diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000000..ca5ce76041
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: ❓ Ask a question
+    url: https://github.com/open-policy-agent/feedback/discussions
+    about: Community Support Forum
\ No newline at end of file
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index d12e73bf32..96b1e0ee0f 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -10,11 +10,11 @@ assignees: ''
 <!-- Thanks for opening an issue to request a feature or file a bug!
 If you provide some basic information, it helps us address problems faster. -->
 
-## What part of OPA would you like to see improved?
+## What is the underlying problem you're trying to solve?
 <!--
-Is there something challenging or frustrating about OPA that you are trying to improve?
-Do you want OPA to integrate with another project or tool?
-Why would this improvement make your experience with OPA better?
+By making this change, what are you hoping to improve or fix?
+Why would this change make the OPA experience better?
+Are there any current solutions that are inefficient or frustrating?
 -->
 
 ## Describe the ideal solution
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 2661ab4292..48759a3b76 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -27,3 +27,27 @@ For more information on contributing to OPA see:
   for high-level contributing guidelines and development setup.
 
 -->
+
+### Why the changes in this PR are needed?
+
+<!--
+Include a short description of WHY the changes were made.
+-->
+
+### What are the changes in this PR?
+
+<!--
+Include a short description of WHAT changes were made.
+-->
+
+### Notes to assist PR review:
+
+<!--
+Here you can add information you think will help the reviewer(s).
+-->
+
+### Further comments:
+
+<!--
+Here you can include links to additional resources related to the changes, discuss your solution, other approaches you considered etc.
+-->
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 713957a516..cbe78421db 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -30,20 +30,20 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     - id: go_version
       name: Read go version
-      run: echo "::set-output name=go_version::$(cat .go-version)"
+      run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
 
     - name: Install Go (${{ steps.go_version.outputs.go_version }})
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v4
       with:
         go-version: ${{ steps.go_version.outputs.go_version }}
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,4 +59,4 @@ jobs:
         make build
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index d6181a02eb..1655af9c63 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -8,10 +8,10 @@ on:
 jobs:
   race-detector:
     name: Go Race Detector
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Test with Race Detector
         run: CGO_ENABLED=1 make ci-go-race-detector
@@ -27,28 +27,22 @@ jobs:
 
   native-fuzzer:
     name: Go Fuzzer (native)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - id: go_version
         name: Read go version
-        run: echo "::set-output name=go_version::$(cat .go-version)"
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
 
       - name: Install Go (${{ steps.go_version.outputs.go_version }})
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ steps.go_version.outputs.go_version }}
 
-      - name: Install gotip
-        run: |
-          go install golang.org/dl/gotip@latest
-          gotip download
-          gotip version
-
-      - name: gotip test -fuzz
-        run: gotip test ./ast -fuzz FuzzParseStatementsAndCompileModules -fuzztime 1h -v -run '^$'
+      - name: go test -fuzz
+        run: go test ./ast -fuzz FuzzParseStatementsAndCompileModules -fuzztime 1h -v -run '^$'
 
       - name: Dump crashers
         if: ${{ failure() }}
@@ -63,26 +57,18 @@ jobs:
           status: ${{ job.status }}
           fields: repo,workflow
 
-  fuzzer:
-    name: Go Fuzzer
-    runs-on: ubuntu-latest
+  go-perf:
+    name: Go Perf
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
-
-      - name: Run go-fuzz
-        run: make ci-go-check-fuzz
+        uses: actions/checkout@v3
 
-      - name: Dump crashers
-        if: ${{ failure() }}
-        run: find build/fuzzer/workdir/crashers -name '*.quoted' -print -exec cat {} \;
-
-      - name: Upload Workdir
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v2
-        with:
-          name: workdir
-          path: ./build/fuzzer/workdir
+      - name: Benchmark Test Golang
+        run: make ci-go-perf
+        timeout-minutes: 30
+        env:
+          DOCKER_RUNNING: 0
 
       - name: Slack Notification
         uses: 8398a7/action-slack@v3
@@ -95,10 +81,10 @@ jobs:
 
   go-proxy-check:
     name: Go mod check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Vendor without proxy
         run: make check-go-module
@@ -112,3 +98,87 @@ jobs:
         with:
           status: ${{ job.status }}
           fields: repo,workflow
+
+  trivy-scan-image:
+    name: Trivy security scan image
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code # needed for .trivyignore file
+        uses: actions/checkout@v3
+
+      - run: "docker pull openpolicyagent/opa:edge-static"
+
+      # Equivalent to:
+      # $ trivy image openpolicyagent/opa:edge-static
+      - name: Run Trivy scan on image
+        uses: aquasecurity/trivy-action@0.10.0
+        with:
+          image-ref: 'openpolicyagent/opa:edge-static'
+          format: table
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: os,library
+          severity: CRITICAL,HIGH
+
+      - name: Slack Notification
+        uses: 8398a7/action-slack@v3
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow
+
+  trivy-scan-repo:
+    name: Trivy security scan repo
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      # Equivalent to:
+      # $ trivy fs .
+      - name: Run Trivy scan on repo
+        uses: aquasecurity/trivy-action@0.10.0
+        with:
+          scan-type: fs
+          format: table
+          exit-code: '1'
+          ignore-unfixed: true
+          skip-dirs: vendor/,internal/gqlparser/validator/imported/
+          severity: CRITICAL,HIGH
+
+      - name: Slack Notification
+        uses: 8398a7/action-slack@v3
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow
+
+  govulncheck:
+    name: Go vulnerability check
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v3
+      - id: go_version
+        name: Read go version
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@v4
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./...
+
+      - name: Slack Notification
+        uses: 8398a7/action-slack@v3
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
+        with:
+          status: ${{ job.status }}
+          fields: repo,workflow
diff --git a/.github/workflows/post-merge.yaml b/.github/workflows/post-merge.yaml
index 89cb3ea92b..1acb7f5d05 100644
--- a/.github/workflows/post-merge.yaml
+++ b/.github/workflows/post-merge.yaml
@@ -7,16 +7,16 @@ on:
 
 jobs:
   generate:
-    name: Sync Generated Code
-    runs-on: ubuntu-18.04
+    name: Sync Generated Code and Docs
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
-          token: ${{ secrets.GH_PUSH_TOKEN }}
+          token: ${{ secrets.GH_PUSH_TOKEN }} # required to push to protected branch below
 
       - name: Generate
-        run: make clean generate
+        run: make clean generate docs-generate-cli-docs
 
       - name: Commit & Push
         shell: bash
@@ -45,13 +45,34 @@ jobs:
             echo "No generated changes to push!"
           fi
 
+          AUTHOR=cli-docs-updater
+          git config user.name ${AUTHOR}
+          git config user.email ${AUTHOR}@github.com
+
+          # Prevent looping if the build was non-deterministic..
+          CAN_PUSH=1
+          if [[ "$(git log -1 --pretty=format:'%an')" == "${AUTHOR}" ]]; then
+              CAN_PUSH=0
+          fi
+
+          if ./build/commit-cli-docs.sh; then
+            if [[ "${CAN_PUSH}" == "1" ]]; then
+              git push
+            else
+              echo "Previous commit was auto-generated -- Aborting!"
+              exit 1
+            fi
+          else
+            echo "No generated changes to push!"
+          fi
+
   code-coverage:
     name: Update Go Test Coverage
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Unit Test Golang
         run: make ci-go-test-coverage
@@ -59,11 +80,11 @@ jobs:
 
   release-build:
     name: Release Build (linux, windows)
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Build Linux and Windows
         run: make ci-go-ci-build-linux ci-go-ci-build-linux-static ci-go-ci-build-windows
@@ -71,8 +92,15 @@ jobs:
         env:
           TELEMETRY_URL: ${{ secrets.TELEMETRY_URL }}
 
+      - name: Build Linux arm64
+        run: make ci-go-ci-build-linux-static
+        timeout-minutes: 30
+        env:
+          GOARCH: arm64
+          TELEMETRY_URL: ${{ secrets.TELEMETRY_URL }}
+
       - name: Upload binaries
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: always()
         with:
           name: binaries
@@ -84,14 +112,14 @@ jobs:
     needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - id: go_version
         name: Read go version
-        run: echo "::set-output name=go_version::$(cat .go-version)"
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
 
       - name: Install Go (${{ steps.go_version.outputs.go_version }})
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ steps.go_version.outputs.go_version }}
 
@@ -102,7 +130,7 @@ jobs:
           TELEMETRY_URL: ${{ secrets.TELEMETRY_URL }}
 
       - name: Upload binaries (darwin)
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: always()
         with:
           name: binaries
@@ -110,22 +138,25 @@ jobs:
 
   deploy-edge:
     name: Push Edge Release
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     needs: [release-build, release-build-darwin]
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Test
         run: make ci-release-test
         timeout-minutes: 60
 
       - name: Download release binaries
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: binaries
           path: _release
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
       - name: Deploy OPA Edge
         env:
           DOCKER_USER: ${{ secrets.DOCKER_USER }}
@@ -140,11 +171,11 @@ jobs:
 
   deploy-wasm-builder:
     name: Deploy WASM Builder
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Build and Push opa-wasm-builder
         env:
diff --git a/.github/workflows/post-release.yaml b/.github/workflows/post-release.yaml
index 8705e12cec..942f778a4c 100644
--- a/.github/workflows/post-release.yaml
+++ b/.github/workflows/post-release.yaml
@@ -4,14 +4,17 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: none
+
 jobs:
   kick-netlify:
     name: Kick Netlify
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Trigger Netlify Deploy
         env:
           NETLIFY_BUILD_HOOK_URL: ${{ secrets.NETLIFY_BUILD_HOOK_URL }}
         if: ${{ env.NETLIFY_BUILD_HOOK_URL }}
         run: |
-          curl --fail --request POST -d {} ${{ env.NETLIFY_BUILD_HOOK_URL }}
\ No newline at end of file
+          curl --fail --request POST -d {} ${{ env.NETLIFY_BUILD_HOOK_URL }}
diff --git a/.github/workflows/post-tag.yaml b/.github/workflows/post-tag.yaml
index c31aa58218..a73102d6da 100644
--- a/.github/workflows/post-tag.yaml
+++ b/.github/workflows/post-tag.yaml
@@ -8,10 +8,10 @@ on:
 jobs:
   generate:
     name: Generate Code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           token: ${{ secrets.GH_PUSH_TOKEN }}
 
@@ -20,11 +20,11 @@ jobs:
 
   release-build:
     name: Release Build (linux, windows)
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Build Linux and Windows
         run: make ci-go-ci-build-linux ci-go-ci-build-linux-static ci-go-ci-build-windows
@@ -32,8 +32,15 @@ jobs:
         env:
           TELEMETRY_URL: ${{ secrets.TELEMETRY_URL }}
 
+      - name: Build Linux arm64
+        run: make ci-go-ci-build-linux-static
+        timeout-minutes: 30
+        env:
+          GOARCH: arm64
+          TELEMETRY_URL: ${{ secrets.TELEMETRY_URL }}
+
       - name: Upload binaries
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: always()
         with:
           name: binaries
@@ -45,25 +52,25 @@ jobs:
     needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - id: go_version
         name: Read go version
-        run: echo "::set-output name=go_version::$(cat .go-version)"
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
 
       - name: Install Go (${{ steps.go_version.outputs.go_version }})
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ steps.go_version.outputs.go_version }}
 
       - name: Build Darwin
-        run: make ci-build-darwin
+        run: make ci-build-darwin ci-build-darwin-arm64-static
         timeout-minutes: 30
         env:
           TELEMETRY_URL: ${{ secrets.TELEMETRY_URL }}
 
       - name: Upload binaries (darwin)
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: always()
         with:
           name: binaries
@@ -72,21 +79,24 @@ jobs:
   build:
     name: Push Latest Release
     needs: [release-build, release-build-darwin]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Set TAG_NAME in Environment
         # Subsequent jobs will be have the computed tag name
         run: echo "TAG_NAME=${GITHUB_REF##*/}" >> $GITHUB_ENV
 
       - name: Download release binaries
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: binaries
           path: _release
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
       - name: Build and Deploy OPA Docker Images
         id: build-and-deploy
         env:
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index c8921e4e49..12ac7377a0 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -2,21 +2,27 @@ name: PR Check
 
 on: [pull_request]
 
+# When a new revision is pushed to a PR, cancel all in-progress CI runs for that
+# PR. See https://docs.github.com/en/actions/using-jobs/using-concurrency
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # All jobs essentially re-create the `ci-release-test` make target, but are split
   # up for parallel runners for faster PR feedback and a nicer UX.
   generate:
     name: Generate Code
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Generate
         run: make clean generate
 
       - name: Upload generated artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: generated
           path: |
@@ -24,7 +30,7 @@ jobs:
             capabilities.json
 
   go-build:
-    name: Go Build (${{ matrix.os }})
+    name: Go Build (${{ matrix.os }}${{ matrix.arch && format(' {0}', matrix.arch) || '' }})
     runs-on: ${{ matrix.run }}
     needs: generate
     strategy:
@@ -32,39 +38,46 @@ jobs:
       matrix:
         include:
           - os: linux
-            run: ubuntu-18.04
+            run: ubuntu-22.04
             targets: ci-go-ci-build-linux ci-go-ci-build-linux-static
+            arch: amd64
+          - os: linux
+            run: ubuntu-22.04
+            targets: ci-go-ci-build-linux-static
+            arch: arm64
           - os: windows
-            run: ubuntu-18.04
+            run: ubuntu-22.04
             targets: ci-go-ci-build-windows
           - os: darwin
             run: macos-latest
             targets: ci-build-darwin ci-build-darwin-arm64-static
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - id: go_version
         name: Read go version
-        run: echo "::set-output name=go_version::$(cat .go-version)"
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
 
       - name: Install Go (${{ steps.go_version.outputs.go_version }})
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ steps.go_version.outputs.go_version }}
         if: matrix.os == 'darwin'
 
       - name: Download generated artifacts
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: generated
 
       - name: Build
         run: make ${{ matrix.targets }}
+        env:
+          GOARCH: ${{ matrix.arch }}
         timeout-minutes: 30
 
       - name: Upload binaries
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         if: always()
         with:
           name: binaries
@@ -79,24 +92,24 @@ jobs:
       matrix:
         include:
           - os: linux
-            run: ubuntu-18.04
+            run: ubuntu-22.04
           - os: darwin
             run: macos-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - id: go_version
         name: Read go version
-        run: echo "::set-output name=go_version::$(cat .go-version)"
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
 
       - name: Install Go (${{ steps.go_version.outputs.go_version }})
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ steps.go_version.outputs.go_version }}
 
       - name: Download generated artifacts
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: generated
 
@@ -104,34 +117,12 @@ jobs:
         run: make test-coverage
         timeout-minutes: 30
 
-  go-perf:
-    name: Go Perf
-    runs-on: ubuntu-18.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v2
-
-      - name: Benchmark Test Golang
-        run: make ci-go-perf
-        timeout-minutes: 30
-
-  go-quick-fuzz:
-    name: Go quick fuzz
-    runs-on: ubuntu-18.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v2
-
-      - name: Run fuzz check (3m)
-        run: make ci-go-check-fuzz FUZZ_TIME=180
-        timeout-minutes: 30
-
   go-lint:
     name: Go Lint
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Golang Style and Lint Check
         run: make check
@@ -139,63 +130,108 @@ jobs:
 
   wasm:
     name: WASM
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
+    needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - name: Build and Test WASM
+      - name: Check PR for changes to Wasm
+        uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            wasm:
+              - Makefile
+              - 'wasm/**'
+              - 'ast/**'
+              - 'internal/compiler/**'
+              - 'internal/planner/**'
+              - 'internal/wasm/**'
+              - 'test/wasm/**'
+              - 'test/cases/**'
+
+      - name: Download generated artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: generated
+        if: steps.changes.outputs.wasm == 'true'
+
+      - name: Build and Test Wasm
         run: make ci-wasm
         timeout-minutes: 15
+        if: steps.changes.outputs.wasm == 'true'
+
+      - name: Build and Test Wasm SDK
+        run: make ci-go-wasm-sdk-e2e-test
+        timeout-minutes: 30
+        if: steps.changes.outputs.wasm == 'true'
+        env:
+          DOCKER_RUNNING: 0
 
   check-generated:
     name: Check Generated
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
+    needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
+      - name: Download generated artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: generated
 
       - name: Check Working Copy
         run: make ci-check-working-copy
         timeout-minutes: 15
-
-  wasm-go-sdk-e2e:
-    name: OPA Wasm SDK e2e
-    runs-on: ubuntu-18.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v2
-
-      - name: Build and Test Wasm SDK
-        run: make ci-go-wasm-sdk-e2e-test
-        timeout-minutes: 30
+        env:
+          DOCKER_RUNNING: 0
 
   race-detector:
     name: Go Race Detector
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    needs: generate
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
+      - name: Download generated artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: generated
 
       - name: Test with Race Detector
         run: make ci-go-race-detector
+        env:
+          DOCKER_RUNNING: 0
 
   smoke-test-docker-images:
     name: docker image smoke test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs: go-build
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+        with:
+          platforms: arm64
 
       - name: Download release binaries
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: binaries
           path: _release
 
-      - name: Test images
+      - name: Test amd64 images
+        run: make ci-image-smoke-test
+
+      - name: Test arm64 images
         run: make ci-image-smoke-test
+        env:
+          GOARCH: arm64
 
   smoke-test-binaries:
     runs-on: ${{ matrix.os }}
@@ -203,9 +239,9 @@ jobs:
     strategy:
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-22.04
             exec: opa_linux_amd64
-          - os: ubuntu-latest
+          - os: ubuntu-22.04
             exec: opa_linux_amd64_static
             wasm: disabled
           - os: macos-latest
@@ -215,10 +251,10 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Download release binaries
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: binaries
           path: _release
@@ -230,47 +266,60 @@ jobs:
         run: make ci-binary-smoke-test-wasm BINARY=${{ matrix.exec }}
         if: matrix.wasm != 'disabled'
 
-  nodejs-wasm-example:
-    name: npm-opa-wasm
-    runs-on: ubuntu-latest
-    needs: go-build
+  go-version-build:
+    name: Go compat build/test
+    needs: generate
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, macos-latest]
+        version: ["1.18", "1.19"]
     steps:
-      - name: Download release binaries
-        uses: actions/download-artifact@v2
+      - uses: actions/checkout@v3
+      - name: Download generated artifacts
+        uses: actions/download-artifact@v3
         with:
-          name: binaries
-          path: _release
-
-      - name: Prepare OPA
-        run: |
-          ln -s _release/*/opa_linux_amd64 opa
-          chmod +x opa
-          echo $(pwd) >> $GITHUB_PATH
+          name: generated
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ matrix.version }}
+      - run: make build
+        env:
+          DOCKER_RUNNING: 0
+      - run: make go-test
+        env:
+          DOCKER_RUNNING: 0
+
+
+  # Run PR metadata against Rego policies
+  rego-check-pr:
+    name: Rego PR checks
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
 
-      - name: Check out npm-opa-wasm
-        uses: actions/checkout@v2
+      - name: Download OPA
+        uses: open-policy-agent/setup-opa@v2
         with:
-          repository: open-policy-agent/npm-opa-wasm
-          path: npm-opa-wasm
+          version: edge
 
-      - name: Run npm-opa-wasm nodejs-app examples
-        run: |
-          npm install
-          ./e2e.sh
-        working-directory: npm-opa-wasm
+      - name: Test policies
+        run: opa test build/policy
 
-  go-version-build:
-    name: Go compat builds
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - version: "1.16"
-          - version: "1.15"
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v2
+      - name: Ensure proper formatting
+        run: opa fmt --list --fail build/policy
 
-      - name: Build
-        run: make ci-go-ci-build-linux GOVERSION=${{ matrix.version }}
-        timeout-minutes: 30
+      - name: Run policy checks on changed files
+        run: |
+          curl --silent --fail --header 'Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' -o files.json \
+            https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files
+          opa eval --bundle build/policy/ --format values --input files.json \
+            --fail-defined 'data.files.deny[message]'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Show input on failure
+        run: opa eval --input files.json --format pretty input
+        if: ${{ failure() }}
diff --git a/.gitignore b/.gitignore
index faf4e41a76..e6429ce649 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,6 @@ policies
 
 # man pages
 man
+
+# generated when running local website build
+docs/website/.hugo_build.lock
diff --git a/.go-version b/.go-version
index b48f322609..0bd54efd31 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.17
+1.20.4
diff --git a/.golangci.yaml b/.golangci.yaml
index 6286815ef3..5ac97ced90 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -18,11 +18,11 @@ linters:
     - gofmt
     - goimports
     - unused
-    - varcheck
-    - deadcode
     - misspell
+    - tenv
     - typecheck
-    - structcheck
     - staticcheck
     - gosimple
+    - prealloc
+    - unconvert
     # - gosec # too many false positives
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000000..74dc0da0a3
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,35 @@
+# We're not directly using nor running these dependencies, and hence they're not applicable
+#
+# * github.com/satori/go.uuid - used by a dependency that imports containerd... the containerd import
+#   used here is not vulnerable though.
+CVE-2021-3538
+
+# * go.etcd.io/etcd - we don't run etcd as part of the OPA deployment
+CVE-2018-1098
+CVE-2018-1099
+
+# * k8s.io/kubernetes - we don't run kubernetes as part of the OPA deployment
+CVE-2019-1002101
+CVE-2019-11250
+CVE-2019-11253
+CVE-2019-11254
+CVE-2020-8552
+CVE-2020-8554
+CVE-2020-8555
+CVE-2020-8557
+CVE-2020-8558
+CVE-2020-8559
+CVE-2020-8561
+CVE-2020-8562
+CVE-2020-8563
+CVE-2020-8564
+CVE-2020-8565
+CVE-2021-25735
+CVE-2021-25740
+CVE-2021-25741
+
+# * github.com/emicklei/go-restful - we don't use its code in our handlers
+CVE-2022-1996
+
+# github.com/dgrijalva/jwt-go -- vulnerable version used by docker/distribution above
+CVE-2020-26160
diff --git a/ADOPTERS.md b/ADOPTERS.md
index 91c94c9cc6..059842c276 100644
--- a/ADOPTERS.md
+++ b/ADOPTERS.md
@@ -6,6 +6,17 @@
 This is a list of organizations that have spoken publicly about their adoption or
 production users that have added themselves (in alphabetical order):
 
+* [2U, Inc](https://2u.com) has incorporated OPA into their SDLC for both Terraform and Kubernetes deployments.
+  Shift left!
+
+* [Appsflyer](https://www.appsflyer.com/) uses OPA to make consistent
+  authorization decisions by hundreds of microservices for UI and API data
+  access. All authorization decisions are delegated to OPA that is deployed as a
+  central service. The decisions are driven by flexible policy rules that take
+  into consideration data privacy regulations and policies, data consents and
+  application level access permissions. For more information, see the [Appsflyer
+  Engineering Blog post](https://medium.com/appsflyer/authorization-solution-for-microservices-architecture-a2ac0c3c510b).
+
 * [Atlassian](https://www.atlassian.com/) uses OPA in a heterogeneous cloud
   environment for microservice API authorization. OPA is deployed per-host and
   inside of their Slauth (AAA) system. Policies are tagged and categorized
@@ -31,7 +42,7 @@ production users that have added themselves (in alphabetical order):
 
 * [Capital One](https://www.capitalone.com/) uses OPA to enforce a variety of
   admission control policies across their Kubernetes clusters including image
-  registry whitelisting, label requirements, resource requirements, container
+  registry allowlisting, label requirements, resource requirements, container
   privileges, etc. For more information see this talk from [KubeCon US 2018](https://www.youtube.com/watch?v=CDDsjMOtJ-c&t=6m35s)
   and this talk from [OPA Summit 2019](https://www.youtube.com/watch?v=vkvWZuqSk5M).
 
@@ -64,6 +75,11 @@ production users that have added themselves (in alphabetical order):
   OPA-based admission controllers, covering single-tenant environments and hard
   multi-tenancy configurations.
 
+* [Digraph](https://www.getdigraph.com) is a developer-first cloud compliance platform
+  that uses OPA to let security teams detect and resolve non-compliant infrastructure
+  changes before they're deployed to production, and produce audit trails to eliminate
+  manual work and accelerate audit processes like SOC and ISO.
+
 * [Fugue](https://fugue.co) is a cloud security SaaS that uses OPA to
   classify compliance violations and security risks in AWS and Azure
   accounts and generate compliance reports and notifications.
@@ -73,6 +89,19 @@ production users that have added themselves (in alphabetical order):
   RBAC, PV, and Quota resources that are central to the security and operation of
   these clusters. For more information see this talk from [KubeCon US 2019](https://www.youtube.com/watch?v=lYHr_UaHsYQ).
 
+* [Google Cloud](https://cloud.google.com/) uses OPA to validate Google Cloud
+  product's configurations in several products and tools, including
+  [Anthos Config Management](https://cloud.google.com/anthos/config-management),
+  [GKE Policy Automation](https://github.com/google/gke-policy-automation) or
+  [Config Validator](https://github.com/GoogleCloudPlatform/policy-library). See
+  [Creating policy-compliant Google Cloud resources article](https://cloud.google.com/architecture/policy-compliant-resources)
+  for example use cases.
+
+* [Infracost](https://www.infracost.io/) shows cloud cost estimates for Terraform.
+  It uses OPA to enable users to create cost policies, and setup guardrails such
+  as "this change puts the monthly costs above $10K, which is the budget for this
+  product. Consider asking the team lead to review it". See [the docs](https://www.infracost.io/docs/features/cost_policies/) for details.
+
 * [Intuit](https://www.intuit.com/company/) uses OPA as a validating
   and mutating admission controller to implement various security,
   multi-tenancy, and risk management policies across approximately 50
@@ -93,9 +122,9 @@ production users that have added themselves (in alphabetical order):
   AWS resources to generate the final report.
 
 * [Mercari](https://www.mercari.com/) uses OPA to enforce admission control
-  policies in their multi-tenant Kubernetes clusters. It helps maintain 
-  the governance of the cluster, checking that developers are following 
-  the best practices in the admission controller. They also use [confest](https://github.com/open-policy-agent/conftest) to 
+  policies in their multi-tenant Kubernetes clusters. It helps maintain
+  the governance of the cluster, checking that developers are following
+  the best practices in the admission controller. They also use [confest](https://github.com/open-policy-agent/conftest) to
   enforce policies in their CI/CD pipeline.
 
 * [Netflix](https://www.netflix.com) uses OPA as a method of enforcing
@@ -134,6 +163,8 @@ production users that have added themselves (in alphabetical order):
   etc. SAP/Infrabox is used in production within SAP and has several
   external users.
 
+* [Terminus Software](https://terminus.com/) uses OPA for microservice authorization.
+
 * [T-Mobile](https://www.t-mobile.com) uses OPA as a core component for their
   [MagTape](https://github.com/tmobile/magtape/) project that enforces best
   practices and secure configurations across their fleet of Kubernetes
@@ -167,6 +198,18 @@ production users that have added themselves (in alphabetical order):
   [part 1](https://blog.verygoodsecurity.com/posts/building-a-fine-grained-permission-system-in-a-distributed-environment),
   [part 2](https://blog.verygoodsecurity.com/posts/building-a-fine-grained-permissions-system-in-a-distributed-environment).
 
+* [VNG Cloud](https://www.vngcloud.vn/en/home) [Identity and Access Management (IAM)](https://iam.vngcloud.vn/)
+  use OPA as a policy-based decision engine for authorization. IAM provides administrators with fine-grained 
+  access control to VNG Cloud resources and help centralize and manage permissions to access resources. 
+  Specifically, OPA is integrated to evaluate policies to make the decision about denying or allowing incoming requests.
+  
+* [Wiz](https://www.wiz.io/) helps every organization rapidly remove the most critical
+  risks in their cloud estate. It simply connects in minutes, requires zero agents, and
+  automatically correlates the entire security stack to uncover the most pressing issues.
+  Wiz policies leverage Open Policy Agent (OPA) for a unified framework across the
+  cloud-native stack. Whether for configurations, compliance, IaC, and more, OPA enables
+  teams to move faster in the cloud. For more information on how Wiz uses OPA, [contact Wiz](https://www.wiz.io/contact/).
+
 * [Xenit AB](https://www.xenit.se/) uses OPA to implement fine-grained control
   over resource formulation in its managed Kubernetes service as well as several
   customer-specific implementations. For more information, see the Kubernetes Terraform library [OPA Gatekeeper module](https://github.com/XenitAB/terraform-modules/tree/main/modules/kubernetes/opa-gatekeeper) and
@@ -175,7 +218,7 @@ production users that have added themselves (in alphabetical order):
 * [Yelp](https://www.yelp.com/) use OPA and Envoy to enforce authorization policies
   across a fleet of microservices that evolved out of a monolithic architecture.
   For more information see this talk from [KubeCon US 2019](https://www.youtube.com/watch?v=Z6aN3Smt-9M).
-
+  
 In addition, there are several production adopters that prefer to
 remain anonymous.
 
@@ -187,13 +230,13 @@ remain anonymous.
 This is a list of adopters in early stages of production or
 pre-production (in alphabetical order):
 
-* [Aserto](https://www.aserto.com/) is a venture-backed developer API company 
-  that helps developers easily build permissions and roles into their SaaS 
-  applications. Aserto uses OPA as its core engine, and has contributed projects 
-  such as [Open Policy Registry](https://openpolicyregistry.io) and  
-  [OPA Runtime](https://github.com/aserto-dev/runtime) that make it easier for 
+* [Aserto](https://www.aserto.com/) is a venture-backed developer API company
+  that helps developers easily build permissions and roles into their SaaS
+  applications. Aserto uses OPA as its core engine, and has contributed projects
+  such as [Open Policy Registry](https://openpolicyregistry.io) and
+  [OPA Runtime](https://github.com/aserto-dev/runtime) that make it easier for
   developers to incorporate OPA policies and the OPA engine into their applications.
-  
+
 * [Cyral](https://www.cyral.com/) is a venture-funded data security
   company. Still in stealth mode but using OPA to manage and enforce
   fine-grained authorization policies.
@@ -210,6 +253,14 @@ pre-production (in alphabetical order):
   December 2018, ~850 ORY Keto instances were running in a mix of
   pre-production and production environments.
 
+* [Permit.io](https://permit.io) Uses a combination of OPA and OPAL
+  to power fine-grained authorization policies at the core of the Permit.io platform.
+  Permit.io leverages the power of OPA's Rego language,
+  generating new Rego code on the fly from its UI policy editor.
+  The team behind Permit.io contributes to the OPA ecosystem - creating opens-source projects like
+  [OPAL- making OPA event-driven)](https://github.com/permitio/opal)
+  and [OPToggles - sync Frontend with open-policy](https://github.com/permitio/OPToggles).
+
 * [Scalr](https://scalr.com/) is a remote operations backend for Terraform
   that helps users scale their Terraform usage through automation and collaboration.
   [Scalr uses OPA](https://docs.scalr.com/en/latest/opa.html) to validate Terraform
@@ -221,6 +272,10 @@ pre-production (in alphabetical order):
   automated code review, defining access levels or blocking execution of
   unwanted code.
 
+* [Wealthsimple](https://www.wealthsimple.com/) is using OPA to power all authorization checks their microservice ecosystem by leveraging their existing authorization library make the transition to OPA as simple as possible for development teams.
+
+* [Magda](https://github.com/magda-io/magda) is a federated, Kubernetes-based, open-source data catalog system. Working as Magda's central authorisation policy engine, OPA helps not only the API endpoint authorisation. Magda also uses its partial evaluation feature to translate datasets authorisation decisions to other database-specific DSLs (e.g. SQL or Elasticsearch DSL) and use them for dataset authorisation enforcement in different databases.
+
 Other adopters that have gone into production or various stages of
 testing include:
 
@@ -230,4 +285,5 @@ testing include:
 * [State Street Corporation](http://www.statestreet.com/)
 
 If you have adopted OPA and would like to be included in this list,
-feel free to submit a PR.
+feel free to submit a PR updating this file or
+[open an issue](https://github.com/open-policy-agent/opa/issues/new?assignees=&labels=adopt-opa&template=adopt-opa.yaml&title=organization_name+has+adopted+OPA).
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ec4b5f3504..75515bda5c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,2324 @@ project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+## 0.52.0
+
+This release contains some enhancements, bugfixes, and a new builtin function.
+
+### Allow Adding Labels via Discovery
+
+Previously OPA did not allow any updates to the labels provided in the boot configuration via the discovered (ie. service)
+config. This was done to avoid breaking the discovery configuration. But there are use cases where labels can serve as a convenient
+way to pass information that could be used in policies, status updates or decision logs. This change allows
+additional labels to be configured in the service config which are then made available during runtime.
+
+See [the Discovery documentation](https://www.openpolicyagent.org/docs/v0.52.0/management-discovery/#limitations)
+for more details.
+
+Authored by @mjungsbluth.
+
+### New Built-In Function: crypto.hmac.equal
+
+`crypto.hmac.equal` provides a convenient way to compare hashes generated by the MD5, SHA-1, SHA-256 and SHA-512 hashing algorithms.
+
+Below is a real world example of how this built-in function can be utilized. Imagine our server is registered as a
+GitHub webhook which subscribes to certain events on GitHub.com. Now we want to limit requests to those coming from GitHub.
+One of the ways to do that is to first set up a secret token and validate the information. Once we create the token on GitHub,
+we'll set up an environment variable that stores this token and makes it available to OPA via the `opa.runtime` built-in.
+In the case of GitHub webhooks the validation is done by comparing the hash signature received in the `X-Hub-Signature-256`
+header and calculating a hash using the secret token and payload body. The `check_signature` rule implements this logic.
+
+```rego
+package example
+
+import input.attributes.request.http as http_request
+
+allow {
+    http_request.method == "POST"
+    input.parsed_path = ["workflows", "github", "webhooks"]
+    check_signature
+}
+
+check_signature {
+    secret_key := opa.runtime().env.GITHUB_SECRET_KEY
+    hash_body := crypto.hmac.sha256(http_request.raw_body, secret_key)
+    expected_signature := concat("", ["sha256=", hash_body])
+    header_signature = http_request.headers["X-Hub-Signature-256"]
+    crypto.hmac.equal(header_signature, expected_signature)
+}
+```
+
+See [the documentation on the new built-in](https://www.openpolicyagent.org/docs/v0.52.0/policy-reference/#builtin-crypto-cryptohmacequal)
+for all the details.
+
+Authored by @sandokandias.
+
+### Extend Authentication Methods Supported by OCI Downloader
+
+Previously the OCI Downloader had support for only three types of authentication methods, namely `Client TLS Certificates`,
+`Basic Authentication` and `Bearer Token`. This change adds support for other authentication methods such as [AWS Signature](https://www.openpolicyagent.org/docs/v0.52.0/configuration/#aws-signature),
+[GCP Metadata Token](https://www.openpolicyagent.org/docs/v0.52.0/configuration/#gcp-metadata-token). See [the documentation](https://www.openpolicyagent.org/docs/v0.52.0/configuration/#using-private-image-from-oci-repositories)
+for more details.
+
+Authored by @DerGut.
+
+### Update Profiler Output With Number of Generated Expressions
+
+The number of EVAL/REDO counts in the profile result are sometimes difficult to understand. This is mainly due to the
+fact that the compiler rewrites expressions and assigns the same location to each generated expression and the profiler
+keys the counters by the location. To provide more clarity, the profile output now includes the number of generated
+expressions for each given expression thereby helping to better understand the result and also how the evaluation works.
+
+Here is an example of the updated profiler output with the new `NUM GEN EXPR` column:
+
+```ruby
++----------+----------+----------+--------------+-------------+
+|   TIME   | NUM EVAL | NUM REDO | NUM GEN EXPR |  LOCATION   |
++----------+----------+----------+--------------+-------------+
+| 20.291µs | 3        | 3        | 3            | test.rego:7 |
+| 1µs      | 1        | 1        | 1            | test.rego:6 |
+| 2.333µs  | 1        | 1        | 1            | test.rego:5 |
+| 6.333µs  | 1        | 1        | 1            | test.rego:4 |
+| 84.75µs  | 1        | 1        | 1            | data        |
++----------+----------+----------+--------------+-------------+
+```
+
+See [the Profiling documentation](https://www.openpolicyagent.org/docs/v0.52.0/policy-performance/#profiling)
+for more details.
+
+Authored by @ashutosh-narkar.
+
+### Runtime, Tooling, SDK
+
+- bundle: Add ability to load bundles from an arbitrary filesystem ([#5833](https://github.com/open-policy-agent/opa/issues/5833)) authored by @kjothen
+- server: Add a note to explicitly point out if OPA binds to the 0.0.0.0 interface on server initialization ([#5090](https://github.com/open-policy-agent/opa/issues/5090)) authored by @Parsifal-M
+- Include trace and span identifier in decision logs to help with correlating logs and trace data ([#5230](https://github.com/open-policy-agent/opa/issues/5230)) authored by @ashutosh-narkar
+
+### Topdown and Rego
+
+- ast: Disallow partial object rules to have other partial object rule within their immediate extent ([#5855](https://github.com/open-policy-agent/opa/issues/5855)) authored by @johanfylling
+- ast: Disallow multi-value rules to have other rules in their extent ([#5813](https://github.com/open-policy-agent/opa/issues/5813)) authored by @johanfylling
+- ast: Set result of groundness check on indexer's AllRules func so that rule evaluation for complete rules is not skipped ([#5857](https://github.com/open-policy-agent/opa/issues/5857)) authored by @ashutosh-narkar
+- rego: Fix duplicate text in error message during module parsing ([#5837](https://github.com/open-policy-agent/opa/pull/5837)) authored by @TzlilSwimmer123
+- planner: Fix bugs that have an impact on IR ([#5829](https://github.com/open-policy-agent/opa/pull/5829)) and Wasm usage ([#5839](https://github.com/open-policy-agent/opa/pull/5839)) authored by @srenatus
+- ast: Include information about the location of rule value and reference in the AST's JSON representation based on the provided custom parsing options ([#5790](https://github.com/open-policy-agent/opa/issues/5790)) authored by @Trolloldem
+- ast: Fix issue with unset annotation data when custom parsing options provided ([#5826](https://github.com/open-policy-agent/opa/issues/5826)) authored by @charlieegan3
+
+### Docs
+
+- docs/rest-api: Update Compile API docs to include some use-cases ([#5858](https://github.com/open-policy-agent/opa/pull/5858)) authored by @charlieegan3
+- docs/extensions: Add Nondeterministic field to the Rego object initialization in the code example for the Custom Built-in Function section ([#5861](https://github.com/open-policy-agent/opa/pull/5861)) (authored by @RmStorm)
+
+
+### Website + Ecosystem
+
+- Ecosystem:
+  - Reposaur ([#5854](https://github.com/open-policy-agent/opa/pull/5854)) authored by @charlieegan3
+  - Update logo for Torque integration ([#5810](https://github.com/open-policy-agent/opa/pull/5810)) authored by @shirabendor-quali
+
+- Website:
+  - Reorganize the `MISCELLANEOUS` section to improve content navigation ([#4614](https://github.com/open-policy-agent/opa/issues/4614)) authored by @lakhanjindam
+
+### Miscellaneous
+
+- Dependency bumps, notably:
+  - golang from 1.20.2 to 1.20.3
+  - golang.org/x/net from 0.8.0 to 0.9.0
+  - github.com/prometheus/client_golang from 1.14.0 to 1.15.0
+
+
+## 0.51.0
+
+This release contains improvements to monitoring and an assortment of fixes and improvements.
+
+### Monitoring
+
+#### Surface unauthorized request count from OPA HTTP API authz handler via Status API
+
+Currently when OPA's HTTP server rejects requests per
+the [authz policy](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization), 
+this is not accounted for via the management APIs.
+This change adds that count in the metric registry that is
+part of the Status API for more visibility.
+
+([#3378](https://github.com/open-policy-agent/opa/issues/3378)) authored by @ashutosh-narkar.
+
+#### Surface more decision log errors via Status API 
+
+Previously in [5732](https://github.com/open-policy-agent/opa/pull/5732), 
+we updated the decision log plugin to
+surface errors via the Status API. However, in that change
+certain events like encoder errors and log drops due to
+buffer size limits had no metrics associated with them.
+This change adds more metrics for these events so that they
+can be surfaced via the Status API.
+
+([#5637](https://github.com/open-policy-agent/opa/issues/5637)) authored by @ashutosh-narkar.
+
+#### Include truncated HTTP response in logs 
+
+This change updates the client debug log to include
+the full HTTP response in case of non-200 status codes.
+Recording the response in the logs can help to provide
+more information to debug error scenarios.
+
+([#2961](https://github.com/open-policy-agent/opa/issues/2961)) authored by @ashutosh-narkar reported by @gshively11.
+
+### Topdown and Rego
+
+- Wasm: Add native support for `object.union_n` built-in function (authored by @Azanul)
+
+### Fixes
+
+- ast: Properly set the reported location of unused variables in strict-mode errors. ([#5662](https://github.com/open-policy-agent/opa/issues/5662)) authored by @boranx
+- fmt: report wrong arity for built-in functions. ([#5646](https://github.com/open-policy-agent/opa/issues/5646)) authored by @Trolloldem
+- topdown: http.send(): Ensuring intra-query caching consistency. ([#5736](https://github.com/open-policy-agent/opa/issues/5736)) authored by @johanfylling
+- Performance improvements to decision logging.
+  Specifically, by removing superfluous json encoding roundtrip and double work in AST conversion of to-be-logged events. (authored by @srenatus)
+
+### Docs, Website, and Ecosystem
+
+- Fix typo in documentation (authored by @eternaltyro)
+- Update TLS authentication docs (authored by @charlieegan3)
+- Clarification in docs about checksums of Windows executables (authored by @Ronnie-personal)
+- docs: Small fix to context placement in integration (authored by @craigpastro)
+- docs/website: Fix floating navbar anchor issue ([5774](https://github.com/open-policy-agent/opa/issues/5774)) authored by @charlieegan3 reported by @kristiansvalland
+  
+### Miscellaneous
+
+- Update -debug images to use Chainguard images ([5544](https://github.com/open-policy-agent/opa/issues/5544)) (authored by @charlieegan3)
+- Various third-party dependencies were updated.
+
+## 0.50.2
+
+This is a bug fix release that addresses a regression in 0.50.1. 
+This regression impacts policies with rules that, as its else-value, assign a comprehension containing variables.
+Such rules would cause the compilation of the policy to fail with a `rego_unsafe_var_error` error.
+
+E.g. the following policy would fail to compile with a `policy.rego:5: rego_unsafe_var_error: var x is unsafe` error:
+```rego
+package example
+
+p {
+	false
+} else := [x | x := 1]
+```
+
+### Fixes
+
+- ast: Fixing bug where comprehensions in rule else-heads weren't rewritten correctly ([#5771](https://github.com/open-policy-agent/opa/issues/5771)) authored by @johanfylling reported by @davidmdm
+
+## 0.50.1
+
+This is a bug fix release addressing the following issues:
+
+### Fixes
+
+- ast/compile: Guard recursive module equality check. ([#5756](https://github.com/open-policy-agent/opa/issues/5756)) authored by @philipaconrad. 
+  Resolves a performance regression when using large bundles.
+- ast: Relaxing strict-mode check for unused args in else-branching functions ([#5758](https://github.com/open-policy-agent/opa/issues/5758)) authored by @johanfylling reported by @ethanjli.
+
+### Miscellaneous
+
+- Use normalized policy paths as compiler module keys and store IDs (authored by @ashutosh-narkar). 
+  Resolves an issue with bundle loading on Windows.
+
+## 0.50.0
+
+This release contains a mix of new features, bugfixes, security fixes, optimizations and build updates related to
+OPA's published images.
+
+### New Built-in Functions: JSON Schema Verification and Validation
+
+These new built-in functions add functionality to verify and validate JSON Schema ([#5486](https://github.com/open-policy-agent/opa/pull/5486)) (co-authored by @jkulvich and @johanfylling).
+
+- `json.verify_schema`: Checks that the input is a valid JSON schema object
+- `json.match_schema`: Checks that the document matches the JSON schema
+
+See the [documentation](https://www.openpolicyagent.org/docs/v0.50.0/policy-reference/#object) for all details.
+
+### Annotations scoped to `package` carries across modules
+
+`package` scoped schema annotations are now applied across modules instead of only local to the module where
+it's declared  ([#5251](https://github.com/open-policy-agent/opa/issues/5251)) (authored by @johanfylling). This change may cause compile-time errors and behavioural changes to
+type checking when the `schemas` annotation is used, and to rules calling the `rego.metadata.chain()` built-in function:
+
+  - Existing projects with the same package declared in multiple files will trigger a `rego_type_error: package annotation redeclared`
+error _if_ two or more of these are annotated with the `package` scope.
+  - If using the `package` scope, the `schemas` annotation will be applied to type checking also for rules declared in
+another file than the annotation declaration, as long as the package is the same.
+  - The chain of metadata returned by the `rego.metadata.chain()` built-in function will now contain an entry for the
+package even if the annotations are declared in another file, if the scope is `package`.
+
+### Remote bundle URL shorthand for `run` command
+
+To load a remote bundle using `opa run`, the `set` directive can be provided multiple times as shown below:
+```
+ $ opa run -s --set "services.default.url=https://example.com" \
+              --set "bundles.example.service=default" \
+              --set "bundles.example.resource=/bundles/bundle.tar.gz" \
+              --set "bundles.example.persist=true"
+```
+
+The following command can be used as a shorthand to easily start OPA with a remote bundle ([#5674](https://github.com/open-policy-agent/opa/issues/5674)) (authored by @anderseknert):
+```
+$ opa run -s https://example.com/bundles/bundle.tar.gz
+```
+
+### Performance Improvements for `json.patch` Built-in Function
+
+Performance improvements in `json.patch` were achieved with the introduction of a new `EditTree` data structure,
+which is built for applying in-place modifications to an `ast.Term`, and can render the final result of all edits efficiently
+by applying all patches in a JSON-Patch sequence rapidly, and then collapsing all edits at the end with minimal wasted `ast.Term` copying (authored by @philipaconrad).
+For more details and benchmarks refer [#5494](https://github.com/open-policy-agent/opa/pull/5494) and [#5390](https://github.com/open-policy-agent/opa/pull/5390).
+
+### Surface decision log errors via status API
+
+Errors encountered during decision log uploads will now be surfaced via the Status API in addition to being logged. This
+functionality should give users greater visibility into any issues OPA may face while processing, uploading logs etc ([#5637](https://github.com/open-policy-agent/opa/issues/5637)) (authored by @ashutosh-narkar).
+
+See the [documentation](https://www.openpolicyagent.org/docs/v0.50.0/management-status/#status-service-api) for more details.
+
+### OPA Published Images Update
+
+All published OPA images now run with a non-root uid/gid. The `uid:gid` is set to `1000:1000` for all images. As a result
+there is no longer a need for the `-rootless` image variant and hence it will be not be published as part of future releases.
+This change is in line with container security best practices. OPA can still be run with root privileges by explicitly setting the user,
+either with the `--user` argument for `docker run`, or by specifying the `securityContext` in the Kubernetes Pod specification.
+
+
+### Runtime, Tooling, SDK
+
+- server: Support compression of response payloads if HTTP client supports it ([#5310](https://github.com/open-policy-agent/opa/issues/5310)) authored by @AdrianArnautu
+- bundle: Ensure the bundle resulting from merging a set of bundles does not contain `nil` data ([#5703](https://github.com/open-policy-agent/opa/issues/5703))  authored by @anderseknert
+- repl: Use lowercase for repl commands only and keep any provided arguments as-is ([#5229](https://github.com/open-policy-agent/opa/issues/5229)) authored by @Trolloldem
+- metrics: New endpoint `/metrics/alloc_bytes` to show OPA's memory utilization ([#5715](https://github.com/open-policy-agent/opa/pull/5715)) authored by @anderseknert
+- server: When using OPA TLS authorization, authz policy authors will now have access to the client certificates
+presented as part of the TLS connection. This new data will be available under the key `client_certificates` ([#5538](https://github.com/open-policy-agent/opa/issues/5538))  authored by @charlieegan3
+- server: Use streaming implementation of json.Decode rather than using an intermediate buffer for the incoming request ([#5661](https://github.com/open-policy-agent/opa/pull/5661)) authored by @anderseknert
+
+### Topdown and Rego
+
+- ast: Extend compiler `strict` mode check to include unused arguments ([#5602](https://github.com/open-policy-agent/opa/issues/5602)) authored by @boranx. This change may cause
+compile-time errors for policies that have unused arguments in the scope when the `strict` mode is enabled. These
+variables could be replaced with `_` (wildcard) or get cleaned up if they are not intended to be used in the body of the functions.
+- ast: Respect inlined `schemas` annotations even if `--schema` flag isn't used ([#5506](https://github.com/open-policy-agent/opa/issues/5506)) authored by @johanfylling
+- ast: Force type-checker to respect `allow_net` capability when fetching remote schemas ([#5670](https://github.com/open-policy-agent/opa/issues/5670)) authored by @johanfylling
+- ast/parse: Provide custom parsing options that allow location information of AST nodes to be included in their JSON
+representation. This location information can be used by tools that work with the  OPA AST ([#3143](https://github.com/open-policy-agent/opa/issues/3143))  authored by @charlieegan3
+
+### Docs
+
+- docs/policy-reference: Fix typo in policy reference doc ([#5654](https://github.com/open-policy-agent/opa/pull/5654)) authored by @alvarogomez93
+- docs/extensions: Fix sample code provided in the custom built-in implementation example ([#5666](https://github.com/open-policy-agent/opa/pull/5666)) authored by @Ronnie-personal
+- docs/bundles: Clarify delta bundle behavior when it contains an empty list of patch operations ([#5629](https://github.com/open-policy-agent/opa/issues/5629))  authored by @charlieegan3
+- docs/http-api-authz: Update the HTTP API authz tutorial with steps related to proper bundle creation ([#5682](https://github.com/open-policy-agent/opa/pull/5682)) authored by @lamoboos223
+- Fix broken 'future keywords' url link ([#5686](https://github.com/open-policy-agent/opa/pull/5686)) authored by @neelanjan00
+
+
+### Website + Ecosystem
+
+- Ecosystem:
+  - Styra Load ([#5659](https://github.com/open-policy-agent/opa/pull/5659)) authored by @charlieegan3
+
+- Website:
+  - Update OPA documentation search to use Algolia v3 ([#5706](https://github.com/open-policy-agent/opa/pull/5706)) authored by @Parsifal-M
+  - Drop Google Universal Analytics (UA) code as part of Google Analytics 4 migration (authored by @chalin)
+
+### Miscellaneous
+
+- Dependency bumps, notably:
+  - golang from 1.20.1 to 1.20.2
+  - github.com/containerd/containerd from 1.6.16 to 1.6.19
+  - github.com/golang/protobuf from 1.5.2 to 1.5.3
+  - golang.org/x/net from 0.5.0 to 0.8.0
+  - google.golang.org/grpc from 1.52.3 to 1.53.0
+  - OpenTelemetry-related dependencies (#5701)
+
+
+## 0.49.2
+
+This release migrates the [ORAS Go library](oras.land/oras-go/v2) from v1.2.2 to v2.
+The earlier version of the library had a dependency on the [docker](github.com/docker/docker)
+package. That version of the docker package had some reported vulnerabilities such as
+CVE-2022-41716, CVE-2022-41720. The ORAS Go library v2 removes the dependency on the docker package.
+
+## 0.49.1
+
+This is a bug fix release addressing the following Golang security issues:
+
+### Golang security fix CVE-2022-41723
+
+> A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a
+> denial of service from a small number of small requests.
+
+### Golang security fix CVE-2022-41724
+
+> Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records
+> which cause servers and clients, respectively, to panic when attempting to construct responses.
+
+### Golang security fix CVE-2022-41722
+
+> A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could
+> transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative
+> (if invalid) path into an absolute path could enable a directory traversal attack.
+> After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
+
+## 0.49.0
+
+This release focuses on bugfixes and documentation improvements, as well as a few small performance improvements.
+
+### Runtime, Tooling, SDK
+
+- runtime: Update rule index's trie node scalar handling so that numerics compare correctly ([#5585](https://github.com/open-policy-agent/opa/issues/5585)) authored by @ashutosh-narkar reported by @alvarogomez93
+- ast: Improve error information when metadata yaml fails to compile ([#4475](https://github.com/open-policy-agent/opa/issues/4475)) authored and reported by @johanfylling
+- bundle: Retain metadata annotations for Wasm entrypoints during inspection ([#5588](https://github.com/open-policy-agent/opa/issues/5588)) authored and reported by @johanfylling
+- compile: Allow object generating rules to be annotated as entrypoints ([#5577](https://github.com/open-policy-agent/opa/issues/5577)) authored and reported by @johanfylling
+- plugins/discovery: Support for persisting and loading discovery bundle from disk ([#2886](https://github.com/open-policy-agent/opa/issues/2886)) authored by @ashutosh-narkar reported by @anderseknert
+- perf: Use `json.Encode` to avoid extra allocation (authored by @anderseknert)
+- `opa inspect`: Fix prefix error when inspecting bundle from root ([#5503](https://github.com/open-policy-agent/opa/issues/5503)) authored by @harikannan512 reported by @HarshPathakhp
+- topdown: `http.send` to cache responses based on status code ([#5617](https://github.com/open-policy-agent/opa/issues/5617)) authored by @ashutosh-narkar
+- types: Add GoDoc about named types (authored by @wata727)
+- deps: Remove `github.com/pkg/errors` dependency (authored by @Iceber)
+
+
+### Docs
+
+- Update entrypoint documentation ([#5565](https://github.com/open-policy-agent/opa/issues/5565)) authored by @johanfylling reported by @robertgartman
+- Add missing folder argument in bundle build example (authored by @charlieegan3)
+- Clarify `crypto.x509.parse_certificates` docs (authored by @charlieegan3)
+- Added AWS S3 Web Identity Credentials info to tutorial (authored by @vishrana)
+- docs/graphql: non-nullable id argument and typo fix (authored by @philipaconrad)
+
+### Website + Ecosystem
+
+- Ecosystem:
+  - ccbr (authored by @niuzhi)
+
+- Website:
+  - Show prominent warning when viewing old docs (authored by @charlieegan3)
+  - Prevent navbar clipping on narrow screens + sticky nav  (authored by @charlieegan3)
+
+### Miscellaneous
+
+Dependency bumps:
+- build: bump golang 1.19.4 -> 1.19.5 (authored by @yanggangtony)
+- ci: aquasecurity/trivy-action from 0.8.0 to 0.9.0
+- github.com/containerd/containerd from 1.6.15 to 1.6.16
+- google.golang.org/grpc from 1.51.0 to 1.52.3
+
+## 0.48.0
+
+This release rolls in security fixes from recent patch releases, along with
+a number of bugfixes, and a new builtin function.
+
+### Improved error reporting available in `opa eval`
+
+A common frustration when writing policies in OPA is when an error happens,
+causing a rule to unexpectedly return `undefined`. Using
+`--strict-builtin-errors` would allow finding the first error encountered
+during evaluation, but terminates execution immediately.
+
+To improve the debugging experience, it is now possible to display *all* of
+the errors encountered during normal evaluation of a policy, via the new
+`--show-builtin-errors` option.
+
+Consider the following error-filled policy, `multi-error.rego`:
+
+```rego
+package play
+
+this_errors(number) := result {
+        result := number / 0
+}
+
+this_errors_too(number) := result {
+        result := number / 0
+}
+
+res1 := this_errors(1)
+
+res2 := this_errors_too(1)
+```
+
+Using `--strict-builtin-errors`, we would only see the first divide by zero
+error:
+
+    opa eval --strict-builtin-errors -d multi-error.rego data.play
+
+```
+1 error occurred: multi-error.rego:4: eval_builtin_error: div: divide by zero
+```
+
+Using `--show-builtin-errors` shows both divide by zero issues though:
+
+    opa eval --show-builtin-errors -d multi-error.rego data.play -f pretty
+
+```
+2 errors occurred:
+multi-error.rego:4: eval_builtin_error: div: divide by zero
+multi-error.rego:8: eval_builtin_error: div: divide by zero
+```
+
+By showing more errors up front, we hope this will improve the overall
+policy writing experience.
+
+### New Built-in Function: `time.format`
+
+It is now possible to format a time value from nanoseconds to a formatted
+timestamp string via a built-in function. The builtin accepts 3 argument
+formats, each allowing for different options:
+
+ 1. A number representing the nanoseconds since the epoch (UTC).
+ 2. A two-element array of the nanoseconds, and a timezone string.
+ 3. A three-element array of nanoseconds, timezone string, and a layout
+  string (same format as for `time.parse_ns`).
+
+See [the documentation](https://www.openpolicyagent.org/docs/v0.48.0/policy-reference/#builtin-time-timeformat)
+for all details.
+
+Implemented by @burnerlee.
+
+### Optimization in rule indexing
+
+Previously, every time the evaluator looked up a rule in the index, OPA
+performed checks for grounded refs over the entire index *before* looking
+up the rule.
+
+Now, OPA performs all groundedness checks once at index construction time,
+which keeps index lookup times much more consistent as the number of
+indexed rules scales up.
+
+Policies with large numbers of index-ready rules can expect a small
+performance lift, proportional to the number of indexed rules.
+
+### Bundle fetching with AWS Signing Version 4A
+
+AWS has recently developed an extension to SigV4 called Signature Version
+4A (SigV4A) which enables signatures that are valid in more than one AWS
+Region. This new signature method is required for signing multi-region API
+requests, such as Amazon S3 Multi-Region Access Points (MRAP).
+
+OPA now supports this new request signing method for bundle fetching, which
+means that you can use an S3 MRAP as a bundle source. This is configured
+via the new `services[<your_service_name>].credentials.s3_signing.signature_version`
+field.
+
+See the [the documentation](https://www.openpolicyagent.org/docs/v0.48.0/configuration/#aws-signature)
+for more details.
+
+Implemented by @jwineinger
+
+### Runtime
+
+- rego: Check store modules before skipping parsing (authored by @charlieegan3)
+- topdown/rego: Add BuiltinErrorList support to rego package, add to eval command (authored by @charlieegan3)
+- topdown: Fix evaluator's re-wrapping of `NDBCache` errors (authored by @srenatus)
+- Fix potential memory leak from `http.send` in interquery cache (authored by @asleire)
+- ast/parser: Detect function rule head + `contains` keyword ([#5525](https://github.com/open-policy-agent/opa/issues/5525)) authored and reported by @philipaconrad
+- ast/visit: Add `SomeDecl` to visitor walks ([#5480](https://github.com/open-policy-agent/opa/issues/5480)) authored by @srenatus
+- ast/visit: Include `LazyObject` in visitor walks ([#5479](https://github.com/open-policy-agent/opa/issues/5479)) authored by @srenatus reported by @benweint
+
+### Tooling, SDK
+
+- topdown: cache undefined rule evaluations ([#593](https://github.com/open-policy-agent/opa/issues/593)) authored by @edpaget reported by @tsdandall
+- topdown: Specify host verification policy for http redirects ([#5388](https://github.com/open-policy-agent/opa/issues/5388)) authored and reported by @ashutosh-narkar
+- providers/aws: Refactor + Fix 2x Authorization header append issue ([#5472](https://github.com/open-policy-agent/opa/issues/5472)) authored by @philipaconrad reported by @Hiieu
+- Add support to enable ND builtin cache via discovery ([#5457](https://github.com/open-policy-agent/opa/issues/5457)) authored by @ashutosh-narkar reported by @asadali
+- format: Only use ref heads for all rule heads if necessary ([#5449](https://github.com/open-policy-agent/opa/issues/5449)) authored and reported by @srenatus
+- `opa inspect`: Fix path of data namespaces on windows (authored by @shm12)
+- ast+cmd: Only enforcing `schemas` annotations if `--schema` flag is used (authored by @johanfylling)
+- sdk: Allow use of a query tracer (authored by @charlieegan3)
+- sdk: Allow use of metrics, profilers, and instrumentation (authored by @charlieegan3)
+- sdk: Return provenance information in Result types (authored by @charlieegan3)
+- sdk: Allow use of StrictBuiltinErrors (authored by @charlieegan3)
+- Allow print calls in IR (authored by @anderseknert)
+- tester/runner: Fix panic'ing case in utility function ([#5496](https://github.com/open-policy-agent/opa/issues/5496)) authored and reported by @philipaconrad
+
+### Docs
+
+- Community page updates (authored by @anderseknert)
+- Update Hugo version, update deprecated Page fields (authored by @charlieegan3)
+- docs: Update TLS-based Authentication Example ([#5521](https://github.com/open-policy-agent/opa/issues/5521)) authored by @charlieegan3 reported by @jjthom87
+- docs: Update opa eval flags to link to bundle docs (authored by @charlieegan3)
+- docs: Make SDK first option for Go integraton (authored by @anderseknert)
+- docs: Fix typo on Policy Language page.  (authored by @mcdonagj)
+- docs/integrations: Update kubescape repo links (authored by @dwertent)
+- docs/oci: Corrected config section (authored by @ogazitt)
+- website/frontpage: Update Learn More links (authored by @pauly4it)
+
+- integrations.yaml: Ensure inventors listed in organizations (authored by @anderseknert)
+- integrations: Fix malformed inventors item (authored by @anderseknert)
+- Add Digraph to ADOPTERS.md (authored by @jamesphlewis)
+
+### Miscellaneous
+
+- Remove changelog maintainer mention filter (authored by @anderseknert)
+- Chore: Fix len check in the `ast/visit_test` error message (authored by @boranx)
+- `opa inspect`: Fix wrong windows bundle tar files path separator (authored by @shm12)
+- Add CHANGELOG.md to website build triggers (authored by @srenatus)
+
+Dependency bumps:
+- Golang 1.19.3 -> 1.19.4
+- github.com/containerd/containerd from 1.6.10 -> 1.6.15
+- github.com/dgraph-io/badger/v3
+- golang.org/x/net to 0.5.0
+- json5 and postcss-modules
+- oras.land/oras-go from 1.2.1 -> 1.2.2
+
+CI/Distribution fixes:
+- Update base images for non debug builds (authored by @charlieegan3)
+- Remove deprecated linters in golangci config (authored by @yanggangtony)
+
+## 0.47.4
+
+This is a bug fix release addressing a panic in `opa test`.
+
+ - tester/runner: Fix panic'ing case in utility function. ([#5496](https://github.com/open-policy-agent/opa/issues/5496)) authored by @philipaconrad
+
+## 0.47.3
+
+This is a bug fix release addressing an issue that prevented OPA from fetching bundles stored in S3 buckets.
+
+ - providers/aws: Refactor + fix 2x Authorization header append issue. ([#5472](https://github.com/open-policy-agent/opa/issues/5472)) authored by @philipaconrad, reported by @Hiieu
+
+## 0.47.2 and 0.46.3
+
+This is a second security fix to address CVE-2022-41717/GO-2022-1144.
+
+We previously believed that upgrading the Golang version and its stdlib would be sufficient
+to address the problem. It turns out we also need to bump the x/net dependency to v0.4.0.,
+a version that hadn't existed when v0.46.2 was released.
+
+This release bumps the golang.org/x/net dependency to v0.4.0, and contains no other
+changes over v0.46.2.
+
+Note that the affected code is OPA's HTTP server. So if you're using OPA as a Golang library,
+or if your confident that your OPA's HTTP interface is protected by other means (as it should
+be -- not exposed to the public internet), you're OK.
+
+## 0.47.1 and 0.46.2
+
+This is a bug fix release addressing two issues: one security issue, and one bug
+related to formatting backwards-compatibility.
+
+### Golang security fix CVE-2022-41717
+
+> An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.
+
+Since we advise against running an OPA service exposed to the general public of the
+internet, potential attackers would be limited to people that are already capable of
+sending direct requests to the OPA service.
+
+### `opa fmt` and backwards compatibility ([#5449](https://github.com/open-policy-agent/opa/issues/5449))
+
+In v0.46.1, it was possible that `opa fmt` would format a rule in such a way that:
+
+1. Before formatting, it was working fine with older OPA versions, and
+2. after formatting, it would only work with OPA version >= 0.46.1.
+
+This backwards incompatibility wasn't intended, and has now been fixed.
+
+## 0.47.0
+
+This release contains a mix of bugfixes, optimizations, and new features.
+
+### New Built-in Function: `object.keys`
+
+It is now possible to conveniently retrieve an object's keys via a built-in function.
+
+Before, you had to resort to constructs like
+
+```rego
+import future.keywords.in
+
+keys[k] {
+    _ = input[k]
+}
+
+allow if "my_key" in keys
+```
+
+Now, you can simply do
+
+```rego
+import future.keywords.in
+
+allow if "my_key" in object.keys(input)
+```
+
+See [the documentation](https://www.openpolicyagent.org/docs/v0.47.0/policy-reference/#builtin-object-objectkeys)
+for all details.
+
+Implemented by @kevinswiber.
+
+### New Built-in Function: AWS Signature v4 Request Signing
+
+It is now possible to use a built-in function to prepare a request with a signature, so that
+it can be used with AWS endpoints that use request signing for authentication.
+
+See this example:
+
+```rego
+req := {"method": "get", "url": "https://examplebucket.s3.amazonaws.com/data"}
+aws_config := {
+    "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+    "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+    "aws_service": "s3",
+    "aws_region": "us-east-1",
+}
+example_verify_resource {
+    resp := http.send(providers.aws.sign_req(req, aws_config, time.now_ns()))
+    # process response from AWS ...
+}
+```
+
+See [the documentation on the new built-in](https://www.openpolicyagent.org/docs/v0.47.0/policy-reference/#providers.aws)
+for all details.
+
+Reported by @jicowan and implemented by @philipaconrad.
+
+### Performance improvements for `object.get` and `in` operator
+
+Before, using `object.get` and `in` had come with a performance penalty that wasn't
+to be expected just from the look of the calls: Since they have been implemented using
+built-in functions (obvious for `object.get`, not obvious for `"admin" in input.user.roles`),
+all of their operands had to be read from the store (if applicable) and converted into
+AST types.
+
+Now, we use shallow references ("lazy objects") for store reads in the evaluator.
+In these two cases, this can bring huge performance improvements, when the object
+argument of these two calls is a ref into the base document (like `data.users`):
+
+```rego
+object.get(data.roles, input.role, [])
+{ "id": 12 } in data.users
+```
+
+### Tooling, SDK, and Runtime
+
+- `opa eval`: Added `--strict` to enable strict code checking in evaluation ([#5182](https://github.com/open-policy-agent/opa/issues/5182)) authored by @Parsifal-M
+- `opa fmt`: Remove `{ true }` block following `else` head
+- `opa fmt`: Generate new wildcards for else and chained function heads in the parser ([#5347](https://github.com/open-policy-agent/opa/issues/5347)). This fixes superfluous
+  introductions of `_1` instead of `_` in when formatting functions that use wildcard arguments, like `f(_) := true`.
+- `opa fmt`: Fix assignment rewrite in else formatting ([#5348](https://github.com/open-policy-agent/opa/issues/5348))
+- OCI Download: Set auth credentials only if needed ([#5212](https://github.com/open-policy-agent/opa/issues/5212)) authored by @carabasdaniel
+- Server: Differentiate between "missing" and "undefined doc" in default decision ([#5344](https://github.com/open-policy-agent/opa/issues/5344))
+
+### Topdown and Rego
+
+- `http.send`: Fix interquery cache size calculation with concurrent requests ([#5359](https://github.com/open-policy-agent/opa/issues/5359)) reported and authored by @asleire
+- `http.send`: Remove socket query param for unix sockets ([#5313](https://github.com/open-policy-agent/opa/issues/5313)) reported and authored by @michivi
+- Annotations: Add type coercion guards to avoid panics ([#5368](https://github.com/open-policy-agent/opa/issues/5368))
+- Compiler: Provide more accurate error locations for `some` with unused vars ([#4238](https://github.com/open-policy-agent/opa/issues/4238))
+- Optimization: Read lazy objects from the store ([#5325](https://github.com/open-policy-agent/opa/issues/5325)). This improves the performance of `x in data.foo` and `object.get(data.bar, ...)` calls significantly.
+- Partial Evaluation: Skip comprehensions when checking eqs in copy propagation ([#5367](https://github.com/open-policy-agent/opa/issues/5367)). This fixes a bug when optimization on bundles would change the outcome of the subsequent evaluation.
+- Parser: Fix else error handling with ref heads -- errors had occurred at a later stage then desired, because an edge case slipped through the earlier check.
+- Planner/IR: Fix ref heads processing -- the CallDynamic optimization wasn't planned properly; a bug introduced with ref heads.
+
+### Documentation
+
+- Builtins: Mention base64 URL encoding specifically ([#5406](https://github.com/open-policy-agent/opa/issues/5406)) reported by @phi1010
+- Builtins: Include behavior with sets in `json.patch` ([#5328](https://github.com/open-policy-agent/opa/issues/5328))
+- Comparison: small fix to table to match sample code and other tables (authored by @anlandu)
+- Builtins: Document reference timestamp behavior for `time.parse_ns`
+- Typo fixes, authored by @deining
+- Golang integration: update example code, move SDK above low-level packages
+
+### Website + Ecosystem
+
+- Ecosystem:
+  - Add Easegress (authored by @localvar)
+  - Add Terraform Cloud
+- Website: Updated Footer Color ([#5254](https://github.com/open-policy-agent/opa/issues/5254)), reported and authored by @UtkarshMishra12
+- Website: Add "canonical" link to latest to help with SEO and ancient pages being returned by search engines.
+- Website: Add experimental "OPA version" badge. (Still needs to be tested more thorougly before advertisting it.)
+
+### Miscellaneous
+
+- Dependency bumps: Notably, we're now using wasmtime-go v3
+- CI fixes:
+  - Move performance tests to nightly tests
+  - CLI: add simple bundle build tests
+  - Nightly: Revamp how we're doing fuzz testing
+
+## 0.46.1
+
+This is  bugfix release to resolve an issue in the release pipeline. Everything else is
+the same as 0.46.0.
+
+## 0.46.0
+
+This release contains a mix of bugfixes, optimizations, and new features.
+
+### New language feature: refs in rule heads
+
+With this version of OPA, we can use a shorthand for defining deeply-nested structures
+in Rego:
+
+Before, we had to use multiple packages, and hence multiple files to define a structure
+like this:
+```json
+{
+  "method": {
+    "get": {
+      "allowed": true
+    }
+    "post": {
+      "allowed": true
+    }
+  }
+}
+```
+
+```rego
+package method.get
+default allowed := false
+allowed { ... }
+```
+
+
+```rego
+package method.post
+default allowed := false
+allowed { ... }
+```
+
+Now, we can define those rules in single package (and file):
+
+```rego
+package method
+import future.keywords.if
+default get.allowed := false
+get.allowed if { ... }
+
+default post.allowed := false
+post.allowed if { ... }
+```
+
+Note that in this example, the use of the future keyword `if` is mandatory
+for backwards-compatibility: without it, `get.allowed` would be interpreted
+as `get["allowed"]`, a definition of a partial set rule.
+
+Currently, variables may only appear in the last part of the rule head:
+
+```rego
+package method
+import future.keywords.if
+
+endpoints[ep].allowed if ep := "/v1/data" # invalid
+repos.get.endpoint[x] if x := "/v1/data" # valid
+```
+
+The valid rule defines this structure:
+```json
+{
+  "method": {
+    "repos": {
+      "get": {
+        "endpoint": {
+          "/v1/data": true
+        }
+      }
+    }
+  }
+}
+```
+
+To define a nested key-value pair, we would use
+
+```rego
+package method
+import future.keywords.if
+
+repos.get.endpoint[x] = y if {
+  x := "/v1/data"
+  y := "example"
+}
+```
+
+Multi-value rules (previously referred to as "partial set rules") that are
+nested like this need to use `contains` future keyword, to differentiate them
+from the "last part is a variable" case mentioned just above:
+
+```rego
+package method
+import future.keywords.contains
+
+repos.get.endpoint contains x if x := "/v1/data"
+```
+
+This rule defines the same structure, but with multiple values instead of a key:
+```json
+{
+  "method": {
+    "repos": {
+      "get": {
+        "endpoint": ["/v1/data"]
+      }
+    }
+  }
+}
+```
+
+To ensure that it's safe to build OPA policies for older OPA versions, a new
+capabilities field was introduced: "features". It's a free-form string array:
+
+```json
+{
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
+```
+
+If this key is not present, the compiler will reject ref-heads. This could be
+case when building bundles for older OPA version using their capabilities.
+
+
+### Entrypoint annotations in rule metadata
+
+It is now possible to annotate a rule with `entrypoint: true`, and it will
+automatically be picked up by the tooling that expected `--entrypoint` (`-e`)
+parameters before.
+
+For example, to build this rego policy into a wasm module, you had to pass
+an entrypoint:
+
+```rego
+package test
+allow {
+    input.x
+}
+```
+- `opa build --target wasm --entrypoint test/allow policy.rego`
+
+With the annotation:
+```rego
+package test
+
+# METADATA
+# entrypoint: true
+allow {
+    input.x
+}
+```
+- `opa build --target wasm policy.rego`
+
+The places where entrypoints are taken from metadata are:
+
+1. Building optimized bundles
+2. Building Wasm bundles
+3. Building Plan bundles
+4. Using optimization with `opa eval`
+
+Knowing a module's entrypoints can also help in different analysis tasks.
+
+### New Built-in Functon: `graphql.schema_is_valid`
+
+The new built-in allows checking schemas:
+
+```rego
+schema := `
+  extend type User {
+      id: ID!
+  }
+  extend type Product {
+      upc: String!
+  }
+  union _Entity = Product | User
+  extend type Query {
+    entity: _Entity
+  }
+`
+valid_schema_example {
+    graphql.schema_is_valid(schema)
+}
+```
+
+Requested by @olegroom.
+
+### New Built-in Functon: `net.cidr_is_valid`
+
+The new built-in function allows checking if a string is a valid CIDR.
+
+```rego
+valid_cidr_example {
+	net.cidr_is_valid("192.168.0.0/24")
+}
+```
+
+Authored by @ricardomaraschini.
+
+### Tooling, SDK, and Runtime
+
+- `opa build`: exit with failure on empty signing key ([#4972](https://github.com/open-policy-agent/opa/issues/4972)) authored by @Joffref reported by @caldwecr
+- `opa exec`: add `--fail` and `--fail-defined` flags ([#5007](https://github.com/open-policy-agent/opa/issues/5007)) authored by @byronic reported by @phantlantis
+- `opa exec`: convert slashes of explicit bundles (Windows) ([#5134](https://github.com/open-policy-agent/opa/issues/5134)) reported by @peterchenadded
+- `opa test`: check coverage limit range `[0, 100]` ([#5284](https://github.com/open-policy-agent/opa/issues/5284)) authored by @hzliangbin reported by @aholmis
+- `opa build`+`opa check`: respect capabilities for parsing, i.e. future keywords ([#5323](https://github.com/open-policy-agent/opa/issues/5323)) reported by @TheLunaticScripter
+- `opa bench --e2e`: support providing OPA config ([#4899](https://github.com/open-policy-agent/opa/issues/4899))
+- `opa eval`: new explain mode, `--explain=debug`, that includes unifcations in traces (authored by @jaspervdj)
+
+- Decision logs: Allow rule-based dropping of decision log entries ([#3945](https://github.com/open-policy-agent/opa/issues/3945)) authored by @mariusblarsen and @iamatwork
+- Decision Logs: Include the `req_id` attribute in the decision logs ([#5006](https://github.com/open-policy-agent/opa/issues/5006)) reported and authored by @humbertoc-silva
+- Plugins: export OpenTelemetry TracerProvider for use in plugins (authored by @vinhph0906)
+
+
+### Compiler + Topdown
+
+- `graph.reachable_path`: fix issue with missing subpaths ([#4666](https://github.com/open-policy-agent/opa/issues/4666)) authored by @fredallen-wk
+- `http.send`: Ensure `force_cache` attribute ignores `Date` header ([#4960](https://github.com/open-policy-agent/opa/issues/4960)) reported by @bartandacc
+- `with`: Allow replacing functions with rules ([#5299](https://github.com/open-policy-agent/opa/issues/5299))
+- Evaluation: Skip default functions in full extent ([#5202](https://github.com/open-policy-agent/opa/issues/5202)) reported by @ericjkao
+- Evaluation: capture more cases of conflicts in function evaluation ([#5272](https://github.com/open-policy-agent/opa/issues/5272))
+- Rule Indexing: fix incorrect results from indexing `glob.match` even if output is captured ([#5283](https://github.com/open-policy-agent/opa/issues/5283))
+
+- Planner: various correctness fixes: [#5271](https://github.com/open-policy-agent/opa/issues/5271), [#5265](https://github.com/open-policy-agent/opa/issues/5265), [#5252](https://github.com/open-policy-agent/opa/issues/5252)
+
+- Builtins: Refactor registration functions and signatures (authored by @philipaconrad)
+- Compiler: Speed up typechecker when working with Refs (authored by @philipaconrad)
+- Trace: add `UnifyOp` to tracer events (authored by @jaspervdj)
+
+### Documentation
+
+- Envoy Tutorial: use latest proxy_init (v8)
+- Envoy Plugin: Add note about new config param to skip body parsing
+- Policy Reference: Add `semver` examples
+- Contributing Code: Provide some tips for style fixes
+
+### Website + Ecosystem
+
+- Website: Make "outdated version" banner red if looked-at version is ancient
+- Ecosystem: Add CircleCI and Topaz
+
+### Miscellaneous
+
+- Code Cleanup:
+  - Don't use the deprecated `ioutil` functions
+  - Use `t.Setenv` in tests
+  - Use `t.TempDir` to create temporary test directory (authored by @Juneezee)
+  - Linters: add `unconvert` and `tenv`
+- internal/strvals: port helm strvals fix (CLI --set arguments), reported by @pjbgf, helm fix authored by @mattfarina
+- Wasm: Update README
+
+- Dependency bumps, notably:
+  - Golang: 1.19.2 -> 1.19.3
+  - golang.org/x/text 0.3.7 -> 0.4.0
+  - oras.land/oras-go 1.2.0 -> 1.2.1
+
+## 0.45.0
+
+This release contains a mix of bugfixes, optimizations, and new features.
+
+### Improved Decision Logging with `nd_builtin_cache`
+
+OPA has several non-deterministic built-ins, such as `rand.intn` and
+`http.send` that can make debugging policies from decision log results
+a surprisingly tricky and involved process. To improve the situation
+around debugging policies that use those built-ins, OPA now provides
+an opt-in system for caching the inputs and outputs of these built-ins
+during policy evaluation, and can include this information in decision
+log entries.
+
+A new top-level config key is used to enable the non-deterministic
+builtin caching feature, as shown below:
+
+    nd_builtin_cache: true
+
+This data is exposed to OPA's [decision log masking system](https://www.openpolicyagent.org/docs/v0.45.0/management-decision-logs/#masking-sensitive-data)
+under the `/nd_builtin_cache` path, which allows masking or dropping
+sensitive values from decision logs selectively. This can be useful
+in situations where only some information about a non-deterministic
+built-in was needed, or the arguments to the built-in involved
+sensitive data.
+
+To prevent unexpected decision log size growth from non-deterministic
+built-ins like `http.send`, the new cache information is included in
+decision logs on a best-effort basis. If a decision log event exceeds
+the `decision_logs.reporting.upload_size_limit_bytes` limit for an OPA
+instance, OPA will reattempt uploading it, after dropping the non-
+deterministic builtin cache information from the event. This behavior
+will trigger a log error when it happens, and will increment the
+`decision_logs_nd_builtin_cache_dropped` metrics counter, so that it
+will be possible to debug cases where the cache information is unexpectedly
+missing from a decision log entry.
+
+#### Decision Logging Example
+
+To observe the change in decision logging we can run OPA in server mode
+with `nd_builtin_cache` enabled:
+
+```bash
+opa run -s --set=decision_logs.console=true,nd_builtin_cache=true
+```
+
+After sending it the query `x := rand.intn("a", 15)` we should see
+something like the following in the decision logs:
+
+```
+{..., "msg":"Decision Log", "nd_builtin_cache":{"rand.intn":{"[\"a\",15]":3}}, "query":"assign(x, rand.intn(\"a\", 15))", ..., "result":[{"x":3}], ..., "type":"openpolicyagent.org/decision_logs"}
+```
+
+The new information is included under the optional `nd_builtin_cache`
+JSON key, and shows what arguments were provided for each unique
+invocation of `rand.intn`, as well as what the output of that builtin
+call was (in this case, `3`).
+
+If we sent the query `x := rand.intn("a", 15); y := rand.intn("b", 150)"`
+we can see how unique input arguments get recorded in the cache:
+
+```
+{..., "msg":"Decision Log", "nd_builtin_cache":{"rand.intn":{"[\"a\",15]":12,"[\"b\",150]":149}}, "query":"assign(x, rand.intn(\"a\", 15)); assign(y, rand.intn(\"b\", 150))", ..., "result":[{"x":12,"y":149}], ..., "type":"openpolicyagent.org/decision_logs"}
+```
+
+With this information, it's now easier to debug exactly why a particular
+rule is used or why a rule fails when non-deterministic builtins are used in
+a policy.
+
+### New Built-in Function: `regex.replace`
+
+This release introduces a new builtin for regex-based search/replace on
+strings: `regex.replace`.
+
+See [the built-in functions docs for all the details](https://www.openpolicyagent.org/docs/v0.45.0/policy-reference/#builtin-regex-regexreplace)
+
+This implementation fixes [#5162](https://github.com/open-policy-agent/opa/issues/5162) and was authored by @boranx.
+
+### `object.union_n` Optimization
+
+The `object.union_n` builtin allows easily merging together an array of Objects.
+
+Unfortunately, as noted in [#4985](https://github.com/open-policy-agent/opa/issues/4985)
+its implementation generated unnecessary intermediate copies from doing
+pairwise, recursive Object merges. These pairwise merges resulted in poor
+performance for large inputs; in many cases worse than writing the
+equivalent operation in pure Rego.
+
+This release changes the `object.union_n` builtin's implementation to use
+a more efficient merge algorithm that respects the original implementation's
+sequential, left-to-right merging semantics. The `object.union_n` builtin
+now provides a 2-3x improvement in speed and memory efficiency over the pure
+Rego equivalent.
+
+### Tooling, SDK, and Runtime
+
+- cli: Fix doubled CLI hints/errors. ([#5115](https://github.com/open-policy-agent/opa/issues/5115)) authored by @ivanphdz
+- cli/test: Add capabilities flag to test command. (authored by @ivanphdz)
+- fmt: Fix blank lines after multiline expressions. (authored by @jaspervdj)
+- internal/report: Include heap usage in the telemetry report.
+- plugins/logs: Improve error message when decision log chunk size is greater than the upload limit. ([#5155](https://github.com/open-policy-agent/opa/issues/5155))
+- ir: Make the `internal/ir` package public as `ir`.
+
+### Rego
+
+- ast/parser+formatter: Allow 'if' in rule 'else' statements.
+- ast/schema: Add support for recursive json schema elements. ([#5166](https://github.com/open-policy-agent/opa/issues/5166)) authored and reported by @liamg
+- ast/schema: Fix race condition in parsing with reused references.(authored by @liamg)
+- internal/gojsonschema: Fix race condition in `SetAllowNet`. ([#5187](https://github.com/open-policy-agent/opa/issues/5187)) authored and reported by @liamg
+- ast/compiler: Rewrite declared variables in function calls and recursively rewrite local variables in `with` clauses. ([#5148](https://github.com/open-policy-agent/opa/issues/5148)) authored and reported by @liu-du
+- ast: Skip rules when parsing a body (or query) to help improve ambiguous parsing cases.
+
+### Topdown
+
+- topdown/object: Rework `object.union_n` to use in-place merge algorithm. (reported by @charlesdaniels)
+- topdown/jwt_decode_verify: Ensure `exp` and `nbf` fields are numbers when present. ([#5165](https://github.com/open-policy-agent/opa/issues/5165)) authored and reported by @charlieflowers
+- topdown: Fix `InterQueryCache` only dropping one entry when over the size limit. (authored by @vinhph0906)
+- topdown+builtins: Block all ND builtins from partial evaluation.
+- topdown/builtins: Add Rego Object support for GraphQL builtins to improve composability.
+- topdown/json: Fix panic in `json.filter` on empty JSON paths.
+- topdown/sets_bench_test: Add `intersection` builtin tests.
+- topdown/tokens: Protect against nistec panics. ([#5128](https://github.com/open-policy-agent/opa/issues/5218))
+
+### Documentation
+
+- Add IR to integration docs.
+- Added Gloo Edge Tutorial with examples. (authored by @Parsifal-M)
+- Updated examples for CLI commands.
+- Updated section on performance metrics (authored by @hutchins)
+- docs/annotations: Add policy example and a link to the policy reference. ([#4937](https://github.com/open-policy-agent/opa/issues/4937)) authored by @Parsifal-M
+- docs/policy-language: Be more explicit about future keywords.
+- docs/security: Fix token authz example. (authored by @pigletfly)
+- docs: Update generated CLI docs. (authored by @charlieflowers)
+- docs: Update mentions of `#development` to `#contributors`. (authored by @charlieflowers)
+
+### Website + Ecosystem
+
+- website/security: Style improvements. (authored by @orweis)
+
+### Miscellaneous
+
+- ci: Add `prealloc` linter check and linter fixes.
+- ci: Add govulncheck to Nightly CI.
+- build/wasm: Use golang1.16 `go:embed` mechanism.
+- util/backoff: Seed from math/rand source.
+- version: Use `runtime/debug.BuildInfo`.
+
+- Dependency bumps, notably:
+  - build: bump golang 1.19.1 -> 1.19.2
+  - build(deps): bump golang.org/x/net
+  - build(deps): bump internal/gqlparser to v2.5.1
+  - build(deps): bump tj-actions/changed-files from 29.0.3 -> 32.0.0
+  - deps(build): bump wasmtime-go 0.36.0 -> 1.0.0 (authored by @Parsifal-M)
+
+## 0.44.0
+
+This release contains a number of fixes, two new builtins, a few new features,
+and several performance improvements.
+
+### Security Fixes
+
+This release includes the security fixes present in the recent v0.43.1 release,
+which mitigate CVE-2022-36085 in OPA itself, and CVE-2022-27664 and
+CVE-2022-32190 in our Go build tooling.
+
+See the Release Notes for v0.43.1 for more details.
+
+### Set Element Addition Optimization
+
+Rego Set element addition operations did not scale linearly ([#4999](https://github.com/open-policy-agent/opa/pull/4999))
+in the past, and like the Object type before v0.43.0, experienced noticeable
+reallocation/memory movement overheads once the Set grew past 120k-150k elements
+in size.
+
+This release introduces different handling of Set internals during element
+addition operations to avoid pathological reallocation behavior, and allows
+linear performance scaling up into the 500k key range and beyond.
+
+### Set `union` Built-in Optimization
+
+The Set `union` builtin allows applying the union operation to a set of sets.
+
+However, as discovered in [#4979](https://github.com/open-policy-agent/opa/issues/4979),
+its implementation generated unnecessary intermediate copies, which resulted in
+poor performance; in many cases, worse than writing the equivalent operation in
+pure Rego.
+
+This release improves the `union` builtin's implementation, such that only the
+final result set is ever modified, reducing memory allocations and GC pressure.
+The `union` builtin is now about 15-30% faster than the equivalent operation in
+pure Rego.
+
+### New Built-in Functions: `strings.any_prefix_match` and `strings.any_suffix_match`
+
+This release introduces two new builtins, optimized for bulk matching of string
+prefixes and suffixes: `strings.any_prefix_match`, and
+`strings.any_suffix_match`.
+It works with sets and arrays of strings, allowing efficient matching of
+collections of prefixes or suffixes against a target string.
+
+See [the built-in functions docs for all the details](https://www.openpolicyagent.org/docs/v0.42.0/policy-reference/#builtin-strings-stringsany_prefix_match)
+
+This implementation fixes [#4994](https://github.com/open-policy-agent/opa/issues/4994) and was authored by @cube2222.
+
+### Tooling, SDK, and Runtime
+
+- Logger: Allow configuration of the timestamp format ([#2413](https://github.com/open-policy-agent/opa/issues/2413))
+- loader: Add support for fs.FS (authored by @ear7h)
+
+#### Bundles
+
+This release includes several bugfixes and improvements around bundle building:
+
+- cmd: Add optimize flag to OPA eval command to allow building optimized bundles
+- cmd/build+compile: Allow opt-out of dependents gathering to allow compilation of more bundles into WASM ([#5035](https://github.com/open-policy-agent/opa/issues/5035))
+- opa build -t wasm|plan: Fail on unmatched entrypoints ([#3957](https://github.com/open-policy-agent/opa/issues/3957))
+- opa build: Fix bundle mode to work with ignore flag
+- bundle/status: Include bundle size in status information
+- bundle: Remove raw bytes check for lazy bundle loading mode
+
+#### Storage Fixes
+
+This release has performance improvements and bugfixes for the disk storage system:
+
+- storage/disk: Improve handling of in-flight transactions during truncate operations ([#4900](https://github.com/open-policy-agent/opa/issues/4900))
+- storage/inmem: Allow disabling `util.Roundtrip` on Write for improved performance ([#4708](https://github.com/open-policy-agent/opa/issues/4708))
+- storage: Improve multi-bundle data with overlapping roots is handled ([#4998](https://github.com/open-policy-agent/opa/issues/4998)) reported by @sirpi
+- storage: Fix issue with policyID in Truncate calls ([#4958](https://github.com/open-policy-agent/opa/issues/4958)) authored by @martinjoha reported by @martinjoha
+
+#### Rego
+
+- eval+rego: Support caching output of non-deterministic builtins. ([#1514](https://github.com/open-policy-agent/opa/issues/1514))
+
+#### AST and Topdown
+
+The AST and Topdown module received a number of important bugfixes in this release:
+
+- ast/term: Fix multiple-reader race condition for Sets/Objects
+- ast/compile: Respect unsafeBuiltinMap for 'with' replacements
+- ast: Add capacity to array initialization when size is known (authored by @mstrYoda)
+- topdown/object: Fix unchecked error case in `object.union_n` builtin ([#5073](https://github.com/open-policy-agent/opa/issues/5073))
+- topdown/reachable: Fix missing operand type checks. ([#4951](https://github.com/open-policy-agent/opa/issues/4951))
+- topdown/units_parse: Avoid extra decimal places for integers
+- topdown/type+wasm: Fix inconsistent `is_type` return values. ([#4943](https://github.com/open-policy-agent/opa/issues/4943))
+- builtins: Fix inconsistent error messages in `units.parse*`
+- Add query parameter in canonical request of AWS Sigv4 signature to avoid 403 errors from AWS (authored by @sinhaaks)
+
+#### Test Suite
+
+- Add error type to `units.*` builtin test assertions
+- test/e2e/certrefresh: Add `file.Sync()` to eliminate test failures due to slow disk writes
+- topdown/exported_tests: Remove Golang 1.16 x509 exception
+- cmd/bench: Fix port collision in utility function used for E2E testing
+
+### Documentation
+
+- SECURITY: Migrate policy to web site, update content ([#4272](https://github.com/open-policy-agent/opa/issues/4272)) reported by @adoliver
+- Add deprecated flag to all deprecated builtins ([#5072](https://github.com/open-policy-agent/opa/issues/5072))
+- builtins: Update description of `format_int` to say it rounds down
+- docs/policy-reference: Update Rego EBNF grammar (authored by @shaded-enmity)
+- docs/builtins: Fix typo in `semver.compare` ([#5012](https://github.com/open-policy-agent/opa/issues/5012)) reported by @tetsuya28
+- docs: Fix AWS Signature section in Configuration (authored by @pauly4it)
+- docs: Update port and bundle folder for GraphQL tutorial
+- docs: Document that function overloading is unsupported
+- docs: Fixing related_resources annotations example ([#4982](https://github.com/open-policy-agent/opa/issues/4982)) reported by @humbertoc-silva
+- docs: Fixing typo in metadata ([#5018](https://github.com/open-policy-agent/opa/issues/5018)) authored by @cimin0 reported by @cimin0
+
+### Website + Ecosystem
+
+- Update links to opa-kafka-plugin
+- Add OCI documentation (authored by @carabasdaniel)
+- Add article on using OPA for data filtering in Kafka
+- Ecosystem: Add some links to Rönd (authored by @ugho16)
+- Add community integration for Fiber (authored by @mstrYoda)
+- Add Spacelift Integration (authored by @theseanodell)
+- Fix broken link for Minio OPA integration  (authored by @unautre)
+
+- Ecosystem Additions:
+  - cosign (#5040) (authored by @Dentrax)
+
+### Miscellaneous
+
+- Dockerfile: Append root "/" to $PATH ([#5003](https://github.com/open-policy-agent/opa/issues/5003)) authored by @matusf reported by @matusf
+- Add VNG Cloud to adopters (authored by @vinhph0906)
+
+- Dependency bumps, notably:
+  - build: bump golang: 1.19 -> 1.19.1
+  - build: use go 1.19, drop go 1.16
+  - build(deps): bump aquasecurity/trivy-action from 0.6.1 -> 0.7.1
+  - build(deps): bump github.com/agnivade/levenshtein from 1.0.1 -> 1.1.1
+  - build(deps): bump github.com/containerd/containerd from 1.6.6 -> 1.6.8
+  - build(deps): bump github.com/go-ini/ini from 1.66.6 -> 1.67.0
+  - build(deps): bump github.com/prometheus/client_golang
+  - build(deps): bump google.golang.org/grpc from 1.48.0 -> 1.49.0
+  - build(deps): bump tj-actions/changed-files from 28.0.0 -> 29.0.3
+
+- Dependency removals:
+  - internal: Vendor gqlparser library ([#5065](https://github.com/open-policy-agent/opa/issues/5065)) reported by @vikstrous2
+
+## 0.43.1
+
+This is a security release fixing the following vulnerabilities:
+
+- CVE-2022-36085: Respect unsafeBuiltinMap for 'with' replacements in the compiler
+
+  See https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr for all details.
+
+- CVE-2022-27664 and CVE-2022-32190.
+
+  Fixed by updating the Go version used in our builds to 1.18.6,
+  see https://groups.google.com/g/golang-announce/c/x49AQzIVX-s.
+  Note that CVE-2022-32190 is most likely not relevant for OPA's usage of net/url.
+  But since these CVEs tend to come up in security assessment tooling regardless,
+  it's better to get it out of the way.
+## 0.43.0
+
+This release contains a number of fixes, enhancements, and performance improvements.
+
+### Object Insertion Optimization
+
+Rego Object insertion operations did not scale linearly ([#4625](https://github.com/open-policy-agent/opa/issues/4625))
+in the past, and experienced noticeable reallocation/memory movement
+overheads once the Object grew past 120k-150k keys in size.
+
+This release introduces different handling of Object internals during insert
+operations to avoid pathological reallocation behavior, and allows linear
+performance scaling up into the 500k key range and beyond.
+
+### Tooling, SDK, and Runtime
+
+- Add lines covered/not covered counts to test coverage report (authored by @FarisR99)
+- Plugins: Status and logs plugins now accept any HTTP 2xx status code (authored by @lvisterin)
+- Runtime: Generalize OS check for MacOS to other Unix-likes (authored by @iamleot)
+
+#### Bundles Fixes
+
+The Bundles system received several bugfixes and performance improvements in this release:
+
+  - Bundle: `opa bundle` command now supports `.yml` files ([#4859](https://github.com/open-policy-agent/opa/issues/4859)) authored by @Joffref reported by @rdrgmnzsakt
+  - Plugins/Bundle: Use unique temporary files for persisting activated bundles to disk ([#4782](https://github.com/open-policy-agent/opa/issues/4782)) authored by @FredrikAppelros reported by @FredrikAppelros
+  - Server: Old policy path is now checked for bundle ownership before update ([#4846](https://github.com/open-policy-agent/opa/issues/4846))
+  - Storage+Bundle: Old bundle data is now cleaned before new bundle activation ([#4940](https://github.com/open-policy-agent/opa/issues/4940))
+  - Bundle: Paths are now normalized before bundle root check occurs to ensure checks are os-independent
+
+#### Storage Fixes
+
+The Storage system received mostly bugfixes, with a notable performance improvement for large bundles in this release:
+
+  - storage/inmem: Speed up bundle activation by avoiding unnecessary read operations ([#4898](https://github.com/open-policy-agent/opa/issues/4898))
+  - storage/inmem: Paths are now created during truncate operations if they did not exist before
+  - storage/disk: Symlinks work with relative paths now ([#4869](https://github.com/open-policy-agent/opa/issues/4869))
+
+### Rego and Topdown
+
+The Rego compiler and runtime environment received a number of bugfixes, and a few new features this release, as well as a notable performance improvement for large Objects
+(covered above).
+
+- AST/Compiler: New method for obtaining parsed, but otherwise unprocessed modules is now available ([#4910](https://github.com/open-policy-agent/opa/issues/4910))
+- `object.subset`: Support array + set combination ([#4858](https://github.com/open-policy-agent/opa/issues/4858)) authored by @x-color
+- Compiler: Prevent erasure of `print()` statements in the compiler via a `WithEnablePrintStatements` option to `compiler.Compiler` and `compiler.optimizer` (authored by @kevinstyra)
+- Topdown fixes:
+  - AST/Builtins: `type_name` builtin now has more precise type metadata and improved docs
+  - Topdown/copypropagation: Ref-based tautologies like `input.a == input.a` are no longer eliminated during the copy-propagation pass ([#4848](https://github.com/open-policy-agent/opa/issues/4848)) reported by @johanneskra
+  - Topdown/parse_units: Use big.Rat for units parsing to avoid floating-point rounding issues on fractional units. ([#4856](https://github.com/open-policy-agent/opa/issues/4856)) reported by @tmos22
+  - Topdown: `is_valid` builtins no longer error, and should always return booleans ([#4760](https://github.com/open-policy-agent/opa/issues/4760))
+  - Topdown: `glob.match` now can be used without delimiters ([#4923](https://github.com/open-policy-agent/opa/issues/4923)) authored by @vinhph0906 reported by @vinhph0906
+
+### Documentation
+
+ - Docs: Add GraphQL API authorization tutorial
+ - Docs/bundles: Add bundle CLI command documentation  ([#3831](https://github.com/open-policy-agent/opa/issues/3831)) authored by @Joffref
+ - Docs/policy-reference: Remove extra quote in Grammar to fix formatting ([#4915](https://github.com/open-policy-agent/opa/issues/4915)) authored by @friedrichsenm reported by @friedrichsenm
+ - Docs/policy-testing: Add missing future.keywords imports ([#4849](https://github.com/open-policy-agent/opa/issues/4849)) reported by @robert-elles
+ - Docs: Add note about counter_server_query_cache_hit metric ([#4389](https://github.com/open-policy-agent/opa/issues/4389))
+ - Docs: Kube tutorial includes updated cert install procedure ([#4902](https://github.com/open-policy-agent/opa/issues/4902)) reported by @Imp
+ - Docs: GraphQL builtins section now includes a note about framework-specific `@directive` definitions in GraphQL schemas
+ - Docs: Add warning about name collisions in older policies from importing 'future.keywords'
+
+### Website + Ecosystem
+
+- Website: Show navbar on smaller devices ([#3353](https://github.com/open-policy-agent/opa/issues/3353)) authored by @Parsifal-M reported by @OBrienCommaJosh
+- Website/frontpage: Update front page examples to use the future.keywords imports
+- Website/live-blocks: Only pass 'import future.keywords' when needed and supported
+- Website/live-blocks: Update codemirror-rego to 1.3.0
+- Website: Fix community page layout/scrolling issues (authored by @mstade)
+
+- Ecosystem Additions:
+  - Rond (authored by @ugho16)
+  - walt.id
+
+### Miscellaneous
+
+- Dependency bumps, notably:
+  - aquasecurity/trivy-action from 0.5.1 to 0.6.1
+  - github.com/sirupsen/logrus from 1.8.1 to 1.9.0
+  - github.com/vektah/gqlparser/v2 from 2.4.5 to 2.4.6
+  - google.golang.org/grpc from 1.47.0 to 1.48.0
+  - terser in /docs/website/scripts/live-blocks
+  - glob-parent in /docs/website/scripts/live-blocks
+- Added GKE Policy Automation to ADOPTERS.md (authored by @mikouaj)
+- Fix minor code unreachability error (authored by @Abirdcfly)
+
+## 0.42.2
+
+This is a bug fix release that addresses the following:
+
+- storage/disk: make symlinks work with relative paths ([#4869](https://github.com/open-policy-agent/opa/issues/4869))
+- bundle: Normalize paths before bundle root check
+
+## 0.42.1
+
+This is a bug fix release that addresses the following:
+
+1. An issue while writing data to the in-memory store at a non-root nonexistent path ([#4855](https://github.com/open-policy-agent/opa/issues/4855)), reported by @wermerb and others.
+2. Policies owned by a bundle could be replaced via the REST API because of a missing bundle scope check ([#4846](https://github.com/open-policy-agent/opa/issues/4846)).
+3. Adds missing `future.keywords` import for the examples in the policy testing section of the docs ([#4849](https://github.com/open-policy-agent/opa/issues/4849)), reported by @robert-elles.
+
+## 0.42.0
+
+This release contains a number of fixes and enhancements.
+
+### New built-in function: `object.subset`
+
+This function checks if a collection is a subset of another collection.
+It works on objects, sets, and arrays.
+
+If both arguments are objects, then the operation is recursive, e.g. `{"c": {"x": {10, 15, 20}}`
+is considered a subset of `{"a": "b", "c": {"x": {10, 15, 20, 25}, "y": "z"}`.
+
+See [the built-in functions docs for all the details](https://www.openpolicyagent.org/docs/v0.42.0/policy-reference/#builtin-object-objectsubset)
+
+This implementation fixes [#4358](https://github.com/open-policy-agent/opa/issues/4358) and was authored by @charlesdaniels.
+
+### New keywords: "contains" and "if"
+
+These new keywords let you increase the expressiveness of your policy code:
+
+Before
+
+```rego
+package authz
+allow { not denied } # `denied` left out for presentation purposes
+
+deny[msg] {
+    count(violations) > 0
+    msg := sprintf("there are %d violations", [count(violations)])
+}
+```
+
+After
+
+```rego
+package authz
+import future.keywords
+
+allow if not denied # one expression only => no { ... } needed!
+
+deny contains msg if {
+    count(violations) > 0
+    msg := sprintf("there are %d violations", [count(violations)])
+}
+```
+
+Note that rule bodies containing only one expression can be abbreviated when using `if`.
+
+To use the new keywords, use `import future.keywords.contains` and `import future.keywords.if`; or
+import all of them at once via `import future.keywords`. When these future imports are present, the
+pretty printer (`opa fmt`) will introduce `contains` and `if` where applicable.
+
+`if` is allowed in all places to separate the rule head from the body, like
+```rego
+response[key] = value if { key := "open", y := "sesame" }
+```
+_but_ not for partial set rules, unless also using `contains`:
+```rego
+deny[msg]         if msg := "forbidden" # INVALID
+deny contains msg if msg := "forbidden" # VALID
+```
+
+### Tooling, SDK, and Runtime
+
+- Plugins:
+  - S3 Plugin: Allow multiple AWS credential providers at once, chained together ([#4791](https://github.com/open-policy-agent/opa/issues/4791)), reported and authored by @abhisek
+  - Discovery Plugin: Check for empty key config ([#4656](https://github.com/open-policy-agent/opa/issues/4656)) reported by @humbertoc-silva
+  - Logs Plugin: Update mechanism to escape field paths ([#4717](https://github.com/open-policy-agent/opa/issues/4717)) reported by @pauly4it
+  - Status Plugin: fix `bundle_failed_load_counter` metric for bundles without revisions ([#4822](https://github.com/open-policy-agent/opa/issues/4822)) reported and authored by @jkbschmid
+- Server: The `system.authz` policy now properly supports the interquery caching of `http.send` calls ([#4829](https://github.com/open-policy-agent/opa/issues/4829)), reported by @HarshPathakhp
+- `opa bench`: Passing `--e2e` makes the benchmark measure the performance of a query including the server's HTTP handlers and their processing.
+- `opa fmt`: Output list _and_ diff changes with `--fail` flag (#4710) (authored by @davidkuridza)
+- Disk Storage: Bundles are now streamed into the disk store, and not extracted completely in-memory ([#4539](https://github.com/open-policy-agent/opa/issues/4539))
+- Golang package `repl`: Add a `WithCapabilities` function (authored by @jaspervdj)
+- SDK: Allow configurable ID (authored by @rakshasa-1729)
+- Windows: User lookups in various code paths have been avoided. They had no use, but are costly, and removing them should increase
+  the performance of any CLI calls (even `opa version`) on Windows. Fixes [#4646](https://github.com/open-policy-agent/opa/issues/4646).
+- Server: Open read storage transaction in Query API handler (not write)
+
+### Rego and Topdown
+
+- Runtime Errors: Fix type error message in `count`, `object.filter`, and `object.remove` built-in functions ([#4767](https://github.com/open-policy-agent/opa/issues/4767))
+- Parser: Remove early MHS return in infix parsing, fixing confusing error messages ([#4672](https://github.com/open-policy-agent/opa/issues/4672)) authored by @philipaconrad
+- AST: Disallow shadowing of called functions in comprehension heads ([#4762](https://github.com/open-policy-agent/opa/issues/4762))
+- Planner/IR: shadow rule funcs if mocking functions ([#4746](https://github.com/open-policy-agent/opa/issues/4746))
+- Compiler: Fix "every" handling in partial eval: by reordering body for safety differently, and correctly plugging its terms on safe ([#4801](https://github.com/open-policy-agent/opa/pull/4801)), reported by @jguenther-va
+- Compiler: fix util.HashMap eq comparison ([#4759](https://github.com/open-policy-agent/opa/pull/4759))
+- Built-ins: use strings.Builder in glob.match() (authored by @charlesdaniels)
+
+### Documentation
+
+- Builtins: Fix documentation of `startswith` and `endswith` (authored by @whme)
+- Kubenetes Tutorial: Remove unused assignement in example ([#4778](https://github.com/open-policy-agent/opa/issues/4778)) authored by @Joffref
+- OCI: Update configuration docs for private images in OCI registries (authored by @carabasdaniel)
+- AWS S3 Signing: Fix profile_credentials docs (authored by @wangli1030)
+
+### Website + Ecosystem
+
+- Add "Edit on GitHub" button to docs ([#3784](https://github.com/open-policy-agent/opa/issues/3784)) authored by @avinashdesireddy
+- Wasm: fix function table markup ([#4664](https://github.com/open-policy-agent/opa/issues/4664))
+- Ecosystem: use location.hash to track open modal ([#4667](https://github.com/open-policy-agent/opa/issues/4667))
+
+Note that website changes like these become effective immediately and are not tied to a release.
+We still use our release notes to record the nice fixes contributed by our community.
+
+- Ecosystem Additions:
+  - Alfred, the self-hosted playground (authored by @dolevf)
+  - Java Spring tutorial (authored by @psevestre)
+  - Pulumi
+
+### Miscellaneous
+
+- Add Terminus to ADOPTERS.md (#4734) ([#4713](https://github.com/open-policy-agent/opa/issues/4713)) reported by @charlieflowers
+- Remove any data attributes not used in the "YAML tests" ([#4813](https://github.com/open-policy-agent/opa/issues/4813))
+- Dependency bumps, notably:
+  - github.com/prometheus/client_golang 1.12.2 ([#4697](https://github.com/open-policy-agent/opa/issues/4697))
+  - github.com/vektah/gqlparser/v2 2.4.5
+- Build process and CI:
+  - Use Trivy for vulnerability scans in code and container images (authored by @JAORMX)
+  - Bump golangci-lint to v1.46.2, fix some issues ([#4765](https://github.com/open-policy-agent/opa/issues/4765))
+  - Remove npm-opa-wasm test
+  - Skip flaky darwin tests on PR runs
+  - Fix flaky oci e2e test ([#4748](https://github.com/open-policy-agent/opa/issues/4748)) authored by @carabasdaniel
+  - Integrate builtin_metadata.json handling in release process ([#4754](https://github.com/open-policy-agent/opa/issues/4754))
+
+
+## 0.41.0
+
+This release contains a number of fixes and enhancements.
+
+### GraphQL Built-in Functions
+
+A new set of built-in functions are now available to validate, parse and verify GraphQL query and schema! Following are
+the new built-ins:
+
+    graphql.is_valid: Checks that a GraphQL query is valid against a given schema
+    graphql.parse: Returns AST objects for a given GraphQL query and schema
+    graphql.parse_and_verify: Returns a boolean indicating success or failure alongside the parsed ASTs for a given GraphQL query and schema
+    graphql.parse_query: Returns an AST object for a GraphQL query
+    graphql.parse_schema: Returns an AST object for a GraphQL schema
+
+### Built-in Function Metadata
+
+Built-in function declarations now support additional metadata to specify name and description for function arguments
+and return values. The metadata can be programmatically consumed by external tools such as IDE plugins. The built-in
+function documentation is created using the new built-in function metadata.
+Check out the new look of the [Built-In Reference](https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions)
+page!
+
+Under the hood, a new file called `builtins_metadata.json` is generated via `make generate` which can be consumed by
+external tools.
+
+### Tooling, SDK, and Runtime
+
+- OCI Downloader: Add logic to skip bundle reloading based on the digest of the OCI artifact ([#4637](https://github.com/open-policy-agent/opa/issues/4637)) authored by @carabasdaniel
+- Bundles: Exclude empty manifest from bundle signature ([#4712](https://github.com/open-policy-agent/opa/issues/4712)) authored by @friedrichsenm reported by @friedrichsenm
+
+### Rego and Topdown
+
+- units.parse: New built-in for parsing standard metric decimal and binary SI units (e.g., K, Ki, M, Mi, G, Gi)
+- format: Fix `opa fmt` location for non-key rules  (#4695) (authored by @jaspervdj)
+- token: Ignore keys of unknown alg when verifying JWTs with JWKS ([#4699](https://github.com/open-policy-agent/opa/issues/4699)) reported by @lenalebt
+
+### Documentation
+
+- Adding Built-in Functions: Add note about `capabilities.json` while creating a new built-in function
+- Policy Reference: Add example for `rego.metadata.rule()` built-in function
+- Policy Reference: Fix grammar for `import` keyword ([#4689](https://github.com/open-policy-agent/opa/issues/4689)) authored by @mmzeeman reported by @mmzeeman
+- Security: Fix command line flag name for file containing the TLS certificate ([#4678](https://github.com/open-policy-agent/opa/issues/4678)) authored by @pramodak reported by @pramodak
+
+### Website + Ecosystem
+
+- Update Kubernetes policy examples on the website to use latest kubernetes schema (`apiVersion`: `admission.k8s.io/v1`) (authored by @vicmarbev)
+- Ecosystem:
+  - Add Sansshell (authored by @sfc-gh-jchacon)
+  - Add Nginx
+
+### Miscellaneous
+
+- Various dependency bumps, notably:
+  - OpenTelemetry-go: 1.6.3 -> 1.7.0
+  - go.uber.org/automaxprocs: 1.4.0 -> 1.5.1
+  - github.com/containerd/containerd: 1.6.2 -> 1.6.4
+  - google.golang.org/grpc: 1.46.0 -> 1.47.0
+  - github.com/bytecodealliance/wasmtime-go: 0.35.0 -> 0.36.0
+  - github.com/vektah/gqlparser/v2: 2.4.3 -> 2.4.4
+- `make test`: Fix "too many open files" issue on Mac OS
+- Remove usage of github.com/pkg/errors package (authored by @imjasonh)
+
+## 0.40.0
+
+This release contains a number of fixes and enhancements.
+
+### Metadata introspection
+
+The _rich metadata_ added in the v0.38.0 release can now be introspected
+from the policies themselves!
+
+    package example
+
+    # METADATA
+    # title: Edits by owner only
+    # description: |
+    #   Only the owner is allowed to edit their data.
+    deny[{"allowed": false, "message": rego.metadata.rule().description}] {
+        input.user != input.owner
+    }
+
+This snippet will evaluate to
+
+    [{
+      "allowed": false,
+      "message": "Only the owner is allowed to edit their data.\n"
+    }]
+
+Both the rule's metadata can be accessed, via `rego.metadata.rule()`, and the
+entire chain of metadata attached to the rule via the various scopes that different
+metadata annotations can have, via `rego.metadata.chain()`.
+
+All the details can be found in the documentation of [these new built-in functions](https://www.openpolicyagent.org/docs/v0.40.0/policy-reference/#rego).
+
+### Function mocking
+
+It is now possible to **mock functions** in tests! Both built-in and non-built-in
+functions can be mocked:
+
+    package authz
+    import data.jwks.cert
+    import data.helpers.extract_token
+
+    allow {
+        [true, _, _] = io.jwt.decode_verify(extract_token(input.headers), {"cert": cert, "iss": "corp.issuer.com"})
+    }
+
+    test_allow {
+        allow
+          with input.headers as []
+          with data.jwks.cert as "mock-cert"
+          with io.jwt.decode_verify as [true, {}, {}] # mocked built-in
+          with extract_token as "my-jwt"              # mocked non-built-in
+    }
+
+For further information about policy testing with data and function mock, see [the Policy Testing docs](https://www.openpolicyagent.org/docs/v0.40.0/policy-testing/#data-and-function-mocking)
+All details about `with` can be found in its [Policy Language section](https://www.openpolicyagent.org/docs/v0.40.0/policy-language/#with-keyword).
+
+### Assignments with `:=`
+
+Remaining restrictions around the use of `:=` in rules and functions have been lifted ([#4555](https://github.com/open-policy-agent/opa/issues/4555)).
+These constructs are now valid:
+
+    check_images(imgs) := x { # function
+      # ...
+    }
+
+    allow := x { # rule
+      # ...
+    }
+
+    response[key] := object { # partial object rule
+      # ...
+    }
+
+In the wake of this, rules may now be "redeclared", i.e. you can use `:=` for more than one rule body:
+
+    deny := x {
+      # body 1
+    }
+    deny := x {
+      # body 2
+    }
+
+This was forbidden before, but didn't serve a real purpose: it would catch trivial-to-catch errors
+like
+
+    p := 1
+    p := 2 # redeclared
+
+But it would do no good in more difficult to debug "multiple assignment" problems like
+
+    p := x {
+      some x in [1, 2, 3]
+    }
+
+### Tooling, SDK, and Runtime
+
+- Status Plugin: Remove activeRevision label on all but one Prometheus metric ([#4584](https://github.com/open-policy-agent/opa/issues/4584)) reported and authored by @costimuraru
+- Status: Include bundle type ("snapshot" or "delta") in status information
+- `opa capabilities`: Expose capabilities through CLI, and allow using versions when passing `--capabilities v0.39.0` to the various commands ([#4236](https://github.com/open-policy-agent/opa/issues/4236)) authored by @IoannisMatzaris <!-- FC -->
+- Logging: Log warnings at WARN level not ERROR, authored by @damienjburks
+- Runtime: Persist activated bundle Etag to store ([#4544](https://github.com/open-policy-agent/opa/issues/4544))
+- `opa eval`: Don't use source locations when formatting partially evaluated output ([#4609](https://github.com/open-policy-agent/opa/issues/4609))
+- `opa inspect`: Fixing an issue where some errors encountered by the inspect command aren't properly reported
+- `opa fmt`: Fix a bug with missing whitespace when formatting multiple `with` statements on one indented line ([#4634](https://github.com/open-policy-agent/opa/issues/4634))
+
+#### Experimental OCI support
+
+When configured to do so, OPA's bundle and discovery plugins will retrieve bundles from **any OCI registry**.
+Please see [the Services Configuration section](https://www.openpolicyagent.org/docs/v0.40.0/configuration/#services)
+for details.
+
+Note that at this point, it's best considered a "feature preview". Be aware of this:
+- Bundles are not cached, but re-retrieved and activated periodically.
+- The persistence directory used for storing retrieved OCI artifacts is not yet managed by OPA,
+  so its content may accumulate. By default, the OCI downloader will use a temporary file location.
+- The documentation on how to push bundles to an OCI repository currently only exists in the development
+  docs, see [OCI.md](https://github.com/open-policy-agent/opa/blob/v0.40.0/docs/devel/OCI.md).
+
+Thanks to @carabasdaniel for starting the work on this!
+
+### Rego and Topdown
+
+- Builtins: Require prefix length for IPv6 in `net.cidr_merge` ([#4596](https://github.com/open-policy-agent/opa/issues/4596)), reported by @alexhu20
+- Builtins: `http.send` can now parse and cache YAML responses, analogous to JSON responses
+- Parser: Guard against invalid domains for "some" and "every", reported by @doyensec
+- Formatting: Don't add 'in' keyword import when 'every' is there ([#4606](https://github.com/open-policy-agent/opa/issues/4606))
+
+### Documentation
+
+- Policy Language: Reorder Universal Quantification content, stress `every` over other constructions ([#4603](https://github.com/open-policy-agent/opa/issues/4603))
+- Language pages: Use assignment operator where it's allowed.
+- SSH Tutorial: Use bundle API
+- Annotations: Update "Custom" annotation section
+- Cloudformation: Fix markup and add warning related to booleans
+- Blogs: mention OAuth2 and OIDC blog posts
+
+### Website + Ecosystem
+
+- Redirect previous patch releases to latest patch release ([#4225](https://github.com/open-policy-agent/opa/issues/4225))
+- Add playground button to navbar
+- Add SRI to static html files
+- Remove right margin on sidebar (#4529) (authored by @orweis)
+- Show yellow banner for old version (#4533)
+- Remove unused variables to avoid error in strict mode(#4534) (authored by @panpan0000)
+- Ecosystem:
+  - Add AWS CloudFormation Hook
+  - Add GKE policy automation
+  - Add permit.io (authored by @ozradi)
+  - Add Magda (authored by @t83714) 
+
+### Miscellaneous
+
+- Workflow: no content permissions for GitHub action 'post-release', authored by @naveensrinivasan
+- Various dependency bumps, notably:
+  - OpenTelemetry-go: 1.6.1 -> 1.6.3
+  - go.uber.org/automaxprocs: 1.4.0 -> 1.5.1
+- Binaries and Docker images are now built using Go 1.18.1.
+- Dockerfile: add source annotation (#4626)
+
+## 0.39.0
+
+This release contains a number of fixes and enhancements.
+
+### Disk Storage
+
+The on-disk storage backend has been fully integrated with the OPA server, and
+can now be enabled via configuration:
+
+```yaml
+storage:
+  disk:
+    directory: /var/opa # put data here
+    auto_create: true   # create directory if it doesn't exist
+    partitions:         # partitioning is important for data storage,
+    - /users/*          # please see the documentation
+```
+
+It is intended to enable the use of OPA in scenarios where the data needed for
+policy evaluation exceeds the available memory.
+
+The on-disk contents will persist among restarts, but should not be used as a
+single source of truth: there are no backup mechanisms, and certain data partitioning
+changes will require a start-over. These are things that may get improved in the
+future.
+
+For all the details, please refer to the [configuration](https://www.openpolicyagent.org/docs/v0.39.0/configuration/#disk-storage)
+and [detailled Disk Storage section](https://www.openpolicyagent.org/docs/v0.39.0/misc-disk/)
+of the documentations.
+
+### Tooling, SDK, and Runtime
+
+- Server: Add warning when `input` attribute is missing in `POST /v1/data` API ([#4386](https://github.com/open-policy-agent/opa/issues/4386)) authored by @aflmp
+- SDK: Support partial evaluation ([#4240](https://github.com/open-policy-agent/opa/pull/4240)), authored by @kroekle; with a fix to avoid using different state (authored by @Iceber)
+- Runtime: Suppress payloads in debug logs for handlers that compress responses (`/metrics` and `/debug/pprof`) (authored by @christian1607)
+- `opa test`: Add file path to failing tests to make debugging failing tests easier ([#4457](https://github.com/open-policy-agent/opa/issues/4457)), authored by @liamg
+- `opa fmt`: avoid whitespace mixed with tabs on `with` statements ([#4376](https://github.com/open-policy-agent/opa/issues/4376)) reported by @tiwood
+- Coverage reporting: Remove duplicates from coverage report ([#4393](https://github.com/open-policy-agent/opa/issues/4393)) reported by @gianna7wu
+- Plugins: Fix broken retry logic in decision logs plugin ([#4486](https://github.com/open-policy-agent/opa/issues/4486)) reported by @iamatwork
+- Plugins: Update regular polling fallback mechanism for downloader
+- Plugins: Support for adding custom parameters and headers for OAuth2 Client Credentials Token request (authored by @srlk)
+- Plugins: Log message on unexpected bundle content type ([#4278](https://github.com/open-policy-agent/opa/issues/4278))
+- Plugins: Mask Authorization header value in debug logs ([#4495](https://github.com/open-policy-agent/opa/issues/4495))
+- Docker images: Use GID 1000 in `-rootless` images ([#4380](https://github.com/open-policy-agent/opa/issues/4380)); also warn when using UID/GID 0.
+- Runtime: change processed file event log level to info
+
+### Rego and Topdown
+
+- Type checker: Skip pattern JSON Schema attribute compilation ([#4426](https://github.com/open-policy-agent/opa/issues/4426)): These are not supported, but could have caused the parsing of a JSON Schema document to fail.
+- Topdown: Copy without modifying expr, fixing a bug that could occur when running multiple partial evaluation requests concurrently.
+- Compiler strict mode: Raise error on unused imports ([#4354](https://github.com/open-policy-agent/opa/issues/4354)) authored by @damienjburks
+- AST: Fix print call rewriting in else rules ([#4489](https://github.com/open-policy-agent/opa/issues/4489))
+- Compiler: Improve error message on missing `with` target ([#4431](https://github.com/open-policy-agent/opa/issues/4431)) reported by @gabrielfern
+- Parser: hint about 'every' future keyword import
+
+### Documentation and Website
+
+- AWS CloudFormation Hook: New tutorial
+- Community: Stretch background so it covers on larger screens ([#4402](https://github.com/open-policy-agent/opa/issues/4402)) authored by @msorens
+- Build: Make local dev and PR preview not build everything ([#4379](https://github.com/open-policy-agent/opa/issues/4379))
+- Philosophy: Grammar fixes (authored by @ajonesiii)
+- README: Add note about Hugo version mismatch errors (authored by @ogazitt)
+- Integrations: Add GraphQL-Graphene (authored by @dolevf), Emissary-Ingress (authored by @tayyabjamadar), rekor-sidekick,
+- Integrations CI: ensure referenced software is listed, and logo file names match; allow SVG logos
+- Envoy: Update policy primer with new control headers
+- Envoy: Update bob_token and alice_token in tutorial (authored by @rokkiter)
+- Envoy: Include new configurable gRPC msg sizes (authored by @emaincourt)
+- Annotations: add missing title to index (authored by @itaysk)
+
+### Miscellaneous
+
+- Various dependency bumps, notably:
+  - OpenTelemetry-go: 1.4.1 -> 1.6.1
+  - Wasmtime-go: 0.34.0 -> 0.35.0
+- Binaries and Docker images are now built using Go 1.18; CI runs build/test for Ubuntu and macos with Go 1.16 and 1.17.
+- CI: remove go-fuzz, use native go 1.18 fuzzer
+
+## 0.38.1
+
+This is a bug fix release that addresses one issue when using `opa test` with the
+`--bundle` (`-b`) flag, and a policy that uses the `every` keyword.
+
+There are no other code changes in this release.
+
+### Fixes
+
+- Compiler: don't raise an error with unused declared+generated vars
+  (every) ([#4420](https://github.com/open-policy-agent/opa/issues/4420)),
+  reported by @kristiansvalland
+
+## 0.38.0
+
+This release contains a number of fixes and enhancements.
+
+It contains one **backwards-incompatible change** to the JSON representation
+of metrics in **Status API** payloads, please see the section below.
+
+### Rich Metadata
+
+It is now possible to annotate Rego policies in a way that can be
+processed programmatically, using _Rich Metadata_.
+
+    # METADATA
+    # title: My rule
+    # description: A rule that determines if x is allowed.
+    # authors:
+    # - Jane Austin <jane@example.com>
+    allow {
+      ...
+    }
+
+The available keys are:
+
+- title
+- description
+- authors
+- organizations
+- related_resources
+- schemas
+- scope
+- custom
+
+Custom annotations can be used to annotate rules, packages, and
+documents with whatever you specifically need, beyond the generic
+keywords.
+
+Annotations can be retrieved using the [Golang library](https://www.openpolicyagent.org/docs/v0.38.0/annotations/#go-api)
+or via the CLI, `opa inspect -a`.
+
+All the details can be found in the documentation on [Annotations](https://www.openpolicyagent.org/docs/v0.38.0/annotations/).
+
+### Every Keyword
+
+A new keyword for explicit iteration is added to Rego: `every`.
+
+It comes in two forms, iterating values, or keys and values, of a
+collection, and asserting that the body evaluates successfully for
+each binding of key and value to the collection's elements:
+
+    every k, v in {"foo": "FOO", "bar": "BAR" } {
+      upper(k) == v
+    }
+
+To use it, `import future.keywords.every` or `future.keywords`.
+
+For further information, please refer to the [Every Keyword docs](https://www.openpolicyagent.org/docs/v0.38.0/policy-language/#every-keyword)
+and the new section on [_FOR SOME and FOR ALL_ in the Intro docs](https://www.openpolicyagent.org/docs/v0.38.0/#for-some-and-for-all).
+
+### Tooling, SDK, and Runtime
+
+- Compile API: add `disableInlining` option ([#4357](https://github.com/open-policy-agent/opa/issues/4357)) reported and fixed by @srlk
+- Status API: add `http_code` to response ([#4259](https://github.com/open-policy-agent/opa/issues/4259)) reported and fixed by @jkbschmid
+- Status plugin: publish experimental bundle-related metrics via prometheus endpoint (authored by @rafaelreinert) -- See [Status Metrics](https://www.openpolicyagent.org/docs/v0.38.0/monitoring/#status-metrics) for details.
+- SDK: don't panic without config ([#4303](https://github.com/open-policy-agent/opa/issues/4303)) authored by @damienjburks
+- Storage: Support index for array appends (for JSON Patch compatibility)
+- `opa deps`: Fix pretty printed output to show virtual documents ([#4342](https://github.com/open-policy-agent/opa/issues/4342))
+
+### Rego and Topdown
+
+- Parser: parse 'with' on 'some x in xs' expression ([#4226](https://github.com/open-policy-agent/opa/issues/4226))
+- AST: hash containers on insert/update ([#4345](https://github.com/open-policy-agent/opa/issues/4345)), fixing a data race reported by @skillcoder
+- Planner: Fix bug related to undefined results in dynamic lookups
+
+### Documentation and Website
+
+- Policy Reference: update EBNF to include "every" and "some x in ..." ([#4216](https://github.com/open-policy-agent/opa/issues/4216))
+- REST API: Update docs on 400 response
+- README: Include Google Analytic Instructions
+- Envoy primer: use variables instead of objects
+- Istio tutorial: expose application to outside traffic
+- New "Community" Webpage (authored by @msorens)
+
+### WebAssembly
+
+- OPA now uses Wasmtime 0.34.0 to evaluate its Wasm modules.
+
+### Miscellaneous
+
+- Build: `make build` now builds without errors (by disabling Wasm) on darwin/arm64 (M1)
+- Various dependency bumps.
+  - OpenTelemetry SDK: 1.4.1
+  - github.com/prometheus/client_golang: 1.12.1
+
+### Backwards incompatible changes
+
+The JSON representation of the Status API's payloads -- both for `GET /v1/status`
+responses and the metrics sent to a remote Status API endpoint -- have changed:
+
+Previously, they had been serialized into JSON using the standard library "encoding/json"
+methods. However, the metrics coming from the Prometheus integration are only available
+in Golang structs generated from Protobuf definitions. For serializing these into JSON,
+the standard library functions are unsuited:
+
+- enums would be converted into numbers,
+- field names would be `snake_case`, not `camelCase`,
+- and NaNs would cause the encoder to panic.
+
+Now, we're using the protobuf ecosystem's `jsonpb` package, to serialize the Prometheus
+metrics into JSON in a way that is compliant with the Protobuf specification.
+
+Concretely, what would before be
+```
+  "metrics": {
+    "prometheus": {
+      "go_gc_duration_seconds": {
+        "help": "A summary of the GC invocation durations.",
+        "metric": [
+          {
+            "summary": {
+              "quantile": [
+                {
+                  "quantile": 0,
+                  "value": 0.000011799
+                },
+                {
+                  "quantile": 0.25,
+                  "value": 0.000011905
+                },
+                {
+                  "quantile": 0.5,
+                  "value": 0.000040002
+                },
+                {
+                  "quantile": 0.75,
+                  "value": 0.000065238
+                },
+                {
+                  "quantile": 1,
+                  "value": 0.000104897
+                }
+              ],
+              "sample_count": 7,
+              "sample_sum": 0.000309117
+            }
+          }
+        ],
+        "name": "go_gc_duration_seconds",
+        "type": 2
+      },
+```
+
+is *now*:
+```
+  "metrics": {
+    "prometheus": {
+      "go_gc_duration_seconds": {
+        "name": "go_gc_duration_seconds",
+        "help": "A summary of the pause duration of garbage collection cycles.",
+        "type": "SUMMARY",
+        "metric": [
+          {
+            "summary": {
+              "sampleCount": "1",
+              "sampleSum": 4.1765e-05,
+              "quantile": [
+                {
+                  "quantile": 0,
+                  "value": 4.1765e-05
+                },
+                {
+                  "quantile": 0.25,
+                  "value": 4.1765e-05
+                },
+                {
+                  "quantile": 0.5,
+                  "value": 4.1765e-05
+                },
+                {
+                  "quantile": 0.75,
+                  "value": 4.1765e-05
+                },
+                {
+                  "quantile": 1,
+                  "value": 4.1765e-05
+                }
+              ]
+            }
+          }
+        ]
+      },
+```
+
+Note that `sample_count` is now `sampleCount`, and the `type` is using the enum's
+string representation, `"SUMMARY"`, not `2`.
+
+Note: For compatibility reasons (the Prometheus golang client doesn't use the V2
+protobuf API), this change uses `jsonpb` and not `protojson`.
+
+## 0.37.2
+
+This is a bugfix release addressing two bugs:
+
+1. A regression introduced in the formatter fix for CVE-2022-23628.
+2. Support indices for appending to an array, conforming to JSON Patch (RFC6902)
+   for patch bundles.
+
+### Miscellaneous
+
+- format: generated vars may have a proper location
+- storage: Support index for array appends
+
+## 0.37.1
+
+This is a bug fix release that reverts the github.com/prometheus/client_golang
+upgrade in v0.37.0. The upgrade exposed an issue in the serialization of Go
+runtime metrics in the Status API
+([#4319](https://github.com/open-policy-agent/opa/issues/4319)).
+
+### Miscellaneous
+
+- Revert "build(deps): bump github.com/prometheus/client_golang (#4307)"
+
+## 0.37.0
+
+This release contains a number of fixes and enhancements.
+
+This is the first release that includes a binary and a docker image for
+`linux/arm64`, `opa_linux_arm64_static` and `openpolicyagent/opa:0.37.0-static`.
+Thanks to @ngraef for contributing the build changes necessary.
+
+### Strict Mode
+
+There have been numerous possible checks in the compiler that fall into this category:
+
+1. They would help avoid common mistakes; **but**
+2. Introducing them would potentially break some uncommon, but legitimate use.
+
+We've thus far refrained from introducing them. **Now**, a new "strict mode"
+allows you to opt-in to these checks, and we encourage you to do so!
+
+With *OPA 1.0*, they will become the new default behaviour.
+
+For more details, [see the docs on _Compiler Strict Mode_](https://www.openpolicyagent.org/docs/v0.37.0/strict/).
+
+### Delta Bundles
+
+Delta bundles provide a more efficient way to make data changes by containing
+*patches to data* instead of snapshots.
+Using them together with [HTTP Long Polling](https://www.openpolicyagent.org/docs/v0.37.0/management-bundles/#http-long-polling),
+you can propagate small changes to bundles without waiting for polling delays.
+
+See [the documentation](https://www.openpolicyagent.org/docs/v0.37.0/management-bundles/#delta-bundles)
+for more details.
+
+
+### Tooling and Runtime
+
+- Bundles bug fix: Roundtrip manifest before hashing to allow changing the manifest
+  and still using signature verification of bundles ([#4233](https://github.com/open-policy-agent/opa/issues/4233)),
+  reported by @CristianJena
+
+- The test runner now also supports custom builtins, when invoked through the Golang
+  interface (authored by @MIA-Deltat1995)
+
+- The compile package and the `opa build` command support a new output format: "plan".
+  It represents a _query plan_, steps needed to take to evaluate a query (with policies).
+  The plan format is a JSON encoding of the intermediate representation (IR) used for
+  compiling queries and policies into Wasm.
+
+  When calling `opa build -t plan ...`, the plan can be found in `plan.json` at the top-
+  level directory of the resulting bundle.tar.gz.
+  [See the documentation for details.](https://www.openpolicyagent.org/docs/v0.37.0/ir/).
+
+- Compiler+Bundles: Metadata to be added to a bundle's manifest can now be provided via `WithMetadata`
+  ([#4289](https://github.com/open-policy-agent/opa/issues/4289)), authored by @marensws, reported by @johanneslarsson
+- Plugins: failures in auth plugin resolution are now output, previously panicked, authored by @jcchavezs
+- Plugins: Fix error when initializing empty decision logging or status plugin ([#4291](https://github.com/open-policy-agent/opa/issues/4291))
+- Bundles: Persisted bundle activation failures are treated like failures with
+  non-persisted bundles ([#3840](https://github.com/open-policy-agent/opa/issues/3840)), reported by @dsoguet
+- Server: `http.send` caching now works in system policy `system.authz` ([#3946](https://github.com/open-policy-agent/opa/issues/3946)),
+  reported by @amrap030.
+- Runtime: Apply credentials masking on `opa.runtime().config` ([#4159](https://github.com/open-policy-agent/opa/issues/4159))
+- `opa test`: removing deprecated code for `--show-failure-line` (`-l`), authored by @damienjburks
+- `opa eval`: add description to all output formats
+- `opa inspect`: unhide command for [bundle inspection](https://www.openpolicyagent.org/docs/v0.37.0/cli/#opa-inspect)
+
+### Rego and Topdown
+
+Built-in function enhancements and fixes:
+
+- `object.union_n`: New built-in for creating the union of more than two objects ([#4012](https://github.com/open-policy-agent/opa/issues/4012)),
+  reported by @eliw00d
+- `graph.reachable_paths`: New built-in to calculate the set of reachable paths in a graph (authored by @justinlindh-wf)
+- `indexof_n`: New built-in function to get all the indexes of a specific substring (or character) from a string (authored by @shuheiktgw)
+- `indexof`: Improved performance (authored by @shuheiktgw)
+- `object.get`: Support nested key array for deeper lookups with default (authored by @charlieegan3)
+- `json.is_valid`: Use Golang's `json.Valid` to avoid unnecessary allocations (authored by @kristiansvalland)
+
+Strict-mode features:
+
+- Add _duplicate imports_ check ([#2698](https://github.com/open-policy-agent/opa/issues/2698)) reported by @mikol
+- _Deprecate_ `any()` and `all()` built-in functions ([#2437](https://github.com/open-policy-agent/opa/issues/2437))
+- Make `input` and `data` reserved keywords ([#2600](https://github.com/open-policy-agent/opa/issues/2600)) reported by @jpeach
+- Add _unused local assignment_ check ([#2514](https://github.com/open-policy-agent/opa/issues/2514))
+
+
+Miscellaneous fixes and enhancements:
+
+- `format`: don't group iterable when one has defaulted location
+- `topdown`: ability to retrieve input and plug bindings in the `Event`, authored by @istalker2
+- `print()` built-in: fix bug when used with `with` modifier and a function call value ([#4227](https://github.com/open-policy-agent/opa/issues/4227))
+- `ast`: don't error when future keyword import is redundant during parsing
+
+### Documentation
+
+- A [new "CLI" docs section](https://www.openpolicyagent.org/docs/v0.37.0/cli/) describes the various
+  OPA CLI commands and their arguments ([#3915](https://github.com/open-policy-agent/opa/issues/3915))
+- Policy Testing: Add reference to rule indexing in the context of test code coverage
+  ([#4170](https://github.com/open-policy-agent/opa/issues/4170)), reported by @ekcs
+- Management: Add hint that S3 regional endpoint should be used with bundles (authored by @danoliver1)
+- Many broken links were fixed, thanks to @phelewski
+- Fix rendering of details: add detail-tab for collapsable markdown (authored by @bugg123)
+
+### WebAssembly
+
+- Add native support for `json.is_valid` built-in function
+  ([#4140](https://github.com/open-policy-agent/opa/issues/4140)), authored by @kristiansvalland
+- Dependencies: bump wasmtime-go from 0.32.0 to 0.33.1
+
+### Miscellaneous
+
+- Publish multi-arch image manifest lists including linux/arm64 ([#2233](https://github.com/open-policy-agent/opa/issues/2233)),
+  authored by @ngraef, reported by @povilasv
+- `logging`: Remove logger `GetFields` function ([#4114](https://github.com/open-policy-agent/opa/issues/4114)),
+  authored by @viovanov
+- Website: add versioned docs for latest version, so when 0.37.0 is released, both
+  https://www.openpolicyagent.org/docs/v0.37.0/ and https://www.openpolicyagent.org/docs/latest
+  contain docs, and 0.37.0 can already be used for stable links to versioned docs pages.
+- Community: Initial draft of the community badges program
+- `make test`: fix "too many open files" issue on Mac OS
+- Various dependency bumps
+
+## 0.36.1
+
+This release includes a number of documentation fixes.
+It also includes the experimental binary for darwin/arm64.
+
+There are no code changes.
+
+### Documentation
+
+- OpenTelemetry: fix configuration example, authored by @rvalkenaers
+- Configuration: fix typo for `tls-cert-refresh-period`, authored by @mattmahn
+- SSH and Sudo authorization: Add missing filename
+- Integration: fix example policy
+
+### Release
+
+- Build darwin/arm64 in post tag workflow
+
+## 0.36.0
+
+This release contains a number of fixes and enhancements.
+
+### OpenTelemetry and opa exec
+
+This release adds OpenTelemetry support to OPA. This makes it possible to emit spans to an OpenTelemetry collector via
+gRPC on both incoming and outgoing (i.e. http.send) calls in the server. See the updated docs on
+[monitoring](https://www.openpolicyagent.org/docs/latest/monitoring/) for more information and configuration options
+([#1469](https://github.com/open-policy-agent/opa/issues/1469)) authored by @[rvalkenaers](https://github.com/rvalkenaers)
+
+This release also adds a new `opa exec` command for doing one-off evaluations of policy against input similar to
+`opa eval`, but using the full capabilities of the server (config file, plugins, etc). This is particularly useful in
+contexts such as CI/CD or when enforcing policy for infrastructure as code, where one might want to run OPA with remote
+bundles and decision logs but without having a running server. See the updated docs on
+[Terraform](https://www.openpolicyagent.org/docs/latest/terraform/) for an example use case.
+([#3525](https://github.com/open-policy-agent/opa/issues/3525))
+
+### Built-in Functions
+
+- Four new functions for working with HMAC (`crypto.hmac.md5`, `crypto.hmac.sha1`, `crypto.hmac.sha256`, and `crypto.hmac.sha512`) was added ([#1740](https://github.com/open-policy-agent/opa/issues/1740)) reported by @[jshaw86](https://github.com/jshaw86)
+- `array.reverse(array)` and `strings.reverse(string)` was added for reversing arrays and strings ([#3736](https://github.com/open-policy-agent/opa/issues/3736)) authored by @[kristiansvalland](https://github.com/kristiansvalland) and @[olamiko](https://github.com/olamiko)
+- The `http.send` built-in function now uses a metric for counting inter-query cache hits ([#4023](https://github.com/open-policy-agent/opa/issues/4023)) authored by @[mirayadav](https://github.com/mirayadav)
+- An overflow issue with dates very far in the future has been fixed in the `time.*` built-in functions ([#4098](https://github.com/open-policy-agent/opa/issues/4098)) reported by @[morgante](https://github.com/morgante)
+
+### Tooling
+
+- A problem with future keyword import of `in` was fixed for `opa fmt` ([#4111](https://github.com/open-policy-agent/opa/issues/4111)) reported by @[keshavprasadms](https://github.com/keshavprasadms)
+- An issue with `opa fmt` when refs contained operators was fixed (authored by @[jaspervdj-luminal](https://github.com/jaspervdj-luminal))
+- Fix file renaming check in optimization using `opa build` (authored by @[davidmarne-wf](https://github.com/davidmarne-wf))
+- The `allow_net` capability was added, allowing setting limits on what hosts can be reached in built-ins like `http.send` and `net.lookup_ip_addr` ([#3665](https://github.com/open-policy-agent/opa/issues/3665))
+
+### Server
+
+- A new credential provider for AWS credential files was added ([#2786](https://github.com/open-policy-agent/opa/issues/2786)) reported by @[rgueldem](https://github.com/rgueldem)
+- The new `--tls-cert-refresh-period` flag can now be provided to `opa run`. If used with a positive duration, such as "5m" (5 minutes),
+  "24h", etc, the server will track the certificate and key files' contents. When their content changes, the certificates will be
+  reloaded ([#2500](https://github.com/open-policy-agent/opa/issues/2500)) reported by @[patoarvizu](https://github.com/patoarvizu)
+- A new `v1/status` endpoint was added, providing the same data as the status plugin would send to a remote endpoint ([#4089](https://github.com/open-policy-agent/opa/issues/4089))
+- The HTTP router of OPA is now exposed to the plugin manager ([#2777](https://github.com/open-policy-agent/opa/issues/2777)) authored by @[bhoriuchi](https://github.com/bhoriuchi) reported by @[mneil](https://github.com/mneil)
+- Calling `print` now works in decision masking policies
+- An unintended switch between long/regular polling on 304 HTTP status was fixed ([#3923](https://github.com/open-policy-agent/opa/issues/3923)) authored by @[floriangasc](https://github.com/floriangasc)
+- The error message about prohibited config in the discovery plugin has been improved
+- The discovery plugin no longer panics in Trigger() if downloader is nil
+- The bundle plugin now ignores service errors for file:// resources
+- The bundle plugin file loader was updated to support directories
+- A timer to HTTP request was added to the downloader
+- The requested_by field in the logging plugin is now optional
+
+### Rego
+
+- The error message raised when using `-` with a number and a set is now more specific (as opposed to the correct usage with two sets, or two numbers) ([#1643](https://github.com/open-policy-agent/opa/issues/1643))
+- Fixed an edge case when using print and arrays in unification ([#4078](https://github.com/open-policy-agent/opa/issues/4078))
+- Improved performance of some array operations by caching an array's groundness bit ([#3679](https://github.com/open-policy-agent/opa/issues/3679))
+- ⚠️ Stricter check of arity in undefined function stage ([#4054](https://github.com/open-policy-agent/opa/issues/4054)).
+  This change will fail evaluation in some unusual cases where it previously would succeed, but these policies should be very uncommon.
+
+  An example policy that previously would succeed but no longer will (wrong arity):
+
+```rego
+package policy
+
+default p = false
+p {
+    x := is_blue()
+    input.bar[x]
+}
+
+is_blue(fruit) = y { # doesn't use fruit
+    y := input.foo
+}
+```
+
+### SDK
+
+- The `opa.runtime()` built-in is now made available to the SDK ([#4050](https://github.com/open-policy-agent/opa/issues/4050) authored by @[oren-zohar](https://github.com/oren-zohar) and @[cmschuetz](https://github.com/cmschuetz)
+- Plugins are now exposed on the SDK object
+- The SDK now supports graceful shutdown ([#3980](https://github.com/open-policy-agent/opa/issues/3980)) reported by @[brianchhun-chime](https://github.com/brianchhun-chime)
+- `print` output is now sent to the configured logger
+
+### Website and Documentation
+
+- All pages in the docs now have a feedback button ([#3664](https://github.com/open-policy-agent/opa/issues/3664)) authored by @[alan-ma](https://github.com/alan-ma)
+- The Kafka docs have been updated to use the new Kafka plugin, and to use the OPA management APIs
+- The Terraform tutorial was updated to use `opa exec` ([#3965](https://github.com/open-policy-agent/opa/issues/3965))
+- The docs on Contributing as well as the Vendor Guidelines have been updated
+- The term "whitelist" has been replaced by "allowlist" across the docs
+- A simple destructuring assignment example was added to the docs
+- The docs have been reviewed on the use of assignment, equality and comparison operators, to make sure they follow best practice
+
+### CI
+
+- SHA256 checksums of CI builds now published to release directory ([#3448](https://github.com/open-policy-agent/opa/issues/3448)) authored by @[johanneslarsson](https://github.com/johanneslarsson) reported by @[raesene](https://github.com/raesene)
+- golangci-lint upgraded to v1.43.0 (authored by @[shuheiktgw](https://github.com/shuheiktgw))
+- The build now creates an executable for darwin/arm64. This should work as expected, but is currently tested in the CI pipeline like the other binaries
+- PRs targeting the [ecosystem](https://www.openpolicyagent.org/docs/latest/ecosystem/) page are now checked for mistakes using Rego policies
+
 ## 0.35.0
 
 This release contains a number of fixes and enhancements.
@@ -1370,7 +3688,7 @@ more information see https://openpolicyagent.org/docs/latest/privacy/.
 #### New `opa build` command
 
 The `opa build` command can now be used to package OPA policy and data files
-into [bundles](https://www.openpolicyagent.org/docs/latest/management/#bundles)
+into [bundles](https://www.openpolicyagent.org/docs/latest/management-bundles)
 that can be easily distributed via HTTP. See `opa build --help` for details.
 This change is backwards incompatible. If you were previously relying on `opa
 build` to compile policies to wasm, you can still do so:
@@ -2305,7 +4623,7 @@ pass `"force_json_decode": true` as in the `http.send` parameters.
 * This release adds support for scoping bundles to specific roots
   under `data`. This allows bundles to be used in conjunction with
   sidecars like `kube-mgmt` that load local data and policy into
-  OPA. See the [Bundles](https://www.openpolicyagent.org/docs/bundles.html)
+  OPA. See the [Bundles](https://www.openpolicyagent.org/docs/latest/management-bundles)
   page for more details.
 
 * This release includes a small but backwards incompatible change to
diff --git a/COMMUNITY_BADGES.md b/COMMUNITY_BADGES.md
new file mode 100644
index 0000000000..9ef99bd74e
--- /dev/null
+++ b/COMMUNITY_BADGES.md
@@ -0,0 +1,67 @@
+# OPA Community Badges
+
+Hello OPA Community Members! We thank you for taking the time to be a part of the community and for all of the work you’ve put in. As thanks, the OPA community now offers badges to recognize your contributions to the community.
+
+As of right now, these badges are simple tokens of appreciation that we will proudly display in the OPA GitHub repository. As the program develops, we will provide digital badges and certificates for members to display on their Linkedin and Twitter accounts.
+
+## Contributor Badge
+
+We appreciate contributions to the OPA project, no matter how big or small. So if you’ve contributed a dozen lines of code or corrected a typo in the docs, let us know!
+
+### Requirements
+
+- 1 Merged PR
+
+## Spokesperson Badge 
+
+For community members that like to create OPA content, share your work to receive the OPA Spokesperson Badge.
+
+### Requirements
+
+One or more pieces of publically posted content such as any of the following (Available for non-vendor related content only):
+
+- Conference Talk
+- Meetup presentation
+- Online Video Recording
+- Technical blog or OPA tutorial 
+
+## Super User Badge 
+
+This badge is for members that know the value of running OPA in production. Add your organization to the ADOPTERS.md file, then share a quick snippet about how OPA is used in your production environment to earn this badge. 
+  
+### Requirements
+
+- Deploy or Support OPA in a production environment
+- Add your organization to the ADOPTERS.md file
+
+### Benefits
+
+- Access to a private OPA Super Users Slack Channel
+- Support writing an OPA CFP to grow your portfolio
+
+## Community Champion Badge
+
+Our OPA Community Champions badges are for active members that want to create a measurable impact in the community. Apply for this badge if you believe in the OPA mission to unify policy authorization and wish to help the OPA community grow and expand.
+
+### Requirements
+
+Actively help and support the OPA community. Some places we will look for contributions are:
+
+- Slack
+- GitHub Discussions 
+- Stack Overflow
+- Meetups
+
+Being a champion in the OPA community can take many shapes and forms; as such, we do not want to limit this award to a static number of posts or comments. Instead, we are looking for members who take an active role in helping to build the community, or we look for members that want to have a more active role. 
+
+### Benefits
+
+- Access to a private OPA Champions Slack Channel
+- Help from the OPA team to assist with community issues
+- Increased support for your OPA projects
+
+## Application Process
+
+To apply for any of the OPA badges, fill out the form at: https://airtable.com/shrrd45fRi7yO2k6i
+
+For any questions, please reach out to peteroneilljr@styra.com or @peteroneilljr in [Slack](https://slack.openpolicyagent.org/).
diff --git a/Dockerfile b/Dockerfile
index 097f95c752..667b7286f2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,20 +6,30 @@ ARG BASE
 
 FROM ${BASE}
 
-# Any non-zero number will do, and unfortunately a named user will not, as k8s
-# pod securityContext runAsNonRoot can't resolve the user ID:
-# https://github.com/kubernetes/kubernetes/issues/40958. Make root (uid 0) when
-# not specified.
-ARG USER=0
+LABEL org.opencontainers.image.authors="Torin Sandall <torinsandall@gmail.com>"
+LABEL org.opencontainers.image.source="https://github.com/open-policy-agent/opa"
+
 
-MAINTAINER Torin Sandall <torinsandall@gmail.com>
+# Temporarily allow us to identify whether running from within an offical
+# Docker image with a "rootless" tag, so that we may print a warning that this image tag
+# will not be published after 0.50.0. Remove after 0.50.0 release.
+ARG OPA_DOCKER_IMAGE_TAG
+ENV OPA_DOCKER_IMAGE_TAG=${OPA_DOCKER_IMAGE_TAG}
 
-# Hack.. https://github.com/moby/moby/issues/37965
-# _Something_ needs to be between the two COPY steps.
+# Any non-zero number will do, and unfortunately a named user will not, as k8s
+# pod securityContext runAsNonRoot can't resolve the user ID:
+# https://github.com/kubernetes/kubernetes/issues/40958.
+ARG USER=1000:1000
 USER ${USER}
 
-ARG BIN=./opa_linux_amd64
-COPY ${BIN} /opa
+# TARGETOS and TARGETARCH are automatic platform args injected by BuildKit
+# https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
+ARG TARGETOS
+ARG TARGETARCH
+ARG BIN_DIR=.
+ARG BIN_SUFFIX=
+COPY ${BIN_DIR}/opa_${TARGETOS}_${TARGETARCH}${BIN_SUFFIX} /opa
+ENV PATH=${PATH}:/
 
 ENTRYPOINT ["/opa"]
 CMD ["run"]
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 3e7c5ef2e6..d773a2d044 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -4,15 +4,20 @@ The following table lists OPA project maintainers and areas of expertise in alph
 
 | Name | GitHub | Email | Organization | Repositories/Area of Expertise | Added/Renewed On |
 | --- | --- | --- | --- | --- | --- |
-| Ash Narkar | @ashutosh-narkar | anarkar4387@gmail.com | Styra | opa, opa-envoy-plugin | 2021-03-29 |
-| Craig Tabita | @ctab | ctab@google.com | Google | gatekeeper, gatekeeper-library, cert-controller  | 2021-03-29 |
-| Max Smythe | @maxsmythe | smythe@google.com | Google | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2021-03-29 |
+| Andrew Peabody | @apeabody | andrewpeabody@google.com | Google | gatekeeper-library | 2023-03-31 |
+| Ash Narkar | @ashutosh-narkar | anarkar4387@gmail.com | Styra | opa, opa-envoy-plugin | 2023-03-31 |
+| Max Smythe | @maxsmythe | smythe@google.com | Google | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2023-03-31 |
+| Nilekh Chaudhari | @nilekhc | nilekhc@gmail.com | Microsoft | gatekeeper-library | 2023-03-31 |
 | Oren Shomron | @shomron | shomron@gmail.com | VMware | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2020-11-13 |
-| Rita Zhang | @ritazh | rita.z.zhang@gmail.com | Microsoft | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2021-03-29 |
-| Sertaç Özercan | @sozercan | sozercan@gmail.com | Microsoft | gatekeeper, gatekeeper-library, cert-controller | 2021-03-29 |
-| Tim Hinrichs | @timothyhinrichs | timothy.l.hinrichs@gmail.com | Styra | all repositories | 2021-03-29 |
-| Torin Sandall | @tsandall | torinsandall@gmail.com | Styra | all repositories | 2021-03-29 |
+| Rita Zhang | @ritazh | rita.z.zhang@gmail.com | Microsoft | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2023-03-31 |
+| Sertaç Özercan | @sozercan | sozercan@gmail.com | Microsoft | gatekeeper, gatekeeper-library, cert-controller, gatekeeper-external-data-provider | 2023-03-31 |
+| Stephan Renatus | @srenatus | stephan@styra.com | Styra | opa | 2023-03-31 |
+| Tim Hinrichs | @timothyhinrichs | timothy.l.hinrichs@gmail.com | Styra | all repositories | 2023-03-31 |
+| Torin Sandall | @tsandall | torinsandall@gmail.com | Styra | all repositories | 2023-03-31 |
 
 ## Emeritus
 
+* [Craig Tabita](https://github.com/ctab)
+* [Ernest Wong](https://github.com/chewong)
 * [Patrick East](https://github.com/patrick-east)
+* [Will Beason](https://github.com/willbeason)
diff --git a/Makefile b/Makefile
index 7cb3e774b1..843a413601 100644
--- a/Makefile
+++ b/Makefile
@@ -14,18 +14,22 @@ WASM_ENABLED ?= 1
 GO := CGO_ENABLED=$(CGO_ENABLED) GOFLAGS="-buildmode=exe" go
 GO_TEST_TIMEOUT := -timeout 30m
 
+GOVERSION ?= $(shell cat ./.go-version)
+GOARCH := $(shell go env GOARCH)
+GOOS := $(shell go env GOOS)
+
+ifeq ($(GOOS)/$(GOARCH),darwin/arm64)
+WASM_ENABLED=0
+endif
+
 GO_TAGS := -tags=
 ifeq ($(WASM_ENABLED),1)
 GO_TAGS = -tags=opa_wasm
 endif
 
-GOVERSION ?= $(shell cat ./.go-version)
-GOARCH := $(shell go env GOARCH)
-GOOS := $(shell go env GOOS)
-
-GOLANGCI_LINT_VERSION := v1.40.1
+GOLANGCI_LINT_VERSION := v1.51.0
 
-DOCKER_RUNNING := $(shell docker ps >/dev/null 2>&1 && echo 1 || echo 0)
+DOCKER_RUNNING ?= $(shell docker ps >/dev/null 2>&1 && echo 1 || echo 0)
 
 # We use root because the windows build, invoked through the ci-go-build-windows
 # target, installs the gcc mingw32 cross-compiler.
@@ -41,16 +45,21 @@ endif
 
 DOCKER := docker
 
+# BuildKit is required for automatic platform arg injection (see Dockerfile)
+export DOCKER_BUILDKIT := 1
+
+# Supported platforms to include in image manifest lists
+DOCKER_PLATFORMS := linux/amd64
+DOCKER_PLATFORMS_STATIC := linux/amd64,linux/arm64
+
 BIN := opa_$(GOOS)_$(GOARCH)
 
 # Optional external configuration useful for forks of OPA
 DOCKER_IMAGE ?= openpolicyagent/opa
 S3_RELEASE_BUCKET ?= opa-releases
-FUZZ_TIME ?= 3600  # 1hr
+FUZZ_TIME ?= 1h
 TELEMETRY_URL ?= #Default empty
 
-BUILD_COMMIT := $(shell ./build/get-build-commit.sh)
-BUILD_TIMESTAMP := $(shell ./build/get-build-timestamp.sh)
 BUILD_HOSTNAME := $(shell ./build/get-build-hostname.sh)
 
 RELEASE_BUILD_IMAGE := golang:$(GOVERSION)
@@ -62,9 +71,6 @@ TELEMETRY_FLAG := -X github.com/open-policy-agent/opa/internal/report.ExternalSe
 endif
 
 LDFLAGS := "$(TELEMETRY_FLAG) \
-	-X github.com/open-policy-agent/opa/version.Version=$(VERSION) \
-	-X github.com/open-policy-agent/opa/version.Vcs=$(BUILD_COMMIT) \
-	-X github.com/open-policy-agent/opa/version.Timestamp=$(BUILD_TIMESTAMP) \
 	-X github.com/open-policy-agent/opa/version.Hostname=$(BUILD_HOSTNAME)"
 
 
@@ -155,7 +161,7 @@ clean: wasm-lib-clean
 
 .PHONY: fuzz
 fuzz:
-	$(MAKE) -C ./build/fuzzer all
+	go test ./ast -fuzz FuzzParseStatementsAndCompileModules -fuzztime ${FUZZ_TIME} -v -run '^$$'
 
 ######################################################
 #
@@ -238,20 +244,20 @@ CI_GOLANG_DOCKER_MAKE := $(DOCKER) run \
 	-v $(PWD):/src \
 	-w /src \
 	-e GOCACHE=/src/.go/cache \
+	-e GOARCH=$(GOARCH) \
 	-e CGO_ENABLED=$(CGO_ENABLED) \
 	-e WASM_ENABLED=$(WASM_ENABLED) \
 	-e FUZZ_TIME=$(FUZZ_TIME) \
 	-e TELEMETRY_URL=$(TELEMETRY_URL) \
-	golang:$(GOVERSION) \
-	make
+	golang:$(GOVERSION)
 
 .PHONY: ci-go-%
 ci-go-%: generate
-	$(CI_GOLANG_DOCKER_MAKE) $*
+	$(CI_GOLANG_DOCKER_MAKE) /bin/bash -c "git config --system --add safe.directory /src && make $*"
 
 .PHONY: ci-release-test
 ci-release-test: generate
-	$(CI_GOLANG_DOCKER_MAKE) test perf wasm-sdk-e2e-test check
+	$(CI_GOLANG_DOCKER_MAKE) make test perf wasm-sdk-e2e-test check
 
 .PHONY: ci-check-working-copy
 ci-check-working-copy: generate
@@ -261,7 +267,7 @@ ci-check-working-copy: generate
 ci-wasm: wasm-test
 
 .PHONY: ci-build-linux
-ci-build-linux: ensure-release-dir
+ci-build-linux: ensure-release-dir ensure-linux-toolchain
 	@$(MAKE) build GOOS=linux
 	chmod +x opa_linux_$(GOARCH)
 	mv opa_linux_$(GOARCH) $(RELEASE_DIR)/
@@ -301,84 +307,134 @@ ci-build-windows: ensure-release-dir
 ensure-release-dir:
 	mkdir -p $(RELEASE_DIR)
 
+.PHONY: ensure-executable-bin
+ensure-executable-bin:
+	find $(RELEASE_DIR) -type f ! -name "*.sha256" | xargs chmod +x
+
+.PHONY: ensure-linux-toolchain
+ensure-linux-toolchain:
+ifeq ($(CGO_ENABLED),1)
+	$(eval export CC = $(shell GOARCH=$(GOARCH) build/ensure-linux-toolchain.sh))
+else
+	@echo "CGO_ENABLED=$(CGO_ENABLED). No need to check gcc toolchain."
+endif
+
 .PHONY: build-all-platforms
 build-all-platforms: ci-build-linux ci-build-linux-static ci-build-darwin ci-build-darwin-arm64-static ci-build-windows
 
 .PHONY: image-quick
-image-quick:
-	chmod +x $(RELEASE_DIR)/opa_linux_$(GOARCH)*
+image-quick: image-quick-$(GOARCH)
+
+# % = arch
+.PHONY: image-quick-%
+image-quick-%: ensure-executable-bin
+ifneq ($(GOARCH),arm64) # build only static images for arm64
 	$(DOCKER) build \
 		-t $(DOCKER_IMAGE):$(VERSION) \
-		--build-arg BASE=gcr.io/distroless/cc \
-		--build-arg BIN=$(RELEASE_DIR)/opa_linux_$(GOARCH) \
+		--build-arg BASE=cgr.dev/chainguard/cc-dynamic \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--platform linux/$* \
 		.
 	$(DOCKER) build \
 		-t $(DOCKER_IMAGE):$(VERSION)-debug \
-		--build-arg BASE=gcr.io/distroless/cc:debug \
-		--build-arg BIN=$(RELEASE_DIR)/opa_linux_$(GOARCH) \
+		--build-arg BASE=cgr.dev/chainguard/cc-dynamic:latest-dev \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--platform linux/$* \
 		.
 	$(DOCKER) build \
 		-t $(DOCKER_IMAGE):$(VERSION)-rootless \
-		--build-arg USER=1000 \
-		--build-arg BASE=gcr.io/distroless/cc \
-		--build-arg BIN=$(RELEASE_DIR)/opa_linux_$(GOARCH) \
+		--build-arg OPA_DOCKER_IMAGE_TAG=rootless \
+		--build-arg BASE=cgr.dev/chainguard/cc-dynamic:latest \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--platform linux/$* \
 		.
+endif
 	$(DOCKER) build \
 		-t $(DOCKER_IMAGE):$(VERSION)-static \
-		--build-arg BASE=gcr.io/distroless/static \
-		--build-arg BIN=$(RELEASE_DIR)/opa_linux_$(GOARCH)_static \
+		--build-arg BASE=cgr.dev/chainguard/static:latest \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--build-arg BIN_SUFFIX=_static \
+		--platform linux/$* \
+		.
+
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION)-static-debug \
+		--build-arg BASE=cgr.dev/chainguard/busybox:latest-glibc \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--build-arg BIN_SUFFIX=_static \
+		--platform linux/$* \
+		.
+
+# % = base tag
+.PHONY: push-manifest-list-%
+push-manifest-list-%: ensure-executable-bin
+	$(DOCKER) buildx build \
+		--tag $(DOCKER_IMAGE):$* \
+		--build-arg BASE=cgr.dev/chainguard/cc-dynamic:latest \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--platform $(DOCKER_PLATFORMS) \
+		--push \
+		.
+	# TODO: update busybox shell debug images to image without openssl
+	$(DOCKER) buildx build \
+		--tag $(DOCKER_IMAGE):$*-debug \
+		--build-arg BASE=cgr.dev/chainguard/cc-dynamic:latest-dev \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--platform $(DOCKER_PLATFORMS) \
+		--push \
+		.
+	$(DOCKER) buildx build \
+		--tag $(DOCKER_IMAGE):$*-rootless \
+		--build-arg OPA_DOCKER_IMAGE_TAG=rootless \
+		--build-arg BASE=cgr.dev/chainguard/cc-dynamic:latest \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--platform $(DOCKER_PLATFORMS) \
+		--push \
+		.
+
+	$(DOCKER) buildx build \
+		--tag $(DOCKER_IMAGE):$*-static \
+		--build-arg BASE=cgr.dev/chainguard/static:latest \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--build-arg BIN_SUFFIX=_static \
+		--platform $(DOCKER_PLATFORMS_STATIC) \
+		--push \
+		.
+
+	$(DOCKER) buildx build \
+		--tag $(DOCKER_IMAGE):$*-static-debug \
+		--build-arg BASE=cgr.dev/chainguard/busybox:latest-glibc \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		--build-arg BIN_SUFFIX=_static \
+		--platform $(DOCKER_PLATFORMS_STATIC) \
+		--push \
 		.
 
 .PHONY: ci-image-smoke-test
-ci-image-smoke-test: image-quick
-	$(DOCKER) run $(DOCKER_IMAGE):$(VERSION) version
-	$(DOCKER) run $(DOCKER_IMAGE):$(VERSION)-debug version
-	$(DOCKER) run $(DOCKER_IMAGE):$(VERSION)-rootless version
-	$(DOCKER) run $(DOCKER_IMAGE):$(VERSION)-static version
+ci-image-smoke-test: ci-image-smoke-test-$(GOARCH)
+
+# % = arch
+.PHONY: ci-image-smoke-test-%
+ci-image-smoke-test-%: image-quick-%
+ifneq ($(GOARCH),arm64) # we build only static images for arm64
+	$(DOCKER) run --platform linux/$* $(DOCKER_IMAGE):$(VERSION) version
+	$(DOCKER) run --platform linux/$* $(DOCKER_IMAGE):$(VERSION)-debug version
+
+	$(DOCKER) image inspect $(DOCKER_IMAGE):$(VERSION) |\
+	  $(DOCKER) run --interactive --platform linux/$* $(DOCKER_IMAGE):$(VERSION) \
+	  eval --fail --format raw --stdin-input 'input[0].Config.User = "1000:1000"'
+endif
+	$(DOCKER) run --platform linux/$* $(DOCKER_IMAGE):$(VERSION)-static version
 
+# % = rego/wasm
 .PHONY: ci-binary-smoke-test-%
 ci-binary-smoke-test-%:
 	chmod +x "$(RELEASE_DIR)/$(BINARY)"
-	"$(RELEASE_DIR)/$(BINARY)" eval -t "$*" 'time.now_ns()'
-
-.PHONY: push
-push:
-	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)
-	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-debug
-	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-rootless
-	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-static
-
-.PHONY: tag-latest
-tag-latest:
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION) $(DOCKER_IMAGE):latest
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-debug $(DOCKER_IMAGE):latest-debug
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-rootless $(DOCKER_IMAGE):latest-rootless
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-static $(DOCKER_IMAGE):latest-static
-
-.PHONY: push-latest
-push-latest:
-	$(DOCKER) push $(DOCKER_IMAGE):latest
-	$(DOCKER) push $(DOCKER_IMAGE):latest-debug
-	$(DOCKER) push $(DOCKER_IMAGE):latest-rootless
-	$(DOCKER) push $(DOCKER_IMAGE):latest-static
+	./build/binary-smoke-test.sh "$(RELEASE_DIR)/$(BINARY)" "$*"
 
 .PHONY: push-binary-edge
 push-binary-edge:
-	aws s3 sync $(RELEASE_DIR) s3://$(S3_RELEASE_BUCKET)/edge/ --delete
-
-.PHONY: tag-edge
-tag-edge:
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION) $(DOCKER_IMAGE):edge
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-debug $(DOCKER_IMAGE):edge-debug
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-rootless $(DOCKER_IMAGE):edge-rootless
-	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-static $(DOCKER_IMAGE):edge-static
-
-.PHONY: push-edge
-push-edge:
-	$(DOCKER) push $(DOCKER_IMAGE):edge
-	$(DOCKER) push $(DOCKER_IMAGE):edge-debug
-	$(DOCKER) push $(DOCKER_IMAGE):edge-rootless
-	$(DOCKER) push $(DOCKER_IMAGE):edge-static
+	aws s3 sync $(RELEASE_DIR) s3://$(S3_RELEASE_BUCKET)/edge/ --no-progress --region us-west-1
 
 .PHONY: docker-login
 docker-login:
@@ -386,14 +442,14 @@ docker-login:
 	@echo ${DOCKER_PASSWORD} | $(DOCKER) login -u ${DOCKER_USER} --password-stdin
 
 .PHONY: push-image
-push-image: docker-login image-quick push
+push-image: docker-login push-manifest-list-$(VERSION)
 
 .PHONY: push-wasm-builder-image
 push-wasm-builder-image: docker-login
 	$(MAKE) -C wasm push-builder
 
 .PHONY: deploy-ci
-deploy-ci: push-image tag-edge push-edge push-binary-edge
+deploy-ci: push-image push-manifest-list-edge push-binary-edge
 
 .PHONY: release-ci
 # Don't tag and push "latest" image tags if the version is a release candidate or a bugfix branch
@@ -401,18 +457,18 @@ deploy-ci: push-image tag-edge push-edge push-binary-edge
 ifneq (,$(or $(findstring rc,$(VERSION)), $(findstring release-,$(shell git branch --contains HEAD))))
 release-ci: push-image
 else
-release-ci: push-image tag-latest push-latest
+release-ci: push-image push-manifest-list-latest
 endif
 
 .PHONY: netlify-prod
-netlify-prod: clean docs-clean build docs-generate docs-production-build
+netlify-prod: clean docs-clean build docs-production-build
 
 .PHONY: netlify-preview
-netlify-preview: clean docs-clean build docs-live-blocks-install-deps docs-live-blocks-test docs-generate docs-preview-build
+netlify-preview: clean docs-clean build docs-live-blocks-install-deps docs-live-blocks-test docs-dev-generate docs-preview-build
 
+# Kept for compatibility. Use `make fuzz` instead.
 .PHONY: check-fuzz
-check-fuzz:
-	./build/check-fuzz.sh $(FUZZ_TIME)
+check-fuzz: fuzz
 
 # GOPRIVATE=* causes go to fetch all dependencies from their corresponding VCS
 # source, not through the golang-provided proxy services. We're cleaning out
@@ -427,7 +483,7 @@ check-go-module:
 	  -e 'GOPRIVATE=*' \
 	  --tmpfs /src/.go \
 	  golang:$(GOVERSION) \
-	  go mod vendor -v
+	  /bin/bash -c "git config --system --add safe.directory /src && go mod vendor -v"
 
 ######################################################
 #
@@ -444,14 +500,14 @@ endif
 		-e GITHUB_TOKEN=$(GITHUB_TOKEN) \
 		-e LAST_VERSION=$(LAST_VERSION) \
 		-v $(PWD):/_src \
-		python:2.7 \
+		cmd.cat/make/git/go/python3/perl \
 		/_src/build/gen-release-patch.sh --version=$(VERSION) --source-url=/_src
 
 .PHONY: dev-patch
 dev-patch:
 	@$(DOCKER) run $(DOCKER_FLAGS) \
 		-v $(PWD):/_src \
-		python:2.7 \
+		cmd.cat/make/git/go/python3/perl \
 		/_src/build/gen-dev-patch.sh --version=$(VERSION) --source-url=/_src
 
 # Deprecated targets. To be removed.
diff --git a/README.md b/README.md
index fadf0efc4e..8f2b788c87 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # ![logo](./logo/logo-144x144.png) Open Policy Agent
 
-[![Slack Status](http://slack.openpolicyagent.org/badge.svg)](https://slack.openpolicyagent.org) [![Build Status](https://github.com/open-policy-agent/opa/workflows/Post%20Merge/badge.svg?branch=main)](https://github.com/open-policy-agent/opa/actions) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)
+[![Build Status](https://github.com/open-policy-agent/opa/workflows/Post%20Merge/badge.svg?branch=main)](https://github.com/open-policy-agent/opa/actions) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)
 
 Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
 
@@ -9,7 +9,19 @@ OPA is proud to be a graduated project in the [Cloud Native Computing Foundation
 ## Want to connect with the community or get support for OPA?
 
 - Join the [OPA Slack](https://slack.openpolicyagent.org) for day-to-day conversations with the OPA community.
-- Need Support? Go to the [Discussions Board](https://github.com/open-policy-agent/feedback/discussions) to ask questions.
+- Need Support? Check out the [Community Discussions](https://github.com/orgs/open-policy-agent/discussions) to ask questions.
+
+## Join the OPA Office Hours
+
+**Every Week at these times** 
+  * 10:00 PT / 19:00 CET
+  * 01:30 PT / 10:30 CET
+
+These sessions are open format for community members. Come and ask about new features or the road map for the next release. You can use this time to get unblocked with your OPA deployments, learn more about the project, or to get more involved in the community.
+
+  * [Book a slot](https://calendly.com/styra-devrel/opa-office-hours)
+
+*Watch a replay of a previous office hours on [YouTube](https://www.youtube.com/watch?v=TxFZPrbc9jk&list=PLW-2W4VHBA4RRhCHiiaKHZsDFx-FwH8VU)*
 
 ## What is the this fork for?
 
@@ -26,32 +38,30 @@ git cherry-pick {gitsha of commit with your patches}
 
 - Go to [openpolicyagent.org](https://www.openpolicyagent.org) to get started with documentation and tutorials.
 - Browse [blog.openpolicyagent.org](https://blog.openpolicyagent.org) for news about OPA, community, policy and authorization.
+- Watch OPA's [YouTube](https://www.youtube.com/channel/UClDMRN5HlqD3di5MMf-SV4A) channel for past office hours and other content.
 - Try OPA with the [Rego Playground](https://play.openpolicyagent.org) to experiment with policies and share your work.
 - View the [OPA Roadmap](https://docs.google.com/presentation/d/16QV6gvLDOV3I0_guPC3_19g6jHkEg3X9xqMYgtoCKrs/edit?usp=sharing) to see a high-level snapshot of OPA features in-progress and planned.
 - Check out the [ADOPTERS.md](./ADOPTERS.md) file for a list of production adopters. Does your organization use OPA in production? Support the OPA project by submitting a PR to add your organization to the list with a short description of your OPA use cases!
 
-## Want to get OPA?
+## Want to download OPA?
 
 - [Docker Hub](https://hub.docker.com/r/openpolicyagent/opa/tags/) for Docker images.
 - [GitHub releases](https://github.com/open-policy-agent/opa/releases) for binary releases and changelogs.
 
 ## Want to integrate OPA?
 
-* See
+* See the high-level [Go SDK](https://www.openpolicyagent.org/docs/latest/integration/#integrating-with-the-go-sdk) or the low-level Go API
   [![GoDoc](https://godoc.org/github.com/open-policy-agent/opa?status.svg)](https://godoc.org/github.com/open-policy-agent/opa/rego)
   to integrate OPA with services written in Go.
 * See [REST API](https://www.openpolicyagent.org/docs/rest-api.html) to
   integrate OPA with services written in other languages.
+* See the [integration docs](https://www.openpolicyagent.org/docs/latest/integration/) for more options.
 
 ## Want to contribute to OPA?
 
 * Read the [Contributing Guide](https://www.openpolicyagent.org/docs/latest/contributing/) to learn how to make your first contribution.
-* Use [#development](https://openpolicyagent.slack.com/archives/C02L1TLPN59) in Slack to talk to the OPA maintainers and other contributors.
+* Use [#contributors](https://openpolicyagent.slack.com/archives/C02L1TLPN59) in Slack to talk to other contributors and OPA maintainers.
 * File a [GitHub Issue](https://github.com/open-policy-agent/opa/issues) to request features or report bugs.
-* Join the OPA bi-weekly meetings every other Tuesday at 10:00 (Pacific Timezone):
-    * [Meeting Notes](https://docs.google.com/document/d/1v6l2gmkRKAn5UIg3V2QdeeCcXMElxsNzEzDkVlWDVg8/edit?usp=sharing)
-    * [Zoom](https://zoom.us/j/97827947600)
-    * [Calendar Invite](https://calendar.google.com/event?action=TEMPLATE&tmeid=MnRvb2M4amtldXBuZ2E1azY0MTJndjh0ODRfMjAxODA5MThUMTcwMDAwWiBzdHlyYS5jb21fY28zOXVzc3VobnE2amUzN2l2dHQyYmNiZGdAZw&tmsrc=styra.com_co39ussuhnq6je37ivtt2bcbdg%40group.calendar.google.com&scp=ALL)
 
 ## How does OPA work?
 
@@ -84,6 +94,8 @@ For concrete examples of how to integrate OPA with systems like [Kubernetes](htt
 
 ## Presentations
 
+- OPA maintainers talk @ Kubecon NA 2022: [video](https://www.youtube.com/watch?v=RMiovzGGCfI)
+- Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2022: [video](https://www.youtube.com/watch?v=MhyQxIp1H58)
 - Open Policy Agent Intro @ KubeCon EU 2021: [Video](https://www.youtube.com/watch?v=2CgeiWkliaw)
 - Using Open Policy Agent to Meet Evolving Policy Requirements @ KubeCon NA 2020: [video](https://www.youtube.com/watch?v=zVuM7F_BTyc)
 - Applying Policy Throughout The Application Lifecycle with Open Policy Agent @ CloudNativeCon 2019: [video](https://www.youtube.com/watch?v=cXfsaE6RKfc)
diff --git a/SECURITY.md b/SECURITY.md
index a154a5e164..d90b7e962f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,260 +1,5 @@
-# Security Release Process
+# Security Policy
 
-The Open Policy Agent (OPA) community has adopted this security disclosures and
-response policy to ensure we responsibly handle critical issues.
-
-## Product Security Team (PST)
-
-Security vulnerabilities should be handled quickly and sometimes privately. The primary goal of this
-process is to reduce the total time users are vulnerable to publicly known exploits.
-
-The Product Security Team (PST) is responsible for organizing the entire response including internal
-communication and external disclosure but will need help from relevant developers to successfully
-run this process.
-
-The initial Product Security Team will consist of all [maintainers](MAINTAINERS.md) in the private
-[open-policy-agent-security](https://groups.google.com/forum/#!forum/open-policy-agent-security) list. In the future we may
-decide to have a subset of maintainers work on security response given that this process is time
-consuming.
-
-## Disclosures
-
-### Private Disclosure Processes
-
-The OPA community asks that all suspected vulnerabilities be privately and responsibly disclosed
-via the [reporting policy](README.md#reporting-security-vulnerabilities).
-
-### Public Disclosure Processes
-
-If you know of a publicly disclosed security vulnerability please IMMEDIATELY email
-[open-policy-agent-security](https://groups.google.com/forum/#!forum/open-policy-agent-security) to inform the Product
-Security Team (PST) about the vulnerability so they may start the patch, release, and communication
-process.
-
-If possible the PST will ask the person making the public report if the issue can be handled via a
-private disclosure process (for example if the full exploit details have not yet been published). If
-the reporter denies the request for private disclosure, the PST will move swiftly with the fix and
-release process. In extreme cases GitHub can be asked to delete the issue but this generally isn't
-necessary and is unlikely to make a public disclosure less damaging.
-
-## Patch, Release, and Public Communication
-
-For each vulnerability a member of the PST will volunteer to lead coordination with the "Fix Team"
-and is responsible for sending disclosure emails to the rest of the community. This lead will be
-referred to as the "Fix Lead."
-
-The role of Fix Lead should rotate round-robin across the PST.
-
-Note that given the current size of the OPA community it is likely that the PST is the same as
-the "Fix team." (I.e., all maintainers). The PST may decide to bring in additional contributors
-for added expertise depending on the area of the code that contains the vulnerability.
-
-All of the timelines below are suggestions and assume a private disclosure. The Fix Lead drives the
-schedule using their best judgment based on severity and development time. If the Fix Lead is
-dealing with a public disclosure all timelines become ASAP (assuming the vulnerability has a CVSS
-score >= 4; see below). If the fix relies on another upstream project's disclosure timeline, that
-will adjust the process as well. We will work with the upstream project to fit their timeline and
-best protect our users.
-
-### Fix Team Organization
-
-These steps should be completed within the first 24 hours of disclosure.
-
-- The Fix Lead will work quickly to identify relevant engineers from the affected projects and
-  packages and CC those engineers into the disclosure thread. These selected developers are the Fix
-  Team.
-- The Fix Lead will get the Fix Team access to private security repos to develop the fix.
-
-### Fix Development Process
-
-These steps should be completed within the 1-7 days of Disclosure.
-
-- The Fix Lead and the Fix Team will create a
-  [CVSS](https://www.first.org/cvss/specification-document) using the [CVSS
-  Calculator](https://www.first.org/cvss/calculator/3.0). The Fix Lead makes the final call on the
-  calculated CVSS; it is better to move quickly than make the CVSS perfect.
-- The Fix Team will notify the Fix Lead that work on the fix branch is complete once there are LGTMs
-  on all commits in the private repo from one or more maintainers.
-
-If the CVSS score is under 4.0 ([a low severity
-score](https://www.first.org/cvss/specification-document#i5)) the Fix Team can decide to slow the
-release process down in the face of holidays, developer bandwidth, etc. These decisions must be
-discussed on the open-policy-agent-security mailing list.
-
-### Fix Disclosure Process
-
-With the fix development underway, the Fix Lead needs to come up with an overall communication plan
-for the wider community. This Disclosure process should begin after the Fix Team has developed a Fix
-or mitigation so that a realistic timeline can be communicated to users.
-
-**Disclosure of Forthcoming Fix to Users** (Completed within 1-7 days of Disclosure)
-
-- The Fix Lead will email [open-policy-agent-announce@googlegroups.com](https://groups.google.com/forum/#!forum/open-policy-agent-announce)
-  informing users that a security vulnerability has been disclosed and that a fix will be made
-  available at YYYY-MM-DD HH:MM UTC in the future via this list. This time is the Release Date.
-- The Fix Lead will include any mitigating steps users can take until a fix is available.
-
-The communication to users should be actionable. They should know when to block time to apply
-patches, understand exact mitigation steps, etc.
-
-**Optional Fix Disclosure to Private Distributors List** (Completed within 1-14 days of Disclosure):
-
-- The Fix Lead will make a determination with the help of the Fix Team if an issue is critical enough
-  to require early disclosure to distributors. Generally this Private Distributor Disclosure process
-  should be reserved for remotely exploitable or privilege escalation issues. Otherwise, this
-  process can be skipped.
-- The Fix Lead will email the patches to open-policy-agent-distributors-announce@googlegroups.com so
-  distributors can prepare builds to be available to users on the day of the issue's announcement.
-  Distributors should read about the [Private Distributors List](#private-distributors-list) to find
-  out the requirements for being added to this list.
-- **What if a vendor breaks embargo?** The PST will assess the damage. The Fix Lead will make the
-  call to release earlier or continue with the plan. When in doubt push forward and go public ASAP.
-
-**Fix Release Day** (Completed within 1-21 days of Disclosure)
-
-- The maintainers will create a new patch release branch from the latest patch release tag + the fix
-  from the security branch. As a practical example if v1.5.3 is the latest patch release in opa.git
-  a new branch will be created called v1.5.4 which includes only patches required to fix the issue.
-- The Fix Lead will cherry-pick the patches onto the main branch and all relevant release branches.
-  The Fix Team will LGTM and merge. Maintainers will merge these PRs as quickly as possible. Changes
-  shouldn't be made to the commits even for a typo in the CHANGELOG as this will change the git sha
-  of the commits leading to confusion and potentially conflicts as the fix is cherry-picked around
-  branches.
-- The Fix Lead will request a CVE from [DWF](https://github.com/distributedweaknessfiling/DWF-Documentation)
-  and include the CVSS and release details.
-- The Fix Lead will email open-policy-agent[-announce]@googlegroups.com now that everything is public
-  announcing the new releases, the CVE number, and the relevant merged PRs to get wide distribution
-  and user action. As much as possible this email should be actionable and include links on how to apply
-  the fix to user's environments; this can include links to external distributor documentation.
-- The Fix Lead will remove the Fix Team from the private security repo.
-
-### Retrospective
-
-These steps should be completed 1-3 days after the Release Date. The retrospective process
-[should be blameless](https://landing.google.com/sre/book/chapters/postmortem-culture.html).
-
-- The Fix Lead will send a retrospective of the process to open-policy-agent@googlegroups.com including
-  details on everyone involved, the timeline of the process, links to relevant PRs that introduced
-  the issue, if relevant, and any critiques of the response and release process.
-- Maintainers and Fix Team are also encouraged to send their own feedback on the process to
-  open-policy-agent@googlegroups.com. Honest critique is the only way we are going to get good at this as a
-  community.
-
-## Private Distributors List
-
-This list is intended to be used primarily to provide actionable information to
-multiple distribution vendors at once. This list is not intended for
-individuals to find out about security issues.
-
-### Embargo Policy
-
-The information members receive on open-policy-agent-distributors-announce must not be made public, shared, nor
-even hinted at anywhere beyond the need-to-know within your specific team except with the list's
-explicit approval. This holds true until the public disclosure date/time that was agreed upon by the
-list. Members of the list and others may not use the information for anything other than getting the
-issue fixed for your respective distribution's users.
-
-Before any information from the list is shared with respective members of your team required to fix
-said issue, they must agree to the same terms and only find out information on a need-to-know basis.
-
-In the unfortunate event you share the information beyond what is allowed by this policy, you _must_
-urgently inform the open-policy-agent-security@googlegroups.com mailing list of exactly what information leaked
-and to whom. A retrospective will take place after the leak so we can assess how to not make the
-same mistake in the future.
-
-If you continue to leak information and break the policy outlined here, you will be removed from the
-list.
-
-### Contributing Back
-
-This is a team effort. As a member of the list you must carry some water. This
-could be in the form of the following:
-
-**Technical**
-
-- Review and/or test the proposed patches and point out potential issues with
-  them (such as incomplete fixes for the originally reported issues, additional
-  issues you might notice, and newly introduced bugs), and inform the list of the
-  work done even if no issues were encountered.
-
-**Administrative**
-
-- Help draft emails to the public disclosure mailing list.
-- Help with release notes.
-
-### Membership Criteria
-
-To be eligible for the open-policy-agent-distributors-announce mailing list, your
-distribution should:
-
-1. Be an actively maintained distribution of OPA components OR offer OPA as a publicly
-   available service in which the product clearly states that it is built on top of OPA. E.g.,
-   "SuperAwesomeLinuxDistro" which offers OPA pre-built packages OR
-   "SuperAwesomeCloudProvider's OPA as a Service (EaaS)". A cloud service that uses OPA for a
-   product but does not publicly say they are using OPA does not qualify.
-2. Have a user base not limited to your own organization.
-3. Have a publicly verifiable track record up to present day of fixing security
-   issues.
-4. Not be a downstream or rebuild of another distribution.
-5. Be a participant and active contributor in the community.
-6. Accept the [Embargo Policy](#embargo-policy) that is outlined above.
-7. Be willing to [contribute back](#contributing-back) as outlined above.
-8. Have someone already on the list vouch for the person requesting membership
-   on behalf of your distribution.
-
-### Requesting to Join
-
-New membership requests are sent to open-policy-agent-security@googlegroups.com.
-
-In the body of your request please specify how you qualify and fulfill each
-criterion listed in [Membership Criteria](#membership-criteria).
-
-Here is a pseudo example:
-
-```
-To: open-policy-agent-security@googlegroups.com
-Subject: Seven-Corp Membership to open-policy-agent-distributors-announce
-
-Below are each criterion and why I think we, Seven-Corp, qualify.
-
-> 1. Be an actively maintained distribution of OPA components OR offer OPA as a publicly
-     available service in which the product clearly states that it is built on top of OPA.
-
-We distribute the "Seven" distribution of OPA [link]. We have been doing
-this since 1999 before proxies were even cool.
-
-> 2. Have a user base not limited to your own organization.
-
-Our user base spans of the extensive "Seven" community. We have a slack and
-GitHub repos and mailing lists where the community hangs out. [links]
-
-> 3. Have a publicly verifiable track record up to present day of fixing security
-     issues.
-
-We announce on our blog all upstream patches we apply to "Seven." [link to blog
-posts]
-
-> 4. Not be a downstream or rebuild of another distribution.
-
-This does not apply, "Seven" is a unique snowflake distribution.
-
-> 5. Be a participant and active contributor in the community.
-
-Our members, Acidburn, Cereal, and ZeroCool are outstanding members and are well
-known throughout the OPA community. Especially for their contributions
-in hacking the Gibson.
-
-> 6. Accept the Embargo Policy that is outlined above.
-
-We accept.
-
-> 7. Be willing to contribute back as outlined above.
-
-We are definitely willing to help!
-
-> 8. Have someone already on the list vouch for the person requesting membership
-     on behalf of your distribution.
-
-CrashOverride will vouch for Acidburn joining the list on behalf of the "Seven"
-distribution.
-```
+Please refer to the [OPA Security Policy](https://openpolicyagent.org/security)
+for details on how to report security issues, our disclosure policy, and how to
+receive notifications about security issues.
\ No newline at end of file
diff --git a/ast/annotations.go b/ast/annotations.go
new file mode 100644
index 0000000000..1134cc87c4
--- /dev/null
+++ b/ast/annotations.go
@@ -0,0 +1,941 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package ast
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+
+	"github.com/open-policy-agent/opa/internal/deepcopy"
+	"github.com/open-policy-agent/opa/util"
+)
+
+const (
+	annotationScopePackage     = "package"
+	annotationScopeImport      = "import"
+	annotationScopeRule        = "rule"
+	annotationScopeDocument    = "document"
+	annotationScopeSubpackages = "subpackages"
+)
+
+type (
+	// Annotations represents metadata attached to other AST nodes such as rules.
+	Annotations struct {
+		Scope            string                       `json:"scope"`
+		Title            string                       `json:"title,omitempty"`
+		Entrypoint       bool                         `json:"entrypoint,omitempty"`
+		Description      string                       `json:"description,omitempty"`
+		Organizations    []string                     `json:"organizations,omitempty"`
+		RelatedResources []*RelatedResourceAnnotation `json:"related_resources,omitempty"`
+		Authors          []*AuthorAnnotation          `json:"authors,omitempty"`
+		Schemas          []*SchemaAnnotation          `json:"schemas,omitempty"`
+		Custom           map[string]interface{}       `json:"custom,omitempty"`
+		Location         *Location                    `json:"location,omitempty"`
+
+		comments    []*Comment
+		node        Node
+		jsonOptions JSONOptions
+	}
+
+	// SchemaAnnotation contains a schema declaration for the document identified by the path.
+	SchemaAnnotation struct {
+		Path       Ref          `json:"path"`
+		Schema     Ref          `json:"schema,omitempty"`
+		Definition *interface{} `json:"definition,omitempty"`
+	}
+
+	AuthorAnnotation struct {
+		Name  string `json:"name"`
+		Email string `json:"email,omitempty"`
+	}
+
+	RelatedResourceAnnotation struct {
+		Ref         url.URL `json:"ref"`
+		Description string  `json:"description,omitempty"`
+	}
+
+	AnnotationSet struct {
+		byRule    map[*Rule][]*Annotations
+		byPackage map[int]*Annotations
+		byPath    *annotationTreeNode
+		modules   []*Module // Modules this set was constructed from
+	}
+
+	annotationTreeNode struct {
+		Value    *Annotations
+		Children map[Value]*annotationTreeNode // we assume key elements are hashable (vars and strings only!)
+	}
+
+	AnnotationsRef struct {
+		Path        Ref          `json:"path"` // The path of the node the annotations are applied to
+		Annotations *Annotations `json:"annotations,omitempty"`
+		Location    *Location    `json:"location,omitempty"` // The location of the node the annotations are applied to
+
+		jsonOptions JSONOptions
+
+		node Node // The node the annotations are applied to
+	}
+
+	AnnotationsRefSet []*AnnotationsRef
+
+	FlatAnnotationsRefSet AnnotationsRefSet
+)
+
+func (a *Annotations) String() string {
+	bs, _ := a.MarshalJSON()
+	return string(bs)
+}
+
+// Loc returns the location of this annotation.
+func (a *Annotations) Loc() *Location {
+	return a.Location
+}
+
+// SetLoc updates the location of this annotation.
+func (a *Annotations) SetLoc(l *Location) {
+	a.Location = l
+}
+
+// EndLoc returns the location of this annotation's last comment line.
+func (a *Annotations) EndLoc() *Location {
+	count := len(a.comments)
+	if count == 0 {
+		return a.Location
+	}
+	return a.comments[count-1].Location
+}
+
+// Compare returns an integer indicating if a is less than, equal to, or greater
+// than other.
+func (a *Annotations) Compare(other *Annotations) int {
+
+	if a == nil && other == nil {
+		return 0
+	}
+
+	if a == nil {
+		return -1
+	}
+
+	if other == nil {
+		return 1
+	}
+
+	if cmp := scopeCompare(a.Scope, other.Scope); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := strings.Compare(a.Title, other.Title); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := strings.Compare(a.Description, other.Description); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := compareStringLists(a.Organizations, other.Organizations); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := compareRelatedResources(a.RelatedResources, other.RelatedResources); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := compareAuthors(a.Authors, other.Authors); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := compareSchemas(a.Schemas, other.Schemas); cmp != 0 {
+		return cmp
+	}
+
+	if a.Entrypoint != other.Entrypoint {
+		if a.Entrypoint {
+			return 1
+		}
+		return -1
+	}
+
+	if cmp := util.Compare(a.Custom, other.Custom); cmp != 0 {
+		return cmp
+	}
+
+	return 0
+}
+
+// GetTargetPath returns the path of the node these Annotations are applied to (the target)
+func (a *Annotations) GetTargetPath() Ref {
+	switch n := a.node.(type) {
+	case *Package:
+		return n.Path
+	case *Rule:
+		return n.Path()
+	default:
+		return nil
+	}
+}
+
+func (a *Annotations) setJSONOptions(opts JSONOptions) {
+	a.jsonOptions = opts
+}
+
+func (a *Annotations) MarshalJSON() ([]byte, error) {
+	if a == nil {
+		return []byte(`{"scope":""}`), nil
+	}
+
+	data := map[string]interface{}{
+		"scope": a.Scope,
+	}
+
+	if a.Title != "" {
+		data["title"] = a.Title
+	}
+
+	if a.Description != "" {
+		data["description"] = a.Description
+	}
+
+	if a.Entrypoint {
+		data["entrypoint"] = a.Entrypoint
+	}
+
+	if len(a.Organizations) > 0 {
+		data["organizations"] = a.Organizations
+	}
+
+	if len(a.RelatedResources) > 0 {
+		data["related_resources"] = a.RelatedResources
+	}
+
+	if len(a.Authors) > 0 {
+		data["authors"] = a.Authors
+	}
+
+	if len(a.Schemas) > 0 {
+		data["schemas"] = a.Schemas
+	}
+
+	if len(a.Custom) > 0 {
+		data["custom"] = a.Custom
+	}
+
+	if a.jsonOptions.MarshalOptions.IncludeLocation.Annotations {
+		if a.Location != nil {
+			data["location"] = a.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
+func NewAnnotationsRef(a *Annotations) *AnnotationsRef {
+	var loc *Location
+	if a.node != nil {
+		loc = a.node.Loc()
+	}
+
+	return &AnnotationsRef{
+		Location:    loc,
+		Path:        a.GetTargetPath(),
+		Annotations: a,
+		node:        a.node,
+		jsonOptions: a.jsonOptions,
+	}
+}
+
+func (ar *AnnotationsRef) GetPackage() *Package {
+	switch n := ar.node.(type) {
+	case *Package:
+		return n
+	case *Rule:
+		return n.Module.Package
+	default:
+		return nil
+	}
+}
+
+func (ar *AnnotationsRef) GetRule() *Rule {
+	switch n := ar.node.(type) {
+	case *Rule:
+		return n
+	default:
+		return nil
+	}
+}
+
+func (ar *AnnotationsRef) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"path": ar.Path,
+	}
+
+	if ar.Annotations != nil {
+		data["annotations"] = ar.Annotations
+	}
+
+	if ar.jsonOptions.MarshalOptions.IncludeLocation.AnnotationsRef {
+		if ar.Location != nil {
+			data["location"] = ar.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
+func scopeCompare(s1, s2 string) int {
+
+	o1 := scopeOrder(s1)
+	o2 := scopeOrder(s2)
+
+	if o2 < o1 {
+		return 1
+	} else if o2 > o1 {
+		return -1
+	}
+
+	if s1 < s2 {
+		return -1
+	} else if s2 < s1 {
+		return 1
+	}
+
+	return 0
+}
+
+func scopeOrder(s string) int {
+	switch s {
+	case annotationScopeRule:
+		return 1
+	}
+	return 0
+}
+
+func compareAuthors(a, b []*AuthorAnnotation) int {
+	if len(a) > len(b) {
+		return 1
+	} else if len(a) < len(b) {
+		return -1
+	}
+
+	for i := 0; i < len(a); i++ {
+		if cmp := a[i].Compare(b[i]); cmp != 0 {
+			return cmp
+		}
+	}
+
+	return 0
+}
+
+func compareRelatedResources(a, b []*RelatedResourceAnnotation) int {
+	if len(a) > len(b) {
+		return 1
+	} else if len(a) < len(b) {
+		return -1
+	}
+
+	for i := 0; i < len(a); i++ {
+		if cmp := strings.Compare(a[i].String(), b[i].String()); cmp != 0 {
+			return cmp
+		}
+	}
+
+	return 0
+}
+
+func compareSchemas(a, b []*SchemaAnnotation) int {
+	max := len(a)
+	if len(b) < max {
+		max = len(b)
+	}
+
+	for i := 0; i < max; i++ {
+		if cmp := a[i].Compare(b[i]); cmp != 0 {
+			return cmp
+		}
+	}
+
+	if len(a) > len(b) {
+		return 1
+	} else if len(a) < len(b) {
+		return -1
+	}
+
+	return 0
+}
+
+func compareStringLists(a, b []string) int {
+	if len(a) > len(b) {
+		return 1
+	} else if len(a) < len(b) {
+		return -1
+	}
+
+	for i := 0; i < len(a); i++ {
+		if cmp := strings.Compare(a[i], b[i]); cmp != 0 {
+			return cmp
+		}
+	}
+
+	return 0
+}
+
+// Copy returns a deep copy of s.
+func (a *Annotations) Copy(node Node) *Annotations {
+	cpy := *a
+
+	cpy.Organizations = make([]string, len(a.Organizations))
+	copy(cpy.Organizations, a.Organizations)
+
+	cpy.RelatedResources = make([]*RelatedResourceAnnotation, len(a.RelatedResources))
+	for i := range a.RelatedResources {
+		cpy.RelatedResources[i] = a.RelatedResources[i].Copy()
+	}
+
+	cpy.Authors = make([]*AuthorAnnotation, len(a.Authors))
+	for i := range a.Authors {
+		cpy.Authors[i] = a.Authors[i].Copy()
+	}
+
+	cpy.Schemas = make([]*SchemaAnnotation, len(a.Schemas))
+	for i := range a.Schemas {
+		cpy.Schemas[i] = a.Schemas[i].Copy()
+	}
+
+	cpy.Custom = deepcopy.Map(a.Custom)
+
+	cpy.node = node
+
+	return &cpy
+}
+
+// toObject constructs an AST Object from a.
+func (a *Annotations) toObject() (*Object, *Error) {
+	obj := NewObject()
+
+	if a == nil {
+		return &obj, nil
+	}
+
+	if len(a.Scope) > 0 {
+		obj.Insert(StringTerm("scope"), StringTerm(a.Scope))
+	}
+
+	if len(a.Title) > 0 {
+		obj.Insert(StringTerm("title"), StringTerm(a.Title))
+	}
+
+	if a.Entrypoint {
+		obj.Insert(StringTerm("entrypoint"), BooleanTerm(true))
+	}
+
+	if len(a.Description) > 0 {
+		obj.Insert(StringTerm("description"), StringTerm(a.Description))
+	}
+
+	if len(a.Organizations) > 0 {
+		orgs := make([]*Term, 0, len(a.Organizations))
+		for _, org := range a.Organizations {
+			orgs = append(orgs, StringTerm(org))
+		}
+		obj.Insert(StringTerm("organizations"), ArrayTerm(orgs...))
+	}
+
+	if len(a.RelatedResources) > 0 {
+		rrs := make([]*Term, 0, len(a.RelatedResources))
+		for _, rr := range a.RelatedResources {
+			rrObj := NewObject(Item(StringTerm("ref"), StringTerm(rr.Ref.String())))
+			if len(rr.Description) > 0 {
+				rrObj.Insert(StringTerm("description"), StringTerm(rr.Description))
+			}
+			rrs = append(rrs, NewTerm(rrObj))
+		}
+		obj.Insert(StringTerm("related_resources"), ArrayTerm(rrs...))
+	}
+
+	if len(a.Authors) > 0 {
+		as := make([]*Term, 0, len(a.Authors))
+		for _, author := range a.Authors {
+			aObj := NewObject()
+			if len(author.Name) > 0 {
+				aObj.Insert(StringTerm("name"), StringTerm(author.Name))
+			}
+			if len(author.Email) > 0 {
+				aObj.Insert(StringTerm("email"), StringTerm(author.Email))
+			}
+			as = append(as, NewTerm(aObj))
+		}
+		obj.Insert(StringTerm("authors"), ArrayTerm(as...))
+	}
+
+	if len(a.Schemas) > 0 {
+		ss := make([]*Term, 0, len(a.Schemas))
+		for _, s := range a.Schemas {
+			sObj := NewObject()
+			if len(s.Path) > 0 {
+				sObj.Insert(StringTerm("path"), NewTerm(s.Path.toArray()))
+			}
+			if len(s.Schema) > 0 {
+				sObj.Insert(StringTerm("schema"), NewTerm(s.Schema.toArray()))
+			}
+			if s.Definition != nil {
+				def, err := InterfaceToValue(s.Definition)
+				if err != nil {
+					return nil, NewError(CompileErr, a.Location, "invalid definition in schema annotation: %s", err.Error())
+				}
+				sObj.Insert(StringTerm("definition"), NewTerm(def))
+			}
+			ss = append(ss, NewTerm(sObj))
+		}
+		obj.Insert(StringTerm("schemas"), ArrayTerm(ss...))
+	}
+
+	if len(a.Custom) > 0 {
+		c, err := InterfaceToValue(a.Custom)
+		if err != nil {
+			return nil, NewError(CompileErr, a.Location, "invalid custom annotation %s", err.Error())
+		}
+		obj.Insert(StringTerm("custom"), NewTerm(c))
+	}
+
+	return &obj, nil
+}
+
+func attachAnnotationsNodes(mod *Module) Errors {
+	var errs Errors
+
+	// Find first non-annotation statement following each annotation and attach
+	// the annotation to that statement.
+	for _, a := range mod.Annotations {
+		for _, stmt := range mod.stmts {
+			_, ok := stmt.(*Annotations)
+			if !ok {
+				if stmt.Loc().Row > a.Location.Row {
+					a.node = stmt
+					break
+				}
+			}
+		}
+
+		if a.Scope == "" {
+			switch a.node.(type) {
+			case *Rule:
+				a.Scope = annotationScopeRule
+			case *Package:
+				a.Scope = annotationScopePackage
+			case *Import:
+				a.Scope = annotationScopeImport
+			}
+		}
+
+		if err := validateAnnotationScopeAttachment(a); err != nil {
+			errs = append(errs, err)
+		}
+
+		if err := validateAnnotationEntrypointAttachment(a); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	return errs
+}
+
+func validateAnnotationScopeAttachment(a *Annotations) *Error {
+
+	switch a.Scope {
+	case annotationScopeRule, annotationScopeDocument:
+		if _, ok := a.node.(*Rule); ok {
+			return nil
+		}
+		return newScopeAttachmentErr(a, "rule")
+	case annotationScopePackage, annotationScopeSubpackages:
+		if _, ok := a.node.(*Package); ok {
+			return nil
+		}
+		return newScopeAttachmentErr(a, "package")
+	}
+
+	return NewError(ParseErr, a.Loc(), "invalid annotation scope '%v'. Use one of '%s', '%s', '%s', or '%s'",
+		a.Scope, annotationScopeRule, annotationScopeDocument, annotationScopePackage, annotationScopeSubpackages)
+}
+
+func validateAnnotationEntrypointAttachment(a *Annotations) *Error {
+	if a.Entrypoint && !(a.Scope == annotationScopeRule || a.Scope == annotationScopePackage) {
+		return NewError(ParseErr, a.Loc(), "annotation entrypoint applied to non-rule or package scope '%v'", a.Scope)
+	}
+	return nil
+}
+
+// Copy returns a deep copy of a.
+func (a *AuthorAnnotation) Copy() *AuthorAnnotation {
+	cpy := *a
+	return &cpy
+}
+
+// Compare returns an integer indicating if s is less than, equal to, or greater
+// than other.
+func (a *AuthorAnnotation) Compare(other *AuthorAnnotation) int {
+	if cmp := strings.Compare(a.Name, other.Name); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := strings.Compare(a.Email, other.Email); cmp != 0 {
+		return cmp
+	}
+
+	return 0
+}
+
+func (a *AuthorAnnotation) String() string {
+	if len(a.Email) == 0 {
+		return a.Name
+	} else if len(a.Name) == 0 {
+		return fmt.Sprintf("<%s>", a.Email)
+	} else {
+		return fmt.Sprintf("%s <%s>", a.Name, a.Email)
+	}
+}
+
+// Copy returns a deep copy of rr.
+func (rr *RelatedResourceAnnotation) Copy() *RelatedResourceAnnotation {
+	cpy := *rr
+	return &cpy
+}
+
+// Compare returns an integer indicating if s is less than, equal to, or greater
+// than other.
+func (rr *RelatedResourceAnnotation) Compare(other *RelatedResourceAnnotation) int {
+	if cmp := strings.Compare(rr.Description, other.Description); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := strings.Compare(rr.Ref.String(), other.Ref.String()); cmp != 0 {
+		return cmp
+	}
+
+	return 0
+}
+
+func (rr *RelatedResourceAnnotation) String() string {
+	bs, _ := json.Marshal(rr)
+	return string(bs)
+}
+
+func (rr *RelatedResourceAnnotation) MarshalJSON() ([]byte, error) {
+	d := map[string]interface{}{
+		"ref": rr.Ref.String(),
+	}
+
+	if len(rr.Description) > 0 {
+		d["description"] = rr.Description
+	}
+
+	return json.Marshal(d)
+}
+
+// Copy returns a deep copy of s.
+func (s *SchemaAnnotation) Copy() *SchemaAnnotation {
+	cpy := *s
+	return &cpy
+}
+
+// Compare returns an integer indicating if s is less than, equal to, or greater
+// than other.
+func (s *SchemaAnnotation) Compare(other *SchemaAnnotation) int {
+
+	if cmp := s.Path.Compare(other.Path); cmp != 0 {
+		return cmp
+	}
+
+	if cmp := s.Schema.Compare(other.Schema); cmp != 0 {
+		return cmp
+	}
+
+	if s.Definition != nil && other.Definition == nil {
+		return -1
+	} else if s.Definition == nil && other.Definition != nil {
+		return 1
+	} else if s.Definition != nil && other.Definition != nil {
+		return util.Compare(*s.Definition, *other.Definition)
+	}
+
+	return 0
+}
+
+func (s *SchemaAnnotation) String() string {
+	bs, _ := json.Marshal(s)
+	return string(bs)
+}
+
+func newAnnotationSet() *AnnotationSet {
+	return &AnnotationSet{
+		byRule:    map[*Rule][]*Annotations{},
+		byPackage: map[int]*Annotations{},
+		byPath:    newAnnotationTree(),
+	}
+}
+
+func BuildAnnotationSet(modules []*Module) (*AnnotationSet, Errors) {
+	as := newAnnotationSet()
+	var errs Errors
+	for _, m := range modules {
+		for _, a := range m.Annotations {
+			if err := as.add(a); err != nil {
+				errs = append(errs, err)
+			}
+		}
+	}
+	if len(errs) > 0 {
+		return nil, errs
+	}
+	as.modules = modules
+	return as, nil
+}
+
+// NOTE(philipc): During copy propagation, the underlying Nodes can be
+// stripped away from the annotations, leading to nil deref panics. We
+// silently ignore these cases for now, as a workaround.
+func (as *AnnotationSet) add(a *Annotations) *Error {
+	switch a.Scope {
+	case annotationScopeRule:
+		if rule, ok := a.node.(*Rule); ok {
+			as.byRule[rule] = append(as.byRule[rule], a)
+		}
+	case annotationScopePackage:
+		if pkg, ok := a.node.(*Package); ok {
+			hash := pkg.Path.Hash()
+			if exist, ok := as.byPackage[hash]; ok {
+				return errAnnotationRedeclared(a, exist.Location)
+			}
+			as.byPackage[hash] = a
+		}
+	case annotationScopeDocument:
+		if rule, ok := a.node.(*Rule); ok {
+			path := rule.Path()
+			x := as.byPath.get(path)
+			if x != nil {
+				return errAnnotationRedeclared(a, x.Value.Location)
+			}
+			as.byPath.insert(path, a)
+		}
+	case annotationScopeSubpackages:
+		if pkg, ok := a.node.(*Package); ok {
+			x := as.byPath.get(pkg.Path)
+			if x != nil && x.Value != nil {
+				return errAnnotationRedeclared(a, x.Value.Location)
+			}
+			as.byPath.insert(pkg.Path, a)
+		}
+	}
+	return nil
+}
+
+func (as *AnnotationSet) GetRuleScope(r *Rule) []*Annotations {
+	if as == nil {
+		return nil
+	}
+	return as.byRule[r]
+}
+
+func (as *AnnotationSet) GetSubpackagesScope(path Ref) []*Annotations {
+	if as == nil {
+		return nil
+	}
+	return as.byPath.ancestors(path)
+}
+
+func (as *AnnotationSet) GetDocumentScope(path Ref) *Annotations {
+	if as == nil {
+		return nil
+	}
+	if node := as.byPath.get(path); node != nil {
+		return node.Value
+	}
+	return nil
+}
+
+func (as *AnnotationSet) GetPackageScope(pkg *Package) *Annotations {
+	if as == nil {
+		return nil
+	}
+	return as.byPackage[pkg.Path.Hash()]
+}
+
+// Flatten returns a flattened list view of this AnnotationSet.
+// The returned slice is sorted, first by the annotations' target path, then by their target location
+func (as *AnnotationSet) Flatten() FlatAnnotationsRefSet {
+	// This preallocation often won't be optimal, but it's superior to starting with a nil slice.
+	refs := make([]*AnnotationsRef, 0, len(as.byPath.Children)+len(as.byRule)+len(as.byPackage))
+
+	refs = as.byPath.flatten(refs)
+
+	for _, a := range as.byPackage {
+		refs = append(refs, NewAnnotationsRef(a))
+	}
+
+	for _, as := range as.byRule {
+		for _, a := range as {
+			refs = append(refs, NewAnnotationsRef(a))
+		}
+	}
+
+	// Sort by path, then annotation location, for stable output
+	sort.SliceStable(refs, func(i, j int) bool {
+		return refs[i].Compare(refs[j]) < 0
+	})
+
+	return refs
+}
+
+// Chain returns the chain of annotations leading up to the given rule.
+// The returned slice is ordered as follows
+// 0. Entries for the given rule, ordered from the METADATA block declared immediately above the rule, to the block declared farthest away (always at least one entry)
+// 1. The 'document' scope entry, if any
+// 2. The 'package' scope entry, if any
+// 3. Entries for the 'subpackages' scope, if any; ordered from the closest package path to the fartest. E.g.: 'do.re.mi', 'do.re', 'do'
+// The returned slice is guaranteed to always contain at least one entry, corresponding to the given rule.
+func (as *AnnotationSet) Chain(rule *Rule) AnnotationsRefSet {
+	var refs []*AnnotationsRef
+
+	ruleAnnots := as.GetRuleScope(rule)
+
+	if len(ruleAnnots) >= 1 {
+		for _, a := range ruleAnnots {
+			refs = append(refs, NewAnnotationsRef(a))
+		}
+	} else {
+		// Make sure there is always a leading entry representing the passed rule, even if it has no annotations
+		refs = append(refs, &AnnotationsRef{
+			Location: rule.Location,
+			Path:     rule.Path(),
+			node:     rule,
+		})
+	}
+
+	if len(refs) > 1 {
+		// Sort by annotation location; chain must start with annotations declared closest to rule, then going outward
+		sort.SliceStable(refs, func(i, j int) bool {
+			return refs[i].Annotations.Location.Compare(refs[j].Annotations.Location) > 0
+		})
+	}
+
+	docAnnots := as.GetDocumentScope(rule.Path())
+	if docAnnots != nil {
+		refs = append(refs, NewAnnotationsRef(docAnnots))
+	}
+
+	pkg := rule.Module.Package
+	pkgAnnots := as.GetPackageScope(pkg)
+	if pkgAnnots != nil {
+		refs = append(refs, NewAnnotationsRef(pkgAnnots))
+	}
+
+	subPkgAnnots := as.GetSubpackagesScope(pkg.Path)
+	// We need to reverse the order, as subPkgAnnots ordering will start at the root,
+	// whereas we want to end at the root.
+	for i := len(subPkgAnnots) - 1; i >= 0; i-- {
+		refs = append(refs, NewAnnotationsRef(subPkgAnnots[i]))
+	}
+
+	return refs
+}
+
+func (ars FlatAnnotationsRefSet) Insert(ar *AnnotationsRef) FlatAnnotationsRefSet {
+	result := make(FlatAnnotationsRefSet, 0, len(ars)+1)
+
+	// insertion sort, first by path, then location
+	for i, current := range ars {
+		if ar.Compare(current) < 0 {
+			result = append(result, ar)
+			result = append(result, ars[i:]...)
+			break
+		}
+		result = append(result, current)
+	}
+
+	if len(result) < len(ars)+1 {
+		result = append(result, ar)
+	}
+
+	return result
+}
+
+func newAnnotationTree() *annotationTreeNode {
+	return &annotationTreeNode{
+		Value:    nil,
+		Children: map[Value]*annotationTreeNode{},
+	}
+}
+
+func (t *annotationTreeNode) insert(path Ref, value *Annotations) {
+	node := t
+	for _, k := range path {
+		child, ok := node.Children[k.Value]
+		if !ok {
+			child = newAnnotationTree()
+			node.Children[k.Value] = child
+		}
+		node = child
+	}
+	node.Value = value
+}
+
+func (t *annotationTreeNode) get(path Ref) *annotationTreeNode {
+	node := t
+	for _, k := range path {
+		if node == nil {
+			return nil
+		}
+		child, ok := node.Children[k.Value]
+		if !ok {
+			return nil
+		}
+		node = child
+	}
+	return node
+}
+
+// ancestors returns a slice of annotations in ascending order, starting with the root of ref; e.g.: 'root', 'root.foo', 'root.foo.bar'.
+func (t *annotationTreeNode) ancestors(path Ref) (result []*Annotations) {
+	node := t
+	for _, k := range path {
+		if node == nil {
+			return result
+		}
+		child, ok := node.Children[k.Value]
+		if !ok {
+			return result
+		}
+		if child.Value != nil {
+			result = append(result, child.Value)
+		}
+		node = child
+	}
+	return result
+}
+
+func (t *annotationTreeNode) flatten(refs []*AnnotationsRef) []*AnnotationsRef {
+	if a := t.Value; a != nil {
+		refs = append(refs, NewAnnotationsRef(a))
+	}
+	for _, c := range t.Children {
+		refs = c.flatten(refs)
+	}
+	return refs
+}
+
+func (ar *AnnotationsRef) Compare(other *AnnotationsRef) int {
+	if c := ar.Path.Compare(other.Path); c != 0 {
+		return c
+	}
+
+	if c := ar.Annotations.Location.Compare(other.Annotations.Location); c != 0 {
+		return c
+	}
+
+	return ar.Annotations.Compare(other.Annotations)
+}
diff --git a/ast/annotations_test.go b/ast/annotations_test.go
new file mode 100644
index 0000000000..05563d5197
--- /dev/null
+++ b/ast/annotations_test.go
@@ -0,0 +1,1106 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package ast
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+)
+
+// Test of example code in docs/content/annotations.md
+func ExampleAnnotationSet_Flatten() {
+	modules := [][]string{
+		{
+			"foo.rego", `# METADATA
+# scope: subpackages
+# organizations:
+# - Acme Corp.
+package foo`},
+		{
+			"mod", `# METADATA
+# description: A couple of useful rules
+package foo.bar
+
+# METADATA
+# title: My Rule P
+p := 7`},
+	}
+
+	parsed := make([]*Module, 0, len(modules))
+	for _, entry := range modules {
+		pm, err := ParseModuleWithOpts(entry[0], entry[1], ParserOptions{ProcessAnnotation: true})
+		if err != nil {
+			panic(err)
+		}
+		parsed = append(parsed, pm)
+	}
+
+	as, err := BuildAnnotationSet(parsed)
+	if err != nil {
+		panic(err)
+	}
+
+	flattened := as.Flatten()
+	for _, entry := range flattened {
+		fmt.Printf("%v at %v has annotations %v\n",
+			entry.Path,
+			entry.Location,
+			entry.Annotations)
+	}
+
+	// Output:
+	// data.foo at foo.rego:5 has annotations {"organizations":["Acme Corp."],"scope":"subpackages"}
+	// data.foo.bar at mod:3 has annotations {"description":"A couple of useful rules","scope":"package"}
+	// data.foo.bar.p at mod:7 has annotations {"scope":"rule","title":"My Rule P"}
+}
+
+// Test of example code in docs/content/annotations.md
+func ExampleAnnotationSet_Chain() {
+	modules := [][]string{
+		{
+			"foo.rego", `# METADATA
+# scope: subpackages
+# organizations:
+# - Acme Corp.
+package foo`},
+		{
+			"mod", `# METADATA
+# description: A couple of useful rules
+package foo.bar
+
+# METADATA
+# title: My Rule P
+p := 7`},
+	}
+
+	parsed := make([]*Module, 0, len(modules))
+	for _, entry := range modules {
+		pm, err := ParseModuleWithOpts(entry[0], entry[1], ParserOptions{ProcessAnnotation: true})
+		if err != nil {
+			panic(err)
+		}
+		parsed = append(parsed, pm)
+	}
+
+	as, err := BuildAnnotationSet(parsed)
+	if err != nil {
+		panic(err)
+	}
+
+	rule := parsed[1].Rules[0]
+
+	flattened := as.Chain(rule)
+	for _, entry := range flattened {
+		fmt.Printf("%v at %v has annotations %v\n",
+			entry.Path,
+			entry.Location,
+			entry.Annotations)
+	}
+
+	// Output:
+	// data.foo.bar.p at mod:7 has annotations {"scope":"rule","title":"My Rule P"}
+	// data.foo.bar at mod:3 has annotations {"description":"A couple of useful rules","scope":"package"}
+	// data.foo at foo.rego:5 has annotations {"organizations":["Acme Corp."],"scope":"subpackages"}
+}
+
+func TestAnnotationSet_Flatten(t *testing.T) {
+	tests := []struct {
+		note     string
+		modules  map[string]string
+		expected []AnnotationsRef
+	}{
+		{
+			note:     "no modules",
+			modules:  map[string]string{},
+			expected: []AnnotationsRef{},
+		},
+		{
+			note: "simple module (all annotation types)",
+			modules: map[string]string{
+				"module": `# METADATA
+# title: pkg
+# description: pkg
+# organizations:
+# - pkg
+# related_resources:
+# - https://pkg
+# authors:
+# - pkg
+# schemas:
+# - input: {"type": "boolean"}
+# custom:
+#  pkg: pkg
+package test
+
+# METADATA
+# scope: document
+# title: doc
+# description: doc
+# organizations:
+# - doc
+# related_resources:
+# - https://doc
+# authors:
+# - doc
+# schemas:
+# - input: {"type": "integer"}
+# custom:
+#  doc: doc
+
+# METADATA
+# title: rule
+# description: rule
+# organizations:
+# - rule
+# related_resources:
+# - https://rule
+# authors:
+# - rule
+# schemas:
+# - input: {"type": "string"}
+# custom:
+#  rule: rule
+p = 1`,
+			},
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.test"),
+					Location: &Location{File: "module", Row: 14},
+					Annotations: &Annotations{
+						Scope:         "package",
+						Title:         "pkg",
+						Description:   "pkg",
+						Organizations: []string{"pkg"},
+						RelatedResources: []*RelatedResourceAnnotation{
+							{
+								Ref: mustParseURL("https://pkg"),
+							},
+						},
+						Authors: []*AuthorAnnotation{
+							{
+								Name: "pkg",
+							},
+						},
+						Schemas: []*SchemaAnnotation{
+							schemaAnnotationFromMap("input", map[string]interface{}{
+								"type": "boolean",
+							}),
+						},
+						Custom: map[string]interface{}{
+							"pkg": "pkg",
+						},
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 44},
+					Annotations: &Annotations{
+						Scope:         "document",
+						Title:         "doc",
+						Description:   "doc",
+						Organizations: []string{"doc"},
+						RelatedResources: []*RelatedResourceAnnotation{
+							{
+								Ref: mustParseURL("https://doc"),
+							},
+						},
+						Authors: []*AuthorAnnotation{
+							{
+								Name: "doc",
+							},
+						},
+						Schemas: []*SchemaAnnotation{
+							schemaAnnotationFromMap("input", map[string]interface{}{
+								"type": "integer",
+							}),
+						},
+						Custom: map[string]interface{}{
+							"doc": "doc",
+						},
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 44},
+					Annotations: &Annotations{
+						Scope:         "rule",
+						Title:         "rule",
+						Description:   "rule",
+						Organizations: []string{"rule"},
+						RelatedResources: []*RelatedResourceAnnotation{
+							{
+								Ref: mustParseURL("https://rule"),
+							},
+						},
+						Authors: []*AuthorAnnotation{
+							{
+								Name: "rule",
+							},
+						},
+						Schemas: []*SchemaAnnotation{
+							schemaAnnotationFromMap("input", map[string]interface{}{
+								"type": "string",
+							}),
+						},
+						Custom: map[string]interface{}{
+							"rule": "rule",
+						},
+					},
+				},
+			},
+		},
+		{
+			note: "multiple subpackages",
+			modules: map[string]string{
+				"root": `# METADATA
+# scope: subpackages
+# title: ROOT
+package root`,
+				"root.foo": `# METADATA
+# title: FOO
+# scope: subpackages
+package root.foo`,
+				"root.foo.baz": `# METADATA
+# title: BAZ
+package root.foo.baz`,
+				"root.bar": `# METADATA
+# title: BAR
+# scope: subpackages
+package root.bar`,
+				"root.bar.baz": `# METADATA
+# title: BAZ
+package root.bar.baz`,
+				"root2": `# METADATA
+# scope: subpackages
+# title: ROOT2
+package root2`,
+			},
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.root"),
+					Location: &Location{File: "root", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "ROOT",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.bar"),
+					Location: &Location{File: "root.bar", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "BAR",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.bar.baz"),
+					Location: &Location{File: "root.bar.baz", Row: 3},
+					Annotations: &Annotations{
+						Scope: "package",
+						Title: "BAZ",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo"),
+					Location: &Location{File: "root.foo", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "FOO",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo.baz"),
+					Location: &Location{File: "root.foo.baz", Row: 3},
+					Annotations: &Annotations{
+						Scope: "package",
+						Title: "BAZ",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root2"),
+					Location: &Location{File: "root2", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "ROOT2",
+					},
+				},
+			},
+		},
+		{
+			note: "overlapping rule paths (same module)",
+			modules: map[string]string{
+				"mod": `package test
+
+# METADATA
+# title: P1
+p[v] {v = 1}
+
+# METADATA
+# title: P2
+p[v] {v = 2}`,
+			},
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "mod", Row: 5},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P1",
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "mod", Row: 9},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P2",
+					},
+				},
+			},
+		},
+		{
+			note: "overlapping rule paths (different modules)",
+			modules: map[string]string{
+				"mod1": `package test
+# METADATA
+# title: P1
+p[v] {v = 1}`,
+				"mod2": `package test
+# METADATA
+# title: P2
+p[v] {v = 2}`,
+			},
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "mod1", Row: 4},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P1",
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "mod2", Row: 4},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P2",
+					},
+				},
+			},
+		},
+		{
+			note: "overlapping rule paths (different modules, rule head refs)",
+			modules: map[string]string{
+				"mod1": `package test.a
+# METADATA
+# title: P1
+b.c.p[v] {v = 1}`,
+				"mod2": `package test
+# METADATA
+# title: P2
+a.b.c.p[v] {v = 2}`,
+			},
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.test.a.b.c.p"),
+					Location: &Location{File: "mod1", Row: 4},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P1",
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.a.b.c.p"),
+					Location: &Location{File: "mod2", Row: 4},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P2",
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := MustCompileModulesWithOpts(tc.modules,
+				CompileOpts{ParserOptions: ParserOptions{ProcessAnnotation: true}})
+
+			as := compiler.GetAnnotationSet()
+			if as == nil {
+				t.Fatalf("Expected compiled AnnotationSet, got nil")
+			}
+
+			flattened := as.Flatten()
+
+			if len(flattened) != len(tc.expected) {
+				t.Fatalf("flattened AnnotationSet\n%v\ndoesn't match expected\n%v",
+					toJSON(flattened), toJSON(tc.expected))
+			}
+
+			for i, expected := range tc.expected {
+				a := flattened[i]
+				if !expected.Path.Equal(a.Path) {
+					t.Fatalf("path of AnnotationRef at %d '%v' doesn't match expected '%v'",
+						i, a.Path, expected.Path)
+				}
+				if expected.Location.File != a.Location.File || expected.Location.Row != a.Location.Row {
+					t.Fatalf("location of AnnotationRef at %d '%v' doesn't match expected '%v'",
+						i, a.Location, expected.Location)
+				}
+				if expected.Annotations.Compare(a.Annotations) != 0 {
+					t.Fatalf("annotations of AnnotationRef at %d\n%v\ndoesn't match expected\n%v",
+						i, a.Annotations, expected.Annotations)
+				}
+			}
+		})
+	}
+}
+
+func TestAnnotationSet_Chain(t *testing.T) {
+	tests := []struct {
+		note                string
+		modules             map[string]string
+		moduleToAnalyze     string
+		ruleOnLineToAnalyze int
+		expected            []AnnotationsRef
+	}{
+		{
+			note: "simple module (all annotation types)",
+			modules: map[string]string{
+				"module": `# METADATA
+# title: pkg
+# description: pkg
+# organizations:
+# - pkg
+# related_resources:
+# - https://pkg
+# authors:
+# - pkg
+# schemas:
+# - input.foo: {"type": "boolean"}
+# custom:
+#  pkg: pkg
+package test
+
+# METADATA
+# scope: document
+# title: doc
+# description: doc
+# organizations:
+# - doc
+# related_resources:
+# - https://doc
+# authors:
+# - doc
+# schemas:
+# - input.bar: {"type": "integer"}
+# custom:
+#  doc: doc
+
+# METADATA
+# title: rule
+# description: rule
+# organizations:
+# - rule
+# related_resources:
+# - https://rule
+# authors:
+# - rule
+# schemas:
+# - input.baz: {"type": "string"}
+# custom:
+#  rule: rule
+p = 1`,
+			},
+			moduleToAnalyze:     "module",
+			ruleOnLineToAnalyze: 44,
+			expected: []AnnotationsRef{
+				{ // Rule annotation is always first
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 44},
+					Annotations: &Annotations{
+						Scope:         "rule",
+						Title:         "rule",
+						Description:   "rule",
+						Organizations: []string{"rule"},
+						RelatedResources: []*RelatedResourceAnnotation{
+							{
+								Ref: mustParseURL("https://rule"),
+							},
+						},
+						Authors: []*AuthorAnnotation{
+							{
+								Name: "rule",
+							},
+						},
+						Schemas: []*SchemaAnnotation{
+							schemaAnnotationFromMap("input.baz", map[string]interface{}{
+								"type": "string",
+							}),
+						},
+						Custom: map[string]interface{}{
+							"rule": "rule",
+						},
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 44},
+					Annotations: &Annotations{
+						Scope:         "document",
+						Title:         "doc",
+						Description:   "doc",
+						Organizations: []string{"doc"},
+						RelatedResources: []*RelatedResourceAnnotation{
+							{
+								Ref: mustParseURL("https://doc"),
+							},
+						},
+						Authors: []*AuthorAnnotation{
+							{
+								Name: "doc",
+							},
+						},
+						Schemas: []*SchemaAnnotation{
+							schemaAnnotationFromMap("input.bar", map[string]interface{}{
+								"type": "integer",
+							}),
+						},
+						Custom: map[string]interface{}{
+							"doc": "doc",
+						},
+					},
+				},
+				{
+					Path:     MustParseRef("data.test"),
+					Location: &Location{File: "module", Row: 14},
+					Annotations: &Annotations{
+						Scope:         "package",
+						Title:         "pkg",
+						Description:   "pkg",
+						Organizations: []string{"pkg"},
+						RelatedResources: []*RelatedResourceAnnotation{
+							{
+								Ref: mustParseURL("https://pkg"),
+							},
+						},
+						Authors: []*AuthorAnnotation{
+							{
+								Name: "pkg",
+							},
+						},
+						Schemas: []*SchemaAnnotation{
+							schemaAnnotationFromMap("input.foo", map[string]interface{}{
+								"type": "boolean",
+							}),
+						},
+						Custom: map[string]interface{}{
+							"pkg": "pkg",
+						},
+					},
+				},
+			},
+		},
+		{
+			note: "no annotations on rule",
+			modules: map[string]string{
+				"module": `# METADATA
+# title: pkg
+# description: pkg
+package test
+
+# METADATA
+# scope: document
+# title: doc
+# description: doc
+
+p = 1`,
+			},
+			moduleToAnalyze:     "module",
+			ruleOnLineToAnalyze: 11,
+			expected: []AnnotationsRef{
+				{ // Rule entry is always first, even if no annotations are present
+					Path:        MustParseRef("data.test.p"),
+					Location:    &Location{File: "module", Row: 11},
+					Annotations: nil,
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 11},
+					Annotations: &Annotations{
+						Scope:       "document",
+						Title:       "doc",
+						Description: "doc",
+					},
+				},
+
+				{
+					Path:     MustParseRef("data.test"),
+					Location: &Location{File: "module", Row: 4},
+					Annotations: &Annotations{
+						Scope:       "package",
+						Title:       "pkg",
+						Description: "pkg",
+					},
+				},
+			},
+		},
+		{
+			note: "multiple subpackages",
+			modules: map[string]string{
+				"root": `# METADATA
+# scope: subpackages
+# title: ROOT
+package root`,
+				"root.foo": `# METADATA
+# title: FOO
+# scope: subpackages
+package root.foo`,
+				"root.foo.bar": `# METADATA
+# scope: subpackages
+# description: subpackages scope applied to rule in other module
+# title: BAR-sub
+
+# METADATA
+# title: BAR-other
+# description: This metadata is on the path of the queried rule, and should show up in the result even though it's in a different module.
+package root.foo.bar
+
+# METADATA
+# scope: document
+# description: document scope applied to rule in other module
+# title: P-doc
+p = 1`,
+				"rule": `package root.foo.bar
+
+# METADATA
+# title: P
+p = 1`,
+			},
+			moduleToAnalyze:     "rule",
+			ruleOnLineToAnalyze: 5,
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.root.foo.bar.p"),
+					Location: &Location{File: "rule", Row: 5},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo.bar.p"),
+					Location: &Location{File: "root.foo.bar", Row: 15},
+					Annotations: &Annotations{
+						Scope:       "document",
+						Title:       "P-doc",
+						Description: "document scope applied to rule in other module",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo.bar"),
+					Location: &Location{File: "root.foo.bar", Row: 9},
+					Annotations: &Annotations{
+						Scope:       "package",
+						Title:       "BAR-other",
+						Description: "This metadata is on the path of the queried rule, and should show up in the result even though it's in a different module.",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo.bar"),
+					Location: &Location{File: "root.foo.bar", Row: 9},
+					Annotations: &Annotations{
+						Scope:       "subpackages",
+						Title:       "BAR-sub",
+						Description: "subpackages scope applied to rule in other module",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo"),
+					Location: &Location{File: "root.foo", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "FOO",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root"),
+					Location: &Location{File: "root", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "ROOT",
+					},
+				},
+			},
+		},
+		{
+			note: "multiple subpackages, refs in rule heads", // NOTE(sr): same as above, but last module's rule is `foo.bar.p` in package `root`
+			modules: map[string]string{
+				"root": `# METADATA
+# scope: subpackages
+# title: ROOT
+package root`,
+				"root.foo": `# METADATA
+# title: FOO
+# scope: subpackages
+package root.foo`,
+				"root.foo.bar": `# METADATA
+# scope: subpackages
+# description: subpackages scope applied to rule in other module
+# title: BAR-sub
+
+# METADATA
+# title: BAR-other
+# description: This metadata is on the path of the queried rule, but shouldn't show up in the result as it's in a different module.
+package root.foo.bar
+
+# METADATA
+# scope: document
+# description: document scope applied to rule in other module
+# title: P-doc
+p = 1`,
+				"rule": `# METADATA
+# title: BAR
+package root
+
+# METADATA
+# title: P
+foo.bar.p = 1`,
+			},
+			moduleToAnalyze:     "rule",
+			ruleOnLineToAnalyze: 7,
+			expected: []AnnotationsRef{
+				{
+					Path:     MustParseRef("data.root.foo.bar.p"),
+					Location: &Location{File: "rule", Row: 7},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "P",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root.foo.bar.p"),
+					Location: &Location{File: "root.foo.bar", Row: 15},
+					Annotations: &Annotations{
+						Scope:       "document",
+						Title:       "P-doc",
+						Description: "document scope applied to rule in other module",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root"),
+					Location: &Location{File: "rule", Row: 3},
+					Annotations: &Annotations{
+						Scope: "package",
+						Title: "BAR",
+					},
+				},
+				{
+					Path:     MustParseRef("data.root"),
+					Location: &Location{File: "root", Row: 4},
+					Annotations: &Annotations{
+						Scope: "subpackages",
+						Title: "ROOT",
+					},
+				},
+			},
+		},
+		{
+			note: "multiple metadata blocks for single rule (order)",
+			modules: map[string]string{
+				"module": `package test
+
+# METADATA
+# title: One
+
+# METADATA
+# title: Two
+
+# METADATA
+# title: Three
+
+# METADATA
+# title: Four
+p = true`,
+			},
+			moduleToAnalyze:     "module",
+			ruleOnLineToAnalyze: 14,
+			expected: []AnnotationsRef{ // Rule annotations order is expected to start closest to the rule, moving out
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 14},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "Four",
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 14},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "Three",
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 14},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "Two",
+					},
+				},
+				{
+					Path:     MustParseRef("data.test.p"),
+					Location: &Location{File: "module", Row: 14},
+					Annotations: &Annotations{
+						Scope: "rule",
+						Title: "One",
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := MustCompileModulesWithOpts(tc.modules,
+				CompileOpts{ParserOptions: ParserOptions{ProcessAnnotation: true}})
+
+			as := compiler.GetAnnotationSet()
+			if as == nil {
+				t.Fatalf("Expected compiled AnnotationSet, got nil")
+			}
+
+			m := compiler.Modules[tc.moduleToAnalyze]
+			if m == nil {
+				t.Fatalf("no such module: %s", tc.moduleToAnalyze)
+			}
+
+			var rule *Rule
+			for _, r := range m.Rules {
+				if r.Location.Row == tc.ruleOnLineToAnalyze {
+					rule = r
+					break
+				}
+			}
+			if rule == nil {
+				t.Fatalf("no rule found on line %d in module '%s'",
+					tc.ruleOnLineToAnalyze, tc.moduleToAnalyze)
+			}
+
+			chain := as.Chain(rule)
+
+			if len(chain) != len(tc.expected) {
+				t.Errorf("expected %d elements, got %d:", len(tc.expected), len(chain))
+				t.Fatalf("chained AnnotationSet\n%v\n\ndoesn't match expected\n\n%v",
+					toJSON(chain), toJSON(tc.expected))
+			}
+
+			for i, expected := range tc.expected {
+				a := chain[i]
+				if !expected.Path.Equal(a.Path) {
+					t.Fatalf("path of AnnotationRef at %d '%v' doesn't match expected '%v'",
+						i, a.Path, expected.Path)
+				}
+				if expected.Location.File != a.Location.File || expected.Location.Row != a.Location.Row {
+					t.Fatalf("location of AnnotationRef at %d '%v' doesn't match expected '%v'",
+						i, a.Location, expected.Location)
+				}
+				if expected.Annotations.Compare(a.Annotations) != 0 {
+					t.Fatalf("annotations of AnnotationRef at %d\n%v\n\ndoesn't match expected\n\n%v",
+						i, a.Annotations, expected.Annotations)
+				}
+			}
+		})
+	}
+}
+
+func TestAnnotations_toObject(t *testing.T) {
+	annotations := Annotations{
+		Scope:       annotationScopeRule,
+		Title:       "A title",
+		Description: "A description",
+		Organizations: []string{
+			"Acme Corp.",
+			"Tyrell Corp.",
+		},
+		RelatedResources: []*RelatedResourceAnnotation{
+			{
+				Ref:         mustParseURL("https://example.com"),
+				Description: "An example",
+			},
+			{
+				Ref: mustParseURL("https://another.example.com"),
+			},
+		},
+		Authors: []*AuthorAnnotation{
+			{
+				Name:  "John Doe",
+				Email: "john@example.com",
+			},
+			{
+				Name: "Jane Doe",
+			},
+			{
+				Email: "jeff@example.com",
+			},
+		},
+		Schemas: []*SchemaAnnotation{
+			{
+				Path:   MustParseRef("input.foo"),
+				Schema: MustParseRef("schema.a"),
+			},
+			schemaAnnotationFromMap("input.bar", map[string]interface{}{
+				"type": "boolean",
+			}),
+		},
+		Custom: map[string]interface{}{
+			"number": 42,
+			"float":  2.2,
+			"string": "foo bar baz",
+			"bool":   true,
+			"list": []interface{}{
+				"a", "b",
+			},
+			"list_of_lists": []interface{}{
+				[]interface{}{
+					"a", "b",
+				},
+				[]interface{}{
+					"b", "c",
+				},
+			},
+			"list_of_maps": []interface{}{
+				map[string]interface{}{
+					"one": 1,
+					"two": 2,
+				},
+				map[string]interface{}{
+					"two":   2,
+					"three": 3,
+				},
+			},
+			"map": map[string]interface{}{
+				"nested_number": 1,
+				"nested_map": map[string]interface{}{
+					"do": "re",
+					"mi": "fa",
+				},
+				"nested_list": []interface{}{
+					1, 2, 3,
+				},
+			},
+		},
+	}
+
+	expected := NewObject(
+		Item(StringTerm("scope"), StringTerm(annotationScopeRule)),
+		Item(StringTerm("title"), StringTerm("A title")),
+		Item(StringTerm("description"), StringTerm("A description")),
+		Item(StringTerm("organizations"), ArrayTerm(
+			StringTerm("Acme Corp."),
+			StringTerm("Tyrell Corp."),
+		)),
+		Item(StringTerm("related_resources"), ArrayTerm(
+			ObjectTerm(
+				Item(StringTerm("ref"), StringTerm("https://example.com")),
+				Item(StringTerm("description"), StringTerm("An example")),
+			),
+			ObjectTerm(
+				Item(StringTerm("ref"), StringTerm("https://another.example.com")),
+			),
+		)),
+		Item(StringTerm("authors"), ArrayTerm(
+			ObjectTerm(
+				Item(StringTerm("name"), StringTerm("John Doe")),
+				Item(StringTerm("email"), StringTerm("john@example.com")),
+			),
+			ObjectTerm(
+				Item(StringTerm("name"), StringTerm("Jane Doe")),
+			),
+			ObjectTerm(
+				Item(StringTerm("email"), StringTerm("jeff@example.com")),
+			),
+		)),
+		Item(StringTerm("schemas"), ArrayTerm(
+			ObjectTerm(
+				Item(StringTerm("path"), ArrayTerm(StringTerm("input"), StringTerm("foo"))),
+				Item(StringTerm("schema"), ArrayTerm(StringTerm("schema"), StringTerm("a"))),
+			),
+			ObjectTerm(
+				Item(StringTerm("path"), ArrayTerm(StringTerm("input"), StringTerm("bar"))),
+				Item(StringTerm("definition"), ObjectTerm(
+					Item(StringTerm("type"), StringTerm("boolean")),
+				)),
+			),
+		)),
+		Item(StringTerm("custom"), ObjectTerm(
+			Item(StringTerm("number"), NumberTerm("42")),
+			Item(StringTerm("float"), NumberTerm("2.2")),
+			Item(StringTerm("string"), StringTerm("foo bar baz")),
+			Item(StringTerm("bool"), BooleanTerm(true)),
+			Item(StringTerm("list"), ArrayTerm(
+				StringTerm("a"),
+				StringTerm("b"),
+			)),
+			Item(StringTerm("list_of_lists"), ArrayTerm(
+				ArrayTerm(
+					StringTerm("a"),
+					StringTerm("b"),
+				),
+				ArrayTerm(
+					StringTerm("b"),
+					StringTerm("c"),
+				),
+			)),
+			Item(StringTerm("list_of_maps"), ArrayTerm(
+				ObjectTerm(
+					Item(StringTerm("one"), NumberTerm("1")),
+					Item(StringTerm("two"), NumberTerm("2")),
+				),
+				ObjectTerm(
+					Item(StringTerm("two"), NumberTerm("2")),
+					Item(StringTerm("three"), NumberTerm("3")),
+				),
+			)),
+			Item(StringTerm("map"), ObjectTerm(
+				Item(StringTerm("nested_number"), NumberTerm("1")),
+				Item(StringTerm("nested_map"), ObjectTerm(
+					Item(StringTerm("do"), StringTerm("re")),
+					Item(StringTerm("mi"), StringTerm("fa")),
+				)),
+				Item(StringTerm("nested_list"), ArrayTerm(
+					NumberTerm("1"),
+					NumberTerm("2"),
+					NumberTerm("3"),
+				)),
+			)),
+		)),
+	)
+
+	obj, err := annotations.toObject()
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err.Error())
+	}
+
+	if Compare(*obj, expected) != 0 {
+		t.Fatalf("object generated from annotations\n\n%v\n\ndoesn't match expected\n\n%v",
+			*obj, expected)
+	}
+}
+
+func toJSON(v interface{}) string {
+	b, _ := json.MarshalIndent(v, "", "  ")
+	return string(b)
+}
+
+func schemaAnnotationFromMap(path string, def map[string]interface{}) *SchemaAnnotation {
+	var p interface{} = def
+	return &SchemaAnnotation{Path: MustParseRef(path), Definition: &p}
+}
diff --git a/ast/builtins.go b/ast/builtins.go
index ee57ed4413..c696eb1053 100644
--- a/ast/builtins.go
+++ b/ast/builtins.go
@@ -80,6 +80,7 @@ var DefaultBuiltins = [...]*Builtin{
 	// Arrays
 	ArrayConcat,
 	ArraySlice,
+	ArrayReverse,
 
 	// Conversions
 	ToNumber,
@@ -101,6 +102,7 @@ var DefaultBuiltins = [...]*Builtin{
 	RegexTemplateMatch,
 	RegexFind,
 	RegexFindAllStringSubmatch,
+	RegexReplace,
 
 	// Sets
 	SetDiff,
@@ -108,9 +110,12 @@ var DefaultBuiltins = [...]*Builtin{
 	Union,
 
 	// Strings
+	AnyPrefixMatch,
+	AnySuffixMatch,
 	Concat,
 	FormatInt,
 	IndexOf,
+	IndexOfN,
 	Substring,
 	Lower,
 	Upper,
@@ -127,6 +132,7 @@ var DefaultBuiltins = [...]*Builtin{
 	TrimSuffix,
 	TrimSpace,
 	Sprintf,
+	StringReverse,
 
 	// Numbers
 	NumbersRange,
@@ -154,9 +160,12 @@ var DefaultBuiltins = [...]*Builtin{
 
 	// Object Manipulation
 	ObjectUnion,
+	ObjectUnionN,
 	ObjectRemove,
 	ObjectFilter,
 	ObjectGet,
+	ObjectKeys,
+	ObjectSubset,
 
 	// JSON Object Manipulation
 	JSONFilter,
@@ -186,6 +195,7 @@ var DefaultBuiltins = [...]*Builtin{
 	ParseNanos,
 	ParseRFC3339Nanos,
 	ParseDurationNanos,
+	Format,
 	Date,
 	Clock,
 	Weekday,
@@ -204,10 +214,12 @@ var DefaultBuiltins = [...]*Builtin{
 	CryptoHmacSha1,
 	CryptoHmacSha256,
 	CryptoHmacSha512,
+	CryptoHmacEqual,
 
 	// Graphs
 	WalkBuiltin,
 	ReachableBuiltin,
+	ReachablePathsBuiltin,
 
 	// Sort
 	Sort,
@@ -225,8 +237,25 @@ var DefaultBuiltins = [...]*Builtin{
 	// HTTP
 	HTTPSend,
 
+	// GraphQL
+	GraphQLParse,
+	GraphQLParseAndVerify,
+	GraphQLParseQuery,
+	GraphQLParseSchema,
+	GraphQLIsValid,
+	GraphQLSchemaIsValid,
+
+	// JSON Schema
+	JSONSchemaVerify,
+	JSONMatchSchema,
+
+	// Cloud Provider Helpers
+	ProvidersAWSSignReqObj,
+
 	// Rego
 	RegoParseModule,
+	RegoMetadataChain,
+	RegoMetadataRule,
 
 	// OPA
 	OPARuntime,
@@ -242,18 +271,20 @@ var DefaultBuiltins = [...]*Builtin{
 	NetCIDRExpand,
 	NetCIDRMerge,
 	NetLookupIPAddr,
+	NetCIDRIsValid,
 
 	// Glob
 	GlobMatch,
 	GlobQuoteMeta,
 
 	// Units
+	UnitsParse,
 	UnitsParseBytes,
 
 	// UUIDs
 	UUIDRFC4122,
 
-	//SemVers
+	// SemVers
 	SemVerIsValid,
 	SemVerCompare,
 
@@ -266,14 +297,18 @@ var DefaultBuiltins = [...]*Builtin{
 // built-in definitions.
 var BuiltinMap map[string]*Builtin
 
-// IgnoreDuringPartialEval is a set of built-in functions that should not be
-// evaluated during partial evaluation. These functions are not partially
-// evaluated because they are not pure.
+// Deprecated: Builtins can now be directly annotated with the
+// Nondeterministic property, and when set to true, will be ignored
+// for partial evaluation.
 var IgnoreDuringPartialEval = []*Builtin{
+	RandIntn,
+	UUIDRFC4122,
+	JWTDecodeVerify,
+	JWTEncodeSignRaw,
+	JWTEncodeSign,
 	NowNanos,
 	HTTPSend,
-	UUIDRFC4122,
-	RandIntn,
+	OPARuntime,
 	NetLookupIPAddr,
 }
 
@@ -336,219 +371,283 @@ var MemberWithKey = &Builtin{
 /**
  * Comparisons
  */
+var comparison = category("comparison")
 
-// GreaterThan represents the ">" comparison operator.
 var GreaterThan = &Builtin{
-	Name:  "gt",
-	Infix: ">",
+	Name:       "gt",
+	Infix:      ">",
+	Categories: comparison,
 	Decl: types.NewFunction(
-		types.Args(types.A, types.A),
-		types.B,
+		types.Args(
+			types.Named("x", types.A),
+			types.Named("y", types.A),
+		),
+		types.Named("result", types.B).Description("true if `x` is greater than `y`; false otherwise"),
 	),
 }
 
-// GreaterThanEq represents the ">=" comparison operator.
 var GreaterThanEq = &Builtin{
-	Name:  "gte",
-	Infix: ">=",
+	Name:       "gte",
+	Infix:      ">=",
+	Categories: comparison,
 	Decl: types.NewFunction(
-		types.Args(types.A, types.A),
-		types.B,
+		types.Args(
+			types.Named("x", types.A),
+			types.Named("y", types.A),
+		),
+		types.Named("result", types.B).Description("true if `x` is greater or equal to `y`; false otherwise"),
 	),
 }
 
 // LessThan represents the "<" comparison operator.
 var LessThan = &Builtin{
-	Name:  "lt",
-	Infix: "<",
+	Name:       "lt",
+	Infix:      "<",
+	Categories: comparison,
 	Decl: types.NewFunction(
-		types.Args(types.A, types.A),
-		types.B,
+		types.Args(
+			types.Named("x", types.A),
+			types.Named("y", types.A),
+		),
+		types.Named("result", types.B).Description("true if `x` is less than `y`; false otherwise"),
 	),
 }
 
-// LessThanEq represents the "<=" comparison operator.
 var LessThanEq = &Builtin{
-	Name:  "lte",
-	Infix: "<=",
+	Name:       "lte",
+	Infix:      "<=",
+	Categories: comparison,
 	Decl: types.NewFunction(
-		types.Args(types.A, types.A),
-		types.B,
+		types.Args(
+			types.Named("x", types.A),
+			types.Named("y", types.A),
+		),
+		types.Named("result", types.B).Description("true if `x` is less than or equal to `y`; false otherwise"),
 	),
 }
 
-// NotEqual represents the "!=" comparison operator.
 var NotEqual = &Builtin{
-	Name:  "neq",
-	Infix: "!=",
+	Name:       "neq",
+	Infix:      "!=",
+	Categories: comparison,
 	Decl: types.NewFunction(
-		types.Args(types.A, types.A),
-		types.B,
+		types.Args(
+			types.Named("x", types.A),
+			types.Named("y", types.A),
+		),
+		types.Named("result", types.B).Description("true if `x` is not equal to `y`; false otherwise"),
 	),
 }
 
 // Equal represents the "==" comparison operator.
 var Equal = &Builtin{
-	Name:  "equal",
-	Infix: "==",
+	Name:       "equal",
+	Infix:      "==",
+	Categories: comparison,
 	Decl: types.NewFunction(
-		types.Args(types.A, types.A),
-		types.B,
+		types.Args(
+			types.Named("x", types.A),
+			types.Named("y", types.A),
+		),
+		types.Named("result", types.B).Description("true if `x` is equal to `y`; false otherwise"),
 	),
 }
 
 /**
  * Arithmetic
  */
+var number = category("numbers")
 
-// Plus adds two numbers together.
 var Plus = &Builtin{
-	Name:  "plus",
-	Infix: "+",
+	Name:        "plus",
+	Infix:       "+",
+	Description: "Plus adds two numbers together.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("y", types.N),
+		),
+		types.Named("z", types.N).Description("the sum of `x` and `y`"),
 	),
+	Categories: number,
 }
 
-// Minus subtracts the second number from the first number or computes the diff
-// between two sets.
 var Minus = &Builtin{
-	Name:  "minus",
-	Infix: "-",
+	Name:        "minus",
+	Infix:       "-",
+	Description: "Minus subtracts the second number from the first number or computes the difference between two sets.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(types.N, types.NewSet(types.A)),
-			types.NewAny(types.N, types.NewSet(types.A)),
+			types.Named("x", types.NewAny(types.N, types.NewSet(types.A))),
+			types.Named("y", types.NewAny(types.N, types.NewSet(types.A))),
 		),
-		types.NewAny(types.N, types.NewSet(types.A)),
+		types.Named("z", types.NewAny(types.N, types.NewSet(types.A))).Description("the difference of `x` and `y`"),
 	),
+	Categories: category("sets", "numbers"),
 }
 
-// Multiply multiplies two numbers together.
 var Multiply = &Builtin{
-	Name:  "mul",
-	Infix: "*",
+	Name:        "mul",
+	Infix:       "*",
+	Description: "Multiplies two numbers.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("y", types.N),
+		),
+		types.Named("z", types.N).Description("the product of `x` and `y`"),
 	),
+	Categories: number,
 }
 
-// Divide divides the first number by the second number.
 var Divide = &Builtin{
-	Name:  "div",
-	Infix: "/",
+	Name:        "div",
+	Infix:       "/",
+	Description: "Divides the first number by the second number.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N).Description("the dividend"),
+			types.Named("y", types.N).Description("the divisor"),
+		),
+		types.Named("z", types.N).Description("the result of `x` divided by `y`"),
 	),
+	Categories: number,
 }
 
-// Round rounds the number to the nearest integer.
 var Round = &Builtin{
-	Name: "round",
+	Name:        "round",
+	Description: "Rounds the number to the nearest integer.",
 	Decl: types.NewFunction(
-		types.Args(types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N).Description("the number to round"),
+		),
+		types.Named("y", types.N).Description("the result of rounding `x`"),
 	),
+	Categories: number,
 }
 
-// Ceil rounds the number up to the nearest integer.
 var Ceil = &Builtin{
-	Name: "ceil",
+	Name:        "ceil",
+	Description: "Rounds the number _up_ to the nearest integer.",
 	Decl: types.NewFunction(
-		types.Args(types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N).Description("the number to round"),
+		),
+		types.Named("y", types.N).Description("the result of rounding `x` _up_"),
 	),
+	Categories: number,
 }
 
-// Floor rounds the number down to the nearest integer.
 var Floor = &Builtin{
-	Name: "floor",
+	Name:        "floor",
+	Description: "Rounds the number _down_ to the nearest integer.",
 	Decl: types.NewFunction(
-		types.Args(types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N).Description("the number to round"),
+		),
+		types.Named("y", types.N).Description("the result of rounding `x` _down_"),
 	),
+	Categories: number,
 }
 
-// Abs returns the number without its sign.
 var Abs = &Builtin{
-	Name: "abs",
+	Name:        "abs",
+	Description: "Returns the number without its sign.",
 	Decl: types.NewFunction(
-		types.Args(types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+		),
+		types.Named("y", types.N).Description("the absolute value of `x`"),
 	),
+	Categories: number,
 }
 
-// Rem returns the remainder for x%y for y != 0.
 var Rem = &Builtin{
-	Name:  "rem",
-	Infix: "%",
+	Name:        "rem",
+	Infix:       "%",
+	Description: "Returns the remainder for of `x` divided by `y`, for `y != 0`.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("y", types.N),
+		),
+		types.Named("z", types.N).Description("the remainder"),
 	),
+	Categories: number,
 }
 
 /**
  * Bitwise
  */
 
-// BitsOr returns the bitwise "or" of two integers.
 var BitsOr = &Builtin{
-	Name: "bits.or",
+	Name:        "bits.or",
+	Description: "Returns the bitwise \"OR\" of two integers.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("y", types.N),
+		),
+		types.Named("z", types.N),
 	),
 }
 
-// BitsAnd returns the bitwise "and" of two integers.
 var BitsAnd = &Builtin{
-	Name: "bits.and",
+	Name:        "bits.and",
+	Description: "Returns the bitwise \"AND\" of two integers.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("y", types.N),
+		),
+		types.Named("z", types.N),
 	),
 }
 
-// BitsNegate returns the bitwise "negation" of an integer (i.e. flips each
-// bit).
 var BitsNegate = &Builtin{
-	Name: "bits.negate",
+	Name:        "bits.negate",
+	Description: "Returns the bitwise negation (flip) of an integer.",
 	Decl: types.NewFunction(
-		types.Args(types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+		),
+		types.Named("z", types.N),
 	),
 }
 
-// BitsXOr returns the bitwise "exclusive-or" of two integers.
 var BitsXOr = &Builtin{
-	Name: "bits.xor",
+	Name:        "bits.xor",
+	Description: "Returns the bitwise \"XOR\" (exclusive-or) of two integers.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("y", types.N),
+		),
+		types.Named("z", types.N),
 	),
 }
 
-// BitsShiftLeft returns a new integer with its bits shifted some value to the
-// left.
 var BitsShiftLeft = &Builtin{
-	Name: "bits.lsh",
+	Name:        "bits.lsh",
+	Description: "Returns a new integer with its bits shifted `s` bits to the left.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("s", types.N),
+		),
+		types.Named("z", types.N),
 	),
 }
 
-// BitsShiftRight returns a new integer with its bits shifted some value to the
-// right.
 var BitsShiftRight = &Builtin{
-	Name: "bits.rsh",
+	Name:        "bits.rsh",
+	Description: "Returns a new integer with its bits shifted `s` bits to the right.",
 	Decl: types.NewFunction(
-		types.Args(types.N, types.N),
-		types.N,
+		types.Args(
+			types.Named("x", types.N),
+			types.Named("s", types.N),
+		),
+		types.Named("z", types.N),
 	),
 }
 
@@ -556,528 +655,662 @@ var BitsShiftRight = &Builtin{
  * Sets
  */
 
-// And performs an intersection operation on sets.
+var sets = category("sets")
+
 var And = &Builtin{
-	Name:  "and",
-	Infix: "&",
+	Name:        "and",
+	Infix:       "&",
+	Description: "Returns the intersection of two sets.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewSet(types.A),
-			types.NewSet(types.A),
+			types.Named("x", types.NewSet(types.A)),
+			types.Named("y", types.NewSet(types.A)),
 		),
-		types.NewSet(types.A),
+		types.Named("z", types.NewSet(types.A)).Description("the intersection of `x` and `y`"),
 	),
+	Categories: sets,
 }
 
 // Or performs a union operation on sets.
 var Or = &Builtin{
-	Name:  "or",
-	Infix: "|",
+	Name:        "or",
+	Infix:       "|",
+	Description: "Returns the union of two sets.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewSet(types.A),
-			types.NewSet(types.A),
+			types.Named("x", types.NewSet(types.A)),
+			types.Named("y", types.NewSet(types.A)),
 		),
-		types.NewSet(types.A),
+		types.Named("z", types.NewSet(types.A)).Description("the union of `x` and `y`"),
+	),
+	Categories: sets,
+}
+
+var Intersection = &Builtin{
+	Name:        "intersection",
+	Description: "Returns the intersection of the given input sets.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("xs", types.NewSet(types.NewSet(types.A))).Description("set of sets to intersect"),
+		),
+		types.Named("y", types.NewSet(types.A)).Description("the intersection of all `xs` sets"),
+	),
+	Categories: sets,
+}
+
+var Union = &Builtin{
+	Name:        "union",
+	Description: "Returns the union of the given input sets.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("xs", types.NewSet(types.NewSet(types.A))).Description("set of sets to merge"),
+		),
+		types.Named("y", types.NewSet(types.A)).Description("the union of all `xs` sets"),
 	),
+	Categories: sets,
 }
 
 /**
  * Aggregates
  */
 
-// Count takes a collection or string and counts the number of elements in it.
+var aggregates = category("aggregates")
+
 var Count = &Builtin{
-	Name: "count",
+	Name:        "count",
+	Description: " Count takes a collection or string and returns the number of elements (or characters) in it.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("collection", types.NewAny(
 				types.NewSet(types.A),
 				types.NewArray(nil, types.A),
 				types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
 				types.S,
-			),
+			)).Description("the set/array/object/string to be counted"),
 		),
-		types.N,
+		types.Named("n", types.N).Description("the count of elements, key/val pairs, or characters, respectively."),
 	),
+	Categories: aggregates,
 }
 
-// Sum takes an array or set of numbers and sums them.
 var Sum = &Builtin{
-	Name: "sum",
+	Name:        "sum",
+	Description: "Sums elements of an array or set of numbers.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("collection", types.NewAny(
 				types.NewSet(types.N),
 				types.NewArray(nil, types.N),
-			),
+			)),
 		),
-		types.N,
+		types.Named("n", types.N).Description("the sum of all elements"),
 	),
+	Categories: aggregates,
 }
 
-// Product takes an array or set of numbers and multiplies them.
 var Product = &Builtin{
-	Name: "product",
+	Name:        "product",
+	Description: "Muliplies elements of an array or set of numbers",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("collection", types.NewAny(
 				types.NewSet(types.N),
 				types.NewArray(nil, types.N),
-			),
+			)),
 		),
-		types.N,
+		types.Named("n", types.N).Description("the product of all elements"),
 	),
+	Categories: aggregates,
 }
 
-// Max returns the maximum value in a collection.
 var Max = &Builtin{
-	Name: "max",
+	Name:        "max",
+	Description: "Returns the maximum value in a collection.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("collection", types.NewAny(
 				types.NewSet(types.A),
 				types.NewArray(nil, types.A),
-			),
+			)),
 		),
-		types.A,
+		types.Named("n", types.A).Description("the maximum of all elements"),
 	),
+	Categories: aggregates,
 }
 
-// Min returns the minimum value in a collection.
 var Min = &Builtin{
-	Name: "min",
+	Name:        "min",
+	Description: "Returns the minimum value in a collection.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("collection", types.NewAny(
 				types.NewSet(types.A),
 				types.NewArray(nil, types.A),
-			),
+			)),
 		),
-		types.A,
+		types.Named("n", types.A).Description("the minimum of all elements"),
 	),
+	Categories: aggregates,
 }
 
-// All takes a list and returns true if all of the items
-// are true. A collection of length 0 returns true.
-var All = &Builtin{
-	Name: "all",
-	Decl: types.NewFunction(
-		types.Args(
-			types.NewAny(
-				types.NewSet(types.A),
-				types.NewArray(nil, types.A),
-			),
-		),
-		types.B,
-	),
-}
+/**
+ * Sorting
+ */
 
-// Any takes a collection and returns true if any of the items
-// is true. A collection of length 0 returns false.
-var Any = &Builtin{
-	Name: "any",
+var Sort = &Builtin{
+	Name:        "sort",
+	Description: "Returns a sorted array.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
-				types.NewSet(types.A),
+			types.Named("collection", types.NewAny(
 				types.NewArray(nil, types.A),
-			),
+				types.NewSet(types.A),
+			)).Description("the array or set to be sorted"),
 		),
-		types.B,
+		types.Named("n", types.NewArray(nil, types.A)).Description("the sorted array"),
 	),
+	Categories: aggregates,
 }
 
 /**
  * Arrays
  */
 
-// ArrayConcat returns the result of concatenating two arrays together.
 var ArrayConcat = &Builtin{
-	Name: "array.concat",
+	Name:        "array.concat",
+	Description: "Concatenates two arrays.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewArray(nil, types.A),
-			types.NewArray(nil, types.A),
+			types.Named("x", types.NewArray(nil, types.A)),
+			types.Named("y", types.NewArray(nil, types.A)),
 		),
-		types.NewArray(nil, types.A),
+		types.Named("z", types.NewArray(nil, types.A)).Description("the concatenation of `x` and `y`"),
 	),
 }
 
-// ArraySlice returns a slice of a given array
 var ArraySlice = &Builtin{
-	Name: "array.slice",
+	Name:        "array.slice",
+	Description: "Returns a slice of a given array. If `start` is greater or equal than `stop`, `slice` is `[]`.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewArray(nil, types.A),
-			types.NewNumber(),
-			types.NewNumber(),
+			types.Named("arr", types.NewArray(nil, types.A)).Description("the array to be sliced"),
+			types.Named("start", types.NewNumber()).Description("the start index of the returned slice; if less than zero, it's clamped to 0"),
+			types.Named("stop", types.NewNumber()).Description("the stop index of the returned slice; if larger than `count(arr)`, it's clamped to `count(arr)`"),
 		),
-		types.NewArray(nil, types.A),
+		types.Named("slice", types.NewArray(nil, types.A)).Description("the subslice of `array`, from `start` to `end`, including `arr[start]`, but excluding `arr[end]`"),
+	),
+} // NOTE(sr): this function really needs examples
+
+var ArrayReverse = &Builtin{
+	Name:        "array.reverse",
+	Description: "Returns the reverse of a given array.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("arr", types.NewArray(nil, types.A)).Description("the array to be reversed"),
+		),
+		types.Named("rev", types.NewArray(nil, types.A)).Description("an array containing the elements of `arr` in reverse order"),
 	),
 }
 
 /**
  * Conversions
  */
+var conversions = category("conversions")
 
-// ToNumber takes a string, bool, or number value and converts it to a number.
-// Strings are converted to numbers using strconv.Atoi.
-// Boolean false is converted to 0 and boolean true is converted to 1.
 var ToNumber = &Builtin{
-	Name: "to_number",
+	Name:        "to_number",
+	Description: "Converts a string, bool, or number value to a number: Strings are converted to numbers using `strconv.Atoi`, Boolean `false` is converted to 0 and `true` is converted to 1.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("x", types.NewAny(
 				types.N,
 				types.S,
 				types.B,
 				types.NewNull(),
-			),
+			)),
 		),
-		types.N,
+		types.Named("num", types.N),
 	),
+	Categories: conversions,
 }
 
 /**
  * Regular Expressions
  */
 
-// RegexMatch takes two strings and evaluates to true if the string in the second
-// position matches the pattern in the first position.
 var RegexMatch = &Builtin{
-	Name: "regex.match",
+	Name:        "regex.match",
+	Description: "Matches a string against a regular expression.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("pattern", types.S).Description("regular expression"),
+			types.Named("value", types.S).Description("value to match against `pattern`"),
 		),
-		types.B,
+		types.Named("result", types.B),
 	),
 }
 
-// RegexIsValid returns true if the regex pattern string is valid, otherwise false.
 var RegexIsValid = &Builtin{
-	Name: "regex.is_valid",
+	Name:        "regex.is_valid",
+	Description: "Checks if a string is a valid regular expression: the detailed syntax for patterns is defined by https://github.com/google/re2/wiki/Syntax.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
+			types.Named("pattern", types.S).Description("regular expression"),
 		),
-		types.B,
+		types.Named("result", types.B),
 	),
 }
 
-// RegexFindAllStringSubmatch returns an array of all successive matches of the expression.
-// It takes two strings and a number, the pattern, the value and number of matches to
-// return, -1 means all matches.
 var RegexFindAllStringSubmatch = &Builtin{
-	Name: "regex.find_all_string_submatch_n",
+	Name:        "regex.find_all_string_submatch_n",
+	Description: "Returns all successive matches of the expression.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
-			types.N,
+			types.Named("pattern", types.S).Description("regular expression"),
+			types.Named("value", types.S).Description("string to match"),
+			types.Named("number", types.N).Description("number of matches to return; `-1` means all matches"),
 		),
-		types.NewArray(nil, types.NewArray(nil, types.S)),
+		types.Named("output", types.NewArray(nil, types.NewArray(nil, types.S))),
 	),
 }
 
-// RegexTemplateMatch takes two strings and evaluates to true if the string in the second
-// position matches the pattern in the first position.
 var RegexTemplateMatch = &Builtin{
-	Name: "regex.template_match",
+	Name:        "regex.template_match",
+	Description: "Matches a string against a pattern, where there pattern may be glob-like",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
-			types.S,
-			types.S,
+			types.Named("template", types.S).Description("template expression containing `0..n` regular expressions"),
+			types.Named("value", types.S).Description("string to match"),
+			types.Named("delimiter_start", types.S).Description("start delimiter of the regular expression in `template`"),
+			types.Named("delimiter_end", types.S).Description("end delimiter of the regular expression in `template`"),
 		),
-		types.B,
+		types.Named("result", types.B),
 	),
-}
+} // TODO(sr): example:`regex.template_match("urn:foo:{.*}", "urn:foo:bar:baz", "{", "}")`` returns ``true``.
 
-// RegexSplit splits the input string by the occurrences of the given pattern.
 var RegexSplit = &Builtin{
-	Name: "regex.split",
+	Name:        "regex.split",
+	Description: "Splits the input string by the occurrences of the given pattern.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("pattern", types.S).Description("regular expression"),
+			types.Named("value", types.S).Description("string to match"),
 		),
-		types.NewArray(nil, types.S),
+		types.Named("output", types.NewArray(nil, types.S)).Description("the parts obtained by splitting `value`"),
 	),
 }
 
 // RegexFind takes two strings and a number, the pattern, the value and number of match values to
 // return, -1 means all match values.
 var RegexFind = &Builtin{
-	Name: "regex.find_n",
+	Name:        "regex.find_n",
+	Description: "Returns the specified number of matches when matching the input against the pattern.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
-			types.N,
+			types.Named("pattern", types.S).Description("regular expression"),
+			types.Named("value", types.S).Description("string to match"),
+			types.Named("number", types.N).Description("number of matches to return, if `-1`, returns all matches"),
 		),
-		types.NewArray(nil, types.S),
+		types.Named("output", types.NewArray(nil, types.S)).Description("collected matches"),
 	),
 }
 
 // GlobsMatch takes two strings regexp-style strings and evaluates to true if their
 // intersection matches a non-empty set of non-empty strings.
 // Examples:
-//  - "a.a." and ".b.b" -> true.
-//  - "[a-z]*" and [0-9]+" -> not true.
+//   - "a.a." and ".b.b" -> true.
+//   - "[a-z]*" and [0-9]+" -> not true.
 var GlobsMatch = &Builtin{
 	Name: "regex.globs_match",
+	Description: `Checks if the intersection of two glob-style regular expressions matches a non-empty set of non-empty strings.
+The set of regex symbols is limited for this builtin: only ` + "`.`, `*`, `+`, `[`, `-`, `]` and `\\` are treated as special symbols.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("glob1", types.S),
+			types.Named("glob2", types.S),
 		),
-		types.B,
+		types.Named("result", types.B),
 	),
 }
 
 /**
  * Strings
  */
+var stringsCat = category("strings")
+
+var AnyPrefixMatch = &Builtin{
+	Name:        "strings.any_prefix_match",
+	Description: "Returns true if any of the search strings begins with any of the base strings.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("search", types.NewAny(
+				types.S,
+				types.NewSet(types.S),
+				types.NewArray(nil, types.S),
+			)).Description("search string(s)"),
+			types.Named("base", types.NewAny(
+				types.S,
+				types.NewSet(types.S),
+				types.NewArray(nil, types.S),
+			)).Description("base string(s)"),
+		),
+		types.Named("result", types.B).Description("result of the prefix check"),
+	),
+	Categories: stringsCat,
+}
+
+var AnySuffixMatch = &Builtin{
+	Name:        "strings.any_suffix_match",
+	Description: "Returns true if any of the search strings ends with any of the base strings.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("search", types.NewAny(
+				types.S,
+				types.NewSet(types.S),
+				types.NewArray(nil, types.S),
+			)).Description("search string(s)"),
+			types.Named("base", types.NewAny(
+				types.S,
+				types.NewSet(types.S),
+				types.NewArray(nil, types.S),
+			)).Description("base string(s)"),
+		),
+		types.Named("result", types.B).Description("result of the suffix check"),
+	),
+	Categories: stringsCat,
+}
 
-// Concat joins an array of strings with an input string.
 var Concat = &Builtin{
-	Name: "concat",
+	Name:        "concat",
+	Description: "Joins a set or array of strings with a delimiter.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.NewAny(
+			types.Named("delimiter", types.S),
+			types.Named("collection", types.NewAny(
 				types.NewSet(types.S),
 				types.NewArray(nil, types.S),
-			),
+			)).Description("strings to join"),
 		),
-		types.S,
+		types.Named("output", types.S),
 	),
+	Categories: stringsCat,
 }
 
-// FormatInt returns the string representation of the number in the given base after converting it to an integer value.
 var FormatInt = &Builtin{
-	Name: "format_int",
+	Name:        "format_int",
+	Description: "Returns the string representation of the number in the given base after rounding it down to an integer value.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.N,
-			types.N,
+			types.Named("number", types.N).Description("number to format"),
+			types.Named("base", types.N).Description("base of number representation to use"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("formatted number"),
 	),
+	Categories: stringsCat,
 }
 
-// IndexOf returns the index of a substring contained inside a string
 var IndexOf = &Builtin{
-	Name: "indexof",
+	Name:        "indexof",
+	Description: "Returns the index of a substring contained inside a string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("haystack", types.S).Description("string to search in"),
+			types.Named("needle", types.S).Description("substring to look for"),
+		),
+		types.Named("output", types.N).Description("index of first occurrence, `-1` if not found"),
+	),
+	Categories: stringsCat,
+}
+
+var IndexOfN = &Builtin{
+	Name:        "indexof_n",
+	Description: "Returns a list of all the indexes of a substring contained inside a string.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("haystack", types.S).Description("string to search in"),
+			types.Named("needle", types.S).Description("substring to look for"),
 		),
-		types.N,
+		types.Named("output", types.NewArray(nil, types.N)).Description("all indices at which `needle` occurs in `haystack`, may be empty"),
 	),
+	Categories: stringsCat,
 }
 
-// Substring returns the portion of a string for a given start index and a length.
-//   If the length is less than zero, then substring returns the remainder of the string.
 var Substring = &Builtin{
-	Name: "substring",
+	Name:        "substring",
+	Description: "Returns the  portion of a string for a given `offset` and a `length`.  If `length < 0`, `output` is the remainder of the string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.N,
-			types.N,
+			types.Named("value", types.S),
+			types.Named("offset", types.N).Description("offset, must be positive"),
+			types.Named("length", types.N).Description("length of the substring starting from `offset`"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("substring of `value` from `offset`, of length `length`"),
 	),
+	Categories: stringsCat,
 }
 
-// Contains returns true if the search string is included in the base string
 var Contains = &Builtin{
-	Name: "contains",
+	Name:        "contains",
+	Description: "Returns `true` if the search string is included in the base string",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("haystack", types.S).Description("string to search in"),
+			types.Named("needle", types.S).Description("substring to look for"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("result of the containment check"),
 	),
+	Categories: stringsCat,
 }
 
-// StartsWith returns true if the search string begins with the base string
 var StartsWith = &Builtin{
-	Name: "startswith",
+	Name:        "startswith",
+	Description: "Returns true if the search string begins with the base string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("search", types.S).Description("search string"),
+			types.Named("base", types.S).Description("base string"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("result of the prefix check"),
 	),
+	Categories: stringsCat,
 }
 
-// EndsWith returns true if the search string begins with the base string
 var EndsWith = &Builtin{
-	Name: "endswith",
+	Name:        "endswith",
+	Description: "Returns true if the search string ends with the base string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("search", types.S).Description("search string"),
+			types.Named("base", types.S).Description("base string"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("result of the suffix check"),
 	),
+	Categories: stringsCat,
 }
 
-// Lower returns the input string but with all characters in lower-case
 var Lower = &Builtin{
-	Name: "lower",
+	Name:        "lower",
+	Description: "Returns the input string but with all characters in lower-case.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S).Description("string that is converted to lower-case"),
+		),
+		types.Named("y", types.S).Description("lower-case of x"),
 	),
+	Categories: stringsCat,
 }
 
-// Upper returns the input string but with all characters in upper-case
 var Upper = &Builtin{
-	Name: "upper",
+	Name:        "upper",
+	Description: "Returns the input string but with all characters in upper-case.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S).Description("string that is converted to upper-case"),
+		),
+		types.Named("y", types.S).Description("upper-case of x"),
 	),
+	Categories: stringsCat,
 }
 
-// Split returns an array containing elements of the input string split on a delimiter.
 var Split = &Builtin{
-	Name: "split",
+	Name:        "split",
+	Description: "Split returns an array containing elements of the input string split on a delimiter.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("x", types.S).Description("string that is split"),
+			types.Named("delimiter", types.S).Description("delimiter used for splitting"),
 		),
-		types.NewArray(nil, types.S),
+		types.Named("ys", types.NewArray(nil, types.S)).Description("splitted parts"),
 	),
+	Categories: stringsCat,
 }
 
-// Replace returns the given string with all instances of the second argument replaced
-// by the third.
 var Replace = &Builtin{
-	Name: "replace",
+	Name:        "replace",
+	Description: "Replace replaces all instances of a sub-string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
-			types.S,
+			types.Named("x", types.S).Description("string being processed"),
+			types.Named("old", types.S).Description("substring to replace"),
+			types.Named("new", types.S).Description("string to replace `old` with"),
 		),
-		types.S,
+		types.Named("y", types.S).Description("string with replaced substrings"),
 	),
+	Categories: stringsCat,
 }
 
-// ReplaceN replaces a string from a list of old, new string pairs.
-// Replacements are performed in the order they appear in the target string, without overlapping matches.
-// The old string comparisons are done in argument order.
 var ReplaceN = &Builtin{
 	Name: "strings.replace_n",
+	Description: `Replaces a string from a list of old, new string pairs.
+Replacements are performed in the order they appear in the target string, without overlapping matches.
+The old string comparisons are done in argument order.`,
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("patterns", types.NewObject(
 				nil,
 				types.NewDynamicProperty(
 					types.S,
 					types.S)),
-			types.S,
+			).Description("replacement pairs"),
+			types.Named("value", types.S).Description("string to replace substring matches in"),
 		),
-		types.S,
+		types.Named("output", types.S),
+	),
+}
+
+var RegexReplace = &Builtin{
+	Name:        "regex.replace",
+	Description: `Find and replaces the text using the regular expression pattern.`,
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("s", types.S).Description("string being processed"),
+			types.Named("pattern", types.S).Description("regex pattern to be applied"),
+			types.Named("value", types.S).Description("regex value"),
+		),
+		types.Named("output", types.S),
 	),
 }
 
-// Trim returns the given string with all leading or trailing instances of the second
-// argument removed.
 var Trim = &Builtin{
-	Name: "trim",
+	Name:        "trim",
+	Description: "Returns `value` with all leading or trailing instances of the `cutset` characters removed.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("value", types.S).Description("string to trim"),
+			types.Named("cutset", types.S).Description("string of characters that are cut off"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("string trimmed of `cutset` characters"),
 	),
+	Categories: stringsCat,
 }
 
-// TrimLeft returns the given string with all leading instances of second argument removed.
 var TrimLeft = &Builtin{
-	Name: "trim_left",
+	Name:        "trim_left",
+	Description: "Returns `value` with all leading instances of the `cutset` chartacters removed.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("value", types.S).Description("string to trim"),
+			types.Named("cutset", types.S).Description("string of characters that are cut off on the left"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("string left-trimmed of `cutset` characters"),
 	),
+	Categories: stringsCat,
 }
 
-// TrimPrefix returns the given string without the second argument prefix string.
-// If the given string doesn't start with prefix, it is returned unchanged.
 var TrimPrefix = &Builtin{
-	Name: "trim_prefix",
+	Name:        "trim_prefix",
+	Description: "Returns `value` without the prefix. If `value` doesn't start with `prefix`, it is returned unchanged.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("value", types.S).Description("string to trim"),
+			types.Named("prefix", types.S).Description("prefix to cut off"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("string with `prefix` cut off"),
 	),
+	Categories: stringsCat,
 }
 
-// TrimRight returns the given string with all trailing instances of second argument removed.
 var TrimRight = &Builtin{
-	Name: "trim_right",
+	Name:        "trim_right",
+	Description: "Returns `value` with all trailing instances of the `cutset` chartacters removed.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("value", types.S).Description("string to trim"),
+			types.Named("cutset", types.S).Description("string of characters that are cut off on the right"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("string right-trimmed of `cutset` characters"),
 	),
+	Categories: stringsCat,
 }
 
-// TrimSuffix returns the given string without the second argument suffix string.
-// If the given string doesn't end with suffix, it is returned unchanged.
 var TrimSuffix = &Builtin{
-	Name: "trim_suffix",
+	Name:        "trim_suffix",
+	Description: "Returns `value` without the suffix. If `value` doesn't end with `suffix`, it is returned unchanged.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("value", types.S).Description("string to trim"),
+			types.Named("suffix", types.S).Description("suffix to cut off"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("string with `suffix` cut off"),
 	),
+	Categories: stringsCat,
 }
 
-// TrimSpace return the given string with all leading and trailing white space removed.
 var TrimSpace = &Builtin{
-	Name: "trim_space",
+	Name:        "trim_space",
+	Description: "Return the given string with all leading and trailing white space removed.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
+			types.Named("value", types.S).Description("string to trim"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("string leading and trailing white space cut off"),
 	),
+	Categories: stringsCat,
 }
 
-// Sprintf returns the given string, formatted.
 var Sprintf = &Builtin{
-	Name: "sprintf",
+	Name:        "sprintf",
+	Description: "Returns the given string, formatted.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.NewArray(nil, types.A),
+			types.Named("format", types.S).Description("string with formatting verbs"),
+			types.Named("values", types.NewArray(nil, types.A)).Description("arguments to format into formatting verbs"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("`format` formatted by the values in `values`"),
+	),
+	Categories: stringsCat,
+}
+
+var StringReverse = &Builtin{
+	Name:        "strings.reverse",
+	Description: "Reverses a given string.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S),
 	),
+	Categories: stringsCat,
 }
 
 /**
@@ -1085,26 +1318,30 @@ var Sprintf = &Builtin{
  */
 
 // RandIntn returns a random number 0 - n
+// Marked non-deterministic because it relies on RNG internally.
 var RandIntn = &Builtin{
-	Name: "rand.intn",
+	Name:        "rand.intn",
+	Description: "Returns a random integer between `0` and `n` (`n` exlusive). If `n` is `0`, then `y` is always `0`. For any given argument pair (`str`, `n`), the output will be consistent throughout a query evaluation.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.N,
+			types.Named("str", types.S),
+			types.Named("n", types.N),
 		),
-		types.N,
+		types.Named("y", types.N).Description("random integer in the range `[0, abs(n))`"),
 	),
+	Categories:       number,
+	Nondeterministic: true,
 }
 
-// NumbersRange returns an array of numbers in the given inclusive range.
 var NumbersRange = &Builtin{
-	Name: "numbers.range",
+	Name:        "numbers.range",
+	Description: "Returns an array of numbers in the given (inclusive) range. If `a==b`, then `range == [a]`; if `a > b`, then `range` is in descending order.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.N,
-			types.N,
+			types.Named("a", types.N),
+			types.Named("b", types.N),
 		),
-		types.NewArray(nil, types.N),
+		types.Named("range", types.NewArray(nil, types.N)).Description("the range between `a` and `b`"),
 	),
 }
 
@@ -1112,73 +1349,73 @@ var NumbersRange = &Builtin{
  * Units
  */
 
-// UnitsParseBytes converts strings like 10GB, 5K, 4mb, and the like into an
-// integer number of bytes.
-var UnitsParseBytes = &Builtin{
-	Name: "units.parse_bytes",
+var UnitsParse = &Builtin{
+	Name: "units.parse",
+	Description: `Converts strings like "10G", "5K", "4M", "1500m" and the like into a number.
+This number can be a non-integer, such as 1.5, 0.22, etc. Supports standard metric decimal and
+binary SI units (e.g., K, Ki, M, Mi, G, Gi etc.) m, K, M, G, T, P, and E are treated as decimal
+units and Ki, Mi, Gi, Ti, Pi, and Ei are treated as binary units.
+
+Note that 'm' and 'M' are case-sensitive, to allow distinguishing between "milli" and "mega" units respectively. Other units are case-insensitive.`,
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
+			types.Named("x", types.S).Description("the unit to parse"),
 		),
-		types.N,
+		types.Named("y", types.N).Description("the parsed number"),
 	),
 }
 
-//
-/**
- * Type
- */
-
-// UUIDRFC4122 returns a version 4 UUID string.
-var UUIDRFC4122 = &Builtin{
-	Name: "uuid.rfc4122",
+var UnitsParseBytes = &Builtin{
+	Name: "units.parse_bytes",
+	Description: `Converts strings like "10GB", "5K", "4mb" into an integer number of bytes.
+Supports standard byte units (e.g., KB, KiB, etc.) KB, MB, GB, and TB are treated as decimal
+units and KiB, MiB, GiB, and TiB are treated as binary units. The bytes symbol (b/B) in the
+unit is optional and omitting it wil give the same result (e.g. Mi and MiB).`,
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S).Description("the byte unit to parse"),
+		),
+		types.Named("y", types.N).Description("the parsed number"),
 	),
 }
 
+//
 /**
- * JSON
+ * Type
  */
 
-// JSONMarshal serializes the input term.
-var JSONMarshal = &Builtin{
-	Name: "json.marshal",
+// UUIDRFC4122 returns a version 4 UUID string.
+// Marked non-deterministic because it relies on RNG internally.
+var UUIDRFC4122 = &Builtin{
+	Name:        "uuid.rfc4122",
+	Description: "Returns a new UUIDv4.",
 	Decl: types.NewFunction(
-		types.Args(types.A),
-		types.S,
+		types.Args(
+			types.Named("k", types.S),
+		),
+		types.Named("output", types.S).Description("a version 4 UUID; for any given `k`, the output will be consistent throughout a query evaluation"),
 	),
+	Nondeterministic: true,
 }
 
-// JSONUnmarshal deserializes the input string.
-var JSONUnmarshal = &Builtin{
-	Name: "json.unmarshal",
-	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.A,
-	),
-}
+/**
+ * JSON
+ */
 
-// JSONIsValid verifies the input string is a valid JSON document.
-var JSONIsValid = &Builtin{
-	Name: "json.is_valid",
-	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.B,
-	),
-}
+var objectCat = category("object")
 
-// JSONFilter filters the JSON object
 var JSONFilter = &Builtin{
 	Name: "json.filter",
+	Description: "Filters the object. " +
+		"For example: `json.filter({\"a\": {\"b\": \"x\", \"c\": \"y\"}}, [\"a/b\"])` will result in `{\"a\": {\"b\": \"x\"}}`). " +
+		"Paths are not filtered in-order and are deduplicated before being evaluated.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("object", types.NewObject(
 				nil,
 				types.NewDynamicProperty(types.A, types.A),
-			),
-			types.NewAny(
+			)),
+			types.Named("paths", types.NewAny(
 				types.NewArray(
 					nil,
 					types.NewAny(
@@ -1198,22 +1435,25 @@ var JSONFilter = &Builtin{
 						),
 					),
 				),
-			),
+			)).Description("JSON string paths"),
 		),
-		types.A,
+		types.Named("filtered", types.A).Description("remaining data from `object` with only keys specified in `paths`"),
 	),
+	Categories: objectCat,
 }
 
-// JSONRemove removes paths in the JSON object
 var JSONRemove = &Builtin{
 	Name: "json.remove",
+	Description: "Removes paths from an object. " +
+		"For example: `json.remove({\"a\": {\"b\": \"x\", \"c\": \"y\"}}, [\"a/b\"])` will result in `{\"a\": {\"c\": \"y\"}}`. " +
+		"Paths are not removed in-order and are deduplicated before being evaluated.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("object", types.NewObject(
 				nil,
 				types.NewDynamicProperty(types.A, types.A),
-			),
-			types.NewAny(
+			)),
+			types.Named("paths", types.NewAny(
 				types.NewArray(
 					nil,
 					types.NewAny(
@@ -1233,19 +1473,23 @@ var JSONRemove = &Builtin{
 						),
 					),
 				),
-			),
+			)).Description("JSON string paths"),
 		),
-		types.A,
+		types.Named("output", types.A).Description("result of removing all keys specified in `paths`"),
 	),
+	Categories: objectCat,
 }
 
-// JSONPatch patches a JSON object according to RFC6902
 var JSONPatch = &Builtin{
 	Name: "json.patch",
+	Description: "Patches an object according to RFC6902. " +
+		"For example: `json.patch({\"a\": {\"foo\": 1}}, [{\"op\": \"add\", \"path\": \"/a/bar\", \"value\": 2}])` results in `{\"a\": {\"foo\": 1, \"bar\": 2}`. " +
+		"The patches are applied atomically: if any of them fails, the result will be undefined. " +
+		"Additionally works on sets, where a value contained in the set is considered to be its path.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
-			types.NewArray(
+			types.Named("object", types.A), // TODO(sr): types.A?
+			types.Named("patches", types.NewArray(
 				nil,
 				types.NewObject(
 					[]*types.StaticProperty{
@@ -1254,547 +1498,745 @@ var JSONPatch = &Builtin{
 					},
 					types.NewDynamicProperty(types.A, types.A),
 				),
-			),
+			)),
 		),
-		types.A,
+		types.Named("output", types.A).Description("result obtained after consecutively applying all patch operations in `patches`"),
 	),
+	Categories: objectCat,
 }
 
-// ObjectGet returns takes an object and returns a value under its key if
-// present, otherwise it returns the default.
-var ObjectGet = &Builtin{
-	Name: "object.get",
+var ObjectSubset = &Builtin{
+	Name: "object.subset",
+	Description: "Determines if an object `sub` is a subset of another object `super`." +
+		"Object `sub` is a subset of object `super` if and only if every key in `sub` is also in `super`, " +
+		"**and** for all keys which `sub` and `super` share, they have the same value. " +
+		"This function works with objects, sets, arrays and a set of array and set." +
+		"If both arguments are objects, then the operation is recursive, e.g. " +
+		"`{\"c\": {\"x\": {10, 15, 20}}` is a subset of `{\"a\": \"b\", \"c\": {\"x\": {10, 15, 20, 25}, \"y\": \"z\"}`. " +
+		"If both arguments are sets, then this function checks if every element of `sub` is a member of `super`, " +
+		"but does not attempt to recurse. If both arguments are arrays, " +
+		"then this function checks if `sub` appears contiguously in order within `super`, " +
+		"and also does not attempt to recurse. If `super` is array and `sub` is set, " +
+		"then this function checks if `super` contains every element of `sub` with no consideration of ordering, " +
+		"and also does not attempt to recurse.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
-			types.A,
-			types.A,
+			types.Named("super", types.NewAny(types.NewObject(
+				nil,
+				types.NewDynamicProperty(types.A, types.A),
+			),
+				types.NewSet(types.A),
+				types.NewArray(nil, types.A),
+			)).Description("object to test if sub is a subset of"),
+			types.Named("sub", types.NewAny(types.NewObject(
+				nil,
+				types.NewDynamicProperty(types.A, types.A),
+			),
+				types.NewSet(types.A),
+				types.NewArray(nil, types.A),
+			)).Description("object to test if super is a superset of"),
 		),
-		types.A,
+		types.Named("result", types.A).Description("`true` if `sub` is a subset of `super`"),
 	),
 }
 
-// ObjectUnion creates a new object that is the asymmetric union of two objects
 var ObjectUnion = &Builtin{
 	Name: "object.union",
+	Description: "Creates a new object of the asymmetric union of two objects. " +
+		"For example: `object.union({\"a\": 1, \"b\": 2, \"c\": {\"d\": 3}}, {\"a\": 7, \"c\": {\"d\": 4, \"e\": 5}})` will result in `{\"a\": 7, \"b\": 2, \"c\": {\"d\": 4, \"e\": 5}}`.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("a", types.NewObject(
 				nil,
 				types.NewDynamicProperty(types.A, types.A),
-			),
-			types.NewObject(
+			)),
+			types.Named("b", types.NewObject(
 				nil,
 				types.NewDynamicProperty(types.A, types.A),
-			),
+			)),
 		),
-		types.A,
+		types.Named("output", types.A).Description("a new object which is the result of an asymmetric recursive union of two objects where conflicts are resolved by choosing the key from the right-hand object `b`"),
+	), // TODO(sr): types.A?  ^^^^^^^ (also below)
+}
+
+var ObjectUnionN = &Builtin{
+	Name: "object.union_n",
+	Description: "Creates a new object that is the asymmetric union of all objects merged from left to right. " +
+		"For example: `object.union_n([{\"a\": 1}, {\"b\": 2}, {\"a\": 3}])` will result in `{\"b\": 2, \"a\": 3}`.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("objects", types.NewArray(
+				nil,
+				types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
+			)),
+		),
+		types.Named("output", types.A).Description("asymmetric recursive union of all objects in `objects`, merged from left to right, where conflicts are resolved by choosing the key from the right-hand object"),
 	),
 }
 
-// ObjectRemove Removes specified keys from an object
 var ObjectRemove = &Builtin{
-	Name: "object.remove",
+	Name:        "object.remove",
+	Description: "Removes specified keys from an object.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("object", types.NewObject(
 				nil,
 				types.NewDynamicProperty(types.A, types.A),
-			),
-			types.NewAny(
+			)).Description("object to remove keys from"),
+			types.Named("keys", types.NewAny(
 				types.NewArray(nil, types.A),
 				types.NewSet(types.A),
 				types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
-			),
+			)).Description("keys to remove from x"),
 		),
-		types.A,
+		types.Named("output", types.A).Description("result of removing the specified `keys` from `object`"),
 	),
 }
 
-// ObjectFilter filters the object by keeping only specified keys
 var ObjectFilter = &Builtin{
 	Name: "object.filter",
+	Description: "Filters the object by keeping only specified keys. " +
+		"For example: `object.filter({\"a\": {\"b\": \"x\", \"c\": \"y\"}, \"d\": \"z\"}, [\"a\"])` will result in `{\"a\": {\"b\": \"x\", \"c\": \"y\"}}`).",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("object", types.NewObject(
 				nil,
 				types.NewDynamicProperty(types.A, types.A),
-			),
-			types.NewAny(
+			)).Description("object to filter keys"),
+			types.Named("keys", types.NewAny(
 				types.NewArray(nil, types.A),
 				types.NewSet(types.A),
 				types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
-			),
+			)),
 		),
-		types.A,
+		types.Named("filtered", types.A).Description("remaining data from `object` with only keys specified in `keys`"),
 	),
 }
 
-// Base64Encode serializes the input string into base64 encoding.
+var ObjectGet = &Builtin{
+	Name: "object.get",
+	Description: "Returns value of an object's key if present, otherwise a default. " +
+		"If the supplied `key` is an `array`, then `object.get` will search through a nested object or array using each key in turn. " +
+		"For example: `object.get({\"a\": [{ \"b\": true }]}, [\"a\", 0, \"b\"], false)` results in `true`.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("object", types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))).Description("object to get `key` from"),
+			types.Named("key", types.A).Description("key to lookup in `object`"),
+			types.Named("default", types.A).Description("default to use when lookup fails"),
+		),
+		types.Named("value", types.A).Description("`object[key]` if present, otherwise `default`"),
+	),
+}
+
+var ObjectKeys = &Builtin{
+	Name: "object.keys",
+	Description: "Returns a set of an object's keys. " +
+		"For example: `object.keys({\"a\": 1, \"b\": true, \"c\": \"d\")` results in `{\"a\", \"b\", \"c\"}`.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("object", types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))).Description("object to get keys from"),
+		),
+		types.Named("value", types.NewSet(types.A)).Description("set of `object`'s keys"),
+	),
+}
+
+/*
+ *  Encoding
+ */
+var encoding = category("encoding")
+
+var JSONMarshal = &Builtin{
+	Name:        "json.marshal",
+	Description: "Serializes the input term to JSON.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("x", types.A).Description("the term to serialize"),
+		),
+		types.Named("y", types.S).Description("the JSON string representation of `x`"),
+	),
+	Categories: encoding,
+}
+
+var JSONUnmarshal = &Builtin{
+	Name:        "json.unmarshal",
+	Description: "Deserializes the input string.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("x", types.S).Description("a JSON string"),
+		),
+		types.Named("y", types.A).Description("the term deseralized from `x`"),
+	),
+	Categories: encoding,
+}
+
+var JSONIsValid = &Builtin{
+	Name:        "json.is_valid",
+	Description: "Verifies the input string is a valid JSON document.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("x", types.S).Description("a JSON string"),
+		),
+		types.Named("result", types.B).Description("`true` if `x` is valid JSON, `false` otherwise"),
+	),
+	Categories: encoding,
+}
+
 var Base64Encode = &Builtin{
-	Name: "base64.encode",
+	Name:        "base64.encode",
+	Description: "Serializes the input string into base64 encoding.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("base64 serialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// Base64Decode deserializes the base64 encoded input string.
 var Base64Decode = &Builtin{
-	Name: "base64.decode",
+	Name:        "base64.decode",
+	Description: "Deserializes the base64 encoded input string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("base64 deserialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// Base64IsValid verifies the input string is base64 encoded.
 var Base64IsValid = &Builtin{
-	Name: "base64.is_valid",
+	Name:        "base64.is_valid",
+	Description: "Verifies the input string is base64 encoded.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.B,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("result", types.B).Description("`true` if `x` is valid base64 encoded value, `false` otherwise"),
 	),
+	Categories: encoding,
 }
 
-// Base64UrlEncode serializes the input string into base64url encoding.
 var Base64UrlEncode = &Builtin{
-	Name: "base64url.encode",
+	Name:        "base64url.encode",
+	Description: "Serializes the input string into base64url encoding.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("base64url serialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// Base64UrlEncodeNoPad serializes the input string into base64url encoding without padding.
 var Base64UrlEncodeNoPad = &Builtin{
-	Name: "base64url.encode_no_pad",
+	Name:        "base64url.encode_no_pad",
+	Description: "Serializes the input string into base64url encoding without padding.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("base64url serialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// Base64UrlDecode deserializes the base64url encoded input string.
 var Base64UrlDecode = &Builtin{
-	Name: "base64url.decode",
+	Name:        "base64url.decode",
+	Description: "Deserializes the base64url encoded input string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("base64url deserialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// URLQueryDecode decodes a URL encoded input string.
 var URLQueryDecode = &Builtin{
-	Name: "urlquery.decode",
+	Name:        "urlquery.decode",
+	Description: "Decodes a URL-encoded input string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("URL-encoding deserialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// URLQueryEncode encodes the input string into a URL encoded string.
 var URLQueryEncode = &Builtin{
-	Name: "urlquery.encode",
+	Name:        "urlquery.encode",
+	Description: "Encodes the input string into a URL-encoded string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("URL-encoding serialization of `x`"),
 	),
+	Categories: encoding,
 }
 
-// URLQueryEncodeObject encodes the given JSON into a URL encoded query string.
 var URLQueryEncodeObject = &Builtin{
-	Name: "urlquery.encode_object",
+	Name:        "urlquery.encode_object",
+	Description: "Encodes the given object into a URL encoded query string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("object", types.NewObject(
 				nil,
 				types.NewDynamicProperty(
 					types.S,
 					types.NewAny(
 						types.S,
 						types.NewArray(nil, types.S),
-						types.NewSet(types.S))))),
-		types.S,
+						types.NewSet(types.S)))))),
+		types.Named("y", types.S).Description("the URL-encoded serialization of `object`"),
 	),
+	Categories: encoding,
 }
 
-// URLQueryDecodeObject decodes the given URL query string into an object.
 var URLQueryDecodeObject = &Builtin{
-	Name: "urlquery.decode_object",
+	Name:        "urlquery.decode_object",
+	Description: "Decodes the given URL query string into an object.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewObject(nil, types.NewDynamicProperty(
+		types.Args(
+			types.Named("x", types.S).Description("the query string"),
+		),
+		types.Named("object", types.NewObject(nil, types.NewDynamicProperty(
 			types.S,
-			types.NewArray(nil, types.S))),
+			types.NewArray(nil, types.S)))).Description("the resulting object"),
 	),
+	Categories: encoding,
 }
 
-// YAMLMarshal serializes the input term.
 var YAMLMarshal = &Builtin{
-	Name: "yaml.marshal",
+	Name:        "yaml.marshal",
+	Description: "Serializes the input term to YAML.",
 	Decl: types.NewFunction(
-		types.Args(types.A),
-		types.S,
+		types.Args(
+			types.Named("x", types.A).Description("the term to serialize"),
+		),
+		types.Named("y", types.S).Description("the YAML string representation of `x`"),
 	),
+	Categories: encoding,
 }
 
-// YAMLUnmarshal deserializes the input string.
 var YAMLUnmarshal = &Builtin{
-	Name: "yaml.unmarshal",
+	Name:        "yaml.unmarshal",
+	Description: "Deserializes the input string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.A,
+		types.Args(
+			types.Named("x", types.S).Description("a YAML string"),
+		),
+		types.Named("y", types.A).Description("the term deseralized from `x`"),
 	),
+	Categories: encoding,
 }
 
 // YAMLIsValid verifies the input string is a valid YAML document.
 var YAMLIsValid = &Builtin{
-	Name: "yaml.is_valid",
+	Name:        "yaml.is_valid",
+	Description: "Verifies the input string is a valid YAML document.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.B,
+		types.Args(
+			types.Named("x", types.S).Description("a YAML string"),
+		),
+		types.Named("result", types.B).Description("`true` if `x` is valid YAML, `false` otherwise"),
 	),
+	Categories: encoding,
 }
 
-// HexEncode serializes the input string into hex encoding.
 var HexEncode = &Builtin{
-	Name: "hex.encode",
+	Name:        "hex.encode",
+	Description: "Serializes the input string using hex-encoding.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("serialization of `x` using hex-encoding"),
 	),
+	Categories: encoding,
 }
 
-// HexDecode deserializes the hex encoded input string.
 var HexDecode = &Builtin{
-	Name: "hex.decode",
+	Name:        "hex.decode",
+	Description: "Deserializes the hex-encoded input string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S).Description("a hex-encoded string"),
+		),
+		types.Named("y", types.S).Description("deseralized from `x`"),
 	),
+	Categories: encoding,
 }
 
 /**
  * Tokens
  */
+var tokensCat = category("tokens")
 
-// JWTDecode decodes a JSON Web Token and outputs it as an Object.
 var JWTDecode = &Builtin{
-	Name: "io.jwt.decode",
+	Name:        "io.jwt.decode",
+	Description: "Decodes a JSON Web Token and outputs it as an object.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewArray([]types.Type{
+		types.Args(
+			types.Named("jwt", types.S).Description("JWT token to decode"),
+		),
+		types.Named("output", types.NewArray([]types.Type{
 			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
 			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
 			types.S,
-		}, nil),
+		}, nil)).Description("`[header, payload, sig]`, where `header` and `payload` are objects; `sig` is the hexadecimal representation of the signature on the token."),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyRS256 verifies if a RS256 JWT signature is valid or not.
 var JWTVerifyRS256 = &Builtin{
-	Name: "io.jwt.verify_rs256",
+	Name:        "io.jwt.verify_rs256",
+	Description: "Verifies if a RS256 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyRS384 verifies if a RS384 JWT signature is valid or not.
 var JWTVerifyRS384 = &Builtin{
-	Name: "io.jwt.verify_rs384",
+	Name:        "io.jwt.verify_rs384",
+	Description: "Verifies if a RS384 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyRS512 verifies if a RS512 JWT signature is valid or not.
 var JWTVerifyRS512 = &Builtin{
-	Name: "io.jwt.verify_rs512",
+	Name:        "io.jwt.verify_rs512",
+	Description: "Verifies if a RS512 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyPS256 verifies if a PS256 JWT signature is valid or not.
 var JWTVerifyPS256 = &Builtin{
-	Name: "io.jwt.verify_ps256",
+	Name:        "io.jwt.verify_ps256",
+	Description: "Verifies if a PS256 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyPS384 verifies if a PS384 JWT signature is valid or not.
 var JWTVerifyPS384 = &Builtin{
-	Name: "io.jwt.verify_ps384",
+	Name:        "io.jwt.verify_ps384",
+	Description: "Verifies if a PS384 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyPS512 verifies if a PS512 JWT signature is valid or not.
 var JWTVerifyPS512 = &Builtin{
-	Name: "io.jwt.verify_ps512",
+	Name:        "io.jwt.verify_ps512",
+	Description: "Verifies if a PS512 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyES256 verifies if a ES256 JWT signature is valid or not.
 var JWTVerifyES256 = &Builtin{
-	Name: "io.jwt.verify_es256",
+	Name:        "io.jwt.verify_es256",
+	Description: "Verifies if a ES256 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyES384 verifies if a ES384 JWT signature is valid or not.
 var JWTVerifyES384 = &Builtin{
-	Name: "io.jwt.verify_es384",
+	Name:        "io.jwt.verify_es384",
+	Description: "Verifies if a ES384 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyES512 verifies if a ES512 JWT signature is valid or not.
 var JWTVerifyES512 = &Builtin{
-	Name: "io.jwt.verify_es512",
+	Name:        "io.jwt.verify_es512",
+	Description: "Verifies if a ES512 JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("certificate", types.S).Description("PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyHS256 verifies if a HS256 (secret) JWT signature is valid or not.
 var JWTVerifyHS256 = &Builtin{
-	Name: "io.jwt.verify_hs256",
+	Name:        "io.jwt.verify_hs256",
+	Description: "Verifies if a HS256 (secret) JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("secret", types.S).Description("plain text secret used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyHS384 verifies if a HS384 (secret) JWT signature is valid or not.
 var JWTVerifyHS384 = &Builtin{
-	Name: "io.jwt.verify_hs384",
+	Name:        "io.jwt.verify_hs384",
+	Description: "Verifies if a HS384 (secret) JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("secret", types.S).Description("plain text secret used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTVerifyHS512 verifies if a HS512 (secret) JWT signature is valid or not.
 var JWTVerifyHS512 = &Builtin{
-	Name: "io.jwt.verify_hs512",
+	Name:        "io.jwt.verify_hs512",
+	Description: "Verifies if a HS512 (secret) JWT signature is valid.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified"),
+			types.Named("secret", types.S).Description("plain text secret used to verify the signature"),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if the signature is valid, `false` otherwise"),
 	),
+	Categories: tokensCat,
 }
 
-// JWTDecodeVerify verifies a JWT signature under parameterized constraints and decodes the claims if it is valid.
+// Marked non-deterministic because it relies on time internally.
 var JWTDecodeVerify = &Builtin{
 	Name: "io.jwt.decode_verify",
+	Description: `Verifies a JWT signature under parameterized constraints and decodes the claims if it is valid.
+Supports the following algorithms: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384 and PS512.`,
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
+			types.Named("jwt", types.S).Description("JWT token whose signature is to be verified and whose claims are to be checked"),
+			types.Named("constraints", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).Description("claim verification constraints"),
 		),
-		types.NewArray([]types.Type{
+		types.Named("output", types.NewArray([]types.Type{
 			types.B,
 			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
 			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
-		}, nil),
+		}, nil)).Description("`[valid, header, payload]`:  if the input token is verified and meets the requirements of `constraints` then `valid` is `true`; `header` and `payload` are objects containing the JOSE header and the JWT claim set; otherwise, `valid` is `false`, `header` and `payload` are `{}`"),
 	),
+	Categories:       tokensCat,
+	Nondeterministic: true,
 }
 
-// JWTEncodeSignRaw encodes and optionally sign  a JSON Web Token.
-// Inputs are protected headers, payload, secret
+var tokenSign = category("tokensign")
+
+// Marked non-deterministic because it relies on RNG internally.
 var JWTEncodeSignRaw = &Builtin{
-	Name: "io.jwt.encode_sign_raw",
+	Name:        "io.jwt.encode_sign_raw",
+	Description: "Encodes and optionally signs a JSON Web Token.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
-			types.S,
+			types.Named("headers", types.S).Description("JWS Protected Header"),
+			types.Named("payload", types.S).Description("JWS Payload"),
+			types.Named("key", types.S).Description("JSON Web Key (RFC7517)"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("signed JWT"),
 	),
+	Categories:       tokenSign,
+	Nondeterministic: true,
 }
 
-// JWTEncodeSign encodes and optionally sign  a JSON Web Token.
-// Inputs are protected headers, payload, secret
+// Marked non-deterministic because it relies on RNG internally.
 var JWTEncodeSign = &Builtin{
-	Name: "io.jwt.encode_sign",
+	Name:        "io.jwt.encode_sign",
+	Description: "Encodes and optionally signs a JSON Web Token. Inputs are taken as objects, not encoded strings (see `io.jwt.encode_sign_raw`).",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
-			types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
-			types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
+			types.Named("headers", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).Description("JWS Protected Header"),
+			types.Named("payload", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).Description("JWS Payload"),
+			types.Named("key", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).Description("JSON Web Key (RFC7517)"),
 		),
-		types.S,
+		types.Named("output", types.S).Description("signed JWT"),
 	),
+	Categories:       tokenSign,
+	Nondeterministic: true,
 }
 
 /**
  * Time
  */
 
-// NowNanos returns the current time since epoch in nanoseconds.
+// Marked non-deterministic because it relies on time directly.
 var NowNanos = &Builtin{
-	Name: "time.now_ns",
+	Name:        "time.now_ns",
+	Description: "Returns the current time since epoch in nanoseconds.",
 	Decl: types.NewFunction(
 		nil,
-		types.N,
+		types.Named("now", types.N).Description("nanoseconds since epoch"),
 	),
+	Nondeterministic: true,
 }
 
-// ParseNanos returns the time in nanoseconds parsed from the string in the given format.
 var ParseNanos = &Builtin{
-	Name: "time.parse_ns",
+	Name:        "time.parse_ns",
+	Description: "Returns the time in nanoseconds parsed from the string in the given format. `undefined` if the result would be outside the valid time range that can fit within an `int64`.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("layout", types.S).Description("format used for parsing, see the [Go `time` package documentation](https://golang.org/pkg/time/#Parse) for more details"),
+			types.Named("value", types.S).Description("input to parse according to `layout`"),
 		),
-		types.N,
+		types.Named("ns", types.N).Description("`value` in nanoseconds since epoch"),
 	),
 }
 
-// ParseRFC3339Nanos returns the time in nanoseconds parsed from the string in RFC3339 format.
 var ParseRFC3339Nanos = &Builtin{
-	Name: "time.parse_rfc3339_ns",
+	Name:        "time.parse_rfc3339_ns",
+	Description: "Returns the time in nanoseconds parsed from the string in RFC3339 format. `undefined` if the result would be outside the valid time range that can fit within an `int64`.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.N,
+		types.Args(
+			types.Named("value", types.S),
+		),
+		types.Named("ns", types.N).Description("`value` in nanoseconds since epoch"),
 	),
 }
 
-// ParseDurationNanos returns the duration in nanoseconds represented by a duration string.
-// Duration string is similar to the Go time.ParseDuration string
 var ParseDurationNanos = &Builtin{
-	Name: "time.parse_duration_ns",
+	Name:        "time.parse_duration_ns",
+	Description: "Returns the duration in nanoseconds represented by a string.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.N,
+		types.Args(
+			types.Named("duration", types.S).Description("a duration like \"3m\"; see the [Go `time` package documentation](https://golang.org/pkg/time/#ParseDuration) for more details"),
+		),
+		types.Named("ns", types.N).Description("the `duration` in nanoseconds"),
+	),
+}
+
+var Format = &Builtin{
+	Name:        "time.format",
+	Description: "Returns the formatted timestamp for the nanoseconds since epoch.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("x", types.NewAny(
+				types.N,
+				types.NewArray([]types.Type{types.N, types.S}, nil),
+				types.NewArray([]types.Type{types.N, types.S, types.S}, nil),
+			)).Description("a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string; or a three-element array of ns, timezone string and a layout string (see golang supported time formats)"),
+		),
+		types.Named("formatted timestamp", types.S).Description("the formatted timestamp represented for the nanoseconds since the epoch in the supplied timezone (or UTC)"),
 	),
 }
 
-// Date returns the [year, month, day] for the nanoseconds since epoch.
 var Date = &Builtin{
-	Name: "time.date",
+	Name:        "time.date",
+	Description: "Returns the `[year, month, day]` for the nanoseconds since epoch.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("x", types.NewAny(
 				types.N,
 				types.NewArray([]types.Type{types.N, types.S}, nil),
-			),
+			)).Description("a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string"),
 		),
-		types.NewArray([]types.Type{types.N, types.N, types.N}, nil),
+		types.Named("date", types.NewArray([]types.Type{types.N, types.N, types.N}, nil)).Description("an array of `year`, `month` (1-12), and `day` (1-31)"),
 	),
 }
 
-// Clock returns the [hour, minute, second] of the day for the nanoseconds since epoch.
 var Clock = &Builtin{
-	Name: "time.clock",
+	Name:        "time.clock",
+	Description: "Returns the `[hour, minute, second]` of the day for the nanoseconds since epoch.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("x", types.NewAny(
 				types.N,
 				types.NewArray([]types.Type{types.N, types.S}, nil),
-			),
+			)).Description("a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string"),
 		),
-		types.NewArray([]types.Type{types.N, types.N, types.N}, nil),
+		types.Named("output", types.NewArray([]types.Type{types.N, types.N, types.N}, nil)).
+			Description("the `hour`, `minute` (0-59), and `second` (0-59) representing the time of day for the nanoseconds since epoch in the supplied timezone (or UTC)"),
 	),
 }
 
-// Weekday returns the day of the week (Monday, Tuesday, ...) for the nanoseconds since epoch.
 var Weekday = &Builtin{
-	Name: "time.weekday",
+	Name:        "time.weekday",
+	Description: "Returns the day of the week (Monday, Tuesday, ...) for the nanoseconds since epoch.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("x", types.NewAny(
 				types.N,
 				types.NewArray([]types.Type{types.N, types.S}, nil),
-			),
+			)).Description("a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string"),
 		),
-		types.S,
+		types.Named("day", types.S).Description("the weekday represented by `ns` nanoseconds since the epoch in the supplied timezone (or UTC)"),
 	),
 }
 
-// AddDate returns the nanoseconds since epoch after adding years, months and days to nanoseconds.
 var AddDate = &Builtin{
-	Name: "time.add_date",
+	Name:        "time.add_date",
+	Description: "Returns the nanoseconds since epoch after adding years, months and days to nanoseconds. `undefined` if the result would be outside the valid time range that can fit within an `int64`.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.N,
-			types.N,
-			types.N,
-			types.N,
+			types.Named("ns", types.N).Description("nanoseconds since the epoch"),
+			types.Named("years", types.N),
+			types.Named("months", types.N),
+			types.Named("days", types.N),
 		),
-		types.N,
+		types.Named("output", types.N).Description("nanoseconds since the epoch representing the input time, with years, months and days added"),
 	),
 }
 
-// Diff returns the difference [years, months, days, hours, minutes, seconds] between two unix timestamps in nanoseconds
 var Diff = &Builtin{
-	Name: "time.diff",
+	Name:        "time.diff",
+	Description: "Returns the difference between two unix timestamps in nanoseconds (with optional timezone strings).",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
+			types.Named("ns1", types.NewAny(
 				types.N,
 				types.NewArray([]types.Type{types.N, types.S}, nil),
-			),
-			types.NewAny(
+			)),
+			types.Named("ns2", types.NewAny(
 				types.N,
 				types.NewArray([]types.Type{types.N, types.S}, nil),
-			),
+			)),
 		),
-		types.NewArray([]types.Type{types.N, types.N, types.N, types.N, types.N, types.N}, nil),
+		types.Named("output", types.NewArray([]types.Type{types.N, types.N, types.N, types.N, types.N, types.N}, nil)).Description("difference between `ns1` and `ns2` (in their supplied timezones, if supplied, or UTC) as array of numbers: `[years, months, days, hours, minutes, seconds]`"),
 	),
 }
 
@@ -1802,161 +2244,185 @@ var Diff = &Builtin{
  * Crypto.
  */
 
-// CryptoX509ParseCertificates returns one or more certificates from the given
-// base64 encoded string containing DER encoded certificates that have been
-// concatenated.
 var CryptoX509ParseCertificates = &Builtin{
 	Name: "crypto.x509.parse_certificates",
+	Description: `Returns zero or more certificates from the given encoded string containing
+DER certificate data.
+
+If the input is empty, the function will return null. The input string should be a list of one or more
+concatenated PEM blocks. The whole input of concatenated PEM blocks can optionally be Base64 encoded.`,
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewArray(nil, types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))),
+		types.Args(
+			types.Named("certs", types.S).Description("base64 encoded DER or PEM data containing one or more certificates or a PEM string of one or more certificates"),
+		),
+		types.Named("output", types.NewArray(nil, types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)))).Description("parsed X.509 certificates represented as objects"),
 	),
 }
 
-// CryptoX509ParseAndVerifyCertificates returns one or more certificates from the given
-// string containing PEM or base64 encoded DER certificates after verifying the supplied
-// certificates form a complete certificate chain back to a trusted root.
-//
-// The first certificate is treated as the root and the last is treated as the leaf,
-// with all others being treated as intermediates
 var CryptoX509ParseAndVerifyCertificates = &Builtin{
 	Name: "crypto.x509.parse_and_verify_certificates",
+	Description: `Returns one or more certificates from the given string containing PEM
+or base64 encoded DER certificates after verifying the supplied certificates form a complete
+certificate chain back to a trusted root.
+
+The first certificate is treated as the root and the last is treated as the leaf,
+with all others being treated as intermediates.`,
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewArray([]types.Type{
+		types.Args(
+			types.Named("certs", types.S).Description("base64 encoded DER or PEM data containing two or more certificates where the first is a root CA, the last is a leaf certificate, and all others are intermediate CAs"),
+		),
+		types.Named("output", types.NewArray([]types.Type{
 			types.B,
 			types.NewArray(nil, types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))),
-		}, nil),
+		}, nil)).Description("array of `[valid, certs]`: if the input certificate chain could be verified then `valid` is `true` and `certs` is an array of X.509 certificates represented as objects; if the input certificate chain could not be verified then `valid` is `false` and `certs` is `[]`"),
 	),
 }
 
-// CryptoX509ParseCertificateRequest returns a PKCS #10 certificate signing
-// request from the given PEM-encoded PKCS#10 certificate signing request.
 var CryptoX509ParseCertificateRequest = &Builtin{
-	Name: "crypto.x509.parse_certificate_request",
+	Name:        "crypto.x509.parse_certificate_request",
+	Description: "Returns a PKCS #10 certificate signing request from the given PEM-encoded PKCS#10 certificate signing request.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
+		types.Args(
+			types.Named("csr", types.S).Description("base64 string containing either a PEM encoded or DER CSR or a string containing a PEM CSR"),
+		),
+		types.Named("output", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).Description("X.509 CSR represented as an object"),
 	),
 }
 
-// CryptoX509ParseRSAPrivateKey returns a JWK for signing a JWT from the given
-// PEM-encoded RSA private key.
 var CryptoX509ParseRSAPrivateKey = &Builtin{
-	Name: "crypto.x509.parse_rsa_private_key",
+	Name:        "crypto.x509.parse_rsa_private_key",
+	Description: "Returns a JWK for signing a JWT from the given PEM-encoded RSA private key.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
+		types.Args(
+			types.Named("pem", types.S).Description("base64 string containing a PEM encoded RSA private key"),
+		),
+		types.Named("output", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).Description("JWK as an object"),
 	),
 }
 
-// CryptoMd5 returns a string representing the input string hashed with the md5 function
 var CryptoMd5 = &Builtin{
-	Name: "crypto.md5",
+	Name:        "crypto.md5",
+	Description: "Returns a string representing the input string hashed with the MD5 function",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("MD5-hash of `x`"),
 	),
 }
 
-// CryptoSha1 returns a string representing the input string hashed with the sha1 function
 var CryptoSha1 = &Builtin{
-	Name: "crypto.sha1",
+	Name:        "crypto.sha1",
+	Description: "Returns a string representing the input string hashed with the SHA1 function",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("SHA1-hash of `x`"),
 	),
 }
 
-// CryptoSha256 returns a string representing the input string hashed with the sha256 function
 var CryptoSha256 = &Builtin{
-	Name: "crypto.sha256",
+	Name:        "crypto.sha256",
+	Description: "Returns a string representing the input string hashed with the SHA256 function",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.S,
+		types.Args(
+			types.Named("x", types.S),
+		),
+		types.Named("y", types.S).Description("SHA256-hash of `x`"),
 	),
 }
 
-// CryptoHmacMd5 returns a string representing the MD-5 HMAC of the input message using the input key
-// Inputs are message, key
 var CryptoHmacMd5 = &Builtin{
-	Name: "crypto.hmac.md5",
+	Name:        "crypto.hmac.md5",
+	Description: "Returns a string representing the MD5 HMAC of the input message using the input key.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("x", types.S).Description("input string"),
+			types.Named("key", types.S).Description("key to use"),
 		),
-		types.S,
+		types.Named("y", types.S).Description("MD5-HMAC of `x`"),
 	),
 }
 
-// CryptoHmacSha1 returns a string representing the SHA-1 HMAC of the input message using the input key
-// Inputs are message, key
 var CryptoHmacSha1 = &Builtin{
-	Name: "crypto.hmac.sha1",
+	Name:        "crypto.hmac.sha1",
+	Description: "Returns a string representing the SHA1 HMAC of the input message using the input key.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("x", types.S).Description("input string"),
+			types.Named("key", types.S).Description("key to use"),
 		),
-		types.S,
+		types.Named("y", types.S).Description("SHA1-HMAC of `x`"),
 	),
 }
 
-// CryptoHmacSha256 returns a string representing the SHA-256 HMAC of the input message using the input key
-// Inputs are message, key
 var CryptoHmacSha256 = &Builtin{
-	Name: "crypto.hmac.sha256",
+	Name:        "crypto.hmac.sha256",
+	Description: "Returns a string representing the SHA256 HMAC of the input message using the input key.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("x", types.S).Description("input string"),
+			types.Named("key", types.S).Description("key to use"),
 		),
-		types.S,
+		types.Named("y", types.S).Description("SHA256-HMAC of `x`"),
 	),
 }
 
-// CryptoHmacSha512 returns a string representing the SHA-512 HMAC of the input message using the input key
-// Inputs are message, key
 var CryptoHmacSha512 = &Builtin{
-	Name: "crypto.hmac.sha512",
+	Name:        "crypto.hmac.sha512",
+	Description: "Returns a string representing the SHA512 HMAC of the input message using the input key.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("x", types.S).Description("input string"),
+			types.Named("key", types.S).Description("key to use"),
 		),
-		types.S,
+		types.Named("y", types.S).Description("SHA512-HMAC of `x`"),
+	),
+}
+
+var CryptoHmacEqual = &Builtin{
+	Name:        "crypto.hmac.equal",
+	Description: "Returns a boolean representing the result of comparing two MACs for equality without leaking timing information.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("mac1", types.S).Description("mac1 to compare"),
+			types.Named("mac2", types.S).Description("mac2 to compare"),
+		),
+		types.Named("result", types.B).Description("`true` if the MACs are equals, `false` otherwise"),
 	),
 }
 
 /**
  * Graphs.
  */
+var graphs = category("graph")
 
-// WalkBuiltin generates [path, value] tuples for all nested documents
-// (recursively).
 var WalkBuiltin = &Builtin{
-	Name:     "walk",
-	Relation: true,
+	Name:        "walk",
+	Relation:    true,
+	Description: "Generates `[path, value]` tuples for all nested documents of `x` (recursively).  Queries can use `walk` to traverse documents nested under `x`.",
 	Decl: types.NewFunction(
-		types.Args(types.A),
-		types.NewArray(
+		types.Args(
+			types.Named("x", types.A),
+		),
+		types.Named("output", types.NewArray(
 			[]types.Type{
 				types.NewArray(nil, types.A),
 				types.A,
 			},
 			nil,
-		),
+		)).Description("pairs of `path` and `value`: `path` is an array representing the pointer to `value` in `x`"),
 	),
+	Categories: graphs,
 }
 
-// ReachableBuiltin computes the set of reachable nodes in the graph from a set
-// of starting nodes.
 var ReachableBuiltin = &Builtin{
-	Name: "graph.reachable",
+	Name:        "graph.reachable",
+	Description: "Computes the set of reachable nodes in the graph from a set of starting nodes.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(
+			types.Named("graph", types.NewObject(
 				nil,
 				types.NewDynamicProperty(
 					types.A,
@@ -1964,109 +2430,120 @@ var ReachableBuiltin = &Builtin{
 						types.NewSet(types.A),
 						types.NewArray(nil, types.A)),
 				)),
-			types.NewAny(types.NewSet(types.A), types.NewArray(nil, types.A)),
+			).Description("object containing a set or array of neighboring vertices"),
+			types.Named("initial", types.NewAny(types.NewSet(types.A), types.NewArray(nil, types.A))).Description("set or array of root vertices"),
 		),
-		types.NewSet(types.A),
+		types.Named("output", types.NewSet(types.A)).Description("set of vertices reachable from the `initial` vertices in the directed `graph`"),
 	),
 }
 
-/**
- * Sorting
- */
-
-// Sort returns a sorted array.
-var Sort = &Builtin{
-	Name: "sort",
+var ReachablePathsBuiltin = &Builtin{
+	Name:        "graph.reachable_paths",
+	Description: "Computes the set of reachable paths in the graph from a set of starting nodes.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
-				types.NewArray(nil, types.A),
-				types.NewSet(types.A),
-			),
+			types.Named("graph", types.NewObject(
+				nil,
+				types.NewDynamicProperty(
+					types.A,
+					types.NewAny(
+						types.NewSet(types.A),
+						types.NewArray(nil, types.A)),
+				)),
+			).Description("object containing a set or array of root vertices"),
+			types.Named("initial", types.NewAny(types.NewSet(types.A), types.NewArray(nil, types.A))).Description("initial paths"), // TODO(sr): copied. is that correct?
 		),
-		types.NewArray(nil, types.A),
+		types.Named("output", types.NewSet(types.NewArray(nil, types.A))).Description("paths reachable from the `initial` vertices in the directed `graph`"),
 	),
 }
 
 /**
  * Type
  */
+var typesCat = category("types")
 
-// IsNumber returns true if the input value is a number
 var IsNumber = &Builtin{
-	Name: "is_number",
+	Name:        "is_number",
+	Description: "Returns `true` if the input value is a number.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is a number, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
-// IsString returns true if the input value is a string.
 var IsString = &Builtin{
-	Name: "is_string",
+	Name:        "is_string",
+	Description: "Returns `true` if the input value is a string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is a string, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
-// IsBoolean returns true if the input value is a boolean.
 var IsBoolean = &Builtin{
-	Name: "is_boolean",
+	Name:        "is_boolean",
+	Description: "Returns `true` if the input value is a boolean.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is an boolean, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
-// IsArray returns true if the input value is an array.
 var IsArray = &Builtin{
-	Name: "is_array",
+	Name:        "is_array",
+	Description: "Returns `true` if the input value is an array.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is an array, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
-// IsSet returns true if the input value is a set.
 var IsSet = &Builtin{
-	Name: "is_set",
+	Name:        "is_set",
+	Description: "Returns `true` if the input value is a set.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is a set, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
-// IsObject returns true if the input value is an object.
 var IsObject = &Builtin{
-	Name: "is_object",
+	Name:        "is_object",
+	Description: "Returns true if the input value is an object",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is an object, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
-// IsNull returns true if the input value is null.
 var IsNull = &Builtin{
-	Name: "is_null",
+	Name:        "is_null",
+	Description: "Returns `true` if the input value is null.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("x", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `x` is null, `false` otherwise."),
 	),
+	Categories: typesCat,
 }
 
 /**
@@ -2075,193 +2552,378 @@ var IsNull = &Builtin{
 
 // TypeNameBuiltin returns the type of the input.
 var TypeNameBuiltin = &Builtin{
-	Name: "type_name",
+	Name:        "type_name",
+	Description: "Returns the type of its input value.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewAny(
-				types.A,
-			),
+			types.Named("x", types.A),
 		),
-		types.S,
+		types.Named("type", types.S).Description(`one of "null", "boolean", "number", "string", "array", "object", "set"`),
 	),
+	Categories: typesCat,
 }
 
 /**
  * HTTP Request
  */
 
-// HTTPSend returns a HTTP response to the given HTTP request.
+// Marked non-deterministic because HTTP request results can be non-deterministic.
 var HTTPSend = &Builtin{
-	Name: "http.send",
+	Name:        "http.send",
+	Description: "Returns a HTTP response to the given HTTP request.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
+			types.Named("request", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))),
 		),
-		types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
+		types.Named("response", types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))),
 	),
+	Nondeterministic: true,
 }
 
 /**
- * Rego
+ * GraphQL
  */
 
-// RegoParseModule parses the input Rego file and returns a JSON representation
-// of the AST.
-var RegoParseModule = &Builtin{
-	Name: "rego.parse_module",
+// GraphQLParse returns a pair of AST objects from parsing/validation.
+var GraphQLParse = &Builtin{
+	Name:        "graphql.parse",
+	Description: "Returns AST objects for a given GraphQL query and schema after validating the query against the schema. Returns undefined if errors were encountered during parsing or validation. The query and/or schema can be either GraphQL strings or AST objects from the other GraphQL builtin functions.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("query", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
+			types.Named("schema", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
 		),
-		types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)), // TODO(tsandall): import AST schema
+		types.Named("output", types.NewArray([]types.Type{
+			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
+			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
+		}, nil)).Description("`output` is of the form `[query_ast, schema_ast]`. If the GraphQL query is valid given the provided schema, then `query_ast` and `schema_ast` are objects describing the ASTs for the query and schema."),
+	),
+}
+
+// GraphQLParseAndVerify returns a boolean and a pair of AST object from parsing/validation.
+var GraphQLParseAndVerify = &Builtin{
+	Name:        "graphql.parse_and_verify",
+	Description: "Returns a boolean indicating success or failure alongside the parsed ASTs for a given GraphQL query and schema after validating the query against the schema. The query and/or schema can be either GraphQL strings or AST objects from the other GraphQL builtin functions.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("query", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
+			types.Named("schema", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
+		),
+		types.Named("output", types.NewArray([]types.Type{
+			types.B,
+			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
+			types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
+		}, nil)).Description(" `output` is of the form `[valid, query_ast, schema_ast]`. If the query is valid given the provided schema, then `valid` is `true`, and `query_ast` and `schema_ast` are objects describing the ASTs for the GraphQL query and schema. Otherwise, `valid` is `false` and `query_ast` and `schema_ast` are `{}`."),
+	),
+}
+
+// GraphQLParseQuery parses the input GraphQL query and returns a JSON
+// representation of its AST.
+var GraphQLParseQuery = &Builtin{
+	Name:        "graphql.parse_query",
+	Description: "Returns an AST object for a GraphQL query.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("query", types.S),
+		),
+		types.Named("output", types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))).Description("AST object for the GraphQL query."),
+	),
+}
+
+// GraphQLParseSchema parses the input GraphQL schema and returns a JSON
+// representation of its AST.
+var GraphQLParseSchema = &Builtin{
+	Name:        "graphql.parse_schema",
+	Description: "Returns an AST object for a GraphQL schema.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("schema", types.S),
+		),
+		types.Named("output", types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))).Description("AST object for the GraphQL schema."),
+	),
+}
+
+// GraphQLIsValid returns true if a GraphQL query is valid with a given
+// schema, and returns false for all other inputs.
+var GraphQLIsValid = &Builtin{
+	Name:        "graphql.is_valid",
+	Description: "Checks that a GraphQL query is valid against a given schema. The query and/or schema can be either GraphQL strings or AST objects from the other GraphQL builtin functions.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("query", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
+			types.Named("schema", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
+		),
+		types.Named("output", types.B).Description("`true` if the query is valid under the given schema. `false` otherwise."),
+	),
+}
+
+// GraphQLSchemaIsValid returns true if the input is valid GraphQL schema,
+// and returns false for all other inputs.
+var GraphQLSchemaIsValid = &Builtin{
+	Name:        "graphql.schema_is_valid",
+	Description: "Checks that the input is a valid GraphQL schema. The schema can be either a GraphQL string or an AST object from the other GraphQL builtin functions.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("schema", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))),
+		),
+		types.Named("output", types.B).Description("`true` if the schema is a valid GraphQL schema. `false` otherwise."),
 	),
 }
 
 /**
- * OPA
+ * JSON Schema
  */
 
-// OPARuntime returns an object containing OPA runtime information such as the
-// configuration that OPA was booted with.
-var OPARuntime = &Builtin{
-	Name: "opa.runtime",
+// JSONSchemaVerify returns empty string if the input is valid JSON schema
+// and returns error string for all other inputs.
+var JSONSchemaVerify = &Builtin{
+	Name:        "json.verify_schema",
+	Description: "Checks that the input is a valid JSON schema object. The schema can be either a JSON string or an JSON object.",
 	Decl: types.NewFunction(
-		nil,
-		types.NewObject(nil, types.NewDynamicProperty(types.S, types.A)),
+		types.Args(
+			types.Named("schema", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))).
+				Description("the schema to verify"),
+		),
+		types.Named("output", types.NewArray([]types.Type{
+			types.B,
+			types.NewAny(types.S, types.Null{}),
+		}, nil)).
+			Description("`output` is of the form `[valid, error]`. If the schema is valid, then `valid` is `true`, and `error` is `null`. Otherwise, `valid` is `false` and `error` is a string describing the error."),
 	),
+	Categories: objectCat,
+}
+
+// JSONMatchSchema returns empty array if the document matches the JSON schema,
+// and returns non-empty array with error objects otherwise.
+var JSONMatchSchema = &Builtin{
+	Name:        "json.match_schema",
+	Description: "Checks that the document matches the JSON schema.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("document", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))).
+				Description("document to verify by schema"),
+			types.Named("schema", types.NewAny(types.S, types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)))).
+				Description("schema to verify document by"),
+		),
+		types.Named("output", types.NewArray([]types.Type{
+			types.B,
+			types.NewArray(
+				nil, types.NewObject(
+					[]*types.StaticProperty{
+						{Key: "error", Value: types.S},
+						{Key: "type", Value: types.S},
+						{Key: "field", Value: types.S},
+						{Key: "desc", Value: types.S},
+					},
+					nil,
+				),
+			),
+		}, nil)).
+			Description("`output` is of the form `[match, errors]`. If the document is valid given the schema, then `match` is `true`, and `errors` is an empty array. Otherwise, `match` is `false` and `errors` is an array of objects describing the error(s)."),
+	),
+	Categories: objectCat,
 }
 
 /**
- * Trace
+ * Cloud Provider Helper Functions
  */
+var providersAWSCat = category("providers.aws")
 
-// Trace prints a note that is included in the query explanation.
-var Trace = &Builtin{
-	Name: "trace",
+var ProvidersAWSSignReqObj = &Builtin{
+	Name:        "providers.aws.sign_req",
+	Description: "Signs an HTTP request object for Amazon Web Services. Currently implements [AWS Signature Version 4 request signing](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) by the `Authorization` header method.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
+			types.Named("request", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))),
+			types.Named("aws_config", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))),
+			types.Named("time_ns", types.N),
 		),
-		types.B,
+		types.Named("signed_request", types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))),
 	),
+	Categories: providersAWSCat,
 }
 
 /**
- * Set
+ * Rego
  */
 
-// Intersection returns the intersection of the given input sets
-var Intersection = &Builtin{
-	Name: "intersection",
+var RegoParseModule = &Builtin{
+	Name:        "rego.parse_module",
+	Description: "Parses the input Rego string and returns an object representation of the AST.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewSet(types.NewSet(types.A)),
+			types.Named("filename", types.S).Description("file name to attach to AST nodes' locations"),
+			types.Named("rego", types.S).Description("Rego module"),
 		),
-		types.NewSet(types.A),
+		types.Named("output", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))), // TODO(tsandall): import AST schema
 	),
 }
 
-// Union returns the union of the given input sets
-var Union = &Builtin{
-	Name: "union",
+var RegoMetadataChain = &Builtin{
+	Name: "rego.metadata.chain",
+	Description: `Returns the chain of metadata for the active rule.
+Ordered starting at the active rule, going outward to the most distant node in its package ancestry.
+A chain entry is a JSON document with two members: "path", an array representing the path of the node; and "annotations", a JSON document containing the annotations declared for the node.
+The first entry in the chain always points to the active rule, even if it has no declared annotations (in which case the "annotations" member is not present).`,
+	Decl: types.NewFunction(
+		types.Args(),
+		types.Named("chain", types.NewArray(nil, types.A)).Description("each array entry represents a node in the path ancestry (chain) of the active rule that also has declared annotations"),
+	),
+}
+
+// RegoMetadataRule returns the metadata for the active rule
+var RegoMetadataRule = &Builtin{
+	Name:        "rego.metadata.rule",
+	Description: "Returns annotations declared for the active rule and using the _rule_ scope.",
+	Decl: types.NewFunction(
+		types.Args(),
+		types.Named("output", types.A).Description("\"rule\" scope annotations for this rule; empty object if no annotations exist"),
+	),
+}
+
+/**
+ * OPA
+ */
+
+// Marked non-deterministic because of unpredictable config/environment-dependent results.
+var OPARuntime = &Builtin{
+	Name:        "opa.runtime",
+	Description: "Returns an object that describes the runtime environment where OPA is deployed.",
+	Decl: types.NewFunction(
+		nil,
+		types.Named("output", types.NewObject(nil, types.NewDynamicProperty(types.S, types.A))).
+			Description("includes a `config` key if OPA was started with a configuration file; an `env` key containing the environment variables that the OPA process was started with; includes `version` and `commit` keys containing the version and build commit of OPA."),
+	),
+	Nondeterministic: true,
+}
+
+/**
+ * Trace
+ */
+var tracing = category("tracing")
+
+var Trace = &Builtin{
+	Name:        "trace",
+	Description: "Emits `note` as a `Note` event in the query explanation. Query explanations show the exact expressions evaluated by OPA during policy execution. For example, `trace(\"Hello There!\")` includes `Note \"Hello There!\"` in the query explanation. To include variables in the message, use `sprintf`. For example, `person := \"Bob\"; trace(sprintf(\"Hello There! %v\", [person]))` will emit `Note \"Hello There! Bob\"` inside of the explanation.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.NewSet(types.NewSet(types.A)),
+			types.Named("note", types.S).Description("the note to include"),
 		),
-		types.NewSet(types.A),
+		types.Named("result", types.B).Description("always `true`"),
 	),
+	Categories: tracing,
 }
 
 /**
  * Glob
  */
 
-// GlobMatch - not to be confused with regex.globs_match - parses and matches strings against the glob notation.
 var GlobMatch = &Builtin{
-	Name: "glob.match",
+	Name:        "glob.match",
+	Description: "Parses and matches strings against the glob notation. Not to be confused with `regex.globs_match`.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.NewArray(nil, types.S),
-			types.S,
+			types.Named("pattern", types.S),
+			types.Named("delimiters", types.NewAny(
+				types.NewArray(nil, types.S),
+				types.NewNull(),
+			)).Description("glob pattern delimiters, e.g. `[\".\", \":\"]`, defaults to `[\".\"]` if unset. If `delimiters` is `null`, glob match without delimiter."),
+			types.Named("match", types.S),
 		),
-		types.B,
+		types.Named("result", types.B).Description("true if `match` can be found in `pattern` which is separated by `delimiters`"),
 	),
 }
 
-// GlobQuoteMeta returns a string which represents a version of the pattern where all asterisks have been escaped.
 var GlobQuoteMeta = &Builtin{
-	Name: "glob.quote_meta",
+	Name:        "glob.quote_meta",
+	Description: "Returns a string which represents a version of the pattern where all asterisks have been escaped.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
+			types.Named("pattern", types.S),
 		),
-		types.S,
+		types.Named("output", types.S).Description("the escaped string of `pattern`"),
 	),
+	// TODO(sr): example for this was: Calling ``glob.quote_meta("*.github.com", output)`` returns ``\\*.github.com`` as ``output``.
 }
 
 /**
  * Networking
  */
 
-// NetCIDRIntersects checks if a cidr intersects with another cidr and returns true or false
 var NetCIDRIntersects = &Builtin{
-	Name: "net.cidr_intersects",
+	Name:        "net.cidr_intersects",
+	Description: "Checks if a CIDR intersects with another CIDR (e.g. `192.168.0.0/16` overlaps with `192.168.1.0/24`). Supports both IPv4 and IPv6 notations.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("cidr1", types.S),
+			types.Named("cidr2", types.S),
 		),
-		types.B,
+		types.Named("result", types.B),
 	),
 }
 
-// NetCIDRExpand returns a set of hosts inside the specified cidr.
 var NetCIDRExpand = &Builtin{
-	Name: "net.cidr_expand",
+	Name:        "net.cidr_expand",
+	Description: "Expands CIDR to set of hosts  (e.g., `net.cidr_expand(\"192.168.0.0/30\")` generates 4 hosts: `{\"192.168.0.0\", \"192.168.0.1\", \"192.168.0.2\", \"192.168.0.3\"}`).",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
+			types.Named("cidr", types.S),
 		),
-		types.NewSet(types.S),
+		types.Named("hosts", types.NewSet(types.S)).Description("set of IP addresses the CIDR `cidr` expands to"),
 	),
 }
 
-// NetCIDRContains checks if a cidr or ip is contained within another cidr and returns true or false
 var NetCIDRContains = &Builtin{
-	Name: "net.cidr_contains",
+	Name:        "net.cidr_contains",
+	Description: "Checks if a CIDR or IP is contained within another CIDR. `output` is `true` if `cidr_or_ip` (e.g. `127.0.0.64/26` or `127.0.0.1`) is contained within `cidr` (e.g. `127.0.0.1/24`) and `false` otherwise. Supports both IPv4 and IPv6 notations.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("cidr", types.S),
+			types.Named("cidr_or_ip", types.S),
 		),
-		types.B,
+		types.Named("result", types.B),
 	),
 }
 
-// NetCIDRContainsMatches checks if collections of cidrs or ips are contained within another collection of cidrs and returns matches.
 var NetCIDRContainsMatches = &Builtin{
 	Name: "net.cidr_contains_matches",
+	Description: "Checks if collections of cidrs or ips are contained within another collection of cidrs and returns matches. " +
+		"This function is similar to `net.cidr_contains` except it allows callers to pass collections of CIDRs or IPs as arguments and returns the matches (as opposed to a boolean result indicating a match between two CIDRs/IPs).",
 	Decl: types.NewFunction(
-		types.Args(netCidrContainsMatchesOperandType, netCidrContainsMatchesOperandType),
-		types.NewSet(types.NewArray([]types.Type{types.A, types.A}, nil)),
+		types.Args(
+			types.Named("cidrs", netCidrContainsMatchesOperandType),
+			types.Named("cidrs_or_ips", netCidrContainsMatchesOperandType),
+		),
+		types.Named("output", types.NewSet(types.NewArray([]types.Type{types.A, types.A}, nil))).Description("tuples identifying matches where `cidrs_or_ips` are contained within `cidrs`"),
 	),
 }
 
-// NetCIDRMerge merges IP addresses and subnets into the smallest possible list of CIDRs.
 var NetCIDRMerge = &Builtin{
 	Name: "net.cidr_merge",
+	Description: "Merges IP addresses and subnets into the smallest possible list of CIDRs (e.g., `net.cidr_merge([\"192.0.128.0/24\", \"192.0.129.0/24\"])` generates `{\"192.0.128.0/23\"}`." +
+		`This function merges adjacent subnets where possible, those contained within others and also removes any duplicates.
+Supports both IPv4 and IPv6 notations. IPv6 inputs need a prefix length (e.g. "/128").`,
 	Decl: types.NewFunction(
-		types.Args(netCidrMergeOperandType),
-		types.NewSet(types.S),
+		types.Args(
+			types.Named("addrs", types.NewAny(
+				types.NewArray(nil, types.NewAny(types.S)),
+				types.NewSet(types.S),
+			)).Description("CIDRs or IP addresses"),
+		),
+		types.Named("output", types.NewSet(types.S)).Description("smallest possible set of CIDRs obtained after merging the provided list of IP addresses and subnets in `addrs`"),
 	),
 }
 
-var netCidrMergeOperandType = types.NewAny(
-	types.NewArray(nil, types.NewAny(types.S)),
-	types.NewSet(types.S),
-)
+var NetCIDRIsValid = &Builtin{
+	Name:        "net.cidr_is_valid",
+	Description: "Parses an IPv4/IPv6 CIDR and returns a boolean indicating if the provided CIDR is valid.",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("cidr", types.S),
+		),
+		types.Named("result", types.B),
+	),
+}
 
 var netCidrContainsMatchesOperandType = types.NewAny(
 	types.S,
@@ -2282,44 +2944,43 @@ var netCidrContainsMatchesOperandType = types.NewAny(
 	)),
 )
 
-// NetLookupIPAddr returns the set of IP addresses (as strings, both v4 and v6)
-// that the passed-in name (string) resolves to using the standard name resolution
-// mechanisms available.
+// Marked non-deterministic because DNS resolution results can be non-deterministic.
 var NetLookupIPAddr = &Builtin{
-	Name: "net.lookup_ip_addr",
+	Name:        "net.lookup_ip_addr",
+	Description: "Returns the set of IP addresses (both v4 and v6) that the passed-in `name` resolves to using the standard name resolution mechanisms available.",
 	Decl: types.NewFunction(
-		types.Args(types.S),
-		types.NewSet(types.S),
+		types.Args(
+			types.Named("name", types.S).Description("domain name to resolve"),
+		),
+		types.Named("addrs", types.NewSet(types.S)).Description("IP addresses (v4 and v6) that `name` resolves to"),
 	),
+	Nondeterministic: true,
 }
 
 /**
  * Semantic Versions
  */
 
-// SemVerIsValid validiates a the term is a valid SemVer as a string, returns
-// false for all other input
 var SemVerIsValid = &Builtin{
-	Name: "semver.is_valid",
+	Name:        "semver.is_valid",
+	Description: "Validates that the input is a valid SemVer string.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.A,
+			types.Named("vsn", types.A),
 		),
-		types.B,
+		types.Named("result", types.B).Description("`true` if `vsn` is a valid SemVer; `false` otherwise"),
 	),
 }
 
-// SemVerCompare compares valid SemVer formatted version strings. Given two
-// version strings, if A < B returns -1, if A > B returns 1. If A == B, returns
-// 0
 var SemVerCompare = &Builtin{
-	Name: "semver.compare",
+	Name:        "semver.compare",
+	Description: "Compares valid SemVer formatted version strings.",
 	Decl: types.NewFunction(
 		types.Args(
-			types.S,
-			types.S,
+			types.Named("a", types.S),
+			types.Named("b", types.S),
 		),
-		types.N,
+		types.Named("result", types.N).Description("`-1` if `a < b`; `1` if `a > b`; `0` if `a == b`"),
 	),
 }
 
@@ -2358,6 +3019,7 @@ var SetDiff = &Builtin{
 		),
 		types.NewSet(types.A),
 	),
+	deprecated: true,
 }
 
 // NetCIDROverlap has been replaced by the `net.cidr_contains` built-in.
@@ -2370,6 +3032,7 @@ var NetCIDROverlap = &Builtin{
 		),
 		types.B,
 	),
+	deprecated: true,
 }
 
 // CastArray checks the underlying type of the input. If it is array or set, an array
@@ -2380,6 +3043,7 @@ var CastArray = &Builtin{
 		types.Args(types.A),
 		types.NewArray(nil, types.A),
 	),
+	deprecated: true,
 }
 
 // CastSet checks the underlying type of the input.
@@ -2392,6 +3056,7 @@ var CastSet = &Builtin{
 		types.Args(types.A),
 		types.NewSet(types.A),
 	),
+	deprecated: true,
 }
 
 // CastString returns input if it is a string; if not returns error.
@@ -2402,6 +3067,7 @@ var CastString = &Builtin{
 		types.Args(types.A),
 		types.S,
 	),
+	deprecated: true,
 }
 
 // CastBoolean returns input if it is a boolean; if not returns error.
@@ -2411,6 +3077,7 @@ var CastBoolean = &Builtin{
 		types.Args(types.A),
 		types.B,
 	),
+	deprecated: true,
 }
 
 // CastNull returns null if input is null; if not returns error.
@@ -2420,6 +3087,7 @@ var CastNull = &Builtin{
 		types.Args(types.A),
 		types.NewNull(),
 	),
+	deprecated: true,
 }
 
 // CastObject returns the given object if it is null; throws an error otherwise
@@ -2429,6 +3097,7 @@ var CastObject = &Builtin{
 		types.Args(types.A),
 		types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)),
 	),
+	deprecated: true,
 }
 
 // RegexMatchDeprecated declares `re_match` which has been deprecated. Use `regex.match` instead.
@@ -2441,15 +3110,72 @@ var RegexMatchDeprecated = &Builtin{
 		),
 		types.B,
 	),
+	deprecated: true,
+}
+
+// All takes a list and returns true if all of the items
+// are true. A collection of length 0 returns true.
+var All = &Builtin{
+	Name: "all",
+	Decl: types.NewFunction(
+		types.Args(
+			types.NewAny(
+				types.NewSet(types.A),
+				types.NewArray(nil, types.A),
+			),
+		),
+		types.B,
+	),
+	deprecated: true,
+}
+
+// Any takes a collection and returns true if any of the items
+// is true. A collection of length 0 returns false.
+var Any = &Builtin{
+	Name: "any",
+	Decl: types.NewFunction(
+		types.Args(
+			types.NewAny(
+				types.NewSet(types.A),
+				types.NewArray(nil, types.A),
+			),
+		),
+		types.B,
+	),
+	deprecated: true,
 }
 
 // Builtin represents a built-in function supported by OPA. Every built-in
 // function is uniquely identified by a name.
 type Builtin struct {
-	Name     string          `json:"name"`               // Unique name of built-in function, e.g., <name>(arg1,arg2,...,argN)
-	Decl     *types.Function `json:"decl"`               // Built-in function type declaration.
-	Infix    string          `json:"infix,omitempty"`    // Unique name of infix operator. Default should be unset.
-	Relation bool            `json:"relation,omitempty"` // Indicates if the built-in acts as a relation.
+	Name        string `json:"name"`                  // Unique name of built-in function, e.g., <name>(arg1,arg2,...,argN)
+	Description string `json:"description,omitempty"` // Description of what the built-in function does.
+
+	// Categories of the built-in function. Omitted for namespaced
+	// built-ins, i.e. "array.concat" is taken to be of the "array" category.
+	// "minus" for example, is part of two categories: numbers and sets. (NOTE(sr): aspirational)
+	Categories []string `json:"categories,omitempty"`
+
+	Decl             *types.Function `json:"decl"`               // Built-in function type declaration.
+	Infix            string          `json:"infix,omitempty"`    // Unique name of infix operator. Default should be unset.
+	Relation         bool            `json:"relation,omitempty"` // Indicates if the built-in acts as a relation.
+	deprecated       bool            // Indicates if the built-in has been deprecated.
+	Nondeterministic bool            `json:"nondeterministic,omitempty"` // Indicates if the built-in returns non-deterministic results.
+}
+
+// category is a helper for specifying a Builtin's Categories
+func category(cs ...string) []string {
+	return cs
+}
+
+// IsDeprecated returns true if the Builtin function is deprecated and will be removed in a future release.
+func (b *Builtin) IsDeprecated() bool {
+	return b.deprecated
+}
+
+// IsDeterministic returns true if the Builtin function returns non-deterministic results.
+func (b *Builtin) IsNondeterministic() bool {
+	return b.Nondeterministic
 }
 
 // Expr creates a new expression for the built-in with the given operands.
diff --git a/ast/capabilities.go b/ast/capabilities.go
index a6b162edf7..217e99c999 100644
--- a/ast/capabilities.go
+++ b/ast/capabilities.go
@@ -5,20 +5,36 @@
 package ast
 
 import (
+	"bytes"
+	"fmt"
 	"io"
+	"os"
 	"sort"
+	"strings"
 
+	caps "github.com/open-policy-agent/opa/capabilities"
 	"github.com/open-policy-agent/opa/internal/wasm/sdk/opa/capabilities"
 	"github.com/open-policy-agent/opa/util"
 )
 
-// Capabilities defines a structure containing data that describes the capablilities
+// In the compiler, we used this to check that we're OK working with ref heads.
+// If this isn't present, we'll fail. This is to ensure that older versions of
+// OPA can work with policies that we're compiling -- if they don't know ref
+// heads, they wouldn't be able to parse them.
+const FeatureRefHeadStringPrefixes = "rule_head_ref_string_prefixes"
+
+// Capabilities defines a structure containing data that describes the capabilities
 // or features supported by a particular version of OPA.
 type Capabilities struct {
 	Builtins        []*Builtin       `json:"builtins"`
 	FutureKeywords  []string         `json:"future_keywords"`
 	WasmABIVersions []WasmABIVersion `json:"wasm_abi_versions"`
 
+	// Features is a bit of a mixed bag for checking that an older version of OPA
+	// is able to do what needs to be done.
+	// TODO(sr): find better words ^^
+	Features []string `json:"features"`
+
 	// allow_net is an array of hostnames or IP addresses, that an OPA instance is
 	// allowed to connect to.
 	// If omitted, ANY host can be connected to. If empty, NO host can be connected to.
@@ -44,7 +60,8 @@ func CapabilitiesForThisVersion() *Capabilities {
 		f.WasmABIVersions = append(f.WasmABIVersions, WasmABIVersion{Version: vers[0], Minor: vers[1]})
 	}
 
-	f.Builtins = append(f.Builtins, Builtins...)
+	f.Builtins = make([]*Builtin, len(Builtins))
+	copy(f.Builtins, Builtins)
 	sort.Slice(f.Builtins, func(i, j int) bool {
 		return f.Builtins[i].Name < f.Builtins[j].Name
 	})
@@ -54,6 +71,10 @@ func CapabilitiesForThisVersion() *Capabilities {
 	}
 	sort.Strings(f.FutureKeywords)
 
+	f.Features = []string{
+		FeatureRefHeadStringPrefixes,
+	}
+
 	return f
 }
 
@@ -63,3 +84,48 @@ func LoadCapabilitiesJSON(r io.Reader) (*Capabilities, error) {
 	var c Capabilities
 	return &c, d.Decode(&c)
 }
+
+// LoadCapabilitiesVersion loads a JSON serialized capabilities structure from the specific version.
+func LoadCapabilitiesVersion(version string) (*Capabilities, error) {
+	cvs, err := LoadCapabilitiesVersions()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, cv := range cvs {
+		if cv == version {
+			cont, err := caps.FS.ReadFile(cv + ".json")
+			if err != nil {
+				return nil, err
+			}
+
+			return LoadCapabilitiesJSON(bytes.NewReader(cont))
+		}
+
+	}
+	return nil, fmt.Errorf("no capabilities version found %v", version)
+}
+
+// LoadCapabilitiesFile loads a JSON serialized capabilities structure from a file.
+func LoadCapabilitiesFile(file string) (*Capabilities, error) {
+	fd, err := os.Open(file)
+	if err != nil {
+		return nil, err
+	}
+	defer fd.Close()
+	return LoadCapabilitiesJSON(fd)
+}
+
+// LoadCapabilitiesVersions loads all capabilities versions
+func LoadCapabilitiesVersions() ([]string, error) {
+	ents, err := caps.FS.ReadDir(".")
+	if err != nil {
+		return nil, err
+	}
+
+	capabilitiesVersions := make([]string, 0, len(ents))
+	for _, ent := range ents {
+		capabilitiesVersions = append(capabilitiesVersions, strings.Replace(ent.Name(), ".json", "", 1))
+	}
+	return capabilitiesVersions, nil
+}
diff --git a/ast/capabilities_test.go b/ast/capabilities_test.go
index 0d4d8377da..d6db51f1a6 100644
--- a/ast/capabilities_test.go
+++ b/ast/capabilities_test.go
@@ -1,7 +1,10 @@
 package ast
 
 import (
+	"path"
 	"testing"
+
+	"github.com/open-policy-agent/opa/util/test"
 )
 
 func TestParserCatchesIllegalCapabilities(t *testing.T) {
@@ -83,3 +86,39 @@ func TestParserCapabilitiesWithWildcardOptInAndOlderOPA(t *testing.T) {
 		t.Fatal("unexpected error:", err)
 	}
 }
+
+func TestLoadCapabilitiesVersion(t *testing.T) {
+
+	capabilitiesVersions, err := LoadCapabilitiesVersions()
+	if err != nil {
+		t.Fatal("expected success", err)
+	}
+
+	if len(capabilitiesVersions) == 0 {
+		t.Fatal("expected a non-empty array of capabilities versions")
+	}
+	for _, cv := range capabilitiesVersions {
+		if _, err := LoadCapabilitiesVersion(cv); err != nil {
+			t.Fatal("expected success", err)
+		}
+	}
+}
+
+func TestLoadCapabilitiesFile(t *testing.T) {
+
+	files := map[string]string{
+		"test-capabilities.json": `
+		{
+			"builtins": []
+		}
+		`,
+	}
+
+	test.WithTempFS(files, func(root string) {
+		_, err := LoadCapabilitiesFile(path.Join(root, "test-capabilities.json"))
+		if err != nil {
+			t.Fatal("expected success", err)
+		}
+	})
+
+}
diff --git a/ast/check.go b/ast/check.go
index 1e0971bc89..a2edbe66fa 100644
--- a/ast/check.go
+++ b/ast/check.go
@@ -136,16 +136,8 @@ func (tc *typeChecker) CheckBody(env *TypeEnv, body Body) (*TypeEnv, Errors) {
 // CheckTypes runs type checking on the rules returns a TypeEnv if no errors
 // are found. The resulting TypeEnv wraps the provided one. The resulting
 // TypeEnv will be able to resolve types of refs that refer to rules.
-func (tc *typeChecker) CheckTypes(env *TypeEnv, sorted []util.T) (*TypeEnv, Errors) {
+func (tc *typeChecker) CheckTypes(env *TypeEnv, sorted []util.T, as *AnnotationSet) (*TypeEnv, Errors) {
 	env = tc.newEnv(env)
-	var as *annotationSet
-	if tc.ss != nil {
-		var errs Errors
-		as, errs = buildAnnotationSet(sorted)
-		if len(errs) > 0 {
-			return env, errs
-		}
-	}
 	for _, s := range sorted {
 		tc.checkRule(env, as, s.(*Rule))
 	}
@@ -181,7 +173,7 @@ func (tc *typeChecker) checkClosures(env *TypeEnv, expr *Expr) Errors {
 	return result
 }
 
-func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
+func (tc *typeChecker) checkRule(env *TypeEnv, as *AnnotationSet, rule *Rule) {
 
 	env = env.wrap()
 
@@ -192,6 +184,9 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
 				tc.err([]*Error{err})
 				continue
 			}
+			if ref == nil && refType == nil {
+				continue
+			}
 			prefixRef, t := getPrefix(env, ref)
 			if t == nil || len(prefixRef) == len(ref) {
 				env.tree.Put(ref, refType)
@@ -208,7 +203,7 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
 
 	cpy, err := tc.CheckBody(env, rule.Body)
 	env = env.next
-	path := rule.Path()
+	path := rule.Ref()
 
 	if len(err) > 0 {
 		// if the rule/function contains an error, add it to the type env so
@@ -221,7 +216,6 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
 	var tpe types.Type
 
 	if len(rule.Head.Args) > 0 {
-
 		// If args are not referred to in body, infer as any.
 		WalkVars(rule.Head.Args, func(v Var) bool {
 			if cpy.Get(v) == nil {
@@ -243,23 +237,28 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
 		tpe = types.Or(exist, f)
 
 	} else {
-		switch rule.Head.DocKind() {
-		case CompleteDoc:
-			typeV := cpy.Get(rule.Head.Value)
-			if typeV != nil {
-				exist := env.tree.Get(path)
-				tpe = types.Or(typeV, exist)
-			}
-		case PartialObjectDoc:
-			typeK := cpy.Get(rule.Head.Key)
+		switch rule.Head.RuleKind() {
+		case SingleValue:
 			typeV := cpy.Get(rule.Head.Value)
-			if typeK != nil && typeV != nil {
-				exist := env.tree.Get(path)
-				typeV = types.Or(types.Values(exist), typeV)
-				typeK = types.Or(types.Keys(exist), typeK)
-				tpe = types.NewObject(nil, types.NewDynamicProperty(typeK, typeV))
+			if last := path[len(path)-1]; !last.IsGround() {
+
+				// e.g. store object[string: whatever] at data.p.q.r, not data.p.q.r[x]
+				path = path.GroundPrefix()
+
+				typeK := cpy.Get(last)
+				if typeK != nil && typeV != nil {
+					exist := env.tree.Get(path)
+					typeV = types.Or(types.Values(exist), typeV)
+					typeK = types.Or(types.Keys(exist), typeK)
+					tpe = types.NewObject(nil, types.NewDynamicProperty(typeK, typeV))
+				}
+			} else {
+				if typeV != nil {
+					exist := env.tree.Get(path)
+					tpe = types.Or(typeV, exist)
+				}
 			}
-		case PartialSetDoc:
+		case MultiValue:
 			typeK := cpy.Get(rule.Head.Key)
 			if typeK != nil {
 				exist := env.tree.Get(path)
@@ -275,6 +274,9 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *annotationSet, rule *Rule) {
 }
 
 func (tc *typeChecker) checkExpr(env *TypeEnv, expr *Expr) *Error {
+	if err := tc.checkExprWith(env, expr, 0); err != nil {
+		return err
+	}
 	if !expr.IsCall() {
 		return nil
 	}
@@ -319,17 +321,19 @@ func (tc *typeChecker) checkExprBuiltin(env *TypeEnv, expr *Expr) *Error {
 	}
 
 	fargs := ftpe.FuncArgs()
+	namedFargs := ftpe.NamedFuncArgs()
 
 	if ftpe.Result() != nil {
 		fargs.Args = append(fargs.Args, ftpe.Result())
+		namedFargs.Args = append(namedFargs.Args, ftpe.NamedResult())
 	}
 
 	if len(args) > len(fargs.Args) && fargs.Variadic == nil {
-		return newArgError(expr.Location, name, "too many arguments", pre, fargs)
+		return newArgError(expr.Location, name, "too many arguments", pre, namedFargs)
 	}
 
 	if len(args) < len(ftpe.FuncArgs().Args) {
-		return newArgError(expr.Location, name, "too few arguments", pre, fargs)
+		return newArgError(expr.Location, name, "too few arguments", pre, namedFargs)
 	}
 
 	for i := range args {
@@ -338,7 +342,7 @@ func (tc *typeChecker) checkExprBuiltin(env *TypeEnv, expr *Expr) *Error {
 			for i := range args {
 				post[i] = env.Get(args[i])
 			}
-			return newArgError(expr.Location, name, "invalid argument(s)", post, fargs)
+			return newArgError(expr.Location, name, "invalid argument(s)", post, namedFargs)
 		}
 	}
 
@@ -373,6 +377,27 @@ func (tc *typeChecker) checkExprEq(env *TypeEnv, expr *Expr) *Error {
 	return nil
 }
 
+func (tc *typeChecker) checkExprWith(env *TypeEnv, expr *Expr, i int) *Error {
+	if i == len(expr.With) {
+		return nil
+	}
+
+	target, value := expr.With[i].Target, expr.With[i].Value
+	targetType, valueType := env.Get(target), env.Get(value)
+
+	if t, ok := targetType.(*types.Function); ok { // built-in function replacement
+		switch v := valueType.(type) {
+		case *types.Function: // ...by function
+			if !unifies(targetType, valueType) {
+				return newArgError(expr.With[i].Loc(), target.Value.(Ref), "arity mismatch", v.Args(), t.NamedFuncArgs())
+			}
+		default: // ... by value, nothing to check
+		}
+	}
+
+	return tc.checkExprWith(env, expr, i+1)
+}
+
 func unify2(env *TypeEnv, a *Term, typeA types.Type, b *Term, typeB types.Type) bool {
 
 	nilA := types.Nil(typeA)
@@ -618,11 +643,11 @@ func (rc *refChecker) Visit(x interface{}) bool {
 }
 
 func (rc *refChecker) checkApply(curr *TypeEnv, ref Ref) *Error {
-	if tpe := curr.Get(ref); tpe != nil {
-		if _, ok := tpe.(*types.Function); ok {
-			return newRefErrUnsupported(ref[0].Location, rc.varRewriter(ref), len(ref)-1, tpe)
-		}
+	switch tpe := curr.Get(ref).(type) {
+	case *types.Function: // NOTE(sr): We don't support first-class functions, except for `with`.
+		return newRefErrUnsupported(ref[0].Location, rc.varRewriter(ref), len(ref)-1, tpe)
 	}
+
 	return nil
 }
 
@@ -634,72 +659,57 @@ func (rc *refChecker) checkRef(curr *TypeEnv, node *typeTreeNode, ref Ref, idx i
 
 	head := ref[idx]
 
-	// Handle constant ref operands, i.e., strings or the ref head.
-	if _, ok := head.Value.(String); ok || idx == 0 {
-
-		child := node.Child(head.Value)
-		if child == nil {
-
-			if curr.next != nil {
-				next := curr.next
-				return rc.checkRef(next, next.tree, ref, 0)
-			}
-
-			if RootDocumentNames.Contains(ref[0]) {
-				return rc.checkRefLeaf(types.A, ref, 1)
-			}
-
-			return rc.checkRefLeaf(types.A, ref, 0)
-		}
-
-		if child.Leaf() {
-			return rc.checkRefLeaf(child.Value(), ref, idx+1)
+	// NOTE(sr): as long as package statements are required, this isn't possible:
+	// the shortest possible rule ref is data.a.b (b is idx 2), idx 1 and 2 need to
+	// be strings or vars.
+	if idx == 1 || idx == 2 {
+		switch head.Value.(type) {
+		case Var, String: // OK
+		default:
+			have := rc.env.Get(head.Value)
+			return newRefErrInvalid(ref[0].Location, rc.varRewriter(ref), idx, have, types.S, getOneOfForNode(node))
 		}
-
-		return rc.checkRef(curr, child, ref, idx+1)
 	}
 
-	// Handle dynamic ref operands.
-	switch value := head.Value.(type) {
-
-	case Var:
-
-		if exist := rc.env.Get(value); exist != nil {
-			if !unifies(types.S, exist) {
-				return newRefErrInvalid(ref[0].Location, rc.varRewriter(ref), idx, exist, types.S, getOneOfForNode(node))
+	if v, ok := head.Value.(Var); ok && idx != 0 {
+		tpe := types.Keys(rc.env.getRefRecExtent(node))
+		if exist := rc.env.Get(v); exist != nil {
+			if !unifies(tpe, exist) {
+				return newRefErrInvalid(ref[0].Location, rc.varRewriter(ref), idx, exist, tpe, getOneOfForNode(node))
 			}
 		} else {
-			rc.env.tree.PutOne(value, types.S)
+			rc.env.tree.PutOne(v, tpe)
 		}
+	}
 
-	case Ref:
+	child := node.Child(head.Value)
+	if child == nil {
+		// NOTE(sr): idx is reset on purpose: we start over
+		switch {
+		case curr.next != nil:
+			next := curr.next
+			return rc.checkRef(next, next.tree, ref, 0)
 
-		exist := rc.env.Get(value)
-		if exist == nil {
-			// If ref type is unknown, an error will already be reported so
-			// stop here.
-			return nil
-		}
+		case RootDocumentNames.Contains(ref[0]):
+			if idx != 0 {
+				node.Children().Iter(func(_, child util.T) bool {
+					_ = rc.checkRef(curr, child.(*typeTreeNode), ref, idx+1) // ignore error
+					return false
+				})
+				return nil
+			}
+			return rc.checkRefLeaf(types.A, ref, 1)
 
-		if !unifies(types.S, exist) {
-			return newRefErrInvalid(ref[0].Location, rc.varRewriter(ref), idx, exist, types.S, getOneOfForNode(node))
+		default:
+			return rc.checkRefLeaf(types.A, ref, 0)
 		}
-
-	// Catch other ref operand types here. Non-leaf nodes must be referred to
-	// with string values.
-	default:
-		return newRefErrInvalid(ref[0].Location, rc.varRewriter(ref), idx, nil, types.S, getOneOfForNode(node))
 	}
 
-	// Run checking on remaining portion of the ref. Note, since the ref
-	// potentially refers to data for which no type information exists,
-	// checking should never fail.
-	node.Children().Iter(func(_, child util.T) bool {
-		_ = rc.checkRef(curr, child.(*typeTreeNode), ref, idx+1) // ignore error
-		return false
-	})
+	if child.Leaf() {
+		return rc.checkRefLeaf(child.Value(), ref, idx+1)
+	}
 
-	return nil
+	return rc.checkRef(curr, child, ref, idx+1)
 }
 
 func (rc *refChecker) checkRefLeaf(tpe types.Type, ref Ref, idx int) *Error {
@@ -805,7 +815,17 @@ func unifies(a, b types.Type) bool {
 		}
 		return unifies(types.Values(a), types.Values(b))
 	case *types.Function:
-		// TODO(tsandall): revisit once functions become first-class values.
+		// NOTE(sr): variadic functions can only be internal ones, and we've forbidden
+		// their replacement via `with`; so we disregard variadic here
+		if types.Arity(a) == types.Arity(b) {
+			b := b.(*types.Function)
+			for i := range a.FuncArgs().Args {
+				if !unifies(a.FuncArgs().Arg(i), b.FuncArgs().Arg(i)) {
+					return false
+				}
+			}
+			return true
+		}
 		return false
 	default:
 		panic("unreachable")
@@ -1170,7 +1190,7 @@ func getObjectType(ref Ref, o types.Type, rule *Rule, d *types.DynamicProperty)
 	return getObjectTypeRec(keys, o, d), nil
 }
 
-func getRuleAnnotation(as *annotationSet, rule *Rule) (result []*SchemaAnnotation) {
+func getRuleAnnotation(as *AnnotationSet, rule *Rule) (result []*SchemaAnnotation) {
 
 	for _, x := range as.GetSubpackagesScope(rule.Module.Package.Path) {
 		result = append(result, x.Schemas...)
@@ -1196,6 +1216,9 @@ func processAnnotation(ss *SchemaSet, annot *SchemaAnnotation, rule *Rule, allow
 	var schema interface{}
 
 	if annot.Schema != nil {
+		if ss == nil {
+			return nil, nil, nil
+		}
 		schema = ss.Get(annot.Schema)
 		if schema == nil {
 			return nil, nil, NewError(TypeErr, rule.Location, "undefined schema: %v", annot.Schema)
@@ -1215,158 +1238,3 @@ func processAnnotation(ss *SchemaSet, annot *SchemaAnnotation, rule *Rule, allow
 func errAnnotationRedeclared(a *Annotations, other *Location) *Error {
 	return NewError(TypeErr, a.Location, "%v annotation redeclared: %v", a.Scope, other)
 }
-
-type annotationSet struct {
-	byRule    map[*Rule][]*Annotations
-	byPackage map[*Package]*Annotations
-	byPath    *annotationTreeNode
-}
-
-func buildAnnotationSet(rules []util.T) (*annotationSet, Errors) {
-	as := newAnnotationSet()
-	processed := map[*Module]struct{}{}
-	var errs Errors
-	for _, x := range rules {
-		module := x.(*Rule).Module
-		if _, ok := processed[module]; ok {
-			continue
-		}
-		processed[module] = struct{}{}
-		for _, a := range module.Annotations {
-			if err := as.Add(a); err != nil {
-				errs = append(errs, err)
-			}
-		}
-	}
-	if len(errs) > 0 {
-		return nil, errs
-	}
-	return as, nil
-}
-
-func newAnnotationSet() *annotationSet {
-	return &annotationSet{
-		byRule:    map[*Rule][]*Annotations{},
-		byPackage: map[*Package]*Annotations{},
-		byPath:    newAnnotationTree(),
-	}
-}
-
-func (as *annotationSet) Add(a *Annotations) *Error {
-	switch a.Scope {
-	case annotationScopeRule:
-		rule := a.node.(*Rule)
-		as.byRule[rule] = append(as.byRule[rule], a)
-	case annotationScopePackage:
-		pkg := a.node.(*Package)
-		if exist, ok := as.byPackage[pkg]; ok {
-			return errAnnotationRedeclared(a, exist.Location)
-		}
-		as.byPackage[pkg] = a
-	case annotationScopeDocument:
-		rule := a.node.(*Rule)
-		path := rule.Path()
-		x := as.byPath.Get(path)
-		if x != nil {
-			return errAnnotationRedeclared(a, x.Value.Location)
-		}
-		as.byPath.Insert(path, a)
-	case annotationScopeSubpackages:
-		pkg := a.node.(*Package)
-		x := as.byPath.Get(pkg.Path)
-		if x != nil {
-			return errAnnotationRedeclared(a, x.Value.Location)
-		}
-		as.byPath.Insert(pkg.Path, a)
-	}
-	return nil
-}
-
-func (as *annotationSet) GetRuleScope(r *Rule) []*Annotations {
-	if as == nil {
-		return nil
-	}
-	return as.byRule[r]
-}
-
-func (as *annotationSet) GetSubpackagesScope(path Ref) []*Annotations {
-	if as == nil {
-		return nil
-	}
-	return as.byPath.Ancestors(path)
-}
-
-func (as *annotationSet) GetDocumentScope(path Ref) *Annotations {
-	if as == nil {
-		return nil
-	}
-	if node := as.byPath.Get(path); node != nil {
-		return node.Value
-	}
-	return nil
-}
-
-func (as *annotationSet) GetPackageScope(pkg *Package) *Annotations {
-	if as == nil {
-		return nil
-	}
-	return as.byPackage[pkg]
-}
-
-type annotationTreeNode struct {
-	Value    *Annotations
-	Children map[Value]*annotationTreeNode // we assume key elements are hashable (vars and strings only!)
-}
-
-func newAnnotationTree() *annotationTreeNode {
-	return &annotationTreeNode{
-		Value:    nil,
-		Children: map[Value]*annotationTreeNode{},
-	}
-}
-
-func (t *annotationTreeNode) Insert(path Ref, value *Annotations) {
-	node := t
-	for _, k := range path {
-		child, ok := node.Children[k.Value]
-		if !ok {
-			child = newAnnotationTree()
-			node.Children[k.Value] = child
-		}
-		node = child
-	}
-	node.Value = value
-}
-
-func (t *annotationTreeNode) Get(path Ref) *annotationTreeNode {
-	node := t
-	for _, k := range path {
-		if node == nil {
-			return nil
-		}
-		child, ok := node.Children[k.Value]
-		if !ok {
-			return nil
-		}
-		node = child
-	}
-	return node
-}
-
-func (t *annotationTreeNode) Ancestors(path Ref) (result []*Annotations) {
-	node := t
-	for _, k := range path {
-		if node == nil {
-			return result
-		}
-		child, ok := node.Children[k.Value]
-		if !ok {
-			return result
-		}
-		if child.Value != nil {
-			result = append(result, child.Value)
-		}
-		node = child
-	}
-	return result
-}
diff --git a/ast/check_test.go b/ast/check_test.go
index 8b309d09ce..ea01767067 100644
--- a/ast/check_test.go
+++ b/ast/check_test.go
@@ -7,6 +7,8 @@ package ast
 import (
 	"encoding/json"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"strings"
 	"testing"
@@ -344,6 +346,12 @@ func TestCheckInferenceRules(t *testing.T) {
 		{`number_key`, `q[x] = y { a = ["a", "b"]; y = a[x] }`},
 		{`non_leaf`, `p[x] { data.prefix.i[x][_] }`},
 	}
+	ruleset2 := [][2]string{
+		{`ref_rule_single`, `p.q.r { true }`},
+		{`ref_rule_single_with_number_key`, `p.q[3] { true }`},
+		{`ref_regression_array_key`,
+			`walker[[p, v]] = o { l = input; walk(l, k); [p, v] = k; o = {} }`},
+	}
 
 	tests := []struct {
 		note     string
@@ -465,6 +473,37 @@ func TestCheckInferenceRules(t *testing.T) {
 		{"non-leaf", ruleset1, "data.non_leaf.p", types.NewSet(
 			types.S,
 		)},
+
+		{"ref-rules single value, full ref", ruleset2, "data.ref_rule_single.p.q.r", types.B},
+		{"ref-rules single value, prefix", ruleset2, "data.ref_rule_single.p",
+			types.NewObject(
+				[]*types.StaticProperty{{
+					Key: "q", Value: types.NewObject(
+						[]*types.StaticProperty{{Key: "r", Value: types.B}},
+						types.NewDynamicProperty(types.S, types.A),
+					),
+				}},
+				types.NewDynamicProperty(types.S, types.A),
+			)},
+
+		{"ref-rules single value, number key, full ref", ruleset2, "data.ref_rule_single_with_number_key.p.q[3]", types.B},
+		{"ref-rules single value, number key, prefix", ruleset2, "data.ref_rule_single_with_number_key.p",
+			types.NewObject(
+				[]*types.StaticProperty{{
+					Key: "q", Value: types.NewObject(
+						[]*types.StaticProperty{{Key: json.Number("3"), Value: types.B}},
+						types.NewDynamicProperty(types.S, types.A),
+					),
+				}},
+				types.NewDynamicProperty(types.S, types.A),
+			)},
+
+		{"ref_regression_array_key", ruleset2, "data.ref_regression_array_key.walker",
+			types.NewObject(
+				nil,
+				types.NewDynamicProperty(types.NewArray([]types.Type{types.NewArray(types.A, types.A), types.A}, nil),
+					types.NewObject(nil, types.NewDynamicProperty(types.A, types.A))),
+			)},
 	}
 
 	for _, tc := range tests {
@@ -489,7 +528,7 @@ func TestCheckInferenceRules(t *testing.T) {
 
 			ref := MustParseRef(tc.ref)
 			checker := newTypeChecker()
-			env, err := checker.CheckTypes(nil, elems)
+			env, err := checker.CheckTypes(newTypeChecker().Env(map[string]*Builtin{"walk": BuiltinMap["walk"]}), elems, nil)
 
 			if err != nil {
 				t.Fatalf("Unexpected error %v:", err)
@@ -512,6 +551,87 @@ func TestCheckInferenceRules(t *testing.T) {
 
 }
 
+func TestCheckInferenceOverlapWithRules(t *testing.T) {
+	ruleset1 := [][2]string{
+		{`prefix.i.j.k`, `p = 1 { true }`},
+		{`prefix.i.j.k`, `p = "foo" { true }`},
+	}
+	tests := []struct {
+		note     string
+		rules    [][2]string
+		ref      string
+		expected types.Type // ref's type
+		query    string
+		extra    map[Var]types.Type
+	}{
+		{
+			note:     "non-leaf, extra vars",
+			rules:    ruleset1,
+			ref:      "data.prefix.i.j[k]",
+			expected: types.A,
+			query:    "data.prefix.i.j[k][b]",
+			extra: map[Var]types.Type{
+				Var("k"): types.S,
+				Var("b"): types.S,
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			var elems []util.T
+
+			// Convert test rules into rule slice for "warmup" call.
+			for i := range tc.rules {
+				pkg := MustParsePackage(`package ` + tc.rules[i][0])
+				rule := MustParseRule(tc.rules[i][1])
+				module := &Module{
+					Package: pkg,
+					Rules:   []*Rule{rule},
+				}
+				rule.Module = module
+				elems = append(elems, rule)
+				for next := rule.Else; next != nil; next = next.Else {
+					next.Module = module
+					elems = append(elems, next)
+				}
+			}
+
+			ref := MustParseRef(tc.ref)
+			checker := newTypeChecker()
+			env, err := checker.CheckTypes(nil, elems, nil)
+			if err != nil {
+				t.Fatalf("Unexpected error %v:", err)
+			}
+
+			result := env.Get(ref)
+			if tc.expected == nil {
+				if result != nil {
+					t.Errorf("Expected %v type to be unset but got: %v", ref, result)
+				}
+			} else {
+				if result == nil {
+					t.Errorf("Expected to infer %v => %v but got nil", ref, tc.expected)
+				} else if types.Compare(tc.expected, result) != 0 {
+					t.Errorf("Expected to infer %v => %v but got %v", ref, tc.expected, result)
+				}
+			}
+
+			body := MustParseBody(tc.query)
+			env, err = checker.CheckBody(env, body)
+			if len(err) != 0 {
+				t.Fatalf("Unexpected error: %v", err)
+			}
+			for ex, exp := range tc.extra {
+				act := env.Get(ex)
+				if types.Compare(act, exp) != 0 {
+					t.Errorf("Expected to infer extra %v => %v but got %v", ex, exp, act)
+				}
+			}
+		})
+	}
+}
+
 func TestCheckErrorSuppression(t *testing.T) {
 
 	query := `arr = [1,2,3]; arr[0].deadbeef = 1`
@@ -642,7 +762,7 @@ func TestCheckBuiltinErrors(t *testing.T) {
 		{"objects-any", `fake_builtin_2({"a": a, "c": c})`},
 		{"objects-bad-input", `sum({"a": 1, "b": 2}, x)`},
 		{"sets-any", `sum({1,2,"3",4}, x)`},
-		{"virtual-ref", `plus(data.test.p, data.deabeef, 0)`},
+		{"virtual-ref", `plus(data.test.p, data.coffee, 0)`},
 	}
 
 	env := newTestEnv([]string{
@@ -781,6 +901,7 @@ func TestCheckRefErrInvalid(t *testing.T) {
 	env := newTestEnv([]string{
 		`p { true }`,
 		`q = {"foo": 1, "bar": 2} { true }`,
+		`a.b.c[3] = x { x = {"x": {"y": 2}} }`,
 	})
 
 	tests := []struct {
@@ -799,7 +920,7 @@ func TestCheckRefErrInvalid(t *testing.T) {
 			pos:   2,
 			have:  types.N,
 			want:  types.S,
-			oneOf: []Value{String("p"), String("q")},
+			oneOf: []Value{String("a"), String("p"), String("q")},
 		},
 		{
 			note:  "bad non-leaf ref",
@@ -808,7 +929,7 @@ func TestCheckRefErrInvalid(t *testing.T) {
 			pos:   2,
 			have:  types.N,
 			want:  types.S,
-			oneOf: []Value{String("p"), String("q")},
+			oneOf: []Value{String("a"), String("p"), String("q")},
 		},
 		{
 			note:  "bad leaf ref",
@@ -819,6 +940,24 @@ func TestCheckRefErrInvalid(t *testing.T) {
 			want:  types.S,
 			oneOf: []Value{String("bar"), String("foo")},
 		},
+		{
+			note:  "bad ref hitting last term",
+			query: `x = true; data.test.a.b.c[x][_]`,
+			ref:   `data.test.a.b.c[x][_]`,
+			pos:   5,
+			have:  types.B,
+			want:  types.Any{types.N, types.S},
+			oneOf: []Value{Number("3")},
+		},
+		{
+			note:  "bad ref hitting dynamic part",
+			query: `s = true; data.test.a.b.c[3].x[s][_] = _`,
+			ref:   `data.test.a.b.c[3].x[s][_]`,
+			pos:   7,
+			have:  types.B,
+			want:  types.S,
+			oneOf: []Value{String("y")},
+		},
 		{
 			note:  "bad leaf var",
 			query: `x = 1; data.test.q[x]`,
@@ -851,12 +990,25 @@ func TestCheckRefErrInvalid(t *testing.T) {
 			oneOf: []Value{String("a"), String("c")},
 		},
 		{
+			// NOTE(sr): Thins one and the next are special: it cannot work with ref heads, either, since we need at
+			// least ONE string term after data.test: a module needs a package line, and the shortest head ref
+			// possible is thus data.x.y.
 			note:  "bad non-leaf value",
 			query: `data.test[1]`,
 			ref:   "data.test[1]",
 			pos:   2,
+			have:  types.N,
 			want:  types.S,
-			oneOf: []Value{String("p"), String("q")},
+			oneOf: []Value{String("a"), String("p"), String("q")},
+		},
+		{
+			note:  "bad non-leaf value (package)", // See note above ^^
+			query: `data[1]`,
+			ref:   "data[1]",
+			pos:   1,
+			have:  types.N,
+			want:  types.S,
+			oneOf: []Value{String("test")},
 		},
 		{
 			note:  "composite ref operand",
@@ -1020,9 +1172,11 @@ func TestFunctionTypeInferenceUnappliedWithObjectVarKey(t *testing.T) {
 		f(x) = y { y = {x: 1} }
 	`)
 
-	env, err := newTypeChecker().CheckTypes(newTypeChecker().Env(BuiltinMap), []util.T{
+	elems := []util.T{
 		module.Rules[0],
-	})
+	}
+
+	env, err := newTypeChecker().CheckTypes(newTypeChecker().Env(BuiltinMap), elems, nil)
 
 	if len(err) > 0 {
 		t.Fatal(err)
@@ -1218,8 +1372,8 @@ func TestCheckErrorOrdering(t *testing.T) {
 	inputReversed[1] = inputReversed[2]
 	inputReversed[2] = tmp
 
-	_, errs1 := newTypeChecker().CheckTypes(nil, input)
-	_, errs2 := newTypeChecker().CheckTypes(nil, inputReversed)
+	_, errs1 := newTypeChecker().CheckTypes(nil, input, nil)
+	_, errs2 := newTypeChecker().CheckTypes(nil, inputReversed, nil)
 
 	if errs1.Error() != errs2.Error() {
 		t.Fatalf("Expected error slices to be equal. errs1:\n\n%v\n\nerrs2:\n\n%v\n\n", errs1, errs2)
@@ -1253,7 +1407,9 @@ func newTestEnv(rs []string) *TypeEnv {
 		package test
 	`)
 
-	var elems []util.T
+	// We preallocate enough for at least the base rules.
+	// Else cases will cause reallocs, but that's okay.
+	elems := make([]util.T, 0, len(rs))
 
 	for i := range rs {
 		rule := MustParseRule(rs[i])
@@ -1265,7 +1421,7 @@ func newTestEnv(rs []string) *TypeEnv {
 		}
 	}
 
-	env, err := newTypeChecker().CheckTypes(newTypeChecker().Env(BuiltinMap), elems)
+	env, err := newTypeChecker().CheckTypes(newTypeChecker().Env(BuiltinMap), elems, nil)
 	if len(err) > 0 {
 		panic(err)
 	}
@@ -1818,39 +1974,39 @@ whocan[user] {
 	schemaSet.Put(MustParseRef(`schema["acl-schema"]`), dschema)
 
 	tests := []struct {
-		note   string
-		module string
-		err    string
+		note    string
+		modules []string
+		err     string
 	}{
-		{note: "data and input annotations", module: module1},
-		{note: "correct data override", module: module2},
-		{note: "incorrect data override", module: module3, err: "undefined ref: input.user"},
-		{note: "missing schema", module: module4, err: "undefined schema: schema.missing"},
-		{note: "overriding ref with length greater than one and not existing", module: module8, err: "undefined ref: input.apple.banana"},
-		{note: "overriding ref with length greater than one and existing prefix", module: module9},
-		{note: "overriding ref with length greater than one and existing prefix with type error", module: module10, err: "undefined ref: input.apple.orange.banana.fruit"},
-		{note: "overriding ref with length greater than one and existing ref", module: module11, err: "undefined ref: input.apple.orange.user"},
-		{note: "overriding ref of size one", module: module12, err: "undefined ref: input.user"},
-		{note: "overriding annotation written with brackets", module: module13, err: "undefined ref: input.apple.orange.fruit"},
-		{note: "overriding strict", module: module14, err: "undefined ref: input.request.object.spec.typo"},
-		{note: "data annotation but no input schema", module: module15},
-		{note: "data schema annotation does not overly restrict data expression", module: module16},
-		{note: "correct defer annotation on another rule has no effect base case", module: module17},
-		{note: "correct defer annotation on another rule has no effect", module: module18},
-		{note: "overriding ref with data prefix", module: module19, err: "data.acl.foo.blah"},
-		{note: "data annotation type error", module: module20, err: "data.acl.foo"},
-		{note: "more than one rule with metadata", module: module21},
-		{note: "more than one rule with metadata with type error", module: module22, err: "undefined ref"},
-		{note: "document scope", err: "test.rego:8: rego_type_error: match error", module: `package test
+		{note: "data and input annotations", modules: []string{module1}},
+		{note: "correct data override", modules: []string{module2}},
+		{note: "incorrect data override", modules: []string{module3}, err: "undefined ref: input.user"},
+		{note: "missing schema", modules: []string{module4}, err: "undefined schema: schema.missing"},
+		{note: "overriding ref with length greater than one and not existing", modules: []string{module8}, err: "undefined ref: input.apple.banana"},
+		{note: "overriding ref with length greater than one and existing prefix", modules: []string{module9}},
+		{note: "overriding ref with length greater than one and existing prefix with type error", modules: []string{module10}, err: "undefined ref: input.apple.orange.banana.fruit"},
+		{note: "overriding ref with length greater than one and existing ref", modules: []string{module11}, err: "undefined ref: input.apple.orange.user"},
+		{note: "overriding ref of size one", modules: []string{module12}, err: "undefined ref: input.user"},
+		{note: "overriding annotation written with brackets", modules: []string{module13}, err: "undefined ref: input.apple.orange.fruit"},
+		{note: "overriding strict", modules: []string{module14}, err: "undefined ref: input.request.object.spec.typo"},
+		{note: "data annotation but no input schema", modules: []string{module15}},
+		{note: "data schema annotation does not overly restrict data expression", modules: []string{module16}},
+		{note: "correct defer annotation on another rule has no effect base case", modules: []string{module17}},
+		{note: "correct defer annotation on another rule has no effect", modules: []string{module18}},
+		{note: "overriding ref with data prefix", modules: []string{module19}, err: "data.acl.foo.blah"},
+		{note: "data annotation type error", modules: []string{module20}, err: "data.acl.foo"},
+		{note: "more than one rule with metadata", modules: []string{module21}},
+		{note: "more than one rule with metadata with type error", modules: []string{module22}, err: "undefined ref"},
+		{note: "document scope", err: "test1.rego:8: rego_type_error: match error", modules: []string{`package test
 # METADATA
 # scope: document
 # schemas:
 # - input.foo: schema.number
 p { input.foo = 7 }
 
-p { input.foo = [] }`},
+p { input.foo = [] }`}},
 
-		{note: "rule scope overrides document scope", module: `package test
+		{note: "rule scope overrides document scope", modules: []string{`package test
 
 # METADATA
 # scope: document
@@ -1862,9 +2018,9 @@ p { input.foo = 7 }
 # scope: rule
 # schemas:
 # - input.foo: schema.string
-p { input.foo = "str" }`},
+p { input.foo = "str" }`}},
 
-		{note: "rule scope merges with document scope", err: "test.rego:15: rego_type_error: match error", module: `package test
+		{note: "rule scope merges with document scope", err: "test1.rego:15: rego_type_error: match error", modules: []string{`package test
 
 # METADATA
 # scope: document
@@ -1879,9 +2035,9 @@ p { input.bar = 7 }
 p {
 	input.foo = "str"
 	input.bar = "str"
-}`},
+}`}},
 
-		{note: "document scope conflict", err: "test.rego:9: rego_type_error: document annotation redeclared: test.rego:3", module: `package test
+		{note: "document scope conflict", err: "test1.rego:9: rego_type_error: document annotation redeclared: test1.rego:3", modules: []string{`package test
 
 # METADATA
 # scope: document
@@ -1893,17 +2049,45 @@ p { input.foo = 7 }
 # scope: document
 # schemas:
 # - input.foo: schema.string
-p { input.foo = "str" }`},
+p { input.foo = "str" }`}},
+
+		{note: "package scope in other module", modules: []string{`# METADATA
+# scope: package
+# schemas:
+# - input.foo: schema.number
+package test`, `package test
+
+p { input.foo = 7 }`}},
 
-		{note: "subpackages scope", err: "test.rego:7: rego_type_error: match error", module: `# METADATA
+		{note: "package scope in other module type conflict", err: "test2.rego:3: rego_type_error: match error", modules: []string{`# METADATA
+# scope: package
+# schemas:
+# - input.foo: schema.string
+package test`, `package test
+
+p { input.foo = 7 }`}},
+
+		{note: "package scope conflict", err: "test2.rego:1: rego_type_error: package annotation redeclared: test1.rego:1", modules: []string{`# METADATA
+# scope: package
+# schemas:
+# - input.foo: schema.string
+package test`, `# METADATA
+# scope: package
+# schemas:
+# - input.foo: schema.number
+package test
+
+p { input.foo = 7 }`}},
+
+		{note: "subpackages scope", err: "test1.rego:7: rego_type_error: match error", modules: []string{`# METADATA
 # scope: subpackages
 # schemas:
 # - input: schema.number
 package test
 
-p { input = "str" }`},
+p { input = "str" }`}},
 
-		{note: "document scope overrides subpackages scope", module: `# METADATA
+		{note: "document scope overrides subpackages scope", modules: []string{`# METADATA
 # scope: subpackages
 # schemas:
 # - input: schema.number
@@ -1913,9 +2097,9 @@ package test
 # scope: document
 # schemas:
 # - input: schema.string
-p { input = "str" }`},
+p { input = "str" }`}},
 
-		{note: "document scope overrides subpackages scope and finds error", err: "test.rego:11: rego_type_error: match error", module: `# METADATA
+		{note: "document scope overrides subpackages scope and finds error", err: "test1.rego:11: rego_type_error: match error", modules: []string{`# METADATA
 # scope: subpackages
 # schemas:
 # - input: schema.string
@@ -1925,17 +2109,17 @@ package test
 # scope: rule
 # schemas:
 # - input: schema.number
-p { input = "str" }`},
+p { input = "str" }`}},
 
-		{note: "package scope", err: "test.rego:7: rego_type_error: match error", module: `# METADATA
+		{note: "package scope", err: "test1.rego:7: rego_type_error: match error", modules: []string{`# METADATA
 # scope: package
 # schemas:
 # - input: schema.string
 package test
 
-p { input = 7 }`},
+p { input = 7 }`}},
 
-		{note: "rule scope overrides package scope", module: `# METADATA
+		{note: "rule scope overrides package scope", modules: []string{`# METADATA
 # scope: package
 # schemas:
 # - input: schema.string
@@ -1945,16 +2129,16 @@ package test
 # scope: rule
 # schemas:
 # - input: schema.number
-p { input = 7 }`},
+p { input = 7 }`}},
 
-		{note: "inline definition", err: "test.rego:7: rego_type_error: match error", module: `package test
+		{note: "inline definition", err: "test1.rego:7: rego_type_error: match error", modules: []string{`package test
 
 # METADATA
 # scope: rule
 # schemas:
 # - input: {"type": "string"}
-p { input = 7 }`},
-		{note: "document scope is unordered", err: "test.rego:3: rego_type_error: match error", module: `package test
+p { input = 7 }`}},
+		{note: "document scope is unordered", err: "test1.rego:3: rego_type_error: match error", modules: []string{`package test
 
 p { input = 7 }
 
@@ -1962,28 +2146,35 @@ p { input = 7 }
 # scope: document
 # schemas:
 # - input: schema.string
-p { input = "foo" }`},
+p { input = "foo" }`}},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-			mod, err := ParseModuleWithOpts("test.rego", tc.module, ParserOptions{
-				ProcessAnnotation: true,
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
-
+			var modules []*Module
 			var elems []util.T
-			for _, rule := range mod.Rules {
-				elems = append(elems, rule)
-				for next := rule.Else; next != nil; next = next.Else {
-					elems = append(elems, next)
+
+			for i, module := range tc.modules {
+				mod, err := ParseModuleWithOpts(fmt.Sprintf("test%d.rego", i+1), module, ParserOptions{
+					ProcessAnnotation: true,
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				modules = append(modules, mod)
+
+				for _, rule := range mod.Rules {
+					elems = append(elems, rule)
+					for next := rule.Else; next != nil; next = next.Else {
+						elems = append(elems, next)
+					}
 				}
 			}
 
 			oldTypeEnv := newTypeChecker().WithSchemaSet(schemaSet).Env(BuiltinMap)
-			typeenv, errors := newTypeChecker().WithSchemaSet(schemaSet).CheckTypes(oldTypeEnv, elems)
+			as, errors := BuildAnnotationSet(modules)
+			typeenv, checkErrors := newTypeChecker().WithSchemaSet(schemaSet).CheckTypes(oldTypeEnv, elems, as)
+			errors = append(errors, checkErrors...)
 			if len(errors) > 0 {
 				for _, e := range errors {
 					if tc.err == "" || !strings.Contains(e.Error(), tc.err) {
@@ -2059,7 +2250,9 @@ q = p`,
 					ss.Put(ref, schema)
 				}
 
-				compiler := NewCompiler().WithSchemas(ss)
+				compiler := NewCompiler().
+					WithSchemas(ss).
+					WithUseTypeCheckAnnotations(true)
 				compiler.Compile(modules)
 				if compiler.Failed() {
 					t.Fatal("unexpected error:", compiler.Errors)
@@ -2078,3 +2271,98 @@ q = p`,
 	}
 
 }
+
+func TestRemoteSchema(t *testing.T) {
+	schema := `{"type": "boolean"}`
+
+	schemaCalled := false
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		schemaCalled = true
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(schema))
+	}))
+	defer server.Close()
+
+	policy := fmt.Sprintf(`
+package test
+
+# METADATA
+# schemas:
+# - input: {$ref: "%s"}
+p {
+	input == 42
+}`, server.URL)
+
+	module, err := ParseModuleWithOpts("policy.rego", policy, ParserOptions{ProcessAnnotation: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	modules := map[string]*Module{"policy.rego": module}
+
+	compiler := NewCompiler().
+		WithUseTypeCheckAnnotations(true)
+	compiler.Compile(modules)
+
+	if !compiler.Failed() {
+		t.Fatal("expected error, got none")
+	}
+
+	expectedTypeError := "rego_type_error: match error"
+	if !strings.Contains(compiler.Errors.Error(), expectedTypeError) {
+		t.Fatalf("expected error:\n\n%s\n\ngot:\n\n%s",
+			expectedTypeError, compiler.Errors.Error())
+	}
+
+	if !schemaCalled {
+		t.Fatal("expected schema server to be called, was not")
+	}
+}
+
+func TestRemoteSchemaHostNotAllowed(t *testing.T) {
+	capabilities := CapabilitiesForThisVersion()
+	capabilities.AllowNet = []string{}
+	schema := `{"type": "boolean"}`
+
+	schemaCalled := false
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		schemaCalled = true
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(schema))
+	}))
+	defer server.Close()
+
+	policy := fmt.Sprintf(`
+package test
+
+# METADATA
+# schemas:
+# - input: {$ref: "%s"}
+p {
+	input == 42
+}`, server.URL)
+
+	module, err := ParseModuleWithOpts("policy.rego", policy, ParserOptions{ProcessAnnotation: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	modules := map[string]*Module{"policy.rego": module}
+
+	compiler := NewCompiler().
+		WithUseTypeCheckAnnotations(true).
+		WithCapabilities(capabilities)
+	compiler.Compile(modules)
+
+	if !compiler.Failed() {
+		t.Fatal("expected error, got none")
+	}
+
+	expectedTypeError := "rego_type_error: unable to compile the schema: remote reference loading disabled"
+	if !strings.Contains(compiler.Errors.Error(), expectedTypeError) {
+		t.Fatalf("expected error:\n\n%s\n\ngot:\n\n%s",
+			expectedTypeError, compiler.Errors.Error())
+	}
+
+	if schemaCalled {
+		t.Fatal("expected schema server to not be called, was")
+	}
+}
diff --git a/ast/compare.go b/ast/compare.go
index 685082da63..3bb6f2a75d 100644
--- a/ast/compare.go
+++ b/ast/compare.go
@@ -165,7 +165,12 @@ func Compare(a, b interface{}) int {
 	case *Array:
 		b := b.(*Array)
 		return termSliceCompare(a.elems, b.elems)
+	case *lazyObj:
+		return Compare(a.force(), b)
 	case *object:
+		if x, ok := b.(*lazyObj); ok {
+			b = x.force()
+		}
 		b := b.(*object)
 		return a.Compare(b)
 	case Set:
@@ -201,6 +206,9 @@ func Compare(a, b interface{}) int {
 	case *SomeDecl:
 		b := b.(*SomeDecl)
 		return a.Compare(b)
+	case *Every:
+		b := b.(*Every)
+		return a.Compare(b)
 	case *With:
 		b := b.(*With)
 		return a.Compare(b)
@@ -272,6 +280,8 @@ func sortOrder(x interface{}) int {
 		return 100
 	case *SomeDecl:
 		return 101
+	case *Every:
+		return 102
 	case *With:
 		return 110
 	case *Head:
diff --git a/ast/compare_test.go b/ast/compare_test.go
index 7f30d58ad5..daa2683bbb 100644
--- a/ast/compare_test.go
+++ b/ast/compare_test.go
@@ -325,6 +325,445 @@ func TestCompareAnnotations(t *testing.T) {
 # - input: {"type": "string"}`,
 			exp: 1,
 		},
+		{
+			note: "title",
+			a: `
+# METADATA
+# title: a`,
+			b: `
+# METADATA
+# title: a`,
+			exp: 0,
+		},
+		{
+			note: "title - less than",
+			a: `
+# METADATA
+# title: a`,
+			b: `
+# METADATA
+# title: b`,
+			exp: -1,
+		},
+		{
+			note: "title - greater than",
+			a: `
+# METADATA
+# title: b`,
+			b: `
+# METADATA
+# title: a`,
+			exp: 1,
+		},
+		{
+			note: "description",
+			a: `
+# METADATA
+# description: a`,
+			b: `
+# METADATA
+# description: a`,
+			exp: 0,
+		},
+		{
+			note: "description - less than",
+			a: `
+# METADATA
+# description: a`,
+			b: `
+# METADATA
+# description: b`,
+			exp: -1,
+		},
+		{
+			note: "description - greater than",
+			a: `
+# METADATA
+# description: b`,
+			b: `
+# METADATA
+# description: a`,
+			exp: 1,
+		},
+		{
+			note: "authors",
+			a: `
+# METADATA
+# authors: 
+# - John Doe
+# - Jane Doe`,
+			b: `
+# METADATA
+# authors: 
+# - John Doe
+# - Jane Doe`,
+			exp: 0,
+		},
+		{
+			note: "authors - less than",
+			a: `
+# METADATA
+# authors: 
+# - Jane Doe
+# - John Doe
+`,
+			b: `
+# METADATA
+# authors: 
+# - John Doe
+# - Jane Doe`,
+			exp: -1,
+		},
+		{
+			note: "authors - greater than",
+			a: `
+# METADATA
+# authors: 
+# - John Doe
+# - Jane Doe`,
+			b: `
+# METADATA
+# authors: 
+# - Jane Doe
+# - John Doe`,
+			exp: 1,
+		},
+		{
+			note: "authors - less than (fewer)",
+			a: `
+# METADATA
+# scope: rule
+# authors:
+# - John Doe`,
+			b: `
+# METADATA
+# scope: rule
+# authors:
+# - John Doe
+# - Jane Doe`,
+			exp: -1,
+		},
+		{
+			note: "authors - greater than (more)",
+			a: `
+# METADATA
+# scope: rule
+# authors:
+# - John Doe
+# - Jane Doe`,
+			b: `
+# METADATA
+# scope: rule
+# authors:
+# - John Doe`,
+			exp: 1,
+		},
+		{
+			note: "authors - less than (email)",
+			a: `
+# METADATA
+# authors: 
+# - John Doe <a@example.com>`,
+			b: `
+# METADATA
+# authors: 
+# - John Doe <b@example.com>`,
+			exp: -1,
+		},
+		{
+			note: "authors - greater than (email)",
+			a: `
+# METADATA
+# authors: 
+# - John Doe <b@example.com>`,
+			b: `
+# METADATA
+# authors: 
+# - John Doe <a@example.com>`,
+			exp: 1,
+		},
+		{
+			note: "organizations",
+			a: `
+# METADATA
+# organizations: 
+# - a
+# - b`,
+			b: `
+# METADATA
+# organizations: 
+# - a
+# - b`,
+			exp: 0,
+		},
+		{
+			note: "organizations - less than",
+			a: `
+# METADATA
+# organizations: 
+# - a
+# - b`,
+			b: `
+# METADATA
+# organizations: 
+# - c
+# - d`,
+			exp: -1,
+		},
+		{
+			note: "organizations - greater than",
+			a: `
+# METADATA
+# organizations: 
+# - c
+# - d`,
+			b: `
+# METADATA
+# organizations: 
+# - a
+# - b`,
+			exp: 1,
+		},
+		{
+			note: "organizations - less than (fewer)",
+			a: `
+# METADATA
+# scope: rule
+# organizations:
+# - a`,
+			b: `
+# METADATA
+# scope: rule
+# organizations:
+# - a
+# - b`,
+			exp: -1,
+		},
+		{
+			note: "organizations - greater than (more)",
+			a: `
+# METADATA
+# scope: rule
+# organizations:
+# - a
+# - b`,
+			b: `
+# METADATA
+# scope: rule
+# organizations:
+# - a`,
+			exp: 1,
+		},
+		{
+			note: "related_resources",
+			a: `
+# METADATA
+# related_resources: 
+# - https://a.example.com
+# - 
+#  ref: https://b.example.com
+#  description: foo bar`,
+			b: `
+# METADATA
+# related_resources: 
+# - https://a.example.com
+# - 
+#  ref: https://b.example.com
+#  description: foo bar`,
+			exp: 0,
+		},
+		{
+			note: "related_resources - less than",
+			a: `
+# METADATA
+# related_resources: 
+# - https://a.example.com
+# - https://b.example.com`,
+			b: `
+# METADATA
+# related_resources: 
+# - https://b.example.com
+# - https://c.example.com`,
+			exp: -1,
+		},
+		{
+			note: "related_resources - greater than",
+			a: `
+# METADATA
+# related_resources: 
+# - https://b.example.com
+# - https://c.example.com`,
+			b: `
+# METADATA
+# related_resources: 
+# - https://a.example.com
+# - https://b.example.com`,
+			exp: 1,
+		},
+		{
+			note: "related_resources - less than (fewer)",
+			a: `
+# METADATA
+# scope: rule
+# organizations:
+# - https://a.example.com`,
+			b: `
+# METADATA
+# scope: rule
+# organizations:
+# - https://a.example.com
+# - https://b.example.com`,
+			exp: -1,
+		},
+		{
+			note: "related_resources - greater than (more)",
+			a: `
+# METADATA
+# scope: rule
+# organizations:
+# - https://a.example.com
+# - https://b.example.com`,
+			b: `
+# METADATA
+# scope: rule
+# organizations:
+# - https://a.example.com`,
+			exp: 1,
+		},
+		{
+			note: "related_resources - less than (description)",
+			a: `
+# METADATA
+# related_resources:
+# -
+#  ref: https://example.com
+#  description: a`,
+			b: `
+# METADATA
+# related_resources:
+# -
+#  ref: https://example.com
+#  description: b`,
+			exp: -1,
+		},
+		{
+			note: "related_resources - greater than (description)",
+			a: `
+# METADATA
+# related_resources:
+# -
+#  ref: https://example.com
+#  description: b`,
+			b: `
+# METADATA
+# related_resources:
+# -
+#  ref: https://example.com
+#  description: a`,
+			exp: 1,
+		},
+		{
+			note: "custom",
+			a: `
+# METADATA
+# custom: 
+#  a: 1
+#  b: true
+#  c:
+#  d:
+#  - 1
+#  - 2
+#  e:
+#   i: 1
+#   j: 2`,
+			b: `
+# METADATA
+# custom: 
+#  a: 1
+#  b: true
+#  c:
+#  d:
+#  - 1
+#  - 2
+#  e:
+#   i: 1
+#   j: 2`,
+			exp: 0,
+		},
+		{
+			note: "custom - less than",
+			a: `
+# METADATA
+# custom: 
+#  a: 1`,
+			b: `
+# METADATA
+# custom: 
+#  b: 1`,
+			exp: -1,
+		},
+		{
+			note: "custom - greater than",
+			a: `
+# METADATA
+# custom: 
+#  b: 1`,
+			b: `
+# METADATA
+# custom: 
+#  a: 1`,
+			exp: 1,
+		},
+		{
+			note: "custom - less than (value)",
+			a: `
+# METADATA
+# custom: 
+#  a: 1`,
+			b: `
+# METADATA
+# custom: 
+#  a: 2`,
+			exp: -1,
+		},
+		{
+			note: "custom - greater than (value)",
+			a: `
+# METADATA
+# custom: 
+#  a: 2`,
+			b: `
+# METADATA
+# custom: 
+#  a: 1`,
+			exp: 1,
+		},
+		{
+			note: "custom - less than (fewer)",
+			a: `
+# METADATA
+# custom: 
+#  a: 1`,
+			b: `
+# METADATA
+# custom: 
+#  a: 1
+#  b: 2`,
+			exp: -1,
+		},
+		{
+			note: "custom - greater than (more)",
+			a: `
+# METADATA
+# custom: 
+#  a: 1
+#  b: 2`,
+			b: `
+# METADATA
+# custom: 
+#  a: 1`,
+			exp: 1,
+		},
 	}
 
 	for _, tc := range tests {
diff --git a/ast/compile.go b/ast/compile.go
index f446606d16..1f99e09692 100644
--- a/ast/compile.go
+++ b/ast/compile.go
@@ -11,6 +11,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/open-policy-agent/opa/ast/location"
 	"github.com/open-policy-agent/opa/internal/debug"
 	"github.com/open-policy-agent/opa/internal/gojsonschema"
 	"github.com/open-policy-agent/opa/metrics"
@@ -63,6 +64,7 @@ type Compiler struct {
 	//  p[1] { true }
 	//  p[2] { true }
 	//  q = true
+	//  a.b.c = 3
 	//
 	//  root
 	//    |
@@ -73,6 +75,12 @@ type Compiler struct {
 	//                +--- p (2 rules)
 	//                |
 	//                +--- q (1 rule)
+	//                |
+	//                +--- a
+	//                     |
+	//                     +--- b
+	//                          |
+	//                          +--- c (1 rule)
 	RuleTree *TreeNode
 
 	// Graph contains dependencies between rules. An edge (u,v) is added to the
@@ -94,21 +102,27 @@ type Compiler struct {
 		metricName string
 		f          func()
 	}
-	maxErrs               int
-	sorted                []string // list of sorted module names
-	pathExists            func([]string) (bool, error)
-	after                 map[string][]CompilerStageDefinition
-	metrics               metrics.Metrics
-	capabilities          *Capabilities                 // user-supplied capabilities
-	builtins              map[string]*Builtin           // universe of built-in functions
-	customBuiltins        map[string]*Builtin           // user-supplied custom built-in functions (deprecated: use capabilities)
-	unsafeBuiltinsMap     map[string]struct{}           // user-supplied set of unsafe built-ins functions to block (deprecated: use capabilities)
-	enablePrintStatements bool                          // indicates if print statements should be elided (default)
-	comprehensionIndices  map[*Term]*ComprehensionIndex // comprehension key index
-	initialized           bool                          // indicates if init() has been called
-	debug                 debug.Debug                   // emits debug information produced during compilation
-	schemaSet             *SchemaSet                    // user-supplied schemas for input and data documents
-	inputType             types.Type                    // global input type retrieved from schema set
+	maxErrs                 int
+	sorted                  []string // list of sorted module names
+	pathExists              func([]string) (bool, error)
+	after                   map[string][]CompilerStageDefinition
+	metrics                 metrics.Metrics
+	capabilities            *Capabilities                 // user-supplied capabilities
+	builtins                map[string]*Builtin           // universe of built-in functions
+	customBuiltins          map[string]*Builtin           // user-supplied custom built-in functions (deprecated: use capabilities)
+	unsafeBuiltinsMap       map[string]struct{}           // user-supplied set of unsafe built-ins functions to block (deprecated: use capabilities)
+	deprecatedBuiltinsMap   map[string]struct{}           // set of deprecated, but not removed, built-in functions
+	enablePrintStatements   bool                          // indicates if print statements should be elided (default)
+	comprehensionIndices    map[*Term]*ComprehensionIndex // comprehension key index
+	initialized             bool                          // indicates if init() has been called
+	debug                   debug.Debug                   // emits debug information produced during compilation
+	schemaSet               *SchemaSet                    // user-supplied schemas for input and data documents
+	inputType               types.Type                    // global input type retrieved from schema set
+	annotationSet           *AnnotationSet                // hierarchical set of annotations
+	strict                  bool                          // enforce strict compilation checks
+	keepModules             bool                          // whether to keep the unprocessed, parse modules (below)
+	parsedModules           map[string]*Module            // parsed, but otherwise unprocessed modules, kept track of when keepModules is true
+	useTypeCheckAnnotations bool                          // whether to provide annotated information (schemas) to the type checker
 }
 
 // CompilerStage defines the interface for stages in the compiler.
@@ -215,6 +229,9 @@ type QueryCompiler interface {
 	// ComprehensionIndex returns an index data structure for the given comprehension
 	// term. If no index is found, returns nil.
 	ComprehensionIndex(term *Term) *ComprehensionIndex
+
+	// WithStrict enables strict mode for the query compiler.
+	WithStrict(strict bool) QueryCompiler
 }
 
 // QueryCompilerStage defines the interface for stages in the query compiler.
@@ -239,11 +256,12 @@ func NewCompiler() *Compiler {
 		}, func(x util.T) int {
 			return x.(Ref).Hash()
 		}),
-		maxErrs:              CompileErrorLimitDefault,
-		after:                map[string][]CompilerStageDefinition{},
-		unsafeBuiltinsMap:    map[string]struct{}{},
-		comprehensionIndices: map[*Term]*ComprehensionIndex{},
-		debug:                debug.Discard(),
+		maxErrs:               CompileErrorLimitDefault,
+		after:                 map[string][]CompilerStageDefinition{},
+		unsafeBuiltinsMap:     map[string]struct{}{},
+		deprecatedBuiltinsMap: map[string]struct{}{},
+		comprehensionIndices:  map[*Term]*ComprehensionIndex{},
+		debug:                 debug.Discard(),
 	}
 
 	c.ModuleTree = NewModuleTree(nil)
@@ -258,16 +276,23 @@ func NewCompiler() *Compiler {
 		// load additional modules. If any stages run before resolution, they
 		// need to be re-run after resolution.
 		{"ResolveRefs", "compile_stage_resolve_refs", c.resolveAllRefs},
-		{"SetModuleTree", "compile_stage_set_module_tree", c.setModuleTree},
-		{"SetRuleTree", "compile_stage_set_rule_tree", c.setRuleTree},
 		// The local variable generator must be initialized after references are
 		// resolved and the dynamic module loader has run but before subsequent
 		// stages that need to generate variables.
 		{"InitLocalVarGen", "compile_stage_init_local_var_gen", c.initLocalVarGen},
+		{"RewriteRuleHeadRefs", "compile_stage_rewrite_rule_head_refs", c.rewriteRuleHeadRefs},
+		{"CheckKeywordOverrides", "compile_stage_check_keyword_overrides", c.checkKeywordOverrides},
+		{"CheckDuplicateImports", "compile_stage_check_duplicate_imports", c.checkDuplicateImports},
+		{"RemoveImports", "compile_stage_remove_imports", c.removeImports},
+		{"SetModuleTree", "compile_stage_set_module_tree", c.setModuleTree},
+		{"SetRuleTree", "compile_stage_set_rule_tree", c.setRuleTree}, // depends on RewriteRuleHeadRefs
 		{"RewriteLocalVars", "compile_stage_rewrite_local_vars", c.rewriteLocalVars},
 		{"CheckVoidCalls", "compile_stage_check_void_calls", c.checkVoidCalls},
 		{"RewritePrintCalls", "compile_stage_rewrite_print_calls", c.rewritePrintCalls},
 		{"RewriteExprTerms", "compile_stage_rewrite_expr_terms", c.rewriteExprTerms},
+		{"ParseMetadataBlocks", "compile_stage_parse_metadata_blocks", c.parseMetadataBlocks},
+		{"SetAnnotationSet", "compile_stage_set_annotationset", c.setAnnotationSet},
+		{"RewriteRegoMetadataCalls", "compile_stage_rewrite_rego_metadata_calls", c.rewriteRegoMetadataCalls},
 		{"SetGraph", "compile_stage_set_graph", c.setGraph},
 		{"RewriteComprehensionTerms", "compile_stage_rewrite_comprehension_terms", c.rewriteComprehensionTerms},
 		{"RewriteRefsInHead", "compile_stage_rewrite_refs_in_head", c.rewriteRefsInHead},
@@ -279,8 +304,9 @@ func NewCompiler() *Compiler {
 		{"RewriteEquals", "compile_stage_rewrite_equals", c.rewriteEquals},
 		{"RewriteDynamicTerms", "compile_stage_rewrite_dynamic_terms", c.rewriteDynamicTerms},
 		{"CheckRecursion", "compile_stage_check_recursion", c.checkRecursion},
-		{"CheckTypes", "compile_stage_check_types", c.checkTypes},
+		{"CheckTypes", "compile_stage_check_types", c.checkTypes}, // must be run after CheckRecursion
 		{"CheckUnsafeBuiltins", "compile_state_check_unsafe_builtins", c.checkUnsafeBuiltins},
+		{"CheckDeprecatedBuiltins", "compile_state_check_deprecated_builtins", c.checkDeprecatedBuiltins},
 		{"BuildRuleIndices", "compile_stage_rebuild_indices", c.buildRuleIndices},
 		{"BuildComprehensionIndices", "compile_stage_rebuild_comprehension_indices", c.buildComprehensionIndices},
 	}
@@ -336,6 +362,11 @@ func (c *Compiler) WithCapabilities(capabilities *Capabilities) *Compiler {
 	return c
 }
 
+// Capabilities returns the capabilities enabled during compilation.
+func (c *Compiler) Capabilities() *Capabilities {
+	return c.capabilities
+}
+
 // WithDebug sets where debug messages are written to. Passing `nil` has no
 // effect.
 func (c *Compiler) WithDebug(sink io.Writer) *Compiler {
@@ -362,10 +393,38 @@ func (c *Compiler) WithUnsafeBuiltins(unsafeBuiltins map[string]struct{}) *Compi
 	return c
 }
 
-// QueryCompiler returns a new QueryCompiler object.
+// WithStrict enables strict mode in the compiler.
+func (c *Compiler) WithStrict(strict bool) *Compiler {
+	c.strict = strict
+	return c
+}
+
+// WithKeepModules enables retaining unprocessed modules in the compiler.
+// Note that the modules aren't copied on the way in or out -- so when
+// accessing them via ParsedModules(), mutations will occur in the module
+// map that was passed into Compile().`
+func (c *Compiler) WithKeepModules(y bool) *Compiler {
+	c.keepModules = y
+	return c
+}
+
+// WithUseTypeCheckAnnotations use schema annotations during type checking
+func (c *Compiler) WithUseTypeCheckAnnotations(enabled bool) *Compiler {
+	c.useTypeCheckAnnotations = enabled
+	return c
+}
+
+// ParsedModules returns the parsed, unprocessed modules from the compiler.
+// It is `nil` if keeping modules wasn't enabled via `WithKeepModules(true)`.
+// The map includes all modules loaded via the ModuleLoader, if one was used.
+func (c *Compiler) ParsedModules() map[string]*Module {
+	return c.parsedModules
+}
+
 func (c *Compiler) QueryCompiler() QueryCompiler {
 	c.init()
-	return newQueryCompiler(c)
+	c0 := *c
+	return newQueryCompiler(&c0)
 }
 
 // Compile runs the compilation process on the input modules. The compiled
@@ -377,10 +436,20 @@ func (c *Compiler) Compile(modules map[string]*Module) {
 	c.init()
 
 	c.Modules = make(map[string]*Module, len(modules))
+	c.sorted = make([]string, 0, len(modules))
+
+	if c.keepModules {
+		c.parsedModules = make(map[string]*Module, len(modules))
+	} else {
+		c.parsedModules = nil
+	}
 
 	for k, v := range modules {
 		c.Modules[k] = v.Copy()
 		c.sorted = append(c.sorted, k)
+		if c.parsedModules != nil {
+			c.parsedModules[k] = v
+		}
 	}
 
 	sort.Strings(c.sorted)
@@ -424,16 +493,16 @@ func (c *Compiler) GetArity(ref Ref) int {
 //
 // E.g., given the following module:
 //
-//	package a.b.c
+//		package a.b.c
 //
-//	p[k] = v { ... }    # rule1
-//  p[k1] = v1 { ... }  # rule2
+//		p[k] = v { ... }    # rule1
+//	 p[k1] = v1 { ... }  # rule2
 //
 // The following calls yield the rules on the right.
 //
-//  GetRulesExact("data.a.b.c.p")   => [rule1, rule2]
-//  GetRulesExact("data.a.b.c.p.x") => nil
-//  GetRulesExact("data.a.b.c")     => nil
+//	GetRulesExact("data.a.b.c.p")   => [rule1, rule2]
+//	GetRulesExact("data.a.b.c.p.x") => nil
+//	GetRulesExact("data.a.b.c")     => nil
 func (c *Compiler) GetRulesExact(ref Ref) (rules []*Rule) {
 	node := c.RuleTree
 
@@ -451,16 +520,16 @@ func (c *Compiler) GetRulesExact(ref Ref) (rules []*Rule) {
 //
 // E.g., given the following module:
 //
-//	package a.b.c
+//		package a.b.c
 //
-//	p[k] = v { ... }    # rule1
-//  p[k1] = v1 { ... }  # rule2
+//		p[k] = v { ... }    # rule1
+//	 p[k1] = v1 { ... }  # rule2
 //
 // The following calls yield the rules on the right.
 //
-//  GetRulesForVirtualDocument("data.a.b.c.p")   => [rule1, rule2]
-//  GetRulesForVirtualDocument("data.a.b.c.p.x") => [rule1, rule2]
-//  GetRulesForVirtualDocument("data.a.b.c")     => nil
+//	GetRulesForVirtualDocument("data.a.b.c.p")   => [rule1, rule2]
+//	GetRulesForVirtualDocument("data.a.b.c.p.x") => [rule1, rule2]
+//	GetRulesForVirtualDocument("data.a.b.c")     => nil
 func (c *Compiler) GetRulesForVirtualDocument(ref Ref) (rules []*Rule) {
 
 	node := c.RuleTree
@@ -481,17 +550,17 @@ func (c *Compiler) GetRulesForVirtualDocument(ref Ref) (rules []*Rule) {
 //
 // E.g., given the following module:
 //
-//  package a.b.c
+//	package a.b.c
 //
-//  p[x] = y { ... }  # rule1
-//  p[k] = v { ... }  # rule2
-//  q { ... }         # rule3
+//	p[x] = y { ... }  # rule1
+//	p[k] = v { ... }  # rule2
+//	q { ... }         # rule3
 //
 // The following calls yield the rules on the right.
 //
-//  GetRulesWithPrefix("data.a.b.c.p")   => [rule1, rule2]
-//  GetRulesWithPrefix("data.a.b.c.p.a") => nil
-//  GetRulesWithPrefix("data.a.b.c")     => [rule1, rule2, rule3]
+//	GetRulesWithPrefix("data.a.b.c.p")   => [rule1, rule2]
+//	GetRulesWithPrefix("data.a.b.c.p.a") => nil
+//	GetRulesWithPrefix("data.a.b.c")     => [rule1, rule2, rule3]
 func (c *Compiler) GetRulesWithPrefix(ref Ref) (rules []*Rule) {
 
 	node := c.RuleTree
@@ -519,9 +588,10 @@ func (c *Compiler) GetRulesWithPrefix(ref Ref) (rules []*Rule) {
 	return rules
 }
 
-func extractRules(s []util.T) (rules []*Rule) {
-	for _, r := range s {
-		rules = append(rules, r.(*Rule))
+func extractRules(s []util.T) []*Rule {
+	rules := make([]*Rule, len(s))
+	for i := range s {
+		rules[i] = s[i].(*Rule)
 	}
 	return rules
 }
@@ -530,18 +600,18 @@ func extractRules(s []util.T) (rules []*Rule) {
 //
 // E.g., given the following module:
 //
-//  package a.b.c
+//	package a.b.c
 //
-//  p[x] = y { q[x] = y; ... } # rule1
-//  q[x] = y { ... }           # rule2
+//	p[x] = y { q[x] = y; ... } # rule1
+//	q[x] = y { ... }           # rule2
 //
 // The following calls yield the rules on the right.
 //
-//  GetRules("data.a.b.c.p")	=> [rule1]
-//  GetRules("data.a.b.c.p.x")	=> [rule1]
-//  GetRules("data.a.b.c.q")	=> [rule2]
-//  GetRules("data.a.b.c")		=> [rule1, rule2]
-//  GetRules("data.a.b.d")		=> nil
+//	GetRules("data.a.b.c.p")	=> [rule1]
+//	GetRules("data.a.b.c.p.x")	=> [rule1]
+//	GetRules("data.a.b.c.q")	=> [rule2]
+//	GetRules("data.a.b.c")		=> [rule1, rule2]
+//	GetRules("data.a.b.d")		=> nil
 func (c *Compiler) GetRules(ref Ref) (rules []*Rule) {
 
 	set := map[*Rule]struct{}{}
@@ -576,34 +646,34 @@ func (c *Compiler) GetRulesDynamic(ref Ref) []*Rule {
 //
 // E.g., given the following modules:
 //
-//  package a.b.c
+//	package a.b.c
 //
-//  r1 = 1  # rule1
+//	r1 = 1  # rule1
 //
 // and:
 //
-//  package a.d.c
+//	package a.d.c
 //
-//  r2 = 2  # rule2
+//	r2 = 2  # rule2
 //
 // The following calls yield the rules on the right.
 //
-//  GetRulesDynamicWithOpts("data.a[x].c[y]", opts) => [rule1, rule2]
-//  GetRulesDynamicWithOpts("data.a[x].c.r2", opts) => [rule2]
-//  GetRulesDynamicWithOpts("data.a.b[x][y]", opts) => [rule1]
+//	GetRulesDynamicWithOpts("data.a[x].c[y]", opts) => [rule1, rule2]
+//	GetRulesDynamicWithOpts("data.a[x].c.r2", opts) => [rule2]
+//	GetRulesDynamicWithOpts("data.a.b[x][y]", opts) => [rule1]
 //
 // Using the RulesOptions parameter, the inclusion of hidden modules can be
 // controlled:
 //
 // With
 //
-//  package system.main
+//	package system.main
 //
-//  r3 = 3 # rule3
+//	r3 = 3 # rule3
 //
 // We'd get this result:
 //
-//  GetRulesDynamicWithOpts("data[x]", RulesOptions{IncludeHiddenModules: true}) => [rule1, rule2, rule3]
+//	GetRulesDynamicWithOpts("data[x]", RulesOptions{IncludeHiddenModules: true}) => [rule1, rule2, rule3]
 //
 // Without the options, it would be excluded.
 func (c *Compiler) GetRulesDynamicWithOpts(ref Ref, opts RulesOptions) []*Rule {
@@ -612,7 +682,8 @@ func (c *Compiler) GetRulesDynamicWithOpts(ref Ref, opts RulesOptions) []*Rule {
 	set := map[*Rule]struct{}{}
 	var walk func(node *TreeNode, i int)
 	walk = func(node *TreeNode, i int) {
-		if i >= len(ref) {
+		switch {
+		case i >= len(ref):
 			// We've reached the end of the reference and want to collect everything
 			// under this "prefix".
 			node.DepthFirst(func(descendant *TreeNode) bool {
@@ -622,7 +693,8 @@ func (c *Compiler) GetRulesDynamicWithOpts(ref Ref, opts RulesOptions) []*Rule {
 				}
 				return descendant.Hide
 			})
-		} else if i == 0 || IsConstant(ref[i].Value) {
+
+		case i == 0 || IsConstant(ref[i].Value):
 			// The head of the ref is always grounded.  In case another part of the
 			// ref is also grounded, we can lookup the exact child.  If it's not found
 			// we can immediately return...
@@ -636,7 +708,8 @@ func (c *Compiler) GetRulesDynamicWithOpts(ref Ref, opts RulesOptions) []*Rule {
 				// Otherwise, we continue using the child node.
 				walk(child, i+1)
 			}
-		} else {
+
+		default:
 			// This part of the ref is a dynamic term.  We can't know what it refers
 			// to and will just need to try all of the children.
 			for _, child := range node.Children {
@@ -714,13 +787,30 @@ func (c *Compiler) buildRuleIndices() {
 		if len(node.Values) == 0 {
 			return false
 		}
+		rules := extractRules(node.Values)
+		hasNonGroundKey := false
+		for _, r := range rules {
+			if ref := r.Head.Ref(); len(ref) > 1 {
+				if !ref[len(ref)-1].IsGround() {
+					hasNonGroundKey = true
+				}
+			}
+		}
+		if hasNonGroundKey {
+			// collect children: as of now, this cannot go deeper than one level,
+			// so we grab those, and abort the DepthFirst processing for this branch
+			for _, n := range node.Children {
+				rules = append(rules, extractRules(n.Values)...)
+			}
+		}
+
 		index := newBaseDocEqIndex(func(ref Ref) bool {
 			return isVirtual(c.RuleTree, ref.GroundPrefix())
 		})
-		if rules := extractRules(node.Values); index.Build(rules) {
-			c.ruleIndices.Put(rules[0].Path(), index)
+		if index.Build(rules) {
+			c.ruleIndices.Put(rules[0].Ref().GroundPrefix(), index)
 		}
-		return false
+		return hasNonGroundKey // currently, we don't allow those branches to go deeper
 	})
 
 }
@@ -757,7 +847,7 @@ func (c *Compiler) checkRecursion() {
 func (c *Compiler) checkSelfPath(loc *Location, eq func(a, b util.T) bool, a, b util.T) {
 	tr := NewGraphTraversal(c.Graph)
 	if p := util.DFSPath(tr, eq, a, b); len(p) > 0 {
-		n := []string{}
+		n := make([]string, 0, len(p))
 		for _, x := range p {
 			n = append(n, astNodeToString(x))
 		}
@@ -766,46 +856,103 @@ func (c *Compiler) checkSelfPath(loc *Location, eq func(a, b util.T) bool, a, b
 }
 
 func astNodeToString(x interface{}) string {
-	switch x := x.(type) {
-	case *Rule:
-		return string(x.Head.Name)
-	default:
-		panic("not reached")
-	}
+	return x.(*Rule).Ref().String()
 }
 
 // checkRuleConflicts ensures that rules definitions are not in conflict.
 func (c *Compiler) checkRuleConflicts() {
+	rw := rewriteVarsInRef(c.RewrittenVars)
+
 	c.RuleTree.DepthFirst(func(node *TreeNode) bool {
 		if len(node.Values) == 0 {
-			return false
+			return false // go deeper
 		}
 
-		kinds := map[DocKind]struct{}{}
+		kinds := make(map[RuleKind]struct{}, len(node.Values))
 		defaultRules := 0
-		arities := map[int]struct{}{}
-		declared := false
+		arities := make(map[int]struct{}, len(node.Values))
+		name := ""
+		var singleValueConflicts []Ref
+		var multiValueConflicts []Ref
 
 		for _, rule := range node.Values {
 			r := rule.(*Rule)
-			kinds[r.Head.DocKind()] = struct{}{}
+			ref := r.Ref()
+			name = rw(ref.Copy()).String() // varRewriter operates in-place
+			kinds[r.Head.RuleKind()] = struct{}{}
 			arities[len(r.Head.Args)] = struct{}{}
-			if r.Head.Assign {
-				declared = true
-			}
 			if r.Default {
 				defaultRules++
 			}
+
+			// Single-value rules may not have any other rules in their extent: these pairs are invalid:
+			//
+			//   data.p.q.r { true }          # data.p.q is { "r": true }
+			//   data.p.q.r.s { true }
+			//
+			//   data.p.q[r] { r := input.r } # data.p.q could be { "r": true }
+			//   data.p.q.r.s { true }
+			//
+			// data.p[r] := x { r = input.key; x = input.bar }
+			// data.p.q[r] := x { r = input.key; x = input.bar }
+
+			// But this is allowed:
+			//   data.p.q[r] = 1 { r := "r" }
+			//   data.p.q.s = 2
+
+			if r.Head.RuleKind() == SingleValue && len(node.Children) > 0 {
+				if len(ref) > 1 && !ref[len(ref)-1].IsGround() { // p.q[x] and p.q.s.t => check grandchildren
+					for _, c := range node.Children {
+						grandchildrenFound := false
+
+						if len(c.Values) > 0 {
+							childRules := extractRules(c.Values)
+							for _, childRule := range childRules {
+								childRef := childRule.Ref()
+								if childRule.Head.RuleKind() == SingleValue && !childRef[len(childRef)-1].IsGround() {
+									// The child is a partial object rule, so it's effectively "generating" grandchildren.
+									grandchildrenFound = true
+									break
+								}
+							}
+						}
+
+						if len(c.Children) > 0 {
+							grandchildrenFound = true
+						}
+
+						if grandchildrenFound {
+							singleValueConflicts = node.flattenChildren()
+							break
+						}
+					}
+				} else { // p.q.s and p.q.s.t => any children are in conflict
+					singleValueConflicts = node.flattenChildren()
+				}
+			}
+
+			// Multi-value rules may not have any other rules in their extent; e.g.:
+			//
+			// data.p[v] { v := ... }
+			// data.p.q := 42 # In direct conflict with data.p[v], which is constructing a set and cannot have values assigned to a sub-path.
+
+			if r.Head.RuleKind() == MultiValue && len(node.Children) > 0 {
+				multiValueConflicts = node.flattenChildren()
+			}
 		}
 
-		name := Var(node.Key.(String))
+		switch {
+		case singleValueConflicts != nil:
+			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "single-value rule %v conflicts with %v", name, singleValueConflicts))
+
+		case multiValueConflicts != nil:
+			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "multi-value rule %v conflicts with %v", name, multiValueConflicts))
 
-		if declared && len(node.Values) > 1 {
-			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "rule named %v redeclared at %v", name, node.Values[1].(*Rule).Loc()))
-		} else if len(kinds) > 1 || len(arities) > 1 {
-			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "conflicting rules named %v found", name))
-		} else if defaultRules > 1 {
-			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "multiple default rules named %s found", name))
+		case len(kinds) > 1 || len(arities) > 1:
+			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "conflicting rules %v found", name))
+
+		case defaultRules > 1:
+			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "multiple default rules %s found", name))
 		}
 
 		return false
@@ -817,12 +964,19 @@ func (c *Compiler) checkRuleConflicts() {
 		}
 	}
 
+	// NOTE(sr): depthfirst might better use sorted for stable errs?
 	c.ModuleTree.DepthFirst(func(node *ModuleTreeNode) bool {
 		for _, mod := range node.Modules {
 			for _, rule := range mod.Rules {
-				if childNode, ok := node.Children[String(rule.Head.Name)]; ok {
+				ref := rule.Head.Ref().GroundPrefix()
+				childNode, tail := node.find(ref)
+				if childNode != nil && len(tail) == 0 {
 					for _, childMod := range childNode.Modules {
-						msg := fmt.Sprintf("%v conflicts with rule defined at %v", childMod.Package, rule.Loc())
+						// Avoid recursively checking a module for equality unless we know it's a possible self-match.
+						if childMod.Equal(mod) {
+							continue // don't self-conflict
+						}
+						msg := fmt.Sprintf("%v conflicts with rule %v defined at %v", childMod.Package, rule.Head.Ref(), rule.Loc())
 						c.err(NewError(TypeErr, mod.Package.Loc(), msg))
 					}
 				}
@@ -881,7 +1035,7 @@ func arityMismatchError(env *TypeEnv, f Ref, expr *Expr, exp, act int) *Error {
 		for i, op := range expr.Operands() {
 			have[i] = env.Get(op)
 		}
-		return newArgError(expr.Loc(), f, "arity mismatch", have, want.FuncArgs())
+		return newArgError(expr.Loc(), f, "arity mismatch", have, want.NamedFuncArgs())
 	}
 	if act != 1 {
 		return NewError(TypeErr, expr.Loc(), "function %v has arity %d, got %d arguments", f, exp, act)
@@ -1005,7 +1159,25 @@ func mergeSchemas(schemas ...*gojsonschema.SubSchema) (*gojsonschema.SubSchema,
 	return result, nil
 }
 
-func parseSchema(schema interface{}) (types.Type, error) {
+type schemaParser struct {
+	definitionCache map[string]*cachedDef
+}
+
+type cachedDef struct {
+	properties []*types.StaticProperty
+}
+
+func newSchemaParser() *schemaParser {
+	return &schemaParser{
+		definitionCache: map[string]*cachedDef{},
+	}
+}
+
+func (parser *schemaParser) parseSchema(schema interface{}) (types.Type, error) {
+	return parser.parseSchemaWithPropertyKey(schema, "")
+}
+
+func (parser *schemaParser) parseSchemaWithPropertyKey(schema interface{}, propertyKey string) (types.Type, error) {
 	subSchema, ok := schema.(*gojsonschema.SubSchema)
 	if !ok {
 		return nil, fmt.Errorf("unexpected schema type %v", subSchema)
@@ -1013,7 +1185,10 @@ func parseSchema(schema interface{}) (types.Type, error) {
 
 	// Handle referenced schemas, returns directly when a $ref is found
 	if subSchema.RefSchema != nil {
-		return parseSchema(subSchema.RefSchema)
+		if existing, ok := parser.definitionCache[subSchema.Ref.String()]; ok {
+			return types.NewObject(existing.properties, nil), nil
+		}
+		return parser.parseSchemaWithPropertyKey(subSchema.RefSchema, subSchema.Ref.String())
 	}
 
 	// Handle anyOf
@@ -1025,7 +1200,7 @@ func parseSchema(schema interface{}) (types.Type, error) {
 			copySchema := *subSchema
 			copySchemaRef := &copySchema
 			copySchemaRef.AnyOf = nil
-			coreType, err := parseSchema(copySchemaRef)
+			coreType, err := parser.parseSchema(copySchemaRef)
 			if err != nil {
 				return nil, fmt.Errorf("unexpected schema type %v: %w", subSchema, err)
 			}
@@ -1040,7 +1215,7 @@ func parseSchema(schema interface{}) (types.Type, error) {
 
 		// Iterate through every property of AnyOf and add it to orType
 		for _, pSchema := range subSchema.AnyOf {
-			newtype, err := parseSchema(pSchema)
+			newtype, err := parser.parseSchema(pSchema)
 			if err != nil {
 				return nil, fmt.Errorf("unexpected schema type %v: %w", pSchema, err)
 			}
@@ -1063,12 +1238,12 @@ func parseSchema(schema interface{}) (types.Type, error) {
 				if err != nil {
 					return nil, err
 				}
-				return parseSchema(objectOrArrayResult)
+				return parser.parseSchema(objectOrArrayResult)
 			} else if subSchema.Types.String() != allOfResult.Types.String() {
 				return nil, fmt.Errorf("unable to merge these schemas")
 			}
 		}
-		return parseSchema(allOfResult)
+		return parser.parseSchema(allOfResult)
 	}
 
 	if subSchema.Types.IsTyped() {
@@ -1083,15 +1258,28 @@ func parseSchema(schema interface{}) (types.Type, error) {
 
 		} else if subSchema.Types.Contains("object") {
 			if len(subSchema.PropertiesChildren) > 0 {
-				staticProps := make([]*types.StaticProperty, 0, len(subSchema.PropertiesChildren))
+				def := &cachedDef{
+					properties: make([]*types.StaticProperty, 0, len(subSchema.PropertiesChildren)),
+				}
 				for _, pSchema := range subSchema.PropertiesChildren {
-					newtype, err := parseSchema(pSchema)
+					def.properties = append(def.properties, types.NewStaticProperty(pSchema.Property, nil))
+				}
+				if propertyKey != "" {
+					parser.definitionCache[propertyKey] = def
+				}
+				for _, pSchema := range subSchema.PropertiesChildren {
+					newtype, err := parser.parseSchema(pSchema)
 					if err != nil {
 						return nil, fmt.Errorf("unexpected schema type %v: %w", pSchema, err)
 					}
-					staticProps = append(staticProps, types.NewStaticProperty(pSchema.Property, newtype))
+					for i, prop := range def.properties {
+						if prop.Key == pSchema.Property {
+							def.properties[i].Value = newtype
+							break
+						}
+					}
 				}
-				return types.NewObject(staticProps, nil), nil
+				return types.NewObject(def.properties, nil), nil
 			}
 			return types.NewObject(nil, types.NewDynamicProperty(types.A, types.A)), nil
 
@@ -1099,7 +1287,7 @@ func parseSchema(schema interface{}) (types.Type, error) {
 			if len(subSchema.ItemsChildren) > 0 {
 				if subSchema.ItemsChildrenIsSingleSchema {
 					iSchema := subSchema.ItemsChildren[0]
-					newtype, err := parseSchema(iSchema)
+					newtype, err := parser.parseSchema(iSchema)
 					if err != nil {
 						return nil, fmt.Errorf("unexpected schema type %v", iSchema)
 					}
@@ -1108,7 +1296,7 @@ func parseSchema(schema interface{}) (types.Type, error) {
 				newTypes := make([]types.Type, 0, len(subSchema.ItemsChildren))
 				for i := 0; i != len(subSchema.ItemsChildren); i++ {
 					iSchema := subSchema.ItemsChildren[i]
-					newtype, err := parseSchema(iSchema)
+					newtype, err := parser.parseSchema(iSchema)
 					if err != nil {
 						return nil, fmt.Errorf("unexpected schema type %v", iSchema)
 					}
@@ -1123,27 +1311,46 @@ func parseSchema(schema interface{}) (types.Type, error) {
 	// Assume types if not specified in schema
 	if len(subSchema.PropertiesChildren) > 0 {
 		if err := subSchema.Types.Add("object"); err == nil {
-			return parseSchema(subSchema)
+			return parser.parseSchema(subSchema)
 		}
 	} else if len(subSchema.ItemsChildren) > 0 {
 		if err := subSchema.Types.Add("array"); err == nil {
-			return parseSchema(subSchema)
+			return parser.parseSchema(subSchema)
 		}
 	}
 
 	return types.A, nil
 }
 
+func (c *Compiler) setAnnotationSet() {
+	// Sorting modules by name for stable error reporting
+	sorted := make([]*Module, 0, len(c.Modules))
+	for _, mName := range c.sorted {
+		sorted = append(sorted, c.Modules[mName])
+	}
+
+	as, errs := BuildAnnotationSet(sorted)
+	for _, err := range errs {
+		c.err(err)
+	}
+	c.annotationSet = as
+}
+
 // checkTypes runs the type checker on all rules. The type checker builds a
 // TypeEnv that is stored on the compiler.
 func (c *Compiler) checkTypes() {
 	// Recursion is caught in earlier step, so this cannot fail.
 	sorted, _ := c.Graph.Sort()
 	checker := newTypeChecker().
+		WithAllowNet(c.capabilities.AllowNet).
 		WithSchemaSet(c.schemaSet).
 		WithInputType(c.inputType).
 		WithVarRewriter(rewriteVarsInRef(c.RewrittenVars))
-	env, errs := checker.CheckTypes(c.TypeEnv, sorted)
+	var as *AnnotationSet
+	if c.useTypeCheckAnnotations {
+		as = c.annotationSet
+	}
+	env, errs := checker.CheckTypes(c.TypeEnv, sorted, as)
 	for _, err := range errs {
 		c.err(err)
 	}
@@ -1159,6 +1366,15 @@ func (c *Compiler) checkUnsafeBuiltins() {
 	}
 }
 
+func (c *Compiler) checkDeprecatedBuiltins() {
+	for _, name := range c.sorted {
+		errs := checkDeprecatedBuiltins(c.deprecatedBuiltinsMap, c.Modules[name], c.strict)
+		for _, err := range errs {
+			c.err(err)
+		}
+	}
+}
+
 func (c *Compiler) runStage(metricName string, f func()) {
 	if c.metrics != nil {
 		c.metrics.Timer(metricName).Start()
@@ -1188,10 +1404,10 @@ func (c *Compiler) compile() {
 		if c.Failed() {
 			return
 		}
-		for _, s := range c.after[s.name] {
-			err := c.runStageAfter(s.MetricName, s.Stage)
-			if err != nil {
+		for _, a := range c.after[s.name] {
+			if err := c.runStageAfter(a.MetricName, a.Stage); err != nil {
 				c.err(err)
+				return
 			}
 		}
 	}
@@ -1211,6 +1427,9 @@ func (c *Compiler) init() {
 
 	for _, bi := range c.capabilities.Builtins {
 		c.builtins[bi.Name] = bi
+		if c.strict && bi.IsDeprecated() {
+			c.deprecatedBuiltinsMap[bi.Name] = struct{}{}
+		}
 	}
 
 	for name, bi := range c.customBuiltins {
@@ -1248,30 +1467,99 @@ func (c *Compiler) err(err *Error) {
 func (c *Compiler) getExports() *util.HashMap {
 
 	rules := util.NewHashMap(func(a, b util.T) bool {
-		r1 := a.(Ref)
-		r2 := a.(Ref)
-		return r1.Equal(r2)
+		return a.(Ref).Equal(b.(Ref))
 	}, func(v util.T) int {
 		return v.(Ref).Hash()
 	})
 
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
-		rv, ok := rules.Get(mod.Package.Path)
-		if !ok {
-			rv = []Var{}
-		}
-		rvs := rv.([]Var)
 
 		for _, rule := range mod.Rules {
-			rvs = append(rvs, rule.Head.Name)
+			hashMapAdd(rules, mod.Package.Path, rule.Head.Ref().GroundPrefix())
 		}
-		rules.Put(mod.Package.Path, rvs)
 	}
 
 	return rules
 }
 
+func hashMapAdd(rules *util.HashMap, pkg, rule Ref) {
+	prev, ok := rules.Get(pkg)
+	if !ok {
+		rules.Put(pkg, []Ref{rule})
+		return
+	}
+	for _, p := range prev.([]Ref) {
+		if p.Equal(rule) {
+			return
+		}
+	}
+	rules.Put(pkg, append(prev.([]Ref), rule))
+}
+
+func (c *Compiler) GetAnnotationSet() *AnnotationSet {
+	return c.annotationSet
+}
+
+func (c *Compiler) checkDuplicateImports() {
+	if !c.strict {
+		return
+	}
+
+	for _, name := range c.sorted {
+		mod := c.Modules[name]
+		processedImports := map[Var]*Import{}
+
+		for _, imp := range mod.Imports {
+			name := imp.Name()
+
+			if processed, conflict := processedImports[name]; conflict {
+				c.err(NewError(CompileErr, imp.Location, "import must not shadow %v", processed))
+			} else {
+				processedImports[name] = imp
+			}
+		}
+	}
+}
+
+func (c *Compiler) checkKeywordOverrides() {
+	for _, name := range c.sorted {
+		mod := c.Modules[name]
+		errs := checkKeywordOverrides(mod, c.strict)
+		for _, err := range errs {
+			c.err(err)
+		}
+	}
+}
+
+func checkKeywordOverrides(node interface{}, strict bool) Errors {
+	if !strict {
+		return nil
+	}
+
+	errors := Errors{}
+
+	WalkRules(node, func(rule *Rule) bool {
+		name := rule.Head.Name.String()
+		if RootDocumentRefs.Contains(RefTerm(VarTerm(name))) {
+			errors = append(errors, NewError(CompileErr, rule.Location, "rules must not shadow %v (use a different rule name)", name))
+		}
+		return true
+	})
+
+	WalkExprs(node, func(expr *Expr) bool {
+		if expr.IsAssignment() {
+			name := expr.Operand(0).String()
+			if RootDocumentRefs.Contains(RefTerm(VarTerm(name))) {
+				errors = append(errors, NewError(CompileErr, expr.Location, "variables must not shadow %v (use a different variable name)", name))
+			}
+		}
+		return false
+	})
+
+	return errors
+}
+
 // resolveAllRefs resolves references in expressions to their fully qualified values.
 //
 // For instance, given the following module:
@@ -1281,6 +1569,15 @@ func (c *Compiler) getExports() *util.HashMap {
 // p[x] { bar[_] = x }
 //
 // The reference "bar[_]" would be resolved to "data.foo.bar[_]".
+//
+// Ref rules are resolved, too:
+//
+// package a.b
+// q { c.d.e == 1 }
+// c.d[e] := 1 if e := "e"
+//
+// The reference "c.d.e" would be resolved to "data.a.b.c.d.e".
+
 func (c *Compiler) resolveAllRefs() {
 
 	rules := c.getExports()
@@ -1288,9 +1585,9 @@ func (c *Compiler) resolveAllRefs() {
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
 
-		var ruleExports []Var
+		var ruleExports []Ref
 		if x, ok := rules.Get(mod.Package.Path); ok {
-			ruleExports = x.([]Var)
+			ruleExports = x.([]Ref)
 		}
 
 		globals := getGlobals(mod.Package, ruleExports, mod.Imports)
@@ -1303,8 +1600,20 @@ func (c *Compiler) resolveAllRefs() {
 			return false
 		})
 
-		// Once imports have been resolved, they are no longer needed.
-		mod.Imports = nil
+		if c.strict { // check for unused imports
+			for _, imp := range mod.Imports {
+				path := imp.Path.Value.(Ref)
+				if FutureRootDocument.Equal(path[0]) {
+					continue // ignore future imports
+				}
+
+				for v, u := range globals {
+					if v.Equal(imp.Name()) && !u.used {
+						c.err(NewError(CompileErr, imp.Location, "%s unused", imp.String()))
+					}
+				}
+			}
+		}
 	}
 
 	if c.moduleLoader != nil {
@@ -1322,6 +1631,9 @@ func (c *Compiler) resolveAllRefs() {
 		for id, module := range parsed {
 			c.Modules[id] = module.Copy()
 			c.sorted = append(c.sorted, id)
+			if c.parsedModules != nil {
+				c.parsedModules[id] = module
+			}
 		}
 
 		sort.Strings(c.sorted)
@@ -1329,6 +1641,12 @@ func (c *Compiler) resolveAllRefs() {
 	}
 }
 
+func (c *Compiler) removeImports() {
+	for name := range c.Modules {
+		c.Modules[name].Imports = nil
+	}
+}
+
 func (c *Compiler) initLocalVarGen() {
 	c.localvargen = newLocalVarGeneratorForModuleSet(c.sorted, c.Modules)
 }
@@ -1352,6 +1670,65 @@ func (c *Compiler) rewriteExprTerms() {
 	}
 }
 
+func (c *Compiler) rewriteRuleHeadRefs() {
+	f := newEqualityFactory(c.localvargen)
+	for _, name := range c.sorted {
+		WalkRules(c.Modules[name], func(rule *Rule) bool {
+
+			ref := rule.Head.Ref()
+			// NOTE(sr): We're backfilling Refs here -- all parser code paths would have them, but
+			//           it's possible to construct Module{} instances from Golang code, so we need
+			//           to accommodate for that, too.
+			if len(rule.Head.Reference) == 0 {
+				rule.Head.Reference = ref
+			}
+
+			cannotSpeakRefs := true
+			for _, f := range c.capabilities.Features {
+				if f == FeatureRefHeadStringPrefixes {
+					cannotSpeakRefs = false
+					break
+				}
+			}
+
+			if cannotSpeakRefs && rule.Head.Name == "" {
+				c.err(NewError(CompileErr, rule.Loc(), "rule heads with refs are not supported: %v", rule.Head.Reference))
+				return true
+			}
+
+			for i := 1; i < len(ref); i++ {
+				// NOTE(sr): In the first iteration, non-string values in the refs are forbidden
+				// except for the last position, e.g.
+				//     OK: p.q.r[s]
+				// NOT OK: p[q].r.s
+				// TODO(sr): This is stricter than necessary. We could allow any non-var values there,
+				// but we'll also have to adjust the type tree, for example.
+				if i != len(ref)-1 { // last
+					if _, ok := ref[i].Value.(String); !ok {
+						c.err(NewError(TypeErr, rule.Loc(), "rule head must only contain string terms (except for last): %v", ref[i]))
+						continue
+					}
+				}
+
+				// Rewrite so that any non-scalar elements that in the last position of
+				// the rule are vars:
+				//     p.q.r[y.z] { ... }  =>  p.q.r[__local0__] { __local0__ = y.z }
+				// because that's what the RuleTree knows how to deal with.
+				if _, ok := ref[i].Value.(Var); !ok && !IsScalar(ref[i].Value) {
+					expr := f.Generate(ref[i])
+					if i == len(ref)-1 && rule.Head.Key.Equal(ref[i]) {
+						rule.Head.Key = expr.Operand(0)
+					}
+					rule.Head.Reference[i] = expr.Operand(0)
+					rule.Body.Append(expr)
+				}
+			}
+
+			return true
+		})
+	}
+}
+
 func (c *Compiler) checkVoidCalls() {
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
@@ -1373,12 +1750,14 @@ func (c *Compiler) rewritePrintCalls() {
 		WalkRules(mod, func(r *Rule) bool {
 			safe := r.Head.Args.Vars()
 			safe.Update(ReservedVars)
-			WalkBodies(r, func(b Body) bool {
+			vis := func(b Body) bool {
 				for _, err := range rewritePrintCalls(c.localvargen, c.GetArity, safe, b) {
 					c.err(err)
 				}
 				return false
-			})
+			}
+			WalkBodies(r.Head, vis)
+			WalkBodies(r.Body, vis)
 			return false
 		})
 	}
@@ -1407,11 +1786,11 @@ func checkVoidCalls(env *TypeEnv, x interface{}) Errors {
 //
 // For example, given the following print statement:
 //
-//   print("the value of x is:", input.x)
+//	print("the value of x is:", input.x)
 //
 // The expression would be rewritten to:
 //
-//   print({__local0__ | __local0__ = "the value of x is:"}, {__local1__ | __local1__ = input.x})
+//	print({__local0__ | __local0__ = "the value of x is:"}, {__local1__ | __local1__ = input.x})
 func rewritePrintCalls(gen *localVarGenerator, getArity func(Ref) int, globals VarSet, body Body) Errors {
 
 	var errs Errors
@@ -1419,7 +1798,7 @@ func rewritePrintCalls(gen *localVarGenerator, getArity func(Ref) int, globals V
 	// Visit comprehension bodies recursively to ensure print statements inside
 	// those bodies only close over variables that are safe.
 	for i := range body {
-		if ContainsComprehensions(body[i]) {
+		if ContainsClosures(body[i]) {
 			safe := outputVarsForBody(body[:i], getArity, globals)
 			safe.Update(globals)
 			WalkClosures(body[i], func(x interface{}) bool {
@@ -1430,6 +1809,9 @@ func rewritePrintCalls(gen *localVarGenerator, getArity func(Ref) int, globals V
 					errs = rewritePrintCalls(gen, getArity, safe, x.Body)
 				case *ObjectComprehension:
 					errs = rewritePrintCalls(gen, getArity, safe, x.Body)
+				case *Every:
+					safe.Update(x.KeyValueVars())
+					errs = rewritePrintCalls(gen, getArity, safe, x.Body)
 				}
 				return true
 			})
@@ -1491,6 +1873,8 @@ func erasePrintCalls(node interface{}) {
 			x.Body = erasePrintCallsInBody(x.Body)
 		case *ObjectComprehension:
 			x.Body = erasePrintCallsInBody(x.Body)
+		case *Every:
+			x.Body = erasePrintCallsInBody(x.Body)
 		}
 		return false
 	}).Walk(node)
@@ -1540,7 +1924,7 @@ func isPrintCall(x *Expr) bool {
 	return x.IsCall() && x.Operator().Equal(Print.Ref())
 }
 
-// rewriteTermsInHead will rewrite rules so that the head does not contain any
+// rewriteRefsInHead will rewrite rules so that the head does not contain any
 // terms that require evaluation (e.g., refs or comprehensions). If the key or
 // value contains one or more of these terms, the key or value will be moved
 // into the body and assigned to a new variable. The new variable will replace
@@ -1598,87 +1982,350 @@ func (c *Compiler) rewriteDynamicTerms() {
 	}
 }
 
-func (c *Compiler) rewriteLocalVars() {
+func (c *Compiler) parseMetadataBlocks() {
+	// Only parse annotations if rego.metadata built-ins are called
+	regoMetadataCalled := false
+	for _, name := range c.sorted {
+		mod := c.Modules[name]
+		WalkExprs(mod, func(expr *Expr) bool {
+			if isRegoMetadataChainCall(expr) || isRegoMetadataRuleCall(expr) {
+				regoMetadataCalled = true
+			}
+			return regoMetadataCalled
+		})
+
+		if regoMetadataCalled {
+			break
+		}
+	}
+
+	if regoMetadataCalled {
+		// NOTE: Possible optimization: only parse annotations for modules on the path of rego.metadata-calling module
+		for _, name := range c.sorted {
+			mod := c.Modules[name]
+
+			if len(mod.Annotations) == 0 {
+				var errs Errors
+				mod.Annotations, errs = parseAnnotations(mod.Comments)
+				errs = append(errs, attachAnnotationsNodes(mod)...)
+				for _, err := range errs {
+					c.err(err)
+				}
+			}
+		}
+	}
+}
+
+func (c *Compiler) rewriteRegoMetadataCalls() {
+	eqFactory := newEqualityFactory(c.localvargen)
+
+	_, chainFuncAllowed := c.builtins[RegoMetadataChain.Name]
+	_, ruleFuncAllowed := c.builtins[RegoMetadataRule.Name]
 
 	for _, name := range c.sorted {
 		mod := c.Modules[name]
-		gen := c.localvargen
 
 		WalkRules(mod, func(rule *Rule) bool {
+			var firstChainCall *Expr
+			var firstRuleCall *Expr
+
+			WalkExprs(rule, func(expr *Expr) bool {
+				if chainFuncAllowed && firstChainCall == nil && isRegoMetadataChainCall(expr) {
+					firstChainCall = expr
+				} else if ruleFuncAllowed && firstRuleCall == nil && isRegoMetadataRuleCall(expr) {
+					firstRuleCall = expr
+				}
+				return firstChainCall != nil && firstRuleCall != nil
+			})
 
-			// Rewrite assignments contained in head of rule. Assignments can
-			// occur in rule head if they're inside a comprehension. Note,
-			// assigned vars in comprehensions in the head will be rewritten
-			// first to preserve scoping rules. For example:
-			//
-			// p = [x | x := 1] { x := 2 } becomes p = [__local0__ | __local0__ = 1] { __local1__ = 2 }
-			//
-			// This behaviour is consistent scoping inside the body. For example:
-			//
-			// p = xs { x := 2; xs = [x | x := 1] } becomes p = xs { __local0__ = 2; xs = [__local1__ | __local1__ = 1] }
-			nestedXform := &rewriteNestedHeadVarLocalTransform{
-				gen:           gen,
-				RewrittenVars: c.RewrittenVars,
-			}
+			chainCalled := firstChainCall != nil
+			ruleCalled := firstRuleCall != nil
 
-			NewGenericVisitor(nestedXform.Visit).Walk(rule.Head)
+			if chainCalled || ruleCalled {
+				body := make(Body, 0, len(rule.Body)+2)
 
-			for _, err := range nestedXform.errs {
-				c.err(err)
-			}
+				var metadataChainVar Var
+				if chainCalled {
+					// Create and inject metadata chain for rule
 
-			// Rewrite assignments in body.
-			used := NewVarSet()
+					chain, err := createMetadataChain(c.annotationSet.Chain(rule))
+					if err != nil {
+						c.err(err)
+						return false
+					}
 
-			if rule.Head.Key != nil {
-				used.Update(rule.Head.Key.Vars())
-			}
+					chain.Location = firstChainCall.Location
+					eq := eqFactory.Generate(chain)
+					metadataChainVar = eq.Operands()[0].Value.(Var)
+					body.Append(eq)
+				}
 
-			if rule.Head.Value != nil {
-				used.Update(rule.Head.Value.Vars())
-			}
+				var metadataRuleVar Var
+				if ruleCalled {
+					// Create and inject metadata for rule
 
-			stack := newLocalDeclaredVars()
+					var metadataRuleTerm *Term
 
-			c.rewriteLocalArgVars(gen, stack, rule)
+					a := getPrimaryRuleAnnotations(c.annotationSet, rule)
+					if a != nil {
+						annotObj, err := a.toObject()
+						if err != nil {
+							c.err(err)
+							return false
+						}
+						metadataRuleTerm = NewTerm(*annotObj)
+					} else {
+						// If rule has no annotations, assign an empty object
+						metadataRuleTerm = ObjectTerm()
+					}
 
-			body, declared, errs := rewriteLocalVars(gen, stack, used, rule.Body)
-			for _, err := range errs {
-				c.err(err)
+					metadataRuleTerm.Location = firstRuleCall.Location
+					eq := eqFactory.Generate(metadataRuleTerm)
+					metadataRuleVar = eq.Operands()[0].Value.(Var)
+					body.Append(eq)
+				}
+
+				for _, expr := range rule.Body {
+					body.Append(expr)
+				}
+				rule.Body = body
+
+				vis := func(b Body) bool {
+					for _, err := range rewriteRegoMetadataCalls(&metadataChainVar, &metadataRuleVar, b, &c.RewrittenVars) {
+						c.err(err)
+					}
+					return false
+				}
+				WalkBodies(rule.Head, vis)
+				WalkBodies(rule.Body, vis)
 			}
 
-			// For rewritten vars use the collection of all variables that
-			// were in the stack at some point in time.
-			for k, v := range stack.rewritten {
-				c.RewrittenVars[k] = v
+			return false
+		})
+	}
+}
+
+func getPrimaryRuleAnnotations(as *AnnotationSet, rule *Rule) *Annotations {
+	annots := as.GetRuleScope(rule)
+
+	if len(annots) == 0 {
+		return nil
+	}
+
+	// Sort by annotation location; chain must start with annotations declared closest to rule, then going outward
+	sort.SliceStable(annots, func(i, j int) bool {
+		return annots[i].Location.Compare(annots[j].Location) > 0
+	})
+
+	return annots[0]
+}
+
+func rewriteRegoMetadataCalls(metadataChainVar *Var, metadataRuleVar *Var, body Body, rewrittenVars *map[Var]Var) Errors {
+	var errs Errors
+
+	WalkClosures(body, func(x interface{}) bool {
+		switch x := x.(type) {
+		case *ArrayComprehension:
+			errs = rewriteRegoMetadataCalls(metadataChainVar, metadataRuleVar, x.Body, rewrittenVars)
+		case *SetComprehension:
+			errs = rewriteRegoMetadataCalls(metadataChainVar, metadataRuleVar, x.Body, rewrittenVars)
+		case *ObjectComprehension:
+			errs = rewriteRegoMetadataCalls(metadataChainVar, metadataRuleVar, x.Body, rewrittenVars)
+		case *Every:
+			errs = rewriteRegoMetadataCalls(metadataChainVar, metadataRuleVar, x.Body, rewrittenVars)
+		}
+		return true
+	})
+
+	for i := range body {
+		expr := body[i]
+		var metadataVar Var
+
+		if metadataChainVar != nil && isRegoMetadataChainCall(expr) {
+			metadataVar = *metadataChainVar
+		} else if metadataRuleVar != nil && isRegoMetadataRuleCall(expr) {
+			metadataVar = *metadataRuleVar
+		} else {
+			continue
+		}
+
+		// NOTE(johanfylling): An alternative strategy would be to walk the body and replace all operands[0]
+		// usages with *metadataChainVar
+		operands := expr.Operands()
+		var newExpr *Expr
+		if len(operands) > 0 { // There is an output var to rewrite
+			rewrittenVar := operands[0]
+			newExpr = Equality.Expr(rewrittenVar, NewTerm(metadataVar))
+		} else { // No output var, just rewrite expr to metadataVar
+			newExpr = NewExpr(NewTerm(metadataVar))
+		}
+
+		newExpr.Generated = true
+		newExpr.Location = expr.Location
+		body.Set(newExpr, i)
+	}
+
+	return errs
+}
+
+func isRegoMetadataChainCall(x *Expr) bool {
+	return x.IsCall() && x.Operator().Equal(RegoMetadataChain.Ref())
+}
+
+func isRegoMetadataRuleCall(x *Expr) bool {
+	return x.IsCall() && x.Operator().Equal(RegoMetadataRule.Ref())
+}
+
+func createMetadataChain(chain []*AnnotationsRef) (*Term, *Error) {
+
+	metaArray := NewArray()
+	for _, link := range chain {
+		p := link.Path.toArray().
+			Slice(1, -1) // Dropping leading 'data' element of path
+		obj := NewObject(
+			Item(StringTerm("path"), NewTerm(p)),
+		)
+		if link.Annotations != nil {
+			annotObj, err := link.Annotations.toObject()
+			if err != nil {
+				return nil, err
 			}
+			obj.Insert(StringTerm("annotations"), NewTerm(*annotObj))
+		}
+		metaArray = metaArray.Append(NewTerm(obj))
+	}
+
+	return NewTerm(metaArray), nil
+}
 
-			rule.Body = body
+func (c *Compiler) rewriteLocalVars() {
 
-			// Rewrite vars in head that refer to locally declared vars in the body.
-			localXform := rewriteHeadVarLocalTransform{declared: declared}
+	for _, name := range c.sorted {
+		mod := c.Modules[name]
+		gen := c.localvargen
+
+		WalkRules(mod, func(rule *Rule) bool {
+			argsStack := newLocalDeclaredVars()
 
-			for i := range rule.Head.Args {
-				rule.Head.Args[i], _ = transformTerm(localXform, rule.Head.Args[i])
+			args := NewVarVisitor()
+			if c.strict {
+				args.Walk(rule.Head.Args)
 			}
+			unusedArgs := args.Vars()
 
-			if rule.Head.Key != nil {
-				rule.Head.Key, _ = transformTerm(localXform, rule.Head.Key)
+			c.rewriteLocalArgVars(gen, argsStack, rule)
+
+			// Rewrite local vars in each else-branch of the rule.
+			// Note: this is done instead of a walk so that we can capture any unused function arguments
+			// across else-branches.
+			for rule := rule; rule != nil; rule = rule.Else {
+				stack, errs := c.rewriteLocalVarsInRule(rule, unusedArgs, argsStack, gen)
+
+				for arg := range unusedArgs {
+					if stack.Count(arg) > 1 {
+						delete(unusedArgs, arg)
+					}
+				}
+
+				for _, err := range errs {
+					c.err(err)
+				}
 			}
 
-			if rule.Head.Value != nil {
-				rule.Head.Value, _ = transformTerm(localXform, rule.Head.Value)
+			if c.strict {
+				// Report an error for each unused function argument
+				for arg := range unusedArgs {
+					if !arg.IsWildcard() {
+						c.err(NewError(CompileErr, rule.Head.Location, "unused argument %v", arg))
+					}
+				}
 			}
 
-			return false
+			return true
 		})
 	}
 }
 
+func (c *Compiler) rewriteLocalVarsInRule(rule *Rule, unusedArgs VarSet, argsStack *localDeclaredVars, gen *localVarGenerator) (*localDeclaredVars, Errors) {
+	// Rewrite assignments contained in head of rule. Assignments can
+	// occur in rule head if they're inside a comprehension. Note,
+	// assigned vars in comprehensions in the head will be rewritten
+	// first to preserve scoping rules. For example:
+	//
+	// p = [x | x := 1] { x := 2 } becomes p = [__local0__ | __local0__ = 1] { __local1__ = 2 }
+	//
+	// This behaviour is consistent scoping inside the body. For example:
+	//
+	// p = xs { x := 2; xs = [x | x := 1] } becomes p = xs { __local0__ = 2; xs = [__local1__ | __local1__ = 1] }
+	nestedXform := &rewriteNestedHeadVarLocalTransform{
+		gen:           gen,
+		RewrittenVars: c.RewrittenVars,
+		strict:        c.strict,
+	}
+
+	NewGenericVisitor(nestedXform.Visit).Walk(rule.Head)
+
+	for _, err := range nestedXform.errs {
+		c.err(err)
+	}
+
+	// Rewrite assignments in body.
+	used := NewVarSet()
+
+	last := rule.Head.Ref()[len(rule.Head.Ref())-1]
+	used.Update(last.Vars())
+
+	if rule.Head.Key != nil {
+		used.Update(rule.Head.Key.Vars())
+	}
+
+	if rule.Head.Value != nil {
+		valueVars := rule.Head.Value.Vars()
+		used.Update(valueVars)
+		for arg := range unusedArgs {
+			if valueVars.Contains(arg) {
+				delete(unusedArgs, arg)
+			}
+		}
+	}
+
+	stack := argsStack.Copy()
+
+	body, declared, errs := rewriteLocalVars(gen, stack, used, rule.Body, c.strict)
+
+	// For rewritten vars use the collection of all variables that
+	// were in the stack at some point in time.
+	for k, v := range stack.rewritten {
+		c.RewrittenVars[k] = v
+	}
+
+	rule.Body = body
+
+	// Rewrite vars in head that refer to locally declared vars in the body.
+	localXform := rewriteHeadVarLocalTransform{declared: declared}
+
+	for i := range rule.Head.Args {
+		rule.Head.Args[i], _ = transformTerm(localXform, rule.Head.Args[i])
+	}
+
+	for i := 1; i < len(rule.Head.Ref()); i++ {
+		rule.Head.Reference[i], _ = transformTerm(localXform, rule.Head.Ref()[i])
+	}
+	if rule.Head.Key != nil {
+		rule.Head.Key, _ = transformTerm(localXform, rule.Head.Key)
+	}
+
+	if rule.Head.Value != nil {
+		rule.Head.Value, _ = transformTerm(localXform, rule.Head.Value)
+	}
+	return stack, errs
+}
+
 type rewriteNestedHeadVarLocalTransform struct {
 	gen           *localVarGenerator
 	errs          Errors
 	RewrittenVars map[Var]Var
+	strict        bool
 }
 
 func (xform *rewriteNestedHeadVarLocalTransform) Visit(x interface{}) bool {
@@ -1708,13 +2355,13 @@ func (xform *rewriteNestedHeadVarLocalTransform) Visit(x interface{}) bool {
 			term.Value = cpy
 			stop = true
 		case *ArrayComprehension:
-			xform.errs = rewriteDeclaredVarsInArrayComprehension(xform.gen, stack, x, xform.errs)
+			xform.errs = rewriteDeclaredVarsInArrayComprehension(xform.gen, stack, x, xform.errs, xform.strict)
 			stop = true
 		case *SetComprehension:
-			xform.errs = rewriteDeclaredVarsInSetComprehension(xform.gen, stack, x, xform.errs)
+			xform.errs = rewriteDeclaredVarsInSetComprehension(xform.gen, stack, x, xform.errs, xform.strict)
 			stop = true
 		case *ObjectComprehension:
-			xform.errs = rewriteDeclaredVarsInObjectComprehension(xform.gen, stack, x, xform.errs)
+			xform.errs = rewriteDeclaredVarsInObjectComprehension(xform.gen, stack, x, xform.errs, xform.strict)
 			stop = true
 		}
 
@@ -1773,7 +2420,9 @@ func (vis *ruleArgLocalRewriter) Visit(x interface{}) Visitor {
 	switch v := t.Value.(type) {
 	case Var:
 		gv, ok := vis.stack.Declared(v)
-		if !ok {
+		if ok {
+			vis.stack.Seen(v)
+		} else {
 			gv = vis.gen.Generate()
 			vis.stack.Insert(v, gv, argVar)
 		}
@@ -1813,7 +2462,7 @@ func (c *Compiler) rewriteWithModifiers() {
 			if !ok {
 				return x, nil
 			}
-			body, err := rewriteWithModifiersInBody(c, f, body)
+			body, err := rewriteWithModifiersInBody(c, c.unsafeBuiltinsMap, f, body)
 			if err != nil {
 				c.err(err)
 			}
@@ -1860,6 +2509,11 @@ func newQueryCompiler(compiler *Compiler) QueryCompiler {
 	return qc
 }
 
+func (qc *queryCompiler) WithStrict(strict bool) QueryCompiler {
+	qc.compiler.WithStrict(strict)
+	return qc
+}
+
 func (qc *queryCompiler) WithEnablePrintStatements(yes bool) QueryCompiler {
 	qc.enablePrintStatements = yes
 	return qc
@@ -1921,6 +2575,7 @@ func (qc *queryCompiler) Compile(query Body) (Body, error) {
 		metricName string
 		f          func(*QueryContext, Body) (Body, error)
 	}{
+		{"CheckKeywordOverrides", "query_compile_stage_check_keyword_overrides", qc.checkKeywordOverrides},
 		{"ResolveRefs", "query_compile_stage_resolve_refs", qc.resolveRefs},
 		{"RewriteLocalVars", "query_compile_stage_rewrite_local_vars", qc.rewriteLocalVars},
 		{"CheckVoidCalls", "query_compile_stage_check_void_calls", qc.checkVoidCalls},
@@ -1933,6 +2588,7 @@ func (qc *queryCompiler) Compile(query Body) (Body, error) {
 		{"RewriteDynamicTerms", "query_compile_stage_rewrite_dynamic_terms", qc.rewriteDynamicTerms},
 		{"CheckTypes", "query_compile_stage_check_types", qc.checkTypes},
 		{"CheckUnsafeBuiltins", "query_compile_stage_check_unsafe_builtins", qc.checkUnsafeBuiltins},
+		{"CheckDeprecatedBuiltins", "query_compile_stage_check_deprecated_builtins", qc.checkDeprecatedBuiltins},
 		{"BuildComprehensionIndex", "query_compile_stage_build_comprehension_index", qc.buildComprehensionIndices},
 	}
 
@@ -1968,9 +2624,16 @@ func (qc *queryCompiler) applyErrorLimit(err error) error {
 	return err
 }
 
+func (qc *queryCompiler) checkKeywordOverrides(_ *QueryContext, body Body) (Body, error) {
+	if errs := checkKeywordOverrides(body, qc.compiler.strict); len(errs) > 0 {
+		return nil, errs
+	}
+	return body, nil
+}
+
 func (qc *queryCompiler) resolveRefs(qctx *QueryContext, body Body) (Body, error) {
 
-	var globals map[Var]Ref
+	var globals map[Var]*usedRef
 
 	if qctx != nil {
 		pkg := qctx.Package
@@ -1980,10 +2643,10 @@ func (qc *queryCompiler) resolveRefs(qctx *QueryContext, body Body) (Body, error
 			pkg = &Package{Path: RefTerm(VarTerm("")).Value.(Ref)}
 		}
 		if pkg != nil {
-			var ruleExports []Var
+			var ruleExports []Ref
 			rules := qc.compiler.getExports()
 			if exist, ok := rules.Get(pkg.Path); ok {
-				ruleExports = exist.([]Var)
+				ruleExports = exist.([]Ref)
 			}
 
 			globals = getGlobals(qctx.Package, ruleExports, qctx.Imports)
@@ -2020,7 +2683,7 @@ func (qc *queryCompiler) rewriteExprTerms(_ *QueryContext, body Body) (Body, err
 func (qc *queryCompiler) rewriteLocalVars(_ *QueryContext, body Body) (Body, error) {
 	gen := newLocalVarGenerator("q", body)
 	stack := newLocalDeclaredVars()
-	body, _, err := rewriteLocalVars(gen, stack, nil, body)
+	body, _, err := rewriteLocalVars(gen, stack, nil, body, qc.compiler.strict)
 	if len(err) != 0 {
 		return nil, err
 	}
@@ -2083,13 +2746,22 @@ func (qc *queryCompiler) checkTypes(_ *QueryContext, body Body) (Body, error) {
 }
 
 func (qc *queryCompiler) checkUnsafeBuiltins(_ *QueryContext, body Body) (Body, error) {
-	var unsafe map[string]struct{}
+	errs := checkUnsafeBuiltins(qc.unsafeBuiltinsMap(), body)
+	if len(errs) > 0 {
+		return nil, errs
+	}
+	return body, nil
+}
+
+func (qc *queryCompiler) unsafeBuiltinsMap() map[string]struct{} {
 	if qc.unsafeBuiltins != nil {
-		unsafe = qc.unsafeBuiltins
-	} else {
-		unsafe = qc.compiler.unsafeBuiltinsMap
+		return qc.unsafeBuiltins
 	}
-	errs := checkUnsafeBuiltins(unsafe, body)
+	return qc.compiler.unsafeBuiltinsMap
+}
+
+func (qc *queryCompiler) checkDeprecatedBuiltins(_ *QueryContext, body Body) (Body, error) {
+	errs := checkDeprecatedBuiltins(qc.compiler.deprecatedBuiltinsMap, body, qc.compiler.strict)
 	if len(errs) > 0 {
 		return nil, errs
 	}
@@ -2098,7 +2770,7 @@ func (qc *queryCompiler) checkUnsafeBuiltins(_ *QueryContext, body Body) (Body,
 
 func (qc *queryCompiler) rewriteWithModifiers(_ *QueryContext, body Body) (Body, error) {
 	f := newEqualityFactory(newLocalVarGenerator("q", body))
-	body, err := rewriteWithModifiersInBody(qc.compiler, f, body)
+	body, err := rewriteWithModifiersInBody(qc.compiler, qc.unsafeBuiltinsMap(), f, body)
 	if err != nil {
 		return nil, Errors{err}
 	}
@@ -2357,13 +3029,29 @@ type ModuleTreeNode struct {
 	Hide     bool
 }
 
+func (n *ModuleTreeNode) String() string {
+	var rules []string
+	for _, m := range n.Modules {
+		for _, r := range m.Rules {
+			rules = append(rules, r.Head.String())
+		}
+	}
+	return fmt.Sprintf("<ModuleTreeNode key:%v children:%v rules:%v hide:%v>", n.Key, n.Children, rules, n.Hide)
+}
+
 // NewModuleTree returns a new ModuleTreeNode that represents the root
 // of the module tree populated with the given modules.
 func NewModuleTree(mods map[string]*Module) *ModuleTreeNode {
 	root := &ModuleTreeNode{
 		Children: map[Value]*ModuleTreeNode{},
 	}
-	for _, m := range mods {
+	names := make([]string, 0, len(mods))
+	for name := range mods {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		m := mods[name]
 		node := root
 		for i, x := range m.Package.Path {
 			c, ok := node.Children[x.Value]
@@ -2395,13 +3083,43 @@ func (n *ModuleTreeNode) Size() int {
 	return s
 }
 
+// Child returns n's child with key k.
+func (n *ModuleTreeNode) child(k Value) *ModuleTreeNode {
+	switch k.(type) {
+	case String, Var:
+		return n.Children[k]
+	}
+	return nil
+}
+
+// Find dereferences ref along the tree. ref[0] is converted to a String
+// for convenience.
+func (n *ModuleTreeNode) find(ref Ref) (*ModuleTreeNode, Ref) {
+	if v, ok := ref[0].Value.(Var); ok {
+		ref = Ref{StringTerm(string(v))}.Concat(ref[1:])
+	}
+	node := n
+	for i, r := range ref {
+		next := node.child(r.Value)
+		if next == nil {
+			tail := make(Ref, len(ref)-i)
+			tail[0] = VarTerm(string(ref[i].Value.(String)))
+			copy(tail[1:], ref[i+1:])
+			return node, tail
+		}
+		node = next
+	}
+	return node, nil
+}
+
 // DepthFirst performs a depth-first traversal of the module tree rooted at n.
 // If f returns true, traversal will not continue to the children of n.
-func (n *ModuleTreeNode) DepthFirst(f func(node *ModuleTreeNode) bool) {
-	if !f(n) {
-		for _, node := range n.Children {
-			node.DepthFirst(f)
-		}
+func (n *ModuleTreeNode) DepthFirst(f func(*ModuleTreeNode) bool) {
+	if f(n) {
+		return
+	}
+	for _, node := range n.Children {
+		node.DepthFirst(f)
 	}
 }
 
@@ -2415,78 +3133,164 @@ type TreeNode struct {
 	Hide     bool
 }
 
+func (n *TreeNode) String() string {
+	return fmt.Sprintf("<TreeNode key:%v values:%v sorted:%v hide:%v>", n.Key, n.Values, n.Sorted, n.Hide)
+}
+
 // NewRuleTree returns a new TreeNode that represents the root
 // of the rule tree populated with the given rules.
 func NewRuleTree(mtree *ModuleTreeNode) *TreeNode {
+	root := TreeNode{
+		Key: mtree.Key,
+	}
+
+	mtree.DepthFirst(func(m *ModuleTreeNode) bool {
+		for _, mod := range m.Modules {
+			if len(mod.Rules) == 0 {
+				root.add(mod.Package.Path, nil)
+			}
+			for _, rule := range mod.Rules {
+				root.add(rule.Ref().GroundPrefix(), rule)
+			}
+		}
+		return false
+	})
 
-	ruleSets := map[String][]util.T{}
+	// ensure that data.system's TreeNode is hidden
+	node, tail := root.find(DefaultRootRef.Append(NewTerm(SystemDocumentKey)))
+	if len(tail) == 0 { // found
+		node.Hide = true
+	}
 
-	// Build rule sets for this package.
-	for _, mod := range mtree.Modules {
-		for _, rule := range mod.Rules {
-			key := String(rule.Head.Name)
-			ruleSets[key] = append(ruleSets[key], rule)
+	root.DepthFirst(func(x *TreeNode) bool {
+		x.sort()
+		return false
+	})
+
+	return &root
+}
+
+func (n *TreeNode) add(path Ref, rule *Rule) {
+	node, tail := n.find(path)
+	if len(tail) > 0 {
+		sub := treeNodeFromRef(tail, rule)
+		if node.Children == nil {
+			node.Children = make(map[Value]*TreeNode, 1)
+		}
+		node.Children[sub.Key] = sub
+		node.Sorted = append(node.Sorted, sub.Key)
+	} else {
+		if rule != nil {
+			node.Values = append(node.Values, rule)
 		}
 	}
+}
+
+// Size returns the number of rules in the tree.
+func (n *TreeNode) Size() int {
+	s := len(n.Values)
+	for _, c := range n.Children {
+		s += c.Size()
+	}
+	return s
+}
+
+// Child returns n's child with key k.
+func (n *TreeNode) Child(k Value) *TreeNode {
+	switch k.(type) {
+	case Ref, Call:
+		return nil
+	default:
+		return n.Children[k]
+	}
+}
 
-	// Each rule set becomes a leaf node.
-	children := map[Value]*TreeNode{}
-	sorted := make([]Value, 0, len(ruleSets))
+// Find dereferences ref along the tree
+func (n *TreeNode) Find(ref Ref) *TreeNode {
+	node := n
+	for _, r := range ref {
+		node = node.Child(r.Value)
+		if node == nil {
+			return nil
+		}
+	}
+	return node
+}
 
-	for key, rules := range ruleSets {
-		sorted = append(sorted, key)
-		children[key] = &TreeNode{
-			Key:      key,
-			Children: nil,
-			Values:   rules,
+// Iteratively dereferences ref along the node's subtree.
+// - If matching fails immediately, the tail will contain the full ref.
+// - Partial matching will result in a tail of non-zero length.
+// - A complete match will result in a 0 length tail.
+func (n *TreeNode) find(ref Ref) (*TreeNode, Ref) {
+	node := n
+	for i := range ref {
+		next := node.Child(ref[i].Value)
+		if next == nil {
+			tail := make(Ref, len(ref)-i)
+			copy(tail, ref[i:])
+			return node, tail
 		}
+		node = next
 	}
+	return node, nil
+}
 
-	// Each module in subpackage becomes child node.
-	for key, child := range mtree.Children {
-		sorted = append(sorted, key)
-		children[child.Key] = NewRuleTree(child)
+// DepthFirst performs a depth-first traversal of the rule tree rooted at n. If
+// f returns true, traversal will not continue to the children of n.
+func (n *TreeNode) DepthFirst(f func(*TreeNode) bool) {
+	if f(n) {
+		return
+	}
+	for _, node := range n.Children {
+		node.DepthFirst(f)
 	}
+}
 
-	sort.Slice(sorted, func(i, j int) bool {
-		return sorted[i].Compare(sorted[j]) < 0
+func (n *TreeNode) sort() {
+	sort.Slice(n.Sorted, func(i, j int) bool {
+		return n.Sorted[i].Compare(n.Sorted[j]) < 0
 	})
-
-	return &TreeNode{
-		Key:      mtree.Key,
-		Values:   nil,
-		Children: children,
-		Sorted:   sorted,
-		Hide:     mtree.Hide,
-	}
 }
 
-// Size returns the number of rules in the tree.
-func (n *TreeNode) Size() int {
-	s := len(n.Values)
-	for _, c := range n.Children {
-		s += c.Size()
+func treeNodeFromRef(ref Ref, rule *Rule) *TreeNode {
+	depth := len(ref) - 1
+	key := ref[depth].Value
+	node := &TreeNode{
+		Key:      key,
+		Children: nil,
+	}
+	if rule != nil {
+		node.Values = []util.T{rule}
 	}
-	return s
-}
 
-// Child returns n's child with key k.
-func (n *TreeNode) Child(k Value) *TreeNode {
-	switch k.(type) {
-	case String, Var:
-		return n.Children[k]
+	for i := len(ref) - 2; i >= 0; i-- {
+		key := ref[i].Value
+		node = &TreeNode{
+			Key:      key,
+			Children: map[Value]*TreeNode{ref[i+1].Value: node},
+			Sorted:   []Value{ref[i+1].Value},
+		}
 	}
-	return nil
+	return node
 }
 
-// DepthFirst performs a depth-first traversal of the rule tree rooted at n. If
-// f returns true, traversal will not continue to the children of n.
-func (n *TreeNode) DepthFirst(f func(node *TreeNode) bool) {
-	if !f(n) {
-		for _, node := range n.Children {
-			node.DepthFirst(f)
-		}
+// flattenChildren flattens all children's rule refs into a sorted array.
+func (n *TreeNode) flattenChildren() []Ref {
+	ret := newRefSet()
+	for _, sub := range n.Children { // we only want the children, so don't use n.DepthFirst() right away
+		sub.DepthFirst(func(x *TreeNode) bool {
+			for _, r := range x.Values {
+				rule := r.(*Rule)
+				ret.AddPrefix(rule.Ref())
+			}
+			return false
+		})
 	}
+
+	sort.Slice(ret.s, func(i, j int) bool {
+		return ret.s[i].Compare(ret.s[j]) < 0
+	})
+	return ret.s
 }
 
 // Graph represents the graph of dependencies between rules.
@@ -2532,7 +3336,7 @@ func NewGraph(modules map[string]*Module, list func(Ref) []*Rule) *Graph {
 		})
 	}
 
-	// Walk over all rules, add them to graph, and build adjencency lists.
+	// Walk over all rules, add them to graph, and build adjacency lists.
 	for _, module := range modules {
 		WalkRules(module, func(a *Rule) bool {
 			graph.addNode(a)
@@ -2752,13 +3556,10 @@ func (vs unsafeVars) Slice() (result []unsafePair) {
 // contains a mapping of expressions to unsafe variables in those expressions.
 func reorderBodyForSafety(builtins map[string]*Builtin, arity func(Ref) int, globals VarSet, body Body) (Body, unsafeVars) {
 
-	body, unsafe := reorderBodyForClosures(arity, globals, body)
-	if len(unsafe) != 0 {
-		return nil, unsafe
-	}
-
-	reordered := Body{}
+	bodyVars := body.Vars(SafetyCheckVisitorParams)
+	reordered := make(Body, 0, len(body))
 	safe := VarSet{}
+	unsafe := unsafeVars{}
 
 	for _, e := range body {
 		for v := range e.Vars(SafetyCheckVisitorParams) {
@@ -2778,10 +3579,23 @@ func reorderBodyForSafety(builtins map[string]*Builtin, arity func(Ref) int, glo
 				continue
 			}
 
-			safe.Update(outputVarsForExpr(e, arity, safe))
+			ovs := outputVarsForExpr(e, arity, safe)
+
+			// check closures: is this expression closing over variables that
+			// haven't been made safe by what's already included in `reordered`?
+			vs := unsafeVarsInClosures(e, arity, safe)
+			cv := vs.Intersect(bodyVars).Diff(globals)
+			uv := cv.Diff(outputVarsForBody(reordered, arity, safe))
+
+			if len(uv) > 0 {
+				if uv.Equal(ovs) { // special case "closure-self"
+					continue
+				}
+				unsafe.Set(e, uv)
+			}
 
 			for v := range unsafe[e] {
-				if safe.Contains(v) {
+				if ovs.Contains(v) || safe.Contains(v) {
 					delete(unsafe[e], v)
 				}
 			}
@@ -2789,10 +3603,11 @@ func reorderBodyForSafety(builtins map[string]*Builtin, arity func(Ref) int, glo
 			if len(unsafe[e]) == 0 {
 				delete(unsafe, e)
 				reordered.Append(e)
+				safe.Update(ovs) // this expression's outputs are safe
 			}
 		}
 
-		if len(reordered) == n {
+		if len(reordered) == n { // fixed point, could not add any expr of body
 			break
 		}
 	}
@@ -2827,7 +3642,8 @@ type bodySafetyTransformer struct {
 }
 
 func (xform *bodySafetyTransformer) Visit(x interface{}) bool {
-	if term, ok := x.(*Term); ok {
+	switch term := x.(type) {
+	case *Term:
 		switch x := term.Value.(type) {
 		case *object:
 			cpy, _ := x.Map(func(k, v *Term) (*Term, *Term, error) {
@@ -2857,6 +3673,12 @@ func (xform *bodySafetyTransformer) Visit(x interface{}) bool {
 			xform.reorderSetComprehensionSafety(x)
 			return true
 		}
+	case *Expr:
+		if ev, ok := term.Terms.(*Every); ok {
+			xform.globals.Update(ev.KeyValueVars())
+			ev.Body = xform.reorderComprehensionSafety(NewVarSet(), ev.Body)
+			return true
+		}
 	}
 	return false
 }
@@ -2892,51 +3714,20 @@ func (xform *bodySafetyTransformer) reorderSetComprehensionSafety(sc *SetCompreh
 	sc.Body = xform.reorderComprehensionSafety(sc.Term.Vars(), sc.Body)
 }
 
-// reorderBodyForClosures returns a copy of the body ordered such that
-// expressions (such as array comprehensions) that close over variables are ordered
-// after other expressions that contain the same variable in an output position.
-func reorderBodyForClosures(arity func(Ref) int, globals VarSet, body Body) (Body, unsafeVars) {
-
-	reordered := Body{}
-	unsafe := unsafeVars{}
-
-	for {
-		n := len(reordered)
-
-		for _, e := range body {
-			if reordered.Contains(e) {
-				continue
-			}
-
-			// Collect vars that are contained in closures within this
-			// expression.
-			vs := VarSet{}
-			WalkClosures(e, func(x interface{}) bool {
-				vis := &VarVisitor{vars: vs}
-				vis.Walk(x)
-				return true
-			})
-
-			// Compute vars that are closed over from the body but not yet
-			// contained in the output position of an expression in the reordered
-			// body. These vars are considered unsafe.
-			cv := vs.Intersect(body.Vars(SafetyCheckVisitorParams)).Diff(globals)
-			uv := cv.Diff(outputVarsForBody(reordered, arity, globals))
-
-			if len(uv) == 0 {
-				reordered = append(reordered, e)
-				delete(unsafe, e)
-			} else {
-				unsafe.Set(e, uv)
-			}
-		}
-
-		if len(reordered) == n {
-			break
+// unsafeVarsInClosures collects vars that are contained in closures within
+// this expression.
+func unsafeVarsInClosures(e *Expr, arity func(Ref) int, safe VarSet) VarSet {
+	vs := VarSet{}
+	WalkClosures(e, func(x interface{}) bool {
+		vis := &VarVisitor{vars: vs}
+		if ev, ok := x.(*Every); ok {
+			vis.Walk(ev.Body)
+			return true
 		}
-	}
-
-	return reordered, unsafe
+		vis.Walk(x)
+		return true
+	})
+	return vs
 }
 
 // OutputVarsFromBody returns all variables which are the "output" for
@@ -2970,15 +3761,11 @@ func outputVarsForExpr(expr *Expr, arity func(Ref) int, safe VarSet) VarSet {
 
 	// With modifier inputs must be safe.
 	for _, with := range expr.With {
-		unsafe := false
-		WalkVars(with, func(v Var) bool {
-			if !safe.Contains(v) {
-				unsafe = true
-				return true
-			}
-			return false
-		})
-		if unsafe {
+		vis := NewVarVisitor().WithParams(SafetyCheckVisitorParams)
+		vis.Walk(with)
+		vars := vis.Vars()
+		unsafe := vars.Diff(safe)
+		if len(unsafe) > 0 {
 			return VarSet{}
 		}
 	}
@@ -3002,6 +3789,8 @@ func outputVarsForExpr(expr *Expr, arity func(Ref) int, safe VarSet) VarSet {
 		}
 
 		return outputVarsForExprCall(expr, ar, safe, terms)
+	case *Every:
+		return outputVarsForTerms(terms.Domain, safe)
 	default:
 		panic("illegal expression")
 	}
@@ -3029,13 +3818,13 @@ func outputVarsForExprCall(expr *Expr, arity int, safe VarSet, terms []*Term) Va
 		return output
 	}
 
-	vis := NewVarVisitor().WithParams(VarVisitorParams{
+	params := VarVisitorParams{
 		SkipClosures:   true,
 		SkipSets:       true,
 		SkipObjectKeys: true,
 		SkipRefHead:    true,
-	})
-
+	}
+	vis := NewVarVisitor().WithParams(params)
 	vis.Walk(Args(terms[:numInputTerms]))
 	unsafe := vis.Vars().Diff(output).Diff(safe)
 
@@ -3043,19 +3832,13 @@ func outputVarsForExprCall(expr *Expr, arity int, safe VarSet, terms []*Term) Va
 		return VarSet{}
 	}
 
-	vis = NewVarVisitor().WithParams(VarVisitorParams{
-		SkipRefHead:    true,
-		SkipSets:       true,
-		SkipObjectKeys: true,
-		SkipClosures:   true,
-	})
-
+	vis = NewVarVisitor().WithParams(params)
 	vis.Walk(Args(terms[numInputTerms:]))
 	output.Update(vis.vars)
 	return output
 }
 
-func outputVarsForTerms(expr *Expr, safe VarSet) VarSet {
+func outputVarsForTerms(expr interface{}, safe VarSet) VarSet {
 	output := VarSet{}
 	WalkTerms(expr, func(x *Term) bool {
 		switch r := x.Value.(type) {
@@ -3121,31 +3904,23 @@ func (l *localVarGenerator) Generate() Var {
 	}
 }
 
-func getGlobals(pkg *Package, rules []Var, imports []*Import) map[Var]Ref {
+func getGlobals(pkg *Package, rules []Ref, imports []*Import) map[Var]*usedRef {
 
-	globals := map[Var]Ref{}
+	globals := make(map[Var]*usedRef, len(rules)) // NB: might grow bigger with imports
 
 	// Populate globals with exports within the package.
-	for _, v := range rules {
-		global := append(Ref{}, pkg.Path...)
-		global = append(global, &Term{Value: String(v)})
-		globals[v] = global
+	for _, ref := range rules {
+		v := ref[0].Value.(Var)
+		globals[v] = &usedRef{ref: pkg.Path.Append(StringTerm(string(v)))}
 	}
 
 	// Populate globals with imports.
-	for _, i := range imports {
-		if len(i.Alias) > 0 {
-			path := i.Path.Value.(Ref)
-			globals[i.Alias] = path
-		} else {
-			path := i.Path.Value.(Ref)
-			if len(path) == 1 {
-				globals[path[0].Value.(Var)] = path
-			} else {
-				v := path[len(path)-1].Value.(String)
-				globals[Var(v)] = path
-			}
+	for _, imp := range imports {
+		path := imp.Path.Value.(Ref)
+		if FutureRootDocument.Equal(path[0]) {
+			continue // ignore future imports
 		}
+		globals[imp.Name()] = &usedRef{ref: path}
 	}
 
 	return globals
@@ -3158,14 +3933,14 @@ func requiresEval(x *Term) bool {
 	return ContainsRefs(x) || ContainsComprehensions(x)
 }
 
-func resolveRef(globals map[Var]Ref, ignore *declaredVarStack, ref Ref) Ref {
+func resolveRef(globals map[Var]*usedRef, ignore *declaredVarStack, ref Ref) Ref {
 
 	r := Ref{}
 	for i, x := range ref {
 		switch v := x.Value.(type) {
 		case Var:
 			if g, ok := globals[v]; ok && !ignore.Contains(v) {
-				cpy := g.Copy()
+				cpy := g.ref.Copy()
 				for i := range cpy {
 					cpy[i].SetLocation(x.Location)
 				}
@@ -3174,6 +3949,7 @@ func resolveRef(globals map[Var]Ref, ignore *declaredVarStack, ref Ref) Ref {
 				} else {
 					r = append(r, NewTerm(cpy).SetLocation(x.Location))
 				}
+				g.used = true
 			} else {
 				r = append(r, x)
 			}
@@ -3187,7 +3963,12 @@ func resolveRef(globals map[Var]Ref, ignore *declaredVarStack, ref Ref) Ref {
 	return r
 }
 
-func resolveRefsInRule(globals map[Var]Ref, rule *Rule) error {
+type usedRef struct {
+	ref  Ref
+	used bool
+}
+
+func resolveRefsInRule(globals map[Var]*usedRef, rule *Rule) error {
 	ignore := &declaredVarStack{}
 
 	vars := NewVarSet()
@@ -3238,6 +4019,10 @@ func resolveRefsInRule(globals map[Var]Ref, rule *Rule) error {
 	ignore.Push(vars)
 	ignore.Push(declaredVars(rule.Body))
 
+	ref := rule.Head.Ref()
+	for i := 1; i < len(ref); i++ {
+		ref[i] = resolveRefsInTerm(globals, ignore, ref[i])
+	}
 	if rule.Head.Key != nil {
 		rule.Head.Key = resolveRefsInTerm(globals, ignore, rule.Head.Key)
 	}
@@ -3250,15 +4035,15 @@ func resolveRefsInRule(globals map[Var]Ref, rule *Rule) error {
 	return nil
 }
 
-func resolveRefsInBody(globals map[Var]Ref, ignore *declaredVarStack, body Body) Body {
-	r := Body{}
+func resolveRefsInBody(globals map[Var]*usedRef, ignore *declaredVarStack, body Body) Body {
+	r := make([]*Expr, 0, len(body))
 	for _, expr := range body {
 		r = append(r, resolveRefsInExpr(globals, ignore, expr))
 	}
 	return r
 }
 
-func resolveRefsInExpr(globals map[Var]Ref, ignore *declaredVarStack, expr *Expr) *Expr {
+func resolveRefsInExpr(globals map[Var]*usedRef, ignore *declaredVarStack, expr *Expr) *Expr {
 	cpy := *expr
 	switch ts := expr.Terms.(type) {
 	case *Term:
@@ -3273,6 +4058,20 @@ func resolveRefsInExpr(globals map[Var]Ref, ignore *declaredVarStack, expr *Expr
 		if val, ok := ts.Symbols[0].Value.(Call); ok {
 			cpy.Terms = &SomeDecl{Symbols: []*Term{CallTerm(resolveRefsInTermSlice(globals, ignore, val)...)}}
 		}
+	case *Every:
+		locals := NewVarSet()
+		if ts.Key != nil {
+			locals.Update(ts.Key.Vars())
+		}
+		locals.Update(ts.Value.Vars())
+		ignore.Push(locals)
+		cpy.Terms = &Every{
+			Key:    ts.Key.Copy(),   // TODO(sr): do more?
+			Value:  ts.Value.Copy(), // TODO(sr): do more?
+			Domain: resolveRefsInTerm(globals, ignore, ts.Domain),
+			Body:   resolveRefsInBody(globals, ignore, ts.Body),
+		}
+		ignore.Pop()
 	}
 	for _, w := range cpy.With {
 		w.Target = resolveRefsInTerm(globals, ignore, w.Target)
@@ -3281,14 +4080,15 @@ func resolveRefsInExpr(globals map[Var]Ref, ignore *declaredVarStack, expr *Expr
 	return &cpy
 }
 
-func resolveRefsInTerm(globals map[Var]Ref, ignore *declaredVarStack, term *Term) *Term {
+func resolveRefsInTerm(globals map[Var]*usedRef, ignore *declaredVarStack, term *Term) *Term {
 	switch v := term.Value.(type) {
 	case Var:
 		if g, ok := globals[v]; ok && !ignore.Contains(v) {
-			cpy := g.Copy()
+			cpy := g.ref.Copy()
 			for i := range cpy {
 				cpy[i].SetLocation(term.Location)
 			}
+			g.used = true
 			return NewTerm(cpy).SetLocation(term.Location)
 		}
 		return term
@@ -3353,7 +4153,7 @@ func resolveRefsInTerm(globals map[Var]Ref, ignore *declaredVarStack, term *Term
 	}
 }
 
-func resolveRefsInTermArray(globals map[Var]Ref, ignore *declaredVarStack, terms *Array) []*Term {
+func resolveRefsInTermArray(globals map[Var]*usedRef, ignore *declaredVarStack, terms *Array) []*Term {
 	cpy := make([]*Term, terms.Len())
 	for i := 0; i < terms.Len(); i++ {
 		cpy[i] = resolveRefsInTerm(globals, ignore, terms.Elem(i))
@@ -3361,7 +4161,7 @@ func resolveRefsInTermArray(globals map[Var]Ref, ignore *declaredVarStack, terms
 	return cpy
 }
 
-func resolveRefsInTermSlice(globals map[Var]Ref, ignore *declaredVarStack, terms []*Term) []*Term {
+func resolveRefsInTermSlice(globals map[Var]*usedRef, ignore *declaredVarStack, terms []*Term) []*Term {
 	cpy := make([]*Term, len(terms))
 	for i := 0; i < len(terms); i++ {
 		cpy[i] = resolveRefsInTerm(globals, ignore, terms[i])
@@ -3520,11 +4320,14 @@ func rewriteEquals(x interface{}) {
 func rewriteDynamics(f *equalityFactory, body Body) Body {
 	result := make(Body, 0, len(body))
 	for _, expr := range body {
-		if expr.IsEquality() {
+		switch {
+		case expr.IsEquality():
 			result = rewriteDynamicsEqExpr(f, expr, result)
-		} else if expr.IsCall() {
+		case expr.IsCall():
 			result = rewriteDynamicsCallExpr(f, expr, result)
-		} else {
+		case expr.IsEvery():
+			result = rewriteDynamicsEveryExpr(f, expr, result)
+		default:
 			result = rewriteDynamicsTermExpr(f, expr, result)
 		}
 	}
@@ -3554,6 +4357,13 @@ func rewriteDynamicsCallExpr(f *equalityFactory, expr *Expr, result Body) Body {
 	return appendExpr(result, expr)
 }
 
+func rewriteDynamicsEveryExpr(f *equalityFactory, expr *Expr, result Body) Body {
+	ev := expr.Terms.(*Every)
+	result, ev.Domain = rewriteDynamicsOne(expr, f, ev.Domain, result)
+	ev.Body = rewriteDynamics(f, ev.Body)
+	return appendExpr(result, expr)
+}
+
 func rewriteDynamicsTermExpr(f *equalityFactory, expr *Expr, result Body) Body {
 	term := expr.Terms.(*Term)
 	result, expr.Terms = rewriteDynamicsInTerm(expr, f, term, result)
@@ -3700,6 +4510,21 @@ func expandExpr(gen *localVarGenerator, expr *Expr) (result []*Expr) {
 			result = append(result, extras...)
 		}
 		result = append(result, expr)
+	case *Every:
+		var extras []*Expr
+		if _, ok := terms.Domain.Value.(Call); ok {
+			extras, terms.Domain = expandExprTerm(gen, terms.Domain)
+		} else {
+			term := NewTerm(gen.Generate()).SetLocation(terms.Domain.Location)
+			eq := Equality.Expr(term, terms.Domain).SetLocation(terms.Domain.Location)
+			eq.Generated = true
+			eq.With = expr.With
+			extras = append(extras, eq)
+			terms.Domain = term
+		}
+		terms.Body = rewriteExprTermsInBody(gen, terms.Body)
+		result = append(result, extras...)
+		result = append(result, expr)
 	}
 	return
 }
@@ -3817,8 +4642,8 @@ type localDeclaredVars struct {
 
 	// rewritten contains a mapping of *all* user-defined variables
 	// that have been rewritten whereas vars contains the state
-	// from the current query (not not any nested queries, and all
-	// vars seen).
+	// from the current query (not any nested queries, and all vars
+	// seen).
 	rewritten map[Var]Var
 }
 
@@ -3836,6 +4661,7 @@ type declaredVarSet struct {
 	vs         map[Var]Var
 	reverse    map[Var]Var
 	occurrence map[Var]varOccurrence
+	count      map[Var]int
 }
 
 func newDeclaredVarSet() *declaredVarSet {
@@ -3843,6 +4669,7 @@ func newDeclaredVarSet() *declaredVarSet {
 		vs:         map[Var]Var{},
 		reverse:    map[Var]Var{},
 		occurrence: map[Var]varOccurrence{},
+		count:      map[Var]int{},
 	}
 }
 
@@ -3853,6 +4680,35 @@ func newLocalDeclaredVars() *localDeclaredVars {
 	}
 }
 
+func (s *localDeclaredVars) Copy() *localDeclaredVars {
+	stack := &localDeclaredVars{
+		vars:      []*declaredVarSet{},
+		rewritten: map[Var]Var{},
+	}
+
+	for i := range s.vars {
+		stack.vars = append(stack.vars, newDeclaredVarSet())
+		for k, v := range s.vars[i].vs {
+			stack.vars[0].vs[k] = v
+		}
+		for k, v := range s.vars[i].reverse {
+			stack.vars[0].reverse[k] = v
+		}
+		for k, v := range s.vars[i].count {
+			stack.vars[0].count[k] = v
+		}
+		for k, v := range s.vars[i].occurrence {
+			stack.vars[0].occurrence[k] = v
+		}
+	}
+
+	for k, v := range s.rewritten {
+		stack.rewritten[k] = v
+	}
+
+	return stack
+}
+
 func (s *localDeclaredVars) Push() {
 	s.vars = append(s.vars, newDeclaredVarSet())
 }
@@ -3874,6 +4730,8 @@ func (s localDeclaredVars) Insert(x, y Var, occurrence varOccurrence) {
 	elem.reverse[y] = x
 	elem.occurrence[x] = occurrence
 
+	elem.count[x] = 1
+
 	// If the variable has been rewritten (where x != y, with y being
 	// the generated value), store it in the map of rewritten vars.
 	// Assume that the generated values are unique for the compilation.
@@ -3908,6 +4766,30 @@ func (s localDeclaredVars) GlobalOccurrence(x Var) (varOccurrence, bool) {
 	return newVar, false
 }
 
+// Seen marks x as seen by incrementing its counter
+func (s localDeclaredVars) Seen(x Var) {
+	for i := len(s.vars) - 1; i >= 0; i-- {
+		dvs := s.vars[i]
+		if c, ok := dvs.count[x]; ok {
+			dvs.count[x] = c + 1
+			return
+		}
+	}
+
+	s.vars[len(s.vars)-1].count[x] = 1
+}
+
+// Count returns how many times x has been seen
+func (s localDeclaredVars) Count(x Var) int {
+	for i := len(s.vars) - 1; i >= 0; i-- {
+		if c, ok := s.vars[i].count[x]; ok {
+			return c
+		}
+	}
+
+	return 0
+}
+
 // rewriteLocalVars rewrites bodies to remove assignment/declaration
 // expressions. For example:
 //
@@ -3918,24 +4800,27 @@ func (s localDeclaredVars) GlobalOccurrence(x Var) (varOccurrence, bool) {
 // __local0__ = 1; p[__local0__]
 //
 // During rewriting, assignees are validated to prevent use before declaration.
-func rewriteLocalVars(g *localVarGenerator, stack *localDeclaredVars, used VarSet, body Body) (Body, map[Var]Var, Errors) {
+func rewriteLocalVars(g *localVarGenerator, stack *localDeclaredVars, used VarSet, body Body, strict bool) (Body, map[Var]Var, Errors) {
 	var errs Errors
-	body, errs = rewriteDeclaredVarsInBody(g, stack, used, body, errs)
-	return body, stack.Pop().vs, errs
+	body, errs = rewriteDeclaredVarsInBody(g, stack, used, body, errs, strict)
+	return body, stack.Peek().vs, errs
 }
 
-func rewriteDeclaredVarsInBody(g *localVarGenerator, stack *localDeclaredVars, used VarSet, body Body, errs Errors) (Body, Errors) {
+func rewriteDeclaredVarsInBody(g *localVarGenerator, stack *localDeclaredVars, used VarSet, body Body, errs Errors, strict bool) (Body, Errors) {
 
 	var cpy Body
 
 	for i := range body {
 		var expr *Expr
-		if body[i].IsAssignment() {
-			expr, errs = rewriteDeclaredAssignment(g, stack, body[i], errs)
-		} else if _, ok := body[i].Terms.(*SomeDecl); ok {
-			expr, errs = rewriteSomeDeclStatement(g, stack, body[i], errs)
-		} else {
-			expr, errs = rewriteDeclaredVarsInExpr(g, stack, body[i], errs)
+		switch {
+		case body[i].IsAssignment():
+			expr, errs = rewriteDeclaredAssignment(g, stack, body[i], errs, strict)
+		case body[i].IsSome():
+			expr, errs = rewriteSomeDeclStatement(g, stack, body[i], errs, strict)
+		case body[i].IsEvery():
+			expr, errs = rewriteEveryStatement(g, stack, body[i], errs, strict)
+		default:
+			expr, errs = rewriteDeclaredVarsInExpr(g, stack, body[i], errs, strict)
 		}
 		if expr != nil {
 			cpy.Append(expr)
@@ -3949,10 +4834,56 @@ func rewriteDeclaredVarsInBody(g *localVarGenerator, stack *localDeclaredVars, u
 		cpy.Append(NewExpr(BooleanTerm(true)))
 	}
 
-	return cpy, checkUnusedDeclaredVars(body[0].Loc(), stack, used, cpy, errs)
+	errs = checkUnusedAssignedVars(body, stack, used, errs, strict)
+	return cpy, checkUnusedDeclaredVars(body, stack, used, cpy, errs)
+}
+
+func checkUnusedAssignedVars(body Body, stack *localDeclaredVars, used VarSet, errs Errors, strict bool) Errors {
+
+	if !strict || len(errs) > 0 {
+		return errs
+	}
+
+	dvs := stack.Peek()
+	unused := NewVarSet()
+
+	for v, occ := range dvs.occurrence {
+		// A var that was assigned in this scope must have been seen (used) more than once (the time of assignment) in
+		// the same, or nested, scope to be counted as used.
+		if !v.IsWildcard() && stack.Count(v) <= 1 && occ == assignedVar {
+			unused.Add(dvs.vs[v])
+		}
+	}
+
+	rewrittenUsed := NewVarSet()
+	for v := range used {
+		if gv, ok := stack.Declared(v); ok {
+			rewrittenUsed.Add(gv)
+		} else {
+			rewrittenUsed.Add(v)
+		}
+	}
+
+	unused = unused.Diff(rewrittenUsed)
+
+	for _, gv := range unused.Sorted() {
+		found := false
+		for i := range body {
+			if body[i].Vars(VarVisitorParams{}).Contains(gv) {
+				errs = append(errs, NewError(CompileErr, body[i].Loc(), "assigned var %v unused", dvs.reverse[gv]))
+				found = true
+				break
+			}
+		}
+		if !found {
+			errs = append(errs, NewError(CompileErr, body[0].Loc(), "assigned var %v unused", dvs.reverse[gv]))
+		}
+	}
+
+	return errs
 }
 
-func checkUnusedDeclaredVars(loc *Location, stack *localDeclaredVars, used VarSet, cpy Body, errs Errors) Errors {
+func checkUnusedDeclaredVars(body Body, stack *localDeclaredVars, used VarSet, cpy Body, errs Errors) Errors {
 
 	// NOTE(tsandall): Do not generate more errors if there are existing
 	// declaration errors.
@@ -3982,13 +4913,69 @@ func checkUnusedDeclaredVars(loc *Location, stack *localDeclaredVars, used VarSe
 	unused := declared.Diff(bodyvars).Diff(used)
 
 	for _, gv := range unused.Sorted() {
-		errs = append(errs, NewError(CompileErr, loc, "declared var %v unused", dvs.reverse[gv]))
+		rv := dvs.reverse[gv]
+		if !rv.IsGenerated() {
+			// Scan through body exprs, looking for a match between the
+			// bad var's original name, and each expr's declared vars.
+			foundUnusedVarByName := false
+			for i := range body {
+				varsDeclaredInExpr := declaredVars(body[i])
+				if varsDeclaredInExpr.Contains(dvs.reverse[gv]) {
+					// TODO(philipc): Clean up the offset logic here when the parser
+					// reports more accurate locations.
+					errs = append(errs, NewError(CompileErr, body[i].Loc(), "declared var %v unused", dvs.reverse[gv]))
+					foundUnusedVarByName = true
+					break
+				}
+			}
+			// Default error location returned.
+			if !foundUnusedVarByName {
+				errs = append(errs, NewError(CompileErr, body[0].Loc(), "declared var %v unused", dvs.reverse[gv]))
+			}
+		}
 	}
 
 	return errs
 }
 
-func rewriteSomeDeclStatement(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors) (*Expr, Errors) {
+func rewriteEveryStatement(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors, strict bool) (*Expr, Errors) {
+	e := expr.Copy()
+	every := e.Terms.(*Every)
+
+	errs = rewriteDeclaredVarsInTermRecursive(g, stack, every.Domain, errs, strict)
+
+	stack.Push()
+	defer stack.Pop()
+
+	// if the key exists, rewrite
+	if every.Key != nil {
+		if v := every.Key.Value.(Var); !v.IsWildcard() {
+			gv, err := rewriteDeclaredVar(g, stack, v, declaredVar)
+			if err != nil {
+				return nil, append(errs, NewError(CompileErr, every.Loc(), err.Error()))
+			}
+			every.Key.Value = gv
+		}
+	} else { // if the key doesn't exist, add dummy local
+		every.Key = NewTerm(g.Generate())
+	}
+
+	// value is always present
+	if v := every.Value.Value.(Var); !v.IsWildcard() {
+		gv, err := rewriteDeclaredVar(g, stack, v, declaredVar)
+		if err != nil {
+			return nil, append(errs, NewError(CompileErr, every.Loc(), err.Error()))
+		}
+		every.Value.Value = gv
+	}
+
+	used := NewVarSet()
+	every.Body, errs = rewriteDeclaredVarsInBody(g, stack, used, every.Body, errs, strict)
+
+	return rewriteDeclaredVarsInExpr(g, stack, e, errs, strict)
+}
+
+func rewriteSomeDeclStatement(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors, strict bool) (*Expr, Errors) {
 	e := expr.Copy()
 	decl := e.Terms.(*SomeDecl)
 	for i := range decl.Symbols {
@@ -4026,20 +5013,20 @@ func rewriteSomeDeclStatement(g *localVarGenerator, stack *localDeclaredVars, ex
 					return nil, append(errs, NewError(CompileErr, decl.Loc(), err.Error()))
 				}
 			}
-			return rewriteDeclaredVarsInExpr(g, stack, e, errs)
+			return rewriteDeclaredVarsInExpr(g, stack, e, errs, strict)
 		}
 	}
 	return nil, errs
 }
 
-func rewriteDeclaredVarsInExpr(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors) (*Expr, Errors) {
+func rewriteDeclaredVarsInExpr(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors, strict bool) (*Expr, Errors) {
 	vis := NewGenericVisitor(func(x interface{}) bool {
 		var stop bool
 		switch x := x.(type) {
 		case *Term:
-			stop, errs = rewriteDeclaredVarsInTerm(g, stack, x, errs)
+			stop, errs = rewriteDeclaredVarsInTerm(g, stack, x, errs, strict)
 		case *With:
-			_, errs = rewriteDeclaredVarsInTerm(g, stack, x.Value, errs)
+			errs = rewriteDeclaredVarsInTermRecursive(g, stack, x.Value, errs, strict)
 			stop = true
 		}
 		return stop
@@ -4048,7 +5035,7 @@ func rewriteDeclaredVarsInExpr(g *localVarGenerator, stack *localDeclaredVars, e
 	return expr, errs
 }
 
-func rewriteDeclaredAssignment(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors) (*Expr, Errors) {
+func rewriteDeclaredAssignment(g *localVarGenerator, stack *localDeclaredVars, expr *Expr, errs Errors, strict bool) (*Expr, Errors) {
 
 	if expr.Negated {
 		errs = append(errs, NewError(CompileErr, expr.Location, "cannot assign vars inside negated expression"))
@@ -4064,10 +5051,10 @@ func rewriteDeclaredAssignment(g *localVarGenerator, stack *localDeclaredVars, e
 	// Rewrite terms on right hand side capture seen vars and recursively
 	// process comprehensions before left hand side is processed. Also
 	// rewrite with modifier.
-	errs = rewriteDeclaredVarsInTermRecursive(g, stack, expr.Operand(1), errs)
+	errs = rewriteDeclaredVarsInTermRecursive(g, stack, expr.Operand(1), errs, strict)
 
 	for _, w := range expr.With {
-		errs = rewriteDeclaredVarsInTermRecursive(g, stack, w.Value, errs)
+		errs = rewriteDeclaredVarsInTermRecursive(g, stack, w.Value, errs, strict)
 	}
 
 	// Rewrite vars on left hand side with unique names. Catch redeclaration
@@ -4114,11 +5101,12 @@ func rewriteDeclaredAssignment(g *localVarGenerator, stack *localDeclaredVars, e
 	return expr, errs
 }
 
-func rewriteDeclaredVarsInTerm(g *localVarGenerator, stack *localDeclaredVars, term *Term, errs Errors) (bool, Errors) {
+func rewriteDeclaredVarsInTerm(g *localVarGenerator, stack *localDeclaredVars, term *Term, errs Errors, strict bool) (bool, Errors) {
 	switch v := term.Value.(type) {
 	case Var:
 		if gv, ok := stack.Declared(v); ok {
 			term.Value = gv
+			stack.Seen(v)
 		} else if stack.Occurrence(v) == newVar {
 			stack.Insert(v, v, seenVar)
 		}
@@ -4133,69 +5121,90 @@ func rewriteDeclaredVarsInTerm(g *localVarGenerator, stack *localDeclaredVars, t
 			return true, errs
 		}
 		return false, errs
+	case Call:
+		ref := v[0]
+		WalkVars(ref, func(v Var) bool {
+			if gv, ok := stack.Declared(v); ok && !gv.Equal(v) {
+				// We will rewrite the ref of a function call, which is never ok since we don't have first-class functions.
+				errs = append(errs, NewError(CompileErr, term.Location, "called function %s shadowed", ref))
+				return true
+			}
+			return false
+		})
+		return false, errs
 	case *object:
 		cpy, _ := v.Map(func(k, v *Term) (*Term, *Term, error) {
 			kcpy := k.Copy()
-			errs = rewriteDeclaredVarsInTermRecursive(g, stack, kcpy, errs)
-			errs = rewriteDeclaredVarsInTermRecursive(g, stack, v, errs)
+			errs = rewriteDeclaredVarsInTermRecursive(g, stack, kcpy, errs, strict)
+			errs = rewriteDeclaredVarsInTermRecursive(g, stack, v, errs, strict)
 			return kcpy, v, nil
 		})
 		term.Value = cpy
 	case Set:
 		cpy, _ := v.Map(func(elem *Term) (*Term, error) {
 			elemcpy := elem.Copy()
-			errs = rewriteDeclaredVarsInTermRecursive(g, stack, elemcpy, errs)
+			errs = rewriteDeclaredVarsInTermRecursive(g, stack, elemcpy, errs, strict)
 			return elemcpy, nil
 		})
 		term.Value = cpy
 	case *ArrayComprehension:
-		errs = rewriteDeclaredVarsInArrayComprehension(g, stack, v, errs)
+		errs = rewriteDeclaredVarsInArrayComprehension(g, stack, v, errs, strict)
 	case *SetComprehension:
-		errs = rewriteDeclaredVarsInSetComprehension(g, stack, v, errs)
+		errs = rewriteDeclaredVarsInSetComprehension(g, stack, v, errs, strict)
 	case *ObjectComprehension:
-		errs = rewriteDeclaredVarsInObjectComprehension(g, stack, v, errs)
+		errs = rewriteDeclaredVarsInObjectComprehension(g, stack, v, errs, strict)
 	default:
 		return false, errs
 	}
 	return true, errs
 }
 
-func rewriteDeclaredVarsInTermRecursive(g *localVarGenerator, stack *localDeclaredVars, term *Term, errs Errors) Errors {
+func rewriteDeclaredVarsInTermRecursive(g *localVarGenerator, stack *localDeclaredVars, term *Term, errs Errors, strict bool) Errors {
 	WalkNodes(term, func(n Node) bool {
 		var stop bool
 		switch n := n.(type) {
 		case *With:
-			_, errs = rewriteDeclaredVarsInTerm(g, stack, n.Value, errs)
+			errs = rewriteDeclaredVarsInTermRecursive(g, stack, n.Value, errs, strict)
 			stop = true
 		case *Term:
-			stop, errs = rewriteDeclaredVarsInTerm(g, stack, n, errs)
+			stop, errs = rewriteDeclaredVarsInTerm(g, stack, n, errs, strict)
 		}
 		return stop
 	})
 	return errs
 }
 
-func rewriteDeclaredVarsInArrayComprehension(g *localVarGenerator, stack *localDeclaredVars, v *ArrayComprehension, errs Errors) Errors {
+func rewriteDeclaredVarsInArrayComprehension(g *localVarGenerator, stack *localDeclaredVars, v *ArrayComprehension, errs Errors, strict bool) Errors {
+	used := NewVarSet()
+	used.Update(v.Term.Vars())
+
 	stack.Push()
-	v.Body, errs = rewriteDeclaredVarsInBody(g, stack, nil, v.Body, errs)
-	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Term, errs)
+	v.Body, errs = rewriteDeclaredVarsInBody(g, stack, used, v.Body, errs, strict)
+	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Term, errs, strict)
 	stack.Pop()
 	return errs
 }
 
-func rewriteDeclaredVarsInSetComprehension(g *localVarGenerator, stack *localDeclaredVars, v *SetComprehension, errs Errors) Errors {
+func rewriteDeclaredVarsInSetComprehension(g *localVarGenerator, stack *localDeclaredVars, v *SetComprehension, errs Errors, strict bool) Errors {
+	used := NewVarSet()
+	used.Update(v.Term.Vars())
+
 	stack.Push()
-	v.Body, errs = rewriteDeclaredVarsInBody(g, stack, nil, v.Body, errs)
-	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Term, errs)
+	v.Body, errs = rewriteDeclaredVarsInBody(g, stack, used, v.Body, errs, strict)
+	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Term, errs, strict)
 	stack.Pop()
 	return errs
 }
 
-func rewriteDeclaredVarsInObjectComprehension(g *localVarGenerator, stack *localDeclaredVars, v *ObjectComprehension, errs Errors) Errors {
+func rewriteDeclaredVarsInObjectComprehension(g *localVarGenerator, stack *localDeclaredVars, v *ObjectComprehension, errs Errors, strict bool) Errors {
+	used := NewVarSet()
+	used.Update(v.Key.Vars())
+	used.Update(v.Value.Vars())
+
 	stack.Push()
-	v.Body, errs = rewriteDeclaredVarsInBody(g, stack, nil, v.Body, errs)
-	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Key, errs)
-	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Value, errs)
+	v.Body, errs = rewriteDeclaredVarsInBody(g, stack, used, v.Body, errs, strict)
+	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Key, errs, strict)
+	errs = rewriteDeclaredVarsInTermRecursive(g, stack, v.Value, errs, strict)
 	stack.Pop()
 	return errs
 }
@@ -4219,10 +5228,10 @@ func rewriteDeclaredVar(g *localVarGenerator, stack *localDeclaredVars, v Var, o
 // rewriteWithModifiersInBody will rewrite the body so that with modifiers do
 // not contain terms that require evaluation as values. If this function
 // encounters an invalid with modifier target then it will raise an error.
-func rewriteWithModifiersInBody(c *Compiler, f *equalityFactory, body Body) (Body, *Error) {
+func rewriteWithModifiersInBody(c *Compiler, unsafeBuiltinsMap map[string]struct{}, f *equalityFactory, body Body) (Body, *Error) {
 	var result Body
 	for i := range body {
-		exprs, err := rewriteWithModifier(c, f, body[i])
+		exprs, err := rewriteWithModifier(c, unsafeBuiltinsMap, f, body[i])
 		if err != nil {
 			return nil, err
 		}
@@ -4237,63 +5246,122 @@ func rewriteWithModifiersInBody(c *Compiler, f *equalityFactory, body Body) (Bod
 	return result, nil
 }
 
-func rewriteWithModifier(c *Compiler, f *equalityFactory, expr *Expr) ([]*Expr, *Error) {
+func rewriteWithModifier(c *Compiler, unsafeBuiltinsMap map[string]struct{}, f *equalityFactory, expr *Expr) ([]*Expr, *Error) {
 
 	var result []*Expr
 	for i := range expr.With {
-		err := validateTarget(c, expr.With[i].Target)
+		eval, err := validateWith(c, unsafeBuiltinsMap, expr, i)
 		if err != nil {
 			return nil, err
 		}
 
-		if requiresEval(expr.With[i].Value) {
+		if eval {
 			eq := f.Generate(expr.With[i].Value)
 			result = append(result, eq)
 			expr.With[i].Value = eq.Operand(0)
 		}
 	}
 
-	// If any of the with modifiers in this expression were rewritten then result
-	// will be non-empty. In this case, the expression will have been modified and
-	// it should also be added to the result.
-	if len(result) > 0 {
-		result = append(result, expr)
-	}
-	return result, nil
+	return append(result, expr), nil
 }
 
-func validateTarget(c *Compiler, term *Term) *Error {
-	if !isInputRef(term) && !isDataRef(term) {
-		return NewError(TypeErr, term.Location, "with keyword target must start with %v or %v", InputRootDocument, DefaultRootDocument)
+func validateWith(c *Compiler, unsafeBuiltinsMap map[string]struct{}, expr *Expr, i int) (bool, *Error) {
+	target, value := expr.With[i].Target, expr.With[i].Value
+
+	// Ensure that values that are built-ins are rewritten to Ref (not Var)
+	if v, ok := value.Value.(Var); ok {
+		if _, ok := c.builtins[v.String()]; ok {
+			value.Value = Ref([]*Term{NewTerm(v)})
+		}
+	}
+	isBuiltinRefOrVar, err := isBuiltinRefOrVar(c.builtins, unsafeBuiltinsMap, target)
+	if err != nil {
+		return false, err
 	}
 
-	if isDataRef(term) {
-		ref := term.Value.(Ref)
+	switch {
+	case isDataRef(target):
+		ref := target.Value.(Ref)
 		node := c.RuleTree
 		for i := 0; i < len(ref)-1; i++ {
 			child := node.Child(ref[i].Value)
 			if child == nil {
 				break
 			} else if len(child.Values) > 0 {
-				return NewError(CompileErr, term.Loc(), "with keyword cannot partially replace virtual document(s)")
+				return false, NewError(CompileErr, target.Loc(), "with keyword cannot partially replace virtual document(s)")
 			}
 			node = child
 		}
 
 		if node != nil {
+			// NOTE(sr): at this point in the compiler stages, we don't have a fully-populated
+			// TypeEnv yet -- so we have to make do with this check to see if the replacement
+			// target is a function. It's probably wrong for arity-0 functions, but those are
+			// and edge case anyways.
 			if child := node.Child(ref[len(ref)-1].Value); child != nil {
-				for _, value := range child.Values {
-					if len(value.(*Rule).Head.Args) > 0 {
-						return NewError(CompileErr, term.Loc(), "with keyword cannot replace functions")
+				for _, v := range child.Values {
+					if len(v.(*Rule).Head.Args) > 0 {
+						if ok, err := validateWithFunctionValue(c.builtins, unsafeBuiltinsMap, c.RuleTree, value); err != nil || ok {
+							return false, err // err may be nil
+						}
 					}
 				}
 			}
 		}
+	case isInputRef(target): // ok, valid
+	case isBuiltinRefOrVar:
+
+		// NOTE(sr): first we ensure that parsed Var builtins (`count`, `concat`, etc)
+		// are rewritten to their proper Ref convention
+		if v, ok := target.Value.(Var); ok {
+			target.Value = Ref([]*Term{NewTerm(v)})
+		}
+
+		targetRef := target.Value.(Ref)
+		bi := c.builtins[targetRef.String()] // safe because isBuiltinRefOrVar checked this
+		if err := validateWithBuiltinTarget(bi, targetRef, target.Loc()); err != nil {
+			return false, err
+		}
+
+		if ok, err := validateWithFunctionValue(c.builtins, unsafeBuiltinsMap, c.RuleTree, value); err != nil || ok {
+			return false, err // err may be nil
+		}
+	default:
+		return false, NewError(TypeErr, target.Location, "with keyword target must reference existing %v, %v, or a function", InputRootDocument, DefaultRootDocument)
+	}
+	return requiresEval(value), nil
+}
+
+func validateWithBuiltinTarget(bi *Builtin, target Ref, loc *location.Location) *Error {
+	switch bi.Name {
+	case Equality.Name,
+		RegoMetadataChain.Name,
+		RegoMetadataRule.Name:
+		return NewError(CompileErr, loc, "with keyword replacing built-in function: replacement of %q invalid", bi.Name)
+	}
 
+	switch {
+	case target.HasPrefix(Ref([]*Term{VarTerm("internal")})):
+		return NewError(CompileErr, loc, "with keyword replacing built-in function: replacement of internal function %q invalid", target)
+
+	case bi.Relation:
+		return NewError(CompileErr, loc, "with keyword replacing built-in function: target must not be a relation")
+
+	case bi.Decl.Result() == nil:
+		return NewError(CompileErr, loc, "with keyword replacing built-in function: target must not be a void function")
 	}
 	return nil
 }
 
+func validateWithFunctionValue(bs map[string]*Builtin, unsafeMap map[string]struct{}, ruleTree *TreeNode, value *Term) (bool, *Error) {
+	if v, ok := value.Value.(Ref); ok {
+		if ruleTree.Find(v) != nil { // ref exists in rule tree
+			return true, nil
+		}
+	}
+	return isBuiltinRefOrVar(bs, unsafeMap, value)
+}
+
 func isInputRef(term *Term) bool {
 	if ref, ok := term.Value.(Ref); ok {
 		if ref.HasPrefix(InputRootRef) {
@@ -4312,8 +5380,20 @@ func isDataRef(term *Term) bool {
 	return false
 }
 
+func isBuiltinRefOrVar(bs map[string]*Builtin, unsafeBuiltinsMap map[string]struct{}, term *Term) (bool, *Error) {
+	switch v := term.Value.(type) {
+	case Ref, Var:
+		if _, ok := unsafeBuiltinsMap[v.String()]; ok {
+			return false, NewError(CompileErr, term.Location, "with keyword replacing built-in function: target must not be unsafe: %q", v)
+		}
+		_, ok := bs[v.String()]
+		return ok, nil
+	}
+	return false, nil
+}
+
 func isVirtual(node *TreeNode, ref Ref) bool {
-	for i := 0; i < len(ref); i++ {
+	for i := range ref {
 		child := node.Child(ref[i].Value)
 		if child == nil {
 			return false
@@ -4391,6 +5471,25 @@ func checkUnsafeBuiltins(unsafeBuiltinsMap map[string]struct{}, node interface{}
 	return errs
 }
 
+func checkDeprecatedBuiltins(deprecatedBuiltinsMap map[string]struct{}, node interface{}, strict bool) Errors {
+	// Early out; deprecatedBuiltinsMap is only populated in strict-mode.
+	if !strict {
+		return nil
+	}
+
+	errs := make(Errors, 0)
+	WalkExprs(node, func(x *Expr) bool {
+		if x.IsCall() {
+			operator := x.Operator().String()
+			if _, ok := deprecatedBuiltinsMap[operator]; ok {
+				errs = append(errs, NewError(TypeErr, x.Loc(), "deprecated built-in function calls in expression: %v", operator))
+			}
+		}
+		return false
+	})
+	return errs
+}
+
 func rewriteVarsInRef(vars ...map[Var]Var) varRewriter {
 	return func(node Ref) Ref {
 		i, _ := TransformVars(node, func(v Var) (Value, error) {
@@ -4404,3 +5503,57 @@ func rewriteVarsInRef(vars ...map[Var]Var) varRewriter {
 		return i.(Ref)
 	}
 }
+
+// NOTE(sr): This is duplicated with compile/compile.go; but moving it into another location
+// would cause a circular dependency -- the refSet definition needs ast.Ref. If we make it
+// public in the ast package, the compile package could take it from there, but it would also
+// increase our public interface. Let's reconsider if we need it in a third place.
+type refSet struct {
+	s []Ref
+}
+
+func newRefSet(x ...Ref) *refSet {
+	result := &refSet{}
+	for i := range x {
+		result.AddPrefix(x[i])
+	}
+	return result
+}
+
+// ContainsPrefix returns true if r is prefixed by any of the existing refs in the set.
+func (rs *refSet) ContainsPrefix(r Ref) bool {
+	for i := range rs.s {
+		if r.HasPrefix(rs.s[i]) {
+			return true
+		}
+	}
+	return false
+}
+
+// AddPrefix inserts r into the set if r is not prefixed by any existing
+// refs in the set. If any existing refs are prefixed by r, those existing
+// refs are removed.
+func (rs *refSet) AddPrefix(r Ref) {
+	if rs.ContainsPrefix(r) {
+		return
+	}
+	cpy := []Ref{r}
+	for i := range rs.s {
+		if !rs.s[i].HasPrefix(r) {
+			cpy = append(cpy, rs.s[i])
+		}
+	}
+	rs.s = cpy
+}
+
+// Sorted returns a sorted slice of terms for refs in the set.
+func (rs *refSet) Sorted() []*Term {
+	terms := make([]*Term, len(rs.s))
+	for i := range rs.s {
+		terms[i] = NewTerm(rs.s[i])
+	}
+	sort.Slice(terms, func(i, j int) bool {
+		return terms[i].Value.Compare(terms[j].Value) < 0
+	})
+	return terms
+}
diff --git a/ast/compile_test.go b/ast/compile_test.go
index 223f7eac7b..06890bf7a1 100644
--- a/ast/compile_test.go
+++ b/ast/compile_test.go
@@ -6,6 +6,7 @@ package ast
 
 import (
 	"bytes"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"reflect"
@@ -203,12 +204,31 @@ func TestOutputVarsForNode(t *testing.T) {
 			query: `z = "abc"; x = split(z, a)[y]`,
 			exp:   `{z}`,
 		},
+		{
+			note:  "every: simple: no output vars",
+			query: `every k, v in [1, 2] { k < v }`,
+			exp:   `set()`,
+		},
+		{
+			note:  "every: output vars in domain",
+			query: `xs = []; every k, v in xs[i] { k < v }`,
+			exp:   `{xs, i}`,
+		},
+		{
+			note:  "every: output vars in body",
+			query: `every k, v in [] { k < v; i = 1 }`,
+			exp:   `set()`,
+		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
 
-			body := MustParseBody(tc.query)
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			body, err := ParseBodyWithOpts(tc.query, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
 			arity := func(r Ref) int {
 				a, ok := tc.arities[r.String()]
 				if !ok {
@@ -243,7 +263,7 @@ func TestOutputVarsForNode(t *testing.T) {
 
 func TestModuleTree(t *testing.T) {
 
-	mods := getCompilerTestModules()
+	mods := getCompilerTestModules() // 7 modules
 	mods["system-mod"] = MustParseModule(`
 	package system.foo
 
@@ -254,8 +274,14 @@ func TestModuleTree(t *testing.T) {
 
 	p = 1
 	`)
+	mods["dots-in-heads"] = MustParseModule(`
+	package dots
+
+	a.b.c = 12
+	d.e.f.g = 34
+	`)
 	tree := NewModuleTree(mods)
-	expectedSize := 9
+	expectedSize := 10
 
 	if tree.Size() != expectedSize {
 		t.Fatalf("Expected %v but got %v modules", expectedSize, tree.Size())
@@ -274,978 +300,1892 @@ func TestModuleTree(t *testing.T) {
 	}
 
 }
+func TestCompilerGetExports(t *testing.T) {
+	tests := []struct {
+		note    string
+		modules []*Module
+		exports map[string][]string
+	}{
+		{
+			note: "simple",
+			modules: modules(`package p
+				r = 1`),
+			exports: map[string][]string{"data.p": {"r"}},
+		},
+		{
+			note: "simple single-value ref rule",
+			modules: modules(`package p
+				q.r.s = 1`),
+			exports: map[string][]string{"data.p": {"q.r.s"}},
+		},
+		{
+			note: "var key single-value ref rule",
+			modules: modules(`package p
+				q.r[s] = 1 { s := "foo" }`),
+			exports: map[string][]string{"data.p": {"q.r"}},
+		},
+		{
+			note: "simple multi-value ref rule",
+			modules: modules(`package p
+				import future.keywords
 
-func TestRuleTree(t *testing.T) {
-
-	mods := getCompilerTestModules()
-	mods["system-mod"] = MustParseModule(`
-	package system.foo
-
-	p = 1
-	`)
-	mods["non-system-mod"] = MustParseModule(`
-	package user.system
-
-	p = 1
-	`)
-	mods["mod-incr"] = MustParseModule(`package a.b.c
-
-s[1] { true }
-s[2] { true }`,
-	)
-
-	tree := NewRuleTree(NewModuleTree(mods))
-	expectedNumRules := 23
-
-	if tree.Size() != expectedNumRules {
-		t.Errorf("Expected %v but got %v rules", expectedNumRules, tree.Size())
-	}
-
-	// Check that empty packages are represented as leaves with no rules.
-	node := tree.Children[Var("data")].Children[String("a")].Children[String("b")].Children[String("empty")]
-
-	if node == nil || len(node.Children) != 0 || len(node.Values) != 0 {
-		t.Fatalf("Unexpected nil value or non-empty leaf of non-leaf node: %v", node)
-	}
-
-	system := tree.Child(Var("data")).Child(String("system"))
-	if !system.Hide {
-		t.Fatalf("Expected system node to be hidden")
-	}
-
-	if system.Child(String("foo")).Hide {
-		t.Fatalf("Expected system.foo node to be visible")
-	}
-
-	user := tree.Child(Var("data")).Child(String("user")).Child(String("system"))
-	if user.Hide {
-		t.Fatalf("Expected user.system node to be visible")
-	}
-
-	if !isVirtual(tree, MustParseRef("data.a.b.empty")) {
-		t.Fatal("Expected data.a.b.empty to be virtual")
-	}
-
-	abc := tree.Children[Var("data")].Children[String("a")].Children[String("b")].Children[String("c")]
-	exp := []Value{String("p"), String("q"), String("r"), String("s"), String("z")}
-
-	if len(abc.Sorted) != len(exp) {
-		t.Fatal("expected", exp, "but got", abc)
+				q.r.s contains 1 { true }`),
+			exports: map[string][]string{"data.p": {"q.r.s"}},
+		},
+		{
+			note: "two simple, multiple rules",
+			modules: modules(`package p
+				r = 1
+				s = 11`,
+				`package q
+				x = 2
+				y = 22`),
+			exports: map[string][]string{"data.p": {"r", "s"}, "data.q": {"x", "y"}},
+		},
+		{
+			note: "ref head + simple, multiple rules",
+			modules: modules(`package p.a.b.c
+				r = 1
+				s = 11`,
+				`package q
+				a.b.x = 2
+				a.b.c.y = 22`),
+			exports: map[string][]string{
+				"data.p.a.b.c": {"r", "s"},
+				"data.q":       {"a.b.x", "a.b.c.y"},
+			},
+		},
+		{
+			note: "two ref head, multiple rules",
+			modules: modules(`package p.a.b.c
+				r = 1
+				s = 11`,
+				`package p
+				a.b.x = 2
+				a.b.c.y = 22`),
+			exports: map[string][]string{
+				"data.p.a.b.c": {"r", "s"},
+				"data.p":       {"a.b.x", "a.b.c.y"},
+			},
+		},
+		{
+			note: "single-value rule with number key",
+			modules: modules(`package p
+				q[1] = 1
+				q[2] = 2`),
+			exports: map[string][]string{
+				"data.p": {"q[1]", "q[2]"}, // TODO(sr): is this really what we want?
+			},
+		},
+		{
+			note: "single-value (ref) rule with number key",
+			modules: modules(`package p
+				a.b.q[1] = 1
+				a.b.q[2] = 2`),
+			exports: map[string][]string{
+				"data.p": {"a.b.q[1]", "a.b.q[2]"},
+			},
+		},
+		{
+			note: "single-value (ref) rule with var key",
+			modules: modules(`package p
+				a.b.q[x] = y { x := 1; y := true }
+				a.b.q[2] = 2`),
+			exports: map[string][]string{
+				"data.p": {"a.b.q", "a.b.q[2]"}, // TODO(sr): GroundPrefix? right thing here?
+			},
+		},
+		{ // NOTE(sr): An ast.Module can be constructed in various ways, this is to assert that
+			//         our compilation process doesn't explode here if we're fed a Rule that has no Ref.
+			note: "synthetic",
+			modules: func() []*Module {
+				ms := modules(`package p
+				r = 1`)
+				ms[0].Rules[0].Head.Reference = nil
+				return ms
+			}(),
+			exports: map[string][]string{"data.p": {"r"}},
+		},
+		// TODO(sr): add multi-val rule, and ref-with-var single-value rule.
 	}
 
-	for i := range exp {
-		if exp[i].Compare(abc.Sorted[i]) != 0 {
-			t.Fatal("expected", exp, "but got", abc)
+	hashMap := func(ms map[string][]string) *util.HashMap {
+		rules := util.NewHashMap(func(a, b util.T) bool {
+			switch a := a.(type) {
+			case Ref:
+				return a.Equal(b.(Ref))
+			case []Ref:
+				b := b.([]Ref)
+				if len(b) != len(a) {
+					return false
+				}
+				for i := range a {
+					if !a[i].Equal(b[i]) {
+						return false
+					}
+				}
+				return true
+			default:
+				panic("unreachable")
+			}
+		}, func(v util.T) int {
+			return v.(Ref).Hash()
+		})
+		for r, rs := range ms {
+			refs := make([]Ref, len(rs))
+			for i := range rs {
+				refs[i] = toRef(rs[i])
+			}
+			rules.Put(MustParseRef(r), refs)
 		}
+		return rules
 	}
-}
-
-func TestCompilerEmpty(t *testing.T) {
-	c := NewCompiler()
-	c.Compile(nil)
-	assertNotFailed(t, c)
-}
 
-func TestCompilerExample(t *testing.T) {
-	c := NewCompiler()
-	m := MustParseModule(testModule)
-	c.Compile(map[string]*Module{"testMod": m})
-	assertNotFailed(t, c)
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			for i, m := range tc.modules {
+				c.Modules[fmt.Sprint(i)] = m
+				c.sorted = append(c.sorted, fmt.Sprint(i))
+			}
+			if exp, act := hashMap(tc.exports), c.getExports(); !exp.Equal(act) {
+				t.Errorf("expected %v, got %v", exp, act)
+			}
+		})
+	}
 }
 
-func TestCompilerWithStageAfter(t *testing.T) {
-	c := NewCompiler().WithStageAfter(
-		"CheckRecursion",
-		CompilerStageDefinition{"MockStage", "mock_stage", mockStageFunctionCall},
-	)
-	m := MustParseModule(testModule)
-	c.Compile(map[string]*Module{"testMod": m})
-
-	if !c.Failed() {
-		t.Errorf("Expected compilation error")
+func toRef(s string) Ref {
+	switch t := MustParseTerm(s).Value.(type) {
+	case Var:
+		return Ref{NewTerm(t)}
+	case Ref:
+		return t
+	default:
+		panic("unreachable")
 	}
 }
 
-func TestCompilerFunctions(t *testing.T) {
+func TestCompilerCheckRuleHeadRefs(t *testing.T) {
+
 	tests := []struct {
-		note    string
-		modules []string
-		wantErr bool
+		note     string
+		modules  []*Module
+		expected *Rule
+		err      string
 	}{
 		{
-			note: "multiple input types",
-			modules: []string{`package x
-
-				f([x]) = y {
-					y = x
-				}
-
-				f({"foo": x}) = y {
-					y = x
-				}`},
+			note: "ref contains var",
+			modules: modules(
+				`package x
+				p.q[i].r = 1 { i := 10 }`,
+			),
+			err: "rego_type_error: rule head must only contain string terms (except for last): i",
 		},
 		{
-			note: "multiple input types",
-			modules: []string{`package x
-
-				f([x]) = y {
-					y = x
-				}
-
-				f([[x]]) = y {
-					y = x
-				}`},
+			note: "valid: ref is single-value rule with var key",
+			modules: modules(
+				`package x
+				p.q.r[i] { i := 10 }`,
+			),
 		},
 		{
-			note: "constant input",
-			modules: []string{`package x
-
-				f(1) = y {
-					y = "foo"
-				}
-
-				f(2) = y {
-					y = "bar"
-				}`},
+			note: "valid: ref is single-value rule with var key and value",
+			modules: modules(
+				`package x
+				p.q.r[i] = j { i := 10; j := 11 }`,
+			),
 		},
 		{
-			note: "constant input",
-			modules: []string{`package x
-
-				f(1, x) = y {
-					y = x
-				}
-
-				f(x, y) = z {
-					z = x+y
-				}`},
+			note: "valid: ref is single-value rule with var key and static value",
+			modules: modules(
+				`package x
+				p.q.r[i] = "ten" { i := 10 }`,
+			),
 		},
 		{
-			note: "constant input",
-			modules: []string{`package x
-
-				f(x, 1) = y {
-					y = x
-				}
-
-				f(x, [y]) = z {
-					z = x+y
-				}`},
+			note: "valid: ref is single-value rule with number key",
+			modules: modules(
+				`package x
+				p.q.r[1] { true }`,
+			),
 		},
 		{
-			note: "multiple input types (nested)",
-			modules: []string{`package x
-
-				f({"foo": {"bar": x}}) = y {
-					y = x
-				}
-
-				f({"foo": [x]}) = y {
-					y = x
-				}`},
+			note: "valid: ref is single-value rule with boolean key",
+			modules: modules(
+				`package x
+				p.q.r[true] { true }`,
+			),
 		},
 		{
-			note: "multiple output types",
-			modules: []string{`package x
-
-				f(1) = y {
-					y = "foo"
-				}
-
-				f(2) = y {
-					y = 2
-				}`},
+			note: "valid: ref is single-value rule with null key",
+			modules: modules(
+				`package x
+				p.q.r[null] { true }`,
+			),
 		},
 		{
-			note: "namespacing",
-			modules: []string{
+			note: "valid: ref is single-value rule with set literal key",
+			modules: modules(
 				`package x
-
-				f(x) = y {
-					data.y.f[x] = y
-				}`,
-				`package y
-
-				f[x] = y {
-					y = "bar"
-					x = "foo"
-				}`,
-			},
+				p.q.r[set()] { true }`,
+			),
 		},
 		{
-			note: "implicit value",
-			modules: []string{
+			note: "valid: ref is single-value rule with array literal key",
+			modules: modules(
 				`package x
-
-				f(x) {
-					x = "foo"
-				}`},
+				p.q.r[[]] { true }`,
+			),
 		},
 		{
-			note: "resolving",
-			modules: []string{
+			note: "valid: ref is single-value rule with object literal key",
+			modules: modules(
 				`package x
-
-				f(x) = x { true }`,
-
-				`package y
-
-				import data.x
-				import data.x.f as g
-
-				p { g(1, a) }
-				p { x.f(1, b) }
-				p { data.x.f(1, c) }
-				`,
-			},
+				p.q.r[{}] { true }`,
+			),
 		},
 		{
-			note: "undefined",
-			modules: []string{
+			note: "valid: ref is single-value rule with ref key",
+			modules: modules(
 				`package x
-
-				p {
-					f(1)
-				}`,
-			},
-			wantErr: true,
+				x := [1,2,3]
+				p.q.r[x[i]] { i := 0}`,
+			),
 		},
 		{
-			note: "must apply",
-			modules: []string{
+			note: "invalid: ref in ref",
+			modules: modules(
 				`package x
-
-				f(1)
-
-				p {
-					f
-				}
-				`,
-			},
-			wantErr: true,
+				p.q[arr[0]].r { i := 10 }`,
+			),
+			err: "rego_type_error: rule head must only contain string terms (except for last): arr[0]",
 		},
 		{
-			note: "must apply",
-			modules: []string{
+			note: "invalid: non-string in ref (not last position)",
+			modules: modules(
 				`package x
-				f(1)
-				p { f.x }`,
-			},
-			wantErr: true,
+				p.q[10].r { true }`,
+			),
+			err: "rego_type_error: rule head must only contain string terms (except for last): 10",
 		},
 		{
-			note: "call argument ref output vars",
-			modules: []string{
+			note: "valid: multi-value with var key",
+			modules: modules(
 				`package x
-
-				f(x)
-
-				p { f(data.foo[i]) }`,
-			},
-			wantErr: false,
+				p.q.r contains i if i := 10`,
+			),
+		},
+		{
+			note: "rewrite: single-value with non-var key (ref)",
+			modules: modules(
+				`package x
+				p.q.r[y.z] if y := {"z": "a"}`,
+			),
+			expected: MustParseRule(`p.q.r[__local0__]  { y := {"z": "a"}; __local0__ = y.z }`),
 		},
 	}
+
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-			var err error
-			modules := map[string]*Module{}
-			for i, module := range tc.modules {
-				name := fmt.Sprintf("mod%d", i)
-				modules[name], err = ParseModule(name, module)
-				if err != nil {
-					panic(err)
-				}
+			mods := make(map[string]*Module, len(tc.modules))
+			for i, m := range tc.modules {
+				mods[fmt.Sprint(i)] = m
 			}
 			c := NewCompiler()
-			c.Compile(modules)
-			if tc.wantErr && !c.Failed() {
-				t.Errorf("Expected compilation error")
-			} else if !tc.wantErr && c.Failed() {
-				t.Errorf("Unexpected compilation error(s): %v", c.Errors)
+			c.Modules = mods
+			compileStages(c, c.rewriteRuleHeadRefs)
+			if tc.err != "" {
+				assertCompilerErrorStrings(t, c, []string{tc.err})
+			} else {
+				if len(c.Errors) > 0 {
+					t.Fatalf("expected no errors, got %v", c.Errors)
+				}
+				if tc.expected != nil {
+					assertRulesEqual(t, tc.expected, mods["0"].Rules[0])
+				}
 			}
 		})
 	}
 }
 
-func TestCompilerErrorLimit(t *testing.T) {
-	modules := map[string]*Module{
-		"test": MustParseModule(`package test
-	r = y { y = true; x = z }
+func TestRuleTreeWithDotsInHeads(t *testing.T) {
 
-	s[x] = y {
-		z = y + x
+	// TODO(sr): multi-val with var key in ref
+	tests := []struct {
+		note    string
+		modules []*Module
+		size    int // expected tree size = number of leaves
+		depth   int // expected tree depth
+	}{
+		{
+			note: "two modules, same package, one rule each",
+			modules: modules(
+				`package x
+				p.q.r = 1`,
+				`package x
+				p.q.w = 2`,
+			),
+			size: 2,
+		},
+		{
+			note: "two modules, sub-package, one rule each",
+			modules: modules(
+				`package x
+				p.q.r = 1`,
+				`package x.p
+				q.w.z = 2`,
+			),
+			size: 2,
+		},
+		{
+			note: "three modules, sub-package, incl simple rule",
+			modules: modules(
+				`package x
+				p.q.r = 1`,
+				`package x.p
+				q.w.z = 2`,
+				`package x.p.q.w
+				y = 3`,
+			),
+			size: 3,
+		},
+		{
+			note: "simple: two modules",
+			modules: modules(
+				`package x
+				p.q.r = 1`,
+				`package y
+				p.q.w = 2`,
+			),
+			size: 2,
+		},
+		{
+			note: "conflict: one module",
+			modules: modules(
+				`package q
+				p[x] = 1
+				p = 2`,
+			),
+			size: 2,
+		},
+		{
+			note: "conflict: two modules",
+			modules: modules(
+				`package q
+				p.r.s[x] = 1`,
+				`package q.p
+				r.s = 2 if true`,
+			),
+			size: 2,
+		},
+		{
+			note: "simple: two modules, one using ref head, one package path",
+			modules: modules(
+				`package x
+				p.q.r = 1 { input == 1 }`,
+				`package x.p.q
+				r = 2 { input == 2 }`,
+			),
+			size: 2,
+		},
+		{
+			note: "conflict: two modules, both using ref head, different package paths",
+			modules: modules(
+				`package x
+				p.q.r = 1 { input == 1 }`, // x.p.q.r = 1
+				`package x.p
+				q.r.s = 2 { input == 2 }`, // x.p.q.r.s = 2
+			),
+			size: 2,
+		},
+		{
+			note: "overlapping: one module, two ref head",
+			modules: modules(
+				`package x
+				p.q.r = 1
+				p.q.w.v = 2`,
+			),
+			size:  2,
+			depth: 6,
+		},
+		{
+			note: "last ref term != string",
+			modules: modules(
+				`package x
+				p.q.w[1] = 2
+				p.q.w[{"foo": "baz"}] = 20
+				p.q.x[true] = false
+				p.q.x[y] = y { y := "y" }`,
+			),
+			size:  4,
+			depth: 6,
+		},
 	}
 
-	t[x] { split(x, y, z) }
-	`),
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			for i, m := range tc.modules {
+				c.Modules[fmt.Sprint(i)] = m
+				c.sorted = append(c.sorted, fmt.Sprint(i))
+			}
+			compileStages(c, c.setRuleTree)
+			if len(c.Errors) > 0 {
+				t.Fatal(c.Errors)
+			}
+			tree := c.RuleTree
+			tree.DepthFirst(func(n *TreeNode) bool {
+				t.Log(n)
+				if !sort.SliceIsSorted(n.Sorted, func(i, j int) bool {
+					return n.Sorted[i].Compare(n.Sorted[j]) < 0
+				}) {
+					t.Errorf("expected sorted to be sorted: %v", n.Sorted)
+				}
+				return false
+			})
+			if tc.depth > 0 {
+				if exp, act := tc.depth, depth(tree); exp != act {
+					t.Errorf("expected tree depth %d, got %d", exp, act)
+				}
+			}
+			if exp, act := tc.size, tree.Size(); exp != act {
+				t.Errorf("expected tree size %d, got %d", exp, act)
+			}
+		})
 	}
+}
 
-	c := NewCompiler().SetErrorLimit(2)
-	c.Compile(modules)
-
-	errs := c.Errors
-	exp := []string{
-		"2:20: rego_unsafe_var_error: var x is unsafe",
-		"2:20: rego_unsafe_var_error: var z is unsafe",
-		"rego_compile_error: error limit reached",
-	}
+func TestRuleTreeWithVars(t *testing.T) {
+	opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
 
-	var result []string
-	for _, err := range errs {
-		result = append(result, err.Error())
-	}
+	t.Run("simple single-value rule", func(t *testing.T) {
+		mod0 := `package a.b
+c.d.e = 1 if true`
 
-	sort.Strings(exp)
-	sort.Strings(result)
-	if !reflect.DeepEqual(exp, result) {
-		t.Errorf("Expected errors %v, got %v", exp, result)
-	}
-}
+		mods := map[string]*Module{"0.rego": MustParseModuleWithOpts(mod0, opts)}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-func TestCompilerCheckSafetyHead(t *testing.T) {
-	c := NewCompiler()
-	c.Modules = getCompilerTestModules()
-	c.Modules["newMod"] = MustParseModule(`package a.b
+		node := tree.Find(MustParseRef("data.a.b.c.d.e"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 1, len(node.Values); exp != act {
+			t.Errorf("expected %d values, found %d", exp, act)
+		}
+		if exp, act := 0, len(node.Children); exp != act {
+			t.Errorf("expected %d children, found %d", exp, act)
+		}
+		if exp, act := MustParseRef("c.d.e"), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+	})
 
-unboundKey[x] = y { q[y] = {"foo": [1, 2, [{"bar": y}]]} }
-unboundVal[y] = x { q[y] = {"foo": [1, 2, [{"bar": y}]]} }
-unboundCompositeVal[y] = [{"foo": x, "bar": y}] { q[y] = {"foo": [1, 2, [{"bar": y}]]} }
-unboundCompositeKey[[{"x": x}]] { q[y] }
-unboundBuiltinOperator = eq { x = 1 }
-unboundElse { false } else = else_var { true }
-`,
-	)
-	compileStages(c, c.checkSafetyRuleHeads)
+	t.Run("two single-value rules", func(t *testing.T) {
+		mod0 := `package a.b
+c.d.e = 1 if true`
+		mod1 := `package a.b.c
+d.e = 2 if true`
 
-	makeErrMsg := func(v string) string {
-		return fmt.Sprintf("rego_unsafe_var_error: var %v is unsafe", v)
-	}
+		mods := map[string]*Module{
+			"0.rego": MustParseModuleWithOpts(mod0, opts),
+			"1.rego": MustParseModuleWithOpts(mod1, opts),
+		}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-	expected := []string{
-		makeErrMsg("x"),
-		makeErrMsg("x"),
-		makeErrMsg("x"),
-		makeErrMsg("x"),
-		makeErrMsg("eq"),
-		makeErrMsg("else_var"),
-	}
+		node := tree.Find(MustParseRef("data.a.b.c.d.e"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 2, len(node.Values); exp != act {
+			t.Errorf("expected %d values, found %d", exp, act)
+		}
+		if exp, act := 0, len(node.Children); exp != act {
+			t.Errorf("expected %d children, found %d", exp, act)
+		}
+		if exp, act := MustParseRef("c.d.e"), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if exp, act := MustParseRef("d.e"), node.Values[1].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+	})
 
-	result := compilerErrsToStringSlice(c.Errors)
-	sort.Strings(expected)
+	t.Run("one multi-value rule, one single-value, with var", func(t *testing.T) {
+		mod0 := `package a.b
+c.d.e.g contains 1 if true`
+		mod1 := `package a.b.c
+d.e.f = 2 if true`
 
-	if len(result) != len(expected) {
-		t.Fatalf("Expected %d:\n%v\nBut got %d:\n%v", len(expected), strings.Join(expected, "\n"), len(result), strings.Join(result, "\n"))
-	}
+		mods := map[string]*Module{
+			"0.rego": MustParseModuleWithOpts(mod0, opts),
+			"1.rego": MustParseModuleWithOpts(mod1, opts),
+		}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-	for i := range result {
-		if expected[i] != result[i] {
-			t.Errorf("Expected %v but got: %v", expected[i], result[i])
+		// var-key rules should be included in the results
+		node := tree.Find(MustParseRef("data.a.b.c.d.e.g"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
 		}
-	}
+		if exp, act := 1, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d", exp, act)
+		}
+		if exp, act := 0, len(node.Children); exp != act {
+			t.Fatalf("expected %d children, found %d", exp, act)
+		}
+		node = tree.Find(MustParseRef("data.a.b.c.d.e.f"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 1, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d", exp, act)
+		}
+		if exp, act := MustParseRef("d.e.f"), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+	})
 
-}
+	t.Run("two multi-value rules, back compat", func(t *testing.T) {
+		mod0 := `package a
+b[c] { c := "foo" }`
+		mod1 := `package a
+b[d] { d := "bar" }`
 
-func TestCompilerCheckSafetyBodyReordering(t *testing.T) {
-	tests := []struct {
-		note     string
-		body     string
-		expected string
-	}{
-		{"noop", `x = 1; x != 0`, `x = 1; x != 0`},
-		{"var/ref", `a[i] = x; a = [1, 2, 3, 4]`, `a = [1, 2, 3, 4]; a[i] = x`},
-		{"var/ref (nested)", `a = [1, 2, 3, 4]; a[b[i]] = x; b = [0, 0, 0, 0]`, `a = [1, 2, 3, 4]; b = [0, 0, 0, 0]; a[b[i]] = x`},
-		{"negation",
-			`a = [true, false]; b = [true, false]; not a[i]; b[i]`,
-			`a = [true, false]; b = [true, false]; b[i]; not a[i]`},
-		{"built-in", `x != 0; count([1, 2, 3], x)`, `count([1, 2, 3], x); x != 0`},
-		{"var/var 1", `x = y; z = 1; y = z`, `z = 1; y = z; x = y`},
-		{"var/var 2", `x = y; 1 = z; z = y`, `1 = z; z = y; x = y`},
-		{"var/var 3", `x != 0; y = x; y = 1`, `y = 1; y = x; x != 0`},
-		{"array compr/var", `x != 0; [y | y = 1] = x`, `[y | y = 1] = x; x != 0`},
-		{"array compr/array", `[1] != [x]; [y | y = 1] = [x]`, `[y | y = 1] = [x]; [1] != [x]`},
-		{"with", `data.a.b.d.t with input as x; x = 1`, `x = 1; data.a.b.d.t with input as x`},
-		{"with-2", `data.a.b.d.t with input.x as x; x = 1`, `x = 1; data.a.b.d.t with input.x as x`},
-		{"with-nop", "data.somedoc[x] with input as true", "data.somedoc[x] with input as true"},
-		{"ref-head", `s = [["foo"], ["bar"]]; x = y[0]; y = s[_]; contains(x, "oo")`, `
-		s = [["foo"], ["bar"]];
-		y = s[_];
-		x = y[0];
-		contains(x, "oo")
-	`},
-		{"userfunc", `split(y, ".", z); data.a.b.funcs.fn("...foo.bar..", y)`, `data.a.b.funcs.fn("...foo.bar..", y); split(y, ".", z)`},
-	}
+		mods := map[string]*Module{
+			"0.rego": MustParseModuleWithOpts(mod0, opts),
+			"1.rego": MustParseModuleWithOpts(mod1, opts),
+		}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-	for i, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler()
-			c.Modules = getCompilerTestModules()
-			c.Modules["reordering"] = MustParseModule(fmt.Sprintf(
-				`package test
-				p { %s }`, tc.body))
+		node := tree.Find(MustParseRef("data.a.b"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 2, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d: %v", exp, act, node.Values)
+		}
+		if exp, act := 0, len(node.Children); exp != act {
+			t.Errorf("expected %d children, found %d", exp, act)
+		}
+		if exp, act := (Ref{VarTerm("b")}), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if act := node.Values[0].(*Rule).Head.Value; act != nil {
+			t.Errorf("expected rule value nil, found %v", act)
+		}
+		if exp, act := VarTerm("c"), node.Values[0].(*Rule).Head.Key; !exp.Equal(act) {
+			t.Errorf("expected rule key %v, found %v", exp, act)
+		}
+		if exp, act := (Ref{VarTerm("b")}), node.Values[1].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if act := node.Values[1].(*Rule).Head.Value; act != nil {
+			t.Errorf("expected rule value nil, found %v", act)
+		}
+		if exp, act := VarTerm("d"), node.Values[1].(*Rule).Head.Key; !exp.Equal(act) {
+			t.Errorf("expected rule key %v, found %v", exp, act)
+		}
+	})
 
-			compileStages(c, c.checkSafetyRuleBodies)
+	t.Run("two multi-value rules, back compat with short style", func(t *testing.T) {
+		mod0 := `package a
+b[1]`
+		mod1 := `package a
+b[2]`
+		mods := map[string]*Module{
+			"0.rego": MustParseModuleWithOpts(mod0, opts),
+			"1.rego": MustParseModuleWithOpts(mod1, opts),
+		}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-			if c.Failed() {
-				t.Errorf("%v (#%d): Unexpected compilation error: %v", tc.note, i, c.Errors)
-				return
-			}
+		node := tree.Find(MustParseRef("data.a.b"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 2, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d: %v", exp, act, node.Values)
+		}
+		if exp, act := 0, len(node.Children); exp != act {
+			t.Errorf("expected %d children, found %d", exp, act)
+		}
+		if exp, act := (Ref{VarTerm("b")}), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if act := node.Values[0].(*Rule).Head.Value; act != nil {
+			t.Errorf("expected rule value nil, found %v", act)
+		}
+		if exp, act := IntNumberTerm(1), node.Values[0].(*Rule).Head.Key; !exp.Equal(act) {
+			t.Errorf("expected rule key %v, found %v", exp, act)
+		}
+		if exp, act := (Ref{VarTerm("b")}), node.Values[1].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if act := node.Values[1].(*Rule).Head.Value; act != nil {
+			t.Errorf("expected rule value nil, found %v", act)
+		}
+		if exp, act := IntNumberTerm(2), node.Values[1].(*Rule).Head.Key; !exp.Equal(act) {
+			t.Errorf("expected rule key %v, found %v", exp, act)
+		}
+	})
 
-			expected := MustParseBody(tc.expected)
-			result := c.Modules["reordering"].Rules[0].Body
+	t.Run("two single-value rules, back compat with short style", func(t *testing.T) {
+		mod0 := `package a
+b[1] = 1`
+		mod1 := `package a
+b[2] = 2`
+		mods := map[string]*Module{
+			"0.rego": MustParseModuleWithOpts(mod0, opts),
+			"1.rego": MustParseModuleWithOpts(mod1, opts),
+		}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-			if !expected.Equal(result) {
-				t.Errorf("%v (#%d): Expected body to be ordered and equal to %v but got: %v", tc.note, i, expected, result)
-			}
-		})
-	}
-}
+		// branch point
+		node := tree.Find(MustParseRef("data.a.b"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 0, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d: %v", exp, act, node.Values)
+		}
+		if exp, act := 2, len(node.Children); exp != act {
+			t.Fatalf("expected %d children, found %d", exp, act)
+		}
 
-func TestCompilerCheckSafetyBodyReorderingClosures(t *testing.T) {
-	c := NewCompiler()
-	c.Modules = map[string]*Module{
-		"mod": MustParseModule(
-			`package compr
+		// branch 1
+		node = tree.Find(MustParseRef("data.a.b[1]"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 1, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d: %v", exp, act, node.Values)
+		}
+		if exp, act := MustParseRef("b[1]"), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if exp, act := IntNumberTerm(1), node.Values[0].(*Rule).Head.Value; !exp.Equal(act) {
+			t.Errorf("expected rule value %v, found %v", exp, act)
+		}
+		if exp, act := IntNumberTerm(1), node.Values[0].(*Rule).Head.Key; !exp.Equal(act) {
+			t.Errorf("expected rule key %v, found %v", exp, act)
+		}
 
-import data.b
-import data.c
+		// branch 2
+		node = tree.Find(MustParseRef("data.a.b[2]"))
+		if node == nil {
+			t.Fatal("expected non-nil leaf node")
+		}
+		if exp, act := 1, len(node.Values); exp != act {
+			t.Fatalf("expected %d values, found %d: %v", exp, act, node.Values)
+		}
+		if exp, act := MustParseRef("b[2]"), node.Values[0].(*Rule).Head.Ref(); !exp.Equal(act) {
+			t.Errorf("expected rule ref %v, found %v", exp, act)
+		}
+		if exp, act := IntNumberTerm(2), node.Values[0].(*Rule).Head.Value; !exp.Equal(act) {
+			t.Errorf("expected rule value %v, found %v", exp, act)
+		}
+		if exp, act := IntNumberTerm(2), node.Values[0].(*Rule).Head.Key; !exp.Equal(act) {
+			t.Errorf("expected rule key %v, found %v", exp, act)
+		}
+	})
 
-fn(x) = y {
-	trim(x, ".", y)
-}
+	// NOTE(sr): Now this test seems obvious, but it's a bug that had snuck into the
+	// NewRuleTree code during development.
+	t.Run("root node and data node unhidden if there are no system nodes", func(t *testing.T) {
+		mod0 := `package a
+p = 1`
+		mods := map[string]*Module{
+			"0.rego": MustParseModuleWithOpts(mod0, opts),
+		}
+		tree := NewRuleTree(NewModuleTree(mods))
 
-p = true { v = [null | true]; xs = [x | a[i] = x; a = [y | y != 1; y = c[j]]]; xs[j] > 0; z = [true | data.a.b.d.t with input as i2; i2 = i]; b[i] = j }
-q = true { _ = [x | x = b[i]]; _ = b[j]; _ = [x | x = true; x != false]; true != false; _ = [x | data.foo[_] = x]; data.foo[_] = _ }
-r = true { a = [x | split(y, ".", z); x = z[i]; fn("...foo.bar..", y)] }`,
-		),
-	}
-
-	compileStages(c, c.checkSafetyRuleBodies)
-	assertNotFailed(t, c)
+		if exp, act := false, tree.Hide; act != exp {
+			t.Errorf("expected tree.Hide=%v, got %v", exp, act)
+		}
+		dataNode := tree.Child(Var("data"))
+		if dataNode == nil {
+			t.Fatal("expected data node")
+		}
+		if exp, act := false, dataNode.Hide; act != exp {
+			t.Errorf("expected dataNode.Hide=%v, got %v", exp, act)
+		}
+	})
+}
 
-	result1 := c.Modules["mod"].Rules[1].Body
-	expected1 := MustParseBody(`v = [null | true]; data.b[i] = j; xs = [x | a = [y | y = data.c[j]; y != 1]; a[i] = x]; z = [true | i2 = i; data.a.b.d.t with input as i2]; xs[j] > 0`)
-	if !result1.Equal(expected1) {
-		t.Errorf("Expected reordered body to be equal to:\n%v\nBut got:\n%v", expected1, result1)
+func depth(n *TreeNode) int {
+	d := -1
+	for _, m := range n.Children {
+		if d0 := depth(m); d0 > d {
+			d = d0
+		}
 	}
+	return d + 1
+}
 
-	result2 := c.Modules["mod"].Rules[2].Body
-	expected2 := MustParseBody(`_ = [x | x = data.b[i]]; _ = data.b[j]; _ = [x | x = true; x != false]; true != false; _ = [x | data.foo[_] = x]; data.foo[_] = _`)
-	if !result2.Equal(expected2) {
-		t.Errorf("Expected pre-ordered body to equal:\n%v\nBut got:\n%v", expected2, result2)
+func TestModuleTreeFilenameOrder(t *testing.T) {
+	// NOTE(sr): It doesn't matter that these are conflicting; but that's where it
+	// becomes very apparent: before this change, the rule that was reported as
+	// "conflicting" was that of either one of the input files, randomly.
+	mods := map[string]*Module{
+		"0.rego": MustParseModule("package p\nr = 1 { true }"),
+		"1.rego": MustParseModule("package p\nr = 2 { true }"),
 	}
-
-	result3 := c.Modules["mod"].Rules[3].Body
-	expected3 := MustParseBody(`a = [x | data.compr.fn("...foo.bar..", y); split(y, ".", z); x = z[i]]`)
-	if !result3.Equal(expected3) {
-		t.Errorf("Expected pre-ordered body to equal:\n%v\nBut got:\n%v", expected3, result3)
+	tree := NewModuleTree(mods)
+	vals := tree.Children[Var("data")].Children[String("p")].Modules
+	if exp, act := 2, len(vals); exp != act {
+		t.Fatalf("expected %d rules, found %d", exp, act)
 	}
-}
-
-func TestCompilerCheckSafetyBodyErrors(t *testing.T) {
-
-	moduleBegin := `
-		package a.b
-
-		import input.aref.b.c as foo
-		import input.avar as bar
-		import data.m.n as baz
-	`
-
-	tests := []struct {
-		note          string
-		moduleContent string
-		expected      string
-	}{
-		{"ref-head", `p { a.b.c = "foo" }`, `{a,}`},
-		{"ref-head-2", `p { {"foo": [{"bar": a.b.c}]} = {"foo": [{"bar": "baz"}]} }`, `{a,}`},
-		{"negation", `p { a = [1, 2, 3, 4]; not a[i] = x }`, `{i, x}`},
-		{"negation-head", `p[x] { a = [1, 2, 3, 4]; not a[i] = x }`, `{i,x}`},
-		{"negation-multiple", `p { a = [1, 2, 3, 4]; b = [1, 2, 3, 4]; not a[i] = x; not b[j] = x }`, `{i, x, j}`},
-		{"negation-nested", `p { a = [{"foo": ["bar", "baz"]}]; not a[0].foo = [a[0].foo[i], a[0].foo[j]] } `, `{i, j}`},
-		{"builtin-input", `p { count([1, 2, x], x) }`, `{x,}`},
-		{"builtin-input-name", `p { count(eq, 1) }`, `{eq,}`},
-		{"builtin-multiple", `p { x > 0; x <= 3; x != 2 }`, `{x,}`},
-		{"unordered-object-keys", `p { x = "a"; [{x: y, z: a}] = [{"a": 1, "b": 2}]}`, `{a,y,z}`},
-		{"unordered-sets", `p { x = "a"; [{x, y}] = [{1, 2}]}`, `{y,}`},
-		{"array-compr", `p { _ = [x | x = data.a[_]; y > 1] }`, `{y,}`},
-		{"array-compr-nested", `p { _ = [x | x = a[_]; a = [y | y = data.a[_]; z > 1]] }`, `{z,}`},
-		{"array-compr-closure", `p { _ = [v | v = [x | x = data.a[_]]; x > 1] }`, `{x,}`},
-		{"array-compr-term", `p { _ = [u | true] }`, `{u,}`},
-		{"array-compr-term-nested", `p { _ = [v | v = [w | w != 0]] }`, `{w,}`},
-		{"array-compr-mixed", `p { _ = [x | y = [a | a = z[i]]] }`, `{a, x, z, i}`},
-		{"array-compr-builtin", `p { [true | eq != 2] }`, `{eq,}`},
-		{"closure-self", `p { x = [x | x = 1] }`, `{x,}`},
-		{"closure-transitive", `p { x = y; x = [y | y = 1] }`, `{y,}`},
-		{"nested", `p { count(baz[i].attr[bar[dead.beef]], n) }`, `{dead,}`},
-		{"negated-import", `p { not foo; not bar; not baz }`, `set()`},
-		{"rewritten", `p[{"foo": dead[i]}] { true }`, `{dead, i}`},
-		{"with-value", `p { data.a.b.d.t with input as x }`, `{x,}`},
-		{"with-value-2", `p { x = data.a.b.d.t with input as x }`, `{x,}`},
-		{"else-kw", "p { false } else { count(x, 1) }", `{x,}`},
-		{"function", "foo(x) = [y, z] { split(x, y, z) }", `{y,z}`},
-		{"call-vars-input", "p { f(x, x) } f(x) = x { true }", `{x,}`},
-		{"call-no-output", "p { f(x) } f(x) = x { true }", `{x,}`},
-		{"call-too-few", "p { f(1,x) } f(x,y) { true }", "{x,}"},
-		{"object-key-comprehension", "p { { {p|x}: 0 } }", "{x,}"},
-		{"set-value-comprehension", "p { {1, {p|x}} }", "{x,}"},
+	mod0 := vals[0]
+	mod1 := vals[1]
+	if exp, act := IntNumberTerm(1), mod0.Rules[0].Head.Value; !exp.Equal(act) {
+		t.Errorf("expected value %v, got %v", exp, act)
 	}
-
-	makeErrMsg := func(varName string) string {
-		return fmt.Sprintf("rego_unsafe_var_error: var %v is unsafe", varName)
+	if exp, act := IntNumberTerm(2), mod1.Rules[0].Head.Value; !exp.Equal(act) {
+		t.Errorf("expected value %v, got %v", exp, act)
 	}
+}
+func TestRuleTree(t *testing.T) {
 
-	for _, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
-
-			// Build slice of expected error messages.
-			expected := []string{}
-
-			_ = MustParseTerm(tc.expected).Value.(Set).Iter(func(x *Term) error {
-				expected = append(expected, makeErrMsg(string(x.Value.(Var))))
-				return nil
-			}) // cannot return error
-
-			sort.Strings(expected)
+	mods := getCompilerTestModules()
+	mods["system-mod"] = MustParseModule(`
+	package system.foo
 
-			// Compile test module.
-			c := NewCompiler()
-			c.Modules = map[string]*Module{
-				"newMod": MustParseModule(fmt.Sprintf(`
+	p = 1
+	`)
+	mods["non-system-mod"] = MustParseModule(`
+	package user.system
 
-				%v
+	p = 1`)
+	mods["mod-incr"] = MustParseModule(`
+	package a.b.c
 
-				%v
+	s[1] { true }
+	s[2] { true }`,
+	)
 
-				`, moduleBegin, tc.moduleContent)),
-			}
+	mods["dots-in-heads"] = MustParseModule(`
+		package dots
 
-			compileStages(c, c.checkSafetyRuleBodies)
+		a.b.c = 12
+		d.e.f.g = 34
+		`)
 
-			// Get errors.
-			result := compilerErrsToStringSlice(c.Errors)
+	tree := NewRuleTree(NewModuleTree(mods))
+	expectedNumRules := 25
 
-			// Check against expected.
-			if len(result) != len(expected) {
-				t.Fatalf("Expected %d:\n%v\nBut got %d:\n%v", len(expected), strings.Join(expected, "\n"), len(result), strings.Join(result, "\n"))
-			}
+	if tree.Size() != expectedNumRules {
+		t.Errorf("Expected %v but got %v rules", expectedNumRules, tree.Size())
+	}
 
-			for i := range result {
-				if expected[i] != result[i] {
-					t.Errorf("Expected %v but got: %v", expected[i], result[i])
-				}
-			}
+	// Check that empty packages are represented as leaves with no rules.
+	node := tree.Children[Var("data")].Children[String("a")].Children[String("b")].Children[String("empty")]
+	if node == nil || len(node.Children) != 0 || len(node.Values) != 0 {
+		t.Fatalf("Unexpected nil value or non-empty leaf of non-leaf node: %v", node)
+	}
 
-		})
+	// Check that root node is not hidden
+	if exp, act := false, tree.Hide; act != exp {
+		t.Errorf("expected tree.Hide=%v, got %v", exp, act)
 	}
-}
 
-func TestCompilerCheckSafetyVarLoc(t *testing.T) {
+	system := tree.Child(Var("data")).Child(String("system"))
+	if !system.Hide {
+		t.Fatalf("Expected system node to be hidden: %v", system)
+	}
 
-	_, err := CompileModules(map[string]string{"test.rego": `package test
+	if system.Child(String("foo")).Hide {
+		t.Fatalf("Expected system.foo node to be visible")
+	}
 
-p {
-	not x
-	x > y
-}`})
+	user := tree.Child(Var("data")).Child(String("user")).Child(String("system"))
+	if user.Hide {
+		t.Fatalf("Expected user.system node to be visible")
+	}
 
-	if err == nil {
-		t.Fatal("expected error")
+	if !isVirtual(tree, MustParseRef("data.a.b.empty")) {
+		t.Fatal("Expected data.a.b.empty to be virtual")
 	}
 
-	errs := err.(Errors)
+	abc := tree.Children[Var("data")].Children[String("a")].Children[String("b")].Children[String("c")]
+	exp := []Value{String("p"), String("q"), String("r"), String("s"), String("z")}
 
-	if !strings.Contains(errs[0].Message, "var x is unsafe") || errs[0].Location.Row != 4 {
-		t.Fatal("expected error on row 4 but got:", err)
+	if len(abc.Sorted) != len(exp) {
+		t.Fatal("expected", exp, "but got", abc)
 	}
 
-	if !strings.Contains(errs[1].Message, "var y is unsafe") || errs[1].Location.Row != 5 {
-		t.Fatal("expected y is unsafe on row 5 but got:", err)
+	for i := range exp {
+		if exp[i].Compare(abc.Sorted[i]) != 0 {
+			t.Fatal("expected", exp, "but got", abc)
+		}
 	}
 }
 
-func TestCompilerCheckTypes(t *testing.T) {
+func TestCompilerEmpty(t *testing.T) {
 	c := NewCompiler()
-	modules := getCompilerTestModules()
-	c.Modules = map[string]*Module{"mod6": modules["mod6"], "mod7": modules["mod7"]}
-	compileStages(c, c.checkTypes)
+	c.Compile(nil)
 	assertNotFailed(t, c)
 }
 
-func TestCompilerCheckTypesWithSchema(t *testing.T) {
+func TestCompilerExample(t *testing.T) {
 	c := NewCompiler()
-	var schema interface{}
-	err := util.Unmarshal([]byte(objectSchema), &schema)
-	if err != nil {
-		t.Fatal("Unexpected error:", err)
-	}
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, schema)
-	c.WithSchemas(schemaSet)
-	compileStages(c, c.checkTypes)
+	m := MustParseModule(testModule)
+	c.Compile(map[string]*Module{"testMod": m})
 	assertNotFailed(t, c)
 }
 
-func TestCompilerCheckTypesWithAllOfSchema(t *testing.T) {
+func TestCompilerWithStageAfter(t *testing.T) {
+	t.Run("after failing means overall failure", func(t *testing.T) {
+		c := NewCompiler().WithStageAfter(
+			"CheckRecursion",
+			CompilerStageDefinition{"MockStage", "mock_stage",
+				func(*Compiler) *Error { return NewError(CompileErr, &Location{}, "mock stage error") }},
+		)
+		m := MustParseModule(testModule)
+		c.Compile(map[string]*Module{"testMod": m})
+
+		if !c.Failed() {
+			t.Errorf("Expected compilation error")
+		}
+	})
+
+	t.Run("first 'after' failure inhibits other 'after' stages", func(t *testing.T) {
+		c := NewCompiler().
+			WithStageAfter("CheckRecursion",
+				CompilerStageDefinition{"MockStage", "mock_stage",
+					func(*Compiler) *Error { return NewError(CompileErr, &Location{}, "mock stage error") }}).
+			WithStageAfter("CheckRecursion",
+				CompilerStageDefinition{"MockStage2", "mock_stage2",
+					func(*Compiler) *Error { return NewError(CompileErr, &Location{}, "mock stage error two") }},
+			)
+		m := MustParseModule(`package p
+q := true`)
+
+		c.Compile(map[string]*Module{"testMod": m})
+
+		if !c.Failed() {
+			t.Errorf("Expected compilation error")
+		}
+		if exp, act := 1, len(c.Errors); exp != act {
+			t.Errorf("expected %d errors, got %d: %v", exp, act, c.Errors)
+		}
+	})
+
+	t.Run("'after' failure inhibits other ordinary stages", func(t *testing.T) {
+		c := NewCompiler().
+			WithStageAfter("CheckRecursion",
+				CompilerStageDefinition{"MockStage", "mock_stage",
+					func(*Compiler) *Error { return NewError(CompileErr, &Location{}, "mock stage error") }})
+		m := MustParseModule(`package p
+q {
+	1 == "a" # would fail "CheckTypes", the next stage
+}
+`)
+		c.Compile(map[string]*Module{"testMod": m})
+
+		if !c.Failed() {
+			t.Errorf("Expected compilation error")
+		}
+		if exp, act := 1, len(c.Errors); exp != act {
+			t.Errorf("expected %d errors, got %d: %v", exp, act, c.Errors)
+		}
+	})
+}
 
+func TestCompilerFunctions(t *testing.T) {
 	tests := []struct {
-		note          string
-		schema        string
-		expectedError error
+		note    string
+		modules []string
+		wantErr bool
 	}{
 		{
-			note:          "allOf with mergeable Object types in schema",
-			schema:        allOfObjectSchema,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf with mergeable Array types in schema",
-			schema:        allOfArraySchema,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf without a parent schema",
-			schema:        allOfSchemaParentVariation,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf with empty schema",
-			schema:        emptySchema,
-			expectedError: nil,
+			note: "multiple input types",
+			modules: []string{`package x
+
+				f([x]) = y {
+					y = x
+				}
+
+				f({"foo": x}) = y {
+					y = x
+				}`},
 		},
 		{
-			note:          "allOf with mergeable Array of Object types in schema",
-			schema:        allOfArrayOfObjects,
-			expectedError: nil,
+			note: "multiple input types",
+			modules: []string{`package x
+
+				f([x]) = y {
+					y = x
+				}
+
+				f([[x]]) = y {
+					y = x
+				}`},
 		},
 		{
-			note:          "allOf with mergeable Object types in schema with type declaration missing",
-			schema:        allOfObjectMissing,
-			expectedError: nil,
+			note: "constant input",
+			modules: []string{`package x
+
+				f(1) = y {
+					y = "foo"
+				}
+
+				f(2) = y {
+					y = "bar"
+				}`},
 		},
 		{
-			note:          "allOf with Array of mergeable different types in schema",
-			schema:        allOfArrayDifTypes,
-			expectedError: nil,
+			note: "constant input",
+			modules: []string{`package x
+
+				f(1, x) = y {
+					y = x
+				}
+
+				f(x, y) = z {
+					z = x+y
+				}`},
 		},
 		{
-			note:          "allOf with mergeable Object containing Array types in schema",
-			schema:        allOfArrayInsideObject,
-			expectedError: nil,
+			note: "constant input",
+			modules: []string{`package x
+
+				f(x, 1) = y {
+					y = x
+				}
+
+				f(x, [y]) = z {
+					z = x+y
+				}`},
 		},
 		{
-			note:          "allOf with mergeable Array types in schema with type declaration missing",
-			schema:        allOfArrayMissing,
-			expectedError: nil,
+			note: "multiple input types (nested)",
+			modules: []string{`package x
+
+				f({"foo": {"bar": x}}) = y {
+					y = x
+				}
+
+				f({"foo": [x]}) = y {
+					y = x
+				}`},
 		},
 		{
-			note:          "allOf with mergeable types inside of core schema",
-			schema:        allOfInsideCoreSchema,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf with mergeable String types in schema",
-			schema:        allOfStringSchema,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf with mergeable Integer types in schema",
-			schema:        allOfIntegerSchema,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf with mergeable Boolean types in schema",
-			schema:        allOfBooleanSchema,
-			expectedError: nil,
-		},
-		{
-			note:          "allOf with mergeable Array types with uneven numbers of items",
-			schema:        allOfSchemaWithUnevenArray,
-			expectedError: nil,
+			note: "multiple output types",
+			modules: []string{`package x
+
+				f(1) = y {
+					y = "foo"
+				}
+
+				f(2) = y {
+					y = 2
+				}`},
 		},
 		{
-			note:          "allOf schema with unmergeable Array of Arrays",
-			schema:        allOfArrayOfArrays,
-			expectedError: fmt.Errorf("unable to merge these schemas"),
+			note: "namespacing",
+			modules: []string{
+				`package x
+
+				f(x) = y {
+					data.y.f[x] = y
+				}`,
+				`package y
+
+				f[x] = y {
+					y = "bar"
+					x = "foo"
+				}`,
+			},
 		},
 		{
-			note:          "allOf schema with Array and Object types as siblings",
-			schema:        allOfObjectAndArray,
-			expectedError: fmt.Errorf("unable to merge these schemas"),
+			note: "implicit value",
+			modules: []string{
+				`package x
+
+				f(x) {
+					x = "foo"
+				}`},
 		},
 		{
-			note:          "allOf schema with Array type that contains different unmergeable types",
-			schema:        allOfArrayDifTypesWithError,
-			expectedError: fmt.Errorf("unable to merge these schemas"),
+			note: "resolving",
+			modules: []string{
+				`package x
+
+				f(x) = x { true }`,
+
+				`package y
+
+				import data.x
+				import data.x.f as g
+
+				p { g(1, a) }
+				p { x.f(1, b) }
+				p { data.x.f(1, c) }
+				`,
+			},
 		},
 		{
-			note:          "allOf schema with different unmergeable types",
-			schema:        allOfTypeErrorSchema,
-			expectedError: fmt.Errorf("unable to merge these schemas"),
+			note: "undefined",
+			modules: []string{
+				`package x
+
+				p {
+					f(1)
+				}`,
+			},
+			wantErr: true,
 		},
 		{
-			note:          "allOf unmergeable schema with different parent and items types",
-			schema:        allOfSchemaWithParentError,
-			expectedError: fmt.Errorf("unable to merge these schemas"),
+			note: "must apply",
+			modules: []string{
+				`package x
+
+				f(1)
+
+				p {
+					f
+				}
+				`,
+			},
+			wantErr: true,
 		},
 		{
-			note:          "allOf schema of Array type with uneven numbers of items to merge",
-			schema:        allOfSchemaWithUnevenArray,
-			expectedError: nil,
+			note: "must apply",
+			modules: []string{
+				`package x
+				f(1)
+				p { f.x }`,
+			},
+			wantErr: true,
 		},
 		{
-			note:          "allOf schema with unmergeable types String and Boolean",
-			schema:        allOfStringSchemaWithError,
-			expectedError: fmt.Errorf("unable to merge these schemas"),
+			note: "call argument ref output vars",
+			modules: []string{
+				`package x
+
+				f(x)
+
+				p { f(data.foo[i]) }`,
+			},
+			wantErr: false,
 		},
 	}
-
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler()
-			var schema interface{}
-			err := util.Unmarshal([]byte(tc.schema), &schema)
-			if err != nil {
-				t.Fatal("Unexpected error:", err)
-			}
-			schemaSet := NewSchemaSet()
-			schemaSet.Put(SchemaRootRef, schema)
-			c.WithSchemas(schemaSet)
-			compileStages(c, c.checkTypes)
-			if tc.expectedError != nil {
-				if errors.Is(c.Errors, tc.expectedError) {
-					t.Fatal("Unexpected error:", err)
+			var err error
+			modules := map[string]*Module{}
+			for i, module := range tc.modules {
+				name := fmt.Sprintf("mod%d", i)
+				modules[name], err = ParseModule(name, module)
+				if err != nil {
+					panic(err)
 				}
-			} else {
-				assertNotFailed(t, c)
+			}
+			c := NewCompiler()
+			c.Compile(modules)
+			if tc.wantErr && !c.Failed() {
+				t.Errorf("Expected compilation error")
+			} else if !tc.wantErr && c.Failed() {
+				t.Errorf("Unexpected compilation error(s): %v", c.Errors)
 			}
 		})
 	}
 }
 
-func TestCompilerCheckRuleConflicts(t *testing.T) {
-
-	c := getCompilerWithParsedModules(map[string]string{
-		"mod1.rego": `package badrules
+func TestCompilerErrorLimit(t *testing.T) {
+	modules := map[string]*Module{
+		"test": MustParseModule(`package test
+	r = y { y = true; x = z }
 
-p[x] { x = 1 }
-p[x] = y { x = y; x = "a" }
-q[1] { true }
-q = {1, 2, 3} { true }
-r[x] = y { x = y; x = "a" }
-r[x] = y { x = y; x = "a" }`,
+	s[x] = y {
+		z = y + x
+	}
 
-		"mod2.rego": `package badrules.r
+	t[x] { split(x, y, z) }
+	`),
+	}
 
-q[1] { true }`,
+	c := NewCompiler().SetErrorLimit(2)
+	c.Compile(modules)
 
-		"mod3.rego": `package badrules.defkw
+	errs := c.Errors
+	exp := []string{
+		"2:20: rego_unsafe_var_error: var x is unsafe",
+		"2:20: rego_unsafe_var_error: var z is unsafe",
+		"rego_compile_error: error limit reached",
+	}
 
-default foo = 1
-default foo = 2
-foo = 3 { true }`,
-		"mod4.rego": `package adrules.arity
+	result := make([]string, 0, len(errs))
+	for _, err := range errs {
+		result = append(result, err.Error())
+	}
 
-f(1) { true }
-f { true }
+	sort.Strings(exp)
+	sort.Strings(result)
+	if !reflect.DeepEqual(exp, result) {
+		t.Errorf("Expected errors %v, got %v", exp, result)
+	}
+}
 
-g(1) { true }
-g(1,2) { true }`,
-		"mod5.rego": `package badrules.dataoverlap
+func TestCompilerCheckSafetyHead(t *testing.T) {
+	c := NewCompiler()
+	c.Modules = getCompilerTestModules()
+	popts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+	c.Modules["newMod"] = MustParseModuleWithOpts(`package a.b
+
+unboundKey[x1] = y { q[y] = {"foo": [1, 2, [{"bar": y}]]} }
+unboundVal[y] = x2 { q[y] = {"foo": [1, 2, [{"bar": y}]]} }
+unboundCompositeVal[y] = [{"foo": x3, "bar": y}] { q[y] = {"foo": [1, 2, [{"bar": y}]]} }
+unboundCompositeKey[[{"x": x4}]] { q[y] }
+unboundBuiltinOperator = eq { 4 = 1 }
+unboundElse { false } else = else_var { true }
+c.d.e[x5] if true
+f.g.h[y] = x6 if y := "y"
+i.j.k contains x7 if true
+`, popts)
+	compileStages(c, c.checkSafetyRuleHeads)
 
-p { true }`,
-		"mod6.rego": `package badrules.existserr
+	makeErrMsg := func(v string) string {
+		return fmt.Sprintf("rego_unsafe_var_error: var %v is unsafe", v)
+	}
 
-p { true }`,
-		"mod7.rego": `package badrules.redeclaration
+	expected := []string{
+		makeErrMsg("x1"),
+		makeErrMsg("x2"),
+		makeErrMsg("x3"),
+		makeErrMsg("x4"),
+		makeErrMsg("x5"),
+		makeErrMsg("x6"),
+		makeErrMsg("x7"),
+		makeErrMsg("eq"),
+		makeErrMsg("else_var"),
+	}
 
-p1 := 1
-p1 := 2
+	result := compilerErrsToStringSlice(c.Errors)
+	sort.Strings(expected)
 
-p2 = 1
-p2 := 2`})
+	if len(result) != len(expected) {
+		t.Fatalf("Expected %d:\n%v\nBut got %d:\n%v", len(expected), strings.Join(expected, "\n"), len(result), strings.Join(result, "\n"))
+	}
 
-	c.WithPathConflictsCheck(func(path []string) (bool, error) {
-		if reflect.DeepEqual(path, []string{"badrules", "dataoverlap", "p"}) {
-			return true, nil
-		} else if reflect.DeepEqual(path, []string{"badrules", "existserr", "p"}) {
-			return false, fmt.Errorf("unexpected error")
+	for i := range result {
+		if expected[i] != result[i] {
+			t.Errorf("Expected %v but got: %v", expected[i], result[i])
 		}
-		return false, nil
-	})
+	}
 
-	compileStages(c, c.checkRuleConflicts)
+}
 
-	expected := []string{
-		"rego_compile_error: conflict check for data path badrules/existserr/p: unexpected error",
-		"rego_compile_error: conflicting rule for data path badrules/dataoverlap/p found",
-		"rego_type_error: conflicting rules named f found",
-		"rego_type_error: conflicting rules named g found",
-		"rego_type_error: conflicting rules named p found",
-		"rego_type_error: conflicting rules named q found",
-		"rego_type_error: multiple default rules named foo found",
-		"rego_type_error: package badrules.r conflicts with rule defined at mod1.rego:7",
-		"rego_type_error: package badrules.r conflicts with rule defined at mod1.rego:8",
-		"rego_type_error: rule named p1 redeclared at mod7.rego:4",
-		"rego_type_error: rule named p2 redeclared at mod7.rego:7",
+func TestCompilerCheckSafetyBodyReordering(t *testing.T) {
+	tests := []struct {
+		note     string
+		body     string
+		expected string
+	}{
+		{"noop", `x = 1; x != 0`, `x = 1; x != 0`},
+		{"var/ref", `a[i] = x; a = [1, 2, 3, 4]`, `a = [1, 2, 3, 4]; a[i] = x`},
+		{"var/ref (nested)", `a = [1, 2, 3, 4]; a[b[i]] = x; b = [0, 0, 0, 0]`, `a = [1, 2, 3, 4]; b = [0, 0, 0, 0]; a[b[i]] = x`},
+		{"negation",
+			`a = [true, false]; b = [true, false]; not a[i]; b[i]`,
+			`a = [true, false]; b = [true, false]; b[i]; not a[i]`},
+		{"built-in", `x != 0; count([1, 2, 3], x)`, `count([1, 2, 3], x); x != 0`},
+		{"var/var 1", `x = y; z = 1; y = z`, `z = 1; y = z; x = y`},
+		{"var/var 2", `x = y; 1 = z; z = y`, `1 = z; z = y; x = y`},
+		{"var/var 3", `x != 0; y = x; y = 1`, `y = 1; y = x; x != 0`},
+		{"array compr/var", `x != 0; [y | y = 1] = x`, `[y | y = 1] = x; x != 0`},
+		{"array compr/array", `[1] != [x]; [y | y = 1] = [x]`, `[y | y = 1] = [x]; [1] != [x]`},
+		{"with", `data.a.b.d.t with input as x; x = 1`, `x = 1; data.a.b.d.t with input as x`},
+		{"with-2", `data.a.b.d.t with input.x as x; x = 1`, `x = 1; data.a.b.d.t with input.x as x`},
+		{"with-nop", "data.somedoc[x] with input as true", "data.somedoc[x] with input as true"},
+		{"ref-head", `s = [["foo"], ["bar"]]; x = y[0]; y = s[_]; contains(x, "oo")`, `
+		s = [["foo"], ["bar"]];
+		y = s[_];
+		x = y[0];
+		contains(x, "oo")
+	`},
+		{"userfunc", `split(y, ".", z); data.a.b.funcs.fn("...foo.bar..", y)`, `data.a.b.funcs.fn("...foo.bar..", y); split(y, ".", z)`},
+		{"every", `every _ in [] { x != 1 }; x = 1`, `__local4__ = []; x = 1; every __local3__, _ in __local4__ { x != 1}`},
+		{"every-domain", `every _ in xs { true }; xs = [1]`, `xs = [1]; __local4__ = xs; every __local3__, _ in __local4__ { true }`},
 	}
 
-	assertCompilerErrorStrings(t, c, expected)
-}
+	for i, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			c := NewCompiler()
+			c.Modules = getCompilerTestModules()
+			c.Modules["reordering"] = MustParseModuleWithOpts(fmt.Sprintf(
+				`package test
+				p { %s }`, tc.body), opts)
 
-func TestCompilerCheckUndefinedFuncs(t *testing.T) {
+			compileStages(c, c.checkSafetyRuleBodies)
 
-	module := `
-		package test
+			if c.Failed() {
+				t.Errorf("%v (#%d): Unexpected compilation error: %v", tc.note, i, c.Errors)
+				return
+			}
 
-		undefined_function {
-			data.deadbeef(x)
-		}
+			expected := MustParseBodyWithOpts(tc.expected, opts)
+			result := c.Modules["reordering"].Rules[0].Body
 
-		undefined_global {
-			deadbeef(x)
-		}
+			if !expected.Equal(result) {
+				t.Errorf("%v (#%d): Expected body to be ordered and equal to %v but got: %v", tc.note, i, expected, result)
+			}
+		})
+	}
+}
 
-		# NOTE: all the dynamic dispatch examples here are not supported,
-		#       we're checking assertions about the error returned.
-		undefined_dynamic_dispatch {
-			x = "f"; data.test2[x](1)
-		}
+func TestCompilerCheckSafetyBodyReorderingClosures(t *testing.T) {
+	opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
 
-		undefined_dynamic_dispatch_declared_var {
-			y := "f"; data.test2[y](1)
-		}
-
-		undefined_dynamic_dispatch_declared_var_in_array {
-			z := "f"; data.test2[[z]](1)
-		}
-
-		arity_mismatch_1 {
-			data.test2.f(1,2,3)
-		}
+	tests := []struct {
+		note string
+		mod  *Module
+		exp  Body
+	}{
+		{
+			note: "comprehensions-1",
+			mod: MustParseModule(`package compr
 
-		arity_mismatch_2 {
-			data.test2.f()
-		}
+import data.b
+import data.c
+p = true { v = [null | true]; xs = [x | a[i] = x; a = [y | y != 1; y = c[j]]]; xs[j] > 0; z = [true | data.a.b.d.t with input as i2; i2 = i]; b[i] = j }
+`),
+			exp: MustParseBody(`v = [null | true]; data.b[i] = j; xs = [x | a = [y | y = data.c[j]; y != 1]; a[i] = x]; xs[j] > 0; z = [true | i2 = i; data.a.b.d.t with input as i2]`),
+		},
+		{
+			note: "comprehensions-2",
+			mod: MustParseModule(`package compr
 
-		arity_mismatch_3 {
-			x:= data.test2.f()
-		}
-	`
+import data.b
+import data.c
+q = true { _ = [x | x = b[i]]; _ = b[j]; _ = [x | x = true; x != false]; true != false; _ = [x | data.foo[_] = x]; data.foo[_] = _ }
+`),
+			exp: MustParseBody(`_ = [x | x = data.b[i]]; _ = data.b[j]; _ = [x | x = true; x != false]; true != false; _ = [x | data.foo[_] = x]; data.foo[_] = _`),
+		},
 
-	module2 := `
-		package test2
+		{
+			note: "comprehensions-3",
+			mod: MustParseModule(`package compr
 
-		f(x) = x
-	`
+import data.b
+import data.c
+fn(x) = y {
+	trim(x, ".", y)
+}
+r = true { a = [x | split(y, ".", z); x = z[i]; fn("...foo.bar..", y)] }
+`),
+			exp: MustParseBody(`a = [x | data.compr.fn("...foo.bar..", y); split(y, ".", z); x = z[i]]`),
+		},
+		{
+			note: "closure over function output",
+			mod: MustParseModule(`package test
+import future.keywords
 
-	_, err := CompileModules(map[string]string{
-		"test.rego":  module,
-		"test2.rego": module2,
-	})
-	if err == nil {
-		t.Fatal("expected errors")
+p {
+	object.get(input.subject.roles[_], comp, [""], output)
+	comp = [ 1 | true ]
+	every y in [2] {
+		y in output
 	}
-
-	result := err.Error()
-	want := []string{
-		"rego_type_error: undefined function data.deadbeef",
-		"rego_type_error: undefined function deadbeef",
-		"rego_type_error: undefined function data.test2[x]",
-		"rego_type_error: undefined function data.test2[y]",
-		"rego_type_error: undefined function data.test2[[z]]",
-		"rego_type_error: function data.test2.f has arity 1, got 3 arguments",
-		"test.rego:31: rego_type_error: function data.test2.f has arity 1, got 0 arguments",
-		"test.rego:35: rego_type_error: function data.test2.f has arity 1, got 0 arguments",
+}`),
+			exp: MustParseBodyWithOpts(`comp = [1 | true]
+				__local2__ = [2]
+				object.get(input.subject.roles[_], comp, [""], output)
+				every __local0__, __local1__ in __local2__ { internal.member_2(__local1__, output) }`, opts),
+		},
 	}
-	for _, w := range want {
-		if !strings.Contains(result, w) {
-			t.Fatalf("Expected %q in result but got: %v", w, result)
-		}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			c.Modules = map[string]*Module{"mod": tc.mod}
+			compileStages(c, c.checkSafetyRuleBodies)
+			assertNotFailed(t, c)
+			last := len(c.Modules["mod"].Rules) - 1
+			actual := c.Modules["mod"].Rules[last].Body
+			if !actual.Equal(tc.exp) {
+				t.Errorf("Expected reordered body to be equal to:\n%v\nBut got:\n%v", tc.exp, actual)
+			}
+		})
 	}
 }
 
-func TestCompilerQueryCompilerCheckUndefinedFuncs(t *testing.T) {
-	compiler := NewCompiler()
+func TestCompilerCheckSafetyBodyErrors(t *testing.T) {
 
-	for _, tc := range []struct {
-		note, query, err string
+	moduleBegin := `
+		package a.b
+
+		import input.aref.b.c as foo
+		import input.avar as bar
+		import data.m.n as baz
+	`
+
+	tests := []struct {
+		note          string
+		moduleContent string
+		expected      string
 	}{
+		{"ref-head", `p { a.b.c = "foo" }`, `{a,}`},
+		{"ref-head-2", `p { {"foo": [{"bar": a.b.c}]} = {"foo": [{"bar": "baz"}]} }`, `{a,}`},
+		{"negation", `p { a = [1, 2, 3, 4]; not a[i] = x }`, `{i, x}`},
+		{"negation-head", `p[x] { a = [1, 2, 3, 4]; not a[i] = x }`, `{i,x}`},
+		{"negation-multiple", `p { a = [1, 2, 3, 4]; b = [1, 2, 3, 4]; not a[i] = x; not b[j] = x }`, `{i, x, j}`},
+		{"negation-nested", `p { a = [{"foo": ["bar", "baz"]}]; not a[0].foo = [a[0].foo[i], a[0].foo[j]] } `, `{i, j}`},
+		{"builtin-input", `p { count([1, 2, x], x) }`, `{x,}`},
+		{"builtin-input-name", `p { count(eq, 1) }`, `{eq,}`},
+		{"builtin-multiple", `p { x > 0; x <= 3; x != 2 }`, `{x,}`},
+		{"unordered-object-keys", `p { x = "a"; [{x: y, z: a}] = [{"a": 1, "b": 2}]}`, `{a,y,z}`},
+		{"unordered-sets", `p { x = "a"; [{x, y}] = [{1, 2}]}`, `{y,}`},
+		{"array-compr", `p { _ = [x | x = data.a[_]; y > 1] }`, `{y,}`},
+		{"array-compr-nested", `p { _ = [x | x = a[_]; a = [y | y = data.a[_]; z > 1]] }`, `{z,}`},
+		{"array-compr-closure", `p { _ = [v | v = [x | x = data.a[_]]; x > 1] }`, `{x,}`},
+		{"array-compr-term", `p { _ = [u | true] }`, `{u,}`},
+		{"array-compr-term-nested", `p { _ = [v | v = [w | w != 0]] }`, `{w,}`},
+		{"array-compr-mixed", `p { _ = [x | y = [a | a = z[i]]] }`, `{a, x, z, i}`},
+		{"array-compr-builtin", `p { [true | eq != 2] }`, `{eq,}`},
+		{"closure-self", `p { x = [x | x = 1] }`, `{x,}`},
+		{"closure-transitive", `p { x = y; x = [y | y = 1] }`, `{x,y}`},
+		{"nested", `p { count(baz[i].attr[bar[dead.beef]], n) }`, `{dead,}`},
+		{"negated-import", `p { not foo; not bar; not baz }`, `set()`},
+		{"rewritten", `p[{"foo": dead[i]}] { true }`, `{dead, i}`},
+		{"with-value", `p { data.a.b.d.t with input as x }`, `{x,}`},
+		{"with-value-2", `p { x = data.a.b.d.t with input as x }`, `{x,}`},
+		{"else-kw", "p { false } else { count(x, 1) }", `{x,}`},
+		{"function", "foo(x) = [y, z] { split(x, y, z) }", `{y,z}`},
+		{"call-vars-input", "p { f(x, x) } f(x) = x { true }", `{x,}`},
+		{"call-no-output", "p { f(x) } f(x) = x { true }", `{x,}`},
+		{"call-too-few", "p { f(1,x) } f(x,y) { true }", "{x,}"},
+		{"object-key-comprehension", "p { { {p|x}: 0 } }", "{x,}"},
+		{"set-value-comprehension", "p { {1, {p|x}} }", "{x,}"},
+		{"every", "p { every y in [10] { x > y } }", "{x,}"},
+	}
 
-		{note: "undefined function", query: `data.foo(1)`, err: "undefined function data.foo"},
-		{note: "undefined global function", query: `foo(1)`, err: "undefined function foo"},
-		{note: "var", query: `x = "f"; data[x](1)`, err: "undefined function data[x]"},
-		{note: "declared var", query: `x := "f"; data[x](1)`, err: "undefined function data[x]"},
-		{note: "declared var in array", query: `x := "f"; data[[x]](1)`, err: "undefined function data[[x]]"},
-	} {
+	makeErrMsg := func(varName string) string {
+		return fmt.Sprintf("rego_unsafe_var_error: var %v is unsafe", varName)
+	}
+
+	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-			_, err := compiler.QueryCompiler().Compile(MustParseBody(tc.query))
-			if !strings.Contains(err.Error(), tc.err) {
-				t.Errorf("Unexpected compilation error: %v (want  %s)", err, tc.err)
+
+			// Build slice of expected error messages.
+			expected := []string{}
+
+			_ = MustParseTerm(tc.expected).Value.(Set).Iter(func(x *Term) error {
+				expected = append(expected, makeErrMsg(string(x.Value.(Var))))
+				return nil
+			}) // cannot return error
+
+			sort.Strings(expected)
+
+			// Compile test module.
+			popts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			c := NewCompiler()
+			c.Modules = map[string]*Module{
+				"newMod": MustParseModuleWithOpts(fmt.Sprintf(`
+
+				%v
+
+				%v
+
+				`, moduleBegin, tc.moduleContent), popts),
+			}
+
+			compileStages(c, c.checkSafetyRuleBodies)
+
+			// Get errors.
+			result := compilerErrsToStringSlice(c.Errors)
+
+			// Check against expected.
+			if len(result) != len(expected) {
+				t.Fatalf("Expected %d:\n%v\nBut got %d:\n%v", len(expected), strings.Join(expected, "\n"), len(result), strings.Join(result, "\n"))
 			}
+
+			for i := range result {
+				if expected[i] != result[i] {
+					t.Errorf("Expected %v but got: %v", expected[i], result[i])
+				}
+			}
+
 		})
 	}
 }
 
-func TestCompilerImportsResolved(t *testing.T) {
+func TestCompilerCheckSafetyVarLoc(t *testing.T) {
 
-	modules := map[string]*Module{
-		"mod1": MustParseModule(`package ex
+	_, err := CompileModules(map[string]string{"test.rego": `package test
 
-import data
-import input
-import data.foo
-import input.bar
-import data.abc as baz
-import input.abc as qux`,
-		),
+p {
+	not x
+	x > y
+}`})
+
+	if err == nil {
+		t.Fatal("expected error")
 	}
 
-	c := NewCompiler()
-	c.Compile(modules)
+	errs := err.(Errors)
 
-	assertNotFailed(t, c)
+	if !strings.Contains(errs[0].Message, "var x is unsafe") || errs[0].Location.Row != 4 {
+		t.Fatal("expected error on row 4 but got:", err)
+	}
 
-	if len(c.Modules["mod1"].Imports) != 0 {
-		t.Fatalf("Expected imports to be empty after compile but got: %v", c.Modules)
+	if !strings.Contains(errs[1].Message, "var y is unsafe") || errs[1].Location.Row != 5 {
+		t.Fatal("expected y is unsafe on row 5 but got:", err)
+	}
+}
+
+func TestCompilerCheckSafetyFunctionAndContainsKeyword(t *testing.T) {
+	_, err := CompileModules(map[string]string{"test.rego": `package play
+
+			import future.keywords.contains
+
+			p(id) contains x {
+				x := id
+			}`})
+	if err == nil {
+		t.Fatal("expected error")
 	}
 
+	errs := err.(Errors)
+	if !strings.Contains(errs[0].Message, "the contains keyword can only be used with multi-value rule definitions (e.g., p contains <VALUE> { ... })") {
+		t.Fatal("wrong error message:", err)
+	}
+	if errs[0].Location.Row != 5 {
+		t.Fatal("expected error on line 5 but got:", errs[0].Location.Row)
+	}
 }
 
-func TestCompilerExprExpansion(t *testing.T) {
+func TestCompilerCheckTypes(t *testing.T) {
+	c := NewCompiler()
+	modules := getCompilerTestModules()
+	c.Modules = map[string]*Module{"mod6": modules["mod6"], "mod7": modules["mod7"]}
+	compileStages(c, c.checkTypes)
+	assertNotFailed(t, c)
+}
 
-	tests := []struct {
-		note     string
-		input    string
-		expected []*Expr
-	}{
-		{
-			note:  "identity",
-			input: "x",
-			expected: []*Expr{
-				MustParseExpr("x"),
-			},
-		},
-		{
-			note:  "single",
-			input: "x+y",
-			expected: []*Expr{
-				MustParseExpr("x+y"),
-			},
-		},
-		{
-			note:  "chained",
-			input: "x+y+z+w",
-			expected: []*Expr{
-				MustParseExpr("plus(x, y, __local0__)"),
-				MustParseExpr("plus(__local0__, z, __local1__)"),
-				MustParseExpr("plus(__local1__, w)"),
-			},
-		},
-		{
-			note:  "assoc",
-			input: "x+y*z",
-			expected: []*Expr{
-				MustParseExpr("mul(y, z, __local0__)"),
+func TestCompilerCheckRuleConflicts(t *testing.T) {
+
+	c := getCompilerWithParsedModules(map[string]string{
+		"mod1.rego": `package badrules
+
+p[x] { x = 1 }
+p[x] = y { x = y; x = "a" }
+q[1] { true }
+q = {1, 2, 3} { true }
+r[x] = y { x = y; x = "a" }
+r[x] = y { x = y; x = "a" }`,
+
+		"mod2.rego": `package badrules.r
+
+q[1] { true }`,
+
+		"mod3.rego": `package badrules.defkw
+
+default foo = 1
+default foo = 2
+foo = 3 { true }
+
+default p.q.bar = 1
+default p.q.bar = 2
+p.q.bar = 3 { true }
+`,
+		"mod4.rego": `package badrules.arity
+
+f(1) { true }
+f { true }
+
+g(1) { true }
+g(1,2) { true }
+
+p.q.h(1) { true }
+p.q.h { true }
+
+p.q.i(1) { true }
+p.q.i(1,2) { true }`,
+		"mod5.rego": `package badrules.dataoverlap
+
+p { true }`,
+		"mod6.rego": `package badrules.existserr
+
+p { true }`,
+
+		"mod7.rego": `package badrules.foo
+import future.keywords
+
+bar.baz contains "quz" if true`,
+	})
+
+	c.WithPathConflictsCheck(func(path []string) (bool, error) {
+		if reflect.DeepEqual(path, []string{"badrules", "dataoverlap", "p"}) {
+			return true, nil
+		} else if reflect.DeepEqual(path, []string{"badrules", "existserr", "p"}) {
+			return false, fmt.Errorf("unexpected error")
+		}
+		return false, nil
+	})
+
+	compileStages(c, c.checkRuleConflicts)
+
+	expected := []string{
+		"rego_compile_error: conflict check for data path badrules/existserr/p: unexpected error",
+		"rego_compile_error: conflicting rule for data path badrules/dataoverlap/p found",
+		"rego_type_error: conflicting rules data.badrules.arity.f found",
+		"rego_type_error: conflicting rules data.badrules.arity.g found",
+		"rego_type_error: conflicting rules data.badrules.arity.p.q.h found",
+		"rego_type_error: conflicting rules data.badrules.arity.p.q.i found",
+		"rego_type_error: conflicting rules data.badrules.p[x] found",
+		"rego_type_error: conflicting rules data.badrules.q found",
+		"rego_type_error: multiple default rules data.badrules.defkw.foo found",
+		"rego_type_error: multiple default rules data.badrules.defkw.p.q.bar found",
+		"rego_type_error: package badrules.r conflicts with rule r[x] defined at mod1.rego:7",
+		"rego_type_error: package badrules.r conflicts with rule r[x] defined at mod1.rego:8",
+	}
+
+	assertCompilerErrorStrings(t, c, expected)
+}
+
+func TestCompilerCheckRuleConflictsDotsInRuleHeads(t *testing.T) {
+
+	tests := []struct {
+		note    string
+		modules []*Module
+		err     string
+	}{
+		{
+			note: "arity mismatch, ref and non-ref rule",
+			modules: modules(
+				`package pkg
+				p.q.r { true }`,
+				`package pkg.p.q
+				r(_) = 2`),
+			err: "rego_type_error: conflicting rules data.pkg.p.q.r found",
+		},
+		{
+			note: "two default rules, ref and non-ref rule",
+			modules: modules(
+				`package pkg
+				default p.q.r = 3
+				p.q.r { true }`,
+				`package pkg.p.q
+				default r = 4
+				r = 2`),
+			err: "rego_type_error: multiple default rules data.pkg.p.q.r found",
+		},
+		{
+			note: "arity mismatch, ref and ref rule",
+			modules: modules(
+				`package pkg.a.b
+				p.q.r { true }`,
+				`package pkg.a
+				b.p.q.r(_) = 2`),
+			err: "rego_type_error: conflicting rules data.pkg.a.b.p.q.r found",
+		},
+		{
+			note: "two default rules, ref and ref rule",
+			modules: modules(
+				`package pkg
+				default p.q.w.r = 3
+				p.q.w.r { true }`,
+				`package pkg.p
+				default q.w.r = 4
+				q.w.r = 2`),
+			err: "rego_type_error: multiple default rules data.pkg.p.q.w.r found",
+		},
+		{
+			note: "multi-value + single-value rules, both with same ref prefix",
+			modules: modules(
+				`package pkg
+				p.q.w[x] = 1 if x := "foo"`,
+				`package pkg
+				p.q.w contains "bar"`),
+			err: "rego_type_error: conflicting rules data.pkg.p.q.w found",
+		},
+		{
+			note: "two multi-value rules, both with same ref",
+			modules: modules(
+				`package pkg
+				p.q.w contains "baz"`,
+				`package pkg
+				p.q.w contains "bar"`),
+		},
+		{
+			note: "module conflict: non-ref rule",
+			modules: modules(
+				`package pkg.q
+				r { true }`,
+				`package pkg.q.r`),
+			err: "rego_type_error: package pkg.q.r conflicts with rule r defined at mod0.rego:2",
+		},
+		{
+			note: "module conflict: ref rule",
+			modules: modules(
+				`package pkg
+				p.q.r { true }`,
+				`package pkg.p.q.r`),
+			err: "rego_type_error: package pkg.p.q.r conflicts with rule p.q.r defined at mod0.rego:2",
+		},
+		{
+			note: "single-value with other rule overlap",
+			modules: modules(
+				`package pkg
+				p.q.r { true }`,
+				`package pkg
+				p.q.r.s { true }`),
+			err: "rego_type_error: single-value rule data.pkg.p.q.r conflicts with [data.pkg.p.q.r.s]",
+		},
+		{
+			note: "single-value with other rule overlap",
+			modules: modules(
+				`package pkg
+				p.q.r { true }
+				p.q.r.s { true }
+				p.q.r.t { true }`),
+			err: "rego_type_error: single-value rule data.pkg.p.q.r conflicts with [data.pkg.p.q.r.s data.pkg.p.q.r.t]",
+		},
+		{
+			note: "single-value with other rule overlap, unknown key",
+			modules: modules(
+				`package pkg
+				p.q[r] = x { r = input.key; x = input.foo }
+				p.q.r.s = x { true }
+				`),
+			err: "rego_type_error: single-value rule data.pkg.p.q[r] conflicts with [data.pkg.p.q.r.s]",
+		},
+		{
+			note: "single-value partial object with other partial object rule overlap, unknown keys (regression test for #5855)",
+			modules: modules(
+				`package pkg
+				p[r] := x { r = input.key; x = input.bar }
+				p.q[r] := x { r = input.key; x = input.bar }
+				`),
+			err: "rego_type_error: single-value rule data.pkg.p[r] conflicts with [data.pkg.p.q[r]]",
+		},
+		{
+			note: "single-value partial object with other partial object (implicit 'true' value) rule overlap, unknown keys",
+			modules: modules(
+				`package pkg
+				p[r] := x { r = input.key; x = input.bar }
+				p.q[r] { r = input.key }
+				`),
+			err: "rego_type_error: single-value rule data.pkg.p[r] conflicts with [data.pkg.p.q[r]]",
+		},
+		{
+			note: "single-value partial object with multi-value rule (ref head) overlap, unknown key",
+			modules: modules(
+				`package pkg
+				import future.keywords
+				p[r] := x { r = input.key; x = input.bar }
+				p.q contains r { r = input.key }
+				`),
+		},
+		{
+			note: "single-value partial object with multi-value rule overlap, unknown key",
+			modules: modules(
+				`package pkg
+				p[r] := x { r = input.key; x = input.bar }
+				p.q { true }
+				`),
+			err: "rego_type_error: conflicting rules data.pkg.p found",
+		},
+		{
+			note: "single-value rule with known and unknown key",
+			modules: modules(
+				`package pkg
+				p.q[r] = x { r = input.key; x = input.foo }
+				p.q.s = "x" { true }
+				`),
+		},
+		{
+			note: "multi-value rule with other rule overlap",
+			modules: modules(
+				`package pkg
+				p[v] { v := ["a", "b"][_] }
+				p.q := 42
+				`),
+			err: "rego_type_error: multi-value rule data.pkg.p conflicts with [data.pkg.p.q]",
+		},
+		{
+			note: "multi-value rule with other rule (ref) overlap",
+			modules: modules(
+				`package pkg
+				p[v] { v := ["a", "b"][_] }
+				p.q.r { true }
+				`),
+			err: "rego_type_error: multi-value rule data.pkg.p conflicts with [data.pkg.p.q.r]",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			mods := make(map[string]*Module, len(tc.modules))
+			for i, m := range tc.modules {
+				mods[fmt.Sprint(i)] = m
+			}
+			c := NewCompiler()
+			c.Modules = mods
+			compileStages(c, c.checkRuleConflicts)
+			if tc.err != "" {
+				assertCompilerErrorStrings(t, c, []string{tc.err})
+			} else {
+				assertCompilerErrorStrings(t, c, []string{})
+			}
+		})
+	}
+}
+
+func TestCompilerCheckUndefinedFuncs(t *testing.T) {
+
+	module := `
+		package test
+
+		undefined_function {
+			data.deadbeef(x)
+		}
+
+		undefined_global {
+			deadbeef(x)
+		}
+
+		# NOTE: all the dynamic dispatch examples here are not supported,
+		#       we're checking assertions about the error returned.
+		undefined_dynamic_dispatch {
+			x = "f"; data.test2[x](1)
+		}
+
+		undefined_dynamic_dispatch_declared_var {
+			y := "f"; data.test2[y](1)
+		}
+
+		undefined_dynamic_dispatch_declared_var_in_array {
+			z := "f"; data.test2[[z]](1)
+		}
+
+		arity_mismatch_1 {
+			data.test2.f(1,2,3)
+		}
+
+		arity_mismatch_2 {
+			data.test2.f()
+		}
+
+		arity_mismatch_3 {
+			x:= data.test2.f()
+		}
+	`
+
+	module2 := `
+		package test2
+
+		f(x) = x
+	`
+
+	_, err := CompileModules(map[string]string{
+		"test.rego":  module,
+		"test2.rego": module2,
+	})
+	if err == nil {
+		t.Fatal("expected errors")
+	}
+
+	result := err.Error()
+	want := []string{
+		"rego_type_error: undefined function data.deadbeef",
+		"rego_type_error: undefined function deadbeef",
+		"rego_type_error: undefined function data.test2[x]",
+		"rego_type_error: undefined function data.test2[y]",
+		"rego_type_error: undefined function data.test2[[z]]",
+		"rego_type_error: function data.test2.f has arity 1, got 3 arguments",
+		"test.rego:31: rego_type_error: function data.test2.f has arity 1, got 0 arguments",
+		"test.rego:35: rego_type_error: function data.test2.f has arity 1, got 0 arguments",
+	}
+	for _, w := range want {
+		if !strings.Contains(result, w) {
+			t.Fatalf("Expected %q in result but got: %v", w, result)
+		}
+	}
+}
+
+func TestCompilerQueryCompilerCheckUndefinedFuncs(t *testing.T) {
+	compiler := NewCompiler()
+
+	for _, tc := range []struct {
+		note, query, err string
+	}{
+
+		{note: "undefined function", query: `data.foo(1)`, err: "undefined function data.foo"},
+		{note: "undefined global function", query: `foo(1)`, err: "undefined function foo"},
+		{note: "var", query: `x = "f"; data[x](1)`, err: "undefined function data[x]"},
+		{note: "declared var", query: `x := "f"; data[x](1)`, err: "undefined function data[x]"},
+		{note: "declared var in array", query: `x := "f"; data[[x]](1)`, err: "undefined function data[[x]]"},
+	} {
+		t.Run(tc.note, func(t *testing.T) {
+			_, err := compiler.QueryCompiler().Compile(MustParseBody(tc.query))
+			if !strings.Contains(err.Error(), tc.err) {
+				t.Errorf("Unexpected compilation error: %v (want  %s)", err, tc.err)
+			}
+		})
+	}
+}
+
+func TestCompilerImportsResolved(t *testing.T) {
+
+	modules := map[string]*Module{
+		"mod1": MustParseModule(`package ex
+
+import data
+import input
+import data.foo
+import input.bar
+import data.abc as baz
+import input.abc as qux`,
+		),
+	}
+
+	c := NewCompiler()
+	c.Compile(modules)
+
+	assertNotFailed(t, c)
+
+	if len(c.Modules["mod1"].Imports) != 0 {
+		t.Fatalf("Expected imports to be empty after compile but got: %v", c.Modules)
+	}
+
+}
+
+func TestCompilerExprExpansion(t *testing.T) {
+
+	tests := []struct {
+		note     string
+		input    string
+		expected []*Expr
+	}{
+		{
+			note:  "identity",
+			input: "x",
+			expected: []*Expr{
+				MustParseExpr("x"),
+			},
+		},
+		{
+			note:  "single",
+			input: "x+y",
+			expected: []*Expr{
+				MustParseExpr("x+y"),
+			},
+		},
+		{
+			note:  "chained",
+			input: "x+y+z+w",
+			expected: []*Expr{
+				MustParseExpr("plus(x, y, __local0__)"),
+				MustParseExpr("plus(__local0__, z, __local1__)"),
+				MustParseExpr("plus(__local1__, w)"),
+			},
+		},
+		{
+			note:  "assoc",
+			input: "x+y*z",
+			expected: []*Expr{
+				MustParseExpr("mul(y, z, __local0__)"),
 				MustParseExpr("plus(x, __local0__)"),
 			},
 		},
@@ -1434,13 +2374,26 @@ func TestCompilerRewriteExprTerms(t *testing.T) {
 
 				f(__local0__[0]) { true; __local0__ = [1] }`,
 		},
+		{
+			note: "every: domain",
+			module: `
+			package test
+
+			p { every x in [1,2] { x } }`,
+			expected: `
+			package test
+
+			p { __local2__ = [1, 2]; every __local0__, __local1__ in __local2__ { __local1__ } }`,
+		},
 	}
 
 	for _, tc := range cases {
 		t.Run(tc.note, func(t *testing.T) {
 			compiler := NewCompiler()
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+
 			compiler.Modules = map[string]*Module{
-				"test": MustParseModule(tc.module),
+				"test": MustParseModuleWithOpts(tc.module, opts),
 			}
 			compileStages(compiler, compiler.rewriteExprTerms)
 
@@ -1448,31 +2401,13 @@ func TestCompilerRewriteExprTerms(t *testing.T) {
 			case string:
 				assertNotFailed(t, compiler)
 
-				expected := MustParseModule(exp)
+				expected := MustParseModuleWithOpts(exp, opts)
 
 				if !expected.Equal(compiler.Modules["test"]) {
 					t.Fatalf("Expected modules to be equal. Expected:\n\n%v\n\nGot:\n\n%v", expected, compiler.Modules["test"])
 				}
 			case Errors:
-				if len(exp) != len(compiler.Errors) {
-					t.Fatalf("Expected %d errors, got %d:\n\n%s\n", len(exp), len(compiler.Errors), compiler.Errors.Error())
-				}
-				incorrectErrs := false
-				for _, e := range exp {
-					found := false
-					for _, actual := range compiler.Errors {
-						if e.Message == actual.Message {
-							found = true
-							break
-						}
-					}
-					if !found {
-						incorrectErrs = true
-					}
-				}
-				if incorrectErrs {
-					t.Fatalf("Expected errors:\n\n%s\n\nGot:\n\n%s\n", exp.Error(), compiler.Errors.Error())
-				}
+				assertErrors(t, compiler.Errors, exp, false)
 			default:
 				t.Fatalf("Unsupported value type for test case 'expected' field: %v", exp)
 			}
@@ -1481,1769 +2416,4660 @@ func TestCompilerRewriteExprTerms(t *testing.T) {
 	}
 }
 
-func TestCompilerResolveAllRefs(t *testing.T) {
-	c := NewCompiler()
-	c.Modules = getCompilerTestModules()
-	c.Modules["head"] = MustParseModule(`package head
-
-import data.doc1 as bar
-import input.x.y.foo
-import input.qux as baz
-
-p[foo[bar[i]]] = {"baz": baz} { true }`)
-
-	c.Modules["elsekw"] = MustParseModule(`package elsekw
-
-	import input.x.y.foo
-	import data.doc1 as bar
-	import input.baz
-
-	p {
-		false
-	} else = foo {
-		bar
-	} else = baz {
-		true
+func TestIllegalFunctionCallRewrite(t *testing.T) {
+	cases := []struct {
+		note           string
+		module         string
+		expectedErrors []string
+	}{
+		/*{
+		  			note: "function call override in function value",
+		  			module: `package test
+		  foo(x) := x
+
+		  p := foo(bar) {
+		  	#foo := 1
+		  	bar := 2
+		  }`,
+		  			expectedErrors: []string{
+		  				"undefined function foo",
+		  			},
+		  		},*/
+		{
+			note: "function call override in array comprehension value",
+			module: `package test
+p := [foo(bar) | foo := 1; bar := 2]`,
+			expectedErrors: []string{
+				"called function foo shadowed",
+			},
+		},
+		{
+			note: "function call override in set comprehension value",
+			module: `package test
+p := {foo(bar) | foo := 1; bar := 2}`,
+			expectedErrors: []string{
+				"called function foo shadowed",
+			},
+		},
+		{
+			note: "function call override in object comprehension value",
+			module: `package test
+p := {foo(bar): bar(foo) | foo := 1; bar := 2}`,
+			expectedErrors: []string{
+				"called function bar shadowed",
+				"called function foo shadowed",
+			},
+		},
+		{
+			note: "function call override in array comprehension value",
+			module: `package test
+p := [foo.bar(baz) | foo := 1; bar := 2; baz := 3]`,
+			expectedErrors: []string{
+				"called function foo.bar shadowed",
+			},
+		},
+		{
+			note: "nested function call override in array comprehension value",
+			module: `package test
+p := [baz(foo(bar)) | foo := 1; bar := 2]`,
+			expectedErrors: []string{
+				"called function foo shadowed",
+			},
+		},
+		{
+			note: "function call override of 'input' root document",
+			module: `package test
+p := [input() | input := 1]`,
+			expectedErrors: []string{
+				"called function input shadowed",
+			},
+		},
+		{
+			note: "function call override of 'data' root document",
+			module: `package test
+p := [data() | data := 1]`,
+			expectedErrors: []string{
+				"called function data shadowed",
+			},
+		},
 	}
-	`)
-
-	c.Modules["nestedexprs"] = MustParseModule(`package nestedexprs
-
-		x = 1
-
-		p {
-			f(g(x))
-		}`)
-
-	c.Modules["assign"] = MustParseModule(`package assign
-
-		x = 1
-		y = 1
-
-		p {
-			x := y
-			[true | x := y]
-		}`)
-
-	c.Modules["someinassign"] = MustParseModule(`package someinassign
-		import future.keywords.in
-		x = 1
-		y = 1
 
-		p[x] {
-			some x in [1, 2, y]
-		}`)
-
-	c.Modules["someinassignwithkey"] = MustParseModule(`package someinassignwithkey
-		import future.keywords.in
-		x = 1
-		y = 1
-
-		p[x] {
-			some k, v in [1, 2, y]
-		}`)
-
-	c.Modules["donotresolve"] = MustParseModule(`package donotresolve
-
-		x = 1
-
-		f(x) {
-			x = 2
-		}
-		`)
-
-	c.Modules["indirectrefs"] = MustParseModule(`package indirectrefs
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := NewCompiler()
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
 
-		f(x) = [x] {true}
+			compiler.Modules = map[string]*Module{
+				"test": MustParseModuleWithOpts(tc.module, opts),
+			}
+			compileStages(compiler, compiler.rewriteLocalVars)
 
-		p {
-			f(1)[0]
-		}
-		`)
+			result := make([]string, 0, len(compiler.Errors))
+			for i := range compiler.Errors {
+				result = append(result, compiler.Errors[i].Message)
+			}
 
-	c.Modules["comprehensions"] = MustParseModule(`package comprehensions
+			sort.Strings(tc.expectedErrors)
+			sort.Strings(result)
 
-		nums = [1, 2, 3]
+			if len(tc.expectedErrors) != len(result) {
+				t.Fatalf("Expected %d errors but got %d:\n\n%v\n\nGot:\n\n%v",
+					len(tc.expectedErrors), len(result),
+					strings.Join(tc.expectedErrors, "\n"), strings.Join(result, "\n"))
+			}
 
-		f(x) = [x] {true}
+			for i := range result {
+				if result[i] != tc.expectedErrors[i] {
+					t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v",
+						strings.Join(tc.expectedErrors, "\n"), strings.Join(result, "\n"))
+				}
+			}
+		})
+	}
+}
 
-		p[[1]] {true}
+func TestCompilerCheckUnusedImports(t *testing.T) {
+	cases := []strictnessTestCase{
+		{
+			note: "simple unused: input ref with same name",
+			module: `package p
+			import data.foo.bar as bar
+			r {
+				input.bar == 11
+			}
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.foo.bar as bar unused",
+				},
+			},
+		},
+		{
+			note: "unused import, but imported ref used",
+			module: `package p
+			import data.foo # unused
+			r { data.foo == 10 }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.foo unused",
+				},
+			},
+		},
+		{
+			note: "one of two unused",
+			module: `package p
+			import data.foo
+			import data.x.power #unused
+			r { foo == 10 }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 3, 4),
+					Message:  "import data.x.power unused",
+				},
+			},
+		},
+		{
+			note: "multiple unused: with input ref of same name",
+			module: `package p
+			import data.foo
+			import data.x.power
+			r { input.foo == 10 }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.foo unused",
+				},
+				&Error{
+					Location: NewLocation([]byte("import"), "", 3, 4),
+					Message:  "import data.x.power unused",
+				},
+			},
+		},
+		{
+			note: "import used in comparison",
+			module: `package p
+			import data.foo.x
+			r { x == 10 }
+			`,
+		},
+		{
+			note: "multiple used imports in one rule",
+			module: `package p
+			import data.foo.x
+			import data.power.ranger
+			r { ranger == x }
+			`,
+		},
+		{
+			note: "multiple used imports in separate rules",
+			module: `package p
+			import data.foo.x
+			import data.power.ranger
+			r { ranger == 23 }
+			t { x == 1 }
+			`,
+		},
+		{
+			note: "import used as function operand",
+			module: `package p
+			import data.foo
+			r = count(foo) > 1 # only one operand
+			`,
+		},
+		{
+			note: "import used as function operand, compount term",
+			module: `package p
+			import data.foo
+			r = sprintf("%v %d", [foo, 0])
+			`,
+		},
+		{
+			note: "import used as plain term",
+			module: `package p
+			import data.foo
+			r {
+				foo
+			}
+			`,
+		},
+		{
+			note: "import used in 'every' domain",
+			module: `package p
+			import future.keywords.every
+			import data.foo
+			r {
+				every x in foo { x > 1 }
+			}
+			`,
+		},
+		{
+			note: "import used in 'every' body",
+			module: `package p
+			import future.keywords.every
+			import data.foo
+			r {
+				every x in [1,2,3] { x > foo }
+			}
+			`,
+		},
+		{
+			note: "future import kept even if unused",
+			module: `package p
+			import future.keywords
 
-		q {
-			p[[x | x = nums[_]]]
-		}
+			r { true }
+			`,
+		},
+		{
+			note: "shadowed var name in function arg",
+			module: `package p
+			import data.foo # unused
 
-		r = [y | y = f(1)[0]]
-		`)
+			r { f(1) }
+			f(foo) = foo == 1
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.foo unused",
+				},
+			},
+		},
+		{
+			note: "shadowed assigned var name",
+			module: `package p
+			import data.foo # unused
 
-	compileStages(c, c.resolveAllRefs)
-	assertNotFailed(t, c)
+			r { foo := true; foo }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.foo unused",
+				},
+			},
+		},
+		{
+			note: "used as rule value",
+			module: `package p
+			import data.bar # unused
+			import data.foo
 
-	// Basic test cases.
-	mod1 := c.Modules["mod1"]
-	p := mod1.Rules[0]
-	expr1 := p.Body[0]
-	term := expr1.Terms.(*Term)
-	e := MustParseTerm("data.a.b.c.q[x]")
-	if !term.Equal(e) {
-		t.Errorf("Wrong term (global in same module): expected %v but got: %v", e, term)
-	}
+			r = foo { true }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.bar unused",
+				},
+			},
+		},
+		{
+			note: "unused as rule value (but same data ref)",
+			module: `package p
+			import data.bar # unused
+			import data.foo # unused
 
-	expr2 := p.Body[1]
-	term = expr2.Terms.(*Term)
-	e = MustParseTerm("data.a.b.c.r[x]")
-	if !term.Equal(e) {
-		t.Errorf("Wrong term (global in same package/diff module): expected %v but got: %v", e, term)
+			r = data.foo { true }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 2, 4),
+					Message:  "import data.bar unused",
+				},
+				&Error{
+					Location: NewLocation([]byte("import"), "", 3, 4),
+					Message:  "import data.foo unused",
+				},
+			},
+		},
 	}
 
-	mod2 := c.Modules["mod2"]
-	r := mod2.Rules[0]
-	expr3 := r.Body[1]
-	term = expr3.Terms.([]*Term)[1]
-	e = MustParseTerm("data.x.y.p")
-	if !term.Equal(e) {
-		t.Errorf("Wrong term (var import): expected %v but got: %v", e, term)
-	}
+	runStrictnessTestCase(t, cases, true)
+}
 
-	mod3 := c.Modules["mod3"]
-	expr4 := mod3.Rules[0].Body[0]
-	term = expr4.Terms.([]*Term)[2]
-	e = MustParseTerm("{input.x.secret: [{input.x.keyid}]}")
-	if !term.Equal(e) {
-		t.Errorf("Wrong term (nested refs): expected %v but got: %v", e, term)
-	}
+func TestCompilerCheckDuplicateImports(t *testing.T) {
+	cases := []strictnessTestCase{
+		{
+			note: "shadow",
+			module: `package test
+				import input.noconflict
+				import input.foo
+				import data.foo
+				import data.bar.foo
 
-	// Array comprehensions.
-	mod5 := c.Modules["mod5"]
+				p := noconflict
+				q := foo
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 4, 5),
+					Message:  "import must not shadow import input.foo",
+				},
+				&Error{
+					Location: NewLocation([]byte("import"), "", 5, 5),
+					Message:  "import must not shadow import input.foo",
+				},
+			},
+		}, {
+			note: "alias shadow",
+			module: `package test
+				import input.noconflict
+				import input.foo
+				import input.bar as foo
 
-	ac := func(r *Rule) *ArrayComprehension {
-		return r.Body[0].Terms.(*Term).Value.(*ArrayComprehension)
+				p := noconflict
+				q := foo
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("import"), "", 4, 5),
+					Message:  "import must not shadow import input.foo",
+				},
+			},
+		},
 	}
 
-	acTerm1 := ac(mod5.Rules[0])
-	assertTermEqual(t, acTerm1.Term, MustParseTerm("input.x.a"))
-	acTerm2 := ac(mod5.Rules[1])
-	assertTermEqual(t, acTerm2.Term, MustParseTerm("data.a.b.c.q.a"))
-	acTerm3 := ac(mod5.Rules[2])
-	assertTermEqual(t, acTerm3.Body[0].Terms.([]*Term)[1], MustParseTerm("input.x.a"))
-	acTerm4 := ac(mod5.Rules[3])
-	assertTermEqual(t, acTerm4.Body[0].Terms.([]*Term)[1], MustParseTerm("data.a.b.c.q[i]"))
-	acTerm5 := ac(mod5.Rules[4])
-	assertTermEqual(t, acTerm5.Body[0].Terms.([]*Term)[2].Value.(*ArrayComprehension).Term, MustParseTerm("input.x.a"))
-	acTerm6 := ac(mod5.Rules[5])
-	assertTermEqual(t, acTerm6.Body[0].Terms.([]*Term)[2].Value.(*ArrayComprehension).Body[0].Terms.([]*Term)[1], MustParseTerm("data.a.b.c.q[i]"))
-
-	// Nested references.
-	mod6 := c.Modules["mod6"]
-	nested1 := mod6.Rules[0].Body[0].Terms.(*Term)
-	assertTermEqual(t, nested1, MustParseTerm("data.x[input.x[i].a[data.z.b[j]]]"))
-
-	nested2 := mod6.Rules[1].Body[1].Terms.(*Term)
-	assertTermEqual(t, nested2, MustParseTerm("v[input.x[i]]"))
+	runStrictnessTestCase(t, cases, true)
+}
 
-	nested3 := mod6.Rules[3].Body[0].Terms.(*Term)
-	assertTermEqual(t, nested3, MustParseTerm("data.x[data.a.b.nested.r]"))
+func TestCompilerCheckKeywordOverrides(t *testing.T) {
+	cases := []strictnessTestCase{
+		{
+			note: "rule names",
+			module: `package test
+				input { true }
+				p { true }
+				data { true }
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input { true }"), "", 2, 5),
+					Message:  "rules must not shadow input (use a different rule name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data { true }"), "", 4, 5),
+					Message:  "rules must not shadow data (use a different rule name)",
+				},
+			},
+		},
+		{
+			note: "global assignments",
+			module: `package test
+				input = 1
+				p := 2
+				data := 3
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input = 1"), "", 2, 5),
+					Message:  "rules must not shadow input (use a different rule name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data := 3"), "", 4, 5),
+					Message:  "rules must not shadow data (use a different rule name)",
+				},
+			},
+		},
+		{
+			note: "rule-local assignments",
+			module: `package test
+				p {
+					input := 1
+					x := 2
+				} else {
+					data := 3
+				}
+				q {
+					input := 4
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input := 1"), "", 3, 6),
+					Message:  "variables must not shadow input (use a different variable name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data := 3"), "", 6, 6),
+					Message:  "variables must not shadow data (use a different variable name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("input := 4"), "", 9, 6),
+					Message:  "variables must not shadow input (use a different variable name)",
+				},
+			},
+		},
+		{
+			note: "array comprehension-local assignments",
+			module: `package test
+				p = [ x |
+					input := 1
+					x := 2
+					data := 3
+				]
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input := 1"), "", 3, 6),
+					Message:  "variables must not shadow input (use a different variable name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data := 3"), "", 5, 6),
+					Message:  "variables must not shadow data (use a different variable name)",
+				},
+			},
+		},
+		{
+			note: "set comprehension-local assignments",
+			module: `package test
+				p = { x |
+					input := 1
+					x := 2
+					data := 3
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input := 1"), "", 3, 6),
+					Message:  "variables must not shadow input (use a different variable name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data := 3"), "", 5, 6),
+					Message:  "variables must not shadow data (use a different variable name)",
+				},
+			},
+		},
+		{
+			note: "object comprehension-local assignments",
+			module: `package test
+				p = { x: 1 |
+					input := 1
+					x := 2
+					data := 3
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input := 1"), "", 3, 6),
+					Message:  "variables must not shadow input (use a different variable name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data := 3"), "", 5, 6),
+					Message:  "variables must not shadow data (use a different variable name)",
+				},
+			},
+		},
+		{
+			note: "nested override",
+			module: `package test
+				p {
+					[ x |
+						input := 1
+						x := 2
+						data := 3
+					]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("input := 1"), "", 4, 7),
+					Message:  "variables must not shadow input (use a different variable name)",
+				},
+				&Error{
+					Location: NewLocation([]byte("data := 3"), "", 6, 7),
+					Message:  "variables must not shadow data (use a different variable name)",
+				},
+			},
+		},
+	}
 
-	// Refs in head.
-	mod7 := c.Modules["head"]
-	assertTermEqual(t, mod7.Rules[0].Head.Key, MustParseTerm("input.x.y.foo[data.doc1[i]]"))
-	assertTermEqual(t, mod7.Rules[0].Head.Value, MustParseTerm(`{"baz": input.qux}`))
+	runStrictnessTestCase(t, cases, true)
+}
 
-	// Refs in else.
-	mod8 := c.Modules["elsekw"]
-	assertTermEqual(t, mod8.Rules[0].Else.Head.Value, MustParseTerm("input.x.y.foo"))
-	assertTermEqual(t, mod8.Rules[0].Else.Body[0].Terms.(*Term), MustParseTerm("data.doc1"))
-	assertTermEqual(t, mod8.Rules[0].Else.Else.Head.Value, MustParseTerm("input.baz"))
+func TestCompilerCheckDeprecatedMethods(t *testing.T) {
+	cases := []strictnessTestCase{
+		{
+			note: "all() built-in",
+			module: `package test
+				p := all([true, false])
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("all([true, false])"), "", 2, 10),
+					Message:  "deprecated built-in function calls in expression: all",
+				},
+			},
+		},
+		{
+			note: "user-defined all()",
+			module: `package test
+				import future.keywords.in
+				all(arr) = {x | some x in arr} == {true}
+				p := all([true, false])
+			`,
+		},
+		{
+			note: "any() built-in",
+			module: `package test
+				p := any([true, false])
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte("any([true, false])"), "", 2, 10),
+					Message:  "deprecated built-in function calls in expression: any",
+				},
+			},
+		},
+		{
+			note: "user-defined any()",
+			module: `package test
+				import future.keywords.in
+				any(arr) := true in arr
+				p := any([true, false])
+			`,
+		},
+		{
+			note: "re_match built-in",
+			module: `package test
+				p := re_match("[a]", "a")
+			`,
+			expectedErrors: Errors{
+				&Error{
+					Location: NewLocation([]byte(`re_match("[a]", "a")`), "", 2, 10),
+					Message:  "deprecated built-in function calls in expression: re_match",
+				},
+			},
+		},
+	}
 
-	// Refs in calls.
-	mod9 := c.Modules["nestedexprs"]
-	assertTermEqual(t, mod9.Rules[1].Body[0].Terms.([]*Term)[1], CallTerm(RefTerm(VarTerm("g")), MustParseTerm("data.nestedexprs.x")))
+	runStrictnessTestCase(t, cases, true)
+}
 
-	// Ignore assigned vars.
-	mod10 := c.Modules["assign"]
-	assertTermEqual(t, mod10.Rules[2].Body[0].Terms.([]*Term)[1], VarTerm("x"))
-	assertTermEqual(t, mod10.Rules[2].Body[0].Terms.([]*Term)[2], MustParseTerm("data.assign.y"))
-	assignCompr := mod10.Rules[2].Body[1].Terms.(*Term).Value.(*ArrayComprehension)
-	assertTermEqual(t, assignCompr.Body[0].Terms.([]*Term)[1], VarTerm("x"))
-	assertTermEqual(t, assignCompr.Body[0].Terms.([]*Term)[2], MustParseTerm("data.assign.y"))
+type strictnessTestCase struct {
+	note           string
+	module         string
+	expectedErrors Errors
+}
 
-	// Args
-	mod11 := c.Modules["donotresolve"]
-	assertTermEqual(t, mod11.Rules[1].Head.Args[0], VarTerm("x"))
-	assertExprEqual(t, mod11.Rules[1].Body[0], MustParseExpr("x = 2"))
+func runStrictnessTestCase(t *testing.T, cases []strictnessTestCase, assertLocation bool) {
+	t.Helper()
+	makeTestRunner := func(tc strictnessTestCase, strict bool) func(t *testing.T) {
+		return func(t *testing.T) {
+			compiler := NewCompiler().WithStrict(strict)
+			compiler.Modules = map[string]*Module{
+				"test": MustParseModule(tc.module),
+			}
+			compileStages(compiler, nil)
 
-	// Locations.
-	parsedLoc := getCompilerTestModules()["mod1"].Rules[0].Body[0].Terms.(*Term).Value.(Ref)[0].Location
-	compiledLoc := c.Modules["mod1"].Rules[0].Body[0].Terms.(*Term).Value.(Ref)[0].Location
-	if parsedLoc.Row != compiledLoc.Row {
-		t.Fatalf("Expected parsed location (%v) and compiled location (%v) to be equal", parsedLoc.Row, compiledLoc.Row)
+			if strict {
+				assertErrors(t, compiler.Errors, tc.expectedErrors, assertLocation)
+			} else {
+				assertNotFailed(t, compiler)
+			}
+		}
 	}
 
-	// Indirect references.
-	mod12 := c.Modules["indirectrefs"]
-	assertExprEqual(t, mod12.Rules[1].Body[0], MustParseExpr("data.indirectrefs.f(1)[0]"))
+	for _, tc := range cases {
+		t.Run(tc.note+"_strict", makeTestRunner(tc, true))
+		t.Run(tc.note+"_non-strict", makeTestRunner(tc, false))
+	}
+}
 
-	// Comprehensions
-	mod13 := c.Modules["comprehensions"]
-	assertExprEqual(t, mod13.Rules[3].Body[0].Terms.(*Term).Value.(Ref)[3].Value.(*ArrayComprehension).Body[0], MustParseExpr("x = data.comprehensions.nums[_]"))
-	assertExprEqual(t, mod13.Rules[4].Head.Value.Value.(*ArrayComprehension).Body[0], MustParseExpr("y = data.comprehensions.f(1)[0]"))
+func assertErrors(t *testing.T, actual Errors, expected Errors, assertLocation bool) {
+	t.Helper()
+	if len(expected) != len(actual) {
+		t.Fatalf("Expected %d errors, got %d:\n\n%s\n", len(expected), len(actual), actual.Error())
+	}
+	incorrectErrs := false
+	for _, e := range expected {
+		found := false
+		for _, actual := range actual {
+			if e.Message == actual.Message {
+				if !assertLocation || e.Location.Equal(actual.Location) {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			incorrectErrs = true
+		}
+	}
+	if incorrectErrs {
+		t.Fatalf("Expected errors:\n\n%s\n\nGot:\n\n%s\n", expected.Error(), actual.Error())
+	}
+}
 
-	// Ignore vars assigned via `some x in xs`.
-	mod14 := c.Modules["someinassign"]
-	someInAssignCall := mod14.Rules[2].Body[0].Terms.(*SomeDecl).Symbols[0].Value.(Call)
-	assertTermEqual(t, someInAssignCall[1], VarTerm("x"))
-	collectionLastElem := someInAssignCall[2].Value.(*Array).Get(IntNumberTerm(2))
-	assertTermEqual(t, collectionLastElem, MustParseTerm("data.someinassign.y"))
+// NOTE(sr): the tests below this function are unwieldy, let's keep adding new ones to this one
+func TestCompilerResolveAllRefsNewTests(t *testing.T) {
+	tests := []struct {
+		note  string
+		mod   string
+		exp   string
+		extra string
+	}{
+		{
+			note: "ref-rules referenced in body",
+			mod: `package test
+a.b.c = 1
+q if a.b.c == 1
+`,
+			exp: `package test
+a.b.c = 1 { true }
+q if data.test.a.b.c = 1
+`,
+		},
+		{
+			// NOTE(sr): This is a conservative extension of how it worked before:
+			// we will not automatically extend references to other parts of the rule tree,
+			// only to ref rules defined on the same level.
+			note: "ref-rules from other module referenced in body",
+			mod: `package test
+q if a.b.c == 1
+`,
+			extra: `package test
+a.b.c = 1
+`,
+			exp: `package test
+q if data.test.a.b.c = 1
+`,
+		},
+		{
+			note: "single-value rule in comprehension in call", // NOTE(sr): this is TestRego/partialiter/objects_conflict
+			mod: `package test
+p := count([x | q[x]])
+q[1] = 1
+`,
+			exp: `package test
+p := __local0__ { true; __local1__ = [x | data.test.q[x]]; count(__local1__, __local0__) }
+q[1] = 1
+`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			c := NewCompiler()
+			mod, err := ParseModuleWithOpts("test.rego", tc.mod, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			exp, err := ParseModuleWithOpts("test.rego", tc.exp, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			mods := map[string]*Module{"test": mod}
+			if tc.extra != "" {
+				extra, err := ParseModuleWithOpts("test.rego", tc.extra, opts)
+				if err != nil {
+					t.Fatal(err)
+				}
+				mods["extra"] = extra
+			}
+			c.Compile(mods)
+			if err := c.Errors; len(err) > 0 {
+				t.Errorf("compile module: %v", err)
+			}
+			if act := c.Modules["test"]; !exp.Equal(act) {
+				t.Errorf("compiled: expected %v, got %v", exp, act)
+			}
+		})
+	}
+}
+
+func TestCompilerResolveAllRefs(t *testing.T) {
+	c := NewCompiler()
+	c.Modules = getCompilerTestModules()
+	c.Modules["head"] = MustParseModule(`package head
+
+import data.doc1 as bar
+import input.x.y.foo
+import input.qux as baz
+
+p[foo[bar[i]]] = {"baz": baz} { true }`)
+
+	c.Modules["elsekw"] = MustParseModule(`package elsekw
+
+	import input.x.y.foo
+	import data.doc1 as bar
+	import input.baz
+
+	p {
+		false
+	} else = foo {
+		bar
+	} else = baz {
+		true
+	}
+	`)
+
+	c.Modules["nestedexprs"] = MustParseModule(`package nestedexprs
+
+		x = 1
+
+		p {
+			f(g(x))
+		}`)
+
+	c.Modules["assign"] = MustParseModule(`package assign
+
+		x = 1
+		y = 1
+
+		p {
+			x := y
+			[true | x := y]
+		}`)
+
+	c.Modules["someinassign"] = MustParseModule(`package someinassign
+		import future.keywords.in
+		x = 1
+		y = 1
+
+		p[x] {
+			some x in [1, 2, y]
+		}`)
+
+	c.Modules["someinassignwithkey"] = MustParseModule(`package someinassignwithkey
+		import future.keywords.in
+		x = 1
+		y = 1
+
+		p[x] {
+			some k, v in [1, 2, y]
+		}`)
+
+	c.Modules["donotresolve"] = MustParseModule(`package donotresolve
+
+		x = 1
+
+		f(x) {
+			x = 2
+		}
+		`)
+
+	c.Modules["indirectrefs"] = MustParseModule(`package indirectrefs
+
+		f(x) = [x] {true}
+
+		p {
+			f(1)[0]
+		}
+		`)
+
+	c.Modules["comprehensions"] = MustParseModule(`package comprehensions
+
+		nums = [1, 2, 3]
+
+		f(x) = [x] {true}
+
+		p[[1]] {true}
+
+		q {
+			p[[x | x = nums[_]]]
+		}
+
+		r = [y | y = f(1)[0]]
+		`)
+
+	c.Modules["everykw"] = MustParseModuleWithOpts(`package everykw
+
+	nums = {1, 2, 3}
+	f(_) = true
+	x = 100
+	xs = [1, 2, 3]
+	p {
+		every x in xs {
+			nums[x]
+			x > 10
+		}
+	}`, ParserOptions{unreleasedKeywords: true, FutureKeywords: []string{"every", "in"}})
+
+	c.Modules["heads_with_dots"] = MustParseModule(`package heads_with_dots
+
+		this_is_not = true
+		this.is.dotted { this_is_not }
+	`)
+
+	compileStages(c, c.resolveAllRefs)
+	assertNotFailed(t, c)
+
+	// Basic test cases.
+	mod1 := c.Modules["mod1"]
+	p := mod1.Rules[0]
+	expr1 := p.Body[0]
+	term := expr1.Terms.(*Term)
+	e := MustParseTerm("data.a.b.c.q[x]")
+	if !term.Equal(e) {
+		t.Errorf("Wrong term (global in same module): expected %v but got: %v", e, term)
+	}
+
+	expr2 := p.Body[1]
+	term = expr2.Terms.(*Term)
+	e = MustParseTerm("data.a.b.c.r[x]")
+	if !term.Equal(e) {
+		t.Errorf("Wrong term (global in same package/diff module): expected %v but got: %v", e, term)
+	}
+
+	mod2 := c.Modules["mod2"]
+	r := mod2.Rules[0]
+	expr3 := r.Body[1]
+	term = expr3.Terms.([]*Term)[1]
+	e = MustParseTerm("data.x.y.p")
+	if !term.Equal(e) {
+		t.Errorf("Wrong term (var import): expected %v but got: %v", e, term)
+	}
+
+	mod3 := c.Modules["mod3"]
+	expr4 := mod3.Rules[0].Body[0]
+	term = expr4.Terms.([]*Term)[2]
+	e = MustParseTerm("{input.x.secret: [{input.x.keyid}]}")
+	if !term.Equal(e) {
+		t.Errorf("Wrong term (nested refs): expected %v but got: %v", e, term)
+	}
+
+	// Array comprehensions.
+	mod5 := c.Modules["mod5"]
+
+	ac := func(r *Rule) *ArrayComprehension {
+		return r.Body[0].Terms.(*Term).Value.(*ArrayComprehension)
+	}
+
+	acTerm1 := ac(mod5.Rules[0])
+	assertTermEqual(t, acTerm1.Term, MustParseTerm("input.x.a"))
+	acTerm2 := ac(mod5.Rules[1])
+	assertTermEqual(t, acTerm2.Term, MustParseTerm("data.a.b.c.q.a"))
+	acTerm3 := ac(mod5.Rules[2])
+	assertTermEqual(t, acTerm3.Body[0].Terms.([]*Term)[1], MustParseTerm("input.x.a"))
+	acTerm4 := ac(mod5.Rules[3])
+	assertTermEqual(t, acTerm4.Body[0].Terms.([]*Term)[1], MustParseTerm("data.a.b.c.q[i]"))
+	acTerm5 := ac(mod5.Rules[4])
+	assertTermEqual(t, acTerm5.Body[0].Terms.([]*Term)[2].Value.(*ArrayComprehension).Term, MustParseTerm("input.x.a"))
+	acTerm6 := ac(mod5.Rules[5])
+	assertTermEqual(t, acTerm6.Body[0].Terms.([]*Term)[2].Value.(*ArrayComprehension).Body[0].Terms.([]*Term)[1], MustParseTerm("data.a.b.c.q[i]"))
+
+	// Nested references.
+	mod6 := c.Modules["mod6"]
+	nested1 := mod6.Rules[0].Body[0].Terms.(*Term)
+	assertTermEqual(t, nested1, MustParseTerm("data.x[input.x[i].a[data.z.b[j]]]"))
+
+	nested2 := mod6.Rules[1].Body[1].Terms.(*Term)
+	assertTermEqual(t, nested2, MustParseTerm("v[input.x[i]]"))
+
+	nested3 := mod6.Rules[3].Body[0].Terms.(*Term)
+	assertTermEqual(t, nested3, MustParseTerm("data.x[data.a.b.nested.r]"))
+
+	// Refs in head.
+	mod7 := c.Modules["head"]
+	assertTermEqual(t, mod7.Rules[0].Head.Key, MustParseTerm("input.x.y.foo[data.doc1[i]]"))
+	assertTermEqual(t, mod7.Rules[0].Head.Value, MustParseTerm(`{"baz": input.qux}`))
+
+	// Refs in else.
+	mod8 := c.Modules["elsekw"]
+	assertTermEqual(t, mod8.Rules[0].Else.Head.Value, MustParseTerm("input.x.y.foo"))
+	assertTermEqual(t, mod8.Rules[0].Else.Body[0].Terms.(*Term), MustParseTerm("data.doc1"))
+	assertTermEqual(t, mod8.Rules[0].Else.Else.Head.Value, MustParseTerm("input.baz"))
+
+	// Refs in calls.
+	mod9 := c.Modules["nestedexprs"]
+	assertTermEqual(t, mod9.Rules[1].Body[0].Terms.([]*Term)[1], CallTerm(RefTerm(VarTerm("g")), MustParseTerm("data.nestedexprs.x")))
+
+	// Ignore assigned vars.
+	mod10 := c.Modules["assign"]
+	assertTermEqual(t, mod10.Rules[2].Body[0].Terms.([]*Term)[1], VarTerm("x"))
+	assertTermEqual(t, mod10.Rules[2].Body[0].Terms.([]*Term)[2], MustParseTerm("data.assign.y"))
+	assignCompr := mod10.Rules[2].Body[1].Terms.(*Term).Value.(*ArrayComprehension)
+	assertTermEqual(t, assignCompr.Body[0].Terms.([]*Term)[1], VarTerm("x"))
+	assertTermEqual(t, assignCompr.Body[0].Terms.([]*Term)[2], MustParseTerm("data.assign.y"))
+
+	// Args
+	mod11 := c.Modules["donotresolve"]
+	assertTermEqual(t, mod11.Rules[1].Head.Args[0], VarTerm("x"))
+	assertExprEqual(t, mod11.Rules[1].Body[0], MustParseExpr("x = 2"))
+
+	// Locations.
+	parsedLoc := getCompilerTestModules()["mod1"].Rules[0].Body[0].Terms.(*Term).Value.(Ref)[0].Location
+	compiledLoc := c.Modules["mod1"].Rules[0].Body[0].Terms.(*Term).Value.(Ref)[0].Location
+	if parsedLoc.Row != compiledLoc.Row {
+		t.Fatalf("Expected parsed location (%v) and compiled location (%v) to be equal", parsedLoc.Row, compiledLoc.Row)
+	}
+
+	// Indirect references.
+	mod12 := c.Modules["indirectrefs"]
+	assertExprEqual(t, mod12.Rules[1].Body[0], MustParseExpr("data.indirectrefs.f(1)[0]"))
+
+	// Comprehensions
+	mod13 := c.Modules["comprehensions"]
+	assertExprEqual(t, mod13.Rules[3].Body[0].Terms.(*Term).Value.(Ref)[3].Value.(*ArrayComprehension).Body[0], MustParseExpr("x = data.comprehensions.nums[_]"))
+	assertExprEqual(t, mod13.Rules[4].Head.Value.Value.(*ArrayComprehension).Body[0], MustParseExpr("y = data.comprehensions.f(1)[0]"))
+
+	// Ignore vars assigned via `some x in xs`.
+	mod14 := c.Modules["someinassign"]
+	someInAssignCall := mod14.Rules[2].Body[0].Terms.(*SomeDecl).Symbols[0].Value.(Call)
+	assertTermEqual(t, someInAssignCall[1], VarTerm("x"))
+	collectionLastElem := someInAssignCall[2].Value.(*Array).Get(IntNumberTerm(2))
+	assertTermEqual(t, collectionLastElem, MustParseTerm("data.someinassign.y"))
+
+	// Ignore key and val vars assigned via `some k, v in xs`.
+	mod15 := c.Modules["someinassignwithkey"]
+	someInAssignCall = mod15.Rules[2].Body[0].Terms.(*SomeDecl).Symbols[0].Value.(Call)
+	assertTermEqual(t, someInAssignCall[1], VarTerm("k"))
+	assertTermEqual(t, someInAssignCall[2], VarTerm("v"))
+	collectionLastElem = someInAssignCall[3].Value.(*Array).Get(IntNumberTerm(2))
+	assertTermEqual(t, collectionLastElem, MustParseTerm("data.someinassignwithkey.y"))
+
+	mod16 := c.Modules["everykw"]
+	everyExpr := mod16.Rules[len(mod16.Rules)-1].Body[0].Terms.(*Every)
+	assertTermEqual(t, everyExpr.Body[0].Terms.(*Term), MustParseTerm("data.everykw.nums[x]"))
+	assertTermEqual(t, everyExpr.Domain, MustParseTerm("data.everykw.xs"))
+
+	// 'x' is not resolved
+	assertTermEqual(t, everyExpr.Value, VarTerm("x"))
+	gt10 := MustParseExpr("x > 10")
+	gt10.Index++ // TODO(sr): why?
+	assertExprEqual(t, everyExpr.Body[1], gt10)
+
+	// head refs are kept as-is, but their bodies are replaced.
+	mod := c.Modules["heads_with_dots"]
+	rule := mod.Rules[1]
+	body := rule.Body[0].Terms.(*Term)
+	assertTermEqual(t, body, MustParseTerm("data.heads_with_dots.this_is_not"))
+	if act, exp := rule.Head.Ref(), MustParseRef("this.is.dotted"); act.Compare(exp) != 0 {
+		t.Errorf("expected %v to match %v", act, exp)
+	}
+}
+
+func TestCompilerResolveErrors(t *testing.T) {
+
+	c := NewCompiler()
+	c.Modules = map[string]*Module{
+		"shadow-globals": MustParseModule(`
+			package shadow_globals
+
+			f([input]) { true }
+		`),
+	}
+
+	compileStages(c, c.resolveAllRefs)
+
+	expected := []string{
+		`args must not shadow input`,
+	}
+
+	assertCompilerErrorStrings(t, c, expected)
+}
+
+func TestCompilerRewriteTermsInHead(t *testing.T) {
+	popts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+
+	tests := []struct {
+		note string
+		mod  *Module
+		exp  *Rule
+	}{
+		{
+			note: "imports",
+			mod: MustParseModule(`package head
+import data.doc1 as bar
+import data.doc2 as corge
+import input.x.y.foo
+import input.qux as baz
+
+p[foo[bar[i]]] = {"baz": baz, "corge": corge} { true }
+`),
+			exp: MustParseRule(`p[__local0__] = __local1__ { true; __local0__ = input.x.y.foo[data.doc1[i]]; __local1__ = {"baz": input.qux, "corge": data.doc2} }`),
+		},
+		{
+			note: "array comprehension value",
+			mod: MustParseModule(`package head
+q = [true | true] { true }
+`),
+			exp: MustParseRule(`q = __local0__ { true; __local0__ = [true | true] }`),
+		},
+		{
+			note: "array comprehension value in else head",
+			mod: MustParseModule(`package head
+q { 
+	false 
+} else = [true | true] { 
+	true 
+}
+`),
+			exp: MustParseRule(`q = true { false } else = __local0__ { true; __local0__ = [true | true] }`),
+		},
+		{
+			note: "array comprehension value in head (comprehension-local var)",
+			mod: MustParseModule(`package head
+q = [a | a := true] {
+	false
+} else = [a | a := true] {
+	true
+}
+`),
+			exp: MustParseRule(`q = __local2__ { false; __local2__ = [__local0__ | __local0__ = true] } else = __local3__ { true; __local3__ = [__local1__ | __local1__ = true] }`),
+		},
+		{
+			note: "array comprehension value in function head (comprehension-local var)",
+			mod: MustParseModule(`package head
+f(x) = [a | a := true] {
+	false
+} else = [a | a := true] {
+	true
+}
+`),
+			exp: MustParseRule(`f(__local0__) = __local3__ { false; __local3__ = [__local1__ | __local1__ = true] } else = __local4__ { true; __local4__ = [__local2__ | __local2__ = true] }`),
+		},
+		{
+			note: "array comprehension value in else-func head (reused arg rewrite)",
+			mod: MustParseModule(`package head
+f(x, y) = [x | y] { 
+	false 
+} else = [x | y] {
+	true 
+}
+`),
+			exp: MustParseRule(`f(__local0__, __local1__) = __local2__ { false; __local2__ = [__local0__ | __local1__] } else = __local3__ { true; __local3__ = [__local0__ | __local1__] }`),
+		},
+		{
+			note: "object comprehension value",
+			mod: MustParseModule(`package head
+r = {"true": true | true} { true }
+`),
+			exp: MustParseRule(`r = __local0__ { true; __local0__ = {"true": true | true} }`),
+		},
+		{
+			note: "object comprehension value in else head",
+			mod: MustParseModule(`package head
+q { 
+	false 
+} else = {"true": true | true} { 
+	true 
+}
+`),
+			exp: MustParseRule(`q = true { false } else = __local0__ { true; __local0__ = {"true": true | true} }`),
+		},
+		{
+			note: "object comprehension value in head (comprehension-local var)",
+			mod: MustParseModule(`package head
+q = {"a": a | a := true} {
+	false
+} else = {"a": a | a := true} {
+	true
+}
+`),
+			exp: MustParseRule(`q = __local2__ { false; __local2__ = {"a": __local0__ | __local0__ = true} } else = __local3__ { true; __local3__ = {"a": __local1__ | __local1__ = true} }`),
+		},
+		{
+			note: "object comprehension value in function head (comprehension-local var)",
+			mod: MustParseModule(`package head
+f(x) = {"a": a | a := true} {
+	false
+} else = {"a": a | a := true} {
+	true
+}
+`),
+			exp: MustParseRule(`f(__local0__) = __local3__ { false; __local3__ = {"a": __local1__ | __local1__ = true} } else = __local4__ { true; __local4__ = {"a": __local2__ | __local2__ = true} }`),
+		},
+		{
+			note: "object comprehension value in else-func head (reused arg rewrite)",
+			mod: MustParseModule(`package head
+f(x, y) = {x: y | true} { 
+	false 
+} else = {x: y | true} {
+	true 
+}
+`),
+			exp: MustParseRule(`f(__local0__, __local1__) = __local2__ { false; __local2__ = {__local0__: __local1__ | true} } else = __local3__ { true; __local3__ = {__local0__: __local1__ | true} }`),
+		},
+		{
+			note: "set comprehension value",
+			mod: MustParseModule(`package head
+s = {true | true} { true }
+`),
+			exp: MustParseRule(`s = __local0__ { true; __local0__ = {true | true} }`),
+		},
+		{
+			note: "set comprehension value in else head",
+			mod: MustParseModule(`package head
+q = {false | false} { 
+	false 
+} else = {true | true} { 
+	true 
+}
+`),
+			exp: MustParseRule(`q = __local0__ { false; __local0__ = {false | false} } else = __local1__ { true; __local1__ = {true | true} }`),
+		},
+		{
+			note: "set comprehension value in head (comprehension-local var)",
+			mod: MustParseModule(`package head
+q = {a | a := true} {
+	false
+} else = {a | a := true} {
+	true
+}
+`),
+			exp: MustParseRule(`q = __local2__ { false; __local2__ = {__local0__ | __local0__ = true} } else = __local3__ { true; __local3__ = {__local1__ | __local1__ = true} }`),
+		},
+		{
+			note: "set comprehension value in function head (comprehension-local var)",
+			mod: MustParseModule(`package head
+f(x) = {a | a := true} {
+	false
+} else = {a | a := true} {
+	true
+}
+`),
+			exp: MustParseRule(`f(__local0__) = __local3__ { false; __local3__ = {__local1__ | __local1__ = true} } else = __local4__ { true; __local4__ = {__local2__ | __local2__ = true} }`),
+		},
+		{
+			note: "set comprehension value in else-func head (reused arg rewrite)",
+			mod: MustParseModule(`package head
+f(x, y) = {x | y} { 
+	false 
+} else = {x | y} {
+	true 
+}
+`),
+			exp: MustParseRule(`f(__local0__, __local1__) = __local2__ { false; __local2__ = {__local0__ | __local1__} } else = __local3__ { true; __local3__ = {__local0__ | __local1__} }`),
+		},
+		{
+			note: "import in else value",
+			mod: MustParseModule(`package head
+import input.qux as baz
+elsekw {
+	false
+} else = baz {
+	true
+}
+`),
+			exp: MustParseRule(`elsekw { false } else = __local0__ { true; __local0__ = input.qux }`),
+		},
+		{
+			note: "import ref in last ref head term",
+			mod: MustParseModule(`package head
+import data.doc1 as bar
+x.y.z[bar[i]] = true
+`),
+			exp: MustParseRule(`x.y.z[__local0__] = true { true; __local0__ = data.doc1[i] }`),
+		},
+		{
+			note: "import ref in multi-value ref rule",
+			mod: MustParseModule(`package head
+import future.keywords.if
+import future.keywords.contains
+import data.doc1 as bar
+x.y.w contains bar[i] if true
+`),
+			exp: func() *Rule {
+				exp, _ := ParseRuleWithOpts(`x.y.w contains __local0__ if {true; __local0__ = data.doc1[i] }`, popts)
+				return exp
+			}(),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			c.Modules["head"] = tc.mod
+			compileStages(c, c.rewriteRefsInHead)
+			assertNotFailed(t, c)
+			act := c.Modules["head"].Rules[0]
+			assertRulesEqual(t, act, tc.exp)
+		})
+	}
+}
+
+func TestCompilerRefHeadsNeedCapability(t *testing.T) {
+	popts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+	for _, tc := range []struct {
+		note string
+		mod  *Module
+		err  string
+	}{
+		{
+			note: "one-dot ref, single-value rule, short+compat",
+			mod: MustParseModule(`package t
+p[1] = 2`),
+		},
+		{
+			note: "function, short",
+			mod: MustParseModule(`package t
+p(1)`),
+		},
+		{
+			note: "function",
+			mod: MustParseModuleWithOpts(`package t
+p(1) if true`, popts),
+		},
+		{
+			note: "function with value",
+			mod: MustParseModuleWithOpts(`package t
+p(1) = 2 if true`, popts),
+		},
+		{
+			note: "function with value",
+			mod: MustParseModule(`package t
+p(1) = 2`),
+		},
+		{
+			note: "one-dot ref, single-value rule, compat",
+			mod: MustParseModuleWithOpts(`package t
+p[3] = 4 if true`, popts),
+		},
+		{
+			note: "multi-value non-ref head",
+			mod: MustParseModuleWithOpts(`package t
+p contains 1 if true`, popts),
+		},
+		{ // NOTE(sr): this was previously forbidden because we need the `if` for disambiguation
+			note: "one-dot ref head",
+			mod: MustParseModuleWithOpts(`package t
+p[1] if true`, popts),
+			err: "rule heads with refs are not supported: p[1]",
+		},
+		{
+			note: "single-value ref rule",
+			mod: MustParseModuleWithOpts(`package t
+a.b.c[x] if x := input`, popts),
+			err: "rule heads with refs are not supported: a.b.c[x]",
+		},
+		{
+			note: "ref head function",
+			mod: MustParseModuleWithOpts(`package t
+a.b.c(x) if x == input`, popts),
+			err: "rule heads with refs are not supported: a.b.c",
+		},
+		{
+			note: "multi-value ref rule",
+			mod: MustParseModuleWithOpts(`package t
+a.b.c contains x if x := input`, popts),
+			err: "rule heads with refs are not supported: a.b.c",
+		},
+	} {
+		t.Run(tc.note, func(t *testing.T) {
+			caps, err := LoadCapabilitiesVersion("v0.44.0")
+			if err != nil {
+				t.Fatal(err)
+			}
+			c := NewCompiler().WithCapabilities(caps)
+			c.Modules["test"] = tc.mod
+			compileStages(c, c.rewriteRefsInHead)
+			if tc.err != "" {
+				assertErrorWithMessage(t, c.Errors, tc.err)
+			} else {
+				assertNotFailed(t, c)
+			}
+		})
+	}
+}
+
+func TestCompilerRewriteRegoMetadataCalls(t *testing.T) {
+	tests := []struct {
+		note   string
+		module string
+		exp    string
+	}{
+		{
+			note: "rego.metadata called, no metadata",
+			module: `package test
+
+p {
+	rego.metadata.chain()[0].path == ["test", "p"]
+	rego.metadata.rule() == {}
+}`,
+			exp: `package test
+
+p = true {
+	__local2__ = [{"path": ["test", "p"]}]
+	__local3__ = {}
+	__local0__ = __local2__
+	equal(__local0__[0].path, ["test", "p"])
+	__local1__ = __local3__
+	equal(__local1__, {})
+}`,
+		},
+		{
+			note: "rego.metadata called, no output var, no metadata",
+			module: `package test
+
+p {
+	rego.metadata.chain()
+	rego.metadata.rule()
+}`,
+			exp: `package test
+
+p = true {
+	__local0__ = [{"path": ["test", "p"]}]
+	__local1__ = {}
+	__local0__
+	__local1__
+}`,
+		},
+		{
+			note: "rego.metadata called, with metadata",
+			module: `# METADATA
+# description: A test package
+package test
+
+# METADATA
+# title: My P Rule
+p {
+	rego.metadata.chain()[0].title == "My P Rule"
+	rego.metadata.chain()[1].description == "A test package"
+}
+
+# METADATA
+# title: My Other P Rule
+p {
+	rego.metadata.rule().title == "My Other P Rule"
+}`,
+			exp: `# METADATA
+# {"scope":"package","description":"A test package"}
+package test
+
+# METADATA
+# {"scope":"rule","title":"My P Rule"}
+p = true {
+	__local3__ = [
+		{"annotations": {"scope": "rule", "title": "My P Rule"}, "path": ["test", "p"]},
+		{"annotations": {"description": "A test package", "scope": "package"}, "path": ["test"]}
+	]
+	__local0__ = __local3__
+	equal(__local0__[0].title, "My P Rule")
+	__local1__ = __local3__
+	equal(__local1__[1].description, "A test package")
+}
+
+# METADATA
+# {"scope":"rule","title":"My Other P Rule"}
+p = true {
+	__local4__ = {"scope": "rule", "title": "My Other P Rule"}
+	__local2__ = __local4__
+	equal(__local2__.title, "My Other P Rule")
+}`,
+		},
+		{
+			note: "rego.metadata referenced multiple times",
+			module: `# METADATA
+# description: TEST
+package test
+
+p {
+	rego.metadata.chain()[0].path == ["test", "p"]
+	rego.metadata.chain()[1].path == ["test"]
+}`,
+			exp: `# METADATA
+# {"scope":"package","description":"TEST"}
+package test
+
+p = true {
+	__local2__ = [
+		{"path": ["test", "p"]},
+		{"annotations": {"description": "TEST", "scope": "package"}, "path": ["test"]}
+	]
+	__local0__ = __local2__
+	equal(__local0__[0].path, ["test", "p"])
+	__local1__ = __local2__
+	equal(__local1__[1].path, ["test"]) }`,
+		},
+		{
+			note: "rego.metadata return value",
+			module: `package test
+
+p := rego.metadata.chain()`,
+			exp: `package test
+
+p := __local0__ {
+	__local1__ = [{"path": ["test", "p"]}]
+	true
+	__local0__ = __local1__
+}`,
+		},
+		{
+			note: "rego.metadata argument in function call",
+			module: `package test
+
+p {
+	q(rego.metadata.chain())
+}
+
+q(s) {
+	s == ["test", "p"]
+}`,
+			exp: `package test
+
+p = true {
+	__local2__ = [{"path": ["test", "p"]}]
+	__local1__ = __local2__
+	data.test.q(__local1__)
+}
+
+q(__local0__) = true {
+	equal(__local0__, ["test", "p"])
+}`,
+		},
+		{
+			note: "rego.metadata used in array comprehension",
+			module: `package test
+
+p = [x | x := rego.metadata.chain()]`,
+			exp: `package test
+
+p = [__local0__ | __local1__ = __local2__; __local0__ = __local1__] {
+	__local2__ = [{"path": ["test", "p"]}]
+	true
+}`,
+		},
+		{
+			note: "rego.metadata used in nested array comprehension",
+			module: `package test
+
+p {
+	y := [x | x := rego.metadata.chain()]
+	y[0].path == ["test", "p"]
+}`,
+			exp: `package test
+
+p = true {
+	__local3__ = [{"path": ["test", "p"]}];
+	__local1__ = [__local0__ | __local2__ = __local3__; __local0__ = __local2__];
+	equal(__local1__[0].path, ["test", "p"])
+}`,
+		},
+		{
+			note: "rego.metadata used in set comprehension",
+			module: `package test
+
+p = {x | x := rego.metadata.chain()}`,
+			exp: `package test
+
+p = {__local0__ | __local1__ = __local2__; __local0__ = __local1__} {
+	__local2__ = [{"path": ["test", "p"]}]
+	true
+}`,
+		},
+		{
+			note: "rego.metadata used in nested set comprehension",
+			module: `package test
+
+p {
+	y := {x | x := rego.metadata.chain()}
+	y[0].path == ["test", "p"]
+}`,
+			exp: `package test
+
+p = true {
+	__local3__ = [{"path": ["test", "p"]}]
+	__local1__ = {__local0__ | __local2__ = __local3__; __local0__ = __local2__}
+	equal(__local1__[0].path, ["test", "p"])
+}`,
+		},
+		{
+			note: "rego.metadata used in object comprehension",
+			module: `package test
+
+p = {i: x | x := rego.metadata.chain()[i]}`,
+			exp: `package test
+
+p = {i: __local0__ | __local1__ = __local2__; __local0__ = __local1__[i]} {
+	__local2__ = [{"path": ["test", "p"]}]
+	true
+}`,
+		},
+		{
+			note: "rego.metadata used in nested object comprehension",
+			module: `package test
+
+p {
+	y := {i: x | x := rego.metadata.chain()[i]}
+	y[0].path == ["test", "p"]
+}`,
+			exp: `package test
+
+p = true {
+	__local3__ = [{"path": ["test", "p"]}]
+	__local1__ = {i: __local0__ | __local2__ = __local3__; __local0__ = __local2__[i]}
+	equal(__local1__[0].path, ["test", "p"])
+}`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			c.Modules = map[string]*Module{
+				"test.rego": MustParseModule(tc.module),
+			}
+			compileStages(c, c.rewriteRegoMetadataCalls)
+			assertNotFailed(t, c)
+
+			result := c.Modules["test.rego"]
+			exp := MustParseModuleWithOpts(tc.exp, ParserOptions{ProcessAnnotation: true})
+
+			if result.Compare(exp) != 0 {
+				t.Fatalf("\nExpected:\n\n%v\n\nGot:\n\n%v", exp, result)
+			}
+		})
+	}
+}
+
+func TestCompilerOverridingSelfCalls(t *testing.T) {
+	c := NewCompiler()
+	c.Modules = map[string]*Module{
+		"self.rego": MustParseModule(`package self.metadata
+
+chain(x) = "foo"
+rule := "bar"`),
+		"test.rego": MustParseModule(`package test
+import data.self
+
+p := self.metadata.chain(42)
+q := self.metadata.rule`),
+	}
+
+	compileStages(c, nil)
+	assertNotFailed(t, c)
+}
+
+func TestCompilerRewriteLocalAssignments(t *testing.T) {
+
+	tests := []struct {
+		module          string
+		exp             interface{}
+		expRewrittenMap map[Var]Var
+	}{
+		{
+			module: `
+				package test
+				body { a := 1; a > 0 }
+			`,
+			exp: `
+				package test
+				body = true { __local0__ = 1; gt(__local0__, 0) }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				head_vars(a) = b { b := a }
+			`,
+			exp: `
+				package test
+				head_vars(__local0__) = __local1__ { __local1__ = __local0__ }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+				Var("__local1__"): Var("b"),
+			},
+		},
+		{
+			module: `
+				package test
+				head_key[a] { a := 1 }
+			`,
+			exp: `
+				package test
+				head_key[__local0__] { __local0__ = 1 }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				head_unsafe_var[a] { some a }
+			`,
+			exp: `
+				package test
+				head_unsafe_var[__local0__] { true }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				p = {1,2,3}
+				x = 4
+				head_nested[p[x]] {
+					some x
+				}`,
+			exp: `
+					package test
+					p = {1,2,3}
+					x = 4
+					head_nested[data.test.p[__local0__]]
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+				p = {1,2}
+				head_closure_nested[p[x]] {
+					y = [true | some x; x = 1]
+				}
+			`,
+			exp: `
+				package test
+				p = {1,2}
+				head_closure_nested[data.test.p[x]] {
+					y = [true | __local0__ = 1]
+				}
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+				nested {
+					a := [1,2,3]
+					x := [true | a[i] > 1]
+				}
+			`,
+			exp: `
+				package test
+				nested = true { __local0__ = [1, 2, 3]; __local1__ = [true | gt(__local0__[i], 1)] }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+				Var("__local1__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+				x = 2
+				shadow_globals[x] { x := 1 }
+			`,
+			exp: `
+				package test
+				x = 2 { true }
+				shadow_globals[__local0__] { __local0__ = 1 }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+				shadow_rule[shadow_rule] { shadow_rule := 1 }
+			`,
+			exp: `
+				package test
+				shadow_rule[__local0__] { __local0__ = 1 }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("shadow_rule"),
+			},
+		},
+		{
+			module: `
+				package test
+				shadow_roots_1 { data := 1; input := 2; input > data }
+			`,
+			exp: `
+				package test
+				shadow_roots_1 = true { __local0__ = 1; __local1__ = 2; gt(__local1__, __local0__) }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("data"),
+				Var("__local1__"): Var("input"),
+			},
+		},
+		{
+			module: `
+				package test
+				shadow_roots_2 { input := {"a": 1}; input.a > 0  }
+			`,
+			exp: `
+				package test
+				shadow_roots_2 = true { __local0__ = {"a": 1}; gt(__local0__.a, 0) }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("input"),
+			},
+		},
+		{
+			module: `
+				package test
+				skip_with_target { a := 1; input := 2; data.p with input as a }
+			`,
+			exp: `
+				package test
+				skip_with_target = true { __local0__ = 1; __local1__ = 2; data.p with input as __local0__ }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+				Var("__local1__"): Var("input"),
+			},
+		},
+		{
+			module: `
+				package test
+				shadow_comprehensions {
+					a := 1
+					[true | a := 2; b := 1]
+					b := 2
+				}
+			`,
+			exp: `
+				package test
+				shadow_comprehensions = true { __local0__ = 1; [true | __local1__ = 2; __local2__ = 1]; __local3__ = 2 }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+				Var("__local1__"): Var("a"),
+				Var("__local2__"): Var("b"),
+				Var("__local3__"): Var("b"),
+			},
+		},
+		{
+			module: `
+				package test
+					scoping {
+						[true | a := 1]
+						[true | a := 2]
+					}
+			`,
+			exp: `
+				package test
+				scoping = true { [true | __local0__ = 1]; [true | __local1__ = 2] }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+				Var("__local1__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				object_keys {
+					{k: v1, "k2": v2} := {"foo": 1, "k2": 2}
+				}
+			`,
+			exp: `
+				package test
+				object_keys = true { {"k2": __local0__, k: __local1__} = {"foo": 1, "k2": 2} }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("v2"),
+				Var("__local1__"): Var("v1"),
+			},
+		},
+		{
+			module: `
+				package test
+				head_array_comprehensions = [[x] | x := 1]
+					head_set_comprehensions = {[x] | x := 1}
+					head_object_comprehensions = {k: [x] | k := "foo"; x := 1}
+			`,
+			exp: `
+				package test
+				head_array_comprehensions = [[__local0__] | __local0__ = 1] { true }
+				head_set_comprehensions = {[__local1__] | __local1__ = 1} { true }
+				head_object_comprehensions = {__local2__: [__local3__] | __local2__ = "foo"; __local3__ = 1} { true }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+				Var("__local1__"): Var("x"),
+				Var("__local2__"): Var("k"),
+				Var("__local3__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+				rewritten_object_key {
+					k := "foo"
+					{k: 1}
+				}
+			`,
+			exp: `
+				package test
+				rewritten_object_key = true { __local0__ = "foo"; {__local0__: 1} }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("k"),
+			},
+		},
+		{
+			module: `
+				package test
+				rewritten_object_key_head[[{k: 1}]] {
+					k := "foo"
+				}
+			`,
+			exp: `
+				package test
+				rewritten_object_key_head[[{__local0__: 1}]] { __local0__ = "foo" }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("k"),
+			},
+		},
+		{
+			module: `
+				package test
+				rewritten_object_key_head_value = [{k: 1}] {
+					k := "foo"
+				}
+			`,
+			exp: `
+				package test
+				rewritten_object_key_head_value = [{__local0__: 1}] { __local0__ = "foo" }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("k"),
+			},
+		},
+		{
+			module: `
+				package test
+				skip_with_target_in_assignment {
+					input := 1
+					a := [true | true with input as 2; true with input as 3]
+				}
+			`,
+			exp: `
+				package test
+				skip_with_target_in_assignment = true { __local0__ = 1; __local1__ = [true | true with input as 2; true with input as 3] }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("input"),
+				Var("__local1__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				rewrite_with_value_in_assignment {
+					a := 1
+					b := 1 with input as [a]
+				}
+			`,
+			exp: `
+				package test
+				rewrite_with_value_in_assignment = true { __local0__ = 1; __local1__ = 1 with input as [__local0__] }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+				Var("__local1__"): Var("b"),
+			},
+		},
+		{
+			module: `
+				package test
+				rewrite_with_value_in_expr {
+					a := 1
+					a > 0 with input as [a]
+				}
+			`,
+			exp: `
+				package test
+				rewrite_with_value_in_expr = true { __local0__ = 1; gt(__local0__, 0) with input as [__local0__] }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				rewrite_nested_with_value_in_expr {
+					a := 1
+					a > 0 with input as object.union({"a": a}, {"max_a": max([a])})
+				}
+			`,
+			exp: `
+				package test
+				rewrite_nested_with_value_in_expr = true { __local0__ = 1; gt(__local0__, 0) with input as object.union({"a": __local0__}, {"max_a": max([__local0__])}) }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("a"),
+			},
+		},
+		{
+			module: `
+				package test
+				global = {}
+				ref_shadowed {
+					global := {"a": 1}
+					global.a > 0
+				}
+			`,
+			exp: `
+				package test
+				global = {} { true }
+				ref_shadowed = true { __local0__ = {"a": 1}; gt(__local0__.a, 0) }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("global"),
+			},
+		},
+		{
+			module: `
+				package test
+				f(x) = y {
+					x == 1
+					y := 2
+				} else = y {
+					x == 3
+					y := 4
+				}
+			`,
+			// Each "else" rule has a separate rule head and the vars in the
+			// args will be rewritten. Since we cannot currently redefine the
+			// args, we must parse the module and then manually update the args.
+			exp: func() *Module {
+				module := MustParseModule(`
+					package test
+
+					f(__local0__) = __local1__ { __local0__ == 1; __local1__ = 2 } else = __local2__ { __local0__ == 3; __local2__ = 4 }
+				`)
+				module.Rules[0].Else.Head.Args[0].Value = Var("__local0__")
+				return module
+			},
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+				Var("__local1__"): Var("y"),
+				Var("__local2__"): Var("y"),
+			},
+		},
+		{
+			module: `
+				package test
+				f({"x": [x]}) = y { x == 1; y := 2 }`,
+			exp: `
+				package test
+
+				f({"x": [__local0__]}) = __local1__ { __local0__ == 1; __local1__ = 2 }`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+				Var("__local1__"): Var("y"),
+			},
+		},
+		{
+			module: `
+				package test
+
+				f(x, [x]) = x { x == 1 }
+			`,
+			exp: `
+				package test
+
+				f(__local0__, [__local0__]) = __local0__ { __local0__ == 1 }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+
+				f(x) = {x[0]: 1} { true }
+			`,
+			exp: `
+				package test
+
+				f(__local0__) = {__local0__[0]: 1} { true }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("x"),
+			},
+		},
+		{
+			module: `
+				package test
+
+				f({{t | t := 0}: 1}) {
+					true
+				}
+			`,
+			exp: `
+				package test
+
+				f({{__local0__ | __local0__ = 0}: 1}) { true }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("t"),
+			},
+		},
+		{
+			module: `
+				package test
+
+				f({{t | t := 0}}) {
+					true
+				}
+			`,
+			exp: `
+				package test
+
+				f({{__local0__ | __local0__ = 0}}) { true }
+			`,
+			expRewrittenMap: map[Var]Var{
+				Var("__local0__"): Var("t"),
+			},
+		},
+	}
+
+	for i, tc := range tests {
+		t.Run(fmt.Sprint(i), func(t *testing.T) {
+			c := NewCompiler()
+			c.Modules = map[string]*Module{
+				"test.rego": MustParseModule(tc.module),
+			}
+			compileStages(c, c.rewriteLocalVars)
+			assertNotFailed(t, c)
+			result := c.Modules["test.rego"]
+			var exp *Module
+			switch e := tc.exp.(type) {
+			case string:
+				exp = MustParseModule(e)
+			case func() *Module:
+				exp = e()
+			default:
+				panic("expected value must be string or func() *Module")
+			}
+			if result.Compare(exp) != 0 {
+				t.Fatalf("\nExpected:\n\n%v\n\nGot:\n\n%v", exp, result)
+			}
+			if !reflect.DeepEqual(c.RewrittenVars, tc.expRewrittenMap) {
+				t.Fatalf("\nExpected Rewritten Vars:\n\n\t%+v\n\nGot:\n\n\t%+v\n\n", tc.expRewrittenMap, c.RewrittenVars)
+			}
+		})
+	}
+
+}
+func TestRewriteLocalVarDeclarationErrors(t *testing.T) {
+
+	c := NewCompiler()
+
+	c.Modules["test"] = MustParseModule(`package test
+
+	redeclaration {
+		r1 = 1
+		r1 := 2
+		r2 := 1
+		[b, r2] := [1, 2]
+		input.path == 1
+		input := "foo"
+		_ := [1 | nested := 1; nested := 2]
+	}
+
+	negation {
+		not a := 1
+	}
+
+	bad_assign {
+		null := x
+		true := x
+		4.5 := x
+		"foo" := x
+		[true | true] := []
+		{true | true} := set()
+		{"foo": true | true} := {}
+		x + 1 := 2
+		data.foo := 1
+		[z, 1] := [1, 2]
+	}
+
+	arg_redeclared(arg1) {
+		arg1 := 1
+	}
+
+	arg_nested_redeclared({{arg_nested| arg_nested := 1; arg_nested := 2}}) { true }
+	`)
+
+	compileStages(c, c.rewriteLocalVars)
+
+	expectedErrors := []string{
+		"var r1 referenced above",
+		"var r2 assigned above",
+		"var input referenced above",
+		"var nested assigned above",
+		"arg arg1 redeclared",
+		"var arg_nested assigned above",
+		"cannot assign vars inside negated expression",
+		"cannot assign to ref",
+		"cannot assign to arraycomprehension",
+		"cannot assign to setcomprehension",
+		"cannot assign to objectcomprehension",
+		"cannot assign to call",
+		"cannot assign to number",
+		"cannot assign to number",
+		"cannot assign to boolean",
+		"cannot assign to string",
+		"cannot assign to null",
+	}
+
+	sort.Strings(expectedErrors)
+
+	result := []string{}
+
+	for i := range c.Errors {
+		result = append(result, c.Errors[i].Message)
+	}
+
+	sort.Strings(result)
+
+	if len(expectedErrors) != len(result) {
+		t.Fatalf("Expected %d errors but got %d:\n\n%v\n\nGot:\n\n%v", len(expectedErrors), len(result), strings.Join(expectedErrors, "\n"), strings.Join(result, "\n"))
+	}
+
+	for i := range result {
+		if result[i] != expectedErrors[i] {
+			t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", strings.Join(expectedErrors, "\n"), strings.Join(result, "\n"))
+		}
+	}
+}
+
+func TestRewriteDeclaredVarsStage(t *testing.T) {
+
+	// Unlike the following test case, this only executes up to the
+	// RewriteLocalVars stage. This is done so that later stages like
+	// RewriteDynamics are not executed.
+
+	tests := []struct {
+		note   string
+		module string
+		exp    string
+	}{
+		{
+			note: "object ref key",
+			module: `
+				package test
+
+				p {
+					a := {"a": "a"}
+					{a.a: a.a}
+				}
+			`,
+			exp: `
+				package test
+
+				p {
+					__local0__ = {"a": "a"}
+					{__local0__.a: __local0__.a}
+				}
+			`,
+		},
+		{
+			note: "set ref element",
+			module: `
+				package test
+
+				p {
+					a := {"a": "a"}
+					{a.a}
+				}
+			`,
+			exp: `
+				package test
+
+				p {
+					__local0__ = {"a": "a"}
+					{__local0__.a}
+				}
+			`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+
+			c := NewCompiler()
+
+			c.Modules = map[string]*Module{
+				"test.rego": MustParseModule(tc.module),
+			}
+
+			compileStages(c, c.rewriteLocalVars)
+
+			exp := MustParseModule(tc.exp)
+			result := c.Modules["test.rego"]
+
+			if !exp.Equal(result) {
+				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, result)
+			}
+		})
+	}
+}
+
+func TestRewriteDeclaredVars(t *testing.T) {
+	tests := []struct {
+		note    string
+		module  string
+		exp     string
+		wantErr error
+	}{
+		{
+			note: "rewrite unify",
+			module: `
+				package test
+				x = 1
+				y = 2
+				p { some x; input = [x, y] }
+			`,
+			exp: `
+				package test
+				x = 1
+				y = 2
+				p { __local1__ = data.test.y; input = [__local0__, __local1__] }
+			`,
+		},
+		{
+			note: "rewrite call",
+			module: `
+				package test
+				x = []
+				y = {}
+				p { some x; walk(y, [x, y]) }
+			`,
+			exp: `
+				package test
+				x = []
+				y = {}
+				p { __local1__ = data.test.y; __local2__ = data.test.y; walk(__local1__, [__local0__, __local2__]) }
+			`,
+		},
+		{
+			note: "rewrite term",
+			module: `
+				package test
+				x = "a"
+				y = 1
+				q[[2, "b"]]
+				p { some x; q[[y,x]] }
+			`,
+			exp: `
+				package test
+				x = "a"
+				y = 1
+				q[[2, "b"]]
+				p { __local1__ = data.test.y; data.test.q[[__local1__, __local0__]] }
+			`,
+		},
+		{
+			note: "single-value rule with ref head",
+			module: `
+				package test
+
+				p.r.q[s] = t {
+					t := 1
+					s := input.foo
+				}
+			`,
+			exp: `
+				package test
+
+				p.r.q[__local1__] = __local0__ {
+					__local0__ = 1
+					__local1__ = input.foo
+				}
+			`,
+		},
+		{
+			note: "rewrite some x in xs",
+			module: `
+				package test
+				import future.keywords.in
+				xs = ["a", "b", "c"]
+				p { some x in xs; x == "a" }
+			`,
+			exp: `
+				package test
+				xs = ["a", "b", "c"]
+				p { __local2__ = data.test.xs[__local1__]; __local2__ = "a" }
+			`,
+		},
+		{
+			note: "rewrite some k, x in xs",
+			module: `
+				package test
+				import future.keywords.in
+				xs = ["a", "b", "c"]
+				p { some k, x in xs; x == "a"; k == 2 }
+			`,
+			exp: `
+				package test
+				xs = ["a", "b", "c"]
+				p { __local1__ = data.test.xs[__local0__]; __local1__ = "a"; __local0__ = 2 }
+			`,
+		},
+		{
+			note: "rewrite some k, x in xs[i]",
+			module: `
+				package test
+				import future.keywords.in
+				xs = [["a", "b", "c"], []]
+				p {
+					some i
+					some k, x in xs[i]
+					x == "a"
+					k == 2
+				}
+			`,
+			exp: `
+				package test
+				xs = [["a", "b", "c"], []]
+				p = true { __local2__ = data.test.xs[__local0__][__local1__]; __local2__ = "a"; __local1__ = 2 }
+			`,
+		},
+		{
+			note: "rewrite some k, x in xs[i] with `i` as ref",
+			module: `
+				package test
+				import future.keywords.in
+				i = 0
+				xs = [["a", "b", "c"], []]
+				p {
+					some k, x in xs[i]
+					x == "a"
+					k == 2
+				}
+			`,
+			exp: `
+				package test
+				i = 0
+				xs = [["a", "b", "c"], []]
+				p = true { __local2__ = data.test.i; __local1__ = data.test.xs[__local2__][__local0__]; __local1__ = "a"; __local0__ = 2 }
+			`,
+		},
+		{
+			note: "rewrite some: with modifier on domain",
+			module: `
+				package test
+				p {
+					some k, x in input with input as [1, 1, 1]
+					k == 0
+					x == 1
+				}
+			`,
+			exp: `
+				package test
+				p {
+					__local1__ = input[__local0__] with input as [1, 1, 1]
+					__local0__ = 0
+					__local1__ = 1
+				}
+			`,
+		},
+		{
+			note: "rewrite every",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				i = 0
+				xs = [1, 2]
+				k = "foo"
+				v = "bar"
+				p {
+					every k, v in xs { k + v > i }
+				}
+			`,
+			exp: `
+				package test
+				i = 0
+				xs = [1, 2]
+				k = "foo"
+				v = "bar"
+				p = true {
+					__local2__ = data.test.xs
+					every __local0__, __local1__ in __local2__ {
+						plus(__local0__, __local1__, __local3__)
+						__local4__ = data.test.i
+						gt(__local3__, __local4__)
+					}
+				}			`,
+		},
+		{
+			note: "rewrite every: unused key var",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					every k, v in [1] { v >= 1 }
+				}
+			`,
+			wantErr: errors.New("declared var k unused"),
+		},
+		{
+			// NOTE(sr): this would happen when compiling modules twice:
+			// the first run rewrites every to include a generated key var,
+			// the second one bails because it's not used.
+			// Seen in the wild when using `opa test -b` on a bundle that
+			// used `every`, https://github.com/open-policy-agent/opa/issues/4420
+			note: "rewrite every: unused generated key var",
+			module: `
+				package test
+
+				p {
+					every __local0__, v in [1] { v >= 1 }
+				}
+			`,
+			exp: `
+				package test
+				p = true {
+					__local3__ = [1]
+					every __local1__, __local2__ in __local3__ { __local2__ >= 1 }
+				}
+		`,
+		},
+		{
+			note: "rewrite every: unused value var",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					every v in [1] { true }
+				}
+			`,
+			wantErr: errors.New("declared var v unused"),
+		},
+		{
+			note: "rewrite every: wildcard value var, used key",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					every k, _ in [1] { k >= 0 }
+				}
+			`,
+			exp: `
+				package test
+				p = true {
+					__local1__ = [1]
+					every __local0__, _ in __local1__ { gte(__local0__, 0) }
+				}
+			`,
+		},
+		{
+			note: "rewrite every: wildcard key+value var", // NOTE(sr): may be silly, but valid
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					every _, _ in [1] { true }
+				}
+			`,
+			exp: `
+				package test
+				p = true { __local0__ = [1]; every _, _ in __local0__ { true } }
+			`,
+		},
+		{
+			note: "rewrite every: declared vars with different scopes",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					some x
+					x = 10
+					every x in [1] { x == 1 }
+				}
+			`,
+			exp: `
+				package test
+				p = true {
+					__local0__ = 10
+					__local3__ = [1]
+					every __local1__, __local2__ in __local3__ { __local2__ = 1 }
+				}
+			`,
+		},
+		{
+			note: "rewrite every: declared vars used in body",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					some y
+					y = 10
+					every x in [1] { x == y }
+				}
+			`,
+			exp: `
+				package test
+				p = true {
+					__local0__ = 10
+					__local3__ = [1]
+					every __local1__, __local2__ in __local3__ {
+						__local2__ = __local0__
+					}
+				}
+			`,
+		},
+		{
+			note: "rewrite every: pops declared var stack",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p[x] {
+					some x
+					x = 10
+					every _ in [1] { true }
+				}
+			`,
+			exp: `
+				package test
+				p[__local0__] { __local0__ = 10; __local2__ = [1]; every __local1__, _ in __local2__ { true } }
+			`,
+		},
+		{
+			note: "rewrite every: nested",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					xs := [[1], [2]]
+					every v in [1] {
+						every w in xs[v] {
+							w == 2
+						}
+					}
+				}
+			`,
+			exp: `
+				package test
+				p = true {
+					__local0__ = [[1], [2]]
+					__local5__ = [1]
+					every __local1__, __local2__ in __local5__ {
+						__local6__ = __local0__[__local2__]
+						every __local3__, __local4__ in __local6__ {
+							__local4__ = 2
+						}
+					}
+				}
+			`,
+		},
+		{
+			note: "rewrite every: with modifier on domain",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					every x in input { x == 1 } with input as [1, 1, 1]
+				}
+			`,
+			exp: `
+				package test
+				p {
+					__local2__ = input with input as [1, 1, 1]
+					every __local0__, __local1__ in __local2__ {
+						__local1__ = 1
+					} with input as [1, 1, 1]
+				}
+			`,
+		},
+		{
+			note: "rewrite every: with modifier on domain with declared var",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					xs := [1, 2]
+					every x in input { x == 1 } with input as xs
+				}
+			`,
+			exp: `
+				package test
+				p {
+					__local0__ = [1, 2]
+					__local3__ = input with input as __local0__
+					every __local1__, __local2__ in __local3__ {
+						__local2__ = 1
+					} with input as __local0__
+				}
+			`,
+		},
+		{
+			note: "rewrite every: with modifier on body",
+			module: `
+				package test
+				# import future.keywords.in
+				# import future.keywords.every
+				p {
+					every x in [2] { x == input } with input as 2
+				}
+			`,
+			exp: `
+				package test
+				p {
+					__local2__ = [2] with input as 2
+					every __local0__, __local1__ in __local2__ {
+						__local1__ = input
+					} with input as 2
+				}
+			`,
+		},
+		{
+			note: "rewrite closures",
+			module: `
+				package test
+				x = 1
+				y = 2
+				p {
+					some x, z
+					z = 3
+					[x | x = 2; y = 2; some z; z = 4]
+				}
+			`,
+			exp: `
+				package test
+				x = 1
+				y = 2
+				p {
+					__local1__ = 3
+					[__local0__ | __local0__ = 2; data.test.y = 2; __local2__ = 4]
+				}
+			`,
+		},
+		{
+			note: "rewrite head var",
+			module: `
+				package test
+				x = "a"
+				y = 1
+				z = 2
+				p[x] = [y, z] {
+					some x, z
+					x = "b"
+					z = 4
+				}`,
+			exp: `
+				package test
+				x = "a"
+				y = 1
+				z = 2
+				p[__local0__] = __local2__ {
+					__local0__ = "b"
+					__local1__ = 4;
+					__local3__ = data.test.y
+					__local2__ = [__local3__, __local1__]
+				}
+			`,
+		},
+		{
+			note: "rewrite call with root document ref as arg",
+			module: `
+				package test
+
+				p {
+					f(input, "bar")
+				}
+
+				f(x, y) {
+					x[y]
+				}
+				`,
+			exp: `
+				package test
+
+				p = true {
+					__local2__ = input;
+					data.test.f(__local2__, "bar")
+				}
+
+				f(__local0__, __local1__) = true {
+					__local0__[__local1__]
+				}
+			`,
+		},
+		{
+			note: "redeclare err",
+			module: `
+				package test
+				p {
+					some x
+					some x
+				}
+			`,
+			wantErr: errors.New("var x declared above"),
+		},
+		{
+			note: "redeclare assigned err",
+			module: `
+				package test
+				p {
+					x := 1
+					some x
+				}
+			`,
+			wantErr: errors.New("var x assigned above"),
+		},
+		{
+			note: "redeclare reference err",
+			module: `
+				package test
+				p {
+					data.q[x]
+					some x
+				}
+			`,
+			wantErr: errors.New("var x referenced above"),
+		},
+		{
+			note: "declare unused err",
+			module: `
+				package test
+				p {
+					some x
+				}
+			`,
+			wantErr: errors.New("declared var x unused"),
+		},
+		{
+			note: "declare unsafe err",
+			module: `
+				package test
+				p[x] {
+					some x
+					x == 1
+				}
+			`,
+			wantErr: errors.New("var x is unsafe"),
+		},
+		{
+			note: "declare arg err",
+			module: `
+			package test
+
+			f([a]) {
+				some a
+				a = 1
+			}
+			`,
+			wantErr: errors.New("arg a redeclared"),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			opts := CompileOpts{ParserOptions: ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}}
+			compiler, err := CompileModulesWithOpt(map[string]string{"test.rego": tc.module}, opts)
+			if tc.wantErr != nil {
+				if err == nil {
+					t.Fatal("Expected error but got success")
+				}
+				if !strings.Contains(err.Error(), tc.wantErr.Error()) {
+					t.Fatalf("Expected %v but got %v", tc.wantErr, err)
+				}
+			} else if err != nil {
+				t.Fatal(err)
+			} else {
+				exp := MustParseModuleWithOpts(tc.exp, opts.ParserOptions)
+				result := compiler.Modules["test.rego"]
+				if exp.Compare(result) != 0 {
+					t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, result)
+				}
+			}
+		})
+	}
+}
+
+func TestCheckUnusedFunctionArgVars(t *testing.T) {
+	tests := []strictnessTestCase{
+		{
+			note: "one of the two function args is not used - issue 5602 regression test",
+			module: `package test
+			func(x, y) {
+				x = 1
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y)"), "", 2, 4),
+					Message:  "unused argument y",
+				},
+			},
+		},
+		{
+			note: "one of the two ref-head function args is not used",
+			module: `package test
+			a.b.c.func(x, y) {
+				x = 1
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("a.b.c.func(x, y)"), "", 2, 4),
+					Message:  "unused argument y",
+				},
+			},
+		},
+		{
+			note: "multiple unused argvar in scope - issue 5602 regression test",
+			module: `package test
+			func(x, y) {
+				input.baz = 1
+				input.test == "foo"
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y)"), "", 2, 4),
+					Message:  "unused argument x",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y)"), "", 2, 4),
+					Message:  "unused argument y",
+				},
+			},
+		},
+		{
+			note: "some unused argvar in scope - issue 5602 regression test",
+			module: `package test
+			func(x, y) {
+				input.test == "foo"
+				x = 1
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y)"), "", 2, 4),
+					Message:  "unused argument y",
+				},
+			},
+		},
+		{
+			note: "wildcard argvar that's ignored - issue 5602 regression test",
+			module: `package test
+			func(x, _) {
+				input.test == "foo"
+				x = 1
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "wildcard argvar that's ignored - issue 5602 regression test",
+			module: `package test
+			func(x, _) {
+				input.test == "foo"
+			 }`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, _)"), "", 2, 4),
+					Message:  "unused argument x",
+				},
+			},
+		},
+		{
+			note: "argvar not used in body but in head - issue 5602 regression test",
+			module: `package test
+			func(x) := x {
+				input.test == "foo"
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar not used in body but in head value comprehension",
+			module: `package test
+			a := {"foo": 1}
+			func(x) := { x: v | v := a[x] } {
+				input.test == "foo"
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar not used in body but in else-head value comprehension",
+			module: `package test
+			a := {"foo": 1}
+			func(x) {
+				input.test == "foo"
+			} else := { x: v | v := a[x] } {
+				input.test == "bar"
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar not used in body and shadowed in head value comprehension",
+			module: `package test
+			a := {"foo": 1}
+			func(x) := { x: v | x := "foo"; v := a[x] } {
+				input.test == "foo"
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x) := { x: v | x := \"foo\"; v := a[x] }"), "", 3, 4),
+					Message:  "unused argument x",
+				},
+			},
+		},
+		{
+			note: "argvar used in primary body but not in else body",
+			module: `package test
+			func(x) {
+				input.test == x
+			} else := false {
+				input.test == "foo"
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar used in primary body but not in else body (with wildcard)",
+			module: `package test
+			func(x, _) {
+				input.test == x
+			} else := false {
+				input.test == "foo"
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar not used in primary body but in else body",
+			module: `package test
+			func(x) {
+				input.test == "foo"
+			} else := false {
+				input.test == x
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar not used in primary body but in else body (with wildcard)",
+			module: `package test
+			func(x, _) {
+				input.test == "foo"
+			} else := false {
+				input.test == x
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvar used in primary body but not in implicit else body",
+			module: `package test
+			func(x) {
+				input.test == x
+			} else := false`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvars usage spread over multiple bodies",
+			module: `package test
+			func(x, y, z) {
+				input.test == x
+			} else {
+				input.test == y
+			} else {
+				input.test == z
+			}`,
+			expectedErrors: Errors{},
+		},
+		{
+			note: "argvars usage spread over multiple bodies, missing in first",
+			module: `package test
+			func(x, y, z) {
+				input.test == "foo"
+			} else {
+				input.test == y
+			} else {
+				input.test == z
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y, z)"), "", 2, 4),
+					Message:  "unused argument x",
+				},
+			},
+		},
+		{
+			note: "argvars usage spread over multiple bodies, missing in second",
+			module: `package test
+			func(x, y, z) {
+				input.test == x
+			} else {
+				input.test == "bar"
+			} else {
+				input.test == z
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y, z)"), "", 2, 4),
+					Message:  "unused argument y",
+				},
+			},
+		},
+		{
+			note: "argvars usage spread over multiple bodies, missing in third",
+			module: `package test
+			func(x, y, z) {
+				input.test == x
+			} else {
+				input.test == y
+			} else {
+				input.test == "baz"
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y, z)"), "", 2, 4),
+					Message:  "unused argument z",
+				},
+			},
+		},
+	}
+
+	t.Helper()
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := NewCompiler().WithStrict(true)
+			compiler.Modules = map[string]*Module{
+				"test": MustParseModule(tc.module),
+			}
+			compileStages(compiler, nil)
+
+			assertErrors(t, compiler.Errors, tc.expectedErrors, true)
+		})
+	}
+}
+
+func TestCompileUnusedAssignedVarsErrorLocations(t *testing.T) {
+	tests := []strictnessTestCase{
+		{
+			note: "one of the two function args is not used - issue 5662 regression test",
+			module: `package test
+			func(x, y) {
+				x = 1
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("func(x, y)"), "", 2, 4),
+					Message:  "unused argument y",
+				},
+			},
+		},
+		{
+			note: "multiple unused assigned var in scope - issue 5662 regression test",
+			module: `package test
+			allow {
+				input.message == "world"
+				input.test == "foo"
+				input.x == "foo"
+				input.y == "baz"
+				a := 1
+				b := 2
+				x := {
+					"a": a,
+					"b": "bar",
+				}
+				input.z == "baz"
+				c := 3
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("b := 2"), "", 8, 5),
+					Message:  "assigned var b unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("x := {\n\t\t\t\t\t\"a\": a,\n\t\t\t\t\t\"b\": \"bar\",\n\t\t\t\t}"), "", 9, 5),
+					Message:  "assigned var x unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("c := 3"), "", 14, 5),
+					Message:  "assigned var c unused",
+				},
+			},
+		},
+	}
+
+	t.Helper()
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := NewCompiler().WithStrict(true)
+			compiler.Modules = map[string]*Module{
+				"test": MustParseModule(tc.module),
+			}
+			compileStages(compiler, nil)
+			assertErrors(t, compiler.Errors, tc.expectedErrors, true)
+		})
+	}
 
-	// Ignore key and val vars assigned via `some k, v in xs`.
-	mod15 := c.Modules["someinassignwithkey"]
-	someInAssignCall = mod15.Rules[2].Body[0].Terms.(*SomeDecl).Symbols[0].Value.(Call)
-	assertTermEqual(t, someInAssignCall[1], VarTerm("k"))
-	assertTermEqual(t, someInAssignCall[2], VarTerm("v"))
-	collectionLastElem = someInAssignCall[3].Value.(*Array).Get(IntNumberTerm(2))
-	assertTermEqual(t, collectionLastElem, MustParseTerm("data.someinassignwithkey.y"))
 }
 
-func TestCompilerResolveErrors(t *testing.T) {
+func TestCompileUnusedDeclaredVarsErrorLocations(t *testing.T) {
+	tests := []strictnessTestCase{
+		{
+			note: "simple unused some var - issue 4238 regression test",
+			module: `package test
 
-	c := NewCompiler()
-	c.Modules = map[string]*Module{
-		"shadow-globals": MustParseModule(`
-			package shadow_globals
+			foo {
+				print("Hello world")
+				some i
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some i"), "", 5, 5),
+					Message:  "declared var i unused",
+				},
+			},
+		},
+		{
+			note: "simple unused some vars, 2x rules",
+			module: `package test
 
-			f([input]) { true }
-		`),
+			foo {
+				print("Hello world")
+				some i
+			}
+			
+			bar {
+				print("Hello world")
+				some j
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some i"), "", 5, 5),
+					Message:  "declared var i unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some j"), "", 10, 5),
+					Message:  "declared var j unused",
+				},
+			},
+		},
+		{
+			note: "multiple unused some vars",
+			module: `package test
+
+			x := [1, 1, 1]
+			foo2 {
+				print("A")
+				some a, b, c
+				some i, j
+				some k
+				x[b] == 1
+				print("B")
+			}`,
+			expectedErrors: Errors{
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some a, b, c"), "", 6, 5),
+					Message:  "declared var a unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some a, b, c"), "", 6, 5),
+					Message:  "declared var c unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some i, j"), "", 7, 5),
+					Message:  "declared var i unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some i, j"), "", 7, 5),
+					Message:  "declared var j unused",
+				},
+				&Error{
+					Code:     CompileErr,
+					Location: NewLocation([]byte("some k"), "", 8, 5),
+					Message:  "declared var k unused",
+				},
+			},
+		},
 	}
 
-	compileStages(c, c.resolveAllRefs)
+	// This is similar to the logic for runStrictnessTestCase(), but expects
+	// unconditional compiler errors.
+	t.Helper()
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := NewCompiler().WithStrict(true)
+			compiler.Modules = map[string]*Module{
+				"test": MustParseModule(tc.module),
+			}
+			compileStages(compiler, nil)
 
-	expected := []string{
-		`args must not shadow input`,
+			assertErrors(t, compiler.Errors, tc.expectedErrors, true)
+		})
 	}
-
-	assertCompilerErrorStrings(t, c, expected)
 }
 
-func TestCompilerRewriteTermsInHead(t *testing.T) {
+func TestCompileInvalidEqAssignExpr(t *testing.T) {
+
 	c := NewCompiler()
-	c.Modules["head"] = MustParseModule(`package head
 
-import data.doc1 as bar
-import data.doc2 as corge
-import input.x.y.foo
-import input.qux as baz
+	c.Modules["error"] = MustParseModule(`package errors
 
-p[foo[bar[i]]] = {"baz": baz, "corge": corge} { true }
-q = [true | true] { true }
-r = {"true": true | true} { true }
-s = {true | true} { true }
 
-elsekw {
-	false
-} else = baz {
-	true
-}
-`)
+	p {
+		# Arity mismatches are caught in the checkUndefinedFuncs check,
+		# and invalid eq/assign calls are passed along until then.
+		assign()
+		assign(1)
+		eq()
+		eq(1)
+	}`)
+
+	var prev func()
+	checkUndefinedFuncs := reflect.ValueOf(c.checkUndefinedFuncs)
+
+	for _, stage := range c.stages {
+		if reflect.ValueOf(stage.f).Pointer() == checkUndefinedFuncs.Pointer() {
+			break
+		}
+		prev = stage.f
+	}
 
-	compileStages(c, c.rewriteRefsInHead)
+	compileStages(c, prev)
 	assertNotFailed(t, c)
+}
+
+func TestCompilerRewriteComprehensionTerm(t *testing.T) {
 
-	rule1 := c.Modules["head"].Rules[0]
-	expected1 := MustParseRule(`p[__local0__] = __local1__ { true; __local0__ = input.x.y.foo[data.doc1[i]]; __local1__ = {"baz": input.qux, "corge": data.doc2} }`)
-	assertRulesEqual(t, rule1, expected1)
+	c := NewCompiler()
+	c.Modules["head"] = MustParseModule(`package head
+	arr = [[1], [2], [3]]
+	arr2 = [["a"], ["b"], ["c"]]
+	arr_comp = [[x[i]] | arr[j] = x]
+	set_comp = {[x[i]] | arr[j] = x}
+	obj_comp = {x[i]: x[i] | arr2[j] = x}
+	`)
 
-	rule2 := c.Modules["head"].Rules[1]
-	expected2 := MustParseRule(`q = __local2__ { true; __local2__ = [true | true] }`)
-	assertRulesEqual(t, rule2, expected2)
+	compileStages(c, c.rewriteComprehensionTerms)
+	assertNotFailed(t, c)
 
-	rule3 := c.Modules["head"].Rules[2]
-	expected3 := MustParseRule(`r = __local3__ { true; __local3__ = {"true": true | true} }`)
-	assertRulesEqual(t, rule3, expected3)
+	arrCompRule := c.Modules["head"].Rules[2]
+	exp1 := MustParseRule(`arr_comp = [__local0__ | data.head.arr[j] = x; __local0__ = [x[i]]] { true }`)
+	assertRulesEqual(t, arrCompRule, exp1)
 
-	rule4 := c.Modules["head"].Rules[3]
-	expected4 := MustParseRule(`s = __local4__ { true; __local4__ = {true | true} }`)
-	assertRulesEqual(t, rule4, expected4)
+	setCompRule := c.Modules["head"].Rules[3]
+	exp2 := MustParseRule(`set_comp = {__local1__ | data.head.arr[j] = x; __local1__ = [x[i]]} { true }`)
+	assertRulesEqual(t, setCompRule, exp2)
 
-	rule5 := c.Modules["head"].Rules[4]
-	expected5 := MustParseRule(`elsekw { false } else = __local5__ { true; __local5__ = input.qux }`)
-	assertRulesEqual(t, rule5, expected5)
+	objCompRule := c.Modules["head"].Rules[4]
+	exp3 := MustParseRule(`obj_comp = {__local2__: __local3__ | data.head.arr2[j] = x; __local2__ = x[i]; __local3__ = x[i]} { true }`)
+	assertRulesEqual(t, objCompRule, exp3)
 }
 
-func TestCompilerRewriteLocalAssignments(t *testing.T) {
-
+func TestCompilerRewriteDoubleEq(t *testing.T) {
 	tests := []struct {
-		module          string
-		exp             interface{}
-		expRewrittenMap map[Var]Var
+		note  string
+		input string
+		exp   string
 	}{
 		{
-			module: `
-				package test
-				body { a := 1; a > 0 }
-			`,
-			exp: `
-				package test
-				body = true { __local0__ = 1; gt(__local0__, 0) }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-			},
-		},
-		{
-			module: `
-				package test
-				head_vars(a) = b { b := a }
-			`,
-			exp: `
-				package test
-				head_vars(__local0__) = __local1__ { __local1__ = __local0__ }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-				Var("__local1__"): Var("b"),
-			},
-		},
-		{
-			module: `
-				package test
-				head_key[a] { a := 1 }
-			`,
-			exp: `
-				package test
-				head_key[__local0__] { __local0__ = 1 }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-			},
-		},
-		{
-			module: `
-				package test
-				head_unsafe_var[a] { some a }
-			`,
-			exp: `
-				package test
-				head_unsafe_var[__local0__] { true }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-			},
+			note:  "vars and constants",
+			input: "p { x = 1; x == 1; y = [1,2,3]; y == [1,2,3] }",
+			exp:   `x = 1; x = 1; y = [1,2,3]; y = [1,2,3]`,
 		},
 		{
-			module: `
-				package test
-				p = {1,2,3}
-				x = 4
-				head_nested[p[x]] {
-					some x
-				}`,
-			exp: `
-					package test
-					p = {1,2,3}
-					x = 4
-					head_nested[data.test.p[__local0__]]
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-			},
+			note:  "refs",
+			input: "p { input.x == data.y }",
+			exp:   `input.x = data.y`,
 		},
 		{
-			module: `
-				package test
-				p = {1,2}
-				head_closure_nested[p[x]] {
-					y = [true | some x; x = 1]
-				}
-			`,
-			exp: `
-				package test
-				p = {1,2}
-				head_closure_nested[data.test.p[x]] {
-					y = [true | __local0__ = 1]
-				}
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-			},
+			note:  "comprehensions",
+			input: "p { [1|true] == [2|true] }",
+			exp:   `[1|true] = [2|true]`,
 		},
+		// TODO(tsandall): improve support for calls so that extra unification step is
+		// not required. This requires more changes to the compiler as the initial
+		// stages that rewrite term exprs needs to be updated to handle == differently
+		// and then other stages need to be reviewed to make sure they can deal with
+		// nested calls. Alternatively, the compiler could keep track of == exprs that
+		// have been converted into = and then the safety check would need to be updated.
 		{
-			module: `
-				package test
-				nested {
-					a := [1,2,3]
-					x := [true | a[i] > 1]
-				}
-			`,
-			exp: `
-				package test
-				nested = true { __local0__ = [1, 2, 3]; __local1__ = [true | gt(__local0__[i], 1)] }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-				Var("__local1__"): Var("x"),
-			},
+			note:  "calls",
+			input: "p { count([1,2]) == 2 }",
+			exp:   `count([1,2], __local0__); __local0__ = 2`,
 		},
 		{
-			module: `
-				package test
-				x = 2
-				shadow_globals[x] { x := 1 }
-			`,
-			exp: `
-				package test
-				x = 2 { true }
-				shadow_globals[__local0__] { __local0__ = 1 }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-			},
+			note:  "embedded",
+			input: "p { x = 1; y = [x == 0] }",
+			exp:   `x = 1; equal(x, 0, __local0__); y = [__local0__]`,
 		},
 		{
-			module: `
-				package test
-				shadow_rule[shadow_rule] { shadow_rule := 1 }
-			`,
-			exp: `
-				package test
-				shadow_rule[__local0__] { __local0__ = 1 }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("shadow_rule"),
-			},
+			note:  "embedded in call",
+			input: `p { x = 0; neq(true, x == 1) }`,
+			exp:   `x = 0; equal(x, 1, __local0__); neq(true, __local0__)`,
 		},
 		{
-			module: `
-				package test
-				shadow_roots_1 { data := 1; input := 2; input > data }
-			`,
-			exp: `
-				package test
-				shadow_roots_1 = true { __local0__ = 1; __local1__ = 2; gt(__local1__, __local0__) }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("data"),
-				Var("__local1__"): Var("input"),
-			},
+			note:  "comprehension in object key",
+			input: `p { {{1 | 0 == 0}: 2} }`,
+			exp:   `{{1 | 0 = 0}: 2}`,
 		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			c.Modules["test"] = MustParseModule("package test\n" + tc.input)
+			compileStages(c, c.rewriteEquals)
+			assertNotFailed(t, c)
+			exp := MustParseBody(tc.exp)
+			result := c.Modules["test"].Rules[0].Body
+			if result.Compare(exp) != 0 {
+				t.Fatalf("\nExp: %v\nGot: %v", exp, result)
+			}
+		})
+	}
+}
+
+func TestCompilerRewriteDynamicTerms(t *testing.T) {
+
+	fixture := `
+		package test
+		str = "hello"
+	`
+
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{`arr { [str] }`, `__local0__ = data.test.str; [__local0__]`},
+		{`arr2 { [[str]] }`, `__local0__ = data.test.str; [[__local0__]]`},
+		{`obj { {"x": str} }`, `__local0__ = data.test.str; {"x": __local0__}`},
+		{`obj2 { {"x": {"y": str}} }`, `__local0__ = data.test.str; {"x": {"y": __local0__}}`},
+		{`set { {str} }`, `__local0__ = data.test.str; {__local0__}`},
+		{`set2 { {{str}} }`, `__local0__ = data.test.str; {{__local0__}}`},
+		{`ref { str[str] }`, `__local0__ = data.test.str; data.test.str[__local0__]`},
+		{`ref2 { str[str[str]] }`, `__local0__ = data.test.str; __local1__ = data.test.str[__local0__]; data.test.str[__local1__]`},
+		{`arr_compr { [1 | [str]] }`, `[1 | __local0__ = data.test.str; [__local0__]]`},
+		{`arr_compr2 { [1 | [1 | [str]]] }`, `[1 | [1 | __local0__ = data.test.str; [__local0__]]]`},
+		{`set_compr { {1 | [str]} }`, `{1 | __local0__ = data.test.str; [__local0__]}`},
+		{`set_compr2 { {1 | {1 | [str]}} }`, `{1 | {1 | __local0__ = data.test.str; [__local0__]}}`},
+		{`obj_compr { {"a": "b" | [str]} }`, `{"a": "b" | __local0__ = data.test.str; [__local0__]}`},
+		{`obj_compr2 { {"a": "b" | {"a": "b" | [str]}} }`, `{"a": "b" | {"a": "b" | __local0__ = data.test.str; [__local0__]}}`},
+		{`equality { str = str }`, `data.test.str = data.test.str`},
+		{`equality2 { [str] = [str] }`, `__local0__ = data.test.str; __local1__ = data.test.str; [__local0__] = [__local1__]`},
+		{`call { startswith(str, "") }`, `__local0__ = data.test.str; startswith(__local0__, "")`},
+		{`call2 { count([str], n) }`, `__local0__ = data.test.str; count([__local0__], n)`},
+		{`eq_with { [str] = [1] with input as 1 }`, `__local0__ = data.test.str with input as 1; [__local0__] = [1] with input as 1`},
+		{`term_with { [[str]] with input as 1 }`, `__local0__ = data.test.str with input as 1; [[__local0__]] with input as 1`},
+		{`call_with { count(str) with input as 1 }`, `__local0__ = data.test.str with input as 1; count(__local0__) with input as 1`},
+		{`call_func { f(input, "foo") } f(x,y) { x[y] }`, `__local2__ = input; data.test.f(__local2__, "foo")`},
+		{`call_func2 { f(input.foo, "foo") } f(x,y) { x[y] }`, `__local2__ = input.foo; data.test.f(__local2__, "foo")`},
+		{`every_domain { every _ in str { true } }`, `__local1__ = data.test.str; every __local0__, _ in __local1__ { true }`},
+		{`every_domain_call { every _ in numbers.range(1, 10) { true } }`, `numbers.range(1, 10, __local1__); every __local0__, _ in __local1__ { true }`},
+		{`every_body { every _ in [] { [str] } }`,
+			`__local1__ = []; every __local0__, _ in __local1__ { __local2__ = data.test.str; [__local2__] }`},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.input, func(t *testing.T) {
+			c := NewCompiler()
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			module := fixture + tc.input
+			c.Modules["test"] = MustParseModuleWithOpts(module, opts)
+			compileStages(c, c.rewriteDynamicTerms)
+			assertNotFailed(t, c)
+			expected := MustParseBodyWithOpts(tc.expected, opts)
+			result := c.Modules["test"].Rules[1].Body
+			if result.Compare(expected) != 0 {
+				t.Fatalf("\nExp: %v\nGot: %v", expected, result)
+			}
+		})
+	}
+}
+
+func TestCompilerRewriteWithValue(t *testing.T) {
+	fixture := `package test
+
+	arr = ["hello", "goodbye"]
+
+	`
+
+	tests := []struct {
+		note         string
+		input        string
+		opts         func(*Compiler) *Compiler
+		expected     string
+		expectedRule *Rule
+		wantErr      error
+	}{
 		{
-			module: `
-				package test
-				shadow_roots_2 { input := {"a": 1}; input.a > 0  }
-			`,
-			exp: `
-				package test
-				shadow_roots_2 = true { __local0__ = {"a": 1}; gt(__local0__.a, 0) }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("input"),
-			},
+			note:     "nop",
+			input:    `p { true with input as 1 }`,
+			expected: `p { true with input as 1 }`,
 		},
 		{
-			module: `
-				package test
-				skip_with_target { a := 1; input := 2; data.p with input as a }
-			`,
-			exp: `
-				package test
-				skip_with_target = true { __local0__ = 1; __local1__ = 2; data.p with input as __local0__ }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-				Var("__local1__"): Var("input"),
-			},
+			note:     "refs",
+			input:    `p { true with input as arr }`,
+			expected: `p { __local0__ = data.test.arr; true with input as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-				shadow_comprehensions {
-					a := 1
-					[true | a := 2; b := 1]
-					b := 2
-				}
-			`,
-			exp: `
-				package test
-				shadow_comprehensions = true { __local0__ = 1; [true | __local1__ = 2; __local2__ = 1]; __local3__ = 2 }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-				Var("__local1__"): Var("a"),
-				Var("__local2__"): Var("b"),
-				Var("__local3__"): Var("b"),
-			},
+			note:     "array comprehension",
+			input:    `p { true with input as [true | true] }`,
+			expected: `p { __local0__ = [true | true]; true with input as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-					scoping {
-						[true | a := 1]
-						[true | a := 2]
-					}
-			`,
-			exp: `
-				package test
-				scoping = true { [true | __local0__ = 1]; [true | __local1__ = 2] }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-				Var("__local1__"): Var("a"),
-			},
+			note:     "set comprehension",
+			input:    `p { true with input as {true | true} }`,
+			expected: `p { __local0__ = {true | true}; true with input as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-				object_keys {
-					{k: v1, "k2": v2} := {"foo": 1, "k2": 2}
-				}
-			`,
-			exp: `
-				package test
-				object_keys = true { {"k2": __local0__, k: __local1__} = {"foo": 1, "k2": 2} }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("v2"),
-				Var("__local1__"): Var("v1"),
-			},
+			note:     "object comprehension",
+			input:    `p { true with input as {"k": true | true} }`,
+			expected: `p { __local0__ = {"k": true | true}; true with input as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-				head_array_comprehensions = [[x] | x := 1]
-					head_set_comprehensions = {[x] | x := 1}
-					head_object_comprehensions = {k: [x] | k := "foo"; x := 1}
-			`,
-			exp: `
-				package test
-				head_array_comprehensions = [[__local0__] | __local0__ = 1] { true }
-				head_set_comprehensions = {[__local1__] | __local1__ = 1} { true }
-				head_object_comprehensions = {__local2__: [__local3__] | __local2__ = "foo"; __local3__ = 1} { true }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-				Var("__local1__"): Var("x"),
-				Var("__local2__"): Var("k"),
-				Var("__local3__"): Var("x"),
-			},
+			note:     "comprehension nested",
+			input:    `p { true with input as [true | true with input as arr] }`,
+			expected: `p { __local0__ = [true | __local1__ = data.test.arr; true with input as __local1__]; true with input as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-				rewritten_object_key {
-					k := "foo"
-					{k: 1}
-				}
-			`,
-			exp: `
-				package test
-				rewritten_object_key = true { __local0__ = "foo"; {__local0__: 1} }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("k"),
-			},
+			note:     "multiple",
+			input:    `p { true with input.a as arr[0] with input.b as arr[1] }`,
+			expected: `p { __local0__ = data.test.arr[0]; __local1__ = data.test.arr[1]; true with input.a as __local0__ with input.b as __local1__ }`,
 		},
 		{
-			module: `
-				package test
-				rewritten_object_key_head[[{k: 1}]] {
-					k := "foo"
-				}
-			`,
-			exp: `
-				package test
-				rewritten_object_key_head[[{__local0__: 1}]] { __local0__ = "foo" }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("k"),
-			},
+			note:    "invalid target",
+			input:   `p { true with foo.q as 1 }`,
+			wantErr: fmt.Errorf("rego_type_error: with keyword target must reference existing input, data, or a function"),
 		},
-		{
-			module: `
-				package test
-				rewritten_object_key_head_value = [{k: 1}] {
-					k := "foo"
-				}
-			`,
-			exp: `
-				package test
-				rewritten_object_key_head_value = [{__local0__: 1}] { __local0__ = "foo" }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("k"),
-			},
+		{
+			note:     "built-in function: replaced by (unknown) var",
+			input:    `p { true with time.now_ns as foo }`,
+			expected: `p { true with time.now_ns as foo }`, // `foo` still a Var here
 		},
 		{
-			module: `
-				package test
-				skip_with_target_in_assignment {
-					input := 1
-					a := [true | true with input as 2; true with input as 3]
-				}
-			`,
-			exp: `
-				package test
-				skip_with_target_in_assignment = true { __local0__ = 1; __local1__ = [true | true with input as 2; true with input as 3] }
+			note: "built-in function: valid, arity 0",
+			input: `
+				p { true with time.now_ns as now }
+				now() = 1
 			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("input"),
-				Var("__local1__"): Var("a"),
-			},
+			expected: `p { true with time.now_ns as data.test.now }`,
 		},
 		{
-			module: `
-				package test
-				rewrite_value_in_assignment {
-					a := 1
-					b := 1 with input as [a]
-				}
+			note: "built-in function: valid func ref, arity 1",
+			input: `
+				p { true with http.send as mock_http_send }
+				mock_http_send(_) = { "body": "yay" }
 			`,
-			exp: `
-				package test
-				rewrite_value_in_assignment = true { __local0__ = 1; __local1__ = 1 with input as [__local0__] }
+			expected: `p { true with http.send as data.test.mock_http_send }`,
+		},
+		{
+			note: "built-in function: replaced by value",
+			input: `
+				p { true with http.send as { "body": "yay" } }
 			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("a"),
-				Var("__local1__"): Var("b"),
-			},
+			expected: `p { true with http.send as {"body": "yay"} }`,
 		},
 		{
-			module: `
-				package test
-				global = {}
-				ref_shadowed {
-					global := {"a": 1}
-					global.a > 0
+			note: "built-in function: replaced by var",
+			input: `
+				p {
+					resp := { "body": "yay" }
+					true with http.send as resp
 				}
 			`,
-			exp: `
-				package test
-				global = {} { true }
-				ref_shadowed = true { __local0__ = {"a": 1}; gt(__local0__.a, 0) }
-			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("global"),
-			},
+			expected: `p { __local0__ = {"body": "yay"}; true with http.send as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-				f(x) = y {
-					x == 1
-					y := 2
-				} else = y {
-					x == 3
-					y := 4
+			note: "non-built-in function: replaced by var",
+			input: `
+				p {
+					resp := true
+					f(true) with f as resp
 				}
+				f(false) { true }
 			`,
-			// Each "else" rule has a separate rule head and the vars in the
-			// args will be rewritten. Since we cannot currently redefine the
-			// args, we must parse the module and then manually update the args.
-			exp: func() *Module {
-				module := MustParseModule(`
-					package test
-
-					f(__local0__) = __local1__ { __local0__ == 1; __local1__ = 2 } else = __local3__ { __local2__ == 3; __local3__ = 4 }
-				`)
-				module.Rules[0].Else.Head.Args[0].Value = Var("__local2__")
-				return module
-			},
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-				Var("__local1__"): Var("y"),
-				Var("__local2__"): Var("x"),
-				Var("__local3__"): Var("y"),
-			},
+			expected: `p { __local0__ = true; data.test.f(true) with data.test.f as __local0__ }`,
 		},
 		{
-			module: `
-				package test
-				f({"x": [x]}) = y { x == 1; y := 2 }`,
-			exp: `
-				package test
-
-				f({"x": [__local0__]}) = __local1__ { __local0__ == 1; __local1__ = 2 }`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-				Var("__local1__"): Var("y"),
-			},
+			note: "built-in function: replaced by comprehension",
+			input: `
+				p { true with http.send as { x: true | x := ["a", "b"][_] } }
+			`,
+			expected: `p { __local2__ = {__local0__: true | __local1__ = ["a", "b"]; __local0__ = __local1__[_]}; true with http.send as __local2__ }`,
 		},
 		{
-			module: `
-				package test
-
-				f(x, [x]) = x { x == 1 }
-			`,
-			exp: `
-				package test
-
-				f(__local0__, [__local0__]) = __local0__ { __local0__ == 1 }
+			note: "built-in function: replaced by ref",
+			input: `
+				p { true with http.send as resp }
+				resp := { "body": "yay" }
 			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-			},
+			expected: `p { true with http.send as data.test.resp }`,
 		},
 		{
-			module: `
-				package test
-
-				f(x) = {x[0]: 1} { true }
-			`,
-			exp: `
-				package test
-
-				f(__local0__) = {__local0__[0]: 1} { true }
+			note: "built-in function: replaced by another built-in (ref)",
+			input: `
+				p { true with http.send as object.union_n }
 			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("x"),
-			},
+			expected: `p { true with http.send as object.union_n }`,
 		},
 		{
-			module: `
-				package test
-
-				f({{t | t := 0}: 1}) {
-					true
-				}
-			`,
-			exp: `
-				package test
-
-				f({{__local0__ | __local0__ = 0}: 1}) { true }
+			note: "built-in function: replaced by another built-in (simple)",
+			input: `
+				p { true with http.send as count }
 			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("t"),
-			},
+			expectedRule: func() *Rule {
+				r := MustParseRule(`p { true with http.send as count }`)
+				r.Body[0].With[0].Value.Value = Ref([]*Term{VarTerm("count")})
+				return r
+			}(),
 		},
 		{
-			module: `
-				package test
-
-				f({{t | t := 0}}) {
-					true
-				}
+			note: "built-in function: replaced by another built-in that's marked unsafe",
+			input: `
+				q := is_object({"url": "https://httpbin.org", "method": "GET"})
+				p { q with is_object as http.send }
 			`,
-			exp: `
-				package test
-
-				f({{__local0__ | __local0__ = 0}}) { true }
+			opts:    func(c *Compiler) *Compiler { return c.WithUnsafeBuiltins(map[string]struct{}{"http.send": {}}) },
+			wantErr: fmt.Errorf("rego_compile_error: with keyword replacing built-in function: target must not be unsafe: \"http.send\""),
+		},
+		{
+			note: "non-built-in function: replaced by another built-in that's marked unsafe",
+			input: `
+			r(_) = {}
+			q := r({"url": "https://httpbin.org", "method": "GET"})
+			p {
+				q with r as http.send
+			}`,
+			opts:    func(c *Compiler) *Compiler { return c.WithUnsafeBuiltins(map[string]struct{}{"http.send": {}}) },
+			wantErr: fmt.Errorf("rego_compile_error: with keyword replacing built-in function: target must not be unsafe: \"http.send\""),
+		},
+		{
+			note: "built-in function: valid, arity 1, non-compound name",
+			input: `
+				p { concat("/", input) with concat as mock_concat }
+				mock_concat(_, _) = "foo/bar"
 			`,
-			expRewrittenMap: map[Var]Var{
-				Var("__local0__"): Var("t"),
-			},
+			expectedRule: func() *Rule {
+				r := MustParseRule(`p { concat("/", input) with concat as data.test.mock_concat }`)
+				r.Body[0].With[0].Target.Value = Ref([]*Term{VarTerm("concat")})
+				return r
+			}(),
 		},
 	}
 
-	for i, tc := range tests {
-		t.Run(fmt.Sprint(i), func(t *testing.T) {
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
 			c := NewCompiler()
-			c.Modules = map[string]*Module{
-				"test.rego": MustParseModule(tc.module),
-			}
-			compileStages(c, c.rewriteLocalVars)
-			assertNotFailed(t, c)
-			result := c.Modules["test.rego"]
-			var exp *Module
-			switch e := tc.exp.(type) {
-			case string:
-				exp = MustParseModule(e)
-			case func() *Module:
-				exp = e()
-			default:
-				panic("expected value must be string or func() *Module")
-			}
-			if result.Compare(exp) != 0 {
-				t.Fatalf("\nExpected:\n\n%v\n\nGot:\n\n%v", exp, result)
+			if tc.opts != nil {
+				c = tc.opts(c)
 			}
-			if !reflect.DeepEqual(c.RewrittenVars, tc.expRewrittenMap) {
-				t.Fatalf("\nExpected Rewritten Vars:\n\n\t%+v\n\nGot:\n\n\t%+v\n\n", tc.expRewrittenMap, c.RewrittenVars)
+			module := fixture + tc.input
+			c.Modules["test"] = MustParseModule(module)
+			compileStages(c, c.rewriteWithModifiers)
+			if tc.wantErr == nil {
+				assertNotFailed(t, c)
+				expected := tc.expectedRule
+				if expected == nil {
+					expected = MustParseRule(tc.expected)
+				}
+				result := c.Modules["test"].Rules[1]
+				if result.Compare(expected) != 0 {
+					t.Fatalf("\nExp: %v\nGot: %v", expected, result)
+				}
+			} else {
+				assertCompilerErrorStrings(t, c, []string{tc.wantErr.Error()})
 			}
 		})
 	}
+}
 
-}
-func TestRewriteLocalVarDeclarationErrors(t *testing.T) {
-
-	c := NewCompiler()
-
-	c.Modules["test"] = MustParseModule(`package test
-
-	redeclaration {
-		r1 = 1
-		r1 := 2
-		r2 := 1
-		[b, r2] := [1, 2]
-		input.path == 1
-		input := "foo"
-		_ := [1 | nested := 1; nested := 2]
-	}
-
-	negation {
-		not a := 1
-	}
-
-	bad_assign {
-		null := x
-		true := x
-		4.5 := x
-		"foo" := x
-		[true | true] := []
-		{true | true} := set()
-		{"foo": true | true} := {}
-		x + 1 := 2
-		data.foo := 1
-		[z, 1] := [1, 2]
-	}
-
-	arg_redeclared(arg1) {
-		arg1 := 1
-	}
-
-	arg_nested_redeclared({{arg_nested| arg_nested := 1; arg_nested := 2}}) { true }
-	`)
-
-	compileStages(c, c.rewriteLocalVars)
-
-	expectedErrors := []string{
-		"var r1 referenced above",
-		"var r2 assigned above",
-		"var input referenced above",
-		"var nested assigned above",
-		"arg arg1 redeclared",
-		"var arg_nested assigned above",
-		"cannot assign vars inside negated expression",
-		"cannot assign to ref",
-		"cannot assign to arraycomprehension",
-		"cannot assign to setcomprehension",
-		"cannot assign to objectcomprehension",
-		"cannot assign to call",
-		"cannot assign to number",
-		"cannot assign to number",
-		"cannot assign to boolean",
-		"cannot assign to string",
-		"cannot assign to null",
-	}
-
-	sort.Strings(expectedErrors)
-
-	result := []string{}
-
-	for i := range c.Errors {
-		result = append(result, c.Errors[i].Message)
-	}
-
-	sort.Strings(result)
-
-	if len(expectedErrors) != len(result) {
-		t.Fatalf("Expected %d errors but got %d:\n\n%v\n\nGot:\n\n%v", len(expectedErrors), len(result), strings.Join(expectedErrors, "\n"), strings.Join(result, "\n"))
-	}
-
-	for i := range result {
-		if result[i] != expectedErrors[i] {
-			t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", strings.Join(expectedErrors, "\n"), strings.Join(result, "\n"))
-		}
-	}
-}
-
-func TestRewriteDeclaredVarsStage(t *testing.T) {
-
-	// Unlike the following test case, this only executes up to the
-	// RewriteLocalVars stage. This is done so that later stages like
-	// RewriteDynamics are not executed.
+func TestCompilerRewritePrintCallsErasure(t *testing.T) {
 
-	tests := []struct {
+	cases := []struct {
 		note   string
 		module string
 		exp    string
 	}{
 		{
-			note: "object ref key",
-			module: `
-				package test
+			note: "no-op",
+			module: `package test
+			p { true }`,
+			exp: `package test
+			p { true }`,
+		},
+		{
+			note: "replace empty body with true",
+			module: `package test
 
-				p {
-					a := {"a": "a"}
-					{a.a: a.a}
-				}
+			p { print(1) }
 			`,
-			exp: `
-				package test
+			exp: `package test
 
-				p {
-					__local0__ = {"a": "a"}
-					{__local0__.a: __local0__.a}
-				}
+			p { true } `,
+		},
+		{
+			note: "rule body",
+			module: `package test
+
+			p { false; print(1) }
 			`,
+			exp: `package test
+
+			p { false } `,
 		},
 		{
-			note: "set ref element",
-			module: `
-				package test
+			note: "set comprehension body",
+			module: `package test
 
-				p {
-					a := {"a": "a"}
-					{a.a}
-				}
+			p { {1 | false; print(1)} }
 			`,
-			exp: `
-				package test
+			exp: `package test
 
-				p {
-					__local0__ = {"a": "a"}
-					{__local0__.a}
-				}
+			p { {1 | false} } `,
+		},
+		{
+			note: "array comprehension body",
+			module: `package test
+
+			p { [1 | false; print(1)] }
 			`,
+			exp: `package test
+
+			p { [1 | false] } `,
 		},
-	}
+		{
+			note: "object comprehension body",
+			module: `package test
 
-	for _, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
+			p { {"x": 1 | false; print(1)} }
+			`,
+			exp: `package test
 
-			c := NewCompiler()
+			p { {"x": 1 | false} } `,
+		},
+		{
+			note: "every body",
+			module: `package test
 
-			c.Modules = map[string]*Module{
-				"test.rego": MustParseModule(tc.module),
-			}
+			p { every _ in [] { false; print(1) } }
+			`,
+			exp: `package test
 
-			compileStages(c, c.rewriteLocalVars)
+			p = true { __local1__ = []; every __local0__, _ in __local1__ { false } }`,
+		},
+		{
+			note: "in head",
+			module: `package test
 
-			exp := MustParseModule(tc.exp)
-			result := c.Modules["test.rego"]
+			p = {1 | print("x")}`,
+			exp: `package test
 
-			if !exp.Equal(result) {
-				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, result)
+			p = __local0__ { true; __local0__ = {1 | true} }`,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler().WithEnablePrintStatements(false)
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			c.Compile(map[string]*Module{
+				"test.rego": MustParseModuleWithOpts(tc.module, opts),
+			})
+			if c.Failed() {
+				t.Fatal(c.Errors)
+			}
+			exp := MustParseModuleWithOpts(tc.exp, opts)
+			if !exp.Equal(c.Modules["test.rego"]) {
+				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, c.Modules["test.rego"])
 			}
 		})
 	}
 }
 
-func TestRewriteDeclaredVars(t *testing.T) {
-	tests := []struct {
-		note    string
-		module  string
-		exp     string
-		wantErr error
+func TestCompilerRewritePrintCallsErrors(t *testing.T) {
+	cases := []struct {
+		note   string
+		module string
+		exp    error
 	}{
 		{
-			note: "rewrite unify",
-			module: `
-				package test
-				x = 1
-				y = 2
-				p { some x; input = [x, y] }
-			`,
-			exp: `
-				package test
-				x = 1
-				y = 2
-				p { __local1__ = data.test.y; input = [__local0__, __local1__] }
-			`,
-		},
-		{
-			note: "rewrite call",
-			module: `
-				package test
-				x = []
-				y = {}
-				p { some x; walk(y, [x, y]) }
-			`,
-			exp: `
-				package test
-				x = []
-				y = {}
-				p { __local1__ = data.test.y; __local2__ = data.test.y; walk(__local1__, [__local0__, __local2__]) }
-			`,
+			note: "non-existent var",
+			module: `package test
+
+			p { print(x) }`,
+			exp: errors.New("var x is undeclared"),
 		},
 		{
-			note: "rewrite term",
-			module: `
-				package test
-				x = "a"
-				y = 1
-				q[[2, "b"]]
-				p { some x; q[[y,x]] }
-			`,
-			exp: `
-				package test
-				x = "a"
-				y = 1
-				q[[2, "b"]]
-				p { __local1__ = data.test.y; data.test.q[[__local1__, __local0__]] }
-			`,
+			note: "declared after print",
+			module: `package test
+
+			p { print(x); x = 7 }`,
+			exp: errors.New("var x is undeclared"),
 		},
 		{
-			note: "rewrite some x in xs",
-			module: `
-				package test
-				import future.keywords.in
-				xs = ["a", "b", "c"]
-				p { some x in xs; x == "a" }
-			`,
-			exp: `
-				package test
-				xs = ["a", "b", "c"]
-				p { __local2__ = data.test.xs[__local1__]; __local2__ = "a" }
+			note: "inside comprehension",
+			module: `package test
+			p { {1 | print(x)} }
 			`,
+			exp: errors.New("var x is undeclared"),
 		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler().WithEnablePrintStatements(true)
+			c.Compile(map[string]*Module{
+				"test.rego": MustParseModule(tc.module),
+			})
+			if !c.Failed() {
+				t.Fatal("expected error")
+			}
+			if c.Errors[0].Code != CompileErr || c.Errors[0].Message != tc.exp.Error() {
+				t.Fatal("unexpected error:", c.Errors)
+			}
+		})
+	}
+}
+
+func TestCompilerRewritePrintCalls(t *testing.T) {
+	cases := []struct {
+		note   string
+		module string
+		exp    string
+	}{
 		{
-			note: "rewrite some k, x in xs",
-			module: `
-				package test
-				import future.keywords.in
-				xs = ["a", "b", "c"]
-				p { some k, x in xs; x == "a"; k == 2 }
-			`,
-			exp: `
-				package test
-				xs = ["a", "b", "c"]
-				p { __local1__ = data.test.xs[__local0__]; __local1__ = "a"; __local0__ = 2 }
-			`,
+			note: "print one",
+			module: `package test
+
+			p { print(1) }`,
+			exp: `package test
+
+			p = true { __local1__ = {__local0__ | __local0__ = 1}; internal.print([__local1__]) }`,
 		},
 		{
-			note: "rewrite some k, x in xs[i]",
-			module: `
-				package test
-				import future.keywords.in
-				xs = [["a", "b", "c"], []]
-				p {
-					some i
-					some k, x in xs[i]
-					x == "a"
-					k == 2
-				}
-			`,
-			exp: `
-				package test
-				xs = [["a", "b", "c"], []]
-				p = true { __local2__ = data.test.xs[__local0__][__local1__]; __local2__ = "a"; __local1__ = 2 }
-			`,
+			note: "print multiple",
+			module: `package test
+
+			p { print(1, 2) }`,
+			exp: `package test
+
+			p = true { __local2__ = {__local0__ | __local0__ = 1}; __local3__ = {__local1__ | __local1__ = 2}; internal.print([__local2__, __local3__]) }`,
 		},
 		{
-			note: "rewrite some k, x in xs[i] with `i` as ref",
-			module: `
-				package test
-				import future.keywords.in
-				i = 0
-				xs = [["a", "b", "c"], []]
-				p {
-					some k, x in xs[i]
-					x == "a"
-					k == 2
-				}
-			`,
-			exp: `
-				package test
-				i = 0
-				xs = [["a", "b", "c"], []]
-				p = true { __local2__ = data.test.i; __local1__ = data.test.xs[__local2__][__local0__]; __local1__ = "a"; __local0__ = 2 }
-			`,
+			note: "print inside set comprehension",
+			module: `package test
+
+			p { x = 1; {2 | print(x)} }`,
+			exp: `package test
+
+			p = true { x = 1; {2 | __local1__ = {__local0__ | __local0__ = x}; internal.print([__local1__])} }`,
 		},
 		{
-			note: "rewrite closures",
-			module: `
-				package test
-				x = 1
-				y = 2
-				p {
-					some x, z
-					z = 3
-					[x | x = 2; y = 2; some z; z = 4]
-				}
-			`,
-			exp: `
-				package test
-				x = 1
-				y = 2
-				p {
-					__local1__ = 3
-					[__local0__ | __local0__ = 2; data.test.y = 2; __local2__ = 4]
-				}
-			`,
+			note: "print inside array comprehension",
+			module: `package test
+
+			p { x = 1; [2 | print(x)] }`,
+			exp: `package test
+
+			p = true { x = 1; [2 | __local1__ = {__local0__ | __local0__ = x}; internal.print([__local1__])] }`,
 		},
 		{
-			note: "rewrite head var",
-			module: `
-				package test
-				x = "a"
-				y = 1
-				z = 2
-				p[x] = [y, z] {
-					some x, z
-					x = "b"
-					z = 4
-				}`,
-			exp: `
-				package test
-				x = "a"
-				y = 1
-				z = 2
-				p[__local0__] = __local2__ {
-					__local0__ = "b"
-					__local1__ = 4;
-					__local3__ = data.test.y
-					__local2__ = [__local3__, __local1__]
-				}
-			`,
+			note: "print inside object comprehension",
+			module: `package test
+
+			p { x = 1; {"x": 2 | print(x)} }`,
+			exp: `package test
+
+			p = true { x = 1; {"x": 2 | __local1__ = {__local0__ | __local0__ = x}; internal.print([__local1__])} }`,
 		},
 		{
-			note: "rewrite call with root document ref as arg",
-			module: `
-				package test
+			note: "print inside every",
+			module: `package test
 
-				p {
-					f(input, "bar")
-				}
+			p { every x in [1,2] { print(x) } }`,
+			exp: `package test
 
-				f(x, y) {
-					x[y]
+			p = true {
+				__local3__ = [1, 2]
+				every __local0__, __local1__ in __local3__ {
+					__local4__ = {__local2__ | __local2__ = __local1__}
+					internal.print([__local4__])
 				}
-				`,
-			exp: `
-				package test
+			}`,
+		},
+		{
+			note: "print output of nested call",
+			module: `package test
 
-				p = true {
-					__local2__ = input;
-					data.test.f(__local2__, "bar")
-				}
+			p {
+				x := split("abc", "")[y]
+				print(x, y)
+			}`,
+			exp: `package test
 
-				 f(__local0__, __local1__) = true {
-					__local0__[__local1__]
-				}
-			`,
+			p = true { split("abc", "", __local3__); __local0__ = __local3__[y]; __local4__ = {__local1__ | __local1__ = __local0__}; __local5__ = {__local2__ | __local2__ = y}; internal.print([__local4__, __local5__]) }`,
 		},
 		{
-			note: "redeclare err",
-			module: `
-				package test
-				p {
-					some x
-					some x
-				}
-			`,
-			wantErr: errors.New("var x declared above"),
+			note: "print call in head",
+			module: `package test
+
+			p = {1 | print("x") }`,
+			exp: `package test
+
+			p = __local1__ {
+				true
+				__local1__ = {1 | __local2__ = { __local0__ | __local0__ = "x"}; internal.print([__local2__])}
+			}`,
 		},
 		{
-			note: "redeclare assigned err",
-			module: `
-				package test
-				p {
-					x := 1
-					some x
-				}
+			note: "print call in head - args treated as safe",
+			module: `package test
+
+			f(a) = {1 | a[x]; print(x)}`,
+			exp: `package test
+
+			f(__local0__) = __local2__ { true; __local2__ = {1 | __local0__[x]; __local3__ = {__local1__ | __local1__ = x}; internal.print([__local3__])} }
 			`,
-			wantErr: errors.New("var x assigned above"),
 		},
 		{
-			note: "redeclare reference err",
-			module: `
-				package test
-				p {
-					data.q[x]
-					some x
-				}
+			note: "print call of var in head key",
+			module: `package test
+			f(_) = [1, 2, 3]
+			p[x] { [_, x, _] := f(true); print(x) }`,
+			exp: `package test
+			f(__local0__) = [1, 2, 3] { true }
+			p[__local2__] { data.test.f(true, __local5__); [__local1__, __local2__, __local3__] = __local5__; __local6__ = {__local4__ | __local4__ = __local2__}; internal.print([__local6__]) }
 			`,
-			wantErr: errors.New("var x referenced above"),
 		},
 		{
-			note: "declare unused err",
-			module: `
-				package test
-				p {
-					some x
-				}
+			note: "print call of var in head value",
+			module: `package test
+			f(_) = [1, 2, 3]
+			p = x { [_, x, _] := f(true); print(x) }`,
+			exp: `package test
+			f(__local0__) = [1, 2, 3] { true }
+			p = __local2__ { data.test.f(true, __local5__); [__local1__, __local2__, __local3__] = __local5__; __local6__ = {__local4__ | __local4__ = __local2__}; internal.print([__local6__]) }
 			`,
-			wantErr: errors.New("declared var x unused"),
 		},
 		{
-			note: "declare unsafe err",
-			module: `
-				package test
-				p[x] {
-					some x
-					x == 1
-				}
+			note: "print call of vars in head key and value",
+			module: `package test
+			f(_) = [1, 2, 3]
+			p[x] = y { [_, x, y] := f(true); print(x) }`,
+			exp: `package test
+			f(__local0__) = [1, 2, 3] { true }
+			p[__local2__] = __local3__ { data.test.f(true, __local5__); [__local1__, __local2__, __local3__] = __local5__; __local6__ = {__local4__ | __local4__ = __local2__}; internal.print([__local6__]) }
 			`,
-			wantErr: errors.New("var x is unsafe"),
 		},
 		{
-			note: "declare arg err",
-			module: `
-			package test
-
-			f([a]) {
-				some a
-				a = 1
-			}
-			`,
-			wantErr: errors.New("arg a redeclared"),
+			note: "print call of vars altered with 'with' and call",
+			module: `package test
+			q = input
+			p {
+				x := q with input as json.unmarshal("{}")
+				print(x)
+			}`,
+			exp: `package test
+			q = __local3__ { true; __local3__ = input }
+			p = true {
+				json.unmarshal("{}", __local2__)
+				__local0__ = data.test.q with input as __local2__
+				__local4__ = {__local1__ | __local1__ = __local0__}
+				internal.print([__local4__])
+			}`,
 		},
 	}
 
-	for _, tc := range tests {
+	for _, tc := range cases {
 		t.Run(tc.note, func(t *testing.T) {
-			compiler, err := CompileModules(map[string]string{"test.rego": tc.module})
-			if tc.wantErr != nil {
-				if err == nil {
-					t.Fatal("Expected error but got success")
-				}
-				if !strings.Contains(err.Error(), tc.wantErr.Error()) {
-					t.Fatalf("Expected %v but got %v", tc.wantErr, err)
-				}
-			} else if err != nil {
-				t.Fatal(err)
-			} else {
-				exp := MustParseModule(tc.exp)
-				result := compiler.Modules["test.rego"]
-				if exp.Compare(result) != 0 {
-					t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, result)
-				}
+			c := NewCompiler().WithEnablePrintStatements(true)
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			c.Compile(map[string]*Module{
+				"test.rego": MustParseModuleWithOpts(tc.module, opts),
+			})
+			if c.Failed() {
+				t.Fatal(c.Errors)
+			}
+			exp := MustParseModuleWithOpts(tc.exp, opts)
+			if !exp.Equal(c.Modules["test.rego"]) {
+				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, c.Modules["test.rego"])
 			}
 		})
 	}
 }
 
-func TestCompileInvalidEqAssignExpr(t *testing.T) {
-
-	c := NewCompiler()
-
-	c.Modules["error"] = MustParseModule(`package errors
-
-
-	p {
-		# Arity mismatches are caught in the checkUndefinedFuncs check,
-		# and invalid eq/assign calls are passed along until then.
-		assign()
-		assign(1)
-		eq()
-		eq(1)
-	}`)
-
-	var prev func()
-	checkUndefinedFuncs := reflect.ValueOf(c.checkUndefinedFuncs)
-
-	for _, stage := range c.stages {
-		if reflect.ValueOf(stage.f).Pointer() == checkUndefinedFuncs.Pointer() {
-			break
-		}
-		prev = stage.f
+func TestRewritePrintCallsWithElseImplicitArgs(t *testing.T) {
+
+	module := `package test
+
+	f(x, y) {
+		x = y
 	}
 
-	compileStages(c, prev)
-	assertNotFailed(t, c)
-}
+	else = false {
+		print(x, y)
+	}`
 
-func TestCompilerRewriteComprehensionTerm(t *testing.T) {
+	c := NewCompiler().WithEnablePrintStatements(true)
+	opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+	c.Compile(map[string]*Module{
+		"test.rego": MustParseModuleWithOpts(module, opts),
+	})
 
-	c := NewCompiler()
-	c.Modules["head"] = MustParseModule(`package head
-	arr = [[1], [2], [3]]
-	arr2 = [["a"], ["b"], ["c"]]
-	arr_comp = [[x[i]] | arr[j] = x]
-	set_comp = {[x[i]] | arr[j] = x}
-	obj_comp = {x[i]: x[i] | arr2[j] = x}
-	`)
+	if c.Failed() {
+		t.Fatal(c.Errors)
+	}
 
-	compileStages(c, c.rewriteComprehensionTerms)
-	assertNotFailed(t, c)
+	exp := MustParseModuleWithOpts(`package test
 
-	arrCompRule := c.Modules["head"].Rules[2]
-	exp1 := MustParseRule(`arr_comp = [__local0__ | data.head.arr[j] = x; __local0__ = [x[i]]] { true }`)
-	assertRulesEqual(t, arrCompRule, exp1)
+	f(__local0__, __local1__) = true { __local0__ = __local1__ }
+	else = false { __local4__ = {__local2__ | __local2__ = __local0__}; __local5__ = {__local3__ | __local3__ = __local1__}; internal.print([__local4__, __local5__]) }
+	`, opts)
 
-	setCompRule := c.Modules["head"].Rules[3]
-	exp2 := MustParseRule(`set_comp = {__local1__ | data.head.arr[j] = x; __local1__ = [x[i]]} { true }`)
-	assertRulesEqual(t, setCompRule, exp2)
+	// NOTE(tsandall): we have to patch the implicit args on the else rule
+	// because of how the parser copies the arg names across from the first
+	// rule.
+	exp.Rules[0].Else.Head.Args[0] = VarTerm("__local0__")
+	exp.Rules[0].Else.Head.Args[1] = VarTerm("__local1__")
 
-	objCompRule := c.Modules["head"].Rules[4]
-	exp3 := MustParseRule(`obj_comp = {__local2__: __local3__ | data.head.arr2[j] = x; __local2__ = x[i]; __local3__ = x[i]} { true }`)
-	assertRulesEqual(t, objCompRule, exp3)
+	if !exp.Equal(c.Modules["test.rego"]) {
+		t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, c.Modules["test.rego"])
+	}
 }
 
-func TestCompilerRewriteDoubleEq(t *testing.T) {
+func TestCompilerMockFunction(t *testing.T) {
 	tests := []struct {
-		note  string
-		input string
-		exp   string
+		note          string
+		module, extra string
+		err           string
 	}{
 		{
-			note:  "vars and constants",
-			input: "p { x = 1; x == 1; y = [1,2,3]; y == [1,2,3] }",
-			exp:   `x = 1; x = 1; y = [1,2,3]; y = [1,2,3]`,
+			note: "simple valid",
+			module: `package test
+				now() = 123
+				p { true with time.now_ns as now }
+			`,
 		},
 		{
-			note:  "refs",
-			input: "p { input.x == data.y }",
-			exp:   `input.x = data.y`,
+			note: "simple valid, simple name",
+			module: `package test
+				mock_concat(_, _) = "foo/bar"
+				p { concat("/", input) with concat as mock_concat }
+			`,
 		},
 		{
-			note:  "comprehensions",
-			input: "p { [1|true] == [2|true] }",
-			exp:   `[1|true] = [2|true]`,
+			note: "invalid ref: nonexistant",
+			module: `package test
+				p { true with time.now_ns as now }
+			`,
+			err: "rego_unsafe_var_error: var now is unsafe", // we're running all compiler stages here
 		},
-		// TODO(tsandall): improve support for calls so that extra unification step is
-		// not required. This requires more changes to the compiler as the initial
-		// stages that rewrite term exprs needs to be updated to handle == differently
-		// and then other stages need to be reviewed to make sure they can deal with
-		// nested calls. Alternatively, the compiler could keep track of == exprs that
-		// have been converted into = and then the safety check would need to be updated.
 		{
-			note:  "calls",
-			input: "p { count([1,2]) == 2 }",
-			exp:   `count([1,2], __local0__); __local0__ = 2`,
+			note: "valid ref: not a function, but arity = 0",
+			module: `package test
+				now = 1
+				p { true with time.now_ns as now }
+			`,
 		},
 		{
-			note:  "embedded",
-			input: "p { x = 1; y = [x == 0] }",
-			exp:   `x = 1; equal(x, 0, __local0__); y = [__local0__]`,
+			note: "ref: not a function, arity > 0",
+			module: `package test
+				http_send = { "body": "nope" }
+				p { true with http.send as http_send }
+			`,
 		},
 		{
-			note:  "embedded in call",
-			input: `p { x = 0; neq(true, x == 1) }`,
-			exp:   `x = 0; equal(x, 1, __local0__); neq(true, __local0__)`,
+			note: "invalid ref: arity mismatch",
+			module: `package test
+				http_send(_, _) = { "body": "nope" }
+				p { true with http.send as http_send }
+			`,
+			err: "rego_type_error: http.send: arity mismatch\n\thave: (any, any)\n\twant: (request: object[string: any])",
 		},
 		{
-			note:  "comprehension in object key",
-			input: `p { {{1 | 0 == 0}: 2} }`,
-			exp:   `{{1 | 0 = 0}: 2}`,
+			note: "invalid ref: arity mismatch (in call)",
+			module: `package test
+				http_send(_, _) = { "body": "nope" }
+				p { http.send({}) with http.send as http_send }
+			`,
+			err: "rego_type_error: http.send: arity mismatch\n\thave: (any, any)\n\twant: (request: object[string: any])",
+		},
+		{
+			note: "invalid ref: value another built-in with different type",
+			module: `package test
+				p { true with http.send as net.lookup_ip_addr }
+			`,
+			err: "rego_type_error: http.send: arity mismatch\n\thave: (string)\n\twant: (request: object[string: any])",
+		},
+		{
+			note: "ref: value another built-in with compatible type",
+			module: `package test
+				p { true with count as object.union_n }
+			`,
+		},
+		{
+			note: "valid: package import",
+			extra: `package mocks
+				http_send(_) = {}
+			`,
+			module: `package test
+				import data.mocks
+				p { true with http.send as mocks.http_send }
+			`,
+		},
+		{
+			note: "valid: function import",
+			extra: `package mocks
+				http_send(_) = {}
+			`,
+			module: `package test
+				import data.mocks.http_send
+				p { true with http.send as http_send }
+			`,
+		},
+		{
+			note: "invalid target: relation",
+			module: `package test
+				my_walk(_, _)
+				p { true with walk as my_walk }
+			`,
+			err: "rego_compile_error: with keyword replacing built-in function: target must not be a relation",
+		},
+		{
+			note: "invalid target: eq",
+			module: `package test
+				my_eq(_, _)
+				p { true with eq as my_eq }
+			`,
+			err: `rego_compile_error: with keyword replacing built-in function: replacement of "eq" invalid`,
+		},
+		{
+			note: "invalid target: rego.metadata.chain",
+			module: `package test
+				p { true with rego.metadata.chain as [] }
+			`,
+			err: `rego_compile_error: with keyword replacing built-in function: replacement of "rego.metadata.chain" invalid`,
+		},
+		{
+			note: "invalid target: rego.metadata.rule",
+			module: `package test
+				p { true with rego.metadata.rule as {} }
+			`,
+			err: `rego_compile_error: with keyword replacing built-in function: replacement of "rego.metadata.rule" invalid`,
+		},
+		{
+			note: "invalid target: internal.print",
+			module: `package test
+				my_print(_, _)
+				p { true with internal.print as my_print }
+			`,
+			err: `rego_compile_error: with keyword replacing built-in function: replacement of internal function "internal.print" invalid`,
+		},
+		{
+			note: "mocking custom built-in",
+			module: `package test
+				mock(_)
+				mock_mock(_)
+				p { bar(foo.bar("one")) with bar as mock with foo.bar as mock_mock }
+			`,
+		},
+		{
+			note: "non-built-in function replaced value",
+			module: `package test
+				original(_)
+				p { original(true) with original as 123 }
+			`,
+		},
+		{
+			note: "non-built-in function replaced by another, arity 0",
+			module: `package test
+				original() = 1
+				mock() = 2
+				p { original() with original as mock }
+			`,
+			err: "rego_type_error: undefined function data.test.original", // TODO(sr): file bug -- this doesn't depend on "with" used or not
+		},
+		{
+			note: "non-built-in function replaced by another, arity 1",
+			module: `package test
+				original(_)
+				mock(_)
+				p { original(true) with original as mock }
+			`,
+		},
+		{
+			note: "non-built-in function replaced by built-in",
+			module: `package test
+				original(_)
+				p { original([1]) with original as count }
+			`,
+		},
+		{
+			note: "non-built-in function replaced by another, arity mismatch",
+			module: `package test
+				original(_)
+				mock(_, _)
+				p { original([1]) with original as mock }
+			`,
+			err: "rego_type_error: data.test.original: arity mismatch\n\thave: (any, any)\n\twant: (any)",
+		},
+		{
+			note: "non-built-in function replaced by built-in, arity mismatch",
+			module: `package test
+				original(_)
+				p { original([1]) with original as concat }
+			`,
+			err: "rego_type_error: data.test.original: arity mismatch\n\thave: (string, any<array[string], set[string]>)\n\twant: (any)",
 		},
 	}
+
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler()
-			c.Modules["test"] = MustParseModule("package test\n" + tc.input)
-			compileStages(c, c.rewriteEquals)
-			assertNotFailed(t, c)
-			exp := MustParseBody(tc.exp)
-			result := c.Modules["test"].Rules[0].Body
-			if result.Compare(exp) != 0 {
-				t.Fatalf("\nExp: %v\nGot: %v", exp, result)
+			c := NewCompiler().WithBuiltins(map[string]*Builtin{
+				"bar": {
+					Name: "bar",
+					Decl: types.NewFunction([]types.Type{types.S}, types.A),
+				},
+				"foo.bar": {
+					Name: "foo.bar",
+					Decl: types.NewFunction([]types.Type{types.S}, types.A),
+				},
+			})
+			if tc.extra != "" {
+				c.Modules["extra"] = MustParseModule(tc.extra)
 			}
-		})
-	}
-}
-
-func TestCompilerRewriteDynamicTerms(t *testing.T) {
+			c.Modules["test"] = MustParseModule(tc.module)
 
-	fixture := `
-		package test
-		str = "hello"
-	`
-
-	tests := []struct {
-		input    string
-		expected string
-	}{
-		{`arr { [str] }`, `__local0__ = data.test.str; [__local0__]`},
-		{`arr2 { [[str]] }`, `__local0__ = data.test.str; [[__local0__]]`},
-		{`obj { {"x": str} }`, `__local0__ = data.test.str; {"x": __local0__}`},
-		{`obj2 { {"x": {"y": str}} }`, `__local0__ = data.test.str; {"x": {"y": __local0__}}`},
-		{`set { {str} }`, `__local0__ = data.test.str; {__local0__}`},
-		{`set2 { {{str}} }`, `__local0__ = data.test.str; {{__local0__}}`},
-		{`ref { str[str] }`, `__local0__ = data.test.str; data.test.str[__local0__]`},
-		{`ref2 { str[str[str]] }`, `__local0__ = data.test.str; __local1__ = data.test.str[__local0__]; data.test.str[__local1__]`},
-		{`arr_compr { [1 | [str]] }`, `[1 | __local0__ = data.test.str; [__local0__]]`},
-		{`arr_compr2 { [1 | [1 | [str]]] }`, `[1 | [1 | __local0__ = data.test.str; [__local0__]]]`},
-		{`set_compr { {1 | [str]} }`, `{1 | __local0__ = data.test.str; [__local0__]}`},
-		{`set_compr2 { {1 | {1 | [str]}} }`, `{1 | {1 | __local0__ = data.test.str; [__local0__]}}`},
-		{`obj_compr { {"a": "b" | [str]} }`, `{"a": "b" | __local0__ = data.test.str; [__local0__]}`},
-		{`obj_compr2 { {"a": "b" | {"a": "b" | [str]}} }`, `{"a": "b" | {"a": "b" | __local0__ = data.test.str; [__local0__]}}`},
-		{`equality { str = str }`, `data.test.str = data.test.str`},
-		{`equality2 { [str] = [str] }`, `__local0__ = data.test.str; __local1__ = data.test.str; [__local0__] = [__local1__]`},
-		{`call { startswith(str, "") }`, `__local0__ = data.test.str; startswith(__local0__, "")`},
-		{`call2 { count([str], n) }`, `__local0__ = data.test.str; count([__local0__], n)`},
-		{`eq_with { [str] = [1] with input as 1 }`, `__local0__ = data.test.str with input as 1; [__local0__] = [1] with input as 1`},
-		{`term_with { [[str]] with input as 1 }`, `__local0__ = data.test.str with input as 1; [[__local0__]] with input as 1`},
-		{`call_with { count(str) with input as 1 }`, `__local0__ = data.test.str with input as 1; count(__local0__) with input as 1`},
-		{`call_func { f(input, "foo") } f(x,y) { x[y] }`, `__local2__ = input; data.test.f(__local2__, "foo")`},
-		{`call_func2 { f(input.foo, "foo") } f(x,y) { x[y] }`, `__local2__ = input.foo; data.test.f(__local2__, "foo")`},
-	}
+			// NOTE(sr): We're running all compiler stages here, since the type checking of
+			// built-in function replacements happens at the type check stage.
+			c.Compile(c.Modules)
 
-	for _, tc := range tests {
-		t.Run(tc.input, func(t *testing.T) {
-			c := NewCompiler()
-			module := fixture + tc.input
-			c.Modules["test"] = MustParseModule(module)
-			compileStages(c, c.rewriteDynamicTerms)
-			assertNotFailed(t, c)
-			expected := MustParseBody(tc.expected)
-			result := c.Modules["test"].Rules[1].Body
-			if result.Compare(expected) != 0 {
-				t.Fatalf("\nExp: %v\nGot: %v", expected, result)
+			if tc.err != "" {
+				if !strings.Contains(c.Errors.Error(), tc.err) {
+					t.Errorf("expected error to contain %q, got %q", tc.err, c.Errors.Error())
+				}
+			} else if len(c.Errors) > 0 {
+				t.Errorf("expected no errors, got %v", c.Errors)
 			}
 		})
 	}
+
 }
 
-func TestCompilerRewriteWithValue(t *testing.T) {
-	fixture := `package test
+func TestCompilerMockVirtualDocumentPartially(t *testing.T) {
+	c := NewCompiler()
 
-	arr = ["hello", "goodbye"]
+	c.Modules["test"] = MustParseModule(`
+	package test
+	p = {"a": 1}
+	q = x { p = x with p.a as 2 }
+	`)
 
-	`
+	compileStages(c, c.rewriteWithModifiers)
+	assertCompilerErrorStrings(t, c, []string{"rego_compile_error: with keyword cannot partially replace virtual document(s)"})
+}
 
-	tests := []struct {
-		note     string
-		input    string
-		expected string
-		wantErr  error
-	}{
+func TestCompilerCheckUnusedAssignedVar(t *testing.T) {
+	type testCase struct {
+		note           string
+		module         string
+		expectedErrors Errors
+	}
+
+	cases := []testCase{
 		{
-			note:     "nop",
-			input:    `p { true with input as 1 }`,
-			expected: `p { true with input as 1 }`,
+			note: "global var",
+			module: `package test
+				x := 1
+			`,
+		},
+		{
+			note: "simple rule with wildcard",
+			module: `package test
+				p {
+					_ := 1
+				}
+			`,
+		},
+		{
+			note: "simple rule",
+			module: `package test
+				p {
+					x := 1
+					y := 2
+					z := x + 3
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+				&Error{Message: "assigned var z unused"},
+			},
+		},
+		{
+			note: "rule with return",
+			module: `package test
+				p = x {
+					x := 2
+					y := 3
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
+		},
+		{
+			note: "rule with function call",
+			module: `package test
+				p {
+					x := 2
+					y := f(x)
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note:     "refs",
-			input:    `p { true with input as arr }`,
-			expected: `p { __local0__ = data.test.arr; true with input as __local0__ }`,
+			note: "rule with nested array comprehension",
+			module: `package test
+				p {
+					x := 2
+					y := [z | z := 2 * x]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note:     "array comprehension",
-			input:    `p { true with input as [true | true] }`,
-			expected: `p { __local0__ = [true | true]; true with input as __local0__ }`,
+			note: "rule with nested array comprehension and shadowing",
+			module: `package test
+				p {
+					x := 2
+					y := [x | x := 2 * x]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note:     "set comprehension",
-			input:    `p { true with input as {true | true} }`,
-			expected: `p { __local0__ = {true | true}; true with input as __local0__ }`,
+			note: "rule with nested array comprehension and shadowing (unused shadowed var)",
+			module: `package test
+				p {
+					x := 2
+					y := [x | x := 2]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var x unused"},
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note:     "object comprehension",
-			input:    `p { true with input as {"k": true | true} }`,
-			expected: `p { __local0__ = {"k": true | true}; true with input as __local0__ }`,
+			note: "rule with nested array comprehension and shadowing (unused shadowing var)",
+			module: `package test
+				p {
+					x := 2
+					x > 1
+					[1 | x := 2]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var x unused"},
+			},
 		},
 		{
-			note:     "comprehension nested",
-			input:    `p { true with input as [true | true with input as arr] }`,
-			expected: `p { __local0__ = [true | __local1__ = data.test.arr; true with input as __local1__]; true with input as __local0__ }`,
+			note: "rule with nested array comprehension and some declaration",
+			module: `package test
+				p {
+					some i
+					_ := [z | z := [1, 2][i]]
+				}
+			`,
 		},
 		{
-			note:     "multiple",
-			input:    `p { true with input.a as arr[0] with input.b as arr[1] }`,
-			expected: `p { __local0__ = data.test.arr[0]; __local1__ = data.test.arr[1]; true with input.a as __local0__ with input.b as __local1__ }`,
+			note: "rule with nested set comprehension",
+			module: `package test
+				p {
+					x := 2
+					y := {z | z := 2 * x}
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note:    "invalid target",
-			input:   `p { true with foo.q as 1 }`,
-			wantErr: fmt.Errorf("rego_type_error: with keyword target must start with input or data"),
+			note: "rule with nested set comprehension and unused inner var",
+			module: `package test
+				p {
+					x := 2
+					y := {z | z := 2 * x; a := 2}
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var a unused"}, // y isn't reported, as we abort early on errors when moving through the stack
+			},
 		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler()
-			module := fixture + tc.input
-			c.Modules["test"] = MustParseModule(module)
-			compileStages(c, c.rewriteWithModifiers)
-			if tc.wantErr == nil {
-				assertNotFailed(t, c)
-				expected := MustParseRule(tc.expected)
-				result := c.Modules["test"].Rules[1]
-				if result.Compare(expected) != 0 {
-					t.Fatalf("\nExp: %v\nGot: %v", expected, result)
+		{
+			note: "rule with nested object comprehension",
+			module: `package test
+				p {
+					x := 2
+					y := {z: x | z := 2 * x}
 				}
-			} else {
-				assertCompilerErrorStrings(t, c, []string{tc.wantErr.Error()})
-			}
-		})
-	}
-}
-
-func TestCompilerRewritePrintCallsErasure(t *testing.T) {
-
-	cases := []struct {
-		note   string
-		module string
-		exp    string
-	}{
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
+		},
 		{
-			note: "no-op",
+			note: "rule with nested closure",
 			module: `package test
-			p { true }`,
-			exp: `package test
-			p { true }`,
+				p {
+					x := 1
+					a := 1
+					{ y | y := [ z | z:=[1,2,3][a]; z > 1 ][_] }
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var x unused"},
+			},
 		},
 		{
-			note: "replace empty body with true",
+			note: "rule with nested closure and unused inner var",
 			module: `package test
-
-			p { print(1) }
+				p {
+					x := 1
+					{ y | y := [ z | z:=[1,2,3][x]; z > 1; a := 2 ][_] }
+				}
 			`,
-			exp: `package test
-
-			p { true } `,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var a unused"},
+			},
 		},
 		{
-			note: "rule body",
+			note: "simple function",
 			module: `package test
-
-			p { false; print(1) }
+				f() {
+					x := 1
+					y := 2
+				}
 			`,
-			exp: `package test
-
-			p { false } `,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var x unused"},
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "set comprehension body",
+			note: "simple function with wildcard",
 			module: `package test
-
-			p { {1 | false; print(1)} }
+				f() {
+					x := 1
+					_ := 2
+				}
 			`,
-			exp: `package test
-
-			p { {1 | false} } `,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var x unused"},
+			},
 		},
 		{
-			note: "array comprehension body",
+			note: "function with return",
 			module: `package test
-
-			p { [1 | false; print(1)] }
+				f() = x {
+					x := 1
+					y := 2
+				}
 			`,
-			exp: `package test
-
-			p { [1 | false] } `,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "object comprehension body",
+			note: "array comprehension",
 			module: `package test
-
-			p { {"x": 1 | false; print(1)} }
+				comp = [ 1 |
+					x := [1, 2, 3]
+					y := 2
+					z := x[_]
+				]
 			`,
-			exp: `package test
-
-			p { {"x": 1 | false} } `,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+				&Error{Message: "assigned var z unused"},
+			},
 		},
 		{
-			note: "in head",
+			note: "array comprehension nested",
 			module: `package test
-
-			p = {1 | print("x")}`,
-			exp: `package test
-
-			p = __local0__ { true; __local0__ = {1 | true} }`,
+				comp := [ 1 |
+					x := 1
+					y := [a | a := x]
+				]
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler().WithEnablePrintStatements(false)
-			c.Compile(map[string]*Module{
-				"test.rego": MustParseModule(tc.module),
-			})
-			if c.Failed() {
-				t.Fatal(c.Errors)
-			}
-			exp := MustParseModule(tc.exp)
-			if !exp.Equal(c.Modules["test.rego"]) {
-				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, c.Modules["test.rego"])
-			}
-		})
-	}
-}
-
-func TestCompilerRewritePrintCallsErrors(t *testing.T) {
-	cases := []struct {
-		note   string
-		module string
-		exp    error
-	}{
 		{
-			note: "non-existent var",
+			note: "array comprehension with wildcard",
 			module: `package test
-
-			p { print(x) }`,
-			exp: errors.New("var x is undeclared"),
+				comp = [ 1 |
+					x := [1, 2, 3]
+					_ := 2
+					z := x[_]
+				]
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var z unused"},
+			},
 		},
 		{
-			note: "declared after print",
+			note: "array comprehension with return",
 			module: `package test
-
-			p { print(x); x = 7 }`,
-			exp: errors.New("var x is undeclared"),
+				comp = [ z |
+					x := [1, 2, 3]
+					y := 2
+					z := x[_]
+				]
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "inside comprehension",
+			note: "array comprehension with some",
 			module: `package test
-			p { {1 | print(x)} }
+				comp = [ i |
+					some i
+					y := 2
+				]
 			`,
-			exp: errors.New("var x is undeclared"),
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler().WithEnablePrintStatements(true)
-			c.Compile(map[string]*Module{
-				"test.rego": MustParseModule(tc.module),
-			})
-			if !c.Failed() {
-				t.Fatal("expected error")
-			}
-			if c.Errors[0].Code != CompileErr || c.Errors[0].Message != tc.exp.Error() {
-				t.Fatal("unexpected error:", c.Errors)
-			}
-		})
-	}
-}
-
-func TestCompilerRewritePrintCalls(t *testing.T) {
-	cases := []struct {
-		note   string
-		module string
-		exp    string
-	}{
 		{
-			note: "print one",
+			note: "set comprehension",
 			module: `package test
-
-			p { print(1) }`,
-			exp: `package test
-
-			p = true { __local1__ = {__local0__ | __local0__ = 1}; internal.print([__local1__]) }`,
+				comp = { 1 |
+					x := [1, 2, 3]
+					y := 2
+					z := x[_]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+				&Error{Message: "assigned var z unused"},
+			},
 		},
 		{
-			note: "print multiple",
+			note: "set comprehension nested",
 			module: `package test
-
-			p { print(1, 2) }`,
-			exp: `package test
-
-			p = true { __local2__ = {__local0__ | __local0__ = 1}; __local3__ = {__local1__ | __local1__ = 2}; internal.print([__local2__, __local3__]) }`,
+				comp := { 1 |
+					x := 1
+					y := [a | a := x]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "print inside set comprehension",
+			note: "set comprehension with wildcard",
 			module: `package test
-
-			p { x = 1; {2 | print(x)} }`,
-			exp: `package test
-
-			p = true { x = 1; {2 | __local1__ = {__local0__ | __local0__ = x}; internal.print([__local1__])} }`,
+				comp = { 1 |
+					x := [1, 2, 3]
+					_ := 2
+					z := x[_]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var z unused"},
+			},
 		},
 		{
-			note: "print inside array comprehension",
+			note: "set comprehension with return",
 			module: `package test
-
-			p { x = 1; [2 | print(x)] }`,
-			exp: `package test
-
-			p = true { x = 1; [2 | __local1__ = {__local0__ | __local0__ = x}; internal.print([__local1__])] }`,
+				comp = { z |
+					x := [1, 2, 3]
+					y := 2
+					z := x[_]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "print inside object comprehension",
+			note: "set comprehension with some",
 			module: `package test
-
-			p { x = 1; {"x": 2 | print(x)} }`,
-			exp: `package test
-
-			p = true { x = 1; {"x": 2 | __local1__ = {__local0__ | __local0__ = x}; internal.print([__local1__])} }`,
+				comp = { i |
+					some i
+					y := 2
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "print output of nested call",
+			note: "object comprehension",
 			module: `package test
-
-			p {
-				x := split("abc", "")[y]
-				print(x, y)
-			}`,
-			exp: `package test
-
-			p = true { split("abc", "", __local3__); __local0__ = __local3__[y]; __local4__ = {__local1__ | __local1__ = __local0__}; __local5__ = {__local2__ | __local2__ = y}; internal.print([__local4__, __local5__]) }`,
+				comp = { 1: 2 |
+					x := [1, 2, 3]
+					y := 2
+					z := x[_]
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+				&Error{Message: "assigned var z unused"},
+			},
 		},
 		{
-			note: "print call in head",
+			note: "object comprehension nested",
 			module: `package test
-
-			p = {1 | print("x") }`,
-			exp: `package test
-
-			p = __local1__ {
-				true
-				__local1__ = {1 | __local2__ = { __local0__ | __local0__ = "x"}; internal.print([__local2__])}
-			}`,
+				comp := { 1: 1 |
+					x := 1
+					y := {a: x | a := x}
+				}
+			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "print call in head - args treated as safe",
+			note: "object comprehension with wildcard",
 			module: `package test
-
-			f(a) = {1 | a[x]; print(x)}`,
-			exp: `package test
-
-			f(__local0__) = __local2__ { true; __local2__ = {1 | __local0__[x]; __local3__ = {__local1__ | __local1__ = x}; internal.print([__local3__])} }
+				comp = { 1: 2 |
+					x := [1, 2, 3]
+					_ := 2
+					z := x[_]
+				}
 			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var z unused"},
+			},
 		},
 		{
-			note: "print call of var in head key",
+			note: "object comprehension with return",
 			module: `package test
-			f(_) = [1, 2, 3]
-			p[x] { [_, x, _] := f(true); print(x) }`,
-			exp: `package test
-			f(__local0__) = [1, 2, 3] { true }
-			p[__local2__] { data.test.f(true, __local5__); [__local1__, __local2__, __local3__] = __local5__; __local6__ = {__local4__ | __local4__ = __local2__}; internal.print([__local6__]) }
+				comp = { z: x |
+					x := [1, 2, 3]
+					y := 2
+					z := x[_]
+				}
 			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "print call of var in head value",
+			note: "object comprehension with some",
 			module: `package test
-			f(_) = [1, 2, 3]
-			p = x { [_, x, _] := f(true); print(x) }`,
-			exp: `package test
-			f(__local0__) = [1, 2, 3] { true }
-			p = __local2__ { data.test.f(true, __local5__); [__local1__, __local2__, __local3__] = __local5__; __local6__ = {__local4__ | __local4__ = __local2__}; internal.print([__local6__]) }
+				comp = { i |
+					some i
+					y := 2
+				}
 			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 		{
-			note: "print call of vars in head key and value",
+			note: "every: unused assigned var in body",
 			module: `package test
-			f(_) = [1, 2, 3]
-			p[x] = y { [_, x, y] := f(true); print(x) }`,
-			exp: `package test
-			f(__local0__) = [1, 2, 3] { true }
-			p[__local2__] = __local3__ { data.test.f(true, __local5__); [__local1__, __local2__, __local3__] = __local5__; __local6__ = {__local4__ | __local4__ = __local2__}; internal.print([__local6__]) }
+				p { every i in [1] { y := 10; i == 1 } }
 			`,
+			expectedErrors: Errors{
+				&Error{Message: "assigned var y unused"},
+			},
 		},
 	}
 
-	for _, tc := range cases {
-		t.Run(tc.note, func(t *testing.T) {
-			c := NewCompiler().WithEnablePrintStatements(true)
-			c.Compile(map[string]*Module{
-				"test.rego": MustParseModule(tc.module),
-			})
-			if c.Failed() {
-				t.Fatal(c.Errors)
+	makeTestRunner := func(tc testCase, strict bool) func(t *testing.T) {
+		return func(t *testing.T) {
+			compiler := NewCompiler().WithStrict(strict)
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			compiler.Modules = map[string]*Module{
+				"test": MustParseModuleWithOpts(tc.module, opts),
 			}
-			exp := MustParseModule(tc.exp)
-			if !exp.Equal(c.Modules["test.rego"]) {
-				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, c.Modules["test.rego"])
+			compileStages(compiler, compiler.rewriteLocalVars)
+
+			if strict {
+				assertErrors(t, compiler.Errors, tc.expectedErrors, false)
+			} else {
+				assertNotFailed(t, compiler)
 			}
-		})
+		}
 	}
-}
-
-func TestCompilerMockFunction(t *testing.T) {
-	c := NewCompiler()
-	c.Modules["test"] = MustParseModule(`
-	package test
 
-	is_allowed(label) {
-	    label == "test_label"
+	for _, tc := range cases {
+		t.Run(tc.note+"_strict", makeTestRunner(tc, true))
+		t.Run(tc.note+"_non-strict", makeTestRunner(tc, false))
 	}
-
-	p {true with data.test.is_allowed as "blah" }
-	`)
-	compileStages(c, c.rewriteWithModifiers)
-	assertCompilerErrorStrings(t, c, []string{"rego_compile_error: with keyword cannot replace functions"})
-}
-
-func TestCompilerMockVirtualDocumentPartially(t *testing.T) {
-	c := NewCompiler()
-
-	c.Modules["test"] = MustParseModule(`
-	package test
-	p = {"a": 1}
-	q = x { p = x with p.a as 2 }
-	`)
-
-	compileStages(c, c.rewriteWithModifiers)
-	assertCompilerErrorStrings(t, c, []string{"rego_compile_error: with keyword cannot partially replace virtual document(s)"})
 }
 
 func TestCompilerSetGraph(t *testing.T) {
@@ -3517,39 +7343,53 @@ dataref = true { data }`,
 			x = "foo.bar"
 			foo(x, y)
 		}`),
+		"everyMod": MustParseModule(`package everymod
+		import future.keywords.every
+		everyp {
+			every x in [true, false] { x; everyp }
+		}
+		everyq[1] {
+			every x in everyq { x == 1 }
+		}`),
 	}
 
 	compileStages(c, c.checkRecursion)
 
-	makeRuleErrMsg := func(rule string, loop ...string) string {
-		return fmt.Sprintf("rego_recursion_error: rule %v is recursive: %v", rule, strings.Join(loop, " -> "))
+	makeRuleErrMsg := func(pkg, rule string, loop ...string) string {
+		l := make([]string, len(loop))
+		for i, lo := range loop {
+			l[i] = "data." + pkg + "." + lo
+		}
+		return fmt.Sprintf("rego_recursion_error: rule data.%s.%s is recursive: %v", pkg, rule, strings.Join(l, " -> "))
 	}
 
 	expected := []string{
-		makeRuleErrMsg("s", "s", "t", "s"),
-		makeRuleErrMsg("t", "t", "s", "t"),
-		makeRuleErrMsg("a", "a", "b", "c", "e", "a"),
-		makeRuleErrMsg("b", "b", "c", "e", "a", "b"),
-		makeRuleErrMsg("c", "c", "e", "a", "b", "c"),
-		makeRuleErrMsg("e", "e", "a", "b", "c", "e"),
-		makeRuleErrMsg("p", "p", "q", "p"),
-		makeRuleErrMsg("q", "q", "p", "q"),
-		makeRuleErrMsg("acq", "acq", "acp", "acq"),
-		makeRuleErrMsg("acp", "acp", "acq", "acp"),
-		makeRuleErrMsg("np", "np", "nq", "np"),
-		makeRuleErrMsg("nq", "nq", "np", "nq"),
-		makeRuleErrMsg("prefix", "prefix", "prefix"),
-		makeRuleErrMsg("dataref", "dataref", "dataref"),
-		makeRuleErrMsg("else_self", "else_self", "else_self"),
-		makeRuleErrMsg("elsetop", "elsetop", "elsemid", "elsebottom", "elsetop"),
-		makeRuleErrMsg("elsemid", "elsemid", "elsebottom", "elsetop", "elsemid"),
-		makeRuleErrMsg("elsebottom", "elsebottom", "elsetop", "elsemid", "elsebottom"),
-		makeRuleErrMsg("fn", "fn", "fn"),
-		makeRuleErrMsg("foo", "foo", "bar", "foo"),
-		makeRuleErrMsg("bar", "bar", "foo", "bar"),
-		makeRuleErrMsg("bar", "bar", "p", "foo", "bar"),
-		makeRuleErrMsg("foo", "foo", "bar", "p", "foo"),
-		makeRuleErrMsg("p", "p", "foo", "bar", "p"),
+		makeRuleErrMsg("rec", "s", "s", "t", "s"),
+		makeRuleErrMsg("rec", "t", "t", "s", "t"),
+		makeRuleErrMsg("rec", "a", "a", "b", "c", "e", "a"),
+		makeRuleErrMsg("rec", "b", "b", "c", "e", "a", "b"),
+		makeRuleErrMsg("rec", "c", "c", "e", "a", "b", "c"),
+		makeRuleErrMsg("rec", "e", "e", "a", "b", "c", "e"),
+		`rego_recursion_error: rule data.rec3.p[x] is recursive: data.rec3.p[x] -> data.rec4.q[x] -> data.rec3.p[x]`, // NOTE(sr): these two are hardcoded: they are
+		`rego_recursion_error: rule data.rec4.q[x] is recursive: data.rec4.q[x] -> data.rec3.p[x] -> data.rec4.q[x]`, // the only ones not fitting the pattern.
+		makeRuleErrMsg("rec5", "acq", "acq", "acp", "acq"),
+		makeRuleErrMsg("rec5", "acp", "acp", "acq", "acp"),
+		makeRuleErrMsg("rec6", "np[x]", "np[x]", "nq[x]", "np[x]"),
+		makeRuleErrMsg("rec6", "nq[x]", "nq[x]", "np[x]", "nq[x]"),
+		makeRuleErrMsg("rec7", "prefix", "prefix", "prefix"),
+		makeRuleErrMsg("rec8", "dataref", "dataref", "dataref"),
+		makeRuleErrMsg("rec9", "else_self", "else_self", "else_self"),
+		makeRuleErrMsg("rec9", "elsetop", "elsetop", "elsemid", "elsebottom", "elsetop"),
+		makeRuleErrMsg("rec9", "elsemid", "elsemid", "elsebottom", "elsetop", "elsemid"),
+		makeRuleErrMsg("rec9", "elsebottom", "elsebottom", "elsetop", "elsemid", "elsebottom"),
+		makeRuleErrMsg("f0", "fn", "fn", "fn"),
+		makeRuleErrMsg("f1", "foo", "foo", "bar", "foo"),
+		makeRuleErrMsg("f1", "bar", "bar", "foo", "bar"),
+		makeRuleErrMsg("f2", "bar", "bar", "p[x]", "foo", "bar"),
+		makeRuleErrMsg("f2", "foo", "foo", "bar", "p[x]", "foo"),
+		makeRuleErrMsg("f2", "p[x]", "p[x]", "foo", "bar", "p[x]"),
+		makeRuleErrMsg("everymod", "everyp", "everyp", "everyp"),
+		makeRuleErrMsg("everymod", "everyq", "everyq", "everyq"),
 	}
 
 	result := compilerErrsToStringSlice(c.Errors)
@@ -3571,28 +7411,38 @@ func TestCompilerCheckDynamicRecursion(t *testing.T) {
 	// references.  For more background info, see
 	// <https://github.com/open-policy-agent/opa/issues/1565>.
 
-	for note, mod := range map[string]*Module{
-		"recursion": MustParseModule(`
+	for _, tc := range []struct {
+		note, err string
+		mod       *Module
+	}{
+		{
+			note: "recursion",
+			mod: MustParseModule(`
 package recursion
 pkg = "recursion"
 foo[x] {
 	data[pkg]["foo"][x]
 }
 `),
-		"system.main": MustParseModule(`
+			err: "rego_recursion_error: rule data.recursion.foo is recursive: data.recursion.foo -> data.recursion.foo",
+		},
+		{note: "system.main",
+			mod: MustParseModule(`
 package system.main
 foo {
-  data[input]
+	data[input]
 }
 `),
+			err: "rego_recursion_error: rule data.system.main.foo is recursive: data.system.main.foo -> data.system.main.foo",
+		},
 	} {
-		t.Run(note, func(t *testing.T) {
+		t.Run(tc.note, func(t *testing.T) {
 			c := NewCompiler()
-			c.Modules = map[string]*Module{note: mod}
+			c.Modules = map[string]*Module{tc.note: tc.mod}
 			compileStages(c, c.checkRecursion)
 
 			result := compilerErrsToStringSlice(c.Errors)
-			expected := "rego_recursion_error: rule foo is recursive: foo -> foo"
+			expected := tc.err
 
 			if len(result) != 1 || result[0] != expected {
 				t.Errorf("Expected %v but got: %v", expected, result)
@@ -3868,6 +7718,7 @@ func TestCompilerGetRulesDynamic(t *testing.T) {
 		"mod1": `package a.b.c.d
 r1 = 1`,
 		"mod2": `package a.b.c.e
+default r2 = false
 r2 = 2`,
 		"mod3": `package a.b
 r3 = 3`,
@@ -3878,7 +7729,8 @@ r4 = 4`,
 	compileStages(compiler, nil)
 
 	rule1 := compiler.Modules["mod1"].Rules[0]
-	rule2 := compiler.Modules["mod2"].Rules[0]
+	rule2d := compiler.Modules["mod2"].Rules[0]
+	rule2 := compiler.Modules["mod2"].Rules[1]
 	rule3 := compiler.Modules["mod3"].Rules[0]
 	rule4 := compiler.Modules["hidden"].Rules[0]
 
@@ -3888,15 +7740,16 @@ r4 = 4`,
 		excludeHidden bool
 	}{
 		{input: "data.a.b.c.d.r1", expected: []*Rule{rule1}},
-		{input: "data.a.b[x]", expected: []*Rule{rule1, rule2, rule3}},
+		{input: "data.a.b[x]", expected: []*Rule{rule1, rule2d, rule2, rule3}},
 		{input: "data.a.b[x].d", expected: []*Rule{rule1, rule3}},
-		{input: "data.a.b.c", expected: []*Rule{rule1, rule2}},
+		{input: "data.a.b.c", expected: []*Rule{rule1, rule2d, rule2}},
 		{input: "data.a.b.d"},
-		{input: "data[x]", expected: []*Rule{rule1, rule2, rule3, rule4}},
-		{input: "data[data.complex_computation].b[y]", expected: []*Rule{rule1, rule2, rule3}},
-		{input: "data[x][y].c.e", expected: []*Rule{rule2}},
+		{input: "data", expected: []*Rule{rule1, rule2d, rule2, rule3, rule4}},
+		{input: "data[x]", expected: []*Rule{rule1, rule2d, rule2, rule3, rule4}},
+		{input: "data[data.complex_computation].b[y]", expected: []*Rule{rule1, rule2d, rule2, rule3}},
+		{input: "data[x][y].c.e", expected: []*Rule{rule2d, rule2}},
 		{input: "data[x][y].r3", expected: []*Rule{rule3}},
-		{input: "data[x][y]", expected: []*Rule{rule1, rule2, rule3}, excludeHidden: true}, // old behaviour of GetRulesDynamic
+		{input: "data[x][y]", expected: []*Rule{rule1, rule2d, rule2, rule3}, excludeHidden: true}, // old behaviour of GetRulesDynamic
 	}
 
 	for _, tc := range tests {
@@ -4128,7 +7981,7 @@ func TestCompilerWithStageAfterWithMetrics(t *testing.T) {
 	m := metrics.New()
 	c := NewCompiler().WithStageAfter(
 		"CheckRecursion",
-		CompilerStageDefinition{"MockStage", "mock_stage", mockStageFunctionCallNoErr},
+		CompilerStageDefinition{"MockStage", "mock_stage", func(*Compiler) *Error { return nil }},
 	)
 
 	c.WithMetrics(m)
@@ -4412,6 +8265,19 @@ func TestCompilerBuildComprehensionIndexKeySet(t *testing.T) {
 	}
 }
 
+func TestCompilerAllowMultipleAssignments(t *testing.T) {
+
+	_, err := CompileModules(map[string]string{"test.rego": `
+		package test
+
+		p := 7
+		p := 8
+	`})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestQueryCompiler(t *testing.T) {
 	tests := []struct {
 		note     string
@@ -4502,7 +8368,7 @@ func TestQueryCompiler(t *testing.T) {
 			q:        "x = 1 with foo.p as null",
 			pkg:      "",
 			imports:  nil,
-			expected: fmt.Errorf("1 error occurred: 1:12: rego_type_error: with keyword target must start with input or data"),
+			expected: fmt.Errorf("1 error occurred: 1:12: rego_type_error: with keyword target must reference existing input, data, or a function"),
 		},
 		{
 			note:     "rewrite with value",
@@ -4516,7 +8382,7 @@ func TestQueryCompiler(t *testing.T) {
 			q:        `startswith("x")`,
 			pkg:      "",
 			imports:  nil,
-			expected: fmt.Errorf("1 error occurred: 1:1: rego_type_error: startswith: arity mismatch\n\thave: (string)\n\twant: (string, string)"),
+			expected: fmt.Errorf("1 error occurred: 1:1: rego_type_error: startswith: arity mismatch\n\thave: (string)\n\twant: (search: string, base: string)"),
 		},
 		{
 			note:     "built-in function arity mismatch (arity 0)",
@@ -4530,7 +8396,7 @@ func TestQueryCompiler(t *testing.T) {
 			q:        "count(sum())",
 			pkg:      "",
 			imports:  nil,
-			expected: fmt.Errorf("1 error occurred: 1:7: rego_type_error: sum: arity mismatch\n\thave: (???)\n\twant: (any<array[number], set[number]>)"),
+			expected: fmt.Errorf("1 error occurred: 1:7: rego_type_error: sum: arity mismatch\n\thave: (???)\n\twant: (collection: any<array[number], set[number]>)"),
 		},
 		{
 			note:     "check types",
@@ -4662,7 +8528,7 @@ func TestQueryCompilerWithStageAfterWithMetrics(t *testing.T) {
 		QueryCompilerStageDefinition{
 			"MockStage",
 			"mock_stage",
-			func(qc QueryCompiler, b Body) (Body, error) {
+			func(_ QueryCompiler, b Body) (Body, error) {
 				return b, nil
 			},
 		})
@@ -4679,13 +8545,164 @@ func TestQueryCompilerWithStageAfterWithMetrics(t *testing.T) {
 }
 
 func TestQueryCompilerWithUnsafeBuiltins(t *testing.T) {
-	c := NewCompiler().WithUnsafeBuiltins(map[string]struct{}{
-		"count": {},
-	})
+	tests := []struct {
+		note     string
+		query    string
+		compiler *Compiler
+		opts     func(QueryCompiler) QueryCompiler
+		err      string
+	}{
+		{
+			note:     "builtin unsafe via compiler",
+			query:    "count([])",
+			compiler: NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"count": {}}),
+			err:      "unsafe built-in function calls in expression: count",
+		},
+		{
+			note:     "builtin unsafe via query compiler",
+			query:    "count([])",
+			compiler: NewCompiler(),
+			opts: func(qc QueryCompiler) QueryCompiler {
+				return qc.WithUnsafeBuiltins(map[string]struct{}{"count": {}})
+			},
+			err: "unsafe built-in function calls in expression: count",
+		},
+		{
+			note:     "builtin unsafe via compiler, 'with' mocking",
+			query:    "is_array([]) with is_array as count",
+			compiler: NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"count": {}}),
+			err:      `with keyword replacing built-in function: target must not be unsafe: "count"`,
+		},
+		{
+			note:     "builtin unsafe via query compiler,  'with' mocking",
+			query:    "is_array([]) with is_array as count",
+			compiler: NewCompiler(),
+			opts: func(qc QueryCompiler) QueryCompiler {
+				return qc.WithUnsafeBuiltins(map[string]struct{}{"count": {}})
+			},
+			err: `with keyword replacing built-in function: target must not be unsafe: "count"`,
+		},
+	}
 
-	_, err := c.QueryCompiler().WithUnsafeBuiltins(map[string]struct{}{}).Compile(MustParseBody("count([])"))
-	if err != nil {
-		t.Fatal(err)
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			qc := tc.compiler.QueryCompiler()
+			if tc.opts != nil {
+				qc = tc.opts(qc)
+			}
+			_, err := qc.Compile(MustParseBody(tc.query))
+			var errs Errors
+			if !errors.As(err, &errs) {
+				t.Fatalf("expected error type %T, got %v %[2]T", errs, err)
+			}
+			if exp, act := 1, len(errs); exp != act {
+				t.Fatalf("expected %d error(s), got %d", exp, act)
+			}
+			if exp, act := tc.err, errs[0].Message; exp != act {
+				t.Errorf("expected message %q, got %q", exp, act)
+			}
+		})
+	}
+}
+
+func TestQueryCompilerWithDeprecatedBuiltins(t *testing.T) {
+	cases := []strictnessQueryTestCase{
+		{
+			note:           "all() built-in",
+			query:          "all([true, false])",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:1: rego_type_error: deprecated built-in function calls in expression: all"),
+		},
+		{
+			note:           "any() built-in",
+			query:          "any([true, false])",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:1: rego_type_error: deprecated built-in function calls in expression: any"),
+		},
+	}
+
+	runStrictnessQueryTestCase(t, cases)
+}
+
+func TestQueryCompilerWithUnusedAssignedVar(t *testing.T) {
+	cases := []strictnessQueryTestCase{
+		{
+			note:           "array comprehension",
+			query:          "[1 | x := 2]",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:6: rego_compile_error: assigned var x unused"),
+		},
+		{
+			note:           "set comprehension",
+			query:          "{1 | x := 2}",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:6: rego_compile_error: assigned var x unused"),
+		},
+		{
+			note:           "object comprehension",
+			query:          "{1: 2 | x := 2}",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:9: rego_compile_error: assigned var x unused"),
+		},
+		{
+			note:           "every: unused var in body",
+			query:          "every _ in [] { x := 10 }",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:17: rego_compile_error: assigned var x unused"),
+		},
+	}
+
+	runStrictnessQueryTestCase(t, cases)
+}
+
+func TestQueryCompilerCheckKeywordOverrides(t *testing.T) {
+	cases := []strictnessQueryTestCase{
+		{
+			note:           "input assigned",
+			query:          "input := 1",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:1: rego_compile_error: variables must not shadow input (use a different variable name)"),
+		},
+		{
+			note:           "data assigned",
+			query:          "data := 1",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:1: rego_compile_error: variables must not shadow data (use a different variable name)"),
+		},
+		{
+			note:           "nested input assigned",
+			query:          "d := [input | input := 1]",
+			expectedErrors: fmt.Errorf("1 error occurred: 1:15: rego_compile_error: variables must not shadow input (use a different variable name)"),
+		},
+	}
+
+	runStrictnessQueryTestCase(t, cases)
+}
+
+type strictnessQueryTestCase struct {
+	note           string
+	query          string
+	expectedErrors error
+}
+
+func runStrictnessQueryTestCase(t *testing.T, cases []strictnessQueryTestCase) {
+	t.Helper()
+	makeTestRunner := func(tc strictnessQueryTestCase, strict bool) func(t *testing.T) {
+		return func(t *testing.T) {
+			c := NewCompiler().WithStrict(strict)
+			opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+			result, err := c.QueryCompiler().Compile(MustParseBodyWithOpts(tc.query, opts))
+
+			if strict {
+				if err == nil {
+					t.Fatalf("Expected error from %v but got: %v", tc.query, result)
+				}
+				if !strings.Contains(err.Error(), tc.expectedErrors.Error()) {
+					t.Fatalf("Expected error %v but got: %v", tc.expectedErrors, err)
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("Unexpected error from %v: %v", tc.query, err)
+				}
+			}
+		}
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note+"_strict", makeTestRunner(tc, true))
+		t.Run(tc.note+"_non-strict", makeTestRunner(tc, false))
 	}
 }
 
@@ -4709,14 +8726,6 @@ func assertNotFailed(t *testing.T, c *Compiler) {
 	}
 }
 
-func mockStageFunctionCall(c *Compiler) *Error {
-	return NewError(CompileErr, &Location{}, "mock stage error")
-}
-
-func mockStageFunctionCallNoErr(c *Compiler) *Error {
-	return nil
-}
-
 func getCompilerWithParsedModules(mods map[string]string) *Compiler {
 
 	parsed := map[string]*Module{}
@@ -4985,869 +8994,402 @@ func TestCompilerPassesTypeCheckNegative(t *testing.T) {
 	}
 }
 
-func TestWithSchema(t *testing.T) {
-	c := NewCompiler()
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, objectSchema)
-	c.WithSchemas(schemaSet)
-	if c.schemaSet == nil {
-		t.Fatalf("WithSchema did not set the schema correctly in the compiler")
-	}
-}
-
-func TestAnyOfObjectSchema1(t *testing.T) {
-	c := NewCompiler()
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, anyOfExtendCoreSchema)
-	c.WithSchemas(schemaSet)
-	if c.schemaSet == nil {
-		t.Fatalf("Did not correctly compile an object type schema with anyOf outside core schema")
-	}
-}
-
-func TestAnyOfObjectSchema2(t *testing.T) {
-	c := NewCompiler()
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, anyOfInsideCoreSchema)
-	c.WithSchemas(schemaSet)
-	if c.schemaSet == nil {
-		t.Fatalf("Did not correctly compile an object type schema with anyOf inside core schema")
-	}
-}
-
-func TestAnyOfArraySchema(t *testing.T) {
-	c := NewCompiler()
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, anyOfArraySchema)
-	c.WithSchemas(schemaSet)
-	if c.schemaSet == nil {
-		t.Fatalf("Did not correctly compile an array type schema with anyOf")
-	}
-}
-
-func TestAnyOfObjectMissing(t *testing.T) {
-	c := NewCompiler()
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, anyOfObjectMissing)
-	c.WithSchemas(schemaSet)
-	if c.schemaSet == nil {
-		t.Fatalf("Did not correctly compile an object type schema with anyOf where one of the props did not explicitly claim type")
-	}
-}
-
-func TestAnyOfArrayMissing(t *testing.T) {
-	c := NewCompiler()
-	schemaSet := NewSchemaSet()
-	schemaSet.Put(SchemaRootRef, anyOfArrayMissing)
-	c.WithSchemas(schemaSet)
-	if c.schemaSet == nil {
-		t.Fatalf("Did not correctly compile an array type schema with anyOf where items are inside anyOf")
-	}
-}
-
-const objectSchema = `{
-	"$schema": "http://json-schema.org/draft-07/schema",
-	"$id": "http://example.com/example.json",
-	"type": "object",
-	"title": "The root schema",
-	"description": "The root schema comprises the entire JSON document.",
-	"required": [
-		"foo",
-		"b"
-	],
-	"properties": {
-		"foo": {
-			"$id": "#/properties/foo",
-			"type": "string",
-			"title": "The foo schema",
-			"description": "An explanation about the purpose of this instance."
-		},
-		"b": {
-			"$id": "#/properties/b",
-			"type": "array",
-			"title": "The b schema",
-			"description": "An explanation about the purpose of this instance.",
-			"additionalItems": false,
-			"items": {
-				"$id": "#/properties/b/items",
-				"type": "object",
-				"title": "The items schema",
-				"description": "An explanation about the purpose of this instance.",
-				"required": [
-					"a",
-					"b",
-					"c"
-				],
-				"properties": {
-					"a": {
-						"$id": "#/properties/b/items/properties/a",
-						"type": "integer",
-						"title": "The a schema",
-						"description": "An explanation about the purpose of this instance."
-					},
-					"b": {
-						"$id": "#/properties/b/items/properties/b",
-						"type": "array",
-						"title": "The b schema",
-						"description": "An explanation about the purpose of this instance.",
-						"additionalItems": false,
-						"items": {
-							"$id": "#/properties/b/items/properties/b/items",
-							"type": "integer",
-							"title": "The items schema",
-							"description": "An explanation about the purpose of this instance."
-						}
-					},
-					"c": {
-						"$id": "#/properties/b/items/properties/c",
-						"type": "null",
-						"title": "The c schema",
-						"description": "An explanation about the purpose of this instance."
-					}
-				},
-				"additionalProperties": false
-			}
-		}
-	},
-	"additionalProperties": false
-}`
+func TestKeepModules(t *testing.T) {
 
-const arrayNoItemsSchema = `{
-	"$schema": "http://json-schema.org/draft-07/schema",
-	"$id": "http://example.com/example.json",
-	"type": "object",
-	"title": "The root schema",
-	"description": "The root schema comprises the entire JSON document.",
-	"required": [
-		"b"
-	],
-	"properties": {
-		"b": {
-			"$id": "#/properties/b",
-			"type": "array",
-			"title": "The b schema",
-			"description": "An explanation about the purpose of this instance.",
-			"additionalItems": true
-		}
-	},
-	"additionalProperties": false
-}`
+	t.Run("no keep", func(t *testing.T) {
+		c := NewCompiler() // no keep is default
 
-const noChildrenObjectSchema = `{
-	"$schema": "http://json-schema.org/draft-07/schema",
-	"$id": "http://example.com/example.json",
-	"type": "object",
-	"title": "The root schema",
-	"description": "The root schema comprises the entire JSON document.",
-	"additionalProperties": true
-}`
+		// This one is overwritten by c.Compile()
+		c.Modules["foo.rego"] = MustParseModule("package foo\np = true")
 
-const untypedFieldObjectSchema = `{
-	"$schema": "http://json-schema.org/draft-07/schema",
-	"$id": "http://example.com/example.json",
-	"type": "object",
-	"title": "The root schema",
-	"description": "The root schema comprises the entire JSON document.",
-	"required": [
-		"foo"
-	],
-	"properties": {
-		"foo": {
-			"$id": "#/properties/foo"
-		}
-	},
-	"additionalProperties": false
-}`
+		c.Compile(map[string]*Module{"bar.rego": MustParseModule("package bar\np = input")})
 
-const booleanSchema = `{
-	"$schema": "http://json-schema.org/draft-07/schema",
-	"$id": "http://example.com/example.json",
-	"type": "object",
-	"title": "The root schema",
-	"description": "The root schema comprises the entire JSON document.",
-	"required": [
-		"a"
-	],
-	"properties": {
-		"a": {
-			"$id": "#/properties/foo",
-			"type": "boolean",
-			"title": "The foo schema",
-			"description": "An explanation about the purpose of this instance."
+		if len(c.Errors) != 0 {
+			t.Fatalf("expected no error; got %v", c.Errors)
 		}
-	},
-	"additionalProperties": false
-}`
 
-const refSchema = `
-{
-    "description": "Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.",
-	"type": "object",
-	"properties": {
-      "apiVersion": {
-        "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
-        "type": [
-          "string",
-          "null"
-        ]
-	  },
-
-      "kind": {
-        "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
-        "type": [
-          "string",
-          "null"
-        ],
-        "enum": [
-          "Pod"
-        ]
-      },
-      "metadata": {
-        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
-        "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
-	  }
-	}
-}
-`
-const podSchema = `
-{
-    "description": "Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.",
-    "properties": {
-      "apiVersion": {
-        "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "kind": {
-        "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
-        "type": [
-          "string",
-          "null"
-        ],
-        "enum": [
-          "Pod"
-        ]
-      },
-      "metadata": {
-        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
-        "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
-      },
-      "spec": {
-        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec",
-        "description": "Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status"
-      },
-      "status": {
-        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodStatus",
-        "description": "Most recently observed status of the pod. This data may not be up to date. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status"
-      }
-    },
-    "type": "object",
-    "x-kubernetes-group-version-kind": [
-      {
-        "group": "",
-        "kind": "Pod",
-        "version": "v1"
-      }
-    ],
-    "$schema": "http://json-schema.org/schema#"
-  }`
-
-const anyOfArraySchema = `{
-	"type": "object",
-	"properties": {
-		"familyMembers": {
-			"type": "array",
-			"items": {
-				"anyOf": [
-					{
-						"type": "object",
-						"properties": {
-							"age": { "type": "integer" },
-							"name": {"type": "string"}
-						}
-					},{
-						"type": "object",
-						"properties": {
-							"personality": { "type": "string" },
-							"nickname": { "type": "string"  }
-						}
-					}
-				]
-			}
+		mods := c.ParsedModules()
+		if mods != nil {
+			t.Errorf("expected ParsedModules == nil, got %v", mods)
 		}
-	}
-}`
+	})
 
-const anyOfExtendCoreSchema = `{
-	"type": "object",
-	"properties": {
-		"AddressLine": { "type": "string" }
-	},
-	"anyOf": [
-		{
-			"type": "object",
-			"properties": {
-				"State":   { "type": "string" },
-				"ZipCode": { "type": "string" }
-			}
-		},
-		{
-			"type": "object",
-			"properties": {
-				"County":   { "type": "string" },
-				"PostCode": { "type": "integer" }
-			}
-		}
-	]
-}`
+	t.Run("keep", func(t *testing.T) {
 
-const allOfObjectSchema = `{
-    "$schema": "http://json-schema.org/draft-04/schema#",
-    "type": "object",
-    "title": "My schema",
-    "properties": {
-        "AddressLine1": { "type": "string" },
-        "AddressLine2": { "type": "string" },
-        "City":         { "type": "string" }
-    },
-    "allOf": [
-        {
-            "type": "object",
-            "properties": {
-                "State":   { "type": "string" },
-                "ZipCode": { "type": "string" }
-            },
-        },
-        {
-            "type": "object",
-            "properties": {
-                "County":   { "type": "string" },
-                "PostCode": { "type": "string" }
-            },
-        }
-    ]
-}`
+		c := NewCompiler().WithKeepModules(true)
+
+		// This one is overwritten by c.Compile()
+		c.Modules["foo.rego"] = MustParseModule("package foo\np = true")
 
-const allOfArraySchema = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "array",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"items": {
-		"type": "integer",
-		"title": "The items schema",
-		"description": "An explanation about the purpose of this instance."
-	},
-	"allOf": [
-		{
-		"type": "array",
-		"title": "The b schema",
-		"description": "An explanation about the purpose of this instance.",
-		"items": {
-			"type": "integer",
-			"title": "The items schema",
-			"description": "An explanation about the purpose of this instance."
+		c.Compile(map[string]*Module{"bar.rego": MustParseModule("package bar\np = input")})
+		if len(c.Errors) != 0 {
+			t.Fatalf("expected no error; got %v", c.Errors)
 		}
-		},
-		{
-		"type": "array",
-		"title": "The b schema",
-		"description": "An explanation about the purpose of this instance.",
-		"items": {
-			"type": "integer",
-			"title": "The items schema",
-			"description": "An explanation about the purpose of this instance."
+
+		mods := c.ParsedModules()
+		if exp, act := 1, len(mods); exp != act {
+			t.Errorf("expected %d modules, found %d: %v", exp, act, mods)
 		}
+		for k := range mods {
+			if k != "bar.rego" {
+				t.Errorf("unexpected key: %v, want 'bar.rego'", k)
+			}
 		}
-	]
-}`
 
-const allOfSchemaParentVariation = `{
-    "$schema": "http://json-schema.org/draft-04/schema#",
-    "allOf": [
-        {
-            "type": "object",
-            "properties": {
-                "State":   { "type": "string" },
-                "ZipCode": { "type": "string" }
-            },
-        },
-        {
-            "type": "object",
-            "properties": {
-                "County":   { "type": "string" },
-                "PostCode": { "type": "string" }
-            },
-        }
-    ]
-}`
+		for k := range mods {
+			compiled := c.Modules[k]
+			if compiled.Equal(mods[k]) {
+				t.Errorf("expected module %v to not be compiled: %v", k, mods[k])
+			}
+		}
 
-const emptySchema = `{
-	"allof" : []
- }`
-
-const allOfArrayOfArrays = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "array",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"items": {
-		"type": "array",
-		"title": "The items schema",
-		"description": "An explanation about the purpose of this instance.",
-		"items": {
-			"type": "integer",
-			"title": "The items schema",
-			"description": "An explanation about the purpose of this instance."
+		// expect ParsedModules to be reset
+		c.Compile(map[string]*Module{"baz.rego": MustParseModule("package baz\np = input")})
+		mods = c.ParsedModules()
+		if exp, act := 1, len(mods); exp != act {
+			t.Errorf("expected %d modules, found %d: %v", exp, act, mods)
 		}
-	},
-	"allOf": [{
-			"type": "array",
-			"title": "The b schema",
-			"description": "An explanation about the purpose of this instance.",
-			"items": {
-				"type": "array",
-				"title": "The items schema",
-				"description": "An explanation about the purpose of this instance.",
-				"items": {
-					"type": "integer",
-					"title": "The items schema",
-					"description": "An explanation about the purpose of this instance."
-				}
+		for k := range mods {
+			if k != "baz.rego" {
+				t.Errorf("unexpected key: %v, want 'baz.rego'", k)
 			}
-		},
-		{
-			"type": "array",
-			"title": "The b schema",
-			"description": "An explanation about the purpose of this instance.",
-			"items": {
-				"type": "integer",
-				"title": "The items schema",
-				"description": "An explanation about the purpose of this instance."
+		}
+
+		for k := range mods {
+			compiled := c.Modules[k]
+			if compiled.Equal(mods[k]) {
+				t.Errorf("expected module %v to not be compiled: %v", k, mods[k])
 			}
 		}
-	]
-}`
 
-const anyOfInsideCoreSchema = ` {
-	"type": "object",
-	"properties": {
-		"AddressLine": { "type": "string" },
-		"RandomInfo": {
-			"anyOf": [
-				{ "type": "object",
-				  "properties": {
-					  "accessMe": {"type": "string"}
-				  }
-				},
-				{ "type": "number", "minimum": 0 }
-			  ]
+		// expect ParsedModules to be reset to nil
+		c = c.WithKeepModules(false)
+		c.Compile(map[string]*Module{"baz.rego": MustParseModule("package baz\np = input")})
+		mods = c.ParsedModules()
+		if mods != nil {
+			t.Errorf("expected ParsedModules == nil, got %v", mods)
 		}
-	}
-}`
+	})
 
-const anyOfObjectMissing = `{
-	"type": "object",
-	"properties": {
-		"AddressLine": { "type": "string" }
-	},
-	"anyOf": [
-		{
-			"type": "object",
-			"properties": {
-				"State":   { "type": "string" },
-				"ZipCode": { "type": "string" }
-			}
-		},
-		{
-			"properties": {
-				"County":   { "type": "string" },
-				"PostCode": { "type": "integer" }
+	t.Run("no copies", func(t *testing.T) {
+		extra := MustParseModule("package extra\np = input")
+		done := false
+		testLoader := func(map[string]*Module) (map[string]*Module, error) {
+			if done {
+				return nil, nil
 			}
+			done = true
+			return map[string]*Module{"extra.rego": extra}, nil
 		}
-	]
-}`
 
-const allOfArrayOfObjects = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "array",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"items": {
-		"type": "object",
-		"title": "The items schema",
-		"description": "An explanation about the purpose of this instance.",
-		"properties": {
-			"State": {
-				"type": "string"
-			},
-			"ZipCode": {
-				"type": "string"
-			}
-		},
-		"allOf": [{
-				"type": "object",
-				"title": "The b schema",
-				"description": "An explanation about the purpose of this instance.",
-				"properties": {
-					"County": {
-						"type": "string"
-					},
-					"PostCode": {
-						"type": "string"
-					}
-				}
-			},
-			{
-				"type": "object",
-				"title": "The b schema",
-				"description": "An explanation about the purpose of this instance.",
-				"properties": {
-					"Street": {
-						"type": "string"
-					},
-					"House": {
-						"type": "string"
-					}
-				}
-			}
-		]
-	}
-}`
+		c := NewCompiler().WithModuleLoader(testLoader).WithKeepModules(true)
 
-const allOfObjectAndArray = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "object",
-	"title": "My schema",
-	"properties": {
-		"AddressLine1": {
-			"type": "string"
-		},
-		"AddressLine2": {
-			"type": "string"
-		},
-		"City": {
-			"type": "string"
+		mod := MustParseModule("package bar\np = input")
+		c.Compile(map[string]*Module{"bar.rego": mod})
+		if len(c.Errors) != 0 {
+			t.Fatalf("expected no error; got %v", c.Errors)
 		}
-	},
-	"allOf": [{
-			"type": "object",
-			"properties": {
-				"State": {
-					"type": "string"
-				},
-				"ZipCode": {
-					"type": "string"
-				}
-			}
-		},
-		{
-			"type": "array",
-			"title": "The b schema",
-			"description": "An explanation about the purpose of this instance.",
-			"items": {
-				"type": "integer",
-				"title": "The items schema",
-				"description": "An explanation about the purpose of this instance."
-			}
+
+		mods := c.ParsedModules()
+		if exp, act := 2, len(mods); exp != act {
+			t.Errorf("expected %d modules, found %d: %v", exp, act, mods)
 		}
-	]
-}`
+		newName := Var("q")
+		mods["bar.rego"].Rules[0].Head.Name = newName
+		if exp, act := newName, mod.Rules[0].Head.Name; !exp.Equal(act) {
+			t.Errorf("expected modified rule name %v, found %v", exp, act)
+		}
+		mods["extra.rego"].Rules[0].Head.Name = newName
+		if exp, act := newName, extra.Rules[0].Head.Name; !exp.Equal(act) {
+			t.Errorf("expected modified rule name %v, found %v", exp, act)
+		}
+	})
 
-const allOfObjectMissing = `{
-	"type": "object",
-	"properties": {
-		"AddressLine": { "type": "string" }
-	},
-	"allOf": [
-		{
-			"type": "object",
-			"properties": {
-				"State":   { "type": "string" },
-				"ZipCode": { "type": "string" }
-			}
-		},
-		{
-			"properties": {
-				"County":   { "type": "string" },
-				"PostCode": { "type": "integer" }
+	t.Run("keep, with loader", func(t *testing.T) {
+		extra := MustParseModule("package extra\np = input")
+		done := false
+		testLoader := func(map[string]*Module) (map[string]*Module, error) {
+			if done {
+				return nil, nil
 			}
+			done = true
+			return map[string]*Module{"extra.rego": extra}, nil
 		}
-	]
-}`
 
-const allOfArrayDifTypes = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "array",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "array",
-			"items": [{
-					"type": "string"
-				},
-				{
-					"type": "integer"
-				}
-			]
-		},
-		{
-			"type": "array",
-			"items": [{
-					"type": "string"
-				},
-				{
-					"type": "integer"
-				}
-			]
+		c := NewCompiler().WithModuleLoader(testLoader).WithKeepModules(true)
+
+		// This one is overwritten by c.Compile()
+		c.Modules["foo.rego"] = MustParseModule("package foo\np = true")
+
+		c.Compile(map[string]*Module{"bar.rego": MustParseModule("package bar\np = input")})
+
+		if len(c.Errors) != 0 {
+			t.Fatalf("expected no error; got %v", c.Errors)
 		}
-	]
-}`
 
-const allOfArrayInsideObject = `{
-	"type": "object",
-	"properties": {
-		"familyMembers": {
-			"type": "array",
-			"items": {
-				"allOf": [{
-					"type": "object",
-					"properties": {
-						"age": {
-							"type": "integer"
-						},
-						"name": {
-							"type": "string"
-						}
-					}
-				}, {
-					"type": "object",
-					"properties": {
-						"personality": {
-							"type": "string"
-						},
-						"nickname": {
-							"type": "string"
-						}
-					}
-				}]
+		mods := c.ParsedModules()
+		if exp, act := 2, len(mods); exp != act {
+			t.Errorf("expected %d modules, found %d: %v", exp, act, mods)
+		}
+		for k := range mods {
+			if k != "bar.rego" && k != "extra.rego" {
+				t.Errorf("unexpected key: %v, want 'extra.rego' and 'bar.rego'", k)
 			}
 		}
-	}
-}`
 
-const anyOfArrayMissing = `{
-	"type": "array",
-	"anyOf": [
-		{
-			"items": [
-				{"type": "number"},
-				{"type": "string"}]
-            },
-		{	"items": [
-				{"type": "integer"}]
+		for k := range mods {
+			compiled := c.Modules[k]
+			if compiled.Equal(mods[k]) {
+				t.Errorf("expected module %v to not be compiled: %v", k, mods[k])
+			}
 		}
-	]
-}`
+	})
+}
 
-const allOfArrayMissing = `{
-	"type": "array",
-	"allOf": [{
-			"items": [{
-					"type": "integer"
-				},
-				{
-					"type": "integer"
-				}
-			]
-		},
-		{
-			"items": [{
-				"type": "integer"
-			}]
-		}
-	]
+// see https://github.com/open-policy-agent/opa/issues/5166
+func TestCompilerWithRecursiveSchema(t *testing.T) {
+
+	jsonSchema := `{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/open-policy-agent/opa/issues/5166",
+  "type": "object",
+  "properties": {
+    "Something": {
+      "$ref": "#/$defs/X"
+    }
+  },
+  "$defs": {
+    "X": {
+      "type": "object",
+      "properties": {
+		"Name": { "type": "string" },
+        "Y": {
+          "$ref": "#/$defs/Y"
+        }
+      }
+    },
+    "Y": {
+      "type": "object",
+      "properties": {
+        "X": {
+          "$ref": "#/$defs/X"
+        }
+      }
+    }
+  }
 }`
 
-const anyOfSchemaParentVariation = `{
-    "$schema": "http://json-schema.org/draft-04/schema#",
-    "anyOf": [
-        {
-            "type": "object",
-            "properties": {
-                "State":   { "type": "string" },
-                "ZipCode": { "type": "string" }
-            },
-        },
-        {
-            "type": "object",
-            "properties": {
-                "County":   { "type": "string" },
-                "PostCode": { "type": "string" }
-            },
-        }
-    ]
+	exampleModule := `# METADATA
+# schemas:
+# - input: schema.input
+package opa.recursion
+
+deny {
+	input.Something.Y.X.Name == "Something"
+}
+`
+
+	c := NewCompiler()
+	var schema interface{}
+	if err := json.Unmarshal([]byte(jsonSchema), &schema); err != nil {
+		t.Fatal(err)
 	}
-}`
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(MustParseRef("schema.input"), schema)
+	c.WithSchemas(schemaSet)
 
-const allOfInsideCoreSchema = `{
-	"type": "object",
-	"properties": {
-		"AddressLine": { "type": "string" },
-		"RandomInfo": {
-			"allOf": [
-				{ "type": "object",
-				  "properties": {
-					  "accessMe": {"type": "string"}
-				  }
-				},
-				{ "type": "object",
-					"properties": {
-						"accessYou": {"type": "string"}
-					}}
-			  ]
-		}
+	m := MustParseModuleWithOpts(exampleModule, ParserOptions{ProcessAnnotation: true})
+	c.Compile(map[string]*Module{"testMod": m})
+	if c.Failed() {
+		t.Errorf("Expected compilation to succeed, but got errors: %v", c.Errors)
 	}
-}`
+}
 
-const allOfArrayDifTypesWithError = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "array",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "array",
-			"items": [{
-					"type": "string"
-				},
-				{
-					"type": "integer"
-				}
-			]
-		},
-		{
-			"type": "array",
-			"items": [{
-					"type": "boolean"
-				},
-				{
-					"type": "integer"
-				}
-			]
-		}
-	]
+// see https://github.com/open-policy-agent/opa/issues/5166
+func TestCompilerWithRecursiveSchemaAndInvalidSource(t *testing.T) {
+
+	jsonSchema := `{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/open-policy-agent/opa/issues/5166",
+  "type": "object",
+  "properties": {
+    "Something": {
+      "$ref": "#/$defs/X"
+    }
+  },
+  "$defs": {
+    "X": {
+      "type": "object",
+      "properties": {
+		"Name": { "type": "string" },
+        "Y": {
+          "$ref": "#/$defs/Y"
+        }
+      }
+    },
+    "Y": {
+      "type": "object",
+      "properties": {
+        "X": {
+          "$ref": "#/$defs/X"
+        }
+      }
+    }
+  }
 }`
 
-const allOfStringSchema = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "string",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "string",
-		},
-		{
-			"type": "string",
-		}
-	]
-}`
+	exampleModule := `# METADATA
+# schemas:
+# - input: schema.input
+package opa.recursion
 
-const allOfIntegerSchema = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "integer",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "integer",
-		},
-		{
-			"type": "integer",
-		}
-	]
-}`
+deny {
+	input.Something.Y.X.ThisDoesNotExist == "Something"
+}
+`
 
-const allOfBooleanSchema = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "boolean",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "boolean",
-		},
-		{
-			"type": "boolean",
-		}
-	]
-}`
+	c := NewCompiler().
+		WithUseTypeCheckAnnotations(true)
+	var schema interface{}
+	if err := json.Unmarshal([]byte(jsonSchema), &schema); err != nil {
+		t.Fatal(err)
+	}
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(MustParseRef("schema.input"), schema)
+	c.WithSchemas(schemaSet)
 
-const allOfTypeErrorSchema = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "string",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "string",
-		},
-		{
-			"type": "integer",
-		}
-	]
-}`
+	m := MustParseModuleWithOpts(exampleModule, ParserOptions{ProcessAnnotation: true})
+	c.Compile(map[string]*Module{"testMod": m})
+	if !c.Failed() {
+		t.Errorf("Expected compilation to fail, but it succeeded")
+	} else if !strings.HasPrefix(c.Errors.Error(), "1 error occurred: 7:2: rego_type_error: undefined ref: input.Something.Y.X.ThisDoesNotExist") {
+		t.Errorf("unexpected error: %v", c.Errors.Error())
+	}
+}
 
-const allOfStringSchemaWithError = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "string",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "string",
-		},
-		{
-			"type": "string",
-		},
-		{
-			"type": "boolean",
+func modules(ms ...string) []*Module {
+	opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+	mods := make([]*Module, len(ms))
+	for i, m := range ms {
+		var err error
+		mods[i], err = ParseModuleWithOpts(fmt.Sprintf("mod%d.rego", i), m, opts)
+		if err != nil {
+			panic(err)
 		}
-	]
-}`
+	}
+	return mods
+}
 
-const allOfSchemaWithParentError = `{
-	"$schema": "http://json-schema.org/draft-04/schema#",
-	"type": "string",
-	"title": "The b schema",
-	"description": "An explanation about the purpose of this instance.",
-	"allOf": [{
-			"type": "integer",
-		},
-		{
-			"type": "integer",
-		}
-	]
+func TestCompilerWithRecursiveSchemaAvoidRace(t *testing.T) {
+
+	jsonSchema := `{
+  "type": "object",
+  "properties": {
+    "aws": {
+      "type": "object",
+      "$ref": "#/$defs/example.pkg.providers.aws.AWS"
+    }
+  },
+  "$defs": {
+    "example.pkg.providers.aws.AWS": {
+      "type": "object",
+      "properties": {
+        "iam": {
+          "type": "object",
+          "$ref": "#/$defs/example.pkg.providers.aws.iam.IAM"
+        },
+        "sqs": {
+          "type": "object",
+          "$ref": "#/$defs/example.pkg.providers.aws.sqs.SQS"
+        }
+      }
+    },
+    "example.pkg.providers.aws.iam.Document": {
+      "type": "object"
+    },
+    "example.pkg.providers.aws.iam.IAM": {
+      "type": "object",
+      "properties": {
+        "policies": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/$defs/example.pkg.providers.aws.iam.Policy"
+          }
+        }
+      }
+    },
+    "example.pkg.providers.aws.iam.Policy": {
+      "type": "object",
+      "properties": {
+        "builtin": {
+          "type": "object",
+          "properties": {
+            "value": {
+              "type": "boolean"
+            }
+          }
+        },
+        "document": {
+          "type": "object",
+          "$ref": "#/$defs/example.pkg.providers.aws.iam.Document"
+        }
+      }
+    },
+    "example.pkg.providers.aws.sqs.Queue": {
+      "type": "object",
+      "properties": {
+        "policies": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/$defs/example.pkg.providers.aws.iam.Policy"
+          }
+        }
+      }
+    },
+    "example.pkg.providers.aws.sqs.SQS": {
+      "type": "object",
+      "properties": {
+        "queues": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/$defs/example.pkg.providers.aws.sqs.Queue"
+          }
+        }
+      }
+    }
+  }
 }`
 
-const allOfSchemaWithUnevenArray = `{
-	"type": "array",
-	"allOf": [{
-			"items": [{
-					"type": "integer"
-				},
-				{
-					"type": "integer"
-				}
-			]
-		},
-		{
-			"items": [{
-				"type": "integer"
-			},
-			{
-				"type": "integer"
-			},
-			{
-				"type": "string"
-			}]
-		}
-	]
-}`
+	exampleModule := `# METADATA
+# schemas:
+#  - input: schema.input
+package race.condition
+
+deny {
+	queue := input.aws.sqs.queues[_]
+	policy := queue.policies[_]
+	doc := json.unmarshal(policy.document.value)
+	statement = doc.Statement[_]
+	action := statement.Action[_]
+	action == "*"
+}
+`
+
+	c := NewCompiler()
+	var schema interface{}
+	if err := json.Unmarshal([]byte(jsonSchema), &schema); err != nil {
+		t.Fatal(err)
+	}
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(MustParseRef("schema.input"), schema)
+	c.WithSchemas(schemaSet)
+
+	m := MustParseModuleWithOpts(exampleModule, ParserOptions{ProcessAnnotation: true})
+	c.Compile(map[string]*Module{"testMod": m})
+	if c.Failed() {
+		t.Fatal(c.Errors)
+	}
+}
diff --git a/ast/compilehelper.go b/ast/compilehelper.go
index ca75dfabae..dd48884f9d 100644
--- a/ast/compilehelper.go
+++ b/ast/compilehelper.go
@@ -13,6 +13,7 @@ func CompileModules(modules map[string]string) (*Compiler, error) {
 // CompileOpts defines a set of options for the compiler.
 type CompileOpts struct {
 	EnablePrintStatements bool
+	ParserOptions         ParserOptions
 }
 
 // CompileModulesWithOpt takes a set of Rego modules represented as strings and
@@ -24,7 +25,7 @@ func CompileModulesWithOpt(modules map[string]string, opts CompileOpts) (*Compil
 	for f, module := range modules {
 		var pm *Module
 		var err error
-		if pm, err = ParseModule(f, module); err != nil {
+		if pm, err = ParseModuleWithOpts(f, module, opts.ParserOptions); err != nil {
 			return nil, err
 		}
 		parsed[f] = pm
diff --git a/ast/conflicts.go b/ast/conflicts.go
index d1013ccedd..c2713ad576 100644
--- a/ast/conflicts.go
+++ b/ast/conflicts.go
@@ -27,7 +27,12 @@ func CheckPathConflicts(c *Compiler, exists func([]string) (bool, error)) Errors
 
 func checkDocumentConflicts(node *TreeNode, exists func([]string) (bool, error), path []string) Errors {
 
-	path = append(path, string(node.Key.(String)))
+	switch key := node.Key.(type) {
+	case String:
+		path = append(path, string(key))
+	default: // other key types cannot conflict with data
+		return nil
+	}
 
 	if len(node.Values) > 0 {
 		s := strings.Join(path, "/")
diff --git a/ast/doc.go b/ast/doc.go
index 363660cf98..62b04e301e 100644
--- a/ast/doc.go
+++ b/ast/doc.go
@@ -8,29 +8,29 @@
 //
 // Rego policies are typically defined in text files and then parsed and compiled by the policy engine at runtime. The parsing stage takes the text or string representation of the policy and converts it into an abstract syntax tree (AST) that consists of the types mentioned above. The AST is organized as follows:
 //
-//  Module
-//   |
-//   +--- Package (Reference)
-//   |
-//   +--- Imports
-//   |     |
-//   |     +--- Import (Term)
-//   |
-//   +--- Rules
-//         |
-//         +--- Rule
-//               |
-//               +--- Head
-//               |     |
-//               |     +--- Name (Variable)
-//               |     |
-//               |     +--- Key (Term)
-//               |     |
-//               |     +--- Value (Term)
-//               |
-//               +--- Body
-//                     |
-//                     +--- Expression (Term | Terms | Variable Declaration)
+//	Module
+//	 |
+//	 +--- Package (Reference)
+//	 |
+//	 +--- Imports
+//	 |     |
+//	 |     +--- Import (Term)
+//	 |
+//	 +--- Rules
+//	       |
+//	       +--- Rule
+//	             |
+//	             +--- Head
+//	             |     |
+//	             |     +--- Name (Variable)
+//	             |     |
+//	             |     +--- Key (Term)
+//	             |     |
+//	             |     +--- Value (Term)
+//	             |
+//	             +--- Body
+//	                   |
+//	                   +--- Expression (Term | Terms | Variable Declaration)
 //
 // At query time, the policy engine expects policies to have been compiled. The compilation stage takes one or more modules and compiles them into a format that the policy engine supports.
 package ast
diff --git a/ast/env.go b/ast/env.go
index 60006baafd..e3a4e44284 100644
--- a/ast/env.go
+++ b/ast/env.go
@@ -5,6 +5,8 @@
 package ast
 
 import (
+	"fmt"
+
 	"github.com/open-policy-agent/opa/types"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -59,6 +61,8 @@ func (env *TypeEnv) Get(x interface{}) types.Type {
 
 		return types.NewArray(static, dynamic)
 
+	case *lazyObj:
+		return env.Get(x.force())
 	case *object:
 		static := []*types.StaticProperty{}
 		var dynamic *types.DynamicProperty
@@ -195,9 +199,17 @@ func (env *TypeEnv) getRefRecExtent(node *typeTreeNode) types.Type {
 		child := v.(*typeTreeNode)
 
 		tpe := env.getRefRecExtent(child)
-		// TODO(tsandall): handle non-string keys?
-		if s, ok := key.(String); ok {
-			children = append(children, types.NewStaticProperty(string(s), tpe))
+
+		// NOTE(sr): Converting to Golang-native types here is an extension of what we did
+		// before -- only supporting strings. But since we cannot differentiate sets and arrays
+		// that way, we could reconsider.
+		switch key.(type) {
+		case String, Number, Boolean: // skip anything else
+			propKey, err := JSON(key)
+			if err != nil {
+				panic(fmt.Errorf("unreachable, ValueToInterface: %w", err))
+			}
+			children = append(children, types.NewStaticProperty(propKey, tpe))
 		}
 		return false
 	})
diff --git a/ast/errors.go b/ast/errors.go
index 11348b3d7a..066dfcdd68 100644
--- a/ast/errors.go
+++ b/ast/errors.go
@@ -121,12 +121,3 @@ func NewError(code string, loc *Location, f string, a ...interface{}) *Error {
 		Message:  fmt.Sprintf(f, a...),
 	}
 }
-
-var (
-	errPartialRuleAssignOperator = fmt.Errorf("partial rules must use = operator (not := operator)")
-	errFunctionAssignOperator    = fmt.Errorf("functions must use = operator (not := operator)")
-)
-
-func errTermAssignOperator(x interface{}) error {
-	return fmt.Errorf("cannot assign to %v", TypeName(x))
-}
diff --git a/ast/fuzz.go b/ast/fuzz.go
deleted file mode 100644
index 6ff7e35a8e..0000000000
--- a/ast/fuzz.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// +build gofuzz
-
-package ast
-
-func Fuzz(data []byte) int {
-
-	str := string(data)
-	_, _, err := ParseStatements("", str)
-
-	if err == nil {
-		CompileModules(map[string]string{"": str})
-		return 1
-	}
-
-	return 0
-}
diff --git a/ast/fuzz_test.go b/ast/fuzz_test.go
index acc0c6d2ba..c129b4ac36 100644
--- a/ast/fuzz_test.go
+++ b/ast/fuzz_test.go
@@ -5,16 +5,40 @@
 //go:build go1.18
 // +build go1.18
 
+// nolint
 package ast
 
-import "testing"
+import (
+	"testing"
 
-func FuzzParseStatementsAndCompileModules(f *testing.F) {
+	"github.com/open-policy-agent/opa/test/cases"
+)
+
+var testcases = cases.MustLoad("../test/cases/testdata").Sorted().Cases
+
+func FuzzCompileModules(f *testing.F) {
+	for _, tc := range testcases {
+		for _, mod := range tc.Modules {
+			f.Add(mod)
+		}
+	}
 	f.Fuzz(func(t *testing.T, input string) {
-		t.Parallel() // seed corpus tests can run in parallel
-		_, _, err := ParseStatements("", input)
-		if err != nil {
-			CompileModules(map[string]string{"": input})
+		t.Parallel()
+		CompileModules(map[string]string{"": input})
+	})
+}
+
+func FuzzCompileModulesWithPrintAndAllFutureKWs(f *testing.F) {
+	for _, tc := range testcases {
+		for _, mod := range tc.Modules {
+			f.Add(mod)
 		}
+	}
+	f.Fuzz(func(t *testing.T, input string) {
+		t.Parallel()
+		CompileModulesWithOpt(map[string]string{"": input}, CompileOpts{
+			EnablePrintStatements: true,
+			ParserOptions:         ParserOptions{AllFutureKeywords: true},
+		})
 	})
 }
diff --git a/ast/index.go b/ast/index.go
index bcbb5c1765..ed7a2be26b 100644
--- a/ast/index.go
+++ b/ast/index.go
@@ -32,15 +32,16 @@ type RuleIndex interface {
 
 // IndexResult contains the result of an index lookup.
 type IndexResult struct {
-	Kind      DocKind
-	Rules     []*Rule
-	Else      map[*Rule][]*Rule
-	Default   *Rule
-	EarlyExit bool
+	Kind           RuleKind
+	Rules          []*Rule
+	Else           map[*Rule][]*Rule
+	Default        *Rule
+	EarlyExit      bool
+	OnlyGroundRefs bool
 }
 
 // NewIndexResult returns a new IndexResult object.
-func NewIndexResult(kind DocKind) *IndexResult {
+func NewIndexResult(kind RuleKind) *IndexResult {
 	return &IndexResult{
 		Kind: kind,
 		Else: map[*Rule][]*Rule{},
@@ -53,18 +54,20 @@ func (ir *IndexResult) Empty() bool {
 }
 
 type baseDocEqIndex struct {
-	skipIndexing Set
-	isVirtual    func(Ref) bool
-	root         *trieNode
-	defaultRule  *Rule
-	kind         DocKind
+	skipIndexing   Set
+	isVirtual      func(Ref) bool
+	root           *trieNode
+	defaultRule    *Rule
+	kind           RuleKind
+	onlyGroundRefs bool
 }
 
 func newBaseDocEqIndex(isVirtual func(Ref) bool) *baseDocEqIndex {
 	return &baseDocEqIndex{
-		skipIndexing: NewSet(NewTerm(InternalPrint.Ref())),
-		isVirtual:    isVirtual,
-		root:         newTrieNodeImpl(),
+		skipIndexing:   NewSet(NewTerm(InternalPrint.Ref())),
+		isVirtual:      isVirtual,
+		root:           newTrieNodeImpl(),
+		onlyGroundRefs: true,
 	}
 }
 
@@ -73,7 +76,7 @@ func (i *baseDocEqIndex) Build(rules []*Rule) bool {
 		return false
 	}
 
-	i.kind = rules[0].Head.DocKind()
+	i.kind = rules[0].Head.RuleKind()
 	indices := newrefindices(i.isVirtual)
 
 	// build indices for each rule.
@@ -83,6 +86,9 @@ func (i *baseDocEqIndex) Build(rules []*Rule) bool {
 				i.defaultRule = rule
 				return false
 			}
+			if i.onlyGroundRefs {
+				i.onlyGroundRefs = rule.Head.Reference.IsGround()
+			}
 			var skip bool
 			for _, expr := range rule.Body {
 				if op := expr.OperatorTerm(); op != nil && i.skipIndexing.Contains(op) {
@@ -134,6 +140,7 @@ func (i *baseDocEqIndex) Lookup(resolver ValueResolver) (*IndexResult, error) {
 
 	result := NewIndexResult(i.kind)
 	result.Default = i.defaultRule
+	result.OnlyGroundRefs = i.onlyGroundRefs
 	result.Rules = make([]*Rule, 0, len(tr.ordering))
 
 	for _, pos := range tr.ordering {
@@ -166,6 +173,7 @@ func (i *baseDocEqIndex) AllRules(resolver ValueResolver) (*IndexResult, error)
 
 	result := NewIndexResult(i.kind)
 	result.Default = i.defaultRule
+	result.OnlyGroundRefs = i.onlyGroundRefs
 	result.Rules = make([]*Rule, 0, len(tr.ordering))
 
 	for _, pos := range tr.ordering {
@@ -246,15 +254,20 @@ func (i *refindices) Update(rule *Rule, expr *Expr) {
 
 	op := expr.Operator()
 
-	if op.Equal(Equality.Ref()) {
+	switch {
+	case op.Equal(Equality.Ref()):
 		i.updateEq(rule, expr)
-	} else if op.Equal(Equal.Ref()) && len(expr.Operands()) == 2 {
+
+	case op.Equal(Equal.Ref()) && len(expr.Operands()) == 2:
 		// NOTE(tsandall): if equal() is called with more than two arguments the
 		// output value is being captured in which case the indexer cannot
 		// exclude the rule if the equal() call would return false (because the
 		// false value must still be produced.)
 		i.updateEq(rule, expr)
-	} else if op.Equal(GlobMatch.Ref()) {
+
+	case op.Equal(GlobMatch.Ref()) && len(expr.Operands()) == 3:
+		// NOTE(sr): Same as with equal() above -- 4 operands means the output
+		// of `glob.match` is captured and the rule can thus not be excluded.
 		i.updateGlobMatch(rule, expr)
 	}
 }
@@ -430,7 +443,7 @@ type trieNode struct {
 	next      *trieNode
 	any       *trieNode
 	undefined *trieNode
-	scalars   map[Value]*trieNode
+	scalars   *util.HashMap
 	array     *trieNode
 	rules     []*ruleNode
 }
@@ -453,11 +466,14 @@ func (node *trieNode) String() string {
 	if node.array != nil {
 		flags = append(flags, fmt.Sprintf("array:%p", node.array))
 	}
-	if len(node.scalars) > 0 {
-		buf := make([]string, 0, len(node.scalars))
-		for k, v := range node.scalars {
-			buf = append(buf, fmt.Sprintf("scalar(%v):%p", k, v))
-		}
+	if node.scalars.Len() > 0 {
+		buf := make([]string, 0, node.scalars.Len())
+		node.scalars.Iter(func(k, v util.T) bool {
+			key := k.(Value)
+			val := v.(*trieNode)
+			buf = append(buf, fmt.Sprintf("scalar(%v):%p", key, val))
+			return false
+		})
 		sort.Strings(buf)
 		flags = append(flags, strings.Join(buf, " "))
 	}
@@ -493,7 +509,7 @@ type ruleNode struct {
 
 func newTrieNodeImpl() *trieNode {
 	return &trieNode{
-		scalars: map[Value]*trieNode{},
+		scalars: util.NewHashMap(valueEq, valueHash),
 	}
 }
 
@@ -508,9 +524,13 @@ func (node *trieNode) Do(walker trieWalker) {
 	if node.undefined != nil {
 		node.undefined.Do(next)
 	}
-	for _, child := range node.scalars {
+
+	node.scalars.Iter(func(_, v util.T) bool {
+		child := v.(*trieNode)
 		child.Do(next)
-	}
+		return false
+	})
+
 	if node.array != nil {
 		node.array.Do(next)
 	}
@@ -567,12 +587,12 @@ func (node *trieNode) insertValue(value Value) *trieNode {
 		}
 		return node.any
 	case Null, Boolean, Number, String:
-		child, ok := node.scalars[value]
+		child, ok := node.scalars.Get(value)
 		if !ok {
 			child = newTrieNodeImpl()
-			node.scalars[value] = child
+			node.scalars.Put(value, child)
 		}
-		return child
+		return child.(*trieNode)
 	case *Array:
 		if node.array == nil {
 			node.array = newTrieNodeImpl()
@@ -596,12 +616,12 @@ func (node *trieNode) insertArray(arr *Array) *trieNode {
 		}
 		return node.any.insertArray(arr.Slice(1, -1))
 	case Null, Boolean, Number, String:
-		child, ok := node.scalars[head]
+		child, ok := node.scalars.Get(head)
 		if !ok {
 			child = newTrieNodeImpl()
-			node.scalars[head] = child
+			node.scalars.Put(head, child)
 		}
-		return child.insertArray(arr.Slice(1, -1))
+		return child.(*trieNode).insertArray(arr.Slice(1, -1))
 	}
 
 	panic("illegal value")
@@ -662,11 +682,11 @@ func (node *trieNode) traverseValue(resolver ValueResolver, tr *trieTraversalRes
 		return node.array.traverseArray(resolver, tr, value)
 
 	case Null, Boolean, Number, String:
-		child, ok := node.scalars[value]
+		child, ok := node.scalars.Get(value)
 		if !ok {
 			return nil
 		}
-		return child.Traverse(resolver, tr)
+		return child.(*trieNode).Traverse(resolver, tr)
 	}
 
 	return nil
@@ -691,12 +711,11 @@ func (node *trieNode) traverseArray(resolver ValueResolver, tr *trieTraversalRes
 		}
 	}
 
-	child, ok := node.scalars[head]
+	child, ok := node.scalars.Get(head)
 	if !ok {
 		return nil
 	}
-
-	return child.traverseArray(resolver, tr, arr.Slice(1, -1))
+	return child.(*trieNode).traverseArray(resolver, tr, arr.Slice(1, -1))
 }
 
 func (node *trieNode) traverseUnknown(resolver ValueResolver, tr *trieTraversalResult) error {
@@ -721,13 +740,16 @@ func (node *trieNode) traverseUnknown(resolver ValueResolver, tr *trieTraversalR
 		return err
 	}
 
-	for _, child := range node.scalars {
-		if err := child.traverseUnknown(resolver, tr); err != nil {
-			return err
+	var iterErr error
+	node.scalars.Iter(func(_, v util.T) bool {
+		child := v.(*trieNode)
+		if iterErr = child.traverseUnknown(resolver, tr); iterErr != nil {
+			return true
 		}
-	}
+		return false
+	})
 
-	return nil
+	return iterErr
 }
 
 // If term `a` is one of the function's operands, we store a Ref: `args[0]`
diff --git a/ast/index_test.go b/ast/index_test.go
index 01e92283fa..5026c2c16f 100644
--- a/ast/index_test.go
+++ b/ast/index_test.go
@@ -41,6 +41,48 @@ func (r testResolver) Resolve(ref Ref) (Value, error) {
 }
 
 func TestBaseDocEqIndexing(t *testing.T) {
+	opts := ParserOptions{AllFutureKeywords: true, unreleasedKeywords: true}
+
+	expectOnlyGroundRefs := func(exp bool) func(*testing.T, *IndexResult) {
+		return func(t *testing.T, res *IndexResult) {
+			t.Helper()
+			if act := res.OnlyGroundRefs; exp != act {
+				t.Errorf("OnlyGroundRefs: expected %v, got %v", exp, act)
+			}
+		}
+	}
+
+	everyMod := MustParseModuleWithOpts(`package test
+	p { every _ in [] { input.a = 1 } }`, opts)
+
+	// NOTE(sr): This looks a bit silly; but it's what
+	//
+	//   every x in input.a { input.x == x }
+	//
+	// will get rewritten to -- so to assert that the domain of 'every' expressions
+	// get respected in the rule indexing, we'll need to provide this "pseudo-compiled"
+	// module source here.
+	everyModWithDomain := MustParseModuleWithOpts(`package test
+	p {
+		__local0__ = input.a
+		every x in __local0__ { input.x = x }
+	} {
+		input.b = 1
+	}`, opts)
+
+	refMod := MustParseModuleWithOpts(`package test
+
+	ref.single.value.ground = x if x := input.x
+
+	ref.single.value.key[k] = v if { k := input.k; v := input.v }
+
+	ref.multi.value.ground contains x if x := input.x
+
+	ref.multiple.single.value.ground = x if x := input.x
+	ref.multiple.single.value[y] = x if { x := input.x; y := index.y }
+
+	# ref.multi.value.key[k] contains v if { k := input.k; v := input.v } # not supported yet
+	`, opts)
 
 	module := MustParseModule(`
 	package test
@@ -52,6 +94,7 @@ func TestBaseDocEqIndexing(t *testing.T) {
 		input.x = 3
 		input.y = 4
 	}
+		
 
 	scalars {
 		input.x = 0
@@ -188,14 +231,16 @@ func TestBaseDocEqIndexing(t *testing.T) {
 	`)
 
 	tests := []struct {
-		note       string
-		module     *Module
-		ruleset    string
-		input      string
-		unknowns   []string
-		args       []Value
-		expectedRS interface{}
-		expectedDR *Rule
+		note        string
+		module      *Module
+		ruleset     string
+		ruleRef     Ref
+		input       string
+		unknowns    []string
+		args        []Value
+		expectedRS  interface{}
+		expectedDR  *Rule
+		checkResult func(*testing.T, *IndexResult)
 	}{
 		{
 			note:    "exact match",
@@ -204,6 +249,7 @@ func TestBaseDocEqIndexing(t *testing.T) {
 			expectedRS: []string{
 				`exact { input.x = 3; input.y = 4 }`,
 			},
+			checkResult: expectOnlyGroundRefs(true), // covering base case
 		},
 		{
 			note:    "undefined match",
@@ -461,6 +507,17 @@ func TestBaseDocEqIndexing(t *testing.T) {
 			input:      `{"x": [0]}`,
 			expectedRS: []string{},
 		},
+		{
+			note: "glob.match: do not index captured output",
+			module: MustParseModule(`package test
+				p { x = input.x; glob.match("/a/*/c", ["/"], x, false) }
+			`),
+			ruleset: "p",
+			input:   `{"x": "wrong"}`,
+			expectedRS: []string{
+				`p { x = input.x; glob.match("/a/*/c", ["/"], x, false) }`,
+			},
+		},
 		{
 			note: "functions: args match",
 			module: MustParseModule(`package test
@@ -600,6 +657,59 @@ func TestBaseDocEqIndexing(t *testing.T) {
 				`f(x) = y { equal(x, 1, z); y = z }`,
 			},
 		},
+		{
+			note:       "every: do not index body",
+			module:     everyMod,
+			ruleset:    "p",
+			input:      `{"a": 2}`,
+			expectedRS: RuleSet(everyMod.Rules),
+		},
+		{
+			note:       "every: index domain",
+			module:     everyModWithDomain,
+			ruleset:    "p",
+			input:      `{"a": [1]}`,
+			expectedRS: RuleSet([]*Rule{everyModWithDomain.Rules[0]}),
+		},
+		{
+			note:        "ref: single value, ground ref",
+			module:      refMod,
+			ruleRef:     MustParseRef("ref.single.value.ground"),
+			input:       `{"x": 1}`,
+			expectedRS:  RuleSet([]*Rule{refMod.Rules[0]}),
+			checkResult: expectOnlyGroundRefs(true),
+		},
+		{
+			note:        "ref: single value, ground ref and non-ground ref",
+			module:      refMod,
+			ruleRef:     MustParseRef("ref.multiple.single.value"),
+			input:       `{"x": 1, "y": "Y"}`,
+			expectedRS:  RuleSet([]*Rule{refMod.Rules[3], refMod.Rules[4]}),
+			checkResult: expectOnlyGroundRefs(false),
+		},
+		{
+			note:        "ref: single value, var in ref",
+			module:      refMod,
+			ruleRef:     MustParseRef("ref.single.value.key[k]"),
+			input:       `{"k": 1, "v": 2}`,
+			expectedRS:  RuleSet([]*Rule{refMod.Rules[1]}),
+			checkResult: expectOnlyGroundRefs(false),
+		},
+		{
+			note:        "ref: multi value, ground ref",
+			module:      refMod,
+			ruleRef:     MustParseRef("ref.multi.value.ground"),
+			input:       `{"x": 1}`,
+			expectedRS:  RuleSet([]*Rule{refMod.Rules[2]}),
+			checkResult: expectOnlyGroundRefs(true),
+		},
+		// {
+		// 	note:       "ref: multi value, var in ref",
+		// 	module:     refMod,
+		// 	ruleRef:    MustParseRef("ref.multi.value.key[k]"),
+		// 	input:      `{"k": 1, "v": 2}`,
+		// 	expectedRS: RuleSet([]*Rule{refMod.Rules[3]}),
+		// },
 	}
 
 	for _, tc := range tests {
@@ -610,10 +720,19 @@ func TestBaseDocEqIndexing(t *testing.T) {
 			}
 			rules := []*Rule{}
 			for _, rule := range module.Rules {
-				if rule.Head.Name == Var(tc.ruleset) {
-					rules = append(rules, rule)
+				if tc.ruleRef == nil {
+					if rule.Head.Name == Var(tc.ruleset) {
+						rules = append(rules, rule)
+					}
+				} else {
+					if rule.Head.Ref().HasPrefix(tc.ruleRef) {
+						rules = append(rules, rule)
+					}
 				}
 			}
+			if len(rules) == 0 {
+				t.Fatal("selected empty ruleset")
+			}
 
 			var input *Term
 			if tc.input != "" {
@@ -630,7 +749,7 @@ func TestBaseDocEqIndexing(t *testing.T) {
 			case RuleSet:
 				expectedRS = e
 			default:
-				panic("Unexpected test case expected value")
+				panic("Unexpected test case: expected value")
 			}
 
 			index := newBaseDocEqIndex(func(Ref) bool {
@@ -655,6 +774,10 @@ func TestBaseDocEqIndexing(t *testing.T) {
 				t.Fatalf("Unexpected error during index lookup: %v", err)
 			}
 
+			if tc.checkResult != nil {
+				tc.checkResult(t, result)
+			}
+
 			if !NewRuleSet(result.Rules...).Equal(expectedRS) {
 				t.Fatalf("Expected ruleset %v but got: %v", expectedRS, result.Rules)
 			}
diff --git a/ast/internal/scanner/scanner.go b/ast/internal/scanner/scanner.go
index 9402749e34..7174d092b9 100644
--- a/ast/internal/scanner/scanner.go
+++ b/ast/internal/scanner/scanner.go
@@ -7,7 +7,6 @@ package scanner
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"unicode"
 	"unicode/utf8"
 
@@ -47,7 +46,7 @@ type Position struct {
 // through the source code provided by the io.Reader.
 func New(r io.Reader) (*Scanner, error) {
 
-	bs, err := ioutil.ReadAll(r)
+	bs, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}
@@ -96,6 +95,11 @@ func (s *Scanner) Keyword(lit string) tokens.Token {
 // AddKeyword adds a string -> token mapping to this Scanner instance.
 func (s *Scanner) AddKeyword(kw string, tok tokens.Token) {
 	s.keywords[kw] = tok
+
+	switch tok {
+	case tokens.Every: // importing 'every' means also importing 'in'
+		s.keywords["in"] = tokens.In
+	}
 }
 
 // WithKeywords returns a new copy of the Scanner struct `s`, with the set
@@ -112,6 +116,21 @@ func (s *Scanner) WithKeywords(kws map[string]tokens.Token) *Scanner {
 	return &cpy
 }
 
+// WithoutKeywords returns a new copy of the Scanner struct `s`, with the
+// set of known keywords being that of `s` with `kws` removed.
+// The previously known keywords are returned for a convenient reset.
+func (s *Scanner) WithoutKeywords(kws map[string]tokens.Token) (*Scanner, map[string]tokens.Token) {
+	cpy := *s
+	kw := s.keywords
+	cpy.keywords = make(map[string]tokens.Token, len(s.keywords)-len(kws))
+	for kw, tok := range s.keywords {
+		if _, ok := kws[kw]; !ok {
+			cpy.AddKeyword(kw, tok)
+		}
+	}
+	return &cpy, kw
+}
+
 // Scan will increment the scanners position in the source
 // code until the next token is found. The token, starting position
 // of the token, string literal, and any errors encountered are
diff --git a/ast/internal/tokens/tokens.go b/ast/internal/tokens/tokens.go
index ce053c18a9..29bf971d34 100644
--- a/ast/internal/tokens/tokens.go
+++ b/ast/internal/tokens/tokens.go
@@ -65,6 +65,10 @@ const (
 	Lte
 	Dot
 	Semicolon
+
+	Every
+	Contains
+	If
 )
 
 var strings = [...]string{
@@ -112,6 +116,9 @@ var strings = [...]string{
 	Lte:        "lte",
 	Dot:        ".",
 	Semicolon:  ";",
+	Every:      "every",
+	Contains:   "contains",
+	If:         "if",
 }
 
 var keywords = map[string]Token{
@@ -136,3 +143,9 @@ func Keywords() map[string]Token {
 	}
 	return cpy
 }
+
+// IsKeyword returns if a token is a keyword
+func IsKeyword(tok Token) bool {
+	_, ok := keywords[strings[tok]]
+	return ok
+}
diff --git a/ast/location/location.go b/ast/location/location.go
index 13ae6e35d7..9ef1e6dfd4 100644
--- a/ast/location/location.go
+++ b/ast/location/location.go
@@ -3,9 +3,8 @@ package location
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
-
-	"github.com/pkg/errors"
 )
 
 // Location records a position in source code
@@ -39,7 +38,7 @@ func (loc *Location) Errorf(f string, a ...interface{}) error {
 // Wrapf returns a new error value that wraps an existing error with a message formatted
 // to include the location info (e.g., line, column, filename, etc.)
 func (loc *Location) Wrapf(err error, f string, a ...interface{}) error {
-	return errors.Wrap(err, loc.Format(f, a...))
+	return fmt.Errorf(loc.Format(f, a...)+": %w", err)
 }
 
 // Format returns a formatted string prefixed with the location information.
diff --git a/ast/marshal.go b/ast/marshal.go
new file mode 100644
index 0000000000..891945db8b
--- /dev/null
+++ b/ast/marshal.go
@@ -0,0 +1,7 @@
+package ast
+
+// customJSON is an interface that can be implemented by AST nodes that
+// allows the parser to set options for JSON operations on that node.
+type customJSON interface {
+	setJSONOptions(JSONOptions)
+}
diff --git a/ast/marshal_test.go b/ast/marshal_test.go
new file mode 100644
index 0000000000..38b5216279
--- /dev/null
+++ b/ast/marshal_test.go
@@ -0,0 +1,972 @@
+package ast
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/open-policy-agent/opa/util"
+)
+
+func TestTerm_MarshalJSON(t *testing.T) {
+	testCases := map[string]struct {
+		Term         *Term
+		ExpectedJSON string
+	}{
+		"base case": {
+			Term: func() *Term {
+				v, _ := InterfaceToValue("example")
+				return &Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				}
+			}(),
+			ExpectedJSON: `{"type":"string","value":"example"}`,
+		},
+		"location excluded": {
+			Term: func() *Term {
+				v, _ := InterfaceToValue("example")
+				return &Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+					jsonOptions: JSONOptions{
+						MarshalOptions: JSONMarshalOptions{
+							IncludeLocation: NodeToggle{
+								Term: false,
+							},
+						},
+					},
+				}
+			}(),
+			ExpectedJSON: `{"type":"string","value":"example"}`,
+		},
+		"location included": {
+			Term: func() *Term {
+				v, _ := InterfaceToValue("example")
+				return &Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+					jsonOptions: JSONOptions{
+						MarshalOptions: JSONMarshalOptions{
+							IncludeLocation: NodeToggle{
+								Term: true,
+							},
+						},
+					},
+				}
+			}(),
+			ExpectedJSON: `{"location":{"file":"example.rego","row":1,"col":2},"type":"string","value":"example"}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Term)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestTerm_UnmarshalJSON(t *testing.T) {
+	testCases := map[string]struct {
+		JSON         string
+		ExpectedTerm *Term
+	}{
+		"base case": {
+			JSON: `{"type":"string","value":"example"}`,
+			ExpectedTerm: func() *Term {
+				v, _ := InterfaceToValue("example")
+				return &Term{
+					Value: v,
+				}
+			}(),
+		},
+		"location case": {
+			JSON: `{"location":{"file":"example.rego","row":1,"col":2},"type":"string","value":"example"}`,
+			ExpectedTerm: func() *Term {
+				v, _ := InterfaceToValue("example")
+				return &Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				}
+			}(),
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			var term Term
+			err := json.Unmarshal([]byte(data.JSON), &term)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !term.Equal(data.ExpectedTerm) {
+				t.Fatalf("expected:\n%#v got\n%#v", data.ExpectedTerm, term)
+			}
+			if data.ExpectedTerm.Location != nil {
+				if !term.Location.Equal(data.ExpectedTerm.Location) {
+					t.Fatalf("expected location:\n%#v got\n%#v", data.ExpectedTerm, term)
+				}
+			}
+		})
+	}
+}
+
+func TestPackage_MarshalJSON(t *testing.T) {
+	testCases := map[string]struct {
+		Package      *Package
+		ExpectedJSON string
+	}{
+		"base case": {
+			Package: &Package{
+				Path: EmptyRef(),
+			},
+			ExpectedJSON: `{"path":[]}`,
+		},
+		"location excluded": {
+			Package: &Package{
+				Path:     EmptyRef(),
+				Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Package: false,
+						},
+					},
+				},
+			},
+			ExpectedJSON: `{"path":[]}`,
+		},
+		"location included": {
+			Package: &Package{
+				Path:     EmptyRef(),
+				Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Package: true,
+						},
+					},
+				},
+			},
+			ExpectedJSON: `{"location":{"file":"example.rego","row":1,"col":2},"path":[]}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Package)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+// TODO: Comment has inconsistent JSON field names starting with an upper case letter. Comment Location is
+// also always included for legacy reasons
+func TestComment_MarshalJSON(t *testing.T) {
+	testCases := map[string]struct {
+		Comment      *Comment
+		ExpectedJSON string
+	}{
+		"base case": {
+			Comment: &Comment{
+				Text: []byte("comment"),
+			},
+			ExpectedJSON: `{"Text":"Y29tbWVudA==","Location":null}`,
+		},
+		"location excluded, still included for legacy reasons": {
+			Comment: &Comment{
+				Text:     []byte("comment"),
+				Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Comment: false, // ignored
+						},
+					},
+				},
+			},
+			ExpectedJSON: `{"Text":"Y29tbWVudA==","Location":{"file":"example.rego","row":1,"col":2}}`,
+		},
+		"location included": {
+			Comment: &Comment{
+				Text:     []byte("comment"),
+				Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Comment: true, // ignored
+						},
+					},
+				},
+			},
+			ExpectedJSON: `{"Text":"Y29tbWVudA==","Location":{"file":"example.rego","row":1,"col":2}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Comment)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestImport_MarshalJSON(t *testing.T) {
+	testCases := map[string]struct {
+		Import       *Import
+		ExpectedJSON string
+	}{
+		"base case": {
+			Import: func() *Import {
+				v, _ := InterfaceToValue("example")
+				term := Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				}
+				return &Import{Path: &term}
+			}(),
+			ExpectedJSON: `{"path":{"type":"string","value":"example"}}`,
+		},
+		"location excluded": {
+			Import: func() *Import {
+				v, _ := InterfaceToValue("example")
+				term := Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				}
+				return &Import{
+					Path:     &term,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+					jsonOptions: JSONOptions{
+						MarshalOptions: JSONMarshalOptions{
+							IncludeLocation: NodeToggle{
+								Import: false,
+							},
+						},
+					},
+				}
+			}(),
+			ExpectedJSON: `{"path":{"type":"string","value":"example"}}`,
+		},
+		"location included": {
+			Import: func() *Import {
+				v, _ := InterfaceToValue("example")
+				term := Term{
+					Value:    v,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+				}
+				return &Import{
+					Path:     &term,
+					Location: NewLocation([]byte{}, "example.rego", 1, 2),
+					jsonOptions: JSONOptions{
+						MarshalOptions: JSONMarshalOptions{
+							IncludeLocation: NodeToggle{
+								Import: true,
+							},
+						},
+					},
+				}
+			}(),
+			ExpectedJSON: `{"location":{"file":"example.rego","row":1,"col":2},"path":{"type":"string","value":"example"}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Import)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestRule_MarshalJSON(t *testing.T) {
+	rawModule := `
+	package foo
+
+	# comment
+
+	allow { true }
+	`
+
+	module, err := ParseModuleWithOpts("example.rego", rawModule, ParserOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rule := module.Rules[0]
+
+	testCases := map[string]struct {
+		Rule         *Rule
+		ExpectedJSON string
+	}{
+		"base case": {
+			Rule:         rule.Copy(),
+			ExpectedJSON: `{"body":[{"index":0,"terms":{"type":"boolean","value":true}}],"head":{"name":"allow","value":{"type":"boolean","value":true},"ref":[{"type":"var","value":"allow"}]}}`,
+		},
+		"location excluded": {
+			Rule: func() *Rule {
+				r := rule.Copy()
+				r.jsonOptions = JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Rule: false,
+						},
+					},
+				}
+				return r
+			}(),
+			ExpectedJSON: `{"body":[{"index":0,"terms":{"type":"boolean","value":true}}],"head":{"name":"allow","value":{"type":"boolean","value":true},"ref":[{"type":"var","value":"allow"}]}}`,
+		},
+		"location included": {
+			Rule: func() *Rule {
+				r := rule.Copy()
+				r.jsonOptions = JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Rule: true,
+						},
+					},
+				}
+				return r
+			}(),
+			ExpectedJSON: `{"body":[{"index":0,"terms":{"type":"boolean","value":true}}],"head":{"name":"allow","value":{"type":"boolean","value":true},"ref":[{"type":"var","value":"allow"}]},"location":{"file":"example.rego","row":6,"col":2}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Rule)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestHead_MarshalJSON(t *testing.T) {
+	rawModule := `
+	package foo
+
+	# comment
+
+	allow { true }
+	`
+
+	module, err := ParseModuleWithOpts("example.rego", rawModule, ParserOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	head := module.Rules[0].Head
+
+	testCases := map[string]struct {
+		Head         *Head
+		ExpectedJSON string
+	}{
+		"base case": {
+			Head:         head.Copy(),
+			ExpectedJSON: `{"name":"allow","value":{"type":"boolean","value":true},"ref":[{"type":"var","value":"allow"}]}`,
+		},
+		"location excluded": {
+			Head: func() *Head {
+				h := head.Copy()
+				h.jsonOptions = JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Head: false,
+						},
+					},
+				}
+
+				return h
+			}(),
+			ExpectedJSON: `{"name":"allow","value":{"type":"boolean","value":true},"ref":[{"type":"var","value":"allow"}]}`,
+		},
+		"location included": {
+			Head: func() *Head {
+				h := head.Copy()
+				h.jsonOptions = JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Head: true,
+						},
+					},
+				}
+				return h
+			}(),
+			ExpectedJSON: `{"name":"allow","value":{"type":"boolean","value":true},"ref":[{"type":"var","value":"allow"}],"location":{"file":"example.rego","row":6,"col":2}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Head)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestExpr_MarshalJSON(t *testing.T) {
+	rawModule := `
+	package foo
+
+	# comment
+
+	allow { true }
+	`
+
+	module, err := ParseModuleWithOpts("example.rego", rawModule, ParserOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expr := module.Rules[0].Body[0]
+
+	testCases := map[string]struct {
+		Expr         *Expr
+		ExpectedJSON string
+	}{
+		"base case": {
+			Expr:         expr.Copy(),
+			ExpectedJSON: `{"index":0,"terms":{"type":"boolean","value":true}}`,
+		},
+		"location excluded": {
+			Expr: func() *Expr {
+				e := expr.Copy()
+				e.jsonOptions = JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Expr: false,
+						},
+					},
+				}
+
+				return e
+			}(),
+			ExpectedJSON: `{"index":0,"terms":{"type":"boolean","value":true}}`,
+		},
+		"location included": {
+			Expr: func() *Expr {
+				e := expr.Copy()
+				e.jsonOptions = JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Expr: true,
+						},
+					},
+				}
+				return e
+			}(),
+			ExpectedJSON: `{"index":0,"location":{"file":"example.rego","row":6,"col":10},"terms":{"type":"boolean","value":true}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Expr)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestExpr_UnmarshalJSON(t *testing.T) {
+	rawModule := `
+	package foo
+
+	# comment
+
+	allow { true }
+	`
+
+	module, err := ParseModuleWithOpts("example.rego", rawModule, ParserOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expr := module.Rules[0].Body[0]
+	// text is not marshalled to JSON so we just drop it in our examples
+	expr.Location.Text = nil
+
+	testCases := map[string]struct {
+		JSON         string
+		ExpectedExpr *Expr
+	}{
+		"base case": {
+			JSON: `{"index":0,"terms":{"type":"boolean","value":true}}`,
+			ExpectedExpr: func() *Expr {
+				e := expr.Copy()
+				e.Location = nil
+				return e
+			}(),
+		},
+		"location case": {
+			JSON:         `{"index":0,"location":{"file":"example.rego","row":6,"col":10},"terms":{"type":"boolean","value":true}}`,
+			ExpectedExpr: expr,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			var expr Expr
+			err := json.Unmarshal([]byte(data.JSON), &expr)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if !expr.Equal(data.ExpectedExpr) {
+				t.Fatalf("expected:\n%#v got\n%#v", data.ExpectedExpr, expr)
+			}
+			if data.ExpectedExpr.Location != nil {
+				if !expr.Location.Equal(data.ExpectedExpr.Location) {
+					t.Fatalf("expected location:\n%#v got\n%#v", data.ExpectedExpr.Location, expr.Location)
+				}
+			}
+		})
+	}
+}
+
+func TestSomeDecl_MarshalJSON(t *testing.T) {
+	v, _ := InterfaceToValue("example")
+	term := &Term{
+		Value:    v,
+		Location: NewLocation([]byte{}, "example.rego", 1, 2),
+	}
+
+	testCases := map[string]struct {
+		SomeDecl     *SomeDecl
+		ExpectedJSON string
+	}{
+		"base case": {
+			SomeDecl: &SomeDecl{
+				Symbols:  []*Term{term},
+				Location: NewLocation([]byte{}, "example.rego", 1, 2),
+			},
+			ExpectedJSON: `{"symbols":[{"type":"string","value":"example"}]}`,
+		},
+		"location excluded": {
+			SomeDecl: &SomeDecl{
+				Symbols:     []*Term{term},
+				Location:    NewLocation([]byte{}, "example.rego", 1, 2),
+				jsonOptions: JSONOptions{MarshalOptions: JSONMarshalOptions{IncludeLocation: NodeToggle{SomeDecl: false}}},
+			},
+			ExpectedJSON: `{"symbols":[{"type":"string","value":"example"}]}`,
+		},
+		"location included": {
+			SomeDecl: &SomeDecl{
+				Symbols:     []*Term{term},
+				Location:    NewLocation([]byte{}, "example.rego", 1, 2),
+				jsonOptions: JSONOptions{MarshalOptions: JSONMarshalOptions{IncludeLocation: NodeToggle{SomeDecl: true}}},
+			},
+			ExpectedJSON: `{"location":{"file":"example.rego","row":1,"col":2},"symbols":[{"type":"string","value":"example"}]}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.SomeDecl)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestEvery_MarshalJSON(t *testing.T) {
+
+	rawModule := `
+package foo
+
+import future.keywords.every
+
+allow {
+	every e in [1,2,3] {
+		e == 1
+    }
+}
+`
+
+	module, err := ParseModuleWithOpts("example.rego", rawModule, ParserOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	every, ok := module.Rules[0].Body[0].Terms.(*Every)
+	if !ok {
+		t.Fatal("expected every term")
+	}
+
+	testCases := map[string]struct {
+		Every        *Every
+		ExpectedJSON string
+	}{
+		"base case": {
+			Every:        every,
+			ExpectedJSON: `{"body":[{"index":0,"terms":[{"type":"ref","value":[{"type":"var","value":"equal"}]},{"type":"var","value":"e"},{"type":"number","value":1}]}],"domain":{"type":"array","value":[{"type":"number","value":1},{"type":"number","value":2},{"type":"number","value":3}]},"key":null,"value":{"type":"var","value":"e"}}`,
+		},
+		"location excluded": {
+			Every: func() *Every {
+				e := every.Copy()
+				e.jsonOptions = JSONOptions{MarshalOptions: JSONMarshalOptions{IncludeLocation: NodeToggle{Every: false}}}
+				return e
+			}(),
+			ExpectedJSON: `{"body":[{"index":0,"terms":[{"type":"ref","value":[{"type":"var","value":"equal"}]},{"type":"var","value":"e"},{"type":"number","value":1}]}],"domain":{"type":"array","value":[{"type":"number","value":1},{"type":"number","value":2},{"type":"number","value":3}]},"key":null,"value":{"type":"var","value":"e"}}`,
+		},
+		"location included": {
+			Every: func() *Every {
+				e := every.Copy()
+				e.jsonOptions = JSONOptions{MarshalOptions: JSONMarshalOptions{IncludeLocation: NodeToggle{Every: true}}}
+				return e
+			}(),
+			ExpectedJSON: `{"body":[{"index":0,"terms":[{"type":"ref","value":[{"type":"var","value":"equal"}]},{"type":"var","value":"e"},{"type":"number","value":1}]}],"domain":{"type":"array","value":[{"type":"number","value":1},{"type":"number","value":2},{"type":"number","value":3}]},"key":null,"location":{"file":"example.rego","row":7,"col":2},"value":{"type":"var","value":"e"}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Every)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestWith_MarshalJSON(t *testing.T) {
+
+	rawModule := `
+package foo
+
+a {input}
+
+b {
+	a with input as 1
+}
+`
+
+	module, err := ParseModuleWithOpts("example.rego", rawModule, ParserOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	with := module.Rules[1].Body[0].With[0]
+
+	testCases := map[string]struct {
+		With         *With
+		ExpectedJSON string
+	}{
+		"base case": {
+			With:         with,
+			ExpectedJSON: `{"target":{"type":"ref","value":[{"type":"var","value":"input"}]},"value":{"type":"number","value":1}}`,
+		},
+		"location excluded": {
+			With: func() *With {
+				w := with.Copy()
+				w.jsonOptions = JSONOptions{MarshalOptions: JSONMarshalOptions{IncludeLocation: NodeToggle{With: false}}}
+				return w
+			}(),
+			ExpectedJSON: `{"target":{"type":"ref","value":[{"type":"var","value":"input"}]},"value":{"type":"number","value":1}}`,
+		},
+		"location included": {
+			With: func() *With {
+				w := with.Copy()
+				w.jsonOptions = JSONOptions{MarshalOptions: JSONMarshalOptions{IncludeLocation: NodeToggle{With: true}}}
+				return w
+			}(),
+			ExpectedJSON: `{"location":{"file":"example.rego","row":7,"col":4},"target":{"type":"ref","value":[{"type":"var","value":"input"}]},"value":{"type":"number","value":1}}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.With)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestAnnotations_MarshalJSON(t *testing.T) {
+
+	testCases := map[string]struct {
+		Annotations  *Annotations
+		ExpectedJSON string
+	}{
+		"base case": {
+			Annotations: &Annotations{
+				Scope:         "rule",
+				Title:         "My rule",
+				Entrypoint:    true,
+				Organizations: []string{"org1"},
+				Description:   "My desc",
+				Custom: map[string]interface{}{
+					"foo": "bar",
+				},
+				Location: NewLocation([]byte{}, "example.rego", 1, 4),
+			},
+			ExpectedJSON: `{"custom":{"foo":"bar"},"description":"My desc","entrypoint":true,"organizations":["org1"],"scope":"rule","title":"My rule"}`,
+		},
+		"location excluded": {
+			Annotations: &Annotations{
+				Scope:         "rule",
+				Title:         "My rule",
+				Entrypoint:    true,
+				Organizations: []string{"org1"},
+				Description:   "My desc",
+				Custom: map[string]interface{}{
+					"foo": "bar",
+				},
+				Location: NewLocation([]byte{}, "example.rego", 1, 4),
+
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{Annotations: false},
+					},
+				},
+			},
+			ExpectedJSON: `{"custom":{"foo":"bar"},"description":"My desc","entrypoint":true,"organizations":["org1"],"scope":"rule","title":"My rule"}`,
+		},
+		"location included": {
+			Annotations: &Annotations{
+				Scope:         "rule",
+				Title:         "My rule",
+				Entrypoint:    true,
+				Organizations: []string{"org1"},
+				Description:   "My desc",
+				Custom: map[string]interface{}{
+					"foo": "bar",
+				},
+				Location: NewLocation([]byte{}, "example.rego", 1, 4),
+
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{Annotations: true},
+					},
+				},
+			},
+			ExpectedJSON: `{"custom":{"foo":"bar"},"description":"My desc","entrypoint":true,"location":{"file":"example.rego","row":1,"col":4},"organizations":["org1"],"scope":"rule","title":"My rule"}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.Annotations)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestAnnotationsRef_MarshalJSON(t *testing.T) {
+
+	testCases := map[string]struct {
+		AnnotationsRef *AnnotationsRef
+		ExpectedJSON   string
+	}{
+		"base case": {
+			AnnotationsRef: &AnnotationsRef{
+				Path: []*Term{},
+				// using an empty annotations object here since Annotations marshalling is tested separately
+				Annotations: &Annotations{},
+				Location:    NewLocation([]byte{}, "example.rego", 1, 4),
+			},
+			ExpectedJSON: `{"annotations":{"scope":""},"path":[]}`,
+		},
+		"location excluded": {
+			AnnotationsRef: &AnnotationsRef{
+				Path:        []*Term{},
+				Annotations: &Annotations{},
+				Location:    NewLocation([]byte{}, "example.rego", 1, 4),
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{AnnotationsRef: false},
+					},
+				},
+			},
+			ExpectedJSON: `{"annotations":{"scope":""},"path":[]}`,
+		},
+		"location included": {
+			AnnotationsRef: &AnnotationsRef{
+				Path:        []*Term{},
+				Annotations: &Annotations{},
+				Location:    NewLocation([]byte{}, "example.rego", 1, 4),
+
+				jsonOptions: JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{AnnotationsRef: true},
+					},
+				},
+			},
+			ExpectedJSON: `{"annotations":{"scope":""},"location":{"file":"example.rego","row":1,"col":4},"path":[]}`,
+		},
+	}
+
+	for name, data := range testCases {
+		t.Run(name, func(t *testing.T) {
+			bs := util.MustMarshalJSON(data.AnnotationsRef)
+			got := string(bs)
+			exp := data.ExpectedJSON
+
+			if got != exp {
+				t.Fatalf("expected:\n%s got\n%s", exp, got)
+			}
+		})
+	}
+}
+
+func TestNewAnnotationsRef_JSONOptions(t *testing.T) {
+	tests := []struct {
+		note     string
+		module   string
+		expected []string
+		options  ParserOptions
+	}{
+		{
+			note: "all JSON marshaller options set to true",
+			module: `# METADATA
+# title: pkg
+# description: pkg
+# organizations:
+# - pkg
+# related_resources:
+# - https://pkg
+# authors:
+# - pkg
+# schemas:
+# - input.foo: {"type": "boolean"}
+# custom:
+#  pkg: pkg
+package test
+
+# METADATA
+# scope: document
+# title: doc
+# description: doc
+# organizations:
+# - doc
+# related_resources:
+# - https://doc
+# authors:
+# - doc
+# schemas:
+# - input.bar: {"type": "integer"}
+# custom:
+#  doc: doc
+
+# METADATA
+# title: rule
+# description: rule
+# organizations:
+# - rule
+# related_resources:
+# - https://rule
+# authors:
+# - rule
+# schemas:
+# - input.baz: {"type": "string"}
+# custom:
+#  rule: rule
+p = 1`,
+			options: ParserOptions{
+				ProcessAnnotation: true,
+				JSONOptions: &JSONOptions{
+					MarshalOptions: JSONMarshalOptions{
+						IncludeLocation: NodeToggle{
+							Term:           true,
+							Package:        true,
+							Comment:        true,
+							Import:         true,
+							Rule:           true,
+							Head:           true,
+							Expr:           true,
+							SomeDecl:       true,
+							Every:          true,
+							With:           true,
+							Annotations:    true,
+							AnnotationsRef: true,
+						},
+					},
+				},
+			},
+			expected: []string{
+				`{"annotations":{"authors":[{"name":"pkg"}],"custom":{"pkg":"pkg"},"description":"pkg","location":{"file":"","row":1,"col":1},"organizations":["pkg"],"related_resources":[{"ref":"https://pkg"}],"schemas":[{"path":[{"type":"var","value":"input"},{"type":"string","value":"foo"}],"definition":{"type":"boolean"}}],"scope":"package","title":"pkg"},"location":{"file":"","row":14,"col":1},"path":[{"location":{"file":"","row":14,"col":9},"type":"var","value":"data"},{"location":{"file":"","row":14,"col":9},"type":"string","value":"test"}]}`,
+				`{"annotations":{"authors":[{"name":"doc"}],"custom":{"doc":"doc"},"description":"doc","location":{"file":"","row":16,"col":1},"organizations":["doc"],"related_resources":[{"ref":"https://doc"}],"schemas":[{"path":[{"type":"var","value":"input"},{"type":"string","value":"bar"}],"definition":{"type":"integer"}}],"scope":"document","title":"doc"},"location":{"file":"","row":44,"col":1},"path":[{"location":{"file":"","row":14,"col":9},"type":"var","value":"data"},{"location":{"file":"","row":14,"col":9},"type":"string","value":"test"},{"type":"string","value":"p"}]}`,
+				`{"annotations":{"authors":[{"name":"rule"}],"custom":{"rule":"rule"},"description":"rule","location":{"file":"","row":31,"col":1},"organizations":["rule"],"related_resources":[{"ref":"https://rule"}],"schemas":[{"path":[{"type":"var","value":"input"},{"type":"string","value":"baz"}],"definition":{"type":"string"}}],"scope":"rule","title":"rule"},"location":{"file":"","row":44,"col":1},"path":[{"location":{"file":"","row":14,"col":9},"type":"var","value":"data"},{"location":{"file":"","row":14,"col":9},"type":"string","value":"test"},{"type":"string","value":"p"}]}`,
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			module := MustParseModuleWithOpts(tc.module, tc.options)
+
+			if len(tc.expected) != len(module.Annotations) {
+				t.Fatalf("expected %d annotations got %d", len(tc.expected), len(module.Annotations))
+			}
+
+			for i, a := range module.Annotations {
+				ref := NewAnnotationsRef(a)
+
+				bytes, err := json.Marshal(ref)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				got := string(bytes)
+				expected := tc.expected[i]
+
+				if got != expected {
+					t.Fatalf("expected:\n%s got\n%s", expected, got)
+				}
+			}
+
+		})
+	}
+}
diff --git a/ast/parser.go b/ast/parser.go
index 0990a6a539..58e9e73c8a 100644
--- a/ast/parser.go
+++ b/ast/parser.go
@@ -10,11 +10,13 @@ import (
 	"fmt"
 	"io"
 	"math/big"
+	"net/url"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
-	"github.com/pkg/errors"
 	"gopkg.in/yaml.v2"
 
 	"github.com/open-policy-agent/opa/ast/internal/scanner"
@@ -94,10 +96,42 @@ func (e *parsedTermCacheItem) String() string {
 
 // ParserOptions defines the options for parsing Rego statements.
 type ParserOptions struct {
-	Capabilities      *Capabilities
-	ProcessAnnotation bool
-	AllFutureKeywords bool
-	FutureKeywords    []string
+	Capabilities       *Capabilities
+	ProcessAnnotation  bool
+	AllFutureKeywords  bool
+	FutureKeywords     []string
+	SkipRules          bool
+	JSONOptions        *JSONOptions
+	unreleasedKeywords bool // TODO(sr): cleanup
+}
+
+// JSONOptions defines the options for JSON operations,
+// currently only marshaling can be configured
+type JSONOptions struct {
+	MarshalOptions JSONMarshalOptions
+}
+
+// JSONMarshalOptions defines the options for JSON marshaling,
+// currently only toggling the marshaling of location information is supported
+type JSONMarshalOptions struct {
+	IncludeLocation NodeToggle
+}
+
+// NodeToggle is a generic struct to allow the toggling of
+// settings for different ast node types
+type NodeToggle struct {
+	Term           bool
+	Package        bool
+	Comment        bool
+	Import         bool
+	Rule           bool
+	Head           bool
+	Expr           bool
+	SomeDecl       bool
+	Every          bool
+	With           bool
+	Annotations    bool
+	AnnotationsRef bool
 }
 
 // NewParser creates and initializes a Parser.
@@ -133,12 +167,12 @@ func (p *Parser) WithProcessAnnotation(processAnnotation bool) *Parser {
 // WithFutureKeywords enables "future" keywords, i.e., keywords that can
 // be imported via
 //
-//     import future.keywords.kw
-//     import future.keywords.other
+//	import future.keywords.kw
+//	import future.keywords.other
 //
 // but in a more direct way. The equivalent of this import would be
 //
-//     WithFutureKeywords("kw", "other")
+//	WithFutureKeywords("kw", "other")
 func (p *Parser) WithFutureKeywords(kws ...string) *Parser {
 	p.po.FutureKeywords = kws
 	return p
@@ -147,25 +181,38 @@ func (p *Parser) WithFutureKeywords(kws ...string) *Parser {
 // WithAllFutureKeywords enables all "future" keywords, i.e., the
 // ParserOption equivalent of
 //
-//     import future.keywords
+//	import future.keywords
 func (p *Parser) WithAllFutureKeywords(yes bool) *Parser {
 	p.po.AllFutureKeywords = yes
 	return p
 }
 
+// withUnreleasedKeywords allows using keywords that haven't surfaced
+// as future keywords (see above) yet, but have tests that require
+// them to be parsed
+func (p *Parser) withUnreleasedKeywords(yes bool) *Parser {
+	p.po.unreleasedKeywords = yes
+	return p
+}
+
 // WithCapabilities sets the capabilities structure on the parser.
 func (p *Parser) WithCapabilities(c *Capabilities) *Parser {
 	p.po.Capabilities = c
 	return p
 }
 
-const (
-	annotationScopePackage     = "package"
-	annotationScopeImport      = "import"
-	annotationScopeRule        = "rule"
-	annotationScopeDocument    = "document"
-	annotationScopeSubpackages = "subpackages"
-)
+// WithSkipRules instructs the parser not to attempt to parse Rule statements.
+func (p *Parser) WithSkipRules(skip bool) *Parser {
+	p.po.SkipRules = skip
+	return p
+}
+
+// WithJSONOptions sets the JSONOptions which will be set on nodes to configure
+// their JSON marshaling behavior.
+func (p *Parser) WithJSONOptions(jsonOptions *JSONOptions) *Parser {
+	p.po.JSONOptions = jsonOptions
+	return p
+}
 
 func (p *Parser) parsedTermCacheLookup() (*Term, *state) {
 	l := p.s.loc.Offset
@@ -206,6 +253,24 @@ func (p *Parser) futureParser() *Parser {
 	return &q
 }
 
+// presentParser returns a shallow copy of `p` with an empty
+// cache, and a scanner that knows none of the future keywords.
+// It is used to successfully parse keyword imports, like
+//
+//	import future.keywords.in
+//
+// even when the parser has already been informed about the
+// future keyword "in". This parser won't error out because
+// "in" is an identifier.
+func (p *Parser) presentParser() (*Parser, map[string]tokens.Token) {
+	var cpy map[string]tokens.Token
+	q := *p
+	q.s = p.save()
+	q.s.s, cpy = p.s.s.WithoutKeywords(futureKeywords)
+	q.cache = parsedTermCache{}
+	return &q, cpy
+}
+
 // Parse will read the Rego source and parse statements and
 // comments as they are found. Any errors encountered while
 // parsing will be accumulated and returned as a list of Errors.
@@ -301,18 +366,21 @@ func (p *Parser) Parse() ([]Statement, []*Comment, Errors) {
 		}
 
 		p.restore(s)
-		s = p.save()
 
-		if rules := p.parseRules(); rules != nil {
-			for i := range rules {
-				stmts = append(stmts, rules[i])
+		if !p.po.SkipRules {
+			s = p.save()
+
+			if rules := p.parseRules(); rules != nil {
+				for i := range rules {
+					stmts = append(stmts, rules[i])
+				}
+				continue
+			} else if len(p.s.errors) > 0 {
+				break
 			}
-			continue
-		} else if len(p.s.errors) > 0 {
-			break
-		}
 
-		p.restore(s)
+			p.restore(s)
+		}
 
 		if body := p.parseQuery(true, tokens.EOF); body != nil {
 			stmts = append(stmts, body)
@@ -326,39 +394,72 @@ func (p *Parser) Parse() ([]Statement, []*Comment, Errors) {
 		stmts = p.parseAnnotations(stmts)
 	}
 
+	if p.po.JSONOptions != nil {
+		for i := range stmts {
+			vis := NewGenericVisitor(func(x interface{}) bool {
+				if x, ok := x.(customJSON); ok {
+					x.setJSONOptions(*p.po.JSONOptions)
+				}
+				return false
+			})
+
+			vis.Walk(stmts[i])
+		}
+	}
+
 	return stmts, p.s.comments, p.s.errors
 }
 
 func (p *Parser) parseAnnotations(stmts []Statement) []Statement {
 
+	annotStmts, errs := parseAnnotations(p.s.comments)
+	for _, err := range errs {
+		p.error(err.Location, err.Message)
+	}
+
+	for _, annotStmt := range annotStmts {
+		stmts = append(stmts, annotStmt)
+	}
+
+	return stmts
+}
+
+func parseAnnotations(comments []*Comment) ([]*Annotations, Errors) {
+
 	var hint = []byte("METADATA")
 	var curr *metadataParser
 	var blocks []*metadataParser
 
-	for i := 0; i < len(p.s.comments); i++ {
+	for i := 0; i < len(comments); i++ {
 		if curr != nil {
-			if p.s.comments[i].Location.Row == p.s.comments[i-1].Location.Row+1 && p.s.comments[i].Location.Col == 1 {
-				curr.Append(p.s.comments[i])
+			if comments[i].Location.Row == comments[i-1].Location.Row+1 && comments[i].Location.Col == 1 {
+				curr.Append(comments[i])
 				continue
 			}
 			curr = nil
 		}
-		if bytes.HasPrefix(bytes.TrimSpace(p.s.comments[i].Text), hint) {
-			curr = newMetadataParser(p.s.comments[i].Location)
+		if bytes.HasPrefix(bytes.TrimSpace(comments[i].Text), hint) {
+			curr = newMetadataParser(comments[i].Location)
 			blocks = append(blocks, curr)
 		}
 	}
 
+	var stmts []*Annotations
+	var errs Errors
 	for _, b := range blocks {
 		a, err := b.Parse()
 		if err != nil {
-			p.error(b.loc, err.Error())
+			errs = append(errs, &Error{
+				Code:     ParseErr,
+				Message:  err.Error(),
+				Location: b.loc,
+			})
 		} else {
 			stmts = append(stmts, a)
 		}
 	}
 
-	return stmts
+	return stmts, errs
 }
 
 func (p *Parser) parsePackage() *Package {
@@ -433,8 +534,8 @@ func (p *Parser) parseImport() *Import {
 		p.error(p.s.Loc(), "expected ident")
 		return nil
 	}
-
-	term := p.parseTerm()
+	q, prev := p.presentParser()
+	term := q.parseTerm()
 	if term != nil {
 		switch v := term.Value.(type) {
 		case Var:
@@ -449,6 +550,9 @@ func (p *Parser) parseImport() *Import {
 			imp.Path = term
 		}
 	}
+	// keep advanced parser state, reset known keywords
+	p.s = q.s
+	p.s.s = q.s.s.WithKeywords(prev)
 
 	if imp.Path == nil {
 		p.error(p.s.Loc(), "expected path")
@@ -500,7 +604,8 @@ func (p *Parser) parseRules() []*Rule {
 		return nil
 	}
 
-	if rule.Head = p.parseHead(rule.Default); rule.Head == nil {
+	usesContains := false
+	if rule.Head, usesContains = p.parseHead(rule.Default); rule.Head == nil {
 		return nil
 	}
 
@@ -513,25 +618,89 @@ func (p *Parser) parseRules() []*Rule {
 		return []*Rule{&rule}
 	}
 
-	if p.s.tok == tokens.LBrace {
+	if usesContains && !rule.Head.Reference.IsGround() {
+		p.error(p.s.Loc(), "multi-value rules need ground refs")
+		return nil
+	}
+
+	// back-compat with `p[x] { ... }``
+	hasIf := p.s.tok == tokens.If
+
+	// p[x] if ...  becomes a single-value rule p[x]
+	if hasIf && !usesContains && len(rule.Head.Ref()) == 2 {
+		if rule.Head.Value == nil {
+			rule.Head.Value = BooleanTerm(true).SetLocation(rule.Head.Location)
+		} else {
+			// p[x] = y if  becomes a single-value rule p[x] with value y, but needs name for compat
+			v, ok := rule.Head.Ref()[0].Value.(Var)
+			if !ok {
+				return nil
+			}
+			rule.Head.Name = v
+		}
+	}
+
+	// p[x]         becomes a multi-value rule p
+	if !hasIf && !usesContains &&
+		len(rule.Head.Args) == 0 && // not a function
+		len(rule.Head.Ref()) == 2 { // ref like 'p[x]'
+		v, ok := rule.Head.Ref()[0].Value.(Var)
+		if !ok {
+			return nil
+		}
+		rule.Head.Name = v
+		rule.Head.Key = rule.Head.Ref()[1]
+		if rule.Head.Value == nil {
+			rule.Head.SetRef(rule.Head.Ref()[:len(rule.Head.Ref())-1])
+		}
+	}
+
+	switch {
+	case hasIf:
+		p.scan()
+		s := p.save()
+		if expr := p.parseLiteral(); expr != nil {
+			// NOTE(sr): set literals are never false or undefined, so parsing this as
+			//  p if { true }
+			//       ^^^^^^^^ set of one element, `true`
+			// isn't valid.
+			isSetLiteral := false
+			if t, ok := expr.Terms.(*Term); ok {
+				_, isSetLiteral = t.Value.(Set)
+			}
+			// expr.Term is []*Term or Every
+			if !isSetLiteral {
+				rule.Body.Append(expr)
+				break
+			}
+		}
+
+		// parsing as literal didn't work out, expect '{ BODY }'
+		p.restore(s)
+		fallthrough
+
+	case p.s.tok == tokens.LBrace:
 		p.scan()
 		if rule.Body = p.parseBody(tokens.RBrace); rule.Body == nil {
 			return nil
 		}
 		p.scan()
-	} else {
+
+	case usesContains:
+		rule.Body = NewBody(NewExpr(BooleanTerm(true).SetLocation(rule.Location)).SetLocation(rule.Location))
+		return []*Rule{&rule}
+
+	default:
 		return nil
 	}
 
 	if p.s.tok == tokens.Else {
-
-		if rule.Head.Assign {
-			p.error(p.s.Loc(), "else keyword cannot be used on rule declared with := operator")
+		if r := rule.Head.Ref(); len(r) > 1 && !r[len(r)-1].Value.IsGround() {
+			p.error(p.s.Loc(), "else keyword cannot be used on rules with variables in head")
 			return nil
 		}
-
 		if rule.Head.Key != nil {
-			p.error(p.s.Loc(), "else keyword cannot be used on partial rules")
+			p.error(p.s.Loc(), "else keyword cannot be used on multi-value rules")
 			return nil
 		}
 
@@ -542,9 +711,7 @@ func (p *Parser) parseRules() []*Rule {
 
 	rule.Location.Text = p.s.Text(rule.Location.Offset, p.s.lastEnd)
 
-	var rules []*Rule
-
-	rules = append(rules, &rule)
+	rules := []*Rule{&rule}
 
 	for p.s.tok == tokens.LBrace {
 
@@ -570,6 +737,11 @@ func (p *Parser) parseRules() []*Rule {
 		// rule's head AST but have their location
 		// set to the rule body.
 		next.Head = rule.Head.Copy()
+		for i := range next.Head.Args {
+			if v, ok := next.Head.Args[i].Value.(Var); ok && v.IsWildcard() {
+				next.Head.Args[i].Value = Var(p.genwildcard())
+			}
+		}
 		setLocRecursive(next.Head, loc)
 
 		rules = append(rules, &next)
@@ -584,6 +756,11 @@ func (p *Parser) parseElse(head *Head) *Rule {
 	rule.SetLoc(p.s.Loc())
 
 	rule.Head = head.Copy()
+	for i := range rule.Head.Args {
+		if v, ok := rule.Head.Args[i].Value.(Var); ok && v.IsWildcard() {
+			rule.Head.Args[i].Value = Var(p.genwildcard())
+		}
+	}
 	rule.Head.SetLoc(p.s.Loc())
 
 	defer func() {
@@ -593,9 +770,10 @@ func (p *Parser) parseElse(head *Head) *Rule {
 	p.scan()
 
 	switch p.s.tok {
-	case tokens.LBrace:
+	case tokens.LBrace, tokens.If: // no value, but a body follows directly
 		rule.Head.Value = BooleanTerm(true)
-	case tokens.Unify:
+	case tokens.Assign, tokens.Unify:
+		rule.Head.Assign = tokens.Assign == p.s.tok
 		p.scan()
 		rule.Head.Value = p.parseTermInfixCall()
 		if rule.Head.Value == nil {
@@ -607,6 +785,30 @@ func (p *Parser) parseElse(head *Head) *Rule {
 		return nil
 	}
 
+	hasIf := p.s.tok == tokens.If
+
+	if hasIf {
+		p.scan()
+		s := p.save()
+		if expr := p.parseLiteral(); expr != nil {
+			// NOTE(sr): set literals are never false or undefined, so parsing this as
+			//  p if false else if { true }
+			//                     ^^^^^^^^ set of one element, `true`
+			// isn't valid.
+			isSetLiteral := false
+			if t, ok := expr.Terms.(*Term); ok {
+				_, isSetLiteral = t.Value.(Set)
+			}
+			// expr.Term is []*Term or Every
+			if !isSetLiteral {
+				rule.Body.Append(expr)
+				setLocRecursive(rule.Body, rule.Location)
+				return &rule
+			}
+		}
+		p.restore(s)
+	}
+
 	if p.s.tok != tokens.LBrace {
 		rule.Body = NewBody(NewExpr(BooleanTerm(true)))
 		setLocRecursive(rule.Body, rule.Location)
@@ -629,85 +831,101 @@ func (p *Parser) parseElse(head *Head) *Rule {
 	return &rule
 }
 
-func (p *Parser) parseHead(defaultRule bool) *Head {
-
-	var head Head
-	head.SetLoc(p.s.Loc())
+func (p *Parser) parseHead(defaultRule bool) (*Head, bool) {
 
+	head := &Head{}
+	loc := p.s.Loc()
 	defer func() {
-		head.Location.Text = p.s.Text(head.Location.Offset, p.s.lastEnd)
+		if head != nil {
+			head.SetLoc(loc)
+			head.Location.Text = p.s.Text(head.Location.Offset, p.s.lastEnd)
+		}
 	}()
 
-	if term := p.parseVar(); term != nil {
-		head.Name = term.Value.(Var)
-	} else {
-		p.illegal("expected rule head name")
+	term := p.parseVar()
+	if term == nil {
+		return nil, false
 	}
 
-	p.scan()
-
-	if p.s.tok == tokens.LParen {
-		p.scan()
-		if p.s.tok != tokens.RParen {
-			head.Args = p.parseTermList(tokens.RParen, nil)
-			if head.Args == nil {
-				return nil
+	ref := p.parseTermFinish(term, true)
+	if ref == nil {
+		p.illegal("expected rule head name")
+		return nil, false
+	}
+
+	switch x := ref.Value.(type) {
+	case Var:
+		head = NewHead(x)
+	case Ref:
+		head = RefHead(x)
+	case Call:
+		op, args := x[0], x[1:]
+		var ref Ref
+		switch y := op.Value.(type) {
+		case Var:
+			ref = Ref{op}
+		case Ref:
+			if _, ok := y[0].Value.(Var); !ok {
+				p.illegal("rule head ref %v invalid", y)
+				return nil, false
 			}
+			ref = y
 		}
-		p.scan()
+		head = RefHead(ref)
+		head.Args = append([]*Term{}, args...)
 
-		if p.s.tok == tokens.LBrack {
-			return nil
-		}
+	default:
+		return nil, false
 	}
 
-	if p.s.tok == tokens.LBrack {
+	name := head.Ref().String()
+
+	switch p.s.tok {
+	case tokens.Contains: // NOTE: no Value for `contains` heads, we return here
+		// Catch error case of using 'contains' with a function definition rule head.
+		if head.Args != nil {
+			p.illegal("the contains keyword can only be used with multi-value rule definitions (e.g., %s contains <VALUE> { ... })", name)
+		}
 		p.scan()
 		head.Key = p.parseTermInfixCall()
 		if head.Key == nil {
-			p.illegal("expected rule key term (e.g., %s[<VALUE>] { ... })", head.Name)
-		}
-		if p.s.tok != tokens.RBrack {
-			if _, ok := futureKeywords[head.Name.String()]; ok {
-				p.hint("`import future.keywords.%[1]s` for '%[1]s' keyword", head.Name.String())
-			}
-			p.illegal("non-terminated rule key")
+			p.illegal("expected rule key term (e.g., %s contains <VALUE> { ... })", name)
 		}
-		p.scan()
-	}
+		return head, true
 
-	if p.s.tok == tokens.Unify {
+	case tokens.Unify:
 		p.scan()
 		head.Value = p.parseTermInfixCall()
 		if head.Value == nil {
-			p.illegal("expected rule value term (e.g., %s[%s] = <VALUE> { ... })", head.Name, head.Key)
-		}
-	} else if p.s.tok == tokens.Assign {
-
-		if defaultRule {
-			p.error(p.s.Loc(), "default rules must use = operator (not := operator)")
-			return nil
-		} else if head.Key != nil {
-			p.error(p.s.Loc(), "partial rules must use = operator (not := operator)")
-			return nil
-		} else if len(head.Args) > 0 {
-			p.error(p.s.Loc(), "functions must use = operator (not := operator)")
-			return nil
+			// FIX HEAD.String()
+			p.illegal("expected rule value term (e.g., %s[%s] = <VALUE> { ... })", name, head.Key)
 		}
-
+	case tokens.Assign:
+		s := p.save()
 		p.scan()
 		head.Assign = true
 		head.Value = p.parseTermInfixCall()
 		if head.Value == nil {
-			p.illegal("expected rule value term (e.g., %s := <VALUE> { ... })", head.Name)
+			p.restore(s)
+			switch {
+			case len(head.Args) > 0:
+				p.illegal("expected function value term (e.g., %s(...) := <VALUE> { ... })", name)
+			case head.Key != nil:
+				p.illegal("expected partial rule value term (e.g., %s[...] := <VALUE> { ... })", name)
+			case defaultRule:
+				p.illegal("expected default rule value term (e.g., default %s := <VALUE>)", name)
+			default:
+				p.illegal("expected rule value term (e.g., %s := <VALUE> { ... })", name)
+			}
 		}
 	}
 
 	if head.Value == nil && head.Key == nil {
-		head.Value = BooleanTerm(true).SetLocation(head.Location)
+		if len(head.Ref()) != 2 || len(head.Args) > 0 {
+			head.Value = BooleanTerm(true).SetLocation(head.Location)
+		}
 	}
-
-	return &head
+	return head, false
 }
 
 func (p *Parser) parseBody(end tokens.Token) Body {
@@ -723,7 +941,6 @@ func (p *Parser) parseQuery(requireSemi bool, end tokens.Token) Body {
 	}
 
 	for {
-
 		expr := p.parseLiteral()
 		if expr == nil {
 			return nil
@@ -763,14 +980,26 @@ func (p *Parser) parseLiteral() (expr *Expr) {
 	}()
 
 	var negated bool
+	if p.s.tok == tokens.Not {
+		p.scan()
+		negated = true
+	}
+
 	switch p.s.tok {
 	case tokens.Some:
+		if negated {
+			p.illegal("illegal negation of 'some'")
+			return nil
+		}
 		return p.parseSome()
-	case tokens.Not:
-		p.scan()
-		negated = true
-		fallthrough
+	case tokens.Every:
+		if negated {
+			p.illegal("illegal negation of 'every'")
+			return nil
+		}
+		return p.parseEvery()
 	default:
+		s := p.save()
 		expr := p.parseExpr()
 		if expr != nil {
 			expr.Negated = negated
@@ -779,6 +1008,20 @@ func (p *Parser) parseLiteral() (expr *Expr) {
 					return nil
 				}
 			}
+			// If we find a plain `every` identifier, attempt to parse an every expression,
+			// add hint if it succeeds.
+			if term, ok := expr.Terms.(*Term); ok && Var("every").Equal(term.Value) {
+				var hint bool
+				t := p.save()
+				p.restore(s)
+				if expr := p.futureParser().parseEvery(); expr != nil {
+					_, hint = expr.Terms.(*Every)
+				}
+				p.restore(t)
+				if hint {
+					p.hint("`import future.keywords.every` for `every x in xs { ... }` expressions")
+				}
+			}
 			return expr
 		}
 		return nil
@@ -801,7 +1044,8 @@ func (p *Parser) parseWith() []*With {
 			return nil
 		}
 
-		if with.Target = p.parseTerm(); with.Target == nil {
+		with.Target = p.parseTerm()
+		if with.Target == nil {
 			return nil
 		}
 
@@ -847,14 +1091,29 @@ func (p *Parser) parseSome() *Expr {
 	if term := p.parseTermInfixCall(); term != nil {
 		if call, ok := term.Value.(Call); ok {
 			switch call[0].String() {
-			case Member.Name, MemberWithKey.Name: // OK
+			case Member.Name:
+				if len(call) != 3 {
+					p.illegal("illegal domain")
+					return nil
+				}
+			case MemberWithKey.Name:
+				if len(call) != 4 {
+					p.illegal("illegal domain")
+					return nil
+				}
 			default:
 				p.illegal("expected `x in xs` or `x, y in xs` expression")
 				return nil
 			}
 
 			decl.Symbols = []*Term{term}
-			return NewExpr(decl).SetLocation(decl.Location)
+			expr := NewExpr(decl).SetLocation(decl.Location)
+			if p.s.tok == tokens.With {
+				if expr.With = p.parseWith(); expr.With == nil {
+					return nil
+				}
+			}
+			return expr
 		}
 	}
 
@@ -898,6 +1157,72 @@ func (p *Parser) parseSome() *Expr {
 	return NewExpr(decl).SetLocation(decl.Location)
 }
 
+func (p *Parser) parseEvery() *Expr {
+	qb := &Every{}
+	qb.SetLoc(p.s.Loc())
+
+	// TODO(sr): We'd get more accurate error messages if we didn't rely on
+	// parseTermInfixCall here, but parsed "var [, var] in term" manually.
+	p.scan()
+	term := p.parseTermInfixCall()
+	if term == nil {
+		return nil
+	}
+	call, ok := term.Value.(Call)
+	if !ok {
+		p.illegal("expected `x[, y] in xs { ... }` expression")
+		return nil
+	}
+	switch call[0].String() {
+	case Member.Name: // x in xs
+		if len(call) != 3 {
+			p.illegal("illegal domain")
+			return nil
+		}
+		qb.Value = call[1]
+		qb.Domain = call[2]
+	case MemberWithKey.Name: // k, v in xs
+		if len(call) != 4 {
+			p.illegal("illegal domain")
+			return nil
+		}
+		qb.Key = call[1]
+		qb.Value = call[2]
+		qb.Domain = call[3]
+		if _, ok := qb.Key.Value.(Var); !ok {
+			p.illegal("expected key to be a variable")
+			return nil
+		}
+	default:
+		p.illegal("expected `x[, y] in xs { ... }` expression")
+		return nil
+	}
+	if _, ok := qb.Value.Value.(Var); !ok {
+		p.illegal("expected value to be a variable")
+		return nil
+	}
+	if p.s.tok == tokens.LBrace { // every x in xs { ... }
+		p.scan()
+		body := p.parseBody(tokens.RBrace)
+		if body == nil {
+			return nil
+		}
+		p.scan()
+		qb.Body = body
+		expr := NewExpr(qb).SetLocation(qb.Location)
+
+		if p.s.tok == tokens.With {
+			if expr.With = p.parseWith(); expr.With == nil {
+				return nil
+			}
+		}
+		return expr
+	}
+
+	p.illegal("missing body")
+	return nil
+}
+
 func (p *Parser) parseExpr() *Expr {
 
 	lhs := p.parseTermInfixCall()
@@ -961,7 +1286,6 @@ func (p *Parser) parseTermIn(lhs *Term, keyVal bool, offset int) *Term {
 				}
 			}
 			p.restore(s)
-			return nil
 		}
 		if op := p.parseTermOpName(Member.Ref(), tokens.In); op != nil {
 			if rhs := p.parseTermRelation(nil, p.s.loc.Offset); rhs != nil {
@@ -1099,7 +1423,7 @@ func (p *Parser) parseTerm() *Term {
 		term = p.parseNumber()
 	case tokens.String:
 		term = p.parseString()
-	case tokens.Ident:
+	case tokens.Ident, tokens.Contains: // NOTE(sr): contains anywhere BUT in rule heads gets no special treatment
 		term = p.parseVar()
 	case tokens.LBrack:
 		term = p.parseArray()
@@ -1120,17 +1444,18 @@ func (p *Parser) parseTerm() *Term {
 		p.illegalToken()
 	}
 
-	term = p.parseTermFinish(term)
+	term = p.parseTermFinish(term, false)
 	p.parsedTermCachePush(term, s0)
 	return term
 }
 
-func (p *Parser) parseTermFinish(head *Term) *Term {
+func (p *Parser) parseTermFinish(head *Term, skipws bool) *Term {
 	if head == nil {
 		return nil
 	}
 	offset := p.s.loc.Offset
-	p.scanWS()
+	p.doScan(skipws)
+
 	switch p.s.tok {
 	case tokens.LParen, tokens.Dot, tokens.LBrack:
 		return p.parseRef(head, offset)
@@ -1717,7 +2042,10 @@ func (p *Parser) illegal(note string, a ...interface{}) {
 	}
 
 	tokType := "token"
-	if p.s.tok >= tokens.Package && p.s.tok <= tokens.False {
+	if tokens.IsKeyword(p.s.tok) {
+		tokType = "keyword"
+	}
+	if _, ok := futureKeywords[p.s.tok.String()]; ok {
 		tokType = "keyword"
 	}
 
@@ -1848,9 +2176,18 @@ func (p *Parser) validateDefaultRuleValue(rule *Rule) bool {
 	return valid
 }
 
+// We explicitly use yaml unmarshalling, to accommodate for the '_' in 'related_resources',
+// which isn't handled properly by json for some reason.
 type rawAnnotation struct {
-	Scope   string                `json:"scope"`
-	Schemas []rawSchemaAnnotation `json:"schemas"`
+	Scope            string                 `yaml:"scope"`
+	Title            string                 `yaml:"title"`
+	Entrypoint       bool                   `yaml:"entrypoint"`
+	Description      string                 `yaml:"description"`
+	Organizations    []string               `yaml:"organizations"`
+	RelatedResources []interface{}          `yaml:"related_resources"`
+	Authors          []interface{}          `yaml:"authors"`
+	Schemas          []rawSchemaAnnotation  `yaml:"schemas"`
+	Custom           map[string]interface{} `yaml:"custom"`
 }
 
 type rawSchemaAnnotation map[string]interface{}
@@ -1871,7 +2208,7 @@ func (b *metadataParser) Append(c *Comment) {
 	b.comments = append(b.comments, c)
 }
 
-var yamlLineErrRegex = regexp.MustCompile(`^yaml: line ([[:digit:]]+):`)
+var yamlLineErrRegex = regexp.MustCompile(`^yaml:(?: unmarshal errors:[\n\s]*)? line ([[:digit:]]+):`)
 
 func (b *metadataParser) Parse() (*Annotations, error) {
 
@@ -1882,29 +2219,41 @@ func (b *metadataParser) Parse() (*Annotations, error) {
 	}
 
 	if err := yaml.Unmarshal(b.buf.Bytes(), &raw); err != nil {
+		var comment *Comment
 		match := yamlLineErrRegex.FindStringSubmatch(err.Error())
 		if len(match) == 2 {
 			n, err2 := strconv.Atoi(match[1])
 			if err2 == nil {
 				index := n - 1 // line numbering is 1-based so subtract one from row
 				if index >= len(b.comments) {
-					b.loc = b.comments[len(b.comments)-1].Location
+					comment = b.comments[len(b.comments)-1]
 				} else {
-					b.loc = b.comments[index].Location
+					comment = b.comments[index]
 				}
+				b.loc = comment.Location
 			}
 		}
-		return nil, err
+		return nil, augmentYamlError(err, b.comments)
 	}
 
 	var result Annotations
+	result.comments = b.comments
 	result.Scope = raw.Scope
+	result.Entrypoint = raw.Entrypoint
+	result.Title = raw.Title
+	result.Description = raw.Description
+	result.Organizations = raw.Organizations
 
-	for _, pair := range raw.Schemas {
-		var k string
-		var v interface{}
-		for k, v = range pair {
+	for _, v := range raw.RelatedResources {
+		rr, err := parseRelatedResource(v)
+		if err != nil {
+			return nil, fmt.Errorf("invalid related-resource definition %s: %w", v, err)
 		}
+		result.RelatedResources = append(result.RelatedResources, rr)
+	}
+
+	for _, pair := range raw.Schemas {
+		k, v := unwrapPair(pair)
 
 		var a SchemaAnnotation
 		var err error
@@ -1923,7 +2272,7 @@ func (b *metadataParser) Parse() (*Annotations, error) {
 		case map[interface{}]interface{}:
 			w, err := convertYAMLMapKeyTypes(v, nil)
 			if err != nil {
-				return nil, errors.Wrap(err, "invalid schema definition")
+				return nil, fmt.Errorf("invalid schema definition: %w", err)
 			}
 			a.Definition = &w
 		default:
@@ -1933,10 +2282,67 @@ func (b *metadataParser) Parse() (*Annotations, error) {
 		result.Schemas = append(result.Schemas, &a)
 	}
 
+	for _, v := range raw.Authors {
+		author, err := parseAuthor(v)
+		if err != nil {
+			return nil, fmt.Errorf("invalid author definition %s: %w", v, err)
+		}
+		result.Authors = append(result.Authors, author)
+	}
+
+	result.Custom = make(map[string]interface{})
+	for k, v := range raw.Custom {
+		val, err := convertYAMLMapKeyTypes(v, nil)
+		if err != nil {
+			return nil, err
+		}
+		result.Custom[k] = val
+	}
+
 	result.Location = b.loc
 	return &result, nil
 }
 
+// augmentYamlError augments a YAML error with hints intended to help the user figure out the cause of an otherwise cryptic error.
+// These are hints, instead of proper errors, because they are educated guesses, and aren't guaranteed to be correct.
+func augmentYamlError(err error, comments []*Comment) error {
+	// Adding hints for when key/value ':' separator isn't suffixed with a legal YAML space symbol
+	for _, comment := range comments {
+		txt := string(comment.Text)
+		parts := strings.Split(txt, ":")
+		if len(parts) > 1 {
+			parts = parts[1:]
+			var invalidSpaces []string
+			for partIndex, part := range parts {
+				if len(part) == 0 && partIndex == len(parts)-1 {
+					invalidSpaces = []string{}
+					break
+				}
+
+				r, _ := utf8.DecodeRuneInString(part)
+				if r == ' ' || r == '\t' {
+					invalidSpaces = []string{}
+					break
+				}
+
+				invalidSpaces = append(invalidSpaces, fmt.Sprintf("%+q", r))
+			}
+			if len(invalidSpaces) > 0 {
+				err = fmt.Errorf(
+					"%s\n  Hint: on line %d, symbol(s) %v immediately following a key/value separator ':' is not a legal yaml space character",
+					err.Error(), comment.Location.Row, invalidSpaces)
+			}
+		}
+	}
+	return err
+}
+
+func unwrapPair(pair map[string]interface{}) (k string, v interface{}) {
+	for k, v = range pair {
+	}
+	return
+}
+
 var errInvalidSchemaRef = fmt.Errorf("invalid schema reference")
 
 // NOTE(tsandall): 'schema' is not registered as a root because it's not
@@ -1961,6 +2367,96 @@ func parseSchemaRef(s string) (Ref, error) {
 	return nil, errInvalidSchemaRef
 }
 
+func parseRelatedResource(rr interface{}) (*RelatedResourceAnnotation, error) {
+	rr, err := convertYAMLMapKeyTypes(rr, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	switch rr := rr.(type) {
+	case string:
+		if len(rr) > 0 {
+			u, err := url.Parse(rr)
+			if err != nil {
+				return nil, err
+			}
+			return &RelatedResourceAnnotation{Ref: *u}, nil
+		}
+		return nil, fmt.Errorf("ref URL may not be empty string")
+	case map[string]interface{}:
+		description := strings.TrimSpace(getSafeString(rr, "description"))
+		ref := strings.TrimSpace(getSafeString(rr, "ref"))
+		if len(ref) > 0 {
+			u, err := url.Parse(ref)
+			if err != nil {
+				return nil, err
+			}
+			return &RelatedResourceAnnotation{Description: description, Ref: *u}, nil
+		}
+		return nil, fmt.Errorf("'ref' value required in object")
+	}
+
+	return nil, fmt.Errorf("invalid value type, must be string or map")
+}
+
+func parseAuthor(a interface{}) (*AuthorAnnotation, error) {
+	a, err := convertYAMLMapKeyTypes(a, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	switch a := a.(type) {
+	case string:
+		return parseAuthorString(a)
+	case map[string]interface{}:
+		name := strings.TrimSpace(getSafeString(a, "name"))
+		email := strings.TrimSpace(getSafeString(a, "email"))
+		if len(name) > 0 || len(email) > 0 {
+			return &AuthorAnnotation{name, email}, nil
+		}
+		return nil, fmt.Errorf("'name' and/or 'email' values required in object")
+	}
+
+	return nil, fmt.Errorf("invalid value type, must be string or map")
+}
+
+func getSafeString(m map[string]interface{}, k string) string {
+	if v, found := m[k]; found {
+		if s, ok := v.(string); ok {
+			return s
+		}
+	}
+	return ""
+}
+
+const emailPrefix = "<"
+const emailSuffix = ">"
+
+// parseAuthor parses a string into an AuthorAnnotation. If the last word of the input string is enclosed within <>,
+// it is extracted as the author's email. The email may not contain whitelines, as it then will be interpreted as
+// multiple words.
+func parseAuthorString(s string) (*AuthorAnnotation, error) {
+	parts := strings.Fields(s)
+
+	if len(parts) == 0 {
+		return nil, fmt.Errorf("author is an empty string")
+	}
+
+	namePartCount := len(parts)
+	trailing := parts[namePartCount-1]
+	var email string
+	if len(trailing) >= len(emailPrefix)+len(emailSuffix) && strings.HasPrefix(trailing, emailPrefix) &&
+		strings.HasSuffix(trailing, emailSuffix) {
+		email = trailing[len(emailPrefix):]
+		email = email[0 : len(email)-len(emailSuffix)]
+		namePartCount = namePartCount - 1
+	}
+
+	name := strings.Join(parts[0:namePartCount], " ")
+
+	return &AuthorAnnotation{Name: name, Email: email}, nil
+}
+
 func convertYAMLMapKeyTypes(x interface{}, path []string) (interface{}, error) {
 	var err error
 	switch x := x.(type) {
@@ -1993,23 +2489,22 @@ func convertYAMLMapKeyTypes(x interface{}, path []string) (interface{}, error) {
 // futureKeywords is the source of truth for future keywords that will
 // eventually become standard keywords inside of Rego.
 var futureKeywords = map[string]tokens.Token{
-	"in": tokens.In,
+	"in":       tokens.In,
+	"every":    tokens.Every,
+	"contains": tokens.Contains,
+	"if":       tokens.If,
 }
 
 func (p *Parser) futureImport(imp *Import, allowedFutureKeywords map[string]tokens.Token) {
 	path := imp.Path.Value.(Ref)
-	if len(path) == 1 {
-		p.errorf(imp.Path.Location, "invalid import, use `import future.keywords` or `import.future.keywords.in`")
-		return
-	}
 
-	if !path[1].Equal(StringTerm("keywords")) {
+	if len(path) == 1 || !path[1].Equal(StringTerm("keywords")) {
 		p.errorf(imp.Path.Location, "invalid import, must be `future.keywords`")
 		return
 	}
 
 	if imp.Alias != "" {
-		p.errorf(imp.Path.Location, "future keyword imports cannot be aliased")
+		p.errorf(imp.Path.Location, "`future` imports cannot be aliased")
 		return
 	}
 
@@ -2017,6 +2512,7 @@ func (p *Parser) futureImport(imp *Import, allowedFutureKeywords map[string]toke
 	for k := range allowedFutureKeywords {
 		kwds = append(kwds, k)
 	}
+
 	switch len(path) {
 	case 2: // all keywords imported, nothing to do
 	case 3: // one keyword imported
@@ -2028,6 +2524,7 @@ func (p *Parser) futureImport(imp *Import, allowedFutureKeywords map[string]toke
 		keyword := string(kw)
 		_, ok = allowedFutureKeywords[keyword]
 		if !ok {
+			sort.Strings(kwds) // so the error message is stable
 			p.errorf(imp.Path.Location, "unexpected keyword, must be one of %v", kwds)
 			return
 		}
diff --git a/ast/parser_ext.go b/ast/parser_ext.go
index 749dbd62e8..99430a8fc5 100644
--- a/ast/parser_ext.go
+++ b/ast/parser_ext.go
@@ -12,17 +12,22 @@ package ast
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"strings"
 	"unicode"
-
-	"github.com/pkg/errors"
 )
 
 // MustParseBody returns a parsed body.
 // If an error occurs during parsing, panic.
 func MustParseBody(input string) Body {
-	parsed, err := ParseBody(input)
+	return MustParseBodyWithOpts(input, ParserOptions{})
+}
+
+// MustParseBodyWithOpts returns a parsed body.
+// If an error occurs during parsing, panic.
+func MustParseBodyWithOpts(input string, opts ParserOptions) Body {
+	parsed, err := ParseBodyWithOpts(input, opts)
 	if err != nil {
 		panic(err)
 	}
@@ -52,7 +57,13 @@ func MustParseImports(input string) []*Import {
 // MustParseModule returns a parsed module.
 // If an error occurs during parsing, panic.
 func MustParseModule(input string) *Module {
-	parsed, err := ParseModule("", input)
+	return MustParseModuleWithOpts(input, ParserOptions{})
+}
+
+// MustParseModuleWithOpts returns a parsed module.
+// If an error occurs during parsing, panic.
+func MustParseModuleWithOpts(input string, opts ParserOptions) *Module {
+	parsed, err := ParseModuleWithOpts("", input, opts)
 	if err != nil {
 		panic(err)
 	}
@@ -143,12 +154,15 @@ func ParseRuleFromExpr(module *Module, expr *Expr) (*Rule, error) {
 	}
 
 	if _, ok := expr.Terms.(*SomeDecl); ok {
-		return nil, errors.New("some declarations cannot be used for rule head")
+		return nil, errors.New("'some' declarations cannot be used for rule head")
 	}
 
 	if term, ok := expr.Terms.(*Term); ok {
 		switch v := term.Value.(type) {
 		case Ref:
+			if len(v) > 2 { // 2+ dots
+				return ParseCompleteDocRuleWithDotsFromTerm(module, term)
+			}
 			return ParsePartialSetDocRuleFromTerm(module, term)
 		default:
 			return nil, fmt.Errorf("%v cannot be used for rule name", TypeName(v))
@@ -161,30 +175,15 @@ func ParseRuleFromExpr(module *Module, expr *Expr) (*Rule, error) {
 		return nil, errors.New("expression cannot be used for rule head")
 	}
 
-	if expr.IsAssignment() {
-
-		lhs, rhs := expr.Operand(0), expr.Operand(1)
-		if lhs == nil || rhs == nil {
-			return nil, errors.New("assignment requires two operands")
-		}
-
-		rule, err := ParseCompleteDocRuleFromAssignmentExpr(module, lhs, rhs)
-
-		if err == nil {
-			rule.Location = expr.Location
-			rule.Head.Location = expr.Location
-			return rule, nil
-		} else if _, ok := lhs.Value.(Call); ok {
-			return nil, errFunctionAssignOperator
-		} else if _, ok := lhs.Value.(Ref); ok {
-			return nil, errPartialRuleAssignOperator
-		}
-
-		return nil, errTermAssignOperator(lhs.Value)
-	}
-
 	if expr.IsEquality() {
 		return parseCompleteRuleFromEq(module, expr)
+	} else if expr.IsAssignment() {
+		rule, err := parseCompleteRuleFromEq(module, expr)
+		if err != nil {
+			return nil, err
+		}
+		rule.Head.Assign = true
+		return rule, nil
 	}
 
 	if _, ok := BuiltinMap[expr.Operator().String()]; ok {
@@ -211,18 +210,17 @@ func parseCompleteRuleFromEq(module *Module, expr *Expr) (rule *Rule, err error)
 		return nil, errors.New("assignment requires two operands")
 	}
 
-	rule, err = ParseCompleteDocRuleFromEqExpr(module, lhs, rhs)
-
+	rule, err = ParseRuleFromCallEqExpr(module, lhs, rhs)
 	if err == nil {
 		return rule, nil
 	}
 
-	rule, err = ParseRuleFromCallEqExpr(module, lhs, rhs)
+	rule, err = ParsePartialObjectDocRuleFromEqExpr(module, lhs, rhs)
 	if err == nil {
 		return rule, nil
 	}
 
-	return ParsePartialObjectDocRuleFromEqExpr(module, lhs, rhs)
+	return ParseCompleteDocRuleFromEqExpr(module, lhs, rhs)
 }
 
 // ParseCompleteDocRuleFromAssignmentExpr returns a rule if the expression can
@@ -243,61 +241,92 @@ func ParseCompleteDocRuleFromAssignmentExpr(module *Module, lhs, rhs *Term) (*Ru
 // ParseCompleteDocRuleFromEqExpr returns a rule if the expression can be
 // interpreted as a complete document definition.
 func ParseCompleteDocRuleFromEqExpr(module *Module, lhs, rhs *Term) (*Rule, error) {
+	var head *Head
 
-	var name Var
-
-	if RootDocumentRefs.Contains(lhs) {
-		name = lhs.Value.(Ref)[0].Value.(Var)
-	} else if v, ok := lhs.Value.(Var); ok {
-		name = v
+	if v, ok := lhs.Value.(Var); ok {
+		head = NewHead(v)
+	} else if r, ok := lhs.Value.(Ref); ok { // groundness ?
+		if _, ok := r[0].Value.(Var); !ok {
+			return nil, fmt.Errorf("invalid rule head: %v", r)
+		}
+		head = RefHead(r)
+		if len(r) > 1 && !r[len(r)-1].IsGround() {
+			return nil, fmt.Errorf("ref not ground")
+		}
 	} else {
 		return nil, fmt.Errorf("%v cannot be used for rule name", TypeName(lhs.Value))
 	}
+	head.Value = rhs
+	head.Location = lhs.Location
+	head.setJSONOptions(lhs.jsonOptions)
 
-	rule := &Rule{
-		Location: lhs.Location,
-		Head: &Head{
-			Location: lhs.Location,
-			Name:     name,
-			Value:    rhs,
-		},
-		Body: NewBody(
-			NewExpr(BooleanTerm(true).SetLocation(rhs.Location)).SetLocation(rhs.Location),
-		),
-		Module: module,
+	body := NewBody(NewExpr(BooleanTerm(true).SetLocation(rhs.Location)).SetLocation(rhs.Location))
+	setJSONOptions(body, &rhs.jsonOptions)
+
+	return &Rule{
+		Location:    lhs.Location,
+		Head:        head,
+		Body:        body,
+		Module:      module,
+		jsonOptions: lhs.jsonOptions,
+	}, nil
+}
+
+func ParseCompleteDocRuleWithDotsFromTerm(module *Module, term *Term) (*Rule, error) {
+	ref, ok := term.Value.(Ref)
+	if !ok {
+		return nil, fmt.Errorf("%v cannot be used for rule name", TypeName(term.Value))
 	}
 
-	return rule, nil
+	if _, ok := ref[0].Value.(Var); !ok {
+		return nil, fmt.Errorf("invalid rule head: %v", ref)
+	}
+	head := RefHead(ref, BooleanTerm(true).SetLocation(term.Location))
+	head.Location = term.Location
+	head.jsonOptions = term.jsonOptions
+
+	body := NewBody(NewExpr(BooleanTerm(true).SetLocation(term.Location)).SetLocation(term.Location))
+	setJSONOptions(body, &term.jsonOptions)
+
+	return &Rule{
+		Location: term.Location,
+		Head:     head,
+		Body:     body,
+		Module:   module,
+
+		jsonOptions: term.jsonOptions,
+	}, nil
 }
 
 // ParsePartialObjectDocRuleFromEqExpr returns a rule if the expression can be
 // interpreted as a partial object document definition.
 func ParsePartialObjectDocRuleFromEqExpr(module *Module, lhs, rhs *Term) (*Rule, error) {
-
 	ref, ok := lhs.Value.(Ref)
-	if !ok || len(ref) != 2 {
+	if !ok {
 		return nil, fmt.Errorf("%v cannot be used as rule name", TypeName(lhs.Value))
 	}
 
 	if _, ok := ref[0].Value.(Var); !ok {
-		return nil, fmt.Errorf("%vs cannot be used as rule name", TypeName(ref[0].Value))
+		return nil, fmt.Errorf("invalid rule head: %v", ref)
 	}
 
-	name := ref[0].Value.(Var)
-	key := ref[1]
+	head := RefHead(ref, rhs)
+	if len(ref) == 2 { // backcompat for naked `foo.bar = "baz"` statements
+		head.Name = ref[0].Value.(Var)
+		head.Key = ref[1]
+	}
+	head.Location = rhs.Location
+	head.jsonOptions = rhs.jsonOptions
+
+	body := NewBody(NewExpr(BooleanTerm(true).SetLocation(rhs.Location)).SetLocation(rhs.Location))
+	setJSONOptions(body, &rhs.jsonOptions)
 
 	rule := &Rule{
-		Location: rhs.Location,
-		Head: &Head{
-			Location: rhs.Location,
-			Name:     name,
-			Key:      key,
-			Value:    rhs,
-		},
-		Body: NewBody(
-			NewExpr(BooleanTerm(true).SetLocation(rhs.Location)).SetLocation(rhs.Location),
-		),
-		Module: module,
+		Location:    rhs.Location,
+		Head:        head,
+		Body:        body,
+		Module:      module,
+		jsonOptions: rhs.jsonOptions,
 	}
 
 	return rule, nil
@@ -308,30 +337,34 @@ func ParsePartialObjectDocRuleFromEqExpr(module *Module, lhs, rhs *Term) (*Rule,
 func ParsePartialSetDocRuleFromTerm(module *Module, term *Term) (*Rule, error) {
 
 	ref, ok := term.Value.(Ref)
-	if !ok {
+	if !ok || len(ref) == 1 {
 		return nil, fmt.Errorf("%vs cannot be used for rule head", TypeName(term.Value))
 	}
-
-	if len(ref) != 2 {
-		return nil, fmt.Errorf("refs cannot be used for rule")
+	if _, ok := ref[0].Value.(Var); !ok {
+		return nil, fmt.Errorf("invalid rule head: %v", ref)
 	}
 
-	name, ok := ref[0].Value.(Var)
-	if !ok {
-		return nil, fmt.Errorf("%vs cannot be used as rule name", TypeName(ref[0].Value))
+	head := RefHead(ref)
+	if len(ref) == 2 {
+		v, ok := ref[0].Value.(Var)
+		if !ok {
+			return nil, fmt.Errorf("%vs cannot be used for rule head", TypeName(term.Value))
+		}
+		head = NewHead(v)
+		head.Key = ref[1]
 	}
+	head.Location = term.Location
+	head.jsonOptions = term.jsonOptions
+
+	body := NewBody(NewExpr(BooleanTerm(true).SetLocation(term.Location)).SetLocation(term.Location))
+	setJSONOptions(body, &term.jsonOptions)
 
 	rule := &Rule{
-		Location: term.Location,
-		Head: &Head{
-			Location: term.Location,
-			Name:     name,
-			Key:      ref[1],
-		},
-		Body: NewBody(
-			NewExpr(BooleanTerm(true).SetLocation(term.Location)).SetLocation(term.Location),
-		),
-		Module: module,
+		Location:    term.Location,
+		Head:        head,
+		Body:        body,
+		Module:      module,
+		jsonOptions: term.jsonOptions,
 	}
 
 	return rule, nil
@@ -350,22 +383,24 @@ func ParseRuleFromCallEqExpr(module *Module, lhs, rhs *Term) (*Rule, error) {
 	if !ok {
 		return nil, fmt.Errorf("%vs cannot be used in function signature", TypeName(call[0].Value))
 	}
-
-	name, ok := ref[0].Value.(Var)
-	if !ok {
-		return nil, fmt.Errorf("%vs cannot be used in function signature", TypeName(ref[0].Value))
+	if _, ok := ref[0].Value.(Var); !ok {
+		return nil, fmt.Errorf("invalid rule head: %v", ref)
 	}
 
+	head := RefHead(ref, rhs)
+	head.Location = lhs.Location
+	head.Args = Args(call[1:])
+	head.jsonOptions = lhs.jsonOptions
+
+	body := NewBody(NewExpr(BooleanTerm(true).SetLocation(rhs.Location)).SetLocation(rhs.Location))
+	setJSONOptions(body, &rhs.jsonOptions)
+
 	rule := &Rule{
-		Location: lhs.Location,
-		Head: &Head{
-			Location: lhs.Location,
-			Name:     name,
-			Args:     Args(call[1:]),
-			Value:    rhs,
-		},
-		Body:   NewBody(NewExpr(BooleanTerm(true).SetLocation(rhs.Location)).SetLocation(rhs.Location)),
-		Module: module,
+		Location:    lhs.Location,
+		Head:        head,
+		Body:        body,
+		Module:      module,
+		jsonOptions: lhs.jsonOptions,
 	}
 
 	return rule, nil
@@ -380,19 +415,24 @@ func ParseRuleFromCallExpr(module *Module, terms []*Term) (*Rule, error) {
 	}
 
 	loc := terms[0].Location
-	args := terms[1:]
-	value := BooleanTerm(true).SetLocation(loc)
+	ref := terms[0].Value.(Ref)
+	if _, ok := ref[0].Value.(Var); !ok {
+		return nil, fmt.Errorf("invalid rule head: %v", ref)
+	}
+	head := RefHead(ref, BooleanTerm(true).SetLocation(loc))
+	head.Location = loc
+	head.Args = terms[1:]
+	head.jsonOptions = terms[0].jsonOptions
+
+	body := NewBody(NewExpr(BooleanTerm(true).SetLocation(loc)).SetLocation(loc))
+	setJSONOptions(body, &terms[0].jsonOptions)
 
 	rule := &Rule{
-		Location: loc,
-		Head: &Head{
-			Location: loc,
-			Name:     Var(terms[0].String()),
-			Args:     args,
-			Value:    value,
-		},
-		Module: module,
-		Body:   NewBody(NewExpr(BooleanTerm(true).SetLocation(loc)).SetLocation(loc)),
+		Location:    loc,
+		Head:        head,
+		Module:      module,
+		Body:        body,
+		jsonOptions: terms[0].jsonOptions,
 	}
 	return rule, nil
 }
@@ -435,10 +475,13 @@ func ParseModuleWithOpts(filename, input string, popts ParserOptions) (*Module,
 // ParseBody returns exactly one body.
 // If multiple bodies are parsed, an error is returned.
 func ParseBody(input string) (Body, error) {
-	return ParseBodyWithOpts(input, ParserOptions{})
+	return ParseBodyWithOpts(input, ParserOptions{SkipRules: true})
 }
 
+// ParseBodyWithOpts returns exactly one body. It does _not_ set SkipRules: true on its own,
+// but respects whatever ParserOptions it's been given.
 func ParseBodyWithOpts(input string, popts ParserOptions) (Body, error) {
+
 	stmts, _, err := ParseStatementsWithOpts("", input, popts)
 	if err != nil {
 		return nil, err
@@ -467,7 +510,7 @@ func ParseBodyWithOpts(input string, popts ParserOptions) (Body, error) {
 func ParseExpr(input string) (*Expr, error) {
 	body, err := ParseBody(input)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to parse expression")
+		return nil, fmt.Errorf("failed to parse expression: %w", err)
 	}
 	if len(body) != 1 {
 		return nil, fmt.Errorf("expected exactly one expression but got: %v", body)
@@ -494,7 +537,7 @@ func ParsePackage(input string) (*Package, error) {
 func ParseTerm(input string) (*Term, error) {
 	body, err := ParseBody(input)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to parse term")
+		return nil, fmt.Errorf("failed to parse term: %w", err)
 	}
 	if len(body) != 1 {
 		return nil, fmt.Errorf("expected exactly one term but got: %v", body)
@@ -510,7 +553,7 @@ func ParseTerm(input string) (*Term, error) {
 func ParseRef(input string) (Ref, error) {
 	term, err := ParseTerm(input)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to parse ref")
+		return nil, fmt.Errorf("failed to parse ref: %w", err)
 	}
 	ref, ok := term.Value.(Ref)
 	if !ok {
@@ -519,15 +562,15 @@ func ParseRef(input string) (Ref, error) {
 	return ref, nil
 }
 
-// ParseRule returns exactly one rule.
+// ParseRuleWithOpts returns exactly one rule.
 // If multiple rules are parsed, an error is returned.
-func ParseRule(input string) (*Rule, error) {
-	stmts, _, err := ParseStatements("", input)
+func ParseRuleWithOpts(input string, opts ParserOptions) (*Rule, error) {
+	stmts, _, err := ParseStatementsWithOpts("", input, opts)
 	if err != nil {
 		return nil, err
 	}
 	if len(stmts) != 1 {
-		return nil, fmt.Errorf("expected exactly one statement (rule)")
+		return nil, fmt.Errorf("expected exactly one statement (rule), got %v = %T, %T", stmts, stmts[0], stmts[1])
 	}
 	rule, ok := stmts[0].(*Rule)
 	if !ok {
@@ -536,6 +579,12 @@ func ParseRule(input string) (*Rule, error) {
 	return rule, nil
 }
 
+// ParseRule returns exactly one rule.
+// If multiple rules are parsed, an error is returned.
+func ParseRule(input string) (*Rule, error) {
+	return ParseRuleWithOpts(input, ParserOptions{})
+}
+
 // ParseStatement returns exactly one statement.
 // A statement might be a term, expression, rule, etc. Regardless,
 // this function expects *exactly* one statement. If multiple
@@ -566,7 +615,10 @@ func ParseStatementsWithOpts(filename, input string, popts ParserOptions) ([]Sta
 		WithProcessAnnotation(popts.ProcessAnnotation).
 		WithFutureKeywords(popts.FutureKeywords...).
 		WithAllFutureKeywords(popts.AllFutureKeywords).
-		WithCapabilities(popts.Capabilities)
+		WithCapabilities(popts.Capabilities).
+		WithSkipRules(popts.SkipRules).
+		WithJSONOptions(popts.JSONOptions).
+		withUnreleasedKeywords(popts.unreleasedKeywords)
 
 	stmts, comments, errs := parser.Parse()
 
@@ -585,14 +637,15 @@ func parseModule(filename string, stmts []Statement, comments []*Comment) (*Modu
 
 	var errs Errors
 
-	_package, ok := stmts[0].(*Package)
+	pkg, ok := stmts[0].(*Package)
 	if !ok {
 		loc := stmts[0].Loc()
 		errs = append(errs, NewError(ParseErr, loc, "package expected"))
 	}
 
 	mod := &Module{
-		Package: _package,
+		Package: pkg,
+		stmts:   stmts,
 	}
 
 	// The comments slice only holds comments that were not their own statements.
@@ -609,14 +662,14 @@ func parseModule(filename string, stmts []Statement, comments []*Comment) (*Modu
 			rule, err := ParseRuleFromBody(mod, stmt)
 			if err != nil {
 				errs = append(errs, NewError(ParseErr, stmt[0].Location, err.Error()))
-			} else {
-				mod.Rules = append(mod.Rules, rule)
-
-				// NOTE(tsandall): the statement should now be interpreted as a
-				// rule so update the statement list. This is important for the
-				// logic below that associates annotations with statements.
-				stmts[i+1] = rule
+				continue
 			}
+			mod.Rules = append(mod.Rules, rule)
+
+			// NOTE(tsandall): the statement should now be interpreted as a
+			// rule so update the statement list. This is important for the
+			// logic below that associates annotations with statements.
+			stmts[i+1] = rule
 		case *Package:
 			errs = append(errs, NewError(ParseErr, stmt.Loc(), "unexpected package"))
 		case *Annotations:
@@ -632,34 +685,7 @@ func parseModule(filename string, stmts []Statement, comments []*Comment) (*Modu
 		return nil, errs
 	}
 
-	// Find first non-annotation statement following each annotation and attach
-	// the annotation to that statement.
-	for _, a := range mod.Annotations {
-		for _, stmt := range stmts {
-			_, ok := stmt.(*Annotations)
-			if !ok {
-				if stmt.Loc().Row > a.Location.Row {
-					a.node = stmt
-					break
-				}
-			}
-		}
-
-		if a.Scope == "" {
-			switch a.node.(type) {
-			case *Rule:
-				a.Scope = annotationScopeRule
-			case *Package:
-				a.Scope = annotationScopePackage
-			case *Import:
-				a.Scope = annotationScopeImport
-			}
-		}
-
-		if err := validateAnnotationScopeAttachment(a); err != nil {
-			errs = append(errs, err)
-		}
-	}
+	errs = append(errs, attachAnnotationsNodes(mod)...)
 
 	if len(errs) > 0 {
 		return nil, errs
@@ -668,24 +694,6 @@ func parseModule(filename string, stmts []Statement, comments []*Comment) (*Modu
 	return mod, nil
 }
 
-func validateAnnotationScopeAttachment(a *Annotations) *Error {
-
-	switch a.Scope {
-	case annotationScopeRule, annotationScopeDocument:
-		if _, ok := a.node.(*Rule); ok {
-			return nil
-		}
-		return newScopeAttachmentErr(a, "rule")
-	case annotationScopePackage, annotationScopeSubpackages:
-		if _, ok := a.node.(*Package); ok {
-			return nil
-		}
-		return newScopeAttachmentErr(a, "package")
-	}
-
-	return NewError(ParseErr, a.Loc(), "invalid annotation scope '%v'", a.Scope)
-}
-
 func newScopeAttachmentErr(a *Annotations, want string) *Error {
 	var have string
 	if a.node != nil {
@@ -701,6 +709,16 @@ func setRuleModule(rule *Rule, module *Module) {
 	}
 }
 
+func setJSONOptions(x interface{}, jsonOptions *JSONOptions) {
+	vis := NewGenericVisitor(func(x interface{}) bool {
+		if x, ok := x.(customJSON); ok {
+			x.setJSONOptions(*jsonOptions)
+		}
+		return false
+	})
+	vis.Walk(x)
+}
+
 // ParserErrorDetail holds additional details for parser errors.
 type ParserErrorDetail struct {
 	Line string `json:"line"`
diff --git a/ast/parser_test.go b/ast/parser_test.go
index 56fc775427..5c8422cc7d 100644
--- a/ast/parser_test.go
+++ b/ast/parser_test.go
@@ -7,6 +7,7 @@ package ast
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"reflect"
 	"strings"
@@ -692,6 +693,10 @@ func TestSomeDeclExpr(t *testing.T) {
 		},
 	}, opts)
 
+	assertParseErrorContains(t, "not some", "not some x, y in xs",
+		"unexpected some keyword: illegal negation of 'some'",
+		opts)
+
 	assertParseErrorContains(t, "some + function call", "some f(x)",
 		"expected `x in xs` or `x, y in xs` expression")
 
@@ -767,6 +772,92 @@ func TestSomeDeclExpr(t *testing.T) {
 			NewExpr(VarTerm("x")),
 		),
 	})
+
+	assertParseOneExpr(t, "with modifier on expr", "some x, y in input with input as []",
+		&Expr{
+			Terms: &SomeDecl{
+				Symbols: []*Term{
+					MemberWithKey.Call(
+						VarTerm("x"),
+						VarTerm("y"),
+						NewTerm(MustParseRef("input")),
+					),
+				},
+			},
+			With: []*With{{Value: ArrayTerm(), Target: NewTerm(MustParseRef("input"))}},
+		}, opts)
+
+	assertParseErrorContains(t, "invalid domain (internal.member_2)", "some internal.member_2()", "illegal domain", opts)
+	assertParseErrorContains(t, "invalid domain (internal.member_3)", "some internal.member_3()", "illegal domain", opts)
+
+}
+
+func TestEvery(t *testing.T) {
+	opts := ParserOptions{unreleasedKeywords: true, FutureKeywords: []string{"every"}}
+	assertParseOneExpr(t, "simple", "every x in xs { true }",
+		&Expr{
+			Terms: &Every{
+				Value:  VarTerm("x"),
+				Domain: VarTerm("xs"),
+				Body: []*Expr{
+					NewExpr(BooleanTerm(true)),
+				},
+			},
+		},
+		opts)
+
+	assertParseOneExpr(t, "with key", "every k, v in [1,2] { true }",
+		&Expr{
+			Terms: &Every{
+				Key:    VarTerm("k"),
+				Value:  VarTerm("v"),
+				Domain: ArrayTerm(IntNumberTerm(1), IntNumberTerm(2)),
+				Body: []*Expr{
+					NewExpr(BooleanTerm(true)),
+				},
+			},
+		}, opts)
+
+	assertParseErrorContains(t, "arbitrary term", "every 10", "expected `x[, y] in xs { ... }` expression", opts)
+	assertParseErrorContains(t, "non-var value", "every 10 in xs { true }", "unexpected { token: expected value to be a variable", opts)
+	assertParseErrorContains(t, "non-var key", "every 10, x in xs { true }", "unexpected { token: expected key to be a variable", opts)
+	assertParseErrorContains(t, "arbitrary call", "every f(10)", "expected `x[, y] in xs { ... }` expression", opts)
+	assertParseErrorContains(t, "no body", "every x in xs", "missing body", opts)
+	assertParseErrorContains(t, "invalid body", "every x in xs { + }", "unexpected plus token", opts)
+	assertParseErrorContains(t, "not every", "not every x in xs { true }", "unexpected every keyword: illegal negation of 'every'", opts)
+
+	assertParseOneExpr(t, `"every" kw implies "in" kw`, "x in xs", Member.Expr(
+		VarTerm("x"),
+		VarTerm("xs"),
+	), opts)
+
+	assertParseOneExpr(t, "with modifier on expr", "every x in input { x } with input as []",
+		&Expr{
+			Terms: &Every{
+				Value:  VarTerm("x"),
+				Domain: NewTerm(MustParseRef("input")),
+				Body: []*Expr{
+					NewExpr(VarTerm("x")),
+				},
+			},
+			With: []*With{{Value: ArrayTerm(), Target: NewTerm(MustParseRef("input"))}},
+		}, opts)
+
+	assertParseErrorContains(t, "every x, y in ... usage is hinted properly", `
+	p {
+		every x, y in {"foo": "bar"} { is_string(x); is_string(y) }
+	}`,
+		"unexpected ident token: expected \\n or ; or } (hint: `import future.keywords.every` for `every x in xs { ... }` expressions)")
+
+	assertParseErrorContains(t, "not every 'every' gets a hint", `
+	p {
+		every x
+	}`,
+		"unexpected ident token: expected \\n or ; or }\n\tevery x\n", // this asserts that the tail of the error message doesn't contain a hint
+	)
+
+	assertParseErrorContains(t, "invalid domain (internal.member_2)", "every internal.member_2()", "illegal domain", opts)
+	assertParseErrorContains(t, "invalid domain (internal.member_3)", "every internal.member_3()", "illegal domain", opts)
 }
 
 func TestNestedExpressions(t *testing.T) {
@@ -916,71 +1007,102 @@ func TestChainedCall(t *testing.T) {
 }
 
 func TestMultiLineBody(t *testing.T) {
-
-	input1 := `
-		x = 1
-		y = 2
-		z = [ i | [x,y] = arr
-				   arr[_] = i]
-	`
-
-	body1, err := ParseBody(input1)
-	if err != nil {
-		t.Fatalf("Unexpected parse error on enclosed body: %v", err)
-	}
-
-	expected1 := MustParseBody(`x = 1; y = 2; z = [i | [x,y] = arr; arr[_] = i]`)
-
-	if !body1.Equal(expected1) {
-		t.Errorf("Expected enclosed body to equal %v but got: %v", expected1, body1)
-	}
-
-	// Check that parser can handle multiple expressions w/o enclosing braces.
-	input2 := `
-		x = 1 ; # comment after semicolon
-		y = 2   # comment without semicolon
-		z = [ i | [x,y] = arr  # comment in comprehension
-				   arr[_] = i]
-	`
-
-	body2, err := ParseBody(input2)
-	if err != nil {
-		t.Fatalf("Unexpected parse error on enclosed body: %v", err)
+	tests := []struct {
+		note  string
+		input string
+		exp   Body
+	}{
+		{
+			note: "three definitions",
+			input: `
+x = 1
+y = 2
+z = [ i | [x,y] = arr
+	arr[_] = i]
+`,
+			exp: MustParseBody(`x = 1; y = 2; z = [i | [x,y] = arr; arr[_] = i]`),
+		},
+		{
+			note: "three definitions, with comments and w/o enclosing braces",
+			input: `
+x = 1 ; # comment after semicolon
+y = 2   # comment without semicolon
+z = [ i | [x,y] = arr  # comment in comprehension
+	arr[_] = i]
+`,
+			exp: MustParseBody(`x = 1; y = 2; z = [i | [x,y] = arr; arr[_] = i]`),
+		},
+		{
+			note:  "array following call w/ whitespace",
+			input: "f(x)\n [1]",
+			exp: NewBody(
+				NewExpr([]*Term{RefTerm(VarTerm("f")), VarTerm("x")}),
+				NewExpr(ArrayTerm(IntNumberTerm(1))),
+			),
+		},
+		{
+			note:  "set following call w/ semicolon",
+			input: "f(x);{1}",
+			exp: NewBody(
+				NewExpr([]*Term{RefTerm(VarTerm("f")), VarTerm("x")}),
+				NewExpr(SetTerm(IntNumberTerm(1))),
+			),
+		},
+		{
+			note:  "array following array w/ whitespace",
+			input: "[1]\n [2]",
+			exp: NewBody(
+				NewExpr(ArrayTerm(IntNumberTerm(1))),
+				NewExpr(ArrayTerm(IntNumberTerm(2))),
+			),
+		},
+		{
+			note:  "array following set w/ whitespace",
+			input: "{1}\n [2]",
+			exp: NewBody(
+				NewExpr(SetTerm(IntNumberTerm(1))),
+				NewExpr(ArrayTerm(IntNumberTerm(2))),
+			),
+		},
+		{
+			note:  "set following call w/ whitespace",
+			input: "f(x)\n {1}",
+			exp: NewBody(
+				NewExpr([]*Term{RefTerm(VarTerm("f")), VarTerm("x")}),
+				NewExpr(SetTerm(IntNumberTerm(1))),
+			),
+		},
+		{
+			note:  "set following ref w/ whitespace",
+			input: "data.p.q\n {1}",
+			exp: NewBody(
+				NewExpr(&Term{Value: MustParseRef("data.p.q")}),
+				NewExpr(SetTerm(IntNumberTerm(1))),
+			),
+		},
+		{
+			note:  "set following variable w/ whitespace",
+			input: "input\n {1}",
+			exp: NewBody(
+				NewExpr(&Term{Value: MustParseRef("input")}),
+				NewExpr(SetTerm(IntNumberTerm(1))),
+			),
+		},
+		{
+			note:  "set following equality w/ whitespace",
+			input: "input = 2 \n {1}",
+			exp: NewBody(
+				Equality.Expr(&Term{Value: MustParseRef("input")}, IntNumberTerm(2)),
+				NewExpr(SetTerm(IntNumberTerm(1))),
+			),
+		},
 	}
 
-	if !body2.Equal(expected1) {
-		t.Errorf("Expected unenclosed body to equal %v but got: %v", expected1, body1)
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			assertParseOneBody(t, tc.note, tc.input, tc.exp)
+		})
 	}
-
-	assertParseOneBody(t, "whitespace following call", "f(x)\t\n [1]", NewBody(
-		NewExpr(
-			[]*Term{
-				RefTerm(VarTerm("f")),
-				VarTerm("x"),
-			},
-		),
-		NewExpr(
-			ArrayTerm(IntNumberTerm(1)),
-		),
-	))
-
-	assertParseOneBody(t, "whitespace following array", "[1]\t\n [2]", NewBody(
-		NewExpr(
-			ArrayTerm(IntNumberTerm(1)),
-		),
-		NewExpr(
-			ArrayTerm(IntNumberTerm(2)),
-		),
-	))
-
-	assertParseOneBody(t, "whitespace following set", "{1}\t\n {2}", NewBody(
-		NewExpr(
-			SetTerm(IntNumberTerm(1)),
-		),
-		NewExpr(
-			SetTerm(IntNumberTerm(2)),
-		),
-	))
 }
 
 func TestBitwiseOrVsComprehension(t *testing.T) {
@@ -1108,12 +1230,38 @@ func TestImport(t *testing.T) {
 }
 
 func TestFutureImports(t *testing.T) {
-	assertParseErrorContains(t, "future", "import future", "invalid import, use `import future.keywords` or `import.future.keywords.in`")
+	assertParseErrorContains(t, "future", "import future", "invalid import, must be `future.keywords`")
 	assertParseErrorContains(t, "future.a", "import future.a", "invalid import, must be `future.keywords`")
-	assertParseErrorContains(t, "unknown keyword", "import future.keywords.xyz", "unexpected keyword, must be one of [in]")
-	assertParseErrorContains(t, "all keyword import + alias", "import future.keywords as xyz", "future keyword imports cannot be aliased")
-	assertParseErrorContains(t, "keyword import + alias", "import future.keywords.in as xyz", "future keyword imports cannot be aliased")
+	assertParseErrorContains(t, "unknown keyword", "import future.keywords.xyz", "unexpected keyword, must be one of [contains every if in]")
+	assertParseErrorContains(t, "all keyword import + alias", "import future.keywords as xyz", "`future` imports cannot be aliased")
+	assertParseErrorContains(t, "keyword import + alias", "import future.keywords.in as xyz", "`future` imports cannot be aliased")
+
+	assertParseImport(t, "import kw with kw in options",
+		"import future.keywords.in", &Import{Path: RefTerm(VarTerm("future"), StringTerm("keywords"), StringTerm("in"))},
+		ParserOptions{FutureKeywords: []string{"in"}})
+	assertParseImport(t, "import kw with all kw in options",
+		"import future.keywords.in", &Import{Path: RefTerm(VarTerm("future"), StringTerm("keywords"), StringTerm("in"))},
+		ParserOptions{AllFutureKeywords: true})
+
+	mod := `
+		package p
+		import future.keywords
+		import future.keywords.in
+	`
+	parsed := Module{
+		Package: MustParseStatement(`package p`).(*Package),
+		Imports: []*Import{
+			MustParseStatement("import future.keywords").(*Import),
+			MustParseStatement("import future.keywords.in").(*Import),
+		},
+	}
+	assertParseModule(t, "multiple imports, all kw in options", mod, &parsed, ParserOptions{AllFutureKeywords: true})
+	assertParseModule(t, "multiple imports, single in options", mod, &parsed, ParserOptions{FutureKeywords: []string{"in"}})
+}
 
+func TestFutureImportsExtraction(t *testing.T) {
+	// These tests assert that "import future..." statements in policies cause
+	// the proper keywords to be added to the parser's list of known keywords.
 	tests := []struct {
 		note, imp string
 		exp       map[string]tokens.Token
@@ -1128,6 +1276,13 @@ func TestFutureImports(t *testing.T) {
 			imp:  "import future.keywords",
 			exp:  map[string]tokens.Token{"in": tokens.In},
 		},
+		{
+			note: "all keywords + single keyword imported",
+			imp: `
+				import future.keywords
+				import future.keywords.in`,
+			exp: map[string]tokens.Token{"in": tokens.In},
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
@@ -1256,6 +1411,17 @@ func TestRule(t *testing.T) {
 		Body:    NewBody(NewExpr(BooleanTerm(true))),
 	})
 
+	assertParseRule(t, "default w/ assignment", `default allow := false`, &Rule{
+		Default: true,
+		Head: &Head{
+			Name:      "allow",
+			Reference: Ref{VarTerm("allow")},
+			Value:     BooleanTerm(false),
+			Assign:    true,
+		},
+		Body: NewBody(NewExpr(BooleanTerm(true))),
+	})
+
 	assertParseRule(t, "default w/ comprehension", `default widgets = [x | x = data.fooz[_]]`, &Rule{
 		Default: true,
 		Head:    NewHead(Var("widgets"), nil, MustParseTerm(`[x | x = data.fooz[_]]`)),
@@ -1275,9 +1441,10 @@ func TestRule(t *testing.T) {
 		})
 
 	fxy := &Head{
-		Name:  Var("f"),
-		Args:  Args{VarTerm("x")},
-		Value: VarTerm("y"),
+		Name:      Var("f"),
+		Reference: Ref{VarTerm("f")},
+		Args:      Args{VarTerm("x")},
+		Value:     VarTerm("y"),
 	}
 
 	assertParseRule(t, "identity", `f(x) = y { y = x }`, &Rule{
@@ -1289,9 +1456,10 @@ func TestRule(t *testing.T) {
 
 	assertParseRule(t, "composite arg", `f([x, y]) = z { split(x, y, z) }`, &Rule{
 		Head: &Head{
-			Name:  Var("f"),
-			Args:  Args{ArrayTerm(VarTerm("x"), VarTerm("y"))},
-			Value: VarTerm("z"),
+			Name:      Var("f"),
+			Reference: Ref{VarTerm("f")},
+			Args:      Args{ArrayTerm(VarTerm("x"), VarTerm("y"))},
+			Value:     VarTerm("z"),
 		},
 		Body: NewBody(
 			Split.Expr(VarTerm("x"), VarTerm("y"), VarTerm("z")),
@@ -1300,9 +1468,10 @@ func TestRule(t *testing.T) {
 
 	assertParseRule(t, "composite result", `f(1) = [x, y] { split("foo.bar", x, y) }`, &Rule{
 		Head: &Head{
-			Name:  Var("f"),
-			Args:  Args{IntNumberTerm(1)},
-			Value: ArrayTerm(VarTerm("x"), VarTerm("y")),
+			Name:      Var("f"),
+			Reference: Ref{VarTerm("f")},
+			Args:      Args{IntNumberTerm(1)},
+			Value:     ArrayTerm(VarTerm("x"), VarTerm("y")),
 		},
 		Body: NewBody(
 			Split.Expr(StringTerm("foo.bar"), VarTerm("x"), VarTerm("y")),
@@ -1311,7 +1480,8 @@ func TestRule(t *testing.T) {
 
 	assertParseRule(t, "expr terms: key", `p[f(x) + g(x)] { true }`, &Rule{
 		Head: &Head{
-			Name: Var("p"),
+			Name:      Var("p"),
+			Reference: Ref{VarTerm("p")},
 			Key: Plus.Call(
 				CallTerm(RefTerm(VarTerm("f")), VarTerm("x")),
 				CallTerm(RefTerm(VarTerm("g")), VarTerm("x")),
@@ -1322,7 +1492,8 @@ func TestRule(t *testing.T) {
 
 	assertParseRule(t, "expr terms: value", `p = f(x) + g(x) { true }`, &Rule{
 		Head: &Head{
-			Name: Var("p"),
+			Name:      Var("p"),
+			Reference: Ref{VarTerm("p")},
 			Value: Plus.Call(
 				CallTerm(RefTerm(VarTerm("f")), VarTerm("x")),
 				CallTerm(RefTerm(VarTerm("g")), VarTerm("x")),
@@ -1333,7 +1504,8 @@ func TestRule(t *testing.T) {
 
 	assertParseRule(t, "expr terms: args", `p(f(x) + g(x)) { true }`, &Rule{
 		Head: &Head{
-			Name: Var("p"),
+			Name:      Var("p"),
+			Reference: Ref{VarTerm("p")},
 			Args: Args{
 				Plus.Call(
 					CallTerm(RefTerm(VarTerm("f")), VarTerm("x")),
@@ -1347,8 +1519,52 @@ func TestRule(t *testing.T) {
 
 	assertParseRule(t, "assignment operator", `x := 1 { true }`, &Rule{
 		Head: &Head{
-			Name:   Var("x"),
-			Value:  IntNumberTerm(1),
+			Name:      Var("x"),
+			Reference: Ref{VarTerm("x")},
+			Value:     IntNumberTerm(1),
+			Assign:    true,
+		},
+		Body: NewBody(NewExpr(BooleanTerm(true))),
+	})
+
+	assertParseRule(t, "else assignment", `x := 1 { false } else := 2`, &Rule{
+		Head: &Head{
+			Name:      "x", // ha! clever!
+			Reference: Ref{VarTerm("x")},
+			Value:     IntNumberTerm(1),
+			Assign:    true,
+		},
+		Body: NewBody(NewExpr(BooleanTerm(false))),
+		Else: &Rule{
+			Head: &Head{
+				Name:      "x",
+				Reference: Ref{VarTerm("x")},
+				Value:     IntNumberTerm(2),
+				Assign:    true,
+			},
+			Body: NewBody(NewExpr(BooleanTerm(true))),
+		},
+	})
+
+	assertParseRule(t, "partial assignment", `p[x] := y { true }`, &Rule{
+		Head: &Head{
+			Name:      "p",
+			Reference: MustParseRef("p[x]"),
+			Value:     VarTerm("y"),
+			Key:       VarTerm("x"),
+			Assign:    true,
+		},
+		Body: NewBody(NewExpr(BooleanTerm(true))),
+	})
+
+	assertParseRule(t, "function assignment", `f(x) := y { true }`, &Rule{
+		Head: &Head{
+			Name:      "f",
+			Reference: Ref{VarTerm("f")},
+			Value:     VarTerm("y"),
+			Args: Args{
+				VarTerm("x"),
+			},
 			Assign: true,
 		},
 		Body: NewBody(NewExpr(BooleanTerm(true))),
@@ -1359,33 +1575,33 @@ func TestRule(t *testing.T) {
 	assertParseErrorContains(t, "empty rule body", "p {}", "rego_parse_error: found empty body")
 	assertParseErrorContains(t, "unmatched braces", `f(x) = y { trim(x, ".", y) `, `rego_parse_error: unexpected eof token: expected \n or ; or }`)
 
-	// TODO: how to highlight that assignment is incorrect here?
 	assertParseErrorContains(t, "no output", `f(_) = { "foo" = "bar" }`, "rego_parse_error: unexpected eq token: expected rule value term")
+	assertParseErrorContains(t, "no output", `f(_) := { "foo" = "bar" }`, "rego_parse_error: unexpected assign token: expected function value term")
+	assertParseErrorContains(t, "no output", `f := { "foo" = "bar" }`, "rego_parse_error: unexpected assign token: expected rule value term")
+	assertParseErrorContains(t, "no output", `f[_] := { "foo" = "bar" }`, "rego_parse_error: unexpected assign token: expected rule value term")
+	assertParseErrorContains(t, "no output", `default f :=`, "rego_parse_error: unexpected assign token: expected default rule value term")
 
 	// TODO(tsandall): improve error checking here. This is a common mistake
 	// and the current error message is not very good. Need to investigate if the
 	// parser can be improved.
 	assertParseError(t, "dangling semicolon", "p { true; false; }")
 
-	assertParseErrorContains(t, "default assignment", "default p := 1", `default rules must use = operator (not := operator)`)
-	assertParseErrorContains(t, "partial assignment", `p[x] := y { true }`, "partial rules must use = operator (not := operator)")
-	assertParseErrorContains(t, "function assignment", `f(x) := y { true }`, "functions must use = operator (not := operator)")
-	assertParseErrorContains(t, "else assignment", `p := y { true } else = 2 { true } `, "else keyword cannot be used on rule declared with := operator")
-
 	assertParseErrorContains(t, "default invalid rule name", `default 0[0`, "unexpected default keyword")
-	assertParseErrorContains(t, "default invalid rule value", `default a[0`, "illegal default rule (must have a value)")
+	assertParseErrorContains(t, "default invalid rule value", `default a[0]`, "illegal default rule (must have a value)")
 	assertParseRule(t, "default missing value", `default a`, &Rule{
 		Default: true,
 		Head: &Head{
-			Name:  Var("a"),
-			Value: BooleanTerm(true),
+			Name:      Var("a"),
+			Reference: Ref{VarTerm("a")},
+			Value:     BooleanTerm(true),
 		},
 		Body: NewBody(NewExpr(BooleanTerm(true))),
 	})
 	assertParseRule(t, "empty arguments", `f() { x := 1 }`, &Rule{
 		Head: &Head{
-			Name:  "f",
-			Value: BooleanTerm(true),
+			Name:      "f",
+			Reference: Ref{VarTerm("f")},
+			Value:     BooleanTerm(true),
 		},
 		Body: MustParseBody(`x := 1`),
 	})
@@ -1396,190 +1612,797 @@ func TestRule(t *testing.T) {
 	assertParseErrorContains(t, "default invalid rule head call", `default a = b`, "illegal default rule (value cannot contain var)")
 
 	assertParseError(t, "extra braces", `{ a := 1 }`)
-	assertParseError(t, "invalid rule name dots", `a.b = x { x := 1 }`)
-	assertParseError(t, "invalid rule name dots and call", `a.b(x) { x := 1 }`)
 	assertParseError(t, "invalid rule name hyphen", `a-b = x { x := 1 }`)
 
 	assertParseRule(t, "wildcard name", `_ { x == 1 }`, &Rule{
 		Head: &Head{
-			Name:  "$0",
-			Value: BooleanTerm(true),
+			Name:      "$0",
+			Reference: Ref{VarTerm("$0")},
+			Value:     BooleanTerm(true),
 		},
 		Body: MustParseBody(`x == 1`),
 	})
 
 	assertParseRule(t, "partial object array key", `p[[a, 1, 2]] = x { a := 1; x := "foo" }`, &Rule{
 		Head: &Head{
-			Name:  "p",
-			Key:   ArrayTerm(VarTerm("a"), NumberTerm("1"), NumberTerm("2")),
-			Value: VarTerm("x"),
+			Name:      "p",
+			Reference: MustParseRef("p[[a,1,2]]"),
+			Key:       ArrayTerm(VarTerm("a"), NumberTerm("1"), NumberTerm("2")),
+			Value:     VarTerm("x"),
 		},
 		Body: MustParseBody(`a := 1; x := "foo"`),
 	})
 	assertParseError(t, "invalid rule body no separator", `p { a = "foo"bar }`)
 	assertParseError(t, "invalid rule body no newline", `p { a b c }`)
-}
-
-func TestRuleElseKeyword(t *testing.T) {
-	mod := `package test
-
-	p {
-		"p0"
-	}
-
-	p {
-		"p1"
-	} else {
-		"p1_e1"
-	} else = [null] {
-		"p1_e2"
-	} else = x {
-		x = "p1_e3"
-	}
-
-	p {
-		"p2"
-	}
-
-	f(x) {
-		x < 100
-	} else = false {
-		x > 200
-	} else {
-		x != 150
-	}
-
-	_ {
-		x > 0
-	} else {
-	    x == -1
-	} else {
-		x > -100
-	}
-
-	nobody = 1 {
-		false
-	} else = 7
-
-	nobody_f(x) = 1 {
-		false
-	} else = 7
-	`
 
-	parsed, err := ParseModule("", mod)
-	if err != nil {
-		t.Fatalf("Unexpected parse error: %v", err)
-	}
+	assertParseRule(t, "wildcard in else args", `f(_) { true } else := false`, &Rule{
+		Head: &Head{
+			Name:      "f",
+			Reference: Ref{VarTerm("f")},
+			Args: Args{
+				VarTerm("$0"),
+			},
+			Value: BooleanTerm(true),
+		},
+		Body: MustParseBody(`true`),
+		Else: &Rule{
+			Head: &Head{
+				Name:      "f",
+				Assign:    true,
+				Reference: Ref{VarTerm("f")},
+				Args: Args{
+					VarTerm("$1"),
+				},
+				Value: BooleanTerm(false),
+			},
+			Body: MustParseBody(`true`),
+		},
+	})
 
-	name := Var("p")
+	name := Var("f")
+	ref := Ref{VarTerm("f")}
 	tr := BooleanTerm(true)
-	head := &Head{Name: name, Value: tr}
-
-	expected := &Module{
+	head := func(v string) *Head { return &Head{Name: name, Reference: ref, Value: tr, Args: []*Term{VarTerm(v)}} }
+	assertParseModule(t, "wildcard in chained function heads", `package test
+	f(_) { true } { true }
+`, &Module{
 		Package: MustParsePackage(`package test`),
 		Rules: []*Rule{
 			{
-				Head: head,
-				Body: MustParseBody(`"p0"`),
+				Head: head("$0"),
+				Body: MustParseBody("true"),
 			},
 			{
-				Head: head,
-				Body: MustParseBody(`"p1"`),
-				Else: &Rule{
-					Head: head,
-					Body: MustParseBody(`"p1_e1"`),
-					Else: &Rule{
-						Head: &Head{
-							Name:  Var("p"),
-							Value: ArrayTerm(NullTerm()),
-						},
-						Body: MustParseBody(`"p1_e2"`),
-						Else: &Rule{
-							Head: &Head{
-								Name:  name,
-								Value: VarTerm("x"),
-							},
-							Body: MustParseBody(`x = "p1_e3"`),
-						},
-					},
-				},
+				Head: head("$1"),
+				Body: MustParseBody("true"),
 			},
-			{
-				Head: head,
-				Body: MustParseBody(`"p2"`),
+		},
+	})
+}
+
+func TestRuleContains(t *testing.T) {
+	opts := ParserOptions{FutureKeywords: []string{"contains", "if"}}
+
+	tests := []struct {
+		note string
+		rule string
+		exp  *Rule
+	}{
+		{
+			note: "simple",
+			rule: `p contains "x" { true }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), StringTerm("x")),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
 			},
-			{
-				Head: &Head{
-					Name:  Var("f"),
-					Args:  Args{VarTerm("x")},
-					Value: BooleanTerm(true),
-				},
-				Body: MustParseBody(`x < 100`),
-				Else: &Rule{
-					Head: &Head{
-						Name:  Var("f"),
-						Args:  Args{VarTerm("x")},
-						Value: BooleanTerm(false),
-					},
-					Body: MustParseBody(`x > 200`),
-					Else: &Rule{
-						Head: &Head{
-							Name:  Var("f"),
-							Args:  Args{VarTerm("x")},
-							Value: BooleanTerm(true),
-						},
-						Body: MustParseBody(`x != 150`),
-					},
-				},
+		},
+		{
+			note: "no body",
+			rule: `p contains "x"`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), StringTerm("x")),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
 			},
-
-			{
+		},
+		{
+			note: "ref head, no body",
+			rule: `p.q contains "x"`,
+			exp: &Rule{
 				Head: &Head{
-					Name:  Var("$0"),
-					Value: BooleanTerm(true),
-				},
-				Body: MustParseBody(`x > 0`),
-				Else: &Rule{
-					Head: &Head{
-						Name:  Var("$0"),
-						Value: BooleanTerm(true),
-					},
-					Body: MustParseBody(`x == -1`),
-					Else: &Rule{
-						Head: &Head{
-							Name:  Var("$0"),
-							Value: BooleanTerm(true),
-						},
-						Body: MustParseBody(`x > -100`),
-					},
+					Reference: MustParseRef("p.q"),
+					Key:       StringTerm("x"),
 				},
+				Body: NewBody(NewExpr(BooleanTerm(true))),
 			},
-			{
+		},
+		{
+			note: "ref head",
+			rule: `p.q contains "x" { true }`,
+			exp: &Rule{
 				Head: &Head{
-					Name:  Var("nobody"),
-					Value: IntNumberTerm(1),
+					Reference: MustParseRef("p.q"),
+					Key:       StringTerm("x"),
 				},
-				Body: MustParseBody("false"),
-				Else: &Rule{
-					Head: &Head{
-						Name:  Var("nobody"),
-						Value: IntNumberTerm(7),
-					},
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "set with var element",
+			rule: `deny contains msg { msg := "nonono" }`,
+			exp: &Rule{
+				Head: NewHead(Var("deny"), VarTerm("msg")),
+				Body: MustParseBody(`msg := "nonono"`),
+			},
+		},
+		{
+			note: "set with object elem",
+			rule: `deny contains {"allow": false, "msg": msg} { msg := "nonono" }`,
+			exp: &Rule{
+				Head: NewHead(Var("deny"), MustParseTerm(`{"allow": false, "msg": msg}`)),
+				Body: MustParseBody(`msg := "nonono"`),
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			assertParseRule(t, tc.note, tc.rule, tc.exp, opts)
+		})
+	}
+}
+
+func TestRuleContainsFail(t *testing.T) {
+	opts := ParserOptions{FutureKeywords: []string{"contains", "if", "every"}}
+
+	tests := []struct {
+		note     string
+		rule     string
+		expected string
+	}{
+		{
+			note:     "contains used with a 1+ argument function",
+			rule:     "p(a) contains x { x := a }",
+			expected: "the contains keyword can only be used with multi-value rule definitions (e.g., p contains <VALUE> { ... })",
+		},
+		{
+			note:     "contains used with a 0 argument function",
+			rule:     "p() contains x { x := 1 }",
+			expected: "the contains keyword can only be used with multi-value rule definitions (e.g., p contains <VALUE> { ... })",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			assertParseErrorContains(t, tc.note, tc.rule, tc.expected, opts)
+		})
+	}
+}
+
+func TestRuleIf(t *testing.T) {
+	opts := ParserOptions{FutureKeywords: []string{"contains", "if", "every"}}
+
+	tests := []struct {
+		note string
+		rule string
+		exp  *Rule
+	}{
+		{
+			note: "complete",
+			rule: `p if { true }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "else",
+			rule: `p if { true } else if { true }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+				Else: &Rule{
+					Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+					Body: NewBody(NewExpr(BooleanTerm(true))),
+				},
+			},
+		},
+		{
+			note: "ref head, complete",
+			rule: `p.q if { true }`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q"),
+					Value:     BooleanTerm(true),
+				},
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "complete, normal body",
+			rule: `p if { x := 10; x > y }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: MustParseBody(`x := 10; x > y`),
+			},
+		},
+		{
+			note: "complete+else, normal bodies, assign",
+			rule: `p := "yes" if { 10 > y } else := "no" { 10 <= y }`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: Ref{VarTerm("p")},
+					Name:      Var("p"),
+					Value:     StringTerm("yes"),
+					Assign:    true,
+				},
+				Body: MustParseBody(`10 > y`),
+				Else: &Rule{
+					Head: &Head{
+						Reference: Ref{VarTerm("p")},
+						Name:      Var("p"),
+						Value:     StringTerm("no"),
+						Assign:    true,
+					},
+					Body: MustParseBody(`10 <= y`),
+				},
+			},
+		},
+		{
+			note: "complete+else, normal bodies, assign; if",
+			rule: `p := "yes" if { 10 > y } else := "no" if { 10 <= y }`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: Ref{VarTerm("p")},
+					Name:      Var("p"),
+					Value:     StringTerm("yes"),
+					Assign:    true,
+				},
+				Body: MustParseBody(`10 > y`),
+				Else: &Rule{
+					Head: &Head{
+						Reference: Ref{VarTerm("p")},
+						Name:      Var("p"),
+						Value:     StringTerm("no"),
+						Assign:    true,
+					},
+					Body: MustParseBody(`10 <= y`),
+				},
+			},
+		},
+		{
+			note: "complete, shorthand",
+			rule: `p if true`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "complete, else, shorthand",
+			rule: `p if true else if true`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+				Else: &Rule{
+					Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+					Body: NewBody(NewExpr(BooleanTerm(true))),
+				},
+			},
+		},
+		{
+			note: "complete, else, assignment+shorthand",
+			rule: `p if true else := 3 if 2 < 1`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+				Else: &Rule{
+					Head: &Head{
+						Reference: Ref{VarTerm("p")},
+						Name:      Var("p"),
+						Value:     NumberTerm("3"),
+						Assign:    true,
+					},
+					Body: NewBody(LessThan.Expr(IntNumberTerm(2), IntNumberTerm(1))),
+				},
+			},
+		},
+		{
+			note: "complete+not, shorthand",
+			rule: `p if not q`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: MustParseBody(`not q`),
+			},
+		},
+		{
+			note: "complete+else, shorthand",
+			rule: `p if 1 > 2 else = 42 { 2 > 1 }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: MustParseBody(`1 > 2`),
+				Else: &Rule{
+					Head: &Head{
+						Reference: Ref{VarTerm("p")},
+						Name:      Var("p"),
+						Value:     NumberTerm("42"),
+					},
+					Body: MustParseBody(`2 > 1`),
+				},
+			},
+		},
+		{
+			note: "complete+call, shorthand",
+			rule: `p if count(q) > 0`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: MustParseBody(`count(q) > 0`),
+			},
+		},
+		{
+			note: "function, shorthand",
+			rule: `f(x) = y if y := x + 1`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: Ref{VarTerm("f")},
+					Name:      Var("f"),
+					Args:      []*Term{VarTerm("x")},
+					Value:     VarTerm("y"),
+				},
+				Body: MustParseBody(`y := x + 1`),
+			},
+		},
+		{
+			note: "function+every, shorthand",
+			rule: `f(xs) if every x in xs { x != 0 }`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: Ref{VarTerm("f")},
+					Name:      Var("f"),
+					Args:      []*Term{VarTerm("xs")},
+					Value:     BooleanTerm(true),
+				},
+				Body: MustParseBodyWithOpts(`every x in xs { x != 0 }`, opts),
+			},
+		},
+		{
+			note: "object",
+			rule: `p["foo"] = "bar" if { true }`,
+			exp: &Rule{
+				Head: &Head{
+					Name:      Var("p"),
+					Reference: MustParseRef("p.foo"),
+					Value:     StringTerm("bar"),
+				},
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "object, shorthand",
+			rule: `p["foo"] = "bar" if true`,
+			exp: &Rule{
+				Head: &Head{
+					Name:      Var("p"),
+					Reference: MustParseRef("p.foo"),
+					Value:     StringTerm("bar"),
+				},
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "object with vars",
+			rule: `p[x] = y if {
+				x := "foo"
+				y := "bar"
+			}`,
+			exp: &Rule{
+				Head: &Head{
+					Name:      Var("p"),
+					Reference: MustParseRef("p[x]"),
+					Value:     VarTerm("y"),
+				},
+				Body: MustParseBody(`x := "foo"; y := "bar"`),
+			},
+		},
+		{
+			note: "set",
+			rule: `p contains "foo" if { true }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), StringTerm("foo")),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "set, shorthand",
+			rule: `p contains "foo" if true`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), StringTerm("foo")),
+				Body: NewBody(NewExpr(BooleanTerm(true))),
+			},
+		},
+		{
+			note: "set+var+shorthand",
+			rule: `p contains x if { x := "foo" }`,
+			exp: &Rule{
+				Head: NewHead(Var("p"), VarTerm("x")),
+				Body: MustParseBody(`x := "foo"`),
+			},
+		},
+		{
+			note: "partial set+if, shorthand", // these are now Head.Ref rules, previously forbidden
+			rule: `p[x] if x := 1`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p[x]"),
+					Value:     BooleanTerm(true),
+				},
+				Body: MustParseBody(`x := 1`),
+			},
+		},
+		{
+			note: "partial set+if", // these are now Head.Ref rules, previously forbidden
+			rule: `p[x] if { x := 1 }`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p[x]"),
+					Value:     BooleanTerm(true),
+				},
+				Body: MustParseBody(`x := 1`),
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			assertParseRule(t, tc.note, tc.rule, tc.exp, opts)
+		})
+	}
+}
+
+func TestRuleRefHeads(t *testing.T) {
+	opts := ParserOptions{FutureKeywords: []string{"contains", "if", "every"}}
+	trueBody := NewBody(NewExpr(BooleanTerm(true)))
+
+	tests := []struct {
+		note string
+		rule string
+		exp  *Rule
+	}{
+		{
+			note: "single-value rule",
+			rule: "p.q.r = 1 if true",
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.r"),
+					Value:     IntNumberTerm(1),
+				},
+				Body: trueBody,
+			},
+		},
+		{
+			note: "single-value with brackets, string key",
+			rule: `p.q["r"] = 1 if true`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.r"),
+					Value:     IntNumberTerm(1),
+				},
+				Body: trueBody,
+			},
+		},
+		{
+			note: "single-value with brackets, number key",
+			rule: `p.q[2] = 1 if true`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q[2]"),
+					Value:     IntNumberTerm(1),
+				},
+				Body: trueBody,
+			},
+		},
+		{
+			note: "single-value with brackets, no value",
+			rule: `p.q[2] if true`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q[2]"),
+					Value:     BooleanTerm(true),
+				},
+				Body: trueBody,
+			},
+		},
+		{
+			note: "single-value with brackets, var key",
+			rule: `p.q[x] = 1 if x := 2`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q[x]"),
+					Value:     IntNumberTerm(1),
+				},
+				Body: MustParseBody("x := 2"),
+			},
+		},
+		{
+			note: "single-value with brackets, var key, no dot",
+			rule: `p[x] = 1 if x := 2`,
+			exp: &Rule{
+				Head: &Head{
+					Name:      Var("p"),
+					Reference: MustParseRef("p[x]"),
+					Value:     IntNumberTerm(1),
+				},
+				Body: MustParseBody("x := 2"),
+			},
+		},
+		{
+			note: "multi-value, simple",
+			rule: `p.q.r contains x if x := 2`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.r"),
+					Key:       VarTerm("x"),
+				},
+				Body: MustParseBody("x := 2"),
+			},
+		},
+		{
+			note: "backcompat: multi-value, no dot",
+			rule: `p[x] { x := 2 }`, // no "if", which triggers ref-interpretation
+			exp: &Rule{
+				Head: &Head{
+					Name:      "p",
+					Reference: Ref{VarTerm("p")}, // we're defining p as multi-val rule
+					Key:       VarTerm("x"),
+				},
+				Body: MustParseBody("x := 2"),
+			},
+		},
+		{
+			note: "backcompat: single-value, no dot",
+			rule: `p[x] = 3 { x := 2 }`,
+			exp: &Rule{
+				Head: &Head{
+					Name:      "p",
+					Reference: MustParseRef("p[x]"),
+					Key:       VarTerm("x"), // not used
+					Value:     IntNumberTerm(3),
+				},
+				Body: MustParseBody("x := 2"),
+			},
+		},
+		{
+			note: "backcompat: single-value, no dot, complex object",
+			rule: `partialobj[x] = {"foo": y} { y = "bar"; x = y }`,
+			exp: &Rule{
+				Head: &Head{
+					Name:      "partialobj",
+					Reference: MustParseRef("partialobj[x]"),
+					Key:       VarTerm("x"), // not used
+					Value:     MustParseTerm(`{"foo": y}`),
+				},
+				Body: MustParseBody(`y = "bar"; x = y`),
+			},
+		},
+		{
+			note: "function, simple",
+			rule: `p.q.f(x) = 1 if true`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.f"),
+					Args:      Args([]*Term{VarTerm("x")}),
+					Value:     IntNumberTerm(1),
+				},
+				Body: trueBody,
+			},
+		},
+		{
+			note: "function, no value",
+			rule: `p.q.f(x) if true`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.f"),
+					Args:      Args([]*Term{VarTerm("x")}),
+					Value:     BooleanTerm(true),
+				},
+				Body: trueBody,
+			},
+		},
+		{
+			note: "function, with value",
+			rule: `p.q.f(x) = x + 1 if true`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.f"),
+					Args:      Args([]*Term{VarTerm("x")}),
+					Value:     Plus.Call(VarTerm("x"), IntNumberTerm(1)),
+				},
+				Body: trueBody,
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			assertParseRule(t, tc.note, tc.rule, tc.exp, opts)
+		})
+	}
+
+	assertParseErrorContains(t, "first ref head term is call", `package p
+q(0).r(0) { true }`,
+		"unexpected { token: rule head ref q(0).r invalid", opts)
+}
+
+func TestRuleElseKeyword(t *testing.T) {
+	mod := `package test
+
+	p {
+		"p0"
+	}
+
+	p {
+		"p1"
+	} else {
+		"p1_e1"
+	} else = [null] {
+		"p1_e2"
+	} else = x {
+		x = "p1_e3"
+	}
+
+	p {
+		"p2"
+	}
+
+	f(x) {
+		x < 100
+	} else = false {
+		x > 200
+	} else {
+		x != 150
+	}
+
+	_ {
+		x > 0
+	} else {
+	    x == -1
+	} else {
+		x > -100
+	}
+
+	nobody = 1 {
+		false
+	} else = 7
+
+	nobody_f(x) = 1 {
+		false
+	} else = 7
+	`
+
+	parsed, err := ParseModule("", mod)
+	if err != nil {
+		t.Fatalf("Unexpected parse error: %v", err)
+	}
+
+	name := Var("p")
+	ref := Ref{VarTerm("p")}
+	tr := BooleanTerm(true)
+	head := &Head{Name: name, Reference: ref, Value: tr}
+
+	expected := &Module{
+		Package: MustParsePackage(`package test`),
+		Rules: []*Rule{
+			{
+				Head: head,
+				Body: MustParseBody(`"p0"`),
+			},
+			{
+				Head: head,
+				Body: MustParseBody(`"p1"`),
+				Else: &Rule{
+					Head: head,
+					Body: MustParseBody(`"p1_e1"`),
+					Else: &Rule{
+						Head: &Head{
+							Name:      name,
+							Reference: ref,
+							Value:     ArrayTerm(NullTerm()),
+						},
+						Body: MustParseBody(`"p1_e2"`),
+						Else: &Rule{
+							Head: &Head{
+								Name:      name,
+								Reference: ref,
+								Value:     VarTerm("x"),
+							},
+							Body: MustParseBody(`x = "p1_e3"`),
+						},
+					},
+				},
+			},
+			{
+				Head: head,
+				Body: MustParseBody(`"p2"`),
+			},
+			{
+				Head: &Head{
+					Name:      Var("f"),
+					Reference: Ref{VarTerm("f")},
+					Args:      Args{VarTerm("x")},
+					Value:     BooleanTerm(true),
+				},
+				Body: MustParseBody(`x < 100`),
+				Else: &Rule{
+					Head: &Head{
+						Name:      Var("f"),
+						Reference: Ref{VarTerm("f")},
+						Args:      Args{VarTerm("x")},
+						Value:     BooleanTerm(false),
+					},
+					Body: MustParseBody(`x > 200`),
+					Else: &Rule{
+						Head: &Head{
+							Name:      Var("f"),
+							Reference: Ref{VarTerm("f")},
+							Args:      Args{VarTerm("x")},
+							Value:     BooleanTerm(true),
+						},
+						Body: MustParseBody(`x != 150`),
+					},
+				},
+			},
+
+			{
+				Head: &Head{
+					Name:      Var("$0"),
+					Reference: Ref{VarTerm("$0")},
+					Value:     BooleanTerm(true),
+				},
+				Body: MustParseBody(`x > 0`),
+				Else: &Rule{
+					Head: &Head{
+						Name:      Var("$0"),
+						Reference: Ref{VarTerm("$0")},
+						Value:     BooleanTerm(true),
+					},
+					Body: MustParseBody(`x == -1`),
+					Else: &Rule{
+						Head: &Head{
+							Name:      Var("$0"),
+							Reference: Ref{VarTerm("$0")},
+							Value:     BooleanTerm(true),
+						},
+						Body: MustParseBody(`x > -100`),
+					},
+				},
+			},
+			{
+				Head: &Head{
+					Name:      Var("nobody"),
+					Reference: Ref{VarTerm("nobody")},
+					Value:     IntNumberTerm(1),
+				},
+				Body: MustParseBody("false"),
+				Else: &Rule{
+					Head: &Head{
+						Name:      Var("nobody"),
+						Reference: Ref{VarTerm("nobody")},
+						Value:     IntNumberTerm(7),
+					},
 					Body: MustParseBody("true"),
 				},
 			},
 			{
 				Head: &Head{
-					Name:  Var("nobody_f"),
-					Args:  Args{VarTerm("x")},
-					Value: IntNumberTerm(1),
+					Name:      Var("nobody_f"),
+					Reference: Ref{VarTerm("nobody_f")},
+					Args:      Args{VarTerm("x")},
+					Value:     IntNumberTerm(1),
 				},
 				Body: MustParseBody("false"),
 				Else: &Rule{
 					Head: &Head{
-						Name:  Var("nobody_f"),
-						Args:  Args{VarTerm("x")},
-						Value: IntNumberTerm(7),
+						Name:      Var("nobody_f"),
+						Reference: Ref{VarTerm("nobody_f")},
+						Args:      Args{VarTerm("x")},
+						Value:     IntNumberTerm(7),
 					},
 					Body: MustParseBody("true"),
 				},
@@ -1606,14 +2429,16 @@ func TestRuleElseKeyword(t *testing.T) {
 					Body: MustParseBody(`"p1_e1"`),
 					Else: &Rule{
 						Head: &Head{
-							Name:  Var("p"),
-							Value: ArrayTerm(NullTerm()),
+							Name:      Var("p"),
+							Reference: Ref{VarTerm("p")},
+							Value:     ArrayTerm(NullTerm()),
 						},
 						Body: MustParseBody(`"p1_e2"`),
 						Else: &Rule{
 							Head: &Head{
-								Name:  name,
-								Value: VarTerm("x"),
+								Name:      name,
+								Reference: ref,
+								Value:     VarTerm("x"),
 							},
 							Body: MustParseBody(`x = "p1_e4"`),
 						},
@@ -1636,7 +2461,7 @@ func TestRuleElseKeyword(t *testing.T) {
 	p[1] { false } else { true }
 	`)
 
-	if err == nil || !strings.Contains(err.Error(), "else keyword cannot be used on partial rules") {
+	if err == nil || !strings.Contains(err.Error(), "else keyword cannot be used on multi-value rules") {
 		t.Fatalf("Expected parse error but got: %v", err)
 	}
 
@@ -1660,6 +2485,97 @@ func TestRuleElseKeyword(t *testing.T) {
 
 }
 
+func TestRuleElseRefHeads(t *testing.T) {
+	tests := []struct {
+		note string
+		rule string
+		exp  *Rule
+		err  string
+	}{
+		{
+			note: "simple ref head",
+			rule: `
+a.b.c := 1 if false
+else := 2
+`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("a.b.c"),
+					Value:     NumberTerm("1"),
+					Assign:    true,
+				},
+				Body: MustParseBody("false"),
+				Else: &Rule{
+					Head: &Head{
+						Reference: MustParseRef("a.b.c"),
+						Value:     NumberTerm("2"),
+						Assign:    true,
+					},
+					Body: MustParseBody("true"),
+				},
+			},
+		},
+		{
+			note: "multi-value ref head",
+			rule: `
+a.b.c contains 1 if false
+else := 2
+`,
+			err: "else keyword cannot be used on multi-value rules",
+		},
+		{
+			note: "single-value ref head with var",
+			rule: `
+a.b[x] := 1 if false
+else := 2
+`,
+			err: "else keyword cannot be used on rules with variables in head",
+		},
+		{
+			note: "single-value ref head with length 1 (last is var)",
+			rule: `
+a := 1 if false
+else := 2
+`,
+			exp: &Rule{
+				Head: &Head{
+					Reference: Ref{VarTerm("a")},
+					Name:      Var("a"),
+					Value:     NumberTerm("1"),
+					Assign:    true,
+				},
+				Body: MustParseBody("false"),
+				Else: &Rule{
+					Head: &Head{
+						Reference: Ref{VarTerm("a")},
+						Name:      Var("a"),
+						Value:     NumberTerm("2"),
+						Assign:    true,
+					},
+					Body: MustParseBody("true"),
+				},
+			},
+		},
+	}
+
+	opts := ParserOptions{FutureKeywords: []string{"if", "contains"}}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			if tc.err != "" {
+				assertParseErrorContains(t, tc.note, tc.rule, tc.err, opts)
+				return
+			}
+			if tc.exp != nil {
+				testModule := "package test\n" + tc.rule
+				assertParseModule(t, tc.note, testModule, &Module{
+					Package: MustParseStatement(`package test`).(*Package),
+					Rules:   []*Rule{tc.exp},
+				}, opts)
+			}
+		})
+	}
+}
+
 func TestMultipleEnclosedBodies(t *testing.T) {
 
 	result, err := ParseModule("", `package ex
@@ -1713,7 +2629,6 @@ func TestEmptyModule(t *testing.T) {
 }
 
 func TestComments(t *testing.T) {
-
 	testModule := `package a.b.c
 
     import input.e.f as g  # end of line
@@ -1929,52 +2844,245 @@ func TestLocation(t *testing.T) {
 	}
 }
 
-func TestRuleFromBody(t *testing.T) {
-	testModule := `package a.b.c
-
-pi = 3.14159
-p[x] { x = 1 }
-greeting = "hello"
-cores = [{0: 1}, {1: 2}]
-wrapper = cores[0][1]
-pi = [3, 1, 4, x, y, z]
-foo["bar"] = "buz"
-foo["9"] = "10"
-foo.buz = "bar"
-bar[1]
-bar[[{"foo":"baz"}]]
-bar.qux
-input = 1
-data = 2
-f(1) = 2
-f(1)
-d1 := 1234
-`
+func TestRuleFromBodyRefs(t *testing.T) {
+	opts := ParserOptions{FutureKeywords: []string{"if", "contains"}}
 
-	assertParseModule(t, "rules from bodies", testModule, &Module{
-		Package: MustParseStatement(`package a.b.c`).(*Package),
-		Rules: []*Rule{
-			MustParseRule(`pi = 3.14159 { true }`),
-			MustParseRule(`p[x] { x = 1 }`),
-			MustParseRule(`greeting = "hello" { true }`),
-			MustParseRule(`cores = [{0: 1}, {1: 2}] { true }`),
-			MustParseRule(`wrapper = cores[0][1] { true }`),
-			MustParseRule(`pi = [3, 1, 4, x, y, z] { true }`),
-			MustParseRule(`foo["bar"] = "buz" { true }`),
-			MustParseRule(`foo["9"] = "10" { true }`),
-			MustParseRule(`foo["buz"] = "bar" { true }`),
-			MustParseRule(`bar[1] { true }`),
-			MustParseRule(`bar[[{"foo":"baz"}]] { true }`),
-			MustParseRule(`bar["qux"] { true }`),
-			MustParseRule(`input = 1 { true }`),
-			MustParseRule(`data = 2 { true }`),
-			MustParseRule(`f(1) = 2 { true }`),
-			MustParseRule(`f(1) = true { true }`),
-			MustParseRule("d1 := 1234 { true }"),
+	// NOTE(sr): These tests assert that the other code path, parsing a module, and
+	// then interpreting naked expressions into (shortcut) rule definitions, works
+	// the same as parsing the string as a Rule directly. Without also passing
+	// TestRuleRefHeads, these tests are not to be trusted -- if changing something,
+	// start with getting TestRuleRefHeads to PASS.
+	tests := []struct {
+		note string
+		rule string
+		exp  string
+	}{
+		{
+			note: "no dots: single-value rule (complete doc)",
+			rule: `foo["bar"] = 12`,
+			exp:  `foo["bar"] = 12 { true }`,
+		},
+		{
+			note: "no dots: partial set of numbers",
+			rule: `foo[1]`,
+			exp:  `foo[1] { true }`,
+		},
+		{
+			note: "no dots: shorthand set of strings", // back compat
+			rule: `foo.one`,
+			exp:  `foo["one"] { true }`,
+		},
+		{
+			note: "no dots: partial set",
+			rule: `foo[x] { x = 1 }`,
+			exp:  `foo[x] { x = 1 }`,
+		},
+		{
+			note: "no dots + if: complete doc",
+			rule: `foo[x] if x := 1`,
+			exp:  `foo[x] if x := 1`,
+		},
+		{
+			note: "no dots: function",
+			rule: `foo(x)`,
+			exp:  `foo(x) { true }`,
+		},
+		{
+			note: "no dots: function with value",
+			rule: `foo(x) = y`,
+			exp:  `foo(x) = y { true }`,
+		},
+		{
+			note: "no dots: partial set, ref element",
+			rule: `test[arr[0]]`,
+			exp:  `test[arr[0]] { true }`,
+		},
+		{
+			note: "one dot: complete rule shorthand",
+			rule: `foo.bar = "buz"`,
+			exp:  `foo.bar = "buz" { true }`,
+		},
+		{
+			note: "one dot, bracket with var: partial object",
+			rule: `foo.bar[x] = "buz"`,
+			exp:  `foo.bar[x] = "buz" { true }`,
+		},
+		{
+			note: "one dot, bracket with var: partial set",
+			rule: `foo.bar[x] { x = 1 }`,
+			exp:  `foo.bar[x] { x = 1 }`,
+		},
+		{
+			note: "one dot, bracket with string: complete doc",
+			rule: `foo.bar["baz"] = "buz"`,
+			exp:  `foo.bar.baz = "buz" { true }`,
+		},
+		{
+			note: "one dot, bracket with var, rule body: partial object",
+			rule: `foo.bar[x] = "buz" { x = 1 }`,
+			exp:  `foo.bar[x] = "buz" { x = 1 }`,
+		},
+		{
+			note: "one dot: function",
+			rule: `foo.bar(x)`,
+			exp:  `foo.bar(x) { true }`,
+		},
+		{
+			note: "one dot: function with value",
+			rule: `foo.bar(x) = y`,
+			exp:  `foo.bar(x) = y { true }`,
+		},
+		{
+			note: "two dots, bracket with var: partial object",
+			rule: `foo.bar.baz[x] = "buz" { x = 1 }`,
+			exp:  `foo.bar.baz[x] = "buz" { x = 1 }`,
+		},
+		{
+			note: "two dots, bracket with var: partial set",
+			rule: `foo.bar.baz[x] { x = 1 }`,
+			exp:  `foo.bar.baz[x] { x = 1 }`,
+		},
+		{
+			note: "one dot, bracket with string, no key: complete doc",
+			rule: `foo.bar["baz"]`,
+			exp:  `foo.bar.baz { true }`,
+		},
+		{
+			note: "two dots: function",
+			rule: `foo.bar("baz")`,
+			exp:  `foo.bar("baz") { true }`,
+		},
+		{
+			note: "two dots: function with value",
+			rule: `foo.bar("baz") = y`,
+			exp:  `foo.bar("baz") = y { true }`,
+		},
+		{
+			note: "non-ground ref: complete doc",
+			rule: `foo.bar[i].baz { i := 1 }`,
+			exp:  `foo.bar[i].baz { i := 1 }`,
+		},
+		{
+			note: "non-ground ref: partial set",
+			rule: `foo.bar[i].baz[x] { i := 1; x := 2 }`,
+			exp:  `foo.bar[i].baz[x] { i := 1; x := 2 }`,
+		},
+		{
+			note: "non-ground ref: partial object",
+			rule: `foo.bar[i].baz[x] = 3 { i := 1; x := 2 }`,
+			exp:  `foo.bar[i].baz[x] = 3 { i := 1; x := 2 }`,
+		},
+		{
+			note: "non-ground ref: function",
+			rule: `foo.bar[i].baz(x) = 3 { i := 1 }`,
+			exp:  `foo.bar[i].baz(x) = 3 { i := 1 }`,
+		},
+		{
+			note: "last term is number: partial set",
+			rule: `foo.bar.baz[3] { true }`,
+			exp:  `foo.bar.baz[3] { true }`,
 		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			r, err := ParseRuleWithOpts(tc.exp, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			testModule := "package a.b.c\n" + tc.rule
+			m, err := ParseModuleWithOpts("", testModule, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			mr := m.Rules[0]
+
+			if r.Head.Name.Compare(mr.Head.Name) != 0 {
+				t.Errorf("rule.Head.Name differs:\n exp = %#v\nrule = %#v", r.Head.Name, mr.Head.Name)
+			}
+			if r.Head.Ref().Compare(mr.Head.Ref()) != 0 {
+				t.Errorf("rule.Head.Ref() differs:\n exp = %v\nrule = %v", r.Head.Ref(), mr.Head.Ref())
+			}
+			exp, err := ParseRuleWithOpts(tc.exp, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			assertParseModule(t, tc.note, testModule, &Module{
+				Package: MustParseStatement(`package a.b.c`).(*Package),
+				Rules:   []*Rule{exp},
+			}, opts)
+		})
+	}
+
+	// edge cases
+	t.Run("errors", func(t *testing.T) {
+		t.Run("naked 'data' ref", func(t *testing.T) {
+			_, err := ParseModuleWithOpts("", "package a.b.c\ndata", opts)
+			assertErrorWithMessage(t, err, "refs cannot be used for rule head")
+		})
+		t.Run("naked 'input' ref", func(t *testing.T) {
+			_, err := ParseModuleWithOpts("", "package a.b.c\ninput", opts)
+			assertErrorWithMessage(t, err, "refs cannot be used for rule head")
+		})
 	})
+}
+
+func assertErrorWithMessage(t *testing.T, err error, msg string) {
+	t.Helper()
+	var errs Errors
+	if !errors.As(err, &errs) {
+		t.Fatalf("expected Errors, got %v %[1]T", err)
+	}
+	if exp, act := 1, len(errs); exp != act {
+		t.Fatalf("expected %d errors, got %d", exp, act)
+	}
+	e := errs[0]
+	if exp, act := msg, e.Message; exp != act {
+		t.Fatalf("expected error message %q, got %q", exp, act)
+	}
+}
+
+func TestRuleFromBody(t *testing.T) {
+	tests := []struct {
+		input string
+		exp   string
+	}{
+		{`pi = 3.14159`, `pi = 3.14159 { true }`},
+		{`p[x] { x = 1 }`, `p[x] { x = 1 }`},
+		{`greeting = "hello"`, `greeting = "hello" { true }`},
+		{`cores = [{0: 1}, {1: 2}]`, `cores = [{0: 1}, {1: 2}] { true }`},
+		{`wrapper = cores[0][1]`, `wrapper = cores[0][1] { true }`},
+		{`pi = [3, 1, 4, x, y, z]`, `pi = [3, 1, 4, x, y, z] { true }`},
+		{`foo["bar"] = "buz"`, `foo["bar"] = "buz" { true }`},
+		{`foo["9"] = "10"`, `foo["9"] = "10" { true }`},
+		{`foo.buz = "bar"`, `foo["buz"] = "bar" { true }`},
+		{`bar[1]`, `bar[1] { true }`},
+		{`bar[[{"foo":"baz"}]]`, `bar[[{"foo":"baz"}]] { true }`},
+		{`bar.qux`, `bar["qux"] { true }`},
+		{`input = 1`, `input = 1 { true }`},
+		{`data = 2`, `data = 2 { true }`},
+		{`f(1) = 2`, `f(1) = 2 { true }`},
+		{`f(1)`, `f(1) = true { true }`},
+		{`d1 := 1234`, "d1 := 1234 { true }"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.input, func(t *testing.T) {
+			testModule := "package a.b.c\n" + tc.input
+			assertParseModule(t, tc.input, testModule, &Module{
+				Package: MustParseStatement(`package a.b.c`).(*Package),
+				Rules: []*Rule{
+					MustParseRule(tc.exp),
+				},
+			})
+		})
+	}
 
 	// Verify the rule and rule and rule head col/loc values
+	testModule := "package a.b.c\n\n"
+	for _, tc := range tests {
+		testModule += tc.input + "\n"
+	}
 	module, err := ParseModule("test.rego", testModule)
 	if err != nil {
 		t.Fatal(err)
@@ -1983,19 +3091,19 @@ d1 := 1234
 	for i := range module.Rules {
 		col := module.Rules[i].Location.Col
 		if col != 1 {
-			t.Fatalf("expected rule %v column to be 1 but got %v", module.Rules[i].Head.Name, col)
+			t.Errorf("expected rule %v column to be 1 but got %v", module.Rules[i].Head.Name, col)
 		}
 		row := module.Rules[i].Location.Row
-		if row != 3+i { // 'pi' rule stats on row 3
-			t.Fatalf("expected rule %v row to be %v but got %v", module.Rules[i].Head.Name, 3+i, row)
+		if row != 3+i { // 'pi' rule starts on row 3
+			t.Errorf("expected rule %v row to be %v but got %v", module.Rules[i].Head.Name, 3+i, row)
 		}
 		col = module.Rules[i].Head.Location.Col
 		if col != 1 {
-			t.Fatalf("expected rule head %v column to be 1 but got %v", module.Rules[i].Head.Name, col)
+			t.Errorf("expected rule head %v column to be 1 but got %v", module.Rules[i].Head.Name, col)
 		}
 		row = module.Rules[i].Head.Location.Row
-		if row != 3+i { // 'pi' rule stats on row 3
-			t.Fatalf("expected rule head %v row to be %v but got %v", module.Rules[i].Head.Name, 3+i, row)
+		if row != 3+i { // 'pi' rule starts on row 3
+			t.Errorf("expected rule head %v row to be %v but got %v", module.Rules[i].Head.Name, 3+i, row)
 		}
 	}
 
@@ -2036,16 +3144,6 @@ data = {"bar": 2}`
 	foo = input with input as 1
 	`
 
-	badRefLen1 := `
-	package a.b.c
-
-	p["x"].y = 1`
-
-	badRefLen2 := `
-	package a.b.c
-
-	p["x"].y`
-
 	negated := `
 	package a.b.c
 
@@ -2104,8 +3202,6 @@ data = {"bar": 2}`
 	assertParseModuleError(t, "non-equality", nonEquality)
 	assertParseModuleError(t, "non-var name", nonVarName)
 	assertParseModuleError(t, "with expr", withExpr)
-	assertParseModuleError(t, "bad ref (too long)", badRefLen1)
-	assertParseModuleError(t, "bad ref (too long)", badRefLen2)
 	assertParseModuleError(t, "negated", negated)
 	assertParseModuleError(t, "non ref term", nonRefTerm)
 	assertParseModuleError(t, "zero args", zeroArgs)
@@ -2169,7 +3265,8 @@ func TestWildcards(t *testing.T) {
 
 	assertParseRule(t, "functions", `f(_) = y { true }`, &Rule{
 		Head: &Head{
-			Name: Var("f"),
+			Name:      Var("f"),
+			Reference: Ref{VarTerm("f")},
 			Args: Args{
 				VarTerm("$0"),
 			},
@@ -2179,6 +3276,56 @@ func TestWildcards(t *testing.T) {
 	})
 }
 
+func TestRuleFromBodyJSONOptions(t *testing.T) {
+	tests := []string{
+		`pi = 3.14159`,
+		`p[x] { x = 1 }`,
+		`greeting = "hello"`,
+		`cores = [{0: 1}, {1: 2}]`,
+		`wrapper = cores[0][1]`,
+		`pi = [3, 1, 4, x, y, z]`,
+		`foo["bar"] = "buz"`,
+		`foo["9"] = "10"`,
+		`foo.buz = "bar"`,
+		`foo.fizz.buzz`,
+		`bar[1]`,
+		`bar[[{"foo":"baz"}]]`,
+		`bar.qux`,
+		`input = 1`,
+		`data = 2`,
+		`f(1) = 2`,
+		`f(1)`,
+		`d1 := 1234`,
+	}
+
+	parserOpts := ParserOptions{ProcessAnnotation: true}
+	parserOpts.JSONOptions = &JSONOptions{
+		MarshalOptions: JSONMarshalOptions{
+			IncludeLocation: NodeToggle{
+				Term:           true,
+				Package:        true,
+				Comment:        true,
+				Import:         true,
+				Rule:           true,
+				Head:           true,
+				Expr:           true,
+				SomeDecl:       true,
+				Every:          true,
+				With:           true,
+				Annotations:    true,
+				AnnotationsRef: true,
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc, func(t *testing.T) {
+			testModule := "package a.b.c\n" + tc
+			assertParseModuleJSONOptions(t, tc, testModule, parserOpts)
+		})
+	}
+}
+
 func TestRuleModulePtr(t *testing.T) {
 	mod := `package test
 
@@ -2229,6 +3376,97 @@ func TestNoMatchError(t *testing.T) {
 	}
 }
 
+func TestBraceBracketParenMatchingErrors(t *testing.T) {
+	// Checks to prevent regression on issue #4672.
+	// Error location is important here, which is why we check
+	// the error strings directly.
+	tests := []struct {
+		note  string
+		err   string
+		input string
+	}{
+		{
+			note: "Unmatched ')' case",
+			err: `1 error occurred: test.rego:4: rego_parse_error: unexpected , token: expected \n or ; or }
+	y := contains("a"), "b")
+	                  ^`,
+			input: `package test
+p {
+	x := 5
+	y := contains("a"), "b")
+}`,
+		},
+		{
+			note: "Unmatched '}' case",
+			err: `1 error occurred: test.rego:4: rego_parse_error: unexpected , token: expected \n or ; or }
+	y := {"a", "b", "c"}, "a"}
+	                    ^`,
+			input: `package test
+p {
+	x := 5
+	y := {"a", "b", "c"}, "a"}
+}`,
+		},
+		{
+			note: "Unmatched ']' case",
+			err: `1 error occurred: test.rego:4: rego_parse_error: unexpected , token: expected \n or ; or }
+	y := ["a", "b", "c"], "a"]
+	                    ^`,
+			input: `package test
+p {
+	x := 5
+	y := ["a", "b", "c"], "a"]
+}`,
+		},
+		{
+			note: "Unmatched '(' case",
+			err: `1 error occurred: test.rego:5: rego_parse_error: unexpected } token: expected "," or ")"
+	}
+	^`,
+			input: `package test
+p {
+	x := 5
+	y := contains("a", "b"
+}`,
+		},
+		{
+			note: "Unmatched '{' case",
+
+			err: `1 error occurred: test.rego:5: rego_parse_error: unexpected eof token: expected \n or ; or }
+	}
+	^`,
+			input: `package test
+p {
+	x := 5
+	y := {{"a", "b", "c"}, "a"
+}`,
+		},
+		{
+			note: "Unmatched '[' case",
+			err: `1 error occurred: test.rego:5: rego_parse_error: unexpected } token: expected "," or "]"
+	}
+	^`,
+			input: `package test
+p {
+	x := 5
+	y := [["a", "b", "c"], "a"
+}`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			_, err := ParseModule("test.rego", tc.input)
+			if err == nil {
+				t.Fatal("Expected error")
+			}
+			if tc.err != "" && tc.err != err.Error() {
+				t.Fatalf("Expected error string %q but got: %q", tc.err, err.Error())
+			}
+		})
+	}
+}
+
 func TestParseErrorDetails(t *testing.T) {
 
 	tests := []struct {
@@ -2799,6 +4037,7 @@ func TestAnnotations(t *testing.T) {
 		expNumComments int
 		expAnnotations []*Annotations
 		expError       string
+		expErrorRow    int
 	}{
 		{
 			note: "Single valid annotation",
@@ -3012,6 +4251,14 @@ public_servers[server] {
 }`,
 			expNumComments: 5,
 			expError:       "rego_parse_error: yaml: unmarshal errors:\n  line 3: cannot unmarshal !!str",
+			expErrorRow:    11,
+		},
+		{
+			note: "Ill-structured (invalid) annotation with control character (vertical tab)",
+			module: "# METADATA\n" +
+				"# title: foo\vbar\n" +
+				"package opa.examples\n",
+			expError: "rego_parse_error: yaml: control characters are not allowed",
 		},
 		{
 			note: "Indentation error in yaml",
@@ -3104,20 +4351,42 @@ public_servers_1[server] {
 			expNumComments: 9,
 			expAnnotations: []*Annotations{
 				{
-					Schemas: []*SchemaAnnotation{
-						{Path: dataServers, Schema: schemaServers},
-					},
+					Schemas: []*SchemaAnnotation{
+						{Path: dataServers, Schema: schemaServers},
+					},
+					Scope: annotationScopeRule,
+					node:  MustParseRule(`public_servers[server] { server = servers[i] }`),
+				},
+				{
+					Schemas: []*SchemaAnnotation{
+
+						{Path: dataNetworks, Schema: schemaNetworks},
+						{Path: dataPorts, Schema: schemaPorts},
+					},
+					Scope: annotationScopeRule,
+					node:  MustParseRule(`public_servers_1[server] { ports[k].networks[l] = networks[m].id; networks[m].public = true }`),
+				},
+			},
+		},
+		{
+			note: "multiple metadata blocks on a single rule",
+			module: `package test
+
+# METADATA
+# title: My rule
+
+# METADATA
+# title: My rule 2
+p { input = "str" }`,
+			expNumComments: 4,
+			expAnnotations: []*Annotations{
+				{
 					Scope: annotationScopeRule,
-					node:  MustParseRule(`public_servers[server] { server = servers[i] }`),
+					Title: "My rule",
 				},
 				{
-					Schemas: []*SchemaAnnotation{
-
-						{Path: dataNetworks, Schema: schemaNetworks},
-						{Path: dataPorts, Schema: schemaPorts},
-					},
 					Scope: annotationScopeRule,
-					node:  MustParseRule(`public_servers_1[server] { ports[k].networks[l] = networks[m].id; networks[m].public = true }`),
+					Title: "My rule 2",
 				},
 			},
 		},
@@ -3144,6 +4413,33 @@ p := 7`,
 				{Scope: annotationScopeRule},
 			},
 		},
+		{
+			note: "annotation on package",
+			module: `# METADATA
+# title: My package
+package test
+
+p { input = "str" }`,
+			expNumComments: 2,
+			expAnnotations: []*Annotations{
+				{
+					Scope: annotationScopePackage,
+					Title: "My package",
+				},
+			},
+		},
+		{
+			note: "annotation on import",
+			module: `package test
+
+# METADATA
+# title: My import
+import input.foo
+
+p { input = "str" }`,
+			expNumComments: 2,
+			expError:       "1 error occurred: test.rego:3: rego_parse_error: invalid annotation scope 'import'",
+		},
 		{
 			note: "Default rule scope",
 			module: `
@@ -3221,6 +4517,87 @@ p { input = "str" }`,
 				},
 			},
 		},
+		{
+			note: "Rich meta",
+			module: `package test
+
+# METADATA
+# title: My rule
+# description: |
+#  My rule has a
+#  multiline description.
+# organizations:
+# - Acme Corp.
+# - Soylent Corp.
+# - Tyrell Corp.
+# related_resources:
+# - https://example.com
+# - 
+#  ref: http://john:123@do.re/mi?foo=bar#baz
+#  description: foo bar
+# authors:
+# - John Doe <john@example.com>
+# - name: Jane Doe
+#   email: jane@example.com
+# custom:
+#  list:
+#   - a
+#   - b
+#  map:
+#   a: 1
+#   b: 2.2
+#   c:
+#    "3": d
+#    "4": e
+#  number: 42
+#  string: foo bar baz
+#  flag:
+p { input = "str" }`,
+			expNumComments: 31,
+			expAnnotations: []*Annotations{
+				{
+					Scope:         annotationScopeRule,
+					Title:         "My rule",
+					Description:   "My rule has a\nmultiline description.\n",
+					Organizations: []string{"Acme Corp.", "Soylent Corp.", "Tyrell Corp."},
+					RelatedResources: []*RelatedResourceAnnotation{
+						{
+							Ref: mustParseURL("https://example.com"),
+						},
+						{
+							Ref:         mustParseURL("http://john:123@do.re/mi?foo=bar#baz"),
+							Description: "foo bar",
+						},
+					},
+					Authors: []*AuthorAnnotation{
+						{
+							Name:  "John Doe",
+							Email: "john@example.com",
+						},
+						{
+							Name:  "Jane Doe",
+							Email: "jane@example.com",
+						},
+					},
+					Custom: map[string]interface{}{
+						"list": []interface{}{
+							"a", "b",
+						},
+						"map": map[string]interface{}{
+							"a": 1,
+							"b": 2.2,
+							"c": map[string]interface{}{
+								"3": "d",
+								"4": "e",
+							},
+						},
+						"number": 42,
+						"string": "foo bar baz",
+						"flag":   nil,
+					},
+				},
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -3232,6 +4609,15 @@ p { input = "str" }`,
 				if tc.expError == "" || !strings.Contains(err.Error(), tc.expError) {
 					t.Fatalf("Unexpected parse error when getting annotations: %v", err)
 				}
+				if tc.expErrorRow != 0 {
+					if errs, ok := err.(Errors); !ok {
+						t.Fatalf("expected ast.Errors, got %v", err)
+					} else if len(errs) != 1 {
+						t.Fatalf("expected exactly one ast.Error, got %v: %v", len(errs), errs)
+					} else if loc := errs[0].Location; tc.expErrorRow != loc.Row {
+						t.Fatalf("expected error location row %v, got %v", tc.expErrorRow, loc.Row)
+					}
+				}
 				return
 			} else if tc.expError != "" {
 				t.Fatalf("Expected err: %v but no error from parse module", tc.expError)
@@ -3248,6 +4634,398 @@ p { input = "str" }`,
 	}
 }
 
+func TestAnnotationsAugmentedError(t *testing.T) {
+	tests := []struct {
+		note           string
+		module         string
+		expAnnotations []*Annotations
+		expErrorHint   string
+		expErrorRow    int
+	}{
+		{
+			note: "no whitespace after key/value separator",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# description:p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['p'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  4,
+		},
+		{
+			note: "non-breaking whitespace (\\u00A0) after key/value separator",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# description:\u00A0p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['\\u00a0'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  4,
+		},
+		{
+			note: "non-breaking whitespace (\\u00A0) after key/value separator (different line)",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# title: P\n" +
+				"# description:\u00A0p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 5, symbol(s) ['\\u00a0'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  5,
+		},
+		{
+			note: "non-breaking whitespace (\\u00A0) after key/value separator (different line)",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# title:\n" +
+				"#   P\n" +
+				"# description:\u00A0p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 6, symbol(s) ['\\u00a0'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  6,
+		},
+		{
+			note: "non-breaking whitespace (\\u00A0) after key/value separator (different line)",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# title:\u00A0P\n" +
+				"# description: p is true\n" +
+				"# scope: rule\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['\\u00a0'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  5,
+		},
+		{
+			note: "thin whitespace (\\u2009) after key/value separator",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# description:\u2009p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['\\u2009'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  4,
+		},
+		{
+			note: "ideographic whitespace (\\u3000) after key/value separator",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# description:\u3000p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['\\u3000'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  4,
+		},
+		{
+			note: "several offending runes after key/value separator on single line",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# descr:iption:\u3000p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['i' '\\u3000'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow:  4,
+		},
+		{
+			note: "several offending runes after key/value separator on single line",
+			module: "package opa.examples\n" +
+				"\n" +
+				"# METADATA\n" +
+				"# title:\u3000p\n" +
+				"# scope: rule\n" +
+				"# description:\u2009p is true\n" +
+				"p := true\n",
+			expErrorHint: "Hint: on line 4, symbol(s) ['\\u3000'] immediately following a key/value separator ':' is not a legal yaml space character\n" +
+				"  Hint: on line 6, symbol(s) ['\\u2009'] immediately following a key/value separator ':' is not a legal yaml space character",
+			expErrorRow: 5,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			_, err := ParseModuleWithOpts("test.rego", tc.module, ParserOptions{
+				ProcessAnnotation: true,
+			})
+
+			if err == nil {
+				t.Fatalf("Expected err with hint: %v but no error from parse module", tc.expErrorHint)
+			}
+
+			if !strings.Contains(err.Error(), tc.expErrorHint) {
+				t.Fatalf("Unexpected parse error when getting annotations: %v", err)
+			}
+
+			if errs, ok := err.(Errors); !ok {
+				t.Fatalf("expected ast.Errors, got %v", err)
+			} else if len(errs) != 1 {
+				t.Fatalf("expected exactly one ast.Error, got %v: %v", len(errs), errs)
+			} else if loc := errs[0].Location; tc.expErrorRow != loc.Row {
+				t.Fatalf("expected error location row %v, got %v", tc.expErrorRow, loc.Row)
+			}
+		})
+	}
+}
+
+func TestAuthorAnnotation(t *testing.T) {
+	tests := []struct {
+		note     string
+		raw      interface{}
+		expected interface{}
+	}{
+		{
+			note:     "no name",
+			raw:      "",
+			expected: fmt.Errorf("author is an empty string"),
+		},
+		{
+			note:     "only whitespaces",
+			raw:      " \t",
+			expected: fmt.Errorf("author is an empty string"),
+		},
+		{
+			note:     "one name only",
+			raw:      "John",
+			expected: AuthorAnnotation{Name: "John"},
+		},
+		{
+			note:     "multiple names",
+			raw:      "John Jr.\tDoe",
+			expected: AuthorAnnotation{Name: "John Jr. Doe"},
+		},
+		{
+			note:     "email only",
+			raw:      "<john@example.com>",
+			expected: AuthorAnnotation{Email: "john@example.com"},
+		},
+		{
+			note:     "name and email",
+			raw:      "John Doe <john@example.com>",
+			expected: AuthorAnnotation{Name: "John Doe", Email: "john@example.com"},
+		},
+		{
+			note:     "empty email",
+			raw:      "John Doe <>",
+			expected: AuthorAnnotation{Name: "John Doe"},
+		},
+		{
+			note:     "name with reserved characters",
+			raw:      "John Doe < >",
+			expected: AuthorAnnotation{Name: "John Doe < >"},
+		},
+		{
+			note:     "name with reserved characters (email with space)",
+			raw:      "<john@ example.com>",
+			expected: AuthorAnnotation{Name: "<john@ example.com>"},
+		},
+		{
+			note: "map with name",
+			raw: map[string]interface{}{
+				"name": "John Doe",
+			},
+			expected: AuthorAnnotation{Name: "John Doe"},
+		},
+		{
+			note: "map with email",
+			raw: map[string]interface{}{
+				"email": "john@example.com",
+			},
+			expected: AuthorAnnotation{Email: "john@example.com"},
+		},
+		{
+			note: "map with name and email",
+			raw: map[string]interface{}{
+				"name":  "John Doe",
+				"email": "john@example.com",
+			},
+			expected: AuthorAnnotation{Name: "John Doe", Email: "john@example.com"},
+		},
+		{
+			note: "map with extra entry",
+			raw: map[string]interface{}{
+				"name":  "John Doe",
+				"email": "john@example.com",
+				"foo":   "bar",
+			},
+			expected: AuthorAnnotation{Name: "John Doe", Email: "john@example.com"},
+		},
+		{
+			note:     "empty map",
+			raw:      map[string]interface{}{},
+			expected: fmt.Errorf("'name' and/or 'email' values required in object"),
+		},
+		{
+			note: "map with empty name",
+			raw: map[string]interface{}{
+				"name": "",
+			},
+			expected: fmt.Errorf("'name' and/or 'email' values required in object"),
+		},
+		{
+			note: "map with email and empty name",
+			raw: map[string]interface{}{
+				"name":  "",
+				"email": "john@example.com",
+			},
+			expected: AuthorAnnotation{Email: "john@example.com"},
+		},
+		{
+			note: "map with empty email",
+			raw: map[string]interface{}{
+				"email": "",
+			},
+			expected: fmt.Errorf("'name' and/or 'email' values required in object"),
+		},
+		{
+			note: "map with name and empty email",
+			raw: map[string]interface{}{
+				"name":  "John Doe",
+				"email": "",
+			},
+			expected: AuthorAnnotation{Name: "John Doe"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			parsed, err := parseAuthor(tc.raw)
+
+			switch expected := tc.expected.(type) {
+			case AuthorAnnotation:
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if parsed.Compare(&expected) != 0 {
+					t.Fatalf("expected %v but got %v", tc.expected, parsed)
+				}
+			case error:
+				if err == nil {
+					t.Fatalf("expected '%v' error but got %v", tc.expected, parsed)
+				}
+
+				if strings.Compare(expected.Error(), err.Error()) != 0 {
+					t.Fatalf("expected %v but got %v", tc.expected, err)
+				}
+			default:
+				t.Fatalf("Unexpected result type: %T", expected)
+			}
+		})
+	}
+}
+
+func TestRelatedResourceAnnotation(t *testing.T) {
+	tests := []struct {
+		note     string
+		raw      interface{}
+		expected interface{}
+	}{
+		{
+			note:     "empty ref URL",
+			raw:      "",
+			expected: fmt.Errorf("ref URL may not be empty string"),
+		},
+		{
+			note:     "only whitespaces in ref URL",
+			raw:      " \t",
+			expected: fmt.Errorf("parse \" \\t\": net/url: invalid control character in URL"),
+		},
+		{
+			note:     "invalid ref URL",
+			raw:      "https://foo:bar",
+			expected: fmt.Errorf("parse \"https://foo:bar\": invalid port \":bar\" after host"),
+		},
+		{
+			note:     "ref URL as string",
+			raw:      "https://example.com/foo?bar#baz",
+			expected: RelatedResourceAnnotation{Ref: mustParseURL("https://example.com/foo?bar#baz")},
+		},
+		{
+			note: "map with only ref",
+			raw: map[string]interface{}{
+				"ref": "https://example.com/foo?bar#baz",
+			},
+			expected: RelatedResourceAnnotation{Ref: mustParseURL("https://example.com/foo?bar#baz")},
+		},
+		{
+			note: "map with only description",
+			raw: map[string]interface{}{
+				"description": "foo bar",
+			},
+			expected: fmt.Errorf("'ref' value required in object"),
+		},
+		{
+			note: "map with ref and description",
+			raw: map[string]interface{}{
+				"ref":         "https://example.com/foo?bar#baz",
+				"description": "foo bar",
+			},
+			expected: RelatedResourceAnnotation{
+				Ref:         mustParseURL("https://example.com/foo?bar#baz"),
+				Description: "foo bar",
+			},
+		},
+		{
+			note: "map with ref and description",
+			raw: map[string]interface{}{
+				"ref":         "https://example.com/foo?bar#baz",
+				"description": "foo bar",
+				"foo":         "bar",
+			},
+			expected: RelatedResourceAnnotation{
+				Ref:         mustParseURL("https://example.com/foo?bar#baz"),
+				Description: "foo bar",
+			},
+		},
+		{
+			note:     "empty map",
+			raw:      map[string]interface{}{},
+			expected: fmt.Errorf("'ref' value required in object"),
+		},
+		{
+			note: "map with empty ref",
+			raw: map[string]interface{}{
+				"ref": "",
+			},
+			expected: fmt.Errorf("'ref' value required in object"),
+		},
+		{
+			note: "map with only whitespace in ref",
+			raw: map[string]interface{}{
+				"ref": " \t",
+			},
+			expected: fmt.Errorf("'ref' value required in object"),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			parsed, err := parseRelatedResource(tc.raw)
+
+			switch expected := tc.expected.(type) {
+			case RelatedResourceAnnotation:
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				if parsed.Compare(&expected) != 0 {
+					t.Fatalf("expected %v but got %v", tc.expected, parsed)
+				}
+			case error:
+				if err == nil {
+					t.Fatalf("expected '%v' error but got %v", tc.expected, parsed)
+				}
+
+				if strings.Compare(expected.Error(), err.Error()) != 0 {
+					t.Fatalf("expected %v but got %v", tc.expected, err)
+				}
+			default:
+				t.Fatalf("Unexpected result type: %T", expected)
+			}
+		})
+	}
+}
+
 func assertLocationText(t *testing.T, expected string, actual *Location) {
 	t.Helper()
 	if actual == nil || actual.Text == nil {
@@ -3266,21 +5044,28 @@ func assertParseError(t *testing.T, msg string, input string) {
 	})
 }
 
-func assertParseErrorContains(t *testing.T, msg string, input string, expected string) {
+func assertParseErrorContains(t *testing.T, msg string, input string, expected string, opts ...ParserOptions) {
 	t.Helper()
 	assertParseErrorFunc(t, msg, input, func(result string) {
 		t.Helper()
 		if !strings.Contains(result, expected) {
 			t.Errorf("Error on test \"%s\": expected parse error to contain:\n\n%v\n\nbut got:\n\n%v", msg, expected, result)
 		}
-	})
+	}, opts...)
 }
 
-func assertParseErrorFunc(t *testing.T, msg string, input string, f func(string)) {
+func assertParseErrorFunc(t *testing.T, msg string, input string, f func(string), opts ...ParserOptions) {
 	t.Helper()
-	p, err := ParseStatement(input)
+	opt := ParserOptions{}
+	if len(opts) == 1 {
+		opt = opts[0]
+	}
+	stmts, _, err := ParseStatementsWithOpts("", input, opt)
+	if err == nil && len(stmts) != 1 {
+		err = fmt.Errorf("expected exactly one statement")
+	}
 	if err == nil {
-		t.Errorf("Error on test \"%s\": expected parse error but parsed successfully:\n\n%v\n\n(parsed)", msg, p)
+		t.Errorf("Error on test \"%s\": expected parse error on %s: expected no statements, got %d: %v", msg, input, len(stmts), stmts)
 		return
 	}
 	result := err.Error()
@@ -3290,7 +5075,7 @@ func assertParseErrorFunc(t *testing.T, msg string, input string, f func(string)
 	f(result)
 }
 
-func assertParseImport(t *testing.T, msg string, input string, correct *Import) {
+func assertParseImport(t *testing.T, msg string, input string, correct *Import, opts ...ParserOptions) {
 	t.Helper()
 	assertParseOne(t, msg, input, func(parsed interface{}) {
 		t.Helper()
@@ -3298,12 +5083,15 @@ func assertParseImport(t *testing.T, msg string, input string, correct *Import)
 		if !imp.Equal(correct) {
 			t.Errorf("Error on test \"%s\": imports not equal: %v (parsed), %v (correct)", msg, imp, correct)
 		}
-	})
+	}, opts...)
 }
 
-func assertParseModule(t *testing.T, msg string, input string, correct *Module) {
-
-	m, err := ParseModule("", input)
+func assertParseModule(t *testing.T, msg string, input string, correct *Module, opts ...ParserOptions) {
+	opt := ParserOptions{}
+	if len(opts) == 1 {
+		opt = opts[0]
+	}
+	m, err := ParseModuleWithOpts("", input, opt)
 	if err != nil {
 		t.Errorf("Error on test \"%s\": parse error on %s: %s", msg, input, err)
 		return
@@ -3315,6 +5103,53 @@ func assertParseModule(t *testing.T, msg string, input string, correct *Module)
 
 }
 
+func assertParseModuleJSONOptions(t *testing.T, msg string, input string, opts ...ParserOptions) {
+	opt := ParserOptions{}
+	if len(opts) == 1 {
+		opt = opts[0]
+	}
+	m, err := ParseModuleWithOpts("", input, opt)
+	if err != nil {
+		t.Errorf("Error on test \"%s\": parse error on %s: %s", msg, input, err)
+		return
+	}
+
+	if len(m.Rules) != 1 {
+		t.Fatalf("Error on test \"%s\": expected 1 rule but got %d", msg, len(m.Rules))
+	}
+
+	rule := m.Rules[0]
+	if rule.Head.jsonOptions != *opt.JSONOptions {
+		t.Fatalf("Error on test \"%s\": expected rule Head JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, rule.Head.jsonOptions)
+	}
+	if rule.Body[0].jsonOptions != *opt.JSONOptions {
+		t.Fatalf("Error on test \"%s\": expected rule Body JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, rule.Body[0].jsonOptions)
+	}
+	switch terms := rule.Body[0].Terms.(type) {
+	case []*Term:
+		for _, term := range terms {
+			if term.jsonOptions != *opt.JSONOptions {
+				t.Fatalf("Error on test \"%s\": expected body Term JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, term.jsonOptions)
+			}
+		}
+	case *SomeDecl:
+		if terms.jsonOptions != *opt.JSONOptions {
+			t.Fatalf("Error on test \"%s\": expected body Term JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, terms.jsonOptions)
+		}
+	case *Every:
+		if terms.jsonOptions != *opt.JSONOptions {
+			t.Fatalf("Error on test \"%s\": expected body Term JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, terms.jsonOptions)
+		}
+	case *Term:
+		if terms.jsonOptions != *opt.JSONOptions {
+			t.Fatalf("Error on test \"%s\": expected body Term JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, terms.jsonOptions)
+		}
+	}
+	if rule.jsonOptions != *opt.JSONOptions {
+		t.Fatalf("Error on test \"%s\": expected rule JSONOptions\n%v\n, got\n%v", msg, *opt.JSONOptions, rule.jsonOptions)
+	}
+}
+
 func assertParseModuleError(t *testing.T, msg, input string) {
 	m, err := ParseModule("", input)
 	if err == nil {
@@ -3338,14 +5173,14 @@ func assertParseOne(t *testing.T, msg string, input string, correct func(interfa
 		opt = opts[0]
 	}
 	stmts, _, err := ParseStatementsWithOpts("", input, opt)
-	if len(stmts) != 1 {
-		t.Errorf("Error on test \"%s\": parse error on %s: expected exactly one statement, got %d", msg, input, len(stmts))
-		return
-	}
 	if err != nil {
 		t.Errorf("Error on test \"%s\": parse error on %s: %s", msg, input, err)
 		return
 	}
+	if len(stmts) != 1 {
+		t.Errorf("Error on test \"%s\": parse error on %s: expected exactly one statement, got %d: %v", msg, input, len(stmts), stmts)
+		return
+	}
 	correct(stmts[0])
 }
 
@@ -3393,13 +5228,23 @@ func assertParseOneTermNegated(t *testing.T, msg string, input string, correct *
 	assertParseOneExprNegated(t, msg, input, &Expr{Terms: correct})
 }
 
-func assertParseRule(t *testing.T, msg string, input string, correct *Rule) {
+func assertParseRule(t *testing.T, msg string, input string, correct *Rule, opts ...ParserOptions) {
 	t.Helper()
 	assertParseOne(t, msg, input, func(parsed interface{}) {
 		t.Helper()
 		rule := parsed.(*Rule)
+		if rule.Head.Name != correct.Head.Name {
+			t.Errorf("Error on test \"%s\": rule heads not equal: name = %v (parsed), name = %v (correct)", msg, rule.Head.Name, correct.Head.Name)
+		}
+		if !rule.Head.Ref().Equal(correct.Head.Ref()) {
+			t.Errorf("Error on test \"%s\": rule heads not equal: ref = %v (parsed), ref = %v (correct)", msg, rule.Head.Ref(), correct.Head.Ref())
+		}
+		if !rule.Head.Equal(correct.Head) {
+			t.Errorf("Error on test \"%s\": rule heads not equal: %v (parsed), %v (correct)", msg, rule.Head, correct.Head)
+		}
 		if !rule.Equal(correct) {
 			t.Errorf("Error on test \"%s\": rules not equal: %v (parsed), %v (correct)", msg, rule, correct)
 		}
-	})
+	},
+		opts...)
 }
diff --git a/ast/policy.go b/ast/policy.go
index 26b6d78e0d..caf756f6aa 100644
--- a/ast/policy.go
+++ b/ast/policy.go
@@ -144,68 +144,66 @@ type (
 		Annotations []*Annotations `json:"annotations,omitempty"`
 		Rules       []*Rule        `json:"rules,omitempty"`
 		Comments    []*Comment     `json:"comments,omitempty"`
+		stmts       []Statement
 	}
 
 	// Comment contains the raw text from the comment in the definition.
 	Comment struct {
+		// TODO: these fields have inconsistent JSON keys with other structs in this package.
 		Text     []byte
 		Location *Location
-	}
-
-	// Annotations represents metadata attached to other AST nodes such as rules.
-	Annotations struct {
-		Location *Location           `json:"-"`
-		Scope    string              `json:"scope"`
-		Schemas  []*SchemaAnnotation `json:"schemas,omitempty"`
-		node     Node
-	}
 
-	// SchemaAnnotation contains a schema declaration for the document identified by the path.
-	SchemaAnnotation struct {
-		Path       Ref          `json:"path"`
-		Schema     Ref          `json:"schema,omitempty"`
-		Definition *interface{} `json:"definition,omitempty"`
+		jsonOptions JSONOptions
 	}
 
 	// Package represents the namespace of the documents produced
 	// by rules inside the module.
 	Package struct {
-		Location *Location `json:"-"`
 		Path     Ref       `json:"path"`
+		Location *Location `json:"location,omitempty"`
+
+		jsonOptions JSONOptions
 	}
 
 	// Import represents a dependency on a document outside of the policy
 	// namespace. Imports are optional.
 	Import struct {
-		Location *Location `json:"-"`
 		Path     *Term     `json:"path"`
 		Alias    Var       `json:"alias,omitempty"`
+		Location *Location `json:"location,omitempty"`
+
+		jsonOptions JSONOptions
 	}
 
 	// Rule represents a rule as defined in the language. Rules define the
 	// content of documents that represent policy decisions.
 	Rule struct {
-		Location *Location `json:"-"`
 		Default  bool      `json:"default,omitempty"`
 		Head     *Head     `json:"head"`
 		Body     Body      `json:"body"`
 		Else     *Rule     `json:"else,omitempty"`
+		Location *Location `json:"location,omitempty"`
 
 		// Module is a pointer to the module containing this rule. If the rule
 		// was NOT created while parsing/constructing a module, this should be
 		// left unset. The pointer is not included in any standard operations
 		// on the rule (e.g., printing, comparison, visiting, etc.)
 		Module *Module `json:"-"`
+
+		jsonOptions JSONOptions
 	}
 
 	// Head represents the head of a rule.
 	Head struct {
-		Location *Location `json:"-"`
-		Name     Var       `json:"name"`
-		Args     Args      `json:"args,omitempty"`
-		Key      *Term     `json:"key,omitempty"`
-		Value    *Term     `json:"value,omitempty"`
-		Assign   bool      `json:"assign,omitempty"`
+		Name      Var       `json:"name,omitempty"`
+		Reference Ref       `json:"ref,omitempty"`
+		Args      Args      `json:"args,omitempty"`
+		Key       *Term     `json:"key,omitempty"`
+		Value     *Term     `json:"value,omitempty"`
+		Assign    bool      `json:"assign,omitempty"`
+		Location  *Location `json:"location,omitempty"`
+
+		jsonOptions JSONOptions
 	}
 
 	// Args represents zero or more arguments to a rule.
@@ -219,141 +217,41 @@ type (
 	Expr struct {
 		With      []*With     `json:"with,omitempty"`
 		Terms     interface{} `json:"terms"`
-		Location  *Location   `json:"-"`
 		Index     int         `json:"index"`
 		Generated bool        `json:"generated,omitempty"`
 		Negated   bool        `json:"negated,omitempty"`
+		Location  *Location   `json:"location,omitempty"`
+
+		jsonOptions JSONOptions
 	}
 
 	// SomeDecl represents a variable declaration statement. The symbols are variables.
 	SomeDecl struct {
-		Location *Location `json:"-"`
 		Symbols  []*Term   `json:"symbols"`
-	}
-
-	// With represents a modifier on an expression.
-	With struct {
-		Location *Location `json:"-"`
-		Target   *Term     `json:"target"`
-		Value    *Term     `json:"value"`
-	}
-)
-
-func (s *Annotations) String() string {
-	bs, _ := json.Marshal(s)
-	return string(bs)
-}
-
-// Loc returns the location of this annotation.
-func (s *Annotations) Loc() *Location {
-	return s.Location
-}
-
-// SetLoc updates the location of this annotation.
-func (s *Annotations) SetLoc(l *Location) {
-	s.Location = l
-}
-
-// Compare returns an integer indicating if s is less than, equal to, or greater
-// than other.
-func (s *Annotations) Compare(other *Annotations) int {
-
-	if cmp := scopeCompare(s.Scope, other.Scope); cmp != 0 {
-		return cmp
-	}
-
-	max := len(s.Schemas)
-	if len(other.Schemas) < max {
-		max = len(other.Schemas)
-	}
-
-	for i := 0; i < max; i++ {
-		if cmp := s.Schemas[i].Compare(other.Schemas[i]); cmp != 0 {
-			return cmp
-		}
-	}
-
-	if len(s.Schemas) > len(other.Schemas) {
-		return 1
-	} else if len(s.Schemas) < len(other.Schemas) {
-		return -1
-	}
+		Location *Location `json:"location,omitempty"`
 
-	return 0
-}
-
-// Copy returns a deep copy of s.
-func (s *Annotations) Copy(node Node) *Annotations {
-	cpy := *s
-	cpy.Schemas = make([]*SchemaAnnotation, len(s.Schemas))
-	for i := range cpy.Schemas {
-		cpy.Schemas[i] = s.Schemas[i].Copy()
+		jsonOptions JSONOptions
 	}
-	cpy.node = node
-	return &cpy
-}
 
-// Copy returns a deep copy of s.
-func (s *SchemaAnnotation) Copy() *SchemaAnnotation {
-	cpy := *s
-	return &cpy
-}
-
-// Compare returns an integer indicating if s is less than, equal to, or greater
-// than other.
-func (s *SchemaAnnotation) Compare(other *SchemaAnnotation) int {
-
-	if cmp := s.Path.Compare(other.Path); cmp != 0 {
-		return cmp
-	}
-
-	if cmp := s.Schema.Compare(other.Schema); cmp != 0 {
-		return cmp
-	}
-
-	if s.Definition != nil && other.Definition == nil {
-		return -1
-	} else if s.Definition == nil && other.Definition != nil {
-		return 1
-	} else if s.Definition != nil && other.Definition != nil {
-		return util.Compare(*s.Definition, *other.Definition)
-	}
-
-	return 0
-}
-
-func (s *SchemaAnnotation) String() string {
-	bs, _ := json.Marshal(s)
-	return string(bs)
-}
-
-func scopeCompare(s1, s2 string) int {
-
-	o1 := scopeOrder(s1)
-	o2 := scopeOrder(s2)
-
-	if o2 < o1 {
-		return 1
-	} else if o2 > o1 {
-		return -1
-	}
+	Every struct {
+		Key      *Term     `json:"key"`
+		Value    *Term     `json:"value"`
+		Domain   *Term     `json:"domain"`
+		Body     Body      `json:"body"`
+		Location *Location `json:"location,omitempty"`
 
-	if s1 < s2 {
-		return -1
-	} else if s2 < s1 {
-		return 1
+		jsonOptions JSONOptions
 	}
 
-	return 0
-}
+	// With represents a modifier on an expression.
+	With struct {
+		Target   *Term     `json:"target"`
+		Value    *Term     `json:"value"`
+		Location *Location `json:"location,omitempty"`
 
-func scopeOrder(s string) int {
-	switch s {
-	case annotationScopeRule:
-		return 1
+		jsonOptions JSONOptions
 	}
-	return 0
-}
+)
 
 // Compare returns an integer indicating whether mod is less than, equal to,
 // or greater than other.
@@ -383,32 +281,22 @@ func (mod *Module) Copy() *Module {
 	cpy := *mod
 	cpy.Rules = make([]*Rule, len(mod.Rules))
 
-	var nodes map[Node]Node
-
-	if len(mod.Annotations) > 0 {
-		nodes = make(map[Node]Node)
-	}
+	nodes := make(map[Node]Node, len(mod.Rules)+len(mod.Imports)+1 /* package */)
 
 	for i := range mod.Rules {
 		cpy.Rules[i] = mod.Rules[i].Copy()
 		cpy.Rules[i].Module = &cpy
-		if nodes != nil {
-			nodes[mod.Rules[i]] = cpy.Rules[i]
-		}
+		nodes[mod.Rules[i]] = cpy.Rules[i]
 	}
 
 	cpy.Imports = make([]*Import, len(mod.Imports))
 	for i := range mod.Imports {
 		cpy.Imports[i] = mod.Imports[i].Copy()
-		if nodes != nil {
-			nodes[mod.Imports[i]] = cpy.Imports[i]
-		}
+		nodes[mod.Imports[i]] = cpy.Imports[i]
 	}
 
 	cpy.Package = mod.Package.Copy()
-	if nodes != nil {
-		nodes[mod.Package] = cpy.Package
-	}
+	nodes[mod.Package] = cpy.Package
 
 	cpy.Annotations = make([]*Annotations, len(mod.Annotations))
 	for i := range mod.Annotations {
@@ -420,6 +308,11 @@ func (mod *Module) Copy() *Module {
 		cpy.Comments[i] = mod.Comments[i].Copy()
 	}
 
+	cpy.stmts = make([]Statement, len(mod.stmts))
+	for i := range mod.stmts {
+		cpy.stmts[i] = nodes[mod.stmts[i]]
+	}
+
 	return &cpy
 }
 
@@ -535,6 +428,12 @@ func (c *Comment) Equal(other *Comment) bool {
 	return c.Location.Equal(other.Location) && bytes.Equal(c.Text, other.Text)
 }
 
+func (c *Comment) setJSONOptions(opts JSONOptions) {
+	// Note: this is not used for location since Comments use default JSON marshaling
+	// behavior with struct field names in JSON.
+	c.jsonOptions = opts
+}
+
 // Compare returns an integer indicating whether pkg is less than, equal to,
 // or greater than other.
 func (pkg *Package) Compare(other *Package) int {
@@ -579,6 +478,24 @@ func (pkg *Package) String() string {
 	return fmt.Sprintf("package %v", path)
 }
 
+func (pkg *Package) setJSONOptions(opts JSONOptions) {
+	pkg.jsonOptions = opts
+}
+
+func (pkg *Package) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"path": pkg.Path,
+	}
+
+	if pkg.jsonOptions.MarshalOptions.IncludeLocation.Package {
+		if pkg.Location != nil {
+			data["location"] = pkg.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
 // IsValidImportPath returns an error indicating if the import path is invalid.
 // If the import path is invalid, err is nil.
 func IsValidImportPath(v Value) (err error) {
@@ -671,6 +588,28 @@ func (imp *Import) String() string {
 	return strings.Join(buf, " ")
 }
 
+func (imp *Import) setJSONOptions(opts JSONOptions) {
+	imp.jsonOptions = opts
+}
+
+func (imp *Import) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"path": imp.Path,
+	}
+
+	if len(imp.Alias) != 0 {
+		data["alias"] = imp.Alias
+	}
+
+	if imp.jsonOptions.MarshalOptions.IncludeLocation.Import {
+		if imp.Location != nil {
+			data["location"] = imp.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
 // Compare returns an integer indicating whether rule is less than, equal to,
 // or greater than other.
 func (rule *Rule) Compare(other *Rule) int {
@@ -725,11 +664,22 @@ func (rule *Rule) SetLoc(loc *Location) {
 
 // Path returns a ref referring to the document produced by this rule. If rule
 // is not contained in a module, this function panics.
+// Deprecated: Poor handling of ref rules. Use `(*Rule).Ref()` instead.
 func (rule *Rule) Path() Ref {
 	if rule.Module == nil {
 		panic("assertion failed")
 	}
-	return rule.Module.Package.Path.Append(StringTerm(string(rule.Head.Name)))
+	return rule.Module.Package.Path.Extend(rule.Head.Ref().GroundPrefix())
+}
+
+// Ref returns a ref referring to the document produced by this rule. If rule
+// is not contained in a module, this function panics. The returned ref may
+// contain variables in the last position.
+func (rule *Rule) Ref() Ref {
+	if rule.Module == nil {
+		panic("assertion failed")
+	}
+	return rule.Module.Package.Path.Extend(rule.Head.Ref())
 }
 
 func (rule *Rule) String() string {
@@ -749,6 +699,33 @@ func (rule *Rule) String() string {
 	return strings.Join(buf, " ")
 }
 
+func (rule *Rule) setJSONOptions(opts JSONOptions) {
+	rule.jsonOptions = opts
+}
+
+func (rule *Rule) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"head": rule.Head,
+		"body": rule.Body,
+	}
+
+	if rule.Default {
+		data["default"] = true
+	}
+
+	if rule.Else != nil {
+		data["else"] = rule.Else
+	}
+
+	if rule.jsonOptions.MarshalOptions.IncludeLocation.Rule {
+		if rule.Location != nil {
+			data["location"] = rule.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
 func (rule *Rule) elseString() string {
 	var buf []string
 
@@ -775,7 +752,8 @@ func (rule *Rule) elseString() string {
 // used for the key and the second will be used for the value.
 func NewHead(name Var, args ...*Term) *Head {
 	head := &Head{
-		Name: name,
+		Name:      name, // backcompat
+		Reference: []*Term{NewTerm(name)},
 	}
 	if len(args) == 0 {
 		return head
@@ -785,6 +763,23 @@ func NewHead(name Var, args ...*Term) *Head {
 		return head
 	}
 	head.Value = args[1]
+	if head.Key != nil && head.Value != nil {
+		head.Reference = head.Reference.Append(args[0])
+	}
+	return head
+}
+
+// RefHead returns a new Head object with the passed Ref. If args are provided,
+// the first will be used for the value.
+func RefHead(ref Ref, args ...*Term) *Head {
+	head := &Head{}
+	head.SetRef(ref)
+	if len(ref) < 2 {
+		head.Name = ref[0].Value.(Var)
+	}
+	if len(args) >= 1 {
+		head.Value = args[0]
+	}
 	return head
 }
 
@@ -800,7 +795,7 @@ const (
 
 	// PartialObjectDoc represents an object document that is partially defined by the rule.
 	PartialObjectDoc
-)
+) // TODO(sr): Deprecate?
 
 // DocKind returns the type of document produced by this rule.
 func (head *Head) DocKind() DocKind {
@@ -813,6 +808,41 @@ func (head *Head) DocKind() DocKind {
 	return CompleteDoc
 }
 
+type RuleKind int
+
+const (
+	SingleValue = iota
+	MultiValue
+)
+
+// RuleKind returns the type of rule this is
+func (head *Head) RuleKind() RuleKind {
+	// NOTE(sr): This is bit verbose, since the key is irrelevant for single vs
+	//           multi value, but as good a spot as to assert the invariant.
+	switch {
+	case head.Value != nil:
+		return SingleValue
+	case head.Key != nil:
+		return MultiValue
+	default:
+		panic("unreachable")
+	}
+}
+
+// Ref returns the Ref of the rule. If it doesn't have one, it's filled in
+// via the Head's Name.
+func (head *Head) Ref() Ref {
+	if len(head.Reference) > 0 {
+		return head.Reference
+	}
+	return Ref{&Term{Value: head.Name}}
+}
+
+// SetRef can be used to set a rule head's Reference
+func (head *Head) SetRef(r Ref) {
+	head.Reference = r
+}
+
 // Compare returns an integer indicating whether head is less than, equal to,
 // or greater than other.
 func (head *Head) Compare(other *Head) int {
@@ -832,6 +862,9 @@ func (head *Head) Compare(other *Head) int {
 	if cmp := Compare(head.Args, other.Args); cmp != 0 {
 		return cmp
 	}
+	if cmp := Compare(head.Reference, other.Reference); cmp != 0 {
+		return cmp
+	}
 	if cmp := Compare(head.Name, other.Name); cmp != 0 {
 		return cmp
 	}
@@ -844,6 +877,7 @@ func (head *Head) Compare(other *Head) int {
 // Copy returns a deep copy of head.
 func (head *Head) Copy() *Head {
 	cpy := *head
+	cpy.Reference = head.Reference.Copy()
 	cpy.Args = head.Args.Copy()
 	cpy.Key = head.Key.Copy()
 	cpy.Value = head.Value.Copy()
@@ -856,23 +890,57 @@ func (head *Head) Equal(other *Head) bool {
 }
 
 func (head *Head) String() string {
-	var buf []string
-	if len(head.Args) != 0 {
-		buf = append(buf, head.Name.String()+head.Args.String())
-	} else if head.Key != nil {
-		buf = append(buf, head.Name.String()+"["+head.Key.String()+"]")
-	} else {
-		buf = append(buf, head.Name.String())
+	buf := strings.Builder{}
+	buf.WriteString(head.Ref().String())
+
+	switch {
+	case len(head.Args) != 0:
+		buf.WriteString(head.Args.String())
+	case len(head.Reference) == 1 && head.Key != nil:
+		buf.WriteRune('[')
+		buf.WriteString(head.Key.String())
+		buf.WriteRune(']')
 	}
 	if head.Value != nil {
 		if head.Assign {
-			buf = append(buf, ":=")
+			buf.WriteString(" := ")
 		} else {
-			buf = append(buf, "=")
+			buf.WriteString(" = ")
 		}
-		buf = append(buf, head.Value.String())
+		buf.WriteString(head.Value.String())
+	} else if head.Name == "" && head.Key != nil {
+		buf.WriteString(" contains ")
+		buf.WriteString(head.Key.String())
 	}
-	return strings.Join(buf, " ")
+	return buf.String()
+}
+
+func (head *Head) setJSONOptions(opts JSONOptions) {
+	head.jsonOptions = opts
+}
+
+func (head *Head) MarshalJSON() ([]byte, error) {
+	var loc *Location
+	if head.jsonOptions.MarshalOptions.IncludeLocation.Head {
+		if head.Location != nil {
+			loc = head.Location
+		}
+	}
+
+	// NOTE(sr): we do this to override the rendering of `head.Reference`.
+	// It's still what'll be used via the default means of encoding/json
+	// for unmarshaling a json object into a Head struct!
+	// NOTE(charlieegan3): we also need to optionally include the location
+	type h Head
+	return json.Marshal(struct {
+		h
+		Ref      Ref       `json:"ref"`
+		Location *Location `json:"location,omitempty"`
+	}{
+		h:        h(*head),
+		Ref:      head.Ref(),
+		Location: loc,
+	})
 }
 
 // Vars returns a set of vars found in the head.
@@ -888,6 +956,9 @@ func (head *Head) Vars() VarSet {
 	if head.Value != nil {
 		vis.Walk(head.Value)
 	}
+	if len(head.Reference) > 0 {
+		vis.Walk(head.Reference[1:])
+	}
 	return vis.vars
 }
 
@@ -914,7 +985,7 @@ func (a Args) Copy() Args {
 }
 
 func (a Args) String() string {
-	var buf []string
+	buf := make([]string, 0, len(a))
 	for _, t := range a {
 		buf = append(buf, t.String())
 	}
@@ -959,7 +1030,8 @@ func (body Body) MarshalJSON() ([]byte, error) {
 	if len(body) == 0 {
 		return []byte(`[]`), nil
 	}
-	return json.Marshal([]*Expr(body))
+	ret, err := json.Marshal([]*Expr(body))
+	return ret, err
 }
 
 // Append adds the expr to the body and updates the expr's index accordingly.
@@ -1058,7 +1130,7 @@ func (body Body) SetLoc(loc *Location) {
 }
 
 func (body Body) String() string {
-	var buf []string
+	buf := make([]string, 0, len(body))
 	for _, v := range body {
 		buf = append(buf, v.String())
 	}
@@ -1075,6 +1147,11 @@ func (body Body) Vars(params VarVisitorParams) VarSet {
 
 // NewExpr returns a new Expr object.
 func NewExpr(terms interface{}) *Expr {
+	switch terms.(type) {
+	case *SomeDecl, *Every, *Term, []*Term: // ok
+	default:
+		panic("unreachable")
+	}
 	return &Expr{
 		Negated: false,
 		Terms:   terms,
@@ -1153,6 +1230,10 @@ func (expr *Expr) Compare(other *Expr) int {
 		if cmp := Compare(t, other.Terms.(*SomeDecl)); cmp != 0 {
 			return cmp
 		}
+	case *Every:
+		if cmp := Compare(t, other.Terms.(*Every)); cmp != 0 {
+			return cmp
+		}
 	}
 
 	return withSliceCompare(expr.With, other.With)
@@ -1166,14 +1247,28 @@ func (expr *Expr) sortOrder() int {
 		return 1
 	case []*Term:
 		return 2
+	case *Every:
+		return 3
 	}
 	return -1
 }
 
+// CopyWithoutTerms returns a deep copy of expr without its Terms
+func (expr *Expr) CopyWithoutTerms() *Expr {
+	cpy := *expr
+
+	cpy.With = make([]*With, len(expr.With))
+	for i := range expr.With {
+		cpy.With[i] = expr.With[i].Copy()
+	}
+
+	return &cpy
+}
+
 // Copy returns a deep copy of expr.
 func (expr *Expr) Copy() *Expr {
 
-	cpy := *expr
+	cpy := expr.CopyWithoutTerms()
 
 	switch ts := expr.Terms.(type) {
 	case *SomeDecl:
@@ -1186,14 +1281,11 @@ func (expr *Expr) Copy() *Expr {
 		cpy.Terms = cpyTs
 	case *Term:
 		cpy.Terms = ts.Copy()
+	case *Every:
+		cpy.Terms = ts.Copy()
 	}
 
-	cpy.With = make([]*With, len(expr.With))
-	for i := range expr.With {
-		cpy.With[i] = expr.With[i].Copy()
-	}
-
-	return &cpy
+	return cpy
 }
 
 // Hash returns the hash code of the Expr.
@@ -1248,6 +1340,18 @@ func (expr *Expr) IsCall() bool {
 	return ok
 }
 
+// IsEvery returns true if this expression is an 'every' expression.
+func (expr *Expr) IsEvery() bool {
+	_, ok := expr.Terms.(*Every)
+	return ok
+}
+
+// IsSome returns true if this expression is a 'some' expression.
+func (expr *Expr) IsSome() bool {
+	_, ok := expr.Terms.(*SomeDecl)
+	return ok
+}
+
 // Operator returns the name of the function or built-in this expression refers
 // to. If this expression is not a function call, returns nil.
 func (expr *Expr) Operator() Ref {
@@ -1333,7 +1437,7 @@ func (expr *Expr) SetLoc(loc *Location) {
 }
 
 func (expr *Expr) String() string {
-	var buf []string
+	buf := make([]string, 0, 2+len(expr.With))
 	if expr.Negated {
 		buf = append(buf, "not")
 	}
@@ -1344,9 +1448,7 @@ func (expr *Expr) String() string {
 		} else {
 			buf = append(buf, Call(t).String())
 		}
-	case *Term:
-		buf = append(buf, t.String())
-	case *SomeDecl:
+	case fmt.Stringer:
 		buf = append(buf, t.String())
 	}
 
@@ -1357,6 +1459,37 @@ func (expr *Expr) String() string {
 	return strings.Join(buf, " ")
 }
 
+func (expr *Expr) setJSONOptions(opts JSONOptions) {
+	expr.jsonOptions = opts
+}
+
+func (expr *Expr) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"terms": expr.Terms,
+		"index": expr.Index,
+	}
+
+	if len(expr.With) > 0 {
+		data["with"] = expr.With
+	}
+
+	if expr.Generated {
+		data["generated"] = true
+	}
+
+	if expr.Negated {
+		data["negated"] = true
+	}
+
+	if expr.jsonOptions.MarshalOptions.IncludeLocation.Expr {
+		if expr.Location != nil {
+			data["location"] = expr.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
 // UnmarshalJSON parses the byte array and stores the result in expr.
 func (expr *Expr) UnmarshalJSON(bs []byte) error {
 	v := map[string]interface{}{}
@@ -1422,6 +1555,101 @@ func (d *SomeDecl) Hash() int {
 	return termSliceHash(d.Symbols)
 }
 
+func (d *SomeDecl) setJSONOptions(opts JSONOptions) {
+	d.jsonOptions = opts
+}
+
+func (d *SomeDecl) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"symbols": d.Symbols,
+	}
+
+	if d.jsonOptions.MarshalOptions.IncludeLocation.SomeDecl {
+		if d.Location != nil {
+			data["location"] = d.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
+func (q *Every) String() string {
+	if q.Key != nil {
+		return fmt.Sprintf("every %s, %s in %s { %s }",
+			q.Key,
+			q.Value,
+			q.Domain,
+			q.Body)
+	}
+	return fmt.Sprintf("every %s in %s { %s }",
+		q.Value,
+		q.Domain,
+		q.Body)
+}
+
+func (q *Every) Loc() *Location {
+	return q.Location
+}
+
+func (q *Every) SetLoc(l *Location) {
+	q.Location = l
+}
+
+// Copy returns a deep copy of d.
+func (q *Every) Copy() *Every {
+	cpy := *q
+	cpy.Key = q.Key.Copy()
+	cpy.Value = q.Value.Copy()
+	cpy.Domain = q.Domain.Copy()
+	cpy.Body = q.Body.Copy()
+	return &cpy
+}
+
+func (q *Every) Compare(other *Every) int {
+	for _, terms := range [][2]*Term{
+		{q.Key, other.Key},
+		{q.Value, other.Value},
+		{q.Domain, other.Domain},
+	} {
+		if d := Compare(terms[0], terms[1]); d != 0 {
+			return d
+		}
+	}
+	return q.Body.Compare(other.Body)
+}
+
+// KeyValueVars returns the key and val arguments of an `every`
+// expression, if they are non-nil and not wildcards.
+func (q *Every) KeyValueVars() VarSet {
+	vis := &VarVisitor{vars: VarSet{}}
+	if q.Key != nil {
+		vis.Walk(q.Key)
+	}
+	vis.Walk(q.Value)
+	return vis.vars
+}
+
+func (q *Every) setJSONOptions(opts JSONOptions) {
+	q.jsonOptions = opts
+}
+
+func (q *Every) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"key":    q.Key,
+		"value":  q.Value,
+		"domain": q.Domain,
+		"body":   q.Body,
+	}
+
+	if q.jsonOptions.MarshalOptions.IncludeLocation.Every {
+		if q.Location != nil {
+			data["location"] = q.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
 func (w *With) String() string {
 	return "with " + w.Target.String() + " as " + w.Value.String()
 }
@@ -1480,6 +1708,25 @@ func (w *With) SetLoc(loc *Location) {
 	w.Location = loc
 }
 
+func (w *With) setJSONOptions(opts JSONOptions) {
+	w.jsonOptions = opts
+}
+
+func (w *With) MarshalJSON() ([]byte, error) {
+	data := map[string]interface{}{
+		"target": w.Target,
+		"value":  w.Value,
+	}
+
+	if w.jsonOptions.MarshalOptions.IncludeLocation.With {
+		if w.Location != nil {
+			data["location"] = w.Location
+		}
+	}
+
+	return json.Marshal(data)
+}
+
 // Copy returns a deep copy of the AST node x. If x is not an AST node, x is returned unmodified.
 func Copy(x interface{}) interface{} {
 	switch x := x.(type) {
@@ -1503,6 +1750,8 @@ func Copy(x interface{}) interface{} {
 		return x.Copy()
 	case *SomeDecl:
 		return x.Copy()
+	case *Every:
+		return x.Copy()
 	case *Term:
 		return x.Copy()
 	case *ArrayComprehension:
diff --git a/ast/policy_test.go b/ast/policy_test.go
index 5f01f9a3ad..118fc5b99f 100644
--- a/ast/policy_test.go
+++ b/ast/policy_test.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"net/url"
 	"reflect"
 	"testing"
 
@@ -19,6 +20,7 @@ func TestModuleJSONRoundTrip(t *testing.T) {
 
 	mod, err := ParseModuleWithOpts("test.rego", `package a.b.c
 
+import future.keywords
 import data.x.y as z
 import data.u.i
 
@@ -41,6 +43,7 @@ a = true { xs = {a: b | input.y[a] = "foo"; b = input.z["bar"]} }
 b = true { xs = {{"x": a[i].a} | a[i].n = "bob"; b[x]} }
 call_values { f(x) != g(x) }
 assigned := 1
+rule.having.ref.head[1] = x if x := 2
 
 # METADATA
 # scope: rule
@@ -376,17 +379,76 @@ func TestExprBadJSON(t *testing.T) {
 	assert(js, exp)
 }
 
+func TestExprEveryCopy(t *testing.T) {
+	opts := ParserOptions{AllFutureKeywords: true}
+	newEvery := func() *Expr {
+		return MustParseBodyWithOpts(
+			`every k, v in [1,2,3] { true }`, opts,
+		)[0]
+	}
+	e0 := newEvery()
+	e1 := e0.Copy()
+	e1.Terms.(*Every).Body = NewBody(NewExpr(BooleanTerm(false)))
+	if exp := newEvery(); exp.Compare(e0) != 0 {
+		t.Errorf("expected e0 unchanged (%v), found %v", exp, e0)
+	}
+}
+
+func TestRuleHeadJSON(t *testing.T) {
+	// NOTE(sr): we may get to see Rule objects that aren't the result of parsing, but
+	// fed as-is into the compiler. We need to be able to make sense of their refs, too.
+	head := Head{
+		Name: Var("allow"),
+	}
+
+	rule := Rule{
+		Head: &head,
+	}
+	bs, err := json.Marshal(&rule)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if exp, act := `{"body":[],"head":{"name":"allow","ref":[{"type":"var","value":"allow"}]}}`, string(bs); act != exp {
+		t.Errorf("expected %q, got %q", exp, act)
+	}
+
+	var readRule Rule
+	if err := json.Unmarshal(bs, &readRule); err != nil {
+		t.Fatal(err)
+	}
+	if exp, act := 1, len(readRule.Head.Reference); act != exp {
+		t.Errorf("expected unmarshalled rule to have Reference, got %v", readRule.Head.Reference)
+	}
+	bs0, err := json.Marshal(&readRule)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if exp, act := string(bs), string(bs0); exp != act {
+		t.Errorf("expected json repr to match %q, got %q", exp, act)
+	}
+
+	var readAgainRule Rule
+	if err := json.Unmarshal(bs, &readAgainRule); err != nil {
+		t.Fatal(err)
+	}
+	if !readAgainRule.Equal(&readRule) {
+		t.Errorf("expected roundtripped rule reference to match %v, got %v", readRule.Head.Reference, readAgainRule.Head.Reference)
+	}
+}
+
 func TestRuleHeadEquals(t *testing.T) {
 	assertHeadsEqual(t, &Head{}, &Head{})
 
-	// Same name/key/value
+	// Same name/ref/key/value
 	assertHeadsEqual(t, &Head{Name: Var("p")}, &Head{Name: Var("p")})
+	assertHeadsEqual(t, &Head{Reference: Ref{VarTerm("p"), StringTerm("r")}}, &Head{Reference: Ref{VarTerm("p"), StringTerm("r")}}) // TODO: string for first section
 	assertHeadsEqual(t, &Head{Key: VarTerm("x")}, &Head{Key: VarTerm("x")})
 	assertHeadsEqual(t, &Head{Value: VarTerm("x")}, &Head{Value: VarTerm("x")})
 	assertHeadsEqual(t, &Head{Args: []*Term{VarTerm("x"), VarTerm("y")}}, &Head{Args: []*Term{VarTerm("x"), VarTerm("y")}})
 
-	// Different name/key/value
+	// Different name/ref/key/value
 	assertHeadsNotEqual(t, &Head{Name: Var("p")}, &Head{Name: Var("q")})
+	assertHeadsNotEqual(t, &Head{Reference: Ref{VarTerm("p")}}, &Head{Reference: Ref{VarTerm("q")}}) // TODO: string for first section
 	assertHeadsNotEqual(t, &Head{Key: VarTerm("x")}, &Head{Key: VarTerm("y")})
 	assertHeadsNotEqual(t, &Head{Value: VarTerm("x")}, &Head{Value: VarTerm("y")})
 	assertHeadsNotEqual(t, &Head{Args: []*Term{VarTerm("x"), VarTerm("z")}}, &Head{Args: []*Term{VarTerm("x"), VarTerm("y")}})
@@ -422,48 +484,139 @@ func TestRuleBodyEquals(t *testing.T) {
 }
 
 func TestRuleString(t *testing.T) {
-
-	rule1 := &Rule{
-		Head: NewHead(Var("p"), nil, BooleanTerm(true)),
-		Body: NewBody(
-			Equality.Expr(StringTerm("foo"), StringTerm("bar")),
-		),
-	}
-
-	rule2 := &Rule{
-		Head: NewHead(Var("p"), VarTerm("x"), VarTerm("y")),
-		Body: NewBody(
-			Equality.Expr(StringTerm("foo"), VarTerm("x")),
-			&Expr{
-				Negated: true,
-				Terms:   RefTerm(VarTerm("a"), StringTerm("b"), VarTerm("x")),
+	trueBody := NewBody(NewExpr(BooleanTerm(true)))
+
+	tests := []struct {
+		rule *Rule
+		exp  string
+	}{
+		{
+			rule: &Rule{
+				Head: NewHead(Var("p"), nil, BooleanTerm(true)),
+				Body: NewBody(
+					Equality.Expr(StringTerm("foo"), StringTerm("bar")),
+				),
+			},
+			exp: `p = true { "foo" = "bar" }`,
+		},
+		{
+			rule: &Rule{
+				Head: NewHead(Var("p"), VarTerm("x")),
+				Body: trueBody,
+			},
+			exp: `p[x] { true }`,
+		},
+		{
+			rule: &Rule{
+				Head: RefHead(MustParseRef("p[x]"), BooleanTerm(true)),
+				Body: MustParseBody("x = 1"),
+			},
+			exp: `p[x] = true { x = 1 }`,
+		},
+		{
+			rule: &Rule{
+				Head: RefHead(MustParseRef("p.q.r[x]"), BooleanTerm(true)),
+				Body: MustParseBody("x = 1"),
+			},
+			exp: `p.q.r[x] = true { x = 1 }`,
+		},
+		{
+			rule: &Rule{
+				Head: &Head{
+					Reference: MustParseRef("p.q.r"),
+					Key:       VarTerm("1"),
+				},
+				Body: MustParseBody("x = 1"),
+			},
+			exp: `p.q.r contains 1 { x = 1 }`,
+		},
+		{
+			rule: &Rule{
+				Head: NewHead(Var("p"), VarTerm("x"), VarTerm("y")),
+				Body: NewBody(
+					Equality.Expr(StringTerm("foo"), VarTerm("x")),
+					&Expr{
+						Negated: true,
+						Terms:   RefTerm(VarTerm("a"), StringTerm("b"), VarTerm("x")),
+					},
+					Equality.Expr(StringTerm("b"), VarTerm("y")),
+				),
+			},
+			exp: `p[x] = y { "foo" = x; not a.b[x]; "b" = y }`,
+		},
+		{
+			rule: &Rule{
+				Default: true,
+				Head:    NewHead("p", nil, BooleanTerm(true)),
+			},
+			exp: `default p = true`,
+		},
+		{
+			rule: &Rule{
+				Head: &Head{
+					Name:  Var("f"),
+					Args:  Args{VarTerm("x"), VarTerm("y")},
+					Value: VarTerm("z"),
+				},
+				Body: NewBody(Plus.Expr(VarTerm("x"), VarTerm("y"), VarTerm("z"))),
+			},
+			exp: "f(x, y) = z { plus(x, y, z) }",
+		},
+		{
+			rule: &Rule{
+				Head: &Head{
+					Name:   Var("p"),
+					Value:  BooleanTerm(true),
+					Assign: true,
+				},
+				Body: NewBody(
+					Equality.Expr(StringTerm("foo"), StringTerm("bar")),
+				),
 			},
-			Equality.Expr(StringTerm("b"), VarTerm("y")),
-		),
+			exp: `p := true { "foo" = "bar" }`,
+		},
+		{
+			rule: &Rule{
+				Head: RefHead(MustParseRef("p.q.r")),
+				Body: trueBody,
+			},
+			exp: `p.q.r { true }`,
+		},
+		{
+			rule: &Rule{
+				Head: RefHead(MustParseRef("p.q.r"), StringTerm("foo")),
+				Body: trueBody,
+			},
+			exp: `p.q.r = "foo" { true }`,
+		},
+		{
+			rule: &Rule{
+				Head: RefHead(MustParseRef("p.q.r[x]"), StringTerm("foo")),
+				Body: MustParseBody(`x := 1`),
+			},
+			exp: `p.q.r[x] = "foo" { assign(x, 1) }`,
+		},
 	}
 
-	rule3 := &Rule{
-		Default: true,
-		Head:    NewHead("p", nil, BooleanTerm(true)),
+	for _, tc := range tests {
+		t.Run(tc.exp, func(t *testing.T) {
+			assertRuleString(t, tc.rule, tc.exp)
+		})
 	}
+}
 
-	rule4 := &Rule{
-		Head: &Head{
-			Name:  Var("f"),
-			Args:  Args{VarTerm("x"), VarTerm("y")},
-			Value: VarTerm("z"),
-		},
-		Body: NewBody(Plus.Expr(VarTerm("x"), VarTerm("y"), VarTerm("z"))),
+func TestRulePath(t *testing.T) {
+	ruleWithMod := func(r string) Ref {
+		mod := MustParseModule("package pkg\n" + r)
+		return mod.Rules[0].Path()
+	}
+	if exp, act := MustParseRef("data.pkg.p.q.r"), ruleWithMod("p.q.r { true }"); !exp.Equal(act) {
+		t.Errorf("expected %v, got %v", exp, act)
 	}
 
-	rule5 := rule1.Copy()
-	rule5.Head.Assign = true
-
-	assertRuleString(t, rule1, `p = true { "foo" = "bar" }`)
-	assertRuleString(t, rule2, `p[x] = y { "foo" = x; not a.b[x]; "b" = y }`)
-	assertRuleString(t, rule3, `default p = true`)
-	assertRuleString(t, rule4, "f(x, y) = z { plus(x, y, z) }")
-	assertRuleString(t, rule5, `p := true { "foo" = "bar" }`)
+	if exp, act := MustParseRef("data.pkg.p"), ruleWithMod("p { true }"); !exp.Equal(act) {
+		t.Errorf("expected %v, got %v", exp, act)
+	}
 }
 
 func TestModuleString(t *testing.T) {
@@ -562,24 +715,109 @@ func TestSomeDeclString(t *testing.T) {
 	}
 }
 
+func TestEveryString(t *testing.T) {
+	tests := []struct {
+		every Every
+		exp   string
+	}{
+		{
+			exp: `every x in ["foo", "bar"] { true; true }`,
+			every: Every{
+				Value:  VarTerm("x"),
+				Domain: ArrayTerm(StringTerm("foo"), StringTerm("bar")),
+				Body: []*Expr{
+					{
+						Terms: BooleanTerm(true),
+					},
+					{
+						Terms: BooleanTerm(true),
+					},
+				},
+			},
+		},
+		{
+			exp: `every k, v in ["foo", "bar"] { true; true }`,
+			every: Every{
+				Key:    VarTerm("k"),
+				Value:  VarTerm("v"),
+				Domain: ArrayTerm(StringTerm("foo"), StringTerm("bar")),
+				Body: []*Expr{
+					{
+						Terms: BooleanTerm(true),
+					},
+					{
+						Terms: BooleanTerm(true),
+					},
+				},
+			},
+		},
+	}
+	for _, tc := range tests {
+		if act := tc.every.String(); act != tc.exp {
+			t.Errorf("expected %q, got %q", tc.exp, act)
+		}
+	}
+}
+
 func TestAnnotationsString(t *testing.T) {
 	a := &Annotations{
-		Scope: "foo",
+		Scope:       "foo",
+		Title:       "bar",
+		Description: "baz",
+		Authors: []*AuthorAnnotation{
+			{
+				Name:  "John Doe",
+				Email: "john@example.com",
+			},
+			{
+				Name: "Jane Doe",
+			},
+		},
+		Organizations: []string{"mi", "fa"},
+		RelatedResources: []*RelatedResourceAnnotation{
+			{
+				Ref: mustParseURL("https://example.com"),
+			},
+			{
+				Ref:         mustParseURL("https://example.com/2"),
+				Description: "Some resource",
+			},
+		},
 		Schemas: []*SchemaAnnotation{
 			{
 				Path:   MustParseRef("data.bar"),
 				Schema: MustParseRef("schema.baz"),
 			},
 		},
+		Custom: map[string]interface{}{
+			"list": []int{
+				1, 2, 3,
+			},
+			"map": map[string]interface{}{
+				"one": 1,
+				"two": map[int]interface{}{
+					3: "three",
+				},
+			},
+			"flag": true,
+		},
 	}
 
 	// NOTE(tsandall): for now, annotations are represented as JSON objects
 	// which are a subset of YAML. We could improve this in the future.
-	exp := `{"scope":"foo","schemas":[{"path":[{"type":"var","value":"data"},{"type":"string","value":"bar"}],"schema":[{"type":"var","value":"schema"},{"type":"string","value":"baz"}]}]}`
+	exp := `{"authors":[{"name":"John Doe","email":"john@example.com"},{"name":"Jane Doe"}],"custom":{"flag":true,"list":[1,2,3],"map":{"one":1,"two":{"3":"three"}}},"description":"baz","organizations":["mi","fa"],"related_resources":[{"ref":"https://example.com"},{"description":"Some resource","ref":"https://example.com/2"}],"schemas":[{"path":[{"type":"var","value":"data"},{"type":"string","value":"bar"}],"schema":[{"type":"var","value":"schema"},{"type":"string","value":"baz"}]}],"scope":"foo","title":"bar"}`
 
-	if exp != a.String() {
-		t.Fatalf("expected %q but got %q", exp, a.String())
+	if got := a.String(); exp != got {
+		t.Fatalf("expected\n%s\nbut got\n%s", exp, got)
+	}
+}
+
+func mustParseURL(str string) url.URL {
+	parsed, err := url.Parse(str)
+	if err != nil {
+		panic(err)
 	}
+	return *parsed
 }
 
 func TestModuleStringAnnotations(t *testing.T) {
@@ -683,7 +921,7 @@ func assertPackagesNotEqual(t *testing.T, a, b *Package) {
 func assertRulesEqual(t *testing.T, a, b *Rule) {
 	t.Helper()
 	if !a.Equal(b) {
-		t.Errorf("Rules are not equal (expected equal): a=%v b=%v", a, b)
+		t.Errorf("Rules are not equal (expected equal):\na=%v\nb=%v", a, b)
 	}
 }
 
diff --git a/ast/pretty_test.go b/ast/pretty_test.go
index d59f7cb809..50fe97c142 100644
--- a/ast/pretty_test.go
+++ b/ast/pretty_test.go
@@ -41,8 +41,9 @@ func TestPretty(t *testing.T) {
   qux
  rule
   head
-   p
-   x
+   ref
+    p
+    x
    y
   body
    expr index=0
@@ -67,7 +68,8 @@ func TestPretty(t *testing.T) {
       true
  rule
   head
-   f
+   ref
+    f
    args
     x
    call
diff --git a/ast/schema.go b/ast/schema.go
index 76bd475677..8c96ac624e 100644
--- a/ast/schema.go
+++ b/ast/schema.go
@@ -54,7 +54,7 @@ func loadSchema(raw interface{}, allowNet []string) (types.Type, error) {
 		return nil, err
 	}
 
-	tpe, err := parseSchema(jsonSchema.RootSchema)
+	tpe, err := newSchemaParser().parseSchema(jsonSchema.RootSchema)
 	if err != nil {
 		return nil, fmt.Errorf("type checking: %w", err)
 	}
diff --git a/ast/schema_test.go b/ast/schema_test.go
index c9671f1b24..2882829b2e 100644
--- a/ast/schema_test.go
+++ b/ast/schema_test.go
@@ -1,11 +1,15 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
 package ast
 
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"strings"
 	"testing"
 
@@ -456,7 +460,7 @@ func TestParseSchemaWithSchemaBadSchema(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Unable to compile schema: %v", err)
 	}
-	newtype, err := parseSchema(jsonSchema) // Did not pass the subschema
+	newtype, err := newSchemaParser().parseSchema(jsonSchema) // Did not pass the subschema
 	if err == nil {
 		t.Fatalf("Expected parseSchema() = error, got nil")
 	}
@@ -562,7 +566,7 @@ func TestAnyOfSchema(t *testing.T) {
 
 func kubeSchemaServer(t *testing.T) *httptest.Server {
 	t.Helper()
-	bs, err := ioutil.ReadFile("testdata/_definitions.json")
+	bs, err := os.ReadFile("testdata/_definitions.json")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -574,3 +578,1083 @@ func kubeSchemaServer(t *testing.T) *httptest.Server {
 	}))
 	return ts
 }
+
+func TestCompilerCheckTypesWithSchema(t *testing.T) {
+	c := NewCompiler()
+	var schema interface{}
+	err := util.Unmarshal([]byte(objectSchema), &schema)
+	if err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, schema)
+	c.WithSchemas(schemaSet)
+	compileStages(c, c.checkTypes)
+	assertNotFailed(t, c)
+}
+
+func TestCompilerCheckTypesWithRegexPatternInSchema(t *testing.T) {
+	c := NewCompiler()
+	var schema interface{}
+	// Negative lookahead is not supported in the Go regex dialect, but this is still a valid
+	// JSON schema. Since we don't rely on the "pattern" attribute for type checking, ensure
+	// that this still works (by being ignored)
+	err := util.Unmarshal([]byte(`{
+		"properties": {
+			"name": {
+				"pattern": "^(?!testing:.*)[a-z]+$",
+				"type": "string"
+			}
+		}
+	}`), &schema)
+	if err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, schema)
+	c.WithSchemas(schemaSet)
+	compileStages(c, c.checkTypes)
+	assertNotFailed(t, c)
+}
+
+func TestCompilerCheckTypesWithAllOfSchema(t *testing.T) {
+
+	tests := []struct {
+		note          string
+		schema        string
+		expectedError error
+	}{
+		{
+			note:          "allOf with mergeable Object types in schema",
+			schema:        allOfObjectSchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Array types in schema",
+			schema:        allOfArraySchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf without a parent schema",
+			schema:        allOfSchemaParentVariation,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with empty schema",
+			schema:        emptySchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Array of Object types in schema",
+			schema:        allOfArrayOfObjects,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Object types in schema with type declaration missing",
+			schema:        allOfObjectMissing,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with Array of mergeable different types in schema",
+			schema:        allOfArrayDifTypes,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Object containing Array types in schema",
+			schema:        allOfArrayInsideObject,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Array types in schema with type declaration missing",
+			schema:        allOfArrayMissing,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable types inside of core schema",
+			schema:        allOfInsideCoreSchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable String types in schema",
+			schema:        allOfStringSchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Integer types in schema",
+			schema:        allOfIntegerSchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Boolean types in schema",
+			schema:        allOfBooleanSchema,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf with mergeable Array types with uneven numbers of items",
+			schema:        allOfSchemaWithUnevenArray,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf schema with unmergeable Array of Arrays",
+			schema:        allOfArrayOfArrays,
+			expectedError: fmt.Errorf("unable to merge these schemas"),
+		},
+		{
+			note:          "allOf schema with Array and Object types as siblings",
+			schema:        allOfObjectAndArray,
+			expectedError: fmt.Errorf("unable to merge these schemas"),
+		},
+		{
+			note:          "allOf schema with Array type that contains different unmergeable types",
+			schema:        allOfArrayDifTypesWithError,
+			expectedError: fmt.Errorf("unable to merge these schemas"),
+		},
+		{
+			note:          "allOf schema with different unmergeable types",
+			schema:        allOfTypeErrorSchema,
+			expectedError: fmt.Errorf("unable to merge these schemas"),
+		},
+		{
+			note:          "allOf unmergeable schema with different parent and items types",
+			schema:        allOfSchemaWithParentError,
+			expectedError: fmt.Errorf("unable to merge these schemas"),
+		},
+		{
+			note:          "allOf schema of Array type with uneven numbers of items to merge",
+			schema:        allOfSchemaWithUnevenArray,
+			expectedError: nil,
+		},
+		{
+			note:          "allOf schema with unmergeable types String and Boolean",
+			schema:        allOfStringSchemaWithError,
+			expectedError: fmt.Errorf("unable to merge these schemas"),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := NewCompiler()
+			var schema interface{}
+			err := util.Unmarshal([]byte(tc.schema), &schema)
+			if err != nil {
+				t.Fatal("Unexpected error:", err)
+			}
+			schemaSet := NewSchemaSet()
+			schemaSet.Put(SchemaRootRef, schema)
+			c.WithSchemas(schemaSet)
+			compileStages(c, c.checkTypes)
+			if tc.expectedError != nil {
+				if errors.Is(c.Errors, tc.expectedError) {
+					t.Fatal("Unexpected error:", err)
+				}
+			} else {
+				assertNotFailed(t, c)
+			}
+		})
+	}
+}
+
+func TestWithSchema(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, objectSchema)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("WithSchema did not set the schema correctly in the compiler")
+	}
+}
+
+func TestAnyOfObjectSchema1(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, anyOfExtendCoreSchema)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("Did not correctly compile an object type schema with anyOf outside core schema")
+	}
+}
+
+func TestAnyOfObjectSchema2(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, anyOfInsideCoreSchema)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("Did not correctly compile an object type schema with anyOf inside core schema")
+	}
+}
+
+func TestAnyOfArraySchema(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, anyOfArraySchema)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("Did not correctly compile an array type schema with anyOf")
+	}
+}
+
+func TestAnyOfObjectMissing(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, anyOfObjectMissing)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("Did not correctly compile an object type schema with anyOf where one of the props did not explicitly claim type")
+	}
+}
+
+func TestAnyOfArrayMissing(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, anyOfArrayMissing)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("Did not correctly compile an array type schema with anyOf where items are inside anyOf")
+	}
+}
+
+func TestRecursiveSchema(t *testing.T) {
+	c := NewCompiler()
+	schemaSet := NewSchemaSet()
+	schemaSet.Put(SchemaRootRef, recursiveElements)
+	c.WithSchemas(schemaSet)
+	if c.schemaSet == nil {
+		t.Fatalf("Did not correctly compile an object schema with recursive elements")
+	}
+}
+
+const objectSchema = `{
+	"$schema": "http://json-schema.org/draft-07/schema",
+	"$id": "http://example.com/example.json",
+	"type": "object",
+	"title": "The root schema",
+	"description": "The root schema comprises the entire JSON document.",
+	"required": [
+		"foo",
+		"b"
+	],
+	"properties": {
+		"foo": {
+			"$id": "#/properties/foo",
+			"type": "string",
+			"title": "The foo schema",
+			"description": "An explanation about the purpose of this instance."
+		},
+		"b": {
+			"$id": "#/properties/b",
+			"type": "array",
+			"title": "The b schema",
+			"description": "An explanation about the purpose of this instance.",
+			"additionalItems": false,
+			"items": {
+				"$id": "#/properties/b/items",
+				"type": "object",
+				"title": "The items schema",
+				"description": "An explanation about the purpose of this instance.",
+				"required": [
+					"a",
+					"b",
+					"c"
+				],
+				"properties": {
+					"a": {
+						"$id": "#/properties/b/items/properties/a",
+						"type": "integer",
+						"title": "The a schema",
+						"description": "An explanation about the purpose of this instance."
+					},
+					"b": {
+						"$id": "#/properties/b/items/properties/b",
+						"type": "array",
+						"title": "The b schema",
+						"description": "An explanation about the purpose of this instance.",
+						"additionalItems": false,
+						"items": {
+							"$id": "#/properties/b/items/properties/b/items",
+							"type": "integer",
+							"title": "The items schema",
+							"description": "An explanation about the purpose of this instance."
+						}
+					},
+					"c": {
+						"$id": "#/properties/b/items/properties/c",
+						"type": "null",
+						"title": "The c schema",
+						"description": "An explanation about the purpose of this instance."
+					}
+				},
+				"additionalProperties": false
+			}
+		}
+	},
+	"additionalProperties": false
+}`
+
+const arrayNoItemsSchema = `{
+	"$schema": "http://json-schema.org/draft-07/schema",
+	"$id": "http://example.com/example.json",
+	"type": "object",
+	"title": "The root schema",
+	"description": "The root schema comprises the entire JSON document.",
+	"required": [
+		"b"
+	],
+	"properties": {
+		"b": {
+			"$id": "#/properties/b",
+			"type": "array",
+			"title": "The b schema",
+			"description": "An explanation about the purpose of this instance.",
+			"additionalItems": true
+		}
+	},
+	"additionalProperties": false
+}`
+
+const noChildrenObjectSchema = `{
+	"$schema": "http://json-schema.org/draft-07/schema",
+	"$id": "http://example.com/example.json",
+	"type": "object",
+	"title": "The root schema",
+	"description": "The root schema comprises the entire JSON document.",
+	"additionalProperties": true
+}`
+
+const untypedFieldObjectSchema = `{
+	"$schema": "http://json-schema.org/draft-07/schema",
+	"$id": "http://example.com/example.json",
+	"type": "object",
+	"title": "The root schema",
+	"description": "The root schema comprises the entire JSON document.",
+	"required": [
+		"foo"
+	],
+	"properties": {
+		"foo": {
+			"$id": "#/properties/foo"
+		}
+	},
+	"additionalProperties": false
+}`
+
+const booleanSchema = `{
+	"$schema": "http://json-schema.org/draft-07/schema",
+	"$id": "http://example.com/example.json",
+	"type": "object",
+	"title": "The root schema",
+	"description": "The root schema comprises the entire JSON document.",
+	"required": [
+		"a"
+	],
+	"properties": {
+		"a": {
+			"$id": "#/properties/foo",
+			"type": "boolean",
+			"title": "The foo schema",
+			"description": "An explanation about the purpose of this instance."
+		}
+	},
+	"additionalProperties": false
+}`
+
+const refSchema = `
+{
+    "description": "Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.",
+	"type": "object",
+	"properties": {
+      "apiVersion": {
+        "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
+        "type": [
+          "string",
+          "null"
+        ]
+	  },
+
+      "kind": {
+        "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
+        "type": [
+          "string",
+          "null"
+        ],
+        "enum": [
+          "Pod"
+        ]
+      },
+      "metadata": {
+        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+        "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+	  }
+	}
+}
+`
+const podSchema = `
+{
+    "description": "Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.",
+    "properties": {
+      "apiVersion": {
+        "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources",
+        "type": [
+          "string",
+          "null"
+        ]
+      },
+      "kind": {
+        "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds",
+        "type": [
+          "string",
+          "null"
+        ],
+        "enum": [
+          "Pod"
+        ]
+      },
+      "metadata": {
+        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+        "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+      },
+      "spec": {
+        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec",
+        "description": "Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status"
+      },
+      "status": {
+        "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodStatus",
+        "description": "Most recently observed status of the pod. This data may not be up to date. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#spec-and-status"
+      }
+    },
+    "type": "object",
+    "x-kubernetes-group-version-kind": [
+      {
+        "group": "",
+        "kind": "Pod",
+        "version": "v1"
+      }
+    ],
+    "$schema": "http://json-schema.org/schema#"
+  }`
+
+const anyOfArraySchema = `{
+	"type": "object",
+	"properties": {
+		"familyMembers": {
+			"type": "array",
+			"items": {
+				"anyOf": [
+					{
+						"type": "object",
+						"properties": {
+							"age": { "type": "integer" },
+							"name": {"type": "string"}
+						}
+					},{
+						"type": "object",
+						"properties": {
+							"personality": { "type": "string" },
+							"nickname": { "type": "string"  }
+						}
+					}
+				]
+			}
+		}
+	}
+}`
+
+const anyOfExtendCoreSchema = `{
+	"type": "object",
+	"properties": {
+		"AddressLine": { "type": "string" }
+	},
+	"anyOf": [
+		{
+			"type": "object",
+			"properties": {
+				"State":   { "type": "string" },
+				"ZipCode": { "type": "string" }
+			}
+		},
+		{
+			"type": "object",
+			"properties": {
+				"County":   { "type": "string" },
+				"PostCode": { "type": "integer" }
+			}
+		}
+	]
+}`
+
+const allOfObjectSchema = `{
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "type": "object",
+    "title": "My schema",
+    "properties": {
+        "AddressLine1": { "type": "string" },
+        "AddressLine2": { "type": "string" },
+        "City":         { "type": "string" }
+    },
+    "allOf": [
+        {
+            "type": "object",
+            "properties": {
+                "State":   { "type": "string" },
+                "ZipCode": { "type": "string" }
+            },
+        },
+        {
+            "type": "object",
+            "properties": {
+                "County":   { "type": "string" },
+                "PostCode": { "type": "string" }
+            },
+        }
+    ]
+}`
+
+const allOfArraySchema = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "array",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"items": {
+		"type": "integer",
+		"title": "The items schema",
+		"description": "An explanation about the purpose of this instance."
+	},
+	"allOf": [
+		{
+		"type": "array",
+		"title": "The b schema",
+		"description": "An explanation about the purpose of this instance.",
+		"items": {
+			"type": "integer",
+			"title": "The items schema",
+			"description": "An explanation about the purpose of this instance."
+		}
+		},
+		{
+		"type": "array",
+		"title": "The b schema",
+		"description": "An explanation about the purpose of this instance.",
+		"items": {
+			"type": "integer",
+			"title": "The items schema",
+			"description": "An explanation about the purpose of this instance."
+		}
+		}
+	]
+}`
+
+const allOfSchemaParentVariation = `{
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "allOf": [
+        {
+            "type": "object",
+            "properties": {
+                "State":   { "type": "string" },
+                "ZipCode": { "type": "string" }
+            },
+        },
+        {
+            "type": "object",
+            "properties": {
+                "County":   { "type": "string" },
+                "PostCode": { "type": "string" }
+            },
+        }
+    ]
+}`
+
+const emptySchema = `{
+	"allof" : []
+ }`
+
+const allOfArrayOfArrays = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "array",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"items": {
+		"type": "array",
+		"title": "The items schema",
+		"description": "An explanation about the purpose of this instance.",
+		"items": {
+			"type": "integer",
+			"title": "The items schema",
+			"description": "An explanation about the purpose of this instance."
+		}
+	},
+	"allOf": [{
+			"type": "array",
+			"title": "The b schema",
+			"description": "An explanation about the purpose of this instance.",
+			"items": {
+				"type": "array",
+				"title": "The items schema",
+				"description": "An explanation about the purpose of this instance.",
+				"items": {
+					"type": "integer",
+					"title": "The items schema",
+					"description": "An explanation about the purpose of this instance."
+				}
+			}
+		},
+		{
+			"type": "array",
+			"title": "The b schema",
+			"description": "An explanation about the purpose of this instance.",
+			"items": {
+				"type": "integer",
+				"title": "The items schema",
+				"description": "An explanation about the purpose of this instance."
+			}
+		}
+	]
+}`
+
+const anyOfInsideCoreSchema = ` {
+	"type": "object",
+	"properties": {
+		"AddressLine": { "type": "string" },
+		"RandomInfo": {
+			"anyOf": [
+				{ "type": "object",
+				  "properties": {
+					  "accessMe": {"type": "string"}
+				  }
+				},
+				{ "type": "number", "minimum": 0 }
+			  ]
+		}
+	}
+}`
+
+const anyOfObjectMissing = `{
+	"type": "object",
+	"properties": {
+		"AddressLine": { "type": "string" }
+	},
+	"anyOf": [
+		{
+			"type": "object",
+			"properties": {
+				"State":   { "type": "string" },
+				"ZipCode": { "type": "string" }
+			}
+		},
+		{
+			"properties": {
+				"County":   { "type": "string" },
+				"PostCode": { "type": "integer" }
+			}
+		}
+	]
+}`
+
+const allOfArrayOfObjects = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "array",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"items": {
+		"type": "object",
+		"title": "The items schema",
+		"description": "An explanation about the purpose of this instance.",
+		"properties": {
+			"State": {
+				"type": "string"
+			},
+			"ZipCode": {
+				"type": "string"
+			}
+		},
+		"allOf": [{
+				"type": "object",
+				"title": "The b schema",
+				"description": "An explanation about the purpose of this instance.",
+				"properties": {
+					"County": {
+						"type": "string"
+					},
+					"PostCode": {
+						"type": "string"
+					}
+				}
+			},
+			{
+				"type": "object",
+				"title": "The b schema",
+				"description": "An explanation about the purpose of this instance.",
+				"properties": {
+					"Street": {
+						"type": "string"
+					},
+					"House": {
+						"type": "string"
+					}
+				}
+			}
+		]
+	}
+}`
+
+const allOfObjectAndArray = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "object",
+	"title": "My schema",
+	"properties": {
+		"AddressLine1": {
+			"type": "string"
+		},
+		"AddressLine2": {
+			"type": "string"
+		},
+		"City": {
+			"type": "string"
+		}
+	},
+	"allOf": [{
+			"type": "object",
+			"properties": {
+				"State": {
+					"type": "string"
+				},
+				"ZipCode": {
+					"type": "string"
+				}
+			}
+		},
+		{
+			"type": "array",
+			"title": "The b schema",
+			"description": "An explanation about the purpose of this instance.",
+			"items": {
+				"type": "integer",
+				"title": "The items schema",
+				"description": "An explanation about the purpose of this instance."
+			}
+		}
+	]
+}`
+
+const allOfObjectMissing = `{
+	"type": "object",
+	"properties": {
+		"AddressLine": { "type": "string" }
+	},
+	"allOf": [
+		{
+			"type": "object",
+			"properties": {
+				"State":   { "type": "string" },
+				"ZipCode": { "type": "string" }
+			}
+		},
+		{
+			"properties": {
+				"County":   { "type": "string" },
+				"PostCode": { "type": "integer" }
+			}
+		}
+	]
+}`
+
+const allOfArrayDifTypes = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "array",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "array",
+			"items": [{
+					"type": "string"
+				},
+				{
+					"type": "integer"
+				}
+			]
+		},
+		{
+			"type": "array",
+			"items": [{
+					"type": "string"
+				},
+				{
+					"type": "integer"
+				}
+			]
+		}
+	]
+}`
+
+const allOfArrayInsideObject = `{
+	"type": "object",
+	"properties": {
+		"familyMembers": {
+			"type": "array",
+			"items": {
+				"allOf": [{
+					"type": "object",
+					"properties": {
+						"age": {
+							"type": "integer"
+						},
+						"name": {
+							"type": "string"
+						}
+					}
+				}, {
+					"type": "object",
+					"properties": {
+						"personality": {
+							"type": "string"
+						},
+						"nickname": {
+							"type": "string"
+						}
+					}
+				}]
+			}
+		}
+	}
+}`
+
+const anyOfArrayMissing = `{
+	"type": "array",
+	"anyOf": [
+		{
+			"items": [
+				{"type": "number"},
+				{"type": "string"}]
+            },
+		{	"items": [
+				{"type": "integer"}]
+		}
+	]
+}`
+
+const allOfArrayMissing = `{
+	"type": "array",
+	"allOf": [{
+			"items": [{
+					"type": "integer"
+				},
+				{
+					"type": "integer"
+				}
+			]
+		},
+		{
+			"items": [{
+				"type": "integer"
+			}]
+		}
+	]
+}`
+
+const anyOfSchemaParentVariation = `{
+    "$schema": "http://json-schema.org/draft-04/schema#",
+    "anyOf": [
+        {
+            "type": "object",
+            "properties": {
+                "State":   { "type": "string" },
+                "ZipCode": { "type": "string" }
+            },
+        },
+        {
+            "type": "object",
+            "properties": {
+                "County":   { "type": "string" },
+                "PostCode": { "type": "string" }
+            },
+        }
+    ]
+	}
+}`
+
+const allOfInsideCoreSchema = `{
+	"type": "object",
+	"properties": {
+		"AddressLine": { "type": "string" },
+		"RandomInfo": {
+			"allOf": [
+				{ "type": "object",
+				  "properties": {
+					  "accessMe": {"type": "string"}
+				  }
+				},
+				{ "type": "object",
+					"properties": {
+						"accessYou": {"type": "string"}
+					}}
+			  ]
+		}
+	}
+}`
+
+const allOfArrayDifTypesWithError = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "array",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "array",
+			"items": [{
+					"type": "string"
+				},
+				{
+					"type": "integer"
+				}
+			]
+		},
+		{
+			"type": "array",
+			"items": [{
+					"type": "boolean"
+				},
+				{
+					"type": "integer"
+				}
+			]
+		}
+	]
+}`
+
+const allOfStringSchema = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "string",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "string",
+		},
+		{
+			"type": "string",
+		}
+	]
+}`
+
+const allOfIntegerSchema = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "integer",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "integer",
+		},
+		{
+			"type": "integer",
+		}
+	]
+}`
+
+const allOfBooleanSchema = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "boolean",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "boolean",
+		},
+		{
+			"type": "boolean",
+		}
+	]
+}`
+
+const allOfTypeErrorSchema = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "string",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "string",
+		},
+		{
+			"type": "integer",
+		}
+	]
+}`
+
+const allOfStringSchemaWithError = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "string",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "string",
+		},
+		{
+			"type": "string",
+		},
+		{
+			"type": "boolean",
+		}
+	]
+}`
+
+const allOfSchemaWithParentError = `{
+	"$schema": "http://json-schema.org/draft-04/schema#",
+	"type": "string",
+	"title": "The b schema",
+	"description": "An explanation about the purpose of this instance.",
+	"allOf": [{
+			"type": "integer",
+		},
+		{
+			"type": "integer",
+		}
+	]
+}`
+
+const allOfSchemaWithUnevenArray = `{
+	"type": "array",
+	"allOf": [{
+			"items": [{
+					"type": "integer"
+				},
+				{
+					"type": "integer"
+				}
+			]
+		},
+		{
+			"items": [{
+				"type": "integer"
+			},
+			{
+				"type": "integer"
+			},
+			{
+				"type": "string"
+			}]
+		}
+	]
+}`
+
+const recursiveElements = `{
+  "type": "object",
+  "properties": {
+    "Something": {
+      "$ref": "#/$defs/X"
+    }
+  },
+  "$defs": {
+    "X": {
+      "type": "object",
+      "properties": {
+        "Y": {
+          "$ref": "#/$defs/Y"
+        }
+      }
+    },
+    "Y": {
+      "type": "object",
+      "properties": {
+        "X": {
+          "$ref": "#/$defs/X"
+        }
+      }
+    }
+  }
+}
+`
diff --git a/ast/strings.go b/ast/strings.go
index 8f9928017a..e489f6977c 100644
--- a/ast/strings.go
+++ b/ast/strings.go
@@ -11,5 +11,8 @@ import (
 
 // TypeName returns a human readable name for the AST element type.
 func TypeName(x interface{}) string {
+	if _, ok := x.(*lazyObj); ok {
+		return "object"
+	}
 	return strings.ToLower(reflect.Indirect(reflect.ValueOf(x)).Type().Name())
 }
diff --git a/ast/term.go b/ast/term.go
index 1dc5bd1bbf..79e21ccae6 100644
--- a/ast/term.go
+++ b/ast/term.go
@@ -8,6 +8,7 @@ package ast
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -17,9 +18,9 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 
 	"github.com/OneOfOne/xxhash"
-	"github.com/pkg/errors"
 
 	"github.com/open-policy-agent/opa/ast/location"
 	"github.com/open-policy-agent/opa/util"
@@ -133,12 +134,12 @@ func As(v Value, x interface{}) error {
 
 // Resolver defines the interface for resolving references to native Go values.
 type Resolver interface {
-	Resolve(ref Ref) (interface{}, error)
+	Resolve(Ref) (interface{}, error)
 }
 
 // ValueResolver defines the interface for resolving references to AST values.
 type ValueResolver interface {
-	Resolve(ref Ref) (Value, error)
+	Resolve(Ref) (Value, error)
 }
 
 // UnknownValueErr indicates a ValueResolver was unable to resolve a reference
@@ -215,6 +216,11 @@ func valueToInterface(v Value, resolver Resolver, opt JSONOpt) (interface{}, err
 			return nil, err
 		}
 		return buf, nil
+	case *lazyObj:
+		if opt.CopyMaps {
+			return valueToInterface(v.force(), resolver, opt)
+		}
+		return v.native, nil
 	case Set:
 		buf := []interface{}{}
 		iter := func(x *Term) error {
@@ -251,6 +257,7 @@ func JSON(v Value) (interface{}, error) {
 // JSONOpt defines parameters for AST to JSON conversion.
 type JSONOpt struct {
 	SortSets bool // sort sets before serializing (this makes conversion more expensive)
+	CopyMaps bool // enforces copying of map[string]interface{} read from the store
 }
 
 // JSONWithOpt returns the JSON representation of v. The value must not contain any
@@ -284,8 +291,10 @@ func MustInterfaceToValue(x interface{}) Value {
 
 // Term is an argument to a function.
 type Term struct {
-	Value    Value     `json:"value"` // the value of the Term as represented in Go
-	Location *Location `json:"-"`     // the location of the Term in the source
+	Value    Value     `json:"value"`              // the value of the Term as represented in Go
+	Location *Location `json:"location,omitempty"` // the location of the Term in the source
+
+	jsonOptions JSONOptions
 }
 
 // NewTerm returns a new Term object.
@@ -383,9 +392,13 @@ func (term *Term) Equal(other *Term) bool {
 // Get returns a value referred to by name from the term.
 func (term *Term) Get(name *Term) *Term {
 	switch v := term.Value.(type) {
+	case *object:
+		return v.Get(name)
 	case *Array:
 		return v.Get(name)
-	case *object:
+	case interface {
+		Get(*Term) *Term
+	}:
 		return v.Get(name)
 	case Set:
 		if v.Contains(name) {
@@ -406,6 +419,10 @@ func (term *Term) IsGround() bool {
 	return term.Value.IsGround()
 }
 
+func (term *Term) setJSONOptions(opts JSONOptions) {
+	term.jsonOptions = opts
+}
+
 // MarshalJSON returns the JSON encoding of the term.
 //
 // Specialized marshalling logic is required to include a type hint for Value.
@@ -414,6 +431,11 @@ func (term *Term) MarshalJSON() ([]byte, error) {
 		"type":  TypeName(term.Value),
 		"value": term.Value,
 	}
+	if term.jsonOptions.MarshalOptions.IncludeLocation.Term {
+		if term.Location != nil {
+			d["location"] = term.Location
+		}
+	}
 	return json.Marshal(d)
 }
 
@@ -422,7 +444,7 @@ func (term *Term) String() string {
 }
 
 // UnmarshalJSON parses the byte array and stores the result in term.
-// Specialized unmarshalling is required to handle Value.
+// Specialized unmarshalling is required to handle Value and Location.
 func (term *Term) UnmarshalJSON(bs []byte) error {
 	v := map[string]interface{}{}
 	if err := util.UnmarshalJSON(bs, &v); err != nil {
@@ -433,6 +455,14 @@ func (term *Term) UnmarshalJSON(bs []byte) error {
 		return err
 	}
 	term.Value = val
+
+	if loc, ok := v["location"].(map[string]interface{}); ok {
+		term.Location = &Location{}
+		err := unmarshalLocation(term.Location, loc)
+		if err != nil {
+			return err
+		}
+	}
 	return nil
 }
 
@@ -493,6 +523,20 @@ func ContainsComprehensions(v interface{}) bool {
 	return found
 }
 
+// ContainsClosures returns true if the Value v contains closures.
+func ContainsClosures(v interface{}) bool {
+	found := false
+	WalkClosures(v, func(x interface{}) bool {
+		switch x.(type) {
+		case *ArrayComprehension, *ObjectComprehension, *SetComprehension, *Every:
+			found = true
+			return found
+		}
+		return found
+	})
+	return found
+}
+
 // IsScalar returns true if the AST value is a scalar.
 func IsScalar(v Value) bool {
 	switch v.(type) {
@@ -878,19 +922,16 @@ func (ref Ref) Append(term *Term) Ref {
 // existing elements are shifted to the right. If pos > len(ref)+1 this
 // function panics.
 func (ref Ref) Insert(x *Term, pos int) Ref {
-	if pos == len(ref) {
+	switch {
+	case pos == len(ref):
 		return ref.Append(x)
-	} else if pos > len(ref)+1 {
+	case pos > len(ref)+1:
 		panic("illegal index")
 	}
 	cpy := make(Ref, len(ref)+1)
-	for i := 0; i < pos; i++ {
-		cpy[i] = ref[i]
-	}
+	copy(cpy, ref[:pos])
 	cpy[pos] = x
-	for i := pos; i < len(ref); i++ {
-		cpy[i+1] = ref[i]
-	}
+	copy(cpy[pos+1:], ref[pos:])
 	return cpy
 }
 
@@ -904,9 +945,8 @@ func (ref Ref) Extend(other Ref) Ref {
 	head.Value = String(head.Value.(Var))
 	offset := len(ref)
 	dst[offset] = head
-	for i := range other[1:] {
-		dst[offset+i+1] = other[i+1]
-	}
+
+	copy(dst[offset+1:], other[1:])
 	return dst
 }
 
@@ -917,10 +957,7 @@ func (ref Ref) Concat(terms []*Term) Ref {
 	}
 	cpy := make(Ref, len(ref)+len(terms))
 	copy(cpy, ref)
-
-	for i := range terms {
-		cpy[len(ref)+i] = terms[i]
-	}
+	copy(cpy[len(ref):], terms)
 	return cpy
 }
 
@@ -1064,38 +1101,64 @@ func (ref Ref) String() string {
 }
 
 // OutputVars returns a VarSet containing variables that would be bound by evaluating
-//  this expression in isolation.
+// this expression in isolation.
 func (ref Ref) OutputVars() VarSet {
 	vis := NewVarVisitor().WithParams(VarVisitorParams{SkipRefHead: true})
 	vis.Walk(ref)
 	return vis.Vars()
 }
 
+func (ref Ref) toArray() *Array {
+	a := NewArray()
+	for _, term := range ref {
+		if _, ok := term.Value.(String); ok {
+			a = a.Append(term)
+		} else {
+			a = a.Append(StringTerm(term.Value.String()))
+		}
+	}
+	return a
+}
+
 // QueryIterator defines the interface for querying AST documents with references.
 type QueryIterator func(map[Var]Value, Value) error
 
 // ArrayTerm creates a new Term with an Array value.
 func ArrayTerm(a ...*Term) *Term {
-	return &Term{Value: &Array{a, 0}}
+	return NewTerm(NewArray(a...))
 }
 
 // NewArray creates an Array with the terms provided. The array will
 // use the provided term slice.
 func NewArray(a ...*Term) *Array {
-	return &Array{a, 0}
+	hs := make([]int, len(a))
+	for i, e := range a {
+		hs[i] = e.Value.Hash()
+	}
+	arr := &Array{elems: a, hashs: hs, ground: termSliceIsGround(a)}
+	arr.rehash()
+	return arr
 }
 
 // Array represents an array as defined by the language. Arrays are similar to the
 // same types as defined by JSON with the exception that they can contain Vars
 // and References.
 type Array struct {
-	elems []*Term
-	hash  int
+	elems  []*Term
+	hashs  []int // element hashes
+	hash   int
+	ground bool
 }
 
 // Copy returns a deep copy of arr.
 func (arr *Array) Copy() *Array {
-	return &Array{termSliceCopy(arr.elems), arr.hash}
+	cpy := make([]int, len(arr.elems))
+	copy(cpy, arr.hashs)
+	return &Array{
+		elems:  termSliceCopy(arr.elems),
+		hashs:  cpy,
+		hash:   arr.hash,
+		ground: arr.IsGround()}
 }
 
 // Equal returns true if arr is equal to other.
@@ -1155,28 +1218,24 @@ func (arr *Array) Sorted() *Array {
 	}
 	sort.Sort(termSlice(cpy))
 	a := NewArray(cpy...)
-	a.hash = arr.hash
+	a.hashs = arr.hashs
 	return a
 }
 
 // Hash returns the hash code for the Value.
 func (arr *Array) Hash() int {
-	if arr.hash == 0 {
-		arr.hash = termSliceHash(arr.elems)
-	}
-
 	return arr.hash
 }
 
 // IsGround returns true if all of the Array elements are ground.
 func (arr *Array) IsGround() bool {
-	return termSliceIsGround(arr.elems)
+	return arr.ground
 }
 
 // MarshalJSON returns JSON encoded bytes representing arr.
 func (arr *Array) MarshalJSON() ([]byte, error) {
 	if len(arr.elems) == 0 {
-		return json.Marshal([]interface{}{})
+		return []byte(`[]`), nil
 	}
 	return json.Marshal(arr.elems)
 }
@@ -1204,10 +1263,19 @@ func (arr *Array) Elem(i int) *Term {
 	return arr.elems[i]
 }
 
+// rehash updates the cached hash of arr.
+func (arr *Array) rehash() {
+	arr.hash = 0
+	for _, h := range arr.hashs {
+		arr.hash += h
+	}
+}
+
 // set sets the element i of arr.
 func (arr *Array) set(i int, v *Term) {
+	arr.ground = arr.ground && v.IsGround()
 	arr.elems[i] = v
-	arr.hash = 0
+	arr.hashs[i] = v.Value.Hash()
 }
 
 // Slice returns a slice of arr starting from i index to j. -1
@@ -1215,11 +1283,22 @@ func (arr *Array) set(i int, v *Term) {
 // copy and any modifications to either of arrays may be reflected to
 // the other.
 func (arr *Array) Slice(i, j int) *Array {
+	var elems []*Term
+	var hashs []int
 	if j == -1 {
-		return &Array{elems: arr.elems[i:]}
+		elems = arr.elems[i:]
+		hashs = arr.hashs[i:]
+	} else {
+		elems = arr.elems[i:j]
+		hashs = arr.hashs[i:j]
 	}
+	// If arr is ground, the slice is, too.
+	// If it's not, the slice could still be.
+	gr := arr.ground || termSliceIsGround(elems)
 
-	return &Array{elems: arr.elems[i:j]}
+	s := &Array{elems: elems, hashs: hashs, ground: gr}
+	s.rehash()
+	return s
 }
 
 // Iter calls f on each element in arr. If f returns an error,
@@ -1256,7 +1335,9 @@ func (arr *Array) Foreach(f func(*Term)) {
 func (arr *Array) Append(v *Term) *Array {
 	cpy := *arr
 	cpy.elems = append(arr.elems, v)
-	cpy.hash = 0
+	cpy.hashs = append(arr.hashs, v.Value.Hash())
+	cpy.hash = arr.hash + v.Value.Hash()
+	cpy.ground = arr.ground && v.IsGround()
 	return &cpy
 }
 
@@ -1294,10 +1375,11 @@ func newset(n int) *set {
 		keys = make([]*Term, 0, n)
 	}
 	return &set{
-		elems:  make(map[int]*Term, n),
-		keys:   keys,
-		hash:   0,
-		ground: true,
+		elems:     make(map[int]*Term, n),
+		keys:      keys,
+		hash:      0,
+		ground:    true,
+		sortGuard: new(sync.Once),
 	}
 }
 
@@ -1310,10 +1392,11 @@ func SetTerm(t ...*Term) *Term {
 }
 
 type set struct {
-	elems  map[int]*Term
-	keys   []*Term
-	hash   int
-	ground bool
+	elems     map[int]*Term
+	keys      []*Term
+	hash      int
+	ground    bool
+	sortGuard *sync.Once // Prevents race condition around sorting.
 }
 
 // Copy returns a deep copy of s.
@@ -1334,11 +1417,6 @@ func (s *set) IsGround() bool {
 
 // Hash returns a hash code for s.
 func (s *set) Hash() int {
-	if s.hash == 0 {
-		s.Foreach(func(x *Term) {
-			s.hash += x.Hash()
-		})
-	}
 	return s.hash
 }
 
@@ -1348,7 +1426,7 @@ func (s *set) String() string {
 	}
 	var b strings.Builder
 	b.WriteRune('{')
-	for i := range s.keys {
+	for i := range s.sortedKeys() {
 		if i > 0 {
 			b.WriteString(", ")
 		}
@@ -1358,6 +1436,13 @@ func (s *set) String() string {
 	return b.String()
 }
 
+func (s *set) sortedKeys() []*Term {
+	s.sortGuard.Do(func() {
+		sort.Sort(termSlice(s.keys))
+	})
+	return s.keys
+}
+
 // Compare compares s to other, return <0, 0, or >0 if it is less than, equal to,
 // or greater than other.
 func (s *set) Compare(other Value) int {
@@ -1369,7 +1454,7 @@ func (s *set) Compare(other Value) int {
 		return 1
 	}
 	t := other.(*set)
-	return termSliceCompare(s.keys, t.keys)
+	return termSliceCompare(s.sortedKeys(), t.sortedKeys())
 }
 
 // Find returns the set or dereferences the element itself.
@@ -1435,7 +1520,7 @@ func (s *set) Add(t *Term) {
 // Iter calls f on each element in s. If f returns an error, iteration stops
 // and the return value is the error.
 func (s *set) Iter(f func(*Term) error) error {
-	for i := range s.keys {
+	for i := range s.sortedKeys() {
 		if err := f(s.keys[i]); err != nil {
 			return err
 		}
@@ -1509,28 +1594,28 @@ func (s *set) Len() int {
 // MarshalJSON returns JSON encoded bytes representing s.
 func (s *set) MarshalJSON() ([]byte, error) {
 	if s.keys == nil {
-		return json.Marshal([]interface{}{})
+		return []byte(`[]`), nil
 	}
-	return json.Marshal(s.keys)
+	return json.Marshal(s.sortedKeys())
 }
 
 // Sorted returns an Array that contains the sorted elements of s.
 func (s *set) Sorted() *Array {
 	cpy := make([]*Term, len(s.keys))
-	for i := range s.keys {
-		cpy[i] = s.keys[i]
-	}
-	sort.Sort(termSlice(cpy))
+	copy(cpy, s.sortedKeys())
 	return NewArray(cpy...)
 }
 
 // Slice returns a slice of terms contained in the set.
 func (s *set) Slice() []*Term {
-	return s.keys
+	return s.sortedKeys()
 }
 
+// NOTE(philipc): We assume a many-readers, single-writer model here.
+// This method should NOT be used concurrently, or else we risk data races.
 func (s *set) insert(x *Term) {
 	hash := x.Hash()
+	insertHash := hash
 	// This `equal` utility is duplicated and manually inlined a number of
 	// time in this file.  Inlining it avoids heap allocations, so it makes
 	// a big performance difference: some operations like lookup become twice
@@ -1608,27 +1693,23 @@ func (s *set) insert(x *Term) {
 		equal = func(y Value) bool { return Compare(x, y) == 0 }
 	}
 
-	for curr, ok := s.elems[hash]; ok; {
+	for curr, ok := s.elems[insertHash]; ok; {
 		if equal(curr.Value) {
 			return
 		}
 
-		hash++
-		curr, ok = s.elems[hash]
+		insertHash++
+		curr, ok = s.elems[insertHash]
 	}
 
-	s.elems[hash] = x
-	i := sort.Search(len(s.keys), func(i int) bool { return Compare(x, s.keys[i]) < 0 })
-	if i < len(s.keys) {
-		// insert at position `i`:
-		s.keys = append(s.keys, nil)   // add some space
-		copy(s.keys[i+1:], s.keys[i:]) // move things over
-		s.keys[i] = x                  // drop it in position
-	} else {
-		s.keys = append(s.keys, x)
-	}
+	s.elems[insertHash] = x
+	// O(1) insertion, but we'll have to re-sort the keys later.
+	s.keys = append(s.keys, x)
+	// Reset the sync.Once instance.
+	// See https://github.com/golang/go/issues/25955 for why we do it this way.
+	s.sortGuard = new(sync.Once)
 
-	s.hash = 0
+	s.hash += hash
 	s.ground = s.ground && x.IsGround()
 }
 
@@ -1740,7 +1821,7 @@ type Object interface {
 	MergeWith(other Object, conflictResolver func(v1, v2 *Term) (*Term, bool)) (Object, bool)
 	Filter(filter Object) (Object, error)
 	Keys() []*Term
-	Elem(i int) (*Term, *Term)
+	KeysIterator() ObjectKeysIterator
 	get(k *Term) *objectElem // To prevent external implementations
 }
 
@@ -1758,12 +1839,171 @@ func ObjectTerm(o ...[2]*Term) *Term {
 	return &Term{Value: NewObject(o...)}
 }
 
+func LazyObject(blob map[string]interface{}) Object {
+	return &lazyObj{native: blob}
+}
+
+type lazyObj struct {
+	strict Object
+	native map[string]interface{}
+}
+
+func (l *lazyObj) force() Object {
+	if l.strict == nil {
+		l.strict = MustInterfaceToValue(l.native).(Object)
+	}
+	return l.strict
+}
+
+func (l *lazyObj) Compare(other Value) int {
+	return l.force().Compare(other)
+}
+
+func (l *lazyObj) Copy() Object {
+	return l
+}
+
+func (l *lazyObj) Diff(other Object) Object {
+	return l.force().Diff(other)
+}
+
+func (l *lazyObj) Intersect(other Object) [][3]*Term {
+	return l.force().Intersect(other)
+}
+
+func (l *lazyObj) Iter(f func(*Term, *Term) error) error {
+	return l.force().Iter(f)
+}
+
+func (l *lazyObj) Until(f func(*Term, *Term) bool) bool {
+	// NOTE(sr): there could be benefits in not forcing here -- if we abort because
+	// `f` returns true, we could save us from converting the rest of the object.
+	return l.force().Until(f)
+}
+
+func (l *lazyObj) Foreach(f func(*Term, *Term)) {
+	l.force().Foreach(f)
+}
+
+func (l *lazyObj) Filter(filter Object) (Object, error) {
+	return l.force().Filter(filter)
+}
+
+func (l *lazyObj) Map(f func(*Term, *Term) (*Term, *Term, error)) (Object, error) {
+	return l.force().Map(f)
+}
+
+func (l *lazyObj) MarshalJSON() ([]byte, error) {
+	return l.force().(*object).MarshalJSON()
+}
+
+func (l *lazyObj) Merge(other Object) (Object, bool) {
+	return l.force().Merge(other)
+}
+
+func (l *lazyObj) MergeWith(other Object, conflictResolver func(v1, v2 *Term) (*Term, bool)) (Object, bool) {
+	return l.force().MergeWith(other, conflictResolver)
+}
+
+func (l *lazyObj) Len() int {
+	return len(l.native)
+}
+
+func (l *lazyObj) String() string {
+	return l.force().String()
+}
+
+// get is merely there to implement the Object interface -- `get` there serves the
+// purpose of prohibiting external implementations. It's never called for lazyObj.
+func (*lazyObj) get(*Term) *objectElem {
+	return nil
+}
+
+func (l *lazyObj) Get(k *Term) *Term {
+	if l.strict != nil {
+		return l.strict.Get(k)
+	}
+	if s, ok := k.Value.(String); ok {
+		if val, ok := l.native[string(s)]; ok {
+			switch val := val.(type) {
+			case map[string]interface{}:
+				return NewTerm(&lazyObj{native: val})
+			default:
+				return NewTerm(MustInterfaceToValue(val))
+			}
+		}
+	}
+	return nil
+}
+
+func (l *lazyObj) Insert(k, v *Term) {
+	l.force().Insert(k, v)
+}
+
+func (*lazyObj) IsGround() bool {
+	return true
+}
+
+func (l *lazyObj) Hash() int {
+	return l.force().Hash()
+}
+
+func (l *lazyObj) Keys() []*Term {
+	if l.strict != nil {
+		return l.strict.Keys()
+	}
+	ret := make([]*Term, 0, len(l.native))
+	for k := range l.native {
+		ret = append(ret, StringTerm(k))
+	}
+	sort.Sort(termSlice(ret))
+	return ret
+}
+
+func (l *lazyObj) KeysIterator() ObjectKeysIterator {
+	return &lazyObjKeysIterator{keys: l.Keys()}
+}
+
+type lazyObjKeysIterator struct {
+	current int
+	keys    []*Term
+}
+
+func (ki *lazyObjKeysIterator) Next() (*Term, bool) {
+	if ki.current == len(ki.keys) {
+		return nil, false
+	}
+	ki.current++
+	return ki.keys[ki.current-1], true
+}
+
+func (l *lazyObj) Find(path Ref) (Value, error) {
+	if l.strict != nil {
+		return l.strict.Find(path)
+	}
+	if len(path) == 0 {
+		return l, nil
+	}
+	if p0, ok := path[0].Value.(String); ok {
+		if v, ok := l.native[string(p0)]; ok {
+			switch v := v.(type) {
+			case map[string]interface{}:
+				return (&lazyObj{native: v}).Find(path[1:])
+			default:
+				return MustInterfaceToValue(v).Find(path[1:])
+			}
+		}
+	}
+	return nil, errFindNotFound
+}
+
 type object struct {
 	elems  map[int]*objectElem
 	keys   objectElemSlice
 	ground int // number of key and value grounds. Counting is
 	// required to support insert's key-value replace.
-	hash int
+	hash      int
+	sortGuard *sync.Once // Prevents race condition around sorting.
 }
 
 func newobject(n int) *object {
@@ -1772,10 +2012,11 @@ func newobject(n int) *object {
 		keys = make(objectElemSlice, 0, n)
 	}
 	return &object{
-		elems:  make(map[int]*objectElem, n),
-		keys:   keys,
-		ground: 0,
-		hash:   0,
+		elems:     make(map[int]*objectElem, n),
+		keys:      keys,
+		ground:    0,
+		hash:      0,
+		sortGuard: new(sync.Once),
 	}
 }
 
@@ -1797,9 +2038,19 @@ func Item(key, value *Term) [2]*Term {
 	return [2]*Term{key, value}
 }
 
+func (obj *object) sortedKeys() objectElemSlice {
+	obj.sortGuard.Do(func() {
+		sort.Sort(obj.keys)
+	})
+	return obj.keys
+}
+
 // Compare compares obj to other, return <0, 0, or >0 if it is less than, equal to,
 // or greater than other.
 func (obj *object) Compare(other Value) int {
+	if x, ok := other.(*lazyObj); ok {
+		other = x.force()
+	}
 	o1 := sortOrder(obj)
 	o2 := sortOrder(other)
 	if o1 < o2 {
@@ -1809,29 +2060,32 @@ func (obj *object) Compare(other Value) int {
 	}
 	a := obj
 	b := other.(*object)
-	minLen := len(a.keys)
-	if len(b.keys) < len(a.keys) {
-		minLen = len(b.keys)
+	// Ensure that keys are in canonical sorted order before use!
+	akeys := a.sortedKeys()
+	bkeys := b.sortedKeys()
+	minLen := len(akeys)
+	if len(b.keys) < len(akeys) {
+		minLen = len(bkeys)
 	}
 	for i := 0; i < minLen; i++ {
-		keysCmp := Compare(a.keys[i].key, b.keys[i].key)
+		keysCmp := Compare(akeys[i].key, bkeys[i].key)
 		if keysCmp < 0 {
 			return -1
 		}
 		if keysCmp > 0 {
 			return 1
 		}
-		valA := a.keys[i].value
-		valB := b.keys[i].value
+		valA := akeys[i].value
+		valB := bkeys[i].value
 		valCmp := Compare(valA, valB)
 		if valCmp != 0 {
 			return valCmp
 		}
 	}
-	if len(a.keys) < len(b.keys) {
+	if len(akeys) < len(bkeys) {
 		return -1
 	}
-	if len(b.keys) < len(a.keys) {
+	if len(bkeys) < len(akeys) {
 		return 1
 	}
 	return 0
@@ -1863,14 +2117,6 @@ func (obj *object) Get(k *Term) *Term {
 
 // Hash returns the hash code for the Value.
 func (obj *object) Hash() int {
-	if obj.hash == 0 {
-		for h, curr := range obj.elems {
-			for ; curr != nil; curr = curr.next {
-				obj.hash += h
-				obj.hash += curr.value.Hash()
-			}
-		}
-	}
 	return obj.hash
 }
 
@@ -1915,7 +2161,7 @@ func (obj *object) Intersect(other Object) [][3]*Term {
 // Iter calls the function f for each key-value pair in the object. If f
 // returns an error, iteration stops and the error is returned.
 func (obj *object) Iter(f func(*Term, *Term) error) error {
-	for _, node := range obj.keys {
+	for _, node := range obj.sortedKeys() {
 		if err := f(node.key, node.value); err != nil {
 			return err
 		}
@@ -1967,21 +2213,22 @@ func (obj *object) Map(f func(*Term, *Term) (*Term, *Term, error)) (Object, erro
 func (obj *object) Keys() []*Term {
 	keys := make([]*Term, len(obj.keys))
 
-	for i, elem := range obj.keys {
+	for i, elem := range obj.sortedKeys() {
 		keys[i] = elem.key
 	}
 
 	return keys
 }
 
-func (obj *object) Elem(i int) (*Term, *Term) {
-	return obj.keys[i].key, obj.keys[i].value
+// Returns an iterator over the obj's keys.
+func (obj *object) KeysIterator() ObjectKeysIterator {
+	return newobjectKeysIterator(obj)
 }
 
 // MarshalJSON returns JSON encoded bytes representing obj.
 func (obj *object) MarshalJSON() ([]byte, error) {
 	sl := make([][2]*Term, obj.Len())
-	for i, node := range obj.keys {
+	for i, node := range obj.sortedKeys() {
 		sl[i] = Item(node.key, node.value)
 	}
 	return json.Marshal(sl)
@@ -2061,7 +2308,7 @@ func (obj object) String() string {
 	var b strings.Builder
 	b.WriteRune('{')
 
-	for i, elem := range obj.keys {
+	for i, elem := range obj.sortedKeys() {
 		if i > 0 {
 			b.WriteString(", ")
 		}
@@ -2161,6 +2408,8 @@ func (obj *object) get(k *Term) *objectElem {
 	return nil
 }
 
+// NOTE(philipc): We assume a many-readers, single-writer model here.
+// This method should NOT be used concurrently, or else we risk data races.
 func (obj *object) insert(k, v *Term) {
 	hash := k.Hash()
 	head := obj.elems[hash]
@@ -2255,7 +2504,6 @@ func (obj *object) insert(k, v *Term) {
 			}
 
 			curr.value = v
-			obj.hash = 0
 			return
 		}
 	}
@@ -2265,16 +2513,12 @@ func (obj *object) insert(k, v *Term) {
 		next:  head,
 	}
 	obj.elems[hash] = elem
-	i := sort.Search(len(obj.keys), func(i int) bool { return Compare(elem.key, obj.keys[i].key) < 0 })
-	if i < len(obj.keys) {
-		// insert at position `i`:
-		obj.keys = append(obj.keys, nil)   // add some space
-		copy(obj.keys[i+1:], obj.keys[i:]) // move things over
-		obj.keys[i] = elem                 // drop it in position
-	} else {
-		obj.keys = append(obj.keys, elem)
-	}
-	obj.hash = 0
+	// O(1) insertion, but we'll have to re-sort the keys later.
+	obj.keys = append(obj.keys, elem)
+	// Reset the sync.Once instance.
+	// See https://github.com/golang/go/issues/25955 for why we do it this way.
+	obj.sortGuard = new(sync.Once)
+	obj.hash += hash + v.Hash()
 
 	if k.IsGround() {
 		obj.ground++
@@ -2349,6 +2593,36 @@ func filterObject(o Value, filter Value) (Value, error) {
 	}
 }
 
+// NOTE(philipc): The only way to get an ObjectKeyIterator should be
+// from an Object. This ensures that the iterator can have implementation-
+// specific details internally, with no contracts except to the very
+// limited interface.
+type ObjectKeysIterator interface {
+	Next() (*Term, bool)
+}
+
+type objectKeysIterator struct {
+	obj     *object
+	numKeys int
+	index   int
+}
+
+func newobjectKeysIterator(o *object) ObjectKeysIterator {
+	return &objectKeysIterator{
+		obj:     o,
+		numKeys: o.Len(),
+		index:   0,
+	}
+}
+
+func (oki *objectKeysIterator) Next() (*Term, bool) {
+	if oki.index == oki.numKeys || oki.numKeys == 0 {
+		return nil, false
+	}
+	oki.index++
+	return oki.obj.sortedKeys()[oki.index-1].key, true
+}
+
 // ArrayComprehension represents an array comprehension as defined in the language.
 type ArrayComprehension struct {
 	Term *Term `json:"term"`
@@ -2642,6 +2916,14 @@ func unmarshalExpr(expr *Expr, v map[string]interface{}) error {
 			return fmt.Errorf("ast: unable to unmarshal negated field with type: %T (expected true or false)", v["negated"])
 		}
 	}
+	if generatedRaw, ok := v["generated"]; ok {
+		if b, ok := generatedRaw.(bool); ok {
+			expr.Generated = b
+		} else {
+			return fmt.Errorf("ast: unable to unmarshal generated field with type: %T (expected true or false)", v["generated"])
+		}
+	}
+
 	if err := unmarshalExprIndex(expr, v); err != nil {
 		return err
 	}
@@ -2674,6 +2956,46 @@ func unmarshalExpr(expr *Expr, v map[string]interface{}) error {
 			expr.With = ws
 		}
 	}
+	if loc, ok := v["location"].(map[string]interface{}); ok {
+		expr.Location = &Location{}
+		if err := unmarshalLocation(expr.Location, loc); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func unmarshalLocation(loc *Location, v map[string]interface{}) error {
+	if x, ok := v["file"]; ok {
+		if s, ok := x.(string); ok {
+			loc.File = s
+		} else {
+			return fmt.Errorf("ast: unable to unmarshal file field with type: %T (expected string)", v["file"])
+		}
+	}
+	if x, ok := v["row"]; ok {
+		if n, ok := x.(json.Number); ok {
+			i64, err := n.Int64()
+			if err != nil {
+				return err
+			}
+			loc.Row = int(i64)
+		} else {
+			return fmt.Errorf("ast: unable to unmarshal row field with type: %T (expected number)", v["row"])
+		}
+	}
+	if x, ok := v["col"]; ok {
+		if n, ok := x.(json.Number); ok {
+			i64, err := n.Int64()
+			if err != nil {
+				return err
+			}
+			loc.Col = int(i64)
+		} else {
+			return fmt.Errorf("ast: unable to unmarshal col field with type: %T (expected number)", v["col"])
+		}
+	}
+
 	return nil
 }
 
@@ -2691,11 +3013,22 @@ func unmarshalExprIndex(expr *Expr, v map[string]interface{}) error {
 }
 
 func unmarshalTerm(m map[string]interface{}) (*Term, error) {
+	var term Term
+
 	v, err := unmarshalValue(m)
 	if err != nil {
 		return nil, err
 	}
-	return &Term{Value: v}, nil
+	term.Value = v
+
+	if loc, ok := m["location"].(map[string]interface{}); ok {
+		term.Location = &Location{}
+		if err := unmarshalLocation(term.Location, loc); err != nil {
+			return nil, err
+		}
+	}
+
+	return &term, nil
 }
 
 func unmarshalTermSlice(s []interface{}) ([]*Term, error) {
diff --git a/ast/term_bench_test.go b/ast/term_bench_test.go
index 48892898a4..30ec222462 100644
--- a/ast/term_bench_test.go
+++ b/ast/term_bench_test.go
@@ -32,6 +32,44 @@ func BenchmarkObjectLookup(b *testing.B) {
 	}
 }
 
+func BenchmarkObjectCreationAndLookup(b *testing.B) {
+	sizes := []int{5, 50, 500, 5000, 50000, 500000}
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			obj := NewObject()
+			for i := 0; i < n; i++ {
+				obj.Insert(StringTerm(fmt.Sprint(i)), IntNumberTerm(i))
+			}
+			key := StringTerm(fmt.Sprint(n - 1))
+			for i := 0; i < b.N; i++ {
+				value := obj.Get(key)
+				if value == nil {
+					b.Fatal("expected hit")
+				}
+			}
+		})
+	}
+}
+
+func BenchmarkSetCreationAndLookup(b *testing.B) {
+	sizes := []int{5, 50, 500, 5000, 50000, 500000}
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			set := NewSet()
+			for i := 0; i < n; i++ {
+				set.Add(StringTerm(fmt.Sprint(i)))
+			}
+			key := StringTerm(fmt.Sprint(n - 1))
+			for i := 0; i < b.N; i++ {
+				present := set.Contains(key)
+				if !present {
+					b.Fatal("expected hit")
+				}
+			}
+		})
+	}
+}
+
 func BenchmarkSetIntersection(b *testing.B) {
 	sizes := []int{5, 50, 500, 5000}
 	for _, n := range sizes {
@@ -109,14 +147,19 @@ func BenchmarkTermHashing(b *testing.B) {
 	}
 }
 
-var str string
-var bs []byte
+var (
+	str string
+	bs  []byte
+)
 
 // BenchmarkObjectString generates several objects of different sizes, and
 // marshals them to JSON via two ways:
-//   map[string]int -> ast.Value -> .String()
+//
+//	map[string]int -> ast.Value -> .String()
+//
 // and
-//   map[string]int -> json.Marshal()
+//
+//	map[string]int -> json.Marshal()
 //
 // The difference between these two is relevant for feeding input into the
 // wasm vm: when calling rego.New(...) with rego.Target("wasm"), it's up to
@@ -128,7 +171,6 @@ func BenchmarkObjectString(b *testing.B) {
 
 	for _, n := range sizes {
 		b.Run(fmt.Sprint(n), func(b *testing.B) {
-
 			obj := map[string]int{}
 			for i := 0; i < n; i++ {
 				obj[fmt.Sprint(i)] = i
@@ -154,8 +196,44 @@ func BenchmarkObjectString(b *testing.B) {
 	}
 }
 
-func BenchmarkObjectConstruction(b *testing.B) {
+// This benchmark works similarly to BenchmarkObjectString, but with a key
+// difference: it benchmarks the String and MarshalJSON interface functions
+// for the Objec, instead of the underlying data structure. This ensures
+// that we catch the full performance properties of Object's implementation.
+func BenchmarkObjectStringInterfaces(b *testing.B) {
+	var err error
 	sizes := []int{5, 50, 500, 5000, 50000}
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			obj := map[string]int{}
+			for i := 0; i < n; i++ {
+				obj[fmt.Sprint(i)] = i
+			}
+			valString := MustInterfaceToValue(obj)
+			valJSON := MustInterfaceToValue(obj)
+
+			b.Run("String()", func(b *testing.B) {
+				b.ResetTimer()
+				for i := 0; i < b.N; i++ {
+					str = valString.String()
+				}
+			})
+			b.Run("json.Marshal", func(b *testing.B) {
+				b.ResetTimer()
+				for i := 0; i < b.N; i++ {
+					bs, err = json.Marshal(valJSON)
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		})
+	}
+}
+
+func BenchmarkObjectConstruction(b *testing.B) {
+	sizes := []int{5, 50, 500, 5000, 50000, 500000}
 	seed := time.Now().UnixNano()
 
 	b.Run("shuffled keys", func(b *testing.B) {
@@ -165,7 +243,7 @@ func BenchmarkObjectConstruction(b *testing.B) {
 				for i := 0; i < n; i++ {
 					es = append(es, struct{ k, v int }{i, i})
 				}
-				rand.Seed(seed)
+				rand.New(rand.NewSource(seed)) // Seed the PRNG.
 				rand.Shuffle(len(es), func(i, j int) { es[i], es[j] = es[j], es[i] })
 				b.ResetTimer()
 				for i := 0; i < b.N; i++ {
@@ -205,7 +283,6 @@ func BenchmarkArrayString(b *testing.B) {
 
 	for _, n := range sizes {
 		b.Run(fmt.Sprint(n), func(b *testing.B) {
-
 			obj := make([]string, n)
 			for i := 0; i < n; i++ {
 				obj[i] = fmt.Sprint(i)
@@ -232,11 +309,10 @@ func BenchmarkArrayString(b *testing.B) {
 }
 
 func BenchmarkSetString(b *testing.B) {
-	sizes := []int{5, 50, 500, 5000}
+	sizes := []int{5, 50, 500, 5000, 50000}
 
 	for _, n := range sizes {
 		b.Run(fmt.Sprint(n), func(b *testing.B) {
-
 			val := NewSet()
 			for i := 0; i < n; i++ {
 				val.Add(IntNumberTerm(i))
@@ -251,3 +327,27 @@ func BenchmarkSetString(b *testing.B) {
 		})
 	}
 }
+
+func BenchmarkSetMarshalJSON(b *testing.B) {
+	var err error
+	sizes := []int{5, 50, 500, 5000, 50000}
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			set := NewSet()
+			for i := 0; i < n; i++ {
+				set.Add(StringTerm(fmt.Sprint(i)))
+			}
+
+			b.Run("json.Marshal", func(b *testing.B) {
+				b.ResetTimer()
+				for i := 0; i < b.N; i++ {
+					bs, err = json.Marshal(set)
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		})
+	}
+}
diff --git a/ast/term_test.go b/ast/term_test.go
index ca2d482b48..0e8f50478d 100644
--- a/ast/term_test.go
+++ b/ast/term_test.go
@@ -7,16 +7,18 @@ package ast
 import (
 	"encoding/json"
 	"fmt"
+	"math/rand"
 	"reflect"
+	"runtime"
 	"sort"
 	"strings"
+	"sync"
 	"testing"
 
 	"github.com/open-policy-agent/opa/util"
 )
 
 func TestInterfaceToValue(t *testing.T) {
-
 	// Test util package unmarshalled inputs
 	input := `
 	{
@@ -83,11 +85,9 @@ func TestInterfaceToValue(t *testing.T) {
 			t.Fatalf("Expected %v but got: %v", expected, v)
 		}
 	}
-
 }
 
 func TestInterfaceToValueStructs(t *testing.T) {
-
 	var x struct {
 		Foo struct {
 			Baz string `json:"baz"`
@@ -158,7 +158,6 @@ func TestObjectInsertGetLen(t *testing.T) {
 }
 
 func TestObjectSetOperations(t *testing.T) {
-
 	a := MustParseTerm(`{"a": "b", "c": "d"}`).Value.(Object)
 	b := MustParseTerm(`{"c": "q", "d": "e"}`).Value.(Object)
 
@@ -263,70 +262,7 @@ func TestObjectFilter(t *testing.T) {
 	}
 }
 
-func TestObjectInsertKeepsSorting(t *testing.T) {
-	keysSorted := func(o *object) func(int, int) bool {
-		return func(i, j int) bool {
-			return Compare(o.keys[i].key, o.keys[j].key) < 0
-		}
-	}
-
-	obj := NewObject(
-		[2]*Term{StringTerm("d"), IntNumberTerm(4)},
-		[2]*Term{StringTerm("b"), IntNumberTerm(2)},
-		[2]*Term{StringTerm("a"), IntNumberTerm(1)},
-	)
-	o := obj.(*object)
-	act := sort.SliceIsSorted(o.keys, keysSorted(o))
-	if exp := true; act != exp {
-		t.Errorf("SliceIsSorted: expected %v, got %v", exp, act)
-		for i := range o.keys {
-			t.Logf("elem[%d]: %v", i, o.keys[i].key)
-		}
-	}
-
-	obj.Insert(StringTerm("c"), IntNumberTerm(3))
-	act = sort.SliceIsSorted(o.keys, keysSorted(o))
-	if exp := true; act != exp {
-		t.Errorf("SliceIsSorted: expected %v, got %v", exp, act)
-		for i := range o.keys {
-			t.Logf("elem[%d]: %v", i, o.keys[i].key)
-		}
-	}
-}
-
-func TestSetInsertKeepsKeysSorting(t *testing.T) {
-	keysSorted := func(s *set) func(int, int) bool {
-		return func(i, j int) bool {
-			return Compare(s.keys[i], s.keys[j]) < 0
-		}
-	}
-
-	s0 := NewSet(
-		StringTerm("d"),
-		StringTerm("b"),
-		StringTerm("a"),
-	)
-	s := s0.(*set)
-	act := sort.SliceIsSorted(s.keys, keysSorted(s))
-	if exp := true; act != exp {
-		t.Errorf("SliceIsSorted: expected %v, got %v", exp, act)
-		for i := range s.keys {
-			t.Logf("elem[%d]: %v", i, s.keys[i])
-		}
-	}
-
-	s0.Add(StringTerm("c"))
-	act = sort.SliceIsSorted(s.keys, keysSorted(s))
-	if exp := true; act != exp {
-		t.Errorf("SliceIsSorted: expected %v, got %v", exp, act)
-		for i := range s.keys {
-			t.Logf("elem[%d]: %v", i, s.keys[i])
-		}
-	}
-}
-
 func TestTermBadJSON(t *testing.T) {
-
 	input := `{
 		"Value": [[
 			{"Value": [{"Value": "a", "Type": "var"}, {"Value": "x", "Type": "string"}], "Type": "ref"},
@@ -344,7 +280,6 @@ func TestTermBadJSON(t *testing.T) {
 	if !reflect.DeepEqual(expected, err) {
 		t.Errorf("Expected %v but got: %v", expected, err)
 	}
-
 }
 
 func TestTermEqual(t *testing.T) {
@@ -382,7 +317,6 @@ func TestTermEqual(t *testing.T) {
 }
 
 func TestFind(t *testing.T) {
-
 	term := MustParseTerm(`{"foo": [1,{"bar": {2,3,4}}], "baz": {"qux": ["hello", "world"]}}`)
 
 	tests := []struct {
@@ -418,8 +352,7 @@ func TestFind(t *testing.T) {
 	}
 }
 
-func TestHash(t *testing.T) {
-
+func TestHashObject(t *testing.T) {
 	doc := `{"a": [[true, {"b": [null]}, {"c": "d"}]], "e": {100: a[i].b}, "k": ["foo" | true], "o": {"foo": "bar" | true}, "sc": {"foo" | true}, "s": {1, 2, {3, 4}}, "big": 1e+1000}`
 
 	stmt1 := MustParseStatement(doc)
@@ -431,10 +364,78 @@ func TestHash(t *testing.T) {
 	if obj1.Hash() != obj2.Hash() {
 		t.Errorf("Expected hash codes to be equal")
 	}
+
+	// Calculate hash like we did before moving the caching to create/update:
+	obj := obj1.(*object)
+	exp := 0
+	for h, curr := range obj.elems {
+		for ; curr != nil; curr = curr.next {
+			exp += h
+			exp += curr.value.Hash()
+		}
+	}
+
+	if act := obj1.Hash(); exp != act {
+		t.Errorf("expected %v, got %v", exp, act)
+	}
 }
 
-func TestTermIsGround(t *testing.T) {
+func TestHashArray(t *testing.T) {
+	doc := `[{"a": [[true, {"b": [null]}, {"c": "d"}]]}, 100, true, [a[i].b], {100: a[i].b}, ["foo" | true], {"foo": "bar" | true}, {"foo" | true}, {1, 2, {3, 4}}, 1e+1000]`
+
+	stmt1 := MustParseStatement(doc)
+	stmt2 := MustParseStatement(doc)
+
+	arr1 := stmt1.(Body)[0].Terms.(*Term).Value.(*Array)
+	arr2 := stmt2.(Body)[0].Terms.(*Term).Value.(*Array)
+
+	if arr1.Hash() != arr2.Hash() {
+		t.Errorf("Expected hash codes to be equal")
+	}
+
+	// Calculate hash like we did before moving the caching to create/update:
+	exp := termSliceHash(arr1.elems)
 
+	if act := arr1.Hash(); exp != act {
+		t.Errorf("expected %v, got %v", exp, act)
+	}
+
+	for j := 0; j < arr1.Len(); j++ {
+		for i := 0; i <= j; i++ {
+			slice := arr1.Slice(i, j)
+			exp := termSliceHash(slice.elems)
+			if act := slice.Hash(); exp != act {
+				t.Errorf("arr1[%d:%d]: expected %v, got %v", i, j, exp, act)
+			}
+		}
+	}
+}
+
+func TestHashSet(t *testing.T) {
+	doc := `{{"a": [[true, {"b": [null]}, {"c": "d"}]]}, 100, 100, 100, true, [a[i].b], {100: a[i].b}, ["foo" | true], {"foo": "bar" | true}, {"foo" | true}, {1, 2, {3, 4}}, 1e+1000}`
+
+	stmt1 := MustParseStatement(doc)
+	stmt2 := MustParseStatement(doc)
+
+	set1 := stmt1.(Body)[0].Terms.(*Term).Value.(Set)
+	set2 := stmt2.(Body)[0].Terms.(*Term).Value.(Set)
+
+	if set1.Hash() != set2.Hash() {
+		t.Errorf("Expected hash codes to be equal")
+	}
+
+	// Calculate hash like we did before moving the caching to create/update:
+	exp := 0
+	set1.Foreach(func(x *Term) {
+		exp += x.Hash()
+	})
+
+	if act := set1.Hash(); exp != act {
+		t.Errorf("expected %v, got %v", exp, act)
+	}
+}
+
+func TestTermIsGround(t *testing.T) {
 	tests := []struct {
 		note     string
 		term     string
@@ -468,7 +469,6 @@ func TestTermIsGround(t *testing.T) {
 			t.Errorf("Expected term %v to be %s (test case %d: %v)", term, expected, i, tc.note)
 		}
 	}
-
 }
 
 func TestObjectRemainsGround(t *testing.T) {
@@ -512,7 +512,6 @@ func TestIsConstant(t *testing.T) {
 }
 
 func TestIsScalar(t *testing.T) {
-
 	tests := []struct {
 		term     string
 		expected bool
@@ -566,7 +565,6 @@ func TestTermString(t *testing.T) {
 }
 
 func TestRefHasPrefix(t *testing.T) {
-
 	a := MustParseRef("foo.bar.baz")
 	b := MustParseRef("foo.bar")
 	c := MustParseRef("foo.bar[0][x]")
@@ -706,7 +704,6 @@ func TestRefPtr(t *testing.T) {
 	if _, err := ref.Ptr(); err == nil {
 		t.Fatal("Expected error from x[1]")
 	}
-
 }
 
 func TestSetEqual(t *testing.T) {
@@ -738,7 +735,6 @@ func TestSetEqual(t *testing.T) {
 }
 
 func TestSetMap(t *testing.T) {
-
 	set := MustParseTerm(`{"foo", "bar", "baz", "qux"}`).Value.(Set)
 
 	result, err := set.Map(func(term *Term) (*Term, error) {
@@ -748,7 +744,6 @@ func TestSetMap(t *testing.T) {
 		}
 		return term, nil
 	})
-
 	if err != nil {
 		t.Fatalf("Unexpected error: %v", err)
 	}
@@ -766,7 +761,6 @@ func TestSetMap(t *testing.T) {
 	if !reflect.DeepEqual(err, fmt.Errorf("oops")) {
 		t.Fatalf("Expected oops to be returned but got: %v, %v", result, err)
 	}
-
 }
 
 func TestSetAddContainsLen(t *testing.T) {
@@ -805,7 +799,6 @@ func TestSetAddContainsLen(t *testing.T) {
 }
 
 func TestSetOperations(t *testing.T) {
-
 	tests := []struct {
 		a  string
 		b  string
@@ -861,8 +854,95 @@ func TestSetCopy(t *testing.T) {
 	}
 }
 
-func TestArrayOperations(t *testing.T) {
+// Constructs a set, and then has several reader goroutines attempt to
+// concurrently iterate across it. This should pretty consistently
+// hit a race condition around sorting the underlying key slice if
+// the sorting isn't guarded properly.
+func TestSetConcurrentReads(t *testing.T) {
+	// Create array of numbers.
+	numbers := make([]*Term, 10000)
+	for i := 0; i < 10000; i++ {
+		numbers[i] = IntNumberTerm(i)
+	}
+	// Shuffle numbers array for random insertion order.
+	rand.New(rand.NewSource(10000)) // Seed the PRNG.
+	rand.Shuffle(len(numbers), func(i, j int) {
+		numbers[i], numbers[j] = numbers[j], numbers[i]
+	})
+	// Build set with numbers in unsorted order.
+	s := NewSet()
+	for i := 0; i < len(numbers); i++ {
+		s.Add(numbers[i])
+	}
+	// In-place sort on numbers.
+	sort.Sort(termSlice(numbers))
+
+	// Check if race condition on key sorting is present.
+	var wg sync.WaitGroup
+	num := runtime.NumCPU()
+	wg.Add(num)
+	for i := 0; i < num; i++ {
+		go func() {
+			defer wg.Done()
+			var retrieved []*Term
+			s.Foreach(func(v *Term) {
+				retrieved = append(retrieved, v)
+			})
+			// Check for sortedness of retrieved results.
+			// This will hit a race condition around `s.sortedKeys`.
+			for n := 0; n < len(retrieved); n++ {
+				if retrieved[n] != numbers[n] {
+					t.Errorf("Expected: %v at iteration %d but got %v instead", numbers[n], n, retrieved[n])
+				}
+			}
+		}()
+	}
+	wg.Wait()
+}
+
+func TestObjectConcurrentReads(t *testing.T) {
+	// Create array of numbers.
+	numbers := make([]*Term, 10000)
+	for i := 0; i < 10000; i++ {
+		numbers[i] = IntNumberTerm(i)
+	}
+	// Shuffle numbers array for random insertion order.
+	rand.New(rand.NewSource(10000)) // Seed the PRNG.
+	rand.Shuffle(len(numbers), func(i, j int) {
+		numbers[i], numbers[j] = numbers[j], numbers[i]
+	})
+	// Build an object with numbers in unsorted order.
+	o := NewObject()
+	for i := 0; i < len(numbers); i++ {
+		o.Insert(numbers[i], NullTerm())
+	}
+	// In-place sort on numbers.
+	sort.Sort(termSlice(numbers))
+
+	// Check if race condition on key sorting is present.
+	var wg sync.WaitGroup
+	num := runtime.NumCPU()
+	wg.Add(num)
+	for i := 0; i < num; i++ {
+		go func() {
+			defer wg.Done()
+			var retrieved []*Term
+			o.Foreach(func(k, v *Term) {
+				retrieved = append(retrieved, k)
+			})
+			// Check for sortedness of retrieved results.
+			// This will hit a race condition around `s.sortedKeys`.
+			for n := 0; n < len(retrieved); n++ {
+				if retrieved[n] != numbers[n] {
+					t.Errorf("Expected: %v at iteration %d but got %v instead", numbers[n], n, retrieved[n])
+				}
+			}
+		}()
+	}
+	wg.Wait()
+}
 
+func TestArrayOperations(t *testing.T) {
 	arr := MustParseTerm(`[1,2,3,4]`).Value.(*Array)
 
 	getTests := []struct {
@@ -987,7 +1067,6 @@ func TestArrayOperations(t *testing.T) {
 }
 
 func TestValueToInterface(t *testing.T) {
-
 	// Happy path
 	term := MustParseTerm(`{
 		"foo": [1, "two", true, null, {3,
@@ -1060,6 +1139,53 @@ func TestValueToInterface(t *testing.T) {
 	}
 }
 
+// NOTE(sr): Without the opt-out, we don't allocate another object for
+// the conversion back to interface{} if it can be avoided. As a result,
+// the value held by the store could be changed.
+func TestJSONWithOptLazyObjDefault(t *testing.T) {
+	// would live in the store
+	m := map[string]interface{}{
+		"foo": "bar",
+	}
+	o := LazyObject(m)
+
+	n, err := JSONWithOpt(o, JSONOpt{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	n0, ok := n.(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected %T, got %T: %[2]v", n0, n)
+	}
+	n0["baz"] = true
+
+	if v, ok := m["baz"]; !ok || !v.(bool) {
+		t.Errorf("expected change in m, found none: %v", m)
+	}
+}
+
+func TestJSONWithOptLazyObjOptOut(t *testing.T) {
+	// would live in the store
+	m := map[string]interface{}{
+		"foo": "bar",
+	}
+	o := LazyObject(m)
+
+	n, err := JSONWithOpt(o, JSONOpt{CopyMaps: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	n0, ok := n.(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected %T, got %T: %[2]v", n0, n)
+	}
+	n0["baz"] = true
+
+	if _, ok := m["baz"]; ok {
+		t.Errorf("expected no change in m, found one: %v", m)
+	}
+}
+
 func assertTermEqual(t *testing.T, x *Term, y *Term) {
 	if !x.Equal(y) {
 		t.Errorf("Failure on equality: \n%s and \n%s\n", x, y)
@@ -1078,3 +1204,167 @@ func assertToString(t *testing.T, val Value, expected string) {
 		t.Errorf("Expected %v but got %v", expected, result)
 	}
 }
+
+func TestLazyObjectGet(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": map[string]interface{}{
+				"c": true,
+			},
+		},
+	})
+	y := x.Get(StringTerm("a"))
+	_, ok := y.Value.(*lazyObj)
+	if !ok {
+		t.Errorf("expected Get() to return another lazy object, got %v %[1]T", y.Value)
+	}
+	assertForced(t, x, false)
+}
+
+func TestLazyObjectFind(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": map[string]interface{}{
+				"c": true,
+			},
+			"d": []interface{}{true, true, true},
+		},
+	})
+	// retrieve object via Find
+	y, err := x.Find(Ref{StringTerm("a"), StringTerm("b")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, ok := y.(*lazyObj)
+	if !ok {
+		t.Errorf("expected Find() to return another lazy object, got %v %[1]T", y)
+	}
+	assertForced(t, x, false)
+
+	// retrieve array via Find
+	z, err := x.Find(Ref{StringTerm("a"), StringTerm("d")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, ok = z.(*Array)
+	if !ok {
+		t.Errorf("expected Find() to return array, got %v %[1]T", z)
+	}
+}
+
+func TestLazyObjectCopy(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": map[string]interface{}{
+				"c": true,
+			},
+		},
+	})
+	y := x.Copy()
+	_, ok := y.(*lazyObj)
+	if !ok {
+		t.Errorf("expected Get() to return another lazy object, got %v %[1]T", y)
+	}
+	assertForced(t, x, false)
+}
+
+func TestLazyObjectLen(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": map[string]interface{}{
+				"c": true,
+			},
+		},
+	})
+	if exp, act := 1, x.Len(); exp != act {
+		t.Errorf("expected Len() %v, got %v", exp, act)
+	}
+	assertForced(t, x, false)
+}
+
+func TestLazyObjectIsGround(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": map[string]interface{}{
+				"c": true,
+			},
+		},
+	})
+	if exp, act := true, x.IsGround(); exp != act {
+		t.Errorf("expected IsGround() %v, got %v", exp, act)
+	}
+	assertForced(t, x, false)
+}
+
+func TestLazyObjectInsert(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": "b",
+	})
+	x.Insert(StringTerm("c"), StringTerm("d"))
+	assertForced(t, x, true)
+
+	// NOTE(sr): We compare after asserting that it was forced, since comparison
+	// forces the lazy object, too.
+	if act, exp := x, NewObject(Item(StringTerm("a"), StringTerm("b")), Item(StringTerm("c"), StringTerm("d"))); exp.Compare(act) != 0 {
+		t.Errorf("expected %v to be equal to %v", act, exp)
+	}
+}
+
+func TestLazyObjectKeys(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": "A",
+		"c": "C",
+		"b": "B",
+	})
+	act := x.Keys()
+	exp := []*Term{StringTerm("a"), StringTerm("b"), StringTerm("c")}
+	if !reflect.DeepEqual(exp, act) {
+		t.Errorf("expected Keys() %v, got %v", exp, act)
+	}
+	assertForced(t, x, false)
+}
+
+func TestLazyObjectKeysIterator(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": "A",
+		"c": "C",
+		"b": "B",
+	})
+	ki := x.KeysIterator()
+	act := make([]*Term, 0, x.Len())
+	for k, next := ki.Next(); next; k, next = ki.Next() {
+		act = append(act, k)
+	}
+	exp := []*Term{StringTerm("a"), StringTerm("b"), StringTerm("c")}
+	if !reflect.DeepEqual(exp, act) {
+		t.Errorf("expected Keys() %v, got %v", exp, act)
+	}
+	assertForced(t, x, false)
+}
+
+func TestLazyObjectCompare(t *testing.T) {
+	x := LazyObject(map[string]interface{}{
+		"a": map[string]interface{}{
+			"b": map[string]interface{}{
+				"c": true,
+			},
+		},
+	})
+	if exp, act := 1, x.Compare(NewObject()); exp != act {
+		t.Errorf("expected Compare() => %v, got %v", exp, act)
+	}
+	assertForced(t, x, true)
+}
+
+func assertForced(t *testing.T, x Object, forced bool) {
+	t.Helper()
+	l, ok := x.(*lazyObj)
+	switch {
+	case !ok:
+		t.Errorf("expected lazy object, got %v %[1]T", x)
+	case !forced && l.strict != nil:
+		t.Errorf("expected %v to not be forced", l)
+	case forced && l.strict == nil:
+		t.Errorf("expected %v to be forced", l)
+	}
+}
diff --git a/ast/transform.go b/ast/transform.go
index c7fa4c8f1d..391a164860 100644
--- a/ast/transform.go
+++ b/ast/transform.go
@@ -13,7 +13,7 @@ import (
 // be set to nil and no transformations will be applied to children of the
 // element.
 type Transformer interface {
-	Transform(v interface{}) (interface{}, error)
+	Transform(interface{}) (interface{}, error)
 }
 
 // Transform iterates the AST and calls the Transform function on the
@@ -116,6 +116,9 @@ func Transform(t Transformer, x interface{}) (interface{}, error) {
 		}
 		return y, nil
 	case *Head:
+		if y.Reference, err = transformRef(t, y.Reference); err != nil {
+			return nil, err
+		}
 		if y.Name, err = transformVar(t, y.Name); err != nil {
 			return nil, err
 		}
@@ -172,6 +175,26 @@ func Transform(t Transformer, x interface{}) (interface{}, error) {
 			if y.Terms, err = transformTerm(t, ts); err != nil {
 				return nil, err
 			}
+		case *Every:
+			if ts.Key != nil {
+				ts.Key, err = transformTerm(t, ts.Key)
+				if err != nil {
+					return nil, err
+				}
+			}
+			ts.Value, err = transformTerm(t, ts.Value)
+			if err != nil {
+				return nil, err
+			}
+			ts.Domain, err = transformTerm(t, ts.Domain)
+			if err != nil {
+				return nil, err
+			}
+			ts.Body, err = transformBody(t, ts.Body)
+			if err != nil {
+				return nil, err
+			}
+			y.Terms = ts
 		}
 		for i, w := range y.With {
 			w, err := Transform(t, w)
@@ -307,7 +330,7 @@ func TransformComprehensions(x interface{}, f func(interface{}) (Value, error))
 // GenericTransformer implements the Transformer interface to provide a utility
 // to transform AST nodes using a closure.
 type GenericTransformer struct {
-	f func(x interface{}) (interface{}, error)
+	f func(interface{}) (interface{}, error)
 }
 
 // NewGenericTransformer returns a new GenericTransformer that will transform
@@ -394,3 +417,15 @@ func transformVar(t Transformer, v Var) (Var, error) {
 	}
 	return r, nil
 }
+
+func transformRef(t Transformer, r Ref) (Ref, error) {
+	r1, err := Transform(t, r)
+	if err != nil {
+		return nil, err
+	}
+	r2, ok := r1.(Ref)
+	if !ok {
+		return nil, fmt.Errorf("illegal transform: %T != %T", r, r2)
+	}
+	return r2, nil
+}
diff --git a/ast/transform_test.go b/ast/transform_test.go
index 9ae8a87f4c..8c5a051aae 100644
--- a/ast/transform_test.go
+++ b/ast/transform_test.go
@@ -13,6 +13,7 @@ func TestTransform(t *testing.T) {
 
 import input.foo
 import data.bar.this as qux
+import future.keywords.every
 
 p = true { "this" = "that" }
 p = "this" { false }
@@ -22,6 +23,8 @@ p = true { ["this" | "this"] }
 p = n { count({"this", "that"}, n) with input.foo.this as {"this": true} }
 p { false } else = "this" { "this" } else = ["this"] { true }
 foo(x) = y { split(x, "this", y) }
+p { every x in ["this"] { x == "this" } }
+a.b.c.this["this"] = d { d := "this" }
 `)
 
 	result, err := Transform(&GenericTransformer{
@@ -46,6 +49,7 @@ foo(x) = y { split(x, "this", y) }
 
 import input.foo
 import data.bar.that as qux
+import future.keywords.every
 
 p = true { "that" = "that" }
 p = "that" { false }
@@ -55,6 +59,8 @@ p = true { ["that" | "that"] }
 p = n { count({"that"}, n) with input.foo.that as {"that": true} }
 p { false } else = "that" { "that" } else = ["that"] { true }
 foo(x) = y { split(x, "that", y) }
+p { every x in ["that"] { x == "that" } }
+a.b.c.that["that"] = d { d := "that" }
 `)
 
 	if !expected.Equal(resultMod) {
@@ -109,3 +115,23 @@ p := 7`, ParserOptions{ProcessAnnotation: true})
 	}
 
 }
+
+func TestTransformRefsAndRuleHeads(t *testing.T) {
+	module := MustParseModule(`package test
+p.q.this.fo[x] = y { x := "x"; y := "y" }`)
+
+	result, err := TransformRefs(module, func(r Ref) (Value, error) {
+		if r[0].Value.Compare(Var("p")) == 0 {
+			r[2] = StringTerm("that")
+		}
+		return r, nil
+	})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	resultMod := result.(*Module)
+	if exp, act := MustParseRef("p.q.that.fo[x]"), resultMod.Rules[0].Head.Reference; !act.Equal(exp) {
+		t.Errorf("expected %v, got %v", exp, act)
+	}
+}
diff --git a/ast/varset.go b/ast/varset.go
index 16dc3f5849..14f531494b 100644
--- a/ast/varset.go
+++ b/ast/varset.go
@@ -91,7 +91,7 @@ func (s VarSet) Update(vs VarSet) {
 }
 
 func (s VarSet) String() string {
-	tmp := []string{}
+	tmp := make([]string, 0, len(s))
 	for v := range s {
 		tmp = append(tmp, string(v))
 	}
diff --git a/ast/visit.go b/ast/visit.go
index 139c4de3f5..7b0d3b08e7 100644
--- a/ast/visit.go
+++ b/ast/visit.go
@@ -7,13 +7,15 @@ package ast
 // Visitor defines the interface for iterating AST elements. The Visit function
 // can return a Visitor w which will be used to visit the children of the AST
 // element v. If the Visit function returns nil, the children will not be
-// visited. This is deprecated.
+// visited.
+// Deprecated: use GenericVisitor or another visitor implementation
 type Visitor interface {
 	Visit(v interface{}) (w Visitor)
 }
 
 // BeforeAndAfterVisitor wraps Visitor to provide hooks for being called before
-// and after the AST has been visited. This is deprecated.
+// and after the AST has been visited.
+// Deprecated: use GenericVisitor or another visitor implementation
 type BeforeAndAfterVisitor interface {
 	Visitor
 	Before(x interface{})
@@ -21,7 +23,8 @@ type BeforeAndAfterVisitor interface {
 }
 
 // Walk iterates the AST by calling the Visit function on the Visitor
-// v for x before recursing. This is deprecated.
+// v for x before recursing.
+// Deprecated: use GenericVisitor.Walk
 func Walk(v Visitor, x interface{}) {
 	if bav, ok := v.(BeforeAndAfterVisitor); !ok {
 		walk(v, x)
@@ -33,7 +36,8 @@ func Walk(v Visitor, x interface{}) {
 }
 
 // WalkBeforeAndAfter iterates the AST by calling the Visit function on the
-// Visitor v for x before recursing. This is deprecated.
+// Visitor v for x before recursing.
+// Deprecated: use GenericVisitor.Walk
 func WalkBeforeAndAfter(v BeforeAndAfterVisitor, x interface{}) {
 	Walk(v, x)
 }
@@ -46,17 +50,17 @@ func walk(v Visitor, x interface{}) {
 	switch x := x.(type) {
 	case *Module:
 		Walk(w, x.Package)
-		for _, i := range x.Imports {
-			Walk(w, i)
+		for i := range x.Imports {
+			Walk(w, x.Imports[i])
 		}
-		for _, r := range x.Rules {
-			Walk(w, r)
+		for i := range x.Rules {
+			Walk(w, x.Rules[i])
 		}
-		for _, a := range x.Annotations {
-			Walk(w, a)
+		for i := range x.Annotations {
+			Walk(w, x.Annotations[i])
 		}
-		for _, c := range x.Comments {
-			Walk(w, c)
+		for i := range x.Comments {
+			Walk(w, x.Comments[i])
 		}
 	case *Package:
 		Walk(w, x.Path)
@@ -79,23 +83,21 @@ func walk(v Visitor, x interface{}) {
 			Walk(w, x.Value)
 		}
 	case Body:
-		for _, e := range x {
-			Walk(w, e)
+		for i := range x {
+			Walk(w, x[i])
 		}
 	case Args:
-		for _, t := range x {
-			Walk(w, t)
+		for i := range x {
+			Walk(w, x[i])
 		}
 	case *Expr:
 		switch ts := x.Terms.(type) {
-		case *SomeDecl:
+		case *Term, *SomeDecl, *Every:
 			Walk(w, ts)
 		case []*Term:
-			for _, t := range ts {
-				Walk(w, t)
+			for i := range ts {
+				Walk(w, ts[i])
 			}
-		case *Term:
-			Walk(w, ts)
 		}
 		for i := range x.With {
 			Walk(w, x.With[i])
@@ -106,8 +108,8 @@ func walk(v Visitor, x interface{}) {
 	case *Term:
 		Walk(w, x.Value)
 	case Ref:
-		for _, t := range x {
-			Walk(w, t)
+		for i := range x {
+			Walk(w, x[i])
 		}
 	case *object:
 		x.Foreach(func(k, vv *Term) {
@@ -133,8 +135,19 @@ func walk(v Visitor, x interface{}) {
 		Walk(w, x.Term)
 		Walk(w, x.Body)
 	case Call:
-		for _, t := range x {
-			Walk(w, t)
+		for i := range x {
+			Walk(w, x[i])
+		}
+	case *Every:
+		if x.Key != nil {
+			Walk(w, x.Key)
+		}
+		Walk(w, x.Value)
+		Walk(w, x.Domain)
+		Walk(w, x.Body)
+	case *SomeDecl:
+		for i := range x.Symbols {
+			Walk(w, x.Symbols[i])
 		}
 	}
 }
@@ -155,8 +168,8 @@ func WalkVars(x interface{}, f func(Var) bool) {
 // returns true, AST nodes under the last node will not be visited.
 func WalkClosures(x interface{}, f func(interface{}) bool) {
 	vis := &GenericVisitor{func(x interface{}) bool {
-		switch x.(type) {
-		case *ArrayComprehension, *ObjectComprehension, *SetComprehension:
+		switch x := x.(type) {
+		case *ArrayComprehension, *ObjectComprehension, *SetComprehension, *Every:
 			return f(x)
 		}
 		return false
@@ -277,17 +290,17 @@ func (vis *GenericVisitor) Walk(x interface{}) {
 	switch x := x.(type) {
 	case *Module:
 		vis.Walk(x.Package)
-		for _, i := range x.Imports {
-			vis.Walk(i)
+		for i := range x.Imports {
+			vis.Walk(x.Imports[i])
 		}
-		for _, r := range x.Rules {
-			vis.Walk(r)
+		for i := range x.Rules {
+			vis.Walk(x.Rules[i])
 		}
-		for _, a := range x.Annotations {
-			vis.Walk(a)
+		for i := range x.Annotations {
+			vis.Walk(x.Annotations[i])
 		}
-		for _, c := range x.Comments {
-			vis.Walk(c)
+		for i := range x.Comments {
+			vis.Walk(x.Comments[i])
 		}
 	case *Package:
 		vis.Walk(x.Path)
@@ -310,23 +323,21 @@ func (vis *GenericVisitor) Walk(x interface{}) {
 			vis.Walk(x.Value)
 		}
 	case Body:
-		for _, e := range x {
-			vis.Walk(e)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case Args:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case *Expr:
 		switch ts := x.Terms.(type) {
-		case *SomeDecl:
+		case *Term, *SomeDecl, *Every:
 			vis.Walk(ts)
 		case []*Term:
-			for _, t := range ts {
-				vis.Walk(t)
+			for i := range ts {
+				vis.Walk(ts[i])
 			}
-		case *Term:
-			vis.Walk(ts)
 		}
 		for i := range x.With {
 			vis.Walk(x.With[i])
@@ -337,21 +348,27 @@ func (vis *GenericVisitor) Walk(x interface{}) {
 	case *Term:
 		vis.Walk(x.Value)
 	case Ref:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case *object:
 		x.Foreach(func(k, v *Term) {
 			vis.Walk(k)
 			vis.Walk(x.Get(k))
 		})
+	case Object:
+		x.Foreach(func(k, v *Term) {
+			vis.Walk(k)
+			vis.Walk(x.Get(k))
+		})
 	case *Array:
 		x.Foreach(func(t *Term) {
 			vis.Walk(t)
 		})
 	case Set:
-		for _, t := range x.Slice() {
-			vis.Walk(t)
+		xSlice := x.Slice()
+		for i := range xSlice {
+			vis.Walk(xSlice[i])
 		}
 	case *ArrayComprehension:
 		vis.Walk(x.Term)
@@ -364,8 +381,19 @@ func (vis *GenericVisitor) Walk(x interface{}) {
 		vis.Walk(x.Term)
 		vis.Walk(x.Body)
 	case Call:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
+		}
+	case *Every:
+		if x.Key != nil {
+			vis.Walk(x.Key)
+		}
+		vis.Walk(x.Value)
+		vis.Walk(x.Domain)
+		vis.Walk(x.Body)
+	case *SomeDecl:
+		for i := range x.Symbols {
+			vis.Walk(x.Symbols[i])
 		}
 	}
 }
@@ -398,17 +426,17 @@ func (vis *BeforeAfterVisitor) Walk(x interface{}) {
 	switch x := x.(type) {
 	case *Module:
 		vis.Walk(x.Package)
-		for _, i := range x.Imports {
-			vis.Walk(i)
+		for i := range x.Imports {
+			vis.Walk(x.Imports[i])
 		}
-		for _, r := range x.Rules {
-			vis.Walk(r)
+		for i := range x.Rules {
+			vis.Walk(x.Rules[i])
 		}
-		for _, a := range x.Annotations {
-			vis.Walk(a)
+		for i := range x.Annotations {
+			vis.Walk(x.Annotations[i])
 		}
-		for _, c := range x.Comments {
-			vis.Walk(c)
+		for i := range x.Comments {
+			vis.Walk(x.Comments[i])
 		}
 	case *Package:
 		vis.Walk(x.Path)
@@ -422,32 +450,34 @@ func (vis *BeforeAfterVisitor) Walk(x interface{}) {
 			vis.Walk(x.Else)
 		}
 	case *Head:
-		vis.Walk(x.Name)
-		vis.Walk(x.Args)
-		if x.Key != nil {
-			vis.Walk(x.Key)
+		if len(x.Reference) > 0 {
+			vis.Walk(x.Reference)
+		} else {
+			vis.Walk(x.Name)
+			if x.Key != nil {
+				vis.Walk(x.Key)
+			}
 		}
+		vis.Walk(x.Args)
 		if x.Value != nil {
 			vis.Walk(x.Value)
 		}
 	case Body:
-		for _, e := range x {
-			vis.Walk(e)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case Args:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case *Expr:
 		switch ts := x.Terms.(type) {
-		case *SomeDecl:
+		case *Term, *SomeDecl, *Every:
 			vis.Walk(ts)
 		case []*Term:
-			for _, t := range ts {
-				vis.Walk(t)
+			for i := range ts {
+				vis.Walk(ts[i])
 			}
-		case *Term:
-			vis.Walk(ts)
 		}
 		for i := range x.With {
 			vis.Walk(x.With[i])
@@ -458,21 +488,27 @@ func (vis *BeforeAfterVisitor) Walk(x interface{}) {
 	case *Term:
 		vis.Walk(x.Value)
 	case Ref:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case *object:
 		x.Foreach(func(k, v *Term) {
 			vis.Walk(k)
 			vis.Walk(x.Get(k))
 		})
+	case Object:
+		x.Foreach(func(k, v *Term) {
+			vis.Walk(k)
+			vis.Walk(x.Get(k))
+		})
 	case *Array:
 		x.Foreach(func(t *Term) {
 			vis.Walk(t)
 		})
 	case Set:
-		for _, t := range x.Slice() {
-			vis.Walk(t)
+		xSlice := x.Slice()
+		for i := range xSlice {
+			vis.Walk(xSlice[i])
 		}
 	case *ArrayComprehension:
 		vis.Walk(x.Term)
@@ -485,8 +521,19 @@ func (vis *BeforeAfterVisitor) Walk(x interface{}) {
 		vis.Walk(x.Term)
 		vis.Walk(x.Body)
 	case Call:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
+		}
+	case *Every:
+		if x.Key != nil {
+			vis.Walk(x.Key)
+		}
+		vis.Walk(x.Value)
+		vis.Walk(x.Domain)
+		vis.Walk(x.Body)
+	case *SomeDecl:
+		for i := range x.Symbols {
+			vis.Walk(x.Symbols[i])
 		}
 	}
 }
@@ -527,6 +574,8 @@ func (vis *VarVisitor) Vars() VarSet {
 	return vis.vars
 }
 
+// visit determines if the VarVisitor will recurse into x: if it returns `true`,
+// the visitor will _skip_ that branch of the AST
 func (vis *VarVisitor) visit(v interface{}) bool {
 	if vis.params.SkipObjectKeys {
 		if o, ok := v.(Object); ok {
@@ -538,16 +587,23 @@ func (vis *VarVisitor) visit(v interface{}) bool {
 	}
 	if vis.params.SkipRefHead {
 		if r, ok := v.(Ref); ok {
-			for _, t := range r[1:] {
-				vis.Walk(t)
+			rSlice := r[1:]
+			for i := range rSlice {
+				vis.Walk(rSlice[i])
 			}
 			return true
 		}
 	}
 	if vis.params.SkipClosures {
-		switch v.(type) {
+		switch v := v.(type) {
 		case *ArrayComprehension, *ObjectComprehension, *SetComprehension:
 			return true
+		case *Expr:
+			if ev, ok := v.Terms.(*Every); ok {
+				vis.Walk(ev.Domain)
+				// We're _not_ walking ev.Body -- that's the closure here
+				return true
+			}
 		}
 	}
 	if vis.params.SkipWithTarget {
@@ -565,14 +621,15 @@ func (vis *VarVisitor) visit(v interface{}) bool {
 		switch v := v.(type) {
 		case *Expr:
 			if terms, ok := v.Terms.([]*Term); ok {
-				for _, t := range terms[0].Value.(Ref)[1:] {
-					vis.Walk(t)
+				termSlice := terms[0].Value.(Ref)[1:]
+				for i := range termSlice {
+					vis.Walk(termSlice[i])
 				}
 				for i := 1; i < len(terms); i++ {
 					vis.Walk(terms[i])
 				}
-				for _, w := range v.With {
-					vis.Walk(w)
+				for i := range v.With {
+					vis.Walk(v.With[i])
 				}
 				return true
 			}
@@ -585,6 +642,22 @@ func (vis *VarVisitor) visit(v interface{}) bool {
 				vis.Walk(v[i])
 			}
 			return true
+		case *With:
+			if ref, ok := v.Target.Value.(Ref); ok {
+				refSlice := ref[1:]
+				for i := range refSlice {
+					vis.Walk(refSlice[i])
+				}
+			}
+			if ref, ok := v.Value.Value.(Ref); ok {
+				refSlice := ref[1:]
+				for i := range refSlice {
+					vis.Walk(refSlice[i])
+				}
+			} else {
+				vis.Walk(v.Value)
+			}
+			return true
 		}
 	}
 	if v, ok := v.(Var); ok {
@@ -604,14 +677,14 @@ func (vis *VarVisitor) Walk(x interface{}) {
 	switch x := x.(type) {
 	case *Module:
 		vis.Walk(x.Package)
-		for _, i := range x.Imports {
-			vis.Walk(i)
+		for i := range x.Imports {
+			vis.Walk(x.Imports[i])
 		}
-		for _, r := range x.Rules {
-			vis.Walk(r)
+		for i := range x.Rules {
+			vis.Walk(x.Rules[i])
 		}
-		for _, c := range x.Comments {
-			vis.Walk(c)
+		for i := range x.Comments {
+			vis.Walk(x.Comments[i])
 		}
 	case *Package:
 		vis.Walk(x.Path)
@@ -625,32 +698,35 @@ func (vis *VarVisitor) Walk(x interface{}) {
 			vis.Walk(x.Else)
 		}
 	case *Head:
-		vis.Walk(x.Name)
-		vis.Walk(x.Args)
-		if x.Key != nil {
-			vis.Walk(x.Key)
+		if len(x.Reference) > 0 {
+			vis.Walk(x.Reference)
+		} else {
+			vis.Walk(x.Name)
+			if x.Key != nil {
+				vis.Walk(x.Key)
+			}
 		}
+		vis.Walk(x.Args)
+
 		if x.Value != nil {
 			vis.Walk(x.Value)
 		}
 	case Body:
-		for _, e := range x {
-			vis.Walk(e)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case Args:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case *Expr:
 		switch ts := x.Terms.(type) {
-		case *SomeDecl:
+		case *Term, *SomeDecl, *Every:
 			vis.Walk(ts)
 		case []*Term:
-			for _, t := range ts {
-				vis.Walk(t)
+			for i := range ts {
+				vis.Walk(ts[i])
 			}
-		case *Term:
-			vis.Walk(ts)
 		}
 		for i := range x.With {
 			vis.Walk(x.With[i])
@@ -661,8 +737,8 @@ func (vis *VarVisitor) Walk(x interface{}) {
 	case *Term:
 		vis.Walk(x.Value)
 	case Ref:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
 		}
 	case *object:
 		x.Foreach(func(k, v *Term) {
@@ -674,8 +750,9 @@ func (vis *VarVisitor) Walk(x interface{}) {
 			vis.Walk(t)
 		})
 	case Set:
-		for _, t := range x.Slice() {
-			vis.Walk(t)
+		xSlice := x.Slice()
+		for i := range xSlice {
+			vis.Walk(xSlice[i])
 		}
 	case *ArrayComprehension:
 		vis.Walk(x.Term)
@@ -688,8 +765,19 @@ func (vis *VarVisitor) Walk(x interface{}) {
 		vis.Walk(x.Term)
 		vis.Walk(x.Body)
 	case Call:
-		for _, t := range x {
-			vis.Walk(t)
+		for i := range x {
+			vis.Walk(x[i])
+		}
+	case *Every:
+		if x.Key != nil {
+			vis.Walk(x.Key)
+		}
+		vis.Walk(x.Value)
+		vis.Walk(x.Domain)
+		vis.Walk(x.Body)
+	case *SomeDecl:
+		for i := range x.Symbols {
+			vis.Walk(x.Symbols[i])
 		}
 	}
 }
diff --git a/ast/visit_test.go b/ast/visit_test.go
index 1b3694508b..23d4f57e72 100644
--- a/ast/visit_test.go
+++ b/ast/visit_test.go
@@ -29,6 +29,7 @@ t[x] = y {
 	y = [[x, z] | x = "x"; z = "z"]
 	z = {"foo": [x, z] | x = "x"; z = "z"}
 	s = {1 | a[i] = "foo"}
+	some x0, y0, z0
 	count({1, 2, 3}, n) with input.foo.bar as x
 }
 
@@ -37,264 +38,10 @@ p { false } else { false } else { true }
 fn([x, y]) = z { json.unmarshal(x, z); z > y }
 `)
 	vis := &testVis{}
-
 	NewGenericVisitor(vis.Visit).Walk(rule)
 
-	/*
-		mod
-			package
-				data.a.b
-					term
-						data
-					term
-						a
-					term
-						b
-			import
-				term
-					input.x.y
-						term
-							input
-						term
-							x
-						term
-							y
-						z
-			rule
-				head
-					t
-					args
-					term
-						x
-					term
-						y
-				body
-					expr1
-						term
-							ref
-								term
-									=
-						term
-							ref1
-								term
-									p
-								term
-									x
-						term
-							object1
-								term
-									"foo"
-								term
-									array
-										term
-											y
-										term
-											2
-										term
-											object2
-												term
-													"bar"
-												term
-													3
-					expr2
-						term
-							ref2
-								term
-									q
-								term
-									x
-					expr3
-						term
-							ref
-								term
-									=
-						term
-							y
-						term
-							compr
-								term
-									array
-										term
-											x
-										term
-											z
-								body
-									expr4
-										term
-											ref
-												term
-													=
-										term
-											x
-										term
-											"x"
-									expr5
-										term
-											ref
-												term
-													=
-										term
-											z
-										term
-											"z"
-					expr4
-						term
-							ref
-								term
-									=
-						term
-							z
-						term
-							compr
-								key
-									term
-										"foo"
-								value
-									array
-										term
-											x
-										term
-											z
-								body
-									expr1
-										term
-											ref
-												term
-													=
-										term
-											x
-										term
-											"x"
-									expr2
-										term
-											ref
-												term
-													=
-										term
-											z
-										term
-											"z"
-					expr5
-						term
-							ref
-								term
-									=
-						term
-							s
-						term
-							compr
-								term
-									1
-								body
-									expr1
-										term
-											ref
-												term
-													=
-										term
-											ref
-												term
-													a
-												term
-													i
-
-										term
-											"foo"
-					expr6
-						term
-							ref
-								term
-									count
-						term
-							set
-								term
-									1
-								term
-									2
-								term
-									3
-						term
-							n
-						with
-							term
-								input.foo.bar
-									term
-										input
-									term
-										foo
-									term
-										bar
-							term
-								baz
-			rule
-				head
-					p
-					args
-					<nil> # not counted
-					term
-						true
-				body
-					expr
-						term
-							false
-				rule
-					head
-						p
-						args
-						<nil> # not counted
-						term
-							true
-					body
-						expr
-							term
-								false
-					rule
-						head
-							p
-							args
-							<nil> # not counted
-							term
-								true
-						body
-							expr
-								term
-									true
-			func
-				head
-					fn
-					args
-						term
-							array
-								term
-									x
-								term
-									y
-					term
-						z
-				body
-					expr1
-						term
-							ref
-								term
-									json
-								term
-									unmarshal
-						term
-							x
-						term
-							z
-					expr2
-						term
-							ref
-								term
-									>
-						term
-							z
-						term
-							y
-	*/
-	if len(vis.elems) != 246 {
-		t.Errorf("Expected exactly 246 elements in AST but got %d: %v", len(vis.elems), vis.elems)
+	if exp, act := 254, len(vis.elems); exp != act {
+		t.Errorf("Expected exactly %d elements in AST but got %d: %v", exp, act, vis.elems)
 	}
 }
 
@@ -344,6 +91,7 @@ t[x] = y {
 	y = [[x, z] | x = "x"; z = "z"]
 	z = {"foo": [x, z] | x = "x"; z = "z"}
 	s = {1 | a[i] = "foo"}
+	some x0, y0, z0
 	count({1, 2, 3}, n) with input.foo.bar as x
 }
 
@@ -359,8 +107,8 @@ fn([x, y]) = z { json.unmarshal(x, z); z > y }
 	})
 	vis.Walk(rule)
 
-	if len(elems) != 246 {
-		t.Errorf("Expected exactly 246 elements in AST but got %d: %v", len(elems), elems)
+	if len(elems) != 254 {
+		t.Errorf("Expected exactly 254 elements in AST but got %d: %v", len(elems), elems)
 	}
 }
 
@@ -375,6 +123,7 @@ t[x] = y {
 	y = [[x, z] | x = "x"; z = "z"]
 	z = {"foo": [x, z] | x = "x"; z = "z"}
 	s = {1 | a[i] = "foo"}
+	some x0, y0, z0
 	count({1, 2, 3}, n) with input.foo.bar as x
 }
 
@@ -393,12 +142,12 @@ fn([x, y]) = z { json.unmarshal(x, z); z > y }
 		})
 	vis.Walk(rule)
 
-	if len(before) != 246 {
-		t.Errorf("Expected exactly 246 before elements in AST but got %d: %v", len(before), before)
+	if exp, act := 264, len(before); exp != act {
+		t.Errorf("Expected exactly %d before elements in AST but got %d: %v", exp, act, before)
 	}
 
-	if len(after) != 246 {
-		t.Errorf("Expected exactly 246 after elements in AST but got %d: %v", len(after), after)
+	if exp, act := 264, len(before); exp != act {
+		t.Errorf("Expected exactly %d after elements in AST but got %d: %v", exp, act, after)
 	}
 }
 
@@ -414,21 +163,66 @@ func TestVarVisitor(t *testing.T) {
 		{"data.foo[x] = bar.baz[y]", VarVisitorParams{SkipRefHead: true}, "[x, y]"},
 		{`foo = [x | data.a[i] = x]`, VarVisitorParams{SkipClosures: true}, "[foo, eq]"},
 		{`x = 1; y = 2; z = x + y; count([x, y, z], z)`, VarVisitorParams{}, "[x, y, z, eq, plus, count]"},
+		{"some x, y", VarVisitorParams{}, "[x, y]"},
 	}
 
 	for _, tc := range tests {
-		stmt := MustParseStatement(tc.stmt)
+		t.Run(tc.stmt, func(t *testing.T) {
+			stmt := MustParseStatement(tc.stmt)
+
+			expected := NewVarSet()
+			MustParseTerm(tc.expected).Value.(*Array).Foreach(func(x *Term) {
+				expected.Add(x.Value.(Var))
+			})
 
-		expected := NewVarSet()
-		MustParseTerm(tc.expected).Value.(*Array).Foreach(func(x *Term) {
-			expected.Add(x.Value.(Var))
+			vis := NewVarVisitor().WithParams(tc.params)
+			vis.Walk(stmt)
+
+			if !vis.Vars().Equal(expected) {
+				t.Errorf("Params %#v expected %v but got: %v", tc.params, expected, vis.Vars())
+			}
 		})
+	}
+}
+
+func TestGenericVisitorLazyObject(t *testing.T) {
+	o := LazyObject(map[string]interface{}{"foo": 3})
+	act := 0
+	WalkTerms(o, func(n *Term) bool {
+		switch n.Value {
+		case String("foo"):
+			act++
+		case Number("3"):
+			act++
+		}
 
-		vis := NewVarVisitor().WithParams(tc.params)
-		vis.Walk(stmt)
+		return false
+	})
+	if exp := 2; exp != act {
+		t.Errorf("expected %v, got %v", exp, act)
+	}
+}
 
-		if !vis.Vars().Equal(expected) {
-			t.Errorf("For %v w/ %v expected %v but got: %v", stmt, tc.params, expected, vis.Vars())
+func TestGenericBeforeAfterVisitorLazyObject(t *testing.T) {
+	o := LazyObject(map[string]interface{}{"foo": 3})
+	act := 0
+	vis := NewBeforeAfterVisitor(func(x interface{}) bool {
+		t, ok := x.(*Term)
+		if !ok {
+			return false
 		}
+		switch t.Value {
+		case String("foo"):
+			act++
+		case Number("3"):
+			act++
+		}
+
+		return false
+	},
+		func(interface{}) {})
+	vis.Walk(o)
+	if exp := 2; exp != act {
+		t.Errorf("expected %v, got %v", exp, act)
 	}
 }
diff --git a/build/binary-smoke-test.sh b/build/binary-smoke-test.sh
new file mode 100755
index 0000000000..f06c3b6afd
--- /dev/null
+++ b/build/binary-smoke-test.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -eo pipefail
+OPA_EXEC="$1"
+TARGET="$2"
+
+PATH_SEPARATOR="/"
+BASE_PATH=$(pwd)
+TEST_PATH="${BASE_PATH}/test/cli/smoke/namespace/data.json"
+if [[ $OPA_EXEC == *".exe" ]]; then
+    PATH_SEPARATOR="\\"
+    BASE_PATH=$(pwd -W)
+    TEST_PATH="$(echo ${BASE_PATH}/test/cli/smoke/namespace/data.json | sed 's/^\///' | sed 's/\//\\\\/g')"
+    BASE_PATH=$(echo ${BASE_PATH} | sed 's/^\///' | sed 's/\//\\/g')
+fi
+
+github_actions_group() {
+    local args="$*"
+    echo "::group::$args"
+    $args
+    echo "::endgroup::"
+}
+
+opa() {
+    local args="$*"
+    github_actions_group $OPA_EXEC $args
+}
+
+# assert_contains checks if the actual string contains the expected string.
+assert_contains() {
+    local expected="$1"
+    local actual="$2"
+    if [[ "$actual" != *"$expected"* ]]; then
+        echo "Expected '$expected' but got '$actual'"
+        exit 1
+    fi
+}
+
+# assert_not_contains checks if the actual string does not contain the expected string.
+assert_not_contains() {
+    local expected="$1"
+    local actual="$2"
+    if [[ "$actual" == *"$expected"* ]]; then
+        echo "Didn't expect '$expected' in '$actual'"
+        exit 0
+    fi
+}
+
+opa version
+opa eval -t $TARGET 'time.now_ns()'
+opa eval --format pretty --bundle test/cli/smoke/golden-bundle.tar.gz --input test/cli/smoke/input.json data.test.result --fail
+opa exec --bundle test/cli/smoke/golden-bundle.tar.gz --decision test/result test/cli/smoke/input.json
+opa build --output o0.tar.gz test/cli/smoke/data.yaml test/cli/smoke/test.rego
+echo '{"yay": "bar"}' | opa eval --format pretty --bundle o0.tar.gz -I data.test.result --fail
+opa build --optimize 1 --output o1.tar.gz test/cli/smoke/data.yaml test/cli/smoke/test.rego
+echo '{"yay": "bar"}' | opa eval --format pretty --bundle o1.tar.gz -I data.test.result --fail
+opa build --optimize 2 --output o2.tar.gz  test/cli/smoke/data.yaml test/cli/smoke/test.rego
+echo '{"yay": "bar"}' | opa eval --format pretty --bundle o2.tar.gz -I data.test.result --fail
+
+# Tar paths 
+opa build --output o3.tar.gz test/cli/smoke
+github_actions_group assert_contains '/test/cli/smoke/test.rego' "$(tar -tf o3.tar.gz /test/cli/smoke/test.rego)"
+
+# Data files - correct namespaces
+echo "::group:: Data files - correct namespaces"
+assert_contains "data.namespace | test${PATH_SEPARATOR}cli${PATH_SEPARATOR}smoke${PATH_SEPARATOR}namespace${PATH_SEPARATOR}data.json" "$(opa inspect test/cli/smoke)"
+echo "::endgroup::"
+
+# Data files - correct root path
+echo "::group:: Data files - correct root path"
+assert_contains "${TEST_PATH}" "$(opa inspect ${BASE_PATH}/test/cli/smoke -f json)"
+assert_not_contains "\\\\${TEST_PATH}" "$(opa inspect ${BASE_PATH}/test/cli/smoke -f json)"
+echo "::endgroup::"
\ No newline at end of file
diff --git a/build/changelog.py b/build/changelog.py
index 08b1c9e73d..75195a0e45 100755
--- a/build/changelog.py
+++ b/build/changelog.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python2
+#!/usr/bin/env python3
 """
 changelog.py helps generate the CHANGELOG.md message for a particular release.
 """
@@ -8,7 +8,7 @@
 import subprocess
 import shlex
 import re
-import urllib2
+import urllib.request, urllib.error, urllib.parse
 import sys
 import json
 
@@ -31,35 +31,21 @@ def get_commit_message(commit_id):
 
 
 def fetch(url, token):
-    req = urllib2.Request(url)
+    req = urllib.request.Request(url)
     if token:
         req.add_header('Authorization', "token {}".format(token))
     try:
-        rsp = urllib2.urlopen(req)
+        rsp = urllib.request.urlopen(req)
         result = json.loads(rsp.read())
     except Exception as e:
         if hasattr(e, 'reason'):
-            print >> sys.stderr, 'Failed to fetch URL {}: {}'.format(url, e.reason)
+            print('Failed to fetch URL {}: {}'.format(url, e.reason), file=sys.stderr)
         elif hasattr(e, 'code'):
-            print >> sys.stderr, 'Failed to fetch URL {}: Code {}'.format(url, e.code)
+            print('Failed to fetch URL {}: Code {}'.format(url, e.code), file=sys.stderr)
         return {}
     else:
         return result
 
-
-def get_maintainers():
-    with open("MAINTAINERS.md", "r") as f:
-        contents = f.read()
-    maintainers = re.findall(r"[^\s]+@[^\s]+", contents)
-    return maintainers
-
-maintainers = get_maintainers()
-
-
-def is_maintainer(commit_message):
-    author = author_email(commit_message)
-    return author in maintainers
-
 org_members_usernames = []
 def get_org_members(token):
     url = "https://api.github.com/orgs/open-policy-agent/members?per_page=100"
@@ -72,7 +58,6 @@ def get_org_members(token):
         if login:
             org_members_usernames.append(str(login))
         if email:
-            maintainers.append(str(email))
             github_ids[email]=login
 
 def author_email(commit_message):
@@ -101,16 +86,14 @@ def get_github_id(commit_message, commit_id, token):
 
 def mention_author(commit_message, commit_id, token):
     username = get_github_id(commit_message, commit_id, token)
-    if username not in org_members_usernames:
-        return "authored by @[{author}](https://github.com/{author})".format(author=username)
-    return ""
+    return "authored by @{author}".format(author=username)
 
 def get_issue_reporter(issue_id, token):
     url = "https://api.github.com/repos/open-policy-agent/opa/issues/{issue_id}".format(issue_id=issue_id)
     issue_data = fetch(url, token)
     username = issue_data.get("user", "").get("login", "")
     if username not in org_members_usernames:
-        return "reported by @[{reporter}](https://github.com/{reporter})".format(reporter=username)
+        return "reported by @{reporter}".format(reporter=username)
     return ""
 
 def fixes_issue_id(commit_message):
@@ -163,8 +146,7 @@ def main():
         mention = ""
         reporter = ""
         commit_message = get_commit_message(commit_id)
-        if not is_maintainer(commit_message):
-            mention = mention_author(commit_message, commit_id, args.token)
+        mention = mention_author(commit_message, commit_id, args.token)
         issue_id = fixes_issue_id(commit_message)
         if issue_id:
             reporter = get_issue_reporter(issue_id, args.token)
diff --git a/build/check-fuzz.sh b/build/check-fuzz.sh
deleted file mode 100755
index f4fa5d2a5d..0000000000
--- a/build/check-fuzz.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-OPA_DIR=$(dirname "${BASH_SOURCE}")/..
-
-usage() {
-    echo "check-fuzz.sh <time limit>"
-}
-
-DURATION=$1
-
-if [[ -z "${DURATION}" ]]; then
-    usage
-    exit 1
-fi
-
-
-"${OPA_DIR}"/build/time-bound.sh "${DURATION}" make -C "${OPA_DIR}" fuzz
-
-WORKDIR=${OPA_DIR}/build/fuzzer/workdir
-CRASHER_DIR=${WORKDIR}/crashers
-
-if [[ ! -d "${WORKDIR}" ]]; then
-    echo "Missing go-fuzz workdir!"
-    exit 1
-fi
-
-CRASHERS=$(find "${CRASHER_DIR}" -name "*.output" | wc -l | tr -d '[:space:]')
-
-echo ""
-echo "Found ${CRASHERS} crashers!"
-
-if [[ "${CRASHERS}" == "0" ]]; then
-    exit 0
-else
-    echo "See ${CRASHER_DIR} for details"
-    exit 1
-fi
diff --git a/build/check-working-copy.sh b/build/check-working-copy.sh
index 85bb7cd6e2..c4bff64ca1 100755
--- a/build/check-working-copy.sh
+++ b/build/check-working-copy.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 
 EXCEPTIONS=(
-  "internal/compiler/wasm/opa/opa.go"
   "internal/compiler/wasm/opa/opa.wasm"
   "internal/compiler/wasm/opa/callgraph.csv"
 )
@@ -26,5 +25,7 @@ if [[ "${HAS_CHANGES}" == "1" ]]; then
   echo ""
   echo "git status"
   git status
+  echo "git diff"
+  git diff
   exit 1
 fi
diff --git a/build/commit-cli-docs.sh b/build/commit-cli-docs.sh
new file mode 100755
index 0000000000..a1c00e8f3d
--- /dev/null
+++ b/build/commit-cli-docs.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+OPA_DIR=$(dirname "${BASH_SOURCE}")/..
+
+cd "${OPA_DIR}"
+
+git add docs/content/cli.md
+
+if [[ -z "$(git diff --name-only --cached)" ]]; then
+  echo "No CLI doc changes to commit"
+  exit 1
+fi
+
+git commit -m "docs: Update generated CLI docs"
+
+echo ""
+echo "Committed changes for files:"
+git diff-tree --no-commit-id --name-only -r HEAD
+echo ""
diff --git a/build/docs-build-needed.sh b/build/docs-build-needed.sh
new file mode 100755
index 0000000000..36c6a4d2bf
--- /dev/null
+++ b/build/docs-build-needed.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -exo pipefail
+
+# NOTE(sr): we include version because that's what drives releases
+# Makefile and netlify.toml capture when the build infrastructure changes
+# ast/builtins.go and capabilities.json are driving the builtins_metadata.
+git diff --name-only --exit-code $CACHED_COMMIT_REF $COMMIT_REF docs/ Makefile build/ netlify.toml ast/builtins.go capabilities.json version/ CHANGELOG.md
diff --git a/build/ensure-linux-toolchain.sh b/build/ensure-linux-toolchain.sh
new file mode 100755
index 0000000000..ee687ffb3f
--- /dev/null
+++ b/build/ensure-linux-toolchain.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+case "$(uname -m | tr '[:upper:]' '[:lower:]')" in
+  amd64 | x86_64 | x64)
+    HOST_ARCH=amd64
+    ;;
+  arm64 | aarch64)
+    HOST_ARCH=arm64
+    ;;
+  *)
+    echo "Error: Host architecture not supported." >&2
+    exit 1
+    ;;
+esac
+
+# Native build
+if [ "${GOARCH}" = "${HOST_ARCH}" ]; then
+  if ! [ -x "$(command -v gcc)" ]; then
+    echo "Error: gcc not found." >&2
+    exit 1
+  fi
+  exit 0
+fi
+
+# Cross-compile
+case "${GOARCH}" in
+  amd64)
+    PKG=gcc-x86-64-linux-gnu
+    CC=x86_64-linux-gnu-gcc
+    ;;
+  arm64)
+    PKG=gcc-aarch64-linux-gnu
+    CC=aarch64-linux-gnu-gcc
+    ;;
+  *)
+    echo "Error: Target architecture ${GOARCH} not supported." >&2
+    exit 1
+    ;;
+esac
+
+type -f ${CC} 2>/dev/null && exit 0
+
+if ! [ -x "$(command -v apt-get)" ]; then
+  echo "Error: apt-get not found. Could not install missing toolchain." >&2
+  exit 1
+fi
+
+apt-get update >/dev/null && \
+  apt-get install -y ${PKG} >/dev/null
+
+echo ${CC}
diff --git a/build/fuzzer/.gitignore b/build/fuzzer/.gitignore
deleted file mode 100644
index 95bfbf9b57..0000000000
--- a/build/fuzzer/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-workdir/
-*.zip
diff --git a/build/fuzzer/Makefile b/build/fuzzer/Makefile
deleted file mode 100644
index a4aab0a474..0000000000
--- a/build/fuzzer/Makefile
+++ /dev/null
@@ -1,22 +0,0 @@
-.PHONY: all
-all: clean deps build fuzz
-
-.PHONY: clean
-clean:
-	rm -f *.zip
-	rm -fr workdir
-
-
-.PHONY: deps
-deps:
-	go get -u github.com/dvyukov/go-fuzz/go-fuzz github.com/dvyukov/go-fuzz/go-fuzz-build
-
-# NOTE(sr): go-fuzz-build and Go 1.15/1.16 run into each other on the compiler directive
-# used in xxhash. So, let's skip instrumenting that for now.
-.PHONY: build
-build:
-	go-fuzz-build -preserve github.com/OneOfOne/xxhash github.com/open-policy-agent/fuzz-opa
-
-.PHONY: fuzz
-fuzz:
-	go-fuzz -bin=fuzz-fuzz.zip -workdir=workdir
diff --git a/build/fuzzer/README.md b/build/fuzzer/README.md
deleted file mode 100644
index c8132cca92..0000000000
--- a/build/fuzzer/README.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# OPA Fuzzer
-
-## How To Run
-Install the fuzzer:
-
-```bash
-make deps
-```
-
-Build the fuzzer package. The fuzzer package includes the code to run and the corpus:
-
-```bash
-make build
-```
-
-Run the fuzzer:
-
-```bash
-make fuzz
-```
-
-The last command will start the fuzzer and output the results to the workdir.
-
-> Note: The fuzzer will run in an infinite loop testing until manually interrupted!
-
-See [go-fuzz/README.md](https://github.com/dvyukov/go-fuzz) for details on the
-fuzzer output. Pay attention to the `restarts` output field. This value should
-be around 1/10,000. If it's higher than this and the `crashers` field is greater
-than zero, check the output directory for crash output.
-
-## Easy Mode
-```bash
-make all
-```
-
-Starts the unbounded fuzzing process.
diff --git a/build/fuzzer/corpus/00000.stmt b/build/fuzzer/corpus/00000.stmt
deleted file mode 100644
index f2159129a3..0000000000
--- a/build/fuzzer/corpus/00000.stmt
+++ /dev/null
@@ -1 +0,0 @@
-context
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00001.stmt b/build/fuzzer/corpus/00001.stmt
deleted file mode 100644
index 8c310f1fcd..0000000000
--- a/build/fuzzer/corpus/00001.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encoding/json
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00002.stmt b/build/fuzzer/corpus/00002.stmt
deleted file mode 100644
index 1bbfb77ac7..0000000000
--- a/build/fuzzer/corpus/00002.stmt
+++ /dev/null
@@ -1 +0,0 @@
-errors
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00003.stmt b/build/fuzzer/corpus/00003.stmt
deleted file mode 100644
index d256c0a121..0000000000
--- a/build/fuzzer/corpus/00003.stmt
+++ /dev/null
@@ -1 +0,0 @@
-fmt
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00004.stmt b/build/fuzzer/corpus/00004.stmt
deleted file mode 100644
index e9cd0fde78..0000000000
--- a/build/fuzzer/corpus/00004.stmt
+++ /dev/null
@@ -1 +0,0 @@
-math/rand
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00005.stmt b/build/fuzzer/corpus/00005.stmt
deleted file mode 100644
index 2deb0bd83f..0000000000
--- a/build/fuzzer/corpus/00005.stmt
+++ /dev/null
@@ -1 +0,0 @@
-reflect
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00006.stmt b/build/fuzzer/corpus/00006.stmt
deleted file mode 100644
index dcdd4815d3..0000000000
--- a/build/fuzzer/corpus/00006.stmt
+++ /dev/null
@@ -1 +0,0 @@
-sync
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00007.stmt b/build/fuzzer/corpus/00007.stmt
deleted file mode 100644
index 9a2c7732fa..0000000000
--- a/build/fuzzer/corpus/00007.stmt
+++ /dev/null
@@ -1 +0,0 @@
-testing
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00008.stmt b/build/fuzzer/corpus/00008.stmt
deleted file mode 100644
index 0082886fda..0000000000
--- a/build/fuzzer/corpus/00008.stmt
+++ /dev/null
@@ -1 +0,0 @@
-time
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00009.stmt b/build/fuzzer/corpus/00009.stmt
deleted file mode 100644
index a7a89d2583..0000000000
--- a/build/fuzzer/corpus/00009.stmt
+++ /dev/null
@@ -1 +0,0 @@
-github.com/open-policy-agent/opa/ast
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00010.stmt b/build/fuzzer/corpus/00010.stmt
deleted file mode 100644
index bcb0ffe723..0000000000
--- a/build/fuzzer/corpus/00010.stmt
+++ /dev/null
@@ -1 +0,0 @@
-github.com/open-policy-agent/opa/rego
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00011.stmt b/build/fuzzer/corpus/00011.stmt
deleted file mode 100644
index db5e667e94..0000000000
--- a/build/fuzzer/corpus/00011.stmt
+++ /dev/null
@@ -1 +0,0 @@
-github.com/open-policy-agent/opa/storage
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00012.stmt b/build/fuzzer/corpus/00012.stmt
deleted file mode 100644
index ffe1256e1a..0000000000
--- a/build/fuzzer/corpus/00012.stmt
+++ /dev/null
@@ -1 +0,0 @@
-github.com/open-policy-agent/opa/storage/inmem
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00013.stmt b/build/fuzzer/corpus/00013.stmt
deleted file mode 100644
index 941ebe9297..0000000000
--- a/build/fuzzer/corpus/00013.stmt
+++ /dev/null
@@ -1 +0,0 @@
-github.com/open-policy-agent/opa/util
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00014.stmt b/build/fuzzer/corpus/00014.stmt
deleted file mode 100644
index d7144891e5..0000000000
--- a/build/fuzzer/corpus/00014.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x = data.a
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00015.stmt b/build/fuzzer/corpus/00015.stmt
deleted file mode 100644
index b6fc4c620b..0000000000
--- a/build/fuzzer/corpus/00015.stmt
+++ /dev/null
@@ -1 +0,0 @@
-hello
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00016.stmt b/build/fuzzer/corpus/00016.stmt
deleted file mode 100644
index 0abaeaa993..0000000000
--- a/build/fuzzer/corpus/00016.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bye
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00017.stmt b/build/fuzzer/corpus/00017.stmt
deleted file mode 100644
index 1910281566..0000000000
--- a/build/fuzzer/corpus/00017.stmt
+++ /dev/null
@@ -1 +0,0 @@
-foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00018.stmt b/build/fuzzer/corpus/00018.stmt
deleted file mode 100644
index 7813681f5b..0000000000
--- a/build/fuzzer/corpus/00018.stmt
+++ /dev/null
@@ -1 +0,0 @@
-5
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00019.stmt b/build/fuzzer/corpus/00019.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00019.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00020.stmt b/build/fuzzer/corpus/00020.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/00020.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00021.stmt b/build/fuzzer/corpus/00021.stmt
deleted file mode 100644
index e440e5c842..0000000000
--- a/build/fuzzer/corpus/00021.stmt
+++ /dev/null
@@ -1 +0,0 @@
-3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00022.stmt b/build/fuzzer/corpus/00022.stmt
deleted file mode 100644
index d7144891e5..0000000000
--- a/build/fuzzer/corpus/00022.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x = data.a
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00023.stmt b/build/fuzzer/corpus/00023.stmt
deleted file mode 100644
index c1b0730e01..0000000000
--- a/build/fuzzer/corpus/00023.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00024.stmt b/build/fuzzer/corpus/00024.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00024.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00025.stmt b/build/fuzzer/corpus/00025.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/00025.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00026.stmt b/build/fuzzer/corpus/00026.stmt
deleted file mode 100644
index e440e5c842..0000000000
--- a/build/fuzzer/corpus/00026.stmt
+++ /dev/null
@@ -1 +0,0 @@
-3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00027.stmt b/build/fuzzer/corpus/00027.stmt
deleted file mode 100644
index bf0d87ab1b..0000000000
--- a/build/fuzzer/corpus/00027.stmt
+++ /dev/null
@@ -1 +0,0 @@
-4
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00028.stmt b/build/fuzzer/corpus/00028.stmt
deleted file mode 100644
index d7144891e5..0000000000
--- a/build/fuzzer/corpus/00028.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x = data.a
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00029.stmt b/build/fuzzer/corpus/00029.stmt
deleted file mode 100644
index c1b0730e01..0000000000
--- a/build/fuzzer/corpus/00029.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00030.stmt b/build/fuzzer/corpus/00030.stmt
deleted file mode 100644
index 0bb6c815b9..0000000000
--- a/build/fuzzer/corpus/00030.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Expected non-empty metrics
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00031.stmt b/build/fuzzer/corpus/00031.stmt
deleted file mode 100644
index 8716b472ce..0000000000
--- a/build/fuzzer/corpus/00031.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Unexpected notification %v
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00032.stmt b/build/fuzzer/corpus/00032.stmt
deleted file mode 100644
index 31d59ec341..0000000000
--- a/build/fuzzer/corpus/00032.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Query was not unregistered
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00033.stmt b/build/fuzzer/corpus/00033.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/00033.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00034.stmt b/build/fuzzer/corpus/00034.stmt
deleted file mode 100644
index a37fc54d99..0000000000
--- a/build/fuzzer/corpus/00034.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-package y
-
-		r["foo"] = y {
-			y = data.a[0]
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00035.stmt b/build/fuzzer/corpus/00035.stmt
deleted file mode 100644
index d603ab1ad4..0000000000
--- a/build/fuzzer/corpus/00035.stmt
+++ /dev/null
@@ -1 +0,0 @@
-plus(data.y.r["foo"], 1, x)
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00036.stmt b/build/fuzzer/corpus/00036.stmt
deleted file mode 100644
index d603ab1ad4..0000000000
--- a/build/fuzzer/corpus/00036.stmt
+++ /dev/null
@@ -1 +0,0 @@
-plus(data.y.r["foo"], 1, x)
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00037.stmt b/build/fuzzer/corpus/00037.stmt
deleted file mode 100644
index c1b0730e01..0000000000
--- a/build/fuzzer/corpus/00037.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00038.stmt b/build/fuzzer/corpus/00038.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/00038.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00039.stmt b/build/fuzzer/corpus/00039.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/00039.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00040.stmt b/build/fuzzer/corpus/00040.stmt
deleted file mode 100644
index b56b6876d3..0000000000
--- a/build/fuzzer/corpus/00040.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-package y
-
-		r["foo"] = y {
-			y = "bar"
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00041.stmt b/build/fuzzer/corpus/00041.stmt
deleted file mode 100644
index d603ab1ad4..0000000000
--- a/build/fuzzer/corpus/00041.stmt
+++ /dev/null
@@ -1 +0,0 @@
-plus(data.y.r["foo"], 1, x)
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00042.stmt b/build/fuzzer/corpus/00042.stmt
deleted file mode 100644
index 9d04f8df1d..0000000000
--- a/build/fuzzer/corpus/00042.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Invalid watch channel was not closed
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00043.stmt b/build/fuzzer/corpus/00043.stmt
deleted file mode 100644
index 65b15c82cf..0000000000
--- a/build/fuzzer/corpus/00043.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Invalid watch channel present in new watcher
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00044.stmt b/build/fuzzer/corpus/00044.stmt
deleted file mode 100644
index fb17337960..0000000000
--- a/build/fuzzer/corpus/00044.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Invalid watch channel notify channel present in new watcher
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00045.stmt b/build/fuzzer/corpus/00045.stmt
deleted file mode 100644
index f91f3d2e54..0000000000
--- a/build/fuzzer/corpus/00045.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x0 = data.x0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00046.stmt b/build/fuzzer/corpus/00046.stmt
deleted file mode 100644
index b8f9fc619a..0000000000
--- a/build/fuzzer/corpus/00046.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x1 = data.x1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00047.stmt b/build/fuzzer/corpus/00047.stmt
deleted file mode 100644
index 98737298d3..0000000000
--- a/build/fuzzer/corpus/00047.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x2 = data.y.r["foo"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00048.stmt b/build/fuzzer/corpus/00048.stmt
deleted file mode 100644
index 02201286df..0000000000
--- a/build/fuzzer/corpus/00048.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x3 = data.x0+1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00049.stmt b/build/fuzzer/corpus/00049.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/00049.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00050.stmt b/build/fuzzer/corpus/00050.stmt
deleted file mode 100644
index b9b8265e21..0000000000
--- a/build/fuzzer/corpus/00050.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-package y
-
-		r["foo"] = y {
-			y = data.x2
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00051.stmt b/build/fuzzer/corpus/00051.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/00051.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00052.stmt b/build/fuzzer/corpus/00052.stmt
deleted file mode 100644
index b9b8265e21..0000000000
--- a/build/fuzzer/corpus/00052.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-package y
-
-		r["foo"] = y {
-			y = data.x2
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00053.stmt b/build/fuzzer/corpus/00053.stmt
deleted file mode 100644
index f91f3d2e54..0000000000
--- a/build/fuzzer/corpus/00053.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x0 = data.x0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00054.stmt b/build/fuzzer/corpus/00054.stmt
deleted file mode 100644
index b8f9fc619a..0000000000
--- a/build/fuzzer/corpus/00054.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x1 = data.x1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00055.stmt b/build/fuzzer/corpus/00055.stmt
deleted file mode 100644
index 43406d2c0a..0000000000
--- a/build/fuzzer/corpus/00055.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x2 = data
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00056.stmt b/build/fuzzer/corpus/00056.stmt
deleted file mode 100644
index 02201286df..0000000000
--- a/build/fuzzer/corpus/00056.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x3 = data.x0+1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00057.stmt b/build/fuzzer/corpus/00057.stmt
deleted file mode 100644
index e25f1814e5..0000000000
--- a/build/fuzzer/corpus/00057.stmt
+++ /dev/null
@@ -1 +0,0 @@
-y
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00058.stmt b/build/fuzzer/corpus/00058.stmt
deleted file mode 100644
index 1d2f01491f..0000000000
--- a/build/fuzzer/corpus/00058.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00059.stmt b/build/fuzzer/corpus/00059.stmt
deleted file mode 100644
index 1910281566..0000000000
--- a/build/fuzzer/corpus/00059.stmt
+++ /dev/null
@@ -1 +0,0 @@
-foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00060.stmt b/build/fuzzer/corpus/00060.stmt
deleted file mode 100644
index 89258896ac..0000000000
--- a/build/fuzzer/corpus/00060.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00061.stmt b/build/fuzzer/corpus/00061.stmt
deleted file mode 100644
index 2f43e19878..0000000000
--- a/build/fuzzer/corpus/00061.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00062.stmt b/build/fuzzer/corpus/00062.stmt
deleted file mode 100644
index 98bf17ef67..0000000000
--- a/build/fuzzer/corpus/00062.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00063.stmt b/build/fuzzer/corpus/00063.stmt
deleted file mode 100644
index e04daa7d75..0000000000
--- a/build/fuzzer/corpus/00063.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00064.stmt b/build/fuzzer/corpus/00064.stmt
deleted file mode 100644
index 6307d8730c..0000000000
--- a/build/fuzzer/corpus/00064.stmt
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-        "a": [1,2,3,4],
-        "b": {
-            "v1": "hello",
-            "v2": "goodbye"
-        },
-        "c": [{
-            "x": [true, false, "foo"],
-            "y": [null, 3.14159],
-            "z": {"p": true, "q": false}
-        }],
-        "d": {
-            "e": ["bar", "baz"]
-        },
-		"g": {
-			"a": [1, 0, 0, 0],
-			"b": [0, 2, 0, 0],
-			"c": [0, 0, 0, 4]
-		},
-		"h": [
-			[1,2,3],
-			[2,3,4]
-		]
-    }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00065.stmt b/build/fuzzer/corpus/00065.stmt
deleted file mode 100644
index efac25111f..0000000000
--- a/build/fuzzer/corpus/00065.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00066.stmt b/build/fuzzer/corpus/00066.stmt
deleted file mode 100644
index c2c88d097d..0000000000
--- a/build/fuzzer/corpus/00066.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00067.stmt b/build/fuzzer/corpus/00067.stmt
deleted file mode 100644
index 124009d7b7..0000000000
--- a/build/fuzzer/corpus/00067.stmt
+++ /dev/null
@@ -1 +0,0 @@
-any
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00068.stmt b/build/fuzzer/corpus/00068.stmt
deleted file mode 100644
index 124009d7b7..0000000000
--- a/build/fuzzer/corpus/00068.stmt
+++ /dev/null
@@ -1 +0,0 @@
-any
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00069.stmt b/build/fuzzer/corpus/00069.stmt
deleted file mode 100644
index ac13b3214a..0000000000
--- a/build/fuzzer/corpus/00069.stmt
+++ /dev/null
@@ -1 +0,0 @@
-superset
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00070.stmt b/build/fuzzer/corpus/00070.stmt
deleted file mode 100644
index a564589f2a..0000000000
--- a/build/fuzzer/corpus/00070.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00071.stmt b/build/fuzzer/corpus/00071.stmt
deleted file mode 100644
index 5eea3c99ff..0000000000
--- a/build/fuzzer/corpus/00071.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00072.stmt b/build/fuzzer/corpus/00072.stmt
deleted file mode 100644
index d6bec3e014..0000000000
--- a/build/fuzzer/corpus/00072.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00073.stmt b/build/fuzzer/corpus/00073.stmt
deleted file mode 100644
index ed084c14f7..0000000000
--- a/build/fuzzer/corpus/00073.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-4
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00074.stmt b/build/fuzzer/corpus/00074.stmt
deleted file mode 100644
index 1bb801d8c6..0000000000
--- a/build/fuzzer/corpus/00074.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00075.stmt b/build/fuzzer/corpus/00075.stmt
deleted file mode 100644
index bc16df879a..0000000000
--- a/build/fuzzer/corpus/00075.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array dynamic
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00076.stmt b/build/fuzzer/corpus/00076.stmt
deleted file mode 100644
index efac25111f..0000000000
--- a/build/fuzzer/corpus/00076.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00077.stmt b/build/fuzzer/corpus/00077.stmt
deleted file mode 100644
index 2e65efe2a1..0000000000
--- a/build/fuzzer/corpus/00077.stmt
+++ /dev/null
@@ -1 +0,0 @@
-a
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00078.stmt b/build/fuzzer/corpus/00078.stmt
deleted file mode 100644
index 63d8dbd40c..0000000000
--- a/build/fuzzer/corpus/00078.stmt
+++ /dev/null
@@ -1 +0,0 @@
-b
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00079.stmt b/build/fuzzer/corpus/00079.stmt
deleted file mode 100644
index dde258c392..0000000000
--- a/build/fuzzer/corpus/00079.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object dynamic
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00080.stmt b/build/fuzzer/corpus/00080.stmt
deleted file mode 100644
index 2e65efe2a1..0000000000
--- a/build/fuzzer/corpus/00080.stmt
+++ /dev/null
@@ -1 +0,0 @@
-a
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00081.stmt b/build/fuzzer/corpus/00081.stmt
deleted file mode 100644
index 63d8dbd40c..0000000000
--- a/build/fuzzer/corpus/00081.stmt
+++ /dev/null
@@ -1 +0,0 @@
-b
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00082.stmt b/build/fuzzer/corpus/00082.stmt
deleted file mode 100644
index c2c88d097d..0000000000
--- a/build/fuzzer/corpus/00082.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00083.stmt b/build/fuzzer/corpus/00083.stmt
deleted file mode 100644
index ac13b3214a..0000000000
--- a/build/fuzzer/corpus/00083.stmt
+++ /dev/null
@@ -1 +0,0 @@
-superset
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00084.stmt b/build/fuzzer/corpus/00084.stmt
deleted file mode 100644
index 124009d7b7..0000000000
--- a/build/fuzzer/corpus/00084.stmt
+++ /dev/null
@@ -1 +0,0 @@
-any
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00085.stmt b/build/fuzzer/corpus/00085.stmt
deleted file mode 100644
index a564589f2a..0000000000
--- a/build/fuzzer/corpus/00085.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00086.stmt b/build/fuzzer/corpus/00086.stmt
deleted file mode 100644
index 5eea3c99ff..0000000000
--- a/build/fuzzer/corpus/00086.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00087.stmt b/build/fuzzer/corpus/00087.stmt
deleted file mode 100644
index d6bec3e014..0000000000
--- a/build/fuzzer/corpus/00087.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00088.stmt b/build/fuzzer/corpus/00088.stmt
deleted file mode 100644
index ed084c14f7..0000000000
--- a/build/fuzzer/corpus/00088.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar-4
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00089.stmt b/build/fuzzer/corpus/00089.stmt
deleted file mode 100644
index 1910281566..0000000000
--- a/build/fuzzer/corpus/00089.stmt
+++ /dev/null
@@ -1 +0,0 @@
-foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00090.stmt b/build/fuzzer/corpus/00090.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00090.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00091.stmt b/build/fuzzer/corpus/00091.stmt
deleted file mode 100644
index b6fc4c620b..0000000000
--- a/build/fuzzer/corpus/00091.stmt
+++ /dev/null
@@ -1 +0,0 @@
-hello
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00092.stmt b/build/fuzzer/corpus/00092.stmt
deleted file mode 100644
index 1910281566..0000000000
--- a/build/fuzzer/corpus/00092.stmt
+++ /dev/null
@@ -1 +0,0 @@
-foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00093.stmt b/build/fuzzer/corpus/00093.stmt
deleted file mode 100644
index 1910281566..0000000000
--- a/build/fuzzer/corpus/00093.stmt
+++ /dev/null
@@ -1 +0,0 @@
-foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00094.stmt b/build/fuzzer/corpus/00094.stmt
deleted file mode 100644
index 48aebee2a5..0000000000
--- a/build/fuzzer/corpus/00094.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Expected %v type to be unknown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00095.stmt b/build/fuzzer/corpus/00095.stmt
deleted file mode 100644
index 1910281566..0000000000
--- a/build/fuzzer/corpus/00095.stmt
+++ /dev/null
@@ -1 +0,0 @@
-foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00096.stmt b/build/fuzzer/corpus/00096.stmt
deleted file mode 100644
index 31b1e1a7a8..0000000000
--- a/build/fuzzer/corpus/00096.stmt
+++ /dev/null
@@ -1 +0,0 @@
-func
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00097.stmt b/build/fuzzer/corpus/00097.stmt
deleted file mode 100644
index dfcf4f20d8..0000000000
--- a/build/fuzzer/corpus/00097.stmt
+++ /dev/null
@@ -1,43 +0,0 @@
-
-	{
-		"type": "any",
-		"of": [
-			{
-				"type": "object",
-				"static": [
-					{
-						"key": "foo",
-						"value": {"type": "number"}
-					},
-					{
-						"key": "func",
-						"value": {
-							"type": "function",
-							"args": [
-								{
-									"type": "string"
-								}
-							],
-							"result": {
-								"type": "number"
-							}
-						}
-					}
-				],
-				"dynamic": {
-					"key": {"type": "string"},
-					"value": {
-						"type": "array",
-						"static": [
-							{
-								"type": "set",
-								"of": {"type": "boolean"}
-							}
-						],
-						"dynamic": {"type": "number"}
-					}
-				}
-			}
-		]
-	}
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00099.stmt b/build/fuzzer/corpus/00099.stmt
deleted file mode 100644
index be135bed38..0000000000
--- a/build/fuzzer/corpus/00099.stmt
+++ /dev/null
@@ -1 +0,0 @@
-number non-zero
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00100.stmt b/build/fuzzer/corpus/00100.stmt
deleted file mode 100644
index f753fc1c23..0000000000
--- a/build/fuzzer/corpus/00100.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { -3.14 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00101.stmt b/build/fuzzer/corpus/00101.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00101.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00102.stmt b/build/fuzzer/corpus/00102.stmt
deleted file mode 100644
index 0f25ed42ca..0000000000
--- a/build/fuzzer/corpus/00102.stmt
+++ /dev/null
@@ -1 +0,0 @@
-number zero
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00103.stmt b/build/fuzzer/corpus/00103.stmt
deleted file mode 100644
index f811cdb235..0000000000
--- a/build/fuzzer/corpus/00103.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { null }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00104.stmt b/build/fuzzer/corpus/00104.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00104.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00105.stmt b/build/fuzzer/corpus/00105.stmt
deleted file mode 100644
index ec747fa47d..0000000000
--- a/build/fuzzer/corpus/00105.stmt
+++ /dev/null
@@ -1 +0,0 @@
-null
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00106.stmt b/build/fuzzer/corpus/00106.stmt
deleted file mode 100644
index f811cdb235..0000000000
--- a/build/fuzzer/corpus/00106.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { null }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00107.stmt b/build/fuzzer/corpus/00107.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00107.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00108.stmt b/build/fuzzer/corpus/00108.stmt
deleted file mode 100644
index 62ff658c66..0000000000
--- a/build/fuzzer/corpus/00108.stmt
+++ /dev/null
@@ -1 +0,0 @@
-string non-empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00109.stmt b/build/fuzzer/corpus/00109.stmt
deleted file mode 100644
index 838e389e85..0000000000
--- a/build/fuzzer/corpus/00109.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { "abc" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00110.stmt b/build/fuzzer/corpus/00110.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00110.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00111.stmt b/build/fuzzer/corpus/00111.stmt
deleted file mode 100644
index b7bbd98746..0000000000
--- a/build/fuzzer/corpus/00111.stmt
+++ /dev/null
@@ -1 +0,0 @@
-string empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00112.stmt b/build/fuzzer/corpus/00112.stmt
deleted file mode 100644
index d0582b2574..0000000000
--- a/build/fuzzer/corpus/00112.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { "" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00113.stmt b/build/fuzzer/corpus/00113.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00113.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00114.stmt b/build/fuzzer/corpus/00114.stmt
deleted file mode 100644
index 227ce1fd2b..0000000000
--- a/build/fuzzer/corpus/00114.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array non-empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00115.stmt b/build/fuzzer/corpus/00115.stmt
deleted file mode 100644
index 0ba2d22b28..0000000000
--- a/build/fuzzer/corpus/00115.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [1, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00116.stmt b/build/fuzzer/corpus/00116.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00116.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00117.stmt b/build/fuzzer/corpus/00117.stmt
deleted file mode 100644
index 801f6ce137..0000000000
--- a/build/fuzzer/corpus/00117.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00118.stmt b/build/fuzzer/corpus/00118.stmt
deleted file mode 100644
index 125368782d..0000000000
--- a/build/fuzzer/corpus/00118.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00119.stmt b/build/fuzzer/corpus/00119.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00119.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00120.stmt b/build/fuzzer/corpus/00120.stmt
deleted file mode 100644
index 27bef73a01..0000000000
--- a/build/fuzzer/corpus/00120.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object non-empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00121.stmt b/build/fuzzer/corpus/00121.stmt
deleted file mode 100644
index 5720e3767f..0000000000
--- a/build/fuzzer/corpus/00121.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {"a": 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00122.stmt b/build/fuzzer/corpus/00122.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00122.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00123.stmt b/build/fuzzer/corpus/00123.stmt
deleted file mode 100644
index 7962fbe073..0000000000
--- a/build/fuzzer/corpus/00123.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00124.stmt b/build/fuzzer/corpus/00124.stmt
deleted file mode 100644
index 5ad812a28e..0000000000
--- a/build/fuzzer/corpus/00124.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00125.stmt b/build/fuzzer/corpus/00125.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00125.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00126.stmt b/build/fuzzer/corpus/00126.stmt
deleted file mode 100644
index f3c0f4c2ad..0000000000
--- a/build/fuzzer/corpus/00126.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set non-empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00127.stmt b/build/fuzzer/corpus/00127.stmt
deleted file mode 100644
index 9dafd441ae..0000000000
--- a/build/fuzzer/corpus/00127.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {1, 2, 3} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00128.stmt b/build/fuzzer/corpus/00128.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00128.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00129.stmt b/build/fuzzer/corpus/00129.stmt
deleted file mode 100644
index 1f48995b19..0000000000
--- a/build/fuzzer/corpus/00129.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00130.stmt b/build/fuzzer/corpus/00130.stmt
deleted file mode 100644
index 2cba91e553..0000000000
--- a/build/fuzzer/corpus/00130.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { set() }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00131.stmt b/build/fuzzer/corpus/00131.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00131.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00132.stmt b/build/fuzzer/corpus/00132.stmt
deleted file mode 100644
index 65139e3cef..0000000000
--- a/build/fuzzer/corpus/00132.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00133.stmt b/build/fuzzer/corpus/00133.stmt
deleted file mode 100644
index 05d04a536f..0000000000
--- a/build/fuzzer/corpus/00133.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00134.stmt b/build/fuzzer/corpus/00134.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00134.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00135.stmt b/build/fuzzer/corpus/00135.stmt
deleted file mode 100644
index 233d10e53b..0000000000
--- a/build/fuzzer/corpus/00135.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00136.stmt b/build/fuzzer/corpus/00136.stmt
deleted file mode 100644
index d0831aabc1..0000000000
--- a/build/fuzzer/corpus/00136.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { data.deadbeef[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00137.stmt b/build/fuzzer/corpus/00137.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00138.stmt b/build/fuzzer/corpus/00138.stmt
deleted file mode 100644
index 1d60a61e34..0000000000
--- a/build/fuzzer/corpus/00138.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref undefined (path)
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00139.stmt b/build/fuzzer/corpus/00139.stmt
deleted file mode 100644
index cc0542e1b1..0000000000
--- a/build/fuzzer/corpus/00139.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { data.a[true] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00140.stmt b/build/fuzzer/corpus/00140.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00141.stmt b/build/fuzzer/corpus/00141.stmt
deleted file mode 100644
index 2aa3a8fe3b..0000000000
--- a/build/fuzzer/corpus/00141.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref false
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00142.stmt b/build/fuzzer/corpus/00142.stmt
deleted file mode 100644
index 9cf0658154..0000000000
--- a/build/fuzzer/corpus/00142.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { data.c[0].x[1] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00143.stmt b/build/fuzzer/corpus/00143.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00144.stmt b/build/fuzzer/corpus/00144.stmt
deleted file mode 100644
index a36015163e..0000000000
--- a/build/fuzzer/corpus/00144.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array comprehension
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00145.stmt b/build/fuzzer/corpus/00145.stmt
deleted file mode 100644
index 3e2684c143..0000000000
--- a/build/fuzzer/corpus/00145.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [x | x = 1] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00146.stmt b/build/fuzzer/corpus/00146.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00146.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00147.stmt b/build/fuzzer/corpus/00147.stmt
deleted file mode 100644
index 945375042a..0000000000
--- a/build/fuzzer/corpus/00147.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array comprehension empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00148.stmt b/build/fuzzer/corpus/00148.stmt
deleted file mode 100644
index f3f6822bd1..0000000000
--- a/build/fuzzer/corpus/00148.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [x | x = 1; x = 2] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00149.stmt b/build/fuzzer/corpus/00149.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00149.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00150.stmt b/build/fuzzer/corpus/00150.stmt
deleted file mode 100644
index 829246ae40..0000000000
--- a/build/fuzzer/corpus/00150.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arbitrary position
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00151.stmt b/build/fuzzer/corpus/00151.stmt
deleted file mode 100644
index 484f2ad7c0..0000000000
--- a/build/fuzzer/corpus/00151.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] = x; x; i }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00152.stmt b/build/fuzzer/corpus/00152.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00152.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00153.stmt b/build/fuzzer/corpus/00153.stmt
deleted file mode 100644
index e79377fdaf..0000000000
--- a/build/fuzzer/corpus/00153.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { true = false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00154.stmt b/build/fuzzer/corpus/00154.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00155.stmt b/build/fuzzer/corpus/00155.stmt
deleted file mode 100644
index 166ad2a84e..0000000000
--- a/build/fuzzer/corpus/00155.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [1, 2, 3] = [1, 3, 2] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00156.stmt b/build/fuzzer/corpus/00156.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00157.stmt b/build/fuzzer/corpus/00157.stmt
deleted file mode 100644
index b8c9667a2a..0000000000
--- a/build/fuzzer/corpus/00157.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[3] = 9999 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00158.stmt b/build/fuzzer/corpus/00158.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00159.stmt b/build/fuzzer/corpus/00159.stmt
deleted file mode 100644
index 56044c332b..0000000000
--- a/build/fuzzer/corpus/00159.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] = 9999 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00160.stmt b/build/fuzzer/corpus/00160.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00161.stmt b/build/fuzzer/corpus/00161.stmt
deleted file mode 100644
index 4fbad85d16..0000000000
--- a/build/fuzzer/corpus/00161.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[3] = x; x = 3 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00162.stmt b/build/fuzzer/corpus/00162.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00163.stmt b/build/fuzzer/corpus/00163.stmt
deleted file mode 100644
index 6916bd4025..0000000000
--- a/build/fuzzer/corpus/00163.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [1, x, x] = [1, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00164.stmt b/build/fuzzer/corpus/00164.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00165.stmt b/build/fuzzer/corpus/00165.stmt
deleted file mode 100644
index 70de2f2bde..0000000000
--- a/build/fuzzer/corpus/00165.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [1, x, 3] = [1, 2, x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00166.stmt b/build/fuzzer/corpus/00166.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00167.stmt b/build/fuzzer/corpus/00167.stmt
deleted file mode 100644
index 3784e7739a..0000000000
--- a/build/fuzzer/corpus/00167.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {"a": 1, "b": 2} = {"a": a, "b": a} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00168.stmt b/build/fuzzer/corpus/00168.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00169.stmt b/build/fuzzer/corpus/00169.stmt
deleted file mode 100644
index abbb5071f8..0000000000
--- a/build/fuzzer/corpus/00169.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [[1, x], [3, x]] = [[1, 2], [3, 4]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00170.stmt b/build/fuzzer/corpus/00170.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00171.stmt b/build/fuzzer/corpus/00171.stmt
deleted file mode 100644
index bf7bba067f..0000000000
--- a/build/fuzzer/corpus/00171.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [[1, x], [3, 4]] = [[1, 2], [x, 4]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00172.stmt b/build/fuzzer/corpus/00172.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00173.stmt b/build/fuzzer/corpus/00173.stmt
deleted file mode 100644
index 35d0f64dcb..0000000000
--- a/build/fuzzer/corpus/00173.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {1, 2, 3} = {1, 2, 4} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00174.stmt b/build/fuzzer/corpus/00174.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00175.stmt b/build/fuzzer/corpus/00175.stmt
deleted file mode 100644
index 51eb37bed1..0000000000
--- a/build/fuzzer/corpus/00175.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { true = true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00176.stmt b/build/fuzzer/corpus/00176.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00176.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00177.stmt b/build/fuzzer/corpus/00177.stmt
deleted file mode 100644
index 6c7f61d76a..0000000000
--- a/build/fuzzer/corpus/00177.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { "string" = "string" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00178.stmt b/build/fuzzer/corpus/00178.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00178.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00179.stmt b/build/fuzzer/corpus/00179.stmt
deleted file mode 100644
index 74f631d699..0000000000
--- a/build/fuzzer/corpus/00179.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 17 = 17 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00180.stmt b/build/fuzzer/corpus/00180.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00180.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00181.stmt b/build/fuzzer/corpus/00181.stmt
deleted file mode 100644
index 5902906faf..0000000000
--- a/build/fuzzer/corpus/00181.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { null = null }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00182.stmt b/build/fuzzer/corpus/00182.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00182.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00183.stmt b/build/fuzzer/corpus/00183.stmt
deleted file mode 100644
index f952ac687f..0000000000
--- a/build/fuzzer/corpus/00183.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { [1, 2, 3] = [1, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00184.stmt b/build/fuzzer/corpus/00184.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00184.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00185.stmt b/build/fuzzer/corpus/00185.stmt
deleted file mode 100644
index 8767d7b50b..0000000000
--- a/build/fuzzer/corpus/00185.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {1, 2, 3} = {3, 2, 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00186.stmt b/build/fuzzer/corpus/00186.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00186.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00187.stmt b/build/fuzzer/corpus/00187.stmt
deleted file mode 100644
index b0dd1fe8d3..0000000000
--- a/build/fuzzer/corpus/00187.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {"b": false, "a": [1, 2, 3]} = {"a": [1, 2, 3], "b": false} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00188.stmt b/build/fuzzer/corpus/00188.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00188.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00189.stmt b/build/fuzzer/corpus/00189.stmt
deleted file mode 100644
index 4ce8de3818..0000000000
--- a/build/fuzzer/corpus/00189.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[2] = 3 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00190.stmt b/build/fuzzer/corpus/00190.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00190.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00191.stmt b/build/fuzzer/corpus/00191.stmt
deleted file mode 100644
index 29d39ead6b..0000000000
--- a/build/fuzzer/corpus/00191.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { b.v2 = "goodbye" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00192.stmt b/build/fuzzer/corpus/00192.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00192.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00193.stmt b/build/fuzzer/corpus/00193.stmt
deleted file mode 100644
index 85dd59ca8b..0000000000
--- a/build/fuzzer/corpus/00193.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { d.e = ["bar", "baz"] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00194.stmt b/build/fuzzer/corpus/00194.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00194.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00195.stmt b/build/fuzzer/corpus/00195.stmt
deleted file mode 100644
index 8e468c334a..0000000000
--- a/build/fuzzer/corpus/00195.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { c[0].x[1] = c[0].z.q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00196.stmt b/build/fuzzer/corpus/00196.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00196.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00197.stmt b/build/fuzzer/corpus/00197.stmt
deleted file mode 100644
index cb179d2955..0000000000
--- a/build/fuzzer/corpus/00197.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = y; z = 42; y = z }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00198.stmt b/build/fuzzer/corpus/00198.stmt
deleted file mode 100644
index efb5201056..0000000000
--- a/build/fuzzer/corpus/00198.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[42]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00199.stmt b/build/fuzzer/corpus/00199.stmt
deleted file mode 100644
index 48a7cd2aed..0000000000
--- a/build/fuzzer/corpus/00199.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[3] = x; x = 4 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00200.stmt b/build/fuzzer/corpus/00200.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00200.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00201.stmt b/build/fuzzer/corpus/00201.stmt
deleted file mode 100644
index 07dc7b3826..0000000000
--- a/build/fuzzer/corpus/00201.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] = x; x = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00202.stmt b/build/fuzzer/corpus/00202.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00202.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00203.stmt b/build/fuzzer/corpus/00203.stmt
deleted file mode 100644
index 7264c920ef..0000000000
--- a/build/fuzzer/corpus/00203.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] = 4; x = 3 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00204.stmt b/build/fuzzer/corpus/00204.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00204.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00205.stmt b/build/fuzzer/corpus/00205.stmt
deleted file mode 100644
index 1bedfbdd3c..0000000000
--- a/build/fuzzer/corpus/00205.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] = x; i = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00206.stmt b/build/fuzzer/corpus/00206.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00206.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00207.stmt b/build/fuzzer/corpus/00207.stmt
deleted file mode 100644
index 96c3b10129..0000000000
--- a/build/fuzzer/corpus/00207.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { i = 2; a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00208.stmt b/build/fuzzer/corpus/00208.stmt
deleted file mode 100644
index 810c539bc7..0000000000
--- a/build/fuzzer/corpus/00208.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00209.stmt b/build/fuzzer/corpus/00209.stmt
deleted file mode 100644
index d898e016d3..0000000000
--- a/build/fuzzer/corpus/00209.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { c[0].x[i] = c[0].z[j]; x = [i, j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00210.stmt b/build/fuzzer/corpus/00210.stmt
deleted file mode 100644
index acdb1097cd..0000000000
--- a/build/fuzzer/corpus/00210.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0, "p"], [1, "q"]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00211.stmt b/build/fuzzer/corpus/00211.stmt
deleted file mode 100644
index 65b828bee3..0000000000
--- a/build/fuzzer/corpus/00211.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { [1, x, 3] = [1, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00212.stmt b/build/fuzzer/corpus/00212.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/00212.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00213.stmt b/build/fuzzer/corpus/00213.stmt
deleted file mode 100644
index d0acd3cc6e..0000000000
--- a/build/fuzzer/corpus/00213.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { [[1, x], [3, 4]] = [[1, 2], [3, 4]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00214.stmt b/build/fuzzer/corpus/00214.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/00214.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00215.stmt b/build/fuzzer/corpus/00215.stmt
deleted file mode 100644
index 736e1d5b58..0000000000
--- a/build/fuzzer/corpus/00215.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { [2, x, 3] = [x, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00216.stmt b/build/fuzzer/corpus/00216.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/00216.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00217.stmt b/build/fuzzer/corpus/00217.stmt
deleted file mode 100644
index c0500ff457..0000000000
--- a/build/fuzzer/corpus/00217.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { [1, x, y] = [1, 2, 3]; z = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00218.stmt b/build/fuzzer/corpus/00218.stmt
deleted file mode 100644
index 34d885f171..0000000000
--- a/build/fuzzer/corpus/00218.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[2, 3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00219.stmt b/build/fuzzer/corpus/00219.stmt
deleted file mode 100644
index 4c9017c6bd..0000000000
--- a/build/fuzzer/corpus/00219.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { [1, x, 3] = [y, 2, 3]; z = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00220.stmt b/build/fuzzer/corpus/00220.stmt
deleted file mode 100644
index 301d542f66..0000000000
--- a/build/fuzzer/corpus/00220.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[2, 1]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00221.stmt b/build/fuzzer/corpus/00221.stmt
deleted file mode 100644
index 7544156606..0000000000
--- a/build/fuzzer/corpus/00221.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { [1, 2, 3, x] = [a[0], a[1], a[2], a[3]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00222.stmt b/build/fuzzer/corpus/00222.stmt
deleted file mode 100644
index ea863053e4..0000000000
--- a/build/fuzzer/corpus/00222.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00223.stmt b/build/fuzzer/corpus/00223.stmt
deleted file mode 100644
index 57b810c5ba..0000000000
--- a/build/fuzzer/corpus/00223.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { [1, 2, 3, x] = [a[0], a[1], a[2], a[i]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00224.stmt b/build/fuzzer/corpus/00224.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00224.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00225.stmt b/build/fuzzer/corpus/00225.stmt
deleted file mode 100644
index ae89894494..0000000000
--- a/build/fuzzer/corpus/00225.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { [true, false, x] = c[i][j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00226.stmt b/build/fuzzer/corpus/00226.stmt
deleted file mode 100644
index 6dfd29830e..0000000000
--- a/build/fuzzer/corpus/00226.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["foo"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00227.stmt b/build/fuzzer/corpus/00227.stmt
deleted file mode 100644
index 188420c144..0000000000
--- a/build/fuzzer/corpus/00227.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { c[i][j] = [true, false, x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00228.stmt b/build/fuzzer/corpus/00228.stmt
deleted file mode 100644
index 6dfd29830e..0000000000
--- a/build/fuzzer/corpus/00228.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["foo"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00229.stmt b/build/fuzzer/corpus/00229.stmt
deleted file mode 100644
index e1e85c7b5e..0000000000
--- a/build/fuzzer/corpus/00229.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { [1, 2, x] = y; x = 3 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00230.stmt b/build/fuzzer/corpus/00230.stmt
deleted file mode 100644
index c5a5c483f3..0000000000
--- a/build/fuzzer/corpus/00230.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,2,3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00231.stmt b/build/fuzzer/corpus/00231.stmt
deleted file mode 100644
index ae4886ac89..0000000000
--- a/build/fuzzer/corpus/00231.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { {"x": y} = {"x": "y"} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00232.stmt b/build/fuzzer/corpus/00232.stmt
deleted file mode 100644
index f9cc60af8e..0000000000
--- a/build/fuzzer/corpus/00232.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["y"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00233.stmt b/build/fuzzer/corpus/00233.stmt
deleted file mode 100644
index 5d7cb5f703..0000000000
--- a/build/fuzzer/corpus/00233.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { {"x": x, "y": x} = {"x": 1, "y": 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00234.stmt b/build/fuzzer/corpus/00234.stmt
deleted file mode 100644
index bace2a0be1..0000000000
--- a/build/fuzzer/corpus/00234.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00235.stmt b/build/fuzzer/corpus/00235.stmt
deleted file mode 100644
index 19581ec187..0000000000
--- a/build/fuzzer/corpus/00235.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { {"x": x, "y": y} = {"x": 1, "y": 2}; z = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00236.stmt b/build/fuzzer/corpus/00236.stmt
deleted file mode 100644
index 8cd23e701a..0000000000
--- a/build/fuzzer/corpus/00236.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1, 2]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00237.stmt b/build/fuzzer/corpus/00237.stmt
deleted file mode 100644
index e866e5d5ba..0000000000
--- a/build/fuzzer/corpus/00237.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { {"x": x, "y": 2} = {"x": 1, "y": y}; z = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00238.stmt b/build/fuzzer/corpus/00238.stmt
deleted file mode 100644
index 8cd23e701a..0000000000
--- a/build/fuzzer/corpus/00238.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1, 2]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00239.stmt b/build/fuzzer/corpus/00239.stmt
deleted file mode 100644
index d75254ab13..0000000000
--- a/build/fuzzer/corpus/00239.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { {"p": c[0].x[0], "q": x} = c[i][j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00240.stmt b/build/fuzzer/corpus/00240.stmt
deleted file mode 100644
index 67b2f07601..0000000000
--- a/build/fuzzer/corpus/00240.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[false]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00241.stmt b/build/fuzzer/corpus/00241.stmt
deleted file mode 100644
index 04f12aa448..0000000000
--- a/build/fuzzer/corpus/00241.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { {"a": 1, "b": x} = {"a": 1, "b": c[0].x[i]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00242.stmt b/build/fuzzer/corpus/00242.stmt
deleted file mode 100644
index 38ef50ed24..0000000000
--- a/build/fuzzer/corpus/00242.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true, false, "foo"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00243.stmt b/build/fuzzer/corpus/00243.stmt
deleted file mode 100644
index 15405a2365..0000000000
--- a/build/fuzzer/corpus/00243.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { {"p": y, "q": z} = c[i][j]; x = [i, j, y, z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00244.stmt b/build/fuzzer/corpus/00244.stmt
deleted file mode 100644
index e6ebb3b6dc..0000000000
--- a/build/fuzzer/corpus/00244.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0, "z", true, false]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00245.stmt b/build/fuzzer/corpus/00245.stmt
deleted file mode 100644
index acf783c461..0000000000
--- a/build/fuzzer/corpus/00245.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { c[i][j] = {"p": y, "q": z}; x = [i, j, y, z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00246.stmt b/build/fuzzer/corpus/00246.stmt
deleted file mode 100644
index e6ebb3b6dc..0000000000
--- a/build/fuzzer/corpus/00246.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0, "z", true, false]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00247.stmt b/build/fuzzer/corpus/00247.stmt
deleted file mode 100644
index 66580dabfd..0000000000
--- a/build/fuzzer/corpus/00247.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { {"a": 1, "b": y} = x; y = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00248.stmt b/build/fuzzer/corpus/00248.stmt
deleted file mode 100644
index a8444407d1..0000000000
--- a/build/fuzzer/corpus/00248.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"a": 1, "b": 2}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00249.stmt b/build/fuzzer/corpus/00249.stmt
deleted file mode 100644
index 8d85297cbf..0000000000
--- a/build/fuzzer/corpus/00249.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[ys] { f[i] = {"xs": [2], "ys": ys} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00250.stmt b/build/fuzzer/corpus/00250.stmt
deleted file mode 100644
index 52a3c12ef3..0000000000
--- a/build/fuzzer/corpus/00250.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[3.0]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00251.stmt b/build/fuzzer/corpus/00251.stmt
deleted file mode 100644
index 8a40bae0bc..0000000000
--- a/build/fuzzer/corpus/00251.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[v] { f[i] = {"xs": [x], "ys": [y]}; v = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00252.stmt b/build/fuzzer/corpus/00252.stmt
deleted file mode 100644
index 1ad49b59ca..0000000000
--- a/build/fuzzer/corpus/00252.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1.0, 2.0], [2.0, 3.0]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00253.stmt b/build/fuzzer/corpus/00253.stmt
deleted file mode 100644
index b6544412d0..0000000000
--- a/build/fuzzer/corpus/00253.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = 2; {1,x,3} = {1,2,3} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00254.stmt b/build/fuzzer/corpus/00254.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/00254.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00255.stmt b/build/fuzzer/corpus/00255.stmt
deleted file mode 100644
index c8b4205fec..0000000000
--- a/build/fuzzer/corpus/00255.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = "a"; {x: 1} = {"a": 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00256.stmt b/build/fuzzer/corpus/00256.stmt
deleted file mode 100644
index eac5f7b46e..0000000000
--- a/build/fuzzer/corpus/00256.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["a"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00257.stmt b/build/fuzzer/corpus/00257.stmt
deleted file mode 100644
index d34b630db9..0000000000
--- a/build/fuzzer/corpus/00257.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = "a"; {"a": 1} = {x: 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00258.stmt b/build/fuzzer/corpus/00258.stmt
deleted file mode 100644
index eac5f7b46e..0000000000
--- a/build/fuzzer/corpus/00258.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["a"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00259.stmt b/build/fuzzer/corpus/00259.stmt
deleted file mode 100644
index 462929938d..0000000000
--- a/build/fuzzer/corpus/00259.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[i] = g[i][j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00260.stmt b/build/fuzzer/corpus/00260.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00261.stmt b/build/fuzzer/corpus/00261.stmt
deleted file mode 100644
index 95c700cfe3..0000000000
--- a/build/fuzzer/corpus/00261.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array-type
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00262.stmt b/build/fuzzer/corpus/00262.stmt
deleted file mode 100644
index 789da35890..0000000000
--- a/build/fuzzer/corpus/00262.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { arr = [[1, [2]], [1, null], [2, [2]]]; [x, [2]] = arr[_] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00263.stmt b/build/fuzzer/corpus/00263.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00263.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00264.stmt b/build/fuzzer/corpus/00264.stmt
deleted file mode 100644
index e45081684b..0000000000
--- a/build/fuzzer/corpus/00264.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arrays-element
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00265.stmt b/build/fuzzer/corpus/00265.stmt
deleted file mode 100644
index eb9a3e3b64..0000000000
--- a/build/fuzzer/corpus/00265.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { arr = [[1, 2], [1, null], [2, 2]]; arr[_] = [x, 2] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00266.stmt b/build/fuzzer/corpus/00266.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00266.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00267.stmt b/build/fuzzer/corpus/00267.stmt
deleted file mode 100644
index ddedaee41c..0000000000
--- a/build/fuzzer/corpus/00267.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arrays-length
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00268.stmt b/build/fuzzer/corpus/00268.stmt
deleted file mode 100644
index 49211dc7be..0000000000
--- a/build/fuzzer/corpus/00268.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { arr = [[1, [2]], [1, []], [2, [2]]]; arr[_] = [x, [2]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00269.stmt b/build/fuzzer/corpus/00269.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00269.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00270.stmt b/build/fuzzer/corpus/00270.stmt
deleted file mode 100644
index 0aed5b7fe3..0000000000
--- a/build/fuzzer/corpus/00270.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array-ref-element
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00271.stmt b/build/fuzzer/corpus/00271.stmt
deleted file mode 100644
index 1a612bf48f..0000000000
--- a/build/fuzzer/corpus/00271.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { arr = [[1, 2], data.arr_ref, [2, 2]]; arr[_] = [x, 2] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00272.stmt b/build/fuzzer/corpus/00272.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00272.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00273.stmt b/build/fuzzer/corpus/00273.stmt
deleted file mode 100644
index 16ba5230ff..0000000000
--- a/build/fuzzer/corpus/00273.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object-type
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00274.stmt b/build/fuzzer/corpus/00274.stmt
deleted file mode 100644
index ad8c751f44..0000000000
--- a/build/fuzzer/corpus/00274.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { obj = {"a": {"x": 1, "y": {"v": 2}}, "b": {"x": 1, "y": null}, "c": {"x": 2, "y": {"v": 2}}}; {"x": x, "y": {"v": 2}} = obj[_] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00275.stmt b/build/fuzzer/corpus/00275.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00275.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00276.stmt b/build/fuzzer/corpus/00276.stmt
deleted file mode 100644
index d957ec5248..0000000000
--- a/build/fuzzer/corpus/00276.stmt
+++ /dev/null
@@ -1 +0,0 @@
-objects-element
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00277.stmt b/build/fuzzer/corpus/00277.stmt
deleted file mode 100644
index 60eb705edf..0000000000
--- a/build/fuzzer/corpus/00277.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { obj = {"a": {"x": 1, "y": 2}, "b": {"x": 1, "y": null}, "c": {"x": 2, "y": 2}}; obj[_] = {"x": x, "y": 2}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00278.stmt b/build/fuzzer/corpus/00278.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00278.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00279.stmt b/build/fuzzer/corpus/00279.stmt
deleted file mode 100644
index a0c2ea41ce..0000000000
--- a/build/fuzzer/corpus/00279.stmt
+++ /dev/null
@@ -1 +0,0 @@
-objects-length
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00280.stmt b/build/fuzzer/corpus/00280.stmt
deleted file mode 100644
index 5d408480f7..0000000000
--- a/build/fuzzer/corpus/00280.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { obj = {"a": {"x": 1, "y": {"v": 2}}, "b": {"x": 1, "y": {}}, "c": {"x": 2, "y": {"v": 2}}}; obj[_] = {"x": x, "y": {"v": 2}}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00281.stmt b/build/fuzzer/corpus/00281.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00281.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00282.stmt b/build/fuzzer/corpus/00282.stmt
deleted file mode 100644
index e08e976b34..0000000000
--- a/build/fuzzer/corpus/00282.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object-ref-element
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00283.stmt b/build/fuzzer/corpus/00283.stmt
deleted file mode 100644
index bd530022c6..0000000000
--- a/build/fuzzer/corpus/00283.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { obj = {"a": {"x": 1, "y": 2}, "b": obj_ref, "c": {"x": 2, "y": 2}}; obj[_] = {"x": x, "y": 2}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00284.stmt b/build/fuzzer/corpus/00284.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00284.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00285.stmt b/build/fuzzer/corpus/00285.stmt
deleted file mode 100644
index e28e08c5d9..0000000000
--- a/build/fuzzer/corpus/00285.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object-ref-missing-key
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00286.stmt b/build/fuzzer/corpus/00286.stmt
deleted file mode 100644
index 641396e849..0000000000
--- a/build/fuzzer/corpus/00286.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { obj = {"a": {"x": 1, "y": 2}, "b": obj_ref_missing_key, "c": {"x": 2, "y": 2}}; obj[_] = {"x": x, "y": 2}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00287.stmt b/build/fuzzer/corpus/00287.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00287.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00288.stmt b/build/fuzzer/corpus/00288.stmt
deleted file mode 100644
index d31b533470..0000000000
--- a/build/fuzzer/corpus/00288.stmt
+++ /dev/null
@@ -1,7 +0,0 @@
-
-		{
-			"arr_ref": [1, null],
-			"obj_ref": {"x": 1, "y": null},
-			"obj_ref_missing_key": {"x": 3, "z": 2}
-		}
-		
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00289.stmt b/build/fuzzer/corpus/00289.stmt
deleted file mode 100644
index 0376a054d7..0000000000
--- a/build/fuzzer/corpus/00289.stmt
+++ /dev/null
@@ -1 +0,0 @@
-equals
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00290.stmt b/build/fuzzer/corpus/00290.stmt
deleted file mode 100644
index 684d400a2b..0000000000
--- a/build/fuzzer/corpus/00290.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 == 1; a[i] = x; x == 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00291.stmt b/build/fuzzer/corpus/00291.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00291.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00292.stmt b/build/fuzzer/corpus/00292.stmt
deleted file mode 100644
index 8f46bcc0b5..0000000000
--- a/build/fuzzer/corpus/00292.stmt
+++ /dev/null
@@ -1 +0,0 @@
-noteq
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00293.stmt b/build/fuzzer/corpus/00293.stmt
deleted file mode 100644
index c52c9b4fa2..0000000000
--- a/build/fuzzer/corpus/00293.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 0 != 1; a[i] = x; x != 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00294.stmt b/build/fuzzer/corpus/00294.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00294.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00295.stmt b/build/fuzzer/corpus/00295.stmt
deleted file mode 100644
index 0d17e88f11..0000000000
--- a/build/fuzzer/corpus/00295.stmt
+++ /dev/null
@@ -1 +0,0 @@
-gt
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00296.stmt b/build/fuzzer/corpus/00296.stmt
deleted file mode 100644
index fe65d75aca..0000000000
--- a/build/fuzzer/corpus/00296.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 > 0; a[i] = x; x > 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00297.stmt b/build/fuzzer/corpus/00297.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00297.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00298.stmt b/build/fuzzer/corpus/00298.stmt
deleted file mode 100644
index 0c74f39a90..0000000000
--- a/build/fuzzer/corpus/00298.stmt
+++ /dev/null
@@ -1 +0,0 @@
-gteq
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00299.stmt b/build/fuzzer/corpus/00299.stmt
deleted file mode 100644
index ee52536021..0000000000
--- a/build/fuzzer/corpus/00299.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 >= 1; a[i] = x; x >= 4 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00300.stmt b/build/fuzzer/corpus/00300.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00300.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00301.stmt b/build/fuzzer/corpus/00301.stmt
deleted file mode 100644
index 30e0b42cf8..0000000000
--- a/build/fuzzer/corpus/00301.stmt
+++ /dev/null
@@ -1 +0,0 @@
-lt
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00302.stmt b/build/fuzzer/corpus/00302.stmt
deleted file mode 100644
index cd0ac5c274..0000000000
--- a/build/fuzzer/corpus/00302.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { -1 < 0; a[i] = x; x < 5 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00303.stmt b/build/fuzzer/corpus/00303.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00303.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00304.stmt b/build/fuzzer/corpus/00304.stmt
deleted file mode 100644
index bc24bde1b5..0000000000
--- a/build/fuzzer/corpus/00304.stmt
+++ /dev/null
@@ -1 +0,0 @@
-lteq
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00305.stmt b/build/fuzzer/corpus/00305.stmt
deleted file mode 100644
index ecdf9a433f..0000000000
--- a/build/fuzzer/corpus/00305.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { -1 <= 0; a[i] = x; x <= 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00306.stmt b/build/fuzzer/corpus/00306.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00306.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00307.stmt b/build/fuzzer/corpus/00307.stmt
deleted file mode 100644
index 8d236ffca4..0000000000
--- a/build/fuzzer/corpus/00307.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 0 == 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00308.stmt b/build/fuzzer/corpus/00308.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00309.stmt b/build/fuzzer/corpus/00309.stmt
deleted file mode 100644
index 570ba8ed22..0000000000
--- a/build/fuzzer/corpus/00309.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 0 != 0 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00310.stmt b/build/fuzzer/corpus/00310.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00311.stmt b/build/fuzzer/corpus/00311.stmt
deleted file mode 100644
index 3348d0b975..0000000000
--- a/build/fuzzer/corpus/00311.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 > 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00312.stmt b/build/fuzzer/corpus/00312.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00313.stmt b/build/fuzzer/corpus/00313.stmt
deleted file mode 100644
index 3b85d49c31..0000000000
--- a/build/fuzzer/corpus/00313.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 >= 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00314.stmt b/build/fuzzer/corpus/00314.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00315.stmt b/build/fuzzer/corpus/00315.stmt
deleted file mode 100644
index f13313dd2e..0000000000
--- a/build/fuzzer/corpus/00315.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 < -1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00316.stmt b/build/fuzzer/corpus/00316.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00317.stmt b/build/fuzzer/corpus/00317.stmt
deleted file mode 100644
index f13313dd2e..0000000000
--- a/build/fuzzer/corpus/00317.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 1 < -1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00318.stmt b/build/fuzzer/corpus/00318.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00319.stmt b/build/fuzzer/corpus/00319.stmt
deleted file mode 100644
index e4f95d0417..0000000000
--- a/build/fuzzer/corpus/00319.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00320.stmt b/build/fuzzer/corpus/00320.stmt
deleted file mode 100644
index 94eefaeb8f..0000000000
--- a/build/fuzzer/corpus/00320.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00321.stmt b/build/fuzzer/corpus/00321.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00321.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00322.stmt b/build/fuzzer/corpus/00322.stmt
deleted file mode 100644
index 3cd43f9bc9..0000000000
--- a/build/fuzzer/corpus/00322.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[1] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00323.stmt b/build/fuzzer/corpus/00323.stmt
deleted file mode 100644
index 94eefaeb8f..0000000000
--- a/build/fuzzer/corpus/00323.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00324.stmt b/build/fuzzer/corpus/00324.stmt
deleted file mode 100644
index bace2a0be1..0000000000
--- a/build/fuzzer/corpus/00324.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00325.stmt b/build/fuzzer/corpus/00325.stmt
deleted file mode 100644
index 7d46595550..0000000000
--- a/build/fuzzer/corpus/00325.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = {"b": [q[2]]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00326.stmt b/build/fuzzer/corpus/00326.stmt
deleted file mode 100644
index 94eefaeb8f..0000000000
--- a/build/fuzzer/corpus/00326.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00327.stmt b/build/fuzzer/corpus/00327.stmt
deleted file mode 100644
index cf638ef497..0000000000
--- a/build/fuzzer/corpus/00327.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"b": [2]}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00328.stmt b/build/fuzzer/corpus/00328.stmt
deleted file mode 100644
index 60773251eb..0000000000
--- a/build/fuzzer/corpus/00328.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1000] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00329.stmt b/build/fuzzer/corpus/00329.stmt
deleted file mode 100644
index 088cbbc654..0000000000
--- a/build/fuzzer/corpus/00329.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00330.stmt b/build/fuzzer/corpus/00330.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00331.stmt b/build/fuzzer/corpus/00331.stmt
deleted file mode 100644
index 689fbabbdb..0000000000
--- a/build/fuzzer/corpus/00331.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = y { x = [1]; q[x][0] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00332.stmt b/build/fuzzer/corpus/00332.stmt
deleted file mode 100644
index 7d82cfecf9..0000000000
--- a/build/fuzzer/corpus/00332.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[[x]] { a[_] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00333.stmt b/build/fuzzer/corpus/00333.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00333.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00334.stmt b/build/fuzzer/corpus/00334.stmt
deleted file mode 100644
index 90020918d3..0000000000
--- a/build/fuzzer/corpus/00334.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = 1; q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00335.stmt b/build/fuzzer/corpus/00335.stmt
deleted file mode 100644
index f7c12547eb..0000000000
--- a/build/fuzzer/corpus/00335.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[y] { a[y] = i }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00336.stmt b/build/fuzzer/corpus/00336.stmt
deleted file mode 100644
index bace2a0be1..0000000000
--- a/build/fuzzer/corpus/00336.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00337.stmt b/build/fuzzer/corpus/00337.stmt
deleted file mode 100644
index b05eab4b5e..0000000000
--- a/build/fuzzer/corpus/00337.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { z = [[1, 2], 2]; q[z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00338.stmt b/build/fuzzer/corpus/00338.stmt
deleted file mode 100644
index 25fa07bbf9..0000000000
--- a/build/fuzzer/corpus/00338.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[[x, y]] { x = [1, y]; y = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00339.stmt b/build/fuzzer/corpus/00339.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00339.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00340.stmt b/build/fuzzer/corpus/00340.stmt
deleted file mode 100644
index 27452d9aab..0000000000
--- a/build/fuzzer/corpus/00340.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { y = 2; z = [[1, y], y]; q[z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00341.stmt b/build/fuzzer/corpus/00341.stmt
deleted file mode 100644
index 25fa07bbf9..0000000000
--- a/build/fuzzer/corpus/00341.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[[x, y]] { x = [1, y]; y = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00342.stmt b/build/fuzzer/corpus/00342.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00342.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00343.stmt b/build/fuzzer/corpus/00343.stmt
deleted file mode 100644
index b98eb1bd3b..0000000000
--- a/build/fuzzer/corpus/00343.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { y = 2; x = [1, y]; z = [x, y]; q[z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00344.stmt b/build/fuzzer/corpus/00344.stmt
deleted file mode 100644
index 25fa07bbf9..0000000000
--- a/build/fuzzer/corpus/00344.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[[x, y]] { x = [1, y]; y = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00345.stmt b/build/fuzzer/corpus/00345.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00345.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00346.stmt b/build/fuzzer/corpus/00346.stmt
deleted file mode 100644
index 84696ad9db..0000000000
--- a/build/fuzzer/corpus/00346.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[u] { y = 2; x = [1, u]; z = [x, y]; q[z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00347.stmt b/build/fuzzer/corpus/00347.stmt
deleted file mode 100644
index 25fa07bbf9..0000000000
--- a/build/fuzzer/corpus/00347.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[[x, y]] { x = [1, y]; y = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00348.stmt b/build/fuzzer/corpus/00348.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/00348.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00349.stmt b/build/fuzzer/corpus/00349.stmt
deleted file mode 100644
index 86505bad68..0000000000
--- a/build/fuzzer/corpus/00349.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1] = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00350.stmt b/build/fuzzer/corpus/00350.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00350.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00351.stmt b/build/fuzzer/corpus/00351.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00351.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00352.stmt b/build/fuzzer/corpus/00352.stmt
deleted file mode 100644
index 464c06f641..0000000000
--- a/build/fuzzer/corpus/00352.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1] = 0 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00353.stmt b/build/fuzzer/corpus/00353.stmt
deleted file mode 100644
index f6419757ed..0000000000
--- a/build/fuzzer/corpus/00353.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] = i { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00354.stmt b/build/fuzzer/corpus/00354.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00354.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00355.stmt b/build/fuzzer/corpus/00355.stmt
deleted file mode 100644
index 0ce59ac555..0000000000
--- a/build/fuzzer/corpus/00355.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = [1, q[3], q[2]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00356.stmt b/build/fuzzer/corpus/00356.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00356.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00357.stmt b/build/fuzzer/corpus/00357.stmt
deleted file mode 100644
index b0e75c73be..0000000000
--- a/build/fuzzer/corpus/00357.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,4,3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00358.stmt b/build/fuzzer/corpus/00358.stmt
deleted file mode 100644
index 58d0699227..0000000000
--- a/build/fuzzer/corpus/00358.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = {"a": [q[3]], "b": [q[2]]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00359.stmt b/build/fuzzer/corpus/00359.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00359.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00360.stmt b/build/fuzzer/corpus/00360.stmt
deleted file mode 100644
index 3f2b493dab..0000000000
--- a/build/fuzzer/corpus/00360.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"a": [4], "b": [3]}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00361.stmt b/build/fuzzer/corpus/00361.stmt
deleted file mode 100644
index 7fe8a19741..0000000000
--- a/build/fuzzer/corpus/00361.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1] = 9999 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00362.stmt b/build/fuzzer/corpus/00362.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00362.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00363.stmt b/build/fuzzer/corpus/00363.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00364.stmt b/build/fuzzer/corpus/00364.stmt
deleted file mode 100644
index 564157d9d3..0000000000
--- a/build/fuzzer/corpus/00364.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[9999] = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00365.stmt b/build/fuzzer/corpus/00365.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00365.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00366.stmt b/build/fuzzer/corpus/00366.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00367.stmt b/build/fuzzer/corpus/00367.stmt
deleted file mode 100644
index 2a858275a4..0000000000
--- a/build/fuzzer/corpus/00367.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q.foo = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00368.stmt b/build/fuzzer/corpus/00368.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00368.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00369.stmt b/build/fuzzer/corpus/00369.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00370.stmt b/build/fuzzer/corpus/00370.stmt
deleted file mode 100644
index 798a2237d5..0000000000
--- a/build/fuzzer/corpus/00370.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[0].x[1] = false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00371.stmt b/build/fuzzer/corpus/00371.stmt
deleted file mode 100644
index fb774a5ce7..0000000000
--- a/build/fuzzer/corpus/00371.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { x = c[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00372.stmt b/build/fuzzer/corpus/00372.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00372.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00373.stmt b/build/fuzzer/corpus/00373.stmt
deleted file mode 100644
index 06a64d2e5f..0000000000
--- a/build/fuzzer/corpus/00373.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[v] { x = "a"; q[x][y] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00374.stmt b/build/fuzzer/corpus/00374.stmt
deleted file mode 100644
index 757f67a593..0000000000
--- a/build/fuzzer/corpus/00374.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { k = "a"; v = data.a }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00375.stmt b/build/fuzzer/corpus/00375.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00375.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00376.stmt b/build/fuzzer/corpus/00376.stmt
deleted file mode 100644
index ffaf447985..0000000000
--- a/build/fuzzer/corpus/00376.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[0][x][y] = false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00377.stmt b/build/fuzzer/corpus/00377.stmt
deleted file mode 100644
index fb774a5ce7..0000000000
--- a/build/fuzzer/corpus/00377.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { x = c[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00378.stmt b/build/fuzzer/corpus/00378.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00378.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00379.stmt b/build/fuzzer/corpus/00379.stmt
deleted file mode 100644
index be705c3e0a..0000000000
--- a/build/fuzzer/corpus/00379.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { x = "b"; q[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00380.stmt b/build/fuzzer/corpus/00380.stmt
deleted file mode 100644
index 1efe440a25..0000000000
--- a/build/fuzzer/corpus/00380.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { x = {"a": 1, "b": 2}; x[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00381.stmt b/build/fuzzer/corpus/00381.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/00381.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00382.stmt b/build/fuzzer/corpus/00382.stmt
deleted file mode 100644
index e6ada60afc..0000000000
--- a/build/fuzzer/corpus/00382.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] = y { r[z] = y; q[x] = z }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00383.stmt b/build/fuzzer/corpus/00383.stmt
deleted file mode 100644
index 42c45ed6f8..0000000000
--- a/build/fuzzer/corpus/00383.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r[k] = v { x = {"a": 1, "b": 2, "c": 3, "d": 4}; x[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00384.stmt b/build/fuzzer/corpus/00384.stmt
deleted file mode 100644
index e112e9d54e..0000000000
--- a/build/fuzzer/corpus/00384.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[y] = x { z = {"a": "a", "b": "b", "d": "d"}; z[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00385.stmt b/build/fuzzer/corpus/00385.stmt
deleted file mode 100644
index f7b2921069..0000000000
--- a/build/fuzzer/corpus/00385.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"a": 1, "b": 2, "d": 4}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00386.stmt b/build/fuzzer/corpus/00386.stmt
deleted file mode 100644
index 74769cefe3..0000000000
--- a/build/fuzzer/corpus/00386.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00387.stmt b/build/fuzzer/corpus/00387.stmt
deleted file mode 100644
index 380e168f17..0000000000
--- a/build/fuzzer/corpus/00387.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[y] { a[i] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00388.stmt b/build/fuzzer/corpus/00388.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00388.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00389.stmt b/build/fuzzer/corpus/00389.stmt
deleted file mode 100644
index 41d8d80081..0000000000
--- a/build/fuzzer/corpus/00389.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { {i: [i]} = {i: [q[i]]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00390.stmt b/build/fuzzer/corpus/00390.stmt
deleted file mode 100644
index 301b0e5a76..0000000000
--- a/build/fuzzer/corpus/00390.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { d.e[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00391.stmt b/build/fuzzer/corpus/00391.stmt
deleted file mode 100644
index 4940b40b6c..0000000000
--- a/build/fuzzer/corpus/00391.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["bar", "baz"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00392.stmt b/build/fuzzer/corpus/00392.stmt
deleted file mode 100644
index 74769cefe3..0000000000
--- a/build/fuzzer/corpus/00392.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00393.stmt b/build/fuzzer/corpus/00393.stmt
deleted file mode 100644
index bc920dbbe8..0000000000
--- a/build/fuzzer/corpus/00393.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[y] { y = [i, j]; i = 1; j = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00394.stmt b/build/fuzzer/corpus/00394.stmt
deleted file mode 100644
index 1dd9cdfcb6..0000000000
--- a/build/fuzzer/corpus/00394.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,2]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00395.stmt b/build/fuzzer/corpus/00395.stmt
deleted file mode 100644
index 600dce2e9e..0000000000
--- a/build/fuzzer/corpus/00395.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { q[x][0] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00396.stmt b/build/fuzzer/corpus/00396.stmt
deleted file mode 100644
index 7d82cfecf9..0000000000
--- a/build/fuzzer/corpus/00396.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[[x]] { a[_] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00397.stmt b/build/fuzzer/corpus/00397.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00397.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00398.stmt b/build/fuzzer/corpus/00398.stmt
deleted file mode 100644
index 47369515ec..0000000000
--- a/build/fuzzer/corpus/00398.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { q[i][j][k][x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00399.stmt b/build/fuzzer/corpus/00399.stmt
deleted file mode 100644
index 02ebe454da..0000000000
--- a/build/fuzzer/corpus/00399.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[{{[1], [2]}, {[3], [4]}}] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00400.stmt b/build/fuzzer/corpus/00400.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00400.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00401.stmt b/build/fuzzer/corpus/00401.stmt
deleted file mode 100644
index 74769cefe3..0000000000
--- a/build/fuzzer/corpus/00401.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00402.stmt b/build/fuzzer/corpus/00402.stmt
deleted file mode 100644
index 27a5b4d148..0000000000
--- a/build/fuzzer/corpus/00402.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {0, "", false, null, [], {}, set()} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00403.stmt b/build/fuzzer/corpus/00403.stmt
deleted file mode 100644
index dcc590a753..0000000000
--- a/build/fuzzer/corpus/00403.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0, "", null, [], {}, []]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00404.stmt b/build/fuzzer/corpus/00404.stmt
deleted file mode 100644
index dfa3650b6c..0000000000
--- a/build/fuzzer/corpus/00404.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] = 4 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00405.stmt b/build/fuzzer/corpus/00405.stmt
deleted file mode 100644
index 9e8b590cca..0000000000
--- a/build/fuzzer/corpus/00405.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00406.stmt b/build/fuzzer/corpus/00406.stmt
deleted file mode 100644
index 810c539bc7..0000000000
--- a/build/fuzzer/corpus/00406.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00407.stmt b/build/fuzzer/corpus/00407.stmt
deleted file mode 100644
index 93c683ae5d..0000000000
--- a/build/fuzzer/corpus/00407.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] = y { q[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00408.stmt b/build/fuzzer/corpus/00408.stmt
deleted file mode 100644
index 08b516235a..0000000000
--- a/build/fuzzer/corpus/00408.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { b[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00409.stmt b/build/fuzzer/corpus/00409.stmt
deleted file mode 100644
index fba530d23b..0000000000
--- a/build/fuzzer/corpus/00409.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"v1": "hello", "v2": "goodbye"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00410.stmt b/build/fuzzer/corpus/00410.stmt
deleted file mode 100644
index da0b26b278..0000000000
--- a/build/fuzzer/corpus/00410.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[k] = v { {k: [q[k]]} = {k: [v]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00411.stmt b/build/fuzzer/corpus/00411.stmt
deleted file mode 100644
index f1c8ddfb21..0000000000
--- a/build/fuzzer/corpus/00411.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] = y { b[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00412.stmt b/build/fuzzer/corpus/00412.stmt
deleted file mode 100644
index fba530d23b..0000000000
--- a/build/fuzzer/corpus/00412.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"v1": "hello", "v2": "goodbye"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00413.stmt b/build/fuzzer/corpus/00413.stmt
deleted file mode 100644
index abb7f9be55..0000000000
--- a/build/fuzzer/corpus/00413.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { q[i].x[1] = false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00414.stmt b/build/fuzzer/corpus/00414.stmt
deleted file mode 100644
index fb774a5ce7..0000000000
--- a/build/fuzzer/corpus/00414.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { x = c[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00415.stmt b/build/fuzzer/corpus/00415.stmt
deleted file mode 100644
index 6e7ea636ee..0000000000
--- a/build/fuzzer/corpus/00415.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00416.stmt b/build/fuzzer/corpus/00416.stmt
deleted file mode 100644
index 523e7b0107..0000000000
--- a/build/fuzzer/corpus/00416.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[r] { q[x][y][z] = false; r = [x, y, z] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00417.stmt b/build/fuzzer/corpus/00417.stmt
deleted file mode 100644
index fb774a5ce7..0000000000
--- a/build/fuzzer/corpus/00417.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[i] = x { x = c[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00418.stmt b/build/fuzzer/corpus/00418.stmt
deleted file mode 100644
index e6ea1ba50f..0000000000
--- a/build/fuzzer/corpus/00418.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0, "x", 1], [0, "z", "q"]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00419.stmt b/build/fuzzer/corpus/00419.stmt
deleted file mode 100644
index 1a85c5484d..0000000000
--- a/build/fuzzer/corpus/00419.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[_][0].c[_] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00420.stmt b/build/fuzzer/corpus/00420.stmt
deleted file mode 100644
index 917f0aae8a..0000000000
--- a/build/fuzzer/corpus/00420.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { d.e[_] = k; v = [r | r = l[_]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00421.stmt b/build/fuzzer/corpus/00421.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00421.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00422.stmt b/build/fuzzer/corpus/00422.stmt
deleted file mode 100644
index 55ca2a6afb..0000000000
--- a/build/fuzzer/corpus/00422.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[_].x[0].c[_] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00423.stmt b/build/fuzzer/corpus/00423.stmt
deleted file mode 100644
index 877db1d9ec..0000000000
--- a/build/fuzzer/corpus/00423.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { d.e[_] = k; v = {"x": [r | r = l[_]]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00424.stmt b/build/fuzzer/corpus/00424.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00424.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00425.stmt b/build/fuzzer/corpus/00425.stmt
deleted file mode 100644
index a1e09d62ec..0000000000
--- a/build/fuzzer/corpus/00425.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q.bar[1].alice[0] = 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00426.stmt b/build/fuzzer/corpus/00426.stmt
deleted file mode 100644
index 799b7e1636..0000000000
--- a/build/fuzzer/corpus/00426.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { d.e[_] = k; v = [x | x = {l[_].a: [1]}] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00427.stmt b/build/fuzzer/corpus/00427.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00427.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00428.stmt b/build/fuzzer/corpus/00428.stmt
deleted file mode 100644
index 8859e6039e..0000000000
--- a/build/fuzzer/corpus/00428.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { q[x] = y; z = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00429.stmt b/build/fuzzer/corpus/00429.stmt
deleted file mode 100644
index cdc2e600e7..0000000000
--- a/build/fuzzer/corpus/00429.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { v = [x, y]; x = "a"; y = "b"; k = "foo" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00430.stmt b/build/fuzzer/corpus/00430.stmt
deleted file mode 100644
index c046bf32cb..0000000000
--- a/build/fuzzer/corpus/00430.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["foo", ["a", "b"]]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00431.stmt b/build/fuzzer/corpus/00431.stmt
deleted file mode 100644
index 8859e6039e..0000000000
--- a/build/fuzzer/corpus/00431.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { q[x] = y; z = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00432.stmt b/build/fuzzer/corpus/00432.stmt
deleted file mode 100644
index 1da33fda37..0000000000
--- a/build/fuzzer/corpus/00432.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { k = y; y = x; x = "a"; v = "foo" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00433.stmt b/build/fuzzer/corpus/00433.stmt
deleted file mode 100644
index 82affa310d..0000000000
--- a/build/fuzzer/corpus/00433.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["a", "foo"]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00434.stmt b/build/fuzzer/corpus/00434.stmt
deleted file mode 100644
index c72200ccaa..0000000000
--- a/build/fuzzer/corpus/00434.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[[x, y]] { q[x] = 1; q[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00435.stmt b/build/fuzzer/corpus/00435.stmt
deleted file mode 100644
index f6419757ed..0000000000
--- a/build/fuzzer/corpus/00435.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] = i { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00436.stmt b/build/fuzzer/corpus/00436.stmt
deleted file mode 100644
index 916e55d534..0000000000
--- a/build/fuzzer/corpus/00436.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[2,3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00437.stmt b/build/fuzzer/corpus/00437.stmt
deleted file mode 100644
index a3520422fe..0000000000
--- a/build/fuzzer/corpus/00437.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] = r[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00438.stmt b/build/fuzzer/corpus/00438.stmt
deleted file mode 100644
index ae76a1732b..0000000000
--- a/build/fuzzer/corpus/00438.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] = y { z = {"a": 1, "b": 2, "d": 4}; z[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00439.stmt b/build/fuzzer/corpus/00439.stmt
deleted file mode 100644
index 14172069b4..0000000000
--- a/build/fuzzer/corpus/00439.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r[k] = v { x = {"a": 1, "b": 2, "c": 4, "d": 3}; x[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00440.stmt b/build/fuzzer/corpus/00440.stmt
deleted file mode 100644
index 27dff3ea2c..0000000000
--- a/build/fuzzer/corpus/00440.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["a", "b"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00441.stmt b/build/fuzzer/corpus/00441.stmt
deleted file mode 100644
index c5017e3e59..0000000000
--- a/build/fuzzer/corpus/00441.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { q[x]; r[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00442.stmt b/build/fuzzer/corpus/00442.stmt
deleted file mode 100644
index 23adb78da4..0000000000
--- a/build/fuzzer/corpus/00442.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { z = ["a", "b", "c", "d"]; z[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00443.stmt b/build/fuzzer/corpus/00443.stmt
deleted file mode 100644
index 1bdc0536f1..0000000000
--- a/build/fuzzer/corpus/00443.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r[k] = v { x = {"a": 1, "b": 2, "d": 4}; x[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00444.stmt b/build/fuzzer/corpus/00444.stmt
deleted file mode 100644
index d197cf48c3..0000000000
--- a/build/fuzzer/corpus/00444.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2, 4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00445.stmt b/build/fuzzer/corpus/00445.stmt
deleted file mode 100644
index 86505bad68..0000000000
--- a/build/fuzzer/corpus/00445.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1] = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00446.stmt b/build/fuzzer/corpus/00446.stmt
deleted file mode 100644
index 6463fd5cd1..0000000000
--- a/build/fuzzer/corpus/00446.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [1, 2, 3, 4] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00447.stmt b/build/fuzzer/corpus/00447.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00447.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00448.stmt b/build/fuzzer/corpus/00448.stmt
deleted file mode 100644
index f052dbbce0..0000000000
--- a/build/fuzzer/corpus/00448.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q.b = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00449.stmt b/build/fuzzer/corpus/00449.stmt
deleted file mode 100644
index 543d6e3298..0000000000
--- a/build/fuzzer/corpus/00449.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {"a": 1, "b": 2} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00450.stmt b/build/fuzzer/corpus/00450.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00450.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00451.stmt b/build/fuzzer/corpus/00451.stmt
deleted file mode 100644
index 4906c1a0ba..0000000000
--- a/build/fuzzer/corpus/00451.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00452.stmt b/build/fuzzer/corpus/00452.stmt
deleted file mode 100644
index 81d0437d18..0000000000
--- a/build/fuzzer/corpus/00452.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {1, 2, 3, 4} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00453.stmt b/build/fuzzer/corpus/00453.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00453.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00454.stmt b/build/fuzzer/corpus/00454.stmt
deleted file mode 100644
index 2ef9206838..0000000000
--- a/build/fuzzer/corpus/00454.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1][1] = 3 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00455.stmt b/build/fuzzer/corpus/00455.stmt
deleted file mode 100644
index d5555f3eb9..0000000000
--- a/build/fuzzer/corpus/00455.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [[0, 1], [2, 3]] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00456.stmt b/build/fuzzer/corpus/00456.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00456.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00457.stmt b/build/fuzzer/corpus/00457.stmt
deleted file mode 100644
index 67e5a4739b..0000000000
--- a/build/fuzzer/corpus/00457.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q.b[1] = 4 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00458.stmt b/build/fuzzer/corpus/00458.stmt
deleted file mode 100644
index b770411627..0000000000
--- a/build/fuzzer/corpus/00458.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {"a": [1, 2], "b": [3, 4]} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00459.stmt b/build/fuzzer/corpus/00459.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00459.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00460.stmt b/build/fuzzer/corpus/00460.stmt
deleted file mode 100644
index bc5033c57d..0000000000
--- a/build/fuzzer/corpus/00460.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { z = [1, 2]; z[i] = y; q[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00461.stmt b/build/fuzzer/corpus/00461.stmt
deleted file mode 100644
index 6463fd5cd1..0000000000
--- a/build/fuzzer/corpus/00461.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [1, 2, 3, 4] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00462.stmt b/build/fuzzer/corpus/00462.stmt
deleted file mode 100644
index 906aa8d974..0000000000
--- a/build/fuzzer/corpus/00462.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00463.stmt b/build/fuzzer/corpus/00463.stmt
deleted file mode 100644
index 470eacba6e..0000000000
--- a/build/fuzzer/corpus/00463.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { z = ["b", "c"]; z[i] = y; q[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00464.stmt b/build/fuzzer/corpus/00464.stmt
deleted file mode 100644
index dd059ff37a..0000000000
--- a/build/fuzzer/corpus/00464.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {"a": 1, "b": 2, "c": 3, "d": 4} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00465.stmt b/build/fuzzer/corpus/00465.stmt
deleted file mode 100644
index 906aa8d974..0000000000
--- a/build/fuzzer/corpus/00465.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00466.stmt b/build/fuzzer/corpus/00466.stmt
deleted file mode 100644
index 32f0e153d6..0000000000
--- a/build/fuzzer/corpus/00466.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q[1][1] = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00467.stmt b/build/fuzzer/corpus/00467.stmt
deleted file mode 100644
index a17daefa75..0000000000
--- a/build/fuzzer/corpus/00467.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [{"x": x, "y": y}, z] { x = 1; y = 2; z = [1, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00468.stmt b/build/fuzzer/corpus/00468.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00468.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00469.stmt b/build/fuzzer/corpus/00469.stmt
deleted file mode 100644
index 32dc9041f2..0000000000
--- a/build/fuzzer/corpus/00469.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[i] = e; x = [i, e] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00470.stmt b/build/fuzzer/corpus/00470.stmt
deleted file mode 100644
index 6463fd5cd1..0000000000
--- a/build/fuzzer/corpus/00470.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [1, 2, 3, 4] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00471.stmt b/build/fuzzer/corpus/00471.stmt
deleted file mode 100644
index 2884baef27..0000000000
--- a/build/fuzzer/corpus/00471.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0,1],[1,2],[2,3],[3,4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00472.stmt b/build/fuzzer/corpus/00472.stmt
deleted file mode 100644
index 32dc9041f2..0000000000
--- a/build/fuzzer/corpus/00472.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[i] = e; x = [i, e] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00473.stmt b/build/fuzzer/corpus/00473.stmt
deleted file mode 100644
index 543d6e3298..0000000000
--- a/build/fuzzer/corpus/00473.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {"a": 1, "b": 2} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00474.stmt b/build/fuzzer/corpus/00474.stmt
deleted file mode 100644
index b60f580a02..0000000000
--- a/build/fuzzer/corpus/00474.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["a", 1], ["b", 2]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00475.stmt b/build/fuzzer/corpus/00475.stmt
deleted file mode 100644
index 74769cefe3..0000000000
--- a/build/fuzzer/corpus/00475.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00476.stmt b/build/fuzzer/corpus/00476.stmt
deleted file mode 100644
index 81d0437d18..0000000000
--- a/build/fuzzer/corpus/00476.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {1, 2, 3, 4} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00477.stmt b/build/fuzzer/corpus/00477.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00477.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00478.stmt b/build/fuzzer/corpus/00478.stmt
deleted file mode 100644
index cec19714ac..0000000000
--- a/build/fuzzer/corpus/00478.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[r] { q[i][j] = 2; r = [i, j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00479.stmt b/build/fuzzer/corpus/00479.stmt
deleted file mode 100644
index 86e1edbfe4..0000000000
--- a/build/fuzzer/corpus/00479.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [[1, 2], [3, 2]] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00480.stmt b/build/fuzzer/corpus/00480.stmt
deleted file mode 100644
index 94266041b0..0000000000
--- a/build/fuzzer/corpus/00480.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0, 1], [1, 1]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00481.stmt b/build/fuzzer/corpus/00481.stmt
deleted file mode 100644
index 06ae18262d..0000000000
--- a/build/fuzzer/corpus/00481.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[r] { q[x][y] = 2; r = [x, y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00482.stmt b/build/fuzzer/corpus/00482.stmt
deleted file mode 100644
index 554516d39c..0000000000
--- a/build/fuzzer/corpus/00482.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {"a": {"x": 1}, "b": {"y": 2}, "c": {"z": 2}} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00483.stmt b/build/fuzzer/corpus/00483.stmt
deleted file mode 100644
index 42b2d96d35..0000000000
--- a/build/fuzzer/corpus/00483.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["b", "y"], ["c", "z"]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00484.stmt b/build/fuzzer/corpus/00484.stmt
deleted file mode 100644
index 5281bc7073..0000000000
--- a/build/fuzzer/corpus/00484.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[_][_] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00485.stmt b/build/fuzzer/corpus/00485.stmt
deleted file mode 100644
index a17daefa75..0000000000
--- a/build/fuzzer/corpus/00485.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [{"x": x, "y": y}, z] { x = 1; y = 2; z = [1, 2, 3] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00486.stmt b/build/fuzzer/corpus/00486.stmt
deleted file mode 100644
index 3a26a2e5e9..0000000000
--- a/build/fuzzer/corpus/00486.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00487.stmt b/build/fuzzer/corpus/00487.stmt
deleted file mode 100644
index f4bee89590..0000000000
--- a/build/fuzzer/corpus/00487.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00488.stmt b/build/fuzzer/corpus/00488.stmt
deleted file mode 100644
index 8f03fd3f57..0000000000
--- a/build/fuzzer/corpus/00488.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00489.stmt b/build/fuzzer/corpus/00489.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00489.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00490.stmt b/build/fuzzer/corpus/00490.stmt
deleted file mode 100644
index f4bee89590..0000000000
--- a/build/fuzzer/corpus/00490.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00491.stmt b/build/fuzzer/corpus/00491.stmt
deleted file mode 100644
index 5561c85676..0000000000
--- a/build/fuzzer/corpus/00491.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = x { x = true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00492.stmt b/build/fuzzer/corpus/00492.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00492.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00493.stmt b/build/fuzzer/corpus/00493.stmt
deleted file mode 100644
index f4bee89590..0000000000
--- a/build/fuzzer/corpus/00493.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00494.stmt b/build/fuzzer/corpus/00494.stmt
deleted file mode 100644
index beeda404b7..0000000000
--- a/build/fuzzer/corpus/00494.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = false { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00495.stmt b/build/fuzzer/corpus/00495.stmt
deleted file mode 100644
index 8f03fd3f57..0000000000
--- a/build/fuzzer/corpus/00495.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00496.stmt b/build/fuzzer/corpus/00496.stmt
deleted file mode 100644
index ccfa69763f..0000000000
--- a/build/fuzzer/corpus/00496.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00497.stmt b/build/fuzzer/corpus/00497.stmt
deleted file mode 100644
index 86e9e76e55..0000000000
--- a/build/fuzzer/corpus/00497.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = true { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00498.stmt b/build/fuzzer/corpus/00498.stmt
deleted file mode 100644
index beeda404b7..0000000000
--- a/build/fuzzer/corpus/00498.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = false { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00499.stmt b/build/fuzzer/corpus/00499.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00499.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00500.stmt b/build/fuzzer/corpus/00500.stmt
deleted file mode 100644
index 1dc6dc1d1f..0000000000
--- a/build/fuzzer/corpus/00500.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] = y { q = o; o[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00501.stmt b/build/fuzzer/corpus/00501.stmt
deleted file mode 100644
index f1c8ddfb21..0000000000
--- a/build/fuzzer/corpus/00501.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] = y { b[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00502.stmt b/build/fuzzer/corpus/00502.stmt
deleted file mode 100644
index fba530d23b..0000000000
--- a/build/fuzzer/corpus/00502.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"v1": "hello", "v2": "goodbye"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00503.stmt b/build/fuzzer/corpus/00503.stmt
deleted file mode 100644
index 1dc6dc1d1f..0000000000
--- a/build/fuzzer/corpus/00503.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] = y { q = o; o[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00504.stmt b/build/fuzzer/corpus/00504.stmt
deleted file mode 100644
index f1c8ddfb21..0000000000
--- a/build/fuzzer/corpus/00504.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] = y { b[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00505.stmt b/build/fuzzer/corpus/00505.stmt
deleted file mode 100644
index b5f29c74fe..0000000000
--- a/build/fuzzer/corpus/00505.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x1] = y1 { d.e[y1] = x1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00506.stmt b/build/fuzzer/corpus/00506.stmt
deleted file mode 100644
index 52f66abde1..0000000000
--- a/build/fuzzer/corpus/00506.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"v1": "hello", "v2": "goodbye", "bar": 0, "baz": 1}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00507.stmt b/build/fuzzer/corpus/00507.stmt
deleted file mode 100644
index ad17a37ed4..0000000000
--- a/build/fuzzer/corpus/00507.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q = x; x[i] = 4 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00508.stmt b/build/fuzzer/corpus/00508.stmt
deleted file mode 100644
index 3f5eb74539..0000000000
--- a/build/fuzzer/corpus/00508.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { r = x; x[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00509.stmt b/build/fuzzer/corpus/00509.stmt
deleted file mode 100644
index 34874186cf..0000000000
--- a/build/fuzzer/corpus/00509.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r[k] = v { s = x; x[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00510.stmt b/build/fuzzer/corpus/00510.stmt
deleted file mode 100644
index df6f128878..0000000000
--- a/build/fuzzer/corpus/00510.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r[k] = v { t = x; x[v] = k }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00511.stmt b/build/fuzzer/corpus/00511.stmt
deleted file mode 100644
index 9ac51fd625..0000000000
--- a/build/fuzzer/corpus/00511.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s = {"a": 1, "b": 2, "c": 4} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00512.stmt b/build/fuzzer/corpus/00512.stmt
deleted file mode 100644
index 5fdd58b521..0000000000
--- a/build/fuzzer/corpus/00512.stmt
+++ /dev/null
@@ -1 +0,0 @@
-t = ["d", "e", "g"] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00513.stmt b/build/fuzzer/corpus/00513.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00513.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00514.stmt b/build/fuzzer/corpus/00514.stmt
deleted file mode 100644
index c85eef3d65..0000000000
--- a/build/fuzzer/corpus/00514.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00515.stmt b/build/fuzzer/corpus/00515.stmt
deleted file mode 100644
index 4ce5e06ff8..0000000000
--- a/build/fuzzer/corpus/00515.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { v = [i, j]; k = i; i = "a"; j = 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00516.stmt b/build/fuzzer/corpus/00516.stmt
deleted file mode 100644
index b5c6b7afcb..0000000000
--- a/build/fuzzer/corpus/00516.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"a": ["a", 1]}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00517.stmt b/build/fuzzer/corpus/00517.stmt
deleted file mode 100644
index c85eef3d65..0000000000
--- a/build/fuzzer/corpus/00517.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00518.stmt b/build/fuzzer/corpus/00518.stmt
deleted file mode 100644
index 3e0e1d610c..0000000000
--- a/build/fuzzer/corpus/00518.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = {"v": v} { v = [i, j]; k = i; i = "a"; j = 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00519.stmt b/build/fuzzer/corpus/00519.stmt
deleted file mode 100644
index 3c668010e7..0000000000
--- a/build/fuzzer/corpus/00519.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"a": {"v": ["a", 1]}}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00520.stmt b/build/fuzzer/corpus/00520.stmt
deleted file mode 100644
index 08ede40b80..0000000000
--- a/build/fuzzer/corpus/00520.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q; q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00521.stmt b/build/fuzzer/corpus/00521.stmt
deleted file mode 100644
index 183ed28d87..0000000000
--- a/build/fuzzer/corpus/00521.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = x { x = data.c[0].z.p }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00522.stmt b/build/fuzzer/corpus/00522.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00522.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00523.stmt b/build/fuzzer/corpus/00523.stmt
deleted file mode 100644
index 3a4e64e779..0000000000
--- a/build/fuzzer/corpus/00523.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] = y { xs = ["a", "b", "c", "a"]; x = xs[i]; y = a[i] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00524.stmt b/build/fuzzer/corpus/00524.stmt
deleted file mode 100644
index 5a8b31bfa7..0000000000
--- a/build/fuzzer/corpus/00524.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q = s; s[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00525.stmt b/build/fuzzer/corpus/00525.stmt
deleted file mode 100644
index 94eefaeb8f..0000000000
--- a/build/fuzzer/corpus/00525.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00526.stmt b/build/fuzzer/corpus/00526.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00526.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00527.stmt b/build/fuzzer/corpus/00527.stmt
deleted file mode 100644
index fbb6cca0ce..0000000000
--- a/build/fuzzer/corpus/00527.stmt
+++ /dev/null
@@ -1 +0,0 @@
-empty partial set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00528.stmt b/build/fuzzer/corpus/00528.stmt
deleted file mode 100644
index c5cb5c4c20..0000000000
--- a/build/fuzzer/corpus/00528.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[1] { a[0] = 100 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00529.stmt b/build/fuzzer/corpus/00529.stmt
deleted file mode 100644
index 0637a088a0..0000000000
--- a/build/fuzzer/corpus/00529.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00530.stmt b/build/fuzzer/corpus/00530.stmt
deleted file mode 100644
index a581996db7..0000000000
--- a/build/fuzzer/corpus/00530.stmt
+++ /dev/null
@@ -1 +0,0 @@
-empty partial object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00531.stmt b/build/fuzzer/corpus/00531.stmt
deleted file mode 100644
index 4f1a0be9e2..0000000000
--- a/build/fuzzer/corpus/00531.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p["x"] = 1 { a[0] = 100 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00533.stmt b/build/fuzzer/corpus/00533.stmt
deleted file mode 100644
index 3372acb57f..0000000000
--- a/build/fuzzer/corpus/00533.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { q.a.b = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00534.stmt b/build/fuzzer/corpus/00534.stmt
deleted file mode 100644
index 9af7f80ba1..0000000000
--- a/build/fuzzer/corpus/00534.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {x: {y: 1}} { x = "a"; y = "b" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00535.stmt b/build/fuzzer/corpus/00535.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00535.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00536.stmt b/build/fuzzer/corpus/00536.stmt
deleted file mode 100644
index 6a5faf201b..0000000000
--- a/build/fuzzer/corpus/00536.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p { q["c"] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00537.stmt b/build/fuzzer/corpus/00537.stmt
deleted file mode 100644
index 184d039179..0000000000
--- a/build/fuzzer/corpus/00537.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {x, "b", z} { x = "a"; z = "c" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00538.stmt b/build/fuzzer/corpus/00538.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00538.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00539.stmt b/build/fuzzer/corpus/00539.stmt
deleted file mode 100644
index f987164545..0000000000
--- a/build/fuzzer/corpus/00539.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[i][j] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00540.stmt b/build/fuzzer/corpus/00540.stmt
deleted file mode 100644
index 1dd7b8db8c..0000000000
--- a/build/fuzzer/corpus/00540.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {x: {x1: 1}, y: {y1: 2}} { x = "a"; y = "b"; x1 = "a1"; y1 = "b1" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00541.stmt b/build/fuzzer/corpus/00541.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00541.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00542.stmt b/build/fuzzer/corpus/00542.stmt
deleted file mode 100644
index 74769cefe3..0000000000
--- a/build/fuzzer/corpus/00542.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00543.stmt b/build/fuzzer/corpus/00543.stmt
deleted file mode 100644
index 184d039179..0000000000
--- a/build/fuzzer/corpus/00543.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {x, "b", z} { x = "a"; z = "c" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00544.stmt b/build/fuzzer/corpus/00544.stmt
deleted file mode 100644
index 5e193048a5..0000000000
--- a/build/fuzzer/corpus/00544.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["a", "b", "c"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00545.stmt b/build/fuzzer/corpus/00545.stmt
deleted file mode 100644
index 4f8dfb9834..0000000000
--- a/build/fuzzer/corpus/00545.stmt
+++ /dev/null
@@ -1,28 +0,0 @@
-
-	{
-		"topdown": {
-			"a": {
-				"b": {
-					"c": {
-						"x": [100,200],
-						"y": false,
-						"z": {
-							"a": "b"
-						}
-					}
-				}
-			},
-			"g": {
-				"h": {
-					"k": [1,2,3]
-				}
-			},
-			"set": {
-				"u": [1,2,3,4]
-			},
-			"conflicts": {
-				"k": "foo"
-			}
-		}
-	}
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00546.stmt b/build/fuzzer/corpus/00546.stmt
deleted file mode 100644
index 855a6b8e14..0000000000
--- a/build/fuzzer/corpus/00546.stmt
+++ /dev/null
@@ -1,6 +0,0 @@
-package topdown.a.b.c
-
-p = [1, 2] { true }
-q = [3, 4] { true }
-r["a"] = 1 { true }
-r["b"] = 2 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00547.stmt b/build/fuzzer/corpus/00547.stmt
deleted file mode 100644
index 75dc1f72ab..0000000000
--- a/build/fuzzer/corpus/00547.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.a.b.c.s
-
-w = {"f": 10, "g": 9.9} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00548.stmt b/build/fuzzer/corpus/00548.stmt
deleted file mode 100644
index a8fb4be0d2..0000000000
--- a/build/fuzzer/corpus/00548.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.set
-
-v[data.topdown.set.u[_]] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00549.stmt b/build/fuzzer/corpus/00549.stmt
deleted file mode 100644
index 615d6c4417..0000000000
--- a/build/fuzzer/corpus/00549.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.no.base.doc
-
-p = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00550.stmt b/build/fuzzer/corpus/00550.stmt
deleted file mode 100644
index 56e0316cde..0000000000
--- a/build/fuzzer/corpus/00550.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-package topdown.a.b.c.undefined1
-
-p = true { false }
-p = true { false }
-q = true { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00551.stmt b/build/fuzzer/corpus/00551.stmt
deleted file mode 100644
index bf93c199ad..0000000000
--- a/build/fuzzer/corpus/00551.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.a.b.c.undefined2
-
-p = true { input.foo }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00552.stmt b/build/fuzzer/corpus/00552.stmt
deleted file mode 100644
index 21b10c32c2..0000000000
--- a/build/fuzzer/corpus/00552.stmt
+++ /dev/null
@@ -1 +0,0 @@
-package topdown.a.b.c.empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00553.stmt b/build/fuzzer/corpus/00553.stmt
deleted file mode 100644
index 03bbc55715..0000000000
--- a/build/fuzzer/corpus/00553.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.g.h
-
-p = true { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00554.stmt b/build/fuzzer/corpus/00554.stmt
deleted file mode 100644
index 0682cb1313..0000000000
--- a/build/fuzzer/corpus/00554.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-package topdown.virtual.constants
-
-		p = 1
-		q = 2
-		r = 1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00555.stmt b/build/fuzzer/corpus/00555.stmt
deleted file mode 100644
index a914964261..0000000000
--- a/build/fuzzer/corpus/00555.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.missing.input.value
-
-		p = input.deadbeef
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00556.stmt b/build/fuzzer/corpus/00556.stmt
deleted file mode 100644
index e392f5425a..0000000000
--- a/build/fuzzer/corpus/00556.stmt
+++ /dev/null
@@ -1,12 +0,0 @@
-package topdown
-
-p[[x1, x2, x3, x4]] { data.topdown.a.b[x1][x2][x3] = x4 }
-q[[x1, x2, x3]] { data.topdown.a.b[x1][x2][0] = x3 }
-r[[x1, x2]] { data.topdown.a.b[x1] = x2 }
-s = data.topdown.no { true }
-t = data.topdown.a.b.c.undefined1 { true }
-u = data.topdown.missing.input.value { true }
-v = data.topdown.g { true }
-w = data.topdown.set { true }
-
-iterate_ground[x] { data.topdown.virtual.constants[x] = 1 }
diff --git a/build/fuzzer/corpus/00557.stmt b/build/fuzzer/corpus/00557.stmt
deleted file mode 100644
index 88ec68b927..0000000000
--- a/build/fuzzer/corpus/00557.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package topdown.conflicts
-
-		k = "bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00558.stmt b/build/fuzzer/corpus/00558.stmt
deleted file mode 100644
index f58836bfd3..0000000000
--- a/build/fuzzer/corpus/00558.stmt
+++ /dev/null
@@ -1 +0,0 @@
-base/virtual
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00559.stmt b/build/fuzzer/corpus/00559.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00559.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00560.stmt b/build/fuzzer/corpus/00560.stmt
deleted file mode 100644
index 4f6c4ee9d9..0000000000
--- a/build/fuzzer/corpus/00560.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00561.stmt b/build/fuzzer/corpus/00561.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00561.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00562.stmt b/build/fuzzer/corpus/00562.stmt
deleted file mode 100644
index 6a72ea31d2..0000000000
--- a/build/fuzzer/corpus/00562.stmt
+++ /dev/null
@@ -1,12 +0,0 @@
-[
-		["c", "p", 0, 1],
-		["c", "p", 1, 2],
-		["c", "q", 0, 3],
-		["c", "q", 1, 4],
-		["c", "r", "a", 1],
-		["c", "r", "b", 2],
-		["c", "x", 0, 100],
-		["c", "x", 1, 200],
-		["c", "z", "a", "b"],
-		["c", "s", "w", {"f":10, "g": 9.9}]
-	]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00563.stmt b/build/fuzzer/corpus/00563.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00563.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00564.stmt b/build/fuzzer/corpus/00564.stmt
deleted file mode 100644
index ea0c8a85cb..0000000000
--- a/build/fuzzer/corpus/00564.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00565.stmt b/build/fuzzer/corpus/00565.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00565.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00566.stmt b/build/fuzzer/corpus/00566.stmt
deleted file mode 100644
index e188fe4485..0000000000
--- a/build/fuzzer/corpus/00566.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-[
-		["c", "p", 1],
-		["c", "q", 3],
-		["c", "x", 100]
-	]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00567.stmt b/build/fuzzer/corpus/00567.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00567.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00568.stmt b/build/fuzzer/corpus/00568.stmt
deleted file mode 100644
index 1d2f01491f..0000000000
--- a/build/fuzzer/corpus/00568.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00569.stmt b/build/fuzzer/corpus/00569.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00569.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00570.stmt b/build/fuzzer/corpus/00570.stmt
deleted file mode 100644
index f7f6c5d2bb..0000000000
--- a/build/fuzzer/corpus/00570.stmt
+++ /dev/null
@@ -1,14 +0,0 @@
-[
-		["c", {
-			"p": [1,2],
-			"q": [3,4],
-			"r": {"a": 1, "b": 2},
-			"s": {"w": {"f": 10, "g": 9.9}},
-			"x": [100,200],
-			"y": false,
-			"z": {"a": "b"},
-			"undefined1": {},
-			"undefined2": {},
-			"empty": {}
-		}]
-	]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00571.stmt b/build/fuzzer/corpus/00571.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00571.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00572.stmt b/build/fuzzer/corpus/00572.stmt
deleted file mode 100644
index 6bf0c97a7f..0000000000
--- a/build/fuzzer/corpus/00572.stmt
+++ /dev/null
@@ -1 +0,0 @@
-w
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00573.stmt b/build/fuzzer/corpus/00573.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00573.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00574.stmt b/build/fuzzer/corpus/00574.stmt
deleted file mode 100644
index 4c1d9fb7aa..0000000000
--- a/build/fuzzer/corpus/00574.stmt
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-		"v": [1,2,3,4],
-		"u": [1,2,3,4]
-	}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00575.stmt b/build/fuzzer/corpus/00575.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00575.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00576.stmt b/build/fuzzer/corpus/00576.stmt
deleted file mode 100644
index 2f259b79aa..0000000000
--- a/build/fuzzer/corpus/00576.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00577.stmt b/build/fuzzer/corpus/00577.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00577.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00578.stmt b/build/fuzzer/corpus/00578.stmt
deleted file mode 100644
index 41fe723a1a..0000000000
--- a/build/fuzzer/corpus/00578.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"base": {"doc": {"p": true}}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00579.stmt b/build/fuzzer/corpus/00579.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00579.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00580.stmt b/build/fuzzer/corpus/00580.stmt
deleted file mode 100644
index 32f64f4d83..0000000000
--- a/build/fuzzer/corpus/00580.stmt
+++ /dev/null
@@ -1 +0,0 @@
-t
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00581.stmt b/build/fuzzer/corpus/00581.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00581.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00582.stmt b/build/fuzzer/corpus/00582.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00582.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00583.stmt b/build/fuzzer/corpus/00583.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00583.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00584.stmt b/build/fuzzer/corpus/00584.stmt
deleted file mode 100644
index bb79ec2de5..0000000000
--- a/build/fuzzer/corpus/00584.stmt
+++ /dev/null
@@ -1 +0,0 @@
-v
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00585.stmt b/build/fuzzer/corpus/00585.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00585.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00586.stmt b/build/fuzzer/corpus/00586.stmt
deleted file mode 100644
index 203bd68995..0000000000
--- a/build/fuzzer/corpus/00586.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"h": {"k": [1,2,3]}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00587.stmt b/build/fuzzer/corpus/00587.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00587.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00588.stmt b/build/fuzzer/corpus/00588.stmt
deleted file mode 100644
index f3c6c3c68a..0000000000
--- a/build/fuzzer/corpus/00588.stmt
+++ /dev/null
@@ -1 +0,0 @@
-u
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00589.stmt b/build/fuzzer/corpus/00589.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00589.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00590.stmt b/build/fuzzer/corpus/00590.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00590.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00591.stmt b/build/fuzzer/corpus/00591.stmt
deleted file mode 100644
index b097888468..0000000000
--- a/build/fuzzer/corpus/00591.stmt
+++ /dev/null
@@ -1 +0,0 @@
-iterate ground
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00592.stmt b/build/fuzzer/corpus/00592.stmt
deleted file mode 100644
index 7b7b8345fe..0000000000
--- a/build/fuzzer/corpus/00592.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00593.stmt b/build/fuzzer/corpus/00593.stmt
deleted file mode 100644
index 81b2a19cf9..0000000000
--- a/build/fuzzer/corpus/00593.stmt
+++ /dev/null
@@ -1 +0,0 @@
-iterate_ground
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00594.stmt b/build/fuzzer/corpus/00594.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00594.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00595.stmt b/build/fuzzer/corpus/00595.stmt
deleted file mode 100644
index 69e859f8a4..0000000000
--- a/build/fuzzer/corpus/00595.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["p", "r"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00596.stmt b/build/fuzzer/corpus/00596.stmt
deleted file mode 100644
index eb54897e7e..0000000000
--- a/build/fuzzer/corpus/00596.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown.conflicts
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00597.stmt b/build/fuzzer/corpus/00597.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/00597.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00598.stmt b/build/fuzzer/corpus/00598.stmt
deleted file mode 100644
index 398ec2c139..0000000000
--- a/build/fuzzer/corpus/00598.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"k": "foo"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00599.stmt b/build/fuzzer/corpus/00599.stmt
deleted file mode 100644
index 519205e137..0000000000
--- a/build/fuzzer/corpus/00599.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ground ref
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00600.stmt b/build/fuzzer/corpus/00600.stmt
deleted file mode 100644
index ddbda35413..0000000000
--- a/build/fuzzer/corpus/00600.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[h[0][0]] = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00601.stmt b/build/fuzzer/corpus/00601.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00601.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00602.stmt b/build/fuzzer/corpus/00602.stmt
deleted file mode 100644
index 29937b252f..0000000000
--- a/build/fuzzer/corpus/00602.stmt
+++ /dev/null
@@ -1 +0,0 @@
-non-ground ref
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00603.stmt b/build/fuzzer/corpus/00603.stmt
deleted file mode 100644
index f5ab48c4b7..0000000000
--- a/build/fuzzer/corpus/00603.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[h[i][j]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00604.stmt b/build/fuzzer/corpus/00604.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/00604.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00605.stmt b/build/fuzzer/corpus/00605.stmt
deleted file mode 100644
index b508c56069..0000000000
--- a/build/fuzzer/corpus/00605.stmt
+++ /dev/null
@@ -1 +0,0 @@
-two deep
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00606.stmt b/build/fuzzer/corpus/00606.stmt
deleted file mode 100644
index c27c4f6046..0000000000
--- a/build/fuzzer/corpus/00606.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[a[a[i]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00607.stmt b/build/fuzzer/corpus/00607.stmt
deleted file mode 100644
index 8ec0143b7e..0000000000
--- a/build/fuzzer/corpus/00607.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00608.stmt b/build/fuzzer/corpus/00608.stmt
deleted file mode 100644
index b508c56069..0000000000
--- a/build/fuzzer/corpus/00608.stmt
+++ /dev/null
@@ -1 +0,0 @@
-two deep
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00609.stmt b/build/fuzzer/corpus/00609.stmt
deleted file mode 100644
index cd7ac249d2..0000000000
--- a/build/fuzzer/corpus/00609.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[h[i][a[j]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00610.stmt b/build/fuzzer/corpus/00610.stmt
deleted file mode 100644
index 8ec0143b7e..0000000000
--- a/build/fuzzer/corpus/00610.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00611.stmt b/build/fuzzer/corpus/00611.stmt
deleted file mode 100644
index 6e3741fe29..0000000000
--- a/build/fuzzer/corpus/00611.stmt
+++ /dev/null
@@ -1 +0,0 @@
-two deep repeated var
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00612.stmt b/build/fuzzer/corpus/00612.stmt
deleted file mode 100644
index 38d3f7c2ee..0000000000
--- a/build/fuzzer/corpus/00612.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[h[i][a[i]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00613.stmt b/build/fuzzer/corpus/00613.stmt
deleted file mode 100644
index 810c539bc7..0000000000
--- a/build/fuzzer/corpus/00613.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00614.stmt b/build/fuzzer/corpus/00614.stmt
deleted file mode 100644
index 13671d28cf..0000000000
--- a/build/fuzzer/corpus/00614.stmt
+++ /dev/null
@@ -1 +0,0 @@
-no suffix
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00615.stmt b/build/fuzzer/corpus/00615.stmt
deleted file mode 100644
index dddb8c79f0..0000000000
--- a/build/fuzzer/corpus/00615.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 4 = a[three] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00616.stmt b/build/fuzzer/corpus/00616.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00616.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00617.stmt b/build/fuzzer/corpus/00617.stmt
deleted file mode 100644
index 225d765afe..0000000000
--- a/build/fuzzer/corpus/00617.stmt
+++ /dev/null
@@ -1 +0,0 @@
-var ref
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00618.stmt b/build/fuzzer/corpus/00618.stmt
deleted file mode 100644
index 506d6d696c..0000000000
--- a/build/fuzzer/corpus/00618.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { x = [1, 2, 3]; y = a[x[_]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00619.stmt b/build/fuzzer/corpus/00619.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/00619.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00620.stmt b/build/fuzzer/corpus/00620.stmt
deleted file mode 100644
index 66dc9051da..0000000000
--- a/build/fuzzer/corpus/00620.stmt
+++ /dev/null
@@ -1 +0,0 @@
-undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00621.stmt b/build/fuzzer/corpus/00621.stmt
deleted file mode 100644
index 403a75c440..0000000000
--- a/build/fuzzer/corpus/00621.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[three.deadbeef] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00622.stmt b/build/fuzzer/corpus/00622.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00623.stmt b/build/fuzzer/corpus/00623.stmt
deleted file mode 100644
index f07db1e931..0000000000
--- a/build/fuzzer/corpus/00623.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q[_]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00624.stmt b/build/fuzzer/corpus/00624.stmt
deleted file mode 100644
index 7c1d275944..0000000000
--- a/build/fuzzer/corpus/00624.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [2, 3] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00625.stmt b/build/fuzzer/corpus/00625.stmt
deleted file mode 100644
index 8ec0143b7e..0000000000
--- a/build/fuzzer/corpus/00625.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00626.stmt b/build/fuzzer/corpus/00626.stmt
deleted file mode 100644
index b2cac49211..0000000000
--- a/build/fuzzer/corpus/00626.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q[1]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00627.stmt b/build/fuzzer/corpus/00627.stmt
deleted file mode 100644
index 7c1d275944..0000000000
--- a/build/fuzzer/corpus/00627.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [2, 3] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00628.stmt b/build/fuzzer/corpus/00628.stmt
deleted file mode 100644
index ea863053e4..0000000000
--- a/build/fuzzer/corpus/00628.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00629.stmt b/build/fuzzer/corpus/00629.stmt
deleted file mode 100644
index d63f7c072d..0000000000
--- a/build/fuzzer/corpus/00629.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { 2 = a[q] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00630.stmt b/build/fuzzer/corpus/00630.stmt
deleted file mode 100644
index 75d689c855..0000000000
--- a/build/fuzzer/corpus/00630.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = 1 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00631.stmt b/build/fuzzer/corpus/00631.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00631.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00632.stmt b/build/fuzzer/corpus/00632.stmt
deleted file mode 100644
index f07db1e931..0000000000
--- a/build/fuzzer/corpus/00632.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q[_]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00633.stmt b/build/fuzzer/corpus/00633.stmt
deleted file mode 100644
index 429ae51798..0000000000
--- a/build/fuzzer/corpus/00633.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { o = {"a": 2, "b": 3, "c": 100}; o[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00634.stmt b/build/fuzzer/corpus/00634.stmt
deleted file mode 100644
index 8ec0143b7e..0000000000
--- a/build/fuzzer/corpus/00634.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00635.stmt b/build/fuzzer/corpus/00635.stmt
deleted file mode 100644
index e4b64c080b..0000000000
--- a/build/fuzzer/corpus/00635.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q.b] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00636.stmt b/build/fuzzer/corpus/00636.stmt
deleted file mode 100644
index 429ae51798..0000000000
--- a/build/fuzzer/corpus/00636.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { o = {"a": 2, "b": 3, "c": 100}; o[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00637.stmt b/build/fuzzer/corpus/00637.stmt
deleted file mode 100644
index ea863053e4..0000000000
--- a/build/fuzzer/corpus/00637.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00638.stmt b/build/fuzzer/corpus/00638.stmt
deleted file mode 100644
index 9892fcb973..0000000000
--- a/build/fuzzer/corpus/00638.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q[b[_]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00639.stmt b/build/fuzzer/corpus/00639.stmt
deleted file mode 100644
index c1ba738658..0000000000
--- a/build/fuzzer/corpus/00639.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {"hello": 1, "goodbye": 3, "deadbeef": 1000} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00640.stmt b/build/fuzzer/corpus/00640.stmt
deleted file mode 100644
index c466a1b5b9..0000000000
--- a/build/fuzzer/corpus/00640.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00641.stmt b/build/fuzzer/corpus/00641.stmt
deleted file mode 100644
index 9892fcb973..0000000000
--- a/build/fuzzer/corpus/00641.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q[b[_]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00642.stmt b/build/fuzzer/corpus/00642.stmt
deleted file mode 100644
index f71c176b9a..0000000000
--- a/build/fuzzer/corpus/00642.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { o = {"hello": 1, "goodbye": 3, "deadbeef": 1000}; o[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00643.stmt b/build/fuzzer/corpus/00643.stmt
deleted file mode 100644
index c466a1b5b9..0000000000
--- a/build/fuzzer/corpus/00643.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00644.stmt b/build/fuzzer/corpus/00644.stmt
deleted file mode 100644
index cd9f483a20..0000000000
--- a/build/fuzzer/corpus/00644.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = a[q[d.e[_]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00645.stmt b/build/fuzzer/corpus/00645.stmt
deleted file mode 100644
index b0d7a9859a..0000000000
--- a/build/fuzzer/corpus/00645.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { strings[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00646.stmt b/build/fuzzer/corpus/00646.stmt
deleted file mode 100644
index 8ec0143b7e..0000000000
--- a/build/fuzzer/corpus/00646.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00647.stmt b/build/fuzzer/corpus/00647.stmt
deleted file mode 100644
index 7210e295f7..0000000000
--- a/build/fuzzer/corpus/00647.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { x = q[a[_]].v[r[a[_]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00648.stmt b/build/fuzzer/corpus/00648.stmt
deleted file mode 100644
index 7d2133a411..0000000000
--- a/build/fuzzer/corpus/00648.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = [{"v": {}}, {"v": [0, 0, 1, 2]}, {"v": [0, 0, 3, 4]}, {"v": [0, 0]}, {}] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00649.stmt b/build/fuzzer/corpus/00649.stmt
deleted file mode 100644
index 4717d0ddfb..0000000000
--- a/build/fuzzer/corpus/00649.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r = [1, 2, 3, 4] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00650.stmt b/build/fuzzer/corpus/00650.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00650.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00651.stmt b/build/fuzzer/corpus/00651.stmt
deleted file mode 100644
index a98e100ed1..0000000000
--- a/build/fuzzer/corpus/00651.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ground
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00652.stmt b/build/fuzzer/corpus/00652.stmt
deleted file mode 100644
index a21ad44dcc..0000000000
--- a/build/fuzzer/corpus/00652.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { v = [[1, 2], [2, 3], [3, 4]]; x = v[2][1] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00653.stmt b/build/fuzzer/corpus/00653.stmt
deleted file mode 100644
index ea863053e4..0000000000
--- a/build/fuzzer/corpus/00653.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00654.stmt b/build/fuzzer/corpus/00654.stmt
deleted file mode 100644
index d8b7745a90..0000000000
--- a/build/fuzzer/corpus/00654.stmt
+++ /dev/null
@@ -1 +0,0 @@
-non-ground
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00655.stmt b/build/fuzzer/corpus/00655.stmt
deleted file mode 100644
index 1cb0b47a7d..0000000000
--- a/build/fuzzer/corpus/00655.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { v = [[1, 2], [2, 3], [3, 4]]; x = v[i][j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00656.stmt b/build/fuzzer/corpus/00656.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00656.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00657.stmt b/build/fuzzer/corpus/00657.stmt
deleted file mode 100644
index 527e950d5f..0000000000
--- a/build/fuzzer/corpus/00657.stmt
+++ /dev/null
@@ -1 +0,0 @@
-mixed
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00658.stmt b/build/fuzzer/corpus/00658.stmt
deleted file mode 100644
index 53784c0797..0000000000
--- a/build/fuzzer/corpus/00658.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] = y { v = [{"a": 1, "b": 2}, {"c": 3, "z": [4]}]; y = v[i][x][j] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00659.stmt b/build/fuzzer/corpus/00659.stmt
deleted file mode 100644
index 8209c7beb4..0000000000
--- a/build/fuzzer/corpus/00659.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"z": 4}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00660.stmt b/build/fuzzer/corpus/00660.stmt
deleted file mode 100644
index 9b4d9263a1..0000000000
--- a/build/fuzzer/corpus/00660.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref binding
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00661.stmt b/build/fuzzer/corpus/00661.stmt
deleted file mode 100644
index 4af6ca3aab..0000000000
--- a/build/fuzzer/corpus/00661.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { v = c[i][j]; x = v[k]; x = true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00662.stmt b/build/fuzzer/corpus/00662.stmt
deleted file mode 100644
index de601e305f..0000000000
--- a/build/fuzzer/corpus/00662.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00663.stmt b/build/fuzzer/corpus/00663.stmt
deleted file mode 100644
index 3eb00aae8a..0000000000
--- a/build/fuzzer/corpus/00663.stmt
+++ /dev/null
@@ -1 +0,0 @@
-existing ref binding
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00664.stmt b/build/fuzzer/corpus/00664.stmt
deleted file mode 100644
index 8ed5c0e422..0000000000
--- a/build/fuzzer/corpus/00664.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { q = a; q[0] = x; q[0] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00665.stmt b/build/fuzzer/corpus/00665.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00665.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00666.stmt b/build/fuzzer/corpus/00666.stmt
deleted file mode 100644
index 58e75e442d..0000000000
--- a/build/fuzzer/corpus/00666.stmt
+++ /dev/null
@@ -1 +0,0 @@
-embedded
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00667.stmt b/build/fuzzer/corpus/00667.stmt
deleted file mode 100644
index dce538ad2b..0000000000
--- a/build/fuzzer/corpus/00667.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { v = [1, 2, 3]; x = [{"a": v[i]}] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00668.stmt b/build/fuzzer/corpus/00668.stmt
deleted file mode 100644
index ff10e63fc9..0000000000
--- a/build/fuzzer/corpus/00668.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[{"a": 1}], [{"a": 2}], [{"a": 3}]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00669.stmt b/build/fuzzer/corpus/00669.stmt
deleted file mode 100644
index 88b7a1e5f5..0000000000
--- a/build/fuzzer/corpus/00669.stmt
+++ /dev/null
@@ -1 +0,0 @@
-embedded ref binding
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00670.stmt b/build/fuzzer/corpus/00670.stmt
deleted file mode 100644
index 4cb4c09040..0000000000
--- a/build/fuzzer/corpus/00670.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { v = c[i][j]; w = [v[0], v[1]]; x = w[y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00671.stmt b/build/fuzzer/corpus/00671.stmt
deleted file mode 100644
index c176d37716..0000000000
--- a/build/fuzzer/corpus/00671.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[null, false, true, 3.14159]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00672.stmt b/build/fuzzer/corpus/00672.stmt
deleted file mode 100644
index b946f10636..0000000000
--- a/build/fuzzer/corpus/00672.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { i = [1, 2, 3, 4]; j = [1, 2, 999]; j[k] = y; i[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00673.stmt b/build/fuzzer/corpus/00673.stmt
deleted file mode 100644
index 906aa8d974..0000000000
--- a/build/fuzzer/corpus/00673.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00674.stmt b/build/fuzzer/corpus/00674.stmt
deleted file mode 100644
index 2c7e7fe62f..0000000000
--- a/build/fuzzer/corpus/00674.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { i = [1,2,3,4]; x = data.a[_]; i[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00675.stmt b/build/fuzzer/corpus/00675.stmt
deleted file mode 100644
index f26b6970c9..0000000000
--- a/build/fuzzer/corpus/00675.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2, 3, 4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00676.stmt b/build/fuzzer/corpus/00676.stmt
deleted file mode 100644
index 57e9356d3c..0000000000
--- a/build/fuzzer/corpus/00676.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { i = {"a": 1, "b": 2, "c": 3}; j = ["a", "c", "deadbeef"]; j[k] = y; i[y] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00677.stmt b/build/fuzzer/corpus/00677.stmt
deleted file mode 100644
index 988d338ae1..0000000000
--- a/build/fuzzer/corpus/00677.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00678.stmt b/build/fuzzer/corpus/00678.stmt
deleted file mode 100644
index 165114e734..0000000000
--- a/build/fuzzer/corpus/00678.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { i = {"1": 1, "2": 2, "4": 4}; x = data.numbers[_]; i[x] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00679.stmt b/build/fuzzer/corpus/00679.stmt
deleted file mode 100644
index d197cf48c3..0000000000
--- a/build/fuzzer/corpus/00679.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2, 4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00680.stmt b/build/fuzzer/corpus/00680.stmt
deleted file mode 100644
index bb6a65a7cc..0000000000
--- a/build/fuzzer/corpus/00680.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { i = {1, 2, 3, 4}; j = {1, 2, 99}; j[x]; i[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00681.stmt b/build/fuzzer/corpus/00681.stmt
deleted file mode 100644
index 3169929f69..0000000000
--- a/build/fuzzer/corpus/00681.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00682.stmt b/build/fuzzer/corpus/00682.stmt
deleted file mode 100644
index 07c2a1369c..0000000000
--- a/build/fuzzer/corpus/00682.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { i = {1, 2, 3, 4}; x = data.a[_]; i[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00683.stmt b/build/fuzzer/corpus/00683.stmt
deleted file mode 100644
index 98d20c4307..0000000000
--- a/build/fuzzer/corpus/00683.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2, 3, 4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00684.stmt b/build/fuzzer/corpus/00684.stmt
deleted file mode 100644
index 155aac5f84..0000000000
--- a/build/fuzzer/corpus/00684.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { v = {[1, 999], [3, 4]}; pair = [a[2], 4]; v[pair] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00685.stmt b/build/fuzzer/corpus/00685.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00685.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00686.stmt b/build/fuzzer/corpus/00686.stmt
deleted file mode 100644
index 7f33bc03c6..0000000000
--- a/build/fuzzer/corpus/00686.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { x = [{}, {[1, 2], [3, 4]}]; y = [3, 4]; x[i][y] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00687.stmt b/build/fuzzer/corpus/00687.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00687.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00688.stmt b/build/fuzzer/corpus/00688.stmt
deleted file mode 100644
index 3e2eb54f58..0000000000
--- a/build/fuzzer/corpus/00688.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[[i, z, r]] { x = [{}, {[1, 2], [3, 4]}]; y = [3, 4]; x[i][y][z] = r }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00689.stmt b/build/fuzzer/corpus/00689.stmt
deleted file mode 100644
index 9bafc0d404..0000000000
--- a/build/fuzzer/corpus/00689.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,0,3], [1,1,4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00690.stmt b/build/fuzzer/corpus/00690.stmt
deleted file mode 100644
index b8e2d3c401..0000000000
--- a/build/fuzzer/corpus/00690.stmt
+++ /dev/null
@@ -1 +0,0 @@
-avoids indexer
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00691.stmt b/build/fuzzer/corpus/00691.stmt
deleted file mode 100644
index a7808d9b09..0000000000
--- a/build/fuzzer/corpus/00691.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { somevar = [1, 2, 3]; somevar[i] = 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00692.stmt b/build/fuzzer/corpus/00692.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00692.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00693.stmt b/build/fuzzer/corpus/00693.stmt
deleted file mode 100644
index 1bb801d8c6..0000000000
--- a/build/fuzzer/corpus/00693.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00694.stmt b/build/fuzzer/corpus/00694.stmt
deleted file mode 100644
index c05cfcecf7..0000000000
--- a/build/fuzzer/corpus/00694.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[[1, 2]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00695.stmt b/build/fuzzer/corpus/00695.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00695.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00696.stmt b/build/fuzzer/corpus/00696.stmt
deleted file mode 100644
index efac25111f..0000000000
--- a/build/fuzzer/corpus/00696.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00697.stmt b/build/fuzzer/corpus/00697.stmt
deleted file mode 100644
index a1c10ef881..0000000000
--- a/build/fuzzer/corpus/00697.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[{"foo": "bar"}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00698.stmt b/build/fuzzer/corpus/00698.stmt
deleted file mode 100644
index 18d7acf586..0000000000
--- a/build/fuzzer/corpus/00698.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"foo": "bar"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00699.stmt b/build/fuzzer/corpus/00699.stmt
deleted file mode 100644
index c2c88d097d..0000000000
--- a/build/fuzzer/corpus/00699.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00700.stmt b/build/fuzzer/corpus/00700.stmt
deleted file mode 100644
index 1f0a8d74f0..0000000000
--- a/build/fuzzer/corpus/00700.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[{1, 2}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00701.stmt b/build/fuzzer/corpus/00701.stmt
deleted file mode 100644
index fd8ef09578..0000000000
--- a/build/fuzzer/corpus/00701.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00702.stmt b/build/fuzzer/corpus/00702.stmt
deleted file mode 100644
index 980163d3e0..0000000000
--- a/build/fuzzer/corpus/00702.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unify array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00703.stmt b/build/fuzzer/corpus/00703.stmt
deleted file mode 100644
index 65e779042c..0000000000
--- a/build/fuzzer/corpus/00703.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x | fixture.r[[1, x]]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00704.stmt b/build/fuzzer/corpus/00704.stmt
deleted file mode 100644
index bd182a85c8..0000000000
--- a/build/fuzzer/corpus/00704.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2, 3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00705.stmt b/build/fuzzer/corpus/00705.stmt
deleted file mode 100644
index 2eb14158cf..0000000000
--- a/build/fuzzer/corpus/00705.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unify object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00706.stmt b/build/fuzzer/corpus/00706.stmt
deleted file mode 100644
index ac9de8ebf0..0000000000
--- a/build/fuzzer/corpus/00706.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x | fixture.r[{"foo": x}]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00707.stmt b/build/fuzzer/corpus/00707.stmt
deleted file mode 100644
index 678abc1980..0000000000
--- a/build/fuzzer/corpus/00707.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["bar"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00708.stmt b/build/fuzzer/corpus/00708.stmt
deleted file mode 100644
index e7001338da..0000000000
--- a/build/fuzzer/corpus/00708.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unify partial ground array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00709.stmt b/build/fuzzer/corpus/00709.stmt
deleted file mode 100644
index 89902c1612..0000000000
--- a/build/fuzzer/corpus/00709.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x | fixture.p1[[x,2]]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00710.stmt b/build/fuzzer/corpus/00710.stmt
deleted file mode 100644
index 3169929f69..0000000000
--- a/build/fuzzer/corpus/00710.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00711.stmt b/build/fuzzer/corpus/00711.stmt
deleted file mode 100644
index 6dc3037b6a..0000000000
--- a/build/fuzzer/corpus/00711.stmt
+++ /dev/null
@@ -1 +0,0 @@
-complete doc unify
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00712.stmt b/build/fuzzer/corpus/00712.stmt
deleted file mode 100644
index ac7bfbb3cf..0000000000
--- a/build/fuzzer/corpus/00712.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [[x,y] | fixture.s[[x, y]]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00713.stmt b/build/fuzzer/corpus/00713.stmt
deleted file mode 100644
index 5c7ca9710e..0000000000
--- a/build/fuzzer/corpus/00713.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1, 2], [1, 3], [2, 7], [[1,1], 4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00714.stmt b/build/fuzzer/corpus/00714.stmt
deleted file mode 100644
index 136f39a7bc..0000000000
--- a/build/fuzzer/corpus/00714.stmt
+++ /dev/null
@@ -1 +0,0 @@
-partial doc unify
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00715.stmt b/build/fuzzer/corpus/00715.stmt
deleted file mode 100644
index 6ee8f72adc..0000000000
--- a/build/fuzzer/corpus/00715.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [[x,y] | fixture.r[[x, y]]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00716.stmt b/build/fuzzer/corpus/00716.stmt
deleted file mode 100644
index 5c7ca9710e..0000000000
--- a/build/fuzzer/corpus/00716.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1, 2], [1, 3], [2, 7], [[1,1], 4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00717.stmt b/build/fuzzer/corpus/00717.stmt
deleted file mode 100644
index c6181124fe..0000000000
--- a/build/fuzzer/corpus/00717.stmt
+++ /dev/null
@@ -1 +0,0 @@
-empty set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00718.stmt b/build/fuzzer/corpus/00718.stmt
deleted file mode 100644
index b8bd075055..0000000000
--- a/build/fuzzer/corpus/00718.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p { fixture.empty[set()]} 
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00719.stmt b/build/fuzzer/corpus/00719.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00719.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00720.stmt b/build/fuzzer/corpus/00720.stmt
deleted file mode 100644
index 65139e3cef..0000000000
--- a/build/fuzzer/corpus/00720.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00721.stmt b/build/fuzzer/corpus/00721.stmt
deleted file mode 100644
index 10551fcc65..0000000000
--- a/build/fuzzer/corpus/00721.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[[fixture.foo.bar, 3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00722.stmt b/build/fuzzer/corpus/00722.stmt
deleted file mode 100644
index 96aa67e916..0000000000
--- a/build/fuzzer/corpus/00722.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00723.stmt b/build/fuzzer/corpus/00723.stmt
deleted file mode 100644
index f3b1c2e601..0000000000
--- a/build/fuzzer/corpus/00723.stmt
+++ /dev/null
@@ -1 +0,0 @@
-nested ref
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00724.stmt b/build/fuzzer/corpus/00724.stmt
deleted file mode 100644
index 53dc149b7e..0000000000
--- a/build/fuzzer/corpus/00724.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[[fixture.foo[fixture.o.foo], 3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00725.stmt b/build/fuzzer/corpus/00725.stmt
deleted file mode 100644
index 96aa67e916..0000000000
--- a/build/fuzzer/corpus/00725.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00726.stmt b/build/fuzzer/corpus/00726.stmt
deleted file mode 100644
index 5c692825df..0000000000
--- a/build/fuzzer/corpus/00726.stmt
+++ /dev/null
@@ -1 +0,0 @@
-comprehension
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00727.stmt b/build/fuzzer/corpus/00727.stmt
deleted file mode 100644
index f7f1aac2cc..0000000000
--- a/build/fuzzer/corpus/00727.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.s[[[x | x = y[_]; y = [1, 1]], 4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00728.stmt b/build/fuzzer/corpus/00728.stmt
deleted file mode 100644
index 43600d7714..0000000000
--- a/build/fuzzer/corpus/00728.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,1],4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00729.stmt b/build/fuzzer/corpus/00729.stmt
deleted file mode 100644
index 5c19add851..0000000000
--- a/build/fuzzer/corpus/00729.stmt
+++ /dev/null
@@ -1 +0,0 @@
-missing array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00730.stmt b/build/fuzzer/corpus/00730.stmt
deleted file mode 100644
index 1474476cec..0000000000
--- a/build/fuzzer/corpus/00730.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[[1, 4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00731.stmt b/build/fuzzer/corpus/00731.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00732.stmt b/build/fuzzer/corpus/00732.stmt
deleted file mode 100644
index d4b641421e..0000000000
--- a/build/fuzzer/corpus/00732.stmt
+++ /dev/null
@@ -1 +0,0 @@
-missing object value
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00733.stmt b/build/fuzzer/corpus/00733.stmt
deleted file mode 100644
index bd1ec1c155..0000000000
--- a/build/fuzzer/corpus/00733.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[{"foo": "baz"}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00734.stmt b/build/fuzzer/corpus/00734.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00735.stmt b/build/fuzzer/corpus/00735.stmt
deleted file mode 100644
index 4168248737..0000000000
--- a/build/fuzzer/corpus/00735.stmt
+++ /dev/null
@@ -1 +0,0 @@
-missing set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00736.stmt b/build/fuzzer/corpus/00736.stmt
deleted file mode 100644
index 767d3cc9f5..0000000000
--- a/build/fuzzer/corpus/00736.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = fixture.r[{1, 3}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00737.stmt b/build/fuzzer/corpus/00737.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00738.stmt b/build/fuzzer/corpus/00738.stmt
deleted file mode 100644
index 66aeb4e15f..0000000000
--- a/build/fuzzer/corpus/00738.stmt
+++ /dev/null
@@ -1,12 +0,0 @@
-package fixture
-		empty = {set()}
-		s = {[1, 2], [1, 3], {"foo": "bar"}, {1, 2}, [2, 7], [[1,1], 4]}
-		r[x] { s[x] }
-		a = [1, 2]
-		o = {"foo": "bar"}
-		foo = {"bar": 1}
-
-		p1[[1,2]]
-		p1[[1,3]]
-		p1[[2,2]]
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00739.stmt b/build/fuzzer/corpus/00739.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/00739.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00740.stmt b/build/fuzzer/corpus/00740.stmt
deleted file mode 100644
index 4f6c4ee9d9..0000000000
--- a/build/fuzzer/corpus/00740.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00741.stmt b/build/fuzzer/corpus/00741.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00742.stmt b/build/fuzzer/corpus/00742.stmt
deleted file mode 100644
index 40a6c2234e..0000000000
--- a/build/fuzzer/corpus/00742.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00743.stmt b/build/fuzzer/corpus/00743.stmt
deleted file mode 100644
index b9dd8e25c8..0000000000
--- a/build/fuzzer/corpus/00743.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { b[j] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00744.stmt b/build/fuzzer/corpus/00744.stmt
deleted file mode 100644
index ce550c6c6c..0000000000
--- a/build/fuzzer/corpus/00744.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4,"hello","goodbye"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00745.stmt b/build/fuzzer/corpus/00745.stmt
deleted file mode 100644
index 13c9de5e23..0000000000
--- a/build/fuzzer/corpus/00745.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[100] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00746.stmt b/build/fuzzer/corpus/00746.stmt
deleted file mode 100644
index 101f48721f..0000000000
--- a/build/fuzzer/corpus/00746.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { a[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00747.stmt b/build/fuzzer/corpus/00747.stmt
deleted file mode 100644
index ae2a69e8ae..0000000000
--- a/build/fuzzer/corpus/00747.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0,1,2,3,100]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00748.stmt b/build/fuzzer/corpus/00748.stmt
deleted file mode 100644
index d537e96693..0000000000
--- a/build/fuzzer/corpus/00748.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[k] = v { b[v] = k }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00749.stmt b/build/fuzzer/corpus/00749.stmt
deleted file mode 100644
index 2eda498faf..0000000000
--- a/build/fuzzer/corpus/00749.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[k] = v { a[i] = v; g[k][j] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00750.stmt b/build/fuzzer/corpus/00750.stmt
deleted file mode 100644
index 5301ff0f3e..0000000000
--- a/build/fuzzer/corpus/00750.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"b": 2, "c": 4, "hello": "v1", "goodbye": "v2", "a": 1}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00751.stmt b/build/fuzzer/corpus/00751.stmt
deleted file mode 100644
index 83694f8b75..0000000000
--- a/build/fuzzer/corpus/00751.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p["a"] = 1 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00752.stmt b/build/fuzzer/corpus/00752.stmt
deleted file mode 100644
index 6afd263b58..0000000000
--- a/build/fuzzer/corpus/00752.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p["b"] = 2 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00753.stmt b/build/fuzzer/corpus/00753.stmt
deleted file mode 100644
index ecd219f72d..0000000000
--- a/build/fuzzer/corpus/00753.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"a": 1, "b": 2}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00754.stmt b/build/fuzzer/corpus/00754.stmt
deleted file mode 100644
index 74769cefe3..0000000000
--- a/build/fuzzer/corpus/00754.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00755.stmt b/build/fuzzer/corpus/00755.stmt
deleted file mode 100644
index 94eefaeb8f..0000000000
--- a/build/fuzzer/corpus/00755.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00756.stmt b/build/fuzzer/corpus/00756.stmt
deleted file mode 100644
index 034be9c7c4..0000000000
--- a/build/fuzzer/corpus/00756.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[y] { b[j] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00757.stmt b/build/fuzzer/corpus/00757.stmt
deleted file mode 100644
index ce550c6c6c..0000000000
--- a/build/fuzzer/corpus/00757.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4,"hello","goodbye"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00758.stmt b/build/fuzzer/corpus/00758.stmt
deleted file mode 100644
index 5a8b31bfa7..0000000000
--- a/build/fuzzer/corpus/00758.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q = s; s[x] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00759.stmt b/build/fuzzer/corpus/00759.stmt
deleted file mode 100644
index a049882752..0000000000
--- a/build/fuzzer/corpus/00759.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { a[_] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00760.stmt b/build/fuzzer/corpus/00760.stmt
deleted file mode 100644
index bd0edf57cd..0000000000
--- a/build/fuzzer/corpus/00760.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[y] { b[_] = y }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00761.stmt b/build/fuzzer/corpus/00761.stmt
deleted file mode 100644
index ce550c6c6c..0000000000
--- a/build/fuzzer/corpus/00761.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4,"hello","goodbye"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00762.stmt b/build/fuzzer/corpus/00762.stmt
deleted file mode 100644
index e0be44b3d3..0000000000
--- a/build/fuzzer/corpus/00762.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[k] = v { q[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00763.stmt b/build/fuzzer/corpus/00763.stmt
deleted file mode 100644
index 36a8c2b47e..0000000000
--- a/build/fuzzer/corpus/00763.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { b[v] = k }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00764.stmt b/build/fuzzer/corpus/00764.stmt
deleted file mode 100644
index 467145bad1..0000000000
--- a/build/fuzzer/corpus/00764.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { a[i] = v; g[k][j] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00765.stmt b/build/fuzzer/corpus/00765.stmt
deleted file mode 100644
index 5301ff0f3e..0000000000
--- a/build/fuzzer/corpus/00765.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"b": 2, "c": 4, "hello": "v1", "goodbye": "v2", "a": 1}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00766.stmt b/build/fuzzer/corpus/00766.stmt
deleted file mode 100644
index e0be44b3d3..0000000000
--- a/build/fuzzer/corpus/00766.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[k] = v { q[k] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00767.stmt b/build/fuzzer/corpus/00767.stmt
deleted file mode 100644
index b1c32d13b8..0000000000
--- a/build/fuzzer/corpus/00767.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q["a"] = 1 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00768.stmt b/build/fuzzer/corpus/00768.stmt
deleted file mode 100644
index ab4c7c6409..0000000000
--- a/build/fuzzer/corpus/00768.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q["b"] = 2 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00769.stmt b/build/fuzzer/corpus/00769.stmt
deleted file mode 100644
index ecd219f72d..0000000000
--- a/build/fuzzer/corpus/00769.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"a": 1, "b": 2}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00770.stmt b/build/fuzzer/corpus/00770.stmt
deleted file mode 100644
index 58cbd3f40b..0000000000
--- a/build/fuzzer/corpus/00770.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00771.stmt b/build/fuzzer/corpus/00771.stmt
deleted file mode 100644
index 58cbd3f40b..0000000000
--- a/build/fuzzer/corpus/00771.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00772.stmt b/build/fuzzer/corpus/00772.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00773.stmt b/build/fuzzer/corpus/00773.stmt
deleted file mode 100644
index 050cf626a7..0000000000
--- a/build/fuzzer/corpus/00773.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00774.stmt b/build/fuzzer/corpus/00774.stmt
deleted file mode 100644
index 6089dd3d04..0000000000
--- a/build/fuzzer/corpus/00774.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = false { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00775.stmt b/build/fuzzer/corpus/00775.stmt
deleted file mode 100644
index ba9a7d0b71..0000000000
--- a/build/fuzzer/corpus/00775.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = false { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00776.stmt b/build/fuzzer/corpus/00776.stmt
deleted file mode 100644
index 050cf626a7..0000000000
--- a/build/fuzzer/corpus/00776.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00777.stmt b/build/fuzzer/corpus/00777.stmt
deleted file mode 100644
index 050cf626a7..0000000000
--- a/build/fuzzer/corpus/00777.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00778.stmt b/build/fuzzer/corpus/00778.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00778.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00779.stmt b/build/fuzzer/corpus/00779.stmt
deleted file mode 100644
index 050cf626a7..0000000000
--- a/build/fuzzer/corpus/00779.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00780.stmt b/build/fuzzer/corpus/00780.stmt
deleted file mode 100644
index 6089dd3d04..0000000000
--- a/build/fuzzer/corpus/00780.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = false { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00781.stmt b/build/fuzzer/corpus/00781.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00781.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00782.stmt b/build/fuzzer/corpus/00782.stmt
deleted file mode 100644
index f4bee89590..0000000000
--- a/build/fuzzer/corpus/00782.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00783.stmt b/build/fuzzer/corpus/00783.stmt
deleted file mode 100644
index 8f03fd3f57..0000000000
--- a/build/fuzzer/corpus/00783.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00784.stmt b/build/fuzzer/corpus/00784.stmt
deleted file mode 100644
index beeda404b7..0000000000
--- a/build/fuzzer/corpus/00784.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = false { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00785.stmt b/build/fuzzer/corpus/00785.stmt
deleted file mode 100644
index f4bee89590..0000000000
--- a/build/fuzzer/corpus/00785.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { q }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00786.stmt b/build/fuzzer/corpus/00786.stmt
deleted file mode 100644
index 8f03fd3f57..0000000000
--- a/build/fuzzer/corpus/00786.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00787.stmt b/build/fuzzer/corpus/00787.stmt
deleted file mode 100644
index 8f03fd3f57..0000000000
--- a/build/fuzzer/corpus/00787.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = true { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00788.stmt b/build/fuzzer/corpus/00788.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00788.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00789.stmt b/build/fuzzer/corpus/00789.stmt
deleted file mode 100644
index 2e0be94e4f..0000000000
--- a/build/fuzzer/corpus/00789.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not true = false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00790.stmt b/build/fuzzer/corpus/00790.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00790.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00791.stmt b/build/fuzzer/corpus/00791.stmt
deleted file mode 100644
index 7edfe73bc2..0000000000
--- a/build/fuzzer/corpus/00791.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not true = true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00792.stmt b/build/fuzzer/corpus/00792.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00793.stmt b/build/fuzzer/corpus/00793.stmt
deleted file mode 100644
index f0a96db335..0000000000
--- a/build/fuzzer/corpus/00793.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not q.v0 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00794.stmt b/build/fuzzer/corpus/00794.stmt
deleted file mode 100644
index 1f1c098652..0000000000
--- a/build/fuzzer/corpus/00794.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { b[x] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00795.stmt b/build/fuzzer/corpus/00795.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00795.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00796.stmt b/build/fuzzer/corpus/00796.stmt
deleted file mode 100644
index 0f8d251d77..0000000000
--- a/build/fuzzer/corpus/00796.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not q.v2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00797.stmt b/build/fuzzer/corpus/00797.stmt
deleted file mode 100644
index 1f1c098652..0000000000
--- a/build/fuzzer/corpus/00797.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[x] { b[x] = v }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00798.stmt b/build/fuzzer/corpus/00798.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00799.stmt b/build/fuzzer/corpus/00799.stmt
deleted file mode 100644
index 678a247eab..0000000000
--- a/build/fuzzer/corpus/00799.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array simple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00800.stmt b/build/fuzzer/corpus/00800.stmt
deleted file mode 100644
index 5a642f8d0a..0000000000
--- a/build/fuzzer/corpus/00800.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = [x | x = a[_]]; xs[i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00801.stmt b/build/fuzzer/corpus/00801.stmt
deleted file mode 100644
index 3a26a2e5e9..0000000000
--- a/build/fuzzer/corpus/00801.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00802.stmt b/build/fuzzer/corpus/00802.stmt
deleted file mode 100644
index 1b50fae5e8..0000000000
--- a/build/fuzzer/corpus/00802.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array nested
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00803.stmt b/build/fuzzer/corpus/00803.stmt
deleted file mode 100644
index 0ae8749fdc..0000000000
--- a/build/fuzzer/corpus/00803.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { ys = [y | y = x[_]; x = [z | z = a[_]]]; ys[i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00804.stmt b/build/fuzzer/corpus/00804.stmt
deleted file mode 100644
index 3a26a2e5e9..0000000000
--- a/build/fuzzer/corpus/00804.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00805.stmt b/build/fuzzer/corpus/00805.stmt
deleted file mode 100644
index f1545ba605..0000000000
--- a/build/fuzzer/corpus/00805.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array embedded array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00806.stmt b/build/fuzzer/corpus/00806.stmt
deleted file mode 100644
index 48bf3bb7e3..0000000000
--- a/build/fuzzer/corpus/00806.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = [[x | x = a[_]]]; xs[0][i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00807.stmt b/build/fuzzer/corpus/00807.stmt
deleted file mode 100644
index 3a26a2e5e9..0000000000
--- a/build/fuzzer/corpus/00807.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00808.stmt b/build/fuzzer/corpus/00808.stmt
deleted file mode 100644
index 66fa131a31..0000000000
--- a/build/fuzzer/corpus/00808.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array embedded object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00809.stmt b/build/fuzzer/corpus/00809.stmt
deleted file mode 100644
index 61ba5b34fa..0000000000
--- a/build/fuzzer/corpus/00809.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = {"a": [x | x = a[_]]}; xs.a[i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00810.stmt b/build/fuzzer/corpus/00810.stmt
deleted file mode 100644
index 3a26a2e5e9..0000000000
--- a/build/fuzzer/corpus/00810.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00811.stmt b/build/fuzzer/corpus/00811.stmt
deleted file mode 100644
index d8adae1e04..0000000000
--- a/build/fuzzer/corpus/00811.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array embedded set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00812.stmt b/build/fuzzer/corpus/00812.stmt
deleted file mode 100644
index c25c8d685a..0000000000
--- a/build/fuzzer/corpus/00812.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = xs { xs = {[x | x = a[_]]} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00813.stmt b/build/fuzzer/corpus/00813.stmt
deleted file mode 100644
index 9679990da7..0000000000
--- a/build/fuzzer/corpus/00813.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,2,3,4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00814.stmt b/build/fuzzer/corpus/00814.stmt
deleted file mode 100644
index 622ad9d27f..0000000000
--- a/build/fuzzer/corpus/00814.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array closure
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00815.stmt b/build/fuzzer/corpus/00815.stmt
deleted file mode 100644
index f8b04d17ee..0000000000
--- a/build/fuzzer/corpus/00815.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { y = 1; x = [y | y = 1] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00816.stmt b/build/fuzzer/corpus/00816.stmt
deleted file mode 100644
index 89d00ba206..0000000000
--- a/build/fuzzer/corpus/00816.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00817.stmt b/build/fuzzer/corpus/00817.stmt
deleted file mode 100644
index 7abe9458f5..0000000000
--- a/build/fuzzer/corpus/00817.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array dereference embedded
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00818.stmt b/build/fuzzer/corpus/00818.stmt
deleted file mode 100644
index 9f411792fe..0000000000
--- a/build/fuzzer/corpus/00818.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q.a[2][i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00819.stmt b/build/fuzzer/corpus/00819.stmt
deleted file mode 100644
index 8dd5ae9c25..0000000000
--- a/build/fuzzer/corpus/00819.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { k = "a"; v = [y | i[_] = _; i = y; i = [z | z = a[_]]] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00820.stmt b/build/fuzzer/corpus/00820.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00820.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00821.stmt b/build/fuzzer/corpus/00821.stmt
deleted file mode 100644
index a798e4d596..0000000000
--- a/build/fuzzer/corpus/00821.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object simple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00822.stmt b/build/fuzzer/corpus/00822.stmt
deleted file mode 100644
index 935c493fbb..0000000000
--- a/build/fuzzer/corpus/00822.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = {s: x | x = a[_]; format_int(x, 10, s)}; y = xs[i]; y > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00823.stmt b/build/fuzzer/corpus/00823.stmt
deleted file mode 100644
index 8c3c8d70d8..0000000000
--- a/build/fuzzer/corpus/00823.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["2","3","4"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00824.stmt b/build/fuzzer/corpus/00824.stmt
deleted file mode 100644
index 51386d2e04..0000000000
--- a/build/fuzzer/corpus/00824.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object nested
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00825.stmt b/build/fuzzer/corpus/00825.stmt
deleted file mode 100644
index 7ef3a52090..0000000000
--- a/build/fuzzer/corpus/00825.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = r { r = {x: y | z = {i: q | i = b[q]}; x = z[y]}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00826.stmt b/build/fuzzer/corpus/00826.stmt
deleted file mode 100644
index fba530d23b..0000000000
--- a/build/fuzzer/corpus/00826.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"v1": "hello", "v2": "goodbye"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00827.stmt b/build/fuzzer/corpus/00827.stmt
deleted file mode 100644
index adc9bde509..0000000000
--- a/build/fuzzer/corpus/00827.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object embedded array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00828.stmt b/build/fuzzer/corpus/00828.stmt
deleted file mode 100644
index a7c0d8dea7..0000000000
--- a/build/fuzzer/corpus/00828.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = [{s: x | x = a[_]; format_int(x, 10, s)}]; xs[0][i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00829.stmt b/build/fuzzer/corpus/00829.stmt
deleted file mode 100644
index 8c3c8d70d8..0000000000
--- a/build/fuzzer/corpus/00829.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["2","3","4"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00830.stmt b/build/fuzzer/corpus/00830.stmt
deleted file mode 100644
index dcc37363c7..0000000000
--- a/build/fuzzer/corpus/00830.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object embedded object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00831.stmt b/build/fuzzer/corpus/00831.stmt
deleted file mode 100644
index 831b98f6b5..0000000000
--- a/build/fuzzer/corpus/00831.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = {"a": {s: x | x = a[_]; format_int(x, 10, s)}}; xs.a[i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00832.stmt b/build/fuzzer/corpus/00832.stmt
deleted file mode 100644
index 8c3c8d70d8..0000000000
--- a/build/fuzzer/corpus/00832.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["2","3","4"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00833.stmt b/build/fuzzer/corpus/00833.stmt
deleted file mode 100644
index 2c8a88ce51..0000000000
--- a/build/fuzzer/corpus/00833.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object embedded set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00834.stmt b/build/fuzzer/corpus/00834.stmt
deleted file mode 100644
index fd7102865c..0000000000
--- a/build/fuzzer/corpus/00834.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = xs { xs = {{s: x | x = a[_]; format_int(x, 10, s)}} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00835.stmt b/build/fuzzer/corpus/00835.stmt
deleted file mode 100644
index ba20fa7e67..0000000000
--- a/build/fuzzer/corpus/00835.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"1":1,"2":2,"3":3,"4":4}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00836.stmt b/build/fuzzer/corpus/00836.stmt
deleted file mode 100644
index e078d3dd59..0000000000
--- a/build/fuzzer/corpus/00836.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object closure
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00837.stmt b/build/fuzzer/corpus/00837.stmt
deleted file mode 100644
index 450b929435..0000000000
--- a/build/fuzzer/corpus/00837.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { y = 1; x = {"foo":y | y = 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00838.stmt b/build/fuzzer/corpus/00838.stmt
deleted file mode 100644
index b2f4557796..0000000000
--- a/build/fuzzer/corpus/00838.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"foo": 1}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00839.stmt b/build/fuzzer/corpus/00839.stmt
deleted file mode 100644
index f258c56383..0000000000
--- a/build/fuzzer/corpus/00839.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object dereference embedded
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00840.stmt b/build/fuzzer/corpus/00840.stmt
deleted file mode 100644
index e595f3ab3e..0000000000
--- a/build/fuzzer/corpus/00840.stmt
+++ /dev/null
@@ -1 +0,0 @@
-a = [4] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00841.stmt b/build/fuzzer/corpus/00841.stmt
deleted file mode 100644
index 320f61dc6a..0000000000
--- a/build/fuzzer/corpus/00841.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q.a = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00842.stmt b/build/fuzzer/corpus/00842.stmt
deleted file mode 100644
index a1890717a6..0000000000
--- a/build/fuzzer/corpus/00842.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { k = "a"; v = {"bar": y | i[_] = _; i = y; i = {"foo": z | z = a[_]}} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00843.stmt b/build/fuzzer/corpus/00843.stmt
deleted file mode 100644
index b74fb0d436..0000000000
--- a/build/fuzzer/corpus/00843.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"bar": {"foo": 4}}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00844.stmt b/build/fuzzer/corpus/00844.stmt
deleted file mode 100644
index c1522484de..0000000000
--- a/build/fuzzer/corpus/00844.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object conflict
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00845.stmt b/build/fuzzer/corpus/00845.stmt
deleted file mode 100644
index 320f61dc6a..0000000000
--- a/build/fuzzer/corpus/00845.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q.a = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00846.stmt b/build/fuzzer/corpus/00846.stmt
deleted file mode 100644
index a1890717a6..0000000000
--- a/build/fuzzer/corpus/00846.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { k = "a"; v = {"bar": y | i[_] = _; i = y; i = {"foo": z | z = a[_]}} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00847.stmt b/build/fuzzer/corpus/00847.stmt
deleted file mode 100644
index 50af315807..0000000000
--- a/build/fuzzer/corpus/00847.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set simple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00848.stmt b/build/fuzzer/corpus/00848.stmt
deleted file mode 100644
index d6519e6b7d..0000000000
--- a/build/fuzzer/corpus/00848.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = y {y = {x | x = a[_]; x > 1}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00849.stmt b/build/fuzzer/corpus/00849.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/00849.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00850.stmt b/build/fuzzer/corpus/00850.stmt
deleted file mode 100644
index 2e52eb671c..0000000000
--- a/build/fuzzer/corpus/00850.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set nested
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00851.stmt b/build/fuzzer/corpus/00851.stmt
deleted file mode 100644
index 8fe5aa3851..0000000000
--- a/build/fuzzer/corpus/00851.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { ys = {y | y = x[_]; x = {z | z = a[_]}}; ys[i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00852.stmt b/build/fuzzer/corpus/00852.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/00852.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00853.stmt b/build/fuzzer/corpus/00853.stmt
deleted file mode 100644
index 6f36b118ea..0000000000
--- a/build/fuzzer/corpus/00853.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set embedded array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00854.stmt b/build/fuzzer/corpus/00854.stmt
deleted file mode 100644
index 5d1c449a8c..0000000000
--- a/build/fuzzer/corpus/00854.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = [{x | x = a[_]}]; xs[0][i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00855.stmt b/build/fuzzer/corpus/00855.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/00855.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00856.stmt b/build/fuzzer/corpus/00856.stmt
deleted file mode 100644
index 8353f3b0fd..0000000000
--- a/build/fuzzer/corpus/00856.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set embedded object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00857.stmt b/build/fuzzer/corpus/00857.stmt
deleted file mode 100644
index 8386b9d872..0000000000
--- a/build/fuzzer/corpus/00857.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[i] { xs = {"a": {x | x = a[_]}}; xs.a[i] > 1 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00858.stmt b/build/fuzzer/corpus/00858.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/00858.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00859.stmt b/build/fuzzer/corpus/00859.stmt
deleted file mode 100644
index 8b9f68fa99..0000000000
--- a/build/fuzzer/corpus/00859.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set embedded set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00860.stmt b/build/fuzzer/corpus/00860.stmt
deleted file mode 100644
index ec2ca0af03..0000000000
--- a/build/fuzzer/corpus/00860.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = xs { xs = {{x | x = a[_]}} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00861.stmt b/build/fuzzer/corpus/00861.stmt
deleted file mode 100644
index 9679990da7..0000000000
--- a/build/fuzzer/corpus/00861.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1,2,3,4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00862.stmt b/build/fuzzer/corpus/00862.stmt
deleted file mode 100644
index dd6ec161a6..0000000000
--- a/build/fuzzer/corpus/00862.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set closure
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00863.stmt b/build/fuzzer/corpus/00863.stmt
deleted file mode 100644
index 830dc01fc8..0000000000
--- a/build/fuzzer/corpus/00863.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { y = 1; x = {y | y = 1} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00864.stmt b/build/fuzzer/corpus/00864.stmt
deleted file mode 100644
index 89d00ba206..0000000000
--- a/build/fuzzer/corpus/00864.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[1]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00865.stmt b/build/fuzzer/corpus/00865.stmt
deleted file mode 100644
index 572c4ccaaf..0000000000
--- a/build/fuzzer/corpus/00865.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set dereference embedded
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00866.stmt b/build/fuzzer/corpus/00866.stmt
deleted file mode 100644
index 320f61dc6a..0000000000
--- a/build/fuzzer/corpus/00866.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { q.a = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00867.stmt b/build/fuzzer/corpus/00867.stmt
deleted file mode 100644
index 262adbd6e9..0000000000
--- a/build/fuzzer/corpus/00867.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q[k] = v { k = "a"; v = {y | i[_] = _; i = y; i = {z | z = a[_]}} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00868.stmt b/build/fuzzer/corpus/00868.stmt
deleted file mode 100644
index 02023c3300..0000000000
--- a/build/fuzzer/corpus/00868.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[[1,2,3,4]]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00869.stmt b/build/fuzzer/corpus/00869.stmt
deleted file mode 100644
index 66dc9051da..0000000000
--- a/build/fuzzer/corpus/00869.stmt
+++ /dev/null
@@ -1 +0,0 @@
-undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00870.stmt b/build/fuzzer/corpus/00870.stmt
deleted file mode 100644
index 919396dd44..0000000000
--- a/build/fuzzer/corpus/00870.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 1 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00871.stmt b/build/fuzzer/corpus/00871.stmt
deleted file mode 100644
index 7f494615b9..0000000000
--- a/build/fuzzer/corpus/00871.stmt
+++ /dev/null
@@ -1 +0,0 @@
-default p = 0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00872.stmt b/build/fuzzer/corpus/00872.stmt
deleted file mode 100644
index 9fb6cbd7b3..0000000000
--- a/build/fuzzer/corpus/00872.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 2 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00873.stmt b/build/fuzzer/corpus/00873.stmt
deleted file mode 100644
index c227083464..0000000000
--- a/build/fuzzer/corpus/00873.stmt
+++ /dev/null
@@ -1 +0,0 @@
-0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00874.stmt b/build/fuzzer/corpus/00874.stmt
deleted file mode 100644
index 056329e1e8..0000000000
--- a/build/fuzzer/corpus/00874.stmt
+++ /dev/null
@@ -1 +0,0 @@
-defined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00875.stmt b/build/fuzzer/corpus/00875.stmt
deleted file mode 100644
index 7f494615b9..0000000000
--- a/build/fuzzer/corpus/00875.stmt
+++ /dev/null
@@ -1 +0,0 @@
-default p = 0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00876.stmt b/build/fuzzer/corpus/00876.stmt
deleted file mode 100644
index 962543901e..0000000000
--- a/build/fuzzer/corpus/00876.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 1 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00877.stmt b/build/fuzzer/corpus/00877.stmt
deleted file mode 100644
index 9fb6cbd7b3..0000000000
--- a/build/fuzzer/corpus/00877.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 2 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00878.stmt b/build/fuzzer/corpus/00878.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00878.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00879.stmt b/build/fuzzer/corpus/00879.stmt
deleted file mode 100644
index b10485d2fa..0000000000
--- a/build/fuzzer/corpus/00879.stmt
+++ /dev/null
@@ -1 +0,0 @@
-defined-ooo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00880.stmt b/build/fuzzer/corpus/00880.stmt
deleted file mode 100644
index 962543901e..0000000000
--- a/build/fuzzer/corpus/00880.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 1 { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00881.stmt b/build/fuzzer/corpus/00881.stmt
deleted file mode 100644
index 7f494615b9..0000000000
--- a/build/fuzzer/corpus/00881.stmt
+++ /dev/null
@@ -1 +0,0 @@
-default p = 0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00882.stmt b/build/fuzzer/corpus/00882.stmt
deleted file mode 100644
index 9fb6cbd7b3..0000000000
--- a/build/fuzzer/corpus/00882.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 2 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00883.stmt b/build/fuzzer/corpus/00883.stmt
deleted file mode 100644
index 56a6051ca2..0000000000
--- a/build/fuzzer/corpus/00883.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00884.stmt b/build/fuzzer/corpus/00884.stmt
deleted file mode 100644
index a36015163e..0000000000
--- a/build/fuzzer/corpus/00884.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array comprehension
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00885.stmt b/build/fuzzer/corpus/00885.stmt
deleted file mode 100644
index 919396dd44..0000000000
--- a/build/fuzzer/corpus/00885.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 1 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00886.stmt b/build/fuzzer/corpus/00886.stmt
deleted file mode 100644
index 105d89a263..0000000000
--- a/build/fuzzer/corpus/00886.stmt
+++ /dev/null
@@ -1 +0,0 @@
-default p = [x | a[_] = x]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00887.stmt b/build/fuzzer/corpus/00887.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00887.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00888.stmt b/build/fuzzer/corpus/00888.stmt
deleted file mode 100644
index e22f846b52..0000000000
--- a/build/fuzzer/corpus/00888.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object comprehension
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00889.stmt b/build/fuzzer/corpus/00889.stmt
deleted file mode 100644
index 919396dd44..0000000000
--- a/build/fuzzer/corpus/00889.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 1 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00890.stmt b/build/fuzzer/corpus/00890.stmt
deleted file mode 100644
index 63de57b1b1..0000000000
--- a/build/fuzzer/corpus/00890.stmt
+++ /dev/null
@@ -1 +0,0 @@
-default p = {x: k | d[k][_] = x}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00891.stmt b/build/fuzzer/corpus/00891.stmt
deleted file mode 100644
index c4cd4a99d7..0000000000
--- a/build/fuzzer/corpus/00891.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"bar": "e", "baz": "e"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00892.stmt b/build/fuzzer/corpus/00892.stmt
deleted file mode 100644
index 6b22fb62e8..0000000000
--- a/build/fuzzer/corpus/00892.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set comprehension
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00893.stmt b/build/fuzzer/corpus/00893.stmt
deleted file mode 100644
index 919396dd44..0000000000
--- a/build/fuzzer/corpus/00893.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = 1 { false }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00894.stmt b/build/fuzzer/corpus/00894.stmt
deleted file mode 100644
index 9ac338b04d..0000000000
--- a/build/fuzzer/corpus/00894.stmt
+++ /dev/null
@@ -1 +0,0 @@
-default p = {x | a[_] = x}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00895.stmt b/build/fuzzer/corpus/00895.stmt
deleted file mode 100644
index fde6c1d745..0000000000
--- a/build/fuzzer/corpus/00895.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00896.stmt b/build/fuzzer/corpus/00896.stmt
deleted file mode 100644
index b070a6a41f..0000000000
--- a/build/fuzzer/corpus/00896.stmt
+++ /dev/null
@@ -1 +0,0 @@
-plus
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00897.stmt b/build/fuzzer/corpus/00897.stmt
deleted file mode 100644
index 85d46dbd0f..0000000000
--- a/build/fuzzer/corpus/00897.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { a[i] = x; y = i + x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00898.stmt b/build/fuzzer/corpus/00898.stmt
deleted file mode 100644
index 8c6eadba4e..0000000000
--- a/build/fuzzer/corpus/00898.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1,3,5,7]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00899.stmt b/build/fuzzer/corpus/00899.stmt
deleted file mode 100644
index e25215f914..0000000000
--- a/build/fuzzer/corpus/00899.stmt
+++ /dev/null
@@ -1 +0,0 @@
-minus
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00900.stmt b/build/fuzzer/corpus/00900.stmt
deleted file mode 100644
index 53a35debcc..0000000000
--- a/build/fuzzer/corpus/00900.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { a[i] = x; y = i - x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00901.stmt b/build/fuzzer/corpus/00901.stmt
deleted file mode 100644
index 99d21a2a0f..0000000000
--- a/build/fuzzer/corpus/00901.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[-1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00902.stmt b/build/fuzzer/corpus/00902.stmt
deleted file mode 100644
index 59c6358baf..0000000000
--- a/build/fuzzer/corpus/00902.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multiply
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00903.stmt b/build/fuzzer/corpus/00903.stmt
deleted file mode 100644
index a57bb71e23..0000000000
--- a/build/fuzzer/corpus/00903.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { a[i] = x; y = i * x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00904.stmt b/build/fuzzer/corpus/00904.stmt
deleted file mode 100644
index b0a00ceb2c..0000000000
--- a/build/fuzzer/corpus/00904.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0,2,6,12]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00905.stmt b/build/fuzzer/corpus/00905.stmt
deleted file mode 100644
index 0a0007de98..0000000000
--- a/build/fuzzer/corpus/00905.stmt
+++ /dev/null
@@ -1 +0,0 @@
-divide+round
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00906.stmt b/build/fuzzer/corpus/00906.stmt
deleted file mode 100644
index 1757d9c6be..0000000000
--- a/build/fuzzer/corpus/00906.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[z] { a[i] = x; y = i / x; round(y, z) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00907.stmt b/build/fuzzer/corpus/00907.stmt
deleted file mode 100644
index be4f39dd9e..0000000000
--- a/build/fuzzer/corpus/00907.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0, 1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00908.stmt b/build/fuzzer/corpus/00908.stmt
deleted file mode 100644
index b0f9c16dbb..0000000000
--- a/build/fuzzer/corpus/00908.stmt
+++ /dev/null
@@ -1 +0,0 @@
-divide+error
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00909.stmt b/build/fuzzer/corpus/00909.stmt
deleted file mode 100644
index 5689673953..0000000000
--- a/build/fuzzer/corpus/00909.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[y] { a[i] = x; y = x / i }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00910.stmt b/build/fuzzer/corpus/00910.stmt
deleted file mode 100644
index eaa38a4274..0000000000
--- a/build/fuzzer/corpus/00910.stmt
+++ /dev/null
@@ -1 +0,0 @@
-divide by zero
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00911.stmt b/build/fuzzer/corpus/00911.stmt
deleted file mode 100644
index bc05192bf4..0000000000
--- a/build/fuzzer/corpus/00911.stmt
+++ /dev/null
@@ -1 +0,0 @@
-abs
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00912.stmt b/build/fuzzer/corpus/00912.stmt
deleted file mode 100644
index 29f739af32..0000000000
--- a/build/fuzzer/corpus/00912.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { abs(-10, x); x = 10 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00913.stmt b/build/fuzzer/corpus/00913.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00913.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00914.stmt b/build/fuzzer/corpus/00914.stmt
deleted file mode 100644
index f77168f7a1..0000000000
--- a/build/fuzzer/corpus/00914.stmt
+++ /dev/null
@@ -1 +0,0 @@
-remainder
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00915.stmt b/build/fuzzer/corpus/00915.stmt
deleted file mode 100644
index 5418bbe2ca..0000000000
--- a/build/fuzzer/corpus/00915.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { x = 7 % 4 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00916.stmt b/build/fuzzer/corpus/00916.stmt
deleted file mode 100644
index e440e5c842..0000000000
--- a/build/fuzzer/corpus/00916.stmt
+++ /dev/null
@@ -1 +0,0 @@
-3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00917.stmt b/build/fuzzer/corpus/00917.stmt
deleted file mode 100644
index b951cba3cd..0000000000
--- a/build/fuzzer/corpus/00917.stmt
+++ /dev/null
@@ -1 +0,0 @@
-remainder+error
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00918.stmt b/build/fuzzer/corpus/00918.stmt
deleted file mode 100644
index 15f8759cf8..0000000000
--- a/build/fuzzer/corpus/00918.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { x = 7 % 0 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00919.stmt b/build/fuzzer/corpus/00919.stmt
deleted file mode 100644
index 17bd25c7db..0000000000
--- a/build/fuzzer/corpus/00919.stmt
+++ /dev/null
@@ -1 +0,0 @@
-modulo by zero
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00920.stmt b/build/fuzzer/corpus/00920.stmt
deleted file mode 100644
index 3477b52a7f..0000000000
--- a/build/fuzzer/corpus/00920.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arity 1 ref dest
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00921.stmt b/build/fuzzer/corpus/00921.stmt
deleted file mode 100644
index 0b9b755f04..0000000000
--- a/build/fuzzer/corpus/00921.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { abs(-4, a[3]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00922.stmt b/build/fuzzer/corpus/00922.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00922.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00923.stmt b/build/fuzzer/corpus/00923.stmt
deleted file mode 100644
index 32f8316121..0000000000
--- a/build/fuzzer/corpus/00923.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arity 1 ref dest (2)
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00924.stmt b/build/fuzzer/corpus/00924.stmt
deleted file mode 100644
index 5f2cdfc3f7..0000000000
--- a/build/fuzzer/corpus/00924.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not abs(-5, a[3]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00925.stmt b/build/fuzzer/corpus/00925.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00925.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00926.stmt b/build/fuzzer/corpus/00926.stmt
deleted file mode 100644
index 8f8a7a194a..0000000000
--- a/build/fuzzer/corpus/00926.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arity 2 ref dest
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00927.stmt b/build/fuzzer/corpus/00927.stmt
deleted file mode 100644
index d4ed3ff3f9..0000000000
--- a/build/fuzzer/corpus/00927.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { a[2] = 1 + 2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00928.stmt b/build/fuzzer/corpus/00928.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00928.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00929.stmt b/build/fuzzer/corpus/00929.stmt
deleted file mode 100644
index d70c68354d..0000000000
--- a/build/fuzzer/corpus/00929.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arity 2 ref dest (2)
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00930.stmt b/build/fuzzer/corpus/00930.stmt
deleted file mode 100644
index 5ecaaeed7a..0000000000
--- a/build/fuzzer/corpus/00930.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not a[2] = 2 + 3 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00931.stmt b/build/fuzzer/corpus/00931.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00931.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00932.stmt b/build/fuzzer/corpus/00932.stmt
deleted file mode 100644
index 4fa70c2a73..0000000000
--- a/build/fuzzer/corpus/00932.stmt
+++ /dev/null
@@ -1 +0,0 @@
-to_number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00933.stmt b/build/fuzzer/corpus/00933.stmt
deleted file mode 100644
index 27cf811b5a..0000000000
--- a/build/fuzzer/corpus/00933.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y, z, i, j] { to_number("-42.0", x); to_number(false, y); to_number(100.1, z); to_number(null, i); to_number(true, j) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00934.stmt b/build/fuzzer/corpus/00934.stmt
deleted file mode 100644
index 900c27263f..0000000000
--- a/build/fuzzer/corpus/00934.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[-42.0, 0, 100.1, 0, 1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00935.stmt b/build/fuzzer/corpus/00935.stmt
deleted file mode 100644
index 626e2ac01c..0000000000
--- a/build/fuzzer/corpus/00935.stmt
+++ /dev/null
@@ -1 +0,0 @@
-to_number ref dest
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00936.stmt b/build/fuzzer/corpus/00936.stmt
deleted file mode 100644
index d15cff18ac..0000000000
--- a/build/fuzzer/corpus/00936.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { to_number("3", a[2]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00937.stmt b/build/fuzzer/corpus/00937.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00937.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00938.stmt b/build/fuzzer/corpus/00938.stmt
deleted file mode 100644
index 626e2ac01c..0000000000
--- a/build/fuzzer/corpus/00938.stmt
+++ /dev/null
@@ -1 +0,0 @@
-to_number ref dest
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00939.stmt b/build/fuzzer/corpus/00939.stmt
deleted file mode 100644
index 58733e2c00..0000000000
--- a/build/fuzzer/corpus/00939.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not to_number("-1", a[2]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00940.stmt b/build/fuzzer/corpus/00940.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00940.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00941.stmt b/build/fuzzer/corpus/00941.stmt
deleted file mode 100644
index ec31f21953..0000000000
--- a/build/fuzzer/corpus/00941.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p { to_number("broken", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00942.stmt b/build/fuzzer/corpus/00942.stmt
deleted file mode 100644
index 80c18b57a6..0000000000
--- a/build/fuzzer/corpus/00942.stmt
+++ /dev/null
@@ -1 +0,0 @@
-invalid syntax
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00943.stmt b/build/fuzzer/corpus/00943.stmt
deleted file mode 100644
index 3841a9ffb3..0000000000
--- a/build/fuzzer/corpus/00943.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00944.stmt b/build/fuzzer/corpus/00944.stmt
deleted file mode 100644
index dd14da8444..0000000000
--- a/build/fuzzer/corpus/00944.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y, z] { is_number(-42.0, x); is_number(0, y); is_number(100.1, z) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00945.stmt b/build/fuzzer/corpus/00945.stmt
deleted file mode 100644
index c98a84b55e..0000000000
--- a/build/fuzzer/corpus/00945.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true, true, true]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00946.stmt b/build/fuzzer/corpus/00946.stmt
deleted file mode 100644
index 3841a9ffb3..0000000000
--- a/build/fuzzer/corpus/00946.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00947.stmt b/build/fuzzer/corpus/00947.stmt
deleted file mode 100644
index 5d6d681415..0000000000
--- a/build/fuzzer/corpus/00947.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_number(null, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00948.stmt b/build/fuzzer/corpus/00948.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00949.stmt b/build/fuzzer/corpus/00949.stmt
deleted file mode 100644
index 3841a9ffb3..0000000000
--- a/build/fuzzer/corpus/00949.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00950.stmt b/build/fuzzer/corpus/00950.stmt
deleted file mode 100644
index 0d824e2e7b..0000000000
--- a/build/fuzzer/corpus/00950.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_number(false, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00951.stmt b/build/fuzzer/corpus/00951.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00952.stmt b/build/fuzzer/corpus/00952.stmt
deleted file mode 100644
index 3841a9ffb3..0000000000
--- a/build/fuzzer/corpus/00952.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00953.stmt b/build/fuzzer/corpus/00953.stmt
deleted file mode 100644
index ff28d61e35..0000000000
--- a/build/fuzzer/corpus/00953.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] {arr = [true, 1]; arr[_] = x; is_number(x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00954.stmt b/build/fuzzer/corpus/00954.stmt
deleted file mode 100644
index bace2a0be1..0000000000
--- a/build/fuzzer/corpus/00954.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00955.stmt b/build/fuzzer/corpus/00955.stmt
deleted file mode 100644
index d0c075f020..0000000000
--- a/build/fuzzer/corpus/00955.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_string
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00956.stmt b/build/fuzzer/corpus/00956.stmt
deleted file mode 100644
index 412204dc99..0000000000
--- a/build/fuzzer/corpus/00956.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y, z] { is_string("Hello", x); is_string("There", y); is_string("OPA", z) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00957.stmt b/build/fuzzer/corpus/00957.stmt
deleted file mode 100644
index c98a84b55e..0000000000
--- a/build/fuzzer/corpus/00957.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true, true, true]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00958.stmt b/build/fuzzer/corpus/00958.stmt
deleted file mode 100644
index d0c075f020..0000000000
--- a/build/fuzzer/corpus/00958.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_string
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00959.stmt b/build/fuzzer/corpus/00959.stmt
deleted file mode 100644
index 207299506b..0000000000
--- a/build/fuzzer/corpus/00959.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_string(null, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00960.stmt b/build/fuzzer/corpus/00960.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00961.stmt b/build/fuzzer/corpus/00961.stmt
deleted file mode 100644
index d0c075f020..0000000000
--- a/build/fuzzer/corpus/00961.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_string
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00962.stmt b/build/fuzzer/corpus/00962.stmt
deleted file mode 100644
index d27c1c5286..0000000000
--- a/build/fuzzer/corpus/00962.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_string(false, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00963.stmt b/build/fuzzer/corpus/00963.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00964.stmt b/build/fuzzer/corpus/00964.stmt
deleted file mode 100644
index d0c075f020..0000000000
--- a/build/fuzzer/corpus/00964.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_string
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00965.stmt b/build/fuzzer/corpus/00965.stmt
deleted file mode 100644
index 83b3f059f9..0000000000
--- a/build/fuzzer/corpus/00965.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] {arr = [true, 1, "Hey"]; arr[_] = x; is_string(x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00966.stmt b/build/fuzzer/corpus/00966.stmt
deleted file mode 100644
index 8bc2811605..0000000000
--- a/build/fuzzer/corpus/00966.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_boolean
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00967.stmt b/build/fuzzer/corpus/00967.stmt
deleted file mode 100644
index 5ad8e0aacf..0000000000
--- a/build/fuzzer/corpus/00967.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y] { is_boolean(true, x); is_boolean(false, y) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00968.stmt b/build/fuzzer/corpus/00968.stmt
deleted file mode 100644
index 42c841ee65..0000000000
--- a/build/fuzzer/corpus/00968.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true, true]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00969.stmt b/build/fuzzer/corpus/00969.stmt
deleted file mode 100644
index 8bc2811605..0000000000
--- a/build/fuzzer/corpus/00969.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_boolean
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00970.stmt b/build/fuzzer/corpus/00970.stmt
deleted file mode 100644
index 471d974e06..0000000000
--- a/build/fuzzer/corpus/00970.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_boolean(null, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00971.stmt b/build/fuzzer/corpus/00971.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00972.stmt b/build/fuzzer/corpus/00972.stmt
deleted file mode 100644
index 8bc2811605..0000000000
--- a/build/fuzzer/corpus/00972.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_boolean
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00973.stmt b/build/fuzzer/corpus/00973.stmt
deleted file mode 100644
index cb847c800a..0000000000
--- a/build/fuzzer/corpus/00973.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_boolean("Hello", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00974.stmt b/build/fuzzer/corpus/00974.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00975.stmt b/build/fuzzer/corpus/00975.stmt
deleted file mode 100644
index 8bc2811605..0000000000
--- a/build/fuzzer/corpus/00975.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_boolean
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00976.stmt b/build/fuzzer/corpus/00976.stmt
deleted file mode 100644
index 612687f76b..0000000000
--- a/build/fuzzer/corpus/00976.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] {arr = [false, 1, "Hey"]; arr[_] = x; is_boolean(x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00977.stmt b/build/fuzzer/corpus/00977.stmt
deleted file mode 100644
index 67b2f07601..0000000000
--- a/build/fuzzer/corpus/00977.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[false]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00978.stmt b/build/fuzzer/corpus/00978.stmt
deleted file mode 100644
index f13b655f21..0000000000
--- a/build/fuzzer/corpus/00978.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00979.stmt b/build/fuzzer/corpus/00979.stmt
deleted file mode 100644
index 59b81da3cc..0000000000
--- a/build/fuzzer/corpus/00979.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y] { is_array([1,2,3], x); is_array(["a", "b"], y) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00980.stmt b/build/fuzzer/corpus/00980.stmt
deleted file mode 100644
index 42c841ee65..0000000000
--- a/build/fuzzer/corpus/00980.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true, true]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00981.stmt b/build/fuzzer/corpus/00981.stmt
deleted file mode 100644
index f13b655f21..0000000000
--- a/build/fuzzer/corpus/00981.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00982.stmt b/build/fuzzer/corpus/00982.stmt
deleted file mode 100644
index c7238931c6..0000000000
--- a/build/fuzzer/corpus/00982.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_array({1,2,3}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00983.stmt b/build/fuzzer/corpus/00983.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00984.stmt b/build/fuzzer/corpus/00984.stmt
deleted file mode 100644
index 8c531c6b32..0000000000
--- a/build/fuzzer/corpus/00984.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00985.stmt b/build/fuzzer/corpus/00985.stmt
deleted file mode 100644
index be1e1c2e0c..0000000000
--- a/build/fuzzer/corpus/00985.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y] { is_set({1,2,3}, x); is_set({"a", "b"}, y) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00986.stmt b/build/fuzzer/corpus/00986.stmt
deleted file mode 100644
index 42c841ee65..0000000000
--- a/build/fuzzer/corpus/00986.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[true, true]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00987.stmt b/build/fuzzer/corpus/00987.stmt
deleted file mode 100644
index 8c531c6b32..0000000000
--- a/build/fuzzer/corpus/00987.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00988.stmt b/build/fuzzer/corpus/00988.stmt
deleted file mode 100644
index 0f0fc8ede2..0000000000
--- a/build/fuzzer/corpus/00988.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_set([1,2,3], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00989.stmt b/build/fuzzer/corpus/00989.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00990.stmt b/build/fuzzer/corpus/00990.stmt
deleted file mode 100644
index e05270b603..0000000000
--- a/build/fuzzer/corpus/00990.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00991.stmt b/build/fuzzer/corpus/00991.stmt
deleted file mode 100644
index 17281a6ba7..0000000000
--- a/build/fuzzer/corpus/00991.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_object({"foo": yy | yy = 1}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00992.stmt b/build/fuzzer/corpus/00992.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00992.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00993.stmt b/build/fuzzer/corpus/00993.stmt
deleted file mode 100644
index e05270b603..0000000000
--- a/build/fuzzer/corpus/00993.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00994.stmt b/build/fuzzer/corpus/00994.stmt
deleted file mode 100644
index 1b66780de9..0000000000
--- a/build/fuzzer/corpus/00994.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_object("foo", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00995.stmt b/build/fuzzer/corpus/00995.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/00996.stmt b/build/fuzzer/corpus/00996.stmt
deleted file mode 100644
index 870b6daa83..0000000000
--- a/build/fuzzer/corpus/00996.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_null
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00997.stmt b/build/fuzzer/corpus/00997.stmt
deleted file mode 100644
index 95a3c4fccd..0000000000
--- a/build/fuzzer/corpus/00997.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_null(null, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00998.stmt b/build/fuzzer/corpus/00998.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/00998.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/00999.stmt b/build/fuzzer/corpus/00999.stmt
deleted file mode 100644
index 870b6daa83..0000000000
--- a/build/fuzzer/corpus/00999.stmt
+++ /dev/null
@@ -1 +0,0 @@
-is_null
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01000.stmt b/build/fuzzer/corpus/01000.stmt
deleted file mode 100644
index c033f184d7..0000000000
--- a/build/fuzzer/corpus/01000.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { is_null(true, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01001.stmt b/build/fuzzer/corpus/01001.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01002.stmt b/build/fuzzer/corpus/01002.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01002.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01003.stmt b/build/fuzzer/corpus/01003.stmt
deleted file mode 100644
index d41e4a0134..0000000000
--- a/build/fuzzer/corpus/01003.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name(null, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01004.stmt b/build/fuzzer/corpus/01004.stmt
deleted file mode 100644
index ec747fa47d..0000000000
--- a/build/fuzzer/corpus/01004.stmt
+++ /dev/null
@@ -1 +0,0 @@
-null
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01005.stmt b/build/fuzzer/corpus/01005.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01005.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01006.stmt b/build/fuzzer/corpus/01006.stmt
deleted file mode 100644
index 463e9516d9..0000000000
--- a/build/fuzzer/corpus/01006.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name(true, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01007.stmt b/build/fuzzer/corpus/01007.stmt
deleted file mode 100644
index 5353680324..0000000000
--- a/build/fuzzer/corpus/01007.stmt
+++ /dev/null
@@ -1 +0,0 @@
-boolean
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01008.stmt b/build/fuzzer/corpus/01008.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01008.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01009.stmt b/build/fuzzer/corpus/01009.stmt
deleted file mode 100644
index 62bd0fa056..0000000000
--- a/build/fuzzer/corpus/01009.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name(100, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01010.stmt b/build/fuzzer/corpus/01010.stmt
deleted file mode 100644
index 0dfad6f42d..0000000000
--- a/build/fuzzer/corpus/01010.stmt
+++ /dev/null
@@ -1 +0,0 @@
-number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01011.stmt b/build/fuzzer/corpus/01011.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01011.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01012.stmt b/build/fuzzer/corpus/01012.stmt
deleted file mode 100644
index ac265f712e..0000000000
--- a/build/fuzzer/corpus/01012.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name("Hello", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01013.stmt b/build/fuzzer/corpus/01013.stmt
deleted file mode 100644
index ec186f1f34..0000000000
--- a/build/fuzzer/corpus/01013.stmt
+++ /dev/null
@@ -1 +0,0 @@
-string
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01014.stmt b/build/fuzzer/corpus/01014.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01014.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01015.stmt b/build/fuzzer/corpus/01015.stmt
deleted file mode 100644
index 0e7d393795..0000000000
--- a/build/fuzzer/corpus/01015.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name([1,2,3], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01016.stmt b/build/fuzzer/corpus/01016.stmt
deleted file mode 100644
index 1bb801d8c6..0000000000
--- a/build/fuzzer/corpus/01016.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01017.stmt b/build/fuzzer/corpus/01017.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01017.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01018.stmt b/build/fuzzer/corpus/01018.stmt
deleted file mode 100644
index d89dde5890..0000000000
--- a/build/fuzzer/corpus/01018.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name({1,2,3}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01019.stmt b/build/fuzzer/corpus/01019.stmt
deleted file mode 100644
index c2c88d097d..0000000000
--- a/build/fuzzer/corpus/01019.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01020.stmt b/build/fuzzer/corpus/01020.stmt
deleted file mode 100644
index e876d92336..0000000000
--- a/build/fuzzer/corpus/01020.stmt
+++ /dev/null
@@ -1 +0,0 @@
-type_name
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01021.stmt b/build/fuzzer/corpus/01021.stmt
deleted file mode 100644
index ecceb2b591..0000000000
--- a/build/fuzzer/corpus/01021.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { type_name({"foo": yy | yy = 1}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01022.stmt b/build/fuzzer/corpus/01022.stmt
deleted file mode 100644
index efac25111f..0000000000
--- a/build/fuzzer/corpus/01022.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01023.stmt b/build/fuzzer/corpus/01023.stmt
deleted file mode 100644
index e8b7828728..0000000000
--- a/build/fuzzer/corpus/01023.stmt
+++ /dev/null
@@ -1 +0,0 @@
-re_match
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01024.stmt b/build/fuzzer/corpus/01024.stmt
deleted file mode 100644
index 406c73f9d4..0000000000
--- a/build/fuzzer/corpus/01024.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { re_match("^[a-z]+\\[[0-9]+\\]$", "foo[1]") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01025.stmt b/build/fuzzer/corpus/01025.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01025.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01026.stmt b/build/fuzzer/corpus/01026.stmt
deleted file mode 100644
index c5e06441d3..0000000000
--- a/build/fuzzer/corpus/01026.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { re_match("^[a-z]+\\[[0-9]+\\]$", "foo[\"bar\"]") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01027.stmt b/build/fuzzer/corpus/01027.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01028.stmt b/build/fuzzer/corpus/01028.stmt
deleted file mode 100644
index 750e643b8f..0000000000
--- a/build/fuzzer/corpus/01028.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { re_match("][", "foo[\"bar\"]") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01029.stmt b/build/fuzzer/corpus/01029.stmt
deleted file mode 100644
index c2d3e76576..0000000000
--- a/build/fuzzer/corpus/01029.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { re_match("^b.*$", d.e[x]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01030.stmt b/build/fuzzer/corpus/01030.stmt
deleted file mode 100644
index bfa34124ca..0000000000
--- a/build/fuzzer/corpus/01030.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0,1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01031.stmt b/build/fuzzer/corpus/01031.stmt
deleted file mode 100644
index d0dbf9dcaa..0000000000
--- a/build/fuzzer/corpus/01031.stmt
+++ /dev/null
@@ -1 +0,0 @@
-`^[a-z]+\\[[0-9]+\\]$`
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01032.stmt b/build/fuzzer/corpus/01032.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01032.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01033.stmt b/build/fuzzer/corpus/01033.stmt
deleted file mode 100644
index d0dbf9dcaa..0000000000
--- a/build/fuzzer/corpus/01033.stmt
+++ /dev/null
@@ -1 +0,0 @@
-`^[a-z]+\\[[0-9]+\\]$`
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01034.stmt b/build/fuzzer/corpus/01034.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01035.stmt b/build/fuzzer/corpus/01035.stmt
deleted file mode 100644
index 1a82811c6a..0000000000
--- a/build/fuzzer/corpus/01035.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { regex.split("^[a-z]+\\[[0-9]+\\]$", "", [x]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01036.stmt b/build/fuzzer/corpus/01036.stmt
deleted file mode 100644
index 3cc762b550..0000000000
--- a/build/fuzzer/corpus/01036.stmt
+++ /dev/null
@@ -1 +0,0 @@
-""
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01037.stmt b/build/fuzzer/corpus/01037.stmt
deleted file mode 100644
index f02d9a1b33..0000000000
--- a/build/fuzzer/corpus/01037.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [v,w,x,y] { regex.split("a", "banana", [v,w,x,y]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01038.stmt b/build/fuzzer/corpus/01038.stmt
deleted file mode 100644
index f2e72237d8..0000000000
--- a/build/fuzzer/corpus/01038.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["b","n","n",""]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01039.stmt b/build/fuzzer/corpus/01039.stmt
deleted file mode 100644
index c5a2ee67b4..0000000000
--- a/build/fuzzer/corpus/01039.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [v,w] { regex.split("z+", "pizza", [v,w]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01040.stmt b/build/fuzzer/corpus/01040.stmt
deleted file mode 100644
index e78fd1f6cc..0000000000
--- a/build/fuzzer/corpus/01040.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["pi","a"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01041.stmt b/build/fuzzer/corpus/01041.stmt
deleted file mode 100644
index 6d41a91d37..0000000000
--- a/build/fuzzer/corpus/01041.stmt
+++ /dev/null
@@ -1 +0,0 @@
-regex.globs_match
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01042.stmt b/build/fuzzer/corpus/01042.stmt
deleted file mode 100644
index 00165bdd58..0000000000
--- a/build/fuzzer/corpus/01042.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { regex.globs_match("a.a.[0-9]+z", ".b.b2359825792*594823z") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01043.stmt b/build/fuzzer/corpus/01043.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01043.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01044.stmt b/build/fuzzer/corpus/01044.stmt
deleted file mode 100644
index 6d41a91d37..0000000000
--- a/build/fuzzer/corpus/01044.stmt
+++ /dev/null
@@ -1 +0,0 @@
-regex.globs_match
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01045.stmt b/build/fuzzer/corpus/01045.stmt
deleted file mode 100644
index 28642d9d56..0000000000
--- a/build/fuzzer/corpus/01045.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { regex.globs_match("[a-z]+", "[0-9]*") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01046.stmt b/build/fuzzer/corpus/01046.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01047.stmt b/build/fuzzer/corpus/01047.stmt
deleted file mode 100644
index e5d643ffe4..0000000000
--- a/build/fuzzer/corpus/01047.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { regex.globs_match("pqrs]", "[a-b]+") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01048.stmt b/build/fuzzer/corpus/01048.stmt
deleted file mode 100644
index 9f6c61d717..0000000000
--- a/build/fuzzer/corpus/01048.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { regex.globs_match("b.*", d.e[x]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01049.stmt b/build/fuzzer/corpus/01049.stmt
deleted file mode 100644
index bfa34124ca..0000000000
--- a/build/fuzzer/corpus/01049.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[0,1]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01050.stmt b/build/fuzzer/corpus/01050.stmt
deleted file mode 100644
index 9b1b9b37cf..0000000000
--- a/build/fuzzer/corpus/01050.stmt
+++ /dev/null
@@ -1 +0,0 @@
-`[a-z]+\\[[0-9]+\\]`
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01051.stmt b/build/fuzzer/corpus/01051.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01051.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01052.stmt b/build/fuzzer/corpus/01052.stmt
deleted file mode 100644
index 9b1b9b37cf..0000000000
--- a/build/fuzzer/corpus/01052.stmt
+++ /dev/null
@@ -1 +0,0 @@
-`[a-z]+\\[[0-9]+\\]`
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01053.stmt b/build/fuzzer/corpus/01053.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01054.stmt b/build/fuzzer/corpus/01054.stmt
deleted file mode 100644
index 089aef0359..0000000000
--- a/build/fuzzer/corpus/01054.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set_diff
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01055.stmt b/build/fuzzer/corpus/01055.stmt
deleted file mode 100644
index 94d412f26c..0000000000
--- a/build/fuzzer/corpus/01055.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { s1 = {1, 2, 3, 4}; s2 = {1, 3}; x = s1 - s2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01056.stmt b/build/fuzzer/corpus/01056.stmt
deleted file mode 100644
index c466a1b5b9..0000000000
--- a/build/fuzzer/corpus/01056.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01057.stmt b/build/fuzzer/corpus/01057.stmt
deleted file mode 100644
index b7499d4281..0000000000
--- a/build/fuzzer/corpus/01057.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { s1 = {a[2], a[1], a[0]}; s2 = {a[0], 2}; set_diff(s1, s2, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01058.stmt b/build/fuzzer/corpus/01058.stmt
deleted file mode 100644
index 810c539bc7..0000000000
--- a/build/fuzzer/corpus/01058.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01059.stmt b/build/fuzzer/corpus/01059.stmt
deleted file mode 100644
index 2468bc645e..0000000000
--- a/build/fuzzer/corpus/01059.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {1} = {1, 2, 3} - {2, 3} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01060.stmt b/build/fuzzer/corpus/01060.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01060.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01061.stmt b/build/fuzzer/corpus/01061.stmt
deleted file mode 100644
index b728edf6d6..0000000000
--- a/build/fuzzer/corpus/01061.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { x = s1 - s2 }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01062.stmt b/build/fuzzer/corpus/01062.stmt
deleted file mode 100644
index f3823a4f18..0000000000
--- a/build/fuzzer/corpus/01062.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s1[1] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01063.stmt b/build/fuzzer/corpus/01063.stmt
deleted file mode 100644
index 04f65a4372..0000000000
--- a/build/fuzzer/corpus/01063.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s1[2] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01064.stmt b/build/fuzzer/corpus/01064.stmt
deleted file mode 100644
index 775aa599ad..0000000000
--- a/build/fuzzer/corpus/01064.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s1["c"] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01065.stmt b/build/fuzzer/corpus/01065.stmt
deleted file mode 100644
index 2d59057a7b..0000000000
--- a/build/fuzzer/corpus/01065.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s2 = {"c", 1} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01066.stmt b/build/fuzzer/corpus/01066.stmt
deleted file mode 100644
index 5d50c80c06..0000000000
--- a/build/fuzzer/corpus/01066.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01067.stmt b/build/fuzzer/corpus/01067.stmt
deleted file mode 100644
index d83a6b401a..0000000000
--- a/build/fuzzer/corpus/01067.stmt
+++ /dev/null
@@ -1 +0,0 @@
-intersect
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01068.stmt b/build/fuzzer/corpus/01068.stmt
deleted file mode 100644
index ba60a14afc..0000000000
--- a/build/fuzzer/corpus/01068.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { x = {a[1], a[2], 3} & {a[2], 4, 3} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01069.stmt b/build/fuzzer/corpus/01069.stmt
deleted file mode 100644
index 810c539bc7..0000000000
--- a/build/fuzzer/corpus/01069.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01070.stmt b/build/fuzzer/corpus/01070.stmt
deleted file mode 100644
index a88b00cd4a..0000000000
--- a/build/fuzzer/corpus/01070.stmt
+++ /dev/null
@@ -1 +0,0 @@
-union
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01071.stmt b/build/fuzzer/corpus/01071.stmt
deleted file mode 100644
index ada6a93be0..0000000000
--- a/build/fuzzer/corpus/01071.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { {2, 3, 4} = {a[1], a[2], 3} | {a[2], 4, 3} }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01072.stmt b/build/fuzzer/corpus/01072.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01072.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01073.stmt b/build/fuzzer/corpus/01073.stmt
deleted file mode 100644
index 0f811f49cb..0000000000
--- a/build/fuzzer/corpus/01073.stmt
+++ /dev/null
@@ -1 +0,0 @@
-format_int
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01074.stmt b/build/fuzzer/corpus/01074.stmt
deleted file mode 100644
index 02f05544c9..0000000000
--- a/build/fuzzer/corpus/01074.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { format_int(15.5, 16, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01075.stmt b/build/fuzzer/corpus/01075.stmt
deleted file mode 100644
index 91d1e395e0..0000000000
--- a/build/fuzzer/corpus/01075.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"f"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01076.stmt b/build/fuzzer/corpus/01076.stmt
deleted file mode 100644
index c095610a45..0000000000
--- a/build/fuzzer/corpus/01076.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { format_int(15.5, 16, "10000") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01077.stmt b/build/fuzzer/corpus/01077.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01078.stmt b/build/fuzzer/corpus/01078.stmt
deleted file mode 100644
index 59b789b084..0000000000
--- a/build/fuzzer/corpus/01078.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { format_int(3.1, 10, numbers[2]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01079.stmt b/build/fuzzer/corpus/01079.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01079.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01080.stmt b/build/fuzzer/corpus/01080.stmt
deleted file mode 100644
index f8b984cdf5..0000000000
--- a/build/fuzzer/corpus/01080.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not format_int(4.1, 10, numbers[2]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01081.stmt b/build/fuzzer/corpus/01081.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01081.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01082.stmt b/build/fuzzer/corpus/01082.stmt
deleted file mode 100644
index 6d6820637b..0000000000
--- a/build/fuzzer/corpus/01082.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { format_int(4.1, 199, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01083.stmt b/build/fuzzer/corpus/01083.stmt
deleted file mode 100644
index 864357db0e..0000000000
--- a/build/fuzzer/corpus/01083.stmt
+++ /dev/null
@@ -1 +0,0 @@
-operand 2 must be one of {2, 8, 10, 16}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01084.stmt b/build/fuzzer/corpus/01084.stmt
deleted file mode 100644
index fd33cfcc9a..0000000000
--- a/build/fuzzer/corpus/01084.stmt
+++ /dev/null
@@ -1 +0,0 @@
-concat
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01085.stmt b/build/fuzzer/corpus/01085.stmt
deleted file mode 100644
index b92e172928..0000000000
--- a/build/fuzzer/corpus/01085.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { concat("/", ["", "foo", "bar", "0", "baz"], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01086.stmt b/build/fuzzer/corpus/01086.stmt
deleted file mode 100644
index 383c247dbd..0000000000
--- a/build/fuzzer/corpus/01086.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"/foo/bar/0/baz"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01087.stmt b/build/fuzzer/corpus/01087.stmt
deleted file mode 100644
index 27c9150ae3..0000000000
--- a/build/fuzzer/corpus/01087.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { concat(",", {"1", "2", "3"}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01088.stmt b/build/fuzzer/corpus/01088.stmt
deleted file mode 100644
index 7de27300bf..0000000000
--- a/build/fuzzer/corpus/01088.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"1,2,3"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01089.stmt b/build/fuzzer/corpus/01089.stmt
deleted file mode 100644
index 6cc19e6b3c..0000000000
--- a/build/fuzzer/corpus/01089.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { concat("/", ["a", "b"], "deadbeef") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01090.stmt b/build/fuzzer/corpus/01090.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01091.stmt b/build/fuzzer/corpus/01091.stmt
deleted file mode 100644
index 91012fcd31..0000000000
--- a/build/fuzzer/corpus/01091.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { concat("", ["f", "o", "o"], c[0].x[2]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01092.stmt b/build/fuzzer/corpus/01092.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01092.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01093.stmt b/build/fuzzer/corpus/01093.stmt
deleted file mode 100644
index 230a070dc6..0000000000
--- a/build/fuzzer/corpus/01093.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { not concat("", ["b", "a", "r"], c[0].x[2]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01094.stmt b/build/fuzzer/corpus/01094.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01094.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01095.stmt b/build/fuzzer/corpus/01095.stmt
deleted file mode 100644
index c4b384e08e..0000000000
--- a/build/fuzzer/corpus/01095.stmt
+++ /dev/null
@@ -1 +0,0 @@
-indexof
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01096.stmt b/build/fuzzer/corpus/01096.stmt
deleted file mode 100644
index c7a5661e0d..0000000000
--- a/build/fuzzer/corpus/01096.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { indexof("abcdefgh", "cde", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01097.stmt b/build/fuzzer/corpus/01097.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/01097.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01098.stmt b/build/fuzzer/corpus/01098.stmt
deleted file mode 100644
index a409785dd8..0000000000
--- a/build/fuzzer/corpus/01098.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { indexof("abcdefgh", "xyz", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01099.stmt b/build/fuzzer/corpus/01099.stmt
deleted file mode 100644
index d7d17fcbef..0000000000
--- a/build/fuzzer/corpus/01099.stmt
+++ /dev/null
@@ -1 +0,0 @@
--1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01100.stmt b/build/fuzzer/corpus/01100.stmt
deleted file mode 100644
index e740a76c73..0000000000
--- a/build/fuzzer/corpus/01100.stmt
+++ /dev/null
@@ -1 +0,0 @@
-substring
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01101.stmt b/build/fuzzer/corpus/01101.stmt
deleted file mode 100644
index e000154fd5..0000000000
--- a/build/fuzzer/corpus/01101.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { substring("abcdefgh", 2, 3, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01102.stmt b/build/fuzzer/corpus/01102.stmt
deleted file mode 100644
index a409eceee1..0000000000
--- a/build/fuzzer/corpus/01102.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"cde"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01103.stmt b/build/fuzzer/corpus/01103.stmt
deleted file mode 100644
index 2c0cd5d34b..0000000000
--- a/build/fuzzer/corpus/01103.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { substring("abcdefgh", 2, -1, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01104.stmt b/build/fuzzer/corpus/01104.stmt
deleted file mode 100644
index 063b76e414..0000000000
--- a/build/fuzzer/corpus/01104.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"cdefgh"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01105.stmt b/build/fuzzer/corpus/01105.stmt
deleted file mode 100644
index e6d26daa51..0000000000
--- a/build/fuzzer/corpus/01105.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { substring("abcdefgh", 2, 10000, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01106.stmt b/build/fuzzer/corpus/01106.stmt
deleted file mode 100644
index 063b76e414..0000000000
--- a/build/fuzzer/corpus/01106.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"cdefgh"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01107.stmt b/build/fuzzer/corpus/01107.stmt
deleted file mode 100644
index 176d0c52bc..0000000000
--- a/build/fuzzer/corpus/01107.stmt
+++ /dev/null
@@ -1 +0,0 @@
-contains
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01108.stmt b/build/fuzzer/corpus/01108.stmt
deleted file mode 100644
index c870e7be00..0000000000
--- a/build/fuzzer/corpus/01108.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { contains("abcdefgh", "defg") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01109.stmt b/build/fuzzer/corpus/01109.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01109.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01110.stmt b/build/fuzzer/corpus/01110.stmt
deleted file mode 100644
index 8ca9166082..0000000000
--- a/build/fuzzer/corpus/01110.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { contains("abcdefgh", "ac") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01111.stmt b/build/fuzzer/corpus/01111.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01112.stmt b/build/fuzzer/corpus/01112.stmt
deleted file mode 100644
index a7b1af80e8..0000000000
--- a/build/fuzzer/corpus/01112.stmt
+++ /dev/null
@@ -1 +0,0 @@
-startswith
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01113.stmt b/build/fuzzer/corpus/01113.stmt
deleted file mode 100644
index 35f882a631..0000000000
--- a/build/fuzzer/corpus/01113.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { startswith("abcdefgh", "abcd") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01114.stmt b/build/fuzzer/corpus/01114.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01114.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01115.stmt b/build/fuzzer/corpus/01115.stmt
deleted file mode 100644
index 6bf38c8c6d..0000000000
--- a/build/fuzzer/corpus/01115.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { startswith("abcdefgh", "bcd") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01116.stmt b/build/fuzzer/corpus/01116.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01117.stmt b/build/fuzzer/corpus/01117.stmt
deleted file mode 100644
index a9ca2e5199..0000000000
--- a/build/fuzzer/corpus/01117.stmt
+++ /dev/null
@@ -1 +0,0 @@
-endswith
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01118.stmt b/build/fuzzer/corpus/01118.stmt
deleted file mode 100644
index 1d519406f3..0000000000
--- a/build/fuzzer/corpus/01118.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { endswith("abcdefgh", "fgh") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01119.stmt b/build/fuzzer/corpus/01119.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01119.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01120.stmt b/build/fuzzer/corpus/01120.stmt
deleted file mode 100644
index 02a46ab624..0000000000
--- a/build/fuzzer/corpus/01120.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = true { endswith("abcdefgh", "fg") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01121.stmt b/build/fuzzer/corpus/01121.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01122.stmt b/build/fuzzer/corpus/01122.stmt
deleted file mode 100644
index 49a5af366b..0000000000
--- a/build/fuzzer/corpus/01122.stmt
+++ /dev/null
@@ -1 +0,0 @@
-lower
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01123.stmt b/build/fuzzer/corpus/01123.stmt
deleted file mode 100644
index 433416f871..0000000000
--- a/build/fuzzer/corpus/01123.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { lower("AbCdEf", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01124.stmt b/build/fuzzer/corpus/01124.stmt
deleted file mode 100644
index 3cef96194e..0000000000
--- a/build/fuzzer/corpus/01124.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"abcdef"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01125.stmt b/build/fuzzer/corpus/01125.stmt
deleted file mode 100644
index 941342dc14..0000000000
--- a/build/fuzzer/corpus/01125.stmt
+++ /dev/null
@@ -1 +0,0 @@
-upper
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01126.stmt b/build/fuzzer/corpus/01126.stmt
deleted file mode 100644
index 3e15ee37cb..0000000000
--- a/build/fuzzer/corpus/01126.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { upper("AbCdEf", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01127.stmt b/build/fuzzer/corpus/01127.stmt
deleted file mode 100644
index a8e53de9db..0000000000
--- a/build/fuzzer/corpus/01127.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"ABCDEF"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01128.stmt b/build/fuzzer/corpus/01128.stmt
deleted file mode 100644
index 63d6627267..0000000000
--- a/build/fuzzer/corpus/01128.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { split("", ".", [x]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01129.stmt b/build/fuzzer/corpus/01129.stmt
deleted file mode 100644
index 3cc762b550..0000000000
--- a/build/fuzzer/corpus/01129.stmt
+++ /dev/null
@@ -1 +0,0 @@
-""
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01130.stmt b/build/fuzzer/corpus/01130.stmt
deleted file mode 100644
index 19cdf7e44a..0000000000
--- a/build/fuzzer/corpus/01130.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { split("foo", ".", [x]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01131.stmt b/build/fuzzer/corpus/01131.stmt
deleted file mode 100644
index 7e9668e783..0000000000
--- a/build/fuzzer/corpus/01131.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01132.stmt b/build/fuzzer/corpus/01132.stmt
deleted file mode 100644
index e028b7190c..0000000000
--- a/build/fuzzer/corpus/01132.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x,y] { split("foo.bar.baz", ".", [x,"bar",y]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01133.stmt b/build/fuzzer/corpus/01133.stmt
deleted file mode 100644
index 4812d64517..0000000000
--- a/build/fuzzer/corpus/01133.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["foo","baz"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01134.stmt b/build/fuzzer/corpus/01134.stmt
deleted file mode 100644
index 3e1a95c489..0000000000
--- a/build/fuzzer/corpus/01134.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { replace("", "hi", "bye", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01135.stmt b/build/fuzzer/corpus/01135.stmt
deleted file mode 100644
index 3cc762b550..0000000000
--- a/build/fuzzer/corpus/01135.stmt
+++ /dev/null
@@ -1 +0,0 @@
-""
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01136.stmt b/build/fuzzer/corpus/01136.stmt
deleted file mode 100644
index a922d2153c..0000000000
--- a/build/fuzzer/corpus/01136.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { replace("foo.bar", ".", ",", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01137.stmt b/build/fuzzer/corpus/01137.stmt
deleted file mode 100644
index 15a0175ce9..0000000000
--- a/build/fuzzer/corpus/01137.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo,bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01138.stmt b/build/fuzzer/corpus/01138.stmt
deleted file mode 100644
index 40b3a7e140..0000000000
--- a/build/fuzzer/corpus/01138.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { replace("foo.bar.baz", ".", ",", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01139.stmt b/build/fuzzer/corpus/01139.stmt
deleted file mode 100644
index 1661a9eb1b..0000000000
--- a/build/fuzzer/corpus/01139.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo,bar,baz"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01140.stmt b/build/fuzzer/corpus/01140.stmt
deleted file mode 100644
index 2defcb0b74..0000000000
--- a/build/fuzzer/corpus/01140.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { replace("foo...bar", "..", ",,", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01141.stmt b/build/fuzzer/corpus/01141.stmt
deleted file mode 100644
index b65f33ee1d..0000000000
--- a/build/fuzzer/corpus/01141.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo,,.bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01142.stmt b/build/fuzzer/corpus/01142.stmt
deleted file mode 100644
index 4be007a509..0000000000
--- a/build/fuzzer/corpus/01142.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { trim("", ".", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01143.stmt b/build/fuzzer/corpus/01143.stmt
deleted file mode 100644
index 3cc762b550..0000000000
--- a/build/fuzzer/corpus/01143.stmt
+++ /dev/null
@@ -1 +0,0 @@
-""
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01144.stmt b/build/fuzzer/corpus/01144.stmt
deleted file mode 100644
index 3021526a76..0000000000
--- a/build/fuzzer/corpus/01144.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { trim("foo.bar...", ".", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01145.stmt b/build/fuzzer/corpus/01145.stmt
deleted file mode 100644
index ef47ff2c05..0000000000
--- a/build/fuzzer/corpus/01145.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo.bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01146.stmt b/build/fuzzer/corpus/01146.stmt
deleted file mode 100644
index 706911671b..0000000000
--- a/build/fuzzer/corpus/01146.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { trim("...foo.bar", ".", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01147.stmt b/build/fuzzer/corpus/01147.stmt
deleted file mode 100644
index ef47ff2c05..0000000000
--- a/build/fuzzer/corpus/01147.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo.bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01148.stmt b/build/fuzzer/corpus/01148.stmt
deleted file mode 100644
index 36d23e6455..0000000000
--- a/build/fuzzer/corpus/01148.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { trim("...foo.bar...", ".", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01149.stmt b/build/fuzzer/corpus/01149.stmt
deleted file mode 100644
index ef47ff2c05..0000000000
--- a/build/fuzzer/corpus/01149.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo.bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01150.stmt b/build/fuzzer/corpus/01150.stmt
deleted file mode 100644
index b5069e9671..0000000000
--- a/build/fuzzer/corpus/01150.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { trim("...foo.bar...", ".fr", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01151.stmt b/build/fuzzer/corpus/01151.stmt
deleted file mode 100644
index 29cda2a437..0000000000
--- a/build/fuzzer/corpus/01151.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"oo.ba"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01152.stmt b/build/fuzzer/corpus/01152.stmt
deleted file mode 100644
index f760e279b2..0000000000
--- a/build/fuzzer/corpus/01152.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { trim("...foo.bar...", ".o", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01153.stmt b/build/fuzzer/corpus/01153.stmt
deleted file mode 100644
index ef47ff2c05..0000000000
--- a/build/fuzzer/corpus/01153.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"foo.bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01154.stmt b/build/fuzzer/corpus/01154.stmt
deleted file mode 100644
index 73d038a1e4..0000000000
--- a/build/fuzzer/corpus/01154.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi", [], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01155.stmt b/build/fuzzer/corpus/01155.stmt
deleted file mode 100644
index 492d091b34..0000000000
--- a/build/fuzzer/corpus/01155.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01156.stmt b/build/fuzzer/corpus/01156.stmt
deleted file mode 100644
index 75dfd0922c..0000000000
--- a/build/fuzzer/corpus/01156.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %s", ["there"], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01157.stmt b/build/fuzzer/corpus/01157.stmt
deleted file mode 100644
index 0c724c47ee..0000000000
--- a/build/fuzzer/corpus/01157.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi there"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01158.stmt b/build/fuzzer/corpus/01158.stmt
deleted file mode 100644
index b65c23e750..0000000000
--- a/build/fuzzer/corpus/01158.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %02d", [5], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01159.stmt b/build/fuzzer/corpus/01159.stmt
deleted file mode 100644
index a65a129a53..0000000000
--- a/build/fuzzer/corpus/01159.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi 05"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01160.stmt b/build/fuzzer/corpus/01160.stmt
deleted file mode 100644
index 365affd9a7..0000000000
--- a/build/fuzzer/corpus/01160.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %02X.%02X", [127, 1], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01161.stmt b/build/fuzzer/corpus/01161.stmt
deleted file mode 100644
index 1b2838d5bf..0000000000
--- a/build/fuzzer/corpus/01161.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi 7F.01"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01162.stmt b/build/fuzzer/corpus/01162.stmt
deleted file mode 100644
index d57a45ce93..0000000000
--- a/build/fuzzer/corpus/01162.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %.2f", [3.1415], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01163.stmt b/build/fuzzer/corpus/01163.stmt
deleted file mode 100644
index 6c5ac1f527..0000000000
--- a/build/fuzzer/corpus/01163.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi 3.14"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01164.stmt b/build/fuzzer/corpus/01164.stmt
deleted file mode 100644
index bbafb3ebbc..0000000000
--- a/build/fuzzer/corpus/01164.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %v", [2e308], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01165.stmt b/build/fuzzer/corpus/01165.stmt
deleted file mode 100644
index 1d8cc8c764..0000000000
--- a/build/fuzzer/corpus/01165.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi 2e+308"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01166.stmt b/build/fuzzer/corpus/01166.stmt
deleted file mode 100644
index 52afa9e7fe..0000000000
--- a/build/fuzzer/corpus/01166.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %s", [true], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01167.stmt b/build/fuzzer/corpus/01167.stmt
deleted file mode 100644
index 745276f0b9..0000000000
--- a/build/fuzzer/corpus/01167.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi true"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01168.stmt b/build/fuzzer/corpus/01168.stmt
deleted file mode 100644
index 23edaf3047..0000000000
--- a/build/fuzzer/corpus/01168.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { sprintf("hi %v", [["there", 5, 3.14]], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01169.stmt b/build/fuzzer/corpus/01169.stmt
deleted file mode 100644
index 8c7c89e51d..0000000000
--- a/build/fuzzer/corpus/01169.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hi [\"there\", 5, 3.14]"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01170.stmt b/build/fuzzer/corpus/01170.stmt
deleted file mode 100644
index 0693a2ddbb..0000000000
--- a/build/fuzzer/corpus/01170.stmt
+++ /dev/null
@@ -1 +0,0 @@
-marshal
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01171.stmt b/build/fuzzer/corpus/01171.stmt
deleted file mode 100644
index 57e3a7872e..0000000000
--- a/build/fuzzer/corpus/01171.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { json.marshal([{"foo": {1,2,3}}], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01172.stmt b/build/fuzzer/corpus/01172.stmt
deleted file mode 100644
index 65f01419bc..0000000000
--- a/build/fuzzer/corpus/01172.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"[{\"foo\":[1,2,3]}]"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01173.stmt b/build/fuzzer/corpus/01173.stmt
deleted file mode 100644
index 04e25e5e5c..0000000000
--- a/build/fuzzer/corpus/01173.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unmarshal
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01174.stmt b/build/fuzzer/corpus/01174.stmt
deleted file mode 100644
index 1b103207cf..0000000000
--- a/build/fuzzer/corpus/01174.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { json.unmarshal("[{\"foo\":[1,2,3]}]", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01175.stmt b/build/fuzzer/corpus/01175.stmt
deleted file mode 100644
index 1078f43324..0000000000
--- a/build/fuzzer/corpus/01175.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unmarshal-non-string
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01176.stmt b/build/fuzzer/corpus/01176.stmt
deleted file mode 100644
index 3c65132309..0000000000
--- a/build/fuzzer/corpus/01176.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { json.unmarshal(data.a[0], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01177.stmt b/build/fuzzer/corpus/01177.stmt
deleted file mode 100644
index ab59586296..0000000000
--- a/build/fuzzer/corpus/01177.stmt
+++ /dev/null
@@ -1 +0,0 @@
-operand 1 must be string but got number
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01178.stmt b/build/fuzzer/corpus/01178.stmt
deleted file mode 100644
index 8cecacb08c..0000000000
--- a/build/fuzzer/corpus/01178.stmt
+++ /dev/null
@@ -1 +0,0 @@
-yaml round-trip
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01179.stmt b/build/fuzzer/corpus/01179.stmt
deleted file mode 100644
index d2167f1a28..0000000000
--- a/build/fuzzer/corpus/01179.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = y { yaml.marshal([{"foo": {1,2,3}}], x); yaml.unmarshal(x, y) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01180.stmt b/build/fuzzer/corpus/01180.stmt
deleted file mode 100644
index db3e206ca9..0000000000
--- a/build/fuzzer/corpus/01180.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[{"foo": [1,2,3]}]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01181.stmt b/build/fuzzer/corpus/01181.stmt
deleted file mode 100644
index 73ef63d796..0000000000
--- a/build/fuzzer/corpus/01181.stmt
+++ /dev/null
@@ -1 +0,0 @@
-yaml unmarshal error
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01182.stmt b/build/fuzzer/corpus/01182.stmt
deleted file mode 100644
index 50c0f19b13..0000000000
--- a/build/fuzzer/corpus/01182.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p { yaml.unmarshal("[1,2,3", _) } 
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01183.stmt b/build/fuzzer/corpus/01183.stmt
deleted file mode 100644
index ae1fb24e4c..0000000000
--- a/build/fuzzer/corpus/01183.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01184.stmt b/build/fuzzer/corpus/01184.stmt
deleted file mode 100644
index b77f2e05cc..0000000000
--- a/build/fuzzer/corpus/01184.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64.encode("hello", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01185.stmt b/build/fuzzer/corpus/01185.stmt
deleted file mode 100644
index c7fe278f84..0000000000
--- a/build/fuzzer/corpus/01185.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"aGVsbG8="
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01186.stmt b/build/fuzzer/corpus/01186.stmt
deleted file mode 100644
index 744dd3b437..0000000000
--- a/build/fuzzer/corpus/01186.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01187.stmt b/build/fuzzer/corpus/01187.stmt
deleted file mode 100644
index 45f4068f76..0000000000
--- a/build/fuzzer/corpus/01187.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64.encode("there", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01188.stmt b/build/fuzzer/corpus/01188.stmt
deleted file mode 100644
index 3cb0177a9b..0000000000
--- a/build/fuzzer/corpus/01188.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"dGhlcmU="
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01189.stmt b/build/fuzzer/corpus/01189.stmt
deleted file mode 100644
index 7dcc23ce00..0000000000
--- a/build/fuzzer/corpus/01189.stmt
+++ /dev/null
@@ -1 +0,0 @@
-decode-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01190.stmt b/build/fuzzer/corpus/01190.stmt
deleted file mode 100644
index 6515e9fb97..0000000000
--- a/build/fuzzer/corpus/01190.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64.decode("aGVsbG8=", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01191.stmt b/build/fuzzer/corpus/01191.stmt
deleted file mode 100644
index 84ed78b69b..0000000000
--- a/build/fuzzer/corpus/01191.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hello"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01192.stmt b/build/fuzzer/corpus/01192.stmt
deleted file mode 100644
index 4090cdda08..0000000000
--- a/build/fuzzer/corpus/01192.stmt
+++ /dev/null
@@ -1 +0,0 @@
-decode-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01193.stmt b/build/fuzzer/corpus/01193.stmt
deleted file mode 100644
index 1344e00f32..0000000000
--- a/build/fuzzer/corpus/01193.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64.decode("dGhlcmU=", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01194.stmt b/build/fuzzer/corpus/01194.stmt
deleted file mode 100644
index 4a77270560..0000000000
--- a/build/fuzzer/corpus/01194.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"there"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01195.stmt b/build/fuzzer/corpus/01195.stmt
deleted file mode 100644
index bbbce350b7..0000000000
--- a/build/fuzzer/corpus/01195.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode-slash
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01196.stmt b/build/fuzzer/corpus/01196.stmt
deleted file mode 100644
index 13f79a310f..0000000000
--- a/build/fuzzer/corpus/01196.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64.encode("subjects?_d", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01197.stmt b/build/fuzzer/corpus/01197.stmt
deleted file mode 100644
index 83e49e5fdb..0000000000
--- a/build/fuzzer/corpus/01197.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"c3ViamVjdHM/X2Q="
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01198.stmt b/build/fuzzer/corpus/01198.stmt
deleted file mode 100644
index 1bacd5209b..0000000000
--- a/build/fuzzer/corpus/01198.stmt
+++ /dev/null
@@ -1 +0,0 @@
-decode-slash
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01199.stmt b/build/fuzzer/corpus/01199.stmt
deleted file mode 100644
index 20a1a2a245..0000000000
--- a/build/fuzzer/corpus/01199.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64.decode("c3ViamVjdHM/X2Q=", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01200.stmt b/build/fuzzer/corpus/01200.stmt
deleted file mode 100644
index 7aa3e8d524..0000000000
--- a/build/fuzzer/corpus/01200.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"subjects?_d"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01201.stmt b/build/fuzzer/corpus/01201.stmt
deleted file mode 100644
index ae1fb24e4c..0000000000
--- a/build/fuzzer/corpus/01201.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01202.stmt b/build/fuzzer/corpus/01202.stmt
deleted file mode 100644
index 7969f1798c..0000000000
--- a/build/fuzzer/corpus/01202.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64url.encode("hello", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01203.stmt b/build/fuzzer/corpus/01203.stmt
deleted file mode 100644
index c7fe278f84..0000000000
--- a/build/fuzzer/corpus/01203.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"aGVsbG8="
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01204.stmt b/build/fuzzer/corpus/01204.stmt
deleted file mode 100644
index 744dd3b437..0000000000
--- a/build/fuzzer/corpus/01204.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01205.stmt b/build/fuzzer/corpus/01205.stmt
deleted file mode 100644
index 201d9bab89..0000000000
--- a/build/fuzzer/corpus/01205.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64url.encode("there", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01206.stmt b/build/fuzzer/corpus/01206.stmt
deleted file mode 100644
index 3cb0177a9b..0000000000
--- a/build/fuzzer/corpus/01206.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"dGhlcmU="
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01207.stmt b/build/fuzzer/corpus/01207.stmt
deleted file mode 100644
index 7dcc23ce00..0000000000
--- a/build/fuzzer/corpus/01207.stmt
+++ /dev/null
@@ -1 +0,0 @@
-decode-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01208.stmt b/build/fuzzer/corpus/01208.stmt
deleted file mode 100644
index 2c4544eabd..0000000000
--- a/build/fuzzer/corpus/01208.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64url.decode("aGVsbG8=", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01209.stmt b/build/fuzzer/corpus/01209.stmt
deleted file mode 100644
index 84ed78b69b..0000000000
--- a/build/fuzzer/corpus/01209.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hello"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01210.stmt b/build/fuzzer/corpus/01210.stmt
deleted file mode 100644
index 4090cdda08..0000000000
--- a/build/fuzzer/corpus/01210.stmt
+++ /dev/null
@@ -1 +0,0 @@
-decode-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01211.stmt b/build/fuzzer/corpus/01211.stmt
deleted file mode 100644
index 0e57d245ea..0000000000
--- a/build/fuzzer/corpus/01211.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { base64url.decode("dGhlcmU=", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01212.stmt b/build/fuzzer/corpus/01212.stmt
deleted file mode 100644
index 4a77270560..0000000000
--- a/build/fuzzer/corpus/01212.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"there"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01213.stmt b/build/fuzzer/corpus/01213.stmt
deleted file mode 100644
index de697c3e42..0000000000
--- a/build/fuzzer/corpus/01213.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01214.stmt b/build/fuzzer/corpus/01214.stmt
deleted file mode 100644
index ba7fc48b02..0000000000
--- a/build/fuzzer/corpus/01214.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode("a=b+1", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01215.stmt b/build/fuzzer/corpus/01215.stmt
deleted file mode 100644
index e50305dcca..0000000000
--- a/build/fuzzer/corpus/01215.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"a%3Db%2B1"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01216.stmt b/build/fuzzer/corpus/01216.stmt
deleted file mode 100644
index 0e02dbfbc1..0000000000
--- a/build/fuzzer/corpus/01216.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01217.stmt b/build/fuzzer/corpus/01217.stmt
deleted file mode 100644
index 040b8e415b..0000000000
--- a/build/fuzzer/corpus/01217.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode("", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01218.stmt b/build/fuzzer/corpus/01218.stmt
deleted file mode 100644
index 3cc762b550..0000000000
--- a/build/fuzzer/corpus/01218.stmt
+++ /dev/null
@@ -1 +0,0 @@
-""
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01219.stmt b/build/fuzzer/corpus/01219.stmt
deleted file mode 100644
index 884773f00f..0000000000
--- a/build/fuzzer/corpus/01219.stmt
+++ /dev/null
@@ -1 +0,0 @@
-decode
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01220.stmt b/build/fuzzer/corpus/01220.stmt
deleted file mode 100644
index 24f3270b57..0000000000
--- a/build/fuzzer/corpus/01220.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.decode("a%3Db%2B1", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01221.stmt b/build/fuzzer/corpus/01221.stmt
deleted file mode 100644
index c18c385b6a..0000000000
--- a/build/fuzzer/corpus/01221.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"a=b+1"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01222.stmt b/build/fuzzer/corpus/01222.stmt
deleted file mode 100644
index 3723bf9515..0000000000
--- a/build/fuzzer/corpus/01222.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode_object empty
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01223.stmt b/build/fuzzer/corpus/01223.stmt
deleted file mode 100644
index aa1ce6a815..0000000000
--- a/build/fuzzer/corpus/01223.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode_object({}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01224.stmt b/build/fuzzer/corpus/01224.stmt
deleted file mode 100644
index 3cc762b550..0000000000
--- a/build/fuzzer/corpus/01224.stmt
+++ /dev/null
@@ -1 +0,0 @@
-""
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01225.stmt b/build/fuzzer/corpus/01225.stmt
deleted file mode 100644
index 7979e7c5ad..0000000000
--- a/build/fuzzer/corpus/01225.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode_object strings
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01226.stmt b/build/fuzzer/corpus/01226.stmt
deleted file mode 100644
index 5eeced2ebe..0000000000
--- a/build/fuzzer/corpus/01226.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode_object({"a": "b", "c": "d"}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01227.stmt b/build/fuzzer/corpus/01227.stmt
deleted file mode 100644
index bdc09026bd..0000000000
--- a/build/fuzzer/corpus/01227.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"a=b&c=d"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01228.stmt b/build/fuzzer/corpus/01228.stmt
deleted file mode 100644
index 56a2c467d7..0000000000
--- a/build/fuzzer/corpus/01228.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode_object escape
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01229.stmt b/build/fuzzer/corpus/01229.stmt
deleted file mode 100644
index 87ecbef75a..0000000000
--- a/build/fuzzer/corpus/01229.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode_object({"a": "c=b+1"}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01230.stmt b/build/fuzzer/corpus/01230.stmt
deleted file mode 100644
index b2e76e0676..0000000000
--- a/build/fuzzer/corpus/01230.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"a=c%3Db%2B1"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01231.stmt b/build/fuzzer/corpus/01231.stmt
deleted file mode 100644
index 2bb520659c..0000000000
--- a/build/fuzzer/corpus/01231.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode_object array
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01232.stmt b/build/fuzzer/corpus/01232.stmt
deleted file mode 100644
index 1c9a04f410..0000000000
--- a/build/fuzzer/corpus/01232.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode_object({"a": ["b+1","c+2"]}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01233.stmt b/build/fuzzer/corpus/01233.stmt
deleted file mode 100644
index d74c6f9e7a..0000000000
--- a/build/fuzzer/corpus/01233.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"a=b%2B1&a=c%2B2"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01234.stmt b/build/fuzzer/corpus/01234.stmt
deleted file mode 100644
index f639a994a7..0000000000
--- a/build/fuzzer/corpus/01234.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encode_object set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01235.stmt b/build/fuzzer/corpus/01235.stmt
deleted file mode 100644
index 296468621a..0000000000
--- a/build/fuzzer/corpus/01235.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { urlquery.encode_object({"a": {"b+1"}}, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01236.stmt b/build/fuzzer/corpus/01236.stmt
deleted file mode 100644
index 995b523d31..0000000000
--- a/build/fuzzer/corpus/01236.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"a=b%2B1"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01237.stmt b/build/fuzzer/corpus/01237.stmt
deleted file mode 100644
index 8fd32466da..0000000000
--- a/build/fuzzer/corpus/01237.stmt
+++ /dev/null
@@ -1 +0,0 @@
-simple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01238.stmt b/build/fuzzer/corpus/01238.stmt
deleted file mode 100644
index f0785f9276..0000000000
--- a/build/fuzzer/corpus/01238.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwIiwiaXNzIjoib3BhIn0.XmVoLoHI3pxMtMO_WRONMSJzGUDP9pDjy8Jp0_tdRXY
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01239.stmt b/build/fuzzer/corpus/01239.stmt
deleted file mode 100644
index 3b13ce862b..0000000000
--- a/build/fuzzer/corpus/01239.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "alg": "HS256", "typ": "JWT" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01240.stmt b/build/fuzzer/corpus/01240.stmt
deleted file mode 100644
index f7ebeecdcb..0000000000
--- a/build/fuzzer/corpus/01240.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "sub": "0", "iss": "opa" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01241.stmt b/build/fuzzer/corpus/01241.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01242.stmt b/build/fuzzer/corpus/01242.stmt
deleted file mode 100644
index a9c8fc6ba9..0000000000
--- a/build/fuzzer/corpus/01242.stmt
+++ /dev/null
@@ -1 +0,0 @@
-simple-non-registered
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01243.stmt b/build/fuzzer/corpus/01243.stmt
deleted file mode 100644
index 3b13ce862b..0000000000
--- a/build/fuzzer/corpus/01243.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "alg": "HS256", "typ": "JWT" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01244.stmt b/build/fuzzer/corpus/01244.stmt
deleted file mode 100644
index f86a273f48..0000000000
--- a/build/fuzzer/corpus/01244.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "new": "I am a user created field", "iss": "opa" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01245.stmt b/build/fuzzer/corpus/01245.stmt
deleted file mode 100644
index c6b7c273cc..0000000000
--- a/build/fuzzer/corpus/01245.stmt
+++ /dev/null
@@ -1 +0,0 @@
-e949a3b1c9550c60fd8dc997fc5f112735601ed519b8bbb6a71905fd41100ab1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01246.stmt b/build/fuzzer/corpus/01246.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01247.stmt b/build/fuzzer/corpus/01247.stmt
deleted file mode 100644
index cdb49b7088..0000000000
--- a/build/fuzzer/corpus/01247.stmt
+++ /dev/null
@@ -1 +0,0 @@
-no-support-jwe
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01248.stmt b/build/fuzzer/corpus/01248.stmt
deleted file mode 100644
index ece1f59a5e..0000000000
--- a/build/fuzzer/corpus/01248.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImVuYyI6ImJsYWgifQ.eyJuZXciOiJJIGFtIGEgdXNlciBjcmVhdGVkIGZpZWxkIiwiaXNzIjoib3BhIn0.McGUb1e-UviZKy6UyQErNNQzEUgeV25Buwk7OHOa8U8
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01249.stmt b/build/fuzzer/corpus/01249.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01250.stmt b/build/fuzzer/corpus/01250.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01251.stmt b/build/fuzzer/corpus/01251.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01252.stmt b/build/fuzzer/corpus/01252.stmt
deleted file mode 100644
index 73284b6c8d..0000000000
--- a/build/fuzzer/corpus/01252.stmt
+++ /dev/null
@@ -1 +0,0 @@
-no-periods
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01253.stmt b/build/fuzzer/corpus/01253.stmt
deleted file mode 100644
index db39a41fa4..0000000000
--- a/build/fuzzer/corpus/01253.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIwIiwiaXNzIjoib3BhIn0XmVoLoHI3pxMtMO_WRONMSJzGUDP9pDjy8Jp0_tdRXY
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01254.stmt b/build/fuzzer/corpus/01254.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01255.stmt b/build/fuzzer/corpus/01255.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01256.stmt b/build/fuzzer/corpus/01256.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01257.stmt b/build/fuzzer/corpus/01257.stmt
deleted file mode 100644
index 44cfd0e0ca..0000000000
--- a/build/fuzzer/corpus/01257.stmt
+++ /dev/null
@@ -1 +0,0 @@
-encoded JWT had no period separators
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01258.stmt b/build/fuzzer/corpus/01258.stmt
deleted file mode 100644
index 6205053a4b..0000000000
--- a/build/fuzzer/corpus/01258.stmt
+++ /dev/null
@@ -1 +0,0 @@
-wrong-period-count
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01259.stmt b/build/fuzzer/corpus/01259.stmt
deleted file mode 100644
index 2f9b6b6261..0000000000
--- a/build/fuzzer/corpus/01259.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXV.CJ9eyJzdWIiOiIwIiwiaXNzIjoib3BhIn0XmVoLoHI3pxMtMO_WRONMSJzGUDP9pDjy8Jp0_tdRXY
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01260.stmt b/build/fuzzer/corpus/01260.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01261.stmt b/build/fuzzer/corpus/01261.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01262.stmt b/build/fuzzer/corpus/01262.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01263.stmt b/build/fuzzer/corpus/01263.stmt
deleted file mode 100644
index e4d287d7be..0000000000
--- a/build/fuzzer/corpus/01263.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bad-header-encoding
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01264.stmt b/build/fuzzer/corpus/01264.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01265.stmt b/build/fuzzer/corpus/01265.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01266.stmt b/build/fuzzer/corpus/01266.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01267.stmt b/build/fuzzer/corpus/01267.stmt
deleted file mode 100644
index ae98b9c394..0000000000
--- a/build/fuzzer/corpus/01267.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bad-payload-encoding
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01268.stmt b/build/fuzzer/corpus/01268.stmt
deleted file mode 100644
index f49d2fc25a..0000000000
--- a/build/fuzzer/corpus/01268.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwIiwia/XNzIjoib3BhIn0.XmVoLoHI3pxMtMO_WRONMSJzGUDP9pDjy8Jp0_tdRXY
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01269.stmt b/build/fuzzer/corpus/01269.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01270.stmt b/build/fuzzer/corpus/01270.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01271.stmt b/build/fuzzer/corpus/01271.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01272.stmt b/build/fuzzer/corpus/01272.stmt
deleted file mode 100644
index a23b329b84..0000000000
--- a/build/fuzzer/corpus/01272.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bad-signature-encoding
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01273.stmt b/build/fuzzer/corpus/01273.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01274.stmt b/build/fuzzer/corpus/01274.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01275.stmt b/build/fuzzer/corpus/01275.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01276.stmt b/build/fuzzer/corpus/01276.stmt
deleted file mode 100644
index bfe53d766e..0000000000
--- a/build/fuzzer/corpus/01276.stmt
+++ /dev/null
@@ -1 +0,0 @@
-nested
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01277.stmt b/build/fuzzer/corpus/01277.stmt
deleted file mode 100644
index 3b13ce862b..0000000000
--- a/build/fuzzer/corpus/01277.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "alg": "HS256", "typ": "JWT" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01278.stmt b/build/fuzzer/corpus/01278.stmt
deleted file mode 100644
index f7ebeecdcb..0000000000
--- a/build/fuzzer/corpus/01278.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "sub": "0", "iss": "opa" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01279.stmt b/build/fuzzer/corpus/01279.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01280.stmt b/build/fuzzer/corpus/01280.stmt
deleted file mode 100644
index ff8907b65d..0000000000
--- a/build/fuzzer/corpus/01280.stmt
+++ /dev/null
@@ -1 +0,0 @@
-double-nested
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01281.stmt b/build/fuzzer/corpus/01281.stmt
deleted file mode 100644
index 9861a98fb1..0000000000
--- a/build/fuzzer/corpus/01281.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImN0eSI6IkpXVCJ9.ImV5SmhiR2NpT2lKSVV6STFOaUlzSW5SNWNDSTZJa3BYVkNJc0ltTjBlU0k2SWtwWFZDSjkuSW1WNVNtaGlSMk5wVDJsS1NWVjZTVEZPYVVselNXNVNOV05EU1RaSmEzQllWa05LT1M1bGVVcDZaRmRKYVU5cFNYZEphWGRwWVZoT2VrbHFiMmxpTTBKb1NXNHdMbGh0Vm05TWIwaEpNM0I0VFhSTlQxOVhVazlPVFZOS2VrZFZSRkE1Y0VScWVUaEtjREJmZEdSU1dGa2kuOFcwcXg0bUx4c2xtWmw3d0VNVVdCeEg3dFNUM1hzRXVXWHhlc1hxRm5SSSI.U8rwnGAJ-bJoGrAYKEzNtbJQWd3x1eW0Y25nLKHDCgo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01282.stmt b/build/fuzzer/corpus/01282.stmt
deleted file mode 100644
index 3b13ce862b..0000000000
--- a/build/fuzzer/corpus/01282.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "alg": "HS256", "typ": "JWT" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01283.stmt b/build/fuzzer/corpus/01283.stmt
deleted file mode 100644
index f7ebeecdcb..0000000000
--- a/build/fuzzer/corpus/01283.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "sub": "0", "iss": "opa" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01284.stmt b/build/fuzzer/corpus/01284.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01285.stmt b/build/fuzzer/corpus/01285.stmt
deleted file mode 100644
index 0a619e2ab3..0000000000
--- a/build/fuzzer/corpus/01285.stmt
+++ /dev/null
@@ -1 +0,0 @@
-complex-values
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01286.stmt b/build/fuzzer/corpus/01286.stmt
deleted file mode 100644
index a3a0d83335..0000000000
--- a/build/fuzzer/corpus/01286.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwIiwiaXNzIjoib3BhIiwiZXh0Ijp7ImFiYyI6IjEyMyIsImNiYSI6WzEwLCIxMCJdfX0.IIxF-uJ6i4K5Dj71xNLnUeqB9jmujl6ujTInhii1PxE
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01287.stmt b/build/fuzzer/corpus/01287.stmt
deleted file mode 100644
index 3b13ce862b..0000000000
--- a/build/fuzzer/corpus/01287.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "alg": "HS256", "typ": "JWT" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01288.stmt b/build/fuzzer/corpus/01288.stmt
deleted file mode 100644
index 9d78fc402f..0000000000
--- a/build/fuzzer/corpus/01288.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "sub": "0", "iss": "opa", "ext": { "abc": "123", "cba": [10, "10"] } }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01289.stmt b/build/fuzzer/corpus/01289.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01290.stmt b/build/fuzzer/corpus/01290.stmt
deleted file mode 100644
index cab5c3a2d2..0000000000
--- a/build/fuzzer/corpus/01290.stmt
+++ /dev/null
@@ -1 +0,0 @@
-duplicate-keys
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01291.stmt b/build/fuzzer/corpus/01291.stmt
deleted file mode 100644
index e99784a6c5..0000000000
--- a/build/fuzzer/corpus/01291.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiAiMCIsImlzcyI6ICJub3Qgb3BhIiwgImlzcyI6ICJhbHNvIG5vdCBvcGEiLCAiaXNzIjogIm9wYSJ9.XmVoLoHI3pxMtMO_WRONMSJzGUDP9pDjy8Jp0_tdRXY
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01292.stmt b/build/fuzzer/corpus/01292.stmt
deleted file mode 100644
index 3b13ce862b..0000000000
--- a/build/fuzzer/corpus/01292.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "alg": "HS256", "typ": "JWT" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01293.stmt b/build/fuzzer/corpus/01293.stmt
deleted file mode 100644
index f7ebeecdcb..0000000000
--- a/build/fuzzer/corpus/01293.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{ "sub": "0", "iss": "opa" }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01294.stmt b/build/fuzzer/corpus/01294.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01295.stmt b/build/fuzzer/corpus/01295.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01296.stmt b/build/fuzzer/corpus/01296.stmt
deleted file mode 100644
index 23effb1d42..0000000000
--- a/build/fuzzer/corpus/01296.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = [x, y, z] { io.jwt.decode("%s", [x, y, z]) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01297.stmt b/build/fuzzer/corpus/01297.stmt
deleted file mode 100644
index 0f0c913d55..0000000000
--- a/build/fuzzer/corpus/01297.stmt
+++ /dev/null
@@ -1 +0,0 @@
-success
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01298.stmt b/build/fuzzer/corpus/01298.stmt
deleted file mode 100644
index c3c22722ff..0000000000
--- a/build/fuzzer/corpus/01298.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01299.stmt b/build/fuzzer/corpus/01299.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01300.stmt b/build/fuzzer/corpus/01300.stmt
deleted file mode 100644
index f7bf866899..0000000000
--- a/build/fuzzer/corpus/01300.stmt
+++ /dev/null
@@ -1 +0,0 @@
-success-ps256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01301.stmt b/build/fuzzer/corpus/01301.stmt
deleted file mode 100644
index d0764de0c2..0000000000
--- a/build/fuzzer/corpus/01301.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01302.stmt b/build/fuzzer/corpus/01302.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01303.stmt b/build/fuzzer/corpus/01303.stmt
deleted file mode 100644
index 8f7ce480ae..0000000000
--- a/build/fuzzer/corpus/01303.stmt
+++ /dev/null
@@ -1 +0,0 @@
-success-es256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01304.stmt b/build/fuzzer/corpus/01304.stmt
deleted file mode 100644
index e777dd9ca1..0000000000
--- a/build/fuzzer/corpus/01304.stmt
+++ /dev/null
@@ -1 +0,0 @@
-es256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01305.stmt b/build/fuzzer/corpus/01305.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01306.stmt b/build/fuzzer/corpus/01306.stmt
deleted file mode 100644
index 88c098532b..0000000000
--- a/build/fuzzer/corpus/01306.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-bad token
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01307.stmt b/build/fuzzer/corpus/01307.stmt
deleted file mode 100644
index c3c22722ff..0000000000
--- a/build/fuzzer/corpus/01307.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01308.stmt b/build/fuzzer/corpus/01308.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01309.stmt b/build/fuzzer/corpus/01309.stmt
deleted file mode 100644
index 49020cfefd..0000000000
--- a/build/fuzzer/corpus/01309.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-wrong key
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01310.stmt b/build/fuzzer/corpus/01310.stmt
deleted file mode 100644
index d0764de0c2..0000000000
--- a/build/fuzzer/corpus/01310.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01311.stmt b/build/fuzzer/corpus/01311.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01312.stmt b/build/fuzzer/corpus/01312.stmt
deleted file mode 100644
index acd85ded12..0000000000
--- a/build/fuzzer/corpus/01312.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-wrong alg
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01313.stmt b/build/fuzzer/corpus/01313.stmt
deleted file mode 100644
index d0764de0c2..0000000000
--- a/build/fuzzer/corpus/01313.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01314.stmt b/build/fuzzer/corpus/01314.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01315.stmt b/build/fuzzer/corpus/01315.stmt
deleted file mode 100644
index 97bce18842..0000000000
--- a/build/fuzzer/corpus/01315.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-invalid token
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01316.stmt b/build/fuzzer/corpus/01316.stmt
deleted file mode 100644
index c3c22722ff..0000000000
--- a/build/fuzzer/corpus/01316.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01317.stmt b/build/fuzzer/corpus/01317.stmt
deleted file mode 100644
index c27c18d7bb..0000000000
--- a/build/fuzzer/corpus/01317.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJuYmYiOjE0NDQ0Nzg0MDB9
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01318.stmt b/build/fuzzer/corpus/01318.stmt
deleted file mode 100644
index 3e1f6dd5b4..0000000000
--- a/build/fuzzer/corpus/01318.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-bad cert
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01319.stmt b/build/fuzzer/corpus/01319.stmt
deleted file mode 100644
index c3c22722ff..0000000000
--- a/build/fuzzer/corpus/01319.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01320.stmt b/build/fuzzer/corpus/01320.stmt
deleted file mode 100644
index 1099f85302..0000000000
--- a/build/fuzzer/corpus/01320.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failed to decode PEM block containing certificate
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01321.stmt b/build/fuzzer/corpus/01321.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01322.stmt b/build/fuzzer/corpus/01322.stmt
deleted file mode 100644
index 9ab0365063..0000000000
--- a/build/fuzzer/corpus/01322.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { io.jwt.verify_%s("%s", "%s", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01323.stmt b/build/fuzzer/corpus/01323.stmt
deleted file mode 100644
index 0f0c913d55..0000000000
--- a/build/fuzzer/corpus/01323.stmt
+++ /dev/null
@@ -1 +0,0 @@
-success
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01324.stmt b/build/fuzzer/corpus/01324.stmt
deleted file mode 100644
index 9f716e332b..0000000000
--- a/build/fuzzer/corpus/01324.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0.rz3jTY033z-NrKfwrK89_dcLF7TN4gwCMj-fVBDyLoM
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01325.stmt b/build/fuzzer/corpus/01325.stmt
deleted file mode 100644
index 536aca34db..0000000000
--- a/build/fuzzer/corpus/01325.stmt
+++ /dev/null
@@ -1 +0,0 @@
-secret
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01326.stmt b/build/fuzzer/corpus/01326.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01327.stmt b/build/fuzzer/corpus/01327.stmt
deleted file mode 100644
index 88c098532b..0000000000
--- a/build/fuzzer/corpus/01327.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-bad token
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01328.stmt b/build/fuzzer/corpus/01328.stmt
deleted file mode 100644
index 63c4c44fcc..0000000000
--- a/build/fuzzer/corpus/01328.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0.R0NDxM1gHTucWQKwayMDre2PbMNR9K9efmOfygDZWcE
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01329.stmt b/build/fuzzer/corpus/01329.stmt
deleted file mode 100644
index 536aca34db..0000000000
--- a/build/fuzzer/corpus/01329.stmt
+++ /dev/null
@@ -1 +0,0 @@
-secret
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01330.stmt b/build/fuzzer/corpus/01330.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01331.stmt b/build/fuzzer/corpus/01331.stmt
deleted file mode 100644
index 97bce18842..0000000000
--- a/build/fuzzer/corpus/01331.stmt
+++ /dev/null
@@ -1 +0,0 @@
-failure-invalid token
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01332.stmt b/build/fuzzer/corpus/01332.stmt
deleted file mode 100644
index 5b5c8b8628..0000000000
--- a/build/fuzzer/corpus/01332.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01333.stmt b/build/fuzzer/corpus/01333.stmt
deleted file mode 100644
index 536aca34db..0000000000
--- a/build/fuzzer/corpus/01333.stmt
+++ /dev/null
@@ -1 +0,0 @@
-secret
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01334.stmt b/build/fuzzer/corpus/01334.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01335.stmt b/build/fuzzer/corpus/01335.stmt
deleted file mode 100644
index 6880b2ede1..0000000000
--- a/build/fuzzer/corpus/01335.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p = x { io.jwt.verify_hs256("%s", "%s", x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01336.stmt b/build/fuzzer/corpus/01336.stmt
deleted file mode 100644
index 57151a2dee..0000000000
--- a/build/fuzzer/corpus/01336.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-unconstrained
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01337.stmt b/build/fuzzer/corpus/01337.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01337.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01338.stmt b/build/fuzzer/corpus/01338.stmt
deleted file mode 100644
index 7019863fad..0000000000
--- a/build/fuzzer/corpus/01338.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "PS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01339.stmt b/build/fuzzer/corpus/01339.stmt
deleted file mode 100644
index 6294da2fc9..0000000000
--- a/build/fuzzer/corpus/01339.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01340.stmt b/build/fuzzer/corpus/01340.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01341.stmt b/build/fuzzer/corpus/01341.stmt
deleted file mode 100644
index 861a0d245f..0000000000
--- a/build/fuzzer/corpus/01341.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-key-wrong
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01342.stmt b/build/fuzzer/corpus/01342.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01342.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01343.stmt b/build/fuzzer/corpus/01343.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01343.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01344.stmt b/build/fuzzer/corpus/01344.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01344.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01345.stmt b/build/fuzzer/corpus/01345.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01346.stmt b/build/fuzzer/corpus/01346.stmt
deleted file mode 100644
index 9341fd936d..0000000000
--- a/build/fuzzer/corpus/01346.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-key-wrong
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01347.stmt b/build/fuzzer/corpus/01347.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01347.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01348.stmt b/build/fuzzer/corpus/01348.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01348.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01349.stmt b/build/fuzzer/corpus/01349.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01349.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01350.stmt b/build/fuzzer/corpus/01350.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01351.stmt b/build/fuzzer/corpus/01351.stmt
deleted file mode 100644
index c899e45882..0000000000
--- a/build/fuzzer/corpus/01351.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-iss-ok
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01352.stmt b/build/fuzzer/corpus/01352.stmt
deleted file mode 100644
index 1316226139..0000000000
--- a/build/fuzzer/corpus/01352.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01353.stmt b/build/fuzzer/corpus/01353.stmt
deleted file mode 100644
index 7019863fad..0000000000
--- a/build/fuzzer/corpus/01353.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "PS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01354.stmt b/build/fuzzer/corpus/01354.stmt
deleted file mode 100644
index 6294da2fc9..0000000000
--- a/build/fuzzer/corpus/01354.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01355.stmt b/build/fuzzer/corpus/01355.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01356.stmt b/build/fuzzer/corpus/01356.stmt
deleted file mode 100644
index 111d67652d..0000000000
--- a/build/fuzzer/corpus/01356.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-iss-wrong
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01357.stmt b/build/fuzzer/corpus/01357.stmt
deleted file mode 100644
index 0af074c946..0000000000
--- a/build/fuzzer/corpus/01357.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "iss": "yyy"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01358.stmt b/build/fuzzer/corpus/01358.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01358.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01359.stmt b/build/fuzzer/corpus/01359.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01359.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01360.stmt b/build/fuzzer/corpus/01360.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01361.stmt b/build/fuzzer/corpus/01361.stmt
deleted file mode 100644
index dba57b9f11..0000000000
--- a/build/fuzzer/corpus/01361.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-alg-ok
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01362.stmt b/build/fuzzer/corpus/01362.stmt
deleted file mode 100644
index 015fd188ee..0000000000
--- a/build/fuzzer/corpus/01362.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "alg": "PS256"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01363.stmt b/build/fuzzer/corpus/01363.stmt
deleted file mode 100644
index 7019863fad..0000000000
--- a/build/fuzzer/corpus/01363.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "PS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01364.stmt b/build/fuzzer/corpus/01364.stmt
deleted file mode 100644
index 6294da2fc9..0000000000
--- a/build/fuzzer/corpus/01364.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01365.stmt b/build/fuzzer/corpus/01365.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01366.stmt b/build/fuzzer/corpus/01366.stmt
deleted file mode 100644
index 73cc22cdb5..0000000000
--- a/build/fuzzer/corpus/01366.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-alg-wrong
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01367.stmt b/build/fuzzer/corpus/01367.stmt
deleted file mode 100644
index e64e76cbda..0000000000
--- a/build/fuzzer/corpus/01367.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "alg": "RS256"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01368.stmt b/build/fuzzer/corpus/01368.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01368.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01369.stmt b/build/fuzzer/corpus/01369.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01369.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01370.stmt b/build/fuzzer/corpus/01370.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01371.stmt b/build/fuzzer/corpus/01371.stmt
deleted file mode 100644
index 1430383159..0000000000
--- a/build/fuzzer/corpus/01371.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-exp-ok
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01372.stmt b/build/fuzzer/corpus/01372.stmt
deleted file mode 100644
index 1a4424dd14..0000000000
--- a/build/fuzzer/corpus/01372.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "time": 2000000000000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01373.stmt b/build/fuzzer/corpus/01373.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01373.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01374.stmt b/build/fuzzer/corpus/01374.stmt
deleted file mode 100644
index 010866fd32..0000000000
--- a/build/fuzzer/corpus/01374.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx", "exp": 3000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01375.stmt b/build/fuzzer/corpus/01375.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01376.stmt b/build/fuzzer/corpus/01376.stmt
deleted file mode 100644
index 7cf3449403..0000000000
--- a/build/fuzzer/corpus/01376.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-exp-expired
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01377.stmt b/build/fuzzer/corpus/01377.stmt
deleted file mode 100644
index be0179050b..0000000000
--- a/build/fuzzer/corpus/01377.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "time": 4000000000000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01378.stmt b/build/fuzzer/corpus/01378.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01378.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01379.stmt b/build/fuzzer/corpus/01379.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01379.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01380.stmt b/build/fuzzer/corpus/01380.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01381.stmt b/build/fuzzer/corpus/01381.stmt
deleted file mode 100644
index 6808baaf7e..0000000000
--- a/build/fuzzer/corpus/01381.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-exp-now-expired
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01382.stmt b/build/fuzzer/corpus/01382.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01382.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01383.stmt b/build/fuzzer/corpus/01383.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01383.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01384.stmt b/build/fuzzer/corpus/01384.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01384.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01385.stmt b/build/fuzzer/corpus/01385.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01386.stmt b/build/fuzzer/corpus/01386.stmt
deleted file mode 100644
index 05a049cca8..0000000000
--- a/build/fuzzer/corpus/01386.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-exp-now-explicit-expired
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01387.stmt b/build/fuzzer/corpus/01387.stmt
deleted file mode 100644
index c7adabbe6b..0000000000
--- a/build/fuzzer/corpus/01387.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "time": now}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01388.stmt b/build/fuzzer/corpus/01388.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01388.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01389.stmt b/build/fuzzer/corpus/01389.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01389.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01390.stmt b/build/fuzzer/corpus/01390.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01391.stmt b/build/fuzzer/corpus/01391.stmt
deleted file mode 100644
index c4d29db0e9..0000000000
--- a/build/fuzzer/corpus/01391.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-nbf-ok
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01392.stmt b/build/fuzzer/corpus/01392.stmt
deleted file mode 100644
index 16a511688b..0000000000
--- a/build/fuzzer/corpus/01392.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiAiUlMyNTYiLCAidHlwIjogIkpXVCJ9.eyJuYmYiOiAxMDAwLCAiaXNzIjogInh4eCJ9.cwwYDfJhU_ambPIpwBJwDek05miffoudprr41IAYsl0IKekb1ii2uEgwkNM-LJtVXHe9hsK3gANFyfqoJuCZIBvaNMx_3Z0BUdeBs4k1UwBiZCpuud0ofgHKURwvehNgqDvRfchq_-K_Agi2iRdl0oShgLjN-gVbBl8pRwUbQrvASlcsCpZIKUyOzXNtaIZEFh1z6ISDy8UHHOdoieKpN23swya7QAcEb0wXEEKMkkhiRd5QHgWLk37Lnw2K89mKcq4Om0CtV9nHrxxmpYGSMPojCy16Gjdg5-xKyJWvxCfb3YUBUVM4RWa7ICOPRJWPuHxu9pPYG63hb_qDU6NLsw
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01393.stmt b/build/fuzzer/corpus/01393.stmt
deleted file mode 100644
index 1a4424dd14..0000000000
--- a/build/fuzzer/corpus/01393.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "time": 2000000000000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01394.stmt b/build/fuzzer/corpus/01394.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01394.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01395.stmt b/build/fuzzer/corpus/01395.stmt
deleted file mode 100644
index 7c7be6dce4..0000000000
--- a/build/fuzzer/corpus/01395.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx", "nbf": 1000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01396.stmt b/build/fuzzer/corpus/01396.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01397.stmt b/build/fuzzer/corpus/01397.stmt
deleted file mode 100644
index e5e06bd6c1..0000000000
--- a/build/fuzzer/corpus/01397.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-nbf-now-ok
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01398.stmt b/build/fuzzer/corpus/01398.stmt
deleted file mode 100644
index 16a511688b..0000000000
--- a/build/fuzzer/corpus/01398.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiAiUlMyNTYiLCAidHlwIjogIkpXVCJ9.eyJuYmYiOiAxMDAwLCAiaXNzIjogInh4eCJ9.cwwYDfJhU_ambPIpwBJwDek05miffoudprr41IAYsl0IKekb1ii2uEgwkNM-LJtVXHe9hsK3gANFyfqoJuCZIBvaNMx_3Z0BUdeBs4k1UwBiZCpuud0ofgHKURwvehNgqDvRfchq_-K_Agi2iRdl0oShgLjN-gVbBl8pRwUbQrvASlcsCpZIKUyOzXNtaIZEFh1z6ISDy8UHHOdoieKpN23swya7QAcEb0wXEEKMkkhiRd5QHgWLk37Lnw2K89mKcq4Om0CtV9nHrxxmpYGSMPojCy16Gjdg5-xKyJWvxCfb3YUBUVM4RWa7ICOPRJWPuHxu9pPYG63hb_qDU6NLsw
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01399.stmt b/build/fuzzer/corpus/01399.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01399.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01400.stmt b/build/fuzzer/corpus/01400.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01400.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01401.stmt b/build/fuzzer/corpus/01401.stmt
deleted file mode 100644
index 7c7be6dce4..0000000000
--- a/build/fuzzer/corpus/01401.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx", "nbf": 1000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01402.stmt b/build/fuzzer/corpus/01402.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01403.stmt b/build/fuzzer/corpus/01403.stmt
deleted file mode 100644
index 3aefff417b..0000000000
--- a/build/fuzzer/corpus/01403.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-nbf-toosoon
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01404.stmt b/build/fuzzer/corpus/01404.stmt
deleted file mode 100644
index 16a511688b..0000000000
--- a/build/fuzzer/corpus/01404.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiAiUlMyNTYiLCAidHlwIjogIkpXVCJ9.eyJuYmYiOiAxMDAwLCAiaXNzIjogInh4eCJ9.cwwYDfJhU_ambPIpwBJwDek05miffoudprr41IAYsl0IKekb1ii2uEgwkNM-LJtVXHe9hsK3gANFyfqoJuCZIBvaNMx_3Z0BUdeBs4k1UwBiZCpuud0ofgHKURwvehNgqDvRfchq_-K_Agi2iRdl0oShgLjN-gVbBl8pRwUbQrvASlcsCpZIKUyOzXNtaIZEFh1z6ISDy8UHHOdoieKpN23swya7QAcEb0wXEEKMkkhiRd5QHgWLk37Lnw2K89mKcq4Om0CtV9nHrxxmpYGSMPojCy16Gjdg5-xKyJWvxCfb3YUBUVM4RWa7ICOPRJWPuHxu9pPYG63hb_qDU6NLsw
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01405.stmt b/build/fuzzer/corpus/01405.stmt
deleted file mode 100644
index 71d0c069e6..0000000000
--- a/build/fuzzer/corpus/01405.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "time": 500000000000}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01406.stmt b/build/fuzzer/corpus/01406.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01406.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01407.stmt b/build/fuzzer/corpus/01407.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01407.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01408.stmt b/build/fuzzer/corpus/01408.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01409.stmt b/build/fuzzer/corpus/01409.stmt
deleted file mode 100644
index bb4c37cf9f..0000000000
--- a/build/fuzzer/corpus/01409.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-alg-missing
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01410.stmt b/build/fuzzer/corpus/01410.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01410.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01411.stmt b/build/fuzzer/corpus/01411.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01411.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01412.stmt b/build/fuzzer/corpus/01412.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01412.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01413.stmt b/build/fuzzer/corpus/01413.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01414.stmt b/build/fuzzer/corpus/01414.stmt
deleted file mode 100644
index b184f1d852..0000000000
--- a/build/fuzzer/corpus/01414.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-crit-junk
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01415.stmt b/build/fuzzer/corpus/01415.stmt
deleted file mode 100644
index 7539a56d62..0000000000
--- a/build/fuzzer/corpus/01415.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJjcml0IjogWyJqdW5rIl0sICJraWQiOiAiazEiLCAiYWxnIjogIlJTMjU2IiwgInR5cCI6ICJKV1QiLCAianVuayI6ICJ4eHgifQ.eyJpc3MiOiAieHh4IiwgInN1YiI6ICJmcmVkIn0.YfoUpW5CgDBtxtBuOix3cdYJGT8cX9Mq7wOhIbjDK7eRQUsAmMY_0EQPh7bd7Yi1gLI3e11BKzguf2EHqAa1kbkHWwFniBO-RIi8q42v2uxC4lpEpIjfaaXB5XmsLfAXtYRqh0AObvbSho6VDXBP_Kn81nhIiE2yFbH14_jhRMSxDBs5ToSkXV-XJHw5bONP8NxPqEk9KF3ZJGzN7J_KoD6LjqfYai5K0eLNEIZh4C1WjTdmCKMR4K6ieZRQWZiSsnhSqLSQERir4n22G3QsdY7dOnCp-SS4VYu3V-PfsOSFMvQ-TTAN1geqMZ9A7k1CCLW0wxKBs-KCiYzmRTzwxA
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01416.stmt b/build/fuzzer/corpus/01416.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01416.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01417.stmt b/build/fuzzer/corpus/01417.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01417.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01418.stmt b/build/fuzzer/corpus/01418.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01418.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01419.stmt b/build/fuzzer/corpus/01419.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01420.stmt b/build/fuzzer/corpus/01420.stmt
deleted file mode 100644
index c9363ccf78..0000000000
--- a/build/fuzzer/corpus/01420.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rsa256-nested
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01421.stmt b/build/fuzzer/corpus/01421.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01421.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01422.stmt b/build/fuzzer/corpus/01422.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01422.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01423.stmt b/build/fuzzer/corpus/01423.stmt
deleted file mode 100644
index 6294da2fc9..0000000000
--- a/build/fuzzer/corpus/01423.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01424.stmt b/build/fuzzer/corpus/01424.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01425.stmt b/build/fuzzer/corpus/01425.stmt
deleted file mode 100644
index dc36a58955..0000000000
--- a/build/fuzzer/corpus/01425.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rsa256-nested2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01426.stmt b/build/fuzzer/corpus/01426.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01426.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01427.stmt b/build/fuzzer/corpus/01427.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01427.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01428.stmt b/build/fuzzer/corpus/01428.stmt
deleted file mode 100644
index 6294da2fc9..0000000000
--- a/build/fuzzer/corpus/01428.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01429.stmt b/build/fuzzer/corpus/01429.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01430.stmt b/build/fuzzer/corpus/01430.stmt
deleted file mode 100644
index 5571f56117..0000000000
--- a/build/fuzzer/corpus/01430.stmt
+++ /dev/null
@@ -1 +0,0 @@
-es256-unconstrained
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01431.stmt b/build/fuzzer/corpus/01431.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01431.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01432.stmt b/build/fuzzer/corpus/01432.stmt
deleted file mode 100644
index 5c2cc4c58a..0000000000
--- a/build/fuzzer/corpus/01432.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "ES256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01433.stmt b/build/fuzzer/corpus/01433.stmt
deleted file mode 100644
index 6294da2fc9..0000000000
--- a/build/fuzzer/corpus/01433.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01434.stmt b/build/fuzzer/corpus/01434.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01435.stmt b/build/fuzzer/corpus/01435.stmt
deleted file mode 100644
index 7509b515ca..0000000000
--- a/build/fuzzer/corpus/01435.stmt
+++ /dev/null
@@ -1 +0,0 @@
-hs256-unconstrained
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01436.stmt b/build/fuzzer/corpus/01436.stmt
deleted file mode 100644
index 9f716e332b..0000000000
--- a/build/fuzzer/corpus/01436.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0.rz3jTY033z-NrKfwrK89_dcLF7TN4gwCMj-fVBDyLoM
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01437.stmt b/build/fuzzer/corpus/01437.stmt
deleted file mode 100644
index e6eff7771e..0000000000
--- a/build/fuzzer/corpus/01437.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"secret": "secret"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01438.stmt b/build/fuzzer/corpus/01438.stmt
deleted file mode 100644
index 19bbca9221..0000000000
--- a/build/fuzzer/corpus/01438.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "HS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01439.stmt b/build/fuzzer/corpus/01439.stmt
deleted file mode 100644
index edc19afab3..0000000000
--- a/build/fuzzer/corpus/01439.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"user": "alice", "azp": "alice", "subordinates": [], "hr": false}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01440.stmt b/build/fuzzer/corpus/01440.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01441.stmt b/build/fuzzer/corpus/01441.stmt
deleted file mode 100644
index 81c2255c72..0000000000
--- a/build/fuzzer/corpus/01441.stmt
+++ /dev/null
@@ -1 +0,0 @@
-hs256-key-wrong
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01442.stmt b/build/fuzzer/corpus/01442.stmt
deleted file mode 100644
index 9f716e332b..0000000000
--- a/build/fuzzer/corpus/01442.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0.rz3jTY033z-NrKfwrK89_dcLF7TN4gwCMj-fVBDyLoM
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01443.stmt b/build/fuzzer/corpus/01443.stmt
deleted file mode 100644
index f560d166d4..0000000000
--- a/build/fuzzer/corpus/01443.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"secret": "the wrong key"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01444.stmt b/build/fuzzer/corpus/01444.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01444.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01445.stmt b/build/fuzzer/corpus/01445.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01445.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01446.stmt b/build/fuzzer/corpus/01446.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01447.stmt b/build/fuzzer/corpus/01447.stmt
deleted file mode 100644
index 98ba4463d4..0000000000
--- a/build/fuzzer/corpus/01447.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-aud
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01448.stmt b/build/fuzzer/corpus/01448.stmt
deleted file mode 100644
index 5da21f6b08..0000000000
--- a/build/fuzzer/corpus/01448.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "aud": "fred"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01449.stmt b/build/fuzzer/corpus/01449.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01449.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01450.stmt b/build/fuzzer/corpus/01450.stmt
deleted file mode 100644
index 51d4bcda65..0000000000
--- a/build/fuzzer/corpus/01450.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"aud": "fred", "iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01451.stmt b/build/fuzzer/corpus/01451.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01452.stmt b/build/fuzzer/corpus/01452.stmt
deleted file mode 100644
index f4b13a87f8..0000000000
--- a/build/fuzzer/corpus/01452.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-aud-list
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01453.stmt b/build/fuzzer/corpus/01453.stmt
deleted file mode 100644
index 89c15be61a..0000000000
--- a/build/fuzzer/corpus/01453.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "aud": "bob"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01454.stmt b/build/fuzzer/corpus/01454.stmt
deleted file mode 100644
index b294757555..0000000000
--- a/build/fuzzer/corpus/01454.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"alg": "RS256", "typ": "JWT"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01455.stmt b/build/fuzzer/corpus/01455.stmt
deleted file mode 100644
index 71771bece9..0000000000
--- a/build/fuzzer/corpus/01455.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"aud": ["fred", "bob"], "iss": "xxx"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01456.stmt b/build/fuzzer/corpus/01456.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01457.stmt b/build/fuzzer/corpus/01457.stmt
deleted file mode 100644
index c969573c25..0000000000
--- a/build/fuzzer/corpus/01457.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ps256-no-aud
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01458.stmt b/build/fuzzer/corpus/01458.stmt
deleted file mode 100644
index 43471d71b7..0000000000
--- a/build/fuzzer/corpus/01458.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "aud": "cath"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01459.stmt b/build/fuzzer/corpus/01459.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01459.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01460.stmt b/build/fuzzer/corpus/01460.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01460.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01461.stmt b/build/fuzzer/corpus/01461.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01462.stmt b/build/fuzzer/corpus/01462.stmt
deleted file mode 100644
index 010b206ba0..0000000000
--- a/build/fuzzer/corpus/01462.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-missing-aud
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01463.stmt b/build/fuzzer/corpus/01463.stmt
deleted file mode 100644
index 3565c4e906..0000000000
--- a/build/fuzzer/corpus/01463.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01464.stmt b/build/fuzzer/corpus/01464.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01464.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01465.stmt b/build/fuzzer/corpus/01465.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01465.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01466.stmt b/build/fuzzer/corpus/01466.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01467.stmt b/build/fuzzer/corpus/01467.stmt
deleted file mode 100644
index 85da52f40f..0000000000
--- a/build/fuzzer/corpus/01467.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-wrong-aud
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01468.stmt b/build/fuzzer/corpus/01468.stmt
deleted file mode 100644
index 43471d71b7..0000000000
--- a/build/fuzzer/corpus/01468.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "aud": "cath"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01469.stmt b/build/fuzzer/corpus/01469.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01469.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01470.stmt b/build/fuzzer/corpus/01470.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01470.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01471.stmt b/build/fuzzer/corpus/01471.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01472.stmt b/build/fuzzer/corpus/01472.stmt
deleted file mode 100644
index ee741428a6..0000000000
--- a/build/fuzzer/corpus/01472.stmt
+++ /dev/null
@@ -1 +0,0 @@
-rs256-wrong-aud-list
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01473.stmt b/build/fuzzer/corpus/01473.stmt
deleted file mode 100644
index 43471d71b7..0000000000
--- a/build/fuzzer/corpus/01473.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"cert": "%s", "aud": "cath"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01474.stmt b/build/fuzzer/corpus/01474.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01474.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01475.stmt b/build/fuzzer/corpus/01475.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01475.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01476.stmt b/build/fuzzer/corpus/01476.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01477.stmt b/build/fuzzer/corpus/01477.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01478.stmt b/build/fuzzer/corpus/01478.stmt
deleted file mode 100644
index 3a200bb09b..0000000000
--- a/build/fuzzer/corpus/01478.stmt
+++ /dev/null
@@ -1 +0,0 @@
-time caching
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01479.stmt b/build/fuzzer/corpus/01479.stmt
deleted file mode 100644
index 26db9f78d9..0000000000
--- a/build/fuzzer/corpus/01479.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-
-		p { time.now_ns(t0); test.sleep("10ms"); time.now_ns(t1); t1 = t2 }
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01480.stmt b/build/fuzzer/corpus/01480.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01480.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01481.stmt b/build/fuzzer/corpus/01481.stmt
deleted file mode 100644
index a3c487d197..0000000000
--- a/build/fuzzer/corpus/01481.stmt
+++ /dev/null
@@ -1 +0,0 @@
-parse nanos
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01482.stmt b/build/fuzzer/corpus/01482.stmt
deleted file mode 100644
index c0fe279ca1..0000000000
--- a/build/fuzzer/corpus/01482.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-
-		p = ns { time.parse_ns("2006-01-02T15:04:05Z07:00", "2017-06-02T19:00:00-07:00", ns) }
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01483.stmt b/build/fuzzer/corpus/01483.stmt
deleted file mode 100644
index cbb2856c47..0000000000
--- a/build/fuzzer/corpus/01483.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1496455200000000000
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01484.stmt b/build/fuzzer/corpus/01484.stmt
deleted file mode 100644
index edca47b7c8..0000000000
--- a/build/fuzzer/corpus/01484.stmt
+++ /dev/null
@@ -1 +0,0 @@
-parse rfc3339 nanos
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01485.stmt b/build/fuzzer/corpus/01485.stmt
deleted file mode 100644
index 5ee6aaaca9..0000000000
--- a/build/fuzzer/corpus/01485.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-
-		p = ns { time.parse_rfc3339_ns("2017-06-02T19:00:00-07:00", ns) }
-		
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01486.stmt b/build/fuzzer/corpus/01486.stmt
deleted file mode 100644
index cbb2856c47..0000000000
--- a/build/fuzzer/corpus/01486.stmt
+++ /dev/null
@@ -1 +0,0 @@
-1496455200000000000
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01487.stmt b/build/fuzzer/corpus/01487.stmt
deleted file mode 100644
index 243503e413..0000000000
--- a/build/fuzzer/corpus/01487.stmt
+++ /dev/null
@@ -1 +0,0 @@
-parse duration nanos
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01488.stmt b/build/fuzzer/corpus/01488.stmt
deleted file mode 100644
index db63dcdcef..0000000000
--- a/build/fuzzer/corpus/01488.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-
-		p = ns { time.parse_duration_ns("100ms", ns) }
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01489.stmt b/build/fuzzer/corpus/01489.stmt
deleted file mode 100644
index e2095ce5ac..0000000000
--- a/build/fuzzer/corpus/01489.stmt
+++ /dev/null
@@ -1 +0,0 @@
-100000000
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01490.stmt b/build/fuzzer/corpus/01490.stmt
deleted file mode 100644
index 81229b4a8e..0000000000
--- a/build/fuzzer/corpus/01490.stmt
+++ /dev/null
@@ -1 +0,0 @@
-date
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01491.stmt b/build/fuzzer/corpus/01491.stmt
deleted file mode 100644
index eeb055a67a..0000000000
--- a/build/fuzzer/corpus/01491.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = [year, month, day] { [year, month, day] := time.date(1517832000*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01492.stmt b/build/fuzzer/corpus/01492.stmt
deleted file mode 100644
index f9bc5ffea4..0000000000
--- a/build/fuzzer/corpus/01492.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2018, 2, 5]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01493.stmt b/build/fuzzer/corpus/01493.stmt
deleted file mode 100644
index 6c703bc547..0000000000
--- a/build/fuzzer/corpus/01493.stmt
+++ /dev/null
@@ -1 +0,0 @@
-date leap day
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01494.stmt b/build/fuzzer/corpus/01494.stmt
deleted file mode 100644
index 3705786520..0000000000
--- a/build/fuzzer/corpus/01494.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = [year, month, day] { [year, month, day] := time.date(1582977600*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01495.stmt b/build/fuzzer/corpus/01495.stmt
deleted file mode 100644
index 24875f6a69..0000000000
--- a/build/fuzzer/corpus/01495.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2020, 2, 29]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01496.stmt b/build/fuzzer/corpus/01496.stmt
deleted file mode 100644
index d2570c8b40..0000000000
--- a/build/fuzzer/corpus/01496.stmt
+++ /dev/null
@@ -1 +0,0 @@
-date too big
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01497.stmt b/build/fuzzer/corpus/01497.stmt
deleted file mode 100644
index 17acb921ee..0000000000
--- a/build/fuzzer/corpus/01497.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = [year, month, day] { [year, month, day] := time.date(1582977600*1000*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01498.stmt b/build/fuzzer/corpus/01498.stmt
deleted file mode 100644
index 139289cc44..0000000000
--- a/build/fuzzer/corpus/01498.stmt
+++ /dev/null
@@ -1 +0,0 @@
-timestamp too big
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01499.stmt b/build/fuzzer/corpus/01499.stmt
deleted file mode 100644
index db1fed522e..0000000000
--- a/build/fuzzer/corpus/01499.stmt
+++ /dev/null
@@ -1 +0,0 @@
-clock
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01500.stmt b/build/fuzzer/corpus/01500.stmt
deleted file mode 100644
index 504252eb78..0000000000
--- a/build/fuzzer/corpus/01500.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = [hour, minute, second] { [hour, minute, second] := time.clock(1517832000*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01501.stmt b/build/fuzzer/corpus/01501.stmt
deleted file mode 100644
index 90fe334100..0000000000
--- a/build/fuzzer/corpus/01501.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[12, 0, 0]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01502.stmt b/build/fuzzer/corpus/01502.stmt
deleted file mode 100644
index 4fddb3c537..0000000000
--- a/build/fuzzer/corpus/01502.stmt
+++ /dev/null
@@ -1 +0,0 @@
-clock leap day
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01503.stmt b/build/fuzzer/corpus/01503.stmt
deleted file mode 100644
index 7fdbff7e05..0000000000
--- a/build/fuzzer/corpus/01503.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = [hour, minute, second] { [hour, minute, second] := time.clock(1582977600*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01504.stmt b/build/fuzzer/corpus/01504.stmt
deleted file mode 100644
index 90fe334100..0000000000
--- a/build/fuzzer/corpus/01504.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[12, 0, 0]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01505.stmt b/build/fuzzer/corpus/01505.stmt
deleted file mode 100644
index ef6ac6f4af..0000000000
--- a/build/fuzzer/corpus/01505.stmt
+++ /dev/null
@@ -1 +0,0 @@
-clock too big
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01506.stmt b/build/fuzzer/corpus/01506.stmt
deleted file mode 100644
index ee5d7d9cc7..0000000000
--- a/build/fuzzer/corpus/01506.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = [hour, minute, second] { [hour, minute, second] := time.clock(1582977600*1000*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01507.stmt b/build/fuzzer/corpus/01507.stmt
deleted file mode 100644
index 139289cc44..0000000000
--- a/build/fuzzer/corpus/01507.stmt
+++ /dev/null
@@ -1 +0,0 @@
-timestamp too big
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01508.stmt b/build/fuzzer/corpus/01508.stmt
deleted file mode 100644
index 12a65a56a0..0000000000
--- a/build/fuzzer/corpus/01508.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Monday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01509.stmt b/build/fuzzer/corpus/01509.stmt
deleted file mode 100644
index 776f41efc4..0000000000
--- a/build/fuzzer/corpus/01509.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Tuesday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01510.stmt b/build/fuzzer/corpus/01510.stmt
deleted file mode 100644
index 9f866d4576..0000000000
--- a/build/fuzzer/corpus/01510.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Wednesday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01511.stmt b/build/fuzzer/corpus/01511.stmt
deleted file mode 100644
index 200c7c6b5c..0000000000
--- a/build/fuzzer/corpus/01511.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Thursday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01512.stmt b/build/fuzzer/corpus/01512.stmt
deleted file mode 100644
index e43f260595..0000000000
--- a/build/fuzzer/corpus/01512.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Friday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01513.stmt b/build/fuzzer/corpus/01513.stmt
deleted file mode 100644
index 71d4609e01..0000000000
--- a/build/fuzzer/corpus/01513.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Saturday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01514.stmt b/build/fuzzer/corpus/01514.stmt
deleted file mode 100644
index d7c977775f..0000000000
--- a/build/fuzzer/corpus/01514.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Sunday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01515.stmt b/build/fuzzer/corpus/01515.stmt
deleted file mode 100644
index f742bee50f..0000000000
--- a/build/fuzzer/corpus/01515.stmt
+++ /dev/null
@@ -1 +0,0 @@
-weekday
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01516.stmt b/build/fuzzer/corpus/01516.stmt
deleted file mode 100644
index 982ae53e24..0000000000
--- a/build/fuzzer/corpus/01516.stmt
+++ /dev/null
@@ -1 +0,0 @@
-weekday too big
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01517.stmt b/build/fuzzer/corpus/01517.stmt
deleted file mode 100644
index 0f00b947f5..0000000000
--- a/build/fuzzer/corpus/01517.stmt
+++ /dev/null
@@ -1,2 +0,0 @@
-
-		p = weekday { weekday := time.weekday(1582977600*1000*1000*1000*1000) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01518.stmt b/build/fuzzer/corpus/01518.stmt
deleted file mode 100644
index 139289cc44..0000000000
--- a/build/fuzzer/corpus/01518.stmt
+++ /dev/null
@@ -1 +0,0 @@
-timestamp too big
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01519.stmt b/build/fuzzer/corpus/01519.stmt
deleted file mode 100644
index 3c9738537e..0000000000
--- a/build/fuzzer/corpus/01519.stmt
+++ /dev/null
@@ -1 +0,0 @@
-scalar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01520.stmt b/build/fuzzer/corpus/01520.stmt
deleted file mode 100644
index daa39ee679..0000000000
--- a/build/fuzzer/corpus/01520.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { walk(data.a[0], x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01521.stmt b/build/fuzzer/corpus/01521.stmt
deleted file mode 100644
index d7c02d8e87..0000000000
--- a/build/fuzzer/corpus/01521.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-[
-				[[], 1]
-			]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01522.stmt b/build/fuzzer/corpus/01522.stmt
deleted file mode 100644
index db02243073..0000000000
--- a/build/fuzzer/corpus/01522.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arrays
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01523.stmt b/build/fuzzer/corpus/01523.stmt
deleted file mode 100644
index 4ac3c450a4..0000000000
--- a/build/fuzzer/corpus/01523.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { walk(data.a, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01524.stmt b/build/fuzzer/corpus/01524.stmt
deleted file mode 100644
index af4e3b3de0..0000000000
--- a/build/fuzzer/corpus/01524.stmt
+++ /dev/null
@@ -1,7 +0,0 @@
-[
-				[[], [1,2,3,4]],
-				[[0], 1],
-				[[1], 2],
-				[[2], 3],
-				[[3], 4]
-			]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01525.stmt b/build/fuzzer/corpus/01525.stmt
deleted file mode 100644
index a4abb857a2..0000000000
--- a/build/fuzzer/corpus/01525.stmt
+++ /dev/null
@@ -1 +0,0 @@
-objects
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01526.stmt b/build/fuzzer/corpus/01526.stmt
deleted file mode 100644
index d077684ffd..0000000000
--- a/build/fuzzer/corpus/01526.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { walk(data.b, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01527.stmt b/build/fuzzer/corpus/01527.stmt
deleted file mode 100644
index 3137d3ad35..0000000000
--- a/build/fuzzer/corpus/01527.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-[
-				[[], {"v1": "hello", "v2": "goodbye"}],
-				[["v1"], "hello"],
-				[["v2"], "goodbye"]
-			]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01528.stmt b/build/fuzzer/corpus/01528.stmt
deleted file mode 100644
index 3ee6b04726..0000000000
--- a/build/fuzzer/corpus/01528.stmt
+++ /dev/null
@@ -1 +0,0 @@
-sets
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01529.stmt b/build/fuzzer/corpus/01529.stmt
deleted file mode 100644
index a8309a4866..0000000000
--- a/build/fuzzer/corpus/01529.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[x] { walk(q, x) }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01530.stmt b/build/fuzzer/corpus/01530.stmt
deleted file mode 100644
index 31ae12e3fc..0000000000
--- a/build/fuzzer/corpus/01530.stmt
+++ /dev/null
@@ -1 +0,0 @@
-q = {{1,2,3}} { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01531.stmt b/build/fuzzer/corpus/01531.stmt
deleted file mode 100644
index 424f669640..0000000000
--- a/build/fuzzer/corpus/01531.stmt
+++ /dev/null
@@ -1,7 +0,0 @@
-[
-				[[], [[1,2,3]]],
-				[[[1,2,3]], [1,2,3]],
-				[[[1,2,3], 1], 1],
-				[[[1,2,3], 2], 2],
-				[[[1,2,3], 3], 3]
-			]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01532.stmt b/build/fuzzer/corpus/01532.stmt
deleted file mode 100644
index 4373bfe848..0000000000
--- a/build/fuzzer/corpus/01532.stmt
+++ /dev/null
@@ -1 +0,0 @@
-match and filter
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01533.stmt b/build/fuzzer/corpus/01533.stmt
deleted file mode 100644
index d26e243a5c..0000000000
--- a/build/fuzzer/corpus/01533.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p[[k,x]] { walk(q, [k, x]); contains(k[1], "oo") }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01534.stmt b/build/fuzzer/corpus/01534.stmt
deleted file mode 100644
index 4505106c39..0000000000
--- a/build/fuzzer/corpus/01534.stmt
+++ /dev/null
@@ -1,7 +0,0 @@
-q = [
-					{
-						"foo": 1,
-						"bar": 2,
-						"bazoo": 3,
-					}
-				] { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01535.stmt b/build/fuzzer/corpus/01535.stmt
deleted file mode 100644
index dca306107e..0000000000
--- a/build/fuzzer/corpus/01535.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[[0, "foo"], 1], [[0, "bazoo"], 3]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01536.stmt b/build/fuzzer/corpus/01536.stmt
deleted file mode 100644
index 50d6f42062..0000000000
--- a/build/fuzzer/corpus/01536.stmt
+++ /dev/null
@@ -1 +0,0 @@
-partially ground path
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01537.stmt b/build/fuzzer/corpus/01537.stmt
deleted file mode 100644
index 228942ab30..0000000000
--- a/build/fuzzer/corpus/01537.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-p[[k1,k2,x]] {
-					walk(q, [["a", k1, "b", k2], x])
-				}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01538.stmt b/build/fuzzer/corpus/01538.stmt
deleted file mode 100644
index ad8b99a7e2..0000000000
--- a/build/fuzzer/corpus/01538.stmt
+++ /dev/null
@@ -1,11 +0,0 @@
-q = {
-					"a": [
-						{
-							"b": {"foo": 1, "bar": 2},
-						},
-						{
-							"b": {"baz": 3, "qux": 4},
-						}
-					]
-				} { true }
-				
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01539.stmt b/build/fuzzer/corpus/01539.stmt
deleted file mode 100644
index a533cf3687..0000000000
--- a/build/fuzzer/corpus/01539.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[[0, "foo", 1], [0, "bar", 2], [1, "baz", 3], [1, "qux", 4]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01540.stmt b/build/fuzzer/corpus/01540.stmt
deleted file mode 100644
index dce353f2a6..0000000000
--- a/build/fuzzer/corpus/01540.stmt
+++ /dev/null
@@ -1,7 +0,0 @@
-package b.c.d
-
-import data.a
-import data.g
-
-p[x] { a[i] = x; q[x] }
-q[x] { g[j][k] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01541.stmt b/build/fuzzer/corpus/01541.stmt
deleted file mode 100644
index 79e6ba6ffa..0000000000
--- a/build/fuzzer/corpus/01541.stmt
+++ /dev/null
@@ -1 +0,0 @@
-deep embedded vdoc
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01542.stmt b/build/fuzzer/corpus/01542.stmt
deleted file mode 100644
index 63d8dbd40c..0000000000
--- a/build/fuzzer/corpus/01542.stmt
+++ /dev/null
@@ -1 +0,0 @@
-b
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01543.stmt b/build/fuzzer/corpus/01543.stmt
deleted file mode 100644
index 3410062ba6..0000000000
--- a/build/fuzzer/corpus/01543.stmt
+++ /dev/null
@@ -1 +0,0 @@
-c
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01544.stmt b/build/fuzzer/corpus/01544.stmt
deleted file mode 100644
index c59d9b6344..0000000000
--- a/build/fuzzer/corpus/01544.stmt
+++ /dev/null
@@ -1 +0,0 @@
-d
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01545.stmt b/build/fuzzer/corpus/01545.stmt
deleted file mode 100644
index 4f6c4ee9d9..0000000000
--- a/build/fuzzer/corpus/01545.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01546.stmt b/build/fuzzer/corpus/01546.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01546.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01547.stmt b/build/fuzzer/corpus/01547.stmt
deleted file mode 100644
index d197cf48c3..0000000000
--- a/build/fuzzer/corpus/01547.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[1, 2, 4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01548.stmt b/build/fuzzer/corpus/01548.stmt
deleted file mode 100644
index f8066a2c9a..0000000000
--- a/build/fuzzer/corpus/01548.stmt
+++ /dev/null
@@ -1,18 +0,0 @@
-package z
-
-import data.a
-import input.req1
-import input.req2 as req2as
-import input.req3.a.b
-import input.req4.a.b as req4as
-
-p = true { a[i] = x; req1.foo = x; req2as.bar = x; q[x] }
-q[x] { req1.foo = x; req2as.bar = x; r[x] }
-r[x] { {"foo": req2as.bar, "bar": [x]} = {"foo": x, "bar": [req1.foo]} }
-s = true { b.x[0] = 1 }
-t = true { req4as.x[0] = 1 }
-u[x] { b[_] = x; x > 1 }
-w = [[1, 2], [3, 4]] { true }
-gt1 = true { req1 > 1 }
-keys[x] = y { data.numbers[_] = x; to_number(x, y) }
-loopback = input { true }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01549.stmt b/build/fuzzer/corpus/01549.stmt
deleted file mode 100644
index 5c227d789b..0000000000
--- a/build/fuzzer/corpus/01549.stmt
+++ /dev/null
@@ -1 +0,0 @@
-loopback
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01550.stmt b/build/fuzzer/corpus/01550.stmt
deleted file mode 100644
index fa7af8bf5f..0000000000
--- a/build/fuzzer/corpus/01550.stmt
+++ /dev/null
@@ -1 +0,0 @@
-z
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01551.stmt b/build/fuzzer/corpus/01551.stmt
deleted file mode 100644
index 5c227d789b..0000000000
--- a/build/fuzzer/corpus/01551.stmt
+++ /dev/null
@@ -1 +0,0 @@
-loopback
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01552.stmt b/build/fuzzer/corpus/01552.stmt
deleted file mode 100644
index 77bbe1e7d6..0000000000
--- a/build/fuzzer/corpus/01552.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"foo": 1}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01553.stmt b/build/fuzzer/corpus/01553.stmt
deleted file mode 100644
index 77bbe1e7d6..0000000000
--- a/build/fuzzer/corpus/01553.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"foo": 1}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01554.stmt b/build/fuzzer/corpus/01554.stmt
deleted file mode 100644
index de16678c9a..0000000000
--- a/build/fuzzer/corpus/01554.stmt
+++ /dev/null
@@ -1 +0,0 @@
-loopback undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01555.stmt b/build/fuzzer/corpus/01555.stmt
deleted file mode 100644
index fa7af8bf5f..0000000000
--- a/build/fuzzer/corpus/01555.stmt
+++ /dev/null
@@ -1 +0,0 @@
-z
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01556.stmt b/build/fuzzer/corpus/01556.stmt
deleted file mode 100644
index 5c227d789b..0000000000
--- a/build/fuzzer/corpus/01556.stmt
+++ /dev/null
@@ -1 +0,0 @@
-loopback
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01557.stmt b/build/fuzzer/corpus/01557.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01558.stmt b/build/fuzzer/corpus/01558.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01559.stmt b/build/fuzzer/corpus/01559.stmt
deleted file mode 100644
index 8fd32466da..0000000000
--- a/build/fuzzer/corpus/01559.stmt
+++ /dev/null
@@ -1 +0,0 @@
-simple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01560.stmt b/build/fuzzer/corpus/01560.stmt
deleted file mode 100644
index fa7af8bf5f..0000000000
--- a/build/fuzzer/corpus/01560.stmt
+++ /dev/null
@@ -1 +0,0 @@
-z
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01561.stmt b/build/fuzzer/corpus/01561.stmt
deleted file mode 100644
index 4f6c4ee9d9..0000000000
--- a/build/fuzzer/corpus/01561.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01562.stmt b/build/fuzzer/corpus/01562.stmt
deleted file mode 100644
index 3708182b24..0000000000
--- a/build/fuzzer/corpus/01562.stmt
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-		"req1": {"foo": 4},
-		"req2": {"bar": 4}
-	}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01563.stmt b/build/fuzzer/corpus/01563.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01563.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01564.stmt b/build/fuzzer/corpus/01564.stmt
deleted file mode 100644
index 6eab79a6ce..0000000000
--- a/build/fuzzer/corpus/01564.stmt
+++ /dev/null
@@ -1 +0,0 @@
-missing
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01565.stmt b/build/fuzzer/corpus/01565.stmt
deleted file mode 100644
index fa7af8bf5f..0000000000
--- a/build/fuzzer/corpus/01565.stmt
+++ /dev/null
@@ -1 +0,0 @@
-z
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01566.stmt b/build/fuzzer/corpus/01566.stmt
deleted file mode 100644
index 4f6c4ee9d9..0000000000
--- a/build/fuzzer/corpus/01566.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01567.stmt b/build/fuzzer/corpus/01567.stmt
deleted file mode 100644
index 3f5da1b520..0000000000
--- a/build/fuzzer/corpus/01567.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-		"req1": {"foo": 4}
-	}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01568.stmt b/build/fuzzer/corpus/01568.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01569.stmt b/build/fuzzer/corpus/01569.stmt
deleted file mode 100644
index 5d19471a69..0000000000
--- a/build/fuzzer/corpus/01569.stmt
+++ /dev/null
@@ -1 +0,0 @@
-namespaced
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01570.stmt b/build/fuzzer/corpus/01570.stmt
deleted file mode 100644
index fa7af8bf5f..0000000000
--- a/build/fuzzer/corpus/01570.stmt
+++ /dev/null
@@ -1 +0,0 @@
-z
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01571.stmt b/build/fuzzer/corpus/01571.stmt
deleted file mode 100644
index 2f259b79aa..0000000000
--- a/build/fuzzer/corpus/01571.stmt
+++ /dev/null
@@ -1 +0,0 @@
-s
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01572.stmt b/build/fuzzer/corpus/01572.stmt
deleted file mode 100644
index f7e827372d..0000000000
--- a/build/fuzzer/corpus/01572.stmt
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-		"req3": {
-			"a": {
-				"b": {
-					"x": [1,2,3,4]
-				}
-			}
-		}
-	}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01573.stmt b/build/fuzzer/corpus/01573.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01573.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01574.stmt b/build/fuzzer/corpus/01574.stmt
deleted file mode 100644
index fa7af8bf5f..0000000000
--- a/build/fuzzer/corpus/01574.stmt
+++ /dev/null
@@ -1 +0,0 @@
-z
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01575.stmt b/build/fuzzer/corpus/01575.stmt
deleted file mode 100644
index 32f64f4d83..0000000000
--- a/build/fuzzer/corpus/01575.stmt
+++ /dev/null
@@ -1 +0,0 @@
-t
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01576.stmt b/build/fuzzer/corpus/01576.stmt
deleted file mode 100644
index 0399d98980..0000000000
--- a/build/fuzzer/corpus/01576.stmt
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-		"req4": {
-			"a": {
-				"b": {
-					"x": [1,2,3,4]
-				}
-			}
-		}
-	}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01577.stmt b/build/fuzzer/corpus/01577.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01577.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01578.stmt b/build/fuzzer/corpus/01578.stmt
deleted file mode 100644
index 3dd9dd1b04..0000000000
--- a/build/fuzzer/corpus/01578.stmt
+++ /dev/null
@@ -1,14 +0,0 @@
-package ex
-
-		foo["bar"] = 0
-		foo["baz"] = 1
-		foo["*"] = [1, 2, 3] {
-			input.foo = 7
-		}
-
-		bar["x"]
-		bar["y"]
-		bar["*"] {
-			input.foo = 7
-		}
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01579.stmt b/build/fuzzer/corpus/01579.stmt
deleted file mode 100644
index 8fe1f853de..0000000000
--- a/build/fuzzer/corpus/01579.stmt
+++ /dev/null
@@ -1 +0,0 @@
-obj-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01580.stmt b/build/fuzzer/corpus/01580.stmt
deleted file mode 100644
index e882f35e8e..0000000000
--- a/build/fuzzer/corpus/01580.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.foo.bar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01581.stmt b/build/fuzzer/corpus/01581.stmt
deleted file mode 100644
index c227083464..0000000000
--- a/build/fuzzer/corpus/01581.stmt
+++ /dev/null
@@ -1 +0,0 @@
-0
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01582.stmt b/build/fuzzer/corpus/01582.stmt
deleted file mode 100644
index 08ab6675f1..0000000000
--- a/build/fuzzer/corpus/01582.stmt
+++ /dev/null
@@ -1 +0,0 @@
-obj
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01583.stmt b/build/fuzzer/corpus/01583.stmt
deleted file mode 100644
index 3295d3975a..0000000000
--- a/build/fuzzer/corpus/01583.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01584.stmt b/build/fuzzer/corpus/01584.stmt
deleted file mode 100644
index e63a8ec2e4..0000000000
--- a/build/fuzzer/corpus/01584.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"bar": 0, "baz": 1}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01585.stmt b/build/fuzzer/corpus/01585.stmt
deleted file mode 100644
index 2c6dc03af8..0000000000
--- a/build/fuzzer/corpus/01585.stmt
+++ /dev/null
@@ -1 +0,0 @@
-obj-all
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01586.stmt b/build/fuzzer/corpus/01586.stmt
deleted file mode 100644
index 3295d3975a..0000000000
--- a/build/fuzzer/corpus/01586.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.foo
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01587.stmt b/build/fuzzer/corpus/01587.stmt
deleted file mode 100644
index bc1b074262..0000000000
--- a/build/fuzzer/corpus/01587.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"foo": 7}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01588.stmt b/build/fuzzer/corpus/01588.stmt
deleted file mode 100644
index 4a94fa36f4..0000000000
--- a/build/fuzzer/corpus/01588.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"bar": 0, "baz": 1, "*": [1,2,3]}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01589.stmt b/build/fuzzer/corpus/01589.stmt
deleted file mode 100644
index add043236c..0000000000
--- a/build/fuzzer/corpus/01589.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01590.stmt b/build/fuzzer/corpus/01590.stmt
deleted file mode 100644
index 470d20bd3b..0000000000
--- a/build/fuzzer/corpus/01590.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.bar.x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01591.stmt b/build/fuzzer/corpus/01591.stmt
deleted file mode 100644
index 3403a0c7f4..0000000000
--- a/build/fuzzer/corpus/01591.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"x"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01592.stmt b/build/fuzzer/corpus/01592.stmt
deleted file mode 100644
index c2c88d097d..0000000000
--- a/build/fuzzer/corpus/01592.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01593.stmt b/build/fuzzer/corpus/01593.stmt
deleted file mode 100644
index 592e13df8e..0000000000
--- a/build/fuzzer/corpus/01593.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.bar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01594.stmt b/build/fuzzer/corpus/01594.stmt
deleted file mode 100644
index 497c12af4d..0000000000
--- a/build/fuzzer/corpus/01594.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["x", "y"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01595.stmt b/build/fuzzer/corpus/01595.stmt
deleted file mode 100644
index c905a7b92b..0000000000
--- a/build/fuzzer/corpus/01595.stmt
+++ /dev/null
@@ -1 +0,0 @@
-set-all
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01596.stmt b/build/fuzzer/corpus/01596.stmt
deleted file mode 100644
index 592e13df8e..0000000000
--- a/build/fuzzer/corpus/01596.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.bar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01597.stmt b/build/fuzzer/corpus/01597.stmt
deleted file mode 100644
index bc1b074262..0000000000
--- a/build/fuzzer/corpus/01597.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"foo": 7}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01598.stmt b/build/fuzzer/corpus/01598.stmt
deleted file mode 100644
index 8b2aeaac5a..0000000000
--- a/build/fuzzer/corpus/01598.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["x", "y", "*"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01599.stmt b/build/fuzzer/corpus/01599.stmt
deleted file mode 100644
index c13c574cf7..0000000000
--- a/build/fuzzer/corpus/01599.stmt
+++ /dev/null
@@ -1,126 +0,0 @@
-package ex
-
-		foo(x) = y {
-			split(x, "i", y)
-		}
-
-		bar[x] = y {
-			data.l[_].a = x
-			foo(x, y)
-		}
-
-		chain0(x) = y {
-			foo(x, y)
-		}
-
-		chain1(a) = b {
-			chain0(a, b)
-		}
-
-		chain2 = d {
-			chain1("fooibar", d)
-		}
-
-		cross(x) = [a, b] {
-			split(x, "i", y)
-			foo(y[1], b)
-			data.test.foo(y[2], a)
-		}
-
-		falsy_func(x) = false
-
-		falsy_func_else(x) = true { x = 1 } else = false { true }
-
-		falsy_undefined {
-			falsy_func(1)
-		}
-
-		falsy_negation {
-			not falsy_func(1)
-		}
-
-		falsy_else_value = falsy_func_else(2)
-
-		falsy_else_undefined {
-			falsy_func_else(2)
-		}
-
-		falsy_else_negation {
-			not falsy_func_else(2)
-		}
-
-		arrays([x, y]) = [a, b] {
-			foo(x, a)
-			foo(y, b)
-		}
-
-		arraysrule = y {
-			arrays(["hih", "foo"], y)
-		}
-
-		objects({"foo": x, "bar": y}) = z {
-			foo(x, a)
-			data.test.foo(y, b)
-			z = [a, b]
-		}
-
-		objectsrule = y {
-			objects({"foo": "hih", "bar": "hi ho"}, y)
-		}
-
-		refoutput = y {
-			foo("hih", z)
-			y = z[1]
-		}
-
-		void(x) {
-			x = "foo"
-		}
-
-		voidGood {
-			not void("bar", true)
-		}
-
-		voidBad {
-			void("bar", true)
-		}
-
-		multi(1, x) = y {
-			y = x
-		}
-
-		multi(2, x) = y {
-			a = 2*x
-			y = a+1
-		}
-
-		multi(3, x) = y {
-			y = x*10
-		}
-
-		multi("foo", x) = y {
-			y = "bar"
-		}
-
-		multi1 = y {
-			multi(1, 2, y)
-		}
-
-		multi2 = y {
-			multi(2, 2, y)
-		}
-
-		multi3 = y {
-			multi(3, 2, y)
-		}
-
-		multi4 = y {
-			multi("foo", 2, y)
-		}
-
-		always_true_fn(x)
-
-		always_true {
-			always_true_fn(1)
-		}
-		
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01600.stmt b/build/fuzzer/corpus/01600.stmt
deleted file mode 100644
index b4065fc43f..0000000000
--- a/build/fuzzer/corpus/01600.stmt
+++ /dev/null
@@ -1,25 +0,0 @@
-
-		package test
-
-		import data.ex
-
-		foo(x) = y {
-			trim(x, "h o", y)
-		}
-
-		cross = y {
-			ex.cross("hi, my name is foo", y)
-		}
-
-		multi("foo", x) = y {
-			y = x
-		}
-
-		multi("bar", x) = y {
-			y = "baz"
-		}
-
-		multi_cross_pkg = [y, z] {
-			multi("foo", "bar", y)
-			ex.multi(2, 1, z)
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01601.stmt b/build/fuzzer/corpus/01601.stmt
deleted file mode 100644
index ba2fb501b3..0000000000
--- a/build/fuzzer/corpus/01601.stmt
+++ /dev/null
@@ -1,6 +0,0 @@
-
-		package test
-
-		samepkg = y {
-			foo("how do you do?", y)
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01602.stmt b/build/fuzzer/corpus/01602.stmt
deleted file mode 100644
index ba79a3a0b8..0000000000
--- a/build/fuzzer/corpus/01602.stmt
+++ /dev/null
@@ -1,4 +0,0 @@
-
-		package test.l1.l3
-
-		g(x) = x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01603.stmt b/build/fuzzer/corpus/01603.stmt
deleted file mode 100644
index 0b657a6f51..0000000000
--- a/build/fuzzer/corpus/01603.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-
-		package test.l1.l2
-
-		p = true
-		f(x) = x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01604.stmt b/build/fuzzer/corpus/01604.stmt
deleted file mode 100644
index adda3ffaf6..0000000000
--- a/build/fuzzer/corpus/01604.stmt
+++ /dev/null
@@ -1,7 +0,0 @@
-
-		package test.omit_result
-
-		f(x) = x
-
-		p { f(1) }
-		
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01605.stmt b/build/fuzzer/corpus/01605.stmt
deleted file mode 100644
index d2ad149619..0000000000
--- a/build/fuzzer/corpus/01605.stmt
+++ /dev/null
@@ -1 +0,0 @@
-basic call
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01606.stmt b/build/fuzzer/corpus/01606.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01606.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01607.stmt b/build/fuzzer/corpus/01607.stmt
deleted file mode 100644
index ba0e162e1c..0000000000
--- a/build/fuzzer/corpus/01607.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01608.stmt b/build/fuzzer/corpus/01608.stmt
deleted file mode 100644
index ca56b59dbf..0000000000
--- a/build/fuzzer/corpus/01608.stmt
+++ /dev/null
@@ -1 +0,0 @@
-alice
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01609.stmt b/build/fuzzer/corpus/01609.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01610.stmt b/build/fuzzer/corpus/01610.stmt
deleted file mode 100644
index 6b929d8f3d..0000000000
--- a/build/fuzzer/corpus/01610.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["al", "ce"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01611.stmt b/build/fuzzer/corpus/01611.stmt
deleted file mode 100644
index c0af95f239..0000000000
--- a/build/fuzzer/corpus/01611.stmt
+++ /dev/null
@@ -1 +0,0 @@
-false result
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01612.stmt b/build/fuzzer/corpus/01612.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01612.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01613.stmt b/build/fuzzer/corpus/01613.stmt
deleted file mode 100644
index 4017565beb..0000000000
--- a/build/fuzzer/corpus/01613.stmt
+++ /dev/null
@@ -1 +0,0 @@
-falsy_undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01614.stmt b/build/fuzzer/corpus/01614.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01615.stmt b/build/fuzzer/corpus/01615.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01616.stmt b/build/fuzzer/corpus/01616.stmt
deleted file mode 100644
index 91300cd1bc..0000000000
--- a/build/fuzzer/corpus/01616.stmt
+++ /dev/null
@@ -1 +0,0 @@
-false result negation
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01617.stmt b/build/fuzzer/corpus/01617.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01617.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01618.stmt b/build/fuzzer/corpus/01618.stmt
deleted file mode 100644
index 158cd5d72b..0000000000
--- a/build/fuzzer/corpus/01618.stmt
+++ /dev/null
@@ -1 +0,0 @@
-falsy_negation
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01619.stmt b/build/fuzzer/corpus/01619.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01620.stmt b/build/fuzzer/corpus/01620.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01620.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01621.stmt b/build/fuzzer/corpus/01621.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01621.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01622.stmt b/build/fuzzer/corpus/01622.stmt
deleted file mode 100644
index 45d71bb949..0000000000
--- a/build/fuzzer/corpus/01622.stmt
+++ /dev/null
@@ -1 +0,0 @@
-falsy_else_value
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01623.stmt b/build/fuzzer/corpus/01623.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01624.stmt b/build/fuzzer/corpus/01624.stmt
deleted file mode 100644
index 02e4a84d62..0000000000
--- a/build/fuzzer/corpus/01624.stmt
+++ /dev/null
@@ -1 +0,0 @@
-false
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01625.stmt b/build/fuzzer/corpus/01625.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01625.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01626.stmt b/build/fuzzer/corpus/01626.stmt
deleted file mode 100644
index 08a53bd2bd..0000000000
--- a/build/fuzzer/corpus/01626.stmt
+++ /dev/null
@@ -1 +0,0 @@
-falsy_else_undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01627.stmt b/build/fuzzer/corpus/01627.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01628.stmt b/build/fuzzer/corpus/01628.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01629.stmt b/build/fuzzer/corpus/01629.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01629.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01630.stmt b/build/fuzzer/corpus/01630.stmt
deleted file mode 100644
index 42595b18b2..0000000000
--- a/build/fuzzer/corpus/01630.stmt
+++ /dev/null
@@ -1 +0,0 @@
-falsy_else_negation
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01631.stmt b/build/fuzzer/corpus/01631.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01632.stmt b/build/fuzzer/corpus/01632.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01632.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01633.stmt b/build/fuzzer/corpus/01633.stmt
deleted file mode 100644
index 2d96a912c2..0000000000
--- a/build/fuzzer/corpus/01633.stmt
+++ /dev/null
@@ -1 +0,0 @@
-chained
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01634.stmt b/build/fuzzer/corpus/01634.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01634.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01635.stmt b/build/fuzzer/corpus/01635.stmt
deleted file mode 100644
index c2d26fb2ca..0000000000
--- a/build/fuzzer/corpus/01635.stmt
+++ /dev/null
@@ -1 +0,0 @@
-chain2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01636.stmt b/build/fuzzer/corpus/01636.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01637.stmt b/build/fuzzer/corpus/01637.stmt
deleted file mode 100644
index a6ca513e1d..0000000000
--- a/build/fuzzer/corpus/01637.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["foo", "bar"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01638.stmt b/build/fuzzer/corpus/01638.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01638.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01639.stmt b/build/fuzzer/corpus/01639.stmt
deleted file mode 100644
index 982ae30cb6..0000000000
--- a/build/fuzzer/corpus/01639.stmt
+++ /dev/null
@@ -1 +0,0 @@
-cross
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01640.stmt b/build/fuzzer/corpus/01640.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01641.stmt b/build/fuzzer/corpus/01641.stmt
deleted file mode 100644
index d40b53cc9f..0000000000
--- a/build/fuzzer/corpus/01641.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["s f", [", my name "]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01642.stmt b/build/fuzzer/corpus/01642.stmt
deleted file mode 100644
index 43fc6275d5..0000000000
--- a/build/fuzzer/corpus/01642.stmt
+++ /dev/null
@@ -1 +0,0 @@
-array params
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01643.stmt b/build/fuzzer/corpus/01643.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01643.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01644.stmt b/build/fuzzer/corpus/01644.stmt
deleted file mode 100644
index 3375c8d94b..0000000000
--- a/build/fuzzer/corpus/01644.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arraysrule
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01645.stmt b/build/fuzzer/corpus/01645.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01646.stmt b/build/fuzzer/corpus/01646.stmt
deleted file mode 100644
index c49c51059e..0000000000
--- a/build/fuzzer/corpus/01646.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["h", "h"], ["foo"]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01647.stmt b/build/fuzzer/corpus/01647.stmt
deleted file mode 100644
index db905bd86a..0000000000
--- a/build/fuzzer/corpus/01647.stmt
+++ /dev/null
@@ -1 +0,0 @@
-object params
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01648.stmt b/build/fuzzer/corpus/01648.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01648.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01649.stmt b/build/fuzzer/corpus/01649.stmt
deleted file mode 100644
index 2626f47f3a..0000000000
--- a/build/fuzzer/corpus/01649.stmt
+++ /dev/null
@@ -1 +0,0 @@
-objectsrule
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01650.stmt b/build/fuzzer/corpus/01650.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01651.stmt b/build/fuzzer/corpus/01651.stmt
deleted file mode 100644
index a35d382ae6..0000000000
--- a/build/fuzzer/corpus/01651.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["h", "h"], "i"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01652.stmt b/build/fuzzer/corpus/01652.stmt
deleted file mode 100644
index 1c799b37bb..0000000000
--- a/build/fuzzer/corpus/01652.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref func output
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01653.stmt b/build/fuzzer/corpus/01653.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01653.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01654.stmt b/build/fuzzer/corpus/01654.stmt
deleted file mode 100644
index 8b5ebea03c..0000000000
--- a/build/fuzzer/corpus/01654.stmt
+++ /dev/null
@@ -1 +0,0 @@
-refoutput
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01655.stmt b/build/fuzzer/corpus/01655.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01656.stmt b/build/fuzzer/corpus/01656.stmt
deleted file mode 100644
index bf05caa3d5..0000000000
--- a/build/fuzzer/corpus/01656.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"h"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01657.stmt b/build/fuzzer/corpus/01657.stmt
deleted file mode 100644
index 5294efc37f..0000000000
--- a/build/fuzzer/corpus/01657.stmt
+++ /dev/null
@@ -1 +0,0 @@
-always_true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01658.stmt b/build/fuzzer/corpus/01658.stmt
deleted file mode 100644
index 55c1ccb448..0000000000
--- a/build/fuzzer/corpus/01658.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.always_true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01659.stmt b/build/fuzzer/corpus/01659.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01660.stmt b/build/fuzzer/corpus/01660.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01660.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01661.stmt b/build/fuzzer/corpus/01661.stmt
deleted file mode 100644
index 0d98c16c33..0000000000
--- a/build/fuzzer/corpus/01661.stmt
+++ /dev/null
@@ -1 +0,0 @@
-same package call
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01662.stmt b/build/fuzzer/corpus/01662.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01662.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01663.stmt b/build/fuzzer/corpus/01663.stmt
deleted file mode 100644
index d5bd3d616c..0000000000
--- a/build/fuzzer/corpus/01663.stmt
+++ /dev/null
@@ -1 +0,0 @@
-samepkg
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01664.stmt b/build/fuzzer/corpus/01664.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01665.stmt b/build/fuzzer/corpus/01665.stmt
deleted file mode 100644
index 50333cfa4a..0000000000
--- a/build/fuzzer/corpus/01665.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"w do you do?"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01666.stmt b/build/fuzzer/corpus/01666.stmt
deleted file mode 100644
index 0dd6ab2992..0000000000
--- a/build/fuzzer/corpus/01666.stmt
+++ /dev/null
@@ -1 +0,0 @@
-void good
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01667.stmt b/build/fuzzer/corpus/01667.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01667.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01668.stmt b/build/fuzzer/corpus/01668.stmt
deleted file mode 100644
index f2b8e41c7f..0000000000
--- a/build/fuzzer/corpus/01668.stmt
+++ /dev/null
@@ -1 +0,0 @@
-voidGood
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01669.stmt b/build/fuzzer/corpus/01669.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01670.stmt b/build/fuzzer/corpus/01670.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01670.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01671.stmt b/build/fuzzer/corpus/01671.stmt
deleted file mode 100644
index fb430584f7..0000000000
--- a/build/fuzzer/corpus/01671.stmt
+++ /dev/null
@@ -1 +0,0 @@
-void bad
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01672.stmt b/build/fuzzer/corpus/01672.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01672.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01673.stmt b/build/fuzzer/corpus/01673.stmt
deleted file mode 100644
index 9f4ecfb3fd..0000000000
--- a/build/fuzzer/corpus/01673.stmt
+++ /dev/null
@@ -1 +0,0 @@
-voidBad
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01674.stmt b/build/fuzzer/corpus/01674.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01675.stmt b/build/fuzzer/corpus/01675.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01676.stmt b/build/fuzzer/corpus/01676.stmt
deleted file mode 100644
index 1510888bdd..0000000000
--- a/build/fuzzer/corpus/01676.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01677.stmt b/build/fuzzer/corpus/01677.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01677.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01678.stmt b/build/fuzzer/corpus/01678.stmt
deleted file mode 100644
index 1510888bdd..0000000000
--- a/build/fuzzer/corpus/01678.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01679.stmt b/build/fuzzer/corpus/01679.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01680.stmt b/build/fuzzer/corpus/01680.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/01680.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01681.stmt b/build/fuzzer/corpus/01681.stmt
deleted file mode 100644
index 78322deaad..0000000000
--- a/build/fuzzer/corpus/01681.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01682.stmt b/build/fuzzer/corpus/01682.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01682.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01683.stmt b/build/fuzzer/corpus/01683.stmt
deleted file mode 100644
index 78322deaad..0000000000
--- a/build/fuzzer/corpus/01683.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01684.stmt b/build/fuzzer/corpus/01684.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01685.stmt b/build/fuzzer/corpus/01685.stmt
deleted file mode 100644
index 7813681f5b..0000000000
--- a/build/fuzzer/corpus/01685.stmt
+++ /dev/null
@@ -1 +0,0 @@
-5
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01686.stmt b/build/fuzzer/corpus/01686.stmt
deleted file mode 100644
index 1f01fe7988..0000000000
--- a/build/fuzzer/corpus/01686.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01687.stmt b/build/fuzzer/corpus/01687.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01687.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01688.stmt b/build/fuzzer/corpus/01688.stmt
deleted file mode 100644
index 1f01fe7988..0000000000
--- a/build/fuzzer/corpus/01688.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01689.stmt b/build/fuzzer/corpus/01689.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01690.stmt b/build/fuzzer/corpus/01690.stmt
deleted file mode 100644
index 2edeafb09d..0000000000
--- a/build/fuzzer/corpus/01690.stmt
+++ /dev/null
@@ -1 +0,0 @@
-20
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01691.stmt b/build/fuzzer/corpus/01691.stmt
deleted file mode 100644
index 2868f476e5..0000000000
--- a/build/fuzzer/corpus/01691.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi4
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01692.stmt b/build/fuzzer/corpus/01692.stmt
deleted file mode 100644
index 7647e34ade..0000000000
--- a/build/fuzzer/corpus/01692.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01693.stmt b/build/fuzzer/corpus/01693.stmt
deleted file mode 100644
index 2868f476e5..0000000000
--- a/build/fuzzer/corpus/01693.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi4
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01694.stmt b/build/fuzzer/corpus/01694.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01695.stmt b/build/fuzzer/corpus/01695.stmt
deleted file mode 100644
index 0252483ecb..0000000000
--- a/build/fuzzer/corpus/01695.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"bar"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01696.stmt b/build/fuzzer/corpus/01696.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01696.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01697.stmt b/build/fuzzer/corpus/01697.stmt
deleted file mode 100644
index 07c4f4bb1c..0000000000
--- a/build/fuzzer/corpus/01697.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multi_cross_pkg
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01698.stmt b/build/fuzzer/corpus/01698.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01699.stmt b/build/fuzzer/corpus/01699.stmt
deleted file mode 100644
index abc13fc1e9..0000000000
--- a/build/fuzzer/corpus/01699.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["bar", 3]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01700.stmt b/build/fuzzer/corpus/01700.stmt
deleted file mode 100644
index 7f71c0f04a..0000000000
--- a/build/fuzzer/corpus/01700.stmt
+++ /dev/null
@@ -1 +0,0 @@
-skip-functions
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01701.stmt b/build/fuzzer/corpus/01701.stmt
deleted file mode 100644
index 68f0e047e4..0000000000
--- a/build/fuzzer/corpus/01701.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test.l1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01702.stmt b/build/fuzzer/corpus/01702.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01703.stmt b/build/fuzzer/corpus/01703.stmt
deleted file mode 100644
index 57cdbcaa47..0000000000
--- a/build/fuzzer/corpus/01703.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"l2": {"p": true}, "l3": {}}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01704.stmt b/build/fuzzer/corpus/01704.stmt
deleted file mode 100644
index 18cb82c399..0000000000
--- a/build/fuzzer/corpus/01704.stmt
+++ /dev/null
@@ -1 +0,0 @@
-omit result
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01705.stmt b/build/fuzzer/corpus/01705.stmt
deleted file mode 100644
index 43493f7a84..0000000000
--- a/build/fuzzer/corpus/01705.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test.omit_result.p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01706.stmt b/build/fuzzer/corpus/01706.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01707.stmt b/build/fuzzer/corpus/01707.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01707.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01708.stmt b/build/fuzzer/corpus/01708.stmt
deleted file mode 100644
index b2d6d0bc17..0000000000
--- a/build/fuzzer/corpus/01708.stmt
+++ /dev/null
@@ -1,10 +0,0 @@
-
-		package test1
-
-		p(x) = y {
-			y = x[_]
-		}
-
-		r = y {
-			p([1, 2, 3], y)
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01709.stmt b/build/fuzzer/corpus/01709.stmt
deleted file mode 100644
index 1a31b47bbd..0000000000
--- a/build/fuzzer/corpus/01709.stmt
+++ /dev/null
@@ -1,14 +0,0 @@
-
-		package test2
-
-		p(1, x) = y {
-			y = x
-		}
-
-		p(2, x) = y {
-			y = x+1
-		}
-
-		r = y {
-			p(3, 0, y)
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01710.stmt b/build/fuzzer/corpus/01710.stmt
deleted file mode 100644
index b94df00970..0000000000
--- a/build/fuzzer/corpus/01710.stmt
+++ /dev/null
@@ -1,18 +0,0 @@
-
-		package test3
-
-		p(1, x) = y {
-			y = x
-		}
-
-		p(2, x) = y {
-			y = x+1
-		}
-
-		p(x, y) = z {
-			z = x
-		}
-
-		r = y {
-			p(1, 0, y)
-		}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01711.stmt b/build/fuzzer/corpus/01711.stmt
deleted file mode 100644
index 7177d60b88..0000000000
--- a/build/fuzzer/corpus/01711.stmt
+++ /dev/null
@@ -1 +0,0 @@
-function output conflict single
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01712.stmt b/build/fuzzer/corpus/01712.stmt
deleted file mode 100644
index f079749c42..0000000000
--- a/build/fuzzer/corpus/01712.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01713.stmt b/build/fuzzer/corpus/01713.stmt
deleted file mode 100644
index 1d2f01491f..0000000000
--- a/build/fuzzer/corpus/01713.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01714.stmt b/build/fuzzer/corpus/01714.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01715.stmt b/build/fuzzer/corpus/01715.stmt
deleted file mode 100644
index dd8e304a5d..0000000000
--- a/build/fuzzer/corpus/01715.stmt
+++ /dev/null
@@ -1 +0,0 @@
-function input no match
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01716.stmt b/build/fuzzer/corpus/01716.stmt
deleted file mode 100644
index d606037cb2..0000000000
--- a/build/fuzzer/corpus/01716.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01717.stmt b/build/fuzzer/corpus/01717.stmt
deleted file mode 100644
index 1d2f01491f..0000000000
--- a/build/fuzzer/corpus/01717.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01718.stmt b/build/fuzzer/corpus/01718.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01719.stmt b/build/fuzzer/corpus/01719.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01720.stmt b/build/fuzzer/corpus/01720.stmt
deleted file mode 100644
index b0a0c8ea0c..0000000000
--- a/build/fuzzer/corpus/01720.stmt
+++ /dev/null
@@ -1 +0,0 @@
-function output conflict multiple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01721.stmt b/build/fuzzer/corpus/01721.stmt
deleted file mode 100644
index 29f446afe2..0000000000
--- a/build/fuzzer/corpus/01721.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01722.stmt b/build/fuzzer/corpus/01722.stmt
deleted file mode 100644
index 1d2f01491f..0000000000
--- a/build/fuzzer/corpus/01722.stmt
+++ /dev/null
@@ -1 +0,0 @@
-r
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01723.stmt b/build/fuzzer/corpus/01723.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01724.stmt b/build/fuzzer/corpus/01724.stmt
deleted file mode 100644
index a232b42493..0000000000
--- a/build/fuzzer/corpus/01724.stmt
+++ /dev/null
@@ -1,35 +0,0 @@
-package ex
-
-loopback = input { true }
-composite[x] { input.foo[_] = x; x > 2 }
-vars = {"foo": input.foo, "bar": input.bar} { true }
-input_eq { input.x = 1 }
-allow_basic = true {data.a = "testdata"}
-allow_merge_1 = true {data.b = {"v1": "hello", "v2": "world"}}
-allow_merge_2 = true {data.b = {"v1": "hello", "v2": "world", "v3": "again"}}
-virtual[x] { data.a.b[x] = 1 }
-mock_var = {"a": 0, "b": 0}
-mock_rule = false {1 = 2}
-
-allow1 {
-	data.label.b.c = [1,2,3]
-}
-
-allow2 {
-	data.label.b.c[x] = 2
-}
-
-allow3 {
-	data.label.b[x] = 1
-}
-
-allow4 {
-	data.label.b.c.d[x] = 1
-}
-
-allow {
-	allow1
-	allow2
-	not allow3
-	not allow4
-}
diff --git a/build/fuzzer/corpus/01725.stmt b/build/fuzzer/corpus/01725.stmt
deleted file mode 100644
index 471e0c84c9..0000000000
--- a/build/fuzzer/corpus/01725.stmt
+++ /dev/null
@@ -1,25 +0,0 @@
-package test
-
-import data.ex
-
-basic = true { ex.loopback = true with input as true; ex.loopback = false with input as false }
-negation = true { not ex.loopback with input as false; ex.loopback with input as true }
-composite[x] { ex.composite[x] with input.foo as [1, 2, 3, 4] }
-vars = x { foo = "hello"; bar = "world"; x = ex.vars with input.foo as foo with input.bar as bar }
-conflict = true { ex.loopback with input.foo as "x" with input.foo.bar as "y" }
-negation_invalidate[x] { data.a[_] = x; not data.ex.input_eq with input.x as x }
-basic_data = true {ex.allow_basic = true with data.a as "testdata"}
-map_data_1 = true {ex.allow_merge_1 = true with data.b.v2 as "world"}
-map_data_2 = true {ex.allow_merge_2 = true with data.b.v2 as "world" with data.b.v3 as "again"}
-data_conflict = true {ex.allow_basic = true with data.a.b as 5}
-base_doc_exact_value[x] { data.a.b[x] = 1 with data.a.b as {"c": 1, "d": 2, "e": 1} }
-base_doc_any_index[x] { data.a.b[x] with data.a.b as {"c": 1, "d": 2, "e": 1} }
-undefined_1 { data.a.b.c with data.a.b as 1 }
-undefined_2 { data.l.a with data.l as 1 }
-virtual_doc_exact_value[x] { ex.virtual = x with data.a.b as {"c": 1, "d": 2, "e": 1} }
-virtual_doc_any_index[x] { ex.virtual[x] with data.a.b as {"c": 1, "d": 2, "e": 1} }
-virtual_doc_specific_index = y { y = ex.virtual["c"] with data.a.b as {"c": 1, "d": 2, "e": 1} }
-virtual_doc_not_specific_index = true { not ex.virtual["d"] with data.a.b as {"c": 1, "d": 2, "e": 1} }
-test_mock_var = y {y = ex.mock_var with ex.mock_var as {"c": 1, "d": 2}}
-test_mock_rule {ex.mock_rule with ex.mock_rule as true}
-test_rule_chain {ex.allow with data.label.b.c as [1,2,3]}
diff --git a/build/fuzzer/corpus/01726.stmt b/build/fuzzer/corpus/01726.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01726.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01727.stmt b/build/fuzzer/corpus/01727.stmt
deleted file mode 100644
index ea5233d8e9..0000000000
--- a/build/fuzzer/corpus/01727.stmt
+++ /dev/null
@@ -1 +0,0 @@
-basic
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01728.stmt b/build/fuzzer/corpus/01728.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01729.stmt b/build/fuzzer/corpus/01729.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01729.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01730.stmt b/build/fuzzer/corpus/01730.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01730.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01731.stmt b/build/fuzzer/corpus/01731.stmt
deleted file mode 100644
index ff88aaa6b3..0000000000
--- a/build/fuzzer/corpus/01731.stmt
+++ /dev/null
@@ -1 +0,0 @@
-negation
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01732.stmt b/build/fuzzer/corpus/01732.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01733.stmt b/build/fuzzer/corpus/01733.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01733.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01734.stmt b/build/fuzzer/corpus/01734.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01734.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01735.stmt b/build/fuzzer/corpus/01735.stmt
deleted file mode 100644
index 44ab7c64e2..0000000000
--- a/build/fuzzer/corpus/01735.stmt
+++ /dev/null
@@ -1 +0,0 @@
-composite
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01736.stmt b/build/fuzzer/corpus/01736.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01737.stmt b/build/fuzzer/corpus/01737.stmt
deleted file mode 100644
index 8ec0143b7e..0000000000
--- a/build/fuzzer/corpus/01737.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01738.stmt b/build/fuzzer/corpus/01738.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01738.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01739.stmt b/build/fuzzer/corpus/01739.stmt
deleted file mode 100644
index 315d1c9904..0000000000
--- a/build/fuzzer/corpus/01739.stmt
+++ /dev/null
@@ -1 +0,0 @@
-vars
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01740.stmt b/build/fuzzer/corpus/01740.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01741.stmt b/build/fuzzer/corpus/01741.stmt
deleted file mode 100644
index ed8197c865..0000000000
--- a/build/fuzzer/corpus/01741.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"foo": "hello", "bar": "world"}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01742.stmt b/build/fuzzer/corpus/01742.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01742.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01743.stmt b/build/fuzzer/corpus/01743.stmt
deleted file mode 100644
index 783a0ef7a5..0000000000
--- a/build/fuzzer/corpus/01743.stmt
+++ /dev/null
@@ -1 +0,0 @@
-conflict
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01744.stmt b/build/fuzzer/corpus/01744.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01745.stmt b/build/fuzzer/corpus/01745.stmt
deleted file mode 100644
index 3dd45d28fa..0000000000
--- a/build/fuzzer/corpus/01745.stmt
+++ /dev/null
@@ -1 +0,0 @@
-conflicting input documents
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01746.stmt b/build/fuzzer/corpus/01746.stmt
deleted file mode 100644
index 1bec1e9d7c..0000000000
--- a/build/fuzzer/corpus/01746.stmt
+++ /dev/null
@@ -1 +0,0 @@
-With invalidate
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01747.stmt b/build/fuzzer/corpus/01747.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01747.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01748.stmt b/build/fuzzer/corpus/01748.stmt
deleted file mode 100644
index 0545907c8b..0000000000
--- a/build/fuzzer/corpus/01748.stmt
+++ /dev/null
@@ -1 +0,0 @@
-negation_invalidate
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01749.stmt b/build/fuzzer/corpus/01749.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01750.stmt b/build/fuzzer/corpus/01750.stmt
deleted file mode 100644
index 4f5c3f2a52..0000000000
--- a/build/fuzzer/corpus/01750.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[2,3,4]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01751.stmt b/build/fuzzer/corpus/01751.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01751.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01752.stmt b/build/fuzzer/corpus/01752.stmt
deleted file mode 100644
index bde8effd28..0000000000
--- a/build/fuzzer/corpus/01752.stmt
+++ /dev/null
@@ -1 +0,0 @@
-basic_data
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01753.stmt b/build/fuzzer/corpus/01753.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01754.stmt b/build/fuzzer/corpus/01754.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01754.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01755.stmt b/build/fuzzer/corpus/01755.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01755.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01756.stmt b/build/fuzzer/corpus/01756.stmt
deleted file mode 100644
index 87504ae8cf..0000000000
--- a/build/fuzzer/corpus/01756.stmt
+++ /dev/null
@@ -1 +0,0 @@
-map_data_1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01757.stmt b/build/fuzzer/corpus/01757.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01758.stmt b/build/fuzzer/corpus/01758.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01758.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01759.stmt b/build/fuzzer/corpus/01759.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01759.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01760.stmt b/build/fuzzer/corpus/01760.stmt
deleted file mode 100644
index 29c06f2621..0000000000
--- a/build/fuzzer/corpus/01760.stmt
+++ /dev/null
@@ -1 +0,0 @@
-map_data_2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01761.stmt b/build/fuzzer/corpus/01761.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01762.stmt b/build/fuzzer/corpus/01762.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01762.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01763.stmt b/build/fuzzer/corpus/01763.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01763.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01764.stmt b/build/fuzzer/corpus/01764.stmt
deleted file mode 100644
index ac4d480234..0000000000
--- a/build/fuzzer/corpus/01764.stmt
+++ /dev/null
@@ -1 +0,0 @@
-data_conflict
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01765.stmt b/build/fuzzer/corpus/01765.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01766.stmt b/build/fuzzer/corpus/01766.stmt
deleted file mode 100644
index 217c8b0c9d..0000000000
--- a/build/fuzzer/corpus/01766.stmt
+++ /dev/null
@@ -1 +0,0 @@
-eval_with_merge_error
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01767.stmt b/build/fuzzer/corpus/01767.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01767.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01768.stmt b/build/fuzzer/corpus/01768.stmt
deleted file mode 100644
index 2b09871a10..0000000000
--- a/build/fuzzer/corpus/01768.stmt
+++ /dev/null
@@ -1 +0,0 @@
-base_doc_exact_value
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01769.stmt b/build/fuzzer/corpus/01769.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01770.stmt b/build/fuzzer/corpus/01770.stmt
deleted file mode 100644
index a1b037f1e7..0000000000
--- a/build/fuzzer/corpus/01770.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["c", "e"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01771.stmt b/build/fuzzer/corpus/01771.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01771.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01772.stmt b/build/fuzzer/corpus/01772.stmt
deleted file mode 100644
index d0788a379b..0000000000
--- a/build/fuzzer/corpus/01772.stmt
+++ /dev/null
@@ -1 +0,0 @@
-base_doc_any_index
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01773.stmt b/build/fuzzer/corpus/01773.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01774.stmt b/build/fuzzer/corpus/01774.stmt
deleted file mode 100644
index cdfa87e076..0000000000
--- a/build/fuzzer/corpus/01774.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["c", "d", "e"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01775.stmt b/build/fuzzer/corpus/01775.stmt
deleted file mode 100644
index 9aef12e682..0000000000
--- a/build/fuzzer/corpus/01775.stmt
+++ /dev/null
@@ -1 +0,0 @@
-undefined_1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01776.stmt b/build/fuzzer/corpus/01776.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01776.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01777.stmt b/build/fuzzer/corpus/01777.stmt
deleted file mode 100644
index 9aef12e682..0000000000
--- a/build/fuzzer/corpus/01777.stmt
+++ /dev/null
@@ -1 +0,0 @@
-undefined_1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01778.stmt b/build/fuzzer/corpus/01778.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01779.stmt b/build/fuzzer/corpus/01779.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01780.stmt b/build/fuzzer/corpus/01780.stmt
deleted file mode 100644
index c0609d1668..0000000000
--- a/build/fuzzer/corpus/01780.stmt
+++ /dev/null
@@ -1 +0,0 @@
-undefined_2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01781.stmt b/build/fuzzer/corpus/01781.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01781.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01782.stmt b/build/fuzzer/corpus/01782.stmt
deleted file mode 100644
index c0609d1668..0000000000
--- a/build/fuzzer/corpus/01782.stmt
+++ /dev/null
@@ -1 +0,0 @@
-undefined_2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01783.stmt b/build/fuzzer/corpus/01783.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01784.stmt b/build/fuzzer/corpus/01784.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01785.stmt b/build/fuzzer/corpus/01785.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01785.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01786.stmt b/build/fuzzer/corpus/01786.stmt
deleted file mode 100644
index 73b5049090..0000000000
--- a/build/fuzzer/corpus/01786.stmt
+++ /dev/null
@@ -1 +0,0 @@
-virtual_doc_exact_value
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01787.stmt b/build/fuzzer/corpus/01787.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01788.stmt b/build/fuzzer/corpus/01788.stmt
deleted file mode 100644
index c12ccf1611..0000000000
--- a/build/fuzzer/corpus/01788.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[["c", "e"]]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01789.stmt b/build/fuzzer/corpus/01789.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01789.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01790.stmt b/build/fuzzer/corpus/01790.stmt
deleted file mode 100644
index 921f1007f7..0000000000
--- a/build/fuzzer/corpus/01790.stmt
+++ /dev/null
@@ -1 +0,0 @@
-virtual_doc_any_index
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01791.stmt b/build/fuzzer/corpus/01791.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01792.stmt b/build/fuzzer/corpus/01792.stmt
deleted file mode 100644
index a1b037f1e7..0000000000
--- a/build/fuzzer/corpus/01792.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["c", "e"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01793.stmt b/build/fuzzer/corpus/01793.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01793.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01794.stmt b/build/fuzzer/corpus/01794.stmt
deleted file mode 100644
index 39d3fd2b84..0000000000
--- a/build/fuzzer/corpus/01794.stmt
+++ /dev/null
@@ -1 +0,0 @@
-virtual_doc_specific_index
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01795.stmt b/build/fuzzer/corpus/01795.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01796.stmt b/build/fuzzer/corpus/01796.stmt
deleted file mode 100644
index b6b4957d94..0000000000
--- a/build/fuzzer/corpus/01796.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"c"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01797.stmt b/build/fuzzer/corpus/01797.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01797.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01798.stmt b/build/fuzzer/corpus/01798.stmt
deleted file mode 100644
index bcdd2249d4..0000000000
--- a/build/fuzzer/corpus/01798.stmt
+++ /dev/null
@@ -1 +0,0 @@
-virtual_doc_not_specific_index
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01799.stmt b/build/fuzzer/corpus/01799.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01800.stmt b/build/fuzzer/corpus/01800.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01800.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01801.stmt b/build/fuzzer/corpus/01801.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01801.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01802.stmt b/build/fuzzer/corpus/01802.stmt
deleted file mode 100644
index 00992e90e3..0000000000
--- a/build/fuzzer/corpus/01802.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test_mock_var
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01803.stmt b/build/fuzzer/corpus/01803.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01804.stmt b/build/fuzzer/corpus/01804.stmt
deleted file mode 100644
index 1f6fc6a241..0000000000
--- a/build/fuzzer/corpus/01804.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{"c": 1, "d": 2}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01805.stmt b/build/fuzzer/corpus/01805.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01805.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01806.stmt b/build/fuzzer/corpus/01806.stmt
deleted file mode 100644
index 7f1617a408..0000000000
--- a/build/fuzzer/corpus/01806.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test_mock_rule
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01807.stmt b/build/fuzzer/corpus/01807.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01808.stmt b/build/fuzzer/corpus/01808.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01808.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01809.stmt b/build/fuzzer/corpus/01809.stmt
deleted file mode 100644
index 30d74d2584..0000000000
--- a/build/fuzzer/corpus/01809.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01810.stmt b/build/fuzzer/corpus/01810.stmt
deleted file mode 100644
index e1e9432b18..0000000000
--- a/build/fuzzer/corpus/01810.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test_rule_chain
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01811.stmt b/build/fuzzer/corpus/01811.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01812.stmt b/build/fuzzer/corpus/01812.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01812.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01813.stmt b/build/fuzzer/corpus/01813.stmt
deleted file mode 100644
index 3d7289a7a2..0000000000
--- a/build/fuzzer/corpus/01813.stmt
+++ /dev/null
@@ -1 +0,0 @@
-no-op
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01814.stmt b/build/fuzzer/corpus/01814.stmt
deleted file mode 100644
index 575950c351..0000000000
--- a/build/fuzzer/corpus/01814.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.no_op
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01815.stmt b/build/fuzzer/corpus/01815.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01815.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01816.stmt b/build/fuzzer/corpus/01816.stmt
deleted file mode 100644
index cc008669dd..0000000000
--- a/build/fuzzer/corpus/01816.stmt
+++ /dev/null
@@ -1 +0,0 @@
-trivial
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01817.stmt b/build/fuzzer/corpus/01817.stmt
deleted file mode 100644
index a16e60c214..0000000000
--- a/build/fuzzer/corpus/01817.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.bool
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01818.stmt b/build/fuzzer/corpus/01818.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01818.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01819.stmt b/build/fuzzer/corpus/01819.stmt
deleted file mode 100644
index d3431b1199..0000000000
--- a/build/fuzzer/corpus/01819.stmt
+++ /dev/null
@@ -1 +0,0 @@
-trivial-non-bool
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01820.stmt b/build/fuzzer/corpus/01820.stmt
deleted file mode 100644
index 7cec2922a5..0000000000
--- a/build/fuzzer/corpus/01820.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.non_bool
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01821.stmt b/build/fuzzer/corpus/01821.stmt
deleted file mode 100644
index efe8d98887..0000000000
--- a/build/fuzzer/corpus/01821.stmt
+++ /dev/null
@@ -1 +0,0 @@
-[100]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01822.stmt b/build/fuzzer/corpus/01822.stmt
deleted file mode 100644
index 5891643e8a..0000000000
--- a/build/fuzzer/corpus/01822.stmt
+++ /dev/null
@@ -1 +0,0 @@
-trivial-3
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01823.stmt b/build/fuzzer/corpus/01823.stmt
deleted file mode 100644
index 6558643773..0000000000
--- a/build/fuzzer/corpus/01823.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.triple
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01824.stmt b/build/fuzzer/corpus/01824.stmt
deleted file mode 100644
index 84ed78b69b..0000000000
--- a/build/fuzzer/corpus/01824.stmt
+++ /dev/null
@@ -1 +0,0 @@
-"hello"
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01825.stmt b/build/fuzzer/corpus/01825.stmt
deleted file mode 100644
index e085d4b09e..0000000000
--- a/build/fuzzer/corpus/01825.stmt
+++ /dev/null
@@ -1 +0,0 @@
-var-head
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01826.stmt b/build/fuzzer/corpus/01826.stmt
deleted file mode 100644
index 25d963ab0b..0000000000
--- a/build/fuzzer/corpus/01826.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.vars
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01827.stmt b/build/fuzzer/corpus/01827.stmt
deleted file mode 100644
index 86d71b44b7..0000000000
--- a/build/fuzzer/corpus/01827.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["hello", "goodbye"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01828.stmt b/build/fuzzer/corpus/01828.stmt
deleted file mode 100644
index 43d4e188ba..0000000000
--- a/build/fuzzer/corpus/01828.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ref-head
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01829.stmt b/build/fuzzer/corpus/01829.stmt
deleted file mode 100644
index e6e3d449c0..0000000000
--- a/build/fuzzer/corpus/01829.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.refs
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01830.stmt b/build/fuzzer/corpus/01830.stmt
deleted file mode 100644
index 86d71b44b7..0000000000
--- a/build/fuzzer/corpus/01830.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["hello", "goodbye"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01831.stmt b/build/fuzzer/corpus/01831.stmt
deleted file mode 100644
index b447ee5b42..0000000000
--- a/build/fuzzer/corpus/01831.stmt
+++ /dev/null
@@ -1 +0,0 @@
-first-match
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01832.stmt b/build/fuzzer/corpus/01832.stmt
deleted file mode 100644
index dca21970fb..0000000000
--- a/build/fuzzer/corpus/01832.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.multiple_defined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01833.stmt b/build/fuzzer/corpus/01833.stmt
deleted file mode 100644
index f32a5804e2..0000000000
--- a/build/fuzzer/corpus/01833.stmt
+++ /dev/null
@@ -1 +0,0 @@
-true
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01834.stmt b/build/fuzzer/corpus/01834.stmt
deleted file mode 100644
index ff2e6d1348..0000000000
--- a/build/fuzzer/corpus/01834.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.default_1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01835.stmt b/build/fuzzer/corpus/01835.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/01835.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01836.stmt b/build/fuzzer/corpus/01836.stmt
deleted file mode 100644
index 79a2e4fef7..0000000000
--- a/build/fuzzer/corpus/01836.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.default_2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01837.stmt b/build/fuzzer/corpus/01837.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/01837.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01838.stmt b/build/fuzzer/corpus/01838.stmt
deleted file mode 100644
index ad576ca23b..0000000000
--- a/build/fuzzer/corpus/01838.stmt
+++ /dev/null
@@ -1 +0,0 @@
-multiple-roots
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01839.stmt b/build/fuzzer/corpus/01839.stmt
deleted file mode 100644
index 6b523807ee..0000000000
--- a/build/fuzzer/corpus/01839.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.multiple_roots
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01840.stmt b/build/fuzzer/corpus/01840.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/01840.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01841.stmt b/build/fuzzer/corpus/01841.stmt
deleted file mode 100644
index d4605d21a7..0000000000
--- a/build/fuzzer/corpus/01841.stmt
+++ /dev/null
@@ -1 +0,0 @@
-indexed
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01842.stmt b/build/fuzzer/corpus/01842.stmt
deleted file mode 100644
index 6d268df360..0000000000
--- a/build/fuzzer/corpus/01842.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.indexed
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01843.stmt b/build/fuzzer/corpus/01843.stmt
deleted file mode 100644
index d8263ee986..0000000000
--- a/build/fuzzer/corpus/01843.stmt
+++ /dev/null
@@ -1 +0,0 @@
-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01844.stmt b/build/fuzzer/corpus/01844.stmt
deleted file mode 100644
index 62d848b1fa..0000000000
--- a/build/fuzzer/corpus/01844.stmt
+++ /dev/null
@@ -1 +0,0 @@
-conflict-1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01845.stmt b/build/fuzzer/corpus/01845.stmt
deleted file mode 100644
index 2c48c14e98..0000000000
--- a/build/fuzzer/corpus/01845.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.conflict_1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01846.stmt b/build/fuzzer/corpus/01846.stmt
deleted file mode 100644
index 65e0481a02..0000000000
--- a/build/fuzzer/corpus/01846.stmt
+++ /dev/null
@@ -1 +0,0 @@
-conflict-2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01847.stmt b/build/fuzzer/corpus/01847.stmt
deleted file mode 100644
index e121d0b8fa..0000000000
--- a/build/fuzzer/corpus/01847.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.conflict_2
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01848.stmt b/build/fuzzer/corpus/01848.stmt
deleted file mode 100644
index baf365d531..0000000000
--- a/build/fuzzer/corpus/01848.stmt
+++ /dev/null
@@ -1 +0,0 @@
-functions
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01849.stmt b/build/fuzzer/corpus/01849.stmt
deleted file mode 100644
index 30c6650876..0000000000
--- a/build/fuzzer/corpus/01849.stmt
+++ /dev/null
@@ -1 +0,0 @@
-ex.fn_result
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01850.stmt b/build/fuzzer/corpus/01850.stmt
deleted file mode 100644
index 2c9725cded..0000000000
--- a/build/fuzzer/corpus/01850.stmt
+++ /dev/null
@@ -1 +0,0 @@
-["large", "small", "medium"]
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01851.stmt b/build/fuzzer/corpus/01851.stmt
deleted file mode 100644
index 0017831683..0000000000
--- a/build/fuzzer/corpus/01851.stmt
+++ /dev/null
@@ -1,69 +0,0 @@
-package ex
-
-			no_op { true } else = false { true }
-			bool { false } else { true }
-			non_bool = null { false } else = [100] { true }
-			triple { false } else { false } else = "hello" { true }
-			vars { false } else = ["hello", x] { data.b.v2 = x }
-			refs { false } else = ["hello", data.b.v2] { true }
-			multiple_defined = false { false } else = true { true } else = false { true }
-
-			default default_1 = 1
-			default_1 { false } default_1 = 2 { true }
-
-			default default_2 = 2
-			default_2 { false } default_2 = 1 { false }
-
-			multiple_roots {
-				false
-			} else = 1 {
-				false
-			} else = 2 {
-				true
-			} else = 3 {
-				true
-			}
-
-			multiple_roots = 2
-
-			multiple_roots = 3 {
-				false
-			} else = 2 {
-				true
-			}
-
-			indexed {
-				data.a[0] = 0
-			} else = 2 {
-				data.a[0] = 1
-			} else = 3 {
-				data.a[0] = 1
-			}
-
-			indexed {
-				data.a[0] = 1
-				data.a[2] = 2
-			} else {
-				false
-			} else = 2 {
-				data.a[0] = x
-				x = 1
-				data.a[2] = 3
-			}
-
-			conflict_1 { false } else { true }
-			conflict_1 = false { true }
-
-			conflict_2 { false } else = false { true }
-			conflict_2 { false } else = true { true }
-
-			fn_result = [x,y,z] { fn(101, true, x); fn(100, true, y); fn(100, false, z) }
-
-			fn(x, y) = "large" {
-				x > 100
-			} else = "small" {
-				y = true
-			} else = "medium" {
-				true
-			}
-			
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01852.stmt b/build/fuzzer/corpus/01852.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01853.stmt b/build/fuzzer/corpus/01853.stmt
deleted file mode 100644
index 52a3274aa1..0000000000
--- a/build/fuzzer/corpus/01853.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-
-		package system.somepolicy
-
-		foo = "hello"
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01854.stmt b/build/fuzzer/corpus/01854.stmt
deleted file mode 100644
index 013e54532f..0000000000
--- a/build/fuzzer/corpus/01854.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-
-		package topdown.system
-
-		bar = "goodbye"
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01855.stmt b/build/fuzzer/corpus/01855.stmt
deleted file mode 100644
index 5b8201173c..0000000000
--- a/build/fuzzer/corpus/01855.stmt
+++ /dev/null
@@ -1 +0,0 @@
-system
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01856.stmt b/build/fuzzer/corpus/01856.stmt
deleted file mode 100644
index 16ac089539..0000000000
--- a/build/fuzzer/corpus/01856.stmt
+++ /dev/null
@@ -1 +0,0 @@
-somedata
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01857.stmt b/build/fuzzer/corpus/01857.stmt
deleted file mode 100644
index 2e65efe2a1..0000000000
--- a/build/fuzzer/corpus/01857.stmt
+++ /dev/null
@@ -1 +0,0 @@
-a
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01858.stmt b/build/fuzzer/corpus/01858.stmt
deleted file mode 100644
index 63d8dbd40c..0000000000
--- a/build/fuzzer/corpus/01858.stmt
+++ /dev/null
@@ -1 +0,0 @@
-b
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01859.stmt b/build/fuzzer/corpus/01859.stmt
deleted file mode 100644
index 3410062ba6..0000000000
--- a/build/fuzzer/corpus/01859.stmt
+++ /dev/null
@@ -1 +0,0 @@
-c
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01860.stmt b/build/fuzzer/corpus/01860.stmt
deleted file mode 100644
index 0b1b90abe4..0000000000
--- a/build/fuzzer/corpus/01860.stmt
+++ /dev/null
@@ -1 +0,0 @@
-com
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01861.stmt b/build/fuzzer/corpus/01861.stmt
deleted file mode 100644
index 5b8201173c..0000000000
--- a/build/fuzzer/corpus/01861.stmt
+++ /dev/null
@@ -1 +0,0 @@
-system
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01862.stmt b/build/fuzzer/corpus/01862.stmt
deleted file mode 100644
index e8b5f8233c..0000000000
--- a/build/fuzzer/corpus/01862.stmt
+++ /dev/null
@@ -1 +0,0 @@
-deadbeef
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01863.stmt b/build/fuzzer/corpus/01863.stmt
deleted file mode 100644
index 72aca699b2..0000000000
--- a/build/fuzzer/corpus/01863.stmt
+++ /dev/null
@@ -1 +0,0 @@
-root query
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01864.stmt b/build/fuzzer/corpus/01864.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01864.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01865.stmt b/build/fuzzer/corpus/01865.stmt
deleted file mode 100644
index 36962398d0..0000000000
--- a/build/fuzzer/corpus/01865.stmt
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-		"topdown": {
-			"system": {
-				"bar": "goodbye"
-			}
-		},
-		"com": {
-			"system": "deadbeef"
-		}
-	}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01866.stmt b/build/fuzzer/corpus/01866.stmt
deleted file mode 100644
index 2c2c0de15e..0000000000
--- a/build/fuzzer/corpus/01866.stmt
+++ /dev/null
@@ -1,20 +0,0 @@
-
-        {
-            "servers": [
-                {"id": "s1", "name": "app", "protocols": ["https", "ssh"], "ports": ["p1", "p2", "p3"]},
-                {"id": "s2", "name": "db", "protocols": ["mysql"], "ports": ["p3"]},
-                {"id": "s3", "name": "cache", "protocols": ["memcache", "http"], "ports": ["p3"]},
-                {"id": "s4", "name": "dev", "protocols": ["http"], "ports": ["p1", "p2"]}
-            ],
-            "networks": [
-                {"id": "n1", "public": false},
-                {"id": "n2", "public": false},
-                {"id": "n3", "public": true}
-            ],
-            "ports": [
-                {"id": "p1", "networks": ["n1"]},
-                {"id": "p2", "networks": ["n3"]},
-                {"id": "p3", "networks": ["n2"]}
-            ]
-        }
-    
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01867.stmt b/build/fuzzer/corpus/01867.stmt
deleted file mode 100644
index d2f9bb1067..0000000000
--- a/build/fuzzer/corpus/01867.stmt
+++ /dev/null
@@ -1,8 +0,0 @@
-package opa.example
-
-import data.servers
-import data.networks
-import data.ports
-
-public_servers[server] { server = servers[_]; server.ports[_] = ports[i].id; ports[i].networks[_] = networks[j].id; networks[j].public = true }
-violations[server] { server = servers[_]; server.protocols[_] = "http"; public_servers[server] }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01868.stmt b/build/fuzzer/corpus/01868.stmt
deleted file mode 100644
index 55f57ac86e..0000000000
--- a/build/fuzzer/corpus/01868.stmt
+++ /dev/null
@@ -1 +0,0 @@
-public servers
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01869.stmt b/build/fuzzer/corpus/01869.stmt
deleted file mode 100644
index 563f99e834..0000000000
--- a/build/fuzzer/corpus/01869.stmt
+++ /dev/null
@@ -1 +0,0 @@
-opa
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01870.stmt b/build/fuzzer/corpus/01870.stmt
deleted file mode 100644
index 96236f8158..0000000000
--- a/build/fuzzer/corpus/01870.stmt
+++ /dev/null
@@ -1 +0,0 @@
-example
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01871.stmt b/build/fuzzer/corpus/01871.stmt
deleted file mode 100644
index 76b5fb9896..0000000000
--- a/build/fuzzer/corpus/01871.stmt
+++ /dev/null
@@ -1 +0,0 @@
-public_servers
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01872.stmt b/build/fuzzer/corpus/01872.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01872.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01873.stmt b/build/fuzzer/corpus/01873.stmt
deleted file mode 100644
index 27ddef9a7f..0000000000
--- a/build/fuzzer/corpus/01873.stmt
+++ /dev/null
@@ -1,6 +0,0 @@
-
-        [
-            {"id": "s1", "name": "app", "protocols": ["https", "ssh"], "ports": ["p1", "p2", "p3"]},
-            {"id": "s4", "name": "dev", "protocols": ["http"], "ports": ["p1", "p2"]}
-        ]
-    
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01874.stmt b/build/fuzzer/corpus/01874.stmt
deleted file mode 100644
index 4d6b7b0a2b..0000000000
--- a/build/fuzzer/corpus/01874.stmt
+++ /dev/null
@@ -1 +0,0 @@
-violations
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01875.stmt b/build/fuzzer/corpus/01875.stmt
deleted file mode 100644
index 563f99e834..0000000000
--- a/build/fuzzer/corpus/01875.stmt
+++ /dev/null
@@ -1 +0,0 @@
-opa
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01876.stmt b/build/fuzzer/corpus/01876.stmt
deleted file mode 100644
index 96236f8158..0000000000
--- a/build/fuzzer/corpus/01876.stmt
+++ /dev/null
@@ -1 +0,0 @@
-example
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01877.stmt b/build/fuzzer/corpus/01877.stmt
deleted file mode 100644
index 4d6b7b0a2b..0000000000
--- a/build/fuzzer/corpus/01877.stmt
+++ /dev/null
@@ -1 +0,0 @@
-violations
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01878.stmt b/build/fuzzer/corpus/01878.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01878.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01879.stmt b/build/fuzzer/corpus/01879.stmt
deleted file mode 100644
index b3a4b7f09c..0000000000
--- a/build/fuzzer/corpus/01879.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-
-	    [
-	        {"id": "s4", "name": "dev", "protocols": ["http"], "ports": ["p1", "p2"]}
-	    ]
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01880.stmt b/build/fuzzer/corpus/01880.stmt
deleted file mode 100644
index 117a245c31..0000000000
--- a/build/fuzzer/corpus/01880.stmt
+++ /dev/null
@@ -1 +0,0 @@
-both
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01881.stmt b/build/fuzzer/corpus/01881.stmt
deleted file mode 100644
index 563f99e834..0000000000
--- a/build/fuzzer/corpus/01881.stmt
+++ /dev/null
@@ -1 +0,0 @@
-opa
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01882.stmt b/build/fuzzer/corpus/01882.stmt
deleted file mode 100644
index 96236f8158..0000000000
--- a/build/fuzzer/corpus/01882.stmt
+++ /dev/null
@@ -1 +0,0 @@
-example
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01883.stmt b/build/fuzzer/corpus/01883.stmt
deleted file mode 100644
index 9e26dfeeb6..0000000000
--- a/build/fuzzer/corpus/01883.stmt
+++ /dev/null
@@ -1 +0,0 @@
-{}
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01884.stmt b/build/fuzzer/corpus/01884.stmt
deleted file mode 100644
index e46c4434df..0000000000
--- a/build/fuzzer/corpus/01884.stmt
+++ /dev/null
@@ -1,11 +0,0 @@
-
-		{
-			"public_servers": [
-				{"id": "s1", "name": "app", "protocols": ["https", "ssh"], "ports": ["p1", "p2", "p3"]},
-				{"id": "s4", "name": "dev", "protocols": ["http"], "ports": ["p1", "p2"]}
-			],
-			"violations": [
-				{"id": "s4", "name": "dev", "protocols": ["http"], "ports": ["p1", "p2"]}
-			]
-		}
-	
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01885.stmt b/build/fuzzer/corpus/01885.stmt
deleted file mode 100644
index cbd8135671..0000000000
--- a/build/fuzzer/corpus/01885.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unsupported_builtin
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01886.stmt b/build/fuzzer/corpus/01886.stmt
deleted file mode 100644
index dcd6fae4bd..0000000000
--- a/build/fuzzer/corpus/01886.stmt
+++ /dev/null
@@ -1 +0,0 @@
-unsupported_builtin()
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01887.stmt b/build/fuzzer/corpus/01887.stmt
deleted file mode 100644
index b7a86781c4..0000000000
--- a/build/fuzzer/corpus/01887.stmt
+++ /dev/null
@@ -1,5 +0,0 @@
-
-		package test
-
-		p { data.arr[_] = _; test.sleep("1ms") }
-		
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01888.stmt b/build/fuzzer/corpus/01888.stmt
deleted file mode 100644
index 351774c99a..0000000000
--- a/build/fuzzer/corpus/01888.stmt
+++ /dev/null
@@ -1 +0,0 @@
-arr
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01889.stmt b/build/fuzzer/corpus/01889.stmt
deleted file mode 100644
index 2b7b93940b..0000000000
--- a/build/fuzzer/corpus/01889.stmt
+++ /dev/null
@@ -1 +0,0 @@
-data.test.p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01890.stmt b/build/fuzzer/corpus/01890.stmt
deleted file mode 100644
index ba0e162e1c..0000000000
--- a/build/fuzzer/corpus/01890.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01891.stmt b/build/fuzzer/corpus/01891.stmt
deleted file mode 100644
index 24eb79dd5e..0000000000
--- a/build/fuzzer/corpus/01891.stmt
+++ /dev/null
@@ -1 +0,0 @@
-mod1
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01892.stmt b/build/fuzzer/corpus/01892.stmt
deleted file mode 100644
index b3530e588f..0000000000
--- a/build/fuzzer/corpus/01892.stmt
+++ /dev/null
@@ -1,3 +0,0 @@
-package ex
-
-p[x] { data.a[i] = x }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01893.stmt b/build/fuzzer/corpus/01893.stmt
deleted file mode 100644
index 0d7daf49f3..0000000000
--- a/build/fuzzer/corpus/01893.stmt
+++ /dev/null
@@ -1 +0,0 @@
-data.ex.p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01894.stmt b/build/fuzzer/corpus/01894.stmt
deleted file mode 100644
index ba0e162e1c..0000000000
--- a/build/fuzzer/corpus/01894.stmt
+++ /dev/null
@@ -1 +0,0 @@
-bar
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01895.stmt b/build/fuzzer/corpus/01895.stmt
deleted file mode 100644
index 52473bf0f4..0000000000
--- a/build/fuzzer/corpus/01895.stmt
+++ /dev/null
@@ -1 +0,0 @@
-testMod%d
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01896.stmt b/build/fuzzer/corpus/01896.stmt
deleted file mode 100644
index 1b755a6bcd..0000000000
--- a/build/fuzzer/corpus/01896.stmt
+++ /dev/null
@@ -1 +0,0 @@
-testMod
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01897.stmt b/build/fuzzer/corpus/01897.stmt
deleted file mode 100644
index 177a47e4fb..0000000000
--- a/build/fuzzer/corpus/01897.stmt
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-        "a": [1,2,3,4],
-        "b": {
-            "v1": "hello",
-            "v2": "goodbye"
-        },
-        "c": [{
-            "x": [true, false, "foo"],
-            "y": [null, 3.14159],
-            "z": {"p": true, "q": false}
-        }],
-        "d": {
-            "e": ["bar", "baz"]
-        },
-        "f": [
-            {"xs": [1.0], "ys": [2.0]},
-            {"xs": [2.0], "ys": [3.0]}
-        ],
-        "g": {
-            "a": [1, 0, 0, 0],
-            "b": [0, 2, 0, 0],
-            "c": [0, 0, 0, 4]
-        },
-        "h": [
-            [1,2,3],
-            [2,3,4]
-        ],
-        "l": [
-            {
-                "a": "bob",
-                "b": -1,
-                "c": [1,2,3,4]
-            },
-            {
-                "a": "alice",
-                "b": 1,
-                "c": [2,3,4,5],
-                "d": null
-            }
-        ],
-		"strings": {
-			"foo": 1,
-			"bar": 2,
-			"baz": 3
-		},
-		"three": 3,
-        "m": [],
-		"numbers": [
-			"1",
-			"2",
-			"3",
-			"4"
-		]
-    }
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01898.stmt b/build/fuzzer/corpus/01898.stmt
deleted file mode 100644
index 4f6c4ee9d9..0000000000
--- a/build/fuzzer/corpus/01898.stmt
+++ /dev/null
@@ -1 +0,0 @@
-p
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01899.stmt b/build/fuzzer/corpus/01899.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01900.stmt b/build/fuzzer/corpus/01900.stmt
deleted file mode 100644
index e2f5dd2eb2..0000000000
--- a/build/fuzzer/corpus/01900.stmt
+++ /dev/null
@@ -1 +0,0 @@
-result
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01901.stmt b/build/fuzzer/corpus/01901.stmt
deleted file mode 100644
index 5d612a3605..0000000000
--- a/build/fuzzer/corpus/01901.stmt
+++ /dev/null
@@ -1 +0,0 @@
-OPA_TRACE_TEST
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01902.stmt b/build/fuzzer/corpus/01902.stmt
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/build/fuzzer/corpus/01903.stmt b/build/fuzzer/corpus/01903.stmt
deleted file mode 100644
index f51744b77e..0000000000
--- a/build/fuzzer/corpus/01903.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Expected %v but got undefined
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01904.stmt b/build/fuzzer/corpus/01904.stmt
deleted file mode 100644
index 770eab4480..0000000000
--- a/build/fuzzer/corpus/01904.stmt
+++ /dev/null
@@ -1 +0,0 @@
-input
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01905.stmt b/build/fuzzer/corpus/01905.stmt
deleted file mode 100644
index e7ccfdb614..0000000000
--- a/build/fuzzer/corpus/01905.stmt
+++ /dev/null
@@ -1 +0,0 @@
-package topdown_test_partial
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01906.stmt b/build/fuzzer/corpus/01906.stmt
deleted file mode 100644
index d4c563520f..0000000000
--- a/build/fuzzer/corpus/01906.stmt
+++ /dev/null
@@ -1 +0,0 @@
-__result__
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01907.stmt b/build/fuzzer/corpus/01907.stmt
deleted file mode 100644
index 693a2d8e3d..0000000000
--- a/build/fuzzer/corpus/01907.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown_test_partial
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01908.stmt b/build/fuzzer/corpus/01908.stmt
deleted file mode 100644
index bf74212329..0000000000
--- a/build/fuzzer/corpus/01908.stmt
+++ /dev/null
@@ -1 +0,0 @@
-topdown_test_support_%d
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01909.stmt b/build/fuzzer/corpus/01909.stmt
deleted file mode 100644
index 8453f1c678..0000000000
--- a/build/fuzzer/corpus/01909.stmt
+++ /dev/null
@@ -1 +0,0 @@
-data.topdown_test_partial.__result__ = x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01910.stmt b/build/fuzzer/corpus/01910.stmt
deleted file mode 100644
index f3cf2f8ceb..0000000000
--- a/build/fuzzer/corpus/01910.stmt
+++ /dev/null
@@ -1 +0,0 @@
-Expected %v but got undefined from query after partial evaluation
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01911.stmt b/build/fuzzer/corpus/01911.stmt
deleted file mode 100644
index c1b0730e01..0000000000
--- a/build/fuzzer/corpus/01911.stmt
+++ /dev/null
@@ -1 +0,0 @@
-x
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01912.stmt b/build/fuzzer/corpus/01912.stmt
deleted file mode 100644
index 239ba30225..0000000000
--- a/build/fuzzer/corpus/01912.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test.sleep
\ No newline at end of file
diff --git a/build/fuzzer/corpus/01913.stmt b/build/fuzzer/corpus/01913.stmt
deleted file mode 100644
index 239ba30225..0000000000
--- a/build/fuzzer/corpus/01913.stmt
+++ /dev/null
@@ -1 +0,0 @@
-test.sleep
\ No newline at end of file
diff --git a/build/fuzzer/go.mod b/build/fuzzer/go.mod
deleted file mode 100644
index a50d4f2b63..0000000000
--- a/build/fuzzer/go.mod
+++ /dev/null
@@ -1,11 +0,0 @@
-module github.com/open-policy-agent/fuzz-opa
-
-go 1.15
-
-require (
-	github.com/dvyukov/go-fuzz v0.0.0-20210429054444-fca39067bc72 // indirect
-	github.com/open-policy-agent/opa v0.0.0
-)
-
-// Point the OPA dependency to the local source
-replace github.com/open-policy-agent/opa => ../../
diff --git a/build/fuzzer/go.sum b/build/fuzzer/go.sum
deleted file mode 100644
index 357d316555..0000000000
--- a/build/fuzzer/go.sum
+++ /dev/null
@@ -1,1038 +0,0 @@
-4d63.com/gochecknoglobals v0.0.0-20201008074935-acfc0b28355a/go.mod h1:wfdC5ZjKSPr7CybKEcgJhUOgeAQW1+7WcyK8OvUilfo=
-bitbucket.org/creachadair/shell v0.0.6/go.mod h1:8Qqi/cYk7vPnsOePHroKXDJYmb5x7ENhtiFtfZq8K+M=
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.60.0/go.mod h1:yw2G51M9IfRboUH61Us8GqCeF1PzPblB823Mn2q2eAU=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/pubsub v1.5.0/go.mod h1:ZEwJccE3z93Z2HWvstpri00jOg7oO4UZDtKhwDwqF0w=
-cloud.google.com/go/spanner v1.7.0/go.mod h1:sd3K2gZ9Fd0vMPLXzeCrF6fq4i63Q7aTLW/lBIfBkIk=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-contrib.go.opencensus.io/exporter/stackdriver v0.13.4/go.mod h1:aXENhDJ1Y4lIg4EUaVTwzvYETVNZk10Pu26tevFKLUc=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24/go.mod h1:4UJr5HIiMZrwgkSPdsjy2uOQExX/WEILpIrO9UPGuXs=
-github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
-github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
-github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
-github.com/Masterminds/sprig v2.15.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
-github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
-github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/OpenPeeDeeP/depguard v1.0.1/go.mod h1:xsIw86fROiiwelg+jB2uM9PiKihMMmUx/1V+TNhjQvM=
-github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
-github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
-github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
-github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
-github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
-github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
-github.com/antihax/optional v0.0.0-20180407024304-ca021399b1a6/go.mod h1:V8iCPQYkqmusNa815XgQio277wI47sdRh1dUOLdyC6Q=
-github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
-github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
-github.com/apache/thrift v0.13.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a/go.mod h1:DAHtR1m6lCRdSC2Tm3DSWRPvIPr6xNKyeHdqDQSQT+A=
-github.com/ashanbrown/forbidigo v1.1.0/go.mod h1:vVW7PEdqEFqapJe95xHkTfB1+XvZXBFg8t0sG2FIxmI=
-github.com/ashanbrown/makezero v0.0.0-20210308000810-4155955488a0/go.mod h1:oG9Dnez7/ESBqc4EdrdNlryeo7d0KcW1ftXHm7nU/UU=
-github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
-github.com/aws/aws-sdk-go v1.23.20/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
-github.com/aws/aws-sdk-go v1.25.37/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
-github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
-github.com/aws/aws-sdk-go v1.36.30/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/bkielbasa/cyclop v1.2.0/go.mod h1:qOI0yy6A7dYC4Zgsa72Ppm9kONl0RoIlPbzot9mhmeI=
-github.com/bombsimon/wsl/v3 v3.3.0/go.mod h1:st10JtZYLE4D5sC7b8xV4zTKZwAQjCH/Hy2Pm1FNZIc=
-github.com/bytecodealliance/wasmtime-go v0.26.1/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
-github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
-github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charithe/durationcheck v0.0.6/go.mod h1:SSbRIBVfMjCi/kEB6K65XEA83D6prSM8ap1UCpNKtgg=
-github.com/chavacava/garif v0.0.0-20210405163807-87a70f3d418b/go.mod h1:Qjyv4H3//PWVzTeCezG2b9IRn6myJxJSr4TD/xo6ojU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec/go.mod h1:jMjuTZXRI4dUb/I5gc9Hdhagfvm9+RyrPryS/auMzxE=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
-github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
-github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
-github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190620071333-e64a0ec8b42a/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
-github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
-github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/daixiang0/gci v0.2.8/go.mod h1:+4dZ7TISfSmqfAGv59ePaHfNzgGtIkHAhhdKggP1JAc=
-github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denis-tingajkin/go-header v0.4.2/go.mod h1:eLRHAVXzE5atsKAnNRDB90WHCFFnBUn4RN0nRcs1LJA=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/dvyukov/go-fuzz v0.0.0-20210429054444-fca39067bc72 h1:XiR1YwcWcRFzxjAhWK29HQL4nocj0QWJjpeRi/YASV0=
-github.com/dvyukov/go-fuzz v0.0.0-20210429054444-fca39067bc72/go.mod h1:11Gm+ccJnvAhCNLlf5+cS9KjtbaD5I5zaZpFMsTHWTw=
-github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
-github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
-github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
-github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
-github.com/envoyproxy/go-control-plane v0.6.9/go.mod h1:SBwIajubJHhxtWwsL9s8ss4safvEdbitLhGGK48rN6g=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.0.14/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/esimonov/ifshort v1.0.2/go.mod h1:yZqNJUrNn20K8Q9n2CrjTKYyVEmX209Hgu+M1LBpeZE=
-github.com/ettle/strcase v0.1.1/go.mod h1:hzDLsPC7/lwKyBOywSHEP89nt2pDgdy+No1NBA9o9VY=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
-github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
-github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
-github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
-github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fullstorydev/grpcurl v1.6.0/go.mod h1:ZQ+ayqbKMJNhzLmbpCiurTVlaK2M/3nqZCxaQ2Ze/sM=
-github.com/fzipp/gocyclo v0.3.1/go.mod h1:DJHO6AUmbdqj2ET4Z9iArSuwWgYDRryYt2wASxc7x3E=
-github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-critic/go-critic v0.5.6/go.mod h1:cVjj0DfqewQVIlIAGexPCaGaZDAqGE29PYDDADIVNEo=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-ole/go-ole v1.2.4/go.mod h1:XCwSNxSkXRo4vlyPy93sltvi/qJq0jqQhjqQNIwKuxM=
-github.com/go-redis/redis v6.15.8+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
-github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-toolsmith/astcast v1.0.0/go.mod h1:mt2OdQTeAQcY4DQgPSArJjHCcOwlX+Wl/kwN+LbLGQ4=
-github.com/go-toolsmith/astcopy v1.0.0/go.mod h1:vrgyG+5Bxrnz4MZWPF+pI4R8h3qKRjjyvV/DSez4WVQ=
-github.com/go-toolsmith/astequal v1.0.0/go.mod h1:H+xSiq0+LtiDC11+h1G32h7Of5O3CYFJ99GVbS5lDKY=
-github.com/go-toolsmith/astfmt v1.0.0/go.mod h1:cnWmsOAuq4jJY6Ct5YWlVLmcmLMn1JUPuQIHCY7CJDw=
-github.com/go-toolsmith/astinfo v0.0.0-20180906194353-9809ff7efb21/go.mod h1:dDStQCHtmZpYOmjRP/8gHHnCCch3Zz3oEgCdZVdtweU=
-github.com/go-toolsmith/astp v1.0.0/go.mod h1:RSyrtpVlfTFGDYRbrjyWP1pYu//tSFcvdYrA8meBmLI=
-github.com/go-toolsmith/pkgload v1.0.0/go.mod h1:5eFArkbO80v7Z0kdngIxsRXRMTaX4Ilcwuh3clNrQJc=
-github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
-github.com/go-toolsmith/typep v1.0.0/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2Ns5AIQkATU=
-github.com/go-toolsmith/typep v1.0.2/go.mod h1:JSQCQMUPdRlMZFswiq3TGpNp1GMktqkR2Ns5AIQkATU=
-github.com/go-xmlfmt/xmlfmt v0.0.0-20191208150333-d5b6f63a941b/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/gofrs/flock v0.8.0/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
-github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
-github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
-github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
-github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
-github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golangci/check v0.0.0-20180506172741-cfe4005ccda2/go.mod h1:k9Qvh+8juN+UKMCS/3jFtGICgW8O96FVaZsaxdzDkR4=
-github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a/go.mod h1:ryS0uhF+x9jgbj/N71xsEqODy9BN81/GonCZiOzirOk=
-github.com/golangci/go-misc v0.0.0-20180628070357-927a3d87b613/go.mod h1:SyvUF2NxV+sN8upjjeVYr5W7tyxaT1JVtvhKhOn2ii8=
-github.com/golangci/gofmt v0.0.0-20190930125516-244bba706f1a/go.mod h1:9qCChq59u/eW8im404Q2WWTrnBUQKjpNYKMbU4M7EFU=
-github.com/golangci/golangci-lint v1.40.1/go.mod h1:OyFTr1muxaWeGTcHQcL3B7C4rETnDphTKYenZDgH2/g=
-github.com/golangci/lint-1 v0.0.0-20191013205115-297bf364a8e0/go.mod h1:66R6K6P6VWk9I95jvqGxkqJxVWGFy9XlDwLwVz1RCFg=
-github.com/golangci/maligned v0.0.0-20180506175553-b1d89398deca/go.mod h1:tvlJhZqDe4LMs4ZHD0oMUlt9G2LWuDGoisJTBzLMV9o=
-github.com/golangci/misspell v0.3.5/go.mod h1:dEbvlSfYbMQDtrpRMQU675gSDLDNa8sCPPChZ7PhiVA=
-github.com/golangci/revgrep v0.0.0-20210208091834-cd28932614b5/go.mod h1:LK+zW4MpyytAWQRz0M4xnzEk50lSvqDQKfx304apFkY=
-github.com/golangci/unconvert v0.0.0-20180507085042-28b1c447d1f4/go.mod h1:Izgrg8RkN3rCIMLGE9CyYmU9pY2Jer6DgANEnZ/L/cQ=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/certificate-transparency-go v1.0.21/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
-github.com/google/certificate-transparency-go v1.1.1/go.mod h1:FDKqPvSXawb2ecErVRrD+nfy23RCzyl7eqVCEmlT1Zs=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200507031123-427632fa3b1c/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/trillian v1.3.11/go.mod h1:0tPraVHrSDkA3BO6vKX67zgLXs6SsOAbHEivX+9mPgw=
-github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/gookit/color v1.3.8/go.mod h1:R3ogXq2B9rTbXoSHJ1HyUVAZ3poOJHpd9nQmyGZsfvQ=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gordonklaus/ineffassign v0.0.0-20200309095847-7953dde2c7bf/go.mod h1:cuNKsD1zp2v6XfE/orVX2QE1LC+i254ceGcVeDT3pTU=
-github.com/gordonklaus/ineffassign v0.0.0-20210225214923-2e10b2664254/go.mod h1:M9mZEtGIsR1oDaZagNPNG9iq9n2HrhZ17dsXk73V3Lw=
-github.com/gorhill/cronexpr v0.0.0-20180427100037-88b0669f7d75/go.mod h1:g2644b03hfBX9Ov0ZBDgXXens4rxSxmqFBbhvKv2yVA=
-github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
-github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
-github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3/go.mod h1:eEOZF4jCKGi+aprrirO9e7WKB3beBRtWgqGunKl6pKE=
-github.com/gostaticanalysis/analysisutil v0.0.3/go.mod h1:eEOZF4jCKGi+aprrirO9e7WKB3beBRtWgqGunKl6pKE=
-github.com/gostaticanalysis/analysisutil v0.1.0/go.mod h1:dMhHRU9KTiDcuLGdy87/2gTR8WruwYZrKdRq9m1O6uw=
-github.com/gostaticanalysis/analysisutil v0.4.1/go.mod h1:18U/DLpRgIUd459wGxVHE0fRgmo1UgHDcbw7F5idXu0=
-github.com/gostaticanalysis/comment v1.3.0/go.mod h1:xMicKDx7XRXYdVwY9f9wQpDJVnqWxw9wCauCMKp+IBI=
-github.com/gostaticanalysis/comment v1.4.1/go.mod h1:ih6ZxzTHLdadaiSnF5WY3dxUoXfXAlTaRzuaNDlSado=
-github.com/gostaticanalysis/forcetypeassert v0.0.0-20200621232751-01d4955beaa5/go.mod h1:qZEedyP/sY1lTGV1uJ3VhWZ2mqag3IkWsDHVbplHXak=
-github.com/gostaticanalysis/nilerr v0.1.1/go.mod h1:wZYb6YI5YAxxq0i1+VJbY0s2YONW0HU0GPE3+5PWN4A=
-github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
-github.com/grpc-ecosystem/go-grpc-middleware v1.2.2/go.mod h1:EaizFBKfUKtMIF5iaDEhniwNedqGo9FuLFzppDr3uwI=
-github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.12.1/go.mod h1:8XEsbTttt/W+VvjtQhLACqCisSPWTxCZ7sBRjU6iH9c=
-github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
-github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
-github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/consul/sdk v0.3.0/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
-github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
-github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
-github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
-github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
-github.com/jgautheron/goconst v1.4.0/go.mod h1:aAosetZ5zaeC/2EfMeRswtxUFBpe2Hr7HzkgX4fanO4=
-github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSnpuG7toUTG4=
-github.com/jingyugao/rowserrcheck v0.0.0-20210315055705-d907ca737bb1/go.mod h1:TOQpc2SLx6huPfoFGK3UOnEG+u02D3C1GeosjupAKCA=
-github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
-github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks=
-github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
-github.com/jonboulle/clockwork v0.2.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/juju/ratelimit v1.0.1/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
-github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
-github.com/julz/importas v0.0.0-20210419104244-841f0c0fe66d/go.mod h1:oSFU2R4XK/P7kNBrnL/FEQlDGN1/6WoxXEjSSXO0DV0=
-github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
-github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
-github.com/kisielk/errcheck v1.6.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.10.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.0/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kulti/thelper v0.4.0/go.mod h1:vMu2Cizjy/grP+jmsvOFDx1kYP6+PD1lqg4Yu5exl2U=
-github.com/kunwardeep/paralleltest v1.0.2/go.mod h1:ZPqNm1fVHPllh5LPVujzbVz1JN2GhLxSfY+oqUsvG30=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/kyoh86/exportloopref v0.1.8/go.mod h1:1tUcJeiioIs7VWe5gcOObrux3lb66+sBqGZrRkMwPgg=
-github.com/ldez/gomoddirectives v0.2.1/go.mod h1:sGicqkRgBOg//JfpXwkB9Hj0X5RyJ7mlACM5B9f6Me4=
-github.com/ldez/tagliatelle v0.2.0/go.mod h1:8s6WJQwEYHbKZDsp/LjArytKOG8qaMrKQQ3mFukHs88=
-github.com/letsencrypt/pkcs11key/v4 v4.0.0/go.mod h1:EFUvBDay26dErnNb70Nd0/VW3tJiIbETBPTl9ATXQag=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.9.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
-github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
-github.com/logrusorgru/aurora v0.0.0-20181002194514-a7b3b318ed4e/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
-github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
-github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/maratori/testpackage v1.0.1/go.mod h1:ddKdw+XG0Phzhx8BFDTKgpWP4i7MpApTE5fXSKAqwDU=
-github.com/matoous/godox v0.0.0-20210227103229-6504466cf951/go.mod h1:1BELzlh859Sh1c6+90blK8lbYy0kwQf1bYlBhBysy1s=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mbilski/exhaustivestruct v1.2.0/go.mod h1:OeTBVxQWoEmB2J2JCHmXWPJ0aksxSUOUy+nvtVEfzXc=
-github.com/mgechev/dots v0.0.0-20190921121421-c36f7dcfbb81/go.mod h1:KQ7+USdGKfpPjXk4Ga+5XxQM4Lm4e3gAogrreFAYpOg=
-github.com/mgechev/revive v1.0.6/go.mod h1:Lj5gIVxjBlH8REa3icEOkdfchwYc291nShzZ4QYWyMo=
-github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/miekg/dns v1.1.35/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
-github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
-github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
-github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
-github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/moricho/tparallel v0.2.1/go.mod h1:fXEIZxG2vdfl0ZF8b42f5a78EhjjD5mX8qUplsoSU4k=
-github.com/mozilla/scribe v0.0.0-20180711195314-fb71baf557c1/go.mod h1:FIczTrinKo8VaLxe6PWTPEXRXDIHz2QAwiaBaP5/4a8=
-github.com/mozilla/tls-observatory v0.0.0-20210209181001-cf43108d6880/go.mod h1:FUqVoUPHSEdDR0MnFM3Dh8AU0pZHLXUD127SAJGER/s=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007/go.mod h1:m2XC9Qq0AlmmVksL6FktJCdTYyLk7V3fKyp0sl1yWQo=
-github.com/mwitkow/go-proto-validators v0.2.0/go.mod h1:ZfA1hW+UH/2ZHOWvQ3HnQaU0DtnpXu850MZiy+YUgcc=
-github.com/nakabonne/nestif v0.3.0/go.mod h1:dI314BppzXjJ4HsCnbo7XzrJHPszZsjnk5wEBSYHI2c=
-github.com/nats-io/jwt v0.3.0/go.mod h1:fRYCDE99xlTsqUzISS1Bi75UBJ6ljOJQOAAu5VglpSg=
-github.com/nats-io/jwt v0.3.2/go.mod h1:/euKqTS1ZD+zzjYrY7pseZrTtWQSjujC7xjPc8wL6eU=
-github.com/nats-io/nats-server/v2 v2.1.2/go.mod h1:Afk+wRZqkMQs/p45uXdrVLuab3gwv3Z8C4HTBu8GD/k=
-github.com/nats-io/nats.go v1.9.1/go.mod h1:ZjDU1L/7fJ09jvUSRVBR2e7+RnLiiIQyqyzEE/Zbp4w=
-github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
-github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
-github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
-github.com/nbutton23/zxcvbn-go v0.0.0-20210217022336-fa2cb2858354/go.mod h1:KSVJerMDfblTH7p5MZaTt+8zaT2iEk3AkVb9PQdZuE8=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nishanths/exhaustive v0.1.0/go.mod h1:S1j9110vxV1ECdCudXRkeMnFQ/DQk9ajLT0Uf2MYZQQ=
-github.com/nishanths/predeclared v0.0.0-20190419143655-18a43bb90ffc/go.mod h1:62PewwiQTlm/7Rj+cxVYqZvDIUc+JjZq6GHAC1fsObQ=
-github.com/nishanths/predeclared v0.2.1/go.mod h1:HvkGJcA3naj4lOwnFXFDkFxVtSqQMB9sbB1usJ+xjQE=
-github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
-github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
-github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
-github.com/olekukonko/tablewriter v0.0.2/go.mod h1:rSAaSIOAGT9odnlyGlUfAJaoc5w2fSBUmeGDbRWPxyQ=
-github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.15.0/go.mod h1:hF8qUzuuC8DJGygJH3726JnCZX4MYbRB8yFfISqnKUg=
-github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.10.5/go.mod h1:gza4q3jKQJijlu05nKWRCW/GavJumGt8aNRxWg7mt48=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
-github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
-github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
-github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/openzipkin-contrib/zipkin-go-opentracing v0.4.5/go.mod h1:/wsWhb9smxSfWAKL3wpBW7V8scJMt8N8gnaMCS9E/cA=
-github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
-github.com/openzipkin/zipkin-go v0.2.1/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
-github.com/openzipkin/zipkin-go v0.2.2/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
-github.com/pact-foundation/pact-go v1.0.4/go.mod h1:uExwJY4kCzNPcHRj+hCR/HBbOOIwwtUjcrb0b5/5kLM=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
-github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
-github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
-github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
-github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
-github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/polyfloyd/go-errorlint v0.0.0-20210418123303-74da32850375/go.mod h1:wi9BfjxjF/bwiZ701TzmfKu6UKC357IOAtNr0Td0Lvw=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
-github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.14.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
-github.com/pseudomuto/protoc-gen-doc v1.3.2/go.mod h1:y5+P6n3iGrbKG+9O04V5ld71in3v/bX88wUwgt+U8EA=
-github.com/pseudomuto/protokit v0.2.0/go.mod h1:2PdH30hxVHsup8KpBTOXTBeMVhJZVio3Q8ViKSAXT0Q=
-github.com/quasilyte/go-consistent v0.0.0-20190521200055-c6f3937de18c/go.mod h1:5STLWrekHfjyYwxBRVRXNOSewLJ3PWfDJd1VyTS21fI=
-github.com/quasilyte/go-ruleguard v0.3.1-0.20210203134552-1b5a410e1cc8/go.mod h1:KsAh3x0e7Fkpgs+Q9pNLS5XpFSvYCEVl5gP9Pp1xp30=
-github.com/quasilyte/go-ruleguard v0.3.4/go.mod h1:57FZgMnoo6jqxkYKmVj5Fc8vOt0rVzoE/UNAmFFIPqA=
-github.com/quasilyte/go-ruleguard/dsl v0.3.0/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
-github.com/quasilyte/go-ruleguard/dsl v0.3.2/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
-github.com/quasilyte/go-ruleguard/rules v0.0.0-20201231183845-9e62ed36efe1/go.mod h1:7JTjp89EGyU1d6XfBiXihJNG37wB2VRkd125Q1u7Plc=
-github.com/quasilyte/go-ruleguard/rules v0.0.0-20210203162857-b223e0831f88/go.mod h1:4cgAphtvu7Ftv7vOT2ZOYhC6CvBxZixcasr8qIOTA50=
-github.com/quasilyte/regex/syntax v0.0.0-20200407221936-30656e2c4a95/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0=
-github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
-github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryancurrah/gomodguard v1.2.0/go.mod h1:rNqbC4TOIdUDcVMSIpNNAzTbzXAZa6W5lnUepvuMMgQ=
-github.com/ryanrolds/sqlclosecheck v0.3.0/go.mod h1:1gREqxyTGR3lVtpngyFo3hZAgk0KCtEdgEkHwDbigdA=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
-github.com/sanposhiho/wastedassign v1.0.0/go.mod h1:LGpq5Hsv74QaqM47WtIsRSF/ik9kqk07kchgv66tLVE=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/securego/gosec/v2 v2.7.0/go.mod h1:xNbGArrGUspJLuz3LS5XCY1EBW/0vABAl/LWfSklmiM=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c/go.mod h1:/PevMnwAxekIXwN8qQyfc5gl2NlkB3CQlkizAbOkeBs=
-github.com/shirou/gopsutil/v3 v3.21.4/go.mod h1:ghfMypLDrFSWN2c9cDYFLHyynQ+QUht0cv/18ZqVczw=
-github.com/shurcooL/go v0.0.0-20180423040247-9e1955d9fb6e/go.mod h1:TDJrrUr11Vxrven61rcy3hJMUqaf/CLWYhHNPmT14Lk=
-github.com/shurcooL/go-goon v0.0.0-20170922171312-37c2f522c041/go.mod h1:N5mDOmsrJOB+vfqUK+7DmDyjhSLIIBnXo9lvZJj3MWQ=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
-github.com/sonatard/noctx v0.0.1/go.mod h1:9D2D/EoULe8Yy2joDHJj7bv3sZoq9AaSb8B4lqBjiZI=
-github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
-github.com/sourcegraph/go-diff v0.6.1/go.mod h1:iBszgVvyxdc8SFZ7gm69go2KDdt3ag071iBaWPF6cjs=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
-github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
-github.com/spf13/viper v1.7.1/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
-github.com/ssgreg/nlreturn/v2 v2.1.0/go.mod h1:E/iiPB78hV7Szg2YfRgyIrk1AD6JVMTRkkxBiELzh2I=
-github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
-github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
-github.com/streadway/handy v0.0.0-20190108123426-d5acb3125c2a/go.mod h1:qNTQ5P5JnDBl6z3cMAg/SywNDC5ABu5ApDIw6lUbRmI=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v0.0.0-20170130113145-4d4bfba8f1d1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.1.4/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
-github.com/tdakkota/asciicheck v0.0.0-20200416200610-e657995f937b/go.mod h1:yHp0ai0Z9gUljN3o0xMhYJnH/IcvkdTBOX2fmJ93JEM=
-github.com/tetafro/godot v1.4.6/go.mod h1:LR3CJpxDVGlYOWn3ZZg1PgNZdTUvzsZWu8xaEohUpn8=
-github.com/timakin/bodyclose v0.0.0-20200424151742-cb6215831a94/go.mod h1:Qimiffbc6q9tBWlVV6x0P9sat/ao1xEkREYPPj9hphk=
-github.com/tklauser/go-sysconf v0.3.4/go.mod h1:Cl2c8ZRWfHD5IrfHo9VN+FX9kCFjIOyVklgXycLB6ek=
-github.com/tklauser/numcpus v0.2.1/go.mod h1:9aU+wOc6WjUIZEwWMP62PL/41d65P+iks1gBkr4QyP8=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20200427203606-3cfed13b9966/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/tomarrell/wrapcheck/v2 v2.1.0/go.mod h1:crK5eI4RGSUrb9duDTQ5GqcukbKZvi85vX6nbhsBAeI=
-github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce/go.mod h1:o8v6yHRoik09Xen7gje4m9ERNah1d1PPsVq1VEx9vE4=
-github.com/tommy-muehle/go-mnd/v2 v2.3.2/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
-github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ultraware/funlen v0.0.3/go.mod h1:Dp4UiAus7Wdb9KUZsYWZEWiRzGuM2kXM1lPbfaF6xhA=
-github.com/ultraware/whitespace v0.0.4/go.mod h1:aVMh/gQve5Maj9hQ/hg+F75lr/X5A89uZnzAmWSineA=
-github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/uudashr/gocognit v1.0.1/go.mod h1:j44Ayx2KW4+oB6SWMv8KsmHzZrOInQav7D3cQMJ5JUM=
-github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.16.0/go.mod h1:YOKImeEosDdBPnxc0gy7INqi3m1zK6A+xl6TwOBhHCA=
-github.com/valyala/quicktemplate v1.6.3/go.mod h1:fwPzK2fHuYEODzJ9pkw0ipCPNHZ2tD5KW4lOuSdPKzY=
-github.com/valyala/tcplisten v0.0.0-20161114210144-ceec8f93295a/go.mod h1:v3UYOV9WzVtRmSR+PDvWpU/qWl4Wa5LApYYX4ZtKbio=
-github.com/viki-org/dnscache v0.0.0-20130720023526-c70c1f23c5d8/go.mod h1:dniwbG03GafCjFohMDmz6Zc6oCuiqgH6tGNyXTkHzXE=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
-github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b/go.mod h1:HptNXiXVDcJjXe9SqMd0v2FsL9f8dz4GnXgltU6q/co=
-github.com/yeya24/promlinter v0.1.0/go.mod h1:rs5vtZzeBHqqMwXqFScncpCF6u06lezhZepno9AB1Oc=
-github.com/yudai/gojsondiff v1.0.0/go.mod h1:AY32+k2cwILAkW1fbgxQ5mUmMiZFgLIV+FBNExI05xg=
-github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82/go.mod h1:lgjkn3NuSvDfVJdfcVVdX+jpBxNmX4rDAzaS45IcYoM=
-github.com/yudai/pp v2.0.1+incompatible/go.mod h1:PuxR/8QJ7cyCkFp/aUDS+JY727OFEZkTdatxwunjIkc=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.4/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg=
-go.etcd.io/etcd v0.0.0-20200513171258-e048e166ab9c/go.mod h1:xCI7ZzBfRuGgBXyXO6yfWfDmlWd35khcWpUa4L0xI/k=
-go.mozilla.org/mozlog v0.0.0-20170222151521-4bb13139d403/go.mod h1:jHoPAGnDrCy6kaI2tAze5Prf0Nr0w/oNkROt2lw3n3o=
-go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
-go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/automaxprocs v1.4.0/go.mod h1:/mTEdr7LvHhs0v7mjdxDreTz1OG5zdZGqgOnhWiR/+Q=
-go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
-go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
-go.uber.org/multierr v1.4.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
-go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
-golang.org/x/crypto v0.0.0-20180501155221-613d6eafa307/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191002035440-2ec189313ef0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200420163511-1957bb5e6d1f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210228012217-479acdf4ea46/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190110163146-51295c7ec13a/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190307163923-6a08e3108db3/go.mod h1:25r3+/G6/xytQM8iWZKq3Hn0kr0rgFKPUNVEL/dr3z4=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190311215038-5c2858a9cfe5/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190321232350-e250d351ecad/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190322203728-c1a832b0ad89/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190910044552-dd2b5c81c578/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190916130336-e45ffcd953cc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191010075000-0337d82405ff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117220505-0cba7a3a9ee9/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200324003944-a576cf524670/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200329025819-fd4102a86c65/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200414032229-332987a829c3/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200422022333-3d57cf2e726e/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200426102838-f3a5411a4c3b/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200622203043-20e05c1c8ffa/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200624225443-88f3c62a19ff/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200625211823-6506e20df31f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200626171337-aa94e735be7f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200630154851-b2d8b0336632/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200706234117-b22de6825cf7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200724022722-7017fd6b1305/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200812195022-5ae4c3c160a0/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200820010801-b793a1359eac/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200831203904-5a2aa26beb65/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201001104356-43ebab892c4c/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
-golang.org/x/tools v0.0.0-20201002184944-ecd9fd270d5d/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
-golang.org/x/tools v0.0.0-20201011145850-ed2f50202694/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
-golang.org/x/tools v0.0.0-20201023174141-c8cfbd0f21e6/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201028025901-8cd080b735b3/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201114224030-61ea331ec02b/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201118003311-bd56c0adb394/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201230224404-63754364767c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210104081019-d8d6ddbec6ee/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.2-0.20210512205948-8287d5da45e4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.10.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.2/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20181107211654-5fc9ac540362/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190530194941-fb225487d101/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20190927181202-20e1ac93f88c/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200626011028-ee7919e894b5/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200707001353-8e8330bf89df/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
-google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.0/go.mod h1:chYK+tFQF0nDUGJgXMSgLCQk3phJEuONr2DCgLDdAQM=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.22.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.0/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
-gopkg.in/cheggaaa/pb.v1 v1.0.28/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/gcfg.v1 v1.2.3/go.mod h1:yesOnuUOFQAhST5vPY4nbZsb/huCgGGXlipJsBn0b3o=
-gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
-gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.6/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.1.4/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
-mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
-mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
-mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
-mvdan.cc/unparam v0.0.0-20210104141923-aac4ce9116a7/go.mod h1:hBpJkZE8H/sb+VRFvw2+rBpHNsTBcvSpk61hr8mzXZE=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
-sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0/go.mod h1:hI742Nqp5OhwiqlzhgfbWU4mW4yO10fP+LoT9WOswdU=
diff --git a/build/fuzzer/main.go b/build/fuzzer/main.go
deleted file mode 100644
index d6c81f74ce..0000000000
--- a/build/fuzzer/main.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package fuzz
-
-import (
-	"bytes"
-
-	"github.com/open-policy-agent/opa/ast"
-)
-
-var blacklist = []string{}
-
-func Fuzz(data []byte) int {
-	for i := range blacklist {
-		if bytes.Contains(data, []byte(blacklist[i])) {
-			return -1
-		}
-	}
-	str := string(data)
-	_, _, err := ast.ParseStatements("", str)
-	if err == nil {
-		ast.CompileModules(map[string]string{"": str})
-		return 1
-	}
-	return 0
-}
diff --git a/build/gen-cli-docs.sh b/build/gen-cli-docs.sh
new file mode 100755
index 0000000000..1412b4f77c
--- /dev/null
+++ b/build/gen-cli-docs.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+SCRIPT_DIR=$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)
+
+GOOS="" GOARCH="" go run "$SCRIPT_DIR"/generate-cli-docs/generate.go "$@"
diff --git a/build/gen-dev-patch.sh b/build/gen-dev-patch.sh
index a6f1fab9a7..4fb41c458b 100755
--- a/build/gen-dev-patch.sh
+++ b/build/gen-dev-patch.sh
@@ -39,8 +39,8 @@ cd $OPA_DIR
 
 LAST_VERSION=$(git describe --abbrev=0 --tags | cut -c 2-)
 
-update_makefile() {
-    sed -i='' -e "s/Version\s\+=\s\+\".\+\"$/Version = \"$VERSION-dev\"/" version/version.go
+update_version() {
+    ./build/update-version.sh "$VERSION-dev"
 }
 
 update_changelog() {
@@ -57,7 +57,7 @@ EOF
 }
 
 main() {
-    update_makefile
+    update_version
     update_changelog
     git --no-pager diff --no-color
 }
diff --git a/build/gen-release-patch.sh b/build/gen-release-patch.sh
index f347ef7412..ef93a4a3b1 100755
--- a/build/gen-release-patch.sh
+++ b/build/gen-release-patch.sh
@@ -41,8 +41,8 @@ if [ -z "$LAST_VERSION" ]; then
     LAST_VERSION=$(git describe --abbrev=0 --tags)
 fi
 
-update_makefile() {
-    sed -i='' -e "s/Version\s\+=\s\+\".\+\"$/Version = \"$VERSION\"/" version/version.go
+update_version() {
+    ./build/update-version.sh "$VERSION"
 }
 
 update_changelog() {
@@ -76,10 +76,16 @@ update_capabilities() {
     git add --intent-to-add capabilities/v$VERSION.json
 }
 
+update_metadata() {
+    make generate
+    git add --intent-to-add builtin_metadata.json
+}
+
 main() {
-    update_makefile
+    update_version
     update_changelog
     update_capabilities
+    update_metadata
     git --no-pager diff --no-color
 }
 
diff --git a/build/generate-cli-docs/generate.go b/build/generate-cli-docs/generate.go
new file mode 100644
index 0000000000..b54d730b58
--- /dev/null
+++ b/build/generate-cli-docs/generate.go
@@ -0,0 +1,121 @@
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra/doc"
+
+	"github.com/open-policy-agent/opa/cmd"
+)
+
+const fileHeader = `---
+title: CLI
+kind: documentation
+weight: 90
+restrictedtoc: true
+---
+
+The OPA executable provides the following commands.
+
+`
+
+func main() {
+	if len(os.Args) != 2 {
+		log.Fatal("Required argument: cli docs output directory")
+	}
+	out := os.Args[1]
+
+	command := cmd.RootCommand
+	command.Use = "opa [command]"
+	command.DisableAutoGenTag = true
+
+	dir, err := os.MkdirTemp("", "opa")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+
+	err = doc.GenMarkdownTree(command, dir)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	files, err := os.ReadDir(dir)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	builder := strings.Builder{}
+
+	last := len(files) - 1
+	for i, file := range files {
+		// Skip the first "opa" document as it's rather pointless to include (only shows the --help flag)
+		if i == 0 {
+			continue
+		}
+		path := filepath.Join(dir, file.Name())
+		document, err := fixupSection(path)
+		if err != nil {
+			log.Fatal(err)
+		}
+		builder.WriteString(document)
+		if i != last {
+			builder.WriteString("____\n\n")
+		}
+	}
+
+	heading := regexp.MustCompile(`^[\\-]+$`)
+	lines := strings.Split(builder.String(), "\n")
+	document := make([]string, 0, len(lines))
+	removed := 0
+
+	// The document may contain "----" for headings, which will be converted to h1
+	// elements in markdown. This is undesirable, so let's remove them and prepend
+	// the line before that with ### to instead create a h3
+	for line, str := range lines {
+		if heading.Match([]byte(str)) {
+			document[line-1-removed] = fmt.Sprintf("### %s\n", document[line-1-removed])
+			removed++
+			continue
+		}
+		document = append(document, fmt.Sprintf("%s\n", str))
+	}
+
+	withHeader := fmt.Sprintf("%s%s", fileHeader, strings.Join(document, ""))
+	err = os.WriteFile(filepath.Join(out, "cli.md"), []byte(withHeader), 0755)
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
+func fixupSection(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	scanner := bufio.NewScanner(f)
+	builder := strings.Builder{}
+
+	for scanner.Scan() {
+		line := scanner.Text()
+		// Remove "See also" section
+		if strings.Contains(line, "### SEE ALSO") {
+			break
+		}
+		if home := os.Getenv("HOME"); home != "" {
+			line = strings.ReplaceAll(line, home, "$HOME")
+		}
+		builder.WriteString(line)
+		builder.WriteString("\n")
+	}
+
+	return builder.String(), scanner.Err()
+}
diff --git a/build/get-build-commit.sh b/build/get-build-commit.sh
deleted file mode 100755
index 5c386553cf..0000000000
--- a/build/get-build-commit.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-
-GIT_SHA=$(git rev-parse --short HEAD)
-
-if [ -z "$(git status --porcelain 2>/dev/null)" ]; then
-    echo $GIT_SHA
-else
-    echo "$GIT_SHA-dirty"
-fi
diff --git a/build/get-build-timestamp.sh b/build/get-build-timestamp.sh
deleted file mode 100755
index 8ba5567b6d..0000000000
--- a/build/get-build-timestamp.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-date -u +"%Y-%m-%dT%H:%M:%SZ"
diff --git a/build/get-build-version.sh b/build/get-build-version.sh
index e7e47d8cfb..435a11ac65 100755
--- a/build/get-build-version.sh
+++ b/build/get-build-version.sh
@@ -1,3 +1,3 @@
 #!/usr/bin/env bash
 
-grep '^var Version' version/version.go | awk '{print $4}' | tr -d '"'
\ No newline at end of file
+awk -F'"' '/^var Version/{print $2}' version/version.go
\ No newline at end of file
diff --git a/build/policy/files.rego b/build/policy/files.rego
new file mode 100644
index 0000000000..ed14cf7008
--- /dev/null
+++ b/build/policy/files.rego
@@ -0,0 +1,133 @@
+# Expects policy input as provided by:
+# https://api.github.com/repos/open-policy-agent/opa/pulls/${PR_ID}/files
+#
+# Note that the "filename" here refers to the full path of the file, like
+# docs/website/data/integrations.yaml - since that's how it's named in the
+# input we'll use the same convention here.
+
+package files
+
+import future.keywords.contains
+import future.keywords.if
+import future.keywords.in
+
+import data.helpers.basename
+import data.helpers.directory
+import data.helpers.extension
+
+filenames := {f.filename | some f in input}
+
+logo_exts := {"png", "svg"}
+
+changes[filename] := attributes if {
+	some change in input
+	filename := change.filename
+	attributes := object.remove(change, ["filename"])
+}
+
+http_error(response) if response.status_code == 0
+
+http_error(response) if response.status_code >= 400
+
+dump_response_on_error(response) := response if {
+	http_error(response)
+	print("unexpected error in response", response)
+}
+
+dump_response_on_error(response) := response if not http_error(response)
+
+get_file_in_pr(filename) := dump_response_on_error(http.send({
+	"url": changes[filename].raw_url,
+	"method": "GET",
+	"headers": {"Authorization": sprintf("Bearer %v", [opa.runtime().env.GITHUB_TOKEN])},
+	"cache": true,
+	"enable_redirect": true,
+	"raise_error": false,
+})).raw_body
+
+deny contains "Logo must be placed in docs/website/static/img/logos/integrations" if {
+	"docs/website/data/integrations.yaml" in filenames
+
+	some filename in filenames
+	extension(filename) in logo_exts
+	changes[filename].status == "added"
+	directory(filename) != "docs/website/static/img/logos/integrations"
+}
+
+deny contains "Logo must be a .png or .svg file" if {
+	"docs/website/data/integrations.yaml" in filenames
+
+	some filename in filenames
+	changes[filename].status == "added"
+	directory(filename) == "docs/website/static/img/logos/integrations"
+	not extension(filename) in logo_exts
+}
+
+deny contains "Logo name must match integration" if {
+	"docs/website/data/integrations.yaml" in filenames
+
+	some filename in filenames
+	ext := extension(filename)
+	ext in logo_exts
+	changes[filename].status == "added"
+	logo_name := trim_suffix(basename(filename), concat("", [".", ext]))
+
+	integrations := {integration | some integration, _ in yaml.unmarshal(integrations_file).integrations}
+	not logo_name in integrations
+}
+
+deny contains sprintf("Integration '%v' missing required attribute '%v'", [name, attr]) if {
+	"docs/website/data/integrations.yaml" in filenames
+
+	file := yaml.unmarshal(integrations_file)
+	required := {"title", "description"}
+
+	some name, item in file.integrations
+	some attr in (required - {key | some key, _ in item})
+}
+
+deny contains sprintf("Integration '%v' references unknown software '%v' (i.e. not in 'software' object)", [name, software]) if {
+	"docs/website/data/integrations.yaml" in filenames
+
+	file := yaml.unmarshal(integrations_file)
+	software_list := object.keys(file.software)
+
+	some name, item in file.integrations
+	some software in item.software
+	not software in software_list
+}
+
+deny contains sprintf("Integration '%v' references unknown organization '%v' (i.e. not in 'organizations' object)", [name, organization]) if {
+	"docs/website/data/integrations.yaml" in filenames
+
+	file := yaml.unmarshal(integrations_file)
+	organizations_list := object.keys(file.organizations)
+
+	some name, item in file.integrations
+	some organization in item.inventors
+	not organization in organizations_list
+}
+
+deny contains sprintf("%s is an invalid YAML file: %s", [filename, content]) if {
+	some filename, content in yaml_file_contents
+	changes[filename].status in {"added", "modified"}
+	not yaml.is_valid(content)
+}
+
+deny contains sprintf("%s is an invalid JSON file: %s", [filename, content]) if {
+	some filename, content in json_file_contents
+	changes[filename].status in {"added", "modified"}
+	not json.is_valid(content)
+}
+
+integrations_file := get_file_in_pr("docs/website/data/integrations.yaml")
+
+yaml_file_contents[filename] := get_file_in_pr(filename) if {
+	some filename in filenames
+	extension(filename) in {"yml", "yaml"}
+}
+
+json_file_contents[filename] := get_file_in_pr(filename) if {
+	some filename in filenames
+	extension(filename) == "json"
+}
diff --git a/build/policy/files_test.rego b/build/policy/files_test.rego
new file mode 100644
index 0000000000..b6e432f7f5
--- /dev/null
+++ b/build/policy/files_test.rego
@@ -0,0 +1,204 @@
+package files_test
+
+import future.keywords.in
+
+import data.files.deny
+
+test_deny_logo_if_added_in_wrong_directory {
+	expected := "Logo must be placed in docs/website/static/img/logos/integrations"
+	expected in deny with input as [
+		{
+			"filename": "docs/website/data/integrations.yaml",
+			"status": "modified",
+		},
+		{
+			"filename": "docs/website/static/img/logos/example.png",
+			"status": "added",
+		},
+	]
+}
+
+test_allow_logo_if_added_in_correct_directory {
+	integrations := yaml.marshal({"integrations": {"example": {
+		"title": "My test integration",
+		"description": "Testing",
+	}}})
+
+	count(deny) == 0 with data.files.integrations_file as integrations with input as [
+		{
+			"filename": "docs/website/data/integrations.yaml",
+			"status": "modified",
+		},
+		{
+			"filename": "docs/website/static/img/logos/integrations/example.png",
+			"status": "added",
+		},
+	]
+}
+
+test_deny_logo_if_not_png_file {
+	expected := "Logo must be a .png or .svg file"
+	expected in deny with input as [
+		{
+			"filename": "docs/website/data/integrations.yaml",
+			"status": "modified",
+		},
+		{
+			"filename": "docs/website/static/img/logos/integrations/example.jpg",
+			"status": "added",
+		},
+	]
+}
+
+test_deny_logo_if_no_matching_integration {
+	integrations := yaml.marshal({"integrations": {"my-integration": {
+		"title": "My test integration",
+		"description": "Testing",
+	}}})
+
+	files := [
+		{
+			"filename": "docs/website/data/integrations.yaml",
+			"status": "modified",
+		},
+		{
+			"filename": "docs/website/static/img/logos/integrations/example.png",
+			"status": "added",
+		},
+	]
+
+	expected := "Logo name must match integration"
+
+	expected in deny with data.files.integrations_file as integrations with input as files
+}
+
+test_allow_logo_if_no_matching_integration {
+	integrations := yaml.marshal({"integrations": {"my-integration": {
+		"title": "My test integration",
+		"description": "Testing",
+	}}})
+
+	files := [
+		{
+			"filename": "docs/website/data/integrations.yaml",
+			"status": "modified",
+		},
+		{
+			"filename": "docs/website/static/img/logos/integrations/my-integration.png",
+			"status": "added",
+		},
+	]
+
+	count(deny) == 0 with data.files.integrations_file as integrations with input as files
+}
+
+test_deny_integration_if_missing_required_attribute {
+	expected := "Integration 'my-integration' missing required attribute 'description'"
+	files := [{"filename": "docs/website/data/integrations.yaml"}]
+	integrations := yaml.marshal({"integrations": {"my-integration": {
+		"title": "My test integration",
+		"inventors": ["acmecorp"],
+	}}})
+
+	expected in deny with data.files.integrations_file as integrations with input as files
+}
+
+test_deny_integration_allowed_with_required_attributes {
+	files := [{"filename": "docs/website/data/integrations.yaml"}]
+	integrations := yaml.marshal({
+		"integrations": {"my-integration": {
+			"title": "My test integration",
+			"description": "This is a test integration",
+			"inventors": ["acmecorp"],
+		}},
+		"organizations": {"acmecorp": {"name": "AcmeCorp", "link": "https://acmecorp.example.org"}},
+	})
+
+	count(deny) == 0 with data.files.integrations_file as integrations with input as files
+}
+
+test_deny_unlisted_software {
+	files := [{"filename": "docs/website/data/integrations.yaml"}]
+	integrations := yaml.marshal({
+		"integrations": {"my-integration": {
+			"title": "My test integration",
+			"description": "This is a test integration",
+			"software": ["bitcoin-miner"],
+		}},
+		"software": {"kubernetes": {"name": "Kubernetes"}},
+	})
+
+	expected := "Integration 'my-integration' references unknown software 'bitcoin-miner' (i.e. not in 'software' object)"
+
+	expected in deny with data.files.integrations_file as integrations with input as files
+}
+
+test_allow_listed_software {
+	files := [{"filename": "docs/website/data/integrations.yaml"}]
+	integrations := yaml.marshal({
+		"integrations": {"my-integration": {
+			"title": "My test integration",
+			"description": "This is a test integration",
+			"software": ["kubernetes"],
+		}},
+		"software": {"kubernetes": {"name": "Kubernetes"}},
+	})
+
+	count(deny) == 0 with data.files.integrations_file as integrations with input as files
+}
+
+test_deny_unlisted_organization {
+	files := [{"filename": "docs/website/data/integrations.yaml"}]
+	integrations := yaml.marshal({
+		"integrations": {"my-integration": {
+			"title": "My test integration",
+			"description": "This is a test integration",
+			"software": ["kubernetes"],
+			"inventors": ["acmecorp"],
+		}},
+		"software": {"kubernetes": {"name": "Kubernetes"}},
+		"organizations": {"foobar": {"name": "FooBar", "link": "https://foobar.example.org"}},
+	})
+
+	expected := "Integration 'my-integration' references unknown organization 'acmecorp' (i.e. not in 'organizations' object)"
+
+	expected in deny with data.files.integrations_file as integrations with input as files
+}
+
+test_allow_listed_organization {
+	files := [{"filename": "docs/website/data/integrations.yaml"}]
+	integrations := yaml.marshal({
+		"integrations": {"my-integration": {
+			"title": "My test integration",
+			"description": "This is a test integration",
+			"software": ["kubernetes"],
+			"inventors": ["acmecorp"],
+		}},
+		"software": {"kubernetes": {"name": "Kubernetes"}},
+		"organizations": {"acmecorp": {"name": "AcmeCorp", "link": "https://acmecorp.example.org"}},
+	})
+
+	count(deny) == 0 with data.files.integrations_file as integrations with input as files
+}
+
+test_deny_invalid_yaml_file {
+	expected := "invalid.yaml is an invalid YAML file: {null{}}"
+	expected in deny with data.files.yaml_file_contents as {"invalid.yaml": "{null{}}"}
+		with data.files.changes as {"invalid.yaml": {"status": "modified"}}
+}
+
+test_allow_valid_yaml_file {
+	count(deny) == 0 with data.files.yaml_file_contents as {"valid.yaml": "foo: bar"}
+		with data.files.changes as {"valid.yaml": {"status": "modified"}}
+}
+
+test_deny_invalid_json_file {
+	expected := "invalid.json is an invalid JSON file: }}}"
+	expected in deny with data.files.json_file_contents as {"invalid.json": "}}}"}
+		with data.files.changes as {"invalid.json": {"status": "modified"}}
+}
+
+test_allow_valid_json_file {
+	count(deny) == 0 with data.files.json_file_contents as {"valid.json": "{\"foo\": \"bar\"}"}
+		with data.files.changes as {"valid.json": {"status": "modified"}}
+}
diff --git a/build/policy/helpers.rego b/build/policy/helpers.rego
new file mode 100644
index 0000000000..0236ef5a4c
--- /dev/null
+++ b/build/policy/helpers.rego
@@ -0,0 +1,16 @@
+package helpers
+
+import future.keywords.if
+import future.keywords.in
+
+last_indexof(string, search) := i if {
+	all := [i | chars := split(string, ""); chars[i] == search]
+	count(all) > 0
+	i := all[count(all) - 1]
+} else := -1
+
+basename(filename) := substring(filename, last_indexof(filename, "/") + 1, count(filename) - 1)
+
+extension(filename) := substring(filename, last_indexof(filename, ".") + 1, count(filename) - 1)
+
+directory(filename) := substring(filename, 0, last_indexof(filename, "/"))
diff --git a/build/replacements/github.com/golang/glog/glog.go b/build/replacements/github.com/golang/glog/glog.go
new file mode 100644
index 0000000000..2d258ce66c
--- /dev/null
+++ b/build/replacements/github.com/golang/glog/glog.go
@@ -0,0 +1,21 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package glog is used as a replacement for github.com/golang/glog. The latter
+// is used only through badger (ristretto), and comes with costly current user
+// lookups that we don't need: it's only used for printing fatal errors before
+// giving up.
+package glog
+
+import "log"
+
+// Fatal outputs its arguments and does an os.Exit(1)
+func Fatal(args ...interface{}) {
+	log.Fatal(args...)
+}
+
+// Fatalf formats and outputs its arguments and does an os.Exit(1)
+func Fatalf(format string, args ...interface{}) {
+	log.Fatal(append([]interface{}{format}, args...))
+}
diff --git a/build/replacements/github.com/golang/glog/go.mod b/build/replacements/github.com/golang/glog/go.mod
new file mode 100644
index 0000000000..fd56d00dfd
--- /dev/null
+++ b/build/replacements/github.com/golang/glog/go.mod
@@ -0,0 +1,3 @@
+module github.com/open-policy-agent/opa/replacements/github.com/golang/glog
+
+go 1.18
diff --git a/build/update-version.sh b/build/update-version.sh
new file mode 100755
index 0000000000..d5a20d73a4
--- /dev/null
+++ b/build/update-version.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -e
+# NOTE(sr): This was the only way I've found to replace the string
+# reliably on OSX and Linux.
+perl -pi -e "s/Version = \".*\"$/Version = \"$1\"/" version/version.go
\ No newline at end of file
diff --git a/builtin_metadata.json b/builtin_metadata.json
new file mode 100644
index 0000000000..c4802da739
--- /dev/null
+++ b/builtin_metadata.json
@@ -0,0 +1,17956 @@
+{
+  "_categories": {
+    "aggregates": [
+      "count",
+      "max",
+      "min",
+      "product",
+      "sort",
+      "sum"
+    ],
+    "array": [
+      "array.concat",
+      "array.reverse",
+      "array.slice"
+    ],
+    "bits": [
+      "bits.and",
+      "bits.lsh",
+      "bits.negate",
+      "bits.or",
+      "bits.rsh",
+      "bits.xor"
+    ],
+    "comparison": [
+      "equal",
+      "gt",
+      "gte",
+      "lt",
+      "lte",
+      "neq"
+    ],
+    "conversions": [
+      "to_number"
+    ],
+    "crypto": [
+      "crypto.hmac.equal",
+      "crypto.hmac.md5",
+      "crypto.hmac.sha1",
+      "crypto.hmac.sha256",
+      "crypto.hmac.sha512",
+      "crypto.md5",
+      "crypto.sha1",
+      "crypto.sha256",
+      "crypto.x509.parse_and_verify_certificates",
+      "crypto.x509.parse_certificate_request",
+      "crypto.x509.parse_certificates",
+      "crypto.x509.parse_rsa_private_key"
+    ],
+    "encoding": [
+      "base64.decode",
+      "base64.encode",
+      "base64.is_valid",
+      "base64url.decode",
+      "base64url.encode",
+      "base64url.encode_no_pad",
+      "hex.decode",
+      "hex.encode",
+      "json.is_valid",
+      "json.marshal",
+      "json.unmarshal",
+      "urlquery.decode",
+      "urlquery.decode_object",
+      "urlquery.encode",
+      "urlquery.encode_object",
+      "yaml.is_valid",
+      "yaml.marshal",
+      "yaml.unmarshal"
+    ],
+    "glob": [
+      "glob.match",
+      "glob.quote_meta"
+    ],
+    "graph": [
+      "graph.reachable",
+      "graph.reachable_paths",
+      "walk"
+    ],
+    "graphql": [
+      "graphql.is_valid",
+      "graphql.parse",
+      "graphql.parse_and_verify",
+      "graphql.parse_query",
+      "graphql.parse_schema",
+      "graphql.schema_is_valid"
+    ],
+    "http": [
+      "http.send"
+    ],
+    "internal": [
+      "internal.member_2",
+      "internal.member_3",
+      "internal.print"
+    ],
+    "net": [
+      "net.cidr_contains",
+      "net.cidr_contains_matches",
+      "net.cidr_expand",
+      "net.cidr_intersects",
+      "net.cidr_is_valid",
+      "net.cidr_merge",
+      "net.lookup_ip_addr"
+    ],
+    "numbers": [
+      "abs",
+      "ceil",
+      "div",
+      "floor",
+      "minus",
+      "mul",
+      "numbers.range",
+      "plus",
+      "rand.intn",
+      "rem",
+      "round"
+    ],
+    "object": [
+      "json.filter",
+      "json.match_schema",
+      "json.patch",
+      "json.remove",
+      "json.verify_schema",
+      "object.filter",
+      "object.get",
+      "object.keys",
+      "object.remove",
+      "object.subset",
+      "object.union",
+      "object.union_n"
+    ],
+    "opa": [
+      "opa.runtime"
+    ],
+    "providers.aws": [
+      "providers.aws.sign_req"
+    ],
+    "regex": [
+      "regex.find_all_string_submatch_n",
+      "regex.find_n",
+      "regex.globs_match",
+      "regex.is_valid",
+      "regex.match",
+      "regex.replace",
+      "regex.split",
+      "regex.template_match"
+    ],
+    "rego": [
+      "rego.metadata.chain",
+      "rego.metadata.rule",
+      "rego.parse_module"
+    ],
+    "semver": [
+      "semver.compare",
+      "semver.is_valid"
+    ],
+    "sets": [
+      "and",
+      "intersection",
+      "minus",
+      "or",
+      "union"
+    ],
+    "strings": [
+      "concat",
+      "contains",
+      "endswith",
+      "format_int",
+      "indexof",
+      "indexof_n",
+      "lower",
+      "replace",
+      "split",
+      "sprintf",
+      "startswith",
+      "strings.any_prefix_match",
+      "strings.any_suffix_match",
+      "strings.replace_n",
+      "strings.reverse",
+      "substring",
+      "trim",
+      "trim_left",
+      "trim_prefix",
+      "trim_right",
+      "trim_space",
+      "trim_suffix",
+      "upper"
+    ],
+    "time": [
+      "time.add_date",
+      "time.clock",
+      "time.date",
+      "time.diff",
+      "time.format",
+      "time.now_ns",
+      "time.parse_duration_ns",
+      "time.parse_ns",
+      "time.parse_rfc3339_ns",
+      "time.weekday"
+    ],
+    "tokens": [
+      "io.jwt.decode",
+      "io.jwt.decode_verify",
+      "io.jwt.verify_es256",
+      "io.jwt.verify_es384",
+      "io.jwt.verify_es512",
+      "io.jwt.verify_hs256",
+      "io.jwt.verify_hs384",
+      "io.jwt.verify_hs512",
+      "io.jwt.verify_ps256",
+      "io.jwt.verify_ps384",
+      "io.jwt.verify_ps512",
+      "io.jwt.verify_rs256",
+      "io.jwt.verify_rs384",
+      "io.jwt.verify_rs512"
+    ],
+    "tokensign": [
+      "io.jwt.encode_sign",
+      "io.jwt.encode_sign_raw"
+    ],
+    "tracing": [
+      "trace"
+    ],
+    "types": [
+      "is_array",
+      "is_boolean",
+      "is_null",
+      "is_number",
+      "is_object",
+      "is_set",
+      "is_string",
+      "type_name"
+    ],
+    "units": [
+      "units.parse",
+      "units.parse_bytes"
+    ],
+    "uuid": [
+      "uuid.rfc4122"
+    ]
+  },
+  "abs": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the number without its sign.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the absolute value of `x`",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "all": {
+    "args": [
+      {
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "and": {
+    "args": [
+      {
+        "name": "x",
+        "type": "set[any]"
+      },
+      {
+        "name": "y",
+        "type": "set[any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the intersection of two sets.",
+    "infix": "\u0026",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the intersection of `x` and `y`",
+      "name": "z",
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "any": {
+    "args": [
+      {
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "array.concat": {
+    "args": [
+      {
+        "name": "x",
+        "type": "array[any]"
+      },
+      {
+        "name": "y",
+        "type": "array[any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Concatenates two arrays.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the concatenation of `x` and `y`",
+      "name": "z",
+      "type": "array[any]"
+    },
+    "wasm": true
+  },
+  "array.reverse": {
+    "args": [
+      {
+        "description": "the array to be reversed",
+        "name": "arr",
+        "type": "array[any]"
+      }
+    ],
+    "available": [
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the reverse of a given array.",
+    "introduced": "v0.36.0",
+    "result": {
+      "description": "an array containing the elements of `arr` in reverse order",
+      "name": "rev",
+      "type": "array[any]"
+    },
+    "wasm": true
+  },
+  "array.slice": {
+    "args": [
+      {
+        "description": "the array to be sliced",
+        "name": "arr",
+        "type": "array[any]"
+      },
+      {
+        "description": "the start index of the returned slice; if less than zero, it's clamped to 0",
+        "name": "start",
+        "type": "number"
+      },
+      {
+        "description": "the stop index of the returned slice; if larger than `count(arr)`, it's clamped to `count(arr)`",
+        "name": "stop",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a slice of a given array. If `start` is greater or equal than `stop`, `slice` is `[]`.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the subslice of `array`, from `start` to `end`, including `arr[start]`, but excluding `arr[end]`",
+      "name": "slice",
+      "type": "array[any]"
+    },
+    "wasm": true
+  },
+  "assign": {
+    "args": [
+      {
+        "type": "any"
+      },
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": ":=",
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "base64.decode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Deserializes the base64 encoded input string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "base64 deserialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "base64.encode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Serializes the input string into base64 encoding.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "base64 serialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "base64.is_valid": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies the input string is base64 encoded.",
+    "introduced": "v0.24.0",
+    "result": {
+      "description": "`true` if `x` is valid base64 encoded value, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "base64url.decode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Deserializes the base64url encoded input string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "base64url deserialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "base64url.encode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Serializes the input string into base64url encoding.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "base64url serialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "base64url.encode_no_pad": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Serializes the input string into base64url encoding without padding.",
+    "introduced": "v0.25.0-rc2",
+    "result": {
+      "description": "base64url serialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "bits.and": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the bitwise \"AND\" of two integers.",
+    "introduced": "v0.18.0",
+    "result": {
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "bits.lsh": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "s",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a new integer with its bits shifted `s` bits to the left.",
+    "introduced": "v0.18.0",
+    "result": {
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "bits.negate": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the bitwise negation (flip) of an integer.",
+    "introduced": "v0.18.0",
+    "result": {
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "bits.or": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the bitwise \"OR\" of two integers.",
+    "introduced": "v0.18.0",
+    "result": {
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "bits.rsh": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "s",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a new integer with its bits shifted `s` bits to the right.",
+    "introduced": "v0.18.0",
+    "result": {
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "bits.xor": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the bitwise \"XOR\" (exclusive-or) of two integers.",
+    "introduced": "v0.18.0",
+    "result": {
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "cast_array": {
+    "args": [
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "array[any]"
+    },
+    "wasm": false
+  },
+  "cast_boolean": {
+    "args": [
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "cast_null": {
+    "args": [
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "null"
+    },
+    "wasm": false
+  },
+  "cast_object": {
+    "args": [
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "object[any: any]"
+    },
+    "wasm": false
+  },
+  "cast_set": {
+    "args": [
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "set[any]"
+    },
+    "wasm": false
+  },
+  "cast_string": {
+    "args": [
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "ceil": {
+    "args": [
+      {
+        "description": "the number to round",
+        "name": "x",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Rounds the number _up_ to the nearest integer.",
+    "introduced": "v0.26.0",
+    "result": {
+      "description": "the result of rounding `x` _up_",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "concat": {
+    "args": [
+      {
+        "name": "delimiter",
+        "type": "string"
+      },
+      {
+        "description": "strings to join",
+        "name": "collection",
+        "type": "any\u003carray[string], set[string]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Joins a set or array of strings with a delimiter.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "contains": {
+    "args": [
+      {
+        "description": "string to search in",
+        "name": "haystack",
+        "type": "string"
+      },
+      {
+        "description": "substring to look for",
+        "name": "needle",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the search string is included in the base string",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "result of the containment check",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "count": {
+    "args": [
+      {
+        "description": "the set/array/object/string to be counted",
+        "name": "collection",
+        "type": "any\u003cstring, array[any], object[any: any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": " Count takes a collection or string and returns the number of elements (or characters) in it.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the count of elements, key/val pairs, or characters, respectively.",
+      "name": "n",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "crypto.hmac.equal": {
+    "args": [
+      {
+        "description": "mac1 to compare",
+        "name": "mac1",
+        "type": "string"
+      },
+      {
+        "description": "mac2 to compare",
+        "name": "mac2",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a boolean representing the result of comparing two MACs for equality without leaking timing information.",
+    "introduced": "v0.52.0",
+    "result": {
+      "description": "`true` if the MACs are equals, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "crypto.hmac.md5": {
+    "args": [
+      {
+        "description": "input string",
+        "name": "x",
+        "type": "string"
+      },
+      {
+        "description": "key to use",
+        "name": "key",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the MD5 HMAC of the input message using the input key.",
+    "introduced": "v0.36.0",
+    "result": {
+      "description": "MD5-HMAC of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.hmac.sha1": {
+    "args": [
+      {
+        "description": "input string",
+        "name": "x",
+        "type": "string"
+      },
+      {
+        "description": "key to use",
+        "name": "key",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the SHA1 HMAC of the input message using the input key.",
+    "introduced": "v0.36.0",
+    "result": {
+      "description": "SHA1-HMAC of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.hmac.sha256": {
+    "args": [
+      {
+        "description": "input string",
+        "name": "x",
+        "type": "string"
+      },
+      {
+        "description": "key to use",
+        "name": "key",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the SHA256 HMAC of the input message using the input key.",
+    "introduced": "v0.36.0",
+    "result": {
+      "description": "SHA256-HMAC of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.hmac.sha512": {
+    "args": [
+      {
+        "description": "input string",
+        "name": "x",
+        "type": "string"
+      },
+      {
+        "description": "key to use",
+        "name": "key",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the SHA512 HMAC of the input message using the input key.",
+    "introduced": "v0.36.0",
+    "result": {
+      "description": "SHA512-HMAC of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.md5": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the input string hashed with the MD5 function",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "MD5-hash of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.sha1": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the input string hashed with the SHA1 function",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "SHA1-hash of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.sha256": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string representing the input string hashed with the SHA256 function",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "SHA256-hash of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "crypto.x509.parse_and_verify_certificates": {
+    "args": [
+      {
+        "description": "base64 encoded DER or PEM data containing two or more certificates where the first is a root CA, the last is a leaf certificate, and all others are intermediate CAs",
+        "name": "certs",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns one or more certificates from the given string containing PEM\nor base64 encoded DER certificates after verifying the supplied certificates form a complete\ncertificate chain back to a trusted root.\n\nThe first certificate is treated as the root and the last is treated as the leaf,\nwith all others being treated as intermediates.",
+    "introduced": "v0.31.0",
+    "result": {
+      "description": "array of `[valid, certs]`: if the input certificate chain could be verified then `valid` is `true` and `certs` is an array of X.509 certificates represented as objects; if the input certificate chain could not be verified then `valid` is `false` and `certs` is `[]`",
+      "name": "output",
+      "type": "array\u003cboolean, array[object[string: any]]\u003e"
+    },
+    "wasm": false
+  },
+  "crypto.x509.parse_certificate_request": {
+    "args": [
+      {
+        "description": "base64 string containing either a PEM encoded or DER CSR or a string containing a PEM CSR",
+        "name": "csr",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a PKCS #10 certificate signing request from the given PEM-encoded PKCS#10 certificate signing request.",
+    "introduced": "v0.21.0",
+    "result": {
+      "description": "X.509 CSR represented as an object",
+      "name": "output",
+      "type": "object[string: any]"
+    },
+    "wasm": false
+  },
+  "crypto.x509.parse_certificates": {
+    "args": [
+      {
+        "description": "base64 encoded DER or PEM data containing one or more certificates or a PEM string of one or more certificates",
+        "name": "certs",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns zero or more certificates from the given encoded string containing\nDER certificate data.\n\nIf the input is empty, the function will return null. The input string should be a list of one or more\nconcatenated PEM blocks. The whole input of concatenated PEM blocks can optionally be Base64 encoded.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "parsed X.509 certificates represented as objects",
+      "name": "output",
+      "type": "array[object[string: any]]"
+    },
+    "wasm": false
+  },
+  "crypto.x509.parse_rsa_private_key": {
+    "args": [
+      {
+        "description": "base64 string containing a PEM encoded RSA private key",
+        "name": "pem",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a JWK for signing a JWT from the given PEM-encoded RSA private key.",
+    "introduced": "v0.33.0",
+    "result": {
+      "description": "JWK as an object",
+      "name": "output",
+      "type": "object[string: any]"
+    },
+    "wasm": false
+  },
+  "div": {
+    "args": [
+      {
+        "description": "the dividend",
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "description": "the divisor",
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Divides the first number by the second number.",
+    "infix": "/",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the result of `x` divided by `y`",
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "endswith": {
+    "args": [
+      {
+        "description": "search string",
+        "name": "search",
+        "type": "string"
+      },
+      {
+        "description": "base string",
+        "name": "base",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns true if the search string ends with the base string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "result of the suffix check",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "eq": {
+    "args": [
+      {
+        "type": "any"
+      },
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "=",
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "equal": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      },
+      {
+        "name": "y",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "==",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `x` is equal to `y`; false otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "floor": {
+    "args": [
+      {
+        "description": "the number to round",
+        "name": "x",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Rounds the number _down_ to the nearest integer.",
+    "introduced": "v0.26.0",
+    "result": {
+      "description": "the result of rounding `x` _down_",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "format_int": {
+    "args": [
+      {
+        "description": "number to format",
+        "name": "number",
+        "type": "number"
+      },
+      {
+        "description": "base of number representation to use",
+        "name": "base",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the string representation of the number in the given base after rounding it down to an integer value.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "formatted number",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "glob.match": {
+    "args": [
+      {
+        "name": "pattern",
+        "type": "string"
+      },
+      {
+        "description": "glob pattern delimiters, e.g. `[\".\", \":\"]`, defaults to `[\".\"]` if unset. If `delimiters` is `null`, glob match without delimiter.",
+        "name": "delimiters",
+        "type": "any\u003cnull, array[string]\u003e"
+      },
+      {
+        "name": "match",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Parses and matches strings against the glob notation. Not to be confused with `regex.globs_match`.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `match` can be found in `pattern` which is separated by `delimiters`",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "glob.quote_meta": {
+    "args": [
+      {
+        "name": "pattern",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a string which represents a version of the pattern where all asterisks have been escaped.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the escaped string of `pattern`",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "graph.reachable": {
+    "args": [
+      {
+        "description": "object containing a set or array of neighboring vertices",
+        "name": "graph",
+        "type": "object[any: any\u003carray[any], set[any]\u003e]"
+      },
+      {
+        "description": "set or array of root vertices",
+        "name": "initial",
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Computes the set of reachable nodes in the graph from a set of starting nodes.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "set of vertices reachable from the `initial` vertices in the directed `graph`",
+      "name": "output",
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "graph.reachable_paths": {
+    "args": [
+      {
+        "description": "object containing a set or array of root vertices",
+        "name": "graph",
+        "type": "object[any: any\u003carray[any], set[any]\u003e]"
+      },
+      {
+        "description": "initial paths",
+        "name": "initial",
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Computes the set of reachable paths in the graph from a set of starting nodes.",
+    "introduced": "v0.37.0",
+    "result": {
+      "description": "paths reachable from the `initial` vertices in the directed `graph`",
+      "name": "output",
+      "type": "set[array[any]]"
+    },
+    "wasm": false
+  },
+  "graphql.is_valid": {
+    "args": [
+      {
+        "name": "query",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      },
+      {
+        "name": "schema",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks that a GraphQL query is valid against a given schema. The query and/or schema can be either GraphQL strings or AST objects from the other GraphQL builtin functions.",
+    "introduced": "v0.41.0",
+    "result": {
+      "description": "`true` if the query is valid under the given schema. `false` otherwise.",
+      "name": "output",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "graphql.parse": {
+    "args": [
+      {
+        "name": "query",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      },
+      {
+        "name": "schema",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns AST objects for a given GraphQL query and schema after validating the query against the schema. Returns undefined if errors were encountered during parsing or validation. The query and/or schema can be either GraphQL strings or AST objects from the other GraphQL builtin functions.",
+    "introduced": "v0.41.0",
+    "result": {
+      "description": "`output` is of the form `[query_ast, schema_ast]`. If the GraphQL query is valid given the provided schema, then `query_ast` and `schema_ast` are objects describing the ASTs for the query and schema.",
+      "name": "output",
+      "type": "array\u003cobject[any: any], object[any: any]\u003e"
+    },
+    "wasm": false
+  },
+  "graphql.parse_and_verify": {
+    "args": [
+      {
+        "name": "query",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      },
+      {
+        "name": "schema",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a boolean indicating success or failure alongside the parsed ASTs for a given GraphQL query and schema after validating the query against the schema. The query and/or schema can be either GraphQL strings or AST objects from the other GraphQL builtin functions.",
+    "introduced": "v0.41.0",
+    "result": {
+      "description": " `output` is of the form `[valid, query_ast, schema_ast]`. If the query is valid given the provided schema, then `valid` is `true`, and `query_ast` and `schema_ast` are objects describing the ASTs for the GraphQL query and schema. Otherwise, `valid` is `false` and `query_ast` and `schema_ast` are `{}`.",
+      "name": "output",
+      "type": "array\u003cboolean, object[any: any], object[any: any]\u003e"
+    },
+    "wasm": false
+  },
+  "graphql.parse_query": {
+    "args": [
+      {
+        "name": "query",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns an AST object for a GraphQL query.",
+    "introduced": "v0.41.0",
+    "result": {
+      "description": "AST object for the GraphQL query.",
+      "name": "output",
+      "type": "object[any: any]"
+    },
+    "wasm": false
+  },
+  "graphql.parse_schema": {
+    "args": [
+      {
+        "name": "schema",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns an AST object for a GraphQL schema.",
+    "introduced": "v0.41.0",
+    "result": {
+      "description": "AST object for the GraphQL schema.",
+      "name": "output",
+      "type": "object[any: any]"
+    },
+    "wasm": false
+  },
+  "graphql.schema_is_valid": {
+    "args": [
+      {
+        "name": "schema",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks that the input is a valid GraphQL schema. The schema can be either a GraphQL string or an AST object from the other GraphQL builtin functions.",
+    "introduced": "v0.46.0",
+    "result": {
+      "description": "`true` if the schema is a valid GraphQL schema. `false` otherwise.",
+      "name": "output",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "gt": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      },
+      {
+        "name": "y",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "\u003e",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `x` is greater than `y`; false otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "gte": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      },
+      {
+        "name": "y",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "\u003e=",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `x` is greater or equal to `y`; false otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "hex.decode": {
+    "args": [
+      {
+        "description": "a hex-encoded string",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Deserializes the hex-encoded input string.",
+    "introduced": "v0.25.0-rc2",
+    "result": {
+      "description": "deseralized from `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "hex.encode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Serializes the input string using hex-encoding.",
+    "introduced": "v0.25.0-rc2",
+    "result": {
+      "description": "serialization of `x` using hex-encoding",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "http.send": {
+    "args": [
+      {
+        "name": "request",
+        "type": "object[string: any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a HTTP response to the given HTTP request.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "response",
+      "type": "object[any: any]"
+    },
+    "wasm": false
+  },
+  "indexof": {
+    "args": [
+      {
+        "description": "string to search in",
+        "name": "haystack",
+        "type": "string"
+      },
+      {
+        "description": "substring to look for",
+        "name": "needle",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the index of a substring contained inside a string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "index of first occurrence, `-1` if not found",
+      "name": "output",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "indexof_n": {
+    "args": [
+      {
+        "description": "string to search in",
+        "name": "haystack",
+        "type": "string"
+      },
+      {
+        "description": "substring to look for",
+        "name": "needle",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a list of all the indexes of a substring contained inside a string.",
+    "introduced": "v0.37.0",
+    "result": {
+      "description": "all indices at which `needle` occurs in `haystack`, may be empty",
+      "name": "output",
+      "type": "array[number]"
+    },
+    "wasm": false
+  },
+  "internal.member_2": {
+    "args": [
+      {
+        "type": "any"
+      },
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "in",
+    "introduced": "v0.34.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "internal.member_3": {
+    "args": [
+      {
+        "type": "any"
+      },
+      {
+        "type": "any"
+      },
+      {
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "in",
+    "introduced": "v0.34.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "internal.print": {
+    "args": [
+      {
+        "type": "array[set[any]]"
+      }
+    ],
+    "available": [
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "introduced": "v0.34.0",
+    "result": {},
+    "wasm": false
+  },
+  "intersection": {
+    "args": [
+      {
+        "description": "set of sets to intersect",
+        "name": "xs",
+        "type": "set[set[any]]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the intersection of the given input sets.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the intersection of all `xs` sets",
+      "name": "y",
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "io.jwt.decode": {
+    "args": [
+      {
+        "description": "JWT token to decode",
+        "name": "jwt",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Decodes a JSON Web Token and outputs it as an object.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`[header, payload, sig]`, where `header` and `payload` are objects; `sig` is the hexadecimal representation of the signature on the token.",
+      "name": "output",
+      "type": "array\u003cobject[any: any], object[any: any], string\u003e"
+    },
+    "wasm": false
+  },
+  "io.jwt.decode_verify": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified and whose claims are to be checked",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "claim verification constraints",
+        "name": "constraints",
+        "type": "object[string: any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies a JWT signature under parameterized constraints and decodes the claims if it is valid.\nSupports the following algorithms: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384 and PS512.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`[valid, header, payload]`:  if the input token is verified and meets the requirements of `constraints` then `valid` is `true`; `header` and `payload` are objects containing the JOSE header and the JWT claim set; otherwise, `valid` is `false`, `header` and `payload` are `{}`",
+      "name": "output",
+      "type": "array\u003cboolean, object[any: any], object[any: any]\u003e"
+    },
+    "wasm": false
+  },
+  "io.jwt.encode_sign": {
+    "args": [
+      {
+        "description": "JWS Protected Header",
+        "name": "headers",
+        "type": "object[string: any]"
+      },
+      {
+        "description": "JWS Payload",
+        "name": "payload",
+        "type": "object[string: any]"
+      },
+      {
+        "description": "JSON Web Key (RFC7517)",
+        "name": "key",
+        "type": "object[string: any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Encodes and optionally signs a JSON Web Token. Inputs are taken as objects, not encoded strings (see `io.jwt.encode_sign_raw`).",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "signed JWT",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "io.jwt.encode_sign_raw": {
+    "args": [
+      {
+        "description": "JWS Protected Header",
+        "name": "headers",
+        "type": "string"
+      },
+      {
+        "description": "JWS Payload",
+        "name": "payload",
+        "type": "string"
+      },
+      {
+        "description": "JSON Web Key (RFC7517)",
+        "name": "key",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Encodes and optionally signs a JSON Web Token.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "signed JWT",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_es256": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a ES256 JWT signature is valid.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_es384": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a ES384 JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_es512": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a ES512 JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_hs256": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "plain text secret used to verify the signature",
+        "name": "secret",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a HS256 (secret) JWT signature is valid.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_hs384": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "plain text secret used to verify the signature",
+        "name": "secret",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a HS384 (secret) JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_hs512": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "plain text secret used to verify the signature",
+        "name": "secret",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a HS512 (secret) JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_ps256": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a PS256 JWT signature is valid.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_ps384": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a PS384 JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_ps512": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a PS512 JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_rs256": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a RS256 JWT signature is valid.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_rs384": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a RS384 JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "io.jwt.verify_rs512": {
+    "args": [
+      {
+        "description": "JWT token whose signature is to be verified",
+        "name": "jwt",
+        "type": "string"
+      },
+      {
+        "description": "PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the signature",
+        "name": "certificate",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies if a RS512 JWT signature is valid.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "`true` if the signature is valid, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "is_array": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the input value is an array.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is an array, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "is_boolean": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the input value is a boolean.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is an boolean, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "is_null": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the input value is null.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is null, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "is_number": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the input value is a number.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is a number, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "is_object": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns true if the input value is an object",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is an object, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "is_set": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the input value is a set.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is a set, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "is_string": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `true` if the input value is a string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`true` if `x` is a string, `false` otherwise.",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "json.filter": {
+    "args": [
+      {
+        "name": "object",
+        "type": "object[any: any]"
+      },
+      {
+        "description": "JSON string paths",
+        "name": "paths",
+        "type": "any\u003carray[any\u003cstring, array[any]\u003e], set[any\u003cstring, array[any]\u003e]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Filters the object. For example: `json.filter({\"a\": {\"b\": \"x\", \"c\": \"y\"}}, [\"a/b\"])` will result in `{\"a\": {\"b\": \"x\"}}`). Paths are not filtered in-order and are deduplicated before being evaluated.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "remaining data from `object` with only keys specified in `paths`",
+      "name": "filtered",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "json.is_valid": {
+    "args": [
+      {
+        "description": "a JSON string",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies the input string is a valid JSON document.",
+    "introduced": "v0.25.0-rc1",
+    "result": {
+      "description": "`true` if `x` is valid JSON, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "json.marshal": {
+    "args": [
+      {
+        "description": "the term to serialize",
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Serializes the input term to JSON.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the JSON string representation of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "json.match_schema": {
+    "args": [
+      {
+        "description": "document to verify by schema",
+        "name": "document",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      },
+      {
+        "description": "schema to verify document by",
+        "name": "schema",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks that the document matches the JSON schema.",
+    "introduced": "v0.50.0",
+    "result": {
+      "description": "`output` is of the form `[match, errors]`. If the document is valid given the schema, then `match` is `true`, and `errors` is an empty array. Otherwise, `match` is `false` and `errors` is an array of objects describing the error(s).",
+      "name": "output",
+      "type": "array\u003cboolean, array[object\u003cdesc: string, error: string, field: string, type: string\u003e]\u003e"
+    },
+    "wasm": false
+  },
+  "json.patch": {
+    "args": [
+      {
+        "name": "object",
+        "type": "any"
+      },
+      {
+        "name": "patches",
+        "type": "array[object\u003cop: string, path: any\u003e[any: any]]"
+      }
+    ],
+    "available": [
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Patches an object according to RFC6902. For example: `json.patch({\"a\": {\"foo\": 1}}, [{\"op\": \"add\", \"path\": \"/a/bar\", \"value\": 2}])` results in `{\"a\": {\"foo\": 1, \"bar\": 2}`. The patches are applied atomically: if any of them fails, the result will be undefined. Additionally works on sets, where a value contained in the set is considered to be its path.",
+    "introduced": "v0.25.0",
+    "result": {
+      "description": "result obtained after consecutively applying all patch operations in `patches`",
+      "name": "output",
+      "type": "any"
+    },
+    "wasm": false
+  },
+  "json.remove": {
+    "args": [
+      {
+        "name": "object",
+        "type": "object[any: any]"
+      },
+      {
+        "description": "JSON string paths",
+        "name": "paths",
+        "type": "any\u003carray[any\u003cstring, array[any]\u003e], set[any\u003cstring, array[any]\u003e]\u003e"
+      }
+    ],
+    "available": [
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Removes paths from an object. For example: `json.remove({\"a\": {\"b\": \"x\", \"c\": \"y\"}}, [\"a/b\"])` will result in `{\"a\": {\"c\": \"y\"}}`. Paths are not removed in-order and are deduplicated before being evaluated.",
+    "introduced": "v0.18.0",
+    "result": {
+      "description": "result of removing all keys specified in `paths`",
+      "name": "output",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "json.unmarshal": {
+    "args": [
+      {
+        "description": "a JSON string",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Deserializes the input string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the term deseralized from `x`",
+      "name": "y",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "json.verify_schema": {
+    "args": [
+      {
+        "description": "the schema to verify",
+        "name": "schema",
+        "type": "any\u003cstring, object[any: any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks that the input is a valid JSON schema object. The schema can be either a JSON string or an JSON object.",
+    "introduced": "v0.50.0",
+    "result": {
+      "description": "`output` is of the form `[valid, error]`. If the schema is valid, then `valid` is `true`, and `error` is `null`. Otherwise, `valid` is `false` and `error` is a string describing the error.",
+      "name": "output",
+      "type": "array\u003cboolean, any\u003cnull, string\u003e\u003e"
+    },
+    "wasm": false
+  },
+  "lower": {
+    "args": [
+      {
+        "description": "string that is converted to lower-case",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the input string but with all characters in lower-case.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "lower-case of x",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "lt": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      },
+      {
+        "name": "y",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "\u003c",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `x` is less than `y`; false otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "lte": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      },
+      {
+        "name": "y",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "\u003c=",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `x` is less than or equal to `y`; false otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "max": {
+    "args": [
+      {
+        "name": "collection",
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the maximum value in a collection.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the maximum of all elements",
+      "name": "n",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "min": {
+    "args": [
+      {
+        "name": "collection",
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the minimum value in a collection.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the minimum of all elements",
+      "name": "n",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "minus": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any\u003cnumber, set[any]\u003e"
+      },
+      {
+        "name": "y",
+        "type": "any\u003cnumber, set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Minus subtracts the second number from the first number or computes the difference between two sets.",
+    "infix": "-",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the difference of `x` and `y`",
+      "name": "z",
+      "type": "any\u003cnumber, set[any]\u003e"
+    },
+    "wasm": true
+  },
+  "mul": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Multiplies two numbers.",
+    "infix": "*",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the product of `x` and `y`",
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "neq": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      },
+      {
+        "name": "y",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "infix": "!=",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "true if `x` is not equal to `y`; false otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "net.cidr_contains": {
+    "args": [
+      {
+        "name": "cidr",
+        "type": "string"
+      },
+      {
+        "name": "cidr_or_ip",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks if a CIDR or IP is contained within another CIDR. `output` is `true` if `cidr_or_ip` (e.g. `127.0.0.64/26` or `127.0.0.1`) is contained within `cidr` (e.g. `127.0.0.1/24`) and `false` otherwise. Supports both IPv4 and IPv6 notations.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "net.cidr_contains_matches": {
+    "args": [
+      {
+        "name": "cidrs",
+        "type": "any\u003cstring, array[any\u003cstring, array[any]\u003e], object[string: any\u003cstring, array[any]\u003e], set[any\u003cstring, array[any]\u003e]\u003e"
+      },
+      {
+        "name": "cidrs_or_ips",
+        "type": "any\u003cstring, array[any\u003cstring, array[any]\u003e], object[string: any\u003cstring, array[any]\u003e], set[any\u003cstring, array[any]\u003e]\u003e"
+      }
+    ],
+    "available": [
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks if collections of cidrs or ips are contained within another collection of cidrs and returns matches. This function is similar to `net.cidr_contains` except it allows callers to pass collections of CIDRs or IPs as arguments and returns the matches (as opposed to a boolean result indicating a match between two CIDRs/IPs).",
+    "introduced": "v0.19.0-rc1",
+    "result": {
+      "description": "tuples identifying matches where `cidrs_or_ips` are contained within `cidrs`",
+      "name": "output",
+      "type": "set[array\u003cany, any\u003e]"
+    },
+    "wasm": false
+  },
+  "net.cidr_expand": {
+    "args": [
+      {
+        "name": "cidr",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Expands CIDR to set of hosts  (e.g., `net.cidr_expand(\"192.168.0.0/30\")` generates 4 hosts: `{\"192.168.0.0\", \"192.168.0.1\", \"192.168.0.2\", \"192.168.0.3\"}`).",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "set of IP addresses the CIDR `cidr` expands to",
+      "name": "hosts",
+      "type": "set[string]"
+    },
+    "wasm": false
+  },
+  "net.cidr_intersects": {
+    "args": [
+      {
+        "name": "cidr1",
+        "type": "string"
+      },
+      {
+        "name": "cidr2",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks if a CIDR intersects with another CIDR (e.g. `192.168.0.0/16` overlaps with `192.168.1.0/24`). Supports both IPv4 and IPv6 notations.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "net.cidr_is_valid": {
+    "args": [
+      {
+        "name": "cidr",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Parses an IPv4/IPv6 CIDR and returns a boolean indicating if the provided CIDR is valid.",
+    "introduced": "v0.46.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "net.cidr_merge": {
+    "args": [
+      {
+        "description": "CIDRs or IP addresses",
+        "name": "addrs",
+        "type": "any\u003carray[any\u003cstring\u003e], set[string]\u003e"
+      }
+    ],
+    "available": [
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Merges IP addresses and subnets into the smallest possible list of CIDRs (e.g., `net.cidr_merge([\"192.0.128.0/24\", \"192.0.129.0/24\"])` generates `{\"192.0.128.0/23\"}`.This function merges adjacent subnets where possible, those contained within others and also removes any duplicates.\nSupports both IPv4 and IPv6 notations. IPv6 inputs need a prefix length (e.g. \"/128\").",
+    "introduced": "v0.24.0",
+    "result": {
+      "description": "smallest possible set of CIDRs obtained after merging the provided list of IP addresses and subnets in `addrs`",
+      "name": "output",
+      "type": "set[string]"
+    },
+    "wasm": false
+  },
+  "net.cidr_overlap": {
+    "args": [
+      {
+        "type": "string"
+      },
+      {
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "net.lookup_ip_addr": {
+    "args": [
+      {
+        "description": "domain name to resolve",
+        "name": "name",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the set of IP addresses (both v4 and v6) that the passed-in `name` resolves to using the standard name resolution mechanisms available.",
+    "introduced": "v0.35.0",
+    "result": {
+      "description": "IP addresses (v4 and v6) that `name` resolves to",
+      "name": "addrs",
+      "type": "set[string]"
+    },
+    "wasm": false
+  },
+  "numbers.range": {
+    "args": [
+      {
+        "name": "a",
+        "type": "number"
+      },
+      {
+        "name": "b",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns an array of numbers in the given (inclusive) range. If `a==b`, then `range == [a]`; if `a \u003e b`, then `range` is in descending order.",
+    "introduced": "v0.22.0",
+    "result": {
+      "description": "the range between `a` and `b`",
+      "name": "range",
+      "type": "array[number]"
+    },
+    "wasm": true
+  },
+  "object.filter": {
+    "args": [
+      {
+        "description": "object to filter keys",
+        "name": "object",
+        "type": "object[any: any]"
+      },
+      {
+        "name": "keys",
+        "type": "any\u003carray[any], object[any: any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Filters the object by keeping only specified keys. For example: `object.filter({\"a\": {\"b\": \"x\", \"c\": \"y\"}, \"d\": \"z\"}, [\"a\"])` will result in `{\"a\": {\"b\": \"x\", \"c\": \"y\"}}`).",
+    "introduced": "v0.17.2",
+    "result": {
+      "description": "remaining data from `object` with only keys specified in `keys`",
+      "name": "filtered",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "object.get": {
+    "args": [
+      {
+        "description": "object to get `key` from",
+        "name": "object",
+        "type": "object[any: any]"
+      },
+      {
+        "description": "key to lookup in `object`",
+        "name": "key",
+        "type": "any"
+      },
+      {
+        "description": "default to use when lookup fails",
+        "name": "default",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns value of an object's key if present, otherwise a default. If the supplied `key` is an `array`, then `object.get` will search through a nested object or array using each key in turn. For example: `object.get({\"a\": [{ \"b\": true }]}, [\"a\", 0, \"b\"], false)` results in `true`.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`object[key]` if present, otherwise `default`",
+      "name": "value",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "object.keys": {
+    "args": [
+      {
+        "description": "object to get keys from",
+        "name": "object",
+        "type": "object[any: any]"
+      }
+    ],
+    "available": [
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a set of an object's keys. For example: `object.keys({\"a\": 1, \"b\": true, \"c\": \"d\")` results in `{\"a\", \"b\", \"c\"}`.",
+    "introduced": "v0.47.0",
+    "result": {
+      "description": "set of `object`'s keys",
+      "name": "value",
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "object.remove": {
+    "args": [
+      {
+        "description": "object to remove keys from",
+        "name": "object",
+        "type": "object[any: any]"
+      },
+      {
+        "description": "keys to remove from x",
+        "name": "keys",
+        "type": "any\u003carray[any], object[any: any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Removes specified keys from an object.",
+    "introduced": "v0.17.2",
+    "result": {
+      "description": "result of removing the specified `keys` from `object`",
+      "name": "output",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "object.subset": {
+    "args": [
+      {
+        "description": "object to test if sub is a subset of",
+        "name": "super",
+        "type": "any\u003carray[any], object[any: any], set[any]\u003e"
+      },
+      {
+        "description": "object to test if super is a superset of",
+        "name": "sub",
+        "type": "any\u003carray[any], object[any: any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Determines if an object `sub` is a subset of another object `super`.Object `sub` is a subset of object `super` if and only if every key in `sub` is also in `super`, **and** for all keys which `sub` and `super` share, they have the same value. This function works with objects, sets, arrays and a set of array and set.If both arguments are objects, then the operation is recursive, e.g. `{\"c\": {\"x\": {10, 15, 20}}` is a subset of `{\"a\": \"b\", \"c\": {\"x\": {10, 15, 20, 25}, \"y\": \"z\"}`. If both arguments are sets, then this function checks if every element of `sub` is a member of `super`, but does not attempt to recurse. If both arguments are arrays, then this function checks if `sub` appears contiguously in order within `super`, and also does not attempt to recurse. If `super` is array and `sub` is set, then this function checks if `super` contains every element of `sub` with no consideration of ordering, and also does not attempt to recurse.",
+    "introduced": "v0.42.0",
+    "result": {
+      "description": "`true` if `sub` is a subset of `super`",
+      "name": "result",
+      "type": "any"
+    },
+    "wasm": false
+  },
+  "object.union": {
+    "args": [
+      {
+        "name": "a",
+        "type": "object[any: any]"
+      },
+      {
+        "name": "b",
+        "type": "object[any: any]"
+      }
+    ],
+    "available": [
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Creates a new object of the asymmetric union of two objects. For example: `object.union({\"a\": 1, \"b\": 2, \"c\": {\"d\": 3}}, {\"a\": 7, \"c\": {\"d\": 4, \"e\": 5}})` will result in `{\"a\": 7, \"b\": 2, \"c\": {\"d\": 4, \"e\": 5}}`.",
+    "introduced": "v0.17.2",
+    "result": {
+      "description": "a new object which is the result of an asymmetric recursive union of two objects where conflicts are resolved by choosing the key from the right-hand object `b`",
+      "name": "output",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "object.union_n": {
+    "args": [
+      {
+        "name": "objects",
+        "type": "array[object[any: any]]"
+      }
+    ],
+    "available": [
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Creates a new object that is the asymmetric union of all objects merged from left to right. For example: `object.union_n([{\"a\": 1}, {\"b\": 2}, {\"a\": 3}])` will result in `{\"b\": 2, \"a\": 3}`.",
+    "introduced": "v0.37.0",
+    "result": {
+      "description": "asymmetric recursive union of all objects in `objects`, merged from left to right, where conflicts are resolved by choosing the key from the right-hand object",
+      "name": "output",
+      "type": "any"
+    },
+    "wasm": true
+  },
+  "opa.runtime": {
+    "args": [],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns an object that describes the runtime environment where OPA is deployed.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "includes a `config` key if OPA was started with a configuration file; an `env` key containing the environment variables that the OPA process was started with; includes `version` and `commit` keys containing the version and build commit of OPA.",
+      "name": "output",
+      "type": "object[string: any]"
+    },
+    "wasm": false
+  },
+  "or": {
+    "args": [
+      {
+        "name": "x",
+        "type": "set[any]"
+      },
+      {
+        "name": "y",
+        "type": "set[any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the union of two sets.",
+    "infix": "|",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the union of `x` and `y`",
+      "name": "z",
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "plus": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Plus adds two numbers together.",
+    "infix": "+",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the sum of `x` and `y`",
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "print": {
+    "args": [],
+    "available": [
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "introduced": "v0.34.0",
+    "result": {},
+    "wasm": false
+  },
+  "product": {
+    "args": [
+      {
+        "name": "collection",
+        "type": "any\u003carray[number], set[number]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Muliplies elements of an array or set of numbers",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the product of all elements",
+      "name": "n",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "providers.aws.sign_req": {
+    "args": [
+      {
+        "name": "request",
+        "type": "object[string: any]"
+      },
+      {
+        "name": "aws_config",
+        "type": "object[string: any]"
+      },
+      {
+        "name": "time_ns",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Signs an HTTP request object for Amazon Web Services. Currently implements [AWS Signature Version 4 request signing](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) by the `Authorization` header method.",
+    "introduced": "v0.47.0",
+    "result": {
+      "name": "signed_request",
+      "type": "object[any: any]"
+    },
+    "wasm": false
+  },
+  "rand.intn": {
+    "args": [
+      {
+        "name": "str",
+        "type": "string"
+      },
+      {
+        "name": "n",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a random integer between `0` and `n` (`n` exlusive). If `n` is `0`, then `y` is always `0`. For any given argument pair (`str`, `n`), the output will be consistent throughout a query evaluation.",
+    "introduced": "v0.31.0",
+    "result": {
+      "description": "random integer in the range `[0, abs(n))`",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "re_match": {
+    "args": [
+      {
+        "type": "string"
+      },
+      {
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "regex.find_all_string_submatch_n": {
+    "args": [
+      {
+        "description": "regular expression",
+        "name": "pattern",
+        "type": "string"
+      },
+      {
+        "description": "string to match",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "number of matches to return; `-1` means all matches",
+        "name": "number",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns all successive matches of the expression.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "output",
+      "type": "array[array[string]]"
+    },
+    "wasm": true
+  },
+  "regex.find_n": {
+    "args": [
+      {
+        "description": "regular expression",
+        "name": "pattern",
+        "type": "string"
+      },
+      {
+        "description": "string to match",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "number of matches to return, if `-1`, returns all matches",
+        "name": "number",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the specified number of matches when matching the input against the pattern.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "collected matches",
+      "name": "output",
+      "type": "array[string]"
+    },
+    "wasm": false
+  },
+  "regex.globs_match": {
+    "args": [
+      {
+        "name": "glob1",
+        "type": "string"
+      },
+      {
+        "name": "glob2",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks if the intersection of two glob-style regular expressions matches a non-empty set of non-empty strings.\nThe set of regex symbols is limited for this builtin: only `.`, `*`, `+`, `[`, `-`, `]` and `\\` are treated as special symbols.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "regex.is_valid": {
+    "args": [
+      {
+        "description": "regular expression",
+        "name": "pattern",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Checks if a string is a valid regular expression: the detailed syntax for patterns is defined by https://github.com/google/re2/wiki/Syntax.",
+    "introduced": "v0.23.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "regex.match": {
+    "args": [
+      {
+        "description": "regular expression",
+        "name": "pattern",
+        "type": "string"
+      },
+      {
+        "description": "value to match against `pattern`",
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Matches a string against a regular expression.",
+    "introduced": "v0.23.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "regex.replace": {
+    "args": [
+      {
+        "description": "string being processed",
+        "name": "s",
+        "type": "string"
+      },
+      {
+        "description": "regex pattern to be applied",
+        "name": "pattern",
+        "type": "string"
+      },
+      {
+        "description": "regex value",
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Find and replaces the text using the regular expression pattern.",
+    "introduced": "v0.45.0",
+    "result": {
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "regex.split": {
+    "args": [
+      {
+        "description": "regular expression",
+        "name": "pattern",
+        "type": "string"
+      },
+      {
+        "description": "string to match",
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Splits the input string by the occurrences of the given pattern.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the parts obtained by splitting `value`",
+      "name": "output",
+      "type": "array[string]"
+    },
+    "wasm": false
+  },
+  "regex.template_match": {
+    "args": [
+      {
+        "description": "template expression containing `0..n` regular expressions",
+        "name": "template",
+        "type": "string"
+      },
+      {
+        "description": "string to match",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "start delimiter of the regular expression in `template`",
+        "name": "delimiter_start",
+        "type": "string"
+      },
+      {
+        "description": "end delimiter of the regular expression in `template`",
+        "name": "delimiter_end",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Matches a string against a pattern, where there pattern may be glob-like",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "rego.metadata.chain": {
+    "args": [],
+    "available": [
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the chain of metadata for the active rule.\nOrdered starting at the active rule, going outward to the most distant node in its package ancestry.\nA chain entry is a JSON document with two members: \"path\", an array representing the path of the node; and \"annotations\", a JSON document containing the annotations declared for the node.\nThe first entry in the chain always points to the active rule, even if it has no declared annotations (in which case the \"annotations\" member is not present).",
+    "introduced": "v0.40.0",
+    "result": {
+      "description": "each array entry represents a node in the path ancestry (chain) of the active rule that also has declared annotations",
+      "name": "chain",
+      "type": "array[any]"
+    },
+    "wasm": false
+  },
+  "rego.metadata.rule": {
+    "args": [],
+    "available": [
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns annotations declared for the active rule and using the _rule_ scope.",
+    "introduced": "v0.40.0",
+    "result": {
+      "description": "\"rule\" scope annotations for this rule; empty object if no annotations exist",
+      "name": "output",
+      "type": "any"
+    },
+    "wasm": false
+  },
+  "rego.parse_module": {
+    "args": [
+      {
+        "description": "file name to attach to AST nodes' locations",
+        "name": "filename",
+        "type": "string"
+      },
+      {
+        "description": "Rego module",
+        "name": "rego",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Parses the input Rego string and returns an object representation of the AST.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "output",
+      "type": "object[string: any]"
+    },
+    "wasm": false
+  },
+  "rem": {
+    "args": [
+      {
+        "name": "x",
+        "type": "number"
+      },
+      {
+        "name": "y",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the remainder for of `x` divided by `y`, for `y != 0`.",
+    "infix": "%",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the remainder",
+      "name": "z",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "replace": {
+    "args": [
+      {
+        "description": "string being processed",
+        "name": "x",
+        "type": "string"
+      },
+      {
+        "description": "substring to replace",
+        "name": "old",
+        "type": "string"
+      },
+      {
+        "description": "string to replace `old` with",
+        "name": "new",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Replace replaces all instances of a sub-string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string with replaced substrings",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "round": {
+    "args": [
+      {
+        "description": "the number to round",
+        "name": "x",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Rounds the number to the nearest integer.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the result of rounding `x`",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "semver.compare": {
+    "args": [
+      {
+        "name": "a",
+        "type": "string"
+      },
+      {
+        "name": "b",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Compares valid SemVer formatted version strings.",
+    "introduced": "v0.22.0",
+    "result": {
+      "description": "`-1` if `a \u003c b`; `1` if `a \u003e b`; `0` if `a == b`",
+      "name": "result",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "semver.is_valid": {
+    "args": [
+      {
+        "name": "vsn",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Validates that the input is a valid SemVer string.",
+    "introduced": "v0.22.0",
+    "result": {
+      "description": "`true` if `vsn` is a valid SemVer; `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "set_diff": {
+    "args": [
+      {
+        "type": "set[any]"
+      },
+      {
+        "type": "set[any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "deprecated": true,
+    "introduced": "v0.17.0",
+    "result": {
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "sort": {
+    "args": [
+      {
+        "description": "the array or set to be sorted",
+        "name": "collection",
+        "type": "any\u003carray[any], set[any]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a sorted array.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the sorted array",
+      "name": "n",
+      "type": "array[any]"
+    },
+    "wasm": true
+  },
+  "split": {
+    "args": [
+      {
+        "description": "string that is split",
+        "name": "x",
+        "type": "string"
+      },
+      {
+        "description": "delimiter used for splitting",
+        "name": "delimiter",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Split returns an array containing elements of the input string split on a delimiter.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "splitted parts",
+      "name": "ys",
+      "type": "array[string]"
+    },
+    "wasm": true
+  },
+  "sprintf": {
+    "args": [
+      {
+        "description": "string with formatting verbs",
+        "name": "format",
+        "type": "string"
+      },
+      {
+        "description": "arguments to format into formatting verbs",
+        "name": "values",
+        "type": "array[any]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the given string, formatted.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`format` formatted by the values in `values`",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "startswith": {
+    "args": [
+      {
+        "description": "search string",
+        "name": "search",
+        "type": "string"
+      },
+      {
+        "description": "base string",
+        "name": "base",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns true if the search string begins with the base string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "result of the prefix check",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": true
+  },
+  "strings.any_prefix_match": {
+    "args": [
+      {
+        "description": "search string(s)",
+        "name": "search",
+        "type": "any\u003cstring, array[string], set[string]\u003e"
+      },
+      {
+        "description": "base string(s)",
+        "name": "base",
+        "type": "any\u003cstring, array[string], set[string]\u003e"
+      }
+    ],
+    "available": [
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns true if any of the search strings begins with any of the base strings.",
+    "introduced": "v0.44.0",
+    "result": {
+      "description": "result of the prefix check",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "strings.any_suffix_match": {
+    "args": [
+      {
+        "description": "search string(s)",
+        "name": "search",
+        "type": "any\u003cstring, array[string], set[string]\u003e"
+      },
+      {
+        "description": "base string(s)",
+        "name": "base",
+        "type": "any\u003cstring, array[string], set[string]\u003e"
+      }
+    ],
+    "available": [
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns true if any of the search strings ends with any of the base strings.",
+    "introduced": "v0.44.0",
+    "result": {
+      "description": "result of the suffix check",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "strings.replace_n": {
+    "args": [
+      {
+        "description": "replacement pairs",
+        "name": "patterns",
+        "type": "object[string: string]"
+      },
+      {
+        "description": "string to replace substring matches in",
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Replaces a string from a list of old, new string pairs.\nReplacements are performed in the order they appear in the target string, without overlapping matches.\nThe old string comparisons are done in argument order.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "strings.reverse": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Reverses a given string.",
+    "introduced": "v0.36.0",
+    "result": {
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "substring": {
+    "args": [
+      {
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "offset, must be positive",
+        "name": "offset",
+        "type": "number"
+      },
+      {
+        "description": "length of the substring starting from `offset`",
+        "name": "length",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the  portion of a string for a given `offset` and a `length`.  If `length \u003c 0`, `output` is the remainder of the string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "substring of `value` from `offset`, of length `length`",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "sum": {
+    "args": [
+      {
+        "name": "collection",
+        "type": "any\u003carray[number], set[number]\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Sums elements of an array or set of numbers.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the sum of all elements",
+      "name": "n",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "time.add_date": {
+    "args": [
+      {
+        "description": "nanoseconds since the epoch",
+        "name": "ns",
+        "type": "number"
+      },
+      {
+        "name": "years",
+        "type": "number"
+      },
+      {
+        "name": "months",
+        "type": "number"
+      },
+      {
+        "name": "days",
+        "type": "number"
+      }
+    ],
+    "available": [
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the nanoseconds since epoch after adding years, months and days to nanoseconds. `undefined` if the result would be outside the valid time range that can fit within an `int64`.",
+    "introduced": "v0.19.0",
+    "result": {
+      "description": "nanoseconds since the epoch representing the input time, with years, months and days added",
+      "name": "output",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "time.clock": {
+    "args": [
+      {
+        "description": "a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string",
+        "name": "x",
+        "type": "any\u003cnumber, array\u003cnumber, string\u003e\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the `[hour, minute, second]` of the day for the nanoseconds since epoch.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the `hour`, `minute` (0-59), and `second` (0-59) representing the time of day for the nanoseconds since epoch in the supplied timezone (or UTC)",
+      "name": "output",
+      "type": "array\u003cnumber, number, number\u003e"
+    },
+    "wasm": false
+  },
+  "time.date": {
+    "args": [
+      {
+        "description": "a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string",
+        "name": "x",
+        "type": "any\u003cnumber, array\u003cnumber, string\u003e\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the `[year, month, day]` for the nanoseconds since epoch.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "an array of `year`, `month` (1-12), and `day` (1-31)",
+      "name": "date",
+      "type": "array\u003cnumber, number, number\u003e"
+    },
+    "wasm": false
+  },
+  "time.diff": {
+    "args": [
+      {
+        "name": "ns1",
+        "type": "any\u003cnumber, array\u003cnumber, string\u003e\u003e"
+      },
+      {
+        "name": "ns2",
+        "type": "any\u003cnumber, array\u003cnumber, string\u003e\u003e"
+      }
+    ],
+    "available": [
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the difference between two unix timestamps in nanoseconds (with optional timezone strings).",
+    "introduced": "v0.28.0",
+    "result": {
+      "description": "difference between `ns1` and `ns2` (in their supplied timezones, if supplied, or UTC) as array of numbers: `[years, months, days, hours, minutes, seconds]`",
+      "name": "output",
+      "type": "array\u003cnumber, number, number, number, number, number\u003e"
+    },
+    "wasm": false
+  },
+  "time.format": {
+    "args": [
+      {
+        "description": "a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string; or a three-element array of ns, timezone string and a layout string (see golang supported time formats)",
+        "name": "x",
+        "type": "any\u003cnumber, array\u003cnumber, string\u003e, array\u003cnumber, string, string\u003e\u003e"
+      }
+    ],
+    "available": [
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the formatted timestamp for the nanoseconds since epoch.",
+    "introduced": "v0.48.0",
+    "result": {
+      "description": "the formatted timestamp represented for the nanoseconds since the epoch in the supplied timezone (or UTC)",
+      "name": "formatted timestamp",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "time.now_ns": {
+    "args": [],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the current time since epoch in nanoseconds.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "nanoseconds since epoch",
+      "name": "now",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "time.parse_duration_ns": {
+    "args": [
+      {
+        "description": "a duration like \"3m\"; see the [Go `time` package documentation](https://golang.org/pkg/time/#ParseDuration) for more details",
+        "name": "duration",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the duration in nanoseconds represented by a string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the `duration` in nanoseconds",
+      "name": "ns",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "time.parse_ns": {
+    "args": [
+      {
+        "description": "format used for parsing, see the [Go `time` package documentation](https://golang.org/pkg/time/#Parse) for more details",
+        "name": "layout",
+        "type": "string"
+      },
+      {
+        "description": "input to parse according to `layout`",
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the time in nanoseconds parsed from the string in the given format. `undefined` if the result would be outside the valid time range that can fit within an `int64`.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`value` in nanoseconds since epoch",
+      "name": "ns",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "time.parse_rfc3339_ns": {
+    "args": [
+      {
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the time in nanoseconds parsed from the string in RFC3339 format. `undefined` if the result would be outside the valid time range that can fit within an `int64`.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "`value` in nanoseconds since epoch",
+      "name": "ns",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "time.weekday": {
+    "args": [
+      {
+        "description": "a number representing the nanoseconds since the epoch (UTC); or a two-element array of the nanoseconds, and a timezone string",
+        "name": "x",
+        "type": "any\u003cnumber, array\u003cnumber, string\u003e\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the day of the week (Monday, Tuesday, ...) for the nanoseconds since epoch.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the weekday represented by `ns` nanoseconds since the epoch in the supplied timezone (or UTC)",
+      "name": "day",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "to_number": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any\u003cnull, boolean, number, string\u003e"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Converts a string, bool, or number value to a number: Strings are converted to numbers using `strconv.Atoi`, Boolean `false` is converted to 0 and `true` is converted to 1.",
+    "introduced": "v0.17.0",
+    "result": {
+      "name": "num",
+      "type": "number"
+    },
+    "wasm": true
+  },
+  "trace": {
+    "args": [
+      {
+        "description": "the note to include",
+        "name": "note",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Emits `note` as a `Note` event in the query explanation. Query explanations show the exact expressions evaluated by OPA during policy execution. For example, `trace(\"Hello There!\")` includes `Note \"Hello There!\"` in the query explanation. To include variables in the message, use `sprintf`. For example, `person := \"Bob\"; trace(sprintf(\"Hello There! %v\", [person]))` will emit `Note \"Hello There! Bob\"` inside of the explanation.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "always `true`",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "trim": {
+    "args": [
+      {
+        "description": "string to trim",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "string of characters that are cut off",
+        "name": "cutset",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `value` with all leading or trailing instances of the `cutset` characters removed.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string trimmed of `cutset` characters",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "trim_left": {
+    "args": [
+      {
+        "description": "string to trim",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "string of characters that are cut off on the left",
+        "name": "cutset",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `value` with all leading instances of the `cutset` chartacters removed.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string left-trimmed of `cutset` characters",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "trim_prefix": {
+    "args": [
+      {
+        "description": "string to trim",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "prefix to cut off",
+        "name": "prefix",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `value` without the prefix. If `value` doesn't start with `prefix`, it is returned unchanged.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string with `prefix` cut off",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "trim_right": {
+    "args": [
+      {
+        "description": "string to trim",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "string of characters that are cut off on the right",
+        "name": "cutset",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `value` with all trailing instances of the `cutset` chartacters removed.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string right-trimmed of `cutset` characters",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "trim_space": {
+    "args": [
+      {
+        "description": "string to trim",
+        "name": "value",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Return the given string with all leading and trailing white space removed.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string leading and trailing white space cut off",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "trim_suffix": {
+    "args": [
+      {
+        "description": "string to trim",
+        "name": "value",
+        "type": "string"
+      },
+      {
+        "description": "suffix to cut off",
+        "name": "suffix",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns `value` without the suffix. If `value` doesn't end with `suffix`, it is returned unchanged.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "string with `suffix` cut off",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "type_name": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the type of its input value.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "one of \"null\", \"boolean\", \"number\", \"string\", \"array\", \"object\", \"set\"",
+      "name": "type",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "union": {
+    "args": [
+      {
+        "description": "set of sets to merge",
+        "name": "xs",
+        "type": "set[set[any]]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the union of the given input sets.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the union of all `xs` sets",
+      "name": "y",
+      "type": "set[any]"
+    },
+    "wasm": true
+  },
+  "units.parse": {
+    "args": [
+      {
+        "description": "the unit to parse",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Converts strings like \"10G\", \"5K\", \"4M\", \"1500m\" and the like into a number.\nThis number can be a non-integer, such as 1.5, 0.22, etc. Supports standard metric decimal and\nbinary SI units (e.g., K, Ki, M, Mi, G, Gi etc.) m, K, M, G, T, P, and E are treated as decimal\nunits and Ki, Mi, Gi, Ti, Pi, and Ei are treated as binary units.\n\nNote that 'm' and 'M' are case-sensitive, to allow distinguishing between \"milli\" and \"mega\" units respectively. Other units are case-insensitive.",
+    "introduced": "v0.41.0",
+    "result": {
+      "description": "the parsed number",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "units.parse_bytes": {
+    "args": [
+      {
+        "description": "the byte unit to parse",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Converts strings like \"10GB\", \"5K\", \"4mb\" into an integer number of bytes.\nSupports standard byte units (e.g., KB, KiB, etc.) KB, MB, GB, and TB are treated as decimal\nunits and KiB, MiB, GiB, and TiB are treated as binary units. The bytes symbol (b/B) in the\nunit is optional and omitting it wil give the same result (e.g. Mi and MiB).",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the parsed number",
+      "name": "y",
+      "type": "number"
+    },
+    "wasm": false
+  },
+  "upper": {
+    "args": [
+      {
+        "description": "string that is converted to upper-case",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns the input string but with all characters in upper-case.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "upper-case of x",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": true
+  },
+  "urlquery.decode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Decodes a URL-encoded input string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "URL-encoding deserialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "urlquery.decode_object": {
+    "args": [
+      {
+        "description": "the query string",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Decodes the given URL query string into an object.",
+    "introduced": "v0.24.0",
+    "result": {
+      "description": "the resulting object",
+      "name": "object",
+      "type": "object[string: array[string]]"
+    },
+    "wasm": false
+  },
+  "urlquery.encode": {
+    "args": [
+      {
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Encodes the input string into a URL-encoded string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "URL-encoding serialization of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "urlquery.encode_object": {
+    "args": [
+      {
+        "name": "object",
+        "type": "object[string: any\u003cstring, array[string], set[string]\u003e]"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Encodes the given object into a URL encoded query string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the URL-encoded serialization of `object`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "uuid.rfc4122": {
+    "args": [
+      {
+        "name": "k",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Returns a new UUIDv4.",
+    "introduced": "v0.20.0",
+    "result": {
+      "description": "a version 4 UUID; for any given `k`, the output will be consistent throughout a query evaluation",
+      "name": "output",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "walk": {
+    "args": [
+      {
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Generates `[path, value]` tuples for all nested documents of `x` (recursively).  Queries can use `walk` to traverse documents nested under `x`.",
+    "introduced": "v0.17.0",
+    "relation": true,
+    "result": {
+      "description": "pairs of `path` and `value`: `path` is an array representing the pointer to `value` in `x`",
+      "name": "output",
+      "type": "array\u003carray[any], any\u003e"
+    },
+    "wasm": true
+  },
+  "yaml.is_valid": {
+    "args": [
+      {
+        "description": "a YAML string",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Verifies the input string is a valid YAML document.",
+    "introduced": "v0.25.0-rc1",
+    "result": {
+      "description": "`true` if `x` is valid YAML, `false` otherwise",
+      "name": "result",
+      "type": "boolean"
+    },
+    "wasm": false
+  },
+  "yaml.marshal": {
+    "args": [
+      {
+        "description": "the term to serialize",
+        "name": "x",
+        "type": "any"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Serializes the input term to YAML.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the YAML string representation of `x`",
+      "name": "y",
+      "type": "string"
+    },
+    "wasm": false
+  },
+  "yaml.unmarshal": {
+    "args": [
+      {
+        "description": "a YAML string",
+        "name": "x",
+        "type": "string"
+      }
+    ],
+    "available": [
+      "v0.17.0",
+      "v0.17.1",
+      "v0.17.2",
+      "v0.17.3",
+      "v0.18.0",
+      "v0.19.0-rc1",
+      "v0.19.0",
+      "v0.19.1",
+      "v0.19.2",
+      "v0.20.0",
+      "v0.20.1",
+      "v0.20.2",
+      "v0.20.3",
+      "v0.20.4",
+      "v0.20.5",
+      "v0.21.0",
+      "v0.21.1",
+      "v0.22.0",
+      "v0.23.0",
+      "v0.23.1",
+      "v0.23.2",
+      "v0.24.0",
+      "v0.25.0-rc1",
+      "v0.25.0-rc2",
+      "v0.25.0-rc3",
+      "v0.25.0-rc4",
+      "v0.25.0",
+      "v0.25.1",
+      "v0.25.2",
+      "v0.26.0",
+      "v0.27.0",
+      "v0.27.1",
+      "v0.28.0",
+      "v0.29.0",
+      "v0.29.1",
+      "v0.29.2",
+      "v0.29.3",
+      "v0.29.4",
+      "v0.30.0",
+      "v0.30.1",
+      "v0.30.2",
+      "v0.31.0",
+      "v0.32.0",
+      "v0.32.1",
+      "v0.33.0",
+      "v0.33.1",
+      "v0.34.0",
+      "v0.34.1",
+      "v0.34.2",
+      "v0.35.0",
+      "v0.36.0",
+      "v0.36.1",
+      "v0.37.0",
+      "v0.37.1",
+      "v0.37.2",
+      "v0.38.0",
+      "v0.38.1",
+      "v0.39.0",
+      "v0.40.0",
+      "v0.41.0",
+      "v0.42.0",
+      "v0.42.1",
+      "v0.42.2",
+      "v0.43.0",
+      "v0.43.1",
+      "v0.44.0",
+      "v0.45.0",
+      "v0.46.0",
+      "v0.46.1",
+      "v0.46.2",
+      "v0.46.3",
+      "v0.47.0",
+      "v0.47.1",
+      "v0.47.2",
+      "v0.47.3",
+      "v0.47.4",
+      "v0.48.0",
+      "v0.49.0",
+      "v0.49.1",
+      "v0.49.2",
+      "v0.50.0",
+      "v0.50.1",
+      "v0.50.2",
+      "v0.51.0",
+      "v0.52.0",
+      "edge"
+    ],
+    "description": "Deserializes the input string.",
+    "introduced": "v0.17.0",
+    "result": {
+      "description": "the term deseralized from `x`",
+      "name": "y",
+      "type": "any"
+    },
+    "wasm": false
+  }
+}
diff --git a/bundle/bundle.go b/bundle/bundle.go
index 13ec7fe561..4b08501dd7 100644
--- a/bundle/bundle.go
+++ b/bundle/bundle.go
@@ -11,6 +11,7 @@ import (
 	"compress/gzip"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/url"
@@ -18,8 +19,6 @@ import (
 	"reflect"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/format"
 	"github.com/open-policy-agent/opa/internal/file/archive"
@@ -32,12 +31,17 @@ import (
 const (
 	RegoExt               = ".rego"
 	WasmFile              = "policy.wasm"
+	PlanFile              = "plan.json"
 	ManifestExt           = ".manifest"
 	SignaturesFile        = "signatures.json"
+	patchFile             = "patch.json"
 	dataFile              = "data.json"
 	yamlDataFile          = "data.yaml"
+	ymlDataFile           = "data.yml"
 	defaultHashingAlg     = "SHA-256"
 	DefaultSizeLimitBytes = (1024 * 1024 * 1024) // limit bundle reads to 1GB to protect against gzip bombs
+	DeltaBundleType       = "delta"
+	SnapshotBundleType    = "snapshot"
 )
 
 // Bundle represents a loaded bundle. The bundle can contain data and policies.
@@ -48,6 +52,32 @@ type Bundle struct {
 	Modules     []ModuleFile
 	Wasm        []byte // Deprecated. Use WasmModules instead
 	WasmModules []WasmModuleFile
+	PlanModules []PlanModuleFile
+	Patch       Patch
+	Etag        string
+	Raw         []Raw
+
+	lazyLoadingMode bool
+	sizeLimitBytes  int64
+}
+
+// Raw contains raw bytes representing the bundle's content
+type Raw struct {
+	Path  string
+	Value []byte
+}
+
+// Patch contains an array of objects wherein each object represents the patch operation to be
+// applied to the bundle data.
+type Patch struct {
+	Data []PatchOperation `json:"data,omitempty"`
+}
+
+// PatchOperation models a single patch operation against a document.
+type PatchOperation struct {
+	Op    string      `json:"op"`
+	Path  string      `json:"path"`
+	Value interface{} `json:"value"`
 }
 
 // SignaturesConfig represents an array of JWTs that encapsulate the signatures for the bundle.
@@ -97,8 +127,9 @@ type Manifest struct {
 
 // WasmResolver maps a wasm module to an entrypoint ref.
 type WasmResolver struct {
-	Entrypoint string `json:"entrypoint,omitempty"`
-	Module     string `json:"module,omitempty"`
+	Entrypoint  string             `json:"entrypoint,omitempty"`
+	Module      string             `json:"module,omitempty"`
+	Annotations []*ast.Annotations `json:"annotations,omitempty"`
 }
 
 // Init initializes the manifest. If you instantiate a manifest
@@ -129,21 +160,15 @@ func (m Manifest) Equal(other Manifest) bool {
 		return false
 	}
 
-	if len(m.WasmResolvers) != len(other.WasmResolvers) {
-		return false
-	}
-
-	for i := 0; i < len(m.WasmResolvers); i++ {
-		if m.WasmResolvers[i] != other.WasmResolvers[i] {
-			return false
-		}
-	}
-
 	if !reflect.DeepEqual(m.Metadata, other.Metadata) {
 		return false
 	}
 
-	return m.rootSet().Equal(other.rootSet())
+	return m.equalWasmResolversAndRoots(other)
+}
+
+func (m Manifest) Empty() bool {
+	return m.Equal(Manifest{})
 }
 
 // Copy returns a deep copy of the manifest.
@@ -171,7 +196,7 @@ func (m Manifest) Copy() Manifest {
 
 func (m Manifest) String() string {
 	m.Init()
-	return fmt.Sprintf("<revision: %q, roots: %v, wasm: %+v>", m.Revision, *m.Roots, m.WasmResolvers)
+	return fmt.Sprintf("<revision: %q, roots: %v, wasm: %+v, metadata: %+v>", m.Revision, *m.Roots, m.WasmResolvers, m.Metadata)
 }
 
 func (m Manifest) rootSet() stringSet {
@@ -184,6 +209,51 @@ func (m Manifest) rootSet() stringSet {
 	return stringSet(rs)
 }
 
+func (m Manifest) equalWasmResolversAndRoots(other Manifest) bool {
+	if len(m.WasmResolvers) != len(other.WasmResolvers) {
+		return false
+	}
+
+	for i := 0; i < len(m.WasmResolvers); i++ {
+		if !m.WasmResolvers[i].Equal(&other.WasmResolvers[i]) {
+			return false
+		}
+	}
+
+	return m.rootSet().Equal(other.rootSet())
+}
+
+func (wr *WasmResolver) Equal(other *WasmResolver) bool {
+	if wr == nil && other == nil {
+		return true
+	}
+
+	if wr == nil || other == nil {
+		return false
+	}
+
+	if wr.Module != other.Module {
+		return false
+	}
+
+	if wr.Entrypoint != other.Entrypoint {
+		return false
+	}
+
+	annotLen := len(wr.Annotations)
+	if annotLen != len(other.Annotations) {
+		return false
+	}
+
+	for i := 0; i < annotLen; i++ {
+		if wr.Annotations[i].Compare(other.Annotations[i]) != 0 {
+			return false
+		}
+	}
+
+	return true
+}
+
 type stringSet map[string]struct{}
 
 func (ss stringSet) Equal(other stringSet) bool {
@@ -222,12 +292,7 @@ func (m *Manifest) validateAndInjectDefaults(b Bundle) error {
 	for _, module := range b.Modules {
 		found := false
 		if path, err := module.Parsed.Package.Path.Ptr(); err == nil {
-			for i := range roots {
-				if strings.HasPrefix(path, roots[i]) {
-					found = true
-					break
-				}
-			}
+			found = RootPathsContain(roots, path)
 		}
 		if !found {
 			return fmt.Errorf("manifest roots %v do not permit '%v' in module '%v'", roots, module.Parsed.Package, module.Path)
@@ -248,15 +313,7 @@ func (m *Manifest) validateAndInjectDefaults(b Bundle) error {
 		}
 
 		// Ensure wasm module entrypoint in within bundle roots
-		found := false
-		for i := range roots {
-			if strings.HasPrefix(wmConfig.Entrypoint, roots[i]) {
-				found = true
-				break
-			}
-		}
-
-		if !found {
+		if !RootPathsContain(roots, wmConfig.Entrypoint) {
 			return fmt.Errorf("manifest roots %v do not permit '%v' entrypoint for wasm module '%v'", roots, wmConfig.Entrypoint, wmConfig.Module)
 		}
 
@@ -268,17 +325,28 @@ func (m *Manifest) validateAndInjectDefaults(b Bundle) error {
 		wasmModuleToEps[wmConfig.Module] = wmConfig.Entrypoint
 	}
 
+	// Validate data patches in bundle.
+	for _, patch := range b.Patch.Data {
+		path := strings.Trim(patch.Path, "/")
+		if !RootPathsContain(roots, path) {
+			return fmt.Errorf("manifest roots %v do not permit data patch at path '%s'", roots, path)
+		}
+	}
+
+	if b.lazyLoadingMode {
+		return nil
+	}
+
 	// Validate data in bundle.
 	return dfs(b.Data, "", func(path string, node interface{}) (bool, error) {
 		path = strings.Trim(path, "/")
-		for i := range roots {
-			if strings.HasPrefix(path, roots[i]) {
-				return true, nil
-			}
+		if RootPathsContain(roots, path) {
+			return true, nil
 		}
+
 		if _, ok := node.(map[string]interface{}); ok {
 			for i := range roots {
-				if strings.HasPrefix(roots[i], path) {
+				if RootPathsContain(strings.Split(path, "/"), roots[i]) {
 					return false, nil
 				}
 			}
@@ -303,6 +371,17 @@ type WasmModuleFile struct {
 	Raw         []byte
 }
 
+// PlanModuleFile represents a single plan module contained in a bundle.
+//
+// NOTE(tsandall): currently the plans are just opaque binary blobs. In the
+// future we could inject the entrypoints so that the plans could be executed
+// inside of OPA proper like we do for Wasm modules.
+type PlanModuleFile struct {
+	URL  string
+	Path string
+	Raw  []byte
+}
+
 // Reader contains the reader to load the bundle from.
 type Reader struct {
 	loader                DirectoryLoader
@@ -312,8 +391,13 @@ type Reader struct {
 	verificationConfig    *VerificationConfig
 	skipVerify            bool
 	processAnnotations    bool
+	jsonOptions           *ast.JSONOptions
+	capabilities          *ast.Capabilities
 	files                 map[string]FileInfo // files in the bundle signature payload
 	sizeLimitBytes        int64
+	etag                  string
+	lazyLoadingMode       bool
+	name                  string
 }
 
 // NewReader is deprecated. Use NewCustomReader instead.
@@ -371,6 +455,18 @@ func (r *Reader) WithProcessAnnotations(yes bool) *Reader {
 	return r
 }
 
+// WithCapabilities sets the supported capabilities when loading the files
+func (r *Reader) WithCapabilities(caps *ast.Capabilities) *Reader {
+	r.capabilities = caps
+	return r
+}
+
+// WithJSONOptions sets the JSONOptions to use when parsing policy files
+func (r *Reader) WithJSONOptions(opts *ast.JSONOptions) *Reader {
+	r.jsonOptions = opts
+	return r
+}
+
 // WithSizeLimitBytes sets the size limit to apply to files in the bundle. If files are larger
 // than this, an error will be returned by the reader.
 func (r *Reader) WithSizeLimitBytes(n int64) *Reader {
@@ -378,38 +474,68 @@ func (r *Reader) WithSizeLimitBytes(n int64) *Reader {
 	return r
 }
 
+// WithBundleEtag sets the given etag value on the bundle
+func (r *Reader) WithBundleEtag(etag string) *Reader {
+	r.etag = etag
+	return r
+}
+
+// WithBundleName specifies the bundle name
+func (r *Reader) WithBundleName(name string) *Reader {
+	r.name = name
+	return r
+}
+
+// WithLazyLoadingMode sets the bundle loading mode. If true,
+// bundles will be read in lazy mode. In this mode, data files in the bundle will not be
+// deserialized and the check to validate that the bundle data does not contain paths
+// outside the bundle's roots will not be performed while reading the bundle.
+func (r *Reader) WithLazyLoadingMode(yes bool) *Reader {
+	r.lazyLoadingMode = yes
+	return r
+}
+
+func (r *Reader) ParserOptions() ast.ParserOptions {
+	return ast.ParserOptions{
+		ProcessAnnotation: r.processAnnotations,
+		Capabilities:      r.capabilities,
+		JSONOptions:       r.jsonOptions,
+	}
+}
+
 // Read returns a new Bundle loaded from the reader.
 func (r *Reader) Read() (Bundle, error) {
 
 	var bundle Bundle
 	var descriptors []*Descriptor
 	var err error
+	var raw []Raw
 
-	bundle.Data = map[string]interface{}{}
-
-	bundle.Signatures, descriptors, err = listSignaturesAndDescriptors(r.loader, r.skipVerify, r.sizeLimitBytes)
+	bundle.Signatures, bundle.Patch, descriptors, err = preProcessBundle(r.loader, r.skipVerify, r.sizeLimitBytes)
 	if err != nil {
 		return bundle, err
 	}
 
-	err = r.checkSignaturesAndDescriptors(bundle.Signatures)
-	if err != nil {
-		return bundle, err
+	bundle.lazyLoadingMode = r.lazyLoadingMode
+	bundle.sizeLimitBytes = r.sizeLimitBytes
+
+	if bundle.Type() == SnapshotBundleType {
+		err = r.checkSignaturesAndDescriptors(bundle.Signatures)
+		if err != nil {
+			return bundle, err
+		}
+
+		bundle.Data = map[string]interface{}{}
 	}
 
 	for _, f := range descriptors {
-		var buf bytes.Buffer
-		n, err := f.Read(&buf, r.sizeLimitBytes)
-		f.Close() // always close, even on error
-
-		if err != nil && err != io.EOF {
+		buf, err := readFile(f, r.sizeLimitBytes)
+		if err != nil {
 			return bundle, err
-		} else if err == nil && n >= r.sizeLimitBytes {
-			return bundle, fmt.Errorf("bundle file exceeded max size (%v bytes)", r.sizeLimitBytes-1)
 		}
 
 		// verify the file content
-		if !bundle.Signatures.isEmpty() {
+		if bundle.Type() == SnapshotBundleType && !bundle.Signatures.isEmpty() {
 			path := f.Path()
 			if r.baseDir != "" {
 				path = f.URL()
@@ -431,8 +557,19 @@ func (r *Reader) Read() (Bundle, error) {
 
 		if strings.HasSuffix(path, RegoExt) {
 			fullPath := r.fullPath(path)
+			bs := buf.Bytes()
+
+			if r.lazyLoadingMode {
+				p := fullPath
+				if r.name != "" {
+					p = modulePathWithPrefix(r.name, fullPath)
+				}
+
+				raw = append(raw, Raw{Path: p, Value: bs})
+			}
+
 			r.metrics.Timer(metrics.RegoModuleParse).Start()
-			module, err := ast.ParseModuleWithOpts(fullPath, buf.String(), ast.ParserOptions{ProcessAnnotation: r.processAnnotations})
+			module, err := ast.ParseModuleWithOpts(fullPath, buf.String(), r.ParserOptions())
 			r.metrics.Timer(metrics.RegoModuleParse).Stop()
 			if err != nil {
 				return bundle, err
@@ -441,18 +578,28 @@ func (r *Reader) Read() (Bundle, error) {
 			mf := ModuleFile{
 				URL:    f.URL(),
 				Path:   fullPath,
-				Raw:    buf.Bytes(),
+				Raw:    bs,
 				Parsed: module,
 			}
 			bundle.Modules = append(bundle.Modules, mf)
-
 		} else if filepath.Base(path) == WasmFile {
 			bundle.WasmModules = append(bundle.WasmModules, WasmModuleFile{
 				URL:  f.URL(),
 				Path: r.fullPath(path),
 				Raw:  buf.Bytes(),
 			})
+		} else if filepath.Base(path) == PlanFile {
+			bundle.PlanModules = append(bundle.PlanModules, PlanModuleFile{
+				URL:  f.URL(),
+				Path: r.fullPath(path),
+				Raw:  buf.Bytes(),
+			})
 		} else if filepath.Base(path) == dataFile {
+			if r.lazyLoadingMode {
+				raw = append(raw, Raw{Path: path, Value: buf.Bytes()})
+				continue
+			}
+
 			var value interface{}
 
 			r.metrics.Timer(metrics.RegoDataParse).Start()
@@ -460,14 +607,18 @@ func (r *Reader) Read() (Bundle, error) {
 			r.metrics.Timer(metrics.RegoDataParse).Stop()
 
 			if err != nil {
-				return bundle, errors.Wrapf(err, "bundle load failed on %v", r.fullPath(path))
+				return bundle, fmt.Errorf("bundle load failed on %v: %w", r.fullPath(path), err)
 			}
 
 			if err := insertValue(&bundle, path, value); err != nil {
 				return bundle, err
 			}
 
-		} else if filepath.Base(path) == yamlDataFile {
+		} else if filepath.Base(path) == yamlDataFile || filepath.Base(path) == ymlDataFile {
+			if r.lazyLoadingMode {
+				raw = append(raw, Raw{Path: path, Value: buf.Bytes()})
+				continue
+			}
 
 			var value interface{}
 
@@ -476,7 +627,7 @@ func (r *Reader) Read() (Bundle, error) {
 			r.metrics.Timer(metrics.RegoDataParse).Stop()
 
 			if err != nil {
-				return bundle, errors.Wrapf(err, "bundle load failed on %v", r.fullPath(path))
+				return bundle, fmt.Errorf("bundle load failed on %v: %w", r.fullPath(path), err)
 			}
 
 			if err := insertValue(&bundle, path, value); err != nil {
@@ -485,13 +636,27 @@ func (r *Reader) Read() (Bundle, error) {
 
 		} else if strings.HasSuffix(path, ManifestExt) {
 			if err := util.NewJSONDecoder(&buf).Decode(&bundle.Manifest); err != nil {
-				return bundle, errors.Wrap(err, "bundle load failed on manifest decode")
+				return bundle, fmt.Errorf("bundle load failed on manifest decode: %w", err)
 			}
 		}
 	}
 
+	if bundle.Type() == DeltaBundleType {
+		if len(bundle.Data) != 0 {
+			return bundle, fmt.Errorf("delta bundle expected to contain only patch file but data files found")
+		}
+
+		if len(bundle.Modules) != 0 {
+			return bundle, fmt.Errorf("delta bundle expected to contain only patch file but policy files found")
+		}
+
+		if len(bundle.WasmModules) != 0 {
+			return bundle, fmt.Errorf("delta bundle expected to contain only patch file but wasm files found")
+		}
+	}
+
 	// check if the bundle signatures specify any files that weren't found in the bundle
-	if len(r.files) != 0 {
+	if bundle.Type() == SnapshotBundleType && len(r.files) != 0 {
 		extra := []string{}
 		for k := range r.files {
 			extra = append(extra, k)
@@ -524,21 +689,24 @@ func (r *Reader) Read() (Bundle, error) {
 
 		b, err := json.Marshal(&bundle.Manifest)
 		if err != nil {
-			return bundle, errors.Wrap(err, "bundle load failed on manifest marshal")
+			return bundle, fmt.Errorf("bundle load failed on manifest marshal: %w", err)
 		}
 
 		err = util.UnmarshalJSON(b, &metadata)
 		if err != nil {
-			return bundle, errors.Wrap(err, "bundle load failed on manifest unmarshal")
+			return bundle, fmt.Errorf("bundle load failed on manifest unmarshal: %w", err)
 		}
 
 		// For backwards compatibility always write to the old unnamed manifest path
 		// This will *not* be correct if >1 bundle is in use...
 		if err := bundle.insertData(legacyManifestStoragePath, metadata); err != nil {
-			return bundle, errors.Wrapf(err, "bundle load failed on %v", legacyRevisionStoragePath)
+			return bundle, fmt.Errorf("bundle load failed on %v: %w", legacyRevisionStoragePath, err)
 		}
 	}
 
+	bundle.Etag = r.etag
+	bundle.Raw = raw
+
 	return bundle, nil
 }
 
@@ -632,36 +800,48 @@ func (w *Writer) Write(bundle Bundle) error {
 	gw := gzip.NewWriter(w.w)
 	tw := tar.NewWriter(gw)
 
-	var buf bytes.Buffer
+	bundleType := bundle.Type()
 
-	if err := json.NewEncoder(&buf).Encode(bundle.Data); err != nil {
-		return err
-	}
+	if bundleType == SnapshotBundleType {
+		var buf bytes.Buffer
 
-	if err := archive.WriteFile(tw, "data.json", buf.Bytes()); err != nil {
-		return err
-	}
+		if err := json.NewEncoder(&buf).Encode(bundle.Data); err != nil {
+			return err
+		}
 
-	for _, module := range bundle.Modules {
-		path := module.URL
-		if w.usePath {
-			path = module.Path
+		if err := archive.WriteFile(tw, "data.json", buf.Bytes()); err != nil {
+			return err
+		}
+
+		for _, module := range bundle.Modules {
+			path := module.URL
+			if w.usePath {
+				path = module.Path
+			}
+
+			if err := archive.WriteFile(tw, path, module.Raw); err != nil {
+				return err
+			}
 		}
 
-		if err := archive.WriteFile(tw, path, module.Raw); err != nil {
+		if err := w.writeWasm(tw, bundle); err != nil {
 			return err
 		}
-	}
 
-	if err := w.writeWasm(tw, bundle); err != nil {
-		return err
-	}
+		if err := writeSignatures(tw, bundle); err != nil {
+			return err
+		}
 
-	if err := writeManifest(tw, bundle); err != nil {
-		return err
+		if err := w.writePlan(tw, bundle); err != nil {
+			return err
+		}
+	} else if bundleType == DeltaBundleType {
+		if err := writePatch(tw, bundle); err != nil {
+			return err
+		}
 	}
 
-	if err := writeSignatures(tw, bundle); err != nil {
+	if err := writeManifest(tw, bundle); err != nil {
 		return err
 	}
 
@@ -695,9 +875,25 @@ func (w *Writer) writeWasm(tw *tar.Writer, bundle Bundle) error {
 	return nil
 }
 
+func (w *Writer) writePlan(tw *tar.Writer, bundle Bundle) error {
+	for _, wm := range bundle.PlanModules {
+		path := wm.URL
+		if w.usePath {
+			path = wm.Path
+		}
+
+		err := archive.WriteFile(tw, path, wm.Raw)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 func writeManifest(tw *tar.Writer, bundle Bundle) error {
 
-	if bundle.Manifest.Equal(Manifest{}) {
+	if bundle.Manifest.Empty() {
 		return nil
 	}
 
@@ -710,6 +906,17 @@ func writeManifest(tw *tar.Writer, bundle Bundle) error {
 	return archive.WriteFile(tw, ManifestExt, buf.Bytes())
 }
 
+func writePatch(tw *tar.Writer, bundle Bundle) error {
+
+	var buf bytes.Buffer
+
+	if err := json.NewEncoder(&buf).Encode(bundle.Patch); err != nil {
+		return err
+	}
+
+	return archive.WriteFile(tw, patchFile, buf.Bytes())
+}
+
 func writeSignatures(tw *tar.Writer, bundle Bundle) error {
 
 	if bundle.Signatures.isEmpty() {
@@ -750,11 +957,37 @@ func hashBundleFiles(hash SignatureHasher, b *Bundle) ([]FileInfo, error) {
 		files = append(files, NewFile(strings.TrimPrefix(wasmModule.Path, "/"), hex.EncodeToString(bs), defaultHashingAlg))
 	}
 
-	bs, err = hash.HashFile(b.Manifest)
-	if err != nil {
-		return files, err
+	for _, planmodule := range b.PlanModules {
+		bs, err := hash.HashFile(planmodule.Raw)
+		if err != nil {
+			return files, err
+		}
+		files = append(files, NewFile(strings.TrimPrefix(planmodule.Path, "/"), hex.EncodeToString(bs), defaultHashingAlg))
+	}
+
+	// If the manifest is essentially empty, don't add it to the signatures since it
+	// won't be written to the bundle. Otherwise:
+	// parse the manifest into a JSON structure;
+	// then recursively order the fields of all objects alphabetically and then apply
+	// the hash function to result to compute the hash.
+	if !b.Manifest.Empty() {
+		mbs, err := json.Marshal(b.Manifest)
+		if err != nil {
+			return files, err
+		}
+
+		var result map[string]interface{}
+		if err := util.Unmarshal(mbs, &result); err != nil {
+			return files, err
+		}
+
+		bs, err = hash.HashFile(result)
+		if err != nil {
+			return files, err
+		}
+
+		files = append(files, NewFile(strings.TrimPrefix(ManifestExt, "/"), hex.EncodeToString(bs), defaultHashingAlg))
 	}
-	files = append(files, NewFile(strings.TrimPrefix(ManifestExt, "/"), hex.EncodeToString(bs), defaultHashingAlg))
 
 	return files, err
 }
@@ -828,7 +1061,7 @@ func (b *Bundle) GenerateSignature(signingConfig *SigningConfig, keyID string, u
 		b.Signatures.Plugin = signingConfig.Plugin
 	}
 
-	b.Signatures.Signatures = []string{string(token)}
+	b.Signatures.Signatures = []string{token}
 
 	return nil
 }
@@ -857,10 +1090,14 @@ func (b Bundle) Equal(other Bundle) bool {
 		return false
 	}
 	for i := range b.Modules {
-		if b.Modules[i].URL != other.Modules[i].URL {
+		// To support bundles built from rootless filesystems we ignore a "/" prefix
+		// for URLs and Paths, such that "/file" and "file" are equivalent
+		if strings.TrimPrefix(b.Modules[i].URL, string(filepath.Separator)) !=
+			strings.TrimPrefix(other.Modules[i].URL, string(filepath.Separator)) {
 			return false
 		}
-		if b.Modules[i].Path != other.Modules[i].Path {
+		if strings.TrimPrefix(b.Modules[i].Path, string(filepath.Separator)) !=
+			strings.TrimPrefix(other.Modules[i].Path, string(filepath.Separator)) {
 			return false
 		}
 		if !b.Modules[i].Parsed.Equal(other.Modules[i].Parsed) {
@@ -958,6 +1195,14 @@ func (b *Bundle) readData(key []string) *interface{} {
 	return &child
 }
 
+// Type returns the type of the bundle.
+func (b *Bundle) Type() string {
+	if len(b.Patch.Data) != 0 {
+		return DeltaBundleType
+	}
+	return SnapshotBundleType
+}
+
 func mktree(path []string, value interface{}) (map[string]interface{}, error) {
 	if len(path) == 0 {
 		// For 0 length path the value is the full tree.
@@ -1017,7 +1262,12 @@ func Merge(bundles []*Bundle) (*Bundle, error) {
 
 		result.Manifest.WasmResolvers = append(result.Manifest.WasmResolvers, b.Manifest.WasmResolvers...)
 		result.WasmModules = append(result.WasmModules, b.WasmModules...)
+		result.PlanModules = append(result.PlanModules, b.PlanModules...)
+
+	}
 
+	if result.Data == nil {
+		result.Data = map[string]interface{}{}
 	}
 
 	result.Manifest.Roots = &roots
@@ -1072,21 +1322,24 @@ func rootContains(root []string, other []string) bool {
 }
 
 func insertValue(b *Bundle, path string, value interface{}) error {
+	if err := b.insertData(getNormalizedPath(path), value); err != nil {
+		return fmt.Errorf("bundle load failed on %v: %w", path, err)
+	}
+	return nil
+}
 
+func getNormalizedPath(path string) []string {
 	// Remove leading / and . characters from the directory path. If the bundle
 	// was written with OPA then the paths will contain a leading slash. On the
 	// other hand, if the path is empty, filepath.Dir will return '.'.
 	// Note: filepath.Dir can return paths with '\' separators, always use
 	// filepath.ToSlash to keep them normalized.
-	dirpath := strings.TrimLeft(filepath.ToSlash(filepath.Dir(path)), "/.")
+	dirpath := strings.TrimLeft(normalizePath(filepath.Dir(path)), "/.")
 	var key []string
 	if dirpath != "" {
 		key = strings.Split(dirpath, "/")
 	}
-	if err := b.insertData(key, value); err != nil {
-		return errors.Wrapf(err, "bundle load failed on %v", path)
-	}
-	return nil
+	return key
 }
 
 func dfs(value interface{}, path string, fn func(string, interface{}) (bool, error)) error {
@@ -1118,7 +1371,9 @@ func modulePathWithPrefix(bundleName string, modulePath string) string {
 		prefix = filepath.Join(parsed.Host, parsed.Path)
 	}
 
-	return filepath.Join(prefix, modulePath)
+	// Note: filepath.Join can return paths with '\' separators, always use
+	// filepath.ToSlash to keep them normalized.
+	return normalizePath(filepath.Join(prefix, modulePath))
 }
 
 // IsStructuredDoc checks if the file name equals a structured file extension ex. ".json"
@@ -1127,9 +1382,10 @@ func IsStructuredDoc(name string) bool {
 		filepath.Base(name) == SignaturesFile || filepath.Base(name) == ManifestExt
 }
 
-func listSignaturesAndDescriptors(loader DirectoryLoader, skipVerify bool, sizeLimitBytes int64) (SignaturesConfig, []*Descriptor, error) {
+func preProcessBundle(loader DirectoryLoader, skipVerify bool, sizeLimitBytes int64) (SignaturesConfig, Patch, []*Descriptor, error) {
 	descriptors := []*Descriptor{}
 	var signatures SignaturesConfig
+	var patch Patch
 
 	for {
 		f, err := loader.NextFile()
@@ -1138,26 +1394,58 @@ func listSignaturesAndDescriptors(loader DirectoryLoader, skipVerify bool, sizeL
 		}
 
 		if err != nil {
-			return signatures, nil, errors.Wrap(err, "bundle read failed")
+			return signatures, patch, nil, fmt.Errorf("bundle read failed: %w", err)
 		}
 
 		// check for the signatures file
 		if !skipVerify && strings.HasSuffix(f.Path(), SignaturesFile) {
-			var buf bytes.Buffer
-			n, err := f.Read(&buf, sizeLimitBytes)
-			f.Close() // always close, even on error
-			if err != nil && err != io.EOF {
-				return signatures, nil, err
-			} else if err == nil && n >= sizeLimitBytes {
-				return signatures, nil, fmt.Errorf("bundle signatures file exceeded max size (%v bytes)", sizeLimitBytes-1)
+			buf, err := readFile(f, sizeLimitBytes)
+			if err != nil {
+				return signatures, patch, nil, err
 			}
 
 			if err := util.NewJSONDecoder(&buf).Decode(&signatures); err != nil {
-				return signatures, nil, errors.Wrap(err, "bundle load failed on signatures decode")
+				return signatures, patch, nil, fmt.Errorf("bundle load failed on signatures decode: %w", err)
 			}
 		} else if !strings.HasSuffix(f.Path(), SignaturesFile) {
 			descriptors = append(descriptors, f)
+
+			if filepath.Base(f.Path()) == patchFile {
+
+				var b bytes.Buffer
+				tee := io.TeeReader(f.reader, &b)
+				f.reader = tee
+
+				buf, err := readFile(f, sizeLimitBytes)
+				if err != nil {
+					return signatures, patch, nil, err
+				}
+
+				if err := util.NewJSONDecoder(&buf).Decode(&patch); err != nil {
+					return signatures, patch, nil, fmt.Errorf("bundle load failed on patch decode: %w", err)
+				}
+
+				f.reader = &b
+			}
 		}
 	}
-	return signatures, descriptors, nil
+	return signatures, patch, descriptors, nil
+}
+
+func readFile(f *Descriptor, sizeLimitBytes int64) (bytes.Buffer, error) {
+	var buf bytes.Buffer
+	n, err := f.Read(&buf, sizeLimitBytes)
+	f.Close() // always close, even on error
+
+	if err != nil && err != io.EOF {
+		return buf, err
+	} else if err == nil && n >= sizeLimitBytes {
+		return buf, fmt.Errorf("bundle file '%v' exceeded max size (%v bytes)", strings.TrimPrefix(f.Path(), "/"), sizeLimitBytes-1)
+	}
+
+	return buf, nil
+}
+
+func normalizePath(p string) string {
+	return filepath.ToSlash(p)
 }
diff --git a/bundle/bundle_test.go b/bundle/bundle_test.go
index 314c981c9b..1c21595902 100644
--- a/bundle/bundle_test.go
+++ b/bundle/bundle_test.go
@@ -10,15 +10,14 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
-
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
-
-	"github.com/pkg/errors"
+	"testing/fstest"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/internal/file/archive"
@@ -84,11 +83,15 @@ func TestManifestEqual(t *testing.T) {
 }
 
 func TestRead(t *testing.T) {
-	testReadBundle(t, "")
+	for _, useMemoryFS := range []bool{false, true} {
+		testReadBundle(t, "", useMemoryFS)
+	}
 }
 
 func TestReadWithBaseDir(t *testing.T) {
-	testReadBundle(t, "/foo/bar")
+	for _, useMemoryFS := range []bool{false, true} {
+		testReadBundle(t, "/foo/bar", useMemoryFS)
+	}
 }
 
 func TestReadWithSizeLimit(t *testing.T) {
@@ -101,7 +104,7 @@ func TestReadWithSizeLimit(t *testing.T) {
 	br := NewCustomReader(loader).WithSizeLimitBytes(4)
 
 	_, err := br.Read()
-	if err == nil || err.Error() != "bundle file exceeded max size (4 bytes)" {
+	if err == nil || err.Error() != "bundle file 'data.json' exceeded max size (4 bytes)" {
 		t.Fatal("expected error but got:", err)
 	}
 
@@ -113,14 +116,61 @@ func TestReadWithSizeLimit(t *testing.T) {
 	br = NewCustomReader(loader).WithSizeLimitBytes(4)
 
 	_, err = br.Read()
-	if err == nil || err.Error() != "bundle signatures file exceeded max size (4 bytes)" {
+	if err == nil || err.Error() != "bundle file '.signatures.json' exceeded max size (4 bytes)" {
 		t.Fatal("expected error but got:", err)
 	}
+}
+
+func TestReadBundleInLazyMode(t *testing.T) {
+	files := [][2]string{
+		{"/a/b/c/data.json", "[1,2,3]"},
+		{"/a/b/d/data.json", "true"},
+		{"/a/b/y/data.yaml", `foo: 1`},
+		{"/example/example.rego", `package example`},
+		{"/data.json", `{"x": {"y": true}, "a": {"b": {"z": true}}}}`},
+		{"/.manifest", `{"revision": "foo", "roots": ["example"]}`}, // data is outside roots but validation skipped in lazy mode
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	loader := NewTarballLoaderWithBaseURL(buf, "")
+	br := NewCustomReader(loader).WithLazyLoadingMode(true)
+
+	bundle, err := br.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(bundle.Data) != 0 {
+		t.Fatal("expected the bundle object to contain no data")
+	}
+
+	if len(bundle.Raw) == 0 {
+		t.Fatal("raw bundle bytes not set on bundle object")
+	}
+}
+
+func TestReadWithBundleEtag(t *testing.T) {
+
+	files := [][2]string{
+		{"/.manifest", `{"revision": "quickbrownfaux"}`},
+	}
 
+	buf := archive.MustWriteTarGz(files)
+	bundle, err := NewReader(buf).WithBundleEtag("foo").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if bundle.Etag != "foo" {
+		t.Fatalf("Expected bundle etag foo but got %v\n", bundle.Etag)
+	}
 }
 
-func testReadBundle(t *testing.T, baseDir string) {
+func testReadBundle(t *testing.T, baseDir string, useMemoryFS bool) {
 	module := `package example`
+	if useMemoryFS && baseDir == "" {
+		baseDir = "."
+	}
 
 	modulePath := "/example/example.rego"
 	if baseDir != "" {
@@ -142,6 +192,7 @@ func testReadBundle(t *testing.T, baseDir string) {
 		{"/a/b/c/data.json", "[1,2,3]"},
 		{"/a/b/d/data.json", "true"},
 		{"/a/b/y/data.yaml", `foo: 1`},
+		{"/a/b/g/data.yml", "1"},
 		{"/example/example.rego", `package example`},
 		{"/policy.wasm", `legacy-wasm-module`},
 		{wasmResolverPath, `wasm-module`},
@@ -150,7 +201,18 @@ func testReadBundle(t *testing.T, baseDir string) {
 	}
 
 	buf := archive.MustWriteTarGz(files)
-	loader := NewTarballLoaderWithBaseURL(buf, baseDir)
+	var loader DirectoryLoader
+	if useMemoryFS {
+		fsys := make(fstest.MapFS, 1)
+		fsys["test.tar"] = &fstest.MapFile{Data: buf.Bytes()}
+		fh, err := fsys.Open("test.tar")
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+		loader = NewTarballLoaderWithBaseURL(fh, baseDir)
+	} else {
+		loader = NewTarballLoaderWithBaseURL(buf, baseDir)
+	}
 	br := NewCustomReader(loader).WithBaseDir(baseDir)
 
 	bundle, err := br.Read()
@@ -174,6 +236,7 @@ func testReadBundle(t *testing.T, baseDir string) {
 				"b": map[string]interface{}{
 					"c": []interface{}{json.Number("1"), json.Number("2"), json.Number("3")},
 					"d": true,
+					"g": json.Number("1"),
 					"y": map[string]interface{}{
 						"foo": json.Number("1"),
 					},
@@ -418,6 +481,103 @@ func TestReadWithSignaturesWithBaseDir(t *testing.T) {
 	}
 }
 
+func TestReadWithPatch(t *testing.T) {
+	files := [][2]string{
+		{"/.manifest", `{"revision": "quickbrownfaux",  "roots": ["a"]}`},
+		{"/patch.json", `{"data": [{"op": "add", "path": "/a/b/d", "value": "foo"}, {"op": "remove", "path": "a/b/c"}]}`},
+	}
+
+	buf := archive.MustWriteTarGz(files)
+
+	loader := NewTarballLoaderWithBaseURL(buf, "/foo/bar")
+	reader := NewCustomReader(loader).WithBaseDir("/foo/bar")
+	b, err := reader.Read()
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+
+	actual := b.Type()
+	if actual != DeltaBundleType {
+		t.Fatalf("Expected delta bundle but got %v", actual)
+	}
+
+	if len(b.Patch.Data) != 2 {
+		t.Fatalf("Expected two patch operations but got %v", len(b.Patch.Data))
+	}
+
+	p1 := PatchOperation{
+		Op:    "add",
+		Path:  "/a/b/d",
+		Value: "foo",
+	}
+
+	p2 := PatchOperation{
+		Op:   "remove",
+		Path: "a/b/c",
+	}
+
+	expected := Patch{Data: []PatchOperation{p1, p2}}
+
+	if !reflect.DeepEqual(b.Patch.Data, expected.Data) {
+		t.Fatalf("Expected patch %v but got %v", expected.Data, b.Patch.Data)
+	}
+}
+
+func TestReadWithPatchExtraFiles(t *testing.T) {
+	cases := []struct {
+		note  string
+		files [][2]string
+		err   string
+	}{
+		{
+			note: "extra data file",
+			files: [][2]string{
+				{"/.manifest", `{"revision": "quickbrownfaux",  "roots": ["a"]}`},
+				{"/patch.json", `{"data": [{"op": "add", "path": "/a/b/d", "value": "foo"}, {"op": "remove", "path": "a/b/c"}]}`},
+				{"/a/b/c/data.json", "[1,2,3]"},
+			},
+			err: "delta bundle expected to contain only patch file but data files found",
+		},
+		{
+			note: "extra policy file",
+			files: [][2]string{
+				{"/.manifest", `{"revision": "quickbrownfaux",  "roots": ["a"]}`},
+				{"/patch.json", `{"data": [{"op": "add", "path": "/a/b/d", "value": "foo"}, {"op": "remove", "path": "a/b/c"}]}`},
+				{"/http/policy/policy.rego", `package example`},
+			},
+			err: "delta bundle expected to contain only patch file but policy files found",
+		},
+		{
+			note: "extra wasm file",
+			files: [][2]string{
+				{"/.manifest", `{"revision": "quickbrownfaux",  "roots": ["a"]}`},
+				{"/patch.json", `{"data": [{"op": "add", "path": "/a/b/d", "value": "foo"}, {"op": "remove", "path": "a/b/c"}]}`},
+				{"/policy.wasm", `modules-compiled-as-wasm-binary`},
+			},
+			err: "delta bundle expected to contain only patch file but wasm files found",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			buf := archive.MustWriteTarGz(tc.files)
+			loader := NewTarballLoaderWithBaseURL(buf, "/foo/bar")
+			reader := NewCustomReader(loader).WithBaseDir("/foo/bar")
+			_, err := reader.Read()
+			if tc.err == "" && err != nil {
+				t.Fatal("Unexpected error occurred:", err)
+			} else if tc.err != "" && err == nil {
+				t.Fatal("Expected error but got success")
+			} else if tc.err != "" && err != nil {
+				if tc.err != err.Error() {
+					t.Fatalf("Expected error to contain %q but got: %v", tc.err, err)
+				}
+			}
+		})
+	}
+
+}
+
 func TestReadWithSignaturesExtraFiles(t *testing.T) {
 	signedTokenHS256 := `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyJ9.eyJmaWxlcyI6W3sibmFtZSI6Ii5tYW5pZmVzdCIsImhhc2giOiI1MDdhMmMzOGExNDQxZGI1OGQyY2I4Nzk4MmM0MmFhOTFhNDM0MmVmNDIyYTZiNTQyZWRkZWJlZWY2ZjA0MTJmIiwiYWxnb3JpdGhtIjoiU0hBLTI1NiJ9LHsibmFtZSI6ImEvYi9jL2RhdGEuanNvbiIsImhhc2giOiI0MmNmZTY3NjhiNTdiYjVmNzUwM2MxNjVjMjhkZDA3YWM1YjgxMzU1NGViYzg1MGYyY2MzNTg0M2U3MTM3YjFkIiwiYWxnb3JpdGhtIjoiU0hBLTI1NiJ9LHsibmFtZSI6Imh0dHAvcG9saWN5L3BvbGljeS5yZWdvIiwiaGFzaCI6ImE2MTVlZWFlZTIxZGU1MTc5ZGUwODBkZThjMzA1MmM4ZGE5MDExMzg0MDZiYTcxYzM4YzAzMjg0NWY3ZDU0ZjQiLCJhbGdvcml0aG0iOiJTSEEtMjU2In1dLCJpYXQiOjE1OTIyNDgwMjcsImlzcyI6IkpXVFNlcnZpY2UiLCJzY29wZSI6IndyaXRlIn0.Vmm9UDiInUnXXlk-OOjiCy3rR7EVvXS-OFst1rbh3Zo`
 
@@ -635,6 +795,14 @@ func TestReadRootValidation(t *testing.T) {
 			},
 			err: "manifest roots [a b c/d] do not permit data at path '/c/e'",
 		},
+		{
+			note: "err data patch outside scope",
+			files: [][2]string{
+				{"/.manifest", `{"revision": "abcd", "roots": ["a", "b", "c/d"]}`},
+				{"/patch.json", `{"data": [{"op": "add", "path": "/a/b/d", "value": "foo"}, {"op": "remove", "path": "/c/e"}]}`},
+			},
+			err: "manifest roots [a b c/d] do not permit data patch at path 'c/e'",
+		},
 	}
 
 	for _, tc := range cases {
@@ -851,7 +1019,9 @@ func TestRoundtrip(t *testing.T) {
 			},
 		},
 		Manifest: Manifest{
+			Roots:    &[]string{""},
 			Revision: "quickbrownfaux",
+			Metadata: map[string]interface{}{"version": "v1", "hello": "world"},
 		},
 	}
 
@@ -881,6 +1051,77 @@ func TestRoundtrip(t *testing.T) {
 	}
 }
 
+func TestRoundtripWithPlanModules(t *testing.T) {
+
+	b := Bundle{
+		Data: map[string]interface{}{},
+		PlanModules: []PlanModuleFile{
+			{
+				URL:  "/plan.json",
+				Path: "/plan.json",
+				Raw:  []byte(`{"foo": 7}`), // NOTE(tsandall): contents are ignored
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	if err := Write(&buf, b); err != nil {
+		t.Fatal(err)
+	}
+
+	b2, err := NewReader(&buf).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(b2.PlanModules) != 1 ||
+		b2.PlanModules[0].Path != b.PlanModules[0].Path ||
+		b2.PlanModules[0].URL != b.PlanModules[0].URL ||
+		!bytes.Equal(b2.PlanModules[0].Raw, b.PlanModules[0].Raw) {
+		t.Fatalf("expected %+v but got %+v", b, b2)
+	}
+}
+
+func TestRoundtripDeltaBundle(t *testing.T) {
+
+	// replace a value
+	p1 := PatchOperation{
+		Op:    "replace",
+		Path:  "a/baz",
+		Value: "bux",
+	}
+
+	// add a new object member
+	p2 := PatchOperation{
+		Op:    "add",
+		Path:  "/a/foo",
+		Value: []string{"hello", "world"},
+	}
+
+	bundle := Bundle{
+		Patch: Patch{Data: []PatchOperation{p1, p2}},
+		Manifest: Manifest{
+			Revision: "delta",
+			Roots:    &[]string{"a"},
+		},
+	}
+
+	var buf bytes.Buffer
+
+	if err := NewWriter(&buf).Write(bundle); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+
+	bundle2, err := NewReader(&buf).Read()
+	if err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+
+	if !bundle2.Equal(bundle) {
+		t.Fatal("Exp:", bundle, "\n\nGot:", bundle2)
+	}
+}
+
 func TestWriterUsePath(t *testing.T) {
 
 	bundle := Bundle{
@@ -1141,18 +1382,29 @@ func TestHashBundleFiles(t *testing.T) {
 		data     map[string]interface{}
 		manifest Manifest
 		wasm     []byte
+		plan     []byte
 		exp      int
 	}{
-		"no_content":                 {map[string]interface{}{}, Manifest{}, []byte{}, 2},
-		"data":                       {map[string]interface{}{"foo": "bar"}, Manifest{}, []byte{}, 2},
-		"data_and_manifest":          {map[string]interface{}{"foo": "bar"}, Manifest{Revision: "quickbrownfaux"}, []byte{}, 2},
-		"data_and_manifest_and_wasm": {map[string]interface{}{"foo": "bar"}, Manifest{Revision: "quickbrownfaux"}, []byte("modules-compiled-as-wasm-binary"), 3},
+		"no_content":                 {map[string]interface{}{}, Manifest{}, nil, nil, 1},
+		"data":                       {map[string]interface{}{"foo": "bar"}, Manifest{}, nil, nil, 1},
+		"data_and_manifest":          {map[string]interface{}{"foo": "bar"}, Manifest{Revision: "quickbrownfaux"}, []byte{}, nil, 2},
+		"data_and_manifest_and_wasm": {map[string]interface{}{"foo": "bar"}, Manifest{Revision: "quickbrownfaux"}, []byte("modules-compiled-as-wasm-binary"), nil, 3},
+		"data_and_plan":              {map[string]interface{}{"foo": "bar"}, Manifest{Revision: "quickbrownfaux"}, nil, []byte("not a plan but good enough"), 3},
 	}
 
 	for name, tc := range tests {
 		t.Run(name, func(t *testing.T) {
 
-			f, err := hashBundleFiles(h, &Bundle{Data: tc.data, Manifest: tc.manifest, Wasm: tc.wasm})
+			var plans []PlanModuleFile
+			if len(tc.plan) > 0 {
+				plans = append(plans, PlanModuleFile{
+					URL:  "/plan.json",
+					Path: "/plan.json",
+					Raw:  tc.plan,
+				})
+			}
+
+			f, err := hashBundleFiles(h, &Bundle{Data: tc.data, Manifest: tc.manifest, Wasm: tc.wasm, PlanModules: plans})
 			if err != nil {
 				t.Fatal("Unexpected error:", err)
 			}
@@ -1375,6 +1627,7 @@ func TestMerge(t *testing.T) {
 						"bar",
 					},
 				},
+				Data: map[string]interface{}{},
 			},
 		},
 		{
@@ -1432,6 +1685,7 @@ func TestMerge(t *testing.T) {
 						Raw:         []byte("not really wasm, but good enough"),
 					},
 				},
+				Data: map[string]interface{}{},
 			},
 		},
 		{
@@ -1485,6 +1739,7 @@ func TestMerge(t *testing.T) {
 						Raw:    []byte("package baz"),
 					},
 				},
+				Data: map[string]interface{}{},
 			},
 		},
 		{
@@ -1528,6 +1783,83 @@ func TestMerge(t *testing.T) {
 				},
 			},
 		},
+		{
+			note: "merge empty data",
+			bundles: []*Bundle{
+				{
+					Manifest: Manifest{
+						Roots: &[]string{
+							"foo/bar",
+						},
+					},
+					Data: map[string]interface{}{},
+				},
+				{
+					Manifest: Manifest{
+						Roots: &[]string{
+							"baz",
+						},
+					},
+					Data: map[string]interface{}{},
+				},
+			},
+			wantBundle: &Bundle{
+				Manifest: Manifest{
+					Roots: &[]string{
+						"foo/bar",
+						"baz",
+					},
+				},
+				Data: map[string]interface{}{},
+			},
+		},
+		{
+			note: "merge plans",
+			bundles: []*Bundle{
+				{
+					Manifest: Manifest{
+						Roots: &[]string{"a"},
+					},
+					PlanModules: []PlanModuleFile{
+						{
+							URL:  "a/plan.json",
+							Path: "a/plan.json",
+							Raw:  []byte("not a real plan but good enough"),
+						},
+					},
+				},
+				{
+					Manifest: Manifest{
+						Roots: &[]string{"b"},
+					},
+					PlanModules: []PlanModuleFile{
+						{
+							URL:  "b/plan.json",
+							Path: "b/plan.json",
+							Raw:  []byte("not a real plan but good enough"),
+						},
+					},
+				},
+			},
+			wantBundle: &Bundle{
+				Data: map[string]interface{}{},
+				Manifest: Manifest{
+					Roots: &[]string{"a", "b"},
+				},
+				PlanModules: []PlanModuleFile{
+					{
+						URL:  "a/plan.json",
+						Path: "a/plan.json",
+						Raw:  []byte("not a real plan but good enough"),
+					},
+					{
+						URL:  "b/plan.json",
+						Path: "b/plan.json",
+						Raw:  []byte("not a real plan but good enough"),
+					},
+				},
+			},
+		},
 		{
 			note: "conflicting roots",
 			bundles: []*Bundle{
diff --git a/bundle/file.go b/bundle/file.go
index 040c0af3f8..4892b68631 100644
--- a/bundle/file.go
+++ b/bundle/file.go
@@ -4,14 +4,17 @@ import (
 	"archive/tar"
 	"bytes"
 	"compress/gzip"
+	"fmt"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync"
 
-	"github.com/pkg/errors"
+	"github.com/open-policy-agent/opa/loader/filter"
+
+	"github.com/open-policy-agent/opa/storage"
 )
 
 // Descriptor contains information about a file and
@@ -43,7 +46,7 @@ func (f *lazyFile) Read(b []byte) (int, error) {
 
 	if f.file == nil {
 		if f.file, err = os.Open(f.path); err != nil {
-			return 0, errors.Wrapf(err, "failed to open file %s", f.path)
+			return 0, fmt.Errorf("failed to open file %s: %w", f.path, err)
 		}
 	}
 
@@ -104,28 +107,37 @@ func (d *Descriptor) Close() error {
 	return err
 }
 
+type PathFormat int64
+
+const (
+	Chrooted PathFormat = iota
+	SlashRooted
+	Passthrough
+)
+
 // DirectoryLoader defines an interface which can be used to load
 // files from a directory by iterating over each one in the tree.
 type DirectoryLoader interface {
 	// NextFile must return io.EOF if there is no next value. The returned
 	// descriptor should *always* be closed when no longer needed.
 	NextFile() (*Descriptor, error)
+	WithFilter(filter filter.LoaderFilter) DirectoryLoader
+	WithPathFormat(PathFormat) DirectoryLoader
 }
 
 type dirLoader struct {
-	root  string
-	files []string
-	idx   int
+	root       string
+	files      []string
+	idx        int
+	filter     filter.LoaderFilter
+	pathFormat PathFormat
 }
 
-// NewDirectoryLoader returns a basic DirectoryLoader implementation
-// that will load files from a given root directory path.
-func NewDirectoryLoader(root string) DirectoryLoader {
-
+// Normalize root directory, ex "./src/bundle" -> "src/bundle"
+// We don't need an absolute path, but this makes the joined/trimmed
+// paths more uniform.
+func normalizeRootDirectory(root string) string {
 	if len(root) > 1 {
-		// Normalize relative directories, ex "./src/bundle" -> "src/bundle"
-		// We don't need an absolute path, but this makes the joined/trimmed
-		// paths more uniform.
 		if root[0] == '.' && root[1] == filepath.Separator {
 			if len(root) == 2 {
 				root = root[:1] // "./" -> "."
@@ -134,13 +146,55 @@ func NewDirectoryLoader(root string) DirectoryLoader {
 			}
 		}
 	}
+	return root
+}
 
+// NewDirectoryLoader returns a basic DirectoryLoader implementation
+// that will load files from a given root directory path.
+func NewDirectoryLoader(root string) DirectoryLoader {
 	d := dirLoader{
-		root: root,
+		root:       normalizeRootDirectory(root),
+		pathFormat: Chrooted,
 	}
 	return &d
 }
 
+// WithFilter specifies the filter object to use to filter files while loading bundles
+func (d *dirLoader) WithFilter(filter filter.LoaderFilter) DirectoryLoader {
+	d.filter = filter
+	return d
+}
+
+// WithPathFormat specifies how a path is formatted in a Descriptor
+func (d *dirLoader) WithPathFormat(pathFormat PathFormat) DirectoryLoader {
+	d.pathFormat = pathFormat
+	return d
+}
+
+func formatPath(fileName string, root string, pathFormat PathFormat) string {
+	switch pathFormat {
+	case SlashRooted:
+		if !strings.HasPrefix(fileName, string(filepath.Separator)) {
+			return string(filepath.Separator) + fileName
+		}
+		return fileName
+	case Chrooted:
+		// Trim off the root directory and return path as if chrooted
+		result := strings.TrimPrefix(fileName, filepath.FromSlash(root))
+		if root == "." && filepath.Base(fileName) == ManifestExt {
+			result = fileName
+		}
+		if !strings.HasPrefix(result, string(filepath.Separator)) {
+			result = string(filepath.Separator) + result
+		}
+		return result
+	case Passthrough:
+		fallthrough
+	default:
+		return fileName
+	}
+}
+
 // NextFile iterates to the next file in the directory tree
 // and returns a file Descriptor for the file.
 func (d *dirLoader) NextFile() (*Descriptor, error) {
@@ -149,12 +203,19 @@ func (d *dirLoader) NextFile() (*Descriptor, error) {
 		d.files = []string{}
 		err := filepath.Walk(d.root, func(path string, info os.FileInfo, err error) error {
 			if info != nil && info.Mode().IsRegular() {
-				d.files = append(d.files, filepath.ToSlash(path))
+				if d.filter != nil && d.filter(filepath.ToSlash(path), info, getdepth(path, false)) {
+					return nil
+				}
+				d.files = append(d.files, path)
+			} else if info != nil && info.Mode().IsDir() {
+				if d.filter != nil && d.filter(filepath.ToSlash(path), info, getdepth(path, true)) {
+					return filepath.SkipDir
+				}
 			}
 			return nil
 		})
 		if err != nil {
-			return nil, errors.Wrap(err, "failed to list files")
+			return nil, fmt.Errorf("failed to list files: %w", err)
 		}
 	}
 
@@ -168,37 +229,34 @@ func (d *dirLoader) NextFile() (*Descriptor, error) {
 	d.idx++
 	fh := newLazyFile(fileName)
 
-	// Trim off the root directory and return path as if chrooted
-	cleanedPath := strings.TrimPrefix(fileName, d.root)
-	if d.root == "." && filepath.Base(fileName) == ManifestExt {
-		cleanedPath = fileName
-	}
-
-	if !strings.HasPrefix(cleanedPath, "/") {
-		cleanedPath = "/" + cleanedPath
-	}
-
-	f := newDescriptor(path.Join(d.root, cleanedPath), cleanedPath, fh).withCloser(fh)
+	cleanedPath := formatPath(fileName, d.root, d.pathFormat)
+	f := newDescriptor(filepath.Join(d.root, cleanedPath), cleanedPath, fh).withCloser(fh)
 	return f, nil
 }
 
 type tarballLoader struct {
-	baseURL string
-	r       io.Reader
-	tr      *tar.Reader
-	files   []file
-	idx     int
+	baseURL    string
+	r          io.Reader
+	tr         *tar.Reader
+	files      []file
+	idx        int
+	filter     filter.LoaderFilter
+	skipDir    map[string]struct{}
+	pathFormat PathFormat
 }
 
 type file struct {
 	name   string
 	reader io.Reader
+	path   storage.Path
+	raw    []byte
 }
 
 // NewTarballLoader is deprecated. Use NewTarballLoaderWithBaseURL instead.
 func NewTarballLoader(r io.Reader) DirectoryLoader {
 	l := tarballLoader{
-		r: r,
+		r:          r,
+		pathFormat: Passthrough,
 	}
 	return &l
 }
@@ -208,19 +266,32 @@ func NewTarballLoader(r io.Reader) DirectoryLoader {
 // with the baseURL.
 func NewTarballLoaderWithBaseURL(r io.Reader, baseURL string) DirectoryLoader {
 	l := tarballLoader{
-		baseURL: strings.TrimSuffix(baseURL, "/"),
-		r:       r,
+		baseURL:    strings.TrimSuffix(baseURL, "/"),
+		r:          r,
+		pathFormat: Passthrough,
 	}
 	return &l
 }
 
+// WithFilter specifies the filter object to use to filter files while loading bundles
+func (t *tarballLoader) WithFilter(filter filter.LoaderFilter) DirectoryLoader {
+	t.filter = filter
+	return t
+}
+
+// WithPathFormat specifies how a path is formatted in a Descriptor
+func (t *tarballLoader) WithPathFormat(pathFormat PathFormat) DirectoryLoader {
+	t.pathFormat = pathFormat
+	return t
+}
+
 // NextFile iterates to the next file in the directory tree
 // and returns a file Descriptor for the file.
 func (t *tarballLoader) NextFile() (*Descriptor, error) {
 	if t.tr == nil {
 		gr, err := gzip.NewReader(t.r)
 		if err != nil {
-			return nil, errors.Wrap(err, "archive read failed")
+			return nil, fmt.Errorf("archive read failed: %w", err)
 		}
 
 		t.tr = tar.NewReader(gr)
@@ -229,6 +300,10 @@ func (t *tarballLoader) NextFile() (*Descriptor, error) {
 	if t.files == nil {
 		t.files = []file{}
 
+		if t.skipDir == nil {
+			t.skipDir = map[string]struct{}{}
+		}
+
 		for {
 			header, err := t.tr.Next()
 			if err == io.EOF {
@@ -241,16 +316,48 @@ func (t *tarballLoader) NextFile() (*Descriptor, error) {
 
 			// Keep iterating on the archive until we find a normal file
 			if header.Typeflag == tar.TypeReg {
+
+				if t.filter != nil {
+
+					if t.filter(filepath.ToSlash(header.Name), header.FileInfo(), getdepth(header.Name, false)) {
+						continue
+					}
+
+					basePath := strings.Trim(filepath.Dir(filepath.ToSlash(header.Name)), "/")
+
+					// check if the directory is to be skipped
+					if _, ok := t.skipDir[basePath]; ok {
+						continue
+					}
+
+					match := false
+					for p := range t.skipDir {
+						if strings.HasPrefix(basePath, p) {
+							match = true
+							break
+						}
+					}
+
+					if match {
+						continue
+					}
+				}
+
 				f := file{name: header.Name}
 
 				var buf bytes.Buffer
 				if _, err := io.Copy(&buf, t.tr); err != nil {
-					return nil, errors.Wrapf(err, "failed to copy file %s", header.Name)
+					return nil, fmt.Errorf("failed to copy file %s: %w", header.Name, err)
 				}
 
 				f.reader = &buf
 
 				t.files = append(t.files, f)
+			} else if header.Typeflag == tar.TypeDir {
+				cleanedPath := filepath.ToSlash(header.Name)
+				if t.filter != nil && t.filter(cleanedPath, header.FileInfo(), getdepth(header.Name, true)) {
+					t.skipDir[strings.Trim(cleanedPath, "/")] = struct{}{}
+				}
 			}
 		}
 	}
@@ -264,5 +371,88 @@ func (t *tarballLoader) NextFile() (*Descriptor, error) {
 	f := t.files[t.idx]
 	t.idx++
 
-	return newDescriptor(path.Join(t.baseURL, f.name), f.name, f.reader), nil
+	cleanedPath := formatPath(f.name, "", t.pathFormat)
+	d := newDescriptor(filepath.Join(t.baseURL, cleanedPath), cleanedPath, f.reader)
+	return d, nil
+
+}
+
+// Next implements the storage.Iterator interface.
+// It iterates to the next policy or data file in the directory tree
+// and returns a storage.Update for the file.
+func (it *iterator) Next() (*storage.Update, error) {
+
+	if it.files == nil {
+		it.files = []file{}
+
+		for _, item := range it.raw {
+			f := file{name: item.Path}
+
+			fpath := strings.TrimLeft(normalizePath(filepath.Dir(f.name)), "/.")
+			if strings.HasSuffix(f.name, RegoExt) {
+				fpath = strings.Trim(normalizePath(f.name), "/")
+			}
+
+			p, ok := storage.ParsePathEscaped("/" + fpath)
+			if !ok {
+				return nil, fmt.Errorf("storage path invalid: %v", f.name)
+			}
+			f.path = p
+
+			f.raw = item.Value
+
+			it.files = append(it.files, f)
+		}
+
+		sortFilePathAscend(it.files)
+	}
+
+	// If done reading files then just return io.EOF
+	// errors for each NextFile() call
+	if it.idx >= len(it.files) {
+		return nil, io.EOF
+	}
+
+	f := it.files[it.idx]
+	it.idx++
+
+	isPolicy := false
+	if strings.HasSuffix(f.name, RegoExt) {
+		isPolicy = true
+	}
+
+	return &storage.Update{
+		Path:     f.path,
+		Value:    f.raw,
+		IsPolicy: isPolicy,
+	}, nil
+}
+
+type iterator struct {
+	raw   []Raw
+	files []file
+	idx   int
+}
+
+func NewIterator(raw []Raw) storage.Iterator {
+	it := iterator{
+		raw: raw,
+	}
+	return &it
+}
+
+func sortFilePathAscend(files []file) {
+	sort.Slice(files, func(i, j int) bool {
+		return len(files[i].path) < len(files[j].path)
+	})
+}
+
+func getdepth(path string, isDir bool) int {
+	if isDir {
+		cleanedPath := strings.Trim(filepath.ToSlash(path), "/")
+		return len(strings.Split(cleanedPath, "/"))
+	}
+
+	basePath := strings.Trim(filepath.Dir(filepath.ToSlash(path)), "/")
+	return len(strings.Split(basePath, "/"))
 }
diff --git a/bundle/file_test.go b/bundle/file_test.go
index e170faae4e..809610f3d9 100644
--- a/bundle/file_test.go
+++ b/bundle/file_test.go
@@ -5,11 +5,13 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 
 	"github.com/open-policy-agent/opa/internal/file/archive"
 
+	"github.com/open-policy-agent/opa/loader/filter"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -19,8 +21,11 @@ var archiveFiles = map[string]string{
 	"/a.json":                          "a",
 	"/a/b.json":                        "b",
 	"/a/b/c.json":                      "c",
+	"/a/b/d/data.json":                 "hello",
+	"/a/c/data.yaml":                   "12",
 	"/some.txt":                        "text",
 	"/policy.rego":                     "package foo\n p = 1",
+	"/roles/policy.rego":               "package bar\n p = 1",
 	"/deeper/dir/path/than/others/foo": "bar",
 }
 
@@ -31,14 +36,142 @@ func TestTarballLoader(t *testing.T) {
 	}
 
 	test.WithTempFS(files, func(rootDir string) {
+		tarballFile := filepath.Join(rootDir, "archive.tar.gz")
+		f := testGetTarballFile(t, rootDir)
+
+		loader := NewTarballLoaderWithBaseURL(f, tarballFile)
+
+		defer f.Close()
+
+		testLoader(t, loader, tarballFile, archiveFiles)
+	})
+}
+
+func TestIterator(t *testing.T) {
+
+	files := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	bundle, err := NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := NewIterator(bundle.Raw)
+	fileCount := 0
+	for {
+		_, err := iterator.Next()
+		if err != nil && err != io.EOF {
+			t.Fatalf("Unexpected error: %s", err)
+		} else if err == io.EOF {
+			break
+		}
+		fileCount++
+	}
+
+	expCount := 4
+	if fileCount != expCount {
+		t.Fatalf("Expected to read %d files, read %d", expCount, fileCount)
+	}
+}
+
+func TestIteratorOrder(t *testing.T) {
+
+	var archFiles = map[string]string{
+		"/a/b/c/data.json":     "[1,2,3]",
+		"/a/b/d/e/data.json":   `e: true`,
+		"/data.json":           `{"x": {"y": true}, "a": {"b": {"z": true}}}}`,
+		"/a/b/y/x/z/data.yaml": `foo: 1`,
+		"/a/b/data.json":       "[4,5,6]",
+		"/a/data.json":         "hello",
+		"/policy.rego":         "package foo\n p = 1",
+		"/roles/policy.rego":   "package bar\n p = 1",
+	}
+
+	files := make([][2]string, 0, len(archFiles))
+	for name, content := range archFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	bundle, err := NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := NewIterator(bundle.Raw)
+
+	fileCount := 0
+	actualDataFiles := []string{}
+
+	for {
+		i, err := iterator.Next()
+		if err != nil && err != io.EOF {
+			t.Fatalf("Unexpected error: %s", err)
+		} else if err == io.EOF {
+			break
+		}
+		fileCount++
+
+		if !strings.HasSuffix(i.Path.String(), RegoExt) {
+			actualDataFiles = append(actualDataFiles, i.Path.String())
+		}
+	}
+
+	expCount := 8
+	if fileCount != expCount {
+		t.Fatalf("Expected to read %d files, read %d", expCount, fileCount)
+	}
+
+	expDataFiles := []string{"/", "/a", "/a/b", "/a/b/c", "/a/b/d/e", "/a/b/y/x/z"}
+
+	if !reflect.DeepEqual(expDataFiles, actualDataFiles) {
+		t.Fatalf("Expected data files %v but got %v", expDataFiles, actualDataFiles)
+	}
+}
+
+func TestDirectoryLoader(t *testing.T) {
+	test.WithTempFS(archiveFiles, func(rootDir string) {
+		loader := NewDirectoryLoader(rootDir)
+
+		testLoader(t, loader, rootDir, archiveFiles)
+	})
+}
+
+func TestTarballLoaderWithFilter(t *testing.T) {
+
+	files := map[string]string{
+		"/a/data.json":            `{"foo": "not-bar"}`,
+		"/policy.rego":            "package foo\n p = 1",
+		"/policy_test.rego":       "package foo\n test_p { p }",
+		"/a/b/c/policy.rego":      "package bar\n q = 1",
+		"/a/b/c/policy_test.rego": "package bar\n test_q { q }",
+		"/a/.manifest":            `{"roots": ["a", "foo"]}`,
+	}
+
+	expectedFiles := map[string]string{
+		"/a/data.json":       `{"foo": "not-bar"}`,
+		"/policy.rego":       "package foo\n p = 1",
+		"/a/b/c/policy.rego": "package bar\n q = 1",
+		"/a/.manifest":       `{"roots": ["a", "foo"]}`,
+	}
+
+	gzFileIn := map[string]string{
+		"/archive.tar.gz": "",
+	}
+
+	test.WithTempFS(gzFileIn, func(rootDir string) {
 		tarballFile := filepath.Join(rootDir, "archive.tar.gz")
 		f, err := os.Create(tarballFile)
 		if err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
-		var gzFiles [][2]string
-		for name, content := range archiveFiles {
+		gzFiles := make([][2]string, 0, len(files))
+		for name, content := range files {
 			gzFiles = append(gzFiles, [2]string{name, content})
 		}
 
@@ -53,21 +186,226 @@ func TestTarballLoader(t *testing.T) {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
-		loader := NewTarballLoaderWithBaseURL(f, tarballFile)
+		loader := NewTarballLoaderWithBaseURL(f, tarballFile).WithFilter(func(abspath string, info os.FileInfo, depth int) bool {
+			return getFilter("*_test.rego", 1)(abspath, info, depth)
+		})
+
 		defer f.Close()
 
-		testLoader(t, loader, tarballFile, archiveFiles)
+		testLoader(t, loader, tarballFile, expectedFiles)
+	})
+}
+
+func TestTarballLoaderWithFilterDir(t *testing.T) {
+
+	files := map[string]string{
+		"/a/data.json":            `{"foo": "not-bar"}`,
+		"/policy.rego":            "package foo\n p = 1",
+		"/policy_test.rego":       "package foo\n test_p { p }",
+		"/a/b/c/policy.rego":      "package bar\n q = 1",
+		"/a/b/c/policy_test.rego": "package bar\n test_q { q }",
+		"/a/.manifest":            `{"roots": ["a", "foo"]}`,
+	}
+
+	expectedFiles := map[string]string{
+		"/policy.rego": "package foo\n p = 1",
+	}
+
+	gzFileIn := map[string]string{
+		"/archive.tar.gz": "",
+	}
+
+	test.WithTempFS(gzFileIn, func(rootDir string) {
+		tarballFile := filepath.Join(rootDir, "archive.tar.gz")
+		f, err := os.Create(tarballFile)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		gzFiles := make([][2]string, 0, len(files))
+		for name, content := range files {
+			gzFiles = append(gzFiles, [2]string{name, content})
+		}
+
+		_, err = f.Write(archive.MustWriteTarGz(gzFiles).Bytes())
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+		f.Close()
+
+		f, err = os.Open(tarballFile)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		loader := NewTarballLoaderWithBaseURL(f, tarballFile).WithFilter(func(abspath string, info os.FileInfo, depth int) bool {
+			return getFilter("*_test.rego", 1)(abspath, info, depth)
+		})
+
+		defer f.Close()
+
+		tl, ok := loader.(*tarballLoader)
+		if !ok {
+			t.Fatal("Expected tar loader instance")
+		}
 
+		tl.skipDir = map[string]struct{}{"a": {}}
+
+		fileCount := 0
+		for {
+			f, err := tl.NextFile()
+			if err != nil && err != io.EOF {
+				t.Fatalf("Unexpected error: %s", err)
+			} else if err == io.EOF {
+				break
+			}
+
+			expPath := strings.TrimPrefix(f.URL(), tarballFile)
+			if f.Path() != expPath {
+				t.Fatalf("Expected path to be %v but got %v", expPath, f.Path())
+			}
+
+			_, found := expectedFiles[f.Path()]
+			if !found {
+				t.Fatalf("Found unexpected file %s", f.Path())
+			}
+
+			fileCount++
+		}
+
+		if fileCount != len(expectedFiles) {
+			t.Fatalf("Expected to read %d files, read %d", len(expectedFiles), fileCount)
+		}
 	})
+}
+
+func TestDirectoryLoaderWithFilter(t *testing.T) {
+	files := map[string]string{
+		"/a/data.json":            `{"foo": "not-bar"}`,
+		"/policy.rego":            "package foo\n p = 1",
+		"/policy_test.rego":       "package foo\n test_p { p }",
+		"/a/b/c/policy.rego":      "package bar\n q = 1",
+		"/a/b/c/policy_test.rego": "package bar\n test_q { q }",
+		"/a/.manifest":            `{"roots": ["a", "foo"]}`,
+	}
+
+	expectedFiles := map[string]struct{}{
+		"/a/data.json":       {},
+		"/policy.rego":       {},
+		"/a/b/c/policy.rego": {},
+		"/a/.manifest":       {},
+	}
+
+	test.WithTempFS(files, func(rootDir string) {
+
+		dl := NewDirectoryLoader(rootDir).WithFilter(func(abspath string, info os.FileInfo, depth int) bool {
+			return getFilter("*_test.rego", 1)(abspath, info, depth)
+		})
+
+		fileCount := 0
+		for {
+			f, err := dl.NextFile()
+			if err != nil && err != io.EOF {
+				t.Fatalf("Unexpected error: %s", err)
+			} else if err == io.EOF {
+				break
+			}
 
+			expPath := strings.TrimPrefix(f.URL(), rootDir)
+			if f.Path() != expPath {
+				t.Fatalf("Expected path to be %v but got %v", expPath, f.Path())
+			}
+
+			_, found := expectedFiles[f.Path()]
+			if !found {
+				t.Fatalf("Found unexpected file %s", f.Path())
+			}
+
+			fileCount++
+		}
+
+		if fileCount != len(expectedFiles) {
+			t.Fatalf("Expected to read %d files, read %d", len(expectedFiles), fileCount)
+		}
+	})
 }
 
-func TestDirectoryLoader(t *testing.T) {
-	test.WithTempFS(archiveFiles, func(rootDir string) {
-		loader := NewDirectoryLoader(rootDir)
+func TestDirectoryLoaderWithFilterDir(t *testing.T) {
+	files := map[string]string{
+		"/a/data.json":            `{"foo": "not-bar"}`,
+		"/policy.rego":            "package foo\n p = 1",
+		"/policy_test.rego":       "package foo\n test_p { p }",
+		"/a/b/c/policy.rego":      "package bar\n q = 1",
+		"/a/b/c/policy_test.rego": "package bar\n test_q { q }",
+		"/a/.manifest":            `{"roots": ["a", "foo"]}`,
+	}
 
-		testLoader(t, loader, rootDir, archiveFiles)
+	expectedFiles := map[string]struct{}{
+		"/policy.rego":      {},
+		"/policy_test.rego": {},
+	}
+
+	test.WithTempFS(files, func(rootDir string) {
+
+		dl := NewDirectoryLoader(rootDir).WithFilter(func(abspath string, info os.FileInfo, depth int) bool {
+			return getFilter("a", 1)(abspath, info, depth)
+		})
+
+		fileCount := 0
+		for {
+			f, err := dl.NextFile()
+			if err != nil && err != io.EOF {
+				t.Fatalf("Unexpected error: %s", err)
+			} else if err == io.EOF {
+				break
+			}
+
+			expPath := strings.TrimPrefix(f.URL(), rootDir)
+			if f.Path() != expPath {
+				t.Fatalf("Expected path to be %v but got %v", expPath, f.Path())
+			}
+
+			_, found := expectedFiles[f.Path()]
+			if !found {
+				t.Fatalf("Found unexpected file %s", f.Path())
+			}
+
+			fileCount++
+		}
+
+		if fileCount != len(expectedFiles) {
+			t.Fatalf("Expected to read %d files, read %d", len(expectedFiles), fileCount)
+		}
 	})
+
+}
+
+func testGetTarballFile(t *testing.T, root string) *os.File {
+	t.Helper()
+
+	tarballFile := filepath.Join(root, "archive.tar.gz")
+	f, err := os.Create(tarballFile)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	gzFiles := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		gzFiles = append(gzFiles, [2]string{name, content})
+	}
+
+	_, err = f.Write(archive.MustWriteTarGz(gzFiles).Bytes())
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+	f.Close()
+
+	f, err = os.Open(tarballFile)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	return f
 }
 
 func testLoader(t *testing.T, loader DirectoryLoader, baseURL string, expectedFiles map[string]string) {
@@ -176,3 +514,10 @@ func TestNewDirectoryLoaderNormalizedRoot(t *testing.T) {
 		})
 	}
 }
+
+func getFilter(pattern string, minDepth int) filter.LoaderFilter {
+	return func(abspath string, info os.FileInfo, depth int) bool {
+		match, _ := filepath.Match(pattern, info.Name())
+		return match && depth >= minDepth
+	}
+}
diff --git a/bundle/filefs.go b/bundle/filefs.go
index 60c80fc7dc..3aa253ee19 100644
--- a/bundle/filefs.go
+++ b/bundle/filefs.go
@@ -1,3 +1,4 @@
+//go:build go1.16
 // +build go1.16
 
 package bundle
@@ -6,7 +7,10 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"path/filepath"
 	"sync"
+
+	"github.com/open-policy-agent/opa/loader/filter"
 )
 
 const (
@@ -18,21 +22,27 @@ type dirLoaderFS struct {
 	filesystem fs.FS
 	files      []string
 	idx        int
+	filter     filter.LoaderFilter
+	root       string
+	pathFormat PathFormat
 }
 
 // NewFSLoader returns a basic DirectoryLoader implementation
 // that will load files from a fs.FS interface
 func NewFSLoader(filesystem fs.FS) (DirectoryLoader, error) {
+	return NewFSLoaderWithRoot(filesystem, defaultFSLoaderRoot), nil
+}
+
+// NewFSLoaderWithRoot returns a basic DirectoryLoader implementation
+// that will load files from a fs.FS interface at the supplied root
+func NewFSLoaderWithRoot(filesystem fs.FS, root string) DirectoryLoader {
 	d := dirLoaderFS{
 		filesystem: filesystem,
+		root:       normalizeRootDirectory(root),
+		pathFormat: Chrooted,
 	}
 
-	err := fs.WalkDir(d.filesystem, defaultFSLoaderRoot, d.walkDir)
-	if err != nil {
-		return nil, fmt.Errorf("failed to list files: %w", err)
-	}
-
-	return &d, nil
+	return &d
 }
 
 func (d *dirLoaderFS) walkDir(path string, dirEntry fs.DirEntry, err error) error {
@@ -40,19 +50,52 @@ func (d *dirLoaderFS) walkDir(path string, dirEntry fs.DirEntry, err error) erro
 		return err
 	}
 
-	if dirEntry != nil && dirEntry.Type().IsRegular() {
-		d.files = append(d.files, path)
-	}
+	if dirEntry != nil {
+		info, err := dirEntry.Info()
+		if err != nil {
+			return err
+		}
+
+		if dirEntry.Type().IsRegular() {
+			if d.filter != nil && d.filter(filepath.ToSlash(path), info, getdepth(path, false)) {
+				return nil
+			}
 
+			d.files = append(d.files, path)
+		} else if dirEntry.Type().IsDir() {
+			if d.filter != nil && d.filter(filepath.ToSlash(path), info, getdepth(path, true)) {
+				return fs.SkipDir
+			}
+		}
+	}
 	return nil
 }
 
+// WithFilter specifies the filter object to use to filter files while loading bundles
+func (d *dirLoaderFS) WithFilter(filter filter.LoaderFilter) DirectoryLoader {
+	d.filter = filter
+	return d
+}
+
+// WithPathFormat specifies how a path is formatted in a Descriptor
+func (d *dirLoaderFS) WithPathFormat(pathFormat PathFormat) DirectoryLoader {
+	d.pathFormat = pathFormat
+	return d
+}
+
 // NextFile iterates to the next file in the directory tree
 // and returns a file Descriptor for the file.
 func (d *dirLoaderFS) NextFile() (*Descriptor, error) {
 	d.Lock()
 	defer d.Unlock()
 
+	if d.files == nil {
+		err := fs.WalkDir(d.filesystem, d.root, d.walkDir)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list files: %w", err)
+		}
+	}
+
 	// If done reading files then just return io.EOF
 	// errors for each NextFile() call
 	if d.idx >= len(d.files) {
@@ -67,7 +110,7 @@ func (d *dirLoaderFS) NextFile() (*Descriptor, error) {
 		return nil, fmt.Errorf("failed to open file %s: %w", fileName, err)
 	}
 
-	fileNameWithSlash := fmt.Sprintf("/%s", fileName)
-	f := newDescriptor(fileNameWithSlash, fileNameWithSlash, fh).withCloser(fh)
+	cleanedPath := formatPath(fileName, d.root, d.pathFormat)
+	f := newDescriptor(cleanedPath, cleanedPath, fh).withCloser(fh)
 	return f, nil
 }
diff --git a/bundle/filefs_test.go b/bundle/filefs_test.go
index e8118fc614..1530b5e476 100644
--- a/bundle/filefs_test.go
+++ b/bundle/filefs_test.go
@@ -1,8 +1,10 @@
+//go:build go1.16
 // +build go1.16
 
 package bundle
 
 import (
+	"os"
 	"strings"
 	"testing"
 	"testing/fstest"
@@ -24,3 +26,39 @@ func TestFSLoader(t *testing.T) {
 
 	testLoader(t, loader, "", archiveFiles)
 }
+
+func TestFSLoaderWithFilter(t *testing.T) {
+	files := map[string]string{
+		"/a/data.json":            `{"foo": "not-bar"}`,
+		"/policy.rego":            "package foo\n p = 1",
+		"/policy_test.rego":       "package foo\n test_p { p }",
+		"/a/b/c/policy.rego":      "package bar\n q = 1",
+		"/a/b/c/policy_test.rego": "package bar\n test_q { q }",
+	}
+
+	expectedFiles := map[string]string{
+		"/a/data.json":       `{"foo": "not-bar"}`,
+		"/policy.rego":       "package foo\n p = 1",
+		"/a/b/c/policy.rego": "package bar\n q = 1",
+	}
+
+	archiveFS := make(fstest.MapFS)
+
+	for k, v := range files {
+		file := strings.TrimPrefix(k, "/")
+		archiveFS[file] = &fstest.MapFile{
+			Data: []byte(v),
+		}
+	}
+
+	loader, err := NewFSLoader(archiveFS)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	loader.WithFilter(func(abspath string, info os.FileInfo, depth int) bool {
+		return getFilter("*_test.rego", 1)(abspath, info, depth)
+	})
+
+	testLoader(t, loader, "", expectedFiles)
+}
diff --git a/bundle/keys.go b/bundle/keys.go
index 1f45ba80a2..810bee4b72 100644
--- a/bundle/keys.go
+++ b/bundle/keys.go
@@ -8,7 +8,6 @@ package bundle
 import (
 	"encoding/pem"
 	"fmt"
-	"io/ioutil"
 	"os"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
@@ -115,7 +114,7 @@ func (s *SigningConfig) GetPrivateKey() (interface{}, error) {
 
 	var priv string
 	if _, err := os.Stat(s.Key); err == nil {
-		bs, err := ioutil.ReadFile(s.Key)
+		bs, err := os.ReadFile(s.Key)
 		if err != nil {
 			return nil, err
 		}
@@ -133,7 +132,7 @@ func (s *SigningConfig) GetPrivateKey() (interface{}, error) {
 func (s *SigningConfig) GetClaims() (map[string]interface{}, error) {
 	var claims map[string]interface{}
 
-	bs, err := ioutil.ReadFile(s.ClaimsPath)
+	bs, err := os.ReadFile(s.ClaimsPath)
 	if err != nil {
 		return claims, err
 	}
diff --git a/bundle/sign_test.go b/bundle/sign_test.go
index 2f181e97d2..40aa9bb9c3 100644
--- a/bundle/sign_test.go
+++ b/bundle/sign_test.go
@@ -6,7 +6,7 @@ package bundle
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -106,7 +106,7 @@ func TestGenerateSignedTokenWithClaims(t *testing.T) {
 
 		// create claims file
 		claimsFile := filepath.Join(rootDir, "claims.json")
-		if err := ioutil.WriteFile(claimsFile, claimBytes, 0644); err != nil {
+		if err := os.WriteFile(claimsFile, claimBytes, 0644); err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
diff --git a/bundle/store.go b/bundle/store.go
index 0dc7796457..3a5c97ea79 100644
--- a/bundle/store.go
+++ b/bundle/store.go
@@ -9,8 +9,11 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"path/filepath"
+	"strings"
 
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/json/patch"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/util"
@@ -26,6 +29,11 @@ func ManifestStoragePath(name string) storage.Path {
 	return append(BundlesBasePath, name, "manifest")
 }
 
+// EtagStoragePath is the storage path used for the given named bundle etag.
+func EtagStoragePath(name string) storage.Path {
+	return append(BundlesBasePath, name, "etag")
+}
+
 func namedBundlePath(name string) storage.Path {
 	return append(BundlesBasePath, name)
 }
@@ -77,6 +85,11 @@ func WriteManifestToStore(ctx context.Context, store storage.Store, txn storage.
 	return write(ctx, store, txn, ManifestStoragePath(name), manifest)
 }
 
+// WriteEtagToStore will write the bundle etag into the storage. This function is called when the bundle is activated.
+func WriteEtagToStore(ctx context.Context, store storage.Store, txn storage.Transaction, name, etag string) error {
+	return write(ctx, store, txn, EtagStoragePath(name), etag)
+}
+
 func write(ctx context.Context, store storage.Store, txn storage.Transaction, path storage.Path, value interface{}) error {
 	if err := util.RoundTrip(&value); err != nil {
 		return err
@@ -99,10 +112,22 @@ func write(ctx context.Context, store storage.Store, txn storage.Transaction, pa
 func EraseManifestFromStore(ctx context.Context, store storage.Store, txn storage.Transaction, name string) error {
 	path := namedBundlePath(name)
 	err := store.Write(ctx, txn, storage.RemoveOp, path, nil)
-	if err != nil && !storage.IsNotFound(err) {
-		return err
+	return suppressNotFound(err)
+}
+
+// eraseBundleEtagFromStore will remove the bundle etag from storage. This function is called
+// when the bundle is deactivated.
+func eraseBundleEtagFromStore(ctx context.Context, store storage.Store, txn storage.Transaction, name string) error {
+	path := EtagStoragePath(name)
+	err := store.Write(ctx, txn, storage.RemoveOp, path, nil)
+	return suppressNotFound(err)
+}
+
+func suppressNotFound(err error) error {
+	if err == nil || storage.IsNotFound(err) {
+		return nil
 	}
-	return nil
+	return err
 }
 
 func writeWasmModulesToStore(ctx context.Context, store storage.Store, txn storage.Transaction, name string, b *Bundle) error {
@@ -121,10 +146,7 @@ func eraseWasmModulesFromStore(ctx context.Context, store storage.Store, txn sto
 	path := wasmModulePath(name)
 
 	err := store.Write(ctx, txn, storage.RemoveOp, path, nil)
-	if err != nil && !storage.IsNotFound(err) {
-		return err
-	}
-	return nil
+	return suppressNotFound(err)
 }
 
 // ReadWasmMetadataFromStore will read Wasm module resolver metadata from the store.
@@ -235,11 +257,7 @@ func ReadBundleMetadataFromStore(ctx context.Context, store storage.Store, txn s
 func readMetadataFromStore(ctx context.Context, store storage.Store, txn storage.Transaction, path storage.Path) (map[string]interface{}, error) {
 	value, err := store.Read(ctx, txn, path)
 	if err != nil {
-		if storageErr, ok := err.(*storage.Error); ok && storageErr.Code == storage.NotFoundErr {
-			return nil, nil
-		}
-
-		return nil, err
+		return nil, suppressNotFound(err)
 	}
 
 	data, ok := value.(map[string]interface{})
@@ -250,6 +268,27 @@ func readMetadataFromStore(ctx context.Context, store storage.Store, txn storage
 	return data, nil
 }
 
+// ReadBundleEtagFromStore returns the etag for the specified bundle.
+// If the bundle is not activated, this function will return
+// storage NotFound error.
+func ReadBundleEtagFromStore(ctx context.Context, store storage.Store, txn storage.Transaction, name string) (string, error) {
+	return readEtagFromStore(ctx, store, txn, EtagStoragePath(name))
+}
+
+func readEtagFromStore(ctx context.Context, store storage.Store, txn storage.Transaction, path storage.Path) (string, error) {
+	value, err := store.Read(ctx, txn, path)
+	if err != nil {
+		return "", err
+	}
+
+	str, ok := value.(string)
+	if !ok {
+		return "", fmt.Errorf("corrupt bundle etag")
+	}
+
+	return str, nil
+}
+
 // ActivateOpts defines options for the Activate API call.
 type ActivateOpts struct {
 	Ctx          context.Context
@@ -283,13 +322,13 @@ type DeactivateOpts struct {
 func Deactivate(opts *DeactivateOpts) error {
 	erase := map[string]struct{}{}
 	for name := range opts.BundleNames {
-		if roots, err := ReadBundleRootsFromStore(opts.Ctx, opts.Store, opts.Txn, name); err == nil {
-			for _, root := range roots {
-				erase[root] = struct{}{}
-			}
-		} else if !storage.IsNotFound(err) {
+		roots, err := ReadBundleRootsFromStore(opts.Ctx, opts.Store, opts.Txn, name)
+		if suppressNotFound(err) != nil {
 			return err
 		}
+		for _, root := range roots {
+			erase[root] = struct{}{}
+		}
 	}
 	_, err := eraseBundles(opts.Ctx, opts.Store, opts.Txn, opts.BundleNames, erase)
 	return err
@@ -300,21 +339,28 @@ func activateBundles(opts *ActivateOpts) error {
 	// Build collections of bundle names, modules, and roots to erase
 	erase := map[string]struct{}{}
 	names := map[string]struct{}{}
+	deltaBundles := map[string]*Bundle{}
+	snapshotBundles := map[string]*Bundle{}
 
 	for name, b := range opts.Bundles {
-		names[name] = struct{}{}
+		if b.Type() == DeltaBundleType {
+			deltaBundles[name] = b
+		} else {
+			snapshotBundles[name] = b
+			names[name] = struct{}{}
 
-		if roots, err := ReadBundleRootsFromStore(opts.Ctx, opts.Store, opts.Txn, name); err == nil {
+			roots, err := ReadBundleRootsFromStore(opts.Ctx, opts.Store, opts.Txn, name)
+			if suppressNotFound(err) != nil {
+				return err
+			}
 			for _, root := range roots {
 				erase[root] = struct{}{}
 			}
-		} else if !storage.IsNotFound(err) {
-			return err
-		}
 
-		// Erase data at new roots to prepare for writing the new data
-		for _, root := range *b.Manifest.Roots {
-			erase[root] = struct{}{}
+			// Erase data at new roots to prepare for writing the new data
+			for _, root := range *b.Manifest.Roots {
+				erase[root] = struct{}{}
+			}
 		}
 	}
 
@@ -325,23 +371,77 @@ func activateBundles(opts *ActivateOpts) error {
 		return err
 	}
 
+	if len(deltaBundles) != 0 {
+		err := activateDeltaBundles(opts, deltaBundles)
+		if err != nil {
+			return err
+		}
+	}
+
 	// Erase data and policies at new + old roots, and remove the old
-	// manifests before activating a new bundles.
+	// manifests before activating a new snapshot bundle.
 	remaining, err := eraseBundles(opts.Ctx, opts.Store, opts.Txn, names, erase)
 	if err != nil {
 		return err
 	}
 
-	for _, b := range opts.Bundles {
-		// Write data from each new bundle into the store. Only write under the
-		// roots contained in their manifest. This should be done *before* the
-		// policies so that path conflict checks can occur.
-		if err := writeData(opts.Ctx, opts.Store, opts.Txn, *b.Manifest.Roots, b.Data); err != nil {
-			return err
+	// Validate data in bundle does not contain paths outside the bundle's roots.
+	for _, b := range snapshotBundles {
+
+		if b.lazyLoadingMode {
+
+			for _, item := range b.Raw {
+				path := filepath.ToSlash(item.Path)
+
+				if filepath.Base(path) == dataFile || filepath.Base(path) == yamlDataFile {
+					var val map[string]json.RawMessage
+					err = util.Unmarshal(item.Value, &val)
+					if err == nil {
+						err = doDFS(val, filepath.Dir(strings.Trim(path, "/")), *b.Manifest.Roots)
+						if err != nil {
+							return err
+						}
+					} else {
+						// Build an object for the value
+						p := getNormalizedPath(path)
+
+						if len(p) == 0 {
+							return fmt.Errorf("root value must be object")
+						}
+
+						// verify valid YAML or JSON value
+						var x interface{}
+						err := util.Unmarshal(item.Value, &x)
+						if err != nil {
+							return err
+						}
+
+						value := item.Value
+						dir := map[string]json.RawMessage{}
+						for i := len(p) - 1; i > 0; i-- {
+							dir[p[i]] = value
+
+							bs, err := json.Marshal(dir)
+							if err != nil {
+								return err
+							}
+
+							value = bs
+							dir = map[string]json.RawMessage{}
+						}
+						dir[p[0]] = value
+
+						err = doDFS(dir, filepath.Dir(strings.Trim(path, "/")), *b.Manifest.Roots)
+						if err != nil {
+							return err
+						}
+					}
+				}
+			}
 		}
 	}
 
-	// Write and compile the modules all at once to avoid having to re-do work.
+	// Compile the modules all at once to avoid having to re-do work.
 	remainingAndExtra := make(map[string]*ast.Module)
 	for name, mod := range remaining {
 		remainingAndExtra[name] = mod
@@ -350,21 +450,26 @@ func activateBundles(opts *ActivateOpts) error {
 		remainingAndExtra[name] = mod
 	}
 
-	err = writeModules(opts.Ctx, opts.Store, opts.Txn, opts.Compiler, opts.Metrics, opts.Bundles, remainingAndExtra, opts.legacy)
+	err = compileModules(opts.Compiler, opts.Metrics, snapshotBundles, remainingAndExtra, opts.legacy)
 	if err != nil {
 		return err
 	}
 
-	for name, b := range opts.Bundles {
-		// Always write manifests to the named location. If the plugin is in the older style config
-		// then also write to the old legacy unnamed location.
-		if err := WriteManifestToStore(opts.Ctx, opts.Store, opts.Txn, name, b.Manifest); err != nil {
+	if err := writeDataAndModules(opts.Ctx, opts.Store, opts.Txn, opts.TxnCtx, snapshotBundles, opts.legacy); err != nil {
+		return err
+	}
+
+	if err := ast.CheckPathConflicts(opts.Compiler, storage.NonEmpty(opts.Ctx, opts.Store, opts.Txn)); len(err) > 0 {
+		return err
+	}
+
+	for name, b := range snapshotBundles {
+		if err := writeManifestToStore(opts, name, b.Manifest); err != nil {
 			return err
 		}
-		if opts.legacy {
-			if err := LegacyWriteManifestToStore(opts.Ctx, opts.Store, opts.Txn, b.Manifest); err != nil {
-				return err
-			}
+
+		if err := writeEtagToStore(opts, name, b.Etag); err != nil {
+			return err
 		}
 
 		if err := writeWasmModulesToStore(opts.Ctx, opts.Store, opts.Txn, name, b); err != nil {
@@ -375,6 +480,107 @@ func activateBundles(opts *ActivateOpts) error {
 	return nil
 }
 
+func doDFS(obj map[string]json.RawMessage, path string, roots []string) error {
+	if len(roots) == 1 && roots[0] == "" {
+		return nil
+	}
+
+	for key := range obj {
+
+		newPath := filepath.Join(strings.Trim(path, "/"), key)
+
+		// Note: filepath.Join can return paths with '\' separators, always use
+		// filepath.ToSlash to keep them normalized.
+		newPath = strings.TrimLeft(normalizePath(newPath), "/.")
+
+		contains := false
+		prefix := false
+		if RootPathsContain(roots, newPath) {
+			contains = true
+		} else {
+			for i := range roots {
+				if strings.HasPrefix(strings.Trim(roots[i], "/"), newPath) {
+					prefix = true
+					break
+				}
+			}
+		}
+
+		if !contains && !prefix {
+			return fmt.Errorf("manifest roots %v do not permit data at path '/%s' (hint: check bundle directory structure)", roots, newPath)
+		}
+
+		if contains {
+			continue
+		}
+
+		var next map[string]json.RawMessage
+		err := util.Unmarshal(obj[key], &next)
+		if err != nil {
+			return fmt.Errorf("manifest roots %v do not permit data at path '/%s' (hint: check bundle directory structure)", roots, newPath)
+		}
+
+		if err := doDFS(next, newPath, roots); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func activateDeltaBundles(opts *ActivateOpts, bundles map[string]*Bundle) error {
+
+	// Check that the manifest roots and wasm resolvers in the delta bundle
+	// match with those currently in the store
+	for name, b := range bundles {
+		value, err := opts.Store.Read(opts.Ctx, opts.Txn, ManifestStoragePath(name))
+		if err != nil {
+			if storage.IsNotFound(err) {
+				continue
+			}
+			return err
+		}
+
+		bs, err := json.Marshal(value)
+		if err != nil {
+			return fmt.Errorf("corrupt manifest data: %w", err)
+		}
+
+		var manifest Manifest
+
+		err = util.UnmarshalJSON(bs, &manifest)
+		if err != nil {
+			return fmt.Errorf("corrupt manifest data: %w", err)
+		}
+
+		if !b.Manifest.equalWasmResolversAndRoots(manifest) {
+			return fmt.Errorf("delta bundle '%s' has wasm resolvers or manifest roots that are different from those in the store", name)
+		}
+	}
+
+	for _, b := range bundles {
+		err := applyPatches(opts.Ctx, opts.Store, opts.Txn, b.Patch.Data)
+		if err != nil {
+			return err
+		}
+	}
+
+	if err := ast.CheckPathConflicts(opts.Compiler, storage.NonEmpty(opts.Ctx, opts.Store, opts.Txn)); len(err) > 0 {
+		return err
+	}
+
+	for name, b := range bundles {
+		if err := writeManifestToStore(opts, name, b.Manifest); err != nil {
+			return err
+		}
+
+		if err := writeEtagToStore(opts, name, b.Etag); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 // erase bundles by name and roots. This will clear all policies and data at its roots and remove its
 // manifest from storage.
 func eraseBundles(ctx context.Context, store storage.Store, txn storage.Transaction, names map[string]struct{}, roots map[string]struct{}) (map[string]*ast.Module, error) {
@@ -389,15 +595,19 @@ func eraseBundles(ctx context.Context, store storage.Store, txn storage.Transact
 	}
 
 	for name := range names {
-		if err := EraseManifestFromStore(ctx, store, txn, name); err != nil && !storage.IsNotFound(err) {
+		if err := EraseManifestFromStore(ctx, store, txn, name); suppressNotFound(err) != nil {
+			return nil, err
+		}
+
+		if err := LegacyEraseManifestFromStore(ctx, store, txn); suppressNotFound(err) != nil {
 			return nil, err
 		}
 
-		if err := LegacyEraseManifestFromStore(ctx, store, txn); err != nil && !storage.IsNotFound(err) {
+		if err := eraseBundleEtagFromStore(ctx, store, txn, name); suppressNotFound(err) != nil {
 			return nil, err
 		}
 
-		if err := eraseWasmModulesFromStore(ctx, store, txn, name); err != nil && !storage.IsNotFound(err) {
+		if err := eraseWasmModulesFromStore(ctx, store, txn, name); suppressNotFound(err) != nil {
 			return nil, err
 		}
 	}
@@ -411,11 +621,10 @@ func eraseData(ctx context.Context, store storage.Store, txn storage.Transaction
 		if !ok {
 			return fmt.Errorf("manifest root path invalid: %v", root)
 		}
+
 		if len(path) > 0 {
-			if err := store.Write(ctx, txn, storage.RemoveOp, path, nil); err != nil {
-				if !storage.IsNotFound(err) {
-					return err
-				}
+			if err := store.Write(ctx, txn, storage.RemoveOp, path, nil); suppressNotFound(err) != nil {
+				return err
 			}
 		}
 	}
@@ -462,6 +671,70 @@ func erasePolicies(ctx context.Context, store storage.Store, txn storage.Transac
 	return remaining, nil
 }
 
+func writeManifestToStore(opts *ActivateOpts, name string, manifest Manifest) error {
+	// Always write manifests to the named location. If the plugin is in the older style config
+	// then also write to the old legacy unnamed location.
+	if err := WriteManifestToStore(opts.Ctx, opts.Store, opts.Txn, name, manifest); err != nil {
+		return err
+	}
+
+	if opts.legacy {
+		if err := LegacyWriteManifestToStore(opts.Ctx, opts.Store, opts.Txn, manifest); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func writeEtagToStore(opts *ActivateOpts, name, etag string) error {
+	if err := WriteEtagToStore(opts.Ctx, opts.Store, opts.Txn, name, etag); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func writeDataAndModules(ctx context.Context, store storage.Store, txn storage.Transaction, txnCtx *storage.Context, bundles map[string]*Bundle, legacy bool) error {
+	params := storage.WriteParams
+	params.Context = txnCtx
+
+	for name, b := range bundles {
+		if len(b.Raw) == 0 {
+			// Write data from each new bundle into the store. Only write under the
+			// roots contained in their manifest.
+			if err := writeData(ctx, store, txn, *b.Manifest.Roots, b.Data); err != nil {
+				return err
+			}
+
+			for _, mf := range b.Modules {
+				var path string
+
+				// For backwards compatibility, in legacy mode, upsert policies to
+				// the unprefixed path.
+				if legacy {
+					path = mf.Path
+				} else {
+					path = modulePathWithPrefix(name, mf.Path)
+				}
+
+				if err := store.UpsertPolicy(ctx, txn, path, mf.Raw); err != nil {
+					return err
+				}
+			}
+		} else {
+			params.BasePaths = *b.Manifest.Roots
+
+			err := store.Truncate(ctx, txn, params, NewIterator(b.Raw))
+			if err != nil {
+				return fmt.Errorf("store truncate failed for bundle '%s': %v", name, err)
+			}
+		}
+	}
+
+	return nil
+}
+
 func writeData(ctx context.Context, store storage.Store, txn storage.Transaction, roots []string, data map[string]interface{}) error {
 	for _, root := range roots {
 		path, ok := storage.ParsePathEscaped("/" + root)
@@ -482,6 +755,43 @@ func writeData(ctx context.Context, store storage.Store, txn storage.Transaction
 	return nil
 }
 
+func compileModules(compiler *ast.Compiler, m metrics.Metrics, bundles map[string]*Bundle, extraModules map[string]*ast.Module, legacy bool) error {
+
+	m.Timer(metrics.RegoModuleCompile).Start()
+	defer m.Timer(metrics.RegoModuleCompile).Stop()
+
+	modules := map[string]*ast.Module{}
+
+	// preserve any modules already on the compiler
+	for name, module := range compiler.Modules {
+		modules[name] = module
+	}
+
+	// preserve any modules passed in from the store
+	for name, module := range extraModules {
+		modules[name] = module
+	}
+
+	// include all the new bundle modules
+	for bundleName, b := range bundles {
+		if legacy {
+			for _, mf := range b.Modules {
+				modules[mf.Path] = mf.Parsed
+			}
+		} else {
+			for name, module := range b.ParsedModules(bundleName) {
+				modules[name] = module
+			}
+		}
+	}
+
+	if compiler.Compile(modules); compiler.Failed() {
+		return compiler.Errors
+	}
+
+	return nil
+}
+
 func writeModules(ctx context.Context, store storage.Store, txn storage.Transaction, compiler *ast.Compiler, m metrics.Metrics, bundles map[string]*Bundle, extraModules map[string]*ast.Module, legacy bool) error {
 
 	m.Timer(metrics.RegoModuleCompile).Start()
@@ -557,7 +867,7 @@ func lookup(path storage.Path, data map[string]interface{}) (interface{}, bool)
 func hasRootsOverlap(ctx context.Context, store storage.Store, txn storage.Transaction, bundles map[string]*Bundle) error {
 	collisions := map[string][]string{}
 	allBundles, err := ReadBundleNamesFromStore(ctx, store, txn)
-	if err != nil && !storage.IsNotFound(err) {
+	if suppressNotFound(err) != nil {
 		return err
 	}
 
@@ -566,7 +876,7 @@ func hasRootsOverlap(ctx context.Context, store storage.Store, txn storage.Trans
 	// Build a map of roots for existing bundles already in the system
 	for _, name := range allBundles {
 		roots, err := ReadBundleRootsFromStore(ctx, store, txn, name)
-		if err != nil && !storage.IsNotFound(err) {
+		if suppressNotFound(err) != nil {
 			return err
 		}
 		allRoots[name] = roots
@@ -607,6 +917,47 @@ func hasRootsOverlap(ctx context.Context, store storage.Store, txn storage.Trans
 	return nil
 }
 
+func applyPatches(ctx context.Context, store storage.Store, txn storage.Transaction, patches []PatchOperation) error {
+	for _, pat := range patches {
+
+		// construct patch path
+		path, ok := patch.ParsePatchPathEscaped("/" + strings.Trim(pat.Path, "/"))
+		if !ok {
+			return fmt.Errorf("error parsing patch path")
+		}
+
+		var op storage.PatchOp
+		switch pat.Op {
+		case "upsert":
+			op = storage.AddOp
+
+			_, err := store.Read(ctx, txn, path[:len(path)-1])
+			if err != nil {
+				if !storage.IsNotFound(err) {
+					return err
+				}
+
+				if err := storage.MakeDir(ctx, store, txn, path[:len(path)-1]); err != nil {
+					return err
+				}
+			}
+		case "remove":
+			op = storage.RemoveOp
+		case "replace":
+			op = storage.ReplaceOp
+		default:
+			return fmt.Errorf("bad patch operation: %v", pat.Op)
+		}
+
+		// apply the patch
+		if err := store.Write(ctx, txn, op, path, pat.Value); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 // Helpers for the older single (unnamed) bundle style manifest storage.
 
 // LegacyManifestStoragePath is the older unnamed bundle path for manifests to be stored.
diff --git a/bundle/store_test.go b/bundle/store_test.go
index e578b515d7..ea7d88abb8 100644
--- a/bundle/store_test.go
+++ b/bundle/store_test.go
@@ -1,21 +1,28 @@
 package bundle
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
+	"fmt"
+	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
 
-	"github.com/open-policy-agent/opa/util"
+	"github.com/open-policy-agent/opa/internal/file/archive"
+	"github.com/open-policy-agent/opa/internal/storage/mock"
 
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
-
-	"github.com/open-policy-agent/opa/internal/storage/mock"
+	"github.com/open-policy-agent/opa/util"
+	"github.com/open-policy-agent/opa/util/test"
 
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/storage/disk"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 )
 
 func TestManifestStoreLifecycleSingleBundle(t *testing.T) {
@@ -171,104 +178,3778 @@ func verifyReadBundleNames(ctx context.Context, t *testing.T, store storage.Stor
 		return nil
 	})
 	if err != nil {
-		t.Fatalf("Unexpected error finishing transaction: %s", err)
+		t.Fatalf("Unexpected error finishing transaction: %s", err)
+	}
+
+	if len(actualNames) != len(expected) {
+		t.Fatalf("Expected %d name, found %d \n\t\tActual: %v\n", len(expected), len(actualNames), actualNames)
+	}
+
+	for _, actualName := range actualNames {
+		found := false
+		for _, expectedName := range expected {
+			if actualName == expectedName {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("Found unexpecxted bundle name %s, expected names: %+v", actualName, expected)
+		}
+	}
+}
+
+func verifyReadLegacyRevision(ctx context.Context, t *testing.T, store storage.Store, expected string) {
+	t.Helper()
+	var actual string
+	err := storage.Txn(ctx, store, storage.WriteParams, func(txn storage.Transaction) error {
+		var err error
+		if actual, err = LegacyReadRevisionFromStore(ctx, store, txn); err != nil && !storage.IsNotFound(err) {
+			t.Fatalf("Failed to read manifest revision from store: %s", err)
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("Unexpected error finishing transaction: %s", err)
+	}
+
+	if actual != expected {
+		t.Fatalf("Expected revision %s, got %s", expected, actual)
+	}
+}
+
+func TestBundleLazyModeNoPolicyOrData(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	bundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Roots:    &[]string{"a"},
+				Revision: "foo",
+			},
+			Etag:            "foo",
+			lazyLoadingMode: true,
+		},
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err := Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the bundle was activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+{
+	"system": {
+		"bundles": {
+			"bundle1": {
+				"manifest": {
+					"revision": "foo",
+					"roots": ["a"]
+				},
+				"etag": "foo"
+			}
+		}
+	}
+}
+`
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+}
+
+func TestBundleLazyModeLifecycleRaw(t *testing.T) {
+	files := [][2]string{
+		{"/a/b/c/data.json", "[1,2,3]"},
+		{"/a/b/d/data.json", "true"},
+		{"/a/b/y/data.yaml", `foo: 1`},
+		{"/example/example.rego", `package example`},
+		{"/authz/allow/policy.wasm", `wasm-module`},
+		{"/data.json", `{"x": {"y": true}, "a": {"b": {"z": true}}}}`},
+		{"/.manifest", `{"revision": "foo", "roots": ["a", "example", "x", "authz"],"wasm":[{"entrypoint": "authz/allow", "module": "/authz/allow/policy.wasm"}]}`},
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	loader := NewTarballLoaderWithBaseURL(buf, "")
+	br := NewCustomReader(loader).WithBundleEtag("bar").WithLazyLoadingMode(true)
+
+	bundle, err := br.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	extraMods := map[string]*ast.Module{
+		"mod1": ast.MustParseModule("package x\np = true"),
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:          ctx,
+		Store:        mockStore,
+		Txn:          txn,
+		Compiler:     compiler,
+		Metrics:      m,
+		Bundles:      bundles,
+		ExtraModules: extraMods,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the bundle was activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+	expectedRaw := `
+{
+	"a": {
+		"b": {
+			"c": [1,2,3],
+			"d": true,
+			"y": {
+				"foo": 1
+			},
+			"z": true
+		}
+	},
+	"x": {
+		"y": true
+	},
+	"system": {
+		"bundles": {
+			"bundle1": {
+				"manifest": {
+					"revision": "foo",
+					"roots": ["a", "example", "x", "authz"],
+					"wasm": [
+						{
+							"entrypoint": "authz/allow",
+							"module": "/authz/allow/policy.wasm"
+						}
+					]
+				},
+				"etag": "bar",
+				"wasm": {
+					"/authz/allow/policy.wasm": "d2FzbS1tb2R1bGU="
+				}
+			}
+		}
+	}
+}
+`
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Ensure that the extra module was included
+	if _, ok := compiler.Modules["mod1"]; !ok {
+		t.Fatalf("expected extra module to be compiled")
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Deactivate(&DeactivateOpts{
+		Ctx:         ctx,
+		Store:       mockStore,
+		Txn:         txn,
+		BundleNames: map[string]struct{}{"bundle1": {}},
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Expect the store to have been cleared out after deactivating the bundle
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err = ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != 0 {
+		t.Fatalf("expected 0 bundles in store, found %d", len(names))
+	}
+
+	actual, err = mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+	expectedRaw = `{"system": {"bundles": {}}}`
+	expected = loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	mockStore.AssertValid(t)
+}
+
+func TestBundleLazyModeLifecycleRawInvalidData(t *testing.T) {
+
+	tests := map[string]struct {
+		files [][2]string
+		err   error
+	}{
+		"non-object root": {[][2]string{{"/data.json", `[1,2,3]`}}, fmt.Errorf("root value must be object")},
+		"invalid yaml":    {[][2]string{{"/a/b/data.yaml", `"foo`}}, fmt.Errorf("yaml: found unexpected end of stream")},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+
+			buf := archive.MustWriteTarGz(tc.files)
+			loader := NewTarballLoaderWithBaseURL(buf, "")
+			br := NewCustomReader(loader).WithBundleEtag("bar").WithLazyLoadingMode(true)
+
+			bundle, err := br.Read()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			ctx := context.Background()
+			mockStore := mock.New()
+
+			compiler := ast.NewCompiler()
+			m := metrics.New()
+
+			bundles := map[string]*Bundle{
+				"bundle1": &bundle,
+			}
+
+			txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+			err = Activate(&ActivateOpts{
+				Ctx:      ctx,
+				Store:    mockStore,
+				Txn:      txn,
+				Compiler: compiler,
+				Metrics:  m,
+				Bundles:  bundles,
+			})
+
+			if tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("Expected error message %v but got %v", tc.err.Error(), err.Error())
+			}
+		})
+	}
+}
+
+func TestBundleLazyModeLifecycle(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	extraMods := map[string]*ast.Module{
+		"mod1": ast.MustParseModule("package x\np = true"),
+	}
+
+	mod1 := "package a\np = true"
+	mod2 := "package b\np = true"
+
+	b1Files := [][2]string{
+		{"/.manifest", `{"roots": ["a"]}`},
+		{"a/policy.rego", mod1},
+		{"/data.json", `{"a": {"b": "foo"}}`},
+	}
+
+	buf := archive.MustWriteTarGz(b1Files)
+	loader := NewTarballLoaderWithBaseURL(buf, "")
+	br := NewCustomReader(loader).WithBundleEtag("foo").WithLazyLoadingMode(true).WithBundleName("bundle1")
+
+	bundle1, err := br.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b2Files := [][2]string{
+		{"/.manifest", `{"roots": ["b", "c"]}`},
+		{"b/policy.rego", mod2},
+		{"/data.json", `{}`},
+	}
+
+	buf = archive.MustWriteTarGz(b2Files)
+	loader = NewTarballLoaderWithBaseURL(buf, "")
+	br = NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2")
+
+	bundle2, err := br.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle1,
+		"bundle2": &bundle2,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:          ctx,
+		Store:        mockStore,
+		Txn:          txn,
+		Compiler:     compiler,
+		Metrics:      m,
+		Bundles:      bundles,
+		ExtraModules: extraMods,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the bundle was activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+	expectedRaw := `
+{
+	"a": {
+		"b": "foo"
+	},
+	"system": {
+		"bundles": {
+			"bundle1": {
+				"manifest": {
+					"revision": "",
+					"roots": ["a"]
+				},
+				"etag": "foo"
+			},
+			"bundle2": {
+				"manifest": {
+					"revision": "",
+					"roots": ["b", "c"]
+				},
+				"etag": ""
+			}
+		}
+	}
+}
+`
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Ensure that the extra module was included
+	if _, ok := compiler.Modules["mod1"]; !ok {
+		t.Fatalf("expected extra module to be compiled")
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Deactivate(&DeactivateOpts{
+		Ctx:         ctx,
+		Store:       mockStore,
+		Txn:         txn,
+		BundleNames: map[string]struct{}{"bundle1": {}, "bundle2": {}},
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Expect the store to have been cleared out after deactivating the bundles
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err = ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != 0 {
+		t.Fatalf("expected 0 bundles in store, found %d", len(names))
+	}
+
+	actual, err = mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+	expectedRaw = `{"system": {"bundles": {}}}`
+	expected = loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	mockStore.AssertValid(t)
+}
+
+func TestBundleLazyModeLifecycleRawNoBundleRoots(t *testing.T) {
+	files := [][2]string{
+		{"/a/b/c/data.json", "[1,2,3]"},
+		{"/a/b/d/data.json", "true"},
+		{"/a/b/y/data.yaml", `foo: 1`},
+		{"/example/example.rego", `package example`},
+		{"/data.json", `{"x": {"y": true}, "a": {"b": {"z": true}}}}`},
+		{"/.manifest", `{"revision": "rev-1"}`},
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	loader := NewTarballLoaderWithBaseURL(buf, "")
+	br := NewCustomReader(loader).WithBundleEtag("foo").WithLazyLoadingMode(true)
+
+	bundle, err := br.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the bundle was activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+{
+	"a": {
+		"b": {
+			"c": [1,2,3],
+			"d": true,
+			"y": {
+				"foo": 1
+			},
+			"z": true
+		}
+	},
+	"x": {
+		"y": true
+	},
+	"system": {
+		"bundles": {
+			"bundle1": {
+				"manifest": {
+					"revision": "rev-1",
+					"roots": [""]
+				},
+				"etag": "foo"
+			}
+		}
+	}
+}
+`
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	files = [][2]string{
+		{"/c/data.json", `{"hello": "world"}`},
+		{"/.manifest", `{"revision": "rev-2"}`},
+	}
+
+	buf = archive.MustWriteTarGz(files)
+	loader = NewTarballLoaderWithBaseURL(buf, "")
+	br = NewCustomReader(loader).WithBundleEtag("bar").WithLazyLoadingMode(true)
+
+	bundle, err = br.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles = map[string]*Bundle{
+		"bundle1": &bundle,
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err = mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw = `
+      {
+         "c": {
+            "hello": "world"
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-2",
+                     "roots": [""]
+                  },
+                  "etag": "bar"
+               }
+            }
+         }
+      }`
+
+	expected = loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+}
+
+func TestBundleLazyModeLifecycleRawNoBundleRootsDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		files := [][2]string{
+			{"/a/b/c/data.json", "[1,2,3]"},
+			{"/a/b/d/data.json", "true"},
+			{"/a/b/y/data.yaml", `foo: 1`},
+			{"/example/example.rego", `package example`},
+			{"/data.json", `{"x": {"y": true}, "a": {"b": {"z": true}}}}`},
+			{"/.manifest", `{"revision": "rev-1"}`},
+		}
+
+		buf := archive.MustWriteTarGz(files)
+		loader := NewTarballLoaderWithBaseURL(buf, "")
+		br := NewCustomReader(loader).WithBundleEtag("foo").WithLazyLoadingMode(true)
+
+		bundle, err := br.Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the bundle was activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		for bundleName, bundle := range bundles {
+			for modName := range bundle.ParsedModules(bundleName) {
+				if _, ok := compiler.Modules[modName]; !ok {
+					t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+				}
+			}
+		}
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+{
+	"a": {
+		"b": {
+			"c": [1,2,3],
+			"d": true,
+			"y": {
+				"foo": 1
+			},
+			"z": true
+		}
+	},
+	"x": {
+		"y": true
+	},
+	"system": {
+		"bundles": {
+			"bundle1": {
+				"manifest": {
+					"revision": "rev-1",
+					"roots": [""]
+				},
+				"etag": "foo"
+			}
+		}
+	}
+}
+`
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		files = [][2]string{
+			{"/c/data.json", `{"hello": "world"}`},
+			{"/.manifest", `{"revision": "rev-2"}`},
+		}
+
+		buf = archive.MustWriteTarGz(files)
+		loader = NewTarballLoaderWithBaseURL(buf, "")
+		br = NewCustomReader(loader).WithBundleEtag("bar").WithLazyLoadingMode(true)
+
+		bundle, err = br.Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles = map[string]*Bundle{
+			"bundle1": &bundle,
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err = store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw = `
+      {
+         "c": {
+            "hello": "world"
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-2",
+                     "roots": [""]
+                  },
+                  "etag": "bar"
+               }
+            }
+         }
+      }`
+
+		expected = loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+	})
+}
+
+func TestBundleLazyModeLifecycleNoBundleRoots(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	mod1 := "package a\np = true"
+
+	b := Bundle{
+		Manifest: Manifest{Revision: "rev-1"},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"b": "foo",
+				"e": map[string]interface{}{
+					"f": "bar",
+				},
+				"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+			},
+		},
+		Modules: []ModuleFile{
+			{
+				Path:   "a/policy.rego",
+				Raw:    []byte(mod1),
+				Parsed: ast.MustParseModule(mod1),
+			},
+		},
+		Etag: "foo",
+	}
+
+	var buf1 bytes.Buffer
+	if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader := NewTarballLoaderWithBaseURL(&buf1, "")
+	bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle1,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+      {
+         "a": {
+            "b": "foo",
+            "e": {
+               "f": "bar"
+            },
+            "x": [{"name": "john"}, {"name": "jane"}]
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-1",
+                     "roots": [""]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// add a new bundle with no roots. this means all the data from the currently activated should be removed
+	b = Bundle{
+		Manifest: Manifest{Revision: "rev-2"},
+		Data: map[string]interface{}{
+			"c": map[string]interface{}{
+				"hello": "world",
+			},
+		},
+		Etag: "bar",
+	}
+
+	var buf2 bytes.Buffer
+	if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+
+	loader = NewTarballLoaderWithBaseURL(&buf2, "")
+	bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles = map[string]*Bundle{
+		"bundle1": &bundle2,
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err = mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw = `
+      {
+         "c": {
+            "hello": "world"
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-2",
+                     "roots": [""]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+	expected = loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+}
+
+func TestBundleLazyModeLifecycleNoBundleRootsDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		mod1 := "package a\np = true"
+
+		b := Bundle{
+			Manifest: Manifest{Revision: "rev-1"},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+					"e": map[string]interface{}{
+						"f": "bar",
+					},
+					"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+			Etag: "foo",
+		}
+
+		var buf1 bytes.Buffer
+		if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader := NewTarballLoaderWithBaseURL(&buf1, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundle was activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		for bundleName, bundle := range bundles {
+			for modName := range bundle.ParsedModules(bundleName) {
+				if _, ok := compiler.Modules[modName]; !ok {
+					t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+				}
+			}
+		}
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+      {
+         "a": {
+            "b": "foo",
+            "e": {
+               "f": "bar"
+            },
+            "x": [{"name": "john"}, {"name": "jane"}]
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-1",
+                     "roots": [""]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// add a new bundle with no roots. this means all the data from the currently activated should be removed
+		b = Bundle{
+			Manifest: Manifest{Revision: "rev-2"},
+			Data: map[string]interface{}{
+				"c": map[string]interface{}{
+					"hello": "world",
+				},
+			},
+			Etag: "bar",
+		}
+
+		var buf2 bytes.Buffer
+		if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+
+		loader = NewTarballLoaderWithBaseURL(&buf2, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles = map[string]*Bundle{
+			"bundle1": &bundle2,
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundle was activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err = store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw = `
+      {
+         "c": {
+            "hello": "world"
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-2",
+                     "roots": [""]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected = loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+	})
+}
+
+func TestBundleLazyModeLifecycleMixBundleTypeActivationDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		mod1 := "package a\np = true"
+
+		b := Bundle{
+			Manifest: Manifest{
+				Revision: "snap-1",
+				Roots:    &[]string{"a"},
+			},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+					"e": map[string]interface{}{
+						"f": "bar",
+					},
+					"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+			Etag: "foo",
+		}
+
+		var buf1 bytes.Buffer
+		if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader := NewTarballLoaderWithBaseURL(&buf1, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// create a delta bundle and activate it
+
+		// add a new object member
+		p1 := PatchOperation{
+			Op:    "upsert",
+			Path:  "/x/y",
+			Value: []string{"foo", "bar"},
+		}
+
+		b = Bundle{
+			Manifest: Manifest{
+				Revision: "delta-1",
+				Roots:    &[]string{"x"},
+			},
+			Patch: Patch{Data: []PatchOperation{p1}},
+			Etag:  "bar",
+		}
+
+		var buf2 bytes.Buffer
+		if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+
+		loader = NewTarballLoaderWithBaseURL(&buf2, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+			"bundle2": &bundle2,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the patches were applied
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+      {
+         "a": {
+            "b": "foo",
+            "e": {
+               "f": "bar"
+            },
+            "x": [{"name": "john"}, {"name": "jane"}]
+         },
+        "x": {
+			"y": ["foo","bar"]
+		},
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "snap-1",
+                     "roots": ["a"]
+                  },
+                  "etag": ""
+               },
+			"bundle2": {
+                  "manifest": {
+                     "revision": "delta-1",
+                     "roots": ["x"]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+	})
+}
+
+func TestBundleLazyModeLifecycleOldBundleEraseDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		mod1 := "package a\np = true"
+
+		b := Bundle{
+			Manifest: Manifest{Revision: "rev-1", Roots: &[]string{"a"}},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+					"e": map[string]interface{}{
+						"f": "bar",
+					},
+					"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+			Etag: "foo",
+		}
+
+		var buf1 bytes.Buffer
+		if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader := NewTarballLoaderWithBaseURL(&buf1, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundle was activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		for bundleName, bundle := range bundles {
+			for modName := range bundle.ParsedModules(bundleName) {
+				if _, ok := compiler.Modules[modName]; !ok {
+					t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+				}
+			}
+		}
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+      {
+         "a": {
+            "b": "foo",
+            "e": {
+               "f": "bar"
+            },
+            "x": [{"name": "john"}, {"name": "jane"}]
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-1",
+                     "roots": ["a"]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// add a new bundle and verify data from the currently activated is removed
+		b = Bundle{
+			Manifest: Manifest{Revision: "rev-2", Roots: &[]string{"c"}},
+			Data: map[string]interface{}{
+				"c": map[string]interface{}{
+					"hello": "world",
+				},
+			},
+			Etag: "bar",
+		}
+
+		var buf2 bytes.Buffer
+		if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+
+		loader = NewTarballLoaderWithBaseURL(&buf2, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles = map[string]*Bundle{
+			"bundle1": &bundle2,
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundle was activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err = store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw = `
+      {
+         "c": {
+            "hello": "world"
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-2",
+                     "roots": ["c"]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected = loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+	})
+}
+
+func TestBundleLazyModeLifecycleRestoreBackupDB(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		mod1 := "package a\np = true"
+
+		b := Bundle{
+			Manifest: Manifest{Revision: "rev-1", Roots: &[]string{"a"}},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+					"e": map[string]interface{}{
+						"f": "bar",
+					},
+					"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+			Etag: "foo",
+		}
+
+		var buf1 bytes.Buffer
+		if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader := NewTarballLoaderWithBaseURL(&buf1, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundle was activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		for bundleName, bundle := range bundles {
+			for modName := range bundle.ParsedModules(bundleName) {
+				if _, ok := compiler.Modules[modName]; !ok {
+					t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+				}
+			}
+		}
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+      {
+         "a": {
+            "b": "foo",
+            "e": {
+               "f": "bar"
+            },
+            "x": [{"name": "john"}, {"name": "jane"}]
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-1",
+                     "roots": ["a"]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// add a new bundle but abort the transaction and verify only old the bundle data is kept in store
+		b = Bundle{
+			Manifest: Manifest{Revision: "rev-2", Roots: &[]string{"c"}},
+			Data: map[string]interface{}{
+				"c": map[string]interface{}{
+					"hello": "world",
+				},
+			},
+			Etag: "bar",
+		}
+
+		var buf2 bytes.Buffer
+		if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+
+		loader = NewTarballLoaderWithBaseURL(&buf2, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles = map[string]*Bundle{
+			"bundle1": &bundle2,
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		store.Abort(ctx, txn)
+
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err = store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw = `
+      {
+         "a": {
+            "b": "foo",
+            "e": {
+               "f": "bar"
+            },
+            "x": [{"name": "john"}, {"name": "jane"}]
+         },
+         "system": {
+            "bundles": {
+               "bundle1": {
+                  "manifest": {
+                     "revision": "rev-1",
+                     "roots": ["a"]
+                  },
+                  "etag": ""
+               }
+            }
+         }
+      }`
+
+		expected = loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// check symlink is created
+		symlink := filepath.Join(dir, "active")
+		_, err = os.Lstat(symlink)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// check symlink target
+		_, err = filepath.EvalSymlinks(symlink)
+		if err != nil {
+			t.Fatalf("eval symlinks: %v", err)
+		}
+	})
+}
+
+func TestDeltaBundleLazyModeLifecycleDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		mod1 := "package a\np = true"
+		mod2 := "package b\np = true"
+
+		b := Bundle{
+			Manifest: Manifest{
+				Roots: &[]string{"a"},
+			},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+					"e": map[string]interface{}{
+						"f": "bar",
+					},
+					"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+			Etag: "foo",
+		}
+
+		var buf1 bytes.Buffer
+		if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader := NewTarballLoaderWithBaseURL(&buf1, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		b = Bundle{
+			Manifest: Manifest{
+				Roots: &[]string{"b", "c"},
+			},
+			Data: nil,
+			Modules: []ModuleFile{
+				{
+					Path:   "b/policy.rego",
+					Raw:    []byte(mod2),
+					Parsed: ast.MustParseModule(mod2),
+				},
+			},
+			Etag: "foo",
+		}
+
+		var buf2 bytes.Buffer
+		if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+
+		loader = NewTarballLoaderWithBaseURL(&buf2, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+			"bundle2": &bundle2,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundles were activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		for bundleName, bundle := range bundles {
+			for modName := range bundle.ParsedModules(bundleName) {
+				if _, ok := compiler.Modules[modName]; !ok {
+					t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+				}
+			}
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// create a delta bundle and activate it
+
+		// add a new object member
+		p1 := PatchOperation{
+			Op:    "upsert",
+			Path:  "/a/c/d",
+			Value: []string{"foo", "bar"},
+		}
+
+		// append value to array
+		p2 := PatchOperation{
+			Op:    "upsert",
+			Path:  "/a/c/d/-",
+			Value: "baz",
+		}
+
+		// replace a value
+		p3 := PatchOperation{
+			Op:    "replace",
+			Path:  "a/b",
+			Value: "bar",
+		}
+
+		// add a new object root
+		p4 := PatchOperation{
+			Op:    "upsert",
+			Path:  "/c/d",
+			Value: []string{"foo", "bar"},
+		}
+
+		deltaBundles := map[string]*Bundle{
+			"bundle1": {
+				Manifest: Manifest{
+					Revision: "delta-1",
+					Roots:    &[]string{"a"},
+				},
+				Patch: Patch{Data: []PatchOperation{p1, p2, p3}},
+				Etag:  "bar",
+			},
+			"bundle2": {
+				Manifest: Manifest{
+					Revision: "delta-2",
+					Roots:    &[]string{"b", "c"},
+				},
+				Patch: Patch{Data: []PatchOperation{p4}},
+				Etag:  "baz",
+			},
+			"bundle3": {
+				Manifest: Manifest{
+					Roots: &[]string{"d"},
+				},
+				Data: map[string]interface{}{
+					"d": map[string]interface{}{
+						"e": "foo",
+					},
+				},
+			},
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  deltaBundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// check the modules from the snapshot bundles are on the compiler
+		for bundleName, bundle := range bundles {
+			for modName := range bundle.ParsedModules(bundleName) {
+				if _, ok := compiler.Modules[modName]; !ok {
+					t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+				}
+			}
+		}
+
+		// Ensure the patches were applied
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+		{
+			"a": {
+		     	"b": "bar",
+		     	"c": {
+					"d": ["foo", "bar", "baz"]
+		     	},
+				"e": {
+					"f": "bar"
+				},
+			   "x": [{"name": "john"}, {"name": "jane"}]
+			},
+			"c": {"d": ["foo", "bar"]},
+			"d": {"e": "foo"},
+			"system": {
+				"bundles": {
+					"bundle1": {
+						"manifest": {
+							"revision": "delta-1",
+							"roots": ["a"]
+						},
+						"etag": "bar"
+					},
+					"bundle2": {
+						"manifest": {
+							"revision": "delta-2",
+							"roots": ["b", "c"]
+						},
+						"etag": "baz"
+					},
+					"bundle3": {
+						"manifest": {
+							"revision": "",
+							"roots": ["d"]
+						},
+						"etag": ""
+					}
+				}
+			}
+		}`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+	})
+}
+
+func TestBundleLazyModeLifecycleOverlappingBundleRoots(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	b := Bundle{
+		Manifest: Manifest{
+			Revision: "foo",
+			Roots:    &[]string{"a/b", "a/c", "a/d"},
+		},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"b": "foo",
+				"c": map[string]interface{}{
+					"d": "bar",
+				},
+				"d": []map[string]string{{"name": "john"}, {"name": "jane"}},
+			},
+		},
+	}
+
+	var buf1 bytes.Buffer
+	if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader := NewTarballLoaderWithBaseURL(&buf1, "")
+	bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b = Bundle{
+		Manifest: Manifest{
+			Revision: "bar",
+			Roots:    &[]string{"a/e"},
+		},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"e": map[string]interface{}{
+					"f": "bar",
+				},
+			},
+		},
+	}
+
+	var buf2 bytes.Buffer
+	if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader = NewTarballLoaderWithBaseURL(&buf2, "")
+	bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle1,
+		"bundle2": &bundle2,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the snapshot bundles were activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+		{
+			"a": {
+				"b": "foo",
+				"c": {
+					"d": "bar"
+				},
+				"e": {
+					"f": "bar"
+				},
+			   "d": [{"name": "john"}, {"name": "jane"}]
+			},
+			"system": {
+				"bundles": {
+					"bundle1": {
+						"manifest": {
+							"revision": "foo",
+							"roots": ["a/b", "a/c", "a/d"]
+						},
+						"etag": ""
+					},
+					"bundle2": {
+						"manifest": {
+							"revision": "bar",
+							"roots": ["a/e"]
+						},
+						"etag": ""
+					}
+				}
+			}
+		}`
+
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+}
+
+func TestBundleLazyModeLifecycleOverlappingBundleRootsDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		b := Bundle{
+			Manifest: Manifest{
+				Revision: "foo",
+				Roots:    &[]string{"a/b/c", "a/b/d", "a/b/e"},
+			},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": map[string]interface{}{
+						"c": "bar",
+						"d": []map[string]string{{"name": "john"}, {"name": "jane"}},
+						"e": []string{"foo", "bar"},
+					},
+				},
+			},
+		}
+
+		var buf1 bytes.Buffer
+		if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader := NewTarballLoaderWithBaseURL(&buf1, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		b = Bundle{
+			Manifest: Manifest{
+				Revision: "bar",
+				Roots:    &[]string{"a/b/f"},
+			},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": map[string]interface{}{
+						"f": map[string]interface{}{
+							"hello": "world",
+						},
+					},
+				},
+			},
+		}
+
+		var buf2 bytes.Buffer
+		if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+			t.Fatal("Unexpected error:", err)
+		}
+		loader = NewTarballLoaderWithBaseURL(&buf2, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+			"bundle2": &bundle2,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundles were activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// Ensure the patches were applied
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+		{
+			"a": {
+				"b": {
+					"c": "bar",
+					"d": [{"name": "john"}, {"name": "jane"}],
+					"e": ["foo", "bar"],
+					"f": {"hello": "world"}
+				}
+			},
+			"system": {
+				"bundles": {
+					"bundle1": {
+						"manifest": {
+							"revision": "foo",
+							"roots": ["a/b/c", "a/b/d", "a/b/e"]
+						},
+						"etag": ""
+					},
+					"bundle2": {
+						"manifest": {
+							"revision": "bar",
+							"roots": ["a/b/f"]
+						},
+						"etag": ""
+					}
+				}
+			}
+		}`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+	})
+}
+
+func TestBundleLazyModeLifecycleRawOverlappingBundleRoots(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	files := [][2]string{
+		{"/a/b/x/data.json", "[1,2,3]"},
+		{"/a/c/y/data.json", "true"},
+		{"/a/d/z/data.yaml", `foo: 1`},
+		{"/data.json", `{"a": {"b": {"z": true}}}`},
+		{"/.manifest", `{"revision": "foo", "roots": ["a/b", "a/c", "a/d"]}`},
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	loader := NewTarballLoaderWithBaseURL(buf, "")
+	bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	files = [][2]string{
+		{"/a/e/x/data.json", "[4,5,6]"},
+		{"/data.json", `{"a": {"e": {"f": true}}}`},
+		{"/.manifest", `{"revision": "bar", "roots": ["a/e"]}`},
+	}
+
+	buf = archive.MustWriteTarGz(files)
+	loader = NewTarballLoaderWithBaseURL(buf, "")
+	bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle1,
+		"bundle2": &bundle2,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the snapshot bundles were activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+		{
+			"a": {
+				"b": {
+					"x": [1,2,3],
+					"z": true
+				},
+				"c": {
+					"y": true
+				},
+				"d": {
+					"z": {"foo": 1}
+				},
+				"e": {
+					"x": [4,5,6],
+					"f": true
+				}
+			},
+			"system": {
+				"bundles": {
+					"bundle1": {
+						"manifest": {
+							"revision": "foo",
+							"roots": ["a/b", "a/c", "a/d"]
+						},
+						"etag": ""
+					},
+					"bundle2": {
+						"manifest": {
+							"revision": "bar",
+							"roots": ["a/e"]
+						},
+						"etag": ""
+					}
+				}
+			}
+		}`
+
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+}
+
+func TestBundleLazyModeLifecycleRawOverlappingBundleRootsDiskStorage(t *testing.T) {
+	ctx := context.Background()
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		compiler := ast.NewCompiler()
+		m := metrics.New()
+
+		files := [][2]string{
+			{"/a/b/u/data.json", "[1,2,3]"},
+			{"/a/b/v/data.json", "true"},
+			{"/a/b/w/data.yaml", `foo: 1`},
+			{"/data.json", `{"a": {"b": {"x": true}}}`},
+			{"/.manifest", `{"revision": "foo", "roots": ["a/b"]}`},
+		}
+
+		buf := archive.MustWriteTarGz(files)
+		loader := NewTarballLoaderWithBaseURL(buf, "")
+		bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		files = [][2]string{
+			{"/a/c/x/data.json", "[4,5,6]"},
+			{"/data.json", `{"a": {"c": {"y": true}}}`},
+			{"/.manifest", `{"revision": "bar", "roots": ["a/c"]}`},
+		}
+
+		buf = archive.MustWriteTarGz(files)
+		loader = NewTarballLoaderWithBaseURL(buf, "")
+		bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		bundles := map[string]*Bundle{
+			"bundle1": &bundle1,
+			"bundle2": &bundle2,
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+		err = Activate(&ActivateOpts{
+			Ctx:      ctx,
+			Store:    store,
+			Txn:      txn,
+			Compiler: compiler,
+			Metrics:  m,
+			Bundles:  bundles,
+		})
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		err = store.Commit(ctx, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		// Ensure the snapshot bundles were activated
+		txn = storage.NewTransactionOrDie(ctx, store)
+		names, err := ReadBundleNamesFromStore(ctx, store, txn)
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		if len(names) != len(bundles) {
+			t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+		}
+		for _, name := range names {
+			if _, ok := bundles[name]; !ok {
+				t.Fatalf("unexpected bundle name found in store: %s", name)
+			}
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+
+		// Ensure the patches were applied
+		txn = storage.NewTransactionOrDie(ctx, store)
+
+		actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		expectedRaw := `
+		{
+			"a": {
+				"b": {
+					"u": [1,2,3],
+					"v": true,
+					"w": {"foo": 1},
+					"x": true
+				},
+				"c": {
+					"x": [4,5,6],
+					"y": true
+				}
+			},
+			"system": {
+				"bundles": {
+					"bundle1": {
+						"manifest": {
+							"revision": "foo",
+							"roots": ["a/b"]
+						},
+						"etag": ""
+					},
+					"bundle2": {
+						"manifest": {
+							"revision": "bar",
+							"roots": ["a/c"]
+						},
+						"etag": ""
+					}
+				}
+			}
+		}`
+
+		expected := loadExpectedSortedResult(expectedRaw)
+		if !reflect.DeepEqual(expected, actual) {
+			t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+		}
+
+		// Stop the "read" transaction
+		store.Abort(ctx, txn)
+	})
+}
+
+func TestDeltaBundleLazyModeLifecycle(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	mod1 := "package a\np = true"
+	mod2 := "package b\np = true"
+
+	b := Bundle{
+		Manifest: Manifest{
+			Roots: &[]string{"a"},
+		},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"b": "foo",
+				"e": map[string]interface{}{
+					"f": "bar",
+				},
+				"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+			},
+		},
+		Modules: []ModuleFile{
+			{
+				Path:   "policy.rego",
+				Raw:    []byte(mod1),
+				Parsed: ast.MustParseModule(mod1),
+			},
+		},
+		Etag: "foo",
+	}
+
+	var buf1 bytes.Buffer
+	if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader := NewTarballLoaderWithBaseURL(&buf1, "")
+	bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b = Bundle{
+		Manifest: Manifest{
+			Roots: &[]string{"b", "c"},
+		},
+		Data: nil,
+		Modules: []ModuleFile{
+			{
+				Path:   "policy.rego",
+				Raw:    []byte(mod2),
+				Parsed: ast.MustParseModule(mod2),
+			},
+		},
+		Etag:            "foo",
+		lazyLoadingMode: true,
+		sizeLimitBytes:  DefaultSizeLimitBytes + 1,
+	}
+
+	var buf2 bytes.Buffer
+	if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader = NewTarballLoaderWithBaseURL(&buf2, "")
+	bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle1,
+		"bundle2": &bundle2,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the snapshot bundles were activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// create a delta bundle and activate it
+
+	// add a new object member
+	p1 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d",
+		Value: []string{"foo", "bar"},
+	}
+
+	// append value to array
+	p2 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d/-",
+		Value: "baz",
+	}
+
+	// insert value in array
+	p3 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/x/1",
+		Value: map[string]string{"name": "alice"},
+	}
+
+	// replace a value
+	p4 := PatchOperation{
+		Op:    "replace",
+		Path:  "a/b",
+		Value: "bar",
+	}
+
+	// remove a value
+	p5 := PatchOperation{
+		Op:   "remove",
+		Path: "a/e",
+	}
+
+	// add a new object with an escaped character in the path
+	p6 := PatchOperation{
+		Op:    "upsert",
+		Path:  "a/y/~0z",
+		Value: []int{1, 2, 3},
+	}
+
+	// add a new object root
+	p7 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/c/d",
+		Value: []string{"foo", "bar"},
+	}
+
+	deltaBundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Revision: "delta-1",
+				Roots:    &[]string{"a"},
+			},
+			Patch: Patch{Data: []PatchOperation{p1, p2, p3, p4, p5, p6}},
+			Etag:  "bar",
+		},
+		"bundle2": {
+			Manifest: Manifest{
+				Revision: "delta-2",
+				Roots:    &[]string{"b", "c"},
+			},
+			Patch: Patch{Data: []PatchOperation{p7}},
+			Etag:  "baz",
+		},
+		"bundle3": {
+			Manifest: Manifest{
+				Roots: &[]string{"d"},
+			},
+			Data: map[string]interface{}{
+				"d": map[string]interface{}{
+					"e": "foo",
+				},
+			},
+		},
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  deltaBundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// check the modules from the snapshot bundles are on the compiler
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+	{
+		"a": {
+          "b": "bar",
+	       "c": {
+				"d": ["foo", "bar", "baz"]
+          },
+		   "x": [{"name": "john"}, {"name": "alice"}, {"name": "jane"}],
+		   "y": {"~z": [1, 2, 3]}
+		},
+		"c": {"d": ["foo", "bar"]},
+		"d": {"e": "foo"},
+		"system": {
+			"bundles": {
+				"bundle1": {
+					"manifest": {
+						"revision": "delta-1",
+						"roots": ["a"]
+					},
+					"etag": "bar"
+				},
+				"bundle2": {
+					"manifest": {
+						"revision": "delta-2",
+						"roots": ["b", "c"]
+					},
+					"etag": "baz"
+				},
+				"bundle3": {
+					"manifest": {
+						"revision": "",
+						"roots": ["d"]
+					},
+					"etag": ""
+				}
+			}
+		}
+	}`
+
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	mockStore.AssertValid(t)
+}
+
+func TestDeltaBundleLazyModeWithDefaultRules(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	mod1 := "package a\ndefault p = true"
+	mod2 := "package b\ndefault p = true"
+
+	b := Bundle{
+		Manifest: Manifest{
+			Roots: &[]string{"a"},
+		},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"b": "foo",
+				"e": map[string]interface{}{
+					"f": "bar",
+				},
+				"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+			},
+		},
+		Modules: []ModuleFile{
+			{
+				Path:   "policy.rego",
+				Raw:    []byte(mod1),
+				Parsed: ast.MustParseModule(mod1),
+			},
+		},
+		Etag: "foo",
+	}
+
+	var buf1 bytes.Buffer
+	if err := NewWriter(&buf1).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader := NewTarballLoaderWithBaseURL(&buf1, "")
+	bundle1, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle1").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b = Bundle{
+		Manifest: Manifest{
+			Roots: &[]string{"b", "c"},
+		},
+		Data: nil,
+		Modules: []ModuleFile{
+			{
+				Path:   "policy.rego",
+				Raw:    []byte(mod2),
+				Parsed: ast.MustParseModule(mod2),
+			},
+		},
+		Etag:            "foo",
+		lazyLoadingMode: true,
+		sizeLimitBytes:  DefaultSizeLimitBytes + 1,
+	}
+
+	var buf2 bytes.Buffer
+	if err := NewWriter(&buf2).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+	loader = NewTarballLoaderWithBaseURL(&buf2, "")
+	bundle2, err := NewCustomReader(loader).WithLazyLoadingMode(true).WithBundleName("bundle2").Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundles := map[string]*Bundle{
+		"bundle1": &bundle1,
+		"bundle2": &bundle2,
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the snapshot bundles were activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// create a delta bundle and activate it
+
+	// add a new object member
+	p1 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d",
+		Value: []string{"foo", "bar"},
+	}
+
+	// append value to array
+	p2 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d/-",
+		Value: "baz",
+	}
+
+	// insert value in array
+	p3 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/x/1",
+		Value: map[string]string{"name": "alice"},
+	}
+
+	// replace a value
+	p4 := PatchOperation{
+		Op:    "replace",
+		Path:  "a/b",
+		Value: "bar",
+	}
+
+	// remove a value
+	p5 := PatchOperation{
+		Op:   "remove",
+		Path: "a/e",
+	}
+
+	// add a new object with an escaped character in the path
+	p6 := PatchOperation{
+		Op:    "upsert",
+		Path:  "a/y/~0z",
+		Value: []int{1, 2, 3},
+	}
+
+	// add a new object root
+	p7 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/c/d",
+		Value: []string{"foo", "bar"},
+	}
+
+	deltaBundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Revision: "delta-1",
+				Roots:    &[]string{"a"},
+			},
+			Patch: Patch{Data: []PatchOperation{p1, p2, p3, p4, p5, p6}},
+			Etag:  "bar",
+		},
+		"bundle2": {
+			Manifest: Manifest{
+				Revision: "delta-2",
+				Roots:    &[]string{"b", "c"},
+			},
+			Patch: Patch{Data: []PatchOperation{p7}},
+			Etag:  "baz",
+		},
+		"bundle3": {
+			Manifest: Manifest{
+				Roots: &[]string{"d"},
+			},
+			Data: map[string]interface{}{
+				"d": map[string]interface{}{
+					"e": "foo",
+				},
+			},
+		},
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	expectedModuleCount := len(compiler.Modules)
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  deltaBundles,
+	})
+	if expectedModuleCount != len(compiler.Modules) {
+		t.Fatalf("Expected %d modules, got %d", expectedModuleCount, len(compiler.Modules))
+	}
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// check the modules from the snapshot bundles are on the compiler
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expectedRaw := `
+	{
+		"a": {
+          "b": "bar",
+	       "c": {
+				"d": ["foo", "bar", "baz"]
+          },
+		   "x": [{"name": "john"}, {"name": "alice"}, {"name": "jane"}],
+		   "y": {"~z": [1, 2, 3]}
+		},
+		"c": {"d": ["foo", "bar"]},
+		"d": {"e": "foo"},
+		"system": {
+			"bundles": {
+				"bundle1": {
+					"manifest": {
+						"revision": "delta-1",
+						"roots": ["a"]
+					},
+					"etag": "bar"
+				},
+				"bundle2": {
+					"manifest": {
+						"revision": "delta-2",
+						"roots": ["b", "c"]
+					},
+					"etag": "baz"
+				},
+				"bundle3": {
+					"manifest": {
+						"revision": "",
+						"roots": ["d"]
+					},
+					"etag": ""
+				}
+			}
+		}
+	}`
+
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	mockStore.AssertValid(t)
+}
+
+func TestBundleLifecycle(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	extraMods := map[string]*ast.Module{
+		"mod1": ast.MustParseModule("package x\np = true"),
+	}
+
+	const mod2 = "package a\np = true"
+	mod3 := "package b\np = true"
+
+	bundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Roots: &[]string{"a"},
+			},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod2),
+					Parsed: ast.MustParseModule(mod2),
+				},
+			},
+			Etag: "foo"},
+		"bundle2": {
+			Manifest: Manifest{
+				Roots: &[]string{"b", "c"},
+			},
+			Data: nil,
+			Modules: []ModuleFile{
+				{
+					Path:   "b/policy.rego",
+					Raw:    []byte(mod3),
+					Parsed: ast.MustParseModule(mod3),
+				},
+			},
+		},
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err := Activate(&ActivateOpts{
+		Ctx:          ctx,
+		Store:        mockStore,
+		Txn:          txn,
+		Compiler:     compiler,
+		Metrics:      m,
+		Bundles:      bundles,
+		ExtraModules: extraMods,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the bundle was activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+	expectedRaw := `
+{
+	"a": {
+		"b": "foo"
+	},
+	"system": {
+		"bundles": {
+			"bundle1": {
+				"manifest": {
+					"revision": "",
+					"roots": ["a"]
+				},
+				"etag": "foo"
+			},
+			"bundle2": {
+				"manifest": {
+					"revision": "",
+					"roots": ["b", "c"]
+				},
+				"etag": ""
+			}
+		}
+	}
+}
+`
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	// Ensure that the extra module was included
+	if _, ok := compiler.Modules["mod1"]; !ok {
+		t.Fatalf("expected extra module to be compiled")
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Deactivate(&DeactivateOpts{
+		Ctx:         ctx,
+		Store:       mockStore,
+		Txn:         txn,
+		BundleNames: map[string]struct{}{"bundle1": {}, "bundle2": {}},
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Expect the store to have been cleared out after deactivating the bundles
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err = ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(names) != 0 {
+		t.Fatalf("expected 0 bundles in store, found %d", len(names))
+	}
+
+	actual, err = mockStore.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+	expectedRaw = `{"system": {"bundles": {}}}`
+	expected = loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+	}
+
+	mockStore.AssertValid(t)
+}
+
+func TestDeltaBundleLifecycle(t *testing.T) {
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	mod1 := "package a\np = true"
+	mod2 := "package b\np = true"
+
+	bundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Roots: &[]string{"a"},
+			},
+			Data: map[string]interface{}{
+				"a": map[string]interface{}{
+					"b": "foo",
+					"e": map[string]interface{}{
+						"f": "bar",
+					},
+					"x": []map[string]string{{"name": "john"}, {"name": "jane"}},
+				},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+			Etag: "foo",
+		},
+		"bundle2": {
+			Manifest: Manifest{
+				Roots: &[]string{"b", "c"},
+			},
+			Data: nil,
+			Modules: []ModuleFile{
+				{
+					Path:   "b/policy.rego",
+					Raw:    []byte(mod2),
+					Parsed: ast.MustParseModule(mod2),
+				},
+			},
+		},
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err := Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	// Ensure the snapshot bundles were activated
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
+	}
+
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
+			}
+		}
+	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// create a delta bundle and activate it
+
+	// add a new object member
+	p1 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d",
+		Value: []string{"foo", "bar"},
+	}
+
+	// append value to array
+	p2 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d/-",
+		Value: "baz",
+	}
+
+	// insert value in array
+	p3 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/x/1",
+		Value: map[string]string{"name": "alice"},
+	}
+
+	// replace a value
+	p4 := PatchOperation{
+		Op:    "replace",
+		Path:  "a/b",
+		Value: "bar",
+	}
+
+	// remove a value
+	p5 := PatchOperation{
+		Op:   "remove",
+		Path: "a/e",
+	}
+
+	// add a new object with an escaped character in the path
+	p6 := PatchOperation{
+		Op:    "upsert",
+		Path:  "a/y/~0z",
+		Value: []int{1, 2, 3},
+	}
+
+	// add a new object root
+	p7 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/c/d",
+		Value: []string{"foo", "bar"},
+	}
+
+	deltaBundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Revision: "delta-1",
+				Roots:    &[]string{"a"},
+			},
+			Patch: Patch{Data: []PatchOperation{p1, p2, p3, p4, p5, p6}},
+			Etag:  "bar",
+		},
+		"bundle2": {
+			Manifest: Manifest{
+				Revision: "delta-2",
+				Roots:    &[]string{"b", "c"},
+			},
+			Patch: Patch{Data: []PatchOperation{p7}},
+			Etag:  "baz",
+		},
+		"bundle3": {
+			Manifest: Manifest{
+				Roots: &[]string{"d"},
+			},
+			Data: map[string]interface{}{
+				"d": map[string]interface{}{
+					"e": "foo",
+				},
+			},
+		},
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  deltaBundles,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
 	}
 
-	if len(actualNames) != len(expected) {
-		t.Fatalf("Expected %d name, found %d \n\t\tActual: %v\n", len(expected), len(actualNames), actualNames)
+	err = mockStore.Commit(ctx, txn)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
 	}
 
-	for _, actualName := range actualNames {
-		found := false
-		for _, expectedName := range expected {
-			if actualName == expectedName {
-				found = true
-				break
+	// check the modules from the snapshot bundles are on the compiler
+	for bundleName, bundle := range bundles {
+		for modName := range bundle.ParsedModules(bundleName) {
+			if _, ok := compiler.Modules[modName]; !ok {
+				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
 			}
 		}
-		if !found {
-			t.Errorf("Found unexpecxted bundle name %s, expected names: %+v", actualName, expected)
-		}
 	}
-}
 
-func verifyReadLegacyRevision(ctx context.Context, t *testing.T, store storage.Store, expected string) {
-	t.Helper()
-	var actual string
-	err := storage.Txn(ctx, store, storage.WriteParams, func(txn storage.Transaction) error {
-		var err error
-		if actual, err = LegacyReadRevisionFromStore(ctx, store, txn); err != nil && !storage.IsNotFound(err) {
-			t.Fatalf("Failed to read manifest revision from store: %s", err)
-			return err
-		}
-		return nil
-	})
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
+
+	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
 	if err != nil {
-		t.Fatalf("Unexpected error finishing transaction: %s", err)
+		t.Fatalf("unexpected error: %s", err)
 	}
 
-	if actual != expected {
-		t.Fatalf("Expected revision %s, got %s", expected, actual)
+	expectedRaw := `
+	{
+		"a": {
+           "b": "bar",
+	       "c": {
+				"d": ["foo", "bar", "baz"]
+           },
+		   "x": [{"name": "john"}, {"name": "alice"}, {"name": "jane"}],
+		   "y": {"~z": [1, 2, 3]}
+		},
+		"c": {"d": ["foo", "bar"]},
+		"d": {"e": "foo"},
+		"system": {
+			"bundles": {
+				"bundle1": {
+					"manifest": {
+						"revision": "delta-1",
+						"roots": ["a"]
+					},
+					"etag": "bar"
+				},
+				"bundle2": {
+					"manifest": {
+						"revision": "delta-2",
+						"roots": ["b", "c"]
+					},
+					"etag": "baz"
+				},
+				"bundle3": {
+					"manifest": {
+						"revision": "",
+						"roots": ["d"]
+					},
+					"etag": ""
+				}
+			}
+		}
+	}`
+
+	expected := loadExpectedSortedResult(expectedRaw)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
 	}
+
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	mockStore.AssertValid(t)
 }
 
-func TestBundleLifecycle(t *testing.T) {
+func TestDeltaBundleActivate(t *testing.T) {
+
 	ctx := context.Background()
 	mockStore := mock.New()
 
 	compiler := ast.NewCompiler()
 	m := metrics.New()
 
-	extraMods := map[string]*ast.Module{
-		"mod1": ast.MustParseModule("package x\np = true"),
+	// create a delta bundle
+	p1 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d",
+		Value: []string{"foo", "bar"},
 	}
 
-	mod2 := "package a\np = true"
-	mod3 := "package b\np = true"
-
-	bundles := map[string]*Bundle{
+	deltaBundles := map[string]*Bundle{
 		"bundle1": {
 			Manifest: Manifest{
-				Roots: &[]string{"a"},
-			},
-			Data: map[string]interface{}{
-				"a": map[string]interface{}{
-					"b": "foo",
-				},
-			},
-			Modules: []ModuleFile{
-				{
-					Path:   "a/policy.rego",
-					Raw:    []byte(mod2),
-					Parsed: ast.MustParseModule(mod2),
-				},
-			},
-		},
-		"bundle2": {
-			Manifest: Manifest{
-				Roots: &[]string{"b", "c"},
-			},
-			Data: nil,
-			Modules: []ModuleFile{
-				{
-					Path:   "b/policy.rego",
-					Raw:    []byte(mod3),
-					Parsed: ast.MustParseModule(mod3),
-				},
+				Revision: "delta",
+				Roots:    &[]string{"a"},
 			},
+			Patch: Patch{Data: []PatchOperation{p1}},
+			Etag:  "foo",
 		},
 	}
 
 	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
 
 	err := Activate(&ActivateOpts{
-		Ctx:          ctx,
-		Store:        mockStore,
-		Txn:          txn,
-		Compiler:     compiler,
-		Metrics:      m,
-		Bundles:      bundles,
-		ExtraModules: extraMods,
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  deltaBundles,
 	})
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
@@ -279,77 +3960,99 @@ func TestBundleLifecycle(t *testing.T) {
 		t.Fatalf("unexpected error: %s", err)
 	}
 
-	// Ensure the bundle was activated
+	// Ensure the delta bundle was activated
 	txn = storage.NewTransactionOrDie(ctx, mockStore)
 	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("unexpected error: %s", err)
 	}
 
-	if len(names) != len(bundles) {
-		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	if len(names) != len(deltaBundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(deltaBundles), len(names))
 	}
+
 	for _, name := range names {
-		if _, ok := bundles[name]; !ok {
+		if _, ok := deltaBundles[name]; !ok {
 			t.Fatalf("unexpected bundle name found in store: %s", name)
 		}
 	}
 
-	for bundleName, bundle := range bundles {
-		for modName := range bundle.ParsedModules(bundleName) {
-			if _, ok := compiler.Modules[modName]; !ok {
-				t.Fatalf("expected module %s from bundle %s to have been compiled", modName, bundleName)
-			}
-		}
-	}
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// Ensure the patches were applied
+	txn = storage.NewTransactionOrDie(ctx, mockStore)
 
 	actual, err := mockStore.Read(ctx, txn, storage.MustParsePath("/"))
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
+
 	expectedRaw := `
-{
-	"a": {
-		"b": "foo"
-	},
-	"system": {
-		"bundles": {
-			"bundle1": {
-				"manifest": {
-					"revision": "",
-					"roots": ["a"]
-				}
-			},
-			"bundle2": {
-				"manifest": {
-					"revision": "",
-					"roots": ["b", "c"]
+	{
+		"a": {
+	       "c": {
+				"d": ["foo", "bar"]
+           }
+		},
+		"system": {
+			"bundles": {
+				"bundle1": {
+					"manifest": {
+						"revision": "delta",
+						"roots": ["a"]
+					},
+					"etag": "foo"
 				}
 			}
 		}
 	}
-}
-`
+	`
 	expected := loadExpectedSortedResult(expectedRaw)
 	if !reflect.DeepEqual(expected, actual) {
 		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
 	}
 
-	// Ensure that the extra module was included
-	if _, ok := compiler.Modules["mod1"]; !ok {
-		t.Fatalf("expected extra module to be compiled")
-	}
-
 	// Stop the "read" transaction
 	mockStore.Abort(ctx, txn)
 
-	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+	mockStore.AssertValid(t)
+}
 
-	err = Deactivate(&DeactivateOpts{
-		Ctx:         ctx,
-		Store:       mockStore,
-		Txn:         txn,
-		BundleNames: map[string]struct{}{"bundle1": {}, "bundle2": {}},
+func TestDeltaBundleBadManifest(t *testing.T) {
+
+	ctx := context.Background()
+	mockStore := mock.New()
+
+	compiler := ast.NewCompiler()
+	m := metrics.New()
+
+	mod1 := "package a\np = true"
+
+	bundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Roots: &[]string{"a"},
+			},
+			Modules: []ModuleFile{
+				{
+					Path:   "a/policy.rego",
+					Raw:    []byte(mod1),
+					Parsed: ast.MustParseModule(mod1),
+				},
+			},
+		},
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err := Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  bundles,
 	})
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
@@ -360,25 +4063,59 @@ func TestBundleLifecycle(t *testing.T) {
 		t.Fatalf("unexpected error: %s", err)
 	}
 
-	// Expect the store to have been cleared out after deactivating the bundles
+	// Ensure the snapshot bundle was activated
 	txn = storage.NewTransactionOrDie(ctx, mockStore)
-	names, err = ReadBundleNamesFromStore(ctx, mockStore, txn)
+	names, err := ReadBundleNamesFromStore(ctx, mockStore, txn)
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("unexpected error: %s", err)
 	}
 
-	if len(names) != 0 {
-		t.Fatalf("expected 0 bundles in store, found %d", len(names))
+	if len(names) != len(bundles) {
+		t.Fatalf("expected %d bundles in store, found %d", len(bundles), len(names))
+	}
+	for _, name := range names {
+		if _, ok := bundles[name]; !ok {
+			t.Fatalf("unexpected bundle name found in store: %s", name)
+		}
 	}
 
-	actual, err = mockStore.Read(ctx, txn, storage.MustParsePath("/"))
-	if err != nil {
-		t.Fatalf("unexpected error: %s", err)
+	// Stop the "read" transaction
+	mockStore.Abort(ctx, txn)
+
+	// create a delta bundle with a different manifest from the snapshot bundle
+
+	p1 := PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/c/d",
+		Value: []string{"foo", "bar"},
 	}
-	expectedRaw = `{"system": {"bundles": {}}}`
-	expected = loadExpectedSortedResult(expectedRaw)
-	if !reflect.DeepEqual(expected, actual) {
-		t.Errorf("expected %v, got %v", expectedRaw, string(util.MustMarshalJSON(actual)))
+
+	deltaBundles := map[string]*Bundle{
+		"bundle1": {
+			Manifest: Manifest{
+				Roots: &[]string{"b"},
+			},
+			Patch: Patch{Data: []PatchOperation{p1}},
+		},
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, mockStore, storage.WriteParams)
+
+	err = Activate(&ActivateOpts{
+		Ctx:      ctx,
+		Store:    mockStore,
+		Txn:      txn,
+		Compiler: compiler,
+		Metrics:  m,
+		Bundles:  deltaBundles,
+	})
+	if err == nil {
+		t.Fatal("expected error but got nil")
+	}
+
+	expected := "delta bundle 'bundle1' has wasm resolvers or manifest roots that are different from those in the store"
+	if err.Error() != expected {
+		t.Fatalf("Expected error %v but got %v", expected, err.Error())
 	}
 
 	mockStore.AssertValid(t)
@@ -984,6 +4721,128 @@ func testWriteData(t *testing.T, tc testWriteModuleCase, legacy bool) {
 	})
 }
 
+func TestDoDFS(t *testing.T) {
+
+	cases := []struct {
+		note    string
+		input   map[string]json.RawMessage
+		path    string
+		roots   []string
+		wantErr bool
+		err     error
+	}{
+		{
+			note:    "bundle owns all",
+			input:   nil,
+			path:    "/",
+			roots:   []string{""},
+			wantErr: false,
+		},
+		{
+			note:    "data within roots root case",
+			input:   map[string]json.RawMessage{"a": json.RawMessage(`true`)},
+			path:    "",
+			roots:   []string{"a"},
+			wantErr: false,
+		},
+		{
+			note:    "data within roots nested 1",
+			input:   map[string]json.RawMessage{"d": json.RawMessage(`true`)},
+			path:    filepath.Dir(strings.Trim("a/b/c/data.json", "/")),
+			roots:   []string{"a/b/c"},
+			wantErr: false,
+		},
+		{
+			note:    "data within roots nested 2",
+			input:   map[string]json.RawMessage{"d": json.RawMessage(`{"hello": "world"}`)},
+			path:    filepath.Dir(strings.Trim("a/b/c/data.json", "/")),
+			roots:   []string{"a/b/c"},
+			wantErr: false,
+		},
+		{
+			note:    "data within roots nested 3",
+			input:   map[string]json.RawMessage{"d": json.RawMessage(`{"hello": "world"}`)},
+			path:    filepath.Dir(strings.Trim("a/data.json", "/")),
+			roots:   []string{"a/d"},
+			wantErr: false,
+		},
+		{
+			note:    "data within multiple roots 1",
+			input:   map[string]json.RawMessage{"a": json.RawMessage(`{"b": "c"}`), "c": json.RawMessage(`true`)},
+			path:    filepath.Dir(strings.Trim("/data.json", "/")),
+			roots:   []string{"a/b", "c"},
+			wantErr: false,
+		},
+		{
+			note:    "data within multiple roots 2",
+			input:   map[string]json.RawMessage{"a": json.RawMessage(`{"b": "c"}`), "c": []byte(`{"d": {"e": {"f": true}}}`)},
+			path:    filepath.Dir(strings.Trim("/data.json", "/")),
+			roots:   []string{"a/b", "c/d/e"},
+			wantErr: false,
+		},
+		{
+			note:    "data outside roots 1",
+			input:   map[string]json.RawMessage{"d": json.RawMessage(`{"hello": "world"}`)},
+			path:    filepath.Dir(strings.Trim("/data.json", "/")),
+			roots:   []string{"a/d"},
+			wantErr: true,
+			err:     fmt.Errorf("manifest roots [a/d] do not permit data at path '/d' (hint: check bundle directory structure)"),
+		},
+		{
+			note:    "data outside roots 2",
+			input:   map[string]json.RawMessage{"a": []byte(`{"b": {"c": {"e": true}}}`)},
+			path:    filepath.Dir(strings.Trim("/x/data.json", "/")),
+			roots:   []string{"x/a/b/c/d"},
+			wantErr: true,
+			err:     fmt.Errorf("manifest roots [x/a/b/c/d] do not permit data at path '/x/a/b/c/e' (hint: check bundle directory structure)"),
+		},
+		{
+			note:    "data outside roots 3",
+			input:   map[string]json.RawMessage{"a": []byte(`{"b": {"c": true}}`)},
+			path:    filepath.Dir(strings.Trim("/data.json", "/")),
+			roots:   []string{"a/b/c/d"},
+			wantErr: true,
+			err:     fmt.Errorf("manifest roots [a/b/c/d] do not permit data at path '/a/b/c' (hint: check bundle directory structure)"),
+		},
+		{
+			note:    "data outside multiple roots",
+			input:   map[string]json.RawMessage{"a": json.RawMessage(`{"b": "c"}`), "e": []byte(`{"b": {"c": true}}`)},
+			path:    filepath.Dir(strings.Trim("/data.json", "/")),
+			roots:   []string{"a/b", "c"},
+			wantErr: true,
+			err:     fmt.Errorf("manifest roots [a/b c] do not permit data at path '/e' (hint: check bundle directory structure)"),
+		},
+		{
+			note:    "data outside multiple roots 2",
+			input:   map[string]json.RawMessage{"a": json.RawMessage(`{"b": "c"}`), "c": []byte(`{"d": true}`)},
+			path:    filepath.Dir(strings.Trim("/data.json", "/")),
+			roots:   []string{"a/b", "c/d/e"},
+			wantErr: true,
+			err:     fmt.Errorf("manifest roots [a/b c/d/e] do not permit data at path '/c/d' (hint: check bundle directory structure)"),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+
+			err := doDFS(tc.input, tc.path, tc.roots)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatal("Expected error but got nil")
+				}
+
+				if tc.err != nil && tc.err.Error() != err.Error() {
+					t.Fatalf("Expected error message %v but got %v", tc.err.Error(), err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("Unexpected error %v", err)
+				}
+			}
+		})
+	}
+}
+
 func TestHasRootsOverlap(t *testing.T) {
 	ctx := context.Background()
 
diff --git a/bundle/verify.go b/bundle/verify.go
index f76baf2c8e..e85be835be 100644
--- a/bundle/verify.go
+++ b/bundle/verify.go
@@ -16,8 +16,6 @@ import (
 	"github.com/open-policy-agent/opa/internal/jwx/jws"
 	"github.com/open-policy-agent/opa/internal/jwx/jws/verify"
 	"github.com/open-policy-agent/opa/util"
-
-	"github.com/pkg/errors"
 )
 
 const defaultVerifierID = "_default"
@@ -92,12 +90,12 @@ func verifyJWTSignature(token string, bvc *VerificationConfig) (*DecodedSignatur
 
 	var decodedHeader []byte
 	if decodedHeader, err = base64.RawURLEncoding.DecodeString(parts[0]); err != nil {
-		return nil, errors.Wrap(err, "failed to base64 decode JWT headers")
+		return nil, fmt.Errorf("failed to base64 decode JWT headers: %w", err)
 	}
 
 	var hdr jws.StandardHeaders
 	if err := json.Unmarshal(decodedHeader, &hdr); err != nil {
-		return nil, errors.Wrap(err, "failed to parse JWT headers")
+		return nil, fmt.Errorf("failed to parse JWT headers: %w", err)
 	}
 
 	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
diff --git a/bundle/verify_test.go b/bundle/verify_test.go
index 4021b4981f..fb4cd02c56 100644
--- a/bundle/verify_test.go
+++ b/bundle/verify_test.go
@@ -6,7 +6,7 @@ package bundle
 
 import (
 	"bytes"
-	"fmt"
+	"errors"
 	"testing"
 )
 
@@ -24,20 +24,20 @@ func TestVerifyBundleSignature(t *testing.T) {
 		wantErr            bool
 		err                error
 	}{
-		"no_signatures":       {SignaturesConfig{}, nil, true, fmt.Errorf(".signatures.json: missing JWT (expected exactly one)")},
-		"multiple_signatures": {SignaturesConfig{Signatures: []string{signedTokenHS256, otherSignedTokenHS256}}, nil, true, fmt.Errorf(".signatures.json: multiple JWTs not supported (expected exactly one)")},
-		"invalid_token":       {SignaturesConfig{Signatures: []string{badToken}}, nil, true, fmt.Errorf("Failed to split compact serialization")},
+		"no_signatures":       {SignaturesConfig{}, nil, true, errors.New(".signatures.json: missing JWT (expected exactly one)")},
+		"multiple_signatures": {SignaturesConfig{Signatures: []string{signedTokenHS256, otherSignedTokenHS256}}, nil, true, errors.New(".signatures.json: multiple JWTs not supported (expected exactly one)")},
+		"invalid_token":       {SignaturesConfig{Signatures: []string{badToken}}, nil, true, errors.New("failed to split compact serialization")},
 		"invalid_token_header_base64": {
 			SignaturesConfig{Signatures: []string{badTokenHeaderBase64}},
 			NewVerificationConfig(nil, "", "", nil),
-			true, fmt.Errorf("failed to base64 decode JWT headers: illegal base64 data at input byte 50"),
+			true, errors.New("failed to base64 decode JWT headers: illegal base64 data at input byte 50"),
 		},
 		"invalid_token_header_json": {
 			SignaturesConfig{Signatures: []string{badTokenHeaderJSON}},
 			NewVerificationConfig(nil, "", "", nil),
-			true, fmt.Errorf("failed to parse JWT headers: unexpected end of JSON input"),
+			true, errors.New("failed to parse JWT headers: unexpected end of JSON input"),
 		},
-		"bad_token_payload": {SignaturesConfig{Signatures: []string{badTokenPayload}}, nil, true, fmt.Errorf("json: cannot unmarshal object into Go struct field DecodedSignature.files of type []bundle.FileInfo")},
+		"bad_token_payload": {SignaturesConfig{Signatures: []string{badTokenPayload}}, nil, true, errors.New("json: cannot unmarshal object into Go struct field DecodedSignature.files of type []bundle.FileInfo")},
 		"valid_token_and_scope": {
 			SignaturesConfig{Signatures: []string{signedTokenHS256}},
 			NewVerificationConfig(map[string]*KeyConfig{"foo": {Key: "secret", Algorithm: "HS256"}}, "", "write", nil),
@@ -46,7 +46,7 @@ func TestVerifyBundleSignature(t *testing.T) {
 		"valid_token_and_scope_mismatch": {
 			SignaturesConfig{Signatures: []string{signedTokenHS256}},
 			NewVerificationConfig(map[string]*KeyConfig{"foo": {Key: "secret", Algorithm: "HS256"}}, "", "bad_scope", nil),
-			true, fmt.Errorf("scope mismatch"),
+			true, errors.New("scope mismatch"),
 		},
 	}
 
@@ -158,8 +158,8 @@ yQjtQ8mbDOsiLLvh7wIDAQAB==
 		wantErr bool
 		err     error
 	}{
-		"no_public_key_id":          {signedNoKeyIDTokenHS256, map[string]*KeyConfig{}, "", "", true, fmt.Errorf("verification key ID is empty")},
-		"actual_public_key_missing": {signedTokenHS256, map[string]*KeyConfig{}, "", "", true, fmt.Errorf("verification key corresponding to ID foo not found")},
+		"no_public_key_id":          {signedNoKeyIDTokenHS256, map[string]*KeyConfig{}, "", "", true, errors.New("verification key ID is empty")},
+		"actual_public_key_missing": {signedTokenHS256, map[string]*KeyConfig{}, "", "", true, errors.New("verification key corresponding to ID foo not found")},
 		"deprecated_key_id_claim": {
 			signedTokenWithDeprecatedKidClaimHS256,
 			map[string]*KeyConfig{"foo": {Key: "secret", Algorithm: "HS256"}}, "", "write", // check valid keyId in deprecated claim is used
@@ -168,7 +168,7 @@ yQjtQ8mbDOsiLLvh7wIDAQAB==
 		"bad_public_key_algorithm": {
 			signedTokenHS256,
 			map[string]*KeyConfig{"foo": {Key: "somekey", Algorithm: "RS007"}}, "", "",
-			true, fmt.Errorf("unsupported signature algorithm: RS007"),
+			true, errors.New("unsupported signature algorithm: RS007"),
 		},
 		"public_key_with_valid_HS256_sign": {
 			signedTokenWithBarKidHS256,
@@ -178,7 +178,7 @@ yQjtQ8mbDOsiLLvh7wIDAQAB==
 		"public_key_with_invalid_HS256_sign": {
 			signedTokenHS256,
 			map[string]*KeyConfig{"foo": {Key: "bad_secret", Algorithm: "HS256"}}, "", "",
-			true, fmt.Errorf("Failed to verify message: failed to match hmac signature"),
+			true, errors.New("failed to verify message: failed to match hmac signature"),
 		},
 		"public_key_with_valid_RS256_sign": {
 			signedTokenRS256,
@@ -188,12 +188,12 @@ yQjtQ8mbDOsiLLvh7wIDAQAB==
 		"public_key_with_invalid_RS256_sign": {
 			signedTokenRS256,
 			map[string]*KeyConfig{"foo": {Key: publicKeyInvalid, Algorithm: "RS256"}}, "", "",
-			true, fmt.Errorf("Failed to verify message: crypto/rsa: verification error"),
+			true, errors.New("failed to verify message: crypto/rsa: verification error"),
 		},
 		"public_key_with_bad_cert_RS256": {
 			signedTokenRS256,
 			map[string]*KeyConfig{"foo": {Key: publicKeyBad, Algorithm: "RS256"}}, "foo", "",
-			true, fmt.Errorf("failed to parse PEM block containing the key"),
+			true, errors.New("failed to parse PEM block containing the key"),
 		},
 	}
 
@@ -242,7 +242,7 @@ func TestVerifyBundleFile(t *testing.T) {
 		"file_not_found": {
 			[][2]string{{"/.manifest", `{"revision": "quickbrownfaux"}`}},
 			map[string]FileInfo{},
-			true, fmt.Errorf("file /.manifest not included in bundle signature"),
+			true, errors.New("file /.manifest not included in bundle signature"),
 		},
 		"bad_hashing_algorithm": {
 			[][2]string{{"/.manifest", `{"revision": "quickbrownfaux"}`}},
@@ -251,7 +251,7 @@ func TestVerifyBundleFile(t *testing.T) {
 				Hash:      "e7dc95e14ad6cd75d044c13d52ee3ab1",
 				Algorithm: "MD6",
 			}},
-			true, fmt.Errorf("unsupported hashing algorithm: MD6"),
+			true, errors.New("unsupported hashing algorithm: MD6"),
 		},
 		"bad_digest": {
 			[][2]string{{"/.manifest", `{"revision": "quickbrownfaux"}`}},
@@ -260,7 +260,7 @@ func TestVerifyBundleFile(t *testing.T) {
 				Hash:      "874984d68515ba2439c04dddf5b21574",
 				Algorithm: MD5.String(),
 			}},
-			true, fmt.Errorf("/.manifest: digest mismatch (want: 874984d68515ba2439c04dddf5b21574, got: a005c38a509dc2d5a7407b9494efb2ad)"),
+			true, errors.New("/.manifest: digest mismatch (want: 874984d68515ba2439c04dddf5b21574, got: a005c38a509dc2d5a7407b9494efb2ad)"),
 		},
 	}
 
diff --git a/capabilities.json b/capabilities.json
index d9a04bf152..bfa43f4a59 100644
--- a/capabilities.json
+++ b/capabilities.json
@@ -123,6 +123,26 @@
         "type": "function"
       }
     },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "array.slice",
       "decl": {
@@ -552,6 +572,23 @@
         "type": "function"
       }
     },
+    {
+      "name": "crypto.hmac.equal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "crypto.hmac.md5",
       "decl": {
@@ -874,10 +911,18 @@
             "type": "string"
           },
           {
-            "dynamic": {
-              "type": "string"
-            },
-            "type": "array"
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
           },
           {
             "type": "string"
@@ -960,31 +1005,104 @@
       }
     },
     {
-      "name": "gt",
+      "name": "graph.reachable_paths",
       "decl": {
         "args": [
           {
-            "type": "any"
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
           },
           {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
             "type": "any"
           }
         ],
         "result": {
-          "type": "boolean"
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
         },
         "type": "function"
-      },
-      "infix": "\u003e"
+      }
     },
     {
-      "name": "gte",
+      "name": "graphql.is_valid",
       "decl": {
         "args": [
           {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
             "type": "any"
           },
           {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
             "type": "any"
           }
         ],
@@ -992,81 +1110,360 @@
           "type": "boolean"
         },
         "type": "function"
-      },
-      "infix": "\u003e="
-    },
-    {
-      "name": "hex.decode",
-      "decl": {
-        "args": [
-          {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
       }
     },
     {
-      "name": "hex.encode",
+      "name": "graphql.parse",
       "decl": {
         "args": [
           {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "string"
-        },
-        "type": "function"
-      }
-    },
-    {
-      "name": "http.send",
-      "decl": {
-        "args": [
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
           {
-            "dynamic": {
-              "key": {
+            "of": [
+              {
                 "type": "string"
               },
-              "value": {
-                "type": "any"
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
               }
-            },
-            "type": "object"
+            ],
+            "type": "any"
           }
         ],
         "result": {
-          "dynamic": {
-            "key": {
-              "type": "any"
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
             },
-            "value": {
-              "type": "any"
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
             }
-          },
-          "type": "object"
+          ],
+          "type": "array"
         },
         "type": "function"
       }
     },
     {
-      "name": "indexof",
+      "name": "graphql.parse_and_verify",
       "decl": {
         "args": [
           {
-            "type": "string"
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
           },
           {
-            "type": "string"
-          }
-        ],
-        "result": {
-          "type": "number"
-        },
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
         "type": "function"
       }
     },
@@ -1240,7 +1637,8 @@
           "type": "array"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "io.jwt.encode_sign",
@@ -1284,7 +1682,8 @@
           "type": "string"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "io.jwt.encode_sign_raw",
@@ -1304,7 +1703,8 @@
           "type": "string"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "io.jwt.verify_es256",
@@ -1692,7 +2092,93 @@
           }
         ],
         "result": {
-          "type": "string"
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.match_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "static": [
+                  {
+                    "key": "desc",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "error",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "field",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "type",
+                    "value": {
+                      "type": "string"
+                    }
+                  }
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
         },
         "type": "function"
       }
@@ -1814,6 +2300,52 @@
         "type": "function"
       }
     },
+    {
+      "name": "json.verify_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "of": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "lower",
       "decl": {
@@ -2208,6 +2740,20 @@
         "type": "function"
       }
     },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "net.cidr_merge",
       "decl": {
@@ -2276,7 +2822,8 @@
           "type": "set"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "numbers.range",
@@ -2376,6 +2923,31 @@
         "type": "function"
       }
     },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "object.remove",
       "decl": {
@@ -2426,6 +2998,73 @@
         "type": "function"
       }
     },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "object.union",
       "decl": {
@@ -2459,6 +3098,31 @@
         "type": "function"
       }
     },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "opa.runtime",
       "decl": {
@@ -2474,7 +3138,8 @@
           "type": "object"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "or",
@@ -2535,25 +3200,69 @@
       "decl": {
         "args": [
           {
-            "of": [
-              {
-                "dynamic": {
-                  "type": "number"
-                },
-                "type": "array"
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
               },
-              {
-                "of": {
-                  "type": "number"
-                },
-                "type": "set"
+              "value": {
+                "type": "any"
               }
-            ],
-            "type": "any"
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
           }
         ],
         "result": {
-          "type": "number"
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
         },
         "type": "function"
       }
@@ -2573,7 +3282,8 @@
           "type": "number"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "re_match",
@@ -2689,6 +3399,26 @@
         "type": "function"
       }
     },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "regex.split",
       "decl": {
@@ -2732,6 +3462,27 @@
         "type": "function"
       }
     },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "rego.parse_module",
       "decl": {
@@ -2954,6 +3705,108 @@
         "type": "function"
       }
     },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "strings.replace_n",
       "decl": {
@@ -2979,6 +3832,20 @@
         "type": "function"
       }
     },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "substring",
       "decl": {
@@ -3201,6 +4068,50 @@
         "type": "function"
       }
     },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "time.now_ns",
       "decl": {
@@ -3208,7 +4119,8 @@
           "type": "number"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "time.parse_duration_ns",
@@ -3431,11 +4343,6 @@
       "decl": {
         "args": [
           {
-            "of": [
-              {
-                "type": "any"
-              }
-            ],
             "type": "any"
           }
         ],
@@ -3468,6 +4375,20 @@
         "type": "function"
       }
     },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
     {
       "name": "units.parse_bytes",
       "decl": {
@@ -3600,7 +4521,8 @@
           "type": "string"
         },
         "type": "function"
-      }
+      },
+      "nondeterministic": true
     },
     {
       "name": "walk",
@@ -3672,6 +4594,9 @@
     }
   ],
   "future_keywords": [
+    "contains",
+    "every",
+    "if",
     "in"
   ],
   "wasm_abi_versions": [
@@ -3683,5 +4608,8 @@
       "version": 1,
       "minor_version": 2
     }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
   ]
 }
diff --git a/capabilities/capabilities.go b/capabilities/capabilities.go
index 1266df1db0..ba32cf977e 100644
--- a/capabilities/capabilities.go
+++ b/capabilities/capabilities.go
@@ -14,5 +14,6 @@ import (
 // FS contains the embedded capabilities/ directory of the built version,
 // which has all the capabilities of previous versions:
 // "v0.18.0.json" contains the capabilities JSON of version v0.18.0, etc
+//
 //go:embed *.json
 var FS embed.FS
diff --git a/capabilities/v0.36.0.json b/capabilities/v0.36.0.json
new file mode 100644
index 0000000000..bedf071665
--- /dev/null
+++ b/capabilities/v0.36.0.json
@@ -0,0 +1,3721 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.36.1.json b/capabilities/v0.36.1.json
new file mode 100644
index 0000000000..bedf071665
--- /dev/null
+++ b/capabilities/v0.36.1.json
@@ -0,0 +1,3721 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.37.0.json b/capabilities/v0.37.0.json
new file mode 100644
index 0000000000..e8736d8d0f
--- /dev/null
+++ b/capabilities/v0.37.0.json
@@ -0,0 +1,3825 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.37.1.json b/capabilities/v0.37.1.json
new file mode 100644
index 0000000000..e8736d8d0f
--- /dev/null
+++ b/capabilities/v0.37.1.json
@@ -0,0 +1,3825 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.37.2.json b/capabilities/v0.37.2.json
new file mode 100644
index 0000000000..e8736d8d0f
--- /dev/null
+++ b/capabilities/v0.37.2.json
@@ -0,0 +1,3825 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.38.0.json b/capabilities/v0.38.0.json
new file mode 100644
index 0000000000..d5edb2daa7
--- /dev/null
+++ b/capabilities/v0.38.0.json
@@ -0,0 +1,3826 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "every",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.38.1.json b/capabilities/v0.38.1.json
new file mode 100644
index 0000000000..d5edb2daa7
--- /dev/null
+++ b/capabilities/v0.38.1.json
@@ -0,0 +1,3826 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "every",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.39.0.json b/capabilities/v0.39.0.json
new file mode 100644
index 0000000000..d5edb2daa7
--- /dev/null
+++ b/capabilities/v0.39.0.json
@@ -0,0 +1,3826 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "every",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.40.0.json b/capabilities/v0.40.0.json
new file mode 100644
index 0000000000..2f9e6e6409
--- /dev/null
+++ b/capabilities/v0.40.0.json
@@ -0,0 +1,3847 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "every",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.41.0.json b/capabilities/v0.41.0.json
new file mode 100644
index 0000000000..cf56e6cacd
--- /dev/null
+++ b/capabilities/v0.41.0.json
@@ -0,0 +1,4007 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "every",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.42.0.json b/capabilities/v0.42.0.json
new file mode 100644
index 0000000000..2a57613fb0
--- /dev/null
+++ b/capabilities/v0.42.0.json
@@ -0,0 +1,4076 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.42.1.json b/capabilities/v0.42.1.json
new file mode 100644
index 0000000000..2a57613fb0
--- /dev/null
+++ b/capabilities/v0.42.1.json
@@ -0,0 +1,4076 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.42.2.json b/capabilities/v0.42.2.json
new file mode 100644
index 0000000000..2a57613fb0
--- /dev/null
+++ b/capabilities/v0.42.2.json
@@ -0,0 +1,4076 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "any"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.43.0.json b/capabilities/v0.43.0.json
new file mode 100644
index 0000000000..f61c6f85c8
--- /dev/null
+++ b/capabilities/v0.43.0.json
@@ -0,0 +1,4079 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.43.1.json b/capabilities/v0.43.1.json
new file mode 100644
index 0000000000..f61c6f85c8
--- /dev/null
+++ b/capabilities/v0.43.1.json
@@ -0,0 +1,4079 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.44.0.json b/capabilities/v0.44.0.json
new file mode 100644
index 0000000000..a44b951193
--- /dev/null
+++ b/capabilities/v0.44.0.json
@@ -0,0 +1,4190 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.45.0.json b/capabilities/v0.45.0.json
new file mode 100644
index 0000000000..1d28f21b65
--- /dev/null
+++ b/capabilities/v0.45.0.json
@@ -0,0 +1,4306 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ]
+}
diff --git a/capabilities/v0.46.0.json b/capabilities/v0.46.0.json
new file mode 100644
index 0000000000..d53a8ebbb5
--- /dev/null
+++ b/capabilities/v0.46.0.json
@@ -0,0 +1,4353 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.46.1.json b/capabilities/v0.46.1.json
new file mode 100644
index 0000000000..d53a8ebbb5
--- /dev/null
+++ b/capabilities/v0.46.1.json
@@ -0,0 +1,4353 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.46.2.json b/capabilities/v0.46.2.json
new file mode 100644
index 0000000000..d53a8ebbb5
--- /dev/null
+++ b/capabilities/v0.46.2.json
@@ -0,0 +1,4353 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.46.3.json b/capabilities/v0.46.3.json
new file mode 100644
index 0000000000..d53a8ebbb5
--- /dev/null
+++ b/capabilities/v0.46.3.json
@@ -0,0 +1,4353 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.47.0.json b/capabilities/v0.47.0.json
new file mode 100644
index 0000000000..69d7284a11
--- /dev/null
+++ b/capabilities/v0.47.0.json
@@ -0,0 +1,4422 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.47.1.json b/capabilities/v0.47.1.json
new file mode 100644
index 0000000000..69d7284a11
--- /dev/null
+++ b/capabilities/v0.47.1.json
@@ -0,0 +1,4422 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.47.2.json b/capabilities/v0.47.2.json
new file mode 100644
index 0000000000..69d7284a11
--- /dev/null
+++ b/capabilities/v0.47.2.json
@@ -0,0 +1,4422 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.47.3.json b/capabilities/v0.47.3.json
new file mode 100644
index 0000000000..69d7284a11
--- /dev/null
+++ b/capabilities/v0.47.3.json
@@ -0,0 +1,4422 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.47.4.json b/capabilities/v0.47.4.json
new file mode 100644
index 0000000000..69d7284a11
--- /dev/null
+++ b/capabilities/v0.47.4.json
@@ -0,0 +1,4422 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.48.0.json b/capabilities/v0.48.0.json
new file mode 100644
index 0000000000..a0746f5c13
--- /dev/null
+++ b/capabilities/v0.48.0.json
@@ -0,0 +1,4466 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.49.0.json b/capabilities/v0.49.0.json
new file mode 100644
index 0000000000..a0746f5c13
--- /dev/null
+++ b/capabilities/v0.49.0.json
@@ -0,0 +1,4466 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.49.1.json b/capabilities/v0.49.1.json
new file mode 100644
index 0000000000..a0746f5c13
--- /dev/null
+++ b/capabilities/v0.49.1.json
@@ -0,0 +1,4466 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.49.2.json b/capabilities/v0.49.2.json
new file mode 100644
index 0000000000..a0746f5c13
--- /dev/null
+++ b/capabilities/v0.49.2.json
@@ -0,0 +1,4466 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.50.0.json b/capabilities/v0.50.0.json
new file mode 100644
index 0000000000..4fe0c2b7fe
--- /dev/null
+++ b/capabilities/v0.50.0.json
@@ -0,0 +1,4598 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.match_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "static": [
+                  {
+                    "key": "desc",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "error",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "field",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "type",
+                    "value": {
+                      "type": "string"
+                    }
+                  }
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.verify_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "of": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.50.1.json b/capabilities/v0.50.1.json
new file mode 100644
index 0000000000..4fe0c2b7fe
--- /dev/null
+++ b/capabilities/v0.50.1.json
@@ -0,0 +1,4598 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.match_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "static": [
+                  {
+                    "key": "desc",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "error",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "field",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "type",
+                    "value": {
+                      "type": "string"
+                    }
+                  }
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.verify_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "of": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.50.2.json b/capabilities/v0.50.2.json
new file mode 100644
index 0000000000..4fe0c2b7fe
--- /dev/null
+++ b/capabilities/v0.50.2.json
@@ -0,0 +1,4598 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.match_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "static": [
+                  {
+                    "key": "desc",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "error",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "field",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "type",
+                    "value": {
+                      "type": "string"
+                    }
+                  }
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.verify_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "of": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.51.0.json b/capabilities/v0.51.0.json
new file mode 100644
index 0000000000..4fe0c2b7fe
--- /dev/null
+++ b/capabilities/v0.51.0.json
@@ -0,0 +1,4598 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.match_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "static": [
+                  {
+                    "key": "desc",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "error",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "field",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "type",
+                    "value": {
+                      "type": "string"
+                    }
+                  }
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.verify_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "of": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/capabilities/v0.52.0.json b/capabilities/v0.52.0.json
new file mode 100644
index 0000000000..bfa43f4a59
--- /dev/null
+++ b/capabilities/v0.52.0.json
@@ -0,0 +1,4615 @@
+{
+  "builtins": [
+    {
+      "name": "abs",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "all",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "and",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "\u0026"
+    },
+    {
+      "name": "any",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.concat",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.reverse",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "array.slice",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "assign",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": ":="
+    },
+    {
+      "name": "base64.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "base64url.encode_no_pad",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.and",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.lsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.negate",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.or",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.rsh",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "bits.xor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "null"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "cast_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "ceil",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "concat",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "count",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.equal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.hmac.sha512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.md5",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha1",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.sha256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_and_verify_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificate_request",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_certificates",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "crypto.x509.parse_rsa_private_key",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "div",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "/"
+    },
+    {
+      "name": "endswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "eq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "="
+    },
+    {
+      "name": "equal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "=="
+    },
+    {
+      "name": "floor",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "format_int",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "glob.quote_meta",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graph.reachable_paths",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "of": [
+                  {
+                    "dynamic": {
+                      "type": "any"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "any"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_and_verify",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_query",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.parse_schema",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "graphql.schema_is_valid",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "gt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e"
+    },
+    {
+      "name": "gte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003e="
+    },
+    {
+      "name": "hex.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "hex.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "http.send",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "indexof",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "indexof_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "internal.member_2",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.member_3",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "in"
+    },
+    {
+      "name": "internal.print",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "array"
+          }
+        ],
+        "type": "function"
+      }
+    },
+    {
+      "name": "intersection",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.decode_verify",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.encode_sign_raw",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "io.jwt.verify_es256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_es512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_hs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_ps512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs256",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs384",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "io.jwt.verify_rs512",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_array",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_boolean",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_null",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_number",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_object",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_set",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "is_string",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.match_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "dynamic": {
+                "static": [
+                  {
+                    "key": "desc",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "error",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "field",
+                    "value": {
+                      "type": "string"
+                    }
+                  },
+                  {
+                    "key": "type",
+                    "value": {
+                      "type": "string"
+                    }
+                  }
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.patch",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "static": [
+                {
+                  "key": "op",
+                  "value": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "key": "path",
+                  "value": {
+                    "type": "any"
+                  }
+                }
+              ],
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "json.verify_schema",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "boolean"
+            },
+            {
+              "of": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lower",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "lt",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c"
+    },
+    {
+      "name": "lte",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "\u003c="
+    },
+    {
+      "name": "max",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "min",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "minus",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": [
+            {
+              "type": "number"
+            },
+            {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            }
+          ],
+          "type": "any"
+        },
+        "type": "function"
+      },
+      "infix": "-"
+    },
+    {
+      "name": "mul",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "*"
+    },
+    {
+      "name": "neq",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      },
+      "infix": "!="
+    },
+    {
+      "name": "net.cidr_contains",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_contains_matches",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "string"
+                  },
+                  "value": {
+                    "of": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "dynamic": {
+                          "type": "any"
+                        },
+                        "type": "array"
+                      }
+                    ],
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "of": [
+                    {
+                      "type": "string"
+                    },
+                    {
+                      "dynamic": {
+                        "type": "any"
+                      },
+                      "type": "array"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "static": [
+              {
+                "type": "any"
+              },
+              {
+                "type": "any"
+              }
+            ],
+            "type": "array"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_expand",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_intersects",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_merge",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "of": [
+                    {
+                      "type": "string"
+                    }
+                  ],
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.cidr_overlap",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "net.lookup_ip_addr",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "string"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "numbers.range",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.filter",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.get",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "any"
+          },
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.keys",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.remove",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.subset",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "dynamic": {
+                  "key": {
+                    "type": "any"
+                  },
+                  "value": {
+                    "type": "any"
+                  }
+                },
+                "type": "object"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "any"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "object.union_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "dynamic": {
+                "key": {
+                  "type": "any"
+                },
+                "value": {
+                  "type": "any"
+                }
+              },
+              "type": "object"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "opa.runtime",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "or",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      },
+      "infix": "|"
+    },
+    {
+      "name": "plus",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "+"
+    },
+    {
+      "name": "print",
+      "decl": {
+        "type": "function",
+        "variadic": {
+          "type": "any"
+        }
+      }
+    },
+    {
+      "name": "product",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "providers.aws.sign_req",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "any"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "any"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rand.intn",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "re_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_all_string_submatch_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "dynamic": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.find_n",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.globs_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "regex.template_match",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.chain",
+      "decl": {
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.metadata.rule",
+      "decl": {
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rego.parse_module",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "type": "any"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "rem",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "infix": "%"
+    },
+    {
+      "name": "replace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "round",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.compare",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "semver.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "set_diff",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          },
+          {
+            "of": {
+              "type": "any"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sort",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "any"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "any"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "any"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "split",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sprintf",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "dynamic": {
+              "type": "any"
+            },
+            "type": "array"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "startswith",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_prefix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.any_suffix_match",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "string"
+              },
+              {
+                "dynamic": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "string"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.replace_n",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "strings.reverse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "substring",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "sum",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "dynamic": {
+                  "type": "number"
+                },
+                "type": "array"
+              },
+              {
+                "of": {
+                  "type": "number"
+                },
+                "type": "set"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.add_date",
+      "decl": {
+        "args": [
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "number"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.clock",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.date",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.diff",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          },
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "number"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.format",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.now_ns",
+      "decl": {
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "time.parse_duration_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.parse_rfc3339_ns",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "time.weekday",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "number"
+              },
+              {
+                "static": [
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "string"
+                  }
+                ],
+                "type": "array"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "to_number",
+      "decl": {
+        "args": [
+          {
+            "of": [
+              {
+                "type": "null"
+              },
+              {
+                "type": "boolean"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "string"
+              }
+            ],
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trace",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_left",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_prefix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_right",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_space",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "trim_suffix",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "type_name",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "union",
+      "decl": {
+        "args": [
+          {
+            "of": {
+              "of": {
+                "type": "any"
+              },
+              "type": "set"
+            },
+            "type": "set"
+          }
+        ],
+        "result": {
+          "of": {
+            "type": "any"
+          },
+          "type": "set"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "units.parse_bytes",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "number"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "upper",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.decode_object",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "dynamic": {
+            "key": {
+              "type": "string"
+            },
+            "value": {
+              "dynamic": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "type": "object"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "urlquery.encode_object",
+      "decl": {
+        "args": [
+          {
+            "dynamic": {
+              "key": {
+                "type": "string"
+              },
+              "value": {
+                "of": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "dynamic": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "of": {
+                      "type": "string"
+                    },
+                    "type": "set"
+                  }
+                ],
+                "type": "any"
+              }
+            },
+            "type": "object"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "uuid.rfc4122",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      },
+      "nondeterministic": true
+    },
+    {
+      "name": "walk",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "static": [
+            {
+              "dynamic": {
+                "type": "any"
+              },
+              "type": "array"
+            },
+            {
+              "type": "any"
+            }
+          ],
+          "type": "array"
+        },
+        "type": "function"
+      },
+      "relation": true
+    },
+    {
+      "name": "yaml.is_valid",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "boolean"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.marshal",
+      "decl": {
+        "args": [
+          {
+            "type": "any"
+          }
+        ],
+        "result": {
+          "type": "string"
+        },
+        "type": "function"
+      }
+    },
+    {
+      "name": "yaml.unmarshal",
+      "decl": {
+        "args": [
+          {
+            "type": "string"
+          }
+        ],
+        "result": {
+          "type": "any"
+        },
+        "type": "function"
+      }
+    }
+  ],
+  "future_keywords": [
+    "contains",
+    "every",
+    "if",
+    "in"
+  ],
+  "wasm_abi_versions": [
+    {
+      "version": 1,
+      "minor_version": 1
+    },
+    {
+      "version": 1,
+      "minor_version": 2
+    }
+  ],
+  "features": [
+    "rule_head_ref_string_prefixes"
+  ]
+}
diff --git a/cmd/bench.go b/cmd/bench.go
index 6d3fed0ad0..210597ce17 100644
--- a/cmd/bench.go
+++ b/cmd/bench.go
@@ -5,13 +5,26 @@
 package cmd
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"math"
+	"net/http"
 	"os"
 	"sort"
+	"strconv"
+	"strings"
 	"testing"
+	"time"
+
+	"github.com/open-policy-agent/opa/ast"
+
+	"github.com/open-policy-agent/opa/server/types"
+
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/runtime"
 
 	"github.com/olekukonko/tablewriter"
 	"github.com/spf13/cobra"
@@ -28,8 +41,12 @@ import (
 // ones compatible with running a benchmark.
 type benchmarkCommandParams struct {
 	evalCommandParams
-	benchMem bool
-	count    int
+	benchMem               bool
+	count                  int
+	e2e                    bool
+	gracefulShutdownPeriod int
+	shutdownWaitPeriod     int
+	configFile             string
 }
 
 const (
@@ -47,6 +64,7 @@ func newBenchmarkEvalParams() benchmarkCommandParams {
 			target: util.NewEnumFlag(compile.TargetRego, []string{compile.TargetRego, compile.TargetWasm}),
 			schema: &schemaFlags{},
 		},
+		gracefulShutdownPeriod: 10,
 	}
 }
 
@@ -67,6 +85,8 @@ Example with bundle and input data:
 
 To enable more detailed analysis use the --metrics and --benchmem flags.
 
+To run benchmarks against a running OPA server to evaluate server overhead use the --e2e flag.
+
 The optional "gobench" output format conforms to the Go Benchmark Data Format.
 `,
 
@@ -105,6 +125,12 @@ The optional "gobench" output format conforms to the Go Benchmark Data Format.
 	addCountFlag(benchCommand.Flags(), &params.count, "benchmark")
 	addBenchmemFlag(benchCommand.Flags(), &params.benchMem, true)
 
+	addE2EFlag(benchCommand.Flags(), &params.e2e, false)
+	addConfigFileFlag(benchCommand.Flags(), &params.configFile)
+
+	benchCommand.Flags().IntVar(&params.gracefulShutdownPeriod, "shutdown-grace-period", 10, "set the time (in seconds) that the server will wait to gracefully shut down. This flag is valid in 'e2e' mode only.")
+	benchCommand.Flags().IntVar(&params.shutdownWaitPeriod, "shutdown-wait-period", 0, "set the time (in seconds) that the server will wait before initiating shutdown. This flag is valid in 'e2e' mode only.")
+
 	RootCommand.AddCommand(benchCommand)
 }
 
@@ -113,13 +139,24 @@ type benchRunner interface {
 }
 
 func benchMain(args []string, params benchmarkCommandParams, w io.Writer, r benchRunner) (int, error) {
+
+	ctx := context.Background()
+
+	if params.e2e {
+		err := benchE2E(ctx, args, params, w)
+		if err != nil {
+			errRender := renderBenchmarkError(params, err, w)
+			return 1, errRender
+		}
+		return 0, nil
+	}
+
 	ectx, err := setupEval(args, params.evalCommandParams)
 	if err != nil {
 		errRender := renderBenchmarkError(params, err, w)
 		return 1, errRender
 	}
 
-	ctx := context.Background()
 	var benchFunc func(context.Context, ...rego.EvalOption) error
 	rg := rego.New(ectx.regoArgs...)
 
@@ -177,13 +214,9 @@ type goBenchRunner struct {
 
 func (r *goBenchRunner) run(ctx context.Context, ectx *evalContext, params benchmarkCommandParams, f func(context.Context, ...rego.EvalOption) error) (testing.BenchmarkResult, error) {
 
-	var hist metrics.Metrics
+	var hist, m metrics.Metrics
 	if params.metrics {
 		hist = metrics.New()
-	}
-
-	var m metrics.Metrics
-	if params.metrics {
 		m = metrics.New()
 	}
 
@@ -221,7 +254,7 @@ func (r *goBenchRunner) run(ctx context.Context, ectx *evalContext, params bench
 			if params.metrics {
 				for name, metric := range m.All() {
 					// Note: We only support int64 metrics right now, this should cover pretty
-					// much all of the ones we would care about (timers and counters).
+					// much all the ones we would care about (timers and counters).
 					switch v := metric.(type) {
 					case int64:
 						hist.Histogram(name).Update(v)
@@ -232,32 +265,316 @@ func (r *goBenchRunner) run(ctx context.Context, ectx *evalContext, params bench
 		}
 
 		if params.metrics {
-			// For each histogram add their values to the benchmark results.
-			// Note: If there are many metrics this gets super verbose.
-			for histName, metric := range hist.All() {
-				histValues, ok := metric.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				for metricName, rawValue := range histValues {
-					unit := fmt.Sprintf("%s_%s", histName, metricName)
+			reportMetrics(b, hist.All())
+		}
+	})
+
+	return br, benchErr
+}
+
+func benchE2E(ctx context.Context, args []string, params benchmarkCommandParams, w io.Writer) error {
+	host := "localhost"
+	port := 0
+
+	logger := logging.New()
+	logger.SetLevel(logging.Error)
+
+	paths := params.dataPaths.v
+	if len(params.bundlePaths.v) > 0 {
+		paths = append(paths, params.bundlePaths.v...)
+	}
+
+	// Because of test concurrency, several instances of this function can be
+	// running simultaneously, which will result in occasional collisions when
+	// two goroutines wish to bind the same port for the runtime.
+	// We fix the issue here by binding port 0; this will result in the OS
+	// allocating us an open port.
+	rtParams := runtime.Params{
+		Addrs:                  &[]string{fmt.Sprintf("%s:0", host)},
+		Paths:                  paths,
+		Logger:                 logger,
+		BundleMode:             params.bundlePaths.isFlagSet(),
+		SkipBundleVerification: true,
+		EnableVersionCheck:     false,
+		GracefulShutdownPeriod: params.gracefulShutdownPeriod,
+		ShutdownWaitPeriod:     params.shutdownWaitPeriod,
+		ConfigFile:             params.configFile,
+	}
+
+	rt, err := runtime.NewRuntime(ctx, rtParams)
+	if err != nil {
+		return err
+	}
+
+	cctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	initChannel := rt.Manager.ServerInitializedChannel()
+
+	done := make(chan error)
+	go func() {
+		done <- rt.Serve(cctx)
+	}()
+
+	select {
+	case err := <-done:
+		if err != nil {
+			return err
+		}
+	case <-initChannel:
+		break
+	}
+
+	// Busy loop until server has truly come online to recover the bound port.
+	// We do this with exponential backoff for wait times, since the server
+	// typically comes online very quickly.
+	baseDelay := time.Duration(100) * time.Millisecond
+	maxDelay := time.Duration(60) * time.Second
+	retries := 3 // Max of around 1 minute total wait time.
+	for i := 0; i < retries; i++ {
+		if len(rt.Addrs()) == 0 {
+			delay := util.DefaultBackoff(float64(baseDelay), float64(maxDelay), i)
+			time.Sleep(delay)
+			continue
+		}
+		// We have an address to parse the port from.
+		port, err = strconv.Atoi(strings.Split(rt.Addrs()[0], ":")[1])
+		if err != nil {
+			return err
+		}
+		break
+	}
+	// Check for port still being unbound after retry loop.
+	if port == 0 {
+		return fmt.Errorf("unable to bind a port for bench testing")
+	}
+
+	query, err := readQuery(params, args)
+	if err != nil {
+		return err
+	}
+
+	input, err := readInputBytes(params.evalCommandParams)
+	if err != nil {
+		return err
+	}
+
+	// Wrap input in "input" attribute
+	inp := make(map[string]interface{})
+
+	if input != nil {
+		if err = util.Unmarshal(input, &inp); err != nil {
+			return err
+		}
+	}
+
+	body := map[string]interface{}{"input": inp}
+
+	var path string
+	if params.partial {
+		path = "compile"
+		body["query"] = query
+		if len(params.unknowns) > 0 {
+			body["unknowns"] = params.unknowns
+		}
+	} else {
+		_, err := ast.ParseBody(query)
+		if err != nil {
+			return fmt.Errorf("error occurred while parsing query")
+		}
+
+		if strings.HasPrefix(query, "data.") {
+			path = strings.ReplaceAll(query, ".", "/")
+		} else {
+			path = "query"
+			body["query"] = query
+		}
+	}
+
+	url := fmt.Sprintf("http://%s:%d/v1/%v", host, port, path)
+	if params.metrics {
+		url += "?metrics=true"
+	}
+
+	for i := 0; i < params.count; i++ {
+		br, err := runE2E(params, url, body)
+		if err != nil {
+			return err
+		}
+		renderBenchmarkResult(params, br, w)
+	}
+	return nil
+}
+
+func runE2E(params benchmarkCommandParams, url string, input map[string]interface{}) (testing.BenchmarkResult, error) {
+	hist := metrics.New()
+
+	var benchErr error
+
+	br := testing.Benchmark(func(b *testing.B) {
+
+		// Track memory allocations, if enabled
+		if params.benchMem {
+			b.ReportAllocs()
+		}
+
+		// Reset the histogram for each invocation of the bench function
+		hist.Clear()
+
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+
+			// Start the timer
+			b.StartTimer()
+
+			// Execute the query API call
+			m, err := e2eQuery(params, url, input)
+
+			// Stop the timer while processing the results
+			b.StopTimer()
+			if err != nil {
+				benchErr = err
+				b.FailNow()
+			}
+
+			// Add metrics for that evaluation into the top level histogram
+			if params.metrics {
+				for name, metric := range m {
+					switch v := metric.(type) {
+					case json.Number:
+						num, err := v.Int64()
+						if err != nil {
+							benchErr = err
+							b.FailNow()
+						}
+						hist.Histogram(name).Update(num)
 
-					// Only support histogram metrics that are a float64 or int64,
-					// this covers the stock implementation in metrics.Metrics
-					switch v := rawValue.(type) {
-					case int64:
-						b.ReportMetric(float64(v), unit)
-					case float64:
-						b.ReportMetric(v, unit)
 					}
 				}
 			}
 		}
+
+		if params.metrics {
+			reportMetrics(b, hist.All())
+		}
 	})
 
 	return br, benchErr
 }
 
+func e2eQuery(params benchmarkCommandParams, url string, input map[string]interface{}) (types.MetricsV1, error) {
+
+	reqBody, err := json.Marshal(input)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("POST", url, bytes.NewReader(reqBody))
+	if err != nil {
+		return nil, fmt.Errorf("unexpected error: %w", err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode != 200 {
+		var e map[string]interface{}
+		if err = util.Unmarshal(body, &e); err != nil {
+			return nil, err
+		}
+
+		if _, ok := e["errors"]; !ok {
+			return nil, fmt.Errorf("request failed, OPA server replied with HTTP %v: %v", resp.StatusCode, e["message"])
+		}
+
+		bs, err := json.Marshal(e["errors"])
+		if err != nil {
+			return nil, err
+		}
+
+		var astErrs ast.Errors
+		if err = util.Unmarshal(bs, &astErrs); err != nil {
+			// ignore err
+			return nil, fmt.Errorf("request failed, OPA server replied with HTTP %v: %v", resp.StatusCode, e["message"])
+		}
+
+		return nil, astErrs
+	}
+
+	if !params.partial {
+		var result types.DataResponseV1
+		if err = util.Unmarshal(body, &result); err != nil {
+			return nil, err
+		}
+
+		if result.Result == nil && params.fail {
+			return nil, fmt.Errorf("undefined result")
+		}
+
+		return result.Metrics, nil
+	}
+
+	var result types.CompileResponseV1
+	if err = util.Unmarshal(body, &result); err != nil {
+		return nil, err
+	}
+
+	if params.fail {
+		if result.Result == nil {
+			return nil, fmt.Errorf("undefined result")
+		}
+
+		i := *result.Result
+
+		peResult, ok := i.(map[string]interface{})
+		if !ok {
+			return nil, fmt.Errorf("invalid result for compile response")
+		}
+
+		if len(peResult) == 0 {
+			return nil, fmt.Errorf("undefined result")
+		}
+
+		if val, ok := peResult["queries"]; ok {
+			queries, ok := val.([]interface{})
+			if !ok {
+				return nil, fmt.Errorf("invalid result for output of partial evaluation")
+			}
+
+			if len(queries) == 0 {
+				return nil, fmt.Errorf("undefined result")
+			}
+		} else {
+			return nil, fmt.Errorf("invalid result for output of partial evaluation")
+		}
+	}
+
+	return result.Metrics, nil
+}
+
+func readQuery(params benchmarkCommandParams, args []string) (string, error) {
+	var query string
+	if params.stdin {
+		bs, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return "", err
+		}
+		query = string(bs)
+	} else {
+		query = args[0]
+	}
+	return query, nil
+}
+
 func renderBenchmarkResult(params benchmarkCommandParams, br testing.BenchmarkResult, w io.Writer) {
 	switch params.outputFormat.String() {
 	case evalJSONOutput:
@@ -333,3 +650,26 @@ func prettyFormatFloat(x float64) string {
 	}
 	return fmt.Sprintf(format, x)
 }
+
+func reportMetrics(b *testing.B, m map[string]interface{}) {
+	// For each histogram add their values to the benchmark results.
+	// Note: If there are many metrics this gets super verbose.
+	for histName, metric := range m {
+		histValues, ok := metric.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		for metricName, rawValue := range histValues {
+			unit := fmt.Sprintf("%s_%s", histName, metricName)
+
+			// Only support histogram metrics that are a float64 or int64,
+			// this covers the stock implementation in metrics.Metrics
+			switch v := rawValue.(type) {
+			case int64:
+				b.ReportMetric(float64(v), unit)
+			case float64:
+				b.ReportMetric(v, unit)
+			}
+		}
+	}
+}
diff --git a/cmd/bench_test.go b/cmd/bench_test.go
index c6636eb0ad..fcd80a7359 100644
--- a/cmd/bench_test.go
+++ b/cmd/bench_test.go
@@ -58,6 +58,211 @@ func TestRunBenchmark(t *testing.T) {
 	}
 }
 
+func TestRunBenchmarkE2E(t *testing.T) {
+	params := testBenchParams()
+	params.e2e = true
+
+	args := []string{"1 + 1"}
+	var buf bytes.Buffer
+
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	if rc != 0 {
+		t.Fatalf("Unexpected return code %d, expected 0", rc)
+	}
+
+	// Expect a json serialized benchmark result with histogram fields
+	var br testing.BenchmarkResult
+	err = util.UnmarshalJSON(buf.Bytes(), &br)
+	if err != nil {
+		t.Fatalf("Unexpected error unmarshalling output: %s", err)
+	}
+
+	if br.N == 0 || br.T == 0 || br.MemAllocs == 0 || br.MemBytes == 0 {
+		t.Fatalf("Expected benchmark results to be non-zero, got: %+v", br)
+	}
+
+	if _, ok := br.Extra["histogram_timer_rego_query_eval_ns_count"]; !ok {
+		t.Fatalf("Expected benchmark results to contain 'histogram_timer_rego_query_eval_ns_count', got: %+v", br)
+	}
+
+	if float64(br.N) != br.Extra["histogram_timer_rego_query_eval_ns_count"] {
+		t.Fatalf("Expected 'histogram_timer_rego_query_eval_ns_count' to be equal to N")
+	}
+
+	if _, ok := br.Extra["histogram_timer_server_handler_ns_count"]; !ok {
+		t.Fatalf("Expected benchmark results to contain 'histogram_timer_server_handler_ns_count', got: %+v", br)
+	}
+
+	if float64(br.N) != br.Extra["histogram_timer_server_handler_ns_count"] {
+		t.Fatalf("Expected 'histogram_timer_server_handler_ns_count' to be equal to N")
+	}
+}
+
+func TestRunBenchmarkE2EWithOPAConfigFile(t *testing.T) {
+
+	fs := map[string]string{
+		"/config.yaml": `{"decision_logs": {"console": true}}`,
+	}
+
+	test.WithTempFS(fs, func(testDirRoot string) {
+
+		params := testBenchParams()
+		params.e2e = true
+		params.configFile = filepath.Join(testDirRoot, "/config.yaml")
+
+		args := []string{"1 + 1"}
+		var buf bytes.Buffer
+
+		rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if rc != 0 {
+			t.Fatalf("Unexpected return code %d, expected 0", rc)
+		}
+
+		// Expect a json serialized benchmark result with histogram fields
+		var br testing.BenchmarkResult
+		err = util.UnmarshalJSON(buf.Bytes(), &br)
+		if err != nil {
+			t.Fatalf("Unexpected error unmarshalling output: %s", err)
+		}
+
+		if br.N == 0 || br.T == 0 || br.MemAllocs == 0 || br.MemBytes == 0 {
+			t.Fatalf("Expected benchmark results to be non-zero, got: %+v", br)
+		}
+
+		if _, ok := br.Extra["histogram_timer_rego_query_eval_ns_count"]; !ok {
+			t.Fatalf("Expected benchmark results to contain 'histogram_timer_rego_query_eval_ns_count', got: %+v", br)
+		}
+
+		if float64(br.N) != br.Extra["histogram_timer_rego_query_eval_ns_count"] {
+			t.Fatalf("Expected 'histogram_timer_rego_query_eval_ns_count' to be equal to N")
+		}
+
+		if _, ok := br.Extra["histogram_timer_server_handler_ns_count"]; !ok {
+			t.Fatalf("Expected benchmark results to contain 'histogram_timer_server_handler_ns_count', got: %+v", br)
+		}
+
+		if float64(br.N) != br.Extra["histogram_timer_server_handler_ns_count"] {
+			t.Fatalf("Expected 'histogram_timer_server_handler_ns_count' to be equal to N")
+		}
+	})
+}
+
+func TestRunBenchmarkFailFastE2E(t *testing.T) {
+	params := testBenchParams()
+	params.fail = true // configured to fail on undefined results
+	params.e2e = true
+
+	args := []string{"a := 1; a > 2"}
+	var buf bytes.Buffer
+
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	if rc != 1 {
+		t.Fatalf("Unexpected return code %d, expected 1", rc)
+	}
+
+	// Expect a json serialized benchmark result with histogram fields
+	var pr presentation.Output
+	err = util.UnmarshalJSON(buf.Bytes(), &pr)
+	if err != nil {
+		t.Fatalf("Unexpected error unmarshalling output: %s", err)
+	}
+
+	if len(pr.Errors) != 1 {
+		t.Fatalf("Expected 1 error in result, got:\n\n%s\n", buf.String())
+	}
+}
+
+func TestBenchPartialE2E(t *testing.T) {
+	params := testBenchParams()
+	params.partial = true
+	params.fail = true
+	params.e2e = true
+	params.unknowns = []string{"input"}
+	args := []string{"input.x > 0"}
+	var buf bytes.Buffer
+
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	if rc != 0 {
+		t.Fatalf("Unexpected return code %d, expected 0", rc)
+	}
+
+	var br testing.BenchmarkResult
+	err = util.UnmarshalJSON(buf.Bytes(), &br)
+	if err != nil {
+		t.Fatalf("Unexpected error unmarshalling output: %s", err)
+	}
+
+	if br.N == 0 || br.T == 0 || br.MemAllocs == 0 || br.MemBytes == 0 {
+		t.Fatalf("Expected benchmark results to be non-zero, got: %+v", br)
+	}
+
+	if _, ok := br.Extra["histogram_timer_rego_partial_eval_ns_count"]; !ok {
+		t.Fatalf("Expected benchmark results to contain 'histogram_timer_rego_partial_eval_ns_count', got: %+v", br)
+	}
+
+	if float64(br.N) != br.Extra["histogram_timer_rego_partial_eval_ns_count"] {
+		t.Fatalf("Expected 'histogram_timer_rego_partial_eval_ns_count' to be equal to N")
+	}
+
+	if _, ok := br.Extra["histogram_timer_server_handler_ns_count"]; !ok {
+		t.Fatalf("Expected benchmark results to contain 'histogram_timer_server_handler_ns_count', got: %+v", br)
+	}
+
+	if float64(br.N) != br.Extra["histogram_timer_server_handler_ns_count"] {
+		t.Fatalf("Expected 'histogram_timer_server_handler_ns_count' to be equal to N")
+	}
+}
+
+func TestRunBenchmarkPartialFailFastE2E(t *testing.T) {
+	params := testBenchParams()
+	params.partial = true
+	params.unknowns = []string{}
+	params.fail = true
+	params.e2e = true
+	args := []string{"1 == 2"}
+	var buf bytes.Buffer
+
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	if rc != 1 {
+		t.Fatalf("Unexpected return code %d, expected 1", rc)
+	}
+
+	actual := buf.String()
+	expected := `{
+  "errors": [
+    {
+      "message": "undefined result"
+    }
+  ]
+}
+`
+
+	if actual != expected {
+		t.Fatalf("\nExpected:\n%s\n\nGot:\n%s\n", expected, actual)
+	}
+
+}
+
 func TestRunBenchmarkFailFast(t *testing.T) {
 	params := testBenchParams()
 	params.fail = true // configured to fail on undefined results
@@ -290,33 +495,79 @@ func TestBenchMainInvalidInputFile(t *testing.T) {
 	})
 }
 
-func TestBenchMainWithBundleData(t *testing.T) {
+func TestBenchMainWithJSONInputFileE2E(t *testing.T) {
 	params := testBenchParams()
+	params.e2e = true
+	files := map[string]string{
+		"/input.json": `{"x": 42}`,
+	}
+	args := []string{"input.x == 42"}
+	test.WithTempFS(files, func(path string) {
+		params.inputPath = filepath.Join(path, "input.json")
 
-	mod := `package a.b
+		var buf bytes.Buffer
 
-	x {
-	   data.a.b.c == 42
+		rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if rc != 0 {
+			t.Fatalf("Unexpected return code %d, expected 0", rc)
+		}
+	})
+}
+
+func TestBenchMainWithYAMLInputFileE2E(t *testing.T) {
+	params := testBenchParams()
+	params.e2e = true
+	files := map[string]string{
+		"/input.yaml": `x: 42`,
 	}
-	`
+	args := []string{"input.x == 42"}
+	test.WithTempFS(files, func(path string) {
+		params.inputPath = filepath.Join(path, "input.yaml")
 
-	b := bundle.Bundle{
-		Manifest: bundle.Manifest{},
-		Data: map[string]interface{}{
-			"a": map[string]interface{}{
-				"b": map[string]interface{}{
-					"c": 42,
-				},
-			},
-		},
-		Modules: []bundle.ModuleFile{
-			{
-				Path:   "/a/b/policy.rego",
-				Raw:    []byte(mod),
-				Parsed: ast.MustParseModule(mod),
-			},
-		},
+		var buf bytes.Buffer
+
+		rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if rc != 0 {
+			t.Fatalf("Unexpected return code %d, expected 0", rc)
+		}
+	})
+}
+
+func TestBenchMainInvalidInputFileE2E(t *testing.T) {
+	params := testBenchParams()
+	params.e2e = true
+	files := map[string]string{
+		"/input.yaml": `x: 42`,
 	}
+	args := []string{"1+1"}
+	test.WithTempFS(files, func(path string) {
+		params.inputPath = filepath.Join(path, "definitely/not/input.yaml")
+
+		var buf bytes.Buffer
+
+		rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if rc != 1 {
+			t.Fatalf("Unexpected return code %d, expected 1", rc)
+		}
+	})
+}
+
+func TestBenchMainWithBundleData(t *testing.T) {
+	params := testBenchParams()
+
+	b := testBundle()
 
 	files := map[string]string{
 		"bundle.tar.gz": "",
@@ -343,7 +594,101 @@ func TestBenchMainWithBundleData(t *testing.T) {
 
 		validateBenchMainPrep(t, args, params)
 	})
+}
 
+func TestBenchMainWithBundleDataE2E(t *testing.T) {
+	params := testBenchParams()
+	params.e2e = true
+
+	b := testBundle()
+
+	files := map[string]string{
+		"bundle.tar.gz": "",
+	}
+
+	test.WithTempFS(files, func(path string) {
+		bundlePath := filepath.Join(path, "bundle.tar.gz")
+		f, err := os.OpenFile(bundlePath, os.O_WRONLY, os.ModePerm)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		err = bundle.Write(f, b)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		err = params.bundlePaths.Set(bundlePath)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		args := []string{"data.a.b.x"}
+
+		var buf bytes.Buffer
+
+		rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if rc != 0 {
+			t.Fatalf("Unexpected return code %d, expected 0", rc)
+		}
+	})
+}
+
+func TestBenchMainWithDataE2E(t *testing.T) {
+	params := testBenchParams()
+	params.e2e = true
+
+	mod := `package a.b
+
+	x {
+	   data.a.b.c == 42
+	}
+	`
+
+	files := map[string]string{
+		"p.rego": mod,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		err := params.dataPaths.Set(filepath.Join(path, "p.rego"))
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		args := []string{"data.a.b.x"}
+
+		var buf bytes.Buffer
+
+		rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if rc != 0 {
+			t.Fatalf("Unexpected return code %d, expected 0", rc)
+		}
+	})
+}
+
+func TestBenchMainBadQueryE2E(t *testing.T) {
+	params := testBenchParams()
+	params.e2e = true
+	args := []string{"foo.bar"}
+
+	var buf bytes.Buffer
+
+	rc, err := benchMain(args, params, &buf, &goBenchRunner{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	if rc != 1 {
+		t.Fatalf("Unexpected return code %d, expected 1", rc)
+	}
 }
 
 func TestRenderBenchmarkResultJSONOutput(t *testing.T) {
@@ -600,3 +945,30 @@ func fakeBenchResults() testing.BenchmarkResult {
 		},
 	}
 }
+
+func testBundle() bundle.Bundle {
+	mod := `package a.b
+
+	x {
+	   data.a.b.c == 42
+	}
+	`
+
+	return bundle.Bundle{
+		Manifest: bundle.Manifest{},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"b": map[string]interface{}{
+					"c": 42,
+				},
+			},
+		},
+		Modules: []bundle.ModuleFile{
+			{
+				Path:   "/a/b/policy.rego",
+				Raw:    []byte(mod),
+				Parsed: ast.MustParseModule(mod),
+			},
+		},
+	}
+}
diff --git a/cmd/build.go b/cmd/build.go
index b85a32f7f8..212b297e1a 100644
--- a/cmd/build.go
+++ b/cmd/build.go
@@ -27,6 +27,7 @@ type buildParams struct {
 	capabilities       *capabilitiesFlag
 	target             *util.EnumFlag
 	bundleMode         bool
+	pruneUnused        bool
 	optimizationLevel  int
 	entrypoints        repeatedStringFlag
 	outputFile         string
@@ -46,7 +47,7 @@ type buildParams struct {
 func newBuildParams() buildParams {
 	return buildParams{
 		capabilities: newcapabilitiesFlag(),
-		target:       util.NewEnumFlag(compile.TargetRego, []string{compile.TargetRego, compile.TargetWasm}),
+		target:       util.NewEnumFlag(compile.TargetRego, compile.Targets),
 	}
 }
 
@@ -85,9 +86,10 @@ Inside another terminal in the same directory, serve the bundle via HTTP:
 
     $ python3 -m http.server --bind localhost 8080
 
-For more information on bundles see https://www.openpolicyagent.org/docs/latest/management.
+For more information on bundles see https://www.openpolicyagent.org/docs/latest/management-bundles/.
 
-## Common Flags
+Common Flags
+------------
 
 When -b is specified the 'build' command assumes paths refer to existing bundle files
 or directories following the bundle structure. If multiple bundles are provided, their
@@ -107,17 +109,26 @@ The 'build' command supports targets (specified by -t):
     rego    The default target emits a bundle containing a set of policy and data files
             that are semantically equivalent to the input files. If optimizations are
             disabled the output may simply contain a copy of the input policy and data
-            files. If optimization is enabled at least one entrypoint (-e) must be supplied.
+            files. If optimization is enabled at least one entrypoint must be supplied,
+            either via the -e option, or via entrypoint metadata annotations.
 
     wasm    The wasm target emits a bundle containing a WebAssembly module compiled from
             the input files for each specified entrypoint. The bundle may contain the
             original policy or data files.
 
-The -e flag tells the 'build' command which documents will be queried by the software
-asking for policy decisions, so that it can focus optimization efforts and ensure
-that document is not eliminated by the optimizer.
+    plan    The plan target emits a bundle containing a plan, i.e., an intermediate
+            representation compiled from the input files for each specified entrypoint.
+            This is for further processing, OPA cannot evaluate a "plan bundle" like it
+            can evaluate a wasm or rego bundle.
 
-## Signing
+The -e flag tells the 'build' command which documents (entrypoints) will be queried by 
+the software asking for policy decisions, so that it can focus optimization efforts and 
+ensure that document is not eliminated by the optimizer.
+Note: Unless the --prune-unused flag is used, any rule transitively referring to a 
+package or rule declared as an entrypoint will also be enumerated as an entrypoint.
+
+Signing
+-------
 
 The 'build' command can be used to verify the signature of a signed bundle and
 also to generate a signature for the output bundle the command creates.
@@ -126,8 +137,8 @@ If the directory path(s) provided to the 'build' command contain a ".signatures.
 it will attempt to verify the signatures included in that file. The bundle files
 or directory path(s) to verify must be specified using --bundle.
 
-For more information on the bundle verification process see
-https://www.openpolicyagent.org/docs/latest/management/#signature-verification.
+For more information on the bundle signing and verification, see
+https://www.openpolicyagent.org/docs/latest/management-bundles/#signing.
 
 Example:
 
@@ -161,9 +172,10 @@ To include additional claims in the payload use the --claims-file flag to provid
 containing optional claims.
 
 For more information on the format of the ".signatures.json" file
-see https://www.openpolicyagent.org/docs/latest/management/#signature-format.
+see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format.
 
-## Capabilities
+Capabilities
+------------
 
 The 'build' command can validate policies against a configurable set of OPA capabilities.
 The capabilities define the built-in functions and other language features that policies
@@ -198,7 +210,7 @@ The OPA repository contains a set of capabilities files for each OPA release. Fo
 the following command builds a directory of policies ('./policies') and validates them
 against OPA v0.22.0:
 
-    opa build ./policies --capabilities $OPA_SRC/capabilities/v0.22.0.json
+    opa build ./policies --capabilities v0.22.0
 `,
 		PreRunE: func(Cmd *cobra.Command, args []string) error {
 			if len(args) == 0 {
@@ -215,7 +227,8 @@ against OPA v0.22.0:
 	}
 
 	buildCommand.Flags().VarP(buildParams.target, "target", "t", "set the output bundle target type")
-	buildCommand.Flags().BoolVarP(&buildParams.debug, "debug", "", false, "enable debug output")
+	buildCommand.Flags().BoolVar(&buildParams.pruneUnused, "prune-unused", false, "exclude dependents of entrypoints")
+	buildCommand.Flags().BoolVar(&buildParams.debug, "debug", false, "enable debug output")
 	buildCommand.Flags().IntVarP(&buildParams.optimizationLevel, "optimize", "O", 0, "set optimization level")
 	buildCommand.Flags().VarP(&buildParams.entrypoints, "entrypoint", "e", "set slash separated entrypoint path")
 	buildCommand.Flags().VarP(&buildParams.revision, "revision", "r", "set output bundle revision")
@@ -250,13 +263,15 @@ func dobuild(params buildParams, args []string) error {
 		return err
 	}
 
-	bsc := buildSigningConfig(params.key, params.algorithm, params.claimsFile, params.plugin)
+	bsc, err := buildSigningConfig(params.key, params.algorithm, params.claimsFile, params.plugin)
+	if err != nil {
+		return err
+	}
 
-	if bvc != nil || bsc != nil {
-		if !params.bundleMode {
-			return fmt.Errorf("enable bundle mode (ie. --bundle) to verify or sign bundle files or directories")
-		}
+	if (bvc != nil || bsc != nil) && !params.bundleMode {
+		return fmt.Errorf("enable bundle mode (ie. --bundle) to verify or sign bundle files or directories")
 	}
+
 	var capabilities *ast.Capabilities
 	// if capabilities are not provided as a cmd flag,
 	// then ast.CapabilitiesForThisVersion must be called
@@ -266,13 +281,16 @@ func dobuild(params buildParams, args []string) error {
 	} else {
 		capabilities = ast.CapabilitiesForThisVersion()
 	}
+
 	compiler := compile.New().
 		WithCapabilities(capabilities).
 		WithTarget(params.target.String()).
 		WithAsBundle(params.bundleMode).
+		WithPruneUnused(params.pruneUnused).
 		WithOptimizationLevel(params.optimizationLevel).
 		WithOutput(buf).
 		WithEntrypoints(params.entrypoints.v...).
+		WithRegoAnnotationEntrypoints(true).
 		WithPaths(args...).
 		WithFilter(buildCommandLoaderFilter(params.bundleMode, params.ignore)).
 		WithBundleVerificationConfig(bvc).
@@ -290,6 +308,10 @@ func dobuild(params buildParams, args []string) error {
 		compiler = compiler.WithBundleVerificationKeyID(params.pubKeyID)
 	}
 
+	if params.target.String() == compile.TargetPlan {
+		compiler = compiler.WithEnablePrintStatements(true)
+	}
+
 	err = compiler.Build(context.Background())
 	if err != nil {
 		return err
@@ -331,10 +353,12 @@ func buildVerificationConfig(pubKey, pubKeyID, alg, scope string, excludeFiles [
 	return bundle.NewVerificationConfig(map[string]*keys.Config{pubKeyID: keyConfig}, pubKeyID, scope, excludeFiles), nil
 }
 
-func buildSigningConfig(key, alg, claimsFile, plugin string) *bundle.SigningConfig {
+func buildSigningConfig(key, alg, claimsFile, plugin string) (*bundle.SigningConfig, error) {
+	if key == "" && (plugin != "" || claimsFile != "") {
+		return nil, errSigningConfigIncomplete
+	}
 	if key == "" {
-		return nil
+		return nil, nil
 	}
-
-	return bundle.NewSigningConfig(key, alg, claimsFile).WithPlugin(plugin)
+	return bundle.NewSigningConfig(key, alg, claimsFile).WithPlugin(plugin), nil
 }
diff --git a/cmd/build_test.go b/cmd/build_test.go
index a5509c1a3c..b2c062d497 100644
--- a/cmd/build_test.go
+++ b/cmd/build_test.go
@@ -3,15 +3,19 @@ package cmd
 import (
 	"archive/tar"
 	"compress/gzip"
+	"encoding/json"
+	"fmt"
 	"io"
 	"os"
 	"path"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 
+	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/loader"
-
+	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -68,52 +72,117 @@ func TestBuildProducesBundle(t *testing.T) {
 }
 
 func TestBuildRespectsCapabilities(t *testing.T) {
-	capabilitiesJSON := `{
-    "builtins": [
-      {
-        "name": "is_foo",
-        "decl": {
-          "args": [
-            {
-              "type": "string"
-            }
-          ],
-          "result": {
-            "type": "boolean"
-          },
-          "type": "function"
-        }
-      }
-    ]
-  }`
-
-	files := map[string]string{
-		"capabilities.json": capabilitiesJSON,
-		"test.rego": `
-			package test
-			p { is_foo("bar") }
-		`,
+	tests := []struct {
+		note       string
+		caps       string
+		policy     string
+		err        string
+		bundleMode bool // build with "-b" flag
+	}{
+		{
+			note: "builtin defined in caps",
+			caps: `{
+			"builtins": [
+				{
+					"name": "is_foo",
+					"decl": {
+						"args": [
+							{
+								"type": "string"
+							}
+						],
+						"result": {
+							"type": "boolean"
+						},
+						"type": "function"
+					}
+				}
+			]
+		}`,
+			policy: `package test
+p { is_foo("bar") }`,
+		},
+		{
+			note: "future kw NOT defined in caps",
+			caps: func() string {
+				c := ast.CapabilitiesForThisVersion()
+				c.FutureKeywords = []string{"in"}
+				j, err := json.Marshal(c)
+				if err != nil {
+					panic(err)
+				}
+				return string(j)
+			}(),
+			policy: `package test
+import future.keywords.if
+import future.keywords.in
+p if "opa" in input.tools`,
+			err: "rego_parse_error: unexpected keyword, must be one of [in]",
+		},
+		{
+			note: "future kw are defined in caps",
+			caps: func() string {
+				c := ast.CapabilitiesForThisVersion()
+				c.FutureKeywords = []string{"in", "if"}
+				j, err := json.Marshal(c)
+				if err != nil {
+					panic(err)
+				}
+				return string(j)
+			}(),
+			policy: `package test
+import future.keywords.if
+import future.keywords.in
+p if "opa" in input.tools`,
+		},
 	}
 
-	test.WithTempFS(files, func(root string) {
-		caps := newcapabilitiesFlag()
-		if err := caps.Set(path.Join(root, "capabilities.json")); err != nil {
-			t.Fatal(err)
-		}
-		params := newBuildParams()
-		params.outputFile = path.Join(root, "bundle.tar.gz")
-		params.capabilities = caps
+	// add same tests for bundle-mode == true:
+	for i := range tests {
+		tc := tests[i]
+		tc.bundleMode = true
+		tc.note = tc.note + " (as bundle)"
+		tests = append(tests, tc)
+	}
 
-		err := dobuild(params, []string{root})
-		if err != nil {
-			t.Fatal(err)
-		}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			files := map[string]string{
+				"capabilities.json": tc.caps,
+				"test.rego":         tc.policy,
+			}
 
-		_, err = loader.NewFileLoader().AsBundle(params.outputFile)
-		if err != nil {
-			t.Fatal(err)
-		}
-	})
+			test.WithTempFS(files, func(root string) {
+				caps := newcapabilitiesFlag()
+				if err := caps.Set(path.Join(root, "capabilities.json")); err != nil {
+					t.Fatal(err)
+				}
+				params := newBuildParams()
+				params.outputFile = path.Join(root, "bundle.tar.gz")
+				params.capabilities = caps
+				params.bundleMode = tc.bundleMode
+
+				err := dobuild(params, []string{root})
+				switch {
+				case err != nil && tc.err != "":
+					if !strings.Contains(err.Error(), tc.err) {
+						t.Fatalf("expected err %v, got %v", tc.err, err)
+					}
+					return // don't read back bundle below
+				case err != nil && tc.err == "":
+					t.Fatalf("unexpected error: %v", err)
+				case err == nil && tc.err != "":
+					t.Fatalf("expected error %v, got nil", tc.err)
+				}
+
+				// check that the resulting bundle is readable
+				_, err = loader.NewFileLoader().AsBundle(params.outputFile)
+				if err != nil {
+					t.Fatal(err)
+				}
+			})
+		})
+	}
 }
 
 func TestBuildFilesystemModeIgnoresTarGz(t *testing.T) {
@@ -162,12 +231,14 @@ func TestBuildErrorDoesNotWriteFile(t *testing.T) {
 		params.outputFile = path.Join(root, "bundle.tar.gz")
 
 		err := dobuild(params, []string{root})
-		if err == nil || !strings.Contains(err.Error(), "rule p is recursive") {
-			t.Fatal("expected recursion error but got:", err)
+		exp := fmt.Sprintf("1 error occurred: %s/test.rego:3: rego_recursion_error: rule data.test.p is recursive: data.test.p -> data.test.p",
+			root)
+		if err == nil || err.Error() != exp {
+			t.Fatalf("expected recursion error %q but got: %q", exp, err)
 		}
 
-		if _, err := os.Stat(params.outputFile); err == nil {
-			t.Fatal("expected stat error")
+		if _, err := os.Stat(params.outputFile); !os.IsNotExist(err) {
+			t.Fatalf("expected stat \"not found\" error, got %v", err)
 		}
 	})
 }
@@ -220,3 +291,688 @@ func TestBuildVerificationConfigError(t *testing.T) {
 		}
 	})
 }
+
+func TestBuildSigningConfigError(t *testing.T) {
+	tests := []struct {
+		note                    string
+		key, plugin, claimsFile string
+		expErr                  bool
+	}{
+		{
+			note: "key+plugin+claimsFile unset",
+		},
+		{
+			note:   "key+claimsFile unset",
+			plugin: "plugin",
+			expErr: true,
+		},
+		{
+			note:       "key+plugin unset",
+			claimsFile: "claims",
+			expErr:     true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			_, err := buildSigningConfig(tc.key, defaultTokenSigningAlg, tc.claimsFile, tc.plugin)
+			switch {
+			case tc.expErr && err == nil:
+				t.Fatal("Expected error but got nil")
+			case !tc.expErr && err != nil:
+				t.Fatalf("Expected no error but got %v", err)
+			}
+		})
+	}
+}
+
+func TestBuildPlanWithPruneUnused(t *testing.T) {
+
+	files := map[string]string{
+		"test.rego": `
+			package test
+			
+			p[1]
+			
+			f(x) { p[x] }
+		`,
+	}
+
+	test.WithTempFS(files, func(root string) {
+		params := newBuildParams()
+		if err := params.target.Set("plan"); err != nil {
+			t.Fatal(err)
+		}
+		params.pruneUnused = true
+		params.entrypoints.v = []string{"test"}
+		params.outputFile = path.Join(root, "bundle.tar.gz")
+
+		err := dobuild(params, []string{root})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_, err = loader.NewFileLoader().AsBundle(params.outputFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// Check that manifest is not written given no input manifest and no other flags
+		f, err := os.Open(params.outputFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+
+		gr, err := gzip.NewReader(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		tr := tar.NewReader(gr)
+
+		found := false // for plan.json
+
+		for {
+			f, err := tr.Next()
+			if err == io.EOF {
+				break
+			} else if err != nil {
+				t.Fatal(err)
+			}
+			switch {
+			case f.Name == "/plan.json":
+				found = true
+			case f.Name == "/data.json" || strings.HasSuffix(f.Name, "/test.rego"): // expected
+			default:
+				t.Errorf("unexpected file: %s", f.Name)
+			}
+		}
+		if !found {
+			t.Error("plan.json not found")
+		}
+	})
+}
+
+func TestBuildPlanWithPrintStatements(t *testing.T) {
+
+	files := map[string]string{
+		"test.rego": `
+			package test
+
+			p { print("hello") }
+		`,
+	}
+
+	test.WithTempFS(files, func(root string) {
+		params := newBuildParams()
+		if err := params.target.Set("plan"); err != nil {
+			t.Fatal(err)
+		}
+		params.entrypoints.v = []string{"test"}
+		params.outputFile = path.Join(root, "bundle.tar.gz")
+
+		err := dobuild(params, []string{root})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_, err = loader.NewFileLoader().AsBundle(params.outputFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		f, err := os.Open(params.outputFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+
+		gr, err := gzip.NewReader(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		tr := tar.NewReader(gr)
+		var found bool
+
+		for {
+			f, err := tr.Next()
+			if err == io.EOF {
+				break
+			} else if err != nil {
+				t.Fatal(err)
+			}
+			if f.Name == "/plan.json" {
+				found = true
+				plan, err := io.ReadAll(tr)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if !strings.Contains(string(plan), "internal.print") {
+					t.Error("expected plan.json to contain reference to internal.print built-in function")
+				}
+			}
+		}
+
+		if !found {
+			t.Error("plan.json not found")
+		}
+	})
+}
+
+func TestBuildPlanWithRegoEntrypointAnnotations(t *testing.T) {
+
+	tests := []struct {
+		note  string
+		files map[string]string
+		err   error
+	}{
+		{
+			note: "annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+# METADATA
+# entrypoint: true
+package test
+
+p[1]
+
+f(x) { p[x] }
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "set generation with annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+p[x] {
+	{"a", "b"}[x]
+}
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "set generation with annotated entrypoint (contains if)",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+import future.keywords
+
+# METADATA
+# entrypoint: true
+p contains x if {
+	{"a", "b"}[x]
+}
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "object generation with annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+p[i] := x {
+	x := ["a", "b"][i]
+}
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "object generation with annotated entrypoint (if)",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+import future.keywords
+
+# METADATA
+# entrypoint: true
+p[i] if {
+	{"a", "b"}[i]
+}
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "dots in head with annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+p.a.b if {
+	true
+}
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "dots in head object generation with annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+p.a.b[i] := x {
+	x := ["a", "b"][i]
+}
+		`,
+			},
+			err: nil,
+		},
+		{
+			note: "no annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+
+package test
+
+p[1]
+
+f(x) { p[x] }
+`,
+			},
+			err: fmt.Errorf("plan compilation requires at least one entrypoint"),
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			test.WithTempFS(tc.files, func(root string) {
+				params := newBuildParams()
+				if err := params.target.Set("plan"); err != nil {
+					t.Fatal(err)
+				}
+				params.pruneUnused = true
+				params.outputFile = path.Join(root, "bundle.tar.gz")
+
+				// Build should fail if entrypoint is not discovered from annotations.
+				err := dobuild(params, []string{root})
+				if err != nil {
+					if tc.err == nil || tc.err.Error() != err.Error() {
+						t.Fatal(err)
+					}
+					return // Bail out if this was an expected test failure.
+				}
+
+				// Attempt to load up the built bundle.
+				_, err = loader.NewFileLoader().AsBundle(params.outputFile)
+				if err != nil {
+					t.Fatal(err)
+				}
+			})
+		})
+	}
+}
+
+func TestBuildWasmWithAnnotations(t *testing.T) {
+	tests := []struct {
+		note        string
+		files       map[string]string
+		entrypoints []string
+		manifest    string
+	}{
+		{
+			note: "last rule is annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# title: P1
+p1 := 1
+
+# METADATA
+# title: P2
+# entrypoint: true
+p2 := 2
+`,
+			},
+			manifest: `
+{
+	"revision":"",
+	"roots":[""],
+	"wasm":[{
+		"entrypoint":"test/p2",
+		"module":"/policy.wasm",
+		"annotations":[{
+			"scope":"rule",
+			"title":"P2",
+			"entrypoint":true
+		}]
+	}]
+}
+`,
+		},
+		{
+			note: "last rule is (not annotated) entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# title: P1
+p1 := 1
+
+# METADATA
+# title: P2
+p2 := 2
+`,
+			},
+			entrypoints: []string{"test/p2"},
+			manifest: `
+{
+	"revision":"",
+	"roots":[""],
+	"wasm":[{
+		"entrypoint":"test/p2",
+		"module":"/policy.wasm",
+		"annotations":[{
+			"scope":"rule",
+			"title":"P2"
+		}]
+	}]
+}
+`,
+		},
+		{
+			note: "rules in multiple files are entrypoints",
+			files: map[string]string{
+				"test1.rego": `
+package test
+
+# METADATA
+# title: P1
+p1 := 1
+
+# METADATA
+# title: P2
+# entrypoint: true
+p2 := 2
+`,
+				"test2.rego": `
+package test
+
+# METADATA
+# title: P3
+p3 := 3
+
+# METADATA
+# title: P4
+p4 := 4
+`,
+				"test3.rego": `
+package test.foo
+
+# METADATA
+# title: BAR
+# entrypoint: true
+bar := "baz"
+`,
+			},
+			entrypoints: []string{"test/p3"},
+			manifest: `
+{
+	"revision":"",
+	"roots":[""],
+	"wasm":[{
+		"entrypoint":"test/p3",
+		"annotations":[{"scope":"rule","title":"P3"}],
+		"module":"/policy.wasm"
+	},{
+		"entrypoint":"test/foo/bar",
+		"module":"/policy.wasm",
+		"annotations":[{
+			"scope":"rule",
+			"title":"BAR",
+			"entrypoint":true
+		}]
+	},{
+		"entrypoint":"test/p2",
+		"module":"/policy.wasm",
+		"annotations":[{
+			"scope":"rule",
+			"title":"P2",
+			"entrypoint":true
+		}]
+	}]
+}
+`,
+		},
+		{
+			note: "rule with multiple metadata blocks",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# title: P doc
+# scope: document
+
+# METADATA
+# title: P
+# entrypoint: true
+p := 1
+`,
+			},
+			manifest: `
+{
+	"revision":"",
+	"roots":[""],
+	"wasm":[{
+		"entrypoint":"test/p",
+		"module":"/policy.wasm",
+		"annotations":[{
+			"scope":"document",
+			"title":"P doc"
+		},{
+			"scope":"rule",
+			"title":"P",
+			"entrypoint":true
+		}]
+	}]
+}
+`,
+		},
+
+		// Package annotations are not injected into manifest, as package definition is always retained in Rego source.
+		{
+			note: "package is annotated entrypoint",
+			files: map[string]string{
+				"test.rego": `
+# METADATA
+# title: PKG
+# entrypoint: true
+package test
+
+# METADATA
+# title: P1
+p1 := 1
+
+# METADATA
+# title: P2
+p2 := 2
+`,
+			},
+			manifest: `
+{
+	"revision":"",
+	"roots":[""],
+	"wasm":[{
+		"entrypoint":"test",
+		"module":"/policy.wasm"
+	}]
+}
+`,
+		},
+		{
+			note: "package is (not annotated) entrypoint",
+			files: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# title: P1
+p1 := 1
+
+# METADATA
+# title: P2
+p2 := 2
+`,
+			},
+			entrypoints: []string{"test"},
+			manifest: `
+{
+	"revision":"",
+	"roots":[""],
+	"wasm":[{
+		"entrypoint":"test",
+		"module":"/policy.wasm"
+	}]
+}
+`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			test.WithTempFS(tc.files, func(root string) {
+				params := newBuildParams()
+				if err := params.target.Set("wasm"); err != nil {
+					t.Fatal(err)
+				}
+				params.pruneUnused = true
+				params.outputFile = path.Join(root, "bundle.tar.gz")
+				params.entrypoints.v = tc.entrypoints
+
+				// Build should fail if entrypoint is not discovered from annotations.
+				err := dobuild(params, []string{root})
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				_, err = loader.NewFileLoader().AsBundle(params.outputFile)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				// Check that manifest has expected content
+				f, err := os.Open(params.outputFile)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer f.Close()
+
+				gr, err := gzip.NewReader(f)
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				tr := tar.NewReader(gr)
+
+				found := false
+				for {
+					f, err := tr.Next()
+					if err == io.EOF {
+						break
+					} else if err != nil {
+						t.Fatal(err)
+					}
+					if f.Name == "/.manifest" {
+						found = true
+						data, err := io.ReadAll(tr)
+						if err != nil {
+							t.Fatal(err)
+						}
+						manifest := util.MustUnmarshalJSON(data)
+						if !reflect.DeepEqual(manifest, util.MustUnmarshalJSON([]byte(tc.manifest))) {
+							t.Fatalf("expected manifest\n\n%v\n\nbut got\n\n%v", tc.manifest, string(util.MustMarshalJSON(manifest)))
+						}
+						break
+					}
+				}
+
+				if !found {
+					t.Fatal("no manifest found in bundle")
+				}
+			})
+		})
+	}
+}
+
+func TestBuildBundleModeIgnoreFlag(t *testing.T) {
+
+	files := map[string]string{
+		"/a/b/d/data.json":                              `{"e": "f"}`,
+		"/policy.rego":                                  "package foo\n p = 1",
+		"/policy_test.rego":                             "package foo\n test_p { p }",
+		"/roles/policy.rego":                            "package bar\n p = 1",
+		"/roles/policy_test.rego":                       "package bar\n test_p { p }",
+		"/deeper/dir/path/than/others/policy.rego":      "package baz\n p = 1",
+		"/deeper/dir/path/than/others/policy_test.rego": "package baz\n test_p { p }",
+	}
+
+	test.WithTempFS(files, func(root string) {
+		params := newBuildParams()
+		params.outputFile = path.Join(root, "bundle.tar.gz")
+		params.bundleMode = true
+		params.ignore = []string{"*_test.rego"}
+
+		err := dobuild(params, []string{root})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_, err = loader.NewFileLoader().AsBundle(params.outputFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// Check that test files are not included in the output bundle
+		f, err := os.Open(params.outputFile)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+
+		gr, err := gzip.NewReader(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		tr := tar.NewReader(gr)
+
+		files := []string{}
+
+		for {
+			f, err := tr.Next()
+			if err == io.EOF {
+				break
+			} else if err != nil {
+				t.Fatal(err)
+			}
+
+			files = append(files, filepath.Base(f.Name))
+		}
+
+		expected := 4
+		if len(files) != expected {
+			t.Fatalf("expected %v files but got %v", expected, len(files))
+		}
+	})
+}
diff --git a/cmd/capabilities.go b/cmd/capabilities.go
new file mode 100644
index 0000000000..4e3d4f9460
--- /dev/null
+++ b/cmd/capabilities.go
@@ -0,0 +1,124 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/spf13/cobra"
+)
+
+type capabilitiesParams struct {
+	showCurrent bool
+	version     string
+	file        string
+}
+
+func init() {
+
+	capabilitiesParams := capabilitiesParams{}
+
+	var capabilitiesCommand = &cobra.Command{
+		Use:   "capabilities",
+		Short: "Print the capabilities of OPA",
+		Long: `Show capabilities for OPA.
+
+The 'capabilities' command prints the OPA capabilities, prior to and including the version of OPA used.
+
+Print a list of all existing capabilities version names
+
+    $ opa capabilities
+    v0.17.0
+    v0.17.1
+    ...
+    v0.37.1
+    v0.37.2
+    v0.38.0
+    ...
+
+Print the capabilities of the current version
+
+    $ opa capabilities --current
+    {
+        "builtins": [...],
+        "future_keywords": [...],
+        "wasm_abi_versions": [...]
+    }
+
+Print the capabilities of a specific version
+
+    $ opa capabilities --version v0.32.1
+    {
+        "builtins": [...],
+        "future_keywords": null,
+        "wasm_abi_versions": [...]
+    }
+
+Print the capabilities of a capabilities file
+
+    $ opa capabilities --file ./capabilities/v0.32.1.json
+    {
+        "builtins": [...],
+        "future_keywords": null,
+        "wasm_abi_versions": [...]
+    }
+
+`,
+		RunE: func(*cobra.Command, []string) error {
+			cs, err := doCapabilities(capabilitiesParams)
+			if err != nil {
+				return err
+			}
+			fmt.Println(cs)
+			return nil
+		},
+	}
+	capabilitiesCommand.Flags().BoolVar(&capabilitiesParams.showCurrent, "current", false, "print current capabilities")
+	capabilitiesCommand.Flags().StringVar(&capabilitiesParams.version, "version", "", "print capabilities of a specific version")
+	capabilitiesCommand.Flags().StringVar(&capabilitiesParams.file, "file", "", "print current capabilities")
+
+	RootCommand.AddCommand(capabilitiesCommand)
+}
+
+func doCapabilities(params capabilitiesParams) (string, error) {
+	var (
+		c   *ast.Capabilities
+		err error
+	)
+
+	if len(params.version) > 0 {
+		c, err = ast.LoadCapabilitiesVersion(params.version)
+	} else if len(params.file) > 0 {
+		c, err = ast.LoadCapabilitiesFile(params.file)
+	} else if params.showCurrent {
+		c = ast.CapabilitiesForThisVersion()
+	} else {
+		return showVersions()
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	bs, err := json.MarshalIndent(c, "", "  ")
+	if err != nil {
+		return "", err
+	}
+	return string(bs), nil
+
+}
+
+func showVersions() (string, error) {
+	cvs, err := ast.LoadCapabilitiesVersions()
+	if err != nil {
+		return "", err
+	}
+
+	t := strings.Join(cvs, "\n")
+	return t, nil
+}
diff --git a/cmd/capabilities_test.go b/cmd/capabilities_test.go
new file mode 100644
index 0000000000..6bfcdd75f1
--- /dev/null
+++ b/cmd/capabilities_test.go
@@ -0,0 +1,76 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"path"
+	"testing"
+
+	"github.com/open-policy-agent/opa/util/test"
+)
+
+func TestCapabilitiesNoArgs(t *testing.T) {
+	t.Run("test with no arguments", func(t *testing.T) {
+		_, err := doCapabilities(capabilitiesParams{})
+		if err != nil {
+			t.Fatal("expected success", err)
+		}
+	})
+}
+
+func TestCapabilitiesVersion(t *testing.T) {
+	t.Run("test with version", func(t *testing.T) {
+		params := capabilitiesParams{
+			version: "v0.39.0",
+		}
+		_, err := doCapabilities(params)
+		if err != nil {
+			t.Fatal("expected success", err)
+		}
+	})
+}
+
+func TestCapabilitiesFile(t *testing.T) {
+	t.Run("test with file", func(t *testing.T) {
+		files := map[string]string{
+			"test-capabilities.json": `
+			{
+				"builtins": [
+					{
+						"name": "plus",
+						"infix": "+",
+						"decl": {
+							"type": "function",
+							"args": [
+								{
+									"type": "number"
+								},
+								{
+									"type": "number"
+								}
+							],
+							"result": {
+								"type": "number"
+							}
+						}
+					}
+				]
+			}
+			`,
+		}
+
+		test.WithTempFS(files, func(root string) {
+			params := capabilitiesParams{
+				file: path.Join(root, "test-capabilities.json"),
+			}
+			_, err := doCapabilities(params)
+
+			if err != nil {
+				t.Fatal("expected success", err)
+			}
+		})
+
+	})
+}
diff --git a/cmd/check.go b/cmd/check.go
index e8702e6a77..872d4a8420 100644
--- a/cmd/check.go
+++ b/cmd/check.go
@@ -17,19 +17,24 @@ import (
 	"github.com/open-policy-agent/opa/util"
 )
 
-var checkParams = struct {
+type checkParams struct {
 	format       *util.EnumFlag
 	errLimit     int
 	ignore       []string
 	bundleMode   bool
 	capabilities *capabilitiesFlag
 	schema       *schemaFlags
-}{
-	format: util.NewEnumFlag(checkFormatPretty, []string{
-		checkFormatPretty, checkFormatJSON,
-	}),
-	capabilities: newcapabilitiesFlag(),
-	schema:       &schemaFlags{},
+	strict       bool
+}
+
+func newCheckParams() checkParams {
+	return checkParams{
+		format: util.NewEnumFlag(checkFormatPretty, []string{
+			checkFormatPretty, checkFormatJSON,
+		}),
+		capabilities: newcapabilitiesFlag(),
+		schema:       &schemaFlags{},
+	}
 }
 
 const (
@@ -37,46 +42,34 @@ const (
 	checkFormatJSON   = "json"
 )
 
-var checkCommand = &cobra.Command{
-	Use:   "check <path> [path [...]]",
-	Short: "Check Rego source files",
-	Long: `Check Rego source files for parse and compilation errors.
-
-If the 'check' command succeeds in parsing and compiling the source file(s), no output
-is produced. If the parsing or compiling fails, 'check' will output the errors
-and exit with a non-zero exit code.`,
-
-	PreRunE: func(Cmd *cobra.Command, args []string) error {
-		if len(args) == 0 {
-			return fmt.Errorf("specify at least one file")
-		}
-		return nil
-	},
-
-	Run: func(cmd *cobra.Command, args []string) {
-		os.Exit(checkModules(args))
-	},
-}
-
-func checkModules(args []string) int {
+func checkModules(params checkParams, args []string) error {
 
 	modules := map[string]*ast.Module{}
 
-	ss, err := loader.Schemas(checkParams.schema.path)
+	var capabilities *ast.Capabilities
+	// if capabilities are not provided as a cmd flag,
+	// then ast.CapabilitiesForThisVersion must be called
+	// within checkModules to ensure custom builtins are properly captured
+	if params.capabilities.C != nil {
+		capabilities = params.capabilities.C
+	} else {
+		capabilities = ast.CapabilitiesForThisVersion()
+	}
+
+	ss, err := loader.Schemas(params.schema.path)
 	if err != nil {
-		outputErrors(err)
-		return 1
+		return err
 	}
 
-	if checkParams.bundleMode {
+	if params.bundleMode {
 		for _, path := range args {
 			b, err := loader.NewFileLoader().
 				WithSkipBundleVerification(true).
-				WithProcessAnnotation(ss != nil).
+				WithProcessAnnotation(true).
+				WithCapabilities(capabilities).
 				AsBundle(path)
 			if err != nil {
-				outputErrors(err)
-				return 1
+				return err
 			}
 			for name, mod := range b.ParsedModules(path) {
 				modules[name] = mod
@@ -84,48 +77,38 @@ func checkModules(args []string) int {
 		}
 	} else {
 		f := loaderFilter{
-			Ignore: checkParams.ignore,
+			Ignore: params.ignore,
 		}
 
 		result, err := loader.NewFileLoader().
-			WithProcessAnnotation(ss != nil).
+			WithProcessAnnotation(true).
+			WithCapabilities(capabilities).
 			Filtered(args, f.Apply)
 		if err != nil {
-			outputErrors(err)
-			return 1
+			return err
 		}
 
 		for _, m := range result.Modules {
 			modules[m.Name] = m.Parsed
 		}
 	}
-	var capabilities *ast.Capabilities
-	// if capabilities are not provided as a cmd flag,
-	// then ast.CapabilitiesForThisVersion must be called
-	// within checkModules to ensure custom builtins are properly captured
-	if checkParams.capabilities.C != nil {
-		capabilities = checkParams.capabilities.C
-	} else {
-		capabilities = ast.CapabilitiesForThisVersion()
-	}
+
 	compiler := ast.NewCompiler().
-		SetErrorLimit(checkParams.errLimit).
+		SetErrorLimit(params.errLimit).
 		WithCapabilities(capabilities).
 		WithSchemas(ss).
-		WithEnablePrintStatements(true)
+		WithEnablePrintStatements(true).
+		WithStrict(params.strict).
+		WithUseTypeCheckAnnotations(true)
 
 	compiler.Compile(modules)
-
-	if !compiler.Failed() {
-		return 0
+	if compiler.Failed() {
+		return compiler.Errors
 	}
-
-	outputErrors(compiler.Errors)
-
-	return 1
+	return nil
 }
 
-func outputErrors(err error) {
+func outputErrors(format string, err error) {
 	var out io.Writer
 	if err != nil {
 		out = os.Stderr
@@ -133,7 +116,7 @@ func outputErrors(err error) {
 		out = os.Stdout
 	}
 
-	switch checkParams.format.String() {
+	switch format {
 	case checkFormatJSON:
 		result := pr.Output{
 			Errors: pr.NewOutputErrors(err),
@@ -148,11 +131,38 @@ func outputErrors(err error) {
 }
 
 func init() {
+	checkParams := newCheckParams()
+
+	checkCommand := &cobra.Command{
+		Use:   "check <path> [path [...]]",
+		Short: "Check Rego source files",
+		Long: `Check Rego source files for parse and compilation errors.
+	
+	If the 'check' command succeeds in parsing and compiling the source file(s), no output
+	is produced. If the parsing or compiling fails, 'check' will output the errors
+	and exit with a non-zero exit code.`,
+
+		PreRunE: func(_ *cobra.Command, args []string) error {
+			if len(args) == 0 {
+				return fmt.Errorf("specify at least one file")
+			}
+			return nil
+		},
+
+		Run: func(_ *cobra.Command, args []string) {
+			if err := checkModules(checkParams, args); err != nil {
+				outputErrors(checkParams.format.String(), err)
+				os.Exit(1)
+			}
+		},
+	}
+
 	addMaxErrorsFlag(checkCommand.Flags(), &checkParams.errLimit)
 	addIgnoreFlag(checkCommand.Flags(), &checkParams.ignore)
 	checkCommand.Flags().VarP(checkParams.format, "format", "f", "set output format")
 	addBundleModeFlag(checkCommand.Flags(), &checkParams.bundleMode, false)
 	addCapabilitiesFlag(checkCommand.Flags(), checkParams.capabilities)
 	addSchemaFlags(checkCommand.Flags(), checkParams.schema)
+	addStrictFlag(checkCommand.Flags(), &checkParams.strict, false)
 	RootCommand.AddCommand(checkCommand)
 }
diff --git a/cmd/check_test.go b/cmd/check_test.go
new file mode 100644
index 0000000000..105128c32b
--- /dev/null
+++ b/cmd/check_test.go
@@ -0,0 +1,171 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package cmd
+
+import (
+	"encoding/json"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/util/test"
+)
+
+func TestCheckRespectsCapabilities(t *testing.T) {
+	tests := []struct {
+		note       string
+		caps       string
+		policy     string
+		err        string
+		bundleMode bool // check with "-b" flag
+	}{
+		{
+			note: "builtin defined in caps",
+			caps: `{
+			"builtins": [
+				{
+					"name": "is_foo",
+					"decl": {
+						"args": [
+							{
+								"type": "string"
+							}
+						],
+						"result": {
+							"type": "boolean"
+						},
+						"type": "function"
+					}
+				}
+			]
+		}`,
+			policy: `package test
+p { is_foo("bar") }`,
+		},
+		{
+			note: "future kw NOT defined in caps",
+			caps: func() string {
+				c := ast.CapabilitiesForThisVersion()
+				c.FutureKeywords = []string{"in"}
+				j, err := json.Marshal(c)
+				if err != nil {
+					panic(err)
+				}
+				return string(j)
+			}(),
+			policy: `package test
+import future.keywords.if
+import future.keywords.in
+p if "opa" in input.tools`,
+			err: "rego_parse_error: unexpected keyword, must be one of [in]",
+		},
+		{
+			note: "future kw are defined in caps",
+			caps: func() string {
+				c := ast.CapabilitiesForThisVersion()
+				c.FutureKeywords = []string{"in", "if"}
+				j, err := json.Marshal(c)
+				if err != nil {
+					panic(err)
+				}
+				return string(j)
+			}(),
+			policy: `package test
+import future.keywords.if
+import future.keywords.in
+p if "opa" in input.tools`,
+		},
+	}
+
+	// add same tests for bundle-mode == true:
+	for i := range tests {
+		tc := tests[i]
+		tc.bundleMode = true
+		tc.note = tc.note + " (as bundle)"
+		tests = append(tests, tc)
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			files := map[string]string{
+				"capabilities.json": tc.caps,
+				"test.rego":         tc.policy,
+			}
+
+			test.WithTempFS(files, func(root string) {
+				caps := newcapabilitiesFlag()
+				if err := caps.Set(path.Join(root, "capabilities.json")); err != nil {
+					t.Fatal(err)
+				}
+				params := newCheckParams()
+				params.capabilities = caps
+				params.bundleMode = tc.bundleMode
+
+				err := checkModules(params, []string{root})
+				switch {
+				case err != nil && tc.err != "":
+					if !strings.Contains(err.Error(), tc.err) {
+						t.Fatalf("expected err %v, got %v", tc.err, err)
+					}
+					return // don't read back bundle below
+				case err != nil && tc.err == "":
+					t.Fatalf("unexpected error: %v", err)
+				case err == nil && tc.err != "":
+					t.Fatalf("expected error %v, got nil", tc.err)
+				}
+			})
+		})
+	}
+}
+
+func testCheckWithSchemasAnnotationButNoSchemaFlag(policy string) error {
+	files := map[string]string{
+		"test.rego": policy,
+	}
+
+	var err error
+	test.WithTempFS(files, func(path string) {
+		params := newCheckParams()
+
+		err = checkModules(params, []string{path})
+	})
+
+	return err
+}
+
+// Assert that 'schemas' annotations with schema refs are only informing the type checker when the --schema flag is used
+func TestCheckWithSchemasAnnotationButNoSchemaFlag(t *testing.T) {
+	policyWithSchemaRef := `
+package test
+# METADATA
+# schemas:
+#   - input: schema["input"]
+p { 
+	rego.metadata.rule() # presence of rego.metadata.* calls must not trigger unwanted schema evaluation 
+	input.foo == 42 # type mismatch with schema that should be ignored
+}`
+
+	err := testCheckWithSchemasAnnotationButNoSchemaFlag(policyWithSchemaRef)
+	if err != nil {
+		t.Fatalf("unexpected error from eval with schema ref: %v", err)
+	}
+
+	policyWithInlinedSchema := `
+package test
+# METADATA
+# schemas:
+#   - input.foo: {"type": "boolean"}
+p { 
+	rego.metadata.rule() # presence of rego.metadata.* calls must not trigger unwanted schema evaluation 
+	input.foo == 42 # type mismatch with schema that should be ignored
+}`
+
+	err = testCheckWithSchemasAnnotationButNoSchemaFlag(policyWithInlinedSchema)
+	// We expect an error here, as inlined schemas are always used for type checking
+	if !strings.Contains(err.Error(), "rego_type_error: match error") {
+		t.Fatalf("unexpected error from eval with inlined schema, got: %v", err)
+	}
+}
diff --git a/cmd/deps.go b/cmd/deps.go
index 89759a6e03..8e96142e8e 100644
--- a/cmd/deps.go
+++ b/cmd/deps.go
@@ -5,13 +5,13 @@
 package cmd
 
 import (
+	"errors"
 	"fmt"
 	"os"
 
 	"github.com/open-policy-agent/opa/dependencies"
 	"github.com/open-policy-agent/opa/internal/presentation"
 
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -42,6 +42,39 @@ func init() {
 	depsCommand := &cobra.Command{
 		Use:   "deps <query>",
 		Short: "Analyze Rego query dependencies",
+		Long: `Print dependencies of provided query.
+
+Dependencies are categorized as either base documents, which is any data loaded
+from the outside world, or virtual documents, i.e values that are computed from rules.
+
+Example
+-------
+Given a policy like this:
+
+	package policy
+
+	import future.keywords.if
+	import future.keywords.in
+
+	allow if is_admin
+
+	is_admin if "admin" in input.user.roles
+
+To evaluate the dependencies of a simple query (e.g. data.policy.allow),
+we'd run opa deps like demonstrated below:
+
+	$ opa deps --data policy.rego data.policy.allow
+	+------------------+----------------------+
+	|  BASE DOCUMENTS  |  VIRTUAL DOCUMENTS   |
+	+------------------+----------------------+
+	| input.user.roles | data.policy.allow    |
+	|                  | data.policy.is_admin |
+	+------------------+----------------------+
+
+From the output we're able to determine that the allow rule depends on
+the input.user.roles base document, as well as the virtual document (rule)
+data.policy.is_admin.
+`,
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			if len(args) != 1 {
 				return errors.New("specify exactly one query argument")
diff --git a/cmd/eval.go b/cmd/eval.go
index 2f39dac762..8b8abe9a80 100644
--- a/cmd/eval.go
+++ b/cmd/eval.go
@@ -5,11 +5,11 @@
 package cmd
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strconv"
 	"strings"
@@ -19,6 +19,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/ast/location"
+	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/compile"
 	"github.com/open-policy-agent/opa/cover"
 	fileurl "github.com/open-policy-agent/opa/internal/file/url"
@@ -43,6 +44,7 @@ type evalCommandParams struct {
 	disableIndexing     bool
 	disableEarlyExit    bool
 	strictBuiltinErrors bool
+	showBuiltinErrors   bool
 	dataPaths           repeatedStringFlag
 	inputPath           string
 	imports             repeatedStringFlag
@@ -65,6 +67,9 @@ type evalCommandParams struct {
 	schema              *schemaFlags
 	target              *util.EnumFlag
 	timeout             time.Duration
+	optimizationLevel   int
+	entrypoints         repeatedStringFlag
+	strict              bool
 }
 
 func newEvalCommandParams() evalCommandParams {
@@ -78,7 +83,7 @@ func newEvalCommandParams() evalCommandParams {
 			evalSourceOutput,
 			evalRawOutput,
 		}),
-		explain:         newExplainFlag([]string{explainModeOff, explainModeFull, explainModeNotes, explainModeFails}),
+		explain:         newExplainFlag([]string{explainModeOff, explainModeFull, explainModeNotes, explainModeFails, explainModeDebug}),
 		target:          util.NewEnumFlag(compile.TargetRego, []string{compile.TargetRego, compile.TargetWasm}),
 		count:           1,
 		profileCriteria: newrepeatedStringFlag([]string{}),
@@ -111,6 +116,13 @@ func validateEvalParams(p *evalCommandParams, cmdArgs []string) error {
 	} else if !p.partial && of == evalSourceOutput {
 		return errors.New("invalid output format for evaluation")
 	}
+
+	if p.optimizationLevel > 0 {
+		if len(p.dataPaths.v) > 0 && p.bundlePaths.isFlagSet() {
+			return fmt.Errorf("specify either --data or --bundle flag with optimization level greater than 0")
+		}
+	}
+
 	if p.profileLimit.isFlagSet() || p.profileCriteria.isFlagSet() {
 		p.profile = true
 	}
@@ -157,11 +169,11 @@ Examples
 
 To evaluate a simple query:
 
-    $ opa eval 'x = 1; y = 2; x < y'
+    $ opa eval 'x := 1; y := 2; x < y'
 
 To evaluate a query against JSON data:
 
-    $ opa eval --data data.json 'data.names[_] = name'
+    $ opa eval --data data.json 'name := data.names[_]'
 
 To evaluate a query against JSON data supplied with a file:// URL:
 
@@ -195,12 +207,20 @@ package path contained inside the file. Only data files named data.json or
 data.yaml will be loaded. In the example above the manifest.yaml would be
 ignored.
 
-See https://www.openpolicyagent.org/docs/latest/bundles/ for more details
+See https://www.openpolicyagent.org/docs/latest/management-bundles/ for more details
 on bundle directory structures.
 
 The --data flag can be used to recursively load ALL *.rego, *.json, and
 *.yaml files under the specified directory.
 
+The -O flag controls the optimization level. By default, optimization is disabled (-O=0).
+When optimization is enabled the 'eval' command generates a bundle from the files provided
+with either the --bundle or --data flag. This bundle is semantically equivalent to the input
+files however the structure of the files in the bundle may have been changed by rewriting, inlining,
+pruning, etc. This resulting optimized bundle is used to evaluate the query. If optimization is
+enabled at least one entrypoint must be supplied, either via the -e option, or via entrypoint
+metadata annotations.
+
 Output Formats
 --------------
 
@@ -210,6 +230,8 @@ Set the output format with the --format flag.
     --format=values    : output line separated JSON arrays containing expression values
     --format=bindings  : output line separated JSON objects containing variable bindings
     --format=pretty    : output query results in a human-readable format
+    --format=source    : output partial evaluation results in a source format
+    --format=raw       : output the values from query results in a scripting friendly format
 
 Schema
 ------
@@ -268,7 +290,8 @@ access.
 	evalCommand.Flags().BoolVarP(&params.shallowInlining, "shallow-inlining", "", false, "disable inlining of rules that depend on unknowns")
 	evalCommand.Flags().BoolVar(&params.disableIndexing, "disable-indexing", false, "disable indexing optimizations")
 	evalCommand.Flags().BoolVar(&params.disableEarlyExit, "disable-early-exit", false, "disable 'early exit' optimizations")
-	evalCommand.Flags().BoolVarP(&params.strictBuiltinErrors, "strict-builtin-errors", "", false, "treat built-in function errors as fatal")
+	evalCommand.Flags().BoolVarP(&params.strictBuiltinErrors, "strict-builtin-errors", "", false, "treat the first built-in function error encountered as fatal")
+	evalCommand.Flags().BoolVarP(&params.showBuiltinErrors, "show-builtin-errors", "", false, "collect and return all encountered built-in errors, built in errors are not fatal")
 	evalCommand.Flags().BoolVarP(&params.instrument, "instrument", "", false, "enable query instrumentation metrics (implies --metrics)")
 	evalCommand.Flags().BoolVarP(&params.profile, "profile", "", false, "perform expression profiling")
 	evalCommand.Flags().VarP(&params.profileCriteria, "profile-sort", "", "set sort order of expression profiler results")
@@ -277,6 +300,9 @@ access.
 	evalCommand.Flags().BoolVarP(&params.failDefined, "fail-defined", "", false, "exits with non-zero exit code on defined/non-empty result and errors")
 	evalCommand.Flags().DurationVar(&params.timeout, "timeout", 0, "set eval timeout (default unlimited)")
 
+	evalCommand.Flags().IntVarP(&params.optimizationLevel, "optimize", "O", 0, "set optimization level")
+	evalCommand.Flags().VarP(&params.entrypoints, "entrypoint", "e", "set slash separated entrypoint path")
+
 	// Shared flags
 	addCapabilitiesFlag(evalCommand.Flags(), params.capabilities)
 	addPartialFlag(evalCommand.Flags(), &params.partial, false)
@@ -296,6 +322,7 @@ access.
 	addSchemaFlags(evalCommand.Flags(), params.schema)
 	addTargetFlag(evalCommand.Flags(), params.target)
 	addCountFlag(evalCommand.Flags(), &params.count, "benchmark")
+	addStrictFlag(evalCommand.Flags(), &params.strict, false)
 
 	RootCommand.AddCommand(evalCommand)
 }
@@ -351,6 +378,11 @@ func eval(args []string, params evalCommandParams, w io.Writer) (bool, error) {
 		result.AggregatedMetrics = timersAggregated
 	}
 
+	var builtInErrorCount int
+	if ectx.params.showBuiltinErrors {
+		builtInErrorCount = len(*(ectx.builtInErrorList))
+	}
+
 	switch ectx.params.outputFormat.String() {
 	case evalBindingsOutput:
 		err = pr.Bindings(w, result)
@@ -368,7 +400,11 @@ func eval(args []string, params evalCommandParams, w io.Writer) (bool, error) {
 
 	if err != nil {
 		return false, err
-	} else if len(result.Errors) > 0 {
+	} else if errorCount := len(result.Errors); errorCount > 0 && errorCount != builtInErrorCount {
+		// if we only have built-in errors, we don't want to return an error. If
+		// strict-builtin-errors is set the first built-in error will be returned
+		// in a result error instead.
+
 		// If the rego package returned an error, return a special error here so
 		// that the command doesn't print the same error twice. The error will
 		// have been printed above by the presentation package.
@@ -411,11 +447,19 @@ func evalOnce(ctx context.Context, ectx *evalContext) pr.Output {
 	}
 
 	result.Errors = pr.NewOutputErrors(resultErr)
+	if ectx.builtInErrorList != nil {
+		for _, err := range *(ectx.builtInErrorList) {
+			err := err
+			result.Errors = append(result.Errors, pr.NewOutputErrors(&err)...)
+		}
+	}
 
 	if ectx.params.explain != nil {
 		switch ectx.params.explain.String() {
+		case explainModeDebug:
+			result.Explanation = lineage.Debug(*(ectx.tracer))
 		case explainModeFull:
-			result.Explanation = *(ectx.tracer)
+			result.Explanation = lineage.Full(*(ectx.tracer))
 		case explainModeNotes:
 			result.Explanation = lineage.Notes(*(ectx.tracer))
 		case explainModeFails:
@@ -446,20 +490,21 @@ func evalOnce(ctx context.Context, ectx *evalContext) pr.Output {
 }
 
 type evalContext struct {
-	params   evalCommandParams
-	metrics  metrics.Metrics
-	profiler *resettableProfiler
-	cover    *cover.Cover
-	tracer   *topdown.BufferTracer
-	regoArgs []func(*rego.Rego)
-	evalArgs []rego.EvalOption
+	params           evalCommandParams
+	metrics          metrics.Metrics
+	profiler         *resettableProfiler
+	cover            *cover.Cover
+	tracer           *topdown.BufferTracer
+	regoArgs         []func(*rego.Rego)
+	evalArgs         []rego.EvalOption
+	builtInErrorList *[]topdown.Error
 }
 
 func setupEval(args []string, params evalCommandParams) (*evalContext, error) {
 	var query string
 
 	if params.stdin {
-		bs, err := ioutil.ReadAll(os.Stdin)
+		bs, err := io.ReadAll(os.Stdin)
 		if err != nil {
 			return nil, err
 		}
@@ -491,12 +536,31 @@ func setupEval(args []string, params evalCommandParams) (*evalContext, error) {
 		f := loaderFilter{
 			Ignore: params.ignore,
 		}
-		regoArgs = append(regoArgs, rego.Load(params.dataPaths.v, f.Apply))
+
+		if params.optimizationLevel <= 0 {
+			regoArgs = append(regoArgs, rego.Load(params.dataPaths.v, f.Apply))
+		} else {
+			b, err := generateOptimizedBundle(params, false, f.Apply, params.dataPaths.v)
+			if err != nil {
+				return nil, err
+			}
+
+			regoArgs = append(regoArgs, rego.ParsedBundle("optimized", b))
+		}
 	}
 
 	if params.bundlePaths.isFlagSet() {
-		for _, bundleDir := range params.bundlePaths.v {
-			regoArgs = append(regoArgs, rego.LoadBundle(bundleDir))
+		if params.optimizationLevel <= 0 {
+			for _, bundleDir := range params.bundlePaths.v {
+				regoArgs = append(regoArgs, rego.LoadBundle(bundleDir))
+			}
+		} else {
+			b, err := generateOptimizedBundle(params, true, buildCommandLoaderFilter(true, params.ignore), params.bundlePaths.v)
+			if err != nil {
+				return nil, err
+			}
+
+			regoArgs = append(regoArgs, rego.ParsedBundle("optimized", b))
 		}
 	}
 
@@ -576,20 +640,33 @@ func setupEval(args []string, params evalCommandParams) (*evalContext, error) {
 
 	if params.strictBuiltinErrors {
 		regoArgs = append(regoArgs, rego.StrictBuiltinErrors(true))
+		if params.showBuiltinErrors {
+			return nil, fmt.Errorf("cannot use --show-builtin-errors with --strict-builtin-errors, --strict-builtin-errors will return the first built-in error encountered immediately")
+		}
+	}
+
+	var builtInErrors []topdown.Error
+	if params.showBuiltinErrors {
+		regoArgs = append(regoArgs, rego.BuiltinErrorList(&builtInErrors))
 	}
 
 	if params.capabilities != nil {
 		regoArgs = append(regoArgs, rego.Capabilities(params.capabilities.C))
 	}
 
+	if params.strict {
+		regoArgs = append(regoArgs, rego.Strict(params.strict))
+	}
+
 	evalCtx := &evalContext{
-		params:   params,
-		metrics:  m,
-		profiler: &rp,
-		cover:    c,
-		tracer:   tracer,
-		regoArgs: regoArgs,
-		evalArgs: evalArgs,
+		params:           params,
+		metrics:          m,
+		profiler:         &rp,
+		cover:            c,
+		tracer:           tracer,
+		regoArgs:         regoArgs,
+		evalArgs:         evalArgs,
+		builtInErrorList: &builtInErrors,
 	}
 
 	return evalCtx, nil
@@ -626,13 +703,13 @@ func getProfileSortOrder(sortOrder []string) []string {
 
 func readInputBytes(params evalCommandParams) ([]byte, error) {
 	if params.stdinInput {
-		return ioutil.ReadAll(os.Stdin)
+		return io.ReadAll(os.Stdin)
 	} else if params.inputPath != "" {
 		path, err := fileurl.Clean(params.inputPath)
 		if err != nil {
 			return nil, err
 		}
-		return ioutil.ReadFile(path)
+		return os.ReadFile(path)
 	}
 	return nil, nil
 }
@@ -738,3 +815,32 @@ func (vis *astLocationResetVisitor) visit(x interface{}) bool {
 	}
 	return false
 }
+
+func generateOptimizedBundle(params evalCommandParams, asBundle bool, filter loader.Filter, paths []string) (*bundle.Bundle, error) {
+	buf := bytes.NewBuffer(nil)
+
+	var capabilities *ast.Capabilities
+	if params.capabilities.C != nil {
+		capabilities = params.capabilities.C
+	} else {
+		capabilities = ast.CapabilitiesForThisVersion()
+	}
+
+	compiler := compile.New().
+		WithCapabilities(capabilities).
+		WithTarget(params.target.String()).
+		WithAsBundle(asBundle).
+		WithOptimizationLevel(params.optimizationLevel).
+		WithOutput(buf).
+		WithEntrypoints(params.entrypoints.v...).
+		WithRegoAnnotationEntrypoints(true).
+		WithPaths(paths...).
+		WithFilter(filter)
+
+	err := compiler.Build(context.Background())
+	if err != nil {
+		return nil, err
+	}
+
+	return compiler.Bundle(), nil
+}
diff --git a/cmd/eval_test.go b/cmd/eval_test.go
index 099c1c0c65..495abc5f27 100755
--- a/cmd/eval_test.go
+++ b/cmd/eval_test.go
@@ -10,11 +10,12 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -57,17 +58,92 @@ func TestEvalExitCode(t *testing.T) {
 	}
 }
 
+func TestEvalWithShowBuiltinErrors(t *testing.T) {
+	files := map[string]string{
+		"x.rego": `package x
+
+p {
+	1/0
+}
+
+q {
+	1/0
+}`,
+	}
+
+	test.WithTempFS(files, func(path string) {
+
+		params := newEvalCommandParams()
+		params.showBuiltinErrors = true
+		params.dataPaths = newrepeatedStringFlag([]string{path})
+
+		var buf bytes.Buffer
+
+		defined, err := eval([]string{"data.x"}, params, &buf)
+		if !defined || err != nil {
+			t.Fatalf("unexpected undefined or error: %v", err)
+		}
+
+		var output presentation.Output
+
+		if err := util.NewJSONDecoder(&buf).Decode(&output); err != nil {
+			t.Fatal(err)
+		}
+
+		if len(output.Errors) != 2 {
+			t.Fatalf("Expected 2 errors in result, got:%v", len(output.Errors))
+		}
+
+		expectedCode := "eval_builtin_error"
+		expectedMessage := "div: divide by zero"
+
+		if code := output.Errors[0].Code; code != expectedCode {
+			t.Fatalf("expected code '%v', got '%v'", expectedCode, code)
+		}
+		if msg := output.Errors[0].Message; msg != expectedMessage {
+			t.Fatalf("expected message '%v', got '%v'", expectedMessage, msg)
+		}
+
+		if code := output.Errors[1].Code; code != expectedCode {
+			t.Fatalf("expected code '%v', got '%v'", expectedCode, code)
+		}
+		if msg := output.Errors[1].Message; msg != expectedMessage {
+			t.Fatalf("expected message '%v', got '%v'", expectedMessage, msg)
+		}
+
+		loc1, ok1 := output.Errors[0].Location.(map[string]interface{})
+		if !ok1 {
+			t.Fatal("unexpected location type")
+		}
+
+		loc2, ok2 := output.Errors[1].Location.(map[string]interface{})
+		if !ok2 {
+			t.Fatal("unexpected location type")
+		}
+
+		if loc1["row"] == loc2["row"] {
+			t.Fatal("expected 2 distinct error occurrences in policy")
+		}
+	})
+}
+
 func TestEvalWithProfiler(t *testing.T) {
 	files := map[string]string{
 		"x.rego": `package x
 
-p = 1`,
+p {
+	a := 1
+	b := 2
+	c := 3
+	x = a + b * c
+}`,
 	}
 
 	test.WithTempFS(files, func(path string) {
 
 		params := newEvalCommandParams()
 		params.profile = true
+		params.profileCriteria = newrepeatedStringFlag([]string{"line"})
 		params.dataPaths = newrepeatedStringFlag([]string{path})
 
 		var buf bytes.Buffer
@@ -86,6 +162,29 @@ p = 1`,
 		if len(output.Profile) == 0 {
 			t.Fatal("Expected profile output to be non-empty")
 		}
+
+		expectedNumEval := []int{3, 1, 1, 1, 1}
+		expectedNumRedo := []int{3, 1, 1, 1, 1}
+		expectedRow := []int{7, 6, 5, 4, 1}
+		expectedNumGenExpr := []int{3, 1, 1, 1, 1}
+
+		for idx, actualExprStat := range output.Profile {
+			if actualExprStat.NumEval != expectedNumEval[idx] {
+				t.Fatalf("Index %v: Expected number of evals %v but got %v", idx, expectedNumEval[idx], actualExprStat.NumEval)
+			}
+
+			if actualExprStat.NumRedo != expectedNumRedo[idx] {
+				t.Fatalf("Index %v: Expected number of redos %v but got %v", idx, expectedNumRedo[idx], actualExprStat.NumRedo)
+			}
+
+			if actualExprStat.Location.Row != expectedRow[idx] {
+				t.Fatalf("Index %v: Expected row %v but got %v", idx, expectedRow[idx], actualExprStat.Location.Row)
+			}
+
+			if actualExprStat.NumGenExpr != expectedNumGenExpr[idx] {
+				t.Fatalf("Index %v: Expected number of generated expressions %v but got %v", idx, expectedNumGenExpr[idx], actualExprStat.NumGenExpr)
+			}
+		}
 	})
 }
 
@@ -122,6 +221,147 @@ p = 1`,
 	})
 }
 
+func TestEvalWithOptimizeErrors(t *testing.T) {
+	files := map[string]string{
+		"x.rego": `package x
+
+p = 1`,
+	}
+
+	test.WithTempFS(files, func(path string) {
+
+		params := newEvalCommandParams()
+		params.optimizationLevel = 1
+		params.dataPaths = newrepeatedStringFlag([]string{path})
+		if err := params.bundlePaths.Set(path); err != nil {
+			t.Fatal(err)
+		}
+
+		err := validateEvalParams(&params, []string{"data"})
+		if err == nil {
+			t.Fatal("Expected error but got nil")
+		}
+
+		expected := "specify either --data or --bundle flag with optimization level greater than 0"
+		if err.Error() != expected {
+			t.Fatalf("Expected error %v but got %v", expected, err.Error())
+		}
+
+		params = newEvalCommandParams()
+		params.optimizationLevel = 1
+		params.dataPaths = newrepeatedStringFlag([]string{path})
+
+		var buf bytes.Buffer
+
+		_, err = eval([]string{"data.test"}, params, &buf)
+		if err == nil {
+			t.Fatal("Expected error but got nil")
+		}
+
+		expected = "bundle optimizations require at least one entrypoint"
+		if err.Error() != expected {
+			t.Fatalf("Expected error %v but got %v", expected, err.Error())
+		}
+	})
+}
+
+func TestEvalWithOptimize(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+			package test
+			default p = false
+			p { q }
+			q { input.x = data.foo }`,
+		"data.json": `
+			{"foo": 1}`,
+	}
+
+	test.WithTempFS(files, func(path string) {
+
+		params := newEvalCommandParams()
+		params.optimizationLevel = 1
+		params.dataPaths = newrepeatedStringFlag([]string{path})
+		params.entrypoints = newrepeatedStringFlag([]string{"test/p"})
+
+		var buf bytes.Buffer
+
+		defined, err := eval([]string{"data.test.p"}, params, &buf)
+		if !defined || err != nil {
+			t.Fatalf("Unexpected undefined or error: %v", err)
+		}
+	})
+}
+
+// Ensure that entrypoint annotations don't cause panics when using
+// higher levels of optimization.
+// Reference: https://github.com/open-policy-agent/opa/issues/5368
+func TestEvalIssue5368(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+package system
+
+object_key_exists(object, key) {
+	_ = object[key]
+}
+
+default main = false
+
+# METADATA
+# entrypoint: true
+main := results {
+	object_key_exists(input, "queries")
+	results := {key: result |
+		result := input.queries[key]
+	}
+}`,
+		"input.json": `{}`,
+	}
+
+	test.WithTempFS(files, func(path string) {
+
+		params := newEvalCommandParams()
+		params.optimizationLevel = 2
+		params.dataPaths = newrepeatedStringFlag([]string{path})
+		params.inputPath = filepath.Join(path, "input.json")
+
+		var buf bytes.Buffer
+
+		defined, err := eval([]string{"data.system.main"}, params, &buf)
+		if !defined || err != nil {
+			t.Fatalf("Unexpected undefined or error: %v", err)
+		}
+	})
+}
+
+func TestEvalWithOptimizeBundleData(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+			package test
+			default p = false
+			p { q }
+			q { input.x = data.foo }`,
+		"data.json": `
+			{"foo": 1}`,
+	}
+
+	test.WithTempFS(files, func(path string) {
+
+		params := newEvalCommandParams()
+		params.optimizationLevel = 1
+		if err := params.bundlePaths.Set(path); err != nil {
+			t.Fatal(err)
+		}
+		params.entrypoints = newrepeatedStringFlag([]string{"test/p"})
+
+		var buf bytes.Buffer
+
+		defined, err := eval([]string{"data.test.p"}, params, &buf)
+		if !defined || err != nil {
+			t.Fatalf("Unexpected undefined or error: %v", err)
+		}
+	})
+}
+
 func testEvalWithInputFile(t *testing.T, input string, query string, params evalCommandParams) error {
 	files := map[string]string{
 		"input.json": input,
@@ -164,24 +404,31 @@ func TestEvalWithInvalidInputFile(t *testing.T) {
 	}
 }
 
-func testEvalWithSchemaFile(t *testing.T, input string, query string, schema string) error {
+func testEvalWithSchemaFile(t *testing.T, input string, query string, schema string, policy string, expTypeErr bool) error {
 	files := map[string]string{
 		"input.json":  input,
 		"schema.json": schema,
 	}
 
+	policyFilePresent := policy != ""
+	if policyFilePresent {
+		files["policy.rego"] = policy
+	}
+
 	var err error
 	test.WithTempFS(files, func(path string) {
 
 		params := newEvalCommandParams()
 		params.inputPath = filepath.Join(path, "input.json")
+		if policyFilePresent {
+			params.dataPaths = newrepeatedStringFlag([]string{path})
+		}
 		params.schema = &schemaFlags{path: filepath.Join(path, "schema.json")}
 
 		var buf bytes.Buffer
-		var defined bool
-		defined, err = eval([]string{query}, params, &buf)
-		if !defined || err != nil {
-			err = fmt.Errorf("Unexpected error or undefined from evaluation: %v", err)
+		defined, evalErr := eval([]string{query}, params, &buf)
+		if !expTypeErr && (!defined || evalErr != nil) {
+			err = fmt.Errorf("unexpected error or undefined from evaluation: %v", evalErr)
 			return
 		}
 
@@ -191,6 +438,13 @@ func testEvalWithSchemaFile(t *testing.T, input string, query string, schema str
 			t.Fatal(err)
 		}
 
+		if expTypeErr {
+			if len(output.Errors) != 1 || output.Errors[0].Code != "rego_type_error" {
+				err = fmt.Errorf("expected type conflict, got %v", output.Errors)
+			}
+			return
+		}
+
 		rs := output.Result
 		if exp, act := true, rs.Allowed(); exp != act {
 			t.Errorf("expected %v, got %v", exp, act)
@@ -225,6 +479,68 @@ func testEvalWithInvalidSchemaFile(input string, query string, schema string) er
 	return err
 }
 
+func testEvalWithSchemasAnnotationButNoSchemaFlag(policy string) error {
+	query := "data.test.p"
+
+	files := map[string]string{
+		"input.json": `{
+				"foo": 42
+			}`,
+		"test.rego": policy,
+	}
+
+	var err error
+	test.WithTempFS(files, func(path string) {
+
+		params := newEvalCommandParams()
+		params.inputPath = filepath.Join(path, "input.json")
+		params.dataPaths = newrepeatedStringFlag([]string{path})
+
+		var buf bytes.Buffer
+		var defined bool
+		defined, err = eval([]string{query}, params, &buf)
+		if !defined || err != nil {
+			err = fmt.Errorf(buf.String())
+		}
+	})
+
+	return err
+}
+
+// Assert that 'schemas' annotations with schema refs are only informing the type checker when the --schema flag is used
+func TestEvalWithSchemasAnnotationButNoSchemaFlag(t *testing.T) {
+	policyWithSchemaRef := `
+package test
+# METADATA
+# schemas:
+#   - input: schema["input"]
+p { 
+	rego.metadata.rule() # presence of rego.metadata.* calls must not trigger unwanted schema evaluation 
+	input.foo == 42 # type mismatch with schema that should be ignored
+}`
+
+	err := testEvalWithSchemasAnnotationButNoSchemaFlag(policyWithSchemaRef)
+	if err != nil {
+		t.Fatalf("unexpected error from eval with schema ref: %v", err)
+	}
+
+	policyWithInlinedSchema := `
+package test
+# METADATA
+# schemas:
+#   - input.foo: {"type": "boolean"}
+p { 
+	rego.metadata.rule() # presence of rego.metadata.* calls must not trigger unwanted schema evaluation 
+	input.foo == 42 # type mismatch with schema that should be ignored
+}`
+
+	err = testEvalWithSchemasAnnotationButNoSchemaFlag(policyWithInlinedSchema)
+	// We expect an error here, as inlined schemas are always used for type checking
+	if !strings.Contains(err.Error(), `"code": "rego_type_error"`) {
+		t.Fatalf("unexpected error from eval with inlined schema, got: %v", err)
+	}
+}
+
 func testReadParamWithSchemaDir(input string, inputSchema string) error {
 	files := map[string]string{
 		"input.json":                          input,
@@ -347,7 +663,33 @@ func TestEvalWithJSONSchema(t *testing.T) {
 	}`
 
 	query := "input.b[0].a == 1"
-	err := testEvalWithSchemaFile(t, input, query, schema)
+	err := testEvalWithSchemaFile(t, input, query, schema, "", false)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	policyWithSchemasAnnotation := `
+package test
+# METADATA
+# schemas:
+#   - input: schema
+p {
+	input.foo == 42 # type mismatch
+}`
+	err = testEvalWithSchemaFile(t, input, query, schema, policyWithSchemasAnnotation, true)
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	policyWithInlinedSchemasAnnotation := `
+package test
+# METADATA
+# schemas:
+#   - input.foo: {"type": "boolean"}
+p {
+	input.foo == 42 # type mismatch
+}`
+	err = testEvalWithSchemaFile(t, input, query, schema, policyWithInlinedSchemasAnnotation, true)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
 	}
@@ -374,7 +716,7 @@ func TestEvalWithInvalidSchemaFile(t *testing.T) {
 	schema := `{badjson`
 
 	query := "input.b[0].a == 1"
-	err := testEvalWithSchemaFile(t, input, query, schema)
+	err := testEvalWithSchemaFile(t, input, query, schema, "", false)
 	if err == nil {
 		t.Fatalf("expected error but err == nil")
 	}
@@ -500,6 +842,111 @@ func TestEvalWithSchemaFileWithRemoteRef(t *testing.T) {
 	})
 }
 
+func TestBuiltinsCapabilities(t *testing.T) {
+	tests := []struct {
+		note            string
+		policy          string
+		query           string
+		ruleName        string
+		expectedCode    string
+		expectedMessage string
+	}{
+		{
+			note:            "rego.metadata.chain() not allowed",
+			policy:          "package p\n r := rego.metadata.chain()",
+			query:           "data.p",
+			ruleName:        "rego.metadata.chain",
+			expectedCode:    "rego_type_error",
+			expectedMessage: "undefined function rego.metadata.chain",
+		},
+		{
+			note:            "rego.metadata.rule() not allowed",
+			policy:          "package p\n r := rego.metadata.rule()",
+			query:           "data.p",
+			ruleName:        "rego.metadata.rule",
+			expectedCode:    "rego_type_error",
+			expectedMessage: "undefined function rego.metadata.rule",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+
+			files := map[string]string{
+				"p.rego": tc.policy,
+			}
+
+			test.WithTempFS(files, func(path string) {
+				params := newEvalCommandParams()
+				params.capabilities.C = ast.CapabilitiesForThisVersion()
+				params.capabilities.C.Builtins = removeBuiltin(params.capabilities.C.Builtins, tc.ruleName)
+
+				_ = params.dataPaths.Set(filepath.Join(path, "p.rego"))
+
+				var buf bytes.Buffer
+				_, err := eval([]string{tc.query}, params, &buf)
+				if err == nil {
+					t.Fatal("expected error, got nil")
+				}
+				var output presentation.Output
+				if err := util.NewJSONDecoder(&buf).Decode(&output); err != nil {
+					t.Fatal(err)
+				}
+				if exp, act := 1, len(output.Errors); exp != act {
+					t.Fatalf("expected %d errors, got %d", exp, act)
+				}
+				if code := output.Errors[0].Code; code != tc.expectedCode {
+					t.Errorf("expected code '%v', got '%v'", tc.expectedCode, code)
+				}
+				if msg := output.Errors[0].Message; msg != tc.expectedMessage {
+					t.Errorf("expected message '%v', got '%v'", tc.expectedMessage, msg)
+				}
+			})
+		})
+	}
+}
+
+func removeBuiltin(builtins []*ast.Builtin, name string) []*ast.Builtin {
+	var cpy []*ast.Builtin
+	for _, builtin := range builtins {
+		if builtin.Name != name {
+			cpy = append(cpy, builtin)
+		}
+	}
+	return cpy
+}
+
+// Nearly identical to TestEvalWithOptimizeBundleData, but uses
+// Rego entrypoint annotations instead of explicitly providing
+// the entrypoints as CLI arguments.
+func TestEvalWithRegoEntrypointAnnotations(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+package test
+default p = false
+# METADATA
+# entrypoint: true
+p { q }
+q { input.x = data.foo }`,
+		"data.json": `
+{"foo": 1}`,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		params := newEvalCommandParams()
+		if err := params.bundlePaths.Set(path); err != nil {
+			t.Fatal(err)
+		}
+
+		var buf bytes.Buffer
+
+		defined, err := eval([]string{"data.test.p"}, params, &buf)
+		if !defined || err != nil {
+			t.Fatalf("Unexpected undefined or error: %v", err)
+		}
+	})
+}
+
 func TestEvalReturnsRegoError(t *testing.T) {
 	buf := new(bytes.Buffer)
 	_, err := eval([]string{`{k: v | k = ["a", "a"][_]; v = [0,1][_]}`}, newEvalCommandParams(), buf)
@@ -518,9 +965,8 @@ func TestEvalWithBundleData(t *testing.T) {
 	test.WithTempFS(files, func(path string) {
 
 		params := newEvalCommandParams()
-		params.bundlePaths = repeatedStringFlag{
-			v:     []string{path},
-			isSet: true,
+		if err := params.bundlePaths.Set(path); err != nil {
+			t.Fatal(err)
 		}
 
 		var buf bytes.Buffer
@@ -554,12 +1000,11 @@ func TestEvalWithBundleDuplicateFileNames(t *testing.T) {
 	test.WithTempFS(files, func(path string) {
 
 		params := newEvalCommandParams()
-		params.bundlePaths = repeatedStringFlag{
-			v: []string{
-				filepath.Join(path, "a"),
-				filepath.Join(path, "b"),
-			},
-			isSet: true,
+		if err := params.bundlePaths.Set(filepath.Join(path, "a")); err != nil {
+			t.Fatal(err)
+		}
+		if err := params.bundlePaths.Set(filepath.Join(path, "b")); err != nil {
+			t.Fatal(err)
 		}
 
 		var buf bytes.Buffer
@@ -817,7 +1262,7 @@ func TestResetExprLocations(t *testing.T) {
 }
 func kubeSchemaServer(t *testing.T) *httptest.Server {
 	t.Helper()
-	bs, err := ioutil.ReadFile("../ast/testdata/_definitions.json")
+	bs, err := os.ReadFile("../ast/testdata/_definitions.json")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -829,3 +1274,272 @@ func kubeSchemaServer(t *testing.T) *httptest.Server {
 	}))
 	return ts
 }
+
+func TestEvalPartialFormattedOutput(t *testing.T) {
+
+	query := `time.clock(input.x) == time.clock(input.y)`
+	tests := []struct {
+		format, expected string
+	}{
+		{
+			format: evalPrettyOutput,
+			expected: `+---------+------------------------------------------+
+| Query 1 | time.clock(input.y, time.clock(input.x)) |
++---------+------------------------------------------+
+`},
+		{
+			format: evalSourceOutput,
+			expected: `# Query 1
+time.clock(input.y, time.clock(input.x))
+
+`},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.format, func(t *testing.T) {
+			buf := new(bytes.Buffer)
+			params := newEvalCommandParams()
+			params.partial = true
+			_ = params.outputFormat.Set(tc.format)
+			_, err := eval([]string{query}, params, buf)
+			if err != nil {
+				t.Fatal("unexpected error:", err)
+			}
+			if actual := buf.String(); actual != tc.expected {
+				t.Errorf("expected output %q\ngot %q", tc.expected, actual)
+			}
+		})
+	}
+}
+
+func TestPolicyWithStrictFlag(t *testing.T) {
+	testsShouldError := []struct {
+		note            string
+		policy          string
+		query           string
+		expectedCode    string
+		expectedMessage string
+	}{
+		{
+			note: "strict mode should error on duplicate imports",
+			policy: `package x 
+			import future.keywords.if 
+			import future.keywords.if 
+			foo = 2`,
+			query:           "data.foo",
+			expectedCode:    "rego_compile_error",
+			expectedMessage: "import must not shadow import future.keywords.if",
+		},
+		{
+			note: "strict mode should error on unused imports",
+			policy: `package x
+			import future.keywords.if
+			import data.foo 
+			foo = 2`,
+			query:           "data.foo",
+			expectedCode:    "rego_compile_error",
+			expectedMessage: "import data.foo unused",
+		},
+		{
+			note: "strict mode should error when reserved vars data or input is used",
+			policy: `package x
+			import future.keywords.if
+			data if { x = 1}`,
+			query:           "data.foo",
+			expectedCode:    "rego_compile_error",
+			expectedMessage: "rules must not shadow data (use a different rule name)",
+		},
+	}
+
+	for _, tc := range testsShouldError {
+		t.Run(tc.note, func(t *testing.T) {
+
+			files := map[string]string{
+				"test.rego": tc.policy,
+			}
+
+			test.WithTempFS(files, func(path string) {
+				params := newEvalCommandParams()
+				params.strict = true
+
+				_ = params.dataPaths.Set(filepath.Join(path, "test.rego"))
+
+				var buf bytes.Buffer
+				_, err := eval([]string{tc.query}, params, &buf)
+				if err == nil {
+					t.Fatal("expected error, got nil")
+				}
+				var output presentation.Output
+				if err := util.NewJSONDecoder(&buf).Decode(&output); err != nil {
+					t.Fatal(err)
+				}
+
+				if code := output.Errors[0].Code; code != tc.expectedCode {
+					t.Errorf("expected code '%v', got '%v'", tc.expectedCode, code)
+				}
+				if msg := output.Errors[0].Message; msg != tc.expectedMessage {
+					t.Errorf("expected message '%v', got '%v'", tc.expectedMessage, msg)
+				}
+			})
+		})
+	}
+
+	testsShouldPass := []struct {
+		note   string
+		policy string
+		query  string
+	}{
+		{
+			note: "This should not error as it is valid",
+			policy: `package x 
+			import future.keywords.if
+			foo = 2`,
+			query: "data.foo",
+		},
+		{
+			note: "Strict mode should not validate the query, only the policy, this should not error",
+			policy: `package x 
+			import future.keywords.if 
+			foo = 2`,
+			query: "x := data.x.foo",
+		},
+	}
+	for _, tc := range testsShouldPass {
+		t.Run(tc.note, func(t *testing.T) {
+
+			files := map[string]string{
+				"test.rego": tc.policy,
+			}
+
+			test.WithTempFS(files, func(path string) {
+				params := newEvalCommandParams()
+				params.strict = true
+
+				var buf bytes.Buffer
+				_, err := eval([]string{tc.query}, params, &buf)
+				if err != nil {
+					t.Errorf("Should not error, got error: '%v'", err)
+				}
+			})
+		})
+	}
+
+}
+
+func TestBundleWithStrictFlag(t *testing.T) {
+	testsShouldError := []struct {
+		note            string
+		policy          string
+		query           string
+		expectedCode    string
+		expectedMessage string
+	}{
+		{
+			note: "strict mode should error on duplicate imports in this bundle",
+			policy: `package x 
+			import future.keywords.if 
+			import future.keywords.if 
+			foo = 2`,
+			query:           "data.foo",
+			expectedCode:    "rego_compile_error",
+			expectedMessage: "import must not shadow import future.keywords.if",
+		},
+		{
+			note: "strict mode should error on unused imports in this bundle",
+			policy: `package x
+			import future.keywords.if 
+			import data.foo 
+			foo = 2`,
+			query:           "data.foo",
+			expectedCode:    "rego_compile_error",
+			expectedMessage: "import data.foo unused",
+		},
+		{
+			note: "strict mode should error when reserved vars data or input is used in this bundle",
+			policy: `package x
+			import future.keywords.if 
+			data if { x = 1}`,
+			query:           "data.foo",
+			expectedCode:    "rego_compile_error",
+			expectedMessage: "rules must not shadow data (use a different rule name)",
+		},
+	}
+
+	for _, tc := range testsShouldError {
+		t.Run(tc.note, func(t *testing.T) {
+
+			files := map[string]string{
+				"test.rego": tc.policy,
+			}
+
+			test.WithTempFS(files, func(path string) {
+				params := newEvalCommandParams()
+				if err := params.bundlePaths.Set(path); err != nil {
+					t.Fatal(err)
+				}
+				params.strict = true
+
+				var buf bytes.Buffer
+				_, err := eval([]string{tc.query}, params, &buf)
+				if err == nil {
+					t.Fatal("expected error, got nil")
+				}
+				var output presentation.Output
+				if err := util.NewJSONDecoder(&buf).Decode(&output); err != nil {
+					t.Fatal(err)
+				}
+
+				if code := output.Errors[0].Code; code != tc.expectedCode {
+					t.Errorf("expected code '%v', got '%v'", tc.expectedCode, code)
+				}
+				if msg := output.Errors[0].Message; msg != tc.expectedMessage {
+					t.Errorf("expected message '%v', got '%v'", tc.expectedMessage, msg)
+				}
+			})
+		})
+	}
+
+	testsShouldPass := []struct {
+		note   string
+		policy string
+		query  string
+	}{
+		{
+			note: "This bundle should not error as it is valid",
+			policy: `package x 
+			import future.keywords.if 
+			foo = 2`,
+			query: "data.foo",
+		},
+		{
+			note: "Strict mode should not validate the query, only the policy, this bundle should not error",
+			policy: `package x 
+			import future.keywords.if 
+			foo = 2`,
+			query: "x := data.x.foo",
+		},
+	}
+	for _, tc := range testsShouldPass {
+		t.Run(tc.note, func(t *testing.T) {
+
+			files := map[string]string{
+				"test.rego": tc.policy,
+			}
+
+			test.WithTempFS(files, func(path string) {
+				params := newEvalCommandParams()
+				if err := params.bundlePaths.Set(path); err != nil {
+					t.Fatal(err)
+				}
+				params.strict = true
+
+				var buf bytes.Buffer
+				_, err := eval([]string{tc.query}, params, &buf)
+				if err != nil {
+					t.Errorf("Should not error, got error: '%v'", err)
+				}
+			})
+		})
+	}
+
+}
diff --git a/cmd/exec.go b/cmd/exec.go
new file mode 100644
index 0000000000..8cb43204ea
--- /dev/null
+++ b/cmd/exec.go
@@ -0,0 +1,229 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+
+	"github.com/open-policy-agent/opa/cmd/internal/exec"
+	"github.com/open-policy-agent/opa/internal/config"
+	internal_logging "github.com/open-policy-agent/opa/internal/logging"
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/plugins"
+	"github.com/open-policy-agent/opa/plugins/bundle"
+	"github.com/open-policy-agent/opa/plugins/discovery"
+	"github.com/open-policy-agent/opa/plugins/logs"
+	"github.com/open-policy-agent/opa/plugins/status"
+	"github.com/open-policy-agent/opa/sdk"
+	"github.com/open-policy-agent/opa/util"
+)
+
+func init() {
+
+	var bundlePaths repeatedStringFlag
+
+	params := exec.NewParams(os.Stdout)
+
+	var cmd = &cobra.Command{
+		Use:   `exec <path> [<path> [...]]`,
+		Short: "Execute against input files",
+		Long: `Execute against input files.
+
+The 'exec' command executes OPA against one or more input files. If the paths
+refer to directories, OPA will execute against files contained inside those
+directories, recursively.
+
+The 'exec' command accepts a --config-file/-c or series of --set options as
+arguments. These options behave the same as way as 'opa run'. Since the 'exec'
+command is intended to execute OPA in one-shot, the 'exec' command will
+manually trigger plugins before and after policy execution:
+
+Before: Discovery -> Bundle -> Status
+After: Decision Logs
+
+By default, the 'exec' command executes the "default decision" (specified in
+the OPA configuration) against each input file. This can be overridden by
+specifying the --decision argument and pointing at a specific policy decision,
+e.g., opa exec --decision /foo/bar/baz ...`,
+
+		Args: cobra.MinimumNArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			params.Paths = args
+			params.BundlePaths = bundlePaths.v
+			if err := runExec(params); err != nil {
+				logging.Get().WithFields(map[string]interface{}{"err": err}).Error("Unexpected error.")
+				os.Exit(1)
+			}
+		},
+	}
+
+	addBundleFlag(cmd.Flags(), &bundlePaths)
+	addOutputFormat(cmd.Flags(), params.OutputFormat)
+	addConfigFileFlag(cmd.Flags(), &params.ConfigFile)
+	addConfigOverrides(cmd.Flags(), &params.ConfigOverrides)
+	addConfigOverrideFiles(cmd.Flags(), &params.ConfigOverrideFiles)
+	cmd.Flags().StringVarP(&params.Decision, "decision", "", "", "set decision to evaluate")
+	cmd.Flags().BoolVarP(&params.FailDefined, "fail-defined", "", false, "exits with non-zero exit code on defined/non-empty result and errors")
+	cmd.Flags().BoolVarP(&params.Fail, "fail", "", false, "exits with non-zero exit code on undefined/empty result and errors")
+	cmd.Flags().VarP(params.LogLevel, "log-level", "l", "set log level")
+	cmd.Flags().Var(params.LogFormat, "log-format", "set log format")
+	cmd.Flags().StringVar(&params.LogTimestampFormat, "log-timestamp-format", "", "set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)")
+
+	RootCommand.AddCommand(cmd)
+}
+
+func runExec(params *exec.Params) error {
+
+	stdLogger, consoleLogger, err := setupLogging(params.LogLevel.String(), params.LogFormat.String(), params.LogTimestampFormat)
+	if err != nil {
+		return fmt.Errorf("config error: %w", err)
+	}
+
+	config, err := setupConfig(params.ConfigFile, params.ConfigOverrides, params.ConfigOverrideFiles, params.BundlePaths)
+	if err != nil {
+		return fmt.Errorf("config error: %w", err)
+	}
+
+	ctx := context.Background()
+	ready := make(chan struct{})
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config:        bytes.NewReader(config),
+		Logger:        stdLogger,
+		ConsoleLogger: consoleLogger,
+		Ready:         ready,
+	})
+	if err != nil {
+		return fmt.Errorf("runtime error: %w", err)
+	}
+
+	if err := triggerPlugins(ctx, opa, []string{discovery.Name, bundle.Name, status.Name}); err != nil {
+		return fmt.Errorf("runtime error: %w", err)
+	}
+
+	<-ready
+
+	if err := exec.Exec(ctx, opa, params); err != nil {
+		return fmt.Errorf("exec error: %w", err)
+	}
+
+	if err := triggerPlugins(ctx, opa, []string{logs.Name}); err != nil {
+		return fmt.Errorf("runtime error: %w", err)
+	}
+
+	return nil
+}
+
+func triggerPlugins(ctx context.Context, opa *sdk.OPA, names []string) error {
+	for _, name := range names {
+		if p, ok := opa.Plugin(name).(plugins.Triggerable); ok {
+			if err := p.Trigger(ctx); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func setupLogging(level, format, timestampFormat string) (logging.Logger, logging.Logger, error) {
+
+	lvl, err := internal_logging.GetLevel(level)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if timestampFormat == "" {
+		timestampFormat = os.Getenv("OPA_LOG_TIMESTAMP_FORMAT")
+	}
+
+	logging.Get().SetFormatter(internal_logging.GetFormatter(format, timestampFormat))
+	logging.Get().SetLevel(lvl)
+
+	stdLogger := logging.New()
+	stdLogger.SetLevel(lvl)
+	stdLogger.SetFormatter(internal_logging.GetFormatter(format, timestampFormat))
+
+	consoleLogger := logging.New()
+	consoleLogger.SetFormatter(internal_logging.GetFormatter(format, timestampFormat))
+
+	return stdLogger, consoleLogger, nil
+}
+
+func setupConfig(file string, overrides []string, overrideFiles []string, bundlePaths []string) ([]byte, error) {
+
+	bs, err := config.Load(file, overrides, overrideFiles)
+	if err != nil {
+		return nil, err
+	}
+
+	var root map[string]interface{}
+
+	if err := util.Unmarshal(bs, &root); err != nil {
+		return nil, err
+	}
+
+	if err := injectExplicitBundles(root, bundlePaths); err != nil {
+		return nil, err
+	}
+
+	// NOTE(tsandall): This could be generalized in the future if we need to
+	// deal with arbitrary plugins.
+
+	// NOTE(tsandall): Overriding the discovery trigger mode to manual means
+	// that all plugins will inherit the trigger mode by default. If the plugin
+	// trigger mode is explicitly set to something other than 'manual' this will
+	// result in a configuration error.
+	if cfg, ok := root["discovery"].(map[string]interface{}); ok {
+		cfg["trigger"] = "manual"
+	}
+
+	if cfg, ok := root["bundles"].(map[string]interface{}); ok {
+		for _, x := range cfg {
+			if bcfg, ok := x.(map[string]interface{}); ok {
+				bcfg["trigger"] = "manual"
+			}
+		}
+	}
+
+	if cfg, ok := root["decision_logs"].(map[string]interface{}); ok {
+		if rcfg, ok := cfg["reporting"].(map[string]interface{}); ok {
+			rcfg["trigger"] = "manual"
+		}
+	}
+
+	if cfg, ok := root["status"].(map[string]interface{}); ok {
+		cfg["trigger"] = "manual"
+	}
+
+	return json.Marshal(root)
+}
+
+func injectExplicitBundles(root map[string]interface{}, paths []string) error {
+	if len(paths) == 0 {
+		return nil
+	}
+
+	bundles, ok := root["bundles"].(map[string]interface{})
+	if !ok {
+		bundles = map[string]interface{}{}
+		root["bundles"] = bundles
+	}
+
+	for i := range paths {
+		abspath, err := filepath.Abs(paths[i])
+		if err != nil {
+			return err
+		}
+		abspath = filepath.ToSlash(abspath)
+		bundles[fmt.Sprintf("~%d", i)] = map[string]interface{}{
+			"resource": fmt.Sprintf("file://%v", abspath),
+		}
+	}
+
+	return nil
+}
diff --git a/cmd/exec_test.go b/cmd/exec_test.go
new file mode 100644
index 0000000000..dc158d225a
--- /dev/null
+++ b/cmd/exec_test.go
@@ -0,0 +1,368 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/open-policy-agent/opa/cmd/internal/exec"
+	sdk_test "github.com/open-policy-agent/opa/sdk/test"
+	"github.com/open-policy-agent/opa/util"
+	"github.com/open-policy-agent/opa/util/test"
+)
+
+func TestExecBasic(t *testing.T) {
+
+	files := map[string]string{
+		"test.json":  `{"foo": 7}`,
+		"test2.yaml": `bar: 8`,
+		"test3.yml":  `baz: 9`,
+		"ignore":     `garbage`, // do not recognize this filetype
+	}
+
+	test.WithTempFS(files, func(dir string) {
+
+		s := sdk_test.MustNewServer(sdk_test.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"test.rego": `
+				package system
+				main["hello"]
+			`,
+		}))
+
+		defer s.Stop()
+
+		var buf bytes.Buffer
+		params := exec.NewParams(&buf)
+		_ = params.OutputFormat.Set("json")
+		params.ConfigOverrides = []string{
+			"services.test.url=" + s.URL(),
+			"bundles.test.resource=/bundles/bundle.tar.gz",
+		}
+
+		params.Paths = append(params.Paths, dir)
+		err := runExec(params)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		output := util.MustUnmarshalJSON(bytes.ReplaceAll(buf.Bytes(), []byte(dir), nil))
+
+		exp := util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/test.json",
+			"result": ["hello"]
+		}, {
+			"path": "/test2.yaml",
+			"result": ["hello"]
+		}, {
+			"path": "/test3.yml",
+			"result": ["hello"]
+		}]}`))
+
+		if !reflect.DeepEqual(output, exp) {
+			t.Fatal("Expected:", exp, "Got:", output)
+		}
+	})
+
+}
+
+func TestExecDecisionOption(t *testing.T) {
+
+	files := map[string]string{
+		"test.json": `{"foo": 7}`,
+	}
+
+	test.WithTempFS(files, func(dir string) {
+
+		s := sdk_test.MustNewServer(sdk_test.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"test.rego": `
+				package foo
+				main["hello"]
+			`,
+		}))
+
+		defer s.Stop()
+
+		var buf bytes.Buffer
+		params := exec.NewParams(&buf)
+		_ = params.OutputFormat.Set("json")
+		params.Decision = "foo/main"
+		params.ConfigOverrides = []string{
+			"services.test.url=" + s.URL(),
+			"bundles.test.resource=/bundles/bundle.tar.gz",
+		}
+
+		params.Paths = append(params.Paths, dir)
+		err := runExec(params)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		output := util.MustUnmarshalJSON(bytes.ReplaceAll(buf.Bytes(), []byte(dir), nil))
+
+		exp := util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/test.json",
+			"result": ["hello"]
+		}]}`))
+
+		if !reflect.DeepEqual(output, exp) {
+			t.Fatal("Expected:", exp, "Got:", output)
+		}
+
+	})
+
+}
+
+func TestExecBundleFlag(t *testing.T) {
+
+	files := map[string]string{
+		"files/test.json": `{"foo": 7}`,
+		"bundle/x.rego": `package system
+
+		main["hello"]`,
+	}
+
+	test.WithTempFS(files, func(dir string) {
+
+		var buf bytes.Buffer
+		params := exec.NewParams(&buf)
+		_ = params.OutputFormat.Set("json")
+		params.BundlePaths = []string{dir + "/bundle/"}
+		params.Paths = append(params.Paths, dir+"/files/")
+
+		err := runExec(params)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		output := util.MustUnmarshalJSON(bytes.ReplaceAll(buf.Bytes(), []byte(dir), nil))
+
+		exp := util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": ["hello"]
+		}]}`))
+
+		if !reflect.DeepEqual(output, exp) {
+			t.Fatal("Expected:", exp, "Got:", output)
+		}
+
+	})
+}
+
+func TestInvalidConfig(t *testing.T) {
+	var buf bytes.Buffer
+	params := exec.NewParams(&buf)
+	params.Fail = true
+	params.FailDefined = true
+
+	err := exec.Exec(context.TODO(), nil, params)
+	if err == nil || err.Error() != "specify --fail or --fail-defined but not both" {
+		t.Fatalf("Expected error '%s' but got '%s'", "specify --fail or --fail-defined but not both", err.Error())
+	}
+}
+
+func TestFailFlagCases(t *testing.T) {
+
+	var tests = []struct {
+		description string
+		files       map[string]string
+		decision    string
+		expectError bool
+		expected    interface{}
+		fail        bool
+		failDefined bool
+	}{
+		{
+			description: "--fail-defined with undefined result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package system
+
+		test_fun := x {
+			x = false
+			x
+		}
+
+		undefined_test {
+			test_fun
+		}`,
+			},
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"error": {
+				"code": "opa_undefined_error",
+				"message": "/system/main decision was undefined"
+			  }
+		}]}`)),
+			failDefined: true,
+		},
+		{
+			description: "--fail-defined with populated result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package system
+
+		main["hello"]`,
+			},
+			decision:    "",
+			expectError: true,
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": ["hello"]
+		}]}`)),
+			failDefined: true,
+		},
+		{
+			description: "--fail-defined with true boolean result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package fail.defined.flag
+
+               some_function {
+                       input.foo == 7
+               }
+
+               default fail_test := false
+               fail_test {
+                       some_function
+               }`,
+			},
+			decision:    "fail/defined/flag/fail_test",
+			expectError: true,
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": true
+		}]}`)),
+			failDefined: true,
+		},
+		{
+			description: "--fail-defined with false boolean result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package fail.defined.flag
+
+		default fail_test := false
+		fail_test {
+			false
+		}`,
+			},
+			decision:    "fail/defined/flag/fail_test",
+			expectError: true,
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": false
+		}]}`)),
+			failDefined: true,
+		},
+		{
+			description: "--fail with undefined result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package system
+
+		test_fun := x {
+			x = false
+			x
+		}
+
+		undefined_test {
+			test_fun
+		}`,
+			},
+			expectError: true,
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"error": {
+				"code": "opa_undefined_error",
+				"message": "/system/main decision was undefined"
+			  }
+		}]}`)),
+			fail: true,
+		},
+		{
+			description: "--fail with populated result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package system
+
+		main["hello"]`,
+			},
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": ["hello"]
+		}]}`)),
+			fail: true,
+		},
+		{
+			description: "--fail-defined with true boolean result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package fail.defined.flag
+
+               some_function {
+                       input.foo == 7
+               }
+
+               default fail_test := false
+               fail_test {
+                       some_function
+               }`,
+			},
+			decision: "fail/defined/flag/fail_test",
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": true
+		}]}`)),
+			fail: true,
+		},
+		{
+			description: "--fail-defined with false boolean result",
+			files: map[string]string{
+				"files/test.json": `{"foo": 7}`,
+				"bundle/x.rego": `package fail.defined.flag
+
+		default fail_test := false
+		fail_test {
+			false
+		}`,
+			},
+			decision: "fail/defined/flag/fail_test",
+			expected: util.MustUnmarshalJSON([]byte(`{"result": [{
+			"path": "/files/test.json",
+			"result": false
+		}]}`)),
+			fail: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			test.WithTempFS(tt.files, func(dir string) {
+				var buf bytes.Buffer
+				params := exec.NewParams(&buf)
+				_ = params.OutputFormat.Set("json")
+				params.BundlePaths = []string{dir + "/bundle/"}
+				params.Paths = append(params.Paths, dir+"/files/")
+				if tt.decision != "" {
+					params.Decision = tt.decision
+				}
+				params.FailDefined = tt.failDefined
+				params.Fail = tt.fail
+
+				err := runExec(params)
+				if err != nil && !tt.expectError {
+					t.Fatal("unexpected error in test")
+				}
+				if err == nil && tt.expectError {
+					t.Fatal("expected error, but none occurred in test")
+				}
+
+				output := util.MustUnmarshalJSON(bytes.ReplaceAll(buf.Bytes(), []byte(dir), nil))
+
+				if !reflect.DeepEqual(output, tt.expected) {
+					t.Errorf("Expected %v, got: %v", tt.expected, output)
+				}
+			})
+		})
+	}
+}
diff --git a/cmd/features.go b/cmd/features.go
index 464f4005cc..ed3de8e645 100644
--- a/cmd/features.go
+++ b/cmd/features.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build opa_wasm
 // +build opa_wasm
 
 package cmd
diff --git a/cmd/flags.go b/cmd/flags.go
index 316f569817..264fdb3c82 100644
--- a/cmd/flags.go
+++ b/cmd/flags.go
@@ -6,7 +6,6 @@ package cmd
 
 import (
 	"fmt"
-	"os"
 
 	"github.com/spf13/pflag"
 
@@ -70,6 +69,10 @@ func addOutputFormat(fs *pflag.FlagSet, outputFormat *util.EnumFlag) {
 	fs.VarP(outputFormat, "format", "f", "set output format")
 }
 
+func addListAnnotations(fs *pflag.FlagSet, value *bool) {
+	fs.BoolVarP(value, "annotations", "a", false, "list annotations")
+}
+
 func addBenchmemFlag(fs *pflag.FlagSet, benchMem *bool, value bool) {
 	fs.BoolVar(benchMem, "benchmem", value, "report memory allocations with benchmark results")
 }
@@ -91,7 +94,7 @@ func addSigningAlgFlag(fs *pflag.FlagSet, alg *string, value string) {
 }
 
 func addClaimsFileFlag(fs *pflag.FlagSet, file *string) {
-	fs.StringVarP(file, "claims-file", "", "", "set path of JSON file containing optional claims (see: https://openpolicyagent.org/docs/latest/management/#signature-format)")
+	fs.StringVarP(file, "claims-file", "", "", "set path of JSON file containing optional claims (see: https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format)")
 }
 
 func addSigningKeyFlag(fs *pflag.FlagSet, key *string) {
@@ -99,7 +102,7 @@ func addSigningKeyFlag(fs *pflag.FlagSet, key *string) {
 }
 
 func addSigningPluginFlag(fs *pflag.FlagSet, plugin *string) {
-	fs.StringVarP(plugin, "signing-plugin", "", "", "name of the plugin to use for signing/verification (see https://openpolicyagent.org/docs/latest/management/#signature-plugin")
+	fs.StringVarP(plugin, "signing-plugin", "", "", "name of the plugin to use for signing/verification (see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-plugin")
 }
 
 func addVerificationKeyFlag(fs *pflag.FlagSet, key *string) {
@@ -123,7 +126,7 @@ func addBundleVerificationExcludeFilesFlag(fs *pflag.FlagSet, excludeNames *[]st
 }
 
 func addCapabilitiesFlag(fs *pflag.FlagSet, f *capabilitiesFlag) {
-	fs.VarP(f, "capabilities", "", "set capabilities.json file path")
+	fs.VarP(f, "capabilities", "", "set capabilities version or capabilities.json file path")
 }
 
 func addPartialFlag(fs *pflag.FlagSet, partial *bool, value bool) {
@@ -146,11 +149,20 @@ func addTargetFlag(fs *pflag.FlagSet, target *util.EnumFlag) {
 	fs.VarP(target, "target", "t", "set the runtime to exercise")
 }
 
+func addStrictFlag(fs *pflag.FlagSet, strict *bool, value bool) {
+	fs.BoolVarP(strict, "strict", "S", value, "enable compiler strict mode")
+}
+
+func addE2EFlag(fs *pflag.FlagSet, e2e *bool, value bool) {
+	fs.BoolVar(e2e, "e2e", value, "run benchmarks against a running OPA server")
+}
+
 const (
 	explainModeOff   = "off"
 	explainModeFull  = "full"
 	explainModeNotes = "notes"
 	explainModeFails = "fails"
+	explainModeDebug = "debug"
 )
 
 func newExplainFlag(modes []string) *util.EnumFlag {
@@ -162,8 +174,8 @@ func setExplainFlag(fs *pflag.FlagSet, explain *util.EnumFlag) {
 }
 
 type capabilitiesFlag struct {
-	C    *ast.Capabilities
-	path string
+	C             *ast.Capabilities
+	pathOrVersion string
 }
 
 func newcapabilitiesFlag() *capabilitiesFlag {
@@ -179,18 +191,23 @@ func (f *capabilitiesFlag) Type() string {
 }
 
 func (f *capabilitiesFlag) String() string {
-	return f.path
+	return f.pathOrVersion
 }
 
 func (f *capabilitiesFlag) Set(s string) error {
-	f.path = s
-	fd, err := os.Open(s)
-	if err != nil {
-		return err
+	f.pathOrVersion = s
+	var errPath, errVersion error
+
+	f.C, errPath = ast.LoadCapabilitiesFile(s)
+	if errPath != nil {
+		f.C, errVersion = ast.LoadCapabilitiesVersion(s)
+	}
+
+	if errVersion != nil && errPath != nil {
+		return fmt.Errorf("no such file or capabilities version found: %v", s)
 	}
-	defer fd.Close()
-	f.C, err = ast.LoadCapabilitiesJSON(fd)
-	return err
+	return nil
+
 }
 
 type stringptrFlag struct {
diff --git a/cmd/fmt.go b/cmd/fmt.go
index 2f6d62832c..787eab29af 100644
--- a/cmd/fmt.go
+++ b/cmd/fmt.go
@@ -8,7 +8,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -104,7 +103,7 @@ func formatFile(params *fmtCommandParams, out io.Writer, filename string, info o
 		return nil
 	}
 
-	contents, err := ioutil.ReadFile(filename)
+	contents, err := os.ReadFile(filename)
 	if err != nil {
 		return newError("failed to open file: %v", err)
 	}
@@ -116,7 +115,7 @@ func formatFile(params *fmtCommandParams, out io.Writer, filename string, info o
 
 	changed := !bytes.Equal(contents, formatted)
 
-	if params.fail {
+	if params.fail && !params.list && !params.diff {
 		if changed {
 			return newError("unexpected diff")
 		}
@@ -125,6 +124,10 @@ func formatFile(params *fmtCommandParams, out io.Writer, filename string, info o
 	if params.list {
 		if changed {
 			fmt.Fprintln(out, filename)
+
+			if params.fail {
+				return newError("unexpected diff")
+			}
 		}
 		return nil
 	}
@@ -138,6 +141,10 @@ func formatFile(params *fmtCommandParams, out io.Writer, filename string, info o
 			}
 
 			fmt.Fprintln(out, stdout.String())
+
+			if params.fail {
+				return newError("unexpected diff")
+			}
 		}
 		return nil
 	}
@@ -161,7 +168,7 @@ func formatFile(params *fmtCommandParams, out io.Writer, filename string, info o
 
 func formatStdin(r io.Reader, w io.Writer) error {
 
-	contents, err := ioutil.ReadAll(r)
+	contents, err := io.ReadAll(r)
 	if err != nil {
 		return err
 	}
@@ -176,14 +183,14 @@ func formatStdin(r io.Reader, w io.Writer) error {
 }
 
 func doDiff(old, new []byte) (stdout, stderr bytes.Buffer, err error) {
-	o, err := ioutil.TempFile("", ".opafmt")
+	o, err := os.CreateTemp("", ".opafmt")
 	if err != nil {
 		return stdout, stderr, err
 	}
 	defer os.Remove(o.Name())
 	defer o.Close()
 
-	n, err := ioutil.TempFile("", ".opafmt")
+	n, err := os.CreateTemp("", ".opafmt")
 	if err != nil {
 		return stdout, stderr, err
 	}
diff --git a/cmd/fmt_test.go b/cmd/fmt_test.go
index af53296bbe..b45dda6d8c 100644
--- a/cmd/fmt_test.go
+++ b/cmd/fmt_test.go
@@ -2,12 +2,15 @@ package cmd
 
 import (
 	"bytes"
-	"io/ioutil"
+	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/format"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -20,20 +23,41 @@ p {
 }
 `
 
+const unformatted = `
+        package test
+
+        p { a == 1; true
+                1 +    3
+        }
+
+
+`
+
+const singleWrongArity = `package test
+
+p {
+	a := 1
+	b := 2
+	plus(a, b, c) == 3
+}
+`
+
+const MultipleWrongArity = `package test
+
+p {
+	x:=5
+	y:=7
+	z:=6
+	plus([x, y]) == 3
+	and(true, false, false) == false
+	plus(a, x, y, z)
+}
+`
+
 func TestFmtFormatFile(t *testing.T) {
 	params := fmtCommandParams{}
 	var stdout bytes.Buffer
 
-	unformatted := `
-	package test
-	
-	p { a == 1; true
-		1 +    3
-	}
-
-	
-	`
-
 	files := map[string]string{
 		"policy.rego": unformatted,
 	}
@@ -76,6 +100,32 @@ func TestFmtFormatFileNoChanges(t *testing.T) {
 	})
 }
 
+func TestFmtFailFormatFileNoChanges(t *testing.T) {
+	params := fmtCommandParams{
+		fail: true,
+		diff: true,
+	}
+	var stdout bytes.Buffer
+
+	files := map[string]string{
+		"policy.rego": formatted,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		policyFile := filepath.Join(path, "policy.rego")
+		info, err := os.Stat(policyFile)
+		err = formatFile(&params, &stdout, policyFile, info, err)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		actual := stdout.String()
+		if len(actual) > 0 {
+			t.Fatalf("Expected no output, got:\n%v\n\n", actual)
+		}
+	})
+}
+
 func TestFmtFormatFileDiff(t *testing.T) {
 	params := fmtCommandParams{
 		diff: true,
@@ -128,6 +178,58 @@ func TestFmtFormatFileList(t *testing.T) {
 	})
 }
 
+func TestFmtFailFormatFileList(t *testing.T) {
+	params := fmtCommandParams{
+		fail: true,
+		list: true,
+	}
+	var stdout bytes.Buffer
+
+	files := map[string]string{
+		"policy.rego": formatted,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		policyFile := filepath.Join(path, "policy.rego")
+		info, err := os.Stat(policyFile)
+		err = formatFile(&params, &stdout, policyFile, info, err)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		actual := strings.TrimSpace(stdout.String())
+		if len(actual) > 0 {
+			t.Fatalf("Expected no output, got:\n%v\n\n", actual)
+		}
+	})
+}
+
+func TestFmtFailFormatFileChangesList(t *testing.T) {
+	params := fmtCommandParams{
+		fail: true,
+		list: true,
+	}
+	var stdout bytes.Buffer
+
+	files := map[string]string{
+		"policy.rego": unformatted,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		policyFile := filepath.Join(path, "policy.rego")
+		info, err := os.Stat(policyFile)
+		err = formatFile(&params, &stdout, policyFile, info, err)
+		if err == nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		actual := strings.TrimSpace(stdout.String())
+		if len(actual) == 0 {
+			t.Fatalf("Expected output, got:\n%v\n\n", actual)
+		}
+	})
+}
+
 func TestFmtFailFileNoChanges(t *testing.T) {
 	params := fmtCommandParams{
 		fail: true,
@@ -140,7 +242,7 @@ func TestFmtFailFileNoChanges(t *testing.T) {
 	test.WithTempFS(files, func(path string) {
 		policyFile := filepath.Join(path, "policy.rego")
 		info, err := os.Stat(policyFile)
-		err = formatFile(&params, ioutil.Discard, policyFile, info, err)
+		err = formatFile(&params, io.Discard, policyFile, info, err)
 		if err != nil {
 			t.Fatalf("Expected error but did not receive one")
 		}
@@ -152,15 +254,26 @@ func TestFmtFailFileChanges(t *testing.T) {
 		fail: true,
 	}
 
-	unformatted := `
-	package test
-	
-	p { a == 1; true
-		1 +    3
+	files := map[string]string{
+		"policy.rego": unformatted,
 	}
 
-	
-	`
+	test.WithTempFS(files, func(path string) {
+		policyFile := filepath.Join(path, "policy.rego")
+		info, err := os.Stat(policyFile)
+		err = formatFile(&params, io.Discard, policyFile, info, err)
+		if err == nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+	})
+}
+
+func TestFmtFailFileChangesDiff(t *testing.T) {
+	params := fmtCommandParams{
+		diff: true,
+		fail: true,
+	}
+	var stdout bytes.Buffer
 
 	files := map[string]string{
 		"policy.rego": unformatted,
@@ -169,9 +282,100 @@ func TestFmtFailFileChanges(t *testing.T) {
 	test.WithTempFS(files, func(path string) {
 		policyFile := filepath.Join(path, "policy.rego")
 		info, err := os.Stat(policyFile)
-		err = formatFile(&params, ioutil.Discard, policyFile, info, err)
+		err = formatFile(&params, &stdout, policyFile, info, err)
 		if err == nil {
-			t.Fatalf("Unexpected error: %s", err)
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		actual := strings.TrimSpace(stdout.String())
+		if len(actual) == 0 {
+			t.Fatalf("Expected output, got:\n%v\n\n", actual)
+		}
+	})
+}
+
+func TestFmtSingleWrongArityError(t *testing.T) {
+	params := fmtCommandParams{}
+	var stdout bytes.Buffer
+
+	files := map[string]string{
+		"policy.rego": singleWrongArity,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		policyFile := filepath.Join(path, "policy.rego")
+		info, err := os.Stat(policyFile)
+		err = formatFile(&params, &stdout, policyFile, info, err)
+		if err == nil {
+			t.Fatalf("Expected error but did not receive one")
+		}
+
+		loc := ast.Location{File: policyFile, Row: 6}
+		errExp := ast.NewError(ast.TypeErr, &loc, "%s: %s", "plus", "arity mismatch")
+		errExp.Details = &format.ArityFormatErrDetail{
+			Have: []string{"var", "var", "var"},
+			Want: []string{"number", "number"},
+		}
+		expectedErrs := ast.Errors(make([]*ast.Error, 1))
+		expectedErrs[0] = errExp
+		expectedSingleWrongArityErr := newError("failed to parse Rego source file: %v", fmt.Errorf("%s: %v", policyFile, expectedErrs))
+
+		if err != expectedSingleWrongArityErr {
+			t.Fatalf("Expected:%s\n\nGot:%s\n\n", expectedSingleWrongArityErr, err)
+		}
+	})
+}
+
+func TestFmtMultipleWrongArityError(t *testing.T) {
+	params := fmtCommandParams{}
+	var stdout bytes.Buffer
+
+	files := map[string]string{
+		"policy.rego": MultipleWrongArity,
+	}
+
+	test.WithTempFS(files, func(path string) {
+		policyFile := filepath.Join(path, "policy.rego")
+		info, err := os.Stat(policyFile)
+		err = formatFile(&params, &stdout, policyFile, info, err)
+		if err == nil {
+			t.Fatalf("Expected error but did not receive one")
+		}
+
+		locations := []ast.Location{
+			{File: policyFile, Row: 7},
+			{File: policyFile, Row: 8},
+			{File: policyFile, Row: 9},
+		}
+		haveStrings := [][]string{
+			{"array"},
+			{"boolean", "boolean", "boolean"},
+			{"var", "var", "var", "var"},
+		}
+		wantStrings := [][]string{
+			{"number", "number"},
+			{"set[any]", "set[any]"},
+			{"number", "number"},
+		}
+		operators := []string{
+			"plus",
+			"and",
+			"plus",
+		}
+		expectedErrs := ast.Errors(make([]*ast.Error, 3))
+		for i := 0; i < 3; i++ {
+			loc := locations[i]
+			errExp := ast.NewError(ast.TypeErr, &loc, "%s: %s", operators[i], "arity mismatch")
+			errExp.Details = &format.ArityFormatErrDetail{
+				Have: haveStrings[i],
+				Want: wantStrings[i],
+			}
+			expectedErrs[i] = errExp
+		}
+		expectedMultipleWrongArityErr := newError("failed to parse Rego source file: %v", fmt.Errorf("%s: %v", policyFile, expectedErrs))
+
+		if err != expectedMultipleWrongArityErr {
+			t.Fatalf("Expected:%s\n\nGot:%s\n\n", expectedMultipleWrongArityErr, err)
 		}
 	})
 }
diff --git a/cmd/inspect.go b/cmd/inspect.go
index df6ecbd02f..27a42f4dd0 100644
--- a/cmd/inspect.go
+++ b/cmd/inspect.go
@@ -12,6 +12,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	ib "github.com/open-policy-agent/opa/internal/bundle/inspect"
 	pr "github.com/open-policy-agent/opa/internal/presentation"
@@ -23,9 +24,11 @@ import (
 )
 
 const maxTableFieldLen = 50
+const pageWidth = 80
 
 type inspectCommandParams struct {
-	outputFormat *util.EnumFlag
+	outputFormat    *util.EnumFlag
+	listAnnotations bool
 }
 
 func newInspectCommandParams() inspectCommandParams {
@@ -34,6 +37,7 @@ func newInspectCommandParams() inspectCommandParams {
 			evalJSONOutput,
 			evalPrettyOutput,
 		}),
+		listAnnotations: false,
 	}
 }
 
@@ -42,9 +46,8 @@ func init() {
 	params := newInspectCommandParams()
 
 	var inspectCommand = &cobra.Command{
-		Use:    "inspect <path> [<path> [...]]",
-		Hidden: true,
-		Short:  "Inspect OPA bundle(s)",
+		Use:   "inspect <path> [<path> [...]]",
+		Short: "Inspect OPA bundle(s)",
 		Long: `Inspect OPA bundle(s).
 
 The 'inspect' command provides a summary of the contents in OPA bundle(s). Bundles are
@@ -56,13 +59,13 @@ the following:
 * manifest data
 * signature data
 * information about the Wasm module files
+* package- and rule annotations
 
 Example:
 
-  $ ls
-  bundle.tar.gz
-
-  $ opa inspect bundle.tar.gz
+    $ ls
+    bundle.tar.gz
+    $ opa inspect bundle.tar.gz
 
 You can provide exactly one OPA bundle or path to the 'inspect' command on the command-line. If you provide a path
 referring to a directory, the 'inspect' command will load that path as a bundle and summarize its structure and contents.
@@ -79,11 +82,12 @@ referring to a directory, the 'inspect' command will load that path as a bundle
 	}
 
 	addOutputFormat(inspectCommand.Flags(), params.outputFormat)
+	addListAnnotations(inspectCommand.Flags(), &params.listAnnotations)
 	RootCommand.AddCommand(inspectCommand)
 }
 
 func doInspect(params inspectCommandParams, path string, out io.Writer) error {
-	info, err := ib.File(path)
+	info, err := ib.File(path, params.listAnnotations)
 	if err != nil {
 		return err
 	}
@@ -104,6 +108,13 @@ func doInspect(params inspectCommandParams, path string, out io.Writer) error {
 				return err
 			}
 		}
+
+		if params.listAnnotations && len(info.Annotations) != 0 {
+			if err := populateAnnotations(out, info.Annotations); err != nil {
+				return err
+			}
+		}
+
 		return nil
 	}
 }
@@ -122,10 +133,10 @@ func validateInspectParams(p *inspectCommandParams, args []string) error {
 
 func populateManifest(out io.Writer, m bundle.Manifest) error {
 	t := generateTableWithKeys(out, "field", "value")
-	lines := [][]string{}
+	var lines [][]string
 
 	if m.Revision != "" {
-		lines = append(lines, []string{"Revision", truncateStr(m.Revision)})
+		lines = append(lines, []string{"Revision", truncateTableStr(m.Revision)})
 	}
 
 	if len(*m.Roots) != 0 {
@@ -147,7 +158,7 @@ func populateManifest(out io.Writer, m bundle.Manifest) error {
 		if err != nil {
 			return err
 		}
-		lines = append(lines, []string{"Metadata", truncateStr(string(metadata))})
+		lines = append(lines, []string{"Metadata", truncateTableStr(string(metadata))})
 	}
 
 	t.AppendBulk(lines)
@@ -161,9 +172,12 @@ func populateManifest(out io.Writer, m bundle.Manifest) error {
 
 func populateNamespaces(out io.Writer, n map[string][]string) error {
 	t := generateTableWithKeys(out, "namespace", "file")
-	lines := [][]string{}
+	// only auto-merge the namespace column
+	t.SetAutoMergeCells(false)
+	t.SetAutoMergeCellsByColumnIndex([]int{0})
+	var lines [][]string
 
-	var keys []string
+	keys := make([]string, 0, len(n))
 	for k := range n {
 		keys = append(keys, k)
 	}
@@ -184,28 +198,179 @@ func populateNamespaces(out io.Writer, n map[string][]string) error {
 	return nil
 }
 
+func populateAnnotations(out io.Writer, refs []*ast.AnnotationsRef) error {
+	if len(refs) > 0 {
+		fmt.Fprintln(out, "ANNOTATIONS:")
+		for _, ref := range refs {
+			printTitle(out, ref)
+			fmt.Fprintln(out)
+
+			if a := ref.Annotations; a != nil && len(a.Description) > 0 {
+				fmt.Fprintln(out, a.Description)
+				fmt.Fprintln(out)
+			}
+
+			if p := ref.GetPackage(); p != nil {
+				fmt.Fprintln(out, "Package: ", dropDataPrefix(p.Path))
+			}
+			if r := ref.GetRule(); r != nil {
+				fmt.Fprintln(out, "Rule:    ", r.Head.Name)
+			}
+			if loc := ref.Location; loc != nil {
+				fmt.Fprintln(out, "Location:", loc.String())
+			}
+			if a := ref.Annotations; a != nil {
+				if len(a.Scope) > 0 {
+					fmt.Fprintln(out, "Scope:", a.Scope)
+				}
+				if a.Entrypoint {
+					fmt.Fprintln(out, "Entrypoint:", a.Entrypoint)
+				}
+			}
+			fmt.Fprintln(out)
+
+			if a := ref.Annotations; a != nil {
+				if len(a.Organizations) > 0 {
+					fmt.Fprintln(out, "Organizations:")
+					l := make([]listEntry, 0, len(a.Organizations))
+					for _, o := range a.Organizations {
+						l = append(l, listEntry{"", removeNewLines(o)})
+					}
+					printList(out, l, "")
+					fmt.Fprintln(out)
+				}
+
+				if len(a.Authors) > 0 {
+					fmt.Fprintln(out, "Authors:")
+					l := make([]listEntry, 0, len(a.Authors))
+					for _, a := range a.Authors {
+						l = append(l, listEntry{"", removeNewLines(a.String())})
+					}
+					printList(out, l, "")
+					fmt.Fprintln(out)
+				}
+
+				if len(a.Schemas) > 0 {
+					// NOTE(johanfylling): The Type Checker will MERGE all applicable schema annotations for a rule
+					// into one list. Here, child nodes OVERRIDE parent nodes' schema annotations instead (default annot. behavior).
+					// Should the former behavior be replicated here?
+					fmt.Fprintln(out, "Schemas:")
+					l := make([]listEntry, 0, len(a.Schemas))
+					for _, s := range a.Schemas {
+						le := listEntry{key: s.Path.String()}
+						if len(s.Schema) > 0 {
+							le.value = s.Schema.String()
+						} else if s.Definition != nil {
+							b, _ := json.Marshal(s.Definition)
+							le.value = string(b)
+						}
+						l = append(l, le)
+					}
+					printList(out, l, ": ")
+					fmt.Fprintln(out)
+				}
+
+				if len(a.RelatedResources) > 0 {
+					fmt.Fprintln(out, "Related Resources:")
+					l := make([]listEntry, 0, len(a.RelatedResources))
+					for _, res := range a.RelatedResources {
+						l = append(l, listEntry{removeNewLines(res.Ref.String()), res.Description})
+					}
+					printList(out, l, " ")
+					fmt.Fprintln(out)
+				}
+				if len(a.Custom) > 0 {
+					fmt.Fprintln(out, "Custom:")
+					l := make([]listEntry, 0, len(a.Custom))
+					for k, v := range a.Custom {
+						b, _ := json.Marshal(v)
+						l = append(l, listEntry{k, string(b)})
+					}
+					printList(out, l, ": ")
+					fmt.Fprintln(out)
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+type listEntry struct {
+	key   string
+	value string
+}
+
+func printList(out io.Writer, list []listEntry, separator string) {
+	keyLength := 0
+	for _, e := range list {
+		l := len(e.key)
+		if l > keyLength {
+			keyLength = l
+		}
+	}
+	for _, e := range list {
+		line := fmt.Sprintf(" %s%s%s%s",
+			e.key,
+			separator,
+			strings.Repeat(" ", keyLength-len(e.key)),
+			e.value)
+		fmt.Fprintln(out, truncateStr(line, pageWidth))
+	}
+}
+
+func printTitle(out io.Writer, ref *ast.AnnotationsRef) {
+	var title string
+	if a := ref.Annotations; a != nil {
+		t := strings.TrimSpace(a.Title)
+		if len(t) > 0 {
+			title = t
+		}
+	}
+
+	if len(title) == 0 {
+		title = dropDataPrefix(ref.Path).String()
+	}
+
+	fmt.Fprintf(out, "%s\n", title)
+
+	var underline []byte
+	for i := 0; i < len(title) && i < pageWidth; i++ {
+		underline = append(underline, '=')
+	}
+	fmt.Fprintln(out, string(underline))
+}
+
 func generateTableWithKeys(writer io.Writer, keys ...string) *tablewriter.Table {
 	table := tablewriter.NewWriter(writer)
 	aligns := []int{}
-	var hdrs []string
+	hdrs := make([]string, 0, len(keys))
 	for _, k := range keys {
-		hdrs = append(hdrs, strings.Title((k)))
+		hdrs = append(hdrs, strings.Title(k)) //nolint:staticcheck // SA1019, no unicode
 		aligns = append(aligns, tablewriter.ALIGN_LEFT)
 	}
 	table.SetHeader(hdrs)
 	table.SetAlignment(tablewriter.ALIGN_CENTER)
-	table.SetColumnAlignment(aligns)
 	table.SetAutoMergeCells(true)
+	table.SetColumnAlignment(aligns)
 	table.SetRowLine(false)
 	table.SetAutoWrapText(false)
 	return table
 }
 
-func truncateStr(s string) string {
-	if len(s) < maxTableFieldLen {
+func truncateTableStr(s string) string {
+	return truncateStr(s, maxTableFieldLen)
+}
+
+func truncateStr(s string, maxLen int) string {
+	if len(s) < maxLen {
 		return s
 	}
-	return fmt.Sprintf("%v...", s[:maxTableFieldLen])
+	return fmt.Sprintf("%v...", s[:maxLen-3])
+}
+
+func removeNewLines(s string) string {
+	return strings.ReplaceAll(s, "\n", " ")
 }
 
 func truncateFileName(s string) string {
@@ -216,3 +381,15 @@ func truncateFileName(s string) string {
 	res, _ := iStrs.TruncateFilePaths(maxTableFieldLen, len(s), s)
 	return res[s]
 }
+
+// dropDataPrefix drops the first component of the passed Ref
+func dropDataPrefix(ref ast.Ref) ast.Ref {
+	if len(ref) <= 1 {
+		return ast.EmptyRef()
+	}
+	r := ref[1:].Copy()
+	if s, ok := r[0].Value.(ast.String); ok {
+		r[0].Value = ast.Var(s)
+	}
+	return r
+}
diff --git a/cmd/inspect_test.go b/cmd/inspect_test.go
index ccb9c65f8e..8ac578df27 100644
--- a/cmd/inspect_test.go
+++ b/cmd/inspect_test.go
@@ -114,19 +114,19 @@ func TestDoInspectPretty(t *testing.T) {
 		output := strings.TrimSpace(out.String())
 		expected := strings.TrimSpace(`
  MANIFEST:
-+----------+-------------------------------------------------------+
-|  FIELD   |                         VALUE                         |
-+----------+-------------------------------------------------------+
-| Revision | foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfo... |
-| Roots    | a                                                     |
-|          | bar                                                   |
-|          | foo                                                   |
-|          | fuz                                                   |
-|          | http                                                  |
-|          | metadata/...oobarfoobarfoobarfoobarfoobar/features    |
-|          | x                                                     |
-| Metadata | {"hello":"worldworldworldworldworldworldworldworld... |
-+----------+-------------------------------------------------------+
++----------+----------------------------------------------------+
+|  FIELD   |                       VALUE                        |
++----------+----------------------------------------------------+
+| Revision | foobarfoobarfoobarfoobarfoobarfoobarfoobarfooba... |
+| Roots    | a                                                  |
+|          | bar                                                |
+|          | foo                                                |
+|          | fuz                                                |
+|          | http                                               |
+|          | metadata/...oobarfoobarfoobarfoobarfoobar/features |
+|          | x                                                  |
+| Metadata | {"hello":"worldworldworldworldworldworldworldwo... |
++----------+----------------------------------------------------+
 NAMESPACES:
 +-----------------------------+----------------------------------------------------+
 |          NAMESPACE          |                        FILE                        |
@@ -211,3 +211,356 @@ func TestInspectMultiBundleError(t *testing.T) {
 		t.Fatalf("Expected error %v but got %v", exp, err.Error())
 	}
 }
+
+func TestDoInspectPrettyWithAnnotations(t *testing.T) {
+
+	files := map[string]string{
+		"x.rego": `# METADATA
+# title: pkg-title
+# description: pkg-descr
+# organizations:
+# - pkg-org
+# related_resources:
+# - https://pkg
+# - ref: https://pkg
+#   description: rr-pkg-note
+# authors:
+# - pkg-author
+# schemas:
+# - input: {"type": "boolean"}
+# custom:
+#  pkg: pkg-custom
+package test
+
+# METADATA
+# scope: document
+# title: doc-title
+# description: doc-descr
+# organizations:
+# - doc-org
+# related_resources:
+# - https://doc
+# - ref: https://doc
+#   description: rr-doc-note
+# authors:
+# - doc-author
+# schemas:
+# - input: {"type": "integer"}
+# custom:
+#  doc: doc-custom
+
+# METADATA
+# title: rule-title
+# description: rule-title
+# organizations:
+# - rule-org
+# related_resources:
+# - https://rule
+# - ref: https://rule
+#   description: rr-rule-note
+# authors:
+# - rule-author
+# schemas:
+# - input: {"type": "string"}
+# custom:
+#  rule: rule-custom
+p = 1`,
+	}
+
+	test.WithTempFS(files, func(rootDir string) {
+		ps := newInspectCommandParams()
+		ps.listAnnotations = true
+		var out bytes.Buffer
+		err := doInspect(ps, rootDir, &out)
+		if err != nil {
+			t.Fatalf("Unexpected error %v", err)
+		}
+
+		bs := out.Bytes()
+		idx := bytes.Index(bs, []byte(`ANNOTATIONS`)) // skip NAMESPACE box
+		output := strings.TrimSpace(string(bs[idx:]))
+		expected := strings.TrimSpace(fmt.Sprintf(`
+ANNOTATIONS:
+pkg-title
+=========
+
+pkg-descr
+
+Package:  test
+Location: %[1]s/x.rego:16
+Scope: package
+
+Organizations:
+ pkg-org
+
+Authors:
+ pkg-author
+
+Schemas:
+ input: {"type":"boolean"}
+
+Related Resources:
+ https://pkg 
+ https://pkg rr-pkg-note
+
+Custom:
+ pkg: "pkg-custom"
+
+doc-title
+=========
+
+doc-descr
+
+Package:  test
+Rule:     p
+Location: %[1]s/x.rego:50
+Scope: document
+
+Organizations:
+ doc-org
+
+Authors:
+ doc-author
+
+Schemas:
+ input: {"type":"integer"}
+
+Related Resources:
+ https://doc 
+ https://doc rr-doc-note
+
+Custom:
+ doc: "doc-custom"
+
+rule-title
+==========
+
+rule-title
+
+Package:  test
+Rule:     p
+Location: %[1]s/x.rego:50
+Scope: rule
+
+Organizations:
+ rule-org
+
+Authors:
+ rule-author
+
+Schemas:
+ input: {"type":"string"}
+
+Related Resources:
+ https://rule 
+ https://rule rr-rule-note
+
+Custom:
+ rule: "rule-custom"`, rootDir))
+
+		if output != expected {
+			t.Fatalf("Unexpected output. Expected:\n\n%q\n\nGot:\n\n%q", expected, output)
+		}
+
+	})
+}
+
+func TestDoInspectTarballPrettyWithAnnotations(t *testing.T) {
+
+	files := [][2]string{
+		{"x.rego", `# METADATA
+# title: pkg-title
+# description: pkg-descr
+# organizations:
+# - pkg-org
+# related_resources:
+# - https://pkg
+# - ref: https://pkg
+#   description: rr-pkg-note
+# authors:
+# - pkg-author
+# schemas:
+# - input: {"type": "boolean"}
+# custom:
+#  pkg: pkg-custom
+package test
+
+# METADATA
+# scope: document
+# title: doc-title
+# description: doc-descr
+# organizations:
+# - doc-org
+# related_resources:
+# - https://doc
+# - ref: https://doc
+#   description: rr-doc-note
+# authors:
+# - doc-author
+# schemas:
+# - input: {"type": "integer"}
+# custom:
+#  doc: doc-custom
+
+# METADATA
+# title: rule-title
+# description: rule-title
+# organizations:
+# - rule-org
+# related_resources:
+# - https://rule
+# - ref: https://rule
+#   description: rr-rule-note
+# authors:
+# - rule-author
+# schemas:
+# - input: {"type": "string"}
+# custom:
+#  rule: rule-custom
+p = 1`},
+		{".manifest", `
+{
+	"revision": "",
+	"roots": [
+		""
+	],
+	"wasm": [
+		{
+			"entrypoint": "test/a",
+			"module": "/policy.wasm"
+		},
+		{
+			"entrypoint": "test/b",
+			"module": "/policy.wasm",
+			"annotations": [
+				{
+					"scope": "rule",
+					"title": "WASM RULE B",
+					"entrypoint": true
+				}
+			]
+		}
+	]
+}`},
+		{"policy.wasm", ""},
+	}
+
+	buf := archive.MustWriteTarGz(files)
+
+	test.WithTempFS(nil, func(rootDir string) {
+		bundleFile := filepath.Join(rootDir, "bundle.tar.gz")
+
+		bf, err := os.Create(bundleFile)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		_, err = bf.Write(buf.Bytes())
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		ps := newInspectCommandParams()
+		ps.listAnnotations = true
+		var out bytes.Buffer
+
+		err = doInspect(ps, bundleFile, &out)
+		if err != nil {
+			t.Fatalf("Unexpected error %v", err)
+		}
+
+		bs := out.Bytes()
+		idx := bytes.Index(bs, []byte(`ANNOTATIONS`)) // skip NAMESPACE box
+		output := strings.TrimSpace(string(bs[idx:]))
+		expected := strings.TrimSpace(`
+ANNOTATIONS:
+pkg-title
+=========
+
+pkg-descr
+
+Package:  test
+Location: /x.rego:16
+Scope: package
+
+Organizations:
+ pkg-org
+
+Authors:
+ pkg-author
+
+Schemas:
+ input: {"type":"boolean"}
+
+Related Resources:
+ https://pkg 
+ https://pkg rr-pkg-note
+
+Custom:
+ pkg: "pkg-custom"
+
+WASM RULE B
+===========
+
+Location: /policy.wasm:0
+Scope: rule
+Entrypoint: true
+
+doc-title
+=========
+
+doc-descr
+
+Package:  test
+Rule:     p
+Location: /x.rego:50
+Scope: document
+
+Organizations:
+ doc-org
+
+Authors:
+ doc-author
+
+Schemas:
+ input: {"type":"integer"}
+
+Related Resources:
+ https://doc 
+ https://doc rr-doc-note
+
+Custom:
+ doc: "doc-custom"
+
+rule-title
+==========
+
+rule-title
+
+Package:  test
+Rule:     p
+Location: /x.rego:50
+Scope: rule
+
+Organizations:
+ rule-org
+
+Authors:
+ rule-author
+
+Schemas:
+ input: {"type":"string"}
+
+Related Resources:
+ https://rule 
+ https://rule rr-rule-note
+
+Custom:
+ rule: "rule-custom"`)
+
+		if output != expected {
+			t.Fatalf("Unexpected output. Expected:\n\n%q\n\nGot:\n\n%q", expected, output)
+		}
+
+	})
+}
diff --git a/cmd/internal/exec/exec.go b/cmd/internal/exec/exec.go
new file mode 100644
index 0000000000..e7f9f10c93
--- /dev/null
+++ b/cmd/internal/exec/exec.go
@@ -0,0 +1,224 @@
+package exec
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/open-policy-agent/opa/sdk"
+	"github.com/open-policy-agent/opa/util"
+)
+
+type Params struct {
+	Paths               []string       // file paths to execute against
+	Output              io.Writer      // output stream to write normal output to
+	ConfigFile          string         // OPA configuration file path
+	ConfigOverrides     []string       // OPA configuration overrides (--set arguments)
+	ConfigOverrideFiles []string       // OPA configuration overrides (--set-file arguments)
+	OutputFormat        *util.EnumFlag // output format (default: pretty)
+	LogLevel            *util.EnumFlag // log level for plugins
+	LogFormat           *util.EnumFlag // log format for plugins
+	LogTimestampFormat  string         // log timestamp format for plugins
+	BundlePaths         []string       // explicit paths of bundles to inject into the configuration
+	Decision            string         // decision to evaluate (overrides default decision set by configuration)
+	Fail                bool           // exits with non-zero exit code on undefined/empty result and errors
+	FailDefined         bool           // exits with non-zero exit code on defined/non-empty result and errors
+}
+
+func NewParams(w io.Writer) *Params {
+	return &Params{
+		Output:       w,
+		OutputFormat: util.NewEnumFlag("pretty", []string{"pretty", "json"}),
+		LogLevel:     util.NewEnumFlag("error", []string{"debug", "info", "error"}),
+		LogFormat:    util.NewEnumFlag("json", []string{"text", "json", "json-pretty"}),
+	}
+}
+
+func (p *Params) validateParams() error {
+	if p.Fail && p.FailDefined {
+		return errors.New("specify --fail or --fail-defined but not both")
+	}
+	return nil
+}
+
+// Exec executes OPA against the supplied files and outputs each result.
+//
+// NOTE(tsandall): consider expanding functionality:
+//
+//   - specialized output formats (e.g., pretty/non-JSON outputs)
+//   - exit codes set by convention or policy (e.g,. non-empty set => error)
+//   - support for new input file formats beyond JSON and YAML
+func Exec(ctx context.Context, opa *sdk.OPA, params *Params) error {
+
+	err := params.validateParams()
+	if err != nil {
+		return err
+	}
+
+	now := time.Now()
+	r := &jsonReporter{w: params.Output, buf: make([]result, 0)}
+
+	failCount := 0
+	errorCount := 0
+
+	for item := range listAllPaths(params.Paths) {
+
+		if item.Error != nil {
+			return item.Error
+		}
+
+		input, err := parse(item.Path)
+
+		if err != nil {
+			if err2 := r.Report(result{Path: item.Path, Error: err}); err2 != nil {
+				return err2
+			}
+			if params.FailDefined || params.Fail {
+				errorCount++
+			}
+			continue
+		} else if input == nil {
+			continue
+		}
+
+		rs, err := opa.Decision(ctx, sdk.DecisionOptions{
+			Path:  params.Decision,
+			Now:   now,
+			Input: input,
+		})
+		if err != nil {
+			if err2 := r.Report(result{Path: item.Path, Error: err}); err2 != nil {
+				return err2
+			}
+			if (params.FailDefined && !sdk.IsUndefinedErr(err)) || (params.Fail && sdk.IsUndefinedErr(err)) {
+				errorCount++
+			}
+			continue
+		}
+
+		if err := r.Report(result{Path: item.Path, Result: &rs.Result}); err != nil {
+			return err
+		}
+
+		if (params.FailDefined && rs.Result != nil) || (params.Fail && rs.Result == nil) {
+			failCount++
+		}
+	}
+
+	if err := r.Close(); err != nil {
+		return err
+	}
+
+	if (params.Fail || params.FailDefined) && (failCount > 0 || errorCount > 0) {
+		if params.Fail {
+			return fmt.Errorf("there were %d failures and %d errors counted in the results list, and --fail is set", failCount, errorCount)
+		}
+		return fmt.Errorf("there were %d failures and %d errors counted in the results list, and --fail-defined is set", failCount, errorCount)
+	}
+
+	return nil
+}
+
+type result struct {
+	Path   string       `json:"path"`
+	Error  error        `json:"error,omitempty"`
+	Result *interface{} `json:"result,omitempty"`
+}
+
+type jsonReporter struct {
+	w   io.Writer
+	buf []result
+}
+
+func (jr *jsonReporter) Report(r result) error {
+	jr.buf = append(jr.buf, r)
+	return nil
+}
+
+func (jr *jsonReporter) Close() error {
+	enc := json.NewEncoder(jr.w)
+	enc.SetIndent("", "  ")
+	return enc.Encode(struct {
+		Result []result `json:"result"`
+	}{
+		Result: jr.buf,
+	})
+}
+
+type fileListItem struct {
+	Path  string
+	Error error
+}
+
+func listAllPaths(roots []string) chan fileListItem {
+	ch := make(chan fileListItem)
+	go func() {
+		for _, path := range roots {
+			err := filepath.Walk(path, func(path string, info os.FileInfo, err error) error {
+				if err != nil {
+					return err
+				}
+				if info.IsDir() {
+					return nil
+				}
+				ch <- fileListItem{Path: path}
+				return nil
+			})
+			if err != nil {
+				ch <- fileListItem{Path: path, Error: err}
+			}
+		}
+		close(ch)
+	}()
+	return ch
+}
+
+var parsers = map[string]parser{
+	".json": utilParser{},
+	".yaml": utilParser{},
+	".yml":  utilParser{},
+}
+
+type parser interface {
+	Parse(io.Reader) (interface{}, error)
+}
+
+type utilParser struct {
+}
+
+func (utilParser) Parse(r io.Reader) (interface{}, error) {
+	bs, err := io.ReadAll(r)
+	if err != nil {
+		return nil, err
+	}
+	var x interface{}
+	return x, util.Unmarshal(bs, &x)
+}
+
+func parse(p string) (*interface{}, error) {
+
+	parser, ok := parsers[path.Ext(p)]
+	if !ok {
+		return nil, nil
+	}
+
+	f, err := os.Open(p)
+	if err != nil {
+		return nil, err
+	}
+
+	defer f.Close()
+
+	val, err := parser.Parse(f)
+	if err != nil {
+		return nil, err
+	}
+
+	return &val, nil
+}
diff --git a/cmd/oracle.go b/cmd/oracle.go
index 9f1e9e38e7..c275bdf9ad 100644
--- a/cmd/oracle.go
+++ b/cmd/oracle.go
@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strconv"
 	"strings"
@@ -107,7 +106,14 @@ func dofindDefinition(params findDefinitionParams, stdin io.Reader, stdout io.Wr
 		if len(params.bundlePaths.v) > 1 {
 			return errors.New("not implemented: multiple bundle paths")
 		}
-		b, err = loader.NewFileLoader().WithSkipBundleVerification(true).AsBundle(params.bundlePaths.v[0])
+		b, err = loader.NewFileLoader().
+			WithSkipBundleVerification(true).
+			WithFilter(func(abspath string, info os.FileInfo, depth int) bool {
+				// While directories may contain other things of interest for OPA (json, yaml..),
+				// only .rego will work reliably for the purpose of finding definitions
+				return strings.HasPrefix(info.Name(), ".rego")
+			}).
+			AsBundle(params.bundlePaths.v[0])
 		if err != nil {
 			return err
 		}
@@ -124,10 +130,17 @@ func dofindDefinition(params findDefinitionParams, stdin io.Reader, stdout io.Wr
 	var bs []byte
 
 	if params.stdinBuffer {
-		bs, err = ioutil.ReadAll(stdin)
+		stat, err := os.Stdin.Stat()
 		if err != nil {
 			return err
 		}
+		// Only read from stdin when there is something actually there
+		if (stat.Mode() & os.ModeCharDevice) == 0 {
+			bs, err = io.ReadAll(stdin)
+			if err != nil {
+				return err
+			}
+		}
 	}
 
 	result, err := oracle.New().FindDefinition(oracle.DefinitionQuery{
diff --git a/cmd/oracle_test.go b/cmd/oracle_test.go
index 7bc21565d7..2998fbca28 100644
--- a/cmd/oracle_test.go
+++ b/cmd/oracle_test.go
@@ -27,7 +27,11 @@ p { q }
 
 q = true`)
 
-	files := map[string]string{"test.rego": onDiskModule}
+	files := map[string]string{
+		"test.rego":    onDiskModule,
+		"document.txt": "this should not be included",
+		"ignore.json":  `{"neither": "should this"}`,
+	}
 
 	test.WithTempFS(files, func(rootDir string) {
 
diff --git a/cmd/parse.go b/cmd/parse.go
index 5ab073b895..ef529c8ea7 100644
--- a/cmd/parse.go
+++ b/cmd/parse.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -23,10 +24,14 @@ const (
 	parseFormatJSON   = "json"
 )
 
-var parseParams = struct {
-	format *util.EnumFlag
-}{
-	format: util.NewEnumFlag(parseFormatPretty, []string{parseFormatPretty, parseFormatJSON}),
+type parseParams struct {
+	format      *util.EnumFlag
+	jsonInclude string
+}
+
+var configuredParseParams = parseParams{
+	format:      util.NewEnumFlag(parseFormatPretty, []string{parseFormatPretty, parseFormatJSON}),
+	jsonInclude: "",
 }
 
 var parseCommand = &cobra.Command{
@@ -39,31 +44,73 @@ var parseCommand = &cobra.Command{
 		}
 		return nil
 	},
-	Run: func(cmd *cobra.Command, args []string) {
-		os.Exit(parse(args, os.Stdout, os.Stderr))
+	Run: func(_ *cobra.Command, args []string) {
+		os.Exit(parse(args, &configuredParseParams, os.Stdout, os.Stderr))
 	},
 }
 
-func parse(args []string, stdout io.Writer, stderr io.Writer) int {
+func parse(args []string, params *parseParams, stdout io.Writer, stderr io.Writer) int {
 	if len(args) == 0 {
 		return 0
 	}
 
-	result, err := loader.RegoWithOpts(args[0], ast.ParserOptions{ProcessAnnotation: true})
+	exposeLocation := false
+	exposeComments := true
+	for _, opt := range strings.Split(params.jsonInclude, ",") {
+		value := true
+		if strings.HasPrefix(opt, "-") {
+			value = false
+		}
 
-	switch parseParams.format.String() {
-	case parseFormatJSON:
-		if err != nil {
-			_ = pr.JSON(stderr, pr.Output{Errors: pr.NewOutputErrors(err)})
-			return 1
+		if strings.HasSuffix(opt, "locations") {
+			exposeLocation = value
+		}
+		if strings.HasSuffix(opt, "comments") {
+			exposeComments = value
 		}
+	}
 
+	parserOpts := ast.ParserOptions{ProcessAnnotation: true}
+	if exposeLocation {
+		parserOpts.JSONOptions = &ast.JSONOptions{
+			MarshalOptions: ast.JSONMarshalOptions{
+				IncludeLocation: ast.NodeToggle{
+					Term:           true,
+					Package:        true,
+					Comment:        true,
+					Import:         true,
+					Rule:           true,
+					Head:           true,
+					Expr:           true,
+					SomeDecl:       true,
+					Every:          true,
+					With:           true,
+					Annotations:    true,
+					AnnotationsRef: true,
+				},
+			},
+		}
+	}
+
+	result, err := loader.RegoWithOpts(args[0], parserOpts)
+	if err != nil {
+		_ = pr.JSON(stderr, pr.Output{Errors: pr.NewOutputErrors(err)})
+		return 1
+	}
+
+	if !exposeComments {
+		result.Parsed.Comments = nil
+	}
+
+	switch params.format.String() {
+	case parseFormatJSON:
 		bs, err := json.MarshalIndent(result.Parsed, "", "  ")
 		if err != nil {
-			fmt.Fprintln(stderr, err)
+			_ = pr.JSON(stderr, pr.Output{Errors: pr.NewOutputErrors(err)})
 			return 1
 		}
-		fmt.Println(string(bs))
+
+		fmt.Fprint(stdout, string(bs)+"\n")
 	default:
 		if err != nil {
 			fmt.Fprintln(stderr, err)
@@ -76,6 +123,8 @@ func parse(args []string, stdout io.Writer, stderr io.Writer) int {
 }
 
 func init() {
-	parseCommand.Flags().VarP(parseParams.format, "format", "f", "set output format")
+	parseCommand.Flags().VarP(configuredParseParams.format, "format", "f", "set output format")
+	parseCommand.Flags().StringVarP(&configuredParseParams.jsonInclude, "json-include", "", "", "include or exclude optional elements. By default comments are included. Current options: locations, comments. E.g. --json-include locations,-comments will include locations and exclude comments.")
+
 	RootCommand.AddCommand(parseCommand)
 }
diff --git a/cmd/parse_test.go b/cmd/parse_test.go
index 40652b78df..a5f62009d5 100644
--- a/cmd/parse_test.go
+++ b/cmd/parse_test.go
@@ -3,8 +3,10 @@ package cmd
 import (
 	"bytes"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -16,13 +18,32 @@ func TestParseExit0(t *testing.T) {
 		p = 1
 		`,
 	}
-	errc, _, stderr := testParse(t, files)
+	errc, stdout, stderr, _ := testParse(t, files, &configuredParseParams)
 	if errc != 0 {
 		t.Fatalf("Expected exit code 0, got %v", errc)
 	}
 	if len(stderr) > 0 {
 		t.Fatalf("Expected no stderr output, got:\n%s\n", string(stderr))
 	}
+
+	expectedOutput := `module
+ package
+  ref
+   data
+   "x"
+ rule
+  head
+   ref
+    p
+   1
+  body
+   expr index=0
+    true
+`
+
+	if got, want := string(stdout), expectedOutput; got != want {
+		t.Fatalf("Expected output\n%v\n, got\n%v", want, got)
+	}
 }
 
 func TestParseExit1(t *testing.T) {
@@ -30,7 +51,7 @@ func TestParseExit1(t *testing.T) {
 	files := map[string]string{
 		"x.rego": `???`,
 	}
-	errc, _, stderr := testParse(t, files)
+	errc, _, stderr, _ := testParse(t, files, &configuredParseParams)
 	if errc != 1 {
 		t.Fatalf("Expected exit code 1, got %v", errc)
 	}
@@ -39,21 +60,583 @@ func TestParseExit1(t *testing.T) {
 	}
 }
 
+func TestParseJSONOutput(t *testing.T) {
+
+	files := map[string]string{
+		"x.rego": `package x
+		
+		p = 1
+		`,
+	}
+	errc, stdout, stderr, _ := testParse(t, files, &parseParams{
+		format: util.NewEnumFlag(parseFormatJSON, []string{parseFormatPretty, parseFormatJSON}),
+	})
+	if errc != 0 {
+		t.Fatalf("Expected exit code 0, got %v", errc)
+	}
+	if len(stderr) > 0 {
+		t.Fatalf("Expected no stderr output, got:\n%s\n", string(stderr))
+	}
+
+	expectedOutput := `{
+  "package": {
+    "path": [
+      {
+        "type": "var",
+        "value": "data"
+      },
+      {
+        "type": "string",
+        "value": "x"
+      }
+    ]
+  },
+  "rules": [
+    {
+      "body": [
+        {
+          "index": 0,
+          "terms": {
+            "type": "boolean",
+            "value": true
+          }
+        }
+      ],
+      "head": {
+        "name": "p",
+        "value": {
+          "type": "number",
+          "value": 1
+        },
+        "ref": [
+          {
+            "type": "var",
+            "value": "p"
+          }
+        ]
+      }
+    }
+  ]
+}
+`
+
+	if got, want := string(stdout), expectedOutput; got != want {
+		t.Fatalf("Expected output\n%v\n, got\n%v", want, got)
+	}
+}
+
+func TestParseJSONOutputWithLocations(t *testing.T) {
+
+	files := map[string]string{
+		"x.rego": `package x
+		
+		p = 1
+		`,
+	}
+	errc, stdout, stderr, tempDirPath := testParse(t, files, &parseParams{
+		format:      util.NewEnumFlag(parseFormatJSON, []string{parseFormatPretty, parseFormatJSON}),
+		jsonInclude: "locations",
+	})
+	if errc != 0 {
+		t.Fatalf("Expected exit code 0, got %v", errc)
+	}
+	if len(stderr) > 0 {
+		t.Fatalf("Expected no stderr output, got:\n%s\n", string(stderr))
+	}
+
+	expectedOutput := strings.Replace(`{
+  "package": {
+    "location": {
+      "file": "TEMPDIR/x.rego",
+      "row": 1,
+      "col": 1
+    },
+    "path": [
+      {
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 1,
+          "col": 9
+        },
+        "type": "var",
+        "value": "data"
+      },
+      {
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 1,
+          "col": 9
+        },
+        "type": "string",
+        "value": "x"
+      }
+    ]
+  },
+  "rules": [
+    {
+      "body": [
+        {
+          "index": 0,
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 3,
+            "col": 7
+          },
+          "terms": {
+            "location": {
+              "file": "TEMPDIR/x.rego",
+              "row": 3,
+              "col": 7
+            },
+            "type": "boolean",
+            "value": true
+          }
+        }
+      ],
+      "head": {
+        "name": "p",
+        "value": {
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 3,
+            "col": 7
+          },
+          "type": "number",
+          "value": 1
+        },
+        "ref": [
+          {
+            "type": "var",
+            "value": "p"
+          }
+        ],
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 3,
+          "col": 3
+        }
+      },
+      "location": {
+        "file": "TEMPDIR/x.rego",
+        "row": 3,
+        "col": 3
+      }
+    }
+  ]
+}
+`, "TEMPDIR", tempDirPath, -1)
+
+	if got, want := string(stdout), expectedOutput; got != want {
+		t.Fatalf("Expected output\n%v\n, got\n%v", want, got)
+	}
+}
+
+func TestParseRulesBlockJSONOutputWithLocations(t *testing.T) {
+
+	files := map[string]string{
+		"x.rego": `package x
+
+		default allow = false
+    allow = true {
+      input.method == "GET"
+      input.path = ["getUser", user]
+      input.user == user
+    }
+		`,
+	}
+	errc, stdout, stderr, tempDirPath := testParse(t, files, &parseParams{
+		format:      util.NewEnumFlag(parseFormatJSON, []string{parseFormatPretty, parseFormatJSON}),
+		jsonInclude: "locations",
+	})
+	if errc != 0 {
+		t.Fatalf("Expected exit code 0, got %v", errc)
+	}
+	if len(stderr) > 0 {
+		t.Fatalf("Expected no stderr output, got:\n%s\n", string(stderr))
+	}
+
+	expectedOutput := strings.Replace(`{
+  "package": {
+    "location": {
+      "file": "TEMPDIR/x.rego",
+      "row": 1,
+      "col": 1
+    },
+    "path": [
+      {
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 1,
+          "col": 9
+        },
+        "type": "var",
+        "value": "data"
+      },
+      {
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 1,
+          "col": 9
+        },
+        "type": "string",
+        "value": "x"
+      }
+    ]
+  },
+  "rules": [
+    {
+      "body": [
+        {
+          "index": 0,
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 3,
+            "col": 3
+          },
+          "terms": {
+            "location": {
+              "file": "TEMPDIR/x.rego",
+              "row": 3,
+              "col": 3
+            },
+            "type": "boolean",
+            "value": true
+          }
+        }
+      ],
+      "default": true,
+      "head": {
+        "name": "allow",
+        "value": {
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 3,
+            "col": 19
+          },
+          "type": "boolean",
+          "value": false
+        },
+        "ref": [
+          {
+            "type": "var",
+            "value": "allow"
+          }
+        ],
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 3,
+          "col": 11
+        }
+      },
+      "location": {
+        "file": "TEMPDIR/x.rego",
+        "row": 3,
+        "col": 3
+      }
+    },
+    {
+      "body": [
+        {
+          "index": 0,
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 5,
+            "col": 7
+          },
+          "terms": [
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 5,
+                "col": 20
+              },
+              "type": "ref",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 5,
+                    "col": 20
+                  },
+                  "type": "var",
+                  "value": "equal"
+                }
+              ]
+            },
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 5,
+                "col": 7
+              },
+              "type": "ref",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 5,
+                    "col": 7
+                  },
+                  "type": "var",
+                  "value": "input"
+                },
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 5,
+                    "col": 13
+                  },
+                  "type": "string",
+                  "value": "method"
+                }
+              ]
+            },
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 5,
+                "col": 23
+              },
+              "type": "string",
+              "value": "GET"
+            }
+          ]
+        },
+        {
+          "index": 1,
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 6,
+            "col": 7
+          },
+          "terms": [
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 6,
+                "col": 18
+              },
+              "type": "ref",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 6,
+                    "col": 18
+                  },
+                  "type": "var",
+                  "value": "eq"
+                }
+              ]
+            },
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 6,
+                "col": 7
+              },
+              "type": "ref",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 6,
+                    "col": 7
+                  },
+                  "type": "var",
+                  "value": "input"
+                },
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 6,
+                    "col": 13
+                  },
+                  "type": "string",
+                  "value": "path"
+                }
+              ]
+            },
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 6,
+                "col": 20
+              },
+              "type": "array",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 6,
+                    "col": 21
+                  },
+                  "type": "string",
+                  "value": "getUser"
+                },
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 6,
+                    "col": 32
+                  },
+                  "type": "var",
+                  "value": "user"
+                }
+              ]
+            }
+          ]
+        },
+        {
+          "index": 2,
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 7,
+            "col": 7
+          },
+          "terms": [
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 7,
+                "col": 18
+              },
+              "type": "ref",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 7,
+                    "col": 18
+                  },
+                  "type": "var",
+                  "value": "equal"
+                }
+              ]
+            },
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 7,
+                "col": 7
+              },
+              "type": "ref",
+              "value": [
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 7,
+                    "col": 7
+                  },
+                  "type": "var",
+                  "value": "input"
+                },
+                {
+                  "location": {
+                    "file": "TEMPDIR/x.rego",
+                    "row": 7,
+                    "col": 13
+                  },
+                  "type": "string",
+                  "value": "user"
+                }
+              ]
+            },
+            {
+              "location": {
+                "file": "TEMPDIR/x.rego",
+                "row": 7,
+                "col": 21
+              },
+              "type": "var",
+              "value": "user"
+            }
+          ]
+        }
+      ],
+      "head": {
+        "name": "allow",
+        "value": {
+          "location": {
+            "file": "TEMPDIR/x.rego",
+            "row": 4,
+            "col": 13
+          },
+          "type": "boolean",
+          "value": true
+        },
+        "ref": [
+          {
+            "type": "var",
+            "value": "allow"
+          }
+        ],
+        "location": {
+          "file": "TEMPDIR/x.rego",
+          "row": 4,
+          "col": 5
+        }
+      },
+      "location": {
+        "file": "TEMPDIR/x.rego",
+        "row": 4,
+        "col": 5
+      }
+    }
+  ]
+}
+`, "TEMPDIR", tempDirPath, -1)
+
+	if got, want := string(stdout), expectedOutput; got != want {
+		t.Fatalf("Expected output\n%v\n, got\n%v", want, got)
+	}
+}
+
+func TestParseJSONOutputComments(t *testing.T) {
+
+	files := map[string]string{
+		"x.rego": `package x
+		
+		# comment
+		p = 1
+		`,
+	}
+	errc, stdout, stderr, _ := testParse(t, files, &parseParams{
+		format:      util.NewEnumFlag(parseFormatJSON, []string{parseFormatPretty, parseFormatJSON}),
+		jsonInclude: "comments",
+	})
+	if errc != 0 {
+		t.Fatalf("Expected exit code 0, got %v", errc)
+	}
+	if len(stderr) > 0 {
+		t.Fatalf("Expected no stderr output, got:\n%s\n", string(stderr))
+	}
+
+	expectedCommentTextValue := "IGNvbW1lbnQ="
+
+	if !strings.Contains(string(stdout), expectedCommentTextValue) {
+		t.Fatalf("Comment text value %q missing in output: %s", expectedCommentTextValue, string(stdout))
+	}
+}
+
 // Runs parse and returns the exit code, stdout, and stderr contents
-func testParse(t *testing.T, files map[string]string) (int, []byte, []byte) {
+func testParse(t *testing.T, files map[string]string, params *parseParams) (int, []byte, []byte, string) {
 	t.Helper()
 
 	stdout := new(bytes.Buffer)
 	stderr := new(bytes.Buffer)
 	var errc int
 
+	var tempDirUsed string
 	test.WithTempFS(files, func(path string) {
 		var args []string
 		for file := range files {
 			args = append(args, filepath.Join(path, file))
 		}
-		errc = parse(args, stdout, stderr)
+		errc = parse(args, params, stdout, stderr)
+
+		tempDirUsed = path
 	})
 
-	return errc, stdout.Bytes(), stderr.Bytes()
+	return errc, stdout.Bytes(), stderr.Bytes(), tempDirUsed
 }
diff --git a/cmd/refactor_test.go b/cmd/refactor_test.go
index 953676d376..9279ac8791 100644
--- a/cmd/refactor_test.go
+++ b/cmd/refactor_test.go
@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"bytes"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -85,7 +84,7 @@ default allow = false
 			t.Fatal(err)
 		}
 
-		data, err := ioutil.ReadFile(filepath.Join(path, "policy.rego"))
+		data, err := os.ReadFile(filepath.Join(path, "policy.rego"))
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/run.go b/cmd/run.go
index 006d64ff27..6e1fdfc91c 100644
--- a/cmd/run.go
+++ b/cmd/run.go
@@ -9,7 +9,6 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"time"
@@ -34,12 +33,14 @@ type runCmdParams struct {
 	tlsCertRefresh     time.Duration
 	ignore             []string
 	serverMode         bool
-	skipVersionCheck   bool
+	skipVersionCheck   bool // skipVersionCheck is deprecated. Use disableTelemetry instead
+	disableTelemetry   bool
 	authentication     *util.EnumFlag
 	authorization      *util.EnumFlag
 	minTLSVersion      *util.EnumFlag
 	logLevel           *util.EnumFlag
 	logFormat          *util.EnumFlag
+	logTimestampFormat string
 	algorithm          string
 	scope              string
 	pubKey             string
@@ -120,10 +121,22 @@ File paths can be specified as URLs to resolve ambiguity in paths containing col
 
     $ opa run file:///c:/path/to/data.json
 
+URL paths to remote public bundles (http or https) will be parsed as shorthand
+configuration equivalent of using repeated --set flags to accomplish the same:
+
+	$ opa run -s https://example.com/bundles/bundle.tar.gz
+
+The above shorthand command is identical to:
+
+    $ opa run -s --set "services.cli1.url=https://example.com" \
+                 --set "bundles.cli1.service=cli1" \
+                 --set "bundles.cli1.resource=/bundles/bundle.tar.gz" \
+                 --set "bundles.cli1.persist=true"
+
 The 'run' command can also verify the signature of a signed bundle.
 A signed bundle is a normal OPA bundle that includes a file
 named ".signatures.json". For more information on signed bundles
-see https://www.openpolicyagent.org/docs/latest/management/#signing.
+see https://www.openpolicyagent.org/docs/latest/management-bundles/#signing.
 
 The key to verify the signature of signed bundle can be provided
 using the --verification-key flag. For example, for RSA family of algorithms,
@@ -148,16 +161,18 @@ The 'run' command will read the bundle "bundle.tar.gz", check the
 ".signatures.json" file and perform verification using the provided key.
 An error will be generated if "bundle.tar.gz" does not contain a ".signatures.json" file.
 For more information on the bundle verification process see
-https://www.openpolicyagent.org/docs/latest/management/#signature-verification.
+https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-verification.
 
 The 'run' command can ONLY be used with the --bundle flag to verify signatures
 for existing bundle files or directories following the bundle structure.
 
 To skip bundle verification, use the --skip-verify flag.
 `,
+
 		Run: func(cmd *cobra.Command, args []string) {
 			ctx := context.Background()
-			rt, err := initRuntime(ctx, cmdParams, args)
+			addrSetByUser := cmd.Flags().Changed("addr")
+			rt, err := initRuntime(ctx, cmdParams, args, addrSetByUser)
 			if err != nil {
 				fmt.Println("error:", err)
 				os.Exit(1)
@@ -172,6 +187,7 @@ To skip bundle verification, use the --skip-verify flag.
 	runCommand.Flags().StringVarP(&cmdParams.rt.HistoryPath, "history", "H", historyPath(), "set path of history file")
 	cmdParams.rt.Addrs = runCommand.Flags().StringSliceP("addr", "a", []string{defaultAddr}, "set listening address of the server (e.g., [ip]:<port> for TCP, unix://<path> for UNIX domain socket)")
 	cmdParams.rt.DiagnosticAddrs = runCommand.Flags().StringSlice("diagnostic-addr", []string{}, "set read-only diagnostic listening address of the server for /health and /metric APIs (e.g., [ip]:<port> for TCP, unix://<path> for UNIX domain socket)")
+	cmdParams.rt.UnixSocketPerm = runCommand.Flags().String("unix-socket-perm", "755", "specify the permissions for the Unix domain socket if used to listen for incoming connections")
 	runCommand.Flags().BoolVar(&cmdParams.rt.H2CEnabled, "h2c", false, "enable H2C for HTTP listeners")
 	runCommand.Flags().StringVarP(&cmdParams.rt.OutputFormat, "format", "f", "pretty", "set shell output format, i.e, pretty, json")
 	runCommand.Flags().BoolVarP(&cmdParams.rt.Watch, "watch", "w", false, "watch command line files for changes")
@@ -186,12 +202,21 @@ To skip bundle verification, use the --skip-verify flag.
 	runCommand.Flags().Var(cmdParams.minTLSVersion, "min-tls-version", "set minimum TLS version to be used by OPA's server")
 	runCommand.Flags().VarP(cmdParams.logLevel, "log-level", "l", "set log level")
 	runCommand.Flags().Var(cmdParams.logFormat, "log-format", "set log format")
+	runCommand.Flags().StringVar(&cmdParams.logTimestampFormat, "log-timestamp-format", "", "set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)")
 	runCommand.Flags().IntVar(&cmdParams.rt.GracefulShutdownPeriod, "shutdown-grace-period", 10, "set the time (in seconds) that the server will wait to gracefully shut down")
 	runCommand.Flags().IntVar(&cmdParams.rt.ShutdownWaitPeriod, "shutdown-wait-period", 0, "set the time (in seconds) that the server will wait before initiating shutdown")
 	addConfigOverrides(runCommand.Flags(), &cmdParams.rt.ConfigOverrides)
 	addConfigOverrideFiles(runCommand.Flags(), &cmdParams.rt.ConfigOverrideFiles)
 	addBundleModeFlag(runCommand.Flags(), &cmdParams.rt.BundleMode, false)
-	runCommand.Flags().BoolVar(&cmdParams.skipVersionCheck, "skip-version-check", false, "disables anonymous version reporting (see: https://openpolicyagent.org/docs/latest/privacy)")
+
+	runCommand.Flags().BoolVar(&cmdParams.skipVersionCheck, "skip-version-check", false, "disables anonymous version reporting (see: https://www.openpolicyagent.org/docs/latest/privacy)")
+	err := runCommand.Flags().MarkDeprecated("skip-version-check", "\"skip-version-check\" is deprecated. Use \"disable-telemetry\" instead")
+	if err != nil {
+		fmt.Println("error:", err)
+		os.Exit(1)
+	}
+
+	runCommand.Flags().BoolVar(&cmdParams.disableTelemetry, "disable-telemetry", false, "disables anonymous information reporting (see: https://www.openpolicyagent.org/docs/latest/privacy)")
 	addIgnoreFlag(runCommand.Flags(), &cmdParams.ignore)
 
 	// bundle verification config
@@ -214,7 +239,7 @@ Flags:
 	RootCommand.AddCommand(runCommand)
 }
 
-func initRuntime(ctx context.Context, params runCmdParams, args []string) (*runtime.Runtime, error) {
+func initRuntime(ctx context.Context, params runCmdParams, args []string, addrSetByUser bool) (*runtime.Runtime, error) {
 	authenticationSchemes := map[string]server.AuthenticationScheme{
 		"token": server.AuthenticationToken,
 		"tls":   server.AuthenticationTLS,
@@ -254,16 +279,27 @@ func initRuntime(ctx context.Context, params runCmdParams, args []string) (*runt
 	params.rt.Authorization = authorizationScheme[params.authorization.String()]
 	params.rt.MinTLSVersion = minTLSVersions[params.minTLSVersion.String()]
 	params.rt.Certificate = cert
+
+	timestampFormat := params.logTimestampFormat
+	if timestampFormat == "" {
+		timestampFormat = os.Getenv("OPA_LOG_TIMESTAMP_FORMAT")
+	}
 	params.rt.Logging = runtime.LoggingConfig{
-		Level:  params.logLevel.String(),
-		Format: params.logFormat.String(),
+		Level:           params.logLevel.String(),
+		Format:          params.logFormat.String(),
+		TimestampFormat: timestampFormat,
 	}
 	params.rt.Paths = args
 	params.rt.Filter = loaderFilter{
 		Ignore: params.ignore,
 	}.Apply
 
-	params.rt.EnableVersionCheck = !params.skipVersionCheck
+	params.rt.EnableVersionCheck = !params.disableTelemetry
+
+	// For backwards compatibility, check if `--skip-version-check` flag set.
+	if params.skipVersionCheck {
+		params.rt.EnableVersionCheck = false
+	}
 
 	params.rt.SkipBundleVerification = params.skipBundleVerify
 
@@ -277,7 +313,15 @@ func initRuntime(ctx context.Context, params runCmdParams, args []string) (*runt
 		return nil, fmt.Errorf("enable bundle mode (ie. --bundle) to verify bundle files or directories")
 	}
 
-	return runtime.NewRuntime(ctx, params.rt)
+	rt, err := runtime.NewRuntime(ctx, params.rt)
+	if err != nil {
+		return nil, err
+	}
+
+	rt.SetDistributedTracingLogging()
+	rt.Params.AddrSetByUser = addrSetByUser
+
+	return rt, nil
 }
 
 func startRuntime(ctx context.Context, rt *runtime.Runtime, serverMode bool) {
@@ -312,7 +356,7 @@ func loadCertificate(tlsCertFile, tlsPrivateKeyFile string) (*tls.Certificate, e
 }
 
 func loadCertPool(tlsCACertFile string) (*x509.CertPool, error) {
-	caCertPEM, err := ioutil.ReadFile(tlsCACertFile)
+	caCertPEM, err := os.ReadFile(tlsCACertFile)
 	if err != nil {
 		return nil, fmt.Errorf("read CA cert file: %v", err)
 	}
diff --git a/cmd/run_test.go b/cmd/run_test.go
index 65eab289ab..a0ad554e96 100644
--- a/cmd/run_test.go
+++ b/cmd/run_test.go
@@ -7,16 +7,21 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"encoding/json"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/test/e2e"
+	"github.com/spf13/cobra"
 )
 
 func TestRunServerBase(t *testing.T) {
 	params := newTestRunParams()
 	ctx, cancel := context.WithCancel(context.Background())
 
-	rt, err := initRuntime(ctx, params, nil)
+	rt, err := initRuntime(ctx, params, nil, false)
 	if err != nil {
 		t.Fatalf("Unexpected error: %v", err)
 	}
@@ -48,7 +53,7 @@ func TestRunServerWithDiagnosticAddr(t *testing.T) {
 	params.rt.DiagnosticAddrs = &[]string{":0"}
 	ctx, cancel := context.WithCancel(context.Background())
 
-	rt, err := initRuntime(ctx, params, nil)
+	rt, err := initRuntime(ctx, params, nil, false)
 	if err != nil {
 		t.Fatalf("Unexpected error: %v", err)
 	}
@@ -89,7 +94,7 @@ func TestInitRuntimeVerifyNonBundle(t *testing.T) {
 	params.pubKey = "secret"
 	params.serverMode = false
 
-	_, err := initRuntime(context.Background(), params, nil)
+	_, err := initRuntime(context.Background(), params, nil, false)
 	if err == nil {
 		t.Fatal("Expected error but got nil")
 	}
@@ -100,6 +105,112 @@ func TestInitRuntimeVerifyNonBundle(t *testing.T) {
 	}
 }
 
+func TestRunServerCheckLogTimestampFormat(t *testing.T) {
+	for _, format := range []string{time.Kitchen, time.RFC3339Nano} {
+		t.Run(format, func(t *testing.T) {
+			t.Run("parameter", func(t *testing.T) {
+				params := newTestRunParams()
+				params.logTimestampFormat = format
+				checkLogTimeStampFormat(t, params, format)
+			})
+			t.Run("environment variable", func(t *testing.T) {
+				t.Setenv("OPA_LOG_TIMESTAMP_FORMAT", format)
+				params := newTestRunParams()
+				checkLogTimeStampFormat(t, params, format)
+			})
+		})
+	}
+}
+
+func checkLogTimeStampFormat(t *testing.T, params runCmdParams, format string) {
+	ctx, cancel := context.WithCancel(context.Background())
+
+	rt, err := initRuntime(ctx, params, nil, false)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	var buf bytes.Buffer
+	logger := rt.Manager.Logger().(*logging.StandardLogger)
+	logger.SetOutput(&buf)
+	testRuntime := e2e.WrapRuntime(ctx, cancel, rt)
+
+	done := make(chan bool)
+	go func() {
+		err := rt.Serve(ctx)
+		if err != nil {
+			t.Errorf("Unexpected error: %s", err)
+		}
+		done <- true
+	}()
+
+	err = testRuntime.WaitForServer()
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	validateBasicServe(t, testRuntime)
+
+	cancel()
+	<-done
+
+	for _, line := range strings.Split(buf.String(), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		var rec struct {
+			Time string `json:"time"`
+		}
+		if err := json.Unmarshal([]byte(line), &rec); err != nil {
+			t.Fatalf("incorrect log message %s: %v", line, err)
+		}
+		if rec.Time == "" {
+			t.Fatalf("the time field is empty in log message: %s", line)
+		}
+		if _, err := time.Parse(format, rec.Time); err != nil {
+			t.Fatalf("incorrect timestamp format %q: %v", rec.Time, err)
+		}
+	}
+}
+
+func TestInitRuntimeAddrSetByUser(t *testing.T) {
+	testCases := []struct {
+		name        string
+		addrValue   string
+		addrFlagSet bool
+	}{
+		{"AddrSetByUser_True", "localhost:8181", true},
+		{"AddrSetByUser_False", "", false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := &cobra.Command{}
+			cmd.Flags().String("addr", "", "set address")
+			if tc.addrFlagSet {
+				if err := cmd.Flags().Set("addr", tc.addrValue); err != nil {
+					t.Fatalf("Failed to set addr flag: %v", err)
+				}
+			}
+
+			params := newTestRunParams()
+			params.rt.Addrs = &[]string{":0"}
+			ctx, cancel := context.WithCancel(context.Background())
+
+			rt, err := initRuntime(ctx, params, []string{}, cmd.Flags().Changed("addr"))
+			if err != nil {
+				t.Fatalf("Unexpected error: %v", err)
+			}
+
+			if rt.Params.AddrSetByUser != tc.addrFlagSet {
+				t.Errorf("Expected AddrSetByUser to be %v, but got %v", tc.addrFlagSet, rt.Params.AddrSetByUser)
+			}
+
+			cancel()
+		})
+	}
+}
+
 func newTestRunParams() runCmdParams {
 	params := newRunParams()
 	params.rt.GracefulShutdownPeriod = 1
diff --git a/cmd/sign.go b/cmd/sign.go
index f1ecc7309a..b86a7d09c4 100644
--- a/cmd/sign.go
+++ b/cmd/sign.go
@@ -10,12 +10,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
 
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 
 	"github.com/open-policy-agent/opa/bundle"
@@ -38,6 +36,8 @@ const (
 	signaturesFile         = ".signatures.json"
 )
 
+var errSigningConfigIncomplete = fmt.Errorf("specify the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)")
+
 func newSignCmdParams() signCmdParams {
 	return signCmdParams{}
 }
@@ -128,7 +128,7 @@ To include additional claims in the payload use the --claims-file flag to provid
 a JSON file containing optional claims.
 
 For more information on the format of the ".signatures.json" file see
-https://www.openpolicyagent.org/docs/latest/management/#signature-format.
+https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format.
 `,
 		PreRunE: func(Cmd *cobra.Command, args []string) error {
 			return validateSignParams(args, cmdParams)
@@ -171,7 +171,10 @@ func doSign(args []string, params signCmdParams) error {
 		return err
 	}
 
-	signingConfig := buildSigningConfig(params.key, params.algorithm, params.claimsFile, params.plugin)
+	signingConfig, err := buildSigningConfig(params.key, params.algorithm, params.claimsFile, params.plugin)
+	if err != nil {
+		return err
+	}
 
 	token, err := bundle.GenerateSignedToken(files, signingConfig, "")
 	if err != nil {
@@ -192,7 +195,7 @@ func readBundleFiles(loaders []initload.BundleLoader, h bundle.SignatureHasher)
 			}
 
 			if err != nil {
-				return files, errors.Wrap(err, "bundle read failed")
+				return files, fmt.Errorf("bundle read failed: %w", err)
 			}
 
 			// skip existing signatures file
@@ -261,7 +264,7 @@ func writeTokenToFile(token, fileLoc string) error {
 	if fileLoc != "" {
 		path = filepath.Join(fileLoc, path)
 	}
-	return ioutil.WriteFile(path, bs, 0644)
+	return os.WriteFile(path, bs, 0644)
 }
 
 func validateSignParams(args []string, params signCmdParams) error {
@@ -270,7 +273,7 @@ func validateSignParams(args []string, params signCmdParams) error {
 	}
 
 	if params.key == "" {
-		return fmt.Errorf("specify the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)")
+		return errSigningConfigIncomplete
 	}
 
 	if !params.bundleMode {
diff --git a/cmd/sign_test.go b/cmd/sign_test.go
index 75b7fdc000..f2dcc666df 100644
--- a/cmd/sign_test.go
+++ b/cmd/sign_test.go
@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -32,7 +31,7 @@ func TestWriteTokenToFile(t *testing.T) {
 			t.Fatalf("Unexpected error %v", err)
 		}
 
-		bs, err := ioutil.ReadFile(filepath.Join(rootDir, ".signatures.json"))
+		bs, err := os.ReadFile(filepath.Join(rootDir, ".signatures.json"))
 		if err != nil {
 			t.Fatalf("Unexpected error %v", err)
 		}
@@ -99,7 +98,7 @@ func TestBundleSignVerification(t *testing.T) {
 		var filesInBundle [][2]string
 		err = filepath.Walk(rootDir, func(path string, info os.FileInfo, err error) error {
 			if !info.IsDir() {
-				bs, err := ioutil.ReadFile(path)
+				bs, err := os.ReadFile(path)
 				if err != nil {
 					return err
 				}
@@ -147,6 +146,11 @@ func TestValidateSignParams(t *testing.T) {
 			newSignCmdParams(),
 			true, fmt.Errorf("specify the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)"),
 		},
+		"empty_signing_key": {
+			[]string{"foo"},
+			signCmdParams{key: "", bundleMode: true},
+			true, fmt.Errorf("specify the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)"),
+		},
 		"non_bundle_mode": {
 			[]string{"foo"},
 			signCmdParams{key: "foo"},
diff --git a/cmd/test.go b/cmd/test.go
index c5300cca8a..fa31bab603 100644
--- a/cmd/test.go
+++ b/cmd/test.go
@@ -39,7 +39,6 @@ type testCommandParams struct {
 	threshold    float64
 	timeout      time.Duration
 	ignore       []string
-	failureLine  bool
 	bundleMode   bool
 	benchmark    bool
 	benchMem     bool
@@ -47,13 +46,15 @@ type testCommandParams struct {
 	count        int
 	target       *util.EnumFlag
 	skipExitZero bool
+	capabilities *capabilitiesFlag
 }
 
 func newTestCommandParams() *testCommandParams {
 	return &testCommandParams{
 		outputFormat: util.NewEnumFlag(testPrettyOutput, []string{testPrettyOutput, testJSONOutput, benchmarkGoBenchOutput}),
-		explain:      newExplainFlag([]string{explainModeFails, explainModeFull, explainModeNotes}),
+		explain:      newExplainFlag([]string{explainModeFails, explainModeFull, explainModeNotes, explainModeDebug}),
 		target:       util.NewEnumFlag(compile.TargetRego, []string{compile.TargetRego, compile.TargetWasm}),
+		capabilities: newcapabilitiesFlag(),
 	}
 }
 
@@ -79,20 +80,23 @@ Example policy (example/authz.rego):
 
 	package authz
 
-	allow {
-		input.path = ["users"]
-		input.method = "POST"
+	import future.keywords.if
+
+	allow if {
+		input.path == ["users"]
+		input.method == "POST"
 	}
 
-	allow {
-		input.path = ["users", profile_id]
-		input.method = "GET"
-		profile_id = input.user_id
+	allow if {
+		input.path == ["users", input.user_id]
+		input.method == "GET"
 	}
 
 Example test (example/authz_test.rego):
 
-	package authz
+	package authz_test
+
+	import data.authz.allow
 
 	test_post_allowed {
 		allow with input as {"path": ["users"], "method": "POST"}
@@ -153,6 +157,11 @@ func opaTest(args []string) int {
 		return 0
 	}
 
+	if !isThresholdValid(testParams.threshold) {
+		fmt.Fprintln(os.Stderr, "Code coverage threshold must be between 0 and 100")
+		return 1
+	}
+
 	filter := loaderFilter{
 		Ignore: testParams.ignore,
 	}
@@ -164,7 +173,7 @@ func opaTest(args []string) int {
 
 	if testParams.bundleMode {
 		bundles, err = tester.LoadBundles(args, filter.Apply)
-		store = inmem.New()
+		store = inmem.NewWithOpts(inmem.OptRoundTripOnWrite(false))
 	} else {
 		modules, store, err = tester.Load(args, filter.Apply)
 	}
@@ -182,10 +191,21 @@ func opaTest(args []string) int {
 
 	defer store.Abort(ctx, txn)
 
+	var capabilities *ast.Capabilities
+	// if capabilities are not provided as a cmd flag,
+	// then ast.CapabilitiesForThisVersion must be called
+	// within checkModules to ensure custom builtins are properly captured
+	if testParams.capabilities.C != nil {
+		capabilities = testParams.capabilities.C
+	} else {
+		capabilities = ast.CapabilitiesForThisVersion()
+	}
+
 	compiler := ast.NewCompiler().
 		SetErrorLimit(testParams.errLimit).
 		WithPathConflictsCheck(storage.NonEmpty(ctx, store, txn)).
-		WithEnablePrintStatements(!testParams.benchmark)
+		WithEnablePrintStatements(!testParams.benchmark).
+		WithCapabilities(capabilities)
 
 	info, err := runtime.Term(runtime.Params{})
 	if err != nil {
@@ -211,9 +231,9 @@ func opaTest(args []string) int {
 
 	timeout := testParams.timeout
 	if timeout == 0 { // unset
-		timeout = time.Duration(5 * time.Second)
+		timeout = 5 * time.Second
 		if testParams.benchmark {
-			timeout = time.Duration(30 * time.Second)
+			timeout = 30 * time.Second
 		}
 	}
 
@@ -223,7 +243,6 @@ func opaTest(args []string) int {
 		CapturePrintOutput(true).
 		EnableTracing(testParams.verbose).
 		SetCoverageQueryTracer(coverTracer).
-		EnableFailureLine(testParams.failureLine).
 		SetRuntime(info).
 		SetModules(modules).
 		SetBundles(bundles).
@@ -247,7 +266,6 @@ func opaTest(args []string) int {
 		default:
 			reporter = tester.PrettyReporter{
 				Verbose:                  testParams.verbose,
-				FailureLine:              testParams.failureLine,
 				Output:                   os.Stdout,
 				BenchmarkResults:         testParams.benchmark,
 				BenchMarkShowAllocations: testParams.benchMem,
@@ -322,38 +340,38 @@ func runTests(ctx context.Context, txn storage.Transaction, runner *tester.Runne
 }
 
 func filterTrace(params *testCommandParams, trace []*topdown.Event) []*topdown.Event {
-	ops := map[topdown.Op]struct{}{}
-	mode := params.explain.String()
-
-	if mode == explainModeFull {
-		// Don't bother filtering anything
-		return trace
-	}
-
 	// If an explain mode was specified, filter based
 	// on the mode. If no explain mode was specified,
 	// default to show both notes and fail events
 	showDefault := !params.explain.IsSet() && params.verbose
-
-	if mode == explainModeNotes || showDefault {
-		ops[topdown.NoteOp] = struct{}{}
+	if showDefault {
+		return lineage.Filter(trace, func(event *topdown.Event) bool {
+			return event.Op == topdown.NoteOp || event.Op == topdown.FailOp
+		})
 	}
 
-	if mode == explainModeFails || showDefault {
-		ops[topdown.FailOp] = struct{}{}
+	mode := params.explain.String()
+	switch mode {
+	case explainModeNotes:
+		return lineage.Notes(trace)
+	case explainModeFull:
+		return lineage.Full(trace)
+	case explainModeFails:
+		return lineage.Fails(trace)
+	case explainModeDebug:
+		return lineage.Debug(trace)
+	default:
+		return nil
 	}
+}
 
-	return lineage.Filter(trace, func(event *topdown.Event) bool {
-		_, relevant := ops[event.Op]
-		return relevant
-	})
+func isThresholdValid(t float64) bool {
+	return 0 <= t && t <= 100
 }
 
 func init() {
 	testCommand.Flags().BoolVarP(&testParams.skipExitZero, "exit-zero-on-skipped", "z", false, "skipped tests return status 0")
 	testCommand.Flags().BoolVarP(&testParams.verbose, "verbose", "v", false, "set verbose reporting mode")
-	testCommand.Flags().BoolVarP(&testParams.failureLine, "show-failure-line", "l", false, "show test failure line")
-	_ = testCommand.Flags().MarkDeprecated("show-failure-line", "use -v instead")
 	testCommand.Flags().DurationVar(&testParams.timeout, "timeout", 0, "set test timeout (default 5s, 30s when benchmarking)")
 	testCommand.Flags().VarP(testParams.outputFormat, "format", "f", "set output format")
 	testCommand.Flags().BoolVarP(&testParams.coverage, "coverage", "c", false, "report coverage (overrides debug tracing)")
@@ -367,5 +385,6 @@ func init() {
 	addIgnoreFlag(testCommand.Flags(), &testParams.ignore)
 	setExplainFlag(testCommand.Flags(), testParams.explain)
 	addTargetFlag(testCommand.Flags(), testParams.target)
+	addCapabilitiesFlag(testCommand.Flags(), testParams.capabilities)
 	RootCommand.AddCommand(testCommand)
 }
diff --git a/cmd/test_test.go b/cmd/test_test.go
index 1d97ffe679..f0ab9554a5 100644
--- a/cmd/test_test.go
+++ b/cmd/test_test.go
@@ -3,10 +3,13 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"strings"
 	"testing"
 
+	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/util/test"
 )
 
 func TestFilterTraceDefault(t *testing.T) {
@@ -135,6 +138,15 @@ func TestFilterTraceExplainFull(t *testing.T) {
 	verifyFilteredTrace(t, p, expected)
 }
 
+func TestThresholdRange(t *testing.T) {
+	thresholds := []float64{-1, 101}
+	for _, threshold := range thresholds {
+		if isThresholdValid(threshold) {
+			t.Fatalf("invalid threshold %2f shoul be reported", threshold)
+		}
+	}
+}
+
 func verifyFilteredTrace(t *testing.T, params *testCommandParams, expected string) {
 	filtered := filterTrace(params, failTrace(t))
 
@@ -198,3 +210,65 @@ func failTrace(t *testing.T) []*topdown.Event {
 
 	return *tracer
 }
+
+func testSchemasAnnotation(mod string) error {
+	query := "data.test.test_p"
+
+	files := map[string]string{
+		"test.rego": mod,
+	}
+
+	var err error
+	test.WithTempFS(files, func(path string) {
+		_, err = rego.New(
+			rego.Module("test.rego", mod),
+			rego.Trace(true),
+			rego.Query(query),
+		).Eval(context.Background())
+	})
+
+	return err
+}
+
+// Assert that 'schemas' annotations with schema ref are ignored, but not inlined schemas
+func TestSchemasAnnotation(t *testing.T) {
+	policyWithSchemaRef := `
+package test
+# METADATA
+# schemas:
+#   - input: schema["input"]
+p { 
+	rego.metadata.rule() # presence of rego.metadata.* calls must not trigger unwanted schema evaluation 
+	input.foo == 42 # type mismatch with schema that should be ignored
+}
+
+test_p {
+    p with input.foo as 42
+}`
+
+	err := testSchemasAnnotation(policyWithSchemaRef)
+	if err != nil {
+		t.Fatalf("unexpected error when schema ref is present: %v", err)
+	}
+
+	policyWithInlinedSchema := `
+package test
+# METADATA
+# schemas:
+#   - input.foo: {"type": "boolean"}
+p { 
+	rego.metadata.rule() # presence of rego.metadata.* calls must not trigger unwanted schema evaluation 
+	input.foo == 42 # type mismatch with schema that should be ignored
+}
+
+test_p {
+    p with input.foo as 42
+}`
+
+	err = testSchemasAnnotation(policyWithInlinedSchema)
+	if err == nil {
+		t.Fatalf("didn't get expected error when inlined schema is present")
+	} else if !strings.Contains(err.Error(), "rego_type_error: match error") {
+		t.Fatalf("didn't get expected %s error when inlined schema is present; got: %v", ast.TypeErr, err)
+	}
+}
diff --git a/cmd/version.go b/cmd/version.go
index f541501ad9..674137d66d 100644
--- a/cmd/version.go
+++ b/cmd/version.go
@@ -42,6 +42,7 @@ func generateCmdOutput(out io.Writer, check bool) {
 	fmt.Fprintln(out, "Build Timestamp: "+version.Timestamp)
 	fmt.Fprintln(out, "Build Hostname: "+version.Hostname)
 	fmt.Fprintln(out, "Go Version: "+version.GoVersion)
+	fmt.Fprintln(out, "Platform: "+version.Platform)
 
 	var wasmAvailable string
 
diff --git a/cmd/version_test.go b/cmd/version_test.go
index 0024eb755c..5fbb8ef9a0 100644
--- a/cmd/version_test.go
+++ b/cmd/version_test.go
@@ -9,7 +9,6 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"sort"
 	"strings"
 	"testing"
@@ -28,6 +27,7 @@ func TestGenerateCmdOutputDisableCheckFlag(t *testing.T) {
 		"Build Timestamp",
 		"Build Hostname",
 		"Go Version",
+		"Platform",
 		"WebAssembly",
 	})
 }
@@ -43,7 +43,7 @@ func TestGenerateCmdOutputWithCheckFlagNoError(t *testing.T) {
 	baseURL, teardown := getTestServer(exp, http.StatusOK)
 	defer teardown()
 
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
 
 	var stdout bytes.Buffer
 
@@ -55,6 +55,7 @@ func TestGenerateCmdOutputWithCheckFlagNoError(t *testing.T) {
 		"Build Timestamp",
 		"Build Hostname",
 		"Go Version",
+		"Platform",
 		"WebAssembly",
 		"Latest Upstream Version",
 		"Release Notes",
@@ -64,7 +65,7 @@ func TestGenerateCmdOutputWithCheckFlagNoError(t *testing.T) {
 
 func TestCheckOPAUpdateBadURL(t *testing.T) {
 	url := "http://foo:8112"
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", url)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", url)
 
 	err := checkOPAUpdate(nil)
 	if err == nil {
@@ -75,9 +76,10 @@ func TestCheckOPAUpdateBadURL(t *testing.T) {
 func expectOutputKeys(t *testing.T, stdout string, expectedKeys []string) {
 	t.Helper()
 
-	var gotKeys []string
+	lines := strings.Split(strings.Trim(stdout, "\n"), "\n")
+	gotKeys := make([]string, 0, len(lines))
 
-	for _, line := range strings.Split(strings.Trim(stdout, "\n"), "\n") {
+	for _, line := range lines {
 		gotKeys = append(gotKeys, strings.Split(line, ":")[0])
 	}
 
diff --git a/compile/compile.go b/compile/compile.go
index 70177f2499..4ef9a031b4 100644
--- a/compile/compile.go
+++ b/compile/compile.go
@@ -8,23 +8,25 @@ package compile
 import (
 	"bytes"
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/internal/compiler/wasm"
 	"github.com/open-policy-agent/opa/internal/debug"
-	"github.com/open-policy-agent/opa/internal/ir"
 	"github.com/open-policy-agent/opa/internal/planner"
 	"github.com/open-policy-agent/opa/internal/ref"
 	initload "github.com/open-policy-agent/opa/internal/runtime/init"
 	"github.com/open-policy-agent/opa/internal/wasm/encoding"
+	"github.com/open-policy-agent/opa/ir"
 	"github.com/open-policy-agent/opa/loader"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/storage"
@@ -40,33 +42,45 @@ const (
 	// TargetWasm is an alternative target that compiles the policy into a wasm
 	// module instead of Rego. The target supports base documents.
 	TargetWasm = "wasm"
-)
 
-const wasmResultVar = ast.Var("result")
+	// TargetPlan is an altertive target that compiles the policy into an
+	// imperative query plan that can be further transpiled or interpreted.
+	TargetPlan = "plan"
+)
 
-var validTargets = map[string]struct{}{
-	TargetRego: {},
-	TargetWasm: {},
+// Targets contains the list of targets supported by the compiler.
+var Targets = []string{
+	TargetRego,
+	TargetWasm,
+	TargetPlan,
 }
 
+const resultVar = ast.Var("result")
+
 // Compiler implements bundle compilation and linking.
 type Compiler struct {
-	capabilities      *ast.Capabilities          // the capabilities that compiled policies may require
-	bundle            *bundle.Bundle             // the bundle that the compiler operates on
-	revision          *string                    // the revision to set on the output bundle
-	asBundle          bool                       // whether to assume bundle layout on file loading or not
-	filter            loader.Filter              // filter to apply to file loader
-	paths             []string                   // file paths to load. TODO(tsandall): add support for supplying readers for embedded users.
-	entrypoints       orderedStringSet           // policy entrypoints required for optimization and certain targets
-	optimizationLevel int                        // how aggressive should optimization be
-	target            string                     // target type (wasm, rego, etc.)
-	output            *io.Writer                 // output stream to write bundle to
-	entrypointrefs    []*ast.Term                // validated entrypoints computed from default decision or manually supplied entrypoints
-	compiler          *ast.Compiler              // rego ast compiler used for semantic checks and rewriting
-	debug             debug.Debug                // optionally outputs debug information produced during build
-	bvc               *bundle.VerificationConfig // represents the key configuration used to verify a signed bundle
-	bsc               *bundle.SigningConfig      // represents the key configuration used to generate a signed bundle
-	keyID             string                     // represents the name of the default key used to verify a signed bundle
+	capabilities                 *ast.Capabilities          // the capabilities that compiled policies may require
+	bundle                       *bundle.Bundle             // the bundle that the compiler operates on
+	revision                     *string                    // the revision to set on the output bundle
+	asBundle                     bool                       // whether to assume bundle layout on file loading or not
+	pruneUnused                  bool                       // whether to extend the entrypoint set for semantic equivalence of built bundles
+	filter                       loader.Filter              // filter to apply to file loader
+	paths                        []string                   // file paths to load. TODO(tsandall): add support for supplying readers for embedded users.
+	entrypoints                  orderedStringSet           // policy entrypoints required for optimization and certain targets
+	useRegoAnnotationEntrypoints bool                       // allow compiler to late-bind entrypoints from annotated rules in policies.
+	optimizationLevel            int                        // how aggressive should optimization be
+	target                       string                     // target type (wasm, rego, etc.)
+	output                       *io.Writer                 // output stream to write bundle to
+	entrypointrefs               []*ast.Term                // validated entrypoints computed from default decision or manually supplied entrypoints
+	compiler                     *ast.Compiler              // rego ast compiler used for semantic checks and rewriting
+	policy                       *ir.Policy                 // planner output when wasm or plan targets are enabled
+	debug                        debug.Debug                // optionally outputs debug information produced during build
+	enablePrintStatements        bool                       // optionally enable rego print statements
+	bvc                          *bundle.VerificationConfig // represents the key configuration used to verify a signed bundle
+	bsc                          *bundle.SigningConfig      // represents the key configuration used to generate a signed bundle
+	keyID                        string                     // represents the name of the default key used to verify a signed bundle
+	metadata                     *map[string]interface{}    // represents additional data included in .manifest file
+	fsys                         fs.FS                      // file system to use when loading paths
 }
 
 // New returns a new compiler instance that can be invoked.
@@ -91,6 +105,20 @@ func (c *Compiler) WithAsBundle(enabled bool) *Compiler {
 	return c
 }
 
+// WithPruneUnused will make rules be ignored that are defined on the same
+// package as the entrypoint, but that are not in the entrypoint set.
+//
+// Notably this includes functions (they can't be entrypoints) and causes
+// the built bundle to no longer be semantically equivalent to the bundle built
+// without wasm.
+//
+// This affects the 'wasm' and 'plan' targets only. It has no effect on
+// building 'rego' bundles, i.e., "ordinary bundles".
+func (c *Compiler) WithPruneUnused(enabled bool) *Compiler {
+	c.pruneUnused = enabled
+	return c
+}
+
 // WithEntrypoints sets the policy entrypoints on the compiler. Entrypoints tell the
 // compiler what rules to expect and where optimizations can be targeted. The wasm
 // target requires at least one entrypoint as does optimization.
@@ -99,6 +127,14 @@ func (c *Compiler) WithEntrypoints(e ...string) *Compiler {
 	return c
 }
 
+// WithRegoAnnotationEntrypoints allows the compiler to late-bind entrypoints, based
+// on Rego entrypoint annotations. The rules tagged with entrypoint annotations are
+// added to the global list of entrypoints before optimizations/target compilation.
+func (c *Compiler) WithRegoAnnotationEntrypoints(enabled bool) *Compiler {
+	c.useRegoAnnotationEntrypoints = enabled
+	return c
+}
+
 // WithOptimizationLevel sets the optimization level on the compiler. By default
 // optimizations are disabled. Higher levels apply more aggressive optimizations
 // but can take longer.
@@ -127,6 +163,14 @@ func (c *Compiler) WithDebug(sink io.Writer) *Compiler {
 	return c
 }
 
+// WithEnablePrintStatements enables print statements inside of modules compiled
+// by the compiler. If print statements are not enabled, calls to print() are
+// erased at compile-time.
+func (c *Compiler) WithEnablePrintStatements(yes bool) *Compiler {
+	c.enablePrintStatements = yes
+	return c
+}
+
 // WithPaths adds input filepaths to read policy and data from.
 func (c *Compiler) WithPaths(p ...string) *Compiler {
 	c.paths = append(c.paths, p...)
@@ -172,6 +216,54 @@ func (c *Compiler) WithCapabilities(capabilities *ast.Capabilities) *Compiler {
 	return c
 }
 
+// WithMetadata sets the additional data to be included in .manifest
+func (c *Compiler) WithMetadata(metadata *map[string]interface{}) *Compiler {
+	c.metadata = metadata
+	return c
+}
+
+// WithFS sets the file system to use when loading paths
+func (c *Compiler) WithFS(fsys fs.FS) *Compiler {
+	c.fsys = fsys
+	return c
+}
+
+func addEntrypointsFromAnnotations(c *Compiler, ar []*ast.AnnotationsRef) error {
+	for _, ref := range ar {
+		var entrypoint ast.Ref
+		scope := ref.Annotations.Scope
+
+		if ref.Annotations.Entrypoint {
+			// Build up the entrypoint path from either package path or rule.
+			switch scope {
+			case "package":
+				if p := ref.GetPackage(); p != nil {
+					entrypoint = p.Path
+				}
+			case "rule":
+				if r := ref.GetRule(); r != nil {
+					entrypoint = r.Ref().GroundPrefix()
+				}
+			default:
+				continue // Wrong scope type. Bail out early.
+			}
+
+			// Get a slash-based path, as with a CLI-provided entrypoint.
+			escapedPath, err := storage.NewPathForRef(entrypoint)
+			if err != nil {
+				return err
+			}
+			slashPath := strings.Join(escapedPath, "/")
+
+			// Add new entrypoints to the appropriate places.
+			c.entrypoints = c.entrypoints.Append(slashPath)
+			c.entrypointrefs = append(c.entrypointrefs, ast.NewTerm(entrypoint))
+		}
+	}
+
+	return nil
+}
+
 // Build compiles and links the input files and outputs a bundle to the writer.
 func (c *Compiler) Build(ctx context.Context) error {
 
@@ -179,24 +271,77 @@ func (c *Compiler) Build(ctx context.Context) error {
 		return err
 	}
 
+	// Fail early if not using Rego annotation entrypoints.
+	if !c.useRegoAnnotationEntrypoints {
+		if err := c.checkNumEntrypoints(); err != nil {
+			return err
+		}
+	}
+
 	if err := c.initBundle(); err != nil {
 		return err
 	}
 
+	// Extract annotations, and generate new entrypoints as needed.
+	if c.useRegoAnnotationEntrypoints {
+		moduleList := make([]*ast.Module, 0, len(c.bundle.Modules))
+		for _, modfile := range c.bundle.Modules {
+			moduleList = append(moduleList, modfile.Parsed)
+		}
+		as, errs := ast.BuildAnnotationSet(moduleList)
+		if len(errs) > 0 {
+			return errs
+		}
+		ar := as.Flatten()
+
+		// Patch in entrypoints from Rego annotations.
+		err := addEntrypointsFromAnnotations(c, ar)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Ensure we have at least one valid entrypoint, or fail before compilation.
+	if err := c.checkNumEntrypoints(); err != nil {
+		return err
+	}
+
 	if err := c.optimize(ctx); err != nil {
 		return err
 	}
 
-	if c.target == TargetWasm {
+	switch c.target {
+	case TargetWasm:
 		if err := c.compileWasm(ctx); err != nil {
 			return err
 		}
+	case TargetPlan:
+		if err := c.compilePlan(ctx); err != nil {
+			return err
+		}
+
+		bs, err := json.Marshal(c.policy)
+		if err != nil {
+			return err
+		}
+
+		c.bundle.PlanModules = append(c.bundle.PlanModules, bundle.PlanModuleFile{
+			Path: bundle.PlanFile,
+			URL:  bundle.PlanFile,
+			Raw:  bs,
+		})
+	case TargetRego:
+		// nop
 	}
 
 	if c.revision != nil {
 		c.bundle.Manifest.Revision = *c.revision
 	}
 
+	if c.metadata != nil {
+		c.bundle.Manifest.Metadata = *c.metadata
+	}
+
 	if err := c.bundle.FormatModules(false); err != nil {
 		return err
 	}
@@ -220,12 +365,19 @@ func (c *Compiler) init() error {
 		c.capabilities = ast.CapabilitiesForThisVersion()
 	}
 
-	if _, ok := validTargets[c.target]; !ok {
+	var found bool
+	for _, t := range Targets {
+		if c.target == t {
+			found = true
+			break
+		}
+	}
+
+	if !found {
 		return fmt.Errorf("invalid target %q", c.target)
 	}
 
 	for _, e := range c.entrypoints {
-
 		r, err := ref.ParseDataPath(e)
 		if err != nil {
 			return fmt.Errorf("entrypoint %v not valid: use <package>/<rule>", e)
@@ -234,12 +386,18 @@ func (c *Compiler) init() error {
 		c.entrypointrefs = append(c.entrypointrefs, ast.NewTerm(r))
 	}
 
+	return nil
+}
+
+// Once the bundle has been loaded, we can check the entrypoint counts.
+func (c *Compiler) checkNumEntrypoints() error {
 	if c.optimizationLevel > 0 && len(c.entrypointrefs) == 0 {
 		return errors.New("bundle optimizations require at least one entrypoint")
 	}
 
-	if c.target == TargetWasm && len(c.entrypointrefs) == 0 {
-		return errors.New("wasm compilation requires at least one entrypoint")
+	// Rego target does not require an entrypoint. Others currently do.
+	if c.target != TargetRego && len(c.entrypointrefs) == 0 {
+		return fmt.Errorf("%s compilation requires at least one entrypoint", c.target)
 	}
 
 	return nil
@@ -252,7 +410,6 @@ func (c *Compiler) Bundle() *bundle.Bundle {
 }
 
 func (c *Compiler) initBundle() error {
-
 	// If the bundle is already set, skip file loading.
 	if c.bundle != nil {
 		return nil
@@ -261,9 +418,9 @@ func (c *Compiler) initBundle() error {
 	// TODO(tsandall): the metrics object should passed through here so we that
 	// we can track read and parse times.
 
-	load, err := initload.LoadPaths(c.paths, c.filter, c.asBundle, c.bvc, false)
+	load, err := initload.LoadPaths(c.paths, c.filter, c.asBundle, c.bvc, false, c.useRegoAnnotationEntrypoints, c.capabilities, c.fsys)
 	if err != nil {
-		return errors.Wrap(err, "load error")
+		return fmt.Errorf("load error: %w", err)
 	}
 
 	if c.asBundle {
@@ -297,8 +454,7 @@ func (c *Compiler) initBundle() error {
 	result.Manifest.Init()
 	result.Data = load.Files.Documents
 
-	var modules []string
-
+	modules := make([]string, 0, len(load.Files.Modules))
 	for k := range load.Files.Modules {
 		modules = append(modules, k)
 	}
@@ -306,9 +462,10 @@ func (c *Compiler) initBundle() error {
 	sort.Strings(modules)
 
 	for _, module := range modules {
+		path := filepath.ToSlash(load.Files.Modules[module].Name)
 		result.Modules = append(result.Modules, bundle.ModuleFile{
-			URL:    load.Files.Modules[module].Name,
-			Path:   load.Files.Modules[module].Name,
+			URL:    path,
+			Path:   path,
 			Parsed: load.Files.Modules[module].Parsed,
 			Raw:    load.Files.Modules[module].Raw,
 		})
@@ -323,14 +480,15 @@ func (c *Compiler) optimize(ctx context.Context) error {
 
 	if c.optimizationLevel <= 0 {
 		var err error
-		c.compiler, err = compile(c.capabilities, c.bundle, c.debug)
+		c.compiler, err = compile(c.capabilities, c.bundle, c.debug, c.enablePrintStatements)
 		return err
 	}
 
 	o := newOptimizer(c.capabilities, c.bundle).
 		WithEntrypoints(c.entrypointrefs).
 		WithDebug(c.debug.Writer()).
-		WithShallowInlining(c.optimizationLevel <= 1)
+		WithShallowInlining(c.optimizationLevel <= 1).
+		WithEnablePrintStatements(c.enablePrintStatements)
 
 	err := o.Do(ctx)
 	if err != nil {
@@ -342,53 +500,55 @@ func (c *Compiler) optimize(ctx context.Context) error {
 	return nil
 }
 
-func (c *Compiler) compileWasm(ctx context.Context) error {
+func (c *Compiler) compilePlan(context.Context) error {
 
 	// Lazily compile the modules if needed. If optimizations were run, the
 	// AST compiler will not be set because the default target does not require it.
 	if c.compiler == nil {
 		var err error
-		c.compiler, err = compile(c.capabilities, c.bundle, c.debug)
+		c.compiler, err = compile(c.capabilities, c.bundle, c.debug, c.enablePrintStatements)
 		if err != nil {
 			return err
 		}
 	}
 
-	// Find transitive dependents of entrypoints and add them to the set to compile.
-	//
-	// NOTE(tsandall): We compile entrypoints because the evaluator does not support
-	// evaluation of wasm-compiled rules when 'with' statements are in-scope. Compiling
-	// out the dependents avoids the need to support that case for now.
-	deps := map[*ast.Rule]struct{}{}
-	for i := range c.entrypointrefs {
-		transitiveDocumentDependents(c.compiler, c.entrypointrefs[i], deps)
-	}
+	if !c.pruneUnused {
+		// Find transitive dependents of entrypoints and add them to the set to compile.
+		//
+		// NOTE(tsandall): We compile entrypoints because the evaluator does not support
+		// evaluation of wasm-compiled rules when 'with' statements are in-scope. Compiling
+		// out the dependents avoids the need to support that case for now.
+		deps := map[*ast.Rule]struct{}{}
+		for i := range c.entrypointrefs {
+			transitiveDocumentDependents(c.compiler, c.entrypointrefs[i], deps)
+		}
 
-	extras := ast.NewSet()
-	for rule := range deps {
-		extras.Add(ast.NewTerm(rule.Path()))
-	}
+		extras := ast.NewSet()
+		for rule := range deps {
+			extras.Add(ast.NewTerm(rule.Path()))
+		}
 
-	sorted := extras.Sorted()
+		sorted := extras.Sorted()
 
-	for i := 0; i < sorted.Len(); i++ {
-		p, err := sorted.Elem(i).Value.(ast.Ref).Ptr()
-		if err != nil {
-			return err
-		}
+		for i := 0; i < sorted.Len(); i++ {
+			p, err := sorted.Elem(i).Value.(ast.Ref).Ptr()
+			if err != nil {
+				return err
+			}
 
-		if !c.entrypoints.Contains(p) {
-			c.entrypoints = append(c.entrypoints, p)
-			c.entrypointrefs = append(c.entrypointrefs, sorted.Elem(i))
+			if !c.entrypoints.Contains(p) {
+				c.entrypoints = append(c.entrypoints, p)
+				c.entrypointrefs = append(c.entrypointrefs, sorted.Elem(i))
+			}
 		}
 	}
 
 	// Create query sets for each of the entrypoints.
-	resultSym := ast.NewTerm(wasmResultVar)
+	resultSym := ast.NewTerm(resultVar)
 	queries := make([]planner.QuerySet, len(c.entrypointrefs))
+	var unmappedEntrypoints []string
 
 	for i := range c.entrypointrefs {
-
 		qc := c.compiler.QueryCompiler()
 		query := ast.NewBody(ast.Equality.Expr(resultSym, c.entrypointrefs[i]))
 		compiled, err := qc.Compile(query)
@@ -396,6 +556,10 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 			return err
 		}
 
+		if len(c.compiler.GetRules(c.entrypointrefs[i].Value.(ast.Ref))) == 0 {
+			unmappedEntrypoints = append(unmappedEntrypoints, c.entrypoints[i])
+		}
+
 		queries[i] = planner.QuerySet{
 			Name:          c.entrypoints[i],
 			Queries:       []ast.Body{compiled},
@@ -403,8 +567,12 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 		}
 	}
 
+	if len(unmappedEntrypoints) > 0 {
+		return fmt.Errorf("entrypoint %q does not refer to a rule or policy decision", unmappedEntrypoints[0])
+	}
+
 	// Prepare modules and builtins for the planner.
-	modules := []*ast.Module{}
+	modules := make([]*ast.Module, 0, len(c.compiler.Modules))
 	for _, module := range c.compiler.Modules {
 		modules = append(modules, module)
 	}
@@ -414,7 +582,32 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 		builtins[bi.Name] = bi
 	}
 
+	// Plan the query sets.
+	p := planner.New().
+		WithQueries(queries).
+		WithModules(modules).
+		WithBuiltinDecls(builtins).
+		WithDebug(c.debug.Writer())
+	policy, err := p.Plan()
+	if err != nil {
+		return err
+	}
+
+	// dump policy IR (if "debug" wasn't requested, debug.Writer will discard it)
+	err = ir.Pretty(c.debug.Writer(), policy)
+	if err != nil {
+		return err
+	}
+
+	c.policy = policy
+
+	return nil
+}
+
+func (c *Compiler) compileWasm(ctx context.Context) error {
+
 	compiler := wasm.New()
+
 	found := false
 	have := compiler.ABIVersion()
 	if c.capabilities.WasmABIVersions == nil { // discern nil from len=0
@@ -434,25 +627,12 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 		)
 	}
 
-	// Plan the query sets.
-	p := planner.New().
-		WithQueries(queries).
-		WithModules(modules).
-		WithBuiltinDecls(builtins).
-		WithDebug(c.debug.Writer())
-	policy, err := p.Plan()
-	if err != nil {
-		return err
-	}
-
-	// dump policy IR (if "debug" wasn't requested, debug.Witer will discard it)
-	err = ir.Pretty(c.debug.Writer(), policy)
-	if err != nil {
+	if err := c.compilePlan(ctx); err != nil {
 		return err
 	}
 
 	// Compile the policy into a wasm binary.
-	m, err := compiler.WithPolicy(policy).WithDebug(c.debug.Writer()).Compile()
+	m, err := compiler.WithPolicy(c.policy).WithDebug(c.debug.Writer()).Compile()
 	if err != nil {
 		return err
 	}
@@ -470,13 +650,21 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 		Raw:  buf.Bytes(),
 	}}
 
+	flattenedAnnotations := c.compiler.GetAnnotationSet().Flatten()
+
 	// Each entrypoint needs an entry in the manifest
-	for i := range c.entrypointrefs {
+	for i, e := range c.entrypointrefs {
 		entrypointPath := c.entrypoints[i]
 
+		var annotations []*ast.Annotations
+		if !c.isPackage(e) {
+			annotations = findAnnotationsForTerm(e, flattenedAnnotations)
+		}
+
 		c.bundle.Manifest.WasmResolvers = append(c.bundle.Manifest.WasmResolvers, bundle.WasmResolver{
-			Module:     "/" + strings.TrimLeft(modulePath, "/"),
-			Entrypoint: entrypointPath,
+			Module:      "/" + strings.TrimLeft(modulePath, "/"),
+			Entrypoint:  entrypointPath,
+			Annotations: annotations,
 		})
 	}
 
@@ -484,6 +672,33 @@ func (c *Compiler) compileWasm(ctx context.Context) error {
 	return pruneBundleEntrypoints(c.bundle, c.entrypointrefs)
 }
 
+func (c *Compiler) isPackage(term *ast.Term) bool {
+	for _, m := range c.compiler.Modules {
+		if m.Package.Path.Equal(term.Value) {
+			return true
+		}
+	}
+	return false
+}
+
+// findAnnotationsForTerm returns a slice of all annotations directly associated with the given term.
+func findAnnotationsForTerm(term *ast.Term, annotationRefs []*ast.AnnotationsRef) []*ast.Annotations {
+	r, ok := term.Value.(ast.Ref)
+	if !ok {
+		return nil
+	}
+
+	var result []*ast.Annotations
+
+	for _, ar := range annotationRefs {
+		if r.Equal(ar.Path) {
+			result = append(result, ar.Annotations)
+		}
+	}
+
+	return result
+}
+
 // pruneBundleEntrypoints will modify modules in the provided bundle to remove
 // rules matching the entrypoints along with injecting import statements to
 // preserve their ability to compile.
@@ -519,11 +734,43 @@ func pruneBundleEntrypoints(b *bundle.Bundle, entrypointrefs []*ast.Term) error
 				}
 			}
 
-			// If any rules were dropped update the module accordingly
-			if len(rules) != len(mf.Parsed.Rules) {
+			// Drop any Annotations for rules matching the entrypoint path
+			var annotations []*ast.Annotations
+			var prunedAnnotations []*ast.Annotations
+			for _, annotation := range mf.Parsed.Annotations {
+				p := annotation.GetTargetPath()
+				// We prune annotations of dropped rules, but not packages, as the Rego file is always retained
+				if p.Equal(entrypoint.Value) && !mf.Parsed.Package.Path.Equal(entrypoint.Value) {
+					prunedAnnotations = append(prunedAnnotations, annotation)
+				} else {
+					annotations = append(annotations, annotation)
+				}
+			}
+
+			// Drop comments associated with pruned annotations
+			var comments []*ast.Comment
+			for _, comment := range mf.Parsed.Comments {
+				pruned := false
+				for _, annotation := range prunedAnnotations {
+					if comment.Location.Row >= annotation.Location.Row &&
+						comment.Location.Row <= annotation.EndLoc().Row {
+						pruned = true
+						break
+					}
+				}
+
+				if !pruned {
+					comments = append(comments, comment)
+				}
+			}
+
+			// If any rules or annotations were dropped update the module accordingly
+			if len(rules) != len(mf.Parsed.Rules) || len(comments) != len(mf.Parsed.Comments) {
 				mf.Parsed.Rules = rules
+				mf.Parsed.Annotations = annotations
+				mf.Parsed.Comments = comments
 				// Remove the original raw source, we're editing the AST
-				// directly so it wont be in sync anymore.
+				// directly, so it won't be in sync anymore.
 				mf.Raw = nil
 			}
 		}
@@ -552,15 +799,16 @@ func (err undefinedEntrypointErr) Error() string {
 }
 
 type optimizer struct {
-	capabilities    *ast.Capabilities
-	bundle          *bundle.Bundle
-	compiler        *ast.Compiler
-	entrypoints     []*ast.Term
-	nsprefix        string
-	resultsymprefix string
-	outputprefix    string
-	shallow         bool
-	debug           debug.Debug
+	capabilities          *ast.Capabilities
+	bundle                *bundle.Bundle
+	compiler              *ast.Compiler
+	entrypoints           []*ast.Term
+	nsprefix              string
+	resultsymprefix       string
+	outputprefix          string
+	shallow               bool
+	debug                 debug.Debug
+	enablePrintStatements bool
 }
 
 func newOptimizer(c *ast.Capabilities, b *bundle.Bundle) *optimizer {
@@ -581,6 +829,11 @@ func (o *optimizer) WithDebug(sink io.Writer) *optimizer {
 	return o
 }
 
+func (o *optimizer) WithEnablePrintStatements(yes bool) *optimizer {
+	o.enablePrintStatements = yes
+	return o
+}
+
 func (o *optimizer) WithEntrypoints(es []*ast.Term) *optimizer {
 	o.entrypoints = es
 	return o
@@ -607,7 +860,7 @@ func (o *optimizer) Do(ctx context.Context) error {
 		data = map[string]interface{}{}
 	}
 
-	store := inmem.NewFromObject(data)
+	store := inmem.NewFromObjectWithOpts(data, inmem.OptRoundTripOnWrite(false))
 	resultsym := ast.VarTerm(o.resultsymprefix + "__result__")
 	usedFilenames := map[string]int{}
 	var unknowns []*ast.Term
@@ -620,7 +873,7 @@ func (o *optimizer) Do(ctx context.Context) error {
 	for i, e := range o.entrypoints {
 
 		var err error
-		o.compiler, err = compile(o.capabilities, o.bundle, o.debug)
+		o.compiler, err = compile(o.capabilities, o.bundle, o.debug, o.enablePrintStatements)
 		if err != nil {
 			return err
 		}
@@ -718,7 +971,7 @@ func (o *optimizer) findRequiredDocuments(ref *ast.Term) []string {
 		})
 	}
 
-	var result []string
+	result := make([]string, 0, len(keep))
 
 	for k := range keep {
 		result = append(result, k)
@@ -781,7 +1034,7 @@ func (o *optimizer) getSupportForEntrypoint(queries []ast.Body, e *ast.Term, res
 			o.debug.Printf("optimizer: entrypoint: %v: discard due to self-reference", e)
 			return nil
 		}
-		module.Rules = append(module.Rules, &ast.Rule{
+		module.Rules = append(module.Rules, &ast.Rule{ // TODO(sr): use RefHead instead?
 			Head:   ast.NewHead(name, nil, resultsym),
 			Body:   query,
 			Module: module,
@@ -794,6 +1047,8 @@ func (o *optimizer) getSupportForEntrypoint(queries []ast.Body, e *ast.Term, res
 // merge combines two sets of modules and returns the result. The rules from modules
 // in 'b' override rules from modules in 'a'. If all rules in a module in 'a' are overridden
 // by rules in modules in 'b' then the module from 'a' is discarded.
+// NOTE(sr): This function assumes that `b` is the result of partial eval, and thus does NOT
+// contain any rules that genuinely need their ref heads.
 func (o *optimizer) merge(a, b []bundle.ModuleFile) []bundle.ModuleFile {
 
 	prefixes := ast.NewSet()
@@ -805,12 +1060,19 @@ func (o *optimizer) merge(a, b []bundle.ModuleFile) []bundle.ModuleFile {
 		// of rules.)
 		seen := ast.NewVarSet()
 		for _, rule := range b[i].Parsed.Rules {
-			if _, ok := seen[rule.Head.Name]; !ok {
-				prefixes.Add(ast.NewTerm(rule.Path()))
-				seen.Add(rule.Head.Name)
+			// NOTE(sr): we're relying on the fact that PE never emits ref rules (so far)!
+			// The rule
+			//   p.a = 1 { ... }
+			// will be recorded in prefixes as `data.test.p`, and that'll be checked later on against `data.test.p[k]`
+			if len(rule.Head.Ref()) > 2 {
+				panic("expected a module without ref rules")
+			}
+			name := rule.Head.Name
+			if !seen.Contains(name) {
+				prefixes.Add(ast.NewTerm(b[i].Parsed.Package.Path.Append(ast.StringTerm(string(name)))))
+				seen.Add(name)
 			}
 		}
-
 	}
 
 	for i := range a {
@@ -819,30 +1081,28 @@ func (o *optimizer) merge(a, b []bundle.ModuleFile) []bundle.ModuleFile {
 
 		// NOTE(tsandall): same as above--memoize keep/discard decision. If multiple
 		// entrypoints are provided the dst module may contain a large number of rules.
-		seen := ast.NewVarSet()
-		discard := ast.NewVarSet()
-
+		seen, discarded := ast.NewSet(), ast.NewSet()
 		for _, rule := range a[i].Parsed.Rules {
-
-			if _, ok := discard[rule.Head.Name]; ok {
-				continue
-			} else if _, ok := seen[rule.Head.Name]; ok {
+			refT := ast.NewTerm(rule.Ref())
+			switch {
+			case seen.Contains(refT):
 				keep = append(keep, rule)
 				continue
+			case discarded.Contains(refT):
+				continue
 			}
 
-			path := rule.Path()
+			path := rule.Ref()
 			overlap := prefixes.Until(func(x *ast.Term) bool {
-				ref := x.Value.(ast.Ref)
-				return path.HasPrefix(ref)
+				r := x.Value.(ast.Ref)
+				return path.HasPrefix(r)
 			})
-
 			if overlap {
-				discard.Add(rule.Head.Name)
-			} else {
-				seen.Add(rule.Head.Name)
-				keep = append(keep, rule)
+				discarded.Add(refT)
+				continue
 			}
+			seen.Add(refT)
+			keep = append(keep, rule)
 		}
 
 		if len(keep) > 0 {
@@ -850,7 +1110,6 @@ func (o *optimizer) merge(a, b []bundle.ModuleFile) []bundle.ModuleFile {
 			a[i].Raw = nil
 			b = append(b, a[i])
 		}
-
 	}
 
 	return b
@@ -862,12 +1121,13 @@ func (o *optimizer) getSupportModuleFilename(used map[string]int, module *ast.Mo
 
 	if err == nil && safePathPattern.MatchString(fileName) {
 		fileName = o.outputprefix + "/" + fileName
+		uniqueFileName := fileName
 		if c, ok := used[fileName]; ok {
-			fileName += fmt.Sprintf(".%d", c)
+			uniqueFileName += fmt.Sprintf(".%d", c)
 		}
 		used[fileName]++
-		fileName += ".rego"
-		return fileName
+		uniqueFileName += ".rego"
+		return uniqueFileName
 	}
 
 	return fmt.Sprintf("%v/%v/%v/%v.rego", o.outputprefix, o.nsprefix, entrypointIndex, supportIndex)
@@ -875,7 +1135,7 @@ func (o *optimizer) getSupportModuleFilename(used map[string]int, module *ast.Mo
 
 var safePathPattern = regexp.MustCompile(`^[\w-_/]+$`)
 
-func compile(c *ast.Capabilities, b *bundle.Bundle, dbg debug.Debug) (*ast.Compiler, error) {
+func compile(c *ast.Capabilities, b *bundle.Bundle, dbg debug.Debug, enablePrintStatements bool) (*ast.Compiler, error) {
 
 	modules := map[string]*ast.Module{}
 
@@ -887,7 +1147,7 @@ func compile(c *ast.Capabilities, b *bundle.Bundle, dbg debug.Debug) (*ast.Compi
 		modules[mf.URL] = mf.Parsed
 	}
 
-	compiler := ast.NewCompiler().WithCapabilities(c).WithDebug(dbg.Writer())
+	compiler := ast.NewCompiler().WithCapabilities(c).WithDebug(dbg.Writer()).WithEnablePrintStatements(enablePrintStatements)
 	compiler.Compile(modules)
 
 	if compiler.Failed() {
diff --git a/compile/compile_bench_test.go b/compile/compile_bench_test.go
new file mode 100644
index 0000000000..a26773e98f
--- /dev/null
+++ b/compile/compile_bench_test.go
@@ -0,0 +1,123 @@
+package compile
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/util/test"
+)
+
+// type compileBenchTestData struct {
+// 	filename string
+// 	module   string
+// }
+
+func BenchmarkCompileDynamicPolicy(b *testing.B) {
+	// This benchmarks the compiler against increasingly large numbers of dynamically-selected policies.
+	// See: https://github.com/open-policy-agent/opa/issues/5216
+
+	numPolicies := []int{1000, 2500, 5000, 7500, 10000}
+
+	for _, n := range numPolicies {
+		testcase := generateDynamicPolicyBenchmarkData(n)
+		b.Run(fmt.Sprintf("%d", n), func(b *testing.B) {
+			test.WithTempFS(testcase, func(root string) {
+				b.ResetTimer()
+
+				compiler := New().
+					WithPaths(root)
+
+				err := compiler.Build(context.Background())
+				if err != nil {
+					b.Fatal("unexpected error", err)
+				}
+			})
+		})
+	}
+}
+
+func generateDynamicPolicyBenchmarkData(N int) map[string]string {
+	files := map[string]string{
+		"main.rego": `
+			package main
+
+			denies[x] {
+				x := data.policies[input.type][input.subtype][_].denies[_]
+			}
+			any_denies {
+				denies[_]
+			}
+			allow {
+				not any_denies
+			}`,
+	}
+
+	for i := 0; i < N; i++ {
+		files[fmt.Sprintf("policy%d.rego", i)] = generateDynamicMockPolicy(i)
+	}
+
+	return files
+}
+
+func generateDynamicMockPolicy(N int) string {
+	return fmt.Sprintf(`package policies["%d"]["%d"].policy%d
+denies[x] {
+	input.attribute == "%d"
+	x := "policy%d"
+}`, N, N, N, N, N)
+}
+
+func BenchmarkLargePartialRulePolicy(b *testing.B) {
+	// This benchmarks the compiler against very large partial rule sets.
+	// See: https://github.com/open-policy-agent/opa/issues/5756
+	numPolicies := []int{1000, 2500, 5000, 7500}
+
+	for _, n := range numPolicies {
+		testcase := generateLargePartialRuleBenchmarkData(n)
+		b.ResetTimer()
+		b.Run(fmt.Sprintf("%d", n), func(b *testing.B) {
+			test.WithTempFS(testcase, func(root string) {
+				b.ResetTimer()
+
+				compiler := New().
+					WithPaths(root)
+
+				err := compiler.Build(context.Background())
+				if err != nil {
+					b.Fatal("unexpected error", err)
+				}
+			})
+		})
+	}
+}
+
+func generateLargePartialRuleBenchmarkData(N int) map[string]string {
+	var policy strings.Builder
+	policy.Grow((140 * N) + 100) // Each rule takes around 130 characters.
+
+	policy.WriteString(`package example.large.partial.rules.policy["dynamic_part"].main`)
+	policy.WriteString("\n\n")
+	for i := 0; i < N; i++ {
+		policy.WriteString(generateLargePartialRuleMockRule(i))
+		policy.WriteString("\n\n")
+	}
+	policy.WriteString(`number_denies = x {
+		x := count(deny)
+	}`)
+
+	files := map[string]string{
+		"main.rego": policy.String(),
+	}
+	return files
+}
+
+func generateLargePartialRuleMockRule(N int) string {
+	return fmt.Sprintf(`deny[[resource, errormsg]] {
+		resource := "example.%d"
+		i := %d
+		i %% 2 != 0
+		errormsg := "denied because %d is an odd number."
+}`, N, N, N)
+}
diff --git a/compile/compile_test.go b/compile/compile_test.go
index 0cd1ee0fd4..270d94708d 100644
--- a/compile/compile_test.go
+++ b/compile/compile_test.go
@@ -3,8 +3,10 @@ package compile
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path"
 	"reflect"
@@ -16,6 +18,7 @@ import (
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/format"
 	"github.com/open-policy-agent/opa/internal/ref"
+	"github.com/open-policy-agent/opa/ir"
 	"github.com/open-policy-agent/opa/loader"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
@@ -53,6 +56,11 @@ func TestCompilerInitErrors(t *testing.T) {
 			c:    New().WithTarget("wasm"),
 			want: errors.New("wasm compilation requires at least one entrypoint"),
 		},
+		{
+			note: "plan compilation requires at least one entrypoint",
+			c:    New().WithTarget("plan"),
+			want: errors.New("plan compilation requires at least one entrypoint"),
+		},
 	}
 
 	for _, tc := range tests {
@@ -70,12 +78,18 @@ func TestCompilerInitErrors(t *testing.T) {
 
 func TestCompilerLoadError(t *testing.T) {
 
-	test.WithTempFS(nil, func(root string) {
-		err := New().WithPaths(path.Join(root, "does-not-exist")).Build(context.Background())
-		if err == nil {
-			t.Fatal("expected failure")
-		}
-	})
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(nil, useMemoryFS, func(root string, fsys fs.FS) {
+
+			err := New().
+				WithFS(fsys).
+				WithPaths(path.Join(root, "does-not-exist")).
+				Build(context.Background())
+			if err == nil {
+				t.Fatal("expected failure")
+			}
+		})
+	}
 }
 
 func TestCompilerLoadAsBundleSuccess(t *testing.T) {
@@ -95,54 +109,57 @@ func TestCompilerLoadAsBundleSuccess(t *testing.T) {
 			{"b2": {"k2": "v2"}}`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		root1 := path.Join(root, "b1")
-		root2 := path.Join(root, "b2")
+			root1 := path.Join(root, "b1")
+			root2 := path.Join(root, "b2")
 
-		compiler := New().
-			WithPaths(root1, root2).
-			WithAsBundle(true)
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root1, root2).
+				WithAsBundle(true)
 
-		err := compiler.Build(ctx)
-		if err != nil {
-			t.Fatal(err)
-		}
+			err := compiler.Build(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		// Verify result is just merger of two bundles.
-		a, err := loader.NewFileLoader().AsBundle(root1)
-		if err != nil {
-			panic(err)
-		}
+			// Verify result is just merger of two bundles.
+			a, err := loader.NewFileLoader().WithFS(fsys).AsBundle(root1)
+			if err != nil {
+				panic(err)
+			}
 
-		b, err := loader.NewFileLoader().AsBundle(root2)
-		if err != nil {
-			panic(err)
-		}
+			b, err := loader.NewFileLoader().WithFS(fsys).AsBundle(root2)
+			if err != nil {
+				panic(err)
+			}
 
-		exp, err := bundle.Merge([]*bundle.Bundle{a, b})
-		if err != nil {
-			panic(err)
-		}
+			exp, err := bundle.Merge([]*bundle.Bundle{a, b})
+			if err != nil {
+				panic(err)
+			}
 
-		err = exp.FormatModules(false)
-		if err != nil {
-			t.Fatal(err)
-		}
+			err = exp.FormatModules(false)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if !compiler.bundle.Equal(*exp) {
-			t.Fatalf("expected %v but got %v", exp, compiler.bundle)
-		}
+			if !compiler.bundle.Equal(*exp) {
+				t.Fatalf("expected %v but got %v", exp, compiler.bundle)
+			}
 
-		expRoots := []string{"b1", "b2"}
-		expManifest := bundle.Manifest{
-			Roots: &expRoots,
-		}
+			expRoots := []string{"b1", "b2"}
+			expManifest := bundle.Manifest{
+				Roots: &expRoots,
+			}
 
-		if !compiler.bundle.Manifest.Equal(expManifest) {
-			t.Fatalf("expected %v but got %v", compiler.bundle.Manifest, expManifest)
-		}
-	})
+			if !compiler.bundle.Manifest.Equal(expManifest) {
+				t.Fatalf("expected %v but got %v", compiler.bundle.Manifest, expManifest)
+			}
+		})
+	}
 }
 
 func TestCompilerLoadAsBundleMergeError(t *testing.T) {
@@ -161,20 +178,23 @@ func TestCompilerLoadAsBundleMergeError(t *testing.T) {
 			{"b2": {"k2": "v2"}}`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		root1 := path.Join(root, "b1")
-		root2 := path.Join(root, "b2")
+			root1 := path.Join(root, "b1")
+			root2 := path.Join(root, "b2")
 
-		compiler := New().
-			WithPaths(root1, root2).
-			WithAsBundle(true)
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root1, root2).
+				WithAsBundle(true)
 
-		err := compiler.Build(ctx)
-		if err == nil || err.Error() != "bundle merge failed: manifest has overlapped roots: '' and ''" {
-			t.Fatal(err)
-		}
-	})
+			err := compiler.Build(ctx)
+			if err == nil || err.Error() != "bundle merge failed: manifest has overlapped roots: '' and ''" {
+				t.Fatal(err)
+			}
+		})
+	}
 }
 
 func TestCompilerLoadFilesystem(t *testing.T) {
@@ -188,31 +208,101 @@ func TestCompilerLoadFilesystem(t *testing.T) {
 			{"b1": {"k": "v"}}`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().
-			WithPaths(root)
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root)
 
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		// Verify result is just bundle load.
-		exp, err := loader.NewFileLoader().AsBundle(root)
-		if err != nil {
-			panic(err)
-		}
+			// Verify result is just bundle load.
+			exp, err := loader.NewFileLoader().WithFS(fsys).AsBundle(root)
+			if err != nil {
+				panic(err)
+			}
 
-		err = exp.FormatModules(false)
-		if err != nil {
-			t.Fatal(err)
-		}
+			err = exp.FormatModules(false)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if !compiler.bundle.Equal(*exp) {
-			t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", exp, compiler.bundle)
-		}
-	})
+			if !compiler.bundle.Equal(*exp) {
+				t.Fatalf("Expected:\n\n%v\n\nGot:\n\n%v", compiler.bundle, exp)
+			}
+		})
+	}
+}
+
+func TestCompilerLoadFilesystemWithEnablePrintStatementsFalse(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+			package test
+
+                        allow { print(1) }
+		`,
+		"data.json": `
+			{"b1": {"k": "v"}}`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("plan").WithEntrypoints("test/allow").
+				WithEnablePrintStatements(false)
+
+			if err := compiler.Build(context.Background()); err != nil {
+				t.Fatal(err)
+			}
+
+			bundle := compiler.Bundle()
+
+			if strings.Contains(string(bundle.PlanModules[0].Raw), "internal.print") {
+				t.Fatalf("output different than expected:\n\ngot: %v\n\nfound: internal.print", string(bundle.PlanModules[0].Raw))
+			}
+		})
+	}
+}
+
+func TestCompilerLoadFilesystemWithEnablePrintStatementsTrue(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+			package test
+
+                        allow { print(1) }
+		`,
+		"data.json": `
+			{"b1": {"k": "v"}}`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("plan").
+				WithEntrypoints("test/allow").
+				WithEnablePrintStatements(true)
+
+			if err := compiler.Build(context.Background()); err != nil {
+				t.Fatal(err)
+			}
+
+			bundle := compiler.Bundle()
+
+			if !strings.Contains(string(bundle.PlanModules[0].Raw), "internal.print") {
+				t.Fatalf("output different than expected:\n\ngot: %v\n\nmissing: internal.print", string(bundle.PlanModules[0].Raw))
+			}
+		})
+	}
 }
 
 func TestCompilerLoadHonorsFilter(t *testing.T) {
@@ -225,23 +315,26 @@ func TestCompilerLoadHonorsFilter(t *testing.T) {
 			{"b1": {"k": "v"}}`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().
-			WithPaths(root).
-			WithFilter(func(abspath string, _ os.FileInfo, _ int) bool {
-				return strings.HasSuffix(abspath, ".json")
-			})
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithFilter(func(abspath string, _ os.FileInfo, _ int) bool {
+					return strings.HasSuffix(abspath, ".json")
+				})
 
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if len(compiler.bundle.Data) > 0 {
-			t.Fatal("expected no data to be loaded")
-		}
-	})
+			if len(compiler.bundle.Data) > 0 {
+				t.Fatal("expected no data to be loaded")
+			}
+		})
+	}
 }
 
 func TestCompilerInputBundle(t *testing.T) {
@@ -306,21 +399,24 @@ func TestCompilerError(t *testing.T) {
 			p { p }`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().
-			WithPaths(root)
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root)
 
-		err := compiler.Build(context.Background())
-		if err == nil {
-			t.Fatal("expected error")
-		}
+			err := compiler.Build(context.Background())
+			if err == nil {
+				t.Fatal("expected error")
+			}
 
-		astErr, ok := err.(ast.Errors)
-		if !ok || len(astErr) != 1 || astErr[0].Code != ast.RecursionErr {
-			t.Fatal("unexpected error:", err)
-		}
-	})
+			astErr, ok := err.(ast.Errors)
+			if !ok || len(astErr) != 1 || astErr[0].Code != ast.RecursionErr {
+				t.Fatal("unexpected error:", err)
+			}
+		})
+	}
 }
 
 func TestCompilerOptimizationL1(t *testing.T) {
@@ -335,19 +431,21 @@ func TestCompilerOptimizationL1(t *testing.T) {
 			{"foo": 1}`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().
-			WithPaths(root).
-			WithOptimizationLevel(1).
-			WithEntrypoints("test/p")
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithOptimizationLevel(1).
+				WithEntrypoints("test/p")
 
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		optimizedExp := ast.MustParseModule(`
+			optimizedExp := ast.MustParseModule(`
 			package test
 
 			default p = false
@@ -355,29 +453,30 @@ func TestCompilerOptimizationL1(t *testing.T) {
 			q { input.x = 1 }
 		`)
 
-		// NOTE(tsandall): PE generates vars with wildcard prefix. Instead of
-		// constructing the AST manually, just rewrite to the expected value
-		// here. If this becomes a common pattern, we could refactor (e.g.,
-		// allow caller to control var prefix, split into a reusable function,
-		// etc.)
-		_, err = ast.TransformVars(optimizedExp, func(x ast.Var) (ast.Value, error) {
-			if x == ast.Var("X") {
-				return ast.Var("$_term_1_01"), nil
+			// NOTE(tsandall): PE generates vars with wildcard prefix. Instead of
+			// constructing the AST manually, just rewrite to the expected value
+			// here. If this becomes a common pattern, we could refactor (e.g.,
+			// allow caller to control var prefix, split into a reusable function,
+			// etc.)
+			_, err = ast.TransformVars(optimizedExp, func(x ast.Var) (ast.Value, error) {
+				if x == ast.Var("X") {
+					return ast.Var("$_term_1_01"), nil
+				}
+				return x, nil
+			})
+			if err != nil {
+				t.Fatal(err)
 			}
-			return x, nil
-		})
-		if err != nil {
-			t.Fatal(err)
-		}
 
-		if len(compiler.bundle.Modules) != 1 {
-			t.Fatalf("expected 1 module but got: %v", compiler.bundle.Modules)
-		}
+			if len(compiler.bundle.Modules) != 1 {
+				t.Fatalf("expected 1 module but got: %v", compiler.bundle.Modules)
+			}
 
-		if !compiler.bundle.Modules[0].Parsed.Equal(optimizedExp) {
-			t.Fatalf("expected optimized module to be:\n\n%v\n\ngot:\n\n%v", optimizedExp, compiler.bundle.Modules[0])
-		}
-	})
+			if !compiler.bundle.Modules[0].Parsed.Equal(optimizedExp) {
+				t.Fatalf("expected optimized module to be:\n\n%v\n\ngot:\n\n%v", optimizedExp, compiler.bundle.Modules[0])
+			}
+		})
+	}
 }
 
 func TestCompilerOptimizationL2(t *testing.T) {
@@ -392,42 +491,51 @@ func TestCompilerOptimizationL2(t *testing.T) {
 			{"foo": 1}`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().
-			WithPaths(root).
-			WithOptimizationLevel(2).
-			WithEntrypoints("test/p")
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithOptimizationLevel(2).
+				WithEntrypoints("test/p")
 
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		prunedExp := ast.MustParseModule(`
+			prunedExp := ast.MustParseModule(`
 			package test
 
 			q { input.x = data.foo }`)
 
-		optimizedExp := ast.MustParseModule(`
+			optimizedExp := ast.MustParseModule(`
 			package test
 
 			default p = false
 			p { input.x = 1 }
-		`)
-
-		if len(compiler.bundle.Modules) != 2 {
-			t.Fatalf("expected two modules but got: %v", compiler.bundle.Modules)
-		}
+      `)
 
-		if !compiler.bundle.Modules[0].Parsed.Equal(prunedExp) {
-			t.Fatalf("expected pruned module to be:\n\n%v\n\ngot:\n\n%v", prunedExp, compiler.bundle.Modules[0])
-		}
+			if len(compiler.bundle.Modules) != 2 {
+				t.Fatalf("expected two modules but got: %v", compiler.bundle.Modules)
+			}
 
-		if !compiler.bundle.Modules[1].Parsed.Equal(optimizedExp) {
-			t.Fatalf("expected optimized module to be:\n\n%v\n\ngot:\n\n%v", optimizedExp, compiler.bundle.Modules[1])
-		}
-	})
+			// Note: L2 optimized ModuleFile ordering in a bundle is non-deterministic...
+			if !compiler.bundle.Modules[0].Parsed.Equal(prunedExp) {
+				if !compiler.bundle.Modules[0].Parsed.Equal(optimizedExp) {
+					t.Fatalf("expected optimized module to be:\n\n%v\n\ngot:\n\n%v", optimizedExp, compiler.bundle.Modules[0])
+				}
+				if !compiler.bundle.Modules[1].Parsed.Equal(prunedExp) {
+					t.Fatalf("expected pruned module to be:\n\n%v\n\ngot:\n\n%v", prunedExp, compiler.bundle.Modules[1])
+				}
+			} else {
+				if !compiler.bundle.Modules[1].Parsed.Equal(optimizedExp) {
+					t.Fatalf("expected optimized module to be:\n\n%v\n\ngot:\n\n%v", optimizedExp, compiler.bundle.Modules[1])
+				}
+			}
+		})
+	}
 }
 
 // NOTE(sr): we override this to not depend on build tags in tests
@@ -445,25 +553,31 @@ func TestCompilerWasmTarget(t *testing.T) {
 		q = p+1`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().WithPaths(root).WithTarget("wasm").WithEntrypoints("test/p", "test/q").
-			WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("wasm").
+				WithEntrypoints("test/p", "test/q").
+				WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if len(compiler.bundle.WasmModules) == 0 {
-			t.Fatal("expected to find compiled wasm module")
-		}
+			if len(compiler.bundle.WasmModules) == 0 {
+				t.Fatal("expected to find compiled wasm module")
+			}
 
-		if len(compiler.bundle.Wasm) != 0 {
-			t.Error("expected NOT to find deprecated bundle `Wasm` value")
-		}
+			if len(compiler.bundle.Wasm) != 0 {
+				t.Error("expected NOT to find deprecated bundle `Wasm` value")
+			}
 
-		ensureEntrypointRemoved(t, compiler.bundle, "test/p")
-	})
+			ensureEntrypointRemoved(t, compiler.bundle, "test/p")
+		})
+	}
 }
 
 // If we're building a wasm bundle, and the `opa` binary we use to do that
@@ -476,14 +590,20 @@ func TestCompilerWasmTargetWithCapabilitiesUnset(t *testing.T) {
 		q = p+1`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().WithPaths(root).WithTarget("wasm").WithEntrypoints("test/p", "test/q")
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatalf("expected no error, got %v", err)
-		}
-	})
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("wasm").
+				WithEntrypoints("test/p", "test/q")
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+		})
+	}
 }
 
 func TestCompilerWasmTargetWithCapabilitiesMismatch(t *testing.T) {
@@ -494,24 +614,30 @@ func TestCompilerWasmTargetWithCapabilitiesMismatch(t *testing.T) {
 		q = p+1`,
 	}
 
-	test.WithTempFS(files, func(root string) {
-
-		for note, wabis := range map[string][]ast.WasmABIVersion{
-			"none":     {},
-			"mismatch": {{Version: 0}, {Version: 1, Minor: 2000}},
-		} {
-			t.Run(note, func(t *testing.T) {
-				caps := ast.CapabilitiesForThisVersion()
-				caps.WasmABIVersions = wabis
-				compiler := New().WithPaths(root).WithTarget("wasm").WithEntrypoints("test/p", "test/q").
-					WithCapabilities(caps)
-				err := compiler.Build(context.Background())
-				if err == nil {
-					t.Fatal("expected err, got nil")
-				}
-			})
-		}
-	})
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			for note, wabis := range map[string][]ast.WasmABIVersion{
+				"none":     {},
+				"mismatch": {{Version: 0}, {Version: 1, Minor: 2000}},
+			} {
+				t.Run(note, func(t *testing.T) {
+					caps := ast.CapabilitiesForThisVersion()
+					caps.WasmABIVersions = wabis
+					compiler := New().
+						WithFS(fsys).
+						WithPaths(root).
+						WithTarget("wasm").
+						WithEntrypoints("test/p", "test/q").
+						WithCapabilities(caps)
+					err := compiler.Build(context.Background())
+					if err == nil {
+						t.Fatal("expected err, got nil")
+					}
+				})
+			}
+		})
+	}
 }
 
 func TestCompilerWasmTargetMultipleEntrypoints(t *testing.T) {
@@ -527,39 +653,133 @@ func TestCompilerWasmTargetMultipleEntrypoints(t *testing.T) {
 		mask["/input/password"]`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().WithPaths(root).WithTarget("wasm").WithEntrypoints("test/p", "policy/authz").
-			WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("wasm").
+				WithEntrypoints("test/p", "policy/authz").
+				WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if len(compiler.bundle.WasmModules) != 1 {
-			t.Fatalf("expected 1 Wasm modules, got: %d", len(compiler.bundle.WasmModules))
-		}
+			if len(compiler.bundle.WasmModules) != 1 {
+				t.Fatalf("expected 1 Wasm modules, got: %d", len(compiler.bundle.WasmModules))
+			}
 
-		expManifest := bundle.Manifest{}
-		expManifest.Init()
-		expManifest.WasmResolvers = []bundle.WasmResolver{
-			{
-				Entrypoint: "test/p",
-				Module:     "/policy.wasm",
-			},
-			{
-				Entrypoint: "policy/authz",
-				Module:     "/policy.wasm",
-			},
-		}
+			expManifest := bundle.Manifest{}
+			expManifest.Init()
+			expManifest.WasmResolvers = []bundle.WasmResolver{
+				{
+					Entrypoint: "test/p",
+					Module:     "/policy.wasm",
+				},
+				{
+					Entrypoint: "policy/authz",
+					Module:     "/policy.wasm",
+				},
+			}
 
-		if !compiler.bundle.Manifest.Equal(expManifest) {
-			t.Fatalf("\nExpected manifest: %+v\nGot: %+v\n", expManifest, compiler.bundle.Manifest)
-		}
+			if !compiler.bundle.Manifest.Equal(expManifest) {
+				t.Fatalf("\nExpected manifest: %+v\nGot: %+v\n", expManifest, compiler.bundle.Manifest)
+			}
+
+			ensureEntrypointRemoved(t, compiler.bundle, "test/p")
+			ensureEntrypointRemoved(t, compiler.bundle, "policy/authz")
+		})
+	}
+}
+
+func TestCompilerWasmTargetAnnotations(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `
+# METADATA
+# title: My test package
+package test
+
+# METADATA
+# title: My P rule
+# entrypoint: true
+p = true`,
+		"policy.rego": `
+package policy
+
+# METADATA
+# title: All my Q rules
+# scope: document
+
+# METADATA
+# title: My Q rule
+q = true`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("wasm").
+				WithEntrypoints("test", "policy/q").
+				WithRegoAnnotationEntrypoints(true)
+
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(compiler.bundle.WasmModules) != 1 {
+				t.Fatalf("expected 1 Wasm modules, got: %d", len(compiler.bundle.WasmModules))
+			}
+
+			expWasmResolvers := []bundle.WasmResolver{
+				{
+					Entrypoint: "test",
+					Module:     "/policy.wasm",
+				},
+				{
+					Entrypoint: "policy/q",
+					Module:     "/policy.wasm",
+					Annotations: []*ast.Annotations{
+						{
+							Title: "All my Q rules",
+							Scope: "document",
+						},
+						{
+							Title: "My Q rule",
+							Scope: "rule",
+						},
+					},
+				},
+				{
+					Entrypoint: "test/p",
+					Module:     "/policy.wasm",
+					Annotations: []*ast.Annotations{
+						{
+							Title:      "My P rule",
+							Scope:      "rule",
+							Entrypoint: true,
+						},
+					},
+				},
+			}
+
+			if len(expWasmResolvers) != len(compiler.bundle.Manifest.WasmResolvers) {
+				t.Fatalf("\nExpected WasmResolvers:\n  %+v\nGot:\n  %+v\n", expWasmResolvers, compiler.bundle.Manifest.WasmResolvers)
+			}
 
-		ensureEntrypointRemoved(t, compiler.bundle, "test/p")
-		ensureEntrypointRemoved(t, compiler.bundle, "policy/authz")
-	})
+			for i, expWasmResolver := range expWasmResolvers {
+				if !expWasmResolver.Equal(&compiler.bundle.Manifest.WasmResolvers[i]) {
+					t.Fatalf("WasmResolver at index %v mismatch\n\nExpected WasmResolvers:\n  %+v\nGot:\n  %+v\n",
+						i, expWasmResolvers, compiler.bundle.Manifest.WasmResolvers)
+				}
+			}
+		})
+	}
 }
 
 func TestCompilerWasmTargetEntrypointDependents(t *testing.T) {
@@ -572,48 +792,54 @@ func TestCompilerWasmTargetEntrypointDependents(t *testing.T) {
 		s = 2
 		z { r }`}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().WithPaths(root).WithTarget("wasm").WithEntrypoints("test/r", "test/z").
-			WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("wasm").
+				WithEntrypoints("test/r", "test/z").
+				WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if len(compiler.bundle.WasmModules) != 1 {
-			t.Fatalf("expected 1 Wasm modules, got: %d", len(compiler.bundle.WasmModules))
-		}
+			if len(compiler.bundle.WasmModules) != 1 {
+				t.Fatalf("expected 1 Wasm modules, got: %d", len(compiler.bundle.WasmModules))
+			}
 
-		expManifest := bundle.Manifest{}
-		expManifest.Init()
-		expManifest.WasmResolvers = []bundle.WasmResolver{
-			{
-				Entrypoint: "test/r",
-				Module:     "/policy.wasm",
-			},
-			{
-				Entrypoint: "test/z",
-				Module:     "/policy.wasm",
-			},
-			{
-				Entrypoint: "test/p",
-				Module:     "/policy.wasm",
-			},
-			{
-				Entrypoint: "test/q",
-				Module:     "/policy.wasm",
-			},
-		}
+			expManifest := bundle.Manifest{}
+			expManifest.Init()
+			expManifest.WasmResolvers = []bundle.WasmResolver{
+				{
+					Entrypoint: "test/r",
+					Module:     "/policy.wasm",
+				},
+				{
+					Entrypoint: "test/z",
+					Module:     "/policy.wasm",
+				},
+				{
+					Entrypoint: "test/p",
+					Module:     "/policy.wasm",
+				},
+				{
+					Entrypoint: "test/q",
+					Module:     "/policy.wasm",
+				},
+			}
 
-		if !compiler.bundle.Manifest.Equal(expManifest) {
-			t.Fatalf("\nExpected manifest: %+v\nGot: %+v\n", expManifest, compiler.bundle.Manifest)
-		}
+			if !compiler.bundle.Manifest.Equal(expManifest) {
+				t.Fatalf("\nExpected manifest: %+v\nGot: %+v\n", expManifest, compiler.bundle.Manifest)
+			}
 
-		ensureEntrypointRemoved(t, compiler.bundle, "test/p")
-		ensureEntrypointRemoved(t, compiler.bundle, "test/q")
-		ensureEntrypointRemoved(t, compiler.bundle, "test/r")
-	})
+			ensureEntrypointRemoved(t, compiler.bundle, "test/p")
+			ensureEntrypointRemoved(t, compiler.bundle, "test/q")
+			ensureEntrypointRemoved(t, compiler.bundle, "test/r")
+		})
+	}
 }
 
 func TestCompilerWasmTargetLazyCompile(t *testing.T) {
@@ -624,25 +850,32 @@ func TestCompilerWasmTargetLazyCompile(t *testing.T) {
 		q = "foo"`,
 	}
 
-	test.WithTempFS(files, func(root string) {
-
-		compiler := New().WithPaths(root).WithTarget("wasm").WithEntrypoints("test/p").WithOptimizationLevel(1).
-			WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("wasm").
+				WithEntrypoints("test/p").
+				WithOptimizationLevel(1).
+				WithCapabilities(wasmABIVersions(ast.WasmABIVersion{Version: 1}))
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if len(compiler.bundle.WasmModules) == 0 {
-			t.Fatal("expected to find compiled wasm module")
-		}
+			if len(compiler.bundle.WasmModules) == 0 {
+				t.Fatal("expected to find compiled wasm module")
+			}
 
-		if _, exists := compiler.compiler.Modules["optimized/test.rego"]; !exists {
-			t.Fatal("expected to find optimized module on compiler")
-		}
+			if _, exists := compiler.compiler.Modules["optimized/test.rego"]; !exists {
+				t.Fatal("expected to find optimized module on compiler")
+			}
 
-		ensureEntrypointRemoved(t, compiler.bundle, "test/p")
-	})
+			ensureEntrypointRemoved(t, compiler.bundle, "test/p")
+		})
+	}
 }
 
 func ensureEntrypointRemoved(t *testing.T, b *bundle.Bundle, e string) {
@@ -660,6 +893,411 @@ func ensureEntrypointRemoved(t *testing.T, b *bundle.Bundle, e string) {
 	}
 }
 
+func TestCompilerPlanTarget(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `package test
+
+		p = 7
+		q = p+1`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("plan").
+				WithEntrypoints("test/p", "test/q")
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(compiler.bundle.PlanModules) == 0 {
+				t.Fatal("expected to find compiled plan module")
+			}
+		})
+	}
+}
+
+func TestCompilerPlanTargetPruneUnused(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `package test
+		p[1]
+		f(x) { p[x] }`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("plan").
+				WithEntrypoints("test").
+				WithPruneUnused(true)
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if len(compiler.bundle.PlanModules) == 0 {
+				t.Fatal("expected to find compiled plan module")
+			}
+
+			plan := compiler.bundle.PlanModules[0].Raw
+			var policy ir.Policy
+
+			if err := json.Unmarshal(plan, &policy); err != nil {
+				t.Fatal(err)
+			}
+			if exp, act := 1, len(policy.Funcs.Funcs); act != exp {
+				t.Fatalf("expected %d funcs, got %d", exp, act)
+			}
+			f := policy.Funcs.Funcs[0]
+			if exp, act := "g0.data.test.p", f.Name; act != exp {
+				t.Fatalf("expected func named %v, got %v", exp, act)
+			}
+		})
+	}
+}
+
+func TestCompilerPlanTargetUnmatchedEntrypoints(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `package test
+
+		p := 7
+		q := p + 1`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("plan").
+				WithEntrypoints("test/p", "test/q", "test/no")
+			err := compiler.Build(context.Background())
+			if err == nil {
+				t.Error("expected error from unmatched entrypoint")
+			}
+			expectError := "entrypoint \"test/no\" does not refer to a rule or policy decision"
+			if err.Error() != expectError {
+				t.Errorf("expected error %s, got: %s", expectError, err.Error())
+			}
+		})
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithTarget("plan").
+				WithEntrypoints("foo", "foo.bar", "test/no")
+			err := compiler.Build(context.Background())
+			if err == nil {
+				t.Error("expected error from unmatched entrypoints")
+			}
+			expectError := "entrypoint \"foo\" does not refer to a rule or policy decision"
+			if err.Error() != expectError {
+				t.Errorf("expected error %s, got: %s", expectError, err.Error())
+			}
+		})
+	}
+}
+
+func TestCompilerRegoEntrypointAnnotations(t *testing.T) {
+	tests := []struct {
+		note            string
+		entrypoints     []string
+		modules         map[string]string
+		data            string
+		roots           []string
+		wantEntrypoints map[string]struct{}
+	}{
+		{
+			note:        "rule annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+p {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/p": {},
+			},
+		},
+		{
+			note:        "package annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+# METADATA
+# entrypoint: true
+package test
+
+p {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test": {},
+			},
+		},
+		{
+			note:        "nested rule annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+import data.test.nested
+
+p {
+	q[input.x]
+	nested.p
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+				"test/nested.rego": `
+package test.nested
+
+# METADATA
+# entrypoint: true
+p {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/nested/p": {},
+			},
+		},
+		{
+			note:        "nested package annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+import data.test.nested
+
+p {
+	q[input.x]
+	nested.p
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+				"test/nested.rego": `
+# METADATA
+# entrypoint: true
+package test.nested
+
+p {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/nested": {},
+			},
+		},
+		{
+			note:        "mixed manual entrypoints + annotation entrypoints",
+			entrypoints: []string{"test/p"},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+import data.test.nested
+
+p {
+	q[input.x]
+	nested.p
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+				"test/nested.rego": `
+# METADATA
+# entrypoint: true
+package test.nested
+
+p {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/nested": {},
+				"test/p":      {},
+			},
+		},
+		{
+			note:        "ref head rule annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+a.b.c.p {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/a/b/c/p": {},
+			},
+		},
+		{
+			note:        "mixed ref head rule/package annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+# METADATA
+# entrypoint: true
+package test.a.b.c
+
+# METADATA
+# entrypoint: true
+d.e.f.g {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/a/b/c":         {},
+				"test/a/b/c/d/e/f/g": {},
+			},
+		},
+		{
+			note:        "numbers in refs annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+a.b[1.0] {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/a/b/1.0": {},
+			},
+		},
+		{
+			note:        "string path with brackets annotation",
+			entrypoints: []string{},
+			modules: map[string]string{
+				"test.rego": `
+package test
+
+# METADATA
+# entrypoint: true
+a.b["1.0.0"].foo {
+	q[input.x]
+}
+
+q[1]
+q[2]
+q[3]
+				`,
+			},
+			wantEntrypoints: map[string]struct{}{
+				"test/a/b/1.0.0/foo": {},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			for _, useMemoryFS := range []bool{false, true} {
+				test.WithTestFS(tc.modules, useMemoryFS, func(root string, fsys fs.FS) {
+					compiler := New().
+						WithFS(fsys).
+						WithPaths(root).
+						WithTarget("plan").
+						WithEntrypoints(tc.entrypoints...).
+						WithRegoAnnotationEntrypoints(true).
+						WithPruneUnused(true)
+					err := compiler.Build(context.Background())
+					if err != nil {
+						t.Fatal(err)
+					}
+
+					// Ensure we have the right number of entrypoints.
+					if len(compiler.entrypoints) != len(tc.wantEntrypoints) {
+						t.Fatalf("Wrong number of entrypoints. Expected %v, got %v.", tc.wantEntrypoints, compiler.entrypoints)
+					}
+
+					// Ensure those entrypoints match the ones we expect.
+					for _, entrypoint := range compiler.entrypoints {
+						if _, found := tc.wantEntrypoints[entrypoint]; !found {
+							t.Fatalf("Unexpected entrypoint '%s'", entrypoint)
+						}
+					}
+				})
+			}
+		})
+	}
+}
+
 func TestCompilerSetRevision(t *testing.T) {
 	files := map[string]string{
 		"test.rego": `package test
@@ -667,18 +1305,51 @@ func TestCompilerSetRevision(t *testing.T) {
 		p = true`,
 	}
 
-	test.WithTempFS(files, func(root string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		compiler := New().WithPaths(root).WithRevision("deadbeef")
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithRevision("deadbeef")
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if compiler.bundle.Manifest.Revision != "deadbeef" {
-			t.Fatal("expected revision to be set but got:", compiler.bundle.Manifest)
-		}
-	})
+			if compiler.bundle.Manifest.Revision != "deadbeef" {
+				t.Fatal("expected revision to be set but got:", compiler.bundle.Manifest)
+			}
+		})
+	}
+}
+
+func TestCompilerSetMetadata(t *testing.T) {
+	files := map[string]string{
+		"test.rego": `package test
+
+		p = true`,
+	}
+
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
+
+			metadata := map[string]interface{}{"OPA version": "0.36.1"}
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithMetadata(&metadata)
+
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if compiler.bundle.Manifest.Metadata["OPA version"] != "0.36.1" {
+				t.Fatal("expected metadata to be set but got:", compiler.bundle.Manifest)
+			}
+		})
+	}
 }
 
 func TestCompilerOutput(t *testing.T) {
@@ -689,45 +1360,51 @@ func TestCompilerOutput(t *testing.T) {
 		p { input.x = data.foo }`))),
 		"data.json": `{"foo": 1}`,
 	}
-	test.WithTempFS(files, func(root string) {
 
-		buf := bytes.NewBuffer(nil)
-		compiler := New().WithPaths(root).WithOutput(buf)
-		err := compiler.Build(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+	for _, useMemoryFS := range []bool{false, true} {
+		test.WithTestFS(files, useMemoryFS, func(root string, fsys fs.FS) {
 
-		// Check that the written bundle is expected.
-		result, err := bundle.NewReader(buf).Read()
-		if err != nil {
-			t.Fatal(err)
-		}
+			buf := bytes.NewBuffer(nil)
+			compiler := New().
+				WithFS(fsys).
+				WithPaths(root).
+				WithOutput(buf)
+			err := compiler.Build(context.Background())
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		exp, err := loader.NewFileLoader().AsBundle(root)
-		if err != nil {
-			t.Fatal(err)
-		}
+			// Check that the written bundle is expected.
+			result, err := bundle.NewReader(buf).Read()
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if !exp.Equal(result) {
-			t.Fatalf("expected:\n\n%+v\n\ngot:\n\n%+v", *exp, result)
-		}
+			exp, err := loader.NewFileLoader().WithFS(fsys).AsBundle(root)
+			if err != nil {
+				t.Fatal(err)
+			}
 
-		if !exp.Manifest.Equal(result.Manifest) {
-			t.Fatalf("expected:\n\n%+v\n\ngot:\n\n%+v", exp.Manifest, result.Manifest)
-		}
+			if !exp.Equal(result) {
+				t.Fatalf("expected-1:\n\n%+v\n\ngot-1:\n\n%+v", *exp, result)
+			}
+
+			if !exp.Manifest.Equal(result.Manifest) {
+				t.Fatalf("expected-2:\n\n%+v\n\ngot-2:\n\n%+v", exp.Manifest, result.Manifest)
+			}
 
-		// Check that the returned bundle is the expected.
-		compiled := compiler.Bundle()
+			// Check that the returned bundle is the expected.
+			compiled := compiler.Bundle()
 
-		if !exp.Equal(*compiled) {
-			t.Fatalf("expected:\n\n%v\n\ngot:\n\n%v", *exp, *compiled)
-		}
+			if !exp.Equal(*compiled) {
+				t.Fatalf("expected-3:\n\n%v\n\ngot-3:\n\n%v", *exp, *compiled)
+			}
 
-		if !exp.Manifest.Equal(compiled.Manifest) {
-			t.Fatalf("expected:\n\n%v\n\ngot:\n\n%v", exp.Manifest, compiled.Manifest)
-		}
-	})
+			if !exp.Manifest.Equal(compiled.Manifest) {
+				t.Fatalf("expected-4:\n\n%v\n\ngot-4:\n\n%v", exp.Manifest, compiled.Manifest)
+			}
+		})
+	}
 }
 
 func TestOptimizerNoops(t *testing.T) {
@@ -785,7 +1462,7 @@ func TestOptimizerErrors(t *testing.T) {
 					p { data.test.p }
 				`,
 			},
-			wantErr: fmt.Errorf("1 error occurred: test.rego:3: rego_recursion_error: rule p is recursive: p -> p"),
+			wantErr: fmt.Errorf("1 error occurred: test.rego:3: rego_recursion_error: rule data.test.p is recursive: data.test.p -> data.test.p"),
 		},
 		{
 			note:        "partial eval error",
@@ -889,9 +1566,39 @@ func TestOptimizerOutput(t *testing.T) {
 				`,
 			},
 		},
+		{
+			note:        "support rules, ref heads",
+			entrypoints: []string{"data.test.p.q.r"},
+			modules: map[string]string{
+				"test.rego": `
+					package test
+
+					default p.q.r = false
+					p.q.r { q[input.x] }
+
+					q[1]
+					q[2]`,
+			},
+			wantModules: map[string]string{
+				"optimized/test/p/q.rego": `
+					package test.p.q
+
+					default r = false
+					r = true { 1 = input.x }
+					r = true { 2 = input.x }
+
+				`,
+				"test.rego": `
+					package test
+
+					q[1]
+					q[2]
+				`,
+			},
+		},
 		{
 			note:        "multiple entrypoints",
-			entrypoints: []string{"data.test.p", "data.test.r"},
+			entrypoints: []string{"data.test.p", "data.test.r", "data.test.s"},
 			modules: map[string]string{
 				"test.rego": `
 					package test
@@ -904,6 +1611,10 @@ func TestOptimizerOutput(t *testing.T) {
 						q[input.x]
 					}
 
+					s {
+						q[input.x]
+					}
+
 					q[1]
 				`,
 			},
@@ -918,6 +1629,11 @@ func TestOptimizerOutput(t *testing.T) {
 
 					r = __result__ { 1 = input.x; __result__ = true }
 				`,
+				"optimized/test.2.rego": `
+					package test
+
+					s = __result__ { 1 = input.x; __result__ = true }
+				`,
 				"test.rego": `
 					package test
 
@@ -1333,14 +2049,13 @@ func getOptimizer(modules map[string]string, data string, entries []string, root
 
 func getModuleFiles(src map[string]string, includeRaw bool) []bundle.ModuleFile {
 
-	var keys []string
-
+	keys := make([]string, 0, len(src))
 	for k := range src {
 		keys = append(keys, k)
 	}
 
 	sort.Strings(keys)
-	var modules []bundle.ModuleFile
+	modules := make([]bundle.ModuleFile, 0, len(keys))
 
 	for _, k := range keys {
 		module, err := ast.ParseModule(k, src[k])
diff --git a/config/config.go b/config/config.go
index 9956019622..51931e440f 100644
--- a/config/config.go
+++ b/config/config.go
@@ -32,7 +32,15 @@ type Config struct {
 	DefaultDecision              *string                    `json:"default_decision,omitempty"`
 	DefaultAuthorizationDecision *string                    `json:"default_authorization_decision,omitempty"`
 	Caching                      json.RawMessage            `json:"caching,omitempty"`
+	NDBuiltinCache               bool                       `json:"nd_builtin_cache,omitempty"`
 	PersistenceDirectory         *string                    `json:"persistence_directory,omitempty"`
+	DistributedTracing           json.RawMessage            `json:"distributed_tracing,omitempty"`
+	Server                       *struct {
+		Encoding json.RawMessage `json:"encoding,omitempty"`
+	} `json:"server,omitempty"`
+	Storage *struct {
+		Disk json.RawMessage `json:"disk,omitempty"`
+	} `json:"storage,omitempty"`
 }
 
 // ParseConfig returns a valid Config object with defaults injected. The id
@@ -83,6 +91,11 @@ func (c Config) DefaultAuthorizationDecisionRef() ast.Ref {
 	return r
 }
 
+// NDBuiltinCacheEnabled returns if the ND builtins cache should be used.
+func (c Config) NDBuiltinCacheEnabled() bool {
+	return c.NDBuiltinCache
+}
+
 func (c *Config) validateAndInjectDefaults(id string) error {
 
 	if c.DefaultDecision == nil {
diff --git a/config/config_test.go b/config/config_test.go
index f743cdba4d..43a508ff10 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -196,6 +196,14 @@ func TestActiveConfig(t *testing.T) {
 		"plugins": {
 			"some-plugin": {}
 		},
+		"server": {
+			"encoding": {
+				"gzip": {
+					"min_length": 1024,
+					"compression_level": 1
+				}
+			}
+		},
 		"discovery": {"name": "config"}`
 
 	serviceObj := `"services": {
@@ -249,6 +257,14 @@ func TestActiveConfig(t *testing.T) {
 		"plugins": {
 			"some-plugin": {}
 		},
+		"server": {
+			"encoding": {
+				"gzip": {
+					"min_length": 1024,
+					"compression_level": 1
+				}
+			}
+		},
 		"default_authorization_decision": "/system/authz/allow",
 		"default_decision": "/system/main",
 		"discovery": {"name": "config"}`, version.Version)
diff --git a/cover/cover.go b/cover/cover.go
index 27a98afb4d..3dad258943 100644
--- a/cover/cover.go
+++ b/cover/cover.go
@@ -86,14 +86,18 @@ func (c *Cover) Report(modules map[string]*ast.Module) (report Report) {
 
 	for _, fr := range report.Files {
 		fr.Coverage = fr.computeCoveragePercentage()
-		coveredLoc += fr.locCovered()
-		notCoveredLoc += fr.locNotCovered()
+		fr.CoveredLines = fr.locCovered()
+		fr.NotCoveredLines = fr.locNotCovered()
+		coveredLoc += fr.CoveredLines
+		notCoveredLoc += fr.NotCoveredLines
 	}
 	totalLoc := coveredLoc + notCoveredLoc
 
 	if totalLoc != 0 {
 		overallCoverage = 100.0 * float64(coveredLoc) / float64(totalLoc)
 	}
+	report.CoveredLines = coveredLoc
+	report.NotCoveredLines = notCoveredLoc
 	report.Coverage = round(overallCoverage, 2)
 
 	return
@@ -158,9 +162,11 @@ func (r Range) In(row int) bool {
 
 // FileReport represents a coverage report for a single file.
 type FileReport struct {
-	Covered    []Range `json:"covered,omitempty"`
-	NotCovered []Range `json:"not_covered,omitempty"`
-	Coverage   float64 `json:"coverage,omitempty"`
+	Covered         []Range `json:"covered,omitempty"`
+	NotCovered      []Range `json:"not_covered,omitempty"`
+	CoveredLines    int     `json:"covered_lines,omitempty"`
+	NotCoveredLines int     `json:"not_covered_lines,omitempty"`
+	Coverage        float64 `json:"coverage,omitempty"`
 }
 
 // IsCovered returns true if the row is marked as covered in the report.
@@ -222,8 +228,10 @@ func (fr *FileReport) computeCoveragePercentage() float64 {
 
 // Report represents a coverage report for a set of files.
 type Report struct {
-	Files    map[string]*FileReport `json:"files"`
-	Coverage float64                `json:"coverage"`
+	Files           map[string]*FileReport `json:"files"`
+	CoveredLines    int                    `json:"covered_lines"`
+	NotCoveredLines int                    `json:"not_covered_lines"`
+	Coverage        float64                `json:"coverage"`
 }
 
 // IsCovered returns true if the row in the given file is covered.
@@ -232,7 +240,7 @@ func (r Report) IsCovered(file string, row int) bool {
 }
 
 // CoverageThresholdError represents an error raised when the global
-// code coverage percenta is lower than the specified threshold.
+// code coverage percentage is lower than the specified threshold.
 type CoverageThresholdError struct {
 	Coverage  float64
 	Threshold float64
@@ -252,9 +260,11 @@ func sortedPositionSliceToRangeSlice(sorted []Position) (result []Range) {
 	start, end := sorted[0], sorted[0]
 	for i := 1; i < len(sorted); i++ {
 		curr := sorted[i]
-		if curr.Row == end.Row+1 {
+		switch {
+		case curr.Row == end.Row: // skip
+		case curr.Row == end.Row+1:
 			end = curr
-		} else {
+		default:
 			result = append(result, Range{start, end})
 			start, end = curr, curr
 		}
diff --git a/cover/cover_test.go b/cover/cover_test.go
index a30e337df8..8fb00b628d 100644
--- a/cover/cover_test.go
+++ b/cover/cover_test.go
@@ -139,6 +139,99 @@ p {
 	}
 }
 
+func TestCoverNoDuplicates(t *testing.T) {
+
+	cover := New()
+
+	module := `package test
+
+# Both a rule and an expression, but should not be counted twice
+foo := 1
+
+allow { true }
+`
+
+	parsedModule, err := ast.ParseModule("test.rego", module)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	eval := rego.New(
+		rego.Module("test.rego", module),
+		rego.Query("data.test.allow"),
+		rego.QueryTracer(cover),
+	)
+
+	ctx := context.Background()
+	_, err = eval.Eval(ctx)
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	report := cover.Report(map[string]*ast.Module{
+		"test.rego": parsedModule,
+	})
+
+	fr, ok := report.Files["test.rego"]
+	if !ok {
+		t.Fatal("Expected file report for test.rego")
+	}
+
+	expectedCovered := []Position{
+		{6}, // allow
+	}
+
+	expectedNotCovered := []Position{
+		{4}, // foo
+	}
+
+	for _, exp := range expectedCovered {
+		if !fr.IsCovered(exp.Row) {
+			t.Errorf("Expected %v to be covered", exp)
+		}
+	}
+
+	for _, exp := range expectedNotCovered {
+		if !fr.IsNotCovered(exp.Row) {
+			t.Errorf("Expected %v to NOT be covered", exp)
+		}
+	}
+
+	if len(expectedCovered) != fr.locCovered() {
+		t.Errorf(
+			"Expected %d loc to be covered, got %d instead",
+			len(expectedCovered),
+			fr.locCovered())
+	}
+
+	if len(expectedNotCovered) != fr.locNotCovered() {
+		t.Errorf(
+			"Expected %d loc to not be covered, got %d instead",
+			len(expectedNotCovered),
+			fr.locNotCovered())
+	}
+
+	expectedCoveragePercentage := round(100.0*float64(len(expectedCovered))/float64(len(expectedCovered)+len(expectedNotCovered)), 2)
+	if expectedCoveragePercentage != fr.Coverage {
+		t.Errorf("Expected coverage %f != %f", expectedCoveragePercentage, fr.Coverage)
+	}
+
+	if expectedCoveragePercentage != report.Coverage {
+		t.Errorf("Expected report coverage %f != %f",
+			expectedCoveragePercentage,
+			report.Coverage)
+	}
+
+	if t.Failed() {
+		bs, err := json.MarshalIndent(fr, "", "  ")
+		if err != nil {
+			t.Fatal(err)
+		}
+		fmt.Println(string(bs))
+	}
+}
+
 func TestCoverTraceConfig(t *testing.T) {
 	ct := topdown.QueryTracer(New())
 	conf := ct.Config()
diff --git a/dependencies/deps.go b/dependencies/deps.go
index 5cd0123bd2..b7cc4ef0c8 100644
--- a/dependencies/deps.go
+++ b/dependencies/deps.go
@@ -200,9 +200,9 @@ func filter(rs []ast.Ref, pred func(ast.Ref, ast.Ref) bool) (filtered []ast.Ref)
 // complicated. It should be possible to compute all dependencies in two
 // passes:
 //
-// 1) perform syntactic unification on vars
-// 2) gather all refs rooted at data after plugging the head with substitution
-//    from (1)
+//  1. perform syntactic unification on vars
+//  2. gather all refs rooted at data after plugging the head with substitution
+//     from (1)
 func ruleDeps(rule *ast.Rule) (resolved []ast.Ref) {
 	vars, others := extractEq(rule.Body)
 	joined := joinVarRefs(vars)
diff --git a/dependencies/deps_test.go b/dependencies/deps_test.go
index 26c77f15ed..b6e93aad7b 100644
--- a/dependencies/deps_test.go
+++ b/dependencies/deps_test.go
@@ -511,7 +511,6 @@ func assertRefSliceEq(t *testing.T, exp, result []ast.Ref) {
 		r := result[i]
 		if e.Compare(r) != 0 {
 			t.Fatalf("Expected refs %v, got %v", exp, result)
-			break
 		}
 	}
 }
diff --git a/docs/Makefile b/docs/Makefile
index b530ebf2bf..5deb333416 100644
--- a/docs/Makefile
+++ b/docs/Makefile
@@ -8,15 +8,29 @@ DEPLOY_PRIME_URL ?= "http://localhost:8888"
 
 .PHONY: clean
 clean:
-	rm -rf ${CURDIR}/website/data/releases.yaml
+	rm -f $(CURDIR)/website/data/releases.yaml
+	rm -f $(CURDIR)/website/data/builtin_metadata.json
 	rm -rf $(CURDIR)/website/generated
 	rm -rf $(CURDIR)/website/public
 	rm -rf $(CURDIR)/website/resources
+	rm -rf $(CURDIR)/website/scripts/live-blocks/opa_versions/latest-*
+
+.PHONY: generate-cli-docs
+generate-cli-docs:
+	$(CURDIR)/../build/gen-cli-docs.sh "$(CURDIR)/content"
 
 .PHONY: generate
-generate:
+generate: generate-cli-docs copy-builtin-metadata
 	$(CURDIR)/website/scripts/load-docs.sh
 
+.PHONY: copy-builtin-metadata
+copy-builtin-metadata:
+	cp -v $(CURDIR)/../builtin_metadata.json $(CURDIR)/website/data/builtin_metadata.json
+
+.PHONY: dev-generate
+dev-generate: generate-cli-docs copy-builtin-metadata
+	DEV=true $(CURDIR)/website/scripts/load-docs.sh
+
 # The website has some npm dependencies saved in ./website/node_modules
 # As well as dependencies required for the "live-blocks".
 # Use this target to update them as needed.
@@ -26,12 +40,13 @@ install-deps: live-blocks-install-deps
 
 # The live-blocks-% pattern target will shim to the
 # npm scripts in ./website/scripts/live-blocks
+# NOTE(sr): we'll avoid an API call if we make use of releases.yaml to determine the latest release
 .PHONY: live-blocks-%
 live-blocks-%:
-	cd $(CURDIR)/website/scripts/live-blocks && npm run $*
+	cd $(CURDIR)/website/scripts/live-blocks && LATEST=$(shell sed -n '2s/- //p' $(CURDIR)/website/data/releases.yaml) npm run $*
 
 .PHONY: serve-local
-serve-local: production-build
+serve-local: dev-build
 	# must be run from root of repo for
 	# the netlify.toml config to work
 	cd $(CURDIR)/.. && netlify dev --offline --dir $(CURDIR)/website/public
@@ -42,6 +57,9 @@ serve-remote: production-build
 	# the netlify.toml config to work
 	cd $(CURDIR)/.. && netlify deploy
 
+.PHONY: dev-build
+dev-build: clean dev-generate copy-builtin-metadata hugo-production-build live-blocks-inject
+
 ######################################################
 #
 # CI targets
@@ -57,7 +75,8 @@ hugo-production-build:
 		--minify
 
 .PHONY: production-build
-production-build: clean generate hugo-production-build live-blocks-inject
+production-build: clean generate hugo-production-build
+	make live-blocks-inject
 
 .PHONY: preview-build
 preview-build:
diff --git a/docs/README.md b/docs/README.md
index 7277c79b03..a192915ce9 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,16 +1,16 @@
 # The OPA Website and Documentation
+
 The content and tooling is separated into a few places:
 
 [devel/](./devel/) - Developer documentation for OPA (not part of the website)
 
-
 [website/](./website/) - This directory contains all of the Markdown, HTML, Sass/CSS,
 and other assets needed to build the [openpolicyagent.org](https://openpolicyagent.org)
 website. See the section below for steps to build the site and test documentation changes
 locally. This content is not versioned for each release, it is common scaffolding for
 the website.
 
-[content/](./content/) - The raw OPA documentation can be found under the 
+[content/](./content/) - The raw OPA documentation can be found under the
 directory. This content is versioned for each release and should have all images
 and code snippets alongside the markdown content files.
 
@@ -44,12 +44,13 @@ changes in this directory are pushed to `master`, the site will be re-built and
 re-deployed.
 
 ## How to Edit and Test
+
 ### Preview Markdown `content` (*.md)
 
 The majority of this can be done with any markdown renderer (typically built into or
 via a plug-in for IDEs and editors). The rendered output will be very similar to what Hugo will
 generate.
- 
+
 > This excludes the Hugo shortcodes (places with `{{< SHORT_CODE >}}` in the markdown.
   To see the output of these you'll need to involve Hugo. Additionally, to validate
   and view live code blocks, a full site preview is required.
@@ -80,6 +81,14 @@ using the non-extended version:
 error: failed to transform resource: TOCSS: failed to transform "sass/style.sass" (text/x-sass): this feature is not available in your current Hugo version
 ```
 
+Please also note that the current version of Hugo (e.g. installed with `brew install hugo`) is
+not compatible with the docs. If you get errors like this, it means that you're using the
+wrong version:
+
+```
+ERROR ... execute of template failed: template: partials/docs/sidenav.html:11:18: executing "partials/docs/sidenav.html" at <.URL>: can't evaluate field URL in type *hugolib.pageState
+```
+
 #### Remote Preview on Netlify
 
 This option provides the best preview of the site content, using the exact same infrastructure as the production website.
@@ -94,10 +103,9 @@ This option provides the best preview of the site content, using the exact same
 1) Deploy the site on Netlify using local content via the `make docs-serve-remote`. Follow any prompts the `netlify`
    tool asks. If you have not already linked the site select `Create & configure a new site` and specify your personal
    user account (which should have been configured in the previous step).
-   
-1) Netlify will then upload the built content and serve it via their CDN. A URL to the preview will be given in the
-   CLI console output.
 
+1) Netlify will then upload the built content and serve it via their CDN. A URL to the preview will be given in the
+   CLI console output. Be sure to select the `edge` version within the Documentation pages to see your reflected changes in the remote site.
 
 #### Local Preview via `netlify dev`
 
@@ -113,7 +121,6 @@ than deploying remotely as the content does not need to be uploaded to the Netli
 > with the redirects not working as expected locally, but working correctly on the "live" site in production.
 > When in doubt use the "remote" Netlify preview to verify behavior.
 
-
 ## Checking links
 
 To check the site's links, first start the full site preview locally (see [Serving the full site](#serving-the-full-site) instructions))
@@ -282,56 +289,58 @@ another group's module when evaluating (e.g. so that they can be imported).
 
 # Integration Index
 
-The integration index makes it easy to find either a specific integration with OPA 
-or to browse the integrations with OPA within a particular category.  And it pulls 
-information about that integration (e.g. blogs, videos, tutorials, code) into a 
+The integration index makes it easy to find either a specific integration with OPA
+or to browse the integrations with OPA within a particular category.  And it pulls
+information about that integration (e.g. blogs, videos, tutorials, code) into a
 single place while allowing integration authors to maintain the code wherever they like.  
 
 ## Schema
 
 The schema of integrations.yaml has the following highlevel entries, each of which is self-explanatory.
-* integrations
-* organizations
-* software
+- integrations
+- organizations
+- software
 
 Each entry is an object where keys are unique identifiers for each subentry.  
 Organizations and Software are self-explanatory by inspection.  The schema for integrations is as follows.
 
-* title: string
-* description: string
-* software: array of strings
-* labels: collection of key/value pairs.
-* tutorials: array of links
-* code: array of links
-* inventors: array of either
-  * string (organization name)
-  * object with fields
-    * name: string
-    * organization: string
-* videos: array of either
-  * link
-  * object with fields
-    * title: string
-    * speakers: array of name/organization objects
-    * venue: string
-    * link: string
-* blogs: array of links
+- title: string
+- description: string
+- software: array of strings
+- labels: collection of key/value pairs.
+- tutorials: array of links
+- code: array of links
+- inventors: array of either
+  - string (organization name)
+  - object with fields
+    - name: string
+    - organization: string
+- videos: array of either
+  - link
+  - object with fields
+    - title: string
+    - speakers: array of name/organization objects
+    - venue: string
+    - link: string
+- blogs: array of links
 
 The UI for this is currently hosted at [https://openpolicyagent.org/docs/latest/ecosystem/](https://openpolicyagent.org/docs/latest/ecosystem/)
 
 The future plan is to use the following labels to generate categories of integrations.
 
-* layer: which layer of the stack does this belong to
-* category: which kind of component within that layer is this
-* type: what kind of integration this is.  Either `enforcement` or `poweredbyopa`.  `enforcement` is the default 
-  if `type` is missing.  `poweredbyopa` is intended to be integrations built using OPA that are not tied to a 
+- layer: which layer of the stack does this belong to
+- category: which kind of component within that layer is this
+- type: what kind of integration this is.  Either `enforcement` or `poweredbyopa`.  `enforcement` is the default
+  if `type` is missing.  `poweredbyopa` is intended to be integrations built using OPA that are not tied to a
   particular layer of the stack.  This distinction is the most ambiguous and may change.
 
 As of now the labels are only displayed for each entry.
 
 ## Logos
-For each entry in the [integrations.yaml](./website/data/integrations.yaml) integrations section the UI will use a
-PNG logo with the same name as the key from [./website/static/img/logos/integrations](./website/static/img/logos/integrations)
+
+For each entry in the [integrations.yaml](./website/data/integrations.yaml)
+integrations section the UI will use a PNG or SVG logo with the same name as the key from
+[./website/static/img/logos/integrations](./website/static/img/logos/integrations)
 
 For example:
 
@@ -342,5 +351,16 @@ integrations:
 ```
 
 Would need a file called `my-cool-integration.png` at `./website/static/img/logos/integrations/my-cool-integration.png`
+(or `my-cool-integration.svg` in the same location).
 
 If it doesn't exist the OPA logo will be shown by default.
+
+## Google Analytics
+
+With the addition of the feedback button, we are now able to see how many users found a particular page of the docs useful.
+
+To view the metrics you will need access to [Google Analytics](https://analytics.google.com/analytics/web/).
+
+Feedback responses can be found in the right hand tree under Behavior -> Events -> Top Events.
+
+From here you can set the desired time frame you wish to monitor. Then drill down into the helpful category to see the specific pages and how many clicks they received.
diff --git a/docs/content/_index.md b/docs/content/_index.md
index df64a21be8..6cce6e1a7f 100644
--- a/docs/content/_index.md
+++ b/docs/content/_index.md
@@ -11,6 +11,11 @@ code and simple APIs to offload policy decision-making from your software. You
 can use OPA to enforce policies in microservices, Kubernetes, CI/CD pipelines,
 API gateways, and more.
 
+OPA was originally created by [Styra](https://www.styra.com) and is proud to be
+a graduated project in the [Cloud Native Computing Foundation
+(CNCF)](https://www.cncf.io/) landscape. For details read the CNCF
+[announcement](https://www.cncf.io/announcements/2021/02/04/cloud-native-computing-foundation-announces-open-policy-agent-graduation/).
+
 Read this page to learn about the core concepts in OPA's policy language
 ([Rego](policy-language)) as well as how to download, run, and integrate OPA.
 
@@ -103,18 +108,26 @@ Rego (pronounced "ray-go") is purpose-built for expressing policies over complex
 hierarchical data structures. For detailed information on Rego see the [Policy
 Language](policy-language) documentation.
 
-> 💡 The examples below are interactive! If you edit the input data above
+{{< info >}}
+💡 The examples below are interactive! If you edit the input data above
 containing servers, networks, and ports, the output will change below.
 Similarly, if you edit the queries or rules in the examples below the output
 will change. As you read through this section, try changing the input, queries,
 and rules and observe the difference in output.
->
-> 💻 They can also be run locally on your machine using the [`opa eval` command, here are setup instructions.](#running-opa)
+
+💻 They can also be run locally on your machine using the [`opa eval` command, here are setup instructions.](#running-opa)
+
+Note that the examples in this section try to represent the best practices.
+As such, they make use of keywords that are meant to become standard keywords
+at some point in time, but have been introduced gradually.
+[See the docs on _future keywords_](./policy-language/#future-keywords) for more information.
+{{< /info >}}
 
 ### References
 
 ```live:example/refs:module:hidden
 package example
+import future.keywords
 ```
 
 When OPA evaluates policies it binds data provided in the query to a global
@@ -151,6 +164,7 @@ input.deadbeef
 
 ```live:example/exprs:module:hidden
 package example
+import future.keywords
 ```
 
 To produce policy decisions in Rego you write expressions against input and
@@ -209,6 +223,7 @@ input.servers[0].protocols[0] == "telnet"
 
 ```live:example/vars:module:hidden
 package example
+import future.keywords
 ```
 
 You can store values in intermediate variables using the `:=` (assignment)
@@ -260,11 +275,14 @@ x != y  # y has not been assigned a value
 
 ```live:example/iter:module:hidden
 package example
+import future.keywords
 ```
 
-Like other declarative languages (e.g., SQL), Rego does not have an explicit
-loop or iteration construct. Instead, iteration happens implicitly when you
-inject variables into expressions.
+Like other declarative languages (e.g., SQL), iteration in Rego happens
+implicitly when you inject variables into expressions.
+
+There are explicit iteration constructs to express _FOR ALL_ and _FOR SOME_, [see
+below](#for-some-and-for-all).
 
 To understand how iteration works in Rego, imagine you need to check if any
 networks are public. Recall that the networks are supplied inside an array:
@@ -352,29 +370,137 @@ some i; input.servers[i].protocols[i] == "ssh"  # there is no assignment of i th
 ```live:example/iter/undefined:output:expect_undefined
 ```
 
+#### FOR SOME and FOR ALL
+
+While plain iteration serves as a powerful building block, Rego also features ways
+to express _FOR SOME_ and _FOR ALL_ more explicitly.
+
+{{< info >}}
+To ensure backwards-compatibility, the keywords discussed below introduced slowly.
+In the first stage, users can opt-in to using the new keywords via a special import:
+`import future.keywords.every` introduces the `every` keyword described here.
+(Importing `every` means also importing `in` without an extra `import` statement.)
+
+At some point in the future, the keyword will become _standard_, and the import will
+become a no-op that can safely be removed. This should give all users ample time to
+update their policies, so that the new keyword will not cause clashes with existing
+variable names.
+[See the docs on _future keywords_](./policy-language/#future-keywords) for more information.
+{{< /info >}}
+
+##### FOR SOME (`some`)
+
+`some ... in ...` is used to iterate over the collection (its last argument),
+and will bind its variables (key, value position) to the collection items.
+It introduces new bindings to the evaluation of the rest of the rule body.
+
+Using `some`, we can express the rules introduced above in different ways:
+
+```live:example/iter/some1:module:merge_down
+public_network contains net.id if {
+    some net in input.networks # some network exists and..
+    net.public                 # it is public.
+}
+
+shell_accessible contains server.id if {
+    some server in input.servers
+    "telnet" in server.protocols
+}
+
+shell_accessible contains server.id if {
+    some server in input.servers
+    "ssh" in server.protocols
+}
+```
+```live:example/iter/some1:query:merge_down
+shell_accessible
+```
+```live:example/iter/some1:output
+```
+
+For details on `some ... in ...`, see [the documentation of the `in` operator](policy-language/#membership-and-iteration-in).
+
+##### FOR ALL (`every`)
+
+Expanding on the examples above, `every` allows us to succinctly express that
+a condition holds for all elements of a domain.
+
+```live:example/iter/every2:module:merge_down
+no_telnet_exposed if {
+    every server in input.servers {
+        every protocol in server.protocols {
+            "telnet" != protocol
+        }
+    }
+}
+
+no_telnet_exposed_alt if { # alternative: every + not-in
+    every server in input.servers {
+        not "telnet" in server.protocols
+    }
+}
+
+no_telnet_exposed_alt2 if { # alternative: not + rule + some
+    not any_telnet_exposed
+}
+
+any_telnet_exposed if {
+    some server in input.servers
+    "telnet" in server.protocols
+}
+```
+```live:example/iter/every2:input:merge_down
+{
+    "servers": [
+        {
+            "id": "busybox",
+            "protocols": ["http", "ftp"]
+        },
+        {
+            "id": "db",
+            "protocols": ["mysql", "ssh"]
+        },
+        {
+            "id": "web",
+            "protocols": ["https"]
+        }
+    ]
+}
+```
+```live:example/iter/every2:query:merge_down
+no_telnet_exposed
+```
+```live:example/iter/every2:output
+```
+
+For all the details, see [Every Keyword](policy-language/#every-keyword).
+
 ### Rules
 
 Rego lets you encapsulate and re-use logic with rules. Rules are just if-then
 logic statements. Rules can either be "complete" or "partial".
 
+```live:example/complete:module:hidden
+package example.rules
+import future.keywords
+```
+
 #### Complete Rules
 
 Complete rules are if-then statements that assign a single value to a variable.
 For example:
 
 ```live:example/complete/1:module:openable
-package example.rules
-
-any_public_networks = true {  # is true if...
-    net := input.networks[_]  # some network exists and..
-    net.public                # it is public.
+any_public_networks := true if {
+    some net in input.networks # some network exists and..
+    net.public                 # it is public.
 }
 ```
 
-Every rule consists of a _head_ and a _body_. In Rego we say the rule head is
-true _if_ the rule body is true for some set of variable assignments. In the
-example above `any_public_networks = true` is the head and `net :=
-input.networks[_]; net.public` is the body.
+Every rule consists of a _head_ and a _body_. In Rego we say the rule head
+is true _if_ the rule body is true for some set of variable assignments. In
+the example above `any_public_networks := true` is the head and `some net in
+input.networks; net.public` is the body.
 
 You can query for the value generated by rules just like any other value:
 
@@ -399,11 +525,9 @@ data.example.rules.any_public_networks
 If you omit the `= <value>` part of the rule head the value defaults to `true`.
 You could rewrite the example above as follows without changing the meaning:
 
-```live:example/complete_elided:module:read_only,openable
-package example.rules
-
-any_public_networks {
-    net := input.networks[_]
+```live:example/complete/elided:module:read_only,openable
+any_public_networks if {
+    some net in input.networks
     net.public
 }
 ```
@@ -414,7 +538,7 @@ to `true`. Since the rule body is true, the rule head is always true/defined.
 ```live:example/complete_constant:module:openable
 package example.constants
 
-pi = 3.14
+pi := 3.14
 ```
 
 Constants defined like this can be queried just like any other values:
@@ -447,15 +571,18 @@ any_public_networks
 
 #### Partial Rules
 
+```live:example/partial_set:module:hidden
+package example
+import future.keywords
+```
+
 Partial rules are if-then statements that generate a set of values and
 assign that set to a variable. For example:
 
-```live:example/partial_set:module:openable
-package example.rules
-
-public_network[net.id] {      # net.id is in the public_network set if...
-    net := input.networks[_]  # some network exists and...
-    net.public                # it is public.
+```live:example/partial_set/1:module:openable
+public_network contains net.id if {
+    some net in input.networks # some network exists and..
+    net.public                 # it is public.
 }
 ```
 
@@ -463,27 +590,44 @@ In the example above `public_network[net.id]` is the rule head and `net :=
 input.networks[_]; net.public` is the rule body. You can query for the entire
 set of values just like any other value:
 
-```live:example/partial_set/extent:query:merge_down
+```live:example/partial_set/1/extent:query:merge_down
 public_network
 ```
-```live:example/partial_set/extent:output
+```live:example/partial_set/1/extent:output
+```
+
+Iteration over the set of values can be done with the `some ... in ...` expression:
+
+```live:example/partial_set/1/iteration_some:query:merge_down
+some net in public_network
+```
+```live:example/partial_set/1/iteration_some:output
+```
+
+With a literal, or a bound variable, you can check if the value exists in the set
+via `... in ...`:
+
+```live:example/partial_set/1/exists_in:query:merge_down
+"net3" in public_network
+```
+```live:example/partial_set/1/exists_in:output
 ```
 
-You can iterate over the set of values by referencing the set elements with a
+You can also iterate over the set of values by referencing the set elements with a
 variable:
 
-```live:example/partial_set/iteration:query:merge_down
+```live:example/partial_set/1/iteration:query:merge_down
 some n; public_network[n]
 ```
-```live:example/partial_set/iteration:output
+```live:example/partial_set/1/iteration:output
 ```
 
 Lastly, you can check if a value exists in the set using the same syntax:
 
-```live:example/partial_set/exists:query:merge_down
+```live:example/partial_set/1/exists:query:merge_down
 public_network["net3"]
 ```
-```live:example/partial_set/exists:output
+```live:example/partial_set/1/exists:output
 ```
 
 In addition to partially defining sets, You can also partially define key/value
@@ -505,13 +649,13 @@ protocols:
 ```live:example/logical_or/complete:module:openable,merge_down
 package example.logical_or
 
-default shell_accessible = false
+default shell_accessible := false
 
-shell_accessible = true {
+shell_accessible := true {
     input.servers[_].protocols[_] == "telnet"
 }
 
-shell_accessible = true {
+shell_accessible := true {
     input.servers[_].protocols[_] == "ssh"
 }
 ```
@@ -581,7 +725,6 @@ shell_accessible
 ```
 
 <!---TBD: explain conflicts --->
-
 ### Putting It Together
 
 The sections above explain the core concepts in Rego. To put it all together
@@ -600,28 +743,32 @@ For example:
 
 ```live:example/final:module:openable,merge_down
 package example
+import future.keywords.every # "every" implies "in"
 
-allow = true {                                      # allow is true if...
+allow := true {                                     # allow is true if...
     count(violation) == 0                           # there are zero violations.
 }
 
 violation[server.id] {                              # a server is in the violation set if...
-    some server
-    public_server[server]                           # it exists in the 'public_server' set and...
-    server.protocols[_] == "http"                   # it contains the insecure "http" protocol.
+    some server in public_servers                   # it exists in the 'public_servers' set and...
+    "http" in server.protocols                      # it contains the insecure "http" protocol.
 }
 
 violation[server.id] {                              # a server is in the violation set if...
-    server := input.servers[_]                      # it exists in the input.servers collection and...
-    server.protocols[_] == "telnet"                 # it contains the "telnet" protocol.
+    some server in input.servers                    # it exists in the input.servers collection and...
+    "telnet" in server.protocols                    # it contains the "telnet" protocol.
 }
 
-public_server[server] {                             # a server exists in the public_server set if...
-    some i, j
-    server := input.servers[_]                      # it exists in the input.servers collection and...
-    server.ports[_] == input.ports[i].id            # it references a port in the input.ports collection and...
-    input.ports[i].network == input.networks[j].id  # the port references a network in the input.networks collection and...
-    input.networks[j].public                        # the network is public.
+public_servers[server] {                            # a server exists in the public_servers set if...
+    some server in input.servers                    # it exists in the input.servers collection and...
+
+    some port in server.ports                       # it references a port in the input.ports collection and...
+    some input_port in input.ports
+    port == input_port.id
+
+    some input_network in input.networks            # the port references a network in the input.networks collection and...
+    input_port.network == input_network.id
+    input_network.public                            # the network is public.
 }
 ```
 ```live:example/final:query:merge_down
@@ -651,9 +798,12 @@ On Linux (64-bit):
 curl -L -o opa https://openpolicyagent.org/downloads/{{< current_version >}}/opa_linux_amd64_static
 ```
 
-> Windows users can obtain the OPA executable from [here](https://openpolicyagent.org/downloads/{{< current_version >}}/opa_windows_amd64.exe).
-> The steps below
-> are the same for Windows users except the executable name will be different.
+{{< info >}}
+Windows users can obtain the OPA executable from [here](https://openpolicyagent.org/downloads/{{< current_version >}}/opa_windows_amd64.exe).
+The steps below are the same for Windows users except the executable name will be different.  
+Windows executable file name is opa_windows_amd64.exe, which inclues file extension name 'exe'. The checksums file name is opa_windows_amd64.exe.sha256.  
+Windows users can obtain the checksums from [here](https://openpolicyagent.org/downloads/{{< current_version >}}/opa_windows_amd64.exe.sha256).
+{{< /info >}}
 
 Set permissions on the OPA executable:
 
@@ -661,12 +811,16 @@ Set permissions on the OPA executable:
 chmod 755 ./opa
 ```
 
-> You can also download and run OPA via Docker. The latest stable image tag is
-> `openpolicyagent/opa:{{< current_docker_version >}}`.
+{{< info >}}
+You can also download and run OPA via Docker. The latest stable image tag is
+`openpolicyagent/opa:latest`.
+{{< /info >}}
 
 #### Checksums
-Checksums for all binaries are available in the download path by appending `.sha256` to the binary filename. 
+
+Checksums for all binaries are available in the download path by appending `.sha256` to the binary filename.
 Verify the macOS binary checksum:
+
 ```shell
 curl -L -o opa_darwin_amd64 https://openpolicyagent.org/downloads/{{< current_version >}}/opa_darwin_amd64
 curl -L -o opa_darwin_amd64.sha256 https://openpolicyagent.org/downloads/{{< current_version >}}/opa_darwin_amd64.sha256
@@ -675,14 +829,14 @@ shasum -c opa_darwin_amd64.sha256
 
 ### 2. Try `opa eval`
 
-The simplest way to interact with OPA is via the command-line using the `opa
-eval` sub-command. `opa eval` is a swiss-army knife that you can use to evaluate
-arbitrary Rego expressions and policies. `opa eval` supports a large number of
-options for controlling evaluation. Commonly used flags include:
+The simplest way to interact with OPA is via the command-line using the [`opa eval` sub-command](cli/#opa-eval).
+It is a swiss-army knife that you can use to evaluate arbitrary Rego expressions and policies.
+`opa eval` supports a large number of options for controlling evaluation.
+Commonly used flags include:
 
 | Flag | Short | Description |
 | --- | --- | --- |
-| `--bundle` | `-b`| Load a bundle file or directory into OPA. This flag can be repeated. |
+| `--bundle` | `-b`| Load a [bundle file](management-bundles/#bundle-file-format) or directory into OPA. This flag can be repeated. |
 | `--data` | `-d` | Load policy or data files into OPA. This flag can be repeated. |
 | `--input` | `-i` | Load a data file and use it as `input`. This flag cannot be repeated. |
 | `--format` | `-f` | Set the output format to use. The default is `json` and is intended for programmatic use. The `pretty` format emits more human-readable output. |
@@ -721,9 +875,9 @@ For example:
 ```live:example/using_opa:module:openable,read_only
 package example
 
-default allow = false                               # unless otherwise defined, allow is false
+default allow := false                              # unless otherwise defined, allow is false
 
-allow = true {                                      # allow is true if...
+allow := true {                                     # allow is true if...
     count(violation) == 0                           # there are zero violations.
 }
 
@@ -761,8 +915,9 @@ echo $?
 
 ### 3. Try `opa run` (interactive)
 
-OPA includes an interactive shell or REPL (Read-Eval-Print-Loop). You can use
-the REPL to experiment with policies and prototype new ones.
+OPA includes an interactive shell or REPL (Read-Eval-Print-Loop) accessible via
+the [`opa run` sub-command](cli/#opa-run).
+You can use the REPL to experiment with policies and prototype new ones.
 
 To start the REPL just:
 
@@ -838,10 +993,12 @@ opa run example.rego repl.input:input.json
 > data.example.public_server[s]
 ```
 
-> 💡 Prefixing file paths with a reference controls where file is loaded under
-> `data`. By convention, the REPL sets the `input` document that queries see by
-> reading `data.repl.input` each time a statement is evaluated. See `help input`
-> for details in the REPL.
+{{< info >}}
+Prefixing file paths with a reference controls where file is loaded under
+`data`. By convention, the REPL sets the `input` document that queries see by
+reading `data.repl.input` each time a statement is evaluated. See `help input`
+for details in the REPL.
+{{< /info >}}
 
 Quit out of the REPL by pressing Control-D or typing `exit`:
 
diff --git a/docs/content/aws-cloudformation-hooks.md b/docs/content/aws-cloudformation-hooks.md
new file mode 100644
index 0000000000..fbe8051128
--- /dev/null
+++ b/docs/content/aws-cloudformation-hooks.md
@@ -0,0 +1,506 @@
+---
+title: AWS CloudFormation Hooks
+kind: tutorial
+weight: 1
+---
+
+[AWS CloudFormation Hooks](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/hooks.html) allows users to
+verify AWS infrastructure components defined in AWS CloudFormation
+[templates](https://aws.amazon.com/cloudformation/resources/templates/), like S3 Buckets or EC2 instances, prior to
+deployment. This is done via **hooks**. Hooks are composed of custom code running in an AWS Lambda function, which is
+invoked before a resource is created, updated or deleted.
+
+AWS currently supports hooks written in either Java or Python, and provides a
+[sample repository](https://github.com/aws-cloudformation/aws-cloudformation-samples), which includes example hooks
+written in both languages. Since we'd rather use OPA for this purpose, we'd need some code to process the requests
+handled by the hook and send them forward to OPA for policy decisions via its
+[REST API](https://www.openpolicyagent.org/docs/latest/rest-api/) using
+the [OPA AWS CloudFormation Hook](https://github.com/StyraInc/opa-aws-cloudformation-hook).
+
+## Goals
+
+This tutorial shows how to deploy an AWS CloudFormation Hook that forwards requests to OPA for policy decisions,
+allowing us to use policy to determine whether a request to create, update or delete a resource should be
+allowed or denied. We'll learn how to author policies that take the input structure of CloudFormation Templates into
+account, and some special considerations to be aware of in this environment.
+
+In addition, this tutorial shows how we can leverage dynamic policy composition to group and structure our policies in a
+way that follows the domain to which they apply.
+
+## Prerequisites
+
+In order to complete this tutorial, the following prerequisites needs to be met:
+
+* An AWS account, with permissions to deploy resources via AWS CloudFormation, and valid credentials available to the CLI commands
+* The [AWS CLI](https://aws.amazon.com/cli/) (`aws`) tool
+* The [CloudFormation CLI](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/what-is-cloudformation-cli.html) (`cfn`) tool
+* Docker
+* OPA server running at an endpoint reachable by the AWS Lambda function, either within the same AWS environment, or
+  elsewhere. While developing your CloudFormation policies, a good option is to run OPA locally, but exposed to the
+  public via a service like [ngrok](https://ngrok.com/).
+
+## Steps
+
+### 1. Install the CloudFormation Hook
+
+To start out, clone the OPA AWS CloudFormation Hook repository:
+
+```shell
+git clone https://github.com/StyraInc/opa-aws-cloudformation-hook.git
+cd opa-aws-cloudformation-hook
+```
+
+To install (but not activate) the hook provided in this repository into your AWS account, cd into the `hooks` directory
+and run:
+
+```shell
+cd hooks
+cfn submit --set-default
+```
+
+When the command above is finished (this may take several minutes), you should see output similar to this:
+
+```
+Successfully submitted type. Waiting for registration with token '16697881-de36-45b8-8bc4-d9744431fa82' to complete.
+Registration complete.
+{
+  'ProgressStatus': 'COMPLETE',
+  'Description': 'Deployment is currently in DEPLOY_STAGE of status COMPLETED',
+  'TypeArn': 'arn:aws:cloudformation:eu-north-1:687803501377:type/hook/Styra-OPA-Hook',
+  ...
+}
+```
+
+### 2. Configure the OPA AWS CloudFormation Hook
+
+The hook is now installed but needs to be configured for your environment. First, copy the value of the `TypeArn`
+attribute from the JSON output of the above command, and store it in an environment variable:
+
+```shell
+export HOOK_TYPE_ARN="arn:aws:cloudformation:eu-north-1:687803501377:type/hook/Styra-OPA-Hook"
+```
+
+Next, set the AWS region and the URL to use for calling OPA:
+
+```shell
+export AWS_REGION="eu-north-1"
+export OPA_URL="https://cfn-opa.example.com"
+```
+
+**(OPTIONAL):** If you want to use a bearer token to authenticate against OPA, provide an ARN pointing to the AWS Secret
+containing the token:
+
+```shell
+export OPA_AUTH_TOKEN_SECRET="arn:aws:secretsmanager:eu-north-1:687803501377:secret:opa-cfn-token-l26bHK"
+```
+
+With the configuration variables set, push the configuration to AWS (remove `opaAuthTokenSecret` if you don't intend to
+use it):
+
+```shell
+aws cloudformation --region "$AWS_REGION" set-type-configuration \
+  --configuration "{\"CloudFormationConfiguration\":{\"HookConfiguration\":{\"TargetStacks\":\"ALL\",\"FailureMode\":\"FAIL\",\"Properties\":{\"opaUrl\": \"$OPA_URL\",\"opaAuthTokenSecret\":\"$OPA_AUTH_TOKEN_SECRET\"}}}}" \
+  --type-arn $HOOK_TYPE_ARN
+```
+
+The hook is now installed, configured and activated!
+
+### 3. Learn the Domain
+
+Before we proceed to write our first policy, let's take a closer look at the data we'll be working with.
+
+#### AWS CloudFormation Templates
+
+A template file is commonly a YAML or JSON file, describing a set of AWS resources. While a template may describe
+multiple resources, the hook will send each resource for validation separately. Important to note here is that the
+resource presented to the hook will be shown **exactly** as provided in the template file. The hook does not perform any
+type preprocessing, such as adding default values where missing, or providing auto-generated names. Policy authors must
+hence take into account that even "obvious" attributes like name might not be present in the resource provided for
+evaluation. As an example, a template to deploy an S3 Bucket with default attributes may be as minimal as this:
+
+```yaml
+Resources:
+  ExampleS3Bucket:
+    Type: AWS::S3::Bucket
+```
+
+For more information on templates, see the
+[AWS User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-guide.html) on that topic.
+
+#### Input and Response Format
+
+The OPA configured to receive requests from the CFN hook will have its input provided in this format:
+
+```json
+{
+  "action": "CREATE",
+  "hook": "Styra::OPA::Hook",
+  "resource": {
+    "id": "MyS3Bucket",
+    "name": "AWS::S3::Bucket",
+    "type": "AWS::S3::Bucket",
+    "properties": {
+      "Tags": [{"Key": "Owner", "Value": "Platform Team"}],
+      "BucketName": "platform-bucket-1"
+    }
+  }
+}
+```
+
+* The `action` is either `CREATE`, `UPDATE` or `DELETE`
+* The `id` is the key of the resource, as provided in the template
+* The `type` is divided by "resource domain" and the specific type, so e.g. the S3 domain may contain `Bucket`,
+  `BucketPolicy`, and so on.
+
+The hook expects the response to contain a boolean `allow` attribute, and a list of (potential) `violations`:
+
+```json
+{
+  "allow": false,
+  "violations": ["bucket must not be public", "bucket name must follow naming standard"]
+}
+```
+
+Any request denied will be logged in [AWS CloudWatch](https://aws.amazon.com/cloudwatch/) for the same account.
+
+### 4. Write a CloudFormation Hook Policy
+
+With knowledge of the domain and the data model, we're ready to write our first CloudFormation Hook policy. Since we'll
+have a single OPA endpoint servicing requests for all types of resources, we'll use the
+[default decision](../configuration/#miscellaneous) policy, which by default queries the `system.main` rule. Let's add a
+simple policy to block an S3 Bucket unless it has an `AccessControl` attribute set to `Private`:
+
+```live:example/system:module
+package system
+
+import future.keywords
+
+main := {
+    "allow": count(deny) == 0,
+    "violations": deny,
+}
+
+deny[msg] {
+    bucket_create_or_update
+    not bucket_is_private
+
+    msg := sprintf("S3 Bucket %s 'AccessControl' attribute value must be 'Private'", [input.resource.id])
+}
+
+bucket_create_or_update {
+    input.resource.type == "AWS::S3::Bucket"
+    input.action in {"CREATE", "UPDATE"}
+}
+
+bucket_is_private {
+    input.resource.properties.AccessControl == "Private"
+}
+```
+
+Since we know that CloudFormation Templates may contain only the bare minimum of information, we can't assume that there
+will be an `AccessControl` attribute present in the input at all. Using negation of boolean rules inside of our `deny`
+rules help alleviate the problem of values potentially being undefined. Compare to the following deny rule, which might
+look correct at a first glance:
+
+```live:example/fail:module
+deny[msg] {
+    bucket_create_or_update
+
+    input.resource.properties.AccessControl != "Private"
+
+    msg := sprintf("S3 Bucket %s 'AccessControl' attribute value must be 'Private'", [input.resource.id])
+}
+```
+
+This rule would work fine as long as there _is_ an `AccessControl` attribute present in the input resource, but would
+fail (i.e. not evaluate) as soon as the property was missing, leading to the resource being allowed! Using helper rules
+and negation is a good way to work with data that might or might not be present, and results in more readable policies,
+too.
+
+{{< danger >}}
+Surprisingly, boolean values from CloudFormation Templates are provided to the hook in the form of **strings** (i.e.
+"true" and "false"). Policy authors must take this into account, and explicitly check for the value of these
+attributes. An example S3 bucket policy might for example want to check that public ACLs are blocked:
+
+```live:example/boolean_fail:module:read_only
+# Wrong: will allow both "true" and "false" values as both are considered "truthy"
+block_public_acls {
+    input.resource.properties.PublicAccessBlockConfiguration.BlockPublicAcls
+}
+```
+
+```live:example/boolean_correct:module:read_only
+# Correct: will allow only when property set to "true"
+block_public_acls {
+    input.resource.properties.PublicAccessBlockConfiguration.BlockPublicAcls == "true"
+}
+```
+{{< /danger >}}
+
+### 5. Policy Enforcement Testing
+
+With the above policy loaded into OPA, we may proceed to try it out. Let's deploy the minimal S3 Bucket from the
+previous template example. Save the below minimal template to a file called `s3bucket.yaml`:
+
+```yaml
+Resources:
+  ExampleS3Bucket:
+    Type: AWS::S3::Bucket
+```
+
+Since our S3 bucket doesn't have an `AccessControl` attribute, it should be denied by the hook. We
+deploy a template by creating a **stack**:
+
+```shell
+aws cloudformation create-stack --stack-name cfn-s3 --template-body file://s3bucket.yaml
+```
+
+The output of the above command will simply be a confirmation that the stack was deployed. It won't tell us whether the
+deployment was successful or not. In order to know that, we'll need to check the stack events:
+
+```shell
+aws cloudformation describe-stack-events --stack-name cfn-s3
+```
+
+The output of the above command will be a list of all events associated with the `cfn-s3` stack. Among the events, you
+should now find an item describing that the hook denied the request, and its reason for doing so:
+
+```json
+{
+  "StackEvents": [
+    {
+      "StackId": "arn:aws:cloudformation:eu-north-1:55523455647:stack/cfn-s3/4f605f70-b1ca-12ec-b4d8-0a63e869dfee",
+      "EventId": "ExampleS3Bucket-c243efd6-bfe7-3f10-8304-a0e40fe5f6f4",
+      "StackName": "cfn-s3",
+      "LogicalResourceId": "ExampleS3Bucket",
+      "PhysicalResourceId": "",
+      "ResourceType": "AWS::S3::Bucket",
+      "Timestamp": "2022-03-31T08:41:15.946000+00:00",
+      "ResourceStatus": "CREATE_IN_PROGRESS",
+      "HookType": "Styra::OPA::Hook",
+      "HookStatus": "HOOK_COMPLETE_FAILED",
+      "HookStatusReason": "Hook failed with message: S3 Bucket ExampleS3Bucket 'AccessControl' attribute value must be 'Private'",
+      "HookInvocationPoint": "PRE_PROVISION",
+      "HookFailureMode": "FAIL"
+    }
+  ]
+}
+```
+
+Congratulations! You've just successfully enforced your first CloudFormation Hook policy using OPA. Let's update the
+template so that it passes our policy requirement:
+
+**s3bucket.yaml**
+```yaml
+Resources:
+  ExampleS3Bucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      AccessControl: Private
+```
+
+Even though our stack did not create an S3 bucket (as the change got rolled back), the **stack** still exists.
+In order to try again, we'll first need to delete the existing stack:
+
+```shell
+aws cloudformation delete-stack --stack-name cfn-s3
+```
+
+Now, let's try again:
+
+```shell
+aws cloudformation create-stack --stack-name cfn-s3 --template-body file://s3bucket.yaml
+```
+
+Checking the output of `aws cloudformation describe-stack-events --stack-name cfn-s3` once more will now show that the
+resource was created. Do note that this could take up to a minute, so if you don't see it immediately, rerun the command
+a bit later.
+
+```json
+{
+  "StackEvents": [
+    {
+      "StackId": "arn:aws:cloudformation:eu-north-1:55523455647:stack/cfn-s3/4f605f70-b1ca-12ec-b4d8-0a63e869dfee",
+      "EventId": "e20fdfa0-b0d0-11ec-b669-0e70f1f560a6",
+      "StackName": "cfn-s3",
+      "LogicalResourceId": "cfn-s3",
+      "PhysicalResourceId": "arn:aws:cloudformation:eu-north-1:55523455647:stack/cfn-s3/cf418141-b0d9-11bc-b421-0a1244c68dd1",
+      "ResourceType": "AWS::CloudFormation::Stack",
+      "Timestamp": "2022-03-31T08:59:33.392000+00:00",
+      "ResourceStatus": "CREATE_COMPLETE"
+    }
+  ]
+}
+```
+
+Note: once our stack is successfully deployed, we can use the `update-stack` command after we've made changes to our
+templates:
+
+```shell
+aws cloudformation update-stack --stack-name cfn-s3 --template-body file://s3bucket.yaml`
+```
+
+## Further Improvements
+
+### Dynamic Policy Composition
+
+Having a single policy file for all rules will quickly become unwieldy. Could we improve this somehow? One way of doing
+that would be to use dynamic policy composition, where a single main policy acts as a "router", and forwards queries to
+other packages based on attributes from the input. A natural attribute to use for CloudFormation templates might for
+example be the resource type, allowing us to group our policies by the resource type they're meant to act on. Let's
+take a look at what such a main policy might look like:
+
+**main.rego**
+```live:example/router:module
+# METADATA
+# description: |
+#   Dynamic routing to policy based in input.resource.type,
+#   aggregating the deny rules found in all policies with a
+#   matching package name
+#
+package system
+
+import future.keywords
+
+main := {
+	"allow": count(violations) == 0,
+	"violations": violations,
+}
+
+# METADATA
+# description: |
+#   Main routing logic, simply converting input.resource.type, e.g.
+#   AWS::S3::Bucket to data.aws.s3.bucket and returning that document.
+#
+#   By default, only input.action == "CREATE" | "UPDATE" will be routed
+#   to the data.aws.s3.bucket document. If handling "DELETE" actions is
+#   desirable, one may create a special policy for that by simply appending
+#   "delete" to the package name, e.g. data.aws.s3.bucket.delete
+#
+route := document(lower(component), lower(type)) {
+	["AWS", component, type] = split(input.resource.type, "::")
+}
+
+violations[msg] {
+	# Aggregate all deny rules found in routed document
+	some msg in route.deny
+}
+
+#
+# Basic input validation to avoid having to do this in each resource policy
+#
+
+violations["Missing input.resource"] {
+	not input.resource
+}
+
+violations["Missing input.resource.type"] {
+	not input.resource.type
+}
+
+violations["Missing input.resource.id"] {
+	not input.resource.id
+}
+
+violations["Missing input.action"] {
+	not input.action
+}
+
+#
+# Helpers
+#
+
+document(component, type) := data.aws[component][type] {
+	input.action != "DELETE"
+}
+
+document(component, type) := data.aws[component][type].delete {
+	input.action == "DELETE"
+}
+```
+
+The above policy will invoke the `route` rule to determine which package should be evaluated based on the
+`input.resource.type`, transforming a value such as `AWS::S3::Bucket` into a call to the `data.aws.s3.bucket` package,
+where each rule named `deny` will be evaluated, and the result aggregated into the final decision.
+
+Since most of our policies will only deal with `CREATE` or `UPDATE` actions, we'd rather want to avoid having to check
+for this in all of our rules. Instead, we'll have the router append `.delete` to the package name for `DELETE`
+operations, so that a request to delete e.g. an S3 bucket would invoke the `data.aws.s3.bucket.delete` package (if it
+exists).
+
+Additionally, we'll also do some simple input validation at this stage, so that we may avoid doing so in our resource
+specific policies.
+
+We can now modify our original policy to verify S3 bucket resources only:
+
+```live:example/bucket:module
+package aws.s3.bucket
+
+deny[sprintf("S3 Bucket %s 'AccessControl' attribute value must be 'Private'", [input.resource.id])] {
+    not bucket_is_private
+}
+
+bucket_is_private {
+    input.resource.properties.AccessControl == "Private"
+}
+```
+
+Note how we no longer need the `bucket_create_or_update` rule, as that is already asserted by the main policy.
+Quite an improvement in terms of readability, and a good foundation for further policy authoring. If you'd like to see
+more examples of policy utilizing this pattern, check out the
+[policy directory](https://github.com/StyraInc/opa-aws-cloudformation-hook/tree/main/policy) in the OPA AWS
+CloudFormation Hook repo.
+
+### OPA Authentication via AWS Secrets
+
+#### OPA Configuration
+
+Since the OPA server does not run inside the AWS Lambda, it is a good idea to require authentication to access its REST
+API, as described in the OPA [documentation](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization).
+
+A simple authz policy for checking the bearer token might look something like this:
+
+**authz.rego**
+```live:example/authz:module
+package system.authz
+
+default allow := false
+
+allow {
+    input.identity == "my_secret_token"
+}
+```
+
+Once created, remember to pass the appropriate flags to `opa run` to enable authentication / authorization:
+
+```shell
+opa run --server --authentication=token --authorization=basic .
+```
+
+#### OPA AWS CloudFormation Hook Configuration
+
+If configured to use a bearer token for authenticating against OPA (by setting the `OPA_AUTH_TOKEN_SECRET` environment
+variable as described in the section on configuring the hook), the hook will try to fetch the token from the
+secret provided in the `opaAuthTokenSecret` (ARN) configuration attribute. Note that the token should be provided
+as a plain string in the secret (i.e. the `SecretString`) and not wrapped in a JSON object.
+
+In order to fetch the token, the hook will need to be permitted to perform the `secretsmanager:GetSecretValue`
+operation. Note that the hook will **only** read the secret provided by `opaAuthTokenSecret`, but it's recommended
+to limit the `HookTypePolicy` on the IAM role to the specific secret accessed, i.e. the same ARN provided in
+`opaAuthTokenSecret`. Example `HookTypePolicy` to allow the hook access to a specific secret:
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "VisualEditor0",
+            "Effect": "Allow",
+            "Action": "secretsmanager:GetSecretValue",
+            "Resource": "arn:aws:secretsmanager:eu-north-1:673240551671:secret:opa-cfn-token-l26bHK"
+        }
+    ]
+}
+```
+
+If you aren't planning to use bearer tokens for authentication, you may remove the permission entirely.
diff --git a/docs/content/cli.md b/docs/content/cli.md
new file mode 100755
index 0000000000..a8ca53e5b4
--- /dev/null
+++ b/docs/content/cli.md
@@ -0,0 +1,1103 @@
+---
+title: CLI
+kind: documentation
+weight: 90
+restrictedtoc: true
+---
+
+The OPA executable provides the following commands.
+
+## opa bench
+
+Benchmark a Rego query
+
+### Synopsis
+
+Benchmark a Rego query and print the results.
+
+The benchmark command works very similar to 'eval' and will evaluate the query in the same fashion. The
+evaluation will be repeated a number of times and performance results will be returned.
+
+Example with bundle and input data:
+
+	opa bench -b ./policy-bundle -i input.json 'data.authz.allow'
+
+To enable more detailed analysis use the --metrics and --benchmem flags.
+
+To run benchmarks against a running OPA server to evaluate server overhead use the --e2e flag.
+
+The optional "gobench" output format conforms to the Go Benchmark Data Format.
+
+
+```
+opa bench <query> [flags]
+```
+
+### Options
+
+```
+      --benchmem                       report memory allocations with benchmark results (default true)
+  -b, --bundle string                  set bundle file(s) or directory path(s). This flag can be repeated.
+  -c, --config-file string             set path of configuration file
+      --count int                      number of times to repeat each benchmark (default 1)
+  -d, --data string                    set policy or data file(s). This flag can be repeated.
+      --e2e                            run benchmarks against a running OPA server
+      --fail                           exits with non-zero exit code on undefined/empty result and errors (default true)
+  -f, --format {json,pretty,gobench}   set output format (default pretty)
+  -h, --help                           help for bench
+      --ignore strings                 set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+      --import string                  set query import(s). This flag can be repeated.
+  -i, --input string                   set input file path
+      --metrics                        report query performance metrics (default true)
+      --package string                 set query package
+  -p, --partial                        perform partial evaluation
+  -s, --schema string                  set schema file path or directory path
+      --shutdown-grace-period int      set the time (in seconds) that the server will wait to gracefully shut down. This flag is valid in 'e2e' mode only. (default 10)
+      --shutdown-wait-period int       set the time (in seconds) that the server will wait before initiating shutdown. This flag is valid in 'e2e' mode only.
+      --stdin                          read query from stdin
+  -I, --stdin-input                    read input document from stdin
+  -t, --target {rego,wasm}             set the runtime to exercise (default rego)
+  -u, --unknowns stringArray           set paths to treat as unknown during partial evaluation (default [input])
+```
+
+____
+
+## opa build
+
+Build an OPA bundle
+
+### Synopsis
+
+Build an OPA bundle.
+
+The 'build' command packages OPA policy and data files into bundles. Bundles are
+gzipped tarballs containing policies and data. Paths referring to directories are
+loaded recursively.
+
+    $ ls
+    example.rego
+
+    $ opa build -b .
+
+You can load bundles into OPA on the command-line:
+
+    $ ls
+    bundle.tar.gz example.rego
+
+    $ opa run bundle.tar.gz
+
+You can also configure OPA to download bundles from remote HTTP endpoints:
+
+    $ opa run --server \
+        --set bundles.example.resource=bundle.tar.gz \
+        --set services.example.url=http://localhost:8080
+
+Inside another terminal in the same directory, serve the bundle via HTTP:
+
+    $ python3 -m http.server --bind localhost 8080
+
+For more information on bundles see https://www.openpolicyagent.org/docs/latest/management-bundles/.
+
+### Common Flags
+
+
+When -b is specified the 'build' command assumes paths refer to existing bundle files
+or directories following the bundle structure. If multiple bundles are provided, their
+contents are merged. If there are any merge conflicts (e.g., due to conflicting bundle
+roots), the command fails. When loading an existing bundle file, the .manifest from
+the input bundle will be included in the output bundle. Flags that set .manifest fields
+(such as --revision) override input bundle .manifest fields.
+
+The -O flag controls the optimization level. By default, optimization is disabled (-O=0).
+When optimization is enabled the 'build' command generates a bundle that is semantically
+equivalent to the input files however the structure of the files in the bundle may have
+been changed by rewriting, inlining, pruning, etc. Higher optimization levels may result
+in longer build times.
+
+The 'build' command supports targets (specified by -t):
+
+    rego    The default target emits a bundle containing a set of policy and data files
+            that are semantically equivalent to the input files. If optimizations are
+            disabled the output may simply contain a copy of the input policy and data
+            files. If optimization is enabled at least one entrypoint must be supplied,
+            either via the -e option, or via entrypoint metadata annotations.
+
+    wasm    The wasm target emits a bundle containing a WebAssembly module compiled from
+            the input files for each specified entrypoint. The bundle may contain the
+            original policy or data files.
+
+    plan    The plan target emits a bundle containing a plan, i.e., an intermediate
+            representation compiled from the input files for each specified entrypoint.
+            This is for further processing, OPA cannot evaluate a "plan bundle" like it
+            can evaluate a wasm or rego bundle.
+
+The -e flag tells the 'build' command which documents (entrypoints) will be queried by 
+the software asking for policy decisions, so that it can focus optimization efforts and 
+ensure that document is not eliminated by the optimizer.
+Note: Unless the --prune-unused flag is used, any rule transitively referring to a 
+package or rule declared as an entrypoint will also be enumerated as an entrypoint.
+
+### Signing
+
+
+The 'build' command can be used to verify the signature of a signed bundle and
+also to generate a signature for the output bundle the command creates.
+
+If the directory path(s) provided to the 'build' command contain a ".signatures.json" file,
+it will attempt to verify the signatures included in that file. The bundle files
+or directory path(s) to verify must be specified using --bundle.
+
+For more information on the bundle signing and verification, see
+https://www.openpolicyagent.org/docs/latest/management-bundles/#signing.
+
+Example:
+
+    $ opa build --verification-key /path/to/public_key.pem --signing-key /path/to/private_key.pem --bundle foo
+
+Where foo has the following structure:
+
+    foo/
+      |
+      +-- bar/
+      |     |
+      |     +-- data.json
+      |
+      +-- policy.rego
+      |
+      +-- .manifest
+      |
+      +-- .signatures.json
+
+
+The 'build' command will verify the signatures using the public key provided by the --verification-key flag.
+The default signing algorithm is RS256 and the --signing-alg flag can be used to specify
+a different one. The --verification-key-id and --scope flags can be used to specify the name for the key
+provided using the --verification-key flag and scope to use for bundle signature verification respectively.
+
+If the verification succeeds, the 'build' command will write out an updated ".signatures.json" file
+to the output bundle. It will use the key specified by the --signing-key flag to sign
+the token in the ".signatures.json" file.
+
+To include additional claims in the payload use the --claims-file flag to provide a JSON file
+containing optional claims.
+
+For more information on the format of the ".signatures.json" file
+see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format.
+
+### Capabilities
+
+
+The 'build' command can validate policies against a configurable set of OPA capabilities.
+The capabilities define the built-in functions and other language features that policies
+may depend on. For example, the following capabilities file only permits the policy to
+depend on the "plus" built-in function ('+'):
+
+    {
+        "builtins": [
+            {
+                "name": "plus",
+                "infix": "+",
+                "decl": {
+                    "type": "function",
+                    "args": [
+                        {
+                            "type": "number"
+                        },
+                        {
+                            "type": "number"
+                        }
+                    ],
+                    "result": {
+                        "type": "number"
+                    }
+                }
+            }
+        ]
+    }
+
+Capabilities can be used to validate policies against a specific version of OPA.
+The OPA repository contains a set of capabilities files for each OPA release. For example,
+the following command builds a directory of policies ('./policies') and validates them
+against OPA v0.22.0:
+
+    opa build ./policies --capabilities v0.22.0
+
+
+```
+opa build <path> [<path> [...]] [flags]
+```
+
+### Options
+
+```
+  -b, --bundle                         load paths as bundle files or root directories
+      --capabilities string            set capabilities version or capabilities.json file path
+      --claims-file string             set path of JSON file containing optional claims (see: https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format)
+      --debug                          enable debug output
+  -e, --entrypoint string              set slash separated entrypoint path
+      --exclude-files-verify strings   set file names to exclude during bundle verification
+  -h, --help                           help for build
+      --ignore strings                 set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+  -O, --optimize int                   set optimization level
+  -o, --output string                  set the output filename (default "bundle.tar.gz")
+      --prune-unused                   exclude dependents of entrypoints
+  -r, --revision string                set output bundle revision
+      --scope string                   scope to use for bundle signature verification
+      --signing-alg string             name of the signing algorithm (default "RS256")
+      --signing-key string             set the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)
+      --signing-plugin string          name of the plugin to use for signing/verification (see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-plugin
+  -t, --target {rego,wasm,plan}        set the output bundle target type (default rego)
+      --verification-key string        set the secret (HMAC) or path of the PEM file containing the public key (RSA and ECDSA)
+      --verification-key-id string     name assigned to the verification key used for bundle verification (default "default")
+```
+
+____
+
+## opa capabilities
+
+Print the capabilities of OPA
+
+### Synopsis
+
+Show capabilities for OPA.
+
+The 'capabilities' command prints the OPA capabilities, prior to and including the version of OPA used.
+
+Print a list of all existing capabilities version names
+
+    $ opa capabilities
+    v0.17.0
+    v0.17.1
+    ...
+    v0.37.1
+    v0.37.2
+    v0.38.0
+    ...
+
+Print the capabilities of the current version
+
+    $ opa capabilities --current
+    {
+        "builtins": [...],
+        "future_keywords": [...],
+        "wasm_abi_versions": [...]
+    }
+
+Print the capabilities of a specific version
+
+    $ opa capabilities --version v0.32.1
+    {
+        "builtins": [...],
+        "future_keywords": null,
+        "wasm_abi_versions": [...]
+    }
+
+Print the capabilities of a capabilities file
+
+    $ opa capabilities --file ./capabilities/v0.32.1.json
+    {
+        "builtins": [...],
+        "future_keywords": null,
+        "wasm_abi_versions": [...]
+    }
+
+
+
+```
+opa capabilities [flags]
+```
+
+### Options
+
+```
+      --current          print current capabilities
+      --file string      print current capabilities
+  -h, --help             help for capabilities
+      --version string   print capabilities of a specific version
+```
+
+____
+
+## opa check
+
+Check Rego source files
+
+### Synopsis
+
+Check Rego source files for parse and compilation errors.
+	
+	If the 'check' command succeeds in parsing and compiling the source file(s), no output
+	is produced. If the parsing or compiling fails, 'check' will output the errors
+	and exit with a non-zero exit code.
+
+```
+opa check <path> [path [...]] [flags]
+```
+
+### Options
+
+```
+  -b, --bundle                 load paths as bundle files or root directories
+      --capabilities string    set capabilities version or capabilities.json file path
+  -f, --format {pretty,json}   set output format (default pretty)
+  -h, --help                   help for check
+      --ignore strings         set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+  -m, --max-errors int         set the number of errors to allow before compilation fails early (default 10)
+  -s, --schema string          set schema file path or directory path
+  -S, --strict                 enable compiler strict mode
+```
+
+____
+
+## opa deps
+
+Analyze Rego query dependencies
+
+### Synopsis
+
+Print dependencies of provided query.
+
+Dependencies are categorized as either base documents, which is any data loaded
+from the outside world, or virtual documents, i.e values that are computed from rules.
+
+### Example
+
+Given a policy like this:
+
+	package policy
+
+	import future.keywords.if
+	import future.keywords.in
+
+	allow if is_admin
+
+	is_admin if "admin" in input.user.roles
+
+To evaluate the dependencies of a simple query (e.g. data.policy.allow),
+we'd run opa deps like demonstrated below:
+
+	$ opa deps --data policy.rego data.policy.allow
+	+------------------+----------------------+
+	|  BASE DOCUMENTS  |  VIRTUAL DOCUMENTS   |
+	+------------------+----------------------+
+	| input.user.roles | data.policy.allow    |
+	|                  | data.policy.is_admin |
+	+------------------+----------------------+
+
+From the output we're able to determine that the allow rule depends on
+the input.user.roles base document, as well as the virtual document (rule)
+data.policy.is_admin.
+
+
+```
+opa deps <query> [flags]
+```
+
+### Options
+
+```
+  -b, --bundle string          set bundle file(s) or directory path(s). This flag can be repeated.
+  -d, --data string            set policy or data file(s). This flag can be repeated.
+  -f, --format {pretty,json}   set output format (default pretty)
+  -h, --help                   help for deps
+      --ignore strings         set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+```
+
+____
+
+## opa eval
+
+Evaluate a Rego query
+
+### Synopsis
+
+Evaluate a Rego query and print the result.
+
+### Examples
+
+
+To evaluate a simple query:
+
+    $ opa eval 'x := 1; y := 2; x < y'
+
+To evaluate a query against JSON data:
+
+    $ opa eval --data data.json 'name := data.names[_]'
+
+To evaluate a query against JSON data supplied with a file:// URL:
+
+    $ opa eval --data file:///path/to/file.json 'data'
+
+
+### File & Bundle Loading
+
+
+The --bundle flag will load data files and Rego files contained
+in the bundle specified by the path. It can be either a
+compressed tar archive bundle file or a directory tree.
+
+    $ opa eval --bundle /some/path 'data'
+
+Where /some/path contains:
+
+    foo/
+      |
+      +-- bar/
+      |     |
+      |     +-- data.json
+      |
+      +-- baz.rego
+      |
+      +-- manifest.yaml
+
+The JSON file 'foo/bar/data.json' would be loaded and rooted under
+'data.foo.bar' and the 'foo/baz.rego' would be loaded and rooted under the
+package path contained inside the file. Only data files named data.json or
+data.yaml will be loaded. In the example above the manifest.yaml would be
+ignored.
+
+See https://www.openpolicyagent.org/docs/latest/management-bundles/ for more details
+on bundle directory structures.
+
+The --data flag can be used to recursively load ALL *.rego, *.json, and
+*.yaml files under the specified directory.
+
+The -O flag controls the optimization level. By default, optimization is disabled (-O=0).
+When optimization is enabled the 'eval' command generates a bundle from the files provided
+with either the --bundle or --data flag. This bundle is semantically equivalent to the input
+files however the structure of the files in the bundle may have been changed by rewriting, inlining,
+pruning, etc. This resulting optimized bundle is used to evaluate the query. If optimization is
+enabled at least one entrypoint must be supplied, either via the -e option, or via entrypoint
+metadata annotations.
+
+### Output Formats
+
+
+Set the output format with the --format flag.
+
+    --format=json      : output raw query results as JSON
+    --format=values    : output line separated JSON arrays containing expression values
+    --format=bindings  : output line separated JSON objects containing variable bindings
+    --format=pretty    : output query results in a human-readable format
+    --format=source    : output partial evaluation results in a source format
+    --format=raw       : output the values from query results in a scripting friendly format
+
+### Schema
+
+
+The -s/--schema flag provides one or more JSON Schemas used to validate references to the input or data documents.
+Loads a single JSON file, applying it to the input document; or all the schema files under the specified directory.
+
+    $ opa eval --data policy.rego --input input.json --schema schema.json
+    $ opa eval --data policy.rego --input input.json --schema schemas/
+
+### Capabilities
+
+
+When passing a capabilities definition file via --capabilities, one can restrict which
+hosts remote schema definitions can be retrieved from. For example, a capabilities.json
+containing
+
+    {
+        "builtins": [ ... ],
+        "allow_net": [ "kubernetesjsonschema.dev" ]
+    }
+
+would disallow fetching remote schemas from any host but "kubernetesjsonschema.dev".
+Setting allow_net to an empty array would prohibit fetching any remote schemas.
+
+Not providing a capabilities file, or providing a file without an allow_net key, will
+permit fetching remote schemas from any host.
+
+Note that the metaschemas http://json-schema.org/draft-04/schema, http://json-schema.org/draft-06/schema,
+and http://json-schema.org/draft-07/schema, are always available, even without network
+access.
+
+
+```
+opa eval <query> [flags]
+```
+
+### Options
+
+```
+  -b, --bundle string                                     set bundle file(s) or directory path(s). This flag can be repeated.
+      --capabilities string                               set capabilities version or capabilities.json file path
+      --count int                                         number of times to repeat each benchmark (default 1)
+      --coverage                                          report coverage
+  -d, --data string                                       set policy or data file(s). This flag can be repeated.
+      --disable-early-exit                                disable 'early exit' optimizations
+      --disable-indexing                                  disable indexing optimizations
+      --disable-inlining stringArray                      set paths of documents to exclude from inlining
+  -e, --entrypoint string                                 set slash separated entrypoint path
+      --explain {off,full,notes,fails,debug}              enable query explanations (default off)
+      --fail                                              exits with non-zero exit code on undefined/empty result and errors
+      --fail-defined                                      exits with non-zero exit code on defined/non-empty result and errors
+  -f, --format {json,values,bindings,pretty,source,raw}   set output format (default json)
+  -h, --help                                              help for eval
+      --ignore strings                                    set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+      --import string                                     set query import(s). This flag can be repeated.
+  -i, --input string                                      set input file path
+      --instrument                                        enable query instrumentation metrics (implies --metrics)
+      --metrics                                           report query performance metrics
+  -O, --optimize int                                      set optimization level
+      --package string                                    set query package
+  -p, --partial                                           perform partial evaluation
+      --pretty-limit int                                  set limit after which pretty output gets truncated (default 80)
+      --profile                                           perform expression profiling
+      --profile-limit int                                 set number of profiling results to show (default 10)
+      --profile-sort string                               set sort order of expression profiler results
+  -s, --schema string                                     set schema file path or directory path
+      --shallow-inlining                                  disable inlining of rules that depend on unknowns
+      --show-builtin-errors                               collect and return all encountered built-in errors, built in errors are not fatal
+      --stdin                                             read query from stdin
+  -I, --stdin-input                                       read input document from stdin
+  -S, --strict                                            enable compiler strict mode
+      --strict-builtin-errors                             treat the first built-in function error encountered as fatal
+  -t, --target {rego,wasm}                                set the runtime to exercise (default rego)
+      --timeout duration                                  set eval timeout (default unlimited)
+  -u, --unknowns stringArray                              set paths to treat as unknown during partial evaluation (default [input])
+```
+
+____
+
+## opa exec
+
+Execute against input files
+
+### Synopsis
+
+Execute against input files.
+
+The 'exec' command executes OPA against one or more input files. If the paths
+refer to directories, OPA will execute against files contained inside those
+directories, recursively.
+
+The 'exec' command accepts a --config-file/-c or series of --set options as
+arguments. These options behave the same as way as 'opa run'. Since the 'exec'
+command is intended to execute OPA in one-shot, the 'exec' command will
+manually trigger plugins before and after policy execution:
+
+Before: Discovery -> Bundle -> Status
+After: Decision Logs
+
+By default, the 'exec' command executes the "default decision" (specified in
+the OPA configuration) against each input file. This can be overridden by
+specifying the --decision argument and pointing at a specific policy decision,
+e.g., opa exec --decision /foo/bar/baz ...
+
+```
+opa exec <path> [<path> [...]] [flags]
+```
+
+### Options
+
+```
+  -b, --bundle string                        set bundle file(s) or directory path(s). This flag can be repeated.
+  -c, --config-file string                   set path of configuration file
+      --decision string                      set decision to evaluate
+      --fail                                 exits with non-zero exit code on undefined/empty result and errors
+      --fail-defined                         exits with non-zero exit code on defined/non-empty result and errors
+  -f, --format {pretty,json}                 set output format (default pretty)
+  -h, --help                                 help for exec
+      --log-format {text,json,json-pretty}   set log format (default json)
+  -l, --log-level {debug,info,error}         set log level (default error)
+      --log-timestamp-format string          set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)
+      --set stringArray                      override config values on the command line (use commas to specify multiple values)
+      --set-file stringArray                 override config values with files on the command line (use commas to specify multiple values)
+```
+
+____
+
+## opa fmt
+
+Format Rego source files
+
+### Synopsis
+
+Format Rego source files.
+
+The 'fmt' command takes a Rego source file and outputs a reformatted version. If no file path
+is provided - this tool will use stdin.
+The format of the output is not defined specifically; whatever this tool outputs
+is considered correct format (with the exception of bugs).
+
+If the '-w' option is supplied, the 'fmt' command with overwrite the source file
+instead of printing to stdout.
+
+If the '-d' option is supplied, the 'fmt' command will output a diff between the
+original and formatted source.
+
+If the '-l' option is supplied, the 'fmt' command will output the names of files
+that would change if formatted. The '-l' option will suppress any other output
+to stdout from the 'fmt' command.
+
+If the '--fail' option is supplied, the 'fmt' command will return a non zero exit
+code if a file would be reformatted.
+
+```
+opa fmt [path [...]] [flags]
+```
+
+### Options
+
+```
+  -d, --diff    only display a diff of the changes
+      --fail    non zero exit code on reformat
+  -h, --help    help for fmt
+  -l, --list    list all files who would change when formatted
+  -w, --write   overwrite the original source file
+```
+
+____
+
+## opa inspect
+
+Inspect OPA bundle(s)
+
+### Synopsis
+
+Inspect OPA bundle(s).
+
+The 'inspect' command provides a summary of the contents in OPA bundle(s). Bundles are
+gzipped tarballs containing policies and data. The 'inspect' command reads bundle(s) and lists
+the following:
+
+* packages that are contributed by .rego files
+* data locations defined by the data.json and data.yaml files
+* manifest data
+* signature data
+* information about the Wasm module files
+* package- and rule annotations
+
+Example:
+
+    $ ls
+    bundle.tar.gz
+    $ opa inspect bundle.tar.gz
+
+You can provide exactly one OPA bundle or path to the 'inspect' command on the command-line. If you provide a path
+referring to a directory, the 'inspect' command will load that path as a bundle and summarize its structure and contents.
+
+
+```
+opa inspect <path> [<path> [...]] [flags]
+```
+
+### Options
+
+```
+  -a, --annotations            list annotations
+  -f, --format {json,pretty}   set output format (default pretty)
+  -h, --help                   help for inspect
+```
+
+____
+
+## opa parse
+
+Parse Rego source file
+
+### Synopsis
+
+Parse Rego source file and print AST.
+
+```
+opa parse <path> [flags]
+```
+
+### Options
+
+```
+  -f, --format {pretty,json}   set output format (default pretty)
+  -h, --help                   help for parse
+      --json-include string    include or exclude optional elements. By default comments are included. Current options: locations, comments. E.g. --json-include locations,-comments will include locations and exclude comments.
+```
+
+____
+
+## opa run
+
+Start OPA in interactive or server mode
+
+### Synopsis
+
+Start an instance of the Open Policy Agent (OPA).
+
+To run the interactive shell:
+
+    $ opa run
+
+To run the server:
+
+    $ opa run -s
+
+The 'run' command starts an instance of the OPA runtime. The OPA runtime can be
+started as an interactive shell or a server.
+
+When the runtime is started as a shell, users can define rules and evaluate
+expressions interactively. When the runtime is started as a server, OPA exposes
+an HTTP API for managing policies, reading and writing data, and executing
+queries.
+
+The runtime can be initialized with one or more files that contain policies or
+data. If the '--bundle' option is specified the paths will be treated as policy
+bundles and loaded following standard bundle conventions. The path can be a
+compressed archive file or a directory which will be treated as a bundle.
+Without the '--bundle' flag OPA will recursively load ALL rego, JSON, and YAML
+files.
+
+When loading from directories, only files with known extensions are considered.
+The current set of file extensions that OPA will consider are:
+
+    .json          # JSON data
+    .yaml or .yml  # YAML data
+    .rego          # Rego file
+
+Non-bundle data file and directory paths can be prefixed with the desired
+destination in the data document with the following syntax:
+
+    <dotted-path>:<file-path>
+
+To set a data file as the input document in the interactive shell use the
+"repl.input" path prefix with the input file:
+
+    repl.input:<file-path>
+
+Example:
+
+    $ opa run repl.input:input.json
+
+Which will load the "input.json" file at path "data.repl.input".
+
+Use the "help input" command in the interactive shell to see more options.
+
+
+File paths can be specified as URLs to resolve ambiguity in paths containing colons:
+
+    $ opa run file:///c:/path/to/data.json
+
+URL paths to remote public bundles (http or https) will be parsed as shorthand
+configuration equivalent of using repeated --set flags to accomplish the same:
+
+	$ opa run -s https://example.com/bundles/bundle.tar.gz
+
+The above shorthand command is identical to:
+
+    $ opa run -s --set "services.cli1.url=https://example.com" \
+                 --set "bundles.cli1.service=cli1" \
+                 --set "bundles.cli1.resource=/bundles/bundle.tar.gz" \
+                 --set "bundles.cli1.persist=true"
+
+The 'run' command can also verify the signature of a signed bundle.
+A signed bundle is a normal OPA bundle that includes a file
+named ".signatures.json". For more information on signed bundles
+see https://www.openpolicyagent.org/docs/latest/management-bundles/#signing.
+
+The key to verify the signature of signed bundle can be provided
+using the --verification-key flag. For example, for RSA family of algorithms,
+the command expects a PEM file containing the public key.
+For HMAC family of algorithms (eg. HS256), the secret can be provided
+using the --verification-key flag.
+
+The --verification-key-id flag can be used to optionally specify a name for the
+key provided using the --verification-key flag.
+
+The --signing-alg flag can be used to specify the signing algorithm.
+The 'run' command uses RS256 (by default) as the signing algorithm.
+
+The --scope flag can be used to specify the scope to use for
+bundle signature verification.
+
+Example:
+
+    $ opa run --verification-key secret --signing-alg HS256 --bundle bundle.tar.gz
+
+The 'run' command will read the bundle "bundle.tar.gz", check the
+".signatures.json" file and perform verification using the provided key.
+An error will be generated if "bundle.tar.gz" does not contain a ".signatures.json" file.
+For more information on the bundle verification process see
+https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-verification.
+
+The 'run' command can ONLY be used with the --bundle flag to verify signatures
+for existing bundle files or directories following the bundle structure.
+
+To skip bundle verification, use the --skip-verify flag.
+
+
+```
+opa run [flags]
+```
+
+### Options
+
+```
+  -a, --addr strings                         set listening address of the server (e.g., [ip]:<port> for TCP, unix://<path> for UNIX domain socket) (default [:8181])
+      --authentication {token,tls,off}       set authentication scheme (default off)
+      --authorization {basic,off}            set authorization scheme (default off)
+  -b, --bundle                               load paths as bundle files or root directories
+  -c, --config-file string                   set path of configuration file
+      --diagnostic-addr strings              set read-only diagnostic listening address of the server for /health and /metric APIs (e.g., [ip]:<port> for TCP, unix://<path> for UNIX domain socket)
+      --disable-telemetry                    disables anonymous information reporting (see: https://www.openpolicyagent.org/docs/latest/privacy)
+      --exclude-files-verify strings         set file names to exclude during bundle verification
+  -f, --format string                        set shell output format, i.e, pretty, json (default "pretty")
+      --h2c                                  enable H2C for HTTP listeners
+  -h, --help                                 help for run
+  -H, --history string                       set path of history file (default "$HOME/.opa_history")
+      --ignore strings                       set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+      --log-format {text,json,json-pretty}   set log format (default json)
+  -l, --log-level {debug,info,error}         set log level (default info)
+      --log-timestamp-format string          set log timestamp format (OPA_LOG_TIMESTAMP_FORMAT environment variable)
+  -m, --max-errors int                       set the number of errors to allow before compilation fails early (default 10)
+      --min-tls-version {1.0,1.1,1.2,1.3}    set minimum TLS version to be used by OPA's server (default 1.2)
+      --pprof                                enables pprof endpoints
+      --ready-timeout int                    wait (in seconds) for configured plugins before starting server (value <= 0 disables ready check)
+      --scope string                         scope to use for bundle signature verification
+  -s, --server                               start the runtime in server mode
+      --set stringArray                      override config values on the command line (use commas to specify multiple values)
+      --set-file stringArray                 override config values with files on the command line (use commas to specify multiple values)
+      --shutdown-grace-period int            set the time (in seconds) that the server will wait to gracefully shut down (default 10)
+      --shutdown-wait-period int             set the time (in seconds) that the server will wait before initiating shutdown
+      --signing-alg string                   name of the signing algorithm (default "RS256")
+      --skip-verify                          disables bundle signature verification
+      --tls-ca-cert-file string              set path of TLS CA cert file
+      --tls-cert-file string                 set path of TLS certificate file
+      --tls-cert-refresh-period duration     set certificate refresh period
+      --tls-private-key-file string          set path of TLS private key file
+      --unix-socket-perm string              specify the permissions for the Unix domain socket if used to listen for incoming connections (default "755")
+      --verification-key string              set the secret (HMAC) or path of the PEM file containing the public key (RSA and ECDSA)
+      --verification-key-id string           name assigned to the verification key used for bundle verification (default "default")
+  -w, --watch                                watch command line files for changes
+```
+
+____
+
+## opa sign
+
+Generate an OPA bundle signature
+
+### Synopsis
+
+Generate an OPA bundle signature.
+
+The 'sign' command generates a digital signature for policy bundles. It generates a
+".signatures.json" file that dictates which files should be included in the bundle,
+what their SHA hashes are, and is cryptographically secure.
+
+The signatures file is a JSON file with an array containing a single JSON Web Token (JWT)
+that encapsulates the signature for the bundle.
+
+The --signing-alg flag can be used to specify the algorithm to sign the token. The 'sign'
+command uses RS256 (by default) as the signing algorithm.
+See https://www.openpolicyagent.org/docs/latest/configuration/#keys
+for a list of supported signing algorithms.
+
+The key to be used for signing the JWT MUST be provided using the --signing-key flag.
+For example, for RSA family of algorithms, the command expects a PEM file containing
+the private key.
+For HMAC family of algorithms (eg. HS256), the secret can be provided using
+the --signing-key flag.
+
+OPA 'sign' can ONLY be used with the --bundle flag to load paths that refer to
+existing bundle files or directories following the bundle structure.
+
+	$ opa sign --signing-key /path/to/private_key.pem --bundle foo
+
+Where foo has the following structure:
+
+	foo/
+	  |
+	  +-- bar/
+	  |     |
+	  |     +-- data.json
+	  |
+	  +-- policy.rego
+	  |
+	  +-- .manifest
+
+This will create a ".signatures.json" file in the current directory.
+The --output-file-path flag can be used to specify a different location for
+the ".signatures.json" file.
+
+The content of the ".signatures.json" file is shown below:
+
+	{
+	  "signatures": [
+		"eyJhbGciOiJSUzI1NiJ9.eyJmaWxlcyI6W3sibmFtZSI6Ii5tYW5pZmVzdCIsImhhc2giOiIxODc0NWRlNzJjMDFlODBjZDlmNTIwZjQxOGMwMDlhYzRkMmMzZDAyYjE3YTUwZTJkMDQyMTU4YmMzNTJhMzJkIiwiYWxnb3JpdGhtIjoiU0hBLTI1NiJ9LHsibmFtZSI6ImJhci9kYXRhLmpzb24iLCJoYXNoIjoiOTNhMjM5NzFhOTE0ZTVlYWNiZjBhOGQyNTE1NGNkYTMwOWMzYzFjNzJmYmI5OTE0ZDQ3YzYwZjNjYjY4MTU4OCIsImFsZ29yaXRobSI6IlNIQS0yNTYifSx7Im5hbWUiOiJwb2xpY3kucmVnbyIsImhhc2giOiJkMGYyNDJhYWUzNGRiNTRlZjU2NmJlYTRkNDVmY2YxOTcwMGM1ZDhmODdhOWRiOTMyZGZhZDZkMWYwZjI5MWFjIiwiYWxnb3JpdGhtIjoiU0hBLTI1NiJ9XX0.lNsmRqrmT1JI4Z_zpY6IzHRZQAU306PyOjZ6osquixPuTtdSBxgbsdKDcp7Civw3B77BgygVsvx4k3fYr8XCDKChm0uYKScrpFr9_yS6g5mVTQws3KZncZXCQHdupRFoqMS8vXAVgJr52C83AinYWABwH2RYq_B0ZPf_GDzaMgzpep9RlDNecGs57_4zlyxmP2ESU8kjfX8jAA6rYFKeGXJHMD-j4SassoYIzYRv9YkHx8F8Y2ae5Kd5M24Ql0kkvqc_4eO_T9s4nbQ4q5qGHGE-91ND1KVn2avcUyVVPc0-XCR7EH8HnHgCl0v1c7gX1RL7ET7NJbPzfmzQAzk0ZW0dEHI4KZnXSpqy8m-3zAc8kIARm2QwoNEWpy3MWiooPeZVSa9d5iw1aLrbyumfjBP0vCQEPes-Aa6PrARwd5jR9SacO5By0-4emzskvJYRZqbfJ9tXSXDMcAFOAm6kqRPJaj8AO4CyajTC_Lt32_0OLeXqYgNpt3HDqLqGjrb-8fVeQc-hKh0aES8XehQqXj4jMwfsTyj5alsXZm08LwzcFlfQZ7s1kUtmr0_BBNJYcdZUdlu6Qio3LFSRYXNuu6edAO1VH5GKqZISvE1uvDZb2E0Z-rtH-oPp1iSpfvsX47jKJ42LVpI6OahEBri44dzHOIwwm3CIuV8gFzOwR0k"
+	  ]
+	}
+
+And the decoded JWT payload has the following form:
+
+	{
+	  "files": [
+		{
+		  "name": ".manifest",
+		  "hash": "18745de72c01e80cd9f520f418c009ac4d2c3d02b17a50e2d042158bc352a32d",
+		  "algorithm": "SHA-256"
+		},
+		{
+		  "name": "policy.rego",
+		  "hash": "d0f242aae34db54ef566bea4d45fcf19700c5d8f87a9db932dfad6d1f0f291ac",
+		  "algorithm": "SHA-256"
+		},
+		{
+		  "name": "bar/data.json",
+		  "hash": "93a23971a914e5eacbf0a8d25154cda309c3c1c72fbb9914d47c60f3cb681588",
+		  "algorithm": "SHA-256"
+		}
+	  ]
+	}
+
+The "files" field is generated from the files under the directory path(s)
+provided to the 'sign' command. During bundle signature verification, OPA will check
+each file name (ex. "foo/bar/data.json") in the "files" field
+exists in the actual bundle. The file content is hashed using SHA256.
+
+To include additional claims in the payload use the --claims-file flag to provide
+a JSON file containing optional claims.
+
+For more information on the format of the ".signatures.json" file see
+https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format.
+
+
+```
+opa sign <path> [<path> [...]] [flags]
+```
+
+### Options
+
+```
+  -b, --bundle                    load paths as bundle files or root directories
+      --claims-file string        set path of JSON file containing optional claims (see: https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-format)
+  -h, --help                      help for sign
+  -o, --output-file-path string   set the location for the .signatures.json file (default ".")
+      --signing-alg string        name of the signing algorithm (default "RS256")
+      --signing-key string        set the secret (HMAC) or path of the PEM file containing the private key (RSA and ECDSA)
+      --signing-plugin string     name of the plugin to use for signing/verification (see https://www.openpolicyagent.org/docs/latest/management-bundles/#signature-plugin
+```
+
+____
+
+## opa test
+
+Execute Rego test cases
+
+### Synopsis
+
+Execute Rego test cases.
+
+The 'test' command takes a file or directory path as input and executes all
+test cases discovered in matching files. Test cases are rules whose names have the prefix "test_".
+
+If the '--bundle' option is specified the paths will be treated as policy bundles
+and loaded following standard bundle conventions. The path can be a compressed archive
+file or a directory which will be treated as a bundle. Without the '--bundle' flag OPA
+will recursively load ALL *.rego, *.json, and *.yaml files for evaluating the test cases.
+
+Test cases under development may be prefixed "todo_" in order to skip their execution,
+while still getting marked as skipped in the test results.
+
+Example policy (example/authz.rego):
+
+	package authz
+
+	import future.keywords.if
+
+	allow if {
+		input.path == ["users"]
+		input.method == "POST"
+	}
+
+	allow if {
+		input.path == ["users", input.user_id]
+		input.method == "GET"
+	}
+
+Example test (example/authz_test.rego):
+
+	package authz_test
+
+	import data.authz.allow
+
+	test_post_allowed {
+		allow with input as {"path": ["users"], "method": "POST"}
+	}
+
+	test_get_denied {
+		not allow with input as {"path": ["users"], "method": "GET"}
+	}
+
+	test_get_user_allowed {
+		allow with input as {"path": ["users", "bob"], "method": "GET", "user_id": "bob"}
+	}
+
+	test_get_another_user_denied {
+		not allow with input as {"path": ["users", "bob"], "method": "GET", "user_id": "alice"}
+	}
+
+	todo_test_user_allowed_http_client_data {
+		false # Remember to test this later!
+	}
+
+Example test run:
+
+	$ opa test ./example/
+
+If used with the '--bench' option then tests will be benchmarked.
+
+Example benchmark run:
+
+	$ opa test --bench ./example/
+
+The optional "gobench" output format conforms to the Go Benchmark Data Format.
+
+
+```
+opa test <path> [path [...]] [flags]
+```
+
+### Options
+
+```
+      --bench                              benchmark the unit tests
+      --benchmem                           report memory allocations with benchmark results (default true)
+  -b, --bundle                             load paths as bundle files or root directories
+      --capabilities string                set capabilities version or capabilities.json file path
+      --count int                          number of times to repeat each test (default 1)
+  -c, --coverage                           report coverage (overrides debug tracing)
+  -z, --exit-zero-on-skipped               skipped tests return status 0
+      --explain {fails,full,notes,debug}   enable query explanations (default fails)
+  -f, --format {pretty,json,gobench}       set output format (default pretty)
+  -h, --help                               help for test
+      --ignore strings                     set file and directory names to ignore during loading (e.g., '.*' excludes hidden files)
+  -m, --max-errors int                     set the number of errors to allow before compilation fails early (default 10)
+  -r, --run string                         run only test cases matching the regular expression.
+  -t, --target {rego,wasm}                 set the runtime to exercise (default rego)
+      --threshold float                    set coverage threshold and exit with non-zero status if coverage is less than threshold %
+      --timeout duration                   set test timeout (default 5s, 30s when benchmarking)
+  -v, --verbose                            set verbose reporting mode
+```
+
+____
+
+## opa version
+
+Print the version of OPA
+
+### Synopsis
+
+Show version and build information for OPA.
+
+```
+opa version [flags]
+```
+
+### Options
+
+```
+  -c, --check   check for latest OPA release
+  -h, --help    help for version
+```
+
+
diff --git a/docs/content/comparison-to-other-systems.md b/docs/content/comparison-to-other-systems.md
index 3e357b3af4..dc6c3c28f5 100644
--- a/docs/content/comparison-to-other-systems.md
+++ b/docs/content/comparison-to-other-systems.md
@@ -1,7 +1,7 @@
 ---
 title: Comparison to Other Systems
 kind: misc
-weight: 16
+weight: 3
 ---
 
 Often the easiest way to understand a new language is by comparing
@@ -37,7 +37,7 @@ And the following role/permission assignments:
 | ``engineering`` | ``read`` | ``server123`` |
 | ``webdev`` | ``write`` | ``server123`` |
 | ``webdev`` | ``read`` | ``server123`` |
-| ``hr`` | ``write`` | ``database456`` |
+| ``hr`` | ``read`` | ``database456`` |
 
 In this example, RBAC makes the following authorization decisions:
 
@@ -121,7 +121,6 @@ but it does let you express SOD constraints and ask for all SOD violations,
 as shown below.  (Here we assume the statements below are added to the RBAC
 statements above.)
 
-
 ```live:rbac/sod:module:openable
 # Pairs of roles that no user can be assigned to simultaneously
 sod_roles := [
@@ -146,7 +145,6 @@ happen whenever a user is assigned two conflicting roles.  The dynamic version o
 a single user to be assigned two conflicting roles but requires that the same user not
 utilize those roles on the same transaction, which is out of scope for this document.)
 
-
 ## Attribute-based access control (ABAC)
 
 With attribute-based access control, you make policy decisions using the
@@ -157,7 +155,6 @@ It has three main components:
 * Attributes for objects
 * Logic dictating which attribute combinations are authorized
 
-
 For example, we might know the following attributes for our users
 
 * alice
@@ -250,7 +247,6 @@ attributes to anything.  And the attributes can themselves be structured JSON ob
 and have attributes on attributes on attributes, etc.  Because OPA was designed to work
 with arbitrarily nested JSON data, it supports incredibly rich ABAC policies.
 
-
 ## Amazon Web Services IAM
 
 Amazon Web Services (AWS) lets you create policies that can be attached to users, roles, groups,
diff --git a/docs/content/configuration.md b/docs/content/configuration.md
index 02fca91071..fd57052ebe 100644
--- a/docs/content/configuration.md
+++ b/docs/content/configuration.md
@@ -69,6 +69,19 @@ keys:
 caching:
   inter_query_builtin_cache:
     max_size_bytes: 10000000
+
+distributed_tracing:
+  type: grpc
+  address: localhost:4317
+  service_name: opa
+  sample_percentage: 50
+  encryption: "off"
+
+server:
+  encoding:
+    gzip:
+        min_length: 1024,
+        compression_level: 9
 ```
 
 #### Environment Variable Substitution
@@ -81,7 +94,7 @@ Example using `BASE_URL` and `BEARER_TOKEN` environment variables:
 ```yaml
 services:
   acmecorp:
-    url: ${BASE_URL}
+    url: "${BASE_URL}"
     credentials:
       bearer:
         token: "${BEARER_TOKEN}"
@@ -183,6 +196,25 @@ Because the entire `0` index was overwritten.
 
 It is highly recommended to use objects/maps instead of lists for configuration for this reason.
 
+##### Remote Bundles Override Shorthand
+
+When running the server to quickly try a remote public bundle — such as those published from the
+[Rego Playground](https://play.openpolicyagent.org), you may find it convenient to provide the URL of the
+bundle directly, rather than via repeated `--set` flags:
+
+```shell
+opa run -s https://example.com/bundles/bundle.tar.gz
+```
+
+The above shorthand command is identical to:
+
+```shell
+opa run -s --set "services.cli1.url=https://example.com" \
+           --set "bundles.cli1.service=cli1" \
+           --set "bundles.cli1.resource=/bundles/bundle.tar.gz" \
+           --set "bundles.cli1.persist=true"
+```
+
 ###### Empty objects
 If you need to set an empty object with the CLI overrides, for example with plugin configuration like:
 
@@ -245,17 +277,61 @@ multiple services.
 | `services[_].tls.ca_cert` | `string` | No | The path to the root CA certificate.  If not provided, this defaults to TLS using the host's root CA set. |
 | `services[_].tls.system_ca_required` | `bool` | No (default: `false`) | Require system certificate appended with root CA certificate. |
 | `services[_].allow_insecure_tls` | `bool` | No | Allow insecure TLS. |
+| `services[_].type` | `string` | No (default: empty) | Optional parameter that allows to use an "OCI" service type. This will allow bundle and discovery plugins to download bundles from an OCI registry. |
+
+> Services can be defined as an array or object. When defined as an object, the
+> object keys override the `services[_].name` fields.
+> For example:
+> ```yaml
+> services:
+>   s1:
+>     url: https://s1/example/
+>   s2:
+>     url: https://s2/
+> ```
+> Is equivalent to
+> ```yaml
+> services:
+>   - name: s1
+>     url: https://s1/example/
+>   - name: s2
+>     url: https://s2/
+> ```
 
 Each service may optionally specify a credential mechanism by which OPA will authenticate
 itself to the service.
 
+##### Example
+
+Using an OCI service type to download a bundle from an OCI repository.
+
+```yaml
+services:
+  ghcr-registry:
+    url: https://ghcr.io
+    type: oci
+
+bundles:
+  authz:
+    service: ghcr-registry
+    resource: ghcr.io/${ORGANIZATION}/${REPOSITORY}:${TAG}
+    persist: true
+    polling:
+      min_delay_seconds: 60
+      max_delay_seconds: 120
+
+persistence_directory: ${PERSISTENCE_PATH}
+```
+
+When using an OCI service type the downloader uses the persistence path to store the layers of the downloaded repository. This storage path should be maintained by the user.
+If persistence is not configured the OCI downloader will store the layers in the system's temporary directory to allow automatic cleanup on system restart.
+
 #### Bearer Token
 
 OPA will authenticate using the specified bearer token and schema; to enable bearer token
 authentication, either the token or the path to the token must be specified. If the latter is provided, on each request OPA will re-read the token from the file and use that token for authentication.
 
-The schema is optional and will default to `Bearer`
-if unspecified.
+The `scheme` attribute is optional, and will default to `Bearer` if unspecified.
 
 | Field | Type | Required | Description |
 | --- | --- | --- | --- |
@@ -286,6 +362,8 @@ Following successful authentication at the token endpoint the returned token wil
 | `services[_].credentials.oauth2.client_id` | `string` | Yes | The client ID to use for authentication. |
 | `services[_].credentials.oauth2.client_secret` | `string` | Yes | The client secret to use for authentication. |
 | `services[_].credentials.oauth2.scopes` | `[]string` | No | Optional list of scopes to request for the token. |
+| `services[_].credentials.oauth2.additional_headers` | `map` | No | Map of additional headers to send to token endpoint at the OAuth2 authorization server |
+| `services[_].credentials.oauth2.additional_parameters` | `map` | No | Map of additional body parameters to send token endpoint at the OAuth2 authorization server |
 
 #### OAuth2 Client Credentials JWT authentication
 
@@ -396,15 +474,18 @@ Consider requiring authentication in order to prevent unauthorized read access t
 
 #### AWS Signature
 
-OPA will authenticate with an [AWS4 HMAC](https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html) signature. Several methods of obtaining the
-necessary credentials are available; exactly one must be specified to use the AWS signature
-authentication method.
+OPA will authenticate with an [AWS Version 4](https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html) or version 4A signature. While version 4 is the default, version 4A must be used when making requests that might be handled by more than one region, such as an [S3 Multi-Region Access Point](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html). You must use version 4A for this or requests will fail when routed to a different region than the one indicated in a version 4 signature. Furthermore, using version 4a also requires that temporary credentials are retrieved from a [regional AWS STS endpoint](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), rather than the global STS endpoint.
+
+Several methods of obtaining the necessary credentials are available; exactly one must be specified to use the AWS signature authentication method.
 
 The AWS service for which to sign the request can be specified in the `service` field. If omitted, the default is `s3`.
 
-| Field | Type | Required | Description |
-| --- | --- | --- | --- |
-| `services[_].credentials.s3_signing.service` | `string` | No | The AWS service to sign requests with, eg `execute-api` or `s3`. Default: `s3` |
+The AWS signature version to sign the request with can be specified in the `signature_version` field. If omitted, the default is `4`. The only other valid value is `4a`.
+
+| Field                                                  | Type | Required | Description                                                                    |
+|--------------------------------------------------------| --- | --- |--------------------------------------------------------------------------------|
+| `services[_].credentials.s3_signing.service`           | `string` | No | The AWS service to sign requests with, eg `execute-api` or `s3`. Default: `s3` |
+| `services[_].credentials.s3_signing.signature_version` | `string` | No | The AWS signature version to sign requests with, eg `4` or `4a`. Default: `4`  |
 
 ##### Using Static Environment Credentials
 If specifying `environment_credentials`, OPA will expect to find environment variables
@@ -417,7 +498,6 @@ Please note that if you are using temporary IAM credentials (e.g. assumed IAM ro
 | --- | --- | --- | --- |
 | `services[_].credentials.s3_signing.environment_credentials` | `{}` | Yes | Enables AWS signing using environment variables to source the configuration and credentials |
 
-
 ##### Using Named Profile Credentials
 If specifying `profile_credentials`, OPA will expect to find the `access key id`, `secret access key` and
 `session token` from the [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html)
@@ -428,7 +508,7 @@ request OPA will re-read the credentials from the file and use them for authenti
 | --- | --- | --- | --- |
 | `services[_].credentials.s3_signing.profile_credentials.path` | `string` | No | The path to the shared credentials file. If empty, OPA will look for the `AWS_SHARED_CREDENTIALS_FILE` env variable. If the variable is not set, the path defaults to the current user's home directory. `~/.aws/credentials` (Linux & Mac) or `%USERPROFILE%\.aws\credentials` (Windows) |
 | `services[_].credentials.s3_signing.profile_credentials.profile` | `string` | No | AWS Profile to extract credentials from the credentials file. If empty, OPA will look for the `AWS_PROFILE` env variable. If the variable is not set, the `default` profile will be used |
-| `services[_].credentials.s3_signing.metadata_credentials.aws_region` | `string` | No | The AWS region to use for the AWS signing service credential method. If unset, the `AWS_REGION` environment variable must be set |
+| `services[_].credentials.s3_signing.profile_credentials.aws_region` | `string` | No | The AWS region to use for the AWS signing service credential method. If unset, the `AWS_REGION` environment variable must be set |
 
 ##### Using EC2 Metadata Credentials
 If specifying `metadata_credentials`, OPA will use the AWS metadata services for [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)
@@ -441,9 +521,9 @@ be specified as `iam_role` and `aws_region` respectively.
 To use the ECS metadata service, specify only the AWS region for the resource as `aws_region`. ECS
 containers have at most one associated IAM role.
 
-**N.B.** Providing a value for `iam_role` will cause OPA to use the EC2 metadata service even
-if running inside an ECS container. This may result in unexpected problems if, for example,
-there is no route to the EC2 metadata service from inside the container or if the IAM role is only available within the container and not from the hosting EC2 instance.
+> Providing a value for `iam_role` will cause OPA to use the EC2 metadata service even
+> if running inside an ECS container. This may result in unexpected problems if, for example,
+> there is no route to the EC2 metadata service from inside the container or if the IAM role is only available within the container and not from the hosting EC2 instance.
 
 | Field | Type | Required | Description |
 | --- | --- | --- | --- |
@@ -451,32 +531,13 @@ there is no route to the EC2 metadata service from inside the container or if th
 | `services[_].credentials.s3_signing.metadata_credentials.iam_role` | `string` | No | The IAM role to use for the AWS signing service credential method |
 
 ##### Using EKS IAM Roles for Service Account (Web Identity) Credentials
-If specifying `web_identity_credentials`, OPA will expect to find environment variables for `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE`, in accordance with the convention used by the [AWS EKS IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html#pod-configuration).
+If specifying `web_identity_credentials`, OPA will expect to find environment variables for `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE`, in accordance with the convention used by the [AWS EKS IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).
 
 | Field | Type | Required | Description |
 | --- | --- | --- | --- |
 | `services[_].credentials.s3_signing.web_identity_credentials.aws_region` | `string` | Yes | The AWS region to use for the sts regional endpoint. Uses the global endpoint by default |
 | `services[_].credentials.s3_signing.web_identity_credentials.session_name` | `string` | No | The session name used to identify the assumed role session. Default: `open-policy-agent` |
 
-> Services can be defined as an array or object. When defined as an object, the
-> object keys override the `services[_].name` fields.
-> For example:
-```yaml
-services:
-  s1:
-    url: https://s1/example/
-  s2:
-    url: https://s2/
-```
-Is equivalent to
-```yaml
-services:
-  - name: s1
-    url: https://s1/example/
-  - name: s2
-    url: https://s2/
-```
-
 #### GCP Metadata Token
 
 OPA will authenticate with a GCP [access token](https://cloud.google.com/run/docs/securing/service-identity#access_tokens) or [identity token](https://cloud.google.com/run/docs/securing/service-identity) fetched from the [Compute Metadata Server](https://cloud.google.com/compute/docs/storing-retrieving-metadata). When one or more `scopes` is provided an access token is fetched. When a non-empty `audience` is provided an identity token is fetched. An audience or `scopes` array is required.
@@ -538,8 +599,8 @@ bundles:
 
 #### Azure Managed Identities Token
 
-OPA will authenticate with an [Azure managed identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) token. 
-The [token request](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http) 
+OPA will authenticate with an [Azure managed identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) token.
+The [token request](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http)
 can be configured via the plugin to customize the base URL, API version, and resource. Specific managed identity IDs can be optionally provided as well.
 
 | Field | Type | Required | Description |
@@ -547,30 +608,30 @@ can be configured via the plugin to customize the base URL, API version, and res
 | `services[_].credentials.azure_managed_identity.endpoint` | `string` | No | Request endpoint. (default: `http://169.254.169.254/metadata/identity/oauth2/token`, the Azure Instance Metadata Service endpoint (recommended))|
 | `services[_].credentials.azure_managed_identity.api_version` | `string` | No | API version to use. (default: `2018-02-01`, the minimum version) |
 | `services[_].credentials.azure_managed_identity.resource` | `string` | No | App ID URI of the target resource. (default: `https://storage.azure.com/`) |
-| `services[_].credentials.azure_managed_identity.object_id` | `string` | No | Optional object ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identites. |
-| `services[_].credentials.azure_managed_identity.client_id` | `string` | No | Optional client ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identites. |
-| `services[_].credentials.azure_managed_identity.mi_res_id` | `string` | No | Optional Azure Resource ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identites. |
+| `services[_].credentials.azure_managed_identity.object_id` | `string` | No | Optional object ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities. |
+| `services[_].credentials.azure_managed_identity.client_id` | `string` | No | Optional client ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities. |
+| `services[_].credentials.azure_managed_identity.mi_res_id` | `string` | No | Optional Azure Resource ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities. |
 
 ##### Example
 Use an [Azure storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) as a bundle service backend.
 Note that the `x-ms-version` header must be specified for the storage account service, and a minimum version of `2017-11-09` must be provided as per [Azure documentation](https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory#call-storage-operations-with-oauth-tokens).
 
 ```yaml
-services: 
-  azure_storage_account: 
+services:
+  azure_storage_account:
     url: ${STORAGE_ACCOUNT_URL}
     headers:
       x-ms-version: 2017-11-09
     response_header_timeout_seconds: 5
-    credentials: 
+    credentials:
       azure_managed_identity: {}
 
-bundles: 
-  authz: 
+bundles:
+  authz:
     service: azure_storage_account
     resource: bundles/http/example/authz.tar.gz
     persist: true
-    polling: 
+    polling:
       min_delay_seconds: 60
       max_delay_seconds: 120
 ```
@@ -676,6 +737,42 @@ func init() {
 
 ```
 
+### Using private image from OCI repositories
+
+When using a private image from an OCI registry you need to specify an authentication method. Supported authentication methods are listed in the [Services](#services) section. The Azure managed identity plugin
+is not supported at this point in time.
+
+Examples of setting credentials for pulling private images:
+*AWS ECR* private images usually require at least basic authentication. The credentials to authenticate can be obtained using the AWS CLI command `aws ecr get-login` and those can be passed to the service configuration as basic bearer credentials as follows:
+```yaml
+credentials:
+  bearer:
+    scheme: "Basic"
+    token: "<username>:<password>"
+```
+
+Other AWS authentication methods also work:
+```yaml
+credentials:
+  s3_signing:
+    service: "ecr"
+    metadata_credentials:
+      aws_region: us-east-1
+```
+
+Note, that the authentication method `s3_signing` does work for
+signing requests to other AWS services.
+
+A special case is that bearer authentication works differently to normal service authentication. The OCI downloader base64-encodes the credentials for you so that they need to be supplied in plain text.
+
+For *GHCR* (Github Container Registry) you can use a developer PAT (personal access token) when downloading a private image. These can be supplied as:
+```yaml
+credentials:
+  bearer:
+    scheme: "Bearer"
+    token: "<PAT>"
+```
+
 ### Miscellaneous
 
 | Field | Type | Required | Description |
@@ -685,6 +782,7 @@ func init() {
 | `default_authorization_decision` | `string` | No (default: `/system/authz/allow`) | Set path of default authorization decision for OPA's API. |
 | `persistence_directory` | `string` | No (default `$PWD/.opa`) | Set directory to use for persistence with options like `bundles[_].persist`. |
 | `plugins` | `object` | No (default: `{}`) | Location for custom plugin configuration. See [Plugins](../plugins) for details. |
+| `nd_builtin_cache` | `boolean` | No (default: `false`) | Enable the non-deterministic builtins caching system during policy evaluation, and include the contents of the cache in decision logs. Note that decision logs that are larger than `upload_size_limit_bytes` will drop the `nd_builtin_cache` key from the log entry before uploading. |
 
 ### Keys
 
@@ -743,6 +841,7 @@ included in the actual bundle gzipped tarball.
 | `bundles[_].polling.min_delay_seconds` | `int64` | No (default: `60`) | Minimum amount of time to wait between bundle downloads. |
 | `bundles[_].polling.max_delay_seconds` | `int64` | No (default: `120`) | Maximum amount of time to wait between bundle downloads. |
 | `bundles[_].trigger` | `string`  (default: `periodic`) | No | Controls how bundle is downloaded from the remote server. Allowed values are `periodic` and `manual`. |
+| `bundles[_].polling.long_polling_timeout_seconds` | `int64` | No | Maximum amount of time the server should wait before issuing a timeout if there's no update available. |
 | `bundles[_].persist` | `bool` | No | Persist activated bundles to disk. |
 | `bundles[_].signing.keyid` | `string` | No | Name of the key to use for bundle signature verification. |
 | `bundles[_].signing.scope` | `string` | No | Scope to use for bundle signature verification. |
@@ -756,6 +855,7 @@ included in the actual bundle gzipped tarball.
 | `status.service` | `string` | Yes | Name of service to use to contact remote server. |
 | `status.partition_name` | `string` | No | Path segment to include in status updates. |
 | `status.console` | `boolean` | No (default: `false`) | Log the status updates locally to the console. When enabled alongside a remote status update API the `service` must be configured, the default `service` selection will be disabled. |
+| `status.prometheus` | `boolean` | No (default: `false`) | Export the status (bundle and plugin) metrics to prometheus (see [the monitoring documentation](../monitoring/#prometheus)). When enabled alongside a remote status update API the `service` must be configured, the default `service` selection will be disabled. |
 | `status.plugin` | `string` | No | Use the named plugin for status updates. If this field exists, the other configuration fields are not required. |
 | `status.trigger` | `string`  (default: `periodic`) | No | Controls how status updates are reported to the remote server. Allowed values are `periodic` and `manual`. |
 
@@ -772,23 +872,26 @@ included in the actual bundle gzipped tarball.
 | `decision_logs.reporting.min_delay_seconds` | `int64` | No (default: `300`) | Minimum amount of time to wait between uploads. |
 | `decision_logs.reporting.max_delay_seconds` | `int64` | No (default: `600`) | Maximum amount of time to wait between uploads. |
 | `decision_logs.reporting.trigger` | `string` | No (default: `periodic`) | Controls how decision logs are reported to the remote server. Allowed values are `periodic` and `manual`. |
-| `decision_logs.mask_decision` | `string` | No (default: `system/log/mask`) | Set path of masking decision. |
+| `decision_logs.mask_decision` | `string` | No (default: `/system/log/mask`) | Set path of masking decision. |
+| `decision_logs.drop_decision` | `string` | No (default: `/system/log/drop`) | Set path of drop decision. |
 | `decision_logs.plugin` | `string` | No | Use the named plugin for decision logging. If this field exists, the other configuration fields are not required. |
 | `decision_logs.console` | `boolean` | No (default: `false`) | Log the decisions locally to the console. When enabled alongside a remote decision logging API the `service` must be configured, the default `service` selection will be disabled. |
 
 ### Discovery
 
-| Field | Type | Required | Description |
-| --- | --- | --- | --- |
-| `discovery.resource` | `string` | Yes | Resource path to use to download bundle from configured service. |
+| Field | Type | Required | Description                                                                                                                                                 |
+| --- | --- | --- |-------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `discovery.resource` | `string` | Yes | Resource path to use to download bundle from configured service.                                                                                            |
 | `discovery.service` | `string` | No | Name of the service to use to contact remote server. If omitted, the configuration must contain exactly one service. Discovery will default to this service. |
-| `discovery.decision` | `string` | No | The path of the decision to evaluate in the discovery bundle. By default, OPA will evaluate `data` in the discovery bundle to produce the configuration. |
-| `discovery.polling.min_delay_seconds` | `int64` | No (default: `60`) | Minimum amount of time to wait between configuration downloads. |
-| `discovery.polling.max_delay_seconds` | `int64` | No (default: `120`) | Maximum amount of time to wait between configuration downloads. |
-| `discovery.trigger` | `string`  (default: `periodic`) | No | Controls how bundle is downloaded from the remote server. Allowed values are `periodic` and `manual`. |
-| `discovery.signing.keyid` | `string` | No | Name of the key to use for bundle signature verification. |
-| `discovery.signing.scope` | `string` | No | Scope to use for bundle signature verification. |
-| `discovery.signing.exclude_files` | `array` | No | Files in the bundle to exclude during verification. |
+| `discovery.decision` | `string` | No | The path of the decision to evaluate in the discovery bundle. By default, OPA will evaluate `data` in the discovery bundle to produce the configuration.    |
+| `discovery.polling.min_delay_seconds` | `int64` | No (default: `60`) | Minimum amount of time to wait between configuration downloads.                                                                                             |
+| `discovery.polling.max_delay_seconds` | `int64` | No (default: `120`) | Maximum amount of time to wait between configuration downloads.                                                                                             |
+| `discovery.trigger` | `string`  (default: `periodic`) | No | Controls how bundle is downloaded from the remote server. Allowed values are `periodic` and `manual`.                                                       |
+| `discovery.polling.long_polling_timeout_seconds` | `int64` | No | Maximum amount of time the server should wait before issuing a timeout if there's no update available.                                                      |
+| `discovery.signing.keyid` | `string` | No | Name of the key to use for bundle signature verification.                                                                                                   |
+| `discovery.signing.scope` | `string` | No | Scope to use for bundle signature verification.                                                                                                             |
+| `discovery.signing.exclude_files` | `array` | No | Files in the bundle to exclude during verification.                                                                                                         |
+| `discovery.persist` | `bool` | No | Persist activated discovery bundle to disk.                                                                                                                 |
 
 > ⚠️ The plugin trigger mode configured on the discovery plugin will be inherited by the bundle, decision log
 > and status plugins. For example, if the discovery plugin is configured to use the manual trigger mode, all other
@@ -801,3 +904,54 @@ The following `discovery` configuration fields are supported but deprecated:
 | --- | --- | --- | --- |
 | `discovery.prefix` | `string` | No (default: `bundles`) | Deprecated: Use `resource` instead. Path prefix to use to download configuration from remote server. |
 | `discovery.name` | `string` | No | Deprecated: Use `resource` instead. Name of the discovery configuration to download. If `discovery.name` is specified and `discovery.resource` is unset, the `discovery.decision` field will default to the `discovery.name` value. |
+
+### Distributed tracing
+
+Distributed tracing represents the configuration of the OpenTelemetry Tracing.
+
+| Field | Type | Required | Description |
+| --- | --- | --- | --- |
+| `distributed_tracing.type` | `string` | No | Setting this to "grpc" enables distributed tracing with an collector gRPC endpoint |
+| `distributed_tracing.address` | `string` | No (default: `localhost:4317`) | Address of the OpenTelemetry Collector gRPC endpoint. |
+| `distributed_tracing.service_name` | `string` | No (default: `opa`) | Logical name of the service. |
+| `distributed_tracing.sample_percentage` | `int` | No (default: `100`) | Percentage of traces that are sampled and exported. |
+| `distributed_tracing.encryption` | `string` | No (default: `off`) | Configures TLS. |
+| `distributed_tracing.allow_insecure_tls` | `bool` | No (default: `false`) | Allow insecure TLS. |
+| `distributed_tracing.tls_ca_cert_file` | `string` | No | The path to the root CA certificate. |
+| `distributed_tracing.tls_cert_file` | `string` | No (unless `encryption` equals `mtls`) | The path to the client certificate to authenticate with. |
+| `distributed_tracing.tls_private_key_file` | `string` | No (unless `tls_cert_file` provided)  | The path to the private key of the client certificate. |
+
+The following encryption methods are supported:
+
+| Name | Description |
+| --- | --- |
+| `off` | Disable TLS |
+| `tls` | Enable TLS |
+| `mtls` | Enable mutual TLS |
+
+### Disk Storage
+
+The `storage` configuration key allows for enabling, and configuring, the
+persistent on-disk storage of an OPA instance.
+
+If `disk` is set to something, the server will enable the on-disk store
+with data put into the configured `directory`.
+
+| Field | Type | Required | Description |
+| --- | --- | --- | --- |
+| `storage.disk.directory` | `string` | Yes | This is the directory to use for storing the persistent database. |
+| `storage.disk.auto_create` | `bool` | No (default: `false`) | If set to true, the configured directory will be created if it does not exist. |
+| `storage.disk.partitions` | `array[string]` | No | Non-overlapping `data` prefixes used for partitioning the data on disk. |
+| `storage.disk.badger` | `string` | No (default: empty) | "Superflags" passed to Badger allowing to modify advanced options. |
+
+See [the docs on disk storage](../misc-disk/) for details about the settings.
+
+### Server
+
+The `server` configuration sets the gzip compression settings for `/v0/data`, `/v1/data` and `/v1/compile` HTTP `POST` endpoints
+The gzip compression settings are used when the client sends `Accept-Encoding: gzip`
+
+| Field                                    | Type  | Required            | Description                                                                                                                                                                                                                                  |
+|------------------------------------------|-------|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `server.encoding.gzip.min_length`        | `int` | No, (default: 1024) | Specifies the minimum length of the response to compress                                                                                                                                                                                     |
+| `server.encoding.gzip.compression_level` | `int` | No, (default: 9)    | Specifies the compression level. Accepted values: a value of either 0 (no compression), 1 (best speed, lowest compression) or 9 (slowest, best compression). See https://pkg.go.dev/compress/flate#pkg-constants |
diff --git a/docs/content/contrib-adding-builtin-functions.md b/docs/content/contrib-adding-builtin-functions.md
index 7e10440eb4..1d7b6eac41 100644
--- a/docs/content/contrib-adding-builtin-functions.md
+++ b/docs/content/contrib-adding-builtin-functions.md
@@ -8,7 +8,7 @@ weight: 5
 can be added inside the `topdown` package.
 
 Built-in functions may be upstreamed if they are generally useful and provide functionality that would be
-impractical to implement natively in Rego (e.g., CIDR arithmetic). Implementations should avoid thirdparty
+impractical to implement natively in Rego (e.g., CIDR arithmetic). Implementations should avoid third-party
 dependencies. If absolutely necessary, consider importing the code manually into the `internal` package.
 
 {{< info >}}
@@ -18,29 +18,31 @@ Read more about extending OPA with custom built-in functions in go [here](../ext
 Adding a new built-in function involves the following steps:
 
 1. [Declare and register](#declare-and-register) the function
-2. [Implementation](#implement) the function
+2. [Implement](#implement) the function
 3. [Test](#test) the function
 4. [Document](#document) the function
+5. [Add a capability](#add-a-capability) for the function
 
 ## Example
 
-The following example adds a simple built-in function, `repeat(string, int)`, that returns a given string repeated a given number of times.  
+The following example adds a simple built-in function, `repeat(string, int)`, that returns a given string repeated a given number of times.
 
 ### Declare and Register
 
 In `ast/builtins.go`, we declare the structure of our built-in function with a `Builtin` struct instance:
 
 ```go
-// Repeat returns, as a string, the given string repeated the given number of times.
 var Repeat = &Builtin{
-    Name: "repeat",  // The name of the function
-    Decl: types.NewFunction(
-        types.Args(  // The built-in takes two arguments, where ..
-            types.S, // .. the first is a string, and ..
-            types.N, // .. the second is a number.
-        ),
-        types.S, // The return type is a string.
-    ),
+	Name:        "repeat", // The name of the function
+	Description: "Returns, as a string, the given string repeated the given number of times.",
+	Decl: types.NewFunction(
+		types.Args( // The built-in takes two arguments, where ..
+			types.Named("str", types.S).Description("string to repeat"),            // named string argument
+			types.Named("count", types.N).Description("how often to repeat `str`"), // named number argument
+		),
+		types.Named("output", types.S).Description("the repetitions"), // The return type is a string.
+	),
+  Categories: category("strings"), // the category the built-in belongs to
 }
 ```
 
@@ -79,7 +81,7 @@ func builtinRepeat(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term)
         return err
     }
 
-    // Get the first argument as an int, returning an error if it's not the correct type or not a positive value.
+    // Get the second argument as an int, returning an error if it's not the correct type or not a positive value.
     count, err := builtins.IntOperand(operands[1].Value, 2)
     if err != nil {
         return err
@@ -97,12 +99,12 @@ func init() {
 }
 ```
 
-In the above code, `builtinRepeat` implements the `topdown.BuiltinFunc` function type. 
-The call to `RegisterBuiltinFunc(...)` in `init()` adds the built-in function to the evaluation engine; binding the implementation to `ast.Repeat` that was registered in [an earlier step](#register-the-function).
+In the above code, `builtinRepeat` implements the `topdown.BuiltinFunc` function type.
+The call to `RegisterBuiltinFunc(...)` in `init()` adds the built-in function to the evaluation engine; binding the implementation to `ast.Repeat` that was registered in [an earlier step](#declare-and-register).
 
 ### Test
 
-All built-in function implementations must include a test suite. 
+All built-in function implementations must include a test suite.
 Test cases for built-in functions are written in YAML and located under `test/cases/testdata`.
 
 We create two new test cases (one positive, expecting a string output; and one negative, expecting an error) for our built-in function:
@@ -114,8 +116,8 @@ cases:
     modules:
       - |
         package test
-        
-        p = repeated {
+
+        p := repeated {
           repeated := repeat(input.str, input.count)
         }
     input: {"str": "Foo", "count": 3}
@@ -127,7 +129,7 @@ cases:
       - |
         package test
 
-        p = repeated {
+        p := repeated {
           repeated := repeat(input.str, input.count)
         }
     input: { "str": "Foo", "count": -3 }
@@ -141,21 +143,45 @@ The above test cases can be run separate from all other tests through: `go test
 See [test/cases/testdata/helloworld](https://github.com/open-policy-agent/opa/blob/main/test/cases/testdata/helloworld)
 for a more detailed example of how to implement tests for your built-in functions.
 
-> Note: We can manually test our new built-in function by [building](../contrib-development#getting-started) 
-> and running the `eval` command. E.g.: `$./opa_<OS>_<ARCH> eval 'repeat("Foo", 3)'`
+{{< info >}}
+Note: We can manually test our new built-in function by [building](../contrib-development#getting-started)
+and running the `eval` command. E.g.: `$./opa_<OS>_<ARCH> eval 'repeat("Foo", 3)'`
+{{< /info >}}
 
 ### Document
 
-All built-in functions must be documented in `docs/content/policy-reference.md` under an appropriate subsection.
+All built-in functions will automatically be documented in `docs/content/policy-reference.md` under an appropriate subsection.
+
+For this example, we'll get an entry for our new function under the `Strings` section.
+
+### Add a capability
+
+{{< info >}}
+Read more about extending the default capabilities list for built-ins [here](../deployments/#built-ins).
+{{< /info >}}
 
-For this example, we add an entry for our new function under the `Strings` section:
+One of the security features of OPA is [capabilities](../deployments/#capabilities) checks on policies, allowing users to restrict which built-in functions will be available to policies at runtime.
+To ensure that our new `repeat` function will be available to callers, we'll need to add it to the `capabilities.json` file at the root of the repo.
+We can have this entry auto-generated for us by running `make generate`.
 
-```markdown
-### Strings
+After running `make generate` we should see a new JSON object entry in the list under the `"builtins"` key:
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
+```json
 ...
-| <span class="opa-keep-it-together">``output := repeat(string, count)``</span> | ``output`` is ``string`` repeated ``count``times | ``SDK-dependent`` |
+{
+  "name": "repeat",
+  "decl": {
+    "args": [
+      {
+        "type": "string"
+        "type": "number"
+      }
+    ],
+    "result": {
+      "type": "string"
+    },
+    "type": "function"
+  }
+},
 ...
 ```
diff --git a/docs/content/contrib-code.md b/docs/content/contrib-code.md
index 29057242c3..2006f46aee 100644
--- a/docs/content/contrib-code.md
+++ b/docs/content/contrib-code.md
@@ -28,7 +28,7 @@ implementing it inside of the
 `github.com/open-policy-agent/opa/internal` package. The `internal`
 package is not visible outside of OPA.
 
-Avoid adding thirdparty dependencies (vendoring). OPA is designed to be minimal,
+Avoid adding third-party dependencies (vendoring). OPA is designed to be minimal,
 lightweight, and easily embedded. Vendoring may make features _easier_ to
 implement however they come with their own cost for both OPA developers and
 OPA users (e.g., vendoring conflicts, security, debugging, etc.)
@@ -133,6 +133,31 @@ the review process. Use your judgement about what constitutes a small Pull
 Request.  If you aren't sure, send a message to the OPA slack or post a comment
 on the Pull Request.
 
+### Vulnerability scanning
+
+On each Pull Request, a series of tests will be run to ensure that the code
+is up to standard. Part of this process is also to run vulnerability scanning
+on the code and on the generated container image.
+
+[Trivy](https://aquasecurity.github.io/trivy/) is used to run the aforementioned
+vulnerability scanning. To install, follow the [installation instructions](
+https://aquasecurity.github.io/trivy/v0.29.2/getting-started/installation/).
+
+To run the vulnerability scanning, on the code-base, run the following command:
+
+```bash
+$ trivy fs .
+```
+
+To run the vulnerability scanning on the container image, run the following command:
+
+```bash
+$ trivy image <Image tag>
+```
+
+If the tool catches any false positives, it's recommended to appropriately document them
+in the `.trivyignore` file.
+
 ## Contribution process
 
 Small bug fixes (or other small improvements) can be submitted directly via a
@@ -148,5 +173,5 @@ Before submitting large changes, please open an issue on GitHub outlining:
 
 Use your judgement about what constitutes a large change. If you aren't sure,
 send a message in 
-[#development](https://openpolicyagent.slack.com/archives/C02L1TLPN59) on Slack 
+[#contributors](https://openpolicyagent.slack.com/archives/C02L1TLPN59) on Slack 
 or submit [an issue on GitHub](https://github.com/open-policy-agent/opa/issues).
diff --git a/docs/content/contrib-development.md b/docs/content/contrib-development.md
index 42fe3aec17..883efb0898 100644
--- a/docs/content/contrib-development.md
+++ b/docs/content/contrib-development.md
@@ -18,7 +18,8 @@ Requirements:
 
 ## Getting Started
 
-After cloning the repository, just run `make`. This will:
+After forking the repository and creating a [clone from your fork](https://docs.github.com/en/get-started/quickstart/contributing-to-projects),
+just run `make`. This will:
 
 - Build the OPA binary.
 - Run all of the tests.
@@ -81,7 +82,7 @@ git commit -s
 git push origin somefeature
 ```
 
-> Make sure to use a [good commit message](../contributing/#commit-messages).
+> Make sure to use a [good commit message](../contrib-code/#commit-messages).
 
 Now, submit a Pull Request from your fork.
 See the official [GitHub Documentation](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork)
@@ -111,17 +112,17 @@ the results are posted and can be viewed
 ## Dependencies
 
 OPA is a Go module [https://github.com/golang/go/wiki/Modules](https://github.com/golang/go/wiki/Modules)
-and dependencies are tracked with the standard [go.mod](../../go.mod) file.
+and dependencies are tracked with the standard [go.mod](https://github.com/open-policy-agent/opa/blob/main/go.mod) file.
 
-We also keep a full copy of the dependencies in the [vendor](../../vendor)
-directory. All `go` commands from the [Makefile](../../Makefile) will enable
+We also keep a full copy of the dependencies in the [vendor](https://github.com/open-policy-agent/opa/tree/main/vendor)
+directory. All `go` commands from the [Makefile](https://github.com/open-policy-agent/opa/blob/main/Makefile) will enable
 module mode by setting `GO111MODULE=on GOFLAGS=-mod=vendor` which will also
 force using the `vendor` directory.
 
 To update a dependency ensure that `GO111MODULE` is either on, or the repository
 qualifies for `auto` to enable module mode. Then simply use `go get ..` to get
-the version desired. This should update the [go.mod](../../go.mod) and (potentially)
-[go.sum](../../go.sum) files. After this you *MUST* run `go mod vendor` to ensure
+the version desired. This should update the [go.mod](https://github.com/open-policy-agent/opa/blob/main/go.mod) and (potentially)
+[go.sum](https://github.com/open-policy-agent/opa/blob/main/go.sum) files. After this you *MUST* run `go mod vendor` to ensure
 that the `vendor` directory is in sync.
 
 Example workflow for updating a dependency:
@@ -138,7 +139,7 @@ If dependencies have been removed ensure to run `go mod tidy` to clean them up.
 
 Sometimes we use some tools which are versioned and vendored
 with OPA as dependencies. For now, we have none, but any we use in the future
-should go in [tools.go](../../tools.go).
+should go in [tools.go](https://github.com/open-policy-agent/opa/blob/main/tools.go).
 
 More details on the pattern: [https://github.com/go-modules-by-example/index/blob/master/010_tools/README.md](https://github.com/go-modules-by-example/index/blob/master/010_tools/README.md)
 
@@ -153,9 +154,21 @@ files in the root of this repository:
 * `.go-version`- which is used by the Makefile and CI tooling. Put the exact go
   version that OPA should use.
 
+## Refactoring and Style Fixes
+
+If you've found some code that you think would benefit from a refactoring — either by making it more readable or more
+performant, that's great! Some things should however be considered before you submit such a change:
+
+* Avoid mixing bug fixes and feature PRs with refactorings or style fixes. These PRs are generally difficult to review.
+  Instead, split your work up in multiple, separate PRs. If a refactoring is "needed" for a feature, at least ensure to
+  split the two into separate commits.
+* If you intend to work on a larger refactoring project, make sure to first create an issue for discussion. Sometimes
+  things are the way they are for a reason, even when it's not immediately obvious.
+* Ensure that there are tests covering the code subject to change.
+
 ## CI Configuration
 
-OPA uses Github Actions defined in the [.github/workflows](../../.github/workflows)
+OPA uses Github Actions defined in the [.github/workflows](https://github.com/open-policy-agent/opa/tree/main/.github/workflows)
 directory.
 
 ### Github Action Secrets
diff --git a/docs/content/contrib-docs.md b/docs/content/contrib-docs.md
index e1d1629359..e81523f415 100644
--- a/docs/content/contrib-docs.md
+++ b/docs/content/contrib-docs.md
@@ -37,7 +37,7 @@ After the Frontmatter block, each page uses standard markdown formatting. For a
 
 ## Create a local branch
 
-To get started, fork the OPA repository and create a local branch for your Docs changes. Check out the [Development Guide](../development/#fork-clone-create-a-branch) if you need some help setting this up. 
+To get started, fork the OPA repository and create a local branch for your Docs changes. Check out the [Development Guide](../contrib-development/#fork-clone-create-a-branch) if you need some help setting this up. 
 
 ## Update Existing Docs
 
@@ -52,7 +52,7 @@ In the case where you want to add a topic that doesn't fit nicely into any of th
 Once you have made your updates, the next step is to test that they look as expected. To test your changes, generate a local preview with your updated files and preview them with Netlify.
 
 Summary of steps:
-1. Install dependencies: [Hugo](#installing-hugo), [NodeJS](https://nodejs.org), and [Netlify CLI](https://www.netlify.com/products/dev/)
+1. Install dependencies: [Hugo](https://github.com/open-policy-agent/opa/tree/main/docs#installing-hugo), [NodeJS](https://nodejs.org), and [Netlify CLI](https://www.netlify.com/products/dev/)
 1. Build artifacts: `make build`
 1. Generate HTML files: `make docs-serve-local` (*This can take up to 5 min*)
 1. Start preview server: `netlify dev`
@@ -65,4 +65,4 @@ Once you've tested your changes and you're happy with how they look, commit them
 
 ## Having trouble
 
-Reach out in the [#development](https://openpolicyagent.slack.com/archives/C02L1TLPN59) channel to ask for help. 
\ No newline at end of file
+Reach out in the [#contributors](https://openpolicyagent.slack.com/archives/C02L1TLPN59) channel to ask for help. 
\ No newline at end of file
diff --git a/docs/content/contributing.md b/docs/content/contributing.md
index 453fbc7aea..e6b2c67dfe 100644
--- a/docs/content/contributing.md
+++ b/docs/content/contributing.md
@@ -9,7 +9,7 @@ Thanks for your interest in contributing to the Open Policy Agent project!
 ## Where to start?
 
 * Ask for help on the [OPA Discussions Board](https://github.com/open-policy-agent/feedback/discussions)
-* Use [#development](https://openpolicyagent.slack.com/archives/C02L1TLPN59) in Slack to talk to the OPA maintainers and other contributors.
+* Use [#contributors](https://openpolicyagent.slack.com/archives/C02L1TLPN59) in Slack to talk to the OPA maintainers and other contributors.
 * File a [GitHub Issue](https://github.com/open-policy-agent/opa/issues) to request features or report bugs.
 * Join the OPA bi-weekly meetings every other Tuesday at 10:00 (Pacific Timezone):
     * [Meeting Notes](https://docs.google.com/document/d/1v6l2gmkRKAn5UIg3V2QdeeCcXMElxsNzEzDkVlWDVg8/edit?usp=sharing)
diff --git a/docs/content/deployments.md b/docs/content/deployments.md
index f71c444966..7804e97ac8 100644
--- a/docs/content/deployments.md
+++ b/docs/content/deployments.md
@@ -90,7 +90,7 @@ docker run -v $PWD:/example openpolicyagent/opa eval -d /example 'data.example.g
 ```live:docker_hello_world:module:read_only
 package example
 
-greeting = msg {
+greeting := msg {
     info := opa.runtime()
     hostname := info.env["HOSTNAME"] # Docker sets the HOSTNAME environment variable.
     msg := sprintf("hello from container %q!", [hostname])
@@ -154,7 +154,7 @@ we recommend you store it as a Secret.
 ```live:k8s_deployment_hello_world:module:read_only
 package example
 
-greeting = msg {
+greeting := msg {
     info := opa.runtime()
     hostname := info.env["HOSTNAME"] # Kubernetes sets the HOSTNAME environment variable.
     msg := sprintf("hello from pod %q!", [hostname])
@@ -292,7 +292,7 @@ containers:
     httpGet:
       scheme: HTTP              # assumes OPA listens on localhost:8181
       port: 8181
-    initialDelaySeconds: 5      # tune these periods for your environemnt
+    initialDelaySeconds: 5      # tune these periods for your environment
     periodSeconds: 5
   readinessProbe:
     httpGet:
@@ -443,7 +443,9 @@ When passing a capabilities definition file via `--capabilities`, one can restri
 
 Not providing a capabilities file, or providing a file without an `allow_net` key, will permit fetching remote schemas from any host.
 
-Note that the metaschemas http://json-schema.org/draft-04/schema, http://json-schema.org/draft-06/schema, and http://json-schema.org/draft-07/schema, are always available, even without network access.
+Note that the metaschemas [http://json-schema.org/draft-04/schema](http://json-schema.org/draft-04/schema), [http://json-schema.org/draft-06/schema](http://json-schema.org/draft-06/schema), and [http://json-schema.org/draft-07/schema](http://json-schema.org/draft-07/schema), are always available, even without network access.
+
+Similarly, the `allow_net` capability restricts what hosts the `http.send` built-in function may send requests to, and what hosts the `net.lookup_ip_addr` built-in function may resolve IP addresses for.
 
 ### Future keywords
 
@@ -482,7 +484,7 @@ See [the ABI version docs](../wasm/#abi-versions) for details.
 
 ### Building your own capabilities JSON
 
-Use the following JSON structure to build more complex capability checks. 
+Use the following JSON structure to build more complex capability checks.
 
 ```json
 {
@@ -494,11 +496,11 @@ Use the following JSON structure to build more complex capability checks.
 
             "decl": {  // REQUIRED: Built-in function type declaration.
 
-                "type": "function", // REQUIRED: states this is a function 
+                "type": "function", // REQUIRED: states this is a function
 
-                "args": [ // REQUIRED: List of types to be passed in as an arguement: any, number, string, boolean, object, array, set. 
+                "args": [ // REQUIRED: List of types to be passed in as an argument: any, number, string, boolean, object, array, set.
                     {
-                        "type": "number" 
+                        "type": "number"
                     },
                     {
                         "type": "number"
diff --git a/docs/content/docker-authorization.md b/docs/content/docker-authorization.md
index 1756bba9d3..8ce9355eab 100644
--- a/docs/content/docker-authorization.md
+++ b/docs/content/docker-authorization.md
@@ -62,7 +62,7 @@ restart, you will need root access.
 ```live:docker_authz:module:read_only
 package docker.authz
 
-allow = true
+allow := true
 ```
 
 This policy defines a single rule named `allow` that always produces the
@@ -148,7 +148,7 @@ Let’s modify our policy to **deny** all requests:
 ```live:docker_authz_deny_all:module:read_only
 package docker.authz
 
-allow = false
+allow := false
 ```
 
 Rebuild the bundle and save it in the Nginx document root directory.
@@ -174,7 +174,7 @@ The output should be:
 Error response from daemon: authorization denied by plugin opa-docker-authz: request rejected by administrative policy
 ```
 
-To learn more about how rules define the content of documents, see: [How Does OPA Work?](../#how-does-opa-work)
+To learn more about how rules define the content of documents, see: [How Does OPA Work?](../#overview)
 
 With this policy in place, users will not be able to run any Docker commands. Go
 ahead and try other commands such as `docker run` or `docker pull`. They will
@@ -189,7 +189,7 @@ Now let's change the policy so that it's a bit more useful.
 ```live:docker_authz_deny_unconfined:module:openable
 package docker.authz
 
-default allow = false
+default allow := false
 
 allow {
     not deny
@@ -389,7 +389,7 @@ EOF
 ```live:docker_authz_users:module:read_only,openable
 package docker.authz
 
-default allow = false
+default allow := false
 
 # allow if the user is granted read/write access.
 allow {
diff --git a/docs/content/ecosystem.html b/docs/content/ecosystem.html
index ba6c00a5b8..91d82869d5 100644
--- a/docs/content/ecosystem.html
+++ b/docs/content/ecosystem.html
@@ -1,7 +1,7 @@
 ---
 title: "Ecosystem"
-kind: misc
-weight: 10
+kind: support
+weight: 2
 layout: ecosystem
 ---
 
diff --git a/docs/content/editor-and-ide-support.md b/docs/content/editor-and-ide-support.md
index 1f8ec90272..549465deae 100644
--- a/docs/content/editor-and-ide-support.md
+++ b/docs/content/editor-and-ide-support.md
@@ -1,7 +1,7 @@
 ---
 title: Editor and IDE Support
 kind: misc
-weight: 11
+weight: 2
 ---
 
 OPA can be integrated into editors and IDEs to provide features like syntax highlighting, query
diff --git a/docs/content/envoy-introduction.md b/docs/content/envoy-introduction.md
index 8651efbc0c..9cd5906e48 100644
--- a/docs/content/envoy-introduction.md
+++ b/docs/content/envoy-introduction.md
@@ -42,13 +42,18 @@ availability) in order to perform the authorization check.
 
 The OPA-Envoy plugin supports the following configuration fields:
 
-| Field                                               | Required | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| --------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `plugins["envoy_ext_authz_grpc"].addr`              | No       | Set listening address of Envoy External Authorization gRPC server. This must match the value configured in the Envoy config. Default: `:9191`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `plugins["envoy_ext_authz_grpc"].path`              | No       | Specifies the hierarchical policy decision path. The policy decision can either be a `boolean` or an `object`. If boolean, `true` indicates the request should be allowed and `false` indicates the request should be denied. If the policy decision is an object, it **must** contain the `allowed` key set to either `true` or `false` to indicate if the request is allowed or not respectively. It can optionally contain a `headers` field to send custom headers to the downstream client or upstream. An optional `body` field can be included in the policy decision to send a response body data to the downstream client. Also an optional `http_status` field can be included to send a HTTP response status code to the downstream client other than `403 (Forbidden)`. Default: `envoy/authz/allow`. |
-| `plugins["envoy_ext_authz_grpc"].dry-run`           | No       | Configures the Envoy External Authorization gRPC server to unconditionally return an `ext_authz.CheckResponse.Status` of `google_rpc.Status{Code: google_rpc.OK}`. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Field                              | Required | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ---------------------------------- | -------- |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `plugins["envoy_ext_authz_grpc"].addr` | No       | Set listening address of Envoy External Authorization gRPC server. This must match the value configured in the Envoy config. Default: `:9191`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `plugins["envoy_ext_authz_grpc"].path` | No       | Specifies the hierarchical policy decision path. The policy decision can either be a `boolean` or an `object`. If boolean, `true` indicates the request should be allowed and `false` indicates the request should be denied. If the policy decision is an object, it **must** contain the `allowed` key set to either `true` or `false` to indicate if the request is allowed or not respectively. It can optionally contain a `headers` field to send custom headers to the downstream client or upstream. An optional `body` field can be included in the policy decision to send a response body data to the downstream client. Also an optional `http_status` field can be included to send a HTTP response status code to the downstream client other than `403 (Forbidden)`. Default: `envoy/authz/allow`. |
+| `plugins["envoy_ext_authz_grpc"].dry-run` | No       | Configures the Envoy External Authorization gRPC server to unconditionally return an `ext_authz.CheckResponse.Status` of `google_rpc.Status{Code: google_rpc.OK}`. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `plugins["envoy_ext_authz_grpc"].enable-reflection` | No       | Enables gRPC server reflection on the Envoy External Authorization gRPC server. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `plugins["envoy_ext_authz_grpc"].proto-descriptor`  | No       | Set the path to a pb that enables the capability to decode the raw body to the parsed body. Default: turns this capability off.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `plugins["envoy_ext_authz_grpc"].proto-descriptor` | No       | Set the path to a pb that enables the capability to decode the raw body to the parsed body. Default: turns this capability off.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `plugins["envoy_ext_authz_grpc"].grpc-max-recv-msg-size` | No       | Set the max message size in bytes the gRPC server can receive. Defaults to 4MB.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `plugins["envoy_ext_authz_grpc"].grpc-max-send-msg-size` | No       | Set the max message size in bytes the gRPC server can send. Defaults to 2048MB.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `plugins["envoy_ext_authz_grpc"].skip-request-body-parse` | No       | Specifies if the plugin should skip parsing the input request body. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+
+
 
 If the configuration does not specify the `path` field, `envoy/authz/allow` will be considered as the default policy
 decision path. `data.envoy.authz.allow` will be the name of the policy decision to query in the default case.
diff --git a/docs/content/envoy-performance.md b/docs/content/envoy-performance.md
index 0e21b6ed17..f38405463f 100644
--- a/docs/content/envoy-performance.md
+++ b/docs/content/envoy-performance.md
@@ -12,15 +12,15 @@ benchmarking scenarios and important metrics that should be captured to understa
 
 #### Sample App
 
-The first component of the setup features a simple Go app which provides information about employees in a company. It 
+The first component of the setup features a simple Go app which provides information about employees in a company. It
 exposes a `/people` endpoint to `get` and `create` employees. The app's source code can be found [here](https://github.com/ashutosh-narkar/go-test-server).
 
 #### Envoy
-  
+
 Next, is the Envoy proxy that runs alongside the example application. The Envoy configuration below defines an external authorization
 filter `envoy.ext_authz` for a gRPC authorization server. The config uses Envoy’s in-built gRPC client which
 is a minimal custom implementation of gRPC to make the external gRPC call.
-  
+
 ```yaml
 static_resources:
   listeners:
@@ -178,7 +178,7 @@ Envoy will make a call to OPA on every incoming request with the below NOP polic
 ```live:nop_example:module:read_only
 package envoy.authz
 
-default allow = true
+default allow := true
 ```
 
 * **App, Envoy and OPA (RBAC policy)**
@@ -191,7 +191,7 @@ package envoy.authz
 
 import input.attributes.request.http as http_request
 
-default allow = false
+default allow := false
 
 allow {
     roles_for_user[r]
@@ -208,7 +208,7 @@ required_roles[r] {
     perm.path == http_request.path
 }
 
-user_name = parsed {
+user_name := parsed {
     [_, encoded] := split(http_request.headers.authorization, " ")
     [parsed, _] := split(base64url.decode(encoded), ":")
 }
@@ -258,4 +258,4 @@ leveraged to measure this.
 The sample OPA-Envoy deployment described [previously](#opa-envoy-plugin), does not utilize OPA's [decision logs](https://www.openpolicyagent.org/docs/latest/management-decision-logs/)
 management API that enables periodic reporting of decision logs to remote HTTP servers or local console. Decision logging
 can be enabled by updating the OPA-Envoy configuration, and the guidance provided on this page can be used to
-gather benchmark results.
\ No newline at end of file
+gather benchmark results.
diff --git a/docs/content/envoy-primer.md b/docs/content/envoy-primer.md
index ecfc512a65..e2202ada22 100644
--- a/docs/content/envoy-primer.md
+++ b/docs/content/envoy-primer.md
@@ -14,36 +14,37 @@ Let's start with an example policy that restricts access to an endpoint based on
 
 ```live:bool_example:module:openable
 package envoy.authz
+import future.keywords
 
 import input.attributes.request.http
 
-default allow = false
+default allow := false
 
-allow {
+allow if {
     is_token_valid
     action_allowed
 }
 
-is_token_valid {
+is_token_valid if {
     token.valid
     now := time.now_ns() / 1000000000
     token.payload.nbf <= now
     now < token.payload.exp
 }
 
-action_allowed {
+action_allowed if {
     http.method == "GET"
     token.payload.role == "guest"
     glob.match("/people/*", ["/"], http.path)
 }
 
-action_allowed {
+action_allowed if {
     http.method == "GET"
     token.payload.role == "admin"
     glob.match("/people/*", ["/"], http.path)
 }
 
-action_allowed {
+action_allowed if {
     http.method == "POST"
     token.payload.role == "admin"
     glob.match("/people", ["/"], http.path)
@@ -51,7 +52,7 @@ action_allowed {
 }
 
 
-token := {"valid": valid, "payload": payload} {
+token := {"valid": valid, "payload": payload} if {
     [_, encoded] := split(http.headers.authorization, " ")
     [valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
 }
@@ -97,34 +98,81 @@ With the input value above, the answer is:
 ```live:bool_example:output
 ```
 
-### Example Policy with Object Response
+## Example Policy with Additional Controls
 
-The `allow` rule in the above policy returns a `boolean` decision to indicate whether a request should be allowed or not.
-If you'd like your rule to not only indicate if a request is allowed or not but also provide optional response headers,
-body and HTTP status that can be sent to the downstream client or upstream, the below `allow` rule generates an `object`
-that provides additional details along with the status of the request (ie. `allowed` or `denied`).
+The `allow` variable in the above policy returns a `boolean` decision to indicate whether a request should be allowed or not.
+If you want, you can also control the HTTP status sent to the upstream or downstream client, along with the response body, and the response headers.  To do that, you can write rules like the ones below to fill in values for variables with the following types:
+
+* `headers` is an object whose keys are strings and values are strings. In case the request is denied, the object represents the HTTP response headers to be sent to the downstream client. If the request is allowed, the object represents additional request headers to be sent to the upstream.
+* `response_headers_to_add` is an object whose keys are strings and values are strings. It defines the HTTP response headers to be sent to the downstream client when a request is allowed.
+* `request_headers_to_remove` is an array of strings which describes the HTTP headers to remove from the original request before dispatching it to the upstream when a request is allowed.
+* `body` is a string which represents the response body data sent to the downstream client when a request is denied.
+* `status_code` is a number which represents the HTTP response status code sent to the downstream client when a request is denied.
 
 ```live:obj_example:module:openable
 package envoy.authz
+import future.keywords
+
+import input.attributes.request.http
 
-default allow = {
-    "allowed": false,
-    "headers": {"x-ext-auth-allow": "no"},
-    "body": "Unauthorized Request",
-    "http_status": 301
+default allow := false
+
+allow if {
+    is_token_valid
+    action_allowed
 }
 
-allow = response {
-    input.attributes.request.http.method == "GET"
-    response := {
-        "allowed": true,
-        "headers": {"x-ext-auth-allow": "yes"}
-    }
+headers["x-ext-auth-allow"] := "yes"
+headers["x-validated-by"] := "security-checkpoint"
+
+request_headers_to_remove := ["one-auth-header", "another-auth-header"]
+
+response_headers_to_add["x-foo"] := "bar"
+
+status_code := 200 if {
+  allow
+} else := 401 {
+  not is_token_valid
+} else := 403
+
+body := "Authentication Failed" if status_code == 401
+body := "Unauthorized Request"  if status_code == 403
+
+is_token_valid if {
+    token.valid
+    now := time.now_ns() / 1000000000
+    token.payload.nbf <= now
+    now < token.payload.exp
+}
+
+action_allowed if {
+    http.method == "GET"
+    token.payload.role == "guest"
+    glob.match("/people/*", ["/"], http.path)
+}
+
+action_allowed if {
+    http.method == "GET"
+    token.payload.role == "admin"
+    glob.match("/people/*", ["/"], http.path)
+}
+
+action_allowed if {
+    http.method == "POST"
+    token.payload.role == "admin"
+    glob.match("/people", ["/"], http.path)
+    lower(input.parsed_body.firstname) != base64url.decode(token.payload.sub)
+}
+
+
+token := {"valid": valid, "payload": payload} if {
+    [_, encoded] := split(http.headers.authorization, " ")
+    [valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
 }
 ```
 
 ```live:obj_example:query:hidden
-data.envoy.authz.allow
+data.envoy.authz
 ```
 
 Sample input received by OPA is shown below:
@@ -145,12 +193,36 @@ Sample input received by OPA is shown below:
 }
 ```
 
-With the input value above, the answer is:
+With the input value above, the value of all the variables in the package are:
 
 ```live:obj_example:output
 ```
 
-### Input Document
+## Output Document
+
+When Envoy receives a policy decision, it expects a JSON object with the following fields:
+* `allowed` (required): a boolean deciding whether or not the request is allowed
+* `headers` (optional): an object mapping a string header name to a string header value (e.g. key "x-ext-auth-allow" has value "yes")
+* `response_headers_to_add` (optional): an object mapping a string header name to a string header value
+* `request_headers_to_remove` (optional): is an array of string header names
+* `http_status` (optional): a number representing the HTTP status code
+* `body` (optional): the response body
+
+To construct that output object using the policies demonstrated in the last section, you can use the following Rego snippet.  Notice that we are using partial object rules so that any variables with undefined values simply have no key in the `result` object.
+
+```rego
+result["allowed"] := allow
+result["headers"] := headers
+result["response_headers_to_add"] := response_headers_to_add
+result["request_headers_to_remove"] := request_headers_to_remove
+result["body"] := body
+result["http_status"] := status_code
+```
+
+For a single user, including this snippet in your normal policy is fine, but when you have multiple teams writing policies, you will typically pull this bit of boilerplate into a wrapper package, so your teams can focus on writing the policies shown in the previous sections.
+
+
+## Input Document
 
 In OPA, `input` is a reserved, global variable whose value is the request sent by the Envoy External Authorization filter
 to OPA. The OPA-Envoy plugin supports both [v2](https://www.envoyproxy.io/docs/envoy/latest/api-v2/service/auth/v2/external_auth.proto#service-auth-v2-checkrequest)
@@ -231,9 +303,9 @@ http_filters:
         target_uri: "127.0.0.1:9191"
 ```
 
-#### Example Input
+### Example Input
 
-<details><summary>Example v3 Input</summary>
+{{<detail-tag "Example v3 Input">}}
 ```json
 {
   "attributes": {
@@ -289,9 +361,9 @@ http_filters:
   }
 }
 ```
-</details>
+{{</detail-tag>}}
 
-<details><summary>Example v2 Input</summary>
+{{<detail-tag "Example v2 Input">}}
 ```json
 {
   "attributes":{
@@ -353,7 +425,7 @@ http_filters:
   }
 }
 ```
-</details>
+{{</detail-tag>}}
 
 The `parsed_path` field in the input is generated from the `path` field in the HTTP request which is included in the
 Envoy External Authorization `CheckRequest` message type. This field provides the request path as a string array which
@@ -362,12 +434,11 @@ access the path `/people`.
 
 ```live:parsed_path_example:module:read_only
 package envoy.authz
+import future.keywords
 
-default allow = false
+default allow := false
 
-allow {
-    input.parsed_path == ["people"]
-}
+allow if input.parsed_path == ["people"]
 ```
 
 The `parsed_query` field in the input is also generated from the `path` field in the HTTP request. This field provides
@@ -376,10 +447,11 @@ the HTTP URL query as a map of string array. The below sample policy allows anyo
 
 ```live:parsed_query_example:module:read_only
 package envoy.authz
+import future.keywords
 
-default allow = false
+default allow := false
 
-allow {
+allow if {
     input.parsed_path == ["people"]
     input.parsed_query.lang == ["en"]
     input.parsed_query.id == ["1", "2"]
@@ -392,10 +464,11 @@ can then be used in a policy as shown below.
 
 ```live:parsed_body_example:module:read_only
 package envoy.authz
+import future.keywords
 
-default allow = false
+default allow := false
 
-allow {
+allow if {
     input.parsed_body.firstname == "Charlie"
     input.parsed_body.lastname == "Opa"
 }
@@ -404,6 +477,9 @@ allow {
 The `truncated_body` field in the input represents if the HTTP request body is truncated. The body is considered to be
 truncated, if the value of the `Content-Length` header exceeds the size of the request body.
 
+If `skip-request-body-parse: true` is specified in the OPA-Envoy [configuration](../envoy-introduction#configuration), then
+the `parsed_body` and `truncated_body` fields will be omitted from the input.
+
 ## Example with JWT payload passed from Envoy
 
 Envoy can be configured to pass validated JWT payload data into the `ext_authz` filter with `metadata_context_namespaces`
diff --git a/docs/content/envoy-tutorial-gloo-edge.md b/docs/content/envoy-tutorial-gloo-edge.md
new file mode 100644
index 0000000000..66e4cefa0a
--- /dev/null
+++ b/docs/content/envoy-tutorial-gloo-edge.md
@@ -0,0 +1,341 @@
+---
+title: "Tutorial: Gloo Edge"
+kind: envoy
+weight: 11
+---
+
+[Gloo Edge](https://docs.solo.io/gloo-edge/latest/) is an Envoy based API Gateway that provides a Kubernetes CRD to manage Envoy configuration for performing traffic management and routing.
+
+Gloo Edge allows creation of a [Custom External Auth Service](https://docs.solo.io/gloo-edge/master/guides/security/auth/custom_auth/) that implements the Envoy spec for an [External Authorization Server](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ext_authz_filter.html).
+
+The purpose of this tutorial is to show how OPA could be used with Gloo Edge to apply security policies for upstream services.
+
+## Prerequisites
+
+This tutorial requires Kubernetes 1.14 or later. To run the tutorial locally, we recommend using [minikube](https://minikube.sigs.k8s.io/docs/start/) in version v1.0+ with Kubernetes 1.14+.
+
+The tutorial also requires [Helm](https://helm.sh/docs/intro/install/) to install Gloo Edge on a Kubernetes cluster.
+
+## Steps
+
+### 1. Start Minikube
+
+```bash
+minikube start
+```
+
+### 2. Setup and Configure Gloo Edge
+
+```bash
+helm repo add gloo https://storage.googleapis.com/solo-public-helm
+helm upgrade --install --namespace gloo-system --create-namespace gloo gloo/gloo
+kubectl config set-context $(kubectl config current-context) --namespace=gloo-system
+```
+
+Ensure all the pods are running using `kubectl get pod` command.
+
+### 3. Create Virtual Service and Upstream
+
+[Virtual Services](https://docs.solo.io/gloo-edge/latest/introduction/architecture/concepts/#virtual-services) define a set of route rules, security configuration, rate limiting, transformations, and other core routing capabilities supported by Gloo Edge.
+
+[Upstreams](https://docs.solo.io/gloo-edge/latest/introduction/architecture/concepts/#upstreams) define destinations for routes.
+
+Save the configuration as **vs.yaml**.
+
+```yaml
+apiVersion: gloo.solo.io/v1
+kind: Upstream
+metadata:
+  name: httpbin
+spec:
+  static:
+    hosts:
+      - addr: httpbin.org
+        port: 80
+---
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: httpbin
+spec:
+  virtualHost:
+    domains:
+      - '*'
+    routes:
+      - matchers:
+         - prefix: /
+        routeAction:
+          single:
+            upstream:
+              name: httpbin
+              namespace: gloo-system
+        options:
+          autoHostRewrite: true
+```
+
+```bash
+kubectl apply -f vs.yaml
+```
+
+### 4. Test Gloo
+
+For simplification port-forwarding will be used. Open another terminal and execute.
+
+```bash
+kubectl port-forward deployment/gateway-proxy 8080:8080
+```
+
+The `VirtualService` created in the previous step forwards requests to http://httpbin.org
+
+Let's test that Gloo works properly by running the below command in the first terminal.
+
+```bash
+curl -XGET -Is localhost:8080/get | head -n 1
+HTTP/1.1 200 OK
+
+curl http -XPOST -Is localhost:8080/post | head -n1
+HTTP/1.1 200 OK
+```
+
+### 5. Define an OPA Policy
+
+The following OPA policy will work as follows:
+
+* Alice is granted a **guest** role and can perform `GET` requests.
+* Bob is granted an **admin** role and can perform `GET` and `POST` requests.
+
+**policy.rego**
+
+```live:example:module:openable
+package envoy.authz
+
+import future.keywords
+
+import input.attributes.request.http as http_request
+
+default allow := false
+
+allow if {
+	is_token_valid
+	action_allowed
+}
+
+is_token_valid if {
+	token.valid
+	now := time.now_ns() / 1000000000
+	token.payload.nbf <= now
+	now < token.payload.exp
+}
+
+action_allowed if {
+	http_request.method == "GET"
+	token.payload.role == "guest"
+}
+
+action_allowed if {
+	http_request.method == "GET"
+	token.payload.role == "admin"
+}
+
+action_allowed if {
+	http_request.method == "POST"
+	token.payload.role == "admin"
+}
+
+token := {"valid": valid, "payload": payload} if {
+	[_, encoded] := split(http_request.headers.authorization, " ")
+	[valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
+}
+```
+
+A sample input can be seen below using Alice's token, Alice should be able to `GET` but not `POST`
+
+```live:example:input
+{
+  "attributes": {
+    "request": {
+      "http": {
+        "method": "GET",
+        "headers": {
+          "authorization": "Bearer eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJleHAiOiAyMjQxMDgxNTM5LCAibmJmIjogMTUxNDg1MTEzOSwgInJvbGUiOiAiZ3Vlc3QiLCAic3ViIjogIllXeHBZMlU9In0.Uk5hgUqMuUfDLvBLnlXMD0-X53aM_Hlziqg3vhOsCc8"
+        }
+      }
+    }
+  }
+}
+```
+
+With the input value above, the answer is:
+
+```live:example:output
+```
+
+Next we build an OPA bundle.
+
+```bash
+opa build policy.rego
+```
+
+And now we serve the OPA bundle created above using Nginx.
+
+```bash
+docker run --rm --name bundle-server -d -p 8888:80 -v ${PWD}:/usr/share/nginx/html:ro nginx:latest
+```
+
+### 6. Setup OPA-Envoy
+
+Create a deployment as shown below and save it in **deployments.yaml**
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opa
+  labels:
+    app: opa
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: opa
+  template:
+    metadata:
+      labels:
+        app: opa
+    spec:
+      containers:
+      - name: opa
+        image: openpolicyagent/opa:{{< current_opa_envoy_docker_version >}}
+        volumeMounts:
+          - readOnly: true
+            mountPath: /policy
+            name: opa-policy
+        args:
+          - "run"
+          - "--server"
+          - "--addr=0.0.0.0:8181"
+          - "--set=services.default.url=http://host.minikube.internal:8888"
+          - "--set=bundles.default.resource=bundle.tar.gz"
+          - "--set=plugins.envoy_ext_authz_grpc.addr=0.0.0.0:9191"
+          - "--set=plugins.envoy_ext_authz_grpc.path=envoy/authz/allow"
+          - "--set=decision_logs.console=true"
+          - "--set=status.console=true"
+          - "--ignore=.*"
+      volumes:
+      - name: opa-policy
+```
+
+```bash
+kubectl apply -f deployments.yaml
+```
+
+Ensure all pods are running using `kubectl get pod` command.
+
+Next, define a Kubernetes `service` for OPA-Envoy. This is required to create a DNS record and thereby create a Gloo `Upstream` object.
+
+**service.yaml**
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: opa
+spec:
+  selector:
+    app: opa
+  ports:
+    - name: grpc
+      protocol: TCP
+      port: 9191
+      targetPort: 9191
+```
+**Note**: Since the name of the service port is `grpc`, `Gloo` will understand that traffic should be routed using HTTP2 protocol.
+
+`kubectl apply -f service.yaml`
+
+### 7. Configure Gloo Edge to use OPA
+
+To use OPA as a custom auth server, we need to add the `extauth` attribute as described below:
+
+**gloo.yaml**
+
+```yaml
+global:
+  extensions:
+    extAuth:
+      extauthzServerRef:
+        name: gloo-system-opa-9191
+        namespace: gloo-system
+```
+
+To apply it, run the following command:
+
+```bash
+helm upgrade --install --namespace gloo-system --create-namespace -f gloo.yaml gloo gloo/gloo
+```
+
+Configure Gloo Edge routes to perform authorization via configured extauth before regular processing.
+
+**vs-patch.yaml**
+
+```yaml
+spec:
+  virtualHost:
+    options:
+      extauth:
+        customAuth: {}
+```
+
+Then apply the patch to our `VirtualService` as shown below:
+
+```bash
+kubectl patch vs httpbin --type=merge --patch "$(cat vs-patch.yaml)"
+```
+
+### 8. Exercise the OPA Policy
+
+Before we exercise the policy, for convenience sake, we will want to store Alice and Bob's tokens in environment variables as such:
+
+```bash
+export ALICE_TOKEN="eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJleHAiOiAyMjQxMDgxNTM5LCAibmJmIjogMTUxNDg1MTEzOSwgInJvbGUiOiAiZ3Vlc3QiLCAic3ViIjogIllXeHBZMlU9In0.Uk5hgUqMuUfDLvBLnlXMD0-X53aM_Hlziqg3vhOsCc8"
+export BOB_TOKEN="eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJleHAiOiAyMjQxMDgxNTM5LCAibmJmIjogMTUxNDg1MTEzOSwgInJvbGUiOiAiYWRtaW4iLCAic3ViIjogIlltOWkifQ.5qsm7rRTvqFHAgiB6evX0a_hWnGbWquZC0HImVQPQo8"
+```
+
+Now let's verify that OPA only allows **Alice** to perform `GET` requests.
+
+```bash
+curl -XGET -Is -H "Authorization: Bearer $ALICE_TOKEN" localhost:8080/get
+HTTP/1.1 200 OK
+```
+And with a `POST` request, we get:
+
+```bash
+curl http -XPOST -Is -H "Authorization: Bearer $ALICE_TOKEN" localhost:8080/post
+HTTP/1.1 403 Forbidden
+```
+
+And for **Bob**, we should be able to `GET` and `POST`:
+
+```bash
+curl -XGET -Is -H "Authorization: Bearer $BOB_TOKEN" localhost:8080/get    
+HTTP/1.1 200 OK
+```
+
+And the `POST`:
+
+```bash
+curl http -XPOST -Is -H "Authorization: Bearer $BOB_TOKEN" localhost:8080/post
+HTTP/1.1 200 OK
+```
+
+Check OPA's decision logs to view the inputs received by OPA from Gloo Edge and the results generated by OPA.
+
+```bash
+kubectl logs deployment/opa -n gloo-system
+```
+
+## Wrap Up
+
+Congratulations for finishing the tutorial!
+
+This tutorial showed how you can use OPA with [Gloo Edge](https://docs.solo.io/gloo-edge/latest/) to apply security policies for upstream services and how to create and test a policy that would allow `GET` or `POST` requests based on your user role.
\ No newline at end of file
diff --git a/docs/content/envoy-tutorial-istio.md b/docs/content/envoy-tutorial-istio.md
index 36a4ed0433..808a5001a7 100644
--- a/docs/content/envoy-tutorial-istio.md
+++ b/docs/content/envoy-tutorial-istio.md
@@ -39,56 +39,56 @@ The `quick_start.yaml` manifest defines the following resources:
 
 * OPA configuration file and an OPA policy into ConfigMaps in the namespace where the app will be deployed, e.g., `default`.
   The following is the example OPA policy:
-        
+
     * alice is granted a **guest** role and can perform a `GET` request to `/productpage`.
     * bob is granted an **admin** role and can perform a `GET` to `/productpage` and `/api/v1/products`.
 
     ```live:example:module:openable
     package istio.authz
-  
+    
+    import future.keywords
+    
     import input.attributes.request.http as http_request
     import input.parsed_path
     
-    default allow = false
+    default allow := false
     
-    allow {
-        parsed_path[0] == "health"
-        http_request.method == "GET"
+    allow if {
+    	parsed_path[0] == "health"
+    	http_request.method == "GET"
     }
     
-    allow {
-        roles_for_user[r]
-        required_roles[r]
+    allow if {
+    	some r in roles_for_user
+    	r in required_roles
     }
     
-    roles_for_user[r] {
-        r := user_roles[user_name][_]
+    roles_for_user contains r if {
+    	some r in user_roles[user_name]
     }
     
-    required_roles[r] {
-        perm := role_perms[r][_]
-        perm.method == http_request.method
-        perm.path == http_request.path
+    required_roles contains r if {
+    	some perm in role_perms[r]
+    	perm.method == http_request.method
+    	perm.path == http_request.path
     }
     
-    user_name = parsed {
-        [_, encoded] := split(http_request.headers.authorization, " ")
-        [parsed, _] := split(base64url.decode(encoded), ":")
+    user_name := parsed if {
+    	[_, encoded] := split(http_request.headers.authorization, " ")
+    	[parsed, _] := split(base64url.decode(encoded), ":")
     }
     
     user_roles := {
-        "alice": ["guest"],
-        "bob": ["admin"]
+    	"alice": ["guest"],
+    	"bob": ["admin"],
     }
     
     role_perms := {
-        "guest": [
-            {"method": "GET",  "path": "/productpage"},
-        ],
-        "admin": [
-            {"method": "GET",  "path": "/productpage"},
-            {"method": "GET",  "path": "/api/v1/products"},
-        ],
+    	"guest": [{"method": "GET", "path": "/productpage"}],
+    	"admin": [
+    		{"method": "GET", "path": "/productpage"},
+    		{"method": "GET", "path": "/api/v1/products"},
+    	],
     }
     ```
 
@@ -99,7 +99,7 @@ The `quick_start.yaml` manifest defines the following resources:
     ```live:example:query:hidden
     data.istio.authz.allow
     ```
-  
+
     ```live:example:input
     {
         "attributes": {
@@ -117,7 +117,7 @@ The `quick_start.yaml` manifest defines the following resources:
     ```
 
     With the input value above, the answer is:
-    
+
     ```live:example:output
     ```
 
@@ -127,7 +127,7 @@ The `quick_start.yaml` manifest defines the following resources:
     > image or it would fetched dynamically via the [Bundle
     > API](https://www.openpolicyagent.org/docs/latest/bundles/). ConfigMaps are
     > used in this tutorial for test purposes.
-  
+
 ### 2. Enable automatic injection of the Istio Proxy and OPA-Envoy sidecars in the namespace where the app will be deployed, e.g., `default`
 
 ```bash
@@ -145,21 +145,27 @@ kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/bo
 kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/networking/bookinfo-gateway.yaml
 ```
 
-### 4. Set the `GATEWAY_URL` environment variable in your shell to the public IP/port of the Istio Ingress gateway
+### 4. Set the `SERVICE_HOST` environment variable in your shell to the public IP/port of the Istio Ingress gateway
 
-**minikube**:
+Run this command in a new terminal window to start a Minikube tunnel that sends traffic to your Istio Ingress Gateway:
 
-```bash
-export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
-export INGRESS_HOST=$(minikube ip)
-export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
-echo $GATEWAY_URL
+```
+minikube tunnel
 ```
 
-**minikube (example)**:
+Check that the Service shows an `EXTERNAL-IP`:
+
+```bash
+kubectl -n istio-system get service istio-ingressgateway
 
+NAME                   TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)                                                                      AGE
+istio-ingressgateway   LoadBalancer   10.98.42.178   127.0.0.1     15021:32290/TCP,80:30283/TCP,443:32497/TCP,31400:30216/TCP,15443:30690/TCP   5s
 ```
-192.168.99.100:31380
+
+**minikube:**
+
+```bash
+export SERVICE_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
 ```
 
 For other platforms see the [Istio documentation on determining ingress IP and ports.](https://istio.io/docs/tasks/traffic-management/ingress/#determining-the-ingress-ip-and-ports)
@@ -170,15 +176,15 @@ For other platforms see the [Istio documentation on determining ingress IP and p
 Check that **alice** can access `/productpage` **BUT NOT** `/api/v1/products`.
 
 ```bash
-curl --user alice:password -i http://$GATEWAY_URL/productpage
-curl --user alice:password -i http://$GATEWAY_URL/api/v1/products
+curl --user alice:password -i http://$SERVICE_HOST/productpage
+curl --user alice:password -i http://$SERVICE_HOST/api/v1/products
 ```
 
 Check that **bob** can access `/productpage` **AND** `/api/v1/products`.
 
 ```bash
-curl --user bob:password -i http://$GATEWAY_URL/productpage
-curl --user bob:password -i http://$GATEWAY_URL/api/v1/products
+curl --user bob:password -i http://$SERVICE_HOST/productpage
+curl --user bob:password -i http://$SERVICE_HOST/api/v1/products
 ```
 
 ## Wrap Up
diff --git a/docs/content/envoy-tutorial-standalone-envoy.md b/docs/content/envoy-tutorial-standalone-envoy.md
index 50f953f21e..f03db6d6cf 100644
--- a/docs/content/envoy-tutorial-standalone-envoy.md
+++ b/docs/content/envoy-tutorial-standalone-envoy.md
@@ -12,7 +12,7 @@ policies over the HTTP request body.
 ## Prerequisites
 
 This tutorial requires Kubernetes 1.20 or later. To run the tutorial locally, we
-recommend using [minikube](https://minikube.sigs.k8s.io/docs/start/) in 
+recommend using [minikube](https://minikube.sigs.k8s.io/docs/start/) in
 version `v1.21+` with Kubernetes 1.20+.
 
 ## Steps
@@ -125,44 +125,46 @@ employee with the same `firstname` as himself.
 ```live:example:module:openable
 package envoy.authz
 
+import future.keywords
+
 import input.attributes.request.http as http_request
 
-default allow = false
+default allow := false
 
-allow {
-    is_token_valid
-    action_allowed
+allow if {
+	is_token_valid
+	action_allowed
 }
 
-is_token_valid {
-    token.valid
-    now := time.now_ns() / 1000000000
-    token.payload.nbf <= now
-    now < token.payload.exp
+is_token_valid if {
+	token.valid
+	now := time.now_ns() / 1000000000
+	token.payload.nbf <= now
+	now < token.payload.exp
 }
 
-action_allowed {
-    http_request.method == "GET"
-    token.payload.role == "guest"
-    glob.match("/people", ["/"], http_request.path)
+action_allowed if {
+	http_request.method == "GET"
+	token.payload.role == "guest"
+	glob.match("/people", ["/"], http_request.path)
 }
 
-action_allowed {
-    http_request.method == "GET"
-    token.payload.role == "admin"
-    glob.match("/people", ["/"], http_request.path)
+action_allowed if {
+	http_request.method == "GET"
+	token.payload.role == "admin"
+	glob.match("/people", ["/"], http_request.path)
 }
 
-action_allowed {
-    http_request.method == "POST"
-    token.payload.role == "admin"
-    glob.match("/people", ["/"], http_request.path)
-    lower(input.parsed_body.firstname) != base64url.decode(token.payload.sub)
+action_allowed if {
+	http_request.method == "POST"
+	token.payload.role == "admin"
+	glob.match("/people", ["/"], http_request.path)
+	lower(input.parsed_body.firstname) != base64url.decode(token.payload.sub)
 }
 
-token := {"valid": valid, "payload": payload} {
-    [_, encoded] := split(http_request.headers.authorization, " ")
-    [valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
+token := {"valid": valid, "payload": payload} if {
+	[_, encoded] := split(http_request.headers.authorization, " ")
+	[valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
 }
 ```
 
@@ -247,7 +249,7 @@ spec:
     spec:
       initContainers:
         - name: proxy-init
-          image: openpolicyagent/proxy_init:v5
+          image: openpolicyagent/proxy_init:v8
           # Configure the iptables bootstrap script to redirect traffic to the
           # Envoy proxy on port 8000, specify that Envoy will be running as user
           # 1111, and that we want to exclude port 8282 from the proxy for the
@@ -376,8 +378,8 @@ echo $SERVICE_URL
 For convenience, we’ll want to store Alice's and Bob's tokens in environment variables.
 
 ```bash
-export ALICE_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiZ3Vlc3QiLCJzdWIiOiJZV3hwWTJVPSIsIm5iZiI6MTUxNDg1MTEzOSwiZXhwIjoxNjQxMDgxNTM5fQ.K5DnnbbIOspRbpCr2IKXE9cPVatGOCBrBQobQmBmaeU"
-export BOB_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYWRtaW4iLCJzdWIiOiJZbTlpIiwibmJmIjoxNTE0ODUxMTM5LCJleHAiOjE2NDEwODE1Mzl9.WCxNAveAVAdRCmkpIObOTaSd0AJRECY2Ch2Qdic3kU8"
+export ALICE_TOKEN="eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJleHAiOiAyMjQxMDgxNTM5LCAibmJmIjogMTUxNDg1MTEzOSwgInJvbGUiOiAiZ3Vlc3QiLCAic3ViIjogIllXeHBZMlU9In0.Uk5hgUqMuUfDLvBLnlXMD0-X53aM_Hlziqg3vhOsCc8"
+export BOB_TOKEN="eyJhbGciOiAiSFMyNTYiLCAidHlwIjogIkpXVCJ9.eyJleHAiOiAyMjQxMDgxNTM5LCAibmJmIjogMTUxNDg1MTEzOSwgInJvbGUiOiAiYWRtaW4iLCAic3ViIjogIlltOWkifQ.5qsm7rRTvqFHAgiB6evX0a_hWnGbWquZC0HImVQPQo8"
 ```
 
 Check that `Alice` can get employees **but cannot** create one.
diff --git a/docs/content/extensions.md b/docs/content/extensions.md
index 06e29f513d..1470b323af 100644
--- a/docs/content/extensions.md
+++ b/docs/content/extensions.md
@@ -107,6 +107,7 @@ r := rego.New(
 			Name: "github.repo",
 			Decl: types.NewFunction(types.Args(types.S, types.S), types.A),
 			Memoize: true,
+			Nondeterministic: true,
 		},
 		func(bctx rego.BuiltinContext, a, b *ast.Term) (*ast.Term, error) {
 			// see implementation below.
@@ -132,6 +133,13 @@ across multiple calls in the same query. If your built-in function performs I/O,
 you should enable memoization as it ensures function evaluation is
 deterministic.
 
+Since this built-in could have non-deterministic results, depending on network
+conditions, the declaration also sets `rego.Function#Nondeterministic` to true.
+This provides basic safety information to the runtime, so that the function
+isn't accidentally run during bundle builds or partial evaluation. If your
+builtin can have non-deterministic results, you should mark it appropriately
+to avoid surprises.
+
 The implementation wraps the Go standard library to perform HTTP requests to
 GitHub's API:
 
@@ -141,7 +149,7 @@ func(bctx rego.BuiltinContext, a, b *ast.Term) (*ast.Term, error) {
 
 	if err := ast.As(a.Value, &org); err != nil {
 		return nil, err
-	} else if ast.As(b.Value, &repo); err != nil {
+	} else if err := ast.As(b.Value, &repo); err != nil {
 		return nil, err
 	}
 
@@ -405,6 +413,7 @@ func main() {
 				Name:    "github.repo",
 				Decl:    types.NewFunction(types.Args(types.S, types.S), types.A),
 				Memoize: true,
+				Nondeterministic: true,
 			},
 			func(bctx rego.BuiltinContext, a, b *ast.Term) (*ast.Term, error) {
 
@@ -412,7 +421,7 @@ func main() {
 
 				if err := ast.As(a.Value, &org); err != nil {
 					return nil, err
-				} else if ast.As(b.Value, &repo); err != nil {
+				} else if err := ast.As(b.Value, &repo); err != nil {
 					return nil, err
 				}
 
@@ -478,6 +487,7 @@ func main() {
 			Name:    "github.repo",
 			Decl:    types.NewFunction(types.Args(types.S, types.S), types.A),
 			Memoize: true,
+			Nondeterministic: true,
 		},
 		func(bctx rego.BuiltinContext, a, b *ast.Term) (*ast.Term, error) {
 
@@ -485,7 +495,7 @@ func main() {
 
 			if err := ast.As(a.Value, &org); err != nil {
 				return nil, err
-			} else if ast.As(b.Value, &repo); err != nil {
+			} else if err := ast.As(b.Value, &repo); err != nil {
 				return nil, err
 			}
 
diff --git a/docs/content/external-data.md b/docs/content/external-data.md
index 43adf4de81..f148ee13dd 100644
--- a/docs/content/external-data.md
+++ b/docs/content/external-data.md
@@ -14,6 +14,7 @@ This document describes options for replicating data into OPA.  The content of t
 [JSON Web Tokens (JWTs)](https://tools.ietf.org/html/rfc7519) allow you to securely transmit JSON data between software systems and are usually produced during the authentication process.  You can set up authentication so that when the user logs in you create a JWT with that user's attributes (or any other data as far as OPA is concerned).  Then you hand that JWT to OPA and use OPA's specialized support for JWTs to extract the information you need to make a policy decision.
 
 ### Flow
+
 The following diagram shows this process in more detail.
 
 1. User logs in to an authentication system, e.g. LDAP/AD/etc.
@@ -25,9 +26,11 @@ The following diagram shows this process in more detail.
 {{< figure src="data-jwt.png" width="60" caption="JSON Web Token flow" >}}
 
 ### Updates
+
 The JWT only gets refreshed when the user authenticates; how often that happens is up to the TTL included in the token.  When user-attribute information changes, those changes will not be seen by OPA until the user authenticates and gets a new JWT.
 
 ### Size Limitations
+
 JWTs have a limited size in practice, so if your organization has too many user attributes you may not be able to fit all the required information into a JWT.
 
 ### Security
@@ -37,39 +40,43 @@ JWTs have a limited size in practice, so if your organization has too many user
 * OPA has support for making HTTP requests during evaluation, which could be used to check if a JWT has been revoked.  Though if you're connecting to a remote system on every policy decision anyway, you should think about whether connecting to the authentication system directly is more appropriate (see below).
 
 ## Option 2: Overload `input`
+
 Often policies require external data that's not available to the authentication system, ruling out JWTs.  The calling system can include external data as part of `input` (necessitating of course that the policy is written accordingly).
 
 For example, suppose your policy says that only a file's owner may delete it.  The authentication system does not track resource-ownership, but the system responsible for files certainly does.
 
 The file-ownership system may be the one that is asking for an authorization decision from OPA.  It already knows which file is being operated on and who the owner is, so it can hand OPA the file-owner as part of OPA's `input`.  This can be dangerous in that it ties the integration of OPA to the policy, but often it's sufficient to have the file-ownership system hand over all the file's metadata.
 
-
 ### Flow
+
 1. OPA-enabled software gathers relevant metadata (and caches it for subsequent requests)
 1. OPA-enabled software sends `input` to OPA including the external data
 1. Policy makes decisions based on external data included in `input`
 
 {{< figure src="data-input.png" width="60" caption="Input flow" >}}
 
-
 ### Updates
+
 External data gets updated as frequently as the OPA-enabled software updates it.  Often some of that data is local to the OPA-enabled software, and sometimes it is remote.  The remote data is usually cached for performance and hence is as updated as the caching strategy allows.
 
 ### Size Limitations
+
 Size limitations are rarely a problem for OPA in this approach because it only sees the metadata for 1 request at a time.  However, the cache of remote data that the OPA-enabled service creates will have a limit that the developer controls.
 
 ### Security
+
 This approach is as secure as the connection between the OPA-enabled service and OPA itself, under the assumption that the OPA-enabled service gathers the appropriate metadata securely.  That is, using external data with this approach is as secure as using OPA in the first place.
 
 ### Recommended usage: Local, Dynamic data
-This approach is valuable when the data changes fairly frequently and/or when the cost of making decisions using stale data is high.  It works especially well when the external data is local to the system asking for authorization decisions.  It can work in the case of remote data as well, but there is more coupling of the system to OPA because the system is hardcoded to fetch the data needed by the policy (and only that data).
 
+This approach is valuable when the data changes fairly frequently and/or when the cost of making decisions using stale data is high.  It works especially well when the external data is local to the system asking for authorization decisions.  It can work in the case of remote data as well, but there is more coupling of the system to OPA because the system is hardcoded to fetch the data needed by the policy (and only that data).
 
 ## Option 3: Bundle API
 
 When external data changes infrequently and can reasonably be stored in memory all at once, you can replicate that data in bulk via OPA's bundle feature.   The bundle feature periodically downloads policy bundles from a centralized server, which can include data as well as policy.  Every time OPA gets updated policies, it gets updated data too.  You must implement the bundle server and integrate your external data into the bundle server--OPA does NOT help with that--but once it is done, OPA will happily pull the data (and policies) out of your bundle server.
 
 ### Flow
+
 Three things happen independently with this kind of data integration.
 
 * A. OPA-enabled software system asks OPA for policy decisions
@@ -79,9 +86,11 @@ Three things happen independently with this kind of data integration.
 {{< figure src="data-bundle.png" width="60" caption="Bundle flow" >}}
 
 ### Updates
+
 The lag between a data update and OPA having the update is the sum of the lag for an update between data replication and the central bundle server and the lag for an update between the central bundle server and OPA.  So if data replication happens every 5 minutes, and OPA pulls a new bundle every 2 minutes, then the total maximum lag is 7 minutes.
 
 ### Size limitations
+
 OPA stores the entire datasource at once in memory.  Obviously this can be a problem with large external data sets.  Because the centralized server handles both policy and data it can prune data to just that which is needed for the policies.
 
 <!-- **Security**
@@ -89,12 +98,11 @@ OPA stores the entire datasource at once in memory.  Obviously this can be a pro
 * Assuming LDAP/AD is the only context needed, use OPA's authentication/authorization to disable all of OPA's APIs except those needed by the OPA-enabled service. -->
 
 ### Recommended usage: Static, Medium-sized data
+
 This approach is more flexible than the JWT and `input` cases above because you can include an entirely new data source at the bundle server without changing the authentication service or the OPA-enabled service.  You are also guaranteed that the policy and its corresponding data always arrive at the same time, making the policy-data consistency perfect.
 
 The drawback is that the consistency of the data with the source of truth is worse than the `input` case and could be better or worse than the consistency for the JWT case (because JWTs only get updated on login).  One feature currently under design is a delta-based bundle protocol, which could improve the data consistency model significantly by lowering the cost of frequent updates.  But as it stands this approach is ideal when the data is relatively static and the data fits into memory.
 
-
-
 ## Option 4: Push Data
 
 Another way to replicate external data in its entirety into OPA is to use OPA's API for injecting arbitrary JSON data.  You can build a replicator that pulls information out of the external data source and pushes that information in OPA through its API.  This approach is similar in most respects to the bundle API, except it lets you optimize for update latency and network traffic.
@@ -116,6 +124,7 @@ Depending on the replication scheme, B and C could be tied together so that ever
 The total lag between the external data source being updated and OPA being updated is the sum of the lag for an update between the data source and the synchronizer plus the lag for an update between the synchronizer and OPA.
 
 ### Size limitations
+
 The entirety of the external data source is stored in memory, which can obviously be a problem with large external data sources.  But unlike the bundle API, this approach does allow updates to data.
 
 <!--
@@ -124,8 +133,8 @@ The entirety of the external data source is stored in memory, which can obviousl
 * Ensure OPA's policy rejects requests without sufficient data so that an OPA restart that wipes out memory does not leave the OPA-enabled service vulnerable. -->
 
 ### Recommended usage: Dynamic, Medium-sized data
-This approach is very similar to the bundle approach except it updates the data stored in OPA with deltas instead of an entire snapshot at a time.  Because the data is updated as deltas, this approach is well-suited for data that changes frequently.  It assumes the data can fit entirely in memory and so is well-suited to small and medium-sized data sets.
 
+This approach is very similar to the bundle approach except it updates the data stored in OPA with deltas instead of an entire snapshot at a time.  Because the data is updated as deltas, this approach is well-suited for data that changes frequently.  It assumes the data can fit entirely in memory and so is well-suited to small and medium-sized data sets.
 
 ## Option 5: Pull Data during Evaluation
 
@@ -134,11 +143,10 @@ OPA includes functionality for reaching out to external servers during evaluatio
 That functionality is implemented using built-in functions such as [`http.send`](https://www.openpolicyagent.org/docs/latest/policy-reference/#http).  Check the docs for the latest instructions.
 
 ### Current limitations
-* Unit test framework does not allow you to mock out the results of builtin functions; however, you can create a helper rule that runs the builtin and mock that out.
+
 * Credentials needed for the external service can either be hardcoded into policy or pulled from the environment.
 * The built-in functions do not implement any retry logic.
 
-
 ### Flow
 
 The key difference here is that every decision requires contacting the external data source.  If that service or the network connection is slow or unavailable, OPA may not be able to return a decision.
@@ -149,15 +157,19 @@ The key difference here is that every decision requires contacting the external
 {{< figure src="data-pull.png" width="60" caption="Pull flow" >}}
 
 ### Updates
+
 External data is perfectly fresh.  There is no lag between an update to the external data and when OPA sees that update.
 
 ### Size limitations
+
 Only the data actually needed by the policy is pulled from the external data source.  There is no need for a replicator to figure out what data the policy will need before execution.
 
 ### Performance and Availability
+
 Latency and availability of decision-making are dependent on the network.  This approach may still be superior to running OPA on a remote server entirely because a local OPA can make some decisions without going over the network--those decisions that do not require information from the remote data server.
 
 ### Recommended usage: Highly Dynamic or Large-sized data
+
 If the data is too large to fit into memory, or it changes too frequently to cache it inside of OPA, the only real option is to fetch the data on demand.  The `input` approach fetches data on demand as well, but puts the burden on the OPA-enabled service to fetch the necessary data (and to know what data is necessary).
 
 The downside to pulling data on demand is reduced performance and availability because of the network, which can be mitigated via caching.  In the `input` case, caching is under the control of the OPA-enabled service and can therefore be tailored to fit the properties of the data.  In the `http.send` case, caching is largely under the control of the remote service that sets HTTP response headers to indicate how long the response can be cached for.  It is crucial in this approach for the OPA-enabled service to handle the case when OPA returns no decision.
@@ -171,6 +183,3 @@ The downside to pulling data on demand is reduced performance and availability b
 | Bundle | High | Updates to policy/data at the same time.  Size an issue. | Static, medium |
 | Push | High | Control data refresh rate.  Size an issue. | Dynamic, medium |
 | Evaluation Pull | Dependent on network | Perfectly up to date.  No size limit. | Dynamic or large |
-
-
-
diff --git a/docs/content/faq.md b/docs/content/faq.md
index 879f7e0c6c..3eed5140e8 100644
--- a/docs/content/faq.md
+++ b/docs/content/faq.md
@@ -1,8 +1,8 @@
 ---
 title: Frequently Asked Questions
 navtitle: FAQ
-kind: misc
-weight: 17
+kind: support
+weight: 1
 ---
 
 ## How do I make user attributes stored in LDAP/AD available to OPA for making decisions?
@@ -30,7 +30,7 @@ ask for `foo/authz`.
 
 ```live:conflict_resolution_deny_by_default:module:read_only
 # deny everything by default
-default authz = false
+default authz := false
 
 # deny overrides allow
 authz {
@@ -52,8 +52,8 @@ mean the same thing whichever order you write them in.
 ```live:unordered:module:openable
 package unordered
 
-ratelimit = 4 { input.name == "alice" }
-ratelimit = 5 { input.name == "bob" }
+ratelimit := 4 { input.name == "alice" }
+ratelimit := 5 { input.name == "bob" }
 ```
 
 ```live:unordered:input
@@ -74,9 +74,9 @@ Sometimes, though, you want the statement order to matter.  For example, you mig
 ```live:ordered:module:openable
 package ordered
 
-ratelimit = 4 {
+ratelimit := 4 {
     input.owner == "bob"
-} else = 5 {
+} else := 5 {
     input.name == "alice"
 }
 ```
@@ -118,6 +118,7 @@ x = 7               # causes x to be assigned 7
 ```
 
 ## Collaboration Using Import
+
 OPA lets multiple teams contribute independent policies that you can then combine to make an overall decision.  Each team writes their policy in a separate `package`, then you write one more policy that imports all the teams policies and makes a decision.
 
 For example, suppose there is a network team, a storage team, and a compute team.  Suppose they each write their own policy:
@@ -156,6 +157,7 @@ allow {
 The cloud team could have a more sophisticated scheme for combining policies, e.g. using just the compute policy for compute-only resources or requiring the compute policy to allow the compute-relevant portions of resource.  Remember that `allow` is not special--it is just another boolean that the policy author can use to make decisions.
 
 ## Functions Versus Rules
+
 Rego lets you factor out common logic in 2 different and complementary ways.
 
 One is the *function*, which is conceptually identical to functions from most programming languages.  It takes any input and returns any output.  Importantly, a function can take infinitely many inputs, e.g. any string.
@@ -163,7 +165,7 @@ One is the *function*, which is conceptually identical to functions from most pr
 ```live:functions:module:openable
 package functions
 
-trim_and_split(s) = result {
+trim_and_split(s) := result {
      t := trim(s, " ")
      result := split(t, ".")
 }
@@ -181,7 +183,7 @@ The other way to factor out common logic is with a *rule*.  Rules differ in that
 ```live:rules:module:openable
 package rules
 
-app_to_hostnames[app_name] = hostnames {
+app_to_hostnames[app_name] := hostnames {
   app := apps[_]
   app_name := app.name
   hostnames := [hostname | name := app.servers[_]
@@ -300,7 +302,7 @@ p[x] { some y; q[y]; r[y] }
 
 # Safe.  q and r are both rules
 #   Both q and r are finite; therefore p is also finite.
-p[x] = y { some x, y; q[x]; r[y] }
+p[x] := y { some x, y; q[x]; r[y] }
 
 # Unsafe: y appears inside a builtin (+) but not in the body.
 #   y has infinitely many possible values; so too does x.
@@ -406,17 +408,18 @@ Depending on the use case and the integration with OPA that you are using, the s
 
 ```rego
 # entry point is 'deny'
-default deny = false
+default deny := false
 deny { ... }
 deny { ... }
 ```
+
 If you assume all of the rules you write are correct, then you know that every rejection the policy produces should truly be rejected.  However, there could be requests that are allowed that you may not truly want allowed, but you simply neglected to write the rule for.  For operations, this is often a useful style of policy authoring because it allows you to incrementally tighten the controls for a system from wherever that system starts.  For security, this style is less appropriate because it allows unknown bad actions to occur.
 
 **Default deny**.  This style of policy rejects every request by default.  The rules you write dictate which requests should be allowed.
 
 ```rego
 # entry point is 'allow'
-default allow = false
+default allow := false
 allow { ... }
 allow { ... }
 ```
@@ -427,7 +430,7 @@ If you assume your rules are correct, the only requests that are accepted are kn
 
 ```rego
 # entry point is 'authz'
-default authz = false
+default authz := false
 authz {
   allow
   not deny
@@ -439,10 +442,3 @@ deny { ... }
 This hybrid approach to policy authoring combines the two previous styles.  These policies allow relatively coarse grained parts of the request space and then carve out of each part what should actually be denied.  Any deny statements that you forget lead to security problems; any allow statements you forget lead to operational problems.  But since this approach allows you to implement either of the other two, it is a common pattern across use cases.
 
 **Non-boolean policies**. The examples above focus on policies with boolean decisions.  Policies that make non-boolean decisions typically have similar tradeoffs.  Are you enumerating the conditions under which requests are permitted (e.g. the list of clusters to which an app SHOULD be deployed) or are you enumerating the conditions under which requests are prohibited (e.g. the list of clusters to which an app SHOULD NOT be deployed).  While the details differ, the concepts are often similar.
-
-
-
-
-
-
-
diff --git a/docs/content/graphql-api-authorization.md b/docs/content/graphql-api-authorization.md
new file mode 100644
index 0000000000..b51dd2b2f0
--- /dev/null
+++ b/docs/content/graphql-api-authorization.md
@@ -0,0 +1,530 @@
+---
+title: "GraphQL APIs"
+kind: tutorial
+weight: 1
+---
+
+GraphQL APIs have become a popular way to query a variety of datastores and microservices, and any application or service providing a GraphQL API generally needs to control which users can run queries, mutations, and so on.
+OPA makes it easy to write fine-grained, context-aware policies to implement GraphQL query authorization.
+
+## Goals
+
+In this tutorial, you'll use a simple GraphQL server that accepts any GraphQL request that you issue, and echoes the OPA decision back as text.
+OPA will fetch policy bundles from a simple bundle server.
+OPA, the bundle server, and the GraphQL server will all be run as containers.
+
+For this tutorial, our desired policy is:
+
+* People can see their own salaries (`query user($id: <user>) { salary }` is permitted for `<user>`)
+* A manager can see their direct reports' salaries (`query user($id: <user>) { salary }` is permitted for `<user>`'s manager)
+
+
+{{< danger >}} GraphQL API Authorization with OPA is currently experimental and the following tutorial is intended for demonstration purposes only. {{< /danger >}}
+
+## Prerequisites
+
+This tutorial requires [Docker Compose](https://docs.docker.com/compose/install/) to run a demo web server along with OPA.
+
+## Steps
+
+### 1. Define our GraphQL schema.
+
+Most modern GraphQL frameworks encourage starting with a schema, so we'll follow suit, and begin by defining the schema for this example.
+
+**schema.gql**:
+```graphql
+type Employee {
+  id: String!
+  salary: Int!
+}
+
+schema {
+  query: Query
+}
+
+type Query {
+  employeeByID(id: String!): Employee
+}
+```
+
+Every GraphQL service has a `query` type, and may or may not have a `mutation` type.
+These types are special because they define the entry points of *every* GraphQL query for the API covered by that schema.
+
+For our example above, we've defined exactly one query entry point, the parameterized query `employeeByID(id: String!)`.
+
+### 2. Create a policy bundle.
+
+GraphQL APIs allow surprising flexibility in how queries can be constructed, which makes writing policies for them a bit more challenging than for a REST API, which usually has a more fixed structure.
+
+To protect a particular endpoint or field, we need to see if they are referenced in the incoming GraphQL query.
+By using `graphql.parse`, we can extract an [abstract syntax tree][wikipedia-ast] (AST) from the incoming query, and then walk down the tree to its leaves to see if our endpoint is the target of the query.
+
+We can then use separate rules to enforce conditions around the `salary` field, and who is allowed to access it.
+
+The policy below does all of the above in parts:
+ - Obtains the query AST (and validates it against our schema with `graphql.parse`).
+ - Recursive traversal with `walk()` to obtain chunks of the AST with queries of interest present.
+   - Selection of nodes of interest by name and structure.
+ - Salary field selected.
+ - Every query of interest found has to pass one of the `allowed_query` rules, or the entire query is rejected.
+   - Constant/variable cases for both employees and their managers.
+
+   [wikipedia-ast]: https://en.wikipedia.org/wiki/Abstract_syntax_tree
+
+**example.rego**:
+```live:example:module:openable
+package graphqlapi.authz
+
+import future.keywords.in
+import future.keywords.every
+
+subordinates = {"alice": [], "charlie": [], "bob": ["alice"], "betty": ["charlie"]}
+
+query_ast := graphql.parse(input.query, input.schema)[0] # If validation fails, the rules depending on this will be undefined.
+
+default allow := false
+
+allow {
+    employeeByIDQueries != {}
+    every query in employeeByIDQueries {
+      allowed_query(query)
+    }
+}
+
+# Allow users to see the salaries of their subordinates. (variable case)
+allowed_query(q) {
+    selected_salary(q)
+    varname := variable_arg(q, "id")
+    input.variables[varname] in subordinates[input.user] # Do value lookup from the 'variables' object.
+}
+# Allow users to see the salaries of their subordinates. (constant value case)
+allowed_query(q) {
+    selected_salary(q)
+    username := constant_string_arg(q, "id")
+    username in subordinates[input.user]
+}
+
+# Helper rules.
+
+# Allow users to get their own salaries. (variable case)
+allowed_query(q) {
+    selected_salary(q)
+    varname := variable_arg(q, "id")
+    input.user == input.variables[varname] # Do value lookup from the 'variables' object.
+}
+
+# Allow users to get their own salaries. (constant value case)
+allowed_query(q) {
+    selected_salary(q)
+    username := constant_string_arg(q, "id")
+    input.user == username
+}
+
+
+# Helper functions.
+
+# Build up an object with all queries of interest as values.
+employeeByIDQueries[value] {
+    some value
+	walk(query_ast, [_, value])
+    value.Name == "employeeByID"
+    count(value.SelectionSet) > 0 # Ensure we latch onto an employeeByID query.
+}
+
+# Extract the string value of a constant value argument.
+constant_string_arg(value, argname) := arg.Value.Raw {
+    some arg in value.Arguments
+    arg.Name == argname
+    arg.Value.Kind == 3
+}
+
+# Extract the variable name for a variable argument.
+variable_arg(value, argname) := arg.Value.Raw {
+    some arg in value.Arguments
+    arg.Name == argname
+    arg.Value.Kind == 0
+}
+
+# Ensure we're dealing with a selection set that includes the "salary" field.
+selected_salary(value) := value.SelectionSet[_].Name == "salary"
+
+```
+
+Then, build a bundle.
+
+```shell
+mkdir bundles
+opa build example.rego
+mv bundle.tar.gz ./bundles
+```
+
+You should now see a policy bundle (`bundle.tar.gz`) in your working directory.
+
+### 3. Bootstrap the tutorial environment using Docker Compose.
+
+Next, create a `docker-compose.yml` file that runs OPA, a bundle server and the demo GraphQL server.
+
+
+**docker-compose.yml**:
+
+```yaml
+services:
+  opa:
+    image: openpolicyagent/opa:{{< current_docker_version >}}
+    ports:
+      - "8181:8181"
+    command:
+      - "run"
+      - "--server"
+      - "--log-format=json-pretty"
+      - "--set=decision_logs.console=true"
+      - "--set=services.nginx.url=http://bundle_server"
+      - "--set=bundles.nginx.service=nginx"
+      - "--set=bundles.nginx.resource=bundle.tar.gz"
+      - "--set=bundles.nginx.polling.min_delay_seconds=10"
+      - "--set=bundles.nginx.polling.max_delay_seconds=30"
+    depends_on:
+      - bundle_server
+  api_server:
+    image: openpolicyagent/demo-graphql-api:0.1
+    ports:
+      - "6000:5000"
+    environment:
+      - OPA_ADDR=http://opa:8181
+      - POLICY_PATH=/v1/data/graphqlapi/authz
+    depends_on:
+      - opa
+  bundle_server:
+    image: nginx:1.20.0-alpine
+    ports:
+      - 8888:80
+    volumes:
+      - ./bundles/:/usr/share/nginx/html/
+```
+
+Then run `docker-compose` to pull and run the containers.
+
+{{< info >}}
+If running "Docker Desktop" (Mac or Windows) you may instead use the `docker compose` command.
+{{< /info >}}
+
+```shell
+docker-compose -f docker-compose.yml up
+```
+
+Every time the demo GraphQL server receives an HTTP request, it asks OPA to decide whether an GraphQL query is authorized or not using a single RESTful API call.
+An example codebase is [here][graphql-example-repo], but the crux of the (JavaScript, Apollo framework) code is shown below.
+
+   [graphql-example-repo]: https://github.com/StyraInc/graphql-apollo-example
+
+```javascript
+  // we assume user is passed in as part of the request context.
+  var user = req.user;
+
+  // we feed in the query and schema strings, as well as the variables object.
+  var input = {
+    input: {
+      schema: schema, // GraphQL schema text.
+      query: query, // GraphQL query text.
+      user: user,
+      variables: variables // GraphQL variable bindings.
+    }
+  };
+
+  await axios
+    // ask OPA for a policy decision.
+    // (in reality OPA URL would be constructed from environment)
+    .post("http://127.0.0.1:8181/v1/data/graphqlapi/authz", input)
+    .then(res => {
+      // GraphQL query allowed.
+    })
+    .catch(error => {
+      // GraphQL query denied.
+    });
+```
+
+
+### 4. Check that `alice` can see her own salary.
+
+We'll define a quick shell function to make the following examples cleaner on the command line:
+
+```shell
+gql-query() {
+   curl --user "$1" -H "Content-Type: application/json" "$2" --data-ascii "$3"
+}
+```
+
+The following command will succeed.
+
+```shell
+gql-query alice:password "localhost:6000/" '{"query":"query { employeeByID(id: \"alice\") { salary }}"}'
+```
+
+The GraphQL server queries OPA to authorize the request.
+In the query, the server includes JSON data describing the incoming request.
+
+```live:example:input
+{
+  "schema": "type Employee {\n  id: ...",
+  "query": "query { employeeByID(id: \"alice\") { salary }}",
+  "user": "alice",
+  "variables": {}
+}
+```
+
+When the GraphQL server queries OPA it asks for a specific policy decision.
+In this case, the integration is hardcoded to ask for `/v1/data/graphqlapi/authz`.
+OPA translates this URL path into a query:
+
+```live:example:query
+data.graphqlapi.authz
+```
+
+The answer returned by OPA for the input above is:
+
+```live:example:output
+```
+
+### 4. Check that `bob` can see `alice`'s salary (because `bob` is `alice`'s manager.)
+
+```shell
+gql-query bob:password "localhost:6000/" '{"query":"query { employeeByID(id: \"alice\") { salary }}"}'
+```
+
+### 5. Check that `bob` CANNOT see `charlie`'s salary.
+
+`bob` is not `charlie`'s manager, so the following command will fail.
+
+```shell
+gql-query bob:password "localhost:6000/" '{"query":"query { employeeByID(id: \"charlie\") { salary }}"}'
+```
+
+### 6. Change the policy.
+
+Suppose the organization now includes an HR department.
+The organization wants members of HR to be able to see any salary.
+Let's extend the policy to handle this.
+
+**example-hr.rego**:
+
+```live:hr_example:module:read_only,openable
+package graphqlapi.authz
+
+# Allow HR members to get anyone's salary.
+allowed_query(q) {
+  selected_salary(q)
+  input.user == hr[_]
+}
+
+# David is the only member of HR.
+hr = [
+  "david",
+]
+```
+
+Build a new bundle with the new policy included.
+
+```shell
+opa build example.rego example-hr.rego
+mv bundle.tar.gz ./bundles
+```
+
+The updated bundle will automatically be served by the bundle server, but note that it  might take up to the configured `max_delay_seconds` for the new bundle to be downloaded by OPA.
+If you plan to make frequent policy changes you might want to adjust this value in `docker-compose.yml` accordingly.
+
+For the sake of the tutorial we included `manager_of` and `hr` data directly inside the policies.
+In real-world scenarios that information would be imported from external data sources.
+
+### 7. Check that the new policy works.
+Check that `david` can see anyone's salary.
+
+```shell
+gql-query david:password "localhost:6000/" '{"query":"query { employeeByID(id: \"alice\") { salary }}"}'
+gql-query david:password "localhost:6000/" '{"query":"query { employeeByID(id: \"bob\") { salary }}"}'
+gql-query david:password "localhost:6000/" '{"query":"query { employeeByID(id: \"charlie\") { salary }}"}'
+gql-query david:password "localhost:6000/" '{"query":"query { employeeByID(id: \"david\") { salary }}"}'
+```
+
+### 8. (Optional) Use JSON Web Tokens to communicate policy data.
+OPA supports the parsing of JSON Web Tokens via the builtin function `io.jwt.decode`.
+To get a sense of one way the subordinate and HR data might be communicated in the real world, let's try a similar exercise utilizing the JWT utilities of OPA.
+
+**example-jwt.rego**:
+
+```live:jwt_example:module:hidden
+package graphqlapi.authz
+
+import future.keywords.in
+import future.keywords.every
+
+query_ast := graphql.parse(input.query, input.schema)[0] # If validation fails, the rules depending on this will be undefined.
+
+# Helper rules.
+
+# Allow users to see the salaries of their subordinates. (variable case)
+allowed_query(q) {
+    selected_salary(q)
+    varname := variable_arg(q, "id")
+    input.variables[varname] in token.payload.subordinates # Do value lookup from the 'variables' object.
+}
+# Allow users to see the salaries of their subordinates. (constant value case)
+allowed_query(q) {
+    selected_salary(q)
+    username := constant_string_arg(q, "id")
+    username in token.payload.subordinates
+}
+
+# Allow users to get their own salaries. (variable case)
+allowed_query(q) {
+    selected_salary(q)
+    varname := variable_arg(q, "id")
+    token.payload.user == input.variables[varname] # Do value lookup from the 'variables' object.
+}
+
+# Allow users to get their own salaries. (constant value case)
+allowed_query(q) {
+    selected_salary(q)
+    username := constant_string_arg(q, "id")
+    token.payload.user == username
+}
+
+# Allow HR members to get anyone's salary.
+allowed_query(q) {
+    selected_salary(q)
+    token.payload.hr == true
+}
+
+# Helper functions.
+
+# Build up a set with all queries of interest as values.
+employeeByIDQueries[value] {
+    some value
+	walk(query_ast, [_, value])
+    value.Name == "employeeByID"
+    count(value.SelectionSet) > 0 # Ensure we latch onto an employeeByID query.
+}
+
+# Extract the string value of a constant value argument.
+constant_string_arg(value, argname) := arg.Value.Raw {
+    some arg in value.Arguments
+    arg.Name == argname
+    arg.Value.Kind == 3
+}
+
+# Extract the variable name for a variable argument.
+variable_arg(value, argname) := arg.Value.Raw {
+    some arg in value.Arguments
+    arg.Name == argname
+    arg.Value.Kind == 0
+}
+
+# Ensure we're dealing with a selection set that includes the "salary" field.
+selected_salary(value) := value.SelectionSet[_].Name == "salary"
+
+```
+
+```live:jwt_example/new_rules:module:openable
+
+default allow := false
+
+allow {
+    employeeByIDQueries != {}
+    user_owns_token  # Ensure we validate the JWT token.
+    every query in employeeByIDQueries {
+      allowed_query(query)
+    }
+}
+
+# Helper rules ... (Same as example.rego)
+
+# Helper functions ... (Same as example.rego)
+
+# -------------------------------------------------------------
+# JWT Token Support
+
+# Ensure that the token was issued to the user supplying it.
+user_owns_token { input.user == token.payload.azp }
+
+# Helper to get the token payload.
+token = {"payload": payload} {
+  [_, payload, _] := io.jwt.decode(input.token)
+}
+```
+
+```live:jwt_example:input:hidden
+{
+  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0.rz3jTY033z-NrKfwrK89_dcLF7TN4gwCMj-fVBDyLoM",
+  "schema": "type Employee {\n  id: ...",
+  "query": "query { employeeByID(id: \"alice\") { salary }}",
+  "user": "alice",
+  "variables": {}
+}
+```
+
+Build a new bundle for the new policy.
+
+```shell
+opa build example-jwt.rego example-hr.rego
+mv bundle.tar.gz ./bundles
+```
+
+For convenience, we'll want to store user tokens in environment variables (they're really long).
+
+```shell
+export ALICE_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWxpY2UiLCJhenAiOiJhbGljZSIsInN1Ym9yZGluYXRlcyI6W10sImhyIjpmYWxzZX0.rz3jTY033z-NrKfwrK89_dcLF7TN4gwCMj-fVBDyLoM"
+export BOB_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYm9iIiwiYXpwIjoiYm9iIiwic3Vib3JkaW5hdGVzIjpbImFsaWNlIl0sImhyIjpmYWxzZX0.n_lXN4H8UXGA_fXTbgWRx8b40GXpAGQHWluiYVI9qf0"
+export CHARLIE_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiY2hhcmxpZSIsImF6cCI6ImNoYXJsaWUiLCJzdWJvcmRpbmF0ZXMiOltdLCJociI6ZmFsc2V9.EZd_y_RHUnrCRMuauY7y5a1yiwdUHKRjm9xhVtjNALo"
+export BETTY_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYmV0dHkiLCJhenAiOiJiZXR0eSIsInN1Ym9yZGluYXRlcyI6WyJjaGFybGllIl0sImhyIjpmYWxzZX0.TGCS6pTzjrs3nmALSOS7yiLO9Bh9fxzDXEDiq1LIYtE"
+export DAVID_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZGF2aWQiLCJhenAiOiJkYXZpZCIsInN1Ym9yZGluYXRlcyI6W10sImhyIjp0cnVlfQ.Q6EiWzU1wx1g6sdWQ1r4bxT1JgSHUpVXpINMqMaUDMU"
+```
+
+These tokens encode the same information as the policies we did before (`bob` is `alice`'s manager, `betty` is `charlie`'s, `david` is the only HR member, etc).
+If you want to inspect their contents, start up the OPA REPL and execute `io.jwt.decode(<token here>, [header, payload, signature])` or open the example above in the Playground.
+
+Let's try a few queries (note: you may need to escape the `?` characters in the queries for your shell):
+
+Check that `charlie` can't see `bob`'s salary.
+
+```shell
+gql-query charlie:password "localhost:5000/?token=$CHARLIE_TOKEN" '{"query":"query { employeeByID(id: \"bob\") { salary }}"}'
+```
+
+Check that `charlie` can't pretend to be `bob` to see `alice`'s salary.
+
+```shell
+gql-query charlie:password "localhost:5000/?token=$BOB_TOKEN" '{"query":"query { employeeByID(id: \"alice\") { salary }}"}'
+```
+
+Check that `david` can see `betty`'s salary.
+
+```shell
+gql-query david:password "localhost:5000/?token=$DAVID_TOKEN" '{"query":"query { employeeByID(id: \"betty\") { salary }}"}'
+```
+
+Check that `bob` can see `alice`'s salary.
+
+```shell
+gql-query bob:password "localhost:5000/?token=$BOB_TOKEN" '{"query":"query { employeeByID(id: \"alice\") { salary }}"}'
+```
+
+Check that `alice` can see her own salary.
+
+```shell
+gql-query alice:password "localhost:5000/?token=$ALICE_TOKEN" '{"query":"query { employeeByID(id: \"alice\") { salary }}"}'
+```
+
+## Wrap Up
+
+Congratulations for finishing the tutorial!
+
+You learned a number of things about API authorization with OPA:
+
+* OPA gives you fine-grained policy control over GraphQL APIs once you set up the server to ask OPA for authorization.
+* You write allow/deny policies to control which endpoints and fields can be accessed by whom.
+* You can import external data into OPA and write policies that depend on that data.
+* You can use OPA data structures to define abstractions over your data.
+* You can use a remote bundle server for distributing policy and data.
+
+The code for this tutorial can be found in the
+[StyraInc/graphql-apollo-example][graphql-example-repo]
+repository.
diff --git a/docs/content/http-api-authorization.md b/docs/content/http-api-authorization.md
index c23d577675..d6e8a4416b 100644
--- a/docs/content/http-api-authorization.md
+++ b/docs/content/http-api-authorization.md
@@ -28,15 +28,21 @@ This tutorial requires [Docker Compose](https://docs.docker.com/compose/install/
 
 Create a policy that allows users to request their own salary as well as the salary of their direct subordinates.
 
+**First** create a directory named `bundles` and cd into it.
+```sh
+mkdir bundles
+cd bundles
+```
+
 **example.rego**:
 
 ```live:example:module:openable
 package httpapi.authz
 
 # bob is alice's manager, and betty is charlie's.
-subordinates = {"alice": [], "charlie": [], "bob": ["alice"], "betty": ["charlie"]}
+subordinates := {"alice": [], "charlie": [], "bob": ["alice"], "betty": ["charlie"]}
 
-default allow = false
+default allow := false
 
 # Allow users to get their own salaries.
 allow {
@@ -53,13 +59,14 @@ allow {
 }
 ```
 
-Then, build a bundle.
+**Then**, build a bundle.
 
 ```shell
 opa build example.rego
+cd ..
 ```
 
-You should now see a policy bundle (`bundle.tar.gz`) in your working directory.
+You should now see a policy bundle (`bundle.tar.gz`) in your working directory (`./bundles/bundle.tar.gz`).
 
 ### 2. Bootstrap the tutorial environment using Docker Compose.
 
@@ -71,7 +78,7 @@ Next, create a `docker-compose.yml` file that runs OPA, a bundle server and the
 version: '2'
 services:
   opa:
-    image: openpolicyagent/opa:{{< current_docker_version >}}-rootless
+    image: openpolicyagent/opa:{{< current_docker_version >}}
     ports:
     - 8181:8181
     # WARNING: OPA is NOT running with an authorization policy configured. This
@@ -249,7 +256,7 @@ real world, let's try a similar exercise utilizing the JWT utilities of OPA.
 ```live:jwt_example:module:openable
 package httpapi.authz
 
-default allow = false
+default allow := false
 
 # Allow users to get their own salaries.
 allow {
@@ -281,7 +288,7 @@ allow {
 user_owns_token { input.user == token.payload.azp }
 
 # Helper to get the token payload.
-token = {"payload": payload} {
+token := {"payload": payload} {
     [header, payload, signature] := io.jwt.decode(input.token)
 }
 ```
diff --git a/docs/content/integration.md b/docs/content/integration.md
index bd9b0d9cdb..223260b5e5 100644
--- a/docs/content/integration.md
+++ b/docs/content/integration.md
@@ -31,7 +31,9 @@ OPA supports different ways to evaluate policies.
 * The [Go API (GoDoc)](https://pkg.go.dev/github.com/open-policy-agent/opa/rego) returns
   decisions as simple Go types (`bool`, `string`, `map[string]interface{}`,
   etc.)
-* [WebAssembly](../wasm) compiles Rego policies into WASM instructions so they can be embedded and evaluated by any WebAssembly runtime
+* [WebAssembly](../wasm) compiles Rego policies into Wasm instructions so they can be embedded and evaluated by any WebAssembly runtime
+* Custom compilers and evaluators may be written to parse evaluation plans in the low-level
+  [Intermediate Representation](../ir) format, which can be emitted by the `opa build` command
 * The [SDK](https://pkg.go.dev/github.com/open-policy-agent/opa/sdk) provides high-level APIs for obtaining the output
   of query evaluation as simple Go types (`bool`, `string`, `map[string]interface{}`, etc.)
 
@@ -66,20 +68,19 @@ decisions: `example/authz/allow` and `example/authz/is_admin`.
 ```live:authz:module:openable,read_only
 package example.authz
 
-default allow = false
+import future.keywords.if
+import future.keywords.in
 
-allow {
+default allow := false
+
+allow if {
     input.method == "GET"
     input.path == ["salary", input.subject.user]
 }
 
-allow {
-    is_admin
-}
+allow if is_admin
 
-is_admin {
-    input.subject.groups[_] == "admin"
-}
+is_admin if "admin" in input.subject.groups
 ```
 
 You can request specific decisions by querying for `<package path>/<rule name>`.
@@ -166,12 +167,109 @@ Content-Type: application/json
 For another example of how to integrate with OPA via HTTP see the [HTTP
 API Authorization](../http-api-authorization) tutorial.
 
+### Integrating with the Go SDK
+
+The [SDK](https://pkg.go.dev/github.com/open-policy-agent/opa/sdk) package contains high-level APIs for embedding OPA
+inside of Go programs and obtaining the output of query evaluation. To get started, import the `sdk` package:
+
+```go
+import "github.com/open-policy-agent/opa/sdk"
+```
+
+A typical workflow when using the `sdk` package would involve first creating a new `sdk.OPA` object by calling
+`sdk.New` and then invoking its `Decision` method to fetch the policy decision. The `sdk.New` call takes the
+`sdk.Options` object as an input which allows specifying the OPA configuration, console logger, plugins, etc.
+
+Here is an example that shows this process:
+
+```go
+package main
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/sdk"
+	sdktest "github.com/open-policy-agent/opa/sdk/test"
+)
+
+func main() {
+	ctx := context.Background()
+
+	// create a mock HTTP bundle server
+	server, err := sdktest.NewServer(sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+		"example.rego": `
+				package authz
+
+				import future.keywords.if
+
+				default allow := false
+
+				allow if input.open == "sesame"
+			`,
+	}))
+	if err != nil {
+		// handle error.
+	}
+
+	defer server.Stop()
+
+	// provide the OPA configuration which specifies
+	// fetching policy bundles from the mock server
+	// and logging decisions locally to the console
+	config := []byte(fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL()))
+
+	// create an instance of the OPA object
+	opa, err := sdk.New(ctx, sdk.Options{
+		ID:     "opa-test-1",
+		Config: bytes.NewReader(config),
+	})
+	if err != nil {
+		// handle error.
+	}
+
+	defer opa.Stop(ctx)
+
+	// get the named policy decision for the specified input
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/authz/allow", Input: map[string]interface{}{"open": "sesame"}}); err != nil {
+		// handle error.
+	} else if decision, ok := result.Result.(bool); !ok || !decision {
+		// handle error.
+	}
+}
+```
+
+If you executed this code, the output (i.e. [Decision Log](https://www.openpolicyagent.org/docs/latest/management-decision-logs/) event)
+would be logged to the console by default.
+
+Setting an `ID` in `sdk.Options` is optional, but recommended. If you do not set an `ID`, a random one will be created
+for the system. While this is fine for testing, it makes it difficult to monitor the system over time, as a new ID will
+be created each time the SDK is initialized, such as when the process is restarted.
+
 ### Integrating with the Go API
 
-Use the
+Use the low-level
 [github.com/open-policy-agent/opa/rego](https://pkg.go.dev/github.com/open-policy-agent/opa/rego)
-package to embed OPA as a library inside services written in Go. To get started
-import the `rego` package:
+package to embed OPA as a library inside services written in Go, when only policy **evaluation** — and
+no other capabilities of OPA, like the management features — are desired. If you're unsure which one to
+use, the SDK is probably the better option.
+
+To get started import the `rego` package:
 
 ```go
 import "github.com/open-policy-agent/opa/rego"
@@ -199,23 +297,23 @@ store, etc.
 module := `
 package example.authz
 
-default allow = false
+import future.keywords.if
+import future.keywords.in
 
-allow {
-    some id
+default allow := false
+
+allow if {
     input.method == "GET"
     input.path == ["salary", input.subject.user]
 }
 
-allow {
-    is_admin
-}
+allow if is_admin
 
-is_admin {
-    input.subject.groups[_] = "admin"
-}
+is_admin if "admin" in input.subject.groups
 `
 
+ctx := context.TODO()
+
 query, err := rego.New(
     rego.Query("x = data.example.authz.allow"),
     rego.Module("example.rego", module),
@@ -239,7 +337,6 @@ input := map[string]interface{}{
     },
 }
 
-ctx := context.TODO()
 results, err := query.Eval(ctx, rego.EvalInput(input))
 ```
 
@@ -287,96 +384,12 @@ Policies can be evaluated as compiled Wasm binaries.
 
 See [OPA Wasm docs](../wasm) for more details.
 
+### Intermediate Representation (IR)
 
-### SDK
+Policies may be compiled into evaluation plans using an intermediate representation format, suitable for custom
+compilers and evaluators.
 
-The [SDK](https://pkg.go.dev/github.com/open-policy-agent/opa/sdk) package contains high-level APIs for embedding OPA
-inside of Go programs and obtaining the output of query evaluation. To get started
-import the `sdk` package:
-
-```go
-import "github.com/open-policy-agent/opa/sdk"
-```
-
-A typical workflow when using the `sdk` package would involve first creating a new `sdk.OPA` object by calling
-`sdk.New` and then invoking its `Decision` method to fetch the policy decision. The `sdk.New` call takes the
-`sdk.Options` object as an input which allows specifying the OPA configuration, console logger, plugins, etc.
-
-Here is an example that shows this process:
-
-```go
-package main
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-
-	"github.com/open-policy-agent/opa/sdk"
-	sdktest "github.com/open-policy-agent/opa/sdk/test"
-)
-
-func main() {
-	ctx := context.Background()
-
-	// create a mock HTTP bundle server
-	server, err := sdktest.NewServer(sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
-		"example.rego": `
-				package authz
-
-				default allow = false
-
-				allow {
-					input.open == "sesame"
-				}
-			`,
-	}))
-	if err != nil {
-		// handle error.
-	}
-
-	defer server.Stop()
-
-	// provide the OPA configuration which specifies
-	// fetching policy bundles from the mock server
-	// and logging decisions locally to the console
-	config := []byte(fmt.Sprintf(`{
-		"services": {
-			"test": {
-				"url": %q
-			}
-		},
-		"bundles": {
-			"test": {
-				"resource": "/bundles/bundle.tar.gz"
-			}
-		},
-		"decision_logs": {
-			"console": true
-		}
-	}`, server.URL()))
-
-	// create an instance of the OPA object
-	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
-	})
-	if err != nil {
-		// handle error.
-	}
-
-	defer opa.Stop(ctx)
-
-	// get the named policy decision for the specified input
-	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/authz/allow", Input: map[string]interface{}{"open": "sesame"}}); err != nil {
-		// handle error.
-	} else if decision, ok := result.Result.(bool); !ok || !decision {
-		// handle error.
-	}
-}
-```
-
-If you executed this code, the output (i.e. [Decision Log](https://www.openpolicyagent.org/docs/latest/management-decision-logs/) event)
-would be logged to the console by default.
+See [OPA IR docs](../ir) for more details.
 
 ## Comparison
 
@@ -394,6 +407,4 @@ Integrating OPA via the REST API is the most common, at the time of writing.  OP
 
 Integrating OPA via the Go API only works for Go software.  Updates to OPA require re-vendoring and re-deploying the software.  Evaluation has less overhead than the REST API because all the communication happens in the same operating-system process.  All of the management functionality (bundles, decision logs, etc.) must be either enabled or implemented.  Security concerns are limited to those management features that are enabled or implemented.
 
-Integrating via WASM is still a work-in-progress.  But once it is finished, WASM policies will be embeddable in any programming language that has a WASM runtime.  Evaluation will have less overhead than the REST API (because it is evaluated in the same operating-system process) and should outperform the Go API (because the policies have been compiled to a lower-level instruction set).  Each programming language will need its own SDKs (also a WIP) that implement the management functionality and the evaluation interface. Typically new OPA language features will not require updating the service since neither the WASM runtime nor the SDKs will be impacted.  Updating the SDKs will require re-deploying the service.  Security will be analogous to the Go API integration: it is mainly the management functionality that presents security risks.
-
-
+Wasm policies are embeddable in any programming language that has a Wasm runtime. Evaluation has less overhead than the REST API (because it is evaluated in the same operating-system process) and should outperform the Go API (because the policies have been compiled to a lower-level instruction set). Each programming language will need its own SDKs that implement the management functionality and the evaluation interface. Typically new OPA language features will not require updating the service since neither the Wasm runtime nor the SDKs will be impacted. Updating the SDKs will require re-deploying the service. Security is analogous to the Go API integration: it is mainly the management functionality that presents security risks.
diff --git a/docs/content/ir.md b/docs/content/ir.md
new file mode 100644
index 0000000000..8e99a4d750
--- /dev/null
+++ b/docs/content/ir.md
@@ -0,0 +1,457 @@
+---
+title: Intermediate Representation (IR)
+kind: documentation
+weight: 100
+---
+
+# Overview
+
+OPA can compile policy queries into planned evaluation paths suitable for
+further compilation or interpretation. This document explains the structure and
+semantics of the intermediate representation (IR) used to represent these
+planned evaluation paths. Read this document if you want to write a compiler or
+interpreter for Rego.
+
+# Structure
+
+This section explains the structure of policies compiled into the IR.
+
+## Policy
+
+The root object emitted by the compiler is a `Policy` and contains the following
+top-level keys:
+
+* `static` is an object containing static data used by the compiled plans and
+  functions.
+* `plans` is an object containing entrypoints to compiled evaluation paths.
+* `funcs` is an object containing functions supporting the compiled evaluation
+  paths.
+
+## Static
+
+The `Static` object contains static data required by the plans and functions.
+The static object also contains metadata that does not affect the semantics of
+the policy. The static object contains the following top-level keys:
+
+* `strings` is an array of string constants referenced by compiled statements in
+  the plans and functions.
+* `builtin_funcs` is an array of function declarations representing built-in
+  functions required by the compiled statements.
+* `files` is used for debugging purposes only. It is an array of filenames that
+  were used during compilation.
+
+### Strings
+
+The `Strings` array is a collection of string objects referenced by compiled
+statements in the policy. Strings are referenced by their index in the
+collection. Each string object contains the following fields:
+
+* `value` is the string constant value. The string may be any valid JSON string.
+
+### Built-in Functions
+
+The `Built-in Functions` array is a collection of built-in function
+declarations. Each declaration represents a function that must be provided by
+the environment where the policy is eventually executed. Each built-in function
+contains the following fields:
+
+* `name` is the name of the function that must be provided.
+* `decl` is the type definition of the function.
+
+### Files
+
+The `Files` array is a collection of static strings representing names of source
+files used during compilation. Filenames are referred to by their index in the
+files array.
+
+## Plans
+
+The `Plans` object contains a collection of planned evaluation paths
+representing entrypoints to the policy. When users compile policies they supply
+the queries to expose as entrypoints. Each plan contains the following fields:
+
+* `name` is the entrypoint identifier, typically set to the path of the policy
+  decision (e.g., `authz/allow`).
+* `blocks` is a collection of [`Block`](#blocks) objects representing the
+  compiled statements that define the entrypoint.
+
+## Functions
+
+The `Functions` object contains a collection of function definitions that
+represent functions supporting the plans. Functions can be invoked by name
+inside of plans and other functions. Each function contains the following
+fields:
+
+* `name` is the function identifier referenced by call statements.
+* `path` is the function identifier referenced by dynamic call statements.
+* `params` is an ordered list of local variable identifiers representing
+  function parameters. The parameters can be referenced inside of the blocks
+  that define the function.
+* `return` is the local variable containing the return value of the function.
+* `blocks` is collection of [`Block`](#blocks) objects representing the compiled
+  statements that define the function.
+
+## Blocks
+
+The `Block` object contains a sequence of [Statements](#statements) that must be
+executed in order until a statement terminating block execution is encountered
+or the end of the block is reached. Each block contains the following fields:
+
+* `stmts` is an array of `Statement` objects.
+
+## Statements
+
+The `Statement` object represents an operation performed by the policy (e.g.,
+function invocation, lookup, iteration, comparison, etc.) The structure is
+specific to each statement type but every statement contains the following
+fields:
+
+* `type` is a string value that identifies the type of the statement.
+* `stmt` is an object containing statement-specific fields.
+* `file` is the index of source filename where this statement originated.
+* `row` is the row in the source file where this statement originated.
+* `col` is the column in the source file where this statement originated.
+
+See the [Statement Definitions](#statement-definitions) section for an
+explanation of the supported statement types.
+
+# Execution
+
+This section explains the execution model for compiled policies.
+
+## Plan Execution
+
+Compiled policies consist of one or more plans. Any plan can be invoked by name.
+If no name is supplied, the first plan in the policy should be executed. Plans
+consist of one or more [Blocks](#blocks) that are executed in-order. Statements
+inside the blocks of a plan have implicit access to two local variables
+representing the `input` and `data` documents (`0` and `1` respectively.) The
+final statement in every block inside of a plan is a `ResultSetAddStmt`
+statement that adds an object to an implicit result set. The object contains the
+key-value bindings representing the values of variables in the original query.
+If no `ResultSetAddStmt` statements are executed, the implicit result set is
+empty.
+
+## Function Execution
+
+Compiled policies may contain zero or more functions. Any function can be
+invoked by name via the `CallStmt` statement or dynamically via the
+`CallDynamicStmt` statement. All functions are defined with two or more
+positional arguments. The first positional argument is a local variable
+representing the `input` document. The second positional argument is a local
+variable representing the `data` document. Function execution terminates when a
+`ReturnLocalStmt` statement is encountered. All functions include a final block
+that includes a `ReturnLocalStmt`.
+
+## Block Execution
+
+Blocks are sequences of statements that are executed in order. Statements can be
+executed if all of the input parameters are defined. If any input parameter is
+undefined then the statement is undefined. The [Statement
+Definitions](#statement-definitions) section below indicates when a statement
+may be undefined. When a statement is undefined execution breaks to the end of
+the current block and resumes execution at the statement immediately following
+the block (which may be the beginning of another block.) When a statement is
+defined, all output parameters are defined. Execution halts if a statement
+raises an exception.
+
+# Statement Definitions
+
+This section defines the statements that can be contained in plans and functions
+and explains the input and output parameters that each statement accepts. The
+set of valid parameter types are:
+
+* `local` is a 32-bit integer representing a local variable.
+* `int32` is a 32-bit integer.
+* `int64` is a 64-bit integer.
+* `uint32` is a 32-bit unsigned integer.
+* `string` is an arbitrary-length unicode string.
+* `array[...]` represents a sequence of `...` values.
+
+In addition, parameters may be of type `operand`. The `operand` type represents
+a tagged union that can refer to a local variable, boolean constant, or string
+constant index:
+
+```
+{
+    "type": "local" | "bool" | "string_index"
+    "value": number | boolean | number
+}
+```
+
+Local variables refer to values. The value types are any JSON value (i.e., `null`,
+`true`, `false`, `number`, `string`, `array`, and `object`) as well as sets
+(which are unordered value collections.)
+
+## `ArrayAppendStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`array` | `input` | `local` | The array to append a value to.
+`value` | `input` | `operand` | The value to append to the array.
+
+## `AssignIntStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`value` | `input` | `int64` | The integer value to assign to the target.
+`target` | `output` | `local` | The local variable to assign the integer to.
+
+## `AssignVarOnceStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to assign to the target.
+`target` | `output` | `local` | The local variable to assign the operand to.
+
+{{< danger >}}
+This statement raises an exception if the `target` operand is already assigned.
+{{< /danger >}}
+
+## `AssignVarStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to assign to the target.
+`target` | `output` | `local` | The local variable to assign the operand to.
+
+## `BlockStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`blocks` | `input` | [Blocks](#blocks) | The nested blocks to execute.
+
+## `BreakStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`index` | `input` | `uint32` | The index of the block to jump out of starting with zero representing the current block and incrementing by one for each outer block.
+
+## `CallDynamicStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`path` | `input` | `array[operand]` | The path of the function to invoke.
+`args` | `input` | `array[local]` | The positional arguments to pass to the function.
+`result` | `output` | `local` | The local variable to assign the function return value to.
+
+## `CallStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`func` | `input` | `string` | The name of the function to invoke.
+`args` | `input` | `array[local]` | The positional arguments to pass to the function.
+`result` | `output` | `local` | The local variable to assign the function return value to.
+
+## `DotStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to perform a lookup operation on.
+`key` | `input` | `operand` | The key to lookup in the source.
+`target` | `output` | `local` | The local variable to assign the result to.
+
+This statement is **undefined** if the `key` does not exist in the `source` value.
+
+## `EqualStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`a` | `input` | `operand` | The first value to compare.
+`b` | `input` | `operand` | The second value to compare.
+
+This statement is **undefined** if `a` does not equal `b`.
+
+## `IsArrayStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to check.
+
+This statement is **undefined** if `source` is not an array.
+
+## `IsDefinedStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to check.
+
+This statement is **undefined** if `source` is undefined.
+
+## `IsObjectStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to check.
+
+This statement is **undefined** if `source` is not an object.
+
+## `IsUndefinedStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to check.
+
+This statement is **undefined** if `source` is not undefined.
+
+## `LenStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `operand` | The value to compute the length for.
+`target` | `output` | `local` | The local variable to assign the length to.
+
+## `MakeArrayStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`capacity` | `input` | `int32` | The initial size of the array to pre-allocate.
+`target` | `output` | `local` | The local variable to assign the array value to.
+
+## `MakeNullStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`target` | `output` | `local` | The local variable to assign the null value to.
+
+## `MakeNumberIntStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`value` | `input` | `int64` | The integer value to initialize the target with.
+`target` | `output` | `local` | The local variable to assign the number to.
+
+## `MakeNumberRefStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`index` | `input` | `int32` | The index of the string constant to construct the number with.
+`target` | `output` | `local` | The local variable to assign the number to.
+
+## `MakeObjectStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`target` | `output` | `local` | The local variable to assign the object to.
+
+## `MakeSetStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`target` | `output` | `local` | The local variable to assign the set to.
+
+## `NopStmt`
+
+This statement is only used for debugging purposes.
+
+## `NotEqualStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`a` | `input` | `operand` | The first value to compare.
+`b` | `input` | `operand` | The second value to compare.
+
+This statement is **undefined** if `a` is equal to `b`.
+
+## `NotStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`block` | `input` | [Block](#blocks) | The negated statement to execute.
+
+This statement is **undefined** if the contained block is not undefined.
+
+## `ObjectInsertOnceStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`key` | `input` | `operand` | The key to insert into the object.
+`value` | `input` | `operand` | The value to insert into the object.
+`object` | `input` | `local` | The object to insert the key-value pair into.
+
+{{< danger >}}
+This statement raises an exception if the `object` contains an existing `key` with a different `value`.
+{{< /danger >}}
+
+## `ObjectInsertStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`key` | `input` | `operand` | The key to insert into the object.
+`value` | `input` | `operand` | The value to insert into the object.
+`object` | `input` | `local` | The object to insert the key-value pair into.
+
+## `ObjectMergeStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`a` | `input` | `local` | The object to merge into.
+`b` | `input` | `local` | The object to merge from.
+`target` | `output` | `local` | The local variable to assign the merged object to.
+
+## `ResetLocalStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`target` | `output` | `local` | The local variable to reset.
+
+## `ResultSetAddStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`value` | `input` | `local` | The value to add to the result set.
+
+## `ReturnLocalStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `local` | The value to return from the function.
+
+## `ScanStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`source` | `input` | `local` | The value to scan.
+`key` | `output` | `local` | The local variable to assign keys to before executing the nested block.
+`value` | `output` | `local` | The local variable to assign values to before executing the nested block.
+`block` | `input` | [Block](#blocks) | The nested block to execute repeatedly for each element in the collection.
+
+This statement is **undefined** if `source` is a scalar value or empty collection.
+
+## `SetAddStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`value` | `input` | `operand` | The value to insert into the set.
+`set` | `input` | `local` | The set to insert the value into.
+
+## `WithStmt`
+
+Parameter | Input/Output | Type | Description
+--- | --- | --- | ---
+`local` | `input` | `local` | The value to mutate in the context of the nested block.
+`path` | `input` | `array[int32]` | The path of the nested document to replace with the `value` represented as an array of string constant indices.
+`value` | `input` | `operand` | The value to upsert.
+`block` | `input` | [Block](#blocks) | The nested block to execute in the context of the mutation.
+
+# Test Suite
+
+The OPA repository contains a [test
+suite](https://github.com/open-policy-agent/opa/tree/main/test/cases/testdata)
+that is used internally to validate both the Go interpreter and the Wasm
+compiler. If you are implementing your own compiler or interpreter we highly
+recommend integrating the test suite into your own development environment so
+that your implementation can be verified to conform with OPA's.
+
+The test suite consists of a set of YAML files that each contain a set of test
+cases. Each test cases specifies a query, set of modules, data values, and
+expected outputs or expected error conditions.
+
+To get started with the test suite, see the [Hello
+World](https://github.com/open-policy-agent/opa/blob/main/test/cases/testdata/helloworld/test-helloworld-1.yaml)
+example.
+
+The following examples show how the test suite is used internally:
+
+* [`github.com/open-policy-agent/opa/topdown#TestRego`](https://github.com/open-policy-agent/opa/blob/main/topdown/exported_test.go)
+* [`github.com/open-policy-agent/opa/internal/wasm/sdk/test/e2e/external_test`](https://github.com/open-policy-agent/opa/blob/main/internal/wasm/sdk/test/e2e/external_test.go)
diff --git a/docs/content/kafka-authorization.md b/docs/content/kafka-authorization.md
index e69c32486c..418d90b3f2 100644
--- a/docs/content/kafka-authorization.md
+++ b/docs/content/kafka-authorization.md
@@ -15,8 +15,8 @@ This tutorial shows how to enforce fine-grained access control over Kafka
 topics. In this tutorial you will use OPA to define and enforce an
 authorization policy stating:
 
-* Consumers of topics containing Personally Identifiable Information (PII) must be whitelisted.
-* Producers to topics with _high fanout_ must be whitelisted.
+* Consumers of topics containing Personally Identifiable Information (PII) must be on allow list.
+* Producers to topics with _high fanout_ must be on allow list.
 
 In addition, this tutorial shows how to break up a policy with small helper
 rules to reuse logic and improve overall readability.
@@ -25,87 +25,115 @@ rules to reuse logic and improve overall readability.
 
 This tutorial requires [Docker Compose](https://docs.docker.com/compose/install/) to run Kafka, ZooKeeper, and OPA.
 
+Additionally, we'll use Nginx for serving policy and data bundles to OPA. This component is however easily replaceable
+by any other bundle server [implementation](../management-bundles/#implementations).
+
 ## Steps
 
 ### 1. Bootstrap the tutorial environment using Docker Compose.
 
-First, create an OPA policy that allows all requests. You will update this policy later in the tutorial.
+First, let's create some directories. We'll create one for our policy files, a second one for built bundles, and a third
+one or the OPA authorizer plugin.
 
 ```bash
-mkdir -p policies
+mkdir policies bundles plugin
 ```
 
+Next, create an OPA policy that allows all requests. You will update this policy later in the tutorial.
+
 **policies/tutorial.rego**:
 
 ```live:start:module:read_only
 package kafka.authz
 
-allow = true
+allow := true
+```
+
+With the policy in place, build a bundle from the contents of the `policies` directory and place it in the `bundles`
+directory. The `bundles` directory will later be mounted into the Nginx container in order to distribute policy updates
+to OPA.
+
+```shell
+opa build --bundle policies/ --output bundles/bundle.tar.gz
 ```
 
-Next, create a `docker-compose.yaml` file that runs OPA, ZooKeeper, and Kafka.
+#### Kafka Authorizer JAR File
+
+Next, download the latest version of the [Open Policy Agent plugin for Kafka authorization](https://github.com/StyraInc/opa-kafka-plugin)
+plugin from the projects [release pages](https://github.com/StyraInc/opa-kafka-plugin/releases).
+
+Store the plugin in the `plugin` directory (replace `${version}` with the version number of the plugin just downloaded):
+```bash
+mv opa-authorizer-${version}-all.jar plugin/
+```
+
+For more information on how to configure the OPA plugin for Kafka, see the plugin [repository](https://github.com/StyraInc/opa-kafka-plugin).
+
+Next, create a `docker-compose.yaml` file that runs OPA, Nginx, ZooKeeper, and Kafka.
 
 **docker-compose.yaml**:
 
 ```yaml
-version: "2"
 services:
+  nginx:
+    image: nginx:1.21.4
+    volumes:
+      - "./bundles:/usr/share/nginx/html"
+    ports:
+      - "80:80"
   opa:
-    hostname: opa
     image: openpolicyagent/opa:{{< current_docker_version >}}
     ports:
-      - 8181:8181
-    # WARNING: OPA is NOT running with an authorization policy configured. This
-    # means that clients can read and write policies in OPA. If you are deploying
-    # OPA in an insecure environment, you should configure authentication and
-    # authorization on the daemon. See the Security page for details:
-    # https://www.openpolicyagent.org/docs/security.html.
-    command: "run --server --watch /policies"
-    volumes:
-      - ./policies:/policies
+      - "8181:8181"
+    command:
+      - "run"
+      - "--server"
+      - "--set=decision_logs.console=true"
+      - "--set=services.authz.url=http://nginx"
+      - "--set=bundles.authz.service=authz"
+      - "--set=bundles.authz.resource=bundle.tar.gz"
+    depends_on:
+      - nginx
   zookeeper:
-    image: confluentinc/cp-zookeeper:4.0.0-3
+    image: confluentinc/cp-zookeeper:6.2.1
+    ports:
+      - "2181:2181"
     environment:
-      ZOOKEEPER_CLIENT_PORT: 2181
-      zk_id: "1"
-  kafka:
-    hostname: kafka
-    image: openpolicyagent/demo-kafka:1.0
-    links:
-      - zookeeper
-      - opa
+      - ALLOW_ANONYMOUS_LOGIN=yes
+      - ZOOKEEPER_CLIENT_PORT=2181
+  broker:
+    image: confluentinc/cp-kafka:6.2.1
     ports:
-      - "9092:9092"
+      - "9093:9093"
     environment:
-      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: "1"
+      # Set cache expiry to low value for development in order to see decisions
+      KAFKA_OPA_AUTHORIZER_CACHE_EXPIRE_AFTER_SECONDS: 10
+      KAFKA_OPA_AUTHORIZER_URL: http://opa:8181/v1/data/kafka/authz/allow
+      KAFKA_AUTHORIZER_CLASS_NAME: org.openpolicyagent.kafka.OpaAuthorizer
+      KAFKA_BROKER_ID: 1
       KAFKA_ZOOKEEPER_CONNECT: "zookeeper:2181"
-      KAFKA_ADVERTISED_LISTENERS: "SSL://:9093"
+      KAFKA_ADVERTISED_LISTENERS: SSL://localhost:9093
       KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SSL
+      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
+      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
+      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
+      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
+      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
+      KAFKA_SSL_KEYSTORE_FILENAME: server.keystore
+      KAFKA_SSL_KEYSTORE_CREDENTIALS: credentials.txt
+      KAFKA_SSL_KEY_CREDENTIALS: credentials.txt
+      KAFKA_SSL_TRUSTSTORE_FILENAME: server.truststore
+      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: credentials.txt
       KAFKA_SSL_CLIENT_AUTH: required
-      KAFKA_SSL_KEYSTORE_FILENAME: kafka.broker.keystore.jks
-      KAFKA_SSL_KEYSTORE_CREDENTIALS: broker_keystore_creds
-      KAFKA_SSL_KEY_CREDENTIALS: broker_sslkey_creds
-      KAFKA_SSL_TRUSTSTORE_FILENAME: kafka.broker.truststore.jks
-      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: broker_truststore_creds
-      KAFKA_AUTHORIZER_CLASS_NAME: com.lbg.kafka.opa.OpaAuthorizer
-      KAFKA_OPA_AUTHORIZER_URL: "http://opa:8181/v1/data/kafka/authz/allow"
-      KAFKA_OPA_AUTHORIZER_ALLOW_ON_ERROR: "false"
-      KAFKA_OPA_AUTHORIZER_CACHE_INITIAL_CAPACITY: 100
-      KAFKA_OPA_AUTHORIZER_CACHE_MAXIMUM_SIZE: 100
-      KAFKA_OPA_AUTHORIZER_CACHE_EXPIRE_AFTER_MS: 600000
-```
-
-For more information on how to configure the OPA plugin for Kafka, see the [github.com/open-policy-agent/contrib](https://github.com/open-policy-agent/contrib)
-repository.
-
-Once you have created the file, launch the containers for this tutorial.
-
-```bash
-docker-compose --project-name opa-kafka-tutorial up
+      CLASSPATH: "/plugin/*"
+    volumes:
+      - "./plugin:/plugin"
+      - "./cert/server:/etc/kafka/secrets"
+    depends_on:
+      - opa
+      - zookeeper
 ```
 
-Now that the tutorial environment is running, we can define an authorization policy using OPA and test it.
-
 #### Authentication
 
 The Docker Compose file defined above requires **SSL client authentication**
@@ -115,43 +143,89 @@ example below shows the input structure.
 
 ```json
 {
-  "operation": {
-    "name": "Write"
-  },
-  "resource": {
-    "resourceType": {
-      "name": "Topic"
+  "action": {
+    "logIfAllowed": true,
+    "logIfDenied": true,
+    "operation": "WRITE",
+    "resourcePattern": {
+      "name": "credit-scores",
+      "patternType": "LITERAL",
+      "resourceType": "TOPIC",
+      "unknown": false
     },
-    "name": "credit-scores"
+    "resourceReferenceCount": 1
   },
-  "session": {
+  "requestContext": {
+    "clientAddress": "/172.22.0.1",
+    "clientInformation": {
+      "softwareName": "apache-kafka-java",
+      "softwareVersion": "2.8.1"
+    },
+    "connectionId": "172.22.0.5:9093-172.22.0.1:62744-2",
+    "header": {
+      "headerVersion": 2,
+      "name": {
+        "clientId": "consumer-console-producer-63933-1",
+        "correlationId": 10,
+        "requestApiKey": 1,
+        "requestApiVersion": 12
+      }
+    },
+    "listenerName": "SSL",
     "principal": {
+      "name": "CN=anon_producer,OU=Developers",
       "principalType": "User"
     },
-    "clientAddress": "172.21.0.5",
-    "sanitizedUser": "CN%3Danon_producer.tutorial.openpolicyagent.org%2COU%3DTUTORIAL%2CO%3DOPA%2CL%3DSF%2CST%3DCA%2CC%3DUS"
+    "securityProtocol": "SSL"
   }
 }
 ```
 
 The client identity is extracted from the SSL certificates that clients
-present when they connect to the broker. The client identity information is
-encoded in the `input.session.sanitizedUser` field. This field can be decoded
-inside the policy.
-
-Generating SSL certificates and JKS files required for SSL client
-authentication is outside the scope of this tutorial. To simplify the steps
-below, the Docker Compose file uses an extended version of the
-[confluentinc/cp-kafka](https://hub.docker.com/r/confluentinc/cp-kafka/)
-image from Docker Hub. The extended image includes **pre-generated SSL
-certificates** that the broker and clients use to identify themselves.
-
-Do not rely on these pre-generated SSL certificates in real-world scenarios.
+present when they connect to the broker. The user identity information is
+encoded in the `input.requestContext.principal.name` field.
+This field can be used inside the policy.
+
+A detailed rundown of generating SSL certificates and JKS files required
+for SSL client authentication is outside the scope of this tutorial, but the plugin
+repository provides an [example script](https://github.com/StyraInc/opa-kafka-plugin/tree/main/example/opa_tutorial/create_cert.sh)
+that demonstrates the creation of client certificates for the four different
+users used in this tutorial:
+
+* `anon_producer`
+* `anon_consumer`
+* `pii_consumer`
+* `fanout_producer`
+
+Lets' download the script and run it:
+
+```shell
+curl -O https://raw.githubusercontent.com/StyraInc/opa-kafka-plugin/main/example/opa_tutorial/create_cert.sh
+chmod +x create_cert.sh
+./create_cert.sh
+```
+
+We should now find a new `cert` directory created by the script,
+containing the server and client certificates we'll need for TLS
+authentication.
+
+Note: Do not rely on these SSL certificates in real-world scenarios.
 They are only provided for convenience/test purposes.
 
-#### Kafka Authorizer JAR File
+If you'd rather set up these users by other means, like one
+of the available SASL mechanisms Kafka provides, that should work
+just as well. Just make sure to update the Docker compose file
+accordingly.
+
+Once you have created the files needed for authentication,
+you may launch the containers for this tutorial.
+
+```bash
+docker-compose --project-name opa-kafka-tutorial up
+```
+
+Now that the tutorial environment is running, we can define an authorization policy using OPA and test it.
 
-The Kafka image used in this tutorial includes a pre-installed JAR file that implements the [Kafka Authorizer](https://kafka.apache.org/documentation/#security_authz) interface. For more information on the authorizer see [open-policy-agent/contrib/kafka_authorizer](https://github.com/open-policy-agent/contrib/tree/main/kafka_authorizer).
 
 ### 2. Define a policy to restrict consumer access to topics containing Personally Identifiable Information (PII).
 
@@ -170,7 +244,9 @@ Update the `policies/tutorial.rego` with the following content.
 #-----------------------------------------------------------------------------
 package kafka.authz
 
-default allow = false
+import future.keywords.in
+
+default allow := false
 
 allow {
 	not deny
@@ -179,7 +255,7 @@ allow {
 deny {
 	is_read_operation
 	topic_contains_pii
-	not consumer_is_whitelisted_for_pii
+	not consumer_is_allowlisted_for_pii
 }
 
 #-----------------------------------------------------------------------------
@@ -188,20 +264,20 @@ deny {
 # data could be pulled from external sources like AD, Git, etc.
 #-----------------------------------------------------------------------------
 
-consumer_whitelist = {"pii": {"pii_consumer"}}
+consumer_allowlist := {"pii": {"pii_consumer"}}
 
-topic_metadata = {"credit-scores": {"tags": ["pii"]}}
+topic_metadata := {"credit-scores": {"tags": ["pii"]}}
 
 #-----------------------------------
 # Helpers for checking topic access.
 #-----------------------------------
 
 topic_contains_pii {
-	topic_metadata[topic_name].tags[_] == "pii"
+	"pii" in topic_metadata[topic_name].tags
 }
 
-consumer_is_whitelisted_for_pii {
-	consumer_whitelist.pii[_] == principal.name
+consumer_is_allowlisted_for_pii {
+	principal.name in consumer_allowlist.pii
 }
 
 #-----------------------------------------------------------------------------
@@ -211,27 +287,30 @@ consumer_is_whitelisted_for_pii {
 #-----------------------------------------------------------------------------
 
 is_write_operation {
-    input.operation.name == "Write"
+    input.action.operation == "WRITE"
 }
 
 is_read_operation {
-	input.operation.name == "Read"
+	input.action.operation == "READ"
 }
 
 is_topic_resource {
-	input.resource.resourceType.name == "Topic"
+	input.action.resourcePattern.resourceType == "TOPIC"
 }
 
-topic_name = input.resource.name {
+topic_name := input.action.resourcePattern.name {
 	is_topic_resource
 }
 
-principal = {"fqn": parsed.CN, "name": cn_parts[0]} {
-	parsed := parse_user(urlquery.decode(input.session.sanitizedUser))
+principal := {"fqn": parsed.CN, "name": cn_parts[0]} {
+	parsed := parse_user(input.requestContext.principal.name)
 	cn_parts := split(parsed.CN, ".")
 }
 
-parse_user(user) = {key: value |
+# If client certificates aren't used for authentication
+else := {"fqn": "", "name": input.requestContext.principal.name}
+
+parse_user(user) := {key: value |
 	parts := split(user, ",")
 	[key, value] := split(parts[_], "=")
 }
@@ -240,7 +319,7 @@ parse_user(user) = {key: value |
 The Kafka authorization plugin is configured to query for the
 `data.kafka.authz.allow` decision. If the response is `true` the operation is
 allowed, otherwise the operation is denied. When the integration queries OPA it
-supplies a JSON representation of the operation, resource, and principal.
+supplies a JSON representation of the operation, resource, client, and principal.
 
 ```live:example:query:hidden
 data.kafka.authz.allow
@@ -248,21 +327,40 @@ data.kafka.authz.allow
 
 ```live:example:input
 {
-  "operation": {
-    "name": "Write"
-  },
-  "resource": {
-    "resourceType": {
-      "name": "Topic"
+  "action": {
+    "logIfAllowed": true,
+    "logIfDenied": true,
+    "operation": "READ",
+    "resourcePattern": {
+      "name": "credit-scores",
+      "patternType": "LITERAL",
+      "resourceType": "TOPIC",
+      "unknown": false
     },
-    "name": "credit-scores"
+    "resourceReferenceCount": 1
   },
-  "session": {
+  "requestContext": {
+    "clientAddress": "/172.22.0.1",
+    "clientInformation": {
+      "softwareName": "apache-kafka-java",
+      "softwareVersion": "2.8.1"
+    },
+    "connectionId": "172.22.0.5:9093-172.22.0.1:62744-2",
+    "header": {
+      "headerVersion": 2,
+      "name": {
+        "clientId": "consumer-console-producer-63933-1",
+        "correlationId": 10,
+        "requestApiKey": 1,
+        "requestApiVersion": 12
+      }
+    },
+    "listenerName": "SSL",
     "principal": {
+      "name": "CN=pii_consumer,OU=developers",
       "principalType": "User"
     },
-    "clientAddress": "172.21.0.5",
-    "sanitizedUser": "CN%3Danon_producer.tutorial.openpolicyagent.org%2COU%3DTUTORIAL%2CO%3DOPA%2CL%3DSF%2CST%3DCA%2CC%3DUS"
+    "securityProtocol": "SSL"
   }
 }
 ```
@@ -272,9 +370,14 @@ With the input value above, the answer is:
 ```live:example:output
 ```
 
-The `./policies` directory is mounted into the Docker container running OPA.
-When the files under this directory change, OPA is notified and the policies
-are automatically reloaded.
+The `./bundles` directory is mounted into the Docker container running Nginx.
+When the bundle under this directory change, OPA is notified via the bundle API,
+and the policies are automatically reloaded.
+
+You can update the bundle at any time by rebuilding it.
+```shell
+opa build --bundle policies/ --output bundles/bundle.tar.gz
+```
 
 At this point, you can exercise the policy.
 
@@ -287,13 +390,13 @@ others are not.
 First, run `kafka-console-producer` to generate some data on the
 `credit-scores` topic.
 
-> This tutorial uses the `kafka-console-producer` and `kafka-console-consumer` scripts to generate and display Kafka messages. These scripts read from STDIN and write to STDOUT and are frequently used to send and receive data via Kafka over the command line. If you are not familiar with these scripts you can learn more in Kafka's [Quick Start](https://kafka.apache.org/documentation/#quickstart) documentation.
+> This tutorial uses the `kafka-console-producer` and `kafka-console-consumer` scripts provided by Kafka to generate and display Kafka messages. These scripts read from STDIN and write to STDOUT and are frequently used to send and receive data via Kafka over the command line. If you are not familiar with these scripts you can learn more in Kafka's [Quick Start](https://kafka.apache.org/documentation/#quickstart) documentation.
 
 
 ```bash
-docker run --rm --network opakafkatutorial_default \
-    openpolicyagent/demo-kafka:1.0 \
-    bash -c 'for i in {1..10}; do echo "{\"user\": \"bob\", \"score\": $i}"; done | kafka-console-producer --topic credit-scores --broker-list kafka:9093 -producer.config /etc/kafka/secrets/anon_producer.ssl.config'
+docker run -v $(pwd)/cert/client:/tmp/client --rm --network opa-kafka-tutorial_default \
+    confluentinc/cp-kafka:6.2.1 \
+    bash -c 'for i in {1..10}; do echo "{\"user\": \"bob\", \"score\": $i}"; done | kafka-console-producer --topic credit-scores --broker-list broker:9093 -producer.config /tmp/client/anon_producer.properties'
 ```
 
 This command will send 10 messages to the `credit-scores` topic. Bob's credit
@@ -304,9 +407,9 @@ the `pii_consumer` credentials to simulate a service that is allowed to read
 PII data.
 
 ```bash
-docker run --rm --network opakafkatutorial_default \
-    openpolicyagent/demo-kafka:1.0 \
-    kafka-console-consumer --bootstrap-server kafka:9093 --topic credit-scores --from-beginning --consumer.config /etc/kafka/secrets/pii_consumer.ssl.config
+docker run -v $(pwd)/cert/client:/tmp/client --rm --network opa-kafka-tutorial_default \
+    confluentinc/cp-kafka:6.2.1 \
+    kafka-console-consumer --bootstrap-server broker:9093 --topic credit-scores --from-beginning --consumer.config /tmp/client/pii_consumer.properties
 ```
 
 This command will output the 10 messages sent to the topic in the first part
@@ -318,9 +421,9 @@ Finally, run `kafka-console-consumer` again but this time try to use the
 service that has **not** been explicitly granted access to PII data.
 
 ```bash
-docker run --rm --network opakafkatutorial_default \
-    openpolicyagent/demo-kafka:1.0 \
-    kafka-console-consumer --bootstrap-server kafka:9093 --topic credit-scores --from-beginning --consumer.config /etc/kafka/secrets/anon_consumer.ssl.config
+docker run -v $(pwd)/cert/client:/tmp/client --rm --network opa-kafka-tutorial_default \
+    confluentinc/cp-kafka:6.2.1 \
+    kafka-console-consumer --bootstrap-server broker:9093 --topic credit-scores --from-beginning --consumer.config /tmp/client/anon_consumer.properties
 ```
 
 Because the `anon_consumer` is not allowed to read PII data, the request will
@@ -338,23 +441,23 @@ First, add the following content to the policy file (`./policies/tutorial.rego`)
 
 ```live:example/deny:module:openable
 deny {
-  is_write_operation
-  topic_has_large_fanout
-  not producer_is_whitelisted_for_large_fanout
+    is_write_operation
+    topic_has_large_fanout
+    not producer_is_allowlisted_for_large_fanout
 }
 
-producer_whitelist = {
-  "large-fanout": {
-    "fanout_producer",
-  }
+producer_allowlist := {
+    "large-fanout": {
+        "fanout_producer",
+    }
 }
 
 topic_has_large_fanout {
-  topic_metadata[topic_name].tags[_] == "large-fanout"
+    topic_metadata[topic_name].tags[_] == "large-fanout"
 }
 
-producer_is_whitelisted_for_large_fanout {
-  producer_whitelist["large-fanout"][_] == principal.name
+producer_is_allowlisted_for_large_fanout {
+    producer_allowlist["large-fanout"][_] == principal.name
 }
 ```
 
@@ -362,33 +465,38 @@ Next, update the `topic_metadata` data structure in the same file to indicate
 that the `click-stream` topic has a high fanout.
 
 ```live:updated_metadata:module:read_only
-topic_metadata = {
-  "click-stream": {
-    "tags": ["large-fanout"],
-  },
-  "credit-scores": {
-    "tags": ["pii"],
-  }
+topic_metadata := {
+    "click-stream": {
+        "tags": ["large-fanout"],
+    },
+    "credit-scores": {
+        "tags": ["pii"],
+    }
 }
 ```
 
+Last, build a bundle from the updated policy.
+```shell
+opa build --bundle policies/ --output bundles/bundle.tar.gz
+```
+
 ### 5. Exercise the policy that restricts producer access to topics with high fanout.
 
 First, run `kafka-console-producer` and simulate a service with access to the
 `click-stream` topic.
 
 ```bash
-docker run --rm --network opakafkatutorial_default \
-    openpolicyagent/demo-kafka:1.0 \
-    bash -c 'for i in {1..10}; do echo "{\"user\": \"alice\", \"button\": $i}"; done | kafka-console-producer --topic click-stream --broker-list kafka:9093 -producer.config /etc/kafka/secrets/fanout_producer.ssl.config'
+docker run -v $(pwd)/cert/client:/tmp/client --rm --network opa-kafka-tutorial_default \
+    confluentinc/cp-kafka:6.2.1 \
+    bash -c 'for i in {1..10}; do echo "{\"user\": \"alice\", \"button\": $i}"; done | kafka-console-producer --topic click-stream --broker-list broker:9093 -producer.config /tmp/client/fanout_producer.properties'
 ```
 
 Next, run the `kafka-console-consumer` to confirm that the messages were published.
 
 ```bash
-docker run --rm --network opakafkatutorial_default \
-    openpolicyagent/demo-kafka:1.0 \
-    kafka-console-consumer --bootstrap-server kafka:9093 --topic click-stream --from-beginning --consumer.config /etc/kafka/secrets/anon_consumer.ssl.config
+docker run -v $(pwd)/cert/client:/tmp/client --rm --network opa-kafka-tutorial_default \
+    confluentinc/cp-kafka:6.2.1 \
+    kafka-console-consumer --bootstrap-server broker:9093 --topic click-stream --from-beginning --consumer.config /tmp/client/anon_consumer.properties
 ```
 
 Once you see the 10 messages produced by the first part of this step, exit the console consumer (^C).
@@ -397,9 +505,9 @@ Lastly, run `kafka-console-producer` to simulate a service that should **not**
 have access to _high fanout_ topics.
 
 ```bash
-docker run --rm --network opakafkatutorial_default \
-    openpolicyagent/demo-kafka:1.0 \
-    bash -c 'echo "{\"user\": \"alice\", \"button\": \"bogus\"}" | kafka-console-producer --topic click-stream --broker-list kafka:9093 -producer.config /etc/kafka/secrets/anon_producer.ssl.config'
+docker run -v $(pwd)/cert/client:/tmp/client --rm --network opa-kafka-tutorial_default \
+    confluentinc/cp-kafka:6.2.1 \
+    bash -c 'echo "{\"user\": \"alice\", \"button\": \"bogus\"}" | kafka-console-producer --topic click-stream --broker-list broker:9093 -producer.config /tmp/client/anon_producer.properties'
 ```
 
 Because `anon_producer` is not authorized to write to high fanout topics, the
@@ -411,7 +519,7 @@ Not authorized to access topics: [click-stream]
 
 ## Wrap Up
 
-Congratulations for finishing the tutorial!
+Congratulations on finishing the tutorial!
 
 At this point you have learned how to enforce fine-grained access control
 over Kafka topics. In addition, you have seen how to break down policies into
@@ -420,5 +528,5 @@ policy.
 
 If you want to use the Kafka Authorizer plugin that integrates Kafka with
 OPA, see the build and install instructions in the
-[github.com/open-policy-agent/contrib](https://github.com/open-policy-agent/contrib)
+[opa-kafka-plugin](https://github.com/StyraInc/opa-kafka-plugin)
 repository.
diff --git a/docs/content/kubernetes-debugging.md b/docs/content/kubernetes-debugging.md
index 23f9c8e453..dd7715452a 100644
--- a/docs/content/kubernetes-debugging.md
+++ b/docs/content/kubernetes-debugging.md
@@ -121,7 +121,7 @@ package system
 
 ```live:patch/good:module:read_only,openable
 main := {
-	"apiVersion": "admission.k8s.io/v1beta1",
+	"apiVersion": "admission.k8s.io/v1",
 	"kind": "AdmissionReview",
 	"response": response,
 }
@@ -145,7 +145,7 @@ patches := [
 
 ```live:patch/bad:module:read_only
 main := {
-	"apiVersion": "admission.k8s.io/v1beta1",
+	"apiVersion": "admission.k8s.io/v1",
 	"kind": "AdmissionReview",
 	"response": response,
 }
diff --git a/docs/content/kubernetes-introduction.md b/docs/content/kubernetes-introduction.md
index 6de17d8a98..abf216dd02 100644
--- a/docs/content/kubernetes-introduction.md
+++ b/docs/content/kubernetes-introduction.md
@@ -5,8 +5,8 @@ weight: 1
 ---
 
 In Kubernetes, [Admission
-Controllers](https://kubernetes.io/docs/admin/admission-controllers/) enforce
-policies on objects during create, update, and delete operations. Admission
+Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/)
+enforce policies on objects during create, update, and delete operations. Admission
 control is fundamental to policy enforcement in Kubernetes.
 
 For example, by deploying OPA as an admission controller you can:
@@ -34,7 +34,7 @@ Kubernetes clusters for security, cost, and availability reasons.
 project providing first-class integration between OPA and Kubernetes. For
 background information see this [blog
 post](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes)
-on kubernetes.io and check out this [Katakoda tutorial](https://katacoda.com/austinheiman/scenarios/open-policy-agent-gatekeeper).
+on kubernetes.io.
 
 OPA Gatekeeper adds the following on top of plain OPA:
 
@@ -46,7 +46,7 @@ OPA Gatekeeper adds the following on top of plain OPA:
 If you want to kick the tires:
 
 * See the [Installation
-  Instructions](https://github.com/open-policy-agent/gatekeeper#installation-instructions)
+  Instructions](https://open-policy-agent.github.io/gatekeeper/website/docs/install/)
   in the README.
 * See the
   [demo/basic](https://github.com/open-policy-agent/gatekeeper/tree/master/demo/basic)
@@ -115,7 +115,7 @@ Here is an example of a Pod being created:
 ```live:container_image:input
 {
   "kind": "AdmissionReview",
-  "apiVersion": "admission.k8s.io/v1beta1",
+  "apiVersion": "admission.k8s.io/v1",
   "request": {
     "kind": {
       "group": "",
@@ -229,7 +229,7 @@ sent back to the API Server.
 ```json
 {
   "kind": "AdmissionReview",
-  "apiVersion": "admission.k8s.io/v1beta1",
+  "apiVersion": "admission.k8s.io/v1",
   "response": {
     "allowed": false,
     "status": {
diff --git a/docs/content/kubernetes-primer.md b/docs/content/kubernetes-primer.md
index a574465f7e..4dd58a7739 100644
--- a/docs/content/kubernetes-primer.md
+++ b/docs/content/kubernetes-primer.md
@@ -187,7 +187,7 @@ Often you don't want to invent new variable names for iteration.  OPA provides t
 
 ### Builtins
 
-On line 5 the *builtin* `startswith` checks if one string is a prefix of the other.  The builtin `sprintf` on line 6 formats a string with arguments.  OPA has 50+ builtins detailed at [openpolicyagent.org/docs/policy-reference](../policy-reference).
+On line 5 the *builtin* `startswith` checks if one string is a prefix of the other.  The builtin `sprintf` on line 6 formats a string with arguments.  OPA has 150+ builtins detailed in [the Policy Reference](../policy-reference/#built-in-functions).
 Builtins let you analyze and manipulate:
 
 * Numbers, Strings, Regexs, Networks
@@ -226,7 +226,7 @@ test_image_safety {                                       # line 3
 
 **Different Package**. On line 1 the `package` directive puts these tests in a different package than admission control policy itself.  This is the recommended best practice.
 
-**Import**.  On line 2 `import data.kubernetes.admission` allows us to reference the admission control policy using the name `admission` everwhere in the test package.  `import` is not strictly necessary--it simply sets up an alias; you could instead reference `data.kubernetes.admission` inside the rules.
+**Import**.  On line 2 `import data.kubernetes.admission` allows us to reference the admission control policy using the name `admission` everywhere in the test package.  `import` is not strictly necessary--it simply sets up an alias; you could instead reference `data.kubernetes.admission` inside the rules.
 
 **Unit Test**.  On line 3 `test_image_safety` defines a unittest.  If the rule evaluates to true the test passes; otherwise it fails.  When you use the OPA test runner, anything in any package starting with `test` is treated as a test.
 
@@ -488,17 +488,17 @@ package system
 
 import data.kubernetes.admission
 
-main = {
+main := {
   "apiVersion": "admission.k8s.io/v1",
   "kind": "AdmissionReview",
   "response": response,
 }
 
-default uid = ""
+default uid := ""
 
-uid = input.request.uid
+uid := input.request.uid
 
-response = {
+response := {
     "allowed": false,
     "uid": uid,
     "status": {
@@ -508,7 +508,8 @@ response = {
     reason := concat(", ", admission.deny)
     reason != ""
 }
-else = {"allowed": true, "uid": uid}
+
+else := {"allowed": true, "uid": uid}
 ```
 
 The `system.main` policy MUST generate an **AdmissionReview** object containing
diff --git a/docs/content/kubernetes-tutorial.md b/docs/content/kubernetes-tutorial.md
index d42a0f8aac..2e6b198d98 100644
--- a/docs/content/kubernetes-tutorial.md
+++ b/docs/content/kubernetes-tutorial.md
@@ -9,7 +9,7 @@ It covers the OPA-kubernetes version that uses kube-mgmt.
 The [OPA Gatekeeper version](https://open-policy-agent.github.io/gatekeeper) has its own docs.
 For the purpose of the tutorial we will deploy two policies that ensure:
 
-- Ingress hostnames must be whitelisted on the Namespace containing the Ingress.
+- Ingress hostnames must be on allowlist on the Namespace containing the Ingress.
 - Two ingresses in different namespaces must not have the same hostname.
 
 > 💡 Kubernetes does not guarantee consistency across resources. If two
@@ -70,33 +70,33 @@ certificate authority (CA) and certificate/key pair for OPA:
 
 ```bash
 openssl genrsa -out ca.key 2048
-openssl req -x509 -new -nodes -key ca.key -days 100000 -out ca.crt -subj "/CN=admission_ca"
+openssl req -x509 -new -nodes -sha256 -key ca.key -days 100000 -out ca.crt -subj "/CN=admission_ca"
 ```
 
 Generate the TLS key and certificate for OPA:
 
 ```bash
 cat >server.conf <<EOF
-[req]
-req_extensions = v3_req
-distinguished_name = req_distinguished_name
+[ req ]
 prompt = no
-[req_distinguished_name]
+req_extensions = v3_ext
+distinguished_name = dn
+
+[ dn ]
 CN = opa.opa.svc
-[ v3_req ]
+
+[ v3_ext ]
 basicConstraints = CA:FALSE
 keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 extendedKeyUsage = clientAuth, serverAuth
-subjectAltName = @alt_names
-[alt_names]
-DNS.1 = opa.opa.svc
+subjectAltName = DNS:opa.opa.svc,DNS:opa.opa.svc.cluster,DNS:opa.opa.svc.cluster.local
 EOF
 ```
 
 ```bash
 openssl genrsa -out server.key 2048
-openssl req -new -key server.key -out server.csr -config server.conf
-openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 100000 -extensions v3_req -extfile server.conf
+openssl req -new -key server.key -sha256 -out server.csr -extensions v3_ext -config server.conf
+openssl x509 -req -in server.csr -sha256 -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 100000 -extensions v3_ext -extfile server.conf
 ```
 
 > Note: the Common Name value and Subject Alternative Name you give to openssl MUST match the name of the OPA service created below.
@@ -120,14 +120,14 @@ mkdir policies && cd policies
 Create a policy that restricts the hostnames that an ingress can use. Only hostnames matching the specified regular
 expressions will be allowed.
 
-**ingress-whitelist.rego**:
+**ingress-allowlist.rego**:
 
-```live:ingress_whitelist:module:read_only
+```live:ingress_allowlist:module:read_only
 package kubernetes.admission
 
 import data.kubernetes.namespaces
 
-operations = {"CREATE", "UPDATE"}
+operations := {"CREATE", "UPDATE"}
 
 deny[msg] {
 	input.request.kind.kind == "Ingress"
@@ -137,9 +137,9 @@ deny[msg] {
 	msg := sprintf("invalid ingress host %q", [host])
 }
 
-valid_ingress_hosts = {host |
-	whitelist := namespaces[input.request.namespace].metadata.annotations["ingress-whitelist"]
-	hosts := split(whitelist, ",")
+valid_ingress_hosts := {host |
+	allowlist := namespaces[input.request.namespace].metadata.annotations["ingress-allowlist"]
+	hosts := split(allowlist, ",")
 	host := hosts[_]
 }
 
@@ -150,9 +150,6 @@ fqdn_matches_any(str, patterns) {
 fqdn_matches(str, pattern) {
 	pattern_parts := split(pattern, ".")
 	pattern_parts[0] == "*"
-	str_parts := split(str, ".")
-	n_pattern_parts := count(pattern_parts)
-	n_str_parts := count(str_parts)
 	suffix := trim(pattern, "*.")
 	endswith(str, suffix)
 }
@@ -199,17 +196,17 @@ package system
 
 import data.kubernetes.admission
 
-main = {
+main := {
   "apiVersion": "admission.k8s.io/v1",
   "kind": "AdmissionReview",
   "response": response,
 }
 
-default uid = ""
+default uid := ""
 
-uid = input.request.uid
+uid := input.request.uid
 
-response = {
+response := {
     "allowed": false,
     "uid": uid,
     "status": {
@@ -219,7 +216,8 @@ response = {
     reason = concat(", ", admission.deny)
     reason != ""
 }
-else = {"allowed": true, "uid": uid}
+
+else := {"allowed": true, "uid": uid}
 ```
 
 > ⚠️ When OPA receives a request, it executes a query against the document defined `data.system.main` by default.
@@ -337,7 +335,7 @@ spec:
         # authentication and authorization on the daemon. See the Security page for
         # details: https://www.openpolicyagent.org/docs/security.html.
         - name: opa
-          image: openpolicyagent/opa:{{< current_docker_version >}}-rootless
+          image: openpolicyagent/opa:{{< current_docker_version >}}
           args:
             - "run"
             - "--server"
@@ -455,7 +453,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   annotations:
-    ingress-whitelist: "*.qa.acmecorp.com,*.internal.acmecorp.com"
+    ingress-allowlist: "*.qa.acmecorp.com,*.internal.acmecorp.com"
   name: qa
 ```
 
@@ -466,7 +464,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   annotations:
-    ingress-whitelist: "*.acmecorp.com"
+    ingress-allowlist: "*.acmecorp.com"
   name: production
 ```
 
@@ -527,12 +525,12 @@ kubectl create -f ingress-ok.yaml -n production
 kubectl create -f ingress-bad.yaml -n qa
 ```
 
-The second Ingress is rejected because its hostname does not match the whitelist in the `qa` namespace.
+The second Ingress is rejected because its hostname does not match the allowlist in the `qa` namespace.
 
 It will report an error as follows:
 
 ```
-Error from server: error when creating "ingress-bad.yaml": admission webhook "validating-webhook.openpolicyagent.org" 
+Error from server: error when creating "ingress-bad.yaml": admission webhook "validating-webhook.openpolicyagent.org"
 denied the request: invalid ingress host "acmecorp.com"
 ```
 
@@ -548,7 +546,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   annotations:
-    ingress-whitelist: "*.acmecorp.com"
+    ingress-allowlist: "*.acmecorp.com"
   name: staging
 ```
 
@@ -563,8 +561,8 @@ kubectl create -f ingress-ok.yaml -n staging
 The above command will report an error as follows:
 
 ```
-Error from server (BadRequest): error when creating "ingress-ok.yaml": admission webhook 
-"validate.nginx.ingress.kubernetes.io" denied the request: host "signin.acmecorp.com" and 
+Error from server (BadRequest): error when creating "ingress-ok.yaml": admission webhook
+"validate.nginx.ingress.kubernetes.io" denied the request: host "signin.acmecorp.com" and
 path "/" is already defined in ingress production/ingress-ok
 ```
 
diff --git a/docs/content/management-bundles.md b/docs/content/management-bundles.md
index 4eecfbafa8..d1544a1705 100644
--- a/docs/content/management-bundles.md
+++ b/docs/content/management-bundles.md
@@ -21,6 +21,31 @@ see the section below.
 
 See the [Configuration Reference](../configuration) for configuration details.
 
+### Bundle build
+
+The CLI command [`opa build`](../cli/#opa-build) gives you the capability to build your own bundles.
+
+Here is a basic example on how to build a bundle from a folder called `foo`. The bundle will be named by default `bundle.tar.gz`.
+```console
+$ ls foo/
+example.rego
+
+$ opa build -b foo/
+```
+
+More, you can optimize the bundle by specifying the `--optimize` or `-O` flag.
+```console
+opa build -b foo/ --optimize=1
+```
+
+Finally, you can also sign your bundle with `opa build`.
+```console
+opa build --verification-key /path/to/public_key.pem --signing-key /path/to/private_key.pem --bundle foo/
+```
+
+For more information, see the [`opa build` command documentation.](../cli/#opa-build)
+
+
 ### Bundle Service API
 
 OPA expects the service to expose an API endpoint that serves bundles. The
@@ -86,10 +111,13 @@ OPA can optionally persist activated bundles to disk for recovery purposes. To e
 persistence, set the `bundles[_].persist` field to `true`. When bundle
 persistence is enabled, OPA will attempt to read the bundle from disk on startup. This
 allows OPA to start with the most recently activated bundle in case OPA cannot communicate
-with the bundle server. When communication between OPA and the bundle server is restored,
-the latest bundle is downloaded, activated, and persisted.
+with the bundle server. OPA will try to load and activate persisted bundles on a best-effort basis. Any errors
+encountered during the process will be surfaced in the bundle's status update. When communication between OPA and
+the bundle server is restored, the latest bundle is downloaded, activated, and persisted.
 
-> By default, bundles are persisted under the current working directory of the OPA process (e.g., `./.opa/bundles/<bundle-name>/bundle.tar.gz`).
+{{< info >}}
+By default, bundles are persisted under the current working directory of the OPA process (e.g., `./.opa/bundles/<bundle-name>/bundle.tar.gz`).
+{{< /info >}}
 
 The optional `bundles[_].signing` field can be used to specify the `keyid` and `scope` that should be used
 for verifying the signature of the bundle. See [this](#signing) section for details.
@@ -104,14 +132,56 @@ in bundle responses to identify the revision of the bundle. OPA will include the
 check the `If-None-Match` header and reply with HTTP `304 Not Modified` if the
 bundle has not changed since the last update.
 
+#### HTTP Long Polling
+
+With the periodic bundle downloading (ie. `short polling`) technique, OPA sends regular requests to the remote HTTP
+server to pull any available bundle. If there is no new bundle, the server responds with a `304 Not Modified` response.
+The polling frequency depends on the latency that the client can tolerate in
+retrieving updated information from the server.  A drawback of this
+method is that if the acceptable latency is low, then the polling frequency could add unnecessary
+burden on the server and/or network.
+
+[HTTP Long Polling](https://datatracker.ietf.org/doc/html/rfc6202#section-2) helps to minimize server/network resource
+usage and also reduces the delay in delivery of updates to the client. When OPA sends a long poll request to the server,
+it defers its response until an update is available or timeout has occurred. In case of a timeout, the server responds
+with a `304 Not Modified` response.
+
+The below configuration shows how to enable bundle downloading via `long polling`:
+
+```yaml
+services:
+  - name: acmecorp
+    url: https://example.com/service/v1
+    credentials:
+      bearer:
+        token: "bGFza2RqZmxha3NkamZsa2Fqc2Rsa2ZqYWtsc2RqZmtramRmYWxkc2tm"
+
+bundles:
+  authz:
+    service: acmecorp
+    resource: somedir/bundle.tar.gz
+    persist: true
+    polling:
+      long_polling_timeout_seconds: 10
+    signing:
+      keyid: my_global_key
+      scope: read
+```
+
+With the above configuration, OPA sends a long poll request to the server with a timeout set to `10` seconds. If the server
+supports `long polling`, OPA expects the server to set the `Content-Type` header to `application/vnd.openpolicyagent.bundles`.
+If the server does not support `long polling`, OPA will fallback to the regular periodic polling.
+
 ### Bundle File Format
 
 Bundle files are gzipped tarballs that contain policies and data. The data
 files in the bundle must be organized hierarchically into directories inside
 the tarball.
 
-> The hierarchical organization indicates to OPA where to load the data files
-> into the [the `data` Document](../#the-data-document).
+{{< info >}}
+The hierarchical organization indicates to OPA where to load the data files
+into the [the `data` Document](../philosophy/#the-opa-document-model).
+{{< /info >}}
 
 You can list the content of a bundle with `tar`.
 
@@ -200,11 +270,12 @@ __Some important details for bundle files:__
 * OPA will only load Wasm modules named `policy.wasm`. Other WebAssembly binary
   files will be ignored.
 
-> YAML data loaded into OPA is converted to JSON. Since JSON is a subset of
-> YAML, you are not allowed to use binary or null keys in objects and boolean
-> and number keys are converted to strings. Also, YAML !!binary tags are not
-> supported.
-
+{{< info >}}
+YAML data loaded into OPA is converted to JSON. Since JSON is a subset of
+YAML, you are not allowed to use binary or null keys in objects and boolean
+and number keys are converted to strings. Also, YAML !!binary tags are not
+supported.
+{{< /info >}}
 
 ### Multiple Sources of Policy and Data
 
@@ -215,13 +286,15 @@ and data from multiple sources, you can implement your bundle service
 to generate bundles that are scoped to a subset of OPA's policy and
 data cache.
 
-> 🚨 We recommend that whenever possible, you implement policy and data
-> aggregation centrally, however, in some cases that's not possible
-> (e.g., due to latency requirements.).
-> When using multiple sources there are **no** ordering guarantees for which bundle loads first and
+{{< danger >}}
+We recommend that whenever possible, you implement policy and data
+aggregation centrally, however, in some cases that's not possible
+(e.g., due to latency requirements.).
+When using multiple sources there are **no** ordering guarantees for which bundle loads first and
 takes over some root. If multiple bundles conflict, but are loaded at different
 times, OPA may go into an error state. It is highly recommended to use
 the health check and include bundle state: [Monitoring OPA](../monitoring#health-checks)
+{{< /danger >}}
 
 To scope bundles to a subset of OPA's policy and data cache, include
 a top-level `roots` key in the bundle that defines the roots of the
@@ -281,9 +354,11 @@ When OPA receives a new bundle, it checks that it has been properly signed using
 configured with out-of-band.  Only if that verification succeeds does OPA activate the new bundle; otherwise, OPA
 continues using its existing bundle and reports an activation failure via the status API and error logging.
 
-> ⚠️ `opa run` performs bundle signature verification only when the `-b`/`--bundle` flag is given
-> or when Bundle downloading is enabled. Sub-commands primarily used in development and debug environments
-> (such as `opa eval`, `opa test`, etc.) DO NOT verify bundle signatures at this point in time.
+{{< info >}}
+⚠️ `opa run` performs bundle signature verification only when the `-b`/`--bundle` flag is given
+or when Bundle downloading is enabled. Sub-commands primarily used in development and debug environments
+(such as `opa eval`, `opa test`, etc.) DO NOT verify bundle signatures at this point in time.
+{{< /info >}}
 
 #### Signature Format
 
@@ -322,12 +397,10 @@ following form:
     },
     {
       "name": "roles/bindings/data.json",
-      "hash": "42cfe6768b57bb5f7503c165c28dd07ac5b813554ebc850f2cc35843e7137b1d"
+      "hash": "42cfe6768b57bb5f7503c165c28dd07ac5b813554ebc850f2cc35843e7137b1d",
+      "algorithm": "SHA-256"
     }
-  ],
-  "iat": 1592248027,
-  "iss": "JWTService",
-  "scope": "write"
+  ]
 }
 ```
 
@@ -340,8 +413,14 @@ following form:
 | `iat` | `string` | No | Time of signature creation since epoch in seconds. For informational purposes only. |
 | `iss` | `string` | No | Identifies the issuer of the JWT. For informational purposes only. |
 
-> Note: OPA will first look for the `keyid` on the command-line. If the `keyid` is empty, OPA will look for it in it's
-> configuration. If `keyid` is still empty, OPA will finally look for `kid` in the JWT header.
+{{< info >}}
+OPA will first look for the `keyid` on the command-line. If the `keyid` is empty, OPA will look for it in it's
+configuration. If `keyid` is still empty, OPA will finally look for `kid` in the JWT header.
+
+To include additional claims in the JWT payload such as `scope`, `iat`, `iss` use the `--claims-file` flag
+in the `opa build` or `opa sign` commands to provide a JSON file containing optional claims. See `opa build --help`
+or `opa sign --help` for more details.
+{{< /info >}}
 
 The following hashing algorithms are supported:
 
@@ -418,6 +497,132 @@ bundle.RegisterSigner("custom", &CustomSigner{})
 bundle.RegisterVerifier("custom", &CustomVerifier{})
 ```
 
+### Delta Bundles
+
+A regular _snapshot_ bundle represents the entirety of OPA’s policy and data cache. When a new _snapshot_ bundle is
+downloaded, OPA will erase and overwrite all the policy and data in its cache before activating the new bundle. We can
+optionally scope the bundle to a subset of OPA’s policy and data cache by defining the `roots` in the bundle's `.manifest` file.
+
+Although OPA [caches](#caching) snapshot bundles to avoid unnecessary retransmission,
+servers must still retransmit the entire snapshot when any change occurs. If you need
+to propagate small changes to bundles without waiting for polling delays, consider
+using _delta_ bundles in conjunction with [HTTP Long Polling](#http-long-polling).
+
+_Delta_ bundles provide a more efficient way to make data changes by containing patches to data instead of complete snapshots.
+_Delta_ bundles are structured differently from _snapshot_ bundles. A _delta_ bundle contains a
+single `patch.json` file at the root of the bundle which includes a [JSON Patch](https://datatracker.ietf.org/doc/html/rfc6902)
+(i.e., an array of one or more JSON objects). The operations in the JSON Patch will be applied to OPA's in-memory store in order.
+
+{{< info >}}
+_Delta_ bundles currently support updates to data only and not policies. 
+{{< /info >}}
+
+#### Delta Bundle File Format
+
+OPA expects a _delta_ bundle to contain an optional `.manifest` file and a required `patch.json` file that specifies a list of one or more
+patch operations on the data. OPA will generate an error if a _delta_ bundle contains any policy, data or wasm binary files.
+If the `.manifest` file specifies any `roots`, any data patch outside the bundle's roots will cause an error.
+
+```bash
+$ tar tzf bundle.tar.gz
+.manifest
+patch.json
+```
+
+Below is an example of the `patch.json` file:
+
+```json
+{
+  "data": [
+    {"op": "upsert", "path": "/a/b", "value": ["hello", "world"]},
+    {"op": "remove", "path": "/a/c"}
+  ]
+}
+```
+
+If OPA has previously activated a _snapshot_ bundle that did not contain a .manifest file, then the _delta_ bundle
+must not contain a `.manifest` file.
+
+If OPA has a previously activated _snapshot_ bundle that did contain a `.manifest` file, then the _delta_ bundle may
+contain a `.manifest` file. Specifically if a previously activated _snapshot_ bundle contains a `.manifest` file that
+declares `roots` or `wasm` fields, a _delta_ bundle update MUST have the same values for the manifest
+`roots` and `wasm` fields from the original _snapshot_ bundle. This means a _delta_ bundle cannot be used to change
+the scope of the original bundle or update Wasm resolvers. A _delta_ bundle can however contain different
+values for the bundle's `revision` and `metadata`.
+
+{{< danger >}}
+An empty list of operations in a _delta_ bundle `patch.json` will remove all the data from OPA's in-memory store. I.e., the following are equivalent:
+
+```json
+{
+  "data": []
+}
+```
+
+```json
+{
+  "data": [
+    { "op": "replace", "path": "/", "value": {} }
+  ]
+}
+  ```
+If there are no operations to apply to the data, the bundle server should return the same [`Etag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) value as the last update. OPA will send the last `Etag` value in the [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-None-Match) Header.
+{{< /danger >}}
+
+#### Delta Bundle Patch Operations
+
+Each patch operation defined in the `patch.json` file must have exactly one `op` member which indicates the
+operation to perform. Valid options include:
+
+|  op | Description  |
+|-----|--------------|
+| `"remove"` | The `"path"` specified will be removed from OPA's in-memory store. The `"value"` field is ignored for `"remove"` operations. |
+| `"replace"` | The value at the specified `"path"` will be replaced by the new value defined by the `"value"` field. The target path must exist for the operation to be successful. |
+| `"upsert"` | The `"value"` will be set at the specified `"path"`. If the `"path"` specifies an array index, the `"value"` is inserted into the array at the specified index. If the `"path"` specifies an object member that does not already exist, a new member is added to the object. If the object member exists, its value is replaced. If the `"path"` does not exist, OPA will create and add it to its in-memory store. |
+
+{{< info >}}
+The `upsert` operation in not part of the [JSON Patch](https://datatracker.ietf.org/doc/html/rfc6902) standard.
+{{< /info >}}
+
+The `"path"` field defines a JSON pointer path to the location to perform the operation on.
+
+The `"value"` field defines the value to be added or replaced. Only required for `"upsert"` and  `"replace"` operations.
+
+#### Current Limitations
+
+* _Delta_ bundles only support updates to data. Policies cannot be updated using _delta_ bundles.
+* _Delta_ bundles do not support bundle signing.
+* Unlike _snapshot_ bundles, activated _delta_ bundles are not persisted to disk when the `bundles[_].persist` field is `true`.
+
+#### Delta Bundle FAQ
+
+This section discusses some _delta_ bundle usage, edge cases and failure scenarios.
+
+* What happens if OPA cannot apply a data patch ?
+
+Bundle activation will fail in this scenario. In the next attempt to download the bundle, OPA will set the value
+of the `If-None-Match` header of the bundle request to the last successful activation Etag value. This should help the
+Bundle Service to send the correct revision of the bundle to OPA.
+
+* What happens if OPA cannot reach the Bundle Service (for example. network failure) or is unable to download a bundle ?
+
+OPA always includes the last successful activation Etag value in the bundle request. When OPA eventually reconnects
+with the server, the value of the `If-None-Match` header of bundle request could be empty indicating that OPA was not
+able to activate the first revision of the bundle itself. This helps the server to re-transmit the correct bundle revision.
+
+In case OPA has already activated a revision of the bundle, and reaches out to the server with the last
+successful activation Etag value, the server now knows to send the next bundle revision. This could either be a snapshot
+or delta bundle. One possible approach on the server-side, would be to first send a snapshot bundle and then send delta bundles
+to perform data patch operations. The server could maintain the order in which the bundles should go out for example,
+assigning an Etag value to each bundle revision. Hence, it can figure out the right bundle to send by looking up the
+`If-None-Match` header of bundle request and then lining-up the next bundle in the queue.
+
+* Does a _delta_ bundle always need to be preceded by a _snapshot_ bundle ?
+
+No. OPA will activate a _delta_ bundle if all the patch operations in it were successfully applied. Note that a _snapshot_
+bundle would erase and overwrite policy and data under the manifest `roots`.
+
+
 ## Implementations
 
 The Bundle API is simple. Most HTTP servers capable of serving static files will do. While not strictly required in all deployments, it is also good if the implementation supports:
@@ -493,9 +698,82 @@ Both methods are going to need a policy for either the service account or the IA
 3. Once the policy has been created, it can be assigned to the role.
 4. With the role created, go to the EC2 instance view. Select an instance where OPA will run and select "Actions" -> "Security" -> "Modify IAM role". Select the role created in previous steps.
 
+##### Web Identity Credentials
+
+Using EKS IAM Roles for Service Account (Web Identity) Credential.
+
+Below are steps to use OpenID connect provider and kubernetes.
+
+1. Go to the "IAM" section of the AWS console.
+2. Click Add provider and select OpenID connect.
+3. For Provider URL enter the one belonging to your chosen kubernetes cluster.
+4. Click on Get thumbprint
+5. For the audience enter: sts.amazonaws.com
+6. Add the provider.
+7. Once the provider is added, copy the ARN for the identity provider. Here's  an example ARN: arn:aws:iam::<your AWS account ID>:oidc-provider/oidc.eks.ap-northeast-1.amazonaws.com/id/DFGHJKKJHGF34HFDFGHY44TRFDE4RGDF
+8. Create an IAM role (eg: app_dev_role) with the policy created above and assign it to the kubernetes service account.
+9. Go to Trust relationships inside the created role and click Edit trust relationship and enter the following policy document.
+  ```json
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Principal": {
+            "Federated": "<the ARN of the Identity provider from step 7, e.g. arn:aws:iam::123456789012:oidc-provider/oidc.eks.ap-northeast-1.amazonaws.com/id/DFGHJKKJHGF34HFDFGHY44TRFDE4RGDF where 123456789012 is the account ID of your AWS account, and DFGHJK...4RGDF is the OpenID Connect URL's end>"
+          },
+          "Action": "sts:AssumeRoleWithWebIdentity",
+          "Condition": {
+            "StringEquals": {
+              "<the OpenID connect URL, e.g. oidc.eks.ap-northeast-1.amazonaws.com/id/B7060B6E991747ADDDC61ADD4B7875CF>:sub": "system:serviceaccount:<kubernetes namespace, e.g. app-dev>:<the kubernetes serviceaccount name, eg: app-dev-service-account>"
+            }
+          }
+        }
+      ]
+    }
+  ```
+10. Create the kubernetes service account.
+    ```yaml
+      apiVersion: v1
+      kind: ServiceAccount
+      metadata:
+        annotations:
+          eks.amazonaws.com/role-arn: <the ARN of the IAM role from your account, e.g. arn:aws:iam::<aws_account eg, 123456789012>:role/app_dev_role>
+        name: <service account name, e.g. app-dev-service-account>
+        namespace: <k8 namespace, e.g. app-dev>
+      automountServiceAccountToken: false
+    ```
+11. Configure your kubernetes resources to use this service account.
+    ```yaml
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        ******
+      spec:
+        ******
+        template:
+          *******
+          spec:
+            serviceAccountName: app-dev-service-account # <--- like this
+            automountServiceAccountToken: true
+            containers:
+            ******
+    ```
+
+You should now be able to access AWS services from your kubernetes cluster.
+
+The above steps should add the following variable to the pod.
+
+```bash
+AWS_ROLE_ARN=<the ARN of the IAM role from your account, e.g. arn:aws:iam::123456789012:role/app_dev_role>
+AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token
+```
+
+Please read [IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) for more details.
+
 ##### Testing Authentication
 
-Use the [AWS CLI tools]([command line tools](https://aws.amazon.com/cli/)) (see "Upload Bundle" below).
+Use the [AWS CLI tools](https://aws.amazon.com/cli/) (see ["Upload Bundle"](#upload-bundle) below).
 
 #### Upload Bundle
 
@@ -525,6 +803,8 @@ bundles:
     resource: bundle.tar.gz
 ```
 
+**NOTE:** the S3 `url` is the bucket's regional endpoint.
+
 ##### Metadata Credentials
 
 In order for this to work it is required that the permissions you created in the "Authentication" steps above are embedded in an IAM Role, which is then assigned to the EC2 instance hosting OPA.
@@ -545,6 +825,56 @@ bundles:
     resource: bundle.tar.gz
 ```
 
+**NOTE:** the S3 `url` is the bucket's regional endpoint.
+
+##### Web Identity Credentials
+
+```yaml
+services:
+  s3:
+    url: https://my-example-opa-bucket.s3.eu-north-1.amazonaws.com
+    credentials:
+      s3_signing:
+        web_identity_credentials:
+          aws_region: eu-north-1
+          session_name: my-open-policy-agent # Optional. Default: open-policy-agent
+
+bundles:
+  authz:
+    service: s3
+    resource: bundle.tar.gz
+```
+
+**NOTE:** the S3 `url` is the bucket's regional endpoint.
+
+##### Credential Provider Chaining
+
+Multiple AWS credential providers can be configured. OPA will follow an *internally defined* order to try each of the credential provider given in the configuration till success. Following order of precedence is followed when multiple credential provider is given in the configuration
+
+1. Environment Credential
+2. Web Identity Credential
+3. Profile Credential
+4. Metadata Credential
+
+```yaml
+services:
+  s3:
+    url: https://my-example-opa-bucket.s3.eu-north-1.amazonaws.com
+    credentials:
+      s3_signing:
+        metadata_credentials:
+          aws_region: eu-north-1
+          iam_role: my-opa-bucket-access-role
+        environment_credentials: {}
+
+bundles:
+  authz:
+    service: s3
+    resource: bundle.tar.gz
+```
+
+**NOTE:** In this example, OPA will look for AWS credentials in the environment first before trying metadata endpoint. S3 signing will fail if none of the providers are successful.
+
 ### Google Cloud Storage
 
 #### OPA Bundle Support
@@ -815,3 +1145,179 @@ bundles:
     service: nginx
     resource: /bundle.tar.gz
 ```
+
+### OCI Registry
+
+OPA is able to interact with [OCI](https://opencontainers.org/) compatible registries to be able to download and use policies stored as containers.
+To configure OPA to use an OCI repository see the [service configuration section](../configuration/#services)
+
+**Structure**
+The bundle container is composed of 3 layers:
+- the manifest layer - contains the information about the tarball layer of the container(the digest, size, mediatype and annotations) and the config layer
+- the bundle tarball layer - the actual bundle tarball
+- the configuration layer - currently empty
+
+For OCI compatible registries an ***oci*** folder is created in the [persistence directory](../configuration/#miscellaneous). If this value is not set, because the OCI downloader plugin requires a storage path, the system's temporary folder location will be used instead. This folder should be maintained by the user. We recommend backing-up or cleaning up this folder periodically as this acts as a local cache for the OCI downloader. 
+
+**Current Limitations**
+The OCI Downloader plugin used by OPA has a couple of limitation:
+- it accepts only **one** layer per image that contains the bundle tarball
+- it can download only the following application media types: 
+    - `application/vnd.oci.image.layer.v1.tar+gzip`
+    - `application/vnd.oci.image.manifest.v1+json`
+    - `application/vnd.oci.image.config.v1+json`
+
+#### Building and Publishing Policy Containers
+
+There are multiple ways to build an image from a policy code base using different tools.
+
+##### Using OPA and ORAS CLIs
+
+To build and push a policy bundle to a remote OCI registry with the [OPA CLI](../cli/) and [ORAS CLI](https://oras.land/cli/) you can  use the following commands:
+
+- `opa build <path_to_src>` will allow you to build a bundle tarball from your OPA policy and data files
+
+Now that we have the tarball we will need to provide a config manifest to the ORAS CLI and the tarball itself: 
+- `oras push <registry>/<org>/<repo>:<tag> --manifest-config <you_config_json>:application/vnd.oci.image.config.v1+json <the_tarball_obtained_from_opa_build>:application/vnd.oci.image.layer.v1.tar+gzip`
+
+Using an empty(`{}`) `manifest-config` json file should be sufficient to be able to push and allow the OCI downloader to use the remote policy image. 
+
+#### Maintaining a policy-as-code repository
+
+One of the easiest method of managing your policy bundles is to store your code base in a hosted repository service like Github or Gitlab and set up an automated way to build and publish your code as a container to the desired registry using a CI(ex. Github Action). 
+
+#### Example 
+
+In this example we are using the [ghcr.io](https://ghcr.io) OCI registry as the upstream repository and the OPA and ORAS CLI as our build and publishing tool.
+
+###### Starting from scratch
+
+Let's set up a basic policy example structured as:
+```
+└── src
+    ├── data.json
+    ├── .manifest
+    └── policies
+        └── hello.rego
+```
+
+Here our *hello.rego* file contains a very simple example:
+```
+package policies.play
+
+default hello = false
+
+hello {
+    m := input.message
+    m == "world"
+}
+```
+The *.manifest* file specifies the root only as:
+```
+{
+    "roots": ["policies"],
+    "metadata": {
+      "required_builtins": {
+          "builtin1": [
+          ],
+      }
+    }
+}
+```
+And the *data.json* file is empty json:
+```
+{}
+```
+
+###### Building your policy
+
+To build my bundle tarball I'm going to use the OPA CLI and run the following command:
+```bash
+opa build .src/ 
+```
+
+###### Pushing the container to a remote registry
+
+I'll prepare an empty config.json file that contains:
+```
+{}
+```
+
+To push the build image to an upstream registry we first need to login using:
+```bash
+ oras login ghcr.io
+```
+
+And now we can push our policy using:
+```bash
+oras push ghcr.io/someorg/policy-hello:1.0.0 --manifest-config config.json:application/vnd.oci.image.config.v1+json bundle.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip
+```
+
+###### Spin up the policy with OPA CLI
+
+Now that our image is pushed we prepare the OPA configuration. 
+
+In this example the configuration.yaml looks like this as the pushed image is private we need credentials for OPA to download it:
+```
+services:
+  ghcr-registry:
+    url: https://ghcr.io
+    type: oci
+    credentials:
+      bearer:
+        scheme: "Bearer"
+        token: "<mytoken>"
+
+bundles:
+  authz:
+    service: ghcr-registry
+    resource: ghcr.io/someorg/policy-hello:1.0.0
+    persist: true
+    polling:
+      min_delay_seconds: 30
+      max_delay_seconds: 120
+```
+
+In the above configuration we pinned the configuration to use the 1.0.0 tag of the image. OPA will identify this image by the tag and the descriptor SHA. If the SHA of the image is changed upstream, OPA will redownload and activate the changes. 
+
+If we run the *opa CLI* with this configuration using the command it will open an interactive terminal (REPL) where we can see the loaded bundle:
+```bash
+opa run -c configuration.yaml
+```
+The terminal should show that the bundle has been loaded and activated:
+```
+> {"level":"info","msg":"Bundle loaded and activated successfully.","name":"authz","plugin":"bundle","time":"2022-06-15T16:50:53+03:00"}
+> data
+{
+  "policies": {
+    "play": {
+      "hello": false
+    }
+  }
+}
+> exit
+```
+We can now start OPA as a server using:
+```bash
+opa run --server --set default_decision=policies -c configuration.yaml
+```
+To interact with the server you can do a simple **curl** to verify if it works as intended:
+```bash
+curl localhost:8181 -i -d '{ "message":"world"}' -H 'Content-Type:application/json'
+
+HTTP/1.1 200 OK
+Content-Type: application/json
+Date: Wed, 15 Jun 2022 13:55:19 GMT
+Content-Length: 23
+
+{"play":{"hello":true}}
+```
+```bash
+curl localhost:8181 -i -d '{ "message":"other"}' -H 'Content-Type:application/json'
+HTTP/1.1 200 OK
+Content-Type: application/json
+Date: Wed, 15 Jun 2022 13:56:13 GMT
+Content-Length: 24
+
+{"play":{"hello":false}}
+```
\ No newline at end of file
diff --git a/docs/content/management-decision-logs.md b/docs/content/management-decision-logs.md
index 66d88c59fd..6ea27ad7f9 100644
--- a/docs/content/management-decision-logs.md
+++ b/docs/content/management-decision-logs.md
@@ -60,26 +60,30 @@ represents a policy decision returned by OPA.
 
 Decision log updates contain the following fields:
 
-| Field | Type | Description |
-| --- | --- | --- |
-| `[_].labels` | `object` | Set of key-value pairs that uniquely identify the OPA instance. |
-| `[_].decision_id` | `string` | Unique identifier generated for each decision for traceability. |
-| `[_].bundles` | `object` | Set of key-value pairs describing the bundles which contained policy used to produce the decision. |
-| `[_].bundles[_].revision` | `string` | Revision of the bundle at the time of evaluation. |
-| `[_].path` | `string` | Hierarchical policy decision path, e.g., `/http/example/authz/allow`. Receivers should tolerate slash-prefixed paths. |
-| `[_].query` | `string` | Ad-hoc Rego query received by Query API. |
-| `[_].input` | `any` | Input data provided in the policy query. |
-| `[_].result` | `any` | Policy decision returned to the client, e.g., `true` or `false`. |
-| `[_].requested_by` | `string` | Identifier for client that executed policy query, e.g., the client address. |
-| `[_].timestamp` | `string` | RFC3999 timestamp of policy decision. |
-| `[_].metrics` | `object` | Key-value pairs of [performance metrics](../rest-api#performance-metrics). |
-| `[_].erased` | `array[string]` | Set of JSON Pointers specifying fields in the event that were erased. |
-| `[_].masked` | `array[string]` | Set of JSON Pointers specifying fields in the event that were masked. |
-
-If the decision log was successfully uploaded to the remote service, it should respond with an HTTP 200 OK status. If the
-service responds with a non-200 OK status, OPA will requeue the last chunk containing decision log events and upload it
+| Field                     | Type | Description                                                                                                                                                                                                                                                                                                                                                                                            |
+|---------------------------| --- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `[_].labels`              | `object` | Set of key-value pairs that uniquely identify the OPA instance.                                                                                                                                                                                                                                                                                                                                        |
+| `[_].decision_id`         | `string` | Unique identifier generated for each decision for traceability.                                                                                                                                                                                                                                                                                                                                        |
+| `[_].trace_id`            | `string` | Unique identifier of a trace generated for each incoming request for traceability. This is a hex string representation compliant with the W3C trace-context specification. See more at https://www.w3.org/TR/trace-context/#trace-id.                                                                                                                                                                  |
+| `[_].span_id`             | `string` | Unique identifier of a span in a trace to assist traceability. This is a hex string representation compliant with the W3C trace-context specification. See more at https://www.w3.org/TR/trace-context/#parent-id.                                                                                                                                                                                                                                                                                                                                         |
+| `[_].bundles`             | `object` | Set of key-value pairs describing the bundles which contained policy used to produce the decision.                                                                                                                                                                                                                                                                                                     |
+| `[_].bundles[_].revision` | `string` | Revision of the bundle at the time of evaluation.                                                                                                                                                                                                                                                                                                                                                      |
+| `[_].path`                | `string` | Hierarchical policy decision path, e.g., `/http/example/authz/allow`. Receivers should tolerate slash-prefixed paths.                                                                                                                                                                                                                                                                                  |
+| `[_].query`               | `string` | Ad-hoc Rego query received by Query API.                                                                                                                                                                                                                                                                                                                                                               |
+| `[_].input`               | `any` | Input data provided in the policy query.                                                                                                                                                                                                                                                                                                                                                               |
+| `[_].result`              | `any` | Policy decision returned to the client, e.g., `true` or `false`.                                                                                                                                                                                                                                                                                                                                       |
+| `[_].requested_by`        | `string` | Identifier for client that executed policy query, e.g., the client address.                                                                                                                                                                                                                                                                                                                            |
+| `[_].timestamp`           | `string` | RFC3999 timestamp of policy decision.                                                                                                                                                                                                                                                                                                                                                                  |
+| `[_].metrics`             | `object` | Key-value pairs of [performance metrics](../rest-api#performance-metrics).                                                                                                                                                                                                                                                                                                                             |
+| `[_].erased`              | `array[string]` | Set of JSON Pointers specifying fields in the event that were erased.                                                                                                                                                                                                                                                                                                                                  |
+| `[_].masked`              | `array[string]` | Set of JSON Pointers specifying fields in the event that were masked.                                                                                                                                                                                                                                                                                                                                  |
+| `[_].nd_builtin_cache`    | `object` | Key-value pairs of non-deterministic builtin names, paired with objects specifying the input/output mappings for each unique invocation of that builtin during policy evaluation. Intended for use in debugging and decision replay. Receivers will need to decode the JSON using Rego's JSON decoders.                                                                                                |
+| `[_].req_id`              | `number` | Incremental request identifier, and unique only to the OPA instance, for the request that started the policy query. The attribute value is the same as the value present in others logs (request, response, and print) and could be used to correlate them all. This attribute will be included just when OPA runtime is initialized in server mode and the log level is equal to or greater than info. |
+
+If the decision log was successfully uploaded to the remote service, it should respond with an HTTP 2xx status. If the
+service responds with a non-2xx status, OPA will requeue the last chunk containing decision log events and upload it
 during the next upload event. OPA also performs an exponential backoff to calculate the delay in uploading the next chunk
-when the remote service responds with a non-200 OK status.
+when the remote service responds with a non-2xx status.
 
 OPA periodically uploads decision logs to the remote service. In order to conserve network and memory resources, OPA
 attempts to fill up each upload chunk with as many events as possible while respecting the user-specified
@@ -95,6 +99,12 @@ the last chunk.
 
 `Equilibrium`: If the chunk size is between 90% and 100% of the user-configured limit, maintain soft limit value.
 
+When an event containing `nd_builtin_cache` cannot fit into a chunk smaller than `upload_size_limit_bytes`, OPA will
+drop the `nd_builtin_cache` key from the event, and will retry encoding the chunk without the non-deterministic
+builtins cache information. This best-effort approach ensures that OPA reports decision log events as much as possible,
+and bounds how large decision log events can get. This size-bounding is necessary, because some non-deterministic builtins
+(such as `http.send`) can increase the decision log event size by a potentially unbounded amount.
+
 ### Local Decision Logs
 
 Local console logging of decisions can be enabled via the `console` config option.
@@ -172,7 +182,7 @@ from the decision log event. The erased paths are recorded on the event itself:
 
 There are a few restrictions on the JSON Pointers that OPA will erase:
 
-* Pointers must be prefixed with `/input` or `/result`.
+* Pointers must be prefixed with `/input`, `/result`, or `/nd_builtin_cache`.
 * Pointers may be undefined. For example `/input/name/first` in the example
   above would be undefined. Undefined pointers are ignored.
 * Pointers must refer to object keys. Pointers to array elements will be treated
@@ -202,7 +212,7 @@ operations
 package system.log
 
 mask[{"op": "upsert", "path": "/input/password", "value": x}] {
-  # conditionally upsert password if it existed in the orginal event
+  # conditionally upsert password if it existed in the original event
   input.input.password
   x := "**REDACTED**"
 }
@@ -246,6 +256,38 @@ to track **remove** vs **upsert** mask operations.
 }
 ```
 
+### Drop Decision Logs
+
+Drop rules filters all decisions, which evaluate to `true`, before logging them.
+
+This rule will drop all requests to the _allow_ rule in the _kafka_ package, that returned _true_:
+```live:drop_rule_example/kafka_allow_rule:module:read_only
+package system.log
+
+drop {
+  input.path == "kafka/allow"
+  input.result == true
+}
+```
+
+Log only requests for _delete_ and _alter_ operations (Kafka with opa-kafka-authorizer):
+
+```live:drop_rule_example/log_only_delete_alter_operations:module:read_only
+package system.log
+
+import future.keywords.in
+
+drop {
+  input.path == "kafka/allow"
+  not input.input.action.operation in {"DELETE", "ALTER"}
+```
+
+The name of the drop rules by default is `drop` in the package `system.log`. It can be changed with the configuration property `decision_logs.drop_decision`.
+```yaml
+decision_logs:
+    drop_decision: /system/log/drop
+```
+
 ### Rate Limiting Decision Logs
 
 There are scenarios where OPA may be uploading decisions faster than what the remote service is able to consume. Although
diff --git a/docs/content/management-discovery.md b/docs/content/management-discovery.md
index 1854bb5e0b..07da970f36 100644
--- a/docs/content/management-discovery.md
+++ b/docs/content/management-discovery.md
@@ -81,7 +81,7 @@ endpoint. If only one service is defined, there is no need to set `discovery.ser
 
 OPA generates it's subsequent configuration by querying the Rego and JSON files
 contained inside the discovery bundle. The default query is `data` however this
-can be overriden by specifying the `discovery.decision`.
+can be overridden by specifying the `discovery.decision`.
 
 ```yaml
 services:
@@ -107,7 +107,7 @@ If the discovery bundle contained the following Rego file:
 ```ruby
 package example
 
-discovery = {
+discovery := {
   "bundles": {
     "main": {
       "service": "acmecorp",
@@ -117,7 +117,7 @@ discovery = {
   "default_decision": "acmecorp/httpauthz/allow"
 }
 
-bundle_name = "acmecorp/httpauthz"
+bundle_name := "acmecorp/httpauthz"
 ```
 
 The subsequent configuration would be:
@@ -271,9 +271,10 @@ configuration labels or environment variables.
 
 In practice, discovery services do not change frequently. These configuration sections are treated as
 immutable to avoid accidental configuration errors rendering OPA unable to discover a new configuration.
-If the discovered configuration changes the `discovery` or `labels` sections,
+If the discovered configuration changes the `discovery` section,
 those changes are ignored. If the discovered configuration changes the discovery service,
 an error will be logged.
+If the discovered configuration changes the `labels` section, only labels that are additional compared to the bootstrap configuration are used, all other changes are ignored. If the discovery document changes its `labels` section over time, the effective set of labels is always the bootstrap configuration plus added labels from the latest discovery document. 
 
 ### Discovery Bundle Signature
 
@@ -285,3 +286,19 @@ signature verification of a discovery bundle **CANNOT** be modified via discover
 > 🚨 We recommend that if you are using discovery you should be signing the discovery bundles because those bundles
 > include the keys used to verify the non-discovery bundles. However, OPA does not enforce that recommendation. You may use
 > unsigned discovery bundles that themselves require non-discovery bundles to be signed.
+
+### Discovery Bundle Persistence
+
+OPA can optionally persist the activated discovery bundle to disk for recovery purposes. To enable
+persistence, set the `discovery.persist` field to `true`. When bundle
+persistence is enabled, OPA will attempt to read the discovery bundle from disk on startup. This
+allows OPA to start with the most recently activated bundle in case OPA cannot communicate
+with the bundle server. OPA will try to load and activate the persisted discovery bundle on a best-effort basis. Any errors
+encountered during the process will be surfaced in the bundle's status update. When communication between OPA and
+the bundle server is restored, the latest bundle is downloaded, activated, and persisted.  Like regular bundles, only
+the discovery bundle itself is persisted. The discovered configuration that is generated by evaluating the data and
+policies contained in the discovery bundle will **NOT** be persisted.
+
+{{< info >}}
+By default, the discovery bundle is persisted under the current working directory of the OPA process (e.g., `./.opa/bundles/<discovery.name>/bundle.tar.gz`).
+{{< /info >}}
diff --git a/docs/content/management-status.md b/docs/content/management-status.md
index 71259ac45b..d9c077865d 100644
--- a/docs/content/management-status.md
+++ b/docs/content/management-status.md
@@ -6,7 +6,7 @@ weight: 4
 
 OPA can periodically report status updates to remote HTTP servers. The
 updates contain status information for OPA itself as well as the
-[Bundles](#bundles) that have been downloaded and activated.
+[Bundles](../management-bundles) that have been downloaded and activated.
 
 OPA sends status reports whenever one of the following happens:
 
@@ -55,6 +55,18 @@ on the agent, updates will be sent to `/status`.
         "timer_rego_module_compile_ns": 12345,
         "timer_rego_module_parse_ns": 12345
       }
+      "name": "http/example/authz",
+      "size": 1048576,
+      "type": "snapshot",
+    }
+  },
+  "decision_logs": {
+    "code": "decision_log_error",
+    "message": "Upload Failed",
+    "http_code": "400",
+    "metrics": {
+      "counter_decision_logs_dropped": "2",
+      "decision_logs_nd_builtin_cache_dropped": "1"
     }
   },
   "plugins": {
@@ -70,114 +82,146 @@ on the agent, updates will be sent to `/status`.
   },
   "metrics": {
     "prometheus": {
+      "go_gc_cycles_automatic_gc_cycles_total": {
+        "name": "go_gc_cycles_automatic_gc_cycles_total",
+        "help": "Count of completed GC cycles generated by the Go runtime.",
+        "type": "COUNTER",
+        "metric": [
+          {
+            "counter": {
+              "value": 1
+            }
+          }
+        ]
+      },
+      "go_gc_cycles_forced_gc_cycles_total": {
+        "name": "go_gc_cycles_forced_gc_cycles_total",
+        "help": "Count of completed GC cycles forced by the application.",
+        "type": "COUNTER",
+        "metric": [
+          {
+            "counter": {
+              "value": 0
+            }
+          }
+        ]
+      },
+      "go_gc_cycles_total_gc_cycles_total": {
+        "name": "go_gc_cycles_total_gc_cycles_total",
+        "help": "Count of all completed GC cycles.",
+        "type": "COUNTER",
+        "metric": [
+          {
+            "counter": {
+              "value": 1
+            }
+          }
+        ]
+      },
       "go_gc_duration_seconds": {
-        "help": "A summary of the GC invocation durations.",
+        "name": "go_gc_duration_seconds",
+        "help": "A summary of the pause duration of garbage collection cycles.",
+        "type": "SUMMARY",
         "metric": [
           {
             "summary": {
+              "sampleCount": "1",
+              "sampleSum": 4.1765e-05,
               "quantile": [
                 {
                   "quantile": 0,
-                  "value": 0.000011799
+                  "value": 4.1765e-05
                 },
                 {
                   "quantile": 0.25,
-                  "value": 0.000011905
+                  "value": 4.1765e-05
                 },
                 {
                   "quantile": 0.5,
-                  "value": 0.000040002
+                  "value": 4.1765e-05
                 },
                 {
                   "quantile": 0.75,
-                  "value": 0.000065238
+                  "value": 4.1765e-05
                 },
                 {
                   "quantile": 1,
-                  "value": 0.000104897
+                  "value": 4.1765e-05
                 }
-              ],
-              "sample_count": 7,
-              "sample_sum": 0.000309117
+              ]
             }
           }
-        ],
-        "name": "go_gc_duration_seconds",
-        "type": 2
+        ]
       },
 ------------------------------8< SNIP 8<------------------------------
       "http_request_duration_seconds": {
+        "name": "http_request_duration_seconds",
         "help": "A histogram of duration for requests.",
+        "type": "HISTOGRAM",
         "metric": [
           {
+            "label": [
+              {
+                "name": "code",
+                "value": "200"
+              },
+              {
+                "name": "handler",
+                "value": "v1/data"
+              },
+              {
+                "name": "method",
+                "value": "get"
+              }
+            ],
             "histogram": {
+              "sampleCount": "2",
+              "sampleSum": 0.00060022,
               "bucket": [
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.005
-                },
-                {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.01
+                  "cumulativeCount": "0",
+                  "upperBound": 1e-06
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.025
+                  "cumulativeCount": "0",
+                  "upperBound": 5e-06
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.05
+                  "cumulativeCount": "0",
+                  "upperBound": 1e-05
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.1
+                  "cumulativeCount": "0",
+                  "upperBound": 5e-05
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.25
+                  "cumulativeCount": "0",
+                  "upperBound": 0.0001
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 0.5
+                  "cumulativeCount": "2",
+                  "upperBound": 0.0005
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 1
+                  "cumulativeCount": "2",
+                  "upperBound": 0.001
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 2.5
+                  "cumulativeCount": "2",
+                  "upperBound": 0.01
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 5
+                  "cumulativeCount": "2",
+                  "upperBound": 0.1
                 },
                 {
-                  "cumulative_count": 1,
-                  "upper_bound": 10
+                  "cumulativeCount": "2",
+                  "upperBound": 1
                 }
-              ],
-              "sample_count": 1,
-              "sample_sum": 0.003157399
-            },
-            "label": [
-              {
-                "name": "code",
-                "value": "200"
-              },
-              {
-                "name": "handler",
-                "value": "v1/data"
-              },
-              {
-                "name": "method",
-                "value": "get"
-              }
-            ]
+              ]
+            }
           }
-        ],
-        "name": "http_request_duration_seconds",
-        "type": 4
+        ]
       }
     }
   }
@@ -186,29 +230,36 @@ on the agent, updates will be sent to `/status`.
 
 Status updates contain the following fields:
 
-| Field | Type | Description |
-| --- | --- | --- |
-| `labels` | `object` | Set of key-value pairs that uniquely identify the OPA instance. |
-| `bundles` | `object` | Set of objects describing the status for each bundle configured with OPA. |
-| `bundles[_].name` | `string` | Name of bundle that the OPA instance is configured to download. |
-| `bundles[_].active_revision` | `string` | Opaque revision identifier of the last successful activation. |
-| `bundles[_].last_request` | `string` | RFC3339 timestamp of last bundle request. This timestamp should be >= to the successful request timestamp in normal operation. |
-| `bundles[_].last_successful_request` | `string` | RFC3339 timestamp of last successful bundle request. This timestamp should be >= to the successful download timestamp in normal operation. |
-| `bundles[_].last_successful_download` | `string` | RFC3339 timestamp of last successful bundle download. |
-| `bundles[_].last_successful_activation` | `string` | RFC3339 timestamp of last successful bundle activation. |
-| `bundles[_].metrics` | `object` | Metrics from the last update of the bundle. |
-| `bundles[_].code` | `string` | If present, indicates error(s) occurred activating this bundle. |
-| `bundles[_].message` | `string` | Human readable messages describing the error(s). |
-| `bundles[_].errors` | `array` | Collection of detailed parse or compile errors that occurred during activation of this bundle. |
-| `discovery.name` | `string` | Name of discovery bundle that the OPA instance is configured to download. |
-| `discovery.active_revision` | `string` | Opaque revision identifier of the last successful discovery activation. |
-| `discovery.last_request` | `string` | RFC3339 timestamp of last discovery bundle request. This timestamp should be >= to the successful request timestamp in normal operation. |
+| Field               | Type | Description                                                                                                                                          |
+|---------------------| --- |------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `labels`            | `object` | Set of key-value pairs that uniquely identify the OPA instance.                                                                                      |
+| `bundles`           | `object` | Set of objects describing the status for each bundle configured with OPA.                                                                            |
+| `bundles[_].name`   | `string` | Name of bundle that the OPA instance is configured to download.                                                                                      |
+| `bundles[_].active_revision` | `string` | Opaque revision identifier of the last successful activation.                                                                                        |
+| `bundles[_].last_request` | `string` | RFC3339 timestamp of last bundle request. This timestamp should be >= to the successful request timestamp in normal operation.                       |
+| `bundles[_].last_successful_request` | `string` | RFC3339 timestamp of last successful bundle request. This timestamp should be >= to the successful download timestamp in normal operation.           |
+| `bundles[_].last_successful_download` | `string` | RFC3339 timestamp of last successful bundle download.                                                                                                |
+| `bundles[_].last_successful_activation` | `string` | RFC3339 timestamp of last successful bundle activation.                                                                                              |
+| `bundles[_].metrics` | `object` | Metrics from the last update of the bundle.                                                                                                          |
+| `bundles[_].code`   | `string` | If present, indicates error(s) occurred activating this bundle.                                                                                      |
+| `bundles[_].message` | `string` | Human readable messages describing the error(s).                                                                                                     |
+| `bundles[_].http_code` | `number` | If present, indicates an erroneous HTTP status code that OPA received downloading this bundle.                                                       |
+| `bundles[_].errors` | `array` | Collection of detailed parse or compile errors that occurred during activation of this bundle.                                                       |
+| `bundles[_].size`   | `number` | Bundle size, in bytes                                                                                                                                |
+| `bundles[_].type`   | `string` | Bundle type, either `snapshot` or `delta`                                                                                                            |
+| `discovery.name`    | `string` | Name of discovery bundle that the OPA instance is configured to download.                                                                            |
+| `discovery.active_revision` | `string` | Opaque revision identifier of the last successful discovery activation.                                                                              |
+| `discovery.last_request` | `string` | RFC3339 timestamp of last discovery bundle request. This timestamp should be >= to the successful request timestamp in normal operation.             |
 | `discovery.last_successful_request` | `string` | RFC3339 timestamp of last successful discovery bundle request. This timestamp should be >= to the successful download timestamp in normal operation. |
-| `discovery.last_successful_download` | `string` | RFC3339 timestamp of last successful discovery bundle download. |
-| `discovery.last_successful_activation` | `string` | RFC3339 timestamp of last successful discovery bundle activation. |
-| `plugins` | `object` | A set of objects describing the state of configured plugins in OPA's runtime. |
-| `plugins[_].state` | `string` | The state of each plugin. |
-| `metrics.prometheus` | `object` | Global performance metrics for the OPA instance. |
+| `discovery.last_successful_download` | `string` | RFC3339 timestamp of last successful discovery bundle download.                                                                                      |
+| `discovery.last_successful_activation` | `string` | RFC3339 timestamp of last successful discovery bundle activation.                                                                                    |
+| `decision_logs.code` | `string` | If present, indicates error(s) occurred during decision log upload event.                                                                            |
+| `decision_logs.message` | `string` | Human readable messages describing the error(s).                                                                                                     |
+| `decision_logs.http_code` | `number` | If present, indicates an erroneous HTTP status code that OPA received during a decision log upload event.                                            |
+| `decision_logs.metrics`   | `object` | Metrics from the last decision log upload event.                                                                                                     |
+| `plugins`           | `object` | A set of objects describing the state of configured plugins in OPA's runtime.                                                                        |
+| `plugins[_].state`  | `string` | The state of each plugin.                                                                                                                            |
+| `metrics.prometheus` | `object` | Global performance metrics for the OPA instance.                                                                                                     |
 
 If the discovery bundle download or activation failed, the status update will contain
 the following additional fields.
@@ -219,7 +270,7 @@ the following additional fields.
 | `discovery.message` | `string` | Human readable messages describing the error(s). |
 | `discovery.errors` | `array` | Collection of detailed parse or compile errors that occurred during activation. |
 
-Services should reply with HTTP status `200 OK` if the status update is
+Services should reply with a `2xx` HTTP status if the status update is
 processed successfully.
 
 ### Local Status Logs
@@ -237,3 +288,15 @@ This will dump all status updates to the console. See
 > Warning: Status update messages are somewhat infrequent but can be very verbose! The
 >`metrics.prometheus` portion of the status update in particular can create a considerable
 > amount of log text at info level.
+
+### Prometheus Status Metrics
+
+Prometheus status metrics can be enabled via the `prometheus` config option. (see [the configuration documentation](../configuration/#status))
+Example of minimal config to enable:
+
+```yaml
+status:
+    prometheus: true
+```
+
+When enabled the OPA instance's Prometheus endpoint exposes the metrics described on [the monitoring documentation](../monitoring/#status-metrics).
diff --git a/docs/content/monitoring.md b/docs/content/monitoring.md
index a61d3f1a68..42d47abca1 100644
--- a/docs/content/monitoring.md
+++ b/docs/content/monitoring.md
@@ -5,6 +5,22 @@ weight: 30
 restrictedtoc: true
 ---
 
+## OpenTelemetry
+
+When run as a server and configured accordingly, OPA will emit spans to an
+[OpenTelemetry](https://opentelemetry.io/) collector via gRPC.
+
+Each [REST API](../rest-api/) request sent to the server will start a span.
+If processing the request involves policy evaluation, and that in turn uses
+[`http.send`](../policy-reference/#http), those HTTP clients will emit descendant spans.
+
+Furthermore, spans exported for policy evaluation requests will contain an
+attribute `opa.decision_id` of the evaluation's decision ID _if_ the server
+has decision logging enabled.
+
+See [the configuration documentation](../configuration/#distributed-tracing)
+for all OpenTelemetry-related configurables.
+
 ## Prometheus
 
 OPA exposes an HTTP endpoint that can be used to collect performance metrics
@@ -26,37 +42,55 @@ scrape_configs:
 
 The Prometheus endpoint exports Go runtime metrics as well as HTTP request latency metrics for all handlers (e.g., `v1/data`).
 
-| Metric name | Metric type | Description |
-| --- | --- | --- |
-| go_gc_duration_seconds | summary | A summary of the GC invocation durations. |
-| go_goroutines | gauge | Number of goroutines that currently exist. |
-| go_info | gauge | Information about the Go environment. |
-| go_memstats_alloc_bytes | gauge | Number of bytes allocated and still in use. |
-| go_memstats_alloc_bytes_total | counter | Total number of bytes allocated, even if freed. |
-| go_memstats_buck_hash_sys_bytes | gauge | Number of bytes used by the profiling bucket hash table. |
-| go_memstats_frees_total | counter | Total number of frees. |
-| go_memstats_gc_cpu_fraction | gauge | The fraction of this program's available CPU time used by the GC since the program started. |
-| go_memstats_gc_sys_bytes | gauge | Number of bytes used for garbage collection system metadata. |
-| go_memstats_heap_alloc_bytes | gauge | Number of heap bytes allocated and still in use. |
-| go_memstats_heap_idle_bytes | gauge | Number of heap bytes waiting to be used. |
-| go_memstats_heap_inuse_bytes | gauge | Number of heap bytes that are in use. |
-| go_memstats_heap_objects | gauge | Number of allocated objects. |
-| go_memstats_heap_released_bytes | gauge | Number of heap bytes released to OS. |
-| go_memstats_heap_sys_bytes | gauge | Number of heap bytes obtained from system. |
-| go_memstats_last_gc_time_seconds | gauge | Number of seconds since 1970 of last garbage collection. |
-| go_memstats_lookups_total | counter | Total number of pointer lookups. |
-| go_memstats_mallocs_total | counter | Total number of mallocs. |
-| go_memstats_mcache_inuse_bytes | gauge | Number of bytes in use by mcache structures. |
-| go_memstats_mcache_sys_bytes | gauge | Number of bytes used for mcache structures obtained from system. |
-| go_memstats_mspan_inuse_bytes | gauge | Number of bytes in use by mspan structures. |
-| go_memstats_mspan_sys_bytes | gauge | Number of bytes used for mspan structures obtained from system. |
-| go_memstats_next_gc_bytes | gauge | Number of heap bytes when next garbage collection will take place. |
-| go_memstats_other_sys_bytes | gauge | Number of bytes used for other system allocations. |
-| go_memstats_stack_inuse_bytes | gauge | Number of bytes in use by the stack allocator. |
-| go_memstats_stack_sys_bytes | gauge | Number of bytes obtained from system for stack allocator. |
-| go_memstats_sys_bytes | gauge | Number of bytes obtained from system. |
-| go_threads | gauge | Number of OS threads created. |
-| http_request_duration_seconds | histogram | A histogram of duration for requests. |
+| Metric name | Metric type | Description | Status |
+| --- | --- | --- | --- |
+| go_gc_duration_seconds | summary | A summary of the GC invocation durations. | STABLE |
+| go_goroutines | gauge | Number of goroutines that currently exist. | STABLE |
+| go_info | gauge | Information about the Go environment. | STABLE |
+| go_memstats_alloc_bytes | gauge | Number of bytes allocated and still in use. | STABLE |
+| go_memstats_alloc_bytes_total | counter | Total number of bytes allocated, even if freed. | STABLE |
+| go_memstats_buck_hash_sys_bytes | gauge | Number of bytes used by the profiling bucket hash table. | STABLE |
+| go_memstats_frees_total | counter | Total number of frees. | STABLE |
+| go_memstats_gc_cpu_fraction | gauge | The fraction of this program's available CPU time used by the GC since the program started. | STABLE |
+| go_memstats_gc_sys_bytes | gauge | Number of bytes used for garbage collection system metadata. | STABLE |
+| go_memstats_heap_alloc_bytes | gauge | Number of heap bytes allocated and still in use. | STABLE |
+| go_memstats_heap_idle_bytes | gauge | Number of heap bytes waiting to be used. | STABLE |
+| go_memstats_heap_inuse_bytes | gauge | Number of heap bytes that are in use. | STABLE |
+| go_memstats_heap_objects | gauge | Number of allocated objects. | STABLE |
+| go_memstats_heap_released_bytes | gauge | Number of heap bytes released to OS. | STABLE |
+| go_memstats_heap_sys_bytes | gauge | Number of heap bytes obtained from system. | STABLE |
+| go_memstats_last_gc_time_seconds | gauge | Number of seconds since 1970 of last garbage collection. | STABLE |
+| go_memstats_lookups_total | counter | Total number of pointer lookups. | STABLE |
+| go_memstats_mallocs_total | counter | Total number of mallocs. | STABLE |
+| go_memstats_mcache_inuse_bytes | gauge | Number of bytes in use by mcache structures. | STABLE |
+| go_memstats_mcache_sys_bytes | gauge | Number of bytes used for mcache structures obtained from system. | STABLE |
+| go_memstats_mspan_inuse_bytes | gauge | Number of bytes in use by mspan structures. | STABLE |
+| go_memstats_mspan_sys_bytes | gauge | Number of bytes used for mspan structures obtained from system. | STABLE |
+| go_memstats_next_gc_bytes | gauge | Number of heap bytes when next garbage collection will take place. | STABLE |
+| go_memstats_other_sys_bytes | gauge | Number of bytes used for other system allocations. | STABLE |
+| go_memstats_stack_inuse_bytes | gauge | Number of bytes in use by the stack allocator. | STABLE |
+| go_memstats_stack_sys_bytes | gauge | Number of bytes obtained from system for stack allocator. | STABLE |
+| go_memstats_sys_bytes | gauge | Number of bytes obtained from system. | STABLE |
+| go_threads | gauge | Number of OS threads created. | STABLE |
+| http_request_duration_seconds | histogram | A histogram of duration for requests. | STABLE |
+
+
+### Status Metrics
+
+When Prometheus is enabled in the status plugin (see [Configuration](../configuration/#status)), the OPA instance's Prometheus endpoint also exposes these metrics:
+
+| Metric name | Metric type | Description                                              | Status |
+| --- | --- |----------------------------------------------------------|--------|
+| opa_info | gauge | Information about the OPA environment.                    | EXPERIMENTAL |
+| plugin_status_gauge | gauge | Number of plugins by name and status.                    | EXPERIMENTAL |
+| bundle_loaded_counter | counter | Number of bundles loaded with success.                   | EXPERIMENTAL |
+| bundle_failed_load_counter | counter | Number of bundles that failed to load.                   | EXPERIMENTAL |
+| last_bundle_request | gauge | Last bundle request in UNIX nanoseconds.                 | EXPERIMENTAL |
+| last_success_bundle_activation | gauge | Last successful bundle activation in UNIX nanoseconds. | EXPERIMENTAL |
+| last_success_bundle_download | gauge | Last successful bundle download in UNIX nanoseconds.   | EXPERIMENTAL |
+| last_success_bundle_request | gauge | Last successful bundle request in UNIX nanoseconds.    | EXPERIMENTAL |
+| bundle_loading_duration_ns | histogram | A histogram of duration for bundle loading.              | EXPERIMENTAL |
+
 
 ## Health Checks
 
diff --git a/docs/content/oauth-oidc.md b/docs/content/oauth-oidc.md
index d53f01efd6..3e0a233446 100644
--- a/docs/content/oauth-oidc.md
+++ b/docs/content/oauth-oidc.md
@@ -1,7 +1,7 @@
 ---
-title: OAuth2 and OpenID Connect
+title: OAuth2 and OIDC Samples
 kind: misc
-weight: 5
+weight: 1
 ---
 
 OAuth2 and OpenID Connect are both pervasive technologies in modern identity systems. While verification of JSON web tokens issued by these systems is documented in the [policy reference](https://www.openpolicyagent.org/docs/latest/policy-reference/#token-verification), the policy examples below aim to cover some other common use cases.
@@ -13,9 +13,9 @@ Rather than storing endpoints and other metadata as part of policy data, the aut
 ```live:oidc:module
 package oidc
 
-issuers = {"https://issuer1.example.com", "https://issuer2.example.com"}
+issuers := {"https://issuer1.example.com", "https://issuer2.example.com"}
 
-metadata_discovery(issuer) = http.send({
+metadata_discovery(issuer) := http.send({
     "url": concat("", [issuers[issuer], "/.well-known/openid-configuration"]),
     "method": "GET",
     "force_cache": true,
@@ -23,7 +23,7 @@ metadata_discovery(issuer) = http.send({
 }).body
 
 claims := jwt.decode(input.token)[1]
-metadata = metadata_discovery(claims.iss)
+metadata := metadata_discovery(claims.iss)
 
 jwks_endpoint := metadata.jwks_uri
 token_endpoint := metadata.token_endpoint
@@ -36,16 +36,16 @@ Below example uses the keys published at the JWKS endpoint of the authorization
 ```live:oidc2:module
 package oidc
 
-jwks_request(url) = http.send({
+jwks_request(url) := http.send({
     "url": url,
     "method": "GET",
     "force_cache": true,
     "force_cache_duration_seconds": 3600 # Cache response for an hour
 })
 
-jwks = jwks_request("https://authorization-server.example.com/jwks").raw_body
+jwks := jwks_request("https://authorization-server.example.com/jwks").raw_body
 
-verified = io.jwt.verify_rs256(input.token, jwks)
+verified := io.jwt.verify_rs256(input.token, jwks)
 ```
 
 ### Key rotation
@@ -55,7 +55,7 @@ Use the keys published at the JWKS endpoint of the authorization server for toke
 ```live:oidc3:module
 package oidc
 
-jwks_request(url) = http.send({
+jwks_request(url) := http.send({
     "url": url,
     "method": "GET",
     "force_cache": true,
diff --git a/docs/content/philosophy.md b/docs/content/philosophy.md
index 0cefb9f3df..72c1187ace 100644
--- a/docs/content/philosophy.md
+++ b/docs/content/philosophy.md
@@ -132,7 +132,7 @@ into OPA when the state of the world changes. This can happen periodically or wh
 event (like a database change notification) occurs. Base documents loaded asynchronously
 are always accessed under the `data` global variable. On the other hand, base documents can
 also be pushed or pulled into OPA _synchronously_ when your software queries OPA for policy
-decisions. We say refer to base documents pushed synchronously as "input". Policies can
+decisions. We refer to base documents pushed synchronously as "input". Policies can
 access these inputs under the `input` global variable. To pull base documents during
 policy evaluation, OPA exposes (and can be extended with custom) built-in functions like
 `http.send`. Built-in function return values can be assigned to local variables and
@@ -140,7 +140,7 @@ surfaced in virtual documents. Data loaded synchronously is kept outside of `dat
 avoid naming conflicts.
 
 The following table summarizes the different models for loading base documents into OPA,
-how they can referenced inside of policies, and the actual mechanism(s) for loading.
+how they can be referenced inside of policies, and the actual mechanism(s) for loading.
 
 | Model | How to access in Rego | How to integrate with OPA |
 | --- | --- | --- |
@@ -151,7 +151,7 @@ how they can referenced inside of policies, and the actual mechanism(s) for load
 
 Data loaded asynchronously into OPA is cached in-memory so that it can be read efficiently
 during policy evaluation. Similarly, policies are also cached in-memory to ensure
-high-performance and and high-availability. Data _pulled_ synchronously can also be
+high-performance and high-availability. Data _pulled_ synchronously can also be
 cached in-memory. For more information on loading external data into OPA, including tradeoffs,
 see the [External Data](../external-data) page.
 
@@ -170,7 +170,7 @@ virtual documents named `data.iam.user_has_role` and `data.acme.user_is_assigned
 {{< figure src="data-model.svg" width="65" caption="Hypothetical Policy Document Model" >}}
 
 > [1] OPA has excellent support for loading JSON and YAML because they are prevalent
-> in modern systems however OPA is not tied to any particular data format. OPA
+> in modern systems; however, OPA is not tied to any particular data format. OPA
 > uses its own internal representation for structures like maps and lists (a.k.a.,
 > objects and arrays in JSON.)
 
@@ -181,5 +181,5 @@ virtual documents named `data.iam.user_has_role` and `data.acme.user_is_assigned
 > nested, hierarchical data structures containing several levels of embedded
 > maps and lists.
 
-> [3] Internally HTTP requests like `GET /v1/data` or `GET /v1/data/foo/bar` are turned
+> [3] Internally, HTTP requests like `GET /v1/data` or `GET /v1/data/foo/bar` are turned
 > into Rego queries that are almost identical to the HTTP path (e.g., `data` or `data.foo.bar`)
diff --git a/docs/content/policy-language.md b/docs/content/policy-language.md
index 3d17fc4d2b..3f56029d93 100644
--- a/docs/content/policy-language.md
+++ b/docs/content/policy-language.md
@@ -7,6 +7,7 @@ toc: true
 
 ```live:eg:module:hidden
 package example
+import future.keywords
 ```
 
 OPA is purpose built for reasoning about information represented in structured
@@ -23,6 +24,13 @@ Rego queries are assertions on data stored in OPA. These queries can be used to
 define policies that enumerate instances of data that violate the expected state
 of the system.
 
+{{< info >}}
+The examples in this section try to represent the best practices. As such, they
+make use of keywords that are meant to become standard keywords at some point in
+time, but have been introduced gradually.
+[See the docs on _future keywords_](#future-keywords) for more information.
+{{< /info >}}
+
 ## Why use Rego?
 
 Use Rego for defining policy that is easy to read and write.
@@ -52,6 +60,7 @@ Rules define the content of documents. We can query for the content of the `pi`
 ```live:eg/pi:query:read_only,merge_down
 pi
 ```
+
 ```live:eg/pi:output
 ```
 
@@ -66,6 +75,7 @@ The result:
 ```live:eg/rect:query:read_only,merge_down
 rect
 ```
+
 ```live:eg/rect:output
 ```
 
@@ -74,13 +84,14 @@ You can compare two scalar or composite values, and when you do so you are check
 ```live:eg/rect/compare:query:merge_down
 rect == {"height": 4, "width": 2}
 ```
+
 ```live:eg/rect/compare:output
 ```
 
-You can define a new concept using a rule.  For example, `v` below is true if the equality expression is true.
+You can define a new concept using a rule. For example, `v` below is true if the equality expression is true.
 
 ```live:eg/undefined:module
-v { "hello" == "world" }
+v if "hello" == "world"
 ```
 
 If we evaluate `v`, the result is `undefined` because the body of the rule never
@@ -90,6 +101,7 @@ defined.
 ```live:eg/undefined:query:hidden
 v
 ```
+
 ```live:eg/undefined:output:expect_undefined
 ```
 
@@ -98,24 +110,39 @@ Expressions that refer to undefined values are also undefined. This includes com
 ```live:eg/undefined/expression:query:merge_down
 v == true
 ```
+
 ```live:eg/undefined/expression:output:expect_undefined,merge_down
 ```
+
 ```live:eg/undefined/other_expression:query:merge_down
 v != true
 ```
+
 ```live:eg/undefined/other_expression:output:expect_undefined
 ```
 
 We can define rules in terms of [Variables](#variables) as well:
 
 ```live:eg/rules:module
-t { x := 42; y := 41; x > y }
+t if { x := 42; y := 41; x > y }
 ```
 
 The formal syntax uses the semicolon character `;` to separate expressions. Rule
 bodies can separate expressions with newlines and omit the semicolon:
 
 ```live:eg/rules/newlines:module:read_only
+t2 if {
+    x := 42
+    y := 41
+    x > y
+}
+```
+
+Note that the future keyword `if` is optional. We could have written `v` and `t2` like this:
+
+```live:eg/rules/newlines_no_if:module:read_only
+v { "hello" == "world" }
+
 t2 {
     x := 42
     y := 41
@@ -139,53 +166,28 @@ rule-name IS value IF body
 
 If the **value** is omitted, it defaults to **true**.
 
-When we query for the value of `t` we see the obvious result:
+When we query for the value of `t2` we see the obvious result:
 
 ```live:eg/rules:query:hidden
 t
 ```
-```live:eg/rules:output
-```
-
-The order of expressions in a rule does not affect the document’s content.
-
-```live:eg/expression_order:module
-s {
-    x > y
-    y = 41
-    x = 42
-}
-```
-
-The query result is the same:
-
-```live:eg/expression_order:query:hidden
-s
-```
-```live:eg/expression_order:output
-```
 
-There's one exception: if you use assignment `:=` the compiler will check
-that the variable you are assigning has not already been used.
-
-```live:eg/assignment_check:module:merge_down
-z {
-    y := 41
-    y := 42
-    43 > y
-}
-```
-```live:eg/assignment_check:output:expect_assigned_above
+```live:eg/rules:output
 ```
 
 Rego [References](#references) help you refer to nested documents. For example, with:
 
 ```live:eg/references:module
-sites = [{"name": "prod"}, {"name": "smoke1"}, {"name": "dev"}]
+sites := [{"name": "prod"}, {"name": "smoke1"}, {"name": "dev"}]
 ```
+
 And
+
 ```live:eg/references/basic:module
-r { sites[_].name == "prod" }
+r if {
+    some site in sites
+    site.name == "prod"
+}
 ```
 
 The rule `r` above asserts that there exists (at least) one document within `sites` where the `name` attribute equals `"prod"`.
@@ -195,13 +197,17 @@ The result:
 ```live:eg/references/basic:query:hidden
 r
 ```
+
 ```live:eg/references/basic:output
 ```
 
 We can generalize the example above with a rule that defines a set document instead of a boolean document:
 
 ```live:eg/references/helper:module
-q[name] { name := sites[_].name }
+q contains name if {
+    some site in sites
+    name := site.name
+}
 ```
 
 The value of `q` is a set of names
@@ -209,13 +215,14 @@ The value of `q` is a set of names
 ```live:eg/references/helper:query:hidden
 q
 ```
+
 ```live:eg/references/helper:output
 ```
 
 We can re-write the rule `r` from above to make use of `q`. We will call the new rule `p`:
 
 ```live:eg/references/helper/composed:module
-p { q["prod"] }
+p if q["prod"]
 ```
 
 Querying `p` will have the same result:
@@ -223,6 +230,7 @@ Querying `p` will have the same result:
 ```live:eg/references/helper/composed:query:hidden
 p
 ```
+
 ```live:eg/references/helper/composed:output
 ```
 
@@ -231,6 +239,7 @@ As you can see, rules which have arguments can be queried with input values:
 ```live:eg/references/helper/argument:query:merge_down
 q["smoke2"]
 ```
+
 ```live:eg/references/helper/argument:output:expect_undefined
 ```
 
@@ -242,7 +251,6 @@ walks through each part of the language in more detail.
 For a concise reference, see the [Policy
 Reference](../policy-reference) document.
 
-
 ## Scalar Values
 
 Scalar values are the simplest type of term in Rego. Scalar values can be [Strings](#strings), numbers, booleans, or null.
@@ -262,6 +270,7 @@ These documents can be queried like any other:
 ```live:eg/scalars:query:merge_down
 [greeting, max_height, pi, allowed, location]
 ```
+
 ```live:eg/scalars/str:output
 ```
 
@@ -292,6 +301,7 @@ The result:
 ```live:eg/cube:query:merge_down
 cube.width
 ```
+
 ```live:eg/cube:output
 ```
 
@@ -303,6 +313,7 @@ b := false
 c := null
 d := {"a": a, "x": [b, c]}
 ```
+
 ```live:eg/composite_variables:output
 ```
 
@@ -320,14 +331,18 @@ ips_by_port := {
     443: ["2.2.2.1"],
 }
 ```
+
 ```live:eg/objects/lookup:query:merge_down
 ips_by_port[80]
 ```
+
 ```live:eg/objects/lookup:output:merge_down
 ```
+
 ```live:eg/objects/iteration:query:merge_down
 some port; ips_by_port[port][_] == "2.2.2.1"
 ```
+
 ```live:eg/objects/iteration:output
 ```
 
@@ -337,6 +352,7 @@ as strings (because JSON does not support non-string object keys).
 ```live:eg/objects/marshal:query:merge_down
 ips_by_port
 ```
+
 ```live:eg/objects/marshal:output
 ```
 
@@ -350,6 +366,7 @@ For example:
 ```live:eg/cube/sets:query:merge_down
 s := {cube.width, cube.height, cube.depth}
 ```
+
 ```live:eg/cube/sets:output
 ```
 
@@ -364,6 +381,7 @@ When comparing sets, the order of elements does not matter:
 ```live:eg/set_equality:query:merge_down
 {1,2,3} == {3,1,2}
 ```
+
 ```live:eg/set_equality:output
 ```
 
@@ -374,6 +392,7 @@ outside the set, OPA will complain:
 ```live:eg/set_unification:query:merge_down
 {1,2,3} == {3,x,2}
 ```
+
 ```live:eg/set_unification:output:expect_unsafe_var
 ```
 
@@ -383,6 +402,7 @@ defined with `{}`, an empty set has to be constructed with a different syntax:
 ```live:eg/set_construction:query:merge_down
 count(set())
 ```
+
 ```live:eg/set_construction:output
 ```
 
@@ -401,7 +421,10 @@ sites := [
     {"name": "dev"}
 ]
 
-q[name] { name := sites[_].name }
+q contains name if {
+    some site in sites
+    name := site.name
+}
 ```
 
 In this case, we evaluate `q` with a variable `x` (which is not bound to a value). As a result, the query returns all of the values for `x` and all of the values for `q[x]`, which are always the same because `q` is a set.
@@ -409,6 +432,7 @@ In this case, we evaluate `q` with a variable `x` (which is not bound to a value
 ```live:eg/variables:query:merge_down
 q[x]
 ```
+
 ```live:eg/variables:output
 ```
 
@@ -417,6 +441,7 @@ On the other hand, if we evaluate `q` with an input value for `name` we can dete
 ```live:eg/variables/value:query:merge_down
 q["dev"]
 ```
+
 ```live:eg/variables/value:output
 ```
 
@@ -433,6 +458,7 @@ The simplest reference contains no variables. For example, the following referen
 ```live:eg/data/ref1:query:merge_down
 sites[0].servers[1].hostname
 ```
+
 ```live:eg/data/ref1:output
 ```
 
@@ -441,6 +467,7 @@ References are typically written using the “dot-access” style. The canonical
 ```live:eg/data/ref2:query:merge_down
 sites[0]["servers"][1]["hostname"]
 ```
+
 ```live:eg/data/ref2:output
 ```
 
@@ -454,13 +481,13 @@ Both forms are valid, however, the dot-access style is typically more readable.
 The prefix of a reference identifies the root document for that reference. In
 the example above this is `sites`. The root document may be:
 
-  * a local variable inside a rule.
-  * a rule inside the same package.
-  * a document stored in OPA.
-  * a documented temporarily provided to OPA as part of a transaction.
-  * an array, object or set, e.g. `[1, 2, 3][0]`.
-  * a function call, e.g. `split("a.b.c", ".")[1]`.
-  * a [comprehension](#comprehensions).
+* a local variable inside a rule.
+* a rule inside the same package.
+* a document stored in OPA.
+* a documented temporarily provided to OPA as part of a transaction.
+* an array, object or set, e.g. `[1, 2, 3][0]`.
+* a function call, e.g. `split("a.b.c", ".")[1]`.
+* a [comprehension](#comprehensions).
 
 ### Variable Keys
 
@@ -472,6 +499,7 @@ example data:
 ```live:eg/data/var_key:query:merge_down
 sites[i].servers[j].hostname
 ```
+
 ```live:eg/data/var_key:output
 ```
 
@@ -491,6 +519,7 @@ In the reference above, we effectively used variables named `i` and `j` to itera
 ```live:eg/data/meh_key:query:merge_down
 sites[_].servers[_].hostname
 ```
+
 ```live:eg/data/meh_key:output
 ```
 
@@ -513,12 +542,14 @@ s := {[1, 2], [1, 4], [2, 6]}
 ```live:eg/composite_key/1:query:merge_down
 s[[1, 2]]
 ```
+
 ```live:eg/composite_key/1:output
 ```
 
 ```live:eg/composite_key/2:query:merge_down
 s[[1, x]]
 ```
+
 ```live:eg/composite_key/2:output
 ```
 
@@ -541,6 +572,7 @@ The result:
 ```live:eg/data/multi:query:merge_down
 apps_and_hostnames[x]
 ```
+
 ```live:eg/data/multi:output
 ```
 
@@ -570,10 +602,10 @@ The result:
 ```live:eg/data/self_join:query:merge_down
 same_site[x]
 ```
+
 ```live:eg/data/self_join:output
 ```
 
-
 ## Comprehensions
 
 Comprehensions provide a concise way of building [Composite Values](#composite-values) from sub-queries.
@@ -586,6 +618,7 @@ The body of a comprehension is able to refer to variables defined in the outer b
 region := "west"
 names := [name | sites[i].region == region; name := sites[i].name]
 ```
+
 ```live:eg/data/comprehension_intro:output
 ```
 
@@ -613,7 +646,7 @@ Array Comprehensions build array values out of sub-queries. Array Comprehensions
 For example, the following rule defines an object where the keys are application names and the values are hostnames of servers where the application is deployed. The hostnames of servers are represented as an array.
 
 ```live:eg/data/array_comprehension:module
-app_to_hostnames[app_name] = hostnames {
+app_to_hostnames[app_name] := hostnames if {
     app := apps[_]
     app_name := app.name
     hostnames := [hostname | name := app.servers[_]
@@ -628,6 +661,7 @@ The result:
 ```live:eg/data/array_comprehension:query:read_only,merge_down
 app_to_hostnames[app]
 ```
+
 ```live:eg/data/array_comprehension:output
 ```
 
@@ -657,6 +691,7 @@ The result is the same:
 ```live:eg/data/object_comprehension:query:read_only,merge_down
 app_to_hostnames[app]
 ```
+
 ```live:eg/data/object_comprehension:output
 ```
 
@@ -665,6 +700,7 @@ Object comprehensions are not allowed to have conflicting entries, similar to ru
 ```live:eg/data/object_comprehension_conflicting:query:merge_down
 {"foo": y | z := [1, 2, 3]; y := z[_] }
 ```
+
 ```live:eg/data/object_comprehension_conflicting:output:expect_conflict
 ```
 
@@ -677,32 +713,59 @@ Set Comprehensions build set values out of sub-queries. Set Comprehensions have
 ```
 
 For example, to construct a set from an array:
+
 ```live:eg/data/set_comprehension:module:merge_down
 a := [1, 2, 3, 4, 3, 4, 3, 4, 5]
 b := {x | x = a[_]}
 ```
+
 ```live:eg/data/set_comprehension:query:hidden
 a
 b
 ```
+
 ```live:eg/data/set_comprehension:output
 ```
 
-
 ## Rules
 
 Rules define the content of [Virtual Documents](../philosophy#how-does-opa-work) in
-OPA. When OPA evaluates a rule, we say OPA *generates* the content of the
+OPA. When OPA evaluates a rule, we say OPA _generates_ the content of the
 document that is defined by the rule.
 
 The sample code in this section make use of the data defined in [Examples](#example-data).
 
+{{< info >}}
+Rule definitions can be more expressive when using the _future keywords_ `contains` and
+`if`. They are optional, and you will find examples below of defining rules without them.
+
+To follow along as-is, please import the keywords:
+
+```live:eg/data/info:module:read_only
+import future.keywords.if
+import future.keywords.contains
+```
+
+[See the docs on _future keywords_](#future-keywords) for more information.
+{{< /info >}}
+
 ### Generating Sets
 
 The following rule defines a set containing the hostnames of all servers:
 
-```live:eg/data/rules:module
-hostnames[name] { name := sites[_].servers[_].hostname }
+```live:eg/data/rules:module:read_only
+hostnames contains name if {
+    name := sites[_].servers[_].hostname
+}
+```
+
+Note that the [(future) keywords `contains` and `if`](#future-keywords) are optional here.
+If future keywords are not available to you, you can define the same rule as follows:
+
+```live:eg/data/rules2:module:read_only
+hostnames[name] {
+    name := sites[_].servers[_].hostname
+}
 ```
 
 When we query for the content of `hostnames` we see the same data as we would if we queried using the `sites[_].servers[_].hostname` reference directly:
@@ -710,6 +773,7 @@ When we query for the content of `hostnames` we see the same data as we would if
 ```live:eg/data/rules:query:read_only,merge_down
 hostnames[name]
 ```
+
 ```live:eg/data/rules:output
 ```
 
@@ -732,7 +796,7 @@ Third, the `name := sites[_].servers[_].hostname` expression binds the value of
 Rules that define objects are very similar to rules that define sets.
 
 ```live:eg/data/rule_objects:module
-apps_by_hostname[hostname] = app {
+apps_by_hostname[hostname] := app if {
     some i
     server := sites[_].servers[_]
     hostname := server.hostname
@@ -748,13 +812,27 @@ The result:
 ```live:eg/data/rule_objects:query:merge_down
 apps_by_hostname["helium"]
 ```
+
 ```live:eg/data/rule_objects:output
 ```
 
+Using the [(future) keyword `if`](#future-keywords) is optional here.
+The same rule can be defined as follows:
+
+```live:eg/data/rule_objects2:module
+apps_by_hostname[hostname] := app {
+    some i
+    server := sites[_].servers[_]
+    hostname := server.hostname
+    apps[i].servers[_] == server.name
+    app := apps[i].name
+}
+```
+
 ### Incremental Definitions
 
 A rule may be defined multiple times with the same name. When a rule is defined
-this way, we refer to the rule definition as *incremental* because each
+this way, we refer to the rule definition as _incremental_ because each
 definition is additive. The document produced by incrementally defined rules is
 the union of the documents produced by each individual rule.
 
@@ -762,12 +840,12 @@ For example, we can write a rule that abstracts over our `servers` and
 `containers` data as `instances`:
 
 ```live:eg/data/incremental_rule:module
-instances[instance] {
+instances contains instance if {
     server := sites[_].servers[_]
     instance := {"address": server.hostname, "name": server.name}
 }
 
-instances[instance] {
+instances contains instance if {
     container := containers[_]
     instance := {"address": container.ipaddress, "name": container.name}
 }
@@ -777,7 +855,7 @@ If the head of the rule is same, we can chain multiple rule bodies together to
 obtain the same result.  We don't recommend using this form anymore.
 
 ```live:eg/data/incremental_rule_nr:module:read_only
-instances[instance] {
+instances contains instance if {
     server := sites[_].servers[_]
     instance := {"address": server.hostname, "name": server.name}
 } {
@@ -793,13 +871,29 @@ The result:
 ```live:eg/data/incremental_rule:query:read_only,merge_down
 instances[x]
 ```
+
 ```live:eg/data/incremental_rule:output
 ```
 
+Note that the [(future) keywords `contains` and `if`](#future-keywords) are optional here.
+If future keywords are not available to you, you can define the same rule as follows:
+
+```live:eg/data/incremental_rule2:module
+instances[instance] {
+    server := sites[_].servers[_]
+    instance := {"address": server.hostname, "name": server.name}
+}
+
+instances[instance] {
+    container := containers[_]
+    instance := {"address": container.ipaddress, "name": container.name}
+}
+```
+
 ### Complete Definitions
 
-In addition to rules that *partially* define sets and objects, Rego also
-supports so-called *complete* definitions of any type of document. Rules provide
+In addition to rules that _partially_ define sets and objects, Rego also
+supports so-called _complete_ definitions of any type of document. Rules provide
 a complete definition by omitting the key in the head. Complete definitions are
 commonly used for constants:
 
@@ -807,8 +901,9 @@ commonly used for constants:
 pi := 3.14159
 ```
 
-> Rego allows authors to omit the body of rules. If the body is omitted, it
-> defaults to true.
+{{< info >}}
+Rego allows authors to omit the body of rules. If the body is omitted, it defaults to true.
+{{< /info >}}
 
 Documents produced by rules with complete definitions can only have one value at
 a time. If evaluation produces multiple values for the same document, an error
@@ -826,10 +921,10 @@ power_users := {"alice", "bob", "fred"}
 restricted_users := {"bob", "kim"}
 
 # Power users get 32GB memory.
-max_memory = 32 { power_users[user] }
+max_memory := 32 if power_users[user]
 
 # Restricted users get 4GB memory.
-max_memory = 4 { restricted_users[user] }
+max_memory := 4 if restricted_users[user]
 ```
 
 Error:
@@ -837,56 +932,81 @@ Error:
 ```live:eg/conflicting_rules:output:expect_conflict
 ```
 
-OPA returns an error in this case because the rule definitions are in *conflict*. The value produced by max_memory cannot be 32 and 4 **at the same time**.
+OPA returns an error in this case because the rule definitions are in _conflict_.
+The value produced by max_memory cannot be 32 and 4 **at the same time**.
 
 The documents produced by rules with complete definitions may still be undefined:
 
 ```live:eg/conflicting_rules/undefined:query:merge_down
 max_memory with user as "johnson"
 ```
+
 ```live:eg/conflicting_rules/undefined:output:expect_undefined
 ```
 
 In some cases, having an undefined result for a document is not desirable. In those cases, policies can use the [Default Keyword](#default-keyword) to provide a fallback value.
 
-Like variables declared in rules, there can be at most one complete definition
-name declared with the `:=` operator per package. The compiler checks for
-redeclaration of complete definitions with the `:=` operator:
+Note that the [(future) keyword `if`](#future-keywords) is optional here.
+If future keywords are not available to you, you can define complete rules like this:
 
-```live:rule_redeclaration:module
-package example
+```live:eg/conflicting_rules2:module
+max_memory := 32 { power_users[user] }
+max_memory := 4 { restricted_users[user] }
+```
+
+### Rule Heads containing References
 
-pi := 3.14
+As a shorthand for defining nested rule structures, it's valid to use references as rule heads:
 
-# some other rules...
+```live:eg/ref_heads:module
+fruit.apple.seeds = 12
 
-pi := 3.14156   # Redeclaration error because 'pi' already declared above.
+fruit.orange.color = "orange"
 ```
-```live:rule_redeclaration:output:expect_rego_type_error
+
+This module defines _two complete rules_, `data.example.fruit.apple.seeds` and `data.example.fruit.orange.color`:
+
+```live:eg/ref_heads:query:merge_down
+data.example
+```
+
+```live:eg/ref_heads:output
 ```
 
 ### Functions
 
-Rego supports user-defined functions that can be called with the same semantics as [Built-in Functions](#built-in-functions). They have access to both the [the data Document](../#the-data-document) and [the input Document](../#the-input-document).
+Rego supports user-defined functions that can be called with the same semantics as [Built-in Functions](#built-in-functions). They have access to both the [the data Document](../philosophy/#the-opa-document-model) and [the input Document](../philosophy/#the-opa-document-model).
 
 For example, the following function will return the result of trimming the spaces from a string and then splitting it by periods.
 
 ```live:eg/basic_function:module:merge_down
-trim_and_split(s) = x {
+trim_and_split(s) := x if {
      t := trim(s, " ")
      x := split(t, ".")
 }
 ```
+
 ```live:eg/basic_function:query:merge_down
 trim_and_split("   foo.bar ")
 ```
+
 ```live:eg/basic_function:output
 ```
 
+Note that the [(future) keyword `if`](#future-keywords) is optional here.
+If future keywords are not available to you, you can define the same function as follows:
+
+```live:eg/basic_function2:module:read_only
+trim_and_split(s) := x {
+     t := trim(s, " ")
+     x := split(t, ".")
+}
+```
+
 Functions may have an arbitrary number of inputs, but exactly one output. Function arguments may be any kind of term. For example, suppose we have the following function:
 
 ```live:eg/function_input:module:read_only
-foo([x, {"bar": y}]) = z {
+foo([x, {"bar": y}]) := z if {
     z := {x: y}
 }
 ```
@@ -895,32 +1015,37 @@ The following calls would produce the logical mappings given:
 
 | Call                                                    | ``x``      | ``y``                         |
 | ------------------------------------------------------- | ---------- | ----------------------------- |
-| ``z := foo(a) ``                                        | ``a[0]``   | ``a[1].bar``                  |
+| ``z := foo(a)``                                        | ``a[0]``   | ``a[1].bar``                  |
 | ``z := foo(["5", {"bar": "hello"}])``                   | ``"5"``    | ``"hello"``                   |
 | ``z := foo(["5", {"bar": [1, 2, 3, ["foo", "bar"]]}])`` | ``"5"``    | ``[1, 2, 3, ["foo", "bar"]]`` |
 
+If you need multiple outputs, write your functions so that the output is an array, object or set
+containing your results. If the output term is omitted, it is equivalent to having the output term
+be the literal `true`. Furthermore, `if` can be used to write shorter definitions. That is, the
+function declarations below are equivalent:
 
-If you need multiple outputs, write your functions so that the output is an array, object or set containing your results. If the output term is omitted, it is equivalent to having the output term be the literal `true`. That is, the function declarations below are equivalent:
 ```live:eg/function_output_unset:module:read_only
-f(x) {
-    x == "foo"
-}
+f(x) { x == "foo" }
+f(x) if { x == "foo" }
+f(x) if x == "foo"
 
-f(x) = true {
-    x == "foo"
-}
+f(x) := true { x == "foo" }
+f(x) := true if { x == "foo" }
+f(x) := true if x == "foo"
 ```
 
 The outputs of user functions have some additional limitations, namely that they must resolve to a single value. If you write a function that has multiple possible bindings for an output variable, you will get a conflict error:
 
 ```live:eg/function_single_output:module:merge_down
-p(x) = y {
+p(x) := y if {
     y := x[_]
 }
 ```
+
 ```live:eg/function_single_output:query:merge_down
 p([1, 2, 3])
 ```
+
 ```live:eg/function_single_output:output:expect_conflict
 ```
 
@@ -929,10 +1054,10 @@ It is possible in Rego to define a function more than once, to achieve a conditi
 Functions can be defined incrementally.
 
 ```live:eg/double_function_define:module
-q(1, x) = y {
+q(1, x) := y if {
     y := x
 }
-q(2, x) = y {
+q(2, x) := y if {
     y := x*4
 }
 ```
@@ -940,23 +1065,25 @@ q(2, x) = y {
 ```live:eg/double_function_define/1:query:merge_down
 q(1, 2)
 ```
+
 ```live:eg/double_function_define/1:output
 ```
 
 ```live:eg/double_function_define/2:query:merge_down
 q(2, 2)
 ```
+
 ```live:eg/double_function_define/2:output
 ```
 
 A given function call will execute all functions that match the signature given. If a call matches multiple functions, they must produce the same output, or else a conflict error will occur:
 
 ```live:eg/double_function_define_diff_out:module
-r(1, x) = y {
+r(1, x) := y if {
     y := x
 }
 
-r(x, 2) = y {
+r(x, 2) := y if {
     y := x*4
 }
 ```
@@ -964,12 +1091,14 @@ r(x, 2) = y {
 ```live:eg/double_function_define_diff_out:query:merge_down
 r(1, 2)
 ```
+
 ```live:eg/double_function_define_diff_out:output:expect_conflict
 ```
 
 On the other hand, if a call matches no functions, then the result is undefined.
+
 ```live:eg/double_function_define_undefined:module
-s(x, 2) = y {
+s(x, 2) := y if {
     y := x * 4
 }
 ```
@@ -977,20 +1106,85 @@ s(x, 2) = y {
 ```live:eg/double_function_define_undefined/1:query:merge_down
 s(5, 2)
 ```
+
 ```live:eg/double_function_define_undefined/1:output
 ```
 
 ```live:eg/double_function_define_undefined/2:query:merge_down
 s(5, 3)
 ```
+
 ```live:eg/double_function_define_undefined/2:output:expect_undefined
 ```
 
+#### Function overloading
+
+Rego does not currently support the overloading of functions by the number of parameters. If two function definitions are given with the same function name but different numbers of parameters, a compile-time type error is generated.
+
+```live:eg/function_overloading_error:module
+r(x) := result if {
+    result := 2*x
+}
+
+r(x, y) := result if {
+    result := 2*x + 3*y
+}
+```
+
+```live:eg/function_overloading_error:output:expect_rego_type_error
+```
+
+The error can be avoided by using different function names.
+
+```live:eg/function_overloading_naming:module
+r_1(x) := result if {
+    result := 2*x
+}
+
+r_2(x, y) := result if {
+    result := 2*x + 3*y
+}
+```
+
+```live:eg/function_overloading_naming:query:merge_down
+[
+  r_1(10),
+  r_2(10, 1)
+]
+```
+
+```live:eg/function_overloading_naming:output
+```
+
+In the unusual case that it is critical to use the same name, the function could be made to take the list of parameters as a single array. However, this approach is not generally recommended because it sacrifices some helpful compile-time checking and can be quite error-prone.
+
+```live:eg/function_overloading_array:module
+r(params) := result if {
+    count(params) == 1
+    result := 2*params[0]
+}
+
+r(params) := result if {
+    count(params) == 2
+    result := 2*params[0] + 3*params[1]
+}
+```
+
+```live:eg/function_overloading_array:query:merge_down
+[
+  r([10]),
+  r([10, 1])
+]
+```
+
+```live:eg/function_overloading_array:output
+```
+
 ## Negation
 
 To generate the content of a [Virtual Document](../philosophy#how-does-opa-work), OPA attempts to bind variables in the body of the rule such that all expressions in the rule evaluate to True.
 
-This generates the correct result when the expressions represent assertions about what states should exist in the data stored in OPA. In some cases, you want to express that certain states *should not* exist in the data stored in OPA. In these cases, negation must be used.
+This generates the correct result when the expressions represent assertions about what states should exist in the data stored in OPA. In some cases, you want to express that certain states _should not_ exist in the data stored in OPA. In these cases, negation must be used.
 
 For safety, a variable appearing in a negated expression must also appear in another non-negated equality expression in the rule.
 
@@ -999,7 +1193,7 @@ For safety, a variable appearing in a negated expression must also appear in ano
 The simplest use of negation involves only scalar values or variables and is equivalent to complementing the operator:
 
 ```live:eg/simple_negation:module
-t {
+t if {
     greeting := "hello"
     not greeting == "goodbye"
 }
@@ -1010,29 +1204,33 @@ The result:
 ```live:eg/simple_negation:query:read_only,merge_down
 t
 ```
+
 ```live:eg/simple_negation:output
 ```
 
-Negation is required to check whether some value *does not* exist in a collection. That is, complementing the operator in an expression such as `p[_] == "foo"` yields `p[_] != "foo"`. However, this is not equivalent to `not p["foo"]`.
+Negation is required to check whether some value _does not_ exist in a collection. That is, complementing the operator in an expression such as `p[_] == "foo"` yields `p[_] != "foo"`. However, this is not equivalent to `not p["foo"]`.
 
 For example, we can write a rule that defines a document containing names of apps not deployed on the `"prod"` site:
 
 ```live:eg/data/negation:module
-prod_servers[name] {
-    site := sites[_]
+prod_servers contains name if {
+    some site in sites
     site.name == "prod"
-    name := site.servers[_].name
+    some server in site.servers
+    name := server.name
 }
 
-apps_in_prod[name] {
-    app := apps[_]
-    server := app.servers[_]
-    prod_servers[server]
+apps_in_prod contains name if {
+    some site in sites
+    some app in apps
     name := app.name
+    some server in app.servers
+    prod_servers[server]
 }
 
-apps_not_in_prod[name] {
-    name := apps[_].name
+apps_not_in_prod contains name if {
+    some app in apps
+    name := app.name
     not apps_in_prod[name]
 }
 ```
@@ -1042,57 +1240,47 @@ The result:
 ```live:eg/data/negation:query:read_only,merge_down
 apps_not_in_prod[name]
 ```
+
 ```live:eg/data/negation:output
 ```
 
 ## Universal Quantification (FOR ALL)
 
-Like SQL, Rego does not have a direct way to express _universal quantification_
-("FOR ALL"). However, like SQL, you can use other language primitives (e.g.,
-[Negation](#negation)) to express FOR ALL. For example, imagine you want to
-express a policy that says (in English):
+Rego allows for several ways to express universal quantification.
+
+For example, imagine you want to express a policy that says (in English):
 
 ```
 There must be no apps named "bitcoin-miner".
 ```
 
-A common mistake is to try encoding the policy with a rule named
-`no_bitcoin_miners` like so:
+The most expressive way to state this in Rego is using the `every` keyword:
 
-```live:eg/data/incorrect_no_bitcoin:module:read_only
-no_bitcoin_miners {
-    app := apps[_]
-    app.name != "bitcoin-miner"  # THIS IS NOT CORRECT.
+```live:eg/data/every_alternative:module:read_only
+import future.keywords.every
+
+no_bitcoin_miners_using_every if {
+    every app in apps {
+        app.name != "bitcoin-miner"
+    }
 }
 ```
 
-It becomes clear that this is incorrect when you use the [`some`](#some-keyword)
-keyword, because the rule is true whenever there is SOME app that is not a
-bitcoin-miner:
+Variables in Rego are _existentially quantified_ by default: when you write
 
-```live:eg/data/incorrect_no_bitcoin_some:module
-no_bitcoin_miners {
-    some i
-    app := apps[i]
-    app.name != "bitcoin-miner"
-}
+```live:eg/data/every_alternative/1:query:merge_down
+array := ["one", "two", "three"]; array[i] == "three"
 ```
 
-You can confirm this by querying the rule:
+The query will be satisfied **if there is an `i`** such that the query's
+expressions are simultaneously satisfied.
 
-```live:eg/data/incorrect_no_bitcoin_some:query:merge_down
-no_bitcoin_miners with apps as [{"name": "bitcoin-miner"}, {"name": "web"}]
-```
-```live:eg/data/incorrect_no_bitcoin_some:output
+```live:eg/data/every_alternative/1:output
 ```
 
-The reason the rule is incorrect is that variables in Rego are _existentially
-quantified_. This means that rule bodies and queries express FOR ANY and not FOR
-ALL. To express FOR ALL in Rego complement the logic in the rule body (e.g.,
-`!=` becomes `==`) and then complement the check using negation (e.g.,
-`no_bitcoin_miners` becomes `not any_bitcoin_miners`).
+Therefore, there are other ways to express the desired policy.
 
-For this policy, you define a rule that finds if there exists a bitcoin-mining
+For this policy, you can also define a rule that finds if there exists a bitcoin-mining
 app (which is easy using the `some` keyword). And then you use negation to check
 that there is NO bitcoin-mining app. Technically, you're using 2 negations and
 an existential quantifier, which is logically the same as a universal
@@ -1101,13 +1289,10 @@ quantifier.
 For example:
 
 ```live:eg/data/correct_negation:module
-no_bitcoin_miners_using_negation {
-    not any_bitcoin_miners
-}
+no_bitcoin_miners_using_negation if not any_bitcoin_miners
 
-any_bitcoin_miners {
-    some i
-    app := apps[i]
+any_bitcoin_miners if {
+    some app in apps
     app.name == "bitcoin-miner"
 }
 ```
@@ -1115,41 +1300,86 @@ any_bitcoin_miners {
 ```live:eg/data/correct_negation/1:query:merge_down
 no_bitcoin_miners_using_negation with apps as [{"name": "web"}]
 ```
+
 ```live:eg/data/correct_negation/1:output
 ```
 
 ```live:eg/data/correct_negation/2:query:merge_down
 no_bitcoin_miners_using_negation with apps as [{"name": "bitcoin-miner"}, {"name": "web"}]
 ```
+
 ```live:eg/data/correct_negation/2:output:expect_undefined
 ```
 
-> The `undefined` result above is expected because we did not define a default
-> value for `no_bitcoin_miners_using_negation`. Since the body of the rule fails
-> to match, there is no value generated.
+{{< info >}}
+The `undefined` result above is expected because we did not define a default
+value for `no_bitcoin_miners_using_negation`. Since the body of the rule fails
+to match, there is no value generated.
+{{< /info >}}
+
+A common mistake is to try encoding the policy with a rule named `no_bitcoin_miners`
+like so:
+
+```live:eg/data/incorrect_no_bitcoin:module:read_only
+no_bitcoin_miners if {
+    app := apps[_]
+    app.name != "bitcoin-miner"  # THIS IS NOT CORRECT.
+}
+```
+
+It becomes clear that this is incorrect when you use the [`some`](#some-keyword)
+keyword, because the rule is true whenever there is SOME app that is not a
+bitcoin-miner:
+
+```live:eg/data/incorrect_no_bitcoin_some:module
+no_bitcoin_miners if {
+    some app in apps
+    app.name != "bitcoin-miner"
+}
+```
+
+You can confirm this by querying the rule:
+
+```live:eg/data/incorrect_no_bitcoin_some:query:merge_down
+no_bitcoin_miners with apps as [{"name": "bitcoin-miner"}, {"name": "web"}]
+```
+
+```live:eg/data/incorrect_no_bitcoin_some:output
+```
+
+The reason the rule is incorrect is that variables in Rego are _existentially
+quantified_. This means that rule bodies and queries express FOR ANY and not FOR
+ALL. To express FOR ALL in Rego complement the logic in the rule body (e.g.,
+`!=` becomes `==`) and then complement the check using negation (e.g.,
+`no_bitcoin_miners` becomes `not any_bitcoin_miners`).
 
 Alternatively, we can implement the same kind of logic inside a single rule
 using [Comprehensions](#comprehensions).
 
 ```live:eg/data/comprehesion_alternative:module:read_only
-no_bitcoin_miners_using_comprehension {
-    bitcoin_miners := {app | app := apps[_]; app.name == "bitcoin-miner"}
+no_bitcoin_miners_using_comprehension if {
+    bitcoin_miners := {app | some app in apps; app.name == "bitcoin-miner"}
     count(bitcoin_miners) == 0
 }
 ```
 
-> Whether you use negation or comprehensions to express FOR ALL is up to you.
-> The comprehension version is more concise and does not require a helper rule
-> while the negation version is more verbose but a bit simpler and allows for
-> more complex ORs.
+{{< info >}}
+Whether you use negation, comprehensions, or `every` to express FOR ALL is up to you.
+The `every` keyword should lend itself nicely to a rule formulation that closely
+follows how requirements are stated, and thus enhances your policy's readability.
+
+The comprehension version is more concise than the negation variant, and does not
+require a helper rule while the negation version is more verbose but a bit simpler
+and allows for more complex ORs.
+{{< /info >}}
 
 ## Modules
 
-In Rego, policies are defined inside *modules*. Modules consist of:
+In Rego, policies are defined inside _modules_. Modules consist of:
 
-  * Exactly one [Package](#packages) declaration.
-  * Zero or more [Import](#imports) statements.
-  * Zero or more [Rule](#rules) definitions.
+* Exactly one [Package](#packages) declaration.
+* Zero or more [Import](#imports) statements.
+* Zero or more [Rule](#rules) definitions.
 
 Modules are typically represented in Unicode text and encoded in UTF-8.
 
@@ -1205,12 +1435,13 @@ Modules use the same syntax to declare dependencies on [Base and Virtual Documen
 
 ```live:import_data:module:read_only
 package opa.examples
+import future.keywords # uses 'in' and 'contains' and 'if'
 
 import data.servers
 
-http_servers[server] {
-    server := servers[_]
-    server.protocols[_] == "http"
+http_servers contains server if {
+    some server in servers
+    "http" in server.protocols
 }
 ```
 
@@ -1218,23 +1449,31 @@ Similarly, modules can declare dependencies on query arguments by specifying an
 
 ```live:import_input:module:read_only
 package opa.examples
+import future.keywords
 
 import input.user
 import input.method
 
 # allow alice to perform any operation.
-allow { user == "alice" }
+allow if user == "alice"
 
 # allow bob to perform read-only operations.
-allow {
+allow if {
     user == "bob"
     method == "GET"
 }
 
 # allows users assigned a "dev" role to perform read-only operations.
-allow {
+allow if {
     method == "GET"
-    data.roles["dev"][_] == input.user
+    input.user in data.roles["dev"]
+}
+
+# allows user catherine access on Saturday and Sunday
+allow if {
+    user == "catherine"
+    day := time.weekday(time.now_ns())
+    day in ["Saturday", "Sunday"]
 }
 ```
 
@@ -1242,36 +1481,122 @@ Imports can include an optional `as` keyword to handle namespacing issues:
 
 ```live:import_namespacing:module:read_only
 package opa.examples
+import future.keywords
 
 import data.servers as my_servers
 
-http_servers[server] {
-    server := my_servers[_]
-    server.protocols[_] == "http"
+http_servers contains server if {
+    some server in my_servers
+    "http" in server.protocols
 }
 ```
 
-## Some Keyword
+## Future Keywords
 
-The `some` keyword allows queries to explicitly declare local variables. Use the
-`some` keyword in rules that contain unification statements or references with
-variable operands **if** variables contained in those statements are not
-declared using `:=` .
+To ensure backwards-compatibility, new keywords (like `every`) are introduced slowly.
+In the first stage, users can opt-in to using the new keywords via a special import:
 
-| Statement | Example | Variables |
-| --- | --- | --- |
-| Unification | `input.a = [["b", x], [y, "c"]]` | `x` and `y` |
-| Reference with variable operands | `data.foo[i].bar[j]` | `i` and `j` |
+* `import future.keywords` introduces _all_ future keywords, and
+* `import future.keywords.x` _only_ introduces the `x` keyword -- see below for all known future keywords.
 
-For example, the following rule generates tuples of array indices for servers in
-the "west" region that contain "db" in their name. The first element in the
-tuple is the site index and the second element is the server index.
+{{< danger >}}
+Using `import future.keywords` to import all future keywords means an **opt-out of a
+safety measure**:
 
-```live:eg/data/some:module
-tuples[[i, j]] {
-    some i, j
+With a new version of OPA, the set of "all" future keywords can grow, and policies that
+worked with the previous version of OPA stop working.
+
+This **cannot happen** when you selectively import the future keywords as you need them.
+{{< /danger>}}
+
+At some point in the future, the keyword will become _standard_, and the import will
+become a no-op that can safely be removed. This should give all users ample time to
+update their policies, so that the new keyword will not cause clashes with existing
+variable names.
+
+Note that some future keyword imports have consequences on pretty-printing:
+If `contains` or `if` are imported, the pretty-printer will use them as applicable
+when formatting the modules.
+
+This is the list of all future keywords known to OPA:
+
+### `future.keywords.in`
+
+More expressive membership and existential quantification keyword:
+
+```live:eg/kws/in:module:read_only
+deny {
+    some x in input.roles # iteration
+    x == "denylisted-role"
+}
+deny {
+    "denylisted-role" in input.roles # membership check
+}
+```
+
+`in` was introduced in [v0.34.0](https://github.com/open-policy-agent/opa/releases/tag/v0.34.0).
+See [the keywords docs](#membership-and-iteration-in) for details.
+
+### `future.keywords.every`
+
+Expressive _universal quantification_ keyword:
+
+```live:eg/kws/every:module:read_only
+allowed := {"customer", "admin"}
+
+allow {
+    every role in input.roles {
+        role.name in allowed
+    }
+}
+```
+
+There is no need to also import `future.keywords.in`, that is **implied** by importing `future.keywords.every`.
+
+`every` was introduced in [v0.38.0](https://github.com/open-policy-agent/opa/releases/tag/v0.38.0).
+See [Every Keyword](#every-keyword) for details.
+
+### `future.keywords.if`
+
+This keyword allows more expressive rule heads:
+
+```live:eg/kws/if:module:read_only
+deny if input.token != "secret"
+```
+
+`if` was introduced in [v0.42.0](https://github.com/open-policy-agent/opa/releases/tag/v0.42.0).
+
+### `future.keywords.contains`
+
+This keyword allows more expressive rule heads for partial set rules:
+
+```live:eg/kws/contains:module:read_only
+deny contains msg { msg := "forbidden" }
+```
+
+`contains` was introduced in [v0.42.0](https://github.com/open-policy-agent/opa/releases/tag/v0.42.0).
+
+## Some Keyword
+
+The `some` keyword allows queries to explicitly declare local variables. Use the
+`some` keyword in rules that contain unification statements or references with
+variable operands **if** variables contained in those statements are not
+declared using `:=` .
+
+| Statement | Example | Variables |
+| --- | --- | --- |
+| Unification | `input.a = [["b", x], [y, "c"]]` | `x` and `y` |
+| Reference with variable operands | `data.foo[i].bar[j]` | `i` and `j` |
+
+For example, the following rule generates tuples of array indices for servers in
+the "west" region that contain "db" in their name. The first element in the
+tuple is the site index and the second element is the server index.
+
+```live:eg/data/some:module
+tuples contains [i, j] if {
+    some i, j
     sites[i].region == "west"
-    server := sites[i].servers[j]    # note: 'server' is local because it's declared with :=
+    server := sites[i].servers[j] # note: 'server' is local because it's declared with :=
     contains(server.name, "db")
 }
 ```
@@ -1281,6 +1606,7 @@ If we query for the tuples we get two results:
 ```live:eg/data/some/i:query:hidden
 tuples
 ```
+
 ```live:eg/data/some/i:output
 ```
 
@@ -1303,10 +1629,106 @@ behaviour of other rules.
 For using the `some` keyword with iteration, see
 [the documentation of the `in` operator](#membership-and-iteration-in).
 
+## Every Keyword
+
+{{< info >}}
+`every` is a future keyword and needs to be imported.
+
+`import future.keywords.every` introduces the `every` keyword described here.
+
+[See the docs on _future keywords_](#future-keywords) for more information.
+{{< /info >}}
+
+```live:eg/data/every0:module:merge_down
+import future.keywords.every
+
+names_with_dev if {
+    some site in sites
+    site.name == "dev"
+
+    every server in site.servers {
+        endswith(server.name, "-dev")
+    }
+}
+```
+
+```live:eg/data/every0:query:merge_down
+names_with_dev
+```
+
+```live:eg/data/every0:output
+```
+
+The `every` keyword takes an (optional) key argument, a value argument, a domain, and a
+block of further queries, its "body".
+
+The keyword is used to explicitly assert that its body is true for _any element in the domain_.
+It will iterate over the domain, bind its variables, and check that the body holds
+for those bindings.
+If one of the bindings does not yield a successful evaluation of the body, the overall
+statement is undefined.
+
+If the domain is empty, the overall statement is true.
+
+Evaluating `every` does **not** introduce new bindings into the rule evaluation.
+
+Used with a key argument, the index, or property name (for objects), comes into the
+scope of the body evaluation:
+
+```live:eg/every1:module:merge_down
+import future.keywords.every
+
+array_domain if {
+    every i, x in [1, 2, 3] { x-i == 1 } # array domain
+}
+
+object_domain if {
+    every k, v in {"foo": "bar", "fox": "baz" } { # object domain
+        startswith(k, "f")
+        startswith(v, "b")
+    }
+}
+
+set_domain if {
+    every x in {1, 2, 3} { x != 4 } # set domain
+}
+```
+
+```live:eg/every1:output
+```
+
+Semantically, `every x in xs { p(x) }` is equivalent to, but shorter than, a "not-some-not"
+construct using a helper rule:
+
+```live:eg/every2:module:merge_down
+import future.keywords.every
+
+xs := [2, 2, 4, 8]
+larger_than_one(x) := x > 1
+
+rule_every if {
+    every x in xs { larger_than_one(x) }
+}
+
+not_less_or_equal_one if not lte_one
+
+lte_one if {
+    some x in xs
+    not larger_than_one(x)
+}
+```
+
+```live:eg/every2:output
+```
+
+Negating `every` is forbidden. If you desire to express `not every x in xs { p(x) }`
+please use `some x in xs; not p(x)` instead.
+
 ## With Keyword
 
 The `with` keyword allows queries to programmatically specify values nested
-under the [input Document](../##the-input-document) and the [data Document](../#the-data-document).
+under the [input Document](../philosophy/#the-opa-document-model) or the
+[data Document](../philosophy/#the-opa-document-model), or built-in functions.
 
 For example, given the simple authorization policy in the [Imports](#imports)
 section, we can write a query that checks whether a particular request would be
@@ -1315,33 +1737,47 @@ allowed:
 ```live:import_input/1:query:merge_down
 allow with input as {"user": "alice", "method": "POST"}
 ```
+
 ```live:import_input/1:output
 ```
 
 ```live:import_input/2:query:merge_down
 allow with input as {"user": "bob", "method": "GET"}
 ```
+
 ```live:import_input/2:output
 ```
 
 ```live:import_input/3:query:merge_down
 not allow with input as {"user": "bob", "method": "DELETE"}
 ```
+
 ```live:import_input/3:output
 ```
 
 ```live:import_input/4:query:merge_down
 allow with input as {"user": "charlie", "method": "GET"} with data.roles as {"dev": ["charlie"]}
 ```
+
 ```live:import_input/4:output
 ```
 
 ```live:import_input/5:query:merge_down
 not allow with input as {"user": "charlie", "method": "GET"} with data.roles as {"dev": ["bob"]}
 ```
+
 ```live:import_input/5:output
 ```
 
+```live:import_input/6:query:merge_down
+allow with input as {"user": "catherine", "method": "GET"}
+      with data.roles as {"dev": ["bob"]}
+      with time.weekday as "Sunday"
+```
+
+```live:import_input/6:output
+```
+
 The `with` keyword acts as a modifier on expressions. A single expression is
 allowed to have zero or more `with` modifiers. The `with` keyword has the
 following syntax:
@@ -1351,33 +1787,112 @@ following syntax:
 ```
 
 The `<target>`s must be references to values in the input document (or the input
-document itself) or data document.
+document itself) or data document, or references to functions (built-in or not).
 
-> When applied to the `data` document, the `<target>` must not attempt to
-> partially define virtual documents. For example, given a virtual document at
-> path `data.foo.bar`, the compiler will generate an error if the policy
-> attempts to replace `data.foo.bar.baz`.
+{{< info >}}
+When applied to the `data` document, the `<target>` must not attempt to
+partially define virtual documents. For example, given a virtual document at
+path `data.foo.bar`, the compiler will generate an error if the policy
+attempts to replace `data.foo.bar.baz`.
+{{< /info >}}
 
 The `with` keyword only affects the attached expression. Subsequent expressions
 will see the unmodified value. The exception to this rule is when multiple
 `with` keywords are in-scope like below:
 
 ```live:multiple_with:module:read_only
-inner := [x, y] {
+inner := [x, y] if {
     x := input.foo
     y := input.bar
 }
 
-middle := [a, b] {
+middle := [a, b] if {
     a := inner with input.foo as 100
     b := input
 }
 
-outer := result {
+outer := result if {
     result := middle with input as {"foo": 200, "bar": 300}
 }
 ```
 
+When `<target>` is a reference to a function, like `http.send`, then
+its `<value>` can be any of the following:
+
+1. a value: `with http.send as {"body": {"success": true }}`
+2. a reference to another function: `with http.send as mock_http_send`
+3. a reference to another (possibly custom) built-in function: `with custom_builtin as less_strict_custom_builtin`
+4. a reference to a rule that will be used as the _value_.
+
+When the replacement value is a function, its arity needs to match the replaced
+function's arity; and the types must be compatible.
+
+Replacement functions can call the function they're replacing **without causing
+recursion**.
+See the following example:
+
+```live:eg/with_builtins:module:read_only
+f(x) := count(x)
+
+mock_count(x) := 0 if "x" in x
+mock_count(x) := count(x) if not "x" in x
+```
+
+```live:eg/with_builtins/1:query:merge_down
+f([1, 2, 3]) with count as mock_count
+```
+
+```live:eg/with_builtins/1:output
+```
+
+```live:eg/with_builtins/2:query:merge_down
+f(["x", "y", "z"]) with count as mock_count
+```
+
+```live:eg/with_builtins/2:output
+```
+
+Each replacement function evaluation will start a new scope: it's valid to use
+`with <builtin1> as ...` in the body of the replacement function -- for example:
+
+```live:eg/with_builtins_nested:module:read_only
+f(x) := count(x) if {
+    rule_using_concat with concat as "foo,bar"
+}
+
+mock_count(x) := 0 if "x" in x
+mock_count(x) := count(x) if not "x" in x
+
+rule_using_concat if {
+    concat(",", input.x) == "foo,bar"
+}
+```
+
+```live:eg/with_builtins_nested/1:query:merge_down
+f(["x", "y", "z"]) with count as mock_count with input.x as ["baz"]
+```
+
+```live:eg/with_builtins_nested/1:output
+```
+
+Note that function replacement via `with` does not affect the evaluation of
+the function arguments: if `input.x` is undefined, the replacement of `concat`
+does not change the result of the evaluation:
+
+```live:eg/with_builtins_nested/2:query:merge_down
+count(input.x) with count as 3 with input.x as ["x"]
+```
+
+```live:eg/with_builtins_nested/2:output
+```
+
+```live:eg/with_builtins_nested/3:query:merge_down
+count(input.x) with count as 3 with input as {}
+```
+
+```live:eg/with_builtins_nested/3:output:expect_undefined
+```
+
 ## Default Keyword
 
 The `default` keyword allows policies to define a default value for documents
@@ -1387,16 +1902,14 @@ default value is used when all of the rules sharing the same name are undefined.
 For example:
 
 ```live:eg/default:module
-default allow = false
+default allow := false
 
-allow {
+allow if {
     input.user == "bob"
     input.method == "GET"
 }
 
-allow {
-    input.user == "alice"
-}
+allow if input.user == "alice"
 ```
 
 When the `allow` document is queried, the return value will be either `true` or `false`.
@@ -1404,12 +1917,14 @@ When the `allow` document is queried, the return value will be either `true` or
 ```live:eg/default:query:hidden
 allow
 ```
+
 ```live:eg/default:input:merge_down
 {
     "user": "bob",
     "method": "POST"
 }
 ```
+
 ```live:eg/default:output
 ```
 
@@ -1418,12 +1933,13 @@ Without the default definition, the `allow` document would simply be undefined f
 When the `default` keyword is used, the rule syntax is restricted to:
 
 ```
-default <name> = <term>
+default <name> := <term>
 ```
 
 The term may be any scalar, composite, or comprehension value but it may not be
 a variable or reference. If the value is a composite then it may not contain
-variables or references.
+variables or references. Comprehensions however may, as the result of a
+comprehension is never undefined.
 
 ## Else Keyword
 
@@ -1438,13 +1954,14 @@ The ``else`` keyword is useful if you are porting policies into Rego from an
 order-sensitive system like IPTables.
 
 ```live:eg/else:module
-authorize = "allow" {
+authorize := "allow" if {
     input.user == "superuser"           # allow 'superuser' to perform any operation.
-} else = "deny" {
+} else := "deny" if {
     input.path[0] == "admin"            # disallow 'admin' operations...
     input.source_network == "external"  # from external networks.
 } # ... more rules
 ```
+
 ```live:eg/else:query:hidden
 authorize
 ```
@@ -1462,6 +1979,7 @@ though the input matches the second rule as well.
   "user": "superuser"
 }
 ```
+
 ```live:eg/else/1:output
 ```
 
@@ -1478,6 +1996,7 @@ evaluation continues to the second rule before stopping.
   "user": "alice"
 }
 ```
+
 ```live:eg/else/2:output
 ```
 
@@ -1488,27 +2007,26 @@ limit imposed on the number of `else` clauses on a rule.
 
 ### Membership and iteration: `in`
 
-> To ensure backwards-compatibility, new keywords (like `in`) are introduced slowly.
-> In the first stage, users can opt-in to using the new keywords via a special import:
-> `import future.keywords` introduces _all_ future keywords, and
-> `import future.keywords.in` introduces the `in` keyword described here.
->
-> At some point in the future, the keyword will become _standard_, and the import will
-> become a no-op that can safely be removed. This should give all users ample time to
-> update their policies, so that the new keyword will not cause clashes with existing
-> variable names.
+{{< info >}}
+To ensure backwards-compatibility, new keywords (like `in`) are introduced slowly.
+In the first stage, users can opt-in to using the new keywords via a special import:
+`import future.keywords.in` introduces the `in` keyword described here.
+
+[See the docs on _future keywords_](#future-keywords) for more information.
+{{< /info >}}
 
 The membership operator `in` lets you check if an element is part of a collection (array, set, or object). It always evaluates to `true` or `false`:
 
 ```live:eg/member1:module:merge_down
 import future.keywords.in
 
-p = [x, y, z] {
+p := [x, y, z] if {
     x := 3 in [1, 2, 3]            # array
     y := 3 in {1, 2, 3}            # set
     z := 3 in {"foo": 1, "bar": 3} # object
 }
 ```
+
 ```live:eg/member1:output
 ```
 
@@ -1519,11 +2037,12 @@ taken to be the key (object) or index (array), respectively:
 ```live:eg/member1c:module:merge_down
 import future.keywords.in
 
-p := [ x, y ] {
+p := [x, y] if {
     x := "foo", "bar" in {"foo": "bar"}    # key, val with object
     y := 2, "baz" in ["foo", "bar", "baz"] # key, val with array
 }
 ```
+
 ```live:eg/member1c:output
 ```
 
@@ -1534,22 +2053,23 @@ arguments -- compare:
 ```live:eg/member1d:module:merge_down
 import future.keywords.in
 
-p := x {
+p := x if {
     x := { 0, 2 in [2] }
 }
-q := x {
+q := x if {
     x := { (0, 2 in [2]) }
 }
-w := x {
+w := x if {
     x := g((0, 2 in [2]))
 }
-z := x {
+z := x if {
     x := f(0, 2 in [2])
 }
 
-f(x, y) = sprintf("two function arguments: %v, %v", [x, y])
-g(x) = sprintf("one function argument: %v", [x])
+f(x, y) := sprintf("two function arguments: %v, %v", [x, y])
+g(x) := sprintf("one function argument: %v", [x])
 ```
+
 ```live:eg/member1d:output
 ```
 
@@ -1559,14 +2079,13 @@ member of an array:
 ```live:eg/member1a:module:merge_down
 import future.keywords.in
 
-deny {
-    not "admin" in input.user.roles
-}
+deny if not "admin" in input.user.roles
 
 test_deny {
     deny with input.user.roles as ["operator", "user"]
 }
 ```
+
 ```live:eg/member1a:output
 ```
 
@@ -1576,10 +2095,11 @@ when called in non-collection arguments:
 ```live:eg/member1b:module:merge_down
 import future.keywords.in
 
-q = x {
+q := x if {
     x := 3 in "three"
 }
 ```
+
 ```live:eg/member1b:output
 ```
 
@@ -1600,10 +2120,12 @@ r[x] {
     some x in {"foo": "bar", "baz": "quz"}
 }
 ```
+
 ```live:eg/member2:output
 ```
 
 Furthermore, passing a second argument allows you to work with _object keys_ and _array indices_:
+
 ```live:eg/member3:module:merge_down
 import future.keywords.in
 
@@ -1611,14 +2133,15 @@ p[x] {
     some x, "r" in ["a", "r", "r", "a", "y"] # key variable, value constant
 }
 
-q[x] = y {
+q[x] = y if {
      some x, y in ["a", "r", "r", "a", "y"] # both variables
 }
 
-r[y] = x {
+r[y] = x if {
     some x, y in {"foo": "bar", "baz": "quz"}
 }
 ```
+
 ```live:eg/member3:output
 ```
 
@@ -1627,13 +2150,14 @@ Any argument to the `some` variant can be a composite, non-ground value:
 ```live:eg/member4:module:merge_down
 import future.keywords.in
 
-p[x] = y {
+p[x] = y if {
     some x, {"foo": y} in [{"foo": 100}, {"bar": 200}]
 }
-p[x] = y {
+p[x] = y if {
     some {"bar": x}, {"foo": y} in {{"bar": "b"}: {"foo": "f"}}
 }
 ```
+
 ```live:eg/member4:output
 ```
 
@@ -1648,7 +2172,7 @@ The assignment operator (`:=`) is used to assign values to variables. Variables
 ```live:eg/assignment1:module:read_only
 x := 100
 
-p {
+p if {
     x := 1     # declare local variable 'x' and assign value 1
     x != 100   # true because 'x' refers to local variable
 }
@@ -1658,16 +2182,17 @@ Assigned variables are not allowed to appear before the assignment in the
 query. For example, the following policy will not compile:
 
 ```live:eg/assignment2:module:merge_down
-p {
+p if {
     x != 100
     x := 1     # error because x appears earlier in the query.
 }
 
-q {
+q if {
     x := 1
     x := 2     # error because x is assigned twice.
 }
 ```
+
 ```live:eg/assignment2:output:expect_assigned_above,expect_referenced_above
 ```
 
@@ -1676,43 +2201,46 @@ A simple form of destructuring can be used to unpack values from arrays and assi
 ```live:eg/assignment3:module:read_only
 address := ["3 Abbey Road", "NW8 9AY", "London", "England"]
 
-in_london {
+in_london if {
     [_, _, city, country] := address
     city == "London"
     country == "England"
 }
 ```
+
 ```live:eg/assignment3:output
 ```
 
-
 #### Comparison `==`
 
 Comparison checks if two values are equal within a rule.  If the left or right hand side contains a variable that has not been assigned a value, the compiler throws an error.
 
 ```live:eg/comparison1:module:merge_down
-p {
+p if {
     x := 100
     x == 100   # true because x refers to the local variable
 }
 ```
+
 ```live:eg/comparison1:output
 ```
 
 ```live:eg/comparison2:module:merge_down
 y := 100
-q {
+q if {
     y == 100   # true because y refers to the global variable
 }
 ```
+
 ```live:eg/comparison2:output
 ```
 
 ```live:eg/comparison3:module:merge_down
-r {
+r if {
     z == 100   # compiler error because z has not been assigned a value
 }
 ```
+
 ```live:eg/comparison3:output:expect_unsafe_var
 ```
 
@@ -1724,15 +2252,26 @@ Unification (`=`) combines assignment and comparison. Rego will assign variables
 # Find values for x and y that make the equality true
 [x, "world"] = ["hello", y]
 ```
+
 ```live:eg/unification1:output
 ```
 
 ```live:eg/data/unification2:query:merge_down
 sites[i].servers[j].name = apps[k].servers[m]
 ```
+
 ```live:eg/data/unification2:output
 ```
 
+As opposed to when assignment (`:=`) is used, the order of expressions in a rule does not affect the document’s content.
+
+```live:eg/expression_order:module
+s if {
+    x > y
+    y = 41
+    x = 42
+}
+```
 
 #### Best Practices for Equality
 
@@ -1750,7 +2289,6 @@ Best practice is to use assignment `:=` and comparison `==` wherever possible. T
 
 Under the hood `:=` and `==` are syntactic sugar for `=`, local variable creation, and additional compiler checks.
 
-
 ### Comparison Operators
 
 The following comparison operators are supported:
@@ -1770,7 +2308,6 @@ must appear in another expression in the same rule that would cause the
 variable to be bound, i.e., an equality expression or the target position of
 a built-in function.
 
-
 ## Built-in Functions
 
 In some cases, rules must perform simple arithmetic, aggregation, and so on.
@@ -1810,21 +2347,23 @@ logic. If error handling is required, the built-in function call can be negated
 to test for undefined. For example:
 
 ```live:eg/errors:module:merge_down
-allow {
+allow if {
     io.jwt.verify_hs256(input.token, "secret")
     [_, payload, _] := io.jwt.decode(input.token)
     payload.role == "admin"
 }
 
-reason["invalid JWT supplied as input"] {
+reason contains "invalid JWT supplied as input" if {
     not io.jwt.decode(input.token)
 }
 ```
+
 ```live:eg/errors:input:merge_down
 {
     "token": "a poorly formatted token"
 }
 ```
+
 ```live:eg/errors:output
 ```
 
@@ -1927,3 +2466,1141 @@ containers := [
     }
 ]
 ```
+
+## Metadata
+
+The package and individual rules in a module can be annotated with a rich set of metadata.
+
+```live:rego/metadata:module:read_only
+# METADATA
+# title: My rule
+# description: A rule that determines if x is allowed.
+# authors:
+# - John Doe <john@example.com>
+# entrypoint: true
+allow {
+  ...
+}
+```
+
+Annotations are grouped within a _metadata block_, and must be specified as YAML within a comment block that **must** start with `# METADATA`.
+Also, every line in the comment block containing the annotation **must** start at Column 1 in the module/file, or otherwise, they will be ignored.
+
+{{< danger >}}
+OPA will attempt to parse the YAML document in comments following the
+initial `# METADATA` comment. If the YAML document cannot be parsed, OPA will
+return an error. If you need to include additional comments between the
+comment block and the next statement, include a blank line immediately after
+the comment block containing the YAML document. This tells OPA that the
+comment block containing the YAML document is finished
+{{< /danger >}}
+
+### Annotations
+
+Name | Type | Description
+--- | --- | ---
+scope | string; one of `package`, `rule`, `document`, `subpackages` | The scope on which the `schemas` annotation is applied. Read more [here](./#scope).
+title | string | A human-readable name for the annotation target. Read more [here](#title).
+description | string | A description of the annotation target. Read more [here](#description).
+related_resources | list of URLs | A list of URLs pointing to related resources/documentation. Read more [here](#related-resources).
+authors | list of strings | A list of authors for the annotation target. Read more [here](#authors).
+organizations | list of strings | A list of organizations related to the annotation target. Read more [here](#organizations).
+schemas | list of object | A list of associations between value paths and schema definitions. Read more [here](#schemas).
+entrypoint | boolean | Whether or not the annotation target is to be used as a policy entrypoint. Read more [here](#entrypoint).
+custom | mapping of arbitrary data | A custom mapping of named parameters holding arbitrary data. Read more [here](#custom).
+
+### Scope
+
+Annotations can be defined at the rule or package level. The `scope` annotation in
+a metadata block determines how that metadata block will be applied. If the
+`scope` field is omitted, it defaults to the scope for the statement that
+immediately follows the annotation. The `scope` values that are currently
+supported are:
+
+* `rule` - applies to the individual rule statement (within the same file). Default, when metadata block precedes rule.
+* `document` - applies to all of the rules with the same name in the same package (across multiple files)
+* `package` - applies to all of the rules in the package (across multiple files). Default, when metadata block precedes package.
+* `subpackages` - applies to all of the rules in the package and all subpackages (recursively, across multiple files)
+
+Since the `document` scope annotation applies to all rules with the same name in the same package
+and the `package` and `subpackages` scope annotations apply to all packages with a matching path, metadata blocks with
+these scopes are applied over all files with applicable package- and rule paths.
+As there is no ordering across files in the same package, the `document`, `package`, and `subpackages` scope annotations
+can only be specified **once** per path.
+The `document` scope annotation can be applied to any rule in the set (i.e., ordering does not matter.)
+
+#### Example
+
+```live:rego/metadata/scope:module:read_only
+# METADATA
+# scope: document
+# description: A set of rules that determines if x is allowed.
+
+# METADATA
+# title: Allow Ones
+allow {
+    x == 1
+}
+
+# METADATA
+# title: Allow Twos
+allow {
+    x == 2
+}
+```
+
+### Title
+
+The `title` annotation is a string value giving a human-readable name to the annotation target.
+
+#### Example
+
+```live:rego/metadata/title:module:read_only
+# METADATA
+# title: Allow Ones
+allow {
+  x == 1
+}
+
+# METADATA
+# title: Allow Twos
+allow {
+  x == 2
+}
+```
+
+### Description
+
+The `description` annotation is a string value describing the annotation target, such as its purpose.
+
+#### Example
+
+```live:rego/metadata/description:module:read_only
+# METADATA
+# description: |
+#  The 'allow' rule...
+#  Is about allowing things.
+#  Not denying them.
+allow {
+  ...
+}
+```
+
+### Related Resources
+
+The `related_resources` annotation is a list of _related-resource_ entries, where each links to some related external resource; such as RFCs and other reading material.
+A _related-resource_ entry can either be an object or a short-form string holding a single URL.
+
+#### Object Related-resource Format
+
+When a _related-resource_ entry is presented as an object, it has two fields:
+
+* `ref`: a URL pointing to the resource (required).
+* `description`: a text describing the resource.
+
+#### String Related-resource Format
+
+When a _related-resource_ entry is presented as a string, it needs to be a valid URL.
+
+#### Examples
+
+```live:rego/metadata/related_resources1:module:read_only
+# METADATA
+# related_resources:
+# - ref: https://example.com
+# ...
+# - ref: https://example.com/foo
+#   description: A text describing this resource
+allow {
+  ...
+}
+```
+
+```live:rego/metadata/related_resources2:module:read_only
+# METADATA
+# related_resources:
+# - https://example.com/foo
+# ...
+# - https://example.com/bar
+allow {
+  ...
+}
+```
+
+### Authors
+
+The `authors` annotation is a list of author entries, where each entry denotes an _author_.
+An _author_ entry can either be an object or a short-form string.
+
+#### Object Author Format
+
+When an _author_ entry is presented as an object, it has two fields:
+
+* `name`: the name of the author
+* `email`: the email of the author
+
+At least one of the above fields are required for a valid `author` entry.
+
+#### String Author Format
+
+When an _author_ entry is presented as a string, it has the format `{ name } [ "<" email ">"]`;
+where the name of the author is a sequence of whitespace-separated words.
+Optionally, the last word may represent an email, if enclosed with `<>`.
+
+#### Examples
+
+```live:rego/metadata/authors1:module:read_only
+# METADATA
+# authors:
+# - name: John Doe
+# ...
+# - name: Jane Doe
+#   email: jane@example.com
+allow {
+  ...
+}
+```
+
+```live:rego/metadata/authors2:module:read_only
+# METADATA
+# authors:
+# - John Doe
+# ...
+# - Jane Doe <jane@example.com>
+allow {
+  ...
+}
+```
+
+### Organizations
+
+The `organizations` annotation is a list of string values representing the organizations associated with the annotation target.
+
+#### Example
+
+```live:rego/metadata/organizations:module:read_only
+# METADATA
+# organizations:
+# - Acme Corp.
+# ...
+# - Tyrell Corp.
+allow {
+  ...
+}
+```
+
+### Schemas
+
+The `schemas` annotation is a list of key value pairs, associating schemas to data values.
+In-depth information on this topic can be found [here](../schemas#schema-annotations).
+
+#### Schema Reference Format
+
+Schema files can be referenced by path, where each path starts with the `schema` namespace, and trailing components specify
+the path of the schema file (sans file-ending) relative to the root directory specified by the `--schema` flag on applicable commands.
+If the `--schema` flag is not present, referenced schemas are ignored during type checking.
+
+```live:rego/metadata/schemas_ref:module:read_only
+# METADATA
+# schemas:
+#   - input: schema.input
+#   - data.acl: schema["acl-schema"]
+allow {
+    access := data.acl["alice"]
+    access[_] == input.operation
+}
+```
+
+#### Inlined Schema Format
+
+Schema definitions can be inlined by specifying the schema structure as a YAML or JSON map.
+Inlined schemas are always used to inform type checking for the `eval`, `check`, and `test` commands;
+in contrast to [by-reference schema annotations](#schema-reference-format), which require the `--schema` flag to be present in order to be evaluated.
+
+```live:rego/metadata/schemas_inline:module:read_only
+# METADATA
+# schemas:
+#   - input.x: {type: number}
+allow {
+    input.x == 42
+}
+```
+
+### Entrypoint
+
+The `entrypoint` annotation is a boolean used to mark rules and packages that should be used as entrypoints for a policy.
+This value is false by default, and can only be used at `rule` or `package` scope.
+
+The `build` and `eval` CLI commands will automatically pick up annotated entrypoints; you do not have to specify them with
+[`--entrypoint`](../cli/#options-1).
+
+{{< info >}}
+Unless the `--prune-unused` flag is used, any rule transitively referring to a
+package or rule declared as an entrypoint will also be enumerated as an entrypoint.
+{{< /info >}}
+
+### Custom
+
+The `custom` annotation is a mapping of user-defined data, mapping string keys to arbitrarily typed values.
+
+#### Example
+
+```live:rego/metadata/custom:module:read_only
+# METADATA
+# custom:
+#  my_int: 42
+#  my_string: Some text
+#  my_bool: true
+#  my_list:
+#   - a
+#   - b
+#  my_map:
+#   a: 1
+#   b: 2
+allow {
+  ...
+}
+```
+
+### Accessing annotations
+
+#### Rego
+
+In the example below, you can see how to access an annotation from within a policy.
+
+Given the input:
+
+```live:example/metadata/1:input
+{
+    "number": 11,
+    "subject": {
+        "name": "John doe",
+        "role": "customer"
+    }
+}
+```
+
+The following policy
+
+```live:example/metadata/1:module
+package example
+
+# METADATA
+# title: Deny invalid numbers
+# description: Numbers may not be higher than 5
+# custom:
+#  severity: MEDIUM
+output := decision {
+ input.number > 5
+
+ annotation := rego.metadata.rule()
+ decision := {
+  "severity": annotation.custom.severity,
+  "message": annotation.description,
+ }
+}
+```
+
+will output
+
+```live:example/metadata/1:output
+```
+
+If you'd like more examples and information on this, you can see more here under the [Rego](../policy-reference/#rego) policy reference.
+
+#### Inspect command
+
+Annotations can be listed through the `inspect` command by using the `-a` flag:
+
+```shell
+opa inspect -a
+```
+
+#### Go API
+
+The ``ast.AnnotationSet`` is a collection of all ``ast.Annotations`` declared in a set of modules.
+An ``ast.AnnotationSet`` can be created from a slice of compiled modules:
+
+```go
+var modules []*ast.Module
+...
+as, err := ast.BuildAnnotationSet(modules)
+if err != nil {
+    // Handle error.
+}
+```
+
+or can be retrieved from an ``ast.Compiler`` instance:
+
+```go
+var modules []*ast.Module
+...
+compiler := ast.NewCompiler()
+compiler.Compile(modules)
+as := compiler.GetAnnotationSet()
+```
+
+The ``ast.AnnotationSet`` can be flattened into a slice of ``ast.AnnotationsRef``, which is a complete, sorted list of all
+annotations, grouped by the path and location of their targeted package or -rule.
+
+```go
+flattened := as.Flatten()
+for _, entry := range flattened {
+    fmt.Printf("%v at %v has annotations %v\n",
+        entry.Path,
+        entry.Location,
+        entry.Annotations)
+}
+
+// Output:
+// data.foo at foo.rego:5 has annotations {"scope":"subpackages","organizations":["Acme Corp."]}
+// data.foo.bar at mod:3 has annotations {"scope":"package","description":"A couple of useful rules"}
+// data.foo.bar.p at mod:7 has annotations {"scope":"rule","title":"My Rule P"}
+//
+// For modules:
+// # METADATA
+// # scope: subpackages
+// # organizations:
+// # - Acme Corp.
+// package foo
+// ---
+// # METADATA
+// # description: A couple of useful rules
+// package foo.bar
+// 
+// # METADATA
+// # title: My Rule P
+// p := 7
+```
+
+Given an ``ast.Rule``, the ``ast.AnnotationSet`` can return the chain of annotations declared for that rule, and its path ancestry.
+The returned slice is ordered starting with the annotations for the rule, going outward to the farthest node with declared annotations
+in the rule's path ancestry.
+
+```go
+var rule *ast.Rule
+...
+chain := ast.Chain(rule)
+for _, link := range chain {
+    fmt.Printf("link at %v has annotations %v\n",
+        link.Path,
+        link.Annotations)
+}
+
+// Output:
+// data.foo.bar.p at mod:7 has annotations {"scope":"rule","title":"My Rule P"}
+// data.foo.bar at mod:3 has annotations {"scope":"package","description":"A couple of useful rules"}
+// data.foo at foo.rego:5 has annotations {"scope":"subpackages","organizations":["Acme Corp."]}
+//
+// For modules:
+// # METADATA
+// # scope: subpackages
+// # organizations:
+// # - Acme Corp.
+// package foo
+// ---
+// # METADATA
+// # description: A couple of useful rules
+// package foo.bar
+// 
+// # METADATA
+// # title: My Rule P
+// p := 7
+```
+
+## Schema
+
+### Using schemas to enhance the Rego type checker
+
+You can provide one or more input schema files and/or data schema files to `opa eval` to improve static type checking and get more precise error reports as you develop Rego code.
+
+The `-s` flag can be used to upload schemas for input and data documents in JSON Schema format. You can either load a single JSON schema file for the input document or directory of schema files.
+
+```
+-s, --schema string set schema file path or directory path
+```
+
+#### Passing a single file with -s
+
+When a single file is passed, it is a schema file associated with the input document globally. This means that for all rules in all packages, the `input` has a type derived from that schema. There is no constraint on the name of the file, it could be anything.
+
+Example:
+
+```
+opa eval data.envoy.authz.allow -i opa-schema-examples/envoy/input.json -d opa-schema-examples/envoy/policy.rego -s opa-schema-examples/envoy/schemas/my-schema.json
+```
+
+#### Passing a directory with -s
+
+When a directory path is passed, annotations will be used in the code to indicate what expressions map to what schemas (see below).
+Both input schema files and data schema files can be provided in the same directory, with different names. The directory of schemas may have any sub-directories. Notice that when a directory is passed the input document does not have a schema associated with it globally. This must also
+be indicated via an annotation.
+
+Example:
+
+```
+opa eval data.kubernetes.admission -i opa-schema-examples/kubernetes/input.json -d opa-schema-examples/kubernetes/policy.rego -s opa-schema-examples/kubernetes/schemas
+
+```
+
+Schemas can also be provided for policy and data files loaded via `opa eval --bundle`
+
+Example:
+
+```
+opa eval data.kubernetes.admission -i opa-schema-examples/kubernetes/input.json -b opa-schema-examples/bundle.tar.gz -s opa-schema-examples/kubernetes/schemas
+
+```
+
+Samples provided at: <https://github.com/aavarghese/opa-schema-examples/>
+
+### Usage scenario with a single schema file
+
+Consider the following Rego code, which assumes as input a Kubernetes admission review. For resources that are Pods, it checks that the image name
+starts with a specific prefix.
+
+`pod.rego`
+
+```
+package kubernetes.admission
+
+deny[msg] {
+    input.request.kind.kinds == "Pod"
+    image := input.request.object.spec.containers[_].image
+    not startswith(image, "hooli.com/")
+    msg := sprintf("image '%v' comes from untrusted registry", [image])
+}
+```
+
+Notice that this code has a typo in it: `input.request.kind.kinds` is undefined and should have been `input.request.kind.kind`.
+
+Consider the following input document:
+
+`input.json`
+
+```
+{
+    "kind": "AdmissionReview",
+    "request": {
+      "kind": {
+        "kind": "Pod",
+        "version": "v1"
+      },
+      "object": {
+        "metadata": {
+          "name": "myapp"
+        },
+        "spec": {
+          "containers": [
+            {
+              "image": "nginx",
+              "name": "nginx-frontend"
+            },
+            {
+              "image": "mysql",
+              "name": "mysql-backend"
+            }
+          ]
+        }
+      }
+    }
+  }
+  ```
+
+Clearly there are 2 image names that are in violation of the policy. However, when we evaluate the erroneous Rego code against this input we obtain:
+
+  ```
+  % opa eval data.kubernetes.admission --format pretty -i opa-schema-examples/kubernetes/input.json -d opa-schema-examples/kubernetes/policy.rego
+  []
+  ```
+
+The empty value returned is indistinguishable from a situation where the input did not violate the policy. This error is therefore causing the policy not to catch violating inputs appropriately.
+
+If we fix the Rego code and change `input.request.kind.kinds` to `input.request.kind.kind`, then we obtain the expected result:
+
+  ```
+  [
+  "image 'nginx' comes from untrusted registry",
+  "image 'mysql' comes from untrusted registry"
+  ]
+  ```
+
+With this feature, it is possible to pass a schema to `opa eval`, written in JSON Schema. Consider the admission review schema provided at:
+<https://github.com/aavarghese/opa-schema-examples/blob/main/kubernetes/schemas/input.json>
+
+We can pass this schema to the evaluator as follows:
+
+  ```
+  % opa eval data.kubernetes.admission --format pretty -i opa-schema-examples/kubernetes/input.json -d opa-schema-examples/kubernetes/policy.rego -s opa-schema-examples/kubernetes/schemas/input.json
+  ```
+
+With the erroneous Rego code, we now obtain the following type error:
+
+  ```
+  1 error occurred: ../../aavarghese/opa-schema-examples/kubernetes/policy.rego:5: rego_type_error: undefined ref: input.request.kind.kinds
+ input.request.kind.kinds
+                    ^
+                    have: "kinds"
+                    want (one of): ["kind" "version"]
+  ```
+
+This indicates the error to the Rego developer right away, without having the need to observe the results of runs on actual data, thereby improving productivity.
+
+### Schema annotations
+
+When passing a directory of schemas to `opa eval`, schema annotations become handy to associate a Rego expression with a corresponding schema within a given scope:
+
+```
+# METADATA
+# schemas:
+#   - <path-to-value>:<path-to-schema>
+#   ...
+#   - <path-to-value>:<path-to-schema>
+allow {
+  ...
+}
+```
+
+See the [annotations documentation](../annotations) for general information relating to annotations.
+
+The `schemas` field specifies an array associating schemas to data values. Paths must start with `input` or `data` (i.e., they must be fully-qualified.)
+
+The type checker derives a Rego Object type for the schema and an appropriate entry is added to the type environment before type checking the rule. This entry is removed upon exit from the rule.
+
+Example:
+
+Consider the following Rego code which checks if an operation is allowed by a user, given an ACL data document:
+
+```
+package policy
+
+import data.acl
+
+default allow := false
+
+# METADATA
+# schemas:
+#   - input: schema.input
+#   - data.acl: schema["acl-schema"]
+allow {
+    access := data.acl["alice"]
+    access[_] == input.operation
+}
+
+allow {
+    access := data.acl["bob"]
+    access[_] == input.operation
+}
+```
+
+Consider a directory named `mySchemasDir` with the following structure, provided via `opa eval --schema opa-schema-examples/mySchemasDir`
+
+```$ tree mySchemasDir/
+mySchemasDir/
+├── input.json
+└── acl-schema.json
+```
+
+For actual code samples, see <https://github.com/aavarghese/opa-schema-examples/tree/main/acl>.
+
+In the first `allow` rule above, the input document has the schema `input.json`, and `data.acl` has the schema `acl-schema.json`. Note that we use the relative path inside the `mySchemasDir` directory to identify a schema, omit the `.json` suffix, and use the global variable `schema` to stand for the top-level of the directory.
+Schemas in annotations are proper Rego references. So `schema.input` is also valid, but `schema.acl-schema` is not.
+
+If we had the expression `data.acl.foo` in this rule, it would result in a type error because the schema contained in `acl-schema.json` only defines object properties `"alice"` and `"bob"` in the ACL data document.
+
+On the other hand, this annotation does not constrain other paths under `data`. What it says is that we know the type of `data.acl` statically, but not that of other paths. So for example, `data.foo` is not a type error and gets assigned the type `Any`.
+
+Note that the second `allow` rule doesn't have a METADATA comment block attached to it, and hence will not be type checked with any schemas.
+
+On a different note, schema annotations can also be added to policy files part of a bundle package loaded via `opa eval --bundle` along with the `--schema` parameter for type checking a set of `*.rego` policy files.
+
+The _scope_ of the `schema` annotation can be controlled through the [scope](../annotations#scope) annotation
+
+In case of overlap, schema annotations override each other as follows:
+
+```
+rule overrides document
+document overrides package
+package overrides subpackages
+```
+
+The following sections explain how the different scopes affect `schema` annotation
+overriding for type checking.
+
+#### Rule and Document Scopes
+
+In the example above, the second rule does not include an annotation so type
+checking of the second rule would not take schemas into account. To enable type
+checking on the second (or other rules in the same file) we could specify the
+annotation multiple times:
+
+```
+# METADATA
+# scope: rule
+# schemas:
+#   - input: schema.input
+#   - data.acl: schema["acl-schema"]
+allow {
+    access := data.acl["alice"]
+    access[_] == input.operation
+}
+
+# METADATA
+# scope: rule
+# schemas:
+#   - input: schema.input
+#   - data.acl: schema["acl-schema"]
+allow {
+    access := data.acl["bob"]
+    access[_] == input.operation
+}
+```
+
+This is obviously redundant and error-prone. To avoid this problem, we can
+define the annotation once on a rule with scope `document`:
+
+```
+# METADATA
+# scope: document
+# schemas:
+#   - input: schema.input
+#   - data.acl: schema["acl-schema"]
+allow {
+    access := data.acl["alice"]
+    access[_] == input.operation
+}
+
+allow {
+    access := data.acl["bob"]
+    access[_] == input.operation
+}
+```
+
+In this example, the annotation with `document` scope has the same affect as the
+two `rule` scoped annotations in the previous example.
+
+#### Package and Subpackage Scopes
+
+Annotations can be defined at the `package` level and then applied to all rules
+within the package:
+
+```
+# METADATA
+# scope: package
+# schemas:
+#   - input: schema.input
+#   - data.acl: schema["acl-schema"]
+package example
+
+allow {
+    access := data.acl["alice"]
+    access[_] == input.operation
+}
+
+allow {
+    access := data.acl["bob"]
+    access[_] == input.operation
+}
+```
+
+`package` scoped schema annotations are useful when all rules in the same
+package operate on the same input structure. In some cases, when policies are
+organized into many sub-packages, it is useful to declare schemas recursively
+for them using the `subpackages` scope. For example:
+
+```
+# METADTA
+# scope: subpackages
+# schemas:
+# - input: schema.input
+package kubernetes.admission
+```
+
+This snippet would declare the top-level schema for `input` for the
+`kubernetes.admission` package as well as all subpackages. If admission control
+rules were defined inside packages like `kubernetes.admission.workloads.pods`,
+they would be able to pick up that one schema declaration.
+
+### Overriding
+
+JSON Schemas are often incomplete specifications of the format of data. For example, a Kubernetes Admission Review resource has a field `object` which can contain any other Kubernetes resource. A schema for Admission Review has a generic type `object` for that field that has no further specification. To allow more precise type checking in such cases, we support overriding existing schemas.
+
+Consider the following example:
+
+```
+package kubernetes.admission
+
+# METADATA
+# scope: rule
+# schemas:
+# - input: schema.input
+# - input.request.object: schema.kubernetes.pod
+deny[msg] {
+    input.request.kind.kind == "Pod"
+    image := input.request.object.spec.containers[_].image
+    not startswith(image, "hooli.com/")
+    msg := sprintf("image '%v' comes from untrusted registry", [image])
+}
+```
+
+In this example, the `input` is associated with an Admission Review schema, and furthermore `input.request.object` is set to have the schema of a Kubernetes Pod. In effect, the second schema annotation overrides the first one. Overriding is a schema transformation feature and combines existing schemas. In this case, we are combining the Admission Review schema with that of a Pod.
+
+Notice that the order of schema annotations matter for overriding to work correctly.
+
+Given a schema annotation, if a prefix of the path already has a type in the environment, then the annotation has the effect of merging and overriding the existing type with the type derived from the schema. In the example above, the prefix `input` already has a type in the type environment, so the second annotation overrides this existing type. Overriding affects the type of the longest prefix that already has a type. If no such prefix exists, the new path and type are added to the type environment for the scope of the rule.
+
+In general, consider the existing Rego type:
+
+```
+object{a: object{b: object{c: C, d: D, e: E}}}
+```
+
+If we override this type with the following type (derived from a schema annotation of the form `a.b.e: schema-for-E1`):
+
+```
+object{a: object{b: object{e: E1}}}
+```
+
+It results in the following type:
+
+```
+object{a: object{b: object{c: C, d: D, e: E1}}}
+```
+
+Notice that `b` still has its fields `c` and `d`, so overriding has a merging effect as well. Moreover, the type of expression `a.b.e` is now `E1` instead of `E`.
+
+We can also use overriding to add new paths to an existing type, so if we override the initial type with the following:
+
+```
+object{a: object{b: object{f: F}}}
+```
+
+we obtain the following type:
+
+```
+object{a: object{b: object{c: C, d: D, e: E, f: F}}}
+```
+
+We use schemas to enhance the type checking capability of OPA, and not to validate the input and data documents against desired schemas. This burden is still on the user and care must be taken when using overriding to ensure that the input and data provided are sensible and validated against the transformed schemas.
+
+### Multiple input schemas
+
+It is sometimes useful to have different input schemas for different rules in the same package. This can be achieved as illustrated by the following example:
+
+```
+package policy
+
+import data.acl
+
+default allow := false
+
+# METADATA
+# scope: rule
+# schemas:
+#  - input: schema["input"]
+#  - data.acl: schema["acl-schema"]
+allow {
+    access := data.acl[input.user]
+    access[_] == input.operation
+}
+
+# METADATA for whocan rule
+# scope: rule
+# schemas:
+#   - input: schema["whocan-input-schema"]
+#   - data.acl: schema["acl-schema"]
+whocan[user] {
+    access := acl[user]
+    access[_] == input.operation
+}
+```
+
+The directory that is passed to `opa eval` is the following:
+
+```$ tree mySchemasDir/
+mySchemasDir/
+├── input.json
+└── acl-schema.json
+└── whocan-input-schema.json
+```
+
+In this example, we associate the schema `input.json` with the input document in the rule `allow`, and the schema `whocan-input-schema.json`
+with the input document for the rule `whocan`.
+
+### Translating schemas to Rego types and dynamicity
+
+Rego has a gradual type system meaning that types can be partially known statically. For example, an object could have certain fields whose types are known and others that are unknown statically. OPA type checks what it knows statically and leaves the unknown parts to be type checked at runtime. An OPA object type has two parts: the static part with the type information known statically, and a dynamic part, which can be nil (meaning everything is known statically) or non-nil and indicating what is unknown.
+
+When we derive a type from a schema, we try to match what is known and unknown in the schema. For example, an `object` that has no specified fields becomes the Rego type `Object{Any: Any}`. However, currently `additionalProperties` and `additionalItems` are ignored. When a schema is fully specified, we derive a type with its dynamic part set to nil, meaning that we take a strict interpretation in order to get the most out of static type checking. This is the case even if `additionalProperties` is set to `true` in the schema. In the future, we will take this feature into account when deriving Rego types.
+
+When overriding existing types, the dynamicity of the overridden prefix is preserved.
+
+### Supporting JSON Schema composition keywords
+
+JSON Schema provides keywords such as `anyOf` and `allOf` to structure a complex schema. For `anyOf`, at least one of the subschemas must be true, and for `allOf`, all subschemas must be true. The type checker is able to identify such keywords and derive a more robust Rego type through more complex schemas.
+
+#### `anyOf`
+
+Specifically, `anyOf` acts as an Rego Or type where at least one (can be more than one) of the subschemas is true. Consider the following Rego and schema file containing `anyOf`:
+
+`policy-anyOf.rego`
+
+```
+package kubernetes.admission
+
+# METADATA
+# scope: rule
+# schemas:
+#   - input: schema["input-anyOf"]
+deny {
+    input.request.servers.versions == "Pod"
+}
+```
+
+`input-anyOf.json`
+
+```
+{
+    "$schema": "http://json-schema.org/draft-07/schema",
+    "type": "object",
+    "properties": {
+        "kind": {"type": "string"},
+        "request": {
+            "type": "object",
+            "anyOf": [
+                {
+                   "properties": {
+                       "kind": {
+                           "type": "object",
+                           "properties": {
+                               "kind": {"type": "string"},
+                               "version": {"type": "string" }
+                           }
+                       }
+                   }
+                },
+                {
+                   "properties": {
+                       "server": {
+                           "type": "object",
+                           "properties": {
+                               "accessNum": {"type": "integer"},
+                               "version": {"type": "string"}
+                           }
+                       }
+                   }
+                }
+            ]
+        }
+    }
+}
+
+```
+
+We can see that `request` is an object with two options as indicated by the choices under `anyOf`:
+
+* contains property `kind`, which has properties `kind` and `version`
+* contains property `server`, which has properties `accessNum` and `version`
+
+The type checker finds the first error in the Rego code, suggesting that `servers` should be either `kind` or `server`.
+
+```
+ input.request.servers.versions
+               ^
+               have: "servers"
+               want (one of): ["kind" "server"]
+```
+
+Once this is fixed, the second typo is highlighted, prompting the user to choose between `accessNum` and `version`.
+
+```
+ input.request.server.versions
+                      ^
+                      have: "versions"
+                      want (one of): ["accessNum" "version"]
+```
+
+#### `allOf`
+
+Specifically, `allOf` keyword implies that all conditions under `allOf` within a schema must be met by the given data. `allOf` is implemented through merging the types from all of the JSON subSchemas listed under `allOf` before parsing the result to convert it to a Rego type. Merging of the JSON subSchemas essentially combines the passed in subSchemas based on what types they contain. Consider the following Rego and schema file containing `allOf`:
+
+`policy-allOf.rego`
+
+```
+package kubernetes.admission
+
+# METADATA
+# scope: rule
+# schemas:
+#   - input: schema["input-allof"]
+deny {
+    input.request.servers.versions == "Pod"
+}
+```
+
+`input-allof.json`
+
+```
+{
+    "$schema": "http://json-schema.org/draft-07/schema",
+    "type": "object",
+    "properties": {
+        "kind": {"type": "string"},
+        "request": {
+            "type": "object",
+            "allOf": [
+                {
+                   "properties": {
+                       "kind": {
+                           "type": "object",
+                           "properties": {
+                               "kind": {"type": "string"},
+                               "version": {"type": "string" }
+                           }
+                       }
+                   }
+                },
+                {
+                   "properties": {
+                       "server": {
+                           "type": "object",
+                           "properties": {
+                               "accessNum": {"type": "integer"},
+                               "version": {"type": "string"}
+                           }
+                       }
+                   }
+                }
+            ]
+        }
+    }
+}
+
+```
+
+We can see that `request` is an object with properties as indicated by the elements listed under `allOf`:
+
+* contains property `kind`, which has properties `kind` and `version`
+* contains property `server`, which has properties `accessNum` and `version`
+
+The type checker finds the first error in the Rego code, suggesting that `servers` should be `server`.
+
+```
+ input.request.servers.versions
+               ^
+               have: "servers"
+               want (one of): ["kind" "server"]
+```
+
+Once this is fixed, the second typo is highlighted, informing the user that `versions` should be one of `accessNum` or `version`.
+
+```
+ input.request.server.versions
+                      ^
+                      have: "versions"
+                      want (one of): ["accessNum" "version"]
+```
+
+Because the properties `kind`, `version`, and `accessNum` are all under the `allOf` keyword, the resulting schema that the given data must be validated against will contain the types contained in these properties children (string and integer).
+
+### Remote references in JSON schemas
+
+It is valid for JSON schemas to reference other JSON schemas via URLs, like this:
+
+```json
+{
+  "description": "Pod is a collection of containers that can run on a host.",
+  "type": "object",
+  "properties": {
+    "metadata": {
+      "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
+      "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+    }
+  }
+}
+```
+
+OPA's type checker will fetch these remote references by default.
+To control the remote hosts schemas will be fetched from, pass a capabilities
+file to your `opa eval` or `opa check` call.
+
+Starting from the capabilities.json of your OPA version (which can be found [in the
+repository](https://github.com/open-policy-agent/opa/tree/main/capabilities)), add
+an `allow_net` key to it: its values are the IP addresses or host names that OPA is
+supposed to connect to for retrieving remote schemas.
+
+```json
+{
+  "builtins": [ ... ],
+  "allow_net": [ "kubernetesjsonschema.dev" ]
+}
+```
+
+#### Note
+
+* To forbid all network access in schema checking, set `allow_net` to `[]`
+* Host names are checked against the list as-is, so adding `127.0.0.1` to `allow_net`,
+  and referencing a schema from `http://localhost/` will _fail_.
+* Metaschemas for different JSON Schema draft versions are not subject to this
+  constraint, as they are already provided by OPA's schema checker without requiring
+  network access. These are:
+
+  * `http://json-schema.org/draft-04/schema`
+  * `http://json-schema.org/draft-06/schema`
+  * `http://json-schema.org/draft-07/schema`
+
+### Limitations
+
+Currently this feature admits schemas written in JSON Schema but does not support every feature available in this format.
+In particular the following features are not yet supported:
+
+* additional properties for objects
+* pattern properties for objects
+* additional items for arrays
+* contains for arrays
+* oneOf, not
+* enum
+* if/then/else
+
+A note of caution: overriding is a powerful capability that must be used carefully. For example, the user is allowed to write:
+
+```
+# METADATA
+# scope: rule
+# schema:
+#  - data: schema["some-schema"]
+```
+
+In this case, we are overriding the root of all documents to have some schema. Since all Rego code lives under `data` as virtual documents, this in practice renders all of them inaccessible (resulting in type errors). Similarly, assigning a schema to a package name is not a good idea and can cause problems. Care must also be taken when defining overrides so that the transformation of schemas is sensible and data can be validated against the transformed schema.
+
+### References
+
+For more examples, please see <https://github.com/aavarghese/opa-schema-examples>
+
+This contains samples for Envoy, Kubernetes, and Terraform including corresponding JSON Schemas.
+
+For a reference on JSON Schema please see: <http://json-schema.org/understanding-json-schema/reference/index.html>
+
+For a tool that generates JSON Schema from JSON samples, please see: <https://jsonschema.net/home>
+
+## Strict Mode
+
+The Rego compiler supports `strict mode`, where additional constraints and safety checks are enforced during compilation.
+Compiler rules that will be enforced by future versions of OPA, but will be a breaking change once introduced, are incubated in strict mode.
+This creates an opportunity for users to verify that their policies are compatible with the next version of OPA before upgrading.
+
+Compiler Strict mode is supported by the `check` command, and can be enabled through the `-S` flag.
+
+```
+-S, --strict enable compiler strict mode
+```
+
+### Strict Mode Constraints and Checks
+
+Name | Description                                                                                                                                                                                                                                                    | Enforced by default in OPA version
+--- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ---
+Duplicate imports | Duplicate [imports](../policy-language/#imports), where one import shadows another, are prohibited.                                                                                                                                                            | 1.0
+Unused local assignments | Unused arguments or [assignments](../policy-reference/#assignment-and-equality) local to a rule, function or comprehension are prohibited                                                                                                                                   | 1.0
+Unused imports | Unused [imports](../policy-language/#imports) are prohibited.                                                                                                                                                                                                  | 1.0
+`input` and `data` reserved keywords | `input` and `data` are reserved keywords, and may not be used as names for rules and variable assignment.                                                                                                                                                      | 1.0
+Use of deprecated built-ins | Use of deprecated functions is prohibited, and these will be removed in OPA 1.0. Deprecated built-in functions: `any`, `all`, `re_match`,  `net.cidr_overlap`, `set_diff`, `cast_array`, `cast_set`, `cast_string`, `cast_boolean`, `cast_null`, `cast_object` | 1.0
diff --git a/docs/content/policy-performance.md b/docs/content/policy-performance.md
index 2f9eadbd67..127895215c 100644
--- a/docs/content/policy-performance.md
+++ b/docs/content/policy-performance.md
@@ -68,7 +68,7 @@ Here is an example policy from the [rule-indexing blog](https://blog.openpolicya
 ```live:indexed:module:openable
 package indexed
 
-default allow = false
+default allow := false
 
 allow {
     some user
@@ -132,7 +132,6 @@ For `glob.match(pattern, delimiter, match)` statements to be indexed the pattern
 | `glob.match("foo:**:bar", [":"], input.x)` | no | pattern contains `**` |
 | `glob.match("foo:*:bar", [":"], input.x[i])` | no | match contains variable(s) |
 
-
 ### Early Exit in Rule Evaluation
 
 In general, OPA has to iterate all potential variable bindings to determine the outcome
@@ -168,31 +167,37 @@ package earlyexit.examples
 # p, q, r and s could be evaluated with early-exit semantics:
 
 p {
-  # ...
+    # ...
 }
-q = 123 {
-  # ...
+
+q := 123 {
+    # ...
 }
-r = {"hello": "world"} {
-  # ...
+
+r := {"hello": "world"} {
+    # ...
 }
-s(x) = 12 {
-  # ...
+
+s(x) := 12 {
+    # ...
 }
 
 # u, v, w, and y could _not_
 
 u[x] { # not a complete document rule, but a partial set
-  x := 911
+    x := 911
 }
-v = x { # x is a variable, not ground
-  x := true
+
+v := x { # x is a variable, not ground
+    x := true
 }
-w = { "foo": x } { # a compound term containing a variable
-  x := "bar"
+
+w := { "foo": x } { # a compound term containing a variable
+    x := "bar"
 }
-y(z) = r { # variable value, not ground
-  r := z + 1
+
+y(z) := r { # variable value, not ground
+    r := z + 1
 }
 ```
 
@@ -212,9 +217,9 @@ Since there's no possibility that could change the outcome of `data.earlyexit.it
 once a variable binding is found that satisfies the conditions, no further iteration will
 occur.
 
-The check if "early exit" is applicable for a query happens _after_ the indexing lookup,
-so in this contrived example, an evaluation with input `{"user": "alice"}` _would_ exit
-early; an evaluation with `{"user": "bob", "group": "admins"}` _would not_:
+The check if "early exit" is applicable for a query happens *after* the indexing lookup,
+so in this contrived example, an evaluation with input `{"user": "alice"}` *would* exit
+early; an evaluation with `{"user": "bob", "group": "admins"}` *would not*:
 
 ```live:eeindex:module:read_only
 package earlyexit
@@ -231,7 +236,7 @@ allow {
 ```
 
 This is because the index lookup for `{"user": "bob", "group": "admins"}` returns two complete
-document rules with _different values_, `true` and `false`, whereas the indexer query for
+document rules with *different values*, `true` and `false`, whereas the indexer query for
 `{"user": "alice"}` only returns rules with value `true`.
 
 ### Comprehension Indexing
@@ -294,25 +299,25 @@ ports := [port | some j; input.exposed[j].interface == intf; port := input.expos
 
 Without comprehension indexing, this query would be O(n^2) where n is the size of `input.exposed`.
 However, with comprehension indexing, the query remains O(n) because OPA only computes the comprehension
-_once_. In this case, the comprehension is evaluated and all possible values of `ports` are computed
+*once*. In this case, the comprehension is evaluated and all possible values of `ports` are computed
 at once. These values are indexed by the assignments of `intf`.
 
 To implement the policy above we could write:
 
 ```rego
 deny[msg] {
-  some i
-  count(exposed_ports_by_interface[i]) > 100
-  msg := sprintf("interface '%v' exposes too many ports", [i])
+    some i
+    count(exposed_ports_by_interface[i]) > 100
+    msg := sprintf("interface '%v' exposes too many ports", [i])
 }
 
 exposed_ports_by_interface := {intf: ports |
-  some i
-  intf := input.exposed[i].interface
-  ports := [port |
-    some j
-    input.exposed[j].interface == intf
-    port := input.exposed[j].port
+    some i
+    intf := input.exposed[i].interface
+    ports := [port |
+        some j
+        input.exposed[j].interface == intf
+        port := input.exposed[j].port
   ]
 }
 ```
@@ -377,29 +382,70 @@ not_indexed_because_nested_closure {
 
 ### Profiling
 
-You can also _profile_ your policies using `opa eval`. The profiler is useful if you need to understand
+You can also *profile* your policies using `opa eval`. The profiler is useful if you need to understand
 why policy evaluation is slow.
 
 The `opa eval` command provides the following profiler options:
 
-| Option | Detail | Default |
-| --- | --- | --- |
-| <span class="opa-keep-it-together">`--profile`</span> | Enables expression profiling and outputs profiler results. | off |
-| <span class="opa-keep-it-together">`--profile-sort`</span> | Criteria to sort the expression profiling results. This options implies `--profile`. | total_time_ns => num_eval => num_redo => file => line |
-| <span class="opa-keep-it-together">`--profile-limit`</span> | Desired number of profiling results sorted on the given criteria. This options implies `--profile`. | 10 |
-| <span class="opa-keep-it-together">`--count`</span> | Desired number of evaluations that profiling metrics are to be captured for. With `--format=pretty`, the output will contain min, max, mean and the 90th and 99th percentile. All collected percentiles can be found in the JSON output. | 1 |
+| Option | Detail | Default                                                               |
+| --- | --- |-----------------------------------------------------------------------|
+| <span class="opa-keep-it-together">`--profile`</span> | Enables expression profiling and outputs profiler results. | off                                                                   |
+| <span class="opa-keep-it-together">`--profile-sort`</span> | Criteria to sort the expression profiling results. This options implies `--profile`. | total_time_ns => num_eval => num_redo => num_gen_expr => file => line |
+| <span class="opa-keep-it-together">`--profile-limit`</span> | Desired number of profiling results sorted on the given criteria. This options implies `--profile`. | 10                                                                    |
+| <span class="opa-keep-it-together">`--count`</span> | Desired number of evaluations that profiling metrics are to be captured for. With `--format=pretty`, the output will contain min, max, mean and the 90th and 99th percentile. All collected percentiles can be found in the JSON output. | 1                                                                     |
 
 #### Sort criteria for the profile results
 
-  * `total_time_ns` - Results are displayed is decreasing order of _expression evaluation time_
-  * `num_eval`  - Results are displayed is decreasing order of _number of times an expression is evaluated_
-  * `num_redo`  - Results are displayed is decreasing order of _number of times an expression is re-evaluated(redo)_
-  * `file`  - Results are sorted in reverse alphabetical order based on the _rego source filename_
-  * `line`  - Results are displayed is decreasing order of _expression line number_ in the source file
+* `total_time_ns` - Results are displayed is decreasing order of *expression evaluation time*
+* `num_eval`  - Results are displayed is decreasing order of *number of times an expression is evaluated*
+* `num_redo`  - Results are displayed is decreasing order of *number of times an expression is re-evaluated(redo)*
+* `num_gen_expr`  - Results are displayed is decreasing order of *number of generated expressions*
+* `file`  - Results are sorted in reverse alphabetical order based on the *rego source filename*
+* `line`  - Results are displayed is decreasing order of *expression line number* in the source file
 
 When the sort criteria is not provided `total_time_ns` has the **highest** priority
 while `line` has the **lowest**.
 
+The `num_gen_expr` represents the number of expressions generated for a given statement on a particular line. For example,
+let's take the following policy:
+
+```rego
+package test
+
+p {
+	a := 1
+	b := 2
+	c := 3
+	x = a + b * c
+}
+```
+
+If we profile the above policy we would get something like the following output:
+
+```ruby
++----------+----------+----------+--------------+-------------+
+|   TIME   | NUM EVAL | NUM REDO | NUM GEN EXPR |  LOCATION   |
++----------+----------+----------+--------------+-------------+
+| 20.291µs | 3        | 3        | 3            | test.rego:7 |
+| 1µs      | 1        | 1        | 1            | test.rego:6 |
+| 2.333µs  | 1        | 1        | 1            | test.rego:5 |
+| 6.333µs  | 1        | 1        | 1            | test.rego:4 |
+| 84.75µs  | 1        | 1        | 1            | data        |
++----------+----------+----------+--------------+-------------+
+```
+
+The first entry indicates that line `test.rego:7` has a `EVAL/REDO` count of `3`. If we look at the expression on line `test.rego:7`
+ie `x = a + b * c` it's not immediately clear why this line has a `EVAL/REDO` count of `3`. But we also notice that there
+are `3` generated expressions (ie. `NUM GEN EXPR`) at line `test.rego:7`. This is because the compiler rewrites the above policy to
+something like below:
+
+`p = true { __local0__ = 1; __local1__ = 2; __local2__ = 3; mul(__local1__, __local2__, __local3__); plus(__local0__, __local3__, __local4__); x = __local4__ }`
+
+And that line `test.rego:7` is rewritten to `mul(__local1__, __local2__, __local3__); plus(__local0__, __local3__, __local4__); x = __local4__` which
+results in a `NUM GEN EXPR` count of `3`. Hence the `NUM GEN EXPR` count can help to better understand the `EVAL/REDO` counts
+for a given expression and also provide more clarity into the profile results and how policy evaluation works.
+
+
 #### Example Policy
 
 The different profiling examples shown later on this page use the below
@@ -411,40 +457,40 @@ package rbac
 # Example input request
 
 input := {
-	"subject": "bob",
-	"resource": "foo123",
-	"action": "write",
+ "subject": "bob",
+ "resource": "foo123",
+ "action": "write",
 }
 
 # Example RBAC configuration.
 bindings := [
-	{
-		"user": "alice",
-		"roles": ["dev", "test"],
-	},
-	{
-		"user": "bob",
-		"roles": ["test"],
-	},
+ {
+  "user": "alice",
+  "roles": ["dev", "test"],
+ },
+ {
+  "user": "bob",
+  "roles": ["test"],
+ },
 ]
 
 roles := [
-	{
-		"name": "dev",
-		"permissions": [
-			{"resource": "foo123", "action": "write"},
-			{"resource": "foo123", "action": "read"},
-		],
-	},
-	{
-		"name": "test",
-		"permissions": [{"resource": "foo123", "action": "read"}],
-	},
+ {
+  "name": "dev",
+  "permissions": [
+   {"resource": "foo123", "action": "write"},
+   {"resource": "foo123", "action": "read"},
+  ],
+ },
+ {
+  "name": "test",
+  "permissions": [{"resource": "foo123", "action": "read"}],
+ },
 ]
 
 # Example RBAC policy implementation.
 
-default allow = false
+default allow := false
 
 allow {
     some role_name
@@ -474,23 +520,24 @@ opa eval --data rbac.rego --profile --format=pretty 'data.rbac.allow'
 ```
 
 **Sample Output**
+
 ```ruby
 false
 
-+----------+----------+----------+-----------------+
-|   TIME   | NUM EVAL | NUM REDO |    LOCATION     |
-+----------+----------+----------+-----------------+
-| 47.148µs | 1        | 1        | data.rbac.allow |
-| 28.965µs | 1        | 1        | rbac.rego:11    |
-| 24.384µs | 1        | 1        | rbac.rego:41    |
-| 23.064µs | 2        | 1        | rbac.rego:47    |
-| 15.525µs | 1        | 1        | rbac.rego:38    |
-| 14.137µs | 1        | 2        | rbac.rego:46    |
-| 13.927µs | 1        | 0        | rbac.rego:42    |
-| 13.568µs | 1        | 1        | rbac.rego:55    |
-| 12.982µs | 1        | 0        | rbac.rego:56    |
-| 12.763µs | 1        | 2        | rbac.rego:52    |
-+----------+----------+----------+-----------------+
++----------+----------+----------+--------------+-----------------+
+|   TIME   | NUM EVAL | NUM REDO | NUM GEN EXPR |    LOCATION     |
++----------+----------+----------+--------------+-----------------+
+| 47.148µs | 1        | 1        | 1            | data.rbac.allow |
+| 28.965µs | 1        | 1        | 1            | rbac.rego:11    |
+| 24.384µs | 1        | 1        | 1            | rbac.rego:41    |
+| 23.064µs | 2        | 1        | 1            | rbac.rego:47    |
+| 15.525µs | 1        | 1        | 1            | rbac.rego:38    |
+| 14.137µs | 1        | 2        | 1            | rbac.rego:46    |
+| 13.927µs | 1        | 0        | 1            | rbac.rego:42    |
+| 13.568µs | 1        | 1        | 1            | rbac.rego:55    |
+| 12.982µs | 1        | 0        | 1            | rbac.rego:56    |
+| 12.763µs | 1        | 2        | 1            | rbac.rego:52    |
++----------+----------+----------+--------------+-----------------+
 
 +------------------------------+----------+
 |            METRIC            |  VALUE   |
@@ -501,18 +548,19 @@ false
 | timer_rego_query_parse_ns    | 12337169 |
 +------------------------------+----------+
 ```
+
 As seen from the above table, all results are displayed. The profile results are
 sorted on the default sort criteria.
 
 To evaluation the policy multiple times, and aggregate the profiling data over those
 runs, pass `--count=NUMBER`:
 
-
 ```bash
 opa eval --data rbac.rego --profile --format=pretty --count=10 'data.rbac.allow'
 ```
 
 **Sample Output**
+
 ```ruby
 false
 +------------------------------+---------+----------+---------------+----------------+---------------+
@@ -525,20 +573,20 @@ false
 | timer_rego_query_eval_ns     | 161812  | 1198092  | 637754        | 1.1846622e+06  | 1.198092e+06  |
 | timer_rego_query_parse_ns    | 6078    | 6078     | 6078          | 6078           | 6078          |
 +------------------------------+---------+----------+---------------+----------------+---------------+
-+----------+-------------+-------------+-------------+-------------+----------+----------+-----------------+
-|   MIN    |     MAX     |    MEAN     |     90%     |     99%     | NUM EVAL | NUM REDO |    LOCATION     |
-+----------+-------------+-------------+-------------+-------------+----------+----------+-----------------+
-| 43.875µs | 26.135469ms | 11.494512ms | 25.746215ms | 26.135469ms | 1        | 1        | data.rbac.allow |
-| 21.478µs | 211.461µs   | 98.102µs    | 205.72µs    | 211.461µs   | 1        | 1        | rbac.rego:13    |
-| 19.652µs | 123.537µs   | 73.161µs    | 122.75µs    | 123.537µs   | 1        | 1        | rbac.rego:40    |
-| 12.303µs | 117.277µs   | 61.59µs     | 116.733µs   | 117.277µs   | 2        | 1        | rbac.rego:50    |
-| 12.224µs | 93.214µs    | 51.289µs    | 92.217µs    | 93.214µs    | 1        | 1        | rbac.rego:44    |
-| 5.561µs  | 84.121µs    | 43.002µs    | 83.469µs    | 84.121µs    | 1        | 1        | rbac.rego:51    |
-| 5.56µs   | 71.712µs    | 36.545µs    | 71.158µs    | 71.712µs    | 1        | 0        | rbac.rego:45    |
-| 4.958µs  | 66.04µs     | 33.161µs    | 65.636µs    | 66.04µs     | 1        | 2        | rbac.rego:49    |
-| 4.326µs  | 65.836µs    | 30.461µs    | 65.083µs    | 65.836µs    | 1        | 1        | rbac.rego:6     |
-| 3.948µs  | 43.399µs    | 24.167µs    | 43.055µs    | 43.399µs    | 1        | 2        | rbac.rego:55    |
-+----------+-------------+-------------+-------------+-------------+----------+----------+-----------------+
++----------+-------------+-------------+-------------+-------------+----------+----------+--------------+------------------+
+|   MIN    |     MAX     |    MEAN     |     90%     |     99%     | NUM EVAL | NUM REDO | NUM GEN EXPR |     LOCATION     |
++----------+-------------+-------------+-------------+-------------+----------+----------+--------------+------------------+
+| 43.875µs | 26.135469ms | 11.494512ms | 25.746215ms | 26.135469ms | 1        | 1        | 1            | data.rbac.allow  |
+| 21.478µs | 211.461µs   | 98.102µs    | 205.72µs    | 211.461µs   | 1        | 1        | 1            | rbac.rego:13     |
+| 19.652µs | 123.537µs   | 73.161µs    | 122.75µs    | 123.537µs   | 1        | 1        | 1            | rbac.rego:40     |
+| 12.303µs | 117.277µs   | 61.59µs     | 116.733µs   | 117.277µs   | 2        | 1        | 1            | rbac.rego:50     |
+| 12.224µs | 93.214µs    | 51.289µs    | 92.217µs    | 93.214µs    | 1        | 1        | 1            | rbac.rego:44     |
+| 5.561µs  | 84.121µs    | 43.002µs    | 83.469µs    | 84.121µs    | 1        | 1        | 1            | rbac.rego:51     |
+| 5.56µs   | 71.712µs    | 36.545µs    | 71.158µs    | 71.712µs    | 1        | 0        | 1            | rbac.rego:45     |
+| 4.958µs  | 66.04µs     | 33.161µs    | 65.636µs    | 66.04µs     | 1        | 2        | 1            | rbac.rego:49     |
+| 4.326µs  | 65.836µs    | 30.461µs    | 65.083µs    | 65.836µs    | 1        | 1        | 1            | rbac.rego:6      |
+| 3.948µs  | 43.399µs    | 24.167µs    | 43.055µs    | 43.399µs    | 1        | 2        | 1            | rbac.rego:55     |
++----------+-------------+-------------+-------------+-------------+----------+----------+--------------+------------------+
 ```
 
 ##### Example: Display top `5` profile results
@@ -548,17 +596,19 @@ opa eval --data rbac.rego --profile-limit 5 --format=pretty 'data.rbac.allow'
 ```
 
 **Sample Output**
+
 ```ruby
-+----------+----------+----------+-----------------+
-|   TIME   | NUM EVAL | NUM REDO |    LOCATION     |
-+----------+----------+----------+-----------------+
-| 46.329µs | 1        | 1        | data.rbac.allow |
-| 26.656µs | 1        | 1        | rbac.rego:11    |
-| 24.206µs | 2        | 1        | rbac.rego:47    |
-| 23.235µs | 1        | 1        | rbac.rego:41    |
-| 18.242µs | 1        | 1        | rbac.rego:38    |
-+----------+----------+----------+-----------------+
++----------+----------+----------+--------------+-----------------+
+|   TIME   | NUM EVAL | NUM REDO | NUM GEN EXPR |     LOCATION    |
++----------+----------+----------+--------------+-----------------+
+| 46.329µs | 1        | 1        | 1            | data.rbac.allow |
+| 26.656µs | 1        | 1        | 1            | rbac.rego:11    |
+| 24.206µs | 2        | 1        | 1            | rbac.rego:47    |
+| 23.235µs | 1        | 1        | 1            | rbac.rego:41    |
+| 18.242µs | 1        | 1        | 1            | rbac.rego:38    |
++----------+----------+----------+--------------+-----------------+
 ```
+
 The profile results are sorted on the default sort criteria.
 Also `--profile` option is implied and does not need to be provided.
 
@@ -569,17 +619,19 @@ opa  eval --data rbac.rego --profile-limit 5 --profile-sort num_eval --format=pr
 ```
 
 **Sample Profile Output**
+
 ```ruby
-+----------+----------+----------+-----------------+
-|   TIME   | NUM EVAL | NUM REDO |    LOCATION     |
-+----------+----------+----------+-----------------+
-| 26.675µs | 2        | 1        | rbac.rego:47    |
-| 9.274µs  | 2        | 1        | rbac.rego:53    |
-| 43.356µs | 1        | 1        | data.rbac.allow |
-| 22.467µs | 1        | 1        | rbac.rego:41    |
-| 22.425µs | 1        | 1        | rbac.rego:11    |
-+----------+----------+----------+-----------------+
++----------+----------+----------+--------------+-----------------+
+|   TIME   | NUM EVAL | NUM REDO | NUM GEN EXPR |    LOCATION     |
++----------+----------+----------+--------------+-----------------+
+| 26.675µs | 2        | 1        | 1            | rbac.rego:47    |
+| 9.274µs  | 2        | 1        | 1            | rbac.rego:53    |
+| 43.356µs | 1        | 1        | 1            | data.rbac.allow |
+| 22.467µs | 1        | 1        | 1            | rbac.rego:41    |
+| 22.425µs | 1        | 1        | 1            | rbac.rego:11    |
++----------+----------+----------+--------------+-----------------+
 ```
+
 As seen from the above table, the results are arranged first in decreasing
 order of number of evaluations and if two expressions have been evaluated
 the same number of times, the default criteria is used since no other sort criteria is provided.
@@ -593,40 +645,46 @@ opa eval --data rbac.rego --profile-limit 5 --profile-sort num_eval,num_redo --f
 ```
 
 **Sample Profile Output**
+
 ```ruby
-+----------+----------+----------+-----------------+
-|   TIME   | NUM EVAL | NUM REDO |    LOCATION     |
-+----------+----------+----------+-----------------+
-| 22.892µs | 2        | 1        | rbac.rego:47    |
-| 8.831µs  | 2        | 1        | rbac.rego:53    |
-| 13.767µs | 1        | 2        | rbac.rego:46    |
-| 10.78µs  | 1        | 2        | rbac.rego:52    |
-| 42.338µs | 1        | 1        | data.rbac.allow |
-+----------+----------+----------+-----------------+
-```
-As seen from the above table, result are first arranged based on _number of evaluations_,
-then _number of re-evaluations_ and finally the default criteria is used.
++----------+----------+----------+--------------+-----------------+
+|   TIME   | NUM EVAL | NUM REDO | NUM GEN EXPR |    LOCATION     |
++----------+----------+----------+--------------+-----------------+
+| 22.892µs | 2        | 1        | 1            | rbac.rego:47    |
+| 8.831µs  | 2        | 1        | 1            | rbac.rego:53    |
+| 13.767µs | 1        | 2        | 1            | rbac.rego:46    |
+| 10.78µs  | 1        | 2        | 1            | rbac.rego:52    |
+| 42.338µs | 1        | 1        | 1            | data.rbac.allow |
++----------+----------+----------+--------------+-----------------+
+```
+
+As seen from the above table, result are first arranged based on *number of evaluations*,
+then *number of re-evaluations* and finally the default criteria is used.
 In this case, total_time_ns => file => line.
 The `--profile-sort` options accepts repeated or comma-separated values for the criteria.
 The order of the criteria on the command line determine their priority.
 
 Another way to get the same output as above would be the following:
+
 ```bash
 opa eval --data rbac.rego --profile-limit 5 --profile-sort num_eval --profile-sort num_redo --format=pretty 'data.rbac.allow'
 ```
 
 ## Benchmarking Queries
+
 OPA provides CLI options to benchmark a single query via the `opa bench` command. This will evaluate similarly to
 `opa eval` but it will repeat the evaluation (in its most efficient form) a number of times and report metrics.
 
-
 #### Example: Benchmark rbac allow
+
 Using the same [policy source as shown above](#example-policy):
+
 ```bash
-$ opa bench --data rbac.rego 'data.rbac.allow'
+opa bench --data rbac.rego 'data.rbac.allow'
 ```
 
 Will result in an output similar to:
+
 ```
 +-------------------------------------------+------------+
 | samples                                   |      27295 |
@@ -654,13 +712,13 @@ to evaluate (loading, parsing, compiling, etc.) is omitted.
 > Note: all `*/op` results are an average over the number of `samples` (or `N` in the JSON format)
 
 #### Options for `opa bench`
+
 | Option | Detail | Default |
 | --- | --- | --- |
 | <span class="opa-keep-it-together">`--benchmem`</span> | Report memory allocations with benchmark results. | true |
 | <span class="opa-keep-it-together">`--metrics`</span> | Report additional query performance metrics. | true |
 | <span class="opa-keep-it-together">`--count`</span> | Number of times to repeat the benchmark. | 1 |
 
-
 ### Benchmarking OPA Tests
 
 There is also a `--bench` option for `opa test` which will perform benchmarking on OPA unit tests. This will evaluate
@@ -669,13 +727,14 @@ will typically be longer than what is seen with `opa bench`. The primary use-cas
 track relative time as policies change.
 
 #### Options for `opa test --bench`
+
 | Option | Detail | Default |
 | --- | --- | --- |
 | <span class="opa-keep-it-together">`--benchmem`</span> | Report memory allocations with benchmark results. | true |
 | <span class="opa-keep-it-together">`--count`</span> | Number of times to repeat the benchmark. | 1 |
 
-
 #### Example Tests
+
 Adding a unit test file for the [policy source as shown above](#example-policy):
 
 ```rego
@@ -692,6 +751,7 @@ test_user_has_role_negative {
 ```
 
 Which when run normally will output something like:
+
 ```
 $ opa test -v ./rbac.rego ./rbac_test.rego
 data.rbac.test_user_has_role_dev: PASS (605.076µs)
@@ -705,33 +765,40 @@ PASS: 2/2
 ```bash
 opa test -v --bench ./rbac.rego ./rbac_test.rego
 ```
+
 Results in output:
+
 ```
-data.rbac.test_user_has_role_dev	   44749	     27677 ns/op	     23146 timer_rego_query_eval_ns/op	   12303 B/op	     229 allocs/op
-data.rbac.test_user_has_role_negative	   44526	     26348 ns/op	     22033 timer_rego_query_eval_ns/op	   12470 B/op	     235 allocs/op
+data.rbac.test_user_has_role_dev    44749      27677 ns/op      23146 timer_rego_query_eval_ns/op    12303 B/op      229 allocs/op
+data.rbac.test_user_has_role_negative    44526      26348 ns/op      22033 timer_rego_query_eval_ns/op    12470 B/op      235 allocs/op
 --------------------------------------------------------------------------------
 PASS: 2/2
 ```
 
 #### Example: Benchmark rbac unit tests and compare with `benchstat`
+
 The benchmark output formats default to `pretty`, but support a `gobench` format which complies with the
 [Golang Benchmark Data Format](https://go.googlesource.com/proposal/+/master/design/14313-benchmark-format.md).
 This allows for usage of tools like [benchstat](https://godoc.org/golang.org/x/perf/cmd/benchstat) to gain additional
 insight into the benchmark results and to diff between benchmark results.
 
 Example:
+
 ```bash
 opa test -v --bench --count 10 --format gobench ./rbac.rego ./rbac_test.rego | tee ./old.txt
 ```
+
 Will result in an `old.txt` and output similar to:
+
 ```
-BenchmarkDataRbacTestUserHasRoleDev	   45152	     26323 ns/op	     22026 timer_rego_query_eval_ns/op	   12302 B/op	     229 allocs/op
-BenchmarkDataRbacTestUserHasRoleNegative	   45483	     26253 ns/op	     21986 timer_rego_query_eval_ns/op	   12470 B/op	     235 allocs/op
+BenchmarkDataRbacTestUserHasRoleDev    45152      26323 ns/op      22026 timer_rego_query_eval_ns/op    12302 B/op      229 allocs/op
+BenchmarkDataRbacTestUserHasRoleNegative    45483      26253 ns/op      21986 timer_rego_query_eval_ns/op    12470 B/op      235 allocs/op
 --------------------------------------------------------------------------------
 PASS: 2/2
 .
 .
 ```
+
 Repeated 10 times (as specified by the `--count` flag).
 
 This format can then be loaded by `benchstat`:
@@ -739,7 +806,9 @@ This format can then be loaded by `benchstat`:
 ```bash
 benchstat ./old.txt
 ```
+
 Output:
+
 ```
 name                             time/op
 DataRbacTestUserHasRoleDev                       29.8µs ±18%
@@ -763,14 +832,16 @@ If later on a change was introduced that altered the performance we can run agai
 ```bash
 opa test -v --bench --count 10 --format gobench ./rbac.rego ./rbac_test.rego | tee ./new.txt
 ```
+
 ```
-BenchmarkDataRbacTestUserHasRoleDev	   27415	     43671 ns/op	     39301 timer_rego_query_eval_ns/op	   17201 B/op	     379 allocs/op
-BenchmarkDataRbacTestUserHasRoleNegative	   27583	     44743 ns/op	     40152 timer_rego_query_eval_ns/op	   17369 B/op	     385 allocs/op
+BenchmarkDataRbacTestUserHasRoleDev    27415      43671 ns/op      39301 timer_rego_query_eval_ns/op    17201 B/op      379 allocs/op
+BenchmarkDataRbacTestUserHasRoleNegative    27583      44743 ns/op      40152 timer_rego_query_eval_ns/op    17369 B/op      385 allocs/op
 --------------------------------------------------------------------------------
 PASS: 2/2
 .
 .
 ```
+
 (Repeated 10 times)
 
 Then we can compare the results via:
@@ -778,6 +849,7 @@ Then we can compare the results via:
 ```bash
 benchstat ./old.txt ./new.txt
 ```
+
 ```
 name                             old time/op                      new time/op                      delta
 DataRbacTestUserHasRoleDev                           29.8µs ±18%                      47.4µs ±15%  +59.06%  (p=0.000 n=9+10)
@@ -826,11 +898,13 @@ loading 10,000 rules that implement an ACL-style authorization policy consumes a
 130MB of RAM while 100,000 rules implementing the same policy (but with 10x more tuples to check)
 consumes approximately 1.1GB of RAM.
 
+By default, OPA stores policy and data in-memory. OPA's disk storage feature allows policy and data to be stored on disk. See [this](../storage/#disk) for more details.
+
 ## Optimization Levels
 
 The `--optimize` (or `-O`) flag on the `opa build` command controls how bundles are optimized.
 
-> Optimization applies partial evaluation to precompute _known_ values in the policy. The goal of
+> Optimization applies partial evaluation to precompute *known* values in the policy. The goal of
 partial evaluation is to convert non-linear-time policies into linear-time policies.
 
 By specifying the `--optimize` flag, users can control how much time and resources are spent
@@ -847,7 +921,7 @@ By default optimizations are disabled.
 Policies are partially evaluated. Rules that DO NOT depend on unknowns (directly or indirectly) are
 evaluated and the virtual documents they produce are inlined into call sites. Virtual documents that
 are required at evaluation time are not inlined. For example, if a base or virtual document is
-targetted by a `with` statement in the policy, the document will not be inlined.
+targeted by a `with` statement in the policy, the document will not be inlined.
 
 Rules that depend on unknowns (directly or indirectly) are also partially evaluated however the
 virtual documents they produce ARE NOT inlined into call sites. The output policy should be structurally
@@ -874,4 +948,3 @@ For high-performance use cases:
 * Write your policies with indexed statements so that [rule-indexing](https://blog.openpolicyagent.org/optimizing-opa-rule-indexing-59f03f17caf3) is effective.
 * Use the profiler to help identify portions of the policy that would benefit the most from improved performance.
 * Use the benchmark tools to help get real world timing data and detect policy performance changes.
-
diff --git a/docs/content/policy-reference.md b/docs/content/policy-reference.md
index f134f00d1d..04ddcc83e7 100644
--- a/docs/content/policy-reference.md
+++ b/docs/content/policy-reference.md
@@ -103,6 +103,11 @@ some [x, "b", z] in a_set
 
 ## Iteration
 
+```live:iteration:module:hidden
+package example
+import future.keywords
+```
+
 ### Arrays
 
 ```live:iteration/arrays:query:read_only
@@ -182,13 +187,13 @@ not any_not_match
 ```
 
 ```live:iteration/forall:module:read_only
-any_match {
-    set[x]
+any_match if {
+    some x in set
     f(x)
 }
 
-any_not_match {
-    set[x]
+any_not_match if {
+    some x in set
     not f(x)
 }
 ```
@@ -197,31 +202,38 @@ any_not_match {
 
 In the examples below `...` represents one or more conditions.
 
+```live:rules:module:hidden
+package example
+import future.keywords
+```
+
 ### Constants
 
 ```live:rules/constants:module:read_only
-a = {1, 2, 3}
-b = {4, 5, 6}
-c = a | b
+a := {1, 2, 3}
+b := {4, 5, 6}
+c := a | b
 ```
 
 ### Conditionals (Boolean)
 
 ```live:rules/condbool:module:read_only
 # p is true if ...
-p = true { ... }
+p := true { ... }
 
 # OR
+p if { ... }
 
+# OR
 p { ... }
 ```
 
 ### Conditionals
 
 ```live:rules/cond:module:read_only
-default a = 1
-a = 5 { ... }
-a = 100 { ... }
+default a := 1
+a := 5   if { ... }
+a := 100 if { ... }
 ```
 
 ### Incremental
@@ -231,29 +243,33 @@ a = 100 { ... }
 a_set[x] { ... }
 a_set[y] { ... }
 
+# alternatively, with future.keywords.contains and future.keywords.if
+a_set contains x if { ... }
+a_set contains y if { ... }
+
 # a_map will contain key->value pairs x->y and w->z
-a_map[x] = y { ... }
-a_map[w] = z { ... }
+a_map[x] := y if { ... }
+a_map[w] := z if { ... }
 ```
 
 ### Ordered (Else)
 
 ```live:rules/ordered:module:read_only
-default a = 1
-a = 5 { ... }
-else = 10 { ... }
+default a := 1
+a := 5 if { ... }
+else := 10 if { ... }
 ```
 
 ### Functions (Boolean)
 
 ```live:rules/funcs:module:read_only
-f(x, y) {
+f(x, y) if {
     ...
 }
 
 # OR
 
-f(x, y) = true {
+f(x, y) := true if {
     ...
 }
 ```
@@ -261,11 +277,48 @@ f(x, y) = true {
 ### Functions (Conditionals)
 
 ```live:rules/condfuncs:module:read_only
-f(x) = "A" { x >= 90 }
-f(x) = "B" { x >= 80; x < 90 }
-f(x) = "C" { x >= 70; x < 80 }
+f(x) := "A" if { x >= 90 }
+f(x) := "B" if { x >= 80; x < 90 }
+f(x) := "C" if { x >= 70; x < 80 }
+```
+
+### Reference Heads
+
+```live:rules/ref_heads:module:read_only
+fruit.apple.seeds = 12 if input == "apple"             # complete document (single value rule)
+
+fruit.pineapple.colors contains x if x := "yellow"     # multi-value rule
+
+fruit.banana.phone[x] = "bananular" if x := "cellular" # single value rule
+fruit.banana.phone.cellular = "bananular" if true      # equivalent single value rule
+
+fruit.orange.color(x) = true if x == "orange"          # function
+```
+
+For reasons of backwards-compatibility, partial sets need to use `contains` in
+their rule heads, i.e.
+
+```live:rules/ref_heads/set:module:read_only
+fruit.box contains "apples" if true
+```
+
+whereas
+
+```live:rules/ref_heads/complete:module:read_only
+fruit.box[x] if { x := "apples" }
+```
+
+defines a _complete document rule_ `fruit.box.apples` with value `true`.
+The same is the case of rules with brackets that don't contain dots, like
+
+```live:rules/ref_heads/simple:module:read_only
+box[x] if { x := "apples" } # => {"box": {"apples": true }}
+box2[x] { x := "apples" } # => {"box": ["apples"]}
 ```
 
+For backwards-compatibility, rules _without_ if and without _dots_ will be interpreted
+as defining partial sets, like `box2`.
+
 ## Tests
 
 ```live:tests:module:read_only
@@ -282,71 +335,13 @@ The built-in functions for the language provide basic operations to manipulate
 scalar values (e.g. numbers and strings), and aggregate functions that summarize
 complex types.
 
-### Comparison
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``x == y``</span>   | ``x`` is equal to ``y`` | ✅  |
-| <span class="opa-keep-it-together">``x != y``</span>   | ``x`` is not equal to ``y`` | ✅  |
-| <span class="opa-keep-it-together">``x < y``</span>   | ``x`` is less than ``y`` | ✅   |
-| <span class="opa-keep-it-together">``x <= y``</span>   | ``x`` is less than or equal to ``y`` | ✅  |
-| <span class="opa-keep-it-together">``x > y``</span>   | ``x`` is greater than ``y`` | ✅  |
-| <span class="opa-keep-it-together">``x >= y``</span>   | ``x`` is greater than or equal to ``y`` | ✅ |
-
-### Numbers
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``z := x + y``</span>   | ``z`` is the sum of ``x`` and ``y`` | ✅ |
-| <span class="opa-keep-it-together">``z := x - y``</span>  | ``z`` is the difference of ``x`` and ``y`` | ✅ |
-| <span class="opa-keep-it-together">``z := x * y``</span>   | ``z`` is the product of ``x`` and ``y`` | ✅ |
-| <span class="opa-keep-it-together">``z := x / y``</span>   | ``z`` is the quotient of ``x`` and ``y``  | ✅ |
-| <span class="opa-keep-it-together">``z := x % y``</span>   | ``z`` is the remainder from the division of ``x`` and ``y``  | ✅ |
-| <span class="opa-keep-it-together">``output := round(x)``</span>    | ``output`` is ``x`` rounded to the nearest integer | ✅ |
-| <span class="opa-keep-it-together">``output := ceil(x)``</span>    | ``output`` is ``x`` rounded up to the nearest integer | ✅ |
-| <span class="opa-keep-it-together">``output := floor(x)``</span>    | ``output`` is ``x`` rounded down the nearest integer | ✅ |
-| <span class="opa-keep-it-together">``output := abs(x)``</span>    | ``output`` is the absolute value of ``x`` | ✅ |
-| <span class="opa-keep-it-together">``output := numbers.range(a, b)``</span> | ``output`` is the range of integer numbers between ``a`` and ``b`` (inclusive). If ``a`` == ``b`` then ``output`` == ``[a]``. If ``a`` < ``b`` the range is in ascending order. If ``a`` > ``b`` the range is in descending order. | ✅ |
-  <span class="opa-keep-it-together">``output := rand.intn(str, n)``</span> |  ``output`` is a ``number`` in the range [0, abs(``n``)). If ``n`` is 0, then ``output`` is 0. For any given (``str``, ``n``) pair the output will be consistent throughout a query evaluation. | SDK-dependent |
-
-### Aggregates
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := count(collection_or_string)``</span> | ``output`` is the length of the object, array, set, or string provided as input | ✅ |
-| <span class="opa-keep-it-together">``output := sum(array_or_set)``</span> | ``output`` is the sum of the numbers in ``array_or_set`` | ✅ |
-| <span class="opa-keep-it-together">``output := product(array_or_set)``</span> | ``output`` is the product of the numbers in ``array_or_set`` | ✅ |
-| <span class="opa-keep-it-together">``output := max(array_or_set)``</span> | ``output`` is the maximum value in ``array_or_set`` | ✅ |
-| <span class="opa-keep-it-together">``output := min(array_or_set)``</span> | ``output`` is the minimum value in ``array_or_set`` | ✅ |
-| <span class="opa-keep-it-together">``output := sort(array_or_set)``</span> | ``output`` is the sorted ``array`` containing elements from ``array_or_set``. | ✅ |
-
-### Arrays
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := array.concat(array, array)``</span> | ``output`` is the result of concatenating the two input arrays together. | ✅ |
-  <span class="opa-keep-it-together">``output := array.slice(array, startIndex, stopIndex)``</span> | ``output`` is the part of the ``array`` from ``startIndex`` to ``stopIndex`` including the first but excluding the last. If `startIndex >= stopIndex` then `output == []`. If both `startIndex` and `stopIndex` are less than zero, `output == []`. Otherwise, `startIndex` and `stopIndex` are clamped to 0 and `count(array)` respectively. | ✅ |
-
-### Sets
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``s3 := s1 & s2``</span> | ``s3`` is the intersection of ``s1`` and ``s2``. | ✅ |
-| <span class="opa-keep-it-together"><code>s3 := s1 &#124; s2</code></span> | ``s3`` is the union of ``s1`` and ``s2``. | ✅ |
-| <span class="opa-keep-it-together">``s3 := s1 - s2``</span> | ``s3`` is the difference between ``s1`` and ``s2``, i.e., the elements in ``s1`` that are not in ``s2`` | ✅ |
-| <span class="opa-keep-it-together">``output := intersection(set[set])``</span> | ``output`` is the intersection of the sets in the input set | ✅ |
-| <span class="opa-keep-it-together">``output := union(set[set])``</span> | ``output`` is the union of the sets in the input set  | ✅ |
-
-### Objects
+{{< builtin-table comparison >}}
+{{< builtin-table numbers >}}
+{{< builtin-table aggregates >}}
+{{< builtin-table cat=array id=arrays-2 title=arrays >}}
+{{< builtin-table cat=sets id=sets-2 >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">`value := object.get(object, key, default)`</span> | `value` is the value stored by the `object` at `key`. If no value is found, `default` is returned. | ✅ |
-| <span class="opa-keep-it-together">`output := object.remove(object, keys)`</span> | `output` is a new object which is the result of removing the specified `keys` from `object`. `keys` must be either an array, object, or set of keys. | ✅ |
-| <span class="opa-keep-it-together">`output := object.union(objectA, objectB)`</span> | `output` is a new object which is the result of an asymmetric recursive union of two objects where conflicts are resolved by choosing the key from the right-hand object (`objectB`). For example: `object.union({"a": 1, "b": 2, "c": {"d": 3}}, {"a": 7, "c": {"d": 4, "e": 5}})` will result in `{"a": 7, "b": 2, "c": {"d": 4, "e": 5}}`  | ✅ |
-| <span class="opa-keep-it-together">`filtered := object.filter(object, keys)`</span> | `filtered` is a new object with the remaining data from `object` with only keys specified in `keys` which is an array, object, or set of keys. For example: `object.filter({"a": {"b": "x", "c": "y"}, "d": "z"}, ["a"])` will result in `{"a": {"b": "x", "c": "y"}}`). | ✅ |
-| <span class="opa-keep-it-together">`filtered := json.filter(object, paths)`</span> | `filtered` is the remaining data from `object` with only keys specified in `paths` which is an array or set of JSON string paths. For example: `json.filter({"a": {"b": "x", "c": "y"}}, ["a/b"])` will result in `{"a": {"b": "x"}}`). Paths are not filtered in-order and are deduplicated before being evaluated. | ✅ |
-| <span class="opa-keep-it-together">`output := json.remove(object, paths)`</span> | `output` is a new object which is the result of removing all keys specified in `paths` which is an array or set of JSON string paths. For example: `json.remove({"a": {"b": "x", "c": "y"}}, ["a/b"])` will result in `{"a": {"c": "y"}}`. Paths are not removed in-order and are deduplicated before being evaluated. | ✅ |
-| <span class="opa-keep-it-together">`output := json.patch(object, patches)`</span> | `output` is a the object obtained after consecutively applying all [JSON Patch](https://tools.ietf.org/html/rfc6902) operations in the array `patches`. For example: `json.patch({"a": {"foo": 1}}, [{"op": "add", "path": "/a/bar", "value": 2}])` results in `{"a": {"foo": 1, "bar": 2}`.  The patches are applied atomically: if any of them fails, the result will be undefined. | ``SDK-dependent`` |
+{{< builtin-table cat=object title=objects >}}
 
 * When `keys` are provided as an object only the top level keys on the object will be used, values are ignored.
   For example: `object.remove({"a": {"b": {"c": 2}}, "x": 123}, {"a": 1}) == {"x": 123}` regardless of the value
@@ -368,46 +363,10 @@ complex types.
   the path `a/b/c` can be passed in as `["a", "b", "c"]`.
 
 
-### Strings
+{{< builtin-table strings >}}
+{{< builtin-table regex >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := concat(delimiter, array_or_set)``</span> | ``output`` is the result of joining together the elements of ``array_or_set`` with the  string ``delimiter`` | ✅ |
-| <span class="opa-keep-it-together">``contains(string, search)``</span> | true if ``string`` contains ``search`` | ✅ |
-| <span class="opa-keep-it-together">``endswith(string, search)``</span> | true if ``string`` ends with ``search`` | ✅ |
-| <span class="opa-keep-it-together">``output := format_int(number, base)``</span> | ``output`` is string representation of ``number`` in the given ``base`` | ✅ |
-| <span class="opa-keep-it-together">``output := indexof(string, search)``</span> | ``output`` is the index inside ``string`` where ``search`` first occurs, or -1 if ``search`` does not exist | ✅ |
-| <span class="opa-keep-it-together">``output := lower(string)``</span> | ``output`` is ``string`` after converting to lower case | ✅ |
-| <span class="opa-keep-it-together">``output := replace(string, old, new)``</span> | ``output`` is a ``string`` representing ``string`` with all instances of ``old`` replaced by ``new`` | ✅ |
-| <span class="opa-keep-it-together">``output := strings.replace_n(patterns, string)``</span> | ``patterns`` is an object with old, new string key value pairs (e.g. ``{"old1": "new1", "old2": "new2", ...}``). ``output`` is a ``string`` with all old strings inside ``patterns`` replaced by the new strings | ✅ |
-| <span class="opa-keep-it-together">``output := split(string, delimiter)``</span> | ``output`` is ``array[string]`` representing elements of ``string`` separated by ``delimiter`` | ✅ |
-| <span class="opa-keep-it-together">``output := sprintf(string, values)``</span> | ``output`` is a ``string`` representing ``string`` formatted by the values in the ``array`` ``values``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``startswith(string, search)``</span> | true if ``string`` begins with ``search`` | ✅ |
-| <span class="opa-keep-it-together">``output := substring(string, start, length)``</span> | ``output`` is the portion of ``string`` from index ``start`` and having a length of ``length``.  If ``length`` is less than zero, ``length`` is the remainder of the ``string``. If ``start`` is greater than the length of the string, ``output`` is empty. It is invalid to pass a negative offset to this function. | ✅ |
-| <span class="opa-keep-it-together">``output := trim(string, cutset)``</span> | ``output`` is a ``string`` representing ``string`` with all leading and trailing instances of the characters in ``cutset`` removed. | ✅ |
-| <span class="opa-keep-it-together">``output := trim_left(string, cutset)``</span> | ``output`` is a ``string`` representing ``string`` with all leading instances of the characters in ``cutset`` removed. | ✅ |
-| <span class="opa-keep-it-together">``output := trim_prefix(string, prefix)``</span> | ``output`` is a ``string`` representing ``string`` with leading instance of ``prefix`` removed. If ``string`` doesn't start with prefix, ``string`` is returned unchanged.| ✅ |
-| <span class="opa-keep-it-together">``output := trim_right(string, cutset)``</span> | ``output`` is a ``string`` representing ``string`` with all trailing instances of the characters in ``cutset`` removed. | ✅ |
-| <span class="opa-keep-it-together">``output := trim_suffix(string, suffix)``</span> | ``output`` is a ``string`` representing ``string`` with trailing instance of ``suffix`` removed. If ``string`` doesn't end with suffix, ``string`` is returned unchanged.| ✅ |
-| <span class="opa-keep-it-together">``output := trim_space(string)``</span> | ``output`` is a ``string`` representing ``string`` with all leading and trailing white space removed.| ✅ |
-| <span class="opa-keep-it-together">``output := upper(string)``</span> | ``output`` is ``string`` after converting to upper case | ✅ |
-
-### Regex
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := regex.match(pattern, value)``</span> | ``output`` is a ``boolean`` that indicates if ``value`` matches the regex ``pattern``. | ✅ |
-| <span class="opa-keep-it-together">``output := regex.is_valid(pattern)``</span> | ``output`` is a ``boolean`` that indicates if ``pattern`` is a valid regex pattern. The detailed syntax for regex patterns is defined by https://github.com/google/re2/wiki/Syntax. | ✅ |
-| <span class="opa-keep-it-together">``output := regex.split(pattern, string)``</span> | ``output`` is ``array[string]`` representing elements of ``string`` separated by ``pattern`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``regex.globs_match(glob1, glob2)``</span> | true if the intersection of regex-style globs ``glob1`` and ``glob2`` matches a non-empty set of non-empty strings. The set of regex symbols is limited for this builtin: only ``.``, ``*``, ``+``, ``[``, ``-``, ``]`` and ``\`` are treated as special symbols. | ``SDK-dependent`` |
-| <span class="opa-keep-it-normal">``output := regex.template_match(pattern, string, delimiter_start, delimiter_end)``</span> | ``output`` is true if ``string`` matches ``pattern``. ``pattern`` is a string containing ``0..n`` regular expressions delimited by ``delimiter_start`` and ``delimiter_end``. Example ``regex.template_match("urn:foo:{.*}", "urn:foo:bar:baz", "{", "}")`` returns ``true``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := regex.find_n(pattern, string, number)``</span> | ``output`` is an ``array[string]`` with the ``number`` of values matching the ``pattern``. A ``number`` of ``-1`` means all matches. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := regex.find_all_string_submatch_n(pattern, string, number)``</span> | ``output`` is an ``array[array[string]]`` with the outer `array` including a ``number`` of matches which match the ``pattern``. A ``number`` of ``-1`` means all matches. | ✅ |
-
-### Glob
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := glob.match(pattern, delimiters, match)``</span> | ``output`` is true if ``match`` can be found in ``pattern`` which is separated by ``delimiters``. For valid patterns, check the table below. Argument ``delimiters`` is an array of single-characters (e.g. `[".", ":"]`). If ``delimiters`` is empty, it defaults to ``["."]``. | ✅ |
-| <span class="opa-keep-it-together">``output := glob.quote_meta(pattern)``</span> | ``output`` is the escaped string of ``pattern``. Calling ``glob.quote_meta("*.github.com", output)`` returns ``\\*.github.com`` as ``output``. | ``SDK-dependent`` |
+{{< builtin-table glob >}}
 
 The following table shows examples of how ``glob.match`` works:
 
@@ -415,6 +374,7 @@ The following table shows examples of how ``glob.match`` works:
 | -------- | ---------- | ----------- |
 | ``output := glob.match("*.github.com", [], "api.github.com")`` | ``true`` | A glob with the default ``["."]`` delimiter. |
 | ``output := glob.match("*.github.com", [], "api.cdn.github.com")`` | ``false`` | A glob with the default ``["."]`` delimiter. |
+| ``output := glob.match("*hub.com", null, "api.cdn.github.com")`` | ``true`` | A glob without delimiter. |
 | ``output := glob.match("*:github:com", [":"], "api:github:com")`` | ``true`` | A glob with delimiters ``[":"]``. |
 | ``output := glob.match("api.**.com", [], "api.github.com")`` | ``true`` | A super glob. |
 | ``output := glob.match("api.**.com", [], "api.cdn.github.com")`` | ``true`` | A super glob. |
@@ -434,65 +394,13 @@ The following table shows examples of how ``glob.match`` works:
 | ``output := glob.match("{cat,bat,[fr]at}", [], "rat")`` | ``true`` | A glob with pattern-alternatives matchers. |
 | ``output := glob.match("{cat,bat,[fr]at}", [], "at")`` | ``false`` | A glob with pattern-alternatives matchers. |
 
-### Bitwise
+{{< builtin-table cat=bits title=bitwise >}}
+{{< builtin-table conversions >}}
+{{< builtin-table units >}}
+{{< builtin-table types >}}
+{{< builtin-table encoding >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``z := bits.or(x, y)``</span>  | ``z`` is the bitwise or of integers ``x`` and ``y`` | ✅ |
-| <span class="opa-keep-it-together">``z := bits.and(x, y)``</span> | ``z`` is the bitwise and of integers ``x`` and ``y`` | ✅ |
-| <span class="opa-keep-it-together">``z := bits.negate(x)``</span> | ``z`` is the bitwise negation (flip) of integer ``x`` | ✅ |
-| <span class="opa-keep-it-together">``z := bits.xor(x, y)``</span> | ``z`` is the bitwise exclusive-or of integers ``x`` and ``y`` | ✅ |
-| <span class="opa-keep-it-together">``z := bits.lsh(x, s)``</span> | ``z`` is the bitshift of integer ``x`` by ``s`` bits to the left | ✅ |
-| <span class="opa-keep-it-together">``z := bits.rsh(x, s)``</span> | ``z`` is the bitshift of integer ``x`` by ``s`` bits to the right | ✅ |
-
-### Conversions
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := to_number(x)``</span> | ``output`` is ``x`` converted to a number. `null` is converted to zero, `true` and `false` are converted to one and zero (respectively), `string` values are interpreted as base 10, and `numbers` are a no-op. Other types are not supported. | ✅ |
-
-### Units
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := units.parse_bytes(x)``</span> | ``output`` is ``x`` converted to a number with support for standard byte units (e.g., KB, KiB, etc.) KB, MB, GB, and TB are treated as decimal units and KiB, MiB, GiB, and TiB are treated as binary units. The bytes symbol (b/B) in the unit is optional and omitting it wil give the same result (e.g. Mi and MiB) | ``SDK-dependent`` |
-
-### Types
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := is_number(x)``</span> | ``output`` is ``true`` if ``x`` is a number; otherwise undefined| ✅ |
-| <span class="opa-keep-it-together">``output := is_string(x)``</span> | ``output`` is ``true`` if ``x`` is a string; otherwise undefined | ✅ |
-| <span class="opa-keep-it-together">``output := is_boolean(x)``</span> | ``output`` is ``true`` if ``x`` is a boolean; otherwise undefined | ✅ |
-| <span class="opa-keep-it-together">``output := is_array(x)``</span> | ``output`` is ``true`` if ``x`` is an array; otherwise undefined | ✅ |
-| <span class="opa-keep-it-together">``output := is_set(x)``</span> | ``output`` is ``true`` if ``x`` is a set; otherwise undefined | ✅ |
-| <span class="opa-keep-it-together">``output := is_object(x)``</span> | ``output`` is ``true`` if ``x`` is an object; otherwise undefined | ✅ |
-| <span class="opa-keep-it-together">``output := is_null(x)``</span> | ``output`` is ``true`` if ``x`` is null; otherwise undefined | ✅ |
-| <span class="opa-keep-it-together">``output := type_name(x)``</span> | ``output`` is the type of ``x`` (e.g. ``"number"``, ``"boolean"``, ...) | ✅ |
-
-### Encoding
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := base64.encode(x)``</span> | ``output`` is ``x`` serialized to a base64 encoded string without padding | ✅ |
-| <span class="opa-keep-it-together">``output := base64.decode(string)``</span> | ``output`` is ``x`` deserialized from a base64 encoding string without padding | ✅ |
-| <span class="opa-keep-it-together">``output := base64url.encode(x)``</span> | ``output`` is ``x`` serialized to a base64url encoded string with padding | ✅ |
-| <span class="opa-keep-it-together">``output := base64url.encode_no_pad(x)``</span> | ``output`` is ``x`` serialized to a base64url encoded string without padding | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := base64url.decode(string)``</span> | ``output`` is ``string`` deserialized from a base64url encoded string with or without padding | ✅ |
-| <span class="opa-keep-it-together">``output := urlquery.encode(string)``</span> | ``output`` is URL query parameter encoded ``string`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := urlquery.encode_object(object)``</span> | ``output`` is URL query parameter encoded ``object`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := urlquery.decode(string)``</span> | ``output`` is URL query parameter decoded ``string`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := urlquery.decode_object(string)``</span> | ``output`` is URL query parameter decoded ``string`` represented as an ``object`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := json.marshal(x)``</span> | ``output`` is ``x`` serialized to a JSON string | ✅ |
-| <span class="opa-keep-it-together">``output := json.unmarshal(string)``</span> | ``output`` is ``string`` deserialized to a term from a JSON encoded string | ✅ |
-| <span class="opa-keep-it-together">``output := json.is_valid(string)``</span> | ``output`` is a ``boolean`` that indicated whether ``string`` is a valid JSON document | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := yaml.marshal(x)``</span> | ``output`` is ``x`` serialized to a YAML string | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := yaml.unmarshal(string)``</span> | ``output`` is ``string`` deserialized to a term from YAML encoded string | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := yaml.is_valid(string)``</span> | ``output`` is a ``boolean`` that indicated whether ``string`` is a valid YAML document that can be decoded by `yaml.unmarshal` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := hex.encode(x)``</span> | ``output`` is ``x`` serialized to a hex encoded string | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := hex.decode(string)``</span> | ``output`` is a ``string`` deserialized from a hex encoded string | ``SDK-dependent`` |
-
-### Token Signing
+{{< builtin-table cat=tokensign title="Token Signing" >}}
 
 OPA provides two builtins that implement JSON Web Signature [RFC7515](https://tools.ietf.org/html/rfc7515) functionality.
 
@@ -504,10 +412,12 @@ OPA provides two builtins that implement JSON Web Signature [RFC7515](https://to
 ``io.jwt.encode_sign()`` takes three Rego Objects as parameters and returns their JWS Compact Serialization. This builtin
  should be used by those that want to use rego objects for signing during policy evaluation.
 
-> Note that with `io.jwt.encode_sign` the Rego objects are serialized to JSON with standard formatting applied
-> whereas the `io.jwt.encode_sign_raw` built-in will **not** affect whitespace of the strings passed in.
-> This will mean that the final encoded token may have different string values, but the decoded and parsed
-> JSON will match.
+{{< info >}}
+Note that with `io.jwt.encode_sign` the Rego objects are serialized to JSON with standard formatting applied
+whereas the `io.jwt.encode_sign_raw` built-in will **not** affect whitespace of the strings passed in.
+This will mean that the final encoded token may have different string values, but the decoded and parsed
+JSON will match.
+{{< /info >}}
 
 The following algorithms are supported:
 
@@ -524,15 +434,11 @@ The following algorithms are supported:
 	RS384       "RS384" // RSASSA-PKCS-v1.5 using SHA-384
 	RS512       "RS512" // RSASSA-PKCS-v1.5 using SHA-512
 
-<br>
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := io.jwt.encode_sign_raw(headers, payload, key)``</span> | ``headers``, ``payload`` and  ``key`` as strings that represent the JWS Protected Header, JWS Payload and JSON Web Key ([RFC7517](https://tools.ietf.org/html/rfc7517)) respectively.| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.encode_sign(headers, payload, key)``</span> | ``headers``, ``payload`` and  ``key`` are JSON objects that represent the JWS Protected Header, JWS Payload and JSON Web Key ([RFC7517](https://tools.ietf.org/html/rfc7517)) respectively.| ``SDK-dependent`` |
 
-> Note that the key's provided should be base64 encoded (without padding) as per the specification ([RFC7517](https://tools.ietf.org/html/rfc7517)).
-> This differs from the plain text secrets provided with the algorithm specific verify built-ins described below.
+{{< info >}}
+Note that the key's provided should be base64 URL encoded (without padding) as per the specification ([RFC7517](https://tools.ietf.org/html/rfc7517)).
+This differs from the plain text secrets provided with the algorithm specific verify built-ins described below.
+{{< /info >}}
 
 #### Token Signing Examples
 
@@ -623,27 +529,12 @@ io.jwt.encode_sign_raw(
 ```live:jwt/raw:output
 ```
 
-### Token Verification
+{{< builtin-table cat=tokens title="Token Verification" >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := io.jwt.verify_rs256(string, certificate)``</span> | ``output`` is ``true`` if the RS256 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the RS256 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_rs384(string, certificate)``</span> | ``output`` is ``true`` if the RS384 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the RS384 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_rs512(string, certificate)``</span> | ``output`` is ``true`` if the RS512 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key, or the JWK key (set) used to verify the RS512 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_ps256(string, certificate)``</span> | ``output`` is ``true`` if the PS256 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key or the JWK key (set) used to verify the PS256 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_ps384(string, certificate)``</span> | ``output`` is ``true`` if the PS384 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key or the JWK key (set) used to verify the PS384 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_ps512(string, certificate)``</span> | ``output`` is ``true`` if the PS512 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key or the JWK key (set) used to verify the PS512 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_es256(string, certificate)``</span> | ``output`` is ``true`` if the ES256 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key or the JWK key (set) used to verify the ES256 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_es384(string, certificate)``</span> | ``output`` is ``true`` if the ES384 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key or the JWK key (set) used to verify the ES384 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_es512(string, certificate)``</span> | ``output`` is ``true`` if the ES512 signature of the input token is valid. ``certificate`` is the PEM encoded certificate, PEM encoded public key or the JWK key (set) used to verify the ES512 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_hs256(string, secret)``</span> | ``output`` is ``true`` if the Secret signature of the input token is valid. ``secret`` is a plain text secret used to verify the HS256 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_hs384(string, secret)``</span> | ``output`` is ``true`` if the Secret signature of the input token is valid. ``secret`` is a plain text secret used to verify the HS384 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.verify_hs512(string, secret)``</span> | ``output`` is ``true`` if the Secret signature of the input token is valid. ``secret`` is a plain text secret used to verify the HS512 signature| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.decode(string)``</span> | ``output`` is of the form ``[header, payload, sig]``.  ``header`` and ``payload`` are ``object``. ``sig`` is the hexadecimal representation of the signature on the token. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := io.jwt.decode_verify(string, constraints)``</span> | ``output`` is of the form ``[valid, header, payload]``.  If the input token verifies and meets the requirements of ``constraints`` then ``valid`` is ``true`` and ``header`` and ``payload`` are objects containing the JOSE header and the JWT claim set. Otherwise, ``valid`` is ``false`` and ``header`` and ``payload`` are ``{}``. Supports the following algorithms: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384 and PS512. | ``SDK-dependent`` |
-
-> Note that the `io.jwt.verify_XX` built-in methods verify **only** the signature. They **do not** provide any validation for the JWT
-> payload and any claims specified. The `io.jwt.decode_verify` built-in will verify the payload and **all** standard claims.
+{{< info >}}
+Note that the `io.jwt.verify_XX` built-in methods verify **only** the signature. They **do not** provide any validation for the JWT
+payload and any claims specified. The `io.jwt.decode_verify` built-in will verify the payload and **all** standard claims.
+{{< /info >}}
 
 The input `string` is a JSON Web Token encoded with JWS Compact Serialization. JWE and JWS JSON Serialization are not supported. If nested signing was used, the ``header``, ``payload`` and ``signature`` will represent the most deeply nested token.
 
@@ -667,7 +558,7 @@ unrecognized constraints then the token is considered invalid.
 The examples below use the following token:
 
 ```live:jwt/verify:module
-es256_token = "eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJFUzI1NiJ9.eyJuYmYiOiAxNDQ0NDc4NDAwLCAiaXNzIjogInh4eCJ9.lArczfN-pIL8oUU-7PU83u-zfXougXBZj6drFeKFsPEoVhy9WAyiZlRshYqjTSXdaw8yw2L-ovt4zTUZb2PWMg"
+es256_token := "eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJFUzI1NiJ9.eyJuYmYiOiAxNDQ0NDc4NDAwLCAiaXNzIjogInh4eCJ9.lArczfN-pIL8oUU-7PU83u-zfXougXBZj6drFeKFsPEoVhy9WAyiZlRshYqjTSXdaw8yw2L-ovt4zTUZb2PWMg"
 ```
 
 ##### Using JWKS
@@ -675,7 +566,7 @@ This example shows a two-step process to verify the token signature and then dec
 further checks of the payload content. This approach gives more flexibility in verifying only
 the claims that the policy needs to enforce.
 ```live:jwt/verify/jwks:module
-jwks = `{
+jwks := `{
     "keys": [{
         "kty":"EC",
         "crv":"P-256",
@@ -709,7 +600,7 @@ constraints.
 The following examples will demonstrate verifying tokens using an X.509 Certificate
 defined as:
 ```live:jwt/verify/cert:module
-cert = `-----BEGIN CERTIFICATE-----
+cert := `-----BEGIN CERTIFICATE-----
 MIIBcDCCARagAwIBAgIJAMZmuGSIfvgzMAoGCCqGSM49BAMCMBMxETAPBgNVBAMM
 CHdoYXRldmVyMB4XDTE4MDgxMDE0Mjg1NFoXDTE4MDkwOTE0Mjg1NFowEzERMA8G
 A1UEAwwId2hhdGV2ZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATPwn3WCEXL
@@ -766,7 +657,7 @@ raw_result_parts_hs256 := io.jwt.decode_verify(raw_result_hs256, {"secret": "foo
 ```live:jwt/verify/round_trip_raw:output
 ```
 
-Now encode the and sign the same token contents but with `io.jwt.encode_sign` instead of the `raw` varient.
+Now encode the and sign the same token contents but with `io.jwt.encode_sign` instead of the `raw` variant.
 ```live:jwt/verify/round_trip:module:hidden
 ```
 ```live:jwt/verify/round_trip:query:merge_down
@@ -789,28 +680,20 @@ result_valid_hs256 := io.jwt.verify_hs256(result_hs256, "foo")
 ```live:jwt/verify/round_trip:output
 ```
 
-> Note that the resulting encoded token is different from the first example using
-> `io.jwt.encode_sign_raw`. The reason is that the `io.jwt.encode_sign` function
-> is using canonicalized formatting for the header and payload whereas
-> `io.jwt.encode_sign_raw` does not change the whitespace of the strings passed
-> in. The decoded and parsed JSON values are still the same.
+{{< info >}}
+Note that the resulting encoded token is different from the first example using
+`io.jwt.encode_sign_raw`. The reason is that the `io.jwt.encode_sign` function
+is using canonicalized formatting for the header and payload whereas
+`io.jwt.encode_sign_raw` does not change the whitespace of the strings passed
+in. The decoded and parsed JSON values are still the same.
+{{< /info >}}
 
-### Time
+{{< builtin-table time >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := time.now_ns()``</span> | ``output`` is a ``number`` representing the current time since epoch in nanoseconds. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.parse_ns(layout, value)``</span> | ``output`` is a ``number`` representing the time ``value`` in nanoseconds since epoch; or ``undefined`` if outside the valid time range that can fit within an ``int64``. See the [Go `time` package documentation](https://golang.org/pkg/time/#Parse) for more details on ``layout``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.parse_rfc3339_ns(value)``</span> | ``output`` is a ``number`` representing the time ``value`` in nanoseconds since epoch; or ``undefined`` if outside the valid time range that can fit within an ``int64``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.parse_duration_ns(duration)``</span> | ``output`` is a ``number`` representing the duration ``duration`` in nanoseconds. See the [Go `time` package documentation](https://golang.org/pkg/time/#ParseDuration) for more details on ``duration``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.date(ns)``<br/>``output := time.date([ns, tz])``</span> | ``output`` is of the form ``[year, month, day]``, which includes the ``year``, ``month`` (0-12), and ``day`` (0-31) as ``number``s representing the date from the nanoseconds since epoch (``ns``) in the timezone (``tz``), if supplied, or as UTC.| ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.clock(ns)``<br/>``output := time.clock([ns, tz])``</span> | ``output`` is of the form ``[hour, minute, second]``, which outputs the ``hour``, ``minute`` (0-59), and ``second`` (0-59) as ``number``s representing the time of day for the nanoseconds since epoch (``ns``) in the timezone (``tz``), if supplied, or as UTC. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``day := time.weekday(ns)``<br/>``day := time.weekday([ns, tz])``</span> | outputs the ``day`` as ``string`` representing the day of the week for the nanoseconds since epoch (``ns``) in the timezone (``tz``), if supplied, or as UTC. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.add_date(ns, years, months, days)``</span> | ``output`` is a ``number`` representing the time since epoch in nanoseconds after adding the ``years``, ``months`` and ``days`` to ``ns``; or ``undefined`` if outside the valid time range that can fit within an ``int64``. See the [Go `time` package documentation](https://golang.org/pkg/time/#Time.AddDate) for more details on ``add_date``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := time.diff(ns1, ns2)``<br/>``output := time.diff([ns1, tz1], [ns2, tz2])``</span> | ``output`` is of the form ``[year(s), month(s), day(s), hour(s), minute(s), second(s)]``, which outputs ``year(s)``, ``month(s)`` (0-11), ``day(s)`` (0-30),  ``hour(s)``(0-23), ``minute(s)``(0-59) and ``second(s)``(0-59)  as ``number``s representing the  difference between the the two timestamps in nanoseconds since epoch (``ns1`` and ``ns2``), in the timezones (``tz1`` and ``tz2``, respectively), if supplied, or as UTC. | ``SDK-dependent`` |
-
-> Multiple calls to the `time.now_ns` built-in function within a single policy
+{{< info >}}
+Multiple calls to the `time.now_ns` built-in function within a single policy
 evaluation query will always return the same value.
+{{< /info >}}
 
 Timezones can be specified as
 
@@ -818,30 +701,48 @@ Timezones can be specified as
 * "UTC" or "", which are equivalent to not passing a timezone (i.e. will return as UTC)
 * "Local", which will use the local timezone.
 
-Note that the opa executable will need access to the timezone files in the environment it is running in (see the [Go time.LoadLocation()](https://golang.org/pkg/time/#LoadLocation) documentation for more information).
+Note that the opa executable will need access to the timezone files in the environment it is running in (see the [Go `time.LoadLocation()`](https://pkg.go.dev/time#LoadLocation) documentation for more information).
 
-### Cryptography
+#### Timestamp Parsing
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := crypto.x509.parse_certificates(certs)``</span> | ``certs`` is base64 encoded DER or PEM data containing one or more certificates or a PEM string of one or more certificates. ``output`` is an array of X.509 certificates represented as JSON objects. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.x509.parse_and_verify_certificates(certs)``</span> | ``certs`` is base64 encoded DER or PEM data containing two or more certificates where the first is a root CA, the last is a leaf certificate, and all others are intermediate CAs. ``output`` is of the form ``[valid, certs]``. If the input certificate chain could be verified then ``valid`` is ``true`` and ``certs`` is an array of X.509 certificates represented as JSON objects. If the input certificate chain could not be verified then ``valid`` is ``false`` and ``certs`` is ``[]``. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.x509.parse_certificate_request(csr)``</span> | ``csr`` is a base64 string containing either a PEM encoded or DER CSR or a string containing a PEM CSR.``output`` is an X.509 CSR represented as a JSON object. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.x509.parse_rsa_private_key(pem)``</span> | ``pem`` is a base64 string containing a PEM encoded RSA private key.``output`` is a JWK as a JSON object. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.md5(string)``</span> | ``output`` is ``string`` md5 hashed. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.sha1(string)``</span> | ``output`` is ``string`` sha1 hashed. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.sha256(string)``</span> | ``output`` is ``string`` sha256 hashed. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.hmac.md5(string, key)``</span> | ``output`` is HMAC-MD5 of ``string`` using ``key`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.hmac.sha1(string, key)``</span> | ``output`` is HMAC-SHA-1 of ``string`` using ``key`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.hmac.sha256(string, key)``</span> | ``output`` is HMAC-SHA-256 of ``string`` using ``key`` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := crypto.hmac.sha512(string, key)``</span> | ``output`` is HMAC-SHA-512 of ``string`` using ``key`` | ``SDK-dependent`` |
-
-### Graphs
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``walk(x, [path, value])``</span> | ``walk`` is a relation that produces ``path`` and ``value`` pairs for documents under ``x``. ``path`` is ``array`` representing a pointer to ``value`` in ``x``.  Queries can use ``walk`` to traverse documents nested under ``x`` (recursively). | ✅ |
-| <span class="opa-keep-it-together">``output := graph.reachable(graph, initial)``</span> | ``output`` is the set of vertices [reachable](https://en.wikipedia.org/wiki/Reachability) from the ``initial`` vertices in the directed ``graph``.  ``initial`` is a set or array of vertices, and ``graph`` is an object containing a set or array of neighboring vertices. | ✅ |
+OPA can parse timestamps of nearly arbitrary formats, and currently accepts the same inputs as Go's `time.Parse()` utility.
+As a result, you **must** describe the format of your timestamps using the Reference Timestamp that Go's `time` module expects:
+
+    2006-01-02T15:04:05Z07:00
+
+In other date formats, that same value is rendered as:
+
+ - January 2, 15:04:05, 2006, in time zone seven hours west of GMT
+ - Unix time: `1136239445`
+ - Unix `date` command output: `Mon Jan 2 15:04:05 MST 2006`
+ - RFC3339 timestamp: `2006-01-02T15:04:05Z07:00`
+
+Examples of valid values for each timestamp field:
+
+ - Year: `"2006"` `"06"`
+ - Month: `"Jan"` `"January"` `"01"` `"1"`
+ - Day of the week: `"Mon"` `"Monday"`
+ - Day of the month: `"2"` `"_2"` `"02"`
+ - Day of the year: `"__2"` `"002"`
+ - Hour: `"15"` `"3"` `"03"` (PM or AM)
+ - Minute: `"4"` `"04"`
+ - Second: `"5"` `"05"`
+ - AM/PM mark: `"PM"`
+
+For formatting of nanoseconds, time zones, and other fields, see the [Go `time/format` module documentation](https://cs.opensource.google/go/go/+/master:src/time/format.go;l=9-100).
+
+#### Timestamp Parsing Example
+
+In OPA, we can parse a simple `YYYY-MM-DD` timestamp as follows:
+
+```live:time/parse_ns/example:module
+ts := "1985-10-27"
+result := time.parse_ns("2006-01-02", ts)
+```
+
+{{< builtin-table cat=crypto title=Cryptography >}}
+
+{{< builtin-table cat=graph title=Graphs >}}
 
 A common class of recursive rules can be reduced to a graph reachability
 problem, so `graph.reachable` is useful for more than just graph analysis.
@@ -851,19 +752,19 @@ shows you how to "flatten" a hierarchy of access permissions.
 ```live:graph/reachable/example:module
 package graph_reachable_example
 
-org_chart_data = {
+org_chart_data := {
   "ceo": {},
   "human_resources": {"owner": "ceo", "access": ["salaries", "complaints"]},
   "staffing": {"owner": "human_resources", "access": ["interviews"]},
   "internships": {"owner": "staffing", "access": ["blog"]}
 }
 
-org_chart_graph[entity_name] = edges {
+org_chart_graph[entity_name] := edges {
   org_chart_data[entity_name]
   edges := {neighbor | org_chart_data[neighbor].owner == entity_name}
 }
 
-org_chart_permissions[entity_name] = access {
+org_chart_permissions[entity_name] := access {
   org_chart_data[entity_name]
   reachable := graph.reachable(org_chart_graph, {entity_name})
   access := {item | reachable[k]; item := org_chart_data[k].access[_]}
@@ -875,11 +776,72 @@ org_chart_permissions[entity_name]
 ```live:graph/reachable/example:output
 ```
 
-### HTTP
+It may be useful to find all reachable paths from a root element. `graph.reachable_paths` can be used for this. Note that cyclical paths will terminate on the repeated node. If an element references a nonexistent element, the path will be terminated, and excludes the nonexistent node.
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``response := http.send(request)``</span> | ``http.send`` executes an HTTP `request` and returns a `response`. | ``SDK-dependent`` |
+```live:graph/reachable_paths/example:module
+package graph_reachable_paths_example
+
+path_data := {
+    "aTop": [],
+    "cMiddle": ["aTop"],
+    "bBottom": ["cMiddle"],
+    "dIgnored": []
+}
+
+all_paths[root] := paths {
+    path_data[root]
+    paths := graph.reachable_paths(path_data, {root})
+}
+```
+```live:graph/reachable_paths/example:query
+all_paths[entity_name]
+```
+```live:graph/reachable_paths/example:output
+```
+
+{{< builtin-table cat=graphql title="GraphQL" >}}
+
+{{< info >}}
+Custom [GraphQL `@directive`](http://spec.graphql.org/October2021/#sec-Language.Directives) definitions defined by your GraphQL framework will need to be included manually as part of your GraphQL schema string in order for validation to work correctly on GraphQL queries using those directives.
+
+Directives defined as part of the GraphQL specification (`@skip`, `@include`, `@deprecated`, and `@specifiedBy`) are supported by default, and do not need to be added to your schema manually.
+{{< /info >}}
+
+#### GraphQL Custom `@directive` Example
+
+New `@directive` definitions can be defined separately from your schema, so long as you `concat` them onto the schema definition before attempting to validate a query/schema using those custom directives.
+In the following example, a custom directive is defined, and then used in the schema to annotate an argument on one of the allowed query types.
+
+```live:graphql/custom_directive/example:module
+package graphql_custom_directive_example
+
+custom_directives := `
+directive @customDeprecatedArgs(
+  reason: String
+) on ARGUMENT_DEFINITION
+`
+
+schema := `
+type Query {
+    foo(name: String! @customDeprecatedArgs(reason: "example reason")): String,
+    bar: String!
+}
+`
+
+query := `query { foo(name: "example") }`
+
+p {
+    graphql.is_valid(query,  concat("", [custom_directives, schema]))
+}
+```
+
+{{< builtin-table cat=http title=HTTP >}}
+
+
+{{< info >}}
+Similar to other built-in functions, multiple calls to the `http.send` built-in function for a given request object
+within a single policy evaluation query will always return the same value.
+{{< /info >}}
 
 {{< danger >}}
 This built-in function **must not** be used for effecting changes in
@@ -889,33 +851,35 @@ to automatic performance optimizations that are applied during policy evaluation
 
 The `request` object parameter may contain the following fields:
 
-| Field | Required | Type | Description |
-| --- | --- | --- | --- |
-| `url` | yes | `string` | HTTP URL to specify in the request (e.g., `"https://www.openpolicyagent.org"`). |
-| `method` | yes | `string` | HTTP method to specify in request (e.g., `"GET"`, `"POST"`, `"PUT"`, etc.) |
-| `body` | no | `any` | HTTP message body to include in request. The value will be serialized to JSON. |
-| `raw_body` | no | `string` | HTTP message body to include in request. The value WILL NOT be serialized. Use this for non-JSON messages. |
-| `headers` | no | `object` | HTTP headers to include in the request (e.g,. `{"X-Opa": "rules"}`). |
-| `enable_redirect` | no | `boolean` | Follow HTTP redirects. Default: `false`. |
-| `force_json_decode` | no | `boolean` | Decode the HTTP response message body as JSON even if the `Content-Type` header is missing. Default: `false`. |
-| `tls_use_system_certs` | no | `boolean` | Use the system certificate pool. Default: `true` when `tls_ca_cert`, `tls_ca_cert_file`, `tls_ca_cert_env_variable` are unset. **Ignored on Windows** due to the system certificate pool not being accessible in the same way as it is for other platforms. |
-| `tls_ca_cert` | no | `string` | String containing a root certificate in PEM encoded format. |
-| `tls_ca_cert_file` | no | `string` | Path to file containing a root certificate in PEM encoded format. |
-| `tls_ca_cert_env_variable` | no | `string` | Environment variable containing a root certificate in PEM encoded format. |
-| `tls_client_cert` | no | `string` | String containing a client certificate in PEM encoded format. |
-| `tls_client_cert_file` | no | `string` | Path to file containing a client certificate in PEM encoded format. |
-| `tls_client_cert_env_variable` | no | `string` | Environment variable containing a client certificate in PEM encoded format. |
-| `tls_client_key` | no | `string` | String containing a key in PEM encoded format. |
-| `tls_client_key_file` | no | `string` | Path to file containing a key in PEM encoded format. |
-| `tls_client_key_env_variable` | no | `string` | Environment variable containing a client key in PEM encoded format. |
-| `timeout` | no | `string` or `number` | Timeout for the HTTP request with a default of 5 seconds (`5s`). Numbers provided are in nanoseconds. Strings must be a valid duration string where a duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". A zero timeout means no timeout.|
-| `tls_insecure_skip_verify` | no | `bool` | Allows for skipping TLS verification when calling a network endpoint. Not recommended for production. |
-| `tls_server_name` | no | `string` | Sets the hostname that is sent in the client Server Name Indication and that be will be used for server certificate validation. If this is not set, the value of the `Host` header (if present) will be used. If neither are set, the host name from the requested URL is used. |
-| `cache` | no | `boolean` | Cache HTTP response across OPA queries. Default: `false`. |
-| `force_cache` | no | `boolean` | Cache HTTP response across OPA queries and override cache directives defined by the server. Default: `false`. |
-| `force_cache_duration_seconds` | no | `number` | If `force_cache` is set, this field specifies the duration in seconds for the freshness of a cached response. |
+| Field | Required | Type | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| --- | --- | --- |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `url` | yes | `string` | HTTP URL to specify in the request (e.g., `"https://www.openpolicyagent.org"`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `method` | yes | `string` | HTTP method to specify in request (e.g., `"GET"`, `"POST"`, `"PUT"`, etc.)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `body` | no | `any` | HTTP message body to include in request. The value will be serialized to JSON.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `raw_body` | no | `string` | HTTP message body to include in request. The value WILL NOT be serialized. Use this for non-JSON messages.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `headers` | no | `object` | HTTP headers to include in the request (e.g,. `{"X-Opa": "rules"}`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `enable_redirect` | no | `boolean` | Follow HTTP redirects. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `force_json_decode` | no | `boolean` | Decode the HTTP response message body as JSON even if the `Content-Type` header is missing. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `force_yaml_decode` | no | `boolean` | Decode the HTTP response message body as YAML even if the `Content-Type` header is missing. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `tls_use_system_certs` | no | `boolean` | Use the system certificate pool. Default: `true` when `tls_ca_cert`, `tls_ca_cert_file`, `tls_ca_cert_env_variable` are unset. **Ignored on Windows** due to the system certificate pool not being accessible in the same way as it is for other platforms.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `tls_ca_cert` | no | `string` | String containing a root certificate in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `tls_ca_cert_file` | no | `string` | Path to file containing a root certificate in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `tls_ca_cert_env_variable` | no | `string` | Environment variable containing a root certificate in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `tls_client_cert` | no | `string` | String containing a client certificate in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `tls_client_cert_file` | no | `string` | Path to file containing a client certificate in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `tls_client_cert_env_variable` | no | `string` | Environment variable containing a client certificate in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `tls_client_key` | no | `string` | String containing a key in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `tls_client_key_file` | no | `string` | Path to file containing a key in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `tls_client_key_env_variable` | no | `string` | Environment variable containing a client key in PEM encoded format.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `timeout` | no | `string` or `number` | Timeout for the HTTP request with a default of 5 seconds (`5s`). Numbers provided are in nanoseconds. Strings must be a valid duration string where a duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". A zero timeout means no timeout.                                                                                                                                                                                                                                                                                                                                                                                         |
+| `tls_insecure_skip_verify` | no | `bool` | Allows for skipping TLS verification when calling a network endpoint. Not recommended for production.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `tls_server_name` | no | `string` | Sets the hostname that is sent in the client Server Name Indication and that be will be used for server certificate validation. If this is not set, the value of the `Host` header (if present) will be used. If neither are set, the host name from the requested URL is used.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `cache` | no | `boolean` | Cache HTTP response across OPA queries. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `force_cache` | no | `boolean` | Cache HTTP response across OPA queries and override cache directives defined by the server. Default: `false`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `force_cache_duration_seconds` | no | `number` | If `force_cache` is set, this field specifies the duration in seconds for the freshness of a cached response.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `caching_mode` | no | `string` | Controls the format in which items are inserted into the inter-query cache. Allowed modes are `serialized` and `deserialized`. In the `serialized` mode, items will be serialized before inserting into the cache. This mode is helpful if memory conservation is preferred over higher latency during cache lookup. This is the default mode. In the `deserialized` mode, an item will be inserted in the cache without any serialization. This means when items are fetched from the cache, there won't be a need to decode them. This mode helps to make the cache lookup faster at the expense of more memory consumption. If this mode is enabled, the configured `caching.inter_query_builtin_cache.max_size_bytes` value will be ignored. This means an unlimited cache size will be assumed. |
-| `raise_error` | no | `bool` | If `raise_error` is set, errors returned by `http.send` will halt policy evaluation. Default: `true`. |
+| `raise_error` | no | `bool` | If `raise_error` is set, errors returned by `http.send` will halt policy evaluation. Default: `true`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `max_retry_attempts` | no | `number` | Number of times to retry a HTTP request when a network error is encountered. If provided, retries are performed with an exponential backoff delay. Default: `0`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 
 If the `Host` header is included in `headers`, its value will be used as the `Host` header of the request. The `url` parameter will continue to specify the server to connect to.
 
@@ -925,7 +889,9 @@ When sending HTTPS requests with client certificates at least one the following
  * ``tls_client_cert_file`` and ``tls_client_key_file``
  * ``tls_client_cert_env_variable`` and ``tls_client_key_env_variable``
 
-> To validate TLS server certificates, the user must also provide trusted root CA certificates through the ``tls_ca_cert``, ``tls_ca_cert_file`` and ``tls_ca_cert_env_variable`` fields. If the ``tls_use_system_certs`` field is ``true``, the system certificate pool will be used as well as any additional CA certificates.
+{{< info >}}
+To validate TLS server certificates, the user must also provide trusted root CA certificates through the ``tls_ca_cert``, ``tls_ca_cert_file`` and ``tls_ca_cert_env_variable`` fields. If the ``tls_use_system_certs`` field is ``true``, the system certificate pool will be used as well as any additional CA certificates.
+{{< /info >}}
 
 The `response` object parameter will contain the following fields:
 
@@ -933,7 +899,7 @@ The `response` object parameter will contain the following fields:
 | --- | --- | --- |
 | `status` | `string` | HTTP status message (e.g., `"200 OK"`). |
 | `status_code` | `number` | HTTP status code (e.g., `200`). If `raise_error` is `false`, this field will be set to `0` if `http.send` encounters an error. |
-| `body` | `any` | Any JSON value. If the HTTP response message body was not deserialized from JSON, this field is set to `null`. |
+| `body` | `any` | Any value. If the HTTP response message body was not deserialized from JSON or YAML (by force or via the expected Content-Type headers `application/json`; or `application/yaml` or `application/x-yaml`), this field is set to `null`. |
 | `raw_body` | `string` | The entire raw HTTP response message body represented as a string. |
 | `headers` | `object` | An object containing the response headers. The values will be an array of strings, repeated headers are grouped under the same keys with all values in the array. |
 | `error` | `object` | If `raise_error` is `false`, this field will represent the error encountered while running `http.send`. The `error` object contains a `message` key which holds the actual error message and a `code` key which represents if the error was caused due to a network issue or during policy evaluation. |
@@ -943,7 +909,8 @@ instead of halting evaluation, if `http.send` encounters an error, it can return
 set to `0` and `error` describing the actual error. This can be activated by setting the `raise_error` field
 in the `request` object to `false`.
 
-If the `cache` field in the `request` object is `true`, `http.send` will return a cached response after it checks its freshness and validity.
+If the `cache` field in the `request` object is `true`, `http.send` will return a cached response after it checks its
+freshness and validity.
 
 `http.send` uses the `Cache-Control` and `Expires` response headers to check the freshness of the cached response.
 Specifically if the [max-age](https://tools.ietf.org/html/rfc7234#section-5.2.2.8) `Cache-Control` directive is set, `http.send`
@@ -960,11 +927,17 @@ conjunction with the `force_cache_duration_seconds` field. If `force_cache` is `
 
 Also, if `force_cache` is `true`, it overrides the `cache` field.
 
-> `http.send` uses the `Date` response header to calculate the current age of the response by comparing it with the current time.
-> This value is used to determine the freshness of the cached response. As per https://tools.ietf.org/html/rfc7231#section-7.1.1.2,
-> an origin server MUST NOT send a `Date` header field if it does not have a clock capable of providing a reasonable
-> approximation of the current instance in Coordinated Universal Time. Hence, if `http.send` encounters a scenario where current
-> age of the response is represented as a negative duration, the cached response will be considered as stale.
+`http.send` only caches responses with the following HTTP status codes: `200`, `203`, `204`, `206`, `300`, `301`,
+`404`, `405`, `410`, `414`, and `501`. This is behavior is as per https://www.rfc-editor.org/rfc/rfc7231#section-6.1 and
+is enforced when caching responses within a single query or across queries via the `cache` and `force_cache` request fields.
+
+{{< info >}}
+`http.send` uses the `Date` response header to calculate the current age of the response by comparing it with the current time.
+This value is used to determine the freshness of the cached response. As per https://tools.ietf.org/html/rfc7231#section-7.1.1.2,
+an origin server MUST NOT send a `Date` header field if it does not have a clock capable of providing a reasonable
+approximation of the current instance in Coordinated Universal Time. Hence, if `http.send` encounters a scenario where current
+age of the response is represented as a negative duration, the cached response will be considered as stale.
+{{< /info >}}
 
 The table below shows examples of calling `http.send`:
 
@@ -975,24 +948,95 @@ The table below shows examples of calling `http.send`:
 | Environment variables containing TLS material | ``http.send({"method": "get", "url": "https://127.0.0.1:65360", "tls_ca_cert_env_variable": "CLIENT_CA_ENV", "tls_client_cert_env_variable": "CLIENT_CERT_ENV", "tls_client_key_env_variable": "CLIENT_KEY_ENV"})`` |
 | Unix Socket URL Format| ``http.send({"method": "get", "url": "unix://localhost/?socket=%F2path%F2file.socket"})`` |
 
-### Net
+{{< builtin-table cat=providers.aws title=AWS >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``net.lookup_ip_addr(name)``</span> | `output` is a set of IP addresses (both v4 and v6, strings) that the domain name resolves to using standard name resolution, [see the notes below](#notes-on-name-resolution-netlookup_ip_addr). | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``net.cidr_contains(cidr, cidr_or_ip)``</span> | `output` is `true` if `cidr_or_ip` (e.g. `127.0.0.64/26` or `127.0.0.1`) is contained within `cidr` (e.g. `127.0.0.1/24`) and false otherwise. Supports both IPv4 and IPv6 notations.| ✅ |
-| <span class="opa-keep-it-together">``output := net.cidr_contains_matches(cidrs, cidrs_or_ips)``</span> | `output` is a `set` of tuples identifying matches where `cidrs_or_ips` are contained within `cidrs`. This function is similar to `net.cidr_contains` except it allows callers to pass collections of CIDRs or IPs as arguments and returns the matches (as opposed to a boolean result indicating a match between two CIDRs/IPs.) See below for examples. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``net.cidr_intersects(cidr1, cidr2)``</span> | `output` is `true` if `cidr1` (e.g. `192.168.0.0/16`) overlaps with `cidr2` (e.g. `192.168.1.0/24`) and false otherwise. Supports both IPv4 and IPv6 notations.| ✅ |
-| <span class="opa-keep-it-together">``net.cidr_expand(cidr)``</span> | `output` is the set of hosts in `cidr`  (e.g., `net.cidr_expand("192.168.0.0/30")` generates 4 hosts: `{"192.168.0.0", "192.168.0.1", "192.168.0.2", "192.168.0.3"}` | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``net.cidr_merge(cidrs_or_ips)``</span> | `output` is the smallest possible set of CIDRs obtained after merging the provided list of IP addresses and subnets in `cidrs_or_ips`  (e.g., `net.cidr_merge(["192.0.128.0/24", "192.0.129.0/24"])` generates `{"192.0.128.0/23"}`. This function merges adjacent subnets where possible, those contained within others and also removes any duplicates. Supports both IPv4 and IPv6 notations. | ``SDK-dependent`` |
+The AWS Request Signing builtin in OPA implements the header-based auth,
+single-chunk method described in the [AWS SigV4 docs](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html).
+It will always sign the payload when present, and will sign most user-provided
+headers for the request, to ensure their integrity.
+
+{{< info >}}
+Note that the `authorization`, `user-agent`, and `x-amzn-trace-id` headers,
+are commonly modified by proxy systems, and as such are ignored by OPA
+for signing.
+{{< /info >}}
+
+The `request` object parameter may contain any and all of the same fields as for `http.send`.
+The following fields will have effects on the output `Authorization` header signature:
+
+| Field | Required | Type | Description |
+| --- | --- | --- | --- |
+| `url` | yes | `string` | HTTP URL to specify in the request. Used in the signature. |
+| `method` | yes | `string` | HTTP method to specify in request. Used in the signature. |
+| `body` | no | `any` | HTTP message body. The JSON serialized version of this value will be used for the payload portion of the signature if present. |
+| `raw_body` | no | `string` | HTTP message body. This will be used for the payload portion of the signature if present. |
+| `headers` | no | `object` | HTTP headers to include in the request. These will be added to the list of headers to sign. |
+
+The `aws_config` object parameter may contain the following fields:
+
+| Field | Required | Type | Description |
+| --- | --- | --- | --- |
+| `aws_access_key` | yes | `string` | AWS access key. |
+| `aws_secret_access_key` | yes | `string` | AWS secret access key. Used in generating the signing key for the request. |
+| `aws_service` | yes | `string` | AWS service the request will be valid for. (e.g. `"s3"`) |
+| `aws_region` | yes | `string` | AWS region for the request. (e.g. `"us-east-1"`) |
+| `aws_session_token` | no | `string` | AWS security token. Used for the `x-amz-security-token` request header. |
+
+#### AWS Request Signing Examples
+
+##### Basic Request Signing Example
+The example below shows using hard-coded AWS credentials for signing the request
+object for `http.send`.
+
+{{< info >}}
+For deployments, a common way to provide AWS credentials is via environment
+variables, usually by using the results of `opa.runtime().env`.
+{{< /info >}}
+
+```live:providers/aws/sign_req_basic:module
+req := {"method": "get", "url": "https://examplebucket.s3.amazonaws.com/data"}
+aws_config := {
+    "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+    "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+    "aws_service": "s3",
+    "aws_region": "us-east-1",
+}
+
+example_verify_resource {
+    resp := http.send(providers.aws.sign_req(req, aws_config, time.now_ns()))
+    # process response from AWS ...
+}
+```
+
+##### Pre-Signed Request Example
+The [AWS S3 request signing API](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html)
+supports pre-signing requests, so that they will only be valid at a future date.
+To do this in OPA, simply adjust the time parameter:
+
+```live:providers/aws/sign_req_presign:module
+env := opa.runtime().env
+req := {"method": "get", "url": "https://examplebucket.s3.amazonaws.com/data"}
+aws_config := {
+    "aws_access_key": env["AWS_ACCESS_KEY"],
+    "aws_secret_access_key": env["AWS_SECRET_ACCESS_KEY"],
+    "aws_service": "s3",
+    "aws_region": env["AWS_REGION"],
+}
+# Request will become valid 2 days from now.
+signing_time := time.add_date(time.now_ns(), 0, 0, 2)
+
+pre_signed_req := providers.aws.sign_req(req, aws_config, signing_time))
+```
+
+{{< builtin-table net >}}
 
 #### Notes on Name Resolution (`net.lookup_ip_addr`)
 
 The lookup mechanism uses either the pure-Go, or the cgo-based resolver, depending on the operating system and availability of cgo.
-The latter depends on flags that can be provided when building OPA as a Go library, and can be adjusted at runtime via the GODEBUG enviroment variable.
+The latter depends on flags that can be provided when building OPA as a Go library, and can be adjusted at runtime via the GODEBUG environment variable.
 See [these docs on the `net` package](https://pkg.go.dev/net@go1.17.3#hdr-Name_Resolution) for details.
 
-Note that the cgo-based resolver is often **preferrable**: It will take advantage of host-based DNS caching in place.
+Note that the cgo-based resolver is often **preferable**: It will take advantage of host-based DNS caching in place.
 This built-in function only caches DNS lookups within _a single_ policy evaluation.
 
 #### Examples of `net.cidr_contains_matches`
@@ -1047,36 +1091,166 @@ net.cidr_contains_matches({["1.1.0.0/16", "foo"], "1.1.2.0/24"}, {"x": "1.1.1.12
 ```live:netcidrcontainsmatches/sets_and_objects:output:merge_down
 ```
 
-### UUID
+{{< builtin-table cat=uuid title=UUID >}}
+{{< builtin-table cat=semver title="Semantic Versions" >}}
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := uuid.rfc4122(str)``</span> | ``output`` is ``string`` representing a version 4 uuid. For any given str the output will be consistent throughout a query evaluation. | ``SDK-dependent`` |
+#### Example of `semver.is_valid`
 
-### Semantic Versions
+The `result := semver.is_valid(vsn)` function checks to see if a version
+string is of the form: `MAJOR.MINOR.PATCH[-PRERELEASE][+METADATA]`, where
+items in square braces are optional elements.
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := semver.is_valid(str)``</span> | ``output`` is a ``boolean``. ``true`` means the input is a valid SemVer string (e.g. "1.0.0"). ``false`` is returned for invalid version strings and non-string input. | ``SDK-dependent`` |
-| <span class="opa-keep-it-together">``output := semver.compare(str, str)``</span> | ``output`` is a ``number``. ``-1`` means the version in the first operand is less than the second. ``1`` means the version in the first operand is greater than the second. ``0`` means the versions are equal. Only valid SemVer strings are accepted e.g. ``1.2.3`` or ``0.1.0`` | ``SDK-dependent`` |
+When working with Go-style semantic versions, remember to remove the
+leading `v` character, or the semver string will be marked as invalid!
 
-### Rego
+```live:semverisvalid:module:hidden
+package semverisvalid
+```
+```live:semverisvalid/invalid:query:merge_down
+semver.is_valid("v1.1.12-rc1+foo")
+```
+```live:semverisvalid/invalid:output
+```
+```live:semverisvalid/valid:query:merge_down
+semver.is_valid("1.1.12-rc1+foo")
+```
+```live:semverisvalid/valid:output
+```
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := rego.parse_module(filename, string)``</span> | ``rego.parse_module`` parses the input ``string`` as a Rego module and returns the AST as a JSON object ``output``. | ``SDK-dependent`` |
+{{< builtin-table rego >}}
 
-### OPA
+#### Example
 
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``output := opa.runtime()``</span> | ``opa.runtime`` returns a JSON object ``output`` that describes the runtime environment where OPA is deployed. **Caution**: Policies that depend on the output of ``opa.runtime`` may return different answers depending on how OPA was started. If possible, prefer using an explicit `input` or `data` value instead of `opa.runtime`. The ``output`` of ``opa.runtime`` will include a ``"config"`` key if OPA was started with a configuration file. The ``output`` of ``opa.runtime`` will include a ``"env"`` key containing the environment variables that the OPA process was started with. The ``output`` of ``opa.runtime`` will include ``"version"`` and ``"commit"`` keys containing the semantic version and build commit of OPA. | ``SDK-dependent`` |
+Given the input document
+
+```live:example/metadata/1:input
+{
+    "number": 11,
+    "subject": {
+        "name": "John doe",
+        "role": "customer"
+    }
+}
+```
+
+the following policy
+
+```live:example/metadata/1:module
+package example
+
+# METADATA
+# title: Deny invalid numbers
+# description: Numbers may not be higher than 5
+# custom:
+#  severity: MEDIUM
+deny[format(rego.metadata.rule())] {
+    input.number > 5
+}
+
+# METADATA
+# title: Deny non-admin subjects
+# description: Subject must have the 'admin' role
+# custom:
+#  severity: HIGH
+deny[format(rego.metadata.rule())] {
+    input.subject.role != "admin"
+}
+
+format(meta) := {"severity": meta.custom.severity, "reason": meta.description}
+```
+
+will output
+
+```live:example/metadata/1:query:merge_down
+deny
+```
+```live:example/metadata/1:output
+```
+
+#### Metadata Merge strategies
+
+When multiple [annotations](../annotations) are declared along the path ancestry (chain) for a rule, how any given annotation should be selected, inherited or merged depends on the semantics of the annotation, the context of the rule, and the preferences of the developer.
+OPA doesn't presume what merge strategy is appropriate; instead, this lies in the hands of the developer. The following example demonstrates how some string and list type annotations in a metadata chain can be merged into a single metadata object.
+
+```live:rego/metadata:module:read_only
+# METADATA
+# title: My Example Package
+# description: A set of rules illustrating how metadata annotations can be merged.
+# authors:
+# - John Doe <john@example.com>
+# organizations:
+# - Acme Corp.
+package example
+
+import future.keywords.in
+
+# METADATA
+# scope: document
+# description: A rule that merges metadata annotations in various ways.
+
+# METADATA
+# title: My Allow Rule
+# authors:
+# - Jane Doe <jane@example.com>
+allow {
+    meta := merge(rego.metadata.chain())
+    meta.title == "My Allow Rule"                                                  # 'title' pulled from 'rule' scope
+    meta.description == "A rule that merges metadata annotations in various ways." # 'description' pulled from 'document' scope
+    meta.authors == {                                                              # 'authors' joined from 'package' and 'rule' scopes
+        {"email": "jane@example.com", "name": "Jane Doe"},
+        {"email": "john@example.com", "name": "John Doe"}
+    }
+    meta.organizations == {"Acme Corp."}                                           # 'organizations' pulled from 'package' scope
+}
+
+allow {
+    meta := merge(rego.metadata.chain())
+    meta.title == null                                                             # No 'title' present in 'rule' or 'document' scopes
+    meta.description == "A rule that merges metadata annotations in various ways." # 'description' pulled from 'document' scope
+    meta.authors == {                                                              # 'authors' pulled from 'package' scope
+        {"email": "john@example.com", "name": "John Doe"}
+    }
+    meta.organizations == {"Acme Corp."}                                           # 'organizations' pulled from 'package' scope
+}
+
+merge(chain) := meta {
+    ruleAndDoc := ["rule", "document"]
+    meta := {
+        "title": override_annot(chain, "title", ruleAndDoc),                         # looks for 'title' in 'rule' scope, then 'document' scope
+        "description": override_annot(chain, "description", ruleAndDoc),             # looks for 'description' in 'rule' scope, then 'document' scope
+        "related_resources": override_annot(chain, "related_resources", ruleAndDoc), # looks for 'related_resources' in 'rule' scope, then 'document' scope
+        "authors": merge_annot(chain, "authors"),                                    # merges all 'authors' across all scopes
+        "organizations": merge_annot(chain, "organizations"),                        # merges all 'organizations' across all scopes
+    }
+}
+
+override_annot(chain, name, scopes) := val {
+    val := [v |
+        link := chain[_]
+        link.annotations.scope in scopes
+        v := link.annotations[name]
+    ][0]
+} else := null
+
+merge_annot(chain, name) := val {
+    val := {v |
+        v := chain[_].annotations[name][_]
+    }
+} else := null
+```
+
+{{< builtin-table cat=opa title=OPA >}}
+
+{{< danger >}}
+Policies that depend on the output of `opa.runtime` may return different answers depending on how OPA was started.
+If possible, prefer using an explicit `input` or `data` value instead of `opa.runtime`.
+{{< /danger >}}
 
 ### Debugging
 
-| Built-in | Description | Wasm Support |
+| Built-in | Description | Details |
 | ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``print(...)``</span> | ``print`` is used to output the values of variables for debugging purposes. ``print`` calls have no affect on the result of queries or rules. All variables passed to `print` must be assigned inside of the query or rule. If any of the `print` arguments are undefined, their values are represented as `<undefined>` in the output stream. Because policies can be invoked via different interfaces (e.g., CLI, HTTP API, etc.) the exact output format differs. See the table below for details. | ``SDK-dependent`` |
+| <span class="opa-keep-it-together">``print(...)``</span> | ``print`` is used to output the values of variables for debugging purposes. ``print`` calls have no effect on the result of queries or rules. All variables passed to `print` must be assigned inside of the query or rule. If any of the `print` arguments are undefined, their values are represented as `<undefined>` in the output stream. Because policies can be invoked via different interfaces (e.g., CLI, HTTP API, etc.) the exact output format differs. See the table below for details. | {{< builtin-tags internal.print >}} |
 
 API | Output | Memo
 --- | --- | ---
@@ -1086,19 +1260,15 @@ API | Output | Memo
 `opa run -s` (server) | `stderr` | Specify `--log-level=info` (default) or higher. Output is sent to the log stream. Use `--log-format=text` for pretty output.
 Go (library) | `io.Writer` | [https://pkg.go.dev/github.com/open-policy-agent/opa/rego#example-Rego-Print_statements](https://pkg.go.dev/github.com/open-policy-agent/opa/rego#example-Rego-Print_statements)
 
-### Tracing
-
-| Built-in | Description | Wasm Support |
-| ------- |-------------|---------------|
-| <span class="opa-keep-it-together">``trace(string)``</span> | ``trace`` emits ``string`` as a ``Note`` event in the query explanation. Query explanations show the exact expressions evaluated by OPA during policy execution. For example, ``trace("Hello There!")`` includes ``Note "Hello There!"`` in the query explanation. To include variables in the message, use ``sprintf``. For example, ``person := "Bob"; trace(sprintf("Hello There! %v", [person]))`` will emit ``Note "Hello There! Bob"`` inside of the explanation. | ``SDK-dependent`` |
+{{< builtin-table tracing >}}
 
 By default, explanations are disabled. The following table summarizes how you can enable tracing:
 
-API | Parameter | Example | Memo
---- | --- | --- | ---
-CLI | `--explain` | `opa eval --explain=notes --format=pretty 'trace("hello world")'` |
-HTTP | `explain=notes` | `curl localhost:8181/v1/data/example/allow?explain=notes&pretty` |
-REPL | `notes` | n/a | The "notes" command enables trace explanations. See `help` for more details.
+API | Parameter | Example
+--- | --- | ---
+CLI | `--explain` | `opa eval --explain=notes --format=pretty 'trace("hello world")'`
+HTTP | `explain=notes` | `curl localhost:8181/v1/data/example/allow?explain=notes&pretty`
+REPL | n/a | `trace notes`
 
 ## Reserved Names
 
@@ -1126,27 +1296,36 @@ Rego’s syntax is defined by the following grammar:
 ```ebnf
 module          = package { import } policy
 package         = "package" ref
-import          = "import" package [ "as" var ]
+import          = "import" ref [ "as" var ]
 policy          = { rule }
 rule            = [ "default" ] rule-head { rule-body }
-rule-head       = var [ "(" rule-args ")" ] [ "[" term "]" ] [ ( ":=" | "=" ) term ]
+rule-head       = ( ref | var ) ( rule-head-set | rule-head-obj | rule-head-func | rule-head-comp )
+rule-head-comp  = [ assign-operator term ] [ "if" ]
+rule-head-obj   = "[" term "]" [ assign-operator term ] [ "if" ]
+rule-head-func  = "(" rule-args ")" [ assign-operator term ] [ "if" ]
+rule-head-set   = "contains" term [ "if" ] | "[" term "]"
 rule-args       = term { "," term }
-rule-body       = [ "else" [ "=" term ] ] "{" query "}"
+rule-body       = [ "else" [ assign-operator term ] [ "if" ] ] ( "{" query "}" ) | literal
 query           = literal { ( ";" | ( [CR] LF ) ) literal }
 literal         = ( some-decl | expr | "not" expr ) { with-modifier }
 with-modifier   = "with" term "as" term
-some-decl       = "some" var { "," var }
-expr            = term | expr-call | expr-infix
-expr-call       = var [ "." var ] "(" [ term { "," term } ] ")"
-expr-infix      = [ term "=" ] term infix-operator term
-term            = ref | var | scalar | array | object | set | array-compr | object-compr | set-compr
-array-compr     = "[" term "|" rule-body "]"
-set-compr       = "{" term "|" rule-body "}"
-object-compr    = "{" object-item "|" rule-body "}"
-infix-operator  = bool-operator | arith-operator | bin-operator
+some-decl       = "some" term { "," term } { "in" expr }
+expr            = term | expr-call | expr-infix | expr-every | expr-parens | unary-expr
+expr-call       = var [ "." var ] "(" [ expr { "," expr } ] ")"
+expr-infix      = expr infix-operator expr
+expr-every      = "every" var { "," var } "in" ( term | expr-call | expr-infix ) "{" query "}"
+expr-parens     = "(" expr ")"
+unary-expr      = "-" expr
+membership      = term [ "," term ] "in" term
+term            = ref | var | scalar | array | object | set | membership | array-compr | object-compr | set-compr
+array-compr     = "[" term "|" query "]"
+set-compr       = "{" term "|" query "}"
+object-compr    = "{" object-item "|" query "}"
+infix-operator  = assign-operator | bool-operator | arith-operator | bin-operator
 bool-operator   = "==" | "!=" | "<" | ">" | ">=" | "<="
 arith-operator  = "+" | "-" | "*" | "/"
 bin-operator    = "&" | "|"
+assign-operator = ":=" | "="
 ref             = ( var | array | object | set | array-compr | object-compr | set-compr | expr-call ) { ref-arg }
 ref-arg         = ref-arg-dot | ref-arg-brack
 ref-arg-brack   = "[" ( scalar | var | array | object | set | "_" ) "]"
@@ -1163,6 +1342,8 @@ non-empty-set   = "{" term { "," term } "}"
 empty-set       = "set(" ")"
 ```
 
+Note that the grammar corresponds to Rego with all future keywords enabled.
+
 The grammar defined above makes use of the following syntax. See [the Wikipedia page on EBNF](https://en.wikipedia.org/wiki/Extended_Backus–Naur_Form) for more details:
 
 ```
diff --git a/docs/content/policy-testing.md b/docs/content/policy-testing.md
index 66d0d67d93..0bcf8eccc2 100644
--- a/docs/content/policy-testing.md
+++ b/docs/content/policy-testing.md
@@ -14,6 +14,13 @@ framework that you can use to write _tests_ for your policies. By writing
 tests for your policies you can speed up the development process of new rules
 and reduce the amount of time it takes to modify rules as requirements evolve.
 
+{{< info >}}
+The examples in this section try to represent the best practices. As such, they
+make use of keywords that are meant to become standard keywords at some point in
+time, but have been introduced gradually.
+[See the docs on _future keywords_](../policy-language/#future-keywords) for more information.
+{{< /info >}}
+
 ## Getting Started
 
 Let's use an example to get started. The file below implements a simple
@@ -24,17 +31,16 @@ profile.
 
 ```live:example:module:read_only,openable
 package authz
+import future.keywords
 
-allow {
+allow if {
     input.path == ["users"]
     input.method == "POST"
 }
 
-allow {
-    some profile_id
-    input.path = ["users", profile_id]
+allow if {
+    input.path == ["users", input.user_id]
     input.method == "GET"
-    profile_id == input.user_id
 }
 ```
 
@@ -44,34 +50,35 @@ To test this policy, we will create a separate Rego file that contains test case
 
 ```live:example/test:module:read_only
 package authz
+import future.keywords
 
-test_post_allowed {
+test_post_allowed if {
     allow with input as {"path": ["users"], "method": "POST"}
 }
 
-test_get_anonymous_denied {
+test_get_anonymous_denied if {
     not allow with input as {"path": ["users"], "method": "GET"}
 }
 
-test_get_user_allowed {
+test_get_user_allowed if {
     allow with input as {"path": ["users", "bob"], "method": "GET", "user_id": "bob"}
 }
 
-test_get_another_user_denied {
+test_get_another_user_denied if {
     not allow with input as {"path": ["users", "bob"], "method": "GET", "user_id": "alice"}
 }
 ```
 
 Both of these files are saved in the same directory.
 
-```bash
+```console
 $ ls
 example.rego      example_test.rego
 ```
 
 To exercise the policy, run the `opa test` command in the directory containing the files.
 
-```bash
+```console
 $ opa test . -v
 data.authz.test_post_allowed: PASS (1.417µs)
 data.authz.test_get_anonymous_denied: PASS (426ns)
@@ -85,7 +92,7 @@ The `opa test` output indicates that all of the tests passed.
 
 Try exercising the tests a bit more by removing the first rule in **example.rego**.
 
-```bash
+```console
 $ opa test . -v
 FAILURES
 --------------------------------------------------------------------------------
@@ -114,8 +121,9 @@ name is prefixed with `test_`.
 
 ```live:example_format:module:read_only
 package mypackage
+import future.keywords
 
-test_some_descriptive_name {
+test_some_descriptive_name if {
     # test logic
 }
 ```
@@ -145,24 +153,19 @@ by zero condition) the test result is marked as an `ERROR`. Tests prefixed with
 
 ```live:example_results:module:read_only
 package example
+import future.keywords
 
 # This test will pass.
-test_ok {
-    true
-}
+test_ok if true
 
 # This test will fail.
-test_failure {
-    1 == 2
-}
+test_failure if 1 == 2
 
 # This test will error.
-test_error {
-    1 / 0
-}
+test_error if 1 / 0
 
 # This test will be skipped.
-todo_test_missing_implementation {
+todo_test_missing_implementation if {
     allow with data.roles as ["not", "implemented"]
 }
 ```
@@ -170,7 +173,7 @@ todo_test_missing_implementation {
 By default, `opa test` reports the number of tests executed and displays all
 of the tests that failed or errored.
 
-```bash
+```console
 $ opa test pass_fail_error_test.rego
 data.example.test_failure: FAIL (253ns)
 data.example.test_error: ERROR (289ns)
@@ -185,7 +188,7 @@ By default, OPA prints the test results in a human-readable format. If you
 need to consume the test results programmatically, use the JSON output format.
 
 ```bash
-$ opa test --format=json pass_fail_error_test.rego
+opa test --format=json pass_fail_error_test.rego
 ```
 
 ```json
@@ -233,24 +236,33 @@ $ opa test --format=json pass_fail_error_test.rego
 ]
 ```
 
-## Data Mocking
+## Data and Function Mocking
+
+OPA's `with` keyword can be used to replace the data document or called functions with mocks.
+Both base and virtual documents can be replaced.
 
-OPA's `with` keyword can be used to replace the data document. Both base and virtual documents can be replaced. Below is a simple policy that depends on the data document.
+When replacing functions, built-in or otherwise, the following constraints are in place:
+
+1. Replacing `internal.*` functions, or `rego.metadata.*`, or `eq`; or relations (`walk`) is not allowed.
+2. Replacement and replaced function need to have the same arity.
+3. Replaced functions can call the functions they're replacing, and those calls
+   will call out to the original function, and not cause recursion.
+
+Below is a simple policy that depends on the data document.
 
 **authz.rego**:
 
 ```live:with_keyword:module:read_only,openable
 package authz
+import future.keywords
 
 allow {
-    x := data.policies[_]
+    some x in data.policies
     x.name == "test_policy"
     matches_role(input.role)
 }
 
-matches_role(my_role) {
-    data.roles[my_role][_] == input.user
-}
+matches_role(my_role) if input.user in data.roles[my_role]
 ```
 
 Below is the Rego file to test the above policy.
@@ -259,69 +271,125 @@ Below is the Rego file to test the above policy.
 
 ```live:with_keyword/tests:module:read_only
 package authz
+import future.keywords
 
-policies = [{"name": "test_policy"}]
-roles = {"admin": ["alice"]}
+policies := [{"name": "test_policy"}]
+roles := {"admin": ["alice"]}
 
-test_allow_with_data {
-    allow with input as {"user": "alice", "role": "admin"}  with data.policies as policies  with data.roles as roles
+test_allow_with_data if {
+    allow with input as {"user": "alice", "role": "admin"}
+      with data.policies as policies
+      with data.roles as roles
 }
 ```
 
 To exercise the policy, run the `opa test` command.
 
-```bash
+```console
 $ opa test -v authz.rego authz_test.rego
 data.authz.test_allow_with_data: PASS (697ns)
 --------------------------------------------------------------------------------
 PASS: 1/1
 ```
 
-Below is an example to replace a rule without arguments.
+Below is an example to replace a **rule without arguments**.
 
 **authz.rego**:
 
 ```live:with_keyword_rules:module:read_only
 package authz
+import future.keywords
 
-allow1 {
-    allow2
-}
+allow1 if allow2
 
-allow2 {
-    2 == 1
-}
+allow2 if 2 == 1
 ```
 
 **authz_test.rego**:
 
 ```live:with_keyword_rules/tests:module:read_only
 package authz
+import future.keywords
 
-test_replace_rule {
+test_replace_rule if {
     allow1 with allow2 as true
 }
 ```
 
-```bash
+```console
 $  opa test -v authz.rego authz_test.rego
 data.authz.test_replace_rule: PASS (328ns)
 --------------------------------------------------------------------------------
 PASS: 1/1
 ```
 
-Functions cannot be replaced by the `with` keyword. For example, in the below policy the function `cannot_replace` cannot be replaced.
+Here is an example to replace a rule's **built-in function** with a user-defined function.
+
+**authz.rego**:
+
+```live:with_keyword_builtins:module:read_only
+package authz
+import future.keywords
+
+import data.jwks.cert
+
+allow if {
+    [true, _, _] = io.jwt.decode_verify(input.headers["x-token"], {"cert": cert, "iss": "corp.issuer.com"})
+}
+```
+
+**authz_test.rego**:
+
+```live:with_keyword_builtins/tests:module:read_only
+package authz
+import future.keywords
+
+mock_decode_verify("my-jwt", _) := [true, {}, {}]
+mock_decode_verify(x, _)        := [false, {}, {}] if x != "my-jwt"
+
+test_allow if {
+    allow
+      with input.headers["x-token"] as "my-jwt"
+      with data.jwks.cert as "mock-cert"
+      with io.jwt.decode_verify as mock_decode_verify
+}
+```
+
+```console
+$  opa test -v authz.rego authz_test.rego
+data.authz.test_allow: PASS (458.752µs)
+--------------------------------------------------------------------------------
+PASS: 1/1
+```
+
+In simple cases, a function can also be replaced with a value, as in
+
+```live:with_keyword_builtins/tests/value:module:read_only
+test_allow_value if {
+    allow
+      with input.headers["x-token"] as "my-jwt"
+      with data.jwks.cert as "mock-cert"
+      with io.jwt.decode_verify as [true, {}, {}]
+}
+```
+
+Every invocation of the function will then return the replacement value, regardless
+of the function's arguments.
+
+Note that it's also possible to replace one built-in function by another; or a non-built-in
+function by a built-in function.
 
 **authz.rego**:
 
 ```live:with_keyword_funcs:module:read_only
 package authz
+import future.keywords
 
-invalid_replace {
-    cannot_replace(input.label)
+replace_rule if {
+    replace(input.label)
 }
 
-cannot_replace(label) {
+replace(label) if {
     label == "test_label"
 }
 ```
@@ -330,15 +398,18 @@ cannot_replace(label) {
 
 ```live:with_keyword_funcs/tests:module:read_only
 package authz
+import future.keywords
 
-test_invalid_replace {
-    invalid_replace with input as {"label": "test_label"} with cannot_replace as true
+test_replace_rule if {
+    replace_rule with input.label as "does-not-matter" with replace as true
 }
 ```
 
-```bash
+```console
 $ opa test -v authz.rego authz_test.rego
-1 error occurred: authz_test.rego:4: rego_compile_error: with keyword cannot replace functions
+data.authz.test_replace_rule: PASS (648.314µs)
+--------------------------------------------------------------------------------
+PASS: 1/1
 ```
 
 
@@ -354,6 +425,10 @@ indicates one of two things:
 * If the line refers to the head of a rule, the body of the rule was never true.
 * If the line refers to an expression in a rule, the expression was never evaluated.
 
+It is also possible that [rule indexing](../policy-performance/#use-indexed-statements)
+has determined some path unnecessary for evaluation, thereby affecting the lines
+reported as covered.
+
 If we run the coverage report on the original **example.rego** file without
 `test_get_user_allowed` from **example_test**.rego the report will indicate
 that line 8 is not covered.
@@ -393,7 +468,10 @@ opa test --coverage --format=json example.rego example_test.rego
             "row": 8
           }
         }
-      ]
+      ],
+      "covered_lines": 6,
+      "not_covered_lines": 1,
+      "coverage": 85.7
     },
     "example_test.rego": {
       "covered": [
@@ -421,9 +499,13 @@ opa test --coverage --format=json example.rego example_test.rego
             "row": 12
           }
         }
-      ]
-    }
+      ],
+      "covered_lines": 6,
+      "coverage": 100
+    },
+    "covered_lines": 12,
+    "not_covered_lines": 1,
+    "coverage": 92.3
   }
 }
 ```
-
diff --git a/docs/content/privacy.md b/docs/content/privacy.md
index 044884bc48..63207edf69 100644
--- a/docs/content/privacy.md
+++ b/docs/content/privacy.md
@@ -4,24 +4,28 @@ kind: operations
 weight: 50
 ---
 
-This document provides details about OPA's anonymous version reporting feature.
+This document provides details about OPA's anonymous information reporting feature.
 
 ## Overview
 
-OPA periodically reports its version to a publicly hosted, external service. The version reports only contain the OPA
-version number (e.g., v0.12.3) and a randomly generated UUID. This feature is only applicable to the `opa run` and
-`opa version` commands.
+OPA periodically reports its version and specific anonymous runtime statistics to a publicly hosted, external service.
+The reports contain the OPA version number (e.g., v0.12.3), a randomly generated UUID and the following runtime statistics:
+
+* heap usage in bytes
+
+This feature is only applicable to the `opa run` and `opa version` commands.
 
 In case of the `opa run` command, this feature is **ON by-default** and can be easily disabled by specifying
-the `--skip-version-check` flag. When OPA is started in either the server or repl mode, OPA calls the external service
-on a best-effort basis and shares the version it's running. The time taken to execute the remote call and process the
-subsequent response from the external service does not delay OPA's start-up.
+the `--disable-telemetry` flag. When OPA is started in either the server or repl mode, OPA calls the external service
+on a best-effort basis and shares the version it's running and other statistics such as current memory usage.
+The time taken to execute the remote call and process the subsequent response from the external service does not
+delay OPA's start-up.
 
 In case of the `opa version` command, this feature can be enabled by specifying the `--check` or `-c` flag.
 
 ## External Service
 
-OPA uploads its version information by default at [telemetry.openpolicyagent.org](https://telemetry.openpolicyagent.org).
+OPA uploads its information by default at [telemetry.openpolicyagent.org](https://telemetry.openpolicyagent.org).
 The environment variable `OPA_TELEMETRY_SERVICE_URL` can be used to configure the external service OPA reports to.
 
 Sample HTTP request from OPA to the external service looks like this:
@@ -36,7 +40,8 @@ User-Agent: "Open Policy Agent/v0.12.3 (darwin, amd64)"
 ```json
 {
   "id": "08c1d850-6065-478a-b9b5-a8f9f464ad33",
-  "version": "v0.12.3"
+  "version": "v0.12.3",
+  "heap_usage_bytes": "596000"
 }
 ```
 
@@ -67,5 +72,10 @@ still executing the familiar OPA `run` and `version` commands. It helps users st
 and hence empowers them to make informed decisions while upgrading their OPA deployments.
 
 * OPA maintainers and the [Cloud Native Computing Foundation](https://cncf.io) (CNCF) executive staff can use the version
-reports for obtaining more information about OPA usage and engagement. For example, the information can be used in making better
-decisions about OPA's deprecation cycle.
+reports for obtaining more information about OPA usage and engagement. For example, the information can be used in 
+making better decisions about OPA's deprecation cycle.
+
+* Reporting a running OPA's memory usage can help to better understand how much memory an OPA instance is consuming and
+thereby drive optimization efforts around better resource utilization. Some users have concerns around OPA's memory usage
+and hence this information can help OPA maintainers quantify the number of impacted OPA deployments and also guide future
+features and priorities for the project.
diff --git a/docs/content/rest-api.md b/docs/content/rest-api.md
index c665076cba..b898ce4146 100644
--- a/docs/content/rest-api.md
+++ b/docs/content/rest-api.md
@@ -725,23 +725,24 @@ The path separator is used to access values inside object and array documents. I
 #### Query Parameters
 
 - **input** - Provide an input document. Format is a JSON value that will be used as the value for the input document.
-- **pretty** - If parameter is `true`, response will formatted for humans.
+- **pretty** - If parameter is `true`, response will be formatted for humans.
 - **provenance** - If parameter is `true`, response will include build/version info in addition to the result.  See [Provenance](#provenance) for more detail.
-- **explain** - Return query explanation in addition to result. Values: **full**.
+- **explain** - Return query explanation in addition to result. Values: **notes**, **fails**, **full**, **debug**.
 - **metrics** - Return query performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 - **instrument** - Instrument query evaluation and return a superset of performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 - **strict-builtin-errors** - Treat built-in function call errors as fatal and return an error immediately.
 
+#### Request Headers
+
+- **Accept-Encoding: gzip**: Indicates the server should respond with a gzip encoded body. The server will send the compressed response only if its length is above `server.encoding.gzip.min_length` value. See the configuration section
+
 #### Status Codes
 
 - **200** - no error
 - **400** - bad request
 - **500** - server error
 
-The server returns 400 if either:
-
-- The query requires the input document and the caller does not provide it.
-- The caller provides the input document but the query already defines it programmatically.
+The server returns 400 if the input document is invalid (i.e. malformed JSON).
 
 The server returns 200 if the path refers to an undefined document. In this
 case, the response will not contain a `result` property.
@@ -818,17 +819,19 @@ Get a document that requires input.
 
 The path separator is used to access values inside object and array documents. If the path indexes into an array, the server will attempt to convert the array index to an integer. If the path element cannot be converted to an integer, the server will respond with 404.
 
-The request body contains an object that specifies a value for [The input Document](../#the-input-document).
+The request body contains an object that specifies a value for [The input Document](../philosophy/#the-opa-document-model).
 
 #### Request Headers
 
 - **Content-Type: application/x-yaml**: Indicates the request body is a YAML encoded object.
+- **Content-Encoding: gzip**: Indicates the request body is a gzip encoded object.
+- **Accept-Encoding: gzip**: Indicates the server should respond with a gzip encoded body. The server will send the compressed response only if its length is above `server.encoding.gzip.min_length` value. See the configuration section
 
 #### Query Parameters
 
 - **pretty** - If parameter is `true`, response will formatted for humans.
 - **provenance** - If parameter is `true`, response will include build/version info in addition to the result.  See [Provenance](#provenance) for more detail.
-- **explain** - Return query explanation in addition to result. Values: **full**.
+- **explain** - Return query explanation in addition to result. Values: **notes**, **fails**, **full**, **debug**.
 - **metrics** - Return query performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 - **instrument** - Instrument query evaluation and return a superset of performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 - **strict-builtin-errors** - Treat built-in function call errors as fatal and return an error immediately.
@@ -839,10 +842,7 @@ The request body contains an object that specifies a value for [The input Docume
 - **400** - bad request
 - **500** - server error
 
-The server returns 400 if either:
-
-1. The query requires an input document and the client did not supply one.
-2. The query already defines an input document and the client did supply one.
+The server returns 400 if the input document is invalid (i.e. malformed JSON).
 
 The server returns 200 if the path refers to an undefined document. In this
 case, the response will not contain a `result` property.
@@ -938,13 +938,15 @@ Use this API if you are enforcing policy decisions via webhooks that have pre-de
 request/response formats. Note, the API path prefix is `/v0` instead of `/v1`.
 
 The request message body defines the content of the [The input
-Document](../#the-input-document). The request message body
+Document](../philosophy/#the-opa-document-model). The request message body
 may be empty. The path separator is used to access values inside object and
 array documents.
 
 #### Request Headers
 
 - **Content-Type: application/x-yaml**: Indicates the request body is a YAML encoded object.
+- **Content-Encoding: gzip**: Indicates the request body is a gzip encoded object.
+- **Accept-Encoding: gzip**: Indicates the server should respond with a gzip encoded body. The server will send the compressed response only if its length is above `server.encoding.gzip.min_length` value. See the configuration section
 
 #### Query Parameters
 
@@ -1008,6 +1010,10 @@ If the path does not refer to an existing document, the server will attempt to c
 
 The server will respect the `If-None-Match` header if it is set to `*`. In this case, the server will not overwrite an existing document located at the path.
 
+#### Query Parameters
+
+- **metrics** - Return performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
+
 #### Status Codes
 
 - **204** - no content (success)
@@ -1100,6 +1106,10 @@ Delete a document.
 
 The server processes the DELETE method as if the client had sent a PATCH request containing a single remove operation.
 
+#### Query Parameters
+
+- **metrics** - Return performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
+
 #### Status Codes
 
 - **204** - no content (success)
@@ -1157,7 +1167,7 @@ produce a value for the `/data/system/main` document. You can configure OPA
 to use a different URL path to serve these queries. See the [Configuration Reference](../configuration)
 for more information.
 
-The request message body is mapped to the [Input Document](../#the-input-document).
+The request message body is mapped to the [Input Document](../philosophy/#the-opa-document-model).
 
 ```http
 PUT /v1/policies/example1 HTTP/1.1
@@ -1208,7 +1218,7 @@ GET /v1/query
 
 - **q** - The ad-hoc query to execute. OPA will parse, compile, and execute the query represented by the parameter value. The value MUST be URL encoded. Only used in GET method. For POST method the query is sent as part of the request body and this parameter is not used.
 - **pretty** - If parameter is `true`, response will formatted for humans.
-- **explain** - Return query explanation in addition to result. Values: **full**.
+- **explain** - Return query explanation in addition to result. Values: **notes**, **fails**, **full**, **debug**.
 - **metrics** - Return query performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 
 #### Status Codes
@@ -1274,23 +1284,34 @@ Content-Type: application/json
 Partially evaluate a query.
 
 The [Compile API](#compile-api) allows you to partially evaluate Rego queries
-and obtain a simplified version of the policy. For more details on Partial
-Evaluation in OPA, see [this post on blog.openpolicyagent.org](https://blog.openpolicyagent.org/partial-evaluation-162750eaf422).
+and obtain a simplified version of the policy. This is most useful when building
+integrations where policy logic is to be translated and evaluated in another
+environment. For example, 
+[this post](https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4)
+on the OPA blog shows how SQL can be generated based on Compile API output. 
+For more details on Partial Evaluation in OPA, please refer to
+[this blog post](https://blog.openpolicyagent.org/partial-evaluation-162750eaf422).
 
 #### Request Body
 
 Compile API requests contain the following fields:
 
-| Field | Type | Requried | Description |
+| Field | Type | Required | Description |
 | --- | --- | --- | --- |
 | `query` | `string` | Yes | The query to partially evaluate and compile. |
 | `input` | `any` | No | The input document to use during partial evaluation (default: undefined). |
+| `options`  | `object[string, any]`           | No | Additional options to use during partial evaluation. Only `disableInlining` option is supported. (default: undefined). |
 | `unknowns` | `array[string]` | No | The terms to treat as unknown during partial evaluation (default: `["input"]`]). |
 
+### Request Headers
+
+- **Content-Encoding: gzip**: Indicates the request body is a gzip encoded object.
+- **Accept-Encoding: gzip**: Indicates the server should respond with a gzip encoded body. The server will send the compressed response only if its length is above `server.encoding.gzip.min_length` value
+
 #### Query Parameters
 
 - **pretty** - If parameter is `true`, response will formatted for humans.
-- **explain** - Return query explanation in addition to result. Values: **full**.
+- **explain** - Return query explanation in addition to result. Values: **notes**, **fails**, **full**, **debug**.
 - **metrics** - Return query performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 - **instrument** - Instrument query evaluation and return a superset of performance metrics in addition to result. See [Performance Metrics](#performance-metrics) for more detail.
 
@@ -1325,6 +1346,9 @@ Content-Type: application/json
       "clearance_level": 4
     }
   },
+  "options": {
+    "disableInlining": []
+  },
   "unknowns": [
     "data.reports"
   ]
@@ -1523,7 +1547,7 @@ that the server is operational. Optionally it can account for bundle activation
 #### Query Parameters
 * `bundles` - Boolean parameter to account for bundle activation status in response. This includes any discovery bundles or bundles defined in the loaded discovery configuration.
 * `plugins` - Boolean parameter to account for plugin status in response.
-* `exclude-plugin` - String parameter to exclude a plugin from status checks. Can be added multiple times. Does nothing if `plugins` is not true. This parameter is useful for special use cases where a plugin depends on the server being fully initialized before it can fully intialize itself.
+* `exclude-plugin` - String parameter to exclude a plugin from status checks. Can be added multiple times. Does nothing if `plugins` is not true. This parameter is useful for special use cases where a plugin depends on the server being fully initialized before it can fully initialize itself.
 
 #### Status Codes
 - **200** - OPA service is healthy. If the `bundles` option is specified then all configured bundles have
@@ -1899,14 +1923,18 @@ Explanations can be requested for:
 Explanations are requested by setting the `explain` query parameter to one of
 the following values:
 
+- **off** - do not return any trace.
 - **full** - returns a full query trace containing every step in the query evaluation process.
+- **debug** - returns a full query trace including debug info.
+- **notes** - returns only note events and their context.
+- **fails** - returns only fail events and their context.
 
 By default, explanations are represented in a machine-friendly format. Set the
 `pretty` parameter to request a human-friendly format for debugging purposes.
 
 ### Trace Events
 
-When the `explain` query parameter is set to **full** , the response contains an array of Trace Event objects.
+When the `explain` query parameter is set to anything except `off`, the response contains an array of Trace Event objects.
 
 Trace Event objects contain the following fields:
 
@@ -1996,9 +2024,10 @@ response. To enable performance metric collection on an API call, specify the
 `metrics=true` query parameter when executing the API call. Performance metrics
 are currently supported for the following APIs:
 
-- Data API (GET and POST)
-- Policy API (all methods)
+- Policy API (PUT and DELETE)
+- Data API (GET, POST, PUT, and DELETE)
 - Query API (all methods)
+- Compile API (POST)
 
 For example:
 
@@ -2032,12 +2061,18 @@ Content-Type: application/json
 OPA currently supports the following query performance metrics:
 
 - **timer_rego_input_parse_ns**: time taken (in nanoseconds) to parse the input
-- **timer_rego_query_parse_ns**: time taken (in nanonseconds) to parse the query.
-- **timer_rego_query_compile_ns**: time taken (in nanonseconds) to compile the query.
-- **timer_rego_query_eval_ns**: time taken (in nanonseconds) to evaluate the query.
+- **timer_rego_query_parse_ns**: time taken (in nanoseconds) to parse the query.
+- **timer_rego_query_compile_ns**: time taken (in nanoseconds) to compile the query.
+- **timer_rego_query_eval_ns**: time taken (in nanoseconds) to evaluate the query.
 - **timer_rego_module_parse_ns**: time taken (in nanoseconds) to parse the input policy module.
 - **timer_rego_module_compile_ns**: time taken (in nanoseconds) to compile the loaded policy modules.
 - **timer_server_handler_ns**: time take (in nanoseconds) to handle the API request.
+- **counter_server_query_cache_hit**: number of cache hits for the query.
+
+The `counter_server_query_cache_hit` counter gives an indication about whether OPA creates a new Rego query
+or it uses a pre-processed query which holds some prepared state to serve the API request. A pre-processed query will be
+faster to evaluate since OPA will not have to re-parse or compile it. Hence, when the query is served from the cache
+`timer_rego_query_parse_ns` and `timer_rego_query_compile_ns` timers will be omitted from the reported performance metrics.
 
 OPA also supports query instrumentation. To enable query instrumentation,
 specify the `instrument=true` query parameter when executing the API call.
diff --git a/docs/content/schemas.md b/docs/content/schemas.md
deleted file mode 100644
index eec1e5cfba..0000000000
--- a/docs/content/schemas.md
+++ /dev/null
@@ -1,686 +0,0 @@
----
-title: Type Checking
-kind: misc
-weight: 2
----
-
-## Using schemas to enhance the Rego type checker
-
-You can provide one or more input schema files and/or data schema files to `opa eval` to improve static type checking and get more precise error reports as you develop Rego code.
-
-The `-s` flag can be used to upload schemas for input and data documents in JSON Schema format. You can either load a single JSON schema file for the input document or directory of schema files.
-
-```
--s, --schema string set schema file path or directory path
-```
-
-### Passing a single file with -s
-
-When a single file is passed, it is a schema file associated with the input document globally. This means that for all rules in all packages, the `input` has a type derived from that schema. There is no constraint on the name of the file, it could be anything.
-
-Example:
-```
-opa eval data.envoy.authz.allow -i opa-schema-examples/envoy/input.json -d opa-schema-examples/envoy/policy.rego -s opa-schema-examples/envoy/schemas/my-schema.json
-```
-
-
-### Passing a directory with -s
-
-When a directory path is passed, annotations will be used in the code to indicate what expressions map to what schemas (see below).
-Both input schema files and data schema files can be provided in the same directory, with different names. The directory of schemas may have any sub-directories. Notice that when a directory is passed the input document does not have a schema associated with it globally. This must also
-be indicated via an annotation.
-
-
-Example:
-```
-opa eval data.kubernetes.admission -i opa-schema-examples/kubernetes/input.json -d opa-schema-examples/kubernetes/policy.rego -s opa-schema-examples/kubernetes/schemas
-
-```
-
-Schemas can also be provided for policy and data files loaded via `opa eval --bundle`
-
-
-Example:
-```
-opa eval data.kubernetes.admission -i opa-schema-examples/kubernetes/input.json -b opa-schema-examples/bundle.tar.gz -s opa-schema-examples/kubernetes/schemas
-
-```
-
-Samples provided at: https://github.com/aavarghese/opa-schema-examples/
-
-
-
-## Usage scenario with a single schema file
-
-Consider the following Rego code, which assumes as input a Kubernetes admission review. For resources that are Pods, it checks that the image name
-starts with a specific prefix.
-
-`pod.rego`
-```
-package kubernetes.admission
-
-deny[msg] {
-    input.request.kind.kinds == "Pod"
-    image := input.request.object.spec.containers[_].image
-    not startswith(image, "hooli.com/")
-    msg := sprintf("image '%v' comes from untrusted registry", [image])
-}
-```
-
-Notice that this code has a typo in it: `input.request.kind.kinds` is undefined and should have been `input.request.kind.kind`.
-
-Consider the following input document:
-
-
-`input.json`
-```
-{
-    "kind": "AdmissionReview",
-    "request": {
-      "kind": {
-        "kind": "Pod",
-        "version": "v1"
-      },
-      "object": {
-        "metadata": {
-          "name": "myapp"
-        },
-        "spec": {
-          "containers": [
-            {
-              "image": "nginx",
-              "name": "nginx-frontend"
-            },
-            {
-              "image": "mysql",
-              "name": "mysql-backend"
-            }
-          ]
-        }
-      }
-    }
-  }
-  ```
-
-Clearly there are 2 image names that are in violation of the policy. However, when we evaluate the erroneous Rego code against this input we obtain:
-  ```
-  % opa eval data.kubernetes.admission --format pretty -i opa-schema-examples/kubernetes/input.json -d opa-schema-examples/kubernetes/policy.rego
-  []
-  ```
-
-The empty value returned is indistinguishable from a situation where the input did not violate the policy. This error is therefore causing the policy not to catch violating inputs appropriately.
-
-If we fix the Rego code and change `input.request.kind.kinds` to `input.request.kind.kind`, then we obtain the expected result:
-  ```
-  [
-  "image 'nginx' comes from untrusted registry",
-  "image 'mysql' comes from untrusted registry"
-  ]
-  ```
-
-With this feature, it is possible to pass a schema to `opa eval`, written in JSON Schema. Consider the admission review schema provided at:
-https://github.com/aavarghese/opa-schema-examples/blob/main/kubernetes/schemas/input.json
-
-We can pass this schema to the evaluator as follows:
-  ```
-  % opa eval data.kubernetes.admission --format pretty -i opa-schema-examples/kubernetes/input.json -d opa-schema-examples/kubernetes/policy.rego -s opa-schema-examples/kubernetes/schemas/input.json
-  ```
-
-With the erroneous Rego code, we now obtain the following type error:
-  ```
-  1 error occurred: ../../aavarghese/opa-schema-examples/kubernetes/policy.rego:5: rego_type_error: undefined ref: input.request.kind.kinds
-	input.request.kind.kinds
-	                   ^
-	                   have: "kinds"
-	                   want (one of): ["kind" "version"]
-  ```
-
-This indicates the error to the Rego developer right away, without having the need to observe the results of runs on actual data, thereby improving productivity.
-
-## Schema annotations
-
-When passing a directory of schemas to `opa eval`, schema annotations become handy to associate a Rego expression with a corresponding schema within a given scope:
-
-```
-# METADATA
-# schemas:
-#   - <path-to-value>:<path-to-schema>
-#   ...
-#   - <path-to-value>:<path-to-schema>
-allow {
-  ...
-}
-```
-
-The annotation must be specified as YAML within a comment block that **must** start with `# METADATA`. Also, every line in the comment block containing the annotation **must** start at Column 1 in the module/file, or otherwise, they will be ignored.
-
-> 🚨 OPA will attempt to parse the YAML document in comments following the
-> initial `# METADATA` comment. If the YAML document cannot be parsed, OPA will
-> return an error. If you need to include additional comments between the
-> comment block and the next statement, include a blank line immediately after
-> the comment block containing the YAML document. This tells OPA that the
-> comment block containing the YAML document is finished
-
-The `schemas` field specifies an array associating schemas to data values. Paths must start with `input` or `data` (i.e., they must be fully-qualified.)
-
-The type checker derives a Rego Object type for the schema and an appropriate entry is added to the type environment before type checking the rule. This entry is removed upon exit from the rule.
-
-Example:
-
-Consider the following Rego code which checks if an operation is allowed by a user, given an ACL data document:
-
-```
-package policy
-
-import data.acl
-
-default allow = false
-
-# METADATA
-# schemas:
-#   - input: schema.input
-#   - data.acl: schema["acl-schema"]
-allow {
-    access := data.acl["alice"]
-    access[_] == input.operation
-}
-
-allow {
-    access := data.acl["bob"]
-    access[_] == input.operation
-}
-```
-
-Consider a directory named `mySchemasDir` with the following structure, provided via `opa eval --schema opa-schema-examples/mySchemasDir`
-
-```$ tree mySchemasDir/
-mySchemasDir/
-├── input.json
-└── acl-schema.json
-```
-
-For actual code samples, see https://github.com/aavarghese/opa-schema-examples/tree/main/acl.
-
-In the first `allow` rule above, the input document has the schema `input.json`, and `data.acl` has the schema `acl-schema.json`. Note that we use the relative path inside the `mySchemasDir` directory to identify a schema, omit the `.json` suffix, and use the global variable `schema` to stand for the top-level of the directory.
-Schemas in annotations are proper Rego references. So `schema.input` is also valid, but `schema.acl-schema` is not.
-
-If we had the expression `data.acl.foo` in this rule, it would result in a type error because the schema contained in `acl-schema.json` only defines object properties `"alice"` and `"bob"` in the ACL data document.
-
-On the other hand, this annotation does not constrain other paths under `data`. What it says is that we know the type of `data.acl` statically, but not that of other paths. So for example, `data.foo` is not a type error and gets assigned the type `Any`.
-
-Note that the second `allow` rule doesn't have a METADATA comment block attached to it, and hence will not be type checked with any schemas.
-
-On a different note, schema annotations can also be added to policy files part of a bundle package loaded via `opa eval --bundle` alongwith the `--schema` parameter for type checking a set of `*.rego` policy files.
-
-### Annotation Scopes
-
-Annotations can be defined at the rule or package level. The `scope` field on
-the annotation determines how the schema annotation will be applied. If the
-`scope` field is omitted, it defaults to the scope for the statement that
-immediately follows the annotation. The `scope` values that are currently
-supported are:
-
-* `rule` - applies to the individual rule statement
-* `document` - applies to all of the rules with the same name in the same package
-* `package` - applies to all of the rules in the package
-* `subpackages` - applies to all of the rules in the package and all subpackages (recursively)
-
-In case of overlap, schema annotations override each other as follows:
-
-```
-rule overrides document
-document overrides package
-package overrides subpackages
-```
-
-The following sections explain how the different scopes work.
-
-#### Rule and Document Scopes
-
-In the example above, the second rule does not include an annotation so type
-checking of the second rule would not take schemas into account. To enable type
-checking on the second (or other rules in the same file) we could specify the
-annotation multiple times:
-
-```
-# METADATA
-# scope: rule
-# schemas:
-#   - input: schema.input
-#   - data.acl: schema["acl-schema"]
-allow {
-    access := data.acl["alice"]
-    access[_] == input.operation
-}
-
-# METADATA
-# scope: rule
-# schemas:
-#   - input: schema.input
-#   - data.acl: schema["acl-schema"]
-allow {
-    access := data.acl["bob"]
-    access[_] == input.operation
-}
-```
-
-This is obviously redundant and error-prone. To avoid this problem, we can
-define the annotation once on a rule with scope `document`:
-
-```
-# METADATA
-# scope: document
-# schemas:
-#   - input: schema.input
-#   - data.acl: schema["acl-schema"]
-allow {
-    access := data.acl["alice"]
-    access[_] == input.operation
-}
-
-allow {
-    access := data.acl["bob"]
-    access[_] == input.operation
-}
-```
-
-In this example, the annotation with `document` scope has the same affect as the
-two `rule` scoped annotations in the previous example.
-
-Since the `document` scope annotation applies to all rules with the same name in
-the same package (which can span multiple files) and there is no ordering across
-files in the same package, `document` scope annotations can only be specified
-**once** per rule set. The `document` scope annotation can be applied to any
-rule in the set (i.e., ordering does not matter.)
-
-#### Package and Subpackage Scopes
-
-Annotations can be defined at the `package` level and then applied to all rules
-within the package:
-
-```
-# METADATA
-# scope: package
-# schemas:
-#   - input: schema.input
-#   - data.acl: schema["acl-schema"]
-package example
-
-allow {
-    access := data.acl["alice"]
-    access[_] == input.operation
-}
-
-allow {
-    access := data.acl["bob"]
-    access[_] == input.operation
-}
-```
-
-`package` scoped schema annotations are useful when all rules in the same
-package operate on the same input structure. In some cases, when policies are
-organized into many sub-packages, it is useful to declare schemas recursively
-for them using the `subpackages` scope. For example:
-
-```
-# METADTA
-# scope: subpackages
-# schemas:
-# - input: schema.input
-package kubernetes.admission
-```
-
-This snippet would declare the top-level schema for `input` for the
-`kubernetes.admission` package as well as all subpackages. If admission control
-rules were defined inside packages like `kubernetes.admission.workloads.pods`,
-they would be able to pick up that one schema declaration.
-
-### Overriding
-
-JSON Schemas are often incomplete specifications of the format of data. For example, a Kubernetes Admission Review resource has a field `object` which can contain any other Kubernetes resource. A schema for Admission Review has a generic type `object` for that field that has no further specification. To allow more precise type checking in such cases, we support overriding existing schemas.
-
-Consider the following example:
-
-```
-package kubernetes.admission
-
-# METADATA
-# scope: rule
-# schemas:
-# - input: schema.input
-# - input.request.object: schema.kubernetes.pod
-deny[msg] {
-    input.request.kind.kind == "Pod"
-    image := input.request.object.spec.containers[_].image
-    not startswith(image, "hooli.com/")
-    msg := sprintf("image '%v' comes from untrusted registry", [image])
-}
-```
-
-In this example, the `input` is associated with an Admission Review schema, and furthermore `input.request.object` is set to have the schema of a Kubernetes Pod. In effect, the second schema annotation overrides the first one. Overriding is a schema transformation feature and combines existing schemas. In this case, we are combining the Admission Review schema with that of a Pod.
-
-Notice that the order of schema annotations matter for overriding to work correctly.
-
-Given a schema annotation, if a prefix of the path already has a type in the environment, then the annotation has the effect of merging and overriding the existing type with the type derived from the schema. In the example above, the prefix `input` already has a type in the type environment, so the second annotation overrides this existing type. Overriding affects the type of the longest prefix that already has a type. If no such prefix exists, the new path and type are added to the type environment for the scope of the rule.
-
-In general, consider the existing Rego type:
-
-```
-object{a: object{b: object{c: C, d: D, e: E}}}
-```
-If we override this type with the following type (derived from a schema annotation of the form `a.b.e: schema-for-E1`):
-
-```
-object{a: object{b: object{e: E1}}}
-```
-
-It results in the following type:
-
-```
-object{a: object{b: object{c: C, d: D, e: E1}}}
-```
-
-Notice that `b` still has its fields `c` and `d`, so overriding has a merging effect as well. Moreover, the type of expression `a.b.e` is now `E1` instead of `E`.
-
-We can also use overriding to add new paths to an existing type, so if we override the initial type with the following:
-
-```
-object{a: object{b: object{f: F}}}
-```
-
-we obtain the following type:
-
-```
-object{a: object{b: object{c: C, d: D, e: E, f: F}}}
-```
-
-
-
-We use schemas to enhance the type checking capability of OPA, and not to validate the input and data documents against desired schemas. This burden is still on the user and care must be taken when using overriding to ensure that the input and data provided are sensible and validated against the transformed schemas.
-
-
-### Multiple input schemas
-
-It is sometimes useful to have different input schemas for different rules in the same package. This can be achieved as illustrated by the following example:
-
-```
-package policy
-
-import data.acl
-
-default allow = false
-
-# METADATA
-# scope: rule
-# schemas:
-#  - input: schema["input"]
-#  - data.acl: schema["acl-schema"]
-allow {
-    access := data.acl[input.user]
-    access[_] == input.operation
-}
-
-# METADATA for whocan rule
-# scope: rule
-# schemas:
-#   - input: schema["whocan-input-schema"]
-#   - data.acl: schema["acl-schema"]
-whocan[user] {
-    access := acl[user]
-    access[_] == input.operation
-}
-```
-
-The directory that is passed to `opa eval` is the following:
-```$ tree mySchemasDir/
-mySchemasDir/
-├── input.json
-└── acl-schema.json
-└── whocan-input-schema.json
-```
-
-In this example, we associate the schema `input.json` with the input document in the rule `allow`, and the schema `whocan-input-schema.json`
-with the input document for the rule `whocan`.
-
-### Translating schemas to Rego types and dynamicity
-
-Rego has a gradual type system meaning that types can be partially known statically. For example, an object could have certain fields whose types are known and others that are unknown statically. OPA type checks what it knows statically and leaves the unknown parts to be type checked at runtime. An OPA object type has two parts: the static part with the type information known statically, and a dynamic part, which can be nil (meaning everything is known statically) or non-nil and indicating what is unknown.
-
-When we derive a type from a schema, we try to match what is known and unknown in the schema. For example, an `object` that has no specified fields becomes the Rego type `Object{Any: Any}`. However, currently `additionalProperties` and `additionalItems` are ignored. When a schema is fully specified, we derive a type with its dynamic part set to nil, meaning that we take a strict interpretation in order to get the most out of static type checking. This is the case even if `additionalProperties` is set to `true` in the schema. In the future, we will take this feature into account when deriving Rego types.
-
-When overriding existing types, the dynamicity of the overridden prefix is preserved.
-
-### Supporting JSON Schema composition keywords
-
-JSON Schema provides keywords such as `anyOf` and `allOf` to structure a complex schema. For `anyOf`, at least one of the subschemas must be true, and for `allOf`, all subschemas must be true. The type checker is able to identify such keywords and derive a more robust Rego type through more complex schemas.
-
-#### `anyOf`
-
-Specifically, `anyOf` acts as an Rego Or type where at least one (can be more than one) of the subschemas is true. Consider the following Rego and schema file containing `anyOf`:
-
-`policy-anyOf.rego`
-```
-package kubernetes.admission  
-
-# METADATA
-# scope: rule
-# schemas: 
-#   - input: schema["input-anyOf"] 
-deny {                                                                
-    input.request.servers.versions == "Pod"                       
-}
-```
-
-`input-anyOf.json`
-```
-{
-    "$schema": "http://json-schema.org/draft-07/schema",
-    "type": "object",
-    "properties": {
-        "kind": {"type": "string"},
-        "request": {
-            "type": "object",
-            "anyOf": [
-                {
-                   "properties": {
-                       "kind": {
-                           "type": "object",
-                           "properties": {
-                               "kind": {"type": "string"},
-                               "version": {"type": "string" }
-                           }
-                       }
-                   }
-                },
-                {
-                   "properties": {
-                       "server": {
-                           "type": "object",
-                           "properties": {
-                               "accessNum": {"type": "integer"},
-                               "version": {"type": "string"}
-                           }
-                       }
-                   }
-                }
-            ]
-        }
-    }
-}
-
-```
-
-We can see that `request` is an object with two options as indicated by the choices under `anyOf`:
-* contains property `kind`, which has properties `kind` and `version`
-* contains property `server`, which has properties `accessNum` and `version`
-
-The type checker finds the first error in the Rego code, suggesting that `servers` should be either `kind` or `server`.
-```
-	input.request.servers.versions
-	              ^
-	              have: "servers"
-	              want (one of): ["kind" "server"]
-```
-Once this is fixed, the second typo is highlighted, prompting the user to choose between `accessNum` and `version`.
-```
-	input.request.server.versions
-	                     ^
-	                     have: "versions"
-	                     want (one of): ["accessNum" "version"]
-```
-
-#### `allOf`
-
-Specifically, `allOf` keyword implies that all conditions under `allOf` within a schema must be met by the given data. `allOf` is implemented through merging the types from all of the JSON subSchemas listed under `allOf` before parsing the result to convert it to a Rego type. Merging of the JSON subSchemas essentially combines the passed in subSchemas based on what types they contain. Consider the following Rego and schema file containing `allOf`:
-
-`policy-allOf.rego`
-```
-package kubernetes.admission  
-
-# METADATA
-# scope: rule
-# schemas: 
-#   - input: schema["input-allof"] 
-deny {                                                                
-    input.request.servers.versions == "Pod"                       
-}
-```
-
-`input-allof.json`
-```
-{
-    "$schema": "http://json-schema.org/draft-07/schema",
-    "type": "object",
-    "properties": {
-        "kind": {"type": "string"},
-        "request": {
-            "type": "object",
-            "allOf": [
-                {
-                   "properties": {
-                       "kind": {
-                           "type": "object",
-                           "properties": {
-                               "kind": {"type": "string"},
-                               "version": {"type": "string" }
-                           }
-                       }
-                   }
-                },
-                {
-                   "properties": {
-                       "server": {
-                           "type": "object",
-                           "properties": {
-                               "accessNum": {"type": "integer"},
-                               "version": {"type": "string"}
-                           }
-                       }
-                   }
-                }
-            ]
-        }
-    }
-}
-
-```
-
-We can see that `request` is an object with properties as indicated by the elements listed under `allOf`:
-* contains property `kind`, which has properties `kind` and `version`
-* contains property `server`, which has properties `accessNum` and `version`
-
-The type checker finds the first error in the Rego code, suggesting that `servers` should be `server`.
-```
-	input.request.servers.versions
-	              ^
-	              have: "servers"
-	              want (one of): ["kind" "server"]
-```
-Once this is fixed, the second typo is highlighted, informing the user that `versions` should be one of `accessNum` or `version`.
-```
-	input.request.server.versions
-	                     ^
-	                     have: "versions"
-	                     want (one of): ["accessNum" "version"]
-```
-Because the properties `kind`, `version`, and `accessNum` are all under the `allOf` keyword, the resulting schema that the given data must be validated against will contain the types contained in these properties children (string and integer).
-
-### Remote references in JSON schemas
-
-It is valid for JSON schemas to reference other JSON schemas via URLs, like this:
-```json
-{
-  "description": "Pod is a collection of containers that can run on a host.",
-  "type": "object",
-  "properties": {
-    "metadata": {
-      "$ref": "https://kubernetesjsonschema.dev/v1.14.0/_definitions.json#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta",
-      "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
-    }
-  }
-}
-```
-
-OPA's type checker will fetch these remote references by default.
-To control the remote hosts schemas will be fetched from, pass a capabilities
-file to your `opa eval` or `opa check` call.
-
-Starting from the capabilities.json of your OPA version (which can be found [in the
-repository](https://github.com/open-policy-agent/opa/tree/main/capabilities)), add
-an `allow_net` key to it: its values are the IP addresses or host names that OPA is
-supposed to connect to for retrieving remote schemas.
-
-```json
-{
-  "builtins": [ ... ],
-  "allow_net": [ "kubernetesjsonschema.dev" ]
-}
-```
-
-#### Note
-
-- To forbid all network access in schema checking, set `allow_net` to `[]`
-- Host names are checked against the list as-is, so adding `127.0.0.1` to `allow_net`,
-  and referencing a schema from `http://localhost/` will _fail_.
-- Metaschemas for different JSON Schema draft versions are not subject to this
-  constraint, as they are already provided by OPA's schema checker without requiring
-  network access. These are:
-
-    - `http://json-schema.org/draft-04/schema`
-    - `http://json-schema.org/draft-06/schema`
-    - `http://json-schema.org/draft-07/schema`
-
-
-## Limitations
-
-Currently this feature admits schemas written in JSON Schema but does not support every feature available in this format.
-In particular the following features are not yet supported:
-
-* additional properties for objects
-* pattern properties for objects
-* additional items for arrays
-* contains for arrays
-* oneOf, not
-* enum
-* if/then/else
-
-A note of caution: overriding is a powerful capability that must be used carefully. For example, the user is allowed to write:
-
-```
-# METADATA
-# scope: rule
-# schema:
-#  - data: schema["some-schema"]
-```
-
-In this case, we are overriding the root of all documents to have some schema. Since all Rego code lives under `data` as virtual documents, this in practice renders all of them inaccessible (resulting in type errors). Similarly, assigning a schema to a package name is not a good idea and can cause problems. Care must also be taken when defining overrides so that the transformation of schemas is sensible and data can be validated against the transformed schema.
-
-## References
-
-For more examples, please see https://github.com/aavarghese/opa-schema-examples
-
-This contains samples for Envoy, Kubernetes, and Terraform including corresponding JSON Schemas.
-
-For a reference on JSON Schema please see: http://json-schema.org/understanding-json-schema/reference/index.html
-
-For a tool that generates JSON Schema from JSON samples, please see: https://jsonschema.net/home
\ No newline at end of file
diff --git a/docs/content/security.md b/docs/content/security.md
index 331ce434ff..2015cc138c 100644
--- a/docs/content/security.md
+++ b/docs/content/security.md
@@ -14,7 +14,7 @@ authorization so that:
 - Traffic between OPA and clients is encrypted.
 - Clients verify the OPA API endpoint identity.
 - OPA verifies client identities.
-- Clients are only granted access to specific APIs or sections of [The `data` Document](../#the-data-document).
+- Clients are only granted access to specific APIs or sections of [The `data` Document](../philosophy/#the-opa-document-model).
 
 ## TLS and HTTPS
 
@@ -29,7 +29,7 @@ is specified.
 
 The server can track the certificate and key files' contents, and reload them if necessary:
 
-- ``--tls-cert-refresh=<duration>`` specifies how often OPA should check the TLS certificate and
+- ``--tls-cert-refresh-period=<duration>`` specifies how often OPA should check the TLS certificate and
   private key file for changes (defaults to 0s, disabling periodic refresh). This argument accepts
   any duration, such as "30s", "5m" or "24h".
 
@@ -88,6 +88,21 @@ curl -k https://localhost:8181/v1/data
 We have to use cURL's `-k/--insecure` flag because we are using a self-signed certificate.
 {{< /info >}}
 
+## Interface Binding
+
+OPA can be configured to listen on specific interfaces using the `--addr` flag. For example:
+
+```bash
+opa run --server \
+  --log-level debug \
+  --addr localhost:8181 \
+```
+
+By default, OPA binds to the 0.0.0.0 interface, which allows the OPA server to be exposed to services running outside of the same machine. It's important to note that binding OPA to the 0.0.0.0 interface by itself is not inherently insecure in a trusted environment, exposing OPA to the outside world would also require opening ports and likely a similar procedure on a gateway layer above.
+
+In situations where OPA is not intended to be exposed to remote services, it is recommended to bind OPA to the localhost interface, which only allows connections from the same machine. If it is necessary to expose OPA to remote services, ensure to follow the security recommendations on this page, such as requiring authentication.
+
+
 ## Authentication and Authorization
 
 This section shows how to configure OPA to authenticate and authorize client
@@ -119,7 +134,7 @@ value will be undefined when the authorization policy is evaluated.
 - Client TLS certificates: Client TLS authentication is enabled by starting
 OPA with ``--authentication=tls``. When this authentication mode is enabled,
 OPA will require all clients to provide a client certificate. It is verified
-against the CA certificate(s) provided via `--tls-ca-cert-path`. Upon successful
+against the CA certificate(s) provided via `--tls-ca-cert-file`. Upon successful
 verification, the `input.identity` value is set to the TLS certificate's
 subject.
 
@@ -140,7 +155,7 @@ must be provided on startup. The authorization policy must be structured as foll
 # system.authz as follows:
 package system.authz
 
-default allow = false  # Reject requests by default.
+default allow := false  # Reject requests by default.
 
 allow {
   # Logic to authorize request goes here.
@@ -154,7 +169,8 @@ packages however it is recommended that administrators keep the policy under the
 
 If the document produced by the ``allow`` rule is ``true``, the request is
 processed normally. If the document is undefined or **not** ``true``, the
-request is rejected immediately.
+request is rejected immediately. The count of requests rejected by an OPA instance
+are surfaced via the performance metrics in the [Status](../management-status) information.
 
 OPA provides the following `input` document when executing the authorization
 policy:
@@ -162,10 +178,20 @@ policy:
 <!-- TODO(sr): check if "jsonc" looks alright on netlify -->
 ```jsonc
 {
-    # Identity established by authentication scheme.
+    # Identity value established by authentication scheme.
     # When Bearer tokens are used, the identity is
     # set to the Bearer token value.
+    # When TLS client certificates are used, the identity
+    # is set to the certificate subject RDNSequence.
+    # E.g. "OU=opa-client-01,O=Example"
+    # Note: client certificate data is available in the
+    # 'client_certificates' key.
     "identity": "",
+    
+    # Client certificates provided by the client when calling OPA
+    # over an mTLS connection. Represented in input as a list of
+    # Go x509.Certificate objects marshalled as JSON.
+    "client_certificates": [],
 
     # One of {"GET", "POST", "PUT", "PATCH", "DELETE"}.
     "method": "",
@@ -193,7 +219,7 @@ policy:
     #
     # Example header check:
     #
-    #   input.headers["X-Custom"][_] = "mysecret"
+    #   input.headers["X-Custom"][_] == "mysecret"
     #
     # Header keys follow canonical MIME form. The first character and any
     # characters following a hyphen are uppercase. The rest are lowercase.
@@ -233,7 +259,7 @@ identity:
 ```live:system_authz_secret:module:read_only
 package system.authz
 
-default allow = false           # Reject requests by default.
+default allow := false           # Reject requests by default.
 
 allow {                         # Allow request if...
     "secret" == input.identity  # Identity is the secret root key.
@@ -283,16 +309,16 @@ follows:
 ```live:system_authz_object_resp:module:read_only
 package system.authz
 
-default allow = {
+default allow := {
     "allowed": false,
     "reason": "unauthorized resource access"
 }
 
-allow = { "allowed": true } {   # Allow request if...
+allow := { "allowed": true } {   # Allow request if...
     "secret" == input.identity  # identity is the secret root key.
 }
 
-allow = { "allowed": false, "reason": reason } {
+allow := { "allowed": false, "reason": reason } {
     not input.identity
     reason := "no identity provided"
 }
@@ -319,7 +345,7 @@ tokens := {
     }
 }
 
-default allow = false           # Reject requests by default.
+default allow := false           # Reject requests by default.
 
 allow {                         # Allow request if...
     input.identity == "secret"  # Identity is the secret root key.
@@ -362,7 +388,7 @@ tokens := {
     }
 }
 
-default allow = false               # Reject requests by default.
+default allow := false               # Reject requests by default.
 
 allow {                             # Allow request if...
     some right
@@ -377,7 +403,6 @@ allow {                             # Allow request if...
 }
 
 identity_rights[right] {             # Right is in the identity_rights set if...
-    some role
     token := tokens[input.identity]  # Token exists for identity, and...
     role := token.roles[_]           # Token has a role, and...
     right := rights[role]            # Role has rights defined.
@@ -386,32 +411,60 @@ identity_rights[right] {             # Right is in the identity_rights set if...
 
 ### TLS-based Authentication Example
 
-To set up authentication based on TLS, we will need three certificates:
+To set up authentication based on mutual TLS, we will need three certificates:
 
 1. the CA cert (self-signed),
 2. the server cert (signed by the CA), and
 3. the client cert (signed by the CA).
 
-These are example invocations using `openssl`.
-Don't use these in production, the key sizes are only good for demonstration purposes.
+We use `openssl` to create the example certificates and keys used in this demo. In production, creation of certificates
+and keys should be handled by an automated process out of scope for this tutorial.
 
-Note that we're creating an extra client, which has a certificate signed by the proper
-CA, but will later be used to illustrate the authorization policy.
+Note that we also create an extra client cert (client-2). While this certificate is signed by the same CA, it's identity
+is different. We'll use this to show our authorization policy in action.
 
 ```bash
 # CA
-openssl genrsa -out ca-key.pem 2048
-openssl req -x509 -new -nodes -key ca-key.pem -days 1000 -out ca.pem -subj "/CN=my-ca"
+openssl ecparam -out ca-key.pem -name prime256v1 -genkey 
+openssl req -x509 -new -nodes -key ca-key.pem -days 30 -out ca.pem -subj "/CN=my-ca"
 
 # client 1
-openssl genrsa -out client-key.pem 2048
-openssl req -new -key client-key.pem -out csr.pem -subj "/CN=my-client"
-openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -days 1000
+cat <<EOF >req.cnf
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+
+[req_distinguished_name]
+
+[v3_req]
+basicConstraints = CA:FALSE
+subjectAltName = @alt_names
+
+[alt_names]
+URI.1 = spiffe://example.com/client-1
+EOF
+openssl ecparam -out client-key-1.pem -name prime256v1 -genkey 
+openssl req -new -key client-key-1.pem -out csr.pem -subj "/CN=client-1" -config req.cnf 
+openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert-1.pem -days 10 -extensions v3_req -extfile req.cnf -sha256
 
 # client 2
-openssl genrsa -out client-key-2.pem 2048
-openssl req -new -key client-key-2.pem -out csr.pem -subj "/CN=my-client-2"
-openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert-2.pem -days 1000
+cat <<EOF >req.cnf
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+
+[req_distinguished_name]
+
+[v3_req]
+basicConstraints = CA:FALSE
+subjectAltName = @alt_names
+
+[alt_names]
+URI.1 = spiffe://example.com/client-2
+EOF
+openssl ecparam -out client-key-2.pem -name prime256v1 -genkey 
+openssl req -new -key client-key-2.pem -out csr.pem -subj "/CN=client-2" -config req.cnf
+openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert-2.pem -days 10 -extensions v3_req -extfile req.cnf -sha256
 
 # create server cert with IP and DNS SANs
 cat <<EOF >req.cnf
@@ -429,27 +482,46 @@ subjectAltName = @alt_names
 [alt_names]
 DNS.1 = opa.example.com
 IP.1 = 127.0.0.1
+URI.1 = spiffe://example.com/server
 EOF
-openssl genrsa -out server-key.pem 2048
-openssl req -new -key server-key.pem -out csr.pem -subj "/CN=my-server" -config req.cnf
-openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 1000 -extensions v3_req -extfile req.cnf
+openssl ecparam -out server-key.pem -name prime256v1 -genkey 
+openssl req -new -key server-key.pem -out csr.pem -subj "/CN=server" -config req.cnf
+openssl x509 -req -in csr.pem -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -days 10 -extensions v3_req -extfile req.cnf -sha256
 ```
 
-We also create a simple authorization policy file, called `check.rego`:
+We also create an example authorization policy file, called `check.rego`. This example `system.authz` policy will check
+the certificate ID against a list of allowed paths as defined in a simple Access Control List.
+
+{{< danger >}}
+When choosing messages to return to unauthorized clients in `system.authz` policies, be careful not to expose sensitive
+information such as which paths are allowed.
+{{< /danger >}}
 
 ```live:system_authz_x509:module:read_only
 package system.authz
 
-# client_cns may defined in policy or pushed into OPA as data.
-client_cns := {
-	"my-client": true
+import future.keywords.if
+import future.keywords.in
+
+id_uri := input.client_certificates[0].URIs[0]
+id_string := sprintf("%s://%s%s", [id_uri.Scheme, id_uri.Host, id_uri.Path])
+
+# client_acl represents an access control list and may defined in policy or pushed into OPA as data changes.
+client_acl := {
+  "spiffe://example.com/client-1": [["v1", "data"]],
+  "spiffe://example.com/client-2": [],
 }
 
-default allow = false
+default allow := {"allowed": false, "reason": "Access denied: unknown caller"}
 
-allow {                                        # Allow request if
-	split(input.identity, "=", ["CN", cn]) # the cert subject is a CN, and
-	client_cns[cn]                         # the name is a known client.
+allow := { "allowed": true } if {
+  input.path in client_acl[id_string]
+} else := {
+  "allowed": false,
+  "reason": sprintf("%s is not allowed to call /%s", [
+    id_string,
+    concat("/", input.path),
+  ])
 }
 ```
 
@@ -464,7 +536,7 @@ $ opa run -s \
   --authorization=basic \
   -a https://127.0.0.1:8181 \
   check.rego
-INFO[2019-01-14T10:24:52+01:00] First line of log stream.                     addrs="[https://127.0.0.1:8181]" insecure_addr=
+{"addrs":["https://127.0.0.1:8181"],"diagnostic-addrs":[],"level":"info","msg":"Initializing server.","time":"2023-01-04T10:31:12Z"}
 ```
 
 We can use `curl` to validate our TLS-based authentication setup:
@@ -473,8 +545,8 @@ First, we use the client certificate that was signed by the CA, and has a subjec
 matching our authorization policy:
 
 ```console
-$ curl --key client-key.pem \
-  --cert client-cert.pem \
+$ curl --key client-key-1.pem \
+  --cert client-cert-1.pem \
   --cacert ca.pem \
   --resolve opa.example.com:8181:127.0.0.1 \
   https://opa.example.com:8181/v1/data
@@ -484,7 +556,7 @@ $ curl --key client-key.pem \
 Note that we're passing the CA cert to curl -- this is done to have curl accept
 the server's certificate, which has been signed by our CA cert.
 
-Since we've setup an IP SAN, we may also `curl https://127.0.0.1:8181/v1/data`
+Since we've set up an IP SAN, we may also `curl https://127.0.0.1:8181/v1/data`
 directly. (To keep our examples focused, we'll do that from here on.)
 
 Using a valid certificate whose subject will be declined by our authorization
@@ -497,17 +569,17 @@ $ curl --key client-key-2.pem \
   https://127.0.0.1:8181/v1/data
 {
   "code": "unauthorized",
-  "message": "request rejected by administrative policy"
+  "message": "spiffe://example.com/client-2 is not allowed to call /v1/data"
 }
 ```
 
 Finally, we'll attempt to query without a client certificate:
 ```console
 $ curl --cacert ca.pem https://127.0.0.1:8181/v1/data
-curl: (35) error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
+curl: (56) LibreSSL SSL_read: error:1404C412:SSL routines:ST_OK:sslv3 alert bad certificate, errno 0
 ```
 
-As you can see, TLS-based authentication disallows these request completely.
+As you can see, TLS-based authentication disallows these request before even invoking the `system.authz` policy.
 
 ## Secure Health and Monitoring
 
@@ -550,7 +622,7 @@ clients access to the default policy decision, i.e., `POST /`:
 package system.authz
 
 # Deny access by default.
-default allow = false
+default allow := false
 
 # Allow anonymous access to the default policy decision.
 allow {
diff --git a/docs/content/ssh-and-sudo-authorization.md b/docs/content/ssh-and-sudo-authorization.md
index 837f415430..2a0a4989d8 100644
--- a/docs/content/ssh-and-sudo-authorization.md
+++ b/docs/content/ssh-and-sudo-authorization.md
@@ -66,6 +66,11 @@ services:
       - "run"
       - "--server"
       - "--set=decision_logs.console=true"
+      - "--set=services.nginx.url=http://bundle_server"
+      - "--set=bundles.nginx.service=nginx"
+      - "--set=bundles.nginx.resource=bundles/bundle.tar.gz"
+    depends_on:
+      - bundle_server
   frontend:
     image: openpolicyagent/demo-pam
     ports:
@@ -78,6 +83,12 @@ services:
       - "2223:22"
     volumes:
       - ./backend_host_id.json:/etc/host_identity.json
+  bundle_server:
+    image: nginx:1.20.0-alpine
+    ports:
+      - 8888:80
+    volumes:
+      - ./bundles:/usr/share/nginx/html/bundles
 ```
 
 The `tutorial-docker-compose.yaml` file requires two other local files:
@@ -104,13 +115,19 @@ This tutorial uses a special Docker image named `openpolicyagent/demo-pam` to si
 This image contains pre-created Linux accounts for our users, and the required PAM module is
 pre-configured inside the `sudo` and `sshd` files in `/etc/pam.d/`.
 
-### 2. Load policies and data into OPA.
+### 2. Create a Bundle for the policies and data.
+
+In another terminal, create the policies and data that OPA will use to control access to the hosts.
+
+First, create folder called bundles and cd into it.
 
-In another terminal, load the policies and data into OPA that will control access to the hosts.
+```bash
+mkdir bundles
+cd bundles
+```
 
-First, create a policy that will tell the PAM module to collect context that is required for authorization.
-For more details on what this policy should look like, see
-[this documentation](https://github.com/open-policy-agent/contrib/tree/main/pam_authz/pam#pull).
+Next, create a policy that will tell the PAM module to collect context that is required for authorization.
+For more details on what this policy should look like, see [this documentation](https://github.com/open-policy-agent/contrib/tree/main/pam_opa/pam#pull).
 
 **pull.rego**:
 
@@ -123,17 +140,12 @@ files := ["/etc/host_identity.json"]
 # Which environment variables should be loaded into the context?
 env_vars := []
 ```
-Load this policy into OPA.
 
-```shell
-curl -X PUT --data-binary @pull.rego \
-  localhost:8181/v1/policies/pull
-```
 
-Next, create the policies that will authorize SSH and sudo requests.
+Create the policies that will authorize SSH and sudo requests.
 The `input` which makes up the authorization context in the policy below will also
 include some default values, such as the username making the request. See
-[this documentation](https://github.com/open-policy-agent/contrib/tree/main/pam_authz/pam#authz)
+[this documentation](https://github.com/open-policy-agent/contrib/tree/main/pam_opa/pam#authz)
 to get a better understanding of what the `input` to the authorization policy will look like.
 
 Unlike the *pull* policy, we'll create separate *authz* policies
@@ -154,7 +166,7 @@ import input.sysinfo
 import data.hosts
 
 # By default, users are not authorized.
-default allow = false
+default allow := false
 
 # Allow access to any user that has the "admin" role.
 allow {
@@ -179,12 +191,7 @@ errors["Request denied by administrative policy"] {
 }
 ```
 
-Load this policy into OPA.
 
-```shell
-curl -X PUT --data-binary @sshd_authz.rego \
-  localhost:8181/v1/policies/sshd/authz
-```
 
 Create the `sudo` authorization policy. It should allow only admins to use `sudo`.
 
@@ -194,7 +201,7 @@ Create the `sudo` authorization policy. It should allow only admins to use `sudo
 package sudo.authz
 
 # By default, users are not authorized.
-default allow = false
+default allow := false
 
 # Allow access to any user that has the "admin" role.
 allow {
@@ -207,25 +214,27 @@ errors["Request denied by administrative policy"] {
 }
 ```
 
-Load this policy into OPA.
 
-```shell
-curl -X PUT --data-binary @sudo_authz.rego \
-  localhost:8181/v1/policies/sudo/authz
-```
 
-Finally, load the data that represents our roles and contributors into OPA.
+Now we need to create the data that represents our roles, hots, and contributors into OPA.
+
+Create a folder called roles, and the following data file.
 
 ```shell
-curl -X PUT localhost:8181/v1/data/roles -d \
-'{
+mkdir roles
+cat <<EOF > roles/data.json
+{
     "admin": ["ops"]
-}'
+}
+EOF
+
 ```
 
+Create a folder called hosts, and the following data file.
 ```shell
-curl -X PUT localhost:8181/v1/data/hosts -d \
-'{
+mkdir hosts
+cat <<EOF > hosts/data.json
+{
   "frontend": {
     "contributors": [
       "frontend-dev"
@@ -236,9 +245,35 @@ curl -X PUT localhost:8181/v1/data/hosts -d \
       "backend-dev"
     ]
   }
-}'
+}
+EOF
+```
+
+Finally create the bundle for the bundle server to use.
+
+```bash
+opa build -b .
+```
+
+Now you should have the following file structure setup.
+
+```
+.
+└── tutorial-docker-compose.yaml
+├── backend_host_id.json
+├── frontend_host_id.json
+├── bundles
+│   ├── bundle.tar.gz
+│   ├── pull.rego
+│   ├── sshd_authz.rego
+│   ├── sudo_authz.rego
+│   ├── hosts
+│   │   └── data.json
+│   ├── roles
+│   │   └── data.json
 ```
 
+
 ### 3. SSH and sudo as a user with the `admin` role.
 
 First, let's try to access the hosts as the `ops` user. Recall, the `ops` user
@@ -259,7 +294,7 @@ You will see a lot of verbose logs from `sudo` as the PAM module goes through th
 This is intended so you can study how the PAM module works.
 You can disable verbose logging by changing the `log_level` argument in the PAM
 configuration. For more details see
-[this documentation](https://github.com/open-policy-agent/contrib/tree/main/pam_authz/pam#configuration).
+[this documentation](https://github.com/open-policy-agent/contrib/tree/main/pam_opa/pam#configuration).
 
 ### 4. SSH as a user without the `admin` role.
 
@@ -294,13 +329,16 @@ their rights should be removed.
 Let's mock the current state of this simple ticketing system's API with some data.
 
 ```shell
-curl -X PUT localhost:8181/v1/data/elevate -d \
-'{
+mkdir elevate
+cat <<EOF > elevate/data.json
+{
   "tickets": {
     "frontend-dev": "1234"
   }
-}'
+}
+EOF
 ```
+
 This means that for now, if the `frontend-dev` user can provide ticket number `1234`,
 they should be able to SSH into all servers.
 
@@ -323,15 +361,12 @@ display_spec := [
 ]
 ```
 
-Load this policy into OPA.
 
-```shell
-curl -X PUT --data-binary @display.rego \
-  localhost:8181/v1/policies/display
-```
 
 Then we need to make sure that the authorization takes this input into account.
 
+**sudo_authz_elevated.rego**:
+
 ```live:sudo_authz/elevate:module:read_only
 # A package can be defined across multiple files.
 package sudo.authz
@@ -347,11 +382,10 @@ allow {
 }
 ```
 
-Load this policy into OPA.
+Now we need to build a new bundle for OPA to use.
 
 ```shell
-curl -X PUT --data-binary @sudo_authz_elevated.rego \
-  localhost:8181/v1/policies/sudo_authz_elevated
+opa build -b .
 ```
 
 Confirm that the user `frontend-dev` can indeed use `sudo`.
@@ -376,10 +410,17 @@ For `sudo`, enter the ticket number `1234` to get access.
 Lastly, update the mocked elevation API and confirm the user's original rights are restored.
 
 ```shell
-curl -X PUT localhost:8181/v1/data/elevate -d \
-'{
+cat <<EOF > elevate/data.json
+{
   "tickets": {}
-}'
+}
+EOF
+```
+
+Once again, build the bundle with this new data
+
+```bash
+opa build -b .
 ```
 
 You will find that running `sudo ls /` as the `frontend-dev` user is disallowed again.
@@ -387,7 +428,7 @@ You will find that running `sudo ls /` as the `frontend-dev` user is disallowed
 It is possible to configure the *display* policy to only make the PAM module prompt for the
 elevation ticket when our mock API has a non-empty `tickets` object. So when there are no
 elevated users, there will be no prompt for a ticket. This can be done using the Rego
-[`count` aggregate](http://www.openpolicyagent.org/docs/language-reference.html#aggregates).
+[`count` aggregate](../policy-reference/#aggregates).
 
 ## Wrap Up
 
diff --git a/docs/content/storage.md b/docs/content/storage.md
new file mode 100644
index 0000000000..bb815f8338
--- /dev/null
+++ b/docs/content/storage.md
@@ -0,0 +1,185 @@
+---
+title: Storage
+kind: operations
+weight: 60
+---
+
+## Disk
+
+This page outlines configuration options relevant to using the disk storage
+feature of OPA.
+Configuration options are to be found in [the configuration docs](../configuration/#disk-storage).
+
+{{< info >}}
+The persistent disk storage enables OPA to work with data that does not fit
+into the memory resources granted to the OPA server.
+It is **not** supposed to be used as the primary source of truth for that data.
+
+The on-disk storage should be considered ephemeral: you need to secure the
+means to restore that data.
+Backup and restore, or repair procedures for data corruption are not provided
+at this time.
+{{< /info >}}
+
+### Partitions
+
+Partitions determine how the JSON data is split up when stored in the
+underlying key-value store.
+For example, this table shows how an example document would be stored given
+different configured partitions:
+
+```json
+{
+  "users": {
+    "alice": { "roles": ["admin"] },
+    "bob": { "roles": ["viewer"] }
+  }
+}
+```
+
+| Partitions | Keys | Values |
+| --- | --- | --- |
+| (1) none | `/users` | `{"alice": {"roles": ["admin"]}, "bob": {"roles": ["viewer"]}}}` |
+| --- | --- | --- |
+| (2) `/users` | `/users/alice` | `{"roles": ["admin"]}`  |
+|          | `/users/bob`   | `{"roles": ["viewer"]}` |
+| --- | --- | --- |
+| (3) `/users/*` | `/users/alice/roles` | `["admin"]`  |
+|            | `/users/bob/roles`   | `["viewer"]` |
+
+Partitioning has consequences on performance: in the example above, the
+number of keys to retrieve from the database (and the amount of data of
+its values) varies.
+
+| Query | Partitions | Number of keys read |
+| --- | --- | --- |
+| `data.users` | (1) | 1 |
+|              | (2) | 2 |
+|              | (3) | 2 |
+| --- | --- | --- |
+| `data.users.alice` | (1) | 1 with `bob` data thrown away|
+|                    | (2) | 2 |
+|                    | (3) | 2 |
+
+For example, retrieving the full extent of `data.users` from the disk store
+will require a single key fetch with the partitions of (1).
+With (2), the storage engine will fetch two keys and their values.
+
+Retrieving a single user's data, e.g. `data.users.alice`, will require
+reading a single key and all the users data with (1); but throw away most
+of it: all the data not belonging to `alice`.
+
+There is no one-size-fits-all setting for partitions: good settings depend
+on the actual usage, and that comes down to the policies that are used with
+OPA.
+Commonly, you would optimize the partition settings for those queries that
+are performance critical.
+
+To figure out suboptimal partitioning, please have a look at the exposed
+metrics.
+
+OPA stores some internal values (such as bundle metadata) in the data store,
+under `/system`. Partitions for that part of the data store are managed by
+OPA, and providing any overlapping partitions in the config will raise an
+error.
+
+### Metrics
+
+Using the [REST API](../rest-api/), you can include the `?metrics` query string
+to gain insights into the disk storage access related to a certain OPA query.
+
+```
+$ curl 'http://localhost:8181/v1/data/tenants/acme1/bindings/user1?metrics' | opa eval -I 'input.metrics' -fpretty
+{
+  "counter_disk_read_bytes": 339,
+  "counter_disk_read_keys": 3,
+  "counter_server_query_cache_hit": 1,
+  "timer_disk_read_ns": 40736,
+  "timer_rego_external_resolve_ns": 251,
+  "timer_rego_input_parse_ns": 656,
+  "timer_rego_query_eval_ns": 66616,
+  "timer_server_handler_ns": 117539
+}
+```
+
+The `timer_disk_*_ns` timers give an indication about how much time
+was spent with the different disk operations.
+
+Available timers are
+
+- `timer_disk_read_ns`
+- `timer_disk_write_ns`
+- `timer_disk_commit_ns`
+
+Also note the `counter_disk_*` counters in the metrics:
+
+- `counter_disk_read_keys`: number of keys retrieved
+- `counter_disk_written_keys`: number of keys written
+- `counter_disk_deleted_keys`: number of keys deleted
+- `counter_disk_read_bytes`: bytes retrieved
+
+Suboptimal partition settings can be spotted when the amount of
+keys and bytes retrieved for a query is unproportional to the
+actual data returned: the query likely had to retrieve a giant
+JSON object, and most of it was thrown away.
+
+### Debug Logging
+
+Pass `--log-level debug` to `opa run` to see all the underlying storage
+engine's logs.
+
+When debug logging is _enabled_, the service will output some
+statistics about the configured disk partitions and their key
+sizes.
+
+```
+[DEBUG] partition /tenants/acme3/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+[DEBUG] partition /tenants/acme4/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+[DEBUG] partition /tenants/acme8/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+[DEBUG] partition /tenants/acme9/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+[DEBUG] partition /tenants/acme0/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+[DEBUG] partition /tenants/acme2/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+[DEBUG] partition /tenants/acme6/bindings (pattern /tenants/*/bindings): key count: 10000 (estimated size 598890 bytes)
+```
+
+Note that this process will iterate over all database keys.
+It only happens on startup, when debug logging is enabled.
+
+### Fine-tuning Badger settings (superflags)
+
+While partitioning should be the first thing to look into to tune the memory usage and
+performance of the on-disk storage engine, this configurable gives you the means to
+change many internal aspects of how Badger uses memory and disk storage.
+
+{{< danger >}}
+To be used with care!
+
+Any of the Badger settings used by OPA can be overridden using this feature.
+There is no validation happening for configurables set using this flag.
+
+When the embedded Badger version changes, these configurables could change,
+too.
+{{< /danger >}}
+
+The configurables correspond to Badger options that can be set on [the library's Options
+struct](https://pkg.go.dev/github.com/dgraph-io/badger/v3#Options).
+
+The following configurables can _not_ be overridden:
+
+- `dir`
+- `valuedir`
+- `detectconflicts`
+
+Aside from conflict detection, Badger in OPA uses the default options [you can find here](https://github.com/dgraph-io/badger/blob/v3.2103.2/options.go#L128-L187).
+
+Conflict detection is disabled because the locking scheme used within OPA does not allow
+for having multiple concurrent writes.
+
+#### Example
+
+```yaml
+storage:
+  disk:
+    directory: /tmp/disk
+    badger: nummemtables=1; numgoroutines=2; maxlevels=3
+```
diff --git a/docs/content/terraform.md b/docs/content/terraform.md
index 8b78acb08b..6331d3dba0 100644
--- a/docs/content/terraform.md
+++ b/docs/content/terraform.md
@@ -25,7 +25,7 @@ This tutorial requires
 * [Terraform 0.12.6](https://releases.hashicorp.com/terraform/0.12.6/)
 * [OPA](https://github.com/open-policy-agent/opa/releases)
 
-(This tutorial *should* also work with the [latest version of Terraform](https://www.terraform.io/downloads.html), but 
+(This tutorial *should* also work with the [latest version of Terraform](https://www.terraform.io/downloads.html), but
 it is untested.  Contributions welcome!)
 
 # Getting Started
@@ -75,7 +75,7 @@ terraform plan --out tfplan.binary
 
 ### 2. Convert the Terraform plan into JSON
 
-Use the command [terraform show](https://www.terraform.io/docs/commands/show.html) to convert the Terraform plan into 
+Use the command [terraform show](https://www.terraform.io/docs/commands/show.html) to convert the Terraform plan into
 JSON so that OPA can read the plan.
 
 ```shell
@@ -452,7 +452,7 @@ and there are no changes made to any IAM resources.
 (For simplicity, the threshold in this tutorial is the same for everyone, but in
 practice you would vary the threshold depending on the user.)
 
-**terraform.rego**:
+**policy/terraform.rego**:
 
 ```live:terraform:module:openable
 package terraform.analysis
@@ -480,14 +480,14 @@ resource_types := {"aws_autoscaling_group", "aws_instance", "aws_iam", "aws_laun
 #########
 
 # Authorization holds if score for the plan is acceptable and no changes are made to IAM
-default authz = false
+default authz := false
 authz {
     score < blast_radius
     not touches_iam
 }
 
 # Compute the score for a Terraform plan as the weighted sum of deletions, creations, modifications
-score = s {
+score := s {
     all := [ x |
             some resource_type
             crud := weights[resource_type];
@@ -510,7 +510,7 @@ touches_iam {
 ####################
 
 # list of all resources of a given type
-resources[resource_type] = all {
+resources[resource_type] := all {
     some resource_type
     resource_types[resource_type]
     all := [name |
@@ -520,7 +520,7 @@ resources[resource_type] = all {
 }
 
 # number of creations of resources of a given type
-num_creates[resource_type] = num {
+num_creates[resource_type] := num {
     some resource_type
     resource_types[resource_type]
     all := resources[resource_type]
@@ -530,7 +530,7 @@ num_creates[resource_type] = num {
 
 
 # number of deletions of resources of a given type
-num_deletes[resource_type] = num {
+num_deletes[resource_type] := num {
     some resource_type
     resource_types[resource_type]
     all := resources[resource_type]
@@ -539,7 +539,7 @@ num_deletes[resource_type] = num {
 }
 
 # number of modifications to resources of a given type
-num_modifies[resource_type] = num {
+num_modifies[resource_type] := num {
     some resource_type
     resource_types[resource_type]
     all := resources[resource_type]
@@ -551,10 +551,10 @@ num_modifies[resource_type] = num {
 ### 4. Evaluate the OPA policy on the Terraform plan
 
 To evaluate the policy against that plan, you hand OPA the policy, the Terraform plan as input, and
-ask it to evaluate `data.terraform.analysis.authz`.
+ask it to evaluate `terraform/analysis/authz`.
 
 ```shell
-opa eval --format pretty --data terraform.rego --input tfplan.json "data.terraform.analysis.authz"
+opa exec --decision terraform/analysis/authz --bundle policy/ tfplan.json
 ```
 ```live:terraform/authz:query:hidden
 data.terraform.analysis.authz
@@ -567,7 +567,7 @@ If you're curious, you can ask for the score that the policy used to make the au
 In our example, it is 11 (10 for the creation of the auto-scaling group and 1 for the creation of the server).
 
 ```shell
-opa eval --format pretty --data terraform.rego --input tfplan.json "data.terraform.analysis.score"
+opa exec --decision terraform/analysis/score --bundle policy/ tfplan.json
 ```
 
 ```live:terraform/score:query:hidden
@@ -648,24 +648,31 @@ terraform show -json tfplan_large.binary > tfplan_large.json
 Evaluate the policy to see that it fails the policy tests and check the score.
 
 ```shell
-opa eval --data terraform.rego --input tfplan_large.json "data.terraform.analysis.authz"
-opa eval --data terraform.rego --input tfplan_large.json "data.terraform.analysis.score"
+opa exec --decision terraform/analysis/authz --bundle policy/ tfplan_large.json
+opa exec --decision terraform/analysis/score --bundle policy/ tfplan_large.json
 ```
 
-### 6. (Optional) Run OPA as a daemon and evaluate policy
+### 6. (Optional) Run OPA using a remote policy bundle
 
-In addition to running OPA from the command-line, you can run it as a daemon loaded with the Terraform policy and
-then interact with it using its HTTP API.  First, start the daemon:
+In addition to loading policies from the local filesystem, `opa exec` can fetch policies from remote locations via [Bundles](../management-bundles). To see this in action, first build the policies into a bundle:
 
 ```shell
-opa run -s terraform.rego
+opa build policy/
 ```
 
-Then in a separate terminal, use OPA's HTTP API to evaluate the policy against the two Terraform plans.
+Next, serve the bundle via nginx:
+
+```bash
+docker run --rm --name bundle_server -d -p 8888:80 -v ${PWD}:/usr/share/nginx/html:ro nginx:latest
+```
+
+Then run `opa exec` with bundles enabled:
 
-```shell
-curl localhost:8181/v0/data/terraform/analysis/authz -d @tfplan.json
-curl localhost:8181/v0/data/terraform/analysis/authz -d @tfplan_large.json
+```
+opa exec --decision terraform/analysis/authz \
+  --set services.bundle_server.url=http://localhost:8888 \
+  --set bundles.tutorial.resource=bundle.tar.gz \
+  tfplan_large.json
 ```
 
 ## Wrap Up
@@ -689,7 +696,7 @@ If you'd like to explore an additional example that uses terraform modules pleas
 
 ## Module Steps
 
-### 1. Create and save Terraform module plan 
+### 1. Create and save Terraform module plan
 
 Create a new Terraform file that includes a
 security group and security group from a module.  (This example uses the module from https://github.com/terraform-aws-modules/terraform-aws-security-group)
@@ -767,7 +774,7 @@ The policy evaluates if a security group is valid based on the contents of it's
 
 The policy uses the walk keyword to explore the json structure, and uses conditions to filter for the specific paths where resources would be found.
 
-**terraform_module.rego**:
+**policy/terraform_module.rego**:
 
 ```rego
 package terraform.module
@@ -780,7 +787,7 @@ deny[msg] {
 
 resources := { r |
     some path, value
-    
+
     # Walk over the JSON tree and check if the node we are
     # currently on is a module (either root or child) resources
     # value.
@@ -788,15 +795,15 @@ resources := { r |
 
     # Look for resources in the current value based on path
     rs := module_resources(path, value)
-    
+
     # Aggregate them into `resources`
     r := rs[_]
 }
 
 # Variant to match root_module resources
-module_resources(path, value) = rs {
+module_resources(path, value) := rs {
     # Expect something like:
-    #     
+    #
     #     {
     #     	"root_module": {
     #         	"resources": [...],
@@ -806,16 +813,16 @@ module_resources(path, value) = rs {
     #     }
     #
     # Where the path is [..., "root_module", "resources"]
-    
+
     reverse_index(path, 1) == "resources"
     reverse_index(path, 2) == "root_module"
     rs := value
 }
 
 # Variant to match child_modules resources
-module_resources(path, value) = rs {
+module_resources(path, value) := rs {
     # Expect something like:
-    #     
+    #
     #     {
     #     	...
     #         "child_modules": [
@@ -832,13 +839,13 @@ module_resources(path, value) = rs {
     # Note that there will always be an index int between `child_modules`
     # and `resources`. We know that walk will only visit each one once,
     # so we shouldn't need to keep track of what the index is.
-    
+
     reverse_index(path, 1) == "resources"
     reverse_index(path, 3) == "child_modules"
     rs := value
 }
 
-reverse_index(path, idx) = value {
+reverse_index(path, idx) := value {
 	value := path[count(path) - idx]
 }
 ```
@@ -849,15 +856,22 @@ To evaluate the policy against that plan, you hand OPA the policy, the Terraform
 ask it to evaluate `data.terraform.module.deny`.
 
 ```shell
-opa eval --format pretty --data terraform_module.rego --input tfplan2.json "data.terraform.module.deny"
+opa exec --decision terraform/module/deny --bundle policy/ tfplan2.json
 ```
 
 This should return one of the two resources. The security group created by the module uses HTTP in its description and therefore fails the evaluation.
 
 ```shell
-[
-"No security groups should be using HTTP. Resource in violation: module.http_sg.aws_security_group.this_name_prefix[0]"
-]
+{
+  "result": [
+    {
+      "path": "tfplan2.json",
+      "result": [
+        "No security groups should be using HTTP. Resource in violation: module.http_sg.aws_security_group.this_name_prefix[0]"
+      ]
+    }
+  ]
+}
 ```
 
 ## Module Wrap Up
@@ -870,4 +884,4 @@ Additional use cases might include:
 
 * Ensuring all resources have tags before they are created
 * Making sure naming standards for resources are followed
-* Security or operational requirements
\ No newline at end of file
+* Security or operational requirements
diff --git a/docs/content/wasm.md b/docs/content/wasm.md
index 43b3ac31ad..5dcd1aeb68 100644
--- a/docs/content/wasm.md
+++ b/docs/content/wasm.md
@@ -1,7 +1,7 @@
 ---
 title: WebAssembly
-kind: misc
-weight: 1
+kind: documentation
+weight: 110
 ---
 
 # What is WebAssembly (Wasm)?
@@ -33,7 +33,7 @@ You can compile Rego policies into Wasm modules using the `opa build` subcommand
 
 For example, the `opa build` command below compiles the `example.rego` file into a
 Wasm module and packages it into an OPA bundle. The `wasm` target requires at least
-one entrypoint rule (specified by `-e`).
+one entrypoint rule (specified by `-e`, or a metadata `entrypoint` annotation).
 
 ```bash
 opa build -t wasm -e example/allow example.rego
@@ -41,6 +41,7 @@ opa build -t wasm -e example/allow example.rego
 
 The output of a Wasm module built this way contain the `result` of evaluating the
 entrypoint rule. For example:
+
 ```json
 [
   {
@@ -136,33 +137,38 @@ ABI | Notes
 1.0 | Start of ABI versioning.
 1.1 | Adds export `memory`.
 1.2 | Adds exported function `opa_eval`.
+1.3 | Adds exported functions `opa_value_free`, `opa_heap_blocks_stash`, `opa_heap_blocks_restore`, `opa_heap_stash_clear`.
 
 #### Exports
 
 The primary exported functions for interacting with policy modules are listed below.
 In the ABI column, you can find the ABI version with which the export was introduced.
 
-| Function Signature | Description | ABI
+| Function | Description | ABI
 | --- | --- | --- |
-| <span class="opa-keep-it-together">`int32 eval(ctx_addr)`</span> | Evaluates the loaded policy with the provided evaluation context. The return value is reserved for future use. | 1.0 |
-| <span class="opa-keep-it-together">`value_addr builtins(void)`</span> | Returns the address of a mapping of built-in function names to numeric identifiers that are required by the policy. | 1.0 |
-| <span class="opa-keep-it-together">`value_addr entrypoints(void)`</span> | Returns the address of a mapping of entrypoints to numeric identifiers that can be selected when evaluating the policy. | 1.0 |
-| <span class="opa-keep-it-together">`ctx_addr opa_eval_ctx_new(void)`</span> | Returns the address of a newly allocated evaluation context. | 1.0 |
-| <span class="opa-keep-it-together">`void opa_eval_ctx_set_input(ctx_addr, value_addr)`</span> | Set the input value to use during evaluation. This must be called before each `eval()` call. If the input value is not set before evaluation, references to the `input` document result produce no results (i.e., they are undefined.) | 1.0 |
-| <span class="opa-keep-it-together">`void opa_eval_ctx_set_data(ctx_addr, value_addr)`</span>  | Set the data value to use during evalutaion. This should be called before each `eval()` call. If the data value is not set before evalutaion, references to base `data` documents produce no results (i.e., they are undefined.) | 1.0 |
-| <span class="opa-keep-it-together">`void opa_eval_ctx_set_entrypoint(ctx_addr, entrypoint_id)`</span>  | Set the entrypoint to evaluate. By default, entrypoint with id `0` is evaluated. | 1.0 |
-| <span class="opa-keep-it-together">`value_addr opa_eval_ctx_get_result(ctx_addr)`</span> | Get the result set produced by the evaluation process. | 1.0 |
-| <span class="opa-keep-it-together">`addr opa_malloc(int32 size)`</span> | Allocates size bytes in the shared memory and returns the starting address. | 1.0 |
-| <span class="opa-keep-it-together">`void opa_free(addr)`</span> | Free a pointer. Calls `opa_abort` on error. | 1.0 |
-| <span class="opa-keep-it-together">`value_addr opa_json_parse(str_addr, size)`</span> | Parses the JSON serialized value starting at str_addr of size bytes and returns the address of the parsed value. The parsed value may refer to a null, boolean, number, string, array, or object value. | 1.0 |
-| <span class="opa-keep-it-together">`value_addr opa_value_parse(str_addr, size)`</span> | The same as `opa_json_parse` except Rego set literals are supported. | 1.0 |
-| <span class="opa-keep-it-together">`str_addr opa_json_dump(value_addr)`</span> | Dumps the value referred to by `value_addr` to a null-terminated JSON serialized string and returns the address of the start of the string. Rego sets are serialized as JSON arrays. Non-string Rego object keys are serialized as strings. | 1.0 |
-| <span class="opa-keep-it-together">`str_addr opa_value_dump(value_addr)`</span> | The same as `opa_json_dump` except Rego sets are serialized using the literal syntax and non-string Rego object keys are not serialized as strings. | 1.0 |
-| <span class="opa-keep-it-together">`void opa_heap_ptr_set(addr)`</span> | Set the heap pointer for the next evaluation. | 1.0 |
-| <span class="opa-keep-it-together">`addr opa_heap_ptr_get(void)`</span> | Get the current heap pointer. | 1.0 |
-| <span class="opa-keep-it-together">`int32 opa_value_add_path(base_value_addr, path_value_addr, value_addr)`</span> | Add the value at the `value_addr` into the object referenced by `base_value_addr` at the given path. The `path_value_addr` must point to an array value with string keys (eg: `["a", "b", "c"]`). Existing values will be updated. On success the value at `value_addr` is no longer owned by the caller, it will be freed with the base value. The path must be freed by the caller after use (see `opa_free`). If an error occurs the base value will remain unchanged. Example: base object `{"a": {"b": 123}}`, path `["a", "x", "y"]`, and value `{"foo": "bar"}` will yield `{"a": {"b": 123, "x": {"y": {"foo": "bar"}}}}`. Returns an error code (see below). | 1.0 |
-| <span class="opa-keep-it-together">`int32 opa_value_remove_path(base_value_addr, path_value_addr)`</span> | Remove the value from the object referenced by `base_value_addr` at the given path. Values removed will be freed. The path must be freed by the caller after use (see `opa_free`). The `path_value_addr` must point to an array value with string keys (eg: `["a", "b", "c"]`). Returns an error code (see below). | 1.0 |
-| <span class="opa-keep-it-together">`str_addr opa_eval(_ addr, entrypoint_id int32, data value_addr, input str_addr, input_len int32, heap_ptr addr, format int32)`</span> | One-off policy evaluation method. Its arguments are everything needed to evaluate: entrypoint, address of data in memory, address and length of input JSON string in memory, heap address to use, and the output format (`0` is JSON, `1` is "value", i.e. serialized Rego values). The first argument is reserved for future use and must be `0`. Returns the address to the serialised result value. | 1.2 |
+| `eval` | <div>`int32 eval(ctx_addr)`</div><div>Evaluates the loaded policy with the provided evaluation context. The return value is reserved for future use. </div> | 1.0 |
+| `builtins` | <div>`value_addr builtins(void)`</div><div>Returns the address of a mapping of built-in function names to numeric identifiers that are required by the policy. </div> | 1.0 |
+| `entrypoints` | <div>`value_addr entrypoints(void)`</div><div>Returns the address of a mapping of entrypoints to numeric identifiers that can be selected when evaluating the policy. </div> | 1.0 |
+| `opa_eval_ctx_new` | <div>`ctx_addr opa_eval_ctx_new(void)`</div><div>Returns the address of a newly allocated evaluation context. </div> | 1.0 |
+| `opa_eval_ctx_set_input` | <div>`void opa_eval_ctx_set_input(ctx_addr, value_addr)`</div><div>Set the input value to use during evaluation. This must be called before each `eval()` call. If the input value is not set before evaluation, references to the `input` document result produce no results (i.e., they are undefined.) </div> | 1.0 |
+| `opa_eval_ctx_set_data` | <div>`void opa_eval_ctx_set_data(ctx_addr, value_addr)` </div><div>Set the data value to use during evaluation. This should be called before each `eval()` call. If the data value is not set before evaluation, references to base `data` documents produce no results (i.e., they are undefined.) </div> | 1.0 |
+| `opa_eval_ctx_set_entrypoint` | <div>`void opa_eval_ctx_set_entrypoint(ctx_addr, entrypoint_id)` </div><div>Set the entrypoint to evaluate. By default, entrypoint with id `0` is evaluated. </div> | 1.0 |
+| `opa_eval_ctx_get_result` | <div>`value_addr opa_eval_ctx_get_result(ctx_addr)`</div><div>Get the result set produced by the evaluation process. </div> | 1.0 |
+| `opa_malloc` | <div>`addr opa_malloc(int32 size)`</div><div>Allocates size bytes in the shared memory and returns the starting address. </div> | 1.0 |
+| `opa_free` | <div>`void opa_free(addr)`</div><div>Free a pointer. Calls `opa_abort` on error. </div> | 1.0 |
+| `opa_json_parse` | <div>`value_addr opa_json_parse(str_addr, size)`</div><div>Parses the JSON serialized value starting at str_addr of size bytes and returns the address of the parsed value. The parsed value may refer to a null, boolean, number, string, array, or object value. </div> | 1.0 |
+| `opa_value_parse` | <div>`value_addr opa_value_parse(str_addr, size)`</div><div>The same as `opa_json_parse` except Rego set literals are supported. </div> | 1.0 |
+| `opa_json_dump` | <div>`str_addr opa_json_dump(value_addr)`</div><div>Dumps the value referred to by `value_addr` to a null-terminated JSON serialized string and returns the address of the start of the string. Rego sets are serialized as JSON arrays. Non-string Rego object keys are serialized as strings. </div> | 1.0 |
+| `opa_value_dump` | <div>`str_addr opa_value_dump(value_addr)`</div><div>The same as `opa_json_dump` except Rego sets are serialized using the literal syntax and non-string Rego object keys are not serialized as strings. </div> | 1.0 |
+| `opa_heap_ptr_set` | <div>`void opa_heap_ptr_set(addr)`</div><div>Set the heap pointer for the next evaluation. </div> | 1.0 |
+| `opa_heap_ptr_get` | <div>`addr opa_heap_ptr_get(void)`</div><div>Get the current heap pointer. </div> | 1.0 |
+| `opa_value_add_path` | <div>`int32 opa_value_add_path(base_value_addr, path_value_addr, value_addr)`</div><div>Add the value at the `value_addr` into the object referenced by `base_value_addr` at the given path. The `path_value_addr` must point to an array value with string keys (eg: `["a", "b", "c"]`). Existing values will be updated. On success the value at `value_addr` is no longer owned by the caller, it will be freed with the base value. The path value must be freed by the caller after use by calling `opa_value_free`. (The original path string passed to `opa_json_parse` or `opa_value_parse` to create the value must be freed by calling `opa_free`.) If an error occurs the base value will remain unchanged. Example: base object `{"a": {"b": 123}}`, path `["a", "x", "y"]`, and value `{"foo": "bar"}` will yield `{"a": {"b": 123, "x": {"y": {"foo": "bar"}}}}`. Returns an error code (see below). </div> | 1.0 |
+| `opa_value_remove_path` | <div>`int32 opa_value_remove_path(base_value_addr, path_value_addr)`</div><div>Remove the value from the object referenced by `base_value_addr` at the given path. Values removed will be freed. The path value must be freed by the caller after use by calling `opa_value_free`. (The original path string parsed by `opa_json_parse` or `opa_value_parse` must be released using `opa_free`.) The `path_value_addr` must point to an array value with string keys (eg: `["a", "b", "c"]`). Returns an error code (see below). </div> | 1.0 |
+| `opa_value_free` | <div>`void opa_value_free(value_addr)`</div><div>Free a value such as one generated by `opa_value_parse` or `opa_json_parse` reference at `value_addr`</div> | 1.3 |
+| `opa_heap_blocks_stash` | <div>`void opa_heap_blocks_stash(void)`</div><div>Stash free heap blocks in a shadow heap to enable `eval` or `opa_eval` to allocate only blocks that it can subsequently free with a call to `opa_heap_ptr_set`.  The caller should subsequently call `opa_heap_ptr_get` and store the value to save before calling `opa_heap_bloks_restore`</div> | 1.3 |
+| `opa_heap_blocks_restore` | <div>`void opa_heap_blocks_restore(void)`</div><div>Restore heap blocks stored by `opa_heap_blocks_stash` to the heap.  This should only be called after a `opa_heap_ptr_set` to the a heap pointer recorded by `opa_heap_ptr_get` after the previous call to `opa_heap_blocks_stash`.</div> | 1.3 |
+| `opa_heap_stash_clear` | <div>`void opa_heap_stash_clear(void)`</div><div>Drop all heap blocks saved by `opa_heap_blocks_stash`.  This leaks memory in the VM unless the caller subsquently invokes `opa_heap_ptr_set` to a value taken prior to calling `opa_heap_blocks_stash`. (see below)</div> | 1.3 |
+| `opa_eval` | <div>`str_addr opa_eval(_ addr, entrypoint_id int32, data value_addr, input str_addr, input_len int32, heap_ptr addr, format int32)`</div><div>One-off policy evaluation method. Its arguments are everything needed to evaluate: entrypoint, address of data in memory, address and length of input JSON string in memory, heap address to use, and the output format (`0` is JSON, `1` is "value", i.e. serialized Rego values). The first argument is reserved for future use and must be `0`. Returns the address to the serialised result value. </div> | 1.2 |
 
 The addresses passed and returned by the policy modules are 32-bit integer
 offsets into the shared memory region. The `value_addr` parameters and return
@@ -257,7 +263,7 @@ The (optional) `input` document for a policy can be provided by loading a JSON
  returned address. After the raw string is loaded into memory you will need to
  call the `opa_json_parse` exported method to get an address to the parsed input
  document for use in evaluations. Set the address via the
- `opa_eval_ctx_set_input` exported functoin supplying the evaluation context
+ `opa_eval_ctx_set_input` exported function supplying the evaluation context
  address and parsed input document address.
 
 #### External Data
@@ -277,6 +283,61 @@ reset by calling `opa_heap_ptr_set` to ensure that evaluation restarts back at t
 saved data and re-uses heap space. This is particularly important if re-evaluating many
 times with the same data.
 
+If you want to continue to update data in between query evaluations then the calling
+convention is a little more sophisticated due to the way that `eval` and `opa_eval`
+release temporary memory between queries.  The functions `opa_heap_blocks_stash` and
+`opa_heap_blocks_restore` provide a safe way to stash free heap memory during queries
+and then restore it for use when adding or removing further external data. Without
+using these, the `eval` and `opa_eval` calls will leak all heap blocks below the
+heap pointer.  The calling convention is as follows:
+
+* It's always prudent at VM initialization to call `opa_malloc` with a size of 0
+and then `opa_heap_ptr_get` to obtain the initial value of the heap pointer for the
+VM.  Call this the "initial heap pointer".
+* If you never load external data, you can use the "initial heap pointer" as your
+"data heap pointer" for calls to `eval` or `opa_eval`.
+* On the first load of external data, after calling `opa_heap_ptr_get` also call
+`opa_heap_blocks_stash`. This will save free heap memory for reuse later and prevent
+calls to `eval` or `opa_eval` from leaking that memory. Call the saved heap pointer
+after the initial data document load the "data heap pointer".  This "data heap 
+pointer" is the value that should be used in `eval` or `opa_eval` calls.
+* On subsequent calls to modify the data document using `opa_value_add_path` or
+`opa_value_remove_path`, do the following:
+    1. Call `opa_heap_ptr_set` passing the "data heap pointer" to reset the heap
+       and clear any memory left from `eval` or `opa_eval` calls.
+    2. Call `opa_heap_blocks_restore` to reinstate the heap stashed heap memory.
+    3. Call `opa_malloc`/`opa_json_parse`/`opa_free` to create the "path" and
+       "value" arguments (in WASM value form) as usual.
+    4. Call `opa_value_add_path` or `opa_value_remove_path` as usual.
+    5. Call `opa_value_free` on the "path" argument to release it as usual.
+    6. Call `opa_value_blocks_stash` to stash any free heap blocks to
+       protect them during `eval` or `opa_eval` calls.
+    7. Call `opa_heap_ptr_get` to get a new "data heap pointer".  It may
+       be larger or smaller than the previous value depending upon which
+       internal memory the calls allocated or released.
+* The calling convention for `eval` and `opa_eval` don't change at all.
+* If, at any point, you wish to reset the VM to an initial state with regard
+  to the policy data then do the following:
+    1. Call `opa_heap_stash_clear` to drop all stashed heap blocks (if any).
+    2. Call `opa_heap_ptr_set` with the "initial heap pointer" to reset the
+       heap to its initial state.
+    3. Use the "initial heap pointer" as your new "data heap pointer" until
+       the next time you add external data in the VM.
+
+It might seem counter-intuitive to hide available heap memory from calls
+to `eval` or `opa_eval`. But that memory was never truly available for
+queries in the first place.  The very first call to `opa_heap_ptr_set`
+(either before `eval` or which `opa_eval` calls internally) resets the heap
+and leaks any free blocks on the heap.  In versions of the ABI prior to
+1.3 this memory was simply lost.  Note, however, that multiple queries
+would not continue to leak memory since they would always reset the heap
+pointer to the same value.  The WASM engine would only leak further
+memory if there were subsequent calls to `opa_value_add_path` or
+`opa_value_remove_path` followed by more queries.  ABI 1.3 introduced the
+calling convention using `opa_heap_blocks_stash` and
+`opa_heap_blocks_restore` to allow for interleaving query evaluations
+with incremental data document modifications.
+
 #### Entrypoints
 
 The compiled policy may have one or more entrypoints. If no entrypoint is set
diff --git a/docs/devel/RELEASE.md b/docs/devel/RELEASE.md
index a2b031d68e..90c9e0fb7a 100644
--- a/docs/devel/RELEASE.md
+++ b/docs/devel/RELEASE.md
@@ -15,6 +15,25 @@ should be tagged with the semantic version identifying the release.
 Publishing involves creating a new *Release* on GitHub with the relevant
 CHANGELOG.md snippet and uploading the binaries from the build phase.
 
+> Note: This release process is subject to change without notice.
+
+## Release Cadence
+
+There are two version tracks for the OPA project:
+
+1. Release Candidate (vX.Y.Z-rc.A)
+2. Stable (vX.Y.Z)
+
+A new version of OPA is scheduled to release on the last Friday of every month. At the beginning of that week,
+we will create a release candidate branch (`release-<major>.<minor>-rc.0`) from the main branch and create a release
+candidate tag (`v<major>.<minor>.0-rc.0`) based on the release candidate branch for pre-release. Once the pre-release
+is published, users are encouraged to try out the features, bug fixes in the release candidate. If regressions or bugs
+are detected, they need to get fixed before cutting the stable release. We do not recommend using OPA release
+candidates in a production environment. The stable release that comes out after the release candidate may be identical
+to the release candidate if no other features or bug fixes are introduced to the main branch in between.
+
+See the next section for details on cutting an individual release.
+
 ## Versioning
 
 The steps below assume an OPA development environment has configured for the
@@ -28,6 +47,19 @@ standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
 	git fetch --tags upstream
 	```
 
+	Note: This stage can fail if you have not registered an [SSH key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account)
+	on your Github account.
+
+1. Create a release branch off of `main`, to ensure you don't mangle your
+   fork while creating the release:
+
+	```
+	git checkout -b release-v<version> origin/main
+	```
+
+1. Create a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
+   for GitHub with the 'read:org' scope. Export it to the `GITHUB_TOKEN` environment variable.
+
 1. Execute the release-patch target to generate boilerplate patch. Give the semantic version of the release:
 
 	```
@@ -50,7 +82,7 @@ standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
 	```
 	git add .
 	git commit -s -m "Prepare v<version> release"
-	git push origin main
+	git push origin release-v<version>
 	```
 
 1. Create a Pull Request for the release preparation commit.
@@ -64,6 +96,12 @@ standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
 
     > Note: Ensure that tag is pointing to the correct commit ID! It must be the merged release preparation commit.
 
+1. Create a new branch for the dev-patch work:
+
+    ```
+	git checkout -b dev-v<next_semvar> origin/main
+	```
+
 1. Execute the dev-patch target to generate boilerplate patch. Give the semantic version of the next release:
 
 	```
@@ -83,7 +121,7 @@ standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
 
 	```
 	git commit -a -s -m "Prepare v<next_semvar> development"
-	git push origin main
+	git push origin dev-v<next_semvar>
 	```
 
 1. Create a Pull Request for the development preparation commit.
@@ -161,7 +199,7 @@ make release-patch VERSION=0.14.1 > ~/release.patch
 Apply the patch to the working copy and preview the changes:
 
 ```bash
-patch -p1 < ~/dev.patch
+patch -p1 < ~/release.patch
 git diff
 ```
 
@@ -182,6 +220,7 @@ Once the Pull Request has merged fetch the latest changes and tag the commit to
 prepare for publishing. Use the same instructions as defined above in normal
 release [publishing](#publishing) guide (being careful to tag the appropriate commit).
 
-Last step is to copy the CHANGELOG snippet and capabilities.json for the version to `main`. Create
-a new PR with the version information added below the `Unreleased` section. Remove
-any `Unreleased` notes if they were included in the bugfix release.
+Last step is to copy the CHANGELOG snippet and generated files
+(builtin_metadata.json and capabilities.json) for the version to `main`. Create
+a new PR with the version information added below the `Unreleased` section.
+Remove any `Unreleased` notes if they were included in the bugfix release.
diff --git a/docs/website/.gitignore b/docs/website/.gitignore
index 8344f3cb54..9b37253b89 100644
--- a/docs/website/.gitignore
+++ b/docs/website/.gitignore
@@ -4,4 +4,5 @@ resources/
 
 # Documentation versions
 generated/*
-data/releases.yaml
\ No newline at end of file
+data/releases.yaml
+data/builtin_metadata.json
\ No newline at end of file
diff --git a/docs/website/assets/js/app.js b/docs/website/assets/js/app.js
index 31e9fb0c97..3b54766d91 100644
--- a/docs/website/assets/js/app.js
+++ b/docs/website/assets/js/app.js
@@ -1,3 +1,9 @@
+function initBannerVersionWarningCloseButton() {
+  $(".banner-version-warning").find(".delete").click(function() {
+    $(".dashboard-wrapper").removeClass("showing-banner-version-warning");
+  });
+}
+
 function navbarBurger() {
   $(".navbar-burger").click(function() {
     $(".navbar-burger").toggleClass("is-active");
@@ -19,6 +25,8 @@ $(function() {
 document.addEventListener("DOMContentLoaded", function(event) {
   anchors.add();
 
+  initBannerVersionWarningCloseButton();
+
   // TODO: We should probably look into updating the tocbot library
   // but for now we can pad the bottom of the content to make
   // sure you can scroll into each section of the ToC.
@@ -38,7 +46,7 @@ document.addEventListener("DOMContentLoaded", function(event) {
     contentSelector: '.content',
     headingSelector: 'h1, h2, h3, h4, h5',
     scrollSmooth: false,
-    scrollContainer: ".dashboard-main",
+    scrollContainer: ".article",
     scrollEndCallback: function(e) {
       // Make sure the current ToC item we are on is visible in the nav bar
       $('.docs-nav-item.is-active')[0].scrollIntoView();
diff --git a/docs/website/assets/sass/custom.sass b/docs/website/assets/sass/custom.sass
index 278dc62f21..3f839a2f9d 100644
--- a/docs/website/assets/sass/custom.sass
+++ b/docs/website/assets/sass/custom.sass
@@ -60,8 +60,55 @@
 .article
   padding-bottom: 5rem
 
+  .hero
+    width: 75%
+
+    +touch
+      width: 100%
+
+    .hero-body
+      padding: 2rem 1.5rem 0 3rem
+
+      +touch
+        padding: 0 2rem
+
+  .section
+    padding: 0rem 3rem
+
+    +touch
+      padding: 0rem 2rem
+
   .content
     width: 75%
 
     +touch
       width: 100%
+
+  .icon-edit
+    float: right
+    padding-top: 2rem
+    line-height: 0.5rem
+    text-align: center
+
+    span
+      font-size: 0.7rem
+
+div.bi-args
+  display: grid
+  grid-template-columns: min-content min-content auto
+  margin-bottom: 1rem
+
+  .name
+    grid-column-start: 1
+
+  .type
+    grid-column-start: 2
+    white-space: nowrap
+
+  .desc
+    grid-column-start: 3
+    margin-left: 1rem
+
+table.bi-cat
+  code
+    white-space: nowrap
\ No newline at end of file
diff --git a/docs/website/assets/sass/docs.sass b/docs/website/assets/sass/docs.sass
index 7c2f855db3..984b16f9dd 100644
--- a/docs/website/assets/sass/docs.sass
+++ b/docs/website/assets/sass/docs.sass
@@ -1,5 +1,23 @@
 $panel-header-logo-width: 85%
 
+.dashboard-wrapper
+  .banner-version-warning
+    display: none
+  .dashboard-main
+    .article
+      +desktop
+        // this is the height of the navbar only
+        max-height: calc(100vh - 3.5rem)
+        overflow: scroll
+.dashboard-wrapper.showing-banner-version-warning
+  .banner-version-warning
+    display: block
+  .dashboard-main
+    .article
+      +desktop
+        // this is the height of the navbar and warning banner
+        max-height: calc(100vh - 10.5rem)
+
 =flex
   display: flex
 
@@ -15,7 +33,6 @@ $panel-header-logo-width: 85%
   +row
   position: relative
   overflow: hidden
-  height: 100vh
 
   .is-scrollable
     overflow-y: auto
@@ -126,3 +143,54 @@ $panel-header-logo-width: 85%
 .dropdown-menu .dropdown-content
   max-height: 55vh
   overflow-y: auto
+
+.highlight
+  margin-bottom: 1.5rem // matches what live-blocks does
+
+.dashboard-wrapper
+  display: flex
+  flex-flow: column
+  height: 100%
+  max-height: 100vh
+
+.dashboard
+  flex: 1 1 auto
+
+  .navbar
+    @media screen and (min-width: 1024px)
+      position: sticky
+      top: 0
+
+.dashboard-panel-content
+  margin: 0 0 0 2rem
+  padding: 0 2rem 0 0
+
+.banner-version-warning
+  // override bulma defaults for messages
+  margin-bottom: 0 !important
+  border-radius: 0
+  font-size: 1.2rem
+  font-weight: bold
+  border-top: 1rem solid transparent
+  border-bottom: 1rem solid transparent
+  .message-body
+    border: none
+    border-radius: 0
+    button.delete
+      float: right
+      margin-top: 0.25rem
+
+  // this is used to make the banner appear in the same position as the page
+  // scrolls
+  position: sticky
+  width: 100%
+  z-index: 100
+
+  // different types of message should have different colors. The colors are
+  // duplicated from the bulma since we're not using variables
+  &.is-danger
+    border-image: 50 repeating-linear-gradient(75deg, #cc0f35 0, #cc0f35 1rem, transparent 0, transparent 2rem)
+  &.is-warning
+    border-image: 50 repeating-linear-gradient(75deg, #946c00 0, #946c00 1rem, transparent 0, transparent 2rem)
+  &.is-info
+    border-image: 50 repeating-linear-gradient(75deg, #296fa8 0, #296fa8 1rem, transparent 0, transparent 2rem)
diff --git a/docs/website/assets/sass/style.sass b/docs/website/assets/sass/style.sass
index b7cd5dfd0c..2cad4bab53 100644
--- a/docs/website/assets/sass/style.sass
+++ b/docs/website/assets/sass/style.sass
@@ -18,6 +18,7 @@ $link: $opa-blue
 $family-sans-serif: "Helvetica Neue", Helvetica, Arial, sans-serif
 $hero-padding: 0
 $section-padding: 0 2rem
+$hero-body-padding-tablet: 3rem 3rem 0 3rem
 $gap: 2px
 
 @import "bulma/sass/utilities/derived-variables"
diff --git a/docs/website/config.toml b/docs/website/config.toml
index f09bc51a57..590a2c7313 100644
--- a/docs/website/config.toml
+++ b/docs/website/config.toml
@@ -1,8 +1,7 @@
 title = "Open Policy Agent"
-baseURL = "https://openpolicyagent.org"
+baseURL = "https://www.openpolicyagent.org"
 languageCode = "en"
 disableKinds = ["taxonomy", "taxonomyTerm"]
-googleAnalytics = "UA-84550302-1"
 
 pygmentsCodeFences = true
 pygmentsUseClasses = false
@@ -21,7 +20,8 @@ unsafe = true
 [params]
 description = "Policy-based control for cloud native environments"
 tagline = "Empower your administrators with flexible, fine-grained control across your entire stack."
-algolia_api_key = "26fa0633923a7cb9432cf2851b77dca6"
+algolia_api_key = "40a3909859478f0b23c385214feab2ef"
+GithubEdit = "https://github.com/open-policy-agent/opa/edit/main/docs/content/"
 
 [params.social]
 twitter = "OpenPolicyAgent"
@@ -36,7 +36,7 @@ navbar = "/img/logos/opa-icon-white.png"
 
 [params.ui]
 [params.ui.feedback]
-# Requires googleAnalytics to be set to track feedback events
+# Requires Google Analytics to be enabled for the site.
 # Set hide_feedback: true in a page's front matter to disable feedback for that page
 enable = true
 
diff --git a/docs/website/data/integrations.yaml b/docs/website/data/integrations.yaml
index 0228a0e34f..6344bae821 100644
--- a/docs/website/data/integrations.yaml
+++ b/docs/website/data/integrations.yaml
@@ -1,6 +1,206 @@
 # This file is used to generate the OPA ecosystem page: https://www.openpolicyagent.org/docs/latest/ecosystem/
 # For instructions on how to add an entry, see https://github.com/open-policy-agent/opa/tree/main/docs#integration-index
 integrations:
+
+  torque:
+    title: Torque
+    description: Torque by Quali is a cloud-based platform that provides infrastructure automation and orchestration solutions for digital transformation and DevOps initiatives. Troque utilizes Open Policy Agent (OPA) to enforce policy-as-code, enabling users to define and automate their own security, compliance, and governance policies across their infrastructure.
+    labels:
+      category: Environments as a Service
+      layer: Infrastructure
+      type: poweredbyopa
+    software:
+      - terraform
+      - helm
+      - cloudformation
+      - kubernetes
+      - ansible
+      - aws
+      - gcp
+      - azure
+    tutorials:
+      - https://docs.qtorque.io/governance/policies
+    code:
+      - https://github.com/QualiTorque/opa
+    inventors:
+      - quali
+    blogs:
+      - https://www.quali.com/blog/enforcing-open-policy-agent-guardrails-across-your-cloud-configurations/
+
+  styra-das:
+    title: Styra Declarative Authorization Service
+    description: Styra DAS provides a single pane of glass for authorization and policy across the cloud-native ecosystem of software systems. Beyond a simple control plane, Styra DAS pushes OPA’s potential, providing powerful impact analysis, policy authoring, and decision logging.
+    software:
+      - styra-das
+      - kubernetes
+      - envoy
+      - terraform
+    labels:
+      category: authorization
+      type: poweredbyopa
+    tutorials:
+      - https://docs.styra.com/getting-started
+      - https://docs.styra.com/tutorials/kubernetes/introduction
+      - https://docs.styra.com/tutorials/envoy/introduction
+      - https://docs.styra.com/tutorials/ssh/introduction
+      - https://docs.styra.com/tutorials/terraform/introduction
+      - https://docs.styra.com/tutorials/entitlements/introduction
+      - https://academy.styra.com/courses/opa-rego
+    code:
+      - https://github.com/StyraInc/das-opa-samples
+      - https://github.com/StyraInc/example-policy-management
+      - https://github.com/StyraInc/entitlements-samples
+    inventors:
+      - styra
+    blogs:
+      - https://blog.styra.com/blog/six-of-my-favorite-styra-declarative-authorization-service-das-features
+      - https://blog.styra.com/blog/styra-declarative-authorization-service-expands-service-mesh-use-case
+      - https://blog.styra.com/blog/opa-styra-terraform-protect-your-cloud-investment
+      - https://www.styra.com/blog/how-to-write-your-first-rules-in-rego-the-policy-language-for-opa
+    videos:
+      - title: "Securing Microservices-Based Apps with Dynamic Traffic Authz"
+        speakers:
+          - name: Kurt Roekle
+            organization: styra
+        venue: online
+        link: https://www.youtube.com/watch?v=9F-Zyn9j25g
+      - title: "Policy Management Across the Cloud-Native Stack: Styra DAS for Terraform"
+        speakers:
+          - name: Kurt Roekle
+            organization: styra
+        venue: online
+        link: https://www.youtube.com/watch?v=3K0RqIvNfAc
+
+  circleci:
+    title: CircleCI
+    description: Use config policy management to create organization-level policies to impose rules and scopes around which configuration elements are required, allowed, not allowed etc.
+    software:
+      - circleci
+    labels:
+      category: tooling
+      layer: cicd
+      type: poweredbyopa
+    tutorials:
+      - https://circleci.com/docs/config-policy-management-overview/
+    inventors:
+      - circleci
+
+  aws-cloudformation-hook:
+    title: AWS CloudFormation Hook
+    description: AWS CloudFormation Hook that uses OPA to make policy decisions on infrastructure provisioned via AWS CloudFormation
+    software:
+      - aws
+      - cloudformation
+    labels:
+      type: poweredbyopa
+    tutorials:
+      - https://www.openpolicyagent.org/docs/latest/aws-cloudformation-hooks/
+    code:
+      - https://github.com/StyraInc/opa-aws-cloudformation-hook
+    blogs:
+      - https://blog.styra.com/blog/the-opa-aws-cloudformation-hook
+    inventors:
+      - styra
+
+  oauth2:
+    title: OAuth2
+    description: Integrating OAuth2 with Open Policy Agent
+    software:
+      - oauth
+    labels:
+      category: security
+    tutorials:
+      - https://www.openpolicyagent.org/docs/latest/oauth-oidc/
+    blogs:
+      - https://blog.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent
+
+  oidc:
+    title: OpenID Connect (OIDC)
+    description: Integrating OpenID Connect (OIDC) with Open Policy Agent
+    software:
+      - oauth
+      - oidc
+    labels:
+      category: security
+    tutorials:
+      - https://www.openpolicyagent.org/docs/latest/oauth-oidc/
+    blogs:
+      - https://blog.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent
+
+  google-kubernetes-engine:
+    title: Google Kubernetes Engine (GKE)
+    description: OPA related tools and policy libraries for Kubernetes in the Google Cloud Platform
+    software:
+      - kubernetes
+      - google-kubernetes-engine
+    labels:
+      category: containers
+      layer: orchestration
+    code:
+      - https://github.com/google/gke-policy-automation
+    tutorials:
+      - https://github.com/google/gke-policy-automation/tree/main/gke-policies
+    inventors:
+      - google
+
+  apache-apisix:
+    title: Authorization Integration with Apache APISIX
+    description: Apache APISIX provides a plugin for delegating fine-grained authorization decisions to OPA.
+    software:
+      - apache-apisix
+    labels:
+      category: gateway
+      layer: network
+    code:
+      - https://github.com/apache/apisix
+    inventors:
+      - apache-apisix
+    blogs:
+      - https://apisix.apache.org/blog/2021/12/24/open-policy-agent
+      - https://medium.com/@ApacheAPISIX/apache-apisix-integrates-with-open-policy-agent-to-enrich-its-ecosystem-15569fe3ab9c
+
+  dapr:
+    title: Dapr
+    description: Middleware to apply Open Policy Agent policies on incoming requests
+    software:
+      - dapr
+    labels:
+      category: application
+      layer: network
+    tutorials:
+      - https://docs.dapr.io/reference/components-reference/supported-middleware/middleware-opa/
+    code:
+      - https://github.com/dapr/dapr
+
+  fig:
+    title: fig
+    description: Beautiful shell autocompletion for OPA and many other commands, for Mac OS
+    software:
+      - fig
+    labels:
+      category: utilities
+      layer: shell
+    code:
+      - https://github.com/open-policy-agent/contrib/tree/main/opa_fig_autocomplete
+      - https://github.com/withfig/autocomplete/blob/master/src/opa.ts
+    inventors:
+      - fig
+
+  fiber:
+    title: fiber
+    description: |
+      Fiber is an Express inspired web framework built on top of Fasthttp, the fastest HTTP engine for Go.
+      Designed to ease things up for fast development with zero memory allocation and performance in mind.
+      With Open Policy Agent integration, you can run your Rego policies as part of the request lifecycle in the middleware.
+    labels:
+      category: application
+      layer: library
+    software:
+      - golang
+      - fiber
+    code:
+      - https://github.com/gofiber/contrib/tree/main/opafiber
+
   sphinx-rego:
     title: Automatically document Rego policies
     description: Sphinx extension that automatically documents Open Policy Agent Rego policies using meta properties.
@@ -10,7 +210,6 @@ integrations:
       - https://github.com/zenitysec/sphinx-rego
     inventors:
       - zenity
-    category: tooling
     labels:
       category: tooling
       layer: cicd
@@ -93,7 +292,6 @@ integrations:
           - name: Joe Beda
             organization: VMware
         link: https://www.youtube.com/watch?v=QU9BGPf0hBw
-
     blogs:
       - https://medium.com/@sbueringer/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
       - https://medium.com/@jimmy.ray/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203
@@ -108,9 +306,14 @@ integrations:
       Kubernetes Authorization is a pluggable mechanism that lets administrators control which users can run which APIs and
       is often handled by builtin RBAC.  OPA's policy language is more flexible than the RBAC, for example,
       writing policy using a prohibited list of APIs instead of the usual RBAC style of listing the permitted APIs.
+    code:
+      - https://github.com/open-policy-agent/contrib/tree/main/k8s_authorization
     blogs:
+      - https://blog.styra.com/blog/kubernetes-authorization-webhook
       - https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
       - https://itnext.io/optimizing-open-policy-agent-based-kubernetes-authorization-via-go-execution-tracer-7b439bb5dc5b
+    inventors:
+      - styra
 
   kubernetes-provisioning:
     title: Kubernetes Provisioning
@@ -212,6 +415,17 @@ integrations:
     inventors:
       - build.security
 
+  nginx:
+    title: Nginx
+    description: OPA Authorization for Nginx
+    labels:
+      category: gateway
+      layer: network
+    software:
+      - nginx
+    code:
+      - https://github.com/summerwind/opa-nginx-rbac
+
   asp-dotnet-core:
     title: ASP.NET Core
     description: |
@@ -299,7 +513,6 @@ integrations:
         venue: Kubecon Austin 2017
         link: https://www.youtube.com/watch?v=R6tUNpRpdnY
 
-
   istio-authorization-edge:
     title: Container Network Authorization with Istio (at the Edge)
     description: Istio is a networking abstraction for cloud-native applications that uses Envoy at the edge. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.
@@ -385,24 +598,20 @@ integrations:
     description: Apache Kafka is a high-performance distributed streaming platform deployed by thousands of companies.  OPA provides fine-grained, context-aware access control of which users can read/write which Kafka topics to enforce important requirements around confidentiality and integrity.
     software:
       - kafka
-      - strimzi
     labels:
       category: streaming
       layer: data
-    tutorials:
-      - https://www.openpolicyagent.org/docs/kafka-authorization.html
     blogs:
-      - https://strimzi.io/blog/2020/08/05/using-open-policy-agent-with-strimzi-and-apache-kafka/
+      - https://opencredo.com/blogs/controlling-kafka-data-flows-using-open-policy-agent/
+    tutorials:
+      - https://www.openpolicyagent.org/docs/latest/kafka-authorization/
     code:
+      - https://github.com/StyraInc/opa-kafka-plugin
       - https://github.com/llofberg/kafka-authorizer-opa
-      - https://github.com/open-policy-agent/contrib/tree/master/kafka_authorizer
-      - https://github.com/Bisnode/opa-kafka-plugin
-      - https://github.com/strimzi/strimzi-kafka-operator
+      - https://github.com/opencredo/opa-single-message-transformer
     inventors:
       - ticketmaster
       - styra
-      - bisnode
-      - redhat
     videos:
       - title: "OPA at Scale: How Pinterest Manages Policy Distribution"
         speakers:
@@ -413,6 +622,24 @@ integrations:
         venue: OPA Summit at Kubecon San Diego 2019
         link: https://www.youtube.com/watch?v=LhgxFICWsA8
 
+  strimzi:
+    title: Strimzi (Apache Kafka on Kubernetes)
+    description: Strimzi provides a way to run an Apache Kafka cluster on Kubernetes in various deployment configurations. Strimzi ships with the OPA authorizer plugin right out of the box, and supports OPA as an option for Kafka authorization.
+    software:
+      - kafka
+      - strimzi
+    labels:
+      category: streaming
+      layer: data
+    blogs:
+      - https://strimzi.io/blog/2020/08/05/using-open-policy-agent-with-strimzi-and-apache-kafka/
+      - https://strimzi.io/blog/2020/09/01/enforce-custom-resource-policies-with-opa-gatekeeper/
+    code:
+      - https://github.com/strimzi/strimzi-kafka-operator
+      - https://github.com/scholzj/demo-opa-kafka-authorization
+      - https://github.com/StyraInc/opa-kafka-plugin
+    inventors:
+      - redhat
 
   ceph:
     title: Ceph Object Storage Authorization
@@ -444,6 +671,19 @@ integrations:
     inventors:
       - styra
 
+  open-service-mesh:
+    title: Open Service Mesh (OSM)
+    description: Open Service Mesh is a lightweight and extensible cloud native service mesh.
+    software:
+      - osm
+    labels:
+      category: servicemesh
+      layer: network
+    code:
+      - https://github.com/openservicemesh/osm/blob/main/docs/example/manifests/opa/deploy-opa-envoy.yaml
+    tutorials:
+      - https://release-v0-11.docs.openservicemesh.io/docs/guides/integrations/external_auth_opa/#osm-with-opa-plugin-external-authorization-walkthrough
+
   minio:
     title: Minio API Authorization
     description: Minio is an open source, on-premise object database compatible with the Amazon S3 API.  This integration lets OPA enforce policies on Minio's API.
@@ -453,7 +693,7 @@ integrations:
       layer: data
       category: authorization
     tutorials:
-      - https://github.com/minio/minio/blob/master/docs/sts/opa.md
+      - https://github.com/minio/minio/blob/master/docs/iam/opa.md
     inventors:
       - minio
       - styra
@@ -477,10 +717,11 @@ integrations:
       - https://github.com/fugue/regula
       - https://github.com/accurics/terrascan
       - https://github.com/Checkmarx/kics
-    policies:
       - https://github.com/open-policy-agent/library/tree/master/terraform
       - https://github.com/accurics/terrascan/tree/master/pkg/policies/opa/rego
       - https://github.com/Checkmarx/kics/tree/master/assets/queries/terraform
+    blogs:
+      - https://blog.styra.com/blog/policy-based-infrastructure-guardrails-with-terraform-and-opa
     inventors:
       - fugue
       - accurics
@@ -490,6 +731,59 @@ integrations:
       - docker
       - snyk
 
+  terraform-cloud:
+    title: Terraform Cloud
+    description: Policies are rules that Terraform Cloud enforces on runs. You use the Rego policy language to write policies for the Open Policy Agent (OPA) framework.
+    software:
+      - terraform
+      - terraform-cloud
+      - aws
+      - gcp
+      - azure
+    labels:
+      category: publiccloud
+      layer: orchestration
+    tutorials:
+      - https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/opa
+      - https://developer.hashicorp.com/terraform/tutorials/cloud/drift-and-opa
+      - https://developer.hashicorp.com/terraform/cloud-docs/policy-enforcement/opa/vcs
+    videos:
+      - title: "Terraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies"
+        speakers:
+          - name: Rita Sokolova
+            organization: HashiCorp
+          - name: Cole Morrison
+            organization: HashiCorp
+        venue: HashiConf Europe 2022
+        link: https://www.youtube.com/watch?v=jO2CiYMPxFE
+    inventors:
+      - hashicorp
+
+  pulumi:
+    title: Pulumi
+    description: Build infrastructure as code in familiar languages. CrossGuard is Pulumi's policy as code offering, providing OPA as one of the options to use for defining policy.
+    software:
+      - pulumi
+      - aws
+      - gcp
+      - azure
+    labels:
+      category: publiccloud
+      layer: orchestration
+    code:
+      - https://github.com/pulumi/pulumi-policy-opa
+    blogs:
+      - https://www.pulumi.com/blog/opa-support-for-crossguard/
+    videos:
+      - title: "Testing Configuration with Open Policy Agent"
+        speakers:
+          - name: Gareth Rushgrove
+            organization: snyk
+        venue: Cloud Engineering Summit 2020
+        link: https://www.pulumi.com/resources/testing-configuration-with-open-policy-agent/
+    inventors:
+      - pulumi
+
   iptables:
     title: IPTables
     description: IPTables is a useful tool available to Linux kernel for filtering network packets. OPA makes it possible to manage IPTables rules using context-aware policy.
@@ -497,14 +791,13 @@ integrations:
       layer: network
       category: linux
     software:
-      - Linux
+      - linux
     tutorials:
       - https://github.com/open-policy-agent/contrib/blob/master/opa-iptables/docs/tutorial.md
     code:
       - https://github.com/open-policy-agent/contrib/tree/master/opa-iptables
     inventors:
-      - name: Urvil Patel
-        organization: gsoc
+      - gsoc
       - cisco
       - styra
 
@@ -536,10 +829,12 @@ integrations:
       - https://github.com/Bisnode/opa-spring-security
       - https://github.com/build-security/opa-java-spring-client
       - https://github.com/massenz/jwt-opa
+      - https://github.com/eugenp/tutorials/tree/master/spring-security-modules/spring-security-opa
 
     tutorials:
       - https://github.com/open-policy-agent/contrib/blob/master/spring_authz/README.md
       - https://github.com/massenz/jwt-opa#web-server-demo-app
+      - https://www.baeldung.com/spring-security-authorization-opa
     inventors:
       - styra
       - build.security
@@ -608,37 +903,6 @@ integrations:
     inventors:
       - styra
 
-  # These two exist in the contrib directory, but what kind of integration they are illustrating is less
-  #   clear than the others.  Need to come back to finish these.
-  # azure-cosmos-datafiltering:
-  #   title: Azure Cosmos Data Authorization
-  #   description:
-  #   labels:
-  #     layer: data
-  #     category: filtering
-  #   software:
-  #   - azurecosmos
-  #   code:
-  #   - https://github.com/open-policy-agent/contrib/tree/master/data_filter_azure
-  #   tutorials:
-  #   - https://github.com/open-policy-agent/contrib/blob/master/data_filter_azure/README.documentdb.md
-  #   inventors:
-  #   - microsoft
-
-  # azure-tablestorage-datasource:
-  #   title: Azure Table Storage as External Data
-  #   description:
-  #   labels:
-  #     type: datasource
-  #   software:
-  #   - azuretablestorage
-  #   code:
-  #   - https://github.com/open-policy-agent/contrib/tree/master/data_filter_azure
-  #   tutorials:
-  #   - https://github.com/open-policy-agent/contrib/blob/master/data_filter_azure/README.documentdb.md
-  #   inventors:
-  #   - microsoft
-
   sql-datafiltering:
     title: SQL Database Data Filtering
     description: This integration enables the client of a SQL database to enhance a SQL query so that the results obey an OPA-defined policy.
@@ -706,15 +970,11 @@ integrations:
     code:
       - https://github.com/instrumenta/conftest
     software:
-      - CUE
-      - Kustomize
+      - kustomize
       - terraform
-      - Serverless Framework
-      - AWS SAM Framework
-      - INI
-      - TOML
-      - Dockerfile
-      - HCL2
+      - aws
+      - toml
+      - docker
     videos:
       - title: "Applying Policy Throughout the Application Lifecycle with Open Policy Agent"
         speakers:
@@ -742,9 +1002,9 @@ integrations:
     title: Secure Kubernetes using eBPF & Open Policy Agent
     description: Ensure runtime security in any linux machine by combining Extended Berkeley Packet Filter(eBPF) and Open Policy Agent.
     software:
-      - Linux
-      - Kubernetes
-      - eBPF
+      - linux
+      - kubernetes
+      - ebpf
     labels:
       layer: application
       catagory: filtering
@@ -782,7 +1042,6 @@ integrations:
       - java
       - groovy
       - kotlin
-      - jvm
     code:
       - https://github.com/Bisnode/opa-gradle-plugin
       - https://plugins.gradle.org/plugin/com.bisnode.opa
@@ -809,7 +1068,6 @@ integrations:
         venue: OPA Summit at Kubecon San Diego 2019
         link: https://www.youtube.com/watch?v=jrrW855xL3s
 
-
   sysdig-image-scanner:
     title: Kubernetes Sysdig Image Scanner Admission Controller
     description: Sysdig’s OPA Image Scanner combines Sysdig Secure image scanner with OPA policy-based rego language to evaluate the scan results and the admission context, providing great flexibility on the admission decision.
@@ -885,8 +1143,7 @@ integrations:
       category: Infrastructure as Code
       layer: cicd
     software:
-      - Terraform
-      - Scalr
+      - terraform
     tutorials:
       - https://iacp.docs.scalr.com/en/latest/working-with-iacp/opa.html#creating-the-opa-policy
     code:
@@ -903,8 +1160,10 @@ integrations:
       layer: network
       category: application
     software:
-      - SPIFFE
-      - SPIRE
+      - spiffe
+      - spire
+    blogs:
+      - https://blog.styra.com/blog/zero-trust-with-envoy-spire-and-open-policy-agent-opa
     code:
       - https://github.com/spiffe/spire/blob/v1.0.2/doc/authorization_policy_engine.md
     tutorials:
@@ -920,9 +1179,9 @@ integrations:
     inventors:
       - fairwinds
     software:
-      - Kubernetes
-      - Docker
-      - Helm
+      - kubernetes
+      - docker
+      - helm
     tutorials:
       - https://insights.docs.fairwinds.com/features/policy/
       - https://insights.docs.fairwinds.com/reports/opa/
@@ -950,6 +1209,27 @@ integrations:
     blogs:
       - https://github.com/EliuX/flask-opa/tree/master/examples
 
+  permit:
+    title: Permit.io
+    description:  |
+      Permit.io empowers developers to bake in permissions and access-control into any product in minutes and takes away the pain of constantly rebuilding them.
+      Permit is based on OPA.
+    labels:
+      category: authorization
+      layer: application
+    inventors:
+      - permitio
+    code:
+      - https://github.com/permitio
+    tutorials:
+      - https://docs.permit.io/
+    videos:
+      - https://docs.permit.io/tutorials/onboarding_demo
+    blogs:
+      - https://www.permit.io/blog/introduction-to-opa
+      - https://www.permit.io/blog/implement-abac-using-opa
+      - https://www.permit.io/blog/implement-rbac-using-opa
+
   opal:
     title: OPAL (Open Policy Administration Layer)
     description:  |
@@ -959,16 +1239,32 @@ integrations:
       category: updates
       layer: application
     inventors:
-      - authorizon
+      - permitio
     software:
       - opal
     code:
-      - https://github.com/authorizon/opal
+      - https://github.com/permitio/opal
     tutorials:
-      - https://github.com/authorizon/opal/blob/master/docs/index.md
+      - https://github.com/permitio/opal/tree/master/documentation/docs/tutorials
     videos:
       - https://www.youtube.com/watch?v=K1Zm2FPfrh8
 
+  optoggles:
+    title: OPToggles (Open Policy Toggles)
+    description:  |
+      OPToggles uses OPA and OPAL to sync open-policy to your frontend with the help of feature flag solutions.
+      OPToggles creates user-targeted feature flags based on the policy rules you defined in OPA and keeps the users updated in real-time with OPAL's real-time policy and policy-data change detection.
+      OPToggles already supports launchdarkly.com and a generic REST API.
+    labels:
+      category: updates
+      layer: application
+    inventors:
+      - permitio
+    code:
+      - https://github.com/permitio/OPToggles
+    tutorials:
+      - https://optoggles.opal.ac/tutorials/demo
+
   bottle:
     title: Custom Bottle Application Authorization
     description:  |
@@ -984,7 +1280,380 @@ integrations:
     blogs:
       - https://blog.lethalbit.com/open-policy-agent-for-bottle-web-framework/
 
+  kubescape:
+    title: Kubescape Kubernetes security posture scanner
+    description: |
+      This integration uses OPA for defining security controls over Kubernetes clusters. Kubescape is a simple extensible tool
+      finding security problems in your environment. OPA enables Kubescape to implement and extend very fast to answer new problems.
+    labels:
+      category: security
+      layer: application
+    software:
+      - kubescape
+    code:
+      - https://github.com/kubescape/kubescape
+      - https://github.com/kubescape/regolibrary
+    inventors:
+      - armo
+    tutorials:
+      - https://hub.armosec.io/docs
+
+  i2scim:
+    title: i2scim.io SCIM Restful User/Group Provisioning API
+    description: |
+      i2scim.io is an open source, Apache 2 Licensed, implementation of SCIM (System for Cross-domain Identity Management RFC7643/7644) for use
+      cloud-native kubernetes platforms. i2scim supports externalized access control decisions through OPA. SCIM is a RESTful HTTP API that can be
+      used to provide a standardized way to provision accounts from Azure, Okta, PingIdentity and other providers and tools. SCIM can also be used
+      as a backing identity store for OAuth and other authentication services.
+    labels:
+      category: security
+      layer: application
+    software:
+      - i2scim
+    code:
+      - https://github.com/i2-open/i2scim
+      - https://i2scim.io
+    inventors:
+      - i2
+    tutorials:
+      - https://i2scim.io/OPA_AccessControl.html
+
+  graphene-graphql:
+    title: Custom Application with Field-level Authorization in Graphene GraphQL
+    description:  |
+      This integration demonstrates using Open Policy Agent to perform field-level Authorization with GraphQL for a custom Python application backed by Graphene.
+    labels:
+      layer: network
+      category: application
+    software:
+      - graphene-graphql
+    code:
+      - https://github.com/dolevf/graphql-open-policy-agent
+
+  rekor:
+    title: Rekor transparency log monitoring and alerting
+    description: |
+      Rekor Sidekick monitors a Rekor signature transparency log and forwards events of interest where ever you like.
+      Alert policies written in Rego determine if an event is of interest.
+    labels:
+      category: security
+      layer: application
+    software:
+      - rekor
+    inventors:
+      - sigstore
+    code:
+      - https://github.com/nsmith5/rekor-sidekick
+    videos:
+      - https://www.youtube.com/watch?v=lHSLPIo1pz8
+
+  cosign:
+    title: Container Signing, Verification and Storage in an OCI registry
+    description: |
+      Cosign is a tool for container image signing and verifying maintained under the Project Sigstore
+      in collaboration with the Linux Foundation. Among other features, Cosign supports KMS signing,
+      built-in binary transparency, and timestamping service with Rekor and Kubernetes policy enforcement.
+    labels:
+      category: security
+      layer: application
+    software:
+      - cosign
+    inventors:
+      - sigstore
+    code:
+      - https://docs.sigstore.dev/cosign/attestation#validate-in-toto-attestations
+      - https://github.com/sigstore/cosign-gatekeeper-provider
+    vides:
+      - https://www.youtube.com/watch?v=gCi9_4NYyR0
+
+  alfred:
+    title: Self-hosted Alternative to OPA Playground
+    description:  |
+      Alfred introduces a local graphical user interface to interact with Open Policy Agent and acts as an alternative to OPA's playground, allowing the user to keep information related to policy testing locally.
+    labels:
+      layer: network
+      category: application
+    software:
+      - alfred
+    code:
+      - https://github.com/dolevf/Open-Policy-Agent-Alfred
+
+  open-policy-registry:
+    title: Open Policy Registry
+    description:  |
+      The Open Policy Registry project provides a docker workflow for OPA policies. The policy CLI can be used to build, tag, sign, push, and pull OPA policies as OCIv2 container images,
+      in conjunction with any container registry. The Open Policy Registry (OPCR) is a reference implementation of a policy registry, built and hosted on GCP.
+    labels:
+      category: containers
+      layer: application
+    inventors:
+      - aserto
+    software:
+      - open-policy-registry
+    code:
+      - https://github.com/opcr-io/policy
+    tutorials:
+      - https://www.openpolicyregistry.io/docs/tutorial
+    blogs:
+      - https://www.openpolicyregistry.io/blog/docker-workflow-for-opa
+
+  aserto:
+    title: Aserto
+    description:  |
+      Aserto is a cloud-native authorization service that makes it easy to add permissions and RBAC to your SaaS applications and APIs.
+      Aserto is based on the Open Policy Agent.
+    labels:
+      category: authorization
+      layer: application
+      type: poweredbyopa
+    inventors:
+      - aserto
+    software:
+      - aserto
+    code:
+      - https://github.com/aserto-dev
+      - https://github.com/opcr-io
+    tutorials:
+      - https://docs.aserto.com/docs
+    blogs:
+      - https://www.aserto.com/blog/how-do-aserto-rego-policies-work
+      - https://www.aserto.com/blog/testing-rego-policies
+      - https://www.aserto.com/blog/aserto-on-aserto-an-opa-authorization-policy-for-aserto-tenants
+      - https://www.aserto.com/blog/rego-getting-started
+    videos:
+      - https://www.youtube.com/watch?v=RJkgmdjJn_w
+
+  topaz:
+    title: Topaz
+    description:  |
+      Topaz is an open source authorization service providing fine grained, real-time, policy based access control for applications and APIs.
+      Topaz uses OPA as its decision engine, and includes an embedded database that stores subjects, relations, and objects, inspired by the Google Zanzibar data model.
+      Topaz can be deployed as a sidecar or microservice in your cloud.
+    labels:
+      category: authorization
+      layer: application
+      type: poweredbyopa
+    inventors:
+      - aserto
+    software:
+      - topaz
+    code:
+      - https://github.com/aserto-dev/topaz
+    tutorials:
+      - https://www.topaz.sh
+      - https://github.com/aserto-dev/topaz#quickstart
+    blogs:
+      - https://www.aserto.com/blog/topaz-oss-cloud-native-authorization-combines-opa-zanzibar
+
+  emissary-ingress:
+    title: Emissary-Ingress
+    description:  |
+      Emissary-Ingress is an open-source Kubernetes-native API Gateway, Layer 7 load balancer and Kubernetes Ingress built on Envoy Proxy.
+      OPA can be integrated with Emissary as an external authorization service to enforce authorization policies over APIs.
+    labels:
+      category: network
+      layer: gateway
+    software:
+      - emissary-ingress
+    blogs:
+      - https://www.infracloud.io/blogs/emissary-ingress-opa-integration/
+
+  magda:
+    title: Magda
+    description:  |
+      Magda is a federated, Kubernetes-based, open-source data catalog system.
+      Working as Magda's central authorisation policy engine, OPA helps not only the API endpoint authorisation.
+      Magda also uses its partial evaluation feature to translate datasets authorisation decisions to other database-specific DSLs (e.g. SQL or Elasticsearch DSL) and use them for dataset authorisation enforcement in different databases.
+    labels:
+      type: poweredbyopa
+      category: application
+      layer: application
+    software:
+      - magda
+    code:
+      - https://github.com/magda-io/magda
+    blogs:
+      - https://github.com/magda-io/magda/blob/master/docs/docs/architecture/Guide%20to%20Magda%20Internals.md#authorization-authz
+
+  sansshell:
+    title: Sansshell
+    description: A non-interactive daemon for host management
+    software:
+      - sansshell
+    labels:
+      category: management
+      layer: server
+      type: poweredbyopa
+    code:
+      - https://github.com/Snowflake-Labs/sansshell
+    blogs:
+      - https://www.snowflake.com/blog/sansshell-local-host-agent/
+    inventors:
+      - snowflake
+
+  rond:
+    title: Rönd
+    description: |
+      Rönd is a lightweight container that distributes security policy enforcement throughout your application.
+    software:
+      - rond
+    labels:
+      category: authorization
+      layer: application
+    code:
+      - https://github.com/rond-authz/rond
+    tutorials:
+      - https://github.com/rond-authz/example
+    videos:
+      - title: "Rönd - The Open Source K8s sidecar that defines security policies over your APIs"
+        speakers:
+          - name: Federico Maggi
+            organization: mia-platform
+        link: https://youtu.be/ubT31NtHV8w
+    inventors:
+      - mia-platform
+    blogs:
+      - https://blog.mia-platform.eu/en/announcing-rond-new-open-source-security-enforcement-over-your-apis
+      - https://blog.mia-platform.eu/en/how-why-adopted-role-based-access-control-rbac
+
+  waltid:
+    title: walt.id
+    description:  |
+      Verifying W3C Verifiable Credentials for building SSI (Self-Sovereign Identity) use cases.
+    labels:
+      category: authorization
+      layer: application
+      type: poweredbyopa
+    inventors:
+      - waltid
+      - blockchainlabum
+      - netis
+    software:
+      - ssikit
+    code:
+      - https://github.com/walt-id/waltid-ssikit
+    tutorials:
+      - https://docs.walt.id/v/ssikit/ssi-kit/open-policy-agent
+      - https://docs.walt.id/v/ssikit/concepts/verification-policies/dynamic-policies
+    videos:
+      - title: "Verifying W3C Verifiable Credentials with the SSI Kit using OPA (Open Policy Agent)"
+        speakers:
+          - name: Severin Stampler
+            organization: waltid
+        link: https://youtu.be/mue4UjzOZ3Q
+
+  graphql:
+    title: GraphQL
+    description:  |
+      GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data.
+    labels:
+      category: network
+      layer: application
+    software:
+      - graphql
+    code:
+      - https://github.com/StyraInc/graphql-apollo-example
+    tutorials:
+      - https://www.openpolicyagent.org/docs/graphql-api-authorization/
+
+  wirelesssecuritylab:
+    title: ccbr
+    description:  |
+      CCBR is a policy management system project. It uses the policy language Rego to implement the CIS benchmark test of cloud native kubernetes. In addition, it integrates gatekeeper, manages its constraint templates, constraints and policies, and supports policy deployment and audit inspection.
+    labels:
+      category: network
+      layer: application
+    software:
+      - ccbr
+    code:
+      - https://github.com/wirelesssecuritylab/ccbr
+    inventors:
+      - wirelesssecuritylab
+
+  spacelift:
+     title: Spacelift
+     description: Spacelift is a sophisticated CI/CD platform for Infrastructure as Code including Terraform, Pulumi, CloudFormation, Kubernetes, and Ansible. Spacelift utilizes Open Policy Agent to support a variety of policy types within the platform and Policy as Code for secure and compliance Infrastructure as Code.
+     labels:
+       category: Infrastructure as Code
+       layer: cicd
+     software:
+       - terraform
+       - pulumi
+       - cloudformation
+       - kubernetes
+       - ansible
+       - aws
+       - gcp
+       - azure
+     tutorials:
+       - https://docs.spacelift.io/concepts/policy
+     code:
+       - https://github.com/spacelift-io/spacelift-policies-example-library
+     inventors:
+       - spacelift
+     blogs:
+       - https://spacelift.io/blog/what-is-open-policy-agent-and-how-it-works
+
+  easegress:
+    title: Easegress
+    description: |
+      Easegress is a Cloud Native API orchestration system.
+      OPA can be configured as a filter(plugin) to implement authorization policies for the APIs.
+    labels:
+      category: gateway
+      layer: network
+    code:
+      - https://github.com/megaease/easegress
+    inventors:
+      - megaease
+
+  styra-load:
+    title: Styra Load
+    description: Styra Load is the only enterprise-grade authorization engine built to provide resource-efficient performance for data-heavy workloads while connecting natively to your existing data sources.
+    software:
+      - styra-load
+    labels:
+      category: authorization
+      type: poweredbyopa
+    tutorials:
+      - https://docs.styra.com/load
+      - https://docs.styra.com/load/performance-testing
+      - https://docs.styra.com/load/configuration/data/kafka-streams-api
+    code:
+      - https://github.com/StyraInc/load
+    inventors:
+      - styra
+    blogs:
+      - https://www.styra.com/blog/introducing-styra-load-enterprise-opa-distribution-for-data-heavy-authorization/
+    videos:
+      - title: "Start Loving Your Data-heavy Authorization"
+        speakers:
+          - name: Torin Sandall
+            organization: styra
+          - name: Chris Hendrix
+            organization: styra
+        venue: online
+        link: https://www.youtube.com/watch?v=Is1iBPr1YVs
+
+  reposaur:
+    title: Reposaur
+    description: Audit, verify and report on development platforms (GitHub and others) easily with pre-defined and/or custom policies.
+    software:
+      - github
+    labels:
+      category: security
+      type: poweredbyopa
+    tutorials:
+      - https://docs.reposaur.com/guides/writing-your-first-policy
+    code:
+      - https://github.com/reposaur/reposaur
+    inventors:
+      - reposaur
+
 organizations:
+  quali:
+    name: Quali
+    link: https://www.quali.com/
   styra:
     name: Styra
     link: https://styra.com
@@ -996,7 +1665,7 @@ organizations:
     link: https://google.com
   travelnest:
     name: TravelNest
-    link: http://travelnest.com
+    link: https://travelnest.com
   ticketmaster:
     name: TicketMaster
     link: https://www.ticketmaster.com/
@@ -1009,6 +1678,9 @@ organizations:
   ceph:
     name: Ceph
     link: https://ceph.io/
+  fig:
+    name: fig
+    link: https://fig.io
   redhat:
     name: RedHat
     link: https://www.redhat.com
@@ -1081,6 +1753,9 @@ organizations:
   scalr:
     name: Scalr
     link: https://www.scalr.com/
+  sigstore:
+    name: Sigstore
+    link: https://sigstore.dev/
   build.security:
     name: build.security
     link: https://build.security
@@ -1096,16 +1771,77 @@ organizations:
   fairwinds:
     name: Fairwinds
     link: https://fairwinds.com
-  authorizon:
-    name: authorizon
-    link: https://authorizon.com
+  permitio:
+    name: Permit.io
+    link: https://permit.io
   alertavert:
     name: AlertAVert.com
-    link: http://www.alertavert.com/
+    link: https://www.alertavert.com/
   zenity:
     name: Zenity
-    link: http://www.zenity.io
+    link: https://www.zenity.io
+  apache-apisix:
+    name: Apache APISIX
+    link: https://apisix.apache.org/
+  armo:
+    name: ARMO
+    link: https://armosec.io
+  i2:
+    name: Independent Identity
+    link: https://www.independentid.com
+  aserto:
+    name: Aserto
+    link: https://www.aserto.com
+  snowflake:
+    name: Snowflake
+    link: https://www.snowflake.com/
+  pulumi:
+    name: Pulumi
+    link: https://www.pulumi.com/
+  mia-platform:
+    name: Mia-Platform
+    link: https://mia-platform.eu/
+  waltid:
+    name: walt.id
+    link: https://walt.id
+  blockchainlabum:
+    name: Blockchain Lab:UM
+    link: https://blockchain-lab.um.si
+  netis:
+    name: Netis
+    link:  http://netis.si/en/
+  spacelift:
+    name: Spacelift
+    link: https://spacelift.io
+  circleci:
+    name: CircleCI
+    link: https://circleci.com
+  hashicorp:
+    name: HashiCorp
+    link: https://www.hashicorp.com/
+  wirelesssecuritylab:
+    name: WirelessSecurityLab
+    link: https://github.com/wirelesssecuritylab/
+  megaease:
+    name: MegaEase
+    link: https://www.megaease.com/
+  reposaur:
+    name: Reposaur
+    link: https://reposaur.com/
+
 software:
+  oauth:
+    name: OAuth
+    link: https://oauth.net/
+  oidc:
+    name: OpenID Connect (OIDC)
+    link: https://openid.net/connect/
+  dapr:
+    name: Dapr
+    link: https://dapr.io/
+  fig:
+    name: fig
+    link: https://fig.io
   kubernetes:
     name: Kubernetes
     link: https://kubernetes.io
@@ -1133,6 +1869,9 @@ software:
   clojure:
     name: Clojure
     link: https://clojure.org
+  cosign:
+    name: Cosign
+    link: https://github.com/sigstore/cosign
   aws:
     name: Amazon Public Cloud
     link: https://aws.com
@@ -1141,13 +1880,25 @@ software:
     link: https://cloud.google.com/
   azure:
     name: Microsoft Public Cloud
-    link: http://azure.microsoft.com/
+    link: https://azure.microsoft.com/
+  cloudformation:
+    name: AWS CloudFormation
+    link: https://aws.amazon.com/cloudformation/
+  fiber:
+    name: Fiber
+    link: https://docs.gofiber.io
+  golang:
+    name: golang
+    link: https://golang.org/
   java:
     name: Java
     link: https://www.java.com/
   javaspringsecurity:
     name: Spring Security
     link: https://spring.io/projects/spring-security
+  osm:
+    name: Open Service Mesh
+    link: https://openservicemesh.io/
   spinnaker:
     name: Spinnaker
     link: https://www.spinnaker.io/
@@ -1238,3 +1989,102 @@ software:
   google-calendar:
     name: Google Calendar
     link: https://calendar.google.com/
+  apache-apisix:
+    name: Apache APISIX
+    link: https://apisix.apache.org/
+  kubescape:
+    name: Kubescape
+    link: https://github.com/kubescape/kubescape
+  i2scim:
+    name: i2 SCIM Server
+    link: https://i2scim.io
+  graphene-graphql:
+    name: Graphene GraphQL
+    link: https://graphene-python.org
+  styra-das:
+    name: Styra DAS
+    link: https://www.styra.com/styra-das/
+  styra-load:
+    name: Styra Load
+    link: https://www.styra.com/styra-load/
+  kustomize:
+    name: Kustomize
+    link: https://kustomize.io
+  toml:
+    name: TOML
+    link: https://toml.io
+  groovy:
+    name: Groovy
+    link: https://groovy-lang.org
+  kotlin:
+    name: Kotlin
+    link: https://kotlinlang.org
+  linux:
+    name: Linux
+    link: https://www.kernel.org
+  ebpf:
+    name: eBPF
+    link: https://ebpf.io
+  git:
+    name: Git
+    link: https://git-scm.com
+  pre-commit:
+    name: pre-commit
+    link: https://pre-commit.com
+  rekor:
+    name: rekor
+    link: https://github.com/sigstore/rekor
+  open-policy-registry:
+    name: Open Policy Registry
+    link: https://www.openpolicyregistry.io
+  aserto:
+    name: Aserto
+    link: https://www.aserto.com
+  topaz:
+    name: Topaz
+    link: https://www.topaz.sh
+  emissary-ingress:
+    name: Emissary-Ingress
+    link: https://github.com/emissary-ingress/emissary
+  magda:
+    name: Magda
+    link: https://github.com/magda-io/magda
+  google-kubernetes-engine:
+    name: Google Kubernetes Engine
+    link: https://cloud.google.com/kubernetes-engine/
+  sansshell:
+    name: Sansshell
+    link: https://github.com/Snowflake-Labs/sansshell
+  nginx:
+    name: Nginx
+    link: https://nginx.org/
+  pulumi:
+    name: Pulumi
+    link: https://www.pulumi.com/
+  alfred:
+    name: alfred
+    link: https://github.com/dolevf/Open-Policy-Agent-Alfred
+  rond:
+    name: Rönd
+    link: https://rond-authz.io/
+  ssikit:
+    name: ssikit
+    link: https://walt.id/ssi-kit
+  graphql:
+    name: graphql
+    link: https://graphql.org/
+  ccbr:
+    name: ccbr
+    link: https://github.com/wirelesssecuritylab/ccbr
+  ansible:
+    name: Ansible
+    link: https://www.ansible.com
+  circleci:
+    name: CircleCI
+    link: https://circleci.com
+  terraform-cloud:
+    name: Terraform Cloud
+    link: https://cloud.hashicorp.com/products/terraform
+  github:
+    name: GitHub
+    link: https://github.com
diff --git a/docs/website/edge/badge.ts b/docs/website/edge/badge.ts
new file mode 100644
index 0000000000..4b46464e94
--- /dev/null
+++ b/docs/website/edge/badge.ts
@@ -0,0 +1,29 @@
+import { Context } from "netlify:edge";
+
+const schemaVersion = 1;
+const label = "OPA";
+const releases = "https://api.github.com/repos/open-policy-agent/opa/releases/latest";
+const endpoint = "/badge-endpoint/";
+
+// this is static/img/opa-logo.svg
+const logoSvg = '<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg width="100%" height="100%" viewBox="0 0 34 34" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:1.41421;"><g><path d="M7.988,0.343c0,0 -1.84,6.196 -1.71,8.032c0.092,1.292 2.493,2.982 2.493,2.982c0,0 -1.308,1.552 -1.813,2.423c-0.521,0.898 -1.313,2.963 -1.313,2.963c0,0 -3.938,-4.622 -3.614,-6.89c0.391,-2.734 5.957,-9.51 5.957,-9.51Z" style="fill:#bfbfbf;"/><path d="M25.857,0.343c0,0 1.84,6.196 1.71,8.032c-0.092,1.292 -2.493,2.982 -2.493,2.982c0,0 1.307,1.552 1.813,2.423c0.521,0.898 1.313,2.963 1.313,2.963c0,0 3.938,-4.622 3.614,-6.89c-0.391,-2.734 -5.957,-9.51 -5.957,-9.51Z" style="fill:#bfbfbf;"/><path d="M16.984,7.6c-5.216,0 -9.819,3.695 -11.344,9.106l11.344,3.763l0,-12.869Z" style="fill:#7d9199;"/><path d="M16.974,7.58c5.215,0 9.819,3.696 11.343,9.107l-11.343,3.762l0,-12.869Z" style="fill:#566366;"/><path d="M16.954,16.7l-11.336,0l0,7.923c0,0 4.577,1.795 6.467,3.245c1.569,1.204 4.588,5.459 4.588,5.459l0.281,-0.002l0,-16.625Z" style="fill:#7d9199;"/><path d="M16.96,16.59l11.337,0l0,7.923c0,0 -4.578,1.795 -6.467,3.245c-1.612,1.238 -4.601,5.567 -4.601,5.567l-0.275,0l0.006,-16.735Z" style="fill:#566366;"/><circle cx="16.963" cy="16.32" r="1.427" style="fill:#fff;"/></g></svg>';
+
+export default async (req: Request, context: Context) => {
+  const url = new URL(req.url);
+
+  const version = url.pathname.slice(endpoint.length); // "/badge-endpoint/v0.46.1" => "v0.46.1"
+
+  const latest = await fetch(releases)
+    .then((response) => response.json())
+    .then((data) => data.tag_name);
+
+  const res = {
+    schemaVersion,
+    label,
+    logoSvg,
+    message: version,
+    color: latest == version ? "green" : "yellow",
+  };
+
+  return context.json(res);
+};
\ No newline at end of file
diff --git a/docs/website/layouts/404.html b/docs/website/layouts/404.html
index 270f9acd93..e84b0ff7d6 100644
--- a/docs/website/layouts/404.html
+++ b/docs/website/layouts/404.html
@@ -20,12 +20,13 @@
         color: #008a98;
       }
 
-     body,html {
-      height: 100%;
-      overflow: hidden;}
+      body,html {
+        height: 100%;
+        overflow: hidden;
+      }
 
-      .headline--wave--fg { bottom: 200px;}
-      .headline--wave--bg { bottom: 230px;}
+      .headline--wave--fg { bottom: 200px; }
+      .headline--wave--bg { bottom: 230px; }
 
       h1,p {
         text-align: center;
diff --git a/docs/website/layouts/docs/ecosystem.html.html b/docs/website/layouts/docs/ecosystem.html.html
index b1f466cecb..879d35f894 100644
--- a/docs/website/layouts/docs/ecosystem.html.html
+++ b/docs/website/layouts/docs/ecosystem.html.html
@@ -5,12 +5,20 @@
 {{ define "main" }}
 <script type="application/javascript">
     function openModal(modalID) {
-        $("#"+modalID).addClass("is-active")
+      location.hash = `#${modalID}`;
+      $("#"+modalID).addClass("is-active");
     }
 
     function closeModal(modalID) {
-        $("#"+modalID).removeClass("is-active")
+      location.hash = "";
+      $("#"+modalID).removeClass("is-active");
     }
+
+    window.addEventListener('DOMContentLoaded', () => {
+      if (location.hash) {
+        $(location.hash).addClass("is-active");
+      }
+    });
 </script>
   <div class="dashboard">
       {{ partial "docs/dashboard-panel.html" . }}
@@ -18,8 +26,6 @@
     <div class="dashboard-main is-scrollable">
         {{ partial "docs/navbar.html" . }}
 
-
-
         <div class="integration-index">
           <nav class="navbar ecosystem-navbar">
             <div class="ecosystem-container">
@@ -94,7 +100,7 @@
           {{ $name := (index $integrations "name") }}
           {{ $rank := (index $integrations "rank") }}
           {{ $integration := (index $.Site.Data.integrations.integrations $name) }}
-          <div class="integration-item" onclick="openModal('{{ $name }}-detail-modal')">
+          <div class="integration-item" onclick="openModal('{{ $name }}-detail')">
             <div class="card is-flex-grow-1">
               <div class="card-image">
                 <figure class="image">
@@ -106,8 +112,8 @@
               </div>
             </div>
           </div>
-          <div id="{{ $name }}-detail-modal" class="modal">
-            <div class="modal-background" onclick="closeModal('{{ $name }}-detail-modal')"></div>
+          <div id="{{ $name }}-detail" class="modal">
+            <div class="modal-background" onclick="closeModal('{{ $name }}-detail')"></div>
             <div class="modal-content has-background-light">
               <div class="media integration-details">
                 <div class="media-left">
@@ -217,7 +223,7 @@
                   {{ end }}
                 </div>
                 <div class="media-right">
-                  <button class="delete" onclick="closeModal('{{ $name }}-detail-modal')"></button>
+                  <button class="delete" onclick="closeModal('{{ $name }}-detail')"></button>
                 </div>
               </div>
             </div>
diff --git a/docs/website/layouts/docs/section.en.html b/docs/website/layouts/docs/section.en.html
index 69c0821a8f..1fad840e8c 100644
--- a/docs/website/layouts/docs/section.en.html
+++ b/docs/website/layouts/docs/section.en.html
@@ -3,5 +3,5 @@
 {{ end }}
 
 {{ define "main" }}
-{{ partial "docs/dashboard.html" . }}
+  {{ partial "docs/dashboard.html" . }}
 {{ end }}
\ No newline at end of file
diff --git a/docs/website/layouts/docs/single.en.html b/docs/website/layouts/docs/single.en.html
index 99045bd370..cd6ec3c23d 100644
--- a/docs/website/layouts/docs/single.en.html
+++ b/docs/website/layouts/docs/single.en.html
@@ -3,5 +3,5 @@
 {{ end }}
 
 {{ define "main" }}
-{{ partial "docs/dashboard.html" . }}
-{{ end }}
\ No newline at end of file
+  {{ partial "docs/dashboard.html" . }}
+{{ end }}
diff --git a/docs/website/layouts/index.html b/docs/website/layouts/index.html
index 6326d5ef57..bf7e0aae26 100644
--- a/docs/website/layouts/index.html
+++ b/docs/website/layouts/index.html
@@ -1,4 +1,8 @@
 {{ define "main" }}
+{{- $latest := "latest" -}}
+{{- if eq (len site.Data.releases) 1 -}}
+{{- $latest = "edge" -}}
+{{- end -}}
   <!doctype html>
   <html lang="en">
 
@@ -22,8 +26,7 @@
     <nav class="navbar navbar-expand-lg navbar-dark bg-transparent">
       <div class="container">
 
-        <a class="navbar-brand" href="/"><img src="./img/logo-white.png"
-                                                 class="img-fluid"></a>
+        <a class="navbar-brand" href="/"><img src="./img/logo-white.png" class="img-fluid"></a>
         <button class="navbar-toggler navbar-toggler-right collapsed"
                 type="button" data-toggle="collapse"
                 data-target="#navb" aria-expanded="false">
@@ -35,25 +38,14 @@
           </ul>
 
           <ul class="navbar-nav">
-            <li class="nav-item">
-              <a class="nav-link" href="./docs/latest/">Documentation </a>
-            </li>
-            <li class="nav-item">
-              <a class="nav-link" href="./docs/latest/#running-opa">Download </a>
-            </li>
-            <li class="nav-item">
-              <a class="nav-link"
-                 href="./docs/latest/ecosystem/">Ecosystem </a>
-            </li>
-            <li class="nav-item">
-              <a class="nav-link" href="./support">Support</a>
-            </li>
-            <li class="nav-item">
-              <a class="nav-link" href="https://play.openpolicyagent.org/">Playground</a>
-            </li>
-            <li class="nav-item">
-              <a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a>
-            </li>
+            <li class="nav-item"><a class="nav-link" href="./docs/{{ $latest }}/">Docs</a></li>
+            <li class="nav-item"><a class="nav-link" href="./docs/{{ $latest }}/#running-opa">Download</a></li>
+            <li class="nav-item"><a class="nav-link" href="./docs/{{ $latest }}/ecosystem/">Ecosystem</a></li>
+            <li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
+            <li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
+            <li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
+            <li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
+            <li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
             <li class="nav-item social-nav-item">
               <a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
                 <img src="./img/twitter-icon.png" alt="Twitter">
@@ -79,12 +71,6 @@
     </nav>
   </div>
 
-  <!-- <section id="homebackground">
-      <div class="bg"><img src="./img/homebg.png"></div>
-      <div class="cloud-top"><img src="./img/cloudAll.png"></div>
-      <div class="homepageconterimage"><img src="./img/homeBanner.png"></div>
-    </section> -->
-
   <section id="homebackground">
 
     <div class="bg">
@@ -235,17 +221,19 @@ <h2>Declarative Policy</h2>
                                         </pre>
                                 </div>
                                 <div class="highlight">
-                                    <a onclick='window.open("https://play.openpolicyagent.org/p/ikesWCFIH8")'>
+                                    <a onclick='window.open("https://play.openpolicyagent.org/p/9OTwNMYSog")'>
                                         <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                                           <code class="language-live"
                                                 data-lang="live:kubernetes_registry_check_desktop:module:read_only">package kubernetes.admission
 
-deny[msg] {
-    input.request.kind.kind == "Pod"
-    some i
-    image := input.request.object.spec.containers[i].image
-    not startswith(image, "hooli.com/")
-    msg := sprintf("image '%v' comes from untrusted registry", [image])
+import future.keywords
+
+deny contains msg if {
+	input.request.kind.kind == "Pod"
+	some container in input.request.object.spec.containers
+	image := container.image
+	not startswith(image, "hooli.com/")
+	msg := sprintf("image '%s' comes from untrusted registry", [image])
 }
                                           </code>
                                         </pre>
@@ -262,7 +250,7 @@ <h2>Declarative Policy</h2>
                                   <button
                                       class="mt-4 btn btn-primary btn-playground"><a
                                       target="_blank"
-                                      href="https://play.openpolicyagent.org/p/ikesWCFIH8">Open In Playground
+                                      href="https://play.openpolicyagent.org/p/9OTwNMYSog">Open In Playground
                                       <img src="/live-blocks/icons/playground-open.svg"
                                         class="launch-playground-icon"></a>
                                   </button>
@@ -314,22 +302,29 @@ <h2>Declarative Policy</h2>
                                   </pre>
                                 </div>
                                 <div class="highlight">
-                                  <a onclick='window.open("https://play.openpolicyagent.org/p/oL4Ofd1nQi")'>
+                                  <a onclick='window.open("https://play.openpolicyagent.org/p/lttuKeuUpW")'>
                                     <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                                       <code class="language-live"
                                             data-lang="live:kubernetes_ingress_check_desktop:module:read_only">package kubernetes.admission
+
+import future.keywords
+
 # Reject any ingress with the same host as an existing ingress
-deny[msg] {
-    input.request.kind.kind == "Ingress"
-    # iterate over all hosts in input Ingress
-    some i
-    newhost := input.request.object.spec.rules[i].host
-    # iterate over all existing ingresses and all hosts for each ingress
-    some namespace, name, j
-    oldhost := data.kubernetes.ingresses[namespace][name].spec.rules[j].host
-    # reject if the oldhost and the newhost are the same
-    newhost == oldhost
-    msg := sprintf("ingress host conflicts with ingress %v/%v", [namespace, name])
+deny contains msg if {
+	input.request.kind.kind == "Ingress"
+
+	# iterate over all hosts in input Ingress
+	some rule in input.request.object.spec.rules
+	newhost := rule.host
+
+	# iterate over all existing ingresses and all hosts for each ingress
+	some namespace, name
+	some oldrule in data.kubernetes.ingresses[namespace][name].spec.rules
+	oldhost := oldrule.host
+
+	# reject if the oldhost and the newhost are the same
+	newhost == oldhost
+	msg := sprintf("ingress host conflicts with ingress %s/%s", [namespace, name])
 }
                                       </code>
                                     </pre>
@@ -347,8 +342,8 @@ <h2>Declarative Policy</h2>
                                 <div class="text-center blue">
                                   <button
                                       class="mt-4 btn btn-primary btn-playground"><a
-                                      target=”_blank”
-                                      href="https://play.openpolicyagent.org/p/oL4Ofd1nQi">Open In Playground
+                                      target="_blank"
+                                      href="https://play.openpolicyagent.org/p/lttuKeuUpW">Open In Playground
                                       <img src="/live-blocks/icons/playground-open.svg"
                                         class="launch-playground-icon"></a>
                                   </button>
@@ -445,17 +440,21 @@ <h2>Declarative Policy</h2>
                                 </pre>
                               </div>
                               <div class="highlight">
-                                <a onclick='window.open("https://play.openpolicyagent.org/p/DqXNKeLm20")'>
+                                <a onclick='window.open("https://play.openpolicyagent.org/p/WXAYEQWHKI")'>
                                   <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                                     <code class="language-live"
                                           data-lang="live:envoy_get_pets_desktop:module:read_only">package envoy.authz
 
+import future.keywords
+
 # allow all GET requests to /pets
-default allow = false
-allow {
-    input.attributes.request.http.method == "GET"
-    input.attributes.request.http.path == "/pets"
+default allow := false
+
+allow if {
+	input.attributes.request.http.method == "GET"
+	input.attributes.request.http.path == "/pets"
 }
+
                                     </code>
                                   </pre>
                                 </a>
@@ -471,8 +470,8 @@ <h2>Declarative Policy</h2>
                               <div class="text-center blue">
                                 <button
                                     class="mt-4 btn btn-primary btn-playground"><a
-                                    target=”_blank”
-                                    href="https://play.openpolicyagent.org/p/DqXNKeLm20">Open In Playground
+                                    target="_blank"
+                                    href="https://play.openpolicyagent.org/p/WXAYEQWHKI">Open In Playground
                                     <img src="/live-blocks/icons/playground-open.svg"
                                       class="launch-playground-icon"></a>
                                 </button>
@@ -539,24 +538,28 @@ <h2>Declarative Policy</h2>
                                 </pre>
                               </div>
                               <div class="highlight">
-                                <a onclick='window.open("https://play.openpolicyagent.org/p/FiFAMwNoqm")'>
+                                <a onclick='window.open("https://play.openpolicyagent.org/p/6t8n43lY8W")'>
                                       <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                                         <code class="language-live"
                                               data-lang="live:envoy_get_pets_owners_desktop:module:read_only">package envoy.authz
+
+import future.keywords
 import input.attributes.request.http as http_request
 
 # allow only the frontend service to GET /pets/owners
-default allow = false
-allow {
-    http_request.path == "/pets/owners"
-    http_request.method == "GET"
-    source_spiffe_id == "spiffe://domain.test/frontend"
+default allow := false
+
+allow if {
+	http_request.path == "/pets/owners"
+	http_request.method == "GET"
+	source_spiffe_id == "spiffe://domain.test/frontend"
 }
 
-source_spiffe_id = client_id {
-    [_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")
-    [_, client_id] := split(uri_type_san, "=")
+source_spiffe_id := client_id if {
+	[_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")
+	[_, client_id] := split(uri_type_san, "=")
 }
+
                                     </code>
                                   </pre>
                                 </a>
@@ -572,8 +575,8 @@ <h2>Declarative Policy</h2>
                               <div class="text-center blue">
                                 <button
                                     class="mt-4 btn btn-primary btn-playground"><a
-                                    target=”_blank”
-                                    href="https://play.openpolicyagent.org/p/FiFAMwNoqm">Open In Playground
+                                    target="_blank"
+                                    href="https://play.openpolicyagent.org/p/6t8n43lY8W">Open In Playground
                                     <img src="/live-blocks/icons/playground-open.svg"
                                       class="launch-playground-icon"></a>
                                 </button>
@@ -629,19 +632,22 @@ <h2>Declarative Policy</h2>
                                   </pre>
                               </div>
                               <div class="highlight">
-                                <a onclick='window.open("https://play.openpolicyagent.org/p/qUkvgJRpIU")'>
+                                <a onclick='window.open("https://play.openpolicyagent.org/p/0FjgydMuVo")'>
                                   <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                                     <code class="language-live"
                                           data-lang="live:app_check_owner_desktop:module:read_only">package application.authz
 
+import future.keywords
+
 # Only owner can update the pet's information
 # Ownership information is provided as part of OPA's input
-default allow = false
-allow {
-    input.method == "PUT"
-    some petid
-    input.path = ["pets", petid]
-    input.user == input.owner
+default allow := false
+
+allow if {
+	input.method == "PUT"
+	some petid
+	input.path = ["pets", petid]
+	input.user == input.owner
 }
                                     </code>
                                   </pre>
@@ -658,8 +664,8 @@ <h2>Declarative Policy</h2>
                               <div class="text-center blue">
                                 <button
                                     class="mt-4 btn btn-primary btn-playground"><a
-                                    target=”_blank”
-                                    href="https://play.openpolicyagent.org/p/qUkvgJRpIU">Open In Playground
+                                    target="_blank"
+                                    href="https://play.openpolicyagent.org/p/0FjgydMuVo">Open In Playground
                                     <img src="/live-blocks/icons/playground-open.svg"
                                       class="launch-playground-icon"></a>
                                 </button>
@@ -691,25 +697,24 @@ <h2>Declarative Policy</h2>
                                 </pre>
                               </div>
                               <div class="highlight">
-                                <a onclick='window.open("https://play.openpolicyagent.org/p/c6412EHjS7")'>
+                                <a onclick='window.open("https://play.openpolicyagent.org/p/P8RBsigBsU")'>
                                   <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                                     <code class="language-live"
-                                          data-lang="live:app_jwt_auth_desktop:module:read_only">
-package application.authz
-
-# Everyone can see adopted pets
-allowed_pets[pet] {
-    some i
-    pet := input.pet_list[i]
-    pet.up_for_adoption == true
+                                          data-lang="live:app_jwt_auth_desktop:module:read_only">package application.authz
+
+import future.keywords
+
+# Everyone can see pets up for adoption
+allowed_pets contains pet if {
+	some pet in input.pet_list
+	pet.up_for_adoption
 }
 
 # Employees can see all pets.
-allowed_pets[pet] {
-    [header, payload, signature] := io.jwt.decode(input.token)
-    payload.employee == true
-    some i
-    pet := input.pet_list[i]
+allowed_pets contains pet if {
+	[_, payload, _] := io.jwt.decode(input.token)
+	payload.employee
+	some pet in input.pet_list
 }
                                     </code>
                                   </pre>
@@ -726,8 +731,8 @@ <h2>Declarative Policy</h2>
                               <div class="text-center blue">
                                 <button
                                     class="mt-4 btn btn-primary btn-playground"><a
-                                    target=”_blank”
-                                    href="https://play.openpolicyagent.org/p/c6412EHjS7">Open In Playground
+                                    target="_blank"
+                                    href="https://play.openpolicyagent.org/p/P8RBsigBsU">Open In Playground
                                     <img src="/live-blocks/icons/playground-open.svg"
                                       class="launch-playground-icon"></a>
                                 </button>
@@ -872,17 +877,19 @@ <h2>Declarative Policy</h2>
                             </pre>
                         </div>
                         <div class="highlight">
-                          <a onclick='window.open("https://play.openpolicyagent.org/p/ikesWCFIH8")'>
+                          <a onclick='window.open("https://play.openpolicyagent.org/p/9OTwNMYSog")'>
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
                                     data-lang="live:kubernetes_registry_check_mobile:module:read_only">package kubernetes.admission
 
-deny[msg] {
-    input.request.kind.kind == "Pod"
-    some i
-    image := input.request.object.spec.containers[i].image
-    not startswith(image, "hooli.com/")
-    msg := sprintf("image '%v' comes from untrusted registry", [image])
+import future.keywords
+
+deny contains msg if {
+	input.request.kind.kind == "Pod"
+  some container in input.request.object.spec.containers
+  image := container.image
+	not startswith(image, "hooli.com/")
+	msg := sprintf("image '%v' comes from untrusted registry", [image])
 }
                               </code>
                             </pre>
@@ -898,8 +905,8 @@ <h2>Declarative Policy</h2>
                         <div class="text-center blue">
                           <button
                               class="mt-4 btn btn-primary btn-playground"><a
-                              target=”_blank”
-                              href="https://play.openpolicyagent.org/p/ikesWCFIH8">Open In Playground
+                              target="_blank"
+                              href="https://play.openpolicyagent.org/p/9OTwNMYSog">Open In Playground
                               <img src="/live-blocks/icons/playground-open.svg"
                                 class="launch-playground-icon"></a>
                           </button>
@@ -951,23 +958,29 @@ <h2>Declarative Policy</h2>
                             </pre>
                         </div>
                         <div class="highlight">
-                          <a onclick='window.open("https://play.openpolicyagent.org/p/oL4Ofd1nQi")'>
+                          <a onclick='window.open("https://play.openpolicyagent.org/p/lttuKeuUpW")'>
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
                                     data-lang="live:kubernetes_ingress_check_mobile:module:read_only">package kubernetes.admission
 
+import future.keywords
+
 # Reject any ingress with the same host as an existing ingress
-deny[msg] {
-    input.request.kind.kind == "Ingress"
-    # iterate over all hosts in input Ingress
-    some i
-    newhost := input.request.object.spec.rules[i].host
-    # iterate over all existing ingresses and all hosts for each ingress
-    some namespace, name, j
-    oldhost := data.kubernetes.ingresses[namespace][name].spec.rules[j].host
-    # reject if the oldhost and the newhost are the same
-    newhost == oldhost
-    msg := sprintf("ingress host conflicts with ingress %v/%v", [namespace, name])
+deny contains msg if {
+	input.request.kind.kind == "Ingress"
+
+	# iterate over all hosts in input Ingress
+	some rule in input.request.object.spec.rules
+	newhost := rule.host
+
+	# iterate over all existing ingresses and all hosts for each ingress
+	some namespace, name
+	some oldrule in data.kubernetes.ingresses[namespace][name].spec.rules
+	oldhost := oldrule.host
+
+	# reject if the oldhost and the newhost are the same
+	newhost == oldhost
+	msg := sprintf("ingress host conflicts with ingress %s/%s", [namespace, name])
 }
                               </code>
                             </pre>
@@ -984,8 +997,8 @@ <h2>Declarative Policy</h2>
                         <div class="text-center blue">
                           <button
                               class="mt-4 btn btn-primary btn-playground"><a
-                              target=”_blank”
-                              href="https://play.openpolicyagent.org/p/oL4Ofd1nQi">Open In Playground
+                              target="_blank"
+                              href="https://play.openpolicyagent.org/p/lttuKeuUpW">Open In Playground
                               <img src="/live-blocks/icons/playground-open.svg"
                                 class="launch-playground-icon"></a>
                           </button>
@@ -1088,16 +1101,19 @@ <h2>Declarative Policy</h2>
                             </pre>
                         </div>
                         <div class="highlight">
-                          <a onclick='window.open("https://play.openpolicyagent.org/p/DqXNKeLm20")'>
+                          <a onclick='window.open("https://play.openpolicyagent.org/p/WXAYEQWHKI")'>
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
                                     data-lang="live:envoy_get_pets_mobile:module:read_only">package envoy.authz
 
+import future.keywords
+
 # allow all GET requests to /pets
-default allow = false
-allow {
-    input.attributes.request.http.method == "GET"
-    input.attributes.request.http.path == "/pets"
+default allow := false
+
+allow if {
+	input.attributes.request.http.method == "GET"
+	input.attributes.request.http.path == "/pets"
 }
                               </code>
                             </pre>
@@ -1114,8 +1130,8 @@ <h2>Declarative Policy</h2>
                         <div class="text-center blue">
                           <button
                               class="mt-4 btn btn-primary btn-playground"><a
-                              target=”_blank”
-                              href="https://play.openpolicyagent.org/p/DqXNKeLm20">Open In Playground
+                              target="_blank"
+                              href="https://play.openpolicyagent.org/p/WXAYEQWHKI">Open In Playground
                               <img src="/live-blocks/icons/playground-open.svg"
                                 class="launch-playground-icon"></a>
                           </button>
@@ -1182,23 +1198,26 @@ <h2>Declarative Policy</h2>
                             </pre>
                         </div>
                         <div class="highlight">
-                          <a onclick='window.open("https://play.openpolicyagent.org/p/FiFAMwNoqm")'>
+                          <a onclick='window.open("https://play.openpolicyagent.org/p/6t8n43lY8W")'>
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
                                     data-lang="live:envoy_get_pets_owners_mobile:module:read_only">package envoy.authz
+
+import future.keywords
 import input.attributes.request.http as http_request
 
 # allow only the frontend service to GET /pets/owners
-default allow = false
-allow {
-    http_request.path == "/pets/owners"
-    http_request.method == "GET"
-    source_spiffe_id == "spiffe://domain.test/frontend"
+default allow := false
+
+allow if {
+	http_request.path == "/pets/owners"
+	http_request.method == "GET"
+	source_spiffe_id == "spiffe://domain.test/frontend"
 }
 
-source_spiffe_id = client_id {
-    [_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")
-    [_, client_id] := split(uri_type_san, "=")
+source_spiffe_id = client_id if {
+	[_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")
+	[_, client_id] := split(uri_type_san, "=")
 }
                               </code>
                             </pre>
@@ -1215,8 +1234,8 @@ <h2>Declarative Policy</h2>
                         <div class="text-center blue">
                           <button
                               class="mt-4 btn btn-primary btn-playground"><a
-                              target=”_blank”
-                              href="https://play.openpolicyagent.org/p/FiFAMwNoqm">Open In Playground
+                              target="_blank"
+                              href="https://play.openpolicyagent.org/p/6t8n43lY8W">Open In Playground
                               <img src="/live-blocks/icons/playground-open.svg"
                                 class="launch-playground-icon"></a>
                           </button>
@@ -1277,20 +1296,24 @@ <h2>Declarative Policy</h2>
                             </pre>
                         </div>
                         <div class="highlight">
-                          <a onclick='window.open("https://play.openpolicyagent.org/p/qUkvgJRpIU")'>
+                          <a onclick='window.open("https://play.openpolicyagent.org/p/0FjgydMuVo")'>
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
                                     data-lang="live:app_check_owner_mobile:module:read_only">package application.authz
 
+import future.keywords
+
 # Only owner can update the pet's information
 # Ownership information is provided as part of OPA's input
-default allow = false
-allow {
-    input.method == "PUT"
-    some petid
-    input.path = ["pets", petid]
-    input.user == input.owner
+default allow := false
+
+allow if {
+	input.method == "PUT"
+	some petid
+	input.path = ["pets", petid]
+	input.user == input.owner
 }
+
                               </code>
                             </pre>
                           </a>
@@ -1306,8 +1329,8 @@ <h2>Declarative Policy</h2>
                         <div class="text-center blue">
                           <button
                               class="mt-4 btn btn-primary btn-playground"><a
-                              target=”_blank”
-                              href="https://play.openpolicyagent.org/p/qUkvgJRpIU">Open In Playground
+                              target="_blank"
+                              href="https://play.openpolicyagent.org/p/0FjgydMuVo">Open In Playground
                               <img src="/live-blocks/icons/playground-open.svg"
                                 class="launch-playground-icon"></a>
                           </button>
@@ -1317,7 +1340,7 @@ <h2>Declarative Policy</h2>
                            role="tabpanel"
                            aria-labelledby="v-pills-app-2-mobile-tab">
                         <div class="col-12 highlight">
-                          <a onclick='window.open("https://play.openpolicyagent.org/p/c6412EHjS7")'>
+                          <a onclick='window.open("https://play.openpolicyagent.org/p/P8RBsigBsU")'>
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
                                     data-lang="live:app_jwt_auth_mobile:input:hidden">
@@ -1343,22 +1366,21 @@ <h2>Declarative Policy</h2>
                         <div class="highlight">
                             <pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
                               <code class="language-live"
-                                    data-lang="live:app_jwt_auth_mobile:module:read_only">
-package application.authz
-
-# Everyone can see adopted pets
-allowed_pets[pet] {
-    some i
-    pet := input.pet_list[i]
-    pet.up_for_adoption == true
+                                    data-lang="live:app_jwt_auth_mobile:module:read_only">package application.authz
+
+import future.keywords
+
+# Everyone can see pets up for adoption
+allowed_pets contains pet if {
+  some pet in input.pet_list
+	pet.up_for_adoption
 }
 
 # Employees can see all pets.
-allowed_pets[pet] {
-    [header, payload, signature] := io.jwt.decode(input.token)
-    payload.employee == true
-    some i
-    pet := input.pet_list[i]
+allowed_pets contains pet if {
+	[_, payload, _] := io.jwt.decode(input.token)
+	payload.employee
+  some pet in input.pet_list
 }
                               </code>
                             </pre>
@@ -1374,8 +1396,8 @@ <h2>Declarative Policy</h2>
                         <div class="text-center blue">
                           <button
                               class="mt-4 btn btn-primary btn-playground"><a
-                              target=”_blank”
-                              href="https://play.openpolicyagent.org/p/c6412EHjS7">Open In Playground
+                              target="_blank"
+                              href="https://play.openpolicyagent.org/p/P8RBsigBsU">Open In Playground
                               <img src="/live-blocks/icons/playground-open.svg"
                                 class="launch-playground-icon"></a>
                           </button>
@@ -1426,14 +1448,14 @@ <h2>Declarative Policy</h2>
         <div class="col-12 mt-2">
           <div class="mt-4" style="font-weight:600"><label>Learn More</label></div>
           <div class="mt-2">
-            <a href="./docs/latest/kubernetes-introduction/" class="btn more-link btn-primary"
+            <a href="./docs/{{ $latest }}/kubernetes-introduction/" class="btn more-link btn-primary"
               target="_blank">Kubernetes</a>
-            <a href="./docs/latest/envoy-introduction/" class="btn btn-primary more-link" target="_blank">Envoy</a>
-            <a href="./docs/latest/terraform/" class="btn more-link btn-primary" target="_blank">Terraform</a>
-            <a href="./docs/latest/kafka-authorization/" class="btn more-link btn-primary" target="_blank">Kafka</a>
+            <a href="./docs/{{ $latest }}/envoy-introduction/" class="btn btn-primary more-link" target="_blank">Envoy</a>
+            <a href="./docs/{{ $latest }}/terraform/" class="btn more-link btn-primary" target="_blank">Terraform</a>
+            <a href="./docs/{{ $latest }}/kafka-authorization/" class="btn more-link btn-primary" target="_blank">Kafka</a>
             <a href="https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4"
               class="btn more-link btn-primary" target="_blank">SQL</a>
-            <a href="./docs/latest/ssh-and-sudo-authorization/" class="btn more-link btn-primary" target="_blank">Linux</a>
+            <a href="./docs/{{ $latest }}/ssh-and-sudo-authorization/" class="btn more-link btn-primary" target="_blank">Linux</a>
           </div>
         </div>
       </div>
@@ -1505,9 +1527,6 @@ <h3>Library</h3>
                 <h3>Service</h3>
                 <div class="service-smallCircle">
                   <img src="./img/logo.png">
-                  <!-- <div class="service-innertext dark">
-                                <h3>Services</h3>
-                              </div> -->
                 </div>
               </div>
             </div>
@@ -1539,8 +1558,8 @@ <h3>Services</h3>
         <div class="col-12 mt-2">
           <div class="mt-4" style="font-weight:600"><label>Learn More</label></div>
           <div class="mt-2">
-            <a href="./docs/latest/deployments/" class="btn btn-primary more-link" target="_blank">Daemon</a>
-            <a href="./docs/latest/integration/#integrating-with-the-go-api" class="btn btn-primary more-link" target="_blank">Library</a>
+            <a href="./docs/{{ $latest }}/deployments/" class="btn btn-primary more-link" target="_blank">Daemon</a>
+            <a href="./docs/{{ $latest }}/integration/#integrating-with-the-go-api" class="btn btn-primary more-link" target="_blank">Library</a>
           </div>
         </div>
       </div>
@@ -1548,7 +1567,6 @@ <h3>Services</h3>
   </section>
 
   <section id="curveImage">
-    <!-- <div class="curveImage-container"></div> -->
     <img src="./img/curve-up.png">
   </section>
 
@@ -1594,9 +1612,10 @@ <h4>CLI and REPL for complete control</h4>
         <div class="col-12 mt-2">
           <div class="mt-4" style="font-weight:600"><label>Learn More</label></div>
           <div class="mt-2">
-            <a href="https://marketplace.visualstudio.com/items?itemName=tsandall.opa" class="btn btn-primary more-link" target="_blank">VScode</a>
-              <a href="https://play.openpolicyagent.org/" class="btn btn-primary more-link" target="_blank">Rego Playground</a>
-              <a href="./docs/latest/#running-opa" class="btn btn-primary more-link" target="_blank">General Tooling</a>
+            <a href="https://marketplace.visualstudio.com/items?itemName=tsandall.opa" class="btn btn-primary more-link" target="_blank">VS Code</a>
+            <a href="https://play.openpolicyagent.org/" class="btn btn-primary more-link" target="_blank">Rego Playground</a>
+            <a href="./docs/{{ $latest }}/#running-opa" class="btn btn-primary more-link" target="_blank">General Tooling</a>
+            <a href="https://github.com/open-policy-agent" class="btn btn-primary more-link" target="_blank">OPA GitHub</a>
           </div>
         </div>
       </div>
@@ -1617,7 +1636,7 @@ <h4>CLI and REPL for complete control</h4>
           <div class="footer-bottom">
             © {{ now.Format "2006"}} Open Policy Agent contributors. Licensed under the Apache
             License, Version 2.0. For information about
-            contributing, <a href="/docs/latest/contributing/">see documentation</a>.
+            contributing, <a href="/docs/{{ $latest }}/contributing/">see documentation</a>.
           </div>
         </div>
       </div>
@@ -1627,14 +1646,20 @@ <h4>CLI and REPL for complete control</h4>
   <!-- jQuery first, then Popper.js, then Bootstrap JS -->
   <script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"
           integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"
-          crossorigin="anonymous"></script>
+          crossorigin="anonymous"
+          referrerpolicy="no-referrer"></script>
   <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js"
           integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1"
-          crossorigin="anonymous"></script>
+          crossorigin="anonymous"
+          referrerpolicy="no-referrer"></script>
   <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js"
           integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM"
-          crossorigin="anonymous"></script>
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/smooth-scroll/16.0.3/smooth-scroll.min.js"></script>
+          crossorigin="anonymous"
+          referrerpolicy="no-referrer"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/smooth-scroll/16.0.3/smooth-scroll.min.js"
+          integrity="sha512-hM2bR27jBQ+BEMPGN5s+d1vgOk9igjvb4cH0LWXA6zqFYEPYJoLGA/3s9YoRCOaQQ+8FyunCOpoptJqhwIY83g=="
+          crossorigin="anonymous"
+          referrerpolicy="no-referrer"></script>
   <script>
       $(function () {
           var offset = 50;
@@ -1658,4 +1683,4 @@ <h4>CLI and REPL for complete control</h4>
   </body>
 
   </html>
-{{ end }}
\ No newline at end of file
+{{ end }}
diff --git a/docs/website/layouts/index.redirects b/docs/website/layouts/index.redirects
index 7f557e1252..ad8cefc986 100644
--- a/docs/website/layouts/index.redirects
+++ b/docs/website/layouts/index.redirects
@@ -1,9 +1,13 @@
 {{- $latest       := index site.Data.releases 1 -}}
-{{- $allDocs      := where site.RegularPages "Section" "docs" }}
+{{- $releases     := site.Data.releases -}}
 {{- $docRedirects := site.Data.redirects }}
 
 # Redirect to latest doc version by default
-/docs     /docs/latest      301!
+{{- if eq (len site.Data.releases) 1 }}
+/docs     /docs/edge      301!
+{{- else }}
+/docs     /docs/latest    301!
+{{- end }}
 
 # v0.14.0 re-org redirects
 # TODO: Remove at some point in the future when its more ok to break old links en-mass
@@ -20,19 +24,33 @@
 /docs/latest/management/                            /docs/latest/management-introduction/   301!
 /docs/latest/kubernetes-admission-control/          /docs/latest/kubernetes-tutorial/       301!
 
-/docs/latest/external-data/#option-5-pull-data-during-evaluation-experimental        /docs/latest/external-data/#option-5-pull-data-during-evaluation    301!
-
 # v0.21.0 re-org
 /docs/latest/policy-cheatsheet/                     /docs/latest/policy-reference/          301!
 
-{{- range $docRedirects }}
-/docs/{{ . }}     /docs/latest/{{ . }}      301!
+# v0.35.0 extended contrib sections
+/docs/latest/development/                           /docs/latest/contrib-code/          301!
 
-# Legacy git book redirects
-/docs/{{ . }}.html /docs/latest/{{ . }}     301!
+{{- range $docRedirects }}
+/docs/{{ . }}      /docs/latest/{{ . }} 301!
+/docs/{{ . }}.html /docs/latest/{{ . }} 301! # Legacy git book redirects
 {{- end }}
 
 # Download URLs
 /downloads/edge/*       https://opa-releases.s3.amazonaws.com/edge/:splat 200
 /downloads/latest/*     https://github.com/open-policy-agent/opa/releases/download/{{ $latest }}/:splat 200
 /downloads/*            https://github.com/open-policy-agent/opa/releases/download/:splat 200
+
+# previous patch versions
+{{- range $releases }}
+  {{- if (not (or (eq . "latest") (eq . "edge"))) }}
+    {{- $major := index (split . ".") 0 }}
+    {{- $minor := index (split . ".") 1 }}
+    {{- $patch := int (index (split . ".") 2) }}
+    {{- range after 1 (seq $patch -1 0) }}
+/docs/{{ $major }}.{{ $minor }}.{{ . }}/* /docs/{{ $major }}.{{ $minor }}.{{ $patch }}/:splat
+    {{- end }}
+  {{- end }}
+{{- end }}
+
+/badge/:tag style=:style https://img.shields.io/endpoint?url=https://openpolicyagent.org/badge-endpoint/:tag&style=:style
+/badge/:tag https://img.shields.io/endpoint?url=https://openpolicyagent.org/badge-endpoint/:tag
\ No newline at end of file
diff --git a/docs/website/layouts/partials/css.html b/docs/website/layouts/partials/css.html
index a4cd8748d4..acd68af751 100644
--- a/docs/website/layouts/partials/css.html
+++ b/docs/website/layouts/partials/css.html
@@ -18,7 +18,7 @@
 {{ end }}
 
 {{ if $isDoc }}
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/docsearch.js@2/dist/cdn/docsearch.min.css" />
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@docsearch/css@3" />
 {{ end }}
 
 {{ if (eq .Kind "404") }}
diff --git a/docs/website/layouts/partials/docs/article.html b/docs/website/layouts/partials/docs/article.html
index 3fb7e438af..cb51a48394 100644
--- a/docs/website/layouts/partials/docs/article.html
+++ b/docs/website/layouts/partials/docs/article.html
@@ -1,14 +1,4 @@
-{{ $releases   := site.Data.releases }}
-{{ $latest     := printf "%s" (index $releases 1) }}
-{{ $version    := index (split .File.Path "/") 1 }}
 <article class="article">
-  {{ with (eq $version "edge") }}
-  <div class="message is-danger">
-    <div class="message-body">
-      This version is still under development! Latest stable release is <a href="/docs/latest">{{ $latest }}</a>
-    </div>
-  </div>
-  {{ end }}
   <div class="container">
     {{ partial "docs/hero.html" . }}
 
@@ -16,7 +6,7 @@
       <div class="content">
         {{ .Content }}
       </div>
-      {{ if (and (not .Params.hide_feedback) (site.Params.ui.feedback.enable) (site.GoogleAnalytics)) }}
+      {{ if (and (not .Params.hide_feedback) (site.Params.ui.feedback.enable)) }}
         {{ partial "feedback.html" site.Params.ui.feedback }}
       {{ end }}
       <div class="toc-padding"></div>
diff --git a/docs/website/layouts/partials/docs/dashboard-panel.html b/docs/website/layouts/partials/docs/dashboard-panel.html
index a65898143a..352519565e 100644
--- a/docs/website/layouts/partials/docs/dashboard-panel.html
+++ b/docs/website/layouts/partials/docs/dashboard-panel.html
@@ -5,7 +5,15 @@
 {{ $version    := index (split .File.Path "/") 1 }}
 {{ $page       := trim .RelPermalink "/" }}
 {{ $isLatest   := or (eq $version $latest) (eq $version "latest") }}
-<div class="dashboard-panel left has-background-white-bis is-hidden-mobile">
+
+{{ $rank := 1 }}
+{{- range $index, $ver := $releases -}}
+  {{- if eq $ver $version -}}
+    {{ $rank = $index }}
+  {{- end -}}
+{{- end -}}
+{{ $ancient := gt $rank 5 }}
+<div class="dashboard-panel left has-background-white-bis is-hidden-touch">
   <div class="dashboard-panel-header has-text-centered">
     <div class="dashboard-panel-header-logo">
       <a href="{{ $home }}">
@@ -27,16 +35,16 @@
           </span>
             {{ if $isLatest }}
               <span class="tag latest-tag is-success is-small has-text-weight-bold">
-            latest
-          </span>
+                latest
+              </span>
             {{ else if (eq $version "edge") }}
               <span class="tag latest-tag is-danger is-small has-text-weight-bold">
-            pre-release
-          </span>
+                pre-release
+              </span>
             {{ else }}
-              <span class="tag latest-tag is-warning is-small has-text-weight-bold">
-            older
-          </span>
+              <span class="tag latest-tag {{ cond $ancient "is-danger" "is-warning"}} is-small has-text-weight-bold">
+                older
+              </span>
             {{ end }}
           <span class="icon is-small">
             <i class="fas fa-angle-down" aria-hidden="true"></i>
diff --git a/docs/website/layouts/partials/docs/dashboard.html b/docs/website/layouts/partials/docs/dashboard.html
index e3e9a87549..81a6b08f30 100644
--- a/docs/website/layouts/partials/docs/dashboard.html
+++ b/docs/website/layouts/partials/docs/dashboard.html
@@ -1,8 +1,53 @@
-<div class="dashboard">
-  {{ partial "docs/dashboard-panel.html" . }}
+{{- $latest := "latest" -}}
+{{- if eq (len site.Data.releases) 1 -}}
+{{- $latest = "edge" -}}
+{{- end -}}
 
-  <div class="dashboard-main is-scrollable">
-    {{ partial "docs/navbar.html" . }}
-    {{ partial "docs/article.html" . }}
+{{ $releases            := site.Data.releases }}
+
+{{ $version             := index (split .File.Path "/") 1 }}
+
+{{ $latestVersionString := printf "%s" (index $releases 1) }}
+{{- if eq (len $releases) 1 -}}
+{{- $latestVersionString = "(dev preview)" -}}
+{{- end -}}
+
+{{ $rank := 1 }}
+{{- range $index, $ver := site.Data.releases -}}
+{{- if eq $ver $version -}}
+{{ $rank = $index }}
+{{- end -}}
+{{- end -}}
+{{ $ancient := gt $rank 5 }}
+
+{{ $isEdge := (eq $version "edge") }}
+{{ $isNotLatest := (and (ne $version $latest) (ne $version $latestVersionString)) }}
+
+<div class="dashboard-wrapper {{ if (or $isEdge $isNotLatest) }}showing-banner-version-warning{{ end }}">
+  {{- if $isEdge }}
+  <div class="message is-info banner-version-warning">
+    <div class="message-body">
+      This version is still under development! Latest stable release is <a href="/docs/latest">{{ $latestVersionString }}</a>
+      <button class="delete" aria-label="delete"></button>
+    </div>
+  </div>
+  {{- else if $isNotLatest }}
+  <div class="message {{ cond $ancient "is-danger" "is-warning"}} banner-version-warning">
+    <div class="message-body">
+      These are the docs for an older version of OPA ({{ $version }}). Latest stable release is <a href="/docs/latest">{{ $latestVersionString }}</a>
+      {{ if not $ancient }}
+      <button class="delete" aria-label="delete"></button>
+      {{ end }}
+    </div>
+  </div>
+  {{- end }}
+
+  <div class="dashboard">
+    {{ partial "docs/dashboard-panel.html" . }}
+
+    <div class="dashboard-main is-scrollable">
+      {{ partial "docs/navbar.html" . }}
+      {{ partial "docs/article.html" . }}
+    </div>
   </div>
 </div>
diff --git a/docs/website/layouts/partials/docs/hero.html b/docs/website/layouts/partials/docs/hero.html
index dcc82ac021..a5e44a1c20 100644
--- a/docs/website/layouts/partials/docs/hero.html
+++ b/docs/website/layouts/partials/docs/hero.html
@@ -1,7 +1,11 @@
 <section class="hero">
   <div class="hero-body">
-    <p class="title is-size-1 is-size-2-mobile">
-      {{ .Title }}
-    </p>
+    <span class="title is-size-1 is-size-2-mobile">
+      {{ .Title }} 
+    </span>
+    <span class="icon has-text-white-bis is-size-4 is-size-5-mobile icon-edit">
+        <a href='{{ .Site.Params.GithubEdit }}{{ .File.LogicalName }}' target="_blank"><i class="fab fa-github"></i><span>Edit</span></a>
+    </span>    
+    <hr>
   </div>
 </section>
\ No newline at end of file
diff --git a/docs/website/layouts/partials/docs/integration-logo.html b/docs/website/layouts/partials/docs/integration-logo.html
index d6a9d5b6f3..a125d1cdfa 100644
--- a/docs/website/layouts/partials/docs/integration-logo.html
+++ b/docs/website/layouts/partials/docs/integration-logo.html
@@ -1,6 +1,9 @@
-{{- $logoFile := (printf "%s.png" .name) -}}
-{{- if fileExists (printf "/static/img/logos/integrations/%s" $logoFile) -}}
-<img class="integration-logo is-vcentered" src="{{ (printf "/img/logos/integrations/%s" $logoFile) }}" alt="Integration Logo">
+{{- $logoFilePng := (printf "%s.png" .name) -}}
+{{- $logoFileSvg := (printf "%s.svg" .name) -}}
+{{- if fileExists (printf "/static/img/logos/integrations/%s" $logoFilePng) -}}
+<img class="integration-logo is-vcentered" src="{{ (printf "/img/logos/integrations/%s" $logoFilePng) }}" alt="Integration Logo">
+{{- else if fileExists (printf "/static/img/logos/integrations/%s" $logoFileSvg) -}}
+<img class="integration-logo is-vcentered" src="{{ (printf "/img/logos/integrations/%s" $logoFileSvg) }}" alt="Integration Logo">
 {{- else -}}
 <img class="integration-logo is-vcentered" src="/img/logos/opa-no-text-color.png" alt="Integration Logo">
 {{- end -}}
\ No newline at end of file
diff --git a/docs/website/layouts/partials/docs/navbar-link.html b/docs/website/layouts/partials/docs/navbar-link.html
index a6b719d4bd..eb7c7b1b75 100644
--- a/docs/website/layouts/partials/docs/navbar-link.html
+++ b/docs/website/layouts/partials/docs/navbar-link.html
@@ -7,7 +7,7 @@
 {{- $title := cond (isset .ctx.Params "navtitle") (.ctx.Params.navtitle) .ctx.Title -}}
 {{- if not $isRoot -}}
 {{- if eq .version $contentVersion -}}
-{{- $linkRef := .ctx.URL -}}
+{{- $linkRef := .ctx.Permalink -}}
 <a class="navbar-item" href="{{ $linkRef }}">
   {{ $title }}
 </a>
diff --git a/docs/website/layouts/partials/docs/navbar.html b/docs/website/layouts/partials/docs/navbar.html
index 6a9c97c46a..d82a2dfa84 100644
--- a/docs/website/layouts/partials/docs/navbar.html
+++ b/docs/website/layouts/partials/docs/navbar.html
@@ -17,9 +17,9 @@
 {{ $contrib     := where $allDocs ".Params.kind" "eq" "contrib" }}
 {{ $misc        := where $allDocs ".Params.kind" "eq" "misc" }}
 {{ $version     := index (split .File.Path "/") 1 }}
-{{ $pageUrl     := .URL }}
+{{ $pageUrl     := .Permalink }}
 <nav class="navbar is-primary">
-  <div class="navbar-brand is-hidden-tablet">
+  <div class="navbar-brand is-hidden-desktop">
     <a class="navbar-item" href="{{ $home }}">
       <img src="{{ $logo }}">
     </a>
@@ -31,13 +31,13 @@
     </a>
   </div>
 
-  <div class="navbar-menu is-hidden-tablet" id="mobile-menu">
+  <div class="navbar-menu is-hidden-desktop" id="mobile-menu">
     <div class="navbar-start">
       <span class="navbar-item is-size-5 has-text-weight-light is-uppercase">
         Core Docs
       </span>
 
-      <a class="navbar-item" href="{{ $docsHome.URL }}">
+      <a class="navbar-item" href="{{ $docsHome.Permalink }}">
         {{ $docsHome.Name }}
       </a>
 
@@ -67,6 +67,9 @@
       <a class="navbar-item" href="/support">
         Enterprise and Commercial
       </a>
+      <a class="navbar-item" href="/community">
+        Community
+      </a>
     </div>
 
     <div class="navbar-end">
@@ -110,13 +113,20 @@
     <div class="navbar-end">
       <div class="navbar-item">
         <p class="control has-icons-right">
-          <input class="input" type="search" id="search-bar" placeholder="Search...">
+          <div id="docsearch">
+          </div>
           <span class="icon is-small is-right">
             <icon />
           </span>
         </p>
       </div>
 
+      <div class="navbar-item">
+        <a class="button is-success has-text-weight-semibold" href="https://play.openpolicyagent.org/" target="_blank" title="Playground">
+          Playground
+        </a>
+      </div>
+
       <a class="navbar-item" href="{{ $github }}" target="_blank" title="GitHub">
         <span class="icon has-text-white-bis">
           <i class="fab fa-github"></i>
diff --git a/docs/website/layouts/partials/docs/sidenav-link.html b/docs/website/layouts/partials/docs/sidenav-link.html
index a135e5294a..1952d1b80f 100644
--- a/docs/website/layouts/partials/docs/sidenav-link.html
+++ b/docs/website/layouts/partials/docs/sidenav-link.html
@@ -4,11 +4,11 @@
 {{/* In the current "ctx" the file path refers to the doc we are linking to, not the page we are on */}}
 {{- $contentVersion := index (split .ctx.File.Path "/") 1 -}}
 {{- $isRoot := eq (len (split .ctx.File.Path "/")) 2 -}}
-{{- $isThisPage := eq .ctx.URL .pageUrl -}}
+{{- $isThisPage := eq .ctx.Permalink .pageUrl -}}
 {{- $title := cond (isset .ctx.Params "navtitle") (.ctx.Params.navtitle) .ctx.Title -}}
 {{- if not $isRoot -}}
 {{- if eq .version $contentVersion -}}
-{{- $linkRef := .ctx.URL -}}
+{{- $linkRef := .ctx.Permalink -}}
 <a class="docs-nav-item{{ if $isThisPage }} is-active{{ end }}" href="{{ $linkRef }}">
   {{ $title }}
 </a>
diff --git a/docs/website/layouts/partials/docs/sidenav.html b/docs/website/layouts/partials/docs/sidenav.html
index b995f8741e..7fc09539d5 100644
--- a/docs/website/layouts/partials/docs/sidenav.html
+++ b/docs/website/layouts/partials/docs/sidenav.html
@@ -8,8 +8,9 @@
 {{ $management := where $allDocs ".Params.kind" "eq" "management" }}
 {{ $contrib    := where $allDocs ".Params.kind" "eq" "contrib" }}
 {{ $misc       := where $allDocs ".Params.kind" "eq" "misc" }}
-{{ $pageUrl    := .URL }}
-{{ $isDocsHome := eq .URL $docsHome.URL }}
+{{ $support    := where $allDocs ".Params.kind" "eq" "support" }}
+{{ $pageUrl    := .Permalink }}
+{{ $isDocsHome := eq .Permalink $docsHome.Permalink }}
 {{ $version    := index (split .File.Path "/") 1 }}
 {{ $latest     := index site.Data.releases 1 }}
 
@@ -49,16 +50,8 @@
 
 {{ partial "docs/sidenav-section.html" ( dict "ctx" . "sectionTitle" "Miscellaneous" "section" $misc "pageUrl" $pageUrl "version" $version ) }}
 
-<a class="docs-nav-item" href="https://play.openpolicyagent.org/">
-  Rego Playground
-</a>
-
-<hr class="docs-nav-hr" />
-
-<span class="docs-nav-title">
-  Support
-</span>
+{{ partial "docs/sidenav-section.html" ( dict "ctx" . "sectionTitle" "Support" "section" $support "pageUrl" $pageUrl "version" $version ) }}
 
 <a class="docs-nav-item" href="/support">
-  Enterprise and Commercial
+  Enterprise
 </a>
diff --git a/docs/website/layouts/partials/google-analytics.html b/docs/website/layouts/partials/google-analytics.html
index 5b206e21d1..cbd9ecb7dc 100644
--- a/docs/website/layouts/partials/google-analytics.html
+++ b/docs/website/layouts/partials/google-analytics.html
@@ -1,4 +1,10 @@
-{{ $id := site.GoogleAnalytics }}
+{{ with site.GoogleAnalytics -}}
+<script async src="https://www.googletagmanager.com/gtag/js?id={{ . }}"></script>
 <script>
-(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)})(window,document,'script','https://www.google-analytics.com/analytics.js','ga');ga('create', '{{ $id }}', 'auto');ga('send', 'pageview');
-</script>
\ No newline at end of file
+  window.dataLayer = window.dataLayer || [];
+  function gtag(){dataLayer.push(arguments);}
+  gtag('js', new Date());
+
+  gtag('config', '{{ . }}');
+</script>
+{{ end -}}
diff --git a/docs/website/layouts/partials/javascript.html b/docs/website/layouts/partials/javascript.html
index 66829a5f16..efebce6c06 100644
--- a/docs/website/layouts/partials/javascript.html
+++ b/docs/website/layouts/partials/javascript.html
@@ -1,8 +1,15 @@
 {{ $isDocsPage := eq .Section "docs" }}
 {{ $app        := resources.Get "js/app.js" | resources.ExecuteAsTemplate "js/app.js" . | fingerprint }}
-<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/docsearch.js@2/dist/cdn/docsearch.min.js"></script>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/tocbot/4.7.0/tocbot.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3"
+        onerror="console.error('Error loading the docsearch.min.js script')"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"
+        integrity="sha512-+NqPlbbtM1QqiK8ZAo4Yrj2c4lNQoGv8P79DPtKzj++l5jnN39rHA/xsqn8zE9l0uSoxaCdrOgFs6yjyfbBxSg=="
+        crossorigin="anonymous"
+        referrerpolicy="no-referrer"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/tocbot/4.7.0/tocbot.min.js"
+        integrity="sha512-0yvqkr9Ldt1VsW3izBRlvZuz0Sd1Yu+ZRZSFg33ogi0FJi7FlzP3s1QOrA0Fd0XbAEXMdSrLQBlCFyHq4kNEEQ=="
+        crossorigin="anonymous"
+        referrerpolicy="no-referrer"></script>
 <script src="{{ $app.RelPermalink }}" integrity="{{ $app.Data.Integrity }}"></script>
 <script src="/js/anchor.min.js"></script>
 
@@ -11,13 +18,12 @@
 {{ $apiKey  := site.Params.algolia_api_key }}
 <script>
   console.log("You are reading the docs for version {{ $version }} of Open Policy Agent");
-
-  docsearch({
-    apiKey: '{{ $apiKey }}',
-    indexName: 'openpolicyagent',
-    inputSelector: '#search-bar',
-    algoliaOptions: { 'facetFilters': ["version:{{ $version }}"] },
-    debug: true
-  });
+    docsearch({
+      container: '#docsearch',
+      appId: 'P4N61UNFMP',
+      indexName: 'openpolicyagent',
+      apiKey: '{{ $apiKey }}',
+      searchParameters: { 'facetFilters': ["version:{{ $version }}"] }
+    });
 </script>
 {{ end }}
\ No newline at end of file
diff --git a/docs/website/layouts/partials/meta.html b/docs/website/layouts/partials/meta.html
index 16984c9379..3027bf32aa 100644
--- a/docs/website/layouts/partials/meta.html
+++ b/docs/website/layouts/partials/meta.html
@@ -6,6 +6,11 @@
 {{ $imageUrl    := "/img/logos/opa-horizontal-color.png" | absURL }}
 {{ $twitter     := site.Params.social.twitter }}
 {{ $version     := index (split .File.Path "/") 1 }}
+{{ $page       := trim .RelPermalink "/" }}
+{{ $releases   := site.Data.releases }}
+{{ $latest     := index $releases 1 }}
+{{ $isLatest   := or (eq $version $latest) (eq $version "latest") }}
+
 
 <!-- Basic metadata -->
 <meta charset="utf-8">
@@ -38,8 +43,11 @@
 <meta name="twitter:site" content="@{{ $twitter }}">
 <meta name="twitter:creator" content="@{{ $twitter }}">
 
-<!-- Links -->
-<link rel="canonical" content="{{ .Permalink }}">
+{{ $latestRelLink := strings.Replace $page $version "latest" }}
+{{ $latestLink := strings.Replace .Permalink $version "latest" }}
+{{- if (or $isLatest (eq $version "edge") (ne (site.GetPage $latestRelLink).Content "")) -}}
+<link rel="canonical" href="{{ $latestLink }}">
+{{- end -}}
 <link rel="shortcut icon" href="/favicon.png" type="image/x-icon"/>
 
 <!-- Algolia metadata -->
diff --git a/docs/website/layouts/shortcodes/builtin-table.html b/docs/website/layouts/shortcodes/builtin-table.html
new file mode 100644
index 0000000000..a07ee24f39
--- /dev/null
+++ b/docs/website/layouts/shortcodes/builtin-table.html
@@ -0,0 +1,100 @@
+
+{{- $cat := .Get 0 }}
+{{ if .IsNamedParams }}{{- $cat = .Get "cat" }}{{- end }}
+{{- $id := $cat }}
+{{- $title := $cat }}
+{{- if .Get "id" }}{{ $id = .Get "id" }}{{ end }}
+{{- if .Get "title" }}{{ $title = .Get "title" }}{{ end }}
+
+{{- $version := index (split $.Page.File.Path "/") 1 -}}
+{{- if (eq $version "latest") -}}
+{{- $version = index site.Data.releases 1 -}}
+{{- end -}}
+
+<h3 id={{ $id }}>{{ $title | title }}</h3>
+<table class="table bi-cat is-hoverable">
+    <tbody>
+    {{- range $name := index site.Data.builtin_metadata._categories $cat }}
+    {{- $anchor := anchorize (printf "builtin-%s-%s" $cat $name) }}
+    {{- $bi := index site.Data.builtin_metadata $name }}
+    {{- if in $bi.available $version }}
+    <tr id="{{ $anchor }}">
+        <th>
+            <a class="self-link" href="#{{ $anchor }}">
+            {{- if isset $bi "infix" }}
+                <code>
+                {{ index (index $bi.args 0) "name" }} {{ $bi.infix }} {{ index (index $bi.args 1) "name" }}
+                </code>
+            {{- else }}
+                <code>{{ $name }}</code>
+            {{- end }}
+            </a>
+        </th>
+        <td>
+            <p>
+            {{- if isset $bi "infix" }}
+                <code>
+                {{ $bi.result.name }} := {{ index (index $bi.args 0) "name" }} {{ $bi.infix }} {{ index (index $bi.args 1) "name" }}
+                </code>
+            {{- else if isset $bi "relation" }}
+                <code>
+                {{ $name }}(
+                    {{- range $index, $element := $bi.args -}}
+                    {{- if gt $index 0 -}}, {{ end -}}
+                    {{- $element.name -}}
+                    {{- end -}}
+                    , {{ $bi.result.name -}}
+                )
+                </code>
+            {{- else }}
+                <code>
+                {{ $bi.result.name }} := {{ $name }}(
+                {{- range $index, $element := $bi.args -}}
+                {{- if gt $index 0 -}}, {{ end -}}
+                {{- $element.name -}}
+                {{- end -}}
+                )
+                </code>
+            {{- end }}
+            </p>
+            <p>{{ $bi.description | markdownify }}</p>
+
+            <div class="bi-args">
+            {{- range $element := $bi.args }}
+                <div class="name"><code>{{ $element.name }}</code></div>
+                <div class="type">({{ $element.type }})</div>
+                <div class="desc">{{ $element.description | markdownify }}</div>
+            {{- end }}
+            </div>
+
+            <emph>Returns:</emph>
+            <div class="bi-args">
+                <div class="name"><code>{{ $bi.result.name }}</code></div>
+                <div class="type">({{ $bi.result.type }})</div>
+                <div class="desc">{{ $bi.result.description | markdownify }}</div>
+            </div>
+        </td>
+        <td>
+            <div class="tags">
+                {{- if eq $bi.introduced $version }}
+                    <span class="tag is-primary">New</span>
+                {{- end }}
+                {{- if and (ne $bi.introduced "v0.17.0") (ne $bi.introduced "edge") }}
+                <a href="https://github.com/open-policy-agent/opa/releases/{{ $bi.introduced }}" target="_blank">
+                    <span class="tag is-light">{{ $bi.introduced }}</span>
+                </a>
+                {{- else if eq $bi.introduced "edge" }}
+                <span class="tag is-danger">{{ $bi.introduced }}</span>
+                {{- end }}
+                {{- if index $bi "wasm" -}}
+                    <span class="tag is-success">Wasm</span>
+                {{- else -}}
+                    <span class="tag is-warning">SDK-dependent</span>
+                {{- end -}}
+            </div>
+        </td>
+    </tr>
+    {{- end }}
+    {{- end }}
+    </tbody>
+</table>
\ No newline at end of file
diff --git a/docs/website/layouts/shortcodes/builtin-tags.html b/docs/website/layouts/shortcodes/builtin-tags.html
new file mode 100644
index 0000000000..95ff727c58
--- /dev/null
+++ b/docs/website/layouts/shortcodes/builtin-tags.html
@@ -0,0 +1,25 @@
+{{- $name := .Get 0 -}}
+{{- $metadata := index site.Data.builtin_metadata $name }}
+
+{{- $version := index (split $.Page.File.Path "/") 1 -}}
+{{- if (eq $version "latest") -}}
+{{- $version = index site.Data.releases 1 -}}
+{{- end -}}
+
+<div class="tags">
+    {{- if eq $metadata.introduced $version }}
+        <span class="tag is-primary">New</span>
+    {{- end }}
+    {{- if and (ne $metadata.introduced "v0.17.0") (ne $metadata.introduced "edge") }}
+    <a href="https://github.com/open-policy-agent/opa/releases/{{ $metadata.introduced }}" target="_blank">
+        <span class="tag is-light">{{ $metadata.introduced }}</span>
+    </a>
+    {{- else if eq $metadata.introduced "edge" }}
+    <span class="tag is-danger">{{ $metadata.introduced }}</span>
+    {{- end }}
+    {{- if index $metadata "wasm" -}}
+        <span class="tag is-success">Wasm</span>
+    {{- else -}}
+        <span class="tag is-warning">SDK-dependent</span>
+    {{- end -}}
+</div>
\ No newline at end of file
diff --git a/docs/website/layouts/shortcodes/detail-tag.html b/docs/website/layouts/shortcodes/detail-tag.html
new file mode 100644
index 0000000000..62e1dcbf35
--- /dev/null
+++ b/docs/website/layouts/shortcodes/detail-tag.html
@@ -0,0 +1,4 @@
+<details>
+  <summary>{{ (.Get 0) | markdownify }}</summary>
+  {{ .Inner | markdownify }}
+</details>
diff --git a/docs/website/scripts/live-blocks/package-lock.json b/docs/website/scripts/live-blocks/package-lock.json
index 9e3f2f164c..e59b27d3a8 100644
--- a/docs/website/scripts/live-blocks/package-lock.json
+++ b/docs/website/scripts/live-blocks/package-lock.json
@@ -5,14 +5,15 @@
   "requires": true,
   "packages": {
     "": {
+      "name": "live-blocks",
       "version": "0.0.0",
       "license": "Apache-2.0",
       "dependencies": {
         "cheerio": "^1.0.0-rc.3",
         "codemirror": "^5.58.2",
-        "codemirror-rego": "^1.1.0",
+        "codemirror-rego": "^1.3.0",
         "esm": "^3.2.25",
-        "node-fetch": "^2.6.1",
+        "node-fetch": "^2.6.7",
         "tmp": "^0.2.1"
       },
       "devDependencies": {
@@ -32,9 +33,9 @@
         "chai-as-promised": "^7.1.1",
         "core-js": "^3.1.4",
         "dot-prop": ">=5.1.1",
-        "glob-parent": ">=5.1.2",
-        "minimist": ">=1.2.2",
-        "mocha": ">=9.1.2",
+        "glob-parent": ">=6.0.1",
+        "minimist": ">=1.2.6",
+        "mocha": "^9.2.2",
         "normalize-url": ">=4.5.1",
         "nth-check": ">=2.0.1",
         "postcss": "^8.2.10",
@@ -1655,6 +1656,64 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+      "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/set-array": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/source-map": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
+      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.4.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+      "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+      "dev": true
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.14.tgz",
+      "integrity": "sha512-bJWEfQ9lPTvm3SneWwRFVLzrh6nhjwqw7TUFFBEMzwvg7t7PCDenf2lDwqo4NQXzdpgBXyFgDWnQA+2vkruksQ==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -1909,6 +1968,15 @@
         "node": ">=6"
       }
     },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/ansi-styles": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
@@ -2011,15 +2079,6 @@
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
-    "node_modules/big.js": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/big.js/-/big.js-5.2.2.tgz",
-      "integrity": "sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==",
-      "dev": true,
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/binary-extensions": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
@@ -2116,9 +2175,9 @@
       }
     },
     "node_modules/camelcase": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.2.0.tgz",
-      "integrity": "sha512-c7wVvbw3f37nuobQNtgsgG9POC9qMbNuMQmTCqZv23b6MIz0fcYpBiOlv9gEN/hdLdnZTDQhg6e9Dq5M1vKvfg==",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
       "dev": true,
       "engines": {
         "node": ">=10"
@@ -2140,14 +2199,20 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001236",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001236.tgz",
-      "integrity": "sha512-o0PRQSrSCGJKCPZcgMzl5fUaj5xHe8qA2m4QRvnyY4e1lITqoNkr7q/Oh1NcpGSy0Th97UZ35yoKcINPoq7YOQ==",
+      "version": "1.0.30001320",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001320.tgz",
+      "integrity": "sha512-MWPzG54AGdo3nWx7zHZTefseM5Y1ccM7hlQKHRqJkPozUaw3hNbBTMmLn16GG2FUzjR13Cr3NPfhIieX5PzXDA==",
       "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/browserslist"
-      }
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        }
+      ]
     },
     "node_modules/chai": {
       "version": "4.3.4",
@@ -2237,10 +2302,16 @@
       }
     },
     "node_modules/chokidar": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.2.tgz",
-      "integrity": "sha512-ekGhOnNVPgT77r4K/U3GDhu+FQ2S8TnK/s2KbIGXi0SZWuwkZ2QNyfWdZW+TVfn84DpEP7rLeCt2UI6bJ8GwbQ==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
       "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://paulmillr.com/funding/"
+        }
+      ],
       "dependencies": {
         "anymatch": "~3.1.2",
         "braces": "~3.0.2",
@@ -2280,50 +2351,6 @@
         "wrap-ansi": "^7.0.0"
       }
     },
-    "node_modules/cliui/node_modules/ansi-regex": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-      "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/string-width": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
-      "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-      "dev": true,
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/strip-ansi": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-      "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-      "dev": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/clone-deep": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-4.0.1.tgz",
@@ -2344,9 +2371,9 @@
       "integrity": "sha512-+D1NZjAucuzE93vJGbAaXzvoBHwp9nJZWWWF9utjv25+5AZUiah6CIlfb4ikG4MoDsFsCG8niiJH5++OO2LgIQ=="
     },
     "node_modules/codemirror-rego": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/codemirror-rego/-/codemirror-rego-1.1.0.tgz",
-      "integrity": "sha512-knGIT7jLKVLljy+ABDetmqeinqBefF5rvjNNm7LH7zHz0dbw+1P5UxdocXi/LTCXss9XHBxWE1DSx2e/CsXNJw==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/codemirror-rego/-/codemirror-rego-1.3.0.tgz",
+      "integrity": "sha512-5GI/UCJZbOiPuwDE9UMh3k5aPWAtNOJzblx8loHdbNBz/3MJeOmjHXnhxq0ibNSIArLedvVv2neITcWhm6x+ew==",
       "peerDependencies": {
         "codemirror": "^5.48.0"
       }
@@ -2426,6 +2453,7 @@
       "version": "3.14.0",
       "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.14.0.tgz",
       "integrity": "sha512-3s+ed8er9ahK+zJpp9ZtuVcDoFzHNiZsPbNAAE4KXgrRHbjSqqNN6xGSXq6bq7TZIbKj4NLrLb6bJ5i+vSVjHA==",
+      "deprecated": "core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.",
       "dev": true,
       "hasInstallScript": true,
       "funding": {
@@ -2808,15 +2836,6 @@
       "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "dev": true
     },
-    "node_modules/emojis-list": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-3.0.0.tgz",
-      "integrity": "sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==",
-      "dev": true,
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/entities": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
@@ -2996,12 +3015,12 @@
       "dev": true
     },
     "node_modules/generic-names": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/generic-names/-/generic-names-2.0.1.tgz",
-      "integrity": "sha512-kPCHWa1m9wGG/OwQpeweTwM/PYiQLrUIxXbt/P4Nic3LbGjCP0YwrALHW1uNLKZ0LIMg+RF+XRlj2ekT9ZlZAQ==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/generic-names/-/generic-names-4.0.0.tgz",
+      "integrity": "sha512-ySFolZQfw9FoDb3ed9d80Cm9f0+r7qj+HJkWjeD9RBfpxEVTlVhol+gvaQB/78WbwYfbnNh8nWHHBSlg072y6A==",
       "dev": true,
       "dependencies": {
-        "loader-utils": "^1.1.0"
+        "loader-utils": "^3.2.0"
       }
     },
     "node_modules/gensync": {
@@ -3074,9 +3093,9 @@
       }
     },
     "node_modules/glob-parent": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.0.tgz",
-      "integrity": "sha512-Hdd4287VEJcZXUwv1l8a+vXC1GjOQqXe+VS30w/ypihpcnu9M1n3xeYeJu5CBpeEQj2nAab2xxz28GuA3vp4Ww==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.1.tgz",
+      "integrity": "sha512-kEVjS71mQazDBHKcsq4E9u/vUzaLcw1A8EtUeydawvIWQCJM0qQ08G1H7/XTjFUulla6XQiDOG6MXSaG0HDKog==",
       "dev": true,
       "dependencies": {
         "is-glob": "^4.0.1"
@@ -3304,6 +3323,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/is-glob": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.1.tgz",
@@ -3481,13 +3509,10 @@
       "dev": true
     },
     "node_modules/json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.5"
-      },
       "bin": {
         "json5": "lib/cli.js"
       },
@@ -3526,29 +3551,12 @@
       "dev": true
     },
     "node_modules/loader-utils": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz",
-      "integrity": "sha512-qH0WSMBtn/oHuwjy/NucEgbx5dbxxnxup9s4PVXJUDHZBQY+s0NWA9rJf53RBnQZxfch7euUui7hpoAPvALZdA==",
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-3.2.1.tgz",
+      "integrity": "sha512-ZvFw1KWS3GVyYBYb7qkmRM/WwL2TQQBxgCK62rlvm4WpVQ23Nb4tYjApUlfjrEGvOs7KHEsmyUn75OHZrJMWPw==",
       "dev": true,
-      "dependencies": {
-        "big.js": "^5.2.2",
-        "emojis-list": "^3.0.0",
-        "json5": "^1.0.1"
-      },
       "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/loader-utils/node_modules/json5": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-      "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
-      "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "json5": "lib/cli.js"
+        "node": ">= 12.13.0"
       }
     },
     "node_modules/locate-path": {
@@ -3748,9 +3756,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -3759,38 +3767,38 @@
       }
     },
     "node_modules/minimist": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==",
       "dev": true
     },
     "node_modules/mocha": {
-      "version": "9.1.2",
-      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.1.2.tgz",
-      "integrity": "sha512-ta3LtJ+63RIBP03VBjMGtSqbe6cWXRejF9SyM9Zyli1CKZJZ+vfCTj3oW24V7wAphMJdpOFLoMI3hjJ1LWbs0w==",
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.2.2.tgz",
+      "integrity": "sha512-L6XC3EdwT6YrIk0yXpavvLkn8h+EU+Y5UcCHKECyMbdUIxyMuZj4bX4U9e1nvnvUUvQVsV2VHQr5zLdcUkhW/g==",
       "dev": true,
       "dependencies": {
         "@ungap/promise-all-settled": "1.1.2",
         "ansi-colors": "4.1.1",
         "browser-stdout": "1.3.1",
-        "chokidar": "3.5.2",
-        "debug": "4.3.2",
+        "chokidar": "3.5.3",
+        "debug": "4.3.3",
         "diff": "5.0.0",
         "escape-string-regexp": "4.0.0",
         "find-up": "5.0.0",
-        "glob": "7.1.7",
+        "glob": "7.2.0",
         "growl": "1.10.5",
         "he": "1.2.0",
         "js-yaml": "4.1.0",
         "log-symbols": "4.1.0",
-        "minimatch": "3.0.4",
+        "minimatch": "4.2.1",
         "ms": "2.1.3",
-        "nanoid": "3.1.25",
+        "nanoid": "3.3.1",
         "serialize-javascript": "6.0.0",
         "strip-json-comments": "3.1.1",
         "supports-color": "8.1.1",
         "which": "2.0.2",
-        "workerpool": "6.1.5",
+        "workerpool": "6.2.0",
         "yargs": "16.2.0",
         "yargs-parser": "20.2.4",
         "yargs-unparser": "2.0.0"
@@ -3807,6 +3815,29 @@
         "url": "https://opencollective.com/mochajs"
       }
     },
+    "node_modules/mocha/node_modules/debug": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
+      "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/mocha/node_modules/debug/node_modules/ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
     "node_modules/mocha/node_modules/escape-string-regexp": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
@@ -3819,6 +3850,38 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/mocha/node_modules/glob": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.0.tgz",
+      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
+      "dev": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/mocha/node_modules/glob/node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/mocha/node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -3828,6 +3891,18 @@
         "node": ">=8"
       }
     },
+    "node_modules/mocha/node_modules/minimatch": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-4.2.1.tgz",
+      "integrity": "sha512-9Uq1ChtSZO+Mxa/CL1eGizn2vRn3MlLgzhT0Iz8zaY8NdvxvB0d5QdPFmCKf7JKA9Lerx5vRrnwO03jsSfGG9g==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/mocha/node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -3862,9 +3937,9 @@
       "dev": true
     },
     "node_modules/nanoid": {
-      "version": "3.1.25",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.1.25.tgz",
-      "integrity": "sha512-rdwtIXaXCLFAQbnfqDRnI6jaRHp9fTcYBjtFKE8eezcZ7LuLjhUaQGNeMXf1HmRoCH32CLz6XwX0TtxEOS/A3Q==",
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.1.tgz",
+      "integrity": "sha512-n6Vs/3KGyxPQd6uO0eH4Bv0ojGSUvuLlIHtC3Y0kEO23YRge8H9x1GCzLn28YX0H66pMkxuaeESFq4tKISKwdw==",
       "dev": true,
       "bin": {
         "nanoid": "bin/nanoid.cjs"
@@ -3887,11 +3962,22 @@
       }
     },
     "node_modules/node-fetch": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz",
-      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==",
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
       "engines": {
         "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
       }
     },
     "node_modules/node-modules-regexp": {
@@ -4534,12 +4620,12 @@
       }
     },
     "node_modules/postcss-modules": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/postcss-modules/-/postcss-modules-4.1.3.tgz",
-      "integrity": "sha512-dBT39hrXe4OAVYJe/2ZuIZ9BzYhOe7t+IhedYeQ2OxKwDpAGlkEN/fR0fGnrbx4BvgbMReRX4hCubYK9cE/pJQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/postcss-modules/-/postcss-modules-4.3.1.tgz",
+      "integrity": "sha512-ItUhSUxBBdNamkT3KzIZwYNNRFKmkJrofvC2nWab3CPKhYBQ1f27XXh1PAPE27Psx58jeelPsxWB/+og+KEH0Q==",
       "dev": true,
       "dependencies": {
-        "generic-names": "^2.0.1",
+        "generic-names": "^4.0.0",
         "icss-replace-symbols": "^1.1.0",
         "lodash.camelcase": "^4.3.0",
         "postcss-modules-extract-imports": "^3.0.0",
@@ -5368,6 +5454,7 @@
       "version": "0.1.8",
       "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz",
       "integrity": "sha512-ji9qxRnOVfcuLDySj9qzhGSEFVobyt1kIOSkj1qZzYLzq7Tos/oUUWvotUPQLlrsidqsK6tBH89Bc9kL5zHA6w==",
+      "deprecated": "Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility",
       "dev": true
     },
     "node_modules/string-hash": {
@@ -5376,6 +5463,32 @@
       "integrity": "sha1-6Kr8CsGFW0Zmkp7X3RJ1311sgRs=",
       "dev": true
     },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
@@ -5453,14 +5566,15 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.7.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.7.0.tgz",
-      "integrity": "sha512-HP5/9hp2UaZt5fYkuhNBR8YyRcT8juw8+uFbAme53iN9hblvKnLUTKkmwJG6ocWpIKf8UK4DoeWG4ty0J6S6/g==",
+      "version": "5.14.2",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.14.2.tgz",
+      "integrity": "sha512-oL0rGeM/WFQCUd0y2QrWxYnq7tfSuKBiqTjRPWrRgB46WD/kiwHwF8T23z78H6Q6kGCuuHcPB+KULHRdxvVGQA==",
       "dev": true,
       "dependencies": {
+        "@jridgewell/source-map": "^0.3.2",
+        "acorn": "^8.5.0",
         "commander": "^2.20.0",
-        "source-map": "~0.7.2",
-        "source-map-support": "~0.5.19"
+        "source-map-support": "~0.5.20"
       },
       "bin": {
         "terser": "bin/terser"
@@ -5469,13 +5583,35 @@
         "node": ">=10"
       }
     },
+    "node_modules/terser/node_modules/acorn": {
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.7.1.tgz",
+      "integrity": "sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/terser/node_modules/source-map": {
-      "version": "0.7.3",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.3.tgz",
-      "integrity": "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ==",
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "dev": true,
       "engines": {
-        "node": ">= 8"
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/terser/node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dev": true,
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
       }
     },
     "node_modules/timsort": {
@@ -5516,6 +5652,11 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha1-gYT9NH2snNwYWZLzpmIuFLnZq2o="
+    },
     "node_modules/tslib": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.2.0.tgz",
@@ -5592,6 +5733,20 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha1-JFNCdeKnvGvnvIZhHMFq4KVlSHE="
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha1-lmRU6HZUYuN2RNNib2dCzotwll0=",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -5608,9 +5763,9 @@
       }
     },
     "node_modules/workerpool": {
-      "version": "6.1.5",
-      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.1.5.tgz",
-      "integrity": "sha512-XdKkCK0Zqc6w3iTxLckiuJ81tiD/o5rBE/m+nXpRCB+/Sq4DqkfXZ/x0jW02DG1tGsfUGXbTJyZDP+eu67haSw==",
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.2.0.tgz",
+      "integrity": "sha512-Rsk5qQHJ9eowMH28Jwhe8HEbmdYDX4lwoMWshiCXugjtHqMD9ZbiqSDLxcsfdqsETPzVUtX5s1Z5kStiIM6l4A==",
       "dev": true
     },
     "node_modules/wrap-ansi": {
@@ -5630,15 +5785,6 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
-    "node_modules/wrap-ansi/node_modules/ansi-regex": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-      "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/wrap-ansi/node_modules/ansi-styles": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
@@ -5672,41 +5818,6 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "dev": true
     },
-    "node_modules/wrap-ansi/node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/string-width": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
-      "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-      "dev": true,
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/strip-ansi": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-      "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-      "dev": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -5772,50 +5883,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/yargs/node_modules/ansi-regex": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-      "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/string-width": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
-      "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-      "dev": true,
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/strip-ansi": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-      "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-      "dev": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
@@ -6942,6 +7009,55 @@
         "to-fast-properties": "^2.0.0"
       }
     },
+    "@jridgewell/gen-mapping": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      }
+    },
+    "@jridgewell/resolve-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+      "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+      "dev": true
+    },
+    "@jridgewell/set-array": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "dev": true
+    },
+    "@jridgewell/source-map": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
+      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/gen-mapping": "^0.3.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      }
+    },
+    "@jridgewell/sourcemap-codec": {
+      "version": "1.4.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+      "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+      "dev": true
+    },
+    "@jridgewell/trace-mapping": {
+      "version": "0.3.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.14.tgz",
+      "integrity": "sha512-bJWEfQ9lPTvm3SneWwRFVLzrh6nhjwqw7TUFFBEMzwvg7t7PCDenf2lDwqo4NQXzdpgBXyFgDWnQA+2vkruksQ==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
     "@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -7143,6 +7259,12 @@
       "integrity": "sha512-JoX0apGbHaUJBNl6yF+p6JAFYZ666/hhCGKN5t9QFjbJQKUU/g8MNbFDbvfrgKXvI1QpZplPOnwIo99lX/AAmA==",
       "dev": true
     },
+    "ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true
+    },
     "ansi-styles": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
@@ -7224,12 +7346,6 @@
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
-    "big.js": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/big.js/-/big.js-5.2.2.tgz",
-      "integrity": "sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==",
-      "dev": true
-    },
     "binary-extensions": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
@@ -7301,9 +7417,9 @@
       }
     },
     "camelcase": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.2.0.tgz",
-      "integrity": "sha512-c7wVvbw3f37nuobQNtgsgG9POC9qMbNuMQmTCqZv23b6MIz0fcYpBiOlv9gEN/hdLdnZTDQhg6e9Dq5M1vKvfg==",
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
       "dev": true
     },
     "caniuse-api": {
@@ -7319,9 +7435,9 @@
       }
     },
     "caniuse-lite": {
-      "version": "1.0.30001236",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001236.tgz",
-      "integrity": "sha512-o0PRQSrSCGJKCPZcgMzl5fUaj5xHe8qA2m4QRvnyY4e1lITqoNkr7q/Oh1NcpGSy0Th97UZ35yoKcINPoq7YOQ==",
+      "version": "1.0.30001320",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001320.tgz",
+      "integrity": "sha512-MWPzG54AGdo3nWx7zHZTefseM5Y1ccM7hlQKHRqJkPozUaw3hNbBTMmLn16GG2FUzjR13Cr3NPfhIieX5PzXDA==",
       "dev": true
     },
     "chai": {
@@ -7391,9 +7507,9 @@
       }
     },
     "chokidar": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.2.tgz",
-      "integrity": "sha512-ekGhOnNVPgT77r4K/U3GDhu+FQ2S8TnK/s2KbIGXi0SZWuwkZ2QNyfWdZW+TVfn84DpEP7rLeCt2UI6bJ8GwbQ==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
       "dev": true,
       "requires": {
         "anymatch": "~3.1.2",
@@ -7426,40 +7542,6 @@
         "string-width": "^4.2.0",
         "strip-ansi": "^6.0.0",
         "wrap-ansi": "^7.0.0"
-      },
-      "dependencies": {
-        "ansi-regex": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-          "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-          "dev": true
-        },
-        "is-fullwidth-code-point": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-          "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-          "dev": true
-        },
-        "string-width": {
-          "version": "4.2.2",
-          "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
-          "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-          "dev": true,
-          "requires": {
-            "emoji-regex": "^8.0.0",
-            "is-fullwidth-code-point": "^3.0.0",
-            "strip-ansi": "^6.0.0"
-          }
-        },
-        "strip-ansi": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-          "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-          "dev": true,
-          "requires": {
-            "ansi-regex": "^5.0.0"
-          }
-        }
       }
     },
     "clone-deep": {
@@ -7479,9 +7561,9 @@
       "integrity": "sha512-+D1NZjAucuzE93vJGbAaXzvoBHwp9nJZWWWF9utjv25+5AZUiah6CIlfb4ikG4MoDsFsCG8niiJH5++OO2LgIQ=="
     },
     "codemirror-rego": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/codemirror-rego/-/codemirror-rego-1.1.0.tgz",
-      "integrity": "sha512-knGIT7jLKVLljy+ABDetmqeinqBefF5rvjNNm7LH7zHz0dbw+1P5UxdocXi/LTCXss9XHBxWE1DSx2e/CsXNJw==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/codemirror-rego/-/codemirror-rego-1.3.0.tgz",
+      "integrity": "sha512-5GI/UCJZbOiPuwDE9UMh3k5aPWAtNOJzblx8loHdbNBz/3MJeOmjHXnhxq0ibNSIArLedvVv2neITcWhm6x+ew==",
       "requires": {}
     },
     "color-convert": {
@@ -7819,12 +7901,6 @@
       "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "dev": true
     },
-    "emojis-list": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-3.0.0.tgz",
-      "integrity": "sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==",
-      "dev": true
-    },
     "entities": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
@@ -7963,12 +8039,12 @@
       "dev": true
     },
     "generic-names": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/generic-names/-/generic-names-2.0.1.tgz",
-      "integrity": "sha512-kPCHWa1m9wGG/OwQpeweTwM/PYiQLrUIxXbt/P4Nic3LbGjCP0YwrALHW1uNLKZ0LIMg+RF+XRlj2ekT9ZlZAQ==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/generic-names/-/generic-names-4.0.0.tgz",
+      "integrity": "sha512-ySFolZQfw9FoDb3ed9d80Cm9f0+r7qj+HJkWjeD9RBfpxEVTlVhol+gvaQB/78WbwYfbnNh8nWHHBSlg072y6A==",
       "dev": true,
       "requires": {
-        "loader-utils": "^1.1.0"
+        "loader-utils": "^3.2.0"
       }
     },
     "gensync": {
@@ -8020,9 +8096,9 @@
       }
     },
     "glob-parent": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.0.tgz",
-      "integrity": "sha512-Hdd4287VEJcZXUwv1l8a+vXC1GjOQqXe+VS30w/ypihpcnu9M1n3xeYeJu5CBpeEQj2nAab2xxz28GuA3vp4Ww==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.1.tgz",
+      "integrity": "sha512-kEVjS71mQazDBHKcsq4E9u/vUzaLcw1A8EtUeydawvIWQCJM0qQ08G1H7/XTjFUulla6XQiDOG6MXSaG0HDKog==",
       "dev": true,
       "requires": {
         "is-glob": "^4.0.1"
@@ -8189,6 +8265,12 @@
       "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
       "dev": true
     },
+    "is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true
+    },
     "is-glob": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.1.tgz",
@@ -8326,13 +8408,10 @@
       "dev": true
     },
     "json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.5"
-      }
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true
     },
     "just-extend": {
       "version": "4.2.1",
@@ -8359,26 +8438,10 @@
       "dev": true
     },
     "loader-utils": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz",
-      "integrity": "sha512-qH0WSMBtn/oHuwjy/NucEgbx5dbxxnxup9s4PVXJUDHZBQY+s0NWA9rJf53RBnQZxfch7euUui7hpoAPvALZdA==",
-      "dev": true,
-      "requires": {
-        "big.js": "^5.2.2",
-        "emojis-list": "^3.0.0",
-        "json5": "^1.0.1"
-      },
-      "dependencies": {
-        "json5": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-          "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
-          "dev": true,
-          "requires": {
-            "minimist": "^1.2.0"
-          }
-        }
-      }
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-3.2.1.tgz",
+      "integrity": "sha512-ZvFw1KWS3GVyYBYb7qkmRM/WwL2TQQBxgCK62rlvm4WpVQ23Nb4tYjApUlfjrEGvOs7KHEsmyUn75OHZrJMWPw==",
+      "dev": true
     },
     "locate-path": {
       "version": "6.0.0",
@@ -8536,63 +8599,114 @@
       }
     },
     "minimatch": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
       "requires": {
         "brace-expansion": "^1.1.7"
       }
     },
     "minimist": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==",
       "dev": true
     },
     "mocha": {
-      "version": "9.1.2",
-      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.1.2.tgz",
-      "integrity": "sha512-ta3LtJ+63RIBP03VBjMGtSqbe6cWXRejF9SyM9Zyli1CKZJZ+vfCTj3oW24V7wAphMJdpOFLoMI3hjJ1LWbs0w==",
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.2.2.tgz",
+      "integrity": "sha512-L6XC3EdwT6YrIk0yXpavvLkn8h+EU+Y5UcCHKECyMbdUIxyMuZj4bX4U9e1nvnvUUvQVsV2VHQr5zLdcUkhW/g==",
       "dev": true,
       "requires": {
         "@ungap/promise-all-settled": "1.1.2",
         "ansi-colors": "4.1.1",
         "browser-stdout": "1.3.1",
-        "chokidar": "3.5.2",
-        "debug": "4.3.2",
+        "chokidar": "3.5.3",
+        "debug": "4.3.3",
         "diff": "5.0.0",
         "escape-string-regexp": "4.0.0",
         "find-up": "5.0.0",
-        "glob": "7.1.7",
+        "glob": "7.2.0",
         "growl": "1.10.5",
         "he": "1.2.0",
         "js-yaml": "4.1.0",
         "log-symbols": "4.1.0",
-        "minimatch": "3.0.4",
+        "minimatch": "4.2.1",
         "ms": "2.1.3",
-        "nanoid": "3.1.25",
+        "nanoid": "3.3.1",
         "serialize-javascript": "6.0.0",
         "strip-json-comments": "3.1.1",
         "supports-color": "8.1.1",
         "which": "2.0.2",
-        "workerpool": "6.1.5",
+        "workerpool": "6.2.0",
         "yargs": "16.2.0",
         "yargs-parser": "20.2.4",
         "yargs-unparser": "2.0.0"
       },
       "dependencies": {
+        "debug": {
+          "version": "4.3.3",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
+          "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
+          "dev": true,
+          "requires": {
+            "ms": "2.1.2"
+          },
+          "dependencies": {
+            "ms": {
+              "version": "2.1.2",
+              "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+              "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+              "dev": true
+            }
+          }
+        },
         "escape-string-regexp": {
           "version": "4.0.0",
           "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
           "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
           "dev": true
         },
+        "glob": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.0.tgz",
+          "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
+          "dev": true,
+          "requires": {
+            "fs.realpath": "^1.0.0",
+            "inflight": "^1.0.4",
+            "inherits": "2",
+            "minimatch": "^3.0.4",
+            "once": "^1.3.0",
+            "path-is-absolute": "^1.0.0"
+          },
+          "dependencies": {
+            "minimatch": {
+              "version": "3.1.2",
+              "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+              "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+              "dev": true,
+              "requires": {
+                "brace-expansion": "^1.1.7"
+              }
+            }
+          }
+        },
         "has-flag": {
           "version": "4.0.0",
           "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
           "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
           "dev": true
         },
+        "minimatch": {
+          "version": "4.2.1",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-4.2.1.tgz",
+          "integrity": "sha512-9Uq1ChtSZO+Mxa/CL1eGizn2vRn3MlLgzhT0Iz8zaY8NdvxvB0d5QdPFmCKf7JKA9Lerx5vRrnwO03jsSfGG9g==",
+          "dev": true,
+          "requires": {
+            "brace-expansion": "^1.1.7"
+          }
+        },
         "ms": {
           "version": "2.1.3",
           "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -8623,9 +8737,9 @@
       "dev": true
     },
     "nanoid": {
-      "version": "3.1.25",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.1.25.tgz",
-      "integrity": "sha512-rdwtIXaXCLFAQbnfqDRnI6jaRHp9fTcYBjtFKE8eezcZ7LuLjhUaQGNeMXf1HmRoCH32CLz6XwX0TtxEOS/A3Q==",
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.1.tgz",
+      "integrity": "sha512-n6Vs/3KGyxPQd6uO0eH4Bv0ojGSUvuLlIHtC3Y0kEO23YRge8H9x1GCzLn28YX0H66pMkxuaeESFq4tKISKwdw==",
       "dev": true
     },
     "nise": {
@@ -8642,9 +8756,12 @@
       }
     },
     "node-fetch": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz",
-      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw=="
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "requires": {
+        "whatwg-url": "^5.0.0"
+      }
     },
     "node-modules-regexp": {
       "version": "1.0.0",
@@ -9087,12 +9204,12 @@
       }
     },
     "postcss-modules": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/postcss-modules/-/postcss-modules-4.1.3.tgz",
-      "integrity": "sha512-dBT39hrXe4OAVYJe/2ZuIZ9BzYhOe7t+IhedYeQ2OxKwDpAGlkEN/fR0fGnrbx4BvgbMReRX4hCubYK9cE/pJQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/postcss-modules/-/postcss-modules-4.3.1.tgz",
+      "integrity": "sha512-ItUhSUxBBdNamkT3KzIZwYNNRFKmkJrofvC2nWab3CPKhYBQ1f27XXh1PAPE27Psx58jeelPsxWB/+og+KEH0Q==",
       "dev": true,
       "requires": {
-        "generic-names": "^2.0.1",
+        "generic-names": "^4.0.0",
         "icss-replace-symbols": "^1.1.0",
         "lodash.camelcase": "^4.3.0",
         "postcss-modules-extract-imports": "^3.0.0",
@@ -9694,6 +9811,26 @@
       "integrity": "sha1-6Kr8CsGFW0Zmkp7X3RJ1311sgRs=",
       "dev": true
     },
+    "string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "requires": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      }
+    },
+    "strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "requires": {
+        "ansi-regex": "^5.0.1"
+      }
+    },
     "strip-json-comments": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
@@ -9749,21 +9886,38 @@
       }
     },
     "terser": {
-      "version": "5.7.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.7.0.tgz",
-      "integrity": "sha512-HP5/9hp2UaZt5fYkuhNBR8YyRcT8juw8+uFbAme53iN9hblvKnLUTKkmwJG6ocWpIKf8UK4DoeWG4ty0J6S6/g==",
+      "version": "5.14.2",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.14.2.tgz",
+      "integrity": "sha512-oL0rGeM/WFQCUd0y2QrWxYnq7tfSuKBiqTjRPWrRgB46WD/kiwHwF8T23z78H6Q6kGCuuHcPB+KULHRdxvVGQA==",
       "dev": true,
       "requires": {
+        "@jridgewell/source-map": "^0.3.2",
+        "acorn": "^8.5.0",
         "commander": "^2.20.0",
-        "source-map": "~0.7.2",
-        "source-map-support": "~0.5.19"
+        "source-map-support": "~0.5.20"
       },
       "dependencies": {
+        "acorn": {
+          "version": "8.7.1",
+          "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.7.1.tgz",
+          "integrity": "sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==",
+          "dev": true
+        },
         "source-map": {
-          "version": "0.7.3",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.3.tgz",
-          "integrity": "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ==",
+          "version": "0.6.1",
+          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
           "dev": true
+        },
+        "source-map-support": {
+          "version": "0.5.21",
+          "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+          "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+          "dev": true,
+          "requires": {
+            "buffer-from": "^1.0.0",
+            "source-map": "^0.6.0"
+          }
         }
       }
     },
@@ -9796,6 +9950,11 @@
         "is-number": "^7.0.0"
       }
     },
+    "tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha1-gYT9NH2snNwYWZLzpmIuFLnZq2o="
+    },
     "tslib": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.2.0.tgz",
@@ -9853,6 +10012,20 @@
       "integrity": "sha512-/juG65kTL4Cy2su4P8HjtkTxk6VmJDiOPBufWniqQ6wknac6jNiXS9vU+hO3wgusiyqWlzTbVHi0dyJqRONg3w==",
       "dev": true
     },
+    "webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha1-JFNCdeKnvGvnvIZhHMFq4KVlSHE="
+    },
+    "whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha1-lmRU6HZUYuN2RNNib2dCzotwll0=",
+      "requires": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
     "which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -9863,9 +10036,9 @@
       }
     },
     "workerpool": {
-      "version": "6.1.5",
-      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.1.5.tgz",
-      "integrity": "sha512-XdKkCK0Zqc6w3iTxLckiuJ81tiD/o5rBE/m+nXpRCB+/Sq4DqkfXZ/x0jW02DG1tGsfUGXbTJyZDP+eu67haSw==",
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.2.0.tgz",
+      "integrity": "sha512-Rsk5qQHJ9eowMH28Jwhe8HEbmdYDX4lwoMWshiCXugjtHqMD9ZbiqSDLxcsfdqsETPzVUtX5s1Z5kStiIM6l4A==",
       "dev": true
     },
     "wrap-ansi": {
@@ -9879,12 +10052,6 @@
         "strip-ansi": "^6.0.0"
       },
       "dependencies": {
-        "ansi-regex": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-          "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-          "dev": true
-        },
         "ansi-styles": {
           "version": "4.3.0",
           "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
@@ -9908,32 +10075,6 @@
           "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
           "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
           "dev": true
-        },
-        "is-fullwidth-code-point": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-          "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-          "dev": true
-        },
-        "string-width": {
-          "version": "4.2.2",
-          "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
-          "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-          "dev": true,
-          "requires": {
-            "emoji-regex": "^8.0.0",
-            "is-fullwidth-code-point": "^3.0.0",
-            "strip-ansi": "^6.0.0"
-          }
-        },
-        "strip-ansi": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-          "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-          "dev": true,
-          "requires": {
-            "ansi-regex": "^5.0.0"
-          }
         }
       }
     },
@@ -9967,40 +10108,6 @@
         "string-width": "^4.2.0",
         "y18n": "^5.0.5",
         "yargs-parser": "^20.2.2"
-      },
-      "dependencies": {
-        "ansi-regex": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-          "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-          "dev": true
-        },
-        "is-fullwidth-code-point": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-          "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-          "dev": true
-        },
-        "string-width": {
-          "version": "4.2.2",
-          "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.2.tgz",
-          "integrity": "sha512-XBJbT3N4JhVumXE0eoLU9DCjcaF92KLNqTmFCnG1pf8duUxFGwtP6AD6nkjw9a3IdiRtL3E2w3JDiE/xi3vOeA==",
-          "dev": true,
-          "requires": {
-            "emoji-regex": "^8.0.0",
-            "is-fullwidth-code-point": "^3.0.0",
-            "strip-ansi": "^6.0.0"
-          }
-        },
-        "strip-ansi": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-          "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-          "dev": true,
-          "requires": {
-            "ansi-regex": "^5.0.0"
-          }
-        }
       }
     },
     "yargs-parser": {
diff --git a/docs/website/scripts/live-blocks/package.json b/docs/website/scripts/live-blocks/package.json
index d8c694ed5c..3aa3b59f73 100644
--- a/docs/website/scripts/live-blocks/package.json
+++ b/docs/website/scripts/live-blocks/package.json
@@ -20,9 +20,9 @@
   "dependencies": {
     "cheerio": "^1.0.0-rc.3",
     "codemirror": "^5.58.2",
-    "codemirror-rego": "^1.1.0",
+    "codemirror-rego": "^1.3.0",
     "esm": "^3.2.25",
-    "node-fetch": "^2.6.1",
+    "node-fetch": "^2.6.7",
     "tmp": "^0.2.1"
   },
   "devDependencies": {
@@ -42,9 +42,9 @@
     "chai-as-promised": "^7.1.1",
     "core-js": "^3.1.4",
     "dot-prop": ">=5.1.1",
-    "glob-parent": ">=5.1.2",
-    "minimist": ">=1.2.2",
-    "mocha": ">=9.1.2",
+    "glob-parent": ">=6.0.1",
+    "minimist": ">=1.2.6",
+    "mocha": "^9.2.2",
     "normalize-url": ">=4.5.1",
     "nth-check": ">=2.0.1",
     "postcss": "^8.2.10",
diff --git a/docs/website/scripts/live-blocks/src/preprocess/acquireOPAVersion.js b/docs/website/scripts/live-blocks/src/preprocess/acquireOPAVersion.js
index 8be10503d4..e3caa97b18 100644
--- a/docs/website/scripts/live-blocks/src/preprocess/acquireOPAVersion.js
+++ b/docs/website/scripts/live-blocks/src/preprocess/acquireOPAVersion.js
@@ -50,7 +50,7 @@ function createAcquirer(version) {
 
     const path = pathToVersion(version)
 
-    if (await needsDownloading(version, path)) { // This does not protect against run conditions within a single preprocessing script run, simply allows (long-term) caching.
+    if (await needsDownloading(path)) { // This does not protect against run conditions within a single preprocessing script run, simply allows (long-term) caching.
 
       // Edge is required to have been built from the current source tree,
       // expect the binary to be available at the normal build output location.
@@ -59,7 +59,7 @@ function createAcquirer(version) {
         throw new Error(`binary for ${VERSION_EDGE} is not available at path ${path}, ensure it has been built for the current platform`)
       }
 
-      const assetURL = await getReleaseAssetURL(version)
+      const assetURL = getReleaseAssetURL(version);
 
       let file
       try {
@@ -89,34 +89,17 @@ function pathToVersion(version) {
   return path.resolve(OPA_CACHE_PATH, `${version}-${PLATFORM}${PLATFORM === PLATFORMS.WINDOWS ? '.exe' : ''}`)
 }
 
-// Gets the URL that can be used to download a given version of OPA for the current platform. May error with a user-friendly message.
-async function getReleaseAssetURL(version) {
-  // Releases are on GitHub
-  let releaseURL;
+// Gets the URL that can be used to download a given version of OPA for the current platform.
+// Releases are on GitHub, URLs are predictable
+function getReleaseAssetURL(version) {
   if (version === VERSION_LATEST) {
-    releaseURL = `https://api.github.com/repos/open-policy-agent/opa/releases/latest`
-  } else {
-    releaseURL = `https://api.github.com/repos/open-policy-agent/opa/releases/tags/${version}`;
-  }
-
-  try {
-    const release = await (await fetch(releaseURL)).json()
-    for (let asset of Object.values(release.assets)) {
-      if (asset.name.indexOf(PLATFORM) != -1) {
-        if (asset.browser_download_url) { // If it's actually set, return it
-          return asset.browser_download_url
-        }
-        // Implicit else, throw error below.
-      }
-    }
-  } catch (e) {
-    throw new ChainedError(`error occurred while getting the OPA release asset URL for ${version} on ${PLATFORM} from ${releaseURL}`, e)
+    version = process.env.LATEST;
   }
-  throw new Error(`unable to get the OPA release asset URL for ${version} on ${PLATFORM} from ${releaseURL}`)
+  return `https://github.com/open-policy-agent/opa/releases/download/${version}/opa_${PLATFORM}_${GOARCH}${PLATFORM === PLATFORMS.WINDOWS ? '.exe' : ''}`;
 }
 
-// Determines, based on the desired version and the path to where it should be downloaded, whether it needs to be downloaded. Will not throw an error.
-async function needsDownloading(version, path) {
+// Determines, based on the path to where it should be downloaded, whether it needs to be downloaded. Will not throw an error.
+async function needsDownloading(path) {
   try {
     await promFS.access(path, fsConsts.X_OK) // X_OK verifies that permissions-wise it's executable
   } catch (e) {
diff --git a/docs/website/scripts/live-blocks/src/preprocess/index.js b/docs/website/scripts/live-blocks/src/preprocess/index.js
index 2cd9716094..d163638903 100644
--- a/docs/website/scripts/live-blocks/src/preprocess/index.js
+++ b/docs/website/scripts/live-blocks/src/preprocess/index.js
@@ -79,7 +79,10 @@ async function processFile(path) {
 function getVersion(path) {
   const versionMatch = (new RegExp(`/(v[^/]*|${VERSION_EDGE}|${VERSION_LATEST})/`)).exec(filepath.resolve(path))
   if (!versionMatch) {
-    return VERSION_LATEST
+    if (process.env.LATEST) {
+      return VERSION_LATEST
+    }
+    return VERSION_EDGE
   }
 
   return versionMatch[1]
diff --git a/docs/website/scripts/live-blocks/src/preprocess/localEval.js b/docs/website/scripts/live-blocks/src/preprocess/localEval.js
index ffefb19206..dfa8e87783 100644
--- a/docs/website/scripts/live-blocks/src/preprocess/localEval.js
+++ b/docs/website/scripts/live-blocks/src/preprocess/localEval.js
@@ -3,9 +3,10 @@ import util from 'util'
 import {promises as promFS} from 'fs'
 
 import tmp from 'tmp'
+import semver from 'semver'
 
 import {ChainedError, OPAErrors} from '../errors'
-import {EVAL_MODULE_NAME} from '../constants'
+import {EVAL_MODULE_NAME, VERSION_EDGE, VERSION_LATEST} from '../constants'
 import {getGroupData} from '../helpers'
 
 import {acquireOPAVersion} from './acquireOPAVersion'
@@ -21,7 +22,7 @@ const tmpFile = util.promisify(tmp.file)
 export default async function localEval(groups, groupName, opaVersion) {
   const opa = await acquireOPAVersion(opaVersion) // Get the path (and download if necessary) the required version of OPA.
 
-  const [args, moduleFilenameMap] = await prepEval(groups, groupName) // Save the group data to temporary files
+  const [args, moduleFilenameMap] = await prepEval(groups, groupName, opaVersion) // Save the group data to temporary files
 
   try {
     return (await execFile(opa, args('pretty'))).stdout.replace(/\n$/, '') // Evaluate, retrieving the pretty-formatted output
@@ -66,7 +67,7 @@ export default async function localEval(groups, groupName, opaVersion) {
 }
 
 // Returns 1st a function that consumes a string for the output format you want and produces an array of arguments and 2nd a map of module file names to strings that should be replaced in error messages. May throw a user-friendly error.
-async function prepEval(groups, groupName) {
+async function prepEval(groups, groupName, opaVersion) {
   const {module, package: pkg, query, input, included} = getGroupData(groups, groupName)
   const base = ['eval', '--fail'] // Fail on undefined
   const rest = []
@@ -91,6 +92,13 @@ async function prepEval(groups, groupName) {
     }
 
     if (query) {
+      // NOTE(sr): Only do this if the version is recent enough to understand it,
+      // and if we're rendering docs of a version where we actually started using
+      // queries that need this import.
+      if (opaVersion === VERSION_LATEST || opaVersion == VERSION_EDGE ||
+        semver.satisfies(semver.coerce(opaVersion), '>=0.42.0')) {
+        rest.push('--import', 'future.keywords') // queries may contain them
+      }
       rest.push(query)
     } else { // Simulate playground default behavior
       if (included) {
diff --git a/docs/website/scripts/load-docs.sh b/docs/website/scripts/load-docs.sh
index 8156c4f7ec..7c5a7e2259 100755
--- a/docs/website/scripts/load-docs.sh
+++ b/docs/website/scripts/load-docs.sh
@@ -24,13 +24,17 @@ RELEASES=()
 PREV_MAJOR_VER="-1"
 PREV_MINOR_VER="-1"
 
+if [[ ${DEV} != "" ]]; then
+    ALL_RELEASES=()
+fi
+
 for release in ${ALL_RELEASES}; do
     CUR_SEM_VER=${release#"v"}
 
     # ignore any release candidate versions, for now if they
     # are the "latest" they'll be documented under "edge"
     if [[ "${CUR_SEM_VER}" == *"rc"* ]]; then
-      continue
+        continue
     fi
 
     SEMVER_REGEX='[^0-9]*\([0-9]*\)[.]\([0-9]*\)[.]\([0-9]*\)\([0-9A-Za-z-]*\)'
@@ -57,8 +61,8 @@ for release in ${ALL_RELEASES}; do
     # The releases are sorted in order by semver from newest to oldest, and we only want
     # the latest point release for each minor version
     if [[ "${CUR_MAJOR_VER}" != "${PREV_MAJOR_VER}" || \
-             ("${CUR_MAJOR_VER}" = "${PREV_MAJOR_VER}" && \
-                "${CUR_MINOR_VER}" != "${PREV_MINOR_VER}") ]]; then
+            ("${CUR_MAJOR_VER}" = "${PREV_MAJOR_VER}" && \
+            "${CUR_MINOR_VER}" != "${PREV_MINOR_VER}") ]]; then
         RELEASES+=(${release})
     fi
 
@@ -77,8 +81,10 @@ rm -f ${RELEASES_YAML_FILE}
 
 mkdir -p $(dirname ${RELEASES_YAML_FILE})
 
-echo 'Adding "latest" version to releases.yaml'
-echo "- latest" > ${RELEASES_YAML_FILE}
+if [[ ${DEV} == "" ]]; then
+    echo 'Adding "latest" version to releases.yaml'
+    echo "- latest" > ${RELEASES_YAML_FILE}
+fi
 
 for release in "${RELEASES[@]}"; do
     version_docs_dir=${ROOT_DIR}/docs/website/generated/docs/${release}
@@ -108,7 +114,10 @@ echo "- edge" >> ${RELEASES_YAML_FILE}
 
 # Link instead of copy so we don't need to re-generate each time.
 # Use a relative link so it works in a container more easily.
+mkdir -p ${ROOT_DIR}/docs/website/generated/docs
 ln -s ../../../content ${ROOT_DIR}/docs/website/generated/docs/edge
 
 # Create a "latest" version from the latest semver found
-ln -s ${RELEASES[0]} ${ROOT_DIR}/docs/website/generated/docs/latest
+if [[ ${DEV} == "" ]]; then
+    cp -r ${ROOT_DIR}/docs/website/generated/docs/${RELEASES[0]} ${ROOT_DIR}/docs/website/generated/docs/latest
+fi
diff --git a/docs/website/static/community.html b/docs/website/static/community.html
new file mode 100644
index 0000000000..b72abf046a
--- /dev/null
+++ b/docs/website/static/community.html
@@ -0,0 +1,441 @@
+<!doctype html>
+<html lang="en">
+
+  <head>
+    <!-- Required meta tags -->
+    <meta charset="utf-8">
+    <meta name="viewport"
+          content="width=device-width, initial-scale=1, shrink-to-fit=no">
+
+    <!-- Bootstrap CSS -->
+    <link rel="stylesheet" href="css/bootstrap.min.css">
+
+    <title>Open Policy Agent | Community </title>
+    <link rel="stylesheet" href="css/home.css">
+    <link rel="stylesheet" href="css/community.css">
+    <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.15.4/css/all.css">
+  </head>
+
+  <body data-spy="scroll" data-target=".navbar" data-offset="90">
+
+
+    <div class="support-bg">
+      <div id="navigation">
+        <nav class="navbar navbar-expand-lg navbar-dark bg-transparent">
+          <div class="container">
+
+            <a class="navbar-brand" href="/" aria-label="Open Policy Agent home"><img
+              title="OPA logo" src="./img/logo-white.png" class="img-fluid"></a>
+            <button class="navbar-toggler navbar-toggler-right collapsed"
+                    type="button" data-toggle="collapse"
+                    data-target="#navb" aria-expanded="false">
+              <span class="navbar-toggler-icon"></span>
+            </button>
+
+            <div class="navbar-collapse collapse" id="navb">
+              <ul class="navbar-nav mr-auto">
+              </ul>
+
+              <ul class="navbar-nav">
+                <li class="nav-item"><a class="nav-link" href="./docs/">Docs</a></li>
+                <li class="nav-item"><a class="nav-link" href="./docs/#running-opa">Download</a></li>
+                <li class="nav-item"><a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a></li>
+                <li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
+                <li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
+                <li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
+                <li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
+                <li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
+                <li class="nav-item social-nav-item">
+                  <a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
+                    <img src="./img/twitter-icon.png" alt="Twitter">
+                    <div class="nav-link social-icon-title">Twitter</div>
+                  </a>
+                </li>
+                <li class="nav-item social-nav-item">
+                  <a class="nav-link social-icon-link" href="https://slack.openpolicyagent.org/">
+                    <img src="./img/slack-icon.png" alt="Slack">
+                    <div class="nav-link social-icon-title">Slack</div>
+                  </a>
+                </li>
+                <li class="nav-item social-nav-item">
+                  <a class="nav-link social-icon-link" href="https://github.com/open-policy-agent/opa">
+                    <img src="./img/github-icon.png" alt="GitHub">
+                    <div class="social-icon-title">GitHub</div>
+                  </a>
+                </li>
+              </ul>
+            </div>
+          </div>
+
+        </nav>
+      </div>
+
+      <main class="support-content">
+
+        <section id="homebackground">
+
+          <h1 class="banner-content">
+            Community
+          </h1>
+          <div class="banner-subcontent">
+            Since its launch in 2016, Open Policy Agent has steadily gained momentum as
+            the de facto approach for establishing authorization policies
+            across cloud native environments.
+            Its remarkable growth and adoption is due in no small part to the amazing
+            community that has grown up right along side it.
+            Leverage this list of community resources to maximize the value OPA can provide!
+          </div>
+
+          <h2 class="divider line glow">Social Channels</h2>
+
+          <div class="grid-container">
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Twitter" class="card-img align-middle" src="img/community-logos/twitter.png"/>
+                    <div class="card-text">
+                      <div class="header">Twitter</div>
+                      <div class="subheader">
+                        Connect with us on Twitter to get the latest announcements.
+                      </div>
+                      <a href="https://twitter.com/openpolicyagent"
+                        class="btn btn-primary btn-lg" role="button">Follow us on Twitter</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Medium" class="card-img align-middle" src="img/community-logos/medium.png"/>
+                    <div class="card-text">
+                      <div class="header">Medium</div>
+                      <div class="subheader">
+                        Sign up to receive OPA news, blogs, and tutorials.
+                      </div>
+                      <a href="https://blog.openpolicyagent.org/"
+                        class="btn btn-primary btn-lg" role="button">Read the OPA Blog</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="LinkedIn" class="card-img align-middle" src="img/community-logos/linkedin.png"/>
+                    <div class="card-text">
+                      <div class="header">LinkedIn</div>
+                      <div class="subheader">
+                        Follow Open Policy Agent on LinkedIn and connect with others working with OPA.
+                      </div>
+                      <a href="https://www.linkedin.com/company/open-policy-agent/"
+                         class="btn btn-primary btn-lg" role="button">Follow us on LinkedIn</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+          </div>
+
+          <h2 class="divider line glow">Community Support</h2>
+
+          <div class="grid-container">
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Slack" class="card-img align-middle" src="img/community-logos/slack.png"/>
+                    <div class="card-text">
+                      <div class="header">Slack</div>
+                      <div class="subheader">
+                        Casual conversations with the OPA community.
+                      </div>
+                      <a href="https://slack.openpolicyagent.org/"
+                        class="btn btn-primary btn-lg" role="button">Join us on Slack</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="GitHub" class="card-img align-middle" src="img/community-logos/github.png"/>
+                    <div class="card-text">
+                      <div class="header">GitHub</div>
+                      <div class="subheader">
+                        Get involved with OPA development. Request a feature, file a bug, or just check out the open source code base.
+                      </div>
+                      <a href="https://github.com/open-policy-agent"
+                        class="btn btn-primary btn-lg" role="button">View OPA on GitHub</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="GitHub Discussions" class="card-img align-middle" src="img/community-logos/github-discussions.png"/>
+                    <div class="card-text">
+                      <div class="header">OPA Knowledge Base</div>
+                      <div class="subheader">
+                        Community powered support for OPA and Rego. Ask questions about writing Rego files, implementing OPA, or share the configurations you are working on.
+                      </div>
+                      <a href="https://github.com/open-policy-agent/community/discussions"
+                        class="btn btn-primary btn-lg" role="button">Ask a question</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Stack Overflow" class="card-img align-middle" src="img/community-logos/stack-overflow.png"/>
+                    <div class="card-text">
+                      <div class="header">Stack Overflow</div>
+                      <div class="subheader">
+                        Ask the global developer community questions about OPA with the tag #open-policy-agent
+                      </div>
+                      <a href="https://stackoverflow.com/questions/tagged/open-policy-agent"
+                        class="btn btn-primary btn-lg" role="button">Ask a Question</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+          </div>
+
+          <h2 class="divider line glow">Champions</h2>
+
+          <div class="grid-container">
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Peter Macdonald" class="card-img align-middle" src="img/community-logos/petermacdonald.jpg"/>
+                    <div class="card-text">
+                      <div class="header">Peter Macdonald</div>
+                      <div class="subheader">
+                        <a href="https://hachyderm.io/@parcifal" alt="Mastodon">
+                          <i class="fab fa-mastodon"></i>
+                          parcifal
+                        </a>
+                        <br/>
+                        <a href="https://twitter.com/_PeterM_" alt="Twitter">
+                          <i class="fab fa-twitter-square"></i>
+                          _PeterM_
+                        </a>
+                        <br>
+                        <a href="https://github.com/Parsifal-M" alt="GitHub">
+                          <i class="fab fa-github-square"></i>
+                          Parsifal-M
+                        </a>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="John Reese" class="card-img align-middle" src="img/community-logos/john-reese.png"/>
+                    <div class="card-text">
+                      <div class="header">John Reese</div>
+                      <div class="subheader">
+                        <a href="https://hachyderm.io/@jpreese" alt="Mastodon">
+                          <i class="fab fa-mastodon"></i>
+                          jpreese
+                        </a>
+                        <br/>
+                        <a href="https://twitter.com/johnpreese" alt="Twitter">
+                          <i class="fab fa-twitter-square"></i>
+                          johnpreese
+                        </a>
+                        <br>
+                        <a href="https://github.com/jpreese" alt="Github">
+                          <i class="fab fa-github-square"></i>
+                          jpreese
+                        </a>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Grant Shively" class="card-img align-middle" src="img/community-logos/grant-shively.png"/>
+                    <div class="card-text">
+                      <div class="header">Grant Shively</div>
+                      <div class="subheader">
+                        <a href="https://github.com/gshively11" alt="GitHub">
+                          <i class="fab fa-github-square"></i>
+                          gshively11
+                        </a>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Masayoshi Mizutani" class="card-img align-middle" src="img/community-logos/mizutani-masayoshi.png"/>
+                    <div class="card-text">
+                      <div class="header">Masayoshi Mizutani</div>
+                      <div class="subheader">
+                        <a href="https://twitter.com/m_mizutani" alt="Twitter">
+                          <i class="fab fa-twitter-square"></i>
+                          m_mizutani
+                        </a>
+                        <br>
+                        <a href="https://github.com/m-mizutani" alt="Github">
+                          <i class="fab fa-github-square"></i>
+                          m-mizutani
+                        </a>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+          </div>
+
+          <h2 class="divider line glow">Contribute</h2>
+
+          <div class="grid-container">
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Blog Post" class="card-img align-middle" src="img/community-logos/blog.png"/>
+                    <div class="card-text">
+                      <div class="header">Blog Post</div>
+                      <div class="subheader">
+                        Contribute to the official OPA blog. Write about special use cases, advance configurations, deployment strategies or the OPA community.
+                      </div>
+                      <a href="mailto:opa_community@styra.com?subject=Contribute%20to%20OPA%20Blog"
+                        class="btn btn-primary btn-lg" role="button">Email</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+              <div class="card">
+                <div class="card-body">
+                  <div class="support-card-content d-flex flex-column align-items-start">
+                    <img title="Conference and Meetup CFPs" class="card-img align-middle" src="img/community-logos/cfp.png"/>
+                    <div class="card-text">
+                      <div class="header">Conference and Meetup CFPs</div>
+                      <div class="subheader">
+                        Want to share your OPA knowledge with the world? The OPA team is here to help. Let us know and we can review, suggest edits or help you practice.
+                      </div>
+                      <a href="mailto:opa_community@styra.com?subject=Write%20a%20CFP"
+                        class="btn btn-primary btn-lg" role="button">Write A CFP</a>
+                    </div>
+                  </div>
+                </div>
+              </div>
+
+          </div>
+
+          <h2 class="divider line glow">Meetups</h2>
+
+          <div class="grid-container">
+
+            <div class="card">
+              <div class="card-body">
+                <div class="support-card-content d-flex flex-column align-items-start">
+                  <img title="Amsterdam OPA Users" class="card-img align-middle" src="img/community-logos/meetup.png"/>
+                  <div class="card-text">
+                    <div class="header">Amsterdam OPA Users</div>
+                    <br/>
+                    <a href="https://www.meetup.com/opa-amsterdam/"
+                       class="btn btn-primary btn-lg" role="button">Join Amsterdam OPA users</a>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <div class="card">
+              <div class="card-body">
+                <div class="support-card-content d-flex flex-column align-items-start">
+                  <img title="London OPA Meetup" class="card-img align-middle" src="img/community-logos/meetup.png"/>
+                  <div class="card-text">
+                    <div class="header">London OPA Meetup</div>
+                    <br/>
+                    <a href="https://www.meetup.com/london-opa-meetup/"
+                       class="btn btn-primary btn-lg" role="button">Join London OPA Meetup</a>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <div class="card">
+              <div class="card-body">
+                <div class="support-card-content d-flex flex-column align-items-start">
+                  <img title="Stockholm OPA Users" class="card-img align-middle" src="img/community-logos/meetup.png"/>
+                  <div class="card-text">
+                    <div class="header">Stockholm OPA Users</div>
+                    <br/>
+                    <br/>
+                    <div class="h-50"></div>
+                    <a href="https://www.meetup.com/stockholm-opa-meetup/"
+                       class="btn btn-primary btn-lg" role="button">Join Stockholm OPA Users</a>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+            <div class="card">
+              <div class="card-body">
+                <div class="support-card-content d-flex flex-column align-items-start">
+                  <img title="Meetup" class="card-img align-middle" src="img/community-logos/meetup.png"/>
+                  <div class="card-text">
+                    <div class="header">Host your own!</div>
+                    <div class="subheader">
+                      Host a localized meetup in your area or virtually. Share what you've learned and connect with the OPA community!
+                    </div>
+                    <a href="mailto:opa_community@styra.com?subject=Host%20an%20OPA%20Meetup"
+                       class="btn btn-primary btn-lg" role="button">Host a Meetup</a>
+                  </div>
+                </div>
+              </div>
+            </div>
+
+          </div>
+
+          <h2 class="divider line glow">Newsletter</h2>
+
+          <div class="container d-flex logistics">
+            <div class="col-8">
+              Sign up for the OPA newsletter!
+            </div>
+            <a href="https://eepurl.com/hSFrEP"
+              class="btn btn-primary btn-lg col-4" role="button">Go to Newsletter Sign-up</a>
+          </div>
+        </section>
+      </main>
+    </div>
+
+    <!-- jQuery first, then Popper.js, then Bootstrap JS -->
+    <script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"
+            integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"
+            crossorigin="anonymous"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js"
+            integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1"
+            crossorigin="anonymous"></script>
+    <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js"
+            integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM"
+            crossorigin="anonymous"></script>
+  </body>
+
+</html>
\ No newline at end of file
diff --git a/docs/website/static/css/community.css b/docs/website/static/css/community.css
new file mode 100644
index 0000000000..226a97ad5b
--- /dev/null
+++ b/docs/website/static/css/community.css
@@ -0,0 +1,219 @@
+.grid-container {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+    grid-gap: 1rem;
+    margin-left: 15%;
+    margin-right: 15%;
+    /* justify-items: center;  do NOT use for centering cards when squeezing; changes card sizes!  */
+    position: relative;
+    z-index: 900;
+}
+
+.card {
+    border-radius: 20px;
+    box-shadow: 2px 3px 6px rgba(51, 51, 51, 0.25);
+    max-width: 500px;
+    flex: 1 0 80px;
+}
+
+.card-text a {
+    text-decoration: none;
+}
+
+.card-img {
+    height: 4rem;
+    width: auto;
+}
+
+.support-bg {
+    width: 100%;
+    min-height: 100%;
+    background-color: #5687e5;
+    background-image: url("../img/cloudAll.png"), url("../img/homebg.png");
+    background-attachment: fixed, scroll;
+    background-position: right top;
+    background-repeat: no-repeat;
+    background-size: cover;
+}
+
+.support-content {
+    height: 100%;
+}
+
+#homebackground .banner-content,
+#homebackground .banner-subcontent {
+    padding-left: 15%;
+    padding-right: 15%;
+    text-align: left;
+    line-height: 1.3;
+}
+
+#homebackground .banner-subcontent {
+    color: black;
+}
+
+#homebackground .logistics {
+    font-size: 20px;
+    font-weight: 200px;
+    line-height: 24px;
+    padding: 0px 15px 30px 15px;
+}
+
+#homebackground .logistics:last-child {
+    padding: 0px 15px 90px 15px;
+}
+
+#homebackground .logistics .btn-primary {
+    padding: 10px;
+}
+
+.support-card-content {
+    height: 100%;
+    overflow: hidden;
+}
+
+.card-text {
+    padding-top: 10px;
+    padding-bottom: 10px;
+}
+
+.card-text .header {
+    font-size: 24px;
+    font-weight: 700;
+}
+
+.card-text .subheader {
+    margin-top: 0.5rem;
+    margin-bottom: 0.5rem;
+    line-height: 1.3;
+    font-size: 20px;
+}
+
+.card-text .subheader img {
+    width: 20px;
+    height: 20px;
+}
+
+.support-list {
+    margin-top: -40px;
+    z-index: 99;
+    position: relative;
+    font-size: 18px;
+    /* display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+    grid-gap: 1rem; */
+    display: flex;
+    flex-flow: row wrap;
+    padding: 0.5em;
+}
+
+.support-footer {
+    z-index: 99;
+    position: relative;
+}
+
+/* overrides for home.css */
+
+#homebackground {
+    width: 100%;
+    height: 100%;
+    margin-top: -65px;
+}
+
+.bg {
+    width: 100%;
+    height: 100%;
+    position: absolute;
+    top: 0;
+    overflow: hidden;
+    background-color: #5687e5;
+}
+
+.bg img {
+    width: 100%;
+    object-fit: cover;
+    margin-top: unset;
+}
+
+.cloud-top {
+    width: 100%;
+    height: 100%;
+    position: absolute;
+    top: 0;
+    overflow: hidden;
+}
+
+.cloud-top img {
+    width: 100%;
+    position: absolute;
+    top: 140px;
+    object-fit: cover;
+}
+
+/* import adapted from https://codepen.io/benknight/pen/zxxeay for "light saber" lines  */
+
+.divider {
+    display: flex;
+    gap: 1em;
+    z-index: 99;
+}
+
+.line {
+    align-items: center;
+    margin-left: 15%;
+    margin-right: 15%;
+    margin-top: 1.5em;
+    color: white;
+    font-weight: 700;
+    font-size: 28px;
+}
+
+.line:before,
+.line:after {
+    height: 1px;
+}
+
+.glow:before,
+.glow:after {
+    height: 8px;
+    filter: blur(1px);
+    border-radius: 5px;
+}
+
+.glow:before {
+    background: linear-gradient(to right, rgba(67, 58, 238, 0.721), #343a40d4);
+}
+
+.glow:after {
+    background: linear-gradient(to left, rgba(67, 58, 238, 0.721), #343a40d4);
+}
+
+/* END import */
+
+@media screen and (min-width: 576px) {
+    .grid-container {
+        grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+    }
+
+    .divider:before,
+    .divider:after {
+        content: "";
+        flex: 1;
+    }
+}
+
+@media screen and (min-width: 1200px) {
+    .grid-container {
+        grid-template-columns: repeat(auto-fill, minmax(400px, 1fr));
+    }
+}
+
+@media screen and (max-width: 767px) {
+    .bg img {
+        display: unset;
+    }
+
+    .cloud-top img {
+        display: none;
+    }
+}
\ No newline at end of file
diff --git a/docs/website/static/css/home.css b/docs/website/static/css/home.css
index 4588fc641e..a06a6e5b50 100644
--- a/docs/website/static/css/home.css
+++ b/docs/website/static/css/home.css
@@ -836,7 +836,7 @@ h4 {
 #footer {
     width: 100%;
     min-height: 100px;
-    background: #b7b7b7;
+    background: #47b3de;
     padding: 100px 0px;
 }
 
diff --git a/docs/website/static/css/security.css b/docs/website/static/css/security.css
new file mode 100644
index 0000000000..37c6085650
--- /dev/null
+++ b/docs/website/static/css/security.css
@@ -0,0 +1,37 @@
+ol {
+  list-style: roman;
+}
+
+ul {
+  list-style: square;
+}
+
+li {
+  padding-bottom: 0.5em;
+}
+
+section {
+  padding-bottom: 5%;
+}
+
+h1.banner-content{
+  color: #566366;
+}
+
+h2.line{
+  color: #566366;
+}
+
+.support-content{
+  background: rgba(255, 255, 255, 0.9);
+  border-radius: 2px;
+  display: inline-block;
+  margin: 5% 15% 5% 15%;
+  position: relative;
+  box-shadow: 0 1px 3px rgba(0,0,0,0.12), 0 1px 2px rgba(0,0,0,0.24);
+  transition: all 0.3s cubic-bezier(.25,.8,.25,1);
+}
+
+.banner-subcontent{
+  font-size: 20px;
+}
\ No newline at end of file
diff --git a/docs/website/static/css/support.css b/docs/website/static/css/support.css
index 1f10a2aec5..4445cb873b 100644
--- a/docs/website/static/css/support.css
+++ b/docs/website/static/css/support.css
@@ -147,4 +147,4 @@
     .bg img {
         margin-top: unset;
     }
-}
\ No newline at end of file
+}
diff --git a/docs/website/static/img/community-logos/blog.png b/docs/website/static/img/community-logos/blog.png
new file mode 100644
index 0000000000..3308ba436c
Binary files /dev/null and b/docs/website/static/img/community-logos/blog.png differ
diff --git a/docs/website/static/img/community-logos/cfp.png b/docs/website/static/img/community-logos/cfp.png
new file mode 100644
index 0000000000..ef1ce0bcc8
Binary files /dev/null and b/docs/website/static/img/community-logos/cfp.png differ
diff --git a/docs/website/static/img/community-logos/github-discussions.png b/docs/website/static/img/community-logos/github-discussions.png
new file mode 100644
index 0000000000..892bfc4969
Binary files /dev/null and b/docs/website/static/img/community-logos/github-discussions.png differ
diff --git a/docs/website/static/img/community-logos/github.png b/docs/website/static/img/community-logos/github.png
new file mode 100644
index 0000000000..9b9acce2ca
Binary files /dev/null and b/docs/website/static/img/community-logos/github.png differ
diff --git a/docs/website/static/img/community-logos/grant-shively.png b/docs/website/static/img/community-logos/grant-shively.png
new file mode 100644
index 0000000000..6f97f4ab3d
Binary files /dev/null and b/docs/website/static/img/community-logos/grant-shively.png differ
diff --git a/docs/website/static/img/community-logos/john-reese.png b/docs/website/static/img/community-logos/john-reese.png
new file mode 100644
index 0000000000..f70dd1050b
Binary files /dev/null and b/docs/website/static/img/community-logos/john-reese.png differ
diff --git a/docs/website/static/img/community-logos/linkedin.png b/docs/website/static/img/community-logos/linkedin.png
new file mode 100644
index 0000000000..39cf52cfce
Binary files /dev/null and b/docs/website/static/img/community-logos/linkedin.png differ
diff --git a/docs/website/static/img/community-logos/medium.png b/docs/website/static/img/community-logos/medium.png
new file mode 100644
index 0000000000..1aa8fca0ee
Binary files /dev/null and b/docs/website/static/img/community-logos/medium.png differ
diff --git a/docs/website/static/img/community-logos/meetup.png b/docs/website/static/img/community-logos/meetup.png
new file mode 100644
index 0000000000..244d82cdf6
Binary files /dev/null and b/docs/website/static/img/community-logos/meetup.png differ
diff --git a/docs/website/static/img/community-logos/mizutani-masayoshi.png b/docs/website/static/img/community-logos/mizutani-masayoshi.png
new file mode 100644
index 0000000000..1525945458
Binary files /dev/null and b/docs/website/static/img/community-logos/mizutani-masayoshi.png differ
diff --git a/docs/website/static/img/community-logos/petermacdonald.jpg b/docs/website/static/img/community-logos/petermacdonald.jpg
new file mode 100644
index 0000000000..428c5a2e60
Binary files /dev/null and b/docs/website/static/img/community-logos/petermacdonald.jpg differ
diff --git a/docs/website/static/img/community-logos/slack.png b/docs/website/static/img/community-logos/slack.png
new file mode 100644
index 0000000000..1ce9a79ef7
Binary files /dev/null and b/docs/website/static/img/community-logos/slack.png differ
diff --git a/docs/website/static/img/community-logos/stack-overflow.png b/docs/website/static/img/community-logos/stack-overflow.png
new file mode 100644
index 0000000000..27d2202e39
Binary files /dev/null and b/docs/website/static/img/community-logos/stack-overflow.png differ
diff --git a/docs/website/static/img/community-logos/twitter.png b/docs/website/static/img/community-logos/twitter.png
new file mode 100644
index 0000000000..8617275993
Binary files /dev/null and b/docs/website/static/img/community-logos/twitter.png differ
diff --git a/docs/website/static/img/logos/integrations/alfred.png b/docs/website/static/img/logos/integrations/alfred.png
new file mode 100644
index 0000000000..77dfd677c0
Binary files /dev/null and b/docs/website/static/img/logos/integrations/alfred.png differ
diff --git a/docs/website/static/img/logos/integrations/apache-apisix.png b/docs/website/static/img/logos/integrations/apache-apisix.png
new file mode 100644
index 0000000000..e932be36e5
Binary files /dev/null and b/docs/website/static/img/logos/integrations/apache-apisix.png differ
diff --git a/docs/website/static/img/logos/integrations/aserto.png b/docs/website/static/img/logos/integrations/aserto.png
new file mode 100644
index 0000000000..8545d5816e
Binary files /dev/null and b/docs/website/static/img/logos/integrations/aserto.png differ
diff --git a/docs/website/static/img/logos/integrations/aws-cloudformation-hook.svg b/docs/website/static/img/logos/integrations/aws-cloudformation-hook.svg
new file mode 100644
index 0000000000..c2271fc7a2
--- /dev/null
+++ b/docs/website/static/img/logos/integrations/aws-cloudformation-hook.svg
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="80px" height="80px" viewBox="0 0 80 80" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <!-- Generator: Sketch 64 (93537) - https://sketch.com -->
+    <title>Icon-Architecture/64/Arch_AWS-CloudFormation_64</title>
+    <desc>Created with Sketch.</desc>
+    <defs>
+        <linearGradient x1="0%" y1="100%" x2="100%" y2="0%" id="linearGradient-1">
+            <stop stop-color="#B0084D" offset="0%"></stop>
+            <stop stop-color="#FF4F8B" offset="100%"></stop>
+        </linearGradient>
+    </defs>
+    <g id="Icon-Architecture/64/Arch_AWS-CloudFormation_64" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
+        <g id="Icon-Architecture-BG/64/Management-Governance" fill="url(#linearGradient-1)">
+            <rect id="Rectangle" x="0" y="0" width="80" height="80"></rect>
+        </g>
+        <path d="M53,39.9632039 L58,39.9632039 L58,37.9601375 L53,37.9601375 L53,39.9632039 Z M28,51.9816019 L33,51.9816019 L33,49.9785356 L28,49.9785356 L28,51.9816019 Z M18,51.9816019 L25,51.9816019 L25,49.9785356 L18,49.9785356 L18,51.9816019 Z M18,45.9724029 L30,45.9724029 L30,43.9693366 L18,43.9693366 L18,45.9724029 Z M18,33.9540048 L27,33.9540048 L27,31.9509385 L18,31.9509385 L18,33.9540048 Z M18,39.9632039 L51,39.9632039 L51,37.9601375 L18,37.9601375 L18,39.9632039 Z M37,61.9969337 L14,61.9969337 L14,27.9448058 L37,27.9448058 L37,35.9570712 L39,35.9570712 L39,26.9432726 C39,26.3904263 38.552,25.9417395 38,25.9417395 L13,25.9417395 C12.447,25.9417395 12,26.3904263 12,26.9432726 L12,62.9984668 C12,63.5513131 12.447,64 13,64 L38,64 C38.552,64 39,63.5513131 39,62.9984668 L39,42.9678034 L37,42.9678034 L37,61.9969337 Z M68,36.9586044 C68,43.4305117 62.173,45.6819583 59.092,45.9683968 L43,45.9724029 L43,43.9693366 L59,43.9693366 C59.195,43.9463013 66,43.2121775 66,36.9586044 C66,31.2638867 60.863,30.1081175 59.834,29.9338507 C59.321,29.8467173 58.96,29.3820059 59.004,28.8632117 C59.005,28.8441826 59.007,28.826155 59.009,28.8081274 C58.954,25.5902013 56.981,24.584662 56.126,24.3002266 C54.53,23.769414 52.751,24.2771913 51.81,25.5391231 C51.591,25.8355769 51.229,25.9868085 50.861,25.9307226 C50.497,25.8756383 50.192,25.625255 50.068,25.2767214 C49.447,23.5360568 48.546,22.4083304 47.293,21.1534094 C44.159,18.0386412 39.905,17.1783242 35.925,18.8528877 C33.837,19.7332353 32.012,21.7282894 30.922,24.327268 L29.078,23.5500782 C30.37,20.4743699 32.584,18.0887179 35.15,17.007062 C39.905,15.0049972 44.971,16.0255595 48.704,19.7342369 C49.774,20.8068789 50.66,21.851478 51.35,23.2035478 C52.843,22.0978551 54.857,21.7673492 56.757,22.3993166 C59.189,23.2085554 60.727,25.3207889 60.975,28.1290879 C64.381,28.9884034 68,31.7115721 68,36.9586044 L68,36.9586044 Z" id="AWS-CloudFormation_Icon_64_Squid" fill="#FFFFFF"></path>
+    </g>
+</svg>
\ No newline at end of file
diff --git a/docs/website/static/img/logos/integrations/circleci.png b/docs/website/static/img/logos/integrations/circleci.png
new file mode 100644
index 0000000000..c6af3a0c20
Binary files /dev/null and b/docs/website/static/img/logos/integrations/circleci.png differ
diff --git a/docs/website/static/img/logos/integrations/cosign.png b/docs/website/static/img/logos/integrations/cosign.png
new file mode 100644
index 0000000000..0622fffc6f
Binary files /dev/null and b/docs/website/static/img/logos/integrations/cosign.png differ
diff --git a/docs/website/static/img/logos/integrations/dapr.png b/docs/website/static/img/logos/integrations/dapr.png
new file mode 100644
index 0000000000..80ae89f4dd
Binary files /dev/null and b/docs/website/static/img/logos/integrations/dapr.png differ
diff --git a/docs/website/static/img/logos/integrations/datadog.png b/docs/website/static/img/logos/integrations/datadog.png
new file mode 100644
index 0000000000..c66a593666
Binary files /dev/null and b/docs/website/static/img/logos/integrations/datadog.png differ
diff --git a/docs/website/static/img/logos/integrations/easegress.svg b/docs/website/static/img/logos/integrations/easegress.svg
new file mode 100644
index 0000000000..8593986331
--- /dev/null
+++ b/docs/website/static/img/logos/integrations/easegress.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" height="300" viewBox="0 0 300 300">
+  <defs>
+    <clipPath id="clip-easegress_7">
+      <rect width="300" height="300"/>
+    </clipPath>
+  </defs>
+  <g id="easegress_7" data-name="easegress – 7" clip-path="url(#clip-easegress_7)">
+    <path id="路径_1454" data-name="路径 1454" d="M0,29.825C0,16.282,2.419,4.7,5.84,0c3.42,4.7,5.84,16.282,5.84,29.825S9.26,54.949,5.84,59.65C2.419,54.949,0,43.368,0,29.825Z" transform="matrix(0.819, -0.574, 0.574, 0.819, 85.929, 155.606)" fill="#2f54eb" opacity="0.82"/>
+    <path id="路径_1455" data-name="路径 1455" d="M-2.946,75.395C-1.5,41.16,14.252,11.352,35.28-1.279,55.307,9.855,68.591,38.6,67.147,72.837s-17.2,64.043-38.226,76.675C8.895,138.379-4.39,109.631-2.946,75.395Z" transform="translate(213.825 44.647) rotate(47)" fill="#2f54eb" opacity="0.533"/>
+    <path id="路径_1452" data-name="路径 1452" d="M0,44.7C0,24.405,8.064,7.045,19.465,0,30.866,7.045,38.93,24.405,38.93,44.7s-8.064,37.66-19.465,44.705C8.064,82.364,0,65,0,44.7Z" transform="matrix(-0.225, 0.974, -0.974, -0.225, 216.126, 169.302)" fill="#39d1ff" opacity="0.449"/>
+    <path id="路径_1456" data-name="路径 1456" d="M-.264,72.865C1.065,40.273,17.963,11.875,40.708-.18,62.53,10.389,77.153,37.737,75.823,70.329S57.6,131.32,34.852,143.375C13.03,132.805-1.594,105.458-.264,72.865Z" transform="matrix(0.985, 0.174, -0.174, 0.985, 115.312, 20.809)" fill="#2f54eb" opacity="0.85"/>
+    <path id="路径_1457" data-name="路径 1457" d="M-.264,72.865C1.065,40.273,17.963,11.875,40.708-.18,62.53,10.389,77.153,37.737,75.823,70.329S57.6,131.32,34.852,143.375C13.03,132.805-1.594,105.458-.264,72.865Z" transform="matrix(0.985, 0.174, -0.174, 0.985, 115.312, 20.809)" fill="#4466ed"/>
+    <path id="路径_1458" data-name="路径 1458" d="M-2.946,75.395C-1.5,41.16,14.252,11.352,35.28-1.279,55.307,9.855,68.591,38.6,67.147,72.837s-17.2,64.043-38.226,76.675C8.895,138.379-4.39,109.631-2.946,75.395Z" transform="translate(213.825 44.647) rotate(47)" fill="#8da3ff"/>
+    <path id="路径_1459" data-name="路径 1459" d="M-679.632-1381.312c-5.3-22.195,6.677-51.32,32.561-73.494a118.689,118.689,0,0,1,23.33-15.649,100.393,100.393,0,0,1-2.235,23.071c-6.969,32.712-28.541,58.409-53.033,66.542Q-679.323-1381.075-679.632-1381.312Z" transform="translate(803.747 1548.718)" fill="#2f54eb" opacity="0.999"/>
+    <path id="路径_1453" data-name="路径 1453" d="M0,44.7C0,24.405,8.064,7.045,19.465,0,30.866,7.045,38.93,24.405,38.93,44.7s-8.064,37.66-19.465,44.705C8.064,82.364,0,65,0,44.7Z" transform="matrix(-0.225, 0.974, -0.974, -0.225, 216.126, 169.302)" fill="#39d1ff" opacity="0.449"/>
+    <path id="路径_1469" data-name="路径 1469" d="M3.92,0V-42H25.256l-.672,6.552H12.152v10.024H21l-.056,7.056H12.152V-6.552H25.7L25.032,0Zm31.7.728a5.79,5.79,0,0,1-3.64-1.26,8.191,8.191,0,0,1-2.52-3.416,12.515,12.515,0,0,1-.9-4.844q0-6.1,4.172-8.6a21.149,21.149,0,0,1,9.716-2.828,18.7,18.7,0,0,0-.392-4.48,1.793,1.793,0,0,0-1.9-1.456,2.208,2.208,0,0,0-1.96,1.008,5.678,5.678,0,0,0-.84,2.576L29.68-23.912q.56-4.312,3.528-6.16a12.865,12.865,0,0,1,6.944-1.848q5.1,0,7.644,2.688a9.758,9.758,0,0,1,2.548,7v16.3a20.6,20.6,0,0,0,.84,5.6L43.512.336l-.9-3.864A8.5,8.5,0,0,1,39.648-.5,7.484,7.484,0,0,1,35.616.728Zm3.64-5.6a2.727,2.727,0,0,0,1.6-.448,11.126,11.126,0,0,0,1.6-1.456v-8.736A6.444,6.444,0,0,0,37.968-14a6.024,6.024,0,0,0-1.68,4.7,5.948,5.948,0,0,0,.756,3.276A2.482,2.482,0,0,0,39.256-4.872ZM66.248.728a12.368,12.368,0,0,1-7.5-2.1,9.579,9.579,0,0,1-3.7-5.852l6.1-2.016a4.878,4.878,0,0,0,.84,1.9,4.286,4.286,0,0,0,3.752,1.848A6.157,6.157,0,0,0,68.432-6.1a2.009,2.009,0,0,0,1.288-1.9q0-1.736-2.408-2.688L60.7-13.384a8.554,8.554,0,0,1-4.032-3.36,10.16,10.16,0,0,1-1.4-5.488,9.043,9.043,0,0,1,1.484-5.208,9.589,9.589,0,0,1,3.92-3.332,12.128,12.128,0,0,1,5.236-1.148,11.213,11.213,0,0,1,6.5,2.044A9.84,9.84,0,0,1,76.384-24.3l-6.5,2.016a6.856,6.856,0,0,0-.784-1.9,3.643,3.643,0,0,0-3.136-1.9,4.377,4.377,0,0,0-2.408.644,2.09,2.09,0,0,0-1.008,1.876q0,1.456,2.744,2.688l5.6,2.3a12.671,12.671,0,0,1,4.648,3.528,8.967,8.967,0,0,1,1.68,5.712,9.461,9.461,0,0,1-1.568,5.516A9.838,9.838,0,0,1,71.568-.42,12.685,12.685,0,0,1,66.248.728Zm25.872,0a9.671,9.671,0,0,1-8.568-4.452q-2.968-4.452-2.968-11.844,0-7.5,3.024-11.928A9.985,9.985,0,0,1,92.4-31.92a9.449,9.449,0,0,1,8.4,4.424q2.912,4.424,2.912,11.928a.986.986,0,0,1-.168.644q-.168.2-.168.252H88.424a21.836,21.836,0,0,0,.952,6.636q.952,3,2.912,3,2.184,0,3.248-2.52t1.12-2.632l5.936,2.24A13.36,13.36,0,0,1,98.84-1.6,9.648,9.648,0,0,1,92.12.728Zm3.864-19.936a13.012,13.012,0,0,0-.9-5.32,2.943,2.943,0,0,0-2.8-1.96,2.567,2.567,0,0,0-1.848.952A7.036,7.036,0,0,0,88.984-22.9a11.63,11.63,0,0,0-.56,3.7ZM119.168,9.8q-6.272,0-9.744-1.764t-3.472-4.844A4.786,4.786,0,0,1,107.52-.42,11.565,11.565,0,0,1,111.5-2.8,8.2,8.2,0,0,1,108.3-4.368a3.49,3.49,0,0,1-1.064-2.744,5.914,5.914,0,0,1,1.512-3.948A11.879,11.879,0,0,1,112.728-14q-5.04-2.912-5.04-8.12a8.489,8.489,0,0,1,1.708-5.348A10.555,10.555,0,0,1,113.82-30.8a14.766,14.766,0,0,1,5.684-1.12,13.49,13.49,0,0,1,7.84,2.352,21.2,21.2,0,0,1,3.388-2.52,8.316,8.316,0,0,1,4.284-1.008v5.208a12.506,12.506,0,0,0-4.984.784,24.8,24.8,0,0,1,.924,2.744,8.988,8.988,0,0,1,.252,2.184,9.537,9.537,0,0,1-2.576,6.636q-2.576,2.828-8.4,2.828l-2.072-.056a11.419,11.419,0,0,0-1.232-.056,3.162,3.162,0,0,0-1.4.98,2.375,2.375,0,0,0-.672,1.6,1.833,1.833,0,0,0,.56,1.344,2.361,2.361,0,0,0,1.4.672l8.96,1.008q7.784.9,7.784,7.56,0,5.208-4,7.336A22.089,22.089,0,0,1,119.168,9.8Zm.224-26.992a3.123,3.123,0,0,0,2.688-1.316,6.275,6.275,0,0,0,.952-3.724,5.744,5.744,0,0,0-1.008-3.7,3.182,3.182,0,0,0-2.576-1.232,3.2,3.2,0,0,0-2.744,1.4,5.787,5.787,0,0,0-1.008,3.472,7.4,7.4,0,0,0,.84,3.5A2.964,2.964,0,0,0,119.392-17.192Zm.112,21.28q6.384,0,6.384-3.472a1.781,1.781,0,0,0-.5-1.4,3.267,3.267,0,0,0-1.6-.644q-1.092-.2-3.556-.364l-4.648-.392a3.813,3.813,0,0,0-1.736,1.2A2.933,2.933,0,0,0,113.12.952a2.529,2.529,0,0,0,1.6,2.324A10.945,10.945,0,0,0,119.5,4.088Zm18.76-34.944,7.84-.672v5.1a13.392,13.392,0,0,1,4.172-3.892,12.274,12.274,0,0,1,6.356-1.484v7.672a26.59,26.59,0,0,0-5.292.7A11.3,11.3,0,0,0,146.1-21V-.336l-7.84.672ZM170.912.728a9.671,9.671,0,0,1-8.568-4.452q-2.968-4.452-2.968-11.844,0-7.5,3.024-11.928a9.985,9.985,0,0,1,8.792-4.424,9.449,9.449,0,0,1,8.4,4.424q2.912,4.424,2.912,11.928a.986.986,0,0,1-.168.644q-.168.2-.168.252H167.216a21.836,21.836,0,0,0,.952,6.636q.952,3,2.912,3,2.184,0,3.248-2.52t1.12-2.632l5.936,2.24A13.36,13.36,0,0,1,177.632-1.6,9.648,9.648,0,0,1,170.912.728Zm3.864-19.936a13.012,13.012,0,0,0-.9-5.32,2.944,2.944,0,0,0-2.8-1.96,2.567,2.567,0,0,0-1.848.952,7.036,7.036,0,0,0-1.456,2.632,11.63,11.63,0,0,0-.56,3.7ZM196.672.728a12.368,12.368,0,0,1-7.5-2.1,9.579,9.579,0,0,1-3.7-5.852l6.1-2.016a4.878,4.878,0,0,0,.84,1.9,4.286,4.286,0,0,0,3.752,1.848,6.157,6.157,0,0,0,2.688-.616,2.009,2.009,0,0,0,1.288-1.9q0-1.736-2.408-2.688l-6.608-2.688a8.554,8.554,0,0,1-4.032-3.36,10.16,10.16,0,0,1-1.4-5.488,9.043,9.043,0,0,1,1.484-5.208,9.589,9.589,0,0,1,3.92-3.332,12.128,12.128,0,0,1,5.236-1.148,11.213,11.213,0,0,1,6.5,2.044,9.84,9.84,0,0,1,3.976,5.572l-6.5,2.016a6.856,6.856,0,0,0-.784-1.9,3.643,3.643,0,0,0-3.136-1.9,4.377,4.377,0,0,0-2.408.644,2.09,2.09,0,0,0-1.008,1.876q0,1.456,2.744,2.688l5.6,2.3a12.671,12.671,0,0,1,4.648,3.528,8.967,8.967,0,0,1,1.68,5.712,9.461,9.461,0,0,1-1.568,5.516A9.838,9.838,0,0,1,201.992-.42,12.685,12.685,0,0,1,196.672.728Zm25.256,0a12.368,12.368,0,0,1-7.5-2.1,9.579,9.579,0,0,1-3.7-5.852l6.1-2.016a4.878,4.878,0,0,0,.84,1.9,4.286,4.286,0,0,0,3.752,1.848,6.157,6.157,0,0,0,2.688-.616,2.009,2.009,0,0,0,1.288-1.9q0-1.736-2.408-2.688l-6.608-2.688a8.554,8.554,0,0,1-4.032-3.36,10.16,10.16,0,0,1-1.4-5.488,9.043,9.043,0,0,1,1.484-5.208,9.589,9.589,0,0,1,3.92-3.332,12.128,12.128,0,0,1,5.236-1.148,11.213,11.213,0,0,1,6.5,2.044,9.84,9.84,0,0,1,3.976,5.572l-6.5,2.016a6.856,6.856,0,0,0-.784-1.9,3.643,3.643,0,0,0-3.136-1.9,4.377,4.377,0,0,0-2.408.644,2.09,2.09,0,0,0-1.008,1.876q0,1.456,2.744,2.688l5.6,2.3a12.671,12.671,0,0,1,4.648,3.528,8.967,8.967,0,0,1,1.68,5.712,9.461,9.461,0,0,1-1.568,5.516A9.838,9.838,0,0,1,227.248-.42,12.685,12.685,0,0,1,221.928.728Z" transform="translate(31.588 266)" fill="#2f54eb"/>
+  </g>
+</svg>
diff --git a/docs/website/static/img/logos/integrations/emissary-ingress.png b/docs/website/static/img/logos/integrations/emissary-ingress.png
new file mode 100644
index 0000000000..427d97c940
Binary files /dev/null and b/docs/website/static/img/logos/integrations/emissary-ingress.png differ
diff --git a/docs/website/static/img/logos/integrations/fiber.png b/docs/website/static/img/logos/integrations/fiber.png
new file mode 100644
index 0000000000..f2ee7cc823
Binary files /dev/null and b/docs/website/static/img/logos/integrations/fiber.png differ
diff --git a/docs/website/static/img/logos/integrations/fig.png b/docs/website/static/img/logos/integrations/fig.png
new file mode 100644
index 0000000000..4b60d62432
Binary files /dev/null and b/docs/website/static/img/logos/integrations/fig.png differ
diff --git a/docs/website/static/img/logos/integrations/google-kubernetes-engine.png b/docs/website/static/img/logos/integrations/google-kubernetes-engine.png
new file mode 100644
index 0000000000..a585378ca8
Binary files /dev/null and b/docs/website/static/img/logos/integrations/google-kubernetes-engine.png differ
diff --git a/docs/website/static/img/logos/integrations/graphene-graphql.png b/docs/website/static/img/logos/integrations/graphene-graphql.png
new file mode 100644
index 0000000000..b494d5b0e5
Binary files /dev/null and b/docs/website/static/img/logos/integrations/graphene-graphql.png differ
diff --git a/docs/website/static/img/logos/integrations/graphql.png b/docs/website/static/img/logos/integrations/graphql.png
new file mode 100644
index 0000000000..b494d5b0e5
Binary files /dev/null and b/docs/website/static/img/logos/integrations/graphql.png differ
diff --git a/docs/website/static/img/logos/integrations/i2scim.png b/docs/website/static/img/logos/integrations/i2scim.png
new file mode 100644
index 0000000000..2ca5927719
Binary files /dev/null and b/docs/website/static/img/logos/integrations/i2scim.png differ
diff --git a/docs/website/static/img/logos/integrations/kubescape.png b/docs/website/static/img/logos/integrations/kubescape.png
new file mode 100755
index 0000000000..75b7d4c6df
Binary files /dev/null and b/docs/website/static/img/logos/integrations/kubescape.png differ
diff --git a/docs/website/static/img/logos/integrations/magda.png b/docs/website/static/img/logos/integrations/magda.png
new file mode 100644
index 0000000000..7b6bfd20d2
Binary files /dev/null and b/docs/website/static/img/logos/integrations/magda.png differ
diff --git a/docs/website/static/img/logos/integrations/nginx.png b/docs/website/static/img/logos/integrations/nginx.png
new file mode 100644
index 0000000000..9d6013ff89
Binary files /dev/null and b/docs/website/static/img/logos/integrations/nginx.png differ
diff --git a/docs/website/static/img/logos/integrations/oauth2.svg b/docs/website/static/img/logos/integrations/oauth2.svg
new file mode 100644
index 0000000000..78bd0f1aa2
--- /dev/null
+++ b/docs/website/static/img/logos/integrations/oauth2.svg
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="630px" height="630px" viewBox="-15.757 -15.08 630 630" enable-background="new -15.757 -15.08 630 630" xml:space="preserve">
+<path fill="#FFFFFF" d="M280.009,34.621C398.5,26.405,477.065,84.389,521.987,155.037c22.525,35.422,44.625,89.222,44.727,144.5  c0.109,60.06-19.348,112.071-44.727,150.233c-26.082,39.224-59.82,71.62-102.066,92.893c-70.617,35.56-169.309,36.531-233.951,2.294  C113.979,506.827,58.627,452.404,38.03,358.023c-8.243-37.77-9.19-86.572,2.293-128.443c2.695-9.822,7.592-20.159,11.469-29.817  c18.629-46.412,50.338-86.77,89.452-114.683c15.717-11.216,34.785-22.371,51.607-29.817  C213.783,45.999,249.024,36.769,280.009,34.621z"/>
+<path d="M504.77,306.215c0,111.986-90.781,202.763-202.766,202.763c-111.985,0-202.766-90.776-202.766-202.763  c0-111.984,90.781-202.768,202.766-202.768C413.987,103.447,504.77,194.231,504.77,306.215z"/>
+<path d="M280.711,34.621c118.491-8.216,197.056,49.769,241.978,120.416c22.525,35.422,44.625,89.222,44.727,144.5  c0.109,60.06-19.348,112.071-44.727,150.233c-26.082,39.224-59.82,71.62-102.066,92.893c-70.617,35.56-169.309,36.531-233.951,2.294  c-71.991-38.129-127.342-92.552-147.939-186.933c-8.243-37.77-9.19-86.572,2.293-128.443c2.695-9.822,7.592-20.159,11.469-29.817  c18.629-46.412,50.338-86.77,89.452-114.683c15.717-11.216,34.785-22.371,51.607-29.817  C214.485,45.999,249.727,36.769,280.711,34.621z M240.572,54.117c-44.011,11.411-76.281,31.853-104.36,53.9  c-40.489,31.792-66.301,76.157-81.424,129.59c-16.824,59.447-6.017,131.384,17.203,176.61  c24.079,46.901,56.41,83.308,102.066,108.948c44.419,24.945,106.894,40.962,172.025,28.67  c57.865-10.92,101.814-36.129,137.617-73.396c47.902-49.862,86.402-141.702,60.783-238.538c-6.85-25.881-15.803-52.855-29.818-75.69  c-7.572-12.336-18.686-24.473-29.818-36.698c-42.014-46.141-109.922-85.901-197.253-80.278  C270.972,48.305,256.366,50.021,240.572,54.117z"/>
+<g id="hashpattern">
+	<g>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="314.266" y1="549.395" x2="548.573" y2="315.094"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="293.782" y1="530.839" x2="529.11" y2="295.515"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="273.298" y1="512.286" x2="509.651" y2="275.938"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="252.814" y1="493.729" x2="490.188" y2="256.36"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="232.332" y1="475.175" x2="470.729" y2="236.781"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="211.848" y1="456.624" x2="451.266" y2="217.204"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="191.364" y1="438.064" x2="431.805" y2="197.626"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="170.88" y1="419.51" x2="412.344" y2="178.048"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="150.396" y1="400.955" x2="392.877" y2="158.47"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="129.913" y1="382.398" x2="373.422" y2="138.893"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="109.429" y1="363.845" x2="353.959" y2="119.315"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="88.945" y1="345.289" x2="334.5" y2="99.737"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="68.461" y1="326.734" x2="315.038" y2="80.159"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="47.977" y1="308.179" x2="295.577" y2="60.582"/>
+	</g>
+	<g>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="47.897" y1="310.547" x2="286.886" y2="549.547"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="67.279" y1="290.89" x2="306.733" y2="530.354"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="86.66" y1="271.231" x2="326.579" y2="511.16"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="106.041" y1="251.573" x2="346.424" y2="491.968"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="125.42" y1="231.916" x2="366.27" y2="472.774"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="144.801" y1="212.257" x2="386.118" y2="453.581"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="164.182" y1="192.6" x2="405.963" y2="434.388"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="183.563" y1="172.941" x2="425.809" y2="415.193"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="202.943" y1="153.283" x2="445.655" y2="396"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="222.324" y1="133.625" x2="465.5" y2="376.805"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="241.705" y1="113.967" x2="485.346" y2="357.613"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="261.085" y1="94.31" x2="505.192" y2="338.42"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="280.466" y1="74.652" x2="525.038" y2="319.228"/>
+		<line fill="none" stroke="#FFFFFF" stroke-width="2" x1="299.848" y1="54.994" x2="544.883" y2="300.033"/>
+	</g>
+</g>
+<path d="M470.381,128.66c-21.088-21.088-47.014-40.091-77.984-51.607c-32.1-11.937-68.414-21.999-111.241-18.35  c-68.222,5.815-116.123,36.425-152.527,72.25c-25.5,25.093-44.68,55.841-57.341,91.746c-18.59,52.719-17.461,114.945,3.44,168.583  c17.83,45.753,47.011,82.655,88.305,111.241c38.82,26.875,94.536,47.719,157.114,42.434c76.219-6.438,131.986-45.541,168.582-90.599  c9.363-11.527,18.674-24.557,24.082-40.139c5.301-11.228,7.895-18.859,10.322-22.937c10.164-22.776,15.551-46.808,17.201-73.396  C545.417,236.108,513.952,172.231,470.381,128.66z M447.918,377.813c-0.145,0.312-0.275,0.602-0.428,0.922  c-3.781,10.82-10.295,19.867-16.84,27.873c-25.596,31.287-64.592,58.439-117.893,62.911c-43.763,3.668-82.726-10.804-109.873-29.466  c-23.59-16.217-41.522-36.29-54.096-60.414c-0.767-1.452-8.069-18.276-8.091-19.017c-9.962-30.899-10.826-80.583-0.602-110.399  c6.823-19.899,18.196-41.43,33.257-58.488c20.796-23.553,41.607-38.646,74.544-49.313c15.039-4.871,28.501-9.829,47.019-10.321  c45.155-1.202,91.14,19.072,115.829,41.285c22.689,20.412,48.547,60.174,55.049,97.479  C472.485,309.262,465.344,346.75,447.918,377.813z"/>
+<g id="OAUTH">
+	<g>
+		<path fill="#FFFFFF" d="M164.058,144.994l-0.065-0.088c-6.521-8.938-4.607-21.44,4.997-28.45    c9.604-7.009,21.942-5.042,28.463,3.895l0.065,0.088c6.521,8.938,4.608,21.441-4.997,28.45    C182.917,155.898,170.58,153.932,164.058,144.994z M188.779,126.954l-0.065-0.089c-3.277-4.49-9.378-6.035-14.135-2.563    c-4.713,3.439-5.08,9.567-1.803,14.058l0.065,0.089c3.278,4.49,9.378,6.035,14.091,2.596    C191.69,137.573,192.056,131.445,188.779,126.954z"/>
+		<path fill="#FFFFFF" d="M226.933,86.415l9.801-3.145l27.476,31.94l-10.902,3.498l-4.775-5.694l-14.152,4.541l-0.518,7.393    l-10.692,3.43L226.933,86.415z M243.058,106.042l-7.435-9.119l-0.794,11.759L243.058,106.042z"/>
+		<path fill="#FFFFFF" d="M281.859,96.024l0.086-21.633l10.844,0.043l-0.085,21.413c-0.022,5.56,2.775,8.213,7.069,8.23    c4.294,0.017,7.11-2.503,7.132-7.898l0.086-21.688l10.844,0.043l-0.084,21.358c-0.049,12.44-7.172,17.862-18.126,17.818    C288.67,113.666,281.812,108.079,281.859,96.024z"/>
+		<path fill="#FFFFFF" d="M356.999,92.244l-11.055-3.374l2.73-8.95l32.324,9.865l-2.73,8.95l-11.057-3.374l-8.516,27.902    l-10.213-3.117L356.999,92.244z"/>
+		<path fill="#FFFFFF" d="M409.872,102.273l8.889,5.916l-7.988,12.006l11.41,7.594l7.99-12.007l8.891,5.917l-21.348,32.079    l-8.891-5.917l8.111-12.19l-11.41-7.594l-8.111,12.19l-8.891-5.917L409.872,102.273z"/>
+	</g>
+	<g>
+		<path fill="#FFFFFF" d="M441.276,452.944l0.066,0.087c6.859,8.682,5.424,21.251-3.906,28.621    c-9.328,7.371-21.734,5.876-28.594-2.806l-0.066-0.087c-6.859-8.683-5.424-21.251,3.906-28.621    C422.01,442.77,434.417,444.263,441.276,452.944z M417.258,471.918l0.068,0.087c3.447,4.362,9.602,5.673,14.225,2.021    c4.578-3.617,4.711-9.755,1.264-14.117l-0.068-0.087c-3.445-4.362-9.602-5.673-14.18-2.056    C413.944,461.418,413.813,467.555,417.258,471.918z"/>
+		<path fill="#FFFFFF" d="M380.997,513.992l-9.654,3.572l-28.854-30.699l10.736-3.975l5.021,5.479l13.939-5.159l0.191-7.407    l10.531-3.898L380.997,513.992z M364.024,495.095l7.828,8.782l0.275-11.783L364.024,495.095z"/>
+		<path fill="#FFFFFF" d="M325.741,506.665l0.953,21.612l-10.834,0.479l-0.943-21.393c-0.246-5.554-3.166-8.069-7.455-7.88    c-4.291,0.189-6.983,2.844-6.746,8.232l0.957,21.666l-10.833,0.479l-0.942-21.337c-0.549-12.428,6.305-18.186,17.248-18.668    C318.088,489.371,325.208,494.622,325.741,506.665z"/>
+		<path fill="#FFFFFF" d="M250.465,513.732l11.161,3.013l-2.439,9.035l-32.635-8.809l2.439-9.036l11.161,3.013l7.604-28.17    l10.311,2.784L250.465,513.732z"/>
+		<path fill="#FFFFFF" d="M197.71,505.882l-9.161-5.49l7.415-12.371l-11.757-7.048l-7.414,12.372l-9.16-5.49l19.811-33.053    l9.16,5.491l-7.528,12.56l11.757,7.047l7.528-12.56l9.16,5.49L197.71,505.882z"/>
+	</g>
+</g>
+<g>
+	<path fill="#FFFFFF" stroke="#000000" stroke-width="8" d="M220.728,407.841v-32.384l29.568-26.753   c49.984-44.704,74.273-70.401,74.978-97.153c0-18.656-11.265-33.44-37.665-33.44c-19.712,0-36.96,9.856-48.929,19.008   l-15.136-38.368c17.248-13.024,44-23.584,74.977-23.584c51.745,0,80.257,30.272,80.257,71.809   c0,38.369-27.808,68.992-60.896,98.562l-21.12,17.601v0.703h86.241v44.001H220.728z"/>
+</g>
+</svg>
\ No newline at end of file
diff --git a/docs/website/static/img/logos/integrations/oidc.png b/docs/website/static/img/logos/integrations/oidc.png
new file mode 100644
index 0000000000..af033cd1fe
Binary files /dev/null and b/docs/website/static/img/logos/integrations/oidc.png differ
diff --git a/docs/website/static/img/logos/integrations/open-policy-registry.svg b/docs/website/static/img/logos/integrations/open-policy-registry.svg
new file mode 100644
index 0000000000..7a5692820d
--- /dev/null
+++ b/docs/website/static/img/logos/integrations/open-policy-registry.svg
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="200" height="200" viewBox="0 0 200 200">
+  <defs>
+    <linearGradient id="linear-gradient" x1="0.5" x2="0.5" y2="1" gradientUnits="objectBoundingBox">
+      <stop offset="0" stop-color="#70d0d3"/>
+      <stop offset="1" stop-color="#057b80"/>
+    </linearGradient>
+    <clipPath id="clip-Lottie-200">
+      <rect width="200" height="200"/>
+    </clipPath>
+  </defs>
+  <g id="Lottie-200" clip-path="url(#clip-Lottie-200)">
+    <rect width="200" height="200" fill="rgba(18,18,18,0)"/>
+    <g id="Lottie-200x200" transform="translate(0 0.086)">
+      <path id="Path_8" data-name="Path 8" d="M136.211,110.489c-4.834,5.19-14.265,4.687-20.471-.681s-7.461-13.067-3.285-17.561c2.192-2.2,14.247-13.16,23.474-25.719,9.743-12.158,16.658-25.91,20.518-24.416,3.765,1.273,3.776,18.707-1.929,34.769C149.475,93.2,138.715,108.155,136.211,110.489Z" fill="#1f5355"/>
+      <path id="Path_9" data-name="Path 9" d="M124.84,87.571c4.838-1.6,30.065-13.413,30.691-13.752q-.473,1.534-1.014,3.061c-5.044,16.323-15.8,31.275-18.308,33.608-4.834,5.19-14.265,4.687-20.471-.681a17.085,17.085,0,0,1-4.884-6.764C111.091,101.884,111.5,91.975,124.84,87.571Z" fill="#23696c"/>
+      <path id="Path_10" data-name="Path 10" d="M140.735,124.172c-6.525,2.779-14.939-1.51-18.43-8.936s-1.51-14.971,4.13-17.382c2.9-1.116,18.364-6.239,31.9-13.969C172.173,76.733,184.078,66.974,187,69.907c2.924,2.693-4.146,18.628-15.883,30.99C159.876,113.763,143.972,123.057,140.735,124.172Z" fill="#277f82"/>
+      <path id="Path_11" data-name="Path 11" d="M169.138,87.658c-.727,2.059-1.547,4.126-2.465,6.161-6.37,15.852-18.324,29.868-21.013,31.987-5.244,4.775-14.6,3.5-20.345-2.363s-6.359-13.638-1.828-17.773C123.937,105.288,166.74,88.82,169.138,87.658Z" fill="#2f989c"/>
+      <path id="Path_12" data-name="Path 12" d="M135.564,136.491c-7.091-.109-13.039-7.444-13.216-15.647-.18-8.221,4.7-14.295,10.829-14.21,3.1.155,19.316,1.752,34.82.18,15.553-.919,30.394-5.006,31.872-1.14,1.579,3.647-11.35,15.342-27.093,21.875C157.284,134.747,138.975,136.785,135.564,136.491Z" fill="#36b1b5"/>
+      <path id="Path_13" data-name="Path 13" d="M63.791,110.489c4.834,5.19,14.265,4.687,20.471-.681s7.461-13.067,3.285-17.561c-2.192-2.2-14.247-13.16-23.474-25.719C54.33,54.37,47.415,40.618,43.555,42.112c-3.765,1.273-3.777,18.707,1.928,34.769C50.527,93.2,61.287,108.155,63.791,110.489Z" fill="#1f5355"/>
+      <path id="Path_14" data-name="Path 14" d="M75.159,87.571c-4.838-1.6-30.065-13.413-30.691-13.752q.473,1.534,1.014,3.061c5.043,16.323,15.8,31.275,18.308,33.608,4.834,5.19,14.265,4.687,20.471-.681a17.087,17.087,0,0,0,4.885-6.764C88.908,101.884,88.5,91.975,75.159,87.571Z" fill="#23696c"/>
+      <path id="Path_15" data-name="Path 15" d="M59.266,124.172c6.525,2.779,14.939-1.51,18.43-8.936s1.51-14.971-4.13-17.382c-2.895-1.116-18.364-6.239-31.9-13.969C27.828,76.733,15.923,66.974,13,69.907,10.08,72.6,17.15,88.535,28.887,100.9,40.125,113.763,56.03,123.057,59.266,124.172Z" fill="#277f82"/>
+      <path id="Path_16" data-name="Path 16" d="M30.4,87.658c.727,2.059,1.547,4.126,2.465,6.161,6.37,15.852,18.325,29.867,21.013,31.987,5.245,4.774,14.6,3.5,20.345-2.364s6.359-13.638,1.828-17.773C75.6,105.288,32.8,88.821,30.4,87.658Z" fill="#2f989c"/>
+      <path id="Path_17" data-name="Path 17" d="M64.436,136.491c7.091-.109,13.04-7.444,13.217-15.647.18-8.221-4.7-14.295-10.83-14.21-3.1.155-19.316,1.752-34.82.18-15.554-.919-30.394-5.006-31.873-1.14-1.579,3.647,11.35,15.342,27.093,21.875C42.718,134.747,61.026,136.785,64.436,136.491Z" fill="#36b1b5"/>
+      <path id="Path_18" data-name="Path 18" d="M149.876,126.633c0,27.546-22.33,31.195-49.876,31.195s-49.876-3.649-49.876-31.195,22.33-53.4,49.876-53.4S149.876,99.088,149.876,126.633Z" fill="url(#linear-gradient)"/>
+      <path id="Path_19" data-name="Path 19" d="M90.461,86.649a29.543,29.543,0,0,0-11.1,6.777,3.061,3.061,0,0,1-4.274-4.384,35.633,35.633,0,0,1,13.381-8.181,3.059,3.059,0,0,1,3.892,1.9C93.1,84.908,90.9,86.5,90.461,86.649Z" fill="#aaf9fc"/>
+      <path id="Path_20" data-name="Path 20" d="M68.979,120.279a5.639,5.639,0,1,0-5.639-5.639A5.639,5.639,0,0,0,68.979,120.279Z" fill="#121212"/>
+      <path id="Path_21" data-name="Path 21" d="M131.722,120.279a5.639,5.639,0,1,0-5.639-5.639A5.639,5.639,0,0,0,131.722,120.279Z" fill="#121212"/>
+      <path id="Path_22" data-name="Path 22" d="M99.449,137.723a32.961,32.961,0,0,0,10.657-1.664,31.061,31.061,0,0,0,9.083-4.9l2.024,2.968a34.85,34.85,0,0,1-9.848,5.621A32.485,32.485,0,0,1,99.449,141.9a32.842,32.842,0,0,1-11.961-2.158,35.008,35.008,0,0,1-9.8-5.621l2.023-2.968a31.067,31.067,0,0,0,9.083,4.9A32.964,32.964,0,0,0,99.449,137.723Z" fill="#121212"/>
+    </g>
+  </g>
+</svg>
diff --git a/docs/website/static/img/logos/integrations/open-service-mesh.png b/docs/website/static/img/logos/integrations/open-service-mesh.png
new file mode 100644
index 0000000000..9d9e306617
Binary files /dev/null and b/docs/website/static/img/logos/integrations/open-service-mesh.png differ
diff --git a/docs/website/static/img/logos/integrations/optoggles.png b/docs/website/static/img/logos/integrations/optoggles.png
new file mode 100644
index 0000000000..fbaefcac17
Binary files /dev/null and b/docs/website/static/img/logos/integrations/optoggles.png differ
diff --git a/docs/website/static/img/logos/integrations/permit.png b/docs/website/static/img/logos/integrations/permit.png
new file mode 100644
index 0000000000..b2babb5f61
Binary files /dev/null and b/docs/website/static/img/logos/integrations/permit.png differ
diff --git a/docs/website/static/img/logos/integrations/pulumi.png b/docs/website/static/img/logos/integrations/pulumi.png
new file mode 100644
index 0000000000..9490e000d2
Binary files /dev/null and b/docs/website/static/img/logos/integrations/pulumi.png differ
diff --git a/docs/website/static/img/logos/integrations/rekor.svg b/docs/website/static/img/logos/integrations/rekor.svg
new file mode 100644
index 0000000000..ee92c8c4a8
--- /dev/null
+++ b/docs/website/static/img/logos/integrations/rekor.svg
@@ -0,0 +1,464 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Generator: Adobe Illustrator 19.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+
+<svg
+   version="1.1"
+   id="Layer_1"
+   x="0px"
+   y="0px"
+   viewBox="-237 286.5 123.61956 40.018262"
+   xml:space="preserve"
+   sodipodi:docname="rekor-logo.svg"
+   width="123.61956"
+   height="40.018261"
+   inkscape:version="1.1.1 (3bf5ae0d25, 2021-09-20)"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg"><defs
+   id="defs366"><marker
+     style="overflow:visible"
+     id="Arrow1Lstart"
+     refX="0"
+     refY="0"
+     orient="auto"
+     inkscape:stockid="Arrow1Lstart"
+     inkscape:isstock="true"><path
+       transform="matrix(0.8,0,0,0.8,10,0)"
+       style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
+       d="M 0,0 5,-5 -12.5,0 5,5 Z"
+       id="path2511" /></marker></defs><sodipodi:namedview
+   id="namedview364"
+   pagecolor="#505050"
+   bordercolor="#eeeeee"
+   borderopacity="1"
+   inkscape:pageshadow="0"
+   inkscape:pageopacity="0"
+   inkscape:pagecheckerboard="0"
+   showgrid="false"
+   fit-margin-top="0"
+   fit-margin-left="0"
+   fit-margin-right="0"
+   fit-margin-bottom="0"
+   inkscape:zoom="7.1006656"
+   inkscape:cx="52.600703"
+   inkscape:cy="43.657879"
+   inkscape:window-width="1920"
+   inkscape:window-height="1011"
+   inkscape:window-x="0"
+   inkscape:window-y="0"
+   inkscape:window-maximized="1"
+   inkscape:current-layer="Layer_1" />
+<style
+   type="text/css"
+   id="style273">
+	.st0{display:none;}
+	.st1{display:inline;fill:#444444;}
+	.st2{display:inline;}
+	.st3{fill:#444444;}
+</style>
+<g
+   id="Layer_1_1_"
+   class="st0"
+   transform="translate(-9.1035767,19.559967)">
+	<path
+   class="st1"
+   d="m -519.1,676.3 c 2.7,0 4.4,-1.3 4.4,-3.5 0,-1.7 -1,-2.7 -3,-3.1 l -1.8,-0.4 c -1,-0.2 -1.5,-0.6 -1.5,-1.2 0,-0.7 0.7,-1.1 1.7,-1.1 0.8,0 1.6,0.3 2.2,0.9 0.5,0.4 0.8,0.7 1.2,0.7 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.6 -0.4,-1.2 -1,-1.7 -0.8,-0.6 -2,-1 -3.4,-1 -2.6,0 -4.2,1.2 -4.2,3.3 0,1.6 1.1,2.7 3.2,3.1 l 1.7,0.3 c 0.9,0.2 1.4,0.6 1.4,1.3 0,0.8 -0.7,1.2 -1.8,1.2 -1.1,0 -1.9,-0.3 -2.7,-1.2 -0.5,-0.5 -0.8,-0.7 -1.2,-0.7 -0.6,0 -1,0.4 -1,1 0,0.5 0.3,1.1 0.8,1.6 1,0.9 2.5,1.4 4.1,1.4 z"
+   id="path275" />
+	<path
+   class="st1"
+   d="m -510.2,676.2 c 0.7,0 1.2,-0.5 1.2,-1.2 v -8.7 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 z m -1.5,-13.9 c 0,0.8 0.6,1.5 1.5,1.5 0.9,0 1.5,-0.6 1.5,-1.5 0,-0.8 -0.6,-1.5 -1.5,-1.5 -0.8,0 -1.5,0.6 -1.5,1.5 z"
+   id="path277" />
+	<path
+   class="st1"
+   d="m -500.7,678.6 c 3.6,0 5.6,-1.2 5.6,-3.2 0,-1.7 -1.2,-2.6 -3.5,-2.6 h -3.4 c -0.6,0 -1,-0.3 -1,-0.7 0,-0.2 0.1,-0.4 0.3,-0.6 0.6,0.2 1.3,0.3 2.2,0.3 2.8,0 4.6,-1.3 4.6,-3.4 0,-0.6 -0.1,-1.1 -0.4,-1.6 l 0.8,-0.7 c 0.3,-0.3 0.5,-0.6 0.5,-1 0,-0.4 -0.4,-0.9 -0.9,-0.9 -0.3,0 -0.6,0.1 -0.9,0.4 l -1,0.8 c -0.7,-0.3 -1.6,-0.5 -2.7,-0.5 -2.8,0 -4.6,1.3 -4.6,3.4 0,0.9 0.4,1.7 1,2.3 -0.8,0.5 -1.1,1 -1.1,1.8 0,0.7 0.3,1.2 0.8,1.6 -0.8,0.4 -1.3,1 -1.3,1.9 0,1.8 1.8,2.7 5,2.7 z m -2.6,-3 c 0,-0.4 0.2,-0.7 0.5,-1 0.1,0 0.3,0 0.4,0 h 3.3 c 1,0 1.5,0.3 1.5,0.9 0,0.8 -1,1.2 -3,1.2 -1.8,0.1 -2.7,-0.3 -2.7,-1.1 z m 0.6,-7.2 c 0,-1 0.8,-1.7 2.2,-1.7 1.3,0 2.2,0.6 2.2,1.7 0,1 -0.8,1.7 -2.2,1.7 -1.3,-0.1 -2.2,-0.7 -2.2,-1.7 z"
+   id="path279" />
+	<path
+   class="st1"
+   d="m -487.7,676.3 c 2.7,0 4.4,-1.3 4.4,-3.5 0,-1.7 -1,-2.7 -3,-3.1 l -1.8,-0.4 c -1,-0.2 -1.5,-0.6 -1.5,-1.2 0,-0.7 0.7,-1.1 1.7,-1.1 0.8,0 1.6,0.3 2.2,0.9 0.5,0.4 0.8,0.7 1.2,0.7 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.6 -0.4,-1.2 -1,-1.7 -0.8,-0.6 -2,-1 -3.4,-1 -2.6,0 -4.2,1.2 -4.2,3.3 0,1.6 1.1,2.7 3.2,3.1 l 1.7,0.3 c 0.9,0.2 1.4,0.6 1.4,1.3 0,0.8 -0.7,1.2 -1.8,1.2 -1.1,0 -1.9,-0.3 -2.7,-1.2 -0.5,-0.5 -0.8,-0.7 -1.2,-0.7 -0.6,0 -1,0.4 -1,1 0,0.5 0.3,1.1 0.8,1.6 1,0.9 2.4,1.4 4.1,1.4 z"
+   id="path281" />
+	<path
+   class="st1"
+   d="m -475.8,676.3 c 1.1,0 2.1,-0.4 2.7,-1 0.4,-0.4 0.6,-0.8 0.6,-1.2 0,-0.6 -0.4,-1 -0.9,-1 -0.4,0 -0.6,0.2 -0.9,0.4 -0.4,0.3 -0.8,0.5 -1.2,0.5 -0.7,0 -1.2,-0.5 -1.2,-1.4 v -5.2 h 2.8 c 0.6,0 1.1,-0.4 1.1,-1.1 0,-0.6 -0.5,-1.1 -1.1,-1.1 h -2.8 v -1.8 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 1.8 h -1.5 c -0.7,0 -1.1,0.4 -1.1,1.1 0,0.6 0.5,1.1 1.1,1.1 h 1.5 v 5.5 c 0,2.1 1.4,3.4 3.3,3.4 z"
+   id="path283" />
+	<path
+   class="st1"
+   d="m -465,676.3 c 3.3,0 5.7,-2.3 5.7,-5.7 0,-3.4 -2.4,-5.7 -5.7,-5.7 -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 z m -3.3,-5.7 c 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.4,3.5 -3.3,3.5 -1.9,0 -3.3,-1.4 -3.3,-3.5 z"
+   id="path285" />
+	<path
+   class="st1"
+   d="m -453.9,670.3 c 0,-1.9 0.9,-3 2,-3 0.5,0 1,0.3 1.2,0.6 0.2,0.3 0.6,0.5 1,0.5 0.8,0 1.2,-0.5 1.2,-1.3 0,-0.5 -0.2,-1 -0.6,-1.4 -0.4,-0.4 -1.1,-0.7 -2,-0.7 -1.2,0 -2.2,0.5 -2.8,1.4 v -0.1 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 0,0 0,-4.7 0,-4.7 z"
+   id="path287" />
+	<path
+   class="st1"
+   d="m -441.1,676.3 c 1.7,0 3.4,-0.6 4.3,-1.9 0.2,-0.3 0.3,-0.6 0.3,-0.9 0,-0.6 -0.3,-1 -0.9,-1 -0.4,0 -0.7,0.2 -1.1,0.5 -0.6,0.8 -1.4,1.1 -2.5,1.1 -1.9,0 -3.3,-1.1 -3.4,-2.7 h 7 c 0.8,0 1.3,-0.4 1.3,-1.3 0,-2.9 -2,-5 -5.2,-5 -3.2,0 -5.4,2.3 -5.4,5.6 -0.2,3.4 2.1,5.6 5.6,5.6 z m -3.4,-6.9 c 0.2,-1.6 1.3,-2.5 2.9,-2.5 1.7,0 2.8,0.9 2.9,2.5 z"
+   id="path289" />
+	<path
+   class="st1"
+   d="m -546,670.6 c 0,-1.9 0,-3.8 0,-5.7 0,-0.6 0.1,-1.2 0.3,-1.8 0.4,-1.2 1.2,-2.1 2.4,-2.5 1.4,-0.5 2.9,-0.4 4.3,0.3 0.4,0.2 0.7,0.4 0.9,0.7 0.3,0.4 0.3,1 -0.1,1.4 -0.2,0.2 -0.6,0.2 -0.9,0.1 -0.5,-0.2 -0.9,-0.5 -1.4,-0.6 -0.5,-0.2 -1.1,-0.2 -1.7,0 -0.9,0.3 -1.3,1 -1.5,1.9 0,0.2 0,0.5 0,0.7 0,3.9 0,7.7 0,11.6 0,0.8 -0.1,1.6 -0.4,2.3 -0.6,1.2 -1.5,1.9 -2.8,2.2 -1.1,0.2 -2.2,0.2 -3.2,-0.2 -0.5,-0.2 -1,-0.5 -1.4,-0.9 -0.3,-0.4 -0.3,-0.9 0,-1.2 0.2,-0.3 0.6,-0.4 0.9,-0.3 0.3,0.1 0.5,0.3 0.8,0.4 0.8,0.4 1.6,0.5 2.5,0.3 0.8,-0.2 1.2,-0.8 1.4,-1.6 0.1,-0.3 0.1,-0.6 0.1,-0.9 -0.2,-2.2 -0.2,-4.2 -0.2,-6.2 z"
+   id="path291" />
+	<circle
+   class="st1"
+   cx="-537.09998"
+   cy="670.5"
+   r="2"
+   id="circle293" />
+	<circle
+   class="st1"
+   cx="-552.5"
+   cy="670.5"
+   r="2"
+   id="circle295" />
+</g>
+<g
+   id="Cosign"
+   class="st0"
+   transform="translate(-9.1035767,19.559967)">
+	<g
+   class="st2"
+   id="g318">
+		<path
+   class="st3"
+   d="m -514.3,671.9 c -0.5,0 -0.8,0.2 -1.1,0.7 -0.5,0.8 -1.3,1.5 -2.6,1.5 -1.9,0 -3.2,-1.4 -3.2,-3.5 0,-2.1 1.3,-3.5 3.2,-3.5 1.1,0 2,0.6 2.5,1.4 0.4,0.5 0.7,0.7 1.2,0.7 0.6,0 1,-0.4 1,-1 0,-0.5 -0.4,-1.3 -0.9,-1.9 -0.8,-0.8 -2.1,-1.4 -3.9,-1.4 -3.2,0 -5.6,2.4 -5.6,5.7 0,3.3 2.4,5.7 5.6,5.7 1.7,0 3.1,-0.6 3.9,-1.5 0.5,-0.6 0.9,-1.3 0.9,-1.8 0.1,-0.6 -0.4,-1.1 -1,-1.1 z"
+   id="path298" />
+		<path
+   class="st3"
+   d="m -504.7,665 c -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 3.3,0 5.7,-2.3 5.7,-5.7 0.1,-3.4 -2.3,-5.7 -5.7,-5.7 z m 0,9.1 c -1.9,0 -3.3,-1.4 -3.3,-3.5 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.3,3.5 -3.3,3.5 z"
+   id="path300" />
+		<path
+   class="st3"
+   d="m -489.8,669.7 -1.8,-0.4 c -1,-0.2 -1.5,-0.6 -1.5,-1.2 0,-0.7 0.7,-1.1 1.7,-1.1 0.8,0 1.6,0.3 2.2,0.9 0.5,0.4 0.8,0.7 1.2,0.7 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.6 -0.4,-1.2 -1,-1.7 -0.8,-0.6 -2,-1 -3.4,-1 -2.6,0 -4.2,1.2 -4.2,3.3 0,1.6 1.1,2.7 3.2,3.1 l 1.7,0.3 c 0.9,0.2 1.4,0.6 1.4,1.3 0,0.8 -0.7,1.2 -1.8,1.2 -1.1,0 -1.9,-0.3 -2.7,-1.2 -0.5,-0.5 -0.8,-0.7 -1.2,-0.7 -0.6,0 -1,0.4 -1,1 0,0.5 0.3,1.1 0.8,1.6 0.8,0.8 2.2,1.3 3.9,1.3 2.7,0 4.4,-1.3 4.4,-3.5 0.2,-1.5 -0.8,-2.6 -2.8,-3 z"
+   id="path302" />
+		<path
+   class="st3"
+   d="m -481.5,660.8 c -0.9,0 -1.5,0.6 -1.5,1.5 0,0.8 0.6,1.5 1.5,1.5 0.9,0 1.5,-0.6 1.5,-1.5 0,-0.8 -0.6,-1.5 -1.5,-1.5 z"
+   id="path304" />
+		<path
+   class="st3"
+   d="m -481.5,665.1 c -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -8.7 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 z"
+   id="path306" />
+		<path
+   class="st3"
+   d="m -465.5,665.2 c 0,-0.4 -0.4,-0.9 -0.9,-0.9 -0.3,0 -0.6,0.1 -0.9,0.4 l -1,0.8 c -0.7,-0.3 -1.6,-0.5 -2.7,-0.5 -2.8,0 -4.6,1.3 -4.6,3.4 0,0.9 0.4,1.7 1,2.3 -0.8,0.5 -1.1,1 -1.1,1.8 0,0.7 0.3,1.2 0.8,1.6 -0.8,0.4 -1.3,1 -1.3,1.9 0,1.7 1.8,2.6 5,2.6 3.6,0 5.6,-1.2 5.6,-3.2 0,-1.7 -1.2,-2.6 -3.5,-2.6 h -3.5 c -0.6,0 -1,-0.3 -1,-0.7 0,-0.2 0.1,-0.4 0.3,-0.6 0.6,0.2 1.3,0.3 2.2,0.3 2.8,0 4.6,-1.3 4.6,-3.4 0,-0.6 -0.1,-1.1 -0.4,-1.6 l 0.8,-0.7 c 0.4,-0.2 0.6,-0.6 0.6,-0.9 z m -7.8,9.5 c 0.1,0 0.3,0 0.4,0 h 3.3 c 1,0 1.5,0.3 1.5,0.9 0,0.8 -1,1.2 -3,1.2 -1.9,0 -2.8,-0.4 -2.8,-1.2 0.1,-0.3 0.3,-0.7 0.6,-0.9 z m 2.3,-4.6 c -1.3,0 -2.2,-0.6 -2.2,-1.7 0,-1 0.8,-1.7 2.2,-1.7 1.3,0 2.2,0.6 2.2,1.7 0,1 -0.8,1.7 -2.2,1.7 z"
+   id="path308" />
+		<path
+   class="st3"
+   d="m -455.9,665 c -1.5,0 -2.7,0.5 -3.3,1.5 v -0.2 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -4.8 c 0,-1.8 1.1,-3 2.8,-3 1.6,0 2.5,0.9 2.5,2.8 v 5 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -5.4 c 0,-2.9 -1.8,-4.6 -4.4,-4.6 z"
+   id="path310" />
+		<path
+   class="st3"
+   d="m -541.6,676.1 c -2.8,-1.5 -4.9,-0.8 -6.8,-0.3 -0.7,0.2 -1.3,0.4 -2,0.5 -0.6,0.1 -1.4,-0.1 -2.3,-0.4 -0.6,-0.2 -1.2,0.1 -1.4,0.6 -0.2,0.6 0.1,1.2 0.6,1.4 1,0.4 1.9,0.6 2.7,0.6 0.2,0 0.4,0 0.6,0 0.9,-0.1 1.6,-0.3 2.4,-0.6 1.7,-0.5 3.1,-1 5.2,0.1 0.5,0.3 1.2,0.1 1.5,-0.5 0.2,-0.5 0,-1.2 -0.5,-1.4 z"
+   id="path312" />
+		<path
+   class="st3"
+   d="m -536.4,675.3 -1.6,1.1 c -0.3,0.2 -0.3,0.5 0,0.7 l 1.8,0.9 c 0.3,0.2 0.6,0 0.6,-0.4 l -0.2,-2 c 0,-0.4 -0.3,-0.5 -0.6,-0.3 z"
+   id="path314" />
+		<path
+   class="st3"
+   d="m -538,672.3 -5.8,-8 c -0.3,-0.4 -0.9,-0.5 -1.3,-0.2 l -0.6,0.4 c -0.4,0.3 -0.5,0.9 -0.2,1.3 l 5.8,8 c 0.3,0.4 0.9,0.5 1.3,0.2 l 0.6,-0.4 c 0.4,-0.3 0.5,-0.9 0.2,-1.3 z"
+   id="path316" />
+	</g>
+</g>
+<g
+   id="Rekor"
+   class="st0"
+   transform="translate(-9.1035767,19.559967)">
+	<g
+   class="st2"
+   id="g337">
+		<path
+   class="st3"
+   d="m -518.5,665 c -1.2,0 -2.2,0.5 -2.8,1.4 v -0.1 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -4.7 c 0,-1.9 0.9,-3 2,-3 0.5,0 1,0.3 1.2,0.6 0.2,0.3 0.6,0.5 1,0.5 0.8,0 1.2,-0.5 1.2,-1.3 0,-0.5 -0.2,-1 -0.6,-1.4 -0.4,-0.4 -1.1,-0.7 -2,-0.7 z"
+   id="path321" />
+		<path
+   class="st3"
+   d="m -502.8,670.1 c 0,-2.9 -2,-5 -5.2,-5 -3.2,0 -5.4,2.3 -5.4,5.6 0,3.5 2.3,5.7 5.8,5.7 1.7,0 3.4,-0.6 4.3,-1.9 0.2,-0.3 0.3,-0.6 0.3,-0.9 0,-0.6 -0.3,-1 -0.9,-1 -0.4,0 -0.7,0.2 -1.1,0.5 -0.6,0.8 -1.4,1.1 -2.5,1.1 -1.9,0 -3.3,-1.1 -3.4,-2.7 h 7 c 0.6,-0.1 1.1,-0.5 1.1,-1.4 z m -8.3,-0.6 c 0.2,-1.6 1.3,-2.5 2.9,-2.5 1.7,0 2.8,0.9 2.9,2.5 z"
+   id="path323" />
+		<path
+   class="st3"
+   d="m -492.7,669.8 3,-2.6 c 0.5,-0.4 0.6,-0.8 0.6,-1.1 0,-0.6 -0.5,-1 -1.1,-1 -0.4,0 -0.8,0.1 -1.4,0.7 l -5.2,4.5 V 663 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 12 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -1.8 l 2.1,-1.8 3.4,4.3 c 0.3,0.5 0.8,0.6 1.1,0.6 0.7,0 1.2,-0.5 1.2,-1 0,-0.3 0,-0.5 -0.5,-1.1 z"
+   id="path325" />
+		<path
+   class="st3"
+   d="m -480.3,665 c -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 3.3,0 5.7,-2.3 5.7,-5.7 0,-3.4 -2.4,-5.7 -5.7,-5.7 z m 0,9.2 c -1.9,0 -3.3,-1.4 -3.3,-3.5 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.4,3.5 -3.3,3.5 z"
+   id="path327" />
+		<path
+   class="st3"
+   d="m -463.5,665.7 c -0.4,-0.4 -1.1,-0.7 -2,-0.7 -1.2,0 -2.2,0.5 -2.8,1.4 v -0.1 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -4.7 c 0,-1.9 0.9,-3 2,-3 0.5,0 1,0.3 1.2,0.6 0.2,0.3 0.6,0.5 1,0.5 0.8,0 1.2,-0.5 1.2,-1.3 0,-0.5 -0.2,-1 -0.6,-1.4 z"
+   id="path329" />
+		<path
+   class="st3"
+   d="m -537.6,677.3 h -13.3 c -0.4,0 -0.8,-0.3 -0.8,-0.8 v -11 c 0.2,0.1 0.5,0.1 0.8,0.1 h 13.3 c 0.5,0 0.8,-0.4 0.8,-0.8 0,-0.5 -0.4,-0.8 -0.8,-0.8 h -2.6 v -2.3 c 0,-0.5 -0.4,-0.8 -0.8,-0.8 h -9.9 c -1.3,0 -2.4,1.1 -2.4,2.4 v 13.4 c 0,1.3 1.1,2.4 2.4,2.4 h 13.3 c 0.5,0 0.8,-0.4 0.8,-0.8 0,-0.6 -0.4,-1 -0.8,-1 z m -13.3,-14.9 h 9.1 v 1.5 h -9.1 c -0.4,0 -0.8,-0.3 -0.8,-0.8 0,-0.3 0.4,-0.7 0.8,-0.7 z"
+   id="path331" />
+		<circle
+   class="st3"
+   cx="-538.20001"
+   cy="669"
+   r="1.4"
+   id="circle333" />
+		<circle
+   class="st3"
+   cx="-538.20001"
+   cy="673.79999"
+   r="1.4"
+   id="circle335" />
+	</g>
+</g>
+
+<rect
+   style="fill:#444444;fill-opacity:1;stroke-width:1.42306;stroke-miterlimit:4;stroke-dasharray:none"
+   id="rect3579"
+   width="123.61956"
+   height="40.018261"
+   x="-237"
+   y="286.5"
+   ry="12.764418" /><style
+   type="text/css"
+   id="style1104">
+	.st0{display:none;}
+	.st1{display:inline;fill:#444444;}
+	.st2{fill:#444444;}
+	.st3{display:inline;}
+</style><style
+   type="text/css"
+   id="style1576">
+	.st0{display:none;}
+	.st1{display:inline;fill:#444444;}
+	.st2{display:inline;}
+	.st3{fill:#444444;}
+</style><g
+   id="g1718"
+   transform="translate(15.571152,11.193542)"
+   style="fill:#ffead7;fill-opacity:1"><g
+     id="Layer_1_1_-62"
+     class="st0"
+     style="fill:#ffead7;fill-opacity:1">
+	<path
+   class="st1"
+   d="m -519.1,676.3 c 2.7,0 4.4,-1.3 4.4,-3.5 0,-1.7 -1,-2.7 -3,-3.1 l -1.8,-0.4 c -1,-0.2 -1.5,-0.6 -1.5,-1.2 0,-0.7 0.7,-1.1 1.7,-1.1 0.8,0 1.6,0.3 2.2,0.9 0.5,0.4 0.8,0.7 1.2,0.7 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.6 -0.4,-1.2 -1,-1.7 -0.8,-0.6 -2,-1 -3.4,-1 -2.6,0 -4.2,1.2 -4.2,3.3 0,1.6 1.1,2.7 3.2,3.1 l 1.7,0.3 c 0.9,0.2 1.4,0.6 1.4,1.3 0,0.8 -0.7,1.2 -1.8,1.2 -1.1,0 -1.9,-0.3 -2.7,-1.2 -0.5,-0.5 -0.8,-0.7 -1.2,-0.7 -0.6,0 -1,0.4 -1,1 0,0.5 0.3,1.1 0.8,1.6 1,0.9 2.5,1.4 4.1,1.4 z"
+   id="path1578"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -510.2,676.2 c 0.7,0 1.2,-0.5 1.2,-1.2 v -8.7 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 z m -1.5,-13.9 c 0,0.8 0.6,1.5 1.5,1.5 0.9,0 1.5,-0.6 1.5,-1.5 0,-0.8 -0.6,-1.5 -1.5,-1.5 -0.8,0 -1.5,0.6 -1.5,1.5 z"
+   id="path1580"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -500.7,678.6 c 3.6,0 5.6,-1.2 5.6,-3.2 0,-1.7 -1.2,-2.6 -3.5,-2.6 h -3.4 c -0.6,0 -1,-0.3 -1,-0.7 0,-0.2 0.1,-0.4 0.3,-0.6 0.6,0.2 1.3,0.3 2.2,0.3 2.8,0 4.6,-1.3 4.6,-3.4 0,-0.6 -0.1,-1.1 -0.4,-1.6 l 0.8,-0.7 c 0.3,-0.3 0.5,-0.6 0.5,-1 0,-0.4 -0.4,-0.9 -0.9,-0.9 -0.3,0 -0.6,0.1 -0.9,0.4 l -1,0.8 c -0.7,-0.3 -1.6,-0.5 -2.7,-0.5 -2.8,0 -4.6,1.3 -4.6,3.4 0,0.9 0.4,1.7 1,2.3 -0.8,0.5 -1.1,1 -1.1,1.8 0,0.7 0.3,1.2 0.8,1.6 -0.8,0.4 -1.3,1 -1.3,1.9 0,1.8 1.8,2.7 5,2.7 z m -2.6,-3 c 0,-0.4 0.2,-0.7 0.5,-1 0.1,0 0.3,0 0.4,0 h 3.3 c 1,0 1.5,0.3 1.5,0.9 0,0.8 -1,1.2 -3,1.2 -1.8,0.1 -2.7,-0.3 -2.7,-1.1 z m 0.6,-7.2 c 0,-1 0.8,-1.7 2.2,-1.7 1.3,0 2.2,0.6 2.2,1.7 0,1 -0.8,1.7 -2.2,1.7 -1.3,-0.1 -2.2,-0.7 -2.2,-1.7 z"
+   id="path1582"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -487.7,676.3 c 2.7,0 4.4,-1.3 4.4,-3.5 0,-1.7 -1,-2.7 -3,-3.1 l -1.8,-0.4 c -1,-0.2 -1.5,-0.6 -1.5,-1.2 0,-0.7 0.7,-1.1 1.7,-1.1 0.8,0 1.6,0.3 2.2,0.9 0.5,0.4 0.8,0.7 1.2,0.7 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.6 -0.4,-1.2 -1,-1.7 -0.8,-0.6 -2,-1 -3.4,-1 -2.6,0 -4.2,1.2 -4.2,3.3 0,1.6 1.1,2.7 3.2,3.1 l 1.7,0.3 c 0.9,0.2 1.4,0.6 1.4,1.3 0,0.8 -0.7,1.2 -1.8,1.2 -1.1,0 -1.9,-0.3 -2.7,-1.2 -0.5,-0.5 -0.8,-0.7 -1.2,-0.7 -0.6,0 -1,0.4 -1,1 0,0.5 0.3,1.1 0.8,1.6 1,0.9 2.4,1.4 4.1,1.4 z"
+   id="path1584"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -475.8,676.3 c 1.1,0 2.1,-0.4 2.7,-1 0.4,-0.4 0.6,-0.8 0.6,-1.2 0,-0.6 -0.4,-1 -0.9,-1 -0.4,0 -0.6,0.2 -0.9,0.4 -0.4,0.3 -0.8,0.5 -1.2,0.5 -0.7,0 -1.2,-0.5 -1.2,-1.4 v -5.2 h 2.8 c 0.6,0 1.1,-0.4 1.1,-1.1 0,-0.6 -0.5,-1.1 -1.1,-1.1 h -2.8 v -1.8 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 1.8 h -1.5 c -0.7,0 -1.1,0.4 -1.1,1.1 0,0.6 0.5,1.1 1.1,1.1 h 1.5 v 5.5 c 0,2.1 1.4,3.4 3.3,3.4 z"
+   id="path1586"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -465,676.3 c 3.3,0 5.7,-2.3 5.7,-5.7 0,-3.4 -2.4,-5.7 -5.7,-5.7 -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 z m -3.3,-5.7 c 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.4,3.5 -3.3,3.5 -1.9,0 -3.3,-1.4 -3.3,-3.5 z"
+   id="path1588"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -453.9,670.3 c 0,-1.9 0.9,-3 2,-3 0.5,0 1,0.3 1.2,0.6 0.2,0.3 0.6,0.5 1,0.5 0.8,0 1.2,-0.5 1.2,-1.3 0,-0.5 -0.2,-1 -0.6,-1.4 -0.4,-0.4 -1.1,-0.7 -2,-0.7 -1.2,0 -2.2,0.5 -2.8,1.4 v -0.1 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 0,0 0,-4.7 0,-4.7 z"
+   id="path1590"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -441.1,676.3 c 1.7,0 3.4,-0.6 4.3,-1.9 0.2,-0.3 0.3,-0.6 0.3,-0.9 0,-0.6 -0.3,-1 -0.9,-1 -0.4,0 -0.7,0.2 -1.1,0.5 -0.6,0.8 -1.4,1.1 -2.5,1.1 -1.9,0 -3.3,-1.1 -3.4,-2.7 h 7 c 0.8,0 1.3,-0.4 1.3,-1.3 0,-2.9 -2,-5 -5.2,-5 -3.2,0 -5.4,2.3 -5.4,5.6 -0.2,3.4 2.1,5.6 5.6,5.6 z m -3.4,-6.9 c 0.2,-1.6 1.3,-2.5 2.9,-2.5 1.7,0 2.8,0.9 2.9,2.5 z"
+   id="path1592"
+   style="fill:#ffead7;fill-opacity:1" />
+	<path
+   class="st1"
+   d="m -546,670.6 c 0,-1.9 0,-3.8 0,-5.7 0,-0.6 0.1,-1.2 0.3,-1.8 0.4,-1.2 1.2,-2.1 2.4,-2.5 1.4,-0.5 2.9,-0.4 4.3,0.3 0.4,0.2 0.7,0.4 0.9,0.7 0.3,0.4 0.3,1 -0.1,1.4 -0.2,0.2 -0.6,0.2 -0.9,0.1 -0.5,-0.2 -0.9,-0.5 -1.4,-0.6 -0.5,-0.2 -1.1,-0.2 -1.7,0 -0.9,0.3 -1.3,1 -1.5,1.9 0,0.2 0,0.5 0,0.7 0,3.9 0,7.7 0,11.6 0,0.8 -0.1,1.6 -0.4,2.3 -0.6,1.2 -1.5,1.9 -2.8,2.2 -1.1,0.2 -2.2,0.2 -3.2,-0.2 -0.5,-0.2 -1,-0.5 -1.4,-0.9 -0.3,-0.4 -0.3,-0.9 0,-1.2 0.2,-0.3 0.6,-0.4 0.9,-0.3 0.3,0.1 0.5,0.3 0.8,0.4 0.8,0.4 1.6,0.5 2.5,0.3 0.8,-0.2 1.2,-0.8 1.4,-1.6 0.1,-0.3 0.1,-0.6 0.1,-0.9 -0.2,-2.2 -0.2,-4.2 -0.2,-6.2 z"
+   id="path1594"
+   style="fill:#ffead7;fill-opacity:1" />
+	<circle
+   class="st1"
+   cx="-537.09998"
+   cy="670.5"
+   r="2"
+   id="circle1596"
+   style="fill:#ffead7;fill-opacity:1" />
+	<circle
+   class="st1"
+   cx="-552.5"
+   cy="670.5"
+   r="2"
+   id="circle1598"
+   style="fill:#ffead7;fill-opacity:1" />
+</g><g
+     id="Cosign-9"
+     class="st0"
+     style="fill:#ffead7;fill-opacity:1">
+	<g
+   class="st2"
+   id="g1621"
+   style="fill:#ffead7;fill-opacity:1">
+		<path
+   class="st3"
+   d="m -514.3,671.9 c -0.5,0 -0.8,0.2 -1.1,0.7 -0.5,0.8 -1.3,1.5 -2.6,1.5 -1.9,0 -3.2,-1.4 -3.2,-3.5 0,-2.1 1.3,-3.5 3.2,-3.5 1.1,0 2,0.6 2.5,1.4 0.4,0.5 0.7,0.7 1.2,0.7 0.6,0 1,-0.4 1,-1 0,-0.5 -0.4,-1.3 -0.9,-1.9 -0.8,-0.8 -2.1,-1.4 -3.9,-1.4 -3.2,0 -5.6,2.4 -5.6,5.7 0,3.3 2.4,5.7 5.6,5.7 1.7,0 3.1,-0.6 3.9,-1.5 0.5,-0.6 0.9,-1.3 0.9,-1.8 0.1,-0.6 -0.4,-1.1 -1,-1.1 z"
+   id="path1601"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -504.7,665 c -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 3.3,0 5.7,-2.3 5.7,-5.7 0.1,-3.4 -2.3,-5.7 -5.7,-5.7 z m 0,9.1 c -1.9,0 -3.3,-1.4 -3.3,-3.5 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.3,3.5 -3.3,3.5 z"
+   id="path1603"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -489.8,669.7 -1.8,-0.4 c -1,-0.2 -1.5,-0.6 -1.5,-1.2 0,-0.7 0.7,-1.1 1.7,-1.1 0.8,0 1.6,0.3 2.2,0.9 0.5,0.4 0.8,0.7 1.2,0.7 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.6 -0.4,-1.2 -1,-1.7 -0.8,-0.6 -2,-1 -3.4,-1 -2.6,0 -4.2,1.2 -4.2,3.3 0,1.6 1.1,2.7 3.2,3.1 l 1.7,0.3 c 0.9,0.2 1.4,0.6 1.4,1.3 0,0.8 -0.7,1.2 -1.8,1.2 -1.1,0 -1.9,-0.3 -2.7,-1.2 -0.5,-0.5 -0.8,-0.7 -1.2,-0.7 -0.6,0 -1,0.4 -1,1 0,0.5 0.3,1.1 0.8,1.6 0.8,0.8 2.2,1.3 3.9,1.3 2.7,0 4.4,-1.3 4.4,-3.5 0.2,-1.5 -0.8,-2.6 -2.8,-3 z"
+   id="path1605"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -481.5,660.8 c -0.9,0 -1.5,0.6 -1.5,1.5 0,0.8 0.6,1.5 1.5,1.5 0.9,0 1.5,-0.6 1.5,-1.5 0,-0.8 -0.6,-1.5 -1.5,-1.5 z"
+   id="path1607"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -481.5,665.1 c -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -8.7 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 z"
+   id="path1609"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -465.5,665.2 c 0,-0.4 -0.4,-0.9 -0.9,-0.9 -0.3,0 -0.6,0.1 -0.9,0.4 l -1,0.8 c -0.7,-0.3 -1.6,-0.5 -2.7,-0.5 -2.8,0 -4.6,1.3 -4.6,3.4 0,0.9 0.4,1.7 1,2.3 -0.8,0.5 -1.1,1 -1.1,1.8 0,0.7 0.3,1.2 0.8,1.6 -0.8,0.4 -1.3,1 -1.3,1.9 0,1.7 1.8,2.6 5,2.6 3.6,0 5.6,-1.2 5.6,-3.2 0,-1.7 -1.2,-2.6 -3.5,-2.6 h -3.5 c -0.6,0 -1,-0.3 -1,-0.7 0,-0.2 0.1,-0.4 0.3,-0.6 0.6,0.2 1.3,0.3 2.2,0.3 2.8,0 4.6,-1.3 4.6,-3.4 0,-0.6 -0.1,-1.1 -0.4,-1.6 l 0.8,-0.7 c 0.4,-0.2 0.6,-0.6 0.6,-0.9 z m -7.8,9.5 c 0.1,0 0.3,0 0.4,0 h 3.3 c 1,0 1.5,0.3 1.5,0.9 0,0.8 -1,1.2 -3,1.2 -1.9,0 -2.8,-0.4 -2.8,-1.2 0.1,-0.3 0.3,-0.7 0.6,-0.9 z m 2.3,-4.6 c -1.3,0 -2.2,-0.6 -2.2,-1.7 0,-1 0.8,-1.7 2.2,-1.7 1.3,0 2.2,0.6 2.2,1.7 0,1 -0.8,1.7 -2.2,1.7 z"
+   id="path1611"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -455.9,665 c -1.5,0 -2.7,0.5 -3.3,1.5 v -0.2 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -4.8 c 0,-1.8 1.1,-3 2.8,-3 1.6,0 2.5,0.9 2.5,2.8 v 5 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -5.4 c 0,-2.9 -1.8,-4.6 -4.4,-4.6 z"
+   id="path1613"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -541.6,676.1 c -2.8,-1.5 -4.9,-0.8 -6.8,-0.3 -0.7,0.2 -1.3,0.4 -2,0.5 -0.6,0.1 -1.4,-0.1 -2.3,-0.4 -0.6,-0.2 -1.2,0.1 -1.4,0.6 -0.2,0.6 0.1,1.2 0.6,1.4 1,0.4 1.9,0.6 2.7,0.6 0.2,0 0.4,0 0.6,0 0.9,-0.1 1.6,-0.3 2.4,-0.6 1.7,-0.5 3.1,-1 5.2,0.1 0.5,0.3 1.2,0.1 1.5,-0.5 0.2,-0.5 0,-1.2 -0.5,-1.4 z"
+   id="path1615"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -536.4,675.3 -1.6,1.1 c -0.3,0.2 -0.3,0.5 0,0.7 l 1.8,0.9 c 0.3,0.2 0.6,0 0.6,-0.4 l -0.2,-2 c 0,-0.4 -0.3,-0.5 -0.6,-0.3 z"
+   id="path1617"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -538,672.3 -5.8,-8 c -0.3,-0.4 -0.9,-0.5 -1.3,-0.2 l -0.6,0.4 c -0.4,0.3 -0.5,0.9 -0.2,1.3 l 5.8,8 c 0.3,0.4 0.9,0.5 1.3,0.2 l 0.6,-0.4 c 0.4,-0.3 0.5,-0.9 0.2,-1.3 z"
+   id="path1619"
+   style="fill:#ffead7;fill-opacity:1" />
+	</g>
+</g><g
+     id="Rekor-1"
+     style="fill:#ffead7;fill-opacity:1">
+	<g
+   id="g1640"
+   style="fill:#ffead7;fill-opacity:1">
+		<path
+   class="st3"
+   d="m -202.2,290.6 c -1.2,0 -2.2,0.5 -2.8,1.4 v -0.1 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -4.7 c 0,-1.9 0.9,-3 2,-3 0.5,0 1,0.3 1.2,0.6 0.2,0.3 0.6,0.5 1,0.5 0.8,0 1.2,-0.5 1.2,-1.3 0,-0.5 -0.2,-1 -0.6,-1.4 -0.4,-0.4 -1.1,-0.7 -2,-0.7 z"
+   id="path1624"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -186.5,295.7 c 0,-2.9 -2,-5 -5.2,-5 -3.2,0 -5.4,2.3 -5.4,5.6 0,3.5 2.3,5.7 5.8,5.7 1.7,0 3.4,-0.6 4.3,-1.9 0.2,-0.3 0.3,-0.6 0.3,-0.9 0,-0.6 -0.3,-1 -0.9,-1 -0.4,0 -0.7,0.2 -1.1,0.5 -0.6,0.8 -1.4,1.1 -2.5,1.1 -1.9,0 -3.3,-1.1 -3.4,-2.7 h 7 c 0.6,-0.1 1.1,-0.5 1.1,-1.4 z m -8.3,-0.6 c 0.2,-1.6 1.3,-2.5 2.9,-2.5 1.7,0 2.8,0.9 2.9,2.5 z"
+   id="path1626"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -176.4,295.4 3,-2.6 c 0.5,-0.4 0.6,-0.8 0.6,-1.1 0,-0.6 -0.5,-1 -1.1,-1 -0.4,0 -0.8,0.1 -1.4,0.7 l -5.2,4.5 v -7.3 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 12 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -1.8 l 2.1,-1.8 3.4,4.3 c 0.3,0.5 0.8,0.6 1.1,0.6 0.7,0 1.2,-0.5 1.2,-1 0,-0.3 0,-0.5 -0.5,-1.1 z"
+   id="path1628"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -164,290.6 c -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 3.3,0 5.7,-2.3 5.7,-5.7 0,-3.4 -2.4,-5.7 -5.7,-5.7 z m 0,9.2 c -1.9,0 -3.3,-1.4 -3.3,-3.5 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.4,3.5 -3.3,3.5 z"
+   id="path1630"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -147.2,291.3 c -0.4,-0.4 -1.1,-0.7 -2,-0.7 -1.2,0 -2.2,0.5 -2.8,1.4 v -0.1 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -4.7 c 0,-1.9 0.9,-3 2,-3 0.5,0 1,0.3 1.2,0.6 0.2,0.3 0.6,0.5 1,0.5 0.8,0 1.2,-0.5 1.2,-1.3 0,-0.5 -0.2,-1 -0.6,-1.4 z"
+   id="path1632"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -221.3,302.9 h -13.3 c -0.4,0 -0.8,-0.3 -0.8,-0.8 v -11 c 0.2,0.1 0.5,0.1 0.8,0.1 h 13.3 c 0.5,0 0.8,-0.4 0.8,-0.8 0,-0.5 -0.4,-0.8 -0.8,-0.8 h -2.6 v -2.3 c 0,-0.5 -0.4,-0.8 -0.8,-0.8 h -9.9 c -1.3,0 -2.4,1.1 -2.4,2.4 v 13.4 c 0,1.3 1.1,2.4 2.4,2.4 h 13.3 c 0.5,0 0.8,-0.4 0.8,-0.8 0,-0.6 -0.4,-1 -0.8,-1 z M -234.6,288 h 9.1 v 1.5 h -9.1 c -0.4,0 -0.8,-0.3 -0.8,-0.8 0,-0.3 0.4,-0.7 0.8,-0.7 z"
+   id="path1634"
+   style="fill:#ffead7;fill-opacity:1" />
+		<circle
+   class="st3"
+   cx="-221.89999"
+   cy="294.60001"
+   r="1.4"
+   id="circle1636"
+   style="fill:#ffead7;fill-opacity:1" />
+		<circle
+   class="st3"
+   cx="-221.89999"
+   cy="299.39999"
+   r="1.4"
+   id="circle1638"
+   style="fill:#ffead7;fill-opacity:1" />
+	</g>
+</g><g
+     id="Fulcio"
+     class="st0"
+     style="fill:#ffead7;fill-opacity:1">
+	<g
+   class="st2"
+   id="g1663"
+   style="fill:#ffead7;fill-opacity:1">
+		<path
+   class="st3"
+   d="m -517.3,663.7 c 0.5,0 0.8,0.1 1.1,0.3 0.2,0.1 0.3,0.1 0.5,0.1 0.5,0 0.9,-0.4 0.9,-0.9 0,-0.4 -0.2,-0.7 -0.5,-0.9 -0.5,-0.4 -1.3,-0.6 -2.2,-0.6 -2.2,0 -3.5,1.3 -3.5,3.3 v 0.3 h -1.5 c -0.7,0 -1.1,0.4 -1.1,1.1 0,0.6 0.5,1.1 1.1,1.1 h 1.5 v 7.6 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -7.6 h 2.5 c 0.7,0 1.1,-0.4 1.1,-1.1 0,-0.6 -0.5,-1.1 -1.1,-1.1 h -2.5 v -0.2 c -0.1,-0.9 0.3,-1.4 1.3,-1.4 z"
+   id="path1643"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -502.7,665.1 c -0.7,0 -1.2,0.5 -1.2,1.2 v 4.8 c 0,1.8 -1.1,3 -2.8,3 -1.6,0 -2.5,-0.9 -2.5,-2.8 v -5 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 -0.7,0 -1.2,0.5 -1.2,1.2 v 5.4 c 0,2.9 1.7,4.6 4.4,4.6 1.5,0 2.7,-0.5 3.3,-1.5 v 0.2 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -8.7 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 z"
+   id="path1645"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -495.5,661.8 c -0.7,0 -1.2,0.5 -1.2,1.2 v 12 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -12 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 z"
+   id="path1647"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -481.1,672 c -0.5,0 -0.8,0.2 -1.1,0.7 -0.5,0.8 -1.3,1.5 -2.6,1.5 -1.9,0 -3.2,-1.4 -3.2,-3.5 0,-2.1 1.3,-3.5 3.2,-3.5 1.1,0 2,0.6 2.5,1.4 0.4,0.5 0.7,0.7 1.2,0.7 0.6,0 1,-0.4 1,-1 0,-0.5 -0.4,-1.3 -0.9,-1.9 -0.8,-0.8 -2.1,-1.4 -3.9,-1.4 -3.2,0 -5.6,2.4 -5.6,5.7 0,3.3 2.4,5.7 5.6,5.7 1.7,0 3.1,-0.6 3.9,-1.5 0.5,-0.6 0.9,-1.3 0.9,-1.8 0.1,-0.7 -0.4,-1.1 -1,-1.1 z"
+   id="path1649"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -475.1,665.1 c -0.7,0 -1.2,0.5 -1.2,1.2 v 8.7 c 0,0.7 0.5,1.2 1.2,1.2 0.7,0 1.2,-0.5 1.2,-1.2 v -8.7 c 0,-0.7 -0.5,-1.2 -1.2,-1.2 z"
+   id="path1651"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -475.1,660.8 c -0.9,0 -1.5,0.6 -1.5,1.5 0,0.8 0.6,1.5 1.5,1.5 0.9,0 1.5,-0.6 1.5,-1.5 0,-0.8 -0.6,-1.5 -1.5,-1.5 z"
+   id="path1653"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -464.4,665 c -3.3,0 -5.7,2.3 -5.7,5.7 0,3.4 2.4,5.7 5.7,5.7 3.3,0 5.7,-2.3 5.7,-5.7 0,-3.4 -2.3,-5.7 -5.7,-5.7 z m 0,9.1 c -1.9,0 -3.3,-1.4 -3.3,-3.5 0,-2.1 1.4,-3.5 3.3,-3.5 1.9,0 3.3,1.4 3.3,3.5 0,2.1 -1.4,3.5 -3.3,3.5 z"
+   id="path1655"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -550.6,675.6 c -0.2,0 -0.4,0.1 -0.6,0.2 v 0 c -1.3,1 -2,1.4 -2.1,1.4 -0.4,0.3 -0.6,0.8 -0.4,1.3 0,0.1 0,0.1 0.1,0.2 0.1,0.3 0.4,0.4 0.6,0.5 0.1,0 0.2,0 0.2,0 0.2,0 0.4,0 0.5,-0.1 0.1,-0.1 0.8,-0.4 2.1,-1.4 0.3,-0.2 0.5,-0.5 0.5,-0.9 0.1,-0.7 -0.3,-1.2 -0.9,-1.2 z"
+   id="path1657"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -541.4,671.5 c -0.4,0 -0.8,0.3 -0.8,0.7 l -0.1,0.4 c -0.3,0.7 -0.9,1.6 -2.1,2.2 -0.3,0.1 -0.6,0.3 -0.9,0.4 -0.5,-0.1 -0.9,-0.3 -1.2,-0.5 -0.7,-0.4 -1.2,-1 -1.5,-1.5 -0.5,-0.7 -0.6,-1.4 -0.6,-1.4 v -0.1 -0.2 -3.1 h 3.2 v 0 0 c 0.5,0 0.8,-0.4 0.8,-0.8 0,-0.4 -0.4,-0.8 -0.8,-0.8 v 0 h -3.4 c -0.8,0 -1.5,0.7 -1.5,1.5 v 3.5 c 0,0 0,0.1 0,0.2 0,0.2 0.1,0.5 0.2,0.9 0.2,0.5 0.4,1 0.8,1.5 0.4,0.5 0.8,1 1.5,1.5 0.4,0.3 1,0.6 1.6,0.8 0.2,0.1 0.5,0.2 0.7,0.2 0.1,0 0.1,0 0.2,0 h 0.1 c 0.1,0 0.1,0 0.2,0 v 0 c 2.8,-0.7 4.1,-2.8 4.5,-4.1 v 0 c 0.1,-0.1 0.1,-0.2 0.1,-0.4 -0.2,-0.5 -0.6,-0.9 -1,-0.9 z"
+   id="path1659"
+   style="fill:#ffead7;fill-opacity:1" />
+		<path
+   class="st3"
+   d="m -539,661.7 c -0.1,-0.2 -0.3,-0.3 -0.5,-0.4 -0.2,-0.1 -0.4,0 -0.6,0.1 l -3.4,1.9 c -0.4,0.2 -0.5,0.7 -0.3,1.1 0.2,0.4 0.7,0.5 1.1,0.3 l 1.4,-0.8 c -0.1,0.3 -0.2,0.5 -0.5,1.1 -0.3,0.6 -0.6,1.1 -0.9,1.6 -0.2,0.3 -0.3,0.6 -0.5,0.8 -0.2,0.3 -0.4,0.6 -0.6,0.8 -0.4,0.6 -0.8,1.1 -1.3,1.6 -0.6,0.7 -1,1.2 -1.6,1.8 v 0 0 c -0.2,0.2 -0.3,0.4 -0.3,0.7 0,0.6 0.5,1 1,1 0.3,0 0.5,-0.1 0.7,-0.3 0,0 0,0 0.1,0 v 0 c 0.5,-0.5 1,-1 1.5,-1.6 0.6,-0.7 1.1,-1.4 1.7,-2.2 0.3,-0.4 0.6,-0.8 0.8,-1.2 0.2,-0.3 0.4,-0.6 0.5,-0.9 0.3,-0.5 0.5,-1 0.8,-1.5 0.3,-0.6 0.4,-0.9 0.5,-1.2 l 0.7,1.3 c 0.2,0.3 0.4,0.4 0.7,0.4 0.1,0 0.3,0 0.4,-0.1 0.4,-0.2 0.5,-0.7 0.3,-1.1 z"
+   id="path1661"
+   style="fill:#ffead7;fill-opacity:1" />
+	</g>
+</g></g></svg>
diff --git a/docs/website/static/img/logos/integrations/rond.png b/docs/website/static/img/logos/integrations/rond.png
new file mode 100644
index 0000000000..ad124d05ee
Binary files /dev/null and b/docs/website/static/img/logos/integrations/rond.png differ
diff --git a/docs/website/static/img/logos/integrations/spacelift.png b/docs/website/static/img/logos/integrations/spacelift.png
new file mode 100644
index 0000000000..95696399da
Binary files /dev/null and b/docs/website/static/img/logos/integrations/spacelift.png differ
diff --git a/docs/website/static/img/logos/integrations/strimzi.png b/docs/website/static/img/logos/integrations/strimzi.png
new file mode 100644
index 0000000000..b637d1fa80
Binary files /dev/null and b/docs/website/static/img/logos/integrations/strimzi.png differ
diff --git a/docs/website/static/img/logos/integrations/styra-das.png b/docs/website/static/img/logos/integrations/styra-das.png
new file mode 100644
index 0000000000..77dcdac189
Binary files /dev/null and b/docs/website/static/img/logos/integrations/styra-das.png differ
diff --git a/docs/website/static/img/logos/integrations/styra-load.png b/docs/website/static/img/logos/integrations/styra-load.png
new file mode 100644
index 0000000000..77dcdac189
Binary files /dev/null and b/docs/website/static/img/logos/integrations/styra-load.png differ
diff --git a/docs/website/static/img/logos/integrations/terraform-cloud.png b/docs/website/static/img/logos/integrations/terraform-cloud.png
new file mode 100644
index 0000000000..e604c32a51
Binary files /dev/null and b/docs/website/static/img/logos/integrations/terraform-cloud.png differ
diff --git a/docs/website/static/img/logos/integrations/topaz.svg b/docs/website/static/img/logos/integrations/topaz.svg
new file mode 100644
index 0000000000..572ec35040
--- /dev/null
+++ b/docs/website/static/img/logos/integrations/topaz.svg
@@ -0,0 +1,30 @@
+<svg width="466" height="446" viewBox="0 0 466 446" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M232.639 150.068L320.852 238.77L232.639 327.472L144.425 238.77L232.639 150.068Z" fill="#61A1DC" />
+  <path d="M229.513 144.321L138.703 235.633H38.9276L229.509 44.0034L229.513 144.321Z" fill="#6AB5FA" />
+  <path d="M138.707 241.92L229.516 333.233V433.55L38.9382 241.92H138.707Z" fill="#6AB5FA" />
+  <path d="M235.768 333.229L326.578 241.917H426.35L235.772 433.547L235.768 333.229Z" fill="#0B4781" />
+  <path d="M326.574 235.63L235.765 144.317V44L426.343 235.63H326.574Z" fill="#147ADB" />
+  <path d="M316.878 335.872C305.632 347.945 283.692 346.776 269.255 334.288C254.783 321.778 251.899 303.889 261.613 293.433C266.712 288.324 294.757 262.817 316.222 233.601C338.89 205.318 354.977 173.324 363.955 176.799C372.714 179.762 372.741 220.318 359.469 257.685C347.737 295.658 322.705 330.442 316.878 335.872Z" fill="#1C5286" />
+  <path d="M290.428 282.557C301.683 278.841 360.37 251.354 361.828 250.565C361.094 252.944 360.308 255.321 359.468 257.686C347.735 295.66 322.705 330.443 316.877 335.872C305.631 347.945 283.691 346.776 269.254 334.288C263.804 329.577 259.999 324.103 257.89 318.551C258.443 315.856 259.4 292.802 290.428 282.557Z" fill="#1C60A1" />
+  <path d="M327.403 367.706C312.223 374.171 292.65 364.191 284.528 346.917C276.384 329.608 281.015 312.088 294.137 306.479C300.871 303.882 336.859 291.964 368.34 273.982C400.541 257.343 428.235 234.64 435.027 241.462C441.828 247.727 425.381 284.799 398.077 313.555C371.934 343.49 334.933 365.11 327.403 367.706Z" fill="#1D6EBA" />
+  <path d="M393.481 282.758C391.789 287.548 389.882 292.356 387.747 297.092C372.927 333.97 345.117 366.577 338.862 371.507C326.661 382.613 304.893 379.642 291.532 366.007C278.139 352.349 276.738 334.282 287.278 324.662C288.325 323.773 387.901 285.462 393.481 282.758Z" fill="#227FD7" />
+  <path d="M315.375 396.361C298.878 396.109 285.039 379.044 284.627 359.961C284.209 340.836 295.553 326.704 309.822 326.903C317.031 327.264 354.758 330.978 390.827 327.321C427.009 325.184 461.534 315.675 464.973 324.668C468.646 333.154 438.568 360.36 401.943 375.558C365.902 392.305 323.31 397.047 315.375 396.361Z" fill="#3990E0" />
+  <path d="M148.402 335.872C159.648 347.945 181.587 346.776 196.025 334.288C210.497 321.778 213.381 303.889 203.667 293.433C198.567 288.324 170.523 262.817 149.058 233.601C126.39 205.318 110.303 173.324 101.325 176.799C92.5655 179.762 92.5391 220.318 105.811 257.685C117.543 295.658 142.575 330.442 148.402 335.872Z" fill="#1C5286" />
+  <path d="M174.852 282.557C163.597 278.841 104.91 251.354 103.452 250.565C104.186 252.944 104.972 255.321 105.812 257.686C117.545 295.66 142.575 330.443 148.403 335.872C159.649 347.945 181.589 346.776 196.026 334.288C201.476 329.577 205.281 324.103 207.39 318.551C206.837 315.856 205.88 292.802 174.852 282.557Z" fill="#1C60A1" />
+  <path d="M137.877 367.706C153.057 374.171 172.63 364.191 180.752 346.917C188.896 329.608 184.265 312.088 171.144 306.479C164.409 303.882 128.421 291.964 96.9406 273.982C64.739 257.343 37.0449 234.64 30.2529 241.462C23.4518 247.727 39.8993 284.799 67.2026 313.555C93.3465 343.49 130.348 365.11 137.877 367.706Z" fill="#1D6EBA" />
+  <path d="M70.7161 282.758C72.4083 287.548 74.3155 292.356 76.451 297.092C91.2705 333.97 119.081 366.576 125.336 371.506C137.537 382.613 159.306 379.641 172.666 366.007C186.059 352.348 187.46 334.281 176.92 324.661C175.873 323.773 76.2962 285.462 70.7161 282.758Z" fill="#227FD7" />
+  <path d="M149.904 396.362C166.401 396.109 180.24 379.045 180.652 359.961C181.07 340.836 169.726 326.704 155.458 326.903C148.249 327.264 110.521 330.978 74.4528 327.321C38.2692 325.183 3.74396 315.676 0.304343 324.669C-3.36882 333.155 26.7099 360.361 63.3343 375.559C99.378 392.305 141.97 397.047 149.904 396.362Z" fill="#3990E0" />
+  <path d="M348.672 373.429C348.672 437.512 296.723 446 232.641 446C168.558 446 116.609 437.511 116.609 373.429C116.609 309.347 168.557 249.196 232.64 249.196C296.723 249.196 348.672 309.347 348.672 373.429Z" fill="url(#paint0_linear_0_1)" />
+  <path d="M210.447 280.412C200.532 283.83 191.842 289.134 184.617 296.177C181.801 298.923 177.292 298.866 174.546 296.049C171.8 293.232 171.858 288.723 174.675 285.978C183.415 277.457 193.888 271.054 205.803 266.945C209.522 265.663 213.581 267.636 214.857 271.356C216.576 276.361 211.474 280.057 210.447 280.412Z" fill="#D5EBFF" />
+  <path d="M160.474 358.649C167.72 358.649 173.594 352.775 173.594 345.529C173.594 338.284 167.72 332.41 160.474 332.41C153.229 332.41 147.355 338.284 147.355 345.529C147.355 352.775 153.229 358.649 160.474 358.649Z" fill="black" />
+  <path d="M306.439 358.649C313.685 358.649 319.559 352.775 319.559 345.529C319.559 338.284 313.685 332.41 306.439 332.41C299.194 332.41 293.32 338.284 293.32 345.529C293.32 352.775 299.194 358.649 306.439 358.649Z" fill="black" />
+  <path d="M231.354 399.229C240.281 399.229 248.545 397.939 256.147 395.358C263.749 392.778 270.792 388.977 277.278 383.956L281.986 390.86C275.36 396.3 267.724 400.659 259.076 403.936C250.498 407.284 241.257 408.958 231.354 408.958C221.451 408.958 212.176 407.284 203.528 403.936C194.95 400.659 187.348 396.3 180.723 390.86L185.43 383.956C191.916 388.977 198.96 392.778 206.562 395.358C214.163 397.939 222.428 399.229 231.354 399.229Z" fill="black" />
+  <path d="M182.978 39.4652C183.774 39.5438 184.381 40.2131 184.38 41.0122C184.38 41.8118 183.774 42.481 182.978 42.5592C173.327 43.4004 164.281 47.6171 157.431 54.4669C150.581 61.3167 146.364 70.3629 145.523 80.0143C145.415 80.7842 144.755 81.3554 143.977 81.3519C143.2 81.3488 142.545 80.7719 142.442 80.001C141.602 70.35 137.386 61.3041 130.535 54.4532C123.685 47.6029 114.639 43.3868 104.987 42.5459C104.218 42.4372 103.647 41.7768 103.65 40.9998C103.653 40.2223 104.23 39.5667 105.001 39.4655C114.649 38.6253 123.693 34.4108 130.54 27.5633C137.388 20.7157 141.602 11.6718 142.443 2.02403C142.544 1.25317 143.199 0.676237 143.977 0.672685C144.754 0.669133 145.415 1.24034 145.523 2.01032C146.364 11.6618 150.581 20.7079 157.431 27.5577C164.281 34.4079 173.327 38.6244 182.978 39.4654L182.978 39.4652Z" fill="#4A92FF" />
+  <path d="M395.914 103.176C396.341 103.218 396.667 103.577 396.667 104.006C396.667 104.435 396.341 104.794 395.914 104.836C390.736 105.288 385.882 107.55 382.206 111.226C378.531 114.901 376.268 119.755 375.817 124.934C375.759 125.347 375.404 125.653 374.987 125.651C374.57 125.65 374.219 125.34 374.164 124.926C373.713 119.748 371.451 114.894 367.775 111.218C364.099 107.542 359.245 105.28 354.066 104.829C353.653 104.771 353.347 104.416 353.349 103.999C353.351 103.582 353.66 103.23 354.074 103.176C359.251 102.725 364.103 100.464 367.777 96.7897C371.452 93.1155 373.713 88.2628 374.164 83.086C374.218 82.6724 374.57 82.3629 374.987 82.3609C375.404 82.359 375.759 82.6655 375.817 83.0787C376.268 88.2574 378.531 93.1113 382.206 96.7867C385.882 100.462 390.735 102.725 395.914 103.176L395.914 103.176Z" fill="#4A92FF" />
+  <defs>
+    <linearGradient id="paint0_linear_0_1" x1="232.641" y1="249.196" x2="232.641" y2="446" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#86BAEB" />
+      <stop offset="1" stop-color="#005CB3" />
+    </linearGradient>
+  </defs>
+</svg>
diff --git a/docs/website/static/img/logos/integrations/torque.png b/docs/website/static/img/logos/integrations/torque.png
new file mode 100644
index 0000000000..4c9b0d397b
Binary files /dev/null and b/docs/website/static/img/logos/integrations/torque.png differ
diff --git a/docs/website/static/img/logos/integrations/waltid.png b/docs/website/static/img/logos/integrations/waltid.png
new file mode 100644
index 0000000000..77675fbd02
Binary files /dev/null and b/docs/website/static/img/logos/integrations/waltid.png differ
diff --git a/docs/website/static/security.html b/docs/website/static/security.html
new file mode 100644
index 0000000000..14b623237d
--- /dev/null
+++ b/docs/website/static/security.html
@@ -0,0 +1,156 @@
+<!doctype html>
+<html lang="en">
+
+  <head>
+    <!-- Required meta tags -->
+    <meta charset="utf-8">
+    <meta name="viewport"
+          content="width=device-width, initial-scale=1, shrink-to-fit=no">
+
+    <!-- Bootstrap CSS -->
+    <link rel="stylesheet" href="css/bootstrap.min.css">
+
+    <title>Open Policy Agent | Security Policy</title>
+    <link rel="stylesheet" href="css/home.css">
+    <link rel="stylesheet" href="css/community.css">
+    <link rel="stylesheet" href="css/security.css">
+    <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.15.4/css/all.css">
+  </head>
+
+  <body data-spy="scroll" data-target=".navbar" data-offset="90">
+
+
+    <div class="support-bg">
+      <div id="navigation">
+        <nav class="navbar navbar-expand-lg navbar-dark bg-transparent">
+          <div class="container">
+
+            <a class="navbar-brand" href="/" aria-label="Open Policy Agent home"><img
+              title="OPA logo" src="./img/logo-white.png" class="img-fluid"></a>
+            <button class="navbar-toggler navbar-toggler-right collapsed"
+                    type="button" data-toggle="collapse"
+                    data-target="#navb" aria-expanded="false">
+              <span class="navbar-toggler-icon"></span>
+            </button>
+
+            <div class="navbar-collapse collapse" id="navb">
+              <ul class="navbar-nav mr-auto">
+              </ul>
+
+              <ul class="navbar-nav">
+                <li class="nav-item"><a class="nav-link" href="./docs/">Docs</a></li>
+                <li class="nav-item"><a class="nav-link" href="./docs/#running-opa">Download</a></li>
+                <li class="nav-item"><a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a></li>
+                <li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
+                <li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
+                <li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
+                <li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
+                <li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
+                <li class="nav-item social-nav-item">
+                  <a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
+                    <img src="./img/twitter-icon.png" alt="Twitter">
+                    <div class="nav-link social-icon-title">Twitter</div>
+                  </a>
+                </li>
+                <li class="nav-item social-nav-item">
+                  <a class="nav-link social-icon-link" href="https://slack.openpolicyagent.org/">
+                    <img src="./img/slack-icon.png" alt="Slack">
+                    <div class="nav-link social-icon-title">Slack</div>
+                  </a>
+                </li>
+                <li class="nav-item social-nav-item">
+                  <a class="nav-link social-icon-link" href="https://github.com/open-policy-agent/opa">
+                    <img src="./img/github-icon.png" alt="GitHub">
+                    <div class="social-icon-title">GitHub</div>
+                  </a>
+                </li>
+              </ul>
+            </div>
+          </div>
+        </nav>
+      </div>
+
+      <main class="support-content">
+        <section id="homebackground">
+          <h1 class="banner-content text-center">
+            Security Policy
+          </h1>
+          <div class="banner-subcontent">
+            The Open Policy Agent (OPA) community has adopted this security disclosures and response policy to ensure we responsibly handle critical issues.
+          </div>
+          <h2 class="divider line glow">Reporting a Security Bug</h2>
+          <div class="banner-subcontent">
+            <ul>
+              <li>If you think you have found a security issue in an OPA project, please send an
+                email to <a href="mailto:open-policy-agent-security@googlegroups.com">open-policy-agent-security</a>.
+                This list is delivered to a small security team. We will then acknowledge receipt
+                of your report and prioritize initial analysis of severity.</li>
+
+              <li>After the initial reply to your report, the security team will endeavor to keep you informed
+                of the progress being made towards a fix and full announcement, and may ask for additional
+                information or guidance surrounding the reported issue.</p>
+
+              <li>If you have not received a reply to your report within two days, please reach out on our
+               <a href="https://slack.openpolicyagent.org/">Slack</a>
+               by posting a message in the <code>#contributors</code> channel.</li>
+
+              <li>Note that the <code>#conributors</code> channel is public, so please don't discuss details of your
+                issue there. Instead, simply say that you're trying to get a hold of someone from the security team.</li>
+            </ul>
+          </div>
+          <h2 class="divider line glow">Disclosure Policy</h2>
+          <div class="banner-subcontent">
+            <ol>
+              <li>The security report is received and is assigned a primary handler.
+                This person will coordinate the fix and release process.
+                The problem is confirmed and a list of all affected versions is determined.
+                Code is audited to find any potential similar problems.
+                Fixes are prepared for all releases which are still under maintenance.
+                These fixes are not committed to the public repository but rather held locally or in a private fork pending the announcement.</li>
+
+              <li>A suggested embargo date for this vulnerability is chosen and a CVE
+                (Common Vulnerabilities and Exposures (CVE®)) is requested for the vulnerability,
+                through the GitHub Advisory database.</li>
+
+              <li>A prenotification may be published on the security announcements channels listed below,
+                providing information about affected projects, severity, and the embargo date.</li>
+
+              <li>On the embargo date, the announcement is published.
+                The changes are pushed to the public repository and new builds are deployed.
+              </li>
+
+              <li>Typically the embargo date will be set 72 hours from the time the CVE is issued.
+                However, this may vary depending on the severity of the bug or difficulty in applying a fix.</li>
+
+              <li>This process can take some time, especially when coordination is required with maintainers of
+                other projects. Every effort will be made to handle the bug in as timely a manner as possible;
+                however, it’s important that we follow the release process above to ensure that the disclosure
+                is handled in a consistent manner.</li>
+            <ol>
+          </div>
+          <h2 class="divider line glow">Receiving Security Updates</h2>
+          <div class="banner-subcontent">
+            <ul>
+              <li><a href="https://github.com/open-policy-agent/opa/security/advisories">Security Advistories for OPA</a></li>
+              <li><a href="https://github.com/open-policy-agent/community/discussions/categories/announcements">GitHub Discussions</a> Announcements</li>
+              <li><a href="https://slack.openpolicyagent.org/">Slack</a> <code>#annoucements</code> channel</li>
+              <li><a href="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&isCpeNameSearch=false&cpe_vendor=cpe%3A%2F%3Aopenpolicyagent&cpe_product=cpe%3A%2F%3Aopenpolicyagent%3Aopen_policy_agent">NIST Vulnerability Data Base: Search Results for OPA</a></li>
+            </ul>
+          </div>
+        </section>
+      </main>
+    </div>
+
+    <!-- jQuery first, then Popper.js, then Bootstrap JS -->
+    <script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"
+            integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"
+            crossorigin="anonymous"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js"
+            integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1"
+            crossorigin="anonymous"></script>
+    <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js"
+            integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM"
+            crossorigin="anonymous"></script>
+  </body>
+
+</html>
diff --git a/docs/website/static/support.html b/docs/website/static/support.html
index 14d1adc8fa..ce4f9c0b9a 100644
--- a/docs/website/static/support.html
+++ b/docs/website/static/support.html
@@ -11,8 +11,8 @@
     <link rel="stylesheet" href="css/bootstrap.min.css">
 
     <title>Open Policy Agent | Support </title>
-    <link rel="stylesheet" href="/css/home.css">
-    <link rel="stylesheet" href="/css/support.css">
+    <link rel="stylesheet" href="css/home.css">
+    <link rel="stylesheet" href="css/support.css">
   </head>
 
   <body data-spy="scroll" data-target=".navbar" data-offset="90">
@@ -36,25 +36,14 @@
               </ul>
 
               <ul class="navbar-nav">
-                <li class="nav-item">
-                  <a class="nav-link" href="./docs/latest/">Documentation </a>
-                </li>
-                <li class="nav-item">
-                  <a class="nav-link" href="./docs/latest/#running-opa">Download </a>
-                </li>
-                <li class="nav-item">
-                  <a class="nav-link"
-                     href="./docs/latest/ecosystem/">Ecosystem </a>
-                </li>
-                <li class="nav-item">
-                  <a class="nav-link" href="./support">Support</a>
-                </li>
-                <li class="nav-item">
-                  <a class="nav-link" href="https://play.openpolicyagent.org/">Playground</a>
-                </li>
-                <li class="nav-item">
-                  <a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a>
-                </li>
+                <li class="nav-item"><a class="nav-link" href="./docs/">Docs</a></li>
+                <li class="nav-item"><a class="nav-link" href="./docs/#running-opa">Download</a></li>
+                <li class="nav-item"><a class="nav-link" href="./docs/latest/ecosystem/">Ecosystem</a></li>
+                <li class="nav-item"><a class="nav-link" href="./security">Security</a></li>
+                <li class="nav-item"><a class="nav-link" href="./support">Support</a></li>
+                <li class="nav-item"><a class="nav-link" href="./community">Community</a></li>
+                <li class="nav-item"><a class="nav-link" href="https://play.openpolicyagent.org/">Play</a></li>
+                <li class="nav-item"><a class="nav-link" href="https://blog.openpolicyagent.org/">Blog</a></li>
                 <li class="nav-item social-nav-item">
                   <a class="nav-link social-icon-link" href="https://twitter.com/openpolicyagent">
                     <img src="./img/twitter-icon.png" alt="Twitter">
@@ -93,10 +82,10 @@
           </div>
 
           <div class="container support-list">
-            <div class="card" onclick="window.open('https://registration.styra.com/openpolicyagentsupport')">
+            <div class="card" onclick="window.open('https://www.styra.com/styra-opa-support?utm_medium=partner&utm_source=opa&utm_campaign=dmge&utm_content=opa-support')">
               <div class="card-body">
                 <div class="support-card-content d-flex flex-row align-items-center flex-wrap-sm">
-                  <img class="card-img align-middle" src="../img/logos/styra-logo.png"/>
+                  <img class="card-img align-middle" src="./img/logos/styra-logo.png"/>
                   <div class="card-text">
                     <span class="align-middle">Styra is the original creator of Open Policy
                       Agent and provides support, professional services, training, and
diff --git a/download/config.go b/download/config.go
index 65d406ee81..bdf8e21d26 100644
--- a/download/config.go
+++ b/download/config.go
@@ -14,6 +14,12 @@ import (
 const (
 	defaultMinDelaySeconds = int64(60)
 	defaultMaxDelaySeconds = int64(120)
+
+	// deltaBundleMode indicates that OPA supports delta bundle processing
+	deltaBundleMode = "delta"
+
+	// defaultBundleMode indicates that OPA supports snapshot bundle processing
+	defaultBundleMode = "snapshot"
 )
 
 // PollingConfig represents polling configuration for the downloader.
diff --git a/download/download.go b/download/download.go
index f29f1575fb..9c611bb647 100644
--- a/download/download.go
+++ b/download/download.go
@@ -14,16 +14,14 @@ import (
 	"net/http"
 	"path"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 
-	"github.com/open-policy-agent/opa/plugins"
-
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/plugins"
 	"github.com/open-policy-agent/opa/plugins/rest"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -41,6 +39,7 @@ type Update struct {
 	Error   error
 	Metrics metrics.Metrics
 	Raw     io.Reader
+	Size    int
 }
 
 // Downloader implements low-level OPA bundle downloading. Downloader can be
@@ -64,6 +63,8 @@ type Downloader struct {
 	stopped            bool
 	persist            bool
 	longPollingEnabled bool
+	lazyLoadingMode    bool
+	bundleName         string
 }
 
 type downloaderResponse struct {
@@ -71,6 +72,7 @@ type downloaderResponse struct {
 	raw      io.Reader
 	etag     string
 	longPoll bool
+	size     int
 }
 
 // New returns a new Downloader that can be started.
@@ -117,6 +119,21 @@ func (d *Downloader) WithBundlePersistence(persist bool) *Downloader {
 	return d
 }
 
+// WithLazyLoadingMode specifies how the downloaded bundle should be read.
+// If true, data files in the bundle will not be deserialized
+// and the check to validate that the bundle data does not contain paths
+// outside the bundle's roots will not be performed while reading the bundle.
+func (d *Downloader) WithLazyLoadingMode(yes bool) *Downloader {
+	d.lazyLoadingMode = yes
+	return d
+}
+
+// WithBundleName specifies the name of the downloaded bundle.
+func (d *Downloader) WithBundleName(bundleName string) *Downloader {
+	d.bundleName = bundleName
+	return d
+}
+
 // ClearCache is deprecated. Use SetCache instead.
 func (d *Downloader) ClearCache() {
 	d.etag = ""
@@ -208,7 +225,7 @@ func (d *Downloader) loop(ctx context.Context) {
 		if err != nil {
 			delay = util.DefaultBackoff(float64(minRetryDelay), float64(*d.config.Polling.MaxDelaySeconds), retry)
 		} else {
-			if !d.longPollingEnabled {
+			if !d.longPollingEnabled || d.config.Polling.LongPollingTimeoutSeconds == nil {
 				// revert the response header timeout value on the http client's transport
 				if *d.client.Config().ResponseHeaderTimeoutSeconds == 0 {
 					d.client = d.client.SetResponseHeaderTimeout(&d.respHdrTimeoutSec)
@@ -251,7 +268,7 @@ func (d *Downloader) oneShot(ctx context.Context) error {
 	d.longPollingEnabled = resp.longPoll
 
 	if d.f != nil {
-		d.f(ctx, Update{ETag: resp.etag, Bundle: resp.b, Error: nil, Metrics: m, Raw: resp.raw})
+		d.f(ctx, Update{ETag: resp.etag, Bundle: resp.b, Error: nil, Metrics: m, Raw: resp.raw, Size: resp.size})
 	}
 	return nil
 }
@@ -260,8 +277,12 @@ func (d *Downloader) download(ctx context.Context, m metrics.Metrics) (*download
 	d.logger.Debug("Download starting.")
 
 	d.client = d.client.WithHeader("If-None-Match", d.etag)
+
+	preferences := []string{fmt.Sprintf("modes=%v,%v", defaultBundleMode, deltaBundleMode)}
+
 	if d.longPollingEnabled && d.config.Polling.LongPollingTimeoutSeconds != nil {
-		d.client = d.client.WithHeader("Prefer", fmt.Sprintf("wait=%s", strconv.FormatInt(*d.config.Polling.LongPollingTimeoutSeconds, 10)))
+		wait := fmt.Sprintf("wait=%s", strconv.FormatInt(*d.config.Polling.LongPollingTimeoutSeconds, 10))
+		preferences = append(preferences, wait)
 
 		// fetch existing response header timeout value on the http client's transport and
 		// clear it for the long poll request
@@ -271,15 +292,16 @@ func (d *Downloader) download(ctx context.Context, m metrics.Metrics) (*download
 			t := int64(0)
 			d.client = d.client.SetResponseHeaderTimeout(&t)
 		}
-	} else {
-		d.client = d.client.WithHeader("Prefer", "wait=0")
 	}
 
+	preferValue := fmt.Sprintf("%v", strings.Join(preferences, ";"))
+	d.client = d.client.WithHeader("Prefer", preferValue)
+
 	m.Timer(metrics.BundleRequest).Start()
 	resp, err := d.client.Do(ctx, "GET", d.path)
 	m.Timer(metrics.BundleRequest).Stop()
 	if err != nil {
-		return nil, errors.Wrap(err, "request failed")
+		return nil, fmt.Errorf("request failed: %w", err)
 	}
 
 	defer util.Close(resp)
@@ -293,18 +315,46 @@ func (d *Downloader) download(ctx context.Context, m metrics.Metrics) (*download
 			defer m.Timer(metrics.RegoLoadBundles).Stop()
 			baseURL := path.Join(d.client.Config().URL, d.path)
 
+			cnt := &count{}
+			r := io.TeeReader(resp.Body, cnt)
+
 			var loader bundle.DirectoryLoader
 			if d.persist {
-				tee := io.TeeReader(resp.Body, &buf)
+				tee := io.TeeReader(r, &buf)
 				loader = bundle.NewTarballLoaderWithBaseURL(tee, baseURL)
 			} else {
-				loader = bundle.NewTarballLoaderWithBaseURL(resp.Body, baseURL)
+				loader = bundle.NewTarballLoaderWithBaseURL(r, baseURL)
 			}
 
-			reader := bundle.NewCustomReader(loader).WithMetrics(m).WithBundleVerificationConfig(d.bvc)
+			etag := resp.Header.Get("ETag")
+
+			reader := bundle.NewCustomReader(loader).
+				WithMetrics(m).
+				WithBundleVerificationConfig(d.bvc).
+				WithBundleEtag(etag).
+				WithLazyLoadingMode(d.lazyLoadingMode).
+				WithBundleName(d.bundleName)
 			if d.sizeLimitBytes != nil {
 				reader = reader.WithSizeLimitBytes(*d.sizeLimitBytes)
 			}
+
+			if d.logger.GetLevel() >= logging.Debug {
+				expectedBundleContentType := []string{
+					"application/gzip",
+					"application/octet-stream",
+					"application/vnd.openpolicyagent.bundles",
+				}
+
+				contentType := resp.Header.Get("content-type")
+				if !contains(contentType, expectedBundleContentType) {
+					d.logger.Debug("Content-Type response header set to %v. Expected one of %v. "+
+						"Possibly not a bundle being downloaded.",
+						contentType,
+						expectedBundleContentType,
+					)
+				}
+			}
+
 			b, err := reader.Read()
 			if err != nil {
 				return nil, err
@@ -313,8 +363,9 @@ func (d *Downloader) download(ctx context.Context, m metrics.Metrics) (*download
 			return &downloaderResponse{
 				b:        &b,
 				raw:      &buf,
-				etag:     resp.Header.Get("ETag"),
+				etag:     etag,
 				longPoll: isLongPollSupported(resp.Header),
+				size:     cnt.Bytes(),
 			}, nil
 		}
 
@@ -336,15 +387,42 @@ func (d *Downloader) download(ctx context.Context, m metrics.Metrics) (*download
 			etag:     etag,
 			longPoll: d.longPollingEnabled,
 		}, nil
-	case http.StatusNotFound:
-		return nil, fmt.Errorf("server replied with not found")
-	case http.StatusUnauthorized:
-		return nil, fmt.Errorf("server replied with not authorized")
 	default:
-		return nil, fmt.Errorf("server replied with HTTP %v", resp.StatusCode)
+		return nil, HTTPError{StatusCode: resp.StatusCode}
 	}
 }
 
+type count struct {
+	total int
+}
+
+func (c *count) Write(p []byte) (n int, err error) {
+	n = len(p)
+	c.total += n
+	return
+}
+
+func (c *count) Bytes() int {
+	return c.total
+}
+
 func isLongPollSupported(header http.Header) bool {
 	return header.Get("Content-Type") == "application/vnd.openpolicyagent.bundles"
 }
+
+type HTTPError struct {
+	StatusCode int
+}
+
+func (e HTTPError) Error() string {
+	return fmt.Sprintf("server replied with %s", http.StatusText(e.StatusCode))
+}
+
+func contains(s string, strings []string) bool {
+	for _, str := range strings {
+		if s == str {
+			return true
+		}
+	}
+	return false
+}
diff --git a/download/download_test.go b/download/download_test.go
index e5db61b54a..f8508df33a 100644
--- a/download/download_test.go
+++ b/download/download_test.go
@@ -8,24 +8,19 @@
 package download
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
+	"errors"
 	"fmt"
-	"net/http"
-	"net/http/httptest"
 	"reflect"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/logging/test"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
-
-	"github.com/open-policy-agent/opa/bundle"
-	"github.com/open-policy-agent/opa/keys"
-	"github.com/open-policy-agent/opa/plugins/rest"
 )
 
 func TestStartStop(t *testing.T) {
@@ -58,6 +53,10 @@ func TestStartStop(t *testing.T) {
 		t.Fatalf("expected URL to have path as suffix but got %v and %v", u1.Bundle.Modules[0].URL, u1.Bundle.Modules[0].Path)
 	}
 
+	if u1.Size == 0 {
+		t.Fatal("expected non-0 size")
+	}
+
 	d.Stop(ctx)
 }
 
@@ -95,6 +94,10 @@ func TestStartStopWithBundlePersistence(t *testing.T) {
 		t.Fatal("expected bundle reader to be non-nil")
 	}
 
+	if u1.Size == 0 {
+		t.Fatal("expected non-0 size")
+	}
+
 	r := bundle.NewReader(u1.Raw)
 
 	b, err := r.Read()
@@ -153,6 +156,82 @@ func TestStopWithMultipleCalls(t *testing.T) {
 	}
 }
 
+func TestStartStopWithLazyLoadingMode(t *testing.T) {
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+
+	updates := make(chan *Update)
+
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	d := New(config, fixture.client, "/bundles/test/bundle1").WithCallback(func(_ context.Context, u Update) {
+		updates <- &u
+	}).WithLazyLoadingMode(true)
+
+	d.Start(ctx)
+
+	// Give time for some download events to occur
+	time.Sleep(1 * time.Second)
+
+	u1 := <-updates
+
+	if u1.Bundle == nil || len(u1.Bundle.Modules) == 0 {
+		t.Fatal("expected bundle with at least one module but got:", u1)
+	}
+
+	if !strings.HasSuffix(u1.Bundle.Modules[0].URL, u1.Bundle.Modules[0].Path) {
+		t.Fatalf("expected URL to have path as suffix but got %v and %v", u1.Bundle.Modules[0].URL, u1.Bundle.Modules[0].Path)
+	}
+
+	if len(u1.Bundle.Raw) == 0 {
+		t.Fatal("expected bundle to contain raw bytes")
+	}
+
+	if len(u1.Bundle.Data) != 0 {
+		t.Fatal("expected the bundle object to contain no data")
+	}
+
+	d.Stop(ctx)
+}
+
+func TestStartStopWithDeltaBundleMode(t *testing.T) {
+	ctx := context.Background()
+
+	updates := make(chan *Update)
+
+	config := Config{}
+
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	fixture := newTestFixture(t)
+
+	d := New(config, fixture.client, "/bundles/test/bundle2").WithCallback(func(_ context.Context, u Update) {
+		updates <- &u
+	})
+
+	d.Start(ctx)
+
+	// Give time for some download events to occur
+	time.Sleep(1 * time.Second)
+
+	u1 := <-updates
+
+	if u1.Bundle == nil || u1.Bundle.Manifest.Revision != deltaBundleMode {
+		t.Fatal("expected delta bundle but got:", u1)
+	}
+
+	if u1.Size == 0 {
+		t.Fatal("expected non-0 size")
+	}
+
+	d.Stop(ctx)
+}
+
 func TestStartStopWithLongPollNotSupported(t *testing.T) {
 	ctx := context.Background()
 
@@ -183,6 +262,42 @@ func TestStartStopWithLongPollNotSupported(t *testing.T) {
 	}
 }
 
+func TestStartStopWithLongPollSupportedByServer(t *testing.T) {
+	ctx := context.Background()
+
+	config := Config{}
+	min := int64(1)
+	max := int64(2)
+	config.Polling.MinDelaySeconds = &min
+	config.Polling.MaxDelaySeconds = &max
+
+	// simulate scenario where server supports long polling but long polling timeout not provided
+	config.Polling.LongPollingTimeoutSeconds = nil
+
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	fixture := newTestFixture(t)
+	fixture.d = New(config, fixture.client, "/bundles/test/bundle1").WithCallback(fixture.oneShot)
+	fixture.server.longPoll = true
+	defer fixture.server.stop()
+
+	fixture.d.Start(ctx)
+
+	// Give time for some download events to occur
+	time.Sleep(3 * time.Second)
+
+	fixture.d.Stop(ctx)
+	if len(fixture.updates) == 0 {
+		t.Fatal("expected update but got none")
+	}
+
+	if *fixture.d.client.Config().ResponseHeaderTimeoutSeconds == 0 {
+		t.Fatal("expected non-zero value for response header timeout")
+	}
+}
+
 func TestStartStopWithLongPollSupported(t *testing.T) {
 	ctx := context.Background()
 
@@ -339,6 +454,40 @@ func TestEtagCachingLifecycle(t *testing.T) {
 	}
 }
 
+func TestOneShotWithBundleEtag(t *testing.T) {
+
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+	fixture.d = New(Config{}, fixture.client, "/bundles/test/bundle1").WithCallback(fixture.oneShot)
+	fixture.server.expEtag = "some etag value"
+	defer fixture.server.stop()
+
+	// check etag on the downloader is empty
+	if fixture.d.etag != "" {
+		t.Fatalf("Expected empty downloader ETag but got %v", fixture.d.etag)
+	}
+
+	// simulate successful bundle activation and check updated etag on the downloader
+	fixture.server.expCode = 0
+	err := fixture.d.oneShot(ctx)
+	if err != nil {
+		t.Fatal("Unexpected:", err)
+	}
+
+	if fixture.d.etag != fixture.server.expEtag {
+		t.Fatalf("Expected downloader ETag %v but got %v", fixture.server.expEtag, fixture.d.etag)
+	}
+
+	if fixture.updates[0].Bundle == nil {
+		// 200 response on first request, bundle should be present
+		t.Errorf("Expected bundle in response")
+	}
+
+	if fixture.updates[0].Bundle.Etag != fixture.server.expEtag {
+		t.Fatalf("Expected bundle ETag %v but got %v", fixture.server.expEtag, fixture.updates[0].Bundle.Etag)
+	}
+}
+
 func TestFailureAuthn(t *testing.T) {
 
 	ctx := context.Background()
@@ -382,6 +531,13 @@ func TestFailureUnexpected(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error")
 	}
+	var hErr HTTPError
+	if !errors.As(err, &hErr) {
+		t.Fatal("expected HTTPError")
+	}
+	if hErr.StatusCode != 500 {
+		t.Fatal("expected status code 500")
+	}
 }
 
 func TestEtagInResponse(t *testing.T) {
@@ -489,7 +645,7 @@ func TestTriggerManualWithTimeout(t *testing.T) {
 	}
 
 	d := New(config, fixture.client, "/bundles/test/bundle1").
-		WithCallback(func(_ context.Context, u Update) {
+		WithCallback(func(context.Context, Update) {
 			time.Sleep(3 * time.Second) // this should cause the context deadline to exceed
 		})
 
@@ -512,12 +668,12 @@ func TestTriggerManualWithTimeout(t *testing.T) {
 		t.Fatal("Expected error but got nil")
 	}
 
-	exp := "context deadline exceeded"
-	if ctx.Err().Error() != exp {
-		t.Fatalf("Expected error %v but got %v", exp, ctx.Err().Error())
+	exp := context.DeadlineExceeded
+	if ctx.Err() != exp {
+		t.Fatalf("Expected error %v but got %v", exp, ctx.Err())
 	}
 
-	d.Stop(ctx)
+	d.Stop(context.Background())
 }
 
 func TestDownloadLongPollNotModifiedOn304(t *testing.T) {
@@ -546,7 +702,6 @@ func TestDownloadLongPollNotModifiedOn304(t *testing.T) {
 	if resp.longPoll != fixture.d.longPollingEnabled {
 		t.Fatalf("Expected same value for longPoll and longPollingEnabled")
 	}
-
 }
 
 func TestOneShotLongPollingSwitch(t *testing.T) {
@@ -584,7 +739,8 @@ func TestOneShotLongPollingSwitch(t *testing.T) {
 func TestOneShotNotLongPollingSwitch(t *testing.T) {
 	ctx := context.Background()
 	config := Config{}
-	config.Polling.LongPollingTimeoutSeconds = nil
+	timeout := int64(3)
+	config.Polling.LongPollingTimeoutSeconds = &timeout
 	if err := config.ValidateAndInjectDefaults(); err != nil {
 		t.Fatal(err)
 	}
@@ -599,7 +755,7 @@ func TestOneShotNotLongPollingSwitch(t *testing.T) {
 	if err != nil {
 		t.Fatal("Unexpected:", err)
 	}
-	if fixture.d.longPollingEnabled != true {
+	if !fixture.d.longPollingEnabled {
 		t.Fatal("Expected long polling to be enabled")
 	}
 
@@ -613,177 +769,39 @@ func TestOneShotNotLongPollingSwitch(t *testing.T) {
 	}
 }
 
-type testFixture struct {
-	d                         *Downloader
-	client                    rest.Client
-	server                    *testServer
-	updates                   []Update
-	mockBundleActivationError bool
-	etags                     map[string]string
-}
-
-func newTestFixture(t *testing.T) testFixture {
-
-	ts := testServer{
-		t:       t,
-		expAuth: "Bearer secret",
-		bundles: map[string]bundle.Bundle{
-			"test/bundle1": {
-				Manifest: bundle.Manifest{
-					Revision: "quickbrownfaux",
-				},
-				Data: map[string]interface{}{
-					"foo": map[string]interface{}{
-						"bar": json.Number("1"),
-						"baz": "qux",
-					},
-				},
-				Modules: []bundle.ModuleFile{
-					{
-						Path: `/example.rego`,
-						Raw:  []byte("package foo\n\ncorge=1"),
-					},
-				},
-			},
-		},
-	}
-
-	ts.start()
-
-	restConfig := []byte(fmt.Sprintf(`{
-		"url": %q,
-		"credentials": {
-			"bearer": {
-				"scheme": "Bearer",
-				"token": "secret"
-			}
-		}
-	}`, ts.server.URL))
-
-	tc, err := rest.New(restConfig, map[string]*keys.Config{})
+func TestWarnOnNonBundleContentType(t *testing.T) {
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+	fixture.server.bundles["not-a-bundle"] = bundle.Bundle{}
 
-	if err != nil {
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
 		t.Fatal(err)
 	}
 
-	return testFixture{
-		client:  tc,
-		server:  &ts,
-		updates: []Update{},
-		etags:   make(map[string]string),
-	}
-}
-
-func (t *testFixture) oneShot(ctx context.Context, u Update) {
-
-	t.updates = append(t.updates, u)
-
-	if u.Error != nil {
-		etag := t.etags["test/bundle1"]
-		t.d.SetCache(etag)
-		return
-	}
-
-	if u.Bundle != nil {
-		if t.mockBundleActivationError {
-			etag := t.etags["test/bundle1"]
-			t.d.SetCache(etag)
-			return
-		}
-	}
-
-	t.etags["test/bundle1"] = u.ETag
-}
-
-type testServer struct {
-	t                         *testing.T
-	expCode                   int
-	expEtag                   string
-	expAuth                   string
-	bundles                   map[string]bundle.Bundle
-	server                    *httptest.Server
-	etagInResponse            bool
-	longPoll                  bool
-	opaVendorMediaTypeEnabled bool
-}
-
-func (t *testServer) handle(w http.ResponseWriter, r *http.Request) {
-
-	if t.longPoll {
-		parts := strings.Split(r.Header.Get("Prefer"), "=")
-		if len(parts) != 2 {
-			panic("Invalid \"wait\" Preference")
-		}
+	d := New(config, fixture.client, "/bundles/not-a-bundle")
+	logger := test.New()
+	logger.SetLevel(logging.Debug)
+	d.logger = logger
 
-		timeout, err := strconv.Atoi(parts[1])
-		if err != nil {
-			panic(err)
-		}
-
-		// simulate long operation
-		time.Sleep(time.Duration(timeout) * time.Second)
-	}
-
-	if t.expCode != 0 {
-		w.WriteHeader(t.expCode)
-		return
-	}
+	d.Start(ctx)
 
-	if t.expAuth != "" {
-		if r.Header.Get("Authorization") != t.expAuth {
-			w.WriteHeader(401)
-			return
-		}
-	}
+	time.Sleep(1 * time.Second)
 
-	name := strings.TrimPrefix(r.URL.Path, "/bundles/")
-	b, ok := t.bundles[name]
-	if !ok {
-		w.WriteHeader(404)
-		return
-	}
+	d.Stop(ctx)
 
-	contentTypeShouldBeSend := true
-	if t.expEtag != "" {
-		etag := r.Header.Get("If-None-Match")
-		if etag == t.expEtag {
-			contentTypeShouldBeSend = false
-			if t.etagInResponse {
-				w.Header().Add("Etag", t.expEtag)
-			}
-			w.WriteHeader(304)
-			return
+	expectLogged := "Content-Type response header set to text/html. " +
+		"Expected one of [application/gzip application/octet-stream application/vnd.openpolicyagent.bundles]. " +
+		"Possibly not a bundle being downloaded."
+	var found bool
+	for _, entry := range logger.Entries() {
+		if entry.Message == expectLogged {
+			found = true
+			break
 		}
 	}
 
-	if t.longPoll && contentTypeShouldBeSend {
-		// in 304 Content-Type is not send according https://datatracker.ietf.org/doc/html/rfc7232#section-4.1
-		w.Header().Add("Content-Type", "application/vnd.openpolicyagent.bundles")
-	} else {
-		w.Header().Add("Content-Type", "application/gzip")
+	if !found {
+		t.Errorf("Expected log entry: %s", expectLogged)
 	}
-
-	if t.expEtag != "" {
-		w.Header().Add("Etag", t.expEtag)
-	}
-
-	w.WriteHeader(200)
-
-	var buf bytes.Buffer
-
-	if err := bundle.Write(&buf, b); err != nil {
-		w.WriteHeader(500)
-	}
-
-	if _, err := w.Write(buf.Bytes()); err != nil {
-		panic(err)
-	}
-}
-
-func (t *testServer) start() {
-	t.server = httptest.NewServer(http.HandlerFunc(t.handle))
-}
-
-func (t *testServer) stop() {
-	t.server.Close()
 }
diff --git a/download/oci_download.go b/download/oci_download.go
new file mode 100644
index 0000000000..1146608541
--- /dev/null
+++ b/download/oci_download.go
@@ -0,0 +1,435 @@
+package download
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math/rand"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/remotes/docker"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2"
+	oraslib "oras.land/oras-go/v2"
+	"oras.land/oras-go/v2/content/oci"
+
+	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/plugins"
+	"github.com/open-policy-agent/opa/plugins/rest"
+	"github.com/open-policy-agent/opa/util"
+)
+
+type OCIDownloader struct {
+	config         Config                        // downloader configuration for tuning polling and other downloader behaviour
+	client         rest.Client                   // HTTP client to use for bundle downloading
+	path           string                        // path for OCI image as <registry>/<org>/<repo>:<tag>
+	localStorePath string                        // path for the local OCI storage
+	trigger        chan chan struct{}            // channel to signal downloads when manual triggering is enabled
+	stop           chan chan struct{}            // used to signal plugin to stop running
+	f              func(context.Context, Update) // callback function invoked when download updates occur
+	sizeLimitBytes *int64                        // max bundle file size in bytes (passed to reader)
+	bvc            *bundle.VerificationConfig
+	wg             sync.WaitGroup
+	logger         logging.Logger
+	mtx            sync.Mutex
+	stopped        bool
+	persist        bool
+	store          *oci.Store
+	etag           string
+}
+
+// New returns a new Downloader that can be started.
+func NewOCI(config Config, client rest.Client, path, storePath string) *OCIDownloader {
+	localstore, err := oci.New(storePath)
+	if err != nil {
+		panic(err)
+	}
+	return &OCIDownloader{
+		config:         config,
+		path:           path,
+		localStorePath: storePath,
+		client:         client,
+		trigger:        make(chan chan struct{}),
+		stop:           make(chan chan struct{}),
+		logger:         client.Logger(),
+		store:          localstore,
+	}
+}
+
+// WithCallback registers a function f to be called when download updates occur.
+func (d *OCIDownloader) WithCallback(f func(context.Context, Update)) *OCIDownloader {
+	d.f = f
+	return d
+}
+
+// WithLogAttrs sets an optional set of key/value pair attributes to include in
+// log messages emitted by the downloader.
+func (d *OCIDownloader) WithLogAttrs(attrs map[string]interface{}) *OCIDownloader {
+	d.logger = d.logger.WithFields(attrs)
+	return d
+}
+
+// WithBundleVerificationConfig sets the key configuration used to verify a signed bundle
+func (d *OCIDownloader) WithBundleVerificationConfig(config *bundle.VerificationConfig) *OCIDownloader {
+	d.bvc = config
+	return d
+}
+
+// WithSizeLimitBytes sets the file size limit for bundles read by this downloader.
+func (d *OCIDownloader) WithSizeLimitBytes(n int64) *OCIDownloader {
+	d.sizeLimitBytes = &n
+	return d
+}
+
+// WithBundlePersistence specifies if the downloaded bundle will eventually be persisted to disk.
+func (d *OCIDownloader) WithBundlePersistence(persist bool) *OCIDownloader {
+	d.persist = persist
+	return d
+}
+
+// TODO: remove method ClearCache is deprecated. Use SetCache instead.
+func (d *OCIDownloader) ClearCache() {
+}
+
+// SetCache sets the etag value to the SHA of the loaded bundle
+func (d *OCIDownloader) SetCache(etag string) {
+	d.etag = etag
+}
+
+// Trigger can be used to control when the downloader attempts to download
+// a new bundle in manual triggering mode.
+func (d *OCIDownloader) Trigger(ctx context.Context) error {
+	done := make(chan error)
+
+	go func() {
+		err := d.oneShot(ctx)
+		if err != nil {
+			d.logger.Error("OCI - Bundle download failed: %v.", err)
+			if ctx.Err() == nil {
+				done <- err
+			}
+		}
+		close(done)
+	}()
+
+	select {
+	case err := <-done:
+		return err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// Start tells the Downloader to begin downloading bundles.
+func (d *OCIDownloader) Start(ctx context.Context) {
+	if *d.config.Trigger == plugins.TriggerPeriodic {
+		go d.doStart(ctx)
+	}
+}
+
+// Stop tells the Downloader to stop downloading bundles.
+func (d *OCIDownloader) Stop(context.Context) {
+	if *d.config.Trigger == plugins.TriggerManual {
+		return
+	}
+
+	d.mtx.Lock()
+	defer d.mtx.Unlock()
+
+	if d.stopped {
+		return
+	}
+
+	done := make(chan struct{})
+	d.stop <- done
+	<-done
+}
+
+func (d *OCIDownloader) doStart(context.Context) {
+	// We'll revisit context passing/usage later.
+	ctx, cancel := context.WithCancel(context.Background())
+
+	d.wg.Add(1)
+	go d.loop(ctx)
+
+	done := <-d.stop // blocks until there's something to read
+	cancel()
+	d.wg.Wait()
+	d.stopped = true
+	close(done)
+}
+
+func (d *OCIDownloader) loop(ctx context.Context) {
+	defer d.wg.Done()
+
+	var retry int
+
+	for {
+
+		var delay time.Duration
+
+		err := d.oneShot(ctx)
+
+		if ctx.Err() != nil {
+			return
+		}
+
+		if err != nil {
+			delay = util.DefaultBackoff(float64(minRetryDelay), float64(*d.config.Polling.MaxDelaySeconds), retry)
+		} else {
+			// revert the response header timeout value on the http client's transport
+			min := float64(*d.config.Polling.MinDelaySeconds)
+			max := float64(*d.config.Polling.MaxDelaySeconds)
+			delay = time.Duration(((max - min) * rand.Float64()) + min)
+		}
+
+		d.logger.Debug("OCI - Waiting %v before next download/retry.", delay)
+
+		select {
+		case <-time.After(delay):
+			if err != nil {
+				retry++
+			} else {
+				retry = 0
+			}
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (d *OCIDownloader) oneShot(ctx context.Context) error {
+	m := metrics.New()
+	resp, err := d.download(ctx, m)
+	if err != nil {
+		if d.f != nil {
+			d.f(ctx, Update{ETag: "", Bundle: nil, Error: err, Metrics: m, Raw: nil})
+		}
+		return err
+	}
+	d.SetCache(resp.etag) // set the current etag sha to the cache
+
+	if d.f != nil {
+		d.f(ctx, Update{ETag: resp.etag, Bundle: resp.b, Error: nil, Metrics: m, Raw: resp.raw})
+	}
+	return nil
+}
+
+func (d *OCIDownloader) download(ctx context.Context, m metrics.Metrics) (*downloaderResponse, error) {
+	d.logger.Debug("OCI - Download starting.")
+
+	preferences := []string{fmt.Sprintf("modes=%v,%v", defaultBundleMode, deltaBundleMode)}
+
+	preferValue := fmt.Sprintf("%v", strings.Join(preferences, ";"))
+	d.client = d.client.WithHeader("Prefer", preferValue)
+
+	m.Timer(metrics.BundleRequest).Start()
+	desc, err := d.pull(ctx, d.path)
+	if err != nil {
+		return &downloaderResponse{}, fmt.Errorf("failed to pull %s: %w", d.path, err)
+	}
+
+	manifest, err := manifestFromDesc(ctx, d.store, desc)
+	if err != nil {
+		return nil, err
+	}
+
+	tarballDescriptor := ocispec.Descriptor{}
+	for _, descriptor := range manifest.Layers {
+		if descriptor.MediaType == "application/vnd.oci.image.layer.v1.tar+gzip" {
+			tarballDescriptor = descriptor
+			break
+		}
+	}
+	if tarballDescriptor.MediaType == "" {
+		return nil, fmt.Errorf("no tarball descriptor found in the layers")
+	}
+	etag := tarballDescriptor.Digest.Hex()
+	bundleFilePath := filepath.Join(d.localStorePath, "blobs", "sha256", etag)
+	// if the downloader etag sha is the same with digest of the tarball it was already loaded
+	if d.etag == etag {
+		return &downloaderResponse{
+			b:        nil,
+			raw:      nil,
+			etag:     etag,
+			longPoll: false,
+		}, nil
+	}
+	fileReader, err := os.Open(bundleFilePath)
+	if err != nil {
+		return nil, err
+	}
+	loader := bundle.NewTarballLoaderWithBaseURL(fileReader, d.localStorePath)
+	reader := bundle.NewCustomReader(loader).WithBaseDir(d.localStorePath).
+		WithMetrics(m).
+		WithBundleVerificationConfig(d.bvc).
+		WithBundleEtag(etag)
+	bundleInfo, err := reader.Read()
+	if err != nil {
+		return &downloaderResponse{}, fmt.Errorf("unexpected error %w", err)
+	}
+
+	m.Timer(metrics.BundleRequest).Stop()
+
+	return &downloaderResponse{
+		b:        &bundleInfo,
+		raw:      fileReader,
+		etag:     etag,
+		longPoll: false,
+	}, nil
+}
+
+func (d *OCIDownloader) pull(ctx context.Context, ref string) (*ocispec.Descriptor, error) {
+	lookup := d.client.AuthPluginLookup()
+
+	plugin, err := d.client.Config().AuthPlugin(lookup)
+	if err != nil {
+		return nil, fmt.Errorf("failed to look up auth plugin: %w", err)
+	}
+
+	d.logger.Debug("OCIDownloader: using auth plugin: %T", plugin)
+
+	resolver, err := dockerResolver(plugin, d.client.Config(), d.logger)
+	if err != nil {
+		return nil, fmt.Errorf("invalid host url %s: %w", d.client.Config().URL, err)
+	}
+
+	target := remoteManager{
+		resolver: resolver,
+		srcRef:   ref,
+	}
+
+	manifestDescriptor, err := oraslib.Copy(ctx, &target, ref, d.store, "", oraslib.DefaultCopyOptions)
+	if err != nil {
+		return nil, fmt.Errorf("download for '%s' failed: %w", ref, err)
+	}
+
+	return &manifestDescriptor, nil
+}
+
+func dockerResolver(plugin rest.HTTPAuthPlugin, config *rest.Config, logger logging.Logger) (remotes.Resolver, error) {
+	client, err := plugin.NewClient(*config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create auth client: %w", err)
+	}
+
+	urlInfo, err := url.Parse(config.URL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse url: %w", err)
+	}
+
+	authorizer := pluginAuthorizer{
+		plugin: plugin,
+		logger: logger,
+	}
+
+	registryHost := docker.RegistryHost{
+		Host:         urlInfo.Host,
+		Scheme:       urlInfo.Scheme,
+		Capabilities: docker.HostCapabilityPull | docker.HostCapabilityResolve | docker.HostCapabilityPush,
+		Client:       client,
+		Path:         "/v2",
+		Authorizer:   &authorizer,
+	}
+
+	opts := docker.ResolverOptions{
+		Hosts: func(string) ([]docker.RegistryHost, error) {
+			return []docker.RegistryHost{registryHost}, nil
+		},
+	}
+
+	return docker.NewResolver(opts), nil
+}
+
+type pluginAuthorizer struct {
+	plugin rest.HTTPAuthPlugin
+
+	logger logging.Logger
+}
+
+var _ docker.Authorizer = &pluginAuthorizer{}
+
+func (a *pluginAuthorizer) AddResponses(context.Context, []*http.Response) error {
+	return fmt.Errorf("using custom authorizer: %w", errdefs.ErrNotImplemented)
+}
+
+// Authorize uses a rest.HTTPAuthPlugin to Prepare a request.
+func (a *pluginAuthorizer) Authorize(_ context.Context, req *http.Request) error {
+	if err := a.plugin.Prepare(req); err != nil {
+		err = fmt.Errorf("failed to prepare docker request: %w", err)
+
+		// Make sure to log this before passing the error back to docker
+		a.logger.Error(err.Error())
+
+		return err
+	}
+
+	return nil
+}
+
+func manifestFromDesc(ctx context.Context, target oras.Target, desc *ocispec.Descriptor) (*ocispec.Manifest, error) {
+	var manifest ocispec.Manifest
+
+	descReader, err := target.Fetch(ctx, *desc)
+	if err != nil {
+		return nil, fmt.Errorf("unable to fetch descriptor with digest %q: %w", desc.Digest, err)
+	}
+	defer descReader.Close()
+
+	descBytes, err := io.ReadAll(descReader)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read bytes from descriptor: %w", err)
+	}
+
+	if err = json.Unmarshal(descBytes, &manifest); err != nil {
+		return nil, fmt.Errorf("unable to unmarshal manifest: %w", err)
+	}
+
+	if len(manifest.Layers) < 1 {
+		return nil, fmt.Errorf("no layers in manifest")
+	}
+
+	return &manifest, nil
+}
+
+type remoteManager struct {
+	resolver remotes.Resolver
+	srcRef   string
+}
+
+func (r *remoteManager) Resolve(ctx context.Context, ref string) (ocispec.Descriptor, error) {
+	_, desc, err := r.resolver.Resolve(ctx, ref)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	return desc, nil
+}
+
+func (r *remoteManager) Fetch(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	fetcher, err := r.resolver.Fetcher(ctx, r.srcRef)
+	if err != nil {
+		return nil, err
+	}
+	return fetcher.Fetch(ctx, target)
+}
+
+func (r *remoteManager) Exists(ctx context.Context, target ocispec.Descriptor) (bool, error) {
+	_, err := r.Fetch(ctx, target)
+	if err == nil {
+		return true, nil
+	}
+
+	return !errdefs.IsNotFound(err), err
+}
diff --git a/download/oci_download_test.go b/download/oci_download_test.go
new file mode 100644
index 0000000000..f60c1513aa
--- /dev/null
+++ b/download/oci_download_test.go
@@ -0,0 +1,252 @@
+//go:build slow
+// +build slow
+
+package download
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/open-policy-agent/opa/keys"
+	"github.com/open-policy-agent/opa/plugins/rest"
+)
+
+func TestOCIStartStop(t *testing.T) {
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+	fixture.server.expAuth = "" // test on public registry
+	fixture.server.expEtag = "sha256:c5834dbce332cabe6ae68a364de171a50bf5b08024c27d7c08cc72878b4df7ff"
+
+	updates := make(chan *Update)
+
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	d := NewOCI(config, fixture.client, "ghcr.io/org/repo:latest", "/tmp/opa/").WithCallback(func(_ context.Context, u Update) {
+		updates <- &u
+	})
+
+	d.Start(ctx)
+
+	// Give time for some download events to occur
+	time.Sleep(1 * time.Second)
+
+	u1 := <-updates
+
+	if u1.Bundle == nil || len(u1.Bundle.Modules) == 0 {
+		t.Fatal("expected bundle with at least one module but got:", u1)
+	}
+
+	if !strings.HasSuffix(u1.Bundle.Modules[0].URL, u1.Bundle.Modules[0].Path) {
+		t.Fatalf("expected URL to have path as suffix but got %v and %v", u1.Bundle.Modules[0].URL, u1.Bundle.Modules[0].Path)
+	}
+
+	d.Stop(ctx)
+}
+
+func TestOCIBearerAuthPlugin(t *testing.T) {
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+	plainToken := "secret"
+	token := base64.StdEncoding.EncodeToString([]byte(plainToken)) // token should be base64 encoded
+	fixture.server.expAuth = fmt.Sprintf("Bearer %s", token)       // test on private repository
+	fixture.server.expEtag = "sha256:c5834dbce332cabe6ae68a364de171a50bf5b08024c27d7c08cc72878b4df7ff"
+
+	restConf := fmt.Sprintf(`{
+		"url": %q,
+		"type": "oci",
+		"credentials": {
+			"bearer": {
+				"token": %q
+			}
+		}
+	}`, fixture.server.server.URL, plainToken)
+
+	client, err := rest.New([]byte(restConf), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fixture.setClient(client)
+
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	d := NewOCI(config, fixture.client, "ghcr.io/org/repo:latest", "/tmp/oci")
+
+	if err := d.oneShot(ctx); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestOCIFailureAuthn(t *testing.T) {
+
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+	fixture.server.expAuth = "Bearer badsecret"
+	defer fixture.server.stop()
+
+	d := NewOCI(Config{}, fixture.client, "ghcr.io/org/repo:latest", "/tmp/oci")
+
+	err := d.oneShot(ctx)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if !strings.Contains(err.Error(), "401 Unauthorized") {
+		t.Fatal("expected 401 Unauthorized message")
+	}
+}
+
+func TestOCIEtag(t *testing.T) {
+	fixture := newTestFixture(t)
+	token := base64.StdEncoding.EncodeToString([]byte("secret")) // token should be base64 encoded
+	fixture.server.expAuth = fmt.Sprintf("Bearer %s", token)     // test on private repository
+	fixture.server.expEtag = "sha256:c5834dbce332cabe6ae68a364de171a50bf5b08024c27d7c08cc72878b4df7ff"
+
+	restConfig := []byte(fmt.Sprintf(`{
+		"url": %q,
+		"type": "oci",
+		"credentials": {
+			"bearer": {
+				"token": "secret"
+			}
+		}
+	}`, fixture.server.server.URL))
+
+	client, err := rest.New(restConfig, map[string]*keys.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fixture.setClient(client)
+
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	firstResponse := Update{ETag: ""}
+	d := NewOCI(config, fixture.client, "ghcr.io/org/repo:latest", "/tmp/oci").WithCallback(func(_ context.Context, u Update) {
+		if firstResponse.ETag == "" {
+			firstResponse = u
+			return
+		}
+
+		if u.ETag != firstResponse.ETag || u.Bundle != nil {
+			t.Fatal("expected nil bundle and same etag but got:", u)
+		}
+	})
+
+	// fill firstResponse
+	if err := d.oneShot(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	// Give time for some download events to occur
+	time.Sleep(1 * time.Second)
+
+	// second call to verify if nil bundle is returned and same etag
+	err = d.oneShot(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestOCIPublicRegistry(t *testing.T) {
+	ctx := context.Background()
+	fixture := newTestFixture(t)
+	fixture.server.expAuth = "" // Do not expect authorization header to be set
+
+	restConfig := []byte(fmt.Sprintf(`{
+		"url": %q,
+	}`, fixture.server.server.URL))
+
+	tc, err := rest.New(restConfig, map[string]*keys.Config{})
+	if err != nil {
+		t.Fatal("failed to create rest client without credentials")
+	}
+	fixture.setClient(tc) // set a client without configured credentials
+
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	d := NewOCI(config, fixture.client, "ghcr.io/org/repo:latest", "/tmp/oci")
+
+	err = d.oneShot(ctx)
+	if err != nil {
+		t.Fatal("unexpected error")
+	}
+}
+
+func TestOCICustomAuthPlugin(t *testing.T) {
+	fixture := newTestFixture(t)
+	defer fixture.server.stop()
+
+	restConfig := []byte(fmt.Sprintf(`{
+		"url": %q,
+		"credentials": {
+			"plugin": "my_plugin"
+		}
+	}`, fixture.server.server.URL))
+
+	client, err := rest.New(
+		restConfig,
+		map[string]*keys.Config{},
+		rest.AuthPluginLookup(mockAuthPluginLookup),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fixture.setClient(client)
+
+	config := Config{}
+	if err := config.ValidateAndInjectDefaults(); err != nil {
+		t.Fatal(err)
+	}
+
+	tmpDir := t.TempDir()
+
+	d := NewOCI(config, fixture.client, "ghcr.io/org/repo:latest", tmpDir)
+
+	if err := d.oneShot(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func mockAuthPluginLookup(string) rest.HTTPAuthPlugin {
+	return &mockAuthPlugin{}
+}
+
+type mockAuthPlugin struct{}
+
+func (p *mockAuthPlugin) NewClient(c rest.Config) (*http.Client, error) {
+	tlsConfig, err := rest.DefaultTLSConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	timeoutSec := 10
+
+	client := rest.DefaultRoundTripperClient(
+		tlsConfig,
+		int64(timeoutSec),
+	)
+
+	return client, nil
+}
+
+func (*mockAuthPlugin) Prepare(r *http.Request) error {
+	r.Header.Set("Authorization", "Bearer secret")
+	return nil
+}
diff --git a/build/fuzzer/corpus/00532.stmt b/download/testdata/config.layer
similarity index 100%
rename from build/fuzzer/corpus/00532.stmt
rename to download/testdata/config.layer
diff --git a/download/testdata/manifest.layer b/download/testdata/manifest.layer
new file mode 100644
index 0000000000..c83b4b361d
--- /dev/null
+++ b/download/testdata/manifest.layer
@@ -0,0 +1,19 @@
+{
+   "schemaVersion":2,
+   "config":{
+      "mediaType":"application/vnd.oci.image.config.v1+json",
+      "digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+      "size":2
+   },
+   "layers":[
+      {
+         "mediaType":"application/vnd.oci.image.layer.v1.tar+gzip",
+         "digest":"sha256:b206ac766b0f3f880f6a62c4bb5ba5192d29deaefd989a1961603346a7555bdd",
+         "size":568,
+         "annotations":{
+            "org.opencontainers.image.created":"2022-02-11T09:00:07Z",
+            "org.opencontainers.image.title":"dani/testpol"
+         }
+      }
+   ]
+}
\ No newline at end of file
diff --git a/download/testdata/tar.layer b/download/testdata/tar.layer
new file mode 100644
index 0000000000..ed4ab46d7f
Binary files /dev/null and b/download/testdata/tar.layer differ
diff --git a/download/testharness.go b/download/testharness.go
new file mode 100644
index 0000000000..52684223aa
--- /dev/null
+++ b/download/testharness.go
@@ -0,0 +1,316 @@
+//go:build slow
+// +build slow
+
+package download
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/keys"
+	"github.com/open-policy-agent/opa/plugins/rest"
+)
+
+type testFixture struct {
+	d                         *Downloader
+	client                    rest.Client
+	server                    *testServer
+	updates                   []Update
+	mockBundleActivationError bool
+	etags                     map[string]string
+}
+
+func newTestFixture(t *testing.T) testFixture {
+	t.Helper()
+
+	ts := newTestServer(t)
+	ts.start()
+
+	restConfig := []byte(fmt.Sprintf(`{
+			"url": %q,
+			"credentials": {
+				"bearer": {
+					"scheme": "Bearer",
+					"token": "secret"
+				}
+			}
+		}`, ts.server.URL))
+
+	tc, err := rest.New(restConfig, map[string]*keys.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return testFixture{
+		client:  tc,
+		server:  ts,
+		updates: []Update{},
+		etags:   make(map[string]string),
+	}
+}
+
+func (t *testFixture) setClient(client rest.Client) {
+	t.client = client
+}
+
+func (t *testFixture) oneShot(ctx context.Context, u Update) {
+
+	t.updates = append(t.updates, u)
+
+	if u.Error != nil {
+		etag := t.etags["test/bundle1"]
+		t.d.SetCache(etag)
+		return
+	}
+
+	if u.Bundle != nil {
+		if t.mockBundleActivationError {
+			etag := t.etags["test/bundle1"]
+			t.d.SetCache(etag)
+			return
+		}
+	}
+
+	t.etags["test/bundle1"] = u.ETag
+}
+
+type testServer struct {
+	t              *testing.T
+	expCode        int
+	expEtag        string
+	expAuth        string
+	bundles        map[string]bundle.Bundle
+	server         *httptest.Server
+	etagInResponse bool
+	longPoll       bool
+}
+
+func newTestServer(t *testing.T) *testServer {
+	return &testServer{
+		t:       t,
+		expAuth: "Bearer secret",
+		bundles: map[string]bundle.Bundle{
+			"test/bundle1": {
+				Manifest: bundle.Manifest{
+					Revision: "quickbrownfaux",
+				},
+				Data: map[string]interface{}{
+					"foo": map[string]interface{}{
+						"bar": json.Number("1"),
+						"baz": "qux",
+					},
+				},
+				Modules: []bundle.ModuleFile{
+					{
+						Path: `/example.rego`,
+						Raw:  []byte("package foo\n\ncorge=1"),
+					},
+				},
+			},
+			"test/bundle2": {
+				Manifest: bundle.Manifest{
+					Revision: deltaBundleMode,
+				},
+				Patch: bundle.Patch{Data: []bundle.PatchOperation{
+					{
+						Op:    "upsert",
+						Path:  "/a/c/d",
+						Value: []string{"foo", "bar"},
+					},
+				}},
+			},
+		},
+	}
+}
+
+func (t *testServer) handle(w http.ResponseWriter, r *http.Request) {
+
+	if t.longPoll {
+
+		var timeout time.Duration
+
+		wait := getPreferHeaderField(r, "wait")
+		if wait != "" {
+			waitTime, err := strconv.Atoi(wait)
+			if err != nil {
+				panic(err)
+			}
+			timeout = time.Duration(waitTime) * time.Second
+		}
+
+		// simulate long operation
+		time.Sleep(timeout)
+	}
+
+	if t.expCode != 0 {
+		w.WriteHeader(t.expCode)
+		return
+	}
+
+	if t.expAuth != "" {
+		if r.Header.Get("Authorization") != t.expAuth {
+			w.WriteHeader(401)
+			return
+		}
+	}
+
+	var buf bytes.Buffer
+
+	if r.URL.Path == "/v2/org/repo/manifests/latest" {
+		w.Header().Add("Content-Length", "596")
+		w.Header().Add("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+		w.Header().Add("Docker-Content-Digest", "sha256:fe9c2930b6d8cc1bf3fa0c560996a95c75f0d0668bee71138355d9784c8c99b8")
+		w.WriteHeader(200)
+		return
+	}
+	if r.URL.Path == "/v2/org/repo/manifests/sha256:fe9c2930b6d8cc1bf3fa0c560996a95c75f0d0668bee71138355d9784c8c99b8" {
+		w.Header().Add("Content-Length", "596")
+		w.Header().Add("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+		w.Header().Add("Docker-Content-Digest", "sha256:fe9c2930b6d8cc1bf3fa0c560996a95c75f0d0668bee71138355d9784c8c99b8")
+		w.WriteHeader(200)
+		bs, err := os.ReadFile("testdata/manifest.layer")
+		if err != nil {
+			w.WriteHeader(404)
+			return
+		}
+		buf.WriteString(string(bs))
+		w.Write(buf.Bytes())
+		return
+	}
+	if r.URL.Path == "/v2/org/repo/blobs/sha256:c5834dbce332cabe6ae68a364de171a50bf5b08024c27d7c08cc72878b4df7ff" {
+		w.Header().Add("Content-Length", "464")
+		w.Header().Add("Content-Type", "application/vnd.oci.image.layer.v1.tar+gzip,application/vnd.oci.image.config.v1+json")
+		w.Header().Add("Docker-Content-Digest", "sha256:c5834dbce332cabe6ae68a364de171a50bf5b08024c27d7c08cc72878b4df7ff")
+		w.WriteHeader(200)
+		bs, err := os.ReadFile("testdata/manifest.layer")
+		if err != nil {
+			w.WriteHeader(404)
+			return
+		}
+		buf.WriteString(string(bs))
+		buf.WriteTo(w)
+
+		return
+	}
+	if r.URL.Path == "/v2/org/repo/blobs/sha256:b206ac766b0f3f880f6a62c4bb5ba5192d29deaefd989a1961603346a7555bdd" {
+		w.Header().Add("Content-Length", "568")
+		w.Header().Add("Content-Type", "application/vnd.oci.image.layer.v1.tar+gzip")
+		w.Header().Add("Docker-Content-Digest", "sha256:b206ac766b0f3f880f6a62c4bb5ba5192d29deaefd989a1961603346a7555bdd")
+		w.WriteHeader(200)
+		bs, err := os.ReadFile("testdata/tar.layer")
+		if err != nil {
+			w.WriteHeader(404)
+			return
+		}
+		buf.WriteString(string(bs))
+		w.Write(buf.Bytes())
+		return
+	}
+	if r.URL.Path == "/v2/org/repo/blobs/sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a" {
+		w.Header().Add("Content-Length", "2")
+		w.Header().Add("Content-Type", "application/vnd.oci.image.config.v1+json")
+		w.Header().Add("Docker-Content-Digest", "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a")
+		w.WriteHeader(200)
+		bs, err := os.ReadFile("testdata/config.layer")
+		if err != nil {
+			w.WriteHeader(404)
+			return
+		}
+		buf.WriteString(string(bs))
+		w.Write(buf.Bytes())
+		return
+	}
+	name := strings.TrimPrefix(r.URL.Path, "/bundles/")
+	b, ok := t.bundles[name]
+	if !ok {
+		w.WriteHeader(404)
+		return
+	}
+
+	// check to verify if server can send a delta bundle to OPA
+	if b.Manifest.Revision == deltaBundleMode {
+		modes := strings.Split(getPreferHeaderField(r, "modes"), ",")
+
+		found := false
+		for _, m := range modes {
+			if m == deltaBundleMode {
+				found = true
+				break
+			}
+		}
+
+		if !found {
+			panic("delta bundle requested but OPA does not support it")
+		}
+	}
+
+	contentTypeShouldBeSend := true
+	if t.expEtag != "" {
+		etag := r.Header.Get("If-None-Match")
+		if etag == t.expEtag {
+			contentTypeShouldBeSend = false
+			if t.etagInResponse {
+				w.Header().Add("Etag", t.expEtag)
+			}
+			w.WriteHeader(304)
+			return
+		}
+	}
+
+	if t.longPoll && contentTypeShouldBeSend {
+		// in 304 Content-Type is not send according https://datatracker.ietf.org/doc/html/rfc7232#section-4.1
+		w.Header().Add("Content-Type", "application/vnd.openpolicyagent.bundles")
+	} else {
+		if r.URL.Path == "/bundles/not-a-bundle" {
+			w.Header().Add("Content-Type", "text/html")
+		} else {
+			w.Header().Add("Content-Type", "application/gzip")
+		}
+	}
+
+	if t.expEtag != "" {
+		w.Header().Add("Etag", t.expEtag)
+	}
+
+	w.WriteHeader(200)
+
+	if err := bundle.Write(&buf, b); err != nil {
+		w.WriteHeader(500)
+	}
+
+	if _, err := w.Write(buf.Bytes()); err != nil {
+		panic(err)
+	}
+}
+
+func (t *testServer) start() {
+	t.server = httptest.NewServer(http.HandlerFunc(t.handle))
+}
+
+func (t *testServer) stop() {
+	t.server.Close()
+}
+
+func getPreferHeaderField(r *http.Request, field string) string {
+	for _, line := range r.Header.Values("prefer") {
+		for _, part := range strings.Split(line, ";") {
+			preference := strings.Split(strings.TrimSpace(part), "=")
+			if len(preference) == 2 {
+				if strings.ToLower(preference[0]) == field {
+					return preference[1]
+				}
+			}
+		}
+	}
+	return ""
+}
diff --git a/features/tracing/tracing.go b/features/tracing/tracing.go
new file mode 100644
index 0000000000..a77ad4cc87
--- /dev/null
+++ b/features/tracing/tracing.go
@@ -0,0 +1,34 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package tracing
+
+import (
+	"net/http"
+
+	pkg_tracing "github.com/open-policy-agent/opa/tracing"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+)
+
+func init() {
+	pkg_tracing.RegisterHTTPTracing(&factory{})
+}
+
+type factory struct{}
+
+func (*factory) NewTransport(tr http.RoundTripper, opts pkg_tracing.Options) http.RoundTripper {
+	return otelhttp.NewTransport(tr, convertOpts(opts)...)
+}
+
+func (*factory) NewHandler(f http.Handler, label string, opts pkg_tracing.Options) http.Handler {
+	return otelhttp.NewHandler(f, label, convertOpts(opts)...)
+}
+
+func convertOpts(opts pkg_tracing.Options) []otelhttp.Option {
+	otelOpts := make([]otelhttp.Option, 0, len(opts))
+	for _, opt := range opts {
+		otelOpts = append(otelOpts, opt.(otelhttp.Option))
+	}
+	return otelOpts
+}
diff --git a/features/wasm/wasm.go b/features/wasm/wasm.go
index 8e8e52ea2d..23d03e95f6 100644
--- a/features/wasm/wasm.go
+++ b/features/wasm/wasm.go
@@ -64,7 +64,9 @@ func (o *OPA) Eval(ctx context.Context, opts opa.EvalOpts) (*opa.Result, error)
 		Time:                   opts.Time,
 		Seed:                   opts.Seed,
 		InterQueryBuiltinCache: opts.InterQueryBuiltinCache,
+		NDBuiltinCache:         opts.NDBuiltinCache,
 		PrintHook:              opts.PrintHook,
+		Capabilities:           opts.Capabilities,
 	}
 
 	res, err := o.opa.Eval(ctx, evalOptions)
diff --git a/format/format.go b/format/format.go
index dbe165d569..dffcea77fe 100644
--- a/format/format.go
+++ b/format/format.go
@@ -10,10 +10,27 @@ import (
 	"fmt"
 	"regexp"
 	"sort"
+	"strings"
 
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/future"
+	"github.com/open-policy-agent/opa/types"
 )
 
+// Opts lets you control the code formatting via `AstWithOpts()`.
+type Opts struct {
+	// IgnoreLocations instructs the formatter not to use the AST nodes' locations
+	// into account when laying out the code: notably, when the input is the result
+	// of partial evaluation, arguments maybe have been shuffled around, but still
+	// carry along their original source locations.
+	IgnoreLocations bool
+}
+
+// defaultLocationFile is the file name used in `Ast()` for terms
+// without a location, as could happen when pretty-printing the
+// results of partial eval.
+const defaultLocationFile = "__format_default__"
+
 // Source formats a Rego source file. The bytes provided must describe a complete
 // Rego module. If they don't, Source will return an error resulting from the attempt
 // to parse the bytes.
@@ -22,6 +39,7 @@ func Source(filename string, src []byte) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
+
 	formatted, err := Ast(module)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %v", filename, err)
@@ -43,7 +61,28 @@ func MustAst(x interface{}) []byte {
 // element, Ast returns nil and an error. If AST nodes are missing locations
 // an arbitrary location will be used.
 func Ast(x interface{}) ([]byte, error) {
+	return AstWithOpts(x, Opts{})
+}
 
+type fmtOpts struct {
+	// When the future keyword "contains" is imported, all the pretty-printed
+	// modules will use that format for partial sets.
+	// NOTE(sr): For ref-head rules, this will be the default behaviour, since
+	// we need "contains" to disambiguate complete rules from partial sets.
+	contains bool
+
+	// Same logic applies as for "contains": if `future.keywords.if` (or all
+	// future keywords) is imported, we'll render rules that can use `if` with
+	// `if`.
+	ifs bool
+
+	// We check all rule ref heads to see if any of them _requires_ support
+	// for ref heads -- if they do, we'll print all of them in a different way
+	// than if they don't.
+	refHeads bool
+}
+
+func AstWithOpts(x interface{}, opts Opts) ([]byte, error) {
 	// The node has to be deep copied because it may be mutated below. Alternatively,
 	// we could avoid the copy by checking if mutation will occur first. For now,
 	// since format is not latency sensitive, just deep copy in all cases.
@@ -55,7 +94,9 @@ func Ast(x interface{}) ([]byte, error) {
 	// or internal.member_3, it will sugarize them into usage of the `in`
 	// operator. It has to ensure that the proper future keyword import is
 	// present.
-	extraFutureKeywordImports := map[string]bool{}
+	extraFutureKeywordImports := map[string]struct{}{}
+
+	o := fmtOpts{}
 
 	// Preprocess the AST. Set any required defaults and calculate
 	// values required for printing the formatted output.
@@ -69,13 +110,34 @@ func Ast(x interface{}) ([]byte, error) {
 			unmangleWildcardVar(wildcards, n)
 
 		case *ast.Expr:
-			if n.IsCall() &&
-				ast.Member.Ref().Equal(n.Operator()) ||
-				ast.MemberWithKey.Ref().Equal(n.Operator()) {
-				extraFutureKeywordImports["in"] = true
+			switch {
+			case n.IsCall() && ast.Member.Ref().Equal(n.Operator()) || ast.MemberWithKey.Ref().Equal(n.Operator()):
+				extraFutureKeywordImports["in"] = struct{}{}
+			case n.IsEvery():
+				extraFutureKeywordImports["every"] = struct{}{}
+			}
+
+		case *ast.Import:
+			switch {
+			case future.IsAllFutureKeywords(n):
+				o.contains = true
+				o.ifs = true
+			case future.IsFutureKeyword(n, "contains"):
+				o.contains = true
+			case future.IsFutureKeyword(n, "if"):
+				o.ifs = true
+			}
+
+		case *ast.Rule:
+			if len(n.Head.Ref()) > 2 {
+				o.refHeads = true
+			}
+			if len(n.Head.Ref()) == 2 && n.Head.Key != nil && n.Head.Value == nil { // p.q contains "x"
+				o.refHeads = true
 			}
 		}
-		if x.Loc() == nil {
+
+		if opts.IgnoreLocations || x.Loc() == nil {
 			x.SetLoc(defaultLocation(x))
 		}
 		return false
@@ -83,6 +145,7 @@ func Ast(x interface{}) ([]byte, error) {
 
 	w := &writer{
 		indent: "\t",
+		errs:   make([]*ast.Error, 0),
 	}
 
 	switch x := x.(type) {
@@ -90,21 +153,25 @@ func Ast(x interface{}) ([]byte, error) {
 		for kw := range extraFutureKeywordImports {
 			x.Imports = ensureFutureKeywordImport(x.Imports, kw)
 		}
-		w.writeModule(x)
+		w.writeModule(x, o)
 	case *ast.Package:
 		w.writePackage(x, nil)
 	case *ast.Import:
 		w.writeImports([]*ast.Import{x}, nil)
 	case *ast.Rule:
-		w.writeRule(x, false, nil)
+		w.writeRule(x, false /* isElse */, o, nil)
 	case *ast.Head:
-		w.writeHead(x, false, false, nil)
+		w.writeHead(x,
+			false, // isDefault
+			false, // isExpandedConst
+			o,
+			nil)
 	case ast.Body:
 		w.writeBody(x, nil)
 	case *ast.Expr:
 		w.writeExpr(x, nil)
 	case *ast.With:
-		w.writeWith(x, nil)
+		w.writeWith(x, nil, false)
 	case *ast.Term:
 		w.writeTerm(x, nil)
 	case ast.Value:
@@ -115,6 +182,9 @@ func Ast(x interface{}) ([]byte, error) {
 		return nil, fmt.Errorf("not an ast element: %v", x)
 	}
 
+	if len(w.errs) > 0 {
+		return nil, w.errs
+	}
 	return squashTrailingNewlines(w.buf.Bytes()), nil
 }
 
@@ -154,7 +224,7 @@ func squashTrailingNewlines(bs []byte) []byte {
 }
 
 func defaultLocation(x ast.Node) *ast.Location {
-	return ast.NewLocation([]byte(x.String()), "", 1, 1)
+	return ast.NewLocation([]byte(x.String()), defaultLocationFile, 1, 1)
 }
 
 type writer struct {
@@ -165,9 +235,10 @@ type writer struct {
 	inline    bool
 	beforeEnd *ast.Comment
 	delay     bool
+	errs      ast.Errors
 }
 
-func (w *writer) writeModule(module *ast.Module) {
+func (w *writer) writeModule(module *ast.Module, o fmtOpts) {
 	var pkg *ast.Package
 	var others []interface{}
 	var comments []*ast.Comment
@@ -206,7 +277,7 @@ func (w *writer) writeModule(module *ast.Module) {
 		imports, others = gatherImports(others)
 		comments = w.writeImports(imports, comments)
 		rules, others = gatherRules(others)
-		comments = w.writeRules(rules, comments)
+		comments = w.writeRules(rules, o, comments)
 	}
 
 	for i, c := range comments {
@@ -236,16 +307,16 @@ func (w *writer) writeComments(comments []*ast.Comment) {
 	}
 }
 
-func (w *writer) writeRules(rules []*ast.Rule, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeRules(rules []*ast.Rule, o fmtOpts, comments []*ast.Comment) []*ast.Comment {
 	for _, rule := range rules {
 		comments = w.insertComments(comments, rule.Location)
-		comments = w.writeRule(rule, false, comments)
+		comments = w.writeRule(rule, false, o, comments)
 		w.blankLine()
 	}
 	return comments
 }
 
-func (w *writer) writeRule(rule *ast.Rule, isElse bool, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeRule(rule *ast.Rule, isElse bool, o fmtOpts, comments []*ast.Comment) []*ast.Comment {
 	if rule == nil {
 		return comments
 	}
@@ -264,13 +335,30 @@ func (w *writer) writeRule(rule *ast.Rule, isElse bool, comments []*ast.Comment)
 	// pretend that the rule has no body in this case.
 	isExpandedConst := rule.Body.Equal(ast.NewBody(ast.NewExpr(ast.BooleanTerm(true)))) && rule.Else == nil
 
-	comments = w.writeHead(rule.Head, rule.Default, isExpandedConst, comments)
+	comments = w.writeHead(rule.Head, rule.Default, isExpandedConst, o, comments)
+
+	// this excludes partial sets UNLESS `contains` is used
+	partialSetException := o.contains || rule.Head.Value != nil
 
-	if (len(rule.Body) == 0 || isExpandedConst) && !isElse {
+	if len(rule.Body) == 0 || isExpandedConst {
 		w.endLine()
 		return comments
 	}
 
+	if o.ifs && partialSetException {
+		w.write(" if")
+		if len(rule.Body) == 1 {
+			if rule.Body[0].Location.Row == rule.Head.Location.Row {
+				w.write(" ")
+				comments = w.writeExpr(rule.Body[0], comments)
+				w.endLine()
+				if rule.Else != nil {
+					comments = w.writeElse(rule, o, comments)
+				}
+				return comments
+			}
+		}
+	}
 	w.write(" {")
 	w.endLine()
 	w.up()
@@ -281,8 +369,10 @@ func (w *writer) writeRule(rule *ast.Rule, isElse bool, comments []*ast.Comment)
 
 	if len(rule.Head.Args) > 0 {
 		closeLoc = closingLoc('(', ')', '{', '}', rule.Location)
-	} else {
+	} else if rule.Head.Key != nil {
 		closeLoc = closingLoc('[', ']', '{', '}', rule.Location)
+	} else {
+		closeLoc = closingLoc(0, 0, '{', '}', rule.Location)
 	}
 
 	comments = w.insertComments(comments, closeLoc)
@@ -291,12 +381,12 @@ func (w *writer) writeRule(rule *ast.Rule, isElse bool, comments []*ast.Comment)
 	w.startLine()
 	w.write("}")
 	if rule.Else != nil {
-		comments = w.writeElse(rule, comments)
+		comments = w.writeElse(rule, o, comments)
 	}
 	return comments
 }
 
-func (w *writer) writeElse(rule *ast.Rule, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeElse(rule *ast.Rule, o fmtOpts, comments []*ast.Comment) []*ast.Comment {
 	// If there was nothing else on the line before the "else" starts
 	// then preserve this style of else block, otherwise it will be
 	// started as an "inline" else eg:
@@ -340,7 +430,8 @@ func (w *writer) writeElse(rule *ast.Rule, comments []*ast.Comment) []*ast.Comme
 		w.startLine()
 	}
 
-	rule.Else.Head.Name = "else"
+	rule.Else.Head.Name = "else" // NOTE(sr): whaaat
+	rule.Else.Head.Reference = ast.Ref{ast.VarTerm("else")}
 	rule.Else.Head.Args = nil
 	comments = w.insertComments(comments, rule.Else.Head.Location)
 
@@ -357,11 +448,23 @@ func (w *writer) writeElse(rule *ast.Rule, comments []*ast.Comment) []*ast.Comme
 		rule.Else.Head.Value.Location = rule.Else.Head.Location
 	}
 
-	return w.writeRule(rule.Else, true, comments)
+	return w.writeRule(rule.Else, true, o, comments)
 }
 
-func (w *writer) writeHead(head *ast.Head, isDefault bool, isExpandedConst bool, comments []*ast.Comment) []*ast.Comment {
-	w.write(head.Name.String())
+func (w *writer) writeHead(head *ast.Head, isDefault, isExpandedConst bool, o fmtOpts, comments []*ast.Comment) []*ast.Comment {
+	ref := head.Ref()
+	if head.Key != nil && head.Value == nil {
+		ref = ref.GroundPrefix()
+	}
+	if o.refHeads || len(ref) == 1 {
+		w.write(ref.String())
+	} else {
+		w.write(ref[0].String())
+		w.write("[")
+		w.write(ref[1].String())
+		w.write("]")
+	}
+
 	if len(head.Args) > 0 {
 		w.write("(")
 		var args []interface{}
@@ -372,9 +475,14 @@ func (w *writer) writeHead(head *ast.Head, isDefault bool, isExpandedConst bool,
 		w.write(")")
 	}
 	if head.Key != nil {
-		w.write("[")
-		comments = w.writeTerm(head.Key, comments)
-		w.write("]")
+		if o.contains && head.Value == nil {
+			w.write(" contains ")
+			comments = w.writeTerm(head.Key, comments)
+		} else if head.Value == nil { // no `if` for p[x] notation
+			w.write("[")
+			comments = w.writeTerm(head.Key, comments)
+			w.write("]")
+		}
 	}
 	if head.Value != nil && (head.Key != nil || ast.Compare(head.Value, ast.BooleanTerm(true)) != 0 || isExpandedConst || isDefault) {
 		if head.Assign {
@@ -400,10 +508,19 @@ func (w *writer) insertComments(comments []*ast.Comment, loc *ast.Location) []*a
 
 func (w *writer) writeBody(body ast.Body, comments []*ast.Comment) []*ast.Comment {
 	comments = w.insertComments(comments, body.Loc())
-	offset := 0
 	for i, expr := range body {
-		if i > 0 && expr.Location.Row-body[i-1].Location.Row-offset > 1 {
-			w.blankLine()
+		// Insert a blank line in before the expression if it was not right
+		// after the previous expression.
+		if i > 0 {
+			lastRow := body[i-1].Location.Row
+			for _, c := range body[i-1].Location.Text {
+				if c == '\n' {
+					lastRow++
+				}
+			}
+			if expr.Location.Row > lastRow+1 {
+				w.blankLine()
+			}
 		}
 		w.startLine()
 
@@ -426,6 +543,8 @@ func (w *writer) writeExpr(expr *ast.Expr, comments []*ast.Comment) []*ast.Comme
 	switch t := expr.Terms.(type) {
 	case *ast.SomeDecl:
 		comments = w.writeSomeDecl(t, comments)
+	case *ast.Every:
+		comments = w.writeEvery(t, comments)
 	case []*ast.Term:
 		comments = w.writeFunctionCall(expr, comments)
 	case *ast.Term:
@@ -434,7 +553,9 @@ func (w *writer) writeExpr(expr *ast.Expr, comments []*ast.Comment) []*ast.Comme
 
 	var indented bool
 	for i, with := range expr.With {
-		if i > 0 && with.Location.Row-expr.With[i-1].Location.Row > 0 {
+		if i == 0 || with.Location.Row == expr.With[i-1].Location.Row { // we're on the same line
+			comments = w.writeWith(with, comments, false)
+		} else { // we're on a new line
 			if !indented {
 				indented = true
 
@@ -443,8 +564,8 @@ func (w *writer) writeExpr(expr *ast.Expr, comments []*ast.Comment) []*ast.Comme
 			}
 			w.endLine()
 			w.startLine()
+			comments = w.writeWith(with, comments, true)
 		}
-		comments = w.writeWith(with, comments)
 	}
 
 	return comments
@@ -474,13 +595,34 @@ func (w *writer) writeSomeDecl(decl *ast.SomeDecl, comments []*ast.Comment) []*a
 				w.write(",")
 			}
 		case ast.Call:
-			comments = w.writeInOperator(false, val[1:], comments)
+			comments = w.writeInOperator(false, val[1:], comments, decl.Location, ast.BuiltinMap[val[0].String()].Decl)
 		}
 	}
 
 	return comments
 }
 
+func (w *writer) writeEvery(every *ast.Every, comments []*ast.Comment) []*ast.Comment {
+	comments = w.insertComments(comments, every.Location)
+	w.write("every ")
+	if every.Key != nil {
+		comments = w.writeTerm(every.Key, comments)
+		w.write(", ")
+	}
+	comments = w.writeTerm(every.Value, comments)
+	w.write(" in ")
+	comments = w.writeTerm(every.Domain, comments)
+	w.write(" {")
+	comments = w.writeComprehensionBody('{', '}', every.Body, every.Loc(), every.Loc(), comments)
+
+	if len(every.Body) == 1 &&
+		every.Body[0].Location.Row == every.Location.Row {
+		w.write(" ")
+	}
+	w.write("}")
+	return comments
+}
+
 func (w *writer) writeFunctionCall(expr *ast.Expr, comments []*ast.Comment) []*ast.Comment {
 
 	terms := expr.Terms.([]*ast.Term)
@@ -488,7 +630,7 @@ func (w *writer) writeFunctionCall(expr *ast.Expr, comments []*ast.Comment) []*a
 
 	switch operator {
 	case ast.Member.Name, ast.MemberWithKey.Name:
-		return w.writeInOperator(false, terms[1:], comments)
+		return w.writeInOperator(false, terms[1:], comments, terms[0].Location, ast.BuiltinMap[terms[0].String()].Decl)
 	}
 
 	bi, ok := ast.BuiltinMap[operator]
@@ -513,6 +655,9 @@ func (w *writer) writeFunctionCall(expr *ast.Expr, comments []*ast.Comment) []*a
 		comments = w.writeTerm(terms[2], comments)
 		return comments
 	}
+	// NOTE(Trolloldem): in this point we are operating with a built-in function with the
+	// wrong arity even when the assignment notation is used
+	w.errs = append(w.errs, ArityFormatMismatchError(terms[1:], terms[0].String(), terms[0].Location, bi.Decl))
 	return w.writeFunctionCallPlain(terms, comments)
 }
 
@@ -527,9 +672,12 @@ func (w *writer) writeFunctionCallPlain(terms []*ast.Term, comments []*ast.Comme
 	return w.writeIterable(args, loc, closingLoc(0, 0, '(', ')', loc), comments, w.listWriter())
 }
 
-func (w *writer) writeWith(with *ast.With, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeWith(with *ast.With, comments []*ast.Comment, indented bool) []*ast.Comment {
 	comments = w.insertComments(comments, with.Location)
-	w.write(" with ")
+	if !indented {
+		w.write(" ")
+	}
+	w.write("with ")
 	comments = w.writeTerm(with.Target, comments)
 	w.write(" as ")
 	return w.writeTerm(with.Value, comments)
@@ -571,7 +719,7 @@ func (w *writer) writeTermParens(parens bool, term *ast.Term, comments []*ast.Co
 	case ast.Var:
 		w.write(w.formatVar(x))
 	case ast.Call:
-		comments = w.writeCall(parens, x, comments)
+		comments = w.writeCall(parens, x, term.Location, comments)
 	case fmt.Stringer:
 		w.write(x.String())
 	}
@@ -623,7 +771,7 @@ func (w *writer) formatVar(v ast.Var) string {
 	return v.String()
 }
 
-func (w *writer) writeCall(parens bool, x ast.Call, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeCall(parens bool, x ast.Call, loc *ast.Location, comments []*ast.Comment) []*ast.Comment {
 	bi, ok := ast.BuiltinMap[x[0].String()]
 	if !ok || bi.Infix == "" {
 		return w.writeFunctionCallPlain(x, comments)
@@ -632,13 +780,22 @@ func (w *writer) writeCall(parens bool, x ast.Call, comments []*ast.Comment) []*
 	if bi.Infix == "in" {
 		// NOTE(sr): `in` requires special handling, mirroring what happens in the parser,
 		// since there can be one or two lhs arguments.
-		return w.writeInOperator(true, x[1:], comments)
+		return w.writeInOperator(true, x[1:], comments, loc, bi.Decl)
 	}
 
 	// TODO(tsandall): improve to consider precedence?
 	if parens {
 		w.write("(")
 	}
+
+	// NOTE(Trolloldem): writeCall is only invoked when the function call is a term
+	// of another function. The only valid arity is the one of the
+	// built-in function
+	if len(bi.Decl.Args()) != len(x)-1 {
+		w.errs = append(w.errs, ArityFormatMismatchError(x[1:], x[0].String(), loc, bi.Decl))
+		return comments
+	}
+
 	comments = w.writeTermParens(true, x[1], comments)
 	w.write(" " + bi.Infix + " ")
 	comments = w.writeTermParens(true, x[2], comments)
@@ -649,7 +806,16 @@ func (w *writer) writeCall(parens bool, x ast.Call, comments []*ast.Comment) []*
 	return comments
 }
 
-func (w *writer) writeInOperator(parens bool, operands []*ast.Term, comments []*ast.Comment) []*ast.Comment {
+func (w *writer) writeInOperator(parens bool, operands []*ast.Term, comments []*ast.Comment, loc *ast.Location, f *types.Function) []*ast.Comment {
+	if len(operands) != len(f.Args()) {
+		// The number of operands does not math the arity of the `in` operator
+		operator := ast.Member.Name
+		if len(f.Args()) == 3 {
+			operator = ast.MemberWithKey.Name
+		}
+		w.errs = append(w.errs, ArityFormatMismatchError(operands, operator, loc, f))
+		return comments
+	}
 	kw := "in"
 	switch len(operands) {
 	case 2:
@@ -755,7 +921,7 @@ func (w *writer) writeComprehension(open, close byte, term *ast.Term, body ast.B
 }
 
 func (w *writer) writeComprehensionBody(open, close byte, body ast.Body, term, compr *ast.Location, comments []*ast.Comment) []*ast.Comment {
-	var exprs []interface{}
+	exprs := make([]interface{}, 0, len(body))
 	for _, expr := range body {
 		exprs = append(exprs, expr)
 	}
@@ -872,24 +1038,40 @@ func (w *writer) listWriter() entryWriter {
 // location: anything on the same line will be put into a slice.
 func groupIterable(elements []interface{}, last *ast.Location) [][]interface{} {
 	// Generated vars occur in the AST when we're rendering the result of
-	// partial evaluation in a bundle build with optimization. For those vars,
-	// there is no location, and the grouping based on source location will
-	// yield a bad result. So if there's a generated variable among elements,
-	// we'll render the elements all in one line.
-	vis := ast.NewVarVisitor()
+	// partial evaluation in a bundle build with optimization.
+	// Those variables, and wildcard variables have the "default location",
+	// set in `Ast()`). That is no proper file location, and the grouping
+	// based on source location will yield a bad result.
+	// Another case is generated variables: they do have proper file locations,
+	// but their row/col information may no longer match their AST location.
+	// So, for generated variables, we also don't trust the location, but
+	// keep them ungrouped.
+	def := false // default location found?
 	for _, elem := range elements {
-		vis.Walk(elem)
-	}
-	for v := range vis.Vars() {
-		if v.IsGenerated() {
+		ast.WalkTerms(elem, func(t *ast.Term) bool {
+			if t.Location.File == defaultLocationFile {
+				def = true
+				return true
+			}
+			return false
+		})
+		ast.WalkVars(elem, func(v ast.Var) bool {
+			if v.IsGenerated() {
+				def = true
+				return true
+			}
+			return false
+		})
+		if def { // return as-is
 			return [][]interface{}{elements}
 		}
 	}
 	sort.Slice(elements, func(i, j int) bool {
 		return locLess(elements[i], elements[j])
 	})
+
 	var lines [][]interface{}
-	var cur []interface{}
+	cur := make([]interface{}, 0, len(elements))
 	for i, t := range elements {
 		elem := t
 		loc := getLoc(elem)
@@ -1190,12 +1372,49 @@ func (w *writer) down() {
 }
 
 func ensureFutureKeywordImport(imps []*ast.Import, kw string) []*ast.Import {
-	allKeywords := ast.MustParseTerm("future.keywords")
-	kwPath := ast.MustParseTerm("future.keywords." + kw)
 	for _, imp := range imps {
-		if allKeywords.Equal(imp.Path) || imp.Path.Equal(kwPath) {
+		if future.IsAllFutureKeywords(imp) ||
+			future.IsFutureKeyword(imp, kw) ||
+			(future.IsFutureKeyword(imp, "every") && kw == "in") { // "every" implies "in", so we don't need to add both
 			return imps
 		}
 	}
-	return append(imps, &ast.Import{Path: kwPath})
+	imp := &ast.Import{
+		Path: ast.MustParseTerm("future.keywords." + kw),
+	}
+	imp.Location = defaultLocation(imp)
+	return append(imps, imp)
+}
+
+// ArgErrDetail but for `fmt` checks since compiler has not run yet.
+type ArityFormatErrDetail struct {
+	Have []string `json:"have"`
+	Want []string `json:"want"`
+}
+
+// arityMismatchError but for `fmt` checks since the compiler has not run yet.
+func ArityFormatMismatchError(operands []*ast.Term, operator string, loc *ast.Location, f *types.Function) *ast.Error {
+	want := make([]string, len(f.Args()))
+	for i := range f.Args() {
+		want[i] = types.Sprint(f.Args()[i])
+	}
+
+	have := make([]string, len(operands))
+	for i := 0; i < len(operands); i++ {
+		have[i] = ast.TypeName(operands[i].Value)
+	}
+	err := ast.NewError(ast.TypeErr, loc, "%s: %s", operator, "arity mismatch")
+	err.Details = &ArityFormatErrDetail{
+		Have: have,
+		Want: want,
+	}
+	return err
+}
+
+// Lines returns the string representation of the detail.
+func (d *ArityFormatErrDetail) Lines() []string {
+	return []string{
+		"have: " + "(" + strings.Join(d.Have, ",") + ")",
+		"want: " + "(" + strings.Join(d.Want, ",") + ")",
+	}
 }
diff --git a/format/format_test.go b/format/format_test.go
index 85ab6a5bee..8d363210ff 100644
--- a/format/format_test.go
+++ b/format/format_test.go
@@ -7,7 +7,7 @@ package format
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -60,7 +60,7 @@ func TestFormatNilLocationFunctionArgs(t *testing.T) {
 
 func TestFormatSourceError(t *testing.T) {
 	rego := "testfiles/test.rego.error"
-	contents, err := ioutil.ReadFile(rego)
+	contents, err := os.ReadFile(rego)
 	if err != nil {
 		t.Fatalf("Failed to read rego source: %v", err)
 	}
@@ -85,12 +85,12 @@ func TestFormatSource(t *testing.T) {
 
 	for _, rego := range regoFiles {
 		t.Run(rego, func(t *testing.T) {
-			contents, err := ioutil.ReadFile(rego)
+			contents, err := os.ReadFile(rego)
 			if err != nil {
 				t.Fatalf("Failed to read rego source: %v", err)
 			}
 
-			expected, err := ioutil.ReadFile(rego + ".formatted")
+			expected, err := os.ReadFile(rego + ".formatted")
 			if err != nil {
 				t.Fatalf("Failed to read expected rego source: %v", err)
 			}
@@ -247,6 +247,53 @@ func TestFormatAST(t *testing.T) {
 			}}),
 			expected: `some x, y in xs`,
 		},
+		{
+			note: "every adds import if missing",
+			toFmt: ast.MustParseModuleWithOpts(`package test
+			p {
+				every k, v in [1, 2] { k != v }
+			}`,
+				ast.ParserOptions{FutureKeywords: []string{"every"}}),
+			expected: `package test
+
+import future.keywords.every
+
+p {
+	every k, v in [1, 2] { k != v }
+}`,
+		},
+		{
+			note: "every does not add import if all future KWs are there",
+			toFmt: ast.MustParseModuleWithOpts(`package test
+			import future.keywords
+			p {
+				every k, v in [1, 2] { k != v }
+			}`,
+				ast.ParserOptions{FutureKeywords: []string{"every"}}),
+			expected: `package test
+
+import future.keywords
+
+p if {
+	every k, v in [1, 2] { k != v }
+}`,
+		},
+		{
+			note: "every does not add import if already present",
+			toFmt: ast.MustParseModuleWithOpts(`package test
+			import future.keywords
+			p {
+				every k, v in [1, 2] { k != v }
+			}`,
+				ast.ParserOptions{FutureKeywords: []string{"every"}}),
+			expected: `package test
+
+import future.keywords
+
+p if {
+	every k, v in [1, 2] { k != v }
+}`,
+		},
 		{
 			note: "body shared wildcard",
 			toFmt: ast.Body{
@@ -333,6 +380,69 @@ a[_x[y]]`,
 			expected: `_x
 a[_x[y][[z, w]]]`,
 		},
+		{
+			note: "expr with wildcard that has a default location",
+			toFmt: func() *ast.Expr {
+				expr := ast.MustParseExpr(`["foo", _] = split(input.foo, ":")`)
+				ast.WalkTerms(expr, func(term *ast.Term) bool {
+					v, ok := term.Value.(ast.Var)
+					if ok && v.IsWildcard() {
+						term.Location = defaultLocation(term)
+						return true
+					}
+					term.Location.File = "foo.rego"
+					term.Location.Row = 2
+					return false
+				})
+				return expr
+			}(),
+			expected: `["foo", _] = split(input.foo, ":")`,
+		},
+		{
+			note: "expr all terms having empty-file locations",
+			toFmt: ast.MustParseExpr(`[
+					"foo",
+					_
+					] = split(input.foo, ":")`),
+			expected: `
+[
+	"foo",
+	_,
+] = split(input.foo, ":")`,
+		},
+		{
+			note: "expr where all terms having empty-file locations, and one is a default location",
+			toFmt: func() *ast.Expr {
+				expr := ast.MustParseExpr(`
+["foo", __local1__] = split(input.foo, ":")`)
+				ast.WalkTerms(expr, func(term *ast.Term) bool {
+					if ast.VarTerm("__local1__").Equal(term) {
+						term.Location = defaultLocation(term)
+						return true
+					}
+					return false
+				})
+				return expr
+			}(),
+			expected: `["foo", __local1__] = split(input.foo, ":")`,
+		},
+		{
+			note: "expr where generated var has an AST location not matching its source location",
+			toFmt: func() *ast.Expr {
+				e := ast.MustParseExpr(`__local0__ = concat(",", [__local1__])`)
+				ast.WalkTerms(e, func(t *ast.Term) bool {
+					t.Location.File = "t.rego"
+					return false
+				})
+				// mangling that may happen in PE
+				return ast.Concat.Expr(
+					e.Operand(1).Value.(ast.Call)[1],
+					e.Operand(1).Value.(ast.Call)[2],
+					e.Operand(0),
+				).SetLocation(e.Location)
+			}(),
+			expected: `concat(",", [__local1__], __local0__)`,
+		},
 	}
 
 	for _, tc := range cases {
@@ -344,7 +454,18 @@ a[_x[y][[z, w]]]`,
 			expected := strings.TrimSpace(tc.expected)
 			actual := strings.TrimSpace(string(bs))
 			if actual != expected {
-				t.Fatalf("Expected:\n\n%s\n\nGot:\n\n%s\n\n", expected, actual)
+				t.Fatalf("Expected:\n\n%q\n\nGot:\n\n%q\n\n", expected, actual)
+			}
+		})
+
+		// consistency check: disregarding source locations, it shouldn't panic
+		t.Run("no_loc/"+tc.note, func(t *testing.T) {
+			_, err := AstWithOpts(tc.toFmt, Opts{IgnoreLocations: true})
+			if err != nil {
+				t.Fatalf("Unexpected error: %s", err)
+			}
+			if err != nil {
+				t.Fatalf("Unexpected error: %s", err)
 			}
 		})
 	}
diff --git a/format/testfiles/test.rego b/format/testfiles/test.rego
index d73f41ac00..d24ddff211 100644
--- a/format/testfiles/test.rego
+++ b/format/testfiles/test.rego
@@ -195,18 +195,6 @@ declare1 := 1
 
 declare2 := 2 { false }
 
-multi_line_with {
-    fn(1) with input.a as "a"
-                with input.b as "b"
-            with input.c as {
-                "foo": "bar",
-            }
-                with input.d as [
-                    1,
-                    2,
-                    3]
-}
-
 # more comments!
 # more comments!
 # more comments!
diff --git a/format/testfiles/test.rego.formatted b/format/testfiles/test.rego.formatted
index cbb8e93132..d78027e32b 100644
--- a/format/testfiles/test.rego.formatted
+++ b/format/testfiles/test.rego.formatted
@@ -45,7 +45,6 @@ r = y {
 else = y {
 	y = ["howdy"]
 	x = {"x": {"y": "z"}}
-
 	a = {
 		"a": {"b": "c"},
 		"b": "c", "c": [
@@ -126,7 +125,6 @@ p[x] = y {
 		"d": "e",
 		# Comment before closing object brace.
 	} # Comment on closing object brace.
-
 	a = {"a": "b", "c": "d"}
 	b = [1, 2, 3, 4]
 	c = [
@@ -150,7 +148,6 @@ p[x] = y {
 		split("foo.bar", ".", x)
 		x[_]
 	]
-
 	g = [1 |
 		split("foo.bar", ".", x) # comment in array comprehension
 		x[_]
@@ -163,7 +160,6 @@ p[x] = y {
 		split("foo.bar", ".", x)
 		x[_]
 	}
-
 	k = {1 |
 		split("foo.bar", ".", x) # comment in set comprehension
 		x[_]
@@ -175,12 +171,10 @@ p[x] = y {
 		split("foo.bar", ".", x)
 		y = x[_]
 	}
-
 	n = {y: x |
 		split("foo.bar", ".", x)
 		y = x[_]
 	}
-
 	o = {y: x |
 		split("foo.bar", ".", x) # comment in object comprehension
 		y = x[_]
@@ -197,7 +191,6 @@ nested_infix {
 	f(x, y)
 	y = (x + 1) + 2
 	x = y + z # comment
-
 	x = (a + b) / 2
 	f((a + b) / 2)
 	y = q()
@@ -226,17 +219,6 @@ declare2 := 2 {
 	false
 }
 
-multi_line_with {
-	fn(1) with input.a as "a"
-		 with input.b as "b"
-		 with input.c as {"foo": "bar"}
-		 with input.d as [
-			1,
-			2,
-			3,
-		]
-}
-
 # more comments!
 # more comments!
 # more comments!
diff --git a/format/testfiles/test_assignments.rego b/format/testfiles/test_assignments.rego
new file mode 100644
index 0000000000..16b3710bb8
--- /dev/null
+++ b/format/testfiles/test_assignments.rego
@@ -0,0 +1,24 @@
+package assignments
+
+# default value assignment
+default a := 1
+
+# rule
+b := 2
+
+# else keyword
+c := 3 {
+	false
+} else := 4 {
+	true
+}
+
+# partial rule
+d[msg] := 5 {
+	msg = [1, 2, 3][_]
+}
+
+# function return value
+e := f(6)
+
+f(x) := x
diff --git a/format/testfiles/test_assignments.rego.formatted b/format/testfiles/test_assignments.rego.formatted
new file mode 100644
index 0000000000..a3d1589bc5
--- /dev/null
+++ b/format/testfiles/test_assignments.rego.formatted
@@ -0,0 +1,22 @@
+package assignments
+
+# default value assignment
+default a := 1
+
+# rule
+b := 2
+
+# else keyword
+c := 3 {
+	false
+} else := 4
+
+# partial rule
+d[msg] := 5 {
+	msg = [1, 2, 3][_]
+}
+
+# function return value
+e := f(6)
+
+f(x) := x
diff --git a/format/testfiles/test_contains.rego b/format/testfiles/test_contains.rego
new file mode 100644
index 0000000000..ba229ca974
--- /dev/null
+++ b/format/testfiles/test_contains.rego
@@ -0,0 +1,12 @@
+package test.contains
+import future.keywords.contains
+
+p contains "foo" { true }
+
+deny contains msg {
+  msg := "foo"
+}
+deny[msg] {msg := "bar" }
+
+# partial objects unchanged
+o[k] = v { k := "ok"; v := "nok" }
diff --git a/format/testfiles/test_contains.rego.formatted b/format/testfiles/test_contains.rego.formatted
new file mode 100644
index 0000000000..7b712fa9db
--- /dev/null
+++ b/format/testfiles/test_contains.rego.formatted
@@ -0,0 +1,19 @@
+package test.contains
+
+import future.keywords.contains
+
+p contains "foo"
+
+deny contains msg {
+	msg := "foo"
+}
+
+deny contains msg {
+	msg := "bar"
+}
+
+# partial objects unchanged
+o[k] = v {
+	k := "ok"
+	v := "nok"
+}
diff --git a/format/testfiles/test_contains_if.rego b/format/testfiles/test_contains_if.rego
new file mode 100644
index 0000000000..8506083c62
--- /dev/null
+++ b/format/testfiles/test_contains_if.rego
@@ -0,0 +1,17 @@
+package test.if
+
+import future.keywords
+
+q[x] = y if {
+	y := 10
+	x := "ten"
+}
+
+q[x] = y { # not using if
+	y := 11
+	x := "eleven"
+}
+
+r[x] { # no if here before
+	x := "set"
+}
diff --git a/format/testfiles/test_contains_if.rego.formatted b/format/testfiles/test_contains_if.rego.formatted
new file mode 100644
index 0000000000..8170c70ec2
--- /dev/null
+++ b/format/testfiles/test_contains_if.rego.formatted
@@ -0,0 +1,17 @@
+package test.if
+
+import future.keywords
+
+q[x] = y if {
+	y := 10
+	x := "ten"
+}
+
+q[x] = y if { # not using if
+	y := 11
+	x := "eleven"
+}
+
+r contains x if { # no if here before
+	x := "set"
+}
diff --git a/format/testfiles/test_end_of_rule_comment.rego b/format/testfiles/test_end_of_rule_comment.rego
new file mode 100644
index 0000000000..0c3bd75bee
--- /dev/null
+++ b/format/testfiles/test_end_of_rule_comment.rego
@@ -0,0 +1,7 @@
+package foo
+
+bar {
+	# before
+	input.bar
+	# after
+}
diff --git a/format/testfiles/test_end_of_rule_comment.rego.formatted b/format/testfiles/test_end_of_rule_comment.rego.formatted
new file mode 100644
index 0000000000..0c3bd75bee
--- /dev/null
+++ b/format/testfiles/test_end_of_rule_comment.rego.formatted
@@ -0,0 +1,7 @@
+package foo
+
+bar {
+	# before
+	input.bar
+	# after
+}
diff --git a/format/testfiles/test_every.rego b/format/testfiles/test_every.rego
new file mode 100644
index 0000000000..c8f0c1cd98
--- /dev/null
+++ b/format/testfiles/test_every.rego
@@ -0,0 +1,19 @@
+package p
+
+import future.keywords.every
+
+r {
+	every x in [1,3,5] {
+        is_odd(x)
+    }
+
+	every x in [1,3,5] { is_odd(x); true }
+
+	every x in [1,3,5] {
+        is_odd(x)
+        true
+        x < 10
+    }
+}
+
+is_odd(x) = x % 2 == 0
\ No newline at end of file
diff --git a/format/testfiles/test_every.rego.formatted b/format/testfiles/test_every.rego.formatted
new file mode 100644
index 0000000000..8e54b23eb4
--- /dev/null
+++ b/format/testfiles/test_every.rego.formatted
@@ -0,0 +1,19 @@
+package p
+
+import future.keywords.every
+
+r {
+	every x in [1, 3, 5] {
+		is_odd(x)
+	}
+
+	every x in [1, 3, 5] { is_odd(x); true}
+
+	every x in [1, 3, 5] {
+		is_odd(x)
+		true
+		x < 10
+	}
+}
+
+is_odd(x) = (x % 2) == 0
diff --git a/format/testfiles/test_every_with_key.rego b/format/testfiles/test_every_with_key.rego
new file mode 100644
index 0000000000..b8b6cbd8c1
--- /dev/null
+++ b/format/testfiles/test_every_with_key.rego
@@ -0,0 +1,21 @@
+package p
+
+import future.keywords.every
+
+r {
+	every i, x in [1,3,5] {
+        is_odd(x)
+        i < 10
+    }
+
+	every i, x in {"foo": 1, "bar": 3, "baz": 5} { is_odd(x); i != 20 }
+
+	every i, x in [1,3,5] {
+        is_odd(x)
+        true
+        x < 10
+        x > i
+    }
+}
+
+is_odd(x) = x % 2 == 0
\ No newline at end of file
diff --git a/format/testfiles/test_every_with_key.rego.formatted b/format/testfiles/test_every_with_key.rego.formatted
new file mode 100644
index 0000000000..2e8e3cfecf
--- /dev/null
+++ b/format/testfiles/test_every_with_key.rego.formatted
@@ -0,0 +1,21 @@
+package p
+
+import future.keywords.every
+
+r {
+	every i, x in [1, 3, 5] {
+		is_odd(x)
+		i < 10
+	}
+
+	every i, x in {"foo": 1, "bar": 3, "baz": 5} { is_odd(x); i != 20}
+
+	every i, x in [1, 3, 5] {
+		is_odd(x)
+		true
+		x < 10
+		x > i
+	}
+}
+
+is_odd(x) = (x % 2) == 0
diff --git a/format/testfiles/test_fun_args_with_linebreaks.rego.formatted b/format/testfiles/test_fun_args_with_linebreaks.rego.formatted
index e40e1fbf24..fce99c25cd 100644
--- a/format/testfiles/test_fun_args_with_linebreaks.rego.formatted
+++ b/format/testfiles/test_fun_args_with_linebreaks.rego.formatted
@@ -2,12 +2,10 @@ package test
 
 p {
 	x := count([1, 2, 3]) # four
-
 	y := concat(
 		"/",
 		["foo", "bar"],
 	)
-
 	z := concat(
 		"/",
 		[
diff --git a/format/testfiles/test_if.rego b/format/testfiles/test_if.rego
new file mode 100644
index 0000000000..5f7dca32b6
--- /dev/null
+++ b/format/testfiles/test_if.rego
@@ -0,0 +1,32 @@
+package test.if
+
+import future.keywords.if
+
+p if 1 > 0 # shorthand
+
+p if { 1 > 0 } # longhand one line
+
+p if {
+  1 > 0 # longhand two lines
+}
+
+# same without the comment
+p if {
+  1 > 0
+}
+
+p if { # comment one
+  1 > 0 # comment two
+}
+
+q[x] = y if {
+    y := 10
+    x := "ten"
+}
+
+q[x] = y { # not using if
+    y := 11
+    x := "eleven"
+}
+
+r[x] { x := "set" } # no if here before
diff --git a/format/testfiles/test_if.rego.formatted b/format/testfiles/test_if.rego.formatted
new file mode 100644
index 0000000000..b657f105fd
--- /dev/null
+++ b/format/testfiles/test_if.rego.formatted
@@ -0,0 +1,34 @@
+package test.if
+
+import future.keywords.if
+
+p if 1 > 0 # shorthand
+
+p if 1 > 0 # longhand one line
+
+p if {
+	1 > 0 # longhand two lines
+}
+
+# same without the comment
+p if {
+	1 > 0
+}
+
+p if { # comment one
+	1 > 0 # comment two
+}
+
+q[x] = y if {
+	y := 10
+	x := "ten"
+}
+
+q[x] = y if { # not using if
+	y := 11
+	x := "eleven"
+}
+
+r[x] { # no if here before
+	x := "set"
+}
diff --git a/format/testfiles/test_if_else.rego b/format/testfiles/test_if_else.rego
new file mode 100644
index 0000000000..8dabf52e2c
--- /dev/null
+++ b/format/testfiles/test_if_else.rego
@@ -0,0 +1,20 @@
+package test.if
+
+import future.keywords.if
+
+p := 1 if { 1 > 0 }
+else := 2
+
+q := 1 if { 1 > 0 } else := 2 { 2 > 1 }
+
+q := 1 if {
+  1 > 0
+  2 > 1
+} else := 2 { 2 > 1 }
+
+r := 1 if {
+  1 > 0
+}
+else := 2 {
+  2 > 1
+}
\ No newline at end of file
diff --git a/format/testfiles/test_if_else.rego.formatted b/format/testfiles/test_if_else.rego.formatted
new file mode 100644
index 0000000000..76aeb5639e
--- /dev/null
+++ b/format/testfiles/test_if_else.rego.formatted
@@ -0,0 +1,24 @@
+package test.if
+
+import future.keywords.if
+
+p := 1 if 1 > 0
+
+else := 2
+
+q := 1 if 1 > 0
+
+else := 2 if 2 > 1
+
+q := 1 if {
+	1 > 0
+	2 > 1
+} else := 2 if 2 > 1
+
+r := 1 if {
+	1 > 0
+}
+
+else := 2 if {
+	2 > 1
+}
diff --git a/format/testfiles/test_in_operator_with_all_keywords_import.rego.formatted b/format/testfiles/test_in_operator_with_all_keywords_import.rego.formatted
index 78ee143a58..2841f604c0 100644
--- a/format/testfiles/test_in_operator_with_all_keywords_import.rego.formatted
+++ b/format/testfiles/test_in_operator_with_all_keywords_import.rego.formatted
@@ -3,7 +3,7 @@ package p
 import future.keywords
 import input.foo
 
-r {
+r if {
 	1 in [1]
 	0, 1 in [1]
 }
diff --git a/format/testfiles/test_in_operator_without_import.rego.formatted b/format/testfiles/test_in_operator_without_import.rego.formatted
index efd6f755e7..040c28dfdb 100644
--- a/format/testfiles/test_in_operator_without_import.rego.formatted
+++ b/format/testfiles/test_in_operator_without_import.rego.formatted
@@ -1,6 +1,7 @@
 package p
 
 import future.keywords.in
+
 import input.foo
 
 r {
diff --git a/format/testfiles/test_issue_2299.rego b/format/testfiles/test_issue_2299.rego
index 5f1c5b74f0..5af69145d9 100644
--- a/format/testfiles/test_issue_2299.rego
+++ b/format/testfiles/test_issue_2299.rego
@@ -25,7 +25,8 @@ else = z {
 # Mixed compact and newline separated
 p = x {
     foo == "bar"
-} # some special case
+}
+# some special case
 # with lots of comments
 # describing it
 else = y {
diff --git a/format/testfiles/test_issue_4606.rego b/format/testfiles/test_issue_4606.rego
new file mode 100644
index 0000000000..a71142ed97
--- /dev/null
+++ b/format/testfiles/test_issue_4606.rego
@@ -0,0 +1,6 @@
+package p
+
+#
+import future.keywords.every
+
+r { 1 in [] }
\ No newline at end of file
diff --git a/format/testfiles/test_issue_4606.rego.formatted b/format/testfiles/test_issue_4606.rego.formatted
new file mode 100644
index 0000000000..ce00ead8c9
--- /dev/null
+++ b/format/testfiles/test_issue_4606.rego.formatted
@@ -0,0 +1,8 @@
+package p
+
+#
+import future.keywords.every
+
+r {
+	1 in []
+}
diff --git a/format/testfiles/test_issue_5348.rego b/format/testfiles/test_issue_5348.rego
new file mode 100644
index 0000000000..5ec68f16cd
--- /dev/null
+++ b/format/testfiles/test_issue_5348.rego
@@ -0,0 +1,5 @@
+package p
+
+f(x) {
+	true
+} else := false
diff --git a/format/testfiles/test_issue_5348.rego.formatted b/format/testfiles/test_issue_5348.rego.formatted
new file mode 100644
index 0000000000..5ec68f16cd
--- /dev/null
+++ b/format/testfiles/test_issue_5348.rego.formatted
@@ -0,0 +1,5 @@
+package p
+
+f(x) {
+	true
+} else := false
diff --git a/format/testfiles/test_issue_5449.rego b/format/testfiles/test_issue_5449.rego
new file mode 100644
index 0000000000..0ed8f65990
--- /dev/null
+++ b/format/testfiles/test_issue_5449.rego
@@ -0,0 +1,3 @@
+package demo
+
+foo["bar"] = "baz" { input }
diff --git a/format/testfiles/test_issue_5449.rego.formatted b/format/testfiles/test_issue_5449.rego.formatted
new file mode 100644
index 0000000000..1e0452fe09
--- /dev/null
+++ b/format/testfiles/test_issue_5449.rego.formatted
@@ -0,0 +1,5 @@
+package demo
+
+foo["bar"] = "baz" {
+	input
+}
diff --git a/format/testfiles/test_issue_5449_with_contains_ref_rule.rego b/format/testfiles/test_issue_5449_with_contains_ref_rule.rego
new file mode 100644
index 0000000000..b2223c007f
--- /dev/null
+++ b/format/testfiles/test_issue_5449_with_contains_ref_rule.rego
@@ -0,0 +1,9 @@
+# This is the same as test_issue_5449.rego, but with another rule
+# that gives the formatter the assurance that using ref rules is OK
+package demo
+
+import future.keywords.contains
+
+foo["bar"] = "baz" { input }
+
+a.deep contains "ref"
diff --git a/format/testfiles/test_issue_5449_with_contains_ref_rule.rego.formatted b/format/testfiles/test_issue_5449_with_contains_ref_rule.rego.formatted
new file mode 100644
index 0000000000..37794d61a0
--- /dev/null
+++ b/format/testfiles/test_issue_5449_with_contains_ref_rule.rego.formatted
@@ -0,0 +1,11 @@
+# This is the same as test_issue_5449.rego, but with another rule
+# that gives the formatter the assurance that using ref rules is OK
+package demo
+
+import future.keywords.contains
+
+foo.bar = "baz" {
+	input
+}
+
+a.deep contains "ref"
diff --git a/format/testfiles/test_issue_5449_with_ref_rule.rego b/format/testfiles/test_issue_5449_with_ref_rule.rego
new file mode 100644
index 0000000000..642767191a
--- /dev/null
+++ b/format/testfiles/test_issue_5449_with_ref_rule.rego
@@ -0,0 +1,7 @@
+# This is the same as test_issue_5449.rego, but with a rule that gives
+# the formatter the assurance that using ref rules is OK
+package demo
+
+foo["bar"] = "baz" { input }
+
+a.deep.ref := true
diff --git a/format/testfiles/test_issue_5449_with_ref_rule.rego.formatted b/format/testfiles/test_issue_5449_with_ref_rule.rego.formatted
new file mode 100644
index 0000000000..35f425701a
--- /dev/null
+++ b/format/testfiles/test_issue_5449_with_ref_rule.rego.formatted
@@ -0,0 +1,9 @@
+# This is the same as test_issue_5449.rego, but with a rule that gives
+# the formatter the assurance that using ref rules is OK
+package demo
+
+foo.bar = "baz" {
+	input
+}
+
+a.deep.ref := true
diff --git a/format/testfiles/test_ref_heads.rego b/format/testfiles/test_ref_heads.rego
new file mode 100644
index 0000000000..a55386ab59
--- /dev/null
+++ b/format/testfiles/test_ref_heads.rego
@@ -0,0 +1,13 @@
+package test
+
+import future.keywords
+
+a.b.c = "d" if true
+a.b.e = "f" if true
+a.b.g contains x if some x in numbers.range(1, 3)
+a.b.h[x] = 1 if x := "one"
+
+q[1] = y if true
+r[x] if x := 10
+p.q.r[x] if x := 10
+p.q.r[2] if true
diff --git a/format/testfiles/test_ref_heads.rego.formatted b/format/testfiles/test_ref_heads.rego.formatted
new file mode 100644
index 0000000000..5f23e3681b
--- /dev/null
+++ b/format/testfiles/test_ref_heads.rego.formatted
@@ -0,0 +1,19 @@
+package test
+
+import future.keywords
+
+a.b.c = "d"
+
+a.b.e = "f"
+
+a.b.g contains x if some x in numbers.range(1, 3)
+
+a.b.h[x] = 1 if x := "one"
+
+q[1] = y
+
+r[x] if x := 10
+
+p.q.r[x] if x := 10
+
+p.q.r[2] = true
diff --git a/format/testfiles/test_with.rego b/format/testfiles/test_with.rego
new file mode 100644
index 0000000000..5ff97ad8e7
--- /dev/null
+++ b/format/testfiles/test_with.rego
@@ -0,0 +1,38 @@
+package p
+
+single_line_with {
+  fn(1)   with input.a as "a"
+}
+
+multi_line_with {
+    fn(1) with input.a as "a"
+                with input.b as "b"
+            with input.c as {
+                "foo": "bar",
+            }
+                with input.d as [
+                    1,
+                    2,
+                    3]
+}
+
+mixed_new_lines_with {
+    true with input.a as "a"
+      with input.b as "b" with input.c as "c"
+      with input.d as "d"
+}
+
+mock_f(_) = 123
+
+func_replacements {
+    count(array.concat(input.x, [])) with input.x as "foo"
+    with array.concat as true
+    with count as mock_f
+}
+
+original(x) = x+1
+
+more_func_replacements {
+    original(1) with original as mock_f
+    original(1) with original as 1234
+}
\ No newline at end of file
diff --git a/format/testfiles/test_with.rego.formatted b/format/testfiles/test_with.rego.formatted
new file mode 100644
index 0000000000..538d356bf8
--- /dev/null
+++ b/format/testfiles/test_with.rego.formatted
@@ -0,0 +1,37 @@
+package p
+
+single_line_with {
+	fn(1) with input.a as "a"
+}
+
+multi_line_with {
+	fn(1) with input.a as "a"
+		with input.b as "b"
+		with input.c as {"foo": "bar"}
+		with input.d as [
+			1,
+			2,
+			3,
+		]
+}
+
+mixed_new_lines_with {
+	true with input.a as "a"
+		with input.b as "b" with input.c as "c"
+		with input.d as "d"
+}
+
+mock_f(_) = 123
+
+func_replacements {
+	count(array.concat(input.x, [])) with input.x as "foo"
+		with array.concat as true
+		with count as mock_f
+}
+
+original(x) = x + 1
+
+more_func_replacements {
+	original(1) with original as mock_f
+	original(1) with original as 1234
+}
diff --git a/go.mod b/go.mod
index 698d3edfda..d7ef60649e 100644
--- a/go.mod
+++ b/go.mod
@@ -1,44 +1,104 @@
 module github.com/open-policy-agent/opa
 
-go 1.16
+go 1.18
 
 require (
 	github.com/OneOfOne/xxhash v1.2.8
-	github.com/bytecodealliance/wasmtime-go v0.31.0
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/dgraph-io/badger/v3 v3.2103.2
-	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
+	github.com/agnivade/levenshtein v1.1.1
+	github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
+	github.com/bytecodealliance/wasmtime-go/v3 v3.0.2
+	github.com/containerd/containerd v1.6.19
+	github.com/dgraph-io/badger/v3 v3.2103.5
 	github.com/fortytw2/leaktest v1.3.0
-	github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897
-	github.com/fsnotify/fsnotify v1.5.1
+	github.com/foxcpp/go-mockdns v1.0.0
+	github.com/fsnotify/fsnotify v1.6.0
 	github.com/ghodss/yaml v1.0.0
-	github.com/go-ini/ini v1.66.2
+	github.com/go-ini/ini v1.67.0
+	github.com/go-logr/logr v1.2.4
 	github.com/gobwas/glob v0.2.3
-	github.com/golang/glog v1.0.0 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
+	github.com/golang/protobuf v1.5.3
 	github.com/gorilla/mux v1.8.0
-	github.com/klauspost/compress v1.13.5 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/miekg/dns v1.1.43 // indirect
-	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/olekukonko/tablewriter v0.0.5
-	github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d
-	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.11.0
-	github.com/prometheus/common v0.29.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/opencontainers/image-spec v1.1.0-rc2
+	github.com/peterh/liner v1.2.2
+	github.com/prometheus/client_golang v1.15.1
 	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
-	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/cobra v1.2.1
+	github.com/sirupsen/logrus v1.9.0
+	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.7.0
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/tchap/go-patricia/v2 v2.3.1
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
-	github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b
-	go.uber.org/automaxprocs v1.4.0
-	golang.org/x/net v0.0.0-20211111083644-e5c967477495
-	golang.org/x/sys v0.0.0-20211110154304-99a53858aa08 // indirect
-	golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba
-	google.golang.org/protobuf v1.27.1 // indirect
-	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
+	github.com/yashtewari/glob-intersection v0.1.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0
+	go.opentelemetry.io/otel v1.14.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.14.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0
+	go.opentelemetry.io/otel/sdk v1.14.0
+	go.opentelemetry.io/otel/trace v1.14.0
+	go.uber.org/automaxprocs v1.5.2
+	golang.org/x/net v0.10.0
+	golang.org/x/time v0.3.0
+	google.golang.org/grpc v1.55.0
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
 	gopkg.in/yaml.v2 v2.4.0
+	oras.land/oras-go/v2 v2.1.0
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/cespare/xxhash v1.1.0 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dgraph-io/ristretto v0.1.1 // indirect
+	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
+	github.com/dustin/go-humanize v1.0.0 // indirect
+	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/glog v1.1.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/flatbuffers v1.12.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/klauspost/compress v1.13.6 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/mattn/go-runewidth v0.0.9 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/miekg/dns v1.1.43 // indirect
+	github.com/moby/locker v1.0.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.42.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	go.opencensus.io v0.23.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0 // indirect
+	go.opentelemetry.io/otel/metric v0.34.0 // indirect
+	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+// glog is only used through badger, and only for fatal log-and-exit. However, it comes
+// at a cost, its init function will lookup the current user, and on Windows, that's much
+// work.
+replace github.com/golang/glog => ./build/replacements/github.com/golang/glog
+
+// retract directive comment below will be displayed as a warning on pkg.go.dev for the old package name. Please retain
+// this for future releases.
+
+// Use the path github.com/open-policy-agent/opa (lower-case), not github.com/open-policy-agent/OPA.
+// Before 0.15.0 OPA was not using go modules and the correct import path was not enforced.
+retract [v0.1.0-rc1, v0.14.2]
diff --git a/go.sum b/go.sum
index 025865cd34..4824a0c7a6 100644
--- a/go.sum
+++ b/go.sum
@@ -13,11 +13,6 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -26,7 +21,6 @@ cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4g
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -42,102 +36,97 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
+github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
+github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
+github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
-github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
-github.com/bytecodealliance/wasmtime-go v0.31.0 h1:AbMdV1pwjw/0Ito5yARcGzY366cq5NIiDk5vpy1c2Lw=
-github.com/bytecodealliance/wasmtime-go v0.31.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
+github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
+github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
+github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/containerd/containerd v1.6.19 h1:F0qgQPrG0P2JPgwpxWxYavrVeXAG0ezUIB9Z/4FTUAU=
+github.com/containerd/containerd v1.6.19/go.mod h1:HZCDMn4v/Xl2579/MvtOC2M206i+JJ6VxFWU/NetrGY=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
-github.com/cpuguy83/go-md2man/v2 v2.0.0 h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng4PGlyM=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgraph-io/badger/v3 v3.2103.2 h1:dpyM5eCJAtQCBcMCZcT4UBZchuTJgCywerHHgmxfxM8=
-github.com/dgraph-io/badger/v3 v3.2103.2/go.mod h1:RHo4/GmYcKKh5Lxu63wLEMHJ70Pac2JqZRYGhlyAo2M=
-github.com/dgraph-io/ristretto v0.1.0 h1:Jv3CGQHp9OjuMBSne1485aDpUkTKEcUqF+jm/LuerPI=
-github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug=
+github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
+github.com/dgraph-io/badger/v3 v3.2103.5/go.mod h1:4MPiseMeDQ3FNCYwRbbcBOGJLf5jsE0PPFzRiKjtcdw=
+github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
+github.com/dgraph-io/ristretto v0.1.1/go.mod h1:S1GPSBCYCIhmVNfcth17y2zZtQT6wzkzgwUve0VDWWA=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
 github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
 github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
+github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
-github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897 h1:E52jfcE64UG42SwLmrW0QByONfGynWuzBvm86BoB9z8=
-github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
+github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
+github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI=
-github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
+github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
+github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-ini/ini v1.66.2 h1:IxZmi/R4Yo7inPSXdoPtbL3rGyWaAm+Wy+QoornDenQ=
-github.com/go-ini/ini v1.66.2/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
-github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
-github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
@@ -145,7 +134,6 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -161,9 +149,9 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
@@ -178,15 +166,13 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -194,191 +180,121 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
-github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 h1:BZHcxBETFHIdVyhyEfOvn/RdU/QGdLI4y34qQGjGWO0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
-github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
-github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
-github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.13.5 h1:9O69jUPDcsT9fEm74W92rZL9FQY7rCdaXVneq+yyzl4=
-github.com/klauspost/compress v1.13.5/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/klauspost/compress v1.13.6 h1:P76CopJELS0TiO2mebmnzgWaajssP/EszplttgQxcgc=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
-github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=
 github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
-github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
+github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
+github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d h1:zapSxdmZYY6vJWXFKLQ+MkI+agc+HQyfrCGowDSHiKs=
-github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
-github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/peterh/liner v1.2.2 h1:aJ4AOodmL+JxOZZEL2u9iJf8omNRpqHc/EbrK+3mAXw=
+github.com/peterh/liner v1.2.2/go.mod h1:xFwJyiKIXJZUKItq5dGHZSTBRAuG/CpeNpWLyiNRNwI=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.0 h1:HNkLOAEQMIDv/K+04rukrLx6ch7msSRwf3/SASFAGtQ=
-github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
-github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
+github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.29.0 h1:3jqPBvKT4OHAbje2Ql7KeaaSicDBCxMYwEJU1zRJceE=
-github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0 h1:mxy4L2jP6qMonqmq+aTtOx1ifVWUgG/TAmntgbh3xv4=
-github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
+github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
+github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
+github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ=
 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNueLj0oo=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
-github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/cobra v1.2.1 h1:+KmjbUw1hriSNMF55oPrkZcb27aECyrj8V2ytv7kWDw=
-github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
+github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
-github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
+github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b h1:vVRagRXf67ESqAb72hG2C/ZwI8NtJF2u2V76EsuOHGY=
-github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b/go.mod h1:HptNXiXVDcJjXe9SqMd0v2FsL9f8dz4GnXgltU6q/co=
+github.com/yashtewari/glob-intersection v0.1.0 h1:6gJvMYQlTDOL3dMsPF6J0+26vwX9MB8/1q3uAdhmTrg=
+github.com/yashtewari/glob-intersection v0.1.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
-go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -387,18 +303,32 @@ go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0 h1:gqCw0LfLxScz8irSi8exQc7fyQ0fKQU/qnC/X8+V/1M=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/automaxprocs v1.4.0 h1:CpDZl6aOlLhReez+8S3eEotD7Jx0Os++lemPlMULQP0=
-go.uber.org/automaxprocs v1.4.0/go.mod h1:/mTEdr7LvHhs0v7mjdxDreTz1OG5zdZGqgOnhWiR/+Q=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0 h1:yt2NKzK7Vyo6h0+X8BA4FpreZQTlVEIarnsBP/H5mzs=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0/go.mod h1:+ARmXlUlc51J7sZeCBkBJNdHGySrdOzgzxp6VWRWM1U=
+go.opentelemetry.io/otel v1.14.0 h1:/79Huy8wbf5DnIPhemGB+zEPVwnN6fuQybr/SRXa6hM=
+go.opentelemetry.io/otel v1.14.0/go.mod h1:o4buv+dJzx8rohcUeRmWUZhqupFvzWis188WlggnNeU=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0 h1:/fXHZHGvro6MVqV34fJzDhi7sHGpX3Ej/Qjmfn003ho=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0/go.mod h1:UFG7EBMRdXyFstOwH028U0sVf+AvukSGhF0g8+dmNG8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.14.0 h1:TKf2uAs2ueguzLaxOCBXNpHxfO/aC7PAdDsSH0IbeRQ=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.14.0/go.mod h1:HrbCVv40OOLTABmOn1ZWty6CHXkU8DK/Urc43tHug70=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 h1:ap+y8RXX3Mu9apKVtOkM6WSFESLM8K3wNQyOU8sWHcc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0/go.mod h1:5w41DY6S9gZrbjuq6Y+753e96WfPha5IcsOSZTtullM=
+go.opentelemetry.io/otel/metric v0.34.0 h1:MCPoQxcg/26EuuJwpYN1mZTeCYAUGx8ABxfW07YkjP8=
+go.opentelemetry.io/otel/metric v0.34.0/go.mod h1:ZFuI4yQGNCupurTXCwkeD/zHBt+C2bR7bw5JqUm/AP8=
+go.opentelemetry.io/otel/sdk v1.14.0 h1:PDCppFRDq8A1jL9v6KMI6dYesaq+DFcDZvjsoGvxGzY=
+go.opentelemetry.io/otel/sdk v1.14.0/go.mod h1:bwIC5TjrNG6QDCHNWvW4HLHtUQ4I+VQDsnjhvyZCALM=
+go.opentelemetry.io/otel/trace v1.14.0 h1:wp2Mmvj41tDsyAJXiWDWpfNsOiIyd38fy85pyKcFq/M=
+go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
+go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.uber.org/automaxprocs v1.5.2 h1:2LxUOGiR3O6tw8ui5sZa2LAaHnsviZdVOUZw4fvbnME=
+go.uber.org/automaxprocs v1.5.2/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
+go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -424,8 +354,6 @@ golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -434,14 +362,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -449,7 +371,6 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -469,29 +390,17 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211111083644-e5c967477495 h1:cjxxlQm6d4kYbhpZ2ghvmI8xnq0AG+jXmzrhzfkyu5A=
-golang.org/x/net v0.0.0-20211111083644-e5c967477495/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -501,19 +410,14 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -522,11 +426,8 @@ golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -539,51 +440,38 @@ golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211110154304-99a53858aa08 h1:WecRHqgE09JBkh/584XIE6PMz5KKE/vER4izNUi30AQ=
-golang.org/x/sys v0.0.0-20211110154304-99a53858aa08/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20221010170243-090e33056c14/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba h1:O8mE0/t419eoIwhTFpKVkHiTs/Igowgfkj25AcZrtiE=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
@@ -594,7 +482,6 @@ golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -621,18 +508,10 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -650,19 +529,12 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.44.0/go.mod h1:EBOGZqzyhtvMDoxwS97ctnh0zUmYY6CxqXsc1AvkYD8=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -693,17 +565,9 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 h1:DdoeryqhaXp1LtT/emMP1BRJPHHKFi5akj/nbx/zNTA=
+google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -716,14 +580,13 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
+google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
+google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -736,28 +599,24 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
+google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -765,6 +624,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+oras.land/oras-go/v2 v2.1.0 h1:1nS8BIeEP6CBVQifwxrsth2bkuD+cYfjp7Hf7smUcS8=
+oras.land/oras-go/v2 v2.1.0/go.mod h1:v5ZSAPIMEJYnZjZ6rTGPAyaonH+rCFmbE95IAzCTeGU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/internal/bundle/inspect/inspect.go b/internal/bundle/inspect/inspect.go
index 9d293b74db..f6d61d54e3 100644
--- a/internal/bundle/inspect/inspect.go
+++ b/internal/bundle/inspect/inspect.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"os"
 	"path/filepath"
 	"strings"
 
@@ -24,35 +25,74 @@ type Info struct {
 	Signatures  bundle.SignaturesConfig  `json:"signatures_config,omitempty"`
 	WasmModules []map[string]interface{} `json:"wasm_modules,omitempty"`
 	Namespaces  map[string][]string      `json:"namespaces,omitempty"`
+	Annotations []*ast.AnnotationsRef    `json:"annotations,omitempty"`
 }
 
-func File(path string) (*Info, error) {
-	b, err := loader.NewFileLoader().WithSkipBundleVerification(true).AsBundle(path)
+func File(path string, includeAnnotations bool) (*Info, error) {
+	b, err := loader.NewFileLoader().
+		WithSkipBundleVerification(true).
+		WithProcessAnnotation(true). // Always process annotations, for enriching namespace listing
+		WithJSONOptions(&ast.JSONOptions{
+			MarshalOptions: ast.JSONMarshalOptions{
+				IncludeLocation: ast.NodeToggle{
+					// Annotation location data is only included if includeAnnotations is set
+					AnnotationsRef: includeAnnotations,
+				},
+			},
+		}).
+		AsBundle(path)
 	if err != nil {
 		return nil, err
 	}
 
 	bi := &Info{Manifest: b.Manifest}
 
-	namespaces := map[string][]string{}
+	namespaces := make(map[string][]string, len(b.Modules))
+	modules := make([]*ast.Module, 0, len(b.Modules))
 	for _, m := range b.Modules {
 		namespaces[m.Parsed.Package.Path.String()] = append(namespaces[m.Parsed.Package.Path.String()], filepath.Clean(m.Path))
+		modules = append(modules, m.Parsed)
 	}
 	bi.Namespaces = namespaces
 
+	if includeAnnotations {
+		as, errs := ast.BuildAnnotationSet(modules)
+		if len(errs) > 0 {
+			return nil, errs
+		}
+		flattened := as.Flatten()
+
+		for _, wr := range bi.Manifest.WasmResolvers {
+			if as := wr.Annotations; len(as) > 0 {
+				path, err := ast.PtrRef(ast.DefaultRootDocument, wr.Entrypoint)
+				if err != nil {
+					return nil, fmt.Errorf("failed to parse Wasm entrypoint in manifest: %s", err)
+				}
+				for _, a := range as {
+					ar := ast.NewAnnotationsRef(a)
+					ar.Path = path
+					ar.Location = ast.NewLocation(nil, wr.Module, 0, 0)
+					flattened = flattened.Insert(ar)
+				}
+			}
+		}
+
+		bi.Annotations = flattened
+	}
+
 	err = bi.getBundleDataWasmAndSignatures(path)
 	if err != nil {
 		return nil, err
 	}
 
-	wasmModules := []map[string]interface{}{}
+	wasmModules := make([]map[string]interface{}, 0, len(b.WasmModules))
 	for _, w := range b.WasmModules {
 		wasmModule := map[string]interface{}{
 			"url":  w.URL,
 			"path": w.Path,
 		}
 
-		entrypoints := []string{}
+		var entrypoints []string
 		for _, r := range w.Entrypoints {
 			entrypoints = append(entrypoints, r.String())
 		}
@@ -114,11 +154,11 @@ func (bi *Info) getBundleDataWasmAndSignatures(name string) error {
 
 	for _, f := range descriptors {
 		path := filepath.Clean(f.Path())
-		key := strings.Split(strings.TrimPrefix(path, "/"), "/")
+		key := strings.Split(strings.TrimPrefix(path, string(os.PathSeparator)), string(os.PathSeparator))
 
 		value := path
 		if bl.IsDir {
-			value = f.URL()
+			value = filepath.Clean(f.URL())
 		}
 
 		if len(key) > 1 {
diff --git a/internal/bundle/inspect/inspect_test.go b/internal/bundle/inspect/inspect_test.go
index 00cc4a21cc..47ab7f453f 100644
--- a/internal/bundle/inspect/inspect_test.go
+++ b/internal/bundle/inspect/inspect_test.go
@@ -5,11 +5,13 @@
 package inspect
 
 import (
+	"encoding/json"
 	"fmt"
 	"os"
 	"path"
 	"path/filepath"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -31,7 +33,7 @@ func TestGenerateBundleInfoWithFileDir(t *testing.T) {
 	}
 
 	test.WithTempFS(files, func(rootDir string) {
-		info, err := File(rootDir)
+		info, err := File(rootDir, false)
 		if err != nil {
 			t.Fatalf("Unexpected error: %v", err)
 		}
@@ -60,6 +62,39 @@ func TestGenerateBundleInfoWithFileDir(t *testing.T) {
 	})
 }
 
+func TestBundleInfoHasAnnotationLocationDataSet(t *testing.T) {
+
+	files := map[string]string{
+		"/fuz/fuz.rego": `# METADATA
+# title: My package
+package fuz
+
+p = 1`,
+	}
+
+	test.WithTempFS(files, func(rootDir string) {
+		info, err := File(rootDir, true)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		if got, exp := len(info.Annotations), 1; got != exp {
+			t.Fatalf("expected %d annotation, but got: %d", exp, got)
+		}
+
+		bs, err := json.Marshal(info.Annotations[0])
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+
+		exp := fmt.Sprintf(`"location":{"file":"%s/fuz/fuz.rego","row":3,"col":1}`, rootDir)
+
+		if got := string(bs); !strings.Contains(got, exp) {
+			t.Fatalf("expected to find %q in %q", exp, got)
+		}
+	})
+}
+
 func TestGenerateBundleInfoWithFile(t *testing.T) {
 	files := map[string]string{
 		"bundle.tar.gz": "",
@@ -104,7 +139,7 @@ func TestGenerateBundleInfoWithFile(t *testing.T) {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
-		info, err := File(bundleFile)
+		info, err := File(bundleFile, false)
 		if err != nil {
 			t.Fatalf("Unexpected error: %v", err)
 		}
@@ -155,7 +190,7 @@ func TestGenerateBundleInfoWithBundleTarGz(t *testing.T) {
 			t.Fatalf("Unexpected error: %v", err)
 		}
 
-		info, err := File(bundleFile)
+		info, err := File(bundleFile, false)
 		if err != nil {
 			t.Fatalf("Unexpected error: %v", err)
 		}
diff --git a/internal/bundle/utils.go b/internal/bundle/utils.go
index 0e0775b1fd..a541c45f1f 100644
--- a/internal/bundle/utils.go
+++ b/internal/bundle/utils.go
@@ -7,6 +7,9 @@ package bundle
 import (
 	"context"
 	"fmt"
+	"io"
+	"os"
+	"path/filepath"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
@@ -83,3 +86,55 @@ func LoadWasmResolversFromStore(ctx context.Context, store storage.Store, txn st
 	}
 	return resolvers, nil
 }
+
+// LoadBundleFromDisk loads a previously persisted activated bundle from disk
+func LoadBundleFromDisk(path, name string, bvc *bundle.VerificationConfig) (*bundle.Bundle, error) {
+	bundlePath := filepath.Join(path, name, "bundle.tar.gz")
+
+	if _, err := os.Stat(bundlePath); err == nil {
+		f, err := os.Open(filepath.Join(bundlePath))
+		if err != nil {
+			return nil, err
+		}
+		defer f.Close()
+
+		r := bundle.NewCustomReader(bundle.NewTarballLoaderWithBaseURL(f, ""))
+
+		if bvc != nil {
+			r = r.WithBundleVerificationConfig(bvc)
+		}
+
+		b, err := r.Read()
+		if err != nil {
+			return nil, err
+		}
+		return &b, nil
+	} else if os.IsNotExist(err) {
+		return nil, nil
+	} else {
+		return nil, err
+	}
+}
+
+// SaveBundleToDisk saves the given raw bytes representing the bundle's content to disk
+func SaveBundleToDisk(path string, raw io.Reader) (string, error) {
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		err = os.MkdirAll(path, os.ModePerm)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	if raw == nil {
+		return "", fmt.Errorf("no raw bundle bytes to persist to disk")
+	}
+
+	dest, err := os.CreateTemp(path, ".bundle.tar.gz.*.tmp")
+	if err != nil {
+		return "", err
+	}
+	defer dest.Close()
+
+	_, err = io.Copy(dest, raw)
+	return dest.Name(), err
+}
diff --git a/internal/cmd/genbuiltinmetadata/main.go b/internal/cmd/genbuiltinmetadata/main.go
new file mode 100644
index 0000000000..0e771d3636
--- /dev/null
+++ b/internal/cmd/genbuiltinmetadata/main.go
@@ -0,0 +1,172 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/compiler/wasm"
+	"github.com/open-policy-agent/opa/types"
+)
+
+func main() {
+	f := ast.CapabilitiesForThisVersion()
+	sorted := sortedCaps()
+	sorted = append(sorted, versionedCaps{version: "edge", caps: f})
+
+	mdata := make(map[string]interface{})
+	categories := make(map[string][]string)
+
+	for _, bi := range f.Builtins {
+		latest := getLatest(bi.Name, sorted)
+		for _, cat := range builtinCategories(latest) {
+			categories[cat] = append(categories[cat], bi.Name)
+		}
+
+		argTypes := make([]map[string]interface{}, len(latest.Decl.FuncArgs().Args))
+
+		for i, typ := range latest.Decl.NamedFuncArgs().Args {
+			if n, ok := typ.(*types.NamedType); ok {
+				argTypes[i] = map[string]interface{}{
+					"name": n.Name,
+					"type": n.Type.String(),
+				}
+				if n.Descr != "" {
+					argTypes[i]["description"] = n.Descr
+				}
+			} else {
+				argTypes[i] = map[string]interface{}{
+					"type": typ.String(),
+				}
+			}
+		}
+		res := map[string]interface{}{}
+		resType := latest.Decl.NamedResult()
+		if n, ok := resType.(*types.NamedType); ok {
+			res["name"] = n.Name
+			if n.Descr != "" {
+				res["description"] = n.Descr
+			}
+			res["type"] = n.Type.String()
+		} else if resType != nil {
+			res["type"] = resType.String()
+		}
+		versions := getVersions(bi.Name, sorted)
+		md := map[string]interface{}{
+			"introduced": versions[0],
+			"available":  versions,
+			"wasm":       getWasm(bi.Name),
+			"args":       argTypes,
+			"result":     res,
+		}
+		if latest.Relation {
+			md["relation"] = true
+		}
+		if latest.Infix != "" {
+			md["infix"] = latest.Infix
+		}
+		if latest.Description != "" {
+			md["description"] = latest.Description
+		}
+		if latest.IsDeprecated() {
+			md["deprecated"] = true
+		}
+		mdata[bi.Name] = md
+	}
+
+	mdata["_categories"] = categories
+
+	md, err := os.Create(os.Args[1]) // metadata
+	if err != nil {
+		panic(err)
+	}
+
+	enc := json.NewEncoder(md)
+	enc.SetIndent("", "  ")
+
+	if err := enc.Encode(mdata); err != nil {
+		panic(err)
+	}
+
+	if err := md.Close(); err != nil {
+		panic(err)
+	}
+}
+
+func getVersions(bi string, sorted []versionedCaps) []string {
+	vers := []string{}
+	for i := range sorted {
+		for j := range sorted[i].caps.Builtins {
+			if sorted[i].caps.Builtins[j].Name == bi {
+				vers = append(vers, sorted[i].version)
+			}
+		}
+	}
+	return vers
+}
+
+func getLatest(bi string, sorted []versionedCaps) *ast.Builtin {
+	for i := len(sorted) - 1; i >= 0; i++ {
+		for j := range sorted[i].caps.Builtins {
+			if sorted[i].caps.Builtins[j].Name == bi {
+				return sorted[i].caps.Builtins[j]
+			}
+		}
+	}
+	panic("unreachable")
+}
+
+func getWasm(bi string) bool {
+	return wasm.IsWasmEnabled(bi)
+}
+
+type versionedCaps struct {
+	version string
+	caps    *ast.Capabilities
+}
+
+func sortedCaps() []versionedCaps {
+	vers, err := ast.LoadCapabilitiesVersions()
+	if err != nil {
+		panic(err)
+	}
+	sorted := make([]versionedCaps, len(vers))
+	for i, v := range vers {
+		caps, err := ast.LoadCapabilitiesVersion(v)
+		if err != nil {
+			panic(err)
+		}
+		sorted[i] = versionedCaps{
+			version: v,
+			caps:    caps,
+		}
+	}
+	return sorted
+}
+
+func builtinCategories(b *ast.Builtin) []string {
+	if b.IsDeprecated() {
+		return nil
+	}
+	if len(b.Categories) > 0 {
+		return b.Categories
+	}
+	if s := strings.Split(b.Name, "."); len(s) > 1 {
+		return []string{s[0]}
+	}
+
+	switch b.Name {
+	case "assign", "eq", "print":
+		// Do nothing.
+	default:
+		log.Printf("WARN: not categorized: %s", b.Name)
+	}
+
+	return nil
+}
diff --git a/internal/cmd/genopacapabilities/main.go b/internal/cmd/genopacapabilities/main.go
index a6afd217f8..3d52cb4a5a 100644
--- a/internal/cmd/genopacapabilities/main.go
+++ b/internal/cmd/genopacapabilities/main.go
@@ -9,10 +9,10 @@ import (
 	"os"
 
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/types"
 )
 
 func main() {
-
 	f := ast.CapabilitiesForThisVersion()
 
 	fd, err := os.Create(os.Args[1])
@@ -23,6 +23,18 @@ func main() {
 	enc := json.NewEncoder(fd)
 	enc.SetIndent("", "  ")
 
+	for i, bi := range f.Builtins {
+		// NOTE(sr): This ensures that there are no type names and descriptions in capabilities.json
+		fargs := bi.Decl.FuncArgs()
+		if fargs.Variadic != nil {
+			f.Builtins[i].Decl = types.NewVariadicFunction(fargs.Args, fargs.Variadic, bi.Decl.Result())
+		} else {
+			f.Builtins[i].Decl = types.NewFunction(fargs.Args, bi.Decl.Result())
+		}
+		f.Builtins[i].Categories = nil
+		f.Builtins[i].Description = ""
+	}
+
 	if err := enc.Encode(f); err != nil {
 		panic(err)
 	}
diff --git a/internal/cmd/genopawasm/main.go b/internal/cmd/genopawasm/main.go
deleted file mode 100644
index 402d699402..0000000000
--- a/internal/cmd/genopawasm/main.go
+++ /dev/null
@@ -1,180 +0,0 @@
-// Copyright 2018 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-package main
-
-import (
-	"bytes"
-	"compress/gzip"
-	"fmt"
-	"io"
-	"os"
-	"path"
-
-	"github.com/spf13/cobra"
-)
-
-type params struct {
-	Output string
-}
-
-func main() {
-
-	var params params
-	executable := path.Base(os.Args[0])
-
-	command := &cobra.Command{
-		Use:   executable,
-		Short: executable + " <opa.wasm path>",
-		RunE: func(_ *cobra.Command, args []string) error {
-			if len(args) != 2 {
-				return fmt.Errorf("provide path of opa.wasm and callgraph.csv files")
-			}
-			return run(params, args)
-		},
-	}
-
-	command.Flags().StringVarP(&params.Output, "output", "o", "", "set path of output file (default: stdout)")
-
-	if err := command.Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-
-func run(params params, args []string) error {
-
-	var out io.Writer
-
-	if params.Output != "" {
-		f, err := os.Create(params.Output)
-		if err != nil {
-			return err
-		}
-		defer f.Close()
-		out = f
-	} else {
-		out = os.Stdout
-	}
-
-	_, err := out.Write([]byte(`// Copyright 2018 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-// THIS FILE IS GENERATED. DO NOT EDIT.
-
-// Package opa contains bytecode for the OPA-WASM library.
-package opa
-
-import (
-	"bytes"
-	"compress/gzip"
-	"io/ioutil"
-	"sync"
-)
-
-var (
-	bytesOnce        sync.Once
-	bs               []byte
-	callGraphCSVOnce sync.Once
-	callGraphCSV     []byte
-)
-
-// Bytes returns the OPA-WASM bytecode.
-func Bytes() ([]byte, error) {
-	var err error
-	bytesOnce.Do(func() {
-		gr, err := gzip.NewReader(bytes.NewBuffer(gzipped))
-		if err != nil {
-			return
-		}
-		bs, err = ioutil.ReadAll(gr)
-	})
-	return bs, err
-}
-
-// CallGraphCSV returns a CSV representation of the
-// OPA-WASM bytecode's call graph: 'caller,callee'
-func CallGraphCSV() ([]byte, error) {
-	var err error
-	callGraphCSVOnce.Do(func() {
-		cg, err := gzip.NewReader(bytes.NewBuffer(gzippedCallGraphCSV))
-		if err != nil {
-			return
-		}
-		callGraphCSV, err = ioutil.ReadAll(cg)
-	})
-	return callGraphCSV, err
-}
-`))
-
-	if err != nil {
-		return err
-	}
-
-	_, err = out.Write([]byte(`var gzipped = []byte("`))
-	if err != nil {
-		return err
-	}
-
-	if err := output(out, args[0]); err != nil {
-		return err
-	}
-
-	if _, err := out.Write([]byte(`")
-`)); err != nil {
-		return err
-	}
-
-	_, err = out.Write([]byte(`var gzippedCallGraphCSV = []byte("`))
-	if err != nil {
-		return err
-	}
-
-	if err := output(out, args[1]); err != nil {
-		return err
-	}
-
-	if _, err := out.Write([]byte(`")
-`)); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func output(out io.Writer, filename string) error {
-	in, err := os.Open(filename)
-	if err != nil {
-		return err
-	}
-
-	defer in.Close()
-
-	var buf bytes.Buffer
-	gw := gzip.NewWriter(&buf)
-	_, err = io.Copy(gw, in)
-	if err != nil {
-		return err
-	}
-
-	gw.Close()
-
-	for _, b := range buf.Bytes() {
-		if _, err := out.Write([]byte(`\x`)); err != nil {
-			return err
-		}
-		if _, err := out.Write(asciihex(b)); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-var digits = "0123456789ABCDEF"
-
-func asciihex(b byte) []byte {
-	lo := digits[(b & 0x0F)]
-	hi := digits[(b >> 4)]
-	return []byte{hi, lo}
-}
diff --git a/internal/compiler/wasm/opa/callgraph.csv b/internal/compiler/wasm/opa/callgraph.csv
index 0a92d7fdad..397ccdd8df 100644
--- a/internal/compiler/wasm/opa/callgraph.csv
+++ b/internal/compiler/wasm/opa/callgraph.csv
@@ -115,6 +115,9 @@ opa_array_slice,opa_value_type
 opa_array_slice,opa_number_try_int
 opa_array_slice,opa_array_with_cap
 opa_array_slice,opa_array_append
+opa_array_reverse,opa_value_type
+opa_array_reverse,opa_array_with_cap
+opa_array_reverse,opa_array_append
 opa_bits_or,opa_number_to_bf
 opa_bits_or,mpd_isinteger
 opa_bits_or,opa_mpd_del
@@ -224,9 +227,9 @@ opa_to_number,opa_number_int
 opa_to_number,opa_atof64
 opa_to_number,opa_number_ref
 opa_base64_is_valid,opa_value_type
+opa_base64_is_valid,opa_boolean
 opa_base64_is_valid,base64_gen_decode
 opa_base64_is_valid,free
-opa_base64_is_valid,opa_boolean
 base64_gen_decode,memset
 base64_gen_decode,malloc
 base64_gen_decode,free
@@ -248,15 +251,19 @@ opa_json_unmarshal,opa_json_parse
 opa_json_marshal,opa_json_dump
 opa_json_marshal,strlen
 opa_json_marshal,opa_string_allocated
+opa_json_is_valid,opa_value_type
+opa_json_is_valid,opa_json_parse
+opa_json_is_valid,opa_free
+opa_json_is_valid,opa_boolean
 opa_runtime_error,opa_itoa
 opa_runtime_error,opa_strlen
 opa_runtime_error,opa_malloc
 opa_runtime_error,snprintf_
 opa_runtime_error,opa_abort
 builtin_graph_reachable,opa_value_type
-builtin_graph_reachable,opa_set
 builtin_graph_reachable,opa_array
 builtin_graph_reachable,opa_array_append
+builtin_graph_reachable,opa_set
 builtin_graph_reachable,opa_value_get
 builtin_graph_reachable,opa_set_get
 builtin_graph_reachable,opa_set_add
@@ -337,6 +344,9 @@ opa_json_writer_write,opa_json_writer_emit_value
 opa_json_writer_write,opa_free
 opa_json_dump,opa_json_writer_write
 opa_value_dump,opa_json_writer_write
+move_freelists,opa_abort
+opa_heap_blocks_stash,move_freelists
+opa_heap_blocks_restore,move_freelists
 opa_malloc,opa_abort
 opa_realloc,opa_malloc
 opa_realloc,memcpy
@@ -516,7 +526,10 @@ builtin_object_filter,opa_value_get
 builtin_object_filter,opa_object_get
 builtin_object_filter,opa_object_insert
 builtin_object_get,opa_value_type
-builtin_object_get,opa_object_get
+builtin_object_get,opa_value_get
+builtin_object_keys,opa_value_type
+builtin_object_keys,opa_set_with_cap
+builtin_object_keys,opa_set_add
 builtin_object_remove,opa_value_type
 builtin_object_remove,opa_set
 builtin_object_remove,opa_value_iter
@@ -535,6 +548,10 @@ __merge,opa_value_type
 __merge,__merge
 __merge,opa_object_insert
 __merge,opa_value_get
+builtin_object_union_n,opa_value_iter
+builtin_object_union_n,opa_value_get
+builtin_object_union_n,opa_value_type
+builtin_object_union_n,__merge
 builtin_json_remove,opa_value_type
 builtin_json_remove,__get_json_paths
 builtin_json_remove,__paths_to_object
@@ -555,14 +572,27 @@ opa_sets_intersection,opa_value_type
 opa_sets_intersection,opa_set
 opa_sets_intersection,opa_set_union
 opa_sets_intersection,opa_set_intersection
-opa_sets_intersection,opa_value_free
+opa_sets_intersection,opa_value_free_shallow
 opa_set_union,opa_value_type
 opa_set_union,opa_set
 opa_set_union,opa_set_add
 opa_sets_union,opa_value_type
 opa_sets_union,opa_set
 opa_sets_union,opa_set_add
-opa_sets_union,opa_value_free
+opa_sets_union,opa_value_free_shallow
+opa_strings_any_prefix_match,opa_value_type
+opa_strings_any_prefix_match,opa_value_iter
+opa_strings_any_prefix_match,opa_value_get
+opa_strings_any_prefix_match,opa_strings_any_prefix_match
+opa_strings_any_prefix_match,opa_value_free
+opa_strings_any_prefix_match,opa_strncmp
+opa_strings_any_prefix_match,opa_boolean
+opa_strings_any_suffix_match,opa_value_type
+opa_strings_any_suffix_match,opa_value_iter
+opa_strings_any_suffix_match,opa_value_get
+opa_strings_any_suffix_match,opa_strings_any_suffix_match
+opa_strings_any_suffix_match,opa_value_free
+opa_strings_any_suffix_match,opa_boolean
 opa_strings_concat,opa_value_type
 opa_strings_concat,opa_malloc
 opa_strings_concat,memcpy
@@ -601,6 +631,12 @@ opa_strings_replace_n,memcpy
 opa_strings_replace_n,opa_string_allocated
 opa_strings_replace_n,opa_strings_replace
 opa_strings_replace_n,opa_value_free
+opa_strings_reverse,opa_value_type
+opa_strings_reverse,opa_malloc
+opa_strings_reverse,opa_unicode_decode_utf8
+opa_strings_reverse,opa_abort
+opa_strings_reverse,memcpy
+opa_strings_reverse,opa_string_allocated
 opa_strings_split,opa_value_type
 opa_strings_split,opa_array
 opa_strings_split,opa_strncmp
@@ -752,10 +788,16 @@ opa_object_keys,opa_strncmp
 opa_object_keys,opa_value_compare_object
 opa_object_keys,opa_abort
 opa_object_keys,opa_value_compare_set
-opa_value_free,opa_free
+__opa_value_free,__opa_value_free
+__opa_value_free,opa_free
+__opa_value_free,__opa_object_buckets_free
+__opa_object_buckets_free,__opa_value_free
+__opa_object_buckets_free,opa_free
+opa_value_free,__opa_value_free
+opa_value_free_shallow,__opa_value_free
 opa_value_merge,opa_malloc
 opa_value_merge,opa_value_get
-opa_value_merge,opa_object_insert
+opa_value_merge,__opa_object_insert
 opa_value_merge,opa_value_merge
 opa_value_merge,opa_abort
 opa_value_merge,opa_atoi64
@@ -765,19 +807,12 @@ opa_value_merge,opa_strncmp
 opa_value_merge,opa_value_compare
 opa_value_merge,opa_value_compare_object
 opa_value_merge,opa_value_compare_set
-opa_object_insert,opa_value_hash
-opa_object_insert,opa_value_compare
-opa_object_insert,__opa_object_grow
-opa_object_insert,opa_malloc
-__opa_object_grow,opa_malloc
-__opa_object_grow,opa_value_hash
-__opa_object_grow,opa_value_compare_number
-__opa_object_grow,opa_strncmp
-__opa_object_grow,opa_value_compare
-__opa_object_grow,opa_value_compare_object
-__opa_object_grow,opa_value_compare_set
-__opa_object_grow,opa_abort
-__opa_object_grow,opa_free
+__opa_object_insert,opa_value_hash
+__opa_object_insert,opa_value_compare
+__opa_object_insert,__opa_value_free
+__opa_object_insert,__opa_object_grow
+__opa_object_insert,opa_malloc
+opa_object_insert,__opa_object_insert
 opa_boolean,opa_malloc
 opa_number_ref,opa_malloc
 opa_number_int,opa_malloc
@@ -785,7 +820,7 @@ opa_string,opa_malloc
 opa_value_shallow_copy_object,opa_malloc
 opa_value_shallow_copy_object,opa_value_iter
 opa_value_shallow_copy_object,opa_value_get
-opa_value_shallow_copy_object,opa_object_insert
+opa_value_shallow_copy_object,__opa_object_insert
 opa_value_shallow_copy_set,opa_malloc
 opa_value_shallow_copy_set,opa_value_iter
 opa_value_shallow_copy_set,opa_set_add
@@ -828,15 +863,26 @@ opa_array_with_cap,opa_free
 opa_object,opa_malloc
 opa_set,opa_malloc
 opa_set_with_cap,opa_malloc
+__opa_object_grow,opa_malloc
+__opa_object_grow,opa_value_hash
+__opa_object_grow,opa_value_compare_number
+__opa_object_grow,opa_strncmp
+__opa_object_grow,opa_value_compare
+__opa_object_grow,opa_value_compare_object
+__opa_object_grow,opa_value_compare_set
+__opa_object_grow,opa_abort
+__opa_object_grow,opa_free
+opa_object_remove,opa_value_hash
+opa_object_remove,opa_value_compare
+opa_object_remove,__opa_value_free
+opa_object_remove,opa_free
+opa_string_copy,opa_malloc
 opa_value_add_path,opa_value_get
 opa_value_add_path,opa_malloc
-opa_value_add_path,opa_object_insert
-opa_value_add_path,opa_value_free
+opa_value_add_path,__opa_object_insert
+opa_value_add_path,__opa_value_free
 opa_value_remove_path,opa_value_get
-opa_value_remove_path,opa_value_hash
-opa_value_remove_path,opa_value_compare
-opa_value_remove_path,opa_value_free
-opa_value_remove_path,opa_free
+opa_value_remove_path,opa_object_remove
 opa_lookup,opa_value_get
 opa_lookup,opa_value_iter
 opa_lookup,opa_atoi64
@@ -928,24 +974,23 @@ opa_glob_match,opa_value_get
 opa_glob_match,operator\20new\28unsigned\20long\29
 opa_glob_match,memcpy
 opa_glob_match,operator\20delete\28void*\29
+opa_glob_match,void\20std::__1::vector<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\2c\20std::__1::allocator<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>::__push_back_slow_path<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&&\29
 opa_glob_match,opa_builtin_cache_get
 opa_glob_match,opa_builtin_cache_set
 opa_glob_match,std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>::basic_string\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20const&\29
 opa_glob_match,std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::find<cache_key>\28cache_key\20const&\29
 opa_glob_match,std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>::operator=\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20const&\29
 opa_glob_match,glob_translate\28char\20const*\2c\20unsigned\20long\2c\20std::__1::vector<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\2c\20std::__1::allocator<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20const&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>*\29
-opa_glob_match,cache\28\29
 opa_glob_match,std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>::pair<cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\2c\20false>\28cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\29
 opa_glob_match,std::__1::pair<std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\2c\20bool>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__emplace_unique_key_args<cache_key\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\28cache_key\20const&\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>&&\29
-opa_glob_match,std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>::~pair\28\29
 opa_glob_match,opa_string
 opa_glob_match,opa_regex_match
 opa_glob_match,abort
+void\20std::__1::vector<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\2c\20std::__1::allocator<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>::__push_back_slow_path<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&&\29,operator\20new\28unsigned\20long\29
+void\20std::__1::vector<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\2c\20std::__1::allocator<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>::__push_back_slow_path<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&&\29,operator\20delete\28void*\29
+void\20std::__1::vector<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\2c\20std::__1::allocator<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>::__push_back_slow_path<std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&&\29,abort
 std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::find<cache_key>\28cache_key\20const&\29,std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>::operator\28\29\28cache_key\20const&\29\20const
 std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::find<cache_key>\28cache_key\20const&\29,std::__1::equal_to<cache_key>::operator\28\29\28cache_key\20const&\2c\20cache_key\20const&\29\20const
-cache\28\29,opa_builtin_cache_get
-cache\28\29,operator\20new\28unsigned\20long\29
-cache\28\29,opa_builtin_cache_set
 std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>::pair<cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\2c\20false>\28cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\29,std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>::basic_string\28std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20const&\29
 std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>::pair<cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\2c\20false>\28cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\29,operator\20new\28unsigned\20long\29
 std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>::pair<cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\2c\20false>\28cache_key&\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>&\29,abort
@@ -954,7 +999,6 @@ std::__1::pair<std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_
 std::__1::pair<std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\2c\20bool>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__emplace_unique_key_args<cache_key\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\28cache_key\20const&\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>&&\29,operator\20new\28unsigned\20long\29
 std::__1::pair<std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\2c\20bool>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__emplace_unique_key_args<cache_key\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\28cache_key\20const&\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>&&\29,std::__1::__next_prime\28unsigned\20long\29
 std::__1::pair<std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20void*>*>\2c\20bool>\20std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__emplace_unique_key_args<cache_key\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\28cache_key\20const&\2c\20std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>&&\29,std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__rehash\28unsigned\20long\29
-std::__1::pair<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>::~pair\28\29,operator\20delete\28void*\29
 std::__1::equal_to<cache_key>::operator\28\29\28cache_key\20const&\2c\20cache_key\20const&\29\20const,memcmp
 std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__rehash\28unsigned\20long\29,operator\20new\28unsigned\20long\29
 std::__1::__hash_table<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::__unordered_map_hasher<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::hash<cache_key>\2c\20std::__1::equal_to<cache_key>\2c\20true>\2c\20std::__1::__unordered_map_equal<cache_key\2c\20std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\2c\20std::__1::equal_to<cache_key>\2c\20std::__1::hash<cache_key>\2c\20true>\2c\20std::__1::allocator<std::__1::__hash_value_type<cache_key\2c\20std::__1::basic_string<char\2c\20std::__1::char_traits<char>\2c\20std::__1::allocator<char>\20>\20>\20>\20>::__rehash\28unsigned\20long\29,operator\20delete\28void*\29
diff --git a/internal/compiler/wasm/opa/opa.go b/internal/compiler/wasm/opa/opa.go
index d6c9cd2cd4..10b338405b 100644
--- a/internal/compiler/wasm/opa/opa.go
+++ b/internal/compiler/wasm/opa/opa.go
@@ -1,51 +1,27 @@
-// Copyright 2018 The OPA Authors.  All rights reserved.
+// Copyright 2021 The OPA Authors.  All rights reserved.
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
-// THIS FILE IS GENERATED. DO NOT EDIT.
-
 // Package opa contains bytecode for the OPA-WASM library.
 package opa
 
 import (
-	"bytes"
-	"compress/gzip"
-	"io/ioutil"
-	"sync"
+	_ "embed"
 )
 
-var (
-	bytesOnce        sync.Once
-	bs               []byte
-	callGraphCSVOnce sync.Once
-	callGraphCSV     []byte
-)
+//go:embed opa.wasm
+var wasmBase []byte
+
+//go:embed callgraph.csv
+var callGraphCSV []byte
 
 // Bytes returns the OPA-WASM bytecode.
-func Bytes() ([]byte, error) {
-	var err error
-	bytesOnce.Do(func() {
-		gr, err := gzip.NewReader(bytes.NewBuffer(gzipped))
-		if err != nil {
-			return
-		}
-		bs, err = ioutil.ReadAll(gr)
-	})
-	return bs, err
+func Bytes() []byte {
+	return wasmBase
 }
 
 // CallGraphCSV returns a CSV representation of the
 // OPA-WASM bytecode's call graph: 'caller,callee'
-func CallGraphCSV() ([]byte, error) {
-	var err error
-	callGraphCSVOnce.Do(func() {
-		cg, err := gzip.NewReader(bytes.NewBuffer(gzippedCallGraphCSV))
-		if err != nil {
-			return
-		}
-		callGraphCSV, err = ioutil.ReadAll(cg)
-	})
-	return callGraphCSV, err
+func CallGraphCSV() []byte {
+	return callGraphCSV
 }
-var gzipped = []byte("\x1F\x8B\x08\x00\x00\x00\x00\x00\x00\xFF\xEC\xBD\x0D\xB8\x25\x57\x55\x20\xBA\x7F\xAB\xEA\x9C\x3A\x75\xEF\xE9\x4E\x77\xBA\xC9\x0D\xB2\xAB\xE4\x7D\x73\xA3\xE9\x11\x67\xB4\xE3\x0B\xF0\xE8\x7D\xBF\xE9\xEE\xDC\x34\xD0\xA2\xA0\x6F\xF8\xE6\x3D\x12\x35\xCE\x58\x37\x40\x77\xE7\xA6\x8D\x9F\x4D\x9F\xDB\x74\x20\xE1\x6F\x40\x45\x10\xF0\x4D\x02\x44\x03\x3E\x9A\x9F\x91\x5F\x35\x26\x22\x0A\xF8\x8B\x23\xF3\x40\x84\x31\x8C\xE0\xA0\x02\xC6\x80\x88\x88\xF4\xFB\xD6\xCF\xDE\xB5\xEB\x9C\x73\xBB\xFB\x86\xF0\x23\xD2\x4A\xEE\xA9\x5D\xBB\xF6\xCF\x5A\x6B\xAF\xB5\xF6\x5E\x6B\xAF\x25\xAE\xBD\xE1\xA9\x52\x08\x21\xDF\x27\x97\xAE\xD1\x93\xC9\x44\x4E\xAE\x51\xE1\xBF\xE2\x1A\x33\x99\xC0\x1F\x89\xFF\x93\x93\x6B\xEC\x84\x0A\x34\xFE\x37\x9F\x4C\xF8\x19\xEB\xC9\xC9\x35\x19\x15\xC4\x9A\x72\x72\x8D\x90\x93\x58\x11\x1E\xC5\x35\x6A\x72\x52\x4E\xAE\xD1\x27\xF1\x59\x9E\xC4\xBE\x4E\x8A\x6B\xE4\x09\x79\xE2\x9A\x72\xD2\xFD\x93\x93\x6B\x0A\xF8\x7B\x22\xF9\xDD\xEF\x07\x07\x02\x0D\x40\xFF\xF0\x77\x90\x7C\xAC\x8E\x64\xFA\xBA\xA7\x1D\x1F\x3D\xFD\xC8\xB5\x4F\xF9\xA1\x1B\x7F\xEC\xFA\xF5\x1F\x7B\xDA\x23\x84\x9C\x2E\xFA\x4E\x21\xA6\x8B\xFE\x8D\x18\x4C\x17\xFD\x5B\x51\x4E\x17\x7D\x97\x18\x42\xD1\x00\x8A\xAE\xFD\xA1\xA7\x1F\x5B\x17\x46\xBF\xDD\xBE\xD5\x86\x7F\x52\xE0\x7F\xF1\x9F\x90\x12\x7F\x09\x41\xCF\x72\xA4\x2A\xAB\x94\x5D\xB0\x76\x80\xFF\x6F\xAD\x96\xD6\x5A\x21\xB1\xC2\x22\x7C\x51\xC2\x83\xB5\x66\x64\xAC\x91\x56\x2D\x2C\x2C\x28\xBB\x30\x1A\x99\xD0\x3C\x35\x6D\x25\x75\x12\x1A\x86\x67\xE8\x78\xCC\x5D\x89\xF8\x0E\x8B\xC3\x3F\x21\x07\x34\x3E\x1E\x60\xF8\xD4\xC8\x5C\x59\xB9\x4D\x5A\x18\x9D\xCD\xD5\xC8\xCA\xED\x56\x8E\xEC\x68\x64\xB7\x2B\x21\xA5\xB2\xB9\xCA\x84\x55\xC6\x28\x2B\x73\xA5\x84\x1C\x09\x6D\xA5\x50\x56\x5A\x23\xB5\x50\xD6\xDA\x8B\x06\x03\xAD\x77\xEC\xDC\x79\xB1\x18\xC8\x05\x18\x3C\xD0\x97\x10\xC2\x96\xB9\x90\x59\xAE\xB3\xC1\x30\x1B\x0C\x8C\x19\x08\x9D\x43\xB9\x96\x83\x81\x94\x03\x31\x12\xDD\x08\x95\x11\x06\xFE\x29\x93\x5B\x6B\xF3\x5C\xE7\x79\x2E\xB5\x16\xB9\x14\x03\x2D\xA4\x14\x83\x4C\x65\xBB\xB2\x4C\x6B\x9D\x65\xD9\xAE\x6C\x57\xA6\xCB\xB2\xCC\x32\x2C\xD1\x5A\x96\x45\x29\x77\x0D\x85\x80\x0E\xD4\xC0\x5A\x63\xCD\x82\x94\xB9\x10\x52\x09\x21\xCB\x7C\x28\xF2\x5C\x54\x15\xCC\x58\x6B\xAD\xB2\x3C\xD7\xA6\x94\xBB\x84\x16\x5A\x6B\x93\xEB\x4C\x17\xBB\xA5\xCC\x94\x5C\x5C\xB4\x26\x2B\x72\x65\x94\x52\xEA\x21\x76\x30\x90\x5A\xE8\x5D\x42\xC9\xE9\x7F\x97\x48\x18\xEE\xC5\x4A\x49\x65\x6D\x61\x86\x95\xA8\x06\x4A\xC0\x57\x95\x1D\x28\x29\xAC\x94\x76\x30\x18\x8A\x72\x00\xB8\x53\xD6\x2A\x91\xE3\x58\xA1\xC5\x12\x20\x20\xA4\x91\x66\x30\xC4\x9E\xF2\x2C\xCF\x95\x32\x88\x10\xF8\x7F\xB3\x4B\xE6\xC5\x2E\x9D\x8B\x32\x17\xB9\x11\xD6\x58\xA5\x86\xD5\xC0\x8C\xCC\x48\x58\x65\x01\x50\x80\x1E\x59\x0A\x21\x06\x42\x2A\x29\x95\xB2\x7A\x20\xAC\x50\x52\x19\x6B\x06\x02\xA8\x4C\x8A\xA1\x54\x52\x0C\x86\x76\x60\x06\xC6\x9A\xA1\xC4\xCE\xE0\x43\x63\xE5\x11\x79\xF5\xD5\x56\x4B\xA1\xB2\x45\x35\x91\x7E\x63\xC3\x94\x13\xE1\xEF\xBD\x23\x2F\xF3\xF7\xA9\xED\xD9\x53\xAF\x7B\xEA\xD3\x8F\xFD\x84\x12\x63\x20\xF8\xEB\x8E\x5F\x7B\xFD\x53\x7E\x78\xFD\xA6\xA7\x3C\xED\xBA\x1F\x17\xDF\x3E\x84\xA2\xA7\x5E\x7B\xFD\xF5\x4F\xFF\x61\xF1\x7F\x5E\xDC\x7B\x7F\xC3\x75\xEB\x4F\xF9\xB1\xA7\x1D\xB9\x71\x5D\x5C\x5E\x84\x17\x62\x0F\xB6\xF1\x9F\xAE\xBB\xF6\xC8\x53\x8E\xAC\x1F\x83\x3A\xE2\x07\x17\xA1\xE8\xF8\xB5\xD7\xDF\x78\xDD\x53\x8E\x5C\x7B\xEC\x86\xEB\xC4\xC1\x85\xAE\xE4\x47\x6E\x7C\xEA\x11\xF1\xC4\x0A\x0A\xDA\x1B\x9E\xFE\x34\x7A\xFE\xFE\x9D\x33\x3D\xFD\xC8\xB5\xEB\xD7\x8A\xEF\x58\x9A\x29\xBF\xEE\x69\xEB\xC7\x7E\xE2\xC8\xD3\x7F\xEC\x69\xEB\xE2\x11\xBB\x7A\x6F\xFF\xE3\x75\xEB\x4F\x39\x76\xDD\x0D\x37\x5E\xBF\x2E\xBE\x73\x21\xB6\x4F\x23\x38\x80\x23\xFE\xD1\x63\xD7\x5D\x27\xFE\x7D\xF9\x14\x1A\xEF\x0F\x5D\x7B\xC3\x75\x5A\xF6\xC7\xFF\x1F\xAF\x5B\x17\x3F\xB0\xBD\x1B\xED\xB5\x3F\xF2\x23\x4F\x39\x72\xED\xFA\x7F\x12\xF7\xCA\x9D\x5D\xE9\xB1\xEB\x9E\xFA\xF4\xE3\xD7\xD1\x8B\x8F\xCA\xC1\xCF\x4A\x29\xBC\x2C\x57\xDF\x22\x1F\x7B\xF8\x09\x7F\x2B\xEF\x97\xCF\x55\xCF\x53\x2F\xD6\xBF\xAC\xDE\xA2\x7E\x56\xBF\x59\xBD\x55\xFD\xAC\xFA\x39\xF5\x52\xF5\x12\xF5\xCB\xFA\x2D\xFA\x77\xF5\xEF\xEB\xF7\xEA\xDF\xD1\x6F\xD6\x1F\xD0\x1F\xD4\x7F\xA2\x3F\xA4\xFF\x8B\x3E\xAB\x37\xCC\x29\xF3\x49\xFD\x69\x7D\x9F\xBE\x5F\x7F\x56\x7F\x4E\x7F\x5E\x7F\x41\xDF\x69\x7E\xC3\xBC\xCA\xBC\xDA\xBC\xD3\xDC\x61\x7E\xD3\xBC\xCB\xFC\x96\xF9\x88\xF9\x84\xF9\x6B\x73\xBF\xF9\xAC\xF9\x82\x79\xB9\x7D\x85\xFD\x79\x7B\x9B\x7D\x9D\x3D\x63\x5F\x6D\x5F\x69\x5F\x65\x5F\x6F\x5F\x63\x5F\x6B\x7F\xD1\xDE\x69\xDF\x68\xDF\x64\xFF\xAB\x1D\xBE\xE5\xCF\x2E\x7A\xAB\x7D\xB7\x54\x6A\x22\x4F\x7E\xEB\xC6\xC6\xC6\x86\xF0\xE3\xB5\x46\x3E\x9C\x7E\x8A\x5A\xA9\x7D\xDD\xFF\x39\x31\xFE\xE5\x53\x50\x7E\xA2\x5D\x30\x42\x2A\x6D\x4B\x28\x5C\x56\xA6\x12\x2B\xA2\xD6\x23\x53\xC2\x27\xF0\x53\xEF\x73\x7A\x45\x9E\xA8\xB5\x93\x7E\xD4\x42\x9D\xC2\xA9\x76\xFC\x8E\x67\x6D\x6C\x08\xA7\xDA\x46\xE1\x67\xAB\x95\x18\x99\xB2\x74\xE2\xBB\x55\x31\x7E\x2F\x34\x5D\xAB\x91\xC6\xE7\x51\x7C\x56\x53\xCF\xB2\x74\x3A\x3C\x94\x4E\xFA\x71\x4B\xA3\x75\xAA\x7C\x87\x96\x76\x72\x8E\x69\xC4\x09\xFC\x64\xBB\xA0\x61\xAD\x94\xE3\xBB\x9F\x09\x0D\xC1\x30\xC5\x5E\x55\x38\xED\xC5\xF8\x63\xD8\x9A\xF4\x45\x3B\xFE\x28\xBC\x55\xFB\x9C\x5C\x56\xC5\xFE\x4A\xF8\xF7\x9E\xBE\x79\x43\x8C\x5F\x0C\xA5\x3C\x75\x2C\x16\xB5\xF1\xA6\x56\x7A\x1F\x83\xC3\xA9\x76\x59\x85\xBE\xF4\x81\x4A\x38\x3D\xFE\xBD\x67\xF2\x50\x46\xA6\x74\x3A\xAD\xF6\x17\xD0\xDF\xF8\x53\x1B\x34\x10\xE5\x8B\xB6\x56\xCE\x78\xD9\x36\x06\x7B\x58\xAD\x44\x09\x73\xFE\x5F\x1B\x01\x00\xFD\x51\x8F\x7A\xA3\x1E\xF5\x46\x3D\x9A\x1D\x35\x8F\xBB\xB1\x3C\xF2\x6E\xD4\xC6\xAB\x75\x18\x51\xA3\xF6\x57\x42\xEF\x73\x2A\x99\xC4\xC1\xCA\x38\x4D\x25\x53\xE3\x5D\x56\xA6\x51\x95\x28\xB1\xD5\xDA\x96\x61\xE8\x76\x76\xDC\x29\x18\xBE\x02\xA8\x93\x5F\x23\xD4\xFD\xCD\x97\x85\x3A\xF9\x55\x47\xDD\xDF\x3C\xB8\xA8\xFB\x07\x29\xCD\xC4\x8B\x5A\x6E\x86\x29\x06\xB6\x84\x6F\xBD\xA9\x35\xD4\xD5\x54\x57\xEE\xAF\x84\x93\x34\x07\x8D\x20\x7D\x0B\x7E\x3B\xB9\xBA\x92\x65\x52\x5C\xC3\x08\x00\xBC\x00\x65\xC9\xFC\x03\xC0\x3B\x52\x25\xD6\x03\x68\x11\x70\x0C\x01\x47\x85\x5E\x18\x5F\x01\x40\x1A\x01\x94\x76\xAE\xA7\xBB\xD5\xA1\x43\x80\x8F\x8E\xF0\x31\x65\xE8\xDB\x10\x7C\xE4\x57\x64\xEA\xF2\xAA\xAF\xC9\xD4\xA9\xDB\x0B\x9F\xFA\x2B\xFB\x53\x9F\x9A\x3C\xE8\x4D\x34\xB8\xF1\x87\x90\x55\x4B\x1A\xA1\x22\x58\xE8\x6E\x74\x3A\x8C\xCE\x10\xE5\x4A\x67\x60\x50\xFF\x0D\xBE\x82\x9F\xA6\x31\x71\x18\x0A\x20\x21\xDB\x46\x3B\x15\xE7\x3F\xFE\x43\x6A\x1F\x88\xF2\x14\x92\xF7\x9F\x41\x01\x0C\xF1\xB9\x6A\x6A\x88\xD3\x83\x34\xC2\x94\x3C\xAE\x4A\x7A\x59\xEB\x91\x0A\xBC\xA1\x12\xFC\x8C\xA3\xAC\x0D\x0C\xDA\x9B\x1A\x11\xA9\xF7\x39\xE3\x64\xC2\x27\xD4\xC1\x8A\x04\x5A\xC3\xE5\x7B\x84\xDC\x5F\x29\x64\x44\xB5\x9C\x42\x5B\x89\x0D\xCB\x72\x93\x05\x2C\x11\x0C\x1E\x59\x44\xAF\x07\x7A\xC6\x96\xF1\xA7\x69\x64\x02\x18\x68\x34\x2C\x5F\x15\x96\xEF\xBB\x23\x68\xCA\x8F\x49\xA9\xB7\xC6\x5F\x7B\x4C\x52\x6F\xCE\x24\xD5\x41\x22\x3F\x2E\xC5\x01\x0A\x2F\xB9\x73\xE4\x99\xCC\x18\x19\x77\x91\x31\x7A\x11\x2B\x49\xEE\x6E\x04\xBD\x25\xA5\x4E\xFA\x67\xAA\x47\xCA\x05\x07\xFC\x71\xA1\x1D\xBF\x0D\xBB\x14\x07\x43\x95\x29\x56\xF4\x28\x29\x27\x34\x27\xA4\x24\x35\xBE\x07\xAA\x21\xD5\x41\x0B\x4E\x8D\xDF\x01\x05\x44\xF2\x08\x24\x15\x1B\x2B\xBF\x87\x3E\xD6\x6A\x9F\x53\x11\x18\x5E\x1E\xC2\x95\xA2\x9C\x48\xBF\xDD\x5F\xEB\x08\xE0\xF2\x16\x29\xD5\x2C\x6C\x19\xAA\xC8\x72\x1B\x81\x50\x14\x9D\x00\x50\x41\x00\x40\xC3\x89\x00\xF8\x0C\xBC\x75\x82\x98\x6D\x22\x08\xFE\xE0\xB9\x9D\x20\x70\x8A\x19\xB3\xE8\x4D\xFF\xC1\x1D\xC8\xB3\x4E\xCF\x1F\xC8\x8B\x9E\x77\x01\x03\xF9\xC9\x79\xC4\x36\x67\x1C\xA9\x44\xF4\xC9\x58\x74\x7F\x2C\xCF\x49\xC7\x82\x23\x41\xB9\xCC\xD2\x69\x8A\x06\x1E\xE4\xBE\x6F\xDD\x4A\xDF\xEF\xEC\x23\x40\x05\x80\x50\xC7\xB5\x70\x92\x7F\x45\x81\x81\x7C\x18\x19\xFE\xF8\xE3\xD4\x29\xFD\xED\x23\x09\x58\x7F\x18\x9C\x0B\x0A\x83\x82\xE1\x7D\xEE\x99\xBD\xE1\xF1\x5F\x05\xB2\x7D\xE4\xEF\x7E\xCA\xD1\x06\x3E\xE3\x8E\xFC\x1B\x52\x22\xD2\x1D\xEE\x54\x8A\xBB\xF7\xF4\x39\xC5\xF4\x1C\x74\x9C\x83\xC1\x19\x80\x50\x71\xC0\xBB\x79\xA8\x22\x0C\x55\x38\xED\x4C\x3A\xD4\xBF\xC7\xA1\xB1\x1E\xE1\xCC\xEC\x50\x35\x0D\x15\x5A\xF4\x2F\x4C\x87\x2A\x78\xA8\x9A\x14\x11\x02\x94\xE1\xBF\x30\xEB\x67\x22\x37\xD0\xBD\x99\xE8\xAF\x01\x36\x4E\x9D\xDE\x02\x36\x3E\xF9\x9C\x0B\xC0\xC6\x1F\x9E\x1B\x1B\x5B\x9B\x83\xEE\xE6\x80\x02\x2D\xCC\xC3\xE0\x3C\xFE\xBC\x9B\xC7\xE7\xE7\x53\xD5\xB2\x1A\x35\xC2\x9B\xA3\x15\xCC\x49\xCC\x4C\xE8\x6F\x52\x9C\x99\x80\xB3\x29\xA4\xDC\xFD\xC0\x26\x84\x3A\xCE\xF8\x03\xD0\x36\x3E\xD3\xCF\x07\x32\xCD\x04\x5D\xA7\xE7\xA3\x8B\xD6\xF8\x66\x13\x78\x0B\x4C\x80\x84\x4C\x14\x9A\xF6\x20\x8E\x29\x7D\x80\x1D\x2F\x48\xBA\x96\x15\x20\x35\x23\x4F\x0D\xE8\xE9\x2C\xFD\xDB\x44\xE7\x01\x61\x69\x66\x84\x65\xDC\xC8\x88\x5A\xC4\x8F\xE5\x26\x1F\x0B\xF8\x98\x06\x41\x1F\xAB\xF2\xCD\x4A\xA9\x89\x4A\x36\xF9\x3A\xAA\x00\x66\xB3\x99\x68\x78\x50\xC9\x03\x54\x06\xB5\x11\x36\x58\x6F\x27\x19\xEA\x94\xD3\xE1\x37\x31\x84\xCB\xB4\x68\xEC\xCA\xE4\x49\x78\x28\x60\x9D\x5E\x11\x57\x68\x58\x3D\xCE\xE2\x46\xBF\xC9\x7E\x10\x38\xA8\xCB\xAE\xD0\xC2\x65\xB5\x2D\xC3\x57\x45\x93\x85\xAF\x32\xFA\xAA\x80\xAF\x32\x67\xE9\x03\x7B\x85\x2E\x9C\xAD\x33\x68\x28\x7B\xC6\x9D\x0C\x57\x83\x1D\x86\xEF\xDD\xB3\x57\xDC\x2D\x0D\x7E\x90\xDD\xE9\xF5\xBA\x37\xC7\x40\x15\x76\x86\xE0\x2C\x13\x50\xB1\x72\x86\x5F\xDB\x15\x79\xA2\xB1\x4F\x22\xB5\xA9\x43\xB6\x29\x3F\x0F\xC8\xDE\x8C\x38\xB7\x4E\x9A\x8B\x50\xF6\x3B\x41\xEE\xF2\x2F\x1D\xCB\x00\x11\xCA\x01\xA0\xD5\x3E\xE4\xA9\x4E\x8C\xFF\x1A\x75\xDA\x4F\x73\x3B\xC9\xD3\xF8\x3E\xFC\xEF\x27\xF1\xBF\x9F\xC5\xFF\x22\xC1\x42\x1F\x4E\x8E\xEF\x9F\x2E\x71\x66\xA9\xDF\x98\x13\x50\xF4\xB7\xF3\x5B\x29\x3F\xF9\x75\x3C\xF3\xFB\xCF\x39\xF3\xFB\x7A\x25\x34\xCD\x39\x00\xE0\x99\xD3\x6C\x6F\x24\xDD\x4F\xA6\x5A\x42\x7F\x76\xAC\x41\xFC\x4E\x98\x6C\x18\xDF\x5F\x86\xCA\xA0\x3F\xFD\x55\xD7\x3C\x0A\x0C\xD7\x1B\x65\x9D\x88\x32\x54\xCA\xBF\x9E\x61\xFC\x99\x19\xB8\x7E\xE6\x02\xE1\xFA\x99\x4D\x28\xEA\x03\x52\xCA\x59\xCE\x9F\x6A\x66\x01\x98\xCC\xE5\x78\x82\xB4\x39\xE8\xF1\x24\x89\x5B\x8A\x8E\x05\x5D\xA6\x8B\x95\xC9\x0F\x46\x1D\x44\x12\xC7\x37\x38\x48\xB5\xAC\x8A\xC8\xF4\x4D\x3B\xFE\xDB\x29\x0D\x5B\x2D\x2B\xDC\x37\xFF\x53\x72\xD4\xE2\x24\xA3\xF2\x7F\xA5\xA8\x0C\x07\x20\xD3\x32\xFA\x25\x6A\x9E\x9E\xC1\x5B\x89\x4D\xC9\xA9\x9B\xD1\x81\x2A\x8E\x07\xE7\xAA\xF6\xCD\x9F\xE0\x93\xAA\xDE\x30\x34\xEF\x9A\x22\x4D\xE2\x43\x8A\x09\x02\xA7\x26\x89\x03\x7B\x59\x4D\xD0\xF8\x33\xF8\xE0\x12\xA7\x79\x92\x33\xA8\xEA\x9A\xEE\xB7\x20\x37\x6B\x61\xBE\xA4\x7C\xA9\xEA\x44\xFD\xFB\xC4\x2C\x60\x68\xFA\x26\x95\x38\x86\x84\x0C\xC9\xBD\x70\x7C\xB1\xDC\x8E\x5F\xB5\xD1\x81\x0D\xDE\xA0\xE0\x53\xE3\x57\x6F\x10\x7C\xD2\x32\xAE\xCA\x80\x54\x7B\xC4\x72\x23\xE1\x8F\x20\xC2\x97\xB8\xB3\x37\x00\x0D\x68\xD9\x6F\x6B\x51\x65\xDD\xD6\xD2\xA1\xF5\x1E\x21\xFC\xE4\x06\x27\xF6\x08\xD1\x98\xA3\xB0\x6D\xF4\x47\xDA\x3D\x42\x38\xCD\x7F\xCD\xD1\x83\x78\x56\x40\x42\xB6\x16\x28\xA8\xF1\x3C\x6F\xD2\xC2\xE6\x5D\x8D\x70\x67\x5B\x1B\x50\x81\xDE\xDD\xE9\xA5\xEF\x13\x1D\x60\x7E\xC5\x68\x33\x91\x27\x53\xA2\xD1\xC9\x6A\x90\x7C\xBC\x87\xBB\x58\xE1\x4C\xDB\x58\x18\xD6\x77\x1C\xA8\x24\xAC\x36\xDC\xE4\x1F\x88\x1D\x65\x50\x25\xC0\x82\x8E\x57\x32\x67\xBD\x6C\x9D\x81\x99\xC8\x96\xC4\xF5\x0B\xE8\x80\x0B\xDA\x40\x59\x99\xAF\x88\xEF\xAF\xA4\xCB\x11\x34\x4D\x71\x66\x45\x3F\xFB\x49\x15\xF0\x3F\x3A\xFA\xC8\x00\x40\x85\x97\x47\xEB\x0C\xC7\x54\xC0\xF4\x06\x34\x2E\xA0\x83\xC2\x7F\x49\x1E\xAD\x2D\x1D\x62\x38\x05\x83\x94\x7E\x5B\xEB\x27\x7E\xE3\xA4\xCB\xEF\xBC\xD1\xE5\x2B\xF9\x93\x1A\xB1\x74\xA5\x00\x49\xBB\x3D\xBC\x58\xB9\xE9\xC4\x8A\x70\x62\xA9\x89\x55\x24\x56\xE1\x17\x72\xA9\xCE\x9D\x75\xC6\xAB\xB6\x01\x52\x28\x81\x0A\xB3\xFD\xA8\x65\x98\x76\xA6\x7D\xF8\xB4\x84\xC1\xBA\x02\x76\xF8\x85\xD7\x47\x81\x6D\x20\x1B\x1F\x78\xBD\x5A\x09\x57\xF8\x2F\xCA\xA3\x75\x41\x27\x62\xA0\x31\xB5\x0D\x02\xD0\x3A\x8B\xD8\xF4\xDB\x00\xAB\x47\xAF\xC4\xDF\x2A\x29\xDF\x9E\x94\xEB\xA4\xFC\xA2\xA4\xDC\x24\xE5\x3B\x62\x79\xE1\x24\xBC\x91\x38\x7E\xE0\xE2\x80\x35\x85\x94\x06\xB0\x32\xFE\x48\xDB\x48\x27\xF1\x33\xFE\x06\xE7\x00\xE3\x42\xB2\x9A\xB4\xC0\x02\x47\x8A\xD0\xDB\xD3\x48\xB2\xF2\x67\x86\xB2\x0C\x74\xE3\x7A\x74\x03\x94\xE3\xE5\x55\xDD\xD1\x30\xB1\x56\x67\x60\x64\xFE\xFB\xDA\x85\x0A\x0D\x94\xFC\x4F\xE2\x02\x98\xEC\x15\xDB\x80\x2D\xC2\x18\x50\x59\xF3\x02\xA6\xA0\xEB\xCC\x8B\x3A\xF7\xA2\x2E\x88\x08\x81\x46\x06\xFB\x2B\x14\x4C\xFE\x35\x6F\xB8\x79\x43\xB8\x81\xDF\xBD\xEE\x77\xDF\xE8\xCB\xF1\xCB\x81\x19\x34\x43\xA6\x5A\x97\x7B\x71\xD0\x59\x7F\x56\x1E\x6D\x06\xFB\x8F\x56\x03\x37\xA4\x2F\xD6\xDC\xC0\x0F\xAF\x6F\x1B\x78\x75\xA8\x1A\x80\x62\x77\xA5\x80\x25\x99\xE3\x81\x51\x9D\x13\xC9\xE9\xAB\xAB\x01\x3C\x01\xF5\xB5\x75\xC1\x27\x65\x50\xA9\x70\x03\xFF\xAF\x0F\x56\x85\x2B\xBC\x39\x50\x15\x38\xE0\x0C\x06\x2C\x5D\x06\x75\x71\xCC\x65\x58\x97\xB4\x20\x2B\x5E\x8D\xF0\xCD\x55\x95\x05\x01\xB8\xAC\xC4\x5E\x81\x4B\x78\x64\x4B\xA7\x56\x26\x57\x20\x0C\xC6\x30\x71\xE5\x1F\xD2\x42\x81\x60\x05\x94\xB5\x57\x6C\x01\x81\x90\xEF\xAF\x8C\x13\x35\xD0\x65\xEE\xAF\xC4\xA3\xAF\x3D\x42\xC2\x2F\x0B\xD0\x3F\x50\x59\xEA\xBF\xA4\x13\xD3\x1A\xF6\xC1\x30\x0D\x44\x62\x5D\xB9\x12\x07\x47\xB0\xA6\x83\x5A\xC0\x31\x00\xD9\xDF\x03\x40\xA2\x5D\xB5\xE2\x27\x97\x13\x90\x9B\xA1\xDF\xC6\x60\x86\x35\x78\x2F\xD5\xA4\xBF\x2E\x79\x07\x6C\xCF\x49\x00\x61\xE6\x06\xCE\xAC\xB9\xCC\x9B\xF5\x63\x75\x06\x43\x03\xDA\xB2\xF5\x80\xE1\x89\xE3\x07\x14\xE5\xFE\x4A\x90\x3F\x39\x41\x16\x24\x64\x23\x5C\x75\xA8\x2A\x88\x16\x2E\x75\xA5\x2B\x0E\x54\x99\xD3\xFE\xD2\xB6\x1E\x30\x55\xC0\xB6\x6A\x88\x94\x51\x02\x50\x64\x9F\x32\xE4\x14\x65\xE0\x02\x36\x40\x15\xD4\xA5\xDC\x7F\xB4\x1A\xBA\x2C\x50\x85\x44\xAA\xC8\x91\x2A\x86\x6E\xE0\x72\xA2\x0A\xB3\xBF\xE3\xD4\x43\x98\xD2\x10\xB9\xEE\x10\x66\x32\x04\x16\x64\xF6\x57\x03\x27\x61\xDC\x40\x62\xE6\x40\x85\xA3\x73\x03\xA2\x88\x01\xD4\x1B\x10\x23\x06\xA0\x37\xA5\x2B\x68\x45\x0E\xBD\x7E\x6C\x95\x11\x25\x5C\xBA\x57\x88\x91\x2E\x59\x2E\x00\x96\x55\x3D\x00\xFC\x3A\xBB\xBF\x92\xA3\xA2\x44\xAC\xEF\xAF\x72\xA7\x80\x3B\x48\x80\x4C\xEE\x94\xCB\x7C\xB1\xEE\x32\xBF\xF1\x25\x7D\xD4\x17\xC7\x8F\x3D\x52\xD0\xC7\x96\x3F\x96\x88\xDA\x0C\x65\x28\x80\x0F\xA9\x04\x06\xC7\xB4\x39\xA8\xAD\x33\xB5\x74\x79\x25\x91\xC5\x99\x8A\xCA\x14\xAA\x1A\x34\x0E\xE8\x0F\x31\x61\xE7\xF6\x07\xF5\xE1\x53\x8B\x7A\x85\xAB\x0E\x54\x9A\xA4\x92\xB3\x6B\xCD\x10\xF8\x00\xC2\xEA\x28\xAC\x60\x67\xFD\xE4\x06\x2F\x9C\x58\xC3\xA1\xF8\x93\x08\x19\x37\xF4\x27\x8F\xAE\xE1\xAA\x11\x20\xFA\x9C\x00\x1E\xBE\xD8\xBA\x01\xFC\x42\x2E\x99\xEF\x11\xC8\x0F\x72\x62\x0B\xD2\x2F\xB4\xC8\xB3\x88\xFD\xE1\x9F\x0C\xDB\x6B\x40\xBA\x96\x5E\x3A\xB1\x06\x00\x2F\x60\x95\x54\x40\x80\xD6\x0D\x9D\x59\x6B\x1B\xC1\x5F\x09\xFC\x8A\x2C\xC5\x86\xC7\x3D\x32\x65\x94\x6B\x07\xC3\x82\x05\x0C\x8F\x70\x77\x06\xAB\x71\xE4\x8B\x16\xE5\xD6\x15\xC8\x2C\x0D\x30\x45\xD7\x6D\xD3\x3E\xAA\xA4\x79\x90\x35\x8D\x79\x3A\x85\xE8\x54\x0A\x93\xA8\x14\x06\x09\x55\xCE\x53\x29\x9C\xA9\x2D\xAE\x93\x9E\x62\x21\xE7\x29\x16\x92\x15\x0B\x39\xA5\x58\x58\xE0\x63\x76\x7F\xA5\x47\x74\x5E\xCD\xAD\x53\x3F\x33\x3A\xCB\x96\x9A\x36\xD0\xB4\xE9\x74\x16\x60\x1E\x9B\xE9\x2C\x17\xD1\x49\x1B\x9D\x7E\xF3\xC1\xF7\xCE\xA4\xAC\x3B\x47\xEF\x97\x5E\xCD\xA5\xBB\xD3\xD2\xC9\x0D\xFE\x61\xC7\xE7\x55\x9F\x5F\x2A\xAF\xE2\xD2\x87\xC1\x36\x6D\x3C\xFE\x20\x69\xD4\x2B\xE2\x0A\x05\x14\x55\xB4\xFC\xAB\x1C\xE0\x57\x7B\x95\x28\x5F\xDA\xDF\x6C\xE4\x41\x4C\xD2\x49\xD5\x9F\xA4\xBA\xBE\x1D\x7F\x80\xE6\x08\x0A\x1B\xEF\xC4\x72\x68\x65\x04\x74\xBF\x57\x15\xA0\x24\xC1\x6E\x22\x77\x62\xAF\x12\x2E\x1F\xBF\x7E\x03\xB5\xDF\x7C\x59\x15\x35\xD1\x44\x46\xDA\xFD\xFB\xD3\xED\xC2\x1F\x87\x3D\x5F\x9E\x6E\x16\xB6\x8B\x38\x2A\x68\x6E\xE4\xBB\x51\x9B\xF8\x6B\x54\xE6\x64\xD2\x2B\x1F\x27\xFC\xC4\x8B\x31\x7E\x72\x09\xFC\xF4\x62\x7C\x2A\x79\xF0\x62\xFC\xCC\xDE\xA3\x17\xE3\xD3\x53\x05\x5E\x8C\x6F\xC6\xA2\xF2\xE7\x36\x35\x10\x4C\x59\x81\x26\xE8\xE1\x61\x94\x2E\x57\x04\x3B\x5B\x08\xF4\xCC\xF8\x4E\x21\xE3\xB3\x2A\x7D\x77\xAE\xC5\x07\x2C\xA0\x6A\xFE\x67\xDE\xB5\xC4\xE2\xF1\x7B\x82\xB5\x26\x32\xB8\x69\x8B\xC1\xD3\xE6\x0D\x6C\xEA\x94\xCD\xD0\x72\x4B\x7B\x1B\xB5\x7E\xE3\x8D\x80\xCB\xB7\xA4\x9B\xAC\x97\xF0\xB1\xF1\xE6\x86\xA2\x9B\xAD\x2C\x42\x7F\x2F\x52\x6B\x8D\x09\xAC\xC4\x8F\x5B\xBF\x21\xFD\x86\x1A\xFF\x17\xDC\xE2\x78\x5D\x5B\x54\xDA\xC6\xAD\xD3\xCE\xB6\x4D\xE6\x9F\x01\x6B\xAA\x75\xD6\x3F\xA3\x25\x3E\x38\x6E\x5D\xE6\x4F\x86\xD2\x93\x69\xE9\x24\x94\x4E\x92\x52\x2A\x82\x67\x8B\x2A\xA4\xFF\x4D\xE2\x9E\xA0\x14\x20\x57\x7D\x5C\xB4\xD0\x02\x03\xCF\x83\x6A\x47\x1C\x0B\xF8\xB5\x25\xD3\xD8\x49\xD2\x6C\xB1\x44\xEF\x73\x19\xB5\x2F\x60\x98\xC0\x14\x50\xEF\xDB\x90\x07\x5B\x1E\xBE\x97\x6D\x5A\x0A\x6A\xB3\xB3\xA8\xF4\x06\x55\x1B\x34\xB1\xB4\x99\x7E\x75\x1A\x61\x86\x7A\x9E\xCB\xD6\xBC\x3E\xDA\x68\x97\xB5\x5E\x1D\xF7\xFA\xFA\xF1\xCF\x06\x15\x04\x44\xD3\x50\x81\x40\x01\xA9\x4B\x5A\x61\x01\x65\x9E\x2C\x2D\x56\xEF\xF3\x8F\x06\x9D\xC7\x59\x27\x0F\xA3\xF4\xC2\x9E\x50\x5E\xAA\x7D\x01\x74\xA0\x29\x64\x2D\xEA\x5C\x7E\x43\x1E\x40\x15\x62\xD4\x3A\xDD\xA2\x82\xE0\x0A\x97\xF9\x47\x1F\x20\xCD\x4A\xB6\x8D\x26\xEE\x3E\x04\xF1\x54\x79\x73\x1C\xFE\x8E\xBC\x5A\x3F\x06\x75\xB1\x74\xC1\xAB\xE3\xFC\x16\x4A\x65\x28\xCD\xD6\xE1\xEF\xE2\xB1\x2B\x85\x72\x45\x25\x41\x3D\x68\xEB\xA1\x2B\x80\x05\x96\xB8\x91\x02\xF8\x00\x77\x2F\x79\x91\xC0\x5E\x68\x41\x49\x25\x4A\x37\x20\x5A\x43\x94\x68\x50\x2D\x14\x2B\x27\xA4\xA6\x94\x4E\xB9\xA1\x1B\xAC\x01\xDB\x18\x90\x83\xC5\x8B\x54\xA0\x42\x5B\x3E\xF5\xC1\x21\xFA\x68\xCE\x72\x64\xA0\x1A\x7F\x70\x2E\xCD\x7F\xB9\xBD\xBD\x7D\x4B\xBD\xDD\xA2\xC9\xF8\x6E\x90\x76\xBF\x74\xF6\xEC\x59\x8D\x96\x54\xAF\xD6\xBD\x7E\x9A\xB7\xB0\x75\x92\xB0\x43\xB3\x4C\x39\x59\x90\xAF\xD2\xEB\xC7\x03\x19\x92\x0E\x90\xD1\xA6\x09\xD4\x13\xA0\x05\xEB\xD5\xF1\x36\x6A\x20\x1A\x16\xA5\xF0\x8A\xC9\xE4\x31\x47\xBB\x57\x12\xD7\xAB\x37\xEB\x28\xF3\xE8\xD3\xDD\xEB\xFE\xD2\xE3\xC7\x7A\xD5\x14\x55\x53\xEB\xA4\x6A\x7F\xCB\xD4\x6B\x43\x3B\x32\x4D\x1B\x8A\x67\x80\x82\xA4\xAE\xE6\xC5\x82\x2B\x74\xDE\xC0\x92\xF5\x8A\xEF\x61\x14\xFE\x11\xDC\xAA\xF4\x8F\x26\x01\x61\xE2\xF8\xF6\x08\xD9\x88\xE9\xC1\x49\x9A\xD9\xBA\x7F\x14\x16\x00\xC3\x34\xFE\xD1\x57\x0A\xED\x8C\x13\x40\xAB\x34\xB8\x92\xF5\x30\xD0\x4B\x78\x9F\xEC\x32\xA0\x37\x84\x5C\xE9\xCC\x97\x81\xF6\xF7\x7D\x55\x89\xEC\x7D\x0F\x80\xC8\x2E\x4F\x8F\x6D\x13\x25\xAF\x93\x3C\xBF\xDD\x9D\xB6\x3E\x9C\x0E\xC8\xFE\xB8\xEB\x01\x0F\x36\xC5\xF8\x36\xA0\x3F\xEA\xA1\xFC\x95\x44\x6F\xB8\x4F\x74\x82\x41\xBE\xCE\x19\x7F\x8F\x68\xFD\x70\xFC\xFC\x53\x28\xFD\xD5\xEB\x48\x5A\xC4\x02\x31\xBE\x85\x6D\x30\xF7\x88\x96\x7E\x13\xE7\x0D\xBF\x35\xFF\x00\xE2\x97\xA4\xC4\xD4\x80\x2F\xCD\xC6\x29\xE0\x12\x06\xBF\x00\xA5\xC3\x50\x43\xA0\x78\x28\x27\xFD\x0B\x9F\x75\x33\x1A\x3D\x6F\xA5\x93\x37\x45\xDA\x8B\x33\xFE\xBE\xA0\xA4\x95\xB7\x58\x99\x4F\x12\x50\x64\x07\x2A\x31\xFE\xF0\x29\x3C\xAF\x1D\xFF\x49\xB4\x42\xC9\xB8\xD0\x66\xBC\x95\x64\xF4\x56\xD2\xE7\xB5\x31\xB1\x81\x4A\x26\xCE\x48\x32\x71\x4E\x23\x17\x1F\x39\xCF\xC5\x47\xCD\x77\xF1\x91\xEC\x84\xC6\x0D\x93\x13\x1A\x8D\x1F\x31\xAC\xA2\x01\x2C\x23\x4F\x14\x3C\xBA\x75\x99\xD7\xD0\xBA\x69\x72\x72\xD0\x40\x37\x27\xE6\xD4\x7A\x66\x86\x9A\x66\xD8\x9D\xB2\x59\x9A\x28\x9E\xB9\xEA\x38\xD5\xA6\x20\x57\x13\x5C\x51\x05\x0D\xB5\x0C\x33\x27\x99\x80\x4D\xC1\xCC\x35\xEA\xCE\x36\x02\x4C\x6F\x02\xB0\xA9\xCF\x00\x60\xF0\xBB\x29\xF8\x5C\x93\xC7\x83\x63\xC1\x36\x6C\x1F\x6E\x2A\x3A\x47\x75\x43\xEB\x00\x59\x26\x90\x84\x66\xEB\x22\x08\x2F\x17\xBA\x3B\x67\xEB\x9B\x61\x65\x4E\x5B\x80\x69\x97\x8F\x7F\x9F\xBA\xCD\xE0\x45\x86\xD8\x09\xBE\x61\x67\x8C\xCC\x26\x0E\x97\xE1\xB8\x91\x7B\x55\x41\xE4\x06\x6C\x52\xF9\x3D\xB8\x40\xF1\x44\x02\xDE\x8D\xC9\xD5\x09\xEA\x8A\x35\x5C\xB3\x87\x2B\x3A\x1D\xAB\x15\x1F\xE1\x82\x2A\xE0\x1F\x31\xF5\x19\x9D\x50\x2B\x3A\x6A\x18\x3F\x87\x20\x42\x4B\x1A\x7B\xED\x35\x88\x8E\x65\x97\x0B\x41\xF5\x6A\xB4\xBA\x8E\x6B\xE9\x82\x63\x50\x68\xB4\x37\x8E\x55\xE2\xF3\x08\x76\x81\x80\xA2\xF2\x06\x28\x13\xB6\xF8\x6C\x98\xA0\x69\xFD\xEB\xA9\xF1\x11\xB6\xD6\x1A\xE5\xEC\xA6\xFD\xC3\x04\x82\x13\x20\x34\x4F\x2F\x4C\x6D\xD1\xEF\x6C\x66\x58\x0D\x36\x17\x87\x80\x42\x48\xB9\x38\x1A\x58\xBF\x01\x6C\x4E\x79\x77\x0C\xE1\xF6\x71\x71\x20\x8E\x36\xB4\xA9\x02\xD8\x15\x8C\x30\x83\x11\xCA\xB0\xB5\x15\xFE\x49\xB0\x58\xA4\xE0\xEA\x8A\xAA\x27\x55\x15\xDA\x64\x69\x52\xAA\x9B\x94\xA4\x49\x29\x20\x64\xB4\xBB\x84\x9E\xC8\xC8\x9D\x02\x15\xDE\xC2\xD6\xC7\xA2\x17\x55\xF9\x4E\x2D\x6D\x64\xE3\x80\x3C\x1C\x46\x43\x00\x0D\xCD\x14\xF4\x51\x68\xAD\xD1\x8C\x0C\xC0\x2E\x7D\x1B\x8F\x3C\x15\xC9\xE3\x0F\xE3\xCC\xAD\x6F\x0E\x54\x40\xED\xEE\x30\x30\x36\x64\xF9\xD8\xA6\x25\x20\x48\x67\x9D\x5E\x73\xE6\x70\x45\xFE\x2C\x78\xD4\xFE\x7F\xB7\x0B\x4F\x14\x59\xF2\xAF\xF7\x70\xBE\x7F\x22\xFE\x57\x24\x25\x22\x13\x32\xA3\xDE\x19\xA6\xE1\xD0\x20\x29\x72\xC6\xA9\x35\xA7\x5B\x6F\xAE\xAA\x0C\x41\xF7\x79\xB8\xE3\xAE\xD0\x82\x3D\xBE\x5C\xC8\xE9\x02\x35\x5D\xA0\x93\x02\x2C\x82\x4D\x06\x36\x4E\xAE\x8C\x08\xBF\x5A\x63\xEF\xB2\x4C\x31\xE5\xA5\x93\xCE\xFA\x2F\x89\x43\x4B\x20\x32\x15\x02\x06\x5D\x16\x19\x6E\xE4\xD7\x03\xF5\xA1\x76\xEE\x33\x27\x97\x48\xB8\x9E\xB6\xA0\xEE\xC9\x04\x87\xB3\x68\xD2\xFB\xD4\x26\xFF\x87\x33\x6D\x24\xC0\xFD\x3F\x98\x32\xFC\x1B\x94\xE9\xBF\x61\x79\x9E\x7F\x79\x59\x84\x9F\x8A\xFF\x0A\xF8\x8F\x96\xF4\x60\xCB\x8C\x4E\x39\x52\x20\x8F\xFC\x07\x7F\xEA\x66\x32\x0D\x8E\x6F\x45\x26\x32\xEA\xA0\x06\x93\x54\x8B\x33\xDF\x94\xFE\x0B\x2F\xE9\x7F\x53\xF6\xBF\xD1\x53\xDF\xD8\xAB\xAA\xA1\x7F\xED\x4B\xE9\x1B\xCB\xDF\x0C\xC3\x37\x16\xBF\x31\xFC\x8D\x58\x56\x3B\xF6\x57\x83\xB4\xBF\x81\xFF\xC4\xEB\xFB\xFD\x0D\x02\x73\x55\xD4\x23\x41\xD0\x8C\x9F\x4B\x88\x17\x68\x37\xE2\x0A\x88\x2B\x78\x2D\xE9\x35\x2D\xC0\xB8\xCC\x2E\x3B\x88\xAD\x05\x9C\x2E\xA0\x11\xF9\x9E\x68\xF6\x0D\xE5\x45\xEF\x69\xD0\x7B\x1A\xF6\x9E\xCA\xDE\xD3\xA8\xF7\x54\x2D\x32\x43\x0D\x0C\xDB\x49\x90\x07\x78\x5C\x72\x37\xF5\x89\x6F\x9F\xDB\xB1\x73\x3A\xB6\x22\x48\xF5\x19\x4A\x47\x5B\x41\xEE\xDC\x9D\xCB\x6C\x13\x9B\x9A\xF0\x19\x39\xB3\x90\xDA\x85\xB6\x70\x34\x96\x38\xE5\x35\x19\xB2\x50\x87\xF6\x93\x96\x0C\x47\xCA\x9F\x38\x1A\xCF\x46\x8D\x13\x6D\x93\x03\x1B\x6E\x9B\x22\x9E\x89\xCA\x16\x6D\x14\xF1\x59\xC1\xB3\xEA\x9E\x35\x3C\xEB\xF0\x9C\x39\x81\x87\xEB\x74\x08\x6D\xD9\xFB\xBB\x45\x32\x11\x6D\x4D\x38\x93\x5C\x19\xCF\xEB\xE3\x71\x1D\x1D\x01\xE2\x77\x06\xA6\x70\x2A\x9C\x32\x85\xD5\x43\xAA\x43\x4E\xA3\x25\x81\x85\xFB\xF6\x0F\x07\xA3\x27\xE0\x60\xFC\xFF\xA2\x7A\x54\xF8\x09\x72\x56\x6A\x1A\x66\x51\xE7\xC8\x07\xBC\x6D\x11\x06\xC5\xF8\x97\x18\x39\x30\x25\x7A\x99\xC3\x66\x83\x6D\x2B\x8D\x20\x0F\x63\xA7\x5C\xBE\x16\xE0\x49\xD0\x94\xCE\x74\xA3\xE0\x71\xA0\xF1\xB2\x29\x88\x1D\xC7\x05\x5F\x78\x47\xE6\xB9\x06\xD0\xEF\xDF\xD4\xF9\xC2\x91\x75\x91\x2C\x08\x02\x9D\xD2\x73\x57\xD0\xD1\x71\x3A\x62\x94\x72\x38\x2F\xA7\xFD\xA8\x1D\x9F\x49\x26\xE7\xDF\xF0\xEA\xD4\xB5\x6E\x19\xB8\x16\x7E\xEA\x0A\x97\x8F\x5F\x8F\x4A\x38\xCE\x6B\x0E\x27\x02\x3D\xE7\x72\x1C\x30\x0A\x81\x3C\xF9\xD7\x7B\x38\xDF\x3F\xAA\x2C\xF3\x3C\x57\x5C\xA2\xF3\x3C\x37\xB9\xCD\xF2\x30\xA3\x11\xFC\xF2\xF8\x2B\x83\x5F\x23\xF8\x65\xE1\xD7\x90\xCE\xC8\x5D\xEE\xAB\x2B\xD1\x40\xE1\x72\x3F\x80\x5F\xDD\xAC\x7B\xD8\xF4\x7F\x70\x6B\xEA\x2E\xE9\xB3\xB6\xB6\x04\xE6\x88\x4B\x5B\x07\x47\x0A\x67\xE3\xD7\x76\xEE\xD7\x23\x80\x55\xE1\xEC\xF8\x75\x48\x68\x45\x39\x0D\x38\x55\xA6\x9F\x10\xF1\xA8\x0E\x37\xB8\xE2\xAF\x22\xCD\xB8\x5B\x71\x25\xD0\x06\x10\x70\xEE\xCC\x5A\xA0\xE1\x9E\x71\x53\x94\x2F\x02\xC5\x71\xFA\xDA\x59\xB4\x6D\x9E\x6C\x17\x2A\x21\x95\x36\x26\x2B\x6C\x51\x14\x79\x51\x8E\xFF\x98\xB6\x37\xC1\xDF\x7C\x31\x3A\x95\x93\x22\x38\x6A\xF8\xE2\x81\x5E\x6B\x4C\xD8\x72\xE1\x19\x13\xAE\x7D\x93\xAE\x7D\x4D\xE6\x72\x5A\xFE\x26\x5D\xFE\x0A\x4D\x23\x64\x21\xC9\x93\x15\x8A\xF3\x8D\xCF\xAA\xC5\x05\x13\x9F\x75\x8B\x3C\x60\xF3\xE5\xAF\x69\xF9\xAB\x2D\x2C\x7F\xE5\xCC\xF8\xBF\x9F\x8A\x1E\x38\x30\xB3\x1C\xE7\x09\x4B\xF1\x9D\x1B\x0C\x8B\x5A\x86\xED\x9E\x0E\xC7\xBA\xBF\x81\xBB\xDE\xDC\xDF\xD8\x2E\x28\x2B\xF0\xF4\x10\xED\xF7\xC0\x5D\x2D\x79\x4B\x38\xE1\xF2\xF1\x6F\x62\x3D\xC9\xAA\xB4\x72\x92\x36\x04\x20\x9A\x46\xA4\x71\x86\xB6\xA4\x1F\x1C\xAC\xC4\xF8\x4F\x4F\x05\xB6\x2D\x9C\xEC\x7F\x1E\x10\x99\x74\xFF\xE3\xED\x82\x15\x5A\x0B\xA9\xC9\x27\x2D\x1F\xBF\x2B\xF1\x30\xFA\x2D\xFA\xCD\x7B\x3E\x55\x3A\x55\x6E\xC0\x7E\x3C\xDC\x7C\xDA\xB1\x3F\x6C\x68\x61\xE3\x49\x1B\x10\xA7\xFC\xE0\x00\x2A\x9C\xDC\x4B\x18\x03\x89\xC1\x58\xAF\x37\xF2\x11\xEA\xC4\x30\x01\xBA\x6F\x38\xFD\x2D\x1B\xA1\x50\x3B\xFD\x0D\x29\x15\x8F\x60\xAA\x1A\xB0\x5D\x9A\x3F\x0C\xC7\xA9\xF1\x6F\xF5\x3B\x82\xD9\x1A\x25\x59\x95\x9E\x3B\xBC\x50\xB3\x3A\x38\x67\x0A\xB8\x3B\x99\xDB\xF2\x16\xA7\xF0\x7F\x75\x67\x1A\xAE\x73\xB9\x55\x4E\xEC\x55\xBB\x01\xC7\xEC\xFE\x0F\x4A\x36\x3A\x4E\x5D\xEA\xD4\x8A\xB8\x42\x8F\xD1\x09\x89\x3C\x91\x92\xB6\xD1\xFC\xE4\xBA\x45\xBB\xA5\xD6\xE5\x56\x5B\xFF\x1F\x16\xF7\x92\x78\x55\x8D\xF6\x11\xB5\x0E\xDB\x49\xA0\x33\x8B\xB2\x5C\x7B\x1B\xBC\x65\x1B\xF9\xB8\x8A\x96\xB3\x5C\x6F\x2C\xDB\x8A\xB2\x4A\xF8\xC9\x62\xD9\x9D\xAB\xEB\xA3\xE4\xF5\x8F\x8C\x85\x65\xBE\x87\x17\x27\x8E\xAE\xD5\xB9\x97\x78\xCB\x27\x73\xAA\x6D\xE0\x35\x76\xEC\x54\x4B\xE7\xF9\xB8\x42\x43\x51\xCA\x0E\x42\xAD\x3E\x53\x08\xA5\x9D\x66\x40\x66\x76\xA8\x78\x10\xE5\xA8\x9F\xB4\x78\xB7\x89\x68\x02\x7A\x9D\x6A\x1D\x5D\x09\x40\xD0\x4D\x5A\xBC\x95\x05\xF8\xB6\x7B\xE9\x8C\x0B\xB7\x93\x2E\xDB\xAB\x60\xB7\x94\xB1\x25\x73\x0D\x35\x25\xBC\x7A\xF3\x17\x64\x77\x5D\x56\xC6\x7F\x14\xCF\x1F\x4D\xAD\xFC\x67\x44\x2D\xBD\xAE\xB5\xFF\xA4\xA8\x33\xAF\x50\x18\x7A\xC3\xA0\x34\xDF\x04\xE5\x7C\x50\x7E\x16\x5A\xF0\xBA\x56\xFE\xEF\x00\x7E\xAA\xD6\xFE\x7E\x80\x9F\x44\x99\x07\xB5\xF3\xD6\x65\x01\xDC\x4E\xB7\x4E\xC6\x07\xD5\xFA\x8F\x13\x26\x82\xCB\xF7\x5E\x65\xBC\x28\x7F\xCD\x74\x96\xA8\xC4\x74\x8D\x1E\x80\xE1\x68\x91\x94\x3C\x3A\x3D\x24\xD4\x18\xBA\x60\x2A\xD6\xDA\xC6\x12\xAA\x32\x42\x95\x05\x54\xE5\x8C\xAA\x02\x50\x85\xA7\x09\xC1\x44\x99\x01\xB6\x06\x5E\x80\x7A\x80\xE6\xA9\x80\xAD\x0C\xB1\x05\x53\xB1\x7A\x1F\x08\xFF\xB6\x31\x11\x5B\x36\xC1\x96\x09\x45\xE9\x49\x7B\xA8\x25\x7B\x07\xEB\xA1\x54\x75\x32\x90\x0C\x5E\x01\x5B\x20\xD8\x6A\x5B\xBA\x01\x61\x0B\x7A\x9D\x6A\x1D\xB4\xB1\xDA\xBA\x01\x7B\x9F\x21\xB6\xF2\x88\x2D\xEB\x84\x2B\x08\x5B\x7C\x92\x6C\xD7\xDA\xC6\x00\xB6\xC2\xCD\x14\x8D\x13\xA6\xC3\x40\x9C\x2E\x1D\x17\xA0\x01\x4D\x83\x8C\x2F\xD8\x78\x66\xA0\x73\x85\xF3\x0E\xAE\x0A\xD8\x60\x4B\x9E\x74\x71\x66\xA1\x54\xB5\x38\xC9\xA9\x52\xDD\xA2\x55\x22\x29\xAD\x0D\x5A\xD9\x4C\xB0\xB2\x85\xC9\xC6\xFE\xFA\x33\xE5\x4F\x7A\x13\x06\x4A\x42\x62\x01\x58\xA5\x56\x79\x5B\xFE\xA6\xC1\x23\xDF\x4E\x49\xDA\x23\x24\x5A\xA7\x84\xA4\x23\xA4\xCB\x74\x31\x7E\x2F\x8B\x58\x3C\x60\x65\x7B\xAD\x21\x3A\x42\xF7\x9B\x11\x1D\x03\xB6\x41\x57\xB2\x44\x4A\x12\x48\x29\x63\x52\xCA\xE3\xAA\x47\xD5\xC5\x02\x58\x0B\x3E\xB3\xB1\x09\x1D\x59\xA4\x23\xD4\x2B\xF4\x3E\x97\x3B\x34\xCD\x05\x3A\x92\x09\x1D\xE9\x50\x14\x9E\x23\x1D\xC9\x84\x8E\x74\xA4\x23\x99\xD0\x91\x65\x0F\xBB\x40\x47\x30\xE5\x5A\xA2\xDB\x89\xE0\x5E\xA7\x5A\x67\x85\x0A\xBD\x18\x0B\x06\x6B\x16\xE9\x48\x12\x55\x01\x1D\xE5\x6C\x91\x58\x6B\x1B\x8D\xAB\xDE\xEC\xAF\x14\xE9\x89\x05\xEA\x8D\x1D\x0D\xE1\xD9\x0D\xEA\x89\x39\xBB\x17\x6A\xE8\x18\x7D\x0C\x75\x4A\x17\x38\xA1\x60\x7E\x4D\x4B\x55\x8B\x13\x9C\x2A\xD5\x50\xDA\xA7\x21\x0D\x73\x0A\x4E\x85\x78\x94\xFB\xBC\x67\x47\xFD\x1B\xF0\x12\xA6\x1E\x47\x30\xA5\x48\x52\x23\xBD\xE9\xEB\xC8\x82\xDE\x76\x89\x1C\x6E\xE6\x98\x9D\x50\x4A\x77\xAD\x3D\x50\x88\x99\xA1\x90\x9A\xB7\x28\x1D\x91\x18\x76\xC2\x99\x25\x92\xC2\x4B\xF4\x5F\xC9\x9D\x6E\x61\x27\xC2\x38\xD3\x09\x91\xD8\x50\x94\x2C\x92\x58\x4B\x76\xA5\xAA\x2B\x8D\xE0\x2C\x58\x92\x05\x22\x01\x32\x04\x75\xC8\x04\x22\xD1\xED\x54\xEB\x3D\xAF\x98\x19\x22\xD1\x33\x44\xA2\x23\x91\x68\xDF\x74\xAC\x1D\xCD\x17\x7B\x15\x1D\x27\x4A\xF6\x2E\x67\xA3\x45\xF0\x5F\x26\xC3\xF6\x00\x8D\xDC\x43\xDA\x0A\x0F\x7D\x73\x00\xFF\xF0\x46\xD9\x9D\x1B\xEC\xC3\x29\xB0\xE7\xDF\x50\x60\x1F\x5E\x18\xD8\xDD\x20\xEA\x36\xD0\x06\x6D\x70\xCF\x0D\xB7\x72\x0A\x6E\xD9\x37\x14\xDC\xCA\x0B\x24\xD7\x0F\x8B\xF9\xF4\x1A\x05\xC9\x10\x36\x2F\x97\x18\x65\xAD\xB6\x73\xFE\x49\x51\x22\xA5\x1E\xAC\xCC\xF9\x41\x3E\x4D\xAA\xC3\x6F\x28\x90\x3F\x40\x52\x7D\x00\x70\x1B\xFC\x4B\x84\x9B\xFF\xB4\xE8\x03\x4E\x6F\x1D\x70\xC5\xBF\x48\xC0\xDD\x3F\x05\x38\xB5\x75\xC0\xFD\x8B\x14\x2A\xB4\xCD\xDB\x4C\xAA\xE8\x0B\x02\xDC\x37\x96\x54\xB9\x50\xC0\xFD\x5D\x07\xB8\x47\x5C\x29\x64\xFC\xA5\x82\xA4\xD1\xEC\xCE\x32\x80\x26\x94\xAF\x5A\xAF\xFD\xDD\x1B\x68\xDB\x62\xC7\x96\x69\x9D\x53\xF5\xC0\x3D\x05\xEC\xFD\x95\xF9\x17\x08\x66\xA7\xF6\x88\xAA\x3B\x57\xD8\x23\x16\x22\xAC\x15\xF6\x2A\x1C\xD4\x0C\x8E\x19\xB2\x73\x65\x38\xCF\xEA\x9F\xD6\xE4\xF5\x37\x14\x11\x3F\x30\x4D\x9E\xF6\xDD\xE8\xB4\x3C\x99\xB9\xF8\xB9\x43\xF4\xA2\xCA\xFC\x3E\x7A\x61\xFD\xB4\x91\x76\xE2\x4F\xCE\xDA\x30\xA2\xBF\xD5\xA4\x5D\xC8\x85\xD4\xCA\x64\x36\x0F\x11\xF4\x82\xC3\x4A\x72\xF8\xA6\x92\xC3\x37\xB6\x5D\x34\x36\x6E\xC3\xC9\xDB\x2F\x1C\xBE\xC9\xD4\x76\xE9\xC9\x7A\x49\xC7\x39\xB0\x2F\xB5\xB0\x25\x55\x73\xB7\xE1\x6A\x6A\xA3\xAC\xE6\x6E\xC3\xD5\xDC\x6D\x78\xB6\xC9\x36\x9C\x0F\xDF\xEC\xA6\xDB\xF0\xDE\xE1\x9B\xE9\x6D\xC3\x2D\xE1\xC5\x76\xDB\x70\x74\x8C\x77\x32\xD5\x03\xFE\x4E\x44\x8A\xFF\x24\xFA\x42\xC6\x9F\x3A\x60\x8E\xF7\xB6\x6C\x58\x78\x4F\x62\x64\xF8\xDD\xE4\xF7\xEF\x74\xBF\xFD\x9F\x0A\xFF\x11\xE1\xD1\x99\x7E\xFC\x07\xD1\x16\x4D\x31\x89\x92\x0A\xA7\xD3\x0A\xD8\xC8\xFB\x92\x46\xFE\x51\xF8\x7F\x12\xFE\xE6\xAE\x0E\x59\x31\x3E\x97\xCB\x6C\x12\x30\x6D\xBB\x45\x98\x11\xA6\x73\xC2\x74\x06\x98\x2E\x18\xD3\x83\x88\x69\x74\xCA\xCE\x01\xD3\x19\x1F\xDC\xE5\x09\xA6\x73\xC4\xF4\x90\x0F\xEE\x06\xCE\xB6\x4D\x3E\xF7\xE0\x2E\x77\xFD\xA3\xB5\x7C\xEE\xC1\x5D\x3E\xF7\xE0\x6E\xB8\xC9\xC1\x5D\x46\x98\x1E\x6C\x7A\x70\x97\x01\xA6\x33\xC6\x74\xD1\x3B\xB8\x1B\x10\xA6\x07\x2E\x1E\xDC\x59\xC4\xB4\x75\x6A\xCE\x0A\x44\x73\x26\x06\x75\xB2\x49\x50\x27\xE6\x4F\xDF\x84\xEC\x85\x41\xD6\x5F\x3E\x0D\xD9\xD2\x29\xFC\x44\x3A\xE5\xCC\x36\xE4\x6B\x28\x57\x05\xB9\xBB\x5F\x08\x58\xD5\x37\x2E\x58\xD5\x05\x12\xAC\x9E\x43\xB0\x79\xE9\xF2\x72\x84\x1E\x6C\x2C\x18\x5E\xA8\xA5\x9D\xA0\x18\xF8\x8D\x10\x2E\xA5\xCF\xFA\x6D\x88\x12\xD7\x68\x82\xAF\x9A\xCF\xFA\xBB\x83\x6D\xC5\xAC\x5F\x27\xF0\xD5\xB3\xAC\xFF\xC1\x3F\x81\xDD\x8C\xF5\xAB\xF3\xB1\x7E\x90\x42\x18\x73\x72\x2B\xAC\xFF\x33\x1D\xEB\xFF\x78\xC7\xFA\x3F\xDB\xB1\xFE\x65\xE4\xFC\xF0\xEB\xB2\x2B\x85\x09\xA8\xB0\xA9\x0C\x60\xD6\x9C\xB0\xEF\xF2\x94\x91\xF9\x66\x57\xA9\xD9\x8D\x2D\x89\x7F\x63\xC8\x4F\x29\xA0\xB3\x31\xFB\xF1\x52\x88\xD3\x7E\x77\xEB\xD1\x77\x5B\xFB\x71\x8B\xD7\x85\xF9\xF2\x30\x22\xA6\x68\x9D\x1A\xFF\xB7\x88\xC1\x67\xD0\x85\x56\xE1\xEC\xF8\x03\xC8\xC6\x32\x6A\xAE\x36\x2E\x1B\xFF\x26\x1A\xB4\xED\xF8\x4F\xE8\x2E\x52\x25\xE3\x12\x34\x33\x4B\xD0\x26\x4B\xB0\x6F\xEF\x31\xD3\x47\xB0\x19\x5F\xC3\x98\x55\xDC\x06\x5E\xA2\xD3\x72\x81\x41\x06\x22\x95\x98\x59\xC5\xCD\xCC\x2A\x6E\x66\xAE\xE2\x66\x12\x2A\x19\xD0\x1D\x79\x13\xA8\x04\xF4\xB1\xDA\xC4\x55\x08\xBD\x4E\xB5\xCE\x77\xE0\x7B\xAB\xB0\xB3\xF7\x98\x19\x7B\x8F\x09\xF6\x1E\x67\xFC\x95\xD3\xAB\x70\x56\x39\x9B\xB9\x38\xCA\x6B\xD2\x6F\x04\xE1\x80\x6A\x95\xF0\x1B\x45\x4F\x5B\x54\xD4\xA9\x8A\xDA\x22\xB7\x4E\xAD\x76\x2B\x59\x75\x68\x4A\x2C\xA8\x53\x2A\x5C\xE7\x7E\x7E\x3E\xE3\x69\xC6\xC6\x53\xFB\x95\x31\x9E\x66\xE7\x36\x9E\xDA\x0B\x33\x9E\x9A\x9E\xF1\xB4\xBF\x88\x53\xE3\xA9\x98\x45\xCF\xB2\x62\x37\x1D\x41\x24\xEF\x45\xF9\xD8\x9E\x33\x81\x0C\xC6\xD0\xB8\xC6\x64\x5C\x63\x92\x2E\xE8\x4B\x58\x61\x82\x56\x18\x5E\xD2\x49\x7C\x07\x1E\xB7\x49\x63\xE3\x76\x05\x7E\x8E\x7B\xCD\xC8\xBD\x6A\xF7\x39\x5B\xBB\x55\x03\x66\xC4\x5E\x75\xFB\xAB\x6F\x81\xB1\xEE\xC3\x18\x35\xFE\x13\xB7\xDF\xB2\x21\xF6\xAA\xCF\xDF\x8E\x85\xFE\xB3\xF4\x78\x1F\x3D\x42\xE3\x9F\xE0\x37\xEF\xA1\x37\x1F\xE4\xC7\xF7\xD3\xE3\xFB\xBA\x8A\xEF\xE1\x37\xAF\xA1\x37\x6F\xE7\xC7\x37\xD3\xE3\x1B\xBB\x8A\xAF\xE1\x37\xB7\xD2\x9B\x9F\xE3\xC7\x17\xD3\xE3\x8B\xBA\x8A\xB7\xF2\x9B\x4F\xDC\x46\x63\xBC\x8D\xC7\x48\x8F\xF7\xDD\xD6\x8D\x91\x7E\x3A\xE1\xC7\xEB\x7B\xD5\x1D\x34\x41\x80\xF8\x17\x6F\x8F\x3F\x3F\xDB\xFD\xFC\x70\xF7\xF3\xFD\xDD\xCF\x5F\xEB\x7E\xBE\xB9\xFB\xF9\xF3\xDD\xCF\x17\x77\x3F\xBF\x78\x5B\xD7\x6E\x37\x8C\xF7\xBC\x3A\xFE\xBC\xA7\xFB\xF9\xF6\xEE\xE7\x1B\xE1\x67\x59\x0A\x2F\x96\x09\x0D\xE5\x67\xD5\x37\x1E\x12\x22\x89\x7D\xDD\x62\xE0\x05\xEC\xA8\x47\x61\x1F\xC4\xB2\xFA\x18\x34\xE1\xC4\x61\xBA\x0A\x0F\x25\x37\xDF\x1E\x4B\x14\x95\xDC\xD1\x95\xE8\x5A\xFA\x7B\xE1\x11\x54\x98\x65\xF5\x2E\x7A\xB3\x4A\xE1\x2B\xEC\xBA\xBF\x17\x9A\x43\x66\xA4\xFC\x8E\x96\x3C\x7E\x12\xEF\x7E\xDA\xFB\x8E\x29\x60\xAE\xD3\x18\x18\x87\xF8\xAF\x5C\x56\xC8\xBA\xD1\xCA\x86\xB7\xB6\x31\xAC\xA7\x19\x19\xF6\x6C\x34\xD3\x1F\x1A\xBC\x46\xD4\xF2\xD5\x18\x09\x6F\x32\xBE\x54\xE1\x04\x6C\x9B\x77\xE0\x55\x45\x6C\x97\xE2\x06\x36\xDA\x65\x4E\xAC\xF9\xF5\x16\x39\x12\x74\x9C\x39\x4D\xFE\x4D\xE3\x96\xFC\x47\x24\x5D\xE7\xB2\x78\x2C\x41\xC3\x30\x2D\x45\xC3\x8D\x66\xF8\x0C\x66\xCC\x0D\xB0\xB2\x49\x61\x03\xFB\xF5\x15\xFA\x08\x6A\xB6\xFC\x52\xD4\x6E\x9A\x4A\xE9\xBB\x85\xD0\x48\x47\x6E\xFE\xF8\x84\xCA\x23\x80\x1C\x1E\x56\xF9\x88\x67\x7C\x1C\x3D\xA8\xF7\x09\xF2\xFA\x7C\xF7\x2B\x3A\xAF\x4F\x6A\x08\x6B\xC3\x24\x60\x66\xF8\x50\x32\xF8\x78\x3E\x23\x59\x92\x87\x58\x78\x51\xA0\xFB\x40\xF9\x8F\x46\x0E\xE6\x91\x83\x5F\x6F\x1B\x85\xAE\xDA\x33\x84\xA1\x67\x08\x43\xF7\x09\xC3\x74\x84\xA1\x67\x08\x03\x05\xFE\xB8\xC5\x0B\xD3\x3B\xDA\x3A\xC3\xA8\x14\x75\x8E\x57\xAD\x9A\x82\x6E\x83\x38\x59\x0F\x10\x01\x8D\x74\x0A\x2F\x15\xF9\x02\xBE\x90\x2E\x3B\x18\xAE\xF6\x84\x30\x28\x78\x6B\x19\xF0\x22\xE9\xB4\x77\x00\x4F\x02\xF4\xDB\x51\xEB\x30\xC2\xF1\x00\x6D\xEB\x7E\x84\x38\x37\x7E\x37\x93\x50\x71\xA0\x52\x11\x07\xB8\xA3\x91\x44\x43\x03\xFC\xD4\x1E\xAC\xB4\x33\x1C\xAE\x19\x05\x0C\x9E\x43\x81\x02\xE6\x06\x40\x41\xB0\x87\xC0\x6F\x9D\xC4\xF8\x24\xE8\x33\x3B\x40\xCD\xC1\x09\x3C\x4E\x23\x67\xED\x13\x6D\x23\x61\x32\x48\x84\x03\xDE\x99\xF8\x9B\x5A\xDA\x95\x48\x94\xD2\x74\xB6\xAA\x71\xCE\x73\x47\x2A\xCF\x3D\x52\xB5\xB5\x91\x62\xF8\x6D\x18\x98\xC5\x90\x0B\xB3\xA3\xB2\x71\x54\xBD\x51\x88\x73\x8F\x42\x6E\x69\x14\x65\x59\xFE\x1B\x29\x27\x8E\xEF\x53\x3A\x22\x3A\x8C\x84\x8F\x9B\x5A\xB9\xBA\x34\xFE\x79\x0E\x0A\xC7\x5A\x86\x93\xE5\xBF\x42\x8D\xCD\x17\xA0\x6C\xBD\x74\xA3\xE7\xFC\xAC\xD6\x3D\xB2\x38\x68\xA3\xBC\xEC\x02\xEA\x51\xBC\x89\x3D\x52\x4D\x7C\x50\x22\x91\xA9\xB2\x6B\x28\x50\x38\xAC\x9D\xF7\xE1\xA0\x39\xCE\xC3\xF7\x40\x6D\xB1\x4C\x85\xB5\x88\x1F\xD2\x2A\xE3\x0F\x51\x0F\x0C\x1F\xE2\x1B\x53\xEE\x12\xB4\x52\xB1\x70\x59\x85\x76\xCB\x6F\x15\x4E\xBC\x2E\x04\x66\x48\x2A\x90\x96\x8A\xDE\xA3\xE5\x93\xBB\xAB\xB9\x3D\x6D\x08\x34\x9E\xD7\x8D\xFF\x3F\x76\xF3\x15\xB4\x80\xE3\xF7\x18\xD1\xE1\xAD\xA7\xA2\x6E\x0C\xEC\x87\xA2\x37\x24\xAA\xD1\x5B\xFB\x71\x25\x44\xD8\x49\x79\xB1\x47\xBC\x1F\x5A\xAA\x84\xFF\x20\xFC\x1D\x9F\xA1\xEB\xF2\x00\xA0\x8F\xA1\x50\xF9\x22\x16\xBF\x9E\x8B\xCD\x5E\xF5\xE2\x3B\xA2\x5C\xBA\x95\x7E\x52\x54\x3F\xA0\x87\xDB\xEF\x20\xB6\x82\xE1\x5C\xA5\x97\xF4\x35\x32\xF6\x98\x3A\x81\x23\xE2\xFB\xCF\x9C\xEE\xB1\x37\x79\x25\x8D\x04\x70\x17\x8E\x70\xCB\x82\x87\x05\x3F\xB0\xA9\x72\x7B\x88\x11\x12\x02\xED\x95\xE5\xE7\x94\xD2\x5D\x7A\x94\x7B\xC4\x66\xD7\x9A\x39\x40\x2A\x07\x92\x7E\x54\xB7\x8F\x0C\x3E\x59\x52\xE8\x2E\xEA\x36\x0C\xB3\xD6\x4E\xE3\xB6\x9B\xAE\xC0\xE3\x8E\xC1\x69\xA2\xD7\x46\xB4\x3E\x9C\xD0\xF2\x34\xA5\x7F\x54\x3B\x7E\x5B\x17\x8F\xFB\x51\x33\x81\xC1\x39\xF4\x45\x12\xDD\x1B\xFA\xBF\x4C\x17\x8D\x41\x8D\xB7\x38\xB1\x72\xF6\xEC\xD9\xB3\x8B\x3F\x40\x97\x47\xEF\xA4\xD9\x53\xC3\x1F\x0D\xBE\xFC\xD2\x99\x2B\x34\x39\x80\x8D\x5B\xEF\xFC\xDF\xBE\x02\x83\x3A\x91\x81\xC6\x3B\x98\xE5\x5F\x25\x6B\x81\xB1\xA3\xA8\xFA\x07\xA7\x46\x5A\x26\x43\x7D\x77\xBA\x82\x14\xDE\x48\xF4\x6F\x79\x76\x1A\x75\xD1\xDF\x23\xBA\xCB\xDD\x2F\x38\x47\x34\xF3\x18\xC5\x3C\x44\xED\xE6\x68\xDD\x1F\x8B\xB3\xE6\x48\xDD\x21\xB8\xAF\x8A\xAB\x83\xAE\x2B\x88\xF1\xDB\x03\x22\xBA\x28\xCD\xE4\x61\xC9\xD1\x4A\xA6\x23\x94\x3C\xE3\x41\x18\xCD\x66\xA3\x40\xBE\x75\xCE\xDE\x6F\xD7\x5D\x84\xA3\xB9\xDD\x9F\x23\x9C\x79\x24\x9F\x51\x3B\x7E\xF6\xE9\x5E\x38\xF7\x10\x8E\x9B\x42\x3B\x72\x9D\x4F\xC4\x70\xA1\x21\xE8\xFB\xBB\x9F\xDF\x23\xB2\x10\x3A\xD3\xF4\x5B\xE0\x2B\xD7\x18\x8E\x92\xA3\x69\xE9\x24\x6E\x76\x03\x1B\xE1\x64\x28\x9F\x99\x8A\x2C\xDF\xEB\x24\xA4\x1B\xC1\x58\x4F\x12\xF8\xED\xF8\xB9\xA7\xD1\xFD\xD5\xCB\x75\x5A\x2E\xA4\x7D\x14\xE8\x43\x17\x86\xFE\xBC\xD3\x08\x80\xF3\x0C\xBD\x23\x59\x5C\x70\xCE\xF8\x61\x3A\xB0\xE7\x9F\x3E\xC7\xC0\xE0\x93\x10\x60\xA6\x17\x8B\xE0\x35\xEA\x3C\x18\xE2\xC8\x37\x01\x33\x69\x40\x59\x20\xD4\x24\x6C\x75\x33\x85\xB4\x73\x42\x4A\x44\x48\xA9\x12\x63\x33\x0F\x19\x52\x62\x16\x52\xC2\x0F\x9D\x4E\x21\xB5\x29\x92\x75\x0F\x52\x1C\x0D\x0B\xA3\x92\x7D\xB9\x90\x12\xE5\x8D\xE7\x59\x49\x6A\x7E\x76\x82\x73\x41\xE4\xA3\x73\x20\x32\x85\x9F\x93\x0F\xB0\x57\x50\x56\xEE\x88\x92\x8A\xBA\xFF\xDC\x54\xF7\x2F\xFC\xB9\xF3\x76\xBF\x31\x37\x18\x7D\x88\x50\x16\x42\xFD\xCE\x8D\x30\xCF\x3D\xAB\xB4\x67\xC5\x3D\x7F\xE8\x15\xB3\x3D\x87\x48\xE6\x53\xE1\x58\x1F\x4C\x00\xFC\xFD\x14\x00\xFE\xF1\xA5\x5F\x2D\x00\x9C\x3A\xDD\x07\xC0\x1D\x3F\x75\xC1\x00\xD8\x34\x1F\xC0\x5F\x86\xE3\x1E\xFE\x35\x13\x4B\x7F\x5A\x27\xF0\x58\x1B\x23\x7B\x46\xEE\x77\xDE\x91\x7F\xEA\x99\x73\xA2\xCD\x27\x33\x79\xC1\xCB\x7B\xEB\xEF\xAF\x36\xE6\xE5\x03\xB8\x3B\x39\xB3\x9E\x33\x07\x1D\xE7\x60\x42\x08\x0C\x8C\x52\x43\x73\xD0\x09\xBF\xE6\x1B\xCA\x30\x07\xD3\xC9\x80\x30\xF6\xC0\x44\x70\xEB\x69\x3A\x96\x02\xDA\xBA\x13\xAB\x4B\x8D\xED\x31\x17\xBC\xC9\x63\xFD\x10\x39\x44\x60\x2E\x97\x24\x73\x4B\x19\x43\x38\x9B\x56\xB0\xDF\xCA\x9C\xF5\x39\x45\x6D\xCD\xC3\x11\x75\xBE\x8A\x37\x15\x30\x3C\xBB\xF5\x37\x91\xA3\x79\x0E\x5B\x85\x95\x53\x1B\x37\x6F\xBC\x68\xE3\x1E\x71\x85\x04\xE0\xDE\xD4\x4E\x15\x8C\xD1\xC9\xDB\xE5\xB0\x0B\xCC\x63\xFC\x55\xE1\x32\x97\x7B\xB9\xDE\xA2\x45\x44\x7A\xF9\x48\x49\x47\xA2\x78\xC5\x8E\xA2\xAD\x96\x81\xF5\x4A\x1C\x97\xB3\x5E\x44\xA1\xA0\x52\x56\x37\x6F\x46\x14\x13\xF9\x25\x3D\x86\x69\xFA\xC8\xBF\x7F\x0A\xD9\x2F\x7B\x69\x2F\x57\x42\x8F\x26\xE2\x48\x3A\x31\x90\x10\x50\x48\xA0\x21\x66\x08\xE8\x8D\x73\x22\x58\xA3\x51\xA6\x23\x20\xF9\xB5\x5E\x04\x7F\x73\x9E\x45\xF0\xFB\xB7\x5C\xC0\x22\xF8\x1A\xCF\xE1\xFE\xF3\xCC\xE1\xFD\xCF\xBE\x80\x39\x9C\x33\x57\x4F\x2F\x0E\xFA\xF9\xA5\xE1\x67\xA7\x08\x22\x70\xE5\xE7\xBF\xA4\x97\xAB\x27\x0E\xA4\x27\x8D\x5F\xA6\xE7\x25\xE4\x48\x22\x02\xA6\x49\x73\xD0\xD7\x84\xC2\x1B\x72\x24\x73\x19\xA2\xD6\x73\x14\xD8\x18\xA1\x9E\x42\x86\xEB\xB2\xCB\x07\x23\x09\x7C\x9D\x7A\x19\x00\xF6\xAA\x64\x2D\xF1\xCD\x55\xCD\xA1\xE0\xE4\x55\x1C\xFA\x46\x8C\x3F\x41\x66\xB7\x4A\xF8\x2F\xF4\x34\x15\x67\x38\x68\x0D\x87\x3D\x6F\x2E\xB0\x27\x67\xFC\xE4\x6A\x3A\xC7\xB8\xF0\x1E\x3E\xB9\xC5\x1E\x60\xFC\x65\x8C\xD5\x5F\x76\x6A\xA0\xA6\x78\x9B\x53\x41\xFC\xFB\x02\xEB\x53\x52\x16\x93\x70\x8C\xD0\xCB\x1F\xA2\x42\x8A\x30\xCE\xC2\xC3\xF1\x4B\x39\x12\x92\x5D\x56\x85\x97\x07\x38\x5C\xA0\xA9\x73\x27\x43\x44\x68\x67\x9C\xA5\x8B\x6A\x14\xE5\x88\x43\x26\x61\xA4\xB2\x22\x5C\x66\xA5\x03\x03\xA7\x31\x02\x5B\x12\x46\x69\xD2\x2E\x64\x86\xF2\x0C\x97\xF0\x16\xAF\xAF\xB7\x75\x1E\x5C\xCD\xB0\xDF\x49\xDB\xE8\x55\x8E\x55\x60\x29\xFC\x13\x0D\x8B\xEE\x6A\xF3\x61\xC4\x74\x52\xB4\xD2\xC9\xF2\x25\x4A\xEA\x09\xE3\x5F\xA6\xB7\xC0\xD3\xC4\xA3\xB8\x8B\x76\xA2\x17\xA8\x4A\xE9\x7D\x21\x93\x9E\x4A\xE2\x2E\xCD\x4D\x3B\x16\xB2\xE6\x51\x02\x04\xFF\x82\x5F\x04\x74\xA1\x29\x76\xFC\x72\xEC\x23\x2D\x79\x09\xC2\x63\x26\x0D\x5A\xAF\x33\xFF\xC2\x3B\xE2\x07\xBD\x8F\x5F\x8C\x25\xBF\x94\xBC\xDD\xD8\x98\x7A\x7B\xAE\x81\x96\x18\x46\xB8\x74\xAA\xFC\x09\x69\x22\x58\xF0\x3C\x4A\x74\x2E\x30\x42\xCF\xCD\x6C\xA7\x04\x06\xDB\xD4\x1C\xE0\x85\xD0\x5C\x93\xEB\xF4\xF8\xEF\x23\x99\xD3\x35\xF2\x48\xDD\x5D\xC2\x34\xC6\xC8\x2F\x6A\x85\x81\xEA\x31\x3C\xB2\x4B\xAE\x74\xCF\xF7\x6A\xCB\xB2\x40\x1C\xB4\xB1\xEE\xDC\xDD\x28\xE7\xB5\x32\x25\x34\xC2\x14\xAD\x92\x99\xE8\xFD\x15\xE7\x04\x74\x9A\x06\x0B\x5B\x19\x36\xDD\xFE\x43\xB0\xB7\x63\xB0\x07\x67\x02\x09\x41\xDD\x7B\x02\xFD\x8E\x4C\x0C\x16\xC6\x4E\x14\x66\x7F\xA5\x62\xC8\x2B\xD1\x0B\x79\xC5\x16\x4E\xCC\x76\x68\x70\x51\x00\x14\xE6\xF4\x66\x42\x94\xAB\xD9\x84\x88\x1C\x10\xCB\x70\x08\xB0\x70\xE3\x3E\x90\xE6\x0A\x2D\xBD\x34\xD3\x61\x8B\x0E\x11\x2E\xA3\x33\x80\x95\x21\xFD\x1D\xFF\x34\xFE\x77\x6E\xE7\x1C\xD9\x8B\xD3\x3F\x66\x2B\xF2\x44\x93\x61\x12\x9D\x27\xC6\x88\x5E\x48\x21\x7F\xA8\x95\x65\x3C\xF1\x2A\x7B\xCB\xA9\x99\x3C\x13\xD9\xC1\x18\x17\x2D\x45\x0D\x26\xDE\x16\x52\x47\xB4\x70\x84\x09\x8C\x2A\x00\x92\x64\xB5\xD1\x4B\x8D\x89\xA8\xB2\x30\x36\x4E\x29\xA3\x97\x78\x82\xDA\x59\x9A\x01\x45\xA3\xB6\x11\x87\xFC\x6B\xFC\x85\x8D\x18\x09\x5C\x39\xEB\xB2\x80\x43\x13\xFD\xB9\x2C\x9A\xA0\xE3\xED\x7F\x1D\x92\x9D\x1A\xD0\x59\x91\xF2\xB2\x0E\x96\x59\xC0\xA4\x65\x5B\xF5\x3C\x4C\x7E\xA1\x03\xA6\xEE\x30\x69\x91\x43\xA6\x98\x64\xEE\x85\x5E\xB2\xD0\x55\x27\x82\x1C\xA5\x82\x84\xC2\x15\x51\xE7\xDE\xF4\xA8\x89\xF1\x99\x9F\x03\x9F\x53\x43\x60\x7C\x5A\x32\x44\xE4\x80\xCF\x3C\xE0\xB3\xE4\x59\xC2\xC0\xCA\x77\x70\x76\xCD\xF4\x7C\x31\x3B\xD8\x47\xE7\x81\x34\xE7\x54\xFA\x90\x1F\xAC\x64\xB7\xC8\x64\xBA\xC8\x3A\x76\x91\x06\xFF\x93\x02\xD8\x05\xB1\xFB\x6E\xDD\xD5\x86\xA2\x3A\x18\x3E\xFE\xB5\x21\xBE\x24\x40\x30\xE0\x4F\xA6\x6B\x10\x13\x4D\x7D\x57\x97\x46\x31\x1D\x39\x70\x23\x3C\x8C\xA6\xC6\x04\x27\x2D\x35\x14\xA1\xE0\x0B\x73\x92\x6A\x6D\x71\xBE\x1D\xD9\x74\x33\x36\xE7\x9E\xB1\xE1\x1C\x93\x81\x62\x6A\x4A\x91\xC2\x81\x25\xA0\x98\x9B\xC1\xFD\xC1\x2C\xD7\x8A\x71\xF9\x00\xB7\x21\x28\x5F\x07\x30\x19\x00\x26\x13\x80\x89\x7E\xAB\x4E\x95\xFF\x36\x26\xAD\xEC\x03\x2C\x5D\xB7\x08\xB9\xB3\x9D\x43\xE9\x8B\x14\xC8\x84\x6E\xC1\x8A\x29\x24\x23\x6F\x7C\x2B\x61\x11\x71\x44\xBF\x2D\x06\xF6\xAB\x3B\xAF\x79\x8C\x36\x07\xCB\x26\x05\xB2\x0D\x72\xDF\xCE\x96\xE2\x82\x3D\x1B\x7C\x69\x12\x76\xDC\xE7\xC6\x25\x9F\xFB\x4E\xE5\x2A\x96\xBD\x54\xA7\x81\x1E\xE1\x53\x90\xDA\xEF\x38\x15\x33\x8A\xA1\xD9\x34\x81\x1A\x06\x4A\xD4\x69\x94\xC8\x7E\xAA\x62\x55\xFE\xC0\x7C\x28\x26\x78\x9F\xA5\x19\x27\xC7\x9F\xDF\x88\x98\x82\x97\x9F\xDB\x88\x5C\x98\x00\xFD\x60\x36\xFB\x85\xAE\xD9\x17\xCF\x59\xDF\xF9\xC1\x7E\x43\xA2\x2F\xCE\xF4\xE6\x49\x9F\x6D\x17\x1F\xD2\xF6\xE3\x43\xE2\xE3\x7C\xC6\xA7\x23\x0C\x75\x80\xE1\xBB\x2E\x64\x54\x28\x18\xE8\xEC\x74\xD4\x68\x40\xD6\xEA\xD2\xF8\x23\x81\xD9\x70\xBC\x56\xAC\x44\x82\x23\x10\x41\x10\x18\x5D\xFE\x5F\xD3\x0B\x0E\x2A\xBA\x49\x88\x38\x09\x5A\x41\x22\x99\x05\xFA\x59\x89\x8A\xE2\x5D\xCE\xC6\x0B\x75\xAA\xFC\x23\x19\xC3\x09\x4E\xCF\x83\x6C\x43\x5D\x2E\xE2\xB8\xA5\xD9\x24\x1F\xB1\x43\x27\x55\x3A\x29\xE9\x32\xDE\xE6\x07\x2B\xDA\x9E\xD8\x80\x23\x7A\xFB\x2C\x5A\x63\x94\xEA\x0E\x4B\x4E\x33\x58\x2C\xBB\xF6\xA9\xDA\x3A\xB5\xBF\x32\xE5\x4C\x66\x63\x67\x29\xCF\x73\xCC\x6E\x0C\xFA\x57\x10\x86\xE5\x07\xB7\x42\x2E\x41\x70\x9E\x97\x60\x7A\xF4\x71\x5E\xF2\xC0\xD5\x2C\x36\x5F\xCD\xE7\x6E\x13\x97\xAD\x88\x6D\x8A\x80\xAC\x7F\x52\x89\xE7\x40\x6F\x6E\x33\xD3\x21\xBD\xE3\x9C\x33\xA2\x78\x8E\x7D\x4C\x91\x6E\x90\x45\x3F\xCE\xFC\x60\x65\x5C\x96\x3C\x70\x47\x39\x87\x98\x6D\x58\xD7\x1F\x60\x2F\x18\x62\x76\x30\xA5\x37\xE6\xC4\xAF\x68\x8E\x9D\x66\xA8\x38\x54\xEA\x00\xE6\x38\xE0\x50\xA9\x6A\x9F\xCB\x66\x5A\xCD\xB6\xD0\x6A\x36\xAF\x55\xA7\x98\xA2\xF2\xFD\x95\x76\x79\xAD\x66\xD0\x07\x85\xE4\x3B\x32\x85\xC6\xC5\xF8\xB1\x17\xE5\xBF\x22\xB1\x2B\x29\xFA\x54\x8B\xEA\x02\x90\x60\x4D\x29\xB3\xC2\x6D\x9B\xF2\xB1\x18\x03\xC9\xA9\xC8\xB1\xF7\x08\x0C\x7A\x84\x69\xB2\x0E\x77\x9E\xC9\xCE\x3C\xAE\x12\x1E\xFA\xE8\x87\xB0\xEA\xDC\x7E\xBD\x28\x17\x60\xE3\xF5\xBD\x2D\x86\x27\x1D\xAE\x96\x8F\x88\xF1\x95\xFC\xF1\xB6\x91\xFE\xE2\x43\xE8\x2B\xA2\xBC\x74\x72\xDD\x3F\x67\x63\x43\x1D\x45\xCF\x5B\x3F\x38\x40\xCC\xF3\xDB\x7A\xDF\x3B\xE1\xEF\x9E\xD0\x43\xB6\x7A\xCC\x09\x7F\x5B\xF7\x54\xFE\x4F\xA9\xF4\x49\x83\xB1\x68\x57\x1E\x73\x4B\xA3\x4F\x38\xFD\xAC\x5A\x3B\xF5\x3A\x10\x8B\xB8\x95\x43\xEF\x8D\x8D\x57\xA2\x9B\x09\x8C\x7F\x02\x3A\xFD\xC9\x67\xDC\x39\xE5\xF2\x68\x6B\xED\xEC\x8A\x78\x52\x85\xE7\x97\x02\x13\x55\x3A\xE5\xF7\x74\x55\x28\x17\x17\xF9\x39\xE2\x16\x31\x8B\x3B\x63\x55\x67\x2E\x27\x70\xA2\x63\x8E\x3A\x10\x22\x02\x60\x35\x8C\x29\x56\x17\x2E\xA7\x3C\x51\x27\xDB\x66\x10\x1D\x68\x0B\xEA\xE0\x19\xD0\x16\xF9\x67\x06\x75\x35\x0F\xDB\xE6\xE7\x4A\x25\x4F\x22\x7A\xA4\x97\x8F\x27\x5C\xAC\xB0\x02\xB6\x47\x08\xBF\xE7\x40\x63\x1C\xBC\xC0\x5C\x50\x35\x2A\x36\x6B\x35\x6C\x50\x74\x87\x4B\x1B\x00\x3A\x00\x04\x9E\x5C\x8C\x69\x94\xF4\xCA\xF0\xA4\xB3\x67\x56\xCE\xCA\xD3\x27\x56\xBE\xF7\x44\xCC\x74\x46\x54\xB8\x22\x9C\x7E\x06\x80\x6D\x09\xB3\x24\x95\x9F\x34\x56\x4E\xD4\x09\xF8\x9F\xEE\x8F\xE8\xDF\x09\xFC\x77\xDF\xDD\xE1\xC7\x63\xE2\xE8\xF4\x52\x6D\xB8\x54\xF0\x4D\x0F\x4A\x1F\xF0\xF8\x4A\x24\xE5\xA4\xD5\x60\x5C\xC3\xEF\x6D\x9B\x8C\x46\x7B\xA8\x92\xCE\x72\xA5\x87\xEF\x7B\x95\xCB\xDE\x76\x3B\xBA\xF8\x10\x27\x25\xAF\x63\x67\x5F\x45\x51\x0C\xE9\x17\xB4\x4C\x11\x16\xB8\xB9\x26\xC3\xE8\xBD\x5D\x57\xE4\xB9\x4D\xE1\xAD\x61\x0C\x2F\x7F\x19\xFC\x7B\xC7\x63\x6A\x9B\xD4\xD9\x74\x38\x05\xEC\x6F\xDE\xF6\xAA\xDB\xEB\x22\x19\xD9\xAB\xA7\x47\x95\x3B\xE3\x8A\x57\xDD\x4E\x59\xAF\xE2\x03\x8D\x4D\x86\x96\xEB\xAC\xF4\x27\xEB\x81\xCB\xBA\x68\xBE\x94\xC9\x65\x18\x36\x72\xD4\x24\x86\x93\xC0\xC0\xBD\xB4\xF3\xD7\x5E\xB5\x75\xE6\x27\x94\x8B\x80\x9E\x80\x3E\xC9\x44\x9B\xE1\xAC\xE0\x11\xE7\x40\xB1\x28\x74\x24\x00\x98\x43\xE9\x87\xD7\x3B\xDD\xFA\xEF\x6D\x6B\xD0\x8F\x89\xE4\x82\xD3\x4F\xE6\xE4\xC1\x8A\x52\xCE\xAB\x7D\xAE\xA4\x50\x7A\xA5\xCF\x8F\x32\x17\x2F\xF1\x10\xFF\x30\xA7\xD0\x97\xA5\x87\xB7\x37\xB1\x3F\x33\x66\xAC\xF1\x1B\xEF\xFC\xC0\x77\x5C\x0F\x5B\x5A\x5F\x04\x47\xEF\x10\xB0\xCD\x0F\xAF\xEF\x13\x19\x00\x65\x78\xFD\xDB\x5E\x55\xE7\x18\x72\xF2\x7F\xC7\x74\x5C\x83\xD2\x0D\xCA\xDF\xB2\x32\x9F\x16\x8B\xE6\x60\x12\x65\x52\xCE\x64\xFB\x97\x24\x4A\x00\x86\x6A\xC4\x01\xA6\x65\x97\xEF\x9F\x2C\xB4\xDE\xD4\x06\x1E\x39\x34\x50\x17\x01\xBD\xC9\xBA\x5E\x4C\x88\xEB\x9D\xD1\xE6\x1E\x53\xF5\xC8\xE0\x2B\xD8\x64\xB8\x9B\xCC\xC2\x36\x07\x5D\xDA\xAF\xC7\x6A\xA5\xD3\x1C\x89\x30\xE7\xCE\xF1\xBE\x0C\x76\x83\x5A\x01\x9A\x5A\x41\xF9\x25\xC7\x25\xBC\xC2\x59\x78\x85\x61\x09\x51\x7D\xF7\x23\x8C\xB0\x43\x71\xB5\xC8\x87\x9E\xC3\xDD\xE3\x17\x97\x84\xD8\x55\xA6\x6D\x8A\x96\x86\x6F\x49\xA7\xE9\x37\x7D\x09\xA9\x60\x1C\x9D\x1C\xF7\xA4\x7C\x2C\xD7\x65\x0E\xCE\xC9\xDB\xDB\xB0\x37\x4A\xEE\x0C\xC5\x6E\x5C\xA4\xA0\xE7\x92\x62\x0C\x72\x27\x33\x01\xCB\x0D\xCA\xB7\x00\xB4\x03\x7C\xE4\xA4\xE9\xF0\xAC\x56\xD3\xD1\xDF\x75\x3C\x56\xD1\xAB\xDD\x26\x62\x44\xBA\x18\x0B\x7C\x00\xA3\x22\xD7\x50\x06\x63\x16\xF6\x1A\x18\x69\x65\x82\x78\x2B\xBA\x51\x15\x33\x3A\x02\x85\x39\x13\x57\xA1\x65\x48\xCF\x81\x1F\x9F\xD7\xE0\xE1\x00\x00\x18\xBD\x08\x35\x3A\x0B\x24\xB5\x38\xD0\x7B\xAD\xA7\xF5\x1C\x83\xA9\x13\xDB\xA6\x70\x1C\x9A\x36\x23\x01\x18\x80\x98\x05\x20\x92\x3C\x7B\xC1\x9C\xCD\xEF\x6C\xAE\xAA\x49\x0C\xDD\x44\xEE\x71\xFA\xAA\x70\x12\x4C\xE3\x57\x2D\xBB\x33\x50\x8C\x60\x50\x73\x55\x5A\x7D\xED\x2A\x8A\xD2\x8A\x60\xAF\x44\x09\x0D\xA2\xCF\x7F\x97\x8B\x89\x86\xF3\x0B\x73\x94\xCD\xB9\xA9\xB3\xBA\xCB\x29\xE4\x7C\x4B\x7E\xA6\x2A\x5D\xF7\x8A\x63\x9A\x17\x00\x27\xCB\x5A\x20\xDF\x2D\xC0\x74\x55\x9C\x69\xF3\x00\xC6\x80\x37\x18\x05\x31\x6A\x0C\x07\xF1\xBE\x10\x69\x25\x94\x9A\x39\x1D\xE6\x5F\x2B\xA5\x3A\xB7\x2C\xB7\x59\xD2\x2F\x3D\x9D\xD0\x9A\xE3\xCD\x2B\xBF\xBB\x97\x5F\x75\xF7\xCA\xC9\x13\x2B\x8F\x79\x4E\x63\x56\xF2\x1F\xA8\x84\x7F\x99\x74\xE6\xCE\x46\x02\x47\x3C\xEE\xC9\x3F\xB4\x97\xC9\x55\x7A\xB5\x5E\xCB\xBE\xA9\x68\x87\xD3\x4E\xC4\x54\xB3\x3B\xDA\xF1\x2D\x9D\xCD\x70\x07\x90\xE6\xF3\x5E\xD1\x73\x76\x7A\xF1\x9B\x6E\xDE\xC0\x08\xA0\x9A\xAA\x93\xBB\x50\xFA\xC1\xFD\x2F\xEF\xFB\x53\x88\x5A\xFA\x9D\x4C\xF5\x9A\x75\xA6\xC9\xD5\x78\xC3\x84\x35\x11\xE1\xC4\x1A\xDD\x45\x92\xAD\xDF\x89\xF7\x5F\xE8\x62\x3D\x5A\x77\x9D\xD8\xAB\xC6\x4E\xD3\x0B\x3F\x6E\xF9\x5D\x09\xAA\x0F\xBB\x1F\x11\x5D\xA2\xD9\xC6\x75\x96\x88\x5B\x14\x1E\x04\x6F\x9E\xE4\x76\x13\x32\xE9\x8C\x13\x48\x22\xE6\xAA\x90\x1B\x82\x7D\xDD\x98\x66\x4D\xA0\x59\x45\xB7\xD2\x42\xF5\xB5\xAB\x30\x27\x25\xE5\x41\x03\x12\x58\x99\xB0\x03\x15\xB3\x6A\xCE\xF4\x3B\x5A\x21\x2E\xD0\x9D\x28\x60\xF2\xB6\x60\x16\x09\xE1\x81\xC9\xEF\xF9\x37\x5E\x96\x00\x35\x5B\x91\x27\x6A\xCC\x5E\x30\x72\x12\x83\xBC\x92\xC1\x26\x0B\xFD\x4C\xF9\x10\x9C\xE5\xFD\xCA\x39\x67\x9D\xDE\x19\xEB\x62\xEC\x84\xF8\xB3\xB6\x8B\xAC\x95\x51\xDC\x66\x9A\x0B\x5B\xB9\xBD\xAC\x07\x24\xA4\xA1\xC6\x70\xCD\x15\xC0\xA7\x0A\xE8\x71\x1A\x6C\xC3\xB8\xD4\xE1\x23\x06\x5D\x13\xBF\xBC\xAA\x2E\x03\xF0\xCA\x78\x5E\x3C\x70\xBA\xCE\x80\xA7\x87\xA1\xA1\x54\xC6\xD0\x32\x86\x13\x6A\xB8\x62\xAD\x19\xBA\x9C\x6E\xDC\xB7\x4D\x09\xAA\xA3\x75\xE5\xF8\x43\x34\x7C\x57\xE2\xF1\xB7\xCB\x99\x71\x16\xAD\x1B\x06\x96\x88\x0C\x37\x6B\x6B\xCA\xF8\x80\xC9\xA0\x34\xE9\x5E\x16\x46\x8D\xA6\x75\x95\xB0\x50\xC5\x8C\x36\x2F\xF9\x46\x17\xC9\x4D\x6A\xDE\xF3\x05\xB4\xBC\x23\x4A\xB4\x89\x99\x49\x12\x59\x76\xCE\x81\x99\xE1\x04\xFC\x00\x75\x76\x0B\x8E\xC9\xFC\xA0\xE8\xE7\x9F\xC9\x45\x91\x0B\x9F\x77\xC3\xCC\xCA\x89\xC4\xF3\x32\x72\x58\xD6\xA9\x2A\x60\xD3\x07\xF4\xC1\x26\x03\x0F\x48\xD4\x70\xAD\xAF\x26\xB1\x8A\x5A\x4D\xD8\xA4\xD9\x5A\xCD\x1C\xC3\xF4\x36\x68\x9F\xD0\xBD\x90\xE6\x17\xB8\xEC\x92\x13\x6C\x5A\x48\x9C\x5B\x24\xD2\x1D\x0A\x26\x0E\x19\x6E\x75\xBC\xEF\x58\x00\x52\xD3\x15\x89\x8A\x89\x5D\x6B\x12\x50\x62\x35\xDB\x3A\xC6\x21\xB4\xC5\x98\xD2\x9D\x60\x0B\x39\xF6\x49\x3C\xE4\x6D\x63\x43\x1C\x71\x09\x3B\x19\x84\xA3\x29\x93\xC1\x48\x97\xC3\xD7\x6B\x8F\x63\x79\x69\xD7\x66\x7B\xE4\x7B\xB7\xDC\x6F\x1E\xEF\xE1\x86\xDE\x63\x49\x3A\x06\xB4\x80\x25\x30\xC8\x69\xCF\x87\x0E\x78\x3C\x65\x77\x1E\x1E\x01\xCC\x61\x6A\x34\x39\xD2\xF2\x88\x87\x82\x0B\x67\x14\xC7\x41\x8F\x3D\x40\x20\x7F\xC9\x5B\x1E\x74\x88\x58\xDF\xE3\x2C\xFF\x01\x7D\xC2\xCF\x2B\x75\xA7\x94\x80\xD5\x90\xED\xA8\x27\xFB\x49\x3B\x4A\x84\xE5\xF3\x74\x06\xC2\x52\xF2\xFF\x66\x2E\xBD\xB2\x52\x34\xB7\x63\x9D\x72\x34\x96\xA0\x78\xA8\xDC\x93\xA0\x78\xFB\x35\x3E\xEA\xCB\xF4\xEE\xC6\xAE\x88\xEF\xA7\x10\x16\x97\xE9\xF1\x8A\xF8\xBE\x4A\xF8\x3B\xDF\x10\x2D\xA0\x74\x9C\x4C\x1C\x08\xB4\x31\xCC\x85\x88\xA7\x83\x86\xA3\x95\xC2\xCF\x15\x01\x9B\x68\xD8\xF5\x72\x40\x49\xFB\x04\xDC\x9E\x09\xF6\x47\x4C\x82\xBF\xCF\xC1\x1C\x0C\xB3\x58\xE2\x6D\x49\xCE\xA3\xFA\x7E\x1A\xDF\xB8\x19\x84\x14\xD8\xF6\x19\x6E\xF0\x84\x4A\x97\x68\x91\xA9\x73\x8A\x18\x6F\x38\x46\x0A\x2A\x36\xB2\x0C\xF9\xB4\x9C\x9C\x5D\x0D\xB2\x5B\x0D\x22\xAE\x06\x11\x95\xBC\xE9\x4B\xA7\xFB\x67\xCF\x94\x67\x45\x08\x3C\xA2\x41\xBA\x81\x5F\xAF\x08\x7C\x8A\x18\x03\xA0\xF4\x6D\x4A\xDA\xAD\x73\x86\x98\x57\x9C\xE7\xA6\x0F\x93\xD3\x06\x2A\xB0\x53\x99\x9B\x0A\xE0\x63\xE7\x5C\x1A\x8A\x8F\xC8\x46\x8D\xE5\x7D\x88\x39\x14\x52\xA7\x06\xBD\x1A\xD4\x67\x22\x4B\x96\xB3\xB5\x75\x19\x4A\x14\x4C\xAE\x46\x2C\x35\x48\x08\x4A\x28\x85\xF9\x6D\x00\xE4\x1A\x2F\x84\xB0\xC1\xBE\xD6\xA5\xC7\x94\x3A\x50\x31\x05\x3F\xF4\x80\x35\x02\x6B\xE7\xAB\xC1\xA9\x2E\x93\x2C\xB4\xDF\x57\x0F\x84\xA5\x46\x65\x37\x71\x49\x59\xC6\x9B\x29\x66\xFC\x86\x53\x49\x30\xFD\x1E\x01\xD2\xE5\x30\xF6\x54\x48\xE1\x9A\x5D\x20\x5C\xB3\xC0\xF8\x66\xE0\x6A\x5B\x97\x31\x5C\x73\x82\x6B\xE6\x72\xF4\xE3\xC8\xD6\x02\x5C\x33\xCC\xA0\x97\xC0\x35\x0B\x70\xCD\xF0\xEA\x9B\x17\x57\x93\xA7\xC6\x14\x41\x07\x6A\xD6\x09\x6F\x37\x9B\x80\x13\x1D\x99\x1E\x24\xC6\xC5\x72\x1B\x78\x16\xDF\x1F\x6E\xE8\x3C\x32\x1D\x9C\x6A\xC3\x1D\x09\x27\xA7\xB6\x51\xE7\x1F\x48\x77\x53\x7B\x6A\x18\xCA\xE9\xB5\x76\x7A\x30\x54\x6B\x8D\x36\x4A\x7D\x10\xA9\xB8\xE0\x55\x5C\xF0\x2A\x1D\xCE\x9D\x8A\x14\x95\xE9\xE4\x74\x3E\x3A\xB7\xF0\x0A\xE4\xBD\x6D\x81\x01\x96\x24\xC5\x39\x21\x4B\x36\x26\xA2\x50\xA4\xE1\x93\x19\xEF\xB6\x53\x21\x30\x0D\x66\xC5\x6A\x94\xFF\xF1\xD6\x5B\xCA\x57\xE2\x0E\x56\x68\xBF\xA4\xB4\x51\x14\x29\x89\x9C\xB5\xB4\x93\x8F\x8D\x9D\x70\xE3\x18\x9C\xE9\x81\xB4\x8F\x0E\x3E\x4E\x5E\x8D\xBB\x5D\x32\xA0\x6A\x9C\x31\x70\xC6\x69\x28\xC9\x36\x02\x4A\x46\x40\xC9\x08\x28\x4C\x1D\xF4\x7C\xD5\x73\x40\x8B\x61\x18\x40\xDF\x02\xD1\xFA\xF8\x4A\xB2\x7C\x20\x73\x74\x3F\xE3\x87\x9C\xB7\xEA\xC6\x6F\x64\xE5\x8B\x39\x79\x2D\x69\xFB\x80\x8D\xAA\x46\x3A\xF3\x58\x64\x7B\x38\x6D\x5E\xBE\x6A\xDE\x32\xC4\x4B\xFF\x12\x1D\x30\xB8\xBF\x79\xAB\xDC\x52\x7F\x9C\x19\xCD\xF4\xC1\x00\xEC\x49\x75\x8A\x02\xC3\xA0\xCB\xE3\x62\xD2\x14\x18\xA6\x7C\x97\xEE\x39\xF8\x9E\x2B\x83\xE2\x3C\x0A\x92\x50\x0F\xD9\xBB\x62\x04\xD7\x98\xF4\xFE\x70\x15\xF7\xD2\x16\x11\x5E\x62\x50\x94\xC7\x56\x6C\x75\x0A\x9B\xCA\x44\x4B\x8C\x9E\x66\xB0\x3F\x6D\xC3\xDA\xA3\xC3\x62\x07\x2C\xD7\xC6\x83\xF7\x4B\x56\x97\xC2\x41\x78\x3F\x43\x19\xE6\xCC\xF5\x5D\xB8\x91\xA8\x71\xD3\x96\xC7\x26\xB7\x9F\xF0\xB6\x48\xE6\x39\x69\x05\xF3\xB8\x70\x5B\x81\x60\xAF\xE7\xA2\x48\x8F\xDF\x74\x8E\xB7\x1C\xE4\x20\x7F\x3C\xD2\x78\x4E\x01\x33\x32\x97\xB9\xFC\xAA\xA5\x26\x83\xDE\x3F\x14\xAC\xD9\xA8\xB9\xB5\x94\xE6\x84\x8E\xA7\xD0\x94\x69\x39\xC6\x3A\x71\x8B\xD2\xCD\x43\xE2\x74\x62\xCA\x7F\x1E\x58\xBC\x86\xB0\x78\xDB\xD7\x07\x16\xFF\xEB\xD7\x1D\x16\x1F\x3E\x9B\x5E\x14\xF5\xDF\x90\x24\x9D\xD2\x8A\xCE\xCF\x41\x7A\xDE\x4A\xEA\x42\x2A\xD9\x0B\xA9\x94\x5F\x48\xA5\xEC\x42\x2A\xC9\x99\x4A\xAF\x94\xB1\xD6\x94\xDF\x9F\xE8\x45\xB3\x53\xDA\xD8\x2C\x2F\x29\x9B\x9A\x37\xE3\xDF\xE1\x33\xE2\xF7\xBE\x10\x9E\xF3\xF8\xFC\xDA\xE7\xC1\x73\x16\x9F\xFF\xFB\xCF\xF6\x9F\x7F\x6A\x03\x9E\x6D\x7C\x7E\xE5\xCD\xFD\xF7\xCF\xC7\x67\x4D\xCF\x34\x44\x0A\xD8\x72\xE4\xA8\xDF\x78\xA3\x3E\x50\xBE\x50\x4B\x3D\xF1\x13\x76\x04\xCA\x5A\xA7\xAE\x26\x6D\xBA\x6D\x64\x4C\x89\x85\x32\x12\x9E\xFE\x2E\x24\xC8\xE2\x1C\xC2\xCA\x7F\x6F\xDB\x08\xB6\x2C\x72\x0C\xA6\xB0\x3C\xEC\x21\x14\x83\xAF\x9D\xB4\x35\xDF\x95\xB8\xBB\x7B\x03\xEB\x72\xB5\xAD\xE9\xBE\x23\x45\x6F\xA7\xC6\xCC\xFC\xC6\x32\x92\xA9\x49\x0B\x8A\x5A\x30\xD4\xF4\x6B\x31\x52\x0E\x36\x66\xDA\x60\xA0\x6B\x54\xDA\x98\xED\x37\x66\xFB\x8D\x59\x68\x0C\xA5\xB3\xC5\xC6\x28\x73\x94\xB7\x5D\x63\x72\x8B\x8D\xC9\xAE\x31\x34\xC7\xC2\x5B\xB3\xEE\x70\x82\x2D\xFC\x52\xF1\x17\x36\x4D\xA6\x8E\xF2\xBB\x01\x3D\xC3\x75\xBF\xB1\xB1\x71\x5D\xEB\xA4\xDF\x78\x8F\x68\x8F\xF9\x7F\x3A\x0B\x3C\x21\x60\x6D\x09\x9F\x3B\x2C\x2E\x95\xEF\xCC\x08\x8D\x78\x41\x0D\x74\x00\xB2\xD7\x49\x4E\x27\x96\xF9\x0D\x79\x94\x22\xEB\xEC\x55\xC2\x65\xA8\xB2\x64\xFE\x5E\x79\xD4\xDF\x23\x03\x82\x1B\x49\xCA\x43\xE6\xBF\x84\xE5\x07\x2A\x09\x2D\x62\x33\x94\x6F\x70\x72\x35\x86\x05\x80\x99\xDC\x2D\x0F\xA1\x9E\x81\xA1\x7E\x32\x9F\xAD\xFB\x7B\x16\x8F\x3A\xE9\x1F\x73\xF4\x18\x37\x7E\x9F\x3C\xEA\xEF\xE5\xC6\x55\x6C\x9C\x43\x5C\xE1\x55\x15\xFA\x45\x27\x53\x19\xD7\x25\x3D\x4A\xF8\xDB\x31\xD9\xB5\xC0\x7E\x30\xA0\x0D\x26\x38\x43\xD5\x8B\x06\x70\x8F\x5C\xA5\x0B\x0A\x99\x7F\x18\x81\xBE\x24\x82\x4B\x6A\xAA\x38\xD4\xF3\x35\xF1\x29\xEE\x7C\xE6\xE3\xDB\xCE\xFD\x31\x03\xEB\xD3\xF2\x20\x12\x64\xAC\xA5\x92\xBE\x55\xFA\xB9\x4A\xE0\x87\xEA\xA1\xA6\x30\x19\x8F\x39\xEA\xB3\x75\x97\xF9\xD1\xBA\xDF\xB8\x57\x1F\x3D\x16\x40\xE9\x32\xFF\x79\x79\xD4\xDF\xC7\x80\xD4\x0C\x48\x11\x01\xA9\x30\x98\x54\x1F\xA4\x82\x41\x4A\x5F\x21\xE9\x35\xD6\xBF\x48\x32\xA9\x6E\x36\x25\x7A\x31\x07\x08\x09\xA0\x16\x09\xD6\xEA\x10\x36\x9C\xD4\x14\xE7\x86\xF5\x79\xDA\x76\x99\xFF\xAC\x24\x73\x46\xAC\x21\xB9\xCD\x17\x22\xA9\xC9\xF4\x45\x4A\x83\x2A\x7D\xD1\x41\x1D\x45\xBC\xC1\xF0\x4A\x00\xDC\x11\x00\x77\x3B\x2C\xAB\xFB\x04\x43\xD7\x67\xEB\xC7\x10\xF2\xC7\x28\xF3\xF7\x5D\x92\xC2\x17\x9C\x15\x87\x28\x9A\xC9\x95\x02\x7D\x33\xA8\x70\x91\x0B\xE1\xC3\x0D\x89\x19\xF1\xE1\x29\x3B\xEE\xEF\x81\x27\xE1\x55\xA8\xC9\x99\xDB\x93\xAA\xE8\xE8\xE5\x47\xC7\xFD\xBD\x58\x35\x7C\x18\x5B\xF2\x9A\xF2\x93\xC5\x12\xCC\xF0\xEB\xB7\x1F\xF7\xF7\xCD\xFD\x20\xB6\xD7\xB5\x60\xCA\x9F\x92\x09\x27\x27\x1A\xA1\xE8\x5C\x64\x4C\xD3\xB0\x86\x11\xF0\xB4\x5B\xF6\x27\x83\xBD\x1E\xF6\x23\xC4\x45\x4F\xB4\xE1\x34\x97\x2D\xF5\xF7\x48\xE8\xE0\x00\xD7\xE1\xED\x4C\xAD\x68\x87\x24\x41\x77\xB8\x1A\x34\xAD\x60\x6E\xC0\x10\x12\xCA\xC9\xAB\x96\x88\x97\xFD\x12\x6C\x55\x82\xFC\xF3\x67\x61\x13\x44\xF9\x29\xFD\x8F\x03\x73\xDE\x75\xA8\x92\x5E\x3A\xB5\xEE\x6F\xDB\xD8\x30\x47\x29\x40\x1C\x65\xF5\xF4\x1B\xF7\x8A\xAB\x39\xCB\x2E\x82\x14\xF6\x56\x1B\x7B\x0E\x55\xC2\xDF\x7B\xB2\xD6\x5E\x85\x21\x6F\xDC\x23\x56\x2B\x95\xD6\x7A\xDE\x3D\x18\x32\x67\x63\x5F\xAD\x7D\x9C\xD9\x6B\x66\xAA\xFD\x12\x55\xFB\xE0\xDD\x13\xBA\xA6\x40\xF5\xDE\x30\x53\xEF\x5E\xAA\xF7\x47\x58\xCF\xC6\x6E\xEF\x15\x07\x2B\xE5\x37\x6E\x87\xD2\xAC\x46\xEB\xBE\xF4\x7F\x22\x9C\x3A\xEE\xE5\xD1\x8A\x92\xDF\x39\xE5\xB3\xEB\xFD\xBB\xD0\x6C\xF5\x1D\x52\x3C\x7D\x3F\xDF\x05\xF2\xCF\x42\x90\x02\x93\x0B\x26\x5E\x59\xBE\x4C\xCA\x7C\xE2\xEF\x52\xB4\xDB\x45\x57\x17\xB5\xE6\xD5\x53\x9D\x6A\x1B\xCD\x26\xD8\x1D\xD7\x37\xD6\xDF\x87\xED\x51\xDC\x1D\x71\xA8\xC9\xD1\xED\xCE\x38\xEB\x3F\x1B\x5E\x38\x0E\x61\x03\x1F\xF8\x2F\xC6\xEA\xCA\x6F\x6C\xBC\x8B\xAD\xB8\xC2\x65\x6B\xFE\xE4\xD1\xD6\xCB\x16\xF3\xD6\x09\xF8\x63\x28\x07\x2B\x45\x36\xCC\x97\x1A\x4C\xDD\xEF\x44\xF9\x92\xAF\xD0\xD0\x3E\x3F\x67\x68\x3C\x30\x97\x5D\xC0\xB8\x2E\x03\x5D\xCB\x74\xB7\xD6\x40\xD2\x09\x7F\x53\xBB\xA0\x94\x90\xA5\x47\xAF\x7B\xD2\x79\xFE\xCE\x28\x33\x51\x27\xE7\x2B\x66\x40\xE8\x27\xDB\x85\x02\x74\x32\x21\x8D\xA2\xE4\x54\xE8\xF0\x98\x9D\xC7\xE1\x51\x93\xC9\x7E\xFC\x66\x3A\xBE\x6F\xC9\x59\x00\x9F\x5A\x72\x82\x2C\x52\xAF\xC5\x9E\xC7\xE2\x28\x2F\xBB\x8E\xEC\x16\x3B\xA2\xC6\xCD\xFC\xC6\x0F\x57\xD9\x08\x6F\x51\xED\x11\xD2\xCB\x1B\x30\x45\xED\xDD\xA7\x92\x10\xBD\x06\x53\x0E\xFE\xD6\xAF\xDE\x7F\xEB\x4D\x8B\xC1\xAF\xDF\x49\xBC\x58\x1A\x02\xEB\xA1\x3F\x0A\xD6\xA8\x69\x55\x3A\x89\x3E\x29\x3A\x14\xE2\xD5\xD0\x9F\x39\xBD\x51\x5C\x8F\xC1\x84\x6E\x08\xBF\x49\x04\x75\x8F\xAA\xFF\xA8\xFB\x8F\xA6\xFF\x68\xFB\x8F\x59\xFF\x31\xC7\x47\x74\xD1\xE3\x94\xFA\x05\xC6\xD5\x0B\x77\x94\x0A\x4A\x01\xA8\xCE\xAC\x4C\x4E\x60\x9A\xCA\xE4\x56\x49\x38\x27\x77\xEA\xCC\x93\x2B\x91\xDC\x30\x41\xDE\x9F\xC2\xD5\xBA\xEC\x09\x95\x0A\x96\x4E\xBE\x4B\x42\x20\x1E\x85\x1B\xB2\xD3\x93\x67\xB7\x41\x50\x96\xE2\x05\x59\x27\xCB\xB3\xA9\x6B\x00\x7A\x51\xC1\x56\x95\x52\xD7\x4F\x6A\x85\x4D\xC1\xF0\x28\x95\x9C\x4A\xBC\xCB\x3A\x22\x26\x0D\xD7\xA2\x76\xAB\x62\x5E\xF8\x5E\x0D\x4D\x35\x34\xEC\xD2\x30\x20\xA2\x44\x16\xCD\x36\xAB\xE9\x0B\x48\x06\xB7\x20\x61\x0F\x42\x54\x82\x89\xB0\xD6\x38\x40\xF3\xAF\x9C\xEA\x82\x35\xFF\x6A\xF2\xFB\xD7\x92\xDF\x77\x25\xBF\x7F\x9D\xF7\x1A\x67\xBB\xEB\x93\xE1\xA2\xCD\xE3\x28\xD6\xD0\x9B\x4F\x25\xAE\xA9\x86\xFC\x2C\x8A\x23\x33\x9E\xCC\x14\x01\x95\xEE\xE2\xD0\xFD\x29\xC2\xAA\x60\x47\xC8\x07\xA3\x35\x13\x5B\x5B\x15\xD3\x01\x67\x30\x09\x98\xC4\x00\x30\xE8\x9E\xC7\xFD\x63\xBC\x1C\x6A\xEC\x05\x3C\xD5\x9F\x7F\x56\x92\x4E\xAA\xFC\xB4\xD2\x64\x2D\x3A\xD7\x75\xFD\x94\xDB\xFC\x24\xA6\x8C\x57\x9A\x32\xD0\xC3\x26\xB9\xBB\xBB\xD7\xA5\x24\x53\x18\x20\xA5\x68\x69\x01\xA6\x5D\x0A\x4C\x88\x42\x9E\x19\x7C\x26\x3C\xA2\xCC\x90\x38\xC0\x4A\xD3\x15\x39\xC9\x55\x2E\xD3\xA2\x31\x2B\xE2\xFB\x31\x62\x95\xF8\x6E\x55\xFC\xFB\x8A\x5D\x5D\xCC\x9D\x7C\xD9\x10\xF3\x5D\x44\xD8\x72\x38\x4A\x3B\x03\x59\x19\x8C\xEA\x11\xB2\xD1\x3D\x5C\x70\x30\x2E\x32\x3D\xE0\x3D\x91\xF3\xB5\x26\x36\x6B\x0D\x91\x14\x56\xF5\xEC\x11\xFA\xDB\x94\x52\x13\x35\xEB\xCA\x32\xCD\xD6\x03\x56\x35\x4A\x12\xC4\xEA\x6E\x36\xA2\x75\x48\x45\xC7\x16\x02\x9B\x2A\xCF\x85\x05\x31\x85\x85\x91\x2E\x19\xFA\xB1\xA5\x71\x6C\x09\x1F\x6A\xF4\x1A\xD2\xE8\x2E\xD3\x18\x18\x81\x68\x2C\x61\xC1\x3E\x09\x21\x9E\xB6\x57\x06\x8F\x19\xBC\x90\x4D\xBF\xE4\x26\xB7\x81\x75\x72\x83\xF6\x8F\x9F\x73\xEE\x88\x0E\x89\x5B\xCA\xE3\xC8\x2D\xB9\xB3\x23\xC8\x18\x85\xD5\xC4\xBB\x09\xB7\x9E\xE2\x2B\x8D\xC4\xA2\x28\xDA\x1E\x45\x18\x5B\xA5\x7D\xC7\x21\x5A\xDC\x7F\x2A\x33\xC3\x06\x52\x8D\xB7\xE9\x82\x5F\x59\xF0\x0F\xC0\x06\x1B\xB3\x44\xF7\x19\xEC\x19\x4A\xFD\xE8\x4D\x6D\x57\x64\x5D\x38\x5D\x0F\x30\x4F\x00\x70\x2D\xA7\x56\x97\x16\x4B\x64\xD3\x43\x72\xBC\x74\xC5\xCA\xE4\x44\x33\x72\x83\x8E\x5F\xA3\x53\x5E\x8D\x6E\x6E\x23\x27\xBF\x5B\x15\x4F\x66\x03\x08\xBF\xC1\x44\x49\xA5\x1B\x12\x2D\x35\xC3\x4A\xB8\xC2\x65\x4F\xAC\x73\x97\xB9\xE2\x09\xB8\xF7\x41\xA7\xBD\x02\x58\x7B\x41\x3C\x1D\x86\x50\xBA\x61\x37\x0A\x97\x7B\x79\x74\xA9\x7C\xEF\xC8\x6C\x9F\x28\x9C\x9C\x13\xE3\x77\x06\x96\x83\x4E\x92\xEF\xA4\x93\x37\x14\xEE\xE4\x03\x6F\x01\xA5\xAB\x4B\x4D\x96\x18\xCD\xF1\xDA\xB0\xD7\xEB\x4D\xD1\xA2\xB0\x21\xD7\x41\xD0\x0F\x68\x78\x03\xA0\x92\x58\xD8\x0C\x79\xB5\x0C\x60\xFA\x5E\xD4\xA3\xC0\xDF\x06\xFD\x75\x33\x60\x5E\xE2\x86\x14\x9A\x7B\x59\xA1\x1F\x10\xC6\xC0\x1B\x54\x78\x65\x7A\x84\x9E\x9A\xFC\xB2\xA9\xDC\xF0\x00\xAA\xB4\x15\x49\x9B\x05\x6F\xEA\x45\x26\xF3\x0A\x64\xC9\x38\x95\x25\x8B\xB0\x40\xC6\xF5\x62\x90\x36\xC3\x99\x1A\x0B\x54\x63\xA1\x74\x0B\x6E\x31\xF1\x1E\x8D\x6B\x67\x11\x05\x4C\x99\x91\x84\x29\x5D\xE5\x86\x24\x53\xEA\x6D\xA3\xAC\x74\x15\xBA\xE2\xF0\x7F\x4C\xB3\x08\x05\xA6\x59\x70\x8B\x6E\x21\x50\x5F\x95\x51\x61\xC5\x55\x56\xA1\xC0\x2D\x1E\xAA\xB7\x8D\x2C\x19\xFB\xE0\xFB\x66\x3B\xB6\xD5\x5C\xE4\xB6\xBB\x8B\x56\x9B\x6D\x4B\xCD\x22\xD0\xD9\xE2\x99\x7A\x87\x97\xF5\x68\x45\xD6\x3B\x61\xAA\xEE\xA2\xFA\x62\x18\xF2\x45\x6E\xFB\xE1\xCA\x8E\x32\xA2\xB2\x05\x2F\xEA\xB1\xDA\xE7\x76\x02\x95\xED\x72\x17\x23\x95\x41\xA7\x6E\x11\x69\x69\x0C\xB4\xB4\xCB\x0D\x99\xCA\x86\xDD\x9B\x05\x78\x33\x76\x0B\x8C\xC6\x85\x4A\xB8\x9D\x6E\xC7\x13\xEB\x91\xDB\xE1\x76\x02\x95\x2D\x02\x95\x2D\xBA\x9D\x40\x65\x3B\x71\x88\x38\x80\xD2\x2D\xF8\x89\xDB\x06\xE3\x58\x5D\x72\x23\xA0\xB2\x7A\xDB\xC8\x10\x7C\xEE\x62\xF8\x68\x7A\xFC\x75\x7E\x54\x3D\xA9\x3A\x02\x60\x82\xB4\x1E\x82\xB4\xAE\xB7\x95\x6E\xDB\xFE\x4A\x95\x33\xB8\x87\x3F\x6E\xB0\x1F\xB6\xC0\x03\xE0\xC6\xA3\x32\xA1\xBE\x8E\xD0\x82\xC3\xE7\x00\x57\xED\x85\x12\x18\x30\xF9\x1E\x69\xD1\x26\xED\x6B\x4F\x5C\xC5\x97\x4B\x5C\xC5\x39\x88\xAB\xE8\x13\xD7\xB6\xAF\x36\x71\x6D\xBB\x20\xE2\x2A\x98\xB8\xB6\x21\x71\x15\x7D\xE2\x2A\xFA\xC4\x55\x9C\x9B\xB8\x0A\xCC\x91\x29\x23\x71\x49\x8A\xB4\xD9\x11\x55\x59\xBA\x91\x2B\x13\x5E\x96\xC3\xEE\x23\xE7\x60\xA1\xE8\x39\x67\x9C\x05\x95\x77\xE2\x61\xFB\x66\x0F\x2D\x91\xA1\x14\x61\x4F\x57\xAD\x15\x3B\x73\x57\x31\xA4\x35\x17\xA2\xF7\xB6\x2F\xEA\xCA\xCB\x7A\x18\x98\x69\xD5\xC6\x6A\xAE\x02\x30\x54\x6E\x08\x7D\x0E\xF1\x13\x76\x11\x82\xA1\x55\xA5\xAB\xA8\x5E\xE9\x54\x6C\x57\x27\x1D\xEB\x79\x1D\xEB\x39\x1D\xEB\x73\x77\xAC\x63\xC7\x7A\xBA\x63\xCD\x1F\x0C\xCA\x3B\x77\x64\x65\xE2\x4C\xE4\x30\x94\xA1\xF2\x63\x0E\x62\xA9\x9D\xA2\x18\x42\x16\x0D\x46\x2B\xE2\x0A\xCE\x85\xA9\xC8\xFD\x84\x2C\xD2\xCA\xCB\x75\x0C\x65\xE2\xCD\x3A\x9B\xAD\x4C\x37\x11\xF4\xC2\x0F\x89\x79\x55\x1B\x3C\xC6\x2F\x53\xE2\x0A\x15\xE3\x25\x04\x57\xF1\x30\xE6\x00\x13\x8A\x53\x19\xC7\xED\x42\x42\xE0\xF4\xD6\xDF\xBC\xBB\xE4\x39\xDF\xC3\x02\xBA\x2D\x78\x2C\xCD\x00\x6D\xC8\xE8\xDC\xCC\xA3\xF6\x43\xA7\x96\x1A\x45\x83\xD7\xC9\xE0\xF9\x13\xBA\xE7\x15\xAE\x12\x6C\x61\x12\xCD\x60\xD3\x69\xE0\xFB\x7A\x10\x67\xE3\x34\xDE\x07\xDB\xAB\x0A\xBF\x3B\x44\xAE\x77\x83\x33\x57\xE8\xC2\x29\x7F\x5A\x3D\x52\xF2\x0D\x32\xE3\x06\xA0\x10\x37\xD6\x15\x7B\x51\x65\xC5\xE3\xED\x1C\x5E\xE5\xE9\x4E\x9B\xEF\x14\xA9\x64\x00\x4C\x3A\x44\x36\x43\xBA\x25\x0C\x7A\x45\xDB\x64\xA0\x04\xE4\xA8\x04\x40\x89\x5E\x6F\x14\x32\xE2\x01\x2D\x1E\xBA\x0F\x42\x5F\x0C\x2A\x1E\x88\x75\xAA\xC5\x88\xC6\xE8\xD9\x49\x49\x8E\x87\x08\x1A\xE5\xF0\x50\x93\x32\x74\x38\xE5\x8F\x50\x8C\xE6\x9B\xF8\x7A\x00\xDE\x93\xA6\x18\x2D\x0C\x16\x67\x61\x4A\x4E\xB9\xAC\xB1\xAC\xED\x53\xE4\x5B\x1B\x06\xD7\x52\xBD\xC1\x01\xD8\x3C\xEF\xAF\xA4\x37\xA8\xA5\x85\x2D\xA9\x02\x2E\x5D\xCC\x6C\x49\x8B\x6E\x4B\x3A\x98\xA9\x91\x53\x8D\x1C\xB6\xA4\xF9\x2A\x3A\xDC\x16\xE8\x53\x66\x56\xA7\x99\x3A\x6F\x48\x07\x91\xA5\x2B\x37\x48\x59\x3A\x3A\xC1\x0E\xF8\x3F\x86\x34\x2E\xD3\xE4\xD8\x70\xD0\x56\x8B\xCA\x52\xB1\xE2\x4A\xAB\x55\x0E\x90\x4A\x98\x3A\xF2\x31\x6A\xAD\x19\xB9\xD2\x8D\x90\xA9\xE3\x4D\x09\x73\x06\xD7\xFB\xC2\x8A\xAC\x17\x61\xDE\x6E\x54\x8F\x61\xFC\x23\x57\x02\x53\xCF\x89\xA9\xE7\x14\xED\xD5\x2D\x02\x53\xDF\xE6\xC6\xC8\xD4\x55\xBC\xEB\x42\xB6\xAC\x6D\x6E\xC0\x4C\x7D\xD0\xBD\xA1\xAC\x55\x2E\x67\x66\x99\x03\x1B\x77\xD5\x13\xEB\x05\x90\x3B\x4F\xC0\x34\x6D\x78\x9E\xB1\x08\x4C\x7D\x91\xEE\x45\x8E\x91\xA9\xE7\xC8\xD4\x47\xAE\x5C\x5D\x72\x0B\x1D\x53\x07\x08\x25\x4C\x1D\x1E\x37\x61\xEA\xF0\x16\x98\xFA\x20\x32\xF5\xE0\xC3\xC4\xF4\x4E\xC4\x31\x00\x8A\x98\xE1\x69\xB2\xCF\xA8\x2C\x31\x2A\x4B\x8C\xCA\x4E\x33\x2A\x76\x5B\x9E\xC3\xA8\x30\x52\x59\x8F\x51\x0D\xD0\x37\x51\xB5\x14\xF1\x66\x7A\x8D\xF3\xD5\x4D\x9B\x30\x2A\x3B\xCB\xA8\xAC\xCB\x99\x51\xC9\x84\x51\x89\xEE\x22\x8B\x08\x8C\x8A\x93\x3D\x17\x78\xB1\x95\xC7\xD2\x60\x5C\x06\x66\x54\xF6\x1C\x8C\x2A\xA7\xAB\xCB\x81\x51\x99\x8E\x51\x5D\xF0\x24\x1A\xB3\xE9\x34\xF0\x3D\xFB\x87\x73\x76\x1C\x33\xC3\xA8\x4C\x8F\x51\x59\x26\x7F\x64\x54\x03\x97\xED\x45\x15\x0E\x19\x55\x01\xAF\x8A\x78\xAF\x46\xD1\xAD\xC4\x46\x74\x8C\x0A\x87\xA3\x02\xAB\x5A\xD0\xFB\xDC\x02\x2A\x82\x39\xE8\x0F\x6D\x23\xBA\xFD\x0A\x94\x44\x56\x65\x52\x56\x45\x5F\x18\x8E\x87\xD0\x0C\x22\xAB\x1A\x90\x86\x59\xE7\x50\x05\x59\x15\xA6\x8D\x1B\x00\xAB\x1A\x10\xAB\xCA\x03\xAB\xCA\x51\x82\x44\x56\x65\x79\xF1\x32\xAB\x12\xCD\xA0\xC7\xAA\x06\x61\x70\xCC\xAA\x4C\xC2\xAA\x0A\x60\x57\x29\xAB\xCA\x66\x18\x51\x86\x4B\x90\x98\xCD\x4C\x8D\x82\x6A\x14\xA5\xCB\x5D\x41\xAC\x0A\x88\xA4\xC0\x1B\xA3\x53\xAC\x2A\x9F\x61\x55\x86\x59\x55\x16\x59\x55\xBC\x34\xD6\xE4\xC4\x93\x0A\x6C\x38\xB0\xAA\xAC\x63\x55\x54\x89\x58\x55\x7E\xA8\xCE\x02\xAB\x32\xB3\xAC\x2A\x5B\x6A\x28\x4D\x14\xB1\x2A\xC9\xAC\x2A\x77\x23\xBA\xB3\xD8\x67\x55\x05\xEB\x9F\xCC\xAA\x86\x1D\xAB\xCA\x3B\xFD\x73\x9B\x33\xCC\xAA\x4C\xF7\xA6\x20\xFD\xB3\x60\x56\x55\x04\x56\x25\x03\xAB\xE2\x08\x56\x29\xAB\x1A\x22\xAB\x2A\xFC\xC4\x65\xCC\xAA\x24\xB2\xAA\x8C\x58\x95\x61\x56\x95\x11\xAB\x32\xCC\xAA\xB2\xCD\x58\x95\x41\x56\x95\x81\x90\x65\x56\xC5\x14\x4F\xC4\x81\x14\xB1\x00\x64\xBD\xC0\xD4\xBC\x9A\x44\xA7\x47\xBD\x20\x8F\xFC\x88\x98\x93\xCB\xBD\x38\xB4\x58\x3A\x75\xA6\xDE\xE6\x4D\x3D\x00\xE0\x21\x9C\x14\x9F\x0A\x23\x9C\x2A\x97\x23\x9C\x50\xED\x18\xF0\xD1\x30\x6C\x63\xDC\xB6\x27\x33\xAD\x73\xB1\x42\x77\x18\x06\x91\xA9\x14\x2D\x62\xE5\x16\xB9\xFB\x33\x4F\xAE\xA4\x1B\x00\xA0\x06\x6E\xD1\xA9\x33\xCD\xB6\x27\x77\xDC\x1D\x24\x4E\x59\xA2\x61\x3D\xC7\x75\x09\x7F\x60\x74\xA6\x7C\xA1\xD2\x72\x22\x4F\xA4\xF7\x86\xE4\x74\x78\xB9\xDE\x59\xA5\xB8\x4C\x17\xEF\xE0\x8B\x99\x53\x47\x95\xBE\x68\xC7\xFF\x99\x8E\xD4\x84\x7F\x59\x1A\xD8\x4E\x7E\xBB\x2E\xC8\x15\xE9\xAE\xEE\xF0\xA9\xBB\xA8\x3B\xE5\xD4\x73\x57\xA3\xEF\x64\x0F\x8F\xDB\x7E\xE5\x4D\xCB\xE1\x30\x5E\xF8\xE2\x38\x14\x76\xCF\xE3\xA9\xE7\xDD\xC7\xC3\x6F\xBD\xE2\x6E\xBD\x33\x7D\xA9\x57\x96\xA7\x0B\x1E\x31\x5D\xF0\x3D\xB7\xDE\x79\x43\xF9\x39\x83\x07\xAB\x73\xE2\xED\x9D\xEF\x60\x35\x84\xE0\x42\xA9\x43\x4E\x58\x78\x92\x38\xFA\xEA\x9E\xB9\x4E\xF0\xB4\x6F\x45\x9E\x68\x36\x39\x78\x15\x9C\x68\x38\x19\x6F\x63\xC3\x88\xC9\xC8\x82\xE6\x34\xF4\x1B\x20\xC7\x4C\x60\x85\x76\x7F\x65\xD0\x18\x31\xFF\x8C\xB5\xC9\x41\xF4\xA1\xBA\x88\x57\x31\x33\x3A\xF7\xCA\x7A\x27\xE2\x25\xBF\x8B\xDD\xD2\x0E\x4E\x3E\x8E\xC7\x58\x53\x5C\x1C\x19\xA4\x68\x86\x76\x77\x74\x13\xB1\x07\x2A\x8D\xDD\x67\x34\x03\x39\x3B\x03\x75\xFE\x19\xE8\x2D\xCD\xC0\x6C\x65\x06\xF2\x02\x66\xA0\x92\x19\x4C\x1D\x30\x3F\x9A\x3C\xA3\x65\x20\xAB\x13\xC1\x95\x08\xDD\xCA\x3B\x37\x06\xB5\xEE\xDF\xFC\xE7\x6C\xC3\x44\x64\x92\xB1\xF1\x7F\xCB\xAB\x89\x3E\x39\x9C\xC8\x93\x64\x16\xA0\x1D\x9F\x8C\x8A\x94\x72\x92\x94\x0C\x54\xA4\x54\xA7\x48\x49\x8E\x02\x89\x77\x0F\x25\x2B\x52\xB2\x53\xA4\x74\xB7\x67\x0E\x77\x3F\xD0\x51\x51\xB6\xC4\xDD\x65\xD0\x41\x88\x84\xC3\x4D\x29\x95\x28\x52\x28\x7A\x28\x99\x56\xDC\x22\x63\xC6\x95\xB8\xE3\x93\x7C\xF9\x69\x4E\x1C\x38\x4E\x44\x86\x30\xEB\xE2\x7F\x90\xE7\x3D\x1E\x0E\xD3\xA8\xFD\xD0\xC9\xA5\x46\xD2\xE0\xF5\x7A\xEF\x02\xA6\x0A\x8A\x54\xC1\x37\x12\xB7\x32\x89\x66\xF3\x69\xC4\x68\x22\x3C\x1B\xA7\xF0\x4E\x71\xAA\x48\x49\x57\x9C\xA1\xDC\x55\xA4\x48\x29\x3A\xF5\x2E\x50\x91\x32\xA8\x7F\x39\x43\xB9\x39\x30\x04\x49\x16\x77\x7C\x32\xDE\xB3\x96\xC9\x00\xE2\x8E\x0F\x74\x9D\x41\x3D\xC4\x20\x0C\xA8\xA9\x94\xA0\x39\x19\x3A\xF6\x45\xB1\xD5\x48\x54\x5C\x46\xA9\x1A\x45\x5F\x8C\x58\x32\x37\x85\x93\x2D\xAD\x8F\x02\xB7\x0D\xB0\x0F\x19\xE0\x66\x52\xD2\x8E\x0F\xF6\x92\xF5\xD0\x49\xDA\xF1\x49\x50\xA3\xE4\xF4\x8E\x8F\xC0\x82\x9B\xCC\xD6\x49\x57\x36\xC3\x44\x8D\x92\xB4\x1D\x2D\x83\x1A\x25\xDC\x08\x63\x27\x90\x1A\x25\xA7\x8D\x90\xB0\x9F\x6B\xF4\xA6\x7B\xBE\x11\xD4\xC9\xA1\x4E\x16\xEB\xA0\x7B\x43\x5E\x63\xE8\x08\xB9\x3A\xD3\x6C\xD6\x6F\x2C\xEF\x1A\xD3\xFD\x26\x00\xE2\x5E\xD6\x95\x62\xC7\xFE\x29\x45\x0C\x74\x8D\x76\x61\x30\xB0\xA8\x86\x49\x9B\x97\x4E\xB8\x11\x2B\x62\xD5\xC8\xB2\x85\x67\xC4\xFF\xE1\x8C\x91\x78\xF1\xDA\x99\xA8\x88\x55\x15\xDF\xE9\x91\x54\x09\xF7\x8C\x12\xF6\x8C\xD5\x88\x06\x86\x2D\x90\x1B\x6C\xD1\xE4\xA0\xA2\xAF\x36\xD5\x12\x93\xDD\x99\x7A\x01\x34\x45\x56\xC4\xA4\xCB\x69\xDD\xE6\xCE\x1E\xAE\x4C\x50\xC4\x8C\xA7\xA3\x11\x54\x30\xC6\x4E\x77\xB6\x0C\x99\xAA\x5B\x23\x56\xC4\x46\xDD\x1B\x5C\x8F\x85\x33\x51\xCB\x00\x45\x6C\xE1\x89\x75\xE6\x16\x48\x11\xE3\xD5\xC1\x5A\x05\xDD\x8F\x44\x45\xCC\xF8\x89\xAB\x60\x1C\xAB\x4B\x2E\x43\x45\xAC\x1A\x69\x82\xD0\x5D\x0C\x21\xBA\x2F\x92\xB2\xA4\x82\x58\x52\x41\x2C\xA9\x98\x66\x49\x78\x31\xA6\x98\xC7\x92\x50\x55\x9E\x61\x49\x19\xAC\xE6\xE2\x1C\xAB\xB9\x48\x58\x52\x31\xCB\x92\x0A\xDC\xD6\x4C\xB3\xA4\x6D\x1D\x4B\xDA\x36\xEF\x10\xCA\xF2\x58\x60\x51\x47\x96\x54\x9C\x83\x25\x65\x44\x4D\x81\x25\xE9\x3E\x4B\xBA\xA0\x49\x34\x7A\xD3\x69\xE0\x7B\x90\x2D\x3C\x1B\x4C\xCC\x3D\xCD\x92\x74\x8F\x25\x15\x9C\x1C\x8B\x59\x92\x4D\x58\xD2\xD4\x21\x94\x2C\xDD\x36\x18\xC5\xB6\x8E\x25\x15\x09\x4B\xDA\xA6\xF7\xB9\x6D\xEC\xF1\xB0\x2D\xEE\xEC\xE8\x10\x0A\x4A\x22\x4B\xD2\x29\x4B\xA2\x2F\x74\xC5\x03\x31\x91\x25\x19\x3E\x84\xCA\xA0\x0A\x85\xE1\xA1\x6C\x49\x13\xE2\x45\x47\xDA\x3A\x0B\x2C\x29\x63\x99\xCC\x2C\x89\xC0\x42\xDB\x55\x27\x9D\x68\x4C\x8F\x25\x99\xDE\xCE\x2E\x24\x27\xEB\x0E\xA1\xB2\x4D\xBD\x1E\x32\xF2\x7A\xC8\x22\x0F\x99\xA9\x41\x27\x12\x75\x5E\xBA\x2C\x1C\x42\x61\x76\x5D\x97\xCD\xEE\xEC\xB2\xA9\x9D\x9D\x74\x9A\x19\x8A\x85\x9D\x9D\xE4\x60\x16\x14\xD1\x22\xDC\x19\xCF\xB1\xE1\xC0\x50\x6C\x65\xD9\x4E\xCA\x95\x88\xA1\x64\x87\x6A\x1B\x76\x76\x9A\x2C\x0B\x32\xB1\x2C\x58\xB2\x1A\xBA\xEC\x4C\x3D\x5E\x11\xF5\xA2\x97\xF5\x0E\x77\x11\xCD\x8E\xAD\x0A\x79\x49\x77\x9C\xC8\x00\xE2\xB2\x33\xD1\xEE\xB9\x78\x67\x93\x07\x0B\x7E\x06\xFB\x0F\x8C\x8D\x29\x5D\xB6\xBF\x52\x5E\xD6\x3B\x61\x07\x46\xA5\xB0\x25\x59\xBC\x13\x0F\xB1\x32\xBC\xE3\x16\xCC\x93\x08\xF7\x9C\x5C\x53\x76\xBA\x7C\x3F\x9A\x0A\x33\xB4\xFE\xEE\x1C\xE9\xD2\x9B\xFA\x62\x6F\xEA\x5D\x01\x4C\x00\xE4\xDD\x29\x90\x77\xC1\x40\x77\xD7\xBB\x62\x7E\xB0\x99\x1A\x17\x53\x8D\x8B\xC9\xE8\x71\xF1\xE1\xD8\xB6\xBB\xD8\xED\x5A\xAD\x66\x13\xBF\xEF\x42\x5C\x14\x19\xA2\x42\xF4\x77\x89\x84\x4C\x46\xCD\x4E\xE0\xF5\x19\x5E\x30\xE6\xFF\x98\x66\x17\x06\x98\x69\x2E\x86\xAE\x22\x6A\x76\x56\x39\x87\x11\x6B\x32\x5E\x49\x61\x18\x05\x36\x78\x08\x61\x45\x13\x00\xE4\x3C\x84\x54\x80\x4B\xDC\x43\xDC\x25\xAB\xCD\xCE\xA5\x66\x17\xE0\x68\xD7\x99\x7A\xC9\xCB\xFA\x52\x00\xC8\x8A\xAC\x17\xDC\x25\xF5\x43\x61\x72\x97\xB8\x87\x1C\xAE\x0C\x36\xC7\x8C\xFF\x62\x2F\xEA\xDD\x6A\x9F\x5B\x00\xC6\xFF\x2D\xEE\xA1\x88\x32\x8C\x7C\xB3\x0B\xD9\xFB\x6E\x00\xC6\xB7\xB8\x9C\x19\x7F\xDE\xBD\x41\x30\xED\x76\x17\x33\xE3\xBF\xB8\x12\x6E\xC1\x2D\x3D\xB1\xBE\xD4\x2D\xB9\x05\x60\xFC\x0B\xC0\xF1\x17\xDC\x2E\x60\x45\xBB\x28\xDC\xD9\x43\x91\xF1\x5F\xEC\x27\x6E\x27\x8C\x65\x75\xC9\x5D\x8A\x8C\x1F\x81\x0C\xE0\xBA\x8B\xC1\xA5\xE8\xF1\xD7\xF9\x51\x96\x80\x50\x09\x38\x93\x6B\xF5\xCE\xD2\xED\xAC\x54\x89\x22\xA5\x59\x74\xE3\x27\xD6\x3B\x90\xDE\xC6\xDF\x87\xDC\x11\xBF\xC6\x73\x25\xF2\x2E\xDB\xE9\x27\xCE\xB2\xC1\x69\x07\x76\x67\x31\x5D\x9F\xD3\xDC\x9D\xC5\xCD\x96\xD3\xDC\x9D\x9D\xB3\xE1\x87\x8D\x17\x2C\x5C\xB9\x56\x5B\xD0\xB1\x78\xC3\xCF\x6C\x90\x78\x06\xA6\x03\x64\x5E\x17\xC5\x06\x88\xCA\x54\x7E\x19\x92\x5F\x86\xE4\x97\x99\x96\x5F\x1C\xCE\x6A\x8E\xFC\xCA\xF9\xBC\xA5\x93\x5F\x1A\x8F\xF5\xD8\x97\x6F\x86\xF5\xB3\x8F\x9D\x49\xE4\x97\x99\x95\x5F\x26\x9E\x4D\x8E\x66\xE4\xD7\xA8\x27\xBF\xD2\x80\xBC\x22\x9C\xFD\x64\xF0\x87\xE5\x97\x39\x87\xFC\xCA\xE3\x71\x51\x94\xD2\x5B\x9D\x04\x07\x90\x98\x37\x0D\x8A\x18\x99\xC5\xD9\x38\x83\x76\x8F\xBE\xFC\xCA\x7A\xF2\x8B\x8F\xBD\xD0\xA8\xD0\x68\xCA\xCC\xA8\x49\x7E\x75\x31\x7F\x46\x9B\xC8\x2F\x1C\x8E\x0C\x12\x6C\x97\xDE\xE7\x76\xE1\x8E\x27\x47\x86\xD0\xA0\xD0\xB2\x7C\x36\xB9\xAB\x93\x60\x59\x2A\xC1\xE8\x8B\x8C\x0F\xB5\x1A\x1D\x25\x98\x46\x1F\x11\x53\xE7\x50\x05\x25\x58\x4E\x71\x5F\x26\x2D\x86\xCF\xC2\xB3\x49\x96\x60\x53\x67\x93\x86\x79\x3A\x4B\xB0\x6D\x8D\xEE\x49\x30\x1D\x06\xC7\x12\x2C\x4B\x24\x98\x4D\xCE\x26\xE5\xB4\x7B\x2A\x51\xA5\xE8\xCE\x26\xB3\x99\x1A\x96\x6A\x58\xD4\x2B\x49\x82\xE1\xED\x93\x0B\x39\x9B\x94\x2E\x63\x36\x29\xA2\x04\xCB\xF8\x3F\x80\x24\xBA\x38\x4E\x8A\x22\xB3\x49\xD1\x49\xB0\x2C\x9E\x4D\x4A\xE0\x8E\x22\x48\x30\x64\x8B\x97\x92\x04\xDB\xEE\x2E\x75\xDB\x57\x1B\xD1\x9D\x4D\x06\x09\x76\xB1\xDB\x4E\xB3\xDB\xEE\x2E\x9D\x23\xC1\xF2\x9E\x04\x0B\x56\xA9\x3A\x07\xE1\xC6\x12\x2C\x27\x09\xB6\x9B\x24\x58\xD6\x49\x30\xCB\xC9\xE2\x89\x9B\xDA\x18\xC3\x9F\x24\xD8\x6E\x67\x49\x82\xE5\xC8\xDE\x77\x93\x04\xDB\xE9\x0D\xF0\xB2\x4E\x3E\x3D\x34\x05\xF2\x0E\x18\xE8\x43\xEB\x1D\x01\x0D\x76\xA6\xC6\x4E\xAA\xB1\x13\xA8\x74\x87\xDB\x79\x38\xB6\xED\x76\xBA\x1D\xF3\x24\xD8\x8E\x73\x4B\xB0\xDC\x59\x46\xCD\x6E\x90\x60\x28\xBC\x2C\xFF\xC7\x34\x3B\x48\x42\xED\x84\xAE\x22\x6A\x76\xA3\x04\x23\xD1\xC5\x6B\x29\x0C\x03\x4F\xAE\xED\x21\x84\x55\x34\x56\x34\x0F\x0B\x82\xEC\x61\xEE\x21\xAB\xCD\xEE\xA5\x66\x07\xE0\x68\x07\x49\xB0\x4B\x00\x20\x28\xC1\x1E\x52\x5F\x04\x93\x7B\x88\x7B\x18\x49\xB0\xDD\x41\x82\xED\xF4\xA2\x7E\x68\x27\xC1\x2E\x3A\x13\xE5\xD4\x0E\x94\x53\x0F\x25\x09\x66\x59\x82\xD9\xEE\x0D\x82\xE9\xA1\x6E\x27\x4B\xB0\x9D\x41\x82\x5D\x32\x25\xC1\x76\x00\x33\xC2\xC9\x16\x38\x08\x12\x29\xBB\x61\x2C\xAB\x4B\xEE\x12\x14\x29\x08\x64\x00\xD7\x5D\x0C\x2E\x45\x8F\xBF\xCE\x8F\xB0\xE3\x02\x19\x62\x51\x86\xEC\x2E\xDD\xEE\xBE\x04\xBB\x38\x95\x60\xBB\xA3\x04\xCB\x51\x82\xED\xF6\x13\x27\x80\x44\x57\x97\xDC\xC5\xD8\x9D\x20\x09\x96\x71\x77\x24\xA3\x5C\xC6\xDD\x89\xCD\x24\x58\x86\xBD\x63\xAE\xC4\x10\x21\x80\x10\x45\x3C\x03\x4D\x34\xBB\x80\xDB\xED\x62\x26\xB7\x1A\xC4\x5C\x01\x4B\xC7\x10\xBB\x10\xB8\x59\x26\x5F\xE5\x0C\xF9\x1E\x66\x43\x2F\x3A\x57\x65\xD4\xDC\x4C\x7C\x66\x00\x57\x95\x62\x56\x4D\x11\x24\xDB\x46\x72\xD3\x87\xF1\xCA\x17\x3A\x30\x4B\x47\xB1\x0C\x60\x5B\x0D\x8B\xE7\x50\x25\x31\xC7\x2F\x0C\x7F\x84\xC3\xAF\x4A\x57\xC1\xF0\x25\x46\x3E\x3A\xFB\x92\x7E\x44\x17\xE0\xA5\x74\xAC\x30\x42\x83\x13\x59\xB7\x12\xC7\x8B\xF2\x17\xB4\x34\x93\xE9\x95\x10\x4E\xD0\xD0\xE5\x98\x7C\x8E\x0B\x76\x4C\x57\x07\xAB\x0C\x7E\x8D\xF7\x57\x19\xEF\x69\x70\xEB\xBE\x47\xC8\xFD\x95\x0D\x25\x21\xEA\x8D\xDC\x4F\xDB\x75\x3C\xCE\x95\x9D\x3F\x86\xE0\x4D\x8F\xF2\x45\x2D\x39\xC8\x5F\xB7\xC1\x0E\x19\x4C\x49\xEC\xF5\x73\x68\x04\x6F\x55\x14\xCF\x5D\xC0\x89\x59\xDF\x7B\xBE\xF4\x80\x17\x0D\x5C\xDF\x06\x29\x43\x90\x22\x8A\xC9\x97\x8C\x29\x09\x4F\x2C\x57\x53\x17\x75\x99\x46\x0D\x79\x20\x9D\x99\xF3\x76\x16\xBC\x70\x65\xD9\x69\x24\x0C\x8A\xB2\xBC\x73\x21\xCB\x27\xF2\x64\xC6\xA7\x93\x73\x33\xD9\x38\x8C\x2C\xC1\x07\xBB\x1C\x72\x8E\xA2\x9A\x87\xD3\x5E\x67\xF0\xDE\x5B\x71\x30\x2D\x93\x17\x54\xB1\x73\x7C\xF1\x19\x7A\xBC\x78\x17\x94\xB8\xBD\xCA\xE0\xFD\x68\x43\xC9\xEB\x61\x8F\x42\xE9\x94\xC3\xAF\x22\xFE\x1A\xC5\x5F\xE3\xF8\x6B\x47\xFC\xB5\xDB\xE9\x95\xE2\x8A\xA4\xFA\xA5\xE1\x28\x21\x4B\xDC\xC3\xE7\x44\x60\xC4\xBB\x53\x26\x46\x57\xC7\xB3\x65\x54\x94\x48\xA1\xA0\xF8\xEA\x3C\x31\xDC\x4B\x8F\xDF\x15\xEA\xE1\x01\x42\x56\x86\xEA\x5D\xCA\x86\xFE\x25\x90\x2C\x9E\x25\x66\x49\xA0\xE8\x2E\xDA\x52\xB0\x5E\xE7\xF3\xAC\xD7\x66\x76\x65\xB1\xC9\x03\xD4\x33\xB6\x6B\xE8\xCE\xB3\xA2\x67\xD7\x20\x2F\x83\x59\xBB\x46\x46\x76\x8D\x2C\x5A\x2E\xE7\xD9\x35\x42\x95\xCB\xB4\xA0\x40\x40\xCA\x0D\xFA\x26\x8D\x41\xF4\x25\xCF\x80\xCF\xF2\x9D\x8A\x9A\x63\x6B\x66\x7D\x2F\xD6\x6C\x3F\x49\x4D\x67\xE2\x89\xF2\xFE\x4A\xC5\x73\xD7\x91\x45\xCD\x0B\x8F\x12\x2C\x5A\x7B\x39\x04\xBF\x37\xF5\xD0\x9B\xBA\x27\xAA\x47\xA9\xA8\x2E\xD1\x1A\x5A\x97\x3D\x7B\x6F\xAF\x06\xD9\x4B\xEB\x61\xE9\x86\xAE\x9C\xE3\x62\xC8\x11\x59\x17\xF2\x92\xCE\x17\x73\x34\xCA\x93\xBC\xAE\x8A\xD1\xB0\x24\x51\xDD\x99\x79\xD9\x40\x39\x74\xA5\x1B\x46\x27\xC3\x20\xA4\xB9\x0A\x28\x52\xD6\x95\x87\xAA\x7C\x34\x60\x92\xA8\x48\x4E\x2F\xB8\xCA\x2D\xAC\x36\x8B\x4B\x4D\x09\xAC\xAD\x3C\x53\x8F\xBD\x44\x3B\x65\xB9\x22\xEB\x81\x5B\xA8\xB7\x47\xB7\xE8\x91\xDA\xE7\x06\x20\x8F\x2F\x72\xDB\xCF\x44\xA9\x5B\xA2\x6C\x18\x01\x4D\x5E\xD4\xB7\xE9\x96\x9D\x5B\xF4\xA8\xE7\x16\x3D\x00\xD9\xB8\xCD\x8D\xDD\x00\xE4\xF1\x00\xE4\xF1\xC0\x95\x80\x67\x9A\x5D\xBD\x3D\xBA\x45\x2F\xBA\x05\x57\x05\x9F\xC2\x2A\x03\x6D\xC3\x06\x9B\x2E\x6A\x76\xF8\x88\x02\xB2\x32\x40\xFF\xB6\x33\xE2\x2E\x02\x21\x2C\xB8\xEA\x30\xDD\xEC\x9B\x12\x9D\x8B\xE8\xBC\x1A\x51\x6E\xC8\x1A\xC3\x51\x78\xCE\x4B\x3E\x72\x3E\xF9\x98\xD0\xD6\x37\xC9\xE7\x5F\x0A\xF9\x10\xCA\x75\x30\xE6\x81\x92\x84\xB7\x7F\x91\x65\xA2\xFA\x14\x58\x31\x6A\x45\x45\x1A\x77\x96\x9D\x56\xE7\x05\x98\xBB\x45\x49\xDD\x5D\x37\xD2\x51\x5A\xF7\x29\xB1\x17\xBA\x37\xB9\x6E\x64\x30\x93\xFB\x62\xC2\xFE\x4B\x4E\x12\xE4\x65\x3B\xFE\x6D\xDC\xB1\x8E\x52\xC7\x2A\xE3\x38\x2F\xBC\x45\x41\xA7\xF6\xCD\xE9\xB0\xD1\x6C\xEE\x09\x7E\xA1\x2C\xAB\x68\x03\x2C\xAE\x22\x6A\x04\xF5\xA1\x09\x52\x85\xE2\xFB\x4F\x55\x43\xD3\xA7\xC7\xAB\x6F\xA8\x1A\x69\x0C\x59\x82\x9D\x3B\x83\x49\xE9\xC3\x48\xF7\xAA\x51\x79\x7F\x9E\x2D\x24\xFE\xAB\xD1\x33\xF4\xED\xFF\xEE\x47\xF1\xDF\x5F\x3C\xE6\x55\x4E\xBE\xFD\x47\x2B\x31\x2D\xD9\x53\x77\xCF\x10\xB2\x4E\xD6\x96\xFD\x42\x1B\xB9\x97\xB2\x09\xEF\x55\x18\xB5\x00\x3D\xF1\x48\xF0\x83\xD0\x62\x6D\xF6\x64\xEB\x35\xE5\xB7\x3C\x71\xB4\x36\x7E\x1C\xEF\xA0\x6A\x52\xF2\xFC\x7A\xDB\x29\x0B\xF0\x7C\xD3\xD4\xF3\x89\xA9\x67\xEE\x60\x4C\xC7\xDA\x18\x26\x45\x61\xF0\x27\x0C\x14\x63\x4B\x97\x79\x7D\x94\x6E\xD5\xAF\xA3\xF9\x7A\xEA\x43\x43\x9A\x64\x88\xCF\x3F\x65\xA2\xC8\x3B\xDD\x62\x46\x80\x37\x03\x34\x51\xA2\xEB\x3C\x53\x15\x4C\x66\xA8\x42\x1F\x78\x3C\x4C\x88\x2E\xBB\x28\x9A\x8A\x9D\xED\x0D\x19\xD2\xD5\x01\xBE\xD8\xCD\x3E\x58\xB2\x1E\xD2\x26\x37\xF3\x26\x06\x83\x9F\x65\x5B\x96\xD8\x96\x0D\x8C\x4D\xCD\xD4\xC8\xA8\x46\x86\x6E\x62\x2E\x3B\x1C\xDB\x76\x19\x26\x0B\x99\x61\x73\x96\x36\xB9\x91\xCD\x19\xA7\xE2\x91\xB9\x25\xC2\xEF\x22\x98\x06\x56\x96\x41\xDB\xC9\x91\xB9\x21\x56\x03\x55\x0E\x57\x19\xF6\x58\xC4\x78\x6E\xC0\xE5\x4C\x9F\xCB\x85\xAB\x44\x81\xCB\xD9\x15\x59\x6F\x77\x0B\xB4\x8B\x45\x5E\x11\x1A\xA1\x7D\x14\xB3\xBD\xED\xC0\xF6\x76\xF0\x2E\xD6\x74\x57\x86\x46\xB4\xA5\x57\xCC\xF6\x54\xF7\x26\x23\xB6\xC7\xA7\x4B\xA8\x08\x6E\x0F\x6C\x6F\x3B\xB0\xBD\xED\xC0\xF6\xB6\x87\x3B\x45\xA6\xDB\xC5\x66\xD3\x6C\x8F\x4E\x42\x01\x3C\x77\xC5\x93\x50\x7C\x0C\x07\xA3\x12\x95\x37\xCC\x21\x11\x4F\x42\x1F\x5F\xC9\x80\xDB\xDE\x5E\x4C\x12\x9B\x8D\xA1\x51\x4B\x57\xBA\x01\xBA\xD9\xB9\x21\x2D\x28\x1D\x97\xAE\x2B\x52\x7B\x11\xF3\xBA\x64\x87\x10\xB6\x10\x4E\x5F\xA6\xCC\x15\xC0\x6B\xC2\x2E\xE1\x52\x29\x27\x5E\xC5\x53\x3E\x81\xE1\x0E\xBC\xC2\x58\x04\xE5\xB7\xC3\xCB\xE8\x9E\xE8\xC5\x95\x62\xEC\x82\x4F\x83\xE3\x04\xB7\xA7\x0D\x9A\xD8\xCB\x87\xA6\x75\xA5\x13\xE9\x69\xA1\x2C\xBF\x15\xDE\x8E\xA2\x5B\x04\x7D\x0B\x2D\xE1\xCA\xA4\x16\xEE\x52\xD2\x4E\x78\x12\x9D\x0B\x05\x71\x18\xE9\x55\x74\x2F\x08\x57\xE5\xF0\xFB\x82\xFD\x00\x02\x63\x41\xEE\x83\xE9\xD1\x61\x87\x8C\x29\x88\xD0\x0B\x05\xD6\xBA\xEE\x31\x1A\x0B\x8C\xC6\x32\xA3\x31\xE1\xEE\x41\xC2\x68\xD4\x14\xA3\x51\x53\x8C\x46\xCD\x61\x34\x16\xAF\x3A\x37\x86\x12\x2C\xE0\x4D\xE1\x92\x53\x0D\x07\x36\xA3\xE6\xB0\x19\x0A\x1E\x17\xD8\x4C\xCC\x59\x25\x43\xEA\x18\x0C\xA7\xC2\xA9\xD3\x42\x56\x29\x19\x2A\xF1\xB6\xFC\x97\xE7\x83\x2F\xFF\x26\xF8\x9C\xE4\xE4\x31\xB3\x40\xFB\x07\x99\xCA\x7E\xD5\x09\xE3\xA9\xCB\xC6\x49\x62\xC4\xEE\x0A\xAB\xEA\xB2\xD1\xA4\x32\xFF\x0F\x50\xFA\x16\xA9\xC1\x82\x05\x9E\x99\xDB\x7E\xA3\xB0\x87\xCE\x25\x48\x52\xC2\x9B\x19\x61\xAF\x1B\xC9\x01\xD1\x48\x1D\x98\xAA\x16\x84\xBD\x2E\x09\x2E\x18\x7B\x10\x3D\x4A\x0C\xD9\x56\x7A\xC2\xFE\x01\x49\xFB\xFC\x9B\xD2\x7E\xAE\xB4\x37\xDF\x94\xF6\xDF\x94\xF6\x5F\xA6\xB4\x37\x2C\xED\xCD\x1C\x69\x6F\x1E\x24\x69\xFF\x25\x74\x3C\x3E\xA9\xCF\x75\x7C\x3B\x28\xC8\xB0\x54\x14\x39\x1D\xD2\xD6\x62\x33\x05\x81\xEE\x77\x76\xBE\xCA\x52\x64\xE4\xAB\x5C\xAB\x4E\x15\x20\xB5\x41\x3A\xC5\x1A\x01\x4A\x7B\xB9\x38\x5B\x31\xD6\x50\x5D\x0D\x65\x6A\x15\xF5\x06\xA8\x01\x0B\xCA\x77\x4D\x00\x4C\xA6\x1C\x0F\xA1\x2C\xBD\xC1\x21\xF9\xAA\x19\x3A\x1E\x8A\x79\x56\x52\x3E\xA6\xC3\xFC\x7D\x26\x82\xB1\xA8\x3B\xCE\x87\x9E\x79\x23\x10\xC3\x7B\x31\x0E\x80\xA5\x58\x4D\xC8\x55\x71\x1C\xE3\xDF\x0D\x71\x32\xC6\xBF\xC7\xA1\x23\xFE\x2C\xB9\xF1\x1F\xD2\x97\x3E\x56\xAA\x49\xD7\x28\xC9\xE1\xD0\x1A\x9A\xB2\x13\xC1\x2D\x66\x5C\x47\x31\xEA\x92\x18\xFF\xD1\x29\xCA\x58\xFF\x97\x20\xF0\x13\xE6\x4C\xD7\x0A\x3D\x8E\x94\x6E\x17\x86\x03\xD7\xA9\x1B\x84\x96\x73\x6C\xC1\x9A\x20\x1E\x65\x03\x44\x98\xEC\xF9\xDA\xDB\xCC\x0D\x42\x5A\xA6\xFD\x1B\x84\x00\x58\x8E\xE6\xAE\x9D\x8A\x29\x93\x35\xFD\xC2\x08\x54\x41\x20\xE7\x31\x5B\xC0\x68\xDA\x37\x4B\x4E\x61\xCD\xB2\x6D\x1B\xE3\x3C\xCB\x79\x63\x0C\xE7\xE0\x09\xD6\x28\x57\x4E\x72\x8F\x09\x61\x61\x01\x4F\x45\xBC\xCE\x44\x56\x1A\xEB\xF2\x38\x54\xEB\x94\xCB\x59\xBB\x22\xE0\xC2\xF3\x3D\xE1\x0E\x57\x59\x96\x1F\x91\x68\xF2\x60\x09\x49\x94\x42\x21\x92\x61\x18\xEB\x7E\xE8\xF4\x52\xA3\xE9\x76\xE7\xD4\xCD\x47\x11\x8C\xF6\xAA\xCB\x6F\x4E\x37\x1F\x75\x1B\xA2\xD3\xF0\xC4\xD8\x82\xD3\x91\x63\x77\xE7\xC1\x75\xA1\x50\x75\x6A\x0F\x50\x98\x38\x15\x8D\xF6\x14\xA0\x34\x35\xDA\x6B\xA7\xD0\x68\xAF\x79\x49\x75\xC9\xD0\x1B\xE1\x30\x1C\x9D\x40\x15\xBC\xDC\x09\xDA\xB9\xE4\xAF\x84\x97\x18\xB5\xB9\xFC\x96\x29\x8D\xFE\x4C\x5F\xA5\x9F\xDA\x1C\xC8\x73\x6D\x0E\xB6\x61\x57\xF0\xBD\xA0\xEF\xCB\x3D\xB0\x12\xE2\xC2\xA6\x15\x2D\x28\xD5\x0A\xA5\xCB\xC4\x85\x46\xE7\x25\x1C\x92\x73\xB3\xED\xC3\xCD\xE4\xE4\x4B\x7B\x8C\x71\x9C\x05\x85\xD3\x20\xA4\x0B\x5A\x3F\xA2\xFC\x7F\x30\x76\x5A\xB7\xAC\x67\x57\x20\x5F\x36\xC0\xC0\x6B\xE4\x44\x22\x3A\x27\x12\xD5\x25\xA6\x82\x25\xCD\x34\xAA\x9C\x60\x1A\x15\x01\x95\x02\x03\x89\x24\x34\x5A\x24\x79\x9B\x0C\x67\xF9\x8D\xF6\x1E\x9C\x66\xE9\x64\x79\x53\xCA\x1F\x04\x6D\x7D\x44\x34\x9B\xE0\x7C\x25\x69\x2C\x82\xCC\x1E\x22\x5A\x4E\x44\xB4\x9C\x88\x68\x39\x11\xD1\x72\x22\xA2\xE5\x44\x44\xCB\x49\xF8\x75\xA9\x13\xD3\x1D\xE7\x5F\xB5\x8E\x37\x94\x92\x27\xCC\xC4\x89\xB7\xD7\xD2\x17\x94\x79\x10\x48\x70\xBD\x56\x4E\xF4\x54\xD1\x1F\xAE\x44\x39\xBD\xAF\x11\x73\xF7\x35\xA2\xB7\xAF\x11\xDD\xBE\xC6\x09\x7F\xA2\xAD\xB5\xA7\x5C\x4B\x8A\x30\xD6\xDF\x90\x88\xA9\x07\x33\xF5\x5C\xB4\xA1\xA5\x31\x21\xF8\x44\xCB\xE9\xCF\xA1\x69\xE1\x9F\x41\x14\x91\x36\x25\xBC\x89\xB4\x60\x9C\x3E\x0C\x6A\x45\x0C\xA4\xA7\xCA\x71\xB2\x36\xE4\x95\x42\x96\x77\x49\x99\x05\x66\x43\xD9\xCD\xD0\xC8\xA7\xFC\xA8\xD6\xB0\x33\x43\xAB\xA1\x55\x78\x43\x18\x17\xB3\xF2\x27\x28\x2E\x0D\x7B\x2C\x6E\x3B\x05\x10\x61\x47\x19\x5D\x2B\x67\x28\x49\x20\xDD\x5E\x6C\x72\x97\xFB\x9B\xE0\x03\x0A\x48\x79\x13\x47\x4D\xC6\xCC\xDB\xFE\x08\xB6\x94\x34\xC2\x76\x6E\x91\x5E\x31\x46\x0E\xCA\xDC\x2A\x24\x2E\x0D\x24\x5E\xBE\x5F\xCB\x6C\xE2\x35\x6D\x17\x71\x25\x91\xB5\xD0\x1E\xC4\x9D\x00\x1A\x09\x0F\x70\xD0\x7E\x14\x28\xA8\x73\xAA\xAB\x2A\xBE\xEB\x4C\x2E\x97\x00\x33\x13\xCF\x5B\xE9\x6E\xC6\x82\x15\x5A\x6B\xA1\xCB\x98\x61\x0E\x2F\x36\x73\xB4\x67\x19\x5B\xE0\x9B\x9C\x1C\xB5\xB7\xB6\x8E\xA5\x8A\xC1\xFB\x72\x19\x6A\x90\x9A\xD4\xE1\xC7\x05\xF7\x94\x82\xEE\xE8\xD0\x05\x5E\x4E\xF4\xDD\x18\x8A\xAE\x0A\xBD\x67\x07\x2A\x8C\xFC\xD8\x39\xA2\xD1\xEA\x8C\x32\xB6\x41\x1F\x5E\x4B\x28\x37\xB4\x48\x4C\x5C\x24\x26\x2E\x12\x13\x17\x89\x89\x8B\xC4\xC4\x45\x62\xE2\x22\x31\xDD\x22\x49\x73\xFB\x17\x30\xF3\x82\xB3\x3D\x3B\x53\x0B\x97\x77\x59\x08\x71\xFB\x97\x91\xDF\x50\x9C\x59\xE7\x37\x8A\x8E\x5D\x9C\xD1\x5B\x7A\x05\xC8\xC3\xA9\x1D\xA4\xEC\x08\x4E\x51\x27\x74\xAF\x89\xFC\xC3\x38\xAB\x86\x2E\x5F\xAB\x41\xD9\xD0\xC4\x01\x23\x56\x35\x61\x55\x4F\x61\xD5\xF0\x3E\x86\xB0\x6A\x88\xB6\x02\x56\x39\x31\xFE\x1C\xAC\x46\xF9\x37\x69\x1B\x1B\xF2\x2F\xC4\x16\x48\x4F\x30\x01\xAB\x26\x88\x53\x03\x4C\x83\x03\x7B\x1B\xA7\xE3\xBC\x15\x62\xD4\x12\x46\x39\xDD\x3E\x31\x5E\xBE\xB8\x4B\xA6\x01\x97\x31\x97\x3E\x50\x81\x84\x2E\x3B\x49\xAD\x62\xA3\x1D\x99\x84\x5B\xF4\xA8\xCD\x07\x8B\xC1\xEC\xF1\xBD\x0C\x67\x06\x3C\x53\x67\xC3\x99\x81\x08\xFB\x78\x4C\xAB\xA4\x7A\x6F\xAB\x70\xEA\x17\xCE\x00\x0A\x92\xD1\xA8\xE5\x4E\x5A\xB6\x85\x73\xAA\x13\xCA\xB8\xC7\x3F\x49\x92\x60\x20\x33\x3E\x08\xDA\xEC\x22\xDD\x05\xAE\xC8\x6E\x4D\xC6\xC5\xE8\x25\x07\x87\xE8\x2D\x48\x63\x30\x7D\x24\x2F\x48\x9B\xD0\x22\x2C\xC0\xC7\xA3\x41\x87\x96\xA2\x0C\xD2\x2F\x09\x75\x28\xBA\x1C\xF3\x1D\x82\xD4\x74\x86\x79\x5A\x81\xFA\x60\x35\x3F\x90\x1B\x5F\x89\x50\x21\xDE\xD7\x94\x5D\x5B\xD2\x8D\x21\xF4\x48\xE8\x45\xE1\xEA\x19\x81\xBE\x55\xA8\x7D\x5E\x2C\xAB\x3B\xEE\xB8\x05\x10\xE1\xE9\xB0\xE8\xB7\xE1\xED\x5E\x2A\x2C\xCB\x8B\x44\xAC\xE1\xC4\xF8\x7F\xE2\xD2\x78\xEB\xB0\x97\x34\x85\x93\x34\x90\xC2\x41\x6A\x00\x72\x04\x9E\x3A\x06\x03\x7D\xCE\x6D\x30\x88\xD7\x9C\xC6\x0C\x73\xB3\x1B\x31\xAA\x8A\x5B\x31\xDA\x89\xE5\x36\x2B\xCA\x18\x7C\x8C\x16\xD8\x81\x2A\x07\xB2\x3D\x46\xBA\x3C\x47\xA2\xD2\x40\xAA\x24\x09\xC6\x1F\x0F\x6A\x38\x07\x9A\x27\x8C\xCB\xA3\x4D\xB1\xC4\xF9\x19\xBD\x3C\xEE\x8A\xA5\xF1\xAB\x71\x1C\xEC\x56\xCF\x19\xFD\xE0\xA3\xF1\x2B\x4E\x53\x22\x38\x40\x7E\x16\x77\x99\x98\x0F\x0E\x87\xB0\xE6\xD5\x8D\xAB\x95\x18\x15\x80\x20\xFF\x7B\xAF\x84\x49\xDD\x11\x1A\x93\x7B\xC4\xF7\xEC\x4F\x66\x4B\x2F\x28\x0B\xC7\x8E\x76\xFC\x17\xE9\xE8\x60\x1E\x34\xC0\x0C\x06\xA8\x78\x80\x19\x0C\x50\x9D\x7F\x80\xC2\xDF\x9D\xF4\x3D\xCA\xB6\x30\x1A\xD8\x01\x2E\xF3\x35\xDA\xBA\x85\x6A\x2E\x8E\x41\xFA\x87\x93\x28\xEC\x0D\xC3\x09\xFF\xC2\x5F\xEC\x9A\xC0\x16\xBE\x8B\x5B\xD8\x83\x2D\x5C\x9E\xB4\xF0\x88\xF9\x2D\xF4\xC6\x6B\xBF\x0C\xA0\x74\x20\x31\x09\x48\x46\x86\x58\x29\x1F\x90\xAD\x88\x2B\x34\xEB\x2F\x7C\x6B\x5E\x1E\xC7\xFB\x42\x4D\x4E\x29\x02\x1A\xE3\x8F\x1C\xAE\x0C\x5F\xAC\x0B\x47\x4D\xBE\xA4\xF3\xB9\x6D\xAD\x3F\x72\xB4\xB1\xE3\x97\x9F\xE6\x03\x3F\x96\xFE\xB0\xA8\x8F\x61\x07\x68\x49\xA4\xE0\x35\x99\x97\xEB\xB4\x0B\x95\xC7\x80\xB5\x62\x14\x21\xE3\x0A\xDC\x9A\xB8\x7C\xC9\x65\x9C\xE0\x0E\x45\x51\x48\x9D\xE0\x5F\x0A\x20\xF5\x32\x42\xE8\x01\x81\x40\xA7\x20\xC0\x7B\x50\x74\x4A\x05\x3D\xAB\xD8\x8A\x59\xE2\x64\x7E\xD0\x8A\x09\xAD\x20\xF3\xF0\x7F\xFD\xFA\x3E\xD5\xA4\x2B\x0E\x7D\x9D\x34\xDD\x4B\x9D\x5A\x5D\x30\xCE\xC6\x26\x23\x35\xE9\x48\xCD\xF9\x29\x38\x2E\x2A\x58\x52\xE4\x16\x4D\xD9\x07\x41\xD5\x13\xFE\x99\x1B\x09\xC1\xF1\xA5\xE4\x73\x2D\xF3\x3C\x5D\xE6\xF9\xD6\x96\x39\x6B\x73\xBD\x11\xF1\x89\x88\xFF\x8B\x04\x3C\x14\xDE\xF8\x25\xC9\x52\x28\x53\x16\xF7\xA9\xD7\xF7\x16\x7D\x64\xB4\x8B\xE5\xF8\x67\x00\xFF\xA2\x3C\x9B\xA3\xB5\x02\xD9\xA4\xC7\x0C\x5E\x53\xAC\x32\x28\x18\xF2\x38\x00\x18\x80\xBA\x9F\xC3\xD7\x83\xDE\xB3\x1F\x0F\x30\x38\xA5\xB0\xA1\xEB\x6F\x94\xBE\x03\xF5\x1F\x90\x44\xF8\x95\xE6\x52\x4C\x64\xED\x84\xFF\xB0\x18\xFF\xC2\x69\x3C\x3E\x21\x30\xF0\x25\x6F\xBA\x85\x87\x5F\x85\x0F\x2E\xDF\xEA\x07\x57\x6E\xF5\x83\x66\xAB\x1F\x3C\x7A\xAB\x1F\x3C\x6A\xAB\x1F\xFC\x1F\x5B\xFD\xE0\x4F\xC5\x56\xBF\xF8\xC8\x96\xBF\xF8\x1F\x5B\xFE\xE2\x3B\xB6\xFA\xC1\x87\xB7\xDC\xC5\x3F\x6E\xF9\x8B\x7F\xDA\xF2\x17\x5F\xDC\xF2\x17\xDF\xB6\xD5\x0F\xBE\x7D\xAB\x1F\x3C\xA6\xFF\x01\xB0\xD9\x8C\x2E\xC9\x27\x2D\x34\xB4\x62\xF7\x63\xDE\xFF\x90\x37\x1B\x76\x8C\xC8\x0F\x69\x9B\xF8\xAB\x59\x97\x09\xE8\x11\x6B\x8D\x65\x2D\xF5\x11\x24\x68\x60\x1B\xEB\xD4\xF8\x13\xB4\x57\xA1\x6D\xD5\xE5\x0E\xF3\x2B\xC1\xD3\xE5\xED\xF8\xBE\x53\x31\x5C\x86\xB3\xCB\xEA\xE1\xCE\x82\xF4\x56\x28\x1C\xD0\x05\x49\x60\x75\x2F\xFC\x84\xB2\x2B\x7A\x31\x7E\xED\x69\x0A\x3D\x5B\x3A\x39\xFE\xCB\x53\x94\x11\x9C\x18\x20\xB2\x1F\xFA\xA0\x08\x5B\x63\xE1\xEC\x65\xDA\x5D\xA1\x04\xE5\xF7\xD8\xCD\x02\xD5\x82\x40\x1D\xAB\x18\x86\x84\x34\xF1\x83\xD8\xDF\xB8\xF5\x6F\x7A\x65\xA7\xDD\xD1\x87\xE3\xD6\xDF\x9A\xA8\x7C\xC1\x2E\xA4\xA3\xD9\x07\x24\x29\x5E\xD8\x2B\x28\xD8\x10\xD9\x49\x5C\x01\x3B\xFB\x82\x23\xCE\x06\x21\x36\x04\xC8\x96\x4B\x5E\xA0\x8D\x6B\x19\xAF\x8B\xCB\xE3\xAE\x5C\x72\xB6\xCB\x9B\x87\x01\xD6\xED\x32\xEF\x17\xA8\x21\xAA\x1C\xDA\x38\x0E\x9F\x1D\x5D\x3A\x50\xC9\x32\x80\x1C\xF6\x31\x2B\x6F\xDA\xD8\xD8\x78\xA3\x41\xD5\x95\x4E\x4D\x35\xC8\xE8\x6F\x85\x3F\x97\x89\x4F\xDF\x7A\xF3\x86\xB8\x42\x08\xD6\x2E\x2E\x13\x9F\xEB\x0A\xC6\x58\xF0\xA5\xAE\x60\x37\x16\x3C\xFB\x39\xB1\xE0\x61\xAD\x17\xCB\xE2\x05\x50\xB0\x57\xA0\x92\x62\x9D\x62\xA5\x07\x80\x44\xEE\x72\x39\xF9\xEA\x01\x0A\x9B\xE1\x12\x47\x5C\xC2\xF1\x26\x32\xCC\x76\x32\xCC\x26\x32\xAC\xF0\x23\xD8\x1B\xB3\xCB\x7A\x02\xE4\x35\x3F\x7A\x2A\xA7\xCF\x85\x81\xA6\xFA\x17\x8C\xC2\x2E\x23\x6D\x8D\x5B\x12\xA7\x6C\x68\xE3\x0E\x4C\xD2\x81\x01\x8A\x40\xC5\xDE\x10\xB9\x04\x5A\x21\x1A\xBC\x3C\x1C\xD0\x7E\x1A\x37\x34\x41\xBA\xCF\x92\x9A\x78\xA4\xC4\x20\x62\x76\x8F\x18\x77\xF3\xD8\x1D\xBE\x00\x4A\xEE\x8A\x97\x63\xB1\x7F\x04\x8B\xD1\x72\x95\x77\x18\x23\xD0\x72\xF0\xE8\x8D\xCF\xE2\xC8\xD8\xCC\xF9\x44\xF7\xAA\x87\x3B\xE1\x77\xB4\x61\x2F\xF2\x10\xF8\x85\xA7\x66\xCB\xA1\xAC\x7C\xB5\x94\x76\x42\x9B\x2A\xBF\x83\x52\xFA\xC2\x0E\x6A\x8C\xD6\x53\xCE\x63\xC7\xA7\xD6\x74\x1C\xA3\xE8\x4A\x42\x3C\xB9\xD9\x23\x4C\x18\x2B\xE9\x4B\x71\xB8\x61\xBA\xCB\x6A\x4C\xF1\x85\x77\x90\xFB\xBA\x49\x8E\x8D\x28\xC1\xC0\x8D\x31\xD8\x02\xE7\xB1\xD8\xAB\x76\x38\x15\x15\xFC\xF2\x53\x7A\xDE\x8E\x56\x27\xB6\x2B\x3C\x90\x27\xE0\xDF\x46\xD9\xC2\x81\x6A\x08\x16\x47\x0E\x63\x98\x66\x73\xAC\x0B\x7B\x40\xCA\xAD\x00\x62\x48\x94\xDB\x0C\xB7\x8D\x8E\xCF\xC5\x46\x2D\xDD\x7D\x56\xAC\xE9\x1A\xCE\x14\x8E\x2A\xAE\x21\xEF\x84\xCC\x11\x3B\xC9\x30\xC3\x79\x50\x6D\x33\x3C\xFA\xE3\x8C\x7E\xCC\x4C\xD0\xBE\x27\x68\x2F\x12\x00\x26\xFB\x00\x13\xCE\x24\xA7\xC7\x48\x62\xF4\x31\x87\xB2\x1E\x37\x78\xC4\xB0\xE3\x00\xEE\x90\x35\xA7\xDE\x8F\xAD\x23\x64\xC7\xB7\x87\x35\x82\x1F\xF4\xCE\x21\xBA\x8E\x75\xBF\x63\x9D\x62\x4A\xB2\xB5\x61\x07\xB0\xE0\x4E\x21\x15\xF1\xEC\x51\x3A\xCC\x4D\x23\x89\xA3\xD0\xDD\x3A\xD3\x3F\x09\x84\x6F\xA9\xFF\x44\x7F\x74\x99\x3F\xD1\xEE\x55\x3B\xD2\x8D\x77\xA7\x0F\x3A\x31\xFE\x6B\x74\xB9\x17\x65\xF9\x6B\x0F\x95\x45\x40\xF7\x3D\xA2\x17\x1B\x09\xB6\xFE\x8E\xB6\x72\xE2\x4A\xE1\x1C\x1B\x35\x04\x6D\xE3\x1A\xD5\x36\xE4\xE9\xE0\x2F\xA7\xE0\x0A\xF0\xFA\xE1\x68\x8A\x8D\xAE\x17\x04\xC5\x82\x08\x1C\x63\x92\xEB\x16\xB7\xD1\x2A\x5A\x9F\xB8\x18\x3D\x47\x28\x37\x1B\x10\x90\xB8\xAA\x51\x4B\xB5\xF1\xB8\x23\x10\x4E\x2D\x11\x55\x0B\x6E\x15\xBD\x0C\x84\xB3\xB4\xEA\x2E\x6F\x1D\xE7\xA4\x59\x6E\x29\x66\x1B\xE6\x02\xA6\xF1\xCD\xDD\xF5\xE3\xA6\xEB\x43\x02\x73\x4E\xFA\x1F\x68\x17\x2E\xB6\xB9\xCC\x67\xFE\x99\x8C\xEE\x5A\x3C\x6B\xD2\x2E\x68\x91\x2B\xCD\x9E\x27\x97\xA2\xED\xE7\x52\x3F\x66\xF9\x69\xFC\x02\x91\xF1\x91\xC3\xD5\x20\x38\x07\x10\xD9\x2B\x26\xFB\x2C\xF2\x7D\xE4\x66\x8A\x3C\x45\x32\x22\x76\x67\x60\x01\x68\xA6\x3E\xF4\xCA\x21\xFF\x0E\xDE\xDE\x01\xC2\xD5\x7E\x72\xBF\xB5\x21\x8F\x23\x6E\xF0\x39\x7D\x5C\xC2\x51\x60\xD1\xEC\x26\x37\x9A\xC3\x18\x3B\xC6\x30\x3C\xBC\x01\x82\x18\x0D\x4A\x72\x87\x19\x37\x76\xAD\xC9\xBC\xBA\xB1\xC1\xD3\x06\xE5\x01\xED\x86\xC7\x4F\xD9\xC3\xD7\x40\xB5\xB8\xB1\x29\x60\x4B\xB9\xBA\xE4\xCF\x9E\x3D\x7B\x56\x3B\x0D\x54\x0A\x3F\xE5\xEA\x12\xFB\xD1\x50\xFA\xCD\xD0\xC0\x10\xAF\xDE\xF0\x74\xD1\x2D\x06\xBD\x38\x9A\x9C\x46\xA2\xE8\x66\x4E\x0D\xBB\x25\xA0\x64\x8C\x12\x80\x07\x8F\xCA\xD9\x64\xCB\x8A\x96\xB6\xDD\x24\x19\x77\x10\x9B\x1A\x3B\xBB\xBF\x2A\x02\xAF\x1B\x15\x25\xE3\xE2\xAA\xCA\x26\xA8\x28\x22\x2A\x8A\xAF\x73\x54\x14\xE7\x41\x45\xF1\xE5\xA2\x62\xF0\x95\x45\x45\x1E\x51\x91\x77\xA8\x30\x09\x2A\x16\x23\x2A\xF2\xAF\x0D\x2A\xB6\x80\x0C\xF9\xCF\x1C\x19\x22\x20\x23\xF2\xA8\x09\xF0\xA8\x51\x06\xA0\x83\x9D\xA3\x4E\x10\x33\x88\x88\xC9\xBE\xBE\xD7\x88\x13\xE3\x4F\xA2\xA4\xCA\xCE\x83\x9E\xEC\xCB\x45\x4F\xFE\x95\x43\x0F\x5F\x93\x49\x10\xC4\x93\xB2\x65\x82\x93\x2C\xE2\xC4\x7E\x7D\xE3\x64\x64\xCF\x83\x0B\xFB\xE5\xE2\x22\xFB\xCA\x2E\x15\x13\xF9\x56\x0C\x95\x35\xA3\xE9\x00\x5C\xD0\xE3\x01\x7D\xFA\x68\xFB\x49\xAA\x8C\x49\x55\x99\x9C\x2D\x02\x7D\x55\xC6\x44\x55\x06\xF0\x22\xAE\x6A\x74\xA2\xCA\xE8\x25\xBA\x7E\xD5\xA9\x32\x18\x69\x2B\x9F\xA3\xCA\x64\x04\xF7\xCC\xE9\x96\x50\xFC\x6D\x07\x2B\x99\xD2\x0C\xDE\x2E\xC9\x9C\x02\xE0\x7F\x93\x70\xBE\xEA\x84\x93\x90\xCD\xC7\x5F\x8A\x7B\xC0\x11\x9D\xD5\x4A\x26\x22\x50\x3F\x13\x74\x99\xB8\xC4\xCD\xD7\x39\xA6\xCC\x79\x30\x65\xBE\x5C\x4C\xD9\xAF\x2C\xA6\x74\xC4\x94\x2E\x9D\xA1\x53\x28\xEF\x5A\x3C\x39\x59\x56\xF7\xFE\x39\x22\x0B\xB6\x72\xE2\x32\xFD\x41\x78\xBA\x42\x2F\xD3\xD3\xFB\xE8\xC9\x39\x89\xA7\x2A\xCB\xEA\xD6\x8F\xC5\xCA\x78\xEE\xA2\x37\x3E\x86\x35\xF8\xEB\xCF\x53\xFD\x82\x9E\xEE\xA3\xA7\xE9\xED\xD3\x7C\xEA\x70\x6A\x8D\x9D\xC9\x24\x8E\x8E\xC4\xB6\xB8\x7A\x69\xFC\x29\xBE\x10\x1D\x69\x47\x79\xF1\x48\x69\xC8\xEB\x26\xC5\xA3\xE9\xE3\xD1\x84\xDD\x8F\xE9\xB4\x1A\x33\x07\x8F\x26\xA0\x81\xEF\x7B\x4E\xE1\xD1\x9C\x0B\x8F\xA6\x87\x47\x95\xE2\x11\xA3\xD9\x04\x3C\x32\xF1\x12\x1E\xD5\x0C\x1E\xCD\x14\x1E\x55\x0F\x8F\x66\x56\xAB\x91\xFE\x1E\x31\xB3\x93\xBD\xE5\x22\x39\x9A\x9F\xE2\x3C\x9C\xA3\x84\x10\x29\x9B\x6D\x66\x97\xD5\x72\x63\xDB\x26\x63\xEF\xAA\x87\xD7\x39\xFC\xB9\x1C\x23\x69\x76\xDB\x58\xBA\x29\xDB\xD8\xC8\xFB\x33\xE2\xFD\x36\xC6\xDC\xE4\x62\x67\x29\x4A\x30\xE7\xE9\x77\x16\xD8\xBF\x5D\xAA\x0B\x62\xFF\x85\xB3\x4B\x14\x94\x95\xD9\x7F\xC6\xEC\xBF\xD8\xAB\x2E\xA7\x0D\xED\x72\x14\x06\x00\x21\x1A\x19\x06\xA2\xC3\xB1\xDF\xF3\x4C\xA6\x24\x8E\x6F\xAB\xE9\x94\x01\xC3\x37\x7E\x44\x50\x02\xCC\x9F\x7E\x0E\xD7\x49\x98\x4F\xE1\x87\x74\x0D\xF2\x08\x23\x1D\x9D\x0E\xCA\xD5\x70\x92\x7A\xE4\x68\xA3\x22\xF3\x29\xF0\xC0\x0D\x63\x9F\x03\x83\x41\xE6\x53\xA4\xCC\xA7\x20\xE6\x63\xFB\xCC\xC7\x32\xF3\x81\x7D\x41\xC7\x7C\x6C\xC7\x7C\x96\xD5\x0E\xF2\xB5\xDC\x4D\x51\x34\x30\x21\x04\x9E\xFD\x76\x6C\xC7\xF2\xE9\xCB\x5A\xA3\x80\x5C\xD1\x66\x6A\xFB\xE4\x6A\x5D\xEE\xF4\x1A\x50\xF2\x8D\x20\x60\x9D\x8D\xE4\x9A\xA7\xE4\x4A\x01\xAB\xD1\x33\x3C\xEF\xC8\x35\xEF\xC8\xD5\x96\xE8\x43\x01\xE4\x9A\xD1\x48\x2C\x51\x6F\x5D\x90\x89\x0E\xA3\xB1\xB2\xAF\x13\xFA\xDB\x76\xE4\x5A\x10\xB9\xE6\x44\xAE\x16\x03\x26\xA0\x59\x34\xB2\x1D\xFA\x16\x90\x93\x20\x61\xF4\x75\x85\x04\x3D\x0F\x09\x5E\xD6\xCA\x4B\x0A\xEA\xCC\xC8\xC8\xCF\x89\x0C\xED\x72\xE6\x1D\x03\x37\x48\x90\x31\x87\x77\xD8\xCD\x79\xC7\x3C\x64\xE8\x14\x19\x3A\x45\x46\x3E\x0F\x19\xBA\x43\x46\x98\x04\x46\x3C\x72\x39\x21\x05\x67\xA5\xE8\x48\x07\x13\x77\x17\xBE\x3E\xD8\x43\x4F\xFE\xCF\x02\x3D\x26\xF0\xB7\x07\x80\xA2\xFE\x7A\xF9\x1A\xA3\x28\x4E\xA4\x8F\xA6\x10\xBE\x9B\xE3\x13\x34\xE8\x2F\xC5\xEC\x95\x12\x03\x12\x7B\xA5\x6C\x73\xA6\xCE\x5C\xE1\xF7\x04\xCE\x5C\x0F\x50\x63\x46\x4F\xF5\x02\xD4\xE6\x88\x5E\xED\xCB\xF3\xA1\x77\x18\x14\x12\xB4\xBA\x10\x7A\xB5\x1B\x32\x7A\x35\xA0\x57\x31\x7A\x35\xDE\x7A\x8A\xE8\xC5\x9B\x4F\x8A\xD1\xAB\x7A\xE8\x55\x1D\x7A\xA7\x10\xAC\x08\xC1\xBA\xCF\x04\x65\x8A\xD4\x21\x20\xB5\xEC\x21\x55\x31\x52\x95\x43\xA4\xCB\x1B\x9B\x91\x1B\x25\x48\x55\x29\x52\x55\x87\xD4\xA8\xBC\x61\x95\x1E\x52\x4B\xBA\x30\x45\x23\xB1\xF8\x1A\x88\xB5\xC4\x9B\x6D\x6A\x1F\x40\x20\x20\x75\x98\x20\x55\x13\x52\x55\xC2\x04\x29\x66\x19\xCB\xEC\x08\x7A\xEB\x2B\x5C\x29\x29\xE8\x0B\x02\x7D\xC1\xA0\xCF\xE3\xCA\xB2\x00\xFA\xC8\x8E\x09\xF4\x36\x5D\x59\x96\x56\x56\xD1\x5F\x59\x05\xAF\xAC\x81\xCB\x5A\x57\x24\x8B\xAB\xE8\x2F\xAE\x22\x59\x5C\x05\xA1\x58\xE0\x62\x0D\xBC\x8F\x17\x56\x31\x67\x61\x15\xFD\x85\x55\x4C\xF1\xBE\xE2\x5C\x0B\xAB\xD8\x7C\x61\x15\x18\xCD\x96\x17\x16\xF3\x14\x5A\x58\x76\x66\x61\x15\x53\x0B\xCB\xF6\x16\x56\x01\x0B\x8B\xCC\x07\xAA\xB7\xA8\x82\xBE\x70\x1E\x9D\x14\x57\xDC\x32\xAB\xA5\xFE\xF9\xA0\xE9\x92\x32\x0A\xBC\x93\x95\xF8\xCE\x8C\xD0\xA5\x34\x28\x3F\xB0\xD0\x53\xC4\xD4\x05\x5B\x11\x74\x8B\x11\x8A\xA2\x15\xC1\x92\x16\x96\xF5\xD4\xAF\x9C\x19\x41\x54\xBF\xF2\xB6\x0E\x59\xA4\x6D\xA2\x7E\xE5\xC8\x8C\xA3\xFA\x95\xBB\x1C\xD4\xAF\x7C\x09\xF4\x34\xF2\x50\xCA\x97\xC8\x85\x94\xD5\x2F\x68\x07\xCD\x25\x71\xF7\x6D\xE3\xEE\x9B\x97\xA5\x76\x39\x0D\x91\xC3\xC0\x91\x31\xC9\xB4\x98\x53\x32\x0F\xA9\x35\x31\x3B\x60\x56\x57\x51\xDD\xCC\x59\xF6\x87\x94\x19\xC8\x6C\x3E\x8C\x1A\xDA\x80\x7C\x8A\x45\x93\x63\x84\xAC\x3C\x30\xBB\x6A\x0D\x2F\xED\x50\xBA\x4D\x20\xCF\x92\xC2\xA7\x97\x0E\x57\x0F\x85\x02\x01\x74\x95\x6E\x04\x54\xA7\x6F\x6C\x6C\x47\x95\x0A\xB6\xBF\x85\x1B\xC2\xBB\x12\x28\x16\x58\x7D\xA0\x48\xE9\x4A\xAF\x89\x22\xC5\xEA\x52\xEF\x0B\xAF\xD7\x9B\x32\x48\x40\xF2\x39\x6F\x28\x6F\x8E\xB3\xD8\x31\x69\x99\x44\x7B\x23\xA7\x23\xED\x15\xAE\x6C\xEB\x21\xDD\x10\xC2\x8B\x7E\x00\x99\x51\xB4\x0F\xD7\xA3\xD2\xCB\x9A\x1C\xA6\xEB\x0A\x61\x80\xE1\x33\xED\x81\x4A\x52\xDC\xA5\x1C\x97\x5D\x5D\xB8\x9C\xB2\x2C\xE6\x31\x32\xD6\x34\x89\xEA\x84\x44\x8D\xD3\x40\x9F\xFF\x3F\x7B\x6F\x03\xAD\x59\x56\x15\x06\xDE\xF3\x73\x7F\xCF\xBD\xDF\x77\xDF\x4F\x35\x45\x7F\x6D\x7A\xDF\xBB\x70\xCD\x23\x74\x39\xB5\xD6\x48\x35\x69\x7F\xBA\x4E\xD9\x55\xAF\x5E\x17\x48\x4F\x56\x5C\x93\xAC\x49\xD6\x90\xC1\x64\xF4\xBE\xA2\xA9\xEF\x55\xD9\xB4\xA1\xA8\xF7\xBA\x28\xA4\x13\xC5\xA0\x60\x22\xC8\xC4\xEA\x6A\x42\x35\x68\x19\x94\x71\x90\x21\x48\xA9\xA3\x20\x46\x41\x11\x23\x8A\x06\x49\x83\xF8\x33\xDA\x8E\x3F\x83\x98\x50\xB3\xF6\xDE\xE7\xDC\x9F\xEF\xFB\x5E\xBD\xEA\xA6\x9A\x88\xAB\x6B\x41\xBF\xEF\x9E\x7B\xCE\xB9\xE7\x67\xEF\x7D\xF6\xDE\x67\xFF\xCC\x03\xF4\x1C\x5B\xDF\x82\x16\x01\x14\xB3\xF5\xC3\xDB\xA9\x64\x96\xAD\x4F\x16\xC3\x55\x42\x44\xD1\x9F\x3B\x28\x23\x21\x5C\x25\x2D\x5C\xE5\x90\x0C\xE1\x2A\x71\x70\x15\x32\x5B\xAF\x98\xAD\x67\x28\x23\x92\xC4\x10\xC5\x7E\x09\x4F\x61\xF3\x43\xDC\x7C\x35\xD8\x7C\xE9\x37\x9F\xC4\x3C\xAC\xD7\x6D\x7E\xB4\x70\xF3\x25\x6D\x7E\x6B\x03\xC2\xF1\xB1\x13\xFE\x6C\xE2\xB7\xDE\xD9\xFA\x47\x78\xC4\x74\x5B\xBF\x78\xCF\x23\xF6\x05\xCD\xC1\x1C\x73\x76\xCD\x34\x58\xC3\xF4\xCF\x06\xDE\x09\x8D\xA6\x81\x33\x88\xAD\x40\x44\x39\x31\xA9\xB5\x55\x53\x76\xBD\xE5\xE0\xD5\x85\x45\x02\xED\xB4\x6B\x44\x3A\x73\xBB\xDA\x54\x31\x68\x7B\x76\x4A\xFB\x43\x2F\x10\xA2\x9C\xD9\x46\x4C\xFF\x61\x67\x8B\xD6\xB7\x22\x69\x9A\x86\x20\xCC\x02\x36\x56\x44\x4E\x9D\xF9\xBE\x47\xE6\x9C\x0D\xCD\x89\xE1\x77\x41\xCF\x21\xE1\x46\x94\x95\xA7\x67\x22\x9F\xF8\x19\x80\x61\x57\x6B\x31\xAD\x5C\xA6\xCE\xD6\xD9\x4F\xB1\x76\xE6\xDC\xB4\xE2\xB0\x6B\x39\x11\x89\xD6\xBD\xCE\x0D\x53\xB3\x7F\xB2\x5B\x51\x88\xC0\x90\x6D\x7A\x53\x63\x15\x3F\x23\x9B\x0F\x6B\xB9\x3A\xE4\x3B\x52\xD2\x62\xE0\x31\xD1\xD4\x6A\x9D\x3D\xF2\x28\xE2\x35\x7E\x24\x77\x9B\x19\xBB\x85\xD1\x7E\xE7\xDA\x13\x39\xB6\xB2\x3D\x91\xE5\xE2\x13\x59\x79\x0E\x81\x06\xC4\x27\x32\x1B\x42\x1F\x22\x5B\xC7\x9C\x89\x25\xCB\x57\x9A\xD2\xFB\xB9\x13\x39\x64\xC3\xC1\x2E\x25\x05\xF2\x8D\xBD\x33\x39\xEC\xCE\xE4\x9E\x2E\x23\x19\xEA\x32\x12\x8E\x25\xDB\x9E\xCD\x1C\x2C\xDF\xEB\x32\x98\xC2\x0D\xCE\x64\xD5\x9E\xC9\x5E\x97\x51\x40\xF1\x64\xCE\x64\x3D\x77\x26\x6B\x3A\x93\x35\x8F\xC4\x9F\xC9\x31\x68\x7F\x26\x1B\x4F\x17\x43\x30\xBD\x33\x39\x9E\x3B\x93\x67\x74\x19\x91\xF7\x46\x1B\xE2\xCF\xA2\xBB\xFA\xDF\x62\x9B\x11\x9F\x83\xA8\x76\x89\xC1\xE5\x31\x67\x27\xB0\xC8\x54\x04\xC2\xBE\x55\x8C\x73\x5E\x04\x4E\x4E\xB0\x87\x51\x48\x70\x20\xB8\xC3\x19\x2E\x04\x6C\x6C\xED\x06\xE7\x48\x6D\xFB\x6E\x6D\xEE\xDD\x6A\xFB\xEE\xB6\x99\x77\xCE\x01\xC3\xD9\x39\xE5\x5E\x48\x36\x10\x98\xD7\xC9\xE1\xF4\x24\x19\x8A\xAC\x49\x3A\x28\xA5\xB3\xB0\x71\x6A\x49\xE7\x13\xAC\x21\xE0\x9C\xA7\xAE\xE3\xCD\x5A\x23\x30\x84\x03\x05\x65\xE0\x14\x94\x1A\xE1\x20\x82\xA8\xA7\x9B\x0C\x5B\x20\x88\x3A\xC5\x64\xD4\x72\x76\xC4\x88\xF5\x15\x93\x14\xCE\xB0\x76\x71\xA4\x24\xF3\x69\x55\x44\x5C\x28\xBB\xAC\x78\xC5\xA4\x02\xDD\x03\x82\x88\x3C\xF2\x10\x45\xBC\xE1\x10\x1E\xA4\x6C\x36\xE3\x55\x5A\xED\x74\xFC\x6E\x7F\x40\x0A\xBD\xDD\xA5\x60\x77\x1E\x0E\xF6\x6B\xBD\x0A\x99\x5D\x2B\xB5\xF5\x61\x2E\xEE\x0A\x5E\x80\x7F\xBE\x46\xDC\xC1\x7F\x80\x94\xC4\x47\x9C\xD9\xD4\x6A\x43\xD6\x4F\xCE\x40\xAC\x35\x50\x2F\xED\x6B\x76\x18\xB1\x15\xFF\xA2\x3D\xE1\x18\x55\x0A\x09\x8B\xBB\x14\x54\x87\x59\x0C\x12\x10\x2E\x9D\x27\x07\x35\x50\x6B\x72\x15\xD4\x81\xA0\xC4\xE5\x7E\x00\x11\x7D\x3A\xA1\x25\x9B\xB3\xFC\x2B\x04\xE7\x2C\x0D\x8F\xBA\x9C\x40\x9A\x61\xF2\x56\xD0\x1E\x2C\x21\x2A\x7F\xB0\xB5\x2B\x67\xDB\x2C\x41\x63\x6D\xA1\x87\x19\x02\xD5\x59\x6E\x0D\xDE\x1A\x67\xDD\xE5\xD4\xD7\x08\xD9\x3E\x2D\xBB\x79\x4D\x2C\x16\x24\xB8\x82\x81\x1E\x95\xAC\x1E\x7F\x9F\x7D\x90\xAD\xDE\xAA\xC4\x62\x4B\x11\x8E\xA3\x10\x8C\xCA\x40\xC8\x4C\xE9\x30\x4B\xA2\x2C\xCB\xB2\x38\xCD\x8C\x33\x05\xCB\xDB\x5F\x6C\x4D\x24\x9C\x65\x50\x9E\xFA\x5C\xFB\xF3\x3B\xC8\xB1\x42\x06\x9B\x05\xC2\xAF\xC7\xC2\x9D\x45\xF0\xFA\xE3\x87\x9C\x5B\x83\xDB\x37\xED\xAC\x20\x82\x4A\xB7\x9F\x10\xCE\x7F\x9D\x6F\x87\x04\x77\x25\xB8\x2B\xC1\x5D\x89\xF6\xBB\xA2\x05\x12\x0D\x62\x41\xF7\xF1\xEE\xDD\x47\x37\xA1\xFB\x68\xF7\xEE\xE3\x9B\xD0\x7D\x88\xFB\xF2\x1D\xFE\x49\x9B\xF9\xAF\x24\x4F\xEA\x2B\x01\x87\xA4\xE1\x0F\x7D\xB1\x58\x29\x16\xED\x27\xEB\xBE\x83\x5C\x2D\x18\xEB\x5E\xA3\x13\x3C\x00\x37\x1B\x1C\x2B\x99\xF6\x2F\xFC\x08\xD6\x64\x47\x8C\x5E\xA1\x6B\x42\x41\xD8\xD9\x10\xAE\x03\x6A\xFB\xEE\xD7\x0D\x3C\xA9\x40\x76\x26\x6E\x72\x68\xE2\xD6\x1D\x63\xE6\x4D\xA9\x18\x79\x34\xFC\x48\xD0\xC7\xC3\xAB\x3D\xFF\x5E\x89\x54\x09\x25\xDC\x83\x33\x65\x07\x41\xB2\x95\x70\xAF\x0C\xD8\xDF\x5B\x71\x75\x72\x7D\xE1\xDE\xC4\x16\xA5\xEE\x2D\x1B\x1B\x6E\x91\x79\x61\xD9\x20\x56\xB7\xB6\xBE\x28\xAA\xD1\x57\x82\xAF\x11\xAB\x4C\x02\x28\x54\x86\x2D\x1B\xA6\x02\x56\x54\x0B\x8C\xC5\x10\xF9\xCB\x51\x11\x88\x30\x49\x92\x44\x26\x49\x44\xD1\x96\x95\xFD\xC2\x9B\xBA\x05\x41\x11\xD0\x13\x83\xD8\xF4\x9E\x50\x7C\xF4\xD4\x20\x42\x81\x08\xFF\x9F\xF9\xB8\xEF\x72\x4D\xDE\x86\x67\xD3\x81\x60\xB5\x36\x56\x4C\xEB\x74\xC2\x02\xC5\x7E\x64\x2D\x1E\x80\x74\xD2\x17\x3B\x52\xB6\x35\x26\x79\x83\xEA\xF8\x76\x0F\x60\x6D\x67\x60\xDC\xFF\xB4\xFD\x17\x0F\xF7\xEC\xA3\x43\xC3\x0B\xD5\x0E\x08\x47\xE3\x6F\x32\xE7\x46\x92\x0C\x47\x92\x0C\x46\x92\x3C\xE9\x91\xFC\x70\x7F\x24\xDA\xD0\xE6\xB5\x03\xE9\x16\xFA\x1E\xEC\xE9\x70\xD7\x53\x9D\x4F\x38\x67\xE7\x57\xE3\x8B\x83\x75\x81\x2F\x0A\x7C\x31\x9A\xD4\x05\x0A\x47\x1B\x2E\x87\xBC\x5C\x93\x2F\x00\x0D\x23\x72\x39\x3A\x0E\x21\xE4\x13\x18\x97\x3F\x80\xC7\x6A\x9D\x17\xC2\x40\x01\x66\x83\xC3\x73\xE7\x76\xFB\xDE\x42\xCD\x0C\xF0\xE3\xAF\xED\x0D\x90\x52\xD7\xC1\xCC\x4A\x49\x03\xA9\x0D\xD6\x51\xF6\x5B\x9F\xF6\x21\x05\xBF\xF8\x1C\x1C\x1F\x74\xE3\x23\x07\x1A\x43\x09\xDE\x81\x3B\x9B\x3F\x22\x6D\xB0\x7E\x7A\x6E\xA1\x7E\xF9\xFB\x87\x0B\x45\x82\x06\xD1\xC8\xA2\xA5\x08\x86\x29\x82\xB1\x8A\x45\x43\x4F\x0A\x4C\x4B\x0A\x0C\x8E\x9E\x76\xDB\x1F\x29\xC6\xDE\xD1\xD0\xAA\xB7\x05\x64\x95\x8E\x94\xA2\x00\xE3\x68\x84\x33\x7E\x5D\xF8\x2D\x39\xFF\x2D\x9A\xD7\x7C\x7F\x86\x29\x95\x61\x4A\xD5\xF5\xDE\xA7\x36\x38\xE9\x9C\xF2\x91\x19\x47\x4C\x3C\xFB\x88\x90\xE8\x29\x89\x29\x02\xF7\x16\xBA\xB7\x6B\x1D\x67\x89\x30\xD1\xBD\x78\xC1\xE0\xC5\xE1\xEE\xC5\xF1\x8E\x32\x7D\xC4\xDF\x21\x9A\x7F\x5E\x88\xCC\x93\xA6\x1D\xD1\xF1\x5A\x6D\x2C\x91\xF2\x5D\x44\x14\xC8\xDE\x43\xB8\x07\xD2\x14\xC8\xFE\x1B\x0A\x76\x70\x8A\x19\xAB\x6F\x61\x87\xD2\x36\x04\x4B\x78\xD4\x85\x8A\x47\xDA\xC4\xFE\xBC\xA2\xF5\x8E\x8E\x7D\x2F\xC7\xDC\xB5\xAA\x32\x9C\x89\x20\x61\x0F\x41\x8A\xE0\xAF\x17\x8B\x66\xA9\xE3\x4F\x51\xA2\x4D\x98\x7B\x4B\x49\x2E\x23\x8D\xE4\x21\x59\xB2\x87\x20\xCB\x63\x09\x44\x55\xEC\xD4\xA3\x28\x32\x76\x72\x58\x3C\x90\xC3\xD4\x9A\x3C\xC9\x99\xAA\x4F\xD5\x09\x4A\x60\x19\xA8\xE7\xAA\xE4\x4E\x72\x7B\x48\x1A\x9E\x48\xEB\xB0\xA1\x20\xB3\x79\x73\x48\x9E\xC4\x4F\x51\xAB\x6F\xA9\xF5\xA6\xCD\x5F\xC6\xDA\xEA\xD8\xFE\xDA\x3B\x3E\xF6\x0E\xE1\x6D\x3A\x62\x14\xA6\xE8\x2D\x8E\x89\x94\xA5\xF1\xC6\xC4\x7E\x0C\xEB\x40\x62\xDF\xF1\xB1\x77\x7C\x8C\x54\x13\x6D\xDA\x7A\x48\x7C\x07\x11\x24\x36\x3F\xE9\x26\x9C\x1A\x48\x11\x08\x4F\x36\x75\xDC\x8E\x2E\x9E\x1F\x5D\x4A\x8D\x9A\xCA\x90\x9C\x5A\xE5\x34\x88\x0C\x70\xAD\x21\x73\x6A\x03\xBA\xA5\x4E\xF0\x4F\xE2\x4C\xC1\x59\xCE\xB5\x49\x53\xA7\xAE\x9F\x84\x81\x3D\xE5\xF3\x27\x01\x0E\x96\xA7\xC0\xD0\x9E\x43\x7E\x48\x9E\xE4\x15\xFF\x16\xC8\xEC\x99\x06\x7B\xC6\xDD\xEA\x3C\x1A\x12\x1E\x53\xAB\x15\x03\xBD\x5E\xF1\x57\x9D\xDE\x0B\x34\x07\x3F\x5E\xD4\xA7\x81\x0C\xFB\xC8\x3A\x79\x21\xF4\x90\xC5\xE2\x9A\x15\xE5\x6F\xEE\xB8\xF8\xC1\x76\xD5\x61\x6C\xC6\x63\xCE\x50\xA2\xF9\x2F\x0A\x0F\x39\xDC\x3E\x76\xFE\x13\x90\x95\x9F\x70\xB1\xEB\x5B\x58\x63\x41\xEA\x26\xC1\x9A\x07\xF7\x3D\x20\x0E\x14\xA2\x22\xD5\x6E\x85\x00\xFB\x78\xD0\x13\x53\xE4\x3F\x64\x88\xD4\x0C\x5B\xF1\x66\x9D\xD8\xFC\x65\x94\x25\x3B\xC1\x55\x49\x3D\x80\x28\xFC\xBA\x57\x60\x1E\xC2\x66\x38\xCE\x97\xE0\x1F\x48\x11\x0A\x0E\xC9\x6F\xE6\x2C\xF9\xC7\x38\x88\x1C\xC4\xFC\xC9\x2A\xF5\x5E\x2C\xA4\x69\x89\xDD\xEE\xA6\x54\x66\x5C\x37\x4E\x00\x49\x3A\x37\xCE\xD2\x6F\x47\xC6\x93\x28\xFF\xCC\x5D\x46\x29\xFB\xC1\xFE\x04\x7A\x2E\x13\x09\x13\x02\x3C\x7C\x13\x24\x99\x8E\x21\x20\x61\xFC\x60\xD3\xBA\xD2\x23\xFD\xFF\x2C\xAD\x0A\x12\xEE\xDF\xF5\x91\x07\xBE\x1A\x07\x70\x10\x31\xE7\x01\x5C\x66\x3C\x9B\x49\x50\xFA\x5C\xD0\x94\x7F\xCE\x95\x18\x03\x3E\xD2\xB6\xFD\x0B\xAF\xA7\x2C\xFF\x3F\xAA\x90\x94\x9F\x7B\xC8\x4B\x5A\x07\xBB\xA9\xBC\xA0\xF5\x4A\xC0\x33\x53\x39\x36\x0A\x2B\x1D\xAE\x13\xF6\x5A\xC6\x57\xF7\x00\x7D\x3B\x9E\x94\x1F\x62\x69\xA9\xFC\xAF\x34\x65\xCD\xF2\x59\x32\xD3\x9B\x75\x89\x16\x55\x47\x84\x55\x47\x84\x99\xD2\xFC\xC3\x3A\xF5\xB1\x0F\xD4\x9A\x7C\x49\x9D\x40\xBA\xCE\xAA\x71\x46\xFE\x1B\xC2\xA5\x74\x16\x97\xB0\x63\xDE\xBA\x14\x21\xA0\xF5\x25\x52\x07\x82\xFB\xBA\x91\xFC\xFD\xDE\xAC\xBF\x65\x30\x8E\x93\x37\x6F\x1C\xDF\xD2\x8E\xE3\x64\x6F\x1C\x76\x47\xF8\x30\x08\xBA\x93\xFA\xBF\x5F\x8A\x78\x9B\x54\x20\x20\xCA\xBF\xE4\xB0\x4C\xB6\x8B\x8E\xED\x42\x7C\xC8\xC3\xA0\xBF\x15\xE5\xEE\x13\x2E\x4A\x07\xC8\x29\xEB\x52\x25\xB2\xBB\x14\x6E\x1B\xFF\x9C\xAA\x9C\x54\xC5\xAA\x0A\x9F\xCF\xD1\x25\x60\x3A\xEA\x7C\x71\xD8\xF9\x1C\x42\xF2\x38\xF1\x77\x16\x9C\xC0\x54\x1E\xE3\x50\x2C\xDC\x63\x80\x3D\xB2\xEF\xE1\x7A\x11\xB2\x16\x2E\x66\x29\xF7\xF3\x9C\xCB\xC0\x74\xB9\x9D\x14\xA7\xCA\x74\xE1\x64\x86\x5D\x62\x4F\x53\xEC\x44\x2F\xE8\x44\x9A\x41\x82\x28\x88\x29\x7C\xB6\xF9\x06\x21\xB6\x7B\x64\x2E\xE8\x91\xB9\x36\xEA\x43\x4B\xE6\x82\x1E\x99\x0B\x5A\x32\x67\x3E\x44\x61\x47\x83\x4E\xBA\xF6\xDE\x5C\xC4\x2D\x79\xCB\x2E\xE7\x7C\x4E\x17\x2B\xF9\xCB\x1C\x0F\xE0\xA2\xA1\x3A\x42\x23\x28\x5A\x8D\xBB\x4C\x66\xED\x8E\x42\xC9\xEE\x24\x5B\x2A\x93\x6E\xCB\x45\x57\x63\xB7\xEE\xB2\x16\x4C\x72\x50\x74\xFF\xC1\x57\x7B\x9D\x4B\xCE\xEA\xB7\x9C\xD4\x6F\x2E\x7A\x47\x4E\xF1\xC2\xA9\x8F\xD2\x90\x22\x14\x64\x3B\xDE\x0E\x52\xFE\x43\xAC\xE2\x6D\x7D\x4E\xBE\x8A\x04\x40\x90\x0E\x5A\x3C\xE9\x16\x2E\x1D\x58\x7B\xE3\xF4\xAD\x75\xC4\xF0\x12\x22\xBC\xE8\xA9\xCB\xD9\x46\xAA\xE3\x90\x13\xA1\x85\xA7\xAA\xD8\xB0\x69\xEA\x20\xDC\x26\x07\xF8\x4C\xC9\x62\x8B\x61\x84\x6E\x6D\xF0\x9D\xF4\x89\x39\x23\xA2\xA9\x74\x7F\x41\xBD\x45\xD8\x1B\xE5\xD3\x89\xD7\x11\x2E\x52\x36\x93\x90\xBC\xC9\x47\xF9\x9A\x27\xE4\x28\x25\xDB\x0D\x89\x63\xBE\x4F\x31\xEC\x13\x22\xC8\xA6\xD8\x8B\xDC\xB5\x17\x61\xEC\x1D\x5E\x59\x0B\xEA\xB9\x12\xD9\x68\x75\xA4\x0D\xEE\x56\x4B\x2C\xCA\x39\x9C\x1F\x7B\x4D\x72\x51\xD1\x15\x01\xC7\x83\x25\x69\x91\xE9\xF6\x73\xE5\xFE\x6A\xC4\xDD\xEC\xC7\xD3\x9A\xCD\x3A\xF8\xF4\xB7\x65\x03\xF9\x9D\xC4\x07\x98\x3B\x65\x02\x09\xEE\x52\x41\x05\xC8\x6E\x8F\xF8\x97\xB3\xDB\xE5\xFD\xF8\xDB\xB2\xAC\xC7\x10\xBE\xEB\x8D\x1C\x87\x4F\x34\xEF\xAA\xCB\x7F\x84\xDB\x51\x70\xF6\xE3\x33\x10\x5A\xB5\x01\x21\xAD\xC7\xD4\x06\xEB\x5B\x5B\x2E\xB2\x62\x09\xE3\xEF\x7B\x5D\x3D\xFE\x86\x20\xD8\x79\xF1\x3F\x02\xFC\x1B\x04\x2F\x21\xF2\x33\x7E\x7B\x1B\x34\x87\xA2\x92\x3A\x43\x4C\x05\x72\x63\x52\x2B\x0A\x24\x4C\xD6\xCA\x0A\xBB\xA4\xA0\x54\x6C\xD3\x51\xBE\xC9\x5D\xF8\x3B\xFB\x01\x8E\x6F\x7B\x82\x4D\x10\x5E\x4C\x27\x8A\xDA\xE8\x45\x08\x7C\x17\x0D\xFF\x06\x06\x41\x2D\x28\xA7\xCB\xB7\x32\xB0\x49\x2B\x2C\x50\x80\xD7\xFF\x6D\xF3\x0C\x48\x2B\x37\x26\xAC\x65\x95\x6E\x0C\xAC\x57\x85\x90\x86\xCC\x5F\x67\xEE\xE6\xAF\x1E\x72\x47\x84\xCB\xA3\x46\x77\x2F\x6A\xCA\xF9\x62\xA6\xFE\x86\x50\x43\x48\xD6\x8E\x3E\x03\x21\x81\xB0\x1F\xB7\x03\xE3\x36\xAA\x3F\x70\x00\x27\xD6\xF7\x25\xCC\xB6\x08\x9B\x34\x87\x38\x8D\x41\xC0\xF1\xFC\x35\xE5\x86\x76\x2B\xD3\x7D\x55\x83\x9A\xB2\xC5\x63\x1F\x5F\xB4\xC3\x17\xBA\x1E\xA0\x8B\x11\xA6\x68\xDA\x71\x8D\x9A\xCA\x0C\x85\xC3\x12\x7E\xE7\x0F\xC9\x9C\x6E\x04\xEF\x0A\x34\x5F\x0A\x04\xE6\x47\x91\x32\xB1\xF2\x7C\x7F\xAB\x3C\x87\x39\xE5\x79\x4E\x51\x6C\xDD\x5D\x49\xE9\xD4\xE4\xA2\x73\x19\x05\x89\x47\x8F\x54\x3E\x26\x6D\xAB\x95\x19\x1C\x53\xD8\x84\xB4\x26\x64\x8E\xA9\x5C\x54\xD3\x9C\xA3\x1A\x0A\x24\x67\x72\xA0\xCE\xF7\xDD\x04\xFD\xF0\x2F\xE6\x7C\x84\x47\x15\xE7\xEA\xB7\xA2\x61\x0F\x74\xC9\xD1\x1F\x06\x64\x88\x1D\x89\x15\x42\xA4\x7E\x31\x87\x46\x6B\x0D\xE9\xED\xD9\xA6\x0E\xAD\xE6\xF3\x98\xA7\xA0\xD7\x82\xC0\x7E\xDF\x47\x3F\xF0\xDB\xE1\xC9\x5A\xDA\xFD\x0F\x80\x3C\xED\x1E\x41\xB9\x1F\xA7\x2B\xC9\x37\x2F\x1A\x42\x24\x96\xA1\xD5\x1B\x85\x50\x87\xA9\xB0\xD7\x3C\xC4\xE6\x61\xDB\x5C\xEF\xFE\x4A\xFA\x9E\x07\x5F\xA0\xE0\x4A\x8A\xF2\x74\x5B\x44\x0F\x63\x10\x85\x5A\x79\x9F\x63\xF6\x2A\x29\x28\x36\xDA\x81\x40\xDA\xF2\x0C\xC8\xD3\xB8\x8E\x94\x19\x28\xF1\x4F\x92\x3C\x9B\x7D\xDF\x54\x62\x8B\xDE\xC4\x6A\x6D\xC7\x0F\x80\x3E\xED\xA2\x34\x97\x4D\x1B\xA1\x38\xA7\xD4\xB1\xA0\x21\x26\x91\x49\x5B\x4A\x8E\x7C\x82\xAC\x48\x29\x9E\x72\x8C\xE4\xFF\x24\x11\xAF\x7E\xD0\x15\x8A\x04\x10\x76\xFB\x20\xDB\x40\x00\xE1\x33\xFB\xD0\xDB\x87\xC8\x46\x67\xF0\x54\x7B\xA0\xD9\x65\x4B\x1A\xFB\x9E\x3F\xFD\xAD\x3F\xF9\xF6\x06\xA2\xD3\x94\x82\x99\xB3\xBF\xF1\x2D\x6B\x64\xDE\xA5\xF8\xCE\x6A\x18\x39\xA5\xD6\xE0\xD6\xBF\x8E\x7A\x11\x80\xBA\xA0\x2A\x6A\x42\x92\xFE\xD8\xF4\x62\xE5\xA8\x09\xE5\xC9\x14\x6D\x1C\x3D\x3C\xF9\x8E\xE2\x6A\xBA\xA4\x8A\x14\x42\xC6\xB7\x73\x96\x4E\x31\xD5\xE7\x7B\x72\x97\xA5\x1E\x28\xDB\xB1\x70\x4E\xFD\x13\x50\x10\xB1\xEE\xEB\x28\x37\xED\x41\x98\xB3\x8D\x8B\x37\x49\xF3\xE9\x42\x19\xE6\xB5\xDE\x3C\xD6\x56\x8D\x91\x4B\x0B\xAC\x18\x1B\xE5\x79\x38\xCE\xF0\x48\xF3\x14\x7E\x3A\x2E\x1E\x35\x47\xCA\x6E\x83\x41\xD4\xB2\x9D\x27\xA7\xE3\x21\xF0\x9C\x54\xFE\x96\x59\xE1\x81\xC3\xB9\xE1\xC2\x36\xA7\xAA\x6A\xAC\x68\x70\xBA\x12\x14\xFE\x5D\x2F\x14\xF8\x8C\xAA\xEB\x6E\x8A\xA1\x63\x62\x13\x5A\x00\x8A\x92\x01\xE1\x60\x96\xC4\x54\x51\xF0\xB4\xD0\x8B\x74\xD1\x7A\x21\xB0\xAD\xF9\x4C\x2C\x56\xD8\xF7\x9E\x89\x29\x88\xF6\xAA\x90\x23\xF6\x7B\xCB\x3F\xBE\xB0\xE1\x2B\xBB\x60\xEE\xCA\x8E\x83\xB8\x82\xA0\x00\xE7\xAC\x2B\xA2\x50\xEB\x1C\x61\x5D\x70\x9C\xFE\xC4\xDF\xCB\x7A\x3F\xA1\x36\xA2\xBA\x7F\x3E\x3B\xF3\x3C\x78\xF0\x61\x30\xE9\x2E\x4E\x0D\xE2\xF4\xB7\x7E\xFB\x14\xA2\x5F\xF5\xBE\xD0\x77\x0E\xEF\x42\xAB\x83\x4F\xCF\x26\xBD\xD6\x9C\x92\x41\x31\xB0\x89\x6F\xC5\x5D\xC3\x03\x3B\xA6\x39\x38\xEE\x90\xC3\x5B\xE3\x1F\xE2\x0C\x83\xF6\x48\x65\x8B\xA8\xC8\x9D\x99\x92\x43\xCC\x13\x20\x9F\xA8\x52\x97\xD2\xD5\x71\x2F\x29\x9D\xD8\xC9\x94\xAD\x21\x38\x81\x1E\xFE\x39\x45\x51\x1F\x89\x3D\x89\x29\x20\x5E\x6B\xE8\xE5\x8D\x72\x02\xBA\x65\xAF\x33\xE6\xCC\x5C\x50\x88\xA0\x56\x78\x46\xB3\x12\x56\xBA\x34\xE9\x55\x04\xAA\x8A\xC9\xC1\xC3\xA6\x4D\x95\x73\x92\x35\x7D\x20\x48\x08\x18\xEB\x82\xC1\x71\x34\xA9\xC6\xD8\x54\x1D\x86\x31\xA8\xBA\xC4\x4A\x25\x56\xEA\x63\xE6\x7A\x21\xA1\x5C\x93\x25\x94\xA4\xBE\x60\xC4\xA4\x21\x8D\x8A\x00\xF2\x4A\x42\x51\x85\x30\x26\xCC\x24\xBC\x26\xBC\x5C\x2F\xC2\xD6\xF1\xC6\xD9\x7F\x3A\x5B\x11\x02\xD8\xB1\x1B\x7D\x09\x39\x8C\x10\x27\x9D\x3E\x1A\x39\x63\xBD\x26\xF7\xD7\x4B\xF8\x67\xB5\x96\x9B\xF8\xED\xFD\xF8\x9F\xD5\x7A\x79\x73\x9D\xF8\x6B\x09\x4B\x2C\x3B\x0C\x49\x49\xBD\xD2\x62\xDF\x2A\x2C\xE3\xAB\x65\xCE\xD0\xEE\x6E\x63\xEB\x70\xB2\x5E\x68\x7C\x93\xC0\x32\x4E\x24\x9C\x38\xB3\x1A\xC4\xBB\xD5\x36\x27\x23\x21\x9A\xC3\xB9\xD0\xE3\x5C\x0C\x2B\x33\x38\xB7\xEA\x34\xA8\x2D\xB9\x82\x10\x56\xDD\x2C\x42\x03\xCB\x88\x6F\xCB\x74\x33\x50\x4B\x58\x62\x02\x59\x56\x06\xA7\x12\x70\xA8\xD6\xB2\xA2\x30\x8F\x25\x0A\x05\x25\xA9\x90\x79\x97\xB3\x86\x2E\x9B\x3A\xC0\xA7\x02\x77\x91\x1B\x39\xDE\x0D\xE5\xC9\x2E\x68\x81\x43\x4C\xEF\x03\x33\x83\x98\xA4\x40\x37\xE6\xAF\x7A\x37\xE8\xEF\x14\x83\x78\x06\x7D\xA5\x2E\x91\xA8\xF2\x03\x0F\x71\x06\x52\xE1\x63\xAE\x92\x81\xAA\x0B\x72\xB8\xD8\x45\x4B\x3B\x42\x11\x70\x24\xE1\xB7\x0A\x4A\xB7\x2F\xB6\x0E\xC9\x8B\x82\x2F\xF4\x1F\x13\x9C\x57\x82\x5D\xB3\xB0\xD4\x5E\x14\xA4\x13\x0B\x9C\x7F\x56\x30\xE3\x4C\x20\x7D\x04\x8B\x23\x38\xD6\xF2\x4E\xF5\xFD\x82\x7F\xEB\x3B\xD5\xEB\xB1\xBD\xB8\x2B\xF8\x6E\xC1\x57\x7F\xDF\x25\xF8\x9E\xEF\x61\xC1\xAC\xE5\x63\x5D\xFF\x78\x16\x5D\x14\x75\xC0\x44\x98\x63\x3A\x8B\x35\x1C\x62\xC0\x61\xDC\x38\xFE\x72\xD9\x10\xFF\x0B\xC2\x3E\x2C\x9A\xF2\xF7\x2E\x90\x7F\xD1\x9A\x3C\x78\xD4\x2F\x07\xC8\xF2\x0F\x2F\x90\xE4\x49\x1D\xFA\x00\x1A\xF8\xAD\xCE\x19\xE7\x9D\xAD\x22\xA3\x27\x9E\x7E\x5E\x75\x8B\x7F\x70\x26\x1A\xE6\x6E\x2A\x75\xEF\x4F\xA9\x39\x34\xDE\xCC\xEA\xBB\xD0\x78\x7A\x26\x7A\x88\xBB\xF3\xBF\xAD\x0D\x18\xB2\x9F\x43\x11\x03\xFB\x71\x6B\x5A\xFA\xFD\x20\xED\x7E\xB7\xF0\xBA\x5D\xF8\xCE\x16\x8A\xC9\xBC\x6E\xCD\x83\xE5\x9A\x04\xDF\x04\x31\x0E\x79\xF2\x49\xF9\x05\x76\xE4\x74\x4B\xA0\x6B\x17\xE3\x84\x42\x36\x79\x5B\xE6\x5D\x62\x9C\x28\x1E\x54\xDE\x8E\xD2\x45\x4A\x2E\xFB\xD1\x4D\xD8\x62\x15\x47\xA9\x5C\x80\x13\x3C\xFA\x82\x9E\x01\xB3\x0F\x70\x22\xD7\x64\x49\x33\xE7\x7B\xB7\x59\x1A\x76\x48\xDE\x81\x9D\xFA\xEE\x00\x4B\xD6\x40\xA2\x40\xAA\x2D\x42\xFB\x9F\x5C\xE0\xA5\xD3\xE5\x35\x8E\x64\xE7\x36\x5C\x51\x5F\xDD\x75\x49\xAB\xE0\x94\x9D\x5C\x82\x6B\xD3\xDD\xA2\x1C\x6C\x63\x79\x76\x7B\xFF\xB6\x5E\xDC\x18\xE8\xE1\x9D\x0D\x9C\xF2\x46\xF6\x94\x37\x4E\x02\x97\x9D\xF2\x46\xB6\xCA\x1B\x84\x3F\x56\xDE\x10\xC8\x50\x88\x99\x5A\xE1\xAA\x7B\x2C\x56\xBC\xDC\x6A\x06\x25\x43\xCE\x12\x90\xB7\x18\x89\x08\x10\xBA\xE5\x26\x6E\x82\x96\x5B\xB8\xE5\x0E\x91\x82\xB0\xB1\x7D\xCF\xAA\x35\xA4\xC3\x94\x96\x9B\x3D\xB9\x76\xCE\xFB\x4C\x75\xA2\x5B\x25\xD1\xAD\x52\xA7\x28\x52\x6B\x72\xD5\x25\x95\xF1\x88\xBC\xBF\xC5\xE3\x92\x23\xFD\x22\x0A\xE7\x8C\xC1\x09\xDF\xD4\x8F\xEC\xE7\x82\x96\xF9\x20\x02\x12\xF8\x40\xDA\x6E\xF2\x15\x67\xFC\x27\x77\x64\x72\x15\x4C\x3C\xDA\x2A\x44\x5B\xA2\x82\x0E\x61\x65\xE7\x42\xC1\x1E\x8F\xF3\xFB\x74\x51\x74\x96\x31\x37\x69\x9F\x98\x9E\x04\x4E\xC5\xA5\x78\x16\xAB\xE4\x41\x49\xAA\x09\x1A\xF1\x43\xE7\x39\xDC\xD3\xE2\x55\xEC\x0D\xD6\xBC\xCD\xCB\x98\xBA\x15\x2F\x1D\x6B\xA9\x26\xB5\x76\xC1\x84\x59\xFC\x44\x26\xB4\x42\xCE\x80\x02\x11\xA2\x20\xE2\x14\xA5\x28\xDA\x44\x4E\xB4\xA1\x00\xE0\x54\x8B\x44\x9C\xB0\x27\x88\x08\x14\x44\x44\x27\xA3\xF4\x04\x90\x90\xD3\xD4\x44\xB8\x92\x11\xF5\xAC\x0E\x73\x20\x9E\xAE\x79\x84\xCD\xA3\xB6\xB9\xD8\xFD\xD5\x22\x11\xC7\x65\xC4\xE8\x8B\x38\xA0\x28\x69\x8A\x83\xF3\xA8\x27\xE1\x88\x81\x84\x23\x66\x24\x1C\x31\x94\x70\x6C\x40\xBE\x6B\xEC\x61\xC8\xBA\x80\x81\x98\x23\x50\xCC\x11\xA7\x1D\x59\x8E\x5A\x3E\x50\xD1\x27\xA7\xCE\x2E\xB2\x4A\xB0\x80\x39\xB7\xE8\x54\xE5\x2C\x8D\x20\xF1\x5A\x42\xE1\xF6\x30\xE8\xF4\x13\xB2\xAF\x4E\x16\x1C\xC6\x5C\xB1\x42\x4A\x72\x57\x12\xBB\xA2\x31\x27\x4E\x9D\xCC\xF1\x2F\x5B\xB6\x2D\xF0\x52\x04\x5D\xC7\x60\xC3\x82\xC8\xB7\x76\x49\x8B\x04\x1E\x97\xA9\x63\x5C\x24\x33\x2E\xD2\x25\x64\xA0\x38\x43\x79\x68\xC8\xE7\x97\xC2\xEA\x95\x0E\xDD\x51\x04\xA1\xA4\x98\x4E\x5E\x50\xC6\x8D\xDC\x27\xB9\x44\x5E\x76\xC1\xC0\x91\xA2\x4E\x21\x39\xC6\x96\x03\x33\x43\x8D\xE6\x86\x7A\x94\xC7\x7A\x9D\x4F\xB3\x49\x00\xF2\xCF\xD7\x99\x8F\x80\xA8\x37\x1F\x65\x7A\x83\x45\xAE\x4C\x50\xAE\x7E\xF3\x23\x46\xA5\xDB\xF2\x9C\x7C\x55\x8F\x47\xA4\x48\xC3\xDA\xCB\xA1\x95\xEE\x31\x6F\xE1\xA4\x8E\x2B\x09\x51\x95\x10\x68\xB5\xB8\x12\x21\xAE\x24\x0E\x57\x22\x14\x9D\xA8\x16\x69\xBD\xE2\xDD\xD5\x01\x51\x0B\xC9\xCE\x49\x5B\x42\x52\x85\xE4\xF7\xC6\xB8\x22\x87\xB8\x92\x60\xF3\xA4\x43\x88\xDD\x5F\xE9\x39\x5C\xD1\x3E\x8C\x78\x88\xB8\x12\x3A\x5C\x09\xAB\xA4\xC3\x95\xA4\x87\x2B\xD2\xE1\x8A\x3E\x5D\x69\x7A\x22\x5C\xE1\x27\x5E\xA7\x16\x57\x28\x9C\x76\x81\x32\x7F\x37\xCD\x31\x4E\xB3\x0D\xCE\xBB\x40\xA7\xAE\x19\x5B\x12\xD6\xDA\xBA\xFB\xEA\x2A\xC5\x82\x0D\x2E\x3F\x55\xA5\x4E\x47\x98\x7A\x6C\x91\xEE\x18\xE5\x5F\x1C\xB1\xDD\xE1\x0A\x27\x13\xD0\x08\x66\x01\xAB\x37\xFB\xAA\x46\x0D\xE9\x7A\xC1\xFE\xA4\xED\xB9\x8F\xDB\x5C\x67\xBC\xD1\x66\x42\xE2\x3A\xDB\xDB\xE3\x16\x12\x8F\xAF\xF3\x88\x2E\xE2\x20\x3A\x5A\x84\x74\xAA\x3B\xC6\xA0\x01\x33\x41\x09\xDF\x63\x02\xFB\x39\x70\x56\x39\x64\x86\x18\x14\x63\xD0\x1E\x14\x33\x67\x2A\xBC\xCE\x8A\x77\x4D\xE6\x3B\x6E\x1E\x6C\xDA\x49\xCA\xFC\x7C\x76\x26\xA0\x21\x9F\xE2\xD8\xE5\x0D\x8C\x9D\xEC\x5C\xFC\x78\xF5\xF5\xC6\xEB\x2E\x1D\x23\x67\x35\xA1\x9F\xE4\xE0\x95\x1F\x3C\x45\xF0\xDF\xDF\x39\xFC\xF1\xD5\x40\xFF\x02\x41\x63\xD1\xC8\x27\x54\x93\x90\x70\x0A\x14\x17\xB2\xAE\x74\x1A\x7F\x09\xC5\x9D\x2E\xB3\xEC\x53\x52\xF7\x87\x7B\xAB\xFB\x63\xDE\xA2\xD8\x58\x49\x0A\x87\x98\x74\xE7\xF1\xC6\x04\xE5\x3E\x86\x19\xD7\x25\x7E\x8B\x31\x37\x74\xAA\x76\x67\xDF\xA5\x1D\x1C\x9F\x60\xC0\x42\x3E\x3B\x7C\x72\xEA\xFE\x76\x10\xAD\xBA\x3F\x74\xEA\xFE\x98\xD4\xFD\xB1\x53\xF7\xC7\xA4\xEE\x67\x4D\x82\x1B\x43\xCC\x66\x00\x9A\x86\xCC\x5F\xA7\x2C\xBB\xE5\xAB\xCF\x2F\x50\xF7\x6B\x56\xBC\x27\x8C\x58\x64\xD2\x4F\xEA\xFE\xC4\x21\x1A\x63\x57\xA7\xEE\x27\x0C\xAB\x13\xAF\xEE\x97\x3D\x75\x3F\x85\x6B\x4C\x5A\x75\xBF\xBC\x8E\xBA\x3F\x69\xBF\xBA\x87\xBA\xDF\x3B\x80\xCA\x9E\xBA\x5F\x3A\x75\xBF\x9E\x53\xF7\x6B\x56\xF7\x53\x85\xB7\x47\xCA\x6C\x8B\x73\xB2\x6F\xE0\x5D\x69\xE8\x0C\x8F\xC2\x3D\xA4\x24\x6F\x78\x84\xE2\x39\xF9\x96\xA0\xA4\xB3\xBF\x29\x7F\xC2\xA5\x47\x9E\x93\x61\xF7\x08\x08\xE3\x86\x9E\xB7\x31\x46\x12\xD0\xC8\xBA\x95\xBC\x02\xD2\x31\xCC\xDA\x31\xCC\x9D\xF8\xDA\x0B\x2F\x42\xE3\x08\x7A\x21\x46\x48\xE1\xE1\x9A\x90\x36\xA6\x27\x45\xC5\x47\x8B\xA0\xFC\xF8\x43\xEE\x22\x94\xF8\x8B\x78\x4D\xFE\xFD\x9A\xA2\x88\x66\x56\x9D\xB1\x63\x1C\x60\xCF\x7F\x10\x32\x48\x79\xE8\xB8\xD1\xEA\x0C\x72\x92\xFF\xE6\x7C\x3F\x06\x76\xED\x42\xB0\x72\x9A\x07\x08\x9A\xCA\x50\x54\xD2\x2A\xB7\x41\x55\xA8\xC3\xA0\x28\x14\xA4\x7E\xAE\xDA\x5F\x8F\x8E\x6C\xFF\x8F\x45\x00\x23\x08\x9F\x2F\x93\xFF\xA9\xA0\x14\x72\xDC\xCE\xDF\xD8\xB1\x5F\x48\xC4\x17\x66\xCC\x7D\x73\x2A\x0F\xF2\x79\xC1\xE5\x01\xB5\xC9\x79\x1A\x10\xD4\xB2\xF2\x89\x0B\x1C\xE6\xD6\x59\x89\x43\xB1\xEE\x72\xE0\x39\x8A\x1C\xAF\xC9\x92\xD2\x68\x00\xA9\x3E\x36\x6B\x65\x35\x28\xAB\x8F\x4F\xCA\xF7\xBE\x86\x55\x97\x28\x08\x62\xCF\xE5\x7B\x5E\x43\x86\x01\x08\xA5\x63\x7B\xED\xDA\xCF\x04\xF7\xD6\xE5\xA4\x8E\x48\x6D\x47\x59\x1D\x90\x4C\xD8\xFF\x7A\x4D\x1D\xDB\xE2\x8D\x20\xDD\x13\xD9\x0E\xBD\x88\x93\x3F\x64\xE5\x6F\xD0\xEA\x8E\x41\x56\x0A\x72\x62\x8B\xD9\x6C\x94\x8C\xF9\x29\x8A\x64\x45\x69\x2E\xAC\x68\xD8\x99\x89\xC3\xD6\x3A\x79\xB3\x2E\x9C\xF0\x33\x86\x02\x82\xF2\xD7\xC9\x8B\xE4\x57\x5A\x1B\x93\x4A\x0D\xD2\xC0\xC0\xD8\xBD\x93\x3E\x23\x4E\x53\x2B\x24\xA2\x38\x1E\xAC\x11\x3B\x49\x33\xB9\xD5\x78\x50\xF0\x3A\xB1\x36\xCC\x6B\x27\xA4\x84\x9D\x90\xF2\x23\x89\x18\x3F\xA3\xAD\xFD\xEB\xAD\xAD\xDD\x45\x5F\xEB\x92\x96\xD4\x8A\x1A\x18\xE4\x16\x66\x14\xB3\xB9\x67\x9B\xAB\xC2\xB1\xF7\x05\xB2\xCC\xA4\xC5\x1D\xB1\xAA\x56\x1E\x86\x02\x54\x3D\xC6\x86\xE3\x59\x45\x07\xF2\x16\xE3\x4A\xE5\xB1\x81\x31\x12\x9B\x71\x4F\x67\x0B\xA3\x4A\x42\x5E\x85\xED\x65\xA8\xBF\x40\xA1\x16\x89\xD9\x45\x5F\x6B\x60\x5C\x51\x6F\x4E\x6B\x39\xE6\x81\x2B\x0A\xEB\xEC\x07\xCE\xC3\x36\x74\x95\x81\x43\x0E\x68\x94\x64\xDA\x82\x13\x8D\x5C\x52\x9D\x10\xCC\xD1\x6A\x4C\x40\x5E\x95\x5E\x69\xAD\x2B\x03\xB2\xD0\x94\x90\xC6\xB8\x40\xB1\x7A\x51\xFF\x93\x22\x24\x9E\x6A\x46\xCB\xAD\x79\x51\x4A\xF2\xAD\x03\x55\x4B\x9E\xB8\x98\x4E\xA0\x68\xEF\x40\x10\xE9\xC9\xA0\x9B\x4F\x3A\xE5\xCD\x4F\xAB\x90\x3F\x92\x93\x3E\xFC\x28\x51\x07\x83\x0B\x8C\x9F\xCF\xF1\xCB\xA3\x09\x9B\xE5\x18\x7C\xC3\x26\x22\x0B\x67\x3F\x21\x05\x78\x37\x05\xB1\xB8\x52\x2F\x3B\x6E\xC4\x70\xF8\x34\x6B\x7D\x47\x48\xD1\xFE\x97\xA9\x7D\xFF\x76\x63\x6F\xDD\x30\x06\x1F\xDD\xEF\x83\x42\xFA\x98\xCB\xAF\x68\x6A\x61\x9F\x75\x82\x52\x1A\x49\x2B\x40\x9C\xB1\x3F\xB0\xB3\xA3\xA7\x4C\x4B\xCD\x31\x92\x4B\xCD\x9F\x2B\x25\xCE\xA9\xED\xE8\x2C\x04\xEF\xAB\xC5\xE5\xD6\x14\x4B\x1C\x81\x87\x2F\xD7\xDA\x5E\xBB\x76\xF7\xBD\x8E\x81\xBF\x76\xED\xDA\xB5\x78\x0A\x72\xAB\x08\xEE\x09\xE8\xDF\x7D\x3F\x63\x83\xE7\xA9\x77\xBE\xF5\xB5\x3B\xC1\xA3\x7C\xED\x76\x64\xFB\x9B\x88\xF8\x07\x8F\xB8\x2A\x01\xBE\x81\xB6\xC1\x37\x5C\xAA\x83\xF7\x61\xD7\x95\xB6\xF7\x72\x52\x2C\x6D\x77\x76\xAE\x5E\x8B\x8F\x73\xBB\x8B\x2E\xF3\x27\x97\xE2\xD9\xDF\x76\x84\x2C\x00\xA7\xFD\xB0\xAB\xDF\x06\xAA\xA1\x21\xDD\x3D\xAD\xB5\x7D\xFC\x27\xBF\xB2\xA9\xA5\x5D\x7D\xA0\xB1\x0F\x3D\xD8\xBC\xBB\x8E\xEE\x09\x5E\xF2\x83\xF7\xAD\xDC\xF3\xD1\xBB\x2F\xD5\x31\xE9\x73\xAE\x06\x53\xD0\x5B\xDC\xE7\xE9\x2B\x47\xE0\x3B\x20\x78\xDF\x11\x9C\xD0\xF8\xD5\x17\xDE\xEF\xBE\xF0\xC4\xFB\x2F\xD6\x34\x06\xF7\xFC\xC9\xBB\x2F\x5D\xAA\xC3\x47\xDE\x47\xEA\xAD\x53\xAF\x7E\x7F\x9D\xDC\x13\x04\xB0\xEF\x95\xBF\xF0\x9B\x77\x5F\xAA\xD3\x8B\x75\x06\x29\xC4\x90\x3D\x72\x11\x02\x48\x1E\x81\xF0\x91\x5E\xDB\xE0\xF0\xC5\x47\xEB\x80\xB4\x6D\x01\x8E\x21\xBE\xE4\xBA\xFE\xC1\x9F\x7B\xF0\x23\xE9\x9B\x7F\xE6\xEE\x4B\xF7\xFC\xBB\x07\xBF\xFB\x2B\x7E\x76\xFA\x1F\xEE\xBE\x78\xE9\x1E\xFD\xF9\x7F\xFD\xA6\x37\xBD\xE9\xE3\x77\x5F\xBC\x04\x31\x70\xBD\x7B\xFE\xEE\xD7\xFF\xA7\xE5\x3F\xF9\xE9\xBB\x2F\xDD\xF3\xDB\xEA\x17\xFE\xD5\x37\x1F\xFB\x00\xD6\xFB\x07\x6F\xA8\xDF\xF8\x9C\x8D\x5F\xC1\x9F\x6F\xF8\x26\xFC\xF7\xE9\xBB\x2F\x5E\xBA\x78\xF1\xD2\xC5\x3A\xE8\x86\x06\xD1\x3D\x87\x9E\xF7\x27\x4B\x7F\xFA\x85\x7F\xF0\x75\x97\x70\x64\x17\xEF\xF9\xD8\x95\x37\x7F\xE8\x05\x6F\x7C\xEF\xD7\x5D\xBA\x78\xF1\xE2\x45\x8A\x81\x61\xFE\x8E\x10\x3D\x87\x31\xED\xAD\xF4\x58\xA3\x48\xCC\x24\xA8\xF2\x9F\x9F\xF7\xE1\xD9\x7A\xE9\x8C\x3E\xFA\x15\x61\x46\x89\x9D\xD5\xB9\xBE\x66\xCD\x75\x61\x5F\x4B\xFF\x7D\x98\x75\xE5\x13\x97\x10\x74\x1B\xA4\x95\x4D\x15\x73\x76\x58\x96\xDD\x13\x36\x2E\xFC\xCA\x75\x12\xE0\x12\x79\x58\x1D\x46\x40\xED\xD1\x5B\xE4\xB1\xEB\xF4\x0E\x0A\x2B\xFF\x92\x66\xB4\x24\xA3\x48\x45\xFC\x4F\x44\x41\x14\xE9\x08\x45\x04\xC9\xC9\x8C\x65\x2E\x8D\x4D\xD8\x4C\xA7\x44\xD0\x76\xF7\xC6\x09\xC8\xAD\x2A\xC9\xE9\x78\xA2\xD8\x1E\xF7\x35\xF6\x9A\x98\xDA\xF4\x04\xBB\x43\x92\xE8\x9E\x9D\x84\x0C\x4B\x1B\x7B\x1F\xD2\x49\x0E\xF3\xCE\xF1\xEC\x5D\xF5\x6C\x83\x8C\x65\xBD\x5C\xC0\x61\x42\xFE\x36\xC7\x37\x88\xD9\x78\x52\x6E\x41\xE2\xA2\xC2\xDB\xE0\xF8\x04\x4F\x1F\x90\xF6\xF6\x6F\xAB\xB3\x06\xB2\xD3\x14\x65\x85\x4E\xC0\xF8\x40\x10\x54\x19\x39\x42\xB8\x21\xE1\x07\xBE\x0A\xFB\x8A\x99\xE9\xA7\xA1\xA7\x90\xD8\x9D\x64\x8B\xF4\x17\xF1\x81\x40\xD4\xB3\x43\x37\xEA\x30\x98\xE1\xD0\xCD\x6E\x43\x27\x45\x0A\x7F\x88\x12\x39\xD0\x30\x33\x1B\x40\x66\x83\x7B\x27\x64\x38\x2E\xF1\x93\xDD\x10\x25\x0E\x51\x54\xB9\xDD\x91\x55\xDC\xDB\x94\x8C\x53\x32\xD8\xEF\xDF\x6E\xEC\xED\xAF\x18\x65\x42\x06\x5A\x6B\x85\xFF\x43\x64\x4E\x79\xA4\x7F\xC8\xA1\x1F\xDA\x79\xD0\x1E\x68\xDC\xAE\xDC\xEE\x44\x3E\x08\x84\xAB\xFC\xD9\x99\xCA\x02\x2B\x2B\xAE\x7C\x55\xF0\x92\xEF\x68\x3C\xEF\x13\x88\xB7\xAA\x04\x52\xC8\x79\x92\x55\xB6\x38\xCB\x95\x1B\x64\x1D\xDB\xFF\xB9\x19\xFD\xBD\x68\x3E\xD6\xF5\xE0\x9F\x14\x72\xB6\x28\xE8\x7E\xA9\x00\xDF\x73\x41\x10\xC6\xB1\xC6\xDF\x41\x8C\xC0\x96\xDB\x72\x66\x6D\xAE\x89\x69\x9D\xD9\xC7\xB6\x9B\x51\x25\x3C\xD9\x0A\x64\xD0\xFB\xA7\xFC\x0F\x41\x69\x05\x5E\x3E\xAD\x12\x9B\xD1\xDC\x2C\x20\x00\x65\xF6\xD7\x83\x63\x08\x3C\x71\x95\x43\x66\xDF\xB2\xDD\x8C\x22\x29\x84\x10\x92\x72\x6E\xE7\x58\xF1\xF4\xB4\x4A\x20\xE7\x46\xE7\xA6\x90\x10\xA4\x4C\x27\xCE\xC8\xD5\x35\x0A\xB0\x51\xC0\x22\xA5\xDD\xD1\x53\xAF\xB4\x4C\xE8\xAB\xA0\x6C\xDC\xD8\x07\xA7\x75\xF1\x5C\x15\xD4\xA3\x23\xC1\xDF\x9D\xD4\x63\xEC\x85\x15\x13\x19\x8C\xEE\x23\x7B\xF6\x2B\x55\x09\x23\x18\x1D\xB9\xFB\xB5\xF5\xD2\x59\x58\x7A\x4D\xB5\x04\x63\x0B\x53\xFB\x3B\xC1\x69\xFB\x17\x4E\xEC\x48\x28\xE7\x6C\xD2\xD8\x83\x90\xC3\x12\x2C\x41\xB9\x53\x2F\x43\x79\xEE\x55\x97\xEB\x8C\x52\xC0\x65\x1B\x13\xC8\x1A\x64\xB4\x13\xDC\xE4\x0C\xAB\xFC\xBD\x42\x40\x62\x6F\xDF\xA8\x14\x64\x55\x02\xCB\xD5\x12\x70\xB6\xFB\xC2\xA5\xEA\xE3\xC0\x46\xA0\x21\xC3\xCF\x3F\x7C\x19\x62\x40\x3E\x61\x5C\x7E\x17\xCB\x29\x0C\x30\x32\x1F\xB9\x19\xCA\xB9\x19\x22\x8C\xAF\x4C\xEA\xD5\x6E\x5A\x39\xAC\xD0\x01\xB2\x02\x2B\x88\x98\x49\x03\xC9\xE9\x2A\x81\xD5\xFE\x8C\xF6\x39\xCF\x39\x0D\x19\xCE\x68\x1F\x76\x07\xF1\xFD\xF5\x18\xE2\x93\x9B\x75\xDE\x4E\x28\xA7\x09\x65\x24\x7B\x61\x8D\x8D\x42\x40\x86\x13\x2A\x20\xAF\x32\x18\x57\x09\x14\x6C\xC6\xC3\x38\xD5\x4D\x28\xC7\xAF\x3F\xE0\xE6\xB3\xBA\x68\x3E\x34\xA3\xAB\x01\x9B\x2A\xDD\x11\x04\x9C\xAC\x1C\x27\x54\xAD\x10\x86\xD0\x9B\x15\x5B\x9E\xB1\xE5\xB7\x55\x2B\xA6\x3F\xED\x2F\xBF\x19\x17\x37\x04\xA3\x4B\xF3\x30\xBA\xD4\xC1\xE8\x97\x1C\x28\x6D\xB0\x1B\x40\x16\xD7\x05\xC8\x6C\x52\xAF\xF4\xB7\x27\xE3\xED\x99\xDD\x8F\xDE\xF0\xF7\x41\x06\xD9\xEE\xFB\x91\xF0\x7E\x64\xBC\x1F\x89\xDF\x8F\x04\xC6\x55\xB6\xEB\x7E\xB4\xA3\x5F\x59\x34\xFA\x01\xF8\x11\x99\xF5\xE0\x57\x67\xF6\xDA\x35\x35\x85\x8C\xA1\x70\xE2\x08\xB0\x9F\xE1\x5F\xF7\xC9\xE5\xA6\x85\xA9\x78\xB8\xA3\xF1\xF3\x54\x40\x6D\x5A\x32\x8C\x67\xE5\xCF\x05\xC7\x26\xE5\xEB\x86\x7D\x90\x9C\x9B\x59\xD8\xA2\x1A\xBF\x4B\x89\x94\x12\xBB\x53\x6E\x39\xFD\xBC\x6B\xFA\x5E\xCA\xA2\x80\x04\x98\xBA\x24\xFF\x88\xBD\x3E\x5D\x7E\xF7\xF0\x53\x74\x02\xC7\xB4\x1B\x72\x5A\xE7\x45\x60\x65\x15\xBB\x5B\x27\x16\xA4\x63\x94\xF5\x33\xD2\x79\x9D\x73\x72\x7E\x8C\x72\xBE\xE1\x55\xB6\x1C\xE5\x2A\xA1\xFC\x8A\x10\x2E\xBD\x9A\x13\xEF\x62\x29\x59\x95\xCD\x95\xC9\x05\x65\xAA\x5F\x06\x2E\xD4\x1F\x99\x07\x52\xD7\x55\x64\x58\xBE\x8C\xC9\x7F\xAB\xFD\x68\xAF\x4D\xC4\x09\x4D\x32\x1C\x71\xC6\x9B\x76\x47\x10\xEC\x52\xCB\xED\x67\x4E\x8A\x7C\x88\x5F\xC4\x7F\xEC\xF6\xE9\x86\x27\x0A\xF1\xA6\x55\x53\x62\x1F\xAF\xF3\x2D\xCF\xFD\x91\xB2\x93\x3E\x99\xE1\xF2\x70\x1C\xB9\x2A\x5E\xD0\x92\x0B\x16\xAC\x4A\xB4\x60\x55\xA2\x99\x55\x69\x53\x59\x9E\x6D\xC8\xA9\x23\x32\x0E\x5F\x0A\x1A\x74\x81\x0C\x19\x45\x3F\x31\x76\x1B\xCC\xC4\x6E\x37\xD5\x18\x0A\xA2\xBA\x63\x5C\x38\xD2\x08\x1E\x08\x02\x94\x31\x63\x7E\x1B\xF3\xA8\x29\x54\x12\x18\x84\xE8\x8D\x09\xC4\x7C\xD4\xD7\xE3\x09\xF5\x4B\x70\xB1\xAF\x70\x44\x79\x85\x96\x27\x3B\x81\x47\x03\xA3\xAC\xC4\x35\x3F\x4D\x1E\x81\xF8\xBB\x5D\x38\xCE\xEA\xE9\x96\x20\x1E\xCC\x24\x71\xF9\x38\xDD\xFE\xC6\x38\xAD\x15\xFC\xB3\x42\xC1\x8E\x18\xC6\x24\xAC\x6C\xD2\x02\x3F\xCD\xEB\x68\x1C\x68\x65\xB4\x82\x2E\xDE\x12\xA2\x17\x2E\x65\xE1\x46\x20\x0F\xB3\xED\x99\x39\x5A\x48\x5C\xDF\xA6\x32\x06\x72\xE6\x00\x77\x83\x0E\xEA\xCD\x03\x49\xDE\xA7\x23\xFB\xE8\x42\x06\xB2\x17\xF1\x1F\x5A\xBE\xA4\xB7\x7C\xF1\x5E\x30\x4E\xC3\x25\xD1\x85\x27\x90\xE0\x92\x51\x5F\x5F\x02\xB8\x0B\x8D\x27\xDF\xD5\x16\x05\x84\xF3\xC7\x4E\x3C\xA9\xF3\x8E\x32\x27\x10\x1F\x65\x5F\x6C\x49\xA4\x58\x36\xF6\xA0\xBD\x13\x62\x3B\x62\xE2\x1B\xDB\xF1\xB4\x69\x03\x3D\x22\x48\x94\x1B\x04\x99\xFA\x01\x22\x40\xB7\x6F\x54\x19\x24\x95\x84\x6C\x31\x09\x4E\x6C\x60\x4B\x30\x36\x81\x7C\x96\x04\xC7\xC6\x7E\xE5\xCC\x0A\xB0\x62\x6F\x58\x66\xDC\x82\x1A\xDF\x4E\x51\x78\x32\xAC\x63\xB7\x1B\xFC\xB3\x31\xE9\x2F\x44\x4F\xB1\x1A\x8D\x71\xD1\x17\x6E\xBF\xDB\x70\xA7\x0E\xE3\x2F\xA0\x68\x68\x6E\xE1\x3B\x7B\x0A\xC5\x24\x40\x36\x10\xDC\x15\xA0\xC8\x18\x98\x27\x62\xF6\x5A\xC8\x10\xD5\x8C\x3B\xD0\xD3\xCE\x73\x37\x73\x5A\xDE\x14\x70\xF3\x73\xBA\xE6\xDA\xA4\x1B\x1B\x08\x81\x1C\x8B\x43\x7B\xBB\xBB\x87\xC2\x03\x2F\xB4\xDB\xA7\x91\x20\xE7\xF6\x76\x08\x37\xEB\x02\x72\xF2\xEA\xCF\xAD\xF0\xAA\x7E\xC8\xB1\xA6\xA0\xA4\x3F\xBE\xF7\x10\xD2\xF9\xAE\x52\xEA\xEC\xBA\x5D\x85\x90\xBB\xAE\xDC\xD1\x54\xBA\xF8\xC9\x19\x02\x03\xDB\x26\xF3\x85\x1A\xDD\x61\x86\x90\xAE\xF3\xE5\xDD\x39\xBB\x8D\xBB\x7E\x6C\x62\xB7\x29\xC7\xF2\xA4\x69\x8D\xD1\xB1\x7C\xDD\x75\x02\x53\x0A\x3C\xFC\x39\x04\xA9\xD0\xC2\x06\x79\xB6\x1D\x2D\xA4\xFD\xF5\xB6\x84\x34\xF5\xB1\x95\x28\xE7\x7F\x8A\x4B\x6F\x3F\xC1\xC9\x5B\xC3\x06\x92\x2E\x82\x96\x71\x6F\xDC\xF4\xE6\x5E\x04\xF6\x00\x5F\xE6\x17\x81\x7D\x5E\x85\x47\xB4\x9E\x16\x81\x05\xFA\x89\x90\xBD\xB0\x4F\x49\x6D\x32\x4B\x0E\x2E\x92\x84\xC7\xF0\x45\xB4\x5F\xB4\x78\xEE\x4A\x30\x85\x90\xB1\x9B\xAE\x14\x33\xAC\x48\xD7\x8A\xFC\x93\xB0\x56\x50\xB0\xAD\xC0\x83\x92\x43\xF4\xC4\x23\x48\x8B\xEF\x11\x93\xC8\x14\xF1\x3D\x5B\xD0\x92\x0B\x48\xAF\x39\x5B\x26\x17\x94\xA9\x7E\x99\x0F\x21\x98\x21\xBE\x67\xBD\xB0\x6E\xCE\x45\x40\xF0\x95\x68\xE6\xEE\xF4\xE8\xBC\x6D\xEE\xA0\x6C\x61\xC9\xB0\x1B\x41\x4E\xBF\x7C\xA1\xEA\x58\xFF\x1A\x27\xB1\xA0\x72\x6C\xCF\xF9\xE2\xE1\xA8\x69\xC4\x34\x9A\x73\xDD\x68\x28\x82\x43\x02\x72\x93\x21\x36\x05\xD9\xD4\xB8\x4C\xB8\xD6\x31\xDD\x70\x25\xB4\xD2\x2D\xAF\xB0\x70\x68\x7D\x5E\x21\xA6\x05\xB5\x01\xC8\xA7\x61\x41\x33\xC7\xCE\x34\x74\xF1\x86\xE4\xDA\x7C\x61\x9F\x8A\xB7\xD5\xD9\xFE\xC5\x65\xD2\x0B\xF0\xA9\x41\xFF\x63\x52\x55\x92\x8E\xCC\x9E\xFF\xEE\x0B\x3B\x81\x55\x78\x54\x96\xFF\x92\x48\x5D\xE8\xDC\xB6\xEE\xB9\x46\xFF\xFE\xF8\xDA\x4B\xC9\x94\xDF\xCA\x69\x95\x82\xA4\x73\x3B\xF6\xE0\x98\x41\x64\xD9\x97\x90\x22\x02\xBA\xD7\x91\x7D\x65\xE3\x27\x1D\xD9\xB3\x8D\x3D\x3B\xDD\xAC\x10\x94\xFD\xF4\xB3\xD9\x69\x65\x0B\xA6\x9F\x2D\x98\x7E\x36\x3B\x7D\x84\xA7\x8C\x42\xDF\x22\x71\x73\x7E\x07\x0B\xBE\xE2\xE1\xBD\x0B\x0F\x68\x0F\xCC\x0E\xE4\xF7\x82\x05\x23\xF9\xA3\x60\xC1\x50\x3E\x13\xEC\x36\x96\x10\x52\xE4\x81\x42\x04\xA0\xE8\xC5\x6C\x1A\xD4\x40\xB6\x59\x67\xF6\x95\x1C\x84\x31\x9B\x81\x9E\xB0\xDF\x87\x8B\xC5\xD7\x83\x1E\x83\x0B\x29\x86\xD0\x13\xCE\x2E\x4B\xB8\x60\xF9\xC2\x05\xCB\x17\xCE\x41\x0F\x45\xE7\x0D\x1B\xB2\xF6\xCA\xA5\x19\x6C\xFC\xF6\x37\xE3\x69\xAB\xAD\xC2\x83\x73\x5A\xE7\x93\x45\xFB\x9F\xE2\x34\x03\x48\xF1\x58\x88\x9A\xAA\x60\x7B\x03\x48\x09\x49\x0C\xE9\x17\x09\x2C\x10\xA5\xDD\xCF\x45\xDB\xD3\x4E\x5C\xF0\x7E\x6E\xFB\xFD\x2C\x98\x1C\x45\x10\x6E\x56\xE1\xD3\x04\x3E\x21\xB9\x56\x11\x50\x7C\x0F\xE5\xDB\x7E\xCB\x1B\x2E\xEC\x04\x90\x93\x31\x3E\x1E\xE0\xFE\x0C\x23\x85\xAE\x23\x26\x0B\xA0\xCB\x30\x96\x14\x1C\x62\x16\xD2\xCD\x2A\x47\xCA\xDC\xD8\x73\x14\x1B\x18\x49\xC9\x08\xC9\x6A\xAA\x88\xD8\xB5\x1D\x19\x8A\x8F\xD1\x5B\x0C\x7E\x11\xCF\x90\xAB\x90\xFB\x49\x59\xD5\x99\x83\xB1\xB2\xA9\x4D\x53\x50\x70\x03\x83\xAF\x8A\xA3\x64\x44\x23\x37\xC1\x34\x0C\x7E\xF8\x3D\x30\x9B\x44\x1B\x89\x8D\xC6\xAD\xA3\x30\x15\x1C\x0F\x36\x45\xBC\x25\xB3\x80\x76\x6D\xC3\xC1\x47\x89\xC8\x36\x14\x74\xD5\xD0\x4B\x3C\x94\xF2\x2F\x35\x50\x12\x58\x06\x41\x10\xFC\x93\x5F\xFC\x45\xFB\xCD\xC8\x42\xF8\xA7\x9F\x7A\xA9\xB3\x72\x10\x1C\xD3\x8F\x82\x57\xC6\x4E\x12\x45\x52\xD6\x5E\xBF\x80\x7E\x04\x89\x5F\xFB\xFC\xD2\x49\x35\x76\xE7\x0E\x72\xA0\x3B\xC9\x14\x79\x8F\xEC\xC5\x74\xE1\x54\xF8\x38\xDC\x89\x3D\x08\xB9\x7D\xA0\xA9\x43\xE4\x52\xEC\xED\x1B\x93\x9A\xA4\x9D\xB0\x65\x51\x6C\x3C\x6D\x35\xE1\xF1\x8B\x3B\xCE\x2A\xB4\x2F\x98\x52\xB8\x61\xDC\x6E\x5C\xE9\xA4\xA9\x53\x5A\xC6\xDC\x81\x06\x79\x55\xB7\x87\x4E\xEA\x9D\xAC\x1D\x12\xE4\xB4\x65\x7D\x5C\x60\x65\x15\x7F\x6B\xFC\x26\x7F\xCB\x63\x89\x3E\x8F\xDF\x41\x5F\xA5\x8B\xF7\x07\xBD\xC5\xCD\x18\xD2\x77\x3F\x82\xBB\x75\xC6\x5E\x7C\xFC\xC2\x4E\xD0\x3C\x4F\x05\x75\x79\xA9\x5E\xF2\x37\x46\xF6\xA5\xB0\xD4\x2E\xC8\x3F\x25\xC0\x58\xFA\x21\x42\x56\xEB\x95\xD3\xB0\x04\xD9\x4F\x3C\xD2\x36\xF9\xE4\xDD\x48\x15\xA0\x74\x32\xDF\x4F\xFC\x13\x04\x39\xD6\x7D\x5B\xA7\x68\xE9\xAA\xBE\x94\x45\xBB\x29\x64\x47\xB7\x20\x6B\x5A\x75\x37\x8A\x2C\x90\x42\xCA\x03\xEC\xAA\x5B\x71\x7A\xDA\xF0\x3C\xA0\x32\x0C\xCE\x09\xC2\xDC\x32\xDF\x36\xA8\xC3\xB0\x8C\xA0\x9D\x41\x66\xB3\xFB\xEB\x91\xCD\x4E\x6E\xDA\x83\x5B\xC8\x2F\x19\x0A\x5C\x8C\xE5\x1B\x44\x7F\x4D\x53\xAD\x40\x51\x19\x18\x55\x19\xAC\xD8\xDB\x5D\x92\x5B\x28\x9A\x9A\x56\x94\xD6\x72\x85\x36\xED\x6F\x9D\xA0\xB8\xB2\x05\x73\x90\x45\x53\x8D\x60\x19\xFF\xAC\x40\x81\x54\x2D\x6F\x18\x1A\xE8\xF3\x2B\x43\xDE\x2E\x83\x11\x33\xBB\xC8\xC4\x22\xEF\x57\x40\xB8\x5E\x19\xC8\xAA\x10\x78\xCF\x72\x0B\x1B\xD5\x0A\xE2\x21\xC9\x75\x2B\x3C\x25\xD3\xD8\xAF\x6A\x47\x1D\xF2\x6C\x99\x49\xA4\x90\x27\x61\x83\xAB\x63\xB3\x97\xD5\x19\x4F\xB1\x69\xBF\x88\x02\x45\xDA\xD8\x15\x9A\x25\xCE\x21\x07\x83\x84\x13\x29\x82\x63\x61\x62\x3A\x61\xC8\x8C\xC5\x5B\x7F\x79\x2B\x99\xA8\x0F\xFF\x10\xB7\xFC\x7E\x64\xC0\x30\x21\x37\xCC\xA2\xD3\x10\x0F\x42\x84\xE0\x77\x9A\x81\xDF\x6C\xD6\x29\x12\x41\x36\x64\x6B\x59\x74\xE3\xB8\x7D\xE6\x9E\x3C\xA3\x1B\xB6\x18\x4B\x9F\x22\x96\x37\xA4\x73\x84\x58\x5E\x8A\x52\xCB\x2C\x2F\x7E\x09\xC2\x76\x31\xE8\x52\x1B\x5B\x67\x74\xC0\x20\x36\x9B\x17\xD1\x01\x60\xBC\x2A\x80\x0E\x18\x43\x07\x4C\x8A\x23\x26\x26\x97\x90\xD5\xFD\x5C\x74\xB2\xB6\xE7\xBF\x60\x1A\x8A\x94\xDC\x6D\x90\x3B\x60\xB2\xA7\x81\x96\x71\xD8\xD1\x1E\xBF\xEB\xF8\x28\x87\xF3\x6C\x05\xCA\x6C\xAF\x61\xE4\x49\x18\xE1\x3D\xDB\xBB\x80\x3B\x40\x9E\x40\xF8\xE0\x38\x19\x83\xF3\x82\xCA\xA6\x65\x7B\xC3\xB9\x73\x44\xF2\xA0\x3C\xDB\x8B\x3C\x4B\xD0\xF2\x2C\x2E\x47\x59\xE6\x04\x0C\xE2\x59\x9C\x78\xF1\x24\xD9\x96\xE0\x4B\x72\x42\x90\x8E\xA2\x33\x4B\x32\xE7\xB3\x58\x6C\x8B\xB3\xE2\x9C\x38\x8B\x7F\xE3\xC5\x7C\xF0\x90\xC3\x25\xA1\x54\xFF\xAF\x74\xB0\xF4\xB8\x9F\x05\x07\x0B\x6B\x53\xDB\x28\xF1\xFA\xCD\x33\x67\x4A\x9D\xBE\xAF\xCE\x8E\x70\x1F\xD7\xE2\x57\xD3\xDD\xFB\xCE\xCE\xCE\xE7\xEE\x6E\xAF\xE9\x3F\xF7\xFE\x8B\xF7\xFC\xE3\x6F\x78\xF9\x4B\x2F\xBF\xF6\x57\xEE\xBE\x04\xD9\x91\xAF\x7E\xF8\xB2\xBD\x36\x9E\xD2\xCD\xFF\x3D\x7F\xF5\xED\xEE\xDE\xFF\x9E\x77\x7D\xF0\x25\xDF\xB9\xF6\x2F\x7E\xEE\xEE\x8B\x17\x6B\x33\x43\xEB\xCD\x3B\xAA\xBC\xA3\xF5\xB9\x81\xFC\xDD\xB5\xB9\xE7\x96\x6F\xFA\xF1\xF7\xFE\xE8\xA6\x3C\x7C\xC9\x31\x61\xE6\x9E\xE9\xA3\xDF\x9E\xBE\xF8\x0D\xD9\xE1\x4B\x2D\x85\x5D\xD8\xD7\xA8\xEB\x6B\x64\xF8\x24\xC4\x93\x11\x52\x28\x60\xF4\xEE\x7B\xFE\xF8\xEF\x7C\xFE\x0B\x47\xBE\xEA\x33\xEF\xBF\x74\xB1\x36\x60\x2E\xB6\x06\x02\x60\x1E\x01\x03\xE6\x12\x45\x2F\xF7\xC7\xEC\x1D\x87\x1F\x75\xBF\x9E\x73\xF8\xA2\xFF\xB9\xFF\xF0\xC5\x47\xDB\x87\x27\xEE\xBE\x08\x23\x7B\x2D\x6E\xAE\x1C\xF9\xEA\xEF\x78\xFF\xA5\xDA\xF0\x30\xDA\x56\x8F\x56\xC6\x1D\x7D\x86\x4E\xE6\xF1\xA4\x0A\xAD\xB6\x21\xE4\xF6\x3F\x07\x8D\xFD\x80\xD8\x98\x54\x25\x51\xB9\x1D\xAF\x0C\x48\xEF\x39\xF0\x0D\xB7\xFD\xC1\xA7\x0E\xDD\x7A\xF7\x3F\xA5\x83\x94\xFA\xDA\xB9\xF0\x55\x3C\xC3\x10\xF2\x7B\xAB\x11\xF6\x79\xBA\x1A\x93\x5A\x3F\x84\x71\x63\x03\x18\x4D\x88\x0E\xED\x24\x1C\x76\xB2\x64\xB9\x27\xEC\x72\x70\x84\x30\xB6\xC1\xFA\x26\x12\xE8\xA0\x1A\xB5\xA0\x90\x82\x79\x14\x52\xC8\x27\xB5\x79\x33\x98\xC1\xEE\x43\x68\x49\xE8\x81\x72\xB3\x1E\xC3\x18\xA2\x13\x93\x7A\x0C\xE5\x04\xC6\x84\xF8\xF5\x92\x15\x0F\x4C\x20\xB6\xD7\x5E\x3E\x75\x90\xB4\x2C\x0F\x43\x59\x04\xB0\xEC\x0C\xC4\x2C\x4C\xED\xA7\x83\xD3\x20\x60\xB9\x0F\xF2\x39\xE4\xF6\xF6\x6F\xAB\xE3\x06\xE2\xD3\x55\x0C\xA5\x7D\x55\x53\x8D\xED\xED\x78\x82\x11\x1D\x18\x51\x28\x72\x88\xF1\x58\x5C\xED\x1D\x8B\x2B\xB8\x92\x2B\x30\x66\x9D\x2C\xE1\xE9\x08\x6B\xE1\xF1\xB1\x4A\xE1\xD2\x6F\xF7\xC1\xA4\x43\x3E\x08\x47\x50\xDA\x73\x0D\xC7\xF4\x1E\xE1\x19\x50\xC2\x68\xD3\xBE\x0A\xC5\xEB\xDB\x61\xB4\x59\x87\x10\x53\xFA\x92\xEE\x04\x18\xC3\x0A\xFE\x7F\x63\x82\xF5\xF1\x03\xD8\xDB\xC8\x9F\x23\xA3\xC6\x1E\xB0\xCF\x83\xDC\x06\xC7\x27\x38\xA2\x11\x57\x21\x7F\x57\x67\x2C\x37\x62\x0A\x38\x72\x1C\x17\x8C\x48\x48\x73\xD4\x6B\xC0\x19\x2F\x93\x19\x06\xF7\xDF\xD2\xC0\xB0\xA9\x47\x2D\x0D\x1C\x54\x1F\xB5\x34\x70\x96\x97\x26\x7B\x81\x98\x58\x6A\x17\x2D\x7E\x89\xA4\xDC\x21\x0D\x0C\x9D\xE2\x7E\xC4\x79\xAC\x88\x06\xF6\x04\xCC\x78\xD8\xA3\x98\x89\x3F\x3F\xEA\xD1\xC0\x70\x41\x13\x2E\x58\x40\x03\xE3\x05\x34\x30\x9E\x3D\x59\x38\x8C\x7B\xBC\x88\x06\xC6\xE6\x7D\x5A\xE8\x6D\xA7\x3B\x8A\x3B\xDD\x51\xC4\xBA\xA3\xD0\x09\x6B\xA9\x3B\x4B\x1D\x71\x27\xDD\x8B\xE9\x74\x47\x66\x37\xDD\x11\x1F\xD4\x0B\x54\x1D\xA9\x3F\x4B\xCD\x66\x65\x9E\x26\xDD\x91\xC1\xB3\xD4\x74\x67\x69\xBC\x50\x85\x64\x7A\x2A\x24\x73\x83\x2A\x24\x83\x5C\xE1\x42\x15\x52\xB6\x97\x0A\x09\x0F\x5B\x1E\x14\x2E\x78\xAB\x42\xEA\x20\xC9\x38\x15\x52\x46\x69\x16\x58\x85\x64\xAE\xAF\x42\x1A\x30\xFE\x1D\x24\xDD\xF4\x75\x35\xAD\x0A\xC9\x43\x92\x29\x03\x7B\xF1\xCD\x17\x76\x82\xF2\x8D\xE7\xC9\xD6\x1D\x0B\xDE\x33\x5B\xF0\xCB\x83\x82\x71\xC0\xE1\x52\xCB\xD7\xB0\xFE\xDB\x04\xD0\xFE\xCE\xF0\x37\x99\x2F\xF3\x4F\x0E\xA7\xBF\x1A\x80\xE0\x52\x8B\xBF\x88\x98\x98\x9C\x34\x53\xE5\x6F\x50\x8D\x87\xB4\x30\xDB\xC0\x1E\xF0\x74\x8F\xAB\xD9\xE1\x3D\xAC\x14\xE8\xF2\x3B\xC8\x41\x8B\x1C\x45\x22\xD9\xE5\x89\xFF\xA6\x66\xA4\x44\xC0\x16\xFE\x11\x84\x64\xAB\x83\x3F\x59\x90\x45\x0C\xA5\x9E\x3A\x5F\x24\x69\x5F\x4E\xDE\x04\x74\xED\x79\x90\x35\xC3\xF1\x01\x5C\xAC\x2D\xFB\x39\x8E\x6C\x7F\x94\xC3\x60\xC5\x07\x02\x51\x69\x5B\x92\xC2\x14\xE9\x07\xF9\xA7\x1C\xAD\x42\x9B\x91\x95\x99\xEB\x40\x18\xB2\x52\x3E\x58\x69\x4A\xE7\x09\xE1\xA4\x4A\x0C\x5B\x1F\xF2\x31\x0B\xD1\xA4\x4E\x21\xB9\x9F\x93\xD1\x78\x73\x41\x9F\x81\x86\x72\xFC\xA4\x90\x41\x72\x72\xB3\x2A\xB8\x5B\x32\x7A\xCE\x5B\x21\x28\x46\xF1\x82\x6D\xCD\x40\xD9\xFB\x1A\x32\xA9\x02\x6D\xEF\x6B\x9C\x51\x70\x79\x81\x8D\x4C\xA5\xDD\xB0\x6F\xDF\x06\x55\xBE\x06\x9F\x27\xA0\xC9\x02\x3D\x01\x45\x96\x3E\xFA\x85\x85\x20\xC2\x5C\x29\xBB\xED\x38\x6B\xC5\x96\xA9\x86\x0F\x43\xBA\x48\x1A\x3E\xAF\x53\x50\x4E\x03\x05\xE8\xE3\x9C\x3E\x2B\x39\x89\xFD\x92\xB5\xD5\x60\x91\xD9\x5F\xC2\x4D\x8C\x83\x82\x54\x31\xF6\x65\x9C\xA5\x38\xF0\x65\x21\x04\x90\x4F\xC8\xA6\x34\x05\x63\x03\x30\x9B\x10\x4D\xF8\xC0\x30\x77\xB6\x8E\x7A\x82\xD6\x81\x63\xAD\x04\x07\x10\x19\xC9\x4C\x7F\xEC\x0C\xEB\x83\x9E\x65\xB6\x0D\xCC\x06\xD9\x91\x22\x2C\xF1\x06\x3A\xD7\xAD\x80\x86\xC5\x8E\xAA\x14\xB8\x4C\x81\xDE\x1C\x1B\x0E\xEA\x22\x16\xF6\xF4\x5E\x21\xF4\xB6\x1F\x84\xB4\x6A\xEA\x33\x55\x52\x35\x77\x9F\xC8\xB6\xE9\xCE\x2E\x1D\x28\xD7\x98\xC0\x3F\xD1\x81\x20\xF0\xF7\x50\x74\x5F\xD3\x3E\xCB\x86\x2E\xC8\xDA\x67\xD5\xD0\xE5\x98\x7B\x1E\xD8\xA5\xF3\x9E\x60\x7F\x95\xA4\xDE\xE9\x33\xEC\x1A\xD7\xCB\x66\xA6\xF1\x8F\xA6\x40\x62\x35\x5B\x7D\x04\xE6\x21\x25\xE2\x6D\x90\x2E\x11\x8A\x1A\x4C\x43\xB3\x50\xCB\xB3\x8D\x7A\x13\x89\x59\x1D\x44\x99\xEE\x6A\xF2\xCA\x66\x6B\x35\x6F\xD0\x40\xE2\x7E\xFB\x2C\x1B\xD2\x48\xB5\xCF\x0A\x9F\xDB\x89\xC4\x8E\x55\xF7\x06\xF6\xEC\x99\x8F\x22\x3D\xA5\xFE\x68\xE8\x43\x21\xC5\x6B\xBC\xAB\x23\x7D\x4E\x9E\xF0\x31\x73\x50\x26\x9C\x1B\x76\x7F\xC4\xC2\x8D\x38\xE0\x11\xAB\x2F\x66\xC4\xA2\x3F\x62\x1E\xAF\xE2\xF1\x06\x4F\x62\xBC\x8A\x89\x1C\x04\xE6\xFF\x74\x61\xC3\xDC\x0C\xB6\x1B\x67\xC6\x2F\x6D\x3C\x25\x17\x28\xC7\x6C\x06\xAE\x6B\xD1\xCB\xC9\x42\xD5\xE5\xA0\x5F\x1B\xB3\xBF\x66\x5B\x31\x6E\xFC\xAF\xA8\xFD\x15\xB6\xBF\x74\xFB\x4B\xB5\xBF\x64\xD3\x7D\xC4\xFF\x4A\xF8\x73\x0F\xB6\xBE\x0D\xE6\xBF\x13\x6A\xDB\x05\xB0\x0A\x80\x00\x8C\x22\x2B\xA9\x4A\x10\xE0\x91\xFB\xB3\xDD\x6E\xCC\x7F\x54\x22\x62\xB3\x58\xB7\x56\xFA\xC5\x48\x01\xCF\xBF\xBE\x3D\x1D\x4C\xEB\x2C\xA5\xBB\x9C\xB4\x48\x9C\x83\x2A\x06\xCD\xF1\x7D\xD9\x9C\x3C\x85\xB0\x21\x6B\x78\x3C\x89\x77\xFE\xF0\x8D\x8F\x9E\x25\x5D\x0F\xA4\x1B\x90\xD9\x6B\x6F\xF8\x83\x4F\xA8\x13\x5B\x75\x38\x21\x57\x09\xBE\x39\x96\xEC\xCB\x4A\x2E\xAD\x3D\x73\x09\x44\x20\x50\x1B\x53\xF6\xE5\x11\xE4\xD2\x51\x87\x4D\x95\xF1\x26\x4A\x2B\x68\xB5\xA5\x0D\x20\x73\xA9\x7C\x22\x88\xEC\xCE\x1B\xFF\xE0\x13\xEA\x98\xFB\x82\xC3\x27\x57\x4A\xEE\x89\xAC\x2E\x76\xDF\xC4\x0F\x78\xA8\xE6\x9B\x57\x8D\x7C\x95\xE2\x7B\x22\x24\x2C\x78\xC8\x47\x47\xBB\x01\x48\x1E\x80\x6C\xD8\x6C\x97\x3E\x7D\x48\x06\xB3\xFD\xFA\xEF\xB6\xAE\x3B\x7C\x83\xC4\x7E\x29\x11\xF5\x4C\xB9\x8F\x02\x88\x50\x4C\x17\xF8\x47\xF6\xBA\x62\x5F\x5E\xFF\x9C\x34\x3E\xB6\x1C\x3F\xE7\x8D\xCF\x00\xE0\x83\x69\x12\xE1\x2B\x91\xF0\xF5\xEC\x16\x42\xF3\x29\x29\xD2\x1E\xE0\xE2\x21\xE4\x00\x57\xB0\x47\x9B\xEE\x72\x15\x9E\x9B\x72\x62\x75\x10\x55\x0C\x1C\xC1\x3F\x24\xDE\x3C\x69\xB7\x35\xBE\xA1\x6D\x25\x56\x24\xA3\x95\x71\xCD\x78\x2E\x73\x2D\xEB\xB4\x6D\x5B\x1B\xDF\xDA\xE5\x80\xA2\x84\x57\xC8\xED\x6A\x2B\x7B\xCE\x3D\x2E\xA9\x0D\x6D\x05\x99\x14\x71\x0C\x53\xFC\x8A\x80\x84\xBF\x92\xB8\xAF\xE0\x18\xC8\x2A\xCC\x7F\x62\x42\x16\x83\x75\x4A\x07\x95\xBB\x15\x20\x75\x99\x98\x3A\x3D\x01\xE7\x61\x44\x68\x4E\x2C\x07\x2B\x24\x43\x14\x94\x30\x19\xAC\xE2\x76\x86\x2E\xF2\xAC\x31\x8F\x0A\x3E\xA7\x44\x11\xD8\x37\xFF\xDB\x0E\x63\x5C\x7A\x87\x5A\x71\xB6\x78\x37\x73\x89\xE2\xE7\x06\xC8\x76\xCD\xF4\x84\xDD\x2C\x10\xF3\xAC\xA4\x88\x15\x92\x43\x9B\x68\x07\x63\xD6\xB9\x7B\xE9\xA6\xA6\xE8\xAB\x3C\x12\x6A\xE7\x1F\x11\xB2\x1D\xE8\x29\x10\x1B\x55\x9B\xA3\x31\x60\x0A\x68\x4E\x32\x01\xC3\x13\xDB\x67\x6A\x25\x2E\x24\x68\x73\xE8\x37\x94\x3A\xDF\x75\xAE\x1C\xF6\xB4\x9D\xD3\x68\xC8\xD5\x73\x83\x7C\xC3\xF9\xB4\x62\x72\x36\x36\xF6\x8D\xDD\xBC\xAD\x30\x9F\xD6\x04\x75\x1D\x2F\xA2\x91\x9A\x7C\x67\x57\xA7\x4F\x44\x28\xA5\x97\xCF\x43\xE6\xA0\x32\x72\xB9\xE9\x38\xAB\x17\x42\x22\x12\x1A\xBA\xB9\x02\x41\x57\x1D\x88\x3B\x29\xA5\xE7\xAA\x73\x46\xFF\xB8\xA9\xE3\xCD\xBA\xE0\x21\x37\x50\x40\x8E\x7B\xCD\xFB\x95\x22\x46\x19\x86\x42\xAC\xCF\xBF\xF6\x68\x92\x34\x55\x4A\xB8\x47\x97\x59\x09\x49\x4B\x74\xDE\xCF\x64\x33\xE3\xA8\xBF\x75\x8A\x10\x98\xD2\x17\x32\x90\xFC\x0B\xBF\x90\x6E\xD6\xC6\x7F\xC1\x30\xD8\xC7\xCC\x29\xC5\xDE\x39\xCF\xDB\x7C\x68\xEE\x87\x08\x4C\x8A\xDC\xD8\x36\xCD\xD3\x40\xEC\x90\xA9\x61\xA8\x81\xB4\x4F\xDC\xD2\x42\xD8\xC0\x6E\x43\x3A\x21\x2B\xAE\xF6\x32\xB5\x32\x37\x48\xDE\x4C\x8F\xBC\x65\x0D\xA5\x73\xCD\xDC\x2D\x06\xF8\xB0\xEC\x29\xE5\x5F\xF4\xDD\xBB\x2F\xF7\xA4\x9B\x3E\x79\xCB\x98\xBC\x19\x22\x6F\x19\xA7\xBC\xCA\xBA\x08\xEF\xC8\x15\x51\x7F\xED\x73\xD2\xD0\x72\xB7\xCF\x79\x43\x21\xC1\x17\x92\xB7\x4E\x74\x34\x3F\x26\x45\x72\xB3\x88\x5B\xEC\x93\xC1\x6D\x22\x91\xE2\xDD\xCA\x28\xB9\x72\x9F\xA8\xA5\xB4\x1E\x58\xDD\x41\xD0\xF5\x5A\x3C\x35\x42\xE6\xA8\x18\x31\x41\x9B\xB5\xF6\x3D\x6B\x88\x21\x71\x3D\x13\x83\xCE\x91\x42\xFB\x04\x8B\xA7\x82\xCC\xB8\x83\x92\x21\xAD\x3A\xEA\x88\x95\x16\xE7\x24\xF9\xCE\xF0\x5A\x15\xC1\x00\x79\x83\x8A\x62\x69\xA9\x2B\xB4\x78\x0A\xC8\xE1\xA9\x8A\x14\xE7\x34\x16\xCF\xC7\xFD\x39\x57\xC7\x97\x1B\x4A\x5B\xAF\x36\xC8\x8D\x29\x3E\xEB\xDC\x93\x20\xB9\x72\xE1\x08\x8D\x78\xA7\x8E\x2F\xD7\x8A\x89\xDE\xC9\x86\xB7\x91\xA2\xBB\x38\x6D\x7A\x7B\x32\x42\x7C\xB9\xEA\x48\x2F\x65\xC9\x31\x7F\x21\x54\xD2\x0E\xF1\x7A\x54\x84\xDC\xE1\x8E\x16\xD2\xF9\x44\xD3\x38\x5D\xFA\xB0\x2A\x06\x81\xCB\x5E\xA5\xA0\x58\x46\x23\x8A\x91\x32\x05\x88\x71\x22\xC9\xF3\x65\x70\xAE\x2E\x2E\x37\xF5\x08\x0C\x8A\xF7\xC5\x11\x78\x18\x46\x90\x6F\x5C\x39\x0B\x06\x46\x1B\x57\xCE\xE2\xEC\x4C\x37\xA7\xE2\x32\xE2\x72\x37\x27\xB7\xB6\x2D\x72\x38\x25\x0A\x70\x84\x37\x9A\x50\xF1\xF5\x1D\xA3\xC3\xB7\xB0\x1C\xF4\xDE\x90\xD0\xC3\x00\xE0\xFD\xAB\x1F\x11\x5A\xD0\xBC\xC5\xB9\x45\x5B\x33\xE6\x18\x67\xF2\x0C\xA2\x00\x2D\x26\x09\x12\x01\xEE\x56\x27\xB8\x08\x0E\x39\xA9\xAF\xF0\xA0\x79\xB3\x34\x44\x83\xAD\x7A\x82\x52\x53\xBE\x1A\xF4\x95\x0B\x10\xEE\x5C\xAE\xD9\xF3\x11\x22\x50\x27\x37\x11\x49\xEC\x59\x46\xB9\xB3\x03\x51\x0A\xB4\x79\x4F\x11\x46\xDB\xE2\x9C\xDA\x16\xE7\x0A\xAF\x94\x7F\xBD\xDE\xAC\xA3\x9E\x75\x0A\x47\x38\x77\x41\x0F\x8C\xFD\x7F\xFE\x65\x77\x26\xB6\xB1\x36\x90\xB4\x31\x6C\x23\x67\x4E\x2C\x9F\x0B\xDB\x61\x45\x73\x7F\x95\x42\x64\x5F\x2F\x49\xD5\x42\xE7\xC2\xD5\x80\xA9\x8B\x68\xAC\x2E\xDF\x4B\x7E\xD3\x6C\xD7\x1D\x21\x55\xF0\xC9\x5E\xB9\x56\xD8\xAF\x65\xF8\x53\x28\xED\xB6\xEA\xFE\x39\x90\xA7\x20\x45\xE9\x15\xF6\x5F\x87\x8C\x5C\x62\xC7\xEA\x30\x8C\xA0\x00\x89\x90\x92\x9F\xAB\xCB\xCB\x84\xA4\x50\xF0\x3A\x96\xC3\x75\x8C\x3B\x18\x29\x2F\xE3\x89\xD2\xC1\x88\x3B\x96\x47\xF8\x67\x44\x4A\xDC\x7A\x4C\x61\xFA\x2E\x53\xE0\x54\x08\x37\x71\x78\xBD\x50\x07\xD2\x85\x25\x9D\x19\xA4\xEA\x0D\x52\x82\xA9\x0A\x08\x69\x90\x05\x32\x14\xBD\x41\x8E\x60\x04\x72\xE1\x20\x47\x83\x41\xCA\xFE\x20\x9D\xF5\x64\x81\x7F\x8A\xE1\x20\x29\x9D\x0E\xA2\x54\xBD\xC4\x1E\xCE\xEC\x15\x77\xAC\x60\xAD\x93\x3C\x53\x2F\x37\xD5\x0A\xD5\x39\xD7\xD4\xAB\x84\x7B\xFB\xF0\x61\x5A\xDD\x42\x84\xAA\x7A\x16\x64\x2E\xCB\xFF\x7E\x3A\x53\xE2\xFA\xD9\xD8\xEC\xD6\xA6\x9E\xC0\x52\x53\xDF\xC6\x4C\xD2\x0A\x79\xAD\xDD\xEF\x8F\xE3\x93\x30\x81\x65\x3A\x4D\x47\xA4\x80\x29\x4E\x6E\xB6\x10\x8D\xD3\x54\x88\x9F\x0B\x26\xA9\xAE\x5C\x00\x79\x65\xE7\x72\x5D\x70\xFA\x51\x6A\x59\x29\xC8\x60\x15\x9E\x4D\x28\x59\x8D\x38\x65\x30\xC4\x8E\x07\x23\x89\x67\x1F\x2E\x61\x7C\xA5\xC6\x55\x74\xAB\x74\xB9\x2E\xD8\x2D\xBB\x58\x2F\x24\xF8\x4D\x85\xF2\x72\x03\xA3\x35\x19\xBC\x88\x0C\x0D\x51\xBA\x8B\x5D\x36\x48\x64\xF5\x38\x4C\x1A\x75\xB0\x41\x81\x50\xE3\x2B\x55\x8E\xF4\x69\x4C\x7B\xB6\x9F\x93\x3A\x93\x64\xCE\xF1\xB2\x41\x42\x0E\x05\x91\x22\xDE\xBE\xE1\xE6\x9D\xEA\xEF\x5B\xB7\x6B\x30\x6A\xEA\xD1\x66\xFD\x15\xFE\x7C\xF8\x0A\xD0\x30\xDA\xA8\x47\x44\xF2\x47\x24\x9E\xF8\xDD\x74\x7B\x3B\x46\xE2\x33\x26\xE5\x31\x12\xA8\x5B\x71\xB4\x31\x6F\xA7\x64\xA1\x0F\xE7\xD2\xC2\x1F\xDF\xCA\x70\x7A\x98\xD8\x06\xD5\x28\x27\x2A\xAB\xFC\xA3\x3A\x0C\xFB\x71\xCA\x05\x14\x14\x3D\x01\x46\xC8\xDE\xA8\xA6\x1E\x11\x0F\x3E\xE0\x77\xC7\x7D\x7E\x77\x4C\x43\x2C\x38\x99\x3B\x79\x4D\x17\x30\x6E\x08\x3F\xE6\x5B\x16\xFD\x96\x3C\x39\x17\x15\xE1\x16\x52\xDF\x91\x8D\x78\x2E\xCD\x40\x56\x65\x35\xD7\xB3\x70\x52\x13\x02\xBC\x5A\xB5\xDF\x92\x7E\x9C\xF4\x2D\xE5\xBF\xC5\xC1\xDC\x41\x0D\xBF\x65\xE8\x56\x03\xFB\xB9\xCD\x06\x70\x9B\x93\x06\x94\xDF\xDF\x63\x5C\x67\x3F\x52\xC9\xFD\xF0\x6C\x82\x04\x78\x76\xE1\xDD\x3C\x85\xA3\x45\x15\x9F\x48\x90\x35\x58\x91\xD9\x6E\x26\xA9\x56\x1C\x67\x7F\x6E\x8A\x83\x43\x6F\xC9\xCB\x9D\x4C\xCE\x83\x7B\x7D\xF0\xF5\x79\x5A\x10\x73\x0A\xA0\xD0\x9D\x05\xB2\xA1\x10\x70\xB4\xE9\x8E\x42\xC4\x2E\x14\x87\x64\x28\x1B\x41\x31\xC0\x9E\x62\x17\xEC\x29\xAE\x5C\x80\x7C\xE7\x72\x3D\xA2\x3D\x82\x14\x46\xA4\xBF\x74\x63\x93\xF8\xA7\xE7\xC2\xCF\xD7\xCA\x44\xA9\x29\xCD\x8F\x0D\xD6\xE4\x67\x2F\xBD\x76\x27\x58\xBA\xE0\x0C\xA8\x99\x40\x1F\x2B\x28\xFD\xF0\xDC\xDB\xC8\xBE\x5E\xB7\xF7\x1D\x63\x7C\xBE\xF0\x7D\x94\x7F\x1A\x4F\xCC\x4F\x68\x4A\x5A\xB5\x26\x2F\x3C\xF2\xDA\x9D\xC0\x3E\xFC\xEF\x2E\xEC\x04\x10\x95\xAF\xA7\xA3\xD2\xFE\xAB\xF3\x17\x76\x02\xFB\x5C\x2B\xDA\x1A\xE5\xF7\xF0\x9B\xAC\x2B\xF9\x5E\x2A\xF1\x8E\xED\x9F\xCE\x88\x5D\x6C\xF5\xA3\x1C\x04\xDF\xBE\xF1\x7B\xFA\xC7\x13\x9D\x36\xE9\xFD\x75\x68\x5F\x71\x92\x94\x7F\x88\x19\x9C\x25\xD3\x21\xBA\x42\x96\x99\x31\x06\x77\x55\xD0\xAE\x6A\xD2\x2F\xE1\x73\x40\xCF\x11\x25\x1F\x6E\xC3\xD5\x70\x95\x88\xDE\x70\x4F\x83\x20\x14\xC4\x3C\x8B\xB6\xBF\x53\x33\xFD\x9D\x72\xFD\x21\x5F\xAC\x3B\xBE\x38\x42\xBE\x59\x77\x7C\x33\x32\x19\x1C\x11\xDC\x3D\xF7\xBE\x7F\x8A\xBF\x7F\x8A\xBF\x7F\x96\x94\x8B\xA4\xCD\x55\xF6\x1C\xC7\xA8\xC0\xD9\xD9\x77\xE2\xF6\xB4\x49\x4C\xC8\x17\xD7\x4F\x91\x72\x46\x76\x7E\xA6\x36\x85\x08\x19\xDF\x0C\xCF\xF2\x7F\xF3\x68\x1F\xF7\x50\x48\x60\xEF\xE0\xA8\xE7\x95\xBA\xDD\x8C\x74\x20\xA4\x0A\x51\xA8\xCB\xEE\xAF\x8D\x7D\x80\x54\xCE\x11\x18\x0E\x70\xA5\xED\xE3\x01\x16\xBF\x65\xBB\x57\x4E\xA1\x86\x3F\x1B\x63\xF9\xF7\x3F\xD8\x2B\xC7\x93\xD3\xBE\xFE\x97\xA8\xC1\x13\x3F\xDA\x6F\xD1\x8B\x6D\x9C\xD9\x57\xF6\x3F\x7A\xF1\x75\x11\x56\xFF\xE4\xFF\xFB\xED\xB3\x1F\xB8\x7A\xE1\xEB\xF0\xCD\xD5\xBF\x3A\x32\xFB\x89\x9D\x2B\x9F\xD2\xF8\x6A\xE7\xA3\xFF\xFB\x2B\x07\x1F\xC1\x77\x3F\xFD\x1F\xFF\x7B\x7A\xF7\x93\x8F\xDD\xD7\xBD\x33\x7D\xD9\xD6\x07\x06\xD1\xCC\x08\x9C\x6B\x7C\x30\xA7\xC4\x6E\xAF\x53\xEC\x37\xC5\x28\xCE\x0B\xC9\xA0\x61\xF8\xCE\xE7\x0C\x6B\x8A\xF9\xE0\x14\x34\x19\xCE\xA6\x48\x89\xDC\xFB\x6B\x3E\x74\x3B\x1E\x85\x38\x63\x1D\x22\x58\xD1\x94\x35\x4F\x39\x6E\x28\x54\x05\xC4\x3C\x5D\xCD\xD3\xA5\x52\x45\x16\x03\x34\x55\xED\xA6\x4A\xE5\x74\xBE\xF1\x34\xB5\x9B\x66\xEC\x6E\x27\x1C\xF3\x46\x2F\xF8\x40\x8A\x1B\x8E\x9A\x89\x5C\x64\xEA\x59\x9F\xB3\xAC\x73\x24\x6E\x52\x55\x51\x2B\x31\x3A\x33\xD5\x8C\x0D\x8F\x6F\x7C\xDA\xB3\x53\xD5\x4A\x8A\x20\xDC\x6D\x38\x3C\xDD\x05\x13\xB8\xEE\x84\xE7\x96\x47\x2C\x5A\xCA\x27\x35\x55\x9E\x61\xDE\xCE\x50\xB4\x33\x44\xF9\x1E\x39\xF6\x4A\x22\x8B\xBA\xDB\xF4\x24\xC3\xBA\x66\x58\x97\x24\xDA\x93\x3F\x0A\x48\xC2\x0E\x4D\xD8\xD1\x96\x53\xE2\x83\xC7\xA9\xC1\x5B\xFA\xF5\x49\x12\xCE\xB0\xF8\x81\xAE\xD4\x80\x44\x51\x1E\x67\x14\xF7\x67\xE4\xA6\x12\xE3\x9F\x98\x66\x94\xE3\x8C\xD8\x51\x29\x60\x21\x0B\x14\xA4\x27\xE9\x10\x0C\x20\x2C\x7F\x81\x68\xE8\xAF\x1A\x51\x6C\x3B\xF1\xE5\xF7\xDF\x3A\xA4\xAD\xEE\xB2\x2B\xC5\x21\xBC\xE2\x24\x72\x0B\x61\xA7\x7B\x20\x12\x13\x31\x0D\xB2\xE4\x0C\xE1\xCA\xE8\x76\x78\x9E\xD2\x50\x4E\x1B\x7D\xC2\x87\x6E\x90\x83\x2C\x05\x84\xF6\x1A\x8F\x94\xEC\xFE\x3A\xC5\xF9\x46\x0D\x8B\x81\x79\x84\xA5\xB8\x3A\x29\xAD\x4E\xD4\xD4\x54\x29\x73\x95\x4C\x1E\x62\x05\x5C\xD6\x94\x96\x95\x2A\x60\xFD\xCC\xD5\xE7\x48\x35\x11\xEF\x49\xCE\x7B\x12\x35\xE4\x0E\x1F\x21\x4B\x8C\x4D\x33\x6A\x4A\x4A\xA3\xA8\x4A\x99\x77\x72\x37\x85\xB8\x00\x5E\x57\x02\x02\x3B\x3F\xCB\x39\xD8\x1D\xA4\x66\x0E\x52\x15\x81\x0F\x44\xF6\x41\xCA\x5E\x84\xD4\x54\x1D\x76\x82\x73\x8F\x73\x48\xFC\xE9\x9C\x1C\x75\xBE\x1F\xC1\xBD\x64\x81\x07\x7A\xB3\x46\xE1\x98\x4E\x2C\x62\x0A\x52\xCE\xF5\x7F\x1A\xA4\xBB\xF3\x52\xF6\xEC\x94\x62\xE0\xD2\xFA\x93\x89\xA4\x72\xC6\xAE\xA4\x11\x8C\xA0\xC0\x3F\x49\xFF\x84\x49\x7A\x27\x8C\xCF\xDE\xD7\x3E\xE7\x0D\x25\x78\xF3\x19\x0B\x39\x40\x93\x24\x01\x99\xED\x66\x29\x01\x3B\x22\x38\xC5\x90\x23\xB6\x25\x05\xCD\x7C\x79\x44\x5C\x71\xD4\xFB\x58\xCF\x15\xD3\xC1\x5E\xAE\xCC\xA2\x8C\xB1\x21\x92\xFA\x30\x08\xFD\xA6\x13\xB6\xA6\x8C\xAD\xB4\x7F\xB4\x57\x59\xBB\x57\x26\x4F\x28\x03\x39\x91\x80\x94\x49\x40\x95\xF3\xB6\xF2\x2E\xA4\xBC\x0B\x55\x9E\x53\x34\x5A\x47\x5E\x52\x47\x5E\xAA\xDC\xA7\x54\xAA\x13\x9B\xBD\x98\x42\x8B\x32\x74\x51\x17\x44\x42\x52\x22\x21\x7C\x9F\x4A\x81\xA0\x72\xFE\xB2\x30\x7D\x30\xC6\x46\x04\x1C\xB2\x8B\xAB\xF9\xCA\x0E\x7E\x0D\x4F\x25\xE3\xA9\x18\x6C\x8F\x02\x19\x7F\x21\x63\x22\x45\xA5\x12\x4B\x79\x3E\x99\x23\x69\x86\xBF\x86\xE5\x03\xC0\x32\xDE\xD0\x93\x20\x20\xF5\x92\x75\x15\x79\x90\xEC\xF8\xD4\x1B\x85\x36\x94\x08\x58\x81\x4B\x42\x10\xAB\x33\x55\x9B\xB7\x3D\xDB\x60\xCD\xCF\x09\xB2\x5F\x7A\x65\x53\x95\x1E\x0E\xEB\x51\x95\x03\x7B\x63\xA7\xC8\xA2\x50\xEC\xA1\x76\x29\xC4\x3C\x73\x31\x26\xD3\x10\xD9\xED\xFC\x28\xA4\x03\x8F\x62\x41\x79\x5C\x57\xC4\x09\xF3\x01\xA0\x7A\xB8\xDE\x96\x2B\x2C\xEF\x50\xBC\x2D\x97\x58\x4E\xB0\x92\x32\xAC\xB4\x6F\x06\x51\xB8\x4A\x77\xC8\xD2\x47\xFB\xB0\x36\xFC\x70\x0F\x0C\x66\x3E\x3D\x00\xBC\x99\xCF\x0F\xE0\xAF\x3F\x00\x2F\x77\x74\x60\xD8\xBE\x35\xA0\x48\x3D\x5E\x18\x48\xA0\x80\x18\xF9\x91\x9E\x82\xCA\xE1\x52\x8F\x80\xA7\xAC\x3E\x1C\x11\x15\x4F\xF9\x3E\x84\xCE\x9C\x36\x66\x07\x64\xC8\xB2\xAF\x93\x4B\x44\x66\xCE\x0B\x29\x49\x21\xB7\x50\x2D\xE5\xD5\x85\x4C\x37\x5A\x35\x61\x78\x99\xAE\xE4\xBC\x9A\x30\x6C\x25\xDA\xA8\xD3\x44\x84\x8B\xD5\x84\xFE\xBE\xA1\x55\x3D\x85\x97\xCD\xD7\x06\x10\xD8\xAB\xAF\xFD\xE1\x1F\x3F\x77\x48\x26\x10\x1C\xF9\x5E\xEC\xED\xE1\xF7\xBF\xE3\xD9\x94\x95\xCE\x05\x00\x97\xB7\xB9\x9F\x57\x83\x3B\xE5\x2A\x04\x47\x7E\xF2\x5F\x8B\x3B\x65\x3E\xD7\xF8\xEA\xE7\x3E\xFA\xA1\x87\x76\x6D\xFC\xC9\x61\xE3\x8F\xAB\x90\x94\x72\xDB\xE2\x9C\xDE\xB6\x0F\xA3\x70\xC1\xD0\x4D\x12\xFC\x95\x2A\xB4\xC2\xC5\xC3\x3E\xD7\x50\xE0\x7A\xB2\x5B\x91\xEC\x19\xCC\x78\x31\x2D\x02\x88\xAF\xB0\x59\x56\x7C\xA5\x4E\x20\xBA\x72\x0E\xC2\xF3\x97\x29\xD8\x21\x45\x88\x83\x04\x12\x2E\x8A\xB1\xE4\x01\x52\xED\x07\x9E\x38\x00\x49\x2C\xF6\x9F\x93\xC6\xED\x5F\xEC\x70\x4A\xEF\x1D\x38\x51\xC7\x13\xFB\x9D\xFC\xF8\xAD\x56\x1C\xAB\xD3\x49\xAD\x97\x48\xA4\x0A\xF8\x68\x25\xC3\xD7\xAE\xC4\x7E\x17\xF5\xF0\x3A\x16\xBA\x26\xF6\xBB\xE9\x47\x3A\xA1\x93\x89\x96\x3B\x77\xCE\xD9\xC0\x1A\x45\xDC\x90\xE7\x13\xE6\x6B\xB7\xB1\xCF\x97\x01\x8E\xF3\xEB\x9D\x2E\xBF\xC6\x91\xA7\x83\x42\x4A\x24\xE4\x82\x6D\xB3\x98\x0E\xF9\x86\x63\x1C\x70\x3C\xA6\x37\x1E\x41\xB7\xA6\xAF\x6A\x28\x2D\x24\x44\x57\x48\x37\xCF\xAA\xCC\x80\xB4\xB4\xBE\xDB\x80\xF3\xCB\xC4\x33\x85\xC9\xA2\x42\xBD\xA8\x90\xEE\x0F\xD8\x26\xC3\x7B\xDA\x65\xE6\xC7\x17\x6C\xAD\xF4\x5B\x4B\x70\x2D\xC8\x54\x01\x05\x25\x8A\xEF\xC6\x39\xC6\x38\xB9\x30\x95\xD3\xD6\x46\x57\x58\x28\x8F\xAE\xD4\x31\x84\x57\xCE\x81\x3E\x7F\xB9\x0A\x29\xF8\xDD\x89\x2A\x81\x18\x62\x2E\x8A\x28\x3B\x14\xD2\x4F\xB7\xB5\x29\x5B\xB8\x80\x1C\x6C\xAD\xA0\xAD\x55\x7E\x6B\x05\x6D\x6D\x34\xD9\x65\x1B\x95\xDF\xC6\x88\x5D\xF2\x05\xB1\x9E\xBC\x8D\x91\xB7\xBD\x22\x25\x61\xED\x06\xF2\xF5\x4E\xE7\x57\x27\xA4\x05\x1F\x16\xBB\xA8\x93\x12\x91\xD7\xF8\x6D\x43\x40\xCA\x06\xDB\x96\x82\xC0\x6D\xA3\x18\x5A\xE1\x15\xD2\x38\xA8\x6E\xDB\xDA\xFE\x68\xDB\x22\x88\x66\x0A\x93\x45\x85\x7A\x51\x21\x6D\x1B\x0D\x56\x41\xC2\xC3\x49\xCD\x9F\x2A\x8D\x5B\x16\x6D\xCB\x73\x6D\xFE\x68\xC5\x9B\x43\x8E\x2F\xCF\x97\xB4\x95\x7C\xE9\xE3\xF4\x21\x89\xC7\x46\x56\x05\xA5\x7C\x3D\x9B\xB1\xC6\xDC\xD8\x80\x77\x9F\xE3\xE2\x1A\x08\x37\x26\x9B\xB5\xA1\x20\x2B\x21\x64\xFC\x98\x6F\x42\x68\x03\x30\x90\x6F\x4C\x9A\x2B\xF8\x95\x8B\xD8\xE4\x1C\x84\x57\xCE\x43\xC4\x77\x09\xA1\xEF\x26\xA9\x0D\xB6\xDC\xA0\x6B\x85\xCB\x4D\x9D\x81\x39\xC5\x74\xF0\xCA\x05\x30\x57\xEA\x62\xE7\xF2\x49\xEA\x92\xFC\xCC\xBA\x2E\xDF\xCA\x5D\x16\xE7\xEB\x02\x1F\x7F\x98\x1E\xEB\x11\x75\x02\xA3\xCB\xB5\x01\x2A\x7F\x8C\xCB\x5D\xE7\x1A\xCC\x46\x43\x2E\xB4\x10\x02\x0E\x03\x27\xD0\xD4\xF8\xFD\x86\x22\x91\x24\x34\x80\x8D\x06\x42\x7C\x17\xE3\x3B\x3E\x4D\x5E\xDC\x89\xAB\xE1\x9C\x14\xC5\xAE\x62\xB8\xBF\xF3\x37\x21\xB1\xAF\x64\x1A\x7A\x9B\x75\x6F\x47\x97\xFD\x25\xFC\x49\xC8\x9A\x43\x6E\x6F\xAB\x96\xBA\xFB\xAB\x6A\x6F\xE6\x04\x23\x28\x2E\x5C\x3E\xDA\x66\x4A\x74\x41\xDD\x85\xB1\xBF\xD5\xBB\x50\x37\x3F\x97\xC4\x8C\xA7\x8C\xAF\x24\x66\x10\x6A\x14\x81\xFD\xD5\xCB\x83\x5B\x06\x41\x11\xCB\xED\xAF\x3D\xDA\xBB\x8F\x17\x84\x79\x1E\xC7\xD7\x64\xD0\xA7\xE0\xD4\xC6\x05\x35\xC9\x99\xF1\x94\x67\xDA\xBB\xC2\x94\x78\x21\x26\x84\x19\x24\x10\x37\x14\x90\xB1\xCA\x09\x5A\xAB\x82\xAF\x07\x47\xEC\xC4\x4A\x41\x2D\x4B\xD2\x11\xD7\xA3\xA6\x5E\x02\x6D\x03\x58\x82\x12\x21\x68\xC9\x06\xA0\x61\x09\xF4\xC6\x64\x93\x13\x5C\xE7\x7C\x6F\xB7\xD4\xD4\xCB\x54\x71\x19\x21\x61\xB3\x5E\xA6\x8A\xCB\x6D\xC5\x31\x64\x30\x82\x72\x93\xEA\x8C\xB0\xB3\xE6\x8A\x27\x6D\x06\x0A\x58\x82\x7C\xD3\x7D\x28\xEF\xBF\x43\x1E\xBD\x8A\xFC\x2D\x64\x8A\x58\x9D\x76\xB7\xC2\xC2\xEA\xD6\xD6\x60\xC5\xCA\x6A\x95\x82\xD6\x8A\x07\xAA\x7D\xD2\x87\x82\xA5\x2C\x1E\xD5\x32\x07\x1D\x8D\x61\x1F\xFE\xB9\xA5\xA9\x9E\x85\x62\xC5\x99\x6A\x3F\x5B\xD5\xBB\x1B\xC8\x67\x35\xF5\x12\x2F\x0B\x2D\x51\xCA\x99\x3E\x13\x48\xE0\x96\x76\x59\x68\xB6\xA6\xA9\x9F\x4D\xA3\x7D\x36\x2F\xCB\xB3\x69\xB6\xCF\x6E\x67\x9B\x12\xB3\xDC\xD6\xC9\x17\xD5\x19\x83\xF1\xEB\x61\x68\x3D\xB0\x70\x09\x22\xBF\x10\x11\x2D\x04\x2F\xF2\x7E\x9C\xFC\x08\x96\x71\x8F\xC4\x06\xDB\x3D\xA9\x17\x15\x0A\x67\x28\x70\x4E\xF8\xFF\x13\x93\xEA\x56\x50\xB0\x0F\xA5\x91\xEA\xD9\x56\x54\xCF\x82\x15\x97\xB9\xE9\x59\xB0\x7A\x12\xA1\xC5\xE6\x0C\x02\x34\x6B\xE5\xEF\x5D\x71\x76\x4B\x7C\xB1\x48\xB3\x2B\x91\x8C\xB5\x43\xD8\xAC\x23\xCB\x97\x6B\xDD\xA6\xC7\x64\x4D\x0C\xCF\xE6\x35\x42\x3A\xEB\x56\x65\x4C\xED\xC6\x10\x61\xBB\x31\xB5\x1B\xB7\xED\x96\xA0\xF4\x93\x2B\x79\x97\x21\xF3\xFB\x9C\x82\x81\xC8\xAF\x46\x34\x7C\xB7\x78\xFE\x24\x57\x3D\x0B\x39\xF6\x67\xC1\xAD\xEB\xAD\xA2\x42\xD1\xBD\xC6\x2A\x6E\xFA\x2A\xEC\xAB\x14\xC5\x46\x15\x96\x92\x20\x9D\x98\x54\x23\x0A\xDD\xC1\x86\xAC\x9A\xF3\x34\x83\x7E\x51\x11\x40\xCE\x9B\x9D\x83\xCB\x57\x51\x97\x4E\x90\x2B\x29\xAE\xAA\xA1\x3C\x2A\x63\x7B\xBB\x0B\x0F\x4F\x31\x9C\xEA\x68\x52\x97\xF6\xC1\x06\x4A\xD0\xA0\x6D\xF9\x00\x44\x93\x3A\x22\xBB\x56\x83\x6F\xCE\xE2\x9B\x08\x61\xF8\x01\x30\xF8\x66\xEC\x5E\x9C\xF3\x2F\xB4\x7B\xA1\x38\xB2\x3D\xE5\x18\x04\x33\xB1\x62\xBA\x69\x45\xF3\xC0\x26\x87\x1A\xCB\x71\xB2\x39\x8C\xDC\xD5\xEB\x8E\xA0\x24\xC7\x0B\x69\x07\x93\x0C\x67\x49\xC0\xE8\x61\x3F\xFF\xC8\x05\xCE\xB2\x62\x1F\xDA\xD9\x39\xB8\x41\x19\x83\xFA\xA4\x66\x1B\x64\xF9\xBD\x9C\xA4\xD8\xA5\xC5\x23\xF1\xA7\xFC\xB1\xF3\x1C\xC6\x79\x46\xF1\x6D\xC5\x4D\x1F\x81\x78\xD2\x23\xF8\x60\x14\x69\xBA\xC8\x95\xE7\xE2\x6D\x79\xAE\x8B\xC3\xE9\x82\xA3\x23\x05\xBD\xBF\xD2\xF6\x32\x0D\x26\x74\x83\x39\xD8\x0D\x26\xEC\x0F\x26\xF4\x63\x1F\x32\x50\x55\x68\xB7\x9D\x0C\x4F\x8B\xF4\x86\x57\x93\x7B\xD7\x15\xAF\xC8\x43\x70\xBD\x97\xEC\x82\xF1\xED\xF7\x70\x66\x61\x56\x9C\x76\xB6\x30\xEA\xF9\x32\xAF\x0C\xFE\x49\xAA\x1C\x34\x52\x9D\x02\xF8\x06\x6A\x04\x23\x48\x87\x04\x37\x42\x9E\x06\x0F\xE9\x84\x29\x4B\x42\xE7\x77\xC2\xE7\x37\xE2\x40\xE1\x70\x75\xB9\xA9\x57\xA8\xE2\x0A\x24\xB3\x15\x3D\x25\x29\xAF\xD4\xAB\x60\xCE\x41\x7C\xFE\x72\x53\x97\x54\xBB\x64\xD4\x2C\xA9\x76\xC9\xDD\x96\xB0\x7C\xA5\xDE\x07\xB9\xAB\x38\xF8\x7E\xBF\x22\x53\xAD\x08\x56\xDB\xAA\x83\x3E\x23\xAA\x1A\x71\x9F\x11\xEC\x5B\xFC\xE5\x7E\x2D\xBA\xEC\xE3\x93\x87\x83\x83\x0E\x16\x92\x6D\x4E\x23\x67\xDA\xC6\x2A\x9E\x11\x45\xF3\xAF\xC3\x2B\xB5\xE1\xEE\x2B\x73\x44\x10\x32\x97\xB4\x9E\xB9\x0B\x48\x5B\xE7\x30\x22\x96\x3E\x26\x0A\x42\x1F\x19\xC3\x18\x59\xB3\xF0\x4A\xBD\xDA\x95\x27\xD8\x67\xEE\xFA\xCA\xC1\x00\xBD\xBB\x5C\x85\x50\xE2\x59\x53\xB2\x43\x02\x7D\x5F\x9D\x69\xAA\x10\x92\xF6\xD3\xED\x10\xF2\x23\xA2\x5A\x75\x97\x8A\x21\xAC\xFA\x21\xAC\x42\xD8\x1B\x02\x59\xF4\x96\x60\xFC\x5B\x03\xE5\xE0\x2D\x59\xBF\xFA\x81\x18\xBF\xC6\xD5\x2A\xCA\xB8\xB8\x40\xEC\x18\xE1\x04\x35\x61\x05\xC7\xFA\x15\xB4\x2A\x21\x1B\x2E\x8D\xD8\xBE\x1C\x19\xC4\xF2\x8D\xAF\x26\xCF\x04\x72\xBA\xA5\x84\xBD\xA3\xA6\x0E\xC8\x74\x81\xA8\x64\x1B\x8C\x36\x32\x3F\x1E\x25\x11\x5B\xAB\x90\xE5\x86\xDA\x16\x37\x84\x4D\x37\x86\x51\x3C\x52\xBA\x6F\x20\xC3\x51\x3F\xE2\x98\x6D\x8D\xC9\xA7\x09\x87\xFB\x7D\xED\x70\x93\x5C\x21\xDF\x19\x91\xE7\x13\xCF\x79\x46\xAA\x09\xAF\x54\xA9\x15\x55\xE2\xE8\x06\x43\x0B\xCB\x0D\x6A\xA3\xB5\x4A\xA2\x48\x52\x08\x2B\xB1\xDB\xB0\xB4\x83\x15\x41\xD7\x5B\x3D\x58\x89\x68\x2B\xD2\xF3\xDE\xD8\xA5\x2E\xE8\x4A\x1B\x25\xDD\x51\x57\x4E\x9C\x48\xEE\xFA\x42\x58\xA1\x77\x28\xEF\x0A\xDC\x23\x41\xE9\xEF\x3B\x58\x89\x20\x6B\x3F\xDD\x0E\x01\x61\x65\xE4\x0C\x00\x23\x18\xF9\x21\x8C\xE6\x87\x20\xFA\xB0\x22\x06\x6F\x07\x03\x41\xEE\x33\xA7\x5F\x23\x2F\xAC\xEA\x8D\x36\xA6\x14\x2D\x11\xD3\x2D\xED\x81\x86\x97\x67\x3C\x47\x99\xE4\x19\x52\x6C\xA9\x33\xD5\x12\x0B\x42\x50\x36\x75\xCC\xB7\xFC\x81\x23\x4E\x82\x70\x59\xD0\x99\x5E\x0B\xC2\x65\xC1\x18\x2F\x20\x80\xA5\xA6\xA6\xEB\x74\xE7\xBB\x1B\x40\x06\x62\xB6\x22\x5F\xCD\x46\xA0\xAF\x20\xC3\x49\x2B\x88\xFC\x7F\xC8\x4C\x06\xD6\xD6\x54\x5B\x73\xB7\x1A\xE4\x95\x7A\x99\x67\x78\x79\xE6\xFB\xFD\x8A\x64\xB2\x86\x4B\xDA\x56\x1D\xF4\x39\x43\x9C\x96\x17\x7F\x79\x96\x38\x91\x48\x17\xC0\x78\x0E\x6D\x12\xF3\xE1\xB1\xC8\xE6\xC3\x3F\xB3\x21\x97\x0D\xCA\x8F\x12\xF4\x73\xB4\x71\xFE\x93\x7B\x9C\x39\x10\x04\x75\xC4\x3E\x42\x32\x40\xDC\x2C\x3F\xC2\x86\xA7\x28\xAB\x88\x03\x81\x70\x19\x84\x2B\xB1\x30\x32\x2F\x3B\xCC\x11\x93\x11\xDB\x77\x6F\x37\xA3\xE7\x85\x51\x14\x45\x01\xFE\x47\x47\x8B\xFE\xF5\xDE\x0B\x97\x09\x0C\xB6\xEC\xEF\x04\xC7\x5C\x60\xA9\x42\xE7\x89\xCB\x17\x06\x5B\xF6\x8F\x02\xCE\x3D\x11\x5A\x5D\x7E\x9C\x71\xF8\x40\xA0\x90\x0E\x23\xC6\x29\xC4\xDD\xC8\x1E\x3C\x56\xE8\x3C\x34\x33\x23\x31\x52\xF9\x7F\x22\xA0\x28\x56\x11\xC4\xF6\xF7\x82\xF5\x82\x53\x48\xB7\xDF\xE6\x6F\xF8\x2F\xFE\x8E\x7F\x52\xC3\xEF\x27\xDD\xF7\x29\x2B\x59\xCC\xF2\x57\x4C\x5F\x3D\xB8\x4E\x3E\x08\x1C\x69\x8F\x97\xF4\xE0\x31\xBE\x8E\xAE\x04\xD5\xF0\x3E\x49\x31\xE1\x3B\xE7\x64\xE6\x8A\xF7\x35\x1C\x8C\xDA\x40\x54\x44\x14\xEA\x12\xF9\x36\x8A\x1D\x48\x82\x36\x08\x88\x36\xEB\xB4\xCD\x52\x71\xDB\xE6\x8B\x8A\x90\x2F\x5E\x68\xB2\x47\x8B\x10\x62\xFB\xF3\xE4\x98\xC5\xF3\xEB\xAD\xEB\x70\x6E\x9F\x09\xD8\x9B\xCB\xAF\x61\x40\x43\xE3\xA6\x11\x35\x8D\xA8\xA9\xF6\x4D\x43\x7C\x0A\xF1\xE9\xF7\xFC\x53\x84\x4F\x7F\xE6\x9F\x62\x7C\xFA\x4B\xFF\x94\x14\xA1\xBB\xCE\xE2\xC5\xCA\xC9\x51\x38\x71\xB9\x92\x9D\x02\x6F\x00\x34\xA9\xFD\xB4\xFB\x3A\x07\x78\x8E\xEC\xCF\xF2\x04\x42\xDC\x60\x56\x0E\xF1\x64\x08\x44\x95\xA0\x0B\x84\xAF\x5A\xE7\x38\x18\x5B\x14\x63\x23\x24\xE3\x44\xAC\x98\x1E\x2D\x64\x1E\x3B\xEF\xA5\x08\x58\x7F\x01\xA9\x5B\xFC\xD0\xBB\x22\x0A\x8A\xFD\xE0\xB2\xCC\x85\x83\x12\xE6\xCD\x52\xDA\x50\xEE\xFA\x40\x20\xDA\x4D\x12\xFC\x6D\xB7\xA0\xAE\x8C\x5D\x37\x38\xAC\x35\xFE\xA4\x2C\x43\x1C\x8B\x4E\x40\x44\xCD\x0B\x86\x3F\xE5\x3E\x67\x09\x05\x1F\x7B\x2B\x1E\x24\x64\xC6\x98\x92\x29\x82\xCD\xCA\x37\x71\x6C\x3D\x79\x18\x99\x4C\xAA\x50\x0B\xF6\xE8\x3E\x10\xF8\x6C\xC2\x39\x39\x9B\x40\xC0\x49\x5D\xC2\x4A\xD0\x85\x98\xBD\xC5\xF7\xC8\x2F\x72\xDA\x89\x88\xF3\x87\xD4\xEB\x05\xD5\x84\x08\xCF\xC4\x9D\x07\x1B\x2B\x4E\x14\x1A\xA5\x88\x78\x93\x94\x66\x09\xAB\x37\xC9\x25\xB3\x16\xF6\xEA\xE7\x3E\xFA\x21\xAC\x01\x81\xF3\xCF\xE3\x54\x7C\x20\x36\x29\x5E\x1F\x95\x6D\x1D\x9F\x60\xE7\x29\x0A\x60\x27\x36\xAB\x14\xD7\xD9\xB5\x53\xF6\xA1\x37\xFE\xC1\x27\x14\x41\x3E\xB7\xE4\x82\x7B\x8B\x80\xBF\x4F\x23\xA1\x5E\xD6\x0B\xE5\xF3\x9C\xE4\xD2\xDC\x0C\x14\x12\x43\x14\x92\x8B\x51\x88\x02\xD6\xA5\x36\x7D\x59\x9D\x41\x66\x5F\x71\x12\x39\x5F\xD2\xD0\x7B\xB4\x40\x79\x53\x95\xBF\x78\xDE\xA5\x26\xB2\x3B\x1A\x54\xF9\x1B\xFE\xAE\x94\x56\x36\xC7\xC9\xAD\x52\x10\x21\x43\xA7\x19\x1E\xE6\x28\x6B\xF3\x3D\x0F\x8A\x6D\x21\xA7\x4A\x31\x56\x4C\x5D\x10\x02\xFC\x98\x15\x90\x6E\x22\x80\xDD\x47\x06\xC2\x96\x62\x53\x4C\x5D\x18\x24\x10\x36\x3B\x09\x31\xC4\x90\x1C\x6B\x6A\x71\x47\x10\x34\xF6\xBE\xA6\x8E\xB1\x1F\x44\xF4\xEC\xA4\xCF\xE8\x2E\xA8\x46\xEC\x6B\x08\xB6\x93\x26\x6F\x43\x56\x4D\x30\x13\x9B\x9D\xB4\xF7\x21\xF9\x26\x6B\x28\x3A\xF8\x7C\xE7\xD4\xB4\x6B\x45\x04\x94\xF4\xC6\x56\x9E\x81\x9C\x6E\xAE\x78\xA5\xD9\x74\xBC\x6D\x17\xDE\x11\x04\xED\x98\x04\x8F\xC9\x99\xE3\x86\x6D\x85\xA6\x57\x63\xEE\x25\xB5\xF9\x9B\x56\x83\x76\x88\xD7\xDF\xDD\xF7\xF7\x5C\x96\x82\xF2\x97\xF8\x10\xA6\x44\x0C\x9F\xF0\x37\x70\x81\x95\x1E\xAE\x4C\x2F\x2D\x83\xB1\x83\x74\x0E\x2E\x9F\x14\x69\xD3\x88\x6B\x0D\xD6\xAD\xDC\xB2\xA2\x7C\x0F\x07\x1C\x90\x6B\x32\xAF\x38\x41\x96\xCF\x6A\x6C\x7E\x7F\x55\x18\xEF\x37\x22\xCA\x0F\xFA\x3C\xF3\x86\xB3\x08\x95\x3F\xEB\x93\xAE\x70\xC2\x2F\x9F\x82\xCA\x9A\x86\x93\x0A\x0A\x67\xF3\x1B\x22\x0A\x1D\xF0\x89\xD6\xCA\x9F\x63\x84\xB0\x40\xAE\x66\x57\x83\x29\x05\xB2\x89\x20\x24\x23\xAC\x1D\xE7\xFB\x13\x42\xD4\x3A\xED\x51\x4A\x90\xEE\x7B\xAE\x9F\x0F\xF8\xCF\x2B\xFB\x4B\x3F\xFD\x1E\x79\x28\x08\xAC\x62\x1A\xAC\xBD\x8C\x1B\x1C\x08\xFE\x12\x59\x79\xEC\x09\x85\xEE\xE0\xCF\xF1\xE9\x50\x10\x18\x50\x10\x11\x7D\x77\x43\x97\x20\xCA\x9F\x71\xA9\x2D\x22\x50\xA0\xCA\x9F\xE6\xDB\xB4\xF2\xFF\xEA\xB2\xDF\xAE\xC9\x1C\x91\xF2\x1B\xF1\x9B\x55\xC4\x17\xD1\xDB\xCC\x3F\xC8\x33\xF6\x41\xB6\xFB\x17\x6B\x72\x95\x7D\x06\xC8\x5E\x2B\x45\x3C\xE6\x01\x40\xDA\x5E\xFC\x72\xF0\x21\x45\x6E\x94\x90\x51\xF1\xC9\xCD\x3A\x6D\x2F\x8C\x39\xD0\x84\x22\xB7\x4A\x7C\x7F\xE5\x53\x9A\xDE\xBB\x6B\x66\xDF\x5C\xF1\xEB\xAB\x17\xBE\x8E\xDE\xBA\xAB\x69\xDF\x58\xF3\xDB\x8B\xAF\x8B\xE8\xAD\xBB\x72\xF7\x6F\x43\x7E\xFB\xFA\x5F\x0A\xE8\xED\xB5\x6B\x6A\xEA\x2C\x25\x7C\xEF\x11\xD7\xF8\x6C\xDC\x55\x78\x7C\xD0\x45\xCC\x15\x1E\x77\x3D\x88\x29\xDB\x6D\xF8\xD7\x09\xBF\xEE\x02\x67\x24\x08\xD2\x09\x44\x95\x72\xC1\x31\x49\xDB\xC0\x26\x04\x20\xCA\xFF\xBB\xDB\xD0\x84\x56\xED\x40\xF0\x5D\x3B\xDD\xEE\x3D\x37\xB8\x80\x4F\x77\x06\x48\x3E\xBD\x11\xA1\xDB\x16\xEA\xC8\x7E\xE1\xAD\x7D\xED\xB2\x3B\x6F\xD6\x64\xE2\x2D\xD2\xA5\x4D\xA6\x1C\x72\x59\xF1\x51\x6B\x28\xF0\x6B\x39\x75\x5C\x0C\xE9\x3E\xB0\xCC\xD8\x7F\x76\x6F\xC1\xCE\xD9\x14\x5D\xC9\xD5\xA7\x51\xFE\x7C\x0F\xEA\xB5\x95\x8D\x55\x2F\xAF\x15\xBB\xFF\x2B\x1B\x1C\xA7\x38\xCE\xDC\x39\xB9\x32\xBF\xBC\xA6\xF8\xBC\x11\x76\x7F\x7C\x42\xAE\x3E\xC6\x67\x6A\x8B\x37\x39\x94\x40\x8C\xFF\xBF\x77\x82\x34\xF4\xF8\xC4\x2E\x35\xF5\x00\x77\x84\x3D\xE0\x95\x4F\x3D\xDC\x51\x3D\xDC\x51\x10\x12\x2E\x75\xB8\xA3\x5A\xDC\xE1\x64\xBA\xC0\x4B\x0D\x91\x7D\xE7\x27\x82\xAF\x09\x38\x90\x30\xF6\x8A\x27\xDD\x66\x9D\x30\xF6\x2A\x7B\x10\x12\x1F\x81\x24\xE2\xE1\x91\x65\x95\x43\x0D\x44\x8C\x08\xA2\x1B\x40\x0D\xE9\x50\x23\x7B\xB2\xA8\x51\x0C\x51\xA3\x98\x45\x8D\x62\x88\x1A\xC5\x0C\x6A\x14\x43\xD4\x28\x86\xA8\x51\x0C\x51\xA3\x18\xA2\x46\x31\x44\x8D\x62\x1E\x35\x8A\x21\x6A\x14\x73\xA8\x51\x0C\x51\xA3\x98\x41\x8D\x62\x88\x1A\xC5\x62\xD4\x60\xB7\x15\x46\x0D\x36\xCB\x8B\x09\x60\x88\xBE\xEE\x45\xA4\x16\xEC\x85\x78\x66\x2F\x6E\xC6\x5E\x18\xE3\xF6\xE1\x85\x64\xE1\xA6\x48\xDF\xA1\x5C\xE0\x3A\xC5\x86\x36\x5C\x61\xF3\x38\xC7\x49\x57\x0D\xAF\xBE\xDF\xB4\x04\xE8\xEE\x85\x37\x8D\xE2\xA8\xD7\xCA\xED\x1C\x1F\x44\x75\x6A\x25\xE3\xA1\xE0\xCB\xA1\xED\xA6\x2A\xC8\x32\x0B\x77\x2D\xF5\xBB\x46\xAE\x8C\x1C\x14\x16\x14\x65\xEE\xE1\xC0\x77\x49\x85\x12\x9D\x3B\x4E\xEE\xAF\x47\x6E\x85\x32\x18\xB9\x9D\x73\x81\x64\x45\x53\xEF\xD6\x90\xF6\x75\xE4\xD6\x81\x1A\xD2\x96\xEE\xD9\x90\x36\xBC\xFF\x41\xDA\xEB\x3D\x9B\x11\x24\xF4\x3F\x47\x40\xB0\x67\x33\x02\x91\x7E\x33\x82\x8E\x3D\x9B\xB5\xB0\xD3\x1F\x28\x82\xCD\x8D\xB5\x7C\x7C\xE6\xA3\x8F\xDF\xD0\x37\x19\xDA\xFA\xED\xB2\xBD\x9A\x21\x1E\x0A\x6A\xCD\x8D\x52\x84\xC7\xD4\x47\x93\x2F\x10\x24\x0B\x07\x92\x14\xF9\x86\x32\x13\xE6\xCE\xFD\xEA\x67\x03\xFB\x69\xF6\xBE\xA4\xC8\x50\x11\x05\x8A\x32\x48\xE4\x15\x47\x8B\x12\x74\x50\xDD\xFE\x6D\xB5\x68\x28\x01\x3A\xC7\x94\x9F\x27\x26\x11\x1F\x7F\xC0\x49\xB1\xED\x57\xDE\xD5\x06\xB4\x37\x1C\xE0\x08\x74\xB3\x51\x04\xF6\xC3\xAF\x1F\x5C\xF4\x46\x10\xE2\xA7\x28\x32\x0B\xCA\x27\x1F\x79\xA4\x77\x26\x3B\x12\x13\x40\x48\xE6\x88\x63\x97\xBE\x2E\xB0\xDB\xE6\xAF\x74\xB0\x50\x31\x24\xED\xB9\x66\x94\x26\x71\xC4\xC6\xB7\x14\x44\x3D\xE0\x45\x0B\x78\xD1\x38\xC0\x08\x89\x80\xFE\xBE\x5C\xBA\x95\x73\xB1\x47\x04\x9E\x8D\xE4\xC4\xB4\x49\x3A\x28\xDF\x81\x5B\x75\xD5\xEF\x80\x50\x47\x3A\x00\xE9\xB7\x67\x0C\xDA\xAB\x39\x21\xD0\xA2\xE6\x8C\x47\x7B\x34\x27\x34\x5A\xD0\x9A\xB1\x69\x8F\xC6\x84\x4C\x0B\x1A\x33\x4E\xED\xD1\x98\x50\x6A\x41\x63\xC6\xAC\x3D\x1A\x23\x4E\x2D\x68\x4B\xA8\xB5\x47\xD3\xC7\x17\x7F\xF6\xF1\x1B\xF8\x6A\xB6\xB0\x65\xB6\x47\x43\x46\x2E\x6C\xDF\x35\x35\xFF\x83\x14\xDB\xE2\x9C\xCB\xE1\x26\xAE\x40\x70\xE5\x5C\xAD\x8E\xC0\xC3\x97\xB1\x83\xCB\x36\x58\x93\x9F\xA0\xDB\x3A\x8E\xBD\xC4\x49\x12\x0F\x0A\xB1\x3D\x68\xE1\xEA\x93\x6C\xB5\x26\x1F\xA7\x06\x0F\xF5\x1A\xDC\x2D\xC4\x39\x06\xE9\x2B\x20\xAE\x9C\xAB\x75\xDB\x40\xD3\x27\x3E\xD9\x6B\x51\x4B\xBA\x52\xB4\x14\x49\xC4\xB5\xB7\x7E\x90\x6A\xBE\x0F\x7D\xB9\x96\x10\xA0\x44\x2F\x39\xAF\xEB\xEC\x90\x95\x01\x65\xDE\x2A\x38\xFE\x48\x80\xAF\x7F\x1D\x5F\x57\x42\x1E\xB6\xFB\x67\x6B\xBB\xFC\xEC\xEE\x46\x04\x51\x59\x4D\x5D\xD0\x1F\x44\xD7\x55\x4E\x23\x22\xF0\x5C\x9A\x6D\x89\xAF\x21\xA0\x18\x46\x73\x97\x9C\xC1\x98\x9A\x1D\xA2\xC4\xE6\xC1\x21\x99\x83\x3C\x12\xDC\xC9\x19\xC5\x29\xE6\x0E\x6D\x90\xF9\x31\x21\xE4\x36\xEB\x45\x14\x6B\x7F\x4A\x10\x2F\x2C\x02\xFB\x67\x3F\x30\xE3\x19\xD4\x8D\x6D\xBD\xBD\x3C\x9A\x1B\x91\xC6\x11\x69\xBE\x73\x53\x34\xBA\xF2\xC3\x2C\x46\x97\xBF\xDC\xE9\xB4\x73\x08\xDC\x58\xD8\x12\x65\x47\x6F\x21\x5D\xC2\x21\x6B\x50\x34\x08\x2B\xCF\xB8\x94\xCF\xAC\x6D\x2A\x21\x28\x7F\xC5\x45\x58\x78\xC3\x70\xCC\xC3\x81\xA9\x76\x60\x83\x2D\xD6\x6C\xF2\xC9\x3D\x01\x0E\xD3\x8A\xB1\x1F\x25\x07\x84\x70\x93\x47\x4E\x6E\x66\xD4\xB6\x4D\x09\xBA\x78\xE4\xB8\xDD\x3F\x28\x02\x79\x98\xED\xF7\xB1\x9B\xE0\x45\x45\xEF\x39\xA1\x67\x2B\xAC\xF4\x25\x1A\x82\x13\x93\xB1\xB1\xCA\x6A\x5F\x94\x73\x51\xD7\x6A\x3F\xB7\x0A\x6D\xE4\x4B\x56\x67\xAB\x00\x57\x89\x6D\xE2\x4B\x6E\x73\x1D\xA7\x36\xF3\x45\xCF\xC1\x22\x73\x27\x5F\xBA\xE3\x87\x6A\x31\x27\xC2\x51\x79\x85\xFC\x13\xF9\x5D\xAD\xC9\x55\xE7\xF7\x44\x01\xCF\x0E\x04\x81\x95\xD3\xF6\x67\xDE\xFD\x14\xDD\x4F\xDD\xFD\x1C\x4D\xCD\x8B\x18\x63\x85\x8B\x59\x65\x47\x2C\xF7\x3D\xD9\xCF\x1F\xA5\xC2\xFE\xE7\x6E\x0D\xBC\x6D\x0E\x85\x5D\xEB\x79\x90\x9B\x13\x6E\x8A\x07\x82\xA0\x16\x1C\xBE\x11\xBB\x9A\xC5\x0D\xAA\xC0\x74\x4B\x90\x3C\x0A\xC1\x9C\x7B\x9E\xF9\x49\x17\xF5\x28\xB8\x23\x08\x6A\x65\xB7\x71\xC0\xEF\x7C\x5B\x6F\xC0\x07\x08\xD1\xC9\x08\x92\x33\x75\xD9\x0F\xBD\xAD\x8F\x32\x2D\xDA\xD7\x0C\xD1\xB5\x46\xB4\xFA\xAE\xB7\x0C\xE6\x5C\x56\xBA\x23\x0F\xCA\x38\x73\x4B\xE2\x1A\x40\x1C\x9F\xD4\x0A\x34\x27\xDC\xA7\xD9\x33\x7B\xA0\x80\xC2\x9E\xE1\x0F\x59\x5E\xC5\x9E\x18\x90\x41\x96\x3F\xC5\x41\xC3\x0D\x84\xE6\xCF\x5D\x60\x96\x3D\x16\x9C\xDC\xD9\x5A\xA8\x9D\x5D\xFD\x5A\xCE\x80\xB1\x9C\x03\x63\x79\x62\xC2\xA9\x3F\x07\x90\xCC\xA5\x62\x00\xCC\x72\x0E\x98\xE7\x6B\x01\xD7\x1A\xC0\xB3\xAF\x35\x04\x69\x2A\x65\x93\x5A\x61\xD3\x93\x8D\x7D\x45\x73\x48\x26\x66\x85\x92\xB7\xE2\x62\xFD\x89\x98\x5A\x8D\x8C\x89\x19\xB7\x65\x82\x9E\xCB\xF6\xF9\x0B\x62\x3A\xAC\x70\x3B\x3D\x77\x9D\x3C\x21\xA6\xC0\x8D\x3E\x88\xEB\xD9\x69\xF8\x44\x9B\x31\x9E\x00\x44\xEE\x02\x20\x92\xF9\xBA\x79\x00\x19\xBC\x86\x29\x43\x6A\xD9\xC1\x8C\x7C\x21\x9F\x2C\x77\x05\x63\x0E\xA5\xB3\x0A\xD2\x6A\x10\x76\xDC\x94\xEF\xC3\x0E\x90\xB8\x8A\x03\xC1\xD8\x43\x2F\x35\x3B\x24\x4B\x03\xC1\x91\x87\xD8\x9E\x3B\x71\xD0\xEF\xE3\x88\x38\x55\xE5\x7F\x51\x42\x6F\xB3\xDD\xA7\xB2\xE9\xCB\xBC\x37\x12\x41\xDE\x1E\xD0\x0E\xA1\x0D\xD6\xC9\x86\x60\x21\xD0\x83\x86\xC8\x29\x3A\xFC\x3C\x34\xC3\x7E\xB4\x10\xF6\xA3\x0E\xF6\xB5\xCF\xFC\xAD\xF1\x08\x38\x3E\xA9\x35\x44\xC7\x9C\xF6\xB1\x07\xFB\x1A\xA2\x17\x92\x07\x8D\xF6\xB0\xEF\x7D\x0D\x75\x0B\xFE\xDA\xB0\xF9\x24\x13\xF7\xDC\x45\x85\x38\x24\x13\x76\x44\x13\x1C\x65\xF3\xB8\x23\x0E\x6C\x52\xE0\x9C\x3F\x43\x1F\x86\x61\xDB\x05\x06\x38\xD7\x30\x51\x0A\x7C\x75\xBA\xBC\xE2\x53\x47\x34\x14\x00\xCD\x29\xE9\xE9\x56\x3C\xC0\x97\x14\x58\x88\x5C\xA9\xF9\x12\xF8\x2C\x9B\xF0\x92\xDF\x6B\x2F\x10\x9A\xA0\x40\x68\x6C\x71\xAC\xD9\xD7\x34\x6C\xEC\x37\x37\x55\x80\x1D\x1C\xC1\x0E\xFE\xF4\xFD\x3F\xF6\x8B\x5F\x43\x26\xFA\x76\x7F\x33\x5B\x52\xCE\x95\x24\x73\x25\x2F\x61\xA3\xEF\x07\x9B\x5A\xDB\x98\x64\x18\x73\xBF\x70\x39\x80\x1D\x61\x68\x17\xA2\x72\xD9\x78\x5D\x9E\x75\x9F\xCE\x3B\x3B\x55\x90\x15\x20\xFB\x72\x93\x97\x09\x16\x1E\x2D\x82\x5C\x1B\xD3\xB9\x2A\xA4\xEC\x01\xB8\xDD\xD4\xC2\x19\x77\x13\x1F\x75\x55\x08\xBD\xEB\x39\x20\x77\x21\x4B\x0E\x2D\x1C\x2D\xAA\xBD\x0B\x2E\x92\x9E\xB1\x57\x2E\xBA\xFB\x1B\xA5\x9C\x16\xC6\x1D\xF1\xDA\x0F\xD8\x85\x80\xD2\xEC\xF2\xD7\x0D\xD8\x19\xE1\x2A\x1C\xB0\x1A\x04\x4A\x44\xF8\x26\x92\xA6\x1A\xBB\x7D\xDA\xDE\xFE\x00\x1F\x3D\x3F\xE4\xC2\x27\xEE\x49\x48\x3B\xEA\x59\xCB\xF9\x11\x8B\xE1\x88\xE5\x8D\x8F\xB8\xB5\x17\xA6\x11\x0F\x96\x78\x76\xC4\xE6\x13\x78\x6A\xCD\x19\xE0\x78\xC4\xD6\xBB\x20\xB6\x36\x2E\xCE\xC8\x62\x2A\xE5\x5E\x2F\xA0\x52\xE1\x0B\x09\x46\xFA\x54\x2A\xB4\x08\xCC\x3D\x2A\x25\x29\xF4\xE9\x22\x3A\xC5\x7D\xCF\x30\x56\x44\xD0\xB7\x40\x23\xE9\x75\x3A\xA3\x96\x72\x7D\xE6\x6F\xC0\xEC\x68\x62\x7C\x30\x39\x26\x12\xC4\x96\xF7\x17\x74\xF3\xFC\x79\xED\x91\x54\xD0\x9C\x5A\x4B\x10\x84\x2D\x8D\x5C\xCF\x66\xDD\x9A\xAB\xD3\x95\x31\x45\xF9\x63\x93\x73\xE1\x6C\x4F\x84\x95\xDE\xA6\x7D\x63\x52\x0B\xA6\x84\xFE\x50\xE3\x93\xB0\x7F\xF4\x6B\x47\x08\xF9\xDC\xD7\x33\xE7\xBE\x9E\x3B\xF7\xF5\x89\x09\x79\x90\x0F\xCF\x7D\x2E\x95\x83\x73\x5F\xCF\x9D\xFB\xF3\xB5\x80\x6B\x0D\xCE\x7D\x5F\x6B\x78\xEE\x73\xA9\x30\xC3\x35\xE9\xB4\x11\x21\x2F\x47\xD8\x2E\x47\xD3\x2D\x87\xD8\x6D\x39\x6E\xCA\x5A\xCC\xF2\x40\x7E\xA4\x37\xB2\x16\xE2\x86\xD6\x62\x96\x07\xA2\x52\x96\xCF\xD3\x93\xA0\x1D\x0F\xD4\xBF\xB2\x34\x1F\x09\x5B\x7A\x4F\x91\x63\xED\x88\x79\x48\x9B\x4F\x8F\x12\x13\x29\x08\x02\xED\x6D\x38\xD5\xF2\xB7\x5A\x6E\x52\x80\x2C\x7F\xBB\x45\x12\xA2\xDA\x10\xF0\x45\x0A\x13\xDB\x17\x92\x3C\xA5\x40\x6F\xD6\xBA\xFC\x4F\x4E\x4F\x1E\x30\x39\xD2\xCD\x21\xA9\x77\xB5\x3E\x12\x76\x3F\x7E\x6C\x94\x84\xA9\x54\x81\x16\x51\x4A\xC6\x66\x27\x2A\x9D\x93\x4B\x61\x78\xA2\x88\xF0\xCF\x7A\x11\xD3\xEE\x52\xE4\x91\x69\x45\x16\x12\xEA\x28\x16\xE2\x88\xB6\x4F\x73\xA1\xA6\xC2\xC8\x8B\x07\x1C\xD5\x00\x3B\xE1\x28\x06\x0A\x19\x16\xCD\xFE\x83\xC1\x7A\xDB\x5F\x76\xAA\xD6\x47\x41\xDB\xF0\xD8\xD6\xB4\x65\x18\xFC\xB1\xB8\x4A\x34\xBD\x7C\xD4\xDF\x3D\xE1\x53\x9F\x31\x6E\x37\x8A\x20\x8B\xA6\x6C\x11\xCC\x78\x1B\xF9\xA0\xD0\xBB\x1C\x14\x7A\x86\xE3\xD6\xB3\x1C\x77\x38\x03\x6D\xE1\x1C\xB4\x85\x27\x26\x14\xCD\x79\x08\x6D\x5C\x3A\x84\xB6\x70\x0E\xDA\xE6\x6B\x01\xD7\x1A\x40\x9B\xAF\x35\x84\x36\x2A\x65\x03\xC5\xF4\x24\xF2\x2A\xAF\x68\x50\xDE\x27\xD7\xB8\x35\x19\x90\x4C\x62\x05\xC3\xC2\xAD\x3D\xAE\xAB\xBF\x42\x03\xD0\x32\x8E\x00\xD6\x81\xDD\x01\xA6\x81\xE4\x1E\x6D\xAF\xC2\x56\x45\xB7\xED\x2C\x63\xE3\x13\xD6\x45\x46\xD6\x98\x4F\x46\xBB\x1D\x02\xED\xC5\x38\x2D\x9C\x00\xB9\x59\x8B\x17\xFA\x1B\xEC\xA2\x3D\x27\xC4\x2E\xE7\x84\x3B\xC3\x77\x3B\x27\x88\x0F\x84\x29\xCE\x72\x70\x4A\x88\x17\x52\xF4\x92\xFE\x29\x21\x66\x4F\x09\x3E\x23\xC4\xF0\x8C\xA0\xDB\x0A\x64\xC0\x25\x48\x64\xC1\x45\x83\x0C\xD1\x3A\x71\xA8\xEC\x6A\xCA\x7C\x19\x47\x9B\x6D\x79\x0B\xDD\x50\xB2\x2F\x08\x71\x6D\x98\x6D\xF5\xC6\xAD\xA7\xD8\xD5\x80\xDD\x15\x8E\x4F\x2A\x66\x4B\x81\x5A\x54\x92\x7C\x9A\x85\x95\xC7\x0B\x41\x5C\x44\x25\x38\xAE\x84\xF6\xF1\x1B\x90\x1D\x71\xB6\x58\x64\x9C\xF7\xD4\x56\x6B\x20\xFA\xF2\x62\x91\x34\x33\xCF\xFE\xCB\x9E\x66\x8C\xD3\x75\x0A\x10\x10\x1E\x9F\xD4\x02\xE4\x9C\xD8\x2B\x40\xB2\xD8\x2B\x88\x67\x66\xEE\xFF\xD6\xDC\x65\x38\xA1\xA2\x9F\x62\x3D\x00\xAB\xBC\x73\xE2\xF3\x17\x63\x61\x38\x83\x85\xCC\xB4\xB1\x4B\xBB\x8F\xC6\x50\x8B\x19\x4C\x14\x73\x98\x28\x4E\x4C\xD8\x9A\x6B\x80\x89\x5C\x3A\xC4\x44\x31\x87\x89\xF3\xB5\x80\x6B\x0D\x30\xD1\xD7\x1A\x62\x22\x95\xB2\xE1\x5E\x8A\x70\xC3\x74\x7F\xF7\xF9\xE2\x66\xF3\x49\x49\x4C\x79\x1B\x70\x82\x84\x24\x64\x4C\x92\xBE\x79\xAA\xF9\xB5\x4C\xE8\x45\x18\xE6\xE8\x37\x59\x88\x51\x77\x49\x43\xC1\x90\xDC\xED\xFF\x0B\x3B\xC6\xFE\x7A\xD4\x6F\x8E\xE4\xB1\x62\x8E\x3A\xA5\x63\x03\x7F\xDF\xE6\x02\x44\x12\x11\xD9\x74\xB4\xE3\x8B\x46\x60\x7A\xBD\x80\xD1\x13\x2D\xA3\x57\x0C\x51\xB8\x18\xA2\x70\x71\x63\xC2\x36\x71\x36\xDD\x71\xB7\x26\xF7\x8F\xD2\x40\x48\x15\x04\x81\x08\x78\x1A\x14\xBE\xDD\x99\x50\x3E\x75\x7A\x44\xD1\x63\xF5\x6E\xB3\xEA\xD8\xD7\xD1\x90\x7D\x1D\xCD\xB2\xAF\xA3\x5D\xD8\x57\xB1\x80\x7D\x05\x41\x9C\xB9\x95\xC8\x40\xDA\xAB\x07\xAB\x00\x4F\x6D\xA6\xEA\x1F\x73\x16\x53\x82\x90\xA3\xDB\x39\xAE\x16\xFA\x99\xB7\xF1\x3B\x6F\xA4\x0D\x8E\xC0\x9B\xA7\x72\x99\xEE\xF5\x73\x83\xDD\x10\x1F\x2E\x86\xDD\xA8\x19\xB3\x96\xDB\x9C\x7E\xA1\x6D\x4D\x10\x0D\x0C\x86\x11\x99\x92\x97\x9F\x61\x96\xA0\x63\x74\x36\x0F\x75\xBA\x60\x62\xE3\xF7\xC6\x80\x39\xF8\x3F\x5A\x28\xBB\x73\x35\xA8\x48\x8D\x40\xA6\x07\x92\xBD\x18\xC8\x70\x45\x7F\x63\x21\x3D\x1E\xD0\x5E\x53\xF7\xBB\x13\x36\x17\x9E\x96\x23\x51\xCE\xE1\x19\x0D\xFA\x1B\x69\x02\x0E\xD9\x9E\x6E\x8C\xDA\xEB\x50\xBC\x31\x8C\x12\xA6\xD5\xB8\x5F\x0D\xB6\x38\x5E\x27\x3B\x2B\x7B\x75\x50\xB8\xE9\xB8\xD0\xD0\xCD\x0D\x58\x2D\x43\xBC\x26\xC8\xF2\x77\x69\xD8\x8E\xE1\x10\x9E\xE1\x08\x91\xE1\x40\xC1\xE0\xEA\xC5\xC1\xF6\x3D\x09\x0D\x35\x7E\xBF\xFC\x55\x76\x00\x13\x55\xCB\xD4\x40\xE0\x6E\x06\x3A\xBA\xFA\x29\x2D\xC2\x79\x23\xC1\x4E\x31\x82\x6B\xFC\xA6\xB7\xCD\x78\xF2\xD2\xC6\x7C\xF8\xDF\x0E\x62\xD1\xAB\x27\x47\x67\xEB\xB0\x85\xB4\x80\x34\xE7\xDC\x9C\x78\xF9\x7B\x0B\x76\x82\x50\x20\x8E\x95\x7F\xD0\x9A\x18\x3D\x8D\x50\x21\xE7\xA0\x42\x0E\xA0\x42\x3E\x29\xA8\x08\x69\xF4\xA2\xFC\xA1\xBE\x04\x92\xA0\x80\x2C\x0E\xC9\x84\x44\x65\x8A\xC6\x90\xBE\x8C\xA2\xDA\x91\xEE\x72\x8F\xC9\x41\x04\x7A\xDD\x91\xD5\x45\x4A\xCE\x10\x34\xF1\x68\x73\x4A\xCE\x70\x21\x97\x13\x0E\x95\x9C\x14\x39\x4B\x93\x72\x5F\x43\x38\xC7\xE5\x68\x08\x99\xCB\xD1\x14\xF4\x7E\xC0\xE5\xB8\xA2\x8E\xCB\x41\x29\xD6\xF4\xAD\x48\x95\xF9\xB8\x1A\x70\xC7\x7A\xA8\x22\x09\x77\x99\x74\x68\x5C\x08\xD9\xC5\x3B\xEA\x5E\x2F\xD8\x51\x22\x91\x7A\xB0\xA3\x91\xD5\xA0\x67\x54\x24\x7A\x77\x15\x49\xE8\xF4\xB4\x4E\x92\x57\xDE\x7A\xC0\x29\x36\x54\xA7\xD8\x90\x3D\x49\x5E\xB6\x92\xBC\x64\x49\x3E\xEC\x54\xF5\x43\xD6\x4E\x31\x77\xFC\xE5\x23\x5D\xC9\x56\xBA\x22\xD9\xAA\x23\x1F\x3F\x35\xBC\x81\x78\xBA\xB7\x36\x9C\xDF\xDA\x70\x76\x6B\x77\xDB\x58\x8E\xBC\x52\xFE\xE6\x79\xF6\x1C\x6B\xA7\xF0\x63\x4A\x86\x9D\x87\x20\x0C\x78\x4B\x72\x6D\x22\x45\x83\xCB\x4E\x23\x76\x39\xE8\x84\x3B\xE8\xE8\x7C\x13\x08\x34\x91\xDF\xDE\xF8\x68\x41\x8A\xE6\xA3\xEC\xF2\x41\x1C\x82\x70\xD6\xA9\x9A\xCF\xD3\xA0\xB1\xD9\xBD\x84\x75\xAC\x2F\x04\x51\xFE\x3A\x9F\xEA\x28\x44\x1C\xBC\x2B\x48\xA8\x3A\x69\xC3\x11\xFC\xD4\x21\x79\x1B\x28\x2B\x0F\xC9\xFD\x6C\xBE\x26\x6C\x00\xC1\x66\xF9\x9F\xCF\x3B\xE7\x62\x84\x3F\x45\x54\x16\xC7\xA3\xD6\xE4\x6D\xED\x78\xAA\x18\x9F\x4B\x36\x85\x48\x4F\xB9\xAB\x07\xB2\x3A\xA3\xCA\x51\x63\x1F\x6C\x58\xFF\x92\x82\x98\xD4\x74\x73\x4D\x10\xE1\x3A\xB8\xBF\x76\x22\x9E\xCD\x40\x50\x48\x38\xF6\x2B\x3C\x57\x27\x14\x91\x39\xD8\x28\x04\x24\x47\xE0\xE1\xCB\x96\xBC\x70\x38\xDA\xCE\x37\x92\xCF\x05\x29\xA4\x58\x3E\xD4\x83\x96\xCE\x8A\x21\xB9\xCC\x92\xA5\x3F\x57\x25\xDD\xC1\x6F\x53\xCE\xA7\x2E\x13\x9B\x36\xD7\xD4\x62\x69\xC0\xEF\x17\x82\xD5\x85\x77\x0C\x4E\x2D\x39\x7F\x6A\xF9\xFD\x5C\x70\x62\x89\x4E\x2F\xE2\x4F\x2D\x31\x7B\x6A\x49\x97\xC9\xF2\x18\x8B\xDF\xAB\xC0\x4E\xAB\x3D\x13\x81\x35\xE9\x0E\x7D\xF1\x5C\x99\xDC\xC9\x6A\x87\xF6\x06\x0F\x7F\x8C\x49\x9D\xEC\xE3\x60\x13\x2C\x44\x20\xFD\xF9\x17\x81\x74\xE7\xDF\xAD\x4F\xEF\x9D\x9E\x9A\xBB\xD3\xFB\x62\x98\x22\x4A\xCE\xB6\x89\xA4\x32\x69\xD7\x05\x24\x9F\x86\xB7\x52\x72\x86\x56\xBF\x60\x03\x88\x36\xD7\x1B\x3A\x32\xFA\xEB\xB5\x68\x95\x06\x6C\xCB\xB7\x93\x1D\x0B\x65\x35\xFB\x14\x9D\xB2\x92\x0D\xCE\xBC\x2D\x32\x4A\x32\x3B\x92\xA6\xEB\x74\x70\x14\x56\x99\xEE\xCC\x28\xE3\x1B\x48\x08\xC8\x6A\x81\x10\xD3\x25\xEA\x24\x42\x8F\xBF\x28\x3E\xAE\x00\xED\x21\xD0\xF5\x6D\x40\x99\xB7\x48\x77\x07\xCF\xF6\x30\x04\x28\xEA\x29\xAB\xFB\xCD\x53\x3E\xB2\xFB\xB7\x92\xE1\xC2\x5B\xC9\xF0\x86\x6E\x25\xBB\xE8\x04\x2D\x8C\x5E\x7F\x1F\x1C\x8F\xE4\xFE\x93\x77\x10\x6F\xAC\x30\xEF\x55\x7C\x31\xF5\x34\xE0\x61\x87\x85\x0B\x70\x10\x54\xF9\x69\xD6\x13\x5B\xF6\x41\x01\xD9\xD4\x7A\x93\xFC\xC8\xD3\x97\xD5\x11\xB2\x59\xF1\xDE\xBB\x04\x31\x84\xEB\x9C\x66\x79\x21\x9B\x15\x41\x48\x72\x4C\xEF\x44\xBA\xC1\xBB\xE4\xD0\x45\xDA\x47\x64\x38\x3E\xA9\xC3\x85\x37\xC9\xA1\xBF\x49\x0E\x41\xB9\x3D\xE3\x2C\x56\x54\xD0\x19\x52\xF8\x3D\x6B\x37\x82\xCE\x91\x1C\x64\xF9\x0E\x27\x72\xEA\xF6\x92\xD9\x53\x20\x5E\x93\x43\xBB\x12\x21\x2B\xCC\xA5\x90\xCC\x33\x16\xD9\x60\x0E\x14\xE3\xC2\xEA\x13\x95\x44\x11\x5B\xB0\x62\x5C\xCC\x29\xC6\x25\x4A\xC9\xA2\xD5\x81\xB3\x62\x5C\xA2\xCC\x2B\x8E\x16\x61\x8B\x94\x24\x54\x62\x27\x1C\x23\x55\xD8\x60\x9D\xA3\xA2\x8A\x19\xC5\xB8\x3C\x0A\x92\x15\xE3\x92\xD2\x96\x09\x33\xAB\x14\xAF\x84\xBB\xA7\x75\x96\x38\x4F\x5D\x57\xC8\xF7\xCA\x7A\x81\xCA\x70\x4F\xCC\x14\x9E\x99\x16\x20\xEF\x9D\xD4\x72\x21\x66\x4A\x8F\x99\xB2\xDD\x65\xC9\xBB\x2C\xDB\x5D\xE6\x59\xCA\xDE\x2C\x89\x61\x14\xAD\x76\x3F\xB7\xA2\x21\x3E\x93\x71\x6A\xF7\x3B\xEB\x3E\xDF\x29\x67\x15\xFB\x5F\x06\xEA\x44\xD9\x57\x27\x1A\xF3\x4D\x42\xCC\x5C\x1D\x79\xB6\x6A\x34\xE5\xFB\x12\xBA\x47\xF2\x85\x39\xFB\xC3\x0C\xF9\x09\xA2\xE6\x4C\xF3\xCA\xDF\xA3\x2D\x7F\x4C\xB5\x44\x7D\xDD\x21\x17\x79\x85\x4A\x2B\xA7\x4C\xDD\x59\x39\x26\x5D\x6E\x64\xE5\x13\xDC\x90\xBA\x6B\x73\x6C\xAC\xA0\x5F\x56\x9C\xD9\x1C\x9B\x7E\x05\x2B\xCE\xD8\xED\x66\x6C\xF6\x36\x2F\x68\x8F\x92\xBE\x9D\x41\x77\x67\x1F\xD0\x09\xA6\x76\x21\x91\x74\xBF\x34\x4B\x1E\x85\xE7\x37\x7B\x83\xB8\x4E\x07\x2D\x52\x52\xB5\x61\x67\x08\x16\x38\x1F\x37\x3D\xE9\x7B\xAE\x15\xE7\x7B\x94\x9B\x7E\x8A\x4E\x09\xCB\x77\x72\xCC\xDF\x36\x94\x15\xD2\x06\xDC\x81\x9B\xC7\x76\x43\x86\x27\x64\xD9\x68\xB7\x4F\x73\xC6\xC9\x2D\xB7\x2B\xBF\x4F\x2A\x31\xE1\x87\x84\xCD\x4E\xB2\x6D\xE8\x07\x3B\xCB\x07\x5D\x4B\xE6\xA2\x15\x4B\xAC\x12\xD4\x66\xED\x8D\x30\x98\x2E\x7A\x0A\x49\x5E\xB6\x48\x1F\x5F\xF7\xEA\x9D\x9D\x60\x73\x40\x3B\x19\xA0\xC9\x85\x0C\xE4\x26\xD7\xE0\x0A\xB8\x5B\x82\x2D\x32\x28\xAC\xBF\xB3\x44\xE1\x20\x69\xC4\xD2\x32\xA4\x10\xD3\xE4\xB5\xD9\x20\x39\xE9\x1F\x07\xE6\x27\xF9\x8E\xC2\xBE\xD3\x1A\x18\xBB\x6D\x05\x1E\x01\x1B\x13\xA4\xB6\x7A\xDB\x69\x6E\x7C\x80\xD7\xF6\x92\x85\xA3\x25\xB8\xDB\x91\xED\x86\x6D\x62\x5C\xC4\x57\xD9\x46\xFF\x3F\xEA\x4C\x2E\x34\xD2\xCB\x7B\x9D\xD9\xDA\x40\xD0\x24\xA3\x99\x19\x24\x57\x73\x48\xAE\x16\xCA\x97\x6A\x81\x7C\xA9\xE6\x90\x7C\xBE\x16\x70\xAD\x01\x92\xAB\x85\xF2\x25\x95\x1A\xD9\x45\x89\xAE\x23\x1F\xA9\x5E\xDA\x5E\x74\x7B\x88\x66\x62\xCA\xEA\x36\xA6\xAC\xEE\xC7\x94\xD5\x5D\x4C\x59\xDD\x8F\x29\xAB\xBB\x98\xB2\x7A\x10\x53\x56\xF7\x62\xCA\x6A\x0A\xE9\xEA\xA2\x13\x4A\xD9\x0F\x65\xFC\xCF\x9A\xB9\xF0\xB2\xBA\x17\x5E\x56\x0F\xC2\xCB\xEA\x5E\x78\x59\x3D\x0C\x2F\xAB\xFB\xE1\x65\xF5\x30\xBC\xAC\xEE\x87\x97\xD5\x33\xE1\x65\xF5\x20\xBC\xAC\xE6\xF0\xB2\xDA\xD9\xF7\x1C\x27\x3E\x28\x68\x41\xE9\x41\x1F\x2B\x78\x2F\xC8\x71\x50\x63\x40\xF7\x82\xCC\x92\x31\xF6\x3A\x3B\xF0\x9A\x27\xA2\x81\x76\x50\x7F\x71\x72\xD6\xEE\x72\x73\xBB\xD2\xB3\xD2\xB3\xE7\xF1\x28\x9F\x5A\x8F\xCF\x9B\xB4\xC0\xCE\x52\x53\xCC\x52\x53\x04\x21\xC4\xAD\xD4\x44\x94\xEC\xAF\x9F\x22\x62\x57\xB1\x29\x46\xB1\x29\x46\x16\x2D\x46\xA6\x35\x81\x84\x45\xA4\x78\x73\xDD\x27\x75\x77\x09\x7A\x23\x9A\xA9\x93\xA9\x98\xE5\xD9\x65\x9A\xE2\xBA\xD3\x34\x43\x56\x56\x2C\x64\x65\xC5\x1C\x2B\x8B\x6C\x32\xAE\xB4\x67\x64\x85\x87\x88\x01\x1B\x2B\x3A\x36\xF6\x56\xE2\xEE\x3A\x2E\xF6\x56\x67\x95\xF0\x94\xF6\xC6\x3C\x65\xFE\x7B\x66\xD8\x5F\x0C\xFF\xBD\xCD\xBC\xEB\x50\x16\xEA\x76\x84\xB6\xF3\x06\xC5\xDA\x4E\x17\x05\xD2\xBC\x6D\x59\x2C\xF7\x30\x2E\xEC\xDF\x73\xFA\x40\x3B\xC4\xF3\x48\xFC\x1D\xF3\xEF\xC8\x45\x33\xE6\x3F\xF8\xBD\x82\x42\x54\x38\x0B\x92\xA7\x49\x73\x4E\xAA\x83\x70\x4E\x75\x10\xCE\xE8\x59\xC3\xDD\xF5\xAC\x0B\xEE\xF2\x44\xCF\x14\x4D\xD3\xC1\xE9\xB8\x36\xE7\x72\x82\xD3\x22\x6D\x58\x72\x6F\x9D\x4C\xEA\x14\xE9\x47\x2B\xD8\x45\xBB\x4C\x91\x1D\xD6\xF6\x02\xA5\x88\x41\x29\x5B\x08\x4A\x59\x07\x4A\x11\x83\x12\xE2\x20\x82\x52\x04\xD9\x02\x50\x8A\x20\x63\x50\x8A\x40\x3B\x50\x8A\xBC\x72\x44\x3B\x50\x8A\x0C\x44\xDE\xC6\x87\xE4\x06\x09\xC9\xA4\x36\xC4\xDC\x23\x35\x4B\x29\x32\x08\x18\xFC\x53\x50\xC6\x27\x61\xE6\x0A\x23\x17\xA6\x2D\x87\x88\xAD\xE3\x6D\x76\x7F\x15\x43\xE1\x1E\x05\xFB\x49\x91\x13\x7E\x9D\x58\x71\x82\xEE\x96\x62\x7A\x1C\xD3\x23\x7D\x7B\x0C\x09\x2B\x39\x4B\x3A\x03\xD7\x24\x9D\xD1\x55\xE9\xF2\x56\x50\x6E\xF6\xEC\x14\x05\xA5\xC0\xC7\x31\x64\x28\x95\x65\xDC\x5F\xDC\xF5\x13\x43\xC6\xFD\x2C\x61\x3F\x9E\xC1\xA8\x96\x5C\x5E\x8C\x2A\x83\xC4\xF7\x83\x8F\x09\x8C\xB1\x9F\xF1\x82\x7E\xC6\xDC\xCF\x72\xAF\x9F\xA4\x5A\xF6\x99\x37\xDC\x08\xA8\x23\x7A\xE6\x8E\xFD\x0C\x07\x3D\xB9\x99\xAD\xF4\x7A\xCA\xAB\x15\xC3\x8E\x71\x7E\x0C\xD4\x13\x3D\xEF\x3D\xB7\xD5\x5E\x4F\x65\xB5\x6A\xD8\x3F\x6F\x30\x39\x7A\xDE\x7B\x76\xFB\x7A\x3D\xAD\x56\xFB\x8C\xF3\x13\x1C\x4C\x8F\x0B\xF6\x9E\xDF\x2D\xBD\xBE\xF6\x57\xB7\x18\xE7\xB2\x88\xC0\x40\x13\x94\xDE\xB9\xB1\x4A\x78\x86\xC2\x41\x43\xD7\x97\x04\xC1\x7D\x65\xBD\xBE\x6E\xAB\x32\xC3\xBB\x2F\x78\x0C\xDC\x00\x5C\xF3\x0C\x6E\x81\x7D\xB0\x0A\x2B\xB0\x0C\x4B\x50\x36\xFC\xCF\x1D\x57\x02\x24\x77\x28\x7A\x1D\x42\xE5\xA5\xF7\xA8\x01\x01\x71\xD3\x4B\x2E\x31\x42\xB1\x76\x04\x86\x0D\x44\x8E\x73\x7E\x0A\x0A\x8A\x5F\x8B\x86\xB9\xB2\x8E\xBB\x2D\x40\x3C\x09\x29\xB6\x5C\x28\xC5\x96\x37\x24\xC5\x96\x37\x24\xC5\x96\x0B\xA5\xD8\x92\x4D\xC6\x2A\x09\xA5\xDD\x6E\xAA\x25\x8A\x7D\xCD\xE8\x15\x41\xC9\xA9\x74\xEA\x04\xB1\x56\x82\xC3\xD6\x31\xA1\x27\x2D\xB0\x80\x84\x7D\x1A\xEB\x82\x1E\x69\x59\x0B\xBF\x4F\x94\x1A\x94\x52\x34\x90\xEB\x2F\x2D\x21\xAE\x28\xEE\x39\xE5\xEA\x69\xF3\x5F\x22\x53\x35\x76\xD9\x05\x5C\x92\xB9\x25\x9B\xBC\x98\xA4\xD4\xEC\x14\x7F\xA9\xB4\x09\x4A\x73\x09\xA2\x78\xAF\x30\xE6\xC2\xCF\xC6\xFD\xC2\x88\x0B\x11\xF7\x7A\xA5\x21\x97\x22\x1E\xF5\x4A\x35\x97\x22\x4E\xF4\x4A\x15\x97\x12\x78\xF7\x8A\xA5\x2B\x46\x48\xF5\xC5\x48\x70\x47\x14\x83\x80\xEE\xC1\x51\x66\x1C\xD9\xED\xD3\x20\x9A\x2A\xA3\x39\x41\xDE\xB4\xC9\x99\xF9\x2E\x3D\xBB\xBF\x8E\x1C\x06\x41\x44\xAE\xFD\x3D\xC4\x61\x2A\xE6\x7A\x97\x4C\x8B\x7A\x4F\xBD\x49\x49\x47\x15\x7A\x8F\xBD\x69\x48\x8F\x9E\xFD\xE7\xDE\xC0\xA5\xB7\x93\x6F\x37\xA2\x33\x11\xA6\x13\xCB\x9E\x9A\xD6\x19\x1E\x75\xC6\x39\x3E\x38\x23\xB9\x98\x99\xF9\xF1\xF5\x8D\xE4\x22\x2F\x66\x46\x9D\x91\x5C\xEC\x39\x0F\xCE\xF1\xB5\xF0\x38\xCC\x38\xD3\xD3\xCD\x34\x93\x8B\xC9\x4C\x2E\xDE\xDB\x4C\x4E\xCF\xD8\xC8\xE9\xEE\xEA\xB8\x0D\x6E\xA4\xCA\x3F\x3A\xDF\x86\x36\xDA\x91\xA0\x7D\x6C\xA3\xB0\xBB\x00\xF8\xCD\x70\x70\x03\x24\x07\x16\x97\x28\x9D\x77\x36\x97\x04\x10\xEC\xBA\x94\xBE\x8C\x72\x6A\xB3\x61\xA3\xEE\x19\x36\xEA\xD6\x95\x66\x68\xD8\x48\xF7\x3D\x35\x67\x86\xEC\x5F\x5C\x2D\x30\x6C\x64\x27\x4F\x08\x39\xFD\xDC\x82\x3D\xD3\x14\x7F\xD7\xE7\x9E\x0B\xBB\x3D\x53\x37\xD7\xB0\x71\x4F\x9F\x3E\xD6\x92\xD1\x8E\x29\xDA\xB1\x79\x7F\x3E\xE1\xFD\xF9\x04\xC5\x8B\x9A\xD9\x34\x2A\xEA\xAE\xFC\x15\x83\xDB\x02\xD5\x52\xC0\xAA\xA5\x19\xA5\xC4\x97\xA1\x16\x52\x0D\xB4\x90\x33\x7E\x43\xBB\x4F\x7C\x6E\xAE\x45\xE7\xF6\x37\xE5\x44\xEF\xBA\xFC\xA4\xD7\x3A\xB7\xC0\x7D\x69\xF5\x19\x21\xE0\x19\x21\xE0\xBF\x85\x10\xB0\x75\x93\x84\x80\xAD\x9B\x24\x04\x6C\xDD\x34\x21\x60\xEB\xA6\x09\x01\x5B\x37\x4D\x08\xD8\xBA\x89\x42\xC0\xD6\x4D\x14\x02\xB6\x6E\xB6\x10\xB0\xF5\xD7\x45\x08\x28\x16\x1E\x22\xC5\x0D\x1D\x22\xC5\x0D\x1D\x22\xC5\xC2\x43\xA4\x68\x85\x80\x02\x99\x81\x72\x20\x04\x14\x37\x2E\x04\x98\x4E\x08\x30\x7E\x9F\x6E\x54\x08\x90\x87\x91\xC3\xF7\x2C\xBF\xEB\xD9\x31\x35\x85\x63\x6A\x40\x9C\xE4\x96\x05\x85\x07\xB5\x69\x5F\x20\xE0\x4D\xF7\x4D\x84\x6F\x22\xDB\x26\xB2\xD7\x84\x59\xEA\x3D\x9B\xA8\x5E\x13\xC7\x77\xEF\xD9\x46\xF7\xDA\x38\xE6\x7C\xCF\x36\x61\xAF\x8D\xE3\xE0\xF7\x6C\x13\xF5\xDA\x78\x36\x7F\xCF\x46\x71\xBF\x91\x93\x05\xAE\xDF\x68\x20\x9D\xD5\xB2\x95\xCF\x08\x0D\xE2\x9E\xCC\x33\x26\x71\xA2\x16\x1C\x2B\x5D\xCC\xCA\x3B\x44\x2C\x12\x10\x2E\xE2\x22\x21\x66\xF2\x25\x96\x77\x22\x10\x3D\x44\x76\xD2\x4F\xDC\x9F\xC8\xF1\xEB\x48\x41\xCF\x08\x40\x37\x2E\x00\x7D\xA0\xEC\xA2\xB5\x7F\x44\x6E\xD6\x91\x4F\x7F\x40\xE9\xF2\x76\x92\x3B\xE5\x57\x43\x84\x0C\xD5\x1D\x10\xD9\x83\x77\x05\x6B\x14\x81\xF2\x6A\xD0\x1C\x92\x5F\x8B\xBC\xE2\x21\xF9\x1C\x88\xFC\x55\xC4\xAA\x6B\x56\xDE\x29\x73\x88\xEC\xEB\xC5\x5D\x41\x42\xBC\x63\x15\xB3\xE5\x61\x42\xAD\x9F\xD3\x1C\x92\xB7\x71\x8A\x34\xC9\x89\x66\x28\xF2\x98\xA0\x14\x21\x7C\x74\xE0\x51\x74\x6F\x9D\x4E\xEA\x18\x77\x3B\x99\xE7\x8C\xB1\xBC\x4A\x0C\x31\x3A\xE9\x84\xEE\x2E\x12\xDC\xEA\x78\xC0\x24\xC7\xAE\x4B\xF6\x4A\xD7\x75\x46\x2C\x5F\x63\xB7\x1B\xAC\xA8\x6B\x63\xA9\xA7\xA4\x4E\xF8\x72\x35\xB7\xDB\xA7\x1B\x48\x20\xBF\x77\x42\xFE\x3F\x39\x8A\x7F\x59\x95\x13\x69\x74\xB3\x54\x25\x44\x90\x23\xA3\x19\x11\xE3\x6C\xC7\x53\xFB\x7A\xB1\x75\x57\x90\xF0\x57\x76\x1B\xAE\xAE\x0C\x07\xC7\x4D\x0C\x44\x3C\x58\xD9\x0D\xD6\x06\xEB\xB4\x94\x36\x69\x2A\x0A\x7A\xB9\xC6\xF9\x1D\xD7\x38\xCB\x57\xBE\x09\x21\xBB\x68\x14\x4F\x5F\x60\x8E\xF8\x85\xC4\xFF\x07\x77\x05\x1F\x96\x9E\x0B\x8F\xAD\x86\xC8\x7E\x58\x0E\xD8\xF0\xE8\x40\xF0\x61\xB9\x0B\x1F\x2E\x17\x78\xBD\xF7\xF8\x70\xE7\xDC\xC7\xC1\x85\x9C\xB9\x8A\xBB\xD8\x90\x90\x40\x42\xD7\x1F\x6B\x32\x3F\x5E\xC7\x13\x5C\xAC\xDC\xCF\xD6\xEC\x32\x5B\x8E\x5D\xB7\x17\x12\x9A\x1B\xE4\xC7\xA9\xB7\x1C\x0C\x2E\xF9\xF1\x49\x6D\x16\xF2\xE3\xC6\xF3\xE3\x06\x42\xC7\x8F\x1B\x9E\x0A\x16\x30\x3F\x6E\x0C\x18\xB2\x19\x49\xEC\x6A\x83\x70\x87\x7F\x0A\x88\x27\x95\xA1\x4C\xBA\x75\x42\xE2\x6F\x2D\xB1\x68\x04\x05\x64\xF8\x23\xA3\x45\x88\x27\x1C\xA0\xDB\x5F\x87\x89\x29\x85\x20\xF3\x1E\xBC\x19\x12\x7D\x83\xFF\x29\xF0\x3F\xA3\x35\x19\x94\x17\xF1\xA3\x94\x1A\x90\x0A\xBB\x2B\xCB\x78\x97\x65\xA3\x08\xDB\xF1\xEE\x76\x4B\x79\x7F\xF5\x62\x5E\xBD\x64\xE1\xEA\x25\xDD\xEA\x71\xA7\x90\x43\x4C\x76\x4B\x31\x24\x0B\x56\x2F\x86\x84\x57\x2F\x6E\x57\x2F\xF6\x17\x97\x7E\xF5\x62\x8A\x51\x1F\x1A\x2F\x09\xCA\x33\x0D\x18\x97\x8F\x9A\x50\x8F\xFA\x3B\x35\x05\xB5\xC5\xF1\x73\xA4\x15\x90\x4E\x20\xC5\xB5\x1B\xB3\x72\x93\x53\x01\x52\xEE\x20\x89\xE4\x25\x6D\xC3\x91\x9F\xE9\x4E\x03\x17\x3E\x98\xEE\xB6\x69\x49\x25\xA2\x5D\xE6\x7E\xE5\xFE\x60\xC8\x7B\x49\xC0\x70\x4E\xC8\x48\x12\x0B\x34\xC6\x4E\xC7\x90\x52\x9A\xEF\x38\x97\x06\x7F\x72\x3C\xE0\xAC\x32\x50\x54\x23\x37\x07\xEA\x3C\x5E\xA3\x84\x5E\xB2\x7C\x2B\x2D\x1F\x8F\x8D\x2D\x62\x8E\x4F\xE8\x6B\x3D\x31\x1F\xD9\x5E\x8A\x4E\x42\xE7\x15\x25\xF2\x97\xD4\x03\x09\x50\x94\xBC\x9B\x72\xF5\xBA\xFD\x32\x4F\x99\x2C\x0C\x10\x45\xF2\x56\xC7\x0B\xB7\x3A\xEE\xB6\x5A\x32\xA2\xA0\x00\x88\x88\x22\x21\x9E\x3B\xAD\x24\xC4\x7C\x5A\x49\xBF\xD1\xB7\x7A\xFB\xB4\xB0\xA7\xF6\xC9\xF9\x90\x1D\x3B\x85\x83\xB3\x1E\xA2\x50\xFC\xED\x45\xA7\x62\xE7\x07\x98\x8F\xCF\xCC\x2A\x92\xDC\x40\x3E\xAB\x22\x11\xAE\x83\x5A\xBA\x58\x48\x48\xE2\xF7\x5B\xB5\x4E\xAB\x29\xB6\x5C\x88\xA5\xBB\xD8\x4B\x6E\xF7\x9E\x87\x72\xC2\xEC\x67\xBE\x1C\xC2\x48\xE5\x36\x3D\x09\xB2\xA7\x75\x8A\x0E\x04\x6B\xB5\xE4\x28\x62\xD1\x9A\xFC\xDA\xB9\x28\x62\x58\xC1\x03\x4C\xC9\x5A\xA1\xB5\x66\x2E\x90\x18\x44\xF6\x23\xD2\x33\x12\x3F\xAB\x06\x2E\x1C\xE1\x8C\xF7\x03\xA9\x9A\x7C\x96\x8F\xDC\x99\x16\xE3\x99\x8B\x47\xDE\xD4\x86\x67\xB6\xD8\x26\x11\x39\x99\x4F\x7B\x13\xEF\x61\xB0\x2B\xE4\x68\xD6\x28\x9A\x48\x2F\xA2\x03\x67\x40\xE8\x5A\x91\xBD\x0B\x31\x75\xCE\x02\x8E\xC2\x1B\x45\x40\x48\xC4\xCE\x1B\x9A\x0F\xD2\x5B\x7B\x1C\x92\x34\x64\x42\xCE\xD6\x1F\xBD\xEE\x38\x8E\x84\xAB\x05\x6C\xF2\xED\xA2\x00\xE4\x4F\xA3\x36\x4C\xCD\x6B\xC3\xD4\xD3\xA7\x0D\x1B\xF0\x83\x4F\xAC\x3C\xA3\x33\x7C\x46\x67\x78\xD3\x75\x86\x49\x4F\x49\xD8\xEA\x0C\x4B\x7A\x74\x69\xB0\xC7\x50\x92\x75\xA7\x57\x17\x66\x5E\x5D\x38\x1E\xAA\x0B\x4B\x56\x1C\x2D\xF5\x95\x57\x36\xA8\x90\xF9\x5E\xA2\x43\xA8\xD3\x14\x26\x5E\x53\xB8\xD4\xA9\xE5\xF0\x71\x19\x4A\xEC\xA2\x9C\xE9\x62\x2C\x0F\x43\x39\xE8\x22\xA9\xC6\xAD\x92\x70\x05\x96\x06\x4A\xC2\x25\x58\xC6\x4E\x96\x67\x3A\x29\xE5\x61\x58\x1E\x74\x92\xB3\xE6\x93\xF4\x81\xCB\xB0\x32\xD0\x0F\x72\xA7\xF5\xEA\x4C\x27\x4B\xF2\x30\xAC\x0E\x3A\x29\x59\xED\x49\xAA\xC0\x55\xFA\x72\xA7\x1A\xDC\x47\x9D\xD6\x2B\x33\x9D\x2C\xCB\xC3\xB0\x32\xE8\x64\x95\x75\x9E\xAC\x04\xBC\x05\x56\x87\x5A\xC1\x55\xD8\x87\xDD\xEC\x9B\xE9\x66\x45\x1E\x86\x7D\x83\x6E\xF6\xB3\xC2\x93\xF5\x7F\xFB\xE0\x96\xA1\x42\x90\xFB\x1D\x2A\x04\x5D\x7A\x23\x16\x69\x3B\x5D\x60\x6C\xE8\x93\x95\xA0\x3E\xFC\x2A\xB8\x96\xB1\xD7\x02\xC2\x18\x12\xC8\x5A\x5D\xA0\x0B\x95\xBB\x4A\x7E\x33\x9D\x1A\x50\x76\x6A\x40\xF9\x25\x53\x03\x2E\x2F\x54\x03\x2E\xDF\x90\x1A\x70\xF9\x86\xD4\x80\xCB\x0B\xD5\x80\xCB\xAD\x1A\x70\x19\xD9\xC2\x95\x81\x1A\x70\xF9\x3A\x6A\xC0\x72\xA8\x06\x5C\x62\x7D\x12\x87\xB0\x2B\x61\xE9\x18\xF3\x03\x37\xA0\x01\x5C\xD9\x4D\x03\xB8\x3C\xAB\x01\x5C\x7E\xF2\x1A\xC0\xE5\x27\xAF\x01\x5C\x7E\x0A\x1A\xC0\xE5\xA7\xA0\x01\x5C\x7E\x0A\x1A\xC0\xE5\xA7\xA2\x01\x5C\x7E\x46\x03\xF8\x8C\x06\xF0\x4B\xA2\x01\x7C\xB5\x4F\x59\xCC\xBE\x29\xB9\x0B\xC4\x4B\xAC\xB6\x9E\xE1\xCD\xD5\x75\x78\x73\x4E\x68\x36\x8C\xB6\xC6\x4E\xBB\x5D\x48\x14\x50\xE5\x9F\x9D\xEF\xC5\x61\x03\x55\xFE\x39\x0D\xE8\x2F\x9F\xD6\x41\xD0\x30\xDC\x2D\xFB\x1E\x2E\x82\x73\xEE\x81\xCC\xC9\xEE\x67\x3B\xA3\xDE\xE7\x8F\xB6\x02\xA6\x17\x2F\x7B\xB1\xE9\xC6\x66\x58\xB5\xBB\xAE\x3F\x4D\xB6\xBA\xFD\x30\x76\xBF\xFF\x37\x79\xEA\xB7\xCE\xCC\x35\x1A\x98\xDB\xCC\x0B\x89\x4E\xAC\xD8\xAA\x93\x56\x5C\x4C\x78\x49\xD8\x81\xC3\x26\x3D\xD1\xB1\xE3\xCC\x49\x97\xB5\xE0\x15\x48\xBE\xD6\x42\x50\x8B\xAC\x9E\x3A\x33\x8C\xA7\x22\x64\xC6\xDE\xA7\x29\x62\xF7\x2D\x12\x7A\x2A\x45\x74\x87\xCE\xCF\xD8\x95\x2B\x8F\xB6\x5F\xEE\x02\x8F\x32\x4F\xC7\x24\x74\x3B\x89\x36\x74\x93\xA6\x49\x8C\x66\x27\xF1\x24\x42\x37\xA9\x41\xE8\x26\x0A\x52\x45\xFB\x51\x04\xF6\x77\xDE\x3E\xF0\x20\x79\x7A\x44\xD1\x6E\x52\xC5\x70\x52\xC5\xEC\xA4\x16\xC5\xD9\xDA\x65\x52\x72\x38\x29\x6F\x34\x45\x90\x08\x0A\x74\xF9\x84\xA7\xF2\xA0\x1D\x7E\xF5\xE9\xFA\x1F\x7D\x39\xE3\x9A\xF3\xF4\xED\xA1\x5B\x8B\x67\x11\xF9\x0B\x12\x92\x79\x9C\x7B\x06\xD9\x9E\x41\xB6\xA7\x0D\xD9\x08\x14\x6F\x00\xDF\x56\xC9\xD3\x94\xB9\x1A\xD0\xE5\x5F\x52\x85\xB7\xEF\x13\xB9\x47\xC2\xAB\x7A\xD1\xF5\xEA\xFF\x21\xF9\x7E\xF5\x87\x25\x5F\xB0\x3E\x26\x41\xD1\x05\x0D\xA1\xA7\xBB\x31\xBD\x2A\x9B\x43\xF2\xDF\x4B\x7F\x5B\xBA\x55\xA7\x2D\xCA\xA6\x3D\x94\x4D\x1C\x5E\xFA\x4B\xB6\x05\x28\x3B\x78\x05\x8A\x5D\xC6\x71\xC4\x09\xA1\xAC\x64\xFC\x0D\x3D\xCA\x3A\xDF\xDF\x0E\x65\xD9\xFE\x14\xF4\x3C\xCA\xCA\x29\xA7\xEF\x6D\x51\x32\x75\x98\xB9\x4B\xDC\x7D\x71\xDD\x2C\x13\x83\xD7\xE0\xD4\x8A\xB3\xE8\x49\x77\x95\x80\x83\xF4\xE8\x19\x59\x98\xBD\xA9\x04\x9F\xC7\xA6\x03\x02\xD7\x37\x67\x93\xCD\x41\x30\x10\x08\x50\x0B\x2E\x2A\xFB\xE8\x79\xFD\x99\x40\x0C\xC9\x69\xE7\xF6\xBC\xFB\x84\xC8\x9D\xDB\xD5\x5A\x30\xAF\x64\x7E\x5E\xC9\x17\x3D\x2F\xC9\x33\x1B\x60\x6C\x3A\x44\xD7\x21\xD0\x21\x14\x24\x10\x9F\x66\xF3\x52\x4D\xA1\xA1\x5D\xE8\x40\xB6\x33\xF5\xCB\x23\x3A\x08\x53\x9C\x78\x6E\x8E\xBB\xC4\xF2\x2A\x75\x0C\x54\x8C\x82\xE4\xB4\xCA\xDC\x4D\x38\xC1\x2F\x87\x16\xEA\x98\x4E\x02\xA2\xB9\x6E\xDC\xD5\xB9\xBF\xE7\x97\x33\x2D\xBE\xBC\xA1\xAC\xDC\xF2\xB1\x35\xBF\xC8\x89\x40\x0C\xD9\xE9\xFF\xA6\xD0\xE5\xA7\xA4\x3B\xC8\xB8\xDE\x6E\x2E\xDC\x4F\xB2\xFF\xC8\x4E\x5B\xBE\x44\x40\xE8\xD0\x9B\x0C\x77\xEE\x7A\x87\xAC\x4A\x92\x4D\x02\xCA\xA6\xA6\x9B\x5D\x03\xA9\xDD\x3E\x5D\xE5\x6C\x6F\x52\x50\xA3\x6A\xE4\x54\xDB\xA9\xBB\x06\xB2\x8F\x49\x36\xAB\x78\x4C\x36\x20\xE9\xBA\x9E\x8D\x2A\x04\x08\xBB\xA3\x21\x6C\xD3\x6A\x53\xA3\xED\x75\x14\x81\xC8\x86\xC4\xB5\x51\x90\xFB\x36\xD5\xD8\xF5\xA7\xB0\x0A\x8C\x69\xC1\x7A\x7D\x08\xC3\xD6\x0C\x84\x17\x63\xD2\xBD\x35\xDE\x21\x9C\x62\x12\x16\x01\x24\x20\x28\xC3\xBC\xA2\xBF\x50\xC2\xF8\x38\xDF\x98\x10\x14\x8C\x77\x81\x02\x92\xAB\xC7\x7B\x69\x1D\xC6\xEC\x87\xBB\xB4\xD0\x0F\x77\xA9\xD3\x3A\x8C\x0D\x8C\x41\xC2\x18\xCA\x7B\x27\xF5\x98\x94\x80\x9D\xE9\x01\x6B\x1D\xC6\xB0\xC4\x9E\xB8\xE3\xF6\xCA\x7E\xCC\xAC\xDE\xB8\xBD\xB2\xC7\x6E\xE6\x97\x80\x27\x4B\x2B\x60\xC9\xE5\x98\x61\xCE\xFD\x87\xA3\x8B\xE1\x39\xF2\x18\xF5\xC1\xFE\x51\x30\xB6\x3B\xC9\xBD\xAE\xAE\x0D\xB8\xB6\x6A\x9B\x8C\xCB\xB7\x93\xB1\x43\x89\xAB\x33\xB7\x6F\xBD\x93\x75\x95\x0F\xD6\x9C\xCF\x55\x3E\x48\xA1\x39\x24\x6F\x23\x5F\x9E\xA4\x81\x04\x14\x84\xE5\xE7\xCF\xCF\x45\x69\x43\x04\x48\x5C\x40\x79\x8E\x22\x63\x35\xC7\x57\x65\xE4\xC0\x77\xFE\xF2\xF4\xB6\x45\x97\xA7\x09\x1B\xED\x97\xD3\x42\xD2\xA7\x66\xEB\x30\x80\x45\x14\x9A\x79\x1E\x39\xB8\x03\x7A\x4D\x11\x5C\x28\x9E\xDA\x9A\xBC\xAD\x4E\x7C\xF0\x35\x46\xF0\x6B\x62\xCA\xC3\x48\x76\x1B\x03\x55\x73\x17\xB8\xF3\xA3\xA0\xDC\x6A\xEB\x55\xC9\x0A\x00\x69\xA0\x80\xBC\x81\xD1\x26\x59\x22\x78\xAB\x84\x31\x7F\xDF\xAB\x05\x5C\x4C\x80\xA1\x55\x82\x62\xAB\x04\x17\x15\xA0\x67\x95\x30\x7E\xEA\x14\x6D\x26\xCD\x94\x58\xA8\x41\x13\x33\x1A\x34\xEA\x6D\x4C\x29\xA6\xC6\x94\x62\xCA\x8B\xE2\xFD\x14\x53\xA4\x41\x13\xB4\xF7\x9D\x06\x8D\x9F\xBD\x06\x4D\xC0\x98\x48\x1C\x37\x7C\x42\x4C\x89\x1E\x31\x03\xC4\xCA\x35\x02\x98\xF2\xA8\xD7\xAB\xAC\xD6\xCA\x5D\x7E\x9D\x1A\x45\x81\x94\x52\x06\xD2\x50\x80\x46\x4A\xD2\xC0\x0A\x38\xC1\x66\x28\x44\x8A\x04\x18\x10\xE5\xAF\x11\x24\xE3\x70\xCD\xBD\x93\x5A\xF9\x00\xF3\x0A\xF2\xA6\xCA\x71\x18\xB9\x0B\x0E\x1D\x1D\x08\x1E\x93\x3D\xA8\xFB\xF7\x73\x59\xF1\xB8\x4A\x0B\x77\x8E\xD8\xCD\x6F\xB9\x00\x44\x17\xC7\xBE\x46\xF6\xAA\xF6\xFC\xEB\x4F\x3C\xA7\xB3\x04\x7C\x67\xDC\x0A\x8C\xC8\x69\x1F\x92\xCF\xE1\x3F\x39\x84\x20\x9F\x2B\x93\x3B\xD5\x1A\xFF\x2A\xEF\x54\x07\x21\x04\x45\x65\x25\xFF\x2A\xEF\x54\xFB\xF1\x2D\x2E\xDD\xDF\x9A\xDA\xAB\xC1\x16\x1E\x37\x21\x71\x18\x6D\x41\xD2\xC5\xDC\x66\x51\x2E\xA8\x22\x4E\xB5\x28\x4C\xF9\x7E\x5A\x96\xA8\x27\x61\x76\xA7\x49\x77\x59\x49\x71\xD3\xC8\x33\xAF\xDF\x2A\x26\x63\xE6\xD8\xEE\x68\xE6\x6D\x43\xFB\x82\xA6\xFC\x11\xC7\xB3\xFC\xFF\xEC\xBD\x0B\xB0\x5E\xD7\x55\x26\x78\xF6\xE3\xBC\xFE\x73\xCE\xFF\x1F\x49\xD7\xF6\xB5\x7F\x25\x59\xE7\x94\xA7\xEA\xAA\x2B\xAA\xA8\x6B\xCC\x95\x2B\xED\xE9\x68\x6B\x5A\x8F\x6B\x25\x96\xBB\xA7\x98\xA2\xAB\xA0\x2A\x35\x9D\x61\xC8\xB9\xC2\xF1\x95\x6F\xD4\x61\x50\xEE\xBD\x58\xC2\xA8\xA6\x27\xB4\xA1\x13\x08\x90\xD0\x26\x09\xC8\x98\x88\xA4\x03\x33\x93\x0E\x01\x44\x80\xC6\x0D\x19\x30\xC4\xA1\x33\x90\x06\x57\xF1\x48\x80\xF4\x90\x6E\x32\x10\x1A\x88\xA6\xD6\x63\x9F\xC7\xFF\xFF\x57\x57\xC2\x09\x43\x7A\x92\x94\x75\xFF\xF3\xDA\x8F\xB5\xD7\x5E\x7B\xED\xB5\xD7\xFA\x96\x66\x5F\x3F\x5C\x41\xD6\x6B\xE3\x6C\xB3\xAA\xEF\x77\x49\xA5\x21\x71\xD7\x3F\xFF\xB1\x5F\xA4\x53\x4F\xE3\x3E\xEC\x7F\x86\xB8\x89\x48\xEA\xD4\x4D\x36\xDC\x73\xD8\xEA\xEB\x11\x2F\x6F\x79\x3D\x5A\xD5\x3F\x27\x17\x65\x9D\xAD\xEA\x67\xE5\x62\xA9\xD6\xAB\xFA\xA3\x72\xB1\xBC\xAA\x9F\x93\x9F\x07\xEB\x64\x55\x3F\x1F\x41\xD8\x29\xFE\x16\x42\x52\xFC\x71\xEB\x82\x8A\x3F\xC1\x7A\xE1\x80\xAC\xEA\x0F\xDB\xDE\x8B\x6F\xD5\xFC\xE2\xFF\xAA\xF9\xC5\x2B\x9A\x5E\x7C\x0A\xF7\x04\xEF\xC0\x7B\x7A\x55\x5F\xC6\x77\xC4\x0B\xF3\x73\x4A\x3E\x2E\x8F\xEA\xCF\x28\x08\xC9\x0F\xF3\xD3\xCA\x05\x90\xAD\x57\x86\xBE\xBD\x8C\xDF\xFE\xA5\x62\x2C\x03\x97\x34\xA7\x8A\xC0\xFD\xC7\xEF\x1F\x00\xC1\x1A\xEE\xA0\x7B\x2E\xE0\x6E\xE3\xF0\xBF\x16\xC2\xF6\x78\xAA\xCE\x57\xF5\xEB\x58\x36\xB4\x62\x89\x51\x87\x32\x97\x3E\x5A\x17\x2E\x85\x62\x8A\x7F\x28\x13\x14\x79\x86\x7B\xFC\xC7\xAF\x25\xFC\x47\xC6\x26\xD1\x02\x3C\x22\xE5\x10\x66\xE4\x8C\x33\xF9\x23\x82\x13\x99\x42\xB1\xEE\x4F\x3C\xCC\xB9\x66\x3E\x20\x6C\x11\x40\xCD\xB6\xDB\x1A\x02\xD4\x90\x27\xCE\x9B\xDD\xC5\x21\x40\xCD\xAC\x27\x0E\x7D\xFB\xCD\xEE\x7F\x1E\x02\xD4\xCC\x7A\xE2\xD0\x5B\xDF\xE4\xDE\x04\x5D\x21\xEE\x9F\xBA\x0B\x43\x64\x1A\x91\xE0\xBE\xF3\xF7\x12\xA5\x72\x24\xFD\x2E\xDE\x5A\xF1\xAD\x7B\x6B\x25\x10\x23\xFF\x15\xB3\x72\x11\xEF\x56\x45\x27\x17\x13\x9C\x07\xCF\x06\xE4\xCA\x06\xE6\x1C\x61\x51\x25\x0E\xD9\x5E\x3F\x38\xAD\x13\x28\x58\x4C\xC6\x9D\x98\x4C\xA0\x40\x31\x19\x43\xE2\x71\xFF\x48\x4C\xF2\xB5\x17\x93\x31\x03\x96\xBC\x10\x34\x4E\x83\xE1\x45\xFC\x1E\x88\xDD\x37\xAD\x6A\x8B\x3B\x42\xA7\xE8\x15\x94\x8D\x76\x8A\x13\x20\x87\x98\x2B\xF1\x89\x69\x86\x70\xB6\x49\x0F\xCE\xF6\xD6\xE0\x86\xCC\x42\xB8\x21\x73\x4B\x70\x43\xE6\x96\xE0\x86\xCC\x42\xB8\x21\xDE\xED\xB9\xF4\x1C\x18\x0F\x67\x1B\xBA\x9D\xB8\x95\x34\xEE\x13\x51\xF7\x3B\x59\xD5\x6F\x8F\xF9\xEF\x67\x71\x26\x7D\xF2\x89\xF7\xFE\x6F\x5B\xAB\xFA\x05\x94\x06\xEF\xF9\xF3\x8F\xFD\xE2\xCF\xFC\xD1\xF5\x8F\x7F\xFD\x51\x7D\x39\xF6\xD7\x6F\xFD\xE9\x67\xEE\x3E\x6A\x3E\xC1\x2E\x4C\xE1\x8A\xBE\xBF\x36\x6E\x0B\xD9\xE4\xA9\x0E\x0E\x87\x81\x7D\x42\x4E\xF3\xAD\x9B\xAA\xC0\x82\x83\xA6\x32\x2E\xA0\xBC\xEC\x28\xDD\x6A\x43\x01\x18\x4E\x7F\x23\xCE\x56\xD4\x13\x28\x1F\x78\xE1\xF2\x07\xAB\x31\xE4\x55\x01\xE3\x22\xC8\xCC\x31\x08\xDD\xD3\xB6\xC1\xB1\xE1\x96\x83\x2E\x2F\x5F\x62\x89\x49\x11\xAB\x6A\xD3\x85\x4D\x5D\xAC\xEA\x1D\x7C\xE1\x7A\x44\xEE\xA1\xD8\xB0\x67\xA3\x7A\x8C\x8C\x82\xBD\xBC\xA2\x1B\x7E\x08\x63\x28\xD6\x41\x97\x9F\x61\x76\x08\x5D\x80\xAF\xEE\xC4\xEB\xAB\x2C\xC2\xAE\x68\x5A\xDC\xF8\x8B\x5C\xEA\x26\xEA\x81\x2E\xFF\x52\x68\xC6\xA5\xF1\xBD\x4F\xCA\x3D\x6E\x63\xE8\x3E\xAD\x9A\xD9\x76\xA2\x74\x7A\x9A\xDB\xCF\xA5\xF1\xF7\xF8\x4E\xE8\x9E\x8E\x9B\xF2\xCF\xBA\x5D\xEB\x69\xFC\xE7\xE9\xB8\x2E\xCE\xAF\xEA\xD3\xFA\x18\x14\xEE\x67\x40\x4C\x16\x34\x25\x8B\x5D\xA6\x64\x91\xD1\xCB\x0B\x36\x5F\xFD\xC7\xB4\xEB\x8A\x07\xBB\xAE\xBC\x35\x58\xBD\x0F\x9B\x48\xB3\x26\x27\x8B\xD5\xFB\xE2\x59\x93\xD5\xFB\x62\x32\x6B\x0E\x36\x5E\x52\x3C\xDE\xA6\x29\xC4\x1B\xAF\x18\x8A\xD9\x8D\xE4\x69\x36\x57\x9C\xCE\x5A\x55\xCC\x6D\x37\xE2\x8E\x4E\x9E\xCD\x71\x0F\xED\x2E\xE6\x6D\x1B\xA4\x4E\xB2\x91\x51\xCB\x2C\x64\x30\x6A\xD6\x45\xED\x08\x0F\x07\x4F\x5B\xAF\x76\x84\x2B\xFA\xC3\x76\x4E\xED\xA0\x57\x06\xAA\x26\x0D\xC1\x9C\xE2\xC1\xA5\x5D\xD1\xBD\xD2\xDE\x31\xAF\xC4\xD0\x2B\x33\xA5\x5D\x59\xA4\xC6\xC4\xB4\xB0\xB7\xCC\x81\xD3\x0A\x9A\xEE\x2E\xB1\x91\xD3\x8C\x70\xC4\xB7\x1E\x67\x4E\x39\xFE\xB3\x9F\xFF\xD8\x2F\xFE\xEA\x9F\xD1\x8C\x7B\x80\xC9\xB6\xE2\x0C\x2A\x02\xB2\x16\x76\x5F\x78\x5E\x0C\x56\xF5\x75\x4B\x4F\xBB\x2A\x68\xA1\x9E\xE3\xAA\xEB\xB6\x36\xE7\x51\x03\x38\x4D\x1D\x18\xF2\xD5\x6D\x8B\xFA\xC1\xE3\x05\x7C\xD5\xB9\x09\x3E\xA5\x3D\x5F\xB1\x9F\xE0\x53\x7A\x96\xAF\x9E\xD2\xBB\xF0\x95\x9E\xE7\xAB\x39\x7F\x7D\xE2\x2B\xEA\x96\xE8\xA2\xB2\x4D\x8A\x5B\x58\x6B\x2B\xB9\xFF\x18\xD4\x8E\x9A\x75\xFD\x9D\x97\x77\x28\x3F\x67\xE8\x9E\x78\xE5\xAA\x26\xCE\xB9\xFC\x03\xB8\x90\x7F\xF7\xFB\x2E\x23\xD5\xCA\x27\x49\x40\xB8\xDF\x7E\xFC\xF2\x4E\xE0\x1E\x70\xAA\x7D\xA3\xFC\x0E\x7E\x32\xEA\xEE\x7C\x27\xDF\xD9\xD1\x04\x98\xD4\xC1\xAA\xB9\x2B\xBF\x87\x85\xC5\x8C\xC0\xC8\x2A\x76\x37\x62\x32\xA2\xBD\x11\xFB\xD3\xF9\x11\xD3\x22\x07\xF4\x97\x7A\xBC\x92\x05\xE3\x95\x7C\xC9\xC6\x8B\xE4\x80\x27\x05\xEE\x7D\x9F\x22\x4A\xDD\x9C\x16\x09\x0F\x33\x24\x4C\x0B\x3A\x80\xD9\x85\x16\xD1\xCD\x69\x11\xCD\xD2\x22\xDA\x9D\x16\x11\xED\x75\x6F\x4E\x8B\x68\x48\x0B\x29\x1E\x6F\x53\x28\x0E\xD3\x22\x1A\xD2\x42\x28\xC1\x1B\x01\xE6\x05\xE1\x93\xED\x93\x85\xBE\x29\x9F\x2C\x98\xD9\xFF\x7F\xE1\x93\xCF\xFE\xEE\x6D\xF3\x89\xFA\x2F\x84\x4F\x70\xE3\x43\x62\xCE\x0B\xB9\x13\x85\x62\xDB\x7F\x04\x01\x7B\x41\x44\x9D\x6F\x78\x28\xC2\xB0\xE7\x4A\x3F\x9F\x90\xDB\x37\xA0\x75\xA4\x5F\xB0\x30\xC6\x02\x02\x0E\xF1\xB0\xF0\xB8\x57\x78\xBC\xA8\xF0\x78\x58\x78\x3C\xBF\x4E\x8A\x93\x3D\x75\xF1\xA7\xE2\x0D\xDA\x46\x47\x99\x97\xDC\x8C\xDF\xA8\xF1\x09\x01\x38\xF2\xCB\xEC\x15\x8E\x9D\x63\x4F\xE2\x80\x77\x07\x2F\xBE\xAB\x10\x73\x00\x90\xEA\xB6\x1B\x2F\xAE\x7B\x7F\xED\x28\xA7\xC1\xE3\x9B\x9E\xFE\x5E\xB7\xC3\xE3\x5F\x9C\x10\x43\xB6\xBB\x6E\x77\x39\x66\x64\x0F\xB2\x1E\xA3\x0D\x0E\x1D\xBD\x65\x6C\x41\xDB\xD5\xCD\xDB\xAE\x66\xDB\xBE\xE0\xD0\xC2\xB7\xBD\x77\x6A\xB1\x6B\xDB\x17\xD9\xF9\xE3\x79\x3B\x7F\xAF\x27\x28\x30\xDE\x1F\x7B\xCB\xD1\x5B\x0E\xA8\xB4\xB5\x1C\x2D\x8C\x21\x9D\x35\xC5\x6A\x89\xF2\x89\xD9\x28\xA4\x36\x2A\x8E\x13\xAD\x53\xB2\xDB\xD7\xA3\x07\x7D\xB0\x64\xDE\x99\x6D\x17\x47\xE9\x68\x89\xFF\x49\x20\x7E\xAC\x2A\x60\x04\x29\x64\x53\x1F\x5A\x4A\x9F\x2C\x38\x5D\x68\x4F\x38\x09\xDD\x18\x52\x76\x21\x2C\x5C\xE0\x02\x39\x67\xA0\x49\xAF\xE5\xA4\xC1\xD6\x79\xC3\x0D\x63\xDB\x51\xB3\x5E\xB3\x47\x20\xD7\x00\x24\xA4\xB0\xD4\x1C\x92\x36\x50\xF3\x44\x61\xA4\x68\xEF\x15\xD1\xD6\x49\x31\x2B\xC3\xDA\x5C\x52\x91\x2F\x21\xCD\xC0\x5E\xC9\x7C\x02\x91\xB3\x61\x1C\x8B\xAF\x13\x06\x25\xA2\x48\xD1\x9C\x0D\xD9\x1A\x92\xEE\x24\x23\x37\x19\xDF\x35\x2E\xE8\x35\x87\x8E\x3D\x12\x3E\xAD\xC8\x21\xA1\x46\xE4\x14\xAD\xCA\xF6\xF9\xD1\x7A\x3D\x6E\x4F\x28\x20\x87\x80\x6A\x86\x44\x0E\x24\x8C\xBF\x31\x3A\xDD\x8B\xE9\x48\x76\x99\x77\x72\x4E\xB7\xA7\xF5\xE2\xD6\x02\x1E\x12\x1C\x5D\xEC\xE3\x98\x8C\x15\x8B\xC2\x1D\x12\x1F\xEE\x90\xB4\x27\x14\x09\x1F\xE2\x27\xED\x09\x05\x16\x43\xDD\x36\x72\xF6\x48\xFD\x24\x8D\x31\xA9\x46\x90\x10\x39\xFA\xE7\x2F\x0B\xBC\x3E\xD5\xAD\x7B\x7D\x8E\xD8\x66\x3D\x5E\x68\xB3\x1E\x77\xBD\xA3\xD2\x12\x18\xC1\x08\x92\xD3\xD3\x7A\x04\xE3\x05\x27\x30\x23\x18\xF3\x09\xCC\xA8\xED\xDF\x88\xD9\x6A\xD4\xF6\x6F\x94\xC1\xE8\x44\x61\xA4\x7F\x23\x3E\x7B\x19\xB1\x4A\x4C\xDE\xFF\x23\xEC\x30\x8E\xF5\x98\x6F\x8E\xF0\x6A\x89\x43\x1B\xE5\x20\xA6\x36\x8F\xD4\x63\x4A\xAA\x4F\x9B\x54\x18\x83\x39\xB7\xCE\x67\x93\xF2\x3A\xDE\x1A\x1C\xDA\x18\x7E\xD7\xB4\xC7\x7D\x23\x39\xBE\xE9\x40\x4D\xF3\xF6\x04\x07\xAB\x87\x11\x9F\xE0\xB8\xED\x53\x85\x72\x3B\xB6\xCA\x7C\x10\x57\xDE\x1D\xC8\xB4\xC8\x48\xBA\x3D\x96\xD1\x7C\x4E\x91\xB4\x48\xE7\xDD\x21\xC5\x68\x26\x74\x72\xD7\x43\x8A\xDC\xEF\x8C\xF3\xEE\x90\x62\xF4\xC5\x0D\x9D\x34\x0B\xD9\xD9\xCC\x84\x4E\x8E\x28\x74\x72\x44\xA1\x93\x66\x41\xE8\xA4\xB9\x95\xD0\xC9\x91\xF7\x4E\x5E\x1C\xBB\x38\x9A\x31\x90\x8E\xBE\xFC\x62\x17\xBD\x77\xF7\xA8\x0D\x61\x44\xBD\x73\x90\x7C\xA2\x90\x7C\xE3\x22\x38\x21\x71\x0A\xFF\x23\x28\xB5\x64\x70\x74\xC5\xEE\xDF\x09\x73\x45\x82\x5C\x91\xB0\xFB\x77\xE0\xDD\xBF\x03\xE2\x8A\xA4\x45\x53\x53\xBB\x70\x85\xBA\x1D\xAE\x20\x31\x10\x2C\x14\x03\xC1\x0C\x57\x18\xE2\x0A\x43\x5C\x11\xCC\x1D\x5D\x69\x08\xF8\xE8\x4A\xCF\x1C\x5D\xE9\xC1\xD1\x95\xA1\x55\x5B\x7C\xC0\xFB\x47\x58\xE2\xFC\x21\x27\xF4\x90\x79\x35\xEF\x4B\x83\x26\x60\x5A\x5F\x83\xF7\xE9\x7E\x14\x63\xE4\xDE\x37\x87\x26\xF0\xBE\x9B\xA1\x09\x0C\x74\xF5\x85\x2A\xD4\x6D\x8F\xD0\xE0\xF1\x02\x15\x2A\xE8\xB7\x5D\x54\xA8\xE0\x66\x6D\x5F\xA4\x42\xE9\x8C\x75\x27\xCA\xD7\xDC\x75\xC1\x05\x55\x9A\x89\x66\xE0\x8F\x93\xF5\x5E\xC7\xC9\x7D\xAD\x7A\xD1\x41\x6E\xE4\xDE\xDF\x46\xE2\x5E\xBD\xC3\xC4\xDB\x6A\xAB\xCD\x95\xF7\xA4\xFE\xB2\xF2\xFE\xEC\x7C\x3E\x19\x93\xCA\x7B\xAF\x13\xB4\x46\xB4\x8B\x02\x18\x21\x09\x86\x8A\x1E\xAA\x76\x9A\x9D\x9A\x54\x1B\x84\x19\xEC\x72\x16\x1D\x88\x6F\x4B\x84\x5A\x64\xB4\x9B\x93\x4D\xFB\x16\x6A\xAC\x51\xE7\x64\xB3\x20\x15\x24\xE9\xDF\x65\x3F\x15\x64\xE8\xCA\x59\xED\xBB\xDC\x85\xEB\xCD\xBC\x7F\x62\x34\x74\xE1\xEA\xB0\x1E\x6F\x3B\xE6\x74\xF0\xF8\xA6\xC1\xC7\xE5\x30\xF8\xF8\x96\x9B\x1F\x2D\x68\xFE\xAE\x8E\xAF\xBB\xB8\x8F\x76\x63\x46\xED\xEC\x47\x30\x2C\xE0\x01\xD5\xE7\x81\x05\xC9\x4B\xF0\x19\xF1\x82\xBA\x05\x1E\x50\x10\x7D\x59\xF0\x80\xFE\x2F\x86\x07\x28\xD9\xA9\xE2\xF4\x3A\x9C\x44\xE5\xC1\x3A\xE2\xE0\xEA\x3A\xA1\xA8\xEB\x68\x5A\x8F\x08\x91\xB5\xA9\x23\x52\x7A\x88\xF0\xAD\x6A\x5B\x73\x5C\xF2\x57\xE9\x00\x46\xFC\x77\xAB\xCE\x8F\x53\xD6\x8B\x9D\xAB\x35\xA5\xE0\xA4\x34\x18\x9C\xFD\x22\xBF\xDA\xB4\xC2\x0C\xA9\x73\x46\x44\x8D\x71\x9A\xCD\xC7\x65\x43\xC5\x50\x99\x90\x94\x7F\xF5\xB8\x77\x66\x62\x8B\x08\xBE\xE0\x02\x62\xB6\xF2\xFB\x79\xD9\x25\xE9\xA9\x86\x5F\x1B\xFA\x1E\x45\xDB\x0F\xF9\x03\x3B\x7A\x98\x0A\x88\xCB\x12\x24\x60\xCA\xAB\x8F\xF7\x9D\xA5\x77\x67\xCB\x5B\x73\x93\xB9\x35\x9C\x16\xB1\x68\x19\x30\x10\x91\x9B\xCC\x22\x9C\x16\xE3\x71\x5A\x4C\x1B\x41\x6E\x58\x09\x35\x6D\x04\x39\x6E\x36\x68\xCB\x41\xFB\x0B\x2A\x95\xDC\x2F\x22\xF2\xC4\x72\x66\x83\xE3\xC6\x89\xCE\xDB\x8D\x33\x6B\xB4\x80\x5D\xDC\xA8\x26\x2E\xA0\x93\xCA\xB1\x39\x86\x23\xD3\xD4\x09\xD3\xC6\x34\x75\xBC\xA2\x03\x3E\xAC\xB4\x0D\xC4\xCE\x36\xED\x75\x82\xD7\x49\x77\x9D\xE3\x75\xEE\xAF\x8D\x2B\x51\xB1\x9F\xC0\xD8\xD9\xA6\x1E\x9F\x22\xD3\x56\x81\x12\x60\xEC\xF4\x66\x65\xA4\x26\x5F\x4F\xFB\x95\xC5\xAF\x0A\xB7\xDD\xD4\x45\x81\x93\xAA\xF3\x31\x49\xDC\x0E\xA7\x03\x71\xB6\xFC\xF0\xE3\x02\xB0\xA3\xF5\x31\x0E\x40\x8C\x78\xBC\x33\x1E\x4A\xE4\xCE\x99\xF1\xD6\x19\x64\xBD\xC1\x8E\xE8\x1D\x1E\x6F\xCF\x7B\x3B\x09\x2E\xFB\x1D\xAF\x19\xDC\xAE\xBA\xBC\x29\xBF\xF0\x78\x8B\x2A\x44\x01\xF7\x31\xBD\x54\xC9\x57\x3B\x3B\x47\xCE\x50\xD5\x71\xF7\xC5\x8D\xEE\x8B\xC1\xFD\x9D\x4B\x1E\x8E\xA8\xE0\x28\x40\xEB\xA3\x00\x45\x80\xF0\x91\x20\xE9\x1F\xC1\x22\x23\x5C\x2B\x8D\x20\x5B\x45\x35\x88\xFD\x5F\xA2\x55\x5D\x12\xA0\xED\xCB\x36\x24\xA2\x2D\xC5\xFD\xC2\x68\x45\xDB\xA6\x97\xA5\xE2\xD1\x0D\x92\xBB\x24\x84\x1F\x73\x6A\xE3\x7C\x6D\x70\xFA\x1B\xCE\x0F\x5F\xC5\x28\x46\xF1\xBF\xD3\x53\xB2\x4F\xE8\x4D\xC8\x7A\x1B\xB8\x88\x55\x75\xE4\x9D\x2A\xE2\x0D\x9C\xF2\x1B\x38\x45\xAA\x7A\x44\x27\xDA\xB4\xCF\xE7\xBD\xD0\xED\xE3\x1D\x2D\x80\x60\xD8\x73\x0B\x17\xF1\x9E\x3D\x82\x88\xF6\xEC\xD1\x82\x2D\x5C\xE4\xB7\x70\xD1\x4C\xA4\x66\xD4\x45\x6A\x7A\x9C\xE9\x05\x2B\x5A\xC0\x2B\xDA\x70\x03\x17\xCD\x6E\xE0\xFE\xD6\x3B\x49\x50\x9A\xCE\xCE\x49\x02\x25\xE0\x93\xAD\xA2\xFA\x1E\xAD\xD5\x96\xDE\x46\x0D\x1F\x25\xB7\x22\xB1\x6D\x5B\xB1\x1D\x4A\xA6\x73\x2F\xB6\xED\x55\xCE\x92\xDC\xBE\x6D\xB7\x6A\x7B\xB5\x8E\x20\x6C\xEA\x10\xA2\xB5\x6B\xC7\xE1\x09\xB0\x17\xC9\xE8\xF8\xE8\x25\x08\xAF\x5D\x6E\x8B\xE2\x24\xA2\x5D\xBE\x65\xFC\x82\xD5\x6F\xE3\x14\xDB\xF5\x43\x2C\xD6\xFA\x46\x5C\x6D\x6A\x03\xE1\x6C\x91\xA6\x57\x64\xE8\x93\x33\xB7\x29\x95\xB8\xB9\xBE\x14\x6C\xDC\x71\xB8\x02\xF6\x6A\xAD\x20\x6A\x70\x1F\xB8\x76\xED\x22\x6E\xD5\x9A\x5A\x81\x5E\xBB\x76\x11\xCB\x56\xBD\x12\x25\xDD\xB3\xF6\x25\x2A\x4E\x55\xF7\xCB\xD6\xE8\x6D\xB5\xA5\xBC\x3A\x7F\xA4\xA7\xCD\x83\x76\xE6\x4C\x11\xB8\x8F\xBD\x7B\x10\x77\xA3\xC1\x9C\x2D\x02\xF7\xCC\x5B\xFA\x77\x65\x89\xDB\x7E\x0C\x34\xBB\x64\xE9\x06\x15\x87\x93\x0C\x87\xD4\x38\x75\xC1\xA9\xE6\xDA\x71\xB3\x55\xC7\x94\x46\x57\x83\x85\xF8\x6A\x9D\xD0\x1C\xAB\x23\x64\xF7\x33\x53\xA4\xA4\xDF\x20\x78\xA1\x68\x39\xAD\xB1\x60\xF7\xB9\xB2\xFC\xF6\x4B\x9D\xFB\x1E\x6D\x8D\x28\x02\xF4\x9F\x5F\xEA\x09\x3E\xFF\x6D\xC4\xF9\x8F\x86\x22\x47\x4A\xE3\xAF\x21\xEA\xBE\x5E\x74\xA4\x10\xBA\x23\x6D\x42\xDF\x09\x5E\x5E\x7E\x5B\x7B\xEE\xFC\x31\x3B\x38\x77\xBE\x32\x3C\x77\xFE\xCC\xB7\x5C\xDE\x09\xDC\xA1\x5B\x39\x77\x2E\xFF\xC5\xE3\xBE\x36\x29\xBE\x94\xE2\x97\xE6\x8A\x47\x1D\xE9\x8B\x51\x03\x40\xE8\x3E\x63\x57\xF5\xBD\xF3\x35\x40\x5B\xC3\x47\x6E\xBF\x86\x0F\xC4\x9D\x9F\xE7\x1C\xC2\x4F\xC7\x1F\x56\x38\x84\x21\x04\x22\xE6\xB3\x7F\xDF\xE3\x33\x88\xDC\x8D\x1B\xE6\x8C\xB3\x9B\x75\x8C\xEB\xF2\x79\xB2\xD4\x97\x17\x68\x81\xB2\x6B\xD3\x3A\x76\x3B\x7A\x8D\x40\x72\x20\x75\xF6\x3C\xD0\x5B\x17\x20\xC1\x27\x65\xFB\x40\xF3\x03\x2B\x0F\x2C\x3E\xA0\x3B\x5A\xEE\xA8\x33\x35\x2E\xFC\x90\x5C\x68\x70\x1D\x88\x85\xFB\x68\xE9\x74\x0A\x62\xAA\x1E\xA2\x53\x9B\x04\x23\xE7\x9F\xEE\xEC\x94\xBD\xE7\xD1\x29\x5C\x46\xAA\x38\xB7\x19\x3E\x5A\xA6\x85\xE7\x5B\x76\x76\x96\xD7\x0A\x43\xCB\x29\xE1\x8A\x24\xED\xDA\x6A\x73\x43\x01\x2B\x17\xEA\xC4\x05\x90\x40\xDC\x60\x21\x6B\x53\x81\x59\x88\xD9\x74\x19\x54\x09\x99\x53\xBE\xA4\x2C\x47\xCB\x96\x9F\x2E\x23\x9A\x6A\x09\x27\x98\x4B\x5C\x50\xA5\xCE\x23\x5D\xC5\x7D\x25\x25\x18\xDC\xC0\x49\x96\xF1\xAB\x38\xAD\x46\xC0\xFE\x96\xB5\xE6\x8C\xBB\x55\x0E\x64\x65\x91\xAB\x14\xA2\xDE\x95\xEE\xF9\xE9\x92\xBE\x93\x43\xEC\x82\xF2\xFD\xFE\x84\x23\x45\x32\x75\x97\x1A\x07\x8E\x2F\xF9\x24\x62\xD0\x2C\x4D\xD0\x8A\x8A\xE0\xEC\xEB\x80\x6B\xA8\xE9\x9C\xBA\x7C\x9F\x3F\x8D\xC1\xE7\xFE\x51\x01\x41\x43\xDA\x63\x0C\x66\xBD\xA6\x64\x98\x63\x47\xFE\x6E\xAD\xE2\x0D\x29\x14\xD4\x84\xB6\x80\xA2\x2B\xA0\x6A\x93\x6C\xCE\x7D\x46\x00\x84\x4E\xF3\x67\x55\xCC\x7B\x98\xE1\xE1\x23\x1F\x91\x40\x2A\xB6\xC5\xF2\x5F\xD1\xC2\x9C\x56\x29\xE4\x55\x82\x7D\xCB\xE6\xA5\x51\x5A\xA5\x19\x8C\x16\x9D\x53\xA6\x27\xD8\xF9\x7B\xCE\x72\x73\x62\xF1\x51\x69\x17\x59\x08\x49\xF6\x07\x5F\xC4\x35\xE0\x8B\xB9\x0E\xCC\xAD\x02\x3A\x0F\x79\x15\xC0\x59\xD6\x2D\x04\xC4\x7A\x36\x1B\x08\x7E\x54\xFF\xF5\xBC\xF0\xC7\xD7\xBE\x22\xC4\x6F\x41\x2A\xF4\x57\xC7\x27\x2F\x11\x32\xEC\xE2\xA5\xB4\x3B\xC9\x5F\xE0\x1E\x40\x3E\x0F\xDD\x12\xAA\xB3\x97\x06\xBD\x20\x56\xF6\x80\xEB\x47\xBC\x5E\xD7\x8C\x56\x41\xD6\xC3\xB0\x35\x1D\x86\x43\x4C\xBF\xB0\x87\x5B\xC1\x90\x7B\xBB\xC7\x93\xCE\x1B\x01\x27\xD9\xE0\xA3\x89\x1C\xC5\x5A\x1F\x39\x31\xFF\x68\x61\x52\x48\xED\x93\x42\x72\x42\xC8\xB9\x33\x60\x9F\x3E\xC3\x9F\xC2\x72\xB0\x0A\x68\x09\x3B\x5B\x07\xCB\x2E\xAC\xB5\xC6\xD9\x11\xF0\x79\xB8\x85\xC0\xA9\x33\xD2\x0C\xE3\x96\xC9\x1B\xDD\x96\x9F\x62\x42\xB5\x14\xA8\x95\xDB\x01\xB6\x8B\x32\x59\x94\xBB\x4E\xD7\x59\xF6\xEF\x92\x2E\x2E\xFF\xFD\xBA\x17\x67\xD1\x3B\x2D\x0F\xF9\xB4\x3C\xEC\x4E\xCB\xAB\x48\xCE\xE5\xC9\x7F\x5F\xCE\xC3\x05\xB4\x3F\xDA\xCD\x88\xBB\xD0\x52\xEB\x55\xB0\x3D\x8C\xB8\xF1\x8B\x30\xE2\x9A\xAC\xC3\xC3\xF8\x92\x9D\x2F\x74\x26\xB6\xEE\x7C\x81\x6D\x6C\xEF\x9B\xF3\x0C\xBA\xE9\xF9\xC2\x4D\xD0\x8A\x17\xC4\xE8\xB7\x78\x04\x7D\xD0\x49\x9D\xF5\x26\x26\xF1\x63\xBC\x0B\x3F\xCA\x3E\x74\x51\x04\xEB\x2E\x9F\x29\xFE\x8C\x01\x10\xB4\xFF\x5A\xCD\x7C\xFD\xE5\x4C\xDE\xB2\xA3\xEE\x97\x73\x37\x5A\x83\x36\x3B\x13\x76\x52\xF4\x2F\x1E\xE7\x85\x3A\xEC\x1D\xF5\x84\x8B\x8E\x7A\xC2\xE1\x51\x4F\xB8\xF0\xA8\x67\x06\x7F\xA0\x3B\xF7\xF9\x51\x14\xCD\x73\x8A\x3D\xBB\xF6\x25\x6D\x73\xC8\x09\xB2\x93\xEB\x74\xC9\x3E\xD4\x9D\xAB\x58\x52\x9B\xF3\xBC\xBE\xF7\x7C\x98\xFF\x7A\xF6\xC9\xC1\xE3\x9B\x8E\xCF\x64\x38\x3C\xB7\x0C\xB3\xB1\xC0\x50\x6E\x6E\x09\xEA\x74\x7F\x0F\xB0\x81\xBD\xC3\xF1\x56\x30\x7F\x4B\xCF\xDC\xFA\x4E\xD5\x41\xDD\x1E\x69\xD3\x19\x83\xC5\xE1\x5A\x6E\xEA\x10\xB4\x5B\x6E\x0E\xE9\xE0\xA8\x91\x9B\xD0\x20\x73\x7A\x93\x23\xDD\x2A\x1B\xCA\xD4\xD4\x7F\x2B\xC1\x5B\x89\xBF\x15\x3A\x43\x2F\x83\xA6\x1B\x89\xB4\xD5\x92\x67\x8F\x38\xB3\xDB\x76\xE1\xFE\x9B\x6A\x93\xBE\x9D\x36\x7D\xBB\xD1\x76\x5B\x5D\xEC\x0C\xCB\x72\x8A\xB3\x57\x06\xFB\xD6\x97\xA3\x36\xDD\x39\x8E\xC0\xF9\x72\x5A\xF6\xCA\x1A\x09\x2C\x0E\xEA\x90\x4D\xF2\xA3\x47\x0B\x63\x08\x6E\x8C\xD2\xA2\xB9\xD1\x23\x35\xDE\x3C\x51\xA0\x46\x99\x79\x3B\xAF\x75\x29\x3E\xD6\x6E\xBB\xA9\xB5\x4F\x7B\x9E\x71\xC2\x79\xDB\x50\x44\x71\xE6\xFE\x64\x88\x62\x42\xF8\x86\x81\xFB\xD6\xF7\x0C\xB1\x4D\x66\x3B\x74\x5B\xE9\xBB\x9C\x9A\x4B\x74\x8F\xF3\xA6\x57\x05\x98\x0F\x82\xFA\x60\xF9\x6D\x78\xF1\xEE\x3A\xFA\x07\x41\x70\xFD\xC6\x8D\x1B\x7F\xEC\x5E\x27\x51\x76\x78\x07\xFF\xF7\x59\xF7\x4F\xDA\xDF\x41\xF0\xF5\x6C\x7B\xFC\x11\x32\xA0\x50\xDF\xDC\x36\xD1\x04\xCC\x34\xBB\x1A\xAB\xE4\xF6\x34\x8F\x9E\xAE\x01\xDA\x7D\xCB\x8E\x5D\x2B\x02\xF7\xA1\x67\xE6\xCD\x4A\xFD\x34\x66\xBB\x58\x34\x4D\xFF\x8C\xCE\xE0\xE8\xC6\x33\xA3\x1B\xF9\xD1\x4D\x68\x74\x63\x42\x70\xE7\x6D\x93\x8C\xAE\x04\x30\xA5\x38\xBA\x69\x6F\x74\x63\x1C\x5D\x0A\xC8\xE2\xF0\xFE\xED\x06\x77\x1D\x34\xBA\x09\xF9\x43\x59\x48\x64\x74\x87\x02\xC1\x6D\x57\x69\x1B\x56\x8A\x23\xC1\x7B\xEC\x6D\x82\x32\x31\xA0\xCB\xFF\x85\xB6\x30\x8A\xA1\x00\x86\x82\xDE\x92\x6E\xE4\x74\xF9\x13\xA4\x25\xC6\x38\x35\x62\x41\x3C\x9E\x23\xC8\x82\x85\xDD\xC8\xC2\x1E\xCF\x21\x60\x50\x43\x5C\xF0\xF7\x54\xE0\x54\x95\xB6\xF1\x0E\xEC\x82\x18\xB3\x1A\x4C\x6B\x8C\x21\x8F\x61\xEF\xF8\xE7\x57\x1E\x43\xC9\xBE\xBD\xFA\x4A\x5B\xBB\x8C\x62\x53\x51\x7B\x5C\xD1\x07\x85\x83\xD4\x09\xF6\xA9\x25\x9E\xFF\xF8\x90\xBB\xDB\xC1\xFE\xAE\x67\xFA\x2C\xE9\x2E\x36\x55\x26\x01\x66\x34\x16\x84\xF8\x02\x6A\x6D\x76\x91\xC5\x31\xD3\xC3\x45\x16\xB7\xCE\x4A\x96\x59\x8A\x8D\xC6\xC6\x6B\x71\x22\x8B\xF8\xA3\xC4\xA9\xCD\x06\xA2\xBF\xA7\x08\x4C\x1A\xFF\x23\x5C\x7C\xA6\x51\x53\x25\xFA\x18\x73\x06\xE3\x13\x93\x6B\xA7\x17\x11\x55\x04\x39\x23\xF0\xC7\x64\x26\x22\xB0\xFE\x2A\x82\x04\xDB\x9C\x30\xB0\xA3\x53\x55\x44\x20\x92\x48\xF6\x14\xEF\x16\x41\xC6\x38\x0F\x3A\x83\x51\x4B\xF8\xD9\x13\x10\x4A\xAE\x9E\x0D\x83\x91\x91\x47\x32\xBF\xA8\xC7\x7B\x2D\xEA\x34\xCC\x37\x59\xD4\x7B\xEB\x38\xA4\xD9\x0F\xEC\x33\x6A\x5B\x5D\x4C\x7A\xAB\x79\xDC\x6D\xF7\x8B\xC0\xFD\xC9\x70\xB4\xAC\x1F\xAD\x8F\xCE\x24\xD1\x5F\xF4\xEA\x02\x61\x86\xF7\x45\xD4\x88\x24\xA9\x8F\xBD\x1B\xF4\x07\xDF\x55\x27\xDF\x23\x37\x5E\x70\xFF\x84\xFC\x2C\x9F\xA1\xF9\x82\xDB\xFB\x9D\x37\x11\x01\xF8\xA4\x0C\xDF\xDA\x7C\xE4\xF2\x77\xB9\xAF\x97\x4C\x0B\xF5\xC8\xDD\xB8\x71\xE3\x46\x7C\xAA\xE7\x2D\x7A\xDB\x29\x3C\x06\x8F\x17\x28\x0F\x14\x58\x17\x0F\xE0\xAD\x72\x67\x21\x9E\x81\xB7\x8A\x77\x87\xB7\xCA\xE6\x95\x87\xAC\xA7\x3C\x50\xC0\xC1\x60\xE3\xD4\x5A\x50\xB4\xB3\x32\xF1\x0B\xD6\x8F\x68\xA3\xA7\x9D\xD9\xA8\xC6\x02\x26\xAD\xDB\x33\x4F\x85\xF2\x09\x17\xB6\x8B\x1B\x94\xB4\x6B\x02\x45\x95\x9B\x63\x90\xE3\x74\xCD\x5E\xA1\x68\x7A\xE4\x90\xB9\x8B\x8D\xBF\x70\xB6\x81\xCC\x6D\x75\xD7\x39\x5E\xEB\xEE\xBA\x6C\x70\x66\xB8\x04\x0B\x2E\x61\xE2\x6C\x53\x4F\xF8\xD0\x73\xCC\x48\xA1\x13\x9C\x4C\x55\x06\x05\x4C\x68\xF6\x50\x85\x6D\x6D\x58\x56\x95\x51\x3D\x55\x0E\x63\x14\x99\x63\x89\x12\xFC\xE2\xE5\x5B\xC9\x17\x1E\xA4\xE5\xAE\x97\x6F\x05\x32\x18\x41\x06\xE9\x83\xD3\x3A\x83\xFC\x64\x61\xBA\x43\x34\x05\x19\xE4\xAF\xC6\x3B\x90\x41\xD4\x66\x5A\xD1\x7F\x13\x0C\x35\x19\x32\xD4\x64\x96\xA1\x76\xD3\x46\x6F\x91\xA1\x6C\xB7\x82\x60\xD7\x86\x39\x63\xFA\x90\x35\x7A\x81\x70\x6E\xA7\xFB\xD3\x7D\xE1\x4C\x0A\x53\x0E\x05\x2B\x37\x99\x44\xCA\xFB\xE3\x9A\x0C\x75\x0E\x3E\x1E\xD6\x6E\xAB\xF1\xB0\x1E\x45\xE3\xDE\xD4\x54\x63\x7C\x64\xC4\x5F\x9E\x6C\xB4\xB6\x7C\x2F\xF1\x76\xE9\x7D\x87\x35\x64\x9C\x06\x29\x93\xEC\x30\x38\x6E\xA7\xBB\x8D\xC1\x8B\x43\xC8\x15\xD7\xD9\x74\x21\xBB\xA4\x7D\x27\x49\xC8\x29\x49\x4E\x0E\x9A\x20\x33\x34\xA4\x0B\x5C\x17\xF8\x9D\x94\xDD\x17\x74\xCB\x3A\xDA\xFB\xD0\x7A\x82\xFB\xE2\x4E\x14\x56\xE8\xA7\x81\x08\x07\x25\xBB\x46\x92\x1D\x35\xE7\x14\x3B\xEF\x62\x5B\x10\x15\x4F\x74\xCC\x09\x76\x88\x48\xF6\xC5\xA3\x44\x79\x8B\x94\x28\x33\xC8\xAA\x11\x94\x80\x93\x3F\x7F\x70\x5A\x97\x0B\x29\xC1\xEF\x08\x25\xCA\x96\x12\x25\x53\xA2\x6C\x29\xE1\x8B\x6B\x29\x41\x8B\x6B\x03\x5A\x5C\x44\x27\x6C\x44\xBF\xD8\x54\x63\x98\xE0\xFA\x3A\x61\xB6\x40\x96\x40\x9E\x60\x1D\x83\x5C\x04\xF2\x1E\x26\xF3\x6C\xFE\x96\x6C\x17\x1D\x39\x9B\x39\xE8\xCE\x66\x0F\xBA\xF3\x99\x83\xEE\x7C\xEE\xA0\x3B\x3F\x33\xAD\xF2\xB9\x83\x6E\xBE\x3B\x3C\xE8\xCE\xE7\x0E\xBA\xE7\xDF\x02\x7E\x6B\x70\xD0\xED\xDF\x1A\x1E\x74\xD3\x5D\xEA\xBA\x4B\xCF\x41\x2E\x07\xDD\x9E\x19\xF2\x5D\x98\x81\xD2\xF5\xE4\x7B\x31\x43\xCE\xCC\x30\x17\x42\x10\xCC\x84\x10\x50\x69\x19\x4F\x5D\xCA\x5A\x35\x9E\x73\x47\xC8\x60\xCC\xEE\x08\xAD\x24\xBD\xC7\xA7\xAC\x8A\x7A\x1E\xE5\x21\x44\xDE\xB4\x50\x2C\x08\xDF\xEA\x36\xCF\xFF\x36\x51\xA3\x6D\x56\x4A\xC5\x61\x9D\x0E\x0D\x51\x5A\x5D\x7B\xCF\xDC\xFE\xC0\xBA\x14\xB7\x63\xFF\xF4\x1C\xD8\xA6\xB6\x04\x59\xA0\xC8\x27\x9F\x4C\x59\x9C\xEA\x1A\x0C\x84\x0D\x8D\x3B\x7B\x80\x98\x63\xB2\x4D\x3B\x51\xF0\x01\x8C\x77\x01\x89\x7D\xEE\x6B\xF1\x04\x89\x21\x3A\x89\xCA\xDD\x36\x6A\x8C\x10\xAD\x4D\x27\xD9\x4C\x8E\x6D\xC2\x26\xF2\x35\xB5\xC9\x61\x24\x80\x38\x05\xBB\x8E\x9B\x09\x14\xA8\xDF\xFF\xEE\x01\xBE\x42\xEA\xEC\x19\x86\x93\x69\x97\xFD\xD4\x6D\x37\x63\x1B\x28\x6D\x42\xDC\xCA\x8C\x1E\xA9\xAD\xBB\x70\x0E\x22\xD4\x38\xAD\x3F\xE4\xF8\xDD\x00\x6F\xBF\x63\xBB\x77\x9F\x3C\x06\x3F\x1D\xE3\xFD\xB7\xBF\xA9\x77\x9F\xFC\xA4\x9E\xFC\x65\xFA\xE0\xB3\xFF\xAA\xFF\x45\x0F\xEC\x26\x75\xDF\xDC\xAF\xF4\xA9\xB7\x44\xF8\xFA\x0B\xFF\xE9\x9B\x66\x2B\xB8\x7E\xF9\xBF\xC1\x27\xD7\xFF\xE2\xF8\x6C\x15\x84\xB6\x5E\x5B\xB7\xF3\xB1\x77\x7E\xF3\xA0\x12\x7C\xF6\x91\x7F\xF7\x0A\x7A\xF6\x53\x4F\x3F\xDC\x3D\xCB\x38\x70\xC2\x0E\x9D\xBA\x3A\xA2\xD6\x96\xE8\x4E\x64\xB7\x4C\x76\x5E\x5A\xAC\xA0\x7E\xB9\xAD\xA6\xD6\xBC\x71\x8A\xD9\xAE\x6C\xB0\xC0\x11\xD9\xD8\x51\x21\x31\xBE\xB4\x4A\xE3\x96\x6E\xAD\x62\x8A\x57\x39\x75\xB8\x2A\x0C\xEF\xF0\xB1\x09\x42\x88\x6C\x7E\x8C\x72\x54\x38\x3D\xD0\x1B\xD2\x6A\x1C\x86\x48\xA9\x28\x03\xCB\xE9\xFB\x2F\x20\xD7\x55\x63\x88\x2A\x9B\x13\xCA\x35\x0E\x4F\x44\xC3\xD3\xDE\x37\x78\x1F\x87\x27\xA2\xE1\x69\xEF\x6B\xBC\x4F\xC3\x13\xF1\xF0\xB4\x4F\x06\xCA\x60\x31\xA6\x3A\x2D\x55\x4A\xC3\x13\xF1\xF0\x0C\x2B\xA6\xE1\x89\x78\x78\x86\x55\xF3\xF0\x44\x32\x3C\xC3\xEA\x79\x78\x22\x19\x9E\x5E\x03\xF0\xD9\x5B\xFF\xE8\x93\x86\x1E\x8A\x8F\x8C\x3C\xCD\x70\x04\x61\xCC\x28\xAA\x5A\x46\x0B\x62\x48\xCE\x35\x75\xDC\x8D\x5A\x4C\xA3\x26\xF3\x48\x62\x20\x54\x15\x77\xA9\x1E\x48\x26\x74\x03\xAE\x20\x39\x57\x13\xDA\x12\x84\x14\x24\xC1\x47\x2B\x41\x2F\x59\x3D\x23\x00\x70\x46\x35\xCB\x49\x2A\x64\xBA\x6A\x8E\x36\x35\x2E\x78\x70\x92\x49\x03\xCC\xDA\x34\x7B\x5A\x77\xA6\x2B\x68\x73\xF0\x3B\x81\x13\xE2\x93\xE7\xD7\x90\xBA\xE5\x4F\x27\xEB\x00\x82\xA6\x36\x10\xAC\x15\x0A\x90\x8B\x94\x1C\x35\x06\x6E\xFB\xB1\x33\xEC\xB4\xD8\x30\xD6\x26\xF8\x5D\x95\x21\xF6\x6C\xCF\x15\x35\x1D\xCB\xCD\x9D\x2B\xEA\x17\x71\x26\xD7\x15\x5F\x82\x5E\x7C\xAE\xA8\x5F\xDC\xB9\xE2\xBF\xB5\x2A\x66\xA1\x6B\x21\xA4\x3D\x37\xCA\xDB\x0F\xFF\xE0\x8C\x76\xB8\x8F\xCE\x75\x29\x3B\xCA\xCC\x93\xF2\x4C\x8B\xC4\x6F\x21\x64\x5F\x44\x8F\xD2\xDF\xD4\x91\x53\x17\xEA\x98\x4A\x96\x4A\xE2\xF5\xDA\x42\x78\x96\x04\x36\x99\x24\x37\x9D\x3D\x5F\x27\x7C\x8A\x5E\xA7\x9C\xA9\x93\x14\x85\x14\x92\x06\x42\xB0\xAD\x9B\x0F\x7D\x61\xE7\xBE\xF0\xEF\x6B\xFE\x02\x5B\x41\x5F\x70\xA8\x2C\x3E\x31\x78\xB3\x29\x7F\x80\x6D\x24\xE2\x67\xDB\x2F\xC4\x4A\xFB\xC9\x2B\x44\x3E\x47\x49\x82\x57\xF2\xDD\x84\x20\x15\xA9\xC0\x3A\x11\x67\x02\x03\xB8\xF1\x26\x9F\x4F\xE4\xE3\xA6\x1E\x71\x07\x53\x5F\x15\xA7\x97\xB0\xD2\x3C\xF9\xAC\xCA\xA8\x41\x71\x43\xD0\x44\xBC\x73\xC2\xA7\x4D\x9D\x43\x88\x9F\x87\xF2\x79\x80\xF7\x12\x30\x40\x1F\x38\xB3\x89\x9D\x13\x72\x50\x37\x52\xA1\x45\xD6\x76\x63\x04\x39\x58\xC8\x90\x78\x5D\x37\x22\xB7\xB5\x51\x1B\x6A\x84\xC5\x07\x4D\x5B\x43\x42\xD4\xFA\x41\xB6\xD5\xF7\xE8\x12\xCE\xD0\x25\x24\x24\x9F\x1E\x5D\x4C\xAF\x00\xC3\x05\x64\x5F\x08\x07\x5E\x40\x51\x2F\x3E\xE4\xA6\xBC\xC5\x4E\x33\xCC\x5E\xBF\xF1\xAE\x05\x0B\xFD\xCE\xCE\xCE\xF2\x19\x39\x13\xBE\xAE\x98\xDF\x90\x4D\x90\x37\x88\xDF\x9C\xAA\xE2\xDC\x64\xBE\xB1\x10\xB5\xDE\xAB\x75\xC2\x99\x05\x12\x7C\x19\x09\xCE\x43\x70\xCF\x3C\xBE\x21\x95\xA1\x5B\xC6\x4D\xC9\x53\xA7\xCF\xB8\x89\x67\x5C\x5C\xBC\x07\xCC\x3B\x12\x6A\x71\x36\xAF\x84\x53\x4B\xC2\x88\x99\x97\xCF\xD1\x55\x6E\xB3\xF6\x3B\x3B\xF7\x9D\xFF\x4A\xF3\x77\x38\x28\xF4\x1D\x3B\x42\xCB\xC3\x3E\x17\xB7\x65\xA5\x32\x62\xA3\x99\x11\x1B\x35\x14\xA6\x2A\xA5\x68\x1A\xB4\xA4\xFB\x9C\x3B\xCB\xA5\x48\xED\xF5\xA8\xE5\xEA\x51\x8F\xAB\x47\xC8\x96\xD4\xFB\xA2\xE5\xEA\xA4\xCF\xD5\xA3\x01\x57\x27\x33\x5C\x3D\x6A\xEA\x31\x84\xF8\xF9\xA4\xE5\xEA\x11\x4E\x94\x59\xAE\x96\x96\xAA\xB6\x67\x85\x50\xC9\x4A\xCF\x42\x8A\x1D\xC5\x61\x84\x02\x26\xED\xFB\x80\x34\xD8\xDA\x90\xE6\x84\xF8\xAC\xA9\x3D\x7B\x8E\x20\xF4\xEC\x49\xE5\x86\x3D\x8A\x99\xB6\x5C\x8A\x76\x03\x83\x14\x4B\xFA\xE5\xE2\xF0\x75\xE5\x58\x29\x47\x91\x53\x98\xA3\x78\xF6\xA8\xF3\xA8\x89\xB3\xFF\x47\x69\xB3\xAD\xB7\xDC\x15\x14\xB3\xEC\x0E\x65\x78\x91\xC3\xF5\x2B\x84\xE0\x91\x4A\xBB\xB7\xD2\x43\xD3\xC3\xB6\x63\x43\x30\x32\x37\xE8\x75\xDC\x0C\x3A\x35\xC9\xC0\x5E\xAB\x22\xA7\x2A\x65\xBC\x69\x88\xF2\xE0\x99\x6B\x9C\xD8\xD4\x5C\xAB\x63\x50\xD7\xB6\x20\x7A\xFC\x6A\xC5\x90\x77\x6B\x15\xC1\x2D\xF1\x2D\x42\x89\xBC\x20\xD1\x87\xB9\xCE\x32\x2C\x0A\x42\x5C\xDD\x82\xDB\x2E\x5A\x9D\x59\x5C\x34\x2D\xBD\x2A\x7B\x9B\xD5\xD1\xB6\xD9\xC2\x45\xF5\xF5\xE4\xF9\xEA\x9E\xBF\x3A\x63\x09\x54\x4E\x35\x63\xA3\x02\x15\x64\xEE\x3B\x67\xAD\xC2\xA8\xE5\xBB\x4F\x0F\x3C\x8D\x1C\x6E\xF8\xD4\x85\xDA\x38\x5B\xFE\xD4\xE3\xAD\x2B\xD0\x24\xEB\xD3\x36\x24\xDA\x92\x61\x3E\x46\xDA\x26\x42\x5B\xBA\x5F\x85\x3D\xDA\x42\x74\x8D\xAC\xCA\x31\xC5\xBA\x93\xD5\x42\x21\xF7\x77\x34\x48\x98\x06\xE1\x35\x0E\x81\x0E\xAF\xD5\x23\xA2\x41\xCA\x34\x48\x90\xBC\x31\x8C\x60\xC4\xB7\x42\xFC\xE0\x42\x95\x10\xF8\x04\x92\x97\x6A\x20\x1A\xC7\x44\xE3\xDB\x29\x5A\x9D\x59\x5C\x34\x91\xD7\x82\x5A\xD5\x28\x64\x23\xDC\xFE\x5A\xDA\x3C\x23\xA5\x9D\xE6\x5A\x70\x17\xA2\xF0\xBF\x33\xD3\x3A\x24\x14\x70\x49\x8C\x16\x38\x4B\x56\xC2\x6B\xD5\x08\x17\xE9\xA6\x4A\x20\x74\x5F\xB8\x71\xE3\x46\xBC\x51\x29\xA7\xAA\x10\xDF\x23\x93\xFB\xC5\x06\x42\x0A\x7E\x80\xF0\x1A\xB7\xA2\xCE\xFE\xBE\x04\x47\x54\x09\x0A\x24\xBE\x87\x6D\xA3\xF5\xAF\xA9\xE3\x53\x45\x90\x41\x76\x95\xD2\xE1\x91\xCB\x07\x07\x4E\xE0\x0C\x4C\xD8\xAE\x9D\xBD\x55\xDF\x74\x36\x38\x73\xB3\xD9\x40\x3C\x3A\x98\x12\xB3\x23\x76\x2B\x13\xC2\x2E\xE0\x5A\xEB\x47\xCC\xCF\x02\x94\xE2\xC3\x11\xBB\x95\x09\xB1\xB0\x68\x51\x6E\x95\xB8\xF4\x48\x86\x1D\xFC\x9C\x5E\xFD\xFB\x3A\xC9\xFE\x20\xB4\x29\x05\x52\xD2\x84\x51\x0B\x26\x8C\xFB\x25\x9C\x0A\x2D\x35\x4A\x6C\xDB\xDB\xDE\x75\x99\xA3\xE2\x71\xAD\x2C\xD7\x08\xDE\xD9\xBF\x4E\x7B\x19\xAC\x0E\x54\xEB\x3C\x6B\xC0\xB8\xE4\x3C\xE5\x69\x2B\x2F\x80\x12\xE7\x59\x43\xCE\xB3\xE1\xB4\x8E\x20\x72\xF6\x3C\xD0\x5B\x17\x20\xC4\x27\x65\xFB\x40\xF3\x03\x2B\x0F\x2C\x3E\xA0\x3B\x5A\xEE\xA8\x33\x75\x88\x8B\x51\x48\xCE\xB3\x54\x17\xEA\x78\xEB\x75\xB8\x59\x27\xEC\x1D\x9B\x96\xDF\x75\x49\x92\x14\x25\x6E\x1B\x74\xF9\x9D\xA4\x4A\x8F\xC4\xC9\x85\xF6\x67\x72\x0C\x7A\xBA\xE0\xE5\xAD\xB2\x10\xD0\x06\xDD\x40\x02\xA3\xF2\x03\xB2\xD2\x10\xE0\x60\xB6\xE6\xAD\xC8\xA8\xE1\x71\xD9\x45\x30\xEF\x13\x39\x23\x21\x9A\xAF\xA2\xE8\x7C\x45\x2D\xF8\x0E\x8A\x59\x29\x90\xA7\xB8\x59\x84\x54\x79\x66\x4A\x86\xCA\x89\x39\xE6\x54\x65\xA1\xA8\x42\x98\x30\xEC\x18\xFB\xF1\xCB\xCC\x2D\x65\xE6\x96\x60\xAF\x6D\x41\xFE\xF8\x55\xDC\x0D\x21\x25\xAA\x08\x4A\x28\xF9\x56\x48\x84\xA8\x0C\x9F\x00\x05\x30\x81\x78\x53\xF6\xA4\x16\x3F\xA5\xD7\xAA\xF2\xB8\xAA\xF6\xB9\xA0\x0A\xA9\xAB\xFB\x8E\xDF\xB8\x71\xE3\xC6\xE4\x52\xBD\x0F\xCC\x57\xE9\x00\xDF\xF8\xFB\x12\x41\x84\x83\xF1\x55\x1A\x67\x42\xBD\xBF\xBB\x4F\x68\x1B\xFB\xA4\xAC\x7D\x50\xC2\x7E\x69\x0F\xEE\x9A\x70\x91\x49\x91\x56\x94\x43\xBA\x9E\x00\x47\x2C\xE1\x0E\x96\xC2\xB1\x90\x57\xE6\xA9\x06\xE9\x70\x88\x14\x4E\x33\xDB\x8D\x4E\xEA\x43\x9D\x90\xFA\x7E\x64\x70\xD2\xD6\x81\x8C\xCC\x02\xEF\x54\xB0\xD9\xE7\xC2\x28\x21\x56\x57\x5B\x6A\x5B\x7F\x91\xD8\x5D\x1F\xBB\x65\x46\xB7\xD3\x3A\x84\xB0\xC7\xE8\x56\x18\x5D\x1E\x74\x8C\x6E\x85\xD1\x6D\xCB\xE8\x56\x18\xDD\x92\xD6\x25\x8C\x8E\x6C\x1E\x6D\xD6\xB1\x53\x2D\xB9\x12\x5E\x96\xC0\x40\xB4\x5E\x85\x2D\x6F\xA7\x1D\xF5\xE2\x21\x6F\xC7\x90\x0C\x79\x9B\xC6\x2B\x73\x0A\xC2\xCD\x6A\x34\xCB\xBC\x94\x36\xAE\x65\xDE\xDC\x33\xEF\xC8\x69\xFC\xEF\xCC\xB4\x2A\x9C\xAA\xC6\xC2\xBC\x79\x15\xC2\x78\x01\xF3\x4E\x84\x79\x27\xC4\xBC\x59\x8F\x79\x4B\x98\xC0\x84\x6F\xB5\xCC\x5B\x32\xF3\x8E\x21\xEA\x31\xAF\xBC\x56\x4D\x6E\xCE\xBC\x59\xC7\xBC\x25\x94\x1D\xF3\x66\x43\xE6\xE5\xB2\xF6\xC1\x04\xF6\x4B\x7B\x3C\xF3\xC6\xC4\xBC\x92\x5D\xB3\x38\xD5\xCE\xFA\x11\xC4\xED\xAC\x9F\x57\xDC\x7D\x52\xB2\x11\xA7\x14\x0D\x08\xA4\x61\x96\xC9\x47\xFD\x51\x93\x13\x75\x19\xA2\xD1\x70\x88\x46\x8B\x87\x68\x41\x99\xA8\x15\x8D\xB8\x61\x2E\x38\x45\x5E\x19\xD9\x2F\x59\xA3\xB6\xD5\x56\xDF\x71\xC6\xF4\xC3\x21\x78\x85\xB9\x86\x0B\x0A\x05\xF3\x5C\x65\x47\x3D\x99\x19\x5F\xF8\xA1\xA1\x72\x24\xB7\x7F\xFE\xEA\x8C\x1F\x36\x47\xA9\x82\x2E\xBF\x9B\xB6\xC6\x16\x77\x10\x0A\x29\xA8\xD6\x0A\x05\xF6\xAA\x5F\x3C\x4F\x11\x3D\x42\xDE\x9F\xBB\xA0\x7C\x3B\x8B\x65\xBA\xC1\xDF\xD2\xF6\x50\x6D\xBA\x8B\x1B\x8D\xBF\x85\xC5\x69\xA0\x01\xD1\x6B\x14\x9C\x18\xCE\x54\xD8\xFF\xA8\xBB\x45\x79\x56\xB9\x8A\xC2\x62\xB5\x79\xD8\xFA\x30\x82\xE9\xEC\x24\x66\xB1\x9D\xC4\xBC\x18\x3B\x89\xE9\xEC\x24\x5C\xFC\x9C\x9D\xC4\xF4\xEC\x24\x2F\xAA\x06\x90\x1A\xE6\xFC\xAF\xCD\x8B\xF3\xBF\x46\xA5\x0C\xAB\x69\x1D\xA7\xC3\xEC\x87\xC7\xEA\xA5\x9E\x91\x76\x76\x92\xD6\x90\x05\x8A\x79\xB5\xB6\x3C\x69\xAD\xDB\xC1\x6D\x71\xE6\x3D\x30\x70\x2F\x54\x85\xB4\xB9\xAA\x22\xB0\xCE\x6E\x52\xD2\x4A\xBB\x59\x25\x78\x73\xA3\x4A\xC1\xBA\xAD\x86\x54\xC3\xED\xA6\x22\x04\xF7\x73\xF8\x4D\xEE\x82\xAA\xA0\x1D\xEA\xC5\x8D\xF5\x6A\x4C\xE2\xAC\x9E\x38\xDB\x80\x3D\x57\x95\x10\x54\xFB\xCC\x31\x28\x40\x9D\xAB\xF6\xC3\xBE\xEA\x00\xEC\xAB\x96\xA0\xA8\xEE\xA0\xC5\xE1\x0E\xD8\x4F\x7B\xBF\xEA\x4E\xDC\x2E\xF3\xC9\xF5\xCE\x8E\x6D\xAA\xBB\xE0\x4E\x42\x87\xCE\xF8\xE0\xBA\xBD\x3B\xAE\x96\xE1\x40\x65\xE0\xCE\xEA\x6E\x73\x0C\xEE\x22\xA0\x1E\xDE\x4A\xDE\x03\x77\xE3\x2E\xEE\x2E\xFC\x67\x8A\xFF\x1C\x84\x49\x53\xDD\x8D\xBA\x01\x8A\x90\x7B\x20\x6C\xE0\x2E\xFF\x36\x5E\x4C\xFB\x17\x07\x7B\x17\xD5\x5D\xB0\x8C\xF2\x68\x19\x05\xCB\x3D\x10\x37\xD5\x5D\x5D\xE4\x44\xB5\x3C\xAC\x97\xDF\x37\x58\x97\x81\x65\x94\xF9\xCB\xAC\x84\x9F\xA0\x69\xF4\x12\x72\x14\x79\x09\x2E\x04\x4D\xFD\x12\xB0\x64\xC3\x02\x7B\x0E\x5E\x82\x9F\xBD\x04\x7F\x99\xA6\x5A\x66\xAB\x32\x98\x75\x96\xC0\x2F\xA9\xEE\xE6\x13\x52\xEC\x35\xDC\x85\x14\xAA\xEF\x46\x7D\x17\x3B\x29\x77\x97\xE9\xEE\x54\x1C\xE7\xA6\x70\x0F\x4F\x13\x8D\x7D\x5E\x06\xDB\x54\xCB\x70\x97\x53\xD8\x76\x18\x51\x5C\x28\x7D\x51\x2D\x83\x85\xBB\xD7\xAB\xBB\x07\x85\x93\x3E\xCA\x14\xF6\xC6\xEE\x7B\xC0\xC0\x5D\xB0\xBC\xA0\x06\xDB\xD4\xF7\xE0\x1B\x53\xB8\x07\x09\xDA\xE0\x4B\x07\xE5\xA5\x83\x30\xC5\x3F\x77\x41\x44\x54\x61\xE9\x7D\xB7\xDB\x6A\xEA\xBB\x89\x2A\x2F\x01\x2B\x12\x5A\x23\x4F\xDC\x41\x6A\x3B\x21\x64\x48\xF5\x82\xDC\x6E\x90\x4E\x77\x7A\x68\x76\x7A\xB4\x0C\xE3\xEA\x6E\x1C\x7B\x12\xB8\xCB\x75\x3B\x96\xC8\x0D\x30\xA1\xC1\x6D\xEA\xE5\x76\x5C\x26\x0D\x2C\xEF\x7D\xA7\xBA\xD3\x33\x08\x3E\xAA\x96\xE1\x6E\xEC\x1F\x36\x16\xEE\xE2\x91\xC7\x71\x57\x32\xEE\xA6\xC7\x41\x34\xE0\x77\x79\x76\xE1\x71\xE7\x4D\x02\xB1\x71\x75\x17\xB1\xB7\x3A\x07\x05\x71\x78\xFD\xD2\x96\x9F\xEB\x97\xD1\x0B\xDC\xA1\xA5\xCA\xC0\x4B\xAB\x7B\xCC\x31\x58\xEE\x31\xF3\x5D\x70\x0F\xB2\xF0\xF2\x90\x99\xEF\xF1\x6D\x65\xB2\xDF\x1A\x33\x2F\xE8\xD2\xFF\x37\xCC\x3C\xC7\xC7\x2F\x9E\x85\x3B\xEE\xFD\x1B\x62\xDC\xA1\x8C\xA2\x8E\xBE\x0C\xEF\xBC\x74\xC0\xAA\x2C\xA6\x96\x84\x55\xEF\xAA\xEF\xEE\xB1\xEA\x4B\x91\x0D\xEF\x46\x36\xEC\xB3\x12\x33\xEF\xCD\xEF\x54\x2F\xED\x0F\xFF\x40\x48\xDD\xBD\x68\x5C\xF7\x62\xD6\x1E\xAB\x76\x1D\xF1\x73\xAE\x13\xB5\x0B\xFA\x70\xE7\x5F\xBF\x0F\x77\xEE\xD5\x87\xDB\xEC\xC1\x12\xE4\x4D\xB5\x04\x07\xF0\xC1\x01\xB8\x03\x95\xAF\x3B\xC8\x0F\x30\xC3\x1D\x4F\x53\xED\x83\x02\xEF\x15\x7C\x8F\x47\x28\xF1\x87\xC7\xCF\x46\x31\xEF\x34\xD4\x56\xBC\xAD\xB6\xB2\x16\xA9\x68\x47\xB7\xAE\xCB\x14\x8B\xE3\xD5\x24\xB1\xB8\xA1\x7A\xF5\x96\x79\x7B\x95\xBE\xE0\x54\xD3\x8F\x76\x24\x7D\x46\xB5\x2B\xAC\x66\x03\x8C\x06\x05\x66\x7A\xAD\x8A\xF9\x5C\x39\xB9\x56\xA5\x64\x0D\xA8\x49\xA7\x24\x5B\xC1\x66\x95\x83\xF6\x8A\xBA\x3E\xE6\xDE\x4F\x2A\xFE\xD8\xBD\x6C\x83\x66\xCC\x64\x45\x07\x10\xC1\xD8\x99\x0B\xEE\x2F\x6F\xDC\xB8\xA1\x36\x9A\xBA\x5C\xD1\x01\xCE\xB6\xF1\x35\x88\xB7\xEA\x7D\x57\x21\x81\x7D\x90\xEE\x5C\x3D\xB7\x5E\xEF\x07\x7D\x0E\xD7\xFC\x03\xFA\x18\xEC\xA7\x33\x79\x18\xCB\xAD\x25\x17\x54\x77\x80\x75\x4F\xEE\x28\x76\x4B\x2E\x9B\xEA\x4E\xA2\x3C\x0A\xAF\x25\xB6\xCB\xEE\xEC\x28\x18\xC1\x1D\xEB\x4E\x6F\xC2\x1D\x6E\x07\x70\x48\x47\x6B\xF5\xF2\xB4\xBE\xDB\x5B\xC6\x0F\x54\xF7\xC0\xFE\x2A\x84\x3B\xAB\xA9\x39\x06\xD3\xFA\x4E\xFA\xFE\x1E\x96\x7C\xF7\x80\xBC\x57\x1D\x84\x7B\xC0\xD4\x53\x68\xBF\x8B\x20\xEC\x77\x82\xD3\x0D\x4B\x77\x43\xE9\xEE\x8A\x0E\x28\x28\x28\x9C\xEF\x59\x28\xDD\xB8\x07\x0E\x52\x46\x11\xDA\xBB\xF6\xAA\x86\x83\x5D\x55\x25\x20\x89\x60\xE2\x8B\xBB\xAB\xBA\x03\xA6\x28\xE6\x44\x6C\x07\x50\x88\x7A\x4A\x76\x2E\xE3\x76\xA0\xBA\xDB\x93\x66\xCA\xA4\x39\x08\x19\x89\xEA\x83\xF8\x2D\x84\x44\x19\x14\x65\xA3\xB5\xFA\xCE\x69\x7D\x50\x7A\x39\xA5\x88\x86\x03\x8D\x18\x97\x0F\x96\xEF\x5C\xDC\x82\xBB\x91\x96\xD5\xDD\x70\x8F\xDB\xD9\xD9\x46\xE9\x4E\x05\x36\xB4\xAF\xC2\x27\x06\xA6\xD5\x41\xB8\xA3\x9A\xC2\x9D\x0C\x22\x82\xBC\x5E\xC0\x18\xF7\x3D\x63\x3A\x8B\xCC\xB2\xF9\x60\x3A\x56\x09\xB1\xDD\xAD\x27\x67\x38\xC1\x1B\xAD\x2E\x6D\x17\xEB\xD2\xF6\x45\xE8\xA1\xFF\x6C\xA2\x22\x3E\x11\x0C\xDC\xC7\xC8\xB3\xF3\x48\xA5\xDC\xF5\xDF\xC3\x3D\x39\x25\x75\x47\x35\xFF\x02\x9F\x27\xD5\x16\x75\x43\xF6\xA5\x80\x00\x77\xD0\x15\x4D\x09\xB7\xFD\x18\xED\x9C\xA7\xB5\x22\x4C\x44\x3A\xB4\xE5\xE9\x13\xB8\x8B\x67\x39\x79\xB5\xFB\x35\xF5\x48\x1D\xBA\x5F\x53\xE7\xEA\x68\xBD\xE2\x6A\x76\x3E\xF5\x62\xAA\xE1\xCF\xD7\x9D\x7E\x63\x15\x18\xB2\x92\x6E\xF2\x2D\x0A\xA9\x8B\x9A\x4A\xBB\x4F\x6C\x55\x8A\x91\x1C\x41\xB9\xBF\xFC\x7D\x79\x56\x9B\x47\x6A\x0B\x66\xAD\xB0\x74\x78\x62\xCE\x51\xE8\x2A\xA8\xEE\xEB\x85\x6F\x28\x97\x34\x54\xB5\x7B\xB7\xA9\x94\x14\xFA\xFE\xAD\x66\xD7\xE2\x3E\xB4\xD5\xD4\xF6\x91\x3A\x02\xE3\x46\x4D\x2D\x2F\x44\x60\xDB\x17\x3E\xDC\xBD\xA0\x17\xBE\x70\xBD\x7B\xC1\x2E\x7C\xE1\x23\x7B\x95\xF0\x6F\xF6\x2A\xE1\xA3\xDD\x0B\xD1\xC2\x17\x7E\x79\xAF\x2A\x9E\xDF\xAB\x84\x4F\xEC\xD5\x86\xDF\xD8\xAB\x8A\xDF\xDA\xAB\x84\xDF\xDD\xAB\x0D\x7F\xB8\xD7\x0B\x9F\xD9\xAB\x0D\xFF\x69\xAF\x12\xFE\x74\xAF\x46\x7E\x7E\xAF\x2A\xBE\xB0\x57\x15\x8F\x6F\xEF\x51\xC5\x95\xED\x3D\x4A\x78\xB2\x7B\x21\x59\xF8\xC2\x5B\xF7\xAA\xE2\xBB\xB6\xF7\xE8\xC5\xF7\xEE\x55\xC2\x3B\xF6\x2A\xE1\xA9\xBD\x4A\x78\x7A\xAF\x5E\xFC\xE8\x5E\x74\xF8\xC0\x5E\x55\x7C\x70\xAF\x12\x3E\xB4\x57\x2F\x7E\x6A\xAF\x2A\xFE\xC1\x1E\x35\x9C\xDC\xA3\x82\x57\xEF\xF1\xFD\x3F\xDA\xE3\xF9\x7F\xBF\x47\xFB\xBE\x66\x8F\xFA\xBF\x76\x8F\xEF\xFF\x87\x3D\xEA\x7F\xDD\x1E\xE5\x37\x7B\x7C\xFF\xC8\x1E\xF5\x3F\xBA\x47\xF9\x9B\x7B\x7C\x7F\xE1\xE6\xDF\x93\xD4\x77\xA3\x06\x1F\x58\x50\xE7\xC8\x86\xFD\x6B\xAA\xA9\x28\xD4\xEF\x14\x87\x0F\x91\xD3\x51\xAD\x41\xBB\x23\x27\x6B\x3D\xAD\x08\x27\xA8\xE1\x85\xB0\x8A\xF2\x20\xEB\x8C\x66\x3A\x1B\x05\x10\x94\x9F\x20\x0D\x97\x7E\xFE\x5F\xDD\xCF\xB9\xBB\xE3\xC0\xFD\xCE\x77\x74\x9A\xEC\xD3\x4A\x99\x6D\x8F\xF6\x4A\xBB\xB7\x00\xD4\x21\x1D\x1C\xC5\x35\xD4\x25\x0D\xAD\x5E\xB2\x65\xA2\xF8\xF8\x15\x9D\xB4\xC9\x44\xD5\x8A\xB6\xB5\x72\x23\x71\xEE\x71\x6A\x93\x91\x52\x51\xB5\xA4\x70\x6E\xF7\xE8\x59\x5A\x00\xCB\xC6\x3D\xBA\x51\x5B\x6E\x0D\xB9\xDF\xF1\xF1\x17\x58\x4E\xE4\x8B\xFA\x13\xA1\x34\x19\x5E\xD1\x1B\xAF\xC3\x05\x93\xB6\x9F\x9F\x31\xCA\x6E\x7B\xB7\x2C\x0A\x8B\x67\x14\x7F\xB5\x41\xFB\xEC\xC0\x77\x40\x1F\x03\x73\x6B\xDD\x30\xBB\x77\xC2\x6B\xF0\x01\x45\xB0\x81\x92\xF6\xD0\xC1\x5D\x83\xFD\xE3\x70\x75\x77\xA1\x71\xFF\xE3\xD9\x02\x07\x70\x09\xFF\x3B\x33\x95\xAE\x6A\xEE\x6A\xF7\x69\xBF\xD3\x7A\xD0\x69\x7C\xA7\xA9\x38\xDB\x27\x91\x4F\x9A\x47\x74\x00\x33\xE5\x93\x3B\xD4\x92\xB7\x36\x70\x53\x42\xE8\xC8\x4E\x5D\x00\x33\xAD\xD9\x3D\x4D\xCA\x95\x2E\x71\xC3\x0D\xB2\x56\xDB\x6A\xAC\xA2\x2D\xDD\xBD\xA1\xD2\xEE\x0D\x10\xAE\x83\x82\x70\xDD\xA9\x66\x8D\xD2\x68\x84\x7C\x7C\xF1\xFB\x37\x6E\xDC\x88\x51\x9F\x23\xF3\xFF\x66\x6D\x80\x72\x56\xD2\x81\x09\xF5\x0D\x8C\xCB\xD6\x18\x24\x19\x6B\x0C\x41\xFB\x61\x5D\x5C\x77\xC8\x8C\x77\xD3\xEE\x53\xDB\xB2\xFE\x68\x37\x4A\x6F\xB7\x71\x8A\x8C\x14\x87\x5D\xA6\x14\xFC\xD3\xDA\x82\x3A\xEB\x43\xE1\xD7\x41\x97\xEF\xBA\xD4\x82\x32\x90\x57\x30\xB9\x6A\xB7\x5D\xA6\x8A\x27\xED\xD8\xB5\x77\x79\xA8\xB3\x5F\xD2\xDE\xB9\x4D\x79\xFC\x02\x8A\xC7\x33\x6E\x6B\xC3\x6D\x37\x6E\xC4\x0D\xB0\x58\x37\x1D\x7F\x72\xD0\x26\xB6\x27\x9C\xD6\x76\x9D\xA3\xD0\x2C\x8E\x62\xCC\x34\x89\x72\x85\x54\x36\xEE\x0D\x10\xAD\xD3\x93\x3A\x86\x68\x7D\xAD\xD0\x3C\x39\x12\x7E\x2D\xA5\xD0\xC3\x1E\xC1\x23\x24\x78\x44\x69\x61\xA2\xB5\x69\x1D\x09\xC1\x23\x22\xB8\xC9\x20\x85\x04\xC2\x69\x95\x80\x11\x92\x47\xDE\x88\x1A\x41\x02\xD6\x93\xBC\x3D\xBE\x94\x29\x0F\x01\x08\x0E\x99\x71\xEA\x7C\x6D\xE8\xEC\x3D\x12\xDE\x76\x6A\x63\x5A\x93\xBF\x8C\x06\x25\x28\x35\x9D\x33\xBF\x12\xC8\x81\x58\xB2\x09\x50\x78\xDC\x26\x27\x62\x80\x78\xC1\xB8\xFD\xBE\x27\x66\x4B\xC7\x21\x15\x69\x04\xE9\x6C\x8D\x51\xE2\x90\x8A\x76\x5A\x9B\x75\x06\x85\x21\x9F\x6B\x1A\x3D\x6A\x9D\xC5\xA1\x36\x0D\x28\x0F\x0B\x74\x0F\xC1\xC6\x10\x1A\xC1\xA0\x7D\x5A\x1C\x1F\x1A\x02\x0D\x67\x26\xDB\xE4\x28\x6C\xBA\xA7\x32\xF7\x08\x72\x3C\x83\xCE\x40\xD8\x8D\x85\x0C\x59\xE2\xDE\x40\xE3\x11\xF6\xC7\x23\xC4\xF1\x08\x39\x97\xD7\xDA\xB4\x0E\x65\x3C\x42\x1A\x8F\x94\x52\x3F\x80\x9D\x56\x31\xA4\x32\x1E\xA1\x67\xC0\x10\x62\x30\xDD\x14\x18\xF6\xC1\x0F\x5A\x3C\x18\x1F\x82\x9C\xE3\x61\x4A\x65\x86\x84\xB4\x1B\xA1\x6C\xB9\xB3\x74\x5E\x62\xEE\x57\xE5\xBF\xC4\xEB\xF2\xDD\xE4\xCA\xF8\x03\x5A\x36\x65\xFD\xFF\x33\xDD\xB5\x27\x15\x4A\x3B\xD3\x1B\x98\x5A\xE3\xB2\x44\x34\xB0\xB9\xCD\xDC\x48\x5C\x15\xEA\xD0\x8D\x4E\x15\x21\x13\x29\x72\x23\x26\xE2\x1B\x70\xBE\xBB\x37\x50\xB4\x14\x71\x3A\x68\x4F\x30\x95\x39\x36\x65\xD4\x24\x9F\x9A\x3A\x84\x10\xEC\xDA\xB4\xB6\x42\x36\x4B\x64\x0B\x51\x22\x10\xB5\xC8\x33\xD8\xC3\x3D\xC5\xE4\x52\x31\x42\xB9\x1E\x75\x64\x89\x99\x1E\x21\xD3\x23\x63\x0E\x6E\x90\x17\x3B\xE0\x0B\x06\x95\x6A\xDC\x17\x28\xB3\x23\xB7\xD7\x42\x88\xF3\xC5\xD2\xF9\x33\x12\x8F\xE2\xC5\x91\x86\xDF\xA7\x69\x15\x99\xE7\xCC\x56\xB2\x10\x1F\x76\x2C\x28\x02\xD8\xA3\xA9\x80\x96\xCD\x7D\x46\xAC\x45\x03\xB3\x90\x19\x83\x49\x9F\x0D\xE9\xF4\xD1\x3D\x42\xD2\x0A\xEC\xFA\x5A\x11\x20\x29\xC9\x8D\xB0\xC7\x6F\x56\xA8\x07\x84\x7F\x3F\x4F\x38\x21\xB9\xD0\xAF\xE3\x28\x6A\xA1\x91\x9C\x39\xDC\xE8\x8E\x86\x5A\x56\xDA\x01\x29\xBB\xC6\xF7\x99\x6A\x2C\x3E\xBA\xE5\x0F\x11\x3B\xCD\xF0\x18\xDF\x7C\x42\x14\x86\x4E\x32\x87\x24\x09\x91\x7E\xD1\x54\xAC\x66\x60\x09\xB9\xC6\x7B\x75\x82\x22\xCB\x0D\xAA\x30\x6B\x53\x54\x6A\xC0\x9E\xA9\xE3\x29\x47\xD0\x77\xA4\x8E\xA6\x40\xAB\x6D\x58\x7E\x1F\x19\xD4\x02\xE4\xA9\x6D\x88\xF1\xFD\xB5\x69\x35\x9C\x00\x3F\x5C\xA8\xD1\xB6\x39\x06\xCA\xBD\x89\x50\x39\x5B\x47\xF0\x1E\xE7\x2B\x08\xD6\xEB\xD0\xE9\x37\xD6\xD1\x38\x8A\x22\xF2\x94\xCF\xE8\xD5\x3A\x24\xB7\x30\x16\xF4\xF1\x43\x74\xD6\x19\xF1\x94\x8B\x57\x35\x2D\xC1\xF8\x56\x2C\x4E\x62\x3C\x6D\xE4\xF5\x84\xA2\xA0\x21\xE2\xAF\x08\x2C\x32\xE6\x8F\xE9\xAD\x90\xDF\x8A\xDA\x42\x65\x62\xB3\xBF\x33\x7D\x17\xC8\x1D\x88\xC9\x11\x6A\x22\x30\xA2\xD6\x37\x82\x02\xD0\x43\x48\x1E\x2A\x6C\x57\x43\xD2\xB5\xAB\x4A\x49\xA9\xA9\x70\xB4\x6D\x53\x8D\x64\x25\xEE\x8B\x5D\xCB\x91\x90\x41\x1D\x73\x6B\xB3\xD3\x85\x82\x90\xE1\xC3\x82\x2A\x87\xA8\x52\x10\x57\x89\x7F\xC2\x12\x9E\xE3\xA8\x02\x18\x0D\x5E\x88\xFD\xA7\x1A\x57\x0D\x7E\x81\x9B\x8F\x05\x8D\x2A\x05\x19\xBF\xF7\x10\xE5\x2C\x27\x02\x42\x4E\x6F\x10\x88\xAC\x74\xC5\xA0\x14\xA5\x68\x6C\xEA\x0A\xC5\x23\xD6\x21\x8C\x84\x58\xA6\x5B\xA5\xA8\xC3\x1D\x19\xCD\x2C\x19\xC9\x2C\x64\x1B\x56\xEC\x02\x97\x37\x44\x14\xD0\xE5\x8F\x5C\x12\x50\x1C\x12\xE4\x7F\x41\x59\x19\x88\x42\x09\xD3\x2B\x5B\x48\xA8\x68\x40\xA8\x88\x7B\x1B\x31\x2C\x8C\x1F\xAE\x2A\xA5\x4E\xC6\x3E\x16\x25\xEE\x8D\x56\xD2\x3D\xEC\xA8\x15\x31\x0A\x6F\x24\x3E\x73\x4C\xAD\xB4\xA5\x52\xC2\x54\x4A\x85\x4A\xD8\x89\x3A\x43\xB5\x56\xBB\xA4\x4A\xE9\xD4\x25\x23\x5E\xE3\xFA\x53\x6C\x33\x9D\x9F\x86\x4D\x1D\x63\xDF\x05\x06\x2D\xA4\xC6\x85\x1C\x81\x7F\xB1\xA9\x42\x2C\x59\x42\xD7\xA2\xD3\x6C\x1B\x0D\x1B\x24\x01\xCA\x5D\x71\xBB\xCB\x70\xDF\x12\x62\x6D\x06\x52\x7C\x96\x52\x65\xD8\xFC\x2A\xCB\xD9\x3D\x2D\x72\xFA\x1B\xBD\x97\x0A\x51\xF3\x9D\x2F\x3B\xCD\x06\x39\x88\x9C\xFD\x46\x76\xAD\x84\x94\x1C\xC5\x51\x98\x30\xED\x39\x52\xD3\x76\xAE\x95\x69\x7F\x9A\x31\xC6\x42\xCE\x44\xD5\xD2\x79\xF6\x5A\x0C\x9C\xAA\x72\xCF\x2C\x7E\xE0\xB5\x9F\x26\x29\xBD\xC2\x96\xC1\xE1\x04\xB2\x44\x47\xFC\x98\xC7\x25\xE2\xD7\xFD\x4D\x86\xC4\x62\xA2\x77\xF5\xE1\xD3\xCC\x69\x8A\x5E\xEB\x03\x30\x08\xB7\xC6\x58\xBE\xC4\x28\x99\x2A\xA4\xC1\x08\x39\x0B\x51\x20\xD4\xE2\x72\xA3\xD3\x84\x43\x68\x4F\x16\x11\x8F\x98\x74\x80\x46\x8C\x9B\x62\xA5\x03\xF4\x5D\x1E\x52\x9C\x51\x53\xD3\x37\x31\x51\x3A\x14\xC2\xA3\xB4\x41\x65\x3A\xC2\xB6\x06\x6D\x57\x12\xF6\xF1\xCA\x38\xF2\x5A\x35\x1C\x71\x87\xCD\xA8\x47\x10\x9D\x2D\x02\x73\x0C\x46\x3C\xF0\x29\x85\xA8\x51\x4E\x5D\x2B\xF2\x2D\x41\x6E\xA4\x20\x7F\x94\x12\x84\x6B\x7C\xB1\xA9\x23\xEE\x2B\xD5\xC3\x04\xC5\x5D\x44\x58\x8D\x38\x45\x07\xD5\x15\xC9\x1C\x45\xA2\x41\x7A\x72\x5A\xA5\x52\x7D\xCE\xDE\x36\x23\x0A\xFA\xF4\x03\xE6\xE7\x70\x2B\x18\xA4\xF7\x5D\x8B\x73\x1A\xB2\x11\xE8\xF2\xBD\x97\xFC\x72\x3F\x12\x36\xF4\x37\xC9\x69\x09\xA5\xCE\x89\x22\xCA\x43\x1C\xA0\x08\xE2\x42\x92\xD6\x04\xB8\x5B\x19\xAD\x3F\xD4\x96\xF3\x0C\xF9\x93\x60\x19\x55\x80\x42\x0D\x7F\x51\x59\xF2\xA0\x52\xB9\xCD\x78\x74\x34\x8E\xA6\x39\x06\x29\x13\x2A\xF0\x84\x8A\xFB\xA4\x7A\xA8\x25\x54\x4A\x8F\x7A\xA4\x3A\xDD\x12\x6A\x8D\x32\x8E\x46\x73\x84\xE2\xA1\xAC\x68\x6E\x9C\x24\x62\xD2\x0C\x3A\x89\x7B\xF9\x2C\xFB\x7D\xDC\xB9\xB2\x79\x3B\xF2\x5B\xCE\xA0\x8E\xBB\xD5\xC4\x05\xBC\x17\xA0\xE1\x22\xB8\x50\x4D\xD9\x00\x28\x5E\xC8\x33\x73\xCA\x9F\xF9\x45\xE8\x21\xC6\x78\x66\xA0\x3B\x1A\x2C\xAA\x20\x76\xBA\x05\x16\x11\x66\xF2\xAF\x69\x7A\x8D\x80\x3D\x94\xC8\x30\xFF\x2D\x15\xAF\xB9\x55\x54\xB2\x48\x71\xF9\x44\x93\xB2\xCB\x10\x62\x86\x1B\x41\x05\x6B\x2E\xD8\xD0\xCB\x3E\xDE\x2B\x96\x76\x9E\x16\x40\x06\xAE\xAE\x2D\x50\x04\x57\x9F\x04\xF2\xAA\x6E\x66\x5A\xC6\x93\xD9\x99\x86\x01\x2F\x2C\x7F\x62\x5A\x66\xE3\x7A\x45\x80\xF8\xA6\xC5\xDC\x8A\xB6\xFA\x49\x26\x24\x04\xE3\xDF\xEB\x37\xD3\xF8\xBA\x27\xBD\x36\x9A\x5E\x1B\x75\x6F\x75\xC0\xB6\x4C\x44\xA7\x0A\xFC\xEB\x3C\xB7\x33\x48\xB3\x3F\x8E\x54\xB2\xED\x94\x0F\x1F\xEB\x29\x21\x4E\xBF\x71\x1C\x71\x78\xA0\x57\x40\x24\x36\x2E\x10\x89\x21\x2A\x1A\x25\x5A\xA2\x01\x99\xF4\x14\x15\xDE\xEF\xE0\x5A\x65\x7B\x14\xD3\x60\xF9\x3B\xCD\xEB\xA5\x6D\x55\x10\x69\xB3\x6D\x8B\x95\xB7\x3C\xFA\x0F\x7D\x19\xF8\x7E\x84\x22\x80\x27\xBD\x8D\x08\x95\x15\x72\xFF\x65\x09\x96\x5A\xA2\x7E\xEB\x08\xBF\x34\x41\x7D\xDB\x2F\xB3\x3D\xF3\x90\x6F\xB3\x92\x4E\x72\x9B\x29\x3E\x4F\x73\xDC\x28\xAE\x88\xB6\x1A\xE1\x72\xE9\x9F\xC8\xEA\x4F\x7B\x76\x5E\x5A\xBB\x17\x42\xFF\xA9\x16\x97\x77\x5C\x5A\xB5\x5F\x5A\x93\x6A\x04\x8A\xDF\xA3\x25\xB6\x15\x45\x14\x4A\xCE\x3A\x95\xE6\x95\x87\x3D\xE4\xBD\xD6\x66\xF9\x49\x22\x24\xD3\x9D\xB2\x4C\x5D\xEE\x88\xA9\xE7\x89\xB9\x87\x2A\xC2\xAF\x20\x69\x22\x26\x94\xEC\x36\xED\x90\x42\xBA\x47\x21\x0B\x04\x3D\x6F\x25\xDD\x30\x5E\xB3\x06\x22\x0A\x86\xDF\xE0\x86\x5D\x43\x20\xEA\x1E\xE2\x8A\xE3\xBF\xD7\x19\xEA\xCE\x2C\xA5\x98\x39\x2A\x0A\xE5\x22\xF2\x44\xDE\x9F\xDF\x76\x1A\x48\x44\x86\x35\x42\xF8\x4D\x50\x44\xD3\xAA\x26\x7A\x1A\xB5\x22\x16\x7C\x7C\x72\xEC\xE5\xE3\x36\x99\x7A\xD4\x44\x83\x55\x4A\x50\x67\x48\xD1\x97\x44\x5A\xD1\x43\x0C\xE9\x21\x26\x43\x0D\xDF\x27\x85\xAF\x13\x97\x9C\x2C\x24\xF7\x0E\xF9\x51\xAA\x53\x12\xDB\x22\xD0\x4A\x11\x87\x72\x1A\x36\x7A\xD2\x5B\xA0\x4E\xB2\x1B\xE5\x7F\x25\x18\x58\x01\x5B\xEA\x04\xF4\xB3\x43\xCF\xD9\x26\xDC\xCB\x1D\x2D\x86\x43\x7E\xF9\x7E\xDC\xFE\xBA\xFB\x38\xCA\x80\x28\x4E\xBB\x7C\xF7\xEB\xCF\x7C\xFC\x19\x75\x96\x07\xD9\x2D\x9F\x2B\xBF\xF7\x92\x44\xBC\x1F\x21\x7B\x6D\x7E\x8E\x37\x7E\xAB\xFA\x88\xDF\xBF\xDB\xF2\xFB\xFC\x3B\xF7\x33\xE6\x7C\xB8\xAA\xEF\xC3\xEE\x3D\xE4\x5D\x47\x03\x4E\x93\x4F\x1E\xA4\x58\x14\x45\xA9\xBA\xFC\x5C\x53\xD3\x29\x25\x39\x4C\x5A\xDC\x00\x59\xDA\x3A\x50\x30\x64\x03\x92\x0D\x84\x70\x6C\x4E\x52\x0B\x45\xE3\x9B\x74\x5B\xE0\xFB\x7D\x79\x58\x18\xF1\x41\xD2\xE1\x1F\x20\x29\xB2\x6E\xAF\x74\x29\x33\xE1\xB6\xDE\x32\xDB\xE4\xF6\x4A\x6F\xDD\xCF\x21\x01\xC7\x15\xF3\xB7\xAD\xC3\x75\xE2\x50\x8E\x96\x51\x0D\x91\x75\x45\x9F\x26\x2B\x59\xF3\x0A\x15\x9C\x43\xC5\xF3\x55\x1B\xD7\x9E\xE0\xEC\x89\x40\x39\x0D\xBE\xD1\x99\xCD\xA6\x8E\x0F\x99\xA0\x4E\x2F\x1D\x0F\xFE\x11\x25\x59\x4D\x20\xBD\x7C\xD4\xF8\xAD\xE4\x8F\x76\x24\xB2\x12\x37\x27\x8A\x36\x6D\x5C\x5C\xCE\xC0\x4E\xEC\x3A\x4E\x51\x1F\xB6\xED\x9C\xA5\xCE\xE9\x76\xC6\xB0\xE4\x56\x0C\x6D\x10\x80\x5A\xF7\x82\x31\x58\xD1\x0F\xA3\x44\x77\x66\x73\x1D\x37\xF6\xF1\x86\x33\xC8\xC9\xFF\xEC\x87\x87\x38\x25\x2B\x94\x8C\xD8\x6C\x36\x2B\x9A\x23\xC1\x6C\xAB\x57\x6A\x64\x3F\x16\x12\xE2\x93\x4D\xDE\x1A\x6C\xA8\xC4\xE6\x0B\xD5\xC9\xA0\x84\x3D\x31\xC7\x70\x92\xCD\x5A\x5B\x7A\xED\x89\x40\xD5\x21\x13\x88\x23\x5A\xE2\x0D\xB7\xDD\x8C\x63\x5C\x05\x62\x9B\x8D\x7C\xE8\x22\xF9\x5E\x5E\xA8\x15\xB7\x2B\xA8\x73\x7C\x71\xAB\x19\x87\x4A\x6B\x1D\xD0\xA6\x2B\x77\xEA\x82\xFB\x3C\xC5\xE5\x34\xD2\x3F\x2D\x00\x47\xD6\x45\x04\xE5\xF0\xEC\x5B\x7B\x5D\x8D\x57\xB4\xAD\x14\x8C\x2A\x9B\xA7\x19\xFE\xC1\x9D\xFA\x1D\x45\x92\xC7\x99\xDB\x66\x7B\x06\x8C\xCE\xA2\x3C\x3E\x1C\x10\x0E\x9D\x75\x40\x01\x76\xEE\x37\x83\xD3\x53\xFA\x71\x3D\x78\x10\x7F\xC4\x2E\xC2\xD1\xAF\x15\xD9\x09\x2D\xC4\x87\x03\x7B\xBA\x88\xE8\x49\xD8\x1C\x0E\x82\x07\x8B\x88\x7D\x61\xD6\x24\x9B\x81\x72\xEA\x42\xE3\x07\x5E\x32\x1D\x7A\x59\xE6\x12\x3E\x61\x40\x46\x6F\x79\x23\xDE\x75\xC4\x62\x5A\xF2\x70\x12\x69\x16\x07\x4A\xD0\xD9\x16\xBD\x4E\xCB\x35\xF5\x05\x47\xE0\xE5\x0F\x15\xDA\x05\x10\xAE\xD3\xF6\x7D\xCF\x6F\x02\xDE\x6F\xAE\xB4\x20\x03\xDC\xB6\x9B\x7C\x2A\xFC\x84\x05\xB4\x80\x25\x24\x71\x57\x28\xE7\x8F\x2E\x3F\x7E\x99\x30\xD0\x1E\xDB\x28\x2C\x08\x03\x24\x1B\xBC\xA7\xE9\xF5\x9E\xA3\xE9\x93\x0D\x5E\xFA\x7A\x0F\x78\xC5\xE2\xB1\xB1\x17\xA8\xE7\x96\x02\x1F\x88\xCB\x3D\x93\x35\xEE\x4D\x38\x08\x44\x57\xF7\xA7\xD7\xBA\xD6\xB5\x13\x7B\x9D\x56\x9C\x5D\x66\xB4\x1D\xCC\x68\xDB\xCE\x68\xDB\xCD\x68\x4B\x21\xA1\x3C\xA3\x35\x21\x03\xB0\xB9\xEB\x4E\x46\xDF\x18\x79\x9C\xAD\x15\x7D\x90\xE2\xA3\x4C\x1E\x09\x69\x34\x25\xBA\xF0\x53\x62\xB9\x66\x78\x62\x32\xF9\x1C\x0E\xEE\x38\x51\x68\x0A\x84\x45\xC1\xD7\xBC\x86\xAD\xBE\x07\x09\x13\x2E\xE7\xA3\x85\x83\x14\xCA\xCF\x65\xD5\x0A\x19\x1A\xB9\x8E\x74\x32\x25\x6A\x1F\xA8\x75\x39\xF9\x38\xE8\x70\x95\x71\xAA\x52\x2E\xAF\xAC\x39\x26\x83\xC9\x1A\x7C\x45\x70\x26\xCB\xE4\xA7\x8F\xAB\x73\xE4\x37\xC8\xAC\x15\xE6\x10\xAD\x7B\x28\xCA\xCA\xD2\xB1\x0B\xEB\x2C\x07\x4F\x73\xD4\x45\x65\xA4\xC5\x21\x76\xF8\x64\x11\x4A\x1A\x6B\x1A\x4E\x82\x23\x50\x44\x1A\xC6\xFD\x33\xD2\xFE\xFB\x91\x73\x1F\x14\xE4\x01\xB5\x91\x7D\x26\xD4\x6A\xCB\x6E\xB7\x07\x53\xB4\x7A\x1F\x42\xD5\xF2\x28\x27\x90\xB9\x4A\x18\x3F\xFC\x98\x6E\x42\x7C\x95\x00\x66\xBB\x1D\x6A\x72\x38\x60\x64\x42\x17\x54\x94\xE6\x35\x00\x2F\x07\x92\xC3\x81\x22\x04\x7E\x7A\xA4\x81\x30\xD4\x1B\x7E\x07\xA9\xD7\x9C\x62\xA0\x9C\x68\x55\x1F\xE4\x95\x6A\x19\x02\xC8\x5E\x19\xDC\x49\x51\xBF\x99\x0B\x4E\x9D\x7F\x65\x70\x07\x79\x32\xA5\x7C\xB1\xD4\x42\x23\x32\x3A\xA3\xAC\xB6\x42\xEB\xBC\xD2\x4E\x11\x20\x1F\xA7\xE1\x6C\xDC\xC5\x86\xDE\x22\xE0\xCE\x4A\xCB\xFA\xDE\x11\x92\x37\x5E\x09\x9D\x6E\x11\x32\x64\xB2\xA2\xEF\x3D\xE7\x5E\xD5\x20\xDB\xD5\x09\x41\xBB\xE9\xB3\x94\x21\xD3\x6C\xD6\x21\x2F\xC0\x15\x31\x06\x54\x23\xD6\x75\x00\x37\x83\xB4\x51\xEC\xD6\x5E\x60\x98\xDC\x7B\x1B\xD9\x06\xE1\xB4\x97\x83\x0C\x3E\x51\xD1\x4E\x83\x76\xFA\xC1\xA9\x54\x62\xB9\x12\xBD\x59\x47\xFD\x4A\x56\x7C\x25\x2B\x0B\x2A\x59\xE1\x4A\x5E\xDE\xAB\x24\x92\x4A\xDC\x8E\x2F\x86\x3A\x7B\xA4\xD2\x6C\xCE\x3B\xD2\x62\xB3\x71\x31\x19\xA9\x1D\xEE\x7A\x20\x69\x6E\x03\x7F\x8C\xB1\x24\x66\xD0\x15\x51\x66\x65\xA6\x26\xF4\x52\xF9\xBE\x4B\x84\x2B\xE0\x47\xDC\xD6\x89\x00\x74\x41\xD2\x08\x60\xA5\x86\xE4\xAC\x60\x08\xE2\x4C\x59\xE6\x18\xBA\x04\xF4\xBA\x6C\x38\x25\x19\x2F\xA5\x04\x3D\x08\x51\xF9\xBD\x8F\xB7\xB0\x54\x94\x37\xB1\xFC\x9D\xCB\x02\x4B\xA5\xF1\x33\x7F\xBA\x37\xD7\x20\xCD\xAD\xA9\x47\xA8\x88\x9F\x10\xE0\x7E\xD4\x9D\xD9\x35\x6D\xD4\xA9\x1C\x1F\xEF\x61\x6B\x3C\x17\xB4\x30\x82\x10\x1F\x0F\x8E\x9A\xD3\x10\xBB\x25\x61\x96\xD8\x4D\x1B\x17\xAC\x06\xF8\x6B\x05\xEF\x19\xFC\x75\xA4\xFD\x75\x7F\xFB\xEB\x7A\x20\x11\xE3\x31\x43\x85\xC6\x40\xF8\xC2\x54\x22\x38\xCE\xB9\x10\xD3\x59\x2F\x6E\x70\x9C\x3E\x59\x53\xDC\xEB\xC9\xF3\x60\x5D\x70\x0A\x62\xF7\x6C\xD0\x40\x08\x94\x4F\xE0\xF4\x46\x6D\xA6\x4E\x41\x04\x66\x5A\xBE\x5F\xAC\x0F\x24\x62\x25\x1A\x26\x68\xDF\xA7\x24\x51\xAC\xAE\x91\xAC\x9A\x99\x52\x4E\x55\x2C\xAB\xEF\xAF\x70\x4D\x44\xD5\x6A\x46\x3F\xA4\xA7\x47\xFC\xD3\x59\xED\x91\x9E\xAE\xF8\xA7\x2B\xF3\x4F\xDD\x73\x81\x77\xEB\x0B\xB2\x4B\x5A\x85\xDB\xFE\x54\x67\x85\xC7\xFC\x81\x5A\x83\x6A\xF8\x50\xE7\xD8\xAB\x39\xD9\x96\x7A\x65\xB0\xE2\xB6\x25\xE4\x09\x55\xBE\xFB\x59\xDF\x7D\x35\x69\x93\x09\xD8\x29\x85\x67\x85\x35\x2A\xBF\x55\x08\x06\xEC\x83\xE4\xED\xDC\xCD\x42\xEB\xCC\xA6\xF0\x75\xE8\x25\xD0\x7D\x94\xD2\x23\x64\x1D\xCA\xD1\x66\x65\x1D\x5F\x93\xD9\xC6\x0A\x30\x67\xD5\x8B\xE8\xA5\xDA\xB0\xD6\x5C\x87\xA8\xFE\xEF\xF2\x01\x44\xDD\x3C\xE3\xCE\xB0\x36\x8D\x8A\x60\xC6\xC7\xC4\x0F\x80\xEE\x78\xEB\x1D\x4A\xE9\x6D\x08\xDC\xB3\x9F\x66\xFF\x46\x6E\xDB\xBD\xBC\xB6\xA8\xF2\x63\xC8\xCB\x42\x3E\x32\x96\x7D\x82\x7D\xF3\xF0\xB1\x39\x26\x33\x0F\x94\xD4\xA9\x51\x78\x7B\xF1\xF4\x70\xA5\x58\x3D\x7E\xD8\x9F\x65\xAB\x76\xEE\xAE\xE8\xFB\xFC\xD3\xFB\xE6\x9F\x96\x3F\x7E\x89\x7B\x94\xFD\x07\xA5\x22\x6C\xDD\xA7\x7B\xAD\x63\xB8\x7E\x69\x01\x37\x37\xC1\x8E\x72\x68\x2C\x01\xC0\xD9\xA6\x0E\xDD\xC7\x09\xEF\x87\x35\x10\x62\xBD\x8F\x07\xE7\xD6\xDD\x91\x73\xCD\x8A\x7E\xB9\xE0\x0D\x97\xEF\xF4\xA4\x5A\x46\x4D\x98\xC0\x8C\x68\xD3\xCD\xB8\x68\x56\x08\xB6\xEC\xD1\x81\x39\x38\xDA\xE9\x37\x62\x59\xB8\xF9\x08\x40\x4F\xE9\x4C\x7A\xDD\xA9\xC6\x3D\x23\x10\xAA\xB4\x22\xFA\x61\xA0\x2F\xDD\xC5\x86\x30\xD5\x56\xF4\x32\xED\xB6\x2A\x85\xBB\xBC\x8C\xF7\xB3\xE5\xAF\xFB\xEE\x96\x01\x04\xE5\x8F\x5D\xEA\x48\xFE\xBD\xD6\xB3\x28\x9B\x38\xC8\x23\x80\xF6\x90\xC4\x9A\x02\x4E\x48\x33\x99\x13\x1F\x10\x5B\x31\xC6\x03\x59\x5A\x50\xDB\x8A\x48\x5C\xC9\x39\xFB\x26\x21\x39\xB9\xC9\x19\x9F\x8E\xD5\xF2\x50\x87\xCE\x6E\xD2\x62\x1F\x91\xD2\x49\x9A\x0B\x81\xAF\xC6\x1E\x4F\x60\xC3\x67\xA4\x59\xA0\x23\x27\xAC\x23\x93\x71\x9E\xCE\xB6\x13\x4A\x5B\x00\xF6\x3C\x60\x13\xE8\x94\x2C\x26\xD5\x2B\x03\x25\x41\xDB\xA6\xEF\x52\x62\x5A\x97\x12\xEE\xC7\xE1\xE0\xC8\x09\x8F\xBB\x2B\x2D\xA4\xA0\x2A\xF3\xA2\x5B\x68\x87\x2D\x34\x37\x69\x61\x28\x99\xCA\x0E\x69\x7B\x54\xDB\x36\x83\x45\x8F\x60\xFA\x8B\x4D\x30\x7D\x93\xE6\x58\x71\xF4\xE0\xE6\x64\xFF\x9A\x0F\xA8\x29\x04\xF0\x03\xB4\x92\x58\xDA\xCC\xCD\xB2\x05\x31\x05\xB3\x04\xA5\xC9\xF8\xA5\xCB\x02\x41\x4B\x3B\xD5\x96\xB2\x11\xBD\xD7\xDA\x72\xFB\x3D\xF2\xC7\x16\xBE\x47\xE9\xAE\x3D\x0A\x07\x04\x4E\xB1\x47\xD1\x79\x48\x7D\x8F\x52\xEC\x51\x98\x41\x28\x71\xA6\xEC\x5F\xC2\x1D\xEB\x5A\x49\xBC\xDE\xBA\x34\x6D\x5E\x3B\xFE\x2D\x3B\x3B\x3B\xE5\xD6\x51\xF1\x3B\x11\x32\xE0\x23\xA7\xCE\xF7\x9E\xF6\x8A\xA8\x39\x3B\x76\x1D\x12\x4D\x71\x5B\x61\x37\xCF\x43\x28\xED\xC8\xFE\x80\x91\x12\xDA\x69\xC5\x11\xA1\x2D\x1D\xF5\x4D\xE8\x28\xD2\xBA\x7C\xEE\xB2\x84\x60\x0E\x5B\x28\x56\xA4\x49\x36\x28\x30\xBC\x49\x81\xB4\xAB\x15\xD5\xC2\x48\x82\x17\xB0\x3C\x4A\xE4\x34\xC1\xEE\x5F\x38\xA9\x83\xDE\x5D\xA7\xCE\x13\x36\xD6\x21\x6D\x85\xE3\x8C\x6F\x46\x9D\x5C\x25\xF3\x52\x22\x99\x9E\x59\x17\x4E\x18\x5B\x41\xB1\xE8\x4D\x8E\x57\x57\xAE\x92\x97\x51\x42\xB8\xE1\xE5\xA5\x87\x09\x6E\xD6\xF0\x00\xC8\x10\xCA\x75\xAD\x64\xAB\x40\xD4\x24\x52\x2A\x4F\xCA\x6E\x9A\xC4\x3E\xC1\x5E\x22\x51\xCA\x97\x91\x4B\xFF\x3B\xCE\x34\xF3\xC5\x24\x6E\xF6\x8F\x67\xCB\xDC\x93\xBE\x9C\xC3\xC1\x05\xE5\x47\xA5\xE4\x70\xAE\x64\x3A\x3C\x74\x4A\x6F\x3B\xF1\xBE\xEA\x4D\x2B\x4E\x59\xD3\x63\xD0\xF2\x57\xA8\x1C\x4B\x6B\x6B\x9B\xB0\x00\x4B\xF8\xEA\xD9\xB6\x99\x9B\xB4\x4D\xA8\xED\x82\xF2\x97\xA5\x5D\x66\xAE\x5D\x54\xEA\xDB\xC4\xD3\xC2\xB3\xEB\x22\xD1\xEF\xF4\x2D\x53\x43\x9C\xD1\x6C\xF9\x7F\x5E\x96\x8D\xFB\x7D\xC0\xF6\x32\xFF\xF8\xBC\x0B\xF8\xA1\x17\x14\x9A\x59\x93\xE3\x5A\x91\x87\x70\xAD\x60\xE7\x39\x62\x11\xCE\xEB\xD9\xA2\x79\x9C\x90\x29\xB5\x40\x50\xA0\x44\xAF\x34\x9F\x20\x10\x97\x19\x20\xC6\x8A\x3B\xAE\x02\x85\x82\x02\x35\xE8\xA1\x24\x8E\x86\xD4\x69\xC9\x12\xB8\x4F\x06\x8C\x41\x1F\xDC\x86\x92\xD2\x19\xF0\xBE\x86\xBE\x7A\xBE\xFB\x0A\x94\x33\x1B\xB4\xA5\x50\x3D\xF8\xE7\x8B\x1B\x95\x75\x49\xA5\xBC\x89\x6D\x45\x3F\x0C\xAA\x71\x6F\x12\x55\xDA\x5F\x5F\x9C\xB9\x1E\x5C\x58\xB9\x56\xAE\xC4\xAD\xAE\x15\xC7\x57\xC6\x7C\x26\x22\x1B\xA7\x37\x29\xB4\x61\xF0\x3D\x81\x4F\xAB\x5E\xCE\x03\x6E\xF9\xD7\xCA\xDF\xD7\xA1\x92\x14\xB0\x7A\x9F\xFD\xA1\xD6\x7A\x5B\x6F\xB9\x56\xD9\x6C\x99\x31\x72\xC1\x43\x45\x70\x3C\x60\x59\x80\x6A\x18\xF0\x90\x73\x22\x24\x3F\x3F\xFA\x74\xAE\x62\x88\xC4\x5F\xE6\x3E\x36\xD1\x89\xC3\xD5\xD5\x9A\x40\x9B\xDA\x65\x99\x7C\xC0\x98\x19\x94\x1C\xCF\x41\xD0\xB2\x42\xB4\x88\x15\xC8\x12\x41\x8E\x87\x24\xEE\x39\xD9\x9C\xA2\xB4\x46\xB8\x30\x47\x9E\x1D\x22\x67\x2F\xD4\x41\x97\xD8\x97\x3B\x7B\xC8\x04\xF3\xA2\x2E\xEA\x44\x1D\xCB\x38\x35\x23\xE3\x34\xD9\x7C\x9A\x96\xFB\xE4\x7A\x20\xE3\xA2\x39\x19\xE7\x65\x5A\x2B\xE5\x2E\x1F\x35\xDF\x90\x41\x98\xFD\x86\xA6\xA4\x6E\x24\x36\xDA\x93\x25\x92\xE3\x0A\xDB\x67\xAF\xBA\xB7\x7D\xEC\x17\x7E\x2B\x3C\x57\x2B\xB7\x7C\x01\xD4\x63\x72\xE9\x9E\xFE\x9E\x9F\xFC\xDC\x9B\xFD\x15\x10\x2E\xC1\xE2\x37\x1F\xAB\x95\x2B\x7A\xD7\xB5\x72\x13\xBC\x94\xC9\x66\x5E\x5F\x87\x3E\x97\x95\x71\xDB\xCD\x06\x9F\xB5\x2B\x5C\xCF\x19\xCE\x55\x81\x79\xB4\x62\x3B\x12\xC3\xCD\x11\x97\x07\x27\xFC\x26\x37\xF0\x8E\x9A\xA1\xD3\x0C\x12\xB8\xDD\xB4\xA0\x16\xE2\x85\x43\x3E\xC2\x21\x98\x0D\x88\x4E\x15\x21\xF1\xCE\x21\x93\x80\xFD\x87\x92\x36\x3A\xA0\xD1\x31\x59\x36\xFF\x19\x1D\xF6\x52\x43\x42\x6C\x08\xB9\x4E\x44\xA7\x0A\xDB\x2F\x44\xF7\x0A\xA1\x68\x32\x9A\xFB\xD9\x33\xB1\x51\x5B\xE1\xB6\x7E\x33\x68\xA4\x65\xD4\x52\x48\x23\x85\xF4\x2E\xB4\x8C\xFA\xB4\x1C\xBE\xF9\x58\xAD\x91\x96\xED\x75\xAD\x91\x96\xFA\x31\x0F\x0D\x2B\x36\x81\xC2\xA3\xC4\x43\xF2\xFA\x3A\x65\x6B\x6C\x5C\x8D\x18\xCF\x6A\x8D\xED\xF2\x8F\x56\xA3\x8C\x77\xAF\x23\x4F\x52\xF2\xB7\xA4\xD7\x29\x30\x49\x6E\x19\x2F\x41\x53\x02\xCB\x60\x68\x98\x35\xF2\x6A\x48\x1E\xA5\xB3\x4E\x18\x9D\x2A\x2C\x2E\xE5\x26\x81\xE8\x1F\x15\x84\x30\x44\xBE\x45\x54\x7C\x0C\x09\x0E\x6B\xDD\xAF\x86\x50\xAC\xB6\x9B\x2A\xEB\xD5\xA3\x86\xF5\x40\x0A\xD9\x06\x96\xAC\xE7\x4A\x56\x99\x5B\xE6\xCD\x68\xAD\xD9\xF9\x46\x3B\x81\xD3\x2C\x45\xDA\x70\xE0\xD7\x21\x13\x1C\x35\x09\x13\xE6\xEF\xE8\xB2\xCE\x21\xF9\xB1\xB7\x52\x2A\x2B\xA7\x9A\x1F\xAB\x8B\xAF\xC3\xB9\xC6\x8D\x51\x9B\x90\x38\xB3\x06\x09\xB7\xD6\x05\xA7\xCE\x9F\x17\xBD\xB1\x80\xFC\x6D\x6F\xA9\xF3\xFF\x36\x08\x76\xCE\x7E\x1D\xE0\xDF\x20\x78\x2D\x23\x7C\xFF\x30\x61\x70\xBB\xA0\xCA\x32\xA7\x89\xC0\x19\xB9\xC1\x64\x6B\xD3\x3A\x75\xCA\x93\x2B\xC5\x22\xC9\x73\x87\x00\xBD\xD2\xF2\x7B\x68\x27\xCD\x26\x9C\x2A\xF1\x58\x24\x9C\x86\x1B\x12\x31\x7B\xAD\x55\x99\x1F\xD3\xFC\xC7\xA8\x03\xBB\x37\x23\xE5\x66\x70\x2A\x04\xC8\xB0\x5F\xAF\xE7\x59\x95\x3A\xE5\x80\x5A\xF0\x3F\xAD\x6F\xD2\xE8\x4E\xF9\x64\xDD\xB7\x82\x47\x10\x46\x90\xAE\x4D\x6B\xAE\x1D\x65\xD8\xA8\xFC\x4D\xBF\x69\x66\xA6\x22\xC2\xD4\xA3\x0D\x6A\x63\xBC\x41\x5D\x61\x8E\x3A\xCB\xEC\x85\x85\x0A\x63\xB5\x8E\x0D\xCC\x5C\x35\xF9\x84\xC4\xDE\xE8\x94\xC8\xD9\xDC\xAA\x4E\x60\x44\xCE\xF8\xDE\x63\xA1\x8E\x51\x22\xD3\x81\x05\xEB\x84\xFD\x5A\x63\x18\x6D\xB0\x60\xEC\x73\x71\xEC\xD9\xAC\x33\xBC\x93\x50\xF4\x09\xDC\xF9\xD0\x33\x23\xE0\x33\xE5\xC7\x7E\x55\x13\x58\x76\xF2\xCA\xA0\xD5\xC9\x9E\x48\x4C\xBC\xAD\xB7\xC2\x1E\x06\x6C\x0F\x85\x85\x97\x1A\x7F\x2A\xE3\xE2\x0D\x8F\x4D\xF7\xA9\xB7\x0F\x32\x93\xF8\x8C\x5B\xE5\xCF\x5E\xF2\x5F\x1A\xDC\xDE\x5B\x8F\xAA\xD2\x5F\xC9\x4E\xB3\xAF\x6D\x6F\x09\x13\xFD\x38\xA2\xC0\x61\x94\x81\x6D\xE2\x16\x91\x76\xF7\xD5\x61\xBB\x39\xA6\xA7\xF1\xCD\x17\xA8\xF6\xED\x16\x66\xD9\x5E\x10\x59\xCA\xD5\xD6\x49\x53\xB3\xA3\x0B\x84\x7F\x37\xA0\xE3\x75\x17\x36\x7F\x37\x08\x08\x6D\x4B\xF6\x20\xF1\x06\xB9\xAF\xB8\x8F\xFC\xF0\x00\xFD\xFB\x3E\x48\x18\x38\x8F\x4E\x71\x9D\xBD\x70\xED\xF8\xBE\x27\x60\x74\x3C\x7D\xE2\x32\x64\xC7\xD5\x13\x97\x21\xFD\xAF\x95\x3E\xAE\x70\xAD\x59\x96\x65\xEF\xB9\x80\xF0\x49\xDD\x72\x53\x5E\x17\x78\x9E\xC8\x73\x6F\x9F\x3C\x69\x47\x9E\x3A\x24\xD4\x52\xC2\xFB\x17\x31\x17\x72\xDB\x8B\xA6\x1E\x63\x0B\x27\x72\x06\x16\xC0\xF8\x70\x60\xAB\x31\x16\xD7\x6F\x2B\xDF\xF5\x85\x15\x4D\xFF\x1B\x05\xA1\xC8\x74\xD2\xDD\xE9\x18\xAB\x2A\x66\x4B\x90\x0A\xCB\xF6\x05\x5F\x58\xD9\x2B\x6C\x21\x89\xE8\x85\x6A\x92\x11\x14\x65\xE1\x6E\xA8\x8D\xB6\x2E\x3A\x4C\x73\x6A\x03\x26\xCE\x5E\x60\xCD\x05\x47\x94\x04\x85\xF2\xFA\x4D\x7F\x94\x41\x2C\x23\x90\xCA\xDA\x2F\xD7\x35\x27\x74\xA8\x49\xEF\x48\x69\xED\x8F\xBA\xB5\xDF\x6F\x4C\xEA\x09\xEA\xC7\xB6\xA9\x42\x88\x78\xA8\x23\x3F\xD4\xFC\x39\x9D\x3C\xC6\x1C\x47\xB0\x7B\x87\x26\x34\x03\x98\x8D\x0C\x44\x73\x63\x1E\xF6\xC7\x1C\x86\x63\xCD\x13\xE9\x01\xB7\xDD\x70\x18\xFD\x33\x3F\x32\x3C\x42\x93\x1D\x54\xAD\xF9\xEC\x5A\xC4\x7A\xE0\x3F\x5A\xD5\x0F\x30\xBA\x13\xBD\x8A\x4C\x51\x6B\x69\x0D\xC4\xE5\x47\x2E\x0D\x03\xEF\xA5\x40\xC2\x69\xA6\xC5\xB9\xD3\x8C\x82\x56\x4F\x67\x00\x1D\xE8\x00\x74\x3E\xA8\x25\x06\x0A\xC7\xD7\xFA\x03\xE2\xDE\x2C\xE0\x50\x60\x72\xD3\x8B\x37\x24\x58\x66\x7E\xE6\x91\xAF\x8F\x65\xAE\x09\x1B\x8A\x6E\x28\x7F\xCE\x3B\xB6\x89\x0F\x96\x40\x22\x0D\x6C\x00\xAD\xF5\x68\x97\x0D\x50\x6D\x09\xD2\x95\x3B\x5D\x0F\x5A\x77\x42\xE0\x7C\x28\x47\xDC\xE2\xBA\x66\x4C\x11\x33\xE5\x2F\xD8\x93\xCD\x94\xD5\xE6\x1D\x5C\xF0\x41\xF6\xBB\xBA\x75\x06\xBF\xAF\x36\xA2\x95\x5A\x7F\x42\xBD\x88\x97\xC8\x2D\x1F\xE7\x66\xC8\x79\xAE\x3A\xF1\x3A\xF7\xBE\x47\x2D\x0C\x69\x06\xC9\xBB\x87\x03\x7B\xCA\xCB\x45\x23\x85\xA8\x9B\x14\xC2\x95\x86\x99\x7F\x4D\x26\xB3\x61\x5C\x07\xB6\xBB\xEC\x56\x3F\x18\x9E\xBB\xFC\xCD\x29\xCF\xCB\x5D\x4F\xD5\x5E\x3D\x55\x3C\xE1\x39\x1D\xF4\xCD\x3B\xEB\x9F\xF3\x17\x10\x3C\x86\xF3\x9F\x8E\x7F\xB3\x97\x4B\xC5\x2F\xA7\xAF\xDA\x9C\x80\xFF\x86\x0F\x86\xDA\xEB\x5F\xA0\xC5\xFB\x97\xC6\x3A\xDF\xD6\x5B\x73\x19\xF9\xC4\x17\x4D\x3F\x28\x70\x26\x8F\x6E\x50\x28\xC7\xCE\x6B\x37\x28\x88\xE3\xD8\x06\xC1\x53\xDC\xB8\xF1\xB3\xC1\xC9\x2A\xC1\x5F\xC1\x83\x04\x53\xB1\x53\x9E\xAE\x46\xF4\xC4\x3C\x48\x58\x15\x37\x6E\x4C\x36\xF0\x9F\x53\x55\x8E\x57\x2F\xDB\x70\x37\x5E\x76\xAA\x2A\x40\xBB\x57\x6D\xB8\x57\x9D\x64\x00\x8B\x45\xFF\x07\xE5\x76\xE8\x18\x0A\xF5\x2F\x77\x83\x53\x15\x29\xAC\x08\xC5\x5F\x91\x66\xEE\xC6\xC4\xDF\x9B\xE0\xBD\xD1\x09\xBA\x79\xC3\xF8\xBB\x37\x0C\xDE\xCE\x8A\x94\xA2\xF8\xD5\xE9\x22\x06\xE5\x8E\x6D\xA0\xF2\xA8\xDD\xAB\xAA\x09\x28\xF7\xAA\x8D\x13\xBC\x25\xB3\xD4\x17\x82\x45\x75\x3B\x8A\x2C\xD9\xE5\xB3\x74\xE2\x9E\x65\x10\x57\x13\x18\x9F\x28\x2C\x1B\x21\x76\x5E\xBB\xC1\x19\x05\x6E\xBC\x8C\xCA\xB8\xF1\xB2\x0D\xCA\xDA\x3E\x81\xA2\x7D\x65\xE7\xD1\x0D\x08\xE9\x1D\x6C\x24\x35\x66\xB2\x41\x2B\xC9\x04\xF2\x82\xBC\x0E\x34\x63\xB0\x52\x5D\xE4\xB1\x63\x5D\xDE\x94\x1F\xFA\x56\x14\x51\x13\xF2\xA9\x48\xE4\xF2\x94\x1C\x72\x53\x68\xDD\xE4\x7C\x3D\xF1\xA3\x49\x90\x8C\x95\xCA\xC3\xCC\xBD\x30\x0B\x37\x12\xB4\xF6\xE5\x89\x53\x0F\x91\xC8\x53\xEC\x09\x87\xF3\xA9\xD6\xD7\x8E\xDF\x50\x97\x8E\xA7\x4F\xE0\x65\x50\x1B\xBE\x54\x4F\x5C\x3E\x6A\xCA\xDE\x42\xCC\x38\xAF\x2C\x9C\xC5\x6C\xB0\xA2\x4B\x59\x7B\x70\x3C\x71\xAA\xE1\xBF\x64\x77\xFD\x69\x52\x17\x15\x35\xBE\x6C\x56\xC9\x47\x60\xA5\x01\x2E\xC4\xED\xFC\x01\xA1\x48\x90\xEB\x08\x4A\xFC\x9F\xE1\x3C\x8C\x2B\x7A\xC5\x95\x0D\xFB\x20\x61\x5B\x4F\x16\x8A\x53\xB7\x18\x22\x0B\xF6\x70\xC2\xE9\x12\xB5\x6C\xBD\x26\x74\xAC\xCD\xA9\x9D\x93\x53\xEC\x31\x45\x7E\x4F\x90\x5E\xAB\x4B\xEC\x93\x7A\xEF\xF1\x7D\x4F\x5C\x86\xB2\xED\x10\x0C\x3A\x92\xD0\x79\x27\x77\x84\x08\x8B\x0A\x78\x00\xEA\x45\x77\x80\xC9\x92\x42\xD2\x2F\x8D\x91\x33\x29\x93\x91\x24\x13\xD9\xA6\x34\x8A\xBC\xD5\xEF\x0F\x0F\x67\xFD\x43\x5E\x40\x02\xD4\xAA\xA1\x50\xAC\x6E\xA4\x80\xEF\xEC\x36\x58\xC9\x17\x63\xB0\x92\xDB\x19\x2C\x7D\xBA\x40\x26\xDC\xEA\xC6\x86\xBD\xFC\xEA\x09\x37\x1D\x2C\xF0\x2F\xC2\xEB\x9A\x70\x50\x94\xBE\xD6\x1B\x22\x73\xAD\x1B\xA3\x41\xFB\x19\xE6\xA7\x37\x46\x64\xBD\xD9\x7D\x8C\x6E\xB9\xDD\x3E\xB9\x92\x99\x1D\xA3\x6D\x1C\x9C\x89\x77\xC2\xA0\x03\xD3\xC8\x6B\xF6\xAF\xAB\x27\x48\x4E\xC2\xBD\xF4\xD2\x55\xE0\x0B\x27\xA0\x58\xB1\xA0\x87\x94\x34\x2D\xE8\x99\x82\x03\xF1\xE5\x13\xC5\x85\x0A\x03\x25\x6A\xBC\xAE\x48\x20\x4F\x56\xF5\xEB\xC8\x0F\x06\x98\xF5\xBB\xF9\xED\xE7\x6C\x4F\x58\x38\x7F\x5A\xD1\xD5\x32\xF1\x36\xAF\x7D\xAD\x52\x33\xE1\x0D\x03\x8D\xB9\x1F\x79\x6F\xFB\x9A\xF4\x6D\x5F\xFB\x60\xE2\x37\x85\xAD\xC9\xA9\xBC\x5A\x04\xB0\x8F\x10\x6A\xF5\x31\xD8\x77\xB5\x56\x45\x00\x65\x57\x7A\x35\x81\x92\x2C\x4F\x5A\x1F\x83\xB2\x67\x79\x9A\x48\x27\x95\x68\x9F\x72\x5D\x4F\x08\xD4\xA6\x9E\xA0\x7E\xA5\x48\xBF\x9A\xF4\x2C\x4F\xA5\xB7\x3C\xED\xEB\x59\x9E\x78\x00\xAC\x27\xBF\x22\x5A\xA7\x48\xA8\x70\x76\x04\x90\x6C\x29\x8F\x01\x3F\x77\x64\xA7\x1D\x12\xA8\x1D\x86\x49\x37\x0C\xA9\x0C\xC3\x44\xF2\x87\xE3\xD7\x56\x86\x61\x46\xC6\x92\xE7\xC3\xAB\x05\x3E\xBB\x37\x1A\x59\x3F\x91\xEC\x7F\x66\xAB\x24\xAF\x3E\x94\xFA\x91\x57\x50\x27\xB9\x61\x7A\x2D\x0A\xFD\x90\x45\xED\x90\x85\x33\x43\x46\xFF\x9C\x9E\xCE\x0C\x5E\xDF\xAC\x4F\x3E\xBC\x76\x66\xF0\xE2\xAB\x12\x14\xC0\xF9\xD3\x79\xF0\xE2\xAE\x9E\x4A\x43\x4C\x83\x47\x9E\x6E\x03\xB3\x61\x38\x18\x3C\xB9\xAE\xB5\x18\x60\xBA\xC1\xD3\xBD\xC1\x8B\xFD\xE0\x45\x73\x83\x17\x74\xB3\x47\x51\x8C\x8C\x9A\x9F\x3D\x0A\xAC\xCC\x1E\xC5\xB3\x47\xED\x3D\x7B\x6C\x3B\x7B\xDA\x61\xCB\xB2\x7F\x3E\x36\x44\xFB\x6D\x5A\xF9\xFA\xC5\x88\x49\x57\xB1\xB3\x93\x37\xE0\x0B\xF9\x4D\xB7\x0D\x20\x75\xEA\x23\xCA\xFD\xB6\x22\xF9\xC8\xE4\xEE\x9F\xCF\x10\x8E\x9C\x9A\x21\xB7\x45\x72\x1B\x49\xB4\x03\x86\x4F\xA2\x6C\x57\x6E\x15\x82\x25\x72\xD3\xA6\xA9\x47\x6E\xD9\xE3\xB5\x27\x51\x72\x3D\x3C\xD7\x1B\x1E\xEA\x41\x00\xD6\x93\xDB\xF4\xC8\x2D\x3B\xE3\x1D\xE5\x7E\x5A\xF5\xA4\x9A\x6E\xFD\x3E\x86\x03\xA1\x17\x0F\x84\xDE\x7D\x20\xA2\xDE\x40\x44\xDD\x40\x74\xD6\x88\x6E\x20\x66\xF8\x7C\x57\x42\xBF\xA0\xDC\x1F\xDF\x94\xD0\xA1\x14\x75\xC8\x7C\xC3\xDE\x44\x56\xBB\x10\x59\xCD\x10\x59\xAE\xF7\x38\xEE\xDB\x8D\xC8\xAA\x47\xE4\xEE\x57\xC8\xE4\xBE\x09\xD1\x43\x22\x7A\x38\x4F\xF4\xB0\x25\x7A\x38\x6F\xE0\xD8\x93\xE8\xA1\x9C\x1B\xDD\x3A\xD1\x3F\xAB\xDC\xE7\x6E\x89\xBB\x6F\x89\xE8\x7F\x03\x9C\xBD\x90\xE0\x73\x9C\x3E\x1C\x00\x26\xBF\x1A\xAE\x1C\x7A\x55\xBF\x6E\xB2\x68\xE1\xD0\xED\xC2\x31\x99\x5F\x37\xC2\xDE\x10\x84\xF3\x43\x10\x76\x7C\xEF\x3F\xBE\x99\x6C\x91\x56\x7F\x79\xC9\x16\x08\xBC\x4C\xBC\xA9\x5C\xF9\x92\xB3\x38\x04\x5E\x64\xCC\x8F\x7F\xAD\xBD\x1E\xB7\x4B\xCB\xD4\xE2\x96\xA9\xDB\x6E\x99\x5A\xDC\x32\x99\x57\xBD\x96\xE9\x45\x3C\xF9\xA2\xE5\xF0\xAD\xF3\x63\x96\xDD\x35\x63\x1E\x02\x45\x6E\x7E\xBB\xDE\x9F\x06\x6C\x57\x5A\x61\x7F\x19\xC5\x10\x12\xE4\x75\x99\x3D\x1E\x6A\xB3\xAD\xBC\x95\xE0\x85\xA0\x97\xB8\x1F\x79\xEC\x6B\xBB\x3D\x3B\xF6\x64\xBB\x19\x6B\x15\xE8\xBD\x1D\x44\xE4\x04\xA8\xF3\x60\xE8\x9F\xD0\xEE\xE6\xC1\xC0\x2E\xE5\x9A\x0D\x01\x5F\xB2\x2A\xC0\xBA\x4F\x04\xB8\x87\xF8\x64\x20\xBB\x70\x9C\x6C\x87\x83\xAF\xA9\x22\xD7\x65\x16\x98\x13\xB8\xAD\x03\x8A\xE8\x2B\x11\x44\xBB\x4D\xF8\x18\x74\xC5\x41\xE3\xBC\x8D\x0A\x71\x03\x12\x71\xBD\xB2\xDB\x05\x0B\xF1\x51\xFD\x00\x58\x30\xAB\xFA\x7E\x8E\xBE\x08\x67\xAA\x16\xE7\x0B\x4B\xEE\xA0\x83\x16\xB0\xEB\x45\x08\x61\xAF\x05\x54\xD2\xCA\xC0\x07\xA3\x8A\x33\xDA\x2A\xB9\x04\xBB\x7B\x7F\xD3\x21\x1F\x51\xED\x2F\x27\x43\x04\x3F\x5C\x19\x3C\xB4\x87\xCC\xFD\x47\xCD\x32\xFF\x5A\x39\x6A\x70\x07\xF6\x6C\xD0\xA0\x4A\xE7\x96\x1B\xB6\x5F\xFC\xEF\x97\xA4\xDF\xB8\xB7\xB2\x87\xF4\xAB\xAB\x18\x37\x63\xA7\x2B\xD3\xCB\x7E\x8F\x5A\x64\xE7\x09\x92\xAB\x96\xED\xC0\xBA\x17\xBC\x37\x6B\xF6\xB3\x25\x29\x78\xC6\x1F\xBF\xBC\xA0\x7A\xD9\xC6\x7B\xAC\x3B\x1C\xFE\x7E\xFA\xC3\xBD\xFF\x4F\x24\x46\xFE\xBD\x23\x50\x49\x6A\x6C\x18\xC5\x4B\xC5\x28\x1B\x4F\xF6\x1F\x28\xF7\xE5\x7A\x69\xC6\xA0\x99\xDF\x41\xD3\xAD\xFC\xD7\x64\x28\x5A\x12\xDB\xDA\x8A\x2E\xCB\x9F\xB8\x24\x5E\x27\x8F\x3A\x7D\xAA\x38\x00\xB1\x7B\xBF\x22\x54\xA9\xF2\xC3\x1C\xC4\x82\x7B\xD5\xA4\xE1\xFB\x1D\x51\x63\x88\x0F\x99\xF7\xAB\xA3\xA6\x64\xD7\xE4\xC0\x25\x1C\xFA\xC9\x0F\x83\x43\x5A\x9C\x9B\x9F\xC3\xD2\xA8\x14\x88\x3D\x91\xF9\x76\x0F\xB8\x0A\x0B\x7B\x4E\x1D\xD5\x41\x7E\x80\x84\x55\xCF\x1B\xB1\x4E\x28\xC1\xBB\xBC\x19\x21\x07\xEE\x87\xD0\xE5\x38\x4C\x38\x30\xE4\xEE\x1B\xBB\x23\xD4\xC8\x64\xA6\x01\x47\x20\x76\x40\x4F\x74\xBF\xE9\x9A\x1E\x42\xAF\x75\x47\x1A\x7A\x53\x1A\x98\xEC\xDE\x40\xD0\x5C\x35\x81\x4A\x85\x05\x36\x78\xB6\xC5\x73\xED\xDD\x07\xA1\x2B\xDB\xF6\x26\xD8\x36\x5B\xA5\x1C\x35\x10\x52\x52\x56\x9F\x6F\x1F\x1B\x56\x8D\xF8\x58\xA8\xCE\x28\x6C\x3C\x95\x13\x34\x4E\x1A\x0A\x59\x8B\xC3\x3B\xBF\x41\x4B\xFD\x61\x41\x4F\x8C\x64\x10\x79\x27\x43\x7D\x0C\xD2\xAB\x5C\x26\x17\x31\x62\x0F\x0D\x39\xC9\x25\x47\xA2\x0C\x52\x5A\xA6\x73\x7C\xB9\xB7\x4C\x67\x90\x0F\x1C\x35\xE4\xBA\xCE\x18\xCD\x21\xEB\x8E\x23\xB2\x76\x99\x1E\x79\x1F\xB4\xD4\xFB\xA0\x55\x29\x19\x9D\x3A\xF1\xE5\xA9\x49\x07\xA3\x49\x11\xE4\xFB\xB3\x0C\xF4\x2B\x94\xC6\xAD\x1F\xF9\xC5\x0F\xC9\x19\x33\xA1\x29\xA4\x4E\xF1\x1B\xA0\xDD\xF5\x60\xC3\x45\x17\xCA\xFF\x83\x78\xBB\xEC\x17\xA0\xDA\x02\x28\x5E\xA6\x5F\xC4\x75\xC5\x1E\xE8\xF8\xC2\xEC\xB3\x87\x7B\x9C\xF1\xDC\x5C\x15\xC4\x0D\xFA\x79\xC5\xDD\x88\x57\xF4\x75\x32\xD6\x4C\x7A\x15\xBF\xB0\x6B\xCB\x5F\x2B\x2D\x7F\xA1\x5F\xEC\x07\xA9\xE5\xE3\x6E\x56\x52\x49\x4E\x6D\x94\x1F\xA5\x27\x05\x61\xC8\x96\x27\x0A\x5A\xFB\x9D\xA5\xC0\x42\x49\x56\x50\x09\x44\x03\x59\xCB\xEC\xC9\x22\x70\x7F\xF4\xF4\xE0\xE8\x26\xA2\x6F\x19\xE3\x22\x67\x4F\xCE\x62\xD5\xB3\x2A\xC5\xF8\x8F\x33\x2F\x4F\xE6\xBE\x6F\x09\xA1\x57\xF4\x12\x9F\xD5\x0C\xDB\xC6\xBC\x5A\x10\x1D\x3E\xA1\xAA\x04\xFF\x3E\xAF\xAA\x1C\xFF\x3E\xA7\xE8\xF0\x11\x62\xF7\x14\x0F\x44\xC2\x9E\xB4\x3B\x83\xAB\xCF\x06\x22\x5F\x9E\x1B\xCA\x97\x7C\x55\xBF\x47\x41\x8C\x8D\x7D\x4A\xB1\xBC\x79\x4E\x1D\x35\x8F\xF2\xCF\xA7\xD4\x51\xB3\xA3\x78\x8C\x89\xA0\x3B\xAA\xE1\xC2\x64\x0E\xC7\x2B\xFA\x59\x69\xCF\xCF\x49\x7B\xAE\xAB\xAA\x10\x28\x04\x8A\x7E\xC0\x45\x8C\x56\x2A\xC6\x06\x51\xE5\x4F\xB1\x2C\x74\x01\x99\xD8\x5D\x50\xFE\x3C\x8F\x37\xE3\xEC\x7D\x26\xE8\xC4\x81\x3A\xA4\x5F\x87\xE2\x8A\x33\x5E\xE1\x07\xCA\x05\xE5\x87\x68\xB4\x46\xE2\x9B\x5C\xD6\xC9\x8A\x9E\xF3\x0F\x14\x25\x26\x1F\x65\x90\x50\xDE\x6A\x5F\xAF\x3E\x86\xE2\x2B\x27\x27\x08\x17\x9C\xAA\x0A\xBC\x4C\x18\x0C\xB8\xC5\x1D\x69\xC5\x7F\xCE\x6E\xCF\x3F\x43\x27\xCB\xDA\x59\x3A\x7E\xF9\xCD\xE0\x74\x11\x62\x0F\x3F\xC2\x81\x34\x7C\x9B\x0D\x2A\x72\x51\x47\xEE\xCF\x83\x07\x29\x4E\x9A\x3E\xC6\x42\xFE\xB3\xE8\x27\xA1\xFB\x4D\x94\x24\x50\x54\x19\xEA\x15\x45\x85\x2F\xBD\x40\x6F\x3B\xC9\xF1\xAF\xDA\xC3\x1A\x45\xA1\x10\x19\x9B\x9E\x78\xC3\xCA\x37\x7E\xC1\x87\x47\x26\x0D\x07\x9F\x27\xD4\x2F\x14\x17\xA7\x7C\x8A\x30\xA6\xDE\x1C\x61\xF3\xB4\x25\x9D\xF7\x4C\xDD\x4D\xB2\xE6\x29\xF2\xD5\x93\x6A\xB7\x79\xF6\xA4\x92\x89\xF6\x24\x45\x1E\xFE\x24\xB5\x32\xE1\xD1\xD2\x4E\xD1\xB1\xE4\x94\x97\xB8\x3C\xE6\xDB\xCA\xE9\xC1\x6D\x36\x73\xBA\xC4\xD9\xC1\xED\x90\x6F\x5B\x97\x0C\x6E\xB3\x35\xCE\x95\x72\x69\xF8\x12\xE4\x52\x67\x8B\xB9\x40\xF5\x96\x65\xEC\xD0\x0B\xCA\x2B\x11\xDF\x3D\x52\x89\x57\x20\x9E\xD2\xAD\x03\x07\x18\xF7\xE3\x1E\xE9\xCF\xB8\xF7\x2A\x09\x36\x32\xEE\x3D\xDD\xCF\xCF\x2A\x09\x2D\x32\x6E\x47\xFB\x5C\x96\xEE\xF3\xAA\x41\x81\xFC\x97\x86\x9E\xE0\xBB\xEF\x50\xF4\xD7\x7C\x5A\x81\xF1\x31\x27\x6F\x57\xEE\xF3\x5A\x1C\x92\x6C\xF9\x6B\x97\x19\x9A\xCE\xA9\x55\xFD\x73\xF8\x56\xF0\xCA\xE0\xBA\x02\x03\x76\x55\x7F\x58\xB9\xEB\x81\x7F\xD3\x57\xFD\x76\xD5\xB8\xFB\x9B\xE3\x57\x70\xE1\xC0\x7A\x2C\x87\x39\x51\x10\xE2\x91\xF6\xD7\x4A\xFB\x0B\xDA\x5F\xCB\xED\xAF\xB2\xFD\x95\xF8\x2E\x61\x7D\x1F\x55\x60\xCB\x5F\x15\xC7\x82\xE0\x70\xA0\x25\x0F\xBB\x71\x1A\x1B\x47\xE7\x8C\x47\xCD\x0B\xB2\xB3\x3D\xAE\xFE\x71\x11\xB8\xA7\xDE\x12\x75\x5B\x26\x7D\xD5\xFD\x39\xC1\xD6\xEF\xEC\xEC\x24\xA0\x8F\x5F\x79\xF3\xC5\xE3\xC9\xF6\x55\xD0\xC7\xFF\xEC\xF1\x9D\xEB\xC1\x57\x4F\x2B\xB2\xC7\x5A\xEC\xE6\xAA\xBE\xA2\x39\x9C\xFF\x13\xD8\x5D\xF5\xCA\xE0\x59\xCA\x8B\x5C\xBE\x93\x4E\xBD\xC2\x55\xFD\x56\xAE\x28\x3C\x21\x89\xC5\x8C\x7B\x2B\x8E\x4B\xF9\x2B\xB4\x23\x8A\xDA\xEB\xE7\xE8\x9A\xD0\x3D\xDE\xAA\xAA\x10\xFF\x7E\x82\x13\x17\x3E\xCB\x82\xCF\xB8\x27\x75\x4F\xF0\x19\x8E\x23\xA3\x3F\x4F\x6A\xCE\x36\xBA\xB9\xAA\x3F\x88\xD4\xBF\x42\xB8\x86\x6F\x57\xA8\x2B\xF3\xF7\x41\xF9\xAB\x24\xA2\xC2\xF2\x2F\x48\x6B\x36\x87\x83\xEB\x8A\x88\xF2\x79\x5F\xFA\x95\x9E\x58\xF5\xDD\x93\xEE\x98\x43\xE6\x8A\x3A\x6A\xDE\xE4\x7D\x7B\x9E\x57\x75\xC2\x0D\x94\xE8\x7E\x1C\xED\x9C\x7D\xCA\x38\xAD\x17\x3D\x7E\x4E\x79\x7C\x81\xF9\x78\x2B\x0B\xC9\xAB\x07\xF1\x56\x66\x3E\xDE\xCA\xAC\xE8\x8F\xAA\x7A\x44\xBB\xFF\xA4\x0D\xB8\x4A\xFA\xF1\x53\x44\xFA\x8F\x2A\xB6\x08\x8C\x38\x70\x32\x6D\x23\xAE\xD2\xDD\xBF\x68\x43\x1B\xA5\x3B\xD4\xF0\x8C\x39\xE8\x39\x62\x92\x74\x55\x3F\xAF\x88\x10\x12\x6F\x48\xCD\xF1\x0D\x11\x67\xF2\x84\xB3\x84\xDD\x2F\x34\x64\x62\xF6\x46\x48\x9F\x03\xC3\x9B\x0C\x30\xEE\xD3\x83\xA7\x58\xD3\x37\x30\x71\xDF\x74\xD4\xDC\xCF\xBF\xBE\xE1\xA8\x59\xE1\x91\x96\x01\xC4\xB2\xA9\x08\x59\xAE\xFC\x38\x91\x43\x11\x33\x44\x9D\xB6\x45\x9A\x43\xE6\x49\x7D\xD4\x5C\x51\xD8\xD8\x0F\x2B\x49\x3D\xAE\xA6\xAF\x0C\x28\xE7\x38\x44\xA0\xA6\x75\xC4\xB0\x90\xEA\x95\x01\xA1\xAE\xAF\xE8\x2B\x0A\x19\x35\x11\xCD\xD1\xD0\x36\x91\x6A\x2F\x7F\x4D\xEA\x5C\x96\x1E\x7C\x62\xD0\x03\xD9\x45\x25\xFD\xEA\xBF\x06\xF7\x4F\x2D\xC7\x24\x33\x7D\x59\xE6\xA0\xA1\x56\x7D\x9E\x69\x79\xCD\x6D\xD7\x57\xC9\x5F\x01\x7B\x80\x83\x95\xCB\xE7\x41\xF9\x31\x62\x0E\xA2\x38\xB6\xEE\xC7\x2E\x89\xD4\x79\xAA\xC5\xFD\xB7\x5D\x90\xDC\xA7\x8C\x8A\x7A\x79\x96\x07\xC9\xCD\xD9\x39\xC6\x8A\xD3\xF8\x83\x45\x3F\xEB\x98\x45\x05\xE7\x9B\x9B\xF1\x38\x08\xF1\x7F\x8A\xFE\x0D\x75\x98\x81\x7D\x85\x8A\xEA\xF0\x04\xC3\xD5\x93\xAE\xC8\xD0\x15\xA1\x53\x27\xA7\x2B\x3A\x28\xFF\xFC\x32\xD9\xDD\x72\xDA\xCD\x13\x14\x8A\x6A\x78\xA2\x93\x05\xE2\x15\x2A\x72\x5A\x58\x9C\x61\x7A\x72\x0E\x8F\xA3\x82\x19\x41\xC0\xD9\xCA\x38\xC5\x9B\x15\x30\xB8\xDD\xB6\x0C\x85\x7B\xE3\x86\xD9\x70\x7A\x6D\xCA\x69\x40\x7D\x55\x9C\xE4\x85\xB2\xC1\x13\xE0\x24\x97\xB4\xE6\xF7\xA0\xB8\x73\x7D\x85\xD2\xE5\xE5\x6F\x95\xB7\xAD\xCC\xFF\x98\xB9\x9F\x72\x98\xAD\xE8\x9C\xEF\x72\x46\x33\x4B\x3B\x63\x82\xE4\xA0\x06\xAF\x0D\xBA\x36\xDB\xB1\x8A\x54\xBE\x9C\x8E\x5E\x94\xF4\x52\x13\x89\x89\x8E\x19\x2A\x8A\x4F\x0F\x40\x03\x80\x82\x2D\x71\x4B\xF9\x84\xB4\x8A\xD0\xA4\xA4\x09\x86\x7C\xE3\x1D\x97\x53\x5E\x91\x37\x32\xDF\x70\x0A\x46\xCF\xC8\xE9\xD5\xAF\x73\xD9\x5F\xBD\xC8\x81\x9E\x0C\x06\x7A\x6E\xA4\x29\xCF\xFE\xDC\x70\x37\x12\x30\xB8\x70\xC8\x9F\xDB\x6D\xC8\xFD\x40\x6F\x36\x04\x92\xD3\x32\x80\x8C\x7D\x50\x19\x49\x1B\xF8\xD7\x1F\x7B\xB7\xDD\x9C\xFE\x1B\x19\xFE\xE7\xFE\x96\x0C\xFF\x07\x26\xAA\x4D\x63\xF3\x42\xB0\x5E\x87\x5D\x16\x1B\x89\x3A\x8D\x7C\xD4\xA9\x5A\xD1\x49\x1D\xB3\x9D\x86\x82\xCB\x97\xEA\xB4\xA9\x47\x14\x75\x9A\xF9\xA8\xD3\x11\x64\x83\xA8\x53\x09\x84\x7F\xA7\xB7\x7F\x2C\xD7\xB2\x3D\x27\x08\x6D\x0A\xAC\x59\xC2\xA5\x83\x80\xC4\x96\xC5\x77\xB9\x1E\x41\xBC\x5E\xC7\x83\xA8\xD3\x78\x0A\x29\x44\xFD\xA8\xD3\xD1\x20\xEA\x54\x3C\x75\x39\xEA\x14\x2B\xAA\x92\x0C\x92\x2A\x82\xA4\xCD\x1F\xC6\xF8\x08\xBB\x04\x61\x32\x20\xB7\x25\x9F\x51\x50\x2E\xA7\xDE\x28\x0F\x69\xB3\x5E\x27\x83\xD6\x24\x53\x50\x6E\x89\x9E\x91\xC7\x49\x5E\x7E\xD2\xF7\x70\x89\x6A\x6F\xBB\x18\x65\x10\x41\x42\x44\x8A\x3D\x91\x12\x88\x5B\x22\xD5\x89\xDB\xC6\xFD\xA2\x40\x51\x25\xD2\xBE\x04\xD7\xCD\x55\xFD\x72\x48\x70\x1D\x04\xFE\xB3\x04\x89\x2B\xFB\x8D\xE6\x5E\x2F\x13\x52\xC2\xAA\x5E\xE6\xC8\x9F\x04\x78\x74\x28\xA1\x68\x32\x0C\x0A\x4E\x7A\x41\xC1\x75\xC2\x5E\xBC\x5D\x08\x27\x6F\x8E\x2C\x67\x47\xA6\xA2\x81\x86\x8B\x81\x13\x22\x72\x85\x60\x9D\xFA\x20\x9D\x97\xE1\xD8\x45\xB4\x2F\xA0\x86\x49\x9B\x42\x48\x0E\xE9\x04\xF5\xD2\x90\xF6\xF5\xB8\xAD\x0C\x21\xDA\x77\xC9\xE3\x2A\xD1\x5E\xE2\xB9\x60\x60\xF9\x09\x0F\x99\x87\x8F\x0A\x37\xA3\xE6\x74\x56\x2A\x20\xC0\x5A\x6F\xA3\x58\x50\xC9\xB1\x7E\x25\x64\xA9\x08\xDD\xAF\x04\x0D\x44\xFB\x9E\xE0\xEA\x12\x77\x70\xAE\xBA\x44\xAA\x5B\x42\xD5\xF2\x70\x70\x96\xBD\x1E\x13\xB7\xD4\xD4\x49\x9F\x3B\x92\x8E\x3B\x74\x06\x29\xEB\xF8\x7E\x5C\xDC\xCB\x1B\x39\x49\x8E\x51\x74\x44\x63\xAD\x55\x80\x7B\xB9\xFC\x5C\x5D\x94\xEF\xA0\xF9\x3D\xE6\x70\x00\xB7\xD9\xD4\x13\x97\x3F\x82\xBC\x1B\x6F\x90\x39\x68\xCC\x28\xDF\x01\x44\xEB\xD5\x08\xAF\xCC\x31\x88\x58\x0F\x8F\x5C\x8E\x7B\xE6\x11\x8E\x6A\x06\xA3\xB3\x95\x81\xAC\x1A\x71\xF4\x34\xF9\x07\x3D\x4F\x19\xD6\xC7\x50\x08\x2A\xA3\xFF\xEC\xF9\xA0\xF1\x3F\x9F\xED\x7E\x3E\xD0\xFE\x3A\xD2\xFE\xBA\xB7\xFD\xB5\xDC\x74\x95\xFA\x5F\x2F\x04\x28\xAD\x47\x12\xA0\x05\xE3\xD6\x43\x3E\x71\xD0\xA0\x40\x69\xFB\x7C\xC2\x83\x38\x8E\x18\x56\x93\x8C\x94\x31\xB2\x60\x84\x62\x5E\x62\x3C\x2D\xE7\x93\x95\x0D\x71\x1B\x3D\x52\xC5\x28\xB0\xF0\x7A\xBB\xE9\x04\x48\xF7\xBC\x8E\x4F\x15\x5A\xD8\xA0\x24\x36\x68\xCD\x8F\x2F\x87\x8C\xB0\x9D\xE2\x6E\x4C\x43\x88\xC5\x18\xE9\x19\x02\xDF\x87\x68\xDF\xB7\x09\x1F\xE0\x57\xD8\x56\xFA\xD0\x73\x00\x67\x20\x9F\xE5\x8F\x94\x5F\x54\x8D\x44\xE9\x2E\x73\x70\x0A\x16\x51\x45\x8C\x94\x99\x4A\xC3\x72\xF2\x7F\x87\xDD\xD8\x13\xC8\x28\xC9\x0F\x0F\x0E\x1E\x2E\x1D\x35\xE5\x80\x77\xA1\xA1\x77\x09\x34\x73\xB4\xEF\xCA\x2D\x4C\x16\x1A\x04\x8E\xD5\x41\x6E\x24\x61\xC4\xC0\xED\xEF\xE4\x9D\xAE\xEA\x24\x6E\xDD\x17\xAF\xD4\xF8\x64\x81\x84\x8D\x58\x70\xF4\x84\x6C\x7A\x0B\x42\xF6\x44\xA1\xFD\x61\xCF\xAD\xCB\x1E\x5C\x1C\x22\xC1\x9E\x47\x99\x93\x9F\x6B\xD8\x84\x82\x4C\xC6\x52\x33\x90\xB9\x18\x79\xD3\x77\x3B\x7D\x13\x86\x80\x59\xE5\x08\xE8\x65\x8A\xF0\x69\xC9\x54\xA7\x8B\x88\xFD\xB0\x74\x9E\x97\xB1\x85\x02\x7D\x45\x2F\x73\xE3\x6F\x43\xA6\x8F\xBA\xDE\x8D\x16\xC8\xF4\xB8\x2F\x6E\x6E\x26\xD3\xD3\x59\x81\xBE\xCA\x8D\xC1\xBE\x11\x3A\x68\xEF\xE4\xE3\xAA\x56\x09\x05\xDF\xED\x1D\xB7\x2B\x36\xB3\xEE\xBC\x07\xF7\x8F\x9A\xA2\x78\x6F\x2B\x9C\xB8\x8E\x7A\x91\xF4\x12\x36\xEF\xF1\x69\x08\x16\x20\x21\xB5\xAB\x8D\x8D\xA5\x39\x62\x67\x62\x63\x17\x62\x8D\xA5\x1C\x1B\x9B\xB6\xB0\x00\x29\x01\x5A\x41\x72\x9E\x42\x0A\x18\x6D\xBC\x17\x1B\x2B\x95\x67\x1D\x06\x76\xD4\x80\x11\x7C\xE7\x99\x60\xD9\x0F\x19\x6D\xBB\x63\x4A\x98\xD3\x6E\xE5\x0C\x96\xE1\x3F\xCC\x8A\x4E\x78\x9F\x9A\x7B\x3C\xC0\x07\xE4\x58\x5D\x28\x72\x1F\x3E\x7C\x98\xE1\x4E\x18\xE3\x43\x30\x35\x04\xC5\xC3\xA0\x04\xF6\x60\x29\x12\x01\x7B\x2F\x03\x74\x3C\x40\x49\x83\xCB\xE7\x2F\x8B\x7B\xF7\xBD\xE5\x6F\x76\x3F\x7F\xC3\x9B\x5B\x56\xF4\xBD\x87\x03\x4D\x36\xC5\x65\x1F\x96\x76\x3C\x40\x41\xA1\x48\x6B\x03\xED\x26\x4D\xF9\x9D\xDF\x2A\xAA\xE3\xE1\xA0\xAC\x43\x9F\xC0\x84\x33\x06\x1E\x0E\x26\xEE\x06\xE7\x61\x21\x48\x13\xB1\x28\x4B\xBE\x0F\x42\x6D\xA2\x7B\xCB\x1C\xF9\xA6\xCE\xE3\x6D\xFB\xF2\x20\x58\xD5\x07\xC9\xB6\x68\x71\xE6\xD2\x35\x64\x1C\x9C\x8F\x6F\xF7\x50\x4C\xEE\x95\xC3\xCE\xE0\x90\x39\x5D\x47\x64\x00\x3A\xBE\xB3\x73\x5D\xEC\x9F\x11\x92\xA8\xAC\x15\x0D\x04\x11\xF3\xF4\x94\xBC\xDD\xAF\x5D\x7C\xF3\xF1\x2B\x6F\xBE\x58\x47\xC7\x03\x5C\xB0\xBE\x7A\x4A\x31\x45\xD8\xC7\x7B\xC1\x40\x74\xD4\xBC\x16\x15\x53\xE8\x14\xD3\x31\x8E\x41\x00\xAA\xFC\xE5\x4B\x9C\x77\x06\x87\xA4\xBD\x7C\x41\x29\xBB\xCD\xDF\x2F\x79\x40\x14\xC5\x31\x98\x7A\xDD\xE9\x37\xD6\x86\x22\x98\xC5\xAA\xDB\x07\x26\xB1\xCE\x36\xB5\xF6\x19\x4F\x90\x42\xF2\xBE\x3E\x43\x11\xD2\x7F\xC7\xA3\x6B\x92\x5F\x2E\x1F\x5C\xBB\x8F\x0B\xCA\x9B\x5D\xD5\xA5\x24\xC7\x3E\x39\x5B\x3A\x21\x00\x72\xD6\xEC\xCC\x23\xB4\x30\x80\x29\x7B\xDD\x13\x5E\xD9\xBA\xBB\xD8\x38\x7D\xC1\x6D\x3F\x86\x72\x63\x55\x27\x99\xDF\x65\xCD\x40\x3D\x65\x36\x08\x82\xEC\xE0\x4D\x14\x56\x7E\x68\xFB\x0F\xED\xCC\x43\xDD\x7F\xD8\x9D\xCD\x65\x9F\x0C\xFB\x59\x36\x24\xFA\xBB\x85\xB6\x52\xED\x9E\x8B\x51\x61\x38\xF9\x8C\x47\xEA\x24\x63\x60\xDB\x4C\x4E\xCA\xC2\xA1\xE3\x12\x6F\x31\x13\x3E\x1E\xBA\x84\xF6\x65\x82\xAA\x46\x38\x9E\xBD\xF0\x71\xBA\xBE\x38\x73\x3D\xB8\xB0\xAD\x6D\xB5\xF4\xC0\xA0\xB6\xA9\x7D\x5A\x60\xC9\xAC\xE0\xF4\xA6\x0F\x50\xEF\x4A\x90\x0D\x5E\x3F\x80\x1C\x87\x25\x3C\x51\x18\x86\x53\x35\x10\x52\x9C\x1B\x93\xE1\xF5\xB5\xE6\x00\xC8\x88\xFA\xB0\xE1\x39\x9A\xD6\xC1\x08\xD4\x4C\x48\x31\x1D\x4E\xB3\xFF\x8C\xC1\x12\x29\x5B\x27\xB9\x3D\x33\x82\x8B\x6D\x13\xBB\x3C\xEA\x7D\x32\x2D\x10\x30\x8D\xE1\xF3\x43\xD3\xC2\x4F\x52\xFB\xEB\x98\xB1\x47\x8A\x16\xF1\xDD\x54\xA1\x00\x89\x73\x04\x11\x43\xE0\x11\x70\x96\x39\x64\x12\x0A\x72\xFD\x87\xD4\xAF\x90\x37\x0F\x0C\xEF\x0B\x71\x43\xAA\x49\x47\x45\xBA\xC1\xB0\x0A\xD2\xE0\x02\xF7\xAB\x59\x3B\xBA\x2E\x58\x38\xBA\x14\x53\xD5\xCF\x95\x41\x88\x41\xB1\xCF\xFE\xBF\xA2\x2D\xC4\x1B\xF5\xCD\x7B\xA5\xB8\x57\x27\x7C\x18\xD4\xAD\x76\x42\xCD\x76\x42\xB5\x9D\x60\xA8\x95\x3E\x89\xBA\x6E\x65\x59\x76\x25\x57\x45\x2F\x26\x53\xCD\x65\xC6\x0F\xF8\xE8\xE3\xE3\x01\x63\x4E\x6A\xF7\x23\xB8\xC5\x29\x45\x7C\xB4\x0C\xEF\x05\x85\x97\x2F\xD4\xB0\x9C\xE3\x78\x3C\xE4\xEE\x6B\x0A\x9E\xD8\x21\x0A\x11\xD4\x9A\xB6\x08\xDB\x3E\x6A\x68\x79\xB4\xA0\xD7\xD9\x7C\x42\x49\x28\x7C\x5E\xCF\x80\x96\x3C\xB6\x31\x58\x02\x2C\x25\xB4\x60\x88\x1A\x59\x02\x2D\x84\xA8\x9C\xA9\x37\x3A\x05\xF1\xB4\x8E\xFD\xDC\xD4\x14\xB3\xEA\x61\xE7\xEA\x04\x22\xDC\xBF\x61\x2D\xD5\x88\x91\xFB\x37\x9A\x3A\xA3\x59\x38\xF2\x21\xEE\xB8\x4B\xAE\x73\xC9\x35\x1B\x6F\x50\x4C\x6D\x46\x5E\x21\xA8\xF2\xAD\x57\x16\xAF\x78\xF1\x16\x6A\x63\xC7\x2B\xED\x01\x74\x2D\x81\x64\x80\x3D\x5B\x15\x10\x55\x16\x0A\x1A\xAB\x0C\x46\x4D\x65\x21\x77\x07\x59\xCA\x76\x5F\x53\x7A\x01\x39\x06\xE3\xEB\x19\xBF\x00\x97\x37\x64\x07\x69\xAF\x69\x5D\x2B\xBB\xEB\x25\xBC\x5E\xEA\xAE\x97\x1B\x5A\x0F\xDB\xEB\x83\x78\xDD\xEA\x77\xB8\x68\x50\x6B\xA1\xA9\x63\xC9\x16\xCE\x9E\xE1\x79\x87\xC4\x9C\xB1\x7E\x40\x67\xA1\xFD\x35\x1B\x18\x4E\x39\x63\x3F\x18\x59\x21\x70\x5B\xBC\xAA\x93\xDC\x66\x7E\xE4\x09\x76\xD9\xD2\x3A\xC1\x4C\x20\x30\xEA\x8C\x8C\x75\x96\x83\x69\x39\x06\x5D\xB9\xCF\xBE\x8C\x87\x87\x6B\x56\x2E\x69\xCA\x7F\xEF\x8F\xB4\x16\x3E\xFD\x2D\xDF\x92\xAF\x30\xDF\x57\x98\xAF\x63\x3E\x32\xC0\x11\xC2\x31\xD7\x44\x03\xA2\xA7\xB5\xF6\x03\x42\x6E\x0C\xB4\x70\x78\x68\x03\xAC\x4F\xD0\x0B\x37\x69\x68\x49\x71\x84\xB8\x59\xC5\x1D\x0C\xB6\x27\x1F\xB0\xA0\x25\x06\x24\xB3\x57\xF9\xDB\x97\x5A\x25\xD4\x6B\x2E\x04\xA2\x46\xBB\x74\x4A\x94\x43\xA4\xBC\xD8\xD4\xBA\x7C\x41\x1C\x8C\xE4\xA5\x5C\xF7\xD2\x09\x52\xA7\x62\x39\x7F\xCE\x8F\xB2\x9E\x15\x54\x04\x2B\x2D\x81\xFC\xB4\x6D\x8E\xF8\xC6\x12\xB5\x89\x49\x45\x90\xFD\x4B\x0C\x8C\x5F\x72\xB8\x3F\x21\x9B\x82\x1C\x85\xC7\xF8\x73\x56\x83\x2A\xB3\x19\xC4\x43\xD5\x6A\x91\xD9\xB7\x5B\x95\x6D\xEB\x63\x83\x5E\xE5\x6D\x20\xA6\x4F\x64\x55\xDB\xD7\x50\x36\x00\x03\x76\x38\x91\x42\x02\xA9\x02\x0D\x66\x5D\xC0\x80\xC0\xB4\x09\x9C\x78\x22\xD1\x01\x74\x04\xBA\x61\xE2\x63\x31\x61\xD3\xC6\x4B\xD8\xF5\x3A\xE2\x71\x8B\xA6\x75\xD4\x69\x58\x11\x95\xDE\xDA\xB5\x43\xDC\x58\x62\x2D\x55\xCA\x99\x23\x36\x9A\x7A\x44\xCB\x68\xEA\x27\x12\x6E\xC3\xEB\xAC\x9B\x48\x11\x79\x18\x75\x26\x24\x8D\x57\x84\xCC\x66\xDA\xF3\x25\x52\x7E\x22\x46\x8F\x97\x8C\x5A\xFA\x6C\x95\x13\xCC\x7B\xCE\x80\x9B\x90\x22\xFB\x66\x7E\x22\x75\x5F\x13\x4E\xBA\xE9\x26\x52\x34\xD4\x3D\xC9\x5C\x04\xA6\x9B\x48\x11\xDB\x25\xCB\xEE\x7A\x09\xAF\x97\xBA\xEB\x65\x3E\xC1\x6A\xAF\x0F\xE2\xF5\xC1\xEE\x34\x0C\xB8\xB5\x80\xF3\x5D\xFB\x89\x94\xF0\x44\x12\xDA\x8E\x78\x22\x71\xD6\x86\x19\x04\xF5\x84\xD1\x47\x55\x6B\x23\xE9\xE6\x52\x77\xA8\xF5\x2F\x3D\x3F\x0C\x91\xF3\x4F\x12\x9F\x9B\xD6\xF7\xD6\x4B\xDB\x3A\x3C\x4B\x0A\x5C\xD8\x31\x86\xF6\x12\xD6\x78\x09\x1B\x72\xCA\xC2\x70\xBD\x36\x28\x8A\x7B\xDC\x91\xB4\x68\x8A\x84\xEB\x46\x12\x96\x0D\x15\xF4\x1D\x33\x46\x38\xAD\xC3\x8E\x31\xC2\xBE\x84\xC5\x9D\x6D\x95\x90\x6D\x08\x75\xE4\x8D\xA6\x36\xEC\xD8\x8D\x9F\x53\x38\x9C\xA9\x2C\x68\x3A\x3D\x20\xFE\x18\xF5\xF8\x83\x0E\xCC\x91\x33\x22\xFF\x16\xB9\x8F\x86\xDE\x2A\xC2\xEE\x39\xA8\x4A\x57\x96\xBC\x74\xEA\x0C\x22\xE4\x8E\xAC\x8A\x84\x3B\x0C\x72\x47\x04\x23\xCF\x1D\xDD\xD7\x14\xD4\x17\x76\xDC\x61\x67\xDC\x43\x2C\x72\x47\xD8\x71\x87\x45\xEE\x08\x3B\xEE\xB0\xC8\x1D\x61\xC7\x1D\xE4\x1F\x1A\x76\xDC\x61\xD9\x66\xDB\xD9\x70\x90\x3B\x42\x72\x64\x10\x6D\xB3\xCF\x1D\x3E\x39\x61\x8F\x3B\xFA\x9B\xA9\x76\xA2\x12\x78\xF3\x80\x41\x2C\x59\xB2\x7A\xA7\x9E\x5F\x11\x18\x5F\x11\x18\x5F\x11\x18\x5F\x11\x18\xB7\x2C\x30\xDE\x69\x09\xAD\x97\x11\xA5\xF1\x8F\x39\x02\x41\x0B\x4E\x1D\xB4\xF0\xD3\x81\xFB\xB9\xA0\xBD\xF9\xD1\xEE\xE7\xF3\xDD\xCF\x4F\x76\x3F\x83\x57\x06\x49\x97\x7A\x51\xB1\x1F\xE9\xF5\xA0\x71\xE4\x59\xC6\xAD\x31\x14\xCC\x5D\x5B\x47\xBA\xE1\xC9\x29\xE1\x01\x53\x5A\x12\x54\xE8\xEE\xF7\x3F\xAE\x93\xD7\x5F\x43\xB3\x99\x78\xE5\x1A\xA5\xA0\xA8\x63\x67\xC9\x26\xF7\xF6\xED\x8B\xB5\x39\x6A\x00\xF7\xF3\xC7\xB7\xBF\x9A\x2D\x9F\x54\x3D\x27\x0B\x39\x6A\x56\x18\x24\x63\x45\x2F\x81\x26\x72\xDC\xDB\x38\xBD\xE9\xCA\xE6\xDA\xF1\xA5\xAD\x7F\x3C\xF8\xC0\xDD\x2B\x9C\xA8\xBC\x41\x21\xEE\x94\x55\xDA\x3D\x24\x62\x58\x4A\x59\x9F\x94\x4C\x4D\x29\x19\xCB\x7B\x8F\xD4\x2B\x03\x60\xAD\xF0\x20\xEB\x81\xCB\x7C\xB5\x44\x20\x82\xBD\xCF\x72\xA6\x4F\x3E\x53\x33\xDC\x42\x3D\xC9\x2D\xD7\x93\xB4\xF5\x94\x10\x76\x1D\xF2\xB0\xED\xAA\xC3\xC3\x57\xF8\x69\x2F\xCB\xE4\xCF\x84\x6D\xBA\xD0\xBC\x56\x82\x10\xC9\xC1\xB3\x94\x84\xE4\xAF\xBE\x7F\x26\x97\x84\x16\xEB\x22\xB3\xBE\x0B\xF8\xBC\xC6\x4C\x5F\x5D\x04\xEE\xFB\x7E\x74\xF0\x72\xCE\x08\x21\xE2\x3E\x31\xB4\xDC\x10\x4A\x98\xE1\xA7\x76\xFE\x69\x0F\xDD\x9A\xAC\xB5\x7F\x1B\x1B\x26\x90\xE3\x7D\x40\x4B\xE2\xC2\xC4\x7B\x9E\x79\x40\x69\x7A\xF9\x81\xA6\xC3\xC2\x5C\xD1\xF7\xCF\x7E\x36\xFB\x8D\x23\xD3\xA6\x47\x5B\xF7\xE9\x7C\x3A\x18\x4C\xB3\x3B\x0C\xA6\x66\x2B\xE3\x91\x19\x18\xCC\x23\x33\x30\x98\x47\xFA\x30\x98\x47\x16\xC2\x60\xF2\x1E\x9F\x65\x13\x5B\xDA\x7B\x30\x98\x47\x66\x61\x30\x3D\x4A\x84\x87\xC1\x7C\x20\xBB\xC5\xBE\x52\x69\x1E\x7A\xFC\xC8\x22\x60\xF2\x25\xFF\x74\x69\xFE\x69\xF6\x5D\x89\xDA\xDF\xF3\x0F\xB2\x7D\x6B\x5A\x77\x64\x56\x87\x4D\xA7\xAF\xB0\x4B\xEC\x46\x15\x43\xE7\xBE\x53\x25\x2D\xC2\x5B\x9D\x72\x96\x09\x17\x10\x16\x1E\xEF\x0F\x73\x96\xBA\x05\x33\xD0\x18\x52\xA4\xC5\xC4\x71\xB8\x45\x26\xAF\x97\x2E\xA8\xF6\x99\x63\x30\x86\xB4\x11\xF0\x55\x28\x05\xE8\xAA\x38\x51\x68\x08\x41\xBD\xBA\xE0\x9C\x17\xF8\x9B\xE0\x5E\x28\x0F\x08\x64\x4E\x6F\x42\xD2\xD4\x8A\xCF\x33\xDD\xF6\x49\xB2\x74\x6F\x73\xF6\xBA\x7D\xF8\x5A\x43\xCD\xD1\xC7\x20\x5F\xD1\x0F\xD7\xFB\x05\xA4\xE7\x00\xB6\x78\xC9\xC5\x1B\x14\x90\xC7\xE7\xF9\x63\x1B\x28\xA5\x55\x06\x29\x85\x95\xEE\x87\xA5\x61\x82\x9D\xFA\x8E\xD9\x1C\x3C\xFB\xE1\x8E\x5D\x72\xF0\x40\xE1\xD4\x49\xD8\x47\x70\x75\xB8\x06\xEB\x4A\xE5\x11\xB6\xE2\x40\x9B\x9B\x85\xB3\x31\xD0\x09\x39\x2F\x06\xDC\x58\xC0\xA6\x55\x4B\xDC\x5B\x6A\xE1\xC5\x66\xAC\x03\xA5\xE9\x89\x85\xD1\x79\x0E\x39\xC9\x0F\x07\xEA\x04\x94\xE7\xAB\x32\x83\x89\x64\x90\xF4\xD6\xF3\x0C\x22\x9C\xC1\x3F\xD9\x4B\xFD\xE2\x14\xD1\x35\xE3\xCC\x1D\x19\xB2\x5D\x0A\x8C\x6D\xCD\x47\x9D\x6E\xFB\xE4\xB4\x22\x33\x8C\x81\x18\x46\xD3\xFA\xC0\x79\x7F\x02\xCC\xE7\x1D\x1C\xBA\x28\x2D\xAE\x53\x48\x5E\x53\x28\x48\x50\xA1\xC0\x31\x94\xC1\x49\x09\x1F\x93\xC1\x48\x42\xE4\x7A\xE1\x0E\x72\x3E\x71\xAA\x2A\x29\x89\x21\x36\x56\xD1\xBB\x64\x20\x56\x60\x25\x41\xA3\x82\x92\x4A\xE7\x82\x32\xE6\x1E\x72\xE1\x31\x5C\xB9\x27\x18\x85\x9D\x3D\xE3\xC5\x8A\x26\x03\x54\x8A\x65\xCB\x0B\x6E\xAB\xA5\xA8\xE4\x30\x54\x94\x99\x02\xD9\x90\x4C\xC2\x84\xEB\xEF\xA3\xEC\xF4\x66\x3D\x46\xCD\x69\xC9\x59\x1A\x96\xD2\x87\x6C\x86\x50\x62\xE3\xFB\xB0\x4E\x21\x37\x24\xE5\x71\x5B\xD1\x96\x2B\xD2\xE4\x2A\x5B\xD2\xAC\xCE\x60\x09\x2B\x2B\x61\xDC\x54\xA5\x64\x0A\x55\xBE\x9C\x6C\x51\x39\x99\x94\xC3\xA9\x11\xB9\x66\x25\x81\x09\xB7\xFA\x11\xAD\x89\xB5\x82\xF2\x64\xA1\xF3\xA0\x6F\xBB\xC1\x2F\xE0\x00\x8C\x5C\xB9\x79\xBE\xFC\xDD\x4B\x02\x85\xE2\x45\xAE\xED\x1C\xC7\x54\xF6\xE7\xC6\x9A\x6D\xB5\x35\x3C\x5F\xED\xA2\x40\x0D\x2E\x96\x14\x0C\x9A\x33\x32\x46\x22\x10\x46\xE4\x86\x40\x42\xF7\x08\xB9\xDD\xB9\xE5\xA6\xFC\x3D\x0E\xB1\xA5\x1D\x13\xAA\xC1\x92\x53\x2B\x38\x64\xA0\x8E\xD9\xC6\x95\xC8\x50\x2C\xD5\xD8\x09\x3A\x76\xAF\x33\x94\x39\xF7\x35\xEF\xAD\x73\x52\x43\x8E\x6F\x4B\x22\x0F\xC9\x02\x09\xF9\x9B\x8F\x1A\x20\x48\xB5\xBC\x11\xF5\x40\x96\x1D\xF2\x4A\x0B\x5C\xDE\xB8\x00\x32\xEF\xDB\x9C\x4A\x30\xAD\x5F\xB9\x18\x71\x06\x97\x83\xC8\x31\xB8\x61\xDA\x2E\x09\x29\x2E\x09\xA9\x3B\x58\xA1\x24\xCB\x0C\x65\x97\xB4\x10\x34\x6E\x53\xA4\xB6\xBF\x7E\xD3\xCC\xF5\xC5\x99\x6B\x5E\x22\x70\x49\x20\xFC\x52\xE4\xF7\x8C\x97\x04\x22\x47\xC6\xAA\x56\x15\xF4\xAA\x90\x4F\x6C\x43\x59\x42\xDB\xA0\x49\x4B\xC8\xC2\x94\x52\x90\x5D\x68\xC4\x72\x88\xF7\x57\x58\x8F\xF1\x7B\x0D\xCA\x16\x47\x0A\x70\xAB\x66\xB2\x46\xED\x81\xA7\x6C\x53\xFE\xFE\x25\x01\xCA\xA1\x42\x6D\x77\x34\x1B\x64\x9F\xB3\xAA\xD8\x6E\x15\x86\x22\x70\xBF\xFA\x1D\xBD\x03\x7D\x8D\xFB\xA8\x8F\x05\xBC\xE3\xD1\x9C\x82\x4B\x49\xA2\x3C\x02\x0D\xEB\x12\x99\x5A\x92\x14\x2E\xA8\xD8\xF0\xEC\xB6\x36\xAA\x98\x7C\xC6\x23\x0E\xC8\x61\xBE\xA6\x2F\x70\x49\xD9\x79\xE1\x3D\xD1\x39\xDC\x05\xFE\x8B\xEF\xB9\x76\xE2\x9C\x2B\x2E\x34\xF5\xC2\xBB\x74\xE6\x47\x39\x84\x62\xB0\x4E\xFB\xC3\x42\x36\xBE\x46\x6D\x8E\xAE\xC5\x45\x56\x86\x20\x63\xBD\x30\xE3\x6D\x53\xFB\xB8\xFD\xE6\xBC\x04\x10\xA6\xAF\xAF\x33\x3E\x35\x1C\x31\x68\x2B\xE7\x30\x1E\x55\x39\xE1\xA3\xF2\xFD\x47\xAB\x5C\x4E\x0E\xF3\x1E\xA4\x6D\xD0\x02\xD9\x06\xF4\x69\x55\xC8\xC1\x9A\x66\x53\xC3\xC8\xA7\x40\x97\x0A\x0C\x14\x1B\x1C\xEB\x6F\xB8\x64\x83\x25\x53\x42\xC4\xFC\x54\x61\x24\xBA\x30\xF0\x74\x67\x08\xD1\xFE\xD0\x70\xA2\x45\xF7\xF3\xC3\x5B\x16\xCC\x49\x9F\x46\xD0\xAC\xE8\xE4\x54\xC1\x59\xB5\xEA\x31\x9D\xF0\xE1\xE5\x58\x06\x90\x6C\x1F\x44\x39\x3A\x6D\x5B\xD1\x01\x3E\x15\xC3\x01\x6F\x0D\x9D\xE2\xCC\x8F\x30\x86\xB8\x0E\x70\x91\xA5\x8C\xFA\x9C\x77\x15\xB7\x64\x1C\x82\x39\xF8\x06\x22\xC2\x46\xA3\x2D\xDA\x98\x92\x76\x69\x4E\x17\xAE\x85\xC1\xB2\x0C\x92\xEC\x03\xA9\x1E\x6F\xEB\x37\xF7\x20\xE1\x87\x7C\x67\x3D\xDF\x85\x9C\xEC\xD5\xD6\x92\x7C\x2A\x42\xBE\x8B\xB9\x66\xD6\x42\x22\xCF\x77\x82\x70\xBA\xB5\x41\x6A\x46\x04\x09\x63\xBC\x0B\xDF\x51\x57\xC3\x96\x49\xC2\x1E\xDF\x2D\xBC\x4B\x3B\x4E\x4A\x02\x96\xA2\xE6\xD3\xD4\xB2\xF1\x8C\x79\x01\xEF\x32\xB3\x2C\xFE\x38\xEB\x5D\xB6\xEF\x08\x9F\x79\x4C\xDD\xAC\x03\x6A\xCE\x5E\x5F\xE7\x9E\xF3\x32\xE2\xBC\x82\x39\xAF\xC0\x1B\xCC\x79\xD9\xA3\x55\x21\x68\xB7\x85\xE7\x3C\x36\x84\xB4\xBF\xF0\x53\x06\xDD\x93\x24\x92\x1D\xDF\x49\xF1\x21\x8C\x37\xF8\x6C\x37\xE4\x72\x43\x2C\x97\x10\x50\x0B\x06\x5B\xF6\x69\xEE\x2D\xB9\x56\xCD\x73\x5D\x38\xC3\x75\x04\x8A\x45\x83\xAE\x39\x43\x68\x02\x21\x71\x1E\xC9\x7F\x5B\x97\x74\x2E\x8F\x97\x25\x0E\xA1\x11\xAC\xD2\x15\x7F\xDE\x1E\x12\xE7\x05\x5D\x90\xA1\x6D\xAA\xA8\xE5\xBC\x12\xE2\x3A\x45\xCE\x4B\x99\xF3\x28\x05\x6E\xC2\x99\x40\xF7\x0D\xBF\x81\x7D\x90\x30\xE7\xA5\x50\x3E\x54\x18\xC9\xCC\x6D\x69\x8F\x90\xFB\xB0\x2B\xB6\x23\x59\x11\xDC\x62\xF2\xEA\x81\x44\xEF\x87\xAC\x0F\x12\x7D\xE0\xEB\x08\x65\x50\x65\x38\x71\x37\x21\x73\x66\x0D\x32\x1E\x22\x06\x89\x66\xE1\x77\x00\xF6\xBF\xED\x2D\xF5\x7E\x41\x67\xDE\xDF\x43\x67\xDE\xDF\x43\x67\x76\x62\xAE\x81\x08\x22\xC2\x5B\x8E\x3C\x48\x74\x44\xC2\x7F\xA3\x68\xC1\x7F\x23\x81\x67\x0E\x5B\xFD\x97\x26\x01\x0F\x61\xC4\x66\x44\xB3\xE6\x93\xB5\xF4\x21\xA2\xF7\x6A\x04\x7B\xB9\x62\x4D\xB7\x05\x11\x1D\x92\x9A\x37\xAD\xB9\x76\x8A\x5D\x2C\xBF\xF5\x72\x1F\x22\x9A\xC9\x52\x87\x1B\xD4\xC6\x11\xB3\x30\xA1\xF3\x65\x67\xC9\x60\xC9\x2C\xCD\x7C\xDC\x6E\x20\x98\x97\x39\xBB\x76\xC8\x2E\x16\x2D\x44\x34\x1D\x24\x45\x2D\x44\x34\x27\x70\x47\x1D\x8B\x3C\x3D\x58\x8D\x93\x5A\x23\xAE\x35\x5A\xCC\xDC\x8A\x67\x6A\x2F\xCB\x67\xDF\x1A\xC6\x69\x6F\x9D\xAA\x26\x73\x10\xD1\x13\x86\x88\xA6\x17\x2E\xDB\x16\xE0\xD4\x23\x33\x0C\xB6\xD6\xEC\x7F\x91\x49\x92\x2D\x46\x06\xB6\x2E\x10\x63\xE2\xDC\xE6\x9A\x1C\x61\xD9\xD4\x48\xA3\x8C\x3C\x09\xE1\x14\xF4\x99\x22\x70\x7F\x3C\x7C\x31\x9F\xF8\xD4\x7F\x8A\x0F\x8D\xB9\xF6\x5F\xFF\xC1\x5B\x28\x0E\x5F\x7C\xDF\xAE\xF5\xB6\xAF\xBD\x86\xE1\x96\x2D\x69\x68\x4D\x97\x90\x9A\x0C\x93\xDD\x32\x8B\xDB\x1C\xF7\x54\x17\xEE\xEC\x13\xA6\x7E\x09\xDA\x13\xEC\xD2\x9E\x60\xD0\x9E\x93\x9C\xCA\x50\x97\x97\x2F\x77\x66\x10\x9F\x4B\x68\x7E\x7C\x38\xEF\x2C\x55\x7A\xD3\xA1\xC9\x59\x26\x0E\x5A\x80\x7F\xB2\x9F\x65\x23\x21\xA5\xE9\x62\x1F\x17\xE3\xB6\x1F\xAB\x42\xA7\x18\x26\x91\x4F\x52\x97\xB1\xC8\xE7\xAE\xF5\x57\x34\x71\x5D\xF2\xFE\xD2\x86\x53\x2A\x93\x6B\x9A\x6A\xEA\x68\xAC\x03\x83\xD3\xEA\x70\x00\x85\x06\xE5\x02\xB6\x66\xA9\x15\x7D\xB0\xE6\x2C\xBF\x07\xF1\x2E\x98\xF2\x53\x14\xEB\xC5\x48\x29\x66\x8E\xF0\x32\x1D\xCB\x3A\xF6\x76\x9D\x64\x0A\x66\x96\xE8\x84\x1D\x19\xF3\xFE\x9C\xDC\xD6\x62\x76\x9B\x35\xAF\x61\x8F\x53\x4B\x69\x3C\x9A\x2E\x39\xFA\xD9\x82\x23\x1D\xBC\xB6\x75\xB2\xA0\x1D\x1D\xB7\xB2\xD7\xAC\xA1\x67\x4E\x50\xA7\x2B\xFA\x61\xC9\xC2\x43\x89\x4F\x13\xC9\x7C\x1B\xE9\x40\x99\x40\x45\x19\x24\x2E\xD9\xA8\x13\x67\x2E\x38\xF5\x18\x18\x54\x24\x92\x13\x85\x65\x20\xC0\x84\x93\xC4\xCA\x10\x48\xEA\x7A\xC6\x1B\x89\x25\x81\x64\x22\x29\xC2\xB4\xF8\xDA\x9E\x2E\x34\xEA\x52\x74\xD4\x23\xBF\x92\x93\x9C\xE7\x9B\xF4\xE8\xED\xAE\x0C\x26\x61\xC2\x9B\x72\xF7\x87\xFD\xD1\x8A\x28\x75\xE7\xDE\x2D\xC0\xCA\x09\x01\xE0\xDA\xD3\x33\xB9\x6A\x21\xDC\x28\x38\x05\x2C\xA1\x65\x1B\x72\xFC\xD5\x02\x40\xF9\x9C\x51\xF1\x76\x9B\xB6\x80\xFC\x3A\x57\xF5\x41\x91\x88\x82\xED\x99\x93\x66\x05\x0D\x18\x30\x9C\x8A\x17\x7F\x5C\x0F\x1E\x9C\xA2\x02\xE6\x76\xF4\x49\xCE\xF8\xC8\x5F\x2D\xF1\xB2\x9A\x3E\x88\xD3\xE3\x70\x10\x14\x06\x34\xB2\x92\xC2\x5A\x70\x90\xA8\x96\x83\xB4\xE1\x42\x56\xD2\x2E\x80\xD4\xB3\x92\x87\xA6\x22\xE7\x7F\x1C\xB0\xB4\xDD\x7E\xD6\xA9\x58\x3F\x6C\xA0\xB5\xA2\x2C\xE2\x06\x32\x17\x91\x35\x43\x6D\x4C\xEB\x11\x64\x94\x06\x58\x91\xE6\x22\x69\x80\x15\x6D\x7E\x38\x87\x26\x65\xCD\x02\x5B\x7E\x5A\x7C\x12\xB2\xDD\x50\x8F\x71\xA9\x78\x85\xD2\xD8\xC4\x33\xA4\xD0\xA5\x86\x12\x2A\x60\x39\x29\x6E\x72\xF3\x2A\x85\x51\x6B\x45\xE1\x5C\xC8\x6F\x6A\x9C\x7A\x63\x43\x79\xE0\x6F\x52\x36\x15\x4C\xEB\x98\xFB\xC2\x0D\xB3\x81\x2B\x79\x84\xDB\xB7\x16\x38\xD1\x52\xA8\xEE\xE8\x70\x40\x16\xB3\x84\xF7\x8A\x64\xD1\x09\x09\x2C\x09\xF7\x8F\x9A\x33\x8E\xD7\x51\xEB\x7A\x4E\x12\x81\xD4\xC2\xEC\xFF\x0E\x55\xDA\xB3\xAC\x49\xE8\xB9\xD3\xE2\x37\xAD\xC8\x23\x15\x7F\x8C\x4D\x10\x68\xC6\xB3\x6E\xED\x65\xDE\xB7\x7A\x47\x4B\x0E\xF0\x25\xD9\x44\x81\x6E\xDC\x67\x83\x46\x12\x33\x2B\x16\x7B\x7C\xB2\xD2\xE5\x14\x20\x17\x26\x66\x25\x02\x82\xEF\x58\x89\xF7\x6A\x58\x95\x0B\xBC\xA7\x9F\x5F\x76\x19\xDA\x20\x71\xBA\x19\x6B\x1B\xA0\xC6\xC1\xEC\x12\x31\xBB\x50\x49\x07\x29\x18\x18\xD9\x25\x42\xF1\xD0\xB1\x0B\x1D\x7B\x52\x30\x7F\xC2\xE3\x9A\x79\xED\x3F\x46\x61\x46\x22\xC3\x72\xEC\x1D\x7B\xE8\xBB\x1B\x6A\xA3\x8E\x9D\x3E\x4F\x7E\xE5\xA3\x93\x75\x3A\xAD\xAD\x1B\x9D\xA7\x89\xB5\xA3\x4F\xD6\xC9\x94\x00\xE9\xCB\x0B\xB4\x37\x4F\xC8\x6A\x14\x82\x76\xBF\xAD\x36\xDC\x4F\x6F\x37\x04\xD5\x71\xCF\x5A\x21\x48\xB7\xEE\xB7\x83\x93\xA0\xDD\xC3\x7C\x7F\xB4\x76\x5E\x32\xFC\x94\x9C\x76\x35\x27\xC7\xA5\x0C\x62\xB7\xFD\xD8\x86\x03\x57\x42\xE4\x76\xEC\xC6\x09\x08\x1F\x9B\xC2\xE8\x7C\x3D\x62\x2B\x9C\xEB\x02\x10\x84\x66\x56\xA6\x9F\xA5\xE9\x47\x98\x29\xAC\x6B\xD6\xB1\xDB\xA6\x81\x81\xF8\xC1\x29\x8C\xB8\xD3\x9E\x1D\xF0\x6D\xFA\xB4\x65\x87\x76\x51\xE3\xD1\x49\xC8\x21\x91\x5C\x76\x32\x8E\x25\x9F\xD0\x99\x60\x82\xB3\x03\x8C\x9B\x34\xE5\x1F\x5C\xEA\xAF\x85\x32\xA8\xDD\x67\x90\xBA\x1D\x7D\x1E\x5F\x3E\x1C\x4C\xEA\x98\xB2\xD7\xDA\xF3\x90\x40\x38\x95\x6D\x90\x4F\x11\x61\x9D\x39\xC9\xE8\x13\x04\xC6\x80\xFB\xB1\xA4\xFC\x1D\x8E\x16\x66\x6E\x8B\x06\xDC\x16\x51\xDC\x17\x3B\xC7\x76\xDC\x16\x31\x9A\x22\x73\x1B\xAB\x3F\x74\xC0\xEB\x4D\x42\xD9\x8F\x1B\x65\xE7\x23\x4D\x19\xA9\xC9\xFA\xC0\x32\x9B\x95\x7F\x72\x59\xFC\xDB\x21\x20\x1C\x29\xF2\x34\x62\x0B\x3F\x2A\x77\x1A\x54\x97\xA2\xFF\x93\x0B\x8F\xD2\x7A\x07\x6C\xFE\xD8\xED\xB6\x8F\x14\x56\xF4\x03\xB7\x75\x9E\x60\x6F\xF3\x3C\x21\x94\xF3\x04\xFB\x45\x3A\x4F\x18\xF8\x45\xF3\x79\x82\xBD\xBD\xF3\x04\xE4\x21\x22\x38\xF4\x42\x44\xB3\x9C\x80\x58\xCA\xFF\x40\x53\xF6\x73\x23\xB5\x7F\x5B\xEC\x3E\xAC\xC1\x9B\xC6\xF3\x48\x88\xFC\xE3\x28\x92\x90\x8F\x04\x12\x97\x8A\xC8\xF7\x4E\x09\x6A\x45\xDF\x7B\x82\xE6\x69\x04\xB6\x8A\x85\xF7\x4E\x15\xBA\xBD\x93\x90\xCD\x85\x96\x64\xBA\x47\x5B\xB8\x11\x99\x31\x51\xF6\xA2\x78\x4F\x50\x14\x91\xFD\xBF\xCE\xDC\xD6\x49\x5E\xC5\xEF\x75\x0A\x32\x11\x36\x74\xB6\x8D\x72\x9F\xF2\xC0\x38\xF5\xA0\xA4\xE1\x8E\x32\xAC\xA2\xC5\xFF\xC2\x91\x83\x88\x4C\xE4\x2E\xA8\x72\x48\xB0\x74\xB6\xE9\x20\x31\x6B\x22\x10\x81\xA1\x67\x9E\xC7\x7B\xA2\x94\xE3\x5A\x3D\xC6\x13\xD9\xEE\xCA\x3F\xA4\xED\xE2\xE0\x89\x0B\x0E\x07\x9F\x7D\xD7\xB7\x71\x3C\x73\xCE\x78\xD7\x39\xE5\x54\x7F\xC0\x8D\xCE\x9D\xED\xCD\x3F\x1F\x58\x49\x56\x09\x82\xC8\x28\x38\x20\xD3\x99\x35\x2A\xD3\x05\xD5\x18\x37\xCE\x2E\x20\x20\x66\xC6\xAD\x29\xDD\x36\xD3\x6C\xEC\xF4\x66\x9D\xC3\xD8\xDD\xB8\x71\xE3\x86\xD9\x80\xF1\xA9\x29\xC7\x20\xD6\x13\xA6\x58\x2E\xC6\x3F\x17\xF8\xF4\x41\x29\x96\xBC\x8F\x4B\xDE\x8F\x24\xA0\x0D\x1C\x96\x5A\xB8\x6D\x8A\xCB\xA9\xF7\x63\xA9\x07\x60\xBF\x2F\x75\x7F\x5B\x6A\x4E\x11\x4B\x70\xA0\x2B\x95\x50\xA7\x50\xA1\x2A\xFF\x48\x96\xED\x91\xE0\x61\x8F\xA1\x14\x63\xB2\xD4\x9C\xF0\xCC\xDA\xC7\x68\x49\xB0\x1F\x0A\x79\x8E\xCB\x2D\x33\xC8\xFE\x01\x4D\x53\xDA\x3E\x7A\xFA\xEC\x97\x4D\x29\xEC\x83\xFC\xC4\x79\x8A\xD4\x7A\xA7\x37\xF0\x8F\x3C\xAE\xF8\xC4\x07\xC1\xD9\x2A\x87\xFD\x62\xED\xB1\x6C\xC5\xD5\xB2\x87\x3D\x59\x18\x3E\xF6\x05\x64\x0F\xFF\xB4\xC7\xB5\x8E\x13\xEA\x08\xDF\xB6\xFC\xCA\x1C\x4C\x14\x1A\xB1\x8D\x69\xC4\x27\x32\x23\xE1\xD3\x91\x39\xC6\xF4\x19\xB1\x3E\x8C\x7C\xAA\x3C\x9F\xC6\x9E\x4F\x47\xF4\x2A\x6F\x46\x33\xE6\x53\x66\x53\x43\x18\x7C\xEC\xD5\x02\x9A\xEC\xA1\x23\x48\x3D\xF5\xF8\x0C\x8D\x04\x97\xE4\xB2\xA0\x33\x3C\x14\xF7\xDD\x81\x1A\x6D\xCE\x07\xCC\xCB\x24\x93\x23\x01\xE1\xE2\x94\x03\x5F\x7B\x74\x6E\xFD\xE4\x21\x61\x32\xF5\xC7\x54\x6C\x64\x69\xCB\x7E\xC6\xB3\x5F\x4A\x0E\x4A\x90\x7A\x46\x49\x5B\x46\x89\x98\xFD\xC4\xCF\x05\x95\x8F\x5E\x81\x14\xD0\x9E\x82\xE1\xE1\xAF\xD3\x13\x9C\x11\xDB\xDC\x64\xF0\x8D\x1F\xFC\x84\x85\x29\x9F\x1A\xC8\x60\x53\x03\xCD\x09\x3A\x02\x94\x71\x96\x21\x4C\xF9\x50\x8A\x7C\x4B\x81\x3C\xA1\x28\xEF\x1E\x8E\x7D\xAE\x33\xBC\x31\x1C\xF9\xBE\xBC\xDA\x75\xDC\x15\x5D\xDF\xC2\xD8\xEB\x5B\x19\xFB\x9E\x8C\x92\x76\x66\x64\xBB\xF4\x22\xF8\x8F\xA9\x8B\x3F\x91\x89\x08\xB6\x95\xF6\xEB\x11\x6B\x84\x4E\x64\xB0\x97\xBF\xF1\xB0\x3F\x6D\x6F\x0C\xED\x3C\xA3\xB6\x57\xDC\x0B\x53\x85\xB4\x09\x41\xFD\xCD\xF7\x8C\x71\x5D\x28\xD7\x3D\x36\x97\xB3\xC5\xC7\x14\xED\xC8\x42\xD0\x6D\xF9\xC8\x0F\x86\xD5\xC4\x2E\x8E\x7C\x17\x13\xFA\x86\x18\x11\x45\x3A\xC3\xE8\x4B\xE5\x84\x23\xD4\x54\x9D\x30\xD6\xFD\xB4\x4E\x39\xC4\x14\x50\x68\x6A\xDA\x37\x71\xC0\x59\x82\x33\x02\x39\x7A\xB4\x40\x1C\xF3\x59\x8D\x4F\x8A\x48\xD1\x98\x9E\x7B\xFA\x4F\xE6\xC5\xB1\xB9\x4D\x71\x1C\xA3\xD0\x4C\x17\x88\xE3\xD8\x8B\x63\x22\xE2\x84\xC5\xF1\xC4\xCF\x87\x49\x3B\x1F\xC6\x4C\xC0\x9E\x38\x8E\xB3\x4E\xD0\xCF\x8A\xE3\xC4\x8B\xE3\x64\x2F\x71\x9C\xCC\x88\xE3\x64\x4E\x1C\xF3\x64\x1F\xC3\xA4\x15\xC7\x52\x73\xBC\x9B\x38\xE6\xE0\x5E\x2F\x8E\x3B\x9A\x26\x73\xE2\x38\xD9\x45\x1C\x63\x9D\x63\xA4\xF3\xD8\x8B\x63\x33\x2B\x8E\x45\xCE\x24\x5E\x1C\x67\x03\x71\x9C\xEC\x22\x8E\x67\xE0\x85\x65\xCC\xF8\x96\xBC\xE6\x75\x89\x87\xDA\x07\x0B\xD4\x09\x3D\x50\x28\x42\x66\x68\x7C\x5B\xB7\x0C\x1D\xDE\x44\xAF\xC0\x57\x3D\x3F\xD3\xB9\x1D\x32\x31\x24\x55\x0C\x19\xD9\xF5\xFC\xD6\x89\xF2\xFD\x33\x6A\x46\xE2\xD1\x25\x9A\xBE\xF4\x4E\x50\x7A\x8F\x5A\xE9\x9D\x0C\x18\x5D\xEC\x2D\x34\x11\x3D\xC7\x27\x34\x5A\x71\x6F\x4C\x3A\xD1\x1D\xEF\x22\xBA\x39\x6B\x28\xB3\xAA\xF6\xAC\x8A\x85\xD6\x16\x12\xCF\x54\x49\x4F\x74\x13\xAB\x4A\xE8\x88\x77\xE1\xEF\x44\x37\xED\x46\x44\x74\x27\x22\xBA\xF5\x4D\x18\x45\x7B\x46\x89\x77\x13\xDD\x5A\x44\x77\xD2\x17\xDD\x89\x17\xDD\x21\x8A\xEE\xD4\x8B\xEE\x4C\x44\x77\x4A\x82\x6A\xB1\xA8\x1B\x08\xEE\x19\x96\x30\x34\xC8\xBB\x68\x99\x0B\xD9\x62\x28\xE7\x6E\xC6\x16\x3D\x39\xC7\xCD\x1E\x4A\xF2\xFF\x48\x3D\xFE\xD4\x48\x1D\x98\x91\xE4\x5E\x74\xDB\xB6\x3F\xC2\x22\x55\xC8\x49\x4A\x49\xC1\x06\x53\x25\xB8\x0A\x82\xC5\xC5\xA6\x8F\x56\xEB\xF3\x6D\x5A\x08\x71\x6C\x28\x0A\x3F\x43\x56\xCA\x17\xC8\xCC\x82\x25\x63\x06\x45\x65\xD9\x16\x42\xDA\xA9\x0C\xDD\xDC\xD3\x81\xEC\x24\xA9\xAA\x21\x6A\x20\xDD\x43\x7C\x12\x10\xFA\x58\xA2\x81\x3A\xD9\x39\xF1\xEE\x3C\x64\xE0\x47\x86\xDC\xE7\xB6\xF1\x87\xC8\xCE\x62\x91\xEC\x2C\xF1\x85\x00\x8A\x4E\xCA\x49\xE2\x48\x8B\x25\xEF\xE7\x92\x0F\x38\xCE\xC6\x47\xA7\x51\xD5\x98\x37\xE1\xB6\x3E\x80\xA5\x2E\xC1\x01\x5F\xEA\x81\xB6\xD4\x82\x0F\xFA\x96\xBA\x52\xED\x2E\xB2\xB3\x84\x09\xEC\x13\xD9\xF8\xFF\xB2\xF7\xAF\xC1\x96\x5C\xD7\x7D\x18\xBE\x1F\xFD\x3C\xDD\xE7\xDC\x9E\x99\x0B\x72\xAC\x3B\x65\xEF\xEE\x3F\xFE\xCE\x45\x15\xA6\x88\x0F\xA8\x3B\x08\xE8\x98\xB3\xA7\x38\x77\x1E\x00\x01\x54\xC2\xAA\x20\x15\x55\x05\x1F\xF8\x81\xD5\x17\x8C\x79\x2F\x2E\x50\xB0\x8B\x9A\x3B\x12\x07\x14\x2D\xC7\x36\x4D\x51\x8A\x1E\x94\x44\xD9\x74\x40\x91\xA0\x43\x5B\x54\x42\x59\xB2\x88\x38\x54\x02\x39\x52\x8A\x2E\x8B\x92\x12\xCB\x92\x48\xC7\x32\x15\x3D\x4C\x95\x64\x8B\x22\x45\x4D\x6A\xFD\xD6\xDA\xBB\xBB\xCF\x39\x77\x66\x28\xBE\x64\x7B\x86\x45\xDC\x73\x4E\x77\xEF\xDE\x8F\xB5\xD7\x5E\xCF\xDF\x92\x37\x73\xAA\x13\x71\x34\xA7\xDC\xDC\x9D\x72\x0B\xB9\x9E\x70\x5E\x8A\xD7\xED\xA9\xC9\xBC\x26\x93\x2D\x71\xCA\x8B\x7D\xF9\xA4\x9B\x83\x77\xCE\xA7\xBC\xB3\x41\x90\x49\xE0\x9D\xA7\xE6\xDA\xAB\x8D\x91\x14\x98\xAF\x48\x81\x39\xF1\x91\x22\xF2\x91\x5C\xA4\xC0\x22\xB2\x92\x3C\xA4\xA2\xE6\x23\x52\xC8\xE7\xB2\x9F\xA5\x93\xF9\x88\x99\x24\x6B\x99\x89\x21\x39\x25\xCE\x72\x15\x66\x19\x41\x9E\xA5\xCB\xC3\x2C\xE7\x71\x96\xB9\xBE\xAA\x13\x78\xB9\xB6\x5C\x66\x26\xA5\xCB\x5D\x25\xCC\x24\x17\x66\xC2\x61\x1C\x43\xA7\xC6\x33\x57\xC9\xC9\x89\xB5\x9F\xC7\x08\xDE\xC8\x4C\x8C\xAB\xA8\x95\x81\x1B\xE6\xE1\x80\xB1\x38\x60\x40\x97\x21\x67\x39\xBF\x23\xD1\xCF\x30\xC3\x4C\x82\x80\x64\xB8\x0C\x55\x01\x45\x9B\x98\x00\xE9\xF2\xF9\x60\x29\x3B\x46\x3D\x4D\x70\xAB\xA0\xF1\x0E\xA2\x9F\x21\xA6\xC1\x26\x3B\x30\x0C\xB3\x51\xF1\xDC\x1B\x8E\x93\xD0\x12\x54\xE9\x3C\x90\x19\xE2\x30\x60\x3F\x6B\x19\x97\x09\xAC\x10\xF0\x4A\x15\xB1\x87\xF1\xA8\x2A\x66\x08\xBA\xE7\x1A\xDF\xCB\xC3\x0B\xCB\x07\x6D\x26\xE7\x61\xE5\x32\xAC\x9C\x83\x4F\x24\x8F\x98\x87\xA5\x57\x86\x95\xE3\xD6\xE9\xB0\xA2\x76\xB5\x21\x02\xDF\x37\xE2\xDD\x81\xEB\xFE\x1E\x48\xE3\xD7\xA3\x09\x23\x74\x66\xB3\xB3\x63\x76\x2B\x86\x0D\x78\x89\x95\x00\x46\xF3\x0C\x1B\x4C\x2D\x38\xAF\x0D\x6E\x79\x0B\x78\x1B\x29\x4C\xED\x58\x64\xEE\xCC\x71\x56\x03\xC6\x9D\x8D\x99\x03\x24\x34\x08\x71\x4F\xAE\xAC\xB2\xDA\xFC\xCE\xF8\xEC\x7C\xE0\xB3\xF5\x1A\x19\x75\x16\x64\xD4\x81\xCF\x96\xEB\x65\xD4\xD9\x68\xAF\x8E\xF8\xAC\x5D\x92\x51\xA1\x09\xDA\x20\xA3\xDA\x5B\xCB\xA8\x25\x3C\xE7\x63\x19\xD5\xAE\xF0\xD9\x7A\x45\x46\x9D\xF2\x59\x96\x51\xCB\x91\x8C\x6A\xD9\xD8\x25\x32\xEA\x30\xA1\x76\x45\x46\xB5\x2C\xA3\x96\xE0\xB3\xE5\xC0\x67\xEB\x15\x19\xF5\xE4\xC5\xB9\x25\x19\x44\x22\xEC\x18\x1B\x82\xAB\xCA\x25\x72\xA0\x83\xA4\x13\x22\x88\x24\x6C\x40\x03\xBC\xD1\xF1\x96\x5B\x4B\xEC\x76\x1A\x12\xB5\xCC\x3F\xEC\xC0\x3F\x8E\x31\x1B\xAC\xE3\x1F\xA3\x8D\xB6\x2C\x74\x26\xC7\x0B\x9D\xC9\xF4\xB0\x48\xA6\x27\x85\x80\x16\xD8\x65\x17\x02\xA6\xB9\x88\xC7\xD9\x70\x52\xD8\x63\x4E\x0A\xAE\x58\xC2\x74\x92\x07\x3A\x49\x58\x43\x4A\x02\x9D\x24\xA3\x93\xC2\x8E\x34\xA4\xB6\x5E\x3E\x29\x6A\x3A\xBC\xE4\xA4\x48\xE4\xA4\xC8\x27\xC7\xD7\xF4\x8C\xCD\xC3\x19\x6B\x8F\x3B\x29\x72\x39\x29\xE4\xA8\x4B\xC2\x49\x91\x0E\x27\x85\x95\x62\xF7\xC9\x1D\x48\x9A\x26\xC4\xD2\x58\x96\x34\x53\x78\x06\x71\x60\x58\x5E\x70\x2B\x0B\x6E\x43\xDC\x8D\x62\x70\x42\x5A\xF2\x4B\xF2\xC4\x20\x69\xC6\x95\xB7\x78\x66\x69\xE5\x53\x40\x5E\x9A\x70\x24\xE0\xE0\xE0\x23\x22\x9E\x16\xDF\x00\x3A\x0C\x4C\xF7\xDF\x62\x96\x7F\xB3\xFA\x0F\xDA\x6E\x1C\xFD\xF2\x25\xC2\x89\xA4\x24\x4F\x70\x8F\x56\xDB\xE6\x74\x37\x9B\x2B\xFF\x8F\x86\xDA\xC5\x8E\x7E\x6C\x67\x9C\xF3\x27\x06\x8E\x19\xEB\x39\x09\x5D\x3B\xE3\x6C\xF3\x7D\x20\x7F\xCB\x85\x00\x12\x67\x9B\x7F\x79\x23\x30\x3C\xE9\x81\x44\xBA\x97\x8E\xB5\x83\x6F\x94\xB5\x3A\xBB\x6B\xAD\xFE\x9A\x58\xAB\xD3\x65\x6B\x75\x32\xB6\x56\xA7\x7F\x2A\xAD\xD5\xC1\x52\xED\x4C\x38\x3F\xEE\x9A\xAB\xFF\xE3\x34\x57\xFF\x01\x86\xF8\x0F\xEA\xFF\x48\xCC\xD5\xF1\x0C\x28\x18\x08\xC6\xB6\x66\x74\x06\xCC\xE8\x0C\x28\x97\xCE\x00\xFA\x91\x98\x48\xE5\xEC\x9E\x40\x89\xCA\xBA\x5B\xBA\x76\xC6\x19\x39\x03\x0C\x47\x41\x5A\x67\xE4\x0C\x60\x2C\x3C\xF4\x80\x3E\xFE\xA9\x30\x92\x67\x77\x8D\xE4\x5F\x13\x23\x79\xBA\x6C\x24\x4F\xC6\x46\xF2\xF4\xDF\x67\x23\x79\x75\xD7\x4A\x7E\xD7\x4A\x7E\xAC\x95\xFC\x0F\x31\xE2\xEF\xAE\x74\x33\x51\x1D\xFA\x5B\x9A\xC9\x31\x41\xC9\x10\xB9\x26\x2A\xAC\x09\x39\x0D\x49\xE0\xCE\xC5\x88\x3B\x97\xC4\x9D\x8B\x25\xEE\x5C\x0A\xBC\x2D\x70\x36\x66\xC2\x7D\x84\x3B\x97\xC4\x9D\x67\xC2\x9D\x0B\x46\x2D\xB5\x6E\x26\xDC\x99\x39\x02\x6B\x94\x28\xBE\x71\xD4\x77\xF6\x36\x4C\x79\x64\x81\x5F\x62\xCA\x6B\xAC\xEF\x19\x33\xE5\xEC\x4E\x4C\x42\xD5\x0A\x47\x0E\x25\xAD\x16\x91\xCA\x17\x81\xCA\x6B\x40\x04\xB8\x3A\x50\x79\x3D\x32\x92\x83\xCA\xB3\x15\x8E\x0C\xD3\xFB\x06\xB7\xDC\x84\x94\x9A\xA9\x51\xB8\xA1\x56\x4F\xB8\x26\xB4\xDA\x8C\xF6\x0E\x74\xDF\x13\xB7\x37\xBD\xCF\x5D\x1D\x4D\xEB\x53\x8E\xBC\x81\xEB\x99\x6B\x82\xF9\x78\x64\x7A\x6F\x26\x13\x3A\x35\x0B\x34\xC1\x2C\xB0\xE1\x32\x70\xE4\x6C\xCA\x91\xE1\x00\x99\x0F\x1C\x39\x73\xCD\xB2\xF9\xDD\xAE\x48\xB5\x76\x6A\x51\xB1\x2B\xE6\x77\x1B\xCC\xEF\x76\x44\x03\x76\xC9\xFC\x6E\x6F\x6B\x7E\xCF\x43\xD9\x57\xCC\x74\x19\x66\x9A\x1A\xED\x66\xCE\x86\x99\xB6\x71\xA6\x39\xFF\xC9\xCD\x84\x4B\xCD\x96\xB9\x14\x49\x17\xA5\x70\x29\x2B\x5C\xAA\x9C\x58\x7A\xA6\x06\xB5\x32\x18\xD4\xC4\xFC\x8E\x58\xC2\x7C\xE0\x52\xB9\x2B\x65\x0B\x8C\xAD\x67\x76\x64\xA7\x0A\x96\x19\xDC\x72\x27\xA2\x6C\x3E\x32\x59\x68\x7C\xBF\xB5\xD9\x42\x4D\x44\x59\x75\x1B\xF3\x7B\xCE\x2A\x4B\x34\xBF\xE7\xB7\x31\xBF\x9B\xC1\x08\x78\x5B\x93\x5F\x30\x06\x49\xBD\x9F\x1E\x86\xA0\x68\x01\x1A\xDB\x7F\xD4\x44\xF7\x52\x4B\x86\x1F\x49\x07\x88\xA6\x96\x22\x9A\xFC\x8E\x7B\x69\xC1\x2F\x2D\xF8\xA5\x23\xC9\x98\x5F\x5A\xDC\xEA\xA5\x22\x10\x2F\xBF\xD4\x4E\xEC\x3B\x5F\xC4\x82\xFF\x58\x64\xD2\xB7\x34\xAA\x4F\x6D\x3E\xA4\x38\x2E\xB9\x2F\x93\xC0\xA6\x2D\xB3\x69\x73\xE7\x6C\x9A\x81\x08\xC7\x6C\xDA\xAC\x65\xD3\x66\x85\x4D\xCB\xEC\xE0\xAD\xE9\x92\x4C\xB1\xCA\xA8\x6D\x60\xD4\x76\x99\x51\xDB\x63\x18\xB5\xF9\x1A\x30\xEA\x39\x33\xEA\x79\xD8\xE8\xF3\x91\x90\x7B\x0C\xA3\xB6\xEB\x18\xB5\x0D\x8C\xDA\xDE\x8E\x51\xDB\x25\x46\xBD\x6A\xBB\x2F\x45\x34\x9E\xDF\x31\xA3\x1E\x6C\xF7\xCD\x64\x42\xED\x0A\xA3\xB6\xB7\x60\xD4\xEC\x3A\x09\x8C\xDA\xAC\x61\xD4\x22\x58\x9A\xE3\x05\x4B\x33\xE5\xDB\x66\xCA\xB4\x4D\xB0\x84\x9B\x11\x3D\x98\x25\x4B\xB8\xB9\xAD\x25\x3C\x17\xA5\x90\x67\xBD\x0C\xB3\x6E\x98\x69\x9B\x30\xEB\x66\xC4\xB4\xED\x6D\x98\xB6\x89\x4C\xDB\x8C\x98\xB6\x19\x75\x6A\x99\x69\x9B\x91\x25\xFC\x78\xA6\x6D\x78\x00\x26\x30\xED\x64\x6A\x09\x07\xF6\xFB\x1D\x48\x93\x79\xCC\x66\x66\x69\x32\x09\x96\xF0\x7C\xBD\x25\xDC\x4C\x38\xE1\x25\x79\x62\x90\x26\x97\x19\xE2\xD4\xF6\xCC\xC5\x9F\xF2\xC1\x12\x4E\x3C\xDC\x32\x0F\xB7\xEB\x78\x78\x12\x7D\x93\x77\xE8\xB6\x31\xCC\x4E\xA1\x70\x33\x5E\x0B\xF5\xC3\x84\x73\xC7\xDC\xCA\x7E\x66\x70\xAB\x53\xD4\x65\x75\x87\x3C\xDC\x2E\xF3\x70\x35\xE1\xE1\x76\xE0\xE1\xC7\xBC\x54\x78\xF8\xF2\x4B\xC5\x46\xFF\x3D\x09\xE0\x89\x62\x2A\x3F\x67\x5E\xB0\x93\x24\x7A\x8F\x6C\xDC\x30\x5D\xFA\x06\x21\xA7\x1D\xB3\x19\x5C\x4D\x91\xE6\xF5\x59\x75\x8A\xD9\x9D\x25\x1D\xD5\x88\xE8\x63\xFC\x6C\x17\xE8\xD8\x4B\x69\x19\x9A\x7E\x42\x82\x78\x4C\xCA\x28\xDF\x30\xD7\x28\xB5\xED\x52\x7A\x24\x89\x8F\x9B\xF5\x59\x1D\xBF\xCA\x40\x6C\xF1\xF1\x47\x68\x07\x5C\x27\x2A\x48\x5A\x53\x5B\x26\xD6\x0C\x49\x5B\x5E\xB7\xD6\x1B\xEC\x3E\x9F\xB2\x33\x87\xB9\x38\x8A\x51\x36\x5D\x7A\x80\x9D\xFD\x09\xD5\x0B\x3E\xF5\x5C\x12\x2A\x96\x13\xAE\x9C\xE0\x9E\x2A\x5F\xF8\xDA\xA5\x5B\x9C\xDA\x16\x33\x95\xF8\x29\x24\xB7\xFD\xCB\xC0\x15\xA6\xBB\x56\x9A\xD7\x77\xD2\x3C\x75\x6D\xF2\x86\xF5\xED\x0F\xC7\x08\x23\x6E\x28\x59\xE2\x4D\x1A\xB5\x1C\x9E\xDB\xE6\x34\xB2\x11\xCE\xAA\x06\x73\xC6\x8B\xBC\x6D\x48\xA1\xB5\xAC\x45\x5A\x6E\xE8\x44\xE5\x6C\xF5\x69\xA3\x4D\xC8\xD5\x78\x60\xAF\x2B\x63\xDD\x84\x99\xCB\x05\xDB\x8B\x0B\x28\xA0\xE0\x48\x86\x84\x27\x36\x86\xCD\x38\x1D\x48\xB9\x92\xFE\xDC\xEF\x4A\xA7\xFC\x99\x7E\xC7\x6C\xBB\x92\x4B\x19\xA0\x8C\x8E\xE3\xCB\x67\x5C\x49\x1B\xE0\x5E\x57\x3A\x2D\xB5\xAC\x4B\xA9\x1B\x5D\x90\x4A\xF5\xB0\x6A\x5C\xE9\x92\x87\xD5\x49\x57\xBA\xF4\x61\x75\xCA\x95\xAE\xF4\xDB\x0C\x22\xE2\x94\x2B\x9B\x3F\xA2\x59\x18\x77\x81\xCD\x68\xDB\x66\x13\xE8\xFD\x46\xD1\xD1\x39\x1C\x02\xA8\x68\x98\x3E\xB3\xD5\x33\xEE\x0F\x9B\x12\x5C\x79\x56\x9D\xF4\xFA\x90\xFE\x9E\xF0\xE6\xF0\x80\x3E\x9C\x3A\x00\x51\xD9\xC3\x4E\xFB\xF7\xFC\xC6\x8D\xEB\xC0\x51\xF3\xFA\xD9\x9E\xFA\xEA\xDF\x15\x7E\x39\xF1\xAD\x48\x45\x69\x71\x00\x9E\x55\x67\x26\xD3\xE1\x72\xEA\x89\x43\xD6\x46\x3B\xAB\x5C\xE9\x1F\x08\xE9\x30\xB3\xEA\x63\x46\xEB\xA3\x95\xD2\x14\xC3\x76\x8A\xE9\x73\xC6\xA9\x08\x04\xFD\x39\xE3\x8F\x76\x19\xF6\x19\x58\x85\x67\xF0\x09\xA8\x2A\xF8\x74\x9A\x81\xCC\xFD\xE7\x0C\xE3\x1A\xFB\x1F\xA2\x46\x9B\x0F\xBF\x5D\x00\xDD\x3F\xAB\xFA\x16\xC5\x8C\xBE\xA2\x46\xDF\xB7\xAE\x51\x3D\x6D\xF4\xF7\xEF\xB0\xD1\xDF\x0F\x8D\xFE\xF0\xB4\xD1\xDF\xA2\x46\x25\xD9\x4D\x8D\x4B\x43\xA8\xEA\x3F\xD5\xFA\x88\x37\x49\x22\x20\xF1\x2D\x75\x22\x20\xC0\xA1\x6E\x84\xBA\xCF\x3E\x75\xC1\x1C\x35\x9F\x66\x3E\x08\x68\xB6\x37\x57\x3B\xB7\x7D\xD2\xE2\xC9\xA5\xC7\x2E\x19\x73\xA4\xAF\x4D\x1F\xEC\xD4\x59\x65\x5A\x3D\x3C\x6D\x50\xA0\x82\x9E\xEE\xAC\xB3\x17\xCC\x91\xD3\x5B\x43\x3B\x66\xC7\x3C\x5D\x9D\x56\x03\xC0\xD6\x67\xE8\x8A\xC0\x6C\x55\x9F\xB7\x56\x03\x4C\x67\x48\x8F\x2A\x64\xB8\xB2\x9B\x0A\x6C\x8B\xAE\x3C\x67\x0B\x54\x18\x47\x61\xCF\x02\xBB\x06\x3F\xBA\xF2\xC5\x10\x2A\xA1\xCE\x2A\xDD\x55\xF4\x87\xA4\x41\xEA\x66\x37\xDF\x22\x62\x66\xD9\x8F\xCD\xF0\x6E\x76\x89\x4F\xFA\xDA\x55\x6E\x7A\x79\xE6\xCA\x0B\xEE\x9D\x2F\xF6\x23\xD1\xE9\x92\x98\xAD\x38\xF5\x78\x17\xC5\x93\x69\x77\xA8\x4B\xA4\x23\xED\x1E\x88\x84\x14\x55\xD6\x6B\xBD\x54\xC3\x42\xC1\x6C\x92\xC6\xDA\x9A\xA8\x2E\xBF\xD8\xCE\xBC\x85\xED\xBF\x66\xAE\x5C\x7B\xDD\x26\xCC\x37\x52\x76\x44\xBB\x7A\x0B\xE0\xDE\xFA\x19\xDA\x32\xCA\x25\xCD\x1F\xBF\x9D\x11\x9F\x50\xAA\x89\xFA\x47\x63\xBA\x88\x60\x9B\xA4\x77\x79\xF3\x25\xD6\xFA\xCD\x79\x97\x9D\x55\x90\xBB\x8B\xE6\xDF\x92\x88\x2F\x79\x62\x9E\x2D\xE8\x1C\xB5\xC6\xC2\x4A\x1D\x06\x5B\x6C\x73\x0D\x21\x81\xB4\x4B\xD0\xF6\x56\x1C\x30\x30\x63\xA4\x12\xAE\x24\xD9\x26\xAD\x40\xE2\x69\xD2\x16\x00\xB1\xC0\x90\x00\xDA\xA9\xDE\x65\x7B\x02\xE6\xCA\x40\x4E\x5D\xA8\x41\x84\xA6\xE9\x5A\x85\x7A\x3F\xB2\xB8\xA6\xFA\x23\xCD\x08\x01\x7A\x6D\x56\x76\xC0\x04\x30\x21\xF1\xDC\x6E\x01\xD5\x6C\x35\x1B\x9E\xA1\x6A\x59\x4E\xA6\xBB\xE9\xC6\x98\x0F\xAF\x57\xF3\xE1\xED\x90\x0F\x0F\x2C\x94\x51\x7E\xFE\x6A\x83\x9C\x1E\x2F\xED\x5E\x9E\x2B\xFF\x53\xCB\x99\xEF\xC1\xA9\x53\x8D\x5E\x88\x1C\x40\xC7\x57\x06\xEC\x32\x96\xB9\xB9\xB6\x56\xF5\xA1\x4C\x2F\x02\xBE\xEA\xB4\x0C\x89\xF9\x0F\xBE\x0C\x49\x76\x11\xE0\x38\x28\x43\x92\x11\x59\x09\x30\x47\x2C\x43\x92\x4B\x19\x92\x9C\x4F\x12\x54\x13\xC9\x9D\x7E\x2B\xD0\xD5\x39\xB8\x33\x96\x21\xC9\xA4\xF8\x97\xE6\x12\x1D\x25\x89\xA8\x8F\xC0\xB7\x57\x00\x71\x91\x03\x0C\xD8\x76\x19\x41\x84\x34\x83\x08\xE9\xB7\x06\xAB\x94\x75\x39\x60\xC3\xA4\xE6\x88\x09\x19\xDE\x90\xD2\xBB\xAA\x47\x7D\x02\xEC\x2F\xB6\x5A\xD1\xBE\xB6\xAE\xE0\xBD\x6D\x38\xD3\xBD\x60\xC5\x1E\x08\x6B\x6D\xCD\x42\x6A\x01\x31\xA4\x00\xA4\xF2\x9D\x60\x12\x31\x86\xF2\xAE\x48\x28\x11\x95\x08\x9A\xC4\x3C\xA2\x12\xCD\x45\x18\xC7\x06\x39\x0E\x95\x88\xEB\x09\x10\x93\x41\xAC\xDE\xDC\x25\x5D\xBA\x0B\xE0\x5C\xDD\xB7\x8C\xE5\xD2\x2E\x18\xC1\x66\x63\xFA\x8C\xDB\x70\x8B\x5D\xC1\x9D\x9B\x03\x95\xA8\x46\x08\x9F\x0C\xBD\xE2\xEF\x2D\x4A\xD8\x61\x0D\x6A\x9E\xAB\xAA\x5F\x2A\x5C\x82\x1F\x00\xFF\x5F\xC9\x3A\x31\x64\xBE\xBB\x93\xEA\x2B\xD5\x00\x26\xFA\x19\xAD\xCD\x91\x53\x28\x0D\xE5\x5F\x51\x0C\x5B\x06\x57\x02\x6F\xAC\x0B\xEA\x1C\x4E\x54\xF5\x5A\x5D\xF3\xD3\x45\x04\xDD\x4F\x58\xA0\x6F\x9A\x6F\xE7\xB2\x53\xFE\xFE\x5E\xC4\x42\xF9\x29\xEC\x72\x81\x8E\x0D\x58\xB2\x5E\x1F\x2E\xA1\xC8\xEA\x50\x72\x1A\xA9\xAD\x61\x87\x62\x97\x9F\x47\x67\xEC\x0E\x2F\xE0\xC5\x49\x3D\x23\xEA\xDC\x53\x9C\x8F\x1B\x00\x6D\x3F\xAB\xA4\xC2\xFA\x08\x30\xF5\x4B\x46\xA7\x11\x30\x65\x0D\x16\xA9\x1A\x61\x91\x06\xE6\x68\x03\x73\x4C\xD6\x03\xA6\x58\xC9\xEF\x0E\x66\x10\xE5\x12\xA0\xE5\x3E\x76\x6C\xD9\xA3\xD4\xC5\x51\xEA\xF1\x28\xD9\x09\xCD\x00\x5B\x28\xE4\x20\x26\x81\x80\xAB\x96\x21\x37\xDD\x86\xEF\x52\xA3\x6C\x19\xE7\x34\x74\x87\x91\x88\x6B\xA9\xCF\x2F\xB5\x8C\x27\xA5\x0C\x04\x73\x56\x4F\xB8\xB0\x7E\x94\x55\x0A\xE4\xF2\x0A\x38\xC9\xDA\x89\x6A\x06\xAE\x2C\x16\x67\x7E\xF5\xF2\x2C\x8D\x48\xEC\x6F\x26\x11\xAF\xF6\x4D\x92\xBE\x3C\xD8\x5A\x94\xFF\x24\xC8\x80\x13\xAC\xB1\x40\x2C\xE0\x29\xFF\x4B\x4A\x56\x22\x7F\xCE\xFF\xD1\xCD\x9B\x1B\xFB\xBD\xE0\x84\xF9\x9B\x76\x9F\x41\x11\x71\xDF\x2F\x73\x03\xB6\x1F\xDF\x3A\xBD\xD1\xEE\x0E\xE5\x66\x93\x6E\x12\xAB\x67\xCE\x07\xE4\x42\x6A\x7C\xCF\x5F\x77\xC1\xCE\xD9\x6A\x01\x13\x80\xEE\x2F\xF9\xF4\xFE\x15\xD5\x37\x7F\xF5\x46\x40\xD7\x3E\x1F\x50\x4E\xCF\x2F\xA3\x9C\xF2\x80\xEF\x3F\x06\x00\xE6\xFE\x08\x00\xC3\x39\xE8\x5E\x0D\x99\xE4\xEB\x08\xEE\xA1\x56\x57\x43\x2E\xF8\x12\x9C\xAA\x7F\x80\x67\x06\x1D\x96\x6D\xBF\xA6\x2F\xA7\x8F\xE9\xCB\xE9\xA1\x2F\xDB\xB1\x2F\xF7\x1E\xDF\x97\x7B\x63\x5F\xEE\x5D\xD3\x97\x33\xB7\xE9\x8B\x53\xD5\xA7\xBF\x66\x75\xD6\xAE\x9B\x75\x85\xD6\xAE\x27\x5F\xF7\x42\x6B\xBF\x73\x42\x97\x47\x61\x47\x13\x9D\x74\xD0\x70\x13\x97\x33\x56\x0F\xE8\x08\x96\xAA\xB5\xC0\x2A\x25\xA9\x91\x20\xD8\x19\x3D\xFD\xFA\x15\x14\x9F\x3C\xF8\x3C\x89\xBA\xE9\x08\x6B\x05\x31\x8D\xB1\x7F\x2A\x16\x30\xB3\xB9\xF2\x3F\x3E\x86\xB3\xCB\xF8\xAC\xA8\xE9\xD9\x39\x2F\x4E\x0D\x03\x8E\x39\x0F\xD7\x94\xFF\x77\x1F\x9A\xDC\xAD\xB6\xCD\x53\x2C\x5F\x65\x3B\xE6\xA9\xCA\x55\x6D\x16\xE4\x12\x41\x5B\xEA\xE6\xC7\xC0\xFE\xD4\x01\xF6\xA7\x5A\x83\xB5\x04\xD8\x1F\x40\x97\xD4\xAD\xD4\x51\xA6\xFB\x2B\x46\x9D\x62\x49\x78\x21\xD8\x83\x23\xE4\xA5\x0D\x16\x7F\x17\x74\x4E\x54\x6E\x83\x06\x1F\xB1\x97\xCC\x79\xB7\x58\x0B\x33\x3D\xBC\x48\xDA\xC5\xAD\xF2\xBE\x35\x48\xD3\xA3\x8E\x31\xFC\x95\x24\x1A\x85\x0E\xBE\x81\x67\x6B\x09\x66\x6A\x79\x44\xF1\xF6\xDB\x0D\x7D\xDC\xEE\xD2\x70\x19\xDB\x85\x07\x5B\xC7\xC1\x92\x60\xFD\xEE\x0F\x4C\x26\xFC\xAB\xB2\x06\xB7\xE8\xC8\x62\xD4\x91\xC5\x71\x1D\x59\x6D\x90\x17\x4B\xDA\x5D\x96\xF0\xA7\x4B\x32\xBC\xB0\xDB\xE8\x51\x1C\x98\x31\xA7\x88\x56\x75\xDF\xE1\x07\x99\x84\x20\xAD\xD7\xFE\xDA\x9A\xD5\x5E\x5E\x66\xCD\x00\x5B\x2B\x2B\xFD\x55\x9B\xB6\x75\x13\xB7\x31\x9A\xB5\xAE\x5E\x9E\x37\xC0\xA2\x7C\xE7\x74\xE2\xE4\x99\x96\x9F\x19\xDA\x0F\x0F\x06\x68\xF3\xFA\x18\x24\xF5\xBA\xE2\xC1\xB5\x0B\x57\x87\x31\x6B\x3E\x96\x75\xE5\x16\x5F\x87\x31\xDF\x86\x6A\xD7\x0F\x3A\xA2\x90\x8D\x07\x8C\x87\xE8\xE0\x9D\x8F\x4D\xC1\x66\x0C\xE7\xB5\x6D\x9E\x80\x4C\x24\xD8\x50\x75\x00\xF3\x52\xD6\x64\x89\x9E\x55\xC7\xF3\x3E\xA9\xBF\x3C\x67\xBD\xA2\x0A\x28\x4E\xC5\x18\x76\xAB\x2E\xA8\x13\xC5\xFE\x3C\x03\x9F\xA5\xD7\xD4\xCC\xBD\x6B\x58\xE9\xE9\x49\x04\x3C\xCE\x38\x52\xAA\x66\x6C\xAE\xDB\xDC\x1B\x41\xA1\x48\x18\xF1\x7F\x6D\x5C\x81\xBF\x42\x98\x04\x8E\x9D\xC7\xE6\x49\x6C\x08\xCA\x4F\x22\xF0\x5C\x61\xEC\x4F\xF1\x59\xA3\xA4\x3C\xD9\x53\xF4\x16\xD1\x0A\x8A\x80\x74\x88\xF9\x51\xDB\xE6\xD1\x6E\xBE\xD7\x19\x9F\x1F\x72\x39\x62\xB3\x45\x3F\x7E\x33\xFD\xE7\x49\x06\x89\x77\x45\xF3\xD7\x42\xC9\xD8\x27\x71\xB1\x67\xBD\xF8\xD1\x76\x5E\xB9\xB9\x33\x53\x81\xCA\x04\x81\x4A\x80\x70\xF0\x44\xC7\xC3\x44\xB3\x8F\xB2\xA1\x99\x5A\x3F\xE6\xC9\x4E\xBA\x6B\xFC\x11\x1F\xB3\x73\x6F\x0E\xD7\xB8\x1C\x61\xD4\x90\x89\xA3\xF3\x0D\xDA\x2C\x30\x1A\x83\x5C\x8C\x5F\x01\x7D\xCB\x55\x1B\x0D\xB2\xBB\x11\x33\x33\xC6\x05\x5B\x44\x5C\xB0\xC5\x08\x17\x6C\x1D\x81\x00\x2A\xAC\x5E\x47\x27\xB7\x42\x0B\x73\xF5\x6B\xB4\xA1\x51\x5C\x99\x67\xB7\x42\xFE\xA2\xDB\x68\x52\x8D\x9B\x0B\xF6\xD7\x73\x3D\xEC\x0A\x55\x9D\xDF\x39\xBD\xF2\x5E\x67\x8A\x4B\x6A\xFB\x27\xA0\xBE\x55\x94\x38\xA2\x3E\x97\xB8\xB4\xF9\x14\x91\x82\x3F\x7A\x66\x7F\x6E\xAB\xD1\xAB\x92\xE7\xA4\x9F\x21\x2A\xD4\x08\xC8\x3E\x16\xE8\xB1\x2F\xAB\x3C\xE6\xF5\x24\x94\xC7\xBC\xFE\xB6\xBB\xE5\x31\xEF\x56\x28\xFC\x2A\x95\xC7\xBC\xEE\x56\x0A\x60\x7E\xE7\x8D\x58\x1E\x73\xCD\xD5\xF7\xDC\xB8\x5B\x1E\xF3\x2E\xF1\x7D\xFD\xCA\x63\x0E\x24\x38\x2E\x8F\xF9\x5D\x37\xEE\xBC\x3C\xE6\x77\xDF\xF8\xF7\xA3\x3C\xE6\xAF\x94\xBA\x3A\xE2\x88\xE2\x41\x6E\x09\x70\xA2\x29\x4A\x3D\xB3\xA0\x29\xD0\x68\xA8\x1D\x12\xD3\xC9\xD4\x59\xF5\xE6\x36\x5A\x89\xCF\xAA\x9A\x73\x98\x2B\x71\x25\xC1\x86\x04\x47\x13\xD7\x1F\x00\x9E\x33\xF2\x8A\x3B\x44\x6D\x54\x30\x16\x93\x46\x6B\x5D\x05\xBF\xFF\xB2\xD8\xD8\xCD\x91\x98\xD2\x41\xAA\xEE\x36\xE8\x63\x23\xD2\x63\xAA\x8C\xB5\xDA\x92\x08\x51\x5C\x9A\x9B\x10\x3D\x45\x42\xB3\x6B\x96\x6A\xB1\x34\xA1\x16\x8B\xD1\x5A\x2B\x5D\xAD\xDE\xC2\x42\x00\x24\x5A\x0E\x27\xB2\x58\xA7\x37\xA1\xEB\x4C\x75\x83\x2C\x83\x6A\x57\x6F\x0E\x43\x29\xC3\x50\x38\x77\x83\xD5\xF3\x6A\x45\x3D\x9F\x8D\xD4\xF3\x19\xA9\xE7\x0C\x13\x0B\x17\x9B\xC0\x82\xDA\xC3\x7E\x17\x51\x1E\x75\x08\xAD\x2E\x87\xCC\xBD\xB5\xF3\x76\x87\xAF\xC2\xAA\x09\x1E\x6A\x5B\xBA\xD9\xF4\x9D\xBC\x27\xF5\xE0\xEB\x68\x67\xE6\xBC\xDB\x88\x30\xAE\x9A\x64\x90\x9F\x1B\x29\x03\x74\x29\x40\x82\xCF\x68\x95\x66\x40\x6B\xED\x32\xD1\x1F\x3A\x15\x6B\xDF\xCC\x66\x33\x35\x43\x8F\xD6\xD6\xBE\x29\x39\xEB\x29\x83\xE3\xF1\x95\xF7\x8C\xC6\x30\x0F\x2A\x58\xB2\x21\xF0\xF1\xB7\x5D\x0F\xBA\x1E\xCA\x95\x33\x3D\xCE\x99\xB7\xAB\x6D\xB3\x79\x89\xE3\xE5\xEB\x8B\xB1\xA0\xC2\x4D\x44\x25\xCE\xD8\x1A\x43\xCF\x72\xF0\x17\xF2\xE2\x59\x4F\x61\x1B\x28\x1C\x1D\x0D\x09\x42\xB5\x6B\x2E\xCD\xAD\xE3\x54\xD3\x37\x10\x89\x14\xAE\xBA\x45\x67\x68\x97\x52\x67\xEE\xA8\xE7\xB8\x79\x65\x99\x39\x94\xF1\xCB\xA1\xA9\x72\x2D\x4D\x95\xDF\x08\x9A\x92\x9C\x20\x1C\x9E\x8D\x4F\x9E\x73\x16\xC1\xF0\xB3\xE6\x3B\x6E\x48\x9B\xEB\xDE\x2F\xA8\x1D\xB7\x7F\x7D\xD1\x73\x4E\x61\xCD\xE9\x22\x63\x5A\x86\xFC\x5D\xB9\xAC\xFA\xBD\xCA\x9A\x23\x7D\x2D\x1D\x79\xD5\xF3\x41\xDA\x05\x7B\x86\x17\x98\xD3\x3D\xC6\x0E\xF6\xC1\xC5\x9E\x4F\x5C\xEC\x9D\x09\x79\xBF\x45\x08\x99\x9A\x5D\x99\xCB\x0F\x21\x64\xAA\x8A\x1E\xF4\xAE\x7E\x64\x1E\x3D\x2B\xF3\xB3\x4A\x75\x0B\x9E\x7A\x23\xCE\xF7\xB9\xA0\x07\xD7\xAE\xE2\xC4\xB6\x84\xA9\x62\xCE\x2D\x66\x5C\x91\x66\xE1\xD5\x25\xA4\xC1\x27\x0F\x2B\xD4\x2F\xF4\xFA\xB0\x2B\x50\x82\x00\xBA\x88\x41\x84\x17\x1D\x6F\x95\xAB\x9D\x3D\xA0\x7B\xFD\x91\x3B\x3E\x65\xA5\xD8\x31\x6F\x72\x85\xA7\x53\xE1\x07\x03\x2D\xAA\x1D\x73\x3F\xFF\x39\xCD\x87\xF2\x26\xCF\x76\xC3\xF5\x08\xDF\x2C\x76\xD0\x39\x7C\x47\xED\x0C\x7E\x28\xC6\x91\x85\x63\x6D\xD6\x26\xFE\x08\xBC\xC3\x30\x76\xBF\x39\xAB\x14\x3B\xF0\x0B\x47\xA4\xCD\xB2\x46\xF3\xDF\x21\xF4\x76\x26\x99\x23\x44\x69\x2F\xBD\x34\x5A\xEA\x22\x32\xA2\x4D\xA0\xFA\xCE\xE4\x24\x29\xB8\x42\xD4\xC8\xA6\xC0\x2A\x54\xC1\x7E\xA2\x7C\xDF\x7F\x4B\xBF\x48\x54\x96\x02\x1E\x1C\x51\x73\xEC\xE0\xC1\xEE\x2A\xB8\x0A\x12\xC8\xC2\x90\x92\x34\x63\x68\x6D\x57\x3D\x82\x0A\x14\x74\x94\x85\x9A\x17\x17\x43\xF0\x9B\xDA\x95\x68\xB4\x6D\xA3\xF0\x5B\x25\xC1\xBB\x9C\xCD\x27\x0B\xE9\x2A\x67\xF6\x9A\xBF\x71\x43\x22\x40\x50\x25\x71\x2B\x04\x8C\xC2\x06\xC0\x43\x00\xB5\xEF\x98\xA7\x48\x0F\x8B\x36\x80\x6A\xD9\x06\x50\xED\x75\xB3\x68\x03\x98\x4D\x6C\x00\xB3\x4B\x48\x47\x58\xB1\x01\xCC\xD8\x06\xC0\x72\xDF\x54\x93\x9F\xAD\xB5\x01\xCC\xC6\x36\x80\x59\x68\xFD\x98\x27\x3B\xE9\xEE\x2C\xD8\x00\x50\x47\xAD\x0A\x24\x55\x4D\x6D\x00\xC2\xE4\xDE\x84\xB2\x45\x81\xCD\xE1\x57\x23\x63\x4E\x5A\xEB\x8F\xDA\x2A\x48\xE9\x9B\x91\x52\x2A\x46\x1E\xB6\x80\x60\xE6\x30\x0F\xE6\x14\x81\x51\x20\xF5\xD4\x4A\xAD\x2E\x66\x54\xF6\x0E\x18\x15\xC3\x33\x9B\xE8\x90\xE4\x40\x78\xA6\x2F\x57\xB4\x33\x97\x60\xFB\xF3\xDB\x0B\xAF\x78\x9C\x9B\x5B\xE8\x85\x57\x4C\xAF\xDF\x34\xE0\x3C\x4F\xC9\x95\xFD\x26\xE0\xF2\x23\x66\x5E\x61\x36\x12\xCE\xE2\x2A\x06\x97\x79\x1D\xE0\xFE\x45\x8C\x62\x67\x0B\x33\x12\xF8\x08\x12\x31\x02\xF0\xF0\x92\x95\xE1\xE9\xD1\xF0\x34\x86\x47\xC2\x7B\x87\x28\x16\x4E\x6E\x1C\xD8\x20\xD1\x74\x67\x88\x73\x14\x3C\xF4\x71\x35\x1C\xEB\x79\x0F\x72\x31\x11\xAE\x80\xC3\x45\xF6\xEA\x50\xE0\xF0\x4D\xCE\xF4\x5D\xE2\x9F\xEF\x19\x02\x27\xA5\xAF\xDA\xA3\xA0\x9A\xC4\x92\x30\x98\xF0\xF3\xBD\xCB\x5C\xB2\x27\xEB\xCB\x4F\xF1\x23\xDA\xBF\xAD\x47\xB6\xC5\x70\x77\xBC\x95\x94\x8A\xD6\x80\x64\x0D\xD3\x76\x00\x2D\xE6\xE3\xD2\xDB\xC3\x4E\xF5\x9D\xCC\x14\x42\x6D\x54\xDF\x05\x67\xBF\xCC\x80\x33\x1C\x50\x93\x0F\x01\x35\x45\x75\x45\xEB\xA3\xE0\x44\xB3\x4B\xB9\x02\xF0\xA0\x71\xB9\x8D\x90\x2D\xA7\x46\x79\xB6\xA8\x78\xAA\x43\x92\x6D\xF5\xA3\x5A\xDB\x70\x74\x5C\xD7\xF1\xEC\x60\xAD\x48\x35\xEF\x00\x27\x53\x2E\xBF\xA0\xCE\xD9\x22\xD4\x8C\x0A\x0A\xC6\x6E\x57\x22\x54\xEA\x80\x68\xE4\x12\xD3\x74\xEA\x4A\x97\x5D\xDC\xEF\xEC\x96\xA7\x99\xB0\x5B\xCD\x5F\xA7\x36\xD8\x43\x93\x78\x58\xF9\x52\xBE\x35\xDB\x62\x07\x6A\x42\x27\xCA\x6A\x20\x56\x51\x39\xD5\xBC\xF3\x86\x60\x1F\x5D\xD7\xC3\xF0\x3F\x62\x47\x15\x47\x6E\x57\xD1\x42\x1C\xE8\x69\x70\xA0\x67\xEB\x1D\xE8\xA9\xA8\x24\x90\xC5\xBC\x72\xD9\x57\x56\x71\x64\x5D\x73\x6B\x63\x9A\xE2\x8D\xF1\xB6\xD5\x8A\x23\x8C\xD1\x84\xE2\x36\x2E\x1D\xF9\x3B\xF4\xD8\xDF\x71\xEB\x8A\x23\x5F\x51\x7F\x96\x2B\x8E\x84\xFE\xA8\x49\x7F\x62\xC5\x91\xBF\x75\x43\x1C\xFB\xC6\xD9\xE6\xDD\xF8\xF2\xC5\x6F\x60\x04\x98\x1D\x45\x80\xBD\xFB\x6B\x15\x01\x26\x87\x66\x30\x72\x5A\x76\x07\x20\x80\xA1\xFA\x75\xF3\x65\x17\xC8\x39\x2E\x8A\xE1\xF8\x29\x0C\x75\x92\x6F\x3D\x7F\xC9\x30\x5C\x29\x3D\xB3\x7E\x06\x53\x99\x0C\x9E\xC3\xB8\xC6\x7A\xC5\x6D\x32\x79\x2C\x80\x89\xC5\xB7\x84\x67\xC5\x38\x93\x1C\x1B\xC6\x51\x2F\x85\x71\x48\x1D\x9A\xD5\xD2\xBB\x43\xC3\x93\x37\xD3\x4B\xEE\x16\xB6\xBF\x5B\xD8\xFE\x6E\x61\xFB\xBB\x85\xED\xEF\xBC\xB0\xFD\x5D\x86\x71\x97\x61\xDC\x65\x18\x77\x19\xC6\x1D\x33\x8C\x5F\x2E\x6D\x72\xA4\xAF\x45\xD7\xF2\xE7\xD4\xD4\xDA\xC6\x79\x23\x30\x6B\x25\x3E\xD8\xBF\x60\xC9\x2A\xBD\xA1\x0F\x57\xB7\xBA\x99\x57\x8F\x02\x02\xF6\x65\x05\x03\x08\x2D\xA9\x0D\x26\x2A\x52\xBB\x90\xF8\xF6\x83\x12\x5C\x2B\x16\xBB\x8A\x53\x62\xAA\x17\x01\xA3\x20\xF6\x3A\xFA\xD1\x55\x2F\x8A\xF0\xCA\x59\x21\xD1\x6A\xE7\x2C\xBF\x5E\x72\x65\x42\x5A\x87\x95\xF8\x9C\x60\xE0\xB3\xAE\x1A\xF2\x60\x38\x56\x26\xE9\x2C\xA9\x60\x1E\x48\x01\xB9\xAB\x77\x4C\xC3\x7F\x68\x28\xE6\x72\x3B\x87\x39\x85\xA3\xD0\xC2\xA8\x1F\x63\xBC\x6B\xB7\x60\x20\xB2\xDA\xD9\x9E\x0B\x8B\x6F\x7A\x73\x48\x44\x74\xC2\x95\xDE\xD2\xFF\xAF\x6E\xD1\x2F\xCF\xF7\xED\x49\x99\x82\xFA\xA0\x3D\xC5\xE3\xAE\x0F\xDA\x4D\xF9\xB1\x38\x68\xEF\xE1\x1F\x8B\x83\xF6\x55\x6E\x01\xFD\x38\xBC\x21\xE2\x10\x2A\x57\x9F\x55\x6A\x92\xC6\x9E\x88\x22\xF1\xBA\xFD\x8E\xC3\x91\x59\xD5\xAC\x87\x60\x02\x9A\xA4\x07\xDA\x57\x07\x60\xD7\x05\xA9\xE9\xCF\xB9\x13\x4F\xF7\x5D\x49\x6F\x79\xB5\x60\x64\xB2\x23\xF7\x01\x4E\xBE\x7C\x59\xED\x77\xA7\xDD\xAB\xFD\xEB\xF6\x0F\x24\x0F\xF8\x16\x2F\x10\xAB\xE7\x5C\xB9\x57\xB9\x7B\xDC\xC9\xE6\xBD\xBC\xB4\x73\xF6\x0C\x4B\x0E\x92\x69\x0B\xB7\x29\x09\xC1\xDA\x15\xCF\x79\x07\x7F\x12\x68\xB0\x26\xA5\x81\x7F\xA7\x8D\x37\x5C\xE4\x2B\xE0\xB3\xC8\x0B\xA6\x8B\x4E\xEC\x0A\x58\xA1\x4D\x14\xEB\x4C\xE6\xCA\x9D\x9E\x27\x00\xEE\x33\x5C\xD2\x8A\xDE\xEA\xE6\x07\x6E\x7E\x80\x77\x5B\x77\x4A\xAA\xD1\x1B\x67\x43\xF3\x7A\xFC\x6E\x46\xF1\xEC\x86\x8B\xF2\x6E\x4D\xEF\xD6\x72\x31\xBC\xFB\xD5\xAD\x76\x88\x8B\xAB\x5D\xC3\x55\xEC\x4B\x5E\x85\x07\x76\x45\x49\x7E\xDD\x7E\x30\x04\xAD\x99\x2D\xEA\x90\x10\x57\xE8\x2B\xF7\x74\xA0\x90\xAF\x5E\x67\x19\x3A\x98\x41\x98\x41\x5E\x91\xE2\x18\x2D\xEE\xF9\x5E\x16\x2C\x4C\x69\xD8\x29\x1B\x48\x9C\x66\xCB\x84\xD8\x99\xC2\xC7\x7D\x20\x18\xD4\x4B\xB6\x26\x22\x31\x24\x85\x59\xD4\xA9\xA5\x2E\xC0\xAA\xA2\x39\xC5\xA4\x9B\xF1\xC1\x36\x78\xA7\xBB\x32\x1C\xCC\xB1\x2A\xF8\x6C\x8F\x7F\x1A\x5C\xD6\xAE\xDC\xDB\x19\x0A\x62\xBD\xDA\xD5\xDE\xF4\x5D\xCD\xEB\x30\xE7\x78\xFD\x1A\x09\x9D\xE3\xF7\xE9\x68\x51\xB2\x12\xE8\x16\x8C\x4A\x9F\x53\x83\x59\xE5\xE5\x57\xEB\x57\x05\xCE\xF6\x49\xB5\x14\x35\x43\x5C\x24\x11\xDB\xD5\x93\x5E\x5D\xE2\x24\x7F\x58\x04\x13\x2F\xD9\x4B\x05\x6F\x09\xE5\x1F\x60\x35\xDC\xFF\xAB\x2F\xDA\xAB\x73\xC9\x53\x4C\x8E\x46\xFC\xA0\x4B\x5F\x3A\xE2\xB2\xE5\xD9\x4B\xFF\x05\x1E\x79\x50\xA2\xEE\x11\x74\xDE\x3B\x35\x4E\xC7\x30\x43\xA2\x82\x19\x12\x15\x72\x17\x82\x78\xC2\xF1\x08\x4F\x78\xC2\x97\xFD\x4D\x1D\x2C\xFF\xC4\x11\xBD\xDA\x31\x97\x9D\xBE\xA0\xCE\xC1\x8F\xAD\x76\xCC\xB6\x93\x3B\xDB\xD2\x69\xBF\xDD\x63\x21\xD8\x80\x57\xEE\x98\xFB\x97\xAF\x36\xE3\xAB\x0F\x72\x13\xCD\xE4\xA6\x66\xA9\x89\xCD\x78\x35\xE1\xAB\x43\x13\x09\x97\xD5\x5B\x5F\xA5\xD4\xAC\x94\x25\x65\xC8\x03\x74\x43\xC7\x8A\xA2\xAE\x08\xBE\xB6\x50\xF3\x6C\xDB\xBC\xBE\x95\x12\xA9\x1B\x9C\xCF\x42\x12\x87\xD3\x7E\xA3\x6F\xBE\xF7\x46\xA8\x42\x4A\xF7\x6D\xF3\x32\xFD\xAE\xA2\xD3\x5D\x6F\x9B\x07\xDB\x19\xBD\x82\x8B\xBF\x9D\x77\x45\xB0\x46\x87\x5A\xDE\x4F\x77\x35\xC2\x1F\x79\x05\x61\x62\x9D\x73\xCE\x91\x42\x2A\x98\xF1\x0F\x8C\x02\x37\x64\xBF\xD1\xBD\x5C\xEB\x70\x8E\xCB\x5E\xB5\x0B\x17\xC3\xCE\x2B\xA6\x62\x9A\x45\x62\x5A\x08\xE1\xD8\xF0\x47\x7D\xB7\x31\xC4\x90\x37\x1C\x43\x1E\x4B\xC2\x06\xC1\xEC\x09\x67\xBB\x13\xB8\xED\x64\x74\x8D\x20\xDC\x52\x5B\x6B\x6C\xCA\xC6\xA1\xD5\xEA\xA5\x48\xE4\x3A\x01\x82\x72\x27\xAE\xCC\x89\xE7\x9C\xE0\xA0\xDD\xD5\x08\x54\xD7\x55\x1C\x81\x7A\xA6\xB3\xEB\x23\x50\x1D\x47\xF6\x9E\xE1\xE3\xB7\x62\x53\x4A\x88\x3F\xDD\x1C\x8C\x65\xB8\xAB\x61\x43\x4A\x35\x2A\x17\xCC\x19\x9B\x65\xC5\xB4\xA1\x9D\x89\x18\x0A\x40\x83\x10\xA4\x43\xE3\x93\xE7\xB0\x10\xDD\x29\xC9\x3E\x41\xC2\x71\xD9\x6E\x3A\x1B\xA0\x6E\x4B\x97\x5D\x8E\xCD\x61\xEC\xC4\x85\x79\x1C\x0F\x21\x73\x88\x96\xB8\x33\x5B\xAE\x5A\x33\x8E\x87\x58\x26\x78\x30\x80\x66\x20\x2E\xB3\x92\x71\xDC\xEF\xE4\xB5\xA0\x9A\xC7\x19\xF9\x20\x0C\xA2\xDA\x65\xA4\x04\x90\x65\x00\x18\xAE\x5C\xE1\x4E\x22\x19\x12\xBE\x96\x9B\x76\xBF\x77\xE5\x1D\x92\x27\xA3\xAF\x6D\x32\x11\x12\xC5\x71\x4B\x6B\xC3\x1C\x4B\xDF\x1C\xBA\xE6\xA0\xA3\xC3\xF9\xC0\x19\xB7\xF0\x7A\x7F\xAB\xBD\xC7\x9D\x24\x1A\xAC\xDC\xC9\xB3\x2A\x91\xE3\xF5\xD8\x36\x24\x1D\xB0\x3A\xAB\xF4\x55\xC6\x39\x19\x70\x59\xE1\xEF\xB3\x9D\xF1\x37\x35\xC3\x37\x68\x94\xF2\x77\x86\x2E\xBB\x72\x57\x8E\x92\xB9\x40\xB7\x26\x3D\x72\xF2\xBA\xD2\x3F\xB0\xEF\x1F\x60\xFC\xB4\x7B\xC4\x6B\x52\xBA\x7B\x76\x91\x45\x68\x6A\x44\x02\xDF\xA2\x3F\xD4\x17\x33\x42\x88\x3A\x39\x04\x12\x70\x70\x70\x67\xFC\xA7\x69\x9F\x7D\x5A\x3D\xB2\xC5\xF9\xBE\xE3\x98\xCE\xD5\x3B\x6E\x31\x81\x06\x03\xEF\xAC\xFF\x02\x1D\x30\x5F\x50\x57\xB6\x3A\x30\x6B\xEB\x9F\xEA\xDB\x57\x39\x43\x7F\x0C\xF6\xF6\x4D\x8D\xFF\x5C\xDD\x62\xDC\x95\x38\x49\x15\x26\xA9\x84\xE5\x17\x53\x83\xB4\x42\xDD\x77\xA7\x88\x09\xD0\x3C\x55\x34\x4F\xEE\x14\xB2\x35\x2B\x09\x5D\xA9\xC2\x84\x19\xA6\xE7\x30\x61\x86\x27\x0C\x49\x9B\xF7\xEC\x0A\x3D\xD7\x82\xD4\x68\x5C\xE9\x5E\x75\x59\x26\xFD\x64\xAC\x75\xEB\x36\xDB\x92\x31\x39\x2D\x7D\x1C\x6D\xEE\xE4\xD6\x9B\xBB\xBC\xED\xE6\x2E\x47\x9B\xBB\x3C\x76\x73\x97\xA3\xCD\x5D\xAE\x6C\xEE\xD9\xDA\xCD\x8D\x4E\x27\x01\xD1\xB4\xE6\x31\x2D\x7C\xCC\x4D\xAF\x73\x84\xEF\x30\x78\xC3\x22\x8C\x16\x01\x40\x63\xF6\xA5\xFF\x34\xB0\xAF\xBC\x42\x1F\xD7\xB1\x30\x1D\xD8\x30\x43\x8A\xF2\x99\x70\xE2\x8A\x7C\xBB\x7D\xBF\xCD\xFA\xF2\xDC\xB1\xDF\x26\xF4\xDB\x0C\xE5\xB9\x37\x87\xF2\xDC\x43\xBF\xCD\xD0\x6F\x1B\xFA\x5D\xC4\x95\x89\xC7\xE9\x49\xCE\xBA\xC4\x31\x84\x48\x7E\x5A\x82\xC4\x55\x1C\x98\xB7\x41\x8B\x15\x7D\x3F\xC1\x19\x6F\x94\x36\x15\x3D\x99\x74\xD6\x97\x57\xE7\xDA\x3B\x67\x89\x2D\x31\x12\x2C\x5D\xC0\x17\xF1\xC8\xDB\x09\x6B\xFE\x7A\x8D\x35\x5B\x3F\xD6\xA1\xFA\xF6\x06\x47\x4D\xBB\x19\xED\x4A\x84\xB9\x3C\x08\x76\x3F\x2A\xDB\x0B\x11\xCE\x95\x24\x09\x98\x97\xBE\xE5\x9C\x7D\xCA\x99\x71\x52\xEC\x93\x88\xED\xB3\x3B\xE6\xC9\xA5\xF4\x4E\xBE\x68\x2B\x4E\x8B\x74\x83\x08\x7A\x3E\x1A\xCA\x80\xEB\x1F\xD2\x3E\xD6\x78\x07\x90\xEC\x21\x6E\x01\x9A\x93\x81\xAE\xD7\x24\x4B\x11\x39\xB3\x54\x71\x66\x25\xD7\x58\x03\xBB\x90\xAF\x6E\x2E\x5F\x15\xB9\xE8\x98\x0E\x6C\x8F\x3A\xF0\x50\x38\x4F\xD7\x76\xE0\xC1\xD8\x81\x07\xD7\x75\xE0\xFE\xD0\x81\xFB\xD7\x77\xE0\x3C\x4B\xD0\xC0\x76\x7A\xFD\xF0\x64\x28\xDE\x9B\x0F\x01\x8E\x9F\x8C\x82\xBB\x19\xEC\x13\x7F\xBB\xD2\xC5\x91\x20\x37\x33\xDC\xD2\x60\xAE\x4A\xBA\x74\xCF\x99\x2B\x28\xBC\x90\x39\x83\xF8\xE0\xD4\xE9\xBD\xAE\x70\x48\x74\x4E\xC5\x98\x59\xEC\x75\x39\xF7\xC1\xF4\x2E\xF5\x47\xCF\xF4\x6D\xE9\x52\xA9\x20\x94\xEF\x73\xA8\x47\x0A\x8C\x81\x04\x5C\xFE\x61\x25\xB5\x15\x12\x49\x02\x94\x7C\xF2\xBC\x07\x9E\x6A\x1E\xAC\x43\xE3\x7B\x47\x5F\xCC\xF8\x8B\x1D\x7F\x49\xC6\x5F\xD2\xF1\x97\x6C\xFC\x25\x1F\x7F\x29\x26\x16\xA0\x8C\x7D\x4E\x05\x4F\x07\xA3\xF1\x66\x18\xD9\x5E\x5B\xBA\x8C\xE1\x34\x9C\xD9\xEB\x66\x0E\xB6\x3C\x04\x00\x24\x2E\xC3\xA8\x03\x88\x65\xB6\x47\xC3\x2E\x00\x45\x0D\xC3\x6D\x26\x83\x9F\x2D\x0F\x1E\x89\x0D\x0C\xD7\xC5\x41\xCA\xC3\xE0\xC7\xF7\xE2\xCE\xF1\xF8\x67\xDE\xF4\xE3\x29\x98\x79\xDB\x8F\x67\x81\x36\xE6\x78\x22\x66\x9C\x37\x12\xE7\x62\xC6\xF9\x25\x71\x3A\x66\x3E\xEF\x47\x33\x82\xBE\x15\xB4\xB5\xD3\x30\x31\x09\x4F\x4C\xC9\x56\xEB\x72\x8F\x34\x96\x89\xE1\x3A\x01\x1A\x38\x90\x84\xEC\x23\x5B\x1E\x24\xF9\x86\x2D\x3A\xE1\x73\x3A\xCD\x53\xC1\xF1\x23\x7A\x98\x23\x45\x1B\xD9\x91\x4B\x54\x91\x73\x78\xED\x0A\x71\xC0\x07\x9D\x3F\xCE\xAB\xF2\xF5\xA4\x0D\xD4\xB1\x79\xBE\xEF\x72\x62\x77\xBC\x41\xC4\xD3\x39\xDB\xA3\xA5\xCF\xFD\xD1\xA3\x20\xFD\xD9\x1E\x89\x80\x08\x3C\x4E\xDC\x6C\xAF\x4B\xBC\x3E\xEC\x66\x6E\xE6\xF2\x2B\x5B\x88\x0B\xCA\x43\x51\x97\x2B\x5B\x5D\x36\x04\xD8\x89\x6D\x16\x90\xBA\x34\x78\x92\x86\xCB\xBE\xCB\x41\x69\x26\x6E\x9F\xFC\xB6\xDB\x27\x27\x71\x6A\x06\xAE\xFF\x0D\xD8\x40\xD1\xA6\xA4\xC5\x03\xB2\xD7\x31\x7A\xBB\x13\x80\x4F\x83\x5A\x1D\xC1\x50\x82\x3C\x80\x82\xF9\x09\xDB\xCD\x8E\x9E\x71\xE2\x1D\x21\x16\x43\xE3\xB6\x2C\xDD\xD0\xB8\x67\x2E\xE9\x49\x09\x0E\x34\x6A\x39\xC6\x1F\xA1\xF3\xF8\xBD\xD5\xB8\xA7\xE5\xC4\xB9\x30\x01\x33\xA7\xE5\x01\xDA\x3F\x4E\x0F\x9B\x88\xF6\x8F\xD3\xC3\x26\xA2\xFD\xE3\xF4\xB0\x89\x68\xFF\x20\xC2\x3D\x7E\x4F\xE9\x7B\x3A\x7C\xCF\xE8\x7B\x36\x7C\xCF\xE9\x7B\x3E\x7C\x2F\x68\x67\x4B\x5E\x7E\x1A\x4B\xD9\x0B\x92\x6F\x31\x71\x3F\x98\x75\x20\x07\xF9\xC0\xA3\xEF\x8F\x29\xE8\x9C\x2B\xD9\x7C\x1F\x47\xBB\xC1\x30\x23\x5F\x42\x72\x7A\xF5\x87\x02\x87\x71\xE4\x55\xF3\xDE\x10\xA5\x45\xD3\xE0\x37\x11\xDA\xC3\x36\x72\x49\xF7\x46\xE8\x4F\xF3\xDF\xBF\x30\xD8\x6C\x80\x51\x0A\x00\xB4\x23\x08\x2B\x16\x59\xD9\x35\xC3\x26\xE8\xE6\x8B\x30\xC2\x9D\x16\x83\x09\x7B\xBB\x9A\x7F\xC7\x95\xE9\xE1\xA1\xE2\x7B\x3B\x0B\x50\xBA\x3F\xF3\x08\x29\x42\x70\xC5\x74\xB6\xF9\xEE\x17\x10\xD5\xA3\x8F\x69\xC6\xEB\x83\xD0\x92\x40\x15\x22\xD5\x1D\x5D\xBF\xE7\x11\x0E\x09\x6B\xDE\x47\x6D\x3C\xAC\xB4\x04\x7D\x35\x6C\xAF\xD7\x30\x09\x54\xFF\xA7\xD1\xE9\x91\x57\x01\xDC\xAD\xE1\x3C\x96\x04\x7E\x17\x7C\x22\x65\x27\xF3\xDF\xC2\xB8\x78\x00\x93\x49\xE9\xA7\x7C\xFA\xD3\x6B\xB4\x71\xC9\x6B\xB4\x79\x06\x18\xAD\x60\x5A\x80\x3C\x43\x1C\x92\x4F\x68\x79\x53\xBF\x29\x26\x94\x94\x67\x26\x65\xE3\x4E\xEA\x6C\xF3\xC7\x58\x8F\x84\x6B\xFF\x63\x4E\x33\x7E\x5E\x6A\x50\x6E\x53\x5F\x59\xFB\xB6\x5E\xC1\xC7\x96\xD2\xAF\x9B\x8C\xF0\x28\xCF\x47\x67\x1B\xA7\xB2\x6C\x9B\x86\x0D\x23\x08\xAD\x6B\xB8\x9D\x4D\xB1\x27\xC7\x22\x29\x90\x53\xD8\x1F\x44\x4F\x70\x53\x95\xCC\x88\xE6\xA8\xD9\x84\xC1\x33\x12\x6F\xB1\x7B\x9D\x79\xAD\x36\x00\x7B\x04\x28\x47\xE3\x12\x5E\x9C\xCA\xD9\xEA\x47\x0C\x64\x03\xAF\xB6\xCD\xE7\xDF\xF3\xC2\x75\xD5\x69\xEE\xF8\x47\x7E\xEF\xC6\x75\xD5\x1A\xFE\xEB\xB4\xAF\x9F\xEE\x83\xC5\xC5\x99\x2E\xA1\x7D\xF6\x5C\x97\xD2\xCF\xAC\xB1\x65\x4E\x5D\x45\x12\x0F\x12\x1E\xD1\x8B\xB4\x2D\x10\x44\xEA\x15\x20\x67\xBA\xCC\xE5\x5B\x5D\x81\x96\xA0\xE1\xBB\x6C\x8F\x7E\xD1\x5E\x31\x52\xBE\xB3\xB0\xD6\x5D\x64\xB8\x1B\x9A\x59\x47\xAD\xCE\xD5\x24\xB1\x36\x71\x68\x42\x6C\xA3\xB4\xDD\x17\x36\xD5\x16\xD2\x0F\x49\x3E\x6F\xEB\x17\x86\xBF\x3A\xD5\x63\xC8\xD9\x1E\x2D\x32\xBB\x43\x04\x2F\xDD\x6B\x5C\xF2\x47\xE3\x3B\xD8\x91\xE7\xCD\x5F\xE2\x00\xB9\xD1\x4D\x40\x63\xAB\xBE\x8D\x03\x76\x62\x28\x6E\x27\x3A\xB9\xD3\xCD\x0F\xF0\xFE\x24\xFD\x34\x10\x3C\x29\x4B\x7F\x7C\x53\xED\x0B\xBD\xDB\x70\xA1\x33\xCD\x77\xBE\x20\x40\x9E\x9B\x7D\xC0\x59\x00\xA3\xD7\x1C\x24\x49\x83\x1C\x74\x59\xA0\x40\x32\x70\xEA\xA6\x33\xCE\x34\xEF\x79\x81\xD9\xAB\xE1\xB7\x0A\x1C\x44\x6D\x18\x8B\xC9\x5F\x6F\xC4\x12\x4E\xDC\x3A\xF6\x86\xB4\x30\xE9\x08\xE3\xFE\xD1\x0F\x60\x1D\x73\xBD\x76\xAB\x77\x16\x34\x04\x57\x64\xF3\xFD\xE0\x31\x95\xD7\x55\x47\x9D\x95\xFB\xE5\x18\xE0\xFB\xE5\x1E\xAF\xAB\xEF\x65\xDC\x0C\xF6\xCD\x9C\x0E\x30\x56\x20\xCE\x77\x36\xFB\x9E\x31\xC3\x9D\xF1\xB5\xD3\x4B\x8F\x6E\xD0\xF1\xB8\xE9\xF4\x78\xDE\xF4\xF2\xBC\x41\x54\xDE\xA4\xE3\x88\xD5\x06\xAF\x7C\x29\x73\x82\x40\x55\x5F\x31\xC3\x93\x9F\xC0\x35\x43\xD7\x7E\xDA\x68\x73\x34\x24\x7A\x26\x91\x61\xA4\xFE\x55\x57\xE6\x8C\x80\x5B\x77\xCA\x97\xEC\xEB\x03\x1A\xA3\x49\x80\x2E\x29\x0B\xFE\xB2\x7A\x86\x08\x75\x4B\x6A\x96\xA4\x1C\x3F\xA6\x49\x87\x03\x3F\xD9\x0D\xDE\xB5\xD4\xFF\xE5\x5E\x80\x64\x71\x01\x70\x2D\x3E\x17\xAC\xC8\x30\x26\x80\x82\xCB\x84\x27\x62\xB8\xDE\x36\x35\x71\xBC\xC4\xEB\xD7\x6A\x49\x4F\xAA\x59\xBD\x8C\x0C\x5E\xF2\xD0\xD8\x79\x82\x3B\x88\x34\x74\xF3\xBD\x2F\x20\x1E\xB9\x01\x6C\x29\xD4\xBB\xE1\x24\x91\xC3\x83\x3A\x93\x79\xC4\x76\x01\x3F\x1D\x1C\x1D\x42\x90\x16\xE8\x4C\x3A\x9F\xC0\x82\x03\xA4\x51\x43\x1C\x84\xF8\x31\x8D\x93\x78\xC6\xC3\x1C\x67\x0A\xAE\x3D\xBB\x14\x14\xD7\xA0\xA6\x85\xE3\x07\xF9\x6B\x51\x2E\x78\x0B\x3C\xED\xD5\xCF\x6A\x9D\x1F\x61\x7A\x70\x21\xF5\x76\x9F\xE4\x01\xFC\x72\xD4\x7B\xFB\x38\x78\x26\x60\xBF\x52\xFF\xB6\x7D\x94\x9C\xCC\x5D\x02\x3F\x74\x1A\xD0\xA8\x83\xD3\x98\x44\x57\x71\xED\x55\xF0\x32\x77\xB5\xB3\xAE\x76\xF6\xF2\x56\x67\x49\x45\xC7\xDF\x99\xFC\x2D\xE9\x2F\xD8\x78\xD3\xB7\x29\xF2\x12\x93\xBE\xCB\xF9\xD8\xCE\xB8\xE2\x17\x60\xC5\xF8\x65\x40\x96\x75\xD6\xE5\xF1\x31\xF8\xBE\x33\x12\xC6\x32\xF6\x74\x57\x89\xF2\xAA\x7A\x6F\xA2\x93\x11\x5E\x68\xBA\x04\x66\x19\xB0\x20\xFD\x67\xF3\xAB\x80\x54\xE2\xBF\xC6\xE9\xCB\x1C\x64\xAF\xFD\x6F\xE4\x97\x23\xF1\x19\x0F\x07\x90\x71\x36\x10\x1F\x84\xE8\x81\x68\xB9\x26\x06\x4D\xFD\x88\x64\x0D\x93\xEC\xF2\x53\xBC\x0B\xB3\x48\x6E\xB9\x9F\xB9\x0C\x34\x9C\xB9\x64\x4B\xE8\x2E\xA3\x45\x6F\x38\xF6\x02\x01\xEF\x99\xEC\x0E\x21\xC4\x8C\x09\x31\x19\x08\x31\x89\x84\x98\x08\x21\x16\x0C\x01\x07\x42\x4C\x5C\x31\x10\x62\x41\x84\x58\x4C\x08\x31\x68\xAD\x59\x24\xC4\x8C\x08\x91\x05\x65\x22\xC4\x82\x44\x47\x84\x4F\x66\x42\x88\xE2\xA1\x6F\xA8\xDB\x0F\x2B\xCD\x90\x66\x74\x04\x5D\xC5\xCC\x9A\xCB\x9C\x87\x92\xB8\xD4\xDF\x2B\xC0\x5A\xA9\x3F\x23\xB1\xFF\x74\x8E\xCB\x27\xFA\x53\xBB\xD4\xBF\x7C\xE3\x3F\xDB\x31\xDB\x2E\xF5\xBF\xF4\x1B\x37\x90\x70\x0B\xFA\x2B\x7A\x97\xF9\xCF\xE6\x5E\x37\xFF\xC3\x0D\x46\x56\x5D\xBB\x22\xB8\xB3\x79\x11\x3C\x85\xE9\x34\x7E\x05\xA0\xA3\x4B\x07\xA8\xD3\xA4\x7A\xD7\x4C\xE7\xA3\x24\x9C\x24\x50\x07\x92\x48\x10\x53\x79\x51\x40\x9F\x18\x19\x0F\xFB\x80\xD3\x8A\x37\xBB\xA2\xEF\x4A\xFF\x41\xFD\xDF\x76\xB3\x60\xBE\x29\xDD\xCC\x7F\x50\x3F\xBD\xE7\x4F\x3F\xDD\xD3\x1D\x8C\xBF\xCE\xC2\x01\x07\x7E\x4B\xF2\x22\x22\x49\x32\x8E\xF6\x47\xA9\x9F\x5C\x80\x63\x69\x48\xA5\xCB\xF6\xBA\xCC\x9B\x67\xA9\x2D\xCE\xB8\xC8\xB6\x5C\xE1\xD2\x7E\xCF\xEB\xDE\xFF\x3C\xEC\x01\x25\x87\xAF\x8F\x81\x8D\x6A\x44\x3E\xD4\x1C\x4C\x9E\x57\x2E\x6F\x53\x97\x8B\xEA\xC6\xB2\x2B\x6D\x92\x12\xA3\xAB\xC5\x73\xC7\x3B\x15\x89\xC3\xE3\xF7\xE5\x5B\x4E\x09\xF1\x00\x78\xAF\x6C\xFE\xB7\x90\xDE\xB1\x89\xF6\xE3\x20\x52\x58\x0D\x30\x0D\x59\x98\x86\xDC\x65\x71\x1A\x18\xB3\x68\x93\x31\x8B\x68\x57\x1F\xB1\x2B\x69\x80\x5C\x3C\x4D\xD2\x07\x8D\x9F\xC3\xFB\x0B\x49\x8D\x43\x89\x70\x6E\x38\x1D\x1A\x4E\xC7\x0D\x23\x0A\x2A\x47\x0C\xAB\x91\x8A\x5A\x89\x3F\xE2\x13\x4C\x6D\x1B\x87\x1C\xAE\x1D\xE3\x90\xAE\xA6\xAE\xB2\xD4\xF0\xB0\x3A\x83\x6A\x69\x39\xBD\x4A\x50\xD6\x4F\x5C\x67\xAC\x5C\x23\x12\xD1\xC3\x6A\x83\x7A\x11\xEE\x4A\xFC\x46\x00\xA5\x2B\x4E\xFC\x55\xDC\xDA\x19\x9C\x02\x67\xD5\x06\x42\xBF\x24\xC9\x98\x47\xEA\x37\x25\xFF\x88\x04\xD9\xAC\x33\x02\xF6\x5B\xC0\xB3\x2B\xE6\xF2\x82\xE1\xD9\x24\x45\x45\xDC\x1A\x7C\x3B\x6F\xB9\xA0\x9B\x62\xFF\x3A\x83\x6A\x9D\x88\xC8\xA1\x0E\x19\xAF\x77\xB7\x78\xD0\xC1\x24\x85\x01\x42\xEE\x2C\x42\x60\xAF\xC4\x25\xD1\x24\x78\x73\xD8\x19\x76\x0B\xC6\xEB\x9D\x9C\xF5\x39\x44\x17\xA6\x07\x06\xDE\x0B\xD0\xC1\x29\x5F\xCB\x02\x4C\x66\xCA\xFC\x67\x04\x29\xC1\xA4\x56\x5B\x54\x01\xA8\xA1\x3B\x12\x21\xF2\x6E\x59\x4B\x55\xDB\xE6\x34\x2F\xEF\x97\x41\x58\x66\x58\x7F\xB3\x86\xB0\xB2\x09\x61\x15\xAB\x84\x85\x34\x98\xB0\x98\xD4\x51\x1E\x57\x58\xFE\xFA\xC4\x77\xC8\xF2\x63\x05\x3C\xF6\x57\x1E\xC8\x7F\x8C\x44\xEF\x46\xBB\xB8\x1B\x6F\x59\x76\xEB\xAE\xD9\xB5\x29\x0F\x76\xB4\x71\x8B\x3B\xD8\xB8\xA1\x6E\xF3\xF2\x76\x48\xA7\xFB\x2C\x1D\xEF\xB3\x94\x18\x0E\x1F\x3F\x44\x24\x48\x25\xE7\x52\x0A\x38\x52\x21\xAE\x43\x7E\x48\xF9\xB2\x46\x48\x23\x2B\x34\x23\xD8\xD7\xDF\xD6\x3A\x23\xE5\xF5\xF3\xCC\x7B\xC7\xBC\x50\x4F\x78\xA1\x01\xA0\xA7\xB8\x8C\xBB\xE4\x96\x9D\xA3\x3B\x24\x83\x7E\xC4\x0B\x01\x08\x6A\x25\xD0\x8F\x79\x61\x08\xAE\x8B\x13\x8B\xB0\x3A\x33\x99\x55\xB3\x45\x1A\xD4\x78\x4A\xD3\xDB\x4C\x29\x89\x45\xAD\x76\x56\xD0\xF7\x92\xBE\xF9\x80\x80\xEF\x7D\x0D\x61\xE4\x3E\xA5\xD6\xC1\xC8\x7D\x50\x7F\xDD\x61\xE4\xFE\x85\x26\x9D\x3C\x68\x11\xAF\x1A\x6B\x11\x46\x62\x03\x90\xBF\xD6\xF0\xD4\x6F\x0E\xB0\xFB\xC8\xF3\xAA\xA3\xCF\x00\x61\x66\xDA\xBF\xF5\x71\xA6\x4E\x9C\xF1\x15\xE3\xD8\x36\xBD\x7F\xEB\x7E\x88\x7E\x6D\x33\x67\x19\xF7\x96\xE4\x32\x7D\xC0\xFE\x83\x4C\x02\x25\x01\xE6\x7E\x08\x13\x12\xE9\x55\x19\x1D\x4D\xC4\xE8\x68\x51\xA3\x71\x2A\x73\x5A\x24\x05\x83\xA0\x53\x44\x06\x61\x54\x51\x19\x09\xA6\x99\x9F\x36\x3A\x5D\xB6\xB6\x04\x69\x4C\x0B\xB2\x7C\x94\xC6\xE2\x34\x98\x55\xE5\x88\x2E\xA7\xCD\x87\x6E\xAC\xC1\x9C\xD1\x82\xB0\x5C\xCB\xE4\x52\x8B\xAF\xBE\xC4\xEA\x74\xDD\xD9\x8B\x73\x76\x9D\x92\x92\xC8\xFA\x4A\x0D\xEF\xAA\xAF\x2F\xCD\x8D\x4B\xFD\xB7\xF4\x8B\x93\x89\x59\xFA\x97\x98\x71\x7F\x5E\xBD\x4E\x59\x43\x0D\x1F\x7A\x58\x2B\xF9\x67\xE4\xAF\x56\x62\xA0\x91\x48\xDA\x86\x48\x62\xC7\xD4\x78\x46\x93\x36\x5A\xAF\x5C\x73\x56\x8C\x3E\x6C\x6A\xC0\x95\x60\x07\xD2\xD5\xCF\x25\x00\x1B\x5C\x46\xC9\x6A\x30\x62\x31\x94\x48\x05\xC7\xD4\xDF\xF3\x08\x3C\x9B\x09\xF0\x92\x58\xB8\xF3\x2A\x44\xF8\xD4\xA6\xB2\xE7\xE9\x90\xA8\x51\xF5\x82\xA5\xB7\x9B\x7A\x1F\x04\x0D\xB9\x52\x64\xC8\xBE\x1D\x00\x48\x89\x66\x86\xB6\x6B\x8D\x34\x6D\x09\xA8\xE0\x39\x27\xB6\x8D\xFA\x0D\x09\xC7\x0E\x5D\x99\xEB\x3A\xAD\x82\x45\xF7\x91\x79\x82\xF2\xF7\xC9\x80\x95\x9A\xF3\x61\x3E\x7C\xE7\xDE\x5B\x36\x65\xE5\x5C\x37\x34\x41\xB9\x0A\x6A\x5C\x6C\xC7\x96\xBA\x4A\x9A\x9F\x40\xB6\xD0\x91\x9C\x49\x96\x22\x69\x18\x33\x3E\x3F\xE1\x16\x2C\x7A\x86\x01\xA6\x23\x63\x0B\x01\xE0\x3D\xB5\x9A\x59\x54\xDC\xA7\xF5\xFC\xC3\x1B\x7C\xBE\x87\xB2\x20\x19\xAE\xE3\x48\x6E\x0B\x16\x26\xD3\x50\xFC\xC2\xF0\x5A\xC0\x86\x27\xD2\xBC\xB3\x53\x8D\xD2\x4E\x34\x4A\x3B\x08\xF2\x96\x43\xB7\xC7\x82\x7C\xF4\x43\xE5\xA1\x18\x89\x11\xDC\x3B\xC4\x18\x6A\x57\xB6\xC6\x95\x71\x46\x4C\xCD\xA9\xF1\x25\x6A\xA6\x72\x36\x8F\xF2\xBA\x79\xFB\x0B\xD0\x84\x45\xD4\xA7\x9D\x0D\x90\x14\xEB\xB2\x87\x95\x0E\x1A\x68\x70\x71\x0D\xBB\xF2\xC7\x8D\xB6\x47\x4E\x35\x1F\x14\x46\x2B\xFB\x08\x74\x19\xC9\xCE\x29\x9F\x0D\x1B\x6E\x20\x37\xDE\x56\xA3\xCD\xBB\x1B\x55\x29\xED\x73\x8E\xC6\x52\xF7\x99\x24\x6A\xFF\x2E\x34\xAC\x9C\x7E\x8D\x36\x23\xC4\x10\x36\xF4\x11\xA3\x22\x66\xA2\xEF\x40\x6B\xFF\x13\xCC\x31\xBD\x54\x94\x25\x0D\x4C\x69\xF8\x55\x10\xF0\x09\x8F\x0C\xF7\x78\x30\x9D\xE2\xB2\x4C\x81\x69\xD9\xE0\x33\x98\x41\x3E\xA1\x51\x0B\xE0\xCE\xA7\x4E\x6E\x80\x78\x8B\xD0\xAC\x51\x85\xA1\x7A\x2E\x01\x5B\x02\xBC\xDC\x44\x43\xB4\x8E\x86\x68\xB6\x08\xF3\x88\xB5\x53\xC3\x88\x49\x4D\x08\xC9\x6D\xC1\xE2\x1D\x46\xBC\x11\x17\x24\x5B\x5A\x10\x98\x2A\xAA\x1B\x23\xBD\xBB\x89\x45\x24\xD8\x10\xCA\x99\xF9\x12\xFF\xDC\x25\x3E\x45\x69\x72\xF8\xE6\x8D\x0D\x05\xF1\x1F\x19\xE2\x96\x9C\x6C\x21\xDD\xB3\x57\xBA\xE8\x59\x32\x52\x2C\xAD\x6D\xA1\x5A\x42\xCD\x87\xBB\x01\x6E\x33\x86\x1A\x63\xFF\x9B\x2E\x71\x92\xBA\x1C\xB4\x1A\xB1\xF4\xFF\xC0\x08\x04\xBA\x91\xA7\x6B\xA9\xB8\x7F\xD4\x3B\xB1\x34\x6E\x4A\xED\x95\x74\x48\x9A\xD3\x83\x28\x13\xAC\xB9\x1C\x82\x0E\xA3\x2E\x1B\xF1\x12\xA7\xF7\x18\xCC\x27\xBC\x15\x77\x73\xFE\xE1\x90\x87\x5E\x05\x26\x28\xA3\x8D\x05\xE3\x20\x1E\x49\x82\x77\xB7\x3A\x6A\x0E\x10\x4D\x11\x44\x0D\xC3\xB8\x50\x86\x8E\x90\x39\x34\x5E\xE2\x5F\xE9\xC2\x2A\x04\x3D\x8C\xA7\xA7\x90\x1A\xA9\x09\x40\xA5\x15\xFB\x41\xD2\xE6\x3B\x68\xF1\x43\x5B\x3C\x0E\x66\x53\xB4\x71\x34\x1C\x32\xC4\xCE\x6F\xDA\xFD\xD1\x08\x42\xE9\x3A\x96\xB0\x4C\x94\x27\xAB\x9B\xE5\x04\xD2\xCD\x8A\x98\x09\xF1\xE0\xB4\xB3\xB4\xB0\x67\x9C\x65\xC2\xB4\x48\x57\xE6\xE0\x5A\xCB\xA9\x24\xA7\xFB\xE6\x23\xD4\x0F\x06\x6B\xAF\x3B\xC5\xAF\x51\xFE\x69\x62\xC5\xCA\xBF\x99\x98\xA9\xF2\x6F\x62\xE0\x2C\xE5\xDF\x2A\xB8\x0B\xA5\x53\xFE\xB0\xEF\x10\x10\xA9\x77\x83\x89\x9A\x27\x92\xF8\x5B\xB9\xE7\x93\x67\x2F\x8B\xA2\xE5\xF5\x63\x43\x1D\x88\xD2\x55\x3E\x39\xEC\x3B\xEC\xDE\x0A\xC3\x6D\x35\x57\x55\x93\x68\x0D\xA9\xB0\x00\x68\x3B\xA1\x9C\x11\x58\x94\x20\x88\x37\x62\xD3\xB0\x52\x63\xA6\xAE\x13\x0E\x01\x77\xDA\x55\x3C\x26\x2E\x03\x54\x71\xAC\xB1\x94\x83\xEE\x14\x42\x41\xBA\x79\xDF\x2D\xB8\x3C\xF6\xC6\xE3\x28\x69\x61\x0E\x5B\x6D\x91\xC4\xDD\x23\xAE\x9E\xE3\x30\xE1\x74\xAB\x69\x5B\xD4\xC3\xE3\xBA\xE7\x18\xD0\x76\xE1\x38\xE0\xB3\x9B\xF7\xD2\xD6\x15\x36\x06\xB0\xAE\x49\x23\x3F\xEA\x03\x65\xA0\x72\x28\x6F\x33\xB7\x41\x9F\x6B\x67\x9A\x17\x5E\x10\xB4\x29\xEB\x8D\x33\xCD\x8D\x17\x24\xAF\x1C\x15\x90\x87\x8D\x29\x3D\x28\x89\x38\xAB\x5E\x4A\xA7\xCB\x0D\xA1\xD5\xE5\x7B\x58\xB3\x6D\x43\x22\x54\xD3\x77\x25\xE2\x57\x59\x25\xAD\x18\x49\xBC\x82\x4B\x7F\x03\xD3\x5F\xED\x79\xBB\xCF\x28\x25\x3C\x1D\x98\xA9\x76\x6E\x65\xE6\x4A\x9A\x9A\xD2\xCD\xFB\xE9\xEC\x20\xE2\x75\x1E\x5E\x5F\x71\x85\xF1\x05\x11\xF4\x62\xCE\x61\x34\xF6\xCA\x5C\x4F\x9B\xC4\xDB\xB0\x32\x2A\xB4\xBE\xA0\xD6\x55\xEF\x16\x6E\x4E\x7F\x03\xAA\xD8\xE8\x12\xED\x0B\xB9\x3A\x82\x31\x1B\xDF\x50\x0C\x37\x14\x6B\x6F\xA8\x87\x1B\x62\x96\x0D\x91\x52\x4B\x43\x4E\xB8\xFF\x6F\xEB\xBB\x2A\x80\xF4\xBB\xEA\x2A\xD0\xFE\x0B\x06\x3E\x72\x19\x22\xE8\xDD\x0C\xA1\x9B\x15\xEB\x79\xC4\x38\xA0\xAA\x4F\x05\xBB\x45\x62\x95\x46\x30\xF9\xB6\xD4\x68\x70\xCA\x15\xCD\xDF\x17\xC2\x1C\xFD\x6C\x5C\xD1\xFC\x03\xFC\x6C\x64\xCD\x2A\xD9\x8B\xA8\x7E\xD0\xE9\x3D\x7F\x66\x97\xB1\x4A\xFC\x5B\x07\xB3\x37\xED\x3F\x41\x82\x1F\x60\xBD\x9F\xEA\x3B\x01\x95\xD0\xC1\x7E\xE0\xDF\xC8\x39\xCA\xB4\xE9\x68\x0F\xD5\xD8\x32\x6F\xC2\x96\xB1\xCB\xDD\xFB\x51\x76\x8B\x25\x1C\xE9\x2C\xC5\x1E\x34\xED\xE5\xAE\x42\xA4\x15\x88\xDA\xEE\x6E\xD1\x46\xD9\xDD\x62\x53\x4B\xB0\x7E\xF1\xC0\x99\xA5\x6B\xAE\x0A\x44\x3D\x6E\xA3\x4A\xAB\x18\x26\x8C\xF4\x43\x9E\xC8\x7A\xE8\xF9\x61\x0F\xE8\x9A\x37\x61\x2D\x44\x33\x43\xF9\x08\x55\x31\x33\xAB\xC3\xC9\x58\xC1\xD7\x2A\x7C\xAE\xAA\xBE\x63\x10\xAB\xA7\xE9\x89\x7B\xFE\xCC\x5B\x3A\x76\xBC\xF9\x7F\xF2\xFE\x77\xFF\x8C\x7A\x5C\xBA\x98\x31\x97\xE7\x1B\x72\x00\xEA\xB8\xC2\x65\x57\xB6\xFC\xCF\xD0\x6D\x2E\xF7\xEF\x7F\xF7\xCF\xDC\x1B\x23\x18\x72\x36\xCC\x4A\x13\xDA\x65\xFE\xCC\xD3\x41\xE0\xAD\x60\x30\x3B\xF3\x74\xDF\x95\xCC\xA6\xCA\x90\xD3\xED\xCA\x98\x34\x55\x46\x66\x95\xE3\x61\x46\x4F\x3A\x43\xFB\xC4\xBA\x84\x83\x60\x35\x42\x46\xD1\xD7\x37\x91\x6A\x6A\xE9\x73\x4E\x9F\x53\x58\x5D\x55\xB0\xF9\xC3\x04\x7F\xD8\x77\x05\xB7\x08\x11\x99\xAD\x46\xC4\x9B\xA5\xA6\x58\xE1\x72\x46\xEA\x60\xC3\x6D\x4E\x97\xD2\x98\x43\xF8\x7C\xCF\xE1\x1E\x26\xFE\xF2\xB6\x1E\xD2\x7A\x84\xEE\x63\xAF\x6F\x60\xB0\x9A\xBA\xA1\x7B\x06\xF1\x63\x8F\x7E\xC1\xE1\x30\x59\x64\xCB\x01\x9D\x91\xC6\xC0\x36\x2C\xBB\x3B\x37\xE8\x14\x49\xEB\xE6\x3C\xDB\xD9\x72\x96\xF3\x93\x9E\x13\xCE\x62\xE0\x16\x0D\xA9\xA5\xD9\x79\x13\x0C\x8E\x88\xD2\xAB\xED\x18\x3B\x4F\xDE\x1A\x4E\x81\x52\x72\x5C\x26\xC1\x62\xD5\xFF\x91\xE9\x5A\x8A\xDA\xC1\x11\xCC\x6A\x13\x97\x1C\xB5\xE7\x5D\x2A\x75\x56\x12\x27\x99\x59\x79\xA0\x9B\x58\x11\xA7\x2B\xE8\xB4\xBF\xD6\x2F\x12\xC3\x88\x71\x45\xB0\x57\x79\xEC\x86\x82\xAD\x85\xB8\xCB\xEC\x6E\x31\x71\x20\x80\x4A\xAA\x05\xC1\xD9\x5E\xF8\xC3\xDE\x97\x6C\x8B\x9A\x5D\x42\x86\xE2\x26\x9B\x6C\xB6\x4D\xC3\xDF\x83\xA1\x31\x1D\x24\x2C\x7E\x72\xF3\x91\xB9\xF6\xDA\x15\x87\xFE\x9D\xBF\xF6\xB2\x42\x6E\x8D\x4B\x5D\xDE\xFC\xB5\x17\xE0\xAC\xE4\x80\xBB\x0C\xF2\x1C\x34\xA6\x5D\x08\x26\x50\x83\x60\x79\x4E\x5C\xC6\xBC\x1D\xDA\x52\x5B\xB8\x8C\x31\xEA\x39\x72\x3E\x0A\x34\xA3\x21\x0E\x26\xB9\x14\x30\x3F\xD8\xA8\x3C\x40\x62\xDC\x22\xF4\x54\xA1\x4E\x00\x6C\xA8\xB5\x04\x5F\x13\x15\xD4\x7C\x2D\x89\xF2\x51\xCD\xE5\xE1\x53\x07\x04\xFB\x9A\xE4\x1A\xC6\xED\x45\x75\xE9\xB1\x5C\x53\xF3\xEB\x4D\x5B\x85\x87\x47\xF6\x83\x4A\x5C\xA0\x29\xE9\xB2\x29\xE3\x84\x25\x28\xFA\x8B\x50\x97\x00\x1D\x93\xB8\x6C\xAF\xAD\xE2\x80\xA1\xD4\x21\xAE\x8F\xD9\x67\xF1\x38\x23\x1A\x12\x07\x49\x89\x7C\x0A\xEA\x18\xBA\xCB\x11\xF8\xEC\x11\x8B\xA5\x9B\x2C\xC7\x3D\x75\x73\x62\x7A\x0B\x24\x00\x43\x1D\xD6\x8F\xCF\x13\xF1\x79\x16\x6E\xB6\xD7\x15\xDE\x3E\xDB\x6D\xB8\x0D\x97\x4A\xEC\x13\xBA\xF7\x2C\x7D\x7C\xDD\x95\xAD\x6E\x63\x88\x7E\xDA\x08\xCF\xA7\x6E\xC3\x27\x87\x43\x2C\x54\xE1\x16\x10\x85\x6E\xD5\xBB\x02\xCF\x10\xAF\x60\xBF\x9D\x39\x1F\x8A\xDF\x14\x6E\xE6\xE6\xD1\x9E\x63\xF9\x61\x8B\xAA\x23\xCE\xB2\x91\x96\xD1\xDE\xC2\x26\x4B\xD8\x04\x74\x79\x0B\x85\xEE\x49\xB3\x77\x7A\x17\x39\x99\xF0\xBE\x17\x17\x69\x3A\x07\x05\x13\x05\x9A\x06\xC9\x32\x19\x25\x74\x86\x30\x0B\xBF\xD9\xF3\xE6\x92\x82\xCE\xC5\x40\x68\x0E\x7D\xCC\x39\x9B\x50\x0D\x26\xF3\x32\x94\x84\xCD\x89\xC2\xBE\xA5\x5F\x9C\x54\x7A\xE9\x1F\xD1\x64\x19\xAE\x46\xC3\x8C\x1A\x0C\x33\x68\x1F\x5B\xA0\x88\x5B\x20\x01\x9A\xEC\x0B\x5C\x2B\x35\x6B\xE5\x9E\x47\xD9\x9E\x2A\x9B\xBC\x8A\xE0\xE7\xB1\xF5\x65\x9B\x91\x32\xA8\xED\xD3\x74\xF3\x6D\x53\x93\xD6\x36\x07\x68\x27\xE2\xAC\xF2\x6D\xC1\x51\x25\x65\x4D\xDC\xEB\xB9\x2F\xFA\x2E\xC7\x5D\xF4\x9F\x5A\x40\x98\x20\x3E\x20\xA0\x88\xC4\x66\xC1\x9E\xBE\xD1\x30\xAE\xB3\xCB\xFD\xEC\x2A\xFE\x94\x57\x25\x2B\x52\x02\x29\x66\x2E\x77\xB9\x57\xCD\x47\x83\x6A\x80\x1F\x62\xC4\xC3\xB0\x15\x91\x78\x5C\x30\xFD\x17\x44\xFF\x75\xA4\xFF\xCA\xCD\x58\xBF\x74\xA6\xF9\xAB\x98\x0F\x2E\x8C\x80\x3D\x91\xF3\x9E\x98\x3F\x8E\xD7\x83\xEA\x90\xCE\x57\x70\xEA\x51\xE2\x72\x46\xF5\xB7\xE2\x49\x49\x18\x1E\x2F\xEC\x89\x0D\xDA\x13\x0D\x8C\xFE\x91\xA6\x25\x1E\x70\xEE\xB0\x67\xEC\xB3\xDD\x09\x77\x22\xC6\x03\x42\x3E\x8E\x7B\xE2\x04\xF6\xC4\x9C\xDA\x3C\x11\x9E\xCF\xDC\x89\x61\x4F\xCC\x19\xA1\x93\xF6\xC4\xAD\x7A\x37\xC7\x33\x90\xC9\x69\x4F\xD0\x14\x6F\x48\xFA\x95\x9B\xB9\x8D\xD1\x9E\xA8\x79\x4F\xE4\xBC\x27\xE6\xAB\x7B\x02\x41\x44\xA7\x59\xF5\xC6\x54\x82\x72\x69\x87\x94\xC4\xD4\x0B\xDA\x21\x73\xAE\xBF\x5A\x20\x91\x10\xD6\xFC\x20\x7E\x0C\x9B\xE5\xDB\x33\x7D\xF2\xC8\x8B\x41\x7A\x38\x7D\x96\x36\x87\xD4\xE1\x9D\xC5\x92\xCF\x49\x57\x3B\xFD\x58\x37\x8F\xC2\x53\x1D\xC1\x7A\x00\x19\xE8\xD3\x4B\xE2\x11\x48\x88\xEB\x2E\xE6\x88\x5F\x30\x43\x2B\x24\xC2\x21\x8F\x3C\x21\x0A\x5C\x78\xBD\xBB\x35\x7E\x9A\x8B\x58\x4D\x1F\xC1\x9B\x16\x43\x9C\x7E\x42\x73\x58\x85\x8A\x98\xE2\xD1\x6E\x01\x9F\xD6\xB4\x33\x9A\xA2\xD2\xEB\xFD\xAE\x64\x73\x9D\x40\x89\xCD\x42\x78\x17\x9D\xAF\x0B\x64\xBC\xE4\x5C\x7B\xDD\x55\xFC\xF7\x12\x52\x31\xC0\x40\x17\xC8\xC4\x72\x8B\x36\x63\x7B\x22\xB2\xE7\x17\x6E\x76\x99\xE4\x09\xFA\xD5\x56\x2E\x6D\x4B\x97\xD0\x86\xA3\xEF\x06\xDF\xB9\x44\x61\x81\x92\x83\x58\x02\xEC\x1D\x97\xB9\xB4\x79\x27\x08\x7B\x83\x6F\xE0\xE3\x8E\x8D\x86\x89\x2B\xDA\x45\x28\x71\x9E\x35\x7F\x8F\xE3\xD4\xF8\x8D\xB5\xF4\x86\xB7\x4D\xED\x8A\x3D\xD4\x9E\xE6\x07\x4F\x84\x2D\x92\xF0\x16\x41\xF5\x92\x84\x89\x30\x71\x0D\xD1\x51\xE2\x4E\xEC\x00\x83\x7D\x83\xB7\x48\x32\x6C\x11\xAE\x26\xD6\x9D\xDC\xEB\x4E\xD1\x16\x81\xC1\x3F\x99\x1E\x1B\x34\xE2\x93\x7B\xDD\x82\xB6\xC8\x3D\xEE\x1E\x97\xC4\x2D\xB2\x18\x6D\x91\x7B\x30\xA9\x28\xAA\x72\xCF\x70\x6C\xDC\x33\x6C\x91\x45\xE5\x16\x6E\x13\x5B\xE4\x56\xBD\x5B\xE0\x99\xBE\xDD\xE0\xE5\x4D\xCC\x79\x77\x8A\x57\x6E\xE1\x4E\xBA\x53\xA3\x2D\xB2\xC1\x5B\x24\xE1\x2D\x82\xFD\x75\x92\xB6\xC8\xC9\xB0\x45\xE6\x34\xFF\x6D\xE1\xAA\x36\x77\x33\x6C\x8C\xB4\x62\x75\x2F\x09\x92\xFA\xE8\xD4\xF8\x45\xC3\x25\x75\x2C\xF3\x38\x0E\xB4\x7A\x0F\x47\x45\xE2\xCB\x55\x1A\x61\x08\xB6\x4B\x46\x85\xF1\x53\x89\xB5\x4B\x10\x21\x47\xF2\x9A\x6E\x73\x89\xC3\xB3\x2E\x69\x0B\x31\x69\x21\xC5\xFB\xB9\xAE\xF4\xF5\xD3\xDD\x4C\x4A\x4B\x68\x97\x5F\xED\x6A\x64\xE3\xCC\xFA\x6D\xE2\x14\x8F\xCD\x49\xE7\xF6\x0A\x89\x52\xDD\xCC\xD5\x5B\x1C\xC2\xE7\x4A\x1C\xDF\xAE\xDE\xEA\x0A\x09\xBC\xB3\x2E\x7B\x7C\x6E\x1C\x3B\x19\xD8\xF6\x60\xB9\x34\x4A\xCE\xA7\x58\xC5\x6A\x05\x49\xE5\xE6\xF2\x16\x4D\x05\x92\x7A\xD9\x9E\xCD\xD1\xBF\xFD\xC2\x6A\x3A\x3C\xFC\x91\x47\x71\xBE\xBF\x04\xFF\x31\xAA\x54\x3F\xE3\xF5\x3E\x1F\x83\x05\xFF\x4E\x67\xA0\xD7\xFB\x30\x3E\xC1\x1B\xE7\x72\x52\xAC\x49\x22\x64\xCE\x8F\x17\xD2\x94\x70\x48\xD2\xA3\xC0\xEE\xFF\x11\x1D\xC0\x14\xE2\x39\xA2\x79\x8E\x8D\xA7\x9D\x04\xB6\x53\x0A\x3A\xA2\x9C\x27\x74\x4B\x39\x3E\x4F\xF0\xC3\x10\x41\xE7\xAB\xCB\xD8\xA5\xF1\x7E\x0F\xCB\x38\xDF\x8F\xD8\xBF\x2A\x06\xDC\x6D\x54\xD3\x86\xA7\x37\x0E\xCB\xFC\x4D\x55\xF5\x5D\xB9\xCD\x8E\xF4\x35\xBD\x2A\x3D\x78\xC6\xDD\xD0\xFE\x7A\x21\xF9\xFE\x29\x2B\x6D\x22\x80\x42\x73\x83\x64\xF0\xCB\x30\x54\x24\x24\x26\xE8\xAE\xF0\xA7\x0F\xFD\xE9\x67\xBB\x72\xC7\x9C\xC1\x33\x05\x6A\x42\x7F\x52\xEE\x51\xF7\xD1\xF1\x74\xCE\x36\x38\x04\xAF\xF5\x5D\x2A\xA0\x16\xC8\xA4\x0E\xB6\xEA\xCC\xA5\x3E\xA1\xFF\x5F\xD9\x6A\x7E\x22\x10\x24\x30\x33\xE0\x18\xFA\x71\x36\xBF\xB3\x11\xEB\x0C\x0E\xB8\x4F\x80\x8B\x7F\xE9\xA6\x85\xDB\xE3\x4B\x37\xED\x8E\x39\x53\x23\x0C\x2C\x65\x4E\x78\x29\x5E\xCE\xE9\x2F\x89\xCB\xE3\x1A\x97\xC1\x8D\x79\xD4\xE3\xF0\x6A\x4B\x76\x93\xA3\x32\x60\x36\xBA\x81\x2B\x87\xD2\x0D\x2E\xBB\x38\xE7\x32\xF1\x17\xE6\xE7\x24\x0F\x1E\x72\x77\xE5\x66\x2F\x8A\xF6\x52\xFA\x2F\xAA\xDD\x10\xAD\xD5\xD3\x9C\x14\xE2\x4C\xE8\x52\x57\xEE\xD1\x80\x6B\x31\xCC\xFA\x2F\x29\xAF\x9A\x8F\xC1\xC1\x90\x21\x6E\x83\xFA\xCE\xC0\x22\xB6\xF9\x9F\x19\x81\x90\xC8\x7A\x76\x0E\x36\xA8\x44\x72\x33\x13\x54\xA7\xC3\xBD\xB2\x26\xA5\xA0\x9D\x8C\x7B\x5D\xED\x31\xC3\xE1\x1E\xC0\xA8\x18\xDA\xE4\xC8\xC8\x36\xA5\xFD\xA0\x5D\xE1\x3F\xA9\x76\xB7\xE8\x48\xE1\x28\x26\x12\x6E\xF3\x3D\x71\x84\xCA\x1E\xCA\x58\x2A\x84\xDC\xF7\x2B\xB2\xAE\x1C\x6B\xC6\x3C\x0E\xDB\x98\xDE\xE4\xD9\x76\xC4\x31\xF0\xC8\xE6\xFA\xFD\xBF\xFD\xED\x28\xDC\x57\xFA\xBF\x7E\xFD\xC6\x75\xB5\x3B\x4F\xBD\x45\x8E\x0D\xBE\x7A\xDB\x7C\xFF\xB7\xA1\x53\x29\xF1\x9D\x4F\xFE\xD0\xB7\x5F\x57\x9D\xF2\xEA\x51\x54\xE6\x58\xFA\xC9\xBA\x6C\xCE\xF5\x62\x27\x3F\x9B\xCA\x7F\xF2\x8B\xEF\xA0\x97\x84\xC8\xB8\xEC\x22\xDD\x0B\x70\x11\x0B\x0C\x16\x58\x4B\x8F\xFA\x4E\xB1\xF0\x37\xDC\x1F\x6D\x81\x5D\x3E\x42\x1C\x6E\x7E\x88\x53\xF0\x45\x4E\xBD\x84\x93\xAD\xDC\x05\xCA\x74\xE9\xB2\xD0\x65\x3A\x18\xA7\x8D\x57\x95\xAC\x13\xF1\xEC\xFB\x6C\x73\x8E\x38\x45\x9B\x32\x72\x52\xEA\x2A\xA7\x9B\x8F\xDD\x60\x3F\x40\x3A\x16\x55\x5C\x5A\xBD\xA2\x75\xBA\xEA\x30\x10\xA0\x17\x5E\x30\xC5\x09\xBE\x17\xDB\x84\xD8\xA1\x98\x65\x3D\x48\x63\xBC\x6B\x0C\xDC\x16\xB2\x65\x52\x76\x26\x65\xFE\xE6\xCD\xFF\x35\x44\x2B\xBB\x94\x11\x1F\xAC\x4B\xF7\x60\x17\x48\xA5\x4C\x74\x16\xF6\x89\x95\xD0\x04\x54\xB6\xA7\x51\x1E\x5D\x45\x38\x60\xE5\x34\x48\xDF\x33\x3E\x40\x24\xFF\xC1\xE4\xED\x92\xEA\xE7\x52\x9D\x1D\xA3\x9A\x18\xAF\x63\x44\x66\x1D\x84\x94\xD4\x1B\xC6\x36\x85\xF7\xC8\x11\x57\xF0\xD7\xFA\xD7\x68\x38\x4B\x95\xB3\xCD\x8F\xDD\x08\x61\x01\xAD\xE1\x60\x6D\xD4\xF0\xAD\x39\x1E\x5D\x4B\x7A\xBF\x46\x53\xC9\xD0\x54\xC3\x4D\xC1\x72\xC2\x46\xB4\xA1\xA9\x62\xDA\xD4\xE6\xE5\x10\xA3\x1C\x8E\x8C\xFD\xE0\xF1\xCE\x83\x7D\x5C\x82\xA3\xA2\x22\x93\x2E\x0D\xC3\xC4\x50\xFA\x30\x8C\x82\xBA\x5F\x78\xD3\xAF\x19\x86\x84\xD5\xC7\x61\x48\xE2\xC3\xDA\xC6\x30\x90\x62\x5B\x54\xEC\x35\x03\x19\x1A\xDB\x0C\x8D\x8D\x0E\xA2\xD4\xCF\xFC\x2C\x1E\x2B\x69\xF3\x3D\x2F\xB0\xDF\x26\x6D\xBE\x8B\x9D\x1D\x8C\x6C\x34\x72\x73\x89\x6B\xA4\x80\x74\x4C\x52\x72\xE1\x43\x55\x3C\x43\x9C\x9A\x06\xD4\x95\x8F\x4B\x34\x46\xE9\x8F\xFA\xD8\x23\x94\xA0\xCA\xE5\xE9\x0A\x37\xF3\x04\x70\x46\xB4\xC4\xA9\x0A\x0C\x4C\x3E\x1E\x3A\xCD\xF4\xE5\xB9\xE4\x4E\xC6\x17\x8F\x5E\x0A\x4E\xF7\xD8\x31\x2F\xDD\xE4\x97\x36\xF1\xA5\x1C\x79\x5B\x86\xD7\x16\xCB\xAF\x75\x25\xB6\xC4\x63\x02\x00\x8A\x2F\xA1\xC1\xF1\xD6\xAC\x3E\xA2\x11\x96\x3D\x60\xBD\x76\x6B\xF6\x9C\xA4\xC5\xF0\x9E\xB3\x03\xCC\xAB\x1C\x53\x4E\xF1\x01\x25\xCE\x35\x29\xD5\xAD\x05\xF4\xA8\xDF\x09\xA5\xDA\x12\x67\xC1\xB6\x2D\x42\x1F\xB0\x19\xC3\x6D\x72\x68\xF1\x6D\x7C\x68\x71\x4C\x3A\x9F\x45\x26\x6C\x46\x7F\x54\x7D\x4E\x4B\x08\x34\x0C\x2D\x38\x47\x61\xA0\x49\x86\x00\xDC\x8D\x58\x5B\xCE\x0E\xE7\x39\x10\x72\x39\x3E\xFD\x27\x58\x74\x80\x40\xB7\xE6\x60\x36\xE3\xE1\xD2\x46\x90\xBC\xF8\x30\x5C\x33\x19\x6E\x3A\x19\x6E\x3A\x1E\x6E\x8A\xE1\x12\x7F\xD9\x20\xD6\x79\x47\x23\x4E\x78\xC4\x49\x1C\xB1\xAA\x3E\x33\xD3\xC5\xBA\x38\xD6\xC1\xEE\x9C\x5E\x0C\x02\x4C\xC6\x03\x86\x4F\xDD\x5C\xD0\xCC\xCD\xD2\x61\x02\x63\x9F\xE1\x15\xBF\x50\xAC\xBB\x21\x7A\x05\x59\x94\xC9\x24\xD2\x0E\x96\x93\xF5\x82\x4C\x3D\x11\x64\x72\x16\x64\xEA\xAE\x88\x53\x26\x22\x4C\x1D\xC2\xA9\x73\xEE\x40\xC1\x73\x62\x06\xD1\xA5\x2B\x27\xC2\x4B\x37\x13\x2D\x47\x44\x97\x7C\x72\x83\xCB\xF7\x70\x03\x46\x90\x93\xE2\x3B\x2E\x08\xBF\xFC\x3F\x57\xF8\x27\xFA\xC5\x15\x13\x4C\x3D\x77\xFA\xAF\xA4\xFF\xCC\xE4\x4B\xA6\x94\xCA\x55\xA1\x2A\x95\x02\x37\xFE\xA6\xBA\x3A\xAF\x5C\xD1\xDC\xA0\x43\x93\x3E\xF9\x27\x7A\x3F\xBB\x32\x27\xE9\xB9\x60\xC0\x80\xB4\x9E\x57\xA4\xFA\xCF\x58\xC2\xF8\xBC\x06\xBC\xC2\x0C\xB7\xE2\xF4\x44\xF7\x67\xB0\xB6\x26\x1C\xB4\x91\x8B\xD0\x09\xBC\xB4\x3C\x3C\x02\x78\x71\x09\x4E\x84\x21\x1A\x62\x11\xC3\xAD\xD9\x43\x57\xF4\x68\x10\x46\x2E\x97\x30\xF4\xC4\xAD\x1A\xBA\xD6\x87\x66\x4C\xBF\xDC\x08\xAC\x91\x57\xE7\xB9\xD3\xB0\x7E\x62\x14\x25\x46\x01\xDE\x25\x4B\xEE\x4C\xF3\xE3\x7C\xE0\x5F\x9E\x17\xB2\xE8\xFE\x8B\x8A\xD3\xDC\xD7\xDD\x14\x0C\x01\x41\x9F\x4A\xF8\x0C\x7A\xA2\xEF\x52\x9A\x34\x4E\x06\xFB\x38\x91\xDE\xE2\xCF\xF3\x7C\xDB\x63\xFF\xC9\x75\x26\xE7\x94\xA3\x7E\xAE\xF0\x84\xBA\xDC\xFF\x08\xC7\xA4\xFA\x1F\x3A\xEA\x7D\x76\x65\x8B\x47\x54\x40\x77\x2D\x68\x64\x25\x08\xE8\xE2\xBC\xC4\x8C\xA2\x53\xAB\x1D\x7E\x6C\xAE\xEA\xAA\xA2\xE6\xBE\xA4\x2E\xCD\x73\x1A\x7E\x3E\x5E\xD7\xB2\x92\x56\xC2\xA4\x14\xCB\x93\x12\x46\xF8\xF1\x23\xCE\x1D\x1D\x8D\xD5\xCD\xC2\x18\xF3\x63\xFF\xC9\xF5\x8A\xA7\xAA\xE8\x88\x64\x3A\xCB\x8F\x17\xD4\xE8\x97\xD5\x44\x9C\xE3\xD9\x9D\xCD\x97\x4F\x0E\x5B\x56\xE9\xE4\x39\xBC\x92\x9F\x2D\xE8\x59\xCB\x9A\x25\x3F\x5B\xC4\x67\x2D\xA2\xD4\x9C\xEA\xC3\x3C\x01\xDB\x61\x16\xBE\xE5\xF4\x6D\x1E\xBE\x01\x0B\xA1\x0C\xDF\x50\x8D\x2B\x0F\xDF\x50\x6E\xA9\x0E\xDF\x90\xC6\x5F\x85\x6F\x28\x35\x17\xF0\xFD\x55\xAB\x5C\xAC\x85\x88\x45\x20\xB5\x06\x54\x08\xE9\x34\x88\x75\x23\x3E\x37\x89\x8C\x4D\xAB\x7F\x5A\x59\x7D\xA4\xAF\x35\xAB\x7C\xD6\x25\x8C\xED\x97\x4A\x89\x0E\x9A\xC8\x0B\x74\xA5\x79\x23\x89\x1F\x2F\xD2\x9E\xFE\xE7\xCC\x70\x6D\x60\xB8\xD9\xA0\x3D\x8D\x53\x8E\x72\xBF\xC9\x7C\x6E\x94\x64\x55\xC4\xAB\x65\xB4\x21\x17\x7E\x33\x40\xF4\xF0\x31\x96\x45\xCE\xC8\xE7\x05\x97\x25\xA8\x91\x32\x6E\xCE\xBB\x1A\x1B\xAE\x16\x03\x27\xFD\x19\x2B\x33\xDA\x55\xA4\x98\xC2\xB2\x0F\x24\x53\x59\x97\x39\xF7\x25\x4A\x52\xB3\x91\x24\xC5\xB1\x23\xB5\x54\xF2\x64\x26\x9F\x1C\xB4\x0B\x52\x4E\x5E\xFE\xCD\x1B\xD7\x55\xBB\x41\x1F\x7F\xED\x77\xE9\x63\xE3\x35\xDB\x4C\x20\x93\x08\x0E\xCD\x84\xF3\x66\x2C\x72\xA2\x00\x8E\xFF\x17\x2A\x66\x6A\x65\xFC\x53\x57\xF9\xB3\x97\x0E\x86\xFC\x40\x38\x80\xF6\xA1\x03\xD4\x7C\xBA\x96\x67\x95\xC6\x83\xA3\x7A\x4D\x25\xCB\x85\x70\xF4\x94\x9E\xD4\xB4\xE9\xA9\xE4\x32\x39\x8F\xCA\x10\x1D\x92\x2D\x9F\x47\x38\xED\x4A\x3A\x8B\x34\xAB\x07\x97\xD8\x74\x33\x67\xE2\xD1\x80\x24\x34\x74\x8B\xBA\x3C\xAF\xA3\xFA\x03\xB9\xAB\x94\x60\x91\x8A\xA3\xE6\x0A\x09\x8B\x05\xA2\x10\x3A\x6E\xAF\x74\x27\x30\xE8\x7F\x8E\x65\xC0\x10\x1E\xBE\xC4\x21\x0E\x97\xF1\x27\xB9\xCC\x15\x1A\x36\xDB\x93\x4C\xC5\xA7\x5C\xED\xCA\xDE\x5F\xEB\xDB\x4D\x9F\x88\xF3\xB2\x74\x59\xDF\x11\xB7\xA6\x59\xC1\xF3\xC4\xB1\xE8\x0B\xCD\x07\x8A\x51\xB1\x84\x4C\xCF\xB9\xCD\x37\x40\x6D\x38\x31\xA7\x55\x27\xC1\x47\xF3\x8B\xDD\x81\xFF\x1C\xBE\xB1\x7A\x8C\xB7\x3A\xDB\xFC\x4F\x44\x83\x0B\x93\xCF\x74\xE5\x10\x4D\x97\x90\x36\x6C\xFD\xCB\xBF\x45\x0B\x5B\xB9\xA6\xDD\x14\x35\x12\xB6\x2E\xB6\xA2\xDF\x03\x2B\xBA\xA8\x91\xF7\x10\x67\xB9\x87\xD5\xC8\x13\xA4\x46\xE6\xF4\x67\x50\x23\xF3\xCA\x55\xA4\x46\x56\x6E\x93\x16\x6A\x73\xAE\xEA\xB4\x8A\xE1\xCC\x33\x7F\x5D\xF2\x38\x89\xAA\x4F\xB0\x25\x06\x74\x54\x0D\x92\xDB\x86\xA4\xC5\xFE\xBF\x37\x80\xEB\xB6\x21\x31\x35\xA5\x28\xC3\xCA\x65\xDC\x17\xF6\x0B\x66\xAE\xDA\xA5\x61\xBC\x46\x29\x57\xBD\x46\xA9\x5D\xE0\x2E\x52\x17\x4A\x71\x0A\xB2\x61\xFA\x82\x3A\x67\x43\x6D\x5C\x18\x91\x92\x60\x48\xF8\x87\x6C\x48\x28\x42\x98\x5D\xD2\x95\xA3\x8E\x41\xC2\x3A\x7B\x89\x33\xC1\x98\x28\x51\x62\x22\x0A\x74\xA5\x18\x5D\xE8\xF3\x62\xA9\xCD\x19\x4A\x2B\x74\xA5\xD0\xE3\x63\xD0\x46\x13\x01\xE3\x82\xF5\x8F\x3D\x70\xD6\x69\x57\xEF\xED\x98\xA2\x9E\x91\x50\x90\x08\x16\x61\xE2\xCA\x96\x2B\xCD\x6C\xBA\xCC\x95\xBC\x81\x93\x03\x96\xEB\xC1\x3C\x31\x44\xC8\x92\x6D\x86\xBE\x48\x7C\x08\x23\x11\xD2\x83\xAC\x21\x91\xCA\x4E\x7C\x16\xBC\xD9\x9D\x10\x61\x00\x41\x32\x18\x06\x5E\x51\x86\xD2\x6B\x6E\xC6\x9A\x7D\x6D\xAB\x11\x69\x9C\xB0\x42\x16\x9B\x17\xE7\xC6\x6D\xC2\x22\x61\xC2\x6A\x9F\xA0\xA9\x3E\x31\x47\x7A\x74\x56\x49\x88\x38\x6F\x95\x68\xEE\x41\xDD\xFC\x5A\x4C\x50\xDA\x21\xD7\xEB\xA4\x93\x7A\xA3\xA7\xF8\x95\x78\x9E\x57\x21\x80\xDC\xA6\x6C\x31\x4A\xC1\xC5\x0B\xF1\xDD\xE2\x2D\x23\x96\x9E\x55\xBF\x92\x83\xA5\x97\x6B\xEC\x0E\x86\x59\xBA\x1D\x58\x7A\xD0\x68\x12\xC6\xF5\xBC\xE0\xDE\xF9\x62\x97\xF2\xAA\xDB\x17\x79\xCD\xB7\xE3\x9A\xBF\x2E\x86\xAC\xA2\x4C\x4D\x3C\x66\x5C\x4A\x8C\x36\x27\x59\xCB\x80\xD1\x86\x72\x49\x39\xF2\x0C\xD8\x75\xCF\x96\xC3\xEC\xAC\xB2\xFE\x2F\x48\x18\x32\x9D\x15\x7F\xD1\x1B\xB1\x96\x71\x96\x13\x4E\x2B\x6C\xD6\x7A\xB0\x96\x49\x8E\xEC\x82\x45\x60\xCD\xFA\x0E\x8E\x42\xB8\x0A\x51\x03\xE4\x1A\xDE\x9A\x20\xF6\x42\x6C\x90\x7C\xF2\x4D\xDA\xD2\x40\xA6\x00\xFA\xC6\x35\x76\x63\x65\xAE\x68\x7E\x6A\x9C\x7C\xA7\xD8\x77\x15\x5E\x07\x4F\x4F\x28\x3B\xE3\x4C\xF3\x23\x37\xC2\x41\x41\xA7\xAF\xE6\xC2\x95\xE9\x48\xFB\x51\x2E\xDD\x13\x52\x4C\x59\xED\xC8\x39\xDA\x1C\x52\x20\xE7\x83\xD5\xB1\x82\x1E\x72\x42\xE9\xFF\x53\x4D\xAC\x08\xC6\x51\x56\xC2\xEA\x60\xE9\x61\x13\x28\x91\xBB\x68\x55\x06\xD8\x26\x61\xF2\x59\x17\x96\x38\xC8\x6A\x38\xFE\xAB\x78\x2C\x27\xD8\x01\x2E\xDB\x8B\x8F\x10\x9F\x2D\x60\xE5\x43\xA0\x8B\xBA\x3C\xB7\xC7\x6A\x13\xAE\xF6\x1F\x3A\xEA\x17\x7F\x2E\x99\xAF\xFE\xD3\xF3\xF9\xDC\xE0\x93\x55\x95\xAB\xFD\x7F\xD9\x2F\x4E\x16\x75\x5D\x27\xF5\xE8\x5F\xCE\x38\x6A\xFB\x17\x11\xF3\x4E\xF2\x40\x9B\xD4\x05\x43\x9B\x31\x47\x4C\x7C\x73\x80\xDF\x5C\xE2\xFF\x0D\xAE\xC3\x4F\x96\x4C\xEF\xF9\x03\x7E\x32\x87\xF1\xE6\x40\xEE\xB1\xD3\x7B\x3E\xCE\xF7\x60\x7F\xBC\xAC\xC2\x4D\x86\x3B\x00\x43\x04\xB0\x26\x5D\x7A\x71\x9E\x32\x7E\xD8\xCC\x25\x5E\x1F\xB4\x09\x62\xC6\x69\xD3\xAF\x4D\x30\x41\xEC\x40\x03\x5B\x4B\xCC\x52\x47\x10\x7D\xE9\x8F\x9E\x39\xC0\xEB\x2D\x67\xC3\x40\xFB\xBE\xCF\x92\xB6\x59\x27\xC0\xCE\xA4\x97\x54\x9C\xC0\x18\xA8\xBA\x16\xAA\x86\x35\x99\x29\xAF\xE8\x5D\x01\x2D\x5A\x6C\x8A\x66\x2C\xB2\xDD\xD0\x82\x09\xE0\xB4\xE0\x6A\x41\xF6\x31\x5E\x47\xB4\x04\xC5\xE8\x80\x5D\x42\x5A\x19\xC9\x1E\x90\x9C\x13\x48\xAA\xF4\xF5\x9B\xF8\x2B\x7D\xFC\x55\x36\x6C\x43\xC2\xA5\xEF\x7F\xE6\x91\xB9\x54\x33\xEE\x8C\xD3\x57\x5A\xA4\x8B\x4B\xC1\x20\xAF\x9F\x69\xF9\xE2\x7E\xF5\xDB\x67\xAC\x3D\xD2\xD7\x8A\x31\x4C\x6B\x8C\x84\xF5\x0F\xF5\xBE\xE8\xF9\xA4\x41\x04\xEC\x43\x31\x3A\xD6\xDF\xD4\x6C\x95\xD1\xDE\xED\x77\xC9\xD6\x8E\x79\x80\x6F\xD9\x76\x70\xF7\xF8\x87\x7A\x67\xB6\x68\x22\xEE\x25\x59\x9A\xD8\x55\x76\xCE\x9C\x21\x46\x7A\xCE\x36\x2E\x23\x0E\xD5\x2A\x97\xBD\xC8\xEA\xF6\x28\x99\xA7\x4B\x38\x7A\x2A\x9A\x10\x5C\xE2\xD5\x6B\x35\x02\xA4\x05\x1F\xF9\xAC\x52\x62\x32\xF1\xAF\xA8\x3E\xFC\xB7\xF9\x87\xB4\xD5\x9A\xBF\xC3\x88\x64\x16\xD0\xB0\x57\x60\xB7\x47\x8C\x2E\x82\x64\x1D\x80\x06\x6F\xFB\x30\x54\x79\x04\x11\x6E\x5E\x91\xB0\x61\xC4\xD7\x3F\x84\x40\x48\xB3\xC5\x58\x57\x58\x77\x36\xBE\x2B\xAE\xC6\x1D\xEA\xAE\xC5\xE0\xBC\x21\xCF\x21\x18\x9E\x51\x8B\x9A\x16\x55\x79\xFD\x1C\x50\x25\xBA\x7C\xAB\x43\x7C\xBB\x65\x57\x34\xD0\x78\xF2\x2D\xDA\xD8\xCD\x20\x2E\x6A\x6F\xF6\xE5\x5D\x52\xA2\xD1\x13\x89\x8D\xF8\x8D\x41\x5C\x36\x46\xB3\x6D\x1A\x61\x3C\x18\xC4\xE5\x2E\x17\xC6\x63\xF9\xB4\x60\xF3\x85\x78\x5E\x52\x99\x1B\x9C\xB5\x0D\x7F\xD9\xC4\x31\xBC\xC9\x39\x51\x32\x71\xC3\x45\xA7\xF6\x50\xE9\x8E\x98\x4C\x5A\x21\x16\xDA\xE5\xCD\x0F\xDE\x88\x13\xCF\x61\xFB\xFC\xDC\xB4\x9B\x1C\x9C\xC6\xE1\xD3\x1F\x16\x60\x18\xC6\xD7\xB8\xC8\xDE\x4D\x16\xCF\x8B\x81\xCF\xFA\x3C\xE4\xAA\x7D\xB9\xFF\x73\xF9\xFD\x4A\xF9\x6F\xEE\x17\xFF\x55\xAA\x94\xD2\x76\x56\xB0\x01\x64\xD5\x3C\x72\xCC\xBF\xBC\x56\xC9\xAD\x4C\x2B\x95\xC1\xD2\xAE\xAC\x44\x7D\xDB\x75\xA8\xD7\xAC\xC3\xE2\x2B\x5A\x87\x3F\xBB\xB4\x0E\x35\x70\xC7\xED\xB6\x39\x3D\xC8\x05\x4A\xD2\x47\x21\x04\xF0\x21\x0D\x1D\x81\x9F\xB4\xBE\xE9\x9B\x7F\x84\x23\xF4\x74\xFD\x67\x43\x41\x9F\xEB\x40\xC0\x1E\x71\xD0\x44\xD8\xA7\x62\xF6\x89\x47\x43\x5A\x18\xFB\xDF\xD4\x39\x7B\x39\x34\xF9\x8A\xEA\xE5\xA8\xAD\x96\x86\xC7\x83\x6B\x55\xBD\x29\xE4\x20\x39\x25\xC7\xDC\x75\x4A\xEE\x7A\x89\x05\x80\x63\xEF\x3B\x89\xE0\xD7\xD3\x34\xE1\xFE\x74\x1F\xFB\x7D\xD2\x2F\x9C\xF2\xCD\xFE\x96\x9B\x26\xB2\x1D\xD7\xCC\x89\x2A\x84\xFE\x9C\xEE\xE8\x39\xE6\x3C\xCA\x5F\x7F\x59\x1D\x20\xBB\x76\xDA\xFC\x29\x97\x2F\x37\xAB\x76\xCC\x69\xCC\xC7\xF8\xBE\x0D\xB7\x9C\xD7\x77\xCC\xFB\x1B\x19\xEE\xFB\x6E\xD9\xCB\x8D\x6A\x58\x3A\xA1\xB9\xB4\xF9\x49\x9E\xA1\x57\xC9\xA5\x6D\x73\x39\xAC\x4E\x53\xF9\x02\xE8\x0E\xBE\x64\x3C\x36\x7B\x9F\x6D\xBA\x0C\xCB\xE5\x72\x31\xC7\x35\x18\xE7\x51\xDF\xE9\x1D\xB3\x29\x28\xE4\xF6\xAC\xFA\x33\xCC\x7F\xE4\x07\xC4\x51\x43\xC7\x79\xDD\x25\x99\x99\x6B\x3D\xF3\x30\x88\x6D\x15\xA3\x30\xD7\x15\x23\xC2\x19\xAE\xEE\xF1\x50\xEF\x93\x03\x67\xB6\x58\x54\x4E\x3D\x1B\xFF\x5C\x05\x54\xF2\x02\x84\xE0\xB2\x17\xE9\xC5\x97\x51\xD3\x50\xEF\x91\xD6\xF0\x28\x0F\x24\x30\xEC\xBA\xF9\x61\xD0\xE8\x02\x24\x31\x1A\x02\xCE\x94\xAE\xBA\x38\x2F\xD0\x08\x75\xEE\x8B\xEA\xD2\xBC\x70\xB0\x36\x90\x46\xE4\xF4\x59\xA5\xD9\x60\x97\xF8\xF2\x11\x18\xFD\xC2\x9E\x60\xC3\xA2\x3E\xAB\x8C\x98\x40\xCB\x0A\x86\x07\x20\xB1\x23\xE2\xD5\x02\xEA\xE9\x7F\xF9\xC5\xD7\x5C\x9D\x97\x6E\xEE\xD4\xEE\xBC\x04\x52\x10\x82\xA9\x66\x4F\x3B\x14\x17\x67\xAF\x1C\x40\xD4\x89\xC9\xD7\xFC\x2E\x3A\xB7\x19\x56\x08\xF1\x24\xB5\xBF\x9F\x4F\x6B\x8D\x4C\x08\x7F\xF4\x0C\xF2\x0E\x5C\xDE\x2A\x12\x85\x68\xE8\x6A\x8F\x24\xE1\x0A\xA3\x67\x5C\xF3\x05\xCD\x0A\x5E\x5B\xF8\x2F\xA9\xB6\xF6\x47\x2D\x83\xB5\xD1\x40\xBF\xA4\x76\xE7\x59\x3C\xD1\xEA\xBE\x79\x59\x94\x40\x5A\xFF\x47\x79\x52\xC0\x80\x16\x67\x95\x6A\xEB\x3A\x1F\x91\x77\xE2\xAF\x9B\x81\x3D\x68\x8E\x1B\x80\xCA\xFD\x19\xC8\xFA\x13\x02\x6E\xFC\x09\xA7\xFD\x67\xD4\xEE\x56\x60\x04\x4B\x1B\xC9\x0C\x24\x7A\x8D\x48\xB4\x8A\x8C\x64\xC4\x83\xCC\xC0\xA2\xF9\x65\x1F\x3F\xEA\x17\x27\x54\x6A\xD2\xF1\x3F\xBB\xBC\x7B\x4E\xDE\xE1\x3B\x37\x2A\xA7\xFD\x17\xD4\xA5\xB9\x5D\xDE\xA5\x77\xF6\xFC\x42\xDE\x3B\x6F\x7E\xE8\x96\xF7\xCD\x2B\xA1\x7C\xEC\x15\xA1\xFD\x1D\xD3\xC4\xC0\x49\xBD\x30\xA5\xE6\x70\xFC\x66\x08\xCE\xE0\x29\xF6\x3F\x8D\x8F\xD6\x69\x6A\x40\x4D\x1A\xC0\xF6\x47\x0C\x24\x30\xF3\x7C\x42\xFF\x1F\xCE\x97\xF4\xB6\xE7\x4B\xBA\xE6\x7C\xC9\xBF\xA2\xF3\xE5\x55\xEB\xCE\xF9\x56\x87\xCC\xB6\x40\x38\x08\xBC\x21\xDA\x21\x21\xF4\x73\x6A\x04\x24\xD5\x69\xBF\x29\xBA\x82\xD8\x0E\x87\x4B\xB9\xD8\x0E\x13\x64\xA3\xB9\x3C\x04\x9E\x30\x5F\xDB\x36\xA7\x5D\xE2\x52\xB1\xF6\x58\x95\x21\x29\x68\x72\xEE\xCC\x49\xD6\x62\x64\xB2\x40\xD6\x65\xB0\xCD\x40\x20\x99\x89\x32\x8C\x6C\xC4\xC1\x36\x53\x8C\x6D\x33\xCA\x15\x6D\x32\x64\x5C\x08\xBA\xC2\xC8\x36\x93\x3B\x4D\xD3\x98\xBF\x46\x29\xA7\x61\x9B\xC9\x2B\x2E\xE9\x8B\x80\xB7\xBE\x4B\x44\xC0\x1E\xB8\x31\xBD\xF1\x01\xF6\xD8\x5D\x9C\x9F\x18\xB1\x64\x39\xA5\x21\x5B\x4E\x98\xA3\xA4\x10\xC0\x88\xC7\xC0\x71\x45\xDD\xDC\xD1\x5D\x44\xF6\x6D\x09\x04\x78\x49\x91\x03\x81\xCE\x22\x6B\xD6\x4C\x5D\x23\xA0\xB1\x72\xBC\x1E\x79\x5C\x8F\x44\xD6\x43\x03\x6A\x22\xA8\x40\x9C\x7F\x02\xAF\xE8\xB6\x39\xCD\xF6\x8D\x40\x14\xB2\x0E\x30\x95\xA8\x1D\x53\x93\xE6\x48\x24\xF0\x25\x31\x2D\xD3\x76\xFA\xA2\x8A\xB4\x73\x2C\x21\x22\x29\xB5\xC2\x17\xE2\x7C\x0B\xDC\x73\x99\xF9\xFC\xE5\x8E\x75\x87\x17\x11\x3A\xA9\x96\xCF\x25\xC4\x58\xE2\x0C\xA8\x03\x3A\x57\x38\x9D\xD8\xAA\xB4\x49\xAA\x40\x04\x87\x04\x44\xD9\x1D\x9C\x4E\x89\x9C\x4E\xA5\x64\xD3\xA0\x05\x39\x9A\x12\x19\x3E\xB2\x8E\x68\xE4\xCD\xDF\xC5\xD9\x64\x49\xEF\xC5\x44\x6C\x56\x23\x43\x6C\xF8\xC8\x90\x6C\x80\x86\x0B\x72\x72\x9B\x3B\x2D\x05\x96\x27\xB2\xB1\xB9\x93\x95\x47\xC3\x42\xF8\xDB\xA0\x5B\x3A\xAB\x3A\xC5\xEE\x7E\x15\x12\xB6\xA1\xA4\xBC\x2A\xA4\x8D\x86\x4C\xD3\x80\xCA\x24\xEA\xF6\x48\x7B\x49\x06\x35\x86\xA3\xA7\x03\x60\x8F\xDD\x36\xAF\xBF\x53\xCD\xC7\x8E\x80\x85\x75\xF5\x8A\xD6\xD9\x91\x67\x50\x37\x4E\x39\x8A\xAE\x5F\x41\x53\x7B\xA2\xA7\x93\x99\xFD\x36\x02\xA0\x81\x93\x39\x21\x96\xC9\x27\x33\xF4\x64\x40\x81\xD2\xE9\x9A\xE3\x7E\x3E\x4C\x53\x09\x8E\x19\x05\x69\x64\x72\x64\x9B\xA1\x62\x13\xAC\x3C\xB9\xCB\xFC\xEC\xE9\xBE\xCD\x10\xAE\x13\x82\x6A\x52\x3A\x1E\x73\x04\x9F\xC0\x27\x8B\xF6\x67\x57\x46\x25\xD2\x81\x2E\xED\x4C\x75\x4A\x39\x25\xD8\x4D\x71\xB0\x09\x0D\x91\x34\x06\xFA\x64\xE8\x3F\xB6\x7A\x67\x3D\xC9\x32\xD5\x53\x8C\xAF\x98\x59\xEE\x3F\xA8\xAF\x08\xBA\xDD\x2F\x5C\xC3\xB6\x60\x9C\x8F\x90\x1D\x64\x02\xA2\xC7\xB4\x62\x98\x58\xE0\x24\x86\xED\x0D\x73\x06\xE0\x48\xA7\x65\xE5\x32\xB6\x90\xA1\x8C\x57\xC2\xCA\xA3\x71\xC9\x04\x9D\x17\x46\x31\x98\xC0\x12\x4E\x16\x32\x08\xB3\x93\x08\x5D\x80\xE5\xA0\x7A\x18\xA9\xA5\xA1\x3C\x0A\x2C\x74\x43\xF5\x30\x60\xB6\x96\x78\x4B\x3B\x83\x3D\xEC\x6D\xFB\x7D\x57\x41\xE0\x99\x85\x1C\xB7\x99\x7F\x5B\xDF\xD5\x43\xD9\xB0\x9C\xC4\x48\xA4\x02\x79\xE5\xF2\xBD\x36\xA1\x6F\x88\x88\x36\x31\xA5\x0A\x21\x39\x00\x54\x62\xE4\xDF\x2E\x73\xC9\xE3\xED\xDC\x65\x6D\xE2\xE6\x0C\x8B\xEC\x66\x08\xA9\x0D\x85\xC3\x86\xA7\xF3\x51\xED\x1B\xFE\x3E\x54\xC7\xE1\xEF\x43\x21\x1C\xFE\xDE\xF4\x30\xD3\xC4\xEF\x9B\x7D\xC8\xBE\xE7\xEF\xA7\xE9\xFB\xE9\xE1\xFB\x19\xFA\x7E\x66\x48\x00\x73\xDC\x5B\xD7\x77\x39\xA7\x7D\x55\x9C\x73\x55\xB3\x29\x69\x94\x88\x85\x3C\x13\x41\x9E\x19\x95\x95\x4B\x10\x13\xBD\xB3\x54\x53\x8E\x0D\x67\x58\x79\x60\xEE\xA0\x40\x5C\x28\x1B\x87\xB4\x3C\xC5\x58\x34\x8F\x73\xAC\xB9\xCB\x39\xCC\xF5\x73\x7F\x8E\x97\x87\xDF\xAC\x7D\xD1\x37\xFF\x7B\xB4\xB6\xAF\xBB\xFA\x4A\x80\x3C\xBA\x4B\x7C\x77\x89\x6F\x20\x3E\xA7\x21\x6F\xF9\xBA\xE7\x37\x61\x41\xCC\xD6\x50\x2C\x89\xE3\x9A\xCD\x61\x97\x07\xD0\x4D\x7A\x9F\xD4\xF5\x3E\xE4\xF3\x16\x5F\xF3\x9E\xB1\x1C\x12\xEA\xD6\x98\x04\x39\x68\x11\xC9\xD1\xCD\xCF\x0C\xE8\x11\x01\x61\x08\x11\x3F\xC0\xF3\x42\xC1\x25\x4C\xE5\xDB\xFA\xCE\x34\xFF\x84\xA3\xED\xC2\x4D\xB5\x19\x27\x3F\xC2\xB1\x50\xB1\xB7\xA1\x3E\x17\xF2\x2D\x13\x89\x67\x14\xFF\x7B\x8D\x74\x4C\xBD\x6D\x36\xD1\x27\x9E\x2A\xB0\x7B\xEA\x68\x2E\x3D\xE7\x43\x34\x77\x5C\xC9\xCD\xE5\xF4\x71\x19\xE9\xA8\xA9\x96\x70\x9A\xF5\x10\xAB\x76\xB7\x38\xE8\xDD\xE2\xA0\x77\x8B\x83\xDE\x2D\x0E\x7A\xB7\x9A\xF0\x5D\x86\x71\x97\x61\xDC\x65\x18\x5F\x7D\x86\xE1\x11\x5A\x2E\xF6\x2B\x46\xC6\xA3\x2D\xF6\x8E\x97\x86\x8A\x42\x08\xB9\x29\xF6\x79\xE7\x33\x42\x24\x0C\x43\xC9\xE1\xC1\x8E\x51\xD5\x7F\xBD\xD2\x42\x7A\x5C\x0B\x29\xA4\xAA\x87\x55\xE2\x14\xAA\x7F\x78\xBD\xFF\x5A\xAD\x9C\xF2\x69\xEF\x18\xC9\xC9\x61\x85\x0E\x0F\xBC\x41\xDB\xAF\xFF\x32\x7B\xA7\x43\xEF\x0C\x1A\xB1\x5F\x8D\x46\x12\x34\xF2\x17\x97\x1A\x49\xD9\xF9\xBE\xD2\xC8\xF3\xFB\x3E\x3D\x60\xF5\x44\x0F\xB5\x38\xAA\x07\x54\x7C\x94\xC6\xBE\x63\xD4\xC6\xD2\xC3\xF1\xF1\x0C\xEF\x3B\x3B\x79\x20\x3F\xF6\x81\x1C\x77\xFF\x65\x01\xC1\x52\x00\x70\xB2\x05\xFF\xF9\x9C\xE1\x5F\xEF\x75\xEA\xC2\xD1\x39\x73\x86\x7F\xBD\x0C\x93\x1C\xA3\x51\x0A\xB2\x93\x05\xCE\x7E\x1F\x20\xBF\x3E\xA9\xE2\x8F\xBF\x34\x7C\xFC\xB5\xE1\xE3\x67\xE3\xC7\xEA\xAF\x00\xDC\x8D\xFA\xF2\x74\xF3\x6D\x37\x62\xC7\xDE\x1C\xBE\x6C\x9B\x27\x5B\xCD\xDD\x78\x32\x38\x81\x06\x08\x9D\x6D\xF3\x44\xB8\xFA\xC4\xBA\xAB\x97\xC3\xD5\xCB\xAB\x57\xAB\x77\x94\xBA\x5C\x6F\x26\x71\xD3\xA2\xAC\x8A\xB5\x0C\x3B\xA9\x84\x3A\x2A\x83\x5A\xBB\x70\x29\x65\x9D\x45\x2E\xA5\x10\xE6\xBD\x40\x76\xF3\x81\x3A\x97\x09\xE2\xBC\x69\xA4\x4C\x8D\x6A\xCE\xC9\x25\x4E\x60\xE1\xC4\xA1\x8B\x73\x6D\x05\x8F\x25\x11\x40\x9F\xC3\xBE\x03\x50\x52\x41\x27\x9E\xD4\xB8\xB0\x7E\x03\x01\xCA\xAE\xF0\x1B\xFB\x28\x93\xCB\xA9\x81\xD6\xEB\xE7\xFC\xE7\x6F\xDE\xBC\x99\xEF\xF7\xB1\xCE\x68\x86\x92\x86\x7C\xAF\xB3\xFE\xAD\xFB\x07\x5C\x58\x97\x2B\xBB\x85\x5E\x59\x9F\x3C\x17\x3A\x96\x73\x61\x39\x29\x00\x24\x31\x58\x19\xAC\xA0\xAF\xBC\x67\x54\x90\x11\x6A\x6B\x88\x10\xCB\xA3\xB5\x0D\x40\x49\x09\x47\x9B\xD0\xE6\xE1\x52\x40\x34\x92\xA1\x4F\x97\x50\xA2\x32\x54\x98\x7B\x5C\xD0\x12\xAC\x64\x51\x9C\x55\x6A\xF5\x7D\x0C\xF5\x44\x8C\xEA\xE2\xA8\xDB\xB1\x88\x67\x8A\x22\xBD\x52\x40\x06\x93\x19\xAA\xC1\x11\x77\xAF\xF5\xA0\xB3\xF1\x22\x0D\x46\x42\x29\x02\xBC\xD4\xA2\xE4\x15\x71\x88\x63\x01\xC0\x8C\x54\xA2\x68\x22\x68\x0E\x43\x58\x15\x58\xA4\x84\x07\x37\x9E\x53\x33\x9A\xD3\xE4\x0E\xE7\x14\xF1\x8F\x66\xD4\x9F\x40\x2E\x55\x88\xD2\xE5\xE7\x79\xF6\x52\xA6\x15\xCE\x3A\x5A\xD3\x1E\xAF\x85\xE5\x66\x05\xE4\x93\x33\x19\x18\x75\x88\x57\xC3\x5C\x92\xF6\x80\x5B\xE1\xD2\xB3\x2A\xE1\x5A\x33\xFD\x59\xA5\xFD\x4D\xF8\x78\x4A\x4E\x98\x44\x46\x90\xAC\x64\x2A\x35\x05\x13\x65\xAC\x32\x58\x81\xE7\xDA\x94\xCB\x43\x32\xA1\xC6\x1B\x12\xA3\xA4\x3E\xD7\x84\x40\x5B\x53\xCB\x49\x8A\x1E\xD9\x71\x8F\x74\xEC\x91\x76\x96\x7A\x04\x1A\x8D\x3D\xD2\x21\xEE\x93\xB8\x20\x60\x76\x2B\xA9\x9A\xC0\x24\xC0\xFB\x89\xD1\xB3\x99\x08\xD6\xD6\xC9\x0B\x1B\x4F\x96\x86\x3E\x9F\xF6\xCA\xA5\xEB\x2A\xE5\x6D\xB6\x69\x35\x14\xE3\x1B\xDB\x36\x2A\xCE\x7C\x33\x82\x36\x19\x61\x5B\xD7\x28\xE9\x37\x8D\x4E\x8E\xA6\xD6\x59\xAE\x93\xD2\xD9\x41\xF0\x4E\x38\x21\x3F\xE9\x5B\x3A\x3B\x92\xDA\x54\x7E\xA3\x4D\xD8\x4A\x82\xD8\xE6\x2E\xF5\xB3\x5D\x92\x5B\x70\x7F\xDF\xA1\xC0\x0B\xCB\x67\x8E\x0B\x68\x78\x73\xE0\x12\xA9\x83\xB1\xBB\x05\x6F\x3C\x02\xC6\x81\xD1\xAB\x91\xA3\xFD\xF1\x71\x94\x97\x96\x08\x2F\x1D\x42\xC1\xCA\x47\xE6\x00\xB0\x40\x94\x9D\xE1\xFC\x88\x95\xA7\x52\x79\x2A\x8D\x4F\xF1\xCB\x67\xFC\x90\x4B\xFC\x37\x1D\x30\x2B\xD0\x2D\x2C\xDB\x08\x34\xE2\x21\xD8\xD5\xE6\x2C\x35\xE7\xEC\x10\x8D\x76\x20\x95\x16\x6F\xD5\xE9\xA1\xCB\x74\x3F\x27\x2E\xD0\xD8\x8D\x53\xCF\x6C\x49\xA5\x8F\x43\x7F\xF4\x8C\x77\xFB\x2E\x39\xA8\xBE\xD7\xEA\xEC\x88\xBB\x41\xF4\xF0\xCF\x3E\x34\x2D\x65\xCD\xBF\xFE\xEA\xF4\x57\xED\xAF\x9B\xCB\x73\xE5\x7F\xED\x83\x4B\x37\xF3\xCF\xBF\x33\xFD\x99\x71\x01\xFC\x0B\x1F\x98\x16\xEE\xE5\x40\x3C\x27\x05\x7A\x39\x09\xFC\xA3\x85\x14\x2B\x56\xFE\x63\xFC\x31\xE1\xC2\xA5\x46\xA2\x9C\x59\x16\x23\xCD\x62\xC7\x7C\xB4\xD8\x80\xD3\x67\xDB\x7C\x04\xF8\xF2\x99\xB7\xCF\x76\x88\xAA\xB0\xB1\xDC\x38\x7B\x35\xD9\xAA\x99\x78\xF3\x2C\xF0\xD3\xAC\xE0\x59\x20\xA8\xF5\x59\x86\xB6\xB8\xB2\xD5\x25\x51\xBC\x11\x58\x61\xF3\xF8\xDC\xD0\x2D\x01\xD0\x02\xBE\xB2\x9C\x8F\x20\xEE\x51\x1E\x1D\x54\xF4\x6B\xCB\xC5\xF1\xB1\xAA\x02\x3E\x62\x5D\xEA\xB2\x08\x61\x01\xB1\xE6\x63\x05\xCB\x35\x1F\x15\x29\xF4\x23\xC5\x74\xEF\x0C\xE2\xE5\x6F\xCD\x6C\x7E\x64\xAE\xA1\x0A\x0B\x8F\x52\xC7\x39\x02\xFA\x37\xEC\x8F\xC8\x83\x46\xFE\x85\x8D\x58\xDD\xFC\xF2\x44\x0A\xFD\xB9\xC4\x7F\xAB\xB9\x0C\x8C\xB8\x3F\x1A\x2D\x0D\x73\x3E\xE6\x3F\x7A\xBF\xEF\xF2\xFB\xAC\xEA\x8A\x0B\xA4\x56\xBC\x6E\xFF\xC3\xEF\xE8\xCA\xB7\x5F\x50\xFF\x79\xC4\xCB\x5C\x7A\xDA\xE5\x8E\xEE\x77\xE5\x8D\x73\x56\x31\xF4\x4E\xC1\x5F\x68\xF2\x88\x5F\x55\x93\x97\x99\x00\x5E\x96\x3D\x47\x0B\x75\xD8\xDF\x67\xD5\x85\x23\x97\xE0\x55\x6F\xEF\xCA\x27\xD0\xDF\xF3\xFB\xAE\xFC\x2B\x2F\x1E\xB0\x8D\xF8\x28\x82\x9E\x65\x0B\xAB\xB4\x21\xF9\xF2\x3E\x5B\xF0\xBD\xE5\x5F\x79\x11\xC1\xA9\x00\x76\x56\xF7\xD9\x66\xF8\xF9\xBA\xE6\x06\xE8\xE7\xD3\xA3\xBB\xE9\x67\x8E\xBA\x06\xF8\x31\x57\x90\x61\xF9\x7E\xC8\x75\x56\x97\x59\x19\xFA\x4D\xA2\x78\x16\xC6\x31\x0C\xB8\xBA\xAE\xA3\x7C\x89\x4B\x07\xDA\x26\x5A\x7C\x59\xBD\xA5\xE3\x23\x24\xCE\x20\x9D\x0A\xD9\xE1\xDE\x30\x89\xD2\xDE\x2C\xB4\x3B\xA4\xBA\x84\x69\xC5\x0B\x6E\xA2\x4C\xCA\x30\x95\x8C\x36\x52\x0F\xEF\x9C\x4C\xBB\x5C\x76\xD6\x1F\x5D\x8E\xF3\xDD\xCE\x5C\x1A\x3A\x3A\x1B\x4D\xFE\x85\x23\x97\xBA\x14\x9D\xCD\x7D\x76\xD8\x65\x7B\x1F\x7E\x07\x80\x27\x78\x2D\x64\x09\x32\x9E\xFF\x94\xE7\x3F\x14\x95\xC8\x8F\x9F\xFF\x74\xFD\xFC\xA7\xEB\xE7\x3F\xAD\x22\x8C\xAF\xAC\xC3\x68\xFE\x11\x59\x7B\x35\x80\x08\x31\xE3\xF9\xCD\x0F\xAD\x21\xA1\x38\xE1\x42\x43\x98\xEC\x2E\xDF\x8B\x84\x94\xF3\x28\x66\x3C\x8A\x59\x48\xC3\x3A\x7E\x14\xB3\xF5\xA3\x98\xAD\x1F\xC5\x0C\x20\x7F\x80\xE7\x75\x8C\xEA\xC2\x75\x2A\xDE\x5F\x74\x75\x9C\x33\x94\x1B\xF8\x40\xD1\x01\xFC\xAB\x8E\x70\x0C\x2E\xDF\x85\xE2\xCE\x7E\x7D\xF9\x52\x90\xA4\x96\x05\x30\xAE\x94\x01\xC3\x52\xC0\xF1\xC6\x64\xD6\xF7\x15\x40\x88\xDC\x31\xEF\x2B\x02\x30\xE4\x4B\x02\x8F\x95\x31\x92\x5A\xC6\xCA\x2C\x5B\x5F\x76\xCC\x07\xB8\x66\x88\xAB\x05\xC9\x67\x83\xF1\x25\x85\xB1\x59\x49\xA8\x9A\xD3\xF5\x39\x71\xC6\xC6\x35\x40\x96\x64\xCE\x38\x1F\x73\xC6\x39\x38\x23\xEA\x47\xCC\x43\x03\x09\xDD\x12\x38\x23\xF2\xCC\xB9\xEA\xF2\x06\x77\x66\x83\x3B\x93\xE1\xAE\xBE\xCD\xDD\x06\x71\xC6\x39\xE3\x2C\x01\x6D\xD7\xD5\x6E\x31\xE2\x8C\xF9\x8E\x79\x89\x38\xE2\x9C\x7A\xCE\x6A\xFA\xFB\x0B\xCE\x25\x8B\xD8\x9B\x15\xBB\x92\x67\xCE\xEE\x76\x29\x4A\x96\xA3\x90\x64\xBA\x85\x98\x2A\x41\x40\xE0\x1A\x8F\x6A\xDB\x7C\xB4\xD8\x65\xF4\xF8\xB1\x77\xE2\x23\x85\x60\x6C\x0B\x03\xC6\xB2\xD1\x2B\xAB\x3F\x34\x3A\x3F\x92\x65\x34\x8C\x4C\x4D\x67\xA6\xFF\x80\x1C\x44\x62\xF6\x61\xF8\x61\x16\x30\x82\xC9\x2B\x7C\x29\xFA\xCE\xBA\xE0\x13\x61\xC4\x4C\xC4\x6E\x24\x1B\xC3\x22\xDA\x61\x11\x49\x93\x7F\x49\x8A\xEE\xB0\xE9\xC8\x32\x4C\x89\x1C\x73\x89\xAC\xA3\xB3\x1B\x55\x30\xE4\x0C\x87\x5C\x3C\xA3\x58\x6B\x4B\x82\x9D\x48\x0E\xB9\x24\x2E\x65\x3A\x5E\xCA\x94\xA1\xB0\xB8\x14\x48\x38\x25\x21\xC3\x06\x05\x0F\xD8\x27\x72\xC8\xD9\xD1\x21\x97\xB0\xA4\x1B\x0E\xB9\x74\x38\xE4\x48\xB6\x58\x3A\xE4\xB0\x94\xA9\x2C\x65\x42\x4B\xB9\x22\x04\xDA\x11\x24\x99\x31\xF6\x48\x5F\x43\x7D\x74\x68\xAC\xEF\x63\xA8\x03\x7B\x2C\x13\x60\xAE\x9B\x0C\x4C\x80\x8E\xE0\xEC\xB0\x4B\xC1\x04\xB2\x27\x50\x0A\x38\x5B\xC3\xCA\x92\x09\x13\xC0\x8D\xD9\x0A\x2B\x8B\x3F\x4F\x59\xD9\x70\x37\xB3\x32\x98\x5C\x84\x0D\x6C\x1B\xD5\xFC\x12\x62\x48\x12\xD6\x0A\xAE\x72\x15\xE8\x1E\xF3\x06\x6B\xAA\xDD\x6B\x7E\x90\xAD\x7D\x29\xDB\x97\x6E\xEA\x47\xB9\x9A\x22\x28\x83\xD8\xE0\x07\x4F\xEA\x3A\x68\xE5\x2F\x17\x51\x2D\x87\xCE\x2D\x09\x68\x31\x41\x40\x13\xED\x70\xE8\xBE\x26\xA1\x20\x7C\x7C\x6F\xD1\x5F\xB8\xFE\x6D\xD7\xAF\xBF\xCB\xE1\xBB\xDC\x4C\x57\xDF\x5F\x38\x8D\x54\x54\xFC\x3B\x3A\x67\xA5\xB2\x4A\x33\x06\xDA\xB0\x5C\xE3\x75\x2C\x90\x3F\x01\xF1\xA6\x4B\xFB\x0E\x10\xD9\xF9\xBE\xBF\xD6\x2F\xAC\xB2\x1A\x99\xBB\xD9\x59\x95\x74\xB9\xCB\xB8\x1A\x6B\x57\x34\xBF\x00\xE3\x45\x16\xEA\x4B\x85\x67\xCC\xEE\x5C\xF9\x7F\xFC\x23\x13\xD1\xB0\x3C\xAB\x42\x65\xC6\xDC\x7F\x41\x71\xA6\xF0\xA7\x15\x07\x88\x7E\x9A\xFF\xF3\xC8\x56\x47\xCA\xFA\x17\x14\xFE\x73\x65\xAB\x2B\x78\x6A\x73\xFF\x54\xEF\x0A\xFF\x54\xCF\x2F\x94\xF2\x48\x99\x2F\xF6\x89\xA0\xD1\xEF\x50\x7A\x32\x8D\x3A\x54\xEA\xB2\x67\x48\x27\x35\x01\x59\x80\x7A\xEF\xED\xFE\x45\x67\x0E\xA4\xBE\x28\x0B\x51\x1F\x2D\x58\x65\xFA\x58\x80\xE5\xBC\xF0\x1D\xD7\xAF\x5F\x7F\x9F\x3E\xC7\xC6\x0D\x11\x40\xD9\x3C\xAB\x21\x9B\xE5\x7B\x5D\x49\x9B\x73\x36\x00\x71\x92\x00\x69\x02\x10\x67\xBE\xD7\x15\xB4\x39\xC1\xC6\xE2\xE6\x2C\xC6\x9B\xB3\x88\x16\x40\x57\x44\x46\x4D\xB7\x84\xCD\x89\xB4\xF4\x19\x36\xE7\x6C\xD4\xA1\x14\xF7\xF4\x6D\x21\x85\x6E\x39\x9D\x07\x55\xFB\xE8\x2C\x8C\x5B\x13\xB9\xE8\x1F\x2B\x38\x77\xEE\xA3\x05\x5B\x69\x3E\x52\x38\x89\xBC\x0B\xDA\x59\xF3\x8B\x5C\x07\xA4\x35\x71\xF1\x88\x93\xF9\x0F\x8F\x24\x78\xAC\x2F\x69\x53\x0F\xEC\x5F\x74\x16\x73\x67\x38\x07\x0D\x3C\xB6\xE2\xB9\x6B\x6B\x9E\x4B\xE4\x6F\xA5\x5D\x1E\x52\x67\x10\xE9\x13\x75\x14\x12\xAA\xFF\x1B\xA8\x32\xA1\x66\xB3\xFF\x63\x81\xE8\x2F\x43\x72\x8D\x72\x79\x40\xE7\xE5\xF9\x5D\xA3\x7B\x0D\x79\x39\xE9\x48\x6B\x4B\x2A\x49\x78\x85\xA2\xC1\x1A\x76\x2E\x95\x0C\xAD\x60\x08\xE8\xBE\x2B\xA6\x2D\x3E\xCE\x6F\x74\x05\xE7\x95\x87\x8F\xC1\xD8\xF1\x95\xF7\x01\x62\x7B\x11\xEF\xD7\x0C\x05\x21\x49\x47\xDA\x65\xFE\x8F\x35\xC3\x12\x1B\xAE\x0E\xA2\xB9\xA4\xA1\xE6\x92\x21\x4B\x6F\xB6\x18\x55\x16\xA4\x45\x7F\x53\xB7\x99\xBF\x6E\xDA\xB4\x8A\x73\xF8\x4D\x57\xB0\x4C\x97\x64\xC4\xEB\x94\xBD\x6C\xAD\xB2\x97\x03\x9B\x74\x49\x7D\x73\x39\x72\xEA\xA2\xEA\x36\x73\xF5\xE3\x40\x05\x45\x52\xFD\x8C\x0F\x7F\x26\x46\x06\x07\xAD\xF6\xBA\x19\xED\x0E\xCB\x73\x3D\xD9\x1D\x85\xAB\xE9\x7A\x49\xBB\xA3\x76\xB5\x2B\xE2\xEE\x28\xC7\xBB\xA3\x1C\x40\xA9\xCA\x61\x77\x94\xC3\xEE\x00\x4E\xAD\x65\xD3\x09\x77\xC4\x72\x47\xE8\x1E\xF8\x42\x66\x01\x8F\x96\x64\xE3\x49\xF1\xEB\x1A\xC7\x37\x17\xEC\x46\xAC\x7D\xAC\xDC\xDF\x56\x95\x48\xD4\x08\x29\xAF\x97\x76\x50\x85\x1D\x14\xF6\xCC\x57\x79\x07\x44\x42\x95\x7D\xF0\x86\xF0\xD3\x1D\x52\x6E\x1A\x29\x77\x42\x6C\x76\x42\x6C\x56\x88\x2D\xB9\x43\x62\x83\x49\xEB\x4F\xB4\x0D\xD2\xC9\x36\xB0\x7F\xE2\x76\xD6\x6D\xE9\xDB\x13\xFF\xD7\x8C\xF2\x81\xCE\xB1\x4C\xE1\x20\xE0\x47\x44\xCE\xFE\x93\x50\xB8\x34\x90\x7C\x2D\x28\x9C\xEE\x68\x2B\x24\xBB\x8A\xD7\xAB\xE0\x52\x0D\xEB\x36\xF0\xED\xC9\xDF\x6B\x98\x4D\x06\x8B\x32\xEF\x86\x4A\x22\x7F\x21\x63\x88\x74\xEE\x94\xFF\x9C\xEA\x11\x10\xDB\xFC\x5F\x12\x74\xC4\xE7\xA7\xA4\xE6\xF3\xB6\xE3\x5F\xDF\xBF\xF4\xAB\xD3\xFE\xE5\x22\x58\x0E\xBF\xE7\x94\x8E\xF0\x1B\xD7\xF5\x92\x0B\xE3\xAC\xB2\xA1\xC2\xA3\x65\x2B\xE4\x9B\x97\xFC\x1A\x7A\xD5\xAF\xF1\x59\x2E\xCC\x30\xF8\x36\x9E\x76\xE3\xCB\x9F\x57\xE3\x6B\x87\xDC\xEC\x53\x2C\x61\x3D\x19\xC4\x5B\x1D\x1E\xE9\x92\x1D\xF3\xCD\x7C\xEB\x93\x40\x0B\xB0\xFD\x8E\x79\x4A\x0C\xA6\xE7\x27\x0D\xBF\xBC\xFC\xDE\xD7\x3B\x33\xC8\xE6\x86\x64\xAF\x64\xE4\x63\xA1\xDB\x9B\xBE\xCB\x46\x9E\x96\x47\xB9\xD9\xED\xD8\x2C\x0D\xFA\x81\xD8\xA4\xDD\x31\xF7\xBB\x64\x74\x69\xBB\x1F\x39\x71\xEC\x8E\x79\x90\x9F\x77\x3C\x98\xD3\x88\x4D\x7C\x59\xF5\xB8\x93\xBD\x3A\x98\x1D\xA7\xFD\x2F\xA9\xBE\xF9\xE5\x1B\xC1\x94\xDE\x59\x0F\x53\xF0\xA3\x9D\x19\xC5\x0A\x92\x6C\x16\xBB\xAF\xB7\xCD\xF9\xB6\x80\x46\x21\x1D\x28\xC3\x5C\xC1\xCD\x50\xC2\x22\x60\x87\xF2\x31\xDA\xFF\xE8\x75\x09\x91\x2C\x5D\xC9\x92\x0D\x0A\x0C\x16\x7D\xF3\x2B\x42\x31\xC6\x3F\xDF\xBB\x12\xB0\xDA\xDE\x1E\xFA\xE7\x7B\x01\x64\x2B\xB9\x76\x25\x47\x6A\xD4\x0C\xEB\xA7\xB6\x4D\xC1\xB5\xF2\xEC\x2D\x47\xF5\xAB\x4C\xB2\x06\xF5\x06\xE6\x5C\x00\xCB\x08\x00\x51\xC2\xF4\x78\x5E\x2A\xBC\x0F\x41\x91\xD6\x9B\xC3\x36\x75\xA9\x0B\xE1\x19\x28\xA1\xCE\x72\x3E\xB6\x8E\x96\x42\x4B\xF0\x2C\x06\xE7\x1A\xDB\xFB\x06\x1B\x23\x2B\x60\x31\xC4\xC3\x70\x54\x5C\x0C\xE8\x4B\xFB\x90\x99\x4A\x6C\x5F\xDC\x37\x98\xF6\xD6\x46\x57\x3D\xA9\xA2\xDD\x50\x9D\xD3\x99\x3D\x6F\x9F\x15\x73\x29\x57\xD5\xE0\xA1\x17\xD3\x51\xFF\x5A\x04\xAA\xEB\x30\x72\x2E\x14\xE2\x8B\x03\xC9\xCC\x47\x1A\x7F\xAC\xFA\xC9\x45\x40\xF4\xB6\x29\xA8\xF5\xE6\xD3\xE1\xE1\xA2\x35\x6C\xF2\x4F\x83\x16\x4C\xBD\xC3\x94\x09\xCC\x38\xB2\x56\xB6\xA3\x13\xF4\x81\xF8\xE9\xA1\xF8\xE9\xE5\xE8\x18\x75\x33\x0E\xA1\xD8\x31\xF7\xB2\x56\x5B\x79\xFB\x2C\x16\xC2\x8E\x90\xAA\x01\x60\xE3\x55\xBB\xF0\x80\x97\x69\x1B\xE2\x6C\x5E\x3D\xCA\x98\xCF\xF4\xFF\xAB\x5B\xE2\xA5\xE1\xBA\xF7\x3E\xDF\xEF\x04\x6D\xCE\x00\xB3\xD3\x3C\xE7\xFF\xE8\xE6\xCD\x9B\x16\xCE\x17\x9F\x1C\x3A\xD2\x1E\x0E\x1C\x7B\xBE\xA1\x65\x92\x72\xB7\x4D\xE3\xB1\x03\x06\x5B\x04\x4C\x3C\xEA\x49\x9D\xA6\x81\x7D\x02\x65\x60\xA0\xBD\xBE\xAC\xA4\xF6\x85\xF2\x7F\x01\x9F\x32\x0C\x52\x70\x43\xFC\x83\xF8\x34\xC7\x14\xD0\xA7\x85\x53\xFE\x7E\x7C\xDA\xC0\x04\xD1\xA7\x46\xA0\xE6\x60\x23\x99\xBB\x85\xDB\x70\x4D\xCF\xFF\xDC\x8C\x04\xF1\xCF\xBE\x34\xB6\xE2\x62\xFA\x83\xAE\x56\x77\x20\x91\x8B\x73\xED\xBF\x7F\xB8\x4B\x6A\x50\x01\xFB\x4D\x8A\xC9\x21\x6A\x86\x95\xF4\x22\x5E\x2E\x76\x4C\x11\x4A\xA8\xB1\xC3\xC8\xEE\x75\x86\x4E\xB5\x0C\xB5\x03\xFD\xD1\xA3\xC4\x91\x42\xA5\x78\xF6\x41\xA7\x6C\xCF\x7E\x82\x35\x1D\x62\xD7\xC1\x64\x19\x03\x2A\x1A\x06\xCF\x7D\x82\xC9\xA4\xE0\xCA\x5D\x3F\xAF\x7A\x44\xF8\x03\xAD\x38\x1D\x58\xC0\xC8\x05\x9D\x30\x68\xF0\xD1\xA3\x73\xE3\x8C\xD7\x71\x8B\x30\x08\xE8\x65\x84\x91\x5A\x76\x70\x8F\x0F\x0A\x51\x6A\x0F\xF9\xAD\x97\xF9\x75\x3F\x1B\xD8\x37\x29\xDE\x61\x8F\x22\xF2\xE6\xDE\xCE\xF0\xA9\xC9\x37\x13\xC7\x65\x9C\x03\x66\x35\x47\x3D\xE0\x38\x3C\xF5\xE4\x6D\xFB\x7B\x6D\xE6\x12\xA0\x06\x70\x96\xBB\x01\x61\x1C\xF6\xC8\xE1\x7C\xAD\x96\xD0\x87\x3E\xFE\x1A\x7E\x2A\x86\x9F\xBC\x8E\x37\xD6\xA3\x5F\x0D\x7E\x35\xBE\x01\x8A\x25\x02\x0D\x3A\xD5\x7B\x29\xFD\x89\x04\x54\xAE\xDD\x01\xC3\x91\x39\x04\xD3\x9B\xF4\x80\x9F\x47\x08\xB5\xE4\x45\x46\x22\x95\x13\xB5\xE8\x04\xDC\x5A\x8D\xCB\xD4\x08\x22\x40\x8C\xA2\x05\x76\xD7\xB2\x7B\x90\xF1\x5F\xF3\x25\x47\x60\xE5\x4A\x7E\x88\xDB\x3F\x0D\x0E\xC9\x9F\xCF\x74\xCA\xD9\x5D\xA9\xFF\x33\x2E\xAD\x63\x62\x69\x1D\x76\xBC\xC7\xA8\x04\x67\x2F\xA1\xEB\x74\xBB\x33\x1C\x55\x34\x11\x08\xB6\xBB\xF5\x6E\xCB\xED\x91\xBF\xF2\x21\x3E\x92\x1E\xEC\xD4\x3A\xA7\xE5\x83\x6D\xF0\x78\x3F\x18\x52\xFB\xD5\xC8\x69\x79\x7F\x2B\x35\xD3\xEE\x5F\xBE\x1A\x4E\x80\xF5\x1D\x38\x3F\xEA\xC0\x13\xE1\x4C\x5C\xDB\x81\x47\x63\x07\x1E\x5D\xD7\x81\xD7\x87\x0E\xBC\x7E\x7D\x07\x9E\xEC\xD6\xFC\xF8\xE6\x63\x7A\xF5\xE6\x51\xAF\x9E\xE7\x5E\x1D\xAE\xEF\xD5\x61\xEC\xD5\xE1\xBA\x5E\x3D\x1D\x7A\xF5\xF4\xF2\x35\x7F\x5D\xAF\x54\x18\xF8\xDD\x3F\xAB\x37\x46\x28\x3A\x59\x80\xD8\x91\x68\xAA\x82\x9A\xF2\x6C\xA6\x6E\xDE\x75\x63\xD8\xF2\x75\x27\xD2\xF9\x2F\xFC\xDD\x25\x77\x63\xC3\x05\x6F\xBC\x9C\x54\xE5\x96\xCB\xE9\xBE\xFF\x71\x3A\x88\xA6\x2D\xF8\x14\x2A\x23\x4A\x8C\x57\x8E\x6E\x7E\x24\xD4\x6A\x2B\xE4\xE4\x4C\xA2\xF7\xA7\x9B\xB1\xCF\x0C\x56\x9E\x92\x8D\x2B\xC1\x34\xCF\x58\x23\x6D\xEE\x32\x57\x48\xBF\x11\x71\x19\xFB\x3D\xE4\x88\xAC\xEF\x38\xB1\xB1\x6F\x4C\xAF\x8B\x5B\xF5\x3A\x14\x28\x94\xAA\x60\xA5\xD4\x45\xAA\x83\xC3\x0D\x92\x54\x1A\x4B\xD2\x94\xAC\x0D\xA4\x80\x77\x62\x34\xC9\x92\xFB\x54\xB8\x72\xAF\x2B\x38\x34\xB1\x60\x95\x86\x74\x4B\xC3\x2A\x8D\xBE\xB2\x25\xAA\x3E\x47\x2B\xA2\x7E\x41\x37\x0B\x29\x24\x3B\x5C\xFE\x89\x9B\x2E\xDC\xAC\xE7\x92\x32\xC5\xF0\x12\xAE\x98\xCF\x2C\x1D\xEE\x90\x1C\x1D\x66\x35\x08\xBE\x13\x1A\x15\xAA\xF3\x01\x1E\x38\xF7\x6F\x93\x47\x11\xB2\xC3\xB8\x5F\xF5\xDA\xA5\x49\x68\x69\x4A\xAF\x04\x71\x71\xCB\xD5\xCB\x4B\x83\xA2\x12\x40\xDE\xAA\xDB\x7C\x84\xEC\xE3\x4A\xAE\x5E\x5E\xBF\x81\xD3\xF7\x92\xA1\x12\x06\xE3\x74\x3D\xCE\x1E\xA8\x20\x2F\xD5\x58\x12\x92\x0B\x6B\x09\x5D\x19\xEC\xAA\x28\xC2\xD2\xCD\x19\x9C\x37\xDF\x5F\xE4\x4A\x69\xAD\x4D\x6A\x2A\x97\xD1\x6C\x3F\xC7\xD1\x53\xF3\xB5\x01\x40\x74\xCF\x7C\xDB\x20\x06\x0B\xA5\xED\x16\x98\x8E\x76\x03\xC3\xDE\xA0\x46\x1B\x7F\x74\x15\x28\x6C\x4B\xA3\x37\x61\xF4\x46\x46\xDF\x2C\x8F\xDE\xF0\xE8\xCD\x78\xF4\x61\xE4\xCD\x23\x5C\x96\x55\x08\xD3\xD0\x1C\x34\x03\x61\x9A\x48\x98\xF9\x40\x98\x0D\xA7\xA5\x02\xD5\x77\xDB\xA8\x3D\x5F\xBF\x05\xAA\xE8\xEA\x39\x33\x7D\xB5\xBC\x87\x0F\x1F\x7E\xFF\x32\xFB\x9A\x76\xD5\xFF\x9B\xBF\x07\x40\x93\x49\x87\xDF\x80\x33\x69\x69\x22\x56\xC6\x18\x6F\xBF\xDD\x64\x8C\xDB\x5D\x1A\x3E\x57\x55\x0B\x24\x10\x06\x7F\x69\xAE\xFC\xBB\xA7\x66\x84\xAF\xCA\xAA\xDC\xA2\x23\xC5\xA8\x23\xC5\x71\x1D\x59\x6D\x90\x17\x4F\xDA\xBD\x3C\x57\xFE\xA7\xA6\xAF\x1F\x2D\xC9\xF0\xC2\xEE\x64\xCF\x09\x4E\x86\x9F\x2F\x05\x4E\x2B\x4E\x82\x6B\x38\x92\xAD\xF4\xD7\xD6\xAC\xF6\xF2\x32\x53\xA7\xD6\xAD\xF4\x57\x6D\xDA\xD6\x4D\xDC\xC9\xD1\xAC\x31\x9C\xF7\x78\xDE\x88\x7A\xFD\x77\x4E\x27\x4E\x9E\x69\xF9\x99\xA1\xFD\xF0\x20\x02\xD0\xF1\xAA\x75\x24\x1E\x07\x5D\x56\x3C\xC6\x56\x4A\xF2\x85\xA1\x13\x7B\x1D\x06\x39\xAE\x89\xC4\xBD\x43\xD4\x9E\xCB\x43\xE9\xBB\x1C\xA9\x62\xE3\x2A\x48\x27\x69\x93\xB1\x3B\xA2\xF0\xBF\xF0\xC1\x4F\x7D\x50\x3F\x3E\x2F\x69\x17\x39\xBE\x52\x92\x40\x7D\xCA\x9D\x82\x35\xEA\x53\x74\xDD\x95\xFE\x83\x9F\xFA\xE0\xA7\x60\x8A\x1A\x9E\x40\xF9\x92\x52\xB8\xF6\x29\x37\xF3\xF5\xD3\xD4\x22\x5E\x2F\xB5\xFD\x4E\xB9\xB2\x6F\x4F\xB9\xC2\xD7\x7D\xCB\x35\xE3\x73\x77\x92\x53\xC1\x4F\x31\x8E\xDF\xE6\x50\xEB\x8B\x43\x20\x0B\x14\x65\xE5\xC7\x0B\xE2\xDB\x05\x9F\x49\x33\x14\x04\xEC\x4A\xA9\x25\x58\x08\x53\x8F\x29\x78\x5C\xA7\x90\x9F\x9B\xD1\x9C\xB5\x39\x8D\x88\xAB\x30\xCA\xDB\x10\xDC\x17\x5F\xCA\xFE\x79\xCB\x69\xE6\x25\x27\x6A\x96\x24\x63\x96\x03\x2E\x64\x81\xA3\x86\x44\x52\x3E\x96\x82\x7C\x53\xBA\xFC\x12\xBD\x04\xB7\xBB\x02\x22\xE9\xC4\x5B\xF2\xB5\x24\xC9\xDB\x30\x95\xF5\x34\xD9\x0C\xE5\xCB\x02\x3D\x42\xFF\x8F\x4F\xA2\x68\x4D\x87\x58\xD5\xD9\x10\xA9\x5A\xD2\x9F\xA2\x6B\xF8\xBC\x0F\xB5\x43\x91\x11\xC1\xA8\xA7\x12\xDB\xB9\xD7\x9D\xF4\xE6\xD9\xEE\x04\x10\x66\xC3\xD9\x5E\x8A\xC8\xD0\xB8\x62\xAF\x6B\xBC\x7E\x16\x64\x55\x5E\x09\x12\x41\x33\x96\x08\x1A\x06\xF5\xAB\x01\x21\x2A\x0D\xCC\xD0\xED\x60\x1F\xAA\xD8\xC3\x7C\xCA\x95\xEE\x04\x72\x19\x4F\x70\x87\x4A\x1E\x5C\xDB\xB8\x13\xD4\xFB\x13\xE6\xBC\x3B\xC9\x8A\x1B\x91\xF5\xC9\x68\xEE\x9C\xB9\x13\xC2\x7B\x76\x40\x9B\x0D\x96\x14\x80\x96\x61\x5D\x37\x48\xC8\xD8\x70\x95\x58\xA1\x57\x64\xB5\x7C\x0B\xC7\x6F\x57\xDE\x4A\x60\x93\x75\x2B\x78\xDD\xCA\x28\xAE\xCD\xA2\xB8\x16\x84\x80\xAE\x61\x71\x6D\xC6\x6B\xD8\x84\x35\x2C\x81\xC8\x3A\xE7\xE5\x9A\xC1\x82\x31\x5B\x2B\xC9\x0F\xEF\xE4\x57\x34\x15\xFA\x07\x5B\x5A\x23\x3D\x58\x23\xD6\x8F\xBA\x2A\xE7\x62\x13\x3B\xDC\x9D\x74\x25\x9F\x8B\x27\xDD\x6D\x87\x19\x07\x29\x75\xCD\x57\x86\xB6\x3C\xB0\xE5\x83\xE6\xD8\x06\xBF\xFE\x6F\xD6\xFC\x6C\xB1\xF6\x88\x5B\x9A\xE4\xF8\x42\x3A\xE2\x9A\x9D\x01\x62\x19\x88\x91\x0D\x93\x19\x73\xFB\x92\x8F\xB8\x62\xF5\x88\x9B\xB6\x89\x15\x8B\xD4\x76\xBB\x65\xFB\x32\x66\x6A\xDD\x5C\x9D\x1C\x53\x5F\xB1\x4A\x7D\x4B\x1C\x64\x78\xA6\x6D\x44\xF5\x08\xED\x87\x07\xC3\xA9\xB6\x46\x70\x1B\x8F\xB3\x08\xA7\x5A\xE3\xD0\x44\x38\xD5\x6C\xE5\x1A\xB1\x49\x99\x8A\x23\xA2\x52\x1C\x6D\x97\xE6\x49\x9D\x55\xB7\x10\x76\x17\x68\x96\x71\x00\xE9\x28\x84\x7E\x22\x1B\x8A\xB3\xAB\x11\xF0\x1C\xCF\x40\x56\x6D\x88\x1F\x99\x67\xBB\x93\x43\x25\xC0\x24\x94\x39\xCB\x89\xC3\xED\xD1\x01\x39\xAD\x04\x68\xDD\x6C\xCC\xAF\x66\x43\x69\xDD\x59\x68\x20\x45\xF8\xD7\xB8\xB4\xEE\x49\x30\xAA\x93\x4E\xA4\x9E\x99\x54\x34\x3D\x29\x6C\x96\xD1\x92\xC1\x93\x5C\x13\x19\x55\xCA\x0A\x5A\xCA\xA9\x6A\xA9\xB8\x72\x46\x5A\x4F\xE0\x0D\xB2\xDB\x6B\xE2\x55\x83\x9B\x25\x1B\x6A\xAB\x0B\xA8\x07\xE6\xFE\x72\xF5\xF6\x45\x6A\x8F\xF4\x35\x83\xCA\x56\xC8\xDE\x7E\xBE\x0F\x20\x97\x51\x8D\xD1\x4E\xED\x75\x89\xB7\xCF\x76\xE9\x22\xCB\x32\xA5\x8D\x45\x40\xF5\xF3\xF0\xD8\xE0\xC4\x39\xF1\xAD\xD4\x38\x00\x90\xD4\x7D\x6C\xCA\x74\x89\x1C\xCC\x89\xCB\xCE\x19\xAE\xBC\x55\xAC\x3C\x41\x54\xC0\xD6\xE4\x64\xF2\x73\x21\xFE\xB3\x42\x9A\x2C\xD0\x24\xD7\x0D\xA6\x79\xC8\xB8\xE5\x75\x6F\xE7\x5B\x95\xDC\xAA\xE2\xDB\xD1\x2F\xA2\x47\xAE\x3C\x12\x6B\x10\x8F\x6E\x28\xDA\x92\x1F\xA0\xE7\xCA\x73\x82\x32\x33\x79\x45\x82\x71\xB5\x99\x4B\xD6\xB4\xC0\xC8\xA2\xCA\x37\x3D\x46\xE5\x4C\xF3\xFF\xDC\xE0\x3A\x63\x72\xAD\x2B\x70\xB5\x4B\x91\x09\xD4\x25\xF1\x0E\x9E\x85\x7C\xF9\x6D\x66\x78\x5B\x2E\x6F\xCB\xC3\xD8\xD3\xE5\x5B\x53\xBE\x35\x5D\x9A\x79\xE8\xCC\x4B\xB7\xAA\xFB\x4C\x13\xA6\xA9\x38\x07\xAC\x55\x8C\xBA\x58\x9E\x51\x73\xDC\x8C\x72\x64\x7B\xE2\xFF\x40\x0F\x25\xF1\xFE\x55\xAC\x9C\x96\x7A\xF3\x16\x0E\xE7\x93\x78\xCD\x1F\xFF\x8B\x30\x9B\xE2\x52\xF2\x16\x38\xAA\x68\x16\x72\x41\x97\x08\xF3\xD0\xCE\x10\x83\x3D\xE9\x82\x1E\xE6\xC0\xCA\xC0\x2C\xBA\x80\x58\xB6\x7C\x7C\x33\x1B\xF4\x7B\x8E\xD2\xCC\xF9\xA9\x7C\x69\x3A\xB8\xD8\xC8\xCA\x53\x46\x9E\x8A\x93\x38\x9D\x6F\x84\xE6\xA8\x95\xA7\x6C\x1F\x22\x42\x85\xE8\xA7\x34\xE1\x66\xD8\xD5\xCC\x66\xA6\x74\x0F\x87\xEC\xE4\x17\x46\x06\xE3\xD8\xF2\x99\x4B\x69\xEE\xE3\x10\xA6\x03\x07\x90\x6E\xBE\x76\xA9\xB8\x17\xD3\xBE\x73\x58\x9A\x50\x3F\x57\x74\x59\xD3\x20\xC3\x2F\x4F\x9F\xC4\x8B\x96\xFA\x49\x0B\x72\x4C\xBF\x2A\x6F\xDA\xD9\x00\x8C\xAA\x96\x1F\x44\x62\x29\x10\xCD\x04\xCD\x2B\x11\x1E\xC2\xC8\x47\x05\x60\xFA\xC4\x4E\x1D\x66\x99\xDE\x6E\x77\xE7\x99\x3D\xA6\xC5\x63\xBA\xC2\x82\x61\x8E\xB8\x06\x2E\x67\x6B\x77\xE7\x79\xCD\xB5\x95\x97\x1B\xA9\x8E\x63\x5A\x42\x4D\x9C\x72\x80\xDD\x9B\x3C\x8E\x94\xD5\x82\xF8\x24\x22\x75\x39\x24\x77\x89\x0A\x2B\x2E\x9D\x54\xD8\x38\xC4\x95\x57\x82\xA0\x90\x20\x9E\xB6\xC5\x84\xF0\x96\xBA\x90\x80\x5C\xF3\xDD\xAD\x36\x0F\xC4\xCD\x72\x68\xC1\x0A\x4A\xBE\xBC\xBB\x95\x2B\xB8\xA9\x62\x99\x67\x0C\xA3\x99\x71\x79\x51\x67\x9A\x5F\xBF\x11\x2A\xEB\x14\xCC\x9E\x75\xF8\x11\x2D\xB5\x9A\xB4\x98\xAC\x4E\x2B\xD4\x28\xCC\x51\x27\x81\xD8\xC4\x9E\xD3\xAE\xD8\x7B\x2C\xB6\x03\x87\x2B\xDA\x68\x55\x6D\x2B\x7C\x42\x5B\x72\xA1\xD5\x88\x8E\xE2\x12\xEA\x16\x73\x97\xD3\x24\x26\xF6\xBC\x04\xB0\x76\xC9\xCA\xB2\x24\x58\x44\xCB\xA9\x57\x38\x25\xA6\xD3\xCC\xD1\xAC\x57\xE6\xCA\x27\x1C\x94\x79\x0C\x6F\xE6\x75\x87\x97\x03\x91\xB6\xFC\xD1\xA0\x92\x6C\x55\xFD\xEB\xB9\x1E\x63\xB9\xE7\x01\x08\x5A\x8A\x83\x87\x3A\xEF\x05\xFD\x29\xB8\x42\xB3\xE6\x90\x65\x58\x20\x61\x14\x2D\x78\x97\x67\x5E\x9C\xE7\xDD\x8C\x15\x23\xB9\x71\x26\x37\x16\x2E\x63\xA0\xFA\xB1\x92\x41\xED\x92\x1A\x8A\x94\x33\xA9\xF2\x30\x83\xD3\x1A\xA9\xF3\x48\xC1\x66\x8C\x7E\x1C\xF1\xAC\x8B\xFA\xA3\xAB\x5D\xB5\xAA\x4F\xA6\x24\x2E\xCE\xBC\x62\x0C\xE4\x62\x8D\x30\x98\xA2\x04\x2E\xAE\xC3\x8C\x02\x4D\x42\xB9\x42\x84\xC1\x74\x22\x38\xE3\x3E\x08\xCE\x05\x4B\x2A\x51\x1A\xA4\xE9\x71\x65\xB4\x53\xBA\xD2\xE9\x5D\xE8\x08\x6B\x3A\x65\x42\xA7\xCC\x71\x9D\x32\xDC\x29\xC3\x9D\x9A\x74\xC8\x2C\x75\xC8\x8C\x3A\x34\x16\x4F\x07\x5B\x29\xE7\xC4\x15\x63\x5B\xA9\x31\xC6\x68\xC3\x76\xB0\x35\x12\x63\x41\x0B\x50\x85\xA5\x26\x1D\x97\x96\xBA\xAB\x59\xC7\xAD\x78\x0D\xCB\x41\x66\xE4\xB5\xE2\x8A\xEA\x46\x2A\xAA\x47\x1D\x57\xE2\xB0\x5C\xED\x66\x7B\x5D\x4D\x32\xE3\x86\xDB\x18\xE9\xB8\xF5\x58\x66\xAC\x07\x1D\xB7\x0E\x0D\xE4\xB0\x13\x0F\x3A\x6E\xE9\x16\x90\x19\x17\xDC\x93\x92\xCD\xC8\x6D\xE5\x16\x74\xBA\xD4\x43\xF5\xF4\x72\x52\x3D\x3D\xE3\xEA\xE9\x19\x17\x7E\xC8\x58\xC7\x9D\x56\x8A\x2E\xC6\x32\x23\x75\x82\x63\x63\x65\x12\x2E\x89\x37\x90\x48\xE0\x22\x93\x46\xDD\x6A\x7B\x3E\x68\x46\xA0\xC1\x7A\x75\xB9\x6D\x50\x59\x2C\x20\xB0\xD6\x2C\xB7\x65\x85\xC4\x02\xE0\x27\x68\x2E\x99\x2C\xB8\x8D\x9A\xD4\x5C\x96\xDC\xCA\x92\x67\xA3\x25\xE7\xF0\xC4\xA5\xB7\x1F\xDF\xF0\xED\x7A\xB0\xAE\x0F\x73\x31\xF4\x0D\xAF\x2F\x8E\x57\x88\x86\x27\x86\x66\xA5\x62\x73\x78\x8C\xED\x29\xA0\x9C\x8A\xA7\x58\xED\x4A\x12\x4B\xC5\x61\x07\xEB\xFC\x0F\x2B\x3B\x3A\xBB\xF3\x1D\x9D\xC5\x1D\x9D\xDD\x72\x47\x67\x12\xA2\xB6\x66\x31\x4D\x58\x4C\x73\xDC\x62\x1A\x9E\x4A\xB3\x66\x2A\xA3\xF9\x7F\x16\xCD\xFF\x3C\xA9\x0B\xB6\x9E\xCE\x78\x5A\x17\x93\x69\x25\xA5\x88\x43\x0F\xD6\x58\x38\x26\x2F\x93\xB6\x39\xB8\x8E\xDF\xB9\xD6\xE4\x3F\xEA\xDC\xB8\x6B\x6C\xE8\x88\x71\x0F\x6B\xC8\xE9\xD8\xA7\x6F\x37\x07\x13\x62\x32\x63\x62\x32\x6B\x88\x69\xD9\xE8\xEF\x8C\x2B\x9B\xBF\x25\xE0\x59\x25\x0C\xB6\xCD\xBB\xC5\x21\x57\xD1\x49\x52\x41\x64\x42\x0E\x4B\xD2\x77\x1A\x4B\xCF\xE1\x38\x26\xC4\xD0\xE4\x51\xE5\x1B\xDC\xAD\x5F\x3C\xA1\xCB\x23\x71\xE9\x71\x0C\x06\xC8\x0E\x0A\xF2\x2E\xFA\xA4\x59\x3D\xCE\xA2\x67\x2D\x63\xCF\x4D\x1A\xCF\x35\x71\xC6\xC9\x8D\xC1\x05\x57\xB0\x4E\x9A\x4C\x83\x2B\xA6\x9E\x38\x89\x6F\xCC\xF9\x5C\x5B\xF1\xC1\x41\x53\xB0\xE7\x25\xF2\x12\x11\x8E\xEB\x3C\x71\x45\xF0\xC4\x65\x6B\x9C\xA4\x09\x2F\x43\xB2\xBC\x0C\x79\xF4\xC0\xE5\x83\xD7\x23\x19\xAD\x84\x89\x4E\x51\xCB\x1E\xB8\x7C\x38\xD9\xF2\x70\xB2\xAD\xE9\xD2\xCA\xEE\x58\xE9\xD2\x94\x32\x26\x1D\x32\xA1\x43\xDD\xEC\x78\xE2\xC8\x2F\x49\xAA\x01\xEC\xFA\x19\xDB\xF5\x61\x9F\xC9\x82\x41\x3F\x23\xE1\x29\x93\xA3\x89\xA1\x76\xBA\x8A\x8E\x1E\xFB\x6C\x37\x9F\xE4\x72\xE5\x92\xCB\x55\xB8\x4A\x72\x0C\x16\x6E\x31\xCA\xE5\x9A\xE4\x18\x64\x43\x8C\x69\x6C\xA0\x70\xD9\x52\x8C\xE9\x9C\x1D\x93\x62\x9E\xC7\xE5\xBE\x5D\xB8\x39\x49\x6E\x19\xD7\xD9\x0A\x61\xA6\xF5\xA8\x42\xFB\x82\x8D\xFD\xD9\x60\xEC\x9F\x44\x53\xB3\x65\x3E\xA3\x37\x3F\x4F\x62\x77\x31\x46\xED\xB8\xC5\x52\x94\xB7\x5D\x8A\x72\xC2\xA8\xCA\xE5\xE5\x98\x2D\x99\xD1\xB3\xC1\x8C\x9E\xAF\x37\xA3\xCF\xC6\x36\x74\x5A\x61\x74\xB6\xCB\x7D\xB1\x3F\x3C\x0D\xB4\x15\x97\xFB\x7C\x9F\x06\x50\xDB\x6A\x9A\x35\xC3\x59\x54\x19\x3F\x97\xEF\x2F\x0A\xAD\xAC\xB5\xA9\x49\x75\x35\xAC\x7D\x3E\x5A\xFB\x91\x33\xA7\xE0\x4D\x34\x72\xE7\x94\x12\x5F\x5C\x0D\xA6\x2C\x13\x4C\xEF\x79\xF0\xC4\x4B\x7C\x71\xBE\x7E\xED\xC7\x65\x9D\x43\x03\xB3\x71\x68\x26\xD6\xBE\x42\xB7\xAB\x0B\xD1\xFF\x42\x6B\x5F\xA3\x16\x0E\x34\x8A\x18\x62\x5C\x8E\x42\x8C\x51\x88\xAA\xE0\x70\xE4\xB8\xF6\x13\x07\x3E\xD6\x3E\xAF\xA0\x1F\x74\x85\x8C\x6A\xAF\xCB\xA9\x83\x1A\xE5\xA4\x84\x20\x8A\x7D\x97\x7B\x7D\x78\xC0\x30\x06\x2C\x3F\xC3\x10\x9A\xAF\xF5\x81\x0F\x48\x0E\x6B\x0C\x83\xE5\x71\x86\xC1\x62\xAF\xAB\x30\x5B\x13\xC3\x60\x11\x0D\x83\x85\x18\x06\xE7\x6E\xFE\xE5\x18\x06\xCB\x15\xC3\x20\xA4\xBA\xAE\xE6\x9E\x04\xC3\x20\x09\x7B\x62\x18\xAC\x82\x61\xB0\x70\xD5\xC8\x30\x58\xAE\x1A\x06\xA7\x1E\x0C\x99\x16\x1A\xDA\x73\xE8\xC4\x57\x8F\xA6\xD2\xAF\x94\xA6\xB2\x6F\x04\x4D\xB9\x2C\x98\x0A\x84\x22\x96\xD8\x78\xBE\xC5\x61\xAC\xC9\x73\xDD\x8A\xAC\x35\x66\xE7\x53\x53\x7A\x16\x79\x48\x76\x4B\xCF\x7A\xB6\x9E\x8D\x84\x87\x86\xC6\x5D\x49\xF4\x9F\x0D\xD9\x6A\x43\x2B\xCC\x4E\xB2\xC0\x4E\xBE\x8A\x5C\x22\xF9\x4A\x57\x34\xFD\x46\xAE\xE8\x92\x9F\x40\x55\x23\x8C\x84\x7F\x9A\xD8\x0C\x66\xEE\x51\xD6\x64\xAC\xC4\xE9\x3F\x16\x92\x25\x13\xFF\x91\xA2\xEF\xD2\xF0\xE5\x03\x74\xB4\xCA\x17\xFA\xF3\xBE\x82\x93\x6F\xCF\x70\x64\x2C\x67\x43\xE6\xCE\x72\xC9\x6D\x11\x71\xB8\x1A\x33\x57\x1E\xA7\xB1\x97\x43\x62\xE3\x50\xA6\x78\x9F\x44\x92\xFB\xEC\xC7\xD8\x72\x70\x01\x36\x3F\x7E\xD1\xF4\x7D\x95\x4B\x68\xF4\xEF\xA5\x17\xCF\x46\x49\x99\x37\xCE\xD9\x8F\x15\x78\x79\xC1\xFA\x23\xFA\x75\x9A\x8D\x04\x05\x8A\x0E\x9E\x01\xA0\x6B\x02\x18\xB4\x1D\xD3\xE0\x93\xEB\x77\x4C\x8D\x4F\xEF\x2B\x7A\x04\x0D\x81\x84\x03\x98\x4D\x09\x64\x22\x57\x9E\x55\x09\x63\x2B\x8C\xF2\x30\xA7\x17\x5D\x79\x5C\xBA\x26\xC3\xB6\x21\x81\xA9\xCB\x5D\x71\x56\xE9\xAE\x6A\x3E\x23\x01\xF9\xC7\x3E\x45\xDD\x58\x4D\xF2\xAC\xD6\x24\x79\x96\xAE\xF2\x5F\x50\xF8\x0F\x11\xE1\xD5\xB9\x00\xC5\x95\xFE\xA9\x1E\xC9\x9E\xFC\x32\x11\x19\x4F\x77\x25\x2F\x08\x11\x58\xB2\x6D\xCE\xEC\x75\xA5\xE7\x84\x9A\x9B\x37\xF5\xE5\x2D\xAF\x0F\x5D\xF1\x1A\x6D\x0E\x5E\xAB\x4D\xE5\x75\x9B\xE3\x26\xD2\x8A\x13\x54\x5C\x24\x89\xF7\x8C\x2B\x9D\xB9\xCA\xE5\x1D\x47\x89\x25\xDF\x5D\xA0\x44\x17\x57\x0D\x97\x32\xEC\x8C\x56\xCE\x58\xB6\xF8\xF9\x5B\x41\x24\x13\x38\x8D\xC4\x59\x9F\x3D\x37\x20\x13\x68\x67\x19\x48\x23\x63\x0C\x88\xF8\x38\xBB\x5F\x56\x9B\x08\x29\xD6\x5D\x42\x24\xA4\x5C\x06\x90\x07\x15\xE0\xA3\xE2\xE5\xD4\xA5\xC3\x65\x7D\x2C\xDA\x46\xE2\x34\xF5\x27\x1F\x92\xA4\xB5\xA0\x6D\x20\x91\x59\xFB\xF3\xFB\x6B\x53\xA4\x23\xDA\x43\xB2\x3E\x45\x3A\x59\x9F\x22\x9D\xAC\x4D\x91\x06\x7C\x8F\x40\x3E\x24\x13\xC8\x87\xE9\x74\x18\x94\x4F\x16\x78\x0C\x3B\xC0\x6E\x58\x41\x95\xD1\x95\xB3\x23\x9D\xC1\x19\x24\x80\xDB\x61\xAE\x0D\xCD\x3E\x20\x37\xA6\xD3\x1D\x10\x37\xE4\xEF\x10\xE1\x68\xBC\x8A\xF3\xDF\xE6\xC0\xA1\xB9\xCA\x49\xF8\x92\x5F\x65\x87\x49\x36\x5E\x4B\xF9\xE2\x3C\x2E\xD5\xB1\xB7\x05\xC8\x63\x33\x81\xE5\x48\xF1\x86\x25\xFC\x10\xC3\x99\x1B\x4B\x80\x16\x76\x0C\x68\x91\x31\xA0\x05\x16\xCA\xF2\x42\xD9\x65\x40\x8B\xD5\x85\xB2\xEB\x17\xCA\xAE\x5F\x28\x1B\x17\xCA\xC8\x42\xD9\x09\x36\x87\xD3\x01\x99\x63\xBC\x05\xD6\xE7\xE6\x73\x42\xD3\x64\x3C\x9A\xC7\x63\x87\xF1\xD8\xAF\xC7\x78\x04\x97\x53\x06\xC3\xF8\x5E\x39\x63\x86\x25\x2E\x77\xC9\xE5\x2D\x16\x0E\xD5\xB6\xA9\x03\xAE\xA8\x33\xBB\x5D\x82\xB2\xB7\xD6\xEB\xDE\x25\x5B\x9D\x0E\xC8\x12\xD5\x0F\x73\x01\x41\xBA\xFF\x74\x67\xBD\x7E\x64\xAE\xFC\x7B\x3E\x34\x81\x30\x3C\xDD\xDA\xCA\x07\x08\x00\x03\x3B\x89\xB3\x7B\x44\x15\xC6\xE9\xD6\x72\x2E\x8A\xB3\x4E\xEF\x01\xF1\xC1\xFF\xE3\x71\x22\x07\x08\xE7\x0C\x10\xDD\x9B\xEF\xA3\x9F\x3A\x7B\x11\x18\x55\x6A\xDB\x38\xB4\xEE\x6C\xEF\x8F\xFA\xFB\x15\x97\x09\x62\x48\x29\xCB\xA4\x09\x26\x56\xBD\xCB\x1A\x73\xA4\xAF\xA1\x76\x48\x32\x76\x42\x39\xE3\xF4\xE4\x97\x2C\xCC\xB9\x94\x0E\xCD\x2E\xCE\xB9\xCA\x69\x9B\xA3\xF8\x22\x8B\x52\xC6\xE5\xEC\x2F\x4A\x97\x9B\x8C\x8E\xA9\x3C\x56\x16\x45\x52\xFE\xD8\x31\x95\x87\xB4\x0C\xB5\xA6\x41\x76\x4C\x4D\x9F\xC4\x8B\x96\x7A\x7A\x91\x56\x63\x7D\xBF\xE0\xBC\xE0\x5C\x19\x33\x7D\x84\x5F\x88\x0A\xA7\x83\x03\x29\x67\x87\xDF\x52\xFB\xC8\xC4\xD2\xFD\x46\x75\xDC\x5B\xD8\x55\xBE\xF2\x88\xE9\x83\xF7\x79\x75\x06\x00\xC1\x8A\x64\xFD\xEA\x27\xAC\x49\x8F\xCC\xB5\xC1\x0F\x11\x8A\x3D\xAE\x75\x9B\xA7\xEC\x47\xCE\x96\xDC\xE6\x79\x4C\xAD\xC9\x69\x3A\xE0\xE6\x2D\x26\x6E\xDE\xE2\x9C\x29\x56\x1D\xE7\x9A\xDD\xBC\xC5\xC4\xCD\x5B\x8C\x97\xA8\x90\x32\xAB\xDC\x66\xC9\x97\x1B\x71\x93\xCB\x5D\x45\xF8\x3D\xBA\xCF\xB3\x65\x67\x2E\x7B\xD8\x20\x9F\x04\x29\x3C\xC3\x8B\xD8\xC7\x06\x9F\xB8\xDE\x9D\x4B\x59\x2F\xE2\x12\x5D\xEA\xB2\x15\x37\x22\xFB\x77\x6C\xC1\x39\xCE\x70\x10\x65\x7D\x07\xB8\xD7\xC4\x37\x3D\xB7\x8C\x74\xDD\xB7\xC2\xB7\xC8\x38\x92\x99\x7F\xBE\x97\x12\xEA\x2C\x31\x2C\x39\xED\xA8\x11\x7F\xBA\x67\x90\x1A\xCB\x65\x45\x25\xC4\x2C\x77\x69\x9B\xB1\xB7\x2F\x71\xFA\x52\xAC\x26\x14\x10\xE4\x8B\x51\x1C\xC5\xCA\x12\x7A\x3D\x2D\x94\x88\x88\x0A\x6F\x9F\x5D\x64\x69\x3A\x8E\xA6\x48\x97\x97\x25\x39\xCE\xB1\x5C\x27\x12\x4E\x91\xAE\x0F\xA7\x28\xA6\x1E\xEE\x56\x4B\x38\x85\x96\x36\xD9\xA3\x5F\xC8\x52\x17\x21\x4E\x60\xDD\xEB\xD7\x3A\xFF\x93\x91\x47\x59\xF3\xC6\x2D\x62\x1C\xE6\xE8\x8E\xD5\x80\x8A\x62\x39\x6E\xC1\x0E\x9E\xCF\xA5\x26\xEC\x2D\x22\x2A\x98\x29\x28\x76\xED\x62\x2B\x14\x4C\x3E\xE9\x52\x48\x85\x5E\x7E\x9F\x1E\xDE\x37\xEC\xC5\xF5\x71\x12\x7A\xF0\xA4\x2E\xF9\xF5\x8B\x55\x9F\xF8\x71\x21\x15\x2B\x7E\x7A\x7D\xEC\xAC\xEA\x2A\x06\x89\x2C\x2D\xAA\x04\x8D\x4C\xFA\x17\x82\x32\xE7\xF0\xEA\x1C\xDF\x81\x95\x98\x8E\x5B\x77\x20\x2C\xEB\x6C\xB2\xD9\xB3\x63\x36\xFB\x34\x56\xE6\x78\x4F\xF4\x74\xFE\xB8\x36\x57\x57\xC4\xAD\xEE\x31\x1A\x6C\x78\x3A\x8C\xD3\xD5\x0D\x9F\xC4\x0D\x9F\xCA\x86\x4F\xFB\xAE\xA0\x0D\x5F\x8C\x37\x7C\x1A\x36\x3C\x8E\x8D\x14\x6E\x7A\xDE\xF0\xC5\xDA\x0D\x9F\x62\xC3\x03\x2D\x45\x36\x3C\xBC\xE4\xDD\xCC\x17\xBB\x73\x13\x37\x7F\x02\x94\x68\x2C\x0D\x36\x3F\xED\x68\x86\xFF\x2B\x7A\xA7\x77\x81\x12\x39\x94\x10\x4E\xAA\xBF\x53\xEA\x24\xF0\x81\x07\x22\x1F\x30\xE7\xBD\xDA\x36\x3F\xF9\xFE\x6F\xBF\xAE\xFC\x11\xE7\x1C\x5B\xBF\xDD\xA3\x66\x25\x40\xCC\x77\x4C\xE1\x71\x19\x5D\xF6\x1F\xA5\x87\x9A\x0F\x87\x9C\x37\x2D\x71\x5B\x49\xF3\x62\xC0\xC1\x75\x5C\x96\xE4\x3E\x1B\xD1\x85\x91\x40\x18\xBE\x3B\x83\x4F\x0D\x63\x25\x6D\xF3\x9F\x07\x1C\x97\x73\xA5\xF7\xEC\x98\xFB\x91\x6A\x1A\xD2\x42\xCF\xAA\x07\x43\xC9\x28\x4E\x4A\x0D\x00\xC6\x0F\x49\x75\x6B\x5D\x91\x38\xFC\x5A\x8D\x25\x7C\x99\xAB\x26\xF2\x83\xE7\xE3\x83\xAF\xA8\xF1\x93\x9F\x50\xC3\xA3\x49\x7C\x94\xF3\xEC\x49\xC3\x7D\xCA\xE1\xD6\x6F\x76\x28\x5B\xFA\x24\xFF\xF8\x04\xFF\xC8\x05\x26\xA7\x95\x8E\x4F\x4B\xA6\x36\x12\x17\x51\xE4\xAA\xD3\x5E\xEF\x77\xE9\x16\x1B\x0C\x20\xC8\x69\xAF\x9F\x73\xF4\x4B\x2D\x20\x90\xFE\x5E\xCF\xE8\x02\xDE\xEC\x6E\x75\xDA\x69\xFF\x9E\x8D\x03\x80\x0B\x9C\x55\x8A\x64\x37\x73\x00\xC8\x01\x17\xBE\x5F\x6F\xF8\x87\x36\xFC\x50\xF0\xF7\x2E\xDE\xE0\xF8\x87\xFF\x1F\x7E\x70\xCA\xDF\x0B\x94\x1B\xFD\xCC\x01\x5D\xD4\x7C\xF1\xFF\x1F\xEF\x96\xF6\xFF\x7C\xF8\x41\x9A\xFF\x4F\xF8\x69\x54\x16\xFB\x38\xAA\xB7\xEA\x1D\xB3\x6D\x22\xEA\x65\xAC\xBD\xAC\xF9\x9E\xBF\xF1\x02\x83\x3F\x6B\xAC\x1C\xD7\xD3\xD3\x9E\xC6\xB3\x71\x65\x6B\xC7\x3C\x10\x0C\x41\x67\xBA\x14\xF9\xE7\x8D\xC0\x4D\x63\xEA\x0A\xAE\x7A\x0A\x0C\xAA\x4E\xFB\xB7\x0A\xB8\x1B\x64\xF4\x8A\x61\x41\x9B\xDE\xBF\x75\x3F\x20\xC5\xB7\x82\xA4\x59\xC3\xC9\xA0\x0F\x78\x82\x93\x1D\xD3\x70\x59\x42\xED\xF5\xE1\xC3\xAA\xE0\x09\xD6\x07\x6D\x42\x67\x01\xAB\x9F\x4E\x47\x53\x4E\xE2\x34\xE3\x60\xC3\x4A\x3F\x2A\x4A\xC6\x14\x16\xCC\x94\x26\x6E\x40\x13\x6A\x02\x44\xE0\xF7\x60\xE1\xD2\x48\x68\xFD\x59\xC5\x97\x9B\xBF\x15\xCA\xB9\x5B\x64\x36\xD7\x9C\xD0\xB6\xDD\xFC\x21\x62\x5A\x8C\x00\xA9\x3F\x81\xBA\x45\xB4\x37\xA0\xFF\xBD\xE3\x82\x3D\x6A\x7E\x3E\xA4\xCF\xBF\x91\xFA\x34\x4C\x73\xAB\xFD\x03\x31\x67\x59\x5F\xF8\xFB\xD7\xAF\x5F\x7F\x5F\xC2\x47\x04\x92\xEC\x0D\x0D\xA4\x73\xCA\x6F\x60\x1F\xF1\x32\x18\xAF\xEE\x53\xEF\xFF\xFE\x1B\xD7\xD5\x39\xC5\xBD\xA7\x1F\x5E\x1A\x7E\x68\xF0\xC3\x47\x87\x1F\x4E\xE3\x87\x9F\x1C\x7E\x70\xBD\x57\xAF\x51\x9F\xA0\x1F\x5E\xAB\x54\x84\xF2\x7B\xA2\xF9\x9B\x2F\x00\xE1\xE0\x49\xFE\xFE\xC6\xE6\x7B\x68\x68\x0F\xAB\x6F\x16\x3F\xFB\xBD\x77\x5E\xEC\xED\x81\x15\x77\xE0\x5B\xB5\x3E\x1A\xE8\x0B\xF6\x39\x8F\x21\x81\x35\x30\x8C\x32\xCD\xFE\xF4\x9E\x84\xEF\xF9\x04\xDF\x03\x0F\xE4\x71\xF7\xBC\x32\xBD\xA7\xFA\x56\x2D\xC8\xE9\x82\xA3\x7E\x88\x6F\xE6\x69\xDA\xCA\x28\xAC\x46\xDF\x1E\xC4\x19\x18\x40\xD2\x5D\x0F\x93\x57\x13\xD8\x1B\x7D\x4B\xF8\xCB\xAB\x7A\xAF\x99\xC5\x6C\xF6\xE0\x2B\xA0\x28\x36\x33\x82\xED\xC8\x47\x44\x21\xFD\x6B\xC6\x49\xAF\x0E\xB4\x5E\x05\x33\xE7\x2C\x67\xA9\xA1\xF5\x34\xB3\xE6\xD0\xEB\x33\x82\x6D\x40\x4C\x5A\x03\x0B\x02\x3D\xF5\xBF\x05\x60\x84\xA6\xF7\x3F\x36\x61\xD2\xDB\xE6\x29\x64\xC0\x06\xD8\x62\xA7\xAA\xB3\x82\x21\x8F\x54\x6F\x52\x8A\x05\xBC\xFD\x89\x48\x93\xF6\xA8\xF9\x14\x57\x5A\x7A\xAA\xFA\x79\x03\x08\x7C\xDC\xD0\x09\x16\x7B\x2C\x9F\x49\xD4\xBD\xEE\xC7\x37\x86\x1F\xFF\x19\xD7\x50\x7D\xFB\x70\xE9\xA9\xE3\x2F\xDD\x2F\x97\xE2\x69\xC0\x6E\x4E\x3D\x90\x92\x1E\x91\x92\x9E\x3C\xFB\xA6\xD1\xB3\x9F\x90\x67\x39\xE2\x3D\x69\x7E\x9B\xC1\x1E\x26\xF7\xBF\x79\x74\xFF\x2B\x4B\xF7\xFF\xCE\xCA\xFD\xAB\xA7\xC9\xE4\xE2\x83\x6B\x39\xC8\x2D\x76\x41\x75\x59\x0D\x82\x2A\x1D\xA3\xD2\x47\x35\xEA\x30\x8F\xBC\x09\x23\xE7\xA2\x11\xCB\x83\xAF\x1E\x59\x6E\xE8\x77\xC6\x0D\xFD\x4E\x68\x88\xCF\x95\xD8\xD6\x99\xB5\x6D\xFD\xDF\x66\x10\x12\xDE\xA5\x63\xFA\xB3\x67\x7D\x58\x6D\x9B\x07\x78\x1C\x4F\xBA\x14\x38\x98\x5E\xF9\x77\x6A\x46\x23\xE0\x32\xEC\x90\x77\x88\xB9\x92\xF4\x72\xB0\xD5\xE5\xFE\xE4\xE5\xB9\xF2\x47\xB0\xB1\x77\xA5\xCB\xD9\x68\xBF\xEF\xF2\x4B\x5B\xCD\x7B\xD9\x7D\x8F\xA8\x2D\x6E\xA3\x0C\x18\x89\xDA\x4B\x40\xBF\x21\xC1\xB6\xF9\x9C\x44\xFF\x11\x8B\x61\xE1\xAB\x80\x2D\x7B\xDB\x24\x5C\xE7\x62\x4F\x8C\x3D\x0C\x31\x00\x39\x0F\x71\x7F\x88\x09\x4B\xBD\xBA\xBA\x05\x88\x25\x84\x47\x1E\xF5\x5D\x0A\x91\xD3\x27\x7D\xAB\xD9\x2A\x64\x19\xD4\x3D\x0F\x65\x42\x14\x3F\x6D\x59\xC2\xC9\xE5\x3F\xC9\x89\xEB\xC1\x80\x50\xAB\x8A\x4D\xB3\xE5\x45\x00\xF2\xC1\xEC\x5D\xE2\xAC\x29\x9B\x1F\x10\x37\x97\x7F\x57\x48\x30\x77\x79\xF5\x59\x36\xCD\xE6\xA3\xCD\x9E\xC7\xE9\x2D\x86\xE9\x35\xCE\x4A\x36\x4E\xD2\x95\xCE\x5E\xE1\x5A\xB2\xF7\x19\xD5\xCD\x5E\x74\x5C\x2E\xFB\xB4\xCB\xDD\xEC\x82\x7B\xE7\x8B\xCE\xEC\x39\xEB\xCA\xBD\xBE\xAB\x89\x2F\xE4\x17\x58\xB4\xDA\x36\x4F\xB6\xF3\xC1\x9B\xFB\x46\x54\x72\xE6\x3C\x31\x13\xEC\xFD\x8B\xB3\x4A\x77\x1B\x8C\x62\x63\x2F\xCD\x8D\x37\x6D\xE3\x8A\xB9\xAE\xFC\xFF\xC7\xDE\x9F\x80\xC7\x51\x5D\x89\xE2\xF8\x39\x55\xD5\xD5\x4B\x75\x4B\x8D\x65\x82\xC1\x32\x5D\xDD\xCF\x80\x0C\x96\x2D\x1B\x30\x60\x30\xB8\x6C\xBC\xE1\x4D\xC1\x06\x82\x59\xE4\xB2\xD4\x96\xBA\xD5\xEA\x96\xBB\x5B\x06\x13\x62\x29\x01\x02\x21\x4C\x42\x92\x99\xC9\x24\x43\x82\xE7\x31\xC1\x18\x87\x04\xB2\x2F\x30\x38\x2B\xBC\x64\x48\xEC\x80\x81\xEC\x26\xC9\xE4\x0D\x59\x1C\x43\x58\xBC\x80\xEB\xFF\xDD\x73\xEE\xAD\xAE\x2E\xCB\x24\xF3\xDE\xFC\x7F\xBF\xEF\xFB\x7D\x29\xFB\xE8\x56\x9D\xBE\xFB\x7A\xEE\x3D\xE7\x9E\x83\x74\x16\xAF\x2D\x99\x6C\x1B\x76\x6C\x32\xDF\xFA\x50\x6A\x42\x68\x20\xE4\x74\x41\xCB\xE8\x82\xC4\xD1\x27\xB3\x82\x73\x2D\x85\x76\xD2\x36\x96\x51\xB5\x3E\x29\xBD\x92\xB6\x1F\x2C\xDA\xFA\x64\xA9\x92\x14\x3A\x61\xC5\x22\xB6\xBF\xB9\x94\xCC\x19\x1B\xC5\xEC\x09\xB6\x45\x52\xA9\x7A\x27\x80\x1D\x13\xF9\xD4\x88\x86\xB4\xB5\x80\x3E\xAD\xC9\xC2\x5D\x92\x32\xEC\x98\x68\xC6\x18\x1D\x1C\xE5\x74\xFB\x84\x65\xBE\xBA\x52\xB2\x40\x2A\xFA\x10\x91\xC8\x22\x2F\x83\x54\x23\xE2\x07\x31\x53\x3A\x9A\x83\x36\x91\x5A\xD9\xB4\xE5\x80\x98\x5D\xFF\x9D\xD6\x02\x70\x4E\x14\x03\x23\xAB\xD9\x2D\x1D\xDA\xD2\x2C\xDD\xD5\x98\x9A\x8D\x89\xBC\x5E\x4B\xBA\xCD\x60\x2E\xB4\xDA\xBA\x03\x4B\xEC\x94\x28\x8C\x69\xA7\x6C\x73\xE9\xE4\x9C\xEE\x98\x4B\x37\x65\x93\xCE\xD8\x58\xDA\x8E\x0D\x65\x4F\x70\x40\x99\x4F\xF0\xF7\xD4\xE9\x16\x1D\x34\x8C\xB3\xE4\x0B\xB1\xF5\x69\x80\xB4\xCA\xF5\x31\xFD\x3B\xA2\xAE\x5A\x68\xBF\x91\x4A\x1A\x16\xE9\x84\xC1\x6C\xCC\x6E\x61\xF3\x7D\xE8\x08\x3A\x4A\x0C\x9A\xD6\xA2\x03\xE9\x5B\xC8\x5C\xAC\x61\x47\x3B\xA1\x35\xA5\x27\xA3\x96\xEC\x37\xBE\x6F\x25\x9B\x13\xF0\x4D\x06\xFC\x5B\x17\xA5\xE2\x94\x84\x6E\x49\xAD\xCD\x98\x8D\x25\xE3\x56\x20\x13\x71\x99\x09\x3A\x02\x8C\x51\x2C\x69\x95\x01\x7A\x1D\x27\x0F\x8B\x52\x31\x0A\xA3\x59\x8E\x96\x25\x46\x45\x8A\x74\x07\xC7\x9D\x77\xDB\xCB\x36\xB1\x39\x69\xDD\xC1\xCB\x52\x68\xC7\x9D\xF8\x32\x96\xE7\xB2\xB8\xC7\x9D\xB0\x9C\x72\x91\x92\x1E\x28\x55\xFA\x6E\x14\x9D\xB4\x5C\x87\x53\xD6\x64\xCA\xA6\x45\xFE\x58\x4E\xD9\x5C\x94\x32\x54\xF2\x14\x1F\xA5\xBB\x44\xEC\xE3\xED\xE8\x34\x3D\xCD\x3B\x77\x91\x49\x8A\x31\x1B\xA3\x6B\xAE\xBC\x23\x61\x79\x90\x9A\x9D\x5A\x54\xE5\xA9\x6D\x2D\x19\xD1\x26\xD5\x45\xB6\x9E\xFE\x28\xA7\x2A\xE9\xB8\xB5\xA4\x55\x85\x8A\x20\x66\x03\x2A\x05\x49\x80\xA3\x9D\x92\x01\x1E\xB9\xA5\x11\xA0\xE9\x87\x0F\x52\x4C\x5C\x52\x16\xED\xA2\x81\x63\x2A\x5D\x97\x24\x13\x47\x9C\x7E\xA9\xDA\x80\x7A\x30\xED\xEB\x48\x2C\x65\x15\xF9\xA2\x83\x7B\x87\xCC\x73\x0D\x3A\x7A\x5D\x2A\x82\xB1\xC8\x8E\xA3\x9C\x69\x62\xD6\x44\x22\x1F\x48\x4F\x85\x66\xEB\xE9\x3F\xF1\xB2\x0C\x96\x45\xBB\xAC\x7F\xBA\xEF\xF6\xE0\xE7\x3D\xF4\x79\x21\x93\x41\x68\x0A\xC2\xE7\x42\xA4\xD3\xB8\x0B\x51\xE3\x3D\x0F\xB2\xF1\x1E\x31\x56\x5A\x04\x09\x83\x92\xD6\x61\x0A\xC7\xFA\x02\x4A\x13\x39\x6A\x8C\x83\x73\x73\xB1\xE5\x04\xD4\xE9\x01\x5D\x3E\xA4\xB8\x56\xDA\x12\xC6\x45\x29\xED\x2F\xAE\xEB\x36\xDF\xD0\xF1\x43\xA0\x8D\x3C\xB3\x8A\x1F\x94\xA2\x1D\x49\x4A\xC8\x19\x37\xE0\x5B\xAC\x21\xC9\xA2\xD2\xBF\x91\xFE\x78\xD3\x8A\x6E\x83\xF5\xA8\x81\xFA\xA8\x58\xEF\x6D\x58\x9C\xD3\xE6\x42\x92\xC9\x6E\x5D\xAA\x9A\xD1\x3B\x21\xC9\x2A\xF8\x99\xAC\x8D\x91\x85\xD3\x9C\x21\xE6\x4A\x60\xFE\xBC\xB4\xED\x60\x08\x9F\x6C\x08\x2A\x6B\x48\x39\x1A\xA9\xB6\x6A\x49\xE0\x7E\x01\xF3\xC2\xE9\x04\x1F\x99\xB2\x43\xA9\x73\x4D\x5E\xFB\x25\xB3\x5E\x06\x13\xF5\x9C\x20\x9D\x0D\xD8\xFA\x12\xE6\x6B\x48\x65\xFD\x73\xB4\x98\x32\xBB\x69\xA8\x40\x82\xEA\x4C\xF2\x4E\x20\xA9\xEE\xB1\x73\x72\x2C\x9B\xC4\xF9\xA4\xA8\x2D\xBE\xCC\x40\x77\xB7\x34\xE6\x33\x90\x48\xA8\xC6\xA9\xE8\x92\x93\x20\xBA\x21\xEB\x8A\x0A\xF4\xD5\xE6\x92\x6A\xC1\x92\xD2\xD1\x41\x16\xE5\x26\xEC\xD8\xA4\x9B\x0A\x89\xC7\x2D\xA4\xB4\x48\x80\xAC\x3D\x8C\x34\x38\xA3\x0A\x74\x6C\x21\x0D\xB6\x32\x62\x70\x75\xFE\x9F\x14\x52\x29\xC4\xA2\xBD\x9E\x34\xBD\xA3\xCB\x84\xC4\x0E\x6D\x71\x4E\x17\xEF\x06\x93\xF5\x5A\x16\x89\xFC\xB0\x2C\xEB\xCE\x08\x46\x8E\x67\x82\x68\x26\x1A\x39\xCD\x39\xEA\x89\xA5\x9B\xCF\x57\x9E\x6F\x9C\xAF\x8C\x43\xBA\x3B\xCF\xCB\xCD\x4D\xBA\xE8\x7C\xA5\x41\xBA\x53\x44\x62\x5E\x85\x0E\xED\x19\xE1\x23\xA7\x33\x6D\x42\x62\x06\x11\xE2\x02\x7A\x9E\xBE\x49\xFC\x51\x12\x79\x6C\xA1\x8D\xBC\xE9\xF3\x95\x5C\x51\x3A\xA7\xD9\x20\xC5\x6E\x21\x27\x56\xEA\x08\x1B\x20\xD1\x6C\x58\x2D\x26\x49\x8E\x36\x22\xAD\xD5\xE8\xB6\x41\xA7\x4F\x6C\x4A\x4D\xDE\x53\x88\x34\x4C\xD6\x04\xAC\xF4\x6B\xA4\x81\xCB\xD6\x16\x48\x96\x03\x30\x4B\x5F\x56\xEC\xC4\x62\x43\xAC\x53\xE7\x8D\x06\x1D\x01\x48\x1D\x70\x3A\x2B\x44\x27\xBA\x2B\x22\xD5\x6B\x44\xD2\x07\xD9\x50\x3C\x75\x0E\x12\xAD\x8A\x59\x14\x95\x52\xEE\x46\x6A\xCC\x54\xDF\xFB\xFF\x66\x71\x41\xB4\xA8\x98\x83\x29\x4E\xCF\xD3\xE5\x51\x15\xF3\x68\x2F\x44\xC3\x6A\xDE\xCD\x5D\x20\x36\xCD\xE0\xA0\xB2\x8D\xBB\x9B\x7A\xDB\x78\xBB\xDF\x67\x42\xBB\xDF\x8F\x99\x64\x3F\x45\x75\x5A\x0C\x74\x25\xEE\xB8\xDC\xEF\x68\xA8\xA1\xB2\x7E\xCF\xAC\x40\x75\xEB\xDC\xE0\xBA\x66\xD3\x1D\x29\xBA\x51\x63\x88\x7A\x36\x28\x91\xAC\x9A\x0C\x16\xA5\x0C\x31\x3F\x58\x36\x0A\x52\x3B\x8B\x54\xCF\x14\x1B\xE3\xE4\xE1\x01\x90\x21\x13\x55\xDF\x06\x4F\x04\xC6\x02\x79\xF9\x88\xEA\x5B\xE7\x99\xD0\x68\xAA\x6F\x4D\xD6\x37\xD2\x4D\x1A\x64\x93\x94\x3C\x99\x88\xFA\x56\x92\xDE\x28\xEB\x9B\x66\x0F\xBF\xBE\x0D\xB5\x68\x38\xA3\x45\x69\xD5\xC6\xF3\x74\xBE\x43\xA8\x5D\x88\x46\xA8\x22\xE8\x1A\x1C\x59\xB9\x36\xB3\xBA\x1D\xC9\x22\x29\x32\xA3\x8D\x63\xDA\x86\x65\x39\x63\xB2\x28\x35\x5B\x32\x96\x79\x12\xAD\x6F\xD2\x2D\x23\xF2\xB3\x5C\xEA\x0E\xA6\x29\x1A\xE5\x61\x51\x8E\xEE\xC0\xEA\x4A\x19\x3F\xDD\x42\xE2\xD5\x82\xBE\x38\x01\xF6\x25\x95\xF4\x8B\xA5\x2A\xA7\x8A\x6D\x29\x05\x28\xB4\x40\x71\xE7\xA4\x23\x2C\x2A\xE9\xA8\xD4\x4F\xA4\xA7\xDF\xE0\x0E\xC7\xEB\x60\xAB\x15\x6E\xEA\x88\xDF\xD4\x91\xFF\xD6\xA6\x8E\xFC\xB7\x35\x75\xE4\xD8\xA6\x8E\x34\x37\x75\x24\xD8\xD4\x34\x6D\x34\x35\x35\x8D\x57\xBA\x12\x2A\x1A\x3C\x47\xD4\x0E\xB5\xF8\x26\x52\x0E\xF6\x26\x51\x4B\xD6\x81\x38\x9A\xA3\x36\xF2\x29\xB4\xE6\x5F\x30\xD1\x17\xA9\xAD\x99\xC1\xF6\xDD\x0C\x49\x17\x10\xFB\x8D\xD7\xA4\x14\x92\xB2\x47\xC9\x27\x46\xB1\xBA\xF8\xCB\x91\x03\x34\xB7\x70\x5B\xC5\x72\xD2\x3A\x1C\xC9\x39\x99\xCA\x64\x9A\x46\xA2\xF4\x0E\x9D\x75\x66\x69\x49\x22\x39\x51\x25\x4B\x3D\x47\x13\x73\x59\x27\x24\xA5\xC5\x56\xA9\x13\x92\x7A\x07\xC9\xBD\xD3\x2D\xF6\x18\x13\x20\x6C\xAE\x64\x8E\xBC\x5D\xCD\xA6\x7F\x62\x82\xB2\x9E\xA3\xB4\x61\x1A\x24\x85\xA7\x58\xA9\x51\xB9\x7E\x6A\x82\x36\x4B\xF2\x3A\x48\x67\x09\x8B\x27\x67\xA5\xB6\x61\x4F\x9E\x66\xF0\x2E\x46\x4C\xC1\xA2\x1A\x44\x7E\xD8\x62\x91\xA1\x88\x25\x32\x21\x21\x05\x30\x36\xF1\xAE\xEF\xD8\x15\x9C\x6B\x95\x73\x20\xB7\xF6\x9C\x03\x6C\x5E\xC1\x59\x8B\xA5\x5A\xC1\x71\x8E\x3A\x00\x05\x1E\xE8\xCC\x40\x06\x39\x67\x8B\xCC\x52\xF4\x59\x23\xA8\xFC\xCA\xF0\x15\xF8\x89\xEA\x5B\xC4\x1B\x12\xC3\xEF\xF1\x48\x48\xA2\xA7\x80\xE8\x41\x55\x18\x75\x1D\x54\x32\x58\x04\x15\x64\x2A\xAA\xAB\xD5\xF2\x63\x10\xDD\x5B\x52\x48\x7C\xF2\xAB\x71\x81\x39\x3A\x66\x3B\x1B\x39\xEE\xC8\x52\x15\x1D\x91\x73\x16\x4B\x00\x50\x59\x29\x3D\x79\x1F\xDE\x08\xB4\x9E\xA1\x1A\xCE\x20\x2B\x1B\x34\xA3\x49\xD2\x46\xB6\x93\xAC\x5D\x43\x5A\x9D\x23\x53\x72\x6C\x27\x1D\x99\xB8\xFD\xBF\x48\x91\xE9\xED\xE3\xB5\x23\x97\x9F\x8B\x25\x69\x5A\x6E\x42\xA3\xB9\x09\x59\xFB\x84\x6A\x42\x83\xDB\x4E\xD2\xB3\x1A\x1B\x0F\xA1\x29\x57\xB5\x1E\xC8\xD6\x93\xD3\xA0\x6A\x22\xBF\x7E\xD5\x6F\x46\x73\x9B\xFA\xCD\x27\x1B\x8F\xD0\x34\xA7\x2C\xE1\xAB\x14\xDC\x6C\x32\xB3\xBC\x0B\x51\x91\x6A\xD2\xBA\x9E\x36\x6E\xE3\x71\x8D\xFE\x5F\x56\xE5\x5F\x6C\x3C\xB9\xCC\xD0\x69\xF3\x7F\x47\xE3\x19\xDC\x45\x7D\x52\xDB\x58\xAC\xE4\x7A\x0D\xB6\xD8\x47\x69\x58\xD6\x4E\x2D\x40\x0C\x98\x34\xBF\x42\xFA\xF5\xC6\x11\x2D\xF3\x82\x61\x8E\x96\x74\x80\x55\x16\xAB\xA5\x72\x13\x79\x66\xB3\xC2\x34\x6D\x31\x87\xBC\x83\xF4\xF7\xE1\xE2\xC9\xB9\x48\xD6\x64\xF3\x33\xEA\xE2\x2A\x2A\x63\xCF\xC8\xC4\x32\xD3\x1D\xEA\x08\x99\xB0\x3C\x84\x90\x74\x98\xE6\x34\xA2\x7A\x34\x39\x4B\x73\x38\x93\x02\x84\x32\x48\x9B\x86\x24\x2D\x33\xCA\x1E\xB4\xD2\xE3\x4D\x85\x5A\x96\x92\x32\x61\x1A\xE9\x68\x6F\xEC\x1B\xE1\x42\x34\xAD\xE6\x02\x8B\xF9\x08\x6D\x7D\x26\x9A\x82\xEE\x67\xA3\x80\x62\x42\x16\xF4\xFF\x61\x25\x4F\x25\x76\xB0\x64\x60\xE2\x67\xFF\x10\x36\xF4\x42\xA4\x68\x4A\x72\x03\x6C\x3E\xED\x9C\xA3\x81\x34\x3C\x29\x76\x1E\x62\xE7\xAF\x15\x48\x1A\x8B\x7C\xD1\x7E\x46\x4C\xFB\xCE\x28\xA9\xCE\x66\xBD\xB1\x62\x2F\x21\x0A\x6E\x6B\xFE\x99\xA9\x9C\xF8\x0C\xE6\x45\x29\x4B\x28\x24\x93\xC9\xFA\x5D\x75\x16\x77\x9B\x68\x6B\x45\xD1\x19\x94\x75\x61\xA9\x60\x55\x1E\x9F\x35\x54\x9B\x1B\x6A\x63\xDD\xA1\xA5\x25\x97\x8A\x96\xCC\xB4\xDA\x51\x4B\xE1\x3A\x31\xCA\xAD\x97\x78\xBF\xCF\x96\xFC\x74\x9E\x1B\x71\x26\x6A\xBC\x8C\x61\xAB\xDC\x17\x3A\x74\x17\x5C\x77\x8E\xE2\x26\x87\x2C\x3F\x2A\x3F\xE8\xAF\xFA\x3A\x1F\x32\xE8\x4E\x94\x74\xCA\x3A\xEF\x1E\xA3\xE9\x4D\x77\x92\xF2\x98\x41\xE7\xA5\x1F\x59\xFF\x75\x8C\xCE\x7A\x63\xD4\xF8\x8E\xB6\x6C\xB2\xD8\xD7\x13\x63\x8D\xB6\x8B\xB2\xEF\xE8\xAD\x56\x73\x6E\x8E\x4D\x8D\x8E\x34\x74\x9B\xB8\xC1\x72\xB3\xF9\xD6\x69\x5B\x2D\xE0\xC4\xC4\x2A\x98\xF6\x88\x3A\x68\x01\x27\xDA\xFC\x19\x0F\x7C\x1E\x32\x31\xA6\x4C\x6F\x6B\x2D\x1A\x82\x46\xBA\x78\xA0\x91\x15\x12\xB2\x03\xC7\x14\x39\x34\xF8\xD8\xC5\xE0\x63\x17\xC3\xD6\x45\x1E\xE9\x4B\xCC\xB4\xEA\xBC\xC5\xF0\xCF\x5B\x68\x38\x8F\x1F\x46\x7B\x8B\x30\x4E\xD0\x70\x9B\x4A\x9A\x49\x7A\x79\xFD\x43\x67\xA5\xF2\xEA\x56\x5D\x44\xD0\xB0\xCC\x31\xCD\x19\x59\x24\x43\x49\x7A\xFA\xB3\x74\x5A\xA8\xF1\xE1\x1E\xED\x65\x4C\x35\x13\x8B\x88\x8C\xA5\x01\x9A\xCE\xE4\xEC\x99\x9C\x3D\x93\xAB\xDD\xE4\x6A\x37\xFD\x6A\x36\xFD\x6A\xA6\x3D\x33\x6D\x78\xCA\x39\x41\x3D\x73\x5F\x27\x5D\xA0\xC6\x85\x68\xB2\x8D\xB0\x98\x1D\xCD\xC6\xC8\x3A\x60\x2E\x9E\x4D\xD8\x98\xB5\xF4\xF9\x0D\x2A\x32\x54\x21\x94\xA2\xC1\x29\x1A\x7E\x8A\x86\x4A\xD1\x79\xC3\x6B\x95\x89\x88\x29\x98\x76\x5D\xA6\x6D\xB0\x9C\x7F\xD2\xB6\xF8\x77\x56\xB5\x1C\xE3\xC9\x3B\xC6\xF2\xE6\xF4\x53\x31\x6B\xD9\x09\x91\x91\x04\x1B\xE5\xA5\x1B\xE1\xC4\xDC\x8B\x8B\xB8\x4A\x54\x88\x22\xD9\xC6\x17\x9D\x2E\x7D\x0B\x33\x4E\xC5\x3C\xD5\xA8\x23\x6E\xC9\xB7\xAE\xAA\x16\xBF\xAA\x64\x83\xAA\xDA\x5E\x96\x02\xE7\xC3\x77\x07\x2C\xC4\x8A\x1E\x1E\x68\x10\x6D\xA9\x34\x81\x2C\x4B\xA9\x7C\x88\xA8\xA5\xEA\x6C\x89\xA0\x16\x65\x95\xA4\x59\x52\x24\xAF\x6F\xCA\xAA\xF3\x65\x5F\x8B\x34\xE9\x90\x66\x23\x4B\xE2\x27\x56\x93\x50\xCC\x25\xC9\xBC\x69\x2E\x21\xE5\x69\x92\x62\x9C\x26\x9C\x58\x51\x29\x8D\x70\xD2\x74\x6A\xC1\x37\x33\x63\x2C\xA8\x66\x31\x9D\x40\x4A\x55\x69\x7B\x03\xB6\xD4\x4E\x11\x53\xB3\x9A\x62\xC5\xF8\x55\x3E\x5A\xCC\x59\x14\x38\xB2\x28\xD5\x50\xD1\x6D\xD9\x66\x83\x7F\x3C\x01\x9C\x08\xB3\x57\x55\x7D\x0B\x94\x19\x42\x2D\x11\x1B\x66\x7F\x56\x68\x0C\x78\x1B\x79\x7E\xB0\x58\xC3\x35\x84\x26\x86\xC6\x54\xA4\xD1\xEE\xA4\x39\x1E\x83\x43\x1B\x4E\x82\x46\x1C\x87\x36\x54\x68\x3A\x01\x4B\x53\x27\xE4\x48\xFC\x9D\x88\x6D\x58\xAF\xA9\x09\xD5\x81\xCB\x02\xE3\xE7\x38\x07\xB2\x1A\xF3\x95\xC7\x39\x89\x95\x54\x1A\x8D\x4D\xE2\x6A\x35\x66\xDA\x80\xFF\xF1\x63\xD5\x2F\x6C\x8E\xCB\x66\xF6\x77\x70\xFA\xE4\x80\x3A\x07\xF4\x27\x53\x83\xA7\xEE\x16\x7F\xD6\x94\x51\xD0\xAE\x58\xE4\x22\x7D\x94\xF9\x91\xA2\x19\xD5\x9E\x8B\xB6\xC4\xD6\xA2\x60\xFD\x69\x7E\x14\x1A\x27\xA4\x71\x42\x1A\xD7\xAB\xE6\x4C\x64\x0D\xE1\x2A\x87\xF2\xF8\x45\xB3\x6E\x36\x91\x6F\x3C\x6C\x15\xAE\x7F\x26\x77\x0A\x1D\xA8\xE5\xB4\x69\xC0\x66\x23\x62\xC5\x9C\x31\x8D\xC5\x54\x95\x00\x23\x4E\x03\x12\x76\x60\x99\x3D\x16\x02\x8D\xDA\x91\xF3\xA4\x7D\xF4\x1C\x79\x14\xFD\x49\x17\x28\xB4\x4D\xE1\x18\x76\x8C\x04\x24\xC8\x9F\xF5\xC7\x68\xC3\xE8\x59\x7A\x30\xA7\x35\xCE\x01\x15\xD1\x86\x29\xB6\xD9\xB7\x58\x91\x47\x3A\x2D\x15\x77\x49\x41\x11\xB1\x56\xB3\xC8\x90\xE1\xBC\xB3\xE8\x98\x24\x77\xCD\xFA\x29\xB5\x05\xCC\xA0\xE0\x7F\x01\xB3\x66\x06\x71\xC5\xDE\x59\x54\x6A\x24\x34\x91\x82\x20\x6F\x0C\x65\x6B\x9A\x84\x71\x63\x45\x32\x35\xA0\xB3\xE0\x2A\x9B\x5D\x8C\xF1\x3C\xB7\x49\x2C\x9F\xB6\x2E\xAF\x84\x45\x9A\x97\x55\x89\x8F\xAB\x3C\x46\xD5\x7E\xD5\x60\x7D\x28\x74\x31\xDB\x50\x4A\x53\xC5\x28\xA5\x23\x58\xBE\xE5\xA1\x49\x2D\x14\x8D\x0B\x8A\x86\xAF\x44\x42\xCA\xD8\x5B\xEA\x6E\xA2\x11\x50\x40\xA1\x2E\x26\x1A\x92\x11\xE5\x1B\xB2\x35\x56\xA7\x62\x74\x98\x22\x97\xCE\x94\x65\xA7\xFC\x8B\x89\x94\x87\x14\x9F\xB5\x64\x63\x7C\x31\xD1\x68\x5C\x4C\x4C\xD9\x89\xC0\xC5\x44\x8D\x35\x96\xC9\x3D\x94\x66\xA7\xC2\xDA\x27\x82\x5B\x46\x3B\x58\xD4\x78\xA3\xA8\xCD\x05\x4D\xC9\x1B\x69\x89\x71\x0B\x1A\x13\x05\xB5\x6C\x2B\x50\xD0\x84\x5F\x50\xAB\x61\xCC\xD0\x6A\x14\xD4\x6A\x14\x94\x8E\x57\xE8\xCA\x65\x2E\xC1\x39\x30\xE8\xE7\x62\x36\xCE\x4A\x9C\xF8\x36\xB9\xB4\x62\x98\xB2\x63\x81\x82\xC6\xB9\xA0\x16\x17\x94\x56\xAE\x94\x28\x68\xAA\x21\x7C\x43\x27\x36\x64\x83\x29\x2A\x3B\xCF\x32\xFF\x0C\x43\x6E\x76\x06\x45\xD1\x0C\xC9\xBB\x35\x5A\xB4\x08\xA0\xE5\xBC\x6F\x67\xE8\x9A\x60\xC3\x2F\x19\x27\x77\xB4\xBA\x0D\x45\xE7\x66\xDA\x61\x90\xF0\xB9\xB3\xB5\xC8\x4B\x21\x69\x42\xCD\xB2\x92\x2C\x7D\xA5\xB4\x64\xA1\x0F\xA6\xFF\x8E\x25\xC8\x3A\x01\x88\x81\x22\x90\x64\x3C\x86\x6F\xDA\x49\xBC\x66\x05\xB6\x15\xD0\xA0\x00\x73\x30\x3E\x65\x98\xF3\xC7\x98\x61\xA9\x38\x98\x67\xAF\x27\x35\x7F\xC1\xA0\xF1\x48\x7B\x4D\xB1\x0B\x58\xA4\x4E\xCE\x8C\x86\x98\x92\xD6\x10\xA2\xD4\xAD\x0F\xEB\xA8\x8D\xFA\x6C\xAE\x1C\x9D\x92\xD0\x61\x0D\xAA\x8B\x20\x4D\x0C\x60\xB1\x72\xB6\x9C\x98\x48\xA0\xA6\xEB\x86\x61\x44\xCC\x04\x3F\x10\x8B\xC6\x25\x95\x0A\x33\x51\xAB\x39\x63\xBB\x60\xD3\xA2\x56\x39\x3B\x74\x68\xAC\x63\x71\x49\x2A\x16\xF4\x83\xC2\x87\xDC\x55\xC8\xDF\x69\x78\x37\xFB\x49\x45\x7D\x92\x1D\x03\xA4\x3B\xF3\xC6\x29\x82\x99\x68\x52\x3D\x2D\x6E\x6D\xCA\x02\xE7\x20\x84\x49\xE9\xD2\xAE\x65\x53\x8C\x4B\x52\x46\x23\x97\x8B\x8F\xCD\xF6\x31\x01\x16\xCB\x8C\xAB\x00\x5C\x0A\x16\x8B\x24\x26\x5E\x87\x66\xF0\x91\x17\x1B\xBF\x71\xF4\x3A\x97\x51\xBC\x09\xBA\x84\xF7\x92\xE2\x8F\xE6\x97\xC4\x61\xA3\xD6\xD6\xBD\x1A\x2A\x2B\xD3\x62\x8F\x4B\x97\x81\x74\xD1\x1D\x6D\x5C\x96\x6A\x9C\x49\x38\x5A\x3D\xCB\x77\x63\xC4\xF4\x2B\x8D\xDC\x90\x3C\xB7\x4E\x7B\x64\x4D\xAD\x57\x39\x43\x5A\x22\x35\xED\xE0\xF5\x6A\xCA\x1D\x5D\x44\x15\x04\x9D\x20\x81\xD9\x56\x69\xE3\x82\xB5\x16\xBC\x60\xAD\x35\xD1\xD6\x6C\xB0\xA9\x61\x8A\xBB\x91\x1B\xBE\x65\x1B\xCC\x13\xDA\x4C\x89\xF3\x59\x74\x44\xD9\xE2\x36\xEC\x48\xC0\x4C\x29\x6D\xEF\x69\x91\x36\xB8\x04\x10\xB6\x83\x11\xB0\x50\x6A\x34\xF1\xAA\x9A\xD7\x28\x64\x89\x46\xD1\x85\xF9\x88\x10\x6D\x74\x5A\x96\x4F\x76\xB4\xBA\x73\xE0\xA5\x5B\xC7\x80\x6D\x12\xA5\xEF\xA5\x8D\x00\x49\x68\x6A\xE3\x4B\x68\x36\xCC\x3C\xF9\xF9\x32\xE4\x35\xF8\xA0\xA5\x16\x96\xD0\x04\x36\xF2\x11\x91\xE2\x99\x11\x41\x7C\x05\x6E\x90\x4B\xF1\x4C\xDE\x26\xA7\x8B\xBE\xF4\x1D\x2D\x89\x69\x95\xD5\x88\x1D\x39\x36\xAB\x86\xCC\x6A\x44\x64\x55\x31\x70\x23\x9C\xD5\x48\x48\x98\x54\xB7\x35\xB6\xF8\xAB\x49\x61\x52\x60\x3E\x20\xAB\x86\x17\x75\x4F\x59\xD5\x1C\xAC\x66\x75\x49\x76\x36\xB7\x84\x6E\x47\x38\xAB\x94\x4F\x5A\x32\xC8\x3B\x49\x95\xE6\x22\x2C\x22\xC3\xF3\x64\x84\x84\x66\x26\xA7\xEF\x53\x5A\x3C\x02\x82\xA7\x5A\x80\xFB\x4D\x05\xFE\xD4\x67\xC5\x2C\xFB\xAF\x2C\x54\x4D\x51\xA3\x1C\x2D\x31\x19\x01\xCF\x86\xB2\x76\x24\xC5\x4C\xD2\xD5\x69\x92\x66\xD7\x7C\x0E\x51\xA3\x23\x8C\x61\x43\xD4\xB0\x2B\x68\xA0\x75\xAA\x2C\x03\x3A\xED\xBE\x29\xD6\x89\xEA\x4D\x38\x49\x1B\x9D\x2F\xBC\x7C\xAB\xDC\x69\x2F\xD8\x75\xEB\xBC\xF3\xF4\x0E\x9E\x77\x81\x58\x4F\xF7\xCB\xFB\x0D\xCA\x0A\x49\xAC\x98\xDE\xAE\xAE\x3C\x74\x35\x58\x55\x1F\x37\xE8\xD8\x44\xD2\x46\x0E\x64\xD9\x92\x0C\xA4\xFF\x85\xD7\x5F\x29\x17\x24\xBA\x86\x21\xBE\x36\x49\x3E\x27\x9F\x71\x3B\x5B\x37\x11\x45\x03\x36\xB2\xF9\x98\x0E\xE6\x85\x73\x3D\x4E\xB6\x81\xA5\xE9\x69\x5B\x7F\xCC\x4F\x0E\x16\x95\x71\x9B\xB9\xE0\x1B\x42\x32\xC9\x76\x4D\x4E\xEA\xAE\x21\xB1\xB0\x71\x62\x45\x5B\x59\x90\x9A\x0B\x40\x86\xFB\xC5\x00\xF5\xB3\x4D\xEC\x1B\x93\x4F\x55\xFC\x80\xB9\xC8\x64\x69\x83\x47\x0C\x60\xDA\x2B\x89\x41\xFE\xB5\xDB\x68\x90\x03\xF3\x4C\xD4\xF1\x16\xD1\xC3\x1C\x2E\x1B\x61\x3E\xB9\x49\x97\xEA\xE8\xBA\x52\x64\xF2\x60\x30\x2D\x4E\x22\x47\x02\xE5\x24\x67\xCE\xD2\xDB\xA2\x67\x8B\x9D\x5A\xC2\x46\x27\xB1\x7C\x72\x4E\x63\xBB\x4F\x5B\x25\x12\x26\x2F\x96\x67\x6E\x9A\x93\x58\xA2\x24\x94\x4D\x07\xB3\x72\x98\x61\xD1\x1F\xC0\xB2\x0A\x60\x32\x19\x80\x82\x25\x59\xB0\x23\x44\x17\x89\xF4\x8A\xB9\x08\xCD\xAC\xB6\xD8\xAF\xFA\x23\x41\x91\xBB\x01\x23\x78\x9A\x93\xE0\x1B\x05\x06\x4B\x69\x23\xDF\x9B\x17\x29\xF1\x60\x6B\x6D\x48\x6C\x83\x65\xDD\x65\x60\x9C\xFB\x46\x48\x2C\x44\xF5\x4D\x90\xB4\x17\xB2\xC8\x3E\x33\x48\xE4\xBC\x40\x7E\xD4\x79\x5C\x84\x36\x40\x82\xA6\x61\xD5\x92\xA4\x8C\x46\xDA\x3A\xB1\x23\x82\x3E\xC8\xF2\x75\x5E\x96\x59\x74\x90\x6F\x7A\x08\x42\x8F\xA6\x10\x4B\x54\x6F\xD2\x99\x20\x56\x1E\x56\x50\x48\xF6\x1B\x8C\x22\x2B\x20\x73\xA0\x95\x13\xA7\xCB\xFF\x49\xE7\x5D\x2C\xA5\x86\xCB\x65\xFD\x26\xEC\x08\xEB\x69\x91\x89\xD9\xF1\x22\xF7\x3B\x3E\xAC\x3A\x85\x15\x0C\x08\xF2\x95\xF2\xC8\x66\x4A\x14\xCB\x4F\x52\xE9\xB1\x06\x95\x1E\x0C\xAA\xF6\xC4\xC9\x60\xF8\x65\xF2\xEA\x57\xA4\x11\xD8\x4F\xD5\x8E\xD9\x89\x41\x5A\xCF\x8F\x73\x00\x11\xE7\xCD\x56\x9C\x37\x5B\x71\xDE\x5D\xEA\x4C\x6F\xC6\x29\xA0\xD8\x7D\xC5\xFD\xCD\x59\x5C\x6D\xC0\x2C\xDB\x12\xB1\xDA\x9B\xA4\x02\x13\x51\x69\x0E\x9D\xE2\x5A\x62\xC3\x9F\x50\xF7\x51\x2C\x26\x01\xB2\x09\xDB\xEA\xD0\xD2\x82\xAA\x8D\x3B\xB0\xC4\x4E\xD8\x86\x8D\xE9\xBB\x6F\x93\x77\xD1\x04\xB1\xCA\x57\xED\x45\x5F\xB0\x0D\xEB\xA7\xA8\x66\x8A\xBF\xBA\x37\xE8\x7E\x37\x50\xF4\x99\x11\xE8\x0A\x06\x8B\x7C\x2A\x0A\xD2\x70\x70\x31\x93\x8F\x44\x1A\x0A\xC2\x35\xD0\x8E\x5C\x63\xF6\x26\x45\xFB\xD2\x0F\x3A\xEB\x04\x4D\x17\xB3\x06\x31\xF7\xD0\x97\x37\xCA\x1A\xD2\x50\x98\xC5\x82\x82\x7C\xDB\x40\x15\x4E\xAC\x32\x10\x28\x9C\x6E\x9D\x81\x38\xCA\x67\xE9\x31\x96\x30\x97\x1B\x4E\xF4\xE5\xC3\xE9\x9A\x88\xF5\xF9\x04\x46\x47\x25\xDD\xA1\xD9\x62\x1E\xA1\x21\x78\x18\xD8\xB4\xD8\x37\x80\x31\x9A\xF3\x13\xA0\x3F\x4B\x27\xE7\x0C\x1B\x9D\x6F\x00\xFD\xB9\x6C\x72\x2E\x22\x55\xDC\x8A\x89\x60\x54\x64\x6B\xD0\xC1\x62\xDD\x19\xAD\xD9\x11\xE7\xF1\xD1\x62\x9D\x8D\xC5\x69\xCE\x61\xA0\x3F\x32\xFC\x0B\x40\x7F\x9A\xC2\x1B\xC7\x84\xBF\x97\xC3\x1B\x2C\x1E\x9A\x56\xCA\x82\x68\x12\xC8\x1A\x76\x54\xDA\xF6\x13\x8B\xB4\x24\x06\x97\xE6\x62\x34\xF2\x7C\xED\x56\x64\xDD\x8B\xB6\x03\xE6\x62\x3E\x4F\x4C\xDB\x7C\x91\x9D\x8E\xAE\x57\xA5\x58\xEE\x67\x29\x5F\x1E\xF5\x55\x19\x8C\x1F\xBD\x3E\x7E\xF4\xCD\x91\xB3\x76\x50\x52\xDB\x45\x37\x69\x27\xE6\xE2\xCE\x68\x8D\xFB\x84\xAF\x7B\x82\x6D\xCD\x71\x98\x18\x69\x6D\xB4\x8D\xC5\x29\x64\xDD\x9F\xCA\x88\x7E\x8E\xF4\xA9\xEA\x92\xC1\x4C\xBE\x1A\x7C\xF9\x08\xEB\x7A\x24\xE3\x65\xA4\xA8\x81\xD6\x31\x41\xDA\x92\x89\x7D\x1B\xC4\x56\x34\x49\x3F\xD9\x91\xC9\x64\x37\xAC\x21\xE2\x32\x5A\x64\x75\x3B\x86\x64\xD6\x1B\xC1\x29\xF5\xA8\xF7\x2D\x6A\xFD\x46\x65\xCB\x8B\xFB\x8D\x4A\x89\x90\xB2\x82\x89\x4A\xDF\xCB\x65\xB2\x52\x6C\x6D\xC5\x78\xF5\x42\x92\xCF\xE9\xA5\x7E\xBD\x70\xAD\x68\xFF\xFF\xAE\x95\x71\xAB\xE3\xAF\xAB\x05\xFF\x10\x3B\xCD\x7A\x4C\xB8\x1A\xA2\x8B\x28\x13\xFF\xA5\xAE\xC7\x75\xA0\x31\x27\x25\xBD\x34\xA5\x05\xEB\xE0\xFF\x9D\x1A\x20\xAE\x0D\x15\x7E\xE2\xB1\x85\xE7\x7D\x93\x28\xA9\x1D\x65\xB3\x94\x62\x5A\x18\xE4\x5C\xB2\x8C\x83\x14\x14\x0A\x61\x49\x58\x9B\x97\x27\xC9\xB8\xD3\xEC\x68\x87\x96\x5E\xC5\x92\xAC\x22\x47\x68\x47\xB3\x66\x92\xE4\x6A\x65\x9D\xAD\x4A\xE9\xA4\x7C\x2A\x6B\xB0\x99\x0D\x12\x7C\x61\x05\x37\xD9\xB8\x1D\xC9\x46\x95\x39\x72\x81\x24\xF5\xD6\x59\xD3\x8E\xB3\x52\x29\x33\x1B\xA5\xAD\x36\xC5\x1E\x38\xD3\x8C\xD8\x26\x49\xA2\x2C\x90\x57\x2F\xB5\x87\x16\xD8\xEF\xB5\xF1\xA1\x5B\xCF\xD3\xD2\x62\xBD\xF4\xB9\x59\x49\xA2\xE5\x7D\xAE\x67\x92\x35\xF2\x45\xE4\x3E\x52\x0A\x4E\xF1\xE1\x19\x57\x99\x28\xE7\x44\x31\xB9\xDE\x29\x59\x73\x6C\x17\x94\x4F\x01\xF5\xC5\x92\x04\xD3\x72\x7E\xFB\xA6\xFF\xFE\x36\xDF\xA0\x95\xA1\x24\x71\x9A\x84\x17\x64\xCB\x1E\x47\x12\x47\x0B\x49\xE2\x68\xBE\x24\x8E\xD8\x44\x10\x41\x69\x5D\xE7\x93\xBB\x74\x16\x49\xEB\xCD\x22\xE6\x95\xF2\xF9\x68\x63\xA7\xBC\x94\x05\x87\xA0\x21\x38\x04\x2C\x38\xA4\x2D\x66\x62\x2D\x6D\x23\x19\xD6\xD1\x68\xDB\x6B\x6B\x4B\xAC\x7F\x8E\xD0\x15\x6F\x9D\x8E\x3E\x69\x65\x90\xB3\x03\xBD\x1F\xF2\xDF\x5E\x80\xC0\x34\xEE\x79\x5E\x46\xCC\xF7\x38\xB8\x79\x93\x5C\x42\x69\x25\x12\x13\xFF\x8F\xFD\x20\xBB\x68\x92\x01\xFF\x9A\xA4\x5C\x43\x28\xF0\x4F\x54\x60\x62\x9C\xAA\x72\xB1\x64\x0C\x53\xEE\x28\x5A\x95\x06\xA1\x96\x35\x6D\x9D\x8E\x1F\xA3\x82\x20\xF2\x67\x25\xBC\x6C\x32\xA9\xC8\x8E\xD9\xE8\xCF\x4A\xA2\x4B\xDB\xA6\x28\x2F\x8A\xE9\x2D\xED\x78\x54\x1A\xB4\xCD\x69\x5A\x3A\x17\x5F\x60\xDF\x21\xEF\x17\x93\xA2\xD2\x28\x4F\x82\x72\x1C\x9A\xCA\xA0\x1A\x59\x53\xB3\xA4\xBA\xBB\x62\xD6\xB2\xA3\x6C\x1C\xA6\x79\x1C\x46\x79\x1C\xF2\x20\x4A\x6C\xCF\x46\xED\xF8\xF6\xAC\x3F\x22\xCD\xE3\x8E\x48\xDD\x36\xE5\x88\xF4\xAD\x75\xDA\x51\xB1\x1C\x5A\x72\xAA\xC8\xE9\x6C\xF5\xCC\xA2\x75\xCC\x97\x4D\xA3\xDC\x6A\xD9\xA8\xA8\x0F\xA2\xB6\xB3\xA6\x1C\x87\x51\xD9\xB0\x72\x1C\xC6\xE4\x38\xD4\x1B\xE3\xD0\x5A\x95\xD2\x78\x1C\x9A\x3C\x0E\x63\x62\x1C\x9A\x3C\x0E\x4D\x3B\xC6\xE3\x50\x72\xD6\x03\x43\x2D\xC6\xEC\xB2\x98\xD2\x72\x15\x5F\xE0\x79\x9E\xD7\x7A\x8B\x1D\xA1\xC1\x46\x06\xF6\x82\x83\x8D\x55\x29\x88\x40\x49\x56\xD0\x16\x93\x83\x2D\x26\x45\xA9\x82\x03\x8D\xCD\xF4\xD1\xF1\x89\x61\x5B\x83\x64\x20\x9A\xAD\x6A\x41\x4E\xA7\xAE\xFF\xDB\x84\x66\x8D\xE2\xD6\xA6\xF3\x30\x5F\x3C\x5B\x90\xAF\x1A\xEF\x22\x7C\x6B\xD1\x06\x5B\x8B\x46\x9F\x5B\x8B\xC5\x2C\x2A\xE3\x8A\x1A\xF7\x34\x52\x95\x8D\x62\x87\xC2\xEA\x13\x74\x52\xEE\xA1\xAF\x4C\x69\xB6\x4E\xB7\xF2\x0E\x78\x8F\xD3\x85\x4D\x12\xA1\x33\xF9\x3A\x43\xC4\x81\x2C\x3A\x74\xE4\xDF\x1C\x15\xDF\xDA\x91\xCA\xD6\x78\x17\x2E\x8A\x97\x0D\x1C\x78\xA3\xDC\x9C\xE7\xA4\xE8\x4A\x0A\xC5\xDE\x33\xA9\x35\x0F\x79\xBA\x83\xA2\x29\xFD\xEA\x31\x7F\xAE\x88\x85\xE6\x0A\xA9\xE7\x4E\xE3\x39\xDF\x64\x15\x30\x26\xCD\x05\x9A\xE8\x91\x69\x29\x81\x48\x1A\x31\xE5\x26\x82\x67\xC8\xA8\x98\x21\xD9\xEC\x24\xF7\x20\xD3\xD6\x07\x73\x71\x47\x97\x67\xCF\xD8\xAC\xFF\x0E\xED\x88\xF8\xDD\x74\xB4\x11\xB1\x9E\xDA\xE8\x6B\x4B\x33\x8F\xD5\xA7\x89\x4D\xFA\x34\xCD\xA0\x3E\x4D\x92\xA8\x20\x0D\xC7\xB9\x44\x38\x27\x7A\x9D\x0E\xA8\xE2\x52\xCB\x94\xD8\x34\xF8\xC7\x22\x68\x6B\xC5\x6C\x84\x6D\xB0\x9B\xBE\x64\x97\x2F\xDF\x2F\x3A\x4E\xAC\x43\x9B\x28\x6B\x3A\xA6\x6A\x3A\xE6\xCF\xBE\x31\x31\x9E\x63\x7F\xB9\x46\xC7\x9B\x7D\xA3\xD4\x86\xB2\x96\xE9\x5B\x4E\x24\xC1\x6A\x8D\x3E\xE4\xF7\x97\x60\xCD\x6A\xB2\x66\xC9\x6E\x70\xAC\xA9\x66\xB5\xFF\x4A\xCD\x62\xA3\x66\xFD\x08\xC4\x5E\xB7\xB9\x66\x59\x17\x5B\x2C\x9C\x19\xFF\xD4\x80\x6A\x55\x6B\x98\xC2\x3F\x6E\x75\xB2\xE8\x4B\x64\x30\x87\x8E\x36\xE2\xA0\x8D\x2A\x53\xD8\x94\xA9\x80\x65\x73\x3F\x27\xB9\xF1\x06\x0E\x4B\x56\xFB\x1C\x56\x70\x92\xA4\xE1\x97\xC6\x4D\xE3\x36\x85\x5C\x99\xA5\xD0\x26\xD5\x1B\x5F\xD3\x10\x95\xC7\x57\xC0\x71\xF9\x64\xB2\x7D\x8D\x92\x09\xA5\x4B\x65\x7B\x71\x75\x9B\xDC\x26\xD9\x02\x96\x88\x89\x93\x86\x55\x56\x17\x17\x11\x48\x39\x47\x92\xF1\x55\xA2\x55\x50\xCD\x91\x62\x10\xD2\x39\x2A\xCF\x91\x11\x31\x47\x22\x0B\xB7\xA0\x3F\x47\x6A\x2C\x71\xAA\x91\xAA\xFF\x86\x84\x6C\x63\x8E\xCC\xC6\xEC\xF8\x34\x32\x6E\x1D\x63\x31\x10\x7F\xB2\x4C\x8A\x29\x52\x53\x53\xA4\xA5\x64\x4E\x49\x1F\x2C\x4B\x1F\x6A\x7F\x69\x8A\xB4\x14\x77\x25\x21\x48\x4C\x92\x95\xA0\x5C\xF8\x26\x70\xC0\x19\x1B\xFB\x36\x5F\x0B\x1D\xE4\xE3\x5C\xDE\xA7\xD5\x68\x99\xDD\xC4\x07\x7A\xBC\xF5\xF2\x51\x46\xB8\xF5\xAD\xFF\xA9\xA1\x29\xF6\x88\xE8\xCF\xAE\x62\x1A\x75\xD2\x45\x29\x2A\x44\x27\x24\x49\x3E\x28\x31\x58\xF8\x85\xB5\x3C\xA4\x89\x6D\x17\x53\x33\xAC\x52\xDF\xC3\xEA\x2F\x48\xB4\x95\x7A\x49\xD1\x8E\x4C\xD3\xD2\xE7\x35\xA4\x6F\x8D\x9C\xC1\xC2\xF5\x72\xA8\x46\xC4\x50\x25\xA2\x97\x36\x1F\x44\xB7\x31\x0B\xD2\x68\x90\x53\x8D\xA1\xDA\x24\x30\x4B\xF4\x02\xD2\x94\x68\x2E\x56\x67\x52\x86\x14\x99\xA7\xBA\x9D\xC8\xE2\xB3\xC8\xEA\xB7\xD1\xD6\x56\xA4\xC0\xF9\xC8\x43\x61\xD5\x53\x31\x3E\x5B\x22\x96\x82\xA8\x45\x59\x61\x8B\xA8\xB0\x56\x1B\xD8\xA0\xCE\x23\x15\x63\xE7\x54\xFF\x62\xB1\xB5\x44\x51\x47\x53\xA9\xE5\xA6\x5A\xB6\x66\x19\x60\x6B\xD6\xC7\x35\xD4\xD5\x81\xE9\x6E\xF0\x4F\x4C\x1D\xBA\x8A\xCF\x6A\x24\xF8\x30\xE2\x22\xFF\xD8\xF4\x9C\xE0\xB1\xE9\x74\x41\x49\xDD\x3A\x6F\x8E\xB6\xD4\x46\xE7\x19\x3E\x3F\xED\x20\xFA\xAA\x43\x1D\x9C\x7E\xF2\x36\x62\xCF\xFB\x92\x88\x97\xB2\x89\x62\x92\x65\x62\x7E\xB1\x46\xC7\xB2\x2A\x25\xFF\x58\x96\xC5\x16\x54\x4A\x86\x4A\xC9\xB6\xD1\x79\x85\x53\x52\xB7\xC0\x64\x22\x82\xB8\xE4\x78\x65\x1F\xE2\x04\xDB\xE9\xE6\x0E\x8D\x3F\x5D\xDE\xE0\xB6\x31\x7D\xEF\x6D\x72\x22\x77\x3A\x8A\xF2\xC3\x46\x67\x37\xA8\xA3\x5C\xCD\xFA\x50\x02\xA3\x01\xCE\xB7\xA1\xB8\x0A\x74\x85\x9C\xB6\x14\x8B\x52\xBE\xDD\xEC\x58\xCE\xE4\x8B\xB7\x51\x6A\xD3\x5C\xAC\x98\x8B\x3B\x0F\x62\x39\xD7\xB0\xE0\x60\x27\x9C\x07\xB1\x34\xE8\x4C\x2A\x15\x69\x5B\xCE\x8A\x35\x7D\xB1\xB4\x49\x39\x11\x3E\x1B\x65\xC2\xC3\xE4\xAE\x41\xF6\xDE\xA3\x73\xB4\x49\xAA\x13\xC7\x6D\x93\xE7\x66\x11\x97\x33\xCA\x97\x2E\xED\x98\x1D\x29\x0E\x3A\x58\x74\x9E\x21\xA9\xBF\x38\x33\x27\x7D\x02\x8E\x38\x4E\x37\x93\x12\x4A\x52\x83\x46\x84\x55\x84\x77\x58\xFE\xD5\x6A\x31\xB7\xC4\xA9\x74\x49\x79\xB9\x35\xC6\xA5\x1C\xCC\x45\x9B\xD2\x8B\x4E\xF6\x07\x62\x94\xD4\x57\xA6\x3F\x7F\x9B\x2C\x03\x51\x4D\x93\xFC\x42\x90\x8A\x97\x28\x55\x83\xE9\xAB\xFB\xB6\x4D\xBF\x1A\x72\x64\x30\x72\xA2\x94\xC9\x16\x74\x26\x69\x26\xE7\xE9\x87\x2B\x85\x26\x98\x39\xDA\x24\x96\xF6\x23\xCD\x3E\x1D\xDA\xC4\x22\xD5\x34\x45\x1C\x69\x44\x1C\x09\x46\xAC\xA8\x49\x65\xE3\x27\x4A\xD3\x8C\x3F\x10\xEC\x1C\xDF\x19\xB0\x59\x99\x2C\xEF\x05\x70\x2E\xB4\xDB\xA4\x91\x98\x58\xB0\x34\x27\x4E\x94\x37\xA2\xA5\xEC\x2C\x5F\x96\x8D\x36\x7C\x19\x4E\x6B\x51\x7A\x8D\x9D\xF0\x3E\xF2\x9A\xD3\x68\xD1\xE8\x84\x56\x22\xD9\x1B\xA6\x31\x27\x12\xC9\x2B\xAD\xDF\x46\x66\xA2\x99\xD3\x5A\x34\x0D\xC8\x54\x73\xD4\x49\x2B\x6B\x8E\xB1\x80\x44\x13\xDF\xFA\xF6\xBD\xCB\x73\x11\xA9\x21\x5C\x9E\x7F\xD0\xC5\x49\x27\x56\xA4\x29\x8B\x78\x09\x93\x7D\x75\x91\x3A\xDF\x14\x17\xC4\x81\x15\x38\x1C\x90\x1A\xE6\x6D\x51\x09\x8E\x56\xCF\x69\xBC\xC8\x34\x0E\x0F\x62\x5C\x53\x51\x96\xB0\xA4\xFE\x40\x65\x4C\x37\x94\xA1\x49\x2D\xB9\x7C\xF5\x40\x7A\xA5\xF0\x7C\x0F\x88\x7B\x1A\xD1\xF9\xA4\xA5\x5B\xED\x3D\x68\xB0\x8C\xDB\xA9\x3A\xB4\x49\xDC\xBA\xFF\x85\x7E\xA5\x35\x9A\x5F\x1B\xA7\x5F\x99\x4D\xFD\x2A\x76\x6C\xBF\x62\x9D\x56\xB2\x2D\x45\x46\x65\x39\x64\x71\x93\x27\xDC\x29\x5B\x9F\x1A\x80\x85\x6A\xD5\x26\x4F\x9A\x1A\x55\x12\xB6\x8D\x41\x9C\x0B\x8E\xD8\x18\xAF\x7F\xC7\x0E\xDA\x08\x17\x36\x30\x6E\x63\x7F\xC5\xB8\x5D\xC4\x2C\xBF\x63\x46\x43\xA4\x79\x98\x45\x82\xC3\x2C\x42\x33\x12\xF5\x04\x5E\xDF\x4C\x5F\x90\x9A\xBB\x01\x89\x7B\x45\xA4\xFA\x77\x11\x94\x54\x7E\xF3\x55\xB1\x86\x74\x80\x66\xFD\x11\xD1\x1C\xB5\xC1\xF9\xFB\x3F\xF3\xFC\x1B\x98\x0C\xB1\x69\x32\xD4\x58\x0C\x4A\xE7\xC9\xD0\x78\xCB\xEC\x09\x1F\x92\x1A\x0B\x4C\x86\x0D\xA5\xAE\xB1\xAC\xC6\x93\xA1\x21\x79\xD9\x93\x1A\x2B\xBA\x26\x08\xD9\x60\xBD\x6A\x93\x49\xF7\x4D\xA0\x52\x23\x7F\xA1\x52\x75\xB1\xC9\x42\x5B\xE7\xE3\x26\xC7\x28\xA6\x3F\xCB\xAB\x01\x58\x5F\xD3\xD0\x18\x75\x30\x8B\x21\xA9\x07\xE2\xC1\x8C\x16\x5B\x4E\x34\x4D\xD3\x04\xD0\x75\xDD\xD0\x4C\xF9\xA0\x69\x48\x59\x25\x6D\x51\x2A\x22\x8D\x58\x71\x6B\x69\x8E\xB6\x6C\x32\xDD\x67\xEA\x04\x22\x9F\x5B\x2D\x29\x34\xC6\x69\xE8\x74\x06\x9E\x93\x37\xA4\xD0\x57\xDD\x60\x28\xD1\x32\x83\xC2\x91\x36\x00\x6D\x35\xDF\x10\x6E\xBA\x0E\x4C\xB2\xF2\x0E\x2C\x91\x84\xD7\x92\x4D\x52\x10\x81\xA4\xED\xC3\xF8\xF1\x44\x4D\x3A\x01\x1D\x58\x72\xBC\x5F\x73\x94\x6F\xB4\x38\xE3\x5C\x07\xA4\x70\x18\x9C\xF8\xEA\x14\x38\x17\xD9\xB0\xD9\xC1\x4D\x44\x93\x5A\x09\xB0\x91\x79\x3A\xC1\xD7\x5F\x27\x89\x05\x46\xE2\x19\x39\x96\x6F\x3F\x74\xAB\x7F\x4F\x8B\xA9\x95\xC8\x12\xA9\xE0\xD9\xC8\xC6\x6C\x93\x09\xE9\x86\x84\x98\xA2\x39\xC9\xCC\x32\xEB\xC8\x90\xBC\xA7\x7F\x25\x1A\x20\x4E\x71\x0B\x22\x9B\xCE\xE9\x53\x1A\x5D\x47\x27\xE3\x58\x24\x65\x29\xD6\x1F\x92\xE8\x8F\x2F\xA3\xD3\x18\xFE\x88\xD2\x35\x49\x16\xE8\x50\xA2\x36\x51\x92\xEC\xA7\x9D\x59\x62\x49\xCA\x90\x5E\xB3\x16\xB3\xA8\xA2\x32\x42\x07\xF9\xA4\xC3\xB6\x6C\x33\x97\x5C\x42\xB2\x56\xBE\x8C\x3F\x4D\x18\x86\x0C\xE0\x20\x6D\xF5\xC4\x9A\x24\x7D\x44\x55\x44\x48\x4A\xCE\x66\xA2\xB9\x2C\x05\xC9\x88\x65\x11\xFB\x2B\x6B\xB2\xAD\xA0\x14\x2F\x63\x2D\x0D\xEF\x54\x90\x16\x3B\xB5\x38\x05\x49\xDD\x62\x85\x06\x86\xD4\xDD\x28\x23\x33\x57\xA7\x94\x56\x0F\xBA\xC8\xE7\x57\x10\xDF\x81\x32\xD3\x9F\x22\x41\x51\x3F\x4E\xD9\x22\xF2\xF6\x40\x93\x19\x0A\x5D\x31\xC0\x4C\x12\x93\x65\x41\x11\xB3\xF1\xFB\x1B\xA2\x56\x92\x74\xFC\x60\x90\x56\x39\x16\x72\x8D\x52\x7F\x02\x47\x5B\x5C\xA4\x54\x9A\x3E\x63\xCD\x9F\xC9\xC0\x67\x96\xD7\xC2\x6C\xD4\x4E\xB2\x4D\x14\x93\x37\xB9\x71\xBE\xE3\x42\x53\x08\xED\xB4\x9A\x92\xA0\x50\x54\x14\xD2\x1F\x1D\x17\x41\xD4\x26\x88\xBA\x15\xC9\xFD\xA4\x5F\x23\x2D\x55\x96\xEC\x81\x76\x6C\x90\xC4\x5F\xC2\x62\xC6\xBE\xBE\x70\x41\x16\x58\x62\x06\x8A\x31\xA3\x6F\x94\x4C\x87\x48\x1D\x2F\x7A\x93\x8E\x17\x3A\x1D\xB2\xEC\xE8\x85\x52\xF8\x28\x67\x2E\x4A\x19\xA4\x70\x9D\x16\x77\xC5\xEC\xA4\x8A\x8A\x2B\x4D\x9B\xEA\xEA\x4F\x8C\x4A\xB1\x84\x2C\x08\x34\x3A\x0F\x9F\x83\x24\xA5\xD8\x35\x6B\x63\x17\xFD\x22\x6E\x29\x2E\xA9\x1C\x0B\xDC\x33\xFD\xBE\x63\x93\x2A\x8A\xC6\xD0\x7A\xAB\x7A\x50\x63\x31\xAA\x96\x36\x5F\x94\x3A\xA9\x4A\x63\x91\xB8\x38\x55\x00\x23\xA2\x62\xEB\x49\xAA\xE4\x93\xA2\x03\xE9\x2C\xB3\x10\x63\x2B\x32\x52\x90\x3A\xCA\xDD\x22\x25\x15\x0D\x8A\x2E\x91\xB4\xA3\xC5\x1C\xDA\x86\x70\x94\x01\x71\x64\x1D\xE2\xBE\x28\xB5\x6C\xF9\x54\x93\x28\xB5\x49\xF6\x28\x7D\x51\x6A\xD1\x31\x7C\x51\xEA\x86\xE9\xF1\xE0\xD8\x10\x3D\x55\x4C\x2F\x62\x47\x26\xEB\x38\x30\xB0\xCD\xC6\xC0\xA6\x9D\x51\x78\x3C\xC7\xE5\x4C\x63\xDA\x71\x1E\xD1\x56\x68\x44\x6B\xFF\xC5\x11\xAD\xAB\x11\x1D\xFF\x2B\x46\x34\xB5\xA0\xB9\x2C\x38\x37\xBE\x75\x03\x1E\xBF\x09\x53\x8D\x26\x4C\x1D\xD3\x84\xC8\x4D\x98\xFA\x4B\x4D\xD8\x12\x68\xC2\x14\xB5\x1D\x37\x61\x52\x36\x99\x68\x3D\x12\x89\x6F\x6E\xC2\x96\x70\x13\x42\x53\x13\xA6\xFE\xDA\x26\xB4\x02\x2B\xC3\xE6\x62\x8B\x06\xA8\x89\x52\x20\x6D\xD9\xD3\xB6\xD5\x4A\x5F\x1D\x5A\x7A\x8E\xFA\xB2\xDE\xAB\xF9\x4C\x09\x11\x6A\x4B\xD1\xD1\x97\x2B\x29\x09\xED\xD8\x55\x4D\x67\x46\xFA\x44\x52\xD8\x62\x1B\x75\xE7\x8E\x7D\xBB\x60\xD3\xA2\x86\x5E\x2E\x15\xC1\xF1\x6E\xE8\xBC\xBF\x21\xE9\x6C\x84\x05\x0E\x53\xA4\x36\xC6\xB0\x8F\x4D\xD7\x46\x0E\x48\x72\xA0\xE3\x2D\xB5\x52\xD8\x80\xB2\x40\xC7\xA9\xF2\x2C\x48\x12\xE3\xE9\x25\xC7\xA6\x88\x9B\x16\xF1\x99\xAF\x61\xD9\x86\xF5\x6C\x94\x6E\xF8\x8A\xAE\xA6\xB1\xE0\x9F\xCE\xBA\x74\x49\xFA\x45\x0F\xDF\x31\x12\x18\xCD\x01\x07\xD2\xB7\xD3\x4A\x1A\x69\xA2\x79\x74\xAE\x89\x16\x03\x50\xD3\x05\x01\xAE\xEE\x2C\x3B\xA3\x7C\x9A\x4F\x08\x54\x08\x2D\xE8\x03\x79\x26\x13\x08\xBA\x65\xE0\x5F\xEA\xA2\x48\x13\x8B\x53\xE0\xFC\xC7\xFD\xC1\x03\x8F\x0E\x2D\x2D\x29\xD1\x39\x5A\xFA\x58\xA1\x53\x11\xEA\x5D\xC5\x96\x09\x46\x24\x16\x13\xD9\x89\x19\x46\x8C\x1E\x23\x26\x52\x19\x9D\xA3\xA5\x93\x11\xF5\x46\xC9\x4A\x93\x1E\x52\xB9\x02\x71\xF4\x23\xE3\xA5\xCD\x76\xDD\xC8\x06\xD2\xE8\x62\x52\xAF\xC3\xB4\x70\x5A\x95\x50\x46\x44\x9A\x0B\x3A\x34\x28\xCA\x0B\xCD\xE3\x96\x43\x9E\xBB\xF3\xAE\x53\x66\x4B\x3F\x6E\xD2\x16\xAB\x76\xA0\x84\xB5\xE3\xC5\xE9\xE7\x4F\x2A\x68\x4E\x53\xDE\x64\x65\x4B\x25\x20\x5C\xC8\xBF\xAE\x84\x18\x28\x21\x5F\x16\x3E\xA6\x73\xE4\x4C\xEA\x8A\x22\x9A\xDF\x6F\x6F\x36\xED\x93\xCE\x46\x1D\x83\x64\x45\x98\x04\xD2\xFC\xBB\x82\xBF\x7F\xA0\xA9\x1A\x38\xAF\xAB\x52\x70\x5C\x4F\xC4\x9A\x60\x49\x20\x32\xBF\xA5\x56\x38\x93\x08\x21\x3A\x2B\xA3\x22\x46\x99\xA8\x31\xDF\xAA\x88\xBE\x05\xBF\x28\x6B\x24\x89\x08\x82\x47\x14\xD1\x7A\xCB\xE4\xD3\x7C\x42\x07\x92\x47\xEB\xFB\x5D\x22\x19\x27\xB6\x51\x64\x63\x0C\xBF\x6F\xB6\x23\xC3\x3F\x1C\x2F\xE2\x88\x8C\x7A\xD0\xD6\xC4\xBC\x7D\x07\x0F\xAD\xA6\x1B\x52\x8E\xE6\x00\x4F\xE8\xA7\xD8\x20\xBA\x3C\xD0\x59\x37\xDD\xF8\x97\xEB\x8A\x46\x7B\x5E\x79\x7A\x35\x3E\x69\xAD\x8E\xFB\xD4\xCE\x42\x67\x95\x2E\xEA\xE7\x7B\xA3\xFE\x9D\xBD\xD0\x70\xA2\x5B\x8E\x26\xED\x67\x10\x11\x01\x22\x91\x88\x61\xA2\x7C\x74\x31\xDF\xF2\xFA\xB2\x28\x15\x7D\x0B\x1A\x39\xBE\x84\xAE\x31\xD0\xB9\x8B\xBF\x94\x26\x98\x64\xB7\x13\xBC\xD2\xC6\x43\x0B\xA9\x0A\x20\x17\x52\xB3\xB1\x90\x9A\x2A\xA2\xA6\x85\x34\x6E\x09\x2A\x8C\xE5\xD5\x3A\xE8\x58\xDB\xE4\xF5\xD4\x0C\xA6\x6B\xA7\xEC\xA4\x20\x8D\xA3\x96\x54\xAA\x13\x24\x86\x6C\x4C\x3F\x78\x1B\x4B\xFA\x8A\x5F\xF8\x36\xA7\xB4\x3B\xE0\x53\x61\x74\x05\xD1\x3F\x7B\x27\xBD\x17\xB4\xEA\xEE\xA4\xD6\x43\xDB\x50\xE5\x18\x37\x8E\x5C\xCC\x8F\x45\x9A\x5C\x18\x67\xD5\x20\x0F\xA1\x68\x1A\x7B\x21\xDB\xB4\x63\xFE\xAD\x53\x63\x26\xAA\xF8\x7C\x4A\xC0\x0C\x90\x01\x82\xA8\x9A\xC3\x57\x91\x89\xFA\x3C\x26\x53\xE6\xF1\xB3\x60\x1E\x27\x0B\x2A\x21\xC7\x0A\x26\x64\xF0\x81\x0A\xDD\x42\x34\xFD\xD3\x65\xD1\xE7\x1F\x68\xB6\x45\x83\x7C\x2F\x51\xAD\xCB\x06\xAD\xD2\x51\x26\x4B\x8F\x93\xD2\x31\xC4\x4D\x34\x48\xDC\xC8\xFB\xCC\x18\xA4\x4F\xA3\x36\x95\x37\xEA\xD3\xA7\x12\x41\x2C\x9A\xA8\xA4\x4F\x31\x48\xDC\xA0\x4F\xDC\x60\x83\x3E\x45\x9F\x3E\xC5\x62\x8E\xA4\xF6\x8A\x39\x4B\x12\x33\x09\x51\x6F\x56\x83\xB8\x41\x41\xDC\xE0\xB1\xF4\x69\x90\xB8\x41\xA6\x4F\x0D\x66\x30\x48\xE2\x46\x0A\xC3\xFA\xB3\x9A\x22\x6E\xC4\x08\x12\xD5\x11\xB5\x86\xA4\x0E\x52\x51\xA5\x13\x45\x95\xEE\xD8\x3E\xCE\x7D\x6B\x62\x24\xD2\x2E\x7E\x31\x5F\xBD\xF2\x1B\x0A\x89\x06\xE0\xBA\x0B\xB4\x5F\xB2\x09\x6D\xCB\xB5\xDE\x7A\xC1\x40\x63\xB4\x71\x89\xC3\xD7\x89\x63\xA3\x24\xB1\x7C\xA2\x20\xFD\xEE\xDB\x9A\x82\xDA\x7A\x7A\x4C\x62\xB0\x21\xFD\x4F\xC7\x35\x06\xB7\x8F\xBC\xEE\x96\x8D\xF0\xC2\x60\x47\x6C\xFF\x16\xB3\xD4\xBA\x12\xB1\x91\x66\x76\xDE\xDB\xD1\xC5\x23\xBA\x59\xDA\x9C\x82\xD4\x7D\x61\xEB\xE9\x5B\x79\xD6\xB4\x35\x65\xE4\x92\x2F\x02\xDA\x5A\xB5\xC1\xEA\x72\x34\x5B\x57\xC5\x6C\xDC\x12\x94\x17\x79\xA1\xF9\x98\xC1\xC1\x55\x0D\xF3\x70\x4D\xA5\xF0\xB3\x6F\x88\x4C\x1E\x37\xFB\x7E\x03\x8A\x26\xF6\x33\x18\x6D\x92\xE1\x12\x79\x17\x1B\xC8\xA8\x94\xA4\xF4\x0B\xF7\x1E\xF2\x6C\x4A\x61\x63\x3E\xBF\x45\x67\xB4\x66\x6B\x45\x92\xFA\x96\x3E\xB3\x86\x5F\xB4\x88\x2A\x5A\x36\xE2\xC4\x64\xFF\x47\x3B\xE2\xD0\xCD\xD6\x88\xD2\x26\x46\x86\x1D\x91\x2F\x43\x45\x1A\xE9\x34\x24\xB0\x2D\x3B\x4A\x82\x15\xA4\xFC\x29\x12\xA8\x3A\x6C\xC4\x6F\x89\xCA\xF5\x2F\x0F\xBD\x55\x06\xA0\x91\x01\x96\xF3\xE4\x0C\x00\xAB\x5E\x89\x30\x4F\x4A\x72\x56\x14\x4F\x8A\x98\x4E\xE3\xFD\xF0\x02\xA2\x21\x25\x46\x27\xAA\x43\x44\xE4\xAB\x2E\x1A\xDD\xD2\xD2\x69\xDC\xEA\xCC\xE0\x0C\x1E\xE6\xD1\xF5\x3C\xD2\xAE\x21\x03\x29\xFF\xDA\x72\x3A\x04\xD8\xDB\x30\x63\xA4\x8B\x45\x8E\xAE\xAB\x3B\x0F\x22\x1F\x27\x1A\x8A\x2C\x20\x2D\x33\xCD\xD1\x93\x0A\x24\x8D\x95\xCF\x37\x5D\xBE\x41\xA6\x13\x34\x92\x42\x73\x6E\x2E\x3A\xDA\x66\x67\xB4\x26\xBA\xF0\x1C\x2D\x26\x85\x6C\x94\x1E\x96\x86\x3E\x3E\x03\x80\x2A\x40\x17\x7F\xD0\xBA\x23\x89\xA9\xF1\x15\xAC\x69\xBE\x5E\xD3\x74\x4E\x73\x1E\x24\x21\x12\x91\x9B\x67\xB7\xB2\xC2\x02\xA5\xFE\x84\x84\xA9\x34\x55\x7C\x55\x6B\x54\x0F\x49\xA9\xC3\x8F\x73\x12\xE1\xAB\x68\x9A\x1D\x19\x24\xEE\x79\xD1\xD9\x3A\x24\x26\x2B\x93\x8D\xC1\x19\xB6\x36\xC8\x92\x68\x24\x53\x90\xFE\x04\x5F\x08\x07\xA9\x27\x84\x64\x14\x99\x95\x4A\x85\x36\x1B\x57\x04\xE9\x18\x1F\x47\x1C\xB4\xA3\x93\x1B\x17\x89\x34\x36\xB0\x6A\xFA\x62\x3A\xA6\xD8\xF9\x8A\x54\x48\xCE\x3C\xEA\xDC\xBC\xA9\x98\xB3\xE8\x1A\x63\x42\xA9\xC9\x48\x38\x37\x17\x73\x49\x51\x91\x58\x74\xA2\x9B\x48\x9C\xC8\x62\x6B\x68\x60\x47\x07\xB3\x86\xF8\x22\x21\x2B\xAD\x59\xD3\x83\xDC\x35\x92\x0E\x0C\xD3\x36\x56\x0B\x62\x20\x6B\xD8\x29\xBE\x84\x6D\x27\x58\x98\xBC\x9D\xFB\x4E\x23\xB4\x08\xA6\x6E\x4B\xF0\x77\x8C\xD5\xF8\xFB\xDF\x49\xF1\x9D\x6C\x7C\xA7\xF9\x2E\x8A\xFF\x3D\xB1\xA8\x36\x01\xFC\x4D\x66\x00\x26\x35\xBE\xDB\xC5\x77\x7B\x43\x2F\x85\xCD\xB9\xB5\x05\x0D\x2B\xE5\x36\xC0\x8E\xB3\xB6\x7C\x59\xB7\x16\x8F\x1F\x3A\xE9\x09\xCA\x27\xF0\x29\xB8\x61\x29\xB5\x88\x8C\xA0\xBB\x9A\x31\xDE\xCC\x48\xD1\x7F\xD1\x64\x7C\xA7\x91\x0F\xC8\x89\x8B\x08\x7C\x46\xBE\x9A\x7A\x84\x49\xB6\x80\x6D\x74\x0E\x64\x94\x36\x35\xBA\x66\xE5\xC4\x8A\xE9\x2F\x88\x21\x29\x36\x4E\xE3\xFE\xFA\x45\xC5\x8C\xF9\x5B\xE7\xFB\x5B\xE7\x6B\x74\x3E\xD2\xF1\x48\x4C\x63\x4E\x89\x1A\x44\x9B\x9C\xF3\x6F\x06\xB2\x66\x02\xAD\x9E\x8B\x2A\xC2\x80\x57\x2B\xB9\xE8\x8B\xA6\x4D\xD3\x67\x94\xC4\xEE\x90\x45\x6E\x82\x5D\x50\x51\xD0\x8E\x51\x4C\x7F\xE9\x36\xC9\x83\x6F\x4C\xC7\x4B\x58\xF2\x30\xA9\x93\x9C\x14\x57\xE5\xCD\xC5\x9C\x96\xFE\xF2\x6D\xAC\x0A\x4F\x7A\x4A\x6A\x41\xD1\x14\x51\xA8\xA8\x34\x72\x95\x3C\x4F\x0A\x55\x90\x9A\x06\x24\x61\x0B\x66\x14\xF1\x2D\xFA\x0E\x6D\x22\xE5\x49\x92\xD9\x62\x9D\x13\x19\x8D\xCA\x9C\xB3\xE4\x46\x94\xE5\x58\xD1\x8E\x8A\xD7\xF0\xB2\x90\xB6\x9A\x2F\x2F\x06\x14\x1C\x5A\x1F\x30\xD0\x1A\xD5\xE6\x37\x95\x4A\x8E\x21\xBE\xEB\xC9\x03\xC9\x58\xC9\xD6\x4B\x6C\xA3\x79\x20\x45\x8A\x52\x4F\x9A\x3E\xC8\x6B\x8E\x49\x32\x55\xC1\x81\x44\x62\x8C\xA6\xAD\x15\x73\xF2\x5A\xA5\x6E\x47\xD4\x40\xA2\xCB\x9E\x26\xB7\x9B\x39\x59\xDA\xAD\x26\x6A\xC8\xA4\xD8\x65\xAB\x45\xED\x88\xD8\x5A\x89\x54\xB2\x71\xE2\xA2\x88\x81\x94\x60\x09\x39\x35\x90\xE2\xA2\xE2\xAD\xC6\x40\x32\x53\x60\x27\x68\xFB\xEE\x80\x6D\x0E\x66\x35\xF1\x45\x77\x80\x74\x65\xD3\x8D\xAF\x69\xCB\xFD\x9B\xC6\x97\xAF\xB4\xD5\xD9\xA4\x1D\xC9\x6A\x76\x92\xC5\x57\xED\xB8\xE8\xBE\x96\x1A\x48\x8D\xD0\x22\x18\x45\xE1\x7F\x4B\x2B\x16\xFE\x77\xB2\x48\x0A\x6F\xFC\xEF\x74\x91\x04\x83\xFC\xEF\xA6\x13\x29\xDB\x14\x7D\x59\x6F\x0C\x24\x53\x0C\x24\xBD\x31\x90\x74\x31\x90\x44\x6E\x6D\x31\xDE\x35\x35\x90\x62\x3C\x90\x64\xDD\x26\x02\x54\x50\xB0\xCD\x25\x2F\xD3\x62\xAD\x74\x10\x1E\x4B\x0D\xAA\xEB\x5E\xD5\x1F\x54\x07\xE0\x99\x74\xB1\xAF\x82\xAA\x79\xB6\x25\x63\x75\x74\x19\xC0\xEF\x18\x9A\x9A\x61\x75\x35\xC3\x46\xA4\x09\xAF\xC1\x1C\x5D\x09\x0D\xF4\x8E\x98\xCF\x57\xA5\x0B\xAD\x34\xC3\x4A\xE9\x00\x11\x8E\x3B\x46\x64\x72\x2E\xD2\xE8\x18\x91\xE0\x0C\x1B\x15\x33\x2C\xA9\x95\x70\xF4\x22\x75\x0A\x9D\xFA\x23\x25\x4B\x4C\x1B\x9D\x05\x9E\x54\xFF\x48\x04\xFA\x07\xDD\x91\x14\x3D\xC3\x54\xBE\xF8\x5E\x83\xAC\x1F\x49\x6D\x07\xCE\x82\x72\x96\x6D\x8A\xDE\x61\x65\x4D\xD9\x3B\x74\xD1\x3B\x4C\x3B\xA1\x7A\x47\x23\xB4\x08\x46\x51\xF8\xDF\xB1\x22\x09\x4A\xF8\xDF\x49\xF1\x9D\x6C\x7C\xA7\x8B\x74\x83\xD6\xFF\x9E\x58\x54\x17\x2C\xF8\x7B\x92\xF8\x9E\xD4\xF8\x6E\x17\xDF\x7E\xEF\x88\x88\xDE\x11\x21\x7B\xAF\x62\xA7\x1C\xEA\x1D\xA6\x1C\x79\x81\xDE\x11\xA4\x10\xFD\x81\xAA\x3B\x37\x17\x9B\x3B\x88\x41\xEC\x6A\xA3\xD1\x41\xFE\x36\x61\xFC\x6D\xC2\xF8\xDB\x84\xF1\xB7\x09\xE3\xAF\x9E\x30\x6A\xA8\x8F\xB2\x29\x57\xEE\x1F\x4A\x93\xF8\x4A\x76\x06\xA5\x59\xDC\x1C\xF0\x51\x36\xD0\x49\x04\xAB\xC3\x14\x94\xB2\xCE\x47\xE1\x7C\x63\x48\x63\x83\xA9\x3A\xC9\xF7\x88\x9D\x71\x24\xAB\x59\xCE\xA8\xA0\xB3\x06\x45\x4F\x59\x3C\x99\xB5\x56\x1C\x45\x8C\x8C\xDA\x38\x9D\xEC\x5D\x88\x88\x74\x36\xC9\x68\x6B\x64\x9B\x56\x1E\x56\x3B\x63\x58\xCB\x45\x9C\x5D\x7C\x79\x8B\xAC\xF0\x6E\xCA\x19\xCE\x2F\xE9\x8E\xAA\xE1\xEC\xC2\x65\x29\x74\x34\xBA\x07\x6D\xD6\x9D\x5D\xAD\x9B\xEC\x48\x35\xA7\x3B\x63\x02\x4F\xCA\x67\x3B\x41\xA3\x38\xCC\xE6\x38\x9C\x3F\x91\x05\x58\x9D\xEE\x41\x9B\x75\x31\xA6\xEB\xCE\xD8\x3E\x7D\x53\xD5\x36\x29\x82\x74\x23\x02\x9D\x22\x40\x8E\x40\x06\x7F\x9D\x82\x1B\xC1\xE0\x22\x24\x65\xC2\xF3\x60\x93\x8D\x22\x16\xCF\xD3\x97\xA7\xD0\x72\xDE\xF4\x74\x2E\x9E\x1C\x18\x60\x1B\xD6\x1E\xD2\x62\xC6\x1A\x27\x1C\x0F\xD8\x90\x02\xCE\x05\x70\x50\x29\x1B\x6D\x95\x48\xE7\x92\x4D\xCE\x18\x56\xA5\x1D\x02\xC7\xDC\xEC\xEC\x12\x5F\xE0\x68\xC2\xA7\x88\x9D\x54\x5A\x7B\xDE\xB7\x60\xF9\x64\x56\x62\x1D\x0E\xA9\xD1\x57\x72\xB3\xB3\x8F\x42\xAA\x78\xFC\x88\x1D\x5D\x2A\x04\x56\x18\x52\xD2\xE4\x4C\xD8\xEC\x1C\x18\x37\x80\x1F\x5F\x23\x06\xC3\x5A\x8B\x38\xEA\x48\x8D\xC1\xEA\xDA\x2A\x88\x06\x06\xD1\xA4\x74\x7C\x46\x28\xAA\xC1\x7D\xA2\x89\x6C\x74\xF4\x06\xEA\x80\x42\x2D\x61\x2E\xA5\x98\xDA\x2C\xEB\xFE\xFB\x74\x0D\x9C\xB1\x31\xC3\x7A\xE6\x5E\x7D\x2B\xDC\x0C\xCB\xCA\x1B\x0B\xE5\x42\x7D\x0B\x38\xE5\x2D\xE0\x56\xAB\xEE\x16\xA8\x0C\xBB\x3D\x43\x6E\xA9\x54\xE9\x9D\x6B\x17\x4A\xA5\x7C\xBF\x5B\xB2\x37\x8C\x14\x4A\xF5\x42\xD9\xEE\x75\x7B\x07\xF2\x76\xA1\xDC\x97\xBF\x11\x4E\xEB\x9A\x7D\x23\x9C\x76\x23\xF9\x2F\x8F\x0C\x6D\xC8\x57\x7B\xEA\x95\x9E\x0D\x1B\xE7\xDA\x85\xF2\x66\xB7\x54\xE8\xB3\x19\x6B\x8F\xE7\xA5\xB2\x39\x5F\xDD\x58\xAA\xDC\x00\x4B\xF3\x1B\xAA\xF9\x1B\xE0\xDA\x1B\x60\x45\xA1\x36\x02\x97\x16\x36\xE7\x6B\x3D\xCE\xE0\x48\x75\x04\x56\x8D\xD4\x06\x46\x60\x6D\xBE\x34\xD2\x3F\x02\x2B\x0A\x43\x1B\x46\xA0\xDB\x1D\xE9\x59\x58\x28\xF7\x2C\x75\x47\x60\xC5\x08\x0C\x8D\x94\x7A\x6A\x85\x9B\xF2\x3D\xF5\x8E\x69\x8D\x38\xE7\xDA\xBD\x03\xF9\xDE\x41\xBB\x3E\x90\xB7\x7B\x2B\xE5\x7A\xFE\xC6\x3A\xB8\x7D\x7D\x7F\xA5\xCF\xDA\xC8\x86\xBF\xD2\xE7\x48\x39\x7F\xE3\x70\xBE\xB7\x9E\xEF\xB3\xF3\xE5\x3E\xBB\xB2\xD1\x2E\x94\x87\x47\xEA\xB0\xD6\x2D\xF7\x8F\xD4\xA1\x54\xD8\x30\x34\xDC\x97\x17\xB5\x58\xAE\xE7\xAB\x65\xB7\x64\xE7\xAB\xD5\x4A\xD5\x2E\x94\xED\x9E\xA1\xE1\xBE\x9E\x0D\x6E\x2D\xDF\x53\xEE\x2B\x6C\x1E\xAA\xF4\xCD\xB5\x87\x4B\x79\xB7\x96\xB7\xAB\xF9\xE1\x4A\xB5\x0E\xCB\x07\x0A\x75\xB7\xDC\xB3\x46\x34\x44\xCF\x9A\xDE\x6A\x61\xB8\x4E\xB5\xB8\xA1\x50\xAF\xF5\xB8\xE5\xBE\x9E\x72\xA5\x0E\x0B\xB7\x0C\x57\x0B\x95\x3A\xB8\xFD\xFD\xD5\x7C\xBF\x5B\xCF\xD7\x28\x2D\x50\xF5\x5F\xCD\xD7\xF2\xD5\xCD\xF9\x3E\xDB\xAD\xF6\x8F\x0C\xE5\xCB\x75\x18\x1A\xEE\x13\x5E\x0A\x81\xC8\x6A\x03\x85\x8D\x75\xA8\xE5\xEB\x70\xA9\xF0\x9E\x17\xF9\x2F\xF4\x5C\x59\xC8\xD7\xA1\xB2\xA1\x98\xEF\xAD\xC3\x8A\x46\x8C\xBD\x03\x6E\xD5\xED\xAD\xE7\xAB\x76\x6F\xC9\xAD\xD5\x60\x51\xFF\x96\xE1\x7A\xC1\x2D\xF7\x2C\x2D\xE4\xAB\x95\xFE\xD2\x96\xE1\x81\x1A\x38\x65\xB7\x5E\x29\x85\xB1\x2B\xF3\xD5\x4A\xA1\x5E\xE8\x6D\x42\x5E\x5B\x83\x75\x35\xE8\xAE\xC1\xC2\x1A\x9C\x56\x9B\xCB\xFF\xED\xD3\x6A\x4D\x3D\xA6\xBA\xA5\xA7\x50\xAE\x37\x3A\x63\x35\x3F\x5C\x0D\x7A\x70\x6B\x3D\x1B\x4B\x15\x77\x3C\x1F\x9B\xDD\xD2\x48\xBE\xA7\x36\x20\xBA\xF3\x0D\x3D\xBD\x95\xE1\x2D\x32\xD0\x38\x7E\x8B\xB5\x4A\xB9\xE7\x86\x6A\xA1\x9E\xAF\xF6\xE4\x87\x0A\xF5\xE3\xFB\x0C\xF5\xF6\xF0\xCF\x54\xAD\x37\x56\xAA\x50\xAE\xF8\x35\x6F\x6F\xAC\x54\x85\x8F\x7C\xBD\x50\x2F\x54\xCA\x76\x65\x38\x5F\x75\xEB\x95\x2A\x6C\x70\xFB\xC6\xC5\xAB\x1A\x1F\xCE\x57\x4B\x0D\x6C\xB9\xC2\x7D\xA8\xA9\xEF\x11\xC2\x4F\xB8\x52\x85\x81\x42\xA0\xA1\x6A\x03\x95\x91\x52\x9F\xBD\x21\x6F\xF7\x57\xF3\xAE\xC0\xD4\x07\xDC\xB2\x5D\xAA\x34\xFC\x04\x63\x2B\xE5\xCB\xFD\xF5\x01\xD1\x99\xFF\xB2\x8F\x60\x3A\xA0\xAA\xA1\x56\xAF\x16\xCA\xFD\x76\xBE\xD6\xEB\x0E\xE7\x03\xBF\xF7\xE5\x4B\x85\x21\x51\xB9\x76\xA1\x66\x97\x2B\x75\xDB\xB5\x6B\x85\x72\x7F\x29\xE8\xC7\x4F\xA3\xB7\x54\x11\x63\xC1\x2D\xF7\xE7\xC7\x49\x62\xA4\xCC\xB1\x07\xFA\x23\x2C\x1F\x18\xCA\x07\xDB\xBC\xB7\x32\x34\xEC\x56\xF3\xB2\xAD\xE8\x07\xB7\x5A\xA8\x0F\xF4\x0C\x8D\x94\xEA\x85\xE1\xD2\x96\xF0\x34\x15\xF4\x52\x28\x8F\xD4\xDE\xE2\xF7\xE1\xD2\x71\x7E\x7E\xAB\x69\x30\x10\xBE\xAF\xB0\xB9\xD0\x97\x7F\x0B\x0F\xD5\xCA\x48\xB9\xEF\x98\xDF\x57\xBA\x83\x6E\xCD\xAD\xC2\xCA\x2D\x6E\x79\xC8\x6D\x74\x91\xB2\x3B\x24\xAA\xC2\x1D\xAE\x8F\x54\x45\x2B\x57\x46\x86\x61\xDD\x30\xAC\xAC\x56\x60\xA9\x5B\x1E\x29\x57\x2A\xB0\x6A\xB0\x02\x57\xB9\xE5\xDE\x81\x0A\x2C\xA8\x0C\x57\x86\x2A\x1B\x2B\xB0\xA6\xB2\xA5\x32\xB4\xA1\x02\x2B\x0B\x6E\x05\x56\xB8\x02\x01\xDD\x15\x58\x55\x81\x15\x15\x58\x58\x81\xD3\x2A\x81\x32\xD5\x7A\xA8\x31\xE6\xDA\x5C\xAF\x85\x5A\xA5\x0C\x0B\x2B\x43\x43\x95\xB2\xDF\xF3\xE6\xDA\xE2\xAF\x98\x1D\x37\xE7\xAB\xB5\x42\xD3\x2F\xEE\x86\x63\x7E\x38\x26\x5E\xFF\xD7\x15\x6E\xBD\x50\x86\x95\xF9\xBE\xFC\x46\xB7\xD0\x57\x2D\x94\x61\xA4\x94\x2F\xDB\x17\xCF\xB3\x37\x97\xF2\xE5\x60\x57\xAC\x57\x06\xF3\x65\x58\xE9\x56\x7B\x07\xF2\x65\xB8\x74\x64\xB8\x54\xD9\xE2\x96\xC1\xD9\x9C\xAF\xD5\xDD\x32\xAC\x71\x87\x44\x7D\xBA\x65\x58\x5B\xD8\x90\x17\xEE\xA2\xD2\x06\xB7\xE6\x96\x61\xA9\x5B\xAF\xBA\x65\x28\x0B\x4F\x03\xEE\xE6\x82\x5B\x86\xD5\xA5\xBE\x9E\x6E\x91\x03\xF9\xBE\x74\xA4\xDC\xEF\x56\xC5\xD7\x42\x76\x9C\xEA\x50\xBE\xCC\xDF\x23\xBD\xAE\xF0\xD7\xE3\x94\x36\xB8\x8C\x1A\xA8\x54\xDD\xDA\x90\x78\x5D\x59\x29\xF7\xD3\xEC\x07\xCB\xCA\x35\x9A\xB8\x0B\x95\xB2\x5B\xEA\xE9\x76\xAB\xF5\x01\x81\x5E\x92\xAF\x54\xFB\xC5\xCB\x8A\x2D\x7D\x2A\xB1\x35\x95\xFE\x3E\x46\xF5\x0A\xA7\x7B\xA0\x92\x2F\x17\x7A\x1B\xBF\x8E\xD4\x07\x7A\x9C\xAA\xBB\x41\x61\x56\x55\xAA\x01\xCC\x86\x4A\xA5\x94\x77\xCB\xB0\xCA\xDD\xE0\xD6\x5D\xF1\xB6\xD2\x2D\x17\x7A\x07\xE8\x75\xA9\xF8\x2C\x43\xD9\xBE\xD8\x9E\x65\x9F\x7E\xBA\x5D\x16\xBD\x77\x48\xD4\x26\x23\xBB\x04\xB2\xF1\x3D\x8F\x11\xB5\xBA\x2B\xE6\xEA\x5E\xB7\x56\xBF\x68\xA4\x50\xAE\xCF\x9A\xD3\x53\xBF\xB8\xA3\x3C\xCD\x9E\x27\xFC\x2D\x70\x87\x46\x86\x60\xE1\x48\x39\x5F\xD8\x58\xA9\x0E\x81\x33\x50\x19\x82\xDE\x61\xFB\x22\xBB\x2F\xDF\xCB\x13\xC0\x59\x43\xF9\x21\x70\xFA\x4A\xEE\x10\xAC\x74\x4B\xEE\x16\x57\xBC\xAD\xEE\x1F\x70\x87\x60\x4D\xA1\xAF\x4F\xB8\x62\x9D\x59\x2B\x5E\x16\x12\x76\x08\x56\x0C\xC1\x90\xCA\x11\x65\x65\x28\xD0\x85\x86\x46\x4A\xA2\x2C\xFD\x23\x25\xA8\xDB\xD9\x79\x76\x4F\x4F\x79\xA4\x54\x82\x0D\x81\x77\x37\xF0\xBE\xD6\x1D\x2A\x94\x60\x58\x8C\x88\xCD\x85\x6A\x7D\xC4\x2D\xC1\x42\xB7\xEC\xF6\x51\xB3\x6D\xA8\x54\x0B\xFD\x85\xB2\x5B\x82\x75\x25\x58\x55\x82\x15\x25\x58\x99\xCF\xD7\xF3\x85\x9E\x95\xEE\x96\xFC\x20\x2C\xA9\xE6\xF3\x83\xB0\xC0\xAD\xBB\x83\xB0\x66\x10\xBA\x6B\x6E\x49\xAC\x0A\xDD\xEE\x40\xC9\xDD\x5C\x38\xA6\x61\x19\xBB\x32\x5F\xEE\xCB\xF7\x2C\x2F\x0C\xBA\x83\x23\x05\xB8\xCA\x15\x1D\xBB\x67\x61\xA1\x5E\x80\x25\x23\x45\xB7\xEA\xD6\x0B\xB0\xD6\x1D\xAC\x16\x60\xCD\x96\x52\xA5\x5E\xE8\x59\xE5\xF6\x57\x0B\xB0\xCA\x2D\xF7\x15\xCA\xAE\xE8\x6A\x70\x69\x7E\xB3\x2B\x5F\x37\x96\x0B\xB0\x72\xA4\x54\x77\x85\xEB\x0E\xB8\x45\xF1\xB2\xA0\xEA\x0E\x0C\x15\x60\x41\xBE\xDC\xEF\x96\x0A\xB0\x60\xC0\x2D\x0C\xD6\x46\x06\x0B\xB0\x7C\xA0\x52\x1C\x2C\xC0\xEA\x52\xCF\xC2\x81\x82\xF8\x76\x0B\xF5\x01\x81\x76\xAB\x95\xDA\x80\x78\x5D\x32\x52\x1D\x1A\x19\x1C\x28\xC0\xCA\x4A\x9F\x88\xB1\xE6\x56\xDD\xA1\x9E\x25\x95\x72\x9F\xF8\xAD\x5C\x74\x4B\xAE\xFC\xBA\x3A\x7F\x53\xA1\x4F\x84\x1D\xE9\x73\x6F\x70\xFB\x0A\xB0\x76\xC0\x2D\xC0\x95\x6E\x01\xAE\x2E\x40\xB7\x88\x7B\x8B\x3B\xD0\xB3\xA2\x00\x6B\x0B\x1B\x45\xC6\x07\xA0\x32\xDC\x5B\xE9\xCB\x77\x50\xDF\x18\x5C\x56\xAE\xD5\x9D\x52\xDD\xBE\xF9\x66\x7B\x3C\xFC\x4A\xB7\xDE\x3B\x00\x0B\xDC\x5A\xCD\xED\xB9\xD2\x1D\x80\x5A\xB5\x77\xA6\x22\x94\x66\xD6\xB7\x0C\xE7\x69\x02\x9C\x31\x00\x6B\xDD\x7E\xB7\x54\xE9\x87\x6E\x77\xC0\xBD\x61\xA0\x67\xE9\x50\xA5\xDC\x0F\xAB\xB6\x14\xDC\xC1\x7C\xB9\xBF\xA7\x7B\xC4\xED\x1D\x18\xC9\x4B\xF4\x9A\x42\x7F\xF9\xAA\x6A\xA1\x5E\x28\xF7\x03\xF7\x3E\xA8\x0C\xF7\x50\xB2\x97\xE7\xFB\xF3\x37\x0E\xAF\x10\xEB\x8E\x5B\x5A\xC3\xBF\xAD\xA9\x54\xDD\x9E\x35\x95\xA1\xE1\x7C\xB9\x1F\x2E\xCF\x17\x5D\xF2\x2F\x97\xCF\x72\xBE\xFF\x2F\xD1\x16\x1B\xA1\x6B\xD6\xEC\xB3\xCF\x39\x77\xCE\x79\xE7\x5F\xE0\x6E\xE8\xED\xCB\x6F\x84\xEE\x8D\xB0\x70\x63\x80\xEE\xF2\xD7\x73\x41\x49\x36\x48\x9F\x85\x23\xD5\x5A\x61\x73\x1E\xEA\xD5\x91\xBC\xBF\x9A\xD1\x7A\x05\xAB\xF2\x37\xF4\x88\x01\xB1\x62\x24\xDF\x94\x19\xB7\x9E\x87\x8D\x6E\xA9\x96\x87\x05\x6E\xA9\x50\xCE\x8B\x97\x91\x7E\x7E\xB9\xCC\xDD\xEC\xD2\xCB\x9A\x91\x72\x1F\xBF\xAD\x73\xCB\xEE\x06\xF7\x26\xB7\xDA\xB3\x66\xD3\x88\x5B\xCD\x43\x2F\xAD\xFE\x62\xBD\x1D\x29\x57\xF3\x82\xD8\x18\x29\xE7\x83\xC3\x4A\xAC\x75\x76\xA5\x09\xE7\xF6\xF5\x11\xA6\xDB\x2D\x0D\x6D\xA9\xE6\xCB\x79\xD1\xF3\x44\x76\x8F\x47\x07\xF2\x4A\x1D\x48\x6B\xD8\xAD\xAA\xF5\x1B\x0A\xE5\x5A\xBD\xE7\x9A\x6A\xA5\x52\xBF\x6E\xC6\xF1\xBA\xCA\x5B\xFA\x59\xB0\xA5\x9E\xBF\x9C\xA2\x5A\x5D\x73\xFB\xF3\xB0\x70\x20\x5F\xAD\x0C\xE6\xF3\xB2\xAD\x1B\xEB\xE4\x48\xB9\x20\x82\xFA\xB9\x94\x34\x48\x2D\xBF\x69\x24\x5F\xEE\xCD\x43\xB7\x68\x0A\x9A\x76\x56\xE4\x43\xD4\x7B\x13\x71\x0D\x0B\x46\x06\x0A\x7D\xB0\x71\xB8\x5A\x28\xD7\x37\xCE\xA5\x12\x15\x86\x86\x4B\x79\x41\xC9\xE5\xFB\x60\x23\x51\x89\xE3\xE0\x87\x47\xEA\xBD\xC7\xA2\x97\x95\x07\xF2\x22\x40\x9F\xCC\x70\x6D\xAE\xDD\x9F\xAF\xDB\x62\x5A\xB5\x37\xBA\x85\x52\xF0\x87\x7A\x75\xA4\xDC\xEB\xD6\xF3\xEA\x87\x61\xB7\x2E\xF6\x0E\x76\xBD\x52\xB1\x4B\x6E\xB5\x3F\x6F\x77\xD2\x12\x5C\x28\xF9\x5E\x82\xFB\xB5\x00\xCA\x6F\x4A\xB8\xB6\x0F\xBA\xFB\x60\x55\x1F\x9C\xD6\x07\xE5\x1B\x2A\xD5\xBE\x9A\x98\x5B\xAB\xF9\xDA\x48\xA9\xDE\x79\x31\x85\x84\x95\xDD\x97\xF6\xAC\x5C\xB6\xCA\x59\xB1\x62\xF5\x42\xFB\xA2\xF0\xAF\x0B\x2B\xC3\xF5\x42\x2F\x5C\x21\xA6\x26\xF1\xB2\xA4\xE4\x8A\x35\x4E\xBC\x2E\xAA\x0F\x14\x2A\xC3\x85\x5E\xB8\x5C\xD4\xBE\x5A\x45\x87\x0A\xBD\xB0\x70\x4B\xB5\x50\x2A\x49\xDC\xB2\xBA\xAB\x5E\xD7\x8E\x54\x07\x45\x1C\x95\xFA\x40\xA1\x17\x68\x0D\xEB\x85\x45\xA5\x2D\x43\x6E\xA1\x17\x96\x0D\x0D\xE7\xAB\x05\xB7\x24\xD6\x36\x42\xAC\x74\xCB\x7D\xC2\x5D\xB3\xA5\x5A\x70\x7B\x61\x4D\x2F\x74\xF7\xC2\xCA\x5E\x58\xD8\xDB\x3C\x77\xD0\xDF\xC2\x90\x5B\x9A\xD1\x0B\xA7\x6D\x80\xD5\xB5\x21\xB7\xBC\xC5\x85\xD5\xD5\xC2\x16\x57\xAC\x1B\x85\x8D\x85\x9E\xCB\x2B\x03\x85\x72\xFF\x16\x57\x4C\x2E\x1B\xDC\xF2\x0D\xAE\x18\x75\x2E\xAC\x2D\x54\x07\x46\xEA\x2E\xAC\x71\x47\xAA\x6E\x6D\xA0\x5E\x75\xE1\xD2\x4A\x7F\xD5\x85\xE5\x62\x01\x70\xCB\x2E\x2C\x2D\x54\xDD\x7E\xF1\xB2\x76\xC0\x15\xCE\xC2\x01\x77\x70\xC8\x85\x35\x85\xF2\x80\x5B\x72\x61\x49\xD5\x2D\xD7\x07\x5C\x58\x91\x1F\xEE\x1D\x70\x05\x45\x51\x75\xFB\x44\xF0\x72\x59\xB8\xDD\x03\x6E\x7F\xAD\xA7\xDB\x05\xAE\x54\xB1\x48\xB9\xD0\x25\x6A\x99\xF6\x99\x70\xCD\xF5\x70\xCD\xDC\xEB\xA9\xB3\xCD\xBD\x0E\xAE\x99\xDB\x78\xBB\xFE\xC6\xBE\x42\x7F\x81\xDF\x03\xAF\xD7\x37\x5E\x03\xC8\xE1\x91\x72\xAF\x8C\xC0\x7F\xBB\xBE\x54\xB9\x21\x5F\xA5\xD7\xC6\xDB\xF5\x23\xC3\xC3\xF2\xB5\xF1\x76\xBD\x5B\x2A\x8F\x0C\xD1\x6B\xE3\xED\xFA\xDE\x72\xBD\x5A\xA2\xD7\xC6\xDB\xF5\x1B\x4A\x6E\x79\x90\x5E\x1B\x6F\xD7\xBB\xB5\xDE\x42\x81\x83\xFB\x6F\xD7\xF7\x57\xDD\xE1\x01\x7A\x6D\xBC\x5D\x5F\x1B\x76\x7B\xF3\xF4\xDA\x78\xBB\x5E\x74\x4B\x7A\xF3\x5F\xAE\x77\x4B\xC3\x03\xAE\xCC\x90\x7C\xBB\xFE\xDA\x19\xD7\xC1\x50\xA1\x26\x36\x0E\xF6\x75\x50\x17\xB3\x92\x78\xBD\x16\xAE\x81\x75\xD0\x3B\xDC\xE9\x93\x1F\xF6\x45\xB6\xE8\xD2\x6B\xD6\x2C\x5B\xB7\xA8\x67\xA5\xF3\x0E\xB8\xF6\x2A\xB8\x76\x0D\x74\x43\x6D\x95\xBB\x0A\xCA\xA2\xF2\xCF\x3E\x93\x3A\xBD\xF3\x8E\xB5\x97\x3B\xAB\xD6\x2C\x5E\x7D\xF9\xCA\x9E\xD9\xF2\xA7\xF1\x7E\x58\x09\x25\x57\xFD\xB6\xDC\xB9\xDC\x59\xBB\xE6\x8A\x05\x4E\xCF\x02\x67\xCD\xA2\x85\xCE\x9A\x45\x62\x12\xBB\x41\xB4\xEC\xAA\x2B\x56\xAC\x90\x3E\xCF\x3E\xB3\x63\x9C\x88\x66\xCE\x9E\xD6\xEC\xF9\xDA\x4B\x61\x21\xAC\x28\x94\xF3\x6E\xB5\x67\x81\x7A\x71\xC4\x5E\x48\x44\x72\x01\x13\x65\xE7\x9C\xDF\xD8\xFD\xD4\x37\x76\x9E\xEF\xCF\x71\x57\xAC\x5D\xDC\x79\x3E\xFB\x99\x35\xC7\x27\x94\xCF\x81\xAA\xE8\x5B\xFC\xDA\x3D\x4B\x44\x34\x54\xE9\x2B\x8F\x0C\x11\xB1\xC7\x6F\x17\xCD\xB3\xBB\xCF\x86\x0D\x6E\x8D\xBC\xCD\x86\xAD\xB3\xA0\x56\xE8\x2F\x8B\x69\xB7\x73\x96\xC8\xA2\xFA\x9A\x05\x5B\xBB\xC2\x84\x19\xD1\x88\x03\x85\x8D\x75\x81\x06\xEA\x85\x35\x7A\xBD\x81\x72\xC0\x5E\x47\xE4\x3B\xD4\xFC\x97\x6A\xAF\x7A\xED\xCB\xF7\x76\x5E\xAC\x3E\x82\xB1\xAB\x4F\x18\x72\x6F\x1C\xAE\xE6\x7B\xD5\x4F\x85\x72\xA1\xAE\xBE\x45\x0D\x5F\x3C\xCF\x2E\x6D\x10\x3F\x94\x36\x10\x8A\x89\x57\x28\xB0\xD3\xEB\x56\xAB\x5B\xAE\xE9\xBA\x4E\x14\x80\x82\x33\x62\x56\x18\x31\x9B\x11\x30\x13\x3A\x05\xD1\x75\x16\xCC\x38\x13\xB2\x43\xC3\x7D\x3D\x85\x5A\x6D\x38\xDF\x5B\x70\x4B\x1D\x3C\x6C\xA7\x29\x74\x6F\x45\x2C\x56\x7D\x6E\xDD\x0D\xFF\x52\x1B\x70\xAB\xF9\xBE\xE6\x9F\x3A\x2A\xC3\x3D\xB4\x94\x75\x48\x5A\xE4\xF2\xFC\x70\xDE\xAD\x4F\x83\x42\x6D\x58\x8C\xC8\xD9\x1D\xD5\xCA\x0D\xB5\x69\xD0\x5B\x29\xD5\x84\xB7\xC0\x91\xD6\xEC\xE9\x36\xFF\x76\x4C\x1C\x0B\x07\xDC\xEA\x42\xB1\xF0\x06\xA2\x11\x11\x04\x3E\xCB\xD3\x40\x92\xEB\x1D\x43\xE3\xC4\x20\x29\xA2\x69\xD0\x51\xAA\x4C\x13\x5D\xA1\x63\xA0\x30\x0D\xB2\x03\x6E\xAD\x87\x4E\xF7\x3A\xC4\x57\x6F\xA5\x5C\x77\x0B\xE5\x9A\xF8\xE8\x50\xCB\xB2\x8C\x46\x2C\xCC\x8B\x86\x86\xEB\x5B\xAE\x2A\xF4\xD5\x07\xC6\xFF\x5D\xD1\x7B\xC7\x4F\x9F\x29\xB2\xF1\x43\x2F\xE4\x0D\xED\x78\xC5\x0F\xFC\x72\x4C\x30\x9F\x5A\x98\x06\xDC\x2A\x05\x3E\xE2\xCC\x77\x6C\x68\x60\xEA\xF9\xFE\x7C\xB5\xC3\x9D\x16\x6E\x6A\x77\x1A\xDC\x40\x23\x42\xD4\xC8\xAC\x2B\x2E\xBA\x68\xD6\x9C\x69\x30\x72\x0C\xA6\x7A\x0C\xA6\x56\xED\x3D\x06\xE7\x57\xED\xEC\x73\xCF\x9D\x06\xA2\x82\x03\x5F\xBD\xC1\x8F\xF2\x34\xD1\x69\x3B\x66\x4F\x83\x8E\xE1\x6A\x7E\x63\xE1\x46\xEE\x02\x0D\x6C\xA1\x8F\x4B\x58\x26\x42\xA9\x73\xD6\xB8\x1E\x67\xC9\x24\xC5\x7B\x97\x4C\x50\xBD\xF7\x36\x5E\xEB\x9D\x17\x57\xF3\x1B\x39\x3E\xF1\x5D\x19\xA9\xF7\x70\x3D\xF6\x34\x90\xB5\xBA\x5B\xAD\xAB\x7A\x15\x88\xEA\x48\x79\x53\xE7\xC5\x22\xB5\x20\x56\x7C\x73\xCC\xC1\x0D\x23\xF7\xDF\x8B\x3B\x86\x3B\x87\xBB\xA6\x89\x14\x2B\x75\xB7\xC4\x81\x82\xDE\x0A\xE5\xFA\xC5\x1D\x1B\x4B\x6E\x7D\x86\x8C\x96\x6B\xE2\xA2\xF1\xBC\x11\x29\x59\xEB\x39\xD6\x67\x23\x53\xD0\x51\xAE\xD5\x07\xFD\xF0\xBD\x83\xBE\x6F\xC8\x16\x86\x3B\x2F\x2E\xB9\xB5\x7A\xC7\x34\x28\xF4\xF1\x0C\x70\xF3\xCD\xF6\x70\xB5\xD2\xDF\xD3\x79\xB1\xA8\xD3\x8E\x42\x5F\xE7\xAC\x69\xBE\x27\x2A\x01\xCD\x9A\x2E\x57\xB1\x08\x68\x5F\x14\xFC\x94\x5E\x82\x28\xB5\x32\x4D\x0B\x12\x97\xD3\xA0\x96\xAF\x77\xC0\x54\xA6\xE2\xC5\xC4\x93\x53\x33\x39\x8D\xB4\x1C\x1D\x7C\xF6\xCD\xE5\x73\xBC\xB9\xB6\xFA\xBC\xC1\xAD\x96\x89\xBA\x0D\xEC\x36\xA0\xE9\x39\x66\x17\x02\xC7\xFB\xDD\x59\xB0\xF0\xD2\x45\x8B\xC3\xBF\x33\x76\xC9\xD2\x65\x97\x2D\x5F\xB1\x72\xD5\xEA\xEE\xB7\x5F\xBE\x66\xED\x15\x57\x5E\xF5\x8E\xAB\xD7\x71\x7C\xFD\x03\x85\xE2\x60\x69\xA8\x5C\x19\xDE\x54\xAD\xD5\x47\x36\xDF\x70\xE3\x96\x9B\x1A\x71\x9E\x35\xF3\xBF\x37\xBE\xCE\x1E\x11\xC7\x8F\x5B\xD0\x87\x8C\x89\xF0\x52\xAA\xF1\x7D\x29\x60\x53\x7A\x71\x48\x01\x82\x0D\xB7\x41\x1E\xB6\xC1\xD8\xDB\xF6\x9D\x08\x76\xC2\x46\xE8\xB0\xA7\xD9\x08\x33\xED\x1E\xBB\x0B\xA0\x0B\xBA\x54\x28\x07\x00\xD6\xC9\x77\x5B\xBA\x2E\x00\xDC\x04\x00\xFB\x3C\xCF\x03\xE9\x7E\x11\x00\x04\xFC\x6F\x8D\xFD\x08\x77\x17\x00\x3C\x1B\x0A\xFB\x3C\x00\xFC\x22\x84\xDB\x07\x00\xAF\x85\xE2\x3B\x08\x00\x47\x43\x38\xF1\x22\x60\x8B\x0C\x47\x2E\x02\xCC\xA4\xCC\x9E\xE0\x83\xC8\xBC\x2A\xC0\x05\x32\xFC\x2C\x64\x98\x24\xBF\x85\x3B\x1B\x01\xCE\x0B\x85\xBD\x00\x01\x96\x86\x70\x97\x21\xC0\x0D\x21\xDC\x8D\x08\x04\xE2\xB9\x5D\xC6\xB9\x05\x01\xB6\x86\xFC\x8D\x22\x10\x3C\x73\x94\xFD\x08\x77\x0C\x01\x04\x7C\x4B\x96\x43\xB8\xEF\x46\x06\xF1\xFC\x48\xE2\xDF\x83\x00\xB7\x85\xE2\x7B\x2F\x02\x81\x78\x7E\x20\xFD\xDD\x8E\x00\x77\x84\xFC\xBD\x0F\x01\xEE\x94\xFE\x9E\x92\xFE\xDE\x8F\x00\x77\x85\xFC\x7D\x00\x81\x40\x3C\xAB\xA5\xBF\x0F\x22\x83\x78\xBE\x27\x71\x77\x23\x83\x78\xBE\x2F\x71\x1F\x42\x80\x0F\x87\xE2\xFB\x08\x02\x41\x30\xDD\xBF\x47\x06\xF1\xFC\x50\xE2\xFE\x01\x19\xDC\x40\x9F\xFA\x47\x64\x10\xCF\xD3\x12\xFF\x51\x64\x10\xCF\x1E\x89\xFB\x27\x04\xF8\x58\x28\xDD\x8F\x23\x10\xDC\x27\xFD\x08\xF7\x1E\x64\x08\xC6\xF7\x09\x64\x10\xCF\x5E\x89\xFB\x24\x32\xBC\x47\xD5\x3B\x00\xDC\x8B\x0C\x10\xE8\xC3\xDB\x10\xE0\x53\xA1\x74\xEF\x47\x20\x10\xCF\x4F\xA4\xBF\xED\x08\xF0\x40\xC8\xDF\x0E\x04\x82\xA0\xBF\x4F\x23\xC0\x43\x21\x7F\x9F\x41\x20\x08\xFA\xFB\x2C\x02\x3C\x1C\xF2\xF7\x08\x02\x7C\x4E\xFA\xFB\xB1\xF4\xF7\x79\x04\xF8\x52\xC8\xDF\x97\x11\x08\xC4\xF3\x53\xE9\xEF\x2B\x08\xF0\xD5\x90\xBF\x47\x11\xE0\xB1\x10\xEE\x71\x04\x82\xF3\x65\x38\xE1\x7E\x1B\x19\xC4\xA3\xF1\xF0\x83\xEF\x20\x03\x29\x3C\x93\x7E\xBF\x8B\x0C\x47\xE5\xD8\x10\xBF\x3D\x81\x00\x4F\x84\xC2\x3E\x89\x0C\xC1\xB0\xFF\x0B\x19\x82\x61\xBF\x87\x00\xDF\x0B\x85\xFD\x3E\x32\x04\xC3\xFE\x3B\x32\x04\xC3\x3E\x85\x00\x3F\x0B\x95\xED\xE7\x08\x04\x8F\x48\x7F\xC2\xFD\x05\x02\xFC\x29\xE4\xEF\x25\x04\x82\x60\xBA\x2F\x23\x43\x30\xDD\x3F\x23\x43\x30\xDD\x57\x10\xE0\xD5\x50\x7C\xAF\x21\x10\x88\xE7\x5E\xE9\xF7\x75\x64\x10\xCF\x93\x12\x77\x10\x01\x32\x5A\x73\x58\x5B\x03\x02\xF1\x6C\x95\xFE\x72\x1A\xC0\xD9\x21\x7F\x73\x35\x20\x10\xCF\x59\x67\xB2\x7B\xA1\x06\x70\x51\xC8\xDF\x3C\x0D\x08\xC4\x73\x9D\x8C\xEF\x62\x8D\x41\x3C\x1D\x32\xEC\x25\x1A\xC0\x7C\x0D\xE0\x12\xF5\x7D\x26\x80\xA3\x01\x2C\x08\xC5\xB7\x50\x03\x02\xF1\xCC\x93\xF1\x5D\xAA\x31\x88\x67\x91\xAC\xAB\x45\x1A\x83\x78\x96\x48\xDC\x62\x0D\x60\x75\x28\xBE\x6E\x0D\x08\x32\x32\x5D\xE1\xBE\x5D\x63\x68\x97\x38\xE1\x5E\xAE\x31\x9C\x2A\x71\xC2\x5D\xA3\x31\xCC\x90\xF9\x10\xEE\x5A\x0D\x40\xC0\x6C\x89\x13\xEE\x95\x1A\xC0\x55\xA2\x0E\x25\x4E\xB8\x57\x6B\x00\x02\xE6\x48\x9C\x70\xAF\xD1\x00\x04\x9C\x2B\x71\xC2\xBD\x56\x03\x10\xB0\xFA\x53\x9C\xAE\x70\xD7\x6B\x0C\xC1\xF8\x5C\x0D\x40\xC0\x72\xE9\x4F\xB8\xBD\x1A\xC3\x2C\xB5\x3E\x79\x9E\x97\xD7\x00\x04\x74\x48\x7F\xC2\xDD\xA8\x31\x5C\x2A\x71\xC2\x1D\xD0\x18\x66\xCA\xB0\xC2\x2D\x68\x00\x02\x3A\x25\x4E\xB8\x45\x0D\xA0\x18\x0A\x3B\xA8\x31\xBC\x3E\x8D\x71\xC2\x2D\x69\x0C\x8E\xF4\x27\xDC\x8A\xC6\x10\x8C\x6F\x93\x06\x20\xE0\x4D\x19\x56\xB8\x55\x8D\xE1\x2C\xE9\x4F\xB8\x23\x1A\x80\x80\x33\x25\x4E\xB8\xEF\xD2\x00\x04\xFC\x6F\x19\x56\xB8\x63\x1A\xC3\xE9\xD2\x9F\x70\xDF\xA3\x01\x08\x58\x28\xF3\x22\xDC\x5B\x34\x86\xA0\xBF\xDB\x35\x00\x01\x67\x4A\x7F\xC2\xBD\x43\x63\x08\xFA\x7B\x9F\x06\x20\xE0\xEB\x12\x27\xDC\x3B\x35\x80\xF7\x6B\x00\x67\x48\x9C\x70\xEF\xD2\x00\x04\x7C\x55\xE2\x84\xFB\x61\x0D\x40\xC0\x69\x12\x27\xDC\x4F\x68\x00\x02\x4E\x94\xE9\x0A\xF7\x93\x1A\xC3\x04\x89\x13\xEE\x22\x9D\x61\xAD\xEC\xDF\xC2\x1D\xD6\x01\x6A\x7A\x73\x1F\xDF\xAC\x03\xDC\x10\xC2\xBD\x53\x07\x78\x97\xDE\xBC\x1E\x8D\xEA\x0C\xE2\xA9\x4B\xFC\x7B\x75\x06\x2A\xAB\xC4\xDD\xA1\x03\xDC\x29\x71\xA7\x49\xDC\x5D\x3A\x83\x78\xE6\x4B\xDC\x07\x74\x80\x0F\x4A\xDC\x25\x12\xF7\x21\x1D\xE0\x5F\x24\x4E\xD1\x66\xF7\xE9\x00\x3B\x43\xB8\x4F\xEB\x0C\x3F\x91\xF5\x22\xDC\x87\x74\x80\xCF\xEA\x00\x3F\x95\x38\xE1\x3E\xA2\x03\x7C\x43\x6F\xA6\xE1\xBE\xA9\x03\x08\x78\x41\xE2\x84\xFB\x2D\x1D\xE0\xFB\x21\x7F\xFF\xAE\x03\x08\xD8\x25\x71\xC2\x7D\x4A\x07\xF8\x81\x88\x53\xE2\x84\xFB\x43\x1D\xE0\x87\x32\x7F\x31\x99\xBF\xDD\x3A\xC3\x37\xA5\x3F\xE1\xEE\xD1\x01\x04\x3C\x21\x71\xC2\xDD\xAB\x03\x08\xD8\x23\x71\xC2\x7D\x56\x07\x10\xF0\x3D\x89\x13\xEE\x73\x3A\x80\x80\x83\x6A\x6E\xF6\x3C\xEF\x79\x1D\xE0\x4F\xA1\x76\x3B\xA0\x03\xC1\x83\xD2\x9F\x70\x5F\xD2\x01\x04\x3C\x2C\x71\xC2\x7D\x59\x07\x10\x10\x95\xF9\x15\xEE\x9F\x75\x86\xBB\xA4\x3F\xE1\xBE\xA2\x03\xBC\x22\xCB\xF6\x6D\x89\x7F\x55\x67\xD8\x26\xBF\x85\xFB\xBA\xC8\x5B\x28\x2F\x87\x74\x20\x10\xCF\x21\xE9\xF7\xB0\x0E\x70\x24\xE4\xEF\x4D\x1D\xC0\x93\xFE\xD4\x9A\x02\x06\x40\xAB\xC1\xB8\x6E\x99\xC7\xB4\x01\x30\xD3\x68\xEE\x07\x5D\x06\xC0\x6A\xA3\xB9\xDD\xBA\x0D\x80\x1E\xA3\xB9\xBC\xEB\x0D\x80\x77\x1B\xCD\xE9\xDE\x69\x00\x3C\x1E\xC2\xED\x32\x80\x40\x3C\xAD\x32\x8D\x6F\x18\x00\x3F\x08\xF9\xFB\xA1\x01\x04\x2F\xC9\x34\x84\xBB\x5B\xE4\x2F\xD2\xEC\x6F\x56\x04\xE0\xCA\x88\xCC\xAB\x8C\xCF\x8D\x00\xBC\x37\x02\xB0\x5B\x86\x15\xEE\xB6\x34\xC0\x77\xD2\xFC\xFB\xFA\x76\x76\x9F\x48\x33\x04\x71\x4F\xA5\x19\x82\xB8\xDD\x69\x80\xC3\x69\x80\x5D\x16\xF8\xCF\x9B\x69\x00\x2F\x84\xDB\xD6\x06\xF0\xA7\x36\x19\xE6\xA3\xEC\x1E\x68\x03\x78\xB5\xAD\xB9\xEF\x1E\x6C\x03\x78\xB3\xAD\xB9\xAF\x8D\xB5\x03\x08\xF8\xF0\xFF\x66\x9C\x70\xDF\xDD\x0E\x20\xE0\x23\x12\x27\xDC\xF7\xB4\x03\x08\xB8\x47\xE2\x84\x7B\x4B\x3B\xC0\xAD\xED\x00\x9F\x94\x38\xE1\xDE\xD6\x0E\x20\xE0\x13\x12\x27\xDC\xF7\xB6\x03\x08\xF8\x57\x89\x13\xEE\xED\xED\x00\x02\x7E\x2A\x71\xC2\xBD\xA3\x1D\x40\xC0\x37\xDF\xC7\xF9\x15\xEE\xDD\xED\x00\x5F\x93\xF5\x31\xFF\x15\xF6\xFB\x58\x3B\xC0\xE3\x21\xDC\x96\x29\x0C\xC6\x9D\x8C\x17\xEE\xBB\xA6\x30\xFC\xB6\x85\x71\xC2\xFD\xC0\x14\x86\xF3\xA5\x3F\x72\x4F\x05\xF8\x87\x53\x9B\xDB\xF7\x9F\x4F\x05\x82\xEF\xC8\xBA\x12\xEE\x27\x4F\x05\xF8\xE4\xA9\x1C\xCE\xF9\x95\x1C\x23\xA7\x02\x78\xA1\xB0\x90\x01\x88\x66\x1A\xF5\x2E\xDC\x58\x06\xA0\x35\x23\xDB\x41\xC6\x99\xCE\x00\x9C\x18\xF2\x37\x29\x03\x30\x25\xE4\xCF\xCE\x00\x9C\x11\xF2\xD7\x91\x01\x98\x19\xF2\xD7\x95\x01\x38\x2F\xE4\xEF\xFC\x0C\xC0\x25\x21\x7F\xF3\x33\x00\x8B\x42\xFE\x96\x66\x00\x56\x86\xFC\xBD\x3D\xC3\x10\xF4\xB7\x26\xC3\x10\xC4\x5D\x91\x61\x08\xE2\xAE\xCA\x30\x04\x71\x57\x67\x18\x82\x69\x5C\x93\x61\x08\xE2\xAE\xCB\x30\x04\x71\x3D\x19\x86\x20\x6E\x7D\x06\xA0\x3F\x94\xC6\x40\x06\xA0\x12\xF2\x37\x9C\x01\xD8\x94\x01\xB8\x4C\xFA\x13\x6E\x35\x03\x30\x92\x01\xB8\x52\xE2\x84\xBB\x39\x03\x70\x43\x06\xA0\x4F\xE2\x84\x7B\x63\x06\x60\x4B\x06\x60\x4C\xE2\x84\x7B\x53\x06\xE0\x9D\x19\x80\x61\x89\x13\xEE\xCD\x19\x80\x77\x65\x00\xB6\x4A\x9C\x70\xC7\x32\x00\xB7\x87\xF2\x77\x47\x06\xE0\x83\xA1\xFC\xDD\x9D\x01\xF8\x68\xC8\xDF\x3F\x65\x00\xEE\x0D\xF9\xDB\x96\x01\xD8\x1E\xF2\xF7\x40\x06\xE0\xB3\x21\x7F\x0F\x67\x00\x1E\x09\xF9\xFB\x7C\x86\x21\x2E\x71\xC2\xFD\x4A\x06\xE0\xAB\xA1\xB0\x5F\xCB\x00\x7C\x5D\xE2\xBE\x24\x71\x8F\x66\x18\xC4\xF3\xBA\xC4\xFD\x5B\x86\xE1\xA7\xBF\x96\xE3\xF7\xD7\x9E\xF7\xAD\x0C\xC0\xB7\x42\x69\x3C\x99\x01\xF8\xBE\x0C\xAB\xD6\xAE\x7F\xCF\x30\x04\xE3\xDB\x9D\x01\xD8\x13\xCA\xF3\xF3\x19\x80\x1F\x87\xF2\xF7\x13\x91\xA6\xC4\xDD\xA3\xD6\x86\x0C\xC0\x0B\xA1\xB0\xFF\x91\x61\x08\xAE\x83\xFF\x99\x01\x78\x31\x14\xDF\xEF\x32\x00\xBF\x97\xB8\xBB\x25\xEE\x0F\x19\x06\x08\xAC\x6F\x7F\xCE\x30\x04\xCB\x76\x30\x03\x70\x48\xFA\x1B\x53\xEB\x60\x06\xE0\x88\xC4\xBD\x47\xE2\xDE\xC8\x30\x04\xCB\x7B\x7A\x96\x41\x3C\xF7\xC9\xB9\xE4\xCC\x2C\x83\x78\x9C\x5F\x4A\x9A\x37\xCB\x40\x6D\x23\x71\xB3\xB3\x0C\xE2\x91\xD3\x20\xAC\xCA\x32\xFC\x46\xC6\x2F\xDC\xF5\x59\x80\x8A\xF4\x27\x97\x16\x18\xCE\x02\x8C\x66\x01\x0E\x48\x7F\xC2\xBD\x25\x0B\x70\x2B\xF9\x6B\xCC\x61\x5F\x9A\x0A\xF0\xC3\xA9\x1C\xE6\x14\x19\x76\xF7\x54\x80\x17\xA7\x02\xFC\x56\x86\x25\x77\x3A\xC0\x8C\xE9\xFC\xBB\x5A\x07\xBB\xA6\x03\x5C\x3F\xBD\x79\x1D\x5C\x3F\x1D\xC0\x9D\xDE\x9C\xC6\x86\xE9\x40\x40\xF5\xF9\x2C\xFB\xED\x9D\xCE\x40\xE9\xBE\xC4\xB8\xBE\xE9\x0C\xE2\x39\x59\xFA\xCB\x4F\x67\xD8\xBB\x97\xBF\x85\xBB\x71\x3A\x80\x80\xE7\x25\x4E\xB8\xFD\xD3\x01\x4A\xA1\x74\x87\xA6\x03\x01\xD5\x93\xF4\x5B\x9E\xCE\x20\x1E\x5D\xA6\x51\x99\xCE\x20\x9E\x17\xA4\xBF\xE1\xE9\x0C\xE2\xF9\x95\xC4\x55\xA7\x03\xD4\x42\x69\x8C\x4C\x07\xD8\x1C\xC2\x6D\x9D\x0E\x30\x2A\xC3\x7E\x43\x86\x1D\x9B\x0E\xF0\xEB\x90\xBF\xDF\x4F\x07\xD8\x1F\xC2\xBD\x3C\x1D\xE0\xCF\x21\x1C\x74\x02\x9C\xD6\x09\xB0\x4D\x8E\x41\xE1\x9E\xD1\x09\x70\x46\x08\xD7\xD9\x09\xD0\x19\xC2\xCD\xBF\x1F\x60\xE8\xFE\xE6\xF8\xC6\xEE\x07\xF8\xE7\x10\x2E\xB7\x1D\x60\xE6\xF6\x66\xDC\xEC\xED\x00\x95\x10\x6E\xCB\x76\x80\x9B\x43\xB8\x77\x6D\x07\x02\x1A\x03\x23\x9C\xF6\xD6\xED\x00\xB7\x87\xFC\xBD\x7F\x3B\xC0\x5D\x21\xDC\xDF\x6D\x07\x02\x6A\xC7\x75\x72\x9E\xDC\x0E\xF0\x91\x90\xBF\xBF\xDF\x0E\x04\x7E\xDF\x03\x80\x7F\xDC\x0E\xB0\x23\xE4\xEF\xC1\xED\x40\x20\x9E\x47\x65\x7C\x3B\xB7\x33\x88\xE7\x11\x89\xFB\xF4\x76\x06\xF1\x7C\x51\xE2\x1E\xDA\xCE\x20\x9E\xC7\x25\xEE\x33\xDB\x19\x82\xF1\x3D\xBC\x9D\x41\x3C\xFB\x25\xEE\x91\xED\x0C\xE2\x79\x56\xE2\x3E\xB7\x9D\x41\x3C\xBF\x97\xB8\xCF\x6F\x67\xA0\xF6\x91\x34\xF3\x17\xB6\x03\x3C\x1E\x2A\xC7\x37\xB7\x03\x7C\x2B\x84\xFB\xF6\x76\x20\x50\x63\x4D\xB8\xDF\xD9\xCE\x20\x9E\xC7\x64\x1A\xDF\xDD\xCE\x20\x9E\x27\x65\x7B\xAC\xD9\xC9\xB0\xFE\x0D\xB9\xA6\xBE\xE1\x79\xC3\x3B\x01\x1E\xDF\x09\xD0\x35\x20\xE9\x8A\x01\xCF\xCB\x7A\x00\x73\x99\x82\xF7\x69\x74\xC7\x03\x58\xE7\x35\xD3\xE8\x60\x20\x9C\x61\xF0\x81\x53\x87\xF4\xD7\x61\x20\xAC\x36\x10\x9E\x97\xFE\x84\xFB\xB0\x81\xF0\x74\xC8\xDF\xF3\x06\xC2\x91\x90\xBF\xB1\x24\xC2\xE7\x92\xEC\x4F\xED\x2F\x77\x25\x11\x5E\x4E\x62\xD3\xFE\x6D\xDB\x24\x84\xC7\x27\x61\x53\xFE\x76\x4D\x42\xF8\xE5\x24\x6C\xCA\xDF\xFC\x32\x42\x4F\xB9\xD9\xDF\xFA\x32\xC2\x68\xB9\xD9\x1F\xBC\x88\x90\x7D\x91\xFD\xE5\xA4\xBF\xDC\x8B\x08\x0B\x5F\x44\xF8\x85\xF4\x27\x5C\x43\xAE\x37\x49\x09\x72\x8B\x41\x8F\xD8\xFB\x9E\x29\x68\x1C\x00\x78\x27\x1C\xFB\x84\x7F\x7F\x17\x00\xC8\xE9\x01\xAE\x1B\xC7\x3F\x3F\x07\xE4\x96\x7A\xAA\xAC\x8E\xAB\xD9\x9D\xFF\x41\x76\xEF\xF8\x16\xBB\xC5\x83\xE4\x8E\xDD\x3A\xC3\xA1\x7E\x31\xA1\x97\xDC\x5B\x9F\xFB\x28\xB9\xF9\xA7\x9E\x72\xEE\x96\x31\x62\x00\x4A\x7B\x10\xC6\xC3\x9F\xFF\x23\x84\x0F\x1D\xC7\x7F\xF0\xD1\xC4\xFC\x09\x00\x11\xB9\xE6\x8A\x6D\x4A\x4A\xF6\x54\xB1\x1D\x39\x09\x00\xA6\x00\x91\xC8\x74\x86\x30\x4D\xAC\x71\x00\x30\x13\x00\xCE\x05\x80\x0B\x01\x60\x1E\x00\x2C\x94\xE7\x77\xCB\x24\xEF\x60\x8D\x28\xA9\x3C\xCB\xCF\x03\x40\x3F\x00\x0C\x02\xC0\x10\x00\x6C\x02\x80\x51\x00\xB8\x05\x00\xC4\xD6\xE1\xFD\x00\xF0\x0F\x00\x20\xB6\x42\x9F\x90\xE7\xF5\xA2\xDB\x3F\x24\xC6\x99\xE4\x25\x3D\x2E\xE6\x60\x31\x4E\xC4\x7E\x4C\x9E\xE1\xE3\xFF\x83\xF9\xDD\x32\x4E\x9E\x3F\x78\x9C\x7C\xEF\x08\xE5\xFD\xEB\xE3\xE4\x7F\x4F\xA0\x0D\x44\xBE\x27\x02\xC0\x89\x00\xF0\x36\x59\x86\x49\x81\xDF\x4F\x96\x6B\xFA\x64\x49\x3F\x4C\xE1\x2D\xD0\x31\x8F\xEA\xF7\xFF\x43\xBA\x92\x1C\xF0\xCF\x7E\xD4\xB9\xD0\x19\xD2\x55\xE3\x78\x5A\x28\x9E\x33\x65\x9D\x89\xBE\xDD\x09\x00\x33\x64\xFD\x05\x7F\x17\xF3\xF6\x2C\x41\xDB\xC8\xDF\x4F\x25\xDC\x05\x10\x87\x04\x24\x81\x35\xD7\x8B\x6F\x07\xD6\x41\x0F\xF4\x80\x0B\x37\xC1\x7F\xA6\x90\xDA\x2C\x7D\x2E\x36\x71\x22\x6F\x3F\x01\xE9\x8C\x3C\x8C\xBF\x45\xE3\xEF\x89\xE7\x22\xE8\x01\xFC\x81\x34\xFB\x0F\xE3\xEF\x02\xF6\x6F\x9F\x8B\x4D\xE3\xFA\x8F\xD2\x7F\x18\x6F\xCA\x3C\x8B\x3C\x8A\xFC\x29\x57\xB4\x74\x1C\xE2\x54\x06\xD1\x93\x46\x61\x94\xFC\x65\x61\x2B\xFD\x6E\xCB\x5D\x43\x16\x66\xC2\x5C\x98\x0F\xD7\xC0\x7A\x78\x27\x6C\x25\x7E\x2A\x19\x11\x93\x5C\xD2\x70\xF9\xF9\x7B\x31\xB8\xC0\xAC\xE6\xB7\xA5\x39\xBF\xDF\x0E\x95\xC3\x92\xF9\x0D\xE3\xB7\x4B\xFF\xBB\xCF\x45\xD0\x02\xF8\x7B\xA4\xFF\x30\xFE\x0A\xE9\xFF\xF9\x50\xBD\x5E\x26\xFD\x87\xF1\xF3\xA5\xFF\x9F\x85\xE2\x39\x57\xFA\x0F\xE3\xCF\x92\xFE\x7F\x13\xC2\xDB\xD2\x7F\x18\xFF\xCD\x56\xF6\xFF\x87\x50\xBA\x5F\x6E\x65\xFF\x61\x7C\x51\xC6\x7F\x20\x84\xEF\x91\xF1\x87\xF1\x7F\x90\xF1\xBF\x12\xC2\xBF\x20\xE3\x0F\xE3\xFF\x51\xFA\x3F\x18\xC2\xBF\x5F\xFA\x0F\xE3\x9F\x93\xFE\x61\x4E\x73\x3F\xFA\x77\xE9\x3F\x8C\x1F\x95\xF9\x4F\xCF\x69\xAE\x87\xBA\xCC\x7F\x18\x8F\xD2\xFF\xA4\x39\xCD\xE9\xBE\x26\xE3\x0F\xE3\x3F\x22\xFD\xDB\xA1\x74\xDF\xA7\xFA\x7B\x08\xFF\x69\x99\xFF\xAE\x39\xCD\xFD\x6A\x9B\x8C\x3F\x8C\x6F\x87\xE6\xE7\xF3\x3A\xC2\xA3\x3A\xC2\x8F\x93\x08\x67\x69\x08\x67\x27\x11\xBE\x9C\x46\x78\xFB\x49\x08\xD7\x9C\x84\xF0\x8D\x34\x82\xAB\x23\xBC\xDD\x42\xB8\x4D\x47\xF8\x84\x8E\xF0\xD8\x09\x08\xBB\x22\x8D\x5C\x8B\xB9\xE3\x02\x00\x98\x1B\x98\x3B\x2E\x0C\xA4\x71\x91\x9C\x9F\x2F\x96\xEB\xED\x7C\x29\x77\x10\xFC\x7D\x81\x9C\xBF\x2F\x95\x7C\xA4\xC5\xA1\xDF\x97\xC8\xF0\x4B\xE5\xFC\xAE\xE6\x4A\x25\xBF\x60\xCB\x79\xBE\x28\x69\x87\x41\x39\xD7\x3F\x6E\x03\x94\xC4\xFE\x40\xE2\x6B\x00\x20\x40\x90\x33\xF5\x80\x9C\x43\x50\xBE\x41\xC9\x35\xD8\x01\x79\x06\xF1\xFE\x4B\x09\x8F\x4F\x61\x99\x86\xDF\xC8\xB0\xFF\x21\xF6\xBA\x22\xCF\x36\xC0\x6F\x03\xB2\x0E\x41\x19\x07\x2F\x28\xDB\x20\x65\x1A\x44\x0D\x2A\x19\x05\xF1\xAE\x64\x13\x84\x77\x25\x93\x20\xF0\x4A\x16\xE1\x76\xCF\xF3\x94\x0C\x82\xF0\x13\x94\x3D\x08\xCA\x1C\x28\x59\x83\x1F\x05\x64\x0C\x44\x3C\x4A\xB6\xE0\x07\x01\x99\x02\x11\x8F\x92\x25\x78\x2A\x20\x43\x20\xF0\x4A\x76\x60\x75\x40\x66\xE0\x7B\x01\x59\x81\xEF\x07\x64\x04\x84\x7F\x25\x1B\xF0\x54\x40\x26\xE0\x87\x21\x59\x00\x25\x03\xF0\x74\x80\xF7\xBF\x27\xC0\xF3\x17\xF9\x0C\xF2\xFA\x15\x8F\xFF\xE9\x00\x6F\x7F\x6F\x88\xA7\xAF\x78\xF9\xCF\x06\x78\xF8\x22\x1E\xC5\xBB\xFF\x49\x80\x67\x2F\xF2\xA9\x78\xF5\x3F\x09\xF0\xE8\x85\x7F\xC5\x9B\xFF\x49\x80\x27\x2F\xFC\x2B\x5E\xFC\x8F\x03\x3C\x78\x81\x57\xBC\xF7\x9F\x06\x78\xEE\x22\x1E\xC5\x6B\x17\xEF\x41\x1E\xBB\xE2\xAD\x87\x79\xEA\x41\x5E\xBA\xE2\xA1\x0B\xBC\xE2\x9D\x63\x88\x67\xAE\x78\xE5\x61\x1E\x79\x90\x37\xAE\x78\xE2\x02\x1F\xE4\x85\x2B\x1E\xB8\x08\xAB\x78\xDF\xC2\x8F\xE2\x79\x63\x88\xD7\xAD\x78\xDC\x02\xAF\x78\xDB\xF7\x7A\x9E\xA7\x78\xDA\x4F\x8A\x7E\x2E\x79\xD9\x34\x6F\x49\x1E\xF6\x56\xCF\xF3\x14\xEF\x5A\xE0\x15\xCF\xFA\xAC\x33\x1B\xBC\x6A\x91\xAE\xE2\x51\x5F\xE7\x79\x9E\xE2\x4D\x77\x9C\xD9\xCC\x93\x56\xBC\x68\xE1\x5F\xF1\xA0\xE7\x79\x9E\xA7\x78\xCF\x8B\x02\x3C\xE7\x25\x01\x5E\xB3\x48\x37\xC8\x63\x0E\xF2\x96\x83\x3C\xE5\x20\x2F\x39\xC8\x43\x0E\xF2\x8E\x83\x3C\xE3\x20\xAF\x38\xC8\x23\x0E\xF2\x86\x83\x3C\xE1\x20\x2F\x38\xC8\x03\x0E\xF2\x7E\x83\x3C\xDF\x20\xAF\x37\xC8\xE3\x0D\xF2\x76\x83\x3C\xDD\x20\x2F\x37\xC8\xC3\x0D\xF2\x6E\x83\x3C\xDB\x20\xAF\x36\xC8\xA3\x0D\xF2\x66\x83\x3C\xD9\x20\x2F\x36\xC8\x83\x0D\xF2\x5E\x83\x3C\xD7\x20\xAF\x35\xC8\x63\x0D\xF2\x56\x83\x3C\xD5\x20\x2F\x55\xF1\x50\x45\xDB\x29\xDE\xA9\x78\x0F\xF2\x4C\x15\xAF\xB4\x1E\xE0\x91\x9E\x1E\xE0\x8D\x9E\x16\xE0\x89\xCE\x0F\xF0\x42\x2F\x09\xF0\x40\x6D\xC9\xFB\x14\x20\xF6\x15\xFF\x2A\xF9\xA0\x76\x88\xFF\x19\xE4\x7B\x3E\xA2\x03\x3C\x22\xF9\x98\x9F\xD3\x01\x04\x9C\x4A\x6B\x28\xC0\x17\x24\xFE\x8B\x3A\xC0\x17\x65\xBA\x5F\xD2\x01\xBE\x2C\xF1\x5F\xD1\x01\x04\x08\xBA\xFF\xAB\x3A\x43\xA4\x1D\xE0\x6B\x3A\xC3\x1C\xB1\xA7\xD0\x19\x84\xFF\x47\x75\x00\x01\x87\xDE\xF0\xBC\xC7\x74\x80\xC7\x25\x7E\x97\x0E\x20\x40\xEC\x29\xBE\x21\xF9\xAF\x82\x6E\x57\x7C\x57\x51\x57\xDF\xD2\x01\xBE\x23\xFD\x7F\x57\x07\x10\xD0\x2A\xF6\x28\x3A\xC0\x93\x12\xFF\xBF\x74\x00\x01\xD7\x4D\x01\xF8\x5E\x80\x3F\x1B\xE4\xCB\x06\xF9\xB1\x8A\x0F\x1B\x0B\xF1\x5F\x15\xDF\x55\xEC\x4F\x82\xFC\xD6\x20\x9F\x35\xC8\x5F\x55\x7C\x55\xA2\x01\x03\xFC\xD4\x20\x1F\x35\xC8\x3F\x0D\xF2\x4D\x15\xBF\xF4\x5F\x3D\xCF\x0B\xF2\x49\x15\x7F\x54\xCC\x0F\x8A\x2F\x7A\xC8\xF3\x3C\xC5\x0F\x15\x69\x29\x3E\x28\xF1\x40\x25\xFF\xB3\x3B\xC0\xF7\xB4\x25\xBF\x73\x96\xE4\x77\xCE\x36\x00\x04\xAC\x9A\x04\x70\xB6\xC1\x20\xF0\xE7\x18\x00\x02\x56\x4E\x02\x38\xD7\x00\x98\x27\xF1\x17\x1B\x00\x02\x2E\x9D\x04\x70\x89\x01\x30\x5F\xE2\x1D\x03\x60\x81\x80\x49\x00\x0B\x0D\x80\x65\x12\x7F\x99\x01\x20\xE0\xA2\x49\x00\xCB\x03\x7C\xD6\x20\x7F\x75\xBD\x01\xB0\xC1\xE0\xFC\xF7\x1A\x0C\x53\x27\x01\xF4\x49\x7E\xAB\xC0\x2B\x3E\xAB\x78\x57\xFC\xD5\xD6\x00\x5F\x55\xD4\x49\x90\x9F\xAA\xF8\xA8\xC2\xBF\xE2\x9F\x76\x85\xF8\xA6\x8A\x5F\xBA\xBE\xBD\xC1\x27\x15\xEF\x8A\x3F\x2A\xDE\x83\x7C\xD1\x20\x3F\x54\xF1\x41\x77\x7F\xB4\xC1\xFF\x8C\x85\xF8\x9E\x41\x7E\x67\x90\xCF\x19\xE4\x6F\xDE\xD2\x0E\x70\x8B\xE4\x6B\xDE\x2A\x79\x9C\x22\xCF\x41\xDE\x66\x90\xA7\x19\xE4\x65\x06\x79\x98\x8A\x77\x39\xFF\x15\xCF\x53\x3C\x4B\xF1\x1E\xE4\x55\x06\x79\x94\x4D\xBC\xC9\x53\x01\xD6\x9F\xCA\xE9\xBA\xA7\x32\x08\x1A\x77\x83\xE4\x55\x0A\x7C\x90\x47\xA9\x78\x93\xCE\xAF\x3C\x4F\xF1\x24\x89\x4A\x0E\xF0\x22\x15\x0F\x52\xD4\x43\x90\xF7\xA8\x78\x8E\x02\x1F\xE4\x35\x2A\x1E\xA3\xC0\x07\x79\x8B\x8A\xA7\x28\xF0\x41\x5E\xA2\xE2\x21\x0A\x7C\x90\x77\x18\xE4\x19\x06\x79\x85\x41\x1E\xA1\xE2\x0D\x8A\xB0\x8A\x27\x28\xDE\x15\x2F\x50\xBC\x2B\x1E\xA0\x78\x0F\xF2\xFE\x14\xCF\x4F\xE0\x83\xBC\xBE\x20\x8F\x2F\xC8\xDB\x0B\xF2\xF4\x82\xBC\xBC\x20\x0F\x2F\xC8\xBB\x53\x3C\x3B\x11\x7F\x90\x57\xA7\x78\x74\x02\x1F\xE4\xCD\x29\x9E\x9C\xC0\x07\x79\x71\x41\x1E\x9C\xE2\xBD\x09\x3F\x8A\xE7\xF6\x25\x31\xF7\x4A\x5E\xDB\xEB\x9E\xE7\x29\x1E\xDB\xED\x21\xDE\x9A\xE2\xA9\x89\xB9\x4B\xF1\xD2\x84\xFF\x20\x0F\x4D\xF1\xCE\x44\xFC\x8A\x67\x76\x8F\xE7\x79\x41\x5E\x59\x90\x47\xA6\x78\x63\xC2\xBF\xE2\x89\xDD\x2D\xF6\xD0\x92\x17\x26\xE6\xB4\x20\x0F\x4C\xF1\xBE\xC6\xC4\x5C\x27\x79\x5E\xEF\xF1\x3C\x4F\xF1\xBA\x44\x7E\x14\x8F\xEB\x96\x5F\x79\x9E\xE2\x6D\x65\x7F\xE9\x79\x8A\xA7\xF5\xF1\x5F\x7A\x9E\xE2\x65\xB5\x87\x78\x58\x8A\x77\x95\x0E\xF1\xAC\x14\xAF\x4A\xCC\x2D\x8A\x47\x75\x4A\x98\x37\x25\x79\x52\x5D\x21\x5E\x94\xE2\x41\x89\x71\xA1\x78\x4F\xF1\x67\x3D\x4F\xF1\x9C\x4E\x79\xC9\xF3\x14\xAF\xE9\xE4\x67\x3D\x2F\xC8\x63\x0A\xF2\x96\x14\x4F\x49\xE4\x41\xF1\x92\x7E\xB3\xD7\xF3\x14\x0F\x49\x7F\xD6\xF3\x14\xEF\xE8\x85\xBD\x9E\xA7\x78\x46\xBF\xDA\xEB\x79\x8A\x57\x24\xF2\xA0\x78\x44\x22\x1E\xC5\x1B\xFA\xC6\x5E\xCF\x53\x3C\x21\xE1\x47\xF1\x82\x88\x4E\x96\x3C\x20\x1A\xD7\x01\xDE\x4F\x90\xE7\x13\xE4\xF5\xCC\xBF\x1F\xE0\xB2\xFB\xD9\xFF\xF2\xFB\x19\xE6\x6D\xF6\xBC\x15\x92\xF7\x23\xF0\x8A\xE7\x23\xDE\x15\xAF\x87\xF6\x86\x92\xC7\x23\xDE\x15\x6F\x47\xE4\x41\xF1\x74\xDE\x18\xF1\x3C\xC5\xCB\x11\x7E\x14\x0F\x47\xF8\x51\xBC\x9B\xE7\xD7\x79\x9E\xE2\xD9\x08\x3F\x41\x5E\x8D\xE2\xD1\x08\xBC\xE2\xCD\x3C\xBA\xCE\xF3\x14\x4F\xE6\x91\x75\x9E\xA7\x78\x31\x5F\x5C\xE7\x79\x8A\x07\xF3\xF8\x3A\xCF\x53\xBC\x17\xE1\x5F\xF1\x5C\xF6\xAF\xF3\x3C\xC5\x6B\x79\x76\x9D\xE7\x29\x1E\xCB\xEF\xD7\x79\x9E\xE2\xAD\x6C\xD3\x1B\x3C\x15\x91\xAE\xE2\xA5\xD0\x99\x99\xE4\xA1\x88\x7E\xA2\x78\x27\x8F\xAD\xF3\x3C\xC5\x33\x79\x72\xC4\xF3\x9E\xD8\x0E\xF0\x3D\x59\xC6\x57\xB7\x03\xBC\x26\xDF\x83\x3C\x94\x20\xEF\x44\xF1\x4C\xEC\x30\xAF\x44\xF2\x48\x3A\x42\xBC\x11\xC5\x13\xE9\x08\xF1\x42\x14\x0F\x64\x7E\x88\xF7\xA1\x78\x1E\x76\x88\xD7\xA1\x78\x1C\x76\x98\xB7\x21\x79\x1A\xB9\x10\x2F\x63\xA3\x3A\x4E\x79\x11\x61\xF9\x8B\x08\xDD\x2F\x22\x5C\xFD\x22\xC2\xF5\x2F\x22\xF4\xBC\x18\x38\x21\x3A\x09\xE1\x94\x93\x10\xA6\x9C\x84\x70\xD6\x49\x08\x5D\x27\x21\x5C\x72\x12\x02\x5C\x8A\xB0\x78\x31\x02\x98\x86\x69\x9A\x96\x99\x32\x4F\x31\xDB\xCD\x76\xF3\x54\xF3\x54\xD3\x36\x2F\x31\x1D\xF3\x32\xF3\x4A\xB3\x62\x6E\x32\x7F\x66\xFE\xC2\xF4\xCC\xEE\xE8\x68\x74\x5B\xEC\x0B\xB1\x2F\xC5\x9E\x88\x3D\x1D\x7B\x21\xF6\xEB\x98\x17\xEB\x3E\xF2\x8D\x23\x4F\x1F\x99\xF7\x66\xF7\x9B\x1F\x7C\xF3\xC3\x6F\x3E\xF1\xE6\x81\x37\xDF\x7C\x73\xF8\x68\xFD\xE8\xE6\xA3\x6F\x1C\x55\xC9\xAF\x6F\x41\xD8\xDA\x82\x00\xFB\x11\xF4\xFD\x08\x91\xFD\x08\x99\xFD\x08\xD9\xFD\x08\xB9\xFD\x08\x53\x25\x9C\x21\x61\xDA\x7E\x84\xD9\xFB\x11\xCE\xD9\x8F\x70\xDE\x7E\x84\x0B\x24\x5C\x28\x61\x81\x84\x25\x12\x96\x49\x58\x2E\x61\xE5\x7E\x84\xD5\xFB\x11\xDE\xBE\x1F\xE1\xF2\xFD\x08\x6B\x25\x5C\x25\xE1\x6A\x09\xD7\x48\xB8\x4E\x42\x8F\x04\x77\x3F\xC2\x86\xFD\x08\x7D\x12\xFA\xF7\x23\x14\xF7\x23\x94\xF6\x23\x54\xF7\x23\xD4\xF7\x23\xDC\xB0\x1F\x61\xCB\x7E\x84\x9B\xF7\x23\x6C\x95\x30\xB6\x1F\xE1\x7D\xFB\x11\xDE\xBF\x1F\xE1\x9F\xF7\x23\xFC\xCB\x7E\x84\xFB\xF6\x23\x7C\x6A\x3F\xC2\x8E\xFD\x08\x3B\xF7\x23\x7C\x7D\x3F\xC2\x81\xFD\x08\x2F\xED\x6F\xB4\xCF\xAC\xC8\x95\x91\xAB\x23\x77\x46\xFE\x2E\xF2\xC1\x48\xDB\x91\x93\x8E\x80\x85\x70\xAE\x85\x70\x81\x85\x70\x89\x85\x00\x93\x97\x4F\xEE\x9E\x7C\xF3\xE4\x6D\xF7\xBF\x7E\x3F\x0C\x20\x9C\x5F\x6C\xE6\xDD\xEC\x2E\x22\xFC\xB1\x88\x70\xA0\x88\xF0\x6A\x11\x61\xD7\xE4\x3F\x4F\x7E\x63\xB2\x37\x59\xFD\x3E\x16\xBF\x25\x7E\x5B\xFC\xAE\xF8\x07\xE3\x77\xC7\x3F\x12\x7F\x20\xFE\x60\xFC\xE1\xF8\xE7\xE2\x9F\x8B\x7F\x29\xFE\xD5\xF8\xA3\xF1\x6F\xC7\x9F\x88\x3F\x19\xFF\x7E\xFC\x07\xF1\xE7\xE2\xCF\xC5\x7F\x16\xFF\x79\xFC\x97\xF1\x5F\xC7\x7F\x1B\x3F\x1A\x6F\x1C\x00\x22\xC4\xDA\x11\x12\xED\x08\x73\xDA\x11\xCE\x6F\x47\x58\xD4\x8E\xD0\xDD\x8E\x50\x6A\x47\xF8\x9D\xF6\x7B\x2D\x32\x6B\xE6\xAC\x6D\xB3\x1E\x9F\x45\xFE\xD3\x08\x2B\xD3\x08\x97\xA7\x11\x2A\x69\xA4\xF3\x4F\x01\xD0\xE1\x75\xC0\x29\x93\x4F\x39\xF5\x94\xCC\x29\xF3\x4F\x5A\x73\x52\xA3\x04\x19\x18\x85\x7B\xE1\x21\x78\x08\xC0\x8C\x50\x1F\xFC\xB9\xF9\x73\xB3\x35\xDA\x1A\xFD\x55\xEC\x57\xB1\x96\x49\x2D\x93\x2C\xBB\xD5\x3E\xD3\x9E\x61\xAF\xB7\xFB\xEC\x8D\x76\xC5\x86\xE7\xBD\x83\xDE\x51\xEF\xE8\x21\xEF\x88\xF7\x58\x1A\x41\xC0\x53\x12\xBA\xCE\x41\x38\xFF\x1C\x84\x6D\x8F\x22\xDC\xF7\x28\x42\x6D\x0F\xC2\x4D\x7B\x10\x10\x5A\x08\x6C\x68\x81\x51\x68\x21\x89\xC2\x37\xBD\x56\x92\xB2\x78\x53\x10\xA3\x13\x47\xDF\xF6\xF0\xA4\x57\x27\x6D\xD3\x10\x76\x6B\x8D\x3A\xEE\x8A\x20\xF4\x46\x10\x2A\x12\x54\x7E\xD5\xF3\x5F\xC9\xB7\xCA\x73\xB0\xFD\xFE\xCF\xF3\x2F\x9F\x13\x10\xCE\x39\x01\x61\xCE\x09\x08\x4B\x4E\x40\x80\x07\xE7\x3C\x38\xFF\xC1\x95\x0F\x76\x3F\x78\xF5\x83\xD7\x3E\xD8\xF3\xE0\xB6\xB6\x57\xDB\x0E\xB6\xBD\xD9\x36\xBC\xF3\xF1\x9D\x0F\xB7\x22\x7C\xBF\x15\xC5\x84\x76\xB0\x11\x41\xA8\x1E\x7C\x5E\xC6\x0E\xD8\x09\x5F\x85\xAF\xC3\xE3\xF0\x1C\x3C\x07\xAF\xC3\xEB\xF0\x55\xED\x97\xDA\x7F\x68\x2F\x6A\x7F\xD0\x3C\xAD\xAE\xD7\xF5\xAD\xFA\x56\xFD\x36\xFD\x36\xFD\x76\xFD\x76\x3D\x62\x46\xCC\xA4\x99\x34\x27\x9B\x93\xCD\x8C\x99\x31\xE7\x9B\xF3\xA9\x3E\x44\x5D\xF4\xC5\xF3\xF1\x4B\x5A\x2E\x69\xD9\xDB\xFA\x7C\xEB\x91\xF4\x91\xF4\xEF\xDF\xF6\xC7\xB7\x9D\x7B\xD2\x9C\x93\xB4\x49\xFA\xA4\xC8\xA4\xC8\xA4\xA7\xDB\x9F\x6E\x7F\xA1\xFD\x85\xF6\x17\xDB\xFF\xD0\xBE\xBF\xFD\xCF\xED\xAF\xB6\xBF\xDE\x7E\xB8\xFD\x70\x3B\xD8\x96\xDD\x42\x75\x37\x6C\xD7\xED\xAD\xF6\x98\xFD\x01\x7B\x9B\xFD\xB8\x0D\xD9\xD3\xB2\x67\x64\xA7\x65\xA7\x67\x67\x65\xCF\xCE\xAE\xCC\xAE\xCE\xF6\x64\xDF\x97\x7D\x7F\xF6\xEE\xEC\xE9\x53\xE7\x4F\xBD\x6C\xEA\xFA\xA9\xDE\x19\x30\xAD\x76\xD6\xE6\xB3\xFE\xE1\xAC\x8F\x9E\xE5\x9D\x05\x33\x2E\x9F\x71\x60\xE6\x91\x99\xD0\x65\x74\x99\x5D\x66\x57\xAC\xCB\xEE\xEA\xEA\x3A\xAF\xEB\xA2\xAE\x4B\xBA\xFE\xB9\xEB\x9E\xAE\x6D\x5D\xDB\xBA\x8E\x74\xBD\xD1\x75\xF7\xAC\x7B\x67\xED\x9A\xF5\xEB\x59\xF6\xEC\x9E\xD9\xA3\xB3\x7F\x38\xDB\x9B\xED\xCD\x7E\xC7\xD9\xDE\xD9\xBB\x56\x7A\x2B\x61\x7B\x76\xFB\x1D\xDB\xEF\xDC\xDE\xF5\xC0\x05\x0F\xCC\xD8\x31\x63\xC7\x0F\x77\xFC\x70\xC7\x35\x3B\xAF\xD9\x59\xDC\x39\xB8\xF3\xE2\x37\x2F\x79\x33\x7D\xF4\xE4\xA3\x5D\x47\x2F\x3F\xBA\xF6\xE8\xC6\xA3\x03\x47\x07\x8F\x8A\xB6\x46\xCF\xF6\x2E\xF4\xE6\x7B\xD7\x78\x79\x6F\xD8\x1B\xF6\x3E\xE9\xDD\xEB\xED\xF3\x7E\xEB\xFD\xA7\xB7\xDF\x3B\xE4\xBD\xC9\xFD\x00\x11\x34\x44\x88\x22\xC2\xD9\x88\x70\x1E\x22\x5C\x82\x08\x77\x23\xC2\x3D\x88\xB0\x1B\x11\xDE\x40\x84\x17\x34\x84\x23\x1A\xC2\xAF\x2A\x08\xBF\xAE\x34\xFA\x07\xEC\x46\x78\x75\x37\x02\xEC\x41\x38\x7D\x0F\xC2\xB4\x3D\x08\x1B\xF7\x20\x14\x65\xBF\xB9\x65\x0F\xC2\xAD\x7B\x10\xEE\xDA\x83\xB0\x63\x0F\xC2\x67\xF6\x20\xFC\xE7\x1E\x84\x7D\x3F\x42\xF8\xF3\x8F\x10\xE0\x69\x84\x2B\x9F\x46\x58\xFF\x34\xC2\x8D\x4F\x23\xC0\x33\x08\x6B\x9F\x41\xB8\xF2\x19\x84\x7B\x9E\x41\xF8\xE4\x33\x08\xF7\x3E\x83\xF0\x3F\x25\x7C\xEA\x19\x84\xFB\x9F\x41\xD8\xF1\x0C\xC2\xA7\x9F\x41\xF8\xCC\x33\x08\x5F\x7D\x06\xE1\xEB\x12\x1E\x7B\x06\xE1\x5B\xCF\x20\x7C\xE7\x19\x84\xC8\x5E\x84\xE8\x5E\x84\xC4\x5E\x84\xD4\x5E\x84\x89\x7B\x11\xDE\xB6\x17\xA1\x7D\x2F\xC2\xA9\x7B\x11\x2E\xD8\x8B\x70\xE1\x5E\x84\x8B\xF7\x22\xCC\xDF\x8B\x70\xE9\x5E\x84\xC5\x12\x2E\xDB\x8B\xD0\xBD\x17\xE1\xF2\xBD\x08\x9F\x7A\x16\xE1\x81\x67\x11\xBE\xFF\x1C\xC2\x0F\x9E\x43\xF0\x9E\x43\xD8\xF4\x07\x84\x2F\xFC\x01\x01\xFF\x88\x30\xEF\x8F\x08\x70\x00\xE1\xAC\x03\x08\x5D\x07\x10\x3E\x72\x00\x61\xDB\x01\x84\xCF\x1C\x40\x78\xE4\x00\xC2\xE3\x07\x10\xBE\x71\x00\xE1\x87\x07\x10\xF6\x1C\x40\x78\xF5\x00\x1F\x64\x3E\xF4\x12\xC2\x6F\x5F\x42\xF0\x5E\x42\xC0\x97\x11\xB4\x97\x11\xD2\x2F\x23\x5C\xF8\x32\xC2\xFC\x97\x11\x96\xBE\x8C\xD0\xFD\x32\xC2\xDB\x5F\x46\x58\xFF\x32\x42\xFE\x65\x3E\xE8\x7C\xEE\x35\x84\x7D\xAF\x21\xFC\xE1\x35\x84\x03\xAF\x21\xBC\xF1\x1A\x1F\x6E\xD6\x5E\x47\x18\x7B\x1D\xE1\xF9\xD7\x11\xF6\xBD\x8E\xF0\xFB\xD7\x91\x2E\xEE\x58\x07\x11\xD2\x07\x11\x96\x1C\x44\xE8\x3E\x88\x70\xF5\x41\x84\xF5\x07\x11\x6E\x3F\x88\x70\xF7\x41\x84\x87\x0E\x22\x3C\x7C\x10\xE1\x91\x83\x08\x70\x08\xE1\xC6\x43\x08\x37\x1D\x42\xF8\xFE\x21\x84\xA7\x0E\x21\xAC\x39\x8C\xB0\xFE\x30\xC2\xD0\x61\x84\xE1\xC3\x08\xF5\xC3\x08\x37\x1E\x46\xB8\xE9\x30\xC2\xD8\x61\x84\xF7\x1E\x46\xB8\xFB\x30\xC2\x03\x87\x11\x1E\x3E\x8C\xF0\xA5\xC3\x08\xBB\x0E\x23\x7C\xF3\x30\xC2\xEE\xC3\x08\xCF\x1E\x46\x80\x23\x08\x1F\x3E\x82\xF0\xF7\x47\x10\xBE\x77\x04\xE1\xC0\x11\x84\x43\x47\x8E\x9D\x57\x7E\xA5\xFF\x49\x1F\x9B\xFE\xE7\xE9\x87\xA6\x7B\xD3\xE1\x79\xEF\x97\x60\x23\x7C\xEC\x7F\x20\xC0\x54\x84\xF2\x54\x84\xE1\xA9\x08\xF5\xA9\x08\x63\x53\x11\x16\x9E\x86\x00\x31\x84\x48\x0C\x21\x26\x21\x11\x43\x38\x37\x86\x70\x5E\x0C\xE1\xFC\x18\xC2\x45\x12\x2E\x91\x00\xC6\xAD\xC6\xED\xC6\xCC\xC8\x58\xFB\x1D\xED\x67\x4D\x39\x6B\xCA\x8D\x53\x6E\x9C\xB2\xAF\xD3\xEB\x9C\x7F\xFF\xBD\xF7\xCF\x38\x3A\xF3\x28\x48\xDA\xCA\x7F\xE2\xDD\xF1\x2B\xE2\xBD\xF1\x8D\xF1\xD1\xF8\xBE\x07\xBC\x07\xE0\x64\x04\xF3\x64\x84\xB8\x84\xE4\xC9\x08\x6D\x27\x23\x9C\x78\x32\xC2\xDB\x4E\x46\x98\x74\x32\xC2\xB9\x27\x23\x9C\x77\x32\xC2\xF9\x27\x23\x5C\x78\x32\xC2\xE2\x93\x11\xBA\x4F\x46\xB8\xFA\x64\x04\x98\x84\x70\xE1\xA4\x40\xFC\x8F\x22\x14\x1F\x45\x18\x7E\x14\xE1\xE6\x47\x11\xC6\x1E\x45\xB8\xE3\x51\x84\xBB\x1F\x45\xF8\xD8\xA3\x08\xF7\x3C\x8A\x70\xEF\xA3\x01\xFF\x5D\x08\x33\xCE\x69\xCC\xD3\x10\x41\x38\x23\x82\xB0\xAF\x15\x89\x47\x07\x13\x96\x4E\xB8\x6C\xC2\xCA\x09\xDD\x13\xAE\x9C\xF0\x8E\x09\xEF\x98\xB0\x6E\xC2\x75\x13\xD6\x4F\xB8\x63\xC2\x9D\x13\xFE\x6E\xC2\xDD\x13\x1E\x9E\xF0\xB9\x09\x5F\x9C\xF0\x95\x09\xFF\x36\x61\xD7\x84\x5D\x13\xBE\x39\xE1\x3B\x13\x9E\x9C\xF0\xEC\x84\xE7\x27\xA4\xDB\x26\xB4\x9D\xD8\x36\xA9\x6D\x5D\xDB\x75\x6D\x37\xB7\x8D\xB5\x7D\xAC\x6D\xAC\xF3\x1F\x3B\xB7\x75\xDE\xDF\xF9\x40\xE7\x67\x3A\x1F\xEE\xFC\x52\xE7\x57\x3A\xFF\xAD\x73\x57\xE7\x77\x3B\x9F\xEC\xFC\x41\xE7\xEE\xCE\x67\x3B\x9F\xEF\xFC\x45\x27\xEE\x34\x77\xC6\x77\xB6\xEC\x3C\x61\xE7\xDB\x76\xDA\x3B\x4F\xDF\xD9\xB1\x73\xC6\xCE\x6D\xE9\xEF\xA4\x9F\x48\x3F\x91\x7E\x2A\xFD\x54\x7A\x77\xFA\x70\xFA\x8D\xB4\x97\xBE\xBB\xFD\x6B\xED\x8F\xB5\x3F\xDE\x0E\x9D\xA7\x75\x9E\xD1\x79\x46\xA7\x78\x60\xFA\x8C\xE9\x5D\xD3\xAF\x9F\x0E\xFB\x10\xCC\x7D\x08\xB1\x7D\x08\x93\xF6\x21\x4C\xDE\x87\x90\xDD\x87\xF0\x3F\xF6\x21\x4C\xDD\x87\x70\xFA\x3E\x84\x33\xF7\x21\x74\xE9\x08\x97\xE9\x08\xD0\x86\xA0\xB7\x21\x44\xDA\x10\x92\x6D\x08\xAD\x6D\x08\xE9\x36\x84\xB6\x36\x84\x8E\x36\x84\x33\xDB\x10\xBA\xDA\x10\x66\xB7\x21\x9C\xDD\x86\x70\x6E\x1B\xC2\x05\x6D\x08\x17\xB5\x21\x5C\xDA\x86\xB0\xA4\x0D\x61\x69\x1B\xC2\xF2\x36\x84\x95\x6D\x08\xDD\x12\xAE\x92\x70\x5D\x1B\x42\x6F\x1B\xC2\xC6\x36\x84\x52\x1B\xC2\x70\x1B\x42\xBD\xAD\x51\xFF\xC3\x7A\x4D\x1F\xD1\x6F\xD0\x6F\xD2\xDF\xA5\x8F\xEA\xA3\xFA\xAD\xFA\xAD\xFA\x7B\xF5\xF7\xEA\x77\xE8\x77\xEA\x77\xE9\x77\xE9\x1F\xD0\xFF\x45\xBF\x4F\x7F\x41\x3F\xA0\x7B\xFA\xE9\x53\xCE\x9C\x72\xDD\x14\x77\xCA\xC6\x29\xC5\x29\x8F\x4F\x79\x7C\x0A\x64\x4E\xCC\x4C\xCA\x4C\xC9\xD8\x99\x45\x99\xA5\x99\x95\x99\xEE\xCC\x55\x99\xAB\x33\x57\x67\xAE\xC9\x5C\x93\xB9\x2E\x73\x5D\xA6\x27\xF3\xAE\xCC\x58\xE6\x0B\x99\x2F\x65\xBE\x9D\xF9\x6E\xE6\xE9\xCC\xB3\x99\x9F\x66\x7E\x9E\xF9\x53\xE6\xE5\xCC\x2B\x99\xD7\x32\x47\x33\xA7\x67\x4F\xCF\xE6\x77\xE6\x77\x06\xD7\xEF\xF9\x88\xF0\x01\x44\xD8\x26\x01\x7E\x84\xB0\xE8\x47\x8D\xFC\xBE\x3B\x71\x4B\xE2\xB6\xC4\xDF\x25\x3E\x98\xF8\x50\xE2\x23\x89\x07\x12\x0F\x26\x1E\x4E\x7C\x2E\xF1\xF9\xC4\x17\x13\x5F\x4D\x3C\x9A\xF8\x4E\xE2\x89\xC4\xFF\x4A\x7C\x3F\xF1\x54\x62\x77\x62\x77\x62\x5F\xE2\xD7\x89\xDF\x26\x5E\x4A\x1C\x4A\x78\x09\x9F\x7E\x9E\x82\x90\x9F\x82\xD0\x3F\x05\x61\x60\x0A\x42\x71\x0A\xC2\x07\xA6\x20\xDC\x3D\x05\xE1\x43\x53\x10\x3E\x32\x05\xE1\x9F\xA6\x20\x6C\x9B\x82\xB0\x63\x0A\x02\x26\xF4\x44\x24\x91\x48\xB4\x26\xD2\x89\xB6\x44\x47\xE2\xCC\x44\x57\x62\x76\xE2\xEC\xC4\xB9\x89\x39\x89\xF3\x13\x17\x24\x2E\x4A\x5C\x94\xB8\x38\xB1\x20\xB1\x24\xB1\x34\xB1\x3C\xB1\x32\xF1\xF6\xC4\xDB\x13\x57\x27\xAE\x4D\x5C\x9F\xB8\x3E\xB1\x31\xB1\x39\x31\x36\xE3\x63\x33\xFE\x79\xC6\x9F\x67\xC0\xCC\xBD\x33\x23\x5D\x91\xAE\x68\x57\xB4\x2B\xDB\x35\xAD\xEB\xFC\xAE\x0B\xBB\xE0\x9C\xC7\x57\xC2\xAA\x37\xEE\x85\x43\x43\x87\x87\x0F\xFF\xF8\xB0\xC8\xDF\x81\x0A\xC2\x4B\x15\x24\x29\xA2\x9F\xDF\xAF\x01\x6C\xD7\xE0\x9C\x2F\x6B\x30\xFF\xCB\x1A\x4C\xF9\x8A\x06\xF6\x57\x34\xF8\x97\x1F\x68\xF0\xF0\x0F\x34\xD8\xF7\x7B\x0D\xE0\xA0\x06\x53\x0E\xB3\xC4\xD1\x65\x6D\x3A\xC0\x09\xDE\x09\x33\xBA\x66\x76\xCD\x9A\xF5\x81\x59\x30\xFB\xD4\xD9\xEB\x67\x6F\x9D\xBD\x7E\xC7\xCD\x3B\xE0\xD3\xF7\x3D\xF7\xF0\x73\xDF\x7D\xEE\xFB\xCF\x1D\x79\x6E\x9B\xF7\x6F\xDE\x37\xBD\x27\xBC\xEF\x79\x3F\xF4\x7E\xE4\x3D\xE7\xFD\xC4\xFB\x59\x83\x86\x4A\x21\x9C\x91\x42\xE8\x4A\x21\x5C\x90\x42\xB0\x4F\x3A\xE7\xA4\x60\xFB\xEC\x8B\x21\xBC\x1C\x43\x78\x25\x86\xF0\x6A\x0C\xE1\x48\x0C\xC1\x8B\x35\xDA\xE7\x43\x91\x27\x22\xBB\x23\xBF\x8B\xFC\x29\xF2\x4A\x64\xCA\x91\x39\x47\xCE\x3F\x72\xD1\x91\x8B\x8F\x5C\x7C\x64\xFE\x11\xE7\xC8\xC2\x23\x97\x1E\x59\x7C\x64\xF5\x11\xA7\xEB\x1F\xBB\x3E\xD1\x75\x2F\x89\x2B\xE2\xC3\x08\xA7\x3E\x82\xD0\xFD\x08\xC2\xE5\x8F\x60\xE3\xF2\xA7\xEA\x0F\x31\x84\x2B\x62\x08\x57\xC5\x10\x7A\x44\x3A\x7A\x45\xBF\xCD\x78\xAF\xB1\xDC\xBC\xC2\x1C\x36\x87\xCD\xB7\xC7\xD7\xC6\x1F\x3E\x65\xD7\x29\xBB\xDB\x7F\xD4\xFE\x4C\xFB\xBE\xF6\x5F\xB5\xFF\x67\xFB\x1F\xDB\xFF\xD8\xFE\x4A\xFB\x2B\xED\x07\xDB\x0F\xB5\xEF\x9A\x72\x68\xCA\x91\x29\xDE\x94\xA4\x9D\xB2\x77\xDB\x07\xEC\x33\xBB\x3A\xBB\x3E\xD6\xF5\xF1\x2E\x38\xDA\x7A\xD4\x3E\xDA\x79\xF4\x4D\x44\x10\xB0\x4F\x63\xB8\xB0\x8D\xA1\x7F\x0F\x42\x61\x0F\xC2\x3B\xF7\x20\xBC\x67\x0F\xC2\x6D\x7B\x10\xDE\xBF\x07\xE1\xC1\x3D\x08\x0F\xED\x41\x00\x6C\x81\x3F\x61\x0B\xAC\xB7\x10\xAA\x16\xC2\x8D\x16\xC2\xA8\x85\x30\xDF\x42\xB8\xC2\x42\x78\x87\x85\xD0\x63\x21\x8C\xED\x78\x6A\xC7\xEE\x1D\x3F\xDE\xF1\x8B\x1D\xBF\xDC\x21\xCA\x33\x96\x66\x9E\xBE\xA2\x4F\xC7\x92\x77\x25\x3F\x90\xBC\x3B\xF9\xE1\xE4\x03\xC9\x07\x93\x9F\x4F\x7E\x31\xF9\xD5\xE4\xA3\xC9\x6F\x27\xBF\x9B\x7C\x32\xF9\xBD\xE4\x53\xC9\xBD\xC9\x67\x93\xBF\x48\xFE\x22\xB9\x2F\xF9\xEB\xE4\x6F\x93\x7F\x4A\xBE\x94\x7C\x39\x19\x6C\x8F\x7F\xE9\x3A\xDC\xF5\x66\x97\xD7\x75\x60\x96\x37\x6B\xF7\xEC\xA3\xB3\xE1\xEC\xAB\xCE\xDE\xE8\x55\xBC\x4D\xDE\x27\xB8\x4D\x1F\x66\x46\x6A\xDF\x23\x08\xFD\xA2\x7E\x77\x74\xEE\x98\xB9\x63\xE6\x0E\x3F\x82\x04\x82\x9E\x40\x88\x24\x10\xCC\x04\x42\x32\x81\xD0\x96\x40\x38\x31\x81\x70\x52\x02\xE1\xE4\x04\xC2\xB9\x09\x84\xF3\x13\x08\x73\x13\x08\x97\x24\x10\x96\x26\x10\xBA\x13\x08\xEF\x48\x20\xFC\xA6\xC2\x00\xEF\x47\xD8\x7B\x17\xC2\xD8\x49\x3F\x3F\x69\xDF\x49\x2F\x9E\x74\xE0\xA4\x43\x27\xED\x3B\xD9\x3B\x19\x26\x20\x9C\x30\x01\xA1\x6D\x02\xC2\xC5\x13\x10\x1E\x9E\x80\xF0\xBB\x09\x08\x07\x26\x20\x1C\x9A\x80\xBE\x7C\xD0\x83\xF0\x20\x7C\x11\xBE\x08\x5F\x83\xAF\xC1\x2E\x78\x16\x9E\x87\xD7\xE0\x20\x7C\x43\xFB\xAE\xB6\x47\xDB\xA7\xFD\x46\xFB\x83\xF6\x07\x6D\xBF\xB6\x5F\x1B\xD6\xEB\xFA\xE6\xC0\x7C\x75\xEC\x5C\xF5\xAA\xFE\xBA\xFE\x6E\xE3\x4E\x63\x66\x84\xF7\x82\x57\x47\xD6\x47\xEE\x90\x7D\xF2\xE5\x88\x6D\x5E\x66\x96\x69\x1F\xFE\xB4\xB9\xD7\xDC\x6B\xFE\x87\xF9\x5B\x73\xBF\xF9\x27\xF3\xB0\xF9\x86\xE9\x99\x9E\x99\x8E\xA6\xA3\x13\xA2\x33\xA3\x2B\xA3\x9F\x8A\x3E\x12\x7D\x24\xFA\xBD\xE8\xEF\xA2\xAF\x44\x5F\x8D\x1E\x8E\x1E\x8E\x42\xEC\xC4\xD8\x29\xB1\x53\x62\x53\x63\x53\x63\x1D\xB1\x8E\xD8\xFC\xD8\x3B\x62\xEB\x63\xC5\x98\xDA\xC7\x1B\xF1\x0B\xE2\xF3\xE2\xF3\xE2\xDD\xF1\xEE\xF8\x3B\xE2\x6E\x7C\x53\x7C\xEC\xB8\x7B\xC5\xC7\xE2\x8F\xC5\x7F\x10\xFF\x81\xDC\x23\xBE\x10\x3F\x10\x7F\x29\xFE\x46\xFC\x8D\xF8\x5B\xCD\x35\x6A\x5E\xA9\x26\xEA\xC7\x9D\x03\x1F\x4B\x3C\x26\xE7\xBE\x17\x12\x87\x12\x87\x12\x11\x2B\x69\xB5\x5A\x69\xAB\xCD\xEA\xB0\xCE\xB4\xBA\xAC\xD9\xD6\xD9\xD6\xB9\xD6\x05\xD6\x3C\x6B\x9E\x75\xAD\x75\x9D\xD5\x63\xB9\xD6\x26\x6B\x93\x75\x8B\x75\x8B\x75\x9B\x75\xA7\xF5\x01\xEB\x6E\xEB\xC3\xD6\x3F\x58\x1F\xB3\x3E\x6E\xDD\x63\xDD\x63\x7D\xD2\xBA\xD7\xBA\xCF\xFA\x57\xEB\x01\xEB\x41\xEB\x33\xD6\x57\xAD\xDD\xD6\x6E\x2B\x92\x4C\x26\x5B\x92\xE9\xE4\x84\x64\x47\xF2\xCC\xE4\x05\xC9\x79\xC9\x79\xC9\x77\x24\xD7\x25\xD7\x27\xDD\xE4\x58\x72\x2C\x79\xDB\x38\x7D\xFA\xB1\xE4\x63\xB2\x1F\xBF\x40\x7D\xD8\x48\x25\x53\x2D\xA9\x74\x6A\x42\x6A\x6E\x6A\x5E\x6A\x5E\x6A\x55\x6A\x55\x6A\x6D\xEA\xCA\x54\x4F\xCA\x4D\xDD\x94\x1A\x4D\xDD\x96\xFA\xC7\xD4\xC7\x53\x8F\xA4\x3E\x9F\xFA\x7A\xEA\xB1\xD4\x63\xA9\x5D\xA9\xEF\xA6\xB0\xA5\xAB\x65\x76\xCB\xD9\x2D\xF3\x5B\x16\xB7\xBC\xBB\xE5\x3D\x2D\xB7\xB6\xDC\xDA\xF2\xDE\x96\x3B\x5B\xEE\x6A\xB9\xAF\xE5\x53\x2D\x9F\x6A\xD9\xDE\xF2\x70\xCB\xE7\x5A\x3E\xDF\xF2\x58\xCB\x63\x2D\xBB\x5A\xBE\xDD\xF2\xDD\x96\xEF\xB6\xFC\xAC\xE5\x97\x2D\xD0\x0A\xAD\xF3\x5B\x97\xB4\x2E\x6B\x2D\xB5\xDE\xD1\x7A\x57\x2B\xA4\xCF\x4C\x5F\x92\xBE\x24\xDD\x9D\xBE\x22\xBD\x2E\x7D\x5D\xFA\xFF\xC7\xDE\x97\xC0\x37\x51\x6D\xFF\x9F\x33\x99\xB4\x4D\xD3\x34\x29\x94\x2E\x49\x7B\x93\x58\x20\x04\x86\x10\x16\x59\xCA\x56\x56\x15\x65\x71\x63\x71\x21\x0D\x6D\xDA\x06\xDA\x24\x24\x29\x8B\x0B\x94\x4D\x05\x41\x50\x71\x47\xA9\x8A\x33\x6D\xAA\x02\x0A\x88\xB2\x15\x17\x5C\x11\x54\x16\x05\xD4\x82\x8A\x28\x20\xB8\x2B\x4B\xF2\xFF\xCC\xCC\x4D\x9B\xC6\xA2\xBE\xF7\x7E\xBE\xF7\xFE\xBF\x9F\xC3\xE7\xD0\xDC\x73\xEF\xDC\xFD\x7E\xCF\xB9\xDB\x19\xA7\xCE\xA9\x73\xE9\x4A\x74\x1E\x9D\x4F\x57\xA9\x9B\xA3\xBB\x4B\x77\x97\xEE\xB7\x72\xFF\x5F\xD3\x43\xAA\x5A\x2F\x6D\x1D\x9D\x3B\x62\x7A\x79\x86\x37\x63\x76\xC6\x9C\x8C\x87\x33\xAA\x33\xBE\xCE\xF8\x36\xE3\x97\x0C\xC8\x4C\xC9\x4C\xCD\x4C\xCB\x34\x65\x76\xCD\x2C\xC8\xBC\x32\xB3\x30\xB3\x3C\xD3\x93\xE9\xCB\xAC\xCA\x7C\x3E\x73\x7F\xE6\xFE\xCC\x43\x99\x87\x32\x4D\x59\x33\xB2\xAA\xB2\xE6\x67\xDD\x9E\x55\x93\x15\xCA\x0A\x65\x89\xF3\x6B\xC8\x26\xD9\x63\xB2\x2B\xB2\x7D\xD9\xC1\xEC\xAA\xEC\xBA\xEC\x35\xD9\x6F\x66\x83\x3E\x43\x6F\xD2\x5F\xA3\x17\xF4\x82\x5E\x69\xE8\x6E\x18\x66\xB8\xDC\x30\xCF\x50\x6D\x78\xD6\xB0\xDA\xF0\x92\xE1\x0B\x03\xE4\xE4\xE5\x8C\xCC\x19\x9D\x73\x5D\xCE\xAD\x39\xA2\xDE\x18\xD5\x67\x9A\xE6\x8B\x3F\xC9\xF3\x45\x51\xC6\x93\x3F\x2B\xE3\x37\x1B\xB7\x1A\xB7\x1A\x5F\x96\x64\xFD\x3B\xC6\xDD\x54\xDE\x37\x18\x4F\x50\x79\x7F\xCE\x38\xD5\x34\xD5\x34\xDB\x34\xDB\xB4\xCC\xB4\xC2\xC4\x98\x19\x73\xA2\x39\xD1\x9C\x6C\x6E\x6D\x6E\x63\x6E\x63\xCE\x36\xE7\x9A\xDB\x9A\xDB\x9A\x45\x9D\xA0\x83\xB9\x83\xB9\xA3\xB9\xB3\xB9\x8B\xB9\x8F\xB9\x9F\x79\xA0\x79\x98\xF9\x32\xF3\x28\xF3\x28\xF3\x3C\xF3\x7C\x73\x54\xCF\x2A\xE4\x3E\xE7\x8E\x73\xDF\x70\xDF\x71\xDF\x73\xB1\x7A\x98\xBD\x73\x69\x67\x6F\x67\x6F\xE7\x3F\xA3\xEF\x75\xB1\x75\xB1\x29\xED\x09\xF6\xAE\xF6\x8B\xED\x7D\xED\xFD\xEC\x51\xB9\x24\x62\xEA\x39\x7B\xC4\xAE\xEC\xDA\xA5\xAB\x28\x47\xAB\xBB\x6E\xEB\x2A\xE2\x6B\xA3\xBC\xAE\x5E\xBC\x6A\xF7\xAA\xF3\xAB\xE0\xA9\x14\x5E\xC7\x1B\xF9\x8E\x7C\x27\xBE\x80\xF7\xF0\xB3\xF9\x47\xF9\x6A\xFE\x0B\x3E\x53\x30\x0A\x17\x09\x77\x08\x77\x0A\xDB\x84\x97\x85\xB7\x84\x1F\x05\xAC\x51\xD4\x28\x6B\x12\x6B\x92\x6B\x52\x6A\x2E\xAA\x29\xA8\x09\xD4\xCC\xAD\x79\xBE\xE6\xBB\x9A\x9F\x6B\xCE\xD6\x9C\xAD\x39\x5F\x13\xAE\x49\xAE\x6D\x57\x6B\xAF\x1D\x5E\x2B\xCA\xEA\xF9\xB5\xCF\x49\xF3\xE1\x86\xDA\xCF\x6B\x8F\xD6\x9E\xAA\x3D\x53\x1B\xAE\x85\x50\x87\x50\x41\x68\x70\x68\x68\xE8\xF2\x50\x61\x68\x5A\xE8\xA6\xD0\x4D\xA1\x59\xA1\xD5\xA1\xB5\xA1\xB5\xA1\xF5\xA1\x0D\xA1\x17\x43\x5B\x42\xF5\xA1\xFA\xD0\xCB\xA1\x97\x43\x07\x43\x1F\x87\x1A\x42\x5F\x87\xBE\x0B\xFD\x10\x6A\x49\xA7\xB5\xD7\x5D\x57\x77\x43\x9D\xBB\xCE\x57\x77\xA4\x2E\x56\x2F\x68\xD4\x43\xCE\x26\x9C\x6D\x7D\x36\xF3\x6C\xEE\xD9\xDC\xB3\xC6\xB3\x1D\xCE\x76\x6C\x51\x8E\xAF\x8D\x5B\xAB\x3C\xDB\xB8\x56\x69\x8E\xE4\x47\x06\x45\xAE\x8B\x94\xB4\xA8\x67\x20\xA8\x01\x25\x2B\x39\xED\x01\xA1\x03\x20\xE4\x03\x42\x3F\x40\xE8\x0F\x08\x03\x01\x61\x24\x20\x8C\x01\x84\x1B\x01\xA1\x0A\x10\xCE\x88\x7F\x19\x84\x15\x0C\x42\xE3\x7A\x92\x02\xC1\xA8\x40\xE8\xAC\x40\x28\x50\x20\x0C\x56\x20\x5C\xA6\x40\x18\xA3\x40\xA8\x54\x20\x54\xD1\xB3\x72\xD5\x0A\x84\x57\x14\x08\x6F\x28\x10\x76\x89\xFA\x36\x8B\xF0\x28\x8B\x10\x5D\x67\x8E\xAE\x31\x47\xE7\x1D\xD1\xF5\x29\x48\x40\xE8\x99\x88\x50\x90\x88\x70\x6D\x22\x42\x61\x22\x42\x69\xE2\x3F\x36\x3F\x13\xF5\x96\xC2\x24\x84\x69\x49\x08\x55\x49\x08\x8F\x25\xE1\x6F\xF4\x27\x50\x21\xB4\x51\x21\x98\x54\x08\x7D\x54\x08\x55\x2A\x84\x17\x54\x08\x5B\x55\x08\xDB\x54\x28\xC9\x67\x91\x74\x17\x90\xCB\x85\xC9\x08\xB7\x24\x23\x54\x25\x23\xAC\x48\x46\xA8\x4F\x46\x78\x3D\x19\xE1\x4D\x51\x36\x8B\xEF\xD2\xF5\xCF\xA8\x5E\x12\xD5\x57\xAA\xD4\x08\x77\xAB\x51\x3A\x88\x77\x69\x8A\xA8\x87\xC8\xEB\xEB\xD1\xB5\x75\x51\x0F\xCC\xD3\x20\x54\xA5\x22\xD4\xA6\x22\xAC\x49\x45\x58\x9B\x8A\x00\x5A\x84\x1C\x2D\x82\x85\x92\x5D\x8B\x30\x4C\x8B\xB0\x46\x8B\xF0\xAA\xB6\x69\xDE\xA6\xD0\x21\xF4\xD2\x21\xCC\xD3\x21\xAC\xD6\x21\xEC\xD6\x21\x1C\xD3\x21\x28\xD2\x10\xDA\xA7\x21\x0C\xA5\x74\x09\xA5\x31\x69\x08\xFE\x34\x84\x69\x94\xE6\xA5\x21\x3C\x97\x86\xB0\x3D\x0D\xE1\xD5\x34\x84\x03\x94\x0E\x51\x8A\xD5\x2B\x3A\xB5\x42\xA8\x6A\x85\x70\x5B\x2B\x84\x3B\x28\x2D\x6A\x85\xB0\xA4\x15\xC2\xD2\x56\x08\x8F\xB6\x42\x58\xD9\x0A\xA1\x86\xEA\x1F\x9F\xB4\xFA\xC7\xE7\x5B\xFD\x29\x45\xE7\x57\xE2\xBC\xCA\x29\xCE\xA3\xD2\x11\x7A\xA4\x23\x5C\x92\x8E\x30\x22\x1D\xC1\x91\x8E\xE0\x4C\x47\xA8\x4A\x47\x58\x9D\x8E\xF0\x6A\x3A\xC2\x6B\xE9\x08\xAF\x53\xAA\x6A\x83\xF0\x6C\x1B\x84\x0F\xDB\x20\x1C\x6C\x83\x00\x19\x08\x5D\x32\x10\x86\x52\xAA\xCA\x40\x08\x65\x20\x6C\xA4\x14\xDD\x6F\x10\xE7\xD9\x9D\xB2\x10\xAA\xE9\x1E\x47\x24\xEB\x8F\xE7\xED\x5D\xB2\x11\x06\x52\x1A\x44\xA9\x3A\x1B\x41\xC8\x46\x08\x65\x23\xEC\xCE\x46\x38\x4C\xE9\x33\x4A\xA0\x97\x49\xAD\x47\xE8\xA6\x47\xC8\xA7\x34\x86\xD2\x0D\x7A\x84\x85\x7A\x84\x47\x29\xD5\xEB\x11\x7E\x11\xDF\x89\x59\xD7\xB6\xE5\x20\x14\x50\xF2\xE7\x20\x2C\xCD\x41\x80\x5C\x84\x84\x5C\x84\xA4\x5C\x04\x55\x2E\x82\x3A\x17\xC1\x9E\x8B\x30\x9C\x52\x4B\xF3\xB2\x85\x74\x2E\x26\x52\x03\x41\xF8\x8E\x20\xAC\x31\xCA\x14\x5D\x47\x69\x5C\x37\xA1\xEB\x08\x8D\xFB\x30\x74\x6D\xBF\x60\x32\xC2\xC4\xC9\xD8\xB8\xAE\x0F\x53\x10\xBA\x4C\x41\x28\x98\x82\x30\x64\x0A\x42\xD1\x14\x84\xE9\x53\x10\x6E\x9D\x82\xB0\x54\xE4\xD3\xBD\x22\xF0\x22\x8C\xF0\x22\x8C\xA1\x74\xAF\x17\x61\xA5\x17\xA1\xC1\x8B\x70\x98\xAE\x19\x8A\x04\x3E\x84\x9F\xE9\x61\x4E\x51\xFF\x85\x25\x08\x49\x4B\x64\x9D\x3B\x76\x5E\x13\xD5\xBF\x7D\x6B\x11\xCE\x3E\x87\x7F\xB8\x4E\xF2\xDF\xBC\x6E\x58\xBF\x0F\xE1\xE5\x7D\x08\x07\xF6\x21\x1C\xDA\x87\x70\x66\x1F\xC2\xB9\x7D\x08\xE9\xFB\x11\x32\xF6\x23\xF4\xD8\x8F\xD0\x73\x3F\xC2\xA8\xFD\x08\x63\xF6\x23\x78\xF6\x23\xF8\xF6\x23\xDC\xB1\x1F\x61\xD1\x7E\x84\x9A\xFD\x08\xA1\xFD\x08\x2F\xEF\x47\x78\x75\xBF\xBC\x0E\x09\x87\x11\xB8\xC3\x08\xBD\x0E\x23\xF4\x3F\x8C\x30\x8A\x52\xFD\x11\x84\xE3\x47\x10\xE0\x18\xC2\xAB\xC7\x50\xDA\x9F\x1B\x42\xF7\xE8\x44\xFA\x7B\x1F\x4C\xDE\x07\xFB\x67\xD7\x0B\x5A\xD6\xA3\x9B\xF4\xE7\x37\x52\x77\xA6\xEE\x4E\xFD\x48\xD6\xA3\xA5\xF3\xDE\x4D\xF3\xB5\xE6\x73\xB5\x8D\xD2\x3C\x0D\x72\xDB\xE5\x72\xB9\x37\xE4\x4E\xCA\x75\xE5\x4E\xC9\x9D\x9E\x3B\x33\x77\x6B\x2E\x90\x08\x89\xD5\xFD\x3A\x9A\x3B\x99\xBB\x99\xBB\x49\x3A\x5D\xA1\xF9\x0E\x73\x21\x37\x9B\xBB\x48\xB8\x3D\x46\x5F\x8A\x08\xB2\x8E\x52\x5C\x57\x52\xE7\xAE\x13\xF5\x91\xA8\x4E\x01\x39\xBD\x72\xFA\xE6\x5C\x26\xE9\xAF\xD2\xFC\x35\x9B\x64\x9B\xB2\x3B\x65\xDB\xB3\xFB\x66\x17\x64\x17\x64\x0F\xCD\x1E\x9D\x1D\x3B\x3F\xBE\xA0\x1C\x6F\x7C\xFE\x39\x7D\x64\xF7\xAA\xC8\xAA\x46\x2C\x8A\x79\xC4\xBA\x11\xE7\xB1\x9F\x4A\x75\x12\x01\x44\x44\x05\x2A\x50\x89\x4A\x4C\xC4\x44\x54\xA1\x0A\xD5\xA8\x46\x0D\x6A\x50\x8B\x5A\x4C\xC3\x34\x6C\x8D\xAD\xB1\x0D\xB6\xC1\x4C\xCC\xC4\x6C\xCC\x46\x03\x1A\x30\x17\x73\xD1\x88\x46\x34\xA3\x19\xF3\x30\x0F\xDB\x61\x3B\xB4\xA0\x05\xAD\x68\xC5\x4E\xD8\x09\x3B\x63\x67\xEC\x82\x5D\xB0\x2B\x76\xC5\xEE\xD8\x1D\x2F\xC6\x8B\xB1\x17\xF6\xC6\x7C\xCC\xC7\x7E\xD8\x0F\x07\xE0\x00\x2C\xC0\x02\x1C\x8C\x83\x71\x28\x0E\xC5\xE1\x38\x1C\x2F\xC5\xCB\xF0\x72\xBC\x1C\x47\xE2\x48\x1C\x8D\xA3\xF1\x4A\xBC\x12\xAF\xC6\xAB\xF1\x5A\xBC\x16\xC7\xE1\x38\x9C\x80\x13\xF0\x7A\xBC\x1E\x6F\xC4\x1B\xD1\x81\x0E\x74\xA2\x13\x8B\xB0\x08\x5D\xE8\xC2\x52\x2C\x45\x37\xBA\x71\x0A\x4E\xC1\x0A\xAC\x40\x2F\x7A\x71\x2A\x4E\xC5\x00\x06\xB0\x12\x2B\x71\x3A\x4E\xC7\x9B\xF0\x26\xBC\x05\x6F\xC1\x59\x58\x85\xF3\x70\x1E\x2E\xC0\x05\x78\x07\xDE\x81\x8B\x71\x09\xDE\x83\xF7\xE0\x7D\x78\x1F\x3E\x84\x8F\xE0\x63\xF8\x18\x3E\x8E\x8F\xE3\x93\xF8\x24\x3E\x85\x4F\x61\x0D\xD6\x60\x08\xEB\xF0\x19\x7C\x06\xD7\xE0\x1A\x5C\x87\xEB\x70\x03\x6E\xC0\x17\xF1\x25\xDC\x82\xDB\x70\x07\xEE\xC0\x37\xF1\x4D\x7C\x07\xDF\xC1\x77\xF1\x5D\xDC\x8D\xBB\xF1\x7D\x7C\x1F\xF7\xE0\x1E\xDC\x87\xFB\xF0\x43\xFC\x10\x0F\xE0\x01\x3C\x84\x1F\xE3\xA7\xF8\x29\x1E\xC6\xC3\xF8\x19\x7E\x86\x5F\xE0\x17\xF8\x25\x7E\x89\x5F\xE1\x57\x78\x1C\x8F\xE3\x49\x3C\x89\xA7\xF0\x34\x7E\x8F\xDF\xE3\x8F\xF8\x23\xFE\x8A\xBF\xE2\x59\x3C\x8B\xE7\xF1\x3C\x46\x30\x82\xC8\x20\xA3\x60\x14\x8C\x92\x51\x32\x89\x4C\x22\xA3\x62\x54\x8C\x9A\x51\x33\x1A\x46\xC3\x68\x19\x2D\x93\xC6\xA4\x31\xAD\x99\xD6\x4C\x1B\xA6\x0D\x93\xC9\x64\x32\xD9\x4C\x36\x63\x60\x0C\x4C\x2E\x93\xCB\x18\x19\xA3\x38\xA5\x61\xF2\x98\x3C\xA6\x1D\xD3\x8E\xB1\x30\x16\xC6\xCA\x58\x99\x4E\x4C\x27\xA6\x33\xD3\x99\xE9\xC2\x74\x61\xBA\x32\x5D\x99\xEE\x4C\x1F\xA6\x1F\xD3\x8F\x19\xC8\x14\x30\x83\x99\xC1\xCC\x25\xCC\x25\xCC\x65\xCC\x65\xCC\xE5\xCC\xE5\xCC\x48\x66\x24\x33\x9A\xB9\x97\xB9\x8F\x59\xCD\x4C\x55\x4C\x55\x04\x14\x01\xC5\x74\xC5\x74\xC5\xCD\x8A\x5B\x15\xCB\x14\xCB\x14\x4F\x2B\xDE\x55\xEC\x56\xBC\xA7\xD8\xAB\xD8\xAF\xF8\x48\xF1\x91\xE2\xA0\xE2\xA0\xE2\x63\xC5\xC7\x8A\x4F\x15\x9F\x2A\x0E\x2B\x0E\x2B\x3E\x53\x7C\xA6\xF8\x42\xF1\x85\xE2\x4B\xC5\x97\x8A\xAF\x14\x5F\x29\x8E\x2B\x8E\x2B\x4E\x2A\x4E\x2A\x4E\x29\xBE\x57\xFC\xA8\xF8\x51\xF1\x8B\xE2\x17\xC5\x59\xC5\x39\x85\x9D\x75\xB0\x4E\xD6\xC9\x16\xB1\x45\xAC\x8B\x75\xB1\xA5\x6C\x29\xEB\x66\xDD\xEC\x14\x76\x0A\x5B\xC1\x56\xB0\x5E\xD6\xCB\x4E\x65\xA7\xB2\x01\x36\xC0\x56\xB2\x95\xEC\x74\x76\x3A\x3B\x93\x9D\xC9\xDE\xCC\xDE\xCC\xDE\xCA\xDE\xCA\xCE\x66\x67\xB3\x73\xD8\x39\xEC\x9D\xEC\x9D\xEC\x12\x76\x09\xBB\x94\x5D\xCA\xDE\xCD\xDE\xCD\xDE\xCB\xDE\xCB\xDE\xC7\xDE\xC7\x3E\xC0\x3E\xC0\x3E\xC4\x3E\xC4\x3E\xC2\x3E\xC2\x3E\xCA\x3E\xCA\xAE\x64\x57\xB2\x8F\xB3\x8F\xB3\x4F\xB2\x4F\xB2\x4F\xB1\x4F\xB1\x02\x2B\xB0\xB5\x6C\x2D\x5B\xC7\xD6\xB1\xCF\xB0\xCF\xB0\xAB\xD9\xD5\xEC\x5A\x76\x2D\xFB\x3C\xFB\x3C\xBB\x9E\x5D\xCF\xBE\xC0\xBE\xC0\xBE\xC8\xBE\xC8\x6E\x62\x37\xB1\x5B\xD8\x2D\xEC\x36\x76\x1B\xFB\x32\xFB\x32\xFB\x2A\xFB\x2A\xBB\x83\xDD\xC1\xBE\xC1\xBE\xC1\xBE\xC5\xBE\xC5\xBE\xC3\xBE\xC3\xBE\xCB\xEE\x62\xDF\x63\xDF\x63\x3F\x60\x3F\x60\xF7\xB2\x7B\xD9\xFD\xEC\x7E\xF6\x23\xF6\x23\xF6\x20\x7B\x90\xFD\x98\xFD\x98\xFD\x94\xFD\x94\x3D\xCC\x1E\x66\x3F\x63\x3F\x63\xBF\x60\xBF\x60\xBF\x64\xBF\x64\xBF\x62\xBF\x62\x8F\xB3\xC7\xD9\x93\xEC\x49\xF6\x14\x7B\x8A\xFD\x96\xFD\x96\xFD\x9E\xFD\x9E\xFD\x91\xFD\x91\xFD\x99\xFD\x99\xFD\x95\xFD\x95\x3D\xCB\x9E\x65\xCF\xB3\xE7\xD9\x08\x1B\x61\xC5\xC1\xAB\x50\x2A\x94\xE2\x93\xA8\x4C\x54\xAA\x94\x2A\xA5\x5A\xA9\x56\x6A\x94\x1A\xA5\x56\xA9\x55\xA6\x29\xD3\x94\xAD\x95\xAD\x95\x6D\x94\x6D\x94\x99\xCA\x4C\x65\xB6\x32\x5B\x69\x50\x1A\x94\xB9\xCA\x5C\xA5\x51\x69\x54\x9A\x95\x66\x65\x9E\x32\x4F\xD9\x4E\xD9\x4E\x69\x51\x5A\x94\x56\xA5\x55\xD9\x49\xD9\x49\xD9\x59\xD9\x59\xD9\x45\xD9\x45\x5E\x9F\xD2\x9D\xD1\x9D\xD7\x45\x74\xBF\xB4\x3E\xDF\x5A\x9C\x93\x43\x6E\x27\x8A\x9F\x0F\xE7\x22\x41\xA2\x20\x0A\xA2\x24\x4A\x92\x48\x12\x89\x8A\xA8\x88\x9A\xA8\x89\x86\x68\x88\x96\x68\x49\x1A\x49\x23\xAD\x49\x6B\xD2\x86\xB4\x21\x99\x24\x93\x64\x93\x6C\x62\x20\x06\x92\x4B\x72\x89\x91\x18\x89\x99\x98\x49\x1E\xC9\x23\xED\x48\x3B\x62\x21\x16\x62\x25\x56\xD2\x89\x74\x22\x9D\x49\x67\xD2\x85\x74\x21\x5D\x49\x57\xD2\x9D\x74\x27\x17\x93\x8B\x49\x2F\xD2\x8B\xF4\x21\x7D\x48\x5F\xD2\x97\xF4\x27\xFD\xC9\x40\x32\x90\x0C\x22\x83\xC8\x10\x32\x84\x0C\x23\xC3\xC8\x25\xE4\x12\x72\x19\xB9\x8C\x5C\x4E\x2E\x27\x23\xC9\x48\x32\x9A\x8C\x26\x57\x92\x2B\xC9\xD5\xE4\x6A\x72\x2D\xB9\x96\x8C\x23\xE3\xC8\x04\x32\x81\x5C\x4F\xAE\x27\x37\x92\x1B\x89\x83\x38\x88\x93\x38\x49\x11\x29\x22\x2E\xE2\x22\xA5\xA4\x94\xB8\x89\x9B\x4C\x21\x53\x48\x05\xA9\x20\x5E\xE2\x25\x53\xC9\x54\x12\x20\x01\x52\x49\x2A\xC9\x74\x32\x9D\xCC\x24\x33\xC9\xCD\xE4\x66\x72\x2B\xB9\x95\xCC\x26\xB3\xC9\x1C\x32\x87\xCC\x23\xF3\xC8\x02\xB2\x80\xDC\x4E\x6E\x27\x0B\xC9\x42\x72\x27\xB9\x93\x2C\x21\x4B\xC8\x52\xB2\x94\xDC\x4D\xEE\x26\xF7\x92\x7B\xC9\x7D\xE4\x51\xB2\x92\xAC\x24\x8F\x93\xC7\xC9\x93\xE4\x49\xF2\x14\x79\x8A\x08\x44\x20\xB5\xA4\x96\xD4\x91\x3A\xF2\x0C\x79\x86\xAC\x26\xAB\xC9\x5A\xB2\x96\x3C\x4F\x9E\x27\xEB\xC9\x7A\xF2\x02\x79\x81\xBC\x48\x5E\x24\x9B\xC8\x26\xB2\x85\x6C\x21\xDB\xC8\x36\xB2\x9D\x6C\x27\xAF\x90\x57\xC8\x6B\xE4\x35\xF2\x3A\x79\x9D\xBC\x49\xDE\x24\x6F\x93\xB7\xC9\x4E\xB2\x93\xEC\x22\xBB\xC8\x7B\xE4\x3D\xF2\x01\xF9\x80\xEC\x25\x7B\xC9\x7E\xB2\x9F\x7C\x44\x3E\x22\x07\xC9\x41\xF2\x31\xF9\x98\x7C\x4A\x3E\x25\x87\xC9\x61\xF2\x19\xF9\x8C\x7C\x41\xBE\x20\x5F\x92\x2F\xC9\x57\xE4\x2B\x72\x9C\x1C\x27\x27\xC9\x49\x72\x8A\x9C\x22\xDF\x92\x6F\xC9\xF7\xE4\x7B\xF2\x23\xF9\x91\xFC\x4C\x7E\x26\xBF\x92\x5F\xC9\x59\x72\x96\x9C\x27\xE7\x49\x84\x24\x1A\x75\xC6\x36\x46\x93\xD1\x62\xB4\x1B\x7B\x19\x0B\x8C\xC3\xA4\x35\x97\x42\x63\xA9\xD1\x27\xAD\xB5\xDC\x6E\x5C\x66\x7C\xC0\x58\x6D\x14\x8C\x6B\xA4\x75\x97\x17\x62\xD6\x5D\x5E\xA7\xEB\x2E\xFB\x8D\x0D\xC6\x2F\xE9\xBA\xCB\xCF\xC6\x64\x73\xB2\x39\xD5\xAC\x35\xB7\x36\xB7\x36\x77\x31\x77\x31\xF7\x30\xF7\x30\xF7\x91\xD6\x56\xFA\x9B\x87\xD3\xB5\x95\xF9\xE6\xF9\x66\x3B\x37\x91\x73\x72\x4E\xCE\xC5\x95\x70\x65\x5C\x19\x37\x99\x9B\xCC\x95\x73\xE5\xDC\x54\x6E\x2A\x17\xE0\x82\xDC\x34\xEE\x66\x6E\x0E\x37\x87\x9B\xC7\xCD\xE3\x16\x70\x0B\xB8\xDB\xB9\xDB\xB9\x85\xDC\x42\xEE\x4E\xEE\x4E\x6E\x09\xB7\x84\x5B\xCA\x2D\xE5\xEE\xE6\xEE\xE6\xEE\xE5\xEE\xE5\xEE\xE3\xEE\xE3\x1E\xE0\x1E\xE0\x1E\xE2\x1E\xE2\x1E\xE1\x1E\xE1\x1E\xE5\x1E\xE5\x56\x72\x2B\xB9\xC7\xB9\xC7\xB9\x27\xB9\x27\xB9\xA7\xB8\xA7\x38\x81\x13\xB8\x5A\xAE\x96\xAB\xE3\xEA\xB8\x67\xB8\x67\xB8\xD5\xDC\x6A\x6E\x2D\xB7\x96\x7B\x9E\x7B\x9E\x5B\xCF\xAD\xE7\x5E\xE0\x5E\xE0\x5E\xE4\x5E\xE4\x36\x71\x9B\xB8\x2D\xDC\x16\x6E\x1B\xB7\x8D\xDB\xCE\x6D\xE7\x5E\xE1\x5E\xE1\x5E\xE3\x5E\xE3\x5E\xE7\x5E\xE7\xDE\xE4\xDE\xE4\xDE\xE6\xDE\xE6\x76\x72\x3B\xB9\x5D\xDC\x2E\xEE\x3D\xEE\x3D\xEE\x03\xEE\x03\x6E\x2F\xB7\x97\xDB\xCF\xED\xE7\x3E\xE2\x3E\xE2\x0E\x72\x07\xB9\x8F\xB9\x8F\xB9\x4F\xB9\x4F\xB9\xC3\xDC\x61\xEE\x33\xEE\x73\xEE\x04\x77\x82\xFB\x86\xFB\x86\xFB\x3E\x6E\xFD\x68\x10\x3F\x88\x1F\xC2\x0F\xE1\x87\xF1\xC3\xF8\x4B\xF8\x4B\xF8\xCB\xF8\xCB\xF8\xCB\xF9\xCB\xF9\x91\xFC\x48\x7E\x34\x3F\x9A\xBF\x92\xBF\x92\xBF\x9A\xBF\x9A\xBF\x96\xBF\x96\x1F\xC7\x8F\xE3\x27\xF0\x13\xF8\xEB\xF9\xEB\xF9\x1B\xF9\x1B\x79\x07\xEF\xE0\x9D\xBC\x93\x2F\xE2\x8B\x78\x17\xEF\xE2\x4B\xF9\x52\xDE\xCD\xBB\xF9\x29\xFC\x14\xBE\x82\xAF\xE0\xE7\xF0\x73\xF8\x79\xFC\x3C\x7E\x01\xBF\x80\xBF\x9D\xBF\x9D\x5F\xC8\x2F\xE4\xEF\xE4\xEF\xE4\x97\xF0\x4B\xF8\xA5\xFC\x52\xFE\x6E\xFE\x6E\xFE\x5E\xFE\x5E\xFE\x3E\xFE\x3E\xFE\x01\xFE\x01\xFE\x21\xFE\x21\xFE\x11\xFE\x11\x3E\x4F\xC8\x13\xDA\x09\xED\x04\x8B\x60\x11\xAC\x82\x55\xE8\x24\x74\x12\x3A\x0B\x9D\x85\x2E\x42\x57\xA1\xBB\xD0\x5D\xB8\x58\xB8\x58\xE8\x25\xF4\x12\xFA\x08\x7D\x84\xBE\x42\x5F\xA1\xBF\xD0\x5F\x18\x28\x0C\x14\x06\x09\x83\x84\x21\xC2\x10\x61\x98\x30\x4C\xB8\x44\xB8\x44\xB8\x4C\xB8\x4C\xB8\x5C\xB8\x5C\x18\x29\x8C\x14\x46\x0B\xA3\x85\x2B\x85\x2B\x85\xAB\x85\xAB\x85\x6B\x85\x6B\x85\x71\xC2\x38\x61\x82\x30\x41\xB8\x5E\xB8\x5E\xB8\x51\xB8\x51\x70\x08\x0E\xC1\x29\x38\x85\x22\xA1\x48\x70\x09\x2E\xA1\x54\x28\x15\xDC\x82\x5B\x98\x22\x4C\x11\x2A\x84\x0A\xC1\x2B\x78\x85\xA9\xC2\x0C\xE1\x26\xE1\x26\xE1\x16\xE1\x16\x61\xB6\x30\x5B\x98\x23\xCC\x11\xE6\x09\xF3\x84\x05\xC2\x02\xE1\x76\xE1\x76\x61\xB1\xB0\x58\xB8\x4B\xB8\x4B\xB8\x5B\xB8\x5B\xB8\x57\xB8\x4F\x78\x40\x78\x40\x78\x48\x78\x48\x78\x44\x78\x44\x78\x54\x78\x54\x58\x29\xAC\x14\x1E\x17\x1E\x17\x9E\x14\x9E\x14\x9E\x12\x9E\x12\xC4\xA7\x56\xA8\x15\x56\x0B\xAB\x85\xF5\xC2\x7A\xE1\x05\xE1\x05\xE1\x45\xE1\x45\x61\x93\xB0\x49\xD8\x22\x6C\x11\xB6\x09\xDB\x84\x57\x84\x57\x84\x37\x84\x37\x84\xB7\x84\xB7\x84\x9F\x84\x9F\x84\x33\xC2\x19\x49\x57\x2C\xAC\x2B\xAB\xF3\xD5\x6D\xAB\x8B\xAE\x5D\x49\xBA\x62\xEC\xD9\x42\xBA\xCE\xD3\x78\x76\x90\xCE\xA3\xA3\x67\x03\xF5\x7B\x10\xBA\xEF\x41\x18\x15\x33\xEF\x2A\xDD\x83\x30\x77\x0F\xC2\x23\x7B\x10\x36\xFC\xCE\xFC\x6A\xD7\x1E\x84\xAF\xF7\x20\x28\xE8\x7C\xAA\x17\x9D\x2F\x4D\xD9\x8B\x70\xDB\x5E\x84\x95\x7B\x11\x5E\xDA\x8B\xF0\xC1\x5E\x84\x6F\xC4\xB9\xD8\x3E\x84\x8B\xF6\x21\xF4\xDD\x87\x30\x76\x1F\x82\x77\x1F\xC2\xA2\x7D\xF2\xFC\x2A\x76\x5E\x75\x38\x6E\x5E\x65\x88\x9B\x57\x5D\x1B\x37\xAF\x5A\x1A\x37\xAF\x7A\x93\xCE\xAD\x44\x8A\x9E\x75\x5C\xC3\xFC\x76\x4F\x25\xA8\x08\x2A\x6E\x52\xDC\xA4\x98\xA0\x9C\xA0\x2C\x48\x28\x90\xF6\x44\xA2\x7B\x1E\xB1\xFB\x1D\x53\x55\x53\x55\xC3\x53\x87\x4B\xF3\x82\x73\xBA\x73\xBA\xFD\x99\xFB\x33\x87\x64\x0D\xC9\x12\xF4\x82\x7E\x46\xCE\xAD\x39\x5C\xEE\x64\xE9\xFC\xC1\x23\xB9\xDB\x72\x63\xF5\xFD\x5B\xB8\x5B\x39\x6F\x67\x2F\x5D\x6F\x55\xD2\xF5\xD6\xBE\xF6\x47\xED\x8F\xD9\xCF\xD9\xC3\xF6\x36\xD5\x6D\xAA\x7F\x59\x75\x7E\x55\x0A\x9F\xC2\xCF\xE6\x67\xF3\x2B\xF8\x47\xA5\x35\x54\x9F\xE0\x13\xEE\x10\xEE\x10\x7E\x11\x7E\x15\x76\xD5\xEE\xAA\x3D\x5A\x7B\xB4\xD6\x17\xF2\x85\x3E\x0E\x7D\x1C\xFA\x3E\xF4\x43\xE8\x86\x3A\x47\x9D\xBB\xCE\x5D\x17\x3D\x0B\x24\xED\x17\xD2\x79\xFD\x85\xE6\xEB\xD1\xF9\x65\x74\xFE\x18\x9D\xC7\x6C\xC2\x4D\x58\x8F\xAF\xE0\x72\x66\x39\xD3\xB4\x57\x24\x9F\xDB\x8C\xDD\x2F\xFA\xA3\xBD\x22\x48\x6A\xF3\x87\xFB\x42\xFE\xBF\xF7\x85\xFE\xA2\x7D\xA1\x61\x7F\x6A\x5F\xE8\x9F\xDD\x13\x82\xB4\x7F\x7D\x0F\xE8\x1F\xDD\xFB\x91\xF7\x7D\x06\x67\x0D\xFD\x07\xF7\x7E\x7E\x7F\xDF\x67\xFA\x6F\xF6\x7A\x2E\x36\xF7\x36\xDB\x3B\x97\xFE\xA9\x7D\x93\x04\x7B\x82\xBD\x1F\xDD\x2F\x59\x49\xF7\x4B\x22\xBF\xBB\x5F\x92\x5E\x9D\x21\xED\x99\xFC\xBC\x0A\x9E\x52\x37\xEE\x99\x78\x78\x8F\xB4\x5F\xB2\x54\x58\x2A\xFC\x2C\xFC\x2C\x9C\xFD\x27\xF6\x49\x1A\x6A\x3F\xAF\xFD\xB2\xC5\x3D\x12\x6F\x68\xEA\x1F\xEE\x93\x1C\xA2\xFB\x24\xDF\xB5\xB8\x4F\x52\x7F\x81\xFD\x91\x7F\x76\x5F\x24\xBA\x2F\xFF\xBB\xE7\x2F\xFE\xC3\xFB\x23\x63\xE8\xFE\xC8\xFF\xF5\xFD\x90\xBF\xF7\x3F\xFE\x3B\xF7\x3F\xFE\xDE\xF7\xF8\xD7\xF6\x3D\xE2\xF7\x3B\xE2\xF7\x39\xFE\xB2\xFD\x0C\xBA\xBE\x7F\xC1\x75\xFD\xBF\xD7\xF1\xFF\xA5\x75\xFC\xE8\xF3\x1A\xBE\x86\x6F\xE0\x1B\xF8\x36\xBE\x8D\xDF\xE1\x77\x78\x87\x71\xA9\xF1\x41\xE3\x4A\x63\x8D\x71\xB5\x71\xB3\x71\xB3\xF1\x1D\xE3\x3B\xC6\x73\xC6\xA8\x25\x4E\x79\x3D\x5F\x5E\xC3\xFF\x44\x14\x3D\xC8\x20\x83\x2C\xB2\x98\x80\x09\x98\x84\x49\x98\x8C\xC9\x98\x82\x29\x98\x8A\xA9\xA8\x43\x1D\xB6\xC2\x56\x98\x8E\xE9\x98\x81\x19\x98\x85\x59\xA8\x47\x3D\xE6\x60\x0E\x12\x24\x68\x42\x13\x5E\x84\x17\x61\x5B\x6C\x8B\xED\xB1\x3D\x76\xC0\x0E\xD8\x11\x3B\x22\x87\x1C\xDA\xD0\x86\x76\xB4\x63\x37\xEC\x86\x3D\xB0\x07\xF6\xC4\x9E\xD8\x07\xFB\x60\x5F\xEC\x8B\xFD\xB1\x3F\x0E\xC4\x81\x38\x08\x07\xE1\x10\x1C\x82\xC3\x70\x18\x5E\x82\x97\xE0\x08\x1C\x81\x57\xE0\x15\x38\x0A\x47\xE1\x18\x1C\x83\x57\xE1\x55\x78\x0D\x5E\x83\x63\x71\x2C\x8E\xC7\xF1\x78\x1D\x5E\x87\x37\xE0\x0D\x38\x11\x27\x62\x21\x16\xE2\x24\x9C\x84\xC5\x58\x8C\x25\x58\x82\x65\x58\x86\x93\x71\x32\x96\x63\x39\x7A\xD0\x83\x3E\xF4\xA1\x1F\xFD\x18\xC4\x20\x4E\xC3\x69\x38\x03\x67\xE2\xCD\x78\x33\xDE\x8A\xB7\xE2\x1C\x9C\x8B\xF3\x71\x3E\xDE\x86\xB7\xE3\x42\xBC\x13\xEF\xC2\xBB\xF1\x5E\x5C\x8E\xF7\xE3\x83\xB8\x02\x1F\xC5\x95\x58\x8D\x4F\xE0\x13\xB8\x0A\x57\x21\x8F\x02\xD6\x62\x2D\x3E\x8D\x4F\xE3\xB3\xB8\x1A\xD7\xE2\xF3\xB8\x1E\xD7\xE3\x0B\xB8\x11\x37\xE3\x66\x7C\x15\x5F\xC5\xD7\xF1\x75\x7C\x0B\xDF\xC2\x9D\xB8\x13\x77\xE1\x2E\x7C\x0F\xDF\xC3\x0F\xF0\x03\xDC\x8B\x7B\x71\x3F\xEE\xC7\x8F\xF0\x23\x3C\x88\x07\xF1\x13\xFC\x04\x1B\xB0\x01\x8F\xE0\x11\xFC\x1C\x3F\xC7\xA3\x78\x14\x8F\xE1\x31\xFC\x1A\xBF\xC6\x13\x78\x02\xBF\xC1\x6F\xF0\x5B\xFC\x16\x7F\xC0\x1F\xF0\x27\xFC\x05\xCF\xE0\x19\x3C\x87\xE7\x30\x8C\x61\x04\x06\x18\xF1\x61\x19\x96\x49\x60\x12\x98\x24\x26\x89\x49\x66\x92\x99\x14\x26\x85\x49\x65\x52\x19\x1D\xA3\x63\x5A\x31\xAD\x98\x74\x26\x9D\xC9\x60\x32\x98\x2C\x26\x8B\xD1\x33\x7A\x26\x87\xC9\x61\x08\x43\x18\x13\x63\x62\x2E\x62\x2E\x62\xDA\x32\x6D\x99\xF6\x4C\x7B\xA6\x03\xD3\x81\xE9\xC8\x74\x64\x38\x86\x63\x6C\x8C\x8D\xB1\x33\x76\xA6\x1B\xD3\x8D\xC9\x67\xFA\x32\xFD\x99\x01\xCC\x20\x66\x10\x33\x84\x19\xCE\x5C\xCA\x5C\xCA\x8C\x60\x46\x30\x57\x30\x57\x30\xA3\x98\x51\x8C\x4F\xE1\x53\xF8\x15\x7E\xC5\x34\xC5\xB4\x16\xCE\xE3\x2D\x55\xDC\x2D\x9D\xC9\xAB\x53\xEC\x52\xEC\x52\xBC\xAF\xD8\xA3\xF8\x50\xF1\xA1\xE2\x80\xE2\x80\xE2\x90\xE2\x90\xE2\x13\xC5\x27\x8A\x06\x45\x83\xE2\x88\xE2\x88\xE2\x73\xC5\xE7\x8A\xA3\x8A\xA3\x8A\x63\x8A\x63\x8A\xAF\x15\x5F\x2B\x4E\x28\x4E\x28\xBE\x51\x7C\xA3\xF8\x41\xF1\x83\xE2\x67\xC5\xCF\x8A\x5F\x15\x67\x14\xE7\x15\x5D\xD8\x42\xB6\x90\x9D\xC4\x4E\x62\x8B\xD9\x62\xB6\x84\x2D\x61\xCB\xD8\x32\x76\x32\x3B\x99\x2D\x67\xCB\x59\x0F\xEB\x61\x7D\xAC\x8F\xF5\xB3\x7E\x36\xC8\x06\xD9\x69\xEC\x34\x76\x06\x3B\x83\xBD\x89\xBD\x89\xBD\x85\xBD\x85\x9D\xC5\xCE\x62\xAB\xD8\x2A\x76\x11\xBB\x88\x5D\xCC\x2E\x66\xEF\x62\xEF\x62\x97\xB1\xCB\xD8\x7B\xD8\x7B\xD8\xE5\xEC\x72\xF6\x7E\xF6\x7E\xF6\x41\xF6\x41\xF6\x61\xF6\x61\x76\x05\xBB\x82\x7D\x8C\x7D\x8C\xAD\x66\xAB\xD9\x27\xD8\x27\xD8\x55\xEC\x2A\x96\x67\x79\xB6\x86\xAD\x61\x43\x6C\x88\x7D\x9A\x7D\x9A\x7D\x96\x7D\x96\x5D\xC3\xAE\x61\x9F\x63\x9F\x63\xD7\xB1\xEB\xD8\x0D\xEC\x06\x76\x23\xBB\x91\x7D\x89\x7D\x89\xDD\xCC\x6E\x66\xB7\xB2\x5B\xD9\x7A\x76\x3B\xFB\x0A\xFB\x0A\xFB\x1A\xFB\x1A\xFB\x3A\xFB\x3A\xFB\x26\xFB\x26\xFB\x36\xFB\x36\xBB\x93\xDD\xC9\xEE\x66\x77\xB3\xEF\xB3\xEF\xB3\x7B\xD8\x3D\xEC\x3E\x76\x1F\xFB\x21\xFB\x21\x7B\x80\x3D\xC0\x1E\x62\x0F\xB1\x9F\xB0\x9F\xB0\x0D\x6C\x03\x7B\x84\x3D\xC2\x7E\xCE\x7E\xCE\x1E\x65\x8F\xB2\xC7\xD8\x63\xEC\xD7\xEC\xD7\xEC\x09\xF6\x04\xFB\x0D\xFB\x0D\x7B\x9A\x3D\xCD\x7E\xC7\x7E\xC7\xFE\xC0\xFE\xC0\xFE\xC4\xFE\xC4\xFE\xC2\xFE\xC2\x9E\x61\xCF\xB0\xE7\xD8\x73\x6C\x98\x0D\xB3\xA0\x04\x25\xA3\x64\x94\xAC\x92\x55\x26\x28\x13\x94\x49\xCA\x24\x65\xB2\x32\x59\x99\xA2\x4C\x51\xA6\x2A\x53\x95\x3A\xA5\x4E\xD9\x4A\xD9\x4A\x99\xAE\x4C\x57\x66\x28\x33\x94\x59\xCA\x2C\xA5\x5E\xA9\x57\xE6\x28\x73\x94\x44\x49\x94\x26\xA5\x49\x79\x91\xF2\x22\x65\x5B\x65\x5B\x65\x7B\x65\x7B\x65\x07\x65\x07\x65\x47\x65\x47\x25\xA7\xE4\x94\x36\xA5\x4D\x3A\x5F\x19\x7B\x4E\xAE\xBA\xF5\x8F\xAD\x1B\xCF\xC6\x13\x10\xBB\x19\x61\x09\x4B\x12\x48\x02\x49\x22\x49\x24\x99\x24\x93\x14\x92\x42\x52\x49\x2A\xD1\x11\x1D\x69\x45\x5A\x91\x74\x92\x4E\x32\x48\x06\xC9\x22\x59\x44\x4F\xF4\x24\x87\xE4\x10\xF1\x31\x11\x13\xB9\x88\x5C\x44\xDA\x92\xB6\xA4\x3D\x69\x4F\x3A\x90\x0E\xA4\x23\xE9\x48\x38\xC2\x11\x1B\xB1\x11\x3B\xB1\x93\x6E\xA4\x1B\xE9\x41\x7A\x90\x9E\xA4\x27\xE9\x4D\x7A\x93\x7C\x92\x4F\xFA\x91\x7E\x64\x00\x19\x40\x0A\x48\x01\x19\x4C\x06\x93\xA1\x64\x28\x19\x4E\x86\x93\x4B\xC9\xA5\x64\x04\x19\x41\xAE\x20\x57\x90\x51\x64\x14\x19\x43\xC6\x90\xAB\xC8\x55\xE4\x1A\x72\x0D\x19\x4B\xC6\x92\xF1\x64\x3C\xB9\x8E\x5C\x47\x6E\x20\x37\x90\x89\x64\x22\x29\x24\x85\x64\x12\x99\x44\x8A\x49\x31\x29\x21\x25\xA4\x8C\x94\x91\xC9\x64\x32\x29\x27\xE5\xC4\x43\x3C\xC4\x47\x7C\xC4\x4F\xFC\x24\x48\x82\x64\x1A\x99\x46\x66\x90\x19\xE4\x26\x72\x13\xB9\x85\xDC\x42\x66\x91\x59\xA4\x8A\x54\x91\xB9\x64\x2E\x99\x4F\xE6\x93\xDB\xC8\x6D\xE4\x0E\x72\x07\x59\x44\x16\x91\xC5\x64\x31\xB9\x8B\xDC\x45\x96\x91\x65\xE4\x1E\x72\x0F\x59\x4E\x96\x93\xC7\xC8\x63\xA4\x9A\x54\x93\x27\xC8\x13\x64\x15\x59\x45\x78\xC2\x93\x1A\x52\x43\x42\x24\x44\x9E\x26\x4F\x93\x67\xC9\xB3\x64\x0D\x59\x43\x9E\x23\xCF\x91\x75\x64\x1D\xD9\x40\x36\x90\x8D\x64\x23\x79\x89\xBC\x44\x36\x93\xCD\x64\x2B\xD9\x4A\xEA\x49\x3D\x79\x99\xBC\x4C\x5E\x25\xAF\x92\x1D\x64\x07\x79\x83\xBC\x41\xDE\x22\x6F\x91\x77\xC8\x3B\xE4\x5D\xF2\x2E\xD9\x4D\x76\x93\xF7\xC9\xFB\x64\x0F\xD9\x43\xF6\x91\x7D\xE4\x43\xF2\x21\x39\x40\x0E\x90\x43\xE4\x10\xF9\x84\x7C\x42\x1A\x48\x03\x39\x42\x8E\x90\xCF\xC9\xE7\xE4\x28\x39\x4A\x8E\x91\x63\xE4\x6B\xF2\x35\x39\x41\x4E\x90\x6F\xC8\x37\xE4\x34\x39\x4D\xBE\x23\xDF\x91\x1F\xC8\x0F\xE4\x27\xF2\x13\xF9\x85\xFC\x42\xCE\x90\x33\xE4\x1C\x39\x47\xC2\x24\x4C\x92\x8C\x5A\xE9\x9C\x60\x07\x63\x17\x63\x6F\xE3\x40\xE9\xAC\x60\xF3\x73\x82\x0E\x63\x99\xD1\x6B\xDC\x68\xDC\x64\x7C\xC3\xF8\xB6\xF1\x43\xE3\x41\xE3\x31\xE3\x09\xE3\x2F\xC6\xB3\xC6\xE8\x59\x40\xB5\x59\x63\xD6\x99\x5B\x5D\xF0\x3C\xA0\xDD\xDC\xDD\x3C\x40\x3A\x0F\x38\xCC\x3C\xCF\x3C\x4F\x3A\x0B\x58\xC8\x15\x72\x93\xB8\x62\xAE\x94\x2B\xE5\xDC\x9C\x9B\x9B\xC2\x4D\xE1\x2A\x38\x1F\xE7\xE7\xFC\x5C\x25\x57\xC9\xCD\xE2\xAA\xB8\xB9\xDC\x5C\x6E\x3E\x37\x9F\xBB\x8D\xBB\x8D\xBB\x83\xBB\x83\x5B\xC4\x2D\xE2\x16\x73\x8B\xB9\xBB\xB8\xBB\xB8\x65\xDC\x32\xEE\x1E\xEE\x1E\x6E\x39\xB7\x9C\xBB\x9F\xBB\x9F\x7B\x90\x7B\x90\x7B\x98\x7B\x98\x5B\xC1\xAD\xE0\x1E\xE3\x1E\xE3\xAA\xB9\x6A\xEE\x09\xEE\x09\x6E\x15\xB7\x8A\xE3\x39\x9E\xAB\xE1\x6A\xB8\x10\x17\xE2\x9E\xE6\x9E\xE6\x9E\xE5\x9E\xE5\xD6\x70\x6B\xB8\xE7\xB8\xE7\xB8\x75\xDC\x3A\x6E\x03\xB7\x81\xDB\xC8\x6D\xE4\x5E\xE2\x5E\xE2\x36\x73\x9B\xB9\xAD\xDC\x56\xAE\x9E\xAB\xE7\x5E\xE6\x5E\xE6\x5E\xE5\x5E\xE5\x76\x70\x3B\xB8\x37\xB8\x37\xB8\xB7\xB8\xB7\xB8\x77\xB8\x77\xB8\x77\xB9\x77\xB9\xDD\xDC\x6E\xEE\x7D\xEE\x7D\x6E\x0F\xB7\x87\xDB\xC7\xED\xE3\x3E\xE4\x3E\xE4\x0E\x70\x07\xB8\x43\xDC\x21\xEE\x13\xEE\x13\xAE\x81\x6B\xE0\x8E\x70\x47\xB8\xE3\xDC\x71\xEE\x24\x77\x92\xFB\x8E\xFB\x8E\x2B\xE0\x0B\xF8\xC1\xFC\x60\x7E\x28\x3F\x94\x1F\xCE\x0F\xE7\x2F\xE5\x2F\xE5\x47\xF0\x23\xF8\x2B\xF8\x2B\xF8\x51\xFC\x28\x7E\x0C\x3F\x86\xBF\x8A\xBF\x8A\xBF\x86\xBF\x86\x1F\xCB\x8F\xE5\xC7\xF3\xE3\xF9\xEB\xF8\xEB\xF8\x1B\xF8\x1B\xF8\x89\xFC\x44\xBE\x90\x2F\xE4\x27\xF1\x93\xF8\x62\xBE\x98\x2F\xE1\x4B\xF8\x32\xBE\x8C\x9F\xCC\x4F\xE6\xCB\xF9\x72\xBE\x8A\xAF\xE2\xE7\xF2\x73\xF9\xF9\xFC\x7C\xFE\x36\xFE\x36\xFE\x0E\xFE\x0E\x7E\x11\xBF\x88\x5F\xCC\x2F\xE6\xEF\xE2\xEF\xE2\x97\xF1\xCB\xF8\x7B\xF8\x7B\xF8\xE5\xFC\x72\xFE\x7E\xFE\x7E\xFE\x41\xFE\x41\xFE\x61\xFE\x61\xFE\x22\xE1\x22\xA1\xAD\xD0\x56\x68\x2F\xB4\x17\x3A\x08\x1D\x84\x8E\x42\x47\x81\x13\x38\xC1\x26\xD8\x84\x6E\x42\x37\xA1\x87\xD0\x43\xE8\x29\xF4\x14\x7A\x0B\xBD\x85\x7C\x21\x5F\xE8\x27\xF4\x13\x06\x08\x03\x84\x02\xA1\x40\x18\x2C\x0C\x16\x86\x0A\x43\x85\xE1\xC2\x70\xE1\x52\xE1\x52\x61\x84\x30\x42\xB8\x42\xB8\x42\x18\x25\x8C\x12\xC6\x08\x63\x84\xAB\x84\xAB\x84\x6B\x84\x6B\x84\xB1\xC2\x58\x61\xBC\x30\x5E\xB8\x4E\xB8\x4E\xB8\x41\xB8\x41\x98\x28\x4C\x14\x0A\x85\x42\x61\x92\x30\x49\x28\x16\x8A\x85\x12\xA1\x44\x28\x13\xCA\x84\xC9\xC2\x64\xA1\x5C\x28\x17\x3C\x82\x47\x98\x29\xCC\x14\x6E\x16\x6E\x16\x6E\x15\x66\x09\x55\x42\x95\x30\x57\x98\x2B\xCC\x17\xE6\x0B\xB7\x09\xB7\x09\x77\x0A\x77\x0A\x4B\x84\x25\xC2\x32\x61\x99\x70\x8F\x70\x8F\x70\xBF\x70\xBF\xF0\xA0\xF0\xA0\xF0\xB0\xF0\xB0\xB0\x42\x58\x21\x3C\x26\x3C\x26\x54\x0B\xD5\xC2\x13\xC2\x13\xC2\x2A\x61\x95\xC0\x0B\xBC\x50\x23\xD4\x08\x21\xE1\x59\x61\x8D\xB0\x4E\xD8\x20\x6C\x10\x36\x0A\x1B\x85\x97\x84\x97\x84\xCD\xC2\x66\x61\xAB\xB0\x55\x78\x59\x78\x59\x78\x55\x78\x5D\x78\x53\x78\x53\xF8\x51\xF8\x51\x30\x47\xF2\x9B\xDD\x4F\x8D\xDE\x7B\x8F\x9E\x3F\x8C\x9E\xBB\x8B\xDE\x63\x6F\xB4\xCD\xBB\x07\x21\x7B\x0F\x42\x8F\x3D\x08\x23\xF7\x20\x94\xED\x41\x98\x43\xCF\x02\xFD\xD9\xF3\x40\xEB\xF7\x20\xEC\xDE\x83\xF0\xD5\x1E\x04\x76\xEF\xEF\x9F\x03\xEA\xFD\x27\xCF\x01\x95\xEF\x45\x58\xB0\x17\xA1\x7A\x2F\xC2\x8B\x7B\x11\xF6\xEC\x45\x38\xB9\x17\x21\x69\x1F\x82\x79\x1F\x42\xBF\x7D\x08\xD7\xEE\x43\xF0\xED\x43\x58\x18\x73\x5E\xE8\x08\x3D\x27\x94\x43\xCF\x07\x8D\xA5\xE7\x82\x96\xD1\xF3\x40\x6F\x51\x8A\xDE\xCF\x8F\xAE\x67\x44\xD7\x01\x06\x52\x02\x85\x57\x31\x8F\x5D\xC8\xDE\xAD\xDC\xA2\xDC\xA6\xDC\xA6\xDC\xAE\x7C\x59\xF9\xAA\xF2\x35\xE5\xEB\xCA\xD7\x95\xBA\x04\x7D\xC2\xE5\x09\x0E\xE9\x5E\xC8\xBE\x84\x43\x09\x9F\x26\x7C\x9E\xF0\x65\xC2\xB1\x84\xAF\x13\x4E\x26\xA4\x25\xA6\x25\xDA\x13\x47\x24\xF2\x89\x6B\x12\x8F\x27\x7E\x9F\x78\x3E\xF1\x7C\x62\x46\x52\x76\x92\x21\x29\x2F\xA9\x5D\x92\x25\xC9\x9A\xD4\x39\x69\x42\xD2\xF5\xF4\x2E\xBE\x42\x95\xAF\xEA\xA7\x1A\xA0\x1A\xAD\xBA\x52\x35\x4E\x35\x49\x55\xA4\x9A\xA3\x9A\xA7\xDA\xAC\xDA\xAC\xDA\xDA\x78\xC7\x7B\xA7\x74\xC7\xFB\x88\xEA\x33\x55\x58\x15\x56\x61\xB2\xA2\xC5\xBB\x40\xBE\xE4\xA9\xC9\x95\xC9\x95\xC9\x73\x92\xE7\x25\x6F\x4E\xDE\x9C\xBC\x35\xE6\x8E\xD2\x91\xE4\xCF\x92\xCF\x24\x47\x92\x51\xAD\x50\xF7\x53\xF7\x53\x0F\x50\x0F\x55\x5F\xA2\xBE\x54\x7D\xB9\x7A\xA4\xFA\x5A\xF5\x38\xF5\x24\x75\x91\x7A\xAE\x7A\xAE\x7A\xAB\xFA\x65\xF5\x0E\xF5\x1B\xEA\xB7\xD4\x3B\xD5\xFB\xD5\xFB\xD5\x90\xC2\xA6\x0C\x48\x19\x9A\x32\x3C\xE5\xD2\x94\x11\x29\x23\x53\xAE\x4D\x19\x9B\x32\x29\xA5\x28\x65\x4E\xCA\xBC\x94\xCD\x29\x9B\x53\xB6\xC6\xDD\x1F\x39\x92\xF2\x59\x0A\x68\x14\x9A\xBE\x9A\x7E\x9A\x01\x9A\xA1\x9A\xE1\x9A\x4B\x35\x23\x34\x23\x35\xE3\x34\xE3\x34\x93\x34\x45\x9A\x39\x9A\x79\x9A\xB7\x34\x6F\x69\x76\x69\xF6\x68\xF6\x69\xF6\x69\x3E\xD4\x7C\xAA\xF9\x4E\xF3\xBD\xA6\x6B\x6A\xD7\xD4\x1E\xA9\xF9\xA9\x97\xA4\x8E\x4A\x5D\x9B\xBA\x36\x75\x5D\xEA\x66\xE9\x3C\x50\x96\x36\x5B\x7B\xB1\xF6\x62\x6D\x2F\x6D\x2F\x6D\x1F\x6D\x1F\xED\x00\xED\x40\xED\x54\xED\x7C\xED\x6D\xDA\xDB\xB5\x4B\xB4\x0F\x68\x1F\xD2\x6E\xD6\xEE\xD0\xEE\xD0\x76\xD2\x0D\xD0\x8D\xD5\x4D\xD0\x4D\xD4\x15\xEA\x26\xE9\x8A\x75\xA5\xBA\x0A\xDD\x54\x5D\x50\x37\x57\xB7\x44\xB7\x54\xB7\x54\xF7\xB0\xEE\x51\xDD\x8D\xAD\x1D\xAD\x5B\x65\xA6\x67\x76\xCB\xEC\x91\x79\x55\xE6\xD5\x99\xFE\xCC\x40\xE6\xBA\xCC\x0F\x32\x3F\xCE\xFC\x38\x53\x9D\xA5\xC9\x5A\x90\x75\x5B\x56\x6D\x56\x6D\x56\xF4\x8C\x4F\xA6\xDE\xA0\xBF\x56\x3F\x51\x5F\xA8\xBF\x45\x3F\x5B\x3F\x5B\xBF\x46\x5F\xAF\x07\x03\x6B\xE8\x61\x18\x6A\x98\x62\x08\x18\xAA\x0C\x73\x0D\x8F\x1B\x9E\x31\x1C\x35\x7C\x6F\x68\x9B\xD3\x2B\x47\xBE\x17\xD4\x74\x27\xE8\xE7\x98\x3B\x41\xBB\x4D\xA7\x4D\xA7\xB8\x6F\xB9\xD9\x9D\x67\x77\x6E\xE8\x1C\xE9\xDC\xD1\xDE\x45\xBA\x1B\xE4\xE5\xFD\x7C\x90\xBF\x95\x7F\x8C\x5F\xC9\x9F\xE6\xBF\xE5\x99\x1A\xA6\x26\xA1\x26\xA1\x46\x5D\xA3\xAE\xC9\xAB\xB1\x88\x22\xA0\xA6\xAA\x66\x4E\xCD\xBA\x9A\xD7\x6A\x1A\x6A\xBE\xAD\x89\xD4\x44\x6A\xDA\xD7\x76\xAE\xBD\xA4\xF6\xEA\xDA\xAA\xDA\x79\xB5\xCF\xD7\xD6\xD7\x7E\x51\xFB\x45\xAD\x35\xD4\x33\x34\x24\x34\x24\x74\x45\x68\x64\xE8\xE6\xD0\xAD\xA1\x35\xA1\x35\xA1\xE7\x42\xEB\x42\x2F\x84\x36\x86\xB6\x86\xB6\x85\xB6\x87\xB6\x87\x8E\x87\x4E\x85\x7E\x0C\xFD\x14\xFA\xAC\xEE\xEB\xBA\x13\x75\x27\xEB\xC8\x59\x72\x56\xBE\x9B\xD4\x45\xB2\xF9\x10\x7F\x3F\x69\x9A\x02\xE1\x26\x05\x02\xB6\x70\x6F\x47\x1B\x77\x4F\x47\xA4\x2F\x92\x11\x8E\x26\x23\xB4\xA5\xF7\xBA\xEA\x52\x11\x9E\x4E\x45\x18\xAE\x45\x18\xA3\x45\xC9\xBE\x00\xA3\x43\xE8\xAD\x43\x18\x4E\x6D\x0B\xCC\xD5\x21\xAC\xD1\x21\xBC\xA4\x43\xE9\x3E\x3C\x93\x86\x60\xA1\xF7\xE2\x87\xA5\x21\x0C\x4F\x43\x08\x50\xAA\x4A\x43\x98\x9B\x86\xF0\x7C\x1A\x42\x7D\x1A\xC2\x9B\x69\x08\xEF\xA4\x21\xBC\x9B\x86\xB0\x2B\x0D\x81\x6B\x85\xD0\x8B\xDE\xFD\x11\xE9\x53\x7A\xFF\x27\x7A\xEF\xB1\x2F\xBD\xCB\x38\xE0\x02\xF7\x19\xA3\xF7\x18\x27\x5D\xE0\x1E\xE3\xC5\xE9\x08\xC3\xD3\x11\x26\x52\x5A\x93\x8E\xF0\x4A\x3A\xC2\xEA\x36\x08\xEB\xDB\x20\x6C\x6C\x83\x50\xDF\x06\xE1\x50\x1B\x84\x8F\xDB\x20\xD8\x33\x10\x0A\x32\x10\xEA\x32\x10\x5E\xC8\x68\xB2\xE3\xC1\x65\x21\xE4\x67\x21\xD8\x5B\xB8\xEF\x3A\x20\x1B\xA1\x80\xD2\xE0\x6C\x84\x21\xD9\x08\xEF\x65\x23\xEC\xCF\x46\x38\x90\x8D\xD0\x90\x8D\xF0\x39\x25\xD4\x23\x24\xEB\x11\xBA\xEB\x11\xFA\xE8\x11\xFA\xEA\x11\x06\xE8\x11\x2E\xA1\x74\xA5\x1E\xE1\x7A\x3D\xC2\x22\x3D\xC2\x43\x7A\x84\x2E\x31\x76\x20\x06\xE6\x20\xDC\x93\x83\x20\xE4\x20\xD4\xE6\x20\x6C\xC8\x41\xE8\x9A\x8B\xD0\x33\x17\x21\x9F\x52\xBF\x5C\x84\xFE\xB9\x08\x03\x73\x11\x86\xE5\x22\x5C\x42\x69\x51\x0B\xF7\x18\x1F\xC8\x45\xF8\x9E\x20\xFC\x44\x64\x7B\x16\x3F\x4C\x46\xB0\x4F\x41\xE8\x39\x05\x61\xB4\x57\xA6\x2B\xBD\x08\xB7\x7B\x11\x96\x7A\x11\xEE\xF1\x36\xDD\xE7\x8A\xDE\x43\x7C\x74\x33\xC2\x63\x9B\x11\x5C\xF4\x3E\x5C\xC5\x7B\x08\xFE\xDF\xB9\x17\x37\xF8\x7D\x84\xA1\xEF\x23\xC0\x01\x84\x9E\x07\x10\xFA\x1E\x40\x28\x3F\x80\x50\x49\x69\x3E\xA5\x47\x0E\x20\xAC\x3C\x80\xF0\xF8\x01\x84\xD5\x07\x10\xFE\xF4\xBD\xD9\xC3\x08\x3D\x0F\x23\x9C\x38\x82\x70\xEA\x08\xC2\xEE\x63\x08\xFB\x8E\x21\x0C\xFD\x0A\x61\xC4\x57\x4D\xF7\xF2\xC6\xD0\x75\xD4\x06\x82\xF0\x0B\x89\x39\xA3\xD7\xB8\xBF\x14\xC5\xC1\xD1\x9A\x6B\x34\x45\x9A\x12\xCD\x6C\x4D\x41\xD2\xF5\x49\x13\x93\x26\x26\xC5\x8A\xEB\x7A\x3A\x7E\x8E\x27\x23\xFC\x94\x8C\xE0\xA3\xEB\x7A\xF1\xED\xD4\xF8\xB4\xB0\xDE\x77\xA1\xF6\x13\xDB\x6D\x4C\x2E\xC2\x84\xDC\xA6\xF7\x15\x2A\x85\xAA\xAF\xAA\xAF\x6A\x80\xAA\x40\x75\x99\xEA\x0A\xD5\x28\xD5\x68\xD5\x5C\xD5\x3C\xD5\x56\x55\x3D\x95\x3B\xEF\x48\x72\x47\x91\xAC\x48\x1E\x90\x5C\x90\x3C\x2F\x79\x5E\xF2\xD6\xE4\xFA\xE4\x37\x25\x99\xF2\x4E\x32\xA3\x56\xA8\x07\xA8\x07\xA8\x0B\xD4\x05\x54\x96\x5C\xA1\x1E\xA7\x1E\xA7\xDE\xAA\xDE\xA6\xDE\xDE\x28\x47\xDE\x91\xE4\x08\xA6\x28\x52\x06\xA5\x0C\x4D\x99\x9B\x32\x2F\x65\x6B\xCA\xD6\x94\xFA\x94\x57\x53\x5E\x97\xE4\xC6\xDB\x92\xDC\x60\x34\x0A\xCD\x00\x4D\x01\xAD\xA7\x2B\x24\x79\x31\x57\x33\x4F\xB3\x4B\xF3\x5E\xA3\x8C\x10\xB1\x7F\xB6\x76\xB6\xB6\x93\x8E\xD3\x75\xD5\x75\xD5\xF5\xD6\xF5\xD6\xF5\xD5\xF5\xD3\x8D\xD5\x8D\x6B\xC4\xFC\x79\xBA\xF9\xBA\xDB\x75\x8B\x29\xE6\xAF\xD0\x6D\xC8\xDC\x90\xB9\x35\xF3\xB5\xCC\xD7\x33\xDF\xC8\xCC\xCB\x6E\x9F\x6D\x95\xB0\xBD\x6B\x76\xF7\xEC\xDE\xD9\xD9\x7A\xBD\xFE\x5A\xFD\xB5\xFA\x71\xFA\x71\x7A\xA7\xDE\xA9\x2F\xD2\x17\xEB\x2B\xF4\x7E\x3D\x6B\x60\x0D\x17\x1B\x2E\x36\xF4\x35\xF4\x35\xF4\x37\x0C\x32\x0C\x31\x0C\x35\xCC\x95\xB0\xFE\x71\x03\x6F\x10\x0C\x21\x43\xC8\xF0\xA5\xE1\x4B\xC3\xD7\x86\x13\x86\x6F\x0C\xDF\x18\xBE\x93\xF0\xBF\x53\x4E\x8F\x9C\x8B\x25\x5B\x18\x3F\xE7\xFC\x9C\x63\xB3\x77\xB1\xE7\xD5\xB4\xAD\xB1\xD4\x58\x28\x7E\xBF\x52\x73\x55\xED\xD5\xB5\xF3\x6A\xE7\xD5\xAE\xAB\x5D\x5F\xFB\x52\xED\xA6\xDA\xAD\xB5\xF5\xB5\x5D\x42\xF6\x50\xF7\x50\x8F\xD0\x48\x09\xB7\x45\xE4\xBE\x35\x74\x3C\x74\x3C\xF4\x8D\x84\xD5\x3F\x86\x3E\xAB\xFB\xBC\xEE\x68\xDD\x97\x75\x5F\x49\x98\x7D\xA2\xD9\xFD\x65\x11\x4F\xA3\x98\xCA\x50\x2C\x8D\xE2\xE9\x73\x3A\xD9\xB6\xF3\x46\x1D\x02\x97\x26\x53\x14\x4F\xE7\xC6\xE0\xE8\xFA\x34\x84\x6D\x14\x4F\xDF\xA5\x24\xE2\xA8\xAD\x15\x42\xB7\x56\x08\xDD\x5B\x21\x5C\x4C\xA9\xA1\x15\xC2\x91\x56\x08\x0C\xC5\x53\x11\x47\x07\xB6\x46\x18\xF4\x27\xF1\x54\xC4\xCF\x5E\xE9\x08\x05\xE9\x08\x83\xD2\x11\x86\x51\x12\x71\xF4\xB9\x74\x84\x17\x29\x6D\x4A\x47\xD8\x9A\x8E\xB0\x9D\x92\x88\xAF\x6B\x29\xBE\x6E\x6A\x83\xB0\x95\x92\x88\xAF\xDD\x32\x10\xFA\x66\x20\xF4\xCB\x40\x18\x40\xE9\x69\x4A\xCF\x66\x20\xAC\xCE\x40\xD8\x40\xC9\x94\x89\x60\xCE\x44\x68\x4F\x49\xC4\x61\x5B\x16\x42\x6F\x4A\xF1\x78\xDC\x9F\x52\x2C\x1E\x0F\xA6\x78\xFC\x41\x36\xC2\xA1\x6C\x84\x4F\x63\xF0\xB8\x0F\xC5\xE1\x71\x7A\x84\xF1\x7A\x84\x07\x28\x89\xB8\x2B\xD2\x00\x4A\xB5\x94\xD6\x52\x5A\x47\x29\x8A\xAB\x22\x9E\x2E\xCF\x45\xB8\x9F\xD2\x8F\x14\x57\xA3\xF8\x19\xC5\x4B\x17\xB5\x17\x12\xC5\xC9\x3B\xD8\x85\xEC\x56\xFD\x56\xFD\xC7\xA6\x06\xD3\x11\xD3\xE7\x26\x1F\xEF\xE7\x45\x1D\xFF\x61\x0F\x42\x43\xE8\xA7\x50\x7D\xDD\xC9\xBA\xD3\x75\xBF\x36\xF5\x21\xBA\x1E\xFE\x3A\xC5\xB5\x6A\xBA\xFF\xB5\x59\x85\xB0\x4B\x85\xF0\xBE\x0A\x21\x42\xF7\xC5\x56\xAA\x9A\xD6\xEF\x47\xC7\xE0\xF8\x4A\x6F\x0C\x1E\x49\xFA\xF2\xED\x7F\xB1\xBE\xCC\xA8\xF2\x25\x8D\xB9\x9F\x6A\x90\xEA\x52\xD5\x48\xD5\xC8\x18\xBD\x79\x8E\xA4\x37\x6F\x57\xBD\xAA\xDA\xA9\xDA\x19\xA3\x2F\x33\x92\xBE\x3C\xE8\x82\xFA\xF2\x5C\x49\x5F\xDE\x2E\xE9\xCB\x6F\x24\xEF\x6C\xA6\x2F\xA3\xA4\x2F\x0F\x54\x0F\x54\x0F\x52\x0F\x55\x8F\x94\xF4\xE5\xB1\x8D\xFA\x72\xBD\xBA\x5E\xBD\x53\xBD\x53\x0D\x29\xA2\xA6\x2C\xEA\xCA\x05\x2D\xE8\xCA\x73\x24\x5D\x79\x5B\xCA\xB6\x94\x1D\x29\x3B\x52\xDE\x49\xD9\x49\xF5\x64\x94\xF4\xE4\x41\x9A\xA1\x9A\x91\x9A\x91\x54\x3F\x9E\x23\xE9\xC7\xEF\x53\xFD\xF8\xCF\xEA\xC5\x53\xB5\xB3\xB4\x55\x2D\xE8\xC5\x9D\x75\x76\x5D\x37\x5D\x2F\x5D\x1F\x5D\xBE\xAE\xBF\x6E\x80\x6E\x3C\xD5\x91\x65\xDD\x78\xAE\x6E\x81\xEE\x36\xDD\x12\xDD\x12\xDD\xA3\x17\xD4\x8F\xD7\x67\xBE\x90\xB9\x25\x73\x47\xE6\x8E\xCC\x37\x5B\xD4\x95\x2F\xCA\xB6\x64\x77\xC8\xEE\x96\xDD\x2D\xBB\x8F\xA4\x33\x67\xE9\x0D\x7A\x83\x7E\xAC\x7E\xAC\x7E\xBC\xA4\x3B\x17\xEA\x27\xE9\x27\xE9\x5D\xFA\x72\x7D\xA0\x51\x8F\xDE\xA2\xDF\x26\xE9\xD2\x0A\x43\x0F\x43\x0F\x43\x4F\x43\xBE\xA1\x9F\xA1\x9F\x61\xB0\x61\x30\xD5\xAB\xE7\x18\x9E\x30\x3C\x65\xA8\x31\xD4\x1A\xEA\x24\xFD\xFA\xA8\xE1\x98\xE1\x2B\xC3\x49\xC3\x49\xC3\x29\xC3\xB7\x06\x2E\xA7\x7B\x4E\xCF\x46\x7D\xFB\xC2\xF7\xF0\x77\x9B\x0E\x99\x0E\x9B\x0E\x9B\xBE\xF8\x8D\xEE\xDD\x99\xEA\xDE\xDE\x0B\xEA\xDE\xED\x6A\xDA\x4B\xBA\xF7\xAB\xBF\xD1\xBB\xAF\xAC\xAD\xAA\x9D\x5B\xFB\x7C\xED\xF3\xB5\x1B\x6A\x5F\xAC\xDD\x5C\xBB\x85\xEA\xDF\xB6\x50\xD7\x50\xB7\xD0\xC5\x8D\x7A\xF8\x15\xA1\x5B\x42\xB7\xB4\xA8\x87\x9F\x08\x9D\x0C\xFD\x14\xFA\x29\xF4\x45\xDD\x17\x75\xC7\xEA\x8E\xD5\x9D\x6C\x41\x17\xFF\x77\xE8\xE3\xD2\xF7\x0A\xE2\xF4\xF1\x39\x3A\x84\xE7\x75\x08\x1B\x74\x08\x2F\xB6\xA0\x97\x77\x4A\x43\xE8\x4C\xF5\xF3\x58\xBD\x7C\x4E\x1A\xC2\x86\x34\x84\xAD\x31\x7A\xF9\x2E\x4A\x5D\x5A\x21\x74\x6D\x85\xD0\x83\x52\xCF\x16\xF4\x74\x91\x3E\x8B\xD1\xD7\x31\x46\x5F\x2F\xA0\x14\xAF\x8F\xF7\x4E\x47\x18\x98\x8E\x30\x38\x1D\x61\x28\xD5\xCD\x63\xF5\xF3\xE7\xD3\x11\x36\xA6\x23\xBC\x44\x69\x5B\x3A\x42\x7D\x3A\xC2\xCB\x54\x6F\x7F\x8E\xEA\xED\x9B\xDB\x20\x6C\x69\x83\xB0\x2D\x4E\x7F\xEF\x9E\x81\x90\x9F\x81\xD0\x9F\xD2\xC0\x18\x7D\x5E\xA4\x67\x28\xAD\xC9\x40\x58\x4F\x75\xFC\xA8\x9E\x6F\xCC\x44\xB8\x28\x13\xA1\x5D\x26\x82\x85\xEA\xFD\x5D\xB2\x10\x7A\x65\x21\xF4\xA1\xFA\xBF\xA8\xEF\xF7\xA3\x3A\xFF\x00\xAA\xEB\x8B\xB4\x27\x46\xDF\x3F\x48\x75\xFE\x86\x38\x7D\xBF\xF7\x05\xF4\xFD\xB1\x7A\x84\x09\x31\x7A\xFF\xFD\x7A\x84\x07\xA9\xFE\x6F\x8F\xD1\xFF\xFB\xD3\x39\x40\xEC\x3C\x20\x94\x83\xB0\x26\x07\xE1\xB9\x1C\x84\xE7\x73\x10\xD6\xFF\x83\xF3\x82\xE8\x7C\xE0\x3E\x4A\x0F\xC4\xCC\x0B\x7E\xF8\x9D\x79\x41\xFC\x7C\x20\x3A\x0F\xF8\x23\xBB\x18\xFF\x2D\xFA\x7F\xE3\x43\xCF\x15\x8C\xC9\x40\x98\x90\x21\x9D\x23\xC8\x62\xB3\xD8\xAC\x84\xAC\xD4\x2C\x5D\x56\x76\x96\x7C\xA7\x3E\x94\x55\x98\x81\x50\x9E\xD1\xB4\x6F\x5E\x38\x19\xC1\x3D\x19\xC1\x33\x19\xC1\x1B\x63\x23\xF0\xCF\x9C\xB3\xA8\x15\xC7\x8B\x6E\xA5\xAE\xA1\x36\x5C\x5B\x18\x9A\x1D\x8A\x55\x0F\xED\xD0\x07\x9E\x83\xE7\xE1\x45\x78\x11\x36\xC3\x56\x28\x4C\x70\x27\x9C\x4E\xF8\x35\xA1\x3E\xF1\xCD\xC4\x12\x95\x57\x75\x54\x75\x4A\xF5\x83\xEA\x57\x55\x49\xB2\x37\xF9\x68\xF2\xA9\xE4\x12\xB5\x57\xED\x57\x4F\x57\x1F\x55\x7F\xA7\x2E\x49\xF1\xA6\xCC\x48\x99\x25\xD9\x01\x19\xAF\x99\xA8\x29\xD1\xCC\xD0\x1C\xD5\x9C\xD2\x8C\x49\x9D\x20\xDD\xD1\x32\x69\xBB\x6B\x0B\x74\x97\xE9\x96\xE9\x1E\xD2\xB9\x5B\xDF\xD2\xFA\x9B\x8C\xD3\x19\x51\x5B\x1C\x62\x59\x87\x67\x8F\xCE\xDE\x9D\x7D\x20\xBB\x4A\xBF\x50\xBF\x4C\xFF\x90\x7E\x8C\x61\x82\x61\x8D\xE1\x45\x43\x41\xCE\x65\x39\x63\x72\x26\xE4\xF8\x24\xBB\x70\x33\x4D\x55\xA6\x85\xA6\x31\xE6\xB9\xE6\x05\xE6\x85\xE6\xC2\xB6\x8F\xB4\xFD\xBA\x6D\xA4\xED\x34\xCB\xBD\x96\xF3\xDC\x79\xAE\xC9\x7E\x4D\xBE\xFD\x9E\xAE\xF7\x75\x35\x75\xB3\x76\xBB\xB4\xDB\xE8\x6E\x57\x76\x73\x74\xAB\xEA\xB6\xB0\xDB\xDA\x6E\xDB\xBA\x99\x78\x2B\x7F\x94\x3F\xC5\xDB\x6B\x2E\xAE\xD9\x5D\xF3\x51\x0D\xD4\xAA\x24\x1B\x28\xA7\x6B\x7F\xAD\x1D\x13\x9A\x10\x12\xF5\x1D\x5D\x24\x5B\x5A\x17\x8D\xDA\x69\x2B\x40\x84\x19\x88\xB0\x08\x11\xEE\x8C\xB1\xCF\x66\x52\x20\xE4\x29\x10\x06\x51\x1A\x41\xE9\x3D\x05\xC2\x5E\x05\x42\x35\x8B\x50\xCB\x22\x8C\xA7\xF6\x61\x66\x26\x21\xCC\x4E\x42\x10\x92\x10\x56\xC7\xD8\xA7\xC9\x50\x21\x18\xA8\x1E\xB5\x45\x85\x50\x1F\xA7\x4F\x15\x50\xBB\x26\xB7\x26\x23\xCC\x4A\x46\x78\x34\x19\x61\x25\x9D\xF7\x9D\x4A\x6E\xB2\xE7\x12\xB5\xF3\x52\xAB\x46\x58\xAD\x46\x38\x93\x82\x10\x49\x69\xB2\x97\x13\xB5\xCF\x99\xAB\x45\x68\xAF\x45\xB8\x52\x8B\x70\x8D\x16\xE1\x35\x6A\x2B\x30\x6A\xC7\xF1\xB4\x0E\xE1\x57\x9D\x6C\x67\x70\x60\x1A\xC2\xEE\x34\x84\x8F\xD2\x10\x0E\xA7\x21\xFC\x90\xD6\x64\x1F\x65\x4C\x3A\xC2\x84\x74\x84\xDD\xE9\x08\x1F\xA5\x37\xF5\xE3\xFA\x0C\x84\x37\x33\x64\xFB\xA3\x7D\x33\x11\x1A\xB2\x10\xBE\xCB\x6A\xB2\xCB\x15\xB5\x27\x19\x9D\x5F\x46\xED\x19\xD5\x1B\x11\xF6\x18\x9B\xEC\x8F\x45\xFB\xF9\x98\x29\x08\x13\xA6\x20\x5C\x3F\x05\xC1\x39\x05\xA1\xCA\x83\x70\xBF\xA7\xC9\xAE\x5D\xD4\x9E\x5D\xD4\x5E\x5C\xC1\x61\x84\xCB\x0E\x23\x9C\x3E\x82\xF0\xEB\x11\x59\x5F\xDD\x75\xAC\xC9\x6E\xEA\xD4\x13\x08\x75\x27\x10\x9E\x39\x81\xB0\xFA\x04\xC2\xDA\x18\xFB\x72\x9D\x4F\x22\x74\x89\xDA\x99\xFB\x16\x21\xE5\xDB\x26\xFB\x69\xD1\x73\x61\xD1\xF6\x8B\x3D\xB7\x13\xC5\x5F\x51\xAF\x8F\x1D\x4F\x2D\x8D\xA1\xD8\xF1\x73\x54\x7D\x4A\x1A\x3B\xE2\xB8\x29\xD1\x78\xE3\xC6\x8C\xB5\x71\xCC\x88\x63\xA5\x69\x9C\x7C\x74\xC1\x71\x22\xF6\xEF\x3F\xEA\xD7\xD1\x27\xDA\x3F\xA3\xFD\xA3\xE4\x0F\xDA\xFF\x1F\x69\xF7\x3E\xB4\xDD\xBF\x8A\x6B\xF7\x09\x2D\xB4\x7B\x7C\x3B\x5F\xA8\x1D\xA3\xED\xD7\xD8\x1E\xF4\x5C\xA9\x88\x1B\x9F\x64\x7F\x9A\x0D\xE9\x08\xD7\xA7\x23\xDC\x48\xCF\x79\xD5\x27\x9E\x49\x3C\x9F\x18\x89\x7E\x62\x16\x44\xCC\x29\x94\xB0\xE3\x0E\x73\x2C\x56\x88\x78\x00\xD4\xBE\x57\x10\x2F\x3C\x9E\xA3\xFD\x32\xFA\xC4\x62\xA5\x88\x8B\x22\x16\x9E\x56\x7F\xA7\x16\x71\x50\xC4\x40\x9F\x66\x86\xA6\xA3\xB6\xBB\x56\xC4\x3B\x11\xE7\x0E\x64\x1F\xC8\x6E\x8E\x63\x0E\xF3\xC2\x16\x70\xEC\x42\xD8\x25\x62\x56\x6C\xFB\x45\xF1\xA9\xF2\x0F\xF0\xE9\x3F\x8D\x3F\x7F\x06\x77\x5C\xBA\x26\x7C\xC9\xA7\xB8\xF1\x35\xC5\x8D\xEB\x28\x5E\x44\xF1\xE1\x8F\x70\x20\x3A\xDE\xFF\xD1\x71\x7E\x98\x9E\xC7\x6F\x3C\x37\x46\xCF\x85\xD9\xE9\xB9\xFC\x68\x7F\x1C\x75\x18\x61\xF4\x61\x84\xAA\x8C\x15\x19\x63\x72\x66\x37\x7E\x36\x2B\xDE\x4E\x45\xB4\xFC\x4D\xF3\x5D\xB9\x3D\x3A\x2B\x10\xBA\x28\xE4\x73\xA0\x62\x3D\x8E\xA1\x7A\x7A\xEC\x79\x57\xA9\xBF\xD1\x73\x9C\x85\xC9\x08\xB3\x93\x63\xCE\x7F\xD2\x07\xD5\x0A\xF5\x85\xCE\xCA\xF7\x8B\xDB\xAF\x91\xCF\xCD\x17\xA9\x4B\xD4\xD3\x1B\xBF\x4C\x1F\x6F\x67\xA4\x8A\x9E\xAF\x8D\xE2\x82\x19\xF2\xA0\x1D\x74\x04\x4E\xFA\xEE\x5D\x5F\x18\x28\xD9\x8B\xBD\x51\xFA\xBE\xDD\xCD\x70\x33\xDC\x0A\xB7\xC2\xE3\xF0\x38\x08\x20\x40\x1D\xD4\xC1\x06\x78\x01\x36\x49\x56\x64\xB7\xC1\x2C\xC5\x2C\xC9\x56\xEC\x75\x4A\x87\x72\xA1\x72\x91\x72\xAB\x72\xAB\xB2\x5E\x59\xAF\x7C\x45\xF9\x8A\x72\x87\x72\x87\xF2\x7B\xE5\x0F\x4A\x55\x42\x72\x42\x4A\x82\x46\xB2\x23\x4B\x12\x8C\x09\x93\x13\x2A\x12\xF6\x24\xEC\x49\x80\x44\x4D\xE2\xCF\x89\xBF\x26\xDA\x93\x06\x48\x6B\x9E\xC5\x2A\x97\xCA\xA7\xF2\xA9\xCE\xAB\xCE\xAB\xA6\x25\x4F\x4B\x3E\x9D\x7C\x3A\x79\x7A\xCA\xF4\x94\xF9\x29\xF3\x53\x7E\xD0\xFC\xA0\x19\x9D\x3A\x3A\xF5\xBA\xD4\xEB\x53\x59\x6D\x2B\x6D\xBA\x36\x5D\x9B\xAF\xED\xAF\x5D\xA0\x5D\xA0\xDD\xAD\xDD\xA3\xFD\x48\x7B\x40\x3B\x42\x37\x5A\x77\x56\x77\x56\x57\xD8\xBA\xAC\x35\xA4\x43\xBA\x27\xC3\x93\xF1\x48\xC6\x8A\x8C\xA8\x6D\xDA\x3D\x99\xFB\x32\x3F\xCC\x3C\x90\x09\x59\xC9\x59\x43\xB3\x87\x65\x13\xBD\x51\x5F\xAD\xE7\xF5\x35\xFA\x67\xF4\xD7\x19\x0A\x25\x1B\xCB\x7D\x73\x06\xE6\xCC\xCA\x99\x9D\x53\x9F\xF3\x7A\xCE\x07\x39\x1F\xE4\xE8\x4C\x16\x93\xDD\x34\xC4\x34\xCC\x74\xA5\xE9\x6A\xD3\x44\xD3\xAD\xA6\x59\xA6\x25\xA6\xBB\x4C\x49\x79\xEA\x3C\x6B\x5E\xC7\xBC\x32\x4B\xA5\xE5\x35\xCB\x0E\xCB\x51\xCB\x29\xCB\x3C\xEB\x83\xD6\x0F\xAD\x07\xAD\xE7\xAC\xE7\xAD\xBF\x72\xE7\xB8\x30\x17\xE1\x7C\x9D\x7D\x9D\xC1\x66\xB3\xD9\x6D\xA3\x6D\x57\xD9\xAE\xB2\xA1\x5D\x61\x4F\xB2\xA7\xD9\xD3\xED\x46\xBB\xF8\xF4\xB7\xF7\xA7\xB6\x6A\xCF\xDA\xC3\xAB\x22\xAB\x34\xBC\x96\x0F\xF0\x01\x7E\x16\x3F\x8B\xFF\x8E\xFF\x99\x0F\xD6\x4C\xAF\x79\xB7\x66\x57\xCD\x2F\x35\x67\x6A\xCE\xD5\x9C\xAB\xB1\xD5\x76\xA9\x75\xD4\x3A\x6A\xB7\xD7\xEE\x94\xEC\xB9\xDD\x10\x72\x84\x3E\x09\x7D\x1A\x3A\x1D\xFA\x36\x74\xBC\xEE\x78\x9C\xDD\x5A\x67\xB8\x28\x5C\x14\x2E\x0B\x97\x85\x27\x87\xA7\x84\x31\xA2\x88\x28\x23\xC9\x91\x94\x88\x36\xA2\x8F\x18\x22\x46\xC9\x96\x6D\xFF\xC8\xC0\xC8\xC0\xC8\xF5\x91\xEB\x23\x37\x46\x6E\x8C\x38\x22\xAE\x48\xD4\x7E\xED\x4A\x85\x4C\xBB\x29\x45\xED\x25\x8F\xA3\xB6\xF0\x8C\x2A\x99\xA2\xFB\xA2\x51\x7B\x6C\xB3\x29\x9D\xA6\xEB\xD5\x51\xBB\xD7\x0F\xA9\x11\x56\xA8\x11\x9E\x49\x95\xE9\x5A\x2D\xC2\x04\x2D\xC2\x25\xD4\xBE\xF4\x26\x1D\xC2\x66\x1D\xC2\x56\x6A\x9F\xAE\x20\x0D\x61\x48\x1A\x42\x30\x0D\xA1\x32\x0D\xE1\xB5\x34\x84\x37\xD2\x10\x76\x52\x3A\x48\xE9\xE3\x34\x84\x4F\xD3\x10\x7A\xB7\x42\xE8\x4F\x75\x5F\x91\x2E\x4F\x47\x18\x9D\x8E\x70\x5D\x8C\xBC\x10\x69\x07\xA5\xED\x6D\x10\xF6\xB7\x41\x18\x94\x81\x30\x24\x03\x21\xAA\x7F\xF7\xCB\x44\x18\x90\x29\xDB\x14\x15\x69\x28\xB5\x37\x7A\x84\xD2\x40\x3D\xC2\x70\x3D\xC2\xC3\x7A\x84\x15\x7A\x84\xC7\xF4\x08\x4F\xE8\x11\x06\x51\x3B\xDA\xBE\x1C\x84\xA9\x39\x08\x3F\xD3\x75\xFF\x88\x51\xA6\xA8\x9D\xD5\xA8\x3E\xFF\x23\xA5\x5E\x53\x10\xFA\x4E\x41\x18\x4A\xE9\x01\xBA\x36\x77\xC4\x2B\xD3\x4A\x6A\xAF\xF4\xF6\x03\x08\x77\x1E\x68\xC1\x1E\xFC\x14\x84\x61\x53\x7E\xAB\x3F\xC5\x9F\xB3\x2D\xA4\x72\xA1\xF1\xDC\x30\x7D\xC4\x71\x3E\xD0\x54\x60\xBA\xC6\x74\x8D\xA9\x7B\xB8\x47\x78\x64\x78\x74\x58\xEC\x13\x51\xFF\xCE\xD0\x19\x16\xD1\xB1\x2D\x8E\xAB\x84\xAC\x84\x2C\x9D\xA9\x8D\x29\xD3\x96\x69\xD3\xDB\xF4\xB6\x7C\x5B\x5F\x5B\x81\xAD\xC0\x96\x63\xCF\x91\xFA\xB4\xD8\x9F\xBB\x86\xBB\x85\xC7\x87\xC7\x4B\xFD\x4F\x13\xD1\x44\xA2\x6D\x0E\xD2\x77\x49\xAD\x70\x23\xDC\x28\xE1\x4A\x5F\x6D\x5F\x6D\x7F\x6D\x7F\xED\x8A\x8C\x15\x19\xC3\x4D\xC3\x4D\xB3\x4C\xB3\x4C\x77\x99\xEE\x32\xA9\xF2\x54\x79\xEA\x3C\x75\x5E\xC7\xBC\x8E\x79\x6E\x8B\xDB\x32\xC5\x32\xC5\x52\x61\xA9\xB0\x78\x2D\x5E\xCB\x54\xCB\x54\x4B\xC0\x12\xB0\x54\x5A\x2A\x2D\x3B\x2C\x3B\x2C\x5F\x5A\xBE\xB4\x7C\x65\xF9\xCA\x72\xDC\x72\xDC\x72\xD2\x72\xD2\x72\xCA\x72\xCA\x32\xDF\x3A\xDF\x7A\x9B\xF5\x36\xEB\x1D\xD6\x3B\xAC\x8B\xAC\x8B\xAC\x8B\xAD\x8B\xAD\x77\x59\xEF\xB2\x2E\xB3\x2E\xB3\xDE\x63\xBD\xC7\xBA\xDC\xBA\xDC\x7A\xBF\xF5\x7E\xEB\x83\xD6\x07\xAD\x1F\x59\x3F\xB2\x1E\xB4\x1E\xB4\x9E\xB7\x9E\xB7\xE6\xD9\xF2\x6C\xED\x6C\xED\x6C\x16\x9B\xC5\x66\xB5\x59\x6D\x2A\xBB\xCA\xAE\xB6\xAB\xED\x1A\xBB\xC6\xAE\xB5\x6B\xED\x69\xF6\x34\x7B\x1B\x7B\x1B\x7B\xA6\x3D\xD3\x9E\x6D\xCF\xB6\x1B\xEC\x06\x3B\xB1\x1B\xED\x03\xCE\x0F\x38\x9F\x15\xCE\x0A\xF7\x0C\xF7\x0C\xF7\x0E\xF7\x0E\xE7\x87\xF3\xC3\xFD\xC2\xFD\xC2\x03\xC2\x03\xC2\x05\xE1\x82\xF0\xE0\xF0\xE0\xF0\xD0\xF0\xD0\xF0\xA5\xE1\x4B\xC3\xD7\x85\xAF\x0B\xDF\x10\xBE\x21\x3C\x31\x3C\x31\xAC\x8A\xA8\x22\xFD\x23\xFD\xA5\xB1\x57\x18\x29\x8C\x14\x45\x8A\x22\x22\xB6\x66\x9B\xB2\x4D\xB9\xA6\x5C\x53\xBE\x29\xDF\xA4\xB0\x29\x6C\x4A\x9B\xD2\x96\x6C\x4B\xB6\x69\x6C\x1A\x5B\xAE\x2D\xD7\x66\xB6\x99\x6D\x05\x35\xD3\x65\x3D\x81\xCA\xF5\xE8\x78\x14\x31\x3A\xCB\x94\x65\x32\x98\x72\x4C\x46\x93\xD1\xD4\xC7\xD4\xC7\xC4\xD8\x18\x1B\x6B\x63\x6D\x2A\x9B\xCA\x96\x62\x4B\xB1\xE5\xD8\x72\x6C\x26\x9B\xC9\x06\xD2\xF7\x4E\x45\xFC\xB7\x40\x47\x49\x06\x70\x60\x8B\x91\x03\x37\xC0\x0D\x8D\xD8\x2F\xE2\xFE\x6F\x31\x7F\xE1\xBF\x0D\xEF\x2F\x84\xF5\x22\xCE\xFF\x16\xE3\x95\x59\x89\xFF\x00\xCE\x67\x98\x32\x4D\x26\x09\xEB\x7B\x9B\xFA\x9A\x06\x98\x06\x99\x86\x98\x2E\x91\x30\xFF\x6A\xD3\xB5\xA6\x89\xA6\xE6\x78\x8E\xB6\x04\x5B\x92\x4D\x6D\x53\xDB\x52\x6D\x19\xB6\x2C\x5B\xB6\xCD\x60\x33\xD8\x88\xCD\x68\xEB\x28\x61\x7D\x1F\x5B\x3F\xDB\x40\xDB\x20\xDB\x20\xDB\x90\x18\xDC\x17\xB1\xFE\x7F\x0A\xE7\x75\xE1\x8C\x70\xB6\x84\xF3\xF6\xF0\xB0\xF0\xF0\xF0\x65\xE1\x2B\xC2\x63\x24\xCC\x1F\x17\x76\x84\x9D\x71\x98\x9F\x18\x49\x96\x70\x3F\x25\x92\x1A\x83\xFD\xFD\x22\xFD\x22\xCE\x88\x33\x52\x2C\x62\x7E\xEC\xF3\x17\xE3\xFF\xDF\xB8\xFF\xAF\xE1\x7E\x07\xE8\x00\xD7\xC3\xF5\x92\x6E\x96\xAF\xCD\xD7\xF6\xD3\xF6\xD3\x3E\x92\xF1\x48\x86\xDE\xA4\x37\x11\x13\x31\x0D\x33\x0D\x33\xDD\x6A\xBA\xD5\xB4\xC4\xB4\xC4\x94\x94\x97\x94\x97\x9C\x97\x9C\x67\xCD\xB3\xE6\x95\x59\xCA\x2C\x93\x2D\x93\x2D\xE5\x96\x72\x8B\xC7\xE2\xB1\xF8\x2C\x3E\x8B\xDF\xE2\xB7\x04\x2D\x41\xCB\x6B\x96\xD7\x2C\x47\x2D\x47\x2D\xC7\x2C\xC7\x2C\x5F\x5B\xBE\xB6\x9C\xB0\x9C\xB0\x7C\x63\xF9\xC6\x32\xCF\x3A\xCF\xBA\xC0\xBA\xC0\x7A\xBB\xF5\x76\xEB\x42\xEB\x42\xEB\x9D\xD6\x3B\xAD\x4B\xAC\x4B\xAC\x4B\xAD\x4B\xAD\x77\x5B\xEF\xB6\xDE\x6B\xBD\xD7\x7A\x9F\xF5\x3E\xEB\x03\xD6\x07\xAC\x1F\x5A\x3F\xB4\x1E\xB0\x1E\xB0\x9E\xB3\x9E\xB3\x5E\x64\xBB\xC8\xD6\xD6\xD6\xD6\xD6\xDE\xD6\xDE\xD6\xC1\xD6\xC1\x36\xD8\x36\xD8\x96\x64\x4F\xB2\x27\xDB\x93\xED\x29\xF6\x14\x7B\xAA\x3D\xD5\xAE\xB3\xEB\xEC\xE9\xF6\x74\x7B\x86\x3D\xC3\x9E\x65\xCF\xB2\xEB\xED\x7A\x7B\xAE\x3D\xD7\x3E\xF0\xFC\xC0\xF3\x99\xE1\xCC\xF0\xC5\xE1\x8B\xC3\xBD\xC2\xBD\xC2\x7D\xC2\x7D\xC2\x7D\xC3\x7D\xC3\xFD\xC3\xFD\xC3\x03\xC3\x03\xC3\x83\xC2\x83\xC2\x43\xC2\x43\xC2\x97\x84\x2F\x09\x4F\x08\x4F\x08\x5F\x1F\xBE\x3E\x7C\x63\xF8\xC6\x70\x52\x24\x29\xD2\x37\xD2\x57\xD2\x65\x1C\x11\x47\x64\x52\x64\x92\xD4\xAF\xA3\xF7\xAA\xA2\xFD\x2F\x3A\x6F\xB1\xD7\x5E\x2D\x8D\xB1\xEA\x8C\xAF\x33\xBE\xC9\xF8\x25\x23\xDA\xFD\xDB\x42\x5B\xE8\x04\x9D\xA0\x1F\x0C\x80\x89\x30\x11\x0A\xA1\x10\x6E\x81\x5B\x60\x16\xCC\x82\x27\x80\x87\x1A\xA8\x85\xA7\xE1\x69\x78\x16\xD6\xC2\x3A\x58\x07\x1B\x61\x63\xE3\xF7\x14\x5E\x66\x5E\x63\xDE\x97\xBE\xA9\x70\x9C\x39\xC9\x9C\x64\x4E\x31\x11\xA6\x52\x51\xA9\x98\xAF\x58\xA0\xF8\x49\xF1\x93\x62\x2E\x3B\x97\x5D\xA2\x5C\xAA\x4C\x48\x48\x4A\x50\x27\xA8\x13\x52\x13\xB4\x09\x9F\x24\x7C\x92\xF0\x55\xC2\x57\x09\xE7\x13\xC2\x09\x3F\x25\xFE\x94\x18\x4E\x8C\x24\x7E\xA7\xFA\x5E\x75\x46\x75\x56\xF5\x6D\xF2\xB7\xC9\x3E\xB5\x4F\xFD\xBD\xFA\x8C\x7A\x76\xCA\xEC\x94\xD1\x9A\xD1\x9A\x99\x9A\x99\x9A\x81\xA9\x03\x53\x51\xAB\xD0\xB6\xD6\xB6\xD6\xB6\xD1\x66\x6A\xF5\x5A\xA3\xB6\x87\xB6\x87\xB6\xA7\xB6\xA7\xB6\xB7\xB6\xB7\x76\xAB\xF6\x35\xED\xEB\xDA\x77\xB4\xEF\x6A\x77\x69\xF7\x6A\x3F\xD4\x3E\xA6\x5B\xA9\x5B\xD6\xFA\xA1\xD6\x15\x19\x15\x19\x07\x33\x0F\x66\x16\x64\x17\x64\x7F\x92\x1D\xC9\x76\x1A\x26\x1B\x82\x86\x5B\x0C\x5B\x8C\x5B\x8C\xDB\x8C\xDB\x8D\x3B\x8D\xBB\x8C\x1F\x1B\x3F\x35\x9E\x34\x9E\x32\x9E\x37\x86\x8D\x43\x4D\x43\x4D\x57\x99\xAE\x32\xDD\x64\xBA\xC5\xB4\xC8\xB4\x98\x7E\xAB\x01\xCD\x0A\x73\x82\x39\xC9\xAC\x32\xA7\x9B\xD3\xCD\x19\xE6\x2C\x33\x31\xE7\x99\xDB\x49\xDF\x70\xB0\x98\xAD\x66\xAB\x28\x9E\xCC\xF9\xE6\xBE\xE6\x02\xF3\x50\xF3\x08\xE9\x7B\x0E\xA3\xCD\x8B\xA4\xEF\x39\x24\xE6\xA5\xE4\x75\xC8\xEB\x94\x27\x7F\xD7\x61\x45\xDB\xAF\xDA\x42\xBB\x52\xCB\x72\xCB\xAB\x96\xD7\x2D\x5F\x58\x4E\x5B\xE6\x5A\x1F\xB2\xEE\xB7\x1E\xB2\x9E\xB5\x86\x63\xBE\xF7\xF0\x05\xF7\x35\x37\xC6\x76\xA5\x2D\xD6\x96\xF5\xE9\x2E\x67\xBB\xB0\x76\xD6\xDE\xCA\xDE\xDA\x6E\xB2\x9B\xEC\x3D\xED\xBD\xEC\x03\xE8\xF7\x1F\x96\x75\xBD\xBB\xEB\xFD\xF4\xDB\x0F\xD0\x8D\x74\xEB\xD8\xED\x92\x6E\x63\xBA\x8D\xE9\x56\xD8\x6D\x76\xB7\x45\xDD\xD6\x74\xAB\xEF\x26\x7F\x03\x62\xD9\xAA\x1D\xAB\x40\xC8\x10\x4C\x82\x59\x58\x28\x2C\x12\x3A\xD4\x74\xAA\xE9\x59\xD3\xA7\x66\x7A\x68\x66\x28\xFA\x2D\x08\xEB\x59\xEB\xD9\xE7\xCE\x6E\x3F\x7B\xEE\xFC\xF9\xF3\x93\xC2\x93\xC2\xC5\xE1\x92\xB0\x3B\xEC\x0E\xB3\x11\x36\xA2\x8E\xA8\x23\x39\x11\x12\x19\x10\x19\x10\x29\x88\x14\x44\x6E\x88\xDC\x10\x99\x18\x99\xD8\xF8\x4D\x88\x73\x91\xF3\x91\xE8\xF7\x1F\x66\x22\xC2\x42\x44\x58\x4C\xED\x8B\x47\xBF\x07\x11\xB5\x33\x1E\xFD\x2E\xC4\xF4\x24\x84\x19\x49\x08\x6F\x24\xCB\x34\x90\x7E\xDF\x67\xAF\x11\xE1\x5B\x23\x42\xBF\x29\x08\x03\xA9\xCE\x27\xD2\x0A\x6A\xD3\xBE\xA5\xEF\x46\x14\xD3\xEF\x46\x94\xFF\xCE\x77\x23\xE0\x7D\x84\x41\xD4\xC6\xF9\xB0\x98\xEF\x47\x6C\xDF\x27\xD3\x41\x4A\x67\x29\xB5\xD9\x2F\xD3\xC5\x94\x46\x53\xF2\x52\x5A\x48\xA9\x96\xD2\x2B\x94\xE0\x43\x84\xC8\x47\x08\xBD\x0E\x20\xE4\x1F\x40\xA8\x38\x80\x10\x3C\x80\x30\xED\x00\xC2\xBC\x03\x08\x0B\x0E\x20\xDC\x76\x40\x9E\x73\x8B\x14\x39\x22\xD3\xD3\x27\x64\x5A\x43\xC9\x76\x52\xA6\xC6\xEF\xEE\xFC\x83\xDF\x89\xD0\xC4\x7C\x27\xE2\xFF\xD2\xF7\x21\x20\xA9\x73\x92\xA8\x7B\x55\xD5\xBC\x56\xF3\x6E\xCD\x47\x35\xB1\x78\xF7\x04\x3C\x05\x4B\x95\x4B\x95\x22\x26\x45\xF1\xE7\x2C\xC5\x9F\x5F\xD5\xBF\xAA\x45\xBC\x11\x71\x43\x1C\xFF\xBD\x6B\x7A\xD7\x9C\x3B\x7F\xEE\x7C\x74\x0C\x34\x44\x0E\x47\xBE\x88\x1C\x6D\xD4\x21\x3E\x36\x22\x34\x18\x9B\xDA\x2F\xDA\x6E\x55\x54\x5E\x8F\x61\x11\x66\xC7\x7C\x0F\xA2\x2A\xE6\x9C\xDC\xC7\x6D\xE4\x7E\x72\x67\x4B\xFB\x33\xF4\x99\xA3\x99\xD7\xE2\x1D\xFC\xF8\xF3\xA3\x47\x35\xA7\x34\xDF\x69\x7E\xD0\x44\xD7\x9B\xA2\x4F\x14\xD3\x6B\xA0\x06\x56\xC3\xEA\x46\x0C\xFF\x3D\xEC\xBE\x10\x3E\x8A\x58\x13\x8B\x1F\x51\xCC\x10\xF1\x22\x8A\x09\x9F\x45\x3E\x8B\x9C\xFD\x1E\x21\xF2\xBD\x9C\x87\xA8\x6C\x89\xCA\x14\x51\x96\xAC\x85\xB5\x8D\x32\x44\x94\x13\xA2\x7C\x88\xC7\xDE\x2C\x73\x96\x84\xA7\x97\x9B\x2F\x37\x2F\x33\x2F\x37\x3F\x6C\x7E\xC4\x5C\x6D\xAE\x36\x3F\x69\x7E\xD2\xCC\x9B\x79\xF3\xB3\xE6\x67\xCD\xEF\x9A\x77\x99\xDF\x37\xBF\x6F\xDE\x63\xDE\x63\xFE\xC1\x1C\xB9\xC8\x94\x67\xCE\xBB\x25\xEF\x96\xBC\x47\xF2\x9E\xCF\x3B\x94\x77\x38\xEF\x85\x76\x2F\xB4\xDB\xDE\x6E\x7B\xBB\x5F\xDA\x45\xDA\x79\xDB\x7B\xDB\xD7\x37\xE2\x6E\xC4\x02\xD6\x58\xEC\x8D\x74\xB4\x77\x1A\xDA\xE9\x92\x4E\x57\x74\x12\xF1\x2F\x8A\x7B\x51\xBC\x8B\xE2\xDC\x91\xC8\x91\xC8\x57\x91\x13\xCD\xF4\xC7\xFF\x69\xDC\x88\xFF\xBE\x16\x0F\x3C\xD4\x42\x2D\x3C\x0B\xCF\xC2\x1A\x58\x03\xB2\x4C\xBD\x4B\xD9\x92\x2C\x3D\xA3\x3A\xA3\x92\xE5\xE7\x2F\xEA\x33\x71\x32\xF4\x9F\x95\x9F\xF1\xB2\xF3\xB7\xF2\x30\xF3\x82\xF2\x70\x84\x79\x84\xF9\x8A\x18\x79\x78\x9F\xF9\x21\xF3\x0A\xF3\x4A\xF3\xE3\xE6\x27\xCC\xAB\xCC\x4F\x99\x05\xF3\x33\xE6\xD5\xE6\x9D\xE6\xDD\xE6\xF7\xCC\x1F\x98\x3F\x30\xEF\x35\x7F\x6F\x86\x3C\x51\x66\x1A\xF3\x2E\x92\xE4\xE6\xCD\x79\xB7\xE6\x3D\x9C\xB7\x2E\xEF\x60\xDE\x91\x66\x32\x74\x43\xBB\x8D\xED\xEA\xDB\xBD\xDC\xEE\xE7\x76\xD0\xDE\xD3\xDE\xD7\x5E\x94\xA9\xDB\x2C\xD2\x37\xBA\x3A\x75\xE9\x34\xAC\xD3\xF0\x4E\x23\x3B\xFD\x73\xF2\xF4\x1F\x91\xA5\xB2\xFC\xEC\x55\xD3\x87\xCA\xD0\xF3\xE7\xCF\x9F\xFF\x3C\xF2\x79\xE4\x58\xE4\x58\xE4\xE4\x5F\x20\x0F\x0F\x19\x11\x0E\xFF\x9B\xE5\xE2\x3F\x2A\xC7\xA2\xF2\x2B\x2A\xB7\xFE\x1D\xF2\xEA\x8C\x88\x35\x3F\xFC\xEF\x90\x5B\x76\x3A\x5F\x8C\x3E\x51\x3B\x06\xD1\xFD\xAB\x31\x74\x1E\x56\x65\xD8\x66\x10\xE7\xF3\x50\xC3\x35\xDB\x3F\x81\x44\x4D\xA2\x36\x71\x44\xE2\xC8\xC4\xD1\x89\x85\x49\x93\x93\x64\x5B\x27\xE9\x8D\x36\x4E\xFC\x99\x81\xCC\xA8\x0D\x13\x31\xB8\xA9\xF1\x6C\xBF\xBC\xF7\x56\xAD\x7F\x46\x5F\x25\xD9\xEA\xF8\x54\xDA\x47\xAF\xA2\x76\x01\xA2\xFB\x60\x73\xFF\xA4\x7D\x9A\xD8\x3B\x14\xBB\xD5\xBB\xA5\xF3\xAF\x47\xD5\x67\xD4\xF5\xB4\xFF\x46\xE7\x8B\x0D\xD4\x66\x50\xEC\x3D\xF8\xC8\xA2\x98\x7B\xF0\xBF\xB1\x71\xD3\xFC\x1E\x86\x6C\xEF\xA6\x28\xA5\x24\xC5\x9B\x32\x3D\x65\x76\x4A\x55\xE2\xDA\x44\x4C\xCD\x4F\x2D\x48\xBD\x5E\x3E\x94\x40\x6D\xCE\x4C\xA5\xE7\xC1\xB6\x4A\x38\x27\xAF\xAB\xC8\xB6\xEB\x7D\x9D\x67\x77\x9E\xDD\xB9\x51\x3E\x53\xBB\x09\xD1\x7D\xC0\xA8\xDD\x8E\xE8\xFA\x00\x3C\xD5\x89\x8F\xAD\xEE\x7A\xBA\x8F\x17\x95\xFF\xD5\x74\x7F\x27\x42\x29\x6A\xCF\xA2\x8E\xAE\x09\x36\xDA\xB5\xA8\x5E\xBC\x4A\xC4\x10\x13\x98\xA0\x1A\xAA\xA1\x2A\xA3\x2A\x03\x4C\xC9\xA6\x0E\x26\xAB\xA9\x8B\xA9\x8B\xC9\x61\x72\x98\xC0\x0E\x76\xA0\xE7\x5A\x3A\x48\x3E\x56\x53\x7C\xF8\x66\x61\x01\x60\x52\x12\x42\xAC\x85\xD4\xAA\x11\x08\x0A\x00\x18\x11\xC7\xAF\xA6\xFC\xF1\x4C\x73\xFE\xC6\x11\xB2\x7B\x41\xAA\xFC\xB7\x7E\x04\x4A\xDF\x5E\x37\x5D\x8E\xD2\x37\xCF\xBB\x24\xCA\xFC\x82\x2B\x10\xD8\x98\xF7\x3E\x4A\x68\x1E\xCF\x98\x2B\x10\x18\x00\x69\xEE\x29\xF2\x0B\xA9\x3B\xFA\xE4\xD3\xFC\x94\x5D\x21\xFF\x2D\xA7\x7F\x6F\x4A\x8E\xCB\x3F\x7D\xCF\xA4\x92\xF9\xCB\xE2\xE2\xD9\x48\xF9\xD5\x57\x60\xEC\x57\x05\xA5\xFD\xBE\xD8\x78\x1A\x68\x7E\x7F\x52\x52\xFE\x48\xB9\xFC\xD1\x67\x6D\x5C\x78\x1D\xF5\xEF\x94\x22\xF3\x3B\x8C\x8C\xAB\x27\x5A\x2E\x6E\x64\xF3\xFC\xE8\x35\x32\xBF\x47\x5C\xF8\x45\x69\xB4\xDE\x46\xA2\xF4\x7D\xE1\xAA\x91\x28\x7D\xD3\xF8\x34\xAD\x87\x37\xE2\xE2\xE9\x90\xD8\xFC\xFD\xDD\x34\xBE\xDE\x71\xFC\x06\xFA\xDE\x16\xDA\x5E\xA7\xE3\xE2\x19\x45\xF3\x09\xA3\x10\x34\x62\xFA\xA3\x50\xFA\xF6\x72\xBE\x36\xAE\x9E\x47\xC9\xEF\x2D\xA4\xF9\x59\x36\xAA\x79\xFB\x6E\xA4\xF5\x50\x3D\xAA\x79\xBD\x5D\x1E\x97\x9F\xA7\x47\xC9\xEE\x1C\xDA\x1F\xD6\x51\x77\x3D\x8D\xBF\x80\xF2\x77\x8F\x42\xB8\x5E\x74\x8F\x41\xB8\x0A\x00\x3A\xD2\xFC\xEF\xBE\xAA\x79\xFC\x8B\x69\xFF\x3C\x74\x55\xF3\x74\x0A\xE2\xFA\x73\xC3\x55\x72\x7E\xB7\x63\x73\x3E\x5C\x8D\x90\x00\x00\x0E\x1A\xBF\xFD\x6A\x84\xD8\x0B\x07\xBA\xB8\xFE\x3F\xE6\x6A\xD9\x7D\x37\xED\x0F\x85\x57\x37\xAF\x87\xE5\xD0\x3C\xBC\x8F\xC6\x67\x88\xAB\xCF\x35\x34\x9E\xDD\x71\xE3\xA2\xFE\x6A\x04\x25\x00\x0C\x89\x4B\xF7\xF4\xD5\x72\xFD\x7C\x1F\x17\x1E\xAE\x91\xDD\x8B\x53\x9B\xF3\x93\x28\x7F\x18\xE5\xEB\xAE\x91\xBF\xBD\x1B\x7D\xA6\xD3\x76\x59\x76\x0D\x42\x72\x0C\x3F\x9F\x86\xDF\x78\x8D\x9C\x5E\xFD\x35\x72\x7E\x66\xC5\xC5\x7F\x8C\xC6\x7F\x59\x5C\xB9\x4E\x5F\x83\xD2\xF7\xF6\xF5\xB4\x7E\x7C\xD7\x22\x98\x45\x8F\xB1\x72\xBB\xB9\x29\xDF\x34\xB6\xF9\x78\x4C\x8A\x1B\xD7\x85\x63\xE5\x76\x39\x11\x1D\xD7\x63\xE5\x71\x11\x7D\x8E\xD2\xFC\xEF\x1E\x8B\x20\x6D\xEE\x8E\x93\xEB\xF9\x39\xDA\xEE\x05\xE3\x9A\xC7\xFF\x75\x5C\xFE\xAB\xC6\xC9\xE5\xFB\x8C\x8E\xF7\x65\xE3\x9A\xFB\x9F\x8D\xAB\xE7\xEA\x71\x72\xFE\x17\xD0\xF6\xAD\x1F\x27\x8F\xCF\xE8\xD3\x91\xD6\xC3\xE7\x34\xDE\xD3\x34\xFC\xF2\xB8\x74\x75\xE3\x65\xFF\x32\x8A\x03\xA6\xF1\x08\xE9\x62\x3D\x8D\x97\xF3\xDF\x27\x0E\x67\xD6\xD0\xF0\x85\x71\xE3\xA8\x9E\xF2\xB7\xD3\xF1\xBB\x7B\x7C\xF3\x71\x71\x20\x1E\xDF\xA2\xF1\xD0\x7C\x9E\x1E\x2F\x8F\xF7\xE8\x63\xA6\x7C\xFB\x04\x79\xFC\x8F\x99\x20\x87\xEF\x49\xDB\xA5\x70\x42\x73\xDC\x38\x1C\x17\xBF\x6F\x82\x9C\xFF\x15\x71\xE3\x6B\x0D\x7D\x6F\x27\x4B\xEB\x6D\x42\xF3\xF1\xF2\x56\x5C\x3C\xBB\x69\xF8\xDC\xB8\xFE\xD0\x40\xF9\x0B\x28\x4E\x9E\x9E\x80\x70\x0B\x02\x34\x38\x10\xBE\x03\x80\x14\xDA\x5E\xBE\x52\xDA\x1F\xE8\xF3\x20\xE5\x57\x97\x36\xEF\xFF\x57\xD2\xF2\x9A\xCA\x9A\xD7\xDB\x33\xB4\x7D\xED\x65\x72\xBF\x8F\x3E\xF7\xA5\xC5\xE1\x00\x7D\x6F\x71\x1C\xDF\x57\x26\xD7\xDF\x52\x1A\x4F\x4D\x99\xFC\xF7\x69\xFA\x37\x99\x96\xB7\xBE\x0C\xA1\x88\x01\x18\xE3\x97\xBF\x7D\x7D\x37\xED\xB7\x85\x01\x84\x5E\x62\xFF\x0D\xCA\xFD\x3F\x3B\x5A\xAE\x20\xC2\x45\xE2\x8F\x99\x08\xAF\x8B\xF8\x4F\xF1\xA1\x60\x76\xF3\xF1\xBB\x8D\xA6\xEB\x9B\x8D\x30\x81\x01\x68\xB8\x03\xA1\x1D\x00\xDC\x1B\xD7\x7F\x92\x16\xC9\xEE\xAA\x38\xBE\x6E\x91\x5C\xCF\x36\x5A\x2E\xD3\x22\x84\x4D\x22\x7F\x09\x42\xA9\x58\x9E\xB8\xF6\xBA\x74\x99\xEC\x5E\xA3\x8C\xAB\x1F\xCA\x2F\x8B\x96\x6B\x99\x5C\x2F\xD1\xE7\x29\x3A\x2E\x6E\x59\xD6\xBC\x5F\x1D\x8C\xCB\xCF\x32\xEA\xFF\x46\xFC\x78\x5C\x26\xD7\xFF\x99\xB8\xFC\xD4\xD3\x74\x5E\x8A\x8E\xBB\xBB\x11\x2A\x44\xFE\x3D\x08\x83\x01\xE0\x07\x2A\xA7\x76\x2F\x6F\xDE\xBE\x8F\xC5\xC5\xFF\xF9\x72\xD9\xAD\xA1\xF1\x9F\x58\xDE\xBC\x9F\x8C\x8E\x4B\x17\xEE\x93\xF3\xE9\x56\xC7\xD5\xE7\x7D\xF2\x7B\x9E\x38\x3C\xEF\x70\x9F\xEC\x4E\x8C\x4B\xD7\x4E\xC3\x7F\x4D\xEB\x61\xCC\x7D\x08\xEF\x8B\xE5\x7D\x10\xA1\x12\x00\x7E\x8C\x4B\x77\xCC\x0A\x39\xDD\xB1\x34\x7C\xE1\x0A\xB9\xDF\xCC\x58\x21\xBB\x3F\x8D\x6B\x97\xAA\x15\x72\xFC\xD5\x71\xF1\x54\xAF\x90\xEB\x63\x23\x0D\xFF\xC6\x8A\xE6\xE5\xE5\x68\x7F\x68\x58\x81\x30\x44\x1C\x7F\x8F\xCA\xF5\xF9\x5E\x5C\x7B\x41\x35\x1D\xA7\xF1\xFA\x52\xB5\x1C\xDF\x37\x14\xF7\xEC\xD5\x72\xBF\xDC\x5D\x8D\x90\x05\x00\x4B\x68\xBD\x2D\x7B\xBC\x39\x3E\x28\xE2\xE4\x4B\xF5\xE3\x72\xFC\xC7\x69\x3E\xD7\x3C\xDE\xBC\xFF\x24\x46\xC7\xD7\xE3\x72\x3F\x68\x78\x5C\x2E\x57\x06\xAD\x67\xDD\x13\x08\xB9\x62\x3A\x4F\x20\x74\x14\xE3\x8B\x93\xD7\x0D\x4F\xCA\xF1\x3D\x17\x87\x3F\xA7\x9F\x94\xF3\xE5\xA7\xFD\x59\xB7\xAA\xB9\xFF\x7B\x34\xDD\xF4\x38\xBE\x3E\xAE\x7E\x4C\xAB\xE4\x7A\x28\x8B\x93\x0B\x05\xAB\xE4\x74\x5F\x88\x0B\x3F\x86\xC6\x77\x4D\x5C\xF8\xF1\x94\x9F\x1A\x17\xBE\x90\xC6\x73\x7B\x1C\xDF\x47\xC3\x3F\x15\xC7\x9F\x41\xF9\x81\x78\xF9\x48\xF9\x9F\x53\xFE\xB2\x55\xCD\xE5\xE9\x73\x29\x71\xB8\x4D\xD3\x3D\x14\x17\x4F\x03\xE5\x7F\xAF\xA3\xB8\xBD\x0A\x61\xBE\xE8\x21\x20\x5C\x2C\xE6\x27\xAE\x9E\xD7\xD4\xC8\xED\x65\x8E\x8B\xFF\xC3\x1A\xD9\xFD\x7C\x7C\x7B\x51\xFE\x0B\x51\xFD\xB6\x46\xEE\xFF\xD1\xE7\x38\xED\x6F\xBA\x5A\x84\x34\xB1\x1E\x6B\x65\xF7\xB7\x34\xFE\xC2\x5A\x84\x4B\x63\xC2\x5F\x4E\xFB\x61\x55\xA8\x39\xAE\x96\xD1\x7E\x58\x13\x6A\x9E\xFE\xC3\x71\xF5\xB9\x26\x24\x97\xB7\x3B\x2D\x57\x7D\xA8\xB9\x3C\x6A\x4D\xFB\xE1\xE9\x10\xC2\x1C\x91\xF1\x0C\x42\x0F\x51\xAF\xA6\xF8\x50\xFD\x2C\xC2\xE5\x31\xE1\xAD\xF1\xF2\x71\xB5\xDC\x7F\x94\x34\x9F\xC7\x56\xC7\xE9\xF3\xD1\x7A\x88\xE3\x7F\x4B\xEB\x1F\xD6\x20\x2C\x17\xFB\xD5\x73\x08\x57\x8A\x72\x9C\xE6\xE7\xC3\x75\xCD\xC3\xEB\x68\x79\x1B\xE2\xF8\xEB\xA2\xF1\xAF\x43\x68\x25\xF6\xDB\xF5\x74\x9E\x18\x37\x4E\xC7\xAF\x97\xDD\x09\xF1\xFD\x93\xF2\x67\xC4\xE9\xE7\xBE\xF5\x72\x3A\x6F\xC6\xCF\xEF\x68\xFC\x83\x68\xFC\xD5\xEB\x11\x52\xC4\x7A\xA0\xF1\xB4\xA7\xF5\xD3\xB0\x5E\x1E\xD7\xD7\x6C\x90\xDD\x77\x45\xE5\xCE\x06\xB9\x9F\x15\xBC\x20\xB7\x83\x2E\xAA\x0F\xBC\x80\xE0\x13\xFD\x5F\x44\x18\x0E\x00\x77\xC6\xCB\x9D\x4D\xB2\xFB\x97\xB8\xFC\x54\x6F\x92\xF3\x19\x89\xC3\xD5\x35\x34\xFC\x5B\xB4\x5D\x36\x6E\x6A\x5E\x6F\x33\xA2\xB8\xB4\xA9\xF9\x7B\xCF\x44\xE7\x35\x9B\x9A\xE3\xDE\xA3\x34\xDD\x86\xB8\x78\xCE\xD0\xF0\xC7\x36\x35\xC7\xE7\x9F\x69\x7F\xFE\x21\x2E\x7C\x55\xB4\x9E\x37\x37\x97\x77\x59\xB4\xBF\xA5\x6F\x6E\x1E\xDE\x1F\xD7\xDF\x4C\xD4\xFF\x63\x1A\x8F\x7D\xB3\xAC\x87\xFB\x28\x7F\x7C\x9C\xBE\x57\xB5\x59\x2E\x07\x4F\xC7\x69\xF5\x66\xB9\xBD\xA2\x4F\x77\xDA\x8E\xBB\x37\x37\x7F\xCF\x42\xCB\xBB\x27\x2E\x3F\xC7\x69\x7B\x35\x6C\x6E\xAE\x3F\x0C\xA4\xE1\xCF\x6D\x6E\x5E\x0F\x49\x71\xFD\x50\xB7\x45\x8E\xAF\x6B\x1C\x2E\x99\x28\x9F\xA3\xF1\xD8\xB7\x34\xF7\x3F\x15\xD7\xBE\x05\x34\xFC\x8D\xF1\xF2\x97\xF2\x33\xE2\xE7\x2F\x5B\xE4\x7C\xD9\x29\x7F\xC6\x96\xE6\xE5\x7A\x97\x8E\xC7\xAA\x2D\xCD\xE7\x9B\x7B\xE2\xF4\x87\x6A\x9A\x2F\x96\xA6\x5B\x13\x97\xCF\x43\x34\x9F\x4F\xC7\xF1\x6F\xA3\xED\xBB\x66\x4B\xF3\x7A\xAB\x17\xFF\x1B\xD4\xB0\x32\x51\x5D\xAF\x90\xE2\x85\x0B\x3F\xA2\x7F\xD2\x1F\xF8\xEB\xFE\xC0\xBF\xE0\x77\xFC\xC5\xA7\xEA\x77\xFC\xF2\xD5\x08\xBD\xDF\x97\xCA\x31\x0B\x01\x66\x20\x40\xB9\xD8\x87\x8D\xA2\x5E\x06\x00\x27\x23\x91\xE9\x3D\xE5\x74\x7E\x02\xD0\xF5\x45\xC9\x5A\xA3\x5C\xA6\x24\x9A\x37\x13\xCD\x43\x55\x34\x43\x7F\x61\x00\xD1\x53\x94\x19\xC5\xE2\xF8\x54\x00\xE8\x2C\x00\xD5\xB7\x21\x14\x0C\xD6\x42\xD5\xFD\x0F\x02\x1C\xFE\x51\x09\x6F\x3D\xDC\x57\x8C\x40\x4B\x5F\x16\x65\x52\x2B\x1A\x31\x4A\xE5\x92\xDB\x6D\xF1\x7B\x54\xEE\xBE\x17\x6D\xD7\x88\xF4\xAD\xC6\x48\x44\x07\x62\x99\xC5\x39\x02\x9C\xDC\xC9\xB0\x1E\x67\x85\x0B\xB7\xEC\x64\x36\x2B\x21\xC5\xEB\x73\x3A\x26\x55\xBA\xCB\x83\x6E\x8F\x1D\x63\x5D\x5D\x99\x58\x57\x37\x45\xAC\xAB\x3B\x1B\xEB\xEA\xA1\x4C\x16\x5D\xCE\x49\x5E\x7F\xD0\x91\xA0\x91\x7E\x97\x96\x3A\x8A\xBC\x95\x9E\x60\xA2\x3A\xEA\x0C\x54\x56\x24\x69\xA3\x0E\x9F\xDF\x5B\x5C\x59\x14\x54\x35\xFA\x56\x38\x67\x24\x37\x39\xDC\x1E\x75\x4A\xE3\x7B\x5E\x7F\x30\xA5\xD1\xCB\x59\x5E\xAE\x69\x72\x78\x66\xA6\xA6\xD2\x4C\x38\x2A\x5C\x15\x93\x5C\x7E\xAD\xB6\xB9\xBB\xBB\x4E\xCE\x8F\xDF\x1D\x2C\x73\x38\x27\x05\xD2\xB4\x4D\x4E\xBF\xB7\xD2\x53\xDC\x2A\xB5\x89\x51\xE4\x72\x97\xB7\x8E\x09\x50\x52\xEE\xF5\xFA\xD3\x63\x02\xF8\xCA\x2B\x03\x6D\x62\x02\x54\xB8\x3D\x95\x81\x8C\x56\x31\x8C\xCA\xF2\xA0\xDB\x57\x3E\x33\x53\xD7\xC4\x2B\x76\x4F\x73\x17\xBB\xB2\x62\xF2\xE1\x77\x55\x64\xD3\x00\x7E\xE7\x4C\x47\x91\xD7\x53\xE4\x0C\xEA\xB5\x4D\x9C\x40\xB9\xBB\xC8\x65\x90\xCA\x39\xC9\x1D\x0C\x38\xBC\xFE\x9C\x94\x46\x87\xD3\x53\x9C\xAB\x6D\x74\x79\x5C\xA5\xCE\xA0\x8B\x34\x79\xCF\xF0\xFA\x8D\xAD\x1A\x5D\x81\x32\x77\x49\xB0\xDC\x55\x12\x34\xB5\x6E\xCE\xF3\xBB\x4B\xCB\x82\xE6\x34\x91\x59\xE4\x2E\xF6\x8B\x99\x08\x3A\xDD\x9E\xC0\x45\xC9\x3E\xA7\x3F\xE0\x92\x98\x79\x49\xF2\x6F\xB7\xAF\x6D\xEB\xC6\x80\x6E\x4F\xD0\xE5\x0F\xB8\x8A\x82\x81\x76\x52\xB3\x17\x55\xF8\x1C\xAE\xA9\xED\xD5\xD1\xDF\x1E\xD7\x54\x4B\xA3\x47\x69\xB0\x83\xBA\xE9\xB7\xCB\xDA\xE8\x51\x1E\xEC\xA8\x6E\xFA\xED\xEA\x24\x55\x87\x6B\x9A\xB3\xDC\x51\x14\x9C\xE1\xF0\xB8\xA6\x73\x19\xCD\x38\x01\x57\xD0\xE1\xF6\xF8\x2A\x83\x9D\x93\xA2\x7C\x1B\x2B\xFE\xDF\xA5\xCD\x6F\xC2\x15\x3B\x83\x4E\xBB\xE1\x37\x6C\x97\x27\xE8\x9F\xE9\xF3\xBA\x3D\xC1\xAE\x99\xCD\x3C\x4B\x5D\x41\x87\xDF\x15\xA8\x2C\x0F\x76\x33\x38\x1C\x25\x5E\x7F\x91\xCB\xE1\xAE\xF0\x89\xBD\x39\xA6\x97\x07\xBA\x4B\x2D\x18\xF4\x3A\x3C\x95\x62\xCF\xEA\x21\x57\xA8\x33\xE0\xEA\xD9\xC3\xE1\x0E\x38\xA6\x39\xCB\xDD\xC5\x17\xA7\x51\x46\xA9\xCB\xE3\x28\x76\x15\x79\x8B\x5D\x3D\xD3\x62\xC2\xC9\xAC\x5E\xB1\x2C\x97\x47\x64\xF5\x8E\x7D\x51\x66\xF5\x69\x13\x13\xAA\xD2\x5F\x4E\x5F\xCE\x8F\x67\xCB\xA1\xFB\x4A\x6D\x3E\x39\xE0\xF5\x38\x2A\x3D\x15\x4E\x7F\xA0\xCC\x59\xDE\x4F\xD7\xC8\xA3\x9C\xFE\x52\xCA\xFE\x4A\x4F\xD0\x5D\xE1\x72\xB8\xFC\x7E\xAF\x7F\x40\x66\x74\xC4\x94\xFA\x9D\x3E\xB1\x73\x3A\x8B\xCA\x9C\x93\xCA\x5D\x03\xB3\x1A\xDF\x2E\x77\xCD\x10\xF9\xC5\xB4\xE8\x05\x2D\xF8\x04\x82\x7E\xB7\xA7\x74\x50\xDA\x6F\x7C\x06\xB7\x69\x64\xC9\xBD\x49\x0E\x39\x24\x3D\x8E\x1D\xF4\x4E\x71\x79\x86\xB6\x8A\x0F\xEC\x0A\x0E\x8B\x8F\xC0\x3B\x69\xB2\xAB\x28\x38\x3C\xB5\x39\xFB\x12\x69\x4C\x4C\x73\x96\x57\xBA\x64\xC6\xA5\x39\x8D\x01\xA6\xFB\xDD\x41\x97\xDF\xE1\xAA\x70\x07\x1D\x93\xBC\xDE\x72\x97\xD3\x73\x59\xCB\xBE\x62\xEF\x2E\x75\xF9\x47\x18\x5A\xF4\x95\x8B\x7F\x79\xCB\x9E\x72\xB9\xAE\xB8\xA8\x45\x4F\x79\x5C\xBB\xCA\x5D\x15\x2E\x4F\x70\xA4\xBE\xC5\x30\x52\xDE\x47\x19\x5B\xF4\x2B\xF2\x96\x97\xBB\x8A\x82\x6E\xAF\x67\xB4\xA9\xE5\xD4\xC5\x1E\x2E\x47\x3F\xE6\xC2\x21\xCA\x45\xA7\xB3\xFC\xCA\xBC\x16\x43\xC8\x15\x1B\x8D\xE6\xAA\x36\xF1\x81\xA4\x3F\x57\x6B\x1A\xD9\xC5\x95\x15\xBE\x6B\x52\x9B\xAA\x5D\x74\x5F\x2B\x35\x43\x85\xB3\xBC\xDC\x5B\xE4\x70\x7B\xDC\xC1\xB1\x52\x27\x2C\x73\x39\x7D\x0E\x5F\xD0\x2F\x0E\xB6\x71\xCD\x39\x01\x57\x70\x7C\x72\xD3\x4B\x13\xA4\x01\x5E\xE2\x77\xB9\xAE\x93\x10\xC2\xEF\x92\xD8\xD7\xB7\x89\x19\x8B\x8E\x22\x67\x51\x99\x4B\x8C\xEB\x86\x16\xD8\x01\x57\xF0\x46\x29\x89\x0A\x57\x85\xD7\x7D\x93\x4B\xCA\xC6\xC4\x66\x1C\x5F\x65\xA0\xCC\xA1\x6D\xC6\xF1\xFA\x0A\x5B\x35\x7F\x29\xE0\xF2\x07\x9D\xCD\x02\x95\xBA\x82\x93\x24\xA4\xAD\xF0\x15\x4B\xB1\x16\x69\xC5\x5F\xC5\xAE\x12\x67\x65\x79\x50\x04\x93\x62\xB5\xC8\xA8\x70\xCE\x10\x1D\x2E\x75\x34\x6C\xB1\xAB\xBC\x44\xCA\x80\xDC\x83\x44\x14\x99\x54\x52\x2A\x71\x26\x95\x34\x61\x4A\x59\x56\x3C\xC7\xE1\xF1\x4A\x75\xE1\x4E\x6B\xF2\x99\x54\x22\xE1\xF8\xE4\x28\x4B\x02\x75\x89\x3F\x85\x9D\xEA\x9C\x14\x28\x4F\x9A\xEA\x2C\x2E\x76\x78\x3D\xAE\x0A\x56\xFC\xE5\x49\x9A\x1A\xA8\x9C\x24\xBA\xBD\xEC\xD4\x8A\xCA\x72\x1F\x3B\xD5\xE9\x29\x9E\x9A\x24\xFE\xEF\xF0\x78\x83\x7E\xC5\x54\xAF\x3F\xC0\x4E\x9D\xE1\xF5\x07\xD9\xA9\x1E\x57\x69\x65\x5A\x53\x56\x03\x0E\xBF\xD3\x53\xEA\x9A\x96\xE6\x70\xF8\x9C\xC1\x32\x29\x21\xB9\x9F\x4C\x4F\x71\xD0\x01\x29\x7A\xCC\xD0\x39\x24\x20\xA5\x03\x32\x58\x16\x98\xA9\x71\xC8\x2E\xBF\xAB\xC2\x3B\xCD\x75\x53\xD4\x59\xE2\x2E\x0F\xBA\xFC\x37\xB7\x89\x36\x1A\xED\x75\x32\xFB\x96\x56\x71\xEC\x52\x57\xF0\xD6\xF8\xA0\x72\x84\xB3\xD2\xE3\xD8\x95\x1E\xB7\xD7\x33\x3B\xD1\xE1\xA8\x70\xF9\x4B\x5D\x55\xD8\x3A\xEA\x1F\x93\x8B\x39\x71\x5C\x39\xD5\xB9\xB2\xE6\x23\x09\x0F\x77\x49\xC9\x3C\x4C\x8F\x3A\x1B\xA5\x9D\xDB\xEB\x99\x8F\x6D\x28\x3B\xD0\x8C\xBF\x00\x35\xD1\xE0\x52\x16\x6E\xC3\xD4\xC6\x70\x12\xE3\x76\x94\xFA\x77\x20\xE8\x2F\x77\x79\xEE\x40\x35\x75\x78\x8A\x2A\x7C\x0B\x65\x97\x3B\x50\xEC\x2E\x75\x07\x17\x45\x5D\x01\x9F\xB3\xC8\x75\x27\xAA\x64\x57\x99\x6B\xC6\x62\x94\x86\x85\x3B\xE8\x75\x2E\x91\x63\x73\x06\xBD\xEE\x9E\x3D\xEE\x6A\x74\x94\xF4\xEC\xB1\x14\x5B\xD1\xA8\xDD\x9E\xD2\x00\xD5\x2B\x96\xD1\xC2\x34\x31\x25\x39\x7F\x77\x73\xB6\xCB\x53\x1C\x98\xEE\x0E\x96\xDD\x83\x19\xB1\xEC\x12\xAF\xBF\xC2\x29\xD5\xC2\xBD\xD8\x3A\xD6\xC3\xED\x29\x76\xCD\xF0\x96\x2C\x6F\xCE\xF5\xBB\x7C\xE5\xCE\x22\xD7\x7D\xB4\xA2\x9A\x73\x1D\x9E\xFB\x31\x2D\x96\x1F\xF0\x95\xBB\x83\x0F\x34\x4F\x30\x10\x74\xFA\x83\x52\x4E\x1E\x6C\x1E\x49\xA0\x72\x92\xFC\xF3\x21\xD4\xC5\xF2\x83\x7E\x77\xC5\xC3\xCD\x83\x8A\x2C\x87\xA8\xF3\x3C\xD2\x3C\x6E\x89\x2F\xE9\x3D\x2B\x30\xF3\x37\x1E\x3E\xBF\xAB\xC4\x3D\xE3\xD1\x16\x7C\x02\x95\x25\x25\xEE\x19\x8F\xB5\x10\x99\xD4\x4C\x2B\x31\xB9\xC9\x51\xDD\xBC\x88\xE5\xDE\xE9\x2E\xFF\xE3\xCD\x79\x95\x3E\x9F\xCB\xFF\x84\x5C\x71\xC1\x99\x3E\x57\x40\xD4\x1E\xE4\xC1\xF6\x64\x1C\x57\x7E\x65\x95\xDC\x54\x8D\x5C\x2A\xC1\x9E\x92\x5B\xBB\x91\x2D\x89\x18\x5E\xAE\x9D\xA6\x18\x5C\x41\x21\x2E\x52\x79\xB4\xD4\xC8\x99\x8A\xC9\x40\x79\x79\xAD\xDC\x71\x65\x9E\x38\x49\x08\xC9\x15\x5B\xE9\x71\x8B\x2A\x86\x23\x50\xE9\xF7\x7B\x45\x75\xB3\x4E\xAE\xA5\x28\x5F\x56\x4C\x44\x67\xF0\x69\xCC\x69\xC1\xA7\xF1\xC5\x67\x5A\x7E\x31\x58\xD2\xFB\xD9\xE6\x3E\xB2\x52\x23\xF9\xAC\x6E\x9E\x89\x72\x67\x20\x28\xF1\xD7\xC8\xD5\x12\xE5\x8B\x85\x15\x5B\x60\x6D\x73\x76\xD0\x2B\x37\xC2\x73\xBF\x61\x4B\xED\xF0\x3C\xC6\xC8\x2F\xB1\xE0\xEB\x62\x19\x65\xCE\x40\xD9\x7A\xB9\xA2\x64\x46\x91\xB7\xC2\xE7\xF4\xBB\x36\xC8\x81\x9A\x20\xEA\x05\x3A\xA8\x5D\x92\x6B\xA3\xDC\x32\x51\xAC\xF7\xCF\x14\x07\xD0\x8B\x32\x4A\xC8\xF1\x94\xBA\x82\x2F\x61\xD6\x6F\xE2\xA5\xAF\x6C\x6A\xC9\x4B\xEE\x0B\x9B\xE5\x6A\x6A\xEE\x25\xB5\xFC\x96\x96\x5E\x92\x73\xB8\x55\xAE\xC1\xB8\xF8\x5C\xC1\x6D\xA8\x8D\xC9\xA7\x58\xD8\xFA\xD8\xD2\x8B\x32\x7F\xBB\xDC\x9F\x64\x46\xB9\xCB\x53\x1A\x2C\x7B\x59\x7E\x8B\x16\x7E\x8A\x6B\x66\xE0\x95\xD8\xB7\x44\x69\xF5\x2A\xC6\x28\x63\x12\x1A\xBF\x26\xD7\x22\x7D\x49\x96\xAD\x3B\x30\xCD\xE1\x88\xAD\x47\xBF\x77\xFA\xEB\x72\x45\xD2\x2E\xFE\x86\x1C\x31\xCD\xA0\xDF\x55\xF2\x66\x33\x86\xDB\x13\x7C\xAB\x11\x5A\xDD\x9E\xD2\xB7\x31\xB7\x29\x59\x51\xDD\x2D\xF7\x4E\x77\x14\x79\x7D\x33\x69\x0A\xEF\xA0\xFE\x02\xFE\x01\x57\x70\x67\x53\x13\x3A\x8B\x8B\xDF\xC5\x54\x39\x6F\x52\x93\xFA\xBD\xD3\x77\xC9\xC3\xFF\xB7\xEF\xEE\x96\x7B\x3C\xED\x41\x7E\xA7\x27\xE0\x0E\xBA\xA7\xB9\x1C\x45\xE5\xDE\x40\xA5\xDF\xF5\x1E\x12\x39\xA2\x0B\x05\x78\x1F\x63\xA6\x82\x4E\x9F\xCF\xE5\x29\xFE\x40\x06\x7B\x71\x48\xEE\x69\xD6\x44\x01\xF7\x4D\xAE\xBD\x72\x3B\x37\xD5\x89\x43\xD2\x8F\x9C\x41\x57\xF1\x3E\x79\xA4\x37\xD6\x8E\xAC\xCF\xEE\x8F\x45\x47\x47\xD0\xE5\xAF\x70\x7B\xC4\xD0\x1F\xC6\x4A\x80\xA6\x48\x3E\x92\xA5\x8E\x94\x9F\x03\xD8\xAA\x29\x6F\xD3\xA5\x29\xB2\xD3\x77\x50\xAE\x72\xB9\x4A\x0F\x61\x22\xAD\xA5\x8F\x29\x2E\xBB\x82\x8D\x21\x3F\x89\xED\x92\xD1\x22\xC8\x42\xF5\x53\x4C\x6D\x8A\x59\x9C\xE2\x37\xC8\x49\xC9\x61\x45\xF5\x45\xD4\x21\x0E\xC7\x76\x5C\x59\x80\x4B\xFC\x23\x72\x16\xCA\xBD\xDE\x29\x95\xBE\xCF\xE4\x84\x2B\x9C\x3E\x9F\x58\x10\xB1\xD8\x9F\xCB\x91\x45\x59\x72\xB8\x2F\xB0\xD4\x23\xCE\x9F\xF2\xFD\xAE\x6E\x1D\x02\xC1\xE2\xFC\x7C\x87\xA3\x6B\x7E\xFE\x24\x67\xC0\x5D\x44\x6B\xA1\x5F\x51\x99\xD3\xCF\x99\x9A\x3C\x45\xB7\xD8\x66\xEE\x60\x40\xF2\x1B\x10\xEB\x49\xAB\xCC\xEB\x97\xBD\x4C\x03\x4C\x45\x5E\x4F\x20\xD8\xDE\x7A\x14\x8B\x5D\x81\x22\xA7\xCF\xF5\xD7\x26\xF3\x25\x36\x30\xA5\xE5\xDE\x49\x72\xA7\x2A\x77\x06\x5D\x1D\xC4\x10\xB2\x77\x47\xCE\x54\xE9\x09\xB8\x4B\x3D\xAE\x62\x53\xB9\xD7\x53\x1A\x1B\xE3\x34\x57\x91\x18\xDD\x5F\x92\xB9\x96\x3D\xFF\x9A\x7A\x68\xAA\x8B\xD8\x70\xFF\x83\x29\x74\xB4\x1E\xC3\x0E\xE5\xAE\x19\x2E\x7F\x7E\xBE\xF4\xE7\x77\x2A\xD8\xFA\x15\x6A\x69\xD0\x59\x72\x58\xEB\xD7\xD8\x9A\x72\x3C\xAE\x19\xC1\x0E\xD2\x0C\xB7\xA3\xF5\x78\x23\xB7\xC4\x15\x2C\x2A\x13\x61\xB6\xA2\x83\xF5\x04\xA6\x37\xE3\x4A\x5A\x77\x07\xEB\x49\xCC\x6D\xC6\x0E\x8A\x11\xB9\x3D\x41\x9A\x07\xEB\x37\xA8\x91\x3B\xF5\x2C\xF1\x4F\x07\xEB\x29\x6C\x2D\xBB\x65\x88\xED\x20\x3A\x3A\x5A\x4F\xA3\x5E\xEA\x28\x92\xBA\x2E\x17\xA8\x23\x67\x92\xFC\x3A\x5A\xBF\x45\x83\xC4\xF7\x3B\x2A\x9C\x6E\x4F\x87\x40\xD0\x19\x74\x75\xE4\x4C\x72\x28\xEB\x77\x98\x43\x7D\xE5\x1C\xC5\x79\x7F\x2F\x8F\x63\x29\xF6\x0A\x67\xB0\xA8\xEC\x07\x3C\x92\xD8\x54\xA3\x0E\x49\xAA\x48\x92\x24\xAE\x1F\x50\x1F\x31\x0F\xBF\xE5\x36\x89\xE3\x7E\xF2\x94\x6E\x8A\x6B\xE6\x5F\xD4\xC4\x62\x8F\x9D\xE6\x75\x17\x77\x1C\xD0\x71\x80\xE9\x37\x19\x09\x3A\x27\x95\xFF\xE7\xF3\x17\x9B\x7E\xA5\xC7\xEB\x2F\x76\xF9\x5D\xE2\x24\xD3\x27\xE5\xC6\xE5\x6F\x39\x13\xFF\xE9\xBC\x8A\xA9\x37\x25\xD9\xCC\xCB\x35\xB5\xD2\x59\xEE\x08\x7A\x9B\x79\x07\xFD\x95\xAE\xDF\x2D\xAC\xF4\xD6\x7F\x67\x59\x5B\x2C\xD0\xEF\x54\xC5\x6F\xCA\xDA\x12\x54\xFE\x27\x0A\x25\xFE\xCB\xCF\x2F\x71\x7B\x8A\x63\xF2\xDB\xA1\xF1\x67\x54\xF4\xFC\x88\x89\x12\xAF\x83\xF5\x27\xDC\xC1\x34\xC5\xE8\x73\xBA\x2F\xD0\x1B\xFF\x47\x73\x19\x9F\xD0\x5F\x85\xFF\xED\x39\x53\x89\xB3\x3C\xE0\x8A\xA9\x81\xBF\x2C\x29\xEB\xCF\xF8\x93\x2A\xAE\x26\xFF\x7F\x05\x52\xCE\x24\x2A\xF0\x7F\xE3\xE9\xDF\x78\xFA\x37\x9E\x8A\x68\xE5\x70\xB8\x2A\xE4\x35\xB0\x4A\x8F\x7B\x6A\xA5\x94\xA4\xC3\xE9\x2F\x0D\xB4\x9C\x83\x7F\x13\x8A\x9A\x7E\x0B\xEC\xFF\x81\x5C\xB4\x6F\x6F\xFD\x05\x6F\xFA\x0F\x88\x90\x59\x62\x4A\x1D\xAC\xBF\xE2\x52\xE6\xFF\x10\x20\xE4\xE7\x7B\x7D\xB2\x0C\xE9\x60\xFD\xAD\x5C\x97\xFF\x9E\xC1\xAB\x7F\x37\xAA\xDF\x8D\x83\x33\x5D\x20\xD6\xB3\xB8\x32\xE1\x6F\x81\xF0\x9F\x6E\xFF\xBF\x05\xC2\x7F\x87\x40\xF0\xBB\xC4\xB4\x3B\x34\x5F\x42\x38\x27\xAF\x5B\xF9\x5D\xA5\xAE\x19\x8D\x67\x0A\xCE\xCB\x4B\x80\x32\x53\x9A\x63\x87\x31\xBD\xC8\x5B\xE1\x73\x97\x37\x5B\xF0\xB1\x46\x50\xE7\x77\x55\x06\x5C\x1D\xFC\xAE\x6E\xF9\xF9\x57\x0D\xEB\xD6\xD1\x5A\xC5\xBC\x9C\xF2\x3F\xA9\x44\xFE\x45\x4B\x46\x8D\x19\xFE\x17\x27\xE3\xFF\x86\xEC\xFD\x21\x54\xFC\x45\x79\xF8\xAF\x29\xB6\x34\xD4\xFE\x9D\x23\xFE\x2F\x4B\xEB\x4F\xE2\xE1\xFF\xF6\x06\xFD\xEB\x2B\xFA\xDF\xD5\x79\xFE\x49\xD0\xFF\xCB\x6B\x3B\x66\x51\xE5\x2F\x2A\xFB\x5F\xBB\xD1\x30\x87\xF9\x20\x35\x4E\x41\xFF\xFF\x54\xA8\xFC\x0B\x0B\x13\x7F\xCB\x96\xBF\x65\xCB\xDF\xB2\xE5\x6F\xD9\xF2\x5F\x29\x5B\x2E\xBC\xC0\xF4\x97\xF7\xB0\x38\x71\xF0\x97\x15\xF3\x2F\x15\x71\xFF\xFE\x02\xB5\x6F\x6F\x9D\xCB\x5C\xD4\x34\xB1\x13\xB5\x03\x87\xB3\xBC\x3C\x7A\x1E\x23\x50\x39\x49\x9A\xEB\xCD\x63\xBE\x54\xFD\x2D\xAD\xFE\x2B\xC1\xED\x6F\x69\xF5\xBF\xAC\x41\xFF\x96\x56\xFF\x2E\x69\xD5\xE2\xEA\xD7\x7C\x26\xD1\x1D\x70\x96\xFB\xCA\x9C\x0B\xC4\x5F\xD2\xF9\xCC\xDB\xC4\x5F\xD2\xB9\xCE\xDB\x19\x65\xB9\xB7\xB4\xAB\xFD\x0E\x46\x15\xF0\xF8\xFC\x6E\x4F\xB0\xC4\xB1\x90\x49\x76\x4C\x8B\xBA\x16\x31\x6A\x87\xB7\x32\xE8\x98\x54\x59\x52\xE2\xF2\xDF\xC9\xA8\x24\x97\xA7\xB2\xBC\x7C\x31\x93\xE2\xF0\x04\xBD\x4E\x7A\x9C\x79\x09\xA3\x74\x94\x04\xBD\xCE\xBB\x18\xA5\xC3\x15\xF4\x3A\x97\x32\x49\x52\x50\xBF\x6B\xDA\x32\x26\xB1\x44\x8E\xED\x6E\x26\xA1\x44\xBA\xEF\x70\x0F\xA3\x2C\xF1\x55\x06\x8B\xEE\x65\x94\xD2\x0D\xB7\xE5\x8C\x7C\x3E\x4E\xFC\x7D\x1F\x93\x20\x5F\x5A\xB8\x9F\x61\x4B\xFC\x2E\xD7\x03\x4C\x42\x91\xE4\x7E\x90\x49\xA4\xF7\x16\x1E\x62\x12\x02\x41\x7F\xD0\x5B\xFE\x30\x93\x50\xE1\xAA\x28\x2A\xF3\x3F\x22\xFF\xA8\xF0\xAD\x90\x7F\xF8\x66\x3E\xCA\x24\x56\xB8\x2A\x2A\xBC\xD3\x5C\x8F\x49\xAC\x80\x2B\xB8\x52\x7A\xAD\xDC\xE5\xA9\x66\x52\xA4\x1B\x04\x93\x9C\x01\x97\xB3\xB8\xF8\x71\x26\x35\xD6\x19\xF4\x3E\xC1\x68\x24\x46\xA0\xCC\xEB\x0F\x3A\x8B\x8B\x9F\xA4\x6E\x31\x80\xDB\x53\xE4\x5F\x15\xF3\x7E\xA0\x72\xD2\x53\x8C\x2E\xD6\x59\xE2\xF7\x56\xF0\xB1\x31\x54\x54\x96\x0B\x31\x6F\x54\x54\x96\xD7\xC4\x7A\x17\xBB\xA7\xD5\x32\xDA\x46\xEF\x62\xF7\xB4\x0A\x6F\x71\x28\x86\x23\xDF\x37\xAB\x8B\xE7\xF8\x9F\xA6\x9C\x68\x22\x8E\xA2\x67\x98\x56\x31\x77\x27\x8A\xBC\x9E\xA0\x6B\x46\xF0\x59\x26\x95\xDE\x9F\xA0\x8C\xD5\x8C\xA6\xC4\x13\x74\x14\x79\x3D\xD3\xBC\xE5\x95\x41\xD7\x1A\x26\x4D\x74\x3B\x2B\x83\xDE\x46\xDE\x5A\x86\x2D\xF2\x07\xBB\x3F\xC7\x24\x89\x5E\xC5\xEE\x92\x6E\xCF\x33\x89\x81\x60\xB1\xA3\xC4\x13\x5C\xC7\xA8\xC5\x5F\x6E\xCF\x34\xD1\xB5\x9E\xD1\x94\x78\x2B\xFD\x8E\x40\xD0\xE5\x13\xDD\x1B\x98\x34\xC9\x27\x96\xF7\x02\x23\xDD\xE9\x98\x1A\x70\x45\xAF\xF4\x6C\x64\x92\x45\x4E\xD0\xEB\x08\x14\xB9\x5F\xA4\x0D\x20\xBA\x24\xDF\x97\x98\xD4\xE9\x5E\x7F\x0C\x63\x13\xA3\x12\x03\x48\xAD\xBF\x59\x7E\x55\xEE\x14\x5B\x18\xE9\x72\x08\xED\x18\x5B\x99\x14\xB9\x42\xE4\x90\xDB\x98\x24\x29\x59\x8F\x6B\x7A\x3D\x93\x26\xF9\x4C\x77\x4B\x27\xBE\xBC\x8E\xE2\x99\x9E\xED\x72\xAE\xE8\xBB\x22\xE7\x65\x99\x23\xA5\x2D\x5D\x1E\x08\xBC\x22\x27\x56\x11\x10\x79\xAF\xCA\x35\xE9\x0E\xB8\x3D\x25\x6E\x8F\x3B\xE8\x7A\x4D\xCE\x96\x3B\xE0\x71\x7A\x76\x44\x3D\xA5\xDB\x83\xEE\x69\xAE\xD7\xE5\x57\xDD\x81\xA9\x1E\xA7\xE7\x0D\x46\x23\x3B\x02\x3E\x57\x91\xDB\x59\xFE\x66\xD4\xF3\x26\x97\xDF\xFB\x96\x9C\x4F\x71\xDC\xBE\x2D\x87\xAB\x74\x7B\x82\x0E\xD1\xEB\x1D\x26\x91\xDE\x75\xD9\x29\x97\x74\xAA\xDF\x15\x70\xDF\xE4\x7A\x57\x0E\x17\x70\x05\xE5\x7C\xEE\xA2\x25\x77\x05\x1D\x62\x72\xBB\x19\x5D\xD4\x19\xCD\xCE\x7B\x4D\x2C\x9F\x57\x3E\x2E\xFB\x3E\x93\x1E\x65\x15\xCF\xF4\x38\x2B\xDC\x45\xD2\x3D\xBF\x0F\x1A\xE3\x76\x94\x94\x3B\x4B\x03\x7B\x64\xB7\x98\x9D\x22\xAF\xAB\xA4\x64\xAF\xEC\x9E\x2A\xF5\x28\x57\x49\xC9\x3E\xB9\xD6\x44\xF0\x2A\x97\x42\x05\xF6\x47\x4B\x4B\xAF\x7E\x7D\xC8\x24\x3B\x1A\x19\x1F\xC9\x15\x15\x70\x05\x69\x5D\x1C\x68\xCC\xBB\x74\x79\xEE\x60\xB4\xB3\x48\xBD\x45\x2C\xEC\x21\x9A\x60\x89\xDB\xE3\x2C\x77\xDF\xE4\xFA\x98\x8E\xA6\x12\xF7\x0C\x87\xC7\xE9\xF9\x84\x76\x9F\xA2\x32\x57\xD1\x14\x87\x6B\x86\xEF\x53\xA6\xB5\x1C\x83\x34\x4C\x1C\x6E\x8F\xA4\xC6\x37\x30\xC9\x62\x1A\x41\xBF\xDB\x57\xEE\x3A\x2C\xA7\x29\xF5\x48\x77\xF7\x6E\x47\x68\x14\x53\x4B\x5D\x41\xA9\xF2\x3F\x8B\xFA\xCB\x71\x7C\x4E\x9D\xA5\x72\xF0\x2F\xE4\x76\x9F\x5A\xE4\xF5\xCD\x3C\x4A\xDB\x45\x1E\xA5\x5F\x32\x99\x52\x44\x4E\x9F\xAF\x7C\xA6\x7C\x1B\xD6\xE1\x9A\x51\xE4\x0A\x04\xFE\x1F\x7B\x4F\x02\x1D\x47\x71\x25\x72\x55\x2F\x90\x65\x09\xF8\xB1\x49\x36\x84\x8D\xB3\x81\xA1\x6B\x00\xC7\x92\x70\x30\x8A\xD0\x46\x96\x2C\xAC\x87\x2D\x0B\x49\xB6\xF7\x3D\x96\x9D\xB4\xA6\x4B\x52\xA3\x56\x77\xBB\x0F\x4B\xF2\xDB\xD5\x02\xE6\x32\xA7\x31\xF7\x65\xAE\x70\xDF\xF7\x95\x40\xC8\x26\xE4\x20\x77\xC8\x7D\x93\x64\xC3\x7D\x87\xFB\xD8\xD7\x55\xD5\x57\x75\x75\x4F\x8F\xED\x91\xDF\x12\x9E\xDF\x93\x67\xAA\xFE\xAF\x7F\xF4\xAF\x5F\xBF\x7F\xFD\xAA\x79\x82\x19\x63\x75\xC2\x7A\x72\xCE\x4E\x94\xE1\x09\xEB\xA9\x39\x7B\x04\x1F\x2B\x8E\x32\x81\x2B\x8A\x7A\x14\x9E\xB2\x9E\x66\x12\x92\x63\x94\x86\xFA\x4C\x9C\x86\xFD\x2C\x1B\x49\x31\xD4\xE7\x82\x91\x14\xEB\x79\x6A\x29\x6B\x4C\xFB\x05\x86\xBC\x46\x51\x55\xC7\x1B\x7E\x31\x8E\x6C\xBC\xC4\x90\xA7\x4C\xFB\xE5\x60\x9C\x61\xE7\x15\x6A\x8E\x6B\xC8\xE1\xDB\xBF\x32\xE9\x2C\xDD\x73\x5E\x0D\x60\x54\xF5\x35\xF6\xD1\xF1\x86\x5F\x67\x1F\x55\x6D\xED\x1B\x73\x76\xAE\x04\x9F\xDF\x9C\xB3\x7B\xE8\xA2\x2A\x06\x75\x64\x6F\x05\xCC\xD0\xAF\x6F\x07\xE0\x13\x9E\xFE\x0E\x53\xBA\xEF\xBA\x5A\x2A\x3A\x6E\x79\x97\x75\x8E\x4F\x78\xFA\x7B\x73\xFE\x9E\x3E\x63\xC3\x77\x6D\x47\x83\x7F\x08\x7B\xFC\xA6\x63\xC0\x4E\xC1\x28\xC7\x02\xAA\xF1\x35\x54\xD9\xAE\x49\xCF\x1B\xDA\x8A\xBE\x9E\x01\xD9\x78\xE2\x38\xF0\xE1\x90\x6C\x05\x4F\x29\x55\xF7\x78\xB0\x7B\x0A\xEB\x04\x30\x37\xD5\x36\x75\x22\xA0\xAA\x71\x6D\xCF\xA8\x9E\xC4\xBE\x90\x53\xCC\x1B\x00\xB3\x02\xAC\xE9\x27\x03\x6A\xD4\xDA\x3A\xAC\x19\xBE\xFC\xA7\x00\x6A\xC5\x78\x8A\x1C\x7A\xF5\x9A\x3F\x7B\x2A\x6B\x61\xC7\x60\xBD\xE6\xCF\x9E\x06\xA2\x55\xA1\x3A\x61\x9D\x0E\x76\xA5\x02\x4E\x9A\xF6\xB8\x3F\xD2\x19\x7E\x83\x62\x2B\xAE\xE3\x0D\xFB\xEF\x34\xD5\x8D\x60\x6E\xB2\xC1\xD7\xC5\x99\x60\xD7\xC0\x56\xC6\xB1\x6D\x60\x7D\x13\xD8\x23\x3C\x4C\xE7\x03\x54\x2C\xC5\x56\x26\x9C\xB3\xC0\xEE\x51\xF3\x64\x2B\x79\xDF\x39\x1B\xEC\xE2\x68\x53\xA1\x9F\x3E\x07\xEC\xE6\xFB\xEE\x78\xD3\xB9\x60\x57\x52\x0A\x6D\x99\x0E\xAE\x58\xE6\x64\xCB\x79\x60\x37\x67\x8D\xA7\xD8\x98\x34\x93\xA6\xF3\xC1\x5C\x67\x92\xBC\xA3\xE8\x23\xB6\x39\x49\x1B\x2F\x00\xFB\xC4\xC3\x22\x03\x4F\xB9\x15\xCB\xD6\x26\x30\x17\xA1\x5C\x08\xF6\x0C\x76\xBE\xE7\x19\x78\x92\xEB\xBD\x08\x7C\x24\xEC\x55\xB1\x8E\x5D\x2C\x93\xBC\x23\xBA\x18\xEC\x15\x47\x3B\xE2\x48\x0E\xF1\x12\xF0\x31\x0E\xF1\x88\x23\x19\xEA\x66\x30\xB7\x52\xA9\x4E\x29\x15\xCB\xB3\x71\x65\xAD\x66\xBB\x9E\xA2\x5F\x0A\x1E\x6E\x6A\x48\xA8\x96\x1C\xAC\xB1\x49\xE5\xCB\xC0\x83\x8D\x12\x22\x50\xE6\x21\x8D\x95\xE0\x72\x60\x37\x48\x00\xBA\x6E\xCA\x5C\x01\xBF\xDF\x8D\xAE\x68\x18\x51\x7A\xF6\x44\x48\xF4\x4A\x30\xDD\x58\xA2\xD5\xEC\xB2\xFA\x2F\x82\xA3\x66\x8D\x36\xBA\x0A\x8C\x34\x88\x18\x39\x71\x3C\xAC\x54\xC7\x09\x3D\x74\x35\x38\xAE\x51\xD6\x5F\xA9\x28\x8E\xAF\xC0\x0A\x9E\x72\xB1\x6D\x28\x7A\x9E\x76\xAF\x69\xDC\x93\x25\x4C\xE4\xD1\xBE\xB6\x71\x4F\x36\x45\x1B\x5D\x07\x36\x37\x4A\xE1\xEC\x44\x1D\x3F\x73\x04\x13\x29\x43\x11\xB4\xF9\x7A\xA0\xF8\x3E\x3F\x91\x0E\x71\x4C\xDB\x4D\xBC\xB1\xEB\xD8\x71\xDA\x35\xC3\xDD\x7F\x9E\x66\xB8\x1D\x25\xF2\x5F\xB9\x43\xF6\xFF\xD2\xCF\xC9\x74\x0A\x07\x8E\x6E\x00\xFF\x19\x92\xD6\x0C\x37\x45\x6B\x61\xBD\xC4\xD2\x7F\xF3\xC8\xDF\x08\xD6\x0E\x9B\xA6\x9E\x80\xA1\x07\x55\x34\xD3\x20\x0C\x54\x34\xC3\x57\xA7\xBF\x06\x6E\x4B\xB9\x6F\x02\x3D\xF1\x6E\xFF\x7D\xAC\x62\x1A\x55\xEE\x99\xCD\x5B\x6B\xEA\x8A\xAB\xE9\xB8\xC4\x76\x0C\xE9\x7F\xF3\xE4\x32\x62\xCB\x31\xBA\x19\xEC\x43\xB2\x19\x8B\x35\x77\xD0\x55\x5C\xDC\xD6\xD6\xEF\x39\x63\x32\x21\x15\x37\xB7\x5B\x40\x99\x83\x1B\xB2\xA7\x07\xB1\x62\x57\x05\xC0\xB7\x82\x71\x0E\x98\x41\x92\xD6\x41\x62\xA5\xFD\x1A\xAE\xE2\x30\x5B\x9D\xD9\xE1\xAB\x37\xF8\xCB\x03\x51\x4D\xA1\xDB\xC0\xA9\x4D\xA4\xAB\xDF\x36\x47\x03\x52\x01\xE9\x2D\x20\x19\x1B\xAB\xD3\xA8\x8E\x99\x76\xA2\x69\xB9\xE2\x56\xC7\x0E\xD3\x0C\x35\x93\x9F\xDB\xC1\x5E\xA4\xA7\x8B\x96\x34\xD9\x6D\x6D\x9D\xFE\x1C\xEB\x35\x1C\x72\xD2\x09\xDD\x01\x3E\xCE\xF5\xCF\x04\x1F\x65\x74\x27\x40\x34\xBB\x84\x47\xF1\x94\xD5\xD6\xB6\x5A\xD1\xC7\xB1\xDD\x4E\xDA\x7A\x6C\x65\xB4\xA3\xAD\x6D\x86\xB6\xC9\xE8\xAE\xBC\x81\xEE\x06\x32\xD7\xD9\xA5\xB8\x72\x38\x0E\xE3\xDE\xFF\x88\xEE\x01\x7B\x73\xA0\x83\xAE\x62\xC7\x61\x7D\xFD\xA3\x7B\x99\xA9\x44\x60\x87\x7B\xD8\x71\x53\x70\xF7\x81\x3D\x38\xB8\x3E\xD3\x92\xD1\xFD\x29\x86\x16\x4F\xBB\x78\x80\x1C\xC2\x0A\x2C\x9B\x8D\xF0\x00\xF8\x27\x0E\x94\x68\x9D\x68\xEF\x4B\x60\x5F\xAE\x6F\xC9\x84\xE5\x4E\xAF\xD6\x54\x97\xD9\x17\xF9\xBE\xC2\x42\x5F\x06\xA5\x94\x06\x2C\xD7\xB3\x71\x9C\x63\x7F\xC8\x07\xC1\x9E\x3C\x67\x78\x54\x33\x28\x6B\xE8\x21\xD0\xC7\xF5\xAE\x34\x48\x59\x9D\x3A\xE0\x19\xD8\x97\x61\x90\x9C\xA7\x8F\xA6\x1E\xF5\xBF\xDC\x57\x6A\xC2\x3E\xB9\xAF\x80\x7B\xA5\x54\xD2\x72\x2B\xCA\x0D\x92\x53\x9E\x3A\x67\xDF\x4B\x6C\x5D\xE9\x59\xF6\xA8\x35\xF7\x49\x44\xA8\x5B\x4B\x8A\xA4\x97\xD3\x80\xE2\x74\xB7\x10\xAE\xE0\x9E\x40\x23\x98\xCF\x67\xAC\x88\x90\x5B\x98\xFF\xCE\x62\x2E\x56\xC0\x23\x20\x27\xA7\xDB\x82\x57\x84\x87\xC1\xDD\x3B\x66\xEE\x2C\xCE\x86\x29\x6F\x45\xC1\xCB\x07\x16\xFD\xBE\xB7\xE8\xEC\xB2\x81\x7C\x25\x58\xFE\xF2\x3D\xA9\x39\xB8\x42\xEC\xDC\xF6\xAA\x6E\xC5\x15\x6C\xA5\xBB\x9E\xA5\x8B\x78\x60\xA0\x1D\x69\xD8\x8E\x79\x39\xD3\xA9\x11\x2C\x94\x04\xD0\x1D\xA5\x12\xFA\x2A\xD8\x8F\x8F\x4A\x54\x95\xAE\x5C\x03\xB8\xEA\xD9\x8E\xB6\x36\x5A\x87\xD1\xFF\xA4\xD6\xCE\x1E\xCD\x50\xD3\x0B\x36\xFA\x5A\x6A\x39\x0E\x81\x96\xF8\x36\x12\x41\x7E\x5D\xC4\x80\xBF\x84\x0A\x43\x80\x47\xC0\x67\x72\xA0\x57\x0E\xF5\x2C\xE2\x31\xBE\x01\x9A\x73\x30\x96\x29\xAE\x66\x34\xF3\x38\xDF\x04\xFF\x9C\xC6\xA9\x2C\x5A\x50\x69\x5E\x30\x32\x32\x32\x22\xA3\x6F\xA5\x00\xBA\x4C\x6B\x3A\x0A\x20\xD0\xB7\x41\x0B\x1F\x3B\x8D\x99\xB6\xBB\x4A\x73\x34\x16\x19\xD1\x48\xAE\x1C\x0F\xB8\x1E\x05\x07\x71\x48\xFD\x36\xCE\x45\xA1\xFC\x96\xD1\x77\xC0\xA7\x38\xCC\x65\xF4\x06\x34\x39\x12\xEA\xBB\x60\x39\x3F\xBA\xE9\xE4\x73\x24\xFE\xC8\xE2\xD9\xEF\x81\x85\x29\x1D\xD0\x62\xFD\xE4\x68\x34\xC2\x09\x0D\x12\x7D\x9F\xD9\x50\xAF\x43\xC3\x68\x3F\xA8\x4C\x72\xC0\x08\xFC\x80\xC5\x9F\x01\xE0\x12\x43\x15\x81\xFD\x10\x1C\x56\x2B\x34\xF6\x9B\x7A\x0D\x96\x25\xC8\x55\x25\xFA\x11\xF8\x18\x27\x55\xB7\xE9\x92\xB8\x17\xFD\x18\x7C\x3A\x6D\xFC\x9A\x33\x96\x18\x11\x3D\xC6\xC2\xE1\x80\x1D\x06\x3D\x64\xFA\xEF\x09\x72\xA4\x86\x9F\x80\xFD\xC5\x70\x03\x78\x2D\xB6\x1D\xCC\x81\xFF\x14\xB8\x71\xFF\xA7\x62\xDF\x8D\x0D\x2B\x0E\xA6\x82\xFA\x12\x92\x17\x9B\x98\xDC\x62\x2F\x9A\x09\xCE\x4E\x8B\xC5\xC7\x96\xD1\xCF\xEA\x78\xEF\xF8\x39\x58\x5A\x0B\xB6\xA8\x3D\xFF\x02\xFC\x47\xCD\xA1\xB6\xCA\x78\x7F\xC9\xFC\x48\x0E\x01\x6E\x46\xFF\x0A\xDC\x04\x3F\x88\x2E\x3E\x88\x2E\x44\xD1\x85\xB0\xCC\xE3\xD7\xC0\x89\xC6\x24\x73\x6A\x1B\x4F\xD5\x0A\xB9\x3F\x68\x58\xA9\x8E\x57\xAA\x8A\xA5\x54\x35\x77\x5A\x46\xBF\x01\x67\x34\x25\xB2\x5D\x96\xAE\x05\xB5\x22\xD9\x03\x96\xEB\x64\xA0\xCC\xE5\x7A\xB3\x01\x4B\x25\xF4\x5B\xB0\x71\x76\x59\x1A\xB1\x4D\xC3\xCD\xE7\xE9\x77\xB3\xA4\xA6\x52\x71\x35\xFD\x1E\x9C\x33\xBB\x2C\xD5\x52\x53\xF0\x72\xF7\x07\xD0\x46\x5A\xBB\x7B\x3A\xC9\x1F\x39\x4C\x7B\x95\xB3\x52\x60\xD1\xBA\xF5\x38\xD8\x2D\x42\x9E\xF1\xB1\xD1\x1F\x59\xE6\x84\x34\xAD\x36\xED\xF1\x35\x43\x66\x17\xC9\x9C\xC4\x52\x73\x51\x67\x40\x24\xD1\x12\xCF\xEE\xA2\x3F\x81\xF9\x11\x44\x7C\xA4\x30\x6D\xCA\x21\xFC\x19\xBC\xD6\x54\xEF\xFB\x69\x44\x61\x90\x5D\x0D\x54\x2B\x8D\x92\xC6\xE0\x5A\x96\x2A\xCE\x58\xAA\x91\x84\xC7\x39\x0F\x35\x36\x60\xF4\xB6\x9E\xEA\x91\xF9\x96\xF0\xCE\x2E\xF0\x18\x7F\x8F\xC9\xB6\xD3\x44\x8D\xB7\xF0\xD9\x51\x48\xF6\xCB\x5E\x4D\xFA\x81\x96\x32\xD5\x97\x89\x81\xFE\x02\x16\x90\xAE\x41\x72\x8B\xD4\x20\x76\x87\xDA\x7D\xAD\x74\xB4\xB5\xF5\x92\xC4\x7F\x18\x7E\x46\x09\xBF\x27\xC0\xC1\xD1\x68\x9D\xAA\x3A\x64\x1E\xEE\x61\x4F\x64\xFF\x69\x0B\x7E\x12\xAC\x8A\xC0\x06\x3C\x83\x40\xAE\x30\xFC\x97\xAC\x42\xF3\x27\x35\x62\x10\x79\x3D\xC5\x02\xA3\x60\x60\x22\x65\x6A\xE0\x40\x7F\x3E\x2B\x4F\xB3\x10\x91\x62\x60\x07\xBB\x64\x0A\xC6\xA0\x07\x56\x2F\x33\xAB\xE3\xD8\x2E\xA3\x67\x58\xD0\x4B\x07\x21\x19\xF9\x9E\x9E\x1E\x99\x6F\xEB\x27\xC5\x11\x65\xF4\x2C\xE8\x23\xFB\x28\x51\x7F\xAF\xA1\x6B\x06\x56\x29\xD8\x32\xD3\xB4\xDA\xC9\xC5\x35\xEC\xFE\x9A\xF0\x1A\x9B\xAC\x01\x9F\x13\xD1\x1F\xCA\x04\x7F\x1E\x2C\xAF\x93\x3E\x09\x30\x32\xC7\x7B\x41\x40\x7E\x28\x5B\xFC\x17\x8B\x93\xF7\xE9\xD6\x94\xFE\x25\x11\xF9\x6C\xE9\x5F\x06\xCB\xEA\x23\x9F\x2F\xFC\x2B\x69\xEA\x43\x39\xCF\xFE\xAF\x05\x84\x8F\x49\x5D\x53\xF8\x57\x45\xE4\xB3\x85\x7F\xAD\x80\xF0\x09\xF2\xF9\xC2\xBF\x2E\xA0\x9E\xF3\xE4\xDF\x28\x4C\xBD\xD0\x83\x7F\x53\x44\x3D\x5B\xF6\xB7\xC0\x61\x75\x51\xCF\x17\xFD\x6D\xE6\x19\xA9\x9B\x33\x14\x7D\x7A\x1D\x8E\xEF\xFB\x09\x50\xDE\x01\xC7\x34\xF1\x7D\x5B\xB9\x49\x18\xFD\x2D\x27\x36\x25\x03\xEF\xC8\xFB\xED\x32\x7A\x97\xA5\xB0\x68\x70\x73\x28\x76\x13\xA1\x4F\x2C\xDC\x41\xEF\x81\xC9\xD4\x8E\x76\xB8\xF5\x5A\xB1\x6C\x73\x6A\xBA\x9D\xCF\xBD\x15\x1C\xBA\xAD\x6D\xEF\xCA\x82\x52\x7C\xF7\xB1\x5C\x2A\x75\xCC\xEB\x60\xFB\xB4\x47\xC3\x86\x52\x6E\xCE\xA6\x7C\x4C\x63\x29\xB7\x64\x53\x3E\x16\x7E\x32\x86\xD6\x4D\xEA\xC8\xC2\xB1\xBA\x7B\x3A\xCB\x68\x3D\xBC\x3C\xBD\xF3\x1B\x82\xCC\xDA\xA6\x2F\x33\xB6\x0C\xF3\x3A\x0E\xCA\x19\x01\x43\xD5\xC6\x8A\x8B\xE9\xD5\xE3\x64\x6F\xF3\x78\x78\x76\x3A\x5C\x9D\xDD\x90\x4A\xF8\x86\x7B\x02\xA4\xFB\xB1\x7D\x3E\x78\x5F\xE2\xC5\x00\x9D\x08\xE3\xF1\x50\xA7\x6D\x2B\xD3\xED\x11\xF0\xD0\x98\x8D\x15\xB5\x1C\x95\x80\xF9\x62\x9E\x04\x77\x8B\x20\x66\xFC\xF1\xD0\x06\xA8\xE4\x65\xBD\x62\x63\xE5\x48\x13\x83\x12\xA5\xB8\x4E\x86\xFF\x1D\x81\x91\x30\x8C\xC2\xAE\x91\x0B\x08\x10\x84\x52\xE4\x4F\xA6\x15\x25\x6A\x62\x52\x83\xA0\x53\xE0\x17\x84\x99\x82\x2D\x13\x4F\x98\x16\x38\x15\x1E\xDF\x14\x41\x0F\xBA\xD8\x2A\x28\x5D\x1D\x3A\x28\x22\x3E\x3A\x0D\x8E\xC4\xF8\x68\x60\xF9\xC7\xE9\xB0\x25\x36\x53\xFB\xC9\xAD\xF7\x9D\xD5\x2A\xD6\x89\x1B\xC9\xA8\x50\x3A\x03\x9E\x98\xF6\x1C\x7D\xB3\xEE\x39\x7C\xFE\x37\xC2\x83\x53\xBA\xD7\x0C\xB7\xC3\xE7\x4A\xF0\x36\x41\xFE\x04\x2F\x23\x67\xC2\xF4\xD3\xA5\xB8\x29\xDF\xB2\x09\x7E\x2E\x9B\xCC\x92\x29\xCD\x71\x35\x63\x34\x24\xC7\x13\x3A\x0B\xBA\xF9\x29\x8B\xB8\xA1\x14\xB3\x61\x61\x6A\x29\xDE\x5F\x2A\xA1\xB3\xA1\xD7\x40\xB2\xB1\xBC\x08\x47\xF7\x9C\x46\x88\x2B\x48\x11\x71\x64\xCF\x85\xEB\x1A\x48\x36\x43\xDC\xE0\x11\x9F\x07\x4F\x49\x4F\x89\x15\x06\xEE\x57\x1C\x67\x3B\x4C\x8B\xF3\xE1\x47\x62\xF0\xBD\x4E\xC0\x09\xBA\x00\xC6\x0B\x1F\xD9\xD5\xDF\x5C\xB1\x8D\x48\x33\x09\x10\x62\x04\xEC\x4A\xE9\xB8\xCA\x27\x6D\xC5\x22\x69\x91\x24\x38\xF3\x22\x1D\xA9\x22\x48\x01\x54\x09\x5D\x08\x37\x25\x96\x71\xD7\xC6\xCC\xD1\x87\xDB\x91\xC1\x19\xC2\x70\x7B\x12\x3B\x4E\xCE\x03\x0D\xE1\x08\xDF\x2A\x76\x5C\xDB\x9C\x96\x79\x1A\xB1\xAC\x4D\x8C\x10\xCB\xD9\xA0\x8B\x20\xDD\x1F\x0D\x76\x42\xFA\x49\x38\x12\xD5\xFC\xD1\xF6\xE4\x1E\xD7\xC5\x70\x69\x26\xCE\x72\x65\x7A\x18\x77\x91\x9F\x64\xA1\x4F\x4F\x8E\x16\x87\x04\x7C\x8F\xAE\x8C\x3A\xE8\x12\xF8\x51\xD2\xD5\x35\x5D\xD5\x71\x8F\xA9\x93\xAD\x59\xE2\x99\x36\x43\x94\xCB\x58\x6C\x87\x13\x5D\x0A\x0F\xCC\x85\x1D\xD4\x26\x2C\x1D\xAF\x48\x88\xB1\xC2\x42\x97\xC1\x7F\xC9\x45\xEB\x36\x5D\x19\x5D\x0E\x07\x6B\x28\xC8\xC2\x8A\xCB\x8F\x5D\x63\xF1\x42\x57\x30\xF7\xEE\x63\xBB\x9A\xAB\x99\x06\xDD\x82\xCA\xDC\x23\x8B\xE5\x68\xAE\x84\x5D\x59\xB8\x19\x9B\x62\x51\x8C\x12\xA6\x44\xD1\x17\x43\x9D\xF1\xA3\x64\x6E\x55\xFB\x68\x57\xC1\xFE\x9A\xEA\xA0\xC3\xC9\x05\x22\x23\xA2\x8B\xAB\xE1\xBF\x26\x86\x64\x9B\x71\x74\x19\xCA\xD9\xBB\x8D\xF6\xB6\xAF\x81\x9F\xCE\x1E\x21\xDC\xA0\xBC\x16\x8E\x15\xDB\x43\xE5\x37\x9E\x32\xF3\xEA\xD1\x26\x10\x17\x54\x5E\x07\x0F\xC9\xD4\x52\xB7\xB9\x0C\x8F\xB8\xFD\x8A\x8D\x8D\x2C\x07\x8A\xAE\x87\x72\x0E\xFE\x2A\x6C\xBB\x5A\x55\xD1\x17\x2B\xB6\x8C\x6E\x60\x81\x8E\x18\xB4\xCB\xD4\x75\xC5\x72\x30\x67\xF9\x37\xC2\x7D\x73\x90\x06\xB4\xD1\x31\xC6\x20\xBA\x89\x53\x6D\x12\x92\xED\x80\xA3\x9B\x61\x6B\x02\x6A\x80\xFC\x88\xC5\x32\xAC\xA8\x9A\x31\xCA\xFC\x40\xDA\x96\x6E\x81\xC9\xAD\xFB\x1E\xC5\xF7\xDA\x9D\x3A\x79\xDA\xC4\x84\xE2\x38\x89\x38\x53\xE0\x4A\x6E\x85\x1B\x9A\xB8\x77\x52\xB6\x0C\x10\x8C\x1E\x5B\x99\xC0\x39\x4F\x95\xF4\x73\x19\x64\x12\x45\x3B\xBA\x39\x49\x7E\x8E\xA3\x3D\xC1\x0D\x2D\xCE\x0E\x72\xC5\x5C\x2B\xBA\x0D\x6E\xA2\xCB\x66\x4A\xA6\xDE\x09\x4B\x6F\x6B\x1B\x30\x3D\x43\x6D\xA9\x47\xBE\xFD\x33\xE4\x1A\xB4\x74\xAD\x9A\x27\x18\x05\x20\x3F\xF3\x70\x7B\x11\xAE\x5A\x67\x9B\xAB\x3B\x8A\x70\xD5\x3C\xDB\x5C\xDD\x09\xE9\xB6\x57\xA7\xAA\xFA\xEB\x12\x56\x69\x41\x12\x5D\xAD\xC6\x14\xBB\x4B\x57\x1C\x67\xB1\xA7\xE9\x2A\xF9\x95\x89\x84\x8B\x45\x77\xC1\x43\x85\x80\xB4\xFA\xC8\x1F\x88\xF0\xC9\xBB\x48\x81\x55\xDF\x0D\x0D\x1A\xF0\xF8\x4D\x2B\xE9\xCF\x3A\x1D\x6A\x9B\x9E\x95\xF2\x1D\xE5\x1C\x75\x64\x71\x1D\x43\xF0\xE7\xB4\xE7\x94\xD1\x3D\xCC\x75\xF5\x3A\xAB\x14\x5D\x53\x49\x4D\x55\x7E\x38\x97\xC4\xBF\x17\xFE\x5B\xA0\xB7\x95\x31\x46\xB3\x88\x53\x98\xF0\x7D\x2C\x57\x17\xF7\xB1\x85\x2F\xC6\xC9\x90\x19\x04\x0C\x65\x61\xCC\x28\x60\xF0\x7E\x68\x66\xAF\x60\xFE\xE7\xAE\x2E\x9F\x59\xA5\xEA\x62\x5B\xA4\x64\x31\xAD\x3C\x95\x3C\x00\x17\x47\xCF\x70\x09\xFD\xC9\x9C\xFC\x81\x13\xF8\xD4\xA4\xBE\x04\x8F\xAC\xC1\x76\xA0\xE1\x1A\x96\x51\x16\xAB\xE5\xCB\xCC\xDE\x33\xC7\xEF\xC7\xB6\x4E\xAD\x36\x35\x3E\x7A\x90\xA5\x7B\x98\xD1\xB0\x8A\xFA\x3E\x65\x22\xF3\xA4\x05\x7A\x88\xD9\x49\x82\x5E\x21\x4B\x13\x98\x76\x52\x94\xAF\xC0\x72\xA4\xEF\x5E\x7A\xDE\x3D\x4B\xE1\xE8\x61\x06\x9C\x8E\x83\x66\xF8\x26\x19\x7D\x35\x2F\xD0\x20\x15\x43\xA4\x4C\xB2\x50\x38\xF2\x35\xD8\x9E\x0D\x55\x3B\x0A\xFC\x3A\xEC\xC9\x41\xAF\x23\x10\x7C\x04\x8E\xD6\x28\x54\xD9\x82\x78\x48\x98\x85\xFA\x06\xFC\xAF\xA2\x15\x0E\xFE\x48\xC5\x6A\x1B\x08\x64\x7E\x3D\x0A\x01\x29\x95\xD0\x37\xE1\x4C\xC3\xE9\x0B\xAB\x2A\x02\x06\xBE\xD5\x38\x05\xE4\x56\x9A\x04\xF4\xBF\x0D\xD7\x17\xAE\x31\xD9\x62\x06\xB2\x35\x10\x4C\xFD\x47\xD9\xAB\x07\x7B\x89\x37\x1C\xD7\xFF\xAB\xB9\x9D\xBA\x2B\x27\x37\xA5\x13\x9B\xDE\xDF\x61\xB9\x2A\x1E\x4D\x74\x60\x28\x8D\xFD\x5D\xF8\x19\x21\x76\x70\xFA\x27\x8D\xF1\xBD\x0C\x7A\x19\x27\x8B\x38\xEC\xEF\x27\xF6\x29\x22\xEC\xE8\xCC\xD2\x0F\x60\x49\x08\xD1\x67\x5A\x09\x35\xA0\x1F\xC2\x3D\x85\x80\x3D\x8A\xA6\xCB\xE8\x47\x70\xF7\x58\x2F\xA9\x1B\x45\x3F\x86\x73\x63\x6D\x33\xB4\xF1\x31\xF8\x8F\xB1\xC6\x15\x96\xAB\x4D\x68\xEB\xB0\x8C\x7E\x92\x90\x93\x48\x23\xF6\xF3\xC2\x8C\xEE\x4F\x99\xB3\xF3\x9F\xC2\x72\xC5\x0A\x03\x9D\xE5\x8A\x3D\x1E\x95\x79\xFF\x0C\x7E\x42\x0C\x85\xED\x51\x2C\xA3\x9F\xC3\x4F\x09\xBB\x07\x70\xD5\xD4\x4D\x9B\xA8\xEB\x17\x6C\x8D\xE1\x61\xC8\x87\xE4\x31\xAB\xC0\xB7\xFF\x32\xA1\xB8\x2E\x73\xC2\xF2\x5C\xCC\xF0\x65\xF4\x2B\xB8\x47\xAC\xB7\x47\x57\x5C\xD7\x7F\xE3\xF9\x35\xBC\x62\x4E\xAC\xDD\x97\x63\xD0\xAB\x56\xB1\xE3\x98\xB6\x23\x4E\xAC\x8A\x12\xE5\xA9\xF9\x93\xFA\x39\x3A\xD6\x40\x74\x24\x9A\x66\xD4\x9B\xD6\x2A\x57\x2C\x36\x8A\xFF\x2F\x73\x33\x4A\xC0\x65\x8D\xE1\xCA\xE8\x37\x2C\x8A\x4A\x27\x8E\x75\xEC\x64\xA8\xC9\xB7\x5A\x15\x4F\xAD\x52\x74\x8F\x4F\x15\xD6\x86\x44\xBF\x85\x0F\xCD\x11\x9F\x1C\x26\xBB\xD5\x72\xB9\x84\x1A\x41\xB6\x00\x68\x50\x6F\x95\x0B\x53\x64\x1C\xBA\xB6\x37\x4C\x14\xF4\x3B\x78\x35\x6F\xDA\xDD\x26\xF9\x9D\x4C\x3A\xC7\xB2\xCD\xF8\x6F\xCD\xBC\x7F\x0F\x1F\x69\x4A\x38\x45\xCD\x5D\xA6\xD1\x93\xBA\x75\x28\x83\xF3\xDA\x39\xAB\x69\x04\xB4\xAD\x25\xF9\x03\xD4\xD3\x3E\x70\xA9\x66\xB8\x8E\xBC\x0D\xF9\x0D\x1D\xFD\xE3\xF0\xB4\xA6\xD9\xA4\x47\xEA\x14\x12\xBF\xD4\x12\x76\x51\xB3\xFF\x23\xCB\x2E\xA6\x36\x02\x2B\x3D\x7E\xA0\xD2\x69\xA8\x8B\xFD\x88\x29\x67\x57\xF0\x4F\x70\x23\xC8\xBD\x4E\xE0\xC0\xF7\x93\x07\xFA\xFF\xE1\xC9\xFE\x0C\x1F\x4D\x2F\x06\xDC\x1D\x0B\xAD\xEF\xA7\xC7\xD2\x58\x75\xFE\x2F\x7C\x6C\x4E\x1D\x57\x56\x7C\xA0\xD7\x82\x7A\xFD\x0B\xEC\xA4\x2F\xE0\x4B\x5A\x68\xC8\x5E\x2B\xC1\xE1\xC3\xF9\x91\xB9\x69\x38\xC1\x20\x4F\xC0\xF5\x7C\x5E\xBB\x60\xAD\xD5\xD6\x50\x65\x95\x67\x51\xDD\xD5\x93\xF0\xF3\x11\xF0\xC0\x92\x96\x2D\x18\xF3\x29\xB8\x57\x6C\x88\xD8\x39\x37\xE6\xAA\x9F\x86\xF6\x56\x08\x2A\x18\x30\x59\xC4\x36\xB0\xA4\x85\x79\xF8\xB8\x5C\xCF\xB0\xB2\x23\x32\xC6\x8C\x2F\x18\x7A\x16\xAE\xFF\xBB\xD4\x4E\x6D\xBC\xA1\xF1\x77\xC9\xA6\xCF\x88\x4D\x28\x56\xF2\xA7\xED\x67\xE3\x9E\xE2\xD9\x17\x94\x5C\x69\xD3\x10\x5A\x75\x5C\x18\x3C\x3B\x62\xCF\x2B\xB0\x6D\xBF\x3D\x1E\x46\x50\x1A\xF0\x1C\x7C\x1C\x16\x9D\x06\x5C\x18\xDA\xC0\x1F\xAE\x4B\xCF\x03\x8E\xF6\x76\xE1\x2B\xB8\x89\x69\x8B\x6C\xAC\x91\x4C\x6E\x85\x91\x35\x56\x77\x81\x95\x3D\x0F\xDD\xC8\xFF\x76\x9B\x34\x3D\x56\x60\x6D\x09\xCA\x87\x12\xB1\x7A\x39\x01\x61\xB3\xEB\x0F\xCA\xF1\xED\x25\xB6\x34\xBC\x00\xD7\x46\x90\x35\x88\xE6\xDF\x78\x96\x66\x49\xBC\xD5\xC0\x08\xBF\x08\xAB\x11\x46\xBF\x62\xBB\x9A\xA2\x13\xFA\x7D\xB5\xA5\x16\xA9\x41\x2C\xE4\x4B\x90\xDE\xB2\x46\x00\xC7\x4C\x73\xDC\xF1\x95\xDB\x67\xBA\x63\xFE\xD3\x4B\xB4\xF6\x74\x92\x14\x2D\x39\xB5\x43\xCE\xEF\xB0\xE0\x2A\xB3\x3F\x58\xCE\x5F\x66\x45\x04\x0C\x90\xD6\x74\x73\xB0\x4B\x4D\x73\x5C\x46\xAF\xC0\x23\xEB\xE0\x86\x9E\x4C\x51\x34\xDD\xB3\x71\x9A\x97\x78\x6F\xF8\x3B\xDD\x70\x1F\x01\x27\x71\x48\xCA\xC7\xAB\x2C\xD3\x19\x95\x29\xF0\xC5\x4D\x61\xE5\x8E\x60\xFB\xF1\x35\x56\x7B\x16\x74\xCD\x30\x74\xF4\x3A\x3C\x37\x1D\xA1\x91\xE9\x35\xAC\xE8\x8A\x1F\xBB\x28\x23\x2E\xB6\x59\x40\xDD\x2E\x9C\x84\xB4\x10\x25\x38\x49\x27\x9E\xA8\x09\x98\xFD\xD3\xD4\x52\x30\xE8\x0D\x96\xF2\x0D\x58\xEE\x35\xAA\x36\x1E\x91\xD1\x9B\x70\xF5\x16\x46\x5A\xDC\x40\xA9\x30\xF1\x2D\x8E\x62\x37\xA6\x80\x6F\xC3\x93\x32\x74\x64\x93\x5A\x91\xD9\xD4\xCA\x3B\xDC\x83\xEC\x66\xDE\x11\xBD\xCB\xD2\xD0\x41\x07\xBB\x2A\x64\xC8\x8C\x4A\xD9\xD0\x7B\x70\x20\x01\x33\xE8\x2A\x76\xBF\xEE\x39\x2B\xEC\xD8\xBD\x67\x42\x63\xCA\xDE\xA0\x47\x47\x4B\x8B\x92\x5D\xBA\xE7\x88\x2E\x36\x10\xA0\x1E\xC3\xA1\x46\x97\xB4\xD5\x44\x3D\x56\x3A\x38\xD1\x95\x12\x20\x07\x77\xBD\xF4\x85\x44\x17\x2D\xF9\x5B\x11\x56\x6F\xE0\x3C\x45\xD4\x2C\xDF\x20\x55\x5D\xC7\x49\x9F\x17\x90\xA8\xAB\x26\xE8\x78\x29\x59\x61\x14\x72\xD7\x67\xD2\x62\x93\xBA\x46\x3B\x81\x67\x28\x7E\x71\x5C\x2D\x8D\x51\xBF\x7C\xA2\xD4\xCD\x79\x20\x0B\x2B\x05\x75\x1E\xCB\x7A\x9D\x24\x75\x24\x80\x58\x31\x64\x64\xA6\xB5\x44\xD9\x20\x75\x25\xBA\xFA\xF0\x24\x57\x3F\x10\x7E\xCD\x31\x82\x93\xA5\x4F\x26\x6D\x6F\x52\xE1\x4A\x45\x4F\x91\xE6\x27\x20\xE8\xED\x3F\x99\xE2\x96\xD1\xA9\x12\x2D\xFB\x1C\x32\xAD\x9A\xB0\xA7\x49\x47\x88\x53\x8A\x21\x78\x76\xE9\x2C\x85\x08\xF6\xAA\x05\x77\x02\xA3\xD3\x13\xC2\xD1\xDA\x82\xB6\xB6\x21\x3C\xE5\x06\xAF\x97\x67\x48\x1F\x4F\x2A\xD1\x9B\x60\x26\xE1\xC8\x68\xA3\xC4\x0E\xB1\x75\x99\xC6\x5A\x6C\xBB\xBE\x23\x71\x86\xCC\xC5\xD3\x2E\x76\xA2\xBA\xFD\xE0\x39\x35\x24\xCC\x2A\xA3\x33\xA5\x0D\x4D\x9C\xBD\xAD\xF1\x34\x1B\xAB\x34\x0F\xDA\x98\x8B\xA3\xB9\xB3\x4F\xC1\xE4\x42\x9B\xA4\x63\xF3\x98\xE9\x31\x6D\x7A\x40\xA3\xA1\x4C\xA1\xB3\x98\x81\xA5\x4B\xB3\xF8\x16\x19\x9D\x9D\x09\x1B\x94\x71\x45\xD9\xE6\x73\xA4\xCF\x65\xC3\x66\xCD\xAD\xA0\x18\x0A\x9D\x2B\xED\x9D\xC5\x95\x69\xB8\x8A\x66\x90\x5A\x31\x74\x9E\xB4\x6F\x06\x18\xAD\xB8\xEC\x1C\x36\xE9\x7D\x5D\xE8\x7C\x66\xBD\x69\xC8\x3E\x3C\xEA\xBB\x67\x74\x81\xB4\x4F\x06\xC4\xA1\xD8\x8D\x18\x46\x17\x4A\xF4\xF4\x68\xCC\xBA\xC3\x0A\x99\x54\x9B\x8C\x2E\x92\xDA\xB2\xC0\x6B\x17\xB5\x5C\x2C\x2D\xCC\x42\xCE\xAD\x4A\xBE\x44\xFA\x68\xD2\x11\x69\x13\x96\xAE\x8D\x4C\xCB\x68\xB3\x74\x78\xA2\x27\x7E\xD3\x4F\xE0\x04\x6A\xDF\x10\x15\x7E\x23\x0B\xD3\xA5\xD2\xFE\x05\xC6\x0C\x0B\x7D\x2E\x93\x3E\xC1\xAD\x63\x64\x4F\x84\x16\xA5\xCB\xE8\xF2\xE0\x99\x9A\x8A\x8E\x9D\x2A\x0E\x04\x8E\x2E\x20\x0A\xFC\xDD\x15\x81\x89\x71\x90\xF9\x77\x8B\x05\xD8\x57\x4A\xFF\x2E\xC4\xCE\xBD\x49\xA9\xC0\xB7\xA0\x9E\x5C\x6A\x17\x8B\xA1\x18\x41\x53\x1E\x77\x57\x49\x87\x08\xD1\xBB\x4D\x21\x76\xCA\xB9\x5C\xCD\xB4\x18\x3C\xF9\x6C\x2D\x5E\xC3\xB4\xC8\x43\x16\xD3\xE2\xB5\x2C\x06\xE0\xB1\xF3\xAE\xB6\x4A\x58\x4F\x19\x5D\xC7\x1E\x44\x6A\x88\x6D\xF3\x20\xAE\x97\x0E\x14\xCB\xC7\xBE\x73\xBE\x28\x10\xEC\x06\x69\x28\x17\x4D\x18\xA9\xD4\xAE\x5F\xBD\x51\x2A\x09\x9F\xEB\x4C\xB2\x41\x46\x37\x49\x7D\x05\x26\x55\x1D\x6A\xBE\x99\x51\xE6\x05\x9A\x49\x36\xC8\xE8\x16\x69\x5D\xB1\x73\x01\x09\x5E\x8A\x5F\xBC\x13\xC5\x1A\x82\x93\x02\xB7\xD6\xE7\x4B\x6E\x93\x8E\x2A\xA2\xA5\x6D\x63\x49\xB7\x33\x6F\x9C\x4F\x2C\x3D\xC3\xEE\x90\xA6\x6B\x54\x14\x6E\x13\x4D\x0A\x6B\x0C\xEF\x94\xCE\xAF\xEF\x1A\xA5\x60\xCC\x3A\x6E\x52\x0A\x51\x0A\x5C\x83\x15\xC2\x96\x4A\xE8\x2E\xE9\x82\xED\xC1\x5B\xF6\x45\x4F\x71\xE6\xEE\x9E\x55\xC5\xD5\xBE\x18\x2B\xCE\xDB\x3D\xD2\xE6\xED\xC1\x5B\x01\xC5\x05\x19\xA8\x7B\x25\x7A\x8C\x2E\x96\xBD\xA3\x77\x33\xC9\xDC\xB5\xDF\xB1\x5F\x42\xB8\x4F\xFA\x90\xDF\xE9\x9A\xB6\x67\xE0\xFB\xA5\x0F\xF9\xFF\xB9\xA6\xDF\xF4\x80\xB4\xD3\x88\xA7\xEB\x7E\xC3\x8E\x73\x9B\x76\xF8\x70\xA5\xE2\xB8\xBE\x99\x5B\xA6\xE6\x07\x29\x3B\xEF\x3E\x67\x87\x1D\xE7\xDB\xA6\xAA\xB8\x4A\x93\x34\xDF\xFF\x6F\x07\x75\x67\xCB\x36\x55\xAF\x8A\x6D\xA7\x69\x17\xCB\x36\xAB\xD8\x71\xB0\x7A\xC0\xF0\x74\xD3\x2E\x2B\x87\x3D\xC3\xF5\xE6\x55\x75\xC5\x18\x3D\xA4\xB9\x75\xFE\x82\xF9\xCD\x07\xEC\xB7\x5F\xCB\x82\x96\xE6\xE6\x05\x2D\xAD\xCD\x2D\x0B\x5B\x9B\x0F\xDC\xEF\xA0\x56\x55\xC1\xC3\xAD\xEA\xC2\x05\x07\x8D\x1C\xD0\x3C\x83\xA7\xAC\xE6\x99\x18\xC8\xA2\x85\x8B\xE6\x37\xB7\xFE\x5F\x00\x00\x00\xFF\xFF\xB7\x8E\xB5\x2B\xCA\x6E\x06\x00")
-var gzippedCallGraphCSV = []byte("\x1F\x8B\x08\x00\x00\x00\x00\x00\x00\xFF\xEC\xBD\x5B\x6F\xDC\x38\xB2\x38\xFE\xEE\xCF\xF1\x43\x1E\x82\xE0\x8F\x8C\x67\x77\x91\x31\x72\x02\x38\x17\xEF\x19\x9C\xD9\x24\x27\xC9\xEE\xBC\x04\x10\x68\x89\xDD\xAD\x13\xB5\x24\x53\x94\xD3\x9E\x87\x7C\xF6\x3F\x44\xEA\xC2\x4B\x91\xA2\xEE\x6A\x47\x0F\x33\x71\xB3\x8A\x75\x63\x55\xB1\x44\x52\x54\x92\x22\x0F\xED\xF7\x9E\x9F\xE4\x31\x7D\x56\xFC\xBA\x47\x51\x8E\x3D\xFA\x90\xE2\x0B\x19\xE8\x1F\x10\xA1\x09\xC9\x63\x15\x50\xFC\x8A\xF3\xE3\x2D\x26\x5E\x18\xD3\x1A\x98\xE5\x47\x13\xC1\x02\x74\x4C\x03\xEF\x2E\xC6\xDF\xB5\xC6\x23\x3A\x79\x3E\x3D\xE9\xC8\x19\xA6\x5E\xF8\xEB\xA5\xC6\x00\xDD\x26\x84\x6A\xE8\x01\x8E\x34\xCC\x52\x4A\x9A\x78\xB7\x3B\x09\x78\x87\x82\x40\xC3\xBE\xDD\x15\x98\xBC\x4F\x0D\x4C\x49\x12\xE4\xBE\xD1\x54\x15\x58\xD3\x4E\x04\xA8\x1A\x4A\x9D\x54\x2D\x45\x86\xB2\xA6\x62\x37\x51\x5B\xB1\x07\xA8\x71\x85\x70\x77\xCC\xE1\x5E\xA0\xE6\x47\x74\x32\x69\x2D\x83\xFC\xE4\x98\x22\x22\x40\xC3\xD8\xD8\x51\x02\xA9\x1D\xB3\x84\x18\x0D\x5D\xC3\x10\x21\xE8\xC1\xFB\x1E\xD2\x83\xE7\xA3\xD4\x04\x47\x69\x8A\xE3\xC0\x44\x39\x3B\xA0\x28\x4A\xBE\x7B\x7E\x92\x3E\x98\x28\x64\xA2\xE9\x51\x14\x99\x04\xAB\x40\xB7\x49\x12\x61\x14\x37\xED\xF1\x83\xB1\x4B\x09\x32\x75\x29\x5C\x62\x8F\xE9\xC5\x6D\x1E\x46\x34\x8C\xBD\x23\x2E\x06\x46\xA0\x16\x52\x4C\xCC\x50\x6B\xD7\xCA\xE6\x00\x42\x25\x8E\x0C\xFA\x55\xD5\xC2\x0C\xD6\x19\xFF\xDA\xCA\xF9\x57\xDD\x12\xA4\x18\x5B\x74\x9B\x19\x1C\xBA\x06\xCB\x31\x27\x35\x4B\x11\x27\x77\x40\xB7\x19\xD0\x5C\xC7\x93\xC4\x5C\x88\x3F\xA9\x5D\x8F\x17\x06\x26\x49\x1E\x07\x36\xA9\x39\x02\x20\x77\x03\xD0\x25\x17\x3A\xB1\x3F\x0B\xAA\x75\xDE\x55\x30\x64\x35\x1A\x79\x54\x45\x1A\x88\x41\x15\x1F\x87\x91\x4D\x13\x06\x07\x14\xA9\xDB\x75\x3D\x9A\x2E\xC5\x5F\x10\x40\x96\xBE\x16\xC1\x20\xE2\x2E\x4A\x12\x62\x93\x91\x23\x00\x42\x36\x00\x5D\x4A\xA1\x13\xFB\x13\x04\xC9\x82\x36\x82\x18\x24\x4D\xA3\xDC\xEA\xCC\x35\x5C\xA7\xCD\x40\x80\x0A\x75\xBB\xAE\x41\xD3\xA5\x9E\xE4\xE4\x76\x80\x03\xE4\x23\x35\xC0\xA0\xD5\x31\x8C\xED\x6A\x71\x04\x40\xF8\x06\xA0\x4B\x2F\x74\xCA\xF2\x5B\x10\x20\xCB\xDF\x88\xA1\x2A\xD0\x40\x5A\x35\xB0\x91\x2D\xB2\x71\x10\xEE\x24\xCD\xF2\x88\x86\x69\xF4\x60\xD5\x5E\xC4\x01\xE8\x57\x60\xC8\x3E\x22\x0C\x30\x91\xD4\xB5\x9E\xD3\x75\x98\x81\x23\x68\x2B\x11\x68\x30\x57\x10\xDE\x87\x01\xB6\xE9\x2C\x60\xE8\xFC\x4B\x20\xA0\xAF\x00\x09\xF0\x0E\xE5\x11\x55\x34\x16\xBB\x06\xE1\xBD\xA9\x2B\xC0\x0D\xD2\x55\x00\x99\x12\x39\x36\xD5\x8F\x35\xB8\xE0\x18\x66\x61\x4C\xF1\x1E\xEC\x0A\x64\x63\xAC\x16\xC1\x52\x33\x90\xF8\xAB\x0E\x04\x1F\x81\x66\x9D\xBA\x41\xA3\xA2\x9A\xF1\x93\xD8\x47\x70\x71\xA5\xC2\xA1\x02\x0B\xC6\x11\x8B\x2C\x5E\x33\x45\xA1\x8F\xCD\x4C\x1A\x70\x65\x58\xF2\x20\x4C\x65\x32\x8A\x51\x0C\x15\x45\x90\xE2\x36\xA4\x99\x67\x9A\x14\x2A\xA0\x3E\x72\x62\x37\xD1\xB2\x62\x8F\x2C\xDC\xC7\x52\x63\x5D\x48\xD4\x0D\x59\x7E\xEB\x25\xE5\xD3\x52\x83\xA5\x88\x56\x24\x65\x1D\x2B\xC6\x7B\x4D\x12\x6D\x24\x6B\xEC\x84\x68\x3C\xBC\x38\xA1\x4D\x23\x32\x95\x21\x35\xD4\x60\x84\xAA\xA3\x66\x85\xAA\x8F\x6C\x86\xA2\x55\xB6\x03\x6B\xD1\x0C\xC1\x5A\x13\xA2\x76\x54\x2D\xC1\x5A\x25\x53\x20\x53\x95\x22\x50\x11\x0D\x5C\xB5\xC8\xE6\x88\xF1\x1E\x51\x43\xE2\x12\x11\x0C\x46\x11\xA0\xB2\xFA\x25\x40\xB6\x80\xC0\x8C\x4B\x7D\xBB\x63\x00\x13\x06\x6B\x82\xE5\xD1\x0D\x59\x73\x54\x4D\x57\x01\x24\xEB\x69\xA2\xA8\x06\x3C\x59\x63\xE5\x64\x0E\x96\x93\x29\x5A\x4E\x60\xB8\x9C\xB4\x78\x39\x81\x01\xC3\x5A\x4F\x09\xC0\xC8\x2C\xBF\x6E\x8B\x93\x16\x51\xD9\x21\xDC\xD1\x08\xEF\x0C\xCF\xC8\x00\x8E\x61\xE8\x64\x24\x4D\x7B\x19\xAC\xE4\x40\x8B\x24\x42\x1A\x54\xB0\xA4\x09\x03\x80\x89\xB3\x06\xD4\x95\xFD\x8C\x4D\x60\x8B\xF0\xCD\xA4\x09\x5B\x07\x72\x5B\xC8\x84\xEA\x90\x31\x1C\x12\xEE\x0F\xAD\x63\xC1\x91\x0C\x0E\xA8\x90\x31\x9A\xBA\x21\xA2\xEB\xAA\x4B\x01\x8E\x43\x43\x42\x76\x6A\x01\x28\xFB\xB6\x08\xD0\x5C\x5C\xE1\x6C\xF3\xB3\x86\x31\x1F\x46\xE2\x85\x71\x1A\x21\xDF\x4A\xCD\x38\x2E\x95\xA4\x6A\xB4\x88\x40\x3D\x68\x54\x49\x85\xE1\xF4\xC3\x80\x14\x35\x01\x45\x61\x9C\x41\xA3\x20\x23\xA4\x88\x64\x98\xB5\x19\x81\x61\x6A\x20\x5C\x2D\x0F\x34\x34\x9A\x1E\x42\x1B\xF3\x5B\x9A\x84\xFF\xF8\xDB\x45\x05\x7E\x76\xC4\x47\xFF\x20\xB0\x2C\x3C\x89\x64\xD8\xA7\x66\x91\x05\x14\x48\x68\x85\x82\xB8\x74\xE1\x1F\x53\x0F\xDF\x19\x56\xB8\x04\xA0\xDA\x27\xB6\x76\x8A\x0D\xBD\xF6\xD4\xD2\xA9\x04\xEA\x7D\xB0\xB5\x13\x06\x7B\x45\x36\x4E\x11\xCC\x29\xB2\x72\x8A\x00\x4E\xF8\x1E\x45\x45\x32\xF3\x62\xFC\x9D\xE7\x57\x14\x45\x89\x5F\xC3\x94\xBC\x54\x37\x1D\x30\x4A\xBD\x94\x92\xE2\x49\x4D\x86\x70\xDE\x6C\x10\x1B\x40\xF1\x3F\x08\x2D\xC8\x8F\xA9\xDC\xFE\x7F\x59\x12\xF3\x66\xCF\xDB\x25\xC4\xC7\x5E\x78\x4C\x13\x42\x3D\x26\x39\x5F\xC6\x2A\x9D\x80\xFF\x78\xEE\x8A\xF8\x8B\x2B\xE2\xA5\x2B\xE2\xAF\xAE\x88\x7F\x63\x3A\xD6\xA1\x0C\x45\x81\x0C\x54\x96\xFA\x65\x20\xA2\xC9\xEE\x1F\x10\xC9\xB2\x17\xC1\x65\x1E\x42\x19\xFE\xC7\xDF\xBC\x30\x2B\x78\x85\x01\x98\xB4\x15\x94\xF2\xF7\x1E\xC7\x5E\x80\xFD\x24\x80\xB1\x76\x04\xC3\x00\xD1\xBB\x34\x52\x45\x5A\x28\xBC\x05\x00\x70\x9F\xD3\x01\x2A\xA3\xB2\xD9\xAC\x48\x89\x60\x55\x43\x20\x92\x51\x12\xC6\x6C\x39\x39\xF1\x11\xC5\x81\x88\x86\xE3\x16\x5E\x25\x82\xC0\x8B\xB7\x18\x88\x68\xBC\xB4\x8E\xCF\x84\xD8\x2B\x81\x39\x89\xDA\x95\x16\x90\xAC\x8A\x2B\xC4\x6C\xCA\x17\xA8\xAD\x06\x10\x90\xAC\x46\x50\x88\x81\x7C\x59\xD8\xE7\xF1\x11\x91\xEC\x80\xC0\x75\x7F\x00\x83\x35\x35\x99\x86\xFD\xD4\xE0\x75\x8A\x91\xC0\x19\x25\x11\x8E\xE1\x6E\xA0\x80\x24\x8F\x69\x78\xC4\x1E\x26\xA4\x2C\x8F\x43\x9A\x20\x03\x48\xA0\xAE\x03\x85\x51\x96\x81\x59\x9C\x92\x30\xA6\x3B\xCF\xD0\x91\xA7\xE1\x6A\x29\x7F\x4F\x50\x7A\xF0\x08\x46\xFE\x01\xDD\x46\xDA\x38\xD9\xD0\x32\x6C\x27\xC3\x9E\xF1\xDB\x31\xAA\x55\x80\x76\x89\xF6\x2D\x0C\xD5\xCD\x17\x13\x4E\xB5\xB8\xCA\x86\x2C\xC2\xA7\x02\x25\x10\x33\x60\x98\x05\xE1\x3E\xA4\x00\x12\x1F\xD4\x12\xE9\x80\x4F\x3A\x4A\x35\x72\xB1\x2F\x3A\x8C\x04\x0D\xB3\x2C\xAD\x6A\x41\x1D\x0A\x31\x34\x12\x32\xC8\x09\x10\x12\xCA\xBF\xC6\xE1\x45\x7D\x04\x87\x82\x11\xCC\x11\xA7\xA1\xE6\x71\x58\x04\x6A\x99\x27\x8A\x9F\xD4\x01\x3B\xCB\x09\x49\x8A\xE7\x5E\x0B\x6E\x53\x44\xB8\x71\xA6\xBB\x17\x0E\xD8\x3C\xAF\xB8\x62\x97\xB4\x8D\xE2\xD2\xE4\x1B\x8E\xCB\xA9\x34\x8A\xCC\x50\xB1\x82\x02\x11\xE0\x21\x11\xC9\x57\x33\xB5\x79\x54\x1A\x6C\x4D\x29\x33\x2A\x0F\x5D\x3B\xA5\xCA\xB3\x9C\x18\xB2\xC6\x16\x7E\xE2\x72\x20\x88\x95\xDC\xFE\x1F\xF6\xB5\xC1\x87\x15\xC4\x6E\x78\x6D\x24\x01\x3A\x19\xA6\x0E\x20\x39\xC9\xC8\x60\xAB\xF9\x24\x24\x8B\xF1\xB8\xE4\xED\xF4\x54\x3C\x37\x92\xB0\x5D\x34\x04\x2F\x8C\x33\xAC\xC5\x63\xAB\x50\x66\x69\x84\xB2\xDF\x40\x05\xC4\x00\x95\xFA\x4E\x42\x8A\x89\x87\x8F\x21\xAD\x42\x0D\x8C\x2A\x11\xAF\x5C\xAD\x90\x67\x66\x2B\x96\x5A\x02\x98\xF0\x6C\x5C\x85\xA9\xC7\x44\xA3\xB5\xA3\x23\x7D\x25\x7F\x8A\x58\x96\xB9\x00\x40\x93\xCB\x0C\x0D\x8B\x47\x34\x8E\xF0\x11\x4B\xA7\x95\xF6\xD8\xC0\x5D\xEF\xA0\xA1\x30\x0A\x70\x6F\x06\x32\xD6\x7B\x30\xA6\x4D\xC9\x06\xCB\xE4\x4A\x9D\xFB\xA9\x39\xD7\xB1\x9B\x3A\x6F\x3B\x76\xF3\x93\x28\xC2\x3E\x0D\x93\x1E\x82\x62\xEA\x45\xC5\x4F\x14\xC1\x7D\x1B\xDA\xAD\x76\x54\x50\x85\x33\x30\x46\xD6\x7D\x5D\x40\x10\x5B\xE0\x15\xE1\x78\x4F\x0F\x6E\x3D\xAC\x5E\xAF\xE0\x76\x36\x78\x99\x30\xF5\x88\x30\xBB\x2A\xD0\xA5\x8B\x41\x5A\xBA\xB3\x7F\x9C\x7B\x96\xC5\x1F\xC5\xE4\x18\xC6\x72\x9D\xE1\xA4\x65\xFD\x0C\xEE\xD2\xA5\x13\xB2\x6D\xD4\x8C\xE2\x40\x69\x88\xFD\x63\x23\xD9\x20\x38\x0E\x43\xD3\x41\xD6\xA8\x78\x98\xB4\x8C\x47\xB3\xA8\x65\x41\xE2\x32\x2A\x39\x9D\xE0\xA6\x55\x7C\x40\x2C\x9B\x8F\xF8\xE8\x97\xC7\xE6\x44\xCC\x66\x7D\xA4\x7C\x70\xF2\x91\x7F\x60\x36\x52\xC8\xCB\xF0\x4C\x83\x1F\xF1\x31\x09\xFF\xC2\x5E\x18\x87\xDA\xD8\x68\x30\xA1\xC4\xA8\x60\x69\x9E\x1D\x4C\xFD\x6A\x18\xD0\x8F\x57\x21\xD0\x92\x17\x80\xA1\x57\x2E\x15\x52\xA5\x70\x4D\x83\x4F\xBF\x20\x4E\x49\xA5\xF2\x23\xB6\xD7\x51\x68\x26\x9C\x84\xF0\x93\x98\xE2\x13\x00\x3F\xA2\x93\x11\x56\xEF\x18\xC9\xAD\xE2\x51\xD3\x1A\xA2\x18\x9F\xEF\x94\x48\x3B\x26\xE2\x1E\x0D\x94\x72\x24\xB8\xC4\x5E\x86\x34\xC3\x21\xB7\x37\xFE\xA4\x53\x2A\x44\x16\xE6\x3C\x4D\x94\x46\x72\x09\x54\x3B\x23\x4C\xB1\x32\x82\x04\x95\x6B\x11\x71\xBB\x83\x77\xDC\x0B\x1D\x35\x68\xBD\xBB\xB4\xB3\xAF\x9E\x6A\x1D\x69\xE2\x65\x7E\x08\xF7\x15\xAA\x42\x13\xDD\x7A\x7D\x55\x80\x7B\x71\xC2\xA2\xD1\x2E\x76\x8D\xD5\x22\xA5\x44\xCD\x20\xAD\x44\xCB\x20\x35\xC4\x4F\x96\xBE\xDC\xBD\x52\xF6\x3C\x75\x90\x78\x0A\xF2\x64\x40\x92\xC7\x43\xEA\x5E\x2D\xA9\xC8\x20\x25\x47\x69\xDD\x9A\xBD\x3F\x9D\x62\xBD\xFB\x07\xF4\xFA\x0B\x87\xF1\x2D\x2A\x57\x05\x15\x04\x61\x89\x55\x27\x8A\x4F\x6C\x19\x3F\xFF\xE5\x1F\x26\x8C\x72\xA1\x1F\xC6\x68\xD2\xB1\xB8\x27\xA8\xA9\xA2\x80\x44\xB3\xAB\x20\x41\x4B\x01\xA4\xD9\x4D\xE9\x26\x0C\x84\x26\x86\x6A\x1B\x11\x41\xB2\x8D\x2A\x8A\x6E\x1B\x15\x43\xB7\x8D\x80\xC1\x6C\x73\x27\x1D\x21\xBE\x93\xCE\x07\xDF\xC9\x07\x80\xEF\xC4\x53\xC2\xD5\x0E\xAA\xD8\x57\x6C\x29\x1E\xD9\xEB\x16\x91\x86\x80\x54\xD1\x91\x69\xC8\xFD\x95\xBE\x4D\xBF\x72\x4B\x59\xE8\x2B\xB5\x64\xF9\x6D\xD3\x22\xD0\x10\x91\x18\x9D\x63\x2E\x9C\xE0\x6D\x7E\x1D\xF3\x12\x26\xF4\xAD\x80\x5C\x6E\xE9\x4C\x4E\xB5\x75\x7D\x87\x84\x23\xC8\xF5\x8F\x52\xB7\xEA\x17\x8A\x83\xA6\x7F\xA5\x5B\x43\x4E\xD8\xBB\xAE\x0E\xF1\x18\x38\x31\x90\xC8\xAD\x6E\x10\xBC\xAA\x69\xE7\xCE\x24\xE1\x89\x3E\x24\x31\x6B\xC4\x6A\x70\x2B\x2D\x9A\x16\xC1\xBF\x6A\x40\xE9\x56\x22\xDA\x29\x21\x4A\x4B\x65\x02\x51\x39\x51\x6F\xE9\xBC\x4B\xAD\xB2\x70\xEE\xF8\x4E\x3C\xD3\x5C\xFF\x28\xF8\x48\x4B\xF3\x02\x21\x91\xFC\x09\xA6\x7F\x12\x19\x9C\x24\x0E\xF5\x2F\xA6\xCB\x49\x66\x72\x82\xB9\xC4\x78\x0F\x71\x29\x9A\x1B\xC2\xF5\x2F\x76\xD4\xB6\xF9\xCD\x64\xA8\x28\x94\x7C\x04\x82\xCA\x01\x07\x3E\x93\x64\x1E\x41\xF1\xDE\x70\xC4\x4B\x46\xD1\x0F\x94\xE8\xF0\x7A\x8E\xD0\xA9\xAB\x05\x87\x04\xAB\x17\x3C\x75\x18\x34\x15\xDA\xC8\x88\xEB\x98\x32\x8A\x74\xA6\x44\x01\x89\xA7\x3B\x74\xC2\x95\x75\x3D\x2F\x45\xF4\xC0\xAC\xA8\xAF\xD6\xC1\xC0\xE6\x81\xC7\xD6\xB9\xAA\x87\x6D\x34\x58\xD9\x08\x23\xB0\x85\x6E\xAF\x5C\x87\x2B\x10\x04\xAB\x6A\xCD\x0A\x35\xBD\x4B\x65\x41\x0D\xAA\x3F\x85\x1A\x50\x32\x8F\x92\xF0\xE8\x45\x78\x47\xCD\x28\x59\x1A\x85\x16\x30\xC1\xFC\xC8\x8E\x57\x18\xAF\x5A\x67\xA4\x87\x4C\x52\x0D\x00\x09\x8B\x1C\x16\x78\xA9\xBE\x11\xCE\x07\x4C\x01\x8B\xB2\x5A\xE4\x6A\xEC\xC7\xA0\x04\x1F\x93\x7B\x6D\x75\x4C\x07\xD6\x6E\x04\xF7\x2A\x35\x82\x81\x5C\x5C\x11\x26\xFD\x32\x72\x6B\xFC\x4E\x85\x67\x1A\xC5\x44\x58\x5A\xD7\x21\xD5\x88\xA8\xED\x42\x81\x0C\x90\x2B\xC7\x7A\x97\x90\x23\xA2\x06\x24\xC8\xA6\xBB\x30\xA2\x75\x3D\xCF\x7C\x5F\x6D\x96\x4F\xCF\x98\xE0\xE2\x50\x08\x40\x79\x28\xB4\x5E\xE2\x50\x68\x40\x61\x28\x4A\x98\xF4\xCB\xC8\x4D\x19\x0A\x01\x9E\x69\x14\x81\xA1\x10\x20\xD2\x50\x48\x96\x52\x87\x42\x24\x67\x1C\x0A\x95\xB2\xBA\x63\x5C\x8A\x0F\xDB\xD6\x8C\x54\xDA\xB8\x8D\x8A\xF4\xC6\x9E\x09\x49\xDC\x76\x36\x71\x72\x43\x2A\x07\x41\xC1\xAB\x96\x1D\xCC\x8A\x01\x0B\x13\x0A\x06\x9C\x06\xCC\x48\x99\x03\x09\xC8\x38\x60\x6E\xB0\xB2\x61\x6E\x64\xC6\x80\x07\x4A\x21\x61\x67\xE2\x64\x15\xEB\x08\xE4\xB1\xBC\x88\x0D\x19\x8F\xE3\x78\xDE\x11\x93\x7D\x11\xD5\xEC\x5F\x39\x9E\x9B\x26\x29\x92\x55\xCC\x32\x88\x55\xEC\x32\x5B\xF0\x66\x33\x9F\x26\x92\x55\x02\xA2\x01\x2C\x73\x03\x84\xA2\x4E\x37\x06\x24\xA5\x3A\x30\x60\x89\x53\x83\x84\x61\x0F\x62\x39\xA9\xD9\xE4\xA9\x91\xAC\xF2\x80\xF9\x31\x11\xDE\x1C\x83\x16\xCD\x24\x58\xB5\x0B\xAC\x36\xD6\x2B\x83\x1A\xA0\xDA\x18\x66\xAB\x59\xD5\x81\x54\xC0\xB7\x8C\x38\x45\xA3\xF4\x72\x8D\x11\x4B\x94\x01\x44\x10\x64\xC9\x5C\x84\x01\x90\x04\x03\xC0\x50\x1E\x15\x2D\x38\x62\x63\xAB\x44\x75\x01\x5E\x53\x37\xD9\xAE\x01\x8A\xE3\x24\xB5\xCA\x36\xB0\x51\xCB\x60\x72\x59\x17\x7A\x8D\xE8\xE5\x6C\x67\x7E\xBB\x0B\xC0\x10\x96\x56\x14\xA8\xB0\x12\x0B\xF4\x03\x4F\xEE\x08\x78\xC6\x73\xE0\x20\x8E\x78\xB8\x09\x44\x10\x77\x48\x2B\x04\x1C\x07\x59\xE1\xB4\x36\x2E\x12\x0E\x44\xA4\x29\x0D\x6C\x64\x14\x2C\xE0\x0D\x81\x16\xCC\xFA\xF1\x13\xC0\x93\x96\xDA\x0C\x70\xF1\xCD\x0E\x13\x09\x4A\xF2\xD8\xB7\x09\xD3\x3C\xAD\x9A\x48\x88\xCB\xC3\x06\x22\x80\xC3\x08\x18\xF2\xB2\xB9\x81\x84\xB0\x26\x6C\xC6\x30\x7B\x57\x18\x07\xF8\x94\xC0\x79\x14\x40\x81\x7C\x4B\x84\x2B\xAB\xDD\x10\x8A\xE9\x04\x18\x84\xAB\x1B\xB9\x7C\xE8\xB3\xC9\x2B\xA2\x00\x06\x16\xC1\x90\x3A\x22\xBC\xDC\x85\x03\xE1\x40\x48\x2B\xA4\xCD\x56\x2F\x11\x3D\x38\x95\x81\x48\x66\x4D\xBC\xD8\x22\x4B\xD9\xBB\x83\x34\xEA\xE3\x75\x9B\xDC\x5A\xCA\x64\x8F\xED\x36\xC5\x1A\x84\x66\x59\x47\x87\x41\x63\xD3\x40\x01\x73\x70\x20\x60\x0A\x89\xA6\xD9\x0C\x8A\x58\xE2\x32\x91\x8E\xD2\xE6\xC5\x02\x31\xCD\x87\x33\x8A\x08\x6D\xCD\xB6\x0A\x16\x68\x0E\x19\x05\x4A\xC9\x59\x7E\x2B\x9C\x1B\x32\xB1\x92\x90\x2C\x09\x59\x46\x84\xCF\x1C\xC0\xB8\xAD\xF6\x92\xB0\x01\x9B\x49\x70\x68\xF4\x6B\x04\xC8\x03\x20\xB9\x61\x2F\xA0\x24\x04\x2F\x5B\xD2\xE0\xFA\x42\x56\x3B\x1A\x7B\xE7\xCB\xC6\x4E\x0B\xA6\x9A\x7A\x9B\x4C\x0D\x52\x9B\xA9\x65\x6C\xDD\xD4\x32\x1C\xF2\x3B\x19\x03\x18\x8C\x06\x01\x18\x0C\x8D\xBE\x7D\x30\x3C\xE3\xBB\x88\x06\xAC\x4A\xFF\x08\x65\xD4\xA0\x7D\x83\x6C\x50\x5F\xA7\x66\xB5\x66\x83\x6E\x34\x57\x83\x62\xB2\x57\xF9\x52\xA2\xC1\x60\x12\x8B\x16\x8B\xA5\x04\xEF\x42\xF0\x8A\x29\x13\x9A\x51\x6C\x01\xC7\x24\x77\x89\x62\x12\x5C\xE6\xD2\x22\x79\x96\xEF\x5C\x24\x17\xD0\x8C\x92\x0B\x38\x26\xC9\x4B\x14\x93\xE4\x32\x97\x36\xC9\xD3\x96\xB2\x44\xC0\x6A\xFE\xB4\xD1\x31\x4A\x9D\x1A\xCA\x0F\xA5\xBF\x26\xB3\x02\x87\x3C\x5B\x41\xE1\xD1\x61\xE8\x17\x66\xA5\x0E\x06\x78\x13\x7F\xB0\x62\xBA\x32\x6D\x0A\x88\xCA\x46\xC9\x77\xF8\x15\x3B\x1D\x01\x30\x64\x03\x74\x60\x62\xED\xDF\x96\x1F\x1A\x4C\x3D\xD5\xE8\x54\x68\xC2\x1B\x0D\x68\x50\x3D\xAA\x13\x51\xDF\x96\xA8\x30\xF3\x34\xB5\x9B\xAC\x41\x00\x54\x6E\x80\x56\x93\x71\x34\x6B\xFF\x36\x93\x35\x98\xBA\xC9\x74\x2A\x34\xE1\x8D\x06\x34\xC8\x64\x3A\x11\xD5\x64\x85\x69\xB2\xC2\xC3\x2D\xAF\x72\x02\x28\x62\x05\x56\xC3\xCD\xF5\x17\x84\x02\x92\x10\x8F\xC7\x9B\x68\x88\x38\x20\x11\x56\xD5\x5A\x49\x34\x18\xB0\x22\xFA\x22\x37\x08\x07\x3B\xC3\xBB\x95\x26\x14\x90\x44\x9C\xC3\x77\x05\xEA\x08\x7A\xF7\x18\x1D\xC1\xEC\xAC\x40\xF9\x40\x5C\x34\x88\x07\x94\x89\x55\x7A\xF1\x13\x82\x96\x35\xB3\x02\x2E\x37\x97\x9E\x69\x2D\xE2\xA9\xF1\x36\x54\x4D\x24\x33\x6A\xF3\x38\xD5\x86\x29\x1C\xD2\x6C\xE5\x8F\x4D\x78\x4D\x74\x82\xBB\x20\xB5\x31\x40\xA8\xF8\xDA\x7A\xB9\x16\x0A\xF5\xD5\x41\x62\x47\xF9\x51\x85\x0B\xC5\x6F\x29\x30\x41\x6B\x91\xEB\xF5\x76\x7B\x7B\x43\x4D\x06\x80\xEE\x60\x16\x14\x1A\x7D\x98\x01\x84\xA3\x08\x07\xA0\x68\x4B\x63\x20\xA6\x74\x00\xC3\x88\x51\x9D\x2B\x83\xDC\x50\x2B\xB9\x00\x07\x74\x32\x81\x7E\xC0\xE1\x1B\x7E\xC8\xEC\x88\x1D\x68\x82\xC3\xD3\x46\xD2\x18\x95\x62\x0F\xB3\xF2\x46\xB2\xA6\x60\x33\xF7\x00\x63\x4E\x44\x37\xB9\x84\x80\x52\x3F\x4A\x6A\xA4\xD5\x19\x1E\x46\x68\xE9\xDF\x36\x18\x20\x9E\xD9\xC2\xF5\xAB\x79\x46\xF3\xC2\x04\x8D\xB6\x85\xD1\x61\xC3\xEA\x27\xE5\x85\x7C\x5E\x85\xE9\x4E\xCE\x2A\x0D\x48\x19\x8A\x90\x1A\xC2\xB6\x01\xA8\x31\x1F\xCA\x5B\x6A\x8A\xDB\x86\xF0\x89\x05\x25\x74\xD4\x41\x55\x41\xF5\x70\xAA\x80\x76\xAA\xC6\x21\x54\x11\xC5\xC1\xB3\x13\x11\x86\x4D\x45\xD4\x66\x15\x03\x09\x79\x28\xEB\xF3\xCF\x8A\xDB\x36\x1B\xAC\x9A\xC3\x43\x7B\xAF\x10\x54\x7F\x21\x01\xEE\xCF\x77\x7B\x21\xB8\xEA\x09\x02\x44\x75\x05\x95\xA8\xE2\x0B\x2A\xD8\x18\x57\x0D\xA2\x1E\x51\x06\x22\x0E\x6C\xB4\x68\x33\x21\x56\x83\x23\xD9\xCE\x52\x1B\x68\x08\x80\x3F\x96\x38\x9E\x27\xD6\x14\x24\xF9\x6E\xA0\x53\x8E\xB7\x86\xDE\x0E\x14\x44\xB4\x21\x28\xB6\x87\x51\x2B\xEB\x3B\x10\x72\x62\x56\x1F\x54\x68\x47\xE5\xA7\x82\x20\x3C\xEE\x8F\x30\xAC\x39\xDD\x0E\xBF\x92\xDB\xBC\x5F\x60\x80\x18\xF7\xB6\xE0\x28\x14\x2F\x0C\x17\xA7\x2F\x67\xC4\x26\x49\x3A\x23\xCB\x91\x6E\xC2\x35\xC5\xBD\x84\x6F\x9C\x4E\x41\xAC\x76\x59\xA1\x57\xD4\xCB\xBF\x4D\xE5\xB1\x0C\x52\xEB\xEA\x02\xCA\x47\x9A\x95\xD2\x55\xBC\x88\x1D\xA5\x60\xA8\xB0\x5A\x20\x5A\x8C\x00\x50\x30\x40\x24\x3C\x39\x3A\xCC\x24\xDA\x79\x48\x71\x61\xC1\x6B\x82\x42\x42\x12\x23\x42\x02\x28\xD3\x89\x38\x56\xED\xE3\xFE\xCC\xEA\x64\x1D\x3B\x65\x46\xA7\x05\xE7\x18\x4A\x50\x9C\x85\x34\xBC\xC7\x9E\x1F\x25\x59\x4E\x0C\xB3\x20\x80\xC7\xCD\x60\x02\x5F\xD8\xC1\xBA\xDF\x58\x31\x99\x7D\x1D\xF0\x94\x33\x9E\xAD\xF8\x42\xA4\x39\x63\xEF\x6B\xDF\xE8\x6B\x1A\x55\x52\xD5\xE4\x1A\x4C\x38\xAB\x1E\x69\x2F\x39\x97\x09\x35\x0B\xFF\xD2\xC6\x0E\xBA\x59\x04\xCE\xBA\xC2\xF6\x9C\x1B\x82\x76\xA0\xC0\xCC\xA1\x79\xDC\xD3\x74\xAC\x0E\x40\x39\x40\x95\xCA\x54\x93\x52\xCF\xB0\xE2\x09\x2B\xD8\xAB\x51\x10\xA8\xE7\xD9\xE5\xA4\x2F\x21\xD8\xBB\x9B\xE6\x01\x80\x87\x92\x2D\xF8\x01\x3A\xBB\x20\x30\x8E\x52\xF6\xC1\x48\x7A\xDD\x06\xE3\xB5\x48\x55\x83\xA3\x24\xF9\x96\xA7\x80\xA4\x1A\xA0\x9E\xC1\x04\x88\x50\xCA\x8A\xAD\xCD\xFB\xAF\x28\x4D\x0B\x6F\xAA\x5F\x8D\x6D\x6E\x06\x91\xE0\x42\x67\xFE\xE7\x45\x9C\x04\xF8\xEA\x8A\xE0\xCB\xAF\x97\x2F\x32\x1A\x5C\x5D\x79\xDE\x2F\x57\x57\xB7\x28\x0B\xFD\xD2\x45\x5F\xFA\x07\x44\xBE\x5E\xFA\x5F\x2F\x9F\x37\x08\x45\x5B\x11\xA4\x21\xCD\x18\xFC\x95\x8A\x50\xFA\x75\x42\x2A\xF0\xF3\xE2\x3F\x3F\x89\x33\xFA\xE4\xEB\xE5\x6F\xCF\x26\xE6\x75\x75\x85\xB2\x2C\xDC\xC7\x5F\x2F\x5F\x70\x92\x9C\xF5\xD3\xAF\x97\xBF\x2D\xA6\xF2\x42\x7C\x1F\xF1\x10\xB3\x5C\xAF\x0F\x71\xD1\x35\x8F\x8B\xE1\xC7\xC1\xD7\xCB\xE7\x51\x12\xEF\x97\xB4\x43\x92\x62\x52\x80\xBF\x5E\x3E\x0F\x70\x84\x29\xFE\x7A\xF9\xE2\x3E\x09\x83\x45\x9D\x71\xB1\xC1\x59\x4E\x65\x9C\xF9\x28\xC5\x3F\x49\xF0\x09\x4E\x17\xE3\xEF\x5F\x2F\x5F\xAC\x28\x20\xCA\x1D\xE9\xA5\xD8\xF3\x69\x73\x09\x6F\x98\x3E\xEA\xD2\x3C\x3B\x78\xB7\xC8\xFF\x56\x07\xDE\x6F\x17\xFB\x28\xB9\xE5\x05\x75\x84\x58\xF2\x71\x49\x97\x32\xAF\x7B\xEC\x17\x8C\x26\x37\x95\x09\x65\xFA\x31\x52\xC7\x4A\xEE\x33\x09\xD7\xA7\xAE\x71\xBA\x0D\xE0\x8A\x07\x30\xC2\x27\x4C\xAE\xAE\xD8\x3F\xCE\xA5\xC8\x36\xA2\x2B\x1E\x51\x36\x38\xEC\xD9\xE9\xEB\xE5\x0B\x36\xAE\xE5\x88\x14\x13\xD6\xD3\xA7\xDB\xF8\xAD\x7C\xFC\x26\x9F\x64\xCB\xB5\x01\x28\x59\x1B\x07\xDE\x29\x2F\x54\x08\x9B\x7F\xAD\xD9\xBF\xCA\x8C\xFF\xA3\x4A\xF9\x5B\x42\x58\xF9\x80\x59\x1F\xC0\xB7\x91\x5B\xF1\xC8\x2D\xB8\x4A\xB8\xF9\xC5\x8A\xFD\x22\x31\x9C\x74\xDE\x06\x6D\xC5\x83\xB6\xC8\xFA\xDB\xE6\x11\x2B\xF6\x88\xE9\xD3\x7B\xB7\x1D\x82\xCD\x59\x36\x67\xD9\x6A\x81\x33\xF3\x8B\xA5\xB6\x55\x37\xA7\x58\xBD\x53\xFC\x28\xFE\x29\x9F\xD0\x81\xA7\x76\xFB\x83\x61\xD9\x21\xC6\x27\xFA\xF5\xF2\x05\xFB\xBE\x4A\x99\x87\xD8\x19\x1E\x13\xD8\x65\x41\xDF\xD4\xB7\xDC\x18\x73\x20\xDD\x45\xDC\x89\xD3\x66\x25\xD5\x7F\xCD\x1C\x7F\x26\x85\xF9\xF6\x9E\x09\x5A\xB6\xEF\x30\xF5\x0F\x5E\x48\xF1\x51\x76\x0F\xB5\xDD\xF8\xA4\x61\xC6\x77\x1E\x7E\xAD\xAF\x3C\xFC\x36\xD2\xC6\xE1\xD7\x3A\x49\xED\xEC\x4E\xD5\x16\x85\xA5\x76\xCA\xCD\x17\xC6\x54\x9A\x0F\x4D\x7D\x25\xD3\x6B\x2C\xDD\x6C\x29\x77\xE8\x68\x4C\xB1\x33\x64\x4D\x03\xF1\x16\x73\x8A\xBD\x3A\x9B\x47\xEC\x0C\xD8\x07\x26\xE1\x66\x2A\x63\xDF\x8E\x56\x33\xD0\x81\x0C\xD8\xCE\xB2\xC5\x96\x16\x7D\xCB\x93\x82\xAE\xE8\xEC\x68\x9D\x0B\x32\xB7\xBA\x36\x23\x00\x73\x84\x8E\xE3\x70\x76\x87\x9F\x5D\xFC\x7A\xF9\x82\x6D\x0F\x75\x3B\x7B\xA1\xF7\x95\xCE\x46\x58\x49\xBB\xCB\xC3\x0D\xD0\xBE\xAD\xE5\xBE\x19\x6D\x27\xF3\x58\x36\x60\xEC\x5A\xEA\xEE\xD3\xCD\xC2\x86\xA5\xE8\x85\x4D\x2B\x92\x9D\x79\x42\x67\x9A\x13\xEF\x88\xC2\x98\x71\x46\x14\x97\xFA\x57\xB6\xA8\xD3\xAF\x3A\xAD\x3B\xF5\x7D\xB4\x95\x90\x8B\xF2\x2E\xA1\xBD\x0A\x23\xAE\xDC\x01\x0D\x39\x76\x1D\xB6\x33\xEF\x66\x74\x74\x11\x3D\x37\x95\x04\xAA\x6A\xA6\x57\x74\xDA\x3B\x2F\x6F\x9D\x85\xE5\x5B\x38\x7D\xD8\xB5\x37\x15\xA4\x4E\x9D\x8B\xA2\xE6\x98\xAE\xC4\xCC\xD3\x17\x0F\x8E\x06\x75\x4E\xC8\x0B\x1B\x6C\xF9\x8C\x6C\x37\x40\x4B\x4A\x76\x1E\x06\x3D\xE9\x15\x4E\xCF\x8A\xB2\x23\xA2\x3E\x78\xA1\x24\x08\xAD\xDF\xE0\x01\xA1\xD5\x8B\x3F\x12\xB0\xDD\x17\x94\x2E\xC2\x15\x65\x30\x21\x27\x6D\xB4\x8F\x1E\xB6\x23\x65\x3A\xD2\x63\xF6\x40\xA3\xAA\x1E\x7B\x8F\x8C\x8D\xB5\xB2\x96\x5A\x42\x0A\x3F\xD4\x5B\x1B\xFF\x79\xC9\xED\xF9\x0D\x3F\xCC\xB2\x2C\xDA\xAC\x04\x33\x87\x78\xF5\xF4\x95\xD4\xA3\x14\x8F\xA2\xDB\x68\x9D\x52\x8B\x32\xE5\x71\x42\x02\x4C\x70\xE0\x1D\x51\xCA\x24\xC4\xC4\x2C\xD8\x1A\x75\x28\x24\x6A\xC4\xD0\xC0\xF8\x2E\x47\x91\x47\x13\x0D\x85\x92\x1C\xB7\x1A\x84\xF5\x3E\x2F\x7B\x18\x15\x6E\x31\x19\x68\x0F\x68\x83\x63\x1D\x4A\x3F\x2F\x13\xDA\x2E\x8C\x03\x49\x97\x17\x82\x34\x2E\xD9\xE7\x91\x95\xA0\x8A\x9E\xDB\xD6\xDA\x7A\xB7\xD6\xD4\xB1\x62\x8E\x5B\x2E\x80\x19\xDD\x35\x45\xA1\x25\x41\x4F\x66\x21\x95\xF1\x3C\x56\x2A\xB9\xEC\x50\x94\x61\x29\xB4\x67\x63\xDF\x36\x12\x8F\xAB\x8A\x29\x7E\xDD\x26\x49\xB4\x15\x34\x5B\x41\xB3\x1A\x7B\xFC\x64\x05\x8D\xE7\xE1\x23\xFF\x7C\x45\x1E\x87\x77\x39\x13\xC3\x43\x64\x9F\x99\xA5\x5A\x68\x4E\xE0\xFF\x81\xF5\xD6\x2A\xE4\x7B\xE2\x90\xBF\x97\x98\x49\x7F\x14\x9C\xE1\x79\x3E\x91\x2F\xF7\x55\x20\x04\xEF\xF1\x89\xFF\x56\xC1\x7C\x63\xF2\x71\xCD\x46\xDB\x14\xB4\x4D\x41\xEB\xB0\xC7\x4F\x36\x05\x39\x3E\x53\x3F\xDB\x9C\xBE\x1E\xE4\xE6\x81\x9F\x27\x76\x93\xCD\xEA\x9D\x8D\x2D\x55\x2F\x3F\xE2\x3F\xBD\xD7\x6E\xA9\xFA\xE7\x4B\xD5\x80\x81\x1C\x93\x57\x21\x9A\x3D\xA9\x09\x2B\x58\x86\x4D\x31\x19\xA3\x7D\xAF\xCE\x4E\x31\xC3\x62\x22\xDD\x96\xC6\xE6\x5D\x1A\x7B\xD4\xBB\x95\x9B\x5B\x2D\xE6\x56\x2E\x79\x61\x1B\x9E\xC5\x86\x47\x5D\x6A\xD8\xD6\xC1\xD7\xA2\xC0\x56\xD9\x6E\x95\xED\xA3\xA9\x6C\xB7\x75\xF0\xB1\xE4\x7B\xB2\x2D\xD6\x8C\xB6\x58\xB3\x4D\x76\x6B\x51\x60\xF3\xE7\x6D\xB2\xDB\x26\xBB\x6D\xB2\x6B\x99\xEC\xA6\x5C\xEE\xDA\xA6\x85\xF5\x29\xB0\x4D\x0B\xDB\xB4\xB0\x4D\x0B\xDB\xB4\x00\x4E\x0B\x3D\x56\x16\xB7\xA4\xBE\x02\x05\xB6\xA4\xBE\x25\xF5\x2D\xA9\x6F\x49\xBD\x75\x61\x2B\xC6\x27\xEA\xA5\x24\x3C\x82\x2F\x25\x6F\xC9\x7D\x8D\x0A\x6C\xC9\x7D\x4B\xEE\x5B\x72\xDF\x92\x7B\x6B\x72\xDF\xF2\xD8\x96\xC7\xB6\x3C\x36\x57\x1E\x23\xB8\x90\x67\xB5\xA7\x6F\x84\x97\x68\xEC\x77\x75\x58\x87\x70\xAC\xA5\xE0\xEA\x5E\x9E\x2D\x5D\x6D\xE9\x6A\x15\xF6\xD8\xD2\x55\x93\xAE\x3A\x2E\xFB\x6D\x91\xBB\x45\xEE\x16\xB9\xAB\x8B\x5C\xDB\xCC\xBE\x85\xEC\x16\xB2\x5B\xC8\xAE\x23\x64\xB7\x4A\x78\x0B\xCE\x35\xD9\x63\x0B\x4E\x21\x38\xF9\xBB\x1B\xCD\x5D\x12\x61\x56\xC8\x1D\x06\xD0\x85\x9C\x00\xC6\x6D\x92\x44\x18\xC5\x30\xD8\xED\xE2\x4D\xA5\x9B\x70\xF9\xA6\x02\x21\xF8\xF2\xEA\xEA\xD3\x3B\xFE\xBF\xAF\x97\x2F\xD8\xEF\xCF\xCC\x74\x1F\x43\xEC\x63\xE5\xF1\xBC\x41\xFF\x90\xD2\x30\x89\x33\xED\x56\x34\x23\xFD\x1F\x9C\x81\x01\xAF\xF5\x22\x50\x05\x5F\x35\xB1\xF1\xC2\x53\x19\xDC\xC5\x7A\xDA\xBD\xA5\x62\xB3\x9F\x1C\xD3\x30\x02\xAE\x7A\xD3\x29\x34\x26\xF8\x88\x08\x0D\x51\xF4\xAF\xA2\xF9\xBD\xBB\xB1\x8D\x63\x70\x4D\xF6\x02\x67\xE9\xB6\x39\xF6\x4D\x09\x48\x96\x9C\x5D\xD6\x5F\xD1\x00\x05\x86\x7D\xD0\xF1\xC2\x56\x11\x99\x0F\x92\xD9\x54\xA6\xB7\x57\x6D\x1D\x1C\x5E\x66\xED\xC2\x2F\xB3\xF3\x2B\xBF\x9D\x64\xC1\x28\xFD\xC3\x4A\x43\xC9\x61\x03\xB6\x3F\x27\x4F\x72\xA2\x83\x3D\xD5\xF6\x3E\xF5\x49\xA8\xBD\xDE\x58\x44\xE4\xD6\x62\x63\x16\xA9\x56\x6C\x16\x36\x19\x2F\x59\x27\xCC\xC6\xBB\x43\xC5\xF5\xB3\x3B\xC5\xFC\x83\xB3\x94\x43\x0E\x28\x3B\x67\x1F\xA3\xAA\xE6\x64\x97\x50\xCC\x62\xA1\x59\xAF\x00\x70\x9B\xED\xF5\x62\xC3\xD2\x6F\xD4\xA2\xD6\x89\x8F\x50\xDC\x5A\xF0\x79\x3D\x04\xD5\x60\x86\x4A\xC8\x80\xDA\x5E\x03\x39\xF2\xC8\x4C\x3C\x26\x76\x80\x45\xEF\x9C\x68\x51\x78\xF4\x23\x6B\x0B\xD7\x6C\xFE\xB0\xF3\x6A\x5B\xF9\xB6\x46\xB3\x6C\xE5\xDB\x56\xBE\xAD\x60\x70\xB6\xF2\xCD\xBD\x7C\x33\x9F\x59\x9C\xD9\x6F\x95\x09\x6E\x46\x33\xCC\x38\xCD\x2F\xAF\xF2\x13\x73\xB1\xD1\x6D\xBF\xF5\x7C\x4B\x8F\xAD\xDE\x78\x2C\x53\xCB\x56\x6F\x6C\xF5\xC6\x0A\x06\x67\xAB\x37\x7E\xF6\xE5\x22\xFD\xE0\xC3\xF6\xBC\xBE\xBC\xF4\xDB\xFC\xB9\xCD\x9F\xDB\xFC\xB9\xCD\x9F\x8F\x69\xFE\xDC\x9E\xD7\x7F\xC2\xE7\xF5\xAD\xBC\xD8\xCA\x8B\x33\x9C\x49\xB6\xF2\x62\x2B\x2F\x56\x30\x38\x5B\x79\xB1\x95\x17\x5B\x79\x61\x2B\x2F\x16\xBE\x1A\x6D\xAB\x3D\xB6\xDA\x63\xAB\x3D\xB6\xDA\x63\xAB\x3D\xB6\xDA\x63\xAB\x3D\x7E\xB2\xDA\x43\x74\xC5\x05\x6F\xF0\xDB\x6A\x90\xAD\x06\xD9\x6A\x90\xAD\x06\xD9\x6A\x90\xAD\x06\xD9\x6A\x90\x9F\xB8\x06\xD9\x66\xDC\x33\x4E\xAE\xDB\x8C\xBB\xCD\xB8\x2B\x18\x9C\x6D\xC6\xED\x32\xE3\xDA\x2E\x1B\x6D\xEE\x6E\xD8\x85\x71\xE0\xA1\x28\x2A\x25\xF3\xB2\xFC\xB6\xE5\x76\x0D\x6B\x8F\x38\x3F\xDE\xE2\x42\x8D\x07\x2F\x8C\xA9\x5B\xAF\x2E\xD7\x74\x18\xC9\x68\x37\x77\x18\x31\x9D\x2E\xF3\xB0\x2A\x89\x08\x41\x4E\xAC\x8E\xF8\x98\x61\x27\x2B\x94\x57\x4F\x38\x60\x36\xAF\xA1\xB2\x9B\x45\xDA\x5F\x78\xD5\xEC\x69\x6C\x14\xEE\x1A\x89\xFD\x43\x42\x84\x56\x81\xBC\x74\xE7\x48\xFD\xDD\x2E\x07\xC9\x77\x79\x14\x91\x3C\x76\xF2\xA5\x62\x68\x68\xE2\x8A\x5D\x0F\x8A\xF7\x3D\xA4\x07\xCF\x47\xA9\x6B\xAF\x23\x0B\x2A\x57\xEC\xB2\xAD\x0C\x44\x1C\x74\x93\x0D\xA5\x29\x8E\x9D\xFA\xB4\x5C\xDC\xE2\x12\x4B\xB6\xFB\x5A\x8C\xFD\xD5\xCF\x50\x6F\x65\xDB\x59\xCF\xD0\x5B\xD9\xB6\x95\x6D\x2B\x18\x9C\xAD\x6C\x1B\xA9\x6C\x9B\xEA\xD2\xE5\x2D\x7B\xAF\xD1\x2C\x5B\xF6\xDE\xB2\xF7\x0A\x06\x67\xCB\xDE\x13\x64\xEF\x51\x2E\xDE\xDE\xD2\xF6\x1A\xCD\xB2\xA5\xED\x2D\x6D\xAF\x60\x70\xB6\xB4\x3D\x56\xDA\xEE\x7F\xF9\xFA\x96\xA0\xD7\x68\x96\x2D\x41\x6F\x09\x7A\x05\x83\xB3\x25\xE8\xB1\x12\x74\xB9\x6A\x1D\xA7\x24\x8C\xE9\xCE\x7B\xE6\xDD\x57\x7F\x5F\x34\x7F\x3E\xF3\x62\x9A\x20\x6F\x97\x90\x23\xA2\x52\xFB\x8E\x26\x48\x6A\xC0\xAC\x41\x40\xAF\xF6\x71\x18\xEA\x33\x2F\xC9\xA9\x47\xF0\x7D\xF5\x93\xA3\xB3\xBF\x2B\x3C\xCC\x00\x9C\x30\x16\x00\xBB\x92\x05\xDB\x13\x60\x52\xEF\xBE\x93\x90\x62\xB1\x21\xCD\xA9\x2F\xFC\x66\xFF\x6F\x7E\x7B\x17\xF5\x9F\x62\x23\xDF\xC6\x10\x77\x34\x76\x04\x73\xB2\xC5\x1F\x17\xBE\x06\x2F\x5B\x4A\xC1\x08\x6E\x10\xCA\xBF\x2F\x32\x4A\x68\x12\x3D\x0B\xB3\x2C\x45\x3E\x6E\x7E\xA2\x28\x3D\xA0\xE6\x67\x9E\xA6\x98\x5C\x1C\xF1\xF1\x98\xDC\x63\x91\x83\xD8\xC4\x84\xF0\x8E\x69\xE0\xDD\xA2\x0C\xA3\x20\x10\x34\x64\xCD\xD9\x21\x21\x14\x68\x2F\xD0\xC3\xD8\x27\x50\x7B\x96\xDF\x82\x64\x8E\x79\x04\xA1\x5B\x9A\xAB\x71\xAB\x49\x04\xE1\x3D\x84\x1B\x84\xF7\xC7\x04\x94\xB1\x84\x14\x3F\xB9\xF6\x2A\x64\x57\x79\xA4\xDA\xCE\x1C\x00\x40\xCF\xA9\x4E\x44\x35\xC0\x21\xDC\x51\x50\xA9\x12\x52\xFC\xCC\xC3\x98\x7A\x7F\x61\x92\x28\x50\xCD\xA4\x95\xED\x3C\xD1\xFD\x7C\x42\x7F\x15\xBD\x33\xA6\x5E\x10\xEE\x2E\x85\xA6\x8C\x06\xDE\x2E\xA6\x40\x0B\xA3\x1A\xC6\x21\x2D\x7E\x79\x29\x22\xE8\x98\xD5\xC0\x8A\x12\x6B\x08\xE3\x7B\x80\x46\xD5\x6A\xA4\x53\x21\xD4\xB4\x76\x49\x4E\xBC\x8C\xE2\x54\xA1\x26\xB7\x37\xF4\xBE\xFF\xCA\x8A\x38\x08\xBE\xC7\xF4\x1B\x26\x31\x8E\x14\x60\x16\x9E\xEA\x1F\x17\x4C\x00\x03\x4F\x1D\x56\xB4\xB4\x74\x57\x58\x1B\x10\x24\xD9\x8B\x86\xBB\x0C\xD3\x32\x1B\xB3\x31\x2F\x7E\xEE\x22\xB4\xCF\x8C\xD0\x18\xEF\x11\x0D\xEF\x8D\xDD\xB3\x14\xFB\x21\x8A\x34\x30\x0F\x7B\xB0\xD7\x1D\xC1\x59\xF8\x97\x91\x22\x26\x24\x21\x26\x60\x10\xEE\x43\x0A\x4B\x7B\xB7\x0B\x63\x14\x55\x84\x69\xE2\x65\x7E\xC8\xCD\x50\xFC\xCD\xF0\x2E\xE4\x9F\xAC\x5B\x91\xB6\xB8\x0A\x20\x30\x46\x31\x04\x10\x62\x57\xEB\x51\x59\x0C\x84\xDE\x19\x08\x1E\xB3\xEF\x09\x09\x20\x48\xD1\xEE\x95\x7A\x2B\x60\x06\x6A\xD1\x2E\x8C\x77\x85\x1B\x68\xE2\x08\x01\xDD\x34\x2A\x91\xAE\xD2\x6A\xB2\x83\x00\xE1\x29\x91\x8D\xCF\xF7\x90\xFA\x87\x02\x16\x3C\xC4\x02\x2D\x1D\x56\x79\x17\xB3\x86\x19\x9C\x26\x59\x58\x3B\x9F\x82\xC2\x8F\x71\x98\xFB\x06\x0F\x31\x3A\x86\xBE\x17\x20\x8A\x18\x5A\x39\x5D\xC1\xFC\x21\xA0\xC4\x9D\x8F\x8F\xA2\x14\xB7\x88\xD2\x58\xE7\x51\xD1\x34\xA5\xCF\x2B\xA8\x55\xAB\xA6\x85\x06\x15\xE4\xBB\x90\x42\x41\xA1\x58\xF0\xF5\x13\xBC\xDB\x19\xDB\x05\x6A\x9C\xCB\x11\x9D\xA0\x1E\x4D\xBB\x41\x3A\x09\xAE\xCA\x57\xF8\x1D\xC5\x7B\xAC\x4D\x1E\x0C\xA0\xFA\x46\x9D\x46\xCC\x00\x55\xEC\x2A\x51\xE8\x3D\x78\xB3\xA6\x66\xC6\xD2\x45\x6D\x50\x39\x5B\xD4\xBF\x78\xC2\xD8\x85\x27\xAF\xF2\x0C\x05\xE4\x1F\xB0\xFF\xCD\xC3\xA7\x54\x01\x72\x1E\x6C\xBE\xF4\xC2\x98\x1D\x61\x86\xBA\x57\x65\x8A\x02\x53\x8C\x54\xF2\x37\x35\x8B\xBA\x69\x00\x79\xA4\x4C\xFD\x1A\x60\xAD\x90\xCA\xAD\x01\x68\xFC\x64\x50\xED\x09\x10\x50\x98\x22\x14\xA8\x91\x15\x37\xA3\x86\x0F\x59\x58\x41\x61\x3F\x51\x9A\x46\x0F\x1E\x49\xF2\x38\xF0\xF0\xC9\xC7\x59\x06\x51\xAA\x03\xE2\x02\xA0\xAB\x86\x82\x02\xAD\x26\x5F\x8F\xC4\x01\x88\xA0\x3B\x1F\x40\xA0\x29\xB0\x8C\x34\x80\xA8\x33\x73\xE2\x43\x9A\x61\x4A\x49\x98\x46\x92\x4F\x35\x8D\xBA\x64\x98\x7A\xE1\xAF\x97\x9A\xC6\x65\xB3\x11\x5F\x89\x29\x6E\xE2\xBB\xC2\x28\xB9\x1C\xE0\x0A\xA0\x49\x02\x2A\xA4\xA4\x28\x5A\x44\xAB\x3F\xA5\x66\x61\x0A\xA8\xDB\x80\xA1\xA9\xB0\xF5\x84\x20\x74\x51\x07\x63\x5F\xAA\x29\xCB\xC8\x61\x7E\x92\x3E\xA8\x32\xB1\x36\xC3\x90\xD5\x30\x35\x49\x96\x10\x51\x0D\xB5\x50\x17\x5B\xEB\x2E\x5A\xAB\xC9\x4F\x22\x98\x6D\x09\x53\x1E\x02\x2E\x0C\xD1\xA3\x24\x2E\x13\x96\x32\xE2\x00\x86\x21\x3B\x19\x30\x75\x63\x1D\xCB\x00\xF7\x8F\xE9\x45\xF5\x87\x96\xB4\x04\x24\x2F\x43\x47\xEC\xA1\xE0\xFF\x8A\x6C\x0D\x35\x36\x9A\x15\x24\x85\xF0\x82\xE3\x1F\x1C\x00\xD0\xE5\x4C\x1E\x67\x71\x38\xA1\x8F\x31\xEA\x61\xBB\xA0\x58\x2D\x4B\x58\x93\xC6\xBD\x6A\x04\xC8\x2B\xF8\x3A\x40\xA9\xBC\x8B\x66\x6E\x50\x94\x6A\x88\xBC\x7E\xAF\xC0\xDA\x00\xA1\xD4\xE4\x08\x15\x48\x9F\xA2\x50\xFA\xAC\xC9\x61\x9C\xA1\x36\xF3\xDF\x41\x93\x7E\x62\xB4\x68\x62\xB0\x66\xD5\x43\x56\x38\x21\x8A\xBE\x0D\x9A\xA0\xEE\x1D\x0A\x02\x60\xAD\xA1\x6A\xD6\xE6\x36\x11\x20\xCD\xAF\x22\x00\x30\x14\xD0\x4F\x07\x8A\x8B\x28\x06\x48\x96\xDF\x0A\xEE\x15\x83\xFE\x1D\x03\x15\x91\x88\x5E\xEA\xA3\x75\xA8\x2D\xA5\x21\x2B\xF5\x51\x09\x87\x22\x2E\xD6\x07\xF4\xA4\x8F\xFB\x09\x1A\xF8\x93\x79\xE4\x4F\xA6\xA1\x3F\xC1\x63\x7F\xD2\x06\xFF\xA4\x8E\x3E\xB7\xEE\x6D\xA6\x5A\xB0\x68\xD2\xCD\x57\x23\x1E\xC3\x38\xCF\x94\xB6\x34\xAA\x9A\x18\x54\xA5\xC8\x1B\x75\x9A\xBC\x5D\xAD\xE0\x1B\x0A\x72\xB5\x5B\x30\x51\x29\xB3\x36\x9D\x30\x6B\x56\xE8\x36\xDD\x65\xB2\x28\x08\x34\x0B\x04\x01\x64\x81\x40\x4F\x59\x01\x94\xB2\xAA\xDE\xA5\xEB\x2A\x6C\x64\xEE\x75\x88\x09\x1E\x5C\x79\xBB\xEC\xBE\x52\x88\x4A\x7D\xE5\x74\x5D\xF5\x96\xB8\xD7\x6C\x64\xEE\x41\x78\x5F\x22\x07\xE1\xFD\x45\xFD\x97\x20\x91\x27\xE3\x55\x22\x35\xCD\x6A\xDA\xA8\xBA\xCB\xA9\x81\x11\x68\x92\xA1\xC2\x49\x4A\x2F\x55\xAB\x92\xA5\xEA\x66\x20\xB3\x28\x3C\x15\x88\xB4\xEE\xA9\xB6\x37\xCB\x8F\x10\xC4\x8B\x35\xD8\x11\x78\x3C\x10\x01\xE2\x9A\x47\xDD\x4E\x09\x0A\x23\x56\xBD\xAB\x10\xF0\xD9\xA0\x81\xD6\xC3\xA5\x89\xC4\xE1\x31\xFE\x6E\x00\xB1\xC7\x9B\x98\xE2\x13\x05\x10\x80\x35\x55\xA9\x33\x60\x64\x0D\x47\x33\xB6\x84\x01\x18\x5D\x87\xDF\x1D\xF3\xC8\xC3\x27\xE4\x9B\xE4\x28\xAD\x63\xEB\x6F\xEA\xD9\x66\xB9\x22\x34\xAC\x8A\x19\x99\xF2\xA2\x8F\x26\x1E\x5B\x2C\x20\x08\x12\x41\x5B\x0F\x6F\x20\xCA\x8A\xB8\xD0\x45\x5A\x13\x97\x99\xD6\xD5\xA3\xAE\x48\x3D\x53\xEA\x20\x39\x82\x81\x81\xBF\xB3\x63\x43\x11\x2B\x0F\x4D\xA4\x03\x0C\x01\x6A\x74\x9B\x3B\xB3\xC7\x48\x20\x28\x52\x25\xA0\x1E\xAC\xB5\x48\x7A\x58\x82\x83\x7D\xC7\x76\x4B\x14\x5B\x14\x6D\x40\xEE\x03\xF6\x5B\xEA\xEE\x3A\x51\xF6\x57\xE1\xED\x97\x5E\x84\x2F\x45\x74\x61\x6F\xA6\xC1\xAC\x36\x2B\xD4\xF6\x72\x47\x47\x61\x07\x59\x5C\x11\x05\x80\xF8\xA0\x8C\xDF\x00\xAE\xBB\x18\x92\xA5\xC0\x64\xEB\xFC\x8A\x30\x52\xDA\xFE\x06\x98\xE9\x1B\x24\x01\x6B\xE4\x34\xBF\x27\xE4\x5B\xF3\x74\x5E\x02\x10\x41\x34\xCB\x6F\x91\x47\xB0\xD8\x43\x8A\x33\xDE\x22\xC4\x57\x89\x52\xC7\x15\xFB\x2D\x2E\x4D\xC5\xD0\x6E\x5A\xD9\x2A\x91\xAE\xDA\x04\xE2\x35\x5A\x4D\xBE\x6C\xD1\x49\xA9\xCA\x56\xCD\xFC\x19\x5A\xA2\x16\x53\x0F\xE5\x34\xF1\x93\xF8\x3E\x89\x72\x95\x57\x4C\x3D\x18\x22\xBA\x51\xD9\xE4\x13\xFA\xEB\x85\x34\x52\xD0\x40\xB0\x76\x68\x30\xF8\x7E\x8C\x61\x40\xF8\xBE\x94\x6A\x7B\xDE\xAA\xD8\xBF\x44\x95\xC6\x80\xB5\x41\x82\xC8\xE3\xCC\xBC\x4B\x76\x3A\x96\xF1\xE5\x50\x95\x13\xBD\x9E\x9D\xB5\x80\xD6\x31\x80\xF0\xD6\x91\xD4\x60\x07\xC8\xA8\xE9\xD2\x20\x8B\x38\xA9\x99\xA4\x01\xD6\x03\x39\x3A\x3E\xAA\xF5\x62\xD1\xA4\xD7\x8B\x45\xAB\xB6\x6E\x7F\xD4\xEB\xC5\xA2\x51\xC1\x11\x93\xA4\xC2\x55\x31\x76\x3D\x7F\xAB\xF3\xB1\x00\xB1\xF7\x03\x52\xA8\xD0\x4F\x96\x54\xB0\x94\x71\x2A\xD6\x9A\x4F\x76\x54\x4A\xF2\xD8\xB7\xA3\xEC\xA2\xA4\x7A\x98\x32\xA1\xF8\x38\x8C\xAC\x18\x45\xF8\x84\x71\x91\xBE\xD5\xA5\xFF\x06\x10\x25\xFB\x5F\x9E\x73\x7A\xF8\x94\x26\x84\x7A\xF9\x2F\xFF\x50\xC7\x50\x80\xC8\xDD\x41\xB0\x60\x3D\x05\x22\x3D\x02\x83\x30\x02\xC2\xA4\x11\x11\x60\xF2\xEC\xCD\xA0\xE1\xD1\xA4\x84\x00\x11\x94\x16\x5A\x35\x4E\x0A\xCC\x0C\x01\x1E\x9D\x61\xBA\x20\x5C\x9A\x7C\x3D\x9D\x43\x03\x2F\xAA\x2E\x88\x3A\x50\x77\x2A\x0B\x7E\x52\x4A\xD5\x32\xAC\x0C\xAD\x53\xAC\xD2\x5C\xE6\x58\x15\x99\x25\x59\xB9\xB1\x62\x2A\xE6\x55\x49\x1A\x09\x20\x17\x19\x32\xAC\x9A\x62\x94\x1E\xCA\xCC\x6C\xA0\x87\x82\x80\x26\x00\x45\x36\xFF\x19\xFA\x64\xF9\xED\x8E\x24\xC7\x0B\x7D\x52\x30\x2A\xD0\x1C\x22\x80\x95\x68\xE0\x55\x4D\xA3\x83\x41\xA9\x2A\x88\x6E\x01\xD3\xBC\x65\x13\x0C\xB2\x86\x8C\x51\xEB\x7E\xD4\x0F\x87\x68\x9B\x93\x0A\x98\xFB\x68\x19\x23\xE2\x89\x0C\xF1\x00\x8A\xD8\x4C\x09\x8A\xB3\x34\xC9\xB0\x97\x26\xDF\x2F\x65\x18\xC4\x41\xC6\x68\x8E\xBA\x68\xFD\xE4\xA3\x1E\x06\x51\x34\x10\xC8\x52\xC3\xAA\xD9\xC2\xFD\x2D\xAC\x15\x75\xE5\x9F\x82\x60\x0A\x20\xBB\xCB\x11\xC1\xAC\x11\xEC\x98\x7D\x67\x87\x90\xA3\x1D\x49\xBE\xC3\x18\x20\xD9\x2A\xC4\xD5\x66\x1E\xE2\x1A\x72\x11\xE2\xAA\x24\x95\xCB\xEA\x12\x88\x23\xAE\x03\x85\xB2\x0F\x82\x1A\x89\x96\x47\xDF\x20\x50\xA5\x0D\x04\xE2\x1A\x81\x9D\x98\x56\x3A\x40\x7F\x61\xBF\xE5\xAE\xC7\xB2\x87\xC3\x8B\xA4\xF2\xF5\x08\xE6\x37\x97\x9A\xF3\x7D\x0A\xD1\xBF\xDF\x7E\xFD\x7B\xD0\x83\x74\xD5\x4F\x67\xE0\x79\xFE\x09\x79\x69\x4E\xB0\x77\x1F\x12\x9A\x4B\x35\xE7\xC4\x87\x53\x65\xB2\x33\x7F\x06\x4D\xB0\xD7\x63\x56\xB3\x0A\xA8\x47\xAC\xE2\x4C\xBE\x5A\x45\xD5\x7F\x3D\xD2\x11\x5C\x4A\xBF\x39\x03\x71\x49\x1D\x59\xBA\x7D\xB4\x1A\xCE\x14\x84\xFC\x9C\x1F\x34\x03\x16\x9D\x39\x1F\xF1\x92\xC4\x89\xC4\xE0\xD7\x0E\xB5\x88\x31\xBD\x35\x9C\xC4\x98\x35\xC0\xDC\x24\x9A\x2B\xA5\xB9\xDB\x67\x9E\xE0\x74\xB6\x4E\xF1\xC4\xB7\x12\x69\x66\x0A\xEC\x5A\x18\x5F\xBE\x40\xCE\x87\x2E\x56\x5B\xC0\x83\xDC\xC4\x5A\x24\xD4\xDC\x45\x9B\xD9\xCB\xDD\x04\x5B\xD8\xC1\x7E\xAB\xEE\x09\x5C\x54\x82\x55\x0D\xC9\xF4\xA6\x48\xF3\xEC\xE0\xDD\x22\xFF\x5B\x2D\xD2\xBC\xB1\x03\xF1\x9F\x2B\xA5\x98\x74\x9F\x27\x38\x21\xEE\x33\x45\xA0\xE7\xA1\xAC\x70\x35\x0F\x9F\x28\x26\x31\x8A\xBA\x64\x7B\xBE\xF6\xB3\x5E\x11\xE7\xF4\xDE\x41\x86\x9C\xC5\xC7\x87\xD9\x71\x9E\x48\xE8\x2F\xE3\x5C\x33\x16\x13\xCF\x59\xAA\xF5\x1A\x6C\x39\x53\xCD\x38\xB9\x5B\x24\xF8\x79\xC7\xC5\x4F\x8E\x29\x22\xC6\xE7\x75\xCB\x83\x47\x8B\xE8\x15\x82\x7E\x93\xCC\xD9\x6A\xC2\xB3\xCA\x7D\x12\x06\xCA\xB5\x1E\x59\x42\xA8\x74\x87\x44\x84\xB3\xEC\x25\xBB\x2B\xDA\xE7\x97\x46\xBF\x7A\x52\xFF\xF9\xF4\xD5\xD7\xCB\x17\xC5\xBF\x4D\x8B\xAA\x9F\x81\xC0\x6F\xCF\x04\xE1\x18\x50\x93\xE2\xEF\xC3\xC5\xB0\xFF\xD5\x2E\xE4\xA2\x06\xBA\x4D\x92\x48\xC1\x0C\xE3\x0C\x13\x1A\x26\x31\x93\xC2\x0B\xE3\xC2\x51\x22\x4C\xF1\x1C\x02\x2D\x6A\x8C\x05\x79\x5F\xAC\x6D\x20\xCE\x23\x74\xD8\x35\x30\xAF\x43\xFA\x99\x22\x8A\xAF\xAE\x3E\xE6\xEC\xF6\x97\x1A\x4F\x9B\xB9\x5C\xAE\xC6\xED\x4A\xB3\x2A\xE5\x07\xC8\xA2\x5F\xF4\xD8\x95\x18\x4F\xB5\x4A\xAF\x2F\xE4\xE1\x33\x46\xC4\xB7\x77\xED\xC8\xAA\x1F\x93\x66\x07\xB6\xBF\x8C\x1F\x49\xB2\xBF\xBA\x7A\x77\x4C\xE9\xC3\x4D\x84\xF6\x59\xFB\x47\x0D\xDA\x64\xAF\x39\xB7\xD0\x69\x01\xF3\xD8\x95\xFF\xB2\x7E\x0F\xA1\x8F\x1F\xAE\x41\xD6\x56\x3F\x5D\x4C\xC8\xFA\x86\xA2\x75\x88\xD3\xC7\xC9\x57\x23\x7C\x51\x80\x1E\xC8\x6A\xC4\x11\x62\xFF\x23\xC1\xBB\xF0\x74\xED\xFB\x38\xF2\x6E\x48\x12\xD3\xEB\x38\x78\xCD\x57\x7E\xCA\xB9\xBB\xE5\xF1\x60\x2D\x3A\x09\xA9\x90\x6B\xC6\x25\xA9\x24\x1B\x2C\x91\x40\x59\xFB\x48\x0B\x6F\x66\x9F\x85\xF9\x9F\x30\x0E\x7A\xB8\xF3\x52\x66\x3B\x1F\x83\xB5\xE7\xCC\x37\xFC\xFB\x42\xE4\xEA\xEA\xBA\x78\x38\xFB\x3D\xCE\x68\x95\x1C\x3A\x4C\x0F\x56\x2A\x62\x4E\x6C\x43\x6C\x2A\x18\x57\xC1\xFA\xE8\x25\xB8\x7D\x83\xF7\xA3\xFA\xF3\xEB\xE5\x0B\x25\xDE\x7F\x14\xFF\xF0\xE6\xB6\x5E\x5D\x24\x03\x39\x7E\xC2\x7B\x7C\x4A\xAF\xAE\xFE\x44\xD1\x37\x4C\x5E\xB2\xB6\x1B\x82\xF6\xAF\xAE\xAE\x7E\xF0\x36\x51\x10\x57\x6C\x40\x2E\xF5\xE4\xDA\x60\x82\xBD\x49\x89\x05\x76\x80\xEF\x72\xCC\xCE\xCC\xF2\x0E\x05\x22\x0B\x2D\xA1\xBF\x79\x59\xC1\xD2\xA5\xBA\x9D\xF1\x87\xC8\xC3\x69\x4C\xFF\xBF\x5F\x9E\xD9\x11\xDA\xFB\x77\xF1\x8A\x37\x88\x56\x69\xA4\x10\x5D\x08\x73\xFE\x53\x2B\x62\x9B\xAE\x9F\x69\x31\x95\xAB\x7D\x79\x56\xFB\x4D\x55\x42\x8F\x8B\x1E\xE4\x78\x7C\x14\x54\x8A\xFF\x87\xF4\x3A\xA2\x72\x9A\xA8\xCB\x0C\xB5\xAD\x23\x37\xA3\xCE\xFF\x9B\xE3\x0C\x30\x58\x6F\xA5\x5D\xE8\xA9\x5A\xBF\x4F\x52\x40\xEB\x51\x48\x0F\x30\x28\x97\xAA\x97\x11\x94\xAE\x3D\xF5\x7D\xFD\x40\xF1\x27\x14\xEF\xB1\x58\x6E\xD6\x7F\xF4\x1E\xA1\x0E\x64\x55\xC1\xED\x5D\xDD\x4D\x5B\x7D\xCC\x4E\xAC\x4B\xBA\xA8\x00\xF5\x57\x65\x95\x71\x54\x0A\xEC\xF1\xF3\xCF\x30\xA0\x75\xFD\xC3\x5A\x3E\xA4\xBD\xE4\x69\xA7\xA6\x4A\x67\xE9\xE1\x64\xC1\x37\x28\xA5\x39\xC1\x7A\x34\xF4\x35\xA9\x13\x41\x55\x8B\xA6\x93\xFB\xD8\xB7\x31\x32\x66\xAA\xD7\x78\x1F\xC6\x95\xF7\x75\xAD\x15\xFE\x1D\xFB\xC8\x3F\xE0\xE0\x53\x1E\xE3\xC2\x8B\x3F\xE7\xBB\x5D\x78\x92\xA3\xB0\x59\x93\x07\x1B\x9B\xEA\xB6\xAF\x8D\x27\x13\x62\xAA\x38\x9D\x42\x60\xE8\x10\xBF\xF2\xD5\xEA\xF2\x32\xEA\x90\xF2\xF1\xD5\x21\x71\x12\xD8\x2F\xE3\xD7\x0A\x6D\x61\xF3\x23\x8C\x69\x59\x02\x31\x67\x79\x55\xDD\x0F\x5E\x48\xFA\x0A\xBA\xB8\xBC\xFD\xEE\x7F\x37\x76\x22\x05\xF0\xB2\x7E\x1B\x99\x31\xD9\xB3\x3B\xC8\xE1\x4E\xE6\xBB\xD2\xAD\xF8\x1D\x2E\x9F\x9F\x4B\x49\x37\xC1\xBB\x18\x65\xC0\x65\xEA\xED\xC2\xB7\x7F\x3C\xDF\xCD\x70\x69\xF1\x14\xFB\x3D\xCC\xB0\xC7\x9E\x8B\x49\xEE\x53\x8F\x1A\x3F\x17\x4F\xF3\x34\x32\x4B\x57\x76\xD2\x74\xE6\xBD\x4A\xA1\xF5\x87\x5A\xB9\xF7\x1C\x02\x3E\x31\xF4\x2B\x3F\x4D\xDF\xED\x4B\x7A\x5B\x32\xDA\x92\xD1\x96\x8C\xB6\x64\x34\x51\x32\x12\x47\xA6\xE5\xFD\xCD\x2D\x29\x6D\x49\x69\x4B\x4A\x5B\x52\x9A\x37\x29\x6D\x11\xBD\x45\xF4\xDC\x11\x6D\xF9\xE2\x93\xB6\x1F\x15\x04\x7C\x19\xE2\x13\xF6\x73\x92\x85\xF7\xFA\x22\x87\x65\x11\xC9\xA9\xB7\xD2\xE7\x26\x8C\x03\xF3\x8A\x4A\x3F\x01\x3B\xAF\x1D\xB9\x53\x1D\x71\x09\xDC\x89\xE9\x92\x55\xC9\x56\x8A\x6C\x89\x6B\xC1\xC4\xB5\x0B\xE3\xC0\x2C\x46\xFB\xBC\x3F\x62\x94\x8F\xB5\xE4\xDB\x2B\x7B\x39\xF4\x51\xF9\xB4\x24\x55\x73\x06\x6F\xEB\x68\xDA\xED\x7A\x57\xB8\x58\xBB\x5C\x6D\xF8\xD6\xA9\xE5\x53\x1E\xF7\xD8\xB1\x13\xFA\xFD\xFB\xCB\xCD\x0B\x5B\xDF\x29\x78\xFE\x81\x68\x18\xFF\xD2\x97\x6B\x9B\xC4\x00\x67\xEF\xC5\x73\xEF\x97\xE7\xBB\xDD\x6E\x07\xEF\xFF\x77\x23\x9F\xC7\x98\x26\xFE\x01\x91\x91\xA5\x1C\x65\x4C\x5A\xF9\x3A\x79\x53\x2B\x95\x6D\x0A\xDE\xA6\xE0\x6D\x0A\x1E\x6D\x0A\xEE\x9D\x36\x26\xD8\x2F\x1D\x29\x2F\x6C\xEB\x87\x5B\xC6\xD8\x32\xC6\xB6\x7E\x38\xCD\xFA\xE1\xC8\xA5\x57\xE7\x87\x89\x41\xFC\x5C\x96\x5E\x3A\x52\x1F\x77\x09\x66\x20\xF3\x11\x9F\x0C\x3B\x3C\x33\x0C\x33\xB3\x2B\xFD\x95\xEA\x3A\xD0\x85\xFB\x6A\x3F\xCC\xCD\xD4\xC7\xB2\x5E\x23\x08\x13\x99\x70\x98\xDA\xA4\x9E\xA7\x24\x6B\xB5\x5D\x3F\x8F\x70\xB3\xE6\x80\x61\xFF\x83\x55\x80\xD2\x32\x47\xEF\xF8\x6D\xA3\x35\x95\x13\xD8\xF8\x1A\x17\x07\xDC\x15\x6F\x7D\x9F\x40\x25\xFD\x31\xC9\xE8\x7F\xC2\x2C\xAC\xBB\xF1\x17\x39\x9E\x6A\x3D\x6D\x3F\x81\x17\xB7\x80\xE3\xE5\xF3\xB3\xB6\x9F\xAA\x9E\x9E\xBF\xED\xA4\xF5\xFC\xD2\xAC\xD0\x37\xDA\xE3\x74\x2A\x19\x46\x4C\x4B\xD3\x9B\xC9\xFA\xB6\xCC\xFC\xE2\xD8\x5F\x6D\x99\x5F\x1E\x73\x7A\x9C\x41\x16\xE3\x9A\xE8\xF4\x7A\xAB\xEF\x18\x2C\x10\xBF\x8E\x2B\xFA\x0B\xD8\xC6\xE5\xBD\xA1\x65\x0D\xD6\x75\xA9\x7E\x5E\xE9\xBA\x6F\xB4\xCC\x31\x83\x59\xDF\xC6\xD1\x5E\xDE\xE1\x7F\x81\xE2\x34\x65\xB2\xB4\x82\xD0\xEB\x35\xE8\x5E\x7C\x84\x59\xC8\xFC\xC2\xF1\x50\xCA\xCD\xFC\x76\x83\xC2\x68\x6C\x1E\xD5\x3B\xBF\x9F\xC3\x63\x1A\x85\xBB\x87\xB1\xE9\xFF\x9E\xF1\xD7\xE2\x8B\xE9\x4F\x75\x2A\xE0\x1D\xFD\x31\x59\xBE\x63\xD7\xBC\xCE\xC0\xD0\xF2\xDE\x74\xD1\xF4\x7B\x5C\xDF\x45\xD7\x1A\x52\x86\xB0\x1C\x2E\xDB\x5B\xEC\x13\x6C\xD8\xFE\xEC\x45\x1D\xBE\x24\xA0\x2F\x29\xE8\x1A\x81\xA1\xA1\xDF\xFE\xE2\xF6\x68\x91\x69\x7F\x48\xE9\xCF\x67\x40\xE1\x3F\x06\xD3\xB7\x09\x2D\xCB\xD6\x89\x18\xDC\x84\x71\x98\x1D\x34\x12\x93\xF0\x6A\xB9\x03\xA0\x17\x0B\xA1\x68\x74\x4E\x74\x72\x5C\xFE\x1E\xAB\x71\xD9\x91\x50\xC7\x04\xEB\x4E\xDD\x79\x12\xED\xA9\xF9\x9B\x24\xF6\x91\x0D\xBF\xF6\xF0\xAA\xC7\x47\x44\x32\x5C\xDE\xE0\x35\x8C\xB7\x9E\x0D\x7B\xD9\xC5\x90\x61\xBA\xD0\x92\x1E\x3C\xFA\x5A\x52\x2E\xA9\xF4\xF9\x05\x32\x60\x7F\xC7\x90\x48\x96\xCF\x6D\x9F\xAB\xAF\x1D\x49\xF7\xF1\x75\x1B\xC3\x96\xF9\xDA\x35\x6E\x9C\xC8\x74\xAA\x11\x5C\x29\x77\x8E\x98\x4E\x1A\x8F\x1A\x2F\x9D\x38\x9B\xA3\xA5\x83\x45\x5A\x62\xA5\x9D\x12\x18\x29\xDD\x2C\x38\x66\x9C\x74\xE2\x3C\x42\x94\x8C\x5F\x64\x8E\x71\xC5\xD0\x78\xAC\x67\x60\xDA\x6C\x25\xB3\x0B\x85\x26\xBA\xAF\xC8\xF3\x50\x10\xB0\xEF\x0A\x78\x3E\x4A\x91\x1F\xD2\x07\xC7\x0B\xA0\x46\x30\xA6\xFD\xCB\x88\x6A\xCD\x23\xD5\x77\xDD\xD7\x75\x81\xEE\x53\x6D\xB9\x38\xB0\x1A\xB0\xFA\x2B\x53\xB7\x1D\x04\x06\xAB\xD5\x4E\x0F\x1D\x46\x22\x82\x52\x1F\x52\x1A\x1E\xF9\xC7\xBD\x7A\x52\xB8\x89\x10\xA5\x38\xEE\x4F\xA0\xC0\xCE\x29\xDB\xC0\xFC\x17\x32\x6C\xFE\xD8\xE9\x54\x8E\xFE\x09\xDF\xE5\x21\xC1\x01\xBF\x83\xF1\x26\x21\xEC\x1A\xC6\xE9\xBF\xC9\x26\xD4\xEE\x7A\x56\x29\x95\xF8\x92\x94\xEB\x36\x2D\x0F\x5F\x3D\x9E\x0D\x0C\xFC\x3E\xE1\x7B\x4C\x32\x3C\x1D\x5B\xF1\xC8\xD2\x12\x77\xB3\xD9\x83\x61\x3B\x88\xB7\x1D\xC4\x5B\xF2\x20\x9E\xE5\xB5\xBF\x8E\x97\x76\x6C\xFE\xBB\xF9\xEF\x6A\xFD\x77\x4B\xBC\x9B\xE3\x9E\x8F\xE3\xAA\x97\xB3\x2D\xF2\x74\x06\x7C\x59\x6D\x19\x39\xBA\x4D\x43\x8B\xCB\x68\x4B\x35\xCB\x08\x27\xBA\x6C\x96\x46\x21\xF5\x6E\xF3\xDD\x0E\x5B\xA8\x6A\xDF\x0D\x71\x90\xE4\x29\xF0\x15\x41\x33\x32\x3F\xB4\xFE\x13\x5A\x66\x47\x92\x98\x6E\xA6\xA9\x4D\xF3\x64\x73\x19\xBB\x5D\xDA\x1D\x46\x7A\x97\x6E\x69\xFB\xA8\x73\xD7\xCA\x52\x0E\x30\xAB\xAD\x4D\xC2\xAE\x8F\x5D\xAB\x95\xDE\x5E\x74\xAF\x4B\xEC\xC5\xDC\xD6\x71\x3E\x58\xD2\x6F\x5D\x45\x5C\xA9\xE3\xF6\x10\x7F\x15\x9E\xEB\x2A\xF7\xBC\xAE\xDB\x71\xBE\x9E\xDD\x6F\xBB\xCA\xB7\x26\xA7\x1D\x20\xFB\x72\x1E\xDB\x55\xE8\x85\xDC\xB5\x5B\x19\xB5\x9C\xDB\x76\x94\x73\x95\xEE\xDB\x5F\x87\x15\xB8\x71\x47\xE1\x85\x8D\xD1\xB7\x37\xD7\xEC\x7F\x55\xE7\x8F\x24\xD9\x8B\x1B\xD5\xE0\xE7\xAF\xFA\x9E\xD4\x1E\x83\x99\x2A\xFB\x0F\x4E\x0F\xD8\xF3\xD5\xC1\x6D\x1B\xBC\xAC\xC7\x9F\x09\xF9\x76\xF7\x25\x79\xC3\xDE\xFF\x94\xBE\x2F\xD6\x80\x45\xA1\xB5\x56\x6D\xA7\xBA\xA3\x81\x26\x11\x40\xB7\xCC\x04\x6C\x96\xFC\x84\xEE\xA4\x8A\xCD\x60\xBB\x06\x4F\xA6\x0A\x9C\x32\x32\x1C\x85\x98\xC1\x7B\x6D\x71\xD3\x5D\xEC\xCE\x17\x50\x35\xCC\x18\x9B\x92\x41\xFB\xA5\x52\x70\x3F\xA5\xF5\xBF\xD9\xD2\x36\x00\x28\xAF\x74\xB3\xE6\x67\x81\xB8\x78\xC3\x10\x00\x7B\xA1\x0B\xA3\xDE\x2A\xD4\xD7\x9C\xDD\xD2\x4C\x0F\x06\xE2\xEB\x02\x03\x68\x34\xEF\x09\x0C\x77\x9C\x5E\x37\x14\xB5\xF9\x91\xDF\x7E\xEB\xD0\x12\x2E\x65\xBE\x82\xC6\x49\x9A\xA7\xE2\xC5\x31\x36\x37\xB4\xF6\x05\xF7\x21\x7F\xF6\xB8\x1D\xEF\xF3\x44\x9B\x6B\x0E\x72\xCD\x6D\x20\xD6\x33\x10\x93\x7F\x3D\x67\x1B\xA2\x61\x43\x24\xDA\x64\xE2\x6F\x8A\x6C\x43\x35\xDE\x50\x2D\x6E\x93\xD6\x6B\xF7\x3F\xA7\x88\x64\xF8\x33\xA6\x5F\x5E\x16\x43\xFC\x8A\x9D\xF0\xC6\x84\x0A\xE7\xE2\x2D\x1F\xF8\xEB\x4D\xC2\xD0\xD1\x27\x18\x51\xEC\x85\x71\x80\x4F\xCA\x31\x78\xA6\xDD\x75\x10\x7C\x49\xFE\x37\xC7\xB9\xF9\x51\xC9\x5A\x74\xEB\x8F\xD6\xC3\x28\xF6\xD5\x5F\x10\xE0\x53\x1E\x33\x66\x1F\xE2\xD7\x0F\x9D\x9F\x00\x8D\xA2\xF9\xC2\x49\xEC\x73\x92\x72\xF8\x98\xCC\x2B\x34\xE4\x52\x9F\xF2\x98\x45\x21\xC0\x56\x0C\xFD\x51\x5D\xA8\x2B\xC3\xB1\xED\xDC\x8B\xFF\xF4\xE3\x33\x82\x90\xE3\xAF\xD2\x88\x42\xE1\x0C\x53\x46\x5A\x22\xFA\xE9\xCF\x3F\x12\xFF\x1B\x26\x4D\x5C\x1C\x92\xE4\x5B\x76\x75\xF5\x4F\x4C\xDF\xDE\x5C\x33\x29\x58\x2F\xD6\xFF\xBF\x93\xE4\x9B\xF8\xC2\x88\x33\x65\xC7\xD5\xA2\xCF\x18\x11\xFF\x70\x73\x73\x23\x1B\x8D\xB5\x7E\x44\x04\x1D\x33\x46\x8D\x3B\xA8\x60\x84\xDF\xE3\x28\x8C\x71\xC0\x11\xFF\x48\x92\xF4\xE5\x0E\x45\x19\xE6\x56\x51\xFF\x7C\x65\x25\x7E\x31\x25\xF1\xFE\x21\x38\xBD\x54\xDD\x5D\x77\x5A\xA1\xDC\x5F\x7D\x9B\x54\x8C\x6A\x65\x6A\xAE\x01\x68\x0F\xA6\xB9\x44\xE9\xB1\xE2\x3C\x97\x43\x58\xDF\x69\x95\x32\xC9\x97\x89\x32\x49\x79\xB6\x7A\x92\x44\xD2\x4E\x7B\x81\x3C\xE2\x2A\xD4\x9C\x69\xC4\x41\xA6\x19\xB2\x88\x83\x14\x83\x93\x48\x37\xEB\x4F\x99\x43\x3A\x49\x32\x67\x0A\xE9\xE6\x0C\xCE\x19\xE4\xCB\xA8\xB5\x48\x21\xE4\x54\xA5\x48\x27\xDA\x33\x05\x6B\x37\x99\xA6\x0A\xD6\x6E\x52\xF4\x0B\xD6\xDE\xD6\x1F\x3D\x58\xFB\x4A\x32\x79\xB0\xF6\x76\x06\x53\xB0\x4E\x6E\x97\x61\x0F\xCB\x55\x06\x19\xB5\x06\x69\xB4\x18\xBD\x04\xE9\x42\x7A\xF6\xFC\xB1\xE0\x5C\xDF\x49\x88\xA1\xD9\x63\xE1\x99\xBE\xA7\x20\x33\xE6\x8E\x71\xE6\xF9\xA9\xAD\x32\x46\xE6\xF8\x32\xC2\x3A\x88\x92\xF4\x46\xAD\x3D\xFA\xD2\x9E\xF4\xE9\xA5\xB7\x50\xCD\xFA\xEA\x94\x5C\x8E\xF8\xE8\x1F\xC8\xF4\xD6\xAD\xAE\xAE\xC5\xBB\xF0\xC4\x6E\x65\xF1\x6E\x48\x12\xD3\xEB\x38\x78\xCD\x0F\x37\x97\xA7\xF2\xD8\x66\x92\xBE\x7C\xD8\x21\x51\x0E\x93\x73\x9A\x19\x64\x80\x13\x8C\x38\x85\x0C\x71\x12\xD7\x39\x64\x0C\xEB\x8F\x33\x89\x8C\x20\xC9\x34\xB3\xC8\x18\xCE\xE0\xFA\xB8\xF8\x65\x84\x05\x27\x50\xDE\x71\x8A\xBD\x9E\xA4\xE7\x4F\xD8\x4E\x93\xFC\xD0\x7C\xED\x56\xCD\x0D\x49\xD7\xAE\xA6\x5D\x38\x5B\x2F\x5B\xEE\xF7\x77\x80\xA9\x73\xF5\xB8\xE5\xFE\x08\xA6\x9F\x30\x53\xAF\xA0\xDC\x1F\xC1\x11\x9C\xF3\xF4\x08\xCB\x7A\xF2\x43\xC1\x44\x95\x75\xD7\x35\x93\x5E\x39\xB1\xF3\xFA\x58\xE7\x9C\xD8\x63\xED\x65\x89\x9C\xB8\x9A\x25\xD4\xFE\x0E\x30\x49\x4E\x9C\x6C\x01\x75\x04\xD3\x8F\x9D\x13\xD7\xB5\x7C\x3A\x82\x23\x0C\x58\x02\x19\x64\x95\x51\x96\x40\x46\x58\x3C\x85\x94\x18\xBB\x9C\xEE\xB8\x3C\x35\x30\x4B\x4F\x54\xB8\x76\x5F\xE5\x5A\x36\x47\xAF\xA5\x6C\x5D\x6E\x91\xBA\xBF\x73\x0C\x49\xD0\xCB\xD6\xAC\xAB\x5A\xA1\x1E\xEE\x04\x23\x67\xE7\x79\xD6\xA7\xAF\x63\x14\x3D\xFC\x85\x39\x69\xD7\x11\x18\xEB\x0C\x68\x2F\xE6\x93\x9E\xAD\xEC\x25\x91\x4B\x60\xA8\x84\x2A\x4C\xFE\xB5\x81\x8F\x21\xF6\x31\xF4\xBE\x80\x19\xDC\x8C\xA9\xE9\xAF\x52\x5D\x7E\x55\x77\x99\xB8\x45\xC3\xA8\x8E\xA3\x0E\xB2\xB3\x29\x2E\x84\x19\x84\x1F\x36\xAD\xD0\xB5\x17\xFE\xE5\x37\x1D\x7C\x14\x45\x5E\x12\xFB\xE0\x3B\x29\xCF\xEF\x93\x08\xD1\x30\xC2\xA5\xC2\x65\x3C\x55\x7F\x7E\xBD\x7C\xFE\xF5\xF2\x45\xC1\x5E\x88\xB5\x42\x18\xE0\x25\xF5\x9A\x8F\x97\x92\xE4\xF4\x20\xBC\xC3\xC2\x3F\x57\xDF\x41\xFE\xAB\xAB\xFF\xE7\x3D\x7F\x22\x0E\x11\xBB\xE4\xE0\xC9\x93\xEA\xAB\xFC\x95\x28\x4E\x2F\x48\xAD\x45\xD6\x66\x6C\x87\xDD\xDE\x30\x83\x42\xBF\x9C\x91\xF1\xDD\x64\x3D\x23\xE3\x5F\x9E\x91\xF1\xDD\x64\x1D\xCD\xF8\x02\xE2\x5B\x56\x08\x08\xF4\xDE\xDE\x5C\x2B\xCC\x9A\x6B\x4B\x9C\x3A\xB6\x1F\xBA\xE7\x04\x78\x66\x16\x08\xF4\x9E\x5E\x04\xA2\xFC\x53\x3A\x6D\xE6\x50\xE9\x3D\xD5\x26\xA2\x96\x49\xC7\x6D\x64\x1F\x8B\xB6\xEB\x2F\x05\x1E\x8B\xA5\xE5\xB7\x60\xF8\x41\x2E\x14\x46\x39\xC1\xEA\x3B\x30\x8E\xAF\x16\x82\xEF\xA0\xAF\xFB\xB5\xCD\x21\x9F\x4D\x58\xB5\x32\xCE\x77\xE8\xAF\x51\x8B\xB3\xF3\x22\xE1\xA5\xC5\xF7\x45\xD7\xF7\xDA\x94\x29\xDF\x21\x63\x44\x12\xC2\xED\x9A\x10\xF4\xF0\xB2\x41\xFF\x72\x20\x18\x05\x4F\x5F\x5D\x5D\x11\x9C\xF1\xCF\x2B\x89\x4F\x69\x46\x92\xCE\x97\xE3\xB8\x50\x30\x4C\xB2\xC6\xAE\xDA\x8B\xCD\xCE\x5A\xC1\xEF\x45\x77\xE9\xEE\xA8\x76\x57\xC2\xD2\x3D\x3E\x03\xA4\x32\x98\xB2\x2B\x45\xD5\xF5\x7E\xBC\xB7\xDC\xFB\x06\x6F\x1A\xAA\xFD\xC4\xB0\x53\x3F\xC2\x24\x48\xD3\x12\x43\x02\xA6\xF9\x7B\x4B\xAE\x82\xB7\x89\x0C\xE7\x8C\x89\x85\x77\x95\x93\xAD\x0A\x71\x62\x77\x75\x9D\x60\x1D\x66\x75\xAD\x48\xFE\xCE\xA2\xB9\x88\x90\xEA\x18\xA1\x87\x48\x1C\x88\xAD\x95\x4A\x09\xDE\x8E\x3E\x64\x0C\x5B\x3E\x6E\xB8\x52\x33\x74\xFC\x40\xE2\x4A\xB5\x90\xD2\xE6\x4A\x65\x14\x8A\xED\x77\xC7\x94\x3E\x94\xDF\x30\x6D\xAB\xEC\x15\xF2\x86\x6B\xFD\x27\x71\x5C\xFB\x77\x5F\xA6\x61\xD9\xFB\x13\x2F\x93\x8B\xE3\xF8\x35\x97\x69\xE4\xB0\xDF\x7D\x2B\xBB\x9A\x2B\x53\xE3\xE5\xF8\x22\x8E\xE5\x53\x1B\x67\xAA\xA9\x74\xAB\xEF\x23\x54\x15\xBC\x85\xFB\x31\xEB\x69\x1C\xD0\xF6\xAF\xA1\x4C\xA3\xAF\x5A\xFC\x7C\xA6\x38\xED\x34\x07\xF5\x98\xAD\x3A\xCE\x22\xC0\x8C\xB9\x46\x29\xA1\x52\x72\x8D\x72\xAE\xB8\xEE\x10\x2D\x37\xDD\xC2\xA7\xDA\x45\xBE\xA2\xA7\x4F\x91\xB9\x98\xB0\xDA\x52\xCA\x62\x92\xAC\xDA\xE7\xD7\x60\x20\x30\x3D\x2C\x3A\x5A\xDA\x81\x2E\xE7\x33\x5C\x2B\xD0\x60\x91\x47\xE2\x25\xE3\x5C\x9D\x01\x97\x0F\xF4\x95\x4E\x1F\xBD\xDD\x5A\x0D\xD1\xFE\x84\xCA\x03\x99\x03\xA9\xC0\xDD\xFB\x9D\xBA\x14\x68\x71\xCF\x79\xBF\xA2\x9D\x3A\xCD\xB3\x80\x05\xF4\x33\xD3\x60\xA9\xF0\x3C\x33\x33\x35\x0B\xD7\xFA\x9A\x7F\x18\xD3\x57\x85\x12\x96\x63\x8A\xF5\x1F\xE0\xF5\xDF\x63\x51\x34\xD0\xB1\x5C\x2A\x3B\x1D\xD3\xCF\x98\xBE\x3B\x85\x19\x0D\xE3\xBD\x40\xCF\x44\xC5\x24\x4D\xDB\xA6\xF5\x28\xCC\x0D\x5B\x11\xF3\xAF\x08\x39\x7E\x15\x6B\x72\x31\x86\x7F\xF4\x6A\x4E\x11\xBB\x7E\xD3\x6A\x72\xD9\x66\x72\x25\xFB\x92\xDB\x7C\xBE\xD4\x22\xC7\x2A\x9C\xC9\x5D\xC6\x05\xBC\xA9\x45\xB8\x29\xDD\xC9\x6D\x59\x73\x62\x5F\x72\x14\x62\x39\x47\xEA\x2E\xE0\x5C\x5E\xE4\x28\xD9\x2C\x2E\xE4\xB4\x62\x3C\x97\x2B\xB9\x09\xB3\x02\x97\xEA\x2C\xE8\xEC\xAE\xE5\x26\xA1\xF6\x38\xCA\x8B\xFA\x0F\x31\xFE\x88\x32\x87\x1D\xD9\x79\x0B\x7B\x71\x39\xF2\x0C\xC4\x15\xFA\x0D\xDA\xE5\x3E\x17\x7D\x8F\xF8\xE8\xA7\x0F\xA2\xB8\xBF\x67\x8D\xA8\x9D\xCE\x8A\xC1\xDD\xF5\xF1\xD7\x19\x00\x4B\x2C\x2A\x92\xF0\xF8\xD1\xE3\xA5\x35\x98\x66\x13\x9D\xF7\xD8\x2F\x42\x53\xD0\x8C\x0F\xA8\x29\x86\x15\xC4\xB2\xC4\x08\x99\x30\x5F\x2F\x5F\x88\x69\xE2\x3B\x41\x29\xFB\x0E\x8E\x4E\xBD\x74\x97\x57\x86\x15\x1A\xA5\x51\xEC\xF3\xA4\x45\x33\xD7\x93\xFF\xC0\x60\x35\x6B\x8A\x30\x8A\x3A\xC1\x9D\xA3\xE9\x80\xA9\xF1\x2C\xD5\xE8\x36\xA9\x9E\xA5\x8A\x65\x7E\x3A\x73\x2D\x1C\x8B\x8A\xB3\xD4\x4D\xAF\x78\x29\xC1\xE5\xE6\xCB\xA7\x3C\xC6\x9F\x50\xBC\xC7\xC2\x54\x54\xB7\xFD\x81\x8B\xA4\x62\x2D\x93\x6A\xDC\x52\xB5\x00\x67\x94\x24\x0F\x8A\x6E\x05\x3F\xE1\x83\x62\x0A\xD3\xF2\x73\x62\xEA\x41\x8E\xB5\x0A\x79\x1E\x96\x6C\x9F\x60\x3E\xE1\x3D\x3E\xA5\x57\x57\x1F\xD9\x94\x4D\x11\xC5\x57\x57\x1F\xF3\xEC\xC0\xDB\xAB\x32\x88\xFF\x6A\xCE\x20\x40\xBD\xFE\x85\x1E\x6E\xF1\x9B\x24\xF6\x11\xE5\x65\x8C\xB8\xC0\xA8\xF7\x2A\x2B\xB6\x41\x62\xBC\x39\x20\xF2\x26\x42\x59\xF6\x3A\x0F\xA3\x00\x93\x02\xA3\x98\x30\xAE\x6F\x93\x7B\xF5\xDD\x82\x61\x8A\xBE\xC5\x3E\xC1\x3B\x71\xBD\xBB\x33\x3D\xE7\x02\x6D\x98\xA4\x10\xD6\x87\x74\xDE\x51\x78\x93\xC4\x14\x85\x71\x36\xEA\x10\xBC\x49\x8E\x69\x4E\xF1\xE7\xF0\x98\x46\xB8\x6D\x24\x7A\x3A\xA3\xCC\xF1\x3A\x08\x8A\xD0\xFA\x92\xC8\x24\x26\x60\xEB\xFA\x96\xC3\x64\xAA\xBA\xFB\xF7\x1F\xEC\x63\x91\x51\xB3\xF7\xC0\x7D\xE0\xC1\x8F\xF0\x4D\x12\x31\x83\x39\x0E\xBB\x46\x69\x70\x84\xC0\xB2\x4D\x19\x19\x06\x6B\xE8\x11\xA1\xB4\x0C\xB0\xB4\x46\xBB\x70\x53\x9E\xFD\x95\x0D\x9D\x41\xD6\x9A\x3C\xB5\xBB\xB3\xB7\xE5\x08\x3B\x0F\x9E\x2C\x3E\x00\x83\x3E\x82\xB7\xD9\x88\x4F\xEE\x78\xCE\xCC\xC7\x31\xE4\xDB\x84\x76\x5D\x67\x68\x27\x35\xB9\x91\x0C\xAC\xC6\x36\xC9\x88\x31\xDF\x4A\xB4\x6F\xB0\x7F\xC2\x29\x46\x14\xF2\x17\xE7\xB3\x0C\xA3\x94\x30\x23\x48\x31\x43\xB9\x33\x96\x94\xFA\xF8\xFD\x13\xD3\xBA\xD1\xAD\x9C\x1C\x41\x96\x73\x78\x56\x99\xD7\x7D\x3B\x3F\x0D\x8D\xED\xB7\x9D\xAA\xD9\x4A\x04\x1A\xD2\x30\x89\xB5\xD0\x9F\x3B\x82\x87\x8B\x31\x4B\x08\x8F\x24\xE6\x38\x31\x3C\x5C\x98\xC7\x11\xC4\xA3\xBA\x70\x8F\x28\x1E\xD9\x77\x17\x0A\x63\x89\xC5\x9F\x28\xFA\x86\x49\x79\xD0\xAB\xF8\x21\xEC\xB3\xC8\x15\x8D\xAF\x7E\x11\x79\x71\x71\x7F\xF0\x5F\x90\xE5\x86\xA9\xD5\xF9\x91\x7A\x74\x76\x13\x31\x02\x4F\xCF\x17\x64\xD8\xA8\x31\xB2\x2D\x21\xAF\x22\x3F\x77\x3B\x46\x3F\xBE\xA1\x5C\x5E\xD2\x69\xF7\x9A\x61\x23\xDD\x46\xAA\x07\x11\xDB\xED\x0D\xA3\x0C\x14\x74\x07\xC5\x12\x4C\x7B\xA6\xE2\xB7\xC9\x1F\x78\x47\x3F\x22\x82\x63\xFB\x36\xFB\xC0\x72\xA5\x03\x9F\x49\xEB\x91\x0E\x72\x88\xDB\xFC\x63\xAA\x34\xFC\x89\xB7\x03\x67\xE1\x90\x00\x4C\xE9\x3F\x98\xD0\xD0\x47\xD1\x6B\x44\xDA\x1E\xCF\x47\x5F\x79\x82\xB8\x0F\xF4\xB2\x16\x75\xC6\x77\xA7\x0E\xF6\xEB\x3B\xD8\x1D\x58\xBC\x4D\xDE\x24\x51\x84\xD2\x0C\x03\x6B\x51\x03\x78\xB8\x2D\x49\x5B\xB9\x0F\x1D\x59\x1B\x69\xA9\xDB\xEF\xF1\x70\x59\x47\x57\x7E\x84\xA7\x17\x3B\x83\xF3\x7E\x22\x71\xF6\x9C\x4E\x53\x9B\xF3\x08\xF3\xA4\xF6\x81\x5C\x47\xAC\x7A\xA2\x40\x0F\x25\x43\x3C\x05\x5F\xA5\x85\xB2\x87\x53\x79\xDF\x49\xD6\x0E\x4F\x39\x76\xBA\xAD\x93\xC3\xA7\x70\x7F\xA8\xE7\x99\x96\xC4\xA3\x65\x90\xFE\x84\x5D\x03\xAE\x8B\x78\x3D\xF3\x22\xCC\x62\x68\x20\x6B\x54\xCF\x3D\x7A\x35\x85\xFA\x86\xAC\x7D\x48\x3B\xFA\xBE\xBB\x7F\xF4\x9D\x9A\x6F\xC2\x38\x64\x77\x38\x8E\x19\x1C\x66\xA2\xAE\x81\xE1\x2A\x56\xCF\xA0\xD0\xC9\x0F\x0D\x08\x89\xE2\xB9\x07\x83\xA4\x8C\x7B\x20\xF0\xE3\x32\x7F\x60\x14\x84\xF1\xBE\x2E\xB0\x0D\x4F\xF1\xDD\x9F\xB4\x3B\x92\x97\x8E\xB5\xF6\xA4\xE1\xE8\xBB\x43\xA8\x7E\xFE\x8E\x5A\x43\xF6\x06\xF9\x34\xA9\xE7\x76\xBE\x7C\xD6\x6B\x2A\xFF\xED\x99\x76\x99\x7A\x79\xFC\x90\x75\xB9\x21\xE8\x88\x5B\xBC\x90\xE1\xD4\x6B\x3C\xF8\x98\x46\xC8\xC7\x7C\x9D\x27\x8B\x92\xEF\x5E\x8A\xE8\xE1\xA5\x24\xDC\x93\x5A\xBA\x27\xAF\x54\xC1\x05\xD8\x94\x5A\x4B\xA0\xBA\x46\x7A\x9F\x70\x16\xBD\xE9\xCE\x23\x2F\xAF\xED\x56\x2A\xA4\x46\xEF\xF7\x63\x1A\x5D\x5D\x7D\x4A\xF2\x38\xB8\xEC\x4B\xDB\x37\x7A\xE8\xE7\x34\x0A\xFD\x36\x17\xE5\x48\xCC\x47\x27\x8D\xA5\x56\x03\xFC\xFA\xC8\x0D\xE0\x3E\x35\xCC\x69\xF5\x5F\x56\x62\xF5\x55\xA7\xDA\x7E\x5F\xDE\x58\xAB\x06\xBA\xF7\xAD\x5B\x74\xE1\xB9\xF5\x0C\x12\xA8\x3C\x1D\x95\xB7\xC5\x03\xE5\x0D\x58\xC3\x9C\x9D\x7E\xFA\xEA\xDB\xD9\xA9\xA0\x57\xAA\xE7\xA0\x82\x54\xB0\x9F\x83\xC0\xCE\xEB\xC1\xE7\xA0\x8C\xF2\x40\xA3\xAF\x24\xB8\xEE\x32\x9C\x83\xB2\xE2\xCE\xD8\x39\xC8\xDB\x5E\x68\x9D\x83\x16\x8E\xB3\xDE\x4A\xAA\xE6\x3E\x07\x71\xCF\x58\xAD\xB6\xA3\xC0\x67\xA3\xDA\x75\x10\xDC\x24\x51\x80\x6B\x75\x40\x85\x8D\x37\x10\x9E\xA5\xCE\xFD\x26\xFE\x55\xA9\xE0\xBE\x00\x7B\x36\x2A\x55\x7C\xDE\xE3\xEF\xA2\x22\xB2\xBA\x7A\xED\xDC\x79\x56\x5D\x8B\xD2\xA3\xD4\x43\x6B\x51\xC6\xB5\x44\x58\x8B\xBC\xC3\x4A\x84\xB5\x68\x71\x3E\x3B\x27\xE7\x60\x4D\xC7\x82\x6B\x25\x0B\x66\x72\xD2\x2C\x5F\xE8\x13\xCF\x69\x75\x5D\xF3\x3E\x3B\x9D\xBB\xED\x23\x9D\x8F\x92\xA3\x4C\x0C\x6B\x51\xC6\x75\x62\x58\x8B\xBC\xC3\x26\x86\xB5\x68\x21\xA4\xB2\x51\x0A\xFC\xBE\x8F\x41\x23\x32\x1F\xF1\x41\xC5\xAC\x47\x75\x95\x99\xE1\x6D\x0B\xCB\x16\xCB\xCA\xC5\xEB\x3E\x74\x8C\xC8\xBF\xE3\xD0\x4F\x02\xFC\x4F\x92\xE4\x29\x70\xF4\xB8\xAD\x1A\xAF\x81\x06\x3B\x08\x1D\x3F\x53\x44\xF3\x8C\x39\xEF\x2E\x8F\x22\x92\xC7\x78\x69\x39\xFC\x03\x22\x34\x59\x83\x24\x2A\x97\xAB\xAB\x1D\xBB\xBB\xEE\x45\x73\xF7\x91\x3E\x47\x54\xE7\xC2\x57\x21\xFC\xEF\xD9\x7F\x50\x14\x06\xFF\xFE\x72\xF3\xC2\xF1\x7A\x3F\x95\xCE\xD2\x6A\x14\x13\xD9\x31\x5D\x5A\x8A\x8C\x92\x08\xC7\x4B\x4B\x51\x65\xBC\x7F\x4B\x6C\x6D\x24\x2A\x4C\xE9\x83\x0B\xCE\xA5\xE9\x70\xEF\x51\x92\xCA\x08\x04\xD5\xEC\x30\x8B\x39\xDA\x92\x79\x9F\x09\x62\x05\xE2\xDB\x16\x89\x57\x61\x57\x4B\x7D\xB3\x9C\x70\xEF\xF1\x9E\x1F\x5D\x5F\x87\x38\xD7\x41\x60\x5E\xB7\x6B\xF8\xCF\x2A\xEA\xF9\x2C\x90\x08\xE9\xE7\x4B\xD2\x5C\xE4\x24\x7D\xEB\xCB\x96\xD6\x8D\xA9\x6E\x44\xC2\x6A\xCA\x93\x6C\x5E\x9D\xAC\x2E\xFE\x7E\xF3\xA6\x18\x4D\xE4\x53\x4C\xCC\x73\x92\x59\x08\xA7\xFC\xDB\x4C\x81\xEF\x32\x1F\xA5\xD8\x99\x91\x42\x49\x0D\xE9\x45\x95\x92\x87\x6E\x51\x51\xC0\xEA\x77\x2C\x53\x43\x35\xFE\x68\xB4\xA7\x95\x3C\xCC\x50\x94\x1E\xD0\x14\xA4\x47\x8E\xD7\x36\x27\x52\x93\xB5\x95\xEC\x53\x6B\x66\x18\x76\xB5\xC9\xD8\xD2\x48\x9C\x86\x1C\xCE\x98\x4F\xDA\x11\x6E\xB0\x9A\x49\xAE\x5E\x97\x60\x8D\x2D\x9B\x6B\x9E\x1C\x91\xA5\xFB\xE4\x37\xF6\x18\x2C\xF6\x9C\x37\xA3\xA2\xE2\x73\xED\x2C\x0C\xC5\xC7\xF9\xF9\x93\xD2\x12\x33\xFA\x7A\x52\x47\xFF\xA7\xD4\x25\xA5\xD7\x1F\xB7\xE6\x93\x66\xC6\xB5\x96\xF9\x83\xC1\xF1\xFE\xDB\xE2\xEF\x8F\x98\x44\xA6\xCF\x8D\x8C\xB5\x52\x3A\x90\xF9\x58\x2B\x9D\xE3\x88\xF1\x06\xA5\x34\x27\xF8\x3D\x3B\xC1\x6F\xBD\x3A\x64\x14\xAE\x50\x77\xF7\xDB\x4B\x86\x8A\xE0\x58\x15\xB4\xD2\x71\x9E\xEA\x5B\x29\x0D\xAF\x8B\xBB\xD9\x7D\x92\x62\xB7\xFF\xD0\x77\x7C\xCD\xBA\x53\xBC\x18\xEA\x9B\x91\x1E\x4D\x26\x11\xA5\xF0\x28\x9A\x14\xDE\x35\x17\xC7\x66\x3D\xEA\x16\x65\xA1\xEF\x65\x8C\xF8\x4B\xE8\x93\x19\x45\x9B\x47\x09\x0A\x69\xF6\xB2\xFC\x52\x86\x69\x11\x4C\xF8\x90\x06\x4A\x53\x2C\xE4\x57\xA7\xEF\x29\xCF\x3A\xE6\x2E\xB7\x11\x4C\x22\x83\x25\x19\x4D\xC2\xCF\x9A\xB4\xA6\x71\x67\x5B\xD8\xAB\x37\x8C\x2F\x2E\x94\xFC\x9E\xFE\xE2\xE2\x38\x65\xD6\x45\xA4\x1C\x6D\x0E\x99\xDF\xE9\x96\x9E\x6B\xA6\xA9\x81\xE6\x16\xD5\xE5\xF2\x92\xB9\x65\x52\xAF\x76\x59\x5C\x24\xE9\xC2\xF8\xE5\xA5\x19\xF9\x01\x6D\x79\x85\x46\xBA\xF8\x7B\x56\x45\x18\xEA\xEF\x31\xC5\xFB\xF6\x55\x9C\x75\x98\xD8\xF2\x25\x8B\x59\xE5\x1B\xB0\xFC\x3D\xF1\x70\xAE\x64\xDD\x75\x7A\xD7\x68\x59\x85\x99\xE8\xF1\xC4\xB0\xEA\x3B\xF1\xA0\x4E\xB8\x63\x3C\x9D\xE4\x4B\xAD\x01\x2E\x93\xF8\x07\x5F\x7C\x5E\x69\x52\x91\xE2\xD7\x44\x5F\x5D\xFD\x50\x9B\xA0\x6B\xD3\xDA\xEF\x49\x77\x25\xEB\xF8\x59\xCB\xD9\xEE\x13\x07\xBE\xEB\x3A\x1F\xEF\x6E\x1F\x63\x5D\x44\xAE\x75\x0C\x92\x78\x8E\x48\xFF\x88\xBA\x4C\xEF\x69\x27\xEE\x4F\x4B\xDE\xDA\x77\xFA\x15\x34\xF6\xA9\xFE\xC7\xAC\xBB\xF4\x21\xF9\x9F\x42\xF9\x27\x3F\xED\xB0\x3F\x71\x19\x74\xE9\x29\x7C\x09\x0B\xE8\x5F\x09\x5E\x30\xF4\x81\x79\x62\x59\x79\xBA\xCD\x1D\xAB\x91\xD5\x36\x9F\x2C\x2B\xE4\xAC\xEE\xD6\x9A\x6D\xE7\xF6\xB7\x76\x81\x56\xE4\x70\x9D\x84\x5D\xCC\xE3\xDA\xA5\x9C\xDE\xE5\x9C\xE7\xB8\x59\xFC\xCD\x5D\x9A\xA5\x9D\xAD\x97\xA4\xF3\x7A\x9A\xBB\x88\x33\xBA\x99\x6B\x41\x31\xAF\xBB\x39\x4B\xB5\x1A\xB7\xEB\x23\xF1\x42\xEE\xE7\x2C\xAA\xF0\x12\xF6\x47\x92\xEC\xAF\xAE\x7E\x8F\x33\x5A\xFC\x3F\xA4\xD7\x11\x95\x8D\x5D\x2F\x6E\xA8\x6D\x85\xC6\xC8\xB3\x90\x7A\xFD\x40\x31\x7C\x20\xD7\x1F\x44\xB7\x3C\x39\x24\x52\xED\x4C\xE3\xDD\x31\xA5\x0F\x7F\x86\x01\x3D\x54\xF6\x62\x2D\xD5\x12\x7E\x67\x7A\xFF\x42\xD4\x3F\x88\xDF\x2C\xB7\x62\xBF\x4F\x52\xC0\xC8\xAD\xDD\x6E\x50\x18\xD5\xEB\x02\x00\xE6\x8F\xE2\x1F\x71\xD1\x88\x37\xBF\x65\xDE\xF8\xF6\xE6\xBA\x52\xF5\xED\xCD\xB5\xF0\xDE\xAA\xD6\xB5\xFD\x8C\x02\xEF\xF3\x21\xA5\xE1\x31\xFC\x0B\xF8\xEC\x97\xFD\x38\x0B\xD8\x9B\x2F\x9D\xA5\x6C\xBD\x0D\xD3\x2F\x2F\x0B\x86\xAF\x98\xF2\x98\x50\xE1\x5B\x72\x7C\x0D\x4D\x5D\xE8\x34\x08\x04\xD8\x48\xC1\x69\x83\xB7\xDB\xA2\xF0\xF2\x7F\xA1\xB4\xDE\x1E\xF8\x17\x22\xDF\xF4\x13\xE8\xAA\x30\xCE\xBD\x1C\x6D\xEA\x48\x4F\xBC\xF3\xA2\xBB\x08\xC3\x2C\x60\xD3\x1E\x93\xBD\x61\xD4\xEC\xA8\x7D\xAD\x23\x10\xB1\x9A\x04\x66\xE6\x6A\x07\xA1\xB7\x45\xA3\x4F\xD8\x4F\x22\x76\x79\xFD\xD0\x41\xD7\x28\xD9\x74\xB3\xB1\x75\x54\x50\x23\x61\xD1\x92\xFD\x21\xEB\xE2\x1F\x10\x91\x77\x1E\xDB\x06\xDF\x8D\x88\x93\xAC\x43\x18\x1C\xF1\x31\xC3\x52\xD6\x28\x3F\x07\x53\x92\x13\x53\x9A\x5B\x70\xB4\xD2\x02\x73\x99\x01\xB3\x53\x1A\x06\x69\x88\x7E\xE3\xC6\xCA\x3A\x51\x74\xB0\x4E\x13\x32\xAD\x04\xDC\xCC\xD1\x7F\x98\x45\xD2\x37\x11\xA2\x14\xFA\xA4\x90\x8B\x89\xE5\xCE\x02\xA0\xF0\x85\xCF\xB9\xEF\xE3\x2C\x4B\x48\x73\x36\x82\x4D\x82\xD7\x84\xA0\x07\xB1\x1C\xB4\xC1\xB4\xFB\x79\xB4\x86\xDA\xDF\xA0\xAA\xB2\x59\x06\x34\x61\xF4\xA5\xF7\xBC\xBA\xF8\x47\xD1\xA0\x99\xE2\x4D\x1A\x38\x31\xB0\x0F\x93\x74\x0F\x35\x84\xA0\xDD\x2D\xEF\x79\x59\x42\xE8\x4B\x5E\x63\x3C\xFF\x7A\xF9\xE2\xE9\x13\x76\x08\x1F\x1E\x98\xA2\x3A\x09\xF0\xE9\x3F\x28\xCA\xC1\x7D\x47\x47\xFC\xDF\x1C\xBB\x3C\x7D\xE5\x22\x88\xCD\x5B\x00\xBC\xD9\x55\x75\x8F\x8C\xB7\xC9\x31\x8C\x79\x98\x29\x1F\xF7\xDC\x22\x64\xBC\x08\x51\x26\x32\xE3\x88\xBC\x3B\x86\xF4\x8F\x30\xA3\xAE\x83\x01\x5F\x19\xD6\x3C\xD1\xB4\x3C\xE3\x36\x88\x4B\xDA\x47\x9F\x5C\xFE\x3B\x8C\x69\x26\x5D\xA7\x30\xA2\x7A\x96\xA2\x40\x9D\x80\x80\x6A\xC0\x38\x47\x59\xE7\x66\xB9\x97\x46\x74\x9B\xA2\x46\x70\xB0\x67\x86\x1C\xF9\x19\x5B\x9E\x6C\xEB\x3F\xD4\x13\xB8\xDB\xC0\x8C\x37\x30\x60\x20\x6D\xA6\x1D\xC7\xB4\x9D\x8A\xE4\xCD\xE8\x23\x1B\xDD\x9A\xF5\x37\x6B\x8F\x9C\xD6\x7B\xAF\x59\x6E\x23\x31\xC6\x48\xE8\x0B\x16\x9B\x5D\xC7\xB0\x2B\x9F\x1B\xB7\xE7\xE4\x05\x9E\x93\x9F\xA9\xDB\x43\x9A\xFD\xFF\xF6\x33\x0D\xC0\xF9\x0F\xE8\x16\x46\x8B\x84\x11\x60\xF5\x90\x4D\xD0\x61\x12\x33\xFB\x7B\xBF\x6E\x23\xB0\xF9\xFD\x63\xB3\xFA\xB3\x92\xA5\xC5\xEF\xC3\xD8\x4F\x8E\x69\xF1\x94\xB0\x0D\xC5\x16\x00\x8F\xCD\xEA\xDB\xEE\xCE\xD2\xBB\x3B\xDB\x26\xCE\xC2\xEB\x69\x9B\xF1\x97\x58\x57\xDB\xAC\x3E\xF9\xEA\xFC\x66\xE2\xB5\x2D\x61\x6E\x23\x32\xED\x52\xE6\x66\xDF\x89\xF7\x62\x7D\x82\x11\xC5\x5E\x58\x14\x36\xCA\x21\xC1\x6D\x14\xE6\xDC\x11\x7F\x77\x0A\x33\x1A\xC6\x7B\x21\xF9\xB8\xEE\x87\x6F\xC3\x33\xEE\xBA\xBF\x60\xDE\x47\x7C\xFC\xA7\x6B\x65\xFD\x93\x98\xC2\x5A\xE7\x3E\x6E\x1B\x00\x55\xE7\x63\x56\x78\x8C\x1A\xF0\x31\xDB\x47\xAF\xC8\x1E\xB3\xB6\xA6\x63\xF5\x73\x9E\x7C\xB4\xBE\xEE\x30\xAB\x20\xCB\xB2\xBF\xBA\xFA\x7F\x45\xD7\x26\x2B\xBF\xE0\xAB\x78\x0A\x9A\xF2\x3D\xCD\x33\x91\x16\x1E\xE4\x8F\x04\xEF\xC2\xD3\xB5\xEF\xE3\xC8\xBB\x21\x49\x4C\xAF\xE3\xE0\x35\x7F\xAD\xBA\x5C\xD0\xB5\x5F\xE4\x3C\x11\xD5\x22\x07\x1C\xC8\xC5\xB6\xA9\xB2\x96\x85\xE6\xED\x78\xC4\x63\x3B\x1E\xC1\x3A\x7C\x7A\x77\xC9\xDF\x75\x76\xBD\xDB\xAF\xC0\xFF\x90\x16\xF1\x97\x49\xAF\xB8\x8B\xDE\xE0\xA3\x28\xF2\x92\xB8\xA0\xA0\xD7\xF6\xCF\xEF\x93\x08\xD1\x30\xC2\x25\xD9\xB2\xDC\xAD\xFE\x2C\x8D\xC0\x6D\x50\x95\xC2\x53\x8A\x3B\xD5\x75\xF8\x59\xA1\x77\xC7\xEB\xF0\xC7\xD2\x8E\x43\xA7\xBE\xBA\x71\x64\xA1\xDD\x3F\xCF\x30\x81\x99\xB8\x56\x57\x57\x5F\xF0\x89\x56\x13\xA9\xF4\x29\x98\xB1\x78\x8A\xC5\xED\x14\xA6\x33\x7D\xE5\x60\x12\xD7\xFA\x84\xEF\xF2\x90\xE0\x80\x4F\xF7\x52\xD9\x33\x49\x58\x09\xC9\xF2\xA9\xE6\x98\x4F\xA7\xD6\xF6\xF7\x58\xBB\x17\x77\x12\x3E\x45\x29\x19\x46\xF8\x4B\x52\xDE\x11\x51\xE6\xCD\x19\x52\xC5\xFB\xFC\x58\x5E\xF6\x91\x4D\xA7\x66\x59\xDB\x66\x1F\x62\xFC\x91\x5F\x51\x3E\x3E\x23\xE3\x39\xDA\x7A\x6A\xF2\x52\x92\x9C\x1E\x84\x45\x41\x9A\xA7\x51\xF5\x81\xDE\x91\xC4\x28\x0A\xF4\xE7\x4F\x9E\x94\x6B\x88\x75\x44\x76\xCC\x74\x9F\xDE\x5D\x8E\x33\xC8\x23\x69\x25\x8A\x86\xEF\x31\xC9\x70\x73\x97\x49\xFD\xAC\x31\x79\x39\x30\x68\x6C\x8D\x72\xB3\x47\xAA\x27\x8A\x15\xEA\xD9\x1B\x18\x4A\x38\x70\x65\xFA\xC6\xF8\xFD\xC1\x87\xD6\xE5\x02\x6E\x08\x5D\xBB\x49\x06\xC6\x75\x9C\x1C\x84\x1E\xA2\x51\xD9\xB7\xB2\xC5\x86\xFB\xA2\x96\xF4\xE8\x43\x2A\x36\x4F\x92\xED\xEB\x87\x58\x0D\xD9\xF3\x8E\x28\x2D\x25\x29\x1E\xFF\x10\x99\x49\x98\xB5\x19\x22\xC2\x59\x36\x3D\xF7\x4A\x02\x4A\x72\xEC\xB4\xC1\xB2\x94\x71\xAA\x9B\x55\xDB\x3E\xC3\xBE\xBC\xA4\x3E\xF0\xE1\xF7\xBE\x61\x08\xAC\x35\x4E\xEC\x08\xF6\x48\x04\xE4\x59\x8D\xBC\x2C\x60\x9A\x21\xE8\xE7\xD1\xF3\x2A\x30\xD0\xA9\xE7\xB7\xB6\xE0\xD7\xDB\x4C\xB2\xCD\x24\xDB\x4C\x32\xE3\x4C\xB2\xD5\x6E\x5B\xC4\x6D\x11\x37\x6B\xED\xB6\x45\xDC\x16\x71\x5B\xC4\xCD\x39\xC7\x39\xDF\xFC\xBC\x3D\x35\x6D\x4F\x4D\xE7\xF7\xD4\xB4\x3D\xF8\x6F\x2E\x7C\xE6\x2E\xBC\x65\xE1\xCD\x85\xCF\xDC\x85\x5D\xF7\x4D\xDE\x26\xD5\xB7\x08\x9C\x37\xD5\xAE\x63\xFF\x90\x94\x82\x2B\x1B\x62\x4F\x35\x5C\xB2\x17\x4E\x8F\xE8\x1F\xF1\x6C\xB6\xDC\xC4\xCB\x45\xD7\x25\x99\xB2\xDF\xF9\xF7\xDB\xAF\x7F\x0F\xDA\x76\x3D\x57\x23\x7C\xD3\xC7\x51\x20\x4D\x2D\x63\x23\x2C\xBA\x4A\x1E\x14\x6B\x8D\x96\xD2\x03\xA6\x1A\x69\x20\x6C\xD6\x64\x4C\x76\x28\xE7\x98\xAE\x55\x3A\x87\x7D\xEB\x55\x8B\xCE\xF7\xA9\x3F\x63\x44\xFC\x83\xF0\x55\x94\x16\x47\x6D\x01\x73\xA2\x9A\x44\xD5\xCB\x69\xD4\x3F\xFC\x4F\x18\x07\x56\x59\xD5\x63\x44\xC0\xD9\xFE\xD5\x7A\xAC\x66\xD8\xE6\x34\xCD\x3A\x8C\x2B\xBE\xB2\x72\x06\xE6\x7B\x1D\x52\xF6\xF1\xA6\xCD\x7E\xFD\xEC\xF7\x7E\x45\x71\xBD\x6E\xD3\x69\x65\xDA\x47\x44\x68\x88\x22\x26\xE4\x7B\xF7\x59\xDC\x3C\xB9\xB7\x4D\xD8\xCF\xD6\x57\x3B\xC8\x1F\x9B\xFF\xC1\xFF\x70\x3F\xBF\xE4\xD8\xCF\x50\x8E\x80\xBD\xB5\x07\x58\x8E\x9B\xC7\xD5\x27\xD6\x1A\x4D\xAB\xB6\x3F\x70\x96\x99\x1F\x36\x64\x5C\xC7\xE7\x22\x88\xA9\x76\x6C\x04\x38\x9E\x3A\xD7\x71\x7C\x88\xB5\xFB\xE9\x46\xA8\x37\x70\xAE\x8F\x99\xE3\x16\x45\x28\xF6\xB1\x87\x76\x14\x93\xF2\x25\xA0\x97\xA0\xD1\xBC\x5B\x94\xE1\x97\xA5\x95\x5E\x99\x4C\x2B\x61\xE9\x8F\xFC\x26\xBC\x01\x07\x0F\x01\x6D\x87\x1F\x10\x05\x4E\x0C\x0E\xEC\xBD\xFA\x01\xE8\x2E\x3A\xC1\xC7\xE4\x1E\xAF\x4C\x58\xF7\xB4\x26\x75\x53\x20\x55\xFA\x00\x3A\x09\xA0\x67\xE6\x44\x67\xEB\xD5\x45\x44\x23\x37\xE0\x30\xAB\x23\x33\x7B\xBA\xBE\x0E\x82\x22\x31\x7E\x49\xF8\xA4\x65\xFC\x16\xA4\x03\x7E\xB7\xD5\x89\x0E\xF4\x9C\x14\xF9\x4C\x11\xF9\x18\xE5\xD9\x07\xF2\xBF\x39\xCE\xEA\xD3\xD9\x1C\x5C\x7D\x20\x53\x68\xD2\xDF\x7C\x90\xDF\xD7\xE9\x91\x00\xC6\x17\xC1\x98\xF2\x66\x65\x6C\xF6\xBD\x82\xA9\xCC\xAD\x23\xE9\xD1\x25\xD7\x0D\xB3\x66\xF9\x00\xA2\xEB\x12\xF0\x4D\x12\xFB\x88\x7E\x20\xD7\x11\xBB\x4F\xA1\x79\xB2\x33\x33\x50\xDF\xB2\x36\xB2\xF2\xEB\x17\x36\x7B\xC4\xDA\x5C\x82\x49\x2F\x9A\xCD\xCC\x5B\x42\xBA\x41\x3E\x4D\x6A\x96\x61\x12\x2B\x6E\xE3\xCC\x61\x1D\x23\xEC\x3A\x3F\x2C\x62\xEB\x99\x98\x2E\x35\x10\xE0\xC4\xBE\x80\x1F\xB4\x54\x43\x73\x49\x64\x34\x46\xEF\x08\x5B\x81\x37\xD5\xCC\xDE\x27\x3C\x73\x9C\xB3\x32\xCD\xA7\xD3\x3B\xCC\x64\x7E\x8F\xEF\x51\x37\x6F\xE4\xA6\x58\x1B\x7F\x57\x7E\x43\x18\xFF\x11\x52\x4C\x50\x24\x16\xC3\x1D\x46\x6A\x66\x76\x4E\x85\xBC\xCC\xF0\x3D\xFE\xFE\xE6\x80\xC8\x9B\x48\x58\x64\xAF\x1B\x26\x28\xC9\xDF\xDD\xE5\xEC\x12\x28\xEB\x38\x36\xAF\x20\x7E\x49\x52\xE7\x1E\x7D\x19\x4D\xA8\x03\x54\xAC\xF4\x12\xAC\x25\x33\x77\xA1\x09\x4E\x36\xEE\x04\x9A\xF5\x01\xF1\x06\x20\xA9\x8B\x79\x99\x90\x63\x95\x8B\x84\x9E\x87\xD2\x14\xC7\x2E\x45\x87\xBB\x78\x82\x6E\x5D\x7C\xA7\xDA\x2A\x9D\x49\xBB\x6A\xB5\x7C\x2E\x76\x2E\x2E\x3E\xA3\xEA\x45\x4C\x2C\xA0\xBA\xED\x50\xED\xB4\x42\x68\x11\x67\xBE\x97\xE3\x59\x46\x49\x84\x63\x47\xE4\x8E\xB9\xCB\x42\x49\x4F\x55\x56\x19\x27\x3D\xB7\x74\x75\x55\x1B\xD3\xEF\x70\xCD\x4C\x07\x63\x59\xF3\xE9\x1A\x15\x77\x15\x10\xC8\xED\xDA\xED\x17\x72\x9D\xF0\x27\x8A\xBE\x61\x52\x5E\xAB\x54\xFC\x10\xAE\x6A\xD4\xC3\xA1\x2E\x43\xC0\xBA\xB0\x0B\xAB\x1F\xFC\x97\xB8\x8A\xF5\x26\x89\xEF\x31\xA1\x45\xD9\x92\x7D\x49\x5E\x3F\x50\x46\x46\xBA\x2F\x52\x15\x63\xE2\x01\x79\x3A\xCB\xA5\x4A\x04\x67\xE1\x5F\xE0\x36\x56\xD1\x99\xF3\x59\xB7\x89\x48\x1E\x63\x9A\x14\x6D\xAB\x16\xD3\x39\x5D\xAE\x54\x7E\x31\x49\xAF\x54\x44\xF7\xA2\x75\x7D\xB7\x2C\xB9\x2E\xEF\xAF\x5D\xF2\x45\xD6\x04\x56\x68\x94\x1E\xCB\x0C\xAB\xD3\x61\xC5\xB1\x6E\xB3\xDD\x4D\x42\xD8\x35\xA9\x73\xDB\xF0\x0C\x0C\x56\x2F\xAF\xBC\xCE\xC3\x28\xC0\x84\x2F\xD5\xF0\x83\x30\xEA\x25\xB7\xAB\xDD\xFB\xEF\xA4\x44\xFB\x9C\xD0\x97\x5C\xCB\x2C\x3E\x86\xA5\xD7\x75\x40\x04\x54\xC9\xBC\x82\x57\x62\x09\x81\xD1\xC1\x24\x26\x8E\x9F\x98\xEF\x5D\xDF\x26\xF7\xB8\x39\x1E\x70\x3E\x8E\x0A\x8A\xDF\xC7\x45\xDB\x08\x75\x75\xCE\x4E\x76\x5D\xBB\x5B\xBE\xC7\x7B\x5E\x78\x0C\x34\x8A\x44\x47\xAA\x7F\x9D\x59\x3A\x0F\xA8\x44\xE0\x7C\x4E\x4A\xB6\x28\xF2\x28\x3C\x48\x58\xD7\xD0\x31\xFF\x89\xA9\x98\x02\x7B\xEC\x6E\x3B\xD2\x94\xD6\xCE\x85\xC5\x0E\xBE\x94\x71\x75\xF5\x43\x6B\xEB\xB3\x0C\xD2\x85\xB0\xFB\xE3\xD6\xE7\xF0\x98\x46\xE1\x0E\x3C\xCC\x56\x4A\x24\xAD\x6B\x3A\x2C\x06\xE9\x2D\xE0\x93\x81\x8D\xB3\xF9\x28\x53\x77\x79\x01\x53\x4E\xA5\x60\xE7\xD3\x70\x33\x08\x30\x1B\xEB\x26\xAA\x03\x7C\x97\x97\x39\xAA\xA0\xC7\x5E\x35\x51\x57\xC7\xAD\xE9\xD0\xD8\xEB\x79\xB3\xAE\x1E\x04\xDE\x2D\xF2\xBF\x79\x3E\x4A\x91\x1F\x52\xF0\x58\xE8\x94\xE6\xED\x72\x3A\xC6\xC1\x31\x47\x72\x9D\x36\x9A\x43\xA8\x89\x69\x9B\x0D\x31\x4F\xD9\x53\x8E\xF3\x0F\x91\x93\xBC\x26\x8C\x22\x9C\xF9\xB8\xCA\x84\x6F\x92\xF4\x41\x1B\xCB\xD6\x95\x1B\x95\xCA\xE7\x43\x42\xE8\x7F\xC2\x2C\x6C\x3D\x53\xD0\x87\xFA\xC7\x24\x73\x26\xDE\xDE\x02\xBD\xE4\xB2\x1E\x51\xB4\xF1\x41\x71\xD5\xE4\xBE\x69\xBF\x98\x01\xF5\xE9\x67\x71\x03\xBE\x4D\x0C\xF6\xB3\x5E\x0D\x3F\xA7\xD8\x1D\x56\xD1\x17\x1A\x56\xFE\x6F\xEB\xAA\x27\x78\x0E\x73\x5E\x4B\x4A\x15\xE5\x82\x83\xD8\x5A\x20\x0F\x0B\x73\x79\x78\x3A\x1E\xE9\x19\x1A\x21\x5D\x73\xE6\x30\xFA\x23\x1D\x55\x1B\x49\xB4\x16\x0F\x1B\xA6\xEA\xA0\xD3\x6A\xA3\x29\xD8\x33\x19\x0D\x1D\xE5\xF1\x32\xCC\x30\x49\xF4\x29\xAC\x7A\x72\x1A\x56\x32\xA9\x54\xC6\x2D\x99\x54\xEA\x1F\x09\xEE\x92\xE9\xE4\xD5\xFE\x0E\x6C\x96\x2B\x2C\x16\x13\x65\x05\x56\xD1\x7C\xA9\xFC\xAD\x2D\x5C\xAB\xA9\x7F\x35\x92\x5A\xB2\xBA\x9C\xB8\x5D\x12\xC0\x9C\x5A\x39\xE7\xC7\xC5\xFC\x73\x48\x2A\x9D\xD7\x92\xD2\x54\xBA\xE0\x20\xB6\x15\x6B\x3D\xC2\xAD\x4D\x3B\x37\x12\x3D\x5D\xCD\x85\xF8\x64\x2E\xD3\x99\xB9\xC3\x54\x39\x6E\xD2\x58\x15\xFB\x1E\x6F\x70\x2E\x20\x65\x8F\xF7\x60\xE7\x91\x72\x70\x8C\x4C\x62\xAE\x81\xAF\x57\xCD\x6E\x3A\xC3\x1A\xE7\xAC\x36\x9B\x22\x07\x4D\x22\x68\x9F\x77\x9A\x17\x09\x86\xBE\xD3\xDA\x58\xE2\x58\x9E\x93\x7F\xC8\x0D\x83\xF6\xA4\xDC\x68\x77\xF7\xF6\x1F\x72\xC3\x20\x19\xDD\x68\x3B\x5F\x58\xBE\xDC\x26\x82\xAB\x8C\x0B\xEE\x64\x3D\x3B\xE2\xE3\x31\xB9\xC7\x2B\x91\xA6\xDB\xBB\x42\x2B\x91\x74\xAD\x43\x2B\x06\x41\x96\x46\x21\xF5\x6E\xF3\xDD\x0E\xDB\x09\x6B\x87\x27\xDC\xE4\xA9\x5E\x45\x4A\xF3\xEC\xC0\x84\xA9\x32\xA2\x09\xFF\xC9\x93\xCD\x50\xDE\x8E\x24\x31\xDD\x2C\x65\xB2\xD4\x93\xCD\xA1\x3A\x99\xC9\xC9\x9D\xA4\xCF\xCE\xAE\xC3\x5C\xBC\xF6\x59\x7F\xBA\x02\x26\xCB\xD5\x8A\xDA\x6D\x26\x3D\x07\x35\xEC\x55\xDE\x4A\xE5\x5F\xD8\xB5\xDD\x27\x98\xE5\x7D\xBB\x83\xAC\xAB\x76\xEE\x7E\x7A\xAC\xC8\xBB\x3B\x28\xB0\x84\x7B\x77\xAF\x0A\x16\xF2\xED\x1E\x82\xAE\xCF\xB1\x87\x29\xB1\xB4\x57\xF7\x90\x7E\x51\x97\xEE\x5C\xC1\x2D\xED\xDA\xDD\x05\x5E\xB1\x8B\x0F\x52\x66\x35\xAE\xDE\x5D\x0B\xEE\xF2\xFF\x7F\x00\x00\x00\xFF\xFF\x2A\x88\x2F\xEF\x0B\xCC\x03\x00")
diff --git a/internal/compiler/wasm/opa/opa.wasm b/internal/compiler/wasm/opa/opa.wasm
index 99cde3aafd..01ab9b6f0a 100755
Binary files a/internal/compiler/wasm/opa/opa.wasm and b/internal/compiler/wasm/opa/opa.wasm differ
diff --git a/internal/compiler/wasm/optimizations.go b/internal/compiler/wasm/optimizations.go
index fed367ca25..ecdd8d82c1 100644
--- a/internal/compiler/wasm/optimizations.go
+++ b/internal/compiler/wasm/optimizations.go
@@ -113,10 +113,7 @@ func unquote(s string) (string, error) {
 }
 
 func (c *Compiler) removeUnusedCode() error {
-	cgCSV, err := opa.CallGraphCSV()
-	if err != nil {
-		return fmt.Errorf("csv unpack: %w", err)
-	}
+	cgCSV := opa.CallGraphCSV()
 	r := csv.NewReader(bytes.NewReader(cgCSV))
 	r.LazyQuotes = true
 	cg, err := r.ReadAll()
diff --git a/internal/compiler/wasm/wasm.go b/internal/compiler/wasm/wasm.go
index 57357f1abf..72e4940dba 100644
--- a/internal/compiler/wasm/wasm.go
+++ b/internal/compiler/wasm/wasm.go
@@ -8,20 +8,19 @@ package wasm
 import (
 	"bytes"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"io"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/internal/compiler/wasm/opa"
 	"github.com/open-policy-agent/opa/internal/debug"
-	"github.com/open-policy-agent/opa/internal/ir"
 	"github.com/open-policy-agent/opa/internal/wasm/encoding"
 	"github.com/open-policy-agent/opa/internal/wasm/instruction"
 	"github.com/open-policy-agent/opa/internal/wasm/module"
 	"github.com/open-policy-agent/opa/internal/wasm/types"
 	"github.com/open-policy-agent/opa/internal/wasm/util"
+	"github.com/open-policy-agent/opa/ir"
 	opatypes "github.com/open-policy-agent/opa/types"
 )
 
@@ -29,7 +28,7 @@ import (
 const (
 	opaWasmABIVersionVal      = 1
 	opaWasmABIVersionVar      = "opa_wasm_abi_version"
-	opaWasmABIMinorVersionVal = 2
+	opaWasmABIMinorVersionVal = 3
 	opaWasmABIMinorVersionVar = "opa_wasm_abi_minor_version"
 )
 
@@ -91,6 +90,7 @@ var builtinsFunctions = map[string]string{
 	ast.Floor.Name:                      "opa_arith_floor",
 	ast.Rem.Name:                        "opa_arith_rem",
 	ast.ArrayConcat.Name:                "opa_array_concat",
+	ast.ArrayReverse.Name:               "opa_array_reverse",
 	ast.ArraySlice.Name:                 "opa_array_slice",
 	ast.SetDiff.Name:                    "opa_set_diff",
 	ast.And.Name:                        "opa_set_intersection",
@@ -136,10 +136,13 @@ var builtinsFunctions = map[string]string{
 	ast.GlobMatch.Name:                  "opa_glob_match",
 	ast.JSONMarshal.Name:                "opa_json_marshal",
 	ast.JSONUnmarshal.Name:              "opa_json_unmarshal",
+	ast.JSONIsValid.Name:                "opa_json_is_valid",
 	ast.ObjectFilter.Name:               "builtin_object_filter",
 	ast.ObjectGet.Name:                  "builtin_object_get",
+	ast.ObjectKeys.Name:                 "builtin_object_keys",
 	ast.ObjectRemove.Name:               "builtin_object_remove",
 	ast.ObjectUnion.Name:                "builtin_object_union",
+	ast.ObjectUnionN.Name:               "builtin_object_union_n",
 	ast.Concat.Name:                     "opa_strings_concat",
 	ast.FormatInt.Name:                  "opa_strings_format_int",
 	ast.IndexOf.Name:                    "opa_strings_indexof",
@@ -149,6 +152,7 @@ var builtinsFunctions = map[string]string{
 	ast.Contains.Name:                   "opa_strings_contains",
 	ast.StartsWith.Name:                 "opa_strings_startswith",
 	ast.EndsWith.Name:                   "opa_strings_endswith",
+	ast.StringReverse.Name:              "opa_strings_reverse",
 	ast.Split.Name:                      "opa_strings_split",
 	ast.Replace.Name:                    "opa_strings_replace",
 	ast.ReplaceN.Name:                   "opa_strings_replace_n",
@@ -182,6 +186,11 @@ var builtinsUsingRE2 = [...]string{
 	builtinsFunctions[ast.GlobMatch.Name],
 }
 
+func IsWasmEnabled(bi string) bool {
+	_, ok := builtinsFunctions[bi]
+	return ok
+}
+
 type externalFunc struct {
 	ID   int32
 	Decl *opatypes.Function
@@ -315,11 +324,8 @@ func (c *Compiler) Compile() (*module.Module, error) {
 // are about to be compiled.
 func (c *Compiler) initModule() error {
 
-	bs, err := opa.Bytes()
-	if err != nil {
-		return err
-	}
-
+	bs := opa.Bytes()
+	var err error
 	c.module, err = encoding.ReadModule(bytes.NewReader(bs))
 	if err != nil {
 		return err
@@ -599,7 +605,7 @@ func (c *Compiler) writeExternalFuncNames(buf *bytes.Buffer) {
 
 	for _, decl := range c.policy.Static.BuiltinFuncs {
 		if _, ok := builtinsFunctions[decl.Name]; !ok {
-			addr := int32(buf.Len()) + int32(c.stringOffset)
+			addr := int32(buf.Len()) + c.stringOffset
 			buf.WriteString(decl.Name)
 			buf.WriteByte(0)
 			c.externalFuncNameAddrs[decl.Name] = addr
@@ -611,7 +617,7 @@ func (c *Compiler) writeEntrypointNames(buf *bytes.Buffer) {
 	c.entrypointNameAddrs = make(map[string]int32)
 
 	for _, plan := range c.policy.Plans.Plans {
-		addr := int32(buf.Len()) + int32(c.stringOffset)
+		addr := int32(buf.Len()) + c.stringOffset
 		buf.WriteString(plan.Name)
 		buf.WriteByte(0)
 		c.entrypointNameAddrs[plan.Name] = addr
@@ -849,7 +855,7 @@ func (c *Compiler) compileFunc(fn *ir.Func) error {
 	for i := range fn.Blocks {
 		instrs, err := c.compileBlock(fn.Blocks[i])
 		if err != nil {
-			return errors.Wrapf(err, "block %d", i)
+			return fmt.Errorf("block %d: %w", i, err)
 		}
 		if i < len(fn.Blocks)-1 { // not the last block: wrap in `block` instr
 			if withControlInstr(instrs) { // unless we don't need to
@@ -882,18 +888,15 @@ func (c *Compiler) compileFunc(fn *ir.Func) error {
 }
 
 func mapFunc(mapping ast.Object, fn *ir.Func, index int) (ast.Object, bool) {
-	curr := ast.NewObject()
-	curr.Insert(ast.StringTerm(fn.Path[len(fn.Path)-1]), ast.IntNumberTerm(index))
+	curr := ast.NewObject(ast.Item(ast.StringTerm(fn.Path[len(fn.Path)-1]), ast.IntNumberTerm(index)))
 	for i := len(fn.Path) - 2; i >= 0; i-- {
-		o := ast.NewObject()
-		o.Insert(ast.StringTerm(fn.Path[i]), ast.NewTerm(curr))
-		curr = o
+		curr = ast.NewObject(ast.Item(ast.StringTerm(fn.Path[i]), ast.NewTerm(curr)))
 	}
 	return mapping.Merge(curr)
 }
 
 func (c *Compiler) emitMappingAndStartFunc() error {
-	var indices []uint32
+	indices := make([]uint32, 0, len(c.policy.Funcs.Funcs))
 	var ok bool
 	mapping := ast.NewObject()
 
@@ -992,7 +995,7 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 
 	for _, stmt := range block.Stmts {
 		switch stmt := stmt.(type) {
-		case *ir.ResultSetAdd:
+		case *ir.ResultSetAddStmt:
 			instrs = append(instrs, instruction.GetLocal{Index: c.lrs})
 			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Value)})
 			instrs = append(instrs, instruction.Call{Index: c.function(opaSetAdd)})
@@ -1063,7 +1066,7 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				return nil, err
 			}
 		case *ir.DotStmt:
-			if loc, ok := stmt.Source.(ir.Local); ok {
+			if loc, ok := stmt.Source.Value.(ir.Local); ok {
 				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
 				instrs = append(instrs, c.instrRead(stmt.Key))
 				instrs = append(instrs, instruction.Call{Index: c.function(opaValueGet)})
@@ -1071,8 +1074,8 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				instrs = append(instrs, instruction.I32Eqz{})
 				instrs = append(instrs, instruction.BrIf{Index: 0})
 			} else {
-				// Booleans and strings would lead to the BrIf (since opa_value_get
-				// on them returns 0), so let's skip that.
+				// Booleans and string sources would lead to the BrIf (since opa_value_get
+				// on them returns 0), so let's skip trying that.
 				instrs = append(instrs, instruction.Br{Index: 0})
 				break
 			}
@@ -1093,13 +1096,13 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				instrs = append(instrs, instruction.Br{Index: 0})
 				continue
 			}
-			_, okA := stmt.A.(ir.Bool)
-			if _, okB := stmt.B.(ir.Bool); okA && okB {
+			_, okA := stmt.A.Value.(ir.Bool)
+			if _, okB := stmt.B.Value.(ir.Bool); okA && okB {
 				// not equal (checked above), but both booleans => not equal
 				continue
 			}
-			_, okA = stmt.A.(ir.StringIndex)
-			if _, okB := stmt.B.(ir.StringIndex); okA && okB {
+			_, okA = stmt.A.Value.(ir.StringIndex)
+			if _, okB := stmt.B.Value.(ir.StringIndex); okA && okB {
 				// not equal (checked above), but both strings => not equal
 				continue
 			}
@@ -1131,7 +1134,7 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 			instrs = append(instrs, instruction.Call{Index: c.function(opaSet)})
 			instrs = append(instrs, instruction.SetLocal{Index: c.local(stmt.Target)})
 		case *ir.IsArrayStmt:
-			if loc, ok := stmt.Source.(ir.Local); ok {
+			if loc, ok := stmt.Source.Value.(ir.Local); ok {
 				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
 				instrs = append(instrs, instruction.Call{Index: c.function(opaValueType)})
 				instrs = append(instrs, instruction.I32Const{Value: opaTypeArray})
@@ -1142,7 +1145,7 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				break
 			}
 		case *ir.IsObjectStmt:
-			if loc, ok := stmt.Source.(ir.Local); ok {
+			if loc, ok := stmt.Source.Value.(ir.Local); ok {
 				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
 				instrs = append(instrs, instruction.Call{Index: c.function(opaValueType)})
 				instrs = append(instrs, instruction.I32Const{Value: opaTypeObject})
@@ -1334,7 +1337,7 @@ func (c *Compiler) compileWithStmt(with *ir.WithStmt, result *[]instruction.Inst
 	return nil
 }
 
-func (c *Compiler) compileUpsert(local ir.Local, path []int, value ir.LocalOrConst, loc ir.Location, instrs []instruction.Instruction) []instruction.Instruction {
+func (c *Compiler) compileUpsert(local ir.Local, path []int, value ir.Operand, loc ir.Location, instrs []instruction.Instruction) []instruction.Instruction {
 
 	lcopy := c.genLocal() // holds copy of local
 	instrs = append(instrs, instruction.GetLocal{Index: c.local(local)})
@@ -1481,7 +1484,7 @@ func (c *Compiler) compileCallDynamicStmt(stmt *ir.CallDynamicStmt, result *[]in
 		instruction.CallIndirect{Index: typeIndex}, // [arg0 arg1 tbl_idx] -> [res]
 		instruction.TeeLocal{Index: c.local(stmt.Result)},
 		instruction.I32Eqz{},
-		instruction.BrIf{Index: 2}, // mapping found, "undefined" result counts
+		instruction.BrIf{Index: 3}, // mapping found, "undefined" result counts
 	)
 
 	*result = append(*result, instrs...)
@@ -1747,7 +1750,7 @@ func getLowestFreeElementSegmentOffset(m *module.Module) (int32, error) {
 // It returns the instructions that make up the function call with
 // arguments, followed by Unreachable.
 func (c *Compiler) runtimeErrorAbort(loc ir.Location, errType int) []instruction.Instruction {
-	index, row, col := loc.Index, loc.Row, loc.Col
+	index, row, col := loc.File, loc.Row, loc.Col
 	return []instruction.Instruction{
 		instruction.I32Const{Value: c.fileAddr(index)},
 		instruction.I32Const{Value: int32(row)},
@@ -1768,8 +1771,8 @@ func (c *Compiler) storeFunc(name string, code *module.CodeEntry) error {
 	return nil
 }
 
-func (c *Compiler) instrRead(lv ir.LocalOrConst) instruction.Instruction {
-	switch x := lv.(type) {
+func (c *Compiler) instrRead(lv ir.Operand) instruction.Instruction {
+	switch x := lv.Value.(type) {
 	case ir.Bool:
 		return instruction.I32Const{Value: c.opaBoolAddr(x)}
 	case ir.StringIndex:
diff --git a/internal/config/config.go b/internal/config/config.go
index 69d930f4a4..01e309fc3d 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -8,7 +8,6 @@ package config
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"regexp"
 	"strings"
@@ -25,7 +24,7 @@ import (
 // ServiceOptions stores the options passed to ParseServicesConfig
 type ServiceOptions struct {
 	Raw        json.RawMessage
-	AuthPlugin func(string) rest.HTTPAuthPlugin
+	AuthPlugin rest.AuthPluginLookupFunc
 	Keys       map[string]*keys.Config
 	Logger     logging.Logger
 }
@@ -75,7 +74,7 @@ func Load(configFile string, overrides []string, overrideFiles []string) ([]byte
 	if configFile != "" {
 		var bytes []byte
 		var err error
-		bytes, err = ioutil.ReadFile(configFile)
+		bytes, err = os.ReadFile(configFile)
 		if err != nil {
 			return nil, err
 		}
@@ -83,7 +82,7 @@ func Load(configFile string, overrides []string, overrideFiles []string) ([]byte
 		processedConf := subEnvVars(string(bytes))
 
 		if err := yaml.Unmarshal([]byte(processedConf), &baseConf); err != nil {
-			return []byte{}, fmt.Errorf("failed to parse %s: %s", configFile, err)
+			return nil, fmt.Errorf("failed to parse %s: %s", configFile, err)
 		}
 	}
 
@@ -93,19 +92,19 @@ func Load(configFile string, overrides []string, overrideFiles []string) ([]byte
 	for _, override := range overrides {
 		processedOverride := subEnvVars(override)
 		if err := strvals.ParseInto(processedOverride, overrideConf); err != nil {
-			return []byte{}, fmt.Errorf("failed parsing --set data: %s", err)
+			return nil, fmt.Errorf("failed parsing --set data: %s", err)
 		}
 	}
 
 	// User specified a config override value via --set-file
 	for _, override := range overrideFiles {
 		reader := func(rs []rune) (interface{}, error) {
-			bytes, err := ioutil.ReadFile(string(rs))
+			bytes, err := os.ReadFile(string(rs))
 			value := strings.TrimSpace(string(bytes))
 			return value, err
 		}
 		if err := strvals.ParseIntoFile(override, overrideConf, reader); err != nil {
-			return []byte{}, fmt.Errorf("failed parsing --set-file data: %s", err)
+			return nil, fmt.Errorf("failed parsing --set-file data: %s", err)
 		}
 	}
 
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index b5a4018312..52965a8340 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -19,7 +19,7 @@ import (
 
 func setTestEnvVar(t *testing.T, name, value string) string {
 	envKey := fmt.Sprintf("%s_%s", t.Name(), name)
-	os.Setenv(envKey, value)
+	t.Setenv(envKey, value)
 	return envKey
 }
 
@@ -65,7 +65,7 @@ func TestSubEnvVarsVarsSubMulti(t *testing.T) {
 
 	actual := subEnvVars(configYaml)
 
-	if string(actual) != expected {
+	if actual != expected {
 		t.Errorf("\nExpected: '%s'\nActual: '%s'", expected, actual)
 	}
 }
@@ -76,7 +76,7 @@ func TestSubEnvVarsVarsNoVars(t *testing.T) {
 
 	actual := subEnvVars(configYaml)
 
-	if string(actual) != expected {
+	if actual != expected {
 		t.Errorf("Expected: '%s'\nActual: '%s'", expected, actual)
 	}
 }
@@ -87,7 +87,7 @@ func TestSubEnvVarsVarsEmptyString(t *testing.T) {
 
 	actual := subEnvVars(configYaml)
 
-	if string(actual) != expected {
+	if actual != expected {
 		t.Errorf("Expected: '%s'\nActual: '%s'", expected, actual)
 	}
 }
@@ -102,7 +102,7 @@ func TestSubEnvVarsVarsSubMissingEnvVar(t *testing.T) {
 
 	actual := subEnvVars(configYaml)
 
-	if string(actual) != expected {
+	if actual != expected {
 		t.Errorf("Expected: '%s'\nActual: '%s'", expected, actual)
 	}
 }
@@ -113,7 +113,7 @@ func TestSubEnvVarsVarsSubEmptyVarName(t *testing.T) {
 
 	actual := subEnvVars(configYaml)
 
-	if string(actual) != expected {
+	if actual != expected {
 		t.Errorf("Expected: '%s'\nActual: '%s'", expected, actual)
 	}
 }
diff --git a/internal/debug/debug.go b/internal/debug/debug.go
index b89c6e7150..7b90bd1bb0 100644
--- a/internal/debug/debug.go
+++ b/internal/debug/debug.go
@@ -2,7 +2,6 @@ package debug
 
 import (
 	"io"
-	"io/ioutil"
 	"log"
 )
 
@@ -11,7 +10,7 @@ type Debug interface {
 	// Printf prints, with a short file:line-number prefix
 	Printf(format string, args ...interface{})
 	// Writer returns the writer being written to, which may be
-	// `ioutil.Discard` if no debug output is requested.
+	// `io.Discard` if no debug output is requested.
 	Writer() io.Writer
 
 	// Output allows tweaking the calldepth used for figuring
@@ -32,5 +31,5 @@ func New(sink io.Writer) Debug {
 // since doing this way, we can propagate the "discarding" via
 // `(Debug).Writer()`.
 func Discard() Debug {
-	return New(ioutil.Discard)
+	return New(io.Discard)
 }
diff --git a/internal/deepcopy/deepcopy.go b/internal/deepcopy/deepcopy.go
index cf8cc1cfe0..00e8df6f88 100644
--- a/internal/deepcopy/deepcopy.go
+++ b/internal/deepcopy/deepcopy.go
@@ -16,12 +16,16 @@ func DeepCopy(val interface{}) interface{} {
 		}
 		return cpy
 	case map[string]interface{}:
-		cpy := make(map[string]interface{}, len(val))
-		for k := range val {
-			cpy[k] = DeepCopy(val[k])
-		}
-		return cpy
+		return Map(val)
 	default:
 		return val
 	}
 }
+
+func Map(val map[string]interface{}) map[string]interface{} {
+	cpy := make(map[string]interface{}, len(val))
+	for k := range val {
+		cpy[k] = DeepCopy(val[k])
+	}
+	return cpy
+}
diff --git a/internal/distributedtracing/distributedtracing.go b/internal/distributedtracing/distributedtracing.go
new file mode 100644
index 0000000000..31ff2062b7
--- /dev/null
+++ b/internal/distributedtracing/distributedtracing.go
@@ -0,0 +1,279 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package distributedtracing
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/go-logr/logr"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+	"go.opentelemetry.io/otel/sdk/resource"
+	"go.opentelemetry.io/otel/sdk/trace"
+	semconv "go.opentelemetry.io/otel/semconv/v1.7.0"
+	"google.golang.org/grpc/credentials"
+
+	"github.com/open-policy-agent/opa/config"
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/util"
+
+	// The import registers opentelemetry with the top-level `tracing` package,
+	// so the latter can be used from rego/topdown without an explicit build-time
+	// dependency.
+	_ "github.com/open-policy-agent/opa/features/tracing"
+)
+
+const (
+	defaultAddress              = "localhost:4317"
+	defaultServiceName          = "opa"
+	defaultSampleRatePercentage = int(100)
+	defaultEncyrptionScheme     = "off"
+	defaultEncryptionSkipVerify = false
+)
+
+var supportedEncryptionScheme = map[string]struct{}{
+	"off": {}, "tls": {}, "mtls": {},
+}
+
+func isSupportedEncryptionScheme(scheme string) bool {
+	_, ok := supportedEncryptionScheme[scheme]
+	return ok
+}
+
+func isSupportedSampleRatePercentage(sampleRate int) bool {
+	return sampleRate >= 0 && sampleRate <= 100
+}
+
+type distributedTracingConfig struct {
+	Type                  string `json:"type,omitempty"`
+	Address               string `json:"address,omitempty"`
+	ServiceName           string `json:"service_name,omitempty"`
+	SampleRatePercentage  *int   `json:"sample_percentage,omitempty"`
+	EncryptionScheme      string `json:"encryption,omitempty"`
+	EncryptionSkipVerify  *bool  `json:"allow_insecure_tls,omitempty"`
+	TLSCertFile           string `json:"tls_cert_file,omitempty"`
+	TLSCertPrivateKeyFile string `json:"tls_private_key_file,omitempty"`
+	TLSCACertFile         string `json:"tls_ca_cert_file,omitempty"`
+}
+
+func Init(ctx context.Context, raw []byte, id string) (*otlptrace.Exporter, *trace.TracerProvider, error) {
+	parsedConfig, err := config.ParseConfig(raw, id)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	distributedTracingConfig, err := parseDistributedTracingConfig(parsedConfig.DistributedTracing)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if strings.ToLower(distributedTracingConfig.Type) != "grpc" {
+		return nil, nil, nil
+	}
+
+	certificate, err := loadCertificate(distributedTracingConfig.TLSCertFile, distributedTracingConfig.TLSCertPrivateKeyFile)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	certPool, err := loadCertPool(distributedTracingConfig.TLSCACertFile)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	tlsOption, err := tlsOption(distributedTracingConfig.EncryptionScheme, *distributedTracingConfig.EncryptionSkipVerify, certificate, certPool)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	traceExporter := otlptracegrpc.NewUnstarted(
+		otlptracegrpc.WithEndpoint(distributedTracingConfig.Address),
+		tlsOption,
+	)
+
+	res, err := resource.New(ctx,
+		resource.WithAttributes(
+			semconv.ServiceNameKey.String(distributedTracingConfig.ServiceName),
+		),
+	)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	traceProvider := trace.NewTracerProvider(
+		trace.WithResource(res),
+		trace.WithSampler(trace.ParentBased(trace.TraceIDRatioBased(float64(*distributedTracingConfig.SampleRatePercentage)/float64(100)))),
+		trace.WithSpanProcessor(trace.NewBatchSpanProcessor(traceExporter)),
+	)
+
+	return traceExporter, traceProvider, nil
+}
+
+func SetupLogging(logger logging.Logger) {
+	otel.SetErrorHandler(&errorHandler{logger: logger})
+	otel.SetLogger(logr.New(&sink{logger: logger}))
+}
+
+func parseDistributedTracingConfig(raw []byte) (*distributedTracingConfig, error) {
+	if raw == nil {
+		encryptionSkipVerify := new(bool)
+		sampleRatePercentage := new(int)
+		*sampleRatePercentage = defaultSampleRatePercentage
+		*encryptionSkipVerify = defaultEncryptionSkipVerify
+		return &distributedTracingConfig{
+			Address:              defaultAddress,
+			ServiceName:          defaultServiceName,
+			SampleRatePercentage: sampleRatePercentage,
+			EncryptionScheme:     defaultEncyrptionScheme,
+			EncryptionSkipVerify: encryptionSkipVerify,
+		}, nil
+	}
+	var config distributedTracingConfig
+
+	if err := util.Unmarshal(raw, &config); err != nil {
+		return nil, err
+	}
+	if err := config.validateAndInjectDefaults(); err != nil {
+		return nil, err
+	}
+
+	return &config, nil
+}
+
+func (c *distributedTracingConfig) validateAndInjectDefaults() error {
+	switch c.Type {
+	case "", "grpc": // OK
+	default:
+		return fmt.Errorf("unknown distributed_tracing.type '%s', must be \"grpc\" or \"\" (unset)", c.Type)
+	}
+
+	if c.Address == "" {
+		c.Address = defaultAddress
+	}
+	if c.ServiceName == "" {
+		c.ServiceName = defaultServiceName
+	}
+	if c.SampleRatePercentage == nil {
+		sampleRatePercentage := new(int)
+		*sampleRatePercentage = defaultSampleRatePercentage
+		c.SampleRatePercentage = sampleRatePercentage
+	}
+	if c.EncryptionScheme == "" {
+		c.EncryptionScheme = defaultEncyrptionScheme
+	}
+	if c.EncryptionSkipVerify == nil {
+		encryptionSkipVerify := new(bool)
+		*encryptionSkipVerify = defaultEncryptionSkipVerify
+		c.EncryptionSkipVerify = encryptionSkipVerify
+	}
+
+	if !isSupportedEncryptionScheme(c.EncryptionScheme) {
+		return fmt.Errorf("unsupported distributed_tracing.encryption_scheme '%s'", c.EncryptionScheme)
+	}
+
+	if !isSupportedSampleRatePercentage(*c.SampleRatePercentage) {
+		return fmt.Errorf("unsupported distributed_tracing.sample_percentage '%v'", *c.SampleRatePercentage)
+	}
+
+	return nil
+}
+
+func loadCertificate(tlsCertFile, tlsPrivateKeyFile string) (*tls.Certificate, error) {
+
+	if tlsCertFile != "" && tlsPrivateKeyFile != "" {
+		cert, err := tls.LoadX509KeyPair(tlsCertFile, tlsPrivateKeyFile)
+		if err != nil {
+			return nil, err
+		}
+		return &cert, nil
+	}
+
+	if tlsCertFile != "" || tlsPrivateKeyFile != "" {
+		return nil, fmt.Errorf("distributed_tracing.tls_cert_file and distributed_tracing.tls_private_key_file must be specified together")
+	}
+
+	return nil, nil
+}
+
+func loadCertPool(tlsCACertFile string) (*x509.CertPool, error) {
+	if tlsCACertFile == "" {
+		return nil, nil
+	}
+
+	caCertPEM, err := os.ReadFile(tlsCACertFile)
+	if err != nil {
+		return nil, fmt.Errorf("read CA cert file: %v", err)
+	}
+	pool := x509.NewCertPool()
+	if ok := pool.AppendCertsFromPEM(caCertPEM); !ok {
+		return nil, fmt.Errorf("failed to parse CA cert %q", tlsCACertFile)
+	}
+	return pool, nil
+}
+
+func tlsOption(encryptionScheme string, encryptionSkipVerify bool, cert *tls.Certificate, certPool *x509.CertPool) (otlptracegrpc.Option, error) {
+	if encryptionScheme == "off" {
+		return otlptracegrpc.WithInsecure(), nil
+	}
+	tlsConfig := &tls.Config{
+		RootCAs:            certPool,
+		InsecureSkipVerify: encryptionSkipVerify,
+	}
+	if encryptionScheme == "mtls" {
+		if cert == nil {
+			return nil, fmt.Errorf("distributed_tracing.tls_cert_file required but not supplied")
+		}
+		tlsConfig.Certificates = []tls.Certificate{*cert}
+	}
+	return otlptracegrpc.WithTLSCredentials(credentials.NewTLS(tlsConfig)), nil
+}
+
+type errorHandler struct {
+	logger logging.Logger
+}
+
+func (e *errorHandler) Handle(err error) {
+	e.logger.Warn("Distributed tracing: " + err.Error())
+}
+
+// NOTE(sr): This adapter code is used to ensure that whatever otel logs, now or
+// in the future, will end up in "our" logs, and not go through whatever defaults
+// it has set up with its global logger. As such, it's to a full-featured
+// implementation fo the logr.LogSink interface, but a rather minimal one. Notably,
+// fields are no supported, the initial runtime time info is ignored, and there is
+// no support for different verbosity level is "info" logs: they're all printed
+// as-is.
+
+type sink struct {
+	logger logging.Logger
+}
+
+func (s *sink) Enabled(level int) bool {
+	return int(s.logger.GetLevel()) >= level
+}
+
+func (*sink) Init(logr.RuntimeInfo) {} // ignored
+
+func (s *sink) Info(_ int, msg string, _ ...interface{}) {
+	s.logger.Info(msg)
+}
+
+func (s *sink) Error(err error, msg string, _ ...interface{}) {
+	s.logger.WithFields(map[string]interface{}{"err": err}).Error(msg)
+}
+
+func (s *sink) WithName(name string) logr.LogSink {
+	return &sink{s.logger.WithFields(map[string]interface{}{"name": name})}
+}
+
+func (s *sink) WithValues(...interface{}) logr.LogSink { // ignored
+	return s
+}
diff --git a/internal/edittree/bitvector/README.md b/internal/edittree/bitvector/README.md
new file mode 100644
index 0000000000..c98de9ee43
--- /dev/null
+++ b/internal/edittree/bitvector/README.md
@@ -0,0 +1,15 @@
+# godropbox [![GoDoc](https://godoc.org/github.com/dropbox/godropbox?status.svg)](https://godoc.org/github.com/dropbox/godropbox) [![Actions Status](https://github.com/dropbox/godropbox/workflows/Test/badge.svg)](https://github.com/dropbox/godropbox/actions) [![Actions Status](https://github.com/dropbox/godropbox/workflows/Lint/badge.svg)](https://github.com/dropbox/godropbox/actions)
+
+Common libraries for writing go services/applications on Linux servers.
+
+### Requirements
+ * Go 1.13+
+ * Linux/x64
+
+### Installation
+``go get github.com/dropbox/godropbox``
+
+### Documentation
+
+See https://pkg.go.dev/github.com/dropbox/godropbox for modules documentation.
+
diff --git a/internal/edittree/bitvector/bitvector.go b/internal/edittree/bitvector/bitvector.go
new file mode 100644
index 0000000000..89e7e137b7
--- /dev/null
+++ b/internal/edittree/bitvector/bitvector.go
@@ -0,0 +1,206 @@
+// Package bitvector provides the implementation of a variable sized compact vector of bits
+// which supports lookups, sets, appends, insertions, and deletions.
+package bitvector
+
+// A BitVector is a variable sized vector of bits. It supports
+// lookups, sets, appends, insertions, and deletions.
+//
+// This class is not thread safe.
+type BitVector struct {
+	data   []byte
+	length int
+}
+
+// NewBitVector creates and initializes a new bit vector with length
+// elements, using data as its initial contents.
+func NewBitVector(data []byte, length int) *BitVector {
+	return &BitVector{
+		data:   data,
+		length: length,
+	}
+}
+
+// Bytes returns a slice of the contents of the bit vector. If the caller changes the returned slice,
+// the contents of the bit vector may change.
+func (vector *BitVector) Bytes() []byte {
+	return vector.data
+}
+
+// Length returns the current number of elements in the bit vector.
+func (vector *BitVector) Length() int {
+	return vector.length
+}
+
+// This function shifts a byte slice one bit lower (less significant).
+// bit (either 1 or 0) contains the bit to put in the most significant
+// position of the last byte in the slice.
+// This returns the bit that was shifted off of the last byte.
+func shiftLower(bit byte, b []byte) byte {
+	bit = bit << 7
+	for i := len(b) - 1; i >= 0; i-- {
+		newByte := b[i] >> 1
+		newByte |= bit
+		bit = (b[i] & 1) << 7
+		b[i] = newByte
+	}
+	return bit >> 7
+}
+
+// This function shifts a byte slice one bit higher (more significant).
+// bit (either 1 or 0) contains the bit to put in the least significant
+// position of the first byte in the slice.
+// This returns the bit that was shifted off the last byte.
+func shiftHigher(bit byte, b []byte) byte {
+	for i := 0; i < len(b); i++ {
+		newByte := b[i] << 1
+		newByte |= bit
+		bit = (b[i] & 0x80) >> 7
+		b[i] = newByte
+	}
+	return bit
+}
+
+// Returns the minimum number of bytes needed for storing the bit vector.
+func (vector *BitVector) bytesLength() int {
+	lastBitIndex := vector.length - 1
+	lastByteIndex := lastBitIndex >> 3
+	return lastByteIndex + 1
+}
+
+// Panics if the given index is not within the bounds of the bit vector.
+func (vector *BitVector) indexAssert(i int) {
+	if i < 0 || i >= vector.length {
+		panic("Attempted to access element outside buffer")
+	}
+}
+
+// Append adds a bit to the end of a bit vector.
+func (vector *BitVector) Append(bit byte) {
+	index := uint32(vector.length)
+	vector.length++
+
+	if vector.bytesLength() > len(vector.data) {
+		vector.data = append(vector.data, 0)
+	}
+
+	byteIndex := index >> 3
+	byteOffset := index % 8
+	oldByte := vector.data[byteIndex]
+	var newByte byte
+	if bit == 1 {
+		newByte = oldByte | 1<<byteOffset
+	} else {
+		// Set all bits except the byteOffset
+		mask := byte(^(1 << byteOffset))
+		newByte = oldByte & mask
+	}
+
+	vector.data[byteIndex] = newByte
+}
+
+// Element returns the bit in the ith index of the bit vector.
+// Returned value is either 1 or 0.
+func (vector *BitVector) Element(i int) byte {
+	vector.indexAssert(i)
+	byteIndex := i >> 3
+	byteOffset := uint32(i % 8)
+	b := vector.data[byteIndex]
+	// Check the offset bit
+	return (b >> byteOffset) & 1
+}
+
+// Set changes the bit in the ith index of the bit vector to the value specified in
+// bit.
+func (vector *BitVector) Set(bit byte, index int) {
+	vector.indexAssert(index)
+	byteIndex := uint32(index >> 3)
+	byteOffset := uint32(index % 8)
+
+	oldByte := vector.data[byteIndex]
+
+	var newByte byte
+	if bit == 1 {
+		// turn on the byteOffset'th bit
+		newByte = oldByte | 1<<byteOffset
+	} else {
+		// turn off the byteOffset'th bit
+		removeMask := byte(^(1 << byteOffset))
+		newByte = oldByte & removeMask
+	}
+	vector.data[byteIndex] = newByte
+}
+
+// Insert inserts bit into the supplied index of the bit vector. All
+// bits in positions greater than or equal to index before the call will
+// be shifted up by one.
+func (vector *BitVector) Insert(bit byte, index int) {
+	vector.indexAssert(index)
+	vector.length++
+
+	// Append an additional byte if necessary.
+	if vector.bytesLength() > len(vector.data) {
+		vector.data = append(vector.data, 0)
+	}
+
+	byteIndex := uint32(index >> 3)
+	byteOffset := uint32(index % 8)
+	var bitToInsert byte
+	if bit == 1 {
+		bitToInsert = 1 << byteOffset
+	}
+
+	oldByte := vector.data[byteIndex]
+	// This bit will need to be shifted into the next byte
+	leftoverBit := (oldByte & 0x80) >> 7
+	// Make masks to pull off the bits below and above byteOffset
+	// This mask has the byteOffset lowest bits set.
+	bottomMask := byte((1 << byteOffset) - 1)
+	// This mask has the 8 - byteOffset top bits set.
+	topMask := ^bottomMask
+	top := (oldByte & topMask) << 1
+	newByte := bitToInsert | (oldByte & bottomMask) | top
+
+	vector.data[byteIndex] = newByte
+	// Shift the rest of the bytes in the slice one higher, append
+	// the leftoverBit obtained above.
+	shiftHigher(leftoverBit, vector.data[byteIndex+1:])
+}
+
+// Delete removes the bit in the supplied index of the bit vector. All
+// bits in positions greater than or equal to index before the call will
+// be shifted down by one.
+func (vector *BitVector) Delete(index int) {
+	vector.indexAssert(index)
+	vector.length--
+	byteIndex := uint32(index >> 3)
+	byteOffset := uint32(index % 8)
+
+	oldByte := vector.data[byteIndex]
+
+	// Shift all the bytes above the byte we're modifying, return the
+	// leftover bit to include in the byte we're modifying.
+	bit := shiftLower(0, vector.data[byteIndex+1:])
+
+	// Modify oldByte.
+	// At a high level, we want to select the bits above byteOffset,
+	// and shift them down by one, removing the bit at byteOffset.
+
+	// This selects the bottom bits
+	bottomMask := byte((1 << byteOffset) - 1)
+	// This selects the top (8 - byteOffset - 1) bits
+	topMask := byte(^((1 << (byteOffset + 1)) - 1))
+	// newTop is the top bits, shifted down one, combined with the leftover bit from shifting
+	// the other bytes.
+	newTop := (oldByte&topMask)>>1 | (bit << 7)
+	// newByte takes the bottom bits and combines with the new top.
+	newByte := (bottomMask & oldByte) | newTop
+	vector.data[byteIndex] = newByte
+
+	// The desired length is the byte index of the last element plus one,
+	// where the byte index of the last element is the bit index of the last
+	// element divided by 8.
+	byteLength := vector.bytesLength()
+	if byteLength < len(vector.data) {
+		vector.data = vector.data[:byteLength]
+	}
+}
diff --git a/internal/edittree/bitvector/bitvector_test.go b/internal/edittree/bitvector/bitvector_test.go
new file mode 100644
index 0000000000..ff9743953e
--- /dev/null
+++ b/internal/edittree/bitvector/bitvector_test.go
@@ -0,0 +1,106 @@
+package bitvector
+
+import (
+	"testing"
+
+	. "gopkg.in/check.v1"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type BitVectorSuite struct {
+	vector  *BitVector
+	lVector *BitVector
+}
+
+var _ = Suite(&BitVectorSuite{})
+
+func (s *BitVectorSuite) SetUpTest(c *C) {
+	// This sets elements 4-12
+	s.vector = NewBitVector([]byte{0xF0, 0x0F}, 12)
+
+	s.lVector = NewBitVector([]byte{0xF0, 0x0F}, 16)
+}
+
+func (s *BitVectorSuite) TestElement(c *C) {
+	for i := 0; i < 4; i++ {
+		c.Assert(s.vector.Element(i), Equals, byte(0))
+	}
+	for i := 4; i < 12; i++ {
+		c.Assert(s.vector.Element(i), Equals, byte(1))
+	}
+}
+
+func (s *BitVectorSuite) TestInsert(c *C) {
+	for i := 0; i < 4; i++ {
+		s.vector.Insert(0, 8)
+	}
+	c.Assert(s.vector.Bytes(), DeepEquals, []byte{0xF0, 0xF0})
+}
+
+func (s *BitVectorSuite) TestAppend(c *C) {
+	for i := 0; i < 4; i++ {
+		if i%2 == 0 {
+			s.vector.Append(0)
+		} else {
+			s.vector.Append(1)
+		}
+	}
+	c.Assert(s.vector.Bytes(), DeepEquals, []byte{0xF0, 0xAF})
+}
+
+func (s *BitVectorSuite) TestSet(c *C) {
+	for i := 4; i < 8; i++ {
+		if i%2 == 0 {
+			s.vector.Set(0, i)
+		}
+	}
+	c.Assert(s.vector.Bytes(), DeepEquals, []byte{0xA0, 0x0F})
+}
+
+func (s *BitVectorSuite) TestSetOneBit(c *C) {
+	for i := 4; i < 8; i++ {
+		if i%2 == 0 {
+			s.vector.Set(1, i)
+		}
+	}
+	c.Assert(s.vector.Bytes(), DeepEquals, []byte{0xF0, 0x0F})
+}
+
+func (s *BitVectorSuite) TestDelete(c *C) {
+	for i := 0; i < 4; i++ {
+		s.vector.Delete(8)
+	}
+	c.Assert(s.vector.Bytes(), DeepEquals, []byte{0xF0})
+}
+
+func (s *BitVectorSuite) TestDeleteFirstIndex(c *C) {
+	for i := 0; i < 4; i++ {
+		s.vector.Delete(0)
+	}
+	c.Assert(s.vector.Bytes(), DeepEquals, []byte{0xFF})
+}
+
+func (s *BitVectorSuite) TestDeleteInvalidInput(c *C) {
+
+	defer func() {
+		if r := recover(); r == nil {
+			c.Errorf("Delete should have panicked")
+		}
+	}()
+	s.vector.Delete(-1)
+}
+
+func (s *BitVectorSuite) TestLength(c *C) {
+	c.Assert(s.vector.Length(), Equals, 12)
+}
+
+func (s *BitVectorSuite) TestInsertLongVector(c *C) {
+	s.lVector.Insert(1, 1)
+	c.Assert(s.lVector.Bytes(), DeepEquals, []byte{0xE2, 0x1F, 0x0})
+}
+
+func (s *BitVectorSuite) TestAppendLongVector(c *C) {
+	s.lVector.Append(1)
+	c.Assert(s.lVector.Bytes(), DeepEquals, []byte{0xF0, 0xF, 0x1})
+}
diff --git a/internal/edittree/bitvector/license.txt b/internal/edittree/bitvector/license.txt
new file mode 100644
index 0000000000..04d42108ee
--- /dev/null
+++ b/internal/edittree/bitvector/license.txt
@@ -0,0 +1,27 @@
+Copyright (c) 2014 Dropbox, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/internal/edittree/edittree.go b/internal/edittree/edittree.go
new file mode 100644
index 0000000000..9cfaee8baf
--- /dev/null
+++ b/internal/edittree/edittree.go
@@ -0,0 +1,1185 @@
+// Copyright 2023 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package EditTree implements a specialized tree data structure that
+// allows for cheap edits and modifications of nested Term structures.
+//
+// # Overview
+//
+// The EditTree data structure exists to solve an ugly problem in Rego:
+// modification/deletion of a Term can be very expensive, because we have
+// to rebuild the whole Term, sans the modified/deleted parts.
+//
+// To work around that problem, the EditTree allows simple add, modify, or
+// delete operations on Term structures, and then at the end of a series of
+// edits, the caller can pay the cost of generating a new Term from the
+// tree of edits relatively efficiently. (Essentially a recursive, DFS
+// traversal of the tree.)
+//
+// The data structure preserves basic type/safety properties, the same as
+// working on the real underlying Term values. To do this, recursive
+// lookups are used. On average, these are fairly straightforward and
+// cheap to do.
+//
+// Basic Operations:
+//   - Insert/update EditTree node
+//   - Delete EditTree node
+//   - Unfold EditTree nodes along a path
+//   - Render EditTree node
+//
+// These operations provide all of the basic utilities required to
+// recursively construct the tree. Ref-based convenience functions are also
+// provided, to make rendering subtrees at a particular JSON path easier.
+//
+// Path-Based Convenience Functions:
+//   - InsertAtPath
+//   - DeleteAtPath
+//   - RenderAtPath
+//
+// Additionally, a few "optional" (but nice to have) functions have been
+// added, to allow replacing slower/less-efficient equivalents elsewhere.
+//
+// Optional Functions:
+//   - Exists (a more efficient boolean alternative to Unfold)
+//   - Filter (an alternative to Object.Filter that efficiently renders
+//     paths out of an EditTree)
+//
+// # Storing scalar children "inline"
+//
+// The original design for the EditTree allocated a new EditTree node for
+// each Term stored in the tree, but this was found to be inefficient when
+// dealing with large arrays and objects. The current design of the
+// EditTree separates children based on their types, with scalars stored in
+// a hash -> Term map, and composites stored in a hash -> EditTree map.
+//
+// This results in dramatically fewer heap allocations and faster access
+// times for "shallow" Term structures, without penalizing nested Term
+// structures noticeably.
+//
+// # Object operations
+//
+// Objects are the most straightforward composite type, as their key-value
+// structure maps naturally onto trees. Their inserts/deletes are recorded
+// directly in the appropriate child maps, with almost no additional
+// complexity required.
+//
+// Object EditTree nodes use the child key and value maps, and will not
+// initialize the bit-vectors, since those are only used for Arrays.
+//
+// # Set operations
+//
+// Set data types have a major problem: they're *content-addressed*. This
+// means that we often have to render/materialize the sub-terms before
+// carrying out inserts or deletes, in order to know if the path to the
+// destination Term exists. This forces a tree collapse at the Set's
+// EditTree node, and is brutally inefficient.
+//
+// Example:
+//
+//	Source set: {[0], "a"}
+//	{"op": "add", "path": [[0], 1], "value": 1}      -> result value: {[0, 1], "a"}
+//	{"op": "add", "path": [[0, 1], 3], "value": 3}   -> result value: {[0, 1, 3], "a"}
+//
+// We mitigate this somewhat by only collapsing a Set when a composite
+// value is being used for indexing. Scalars imply a shallow access, which
+// we can look up directly in the appropriate child map.
+//
+// Set EditTree nodes use the child key and value maps, and will not
+// initialize the bit-vectors, since those are only used for Arrays.
+//
+// # Array operations
+//
+// Arrays can have elements inserted/replaced/deleted, and this requires
+// some bookkeeping work to keep everything straight. We do this
+// bookkeeping work using two bit vectors to track all the
+// insertions/deletions.
+//
+// One bit-vector tracks which indexes are preserved/eliminated from the
+// original Array, and the second bit-vector tracks which indexes have
+// insertions. We can record inserts and deletes *directly* on the second
+// bit-vector, "bleeding through" deletions to the preserved/eliminated bit
+// vector when there's not an insert to wipe out first.
+//
+// For bleed-through deletes, a linear scan is required to find the index
+// of which original element will be knocked out. We then mark that bit in
+// the preserved/eliminated bit-vector. This is a fair bit of bookkeeping,
+// but greatly reduces the cost and complexity of tracking Array state.
+// There can only be insertions, or original values present. Any other
+// "deletion" is an error.
+//
+// Insert and Delete operations also imply a linear "index rewriting" pass
+// for an Array's child maps, where indexes that occur above the affected
+// index of the insertion/deletion must be incremented or decremented
+// appropriately. This ensures that when rendered later, the
+// original/inserted values will be spliced in at the correct offsets in
+// the final Array value.
+//
+// Due to optimizations discussed later, Array EditTree nodes do not use
+// the child key map (leaving it uninitialized), but will initialize and
+// use the child value maps normally. Array EditTree nodes are the only
+// types of EditTree nodes that should ever be expected to have initialized
+// bit-vectors present.
+//
+// # Scalar operations
+//
+// Scalars are fairly simple: just a term stored in an EditTree node, or in
+// the scalar child map of a composite type's EditTree node. They cannot
+// have children, and normally do not exist as independent EditTree nodes,
+// except to satisfy certain EditTree APIs.
+//
+// Scalar EditTree nodes can only be expected to have a valid Term value;
+// all other fields will be left uninitialized.
+//
+// # Optimization: Direct Array Indexing with ints
+//
+// Arrays are unique in Rego, because the only valid Terms that can index
+// into them are integer, numeric values. When processing the key Terms for
+// Objects and Sets, we have to identify children by their hash values
+// (which hash to integers). Because the only valid key Terms for Arrays
+// work as ints as well, we can skip the hashing step entirely, and just
+// use the int indexes *directly*.
+//
+// This provides a substantial CPU savings in benchmarks, because the
+// "index rewriting" passes become much cheaper from not having to rehash
+// every child's index.
+package edittree
+
+import (
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"sort"
+	"strings"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/edittree/bitvector"
+)
+
+// Deletions are encoded with a nil value pointer.
+type EditTree struct {
+	value                *ast.Term
+	childKeys            map[int]*ast.Term
+	childScalarValues    map[int]*ast.Term
+	childCompositeValues map[int]*EditTree
+	eliminated           *bitvector.BitVector // Which original indexes have been knocked out?
+	insertions           *bitvector.BitVector // Which indexes have a new value inserted at them? (also used for "live" bookkeeping)
+}
+
+// Creates a new EditTree node from term.
+func NewEditTree(term *ast.Term) *EditTree {
+	if term == nil {
+		return nil
+	}
+
+	var tree EditTree
+	switch x := term.Value.(type) {
+	case ast.Object, ast.Set:
+		tree = EditTree{
+			value:                term,
+			childKeys:            map[int]*ast.Term{},
+			childScalarValues:    map[int]*ast.Term{},
+			childCompositeValues: map[int]*EditTree{},
+		}
+	case *ast.Array:
+		tree = EditTree{
+			value:                term,
+			childScalarValues:    map[int]*ast.Term{},
+			childCompositeValues: map[int]*EditTree{},
+		}
+		bytesLength := ((x.Len() - 1) / 8) + 1 // How many bytes to use for the bit-vectors.
+		tree.eliminated = bitvector.NewBitVector(make([]byte, bytesLength), x.Len())
+		tree.insertions = bitvector.NewBitVector(make([]byte, bytesLength), x.Len())
+	default:
+		tree = EditTree{
+			value: term,
+		}
+	}
+
+	return &tree
+}
+
+// Returns correct (collision-resolved) hash for this term + whether or not
+// it was found in the table already.
+func (e *EditTree) getKeyHash(key *ast.Term) (int, bool) {
+	hash := key.Hash()
+	// This `equal` utility is duplicated and manually inlined a number of
+	// time in this file.  Inlining it avoids heap allocations, so it makes
+	// a big performance difference: some operations like lookup become twice
+	// as slow without it.
+	var equal func(v ast.Value) bool
+
+	switch x := key.Value.(type) {
+	case ast.Null, ast.Boolean, ast.String, ast.Var:
+		equal = func(y ast.Value) bool { return x == y }
+	case ast.Number:
+		if xi, err := json.Number(x).Int64(); err == nil {
+			equal = func(y ast.Value) bool {
+				if y, ok := y.(ast.Number); ok {
+					if yi, err := json.Number(y).Int64(); err == nil {
+						return xi == yi
+					}
+				}
+
+				return false
+			}
+			break
+		}
+
+		// We use big.Rat for comparing big numbers.
+		// It replaces big.Float due to following reason:
+		// big.Float comes with a default precision of 64, and setting a
+		// larger precision results in more memory being allocated
+		// (regardless of the actual number we are parsing with SetString).
+		//
+		// Note: If we're so close to zero that big.Float says we are zero, do
+		// *not* big.Rat).SetString on the original string it'll potentially
+		// take very long.
+		var a *big.Rat
+		fa, ok := new(big.Float).SetString(string(x))
+		if !ok {
+			panic("illegal value")
+		}
+		if fa.IsInt() {
+			if i, _ := fa.Int64(); i == 0 {
+				a = new(big.Rat).SetInt64(0)
+			}
+		}
+		if a == nil {
+			a, ok = new(big.Rat).SetString(string(x))
+			if !ok {
+				panic("illegal value")
+			}
+		}
+
+		equal = func(b ast.Value) bool {
+			if bNum, ok := b.(ast.Number); ok {
+				var b *big.Rat
+				fb, ok := new(big.Float).SetString(string(bNum))
+				if !ok {
+					panic("illegal value")
+				}
+				if fb.IsInt() {
+					if i, _ := fb.Int64(); i == 0 {
+						b = new(big.Rat).SetInt64(0)
+					}
+				}
+				if b == nil {
+					b, ok = new(big.Rat).SetString(string(bNum))
+					if !ok {
+						panic("illegal value")
+					}
+				}
+
+				return a.Cmp(b) == 0
+			}
+			return false
+		}
+
+	default:
+		equal = func(y ast.Value) bool { return ast.Compare(x, y) == 0 }
+	}
+
+	// Look through childKeys, looking up the original hash
+	// value first, and then use linear-probing to iter
+	// through the keys until we either find the Term we're
+	// after, or run out of candidates.
+	for curr, ok := e.childKeys[hash]; ok; {
+		if equal(curr.Value) {
+			return hash, true
+		}
+
+		hash++
+		curr, ok = e.childKeys[hash]
+	}
+
+	// Didn't find any matches in childKeys. Hash will be
+	// the first open slot after the linear probing loop.
+	return hash, false
+}
+
+//gcassert:inline
+func isComposite(t *ast.Term) bool {
+	switch t.Value.(type) {
+	case ast.Object, ast.Set, *ast.Array:
+		return true
+	default:
+		return false
+	}
+}
+
+//gcassert:inline
+func (e *EditTree) setChildKey(hash int, key *ast.Term) {
+	e.childKeys[hash] = key
+}
+
+//gcassert:inline
+func (e *EditTree) setChildScalarValue(hash int, value *ast.Term) {
+	e.childScalarValues[hash] = value
+}
+
+//gcassert:inline
+func (e *EditTree) setChildCompositeValue(hash int, child *EditTree) {
+	e.childCompositeValues[hash] = child
+}
+
+// We don't have a deleteChildKeys method, because once a key is inserted,
+// it can only be replaced with either another value, or a delete node from
+// then on.
+//
+//gcassert:inline
+func (e *EditTree) deleteChildValue(hash int) {
+	delete(e.childScalarValues, hash)
+	delete(e.childCompositeValues, hash)
+}
+
+// Insert creates a new child of e, and returns the new child EditTree node.
+func (e *EditTree) Insert(key, value *ast.Term) (*EditTree, error) {
+	if e.value == nil {
+		return nil, fmt.Errorf("deleted node encountered during insert operation")
+	}
+	if key == nil {
+		return nil, fmt.Errorf("nil key provided for insert operation")
+	}
+	if value == nil {
+		return nil, fmt.Errorf("nil value provided for insert operation")
+	}
+
+	switch x := e.value.Value.(type) {
+	case ast.Object:
+		return e.unsafeInsertObject(key, value), nil
+	case ast.Set:
+		if !key.Equal(value) {
+			return nil, fmt.Errorf("set key %v does not equal value to be inserted %v", key, value)
+		}
+		// We only collapse this Set-typed node if a composite type is involved.
+		if isComposite(key) {
+			// TODO: Investigate re-rendering *only* the immediate composite children.
+			collapsed := e.Render()
+			e.value = collapsed
+			e.childKeys = map[int]*ast.Term{}
+			e.childScalarValues = map[int]*ast.Term{}
+			e.childCompositeValues = map[int]*EditTree{}
+		}
+		return e.unsafeInsertSet(key, value), nil
+	case *ast.Array:
+		idx, err := toIndex(e.insertions.Length(), key)
+		if err != nil {
+			return nil, err
+		}
+		if idx < 0 || idx > e.insertions.Length() {
+			return nil, fmt.Errorf("index for array insertion out of bounds")
+		}
+		return e.unsafeInsertArray(idx, value), nil
+	default:
+		// Catch all primitive types.
+		return nil, fmt.Errorf("expected composite type, found value: %v (type: %T)", x, x)
+	}
+}
+
+func (e *EditTree) unsafeInsertObject(key, value *ast.Term) *EditTree {
+	child := NewEditTree(value)
+	keyHash, found := e.getKeyHash(key)
+	if found {
+		e.deleteChildValue(keyHash)
+	}
+	e.setChildKey(keyHash, key)
+	if isComposite(value) {
+		e.setChildCompositeValue(keyHash, child)
+	} else {
+		e.setChildScalarValue(keyHash, value)
+	}
+	return child
+}
+
+func (e *EditTree) unsafeInsertSet(key, value *ast.Term) *EditTree {
+	child := NewEditTree(value)
+	keyHash, found := e.getKeyHash(key)
+	if found {
+		e.deleteChildValue(keyHash)
+	}
+	e.setChildKey(keyHash, key)
+	if isComposite(value) {
+		e.setChildCompositeValue(keyHash, child)
+	} else {
+		e.setChildScalarValue(keyHash, value)
+	}
+	return child
+}
+
+func (e *EditTree) unsafeInsertArray(idx int, value *ast.Term) *EditTree {
+	child := NewEditTree(value)
+	// Collect insertion indexes above the insertion site for rewriting.
+	rewritesScalars := []int{}
+	rewritesComposites := []int{}
+	for i := idx; i < e.insertions.Length(); i++ {
+		if e.insertions.Element(i) == 1 {
+			if _, ok := e.childScalarValues[i]; ok {
+				rewritesScalars = append(rewritesScalars, i)
+				continue
+			}
+			if _, ok := e.childCompositeValues[i]; ok {
+				rewritesComposites = append(rewritesComposites, i)
+				continue
+			}
+			panic(fmt.Errorf("invalid index %d during Insert operation", i))
+		}
+	}
+	// Do rewrites in reverse order to make room for the newly-inserted element.
+	for i := len(rewritesScalars) - 1; i >= 0; i-- {
+		originalIdx := rewritesScalars[i]
+		rewriteIdx := rewritesScalars[i] + 1
+		v := e.childScalarValues[originalIdx]
+		e.deleteChildValue(originalIdx)
+		e.setChildScalarValue(rewriteIdx, v)
+	}
+	for i := len(rewritesComposites) - 1; i >= 0; i-- {
+		originalIdx := rewritesComposites[i]
+		rewriteIdx := rewritesComposites[i] + 1
+		v := e.childCompositeValues[originalIdx]
+		e.deleteChildValue(originalIdx)
+		e.setChildCompositeValue(rewriteIdx, v)
+	}
+	// Insert new element in children array, bump bit-vector over by 1.
+	if idx == e.insertions.Length() {
+		e.insertions.Append(1)
+	} else {
+		e.insertions.Insert(1, idx)
+	}
+	if isComposite(value) {
+		e.setChildCompositeValue(idx, child)
+	} else {
+		e.setChildScalarValue(idx, value)
+	}
+	return child
+}
+
+// Delete removes a child of e, or else creates a delete node for a term
+// already present in e. It then returns the deleted child EditTree node.
+func (e *EditTree) Delete(key *ast.Term) (*EditTree, error) {
+	if e.value == nil {
+		return nil, fmt.Errorf("deleted node encountered during delete operation")
+	}
+	if key == nil {
+		return nil, fmt.Errorf("nil key provided for delete operation")
+	}
+
+	switch e.value.Value.(type) {
+	case ast.Object:
+		keyHash, found := e.getKeyHash(key)
+		// If child found, replace with delete node. If delete node already existed, error.
+		if found {
+			if child, ok := e.childScalarValues[keyHash]; ok {
+				if child == nil {
+					return nil, fmt.Errorf("cannot delete the already deleted scalar node for key %v", key)
+				}
+				e.setChildKey(keyHash, key)
+				e.setChildScalarValue(keyHash, nil)
+				return NewEditTree(child), nil
+			}
+			if child, ok := e.childCompositeValues[keyHash]; ok {
+				if child == nil {
+					return nil, fmt.Errorf("cannot delete the already deleted composite node for key %v", key)
+				}
+				e.setChildKey(keyHash, key)
+				e.setChildCompositeValue(keyHash, nil)
+				return child, nil
+			}
+			// Note(philipc): We panic here, because the only way to reach
+			// this panic is to have broken the bookkeeping around the key
+			// and child maps in a way that is not recoverable.
+			// For example, if we have an Object EditTree node, and mess up
+			// the bookkeeping elsewhere by deleting just the value from
+			// the child maps, *without* also deleting the key from the key
+			// map, we would reach this place, where the data structure
+			// *expects* a value to exist, but nothing is present.
+			panic(fmt.Errorf("hash value %d not found in scalar or composite child maps", keyHash))
+		}
+		// No child, lookup the key in e.value, and put in a delete if present.
+		// Error if key does not exist in e.value.
+		return e.fallbackDelete(key)
+	case ast.Set:
+		// We only collapse this Set-typed node if a composite type is involved.
+		if isComposite(key) {
+			// TODO: Investigate re-rendering *only* the immediate composite children.
+			collapsed := e.Render()
+			e.value = collapsed
+			e.childKeys = map[int]*ast.Term{}
+			e.childScalarValues = map[int]*ast.Term{}
+			e.childCompositeValues = map[int]*EditTree{}
+		} else {
+			keyHash, found := e.getKeyHash(key)
+			// If child found, replace with delete node. If delete node already existed, error.
+			if found {
+				if child, ok := e.childScalarValues[keyHash]; ok {
+					if child == nil {
+						return nil, fmt.Errorf("cannot delete the already deleted scalar node for key %v", key)
+					}
+					if key.Equal(child) {
+						e.setChildKey(keyHash, key)
+						e.setChildScalarValue(keyHash, nil)
+						return NewEditTree(child), nil
+					}
+				}
+			}
+		}
+		// No child, lookup the key in e.value, and put in a delete if present.
+		// Error if key does not exist in e.value.
+		return e.fallbackDelete(key)
+	case *ast.Array:
+		idx, err := toIndex(e.insertions.Length(), key)
+		if err != nil {
+			return nil, err
+		}
+		if idx < 0 || idx > e.insertions.Length()-1 {
+			return nil, fmt.Errorf("index for array delete out of bounds")
+		}
+
+		// Collect insertion indexes above the delete site for rewriting.
+		rewritesScalars := []int{}
+		rewritesComposites := []int{}
+		for i := idx + 1; i < e.insertions.Length(); i++ {
+			if e.insertions.Element(i) == 1 {
+				if _, ok := e.childScalarValues[i]; ok {
+					rewritesScalars = append(rewritesScalars, i)
+					continue
+				}
+				if _, ok := e.childCompositeValues[i]; ok {
+					rewritesComposites = append(rewritesComposites, i)
+					continue
+				}
+				panic(fmt.Errorf("invalid index %d during Insert operation", i))
+			}
+		}
+		// Do rewrites to clear out the newly-removed element.
+		e.deleteChildValue(idx)
+		for i := 0; i < len(rewritesScalars); i++ {
+			originalIdx := rewritesScalars[i]
+			rewriteIdx := rewritesScalars[i] - 1
+			v := e.childScalarValues[originalIdx]
+			e.deleteChildValue(originalIdx)
+			e.setChildScalarValue(rewriteIdx, v)
+		}
+		for i := 0; i < len(rewritesComposites); i++ {
+			originalIdx := rewritesComposites[i]
+			rewriteIdx := rewritesComposites[i] - 1
+			v := e.childCompositeValues[originalIdx]
+			e.deleteChildValue(originalIdx)
+			e.setChildCompositeValue(rewriteIdx, v)
+		}
+
+		// "bleed through" to the underlying array if needed.
+		// To do this, we sum up the zeroes below the current index, and use that value
+		// to index through the `eliminated` array until we find a surviving index.
+		if e.insertions.Element(idx) == 0 {
+			zeroesSeen := 1 + sumZeroesBelowIndex(idx, e.insertions)
+			// Mark appropriate position in `eliminated` array, or error.
+			elimIdx, found := findIndexOfNthZero(zeroesSeen, e.eliminated)
+			if !found {
+				panic(fmt.Errorf("could not successfully eliminate index %d from array", idx))
+			}
+			e.eliminated.Set(1, elimIdx)
+		}
+		// Delete element from insertions array, bump bit-vec over by 1.
+		e.insertions.Delete(idx)
+		return e, nil
+	default:
+		// Catch all primitive types.
+		return nil, fmt.Errorf("expected composite type, found value: %v (type: %T)", e.value.Value, e.value.Value)
+	}
+}
+
+//gcassert:inline
+func sumZeroesBelowIndex(index int, bv *bitvector.BitVector) int {
+	zeroesSeen := 0
+	for i := 0; i < index; i++ {
+		if bv.Element(i) == 0 {
+			zeroesSeen++
+		}
+	}
+	return zeroesSeen
+}
+
+func findIndexOfNthZero(n int, bv *bitvector.BitVector) (int, bool) {
+	zeroesSeen := 0
+	for i := 0; i < bv.Length(); i++ {
+		if bv.Element(i) == 0 {
+			zeroesSeen++
+		}
+		if zeroesSeen == n {
+			return i, true
+		}
+	}
+	return 0, false
+}
+
+// Helper function for sets/objects when the key isn't present in either
+// child map.
+func (e *EditTree) fallbackDelete(key *ast.Term) (*EditTree, error) {
+	value, err := e.value.Value.Find(ast.Ref{key})
+	if err != nil {
+		return nil, fmt.Errorf("cannot delete child key %v that does not exist", key)
+	}
+	keyHash, _ := e.getKeyHash(key)
+	e.setChildKey(keyHash, key)
+	if isComposite(ast.NewTerm(value)) {
+		e.setChildCompositeValue(keyHash, nil)
+	} else {
+		e.setChildScalarValue(keyHash, nil)
+	}
+	return NewEditTree(ast.NewTerm(value)), nil
+}
+
+// Unfurls a chain of EditTree nodes down a given path, or else returns an error.
+func (e *EditTree) Unfold(path ast.Ref) (*EditTree, error) {
+	// 0 path segments base case. (Root hits this.)
+	if len(path) == 0 {
+		return e, nil
+	}
+	// 1+ path segment case.
+	if e.value == nil {
+		return nil, fmt.Errorf("nil value encountered where composite value was expected")
+	}
+
+	// Switch behavior based on types.
+	key := path[0]
+	switch x := e.value.Value.(type) {
+	case ast.Object:
+		keyHash, found := e.getKeyHash(key)
+		if found {
+			if term, ok := e.childScalarValues[keyHash]; ok {
+				if term == nil {
+					return nil, fmt.Errorf("cannot unfold the already deleted scalar node for key %v", key)
+				}
+				child := NewEditTree(term)
+				return child.Unfold(path[1:])
+			}
+			if child, ok := e.childCompositeValues[keyHash]; ok {
+				if child == nil {
+					return nil, fmt.Errorf("cannot unfold the already deleted composite node for key %v", key)
+				}
+				return child.Unfold(path[1:])
+			}
+			// Note(philipc): We panic here, because the only way to reach
+			// this panic is to have broken the bookkeeping around the key
+			// and child maps in a way that is not recoverable.
+			// For example, if we have an Object EditTree node, and mess up
+			// the bookkeeping elsewhere by deleting just the value from
+			// the child maps, *without* also deleting the key from the key
+			// map, we would reach this place, where the data structure
+			// *expects* a value to exist, but nothing is present.
+			panic(fmt.Errorf("hash value %d not found in scalar or composite child maps", keyHash))
+		}
+		// Fall back to looking up the key in e.value.
+		// Extend the tree if key is present. Error otherwise.
+		if v, err := x.Find(ast.Ref{path[0]}); err == nil {
+			child, err := e.Insert(path[0], ast.NewTerm(v))
+			if err != nil {
+				return nil, err
+			}
+			return child.Unfold(path[1:])
+		}
+		return nil, fmt.Errorf("path %v does not exist in object term %v", ast.Ref{path[0]}, e.value.Value)
+	case ast.Set:
+		// Sets' keys *are* their values, so in order to allow accurate
+		// traversal, we have to collapse the tree beneath this node,
+		// so that we can accurately unfold it again for an update,
+		// once we know that the key we care about is present.
+		if isComposite(key) {
+			collapsed := e.Render()
+			e.value = collapsed
+			e.childKeys = map[int]*ast.Term{}
+			e.childScalarValues = map[int]*ast.Term{}
+			e.childCompositeValues = map[int]*EditTree{}
+		} else {
+			keyHash, found := e.getKeyHash(key)
+			if found {
+				if term, ok := e.childScalarValues[keyHash]; ok {
+					child := NewEditTree(term)
+					return child.Unfold(path[1:])
+				}
+			}
+		}
+		// Fall back to looking up the key in e.value.
+		// Extend the tree if key is present. Error otherwise.
+		if v, err := e.value.Value.Find(ast.Ref{path[0]}); err == nil {
+			child, err := e.Insert(path[0], ast.NewTerm(v))
+			if err != nil {
+				return nil, err
+			}
+			return child.Unfold(path[1:])
+		}
+		return nil, fmt.Errorf("path %v does not exist in set term %v", ast.Ref{path[0]}, e.value.Value)
+	case *ast.Array:
+		idx, err := toIndex(e.insertions.Length(), path[0])
+		if err != nil {
+			return nil, err
+		}
+		if term, ok := e.childScalarValues[idx]; ok {
+			child := NewEditTree(term)
+			return child.Unfold(path[1:])
+		}
+		if child, ok := e.childCompositeValues[idx]; ok {
+			return child.Unfold(path[1:])
+		}
+
+		// Fall back to looking up the key in e.value.
+		// Extend the tree if key is present. Error otherwise.
+		if v, err := x.Find(ast.Ref{ast.IntNumberTerm(idx)}); err == nil {
+			// TODO: Consider a more efficient "Replace" function that special-cases this for arrays instead?
+			_, err := e.Delete(ast.IntNumberTerm(idx))
+			if err != nil {
+				return nil, err
+			}
+			child, err := e.Insert(ast.IntNumberTerm(idx), ast.NewTerm(v))
+			if err != nil {
+				return nil, err
+			}
+			return child.Unfold(path[1:])
+		}
+		return nil, fmt.Errorf("path %v does not exist in array term %v", ast.Ref{ast.IntNumberTerm(idx)}, e.value.Value)
+	default:
+		// Catch all primitive types.
+		return nil, fmt.Errorf("expected composite type for path %v, found value: %v (type: %T)", ast.Ref{path[0]}, x, x)
+	}
+}
+
+// Render generates the effective value for the term at e by recursively
+// rendering the children of e, and then copying over any leftover keys
+// from the original term stored at e.
+func (e *EditTree) Render() *ast.Term {
+	if e.value == nil {
+		return nil
+	}
+
+	switch x := e.value.Value.(type) {
+	case ast.Object:
+		// Early exit if no modifications.
+		if len(e.childKeys) == 0 {
+			return e.value
+		}
+		// Build a new Object with modified/deleted keys.
+		// We do this by adding the modified/deleted keys first, then
+		// skipping those keys later when iterating over the original base
+		// term in e.value.
+		skipKeysList := make([]*ast.Term, 0, len(e.childKeys))
+		out := make([][2]*ast.Term, 0, len(e.childKeys)+x.Len())
+		for hash, term := range e.childScalarValues {
+			skipKeysList = append(skipKeysList, e.childKeys[hash])
+			if term == nil {
+				continue // Delete case.
+			}
+			// Normal value case.
+			out = append(out, [2]*ast.Term{e.childKeys[hash], term})
+		}
+		for hash, child := range e.childCompositeValues {
+			skipKeysList = append(skipKeysList, e.childKeys[hash])
+			if child == nil {
+				continue // Delete case.
+			}
+			// Normal value case.
+			subtreeResult := child.Render()
+			out = append(out, [2]*ast.Term{e.childKeys[hash], subtreeResult})
+		}
+		skipKeys := ast.NewSet(skipKeysList...)
+		// Copy over all keys that weren't deleted/modified.
+		x.Foreach(func(k, v *ast.Term) {
+			if skipKeys.Contains(k) {
+				return
+			}
+			out = append(out, [2]*ast.Term{k, v})
+		})
+		return ast.ObjectTerm(out...)
+	case ast.Set:
+		// Early exit if no modifications.
+		if len(e.childKeys) == 0 {
+			return e.value
+		}
+		// Build a new Set.
+		// Sets only can have deletions/new insertions, because the value
+		// *is* its own key.
+		skipKeysList := make([]*ast.Term, 0, len(e.childKeys))
+		out := make([]*ast.Term, 0, x.Len()+len(e.childKeys))
+		for hash, term := range e.childScalarValues {
+			skipKeysList = append(skipKeysList, e.childKeys[hash])
+			if term == nil {
+				continue // Delete case.
+			}
+			// Normal value case.
+			out = append(out, e.childScalarValues[hash])
+		}
+		// Only happens when this set hasn't been collapsed yet.
+		for hash, child := range e.childCompositeValues {
+			skipKeysList = append(skipKeysList, e.childKeys[hash])
+			if child == nil {
+				continue // Delete case.
+			}
+			// Normal value case.
+			subtreeResult := child.Render()
+			out = append(out, subtreeResult)
+		}
+		skipKeys := ast.NewSet(skipKeysList...)
+		// Copy over all keys that weren't deleted/modified.
+		x.Foreach(func(key *ast.Term) {
+			if skipKeys.Contains(key) {
+				return
+			}
+			out = append(out, key)
+		})
+		return ast.SetTerm(out...)
+	case *ast.Array:
+		// No early exit here, because we might have just deletes on the
+		// original array. We build a new Array with modified/deleted keys.
+		out := make([]*ast.Term, 0, e.insertions.Length())
+		eIdx := 0
+		for i := 0; i < e.insertions.Length(); i++ {
+			// If the index == 0, that indicates we should look up the next
+			// surviving original element.
+			// If the index == 1, that indicates we should look up that
+			// index in the child maps.
+			if e.insertions.Element(i) == 0 {
+				// Scan through the e.eliminated bit-vec, pick the
+				// first non-zero index. The then use that index to
+				// look up the element we should append from e.value.
+				foundIdx := false
+				for j := eIdx; j < e.eliminated.Length(); j++ {
+					if e.eliminated.Element(j) == 0 {
+						foundIdx = true
+						eIdx = j
+						break
+					}
+				}
+				if !foundIdx {
+					panic(fmt.Errorf("too many eliminated indexes in array, expected to find uneliminated index %d", i))
+				}
+				// Append element from original term.
+				out = append(out, x.Elem(eIdx))
+				eIdx++ // Bump the counter, so that we monotonically advance through the array.
+			} else {
+				// Append value from rendered child index.
+				// Since deletions are not possible as children for an Array,
+				// we don't need to check for nils here.
+				if t, ok := e.childScalarValues[i]; ok {
+					out = append(out, t)
+				} else if child, ok := e.childCompositeValues[i]; ok {
+					t := child.Render()
+					out = append(out, t)
+				} else {
+					panic(fmt.Errorf("invalid index %d does not exist in array", i))
+				}
+			}
+		}
+		return ast.ArrayTerm(out...)
+	default:
+		return e.value
+	}
+}
+
+// InsertAtPath traverses down the tree from e and uses the last path
+// segment as the key to insert value into the tree.
+// Returns the inserted EditTree node.
+func (e *EditTree) InsertAtPath(path ast.Ref, value *ast.Term) (*EditTree, error) {
+	if value == nil {
+		return nil, fmt.Errorf("cannot insert nil value into EditTree")
+	}
+
+	if len(path) == 0 {
+		e.value = value
+		e.childKeys = map[int]*ast.Term{}
+		e.childScalarValues = map[int]*ast.Term{}
+		e.childCompositeValues = map[int]*EditTree{}
+		if v, ok := value.Value.(*ast.Array); ok {
+			bytesLength := ((v.Len() - 1) / 8) + 1 // How many bytes to use for the bit-vectors.
+			e.eliminated = bitvector.NewBitVector(make([]byte, bytesLength), v.Len())
+			e.insertions = bitvector.NewBitVector(make([]byte, bytesLength), v.Len())
+		}
+		return e, nil
+	}
+
+	dest, err := e.Unfold(path[:len(path)-1])
+	if err != nil {
+		return nil, err
+	}
+
+	return dest.Insert(path[len(path)-1], value)
+}
+
+// DeleteAtPath traverses down the tree from e and uses the last path
+// segment as the key to delete a node from the tree.
+// Returns the deleted EditTree node.
+func (e *EditTree) DeleteAtPath(path ast.Ref) (*EditTree, error) {
+	// Root document case:
+	if len(path) == 0 {
+		if e.value == nil {
+			return nil, fmt.Errorf("deleted node encountered during delete operation")
+		}
+		e.value = nil
+		e.childKeys = nil
+		e.childScalarValues = nil
+		e.childCompositeValues = nil
+		e.eliminated = nil
+		e.insertions = nil
+		return e, nil
+	}
+
+	dest, err := e.Unfold(path[:len(path)-1])
+	if err != nil {
+		return nil, err
+	}
+
+	return dest.Delete(path[len(path)-1])
+}
+
+// RenderAtPath traverses down the tree from e and renders the EditTree
+// node at the end of path.
+func (e *EditTree) RenderAtPath(path ast.Ref) (*ast.Term, error) {
+	dest, err := e.Unfold(path)
+	if err != nil {
+		return nil, err
+	}
+
+	return dest.Render(), nil
+}
+
+func (e *EditTree) String() string {
+	if t := e.Render(); t != nil {
+		return "EditTree[" + t.String() + "]"
+	}
+	return ""
+}
+
+func (e *EditTree) Exists(path ast.Ref) bool {
+	if e.value == nil {
+		return false
+	}
+
+	switch {
+	// 0 path segments base case. (Root hits this.)
+	case len(path) == 0:
+		return true
+	// 1+ path segments case.
+	case len(path) >= 1:
+		// Switch behavior based on types.
+		key := path[0]
+		switch x := e.value.Value.(type) {
+		case ast.Object:
+			keyHash, found := e.getKeyHash(key)
+			if found {
+				if term, ok := e.childScalarValues[keyHash]; ok {
+					if term == nil {
+						return false
+					}
+					return len(path) == 1
+				}
+				if child, ok := e.childCompositeValues[keyHash]; ok {
+					if child == nil {
+						return false
+					}
+					return child.Exists(path[1:])
+				}
+				// Note(philipc): We panic here, because the only way to reach
+				// this panic is to have broken the bookkeeping around the key
+				// and child maps in a way that is not recoverable.
+				// For example, if we have an Object EditTree node, and mess up
+				// the bookkeeping elsewhere by deleting just the value from
+				// the child maps, *without* also deleting the key from the key
+				// map, we would reach this place, where the data structure
+				// *expects* a value to exist, but nothing is present.
+				panic(fmt.Errorf("hash value %d not found in scalar or composite child maps", keyHash))
+			}
+			// Fallback if child lookup failed.
+			_, err := x.Find(path)
+			return err == nil
+		case ast.Set:
+			// Sets' keys *are* their values, so in order to allow accurate
+			// traversal, we have to collapse the tree beneath this node,
+			// so that we can accurately unfold it again for an update,
+			// once we know that the key we care about is present.
+			if isComposite(key) {
+				collapsed := e.Render()
+				e.value = collapsed
+				e.childKeys = map[int]*ast.Term{}
+				e.childScalarValues = map[int]*ast.Term{}
+				e.childCompositeValues = map[int]*EditTree{}
+			} else {
+				keyHash, found := e.getKeyHash(key)
+				if found {
+					if _, ok := e.childScalarValues[keyHash]; ok {
+						return len(path) == 1
+					}
+				}
+			}
+			// Fallback if child lookup failed.
+			_, err := e.value.Value.Find(path)
+			return err == nil
+		case *ast.Array:
+			var idx int
+			idx, err := toIndex(e.insertions.Length(), path[0])
+			if err != nil {
+				return false
+			}
+			if _, ok := e.childScalarValues[idx]; ok {
+				return len(path) == 1
+			}
+			if child, ok := e.childCompositeValues[idx]; ok {
+				return child.Exists(path[1:])
+			}
+			// Fallback if child lookup failed.
+			// We have to ensure that the lookup term is a number here, or Find will fail.
+			k := ast.Ref{ast.IntNumberTerm(idx)}.Concat(path[1:])
+			_, err = x.Find(k)
+			return err == nil
+		default:
+			// Catch all primitive types.
+			return false
+		}
+	}
+	return false
+}
+
+// --------------------------------------------------------------------
+// Utility functions
+
+// toIndex tries to convert path elements (that may be strings) into indexes
+// into an array.
+func toIndex(arrayLength int, term *ast.Term) (int, error) {
+	i := 0
+	var ok bool
+	switch v := term.Value.(type) {
+	case ast.Number:
+		if i, ok = v.Int(); !ok {
+			return 0, fmt.Errorf("invalid number type for indexing")
+		}
+	case ast.String:
+		if v == "-" {
+			return arrayLength, nil
+		}
+		num := ast.Number(v)
+		if i, ok = num.Int(); !ok {
+			return 0, fmt.Errorf("invalid string for indexing")
+		}
+		if v != "0" && strings.HasPrefix(string(v), "0") {
+			return 0, fmt.Errorf("leading zeros are not allowed in JSON paths")
+		}
+	default:
+		return 0, fmt.Errorf("invalid type for indexing")
+	}
+
+	return i, nil
+}
+
+// --------------------------------------------------------------------
+// Term-level utility functions
+
+// Filter pulls out only the values selected by paths.
+// This is done recursively by plucking off one level from the paths each time we descend a level.
+// Note: Values pulled from arrays will have the same approximate
+// ordering in the final term.
+func (e *EditTree) Filter(paths []ast.Ref) *ast.Term {
+	if e.value == nil {
+		return nil
+	}
+
+	// Separate out keys for this level.
+	// In the event of paths like "a", "a/b", "a/b/c", the "a" path will win out.
+	// Nil keys, such as "" or [], are not permitted. (legacy behavior)
+	pathMap := make(map[ast.Value][]ast.Ref, len(paths))
+	renderNowList := []*ast.Term{}
+	for i := range paths {
+		path := paths[i]
+		switch {
+		case len(path) == 0:
+			continue // ignore nil paths, such as "" and [].
+		case len(path) == 1:
+			renderNowList = append(renderNowList, path[0])
+		default: // len(path) > 1
+			if _, ok := pathMap[path[0].Value]; !ok {
+				pathMap[path[0].Value] = []ast.Ref{}
+			}
+			pathMap[path[0].Value] = append(pathMap[path[0].Value], path[1:])
+		}
+	}
+	renderNow := ast.NewSet(renderNowList...)
+	// Clear everything out of the pathMap that has a renderNow candidate.
+	for k := range pathMap {
+		if renderNow.Contains(ast.NewTerm(k)) {
+			delete(pathMap, k)
+		}
+	}
+
+	// Now that we've reached the target, we can start rendering everything beneath us in the tree.
+	switch e.value.Value.(type) {
+	case ast.Object:
+		out := make([][2]*ast.Term, 0, renderNow.Len()+len(pathMap))
+		// Render any finished paths.
+		renderNow.Foreach(func(k *ast.Term) {
+			if e.Exists(ast.Ref{k}) {
+				subtreeResult, _ := e.RenderAtPath(ast.Ref{k})
+				out = append(out, [2]*ast.Term{k, subtreeResult})
+			}
+		})
+		// Recursively descend remaining paths.
+		for k, p := range pathMap {
+			if e.Exists(ast.Ref{ast.NewTerm(k)}) {
+				child, _ := e.Unfold(ast.Ref{ast.NewTerm(k)})
+				subtreeResult := child.Filter(p)
+				out = append(out, [2]*ast.Term{ast.NewTerm(k), subtreeResult})
+			}
+		}
+		return ast.ObjectTerm(out...)
+	case ast.Set:
+		out := make([]*ast.Term, 0, renderNow.Len()+len(pathMap))
+		// Render any finished paths.
+		renderNow.Foreach(func(k *ast.Term) {
+			if e.Exists(ast.Ref{k}) {
+				subtreeResult, _ := e.RenderAtPath(ast.Ref{k})
+				out = append(out, subtreeResult)
+			}
+		})
+		// Recursively descend remaining paths.
+		for k, p := range pathMap {
+			if e.Exists(ast.Ref{ast.NewTerm(k)}) {
+				child, _ := e.Unfold(ast.Ref{ast.NewTerm(k)})
+				subtreeResult := child.Filter(p)
+				out = append(out, subtreeResult)
+			}
+		}
+		return ast.SetTerm(out...)
+	case *ast.Array:
+		// No early exit here, because we might have just deletes on the
+		// original array. We build a new Array with modified/deleted keys.
+		out := make([]*ast.Term, 0, renderNow.Len()+len(pathMap))
+		// Sort array indexes before descending.
+		idxList := make([]*ast.Term, 0, len(pathMap))
+		renderNow.Foreach(func(k *ast.Term) {
+			idxList = append(idxList, k)
+		})
+		for k := range pathMap {
+			idxList = append(idxList, ast.NewTerm(k))
+		}
+		sort.Sort(termSlice(idxList))
+		// Render child or recursively descend as needed.
+		for i := range idxList {
+			k := idxList[i]
+			if renderNow.Contains(k) {
+				if e.Exists(ast.Ref{k}) {
+					subtreeResult, _ := e.RenderAtPath(ast.Ref{k})
+					out = append(out, subtreeResult)
+				}
+			} else if e.Exists(ast.Ref{k}) {
+				child, _ := e.Unfold(ast.Ref{k})
+				subtreeResult := child.Filter(pathMap[k.Value])
+				out = append(out, subtreeResult)
+			}
+		}
+		return ast.ArrayTerm(out...)
+	default:
+		return e.value
+	}
+}
+
+type termSlice []*ast.Term
+
+func (s termSlice) Less(i, j int) bool { return ast.Compare(s[i].Value, s[j].Value) < 0 }
+func (s termSlice) Swap(i, j int)      { x := s[i]; s[i] = s[j]; s[j] = x }
+func (s termSlice) Len() int           { return len(s) }
diff --git a/internal/edittree/edittree_test.go b/internal/edittree/edittree_test.go
new file mode 100644
index 0000000000..9b99d92566
--- /dev/null
+++ b/internal/edittree/edittree_test.go
@@ -0,0 +1,950 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package edittree
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/topdown/builtins"
+)
+
+// These test cases require malformed tree nodes or arguments,
+// so they're tested separately from normal error conditions.
+func TestEditTreeNilValueCases(t *testing.T) {
+	// Try to create an EditTree with a nil Term pointer.
+	if tree := NewEditTree(nil); tree != nil {
+		t.Fatalf("Expected nil pointer, got %v", tree)
+	}
+
+	// Try to Insert on a nil-valued EditTree node.
+	badroot := EditTree{value: nil}
+	if result, err := badroot.Insert(ast.StringTerm("a"), ast.IntNumberTerm(2)); err != nil {
+		if err.Error() != "deleted node encountered during insert operation" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from Insert on nil-valued tree node, got %v", result)
+	}
+	// Try to Delete on a nil-valued EditTree node.
+	if result, err := badroot.Delete(ast.StringTerm("a")); err != nil {
+		if err.Error() != "deleted node encountered during delete operation" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from Delete on nil-valued tree node, got %v", result)
+	}
+	// Try to Unfold past a nil-valued EditTree node.
+	if result, err := badroot.Unfold(ast.Ref{ast.StringTerm("a")}); err != nil {
+		if err.Error() != "nil value encountered where composite value was expected" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from Unfold on nil-valued tree node, got %v", result)
+	}
+	// Try Exists with a nil-valued EditTree node.
+	if ok := badroot.Exists(ast.Ref{ast.StringTerm("a")}); ok {
+		t.Fatalf("Expected false from Exists on nil-valued tree node, got true instead")
+	}
+	// Try Filter with a nil-valued EditTree node.
+	if result := badroot.Filter([]ast.Ref{{ast.StringTerm("a")}}); result != nil {
+		t.Fatalf("Expected nil from Filter with nil-valued tree node, got: %v", result)
+	}
+
+	// Try to Insert with a nil value as the key Term.
+	simpleTree := NewEditTree(ast.ObjectTerm())
+	if result, err := simpleTree.Insert(nil, ast.IntNumberTerm(2)); err != nil {
+		if err.Error() != "nil key provided for insert operation" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from Insert with nil-valued key Term, got %v", result)
+	}
+	// Try to Insert with a nil value as the value Term.
+	if result, err := simpleTree.Insert(ast.StringTerm("a"), nil); err != nil {
+		if err.Error() != "nil value provided for insert operation" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from Insert with nil-valued value Term, got %v", result)
+	}
+	// Try to Delete with a nil value as the key Term
+	if result, err := simpleTree.Delete(nil); err != nil {
+		if err.Error() != "nil key provided for delete operation" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from Delete with nil-valued key Term, got %v", result)
+	}
+	// Try to InsertAtPath with a nil value.
+	if result, err := simpleTree.InsertAtPath(ast.Ref{ast.StringTerm("a")}, nil); err != nil {
+		if err.Error() != "cannot insert nil value into EditTree" {
+			t.Fatalf("wrong error: %v", err.Error())
+		}
+	} else {
+		t.Fatalf("Expected error from InsertAtPath with nil-valued value Term, got %v", result)
+	}
+	// Try Filter with a nil-valued path slice.
+	if result := simpleTree.Filter(nil); ast.Compare(result, ast.ObjectTerm()) != 0 {
+		t.Fatalf("Expected empty Object from Filter with nil-valued path slice, got: %v", result)
+	}
+	if result := simpleTree.Filter([]ast.Ref{{ast.StringTerm("/a")}, nil}); ast.Compare(result, ast.ObjectTerm()) != 0 {
+		t.Fatalf("Expected empty Object from Filter with nil-valued path slice, got: %v", result)
+	}
+}
+
+func TestEditTreeString(t *testing.T) {
+	// A nil-valued EditTree node.
+	badroot := EditTree{value: nil}
+	if result := badroot.String(); result != "" {
+		t.Fatalf("Expected \"\", got %v", result)
+	}
+	// A normal EditTree node.
+	normalTree := NewEditTree(ast.ArrayTerm(ast.IntNumberTerm(0), ast.IntNumberTerm(1), ast.IntNumberTerm(2)))
+	if result := normalTree.String(); result != "" {
+		if result != "EditTree[[0, 1, 2]]" {
+			t.Fatalf("Expected EditTree[[0, 1, 2]], got %v", result)
+		}
+	} else {
+		t.Fatal("Unexpected empty string")
+	}
+}
+
+func TestEditTreeFilter(t *testing.T) {
+	cases := []struct {
+		note      string
+		object    string
+		paths     []string
+		source    string
+		expResult string
+		expError  error
+	}{
+		// Simple scalar.
+		{
+			note:      "simple scalar",
+			paths:     []string{`[]`},
+			source:    `2`,
+			expResult: `2`,
+		},
+		// Top-level keys only.
+		{
+			note:      "simple top-level key - object",
+			paths:     []string{`"/b"`},
+			source:    `{"a": 2, "b": 3}`,
+			expResult: `{"b": 3}`,
+		},
+		{
+			note:      "simple top-level key - set",
+			paths:     []string{`"/b"`},
+			source:    `{"a", "b", "c"}`,
+			expResult: `{"b"}`,
+		},
+		{
+			note:      "simple top-level key - array",
+			paths:     []string{`"/1"`},
+			source:    `["a", "b", "c"]`,
+			expResult: `["b"]`,
+		},
+		// Nested keys.
+		{
+			note:      "simple nested key - object",
+			paths:     []string{`"/a/b/c"`},
+			source:    `{"a": {"b": {"c": 3}, "d": 4}, "e": 5}`,
+			expResult: `{"a": {"b": {"c": 3}}}`,
+		},
+		{
+			note:      "simple nested key - set",
+			paths:     []string{`[{"b", {"c"}}, {"c"}]`},
+			source:    `{"a", {"b", {"c"}}}`,
+			expResult: `{{{"c"}}}`,
+		},
+		{
+			note:      "simple nested key - array",
+			paths:     []string{`"/1/1/0"`},
+			source:    `["a", ["b", ["c", 3], 4], 5]`,
+			expResult: `[[["c"]]]`,
+		},
+		// Overlapping paths.
+		{
+			note:      "overlapping nested keys - object",
+			paths:     []string{`"/a/b/c"`, `"/a"`},
+			source:    `{"a": {"b": {"c": 3}, "d": 4}, "e": 5}`,
+			expResult: `{"a": {"b": {"c": 3}, "d": 4}}`,
+		},
+		// Out-of-order array indexes.
+		{
+			note:      "out-of-order array indexes.",
+			paths:     []string{`"/4"`, `"/0"`, `"/1"`},
+			source:    `["a", "b", "c", "d", "e"]`,
+			expResult: `["a", "b", "e"]`,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			paths := make([]ast.Ref, 0, len(tc.paths))
+			for i := range tc.paths {
+				path, err := parsePath(ast.MustParseTerm(tc.paths[i]))
+				if err != nil {
+					t.Fatal("could not parse path:", tc.paths[i])
+				}
+				paths = append(paths, path)
+			}
+
+			et := NewEditTree(ast.MustParseTerm(tc.source))
+			// If an error occurred, was it the error we expected? If not, then that's an error.
+
+			actual := et.Filter(paths)
+			// TODO: Nil check here?
+			// if err != nil {
+			// 	t.Fatalf("unexpected error rendering EditTree: %s", err)
+			// }
+
+			if tc.expResult != "" {
+				expected := ast.MustParseTerm(tc.expResult)
+				if expected.Value.Compare(actual.Value) != 0 {
+					t.Errorf("Wrong result generated from filter list:\n\nExpected:\n\t%v\n\nActual:\n\t%v\n\n", expected, actual)
+				}
+			}
+		})
+	}
+}
+
+// Some of the tests in this batch of tests reference the underlying tree
+// methods directly. Those tests exist specifically to boost the test
+// suite's line coverage. References to scalar/composite are similar in
+// purpose: ensuring as many code paths are excercised as possible.
+func TestEditTreeApplyPatches(t *testing.T) {
+	cases := []struct {
+		note      string
+		object    string
+		patches   []string
+		source    string
+		expResult string
+		expError  error
+	}{
+		// Ops on top-level keys only.
+		{
+			note:      "simple add",
+			patches:   []string{`{"op": "add", "path": "/b", "value": 3}`},
+			source:    `{"a": 2}`,
+			expResult: `{"a": 2, "b": 3}`,
+		},
+		{
+			note:      "simple remove",
+			patches:   []string{`{"op": "remove", "path": "/a"}`},
+			source:    `{"a": true}`,
+			expResult: `{}`,
+		},
+		{
+			note:      "simple replace",
+			patches:   []string{`{"op": "replace", "path": "/a", "value": 3}`},
+			source:    `{"a": true}`,
+			expResult: `{"a": 3}`,
+		},
+		{
+			note:      "simple move",
+			patches:   []string{`{"op": "move", "path": "/b", "from": "/a"}`},
+			source:    `{"a": true}`,
+			expResult: `{"b": true}`,
+		},
+		{
+			note:      "simple copy",
+			patches:   []string{`{"op": "copy", "path": "/b", "from": "/a"}`},
+			source:    `{"a": true}`,
+			expResult: `{"a": true, "b": true}`,
+		},
+		{
+			note:      "simple test",
+			patches:   []string{`{"op": "test", "path": "/a", "value": 2}`},
+			source:    `{"a": 2}`,
+			expResult: `{"a": 2}`,
+		},
+		// Op chains:
+		{
+			note: "simple add-remove chain x3",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": 3}`,
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "add", "path": "/a", "value": 3}`,
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "add", "path": "/a", "value": 3}`,
+				`{"op": "remove", "path": "/a"}`,
+			},
+			source:    `{"a": true}`,
+			expResult: `{}`,
+		},
+		{
+			note: "simple add-move-remove chain x2",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": 3}`,
+				`{"op": "move", "path": "/b", "from": "/a"}`,
+				`{"op": "remove", "path": "/b"}`,
+				`{"op": "add", "path": "/a", "value": 3}`,
+				`{"op": "move", "path": "/b", "from": "/a"}`,
+				`{"op": "remove", "path": "/b"}`,
+			},
+			source:    `{"a": true}`,
+			expResult: `{}`,
+		},
+		{
+			note: "simple add chain x3",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": 3}`,
+				`{"op": "add", "path": "/a", "value": 4}`,
+				`{"op": "add", "path": "/a", "value": 5}`,
+			},
+			source:    `{"a": true}`,
+			expResult: `{"a": 5}`,
+		},
+		{
+			note: "simple replace chain x3",
+			patches: []string{
+				`{"op": "replace", "path": "/a", "value": 3}`,
+				`{"op": "replace", "path": "/a", "value": 4}`,
+				`{"op": "replace", "path": "/a", "value": 5}`,
+			},
+			source:    `{"a": true}`,
+			expResult: `{"a": 5}`,
+		},
+		{
+			note: "simple test chain x3",
+			patches: []string{
+				`{"op": "test", "path": "/a", "value": 3}`,
+				`{"op": "test", "path": "/a", "value": 3}`,
+				`{"op": "test", "path": "/a", "value": 3}`,
+			},
+			source:    `{"a": 3}`,
+			expResult: `{"a": 3}`,
+		},
+		// Nested operation tests.
+		{
+			note: "nested add chain object x3",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": {"b": {}}}`,
+				`{"op": "add", "path": "/a/b", "value": {"c": {}}}`,
+				`{"op": "add", "path": "/a/b/c", "value": {"d": {}}}`,
+			},
+			source:    `{"a": {}}`,
+			expResult: `{"a": {"b": {"c": {"d": {}}}}}`,
+		},
+		{
+			note: "nested add chain array x3 - composites",
+			patches: []string{
+				`{"op": "add", "path": "/0", "value": []}`,
+				`{"op": "add", "path": "/0/0", "value": []}`,
+				`{"op": "add", "path": "/0/0/0", "value": []}`,
+			},
+			source:    `[]`,
+			expResult: `[[[[]]]]`,
+		},
+		{
+			note: "add chain array x3 - scalars",
+			patches: []string{
+				`{"op": "add", "path": "/0", "value": 1}`,
+				`{"op": "add", "path": "/0", "value": 2}`,
+				`{"op": "add", "path": "/0", "value": 3}`,
+			},
+			source:    `[0]`,
+			expResult: `[3, 2, 1, 0]`,
+		},
+		{
+			note: "remove chain array x3 - scalars",
+			patches: []string{
+				`{"op": "add", "path": "/0", "value": 1}`,
+				`{"op": "add", "path": "/0", "value": 2}`,
+				`{"op": "add", "path": "/0", "value": 3}`,
+				`{"op": "remove", "path": "/0"}`,
+				`{"op": "remove", "path": "/0"}`,
+				`{"op": "remove", "path": "/0"}`,
+			},
+			source:    `[0]`,
+			expResult: `[0]`,
+		},
+		{
+			note: "nested add chain set complex",
+			patches: []string{
+				`{"op": "add", "path": [{1}, 2], "value": 2}`,           // {{1, 2}, {2}, {3}}
+				`{"op": "add", "path": [{2}, 3], "value": 3}`,           // {{1, 2}, {2, 3}, {3}}
+				`{"op": "add", "path": [{3}, {4}], "value": {4}}`,       // {{1, 2}, {2, 3}, {3, {4}}}
+				`{"op": "add", "path": [{3, {4}}, {4}, 5], "value": 5}`, // {{1, 2}, {2, 3}, {3, {4, 5}}}
+			},
+			source:    `{{1}, {2}, {3}}`,
+			expResult: `{{1, 2}, {2, 3}, {3, {4, 5}}}`,
+		},
+		{
+			note: "nested remove chain object x3",
+			patches: []string{
+				`{"op": "remove", "path": "/a/b/c/d"}`,
+				`{"op": "remove", "path": "/a/b/c"}`,
+				`{"op": "remove", "path": "/a/b"}`,
+			},
+			source:    `{"a": {"b": {"c": {"d": {}}}}}`,
+			expResult: `{"a": {}}`,
+		},
+		{
+			note: "nested remove chain array x3",
+			patches: []string{
+				`{"op": "remove", "path": "/1/2/0"}`,
+				`{"op": "remove", "path": "/1/1"}`,
+				`{"op": "remove", "path": "/0"}`,
+			},
+			source:    `[1, [2, 3, [4, 5]]]`,
+			expResult: `[[2, [5]]]`,
+		},
+		// Array operations:
+		{
+			note: "array add scalars",
+			patches: []string{
+				`{"op": "add", "path": [0], "value": 1}`, // [1, 0]
+				`{"op": "add", "path": [0], "value": 2}`, // [2, 1, 0]
+				`{"op": "add", "path": [0], "value": 3}`, // [3, 2, 1, 0]
+			},
+			source:    `[0]`,
+			expResult: `[3, 2, 1, 0]`,
+		},
+		{
+			note: "array add composites",
+			patches: []string{
+				`{"op": "add", "path": [0], "value": [1]}`, // [[1], 0]
+				`{"op": "add", "path": [0], "value": [2]}`, // [[2], [1], 0]
+				`{"op": "add", "path": [0], "value": [3]}`, // [[3], [2], [1], 0]
+			},
+			source:    `[0]`,
+			expResult: `[[3], [2], [1], 0]`,
+		},
+		{
+			note: "array append scalar",
+			patches: []string{
+				`{"op": "add", "path": "-", "value": 2}`, // [0, 1]
+			},
+			source:    `[0, 1]`,
+			expResult: `[0, 1, 2]`,
+		},
+		// Object operations:
+		{
+			note: "object add/replace bignum scalar",
+			patches: []string{
+				`{"op": "add", "path": [18446744073709551616], "value": 2}`,
+				`{"op": "add", "path": [18446744073709551616], "value": 3}`,
+			},
+			source:    `{}`,
+			expResult: `{18446744073709551616: 3}`,
+		},
+		// Set operations:
+		{
+			note: "set add scalar",
+			patches: []string{
+				`{"op": "add", "path": [2], "value": 2}`, // {"a", 2}
+			},
+			source:    `{"a"}`,
+			expResult: `{"a", 2}`,
+		},
+		{
+			note: "set remove scalar",
+			patches: []string{
+				`{"op": "remove", "path": [2]}`, // {"a"}
+			},
+			source:    `{"a", 2}`,
+			expResult: `{"a"}`,
+		},
+		{
+			note: "set remove scalar child",
+			patches: []string{
+				`{"op": "add", "path": ["b"], "value": "b"}`, // {"a", "b"}
+				`{"op": "add", "path": [2], "value": 2}`,     // {"a", "b", 2}
+				`{"op": "test", "path": [2], "value": 2}`,
+				`{"op": "remove", "path": ["b"]}`, // {"a", 2}
+				`{"op": "remove", "path": [2]}`,   // {"a"}
+			},
+			source:    `{"a"}`,
+			expResult: `{"a"}`,
+		},
+		{
+			note: "nested set add composite",
+			patches: []string{
+				`{"op": "add", "path": [{"a"}], "value": {"a"}}`,                                           // {"a", {"a"}}
+				`{"op": "add", "path": [{"a"}, {"a"}], "value": {"a"}}`,                                    // {"a", {"a", {"a"}}}
+				`{"op": "add", "path": [{"a", {"a"}}, {"a"}, {"a"}], "value": {"a"}}`,                      // {"a", {"a", {"a", {"a"}}}}
+				`{"op": "add", "path": [{"a", {"a", {"a"}}}, {"a", {"a"}}, {"a"}, {"a"}], "value": {"a"}}`, // {"a", {"a", {"a", {"a", {"a"}}}}}
+			},
+			source:    `{"a"}`,
+			expResult: `{"a", {"a", {"a", {"a", {"a"}}}}}`,
+		},
+		{
+			note: "set remove nested composite",
+			patches: []string{
+				`{"op": "remove", "path": [{"a", {"a", {"a", {"a"}}}}, {"a", {"a", {"a"}}}, {"a", {"a"}}, {"a"}]}`, // {"a", {"a", {"a", {"a"}}}}
+				`{"op": "remove", "path": [{"a", {"a", {"a"}}}, {"a", {"a"}}, {"a"}]}`,                             // {"a", {"a", {"a"}}}
+				`{"op": "remove", "path": [{"a", {"a"}}, {"a"}]}`,                                                  // {"a", {"a"}}
+				`{"op": "remove", "path": [{"a"}]}`,                                                                // {"a"}
+				`{"op": "remove", "path": ["a"]}`,
+			},
+			source:    `{"a", {"a", {"a", {"a", {"a"}}}}}`,
+			expResult: `set()`,
+		},
+		// Operations on the root:
+		{
+			note: "remove root",
+			patches: []string{
+				`{"op": "remove", "path": []}`,
+			},
+			source:    `{"a"}`,
+			expResult: ``,
+		},
+		{
+			note: "add/replace root with scalar",
+			patches: []string{
+				`{"op": "add", "path": [], "value": 3}`,
+			},
+			source:    `{"a"}`,
+			expResult: `3`,
+		},
+		{
+			note: "add/replace root with composite",
+			patches: []string{
+				`{"op": "add", "path": [], "value": [3]}`,
+			},
+			source:    `{"a"}`,
+			expResult: `[3]`,
+		},
+
+		// Error cases.
+		// Root node cases.
+		{
+			note: "remove on empty root errors",
+			patches: []string{
+				`{"op": "remove", "path": []}`,
+				`{"op": "remove", "path": []}`,
+			},
+			source:   `"a"`,
+			expError: fmt.Errorf(`deleted node encountered during delete operation`),
+		},
+		// Primitive/Scalar error cases.
+		{
+			note: "nested add on primitive string",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": "example"}`,
+			},
+			source:   `"a"`,
+			expError: fmt.Errorf(`expected composite type, found value: "a" (type: ast.String)`),
+		},
+		{
+			note: "nested add on primitive number",
+			patches: []string{
+				`{"op": "add", "path": "/1", "value": "example"}`,
+			},
+			source:   `2`,
+			expError: fmt.Errorf(`expected composite type, found value: 2 (type: ast.Number)`),
+		},
+		{
+			note: "nested remove on primitive string",
+			patches: []string{
+				`{"op": "remove", "path": "/a"}`,
+			},
+			source:   `"a"`,
+			expError: fmt.Errorf(`expected composite type, found value: "a" (type: ast.String)`),
+		},
+		{
+			note: "nested remove on primitive number",
+			patches: []string{
+				`{"op": "remove", "path": "/1"}`,
+			},
+			source:   `2`,
+			expError: fmt.Errorf(`expected composite type, found value: 2 (type: ast.Number)`),
+		},
+		{
+			note: "nested remove on nested primitive number",
+			patches: []string{
+				`{"op": "test", "path": "/a/2/b", "value": 3}`,
+			},
+			source:   `{"a": 2}`,
+			expError: fmt.Errorf(`expected composite type for path "2", found value: 2 (type: ast.Number)`),
+		},
+		// Object error cases.
+		{
+			note: "remove on non-existent Object path",
+			patches: []string{
+				`{"op": "remove", "path": "/b"}`,
+			},
+			source:   `{"a": {}}`,
+			expError: fmt.Errorf(`cannot delete child key "b" that does not exist`),
+		},
+		{
+			note: "add on non-existent nested Object path",
+			patches: []string{
+				`{"op": "add", "path": "/b/c", "value": "example"}`,
+			},
+			source:   `{"a": {}}`,
+			expError: fmt.Errorf(`path "b" does not exist in object term {"a": {}}`),
+		},
+		{
+			note: "remove on non-existent nested Object path",
+			patches: []string{
+				`{"op": "remove", "path": "/b/c"}`,
+			},
+			source:   `{"a": {}}`,
+			expError: fmt.Errorf(`path "b" does not exist in object term {"a": {}}`),
+		},
+		{
+			note: "delete fails on deleted Object path - scalar",
+			patches: []string{
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "remove", "path": "/a"}`,
+			},
+			source:   `{"a": 2}`,
+			expError: fmt.Errorf(`cannot delete the already deleted scalar node for key "a"`),
+		},
+		{
+			note: "delete fails on deleted Object path - composite",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": {2}}`,
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "remove", "path": "/a"}`,
+			},
+			source:   `{}`,
+			expError: fmt.Errorf(`cannot delete the already deleted composite node for key "a"`),
+		},
+		{
+			note: "unfold fails on deleted Object path - scalar",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": 2}`,
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "test", "path": "/a", "value": 2}`,
+			},
+			source:   `{}`,
+			expError: fmt.Errorf(`cannot unfold the already deleted scalar node for key "a"`),
+		},
+		{
+			note: "unfold fails on deleted Object path - composite",
+			patches: []string{
+				`{"op": "add", "path": "/a", "value": {2}}`,
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "test", "path": "/a", "value": 2}`,
+			},
+			source:   `{}`,
+			expError: fmt.Errorf(`cannot unfold the already deleted composite node for key "a"`),
+		},
+		// Array error cases.
+		{
+			note: "add on non-existent Array path",
+			patches: []string{
+				`{"op": "add", "path": "/2", "value": "example"}`,
+			},
+			source:   `["a"]`,
+			expError: fmt.Errorf(`index for array insertion out of bounds`),
+		},
+		{
+			note: "remove on non-existent Array path",
+			patches: []string{
+				`{"op": "remove", "path": "/2"}`,
+			},
+			source:   `["a"]`,
+			expError: fmt.Errorf(`index for array delete out of bounds`),
+		},
+		{
+			note: "add on non-existent nested Array path",
+			patches: []string{
+				`{"op": "add", "path": "/0/2", "value": "example"}`,
+			},
+			source:   `["a", [1, 2]]`,
+			expError: fmt.Errorf(`expected composite type, found value: "a" (type: ast.String)`),
+		},
+		{
+			note: "remove on non-existent nested Array path",
+			patches: []string{
+				`{"op": "remove", "path": "/0/1"}`,
+			},
+			source:   `["a", [1, 2]]`,
+			expError: fmt.Errorf(`expected composite type, found value: "a" (type: ast.String)`),
+		},
+		{
+			note: "remove on non-integer number Array path - term array",
+			patches: []string{
+				`{"op": "remove", "path": [1, 4.3]}`,
+			},
+			source:   `["a", [1, 2]]`,
+			expError: fmt.Errorf(`invalid number type for indexing`),
+		},
+		{
+			note: "remove on non-integer number Array path - string",
+			patches: []string{
+				`{"op": "remove", "path": "/1/4.3"}`,
+			},
+			source:   `["a", [1, 2]]`,
+			expError: fmt.Errorf(`invalid string for indexing`),
+		},
+		{
+			note: "remove using number with 0 prefix in Array path",
+			patches: []string{
+				`{"op": "remove", "path": "/1/01"}`,
+			},
+			source:   `["a", [1, 2]]`,
+			expError: fmt.Errorf(`leading zeros are not allowed in JSON paths`),
+		},
+		{
+			note: "add with wrong indexing type in Array path",
+			patches: []string{
+				`{"op": "add", "path": [1, [0]], "value": 4}`,
+			},
+			source:   `["a", [1, 2]]`,
+			expError: fmt.Errorf(`invalid type for indexing`),
+		},
+		{
+			note: "test on non-existent nested Array path",
+			patches: []string{
+				`{"op": "add", "path": "/1", "value": 1}`,
+				`{"op": "add", "path": "/2", "value": 2}`,
+				`{"op": "test", "path": "/1/2", "value": "example"}`,
+			},
+			source:   `[0]`,
+			expError: fmt.Errorf(`expected composite type for path "2", found value: 1 (type: ast.Number)`),
+		},
+		// The "-" index is always one beyond the end of the array, thus the delete case is an error.
+		{
+			note: "array remove scalar using the '-' path errors",
+			patches: []string{
+				`{"op": "remove", "path": "-"}`,
+			},
+			source:   `[0, 1, 2]`,
+			expError: fmt.Errorf("index for array delete out of bounds"), // Ref: https://www.rfc-editor.org/rfc/rfc6901, section 4
+		},
+		// Set error cases.
+		{
+			note: "remove on non-existent Set path",
+			patches: []string{
+				`{"op": "remove", "path": "/b"}`,
+			},
+			source:   `{"a"}`,
+			expError: fmt.Errorf(`cannot delete child key "b" that does not exist`),
+		},
+		{
+			note: "add on non-existent nested Set path",
+			patches: []string{
+				`{"op": "add", "path": [{"a", [2, 1]}, [2, 1], 1], "value": {"a"}}`,
+			},
+			source:   `{"a"}`,
+			expError: fmt.Errorf(`path {"a", [2, 1]} does not exist in set term {"a"}`),
+		},
+		{
+			note: "remove on non-existent nested Set path",
+			patches: []string{
+				`{"op": "remove", "path": [{"a", [2, 1]}, [2, 1], 0]}`,
+			},
+			source:   `{"a"}`,
+			expError: fmt.Errorf(`path {"a", [2, 1]} does not exist in set term {"a"}`),
+		},
+		{
+			note: "insert non-matching key value pair into Set",
+			patches: []string{
+				`{"op": "add", "path": ["b"], "value": "c"}`,
+			},
+			source:   `{"a"}`,
+			expError: fmt.Errorf(`set key "b" does not equal value to be inserted "c"`),
+		},
+		{
+			note: "delete fails on deleted Set path - scalar",
+			patches: []string{
+				`{"op": "remove", "path": "/a"}`,
+				`{"op": "remove", "path": "/a"}`,
+			},
+			source:   `{"a"}`,
+			expError: fmt.Errorf(`cannot delete the already deleted scalar node for key "a"`),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			patches := ast.NewArray()
+			for i := range tc.patches {
+				patches = patches.Append(ast.MustParseTerm(tc.patches[i]))
+			}
+
+			et := NewEditTree(ast.MustParseTerm(tc.source))
+			err := patches.Iter(func(term *ast.Term) error {
+				object, ok := term.Value.(ast.Object)
+				if !ok {
+					return fmt.Errorf("must be an array of JSON-Patch objects, but at least one element is not an object")
+				}
+				patch, err := getPatch(object)
+				if err != nil {
+					return err
+				}
+				path, err := parsePath(patch.path)
+				if err != nil {
+					return err
+				}
+				switch patch.op {
+				case "add":
+					_, err = et.InsertAtPath(path, patch.value)
+					if err != nil {
+						return err
+					}
+				case "remove":
+					_, err = et.DeleteAtPath(path)
+					if err != nil {
+						return err
+					}
+				case "replace":
+					_, err = et.DeleteAtPath(path)
+					if err != nil {
+						return err
+					}
+					_, err = et.InsertAtPath(path, patch.value)
+					if err != nil {
+						return err
+					}
+				case "move":
+					from, err := parsePath(patch.from)
+					if err != nil {
+						return err
+					}
+					chunk, err := et.RenderAtPath(from)
+					if err != nil {
+						return err
+					}
+					_, err = et.DeleteAtPath(from)
+					if err != nil {
+						return err
+					}
+					_, err = et.InsertAtPath(path, chunk)
+					if err != nil {
+						return err
+					}
+				case "copy":
+					from, err := parsePath(patch.from)
+					if err != nil {
+						return err
+					}
+					chunk, err := et.RenderAtPath(from)
+					if err != nil {
+						return err
+					}
+					_, err = et.InsertAtPath(path, chunk)
+					if err != nil {
+						return err
+					}
+				case "test":
+					chunk, err := et.RenderAtPath(path)
+					if err != nil {
+						return err
+					}
+					if !chunk.Equal(patch.value) {
+						return fmt.Errorf("value from EditTree != patch value.\n\nExpected: %v\n\nFound: %v", patch.value, chunk)
+					}
+				}
+				return nil
+			})
+			// If an error occurred, was it the error we expected? If not, then that's an error.
+			if err != nil {
+				if tc.expError != nil {
+					if tc.expError.Error() != err.Error() {
+						t.Fatalf("wrong error: %s", err)
+					}
+				} else {
+					t.Fatalf("unexpected error building EditTree: %s", err)
+				}
+			}
+
+			actual := et.Render()
+			// TODO: Nil check here?
+			// if err != nil {
+			// 	t.Fatalf("unexpected error rendering EditTree: %s", err)
+			// }
+
+			if tc.expResult != "" {
+				expected := ast.MustParseTerm(tc.expResult)
+				if expected.Value.Compare(actual.Value) != 0 {
+					t.Errorf("Wrong result generated from patch list:\n\nExpected:\n\t%v\n\nActual:\n\t%v\n\n", expected, actual)
+				}
+			}
+		})
+	}
+}
+
+func parsePath(path *ast.Term) (ast.Ref, error) {
+	// paths can either be a `/` separated json path or
+	// an array or set of values
+	var pathSegments ast.Ref
+	switch p := path.Value.(type) {
+	case ast.String:
+		if p == "" {
+			return ast.Ref{}, nil
+		}
+		parts := strings.Split(strings.TrimLeft(string(p), "/"), "/")
+		for _, part := range parts {
+			part = strings.ReplaceAll(strings.ReplaceAll(part, "~1", "/"), "~0", "~")
+			pathSegments = append(pathSegments, ast.StringTerm(part))
+		}
+	case *ast.Array:
+		p.Foreach(func(term *ast.Term) {
+			pathSegments = append(pathSegments, term)
+		})
+	default:
+		return nil, builtins.NewOperandErr(2, "must be one of {set, array} containing string paths or array of path segments but got %v", ast.TypeName(p))
+	}
+
+	return pathSegments, nil
+}
+
+type jsonPatch struct {
+	op    string
+	path  *ast.Term
+	from  *ast.Term
+	value *ast.Term
+}
+
+func getPatch(o ast.Object) (jsonPatch, error) {
+	var out jsonPatch
+	var ok bool
+	getAttribute := func(attr string) (*ast.Term, error) {
+		if term := o.Get(ast.StringTerm(attr)); term != nil {
+			return term, nil
+		}
+
+		return nil, fmt.Errorf("missing '%s' attribute", attr)
+	}
+
+	opTerm, err := getAttribute("op")
+	if err != nil {
+		return out, err
+	}
+	op, ok := opTerm.Value.(ast.String)
+	if !ok {
+		return out, fmt.Errorf("attribute 'op' must be a string")
+	}
+	out.op = string(op)
+
+	pathTerm, err := getAttribute("path")
+	if err != nil {
+		return out, err
+	}
+	out.path = pathTerm
+
+	// Fetch if present:
+	fromTerm, err := getAttribute("from")
+	if err != nil {
+		switch out.op {
+		case "move", "copy":
+			return out, err
+		}
+	} else {
+		out.from = fromTerm
+	}
+
+	// Fetch if present:
+	valueTerm, err := getAttribute("value")
+	if err != nil {
+		switch out.op {
+		case "add", "replace", "test":
+			return out, err
+		}
+	}
+	out.value = valueTerm
+
+	return out, nil
+}
diff --git a/internal/future/filter_imports.go b/internal/future/filter_imports.go
index b0fdc8c66d..2863aad4e9 100644
--- a/internal/future/filter_imports.go
+++ b/internal/future/filter_imports.go
@@ -18,3 +18,20 @@ func FilterFutureImports(imps []*ast.Import) []*ast.Import {
 	}
 	return ret
 }
+
+// IsAllFutureKeywords returns true if the passed *ast.Import is `future.keywords`
+func IsAllFutureKeywords(imp *ast.Import) bool {
+	path := imp.Path.Value.(ast.Ref)
+	return len(path) == 2 &&
+		ast.FutureRootDocument.Equal(path[0]) &&
+		path[1].Equal(ast.StringTerm("keywords"))
+}
+
+// IsFutureKeyword returns true if the passed *ast.Import is `future.keywords.{kw}`
+func IsFutureKeyword(imp *ast.Import, kw string) bool {
+	path := imp.Path.Value.(ast.Ref)
+	return len(path) == 3 &&
+		ast.FutureRootDocument.Equal(path[0]) &&
+		path[1].Equal(ast.StringTerm("keywords")) &&
+		path[2].Equal(ast.StringTerm(kw))
+}
diff --git a/internal/gojsonschema/README.md b/internal/gojsonschema/README.md
index 53fdef965e..8308e79dd7 100644
--- a/internal/gojsonschema/README.md
+++ b/internal/gojsonschema/README.md
@@ -38,7 +38,8 @@ go get github.com/xeipuuv/gojsonschema
 Dependencies :
 * [github.com/xeipuuv/gojsonpointer](https://github.com/xeipuuv/gojsonpointer)
 * [github.com/xeipuuv/gojsonreference](https://github.com/xeipuuv/gojsonreference)
-* [github.com/stretchr/testify/assert](https://github.com/stretchr/testify#assert-package)
+* [github.com/stretchr/testify/assert](https://github.com/stretchr/testify#assert-package) - (Note, this dependency has
+  been removed to reduce dependencies in OPA)
 
 ## Usage
 
diff --git a/internal/gojsonschema/format_checkers_test.go b/internal/gojsonschema/format_checkers_test.go
index 67421783d6..225f1331a1 100644
--- a/internal/gojsonschema/format_checkers_test.go
+++ b/internal/gojsonschema/format_checkers_test.go
@@ -3,27 +3,44 @@ package gojsonschema
 import (
 	"encoding/json"
 	"testing"
-
-	"github.com/stretchr/testify/assert"
 )
 
 func TestUUIDFormatCheckerIsFormat(t *testing.T) {
 	checker := UUIDFormatChecker{}
 
-	assert.True(t, checker.IsFormat("01234567-89ab-cdef-0123-456789abcdef"))
-	assert.True(t, checker.IsFormat("f1234567-89ab-cdef-0123-456789abcdef"))
-	assert.True(t, checker.IsFormat("01234567-89AB-CDEF-0123-456789ABCDEF"))
-	assert.True(t, checker.IsFormat("F1234567-89AB-CDEF-0123-456789ABCDEF"))
+	if !checker.IsFormat("01234567-89ab-cdef-0123-456789abcdef") {
+		t.Error("Expected true, got false")
+	}
+
+	if !checker.IsFormat("f1234567-89ab-cdef-0123-456789abcdef") {
+		t.Error("Expected true, got false")
+	}
+
+	if !checker.IsFormat("01234567-89AB-CDEF-0123-456789ABCDEF") {
+		t.Error("Expected true, got false")
+	}
+	if !checker.IsFormat("F1234567-89AB-CDEF-0123-456789ABCDEF") {
+		t.Error("Expected true, got false")
+	}
 
-	assert.False(t, checker.IsFormat("not-a-uuid"))
-	assert.False(t, checker.IsFormat("g1234567-89ab-cdef-0123-456789abcdef"))
+	if checker.IsFormat("not-a-uuid") {
+		t.Error("Expected false, got true")
+	}
+
+	if checker.IsFormat("g1234567-89ab-cdef-0123-456789abcdef") {
+		t.Error("Expected false, got true")
+	}
 }
 
 func TestURIReferenceFormatCheckerIsFormat(t *testing.T) {
 	checker := URIReferenceFormatChecker{}
 
-	assert.True(t, checker.IsFormat("relative"))
-	assert.True(t, checker.IsFormat("https://dummyhost.com/dummy-path?dummy-qp-name=dummy-qp-value"))
+	if !checker.IsFormat("relative") {
+		t.Error("Expected true, got false")
+	}
+	if !checker.IsFormat("https://dummyhost.com/dummy-path?dummy-qp-name=dummy-qp-value") {
+		t.Error("Expected true, got false")
+	}
 }
 
 const formatSchema = `{
@@ -132,7 +149,9 @@ func TestCustomFormat(t *testing.T) {
 		t.Error(err)
 	}
 
-	assert.Len(t, invalidResult.Errors(), 5)
+	if len(invalidResult.Errors()) != 5 {
+		t.Error("Expected 5 errors, got", len(invalidResult.Errors()))
+	}
 
 	FormatCheckers.
 		Remove("ArrayChecker").
diff --git a/internal/gojsonschema/jsonLoader.go b/internal/gojsonschema/jsonLoader.go
index 65ada35c04..1011552dee 100644
--- a/internal/gojsonschema/jsonLoader.go
+++ b/internal/gojsonschema/jsonLoader.go
@@ -32,13 +32,13 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
 	"runtime"
 	"strings"
+	"sync"
 
 	"github.com/xeipuuv/gojsonreference"
 )
@@ -48,8 +48,11 @@ import (
 // add extra parameters to all calls and interfaces involved, so we're
 // using a global variable instead:
 var allowNet map[string]struct{}
+var netMut sync.RWMutex
 
 func SetAllowNet(hosts []string) {
+	netMut.Lock()
+	defer netMut.Unlock()
 	if hosts == nil {
 		allowNet = nil // resetting the global
 		return
@@ -61,6 +64,8 @@ func SetAllowNet(hosts []string) {
 }
 
 func isAllowed(ref *url.URL) bool {
+	netMut.RLock()
+	defer netMut.RUnlock()
 	if allowNet == nil {
 		return true
 	}
@@ -214,7 +219,7 @@ func (l *jsonReferenceLoader) loadFromHTTP(address string) (interface{}, error)
 		return nil, errors.New(formatErrorDescription(Locale.HTTPBadStatus(), ErrorDetails{"status": resp.Status}))
 	}
 
-	bodyBuff, err := ioutil.ReadAll(resp.Body)
+	bodyBuff, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -229,7 +234,7 @@ func (l *jsonReferenceLoader) loadFromFile(path string) (interface{}, error) {
 	}
 	defer f.Close()
 
-	bodyBuff, err := ioutil.ReadAll(f)
+	bodyBuff, err := io.ReadAll(f)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/gojsonschema/jsonschema_test.go b/internal/gojsonschema/jsonschema_test.go
index c99c681c78..aa7767f653 100644
--- a/internal/gojsonschema/jsonschema_test.go
+++ b/internal/gojsonschema/jsonschema_test.go
@@ -17,7 +17,6 @@ package gojsonschema
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -40,7 +39,7 @@ type jsonSchemaTestCase struct {
 	Valid       bool        `json:"valid"`
 }
 
-//Skip any directories not named appropiately
+// Skip any directories not named appropiately
 // filepath.Walk will also visit files in the root of the test directory
 var testDirectories = regexp.MustCompile(`(draft\d+)`)
 var draftMapping = map[string]Draft{
@@ -157,7 +156,7 @@ func TestFormats(t *testing.T) {
 	}
 	wd = filepath.Join(wd, "testdata")
 
-	dirs, err := ioutil.ReadDir(wd)
+	dirs, err := os.ReadDir(wd)
 
 	if err != nil {
 		panic(err.Error())
@@ -190,3 +189,10 @@ func TestFormats(t *testing.T) {
 		}
 	}
 }
+
+func Test_ConcurrentNetAccessModification(t *testing.T) {
+	go func() {
+		SetAllowNet([]string{"something"})
+	}()
+	SetAllowNet(nil)
+}
diff --git a/internal/gojsonschema/schema.go b/internal/gojsonschema/schema.go
index 3e6f8c0873..5bdfada5d9 100644
--- a/internal/gojsonschema/schema.go
+++ b/internal/gojsonschema/schema.go
@@ -73,7 +73,6 @@ func (d *Schema) SetRootSchemaName(name string) {
 // Pretty long function ( sorry :) )... but pretty straight forward, repetitive and boring
 // Not much magic involved here, most of the job is to validate the key names and their values,
 // then the values are copied into SubSchema struct
-//
 func (d *Schema) parseSchema(documentNode interface{}, currentSchema *SubSchema) error {
 
 	if currentSchema.Draft == nil {
@@ -517,17 +516,12 @@ func (d *Schema) parseSchema(documentNode interface{}, currentSchema *SubSchema)
 		}
 	}
 
-	if pattern, err := getString(m, KeyPattern); err != nil {
+	// NOTE: Regex compilation step removed as we don't use "pattern" attribute for
+	// type checking, and this would cause schemas to fail if they included patterns
+	// that were valid ECMA regex dialect but not known to Go (i.e. the regexp.Compile
+	// function), such as patterns with negative lookahead
+	if _, err := getString(m, KeyPattern); err != nil {
 		return err
-	} else if pattern != nil {
-		regexpObject, err := regexp.Compile(*pattern)
-		if err != nil {
-			return errors.New(formatErrorDescription(
-				Locale.MustBeValidRegex(),
-				ErrorDetails{"key": KeyPattern},
-			))
-		}
-		currentSchema.pattern = regexpObject
 	}
 
 	if format, err := getString(m, KeyFormat); err != nil {
diff --git a/internal/gojsonschema/schemaLoader.go b/internal/gojsonschema/schemaLoader.go
index d530dee319..8cc6dc03b8 100644
--- a/internal/gojsonschema/schemaLoader.go
+++ b/internal/gojsonschema/schemaLoader.go
@@ -119,7 +119,7 @@ func (sl *SchemaLoader) AddSchemas(loaders ...JSONLoader) error {
 	return nil
 }
 
-//AddSchema adds a schema under the provided URL to the schema cache
+// AddSchema adds a schema under the provided URL to the schema cache
 func (sl *SchemaLoader) AddSchema(url string, loader JSONLoader) error {
 
 	ref, err := gojsonreference.NewJsonReference(url)
diff --git a/internal/gojsonschema/schemaLoader_test.go b/internal/gojsonschema/schemaLoader_test.go
index a0b2adfd6a..c9be1a3c01 100644
--- a/internal/gojsonschema/schemaLoader_test.go
+++ b/internal/gojsonschema/schemaLoader_test.go
@@ -16,10 +16,6 @@ package gojsonschema
 
 import (
 	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/stretchr/testify/assert"
 )
 
 func TestSchemaLoaderWithReferenceToAddedSchema(t *testing.T) {
@@ -28,12 +24,20 @@ func TestSchemaLoaderWithReferenceToAddedSchema(t *testing.T) {
 		"$id" : "http://localhost:1234/test1.json",
 		"type" : "integer"
 		}`))
+	if err != nil {
+		t.Errorf("Error adding schema: %v", err)
+	}
 
-	assert.Nil(t, err)
 	schema, err := sl.Compile(NewReferenceLoader("http://localhost:1234/test1.json"))
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error compiling schema: %v", err)
+	}
+
 	result, err := schema.Validate(NewStringLoader(`"hello"`))
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error validating schema: %v", err)
+	}
+
 	if len(result.Errors()) != 1 || result.Errors()[0].Type() != "invalid_type" {
 		t.Errorf("Expected invalid type erorr, instead got %v", result.Errors())
 	}
@@ -54,13 +58,25 @@ func TestCrossReference(t *testing.T) {
 
 	sl := NewSchemaLoader()
 	err := sl.AddSchema("http://localhost:1234/test2.json", schema1)
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error adding schema: %v", err)
+	}
+
 	err = sl.AddSchema("http://localhost:1234/test3.json", schema2)
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error adding schema: %v", err)
+	}
+
 	schema, err := sl.Compile(NewStringLoader(`{"$ref" : "http://localhost:1234/test2.json"}`))
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error compiling schema: %v", err)
+	}
+
 	result, err := schema.Validate(NewStringLoader(`"hello"`))
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error validating schema: %v", err)
+	}
+
 	if len(result.Errors()) != 1 || result.Errors()[0].Type() != "invalid_type" {
 		t.Errorf("Expected invalid type erorr, instead got %v", result.Errors())
 	}
@@ -70,9 +86,14 @@ func TestCrossReference(t *testing.T) {
 func TestDoubleIDReference(t *testing.T) {
 	sl := NewSchemaLoader()
 	err := sl.AddSchema("http://localhost:1234/test4.json", NewStringLoader("{}"))
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error adding schema: %v", err)
+	}
+
 	err = sl.AddSchemas(NewStringLoader(`{ "$id" : "http://localhost:1234/test4.json"}`))
-	assert.NotNil(t, err)
+	if err == nil {
+		t.Errorf("Expected error adding schema, got none")
+	}
 }
 
 func TestCustomMetaSchema(t *testing.T) {
@@ -89,24 +110,34 @@ func TestCustomMetaSchema(t *testing.T) {
 	sl.Validate = true
 
 	err := sl.AddSchemas(loader)
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error adding schema: %v", err)
+	}
+
 	_, err = sl.Compile(NewStringLoader(`{
 		"$id" : "http://localhost:1234/test6.json",
 		"$schema" : "http://localhost:1234/test5.json",
 		"type" : "string"
 	}`))
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error compiling schema: %v", err)
+	}
 
 	sl = NewSchemaLoader()
 	sl.Validate = true
 	err = sl.AddSchemas(loader)
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error adding schema: %v", err)
+	}
+
 	_, err = sl.Compile(NewStringLoader(`{
 		"$id" : "http://localhost:1234/test7.json",
 		"$schema" : "http://localhost:1234/test5.json",
 		"multipleOf" : 5
 	}`))
-	assert.NotNil(t, err)
+	if err == nil {
+		t.Errorf("Expected error compiling schema, got none")
+	}
 }
 
 func TestSchemaDetection(t *testing.T) {
@@ -117,14 +148,18 @@ func TestSchemaDetection(t *testing.T) {
 
 	// The schema should produce an error in draft-04 mode
 	_, err := NewSchema(loader)
-	assert.NotNil(t, err)
+	if err == nil {
+		t.Errorf("Expected error, got none")
+	}
 
 	// With schema detection disabled the schema should not produce an error in hybrid mode
 	sl := NewSchemaLoader()
 	sl.AutoDetect = false
 
 	_, err = sl.Compile(loader)
-	assert.Nil(t, err)
+	if err != nil {
+		t.Errorf("Error compiling schema: %v", err)
+	}
 }
 
 func TestDraftCrossReferencing(t *testing.T) {
@@ -152,14 +187,20 @@ func TestDraftCrossReferencing(t *testing.T) {
 			sl.AutoDetect = b
 
 			err := sl.AddSchemas(loader1)
-			assert.Nil(t, err)
+			if err != nil {
+				t.Errorf("Error adding schema: %v", err)
+			}
+
 			_, err = sl.Compile(loader2)
 
 			// It will always fail with autodetection on as "exclusiveMinimum" : 5
 			// is only valid since draft-06. With autodetection off it will pass if
 			// draft-06 or newer is used
 
-			assert.Equal(t, err == nil, !b && draft >= Draft6)
+			got := !b && draft >= Draft6
+			if (err == nil) != got {
+				t.Errorf("Expected error: %v, got: %v", !got, err)
+			}
 		}
 	}
 }
@@ -172,6 +213,11 @@ func TestParseSchemaURL_NotMap(t *testing.T) {
 	//WHEN
 	_, err := NewSchema(sl)
 	//THEN
-	require.Error(t, err)
-	assert.EqualError(t, err, "schema is invalid")
+	if err == nil {
+		t.Fatalf("Expected error, got none")
+	}
+
+	if err.Error() != "schema is invalid" {
+		t.Fatalf("Expected error: %s, got: %s", "schema is invalid", err.Error())
+	}
 }
diff --git a/internal/gojsonschema/schema_test.go b/internal/gojsonschema/schema_test.go
index 15f44c84a5..d7646d42a4 100644
--- a/internal/gojsonschema/schema_test.go
+++ b/internal/gojsonschema/schema_test.go
@@ -28,14 +28,12 @@ package gojsonschema
 
 import (
 	"bytes"
+	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/stretchr/testify/assert"
 )
 
 const circularReference = `{
@@ -117,9 +115,14 @@ func TestLoaders(t *testing.T) {
 	readerLoader, wrappedReader := NewReaderLoader(reader)
 
 	// drain reader
-	by, err := ioutil.ReadAll(wrappedReader)
-	assert.Nil(t, err)
-	assert.Equal(t, simpleSchema, string(by))
+	by, err := io.ReadAll(wrappedReader)
+	if err != nil {
+		t.Error(err)
+	}
+
+	if simpleSchema != string(by) {
+		t.Errorf("Expected %s, got %s", simpleSchema, string(by))
+	}
 
 	// setup writer loaders
 	writer := &bytes.Buffer{}
@@ -127,8 +130,12 @@ func TestLoaders(t *testing.T) {
 
 	// fill writer
 	n, err := io.WriteString(wrappedWriter, simpleSchema)
-	assert.Nil(t, err)
-	assert.Equal(t, n, len(simpleSchema))
+	if err != nil {
+		t.Error(err)
+	}
+	if exp, got := n, len(simpleSchema); exp != got {
+		t.Errorf("Expected %d, got %d", exp, got)
+	}
 
 	loaders := []JSONLoader{
 		NewStringLoader(simpleSchema),
@@ -138,7 +145,9 @@ func TestLoaders(t *testing.T) {
 
 	for _, l := range loaders {
 		_, err := NewSchema(l)
-		assert.Nil(t, err, "loader: %T", l)
+		if err != nil {
+			t.Error(err)
+		}
 	}
 }
 
@@ -159,9 +168,13 @@ func TestLoadersWithInvalidPattern(t *testing.T) {
 	readerLoader, wrappedReader := NewReaderLoader(reader)
 
 	// drain reader
-	by, err := ioutil.ReadAll(wrappedReader)
-	assert.Nil(t, err)
-	assert.Equal(t, invalidPattern, string(by))
+	by, err := io.ReadAll(wrappedReader)
+	if err != nil {
+		t.Error(err)
+	}
+	if invalidPattern != string(by) {
+		t.Errorf("Expected %s, got %s", invalidPattern, string(by))
+	}
 
 	// setup writer loaders
 	writer := &bytes.Buffer{}
@@ -169,8 +182,12 @@ func TestLoadersWithInvalidPattern(t *testing.T) {
 
 	// fill writer
 	n, err := io.WriteString(wrappedWriter, invalidPattern)
-	assert.Nil(t, err)
-	assert.Equal(t, n, len(invalidPattern))
+	if err != nil {
+		t.Error(err)
+	}
+	if exp, got := n, len(invalidPattern); exp != got {
+		t.Errorf("Expected %d, got %d", exp, got)
+	}
 
 	loaders := []JSONLoader{
 		NewStringLoader(invalidPattern),
@@ -180,7 +197,9 @@ func TestLoadersWithInvalidPattern(t *testing.T) {
 
 	for _, l := range loaders {
 		_, err := NewSchema(l)
-		assert.NotNil(t, err, "expected error loading invalid pattern: %T", l)
+		if err == nil {
+			t.Errorf("Expected error loading invalid pattern: %T", l)
+		}
 	}
 }
 
@@ -255,19 +274,19 @@ func TestFragmentLoader(t *testing.T) {
 	invalidDocument := NewStringLoader(`"a"`)
 
 	result, err := schema.Validate(validDocument)
-
-	if assert.Nil(t, err, "Unexpected error while validating document: %T", err) {
-		if !result.Valid() {
-			t.Errorf("Got invalid validation result.")
-		}
+	if err != nil {
+		t.Errorf("Unexpected error while validating document: %T", err)
+	}
+	if !result.Valid() {
+		t.Errorf("Got invalid validation result.")
 	}
 
 	result, err = schema.Validate(invalidDocument)
-
-	if assert.Nil(t, err, "Unexpected error while validating document: %T", err) {
-		if len(result.Errors()) != 1 || result.Errors()[0].Type() != "invalid_type" {
-			t.Errorf("Got invalid validation result.")
-		}
+	if err != nil {
+		t.Errorf("Unexpected error while validating document: %T", err)
+	}
+	if len(result.Errors()) != 1 || result.Errors()[0].Type() != "invalid_type" {
+		t.Errorf("Got invalid validation result.")
 	}
 }
 
@@ -281,10 +300,19 @@ func TestFileWithSpace(t *testing.T) {
 	fileName := filepath.Join(wd, "testdata", "extra", "file with space.json")
 	loader := NewReferenceLoader("file://" + filepath.ToSlash(fileName))
 
-	json, err := loader.LoadJSON()
+	data, err := loader.LoadJSON()
+	if err != nil {
+		t.Errorf("Unexpected error when trying to load a filepath containing a space: %s", err)
+	}
+
+	jsonBytes, err := json.Marshal(data)
+	if err != nil {
+		t.Errorf("Unexpected error when trying to marshal json: %s", err)
+	}
 
-	assert.Nil(t, err, "Unexpected error when trying to load a filepath containing a space")
-	assert.Equal(t, map[string]interface{}{"foo": true}, json, "Contents of the file do not match")
+	if exp, got := `{"foo":true}`, string(jsonBytes); exp != got {
+		t.Errorf("Contents of the file do not match, expected %s, got %s", exp, got)
+	}
 }
 
 func TestAdditionalPropertiesErrorMessage(t *testing.T) {
@@ -376,6 +404,10 @@ func TestIncorrectRef(t *testing.T) {
 	schemaLoader := NewStringLoader(incorrectRefSchema)
 	s, err := NewSchema(schemaLoader)
 
-	assert.Nil(t, s)
-	assert.Equal(t, "Object has no key 'fail'", err.Error())
+	if s != nil {
+		t.Errorf("Expected nil schema")
+	}
+	if err.Error() != "Object has no key 'fail'" {
+		t.Errorf("Expected error 'Object has no key 'fail'' but got '%s'", err.Error())
+	}
 }
diff --git a/internal/gojsonschema/testdata/draft4/pattern.json b/internal/gojsonschema/testdata/draft4/pattern.json
index 25e7299731..fa8bdb945e 100644
--- a/internal/gojsonschema/testdata/draft4/pattern.json
+++ b/internal/gojsonschema/testdata/draft4/pattern.json
@@ -9,9 +9,9 @@
                 "valid": true
             },
             {
-                "description": "a non-matching pattern is invalid",
+                "description": "a non-matching pattern is invalid (but ignored)",
                 "data": "abc",
-                "valid": false
+                "valid": true
             },
             {
                 "description": "ignores non-strings",
diff --git a/internal/gojsonschema/testdata/draft6/pattern.json b/internal/gojsonschema/testdata/draft6/pattern.json
index 25e7299731..fa8bdb945e 100644
--- a/internal/gojsonschema/testdata/draft6/pattern.json
+++ b/internal/gojsonschema/testdata/draft6/pattern.json
@@ -9,9 +9,9 @@
                 "valid": true
             },
             {
-                "description": "a non-matching pattern is invalid",
+                "description": "a non-matching pattern is invalid (but ignored)",
                 "data": "abc",
-                "valid": false
+                "valid": true
             },
             {
                 "description": "ignores non-strings",
diff --git a/internal/gojsonschema/testdata/draft7/pattern.json b/internal/gojsonschema/testdata/draft7/pattern.json
index 25e7299731..fa8bdb945e 100644
--- a/internal/gojsonschema/testdata/draft7/pattern.json
+++ b/internal/gojsonschema/testdata/draft7/pattern.json
@@ -9,9 +9,9 @@
                 "valid": true
             },
             {
-                "description": "a non-matching pattern is invalid",
+                "description": "a non-matching pattern is invalid (but ignored)",
                 "data": "abc",
-                "valid": false
+                "valid": true
             },
             {
                 "description": "ignores non-strings",
diff --git a/internal/gojsonschema/utils_test.go b/internal/gojsonschema/utils_test.go
index 3d8ec95e0c..78d7890771 100644
--- a/internal/gojsonschema/utils_test.go
+++ b/internal/gojsonschema/utils_test.go
@@ -28,8 +28,6 @@ package gojsonschema
 import (
 	"encoding/json"
 	"testing"
-
-	"github.com/stretchr/testify/assert"
 )
 
 func TestCheckJsonNumber(t *testing.T) {
@@ -52,8 +50,9 @@ func TestCheckJsonNumber(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		assert.Equal(t, testCase.isInt, checkJSONInteger(testCase.value))
-		assert.Equal(t, testCase.isInt, checkJSONInteger(testCase.value))
+		if exp, got := testCase.isInt, checkJSONInteger(testCase.value); exp != got {
+			t.Errorf("Expected %v, got %v for %v", exp, got, testCase.value)
+		}
 	}
 
 }
diff --git a/internal/gojsonschema/validation.go b/internal/gojsonschema/validation.go
index a3c3e01461..889f0fda45 100644
--- a/internal/gojsonschema/validation.go
+++ b/internal/gojsonschema/validation.go
@@ -503,7 +503,7 @@ func (v *SubSchema) validateArray(currentSubSchema *SubSchema, value []interface
 
 	// minItems & maxItems
 	if currentSubSchema.minItems != nil {
-		if nbValues < int(*currentSubSchema.minItems) {
+		if nbValues < *currentSubSchema.minItems {
 			result.addInternalError(
 				new(ArrayMinItemsError),
 				context,
@@ -513,7 +513,7 @@ func (v *SubSchema) validateArray(currentSubSchema *SubSchema, value []interface
 		}
 	}
 	if currentSubSchema.maxItems != nil {
-		if nbValues > int(*currentSubSchema.maxItems) {
+		if nbValues > *currentSubSchema.maxItems {
 			result.addInternalError(
 				new(ArrayMaxItemsError),
 				context,
@@ -587,7 +587,7 @@ func (v *SubSchema) validateObject(currentSubSchema *SubSchema, value map[string
 
 	// minProperties & maxProperties:
 	if currentSubSchema.minProperties != nil {
-		if len(value) < int(*currentSubSchema.minProperties) {
+		if len(value) < *currentSubSchema.minProperties {
 			result.addInternalError(
 				new(ArrayMinPropertiesError),
 				context,
@@ -597,7 +597,7 @@ func (v *SubSchema) validateObject(currentSubSchema *SubSchema, value map[string
 		}
 	}
 	if currentSubSchema.maxProperties != nil {
-		if len(value) > int(*currentSubSchema.maxProperties) {
+		if len(value) > *currentSubSchema.maxProperties {
 			result.addInternalError(
 				new(ArrayMaxPropertiesError),
 				context,
@@ -716,7 +716,7 @@ func (v *SubSchema) validateString(currentSubSchema *SubSchema, value interface{
 
 	// minLength & maxLength:
 	if currentSubSchema.minLength != nil {
-		if utf8.RuneCount([]byte(stringValue)) < int(*currentSubSchema.minLength) {
+		if utf8.RuneCount([]byte(stringValue)) < *currentSubSchema.minLength {
 			result.addInternalError(
 				new(StringLengthGTEError),
 				context,
@@ -726,7 +726,7 @@ func (v *SubSchema) validateString(currentSubSchema *SubSchema, value interface{
 		}
 	}
 	if currentSubSchema.maxLength != nil {
-		if utf8.RuneCount([]byte(stringValue)) > int(*currentSubSchema.maxLength) {
+		if utf8.RuneCount([]byte(stringValue)) > *currentSubSchema.maxLength {
 			result.addInternalError(
 				new(StringLengthLTEError),
 				context,
diff --git a/internal/gqlparser/.gitignore b/internal/gqlparser/.gitignore
new file mode 100644
index 0000000000..877392a763
--- /dev/null
+++ b/internal/gqlparser/.gitignore
@@ -0,0 +1,5 @@
+/vendor
+/validator/imported/node_modules
+/validator/imported/graphql-js
+
+.idea/
diff --git a/internal/gqlparser/LICENSE b/internal/gqlparser/LICENSE
new file mode 100644
index 0000000000..1221b9d389
--- /dev/null
+++ b/internal/gqlparser/LICENSE
@@ -0,0 +1,19 @@
+Copyright (c) 2018 Adam Scarr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/internal/gqlparser/README.md b/internal/gqlparser/README.md
new file mode 100644
index 0000000000..c6c8f0fd5b
--- /dev/null
+++ b/internal/gqlparser/README.md
@@ -0,0 +1,36 @@
+# gqlparser (Details of library residing in OPA's internal)
+
+## Description
+
+https://github.com/vektah/gqlparser was duplicated into `internal/gqlparser` folder, so that we no longer have to track the external library 1-to-1, and so that OPA library users who want to use newer/older gqlparser versions won't have to match our GraphQL parser's version.
+
+The current version we have forked from is commit [`b3be96f` on branch `master`](https://github.com/vektah/gqlparser/commit/b3be96ff69fa97682c43570dcb6f75d08fdf8586), which is 2 commits past the [`v2.5.1`](https://github.com/vektah/gqlparser/releases/tag/v2.5.1) release tag.
+We picked this specific commit because the two commits after the 2.5.1 release dramatically improve the linter state of the library to be as strict or stricter than OPA's linting, allowing for nearly drop-in integration.
+
+We currently modify `gqlparser/gqlerror/error.go` to provide the line and column of the error location, so as to keep our `graphql` builtin error messages consistent.
+This requires either modifying all the library tests, or removing them.
+For now, at least until upstream adds columns to error messages, we will just remove tests from the imported library with the `remove-tests.sh` script.
+
+## Rewriter script
+
+The `rewrite-deps.sh` can be run from this directory, and it will do the grunt work of rewriting all import path prefixes for `gqlparser` sub-packages, so that they import this package.
+It also will add some linter ignore annotations on the validator rules, since those are tedious to do by hand.
+
+The script thus should alleviate around 40-60% of the linter-fixup work required during a version bump.
+
+## Original README
+
+This is a parser for graphql, written to mirror the graphql-js reference implementation as closely while remaining idiomatic and easy to use.
+
+spec target: June 2018 (Schema definition language, block strings as descriptions, error paths & extension)
+
+This parser is used by [gqlgen](https://github.com/99designs/gqlgen), and it should be reasonably stable.
+
+Guiding principles:
+
+ - maintainability: It should be easy to stay up to date with the spec
+ - well tested: It shouldn't need a graphql server to validate itself. Changes to this repo should be self contained.
+ - server agnostic: It should be usable by any of the graphql server implementations, and any graphql client tooling.
+ - idiomatic & stable api: It should follow go best practices, especially around forwards compatibility.
+ - fast: Where it doesn't impact on the above it should be fast. Avoid unnecessary allocs in hot paths.
+ - close to reference: Where it doesn't impact on the above, it should stay close to the [graphql/graphql-js](https://github.com/graphql/graphql-js) reference implementation.
diff --git a/internal/gqlparser/ast/argmap.go b/internal/gqlparser/ast/argmap.go
new file mode 100644
index 0000000000..43f6a3d6fc
--- /dev/null
+++ b/internal/gqlparser/ast/argmap.go
@@ -0,0 +1,37 @@
+package ast
+
+func arg2map(defs ArgumentDefinitionList, args ArgumentList, vars map[string]interface{}) map[string]interface{} {
+	result := map[string]interface{}{}
+	var err error
+
+	for _, argDef := range defs {
+		var val interface{}
+		var hasValue bool
+
+		if argValue := args.ForName(argDef.Name); argValue != nil {
+			if argValue.Value.Kind == Variable {
+				val, hasValue = vars[argValue.Value.Raw]
+			} else {
+				val, err = argValue.Value.Value(vars)
+				if err != nil {
+					panic(err)
+				}
+				hasValue = true
+			}
+		}
+
+		if !hasValue && argDef.DefaultValue != nil {
+			val, err = argDef.DefaultValue.Value(vars)
+			if err != nil {
+				panic(err)
+			}
+			hasValue = true
+		}
+
+		if hasValue {
+			result[argDef.Name] = val
+		}
+	}
+
+	return result
+}
diff --git a/internal/gqlparser/ast/collections.go b/internal/gqlparser/ast/collections.go
new file mode 100644
index 0000000000..94b800ee26
--- /dev/null
+++ b/internal/gqlparser/ast/collections.go
@@ -0,0 +1,148 @@
+package ast
+
+type FieldList []*FieldDefinition
+
+func (l FieldList) ForName(name string) *FieldDefinition {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type EnumValueList []*EnumValueDefinition
+
+func (l EnumValueList) ForName(name string) *EnumValueDefinition {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type DirectiveList []*Directive
+
+func (l DirectiveList) ForName(name string) *Directive {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+func (l DirectiveList) ForNames(name string) []*Directive {
+	resp := []*Directive{}
+	for _, it := range l {
+		if it.Name == name {
+			resp = append(resp, it)
+		}
+	}
+	return resp
+}
+
+type OperationList []*OperationDefinition
+
+func (l OperationList) ForName(name string) *OperationDefinition {
+	if name == "" && len(l) == 1 {
+		return l[0]
+	}
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type FragmentDefinitionList []*FragmentDefinition
+
+func (l FragmentDefinitionList) ForName(name string) *FragmentDefinition {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type VariableDefinitionList []*VariableDefinition
+
+func (l VariableDefinitionList) ForName(name string) *VariableDefinition {
+	for _, it := range l {
+		if it.Variable == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type ArgumentList []*Argument
+
+func (l ArgumentList) ForName(name string) *Argument {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type ArgumentDefinitionList []*ArgumentDefinition
+
+func (l ArgumentDefinitionList) ForName(name string) *ArgumentDefinition {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type SchemaDefinitionList []*SchemaDefinition
+
+type DirectiveDefinitionList []*DirectiveDefinition
+
+func (l DirectiveDefinitionList) ForName(name string) *DirectiveDefinition {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type DefinitionList []*Definition
+
+func (l DefinitionList) ForName(name string) *Definition {
+	for _, it := range l {
+		if it.Name == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type OperationTypeDefinitionList []*OperationTypeDefinition
+
+func (l OperationTypeDefinitionList) ForType(name string) *OperationTypeDefinition {
+	for _, it := range l {
+		if it.Type == name {
+			return it
+		}
+	}
+	return nil
+}
+
+type ChildValueList []*ChildValue
+
+func (v ChildValueList) ForName(name string) *Value {
+	for _, f := range v {
+		if f.Name == name {
+			return f.Value
+		}
+	}
+	return nil
+}
diff --git a/internal/gqlparser/ast/decode.go b/internal/gqlparser/ast/decode.go
new file mode 100644
index 0000000000..d00920554c
--- /dev/null
+++ b/internal/gqlparser/ast/decode.go
@@ -0,0 +1,216 @@
+package ast
+
+import (
+	"encoding/json"
+)
+
+func UnmarshalSelectionSet(b []byte) (SelectionSet, error) {
+	var tmp []json.RawMessage
+
+	if err := json.Unmarshal(b, &tmp); err != nil {
+		return nil, err
+	}
+
+	var result = make([]Selection, 0)
+	for _, item := range tmp {
+		var field Field
+		if err := json.Unmarshal(item, &field); err == nil {
+			result = append(result, &field)
+			continue
+		}
+		var fragmentSpread FragmentSpread
+		if err := json.Unmarshal(item, &fragmentSpread); err == nil {
+			result = append(result, &fragmentSpread)
+			continue
+		}
+		var inlineFragment InlineFragment
+		if err := json.Unmarshal(item, &inlineFragment); err == nil {
+			result = append(result, &inlineFragment)
+			continue
+		}
+	}
+
+	return result, nil
+}
+
+func (f *FragmentDefinition) UnmarshalJSON(b []byte) error {
+	var tmp map[string]json.RawMessage
+	if err := json.Unmarshal(b, &tmp); err != nil {
+		return err
+	}
+	for k := range tmp {
+		switch k {
+		case "Name":
+			err := json.Unmarshal(tmp[k], &f.Name)
+			if err != nil {
+				return err
+			}
+		case "VariableDefinition":
+			err := json.Unmarshal(tmp[k], &f.VariableDefinition)
+			if err != nil {
+				return err
+			}
+		case "TypeCondition":
+			err := json.Unmarshal(tmp[k], &f.TypeCondition)
+			if err != nil {
+				return err
+			}
+		case "Directives":
+			err := json.Unmarshal(tmp[k], &f.Directives)
+			if err != nil {
+				return err
+			}
+		case "SelectionSet":
+			ss, err := UnmarshalSelectionSet(tmp[k])
+			if err != nil {
+				return err
+			}
+			f.SelectionSet = ss
+		case "Definition":
+			err := json.Unmarshal(tmp[k], &f.Definition)
+			if err != nil {
+				return err
+			}
+		case "Position":
+			err := json.Unmarshal(tmp[k], &f.Position)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (f *InlineFragment) UnmarshalJSON(b []byte) error {
+	var tmp map[string]json.RawMessage
+	if err := json.Unmarshal(b, &tmp); err != nil {
+		return err
+	}
+	for k := range tmp {
+		switch k {
+		case "TypeCondition":
+			err := json.Unmarshal(tmp[k], &f.TypeCondition)
+			if err != nil {
+				return err
+			}
+		case "Directives":
+			err := json.Unmarshal(tmp[k], &f.Directives)
+			if err != nil {
+				return err
+			}
+		case "SelectionSet":
+			ss, err := UnmarshalSelectionSet(tmp[k])
+			if err != nil {
+				return err
+			}
+			f.SelectionSet = ss
+		case "ObjectDefinition":
+			err := json.Unmarshal(tmp[k], &f.ObjectDefinition)
+			if err != nil {
+				return err
+			}
+		case "Position":
+			err := json.Unmarshal(tmp[k], &f.Position)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (f *OperationDefinition) UnmarshalJSON(b []byte) error {
+	var tmp map[string]json.RawMessage
+	if err := json.Unmarshal(b, &tmp); err != nil {
+		return err
+	}
+	for k := range tmp {
+		switch k {
+		case "Operation":
+			err := json.Unmarshal(tmp[k], &f.Operation)
+			if err != nil {
+				return err
+			}
+		case "Name":
+			err := json.Unmarshal(tmp[k], &f.Name)
+			if err != nil {
+				return err
+			}
+		case "VariableDefinitions":
+			err := json.Unmarshal(tmp[k], &f.VariableDefinitions)
+			if err != nil {
+				return err
+			}
+		case "Directives":
+			err := json.Unmarshal(tmp[k], &f.Directives)
+			if err != nil {
+				return err
+			}
+		case "SelectionSet":
+			ss, err := UnmarshalSelectionSet(tmp[k])
+			if err != nil {
+				return err
+			}
+			f.SelectionSet = ss
+		case "Position":
+			err := json.Unmarshal(tmp[k], &f.Position)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (f *Field) UnmarshalJSON(b []byte) error {
+	var tmp map[string]json.RawMessage
+	if err := json.Unmarshal(b, &tmp); err != nil {
+		return err
+	}
+	for k := range tmp {
+		switch k {
+		case "Alias":
+			err := json.Unmarshal(tmp[k], &f.Alias)
+			if err != nil {
+				return err
+			}
+		case "Name":
+			err := json.Unmarshal(tmp[k], &f.Name)
+			if err != nil {
+				return err
+			}
+		case "Arguments":
+			err := json.Unmarshal(tmp[k], &f.Arguments)
+			if err != nil {
+				return err
+			}
+		case "Directives":
+			err := json.Unmarshal(tmp[k], &f.Directives)
+			if err != nil {
+				return err
+			}
+		case "SelectionSet":
+			ss, err := UnmarshalSelectionSet(tmp[k])
+			if err != nil {
+				return err
+			}
+			f.SelectionSet = ss
+		case "Position":
+			err := json.Unmarshal(tmp[k], &f.Position)
+			if err != nil {
+				return err
+			}
+		case "Definition":
+			err := json.Unmarshal(tmp[k], &f.Definition)
+			if err != nil {
+				return err
+			}
+		case "ObjectDefinition":
+			err := json.Unmarshal(tmp[k], &f.ObjectDefinition)
+			if err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
diff --git a/internal/gqlparser/ast/definition.go b/internal/gqlparser/ast/definition.go
new file mode 100644
index 0000000000..d203908168
--- /dev/null
+++ b/internal/gqlparser/ast/definition.go
@@ -0,0 +1,94 @@
+package ast
+
+type DefinitionKind string
+
+const (
+	Scalar      DefinitionKind = "SCALAR"
+	Object      DefinitionKind = "OBJECT"
+	Interface   DefinitionKind = "INTERFACE"
+	Union       DefinitionKind = "UNION"
+	Enum        DefinitionKind = "ENUM"
+	InputObject DefinitionKind = "INPUT_OBJECT"
+)
+
+// Definition is the core type definition object, it includes all of the definable types
+// but does *not* cover schema or directives.
+//
+// @vektah: Javascript implementation has different types for all of these, but they are
+// more similar than different and don't define any behaviour. I think this style of
+// "some hot" struct works better, at least for go.
+//
+// Type extensions are also represented by this same struct.
+type Definition struct {
+	Kind        DefinitionKind
+	Description string
+	Name        string
+	Directives  DirectiveList
+	Interfaces  []string      // object and input object
+	Fields      FieldList     // object and input object
+	Types       []string      // union
+	EnumValues  EnumValueList // enum
+
+	Position *Position `dump:"-"`
+	BuiltIn  bool      `dump:"-"`
+}
+
+func (d *Definition) IsLeafType() bool {
+	return d.Kind == Enum || d.Kind == Scalar
+}
+
+func (d *Definition) IsAbstractType() bool {
+	return d.Kind == Interface || d.Kind == Union
+}
+
+func (d *Definition) IsCompositeType() bool {
+	return d.Kind == Object || d.Kind == Interface || d.Kind == Union
+}
+
+func (d *Definition) IsInputType() bool {
+	return d.Kind == Scalar || d.Kind == Enum || d.Kind == InputObject
+}
+
+func (d *Definition) OneOf(types ...string) bool {
+	for _, t := range types {
+		if d.Name == t {
+			return true
+		}
+	}
+	return false
+}
+
+type FieldDefinition struct {
+	Description  string
+	Name         string
+	Arguments    ArgumentDefinitionList // only for objects
+	DefaultValue *Value                 // only for input objects
+	Type         *Type
+	Directives   DirectiveList
+	Position     *Position `dump:"-"`
+}
+
+type ArgumentDefinition struct {
+	Description  string
+	Name         string
+	DefaultValue *Value
+	Type         *Type
+	Directives   DirectiveList
+	Position     *Position `dump:"-"`
+}
+
+type EnumValueDefinition struct {
+	Description string
+	Name        string
+	Directives  DirectiveList
+	Position    *Position `dump:"-"`
+}
+
+type DirectiveDefinition struct {
+	Description  string
+	Name         string
+	Arguments    ArgumentDefinitionList
+	Locations    []DirectiveLocation
+	IsRepeatable bool
+	Position     *Position `dump:"-"`
+}
diff --git a/internal/gqlparser/ast/directive.go b/internal/gqlparser/ast/directive.go
new file mode 100644
index 0000000000..5f6e8531f5
--- /dev/null
+++ b/internal/gqlparser/ast/directive.go
@@ -0,0 +1,43 @@
+package ast
+
+type DirectiveLocation string
+
+const (
+	// Executable
+	LocationQuery              DirectiveLocation = `QUERY`
+	LocationMutation           DirectiveLocation = `MUTATION`
+	LocationSubscription       DirectiveLocation = `SUBSCRIPTION`
+	LocationField              DirectiveLocation = `FIELD`
+	LocationFragmentDefinition DirectiveLocation = `FRAGMENT_DEFINITION`
+	LocationFragmentSpread     DirectiveLocation = `FRAGMENT_SPREAD`
+	LocationInlineFragment     DirectiveLocation = `INLINE_FRAGMENT`
+
+	// Type System
+	LocationSchema               DirectiveLocation = `SCHEMA`
+	LocationScalar               DirectiveLocation = `SCALAR`
+	LocationObject               DirectiveLocation = `OBJECT`
+	LocationFieldDefinition      DirectiveLocation = `FIELD_DEFINITION`
+	LocationArgumentDefinition   DirectiveLocation = `ARGUMENT_DEFINITION`
+	LocationInterface            DirectiveLocation = `INTERFACE`
+	LocationUnion                DirectiveLocation = `UNION`
+	LocationEnum                 DirectiveLocation = `ENUM`
+	LocationEnumValue            DirectiveLocation = `ENUM_VALUE`
+	LocationInputObject          DirectiveLocation = `INPUT_OBJECT`
+	LocationInputFieldDefinition DirectiveLocation = `INPUT_FIELD_DEFINITION`
+	LocationVariableDefinition   DirectiveLocation = `VARIABLE_DEFINITION`
+)
+
+type Directive struct {
+	Name      string
+	Arguments ArgumentList
+	Position  *Position `dump:"-"`
+
+	// Requires validation
+	ParentDefinition *Definition
+	Definition       *DirectiveDefinition
+	Location         DirectiveLocation
+}
+
+func (d *Directive) ArgumentMap(vars map[string]interface{}) map[string]interface{} {
+	return arg2map(d.Definition.Arguments, d.Arguments, vars)
+}
diff --git a/internal/gqlparser/ast/document.go b/internal/gqlparser/ast/document.go
new file mode 100644
index 0000000000..43bfb54ff5
--- /dev/null
+++ b/internal/gqlparser/ast/document.go
@@ -0,0 +1,79 @@
+package ast
+
+type QueryDocument struct {
+	Operations OperationList
+	Fragments  FragmentDefinitionList
+	Position   *Position `dump:"-"`
+}
+
+type SchemaDocument struct {
+	Schema          SchemaDefinitionList
+	SchemaExtension SchemaDefinitionList
+	Directives      DirectiveDefinitionList
+	Definitions     DefinitionList
+	Extensions      DefinitionList
+	Position        *Position `dump:"-"`
+}
+
+func (d *SchemaDocument) Merge(other *SchemaDocument) {
+	d.Schema = append(d.Schema, other.Schema...)
+	d.SchemaExtension = append(d.SchemaExtension, other.SchemaExtension...)
+	d.Directives = append(d.Directives, other.Directives...)
+	d.Definitions = append(d.Definitions, other.Definitions...)
+	d.Extensions = append(d.Extensions, other.Extensions...)
+}
+
+type Schema struct {
+	Query        *Definition
+	Mutation     *Definition
+	Subscription *Definition
+
+	Types      map[string]*Definition
+	Directives map[string]*DirectiveDefinition
+
+	PossibleTypes map[string][]*Definition
+	Implements    map[string][]*Definition
+
+	Description string
+}
+
+// AddTypes is the helper to add types definition to the schema
+func (s *Schema) AddTypes(defs ...*Definition) {
+	if s.Types == nil {
+		s.Types = make(map[string]*Definition)
+	}
+	for _, def := range defs {
+		s.Types[def.Name] = def
+	}
+}
+
+func (s *Schema) AddPossibleType(name string, def *Definition) {
+	s.PossibleTypes[name] = append(s.PossibleTypes[name], def)
+}
+
+// GetPossibleTypes will enumerate all the definitions for a given interface or union
+func (s *Schema) GetPossibleTypes(def *Definition) []*Definition {
+	return s.PossibleTypes[def.Name]
+}
+
+func (s *Schema) AddImplements(name string, iface *Definition) {
+	s.Implements[name] = append(s.Implements[name], iface)
+}
+
+// GetImplements returns all the interface and union definitions that the given definition satisfies
+func (s *Schema) GetImplements(def *Definition) []*Definition {
+	return s.Implements[def.Name]
+}
+
+type SchemaDefinition struct {
+	Description    string
+	Directives     DirectiveList
+	OperationTypes OperationTypeDefinitionList
+	Position       *Position `dump:"-"`
+}
+
+type OperationTypeDefinition struct {
+	Operation Operation
+	Type      string
+	Position  *Position `dump:"-"`
+}
diff --git a/internal/gqlparser/ast/dumper.go b/internal/gqlparser/ast/dumper.go
new file mode 100644
index 0000000000..dbb7a7efaf
--- /dev/null
+++ b/internal/gqlparser/ast/dumper.go
@@ -0,0 +1,159 @@
+package ast
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+)
+
+// Dump turns ast into a stable string format for assertions in tests
+func Dump(i interface{}) string {
+	v := reflect.ValueOf(i)
+
+	d := dumper{Buffer: &bytes.Buffer{}}
+	d.dump(v)
+
+	return d.String()
+}
+
+type dumper struct {
+	*bytes.Buffer
+	indent int
+}
+
+type Dumpable interface {
+	Dump() string
+}
+
+func (d *dumper) dump(v reflect.Value) {
+	if dumpable, isDumpable := v.Interface().(Dumpable); isDumpable {
+		d.WriteString(dumpable.Dump())
+		return
+	}
+	switch v.Kind() {
+	case reflect.Bool:
+		if v.Bool() {
+			d.WriteString("true")
+		} else {
+			d.WriteString("false")
+		}
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		d.WriteString(fmt.Sprintf("%d", v.Int()))
+
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		d.WriteString(fmt.Sprintf("%d", v.Uint()))
+
+	case reflect.Float32, reflect.Float64:
+		d.WriteString(fmt.Sprintf("%.2f", v.Float()))
+
+	case reflect.String:
+		if v.Type().Name() != "string" {
+			d.WriteString(v.Type().Name() + "(" + strconv.Quote(v.String()) + ")")
+		} else {
+			d.WriteString(strconv.Quote(v.String()))
+		}
+
+	case reflect.Array, reflect.Slice:
+		d.dumpArray(v)
+
+	case reflect.Interface, reflect.Ptr:
+		d.dumpPtr(v)
+
+	case reflect.Struct:
+		d.dumpStruct(v)
+
+	default:
+		panic(fmt.Errorf("unsupported kind: %s\n buf: %s", v.Kind().String(), d.String()))
+	}
+}
+
+func (d *dumper) writeIndent() {
+	d.Buffer.WriteString(strings.Repeat("  ", d.indent))
+}
+
+func (d *dumper) nl() {
+	d.Buffer.WriteByte('\n')
+	d.writeIndent()
+}
+
+func typeName(t reflect.Type) string {
+	if t.Kind() == reflect.Ptr {
+		return typeName(t.Elem())
+	}
+	return t.Name()
+}
+
+func (d *dumper) dumpArray(v reflect.Value) {
+	d.WriteString("[" + typeName(v.Type().Elem()) + "]")
+
+	for i := 0; i < v.Len(); i++ {
+		d.nl()
+		d.WriteString("- ")
+		d.indent++
+		d.dump(v.Index(i))
+		d.indent--
+	}
+}
+
+func (d *dumper) dumpStruct(v reflect.Value) {
+	d.WriteString("<" + v.Type().Name() + ">")
+	d.indent++
+
+	typ := v.Type()
+	for i := 0; i < v.NumField(); i++ {
+		f := v.Field(i)
+		if typ.Field(i).Tag.Get("dump") == "-" {
+			continue
+		}
+
+		if isZero(f) {
+			continue
+		}
+		d.nl()
+		d.WriteString(typ.Field(i).Name)
+		d.WriteString(": ")
+		d.dump(v.Field(i))
+	}
+
+	d.indent--
+}
+
+func isZero(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Ptr, reflect.Interface:
+		return v.IsNil()
+	case reflect.Func, reflect.Map:
+		return v.IsNil()
+
+	case reflect.Array, reflect.Slice:
+		if v.IsNil() {
+			return true
+		}
+		z := true
+		for i := 0; i < v.Len(); i++ {
+			z = z && isZero(v.Index(i))
+		}
+		return z
+	case reflect.Struct:
+		z := true
+		for i := 0; i < v.NumField(); i++ {
+			z = z && isZero(v.Field(i))
+		}
+		return z
+	case reflect.String:
+		return v.String() == ""
+	}
+
+	// Compare other types directly:
+	return reflect.DeepEqual(v.Interface(), reflect.Zero(v.Type()))
+}
+
+func (d *dumper) dumpPtr(v reflect.Value) {
+	if v.IsNil() {
+		d.WriteString("nil")
+		return
+	}
+	d.dump(v.Elem())
+}
diff --git a/internal/gqlparser/ast/fragment.go b/internal/gqlparser/ast/fragment.go
new file mode 100644
index 0000000000..57ab56c7c6
--- /dev/null
+++ b/internal/gqlparser/ast/fragment.go
@@ -0,0 +1,38 @@
+package ast
+
+type FragmentSpread struct {
+	Name       string
+	Directives DirectiveList
+
+	// Require validation
+	ObjectDefinition *Definition
+	Definition       *FragmentDefinition
+
+	Position *Position `dump:"-"`
+}
+
+type InlineFragment struct {
+	TypeCondition string
+	Directives    DirectiveList
+	SelectionSet  SelectionSet
+
+	// Require validation
+	ObjectDefinition *Definition
+
+	Position *Position `dump:"-"`
+}
+
+type FragmentDefinition struct {
+	Name string
+	// Note: fragment variable definitions are experimental and may be changed
+	// or removed in the future.
+	VariableDefinition VariableDefinitionList
+	TypeCondition      string
+	Directives         DirectiveList
+	SelectionSet       SelectionSet
+
+	// Require validation
+	Definition *Definition
+
+	Position *Position `dump:"-"`
+}
diff --git a/internal/gqlparser/ast/operation.go b/internal/gqlparser/ast/operation.go
new file mode 100644
index 0000000000..3b37f81bf3
--- /dev/null
+++ b/internal/gqlparser/ast/operation.go
@@ -0,0 +1,30 @@
+package ast
+
+type Operation string
+
+const (
+	Query        Operation = "query"
+	Mutation     Operation = "mutation"
+	Subscription Operation = "subscription"
+)
+
+type OperationDefinition struct {
+	Operation           Operation
+	Name                string
+	VariableDefinitions VariableDefinitionList
+	Directives          DirectiveList
+	SelectionSet        SelectionSet
+	Position            *Position `dump:"-"`
+}
+
+type VariableDefinition struct {
+	Variable     string
+	Type         *Type
+	DefaultValue *Value
+	Directives   DirectiveList
+	Position     *Position `dump:"-"`
+
+	// Requires validation
+	Definition *Definition
+	Used       bool `dump:"-"`
+}
diff --git a/internal/gqlparser/ast/path.go b/internal/gqlparser/ast/path.go
new file mode 100644
index 0000000000..be1a9e4edb
--- /dev/null
+++ b/internal/gqlparser/ast/path.go
@@ -0,0 +1,67 @@
+package ast
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+)
+
+var _ json.Unmarshaler = (*Path)(nil)
+
+type Path []PathElement
+
+type PathElement interface {
+	isPathElement()
+}
+
+var _ PathElement = PathIndex(0)
+var _ PathElement = PathName("")
+
+func (path Path) String() string {
+	var str bytes.Buffer
+	for i, v := range path {
+		switch v := v.(type) {
+		case PathIndex:
+			str.WriteString(fmt.Sprintf("[%d]", v))
+		case PathName:
+			if i != 0 {
+				str.WriteByte('.')
+			}
+			str.WriteString(string(v))
+		default:
+			panic(fmt.Sprintf("unknown type: %T", v))
+		}
+	}
+	return str.String()
+}
+
+func (path *Path) UnmarshalJSON(b []byte) error {
+	var vs []interface{}
+	err := json.Unmarshal(b, &vs)
+	if err != nil {
+		return err
+	}
+
+	*path = make([]PathElement, 0, len(vs))
+	for _, v := range vs {
+		switch v := v.(type) {
+		case string:
+			*path = append(*path, PathName(v))
+		case int:
+			*path = append(*path, PathIndex(v))
+		case float64:
+			*path = append(*path, PathIndex(int(v)))
+		default:
+			return fmt.Errorf("unknown path element type: %T", v)
+		}
+	}
+	return nil
+}
+
+type PathIndex int
+
+func (PathIndex) isPathElement() {}
+
+type PathName string
+
+func (PathName) isPathElement() {}
diff --git a/internal/gqlparser/ast/selection.go b/internal/gqlparser/ast/selection.go
new file mode 100644
index 0000000000..5ef26c6ab3
--- /dev/null
+++ b/internal/gqlparser/ast/selection.go
@@ -0,0 +1,39 @@
+package ast
+
+type SelectionSet []Selection
+
+type Selection interface {
+	isSelection()
+	GetPosition() *Position
+}
+
+func (*Field) isSelection()          {}
+func (*FragmentSpread) isSelection() {}
+func (*InlineFragment) isSelection() {}
+
+func (s *Field) GetPosition() *Position          { return s.Position }
+func (s *FragmentSpread) GetPosition() *Position { return s.Position }
+func (s *InlineFragment) GetPosition() *Position { return s.Position }
+
+type Field struct {
+	Alias        string
+	Name         string
+	Arguments    ArgumentList
+	Directives   DirectiveList
+	SelectionSet SelectionSet
+	Position     *Position `dump:"-"`
+
+	// Require validation
+	Definition       *FieldDefinition
+	ObjectDefinition *Definition
+}
+
+type Argument struct {
+	Name     string
+	Value    *Value
+	Position *Position `dump:"-"`
+}
+
+func (s *Field) ArgumentMap(vars map[string]interface{}) map[string]interface{} {
+	return arg2map(s.Definition.Arguments, s.Arguments, vars)
+}
diff --git a/internal/gqlparser/ast/source.go b/internal/gqlparser/ast/source.go
new file mode 100644
index 0000000000..2949f83f7b
--- /dev/null
+++ b/internal/gqlparser/ast/source.go
@@ -0,0 +1,19 @@
+package ast
+
+// Source covers a single *.graphql file
+type Source struct {
+	// Name is the filename of the source
+	Name string
+	// Input is the actual contents of the source file
+	Input string
+	// BuiltIn indicate whether the source is a part of the specification
+	BuiltIn bool
+}
+
+type Position struct {
+	Start  int     // The starting position, in runes, of this token in the input.
+	End    int     // The end position, in runes, of this token in the input.
+	Line   int     // The line number at the start of this item.
+	Column int     // The column number at the start of this item.
+	Src    *Source // The source document this token belongs to
+}
diff --git a/internal/gqlparser/ast/type.go b/internal/gqlparser/ast/type.go
new file mode 100644
index 0000000000..5f77bc7ce4
--- /dev/null
+++ b/internal/gqlparser/ast/type.go
@@ -0,0 +1,68 @@
+package ast
+
+func NonNullNamedType(named string, pos *Position) *Type {
+	return &Type{NamedType: named, NonNull: true, Position: pos}
+}
+
+func NamedType(named string, pos *Position) *Type {
+	return &Type{NamedType: named, NonNull: false, Position: pos}
+}
+
+func NonNullListType(elem *Type, pos *Position) *Type {
+	return &Type{Elem: elem, NonNull: true, Position: pos}
+}
+
+func ListType(elem *Type, pos *Position) *Type {
+	return &Type{Elem: elem, NonNull: false, Position: pos}
+}
+
+type Type struct {
+	NamedType string
+	Elem      *Type
+	NonNull   bool
+	Position  *Position `dump:"-"`
+}
+
+func (t *Type) Name() string {
+	if t.NamedType != "" {
+		return t.NamedType
+	}
+
+	return t.Elem.Name()
+}
+
+func (t *Type) String() string {
+	nn := ""
+	if t.NonNull {
+		nn = "!"
+	}
+	if t.NamedType != "" {
+		return t.NamedType + nn
+	}
+
+	return "[" + t.Elem.String() + "]" + nn
+}
+
+func (t *Type) IsCompatible(other *Type) bool {
+	if t.NamedType != other.NamedType {
+		return false
+	}
+
+	if t.Elem != nil && other.Elem == nil {
+		return false
+	}
+
+	if t.Elem != nil && !t.Elem.IsCompatible(other.Elem) {
+		return false
+	}
+
+	if other.NonNull {
+		return t.NonNull
+	}
+
+	return true
+}
+
+func (t *Type) Dump() string {
+	return t.String()
+}
diff --git a/internal/gqlparser/ast/value.go b/internal/gqlparser/ast/value.go
new file mode 100644
index 0000000000..c25ef15059
--- /dev/null
+++ b/internal/gqlparser/ast/value.go
@@ -0,0 +1,120 @@
+package ast
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type ValueKind int
+
+const (
+	Variable ValueKind = iota
+	IntValue
+	FloatValue
+	StringValue
+	BlockValue
+	BooleanValue
+	NullValue
+	EnumValue
+	ListValue
+	ObjectValue
+)
+
+type Value struct {
+	Raw      string
+	Children ChildValueList
+	Kind     ValueKind
+	Position *Position `dump:"-"`
+
+	// Require validation
+	Definition         *Definition
+	VariableDefinition *VariableDefinition
+	ExpectedType       *Type
+}
+
+type ChildValue struct {
+	Name     string
+	Value    *Value
+	Position *Position `dump:"-"`
+}
+
+func (v *Value) Value(vars map[string]interface{}) (interface{}, error) {
+	if v == nil {
+		return nil, nil
+	}
+	switch v.Kind {
+	case Variable:
+		if value, ok := vars[v.Raw]; ok {
+			return value, nil
+		}
+		if v.VariableDefinition != nil && v.VariableDefinition.DefaultValue != nil {
+			return v.VariableDefinition.DefaultValue.Value(vars)
+		}
+		return nil, nil
+	case IntValue:
+		return strconv.ParseInt(v.Raw, 10, 64)
+	case FloatValue:
+		return strconv.ParseFloat(v.Raw, 64)
+	case StringValue, BlockValue, EnumValue:
+		return v.Raw, nil
+	case BooleanValue:
+		return strconv.ParseBool(v.Raw)
+	case NullValue:
+		return nil, nil
+	case ListValue:
+		var val []interface{}
+		for _, elem := range v.Children {
+			elemVal, err := elem.Value.Value(vars)
+			if err != nil {
+				return val, err
+			}
+			val = append(val, elemVal)
+		}
+		return val, nil
+	case ObjectValue:
+		val := map[string]interface{}{}
+		for _, elem := range v.Children {
+			elemVal, err := elem.Value.Value(vars)
+			if err != nil {
+				return val, err
+			}
+			val[elem.Name] = elemVal
+		}
+		return val, nil
+	default:
+		panic(fmt.Errorf("unknown value kind %d", v.Kind))
+	}
+}
+
+func (v *Value) String() string {
+	if v == nil {
+		return "<nil>"
+	}
+	switch v.Kind {
+	case Variable:
+		return "$" + v.Raw
+	case IntValue, FloatValue, EnumValue, BooleanValue, NullValue:
+		return v.Raw
+	case StringValue, BlockValue:
+		return strconv.Quote(v.Raw)
+	case ListValue:
+		var val []string
+		for _, elem := range v.Children {
+			val = append(val, elem.Value.String())
+		}
+		return "[" + strings.Join(val, ",") + "]"
+	case ObjectValue:
+		var val []string
+		for _, elem := range v.Children {
+			val = append(val, elem.Name+":"+elem.Value.String())
+		}
+		return "{" + strings.Join(val, ",") + "}"
+	default:
+		panic(fmt.Errorf("unknown value kind %d", v.Kind))
+	}
+}
+
+func (v *Value) Dump() string {
+	return v.String()
+}
diff --git a/internal/gqlparser/formatter/formatter.go b/internal/gqlparser/formatter/formatter.go
new file mode 100644
index 0000000000..163e69f80f
--- /dev/null
+++ b/internal/gqlparser/formatter/formatter.go
@@ -0,0 +1,637 @@
+package formatter
+
+import (
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+)
+
+type Formatter interface {
+	FormatSchema(schema *ast.Schema)
+	FormatSchemaDocument(doc *ast.SchemaDocument)
+	FormatQueryDocument(doc *ast.QueryDocument)
+}
+
+//nolint:revive // Ignore "stuttering" name format.FormatterOption
+type FormatterOption func(*formatter)
+
+func WithIndent(indent string) FormatterOption {
+	return func(f *formatter) {
+		f.indent = indent
+	}
+}
+
+func NewFormatter(w io.Writer, options ...FormatterOption) Formatter {
+	f := &formatter{
+		indent: "\t",
+		writer: w,
+	}
+	for _, opt := range options {
+		opt(f)
+	}
+	return f
+}
+
+type formatter struct {
+	writer io.Writer
+
+	indent      string
+	indentSize  int
+	emitBuiltin bool
+
+	padNext  bool
+	lineHead bool
+}
+
+func (f *formatter) writeString(s string) {
+	_, _ = f.writer.Write([]byte(s))
+}
+
+func (f *formatter) writeIndent() *formatter {
+	if f.lineHead {
+		f.writeString(strings.Repeat(f.indent, f.indentSize))
+	}
+	f.lineHead = false
+	f.padNext = false
+
+	return f
+}
+
+func (f *formatter) WriteNewline() *formatter {
+	f.writeString("\n")
+	f.lineHead = true
+	f.padNext = false
+
+	return f
+}
+
+func (f *formatter) WriteWord(word string) *formatter {
+	if f.lineHead {
+		f.writeIndent()
+	}
+	if f.padNext {
+		f.writeString(" ")
+	}
+	f.writeString(strings.TrimSpace(word))
+	f.padNext = true
+
+	return f
+}
+
+func (f *formatter) WriteString(s string) *formatter {
+	if f.lineHead {
+		f.writeIndent()
+	}
+	if f.padNext {
+		f.writeString(" ")
+	}
+	f.writeString(s)
+	f.padNext = false
+
+	return f
+}
+
+func (f *formatter) WriteDescription(s string) *formatter {
+	if s == "" {
+		return f
+	}
+
+	f.WriteString(`"""`)
+	if ss := strings.Split(s, "\n"); len(ss) > 1 {
+		f.WriteNewline()
+		for _, s := range ss {
+			f.WriteString(s).WriteNewline()
+		}
+	} else {
+		f.WriteString(s)
+	}
+
+	f.WriteString(`"""`).WriteNewline()
+
+	return f
+}
+
+func (f *formatter) IncrementIndent() {
+	f.indentSize++
+}
+
+func (f *formatter) DecrementIndent() {
+	f.indentSize--
+}
+
+func (f *formatter) NoPadding() *formatter {
+	f.padNext = false
+
+	return f
+}
+
+func (f *formatter) NeedPadding() *formatter {
+	f.padNext = true
+
+	return f
+}
+
+func (f *formatter) FormatSchema(schema *ast.Schema) {
+	if schema == nil {
+		return
+	}
+
+	var inSchema bool
+	startSchema := func() {
+		if !inSchema {
+			inSchema = true
+
+			f.WriteWord("schema").WriteString("{").WriteNewline()
+			f.IncrementIndent()
+		}
+	}
+	if schema.Query != nil && schema.Query.Name != "Query" {
+		startSchema()
+		f.WriteWord("query").NoPadding().WriteString(":").NeedPadding()
+		f.WriteWord(schema.Query.Name).WriteNewline()
+	}
+	if schema.Mutation != nil && schema.Mutation.Name != "Mutation" {
+		startSchema()
+		f.WriteWord("mutation").NoPadding().WriteString(":").NeedPadding()
+		f.WriteWord(schema.Mutation.Name).WriteNewline()
+	}
+	if schema.Subscription != nil && schema.Subscription.Name != "Subscription" {
+		startSchema()
+		f.WriteWord("subscription").NoPadding().WriteString(":").NeedPadding()
+		f.WriteWord(schema.Subscription.Name).WriteNewline()
+	}
+	if inSchema {
+		f.DecrementIndent()
+		f.WriteString("}").WriteNewline()
+	}
+
+	directiveNames := make([]string, 0, len(schema.Directives))
+	for name := range schema.Directives {
+		directiveNames = append(directiveNames, name)
+	}
+	sort.Strings(directiveNames)
+	for _, name := range directiveNames {
+		f.FormatDirectiveDefinition(schema.Directives[name])
+	}
+
+	typeNames := make([]string, 0, len(schema.Types))
+	for name := range schema.Types {
+		typeNames = append(typeNames, name)
+	}
+	sort.Strings(typeNames)
+	for _, name := range typeNames {
+		f.FormatDefinition(schema.Types[name], false)
+	}
+}
+
+func (f *formatter) FormatSchemaDocument(doc *ast.SchemaDocument) {
+	// TODO emit by position based order
+
+	if doc == nil {
+		return
+	}
+
+	f.FormatSchemaDefinitionList(doc.Schema, false)
+	f.FormatSchemaDefinitionList(doc.SchemaExtension, true)
+
+	f.FormatDirectiveDefinitionList(doc.Directives)
+
+	f.FormatDefinitionList(doc.Definitions, false)
+	f.FormatDefinitionList(doc.Extensions, true)
+}
+
+func (f *formatter) FormatQueryDocument(doc *ast.QueryDocument) {
+	// TODO emit by position based order
+
+	if doc == nil {
+		return
+	}
+
+	f.FormatOperationList(doc.Operations)
+	f.FormatFragmentDefinitionList(doc.Fragments)
+}
+
+func (f *formatter) FormatSchemaDefinitionList(lists ast.SchemaDefinitionList, extension bool) {
+	if len(lists) == 0 {
+		return
+	}
+
+	if extension {
+		f.WriteWord("extend")
+	}
+	f.WriteWord("schema").WriteString("{").WriteNewline()
+	f.IncrementIndent()
+
+	for _, def := range lists {
+		f.FormatSchemaDefinition(def)
+	}
+
+	f.DecrementIndent()
+	f.WriteString("}").WriteNewline()
+}
+
+func (f *formatter) FormatSchemaDefinition(def *ast.SchemaDefinition) {
+	f.WriteDescription(def.Description)
+
+	f.FormatDirectiveList(def.Directives)
+
+	f.FormatOperationTypeDefinitionList(def.OperationTypes)
+}
+
+func (f *formatter) FormatOperationTypeDefinitionList(lists ast.OperationTypeDefinitionList) {
+	for _, def := range lists {
+		f.FormatOperationTypeDefinition(def)
+	}
+}
+
+func (f *formatter) FormatOperationTypeDefinition(def *ast.OperationTypeDefinition) {
+	f.WriteWord(string(def.Operation)).NoPadding().WriteString(":").NeedPadding()
+	f.WriteWord(def.Type)
+	f.WriteNewline()
+}
+
+func (f *formatter) FormatFieldList(fieldList ast.FieldList) {
+	if len(fieldList) == 0 {
+		return
+	}
+
+	f.WriteString("{").WriteNewline()
+	f.IncrementIndent()
+
+	for _, field := range fieldList {
+		f.FormatFieldDefinition(field)
+	}
+
+	f.DecrementIndent()
+	f.WriteString("}")
+}
+
+func (f *formatter) FormatFieldDefinition(field *ast.FieldDefinition) {
+	if !f.emitBuiltin && strings.HasPrefix(field.Name, "__") {
+		return
+	}
+
+	f.WriteDescription(field.Description)
+
+	f.WriteWord(field.Name).NoPadding()
+	f.FormatArgumentDefinitionList(field.Arguments)
+	f.NoPadding().WriteString(":").NeedPadding()
+	f.FormatType(field.Type)
+
+	if field.DefaultValue != nil {
+		f.WriteWord("=")
+		f.FormatValue(field.DefaultValue)
+	}
+
+	f.FormatDirectiveList(field.Directives)
+
+	f.WriteNewline()
+}
+
+func (f *formatter) FormatArgumentDefinitionList(lists ast.ArgumentDefinitionList) {
+	if len(lists) == 0 {
+		return
+	}
+
+	f.WriteString("(")
+	for idx, arg := range lists {
+		f.FormatArgumentDefinition(arg)
+
+		// Skip emitting (insignificant) comma in case it is the
+		// last argument, or we printed a new line in its definition.
+		if idx != len(lists)-1 && arg.Description == "" {
+			f.NoPadding().WriteWord(",")
+		}
+	}
+	f.NoPadding().WriteString(")").NeedPadding()
+}
+
+func (f *formatter) FormatArgumentDefinition(def *ast.ArgumentDefinition) {
+	if def.Description != "" {
+		f.WriteNewline().IncrementIndent()
+		f.WriteDescription(def.Description)
+	}
+
+	f.WriteWord(def.Name).NoPadding().WriteString(":").NeedPadding()
+	f.FormatType(def.Type)
+
+	if def.DefaultValue != nil {
+		f.WriteWord("=")
+		f.FormatValue(def.DefaultValue)
+	}
+
+	f.NeedPadding().FormatDirectiveList(def.Directives)
+
+	if def.Description != "" {
+		f.DecrementIndent()
+		f.WriteNewline()
+	}
+}
+
+func (f *formatter) FormatDirectiveLocation(location ast.DirectiveLocation) {
+	f.WriteWord(string(location))
+}
+
+func (f *formatter) FormatDirectiveDefinitionList(lists ast.DirectiveDefinitionList) {
+	if len(lists) == 0 {
+		return
+	}
+
+	for _, dec := range lists {
+		f.FormatDirectiveDefinition(dec)
+	}
+}
+
+func (f *formatter) FormatDirectiveDefinition(def *ast.DirectiveDefinition) {
+	if !f.emitBuiltin {
+		if def.Position.Src.BuiltIn {
+			return
+		}
+	}
+
+	f.WriteDescription(def.Description)
+	f.WriteWord("directive").WriteString("@").WriteWord(def.Name)
+
+	if len(def.Arguments) != 0 {
+		f.NoPadding()
+		f.FormatArgumentDefinitionList(def.Arguments)
+	}
+
+	if len(def.Locations) != 0 {
+		f.WriteWord("on")
+
+		for idx, dirLoc := range def.Locations {
+			f.FormatDirectiveLocation(dirLoc)
+
+			if idx != len(def.Locations)-1 {
+				f.WriteWord("|")
+			}
+		}
+	}
+
+	f.WriteNewline()
+}
+
+func (f *formatter) FormatDefinitionList(lists ast.DefinitionList, extend bool) {
+	if len(lists) == 0 {
+		return
+	}
+
+	for _, dec := range lists {
+		f.FormatDefinition(dec, extend)
+	}
+}
+
+func (f *formatter) FormatDefinition(def *ast.Definition, extend bool) {
+	if !f.emitBuiltin && def.BuiltIn {
+		return
+	}
+
+	f.WriteDescription(def.Description)
+
+	if extend {
+		f.WriteWord("extend")
+	}
+
+	switch def.Kind {
+	case ast.Scalar:
+		f.WriteWord("scalar").WriteWord(def.Name)
+
+	case ast.Object:
+		f.WriteWord("type").WriteWord(def.Name)
+
+	case ast.Interface:
+		f.WriteWord("interface").WriteWord(def.Name)
+
+	case ast.Union:
+		f.WriteWord("union").WriteWord(def.Name)
+
+	case ast.Enum:
+		f.WriteWord("enum").WriteWord(def.Name)
+
+	case ast.InputObject:
+		f.WriteWord("input").WriteWord(def.Name)
+	}
+
+	if len(def.Interfaces) != 0 {
+		f.WriteWord("implements").WriteWord(strings.Join(def.Interfaces, " & "))
+	}
+
+	f.FormatDirectiveList(def.Directives)
+
+	if len(def.Types) != 0 {
+		f.WriteWord("=").WriteWord(strings.Join(def.Types, " | "))
+	}
+
+	f.FormatFieldList(def.Fields)
+
+	f.FormatEnumValueList(def.EnumValues)
+
+	f.WriteNewline()
+}
+
+func (f *formatter) FormatEnumValueList(lists ast.EnumValueList) {
+	if len(lists) == 0 {
+		return
+	}
+
+	f.WriteString("{").WriteNewline()
+	f.IncrementIndent()
+
+	for _, v := range lists {
+		f.FormatEnumValueDefinition(v)
+	}
+
+	f.DecrementIndent()
+	f.WriteString("}")
+}
+
+func (f *formatter) FormatEnumValueDefinition(def *ast.EnumValueDefinition) {
+	f.WriteDescription(def.Description)
+
+	f.WriteWord(def.Name)
+	f.FormatDirectiveList(def.Directives)
+
+	f.WriteNewline()
+}
+
+func (f *formatter) FormatOperationList(lists ast.OperationList) {
+	for _, def := range lists {
+		f.FormatOperationDefinition(def)
+	}
+}
+
+func (f *formatter) FormatOperationDefinition(def *ast.OperationDefinition) {
+	f.WriteWord(string(def.Operation))
+	if def.Name != "" {
+		f.WriteWord(def.Name)
+	}
+	f.FormatVariableDefinitionList(def.VariableDefinitions)
+	f.FormatDirectiveList(def.Directives)
+
+	if len(def.SelectionSet) != 0 {
+		f.FormatSelectionSet(def.SelectionSet)
+		f.WriteNewline()
+	}
+}
+
+func (f *formatter) FormatDirectiveList(lists ast.DirectiveList) {
+	if len(lists) == 0 {
+		return
+	}
+
+	for _, dir := range lists {
+		f.FormatDirective(dir)
+	}
+}
+
+func (f *formatter) FormatDirective(dir *ast.Directive) {
+	f.WriteString("@").WriteWord(dir.Name)
+	f.FormatArgumentList(dir.Arguments)
+}
+
+func (f *formatter) FormatArgumentList(lists ast.ArgumentList) {
+	if len(lists) == 0 {
+		return
+	}
+	f.NoPadding().WriteString("(")
+	for idx, arg := range lists {
+		f.FormatArgument(arg)
+
+		if idx != len(lists)-1 {
+			f.NoPadding().WriteWord(",")
+		}
+	}
+	f.WriteString(")").NeedPadding()
+}
+
+func (f *formatter) FormatArgument(arg *ast.Argument) {
+	f.WriteWord(arg.Name).NoPadding().WriteString(":").NeedPadding()
+	f.WriteString(arg.Value.String())
+}
+
+func (f *formatter) FormatFragmentDefinitionList(lists ast.FragmentDefinitionList) {
+	for _, def := range lists {
+		f.FormatFragmentDefinition(def)
+	}
+}
+
+func (f *formatter) FormatFragmentDefinition(def *ast.FragmentDefinition) {
+	f.WriteWord("fragment").WriteWord(def.Name)
+	f.FormatVariableDefinitionList(def.VariableDefinition)
+	f.WriteWord("on").WriteWord(def.TypeCondition)
+	f.FormatDirectiveList(def.Directives)
+
+	if len(def.SelectionSet) != 0 {
+		f.FormatSelectionSet(def.SelectionSet)
+		f.WriteNewline()
+	}
+}
+
+func (f *formatter) FormatVariableDefinitionList(lists ast.VariableDefinitionList) {
+	if len(lists) == 0 {
+		return
+	}
+
+	f.WriteString("(")
+	for idx, def := range lists {
+		f.FormatVariableDefinition(def)
+
+		if idx != len(lists)-1 {
+			f.NoPadding().WriteWord(",")
+		}
+	}
+	f.NoPadding().WriteString(")").NeedPadding()
+}
+
+func (f *formatter) FormatVariableDefinition(def *ast.VariableDefinition) {
+	f.WriteString("$").WriteWord(def.Variable).NoPadding().WriteString(":").NeedPadding()
+	f.FormatType(def.Type)
+
+	if def.DefaultValue != nil {
+		f.WriteWord("=")
+		f.FormatValue(def.DefaultValue)
+	}
+
+	// TODO https://github.com/open-policy-agent/opa/internal/gqlparser/issues/102
+	//   VariableDefinition : Variable : Type DefaultValue? Directives[Const]?
+}
+
+func (f *formatter) FormatSelectionSet(sets ast.SelectionSet) {
+	if len(sets) == 0 {
+		return
+	}
+
+	f.WriteString("{").WriteNewline()
+	f.IncrementIndent()
+
+	for _, sel := range sets {
+		f.FormatSelection(sel)
+	}
+
+	f.DecrementIndent()
+	f.WriteString("}")
+}
+
+func (f *formatter) FormatSelection(selection ast.Selection) {
+	switch v := selection.(type) {
+	case *ast.Field:
+		f.FormatField(v)
+
+	case *ast.FragmentSpread:
+		f.FormatFragmentSpread(v)
+
+	case *ast.InlineFragment:
+		f.FormatInlineFragment(v)
+
+	default:
+		panic(fmt.Errorf("unknown Selection type: %T", selection))
+	}
+
+	f.WriteNewline()
+}
+
+func (f *formatter) FormatField(field *ast.Field) {
+	if field.Alias != "" && field.Alias != field.Name {
+		f.WriteWord(field.Alias).NoPadding().WriteString(":").NeedPadding()
+	}
+	f.WriteWord(field.Name)
+
+	if len(field.Arguments) != 0 {
+		f.NoPadding()
+		f.FormatArgumentList(field.Arguments)
+		f.NeedPadding()
+	}
+
+	f.FormatDirectiveList(field.Directives)
+
+	f.FormatSelectionSet(field.SelectionSet)
+}
+
+func (f *formatter) FormatFragmentSpread(spread *ast.FragmentSpread) {
+	f.WriteWord("...").WriteWord(spread.Name)
+
+	f.FormatDirectiveList(spread.Directives)
+}
+
+func (f *formatter) FormatInlineFragment(inline *ast.InlineFragment) {
+	f.WriteWord("...")
+	if inline.TypeCondition != "" {
+		f.WriteWord("on").WriteWord(inline.TypeCondition)
+	}
+
+	f.FormatDirectiveList(inline.Directives)
+
+	f.FormatSelectionSet(inline.SelectionSet)
+}
+
+func (f *formatter) FormatType(t *ast.Type) {
+	f.WriteWord(t.String())
+}
+
+func (f *formatter) FormatValue(value *ast.Value) {
+	f.WriteString(value.String())
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/basic.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/basic.graphql
new file mode 100644
index 0000000000..238d422e00
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/basic.graphql
@@ -0,0 +1,7 @@
+query FooBarQuery ($after: String!) {
+	fizzList(first: 100, after: $after) {
+		nodes {
+			id
+		}
+	}
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/field.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/field.graphql
new file mode 100644
index 0000000000..7614c27ecf
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/field.graphql
@@ -0,0 +1,3 @@
+query {
+	bar: foo
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/fragment.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/fragment.graphql
new file mode 100644
index 0000000000..6ecda70909
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/fragment.graphql
@@ -0,0 +1,18 @@
+query FooBarQuery ($after: String!) {
+	fizzList(first: 100, after: $after) {
+		nodes {
+			id
+			... FooFragment
+			... on Foo {
+				id
+			}
+			... {
+				id
+			}
+			name
+		}
+	}
+}
+fragment FooFragment on Foo {
+	id
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/variable.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/variable.graphql
new file mode 100644
index 0000000000..3eeec53b1c
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatQueryDocument/variable.graphql
@@ -0,0 +1,8 @@
+query ($first: Int = 30, $after: String!) {
+	searchCats(first: $first, after: $after) {
+		nodes {
+			id
+			name
+		}
+	}
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/definition.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/definition.graphql
new file mode 100644
index 0000000000..ac651492c3
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/definition.graphql
@@ -0,0 +1,24 @@
+scalar Cat0
+type Cat1 {
+	name: String
+}
+interface Cat2 {
+	name: String
+}
+union Cat3 = Cat3_0 | Cat3_1 | Cat3_2
+type Cat3_0 {
+	name: String
+}
+type Cat3_1 {
+	name: String
+}
+type Cat3_2 {
+	name: String
+}
+enum Cat4 {
+	NFC
+	MAINECOON
+}
+input Cat5 {
+	name: String
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/description.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/description.graphql
new file mode 100644
index 0000000000..a4dca23fd4
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/description.graphql
@@ -0,0 +1,8 @@
+"""
+Cat is best kawaii animal in the world.
+meow!
+"""
+type Cat {
+	"""Shiny brillian name."""
+	name: String
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/directive.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/directive.graphql
new file mode 100644
index 0000000000..5f65049029
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/directive.graphql
@@ -0,0 +1 @@
+directive @foo on FIELD | OBJECT
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/directive_locations.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/directive_locations.graphql
new file mode 100644
index 0000000000..31bf49ec37
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/directive_locations.graphql
@@ -0,0 +1,13 @@
+directive @foo on OBJECT | UNION | ENUM
+enum ConnectionStatus @foo {
+	ONLINE
+	OFFLINE
+	ERROR
+}
+interface Named {
+	name: String!
+}
+type Person implements Named @foo {
+	name: String!
+}
+union PersonUnion @foo = Person
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/extensions.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/extensions.graphql
new file mode 100644
index 0000000000..813b4d0302
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/extensions.graphql
@@ -0,0 +1,16 @@
+directive @extends on OBJECT
+directive @key(fields: String!) on OBJECT | INTERFACE
+directive @permission(permission: String!) on FIELD_DEFINITION
+type Dog {
+	name: String!
+	owner: Person! @permission(permission: "admin")
+}
+type Person @key(fields: "name") {
+	name: String!
+}
+type Query @extends {
+	dogs: [Dog!]!
+}
+type Subscription {
+	dogEvents: [Dog!]!
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/field_definition.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/field_definition.graphql
new file mode 100644
index 0000000000..4f2a9af7f7
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/field_definition.graphql
@@ -0,0 +1,3 @@
+input CatInput {
+	food: String = "fish & meat"
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/schema.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/schema.graphql
new file mode 100644
index 0000000000..1f6578be2c
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/schema.graphql
@@ -0,0 +1,41 @@
+schema {
+	query: TopQuery
+	mutation: TopMutation
+	subscription: TopSubscription
+}
+type TopMutation {
+	noop: Boolean
+	noop2(
+		"""noop2 foo bar"""
+		arg: String
+	): Boolean
+	noop3(
+		"""noop3 foo bar"""
+		arg: String
+	): Boolean
+}
+type TopQuery {
+	noop: Boolean
+	noop2(
+		"""noop2 foo bar"""
+		arg: String
+	): Boolean
+	noop3(
+		"""noop3 foo bar"""
+		arg: String
+	): Boolean
+}
+type TopSubscription {
+	noop: Boolean
+	noop2(
+		"""noop2 foo bar"""
+		arg: String
+	): Boolean
+	noop3(
+		"""noop3 foo bar"""
+		arg1: String
+
+		"""noop3 foo bar"""
+		arg2: String
+	): Boolean
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchema/swapi.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/swapi.graphql
new file mode 100644
index 0000000000..f2c1aea371
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchema/swapi.graphql
@@ -0,0 +1,87 @@
+interface Character {
+	id: ID!
+	name: String!
+	friends: [Character]
+	friendsConnection(first: Int, after: ID): FriendsConnection!
+	appearsIn: [Episode]!
+}
+input ColorInput {
+	red: Int!
+	green: Int!
+	blue: Int!
+}
+type Droid implements Character {
+	id: ID!
+	name: String!
+	friends: [Character]
+	friendsConnection(first: Int, after: ID): FriendsConnection!
+	appearsIn: [Episode]!
+	primaryFunction: String
+}
+enum Episode {
+	NEWHOPE
+	EMPIRE
+	JEDI
+}
+type FriendsConnection {
+	totalCount: Int
+	edges: [FriendsEdge]
+	friends: [Character]
+	pageInfo: PageInfo!
+}
+type FriendsEdge {
+	cursor: ID!
+	node: Character
+}
+type Human implements Character {
+	id: ID!
+	name: String!
+	homePlanet: String
+	height(unit: LengthUnit = METER): Float
+	mass: Float
+	friends: [Character]
+	friendsConnection(first: Int, after: ID): FriendsConnection!
+	appearsIn: [Episode]!
+	starships: [Starship]
+}
+enum LengthUnit {
+	METER
+	FOOT
+}
+type Mutation {
+	createReview(episode: Episode, review: ReviewInput!): Review
+}
+type PageInfo {
+	startCursor: ID
+	endCursor: ID
+	hasNextPage: Boolean!
+}
+type Query {
+	hero(episode: Episode): Character
+	reviews(episode: Episode!): [Review]
+	search(text: String): [SearchResult]
+	character(id: ID!): Character
+	droid(id: ID!): Droid
+	human(id: ID!): Human
+	starship(id: ID!): Starship
+}
+type Review {
+	episode: Episode
+	stars: Int!
+	commentary: String
+}
+input ReviewInput {
+	stars: Int!
+	commentary: String
+	favorite_color: ColorInput
+}
+union SearchResult = Human | Droid | Starship
+type Starship {
+	id: ID!
+	name: String!
+	length(unit: LengthUnit = METER): Float
+	coordinates: [[Float!]!]
+}
+type Subscription {
+	reviewAdded(episode: Episode): Review
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/definition.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/definition.graphql
new file mode 100644
index 0000000000..2eb48e32c6
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/definition.graphql
@@ -0,0 +1,24 @@
+scalar Cat0
+type Cat1 {
+	name: String
+}
+interface Cat2 {
+	name: String
+}
+type Cat3_0 {
+	name: String
+}
+type Cat3_1 {
+	name: String
+}
+type Cat3_2 {
+	name: String
+}
+union Cat3 = Cat3_0 | Cat3_1 | Cat3_2
+enum Cat4 {
+	NFC
+	MAINECOON
+}
+input Cat5 {
+	name: String
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/description.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/description.graphql
new file mode 100644
index 0000000000..a4dca23fd4
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/description.graphql
@@ -0,0 +1,8 @@
+"""
+Cat is best kawaii animal in the world.
+meow!
+"""
+type Cat {
+	"""Shiny brillian name."""
+	name: String
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/directive.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/directive.graphql
new file mode 100644
index 0000000000..5f65049029
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/directive.graphql
@@ -0,0 +1 @@
+directive @foo on FIELD | OBJECT
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/directive_locations.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/directive_locations.graphql
new file mode 100644
index 0000000000..26bd869dac
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/directive_locations.graphql
@@ -0,0 +1,13 @@
+directive @foo on OBJECT | UNION | ENUM
+interface Named {
+	name: String!
+}
+type Person implements Named @foo {
+	name: String!
+}
+enum ConnectionStatus @foo {
+	ONLINE
+	OFFLINE
+	ERROR
+}
+union PersonUnion @foo = Person
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/extensions.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/extensions.graphql
new file mode 100644
index 0000000000..225694f842
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/extensions.graphql
@@ -0,0 +1,24 @@
+schema {
+	query: Query
+}
+extend schema {
+	subscription: Subscription
+}
+directive @permission(permission: String!) on FIELD_DEFINITION
+directive @extends on OBJECT
+directive @key(fields: String!) on OBJECT | INTERFACE
+type Query @extends {
+	dogs: [Dog!]!
+}
+type Subscription {
+	dogEvents: [Dog!]!
+}
+type Dog {
+	name: String!
+}
+type Person @key(fields: "name") {
+	name: String!
+}
+extend type Dog {
+	owner: Person! @permission(permission: "admin")
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/field_definition.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/field_definition.graphql
new file mode 100644
index 0000000000..4f2a9af7f7
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/field_definition.graphql
@@ -0,0 +1,3 @@
+input CatInput {
+	food: String = "fish & meat"
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/schema.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/schema.graphql
new file mode 100644
index 0000000000..1f6578be2c
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/schema.graphql
@@ -0,0 +1,41 @@
+schema {
+	query: TopQuery
+	mutation: TopMutation
+	subscription: TopSubscription
+}
+type TopMutation {
+	noop: Boolean
+	noop2(
+		"""noop2 foo bar"""
+		arg: String
+	): Boolean
+	noop3(
+		"""noop3 foo bar"""
+		arg: String
+	): Boolean
+}
+type TopQuery {
+	noop: Boolean
+	noop2(
+		"""noop2 foo bar"""
+		arg: String
+	): Boolean
+	noop3(
+		"""noop3 foo bar"""
+		arg: String
+	): Boolean
+}
+type TopSubscription {
+	noop: Boolean
+	noop2(
+		"""noop2 foo bar"""
+		arg: String
+	): Boolean
+	noop3(
+		"""noop3 foo bar"""
+		arg1: String
+
+		"""noop3 foo bar"""
+		arg2: String
+	): Boolean
+}
diff --git a/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/swapi.graphql b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/swapi.graphql
new file mode 100644
index 0000000000..357f8f57ab
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/baseline/FormatSchemaDocument/swapi.graphql
@@ -0,0 +1,92 @@
+schema {
+	query: Query
+	mutation: Mutation
+	subscription: Subscription
+}
+type Query {
+	hero(episode: Episode): Character
+	reviews(episode: Episode!): [Review]
+	search(text: String): [SearchResult]
+	character(id: ID!): Character
+	droid(id: ID!): Droid
+	human(id: ID!): Human
+	starship(id: ID!): Starship
+}
+type Mutation {
+	createReview(episode: Episode, review: ReviewInput!): Review
+}
+type Subscription {
+	reviewAdded(episode: Episode): Review
+}
+enum Episode {
+	NEWHOPE
+	EMPIRE
+	JEDI
+}
+interface Character {
+	id: ID!
+	name: String!
+	friends: [Character]
+	friendsConnection(first: Int, after: ID): FriendsConnection!
+	appearsIn: [Episode]!
+}
+enum LengthUnit {
+	METER
+	FOOT
+}
+type Human implements Character {
+	id: ID!
+	name: String!
+	homePlanet: String
+	height(unit: LengthUnit = METER): Float
+	mass: Float
+	friends: [Character]
+	friendsConnection(first: Int, after: ID): FriendsConnection!
+	appearsIn: [Episode]!
+	starships: [Starship]
+}
+type Droid implements Character {
+	id: ID!
+	name: String!
+	friends: [Character]
+	friendsConnection(first: Int, after: ID): FriendsConnection!
+	appearsIn: [Episode]!
+	primaryFunction: String
+}
+type FriendsConnection {
+	totalCount: Int
+	edges: [FriendsEdge]
+	friends: [Character]
+	pageInfo: PageInfo!
+}
+type FriendsEdge {
+	cursor: ID!
+	node: Character
+}
+type PageInfo {
+	startCursor: ID
+	endCursor: ID
+	hasNextPage: Boolean!
+}
+type Review {
+	episode: Episode
+	stars: Int!
+	commentary: String
+}
+input ReviewInput {
+	stars: Int!
+	commentary: String
+	favorite_color: ColorInput
+}
+input ColorInput {
+	red: Int!
+	green: Int!
+	blue: Int!
+}
+type Starship {
+	id: ID!
+	name: String!
+	length(unit: LengthUnit = METER): Float
+	coordinates: [[Float!]!]
+}
+union SearchResult = Human | Droid | Starship
diff --git a/internal/gqlparser/formatter/testdata/source/query/basic.graphql b/internal/gqlparser/formatter/testdata/source/query/basic.graphql
new file mode 100644
index 0000000000..658ddf0b5b
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/query/basic.graphql
@@ -0,0 +1,7 @@
+query FooBarQuery ($after: String!) {
+    fizzList(first: 100, after: $after) {
+        nodes {
+            id
+        }
+    }
+}
diff --git a/internal/gqlparser/formatter/testdata/source/query/field.graphql b/internal/gqlparser/formatter/testdata/source/query/field.graphql
new file mode 100644
index 0000000000..7ac16091ee
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/query/field.graphql
@@ -0,0 +1,3 @@
+{
+    bar: foo
+}
diff --git a/internal/gqlparser/formatter/testdata/source/query/fragment.graphql b/internal/gqlparser/formatter/testdata/source/query/fragment.graphql
new file mode 100644
index 0000000000..48fdc92999
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/query/fragment.graphql
@@ -0,0 +1,19 @@
+query FooBarQuery ($after: String!) {
+    fizzList(first: 100, after: $after) {
+        nodes {
+            id
+            ... FooFragment
+            ... on Foo {
+                id
+            }
+            ... {
+                id
+            }
+            name
+        }
+    }
+}
+
+fragment FooFragment on Foo {
+    id
+}
diff --git a/internal/gqlparser/formatter/testdata/source/query/variable.graphql b/internal/gqlparser/formatter/testdata/source/query/variable.graphql
new file mode 100644
index 0000000000..ccea84aaff
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/query/variable.graphql
@@ -0,0 +1,8 @@
+query ($first: Int = 30, $after: String!) {
+    searchCats(first: $first, after: $after) {
+        nodes {
+            id
+            name
+        }
+    }
+}
diff --git a/internal/gqlparser/formatter/testdata/source/schema/definition.graphql b/internal/gqlparser/formatter/testdata/source/schema/definition.graphql
new file mode 100644
index 0000000000..349d72f360
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/definition.graphql
@@ -0,0 +1,25 @@
+scalar Cat0
+type Cat1 {
+    name: String
+}
+interface Cat2 {
+    name: String
+}
+type Cat3_0 {
+    name: String
+}
+type Cat3_1 {
+    name: String
+}
+type Cat3_2 {
+    name: String
+}
+union Cat3 = Cat3_0|Cat3_1|Cat3_2
+enum Cat4 {
+    NFC
+    MAINECOON
+}
+input Cat5 {
+    name: String
+}
+
diff --git a/internal/gqlparser/formatter/testdata/source/schema/description.graphql b/internal/gqlparser/formatter/testdata/source/schema/description.graphql
new file mode 100644
index 0000000000..d25aff8643
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/description.graphql
@@ -0,0 +1,8 @@
+"""
+Cat is best kawaii animal in the world.
+meow!
+"""
+type Cat {
+    """Shiny brillian name."""
+    name: String
+}
diff --git a/internal/gqlparser/formatter/testdata/source/schema/directive.graphql b/internal/gqlparser/formatter/testdata/source/schema/directive.graphql
new file mode 100644
index 0000000000..4b741df396
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/directive.graphql
@@ -0,0 +1 @@
+directive @foo on FIELD|OBJECT
diff --git a/internal/gqlparser/formatter/testdata/source/schema/directive_locations.graphql b/internal/gqlparser/formatter/testdata/source/schema/directive_locations.graphql
new file mode 100644
index 0000000000..26bd869dac
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/directive_locations.graphql
@@ -0,0 +1,13 @@
+directive @foo on OBJECT | UNION | ENUM
+interface Named {
+	name: String!
+}
+type Person implements Named @foo {
+	name: String!
+}
+enum ConnectionStatus @foo {
+	ONLINE
+	OFFLINE
+	ERROR
+}
+union PersonUnion @foo = Person
diff --git a/internal/gqlparser/formatter/testdata/source/schema/extensions.graphql b/internal/gqlparser/formatter/testdata/source/schema/extensions.graphql
new file mode 100644
index 0000000000..d6ee0ceb65
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/extensions.graphql
@@ -0,0 +1,31 @@
+schema {
+    query: Query
+}
+
+extend schema {
+    subscription: Subscription
+}
+
+type Query @extends {
+    dogs: [Dog!]!
+}
+
+type Subscription {
+    dogEvents: [Dog!]!
+}
+
+type Dog {
+    name: String!
+}
+
+type Person @key(fields: "name") {
+    name: String!
+}
+
+extend type Dog {
+    owner: Person! @permission(permission: "admin")
+}
+
+directive @permission(permission: String!) on FIELD_DEFINITION
+directive @extends on OBJECT
+directive @key(fields: String!) on OBJECT | INTERFACE
\ No newline at end of file
diff --git a/internal/gqlparser/formatter/testdata/source/schema/field_definition.graphql b/internal/gqlparser/formatter/testdata/source/schema/field_definition.graphql
new file mode 100644
index 0000000000..a0b26dda46
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/field_definition.graphql
@@ -0,0 +1,3 @@
+input CatInput {
+    food: String = "fish & meat"
+}
diff --git a/internal/gqlparser/formatter/testdata/source/schema/schema.graphql b/internal/gqlparser/formatter/testdata/source/schema/schema.graphql
new file mode 100644
index 0000000000..96dfc897fb
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/schema.graphql
@@ -0,0 +1,49 @@
+schema {
+	query: TopQuery
+	mutation: TopMutation
+	subscription: TopSubscription
+}
+
+type TopMutation {
+    noop: Boolean
+    noop2("""
+      noop2 foo bar
+      """
+      arg: String
+    ): Boolean
+    noop3("noop3 foo bar"
+      arg: String
+    ): Boolean
+}
+
+type TopQuery {
+      noop: Boolean
+
+      noop2("""
+        noop2 foo bar
+        """
+        arg: String
+      ): Boolean
+
+      noop3(
+        "noop3 foo bar"
+        arg: String
+      ): Boolean
+}
+
+type TopSubscription {
+      noop: Boolean
+
+      noop2(
+        """noop2 foo bar"""
+        arg: String
+      ): Boolean
+
+      noop3(
+        "noop3 foo bar"
+        arg1: String
+
+        "noop3 foo bar"
+        arg2: String
+      ): Boolean
+}
diff --git a/internal/gqlparser/formatter/testdata/source/schema/swapi.graphql b/internal/gqlparser/formatter/testdata/source/schema/swapi.graphql
new file mode 100644
index 0000000000..38422b7f71
--- /dev/null
+++ b/internal/gqlparser/formatter/testdata/source/schema/swapi.graphql
@@ -0,0 +1,147 @@
+schema {
+    query: Query
+    mutation: Mutation
+    subscription: Subscription
+}
+
+# The query type, represents all of the entry points into our object graph
+type Query {
+    hero(episode: Episode): Character
+    reviews(episode: Episode!): [Review]
+    search(text: String): [SearchResult]
+    character(id: ID!): Character
+    droid(id: ID!): Droid
+    human(id: ID!): Human
+    starship(id: ID!): Starship
+}
+# The mutation type, represents all updates we can make to our data
+type Mutation {
+    createReview(episode: Episode, review: ReviewInput!): Review
+}
+# The subscription type, represents all subscriptions we can make to our data
+type Subscription {
+    reviewAdded(episode: Episode): Review
+}
+# The episodes in the Star Wars trilogy
+enum Episode {
+    # Star Wars Episode IV: A New Hope, released in 1977.
+    NEWHOPE
+    # Star Wars Episode V: The Empire Strikes Back, released in 1980.
+    EMPIRE
+    # Star Wars Episode VI: Return of the Jedi, released in 1983.
+    JEDI
+}
+# A character from the Star Wars universe
+interface Character {
+    # The ID of the character
+    id: ID!
+    # The name of the character
+    name: String!
+    # The friends of the character, or an empty list if they have none
+    friends: [Character]
+    # The friends of the character exposed as a connection with edges
+    friendsConnection(first: Int, after: ID): FriendsConnection!
+    # The movies this character appears in
+    appearsIn: [Episode]!
+}
+# Units of height
+enum LengthUnit {
+    # The standard unit around the world
+    METER
+    # Primarily used in the United States
+    FOOT
+}
+# A humanoid creature from the Star Wars universe
+type Human implements Character {
+    # The ID of the human
+    id: ID!
+    # What this human calls themselves
+    name: String!
+    # The home planet of the human, or null if unknown
+    homePlanet: String
+    # Height in the preferred unit, default is meters
+    height(unit: LengthUnit = METER): Float
+    # Mass in kilograms, or null if unknown
+    mass: Float
+    # This human's friends, or an empty list if they have none
+    friends: [Character]
+    # The friends of the human exposed as a connection with edges
+    friendsConnection(first: Int, after: ID): FriendsConnection!
+    # The movies this human appears in
+    appearsIn: [Episode]!
+    # A list of starships this person has piloted, or an empty list if none
+    starships: [Starship]
+}
+# An autonomous mechanical character in the Star Wars universe
+type Droid implements Character {
+    # The ID of the droid
+    id: ID!
+    # What others call this droid
+    name: String!
+    # This droid's friends, or an empty list if they have none
+    friends: [Character]
+    # The friends of the droid exposed as a connection with edges
+    friendsConnection(first: Int, after: ID): FriendsConnection!
+    # The movies this droid appears in
+    appearsIn: [Episode]!
+    # This droid's primary function
+    primaryFunction: String
+}
+# A connection object for a character's friends
+type FriendsConnection {
+    # The total number of friends
+    totalCount: Int
+    # The edges for each of the character's friends.
+    edges: [FriendsEdge]
+    # A list of the friends, as a convenience when edges are not needed.
+    friends: [Character]
+    # Information for paginating this connection
+    pageInfo: PageInfo!
+}
+# An edge object for a character's friends
+type FriendsEdge {
+    # A cursor used for pagination
+    cursor: ID!
+    # The character represented by this friendship edge
+    node: Character
+}
+# Information for paginating this connection
+type PageInfo {
+    startCursor: ID
+    endCursor: ID
+    hasNextPage: Boolean!
+}
+# Represents a review for a movie
+type Review {
+    # The movie
+    episode: Episode
+    # The number of stars this review gave, 1-5
+    stars: Int!
+    # Comment about the movie
+    commentary: String
+}
+# The input object sent when someone is creating a new review
+input ReviewInput {
+    # 0-5 stars
+    stars: Int!
+    # Comment about the movie, optional
+    commentary: String
+    # Favorite color, optional
+    favorite_color: ColorInput
+}
+# The input object sent when passing in a color
+input ColorInput {
+    red: Int!
+    green: Int!
+    blue: Int!
+}
+type Starship {
+    # The ID of the starship
+    id: ID!
+    # The name of the starship
+    name: String!
+    # Length of the starship, along the longest axis
+    length(unit: LengthUnit = METER): Float
+    coordinates: [[Float!]!]
+}
+union SearchResult = Human | Droid | Starship
\ No newline at end of file
diff --git a/internal/gqlparser/gqlerror/error.go b/internal/gqlparser/gqlerror/error.go
new file mode 100644
index 0000000000..58d1c1bd6c
--- /dev/null
+++ b/internal/gqlparser/gqlerror/error.go
@@ -0,0 +1,147 @@
+package gqlerror
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"strconv"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+)
+
+// Error is the standard graphql error type described in https://facebook.github.io/graphql/draft/#sec-Errors
+type Error struct {
+	err        error                  `json:"-"`
+	Message    string                 `json:"message"`
+	Path       ast.Path               `json:"path,omitempty"`
+	Locations  []Location             `json:"locations,omitempty"`
+	Extensions map[string]interface{} `json:"extensions,omitempty"`
+	Rule       string                 `json:"-"`
+}
+
+func (err *Error) SetFile(file string) {
+	if file == "" {
+		return
+	}
+	if err.Extensions == nil {
+		err.Extensions = map[string]interface{}{}
+	}
+
+	err.Extensions["file"] = file
+}
+
+type Location struct {
+	Line   int `json:"line,omitempty"`
+	Column int `json:"column,omitempty"`
+}
+
+type List []*Error
+
+func (err *Error) Error() string {
+	var res bytes.Buffer
+	if err == nil {
+		return ""
+	}
+	filename, _ := err.Extensions["file"].(string)
+	if filename == "" {
+		filename = "input"
+	}
+	res.WriteString(filename)
+
+	if len(err.Locations) > 0 {
+		res.WriteByte(':')
+		res.WriteString(strconv.Itoa(err.Locations[0].Line))
+		res.WriteByte(':')
+		res.WriteString(strconv.Itoa(err.Locations[0].Column))
+	}
+
+	res.WriteString(": ")
+	if ps := err.pathString(); ps != "" {
+		res.WriteString(ps)
+		res.WriteByte(' ')
+	}
+
+	res.WriteString(err.Message)
+
+	return res.String()
+}
+
+func (err Error) pathString() string {
+	return err.Path.String()
+}
+
+func (err Error) Unwrap() error {
+	return err.err
+}
+
+func (errs List) Error() string {
+	var buf bytes.Buffer
+	for _, err := range errs {
+		buf.WriteString(err.Error())
+		buf.WriteByte('\n')
+	}
+	return buf.String()
+}
+
+func (errs List) Is(target error) bool {
+	for _, err := range errs {
+		if errors.Is(err, target) {
+			return true
+		}
+	}
+	return false
+}
+
+func (errs List) As(target interface{}) bool {
+	for _, err := range errs {
+		if errors.As(err, target) {
+			return true
+		}
+	}
+	return false
+}
+
+func WrapPath(path ast.Path, err error) *Error {
+	return &Error{
+		err:     err,
+		Message: err.Error(),
+		Path:    path,
+	}
+}
+
+func Errorf(message string, args ...interface{}) *Error {
+	return &Error{
+		Message: fmt.Sprintf(message, args...),
+	}
+}
+
+func ErrorPathf(path ast.Path, message string, args ...interface{}) *Error {
+	return &Error{
+		Message: fmt.Sprintf(message, args...),
+		Path:    path,
+	}
+}
+
+func ErrorPosf(pos *ast.Position, message string, args ...interface{}) *Error {
+	return ErrorLocf(
+		pos.Src.Name,
+		pos.Line,
+		pos.Column,
+		message,
+		args...,
+	)
+}
+
+func ErrorLocf(file string, line int, col int, message string, args ...interface{}) *Error {
+	var extensions map[string]interface{}
+	if file != "" {
+		extensions = map[string]interface{}{"file": file}
+	}
+	return &Error{
+		Message:    fmt.Sprintf(message, args...),
+		Extensions: extensions,
+		Locations: []Location{
+			{Line: line, Column: col},
+		},
+	}
+}
diff --git a/internal/gqlparser/gqlparser.go b/internal/gqlparser/gqlparser.go
new file mode 100644
index 0000000000..575f5be5e1
--- /dev/null
+++ b/internal/gqlparser/gqlparser.go
@@ -0,0 +1,45 @@
+package gqlparser
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+	"github.com/open-policy-agent/opa/internal/gqlparser/parser"
+	"github.com/open-policy-agent/opa/internal/gqlparser/validator"
+
+	// Blank import is used to load up the validator rules.
+	_ "github.com/open-policy-agent/opa/internal/gqlparser/validator/rules"
+)
+
+func LoadSchema(str ...*ast.Source) (*ast.Schema, error) {
+	return validator.LoadSchema(append([]*ast.Source{validator.Prelude}, str...)...)
+}
+
+func MustLoadSchema(str ...*ast.Source) *ast.Schema {
+	s, err := validator.LoadSchema(append([]*ast.Source{validator.Prelude}, str...)...)
+	if err != nil {
+		panic(err)
+	}
+	return s
+}
+
+func LoadQuery(schema *ast.Schema, str string) (*ast.QueryDocument, gqlerror.List) {
+	query, err := parser.ParseQuery(&ast.Source{Input: str})
+	if err != nil {
+		gqlErr := err.(*gqlerror.Error)
+		return nil, gqlerror.List{gqlErr}
+	}
+	errs := validator.Validate(schema, query)
+	if errs != nil {
+		return nil, errs
+	}
+
+	return query, nil
+}
+
+func MustLoadQuery(schema *ast.Schema, str string) *ast.QueryDocument {
+	q, err := LoadQuery(schema, str)
+	if err != nil {
+		panic(err)
+	}
+	return q
+}
diff --git a/internal/gqlparser/lexer/blockstring.go b/internal/gqlparser/lexer/blockstring.go
new file mode 100644
index 0000000000..4065a610a8
--- /dev/null
+++ b/internal/gqlparser/lexer/blockstring.go
@@ -0,0 +1,58 @@
+package lexer
+
+import (
+	"math"
+	"strings"
+)
+
+// blockStringValue produces the value of a block string from its parsed raw value, similar to
+// Coffeescript's block string, Python's docstring trim or Ruby's strip_heredoc.
+//
+// This implements the GraphQL spec's BlockStringValue() static algorithm.
+func blockStringValue(raw string) string {
+	lines := strings.Split(raw, "\n")
+
+	commonIndent := math.MaxInt32
+	for _, line := range lines {
+		indent := leadingWhitespace(line)
+		if indent < len(line) && indent < commonIndent {
+			commonIndent = indent
+			if commonIndent == 0 {
+				break
+			}
+		}
+	}
+
+	if commonIndent != math.MaxInt32 && len(lines) > 0 {
+		for i := 1; i < len(lines); i++ {
+			if len(lines[i]) < commonIndent {
+				lines[i] = ""
+			} else {
+				lines[i] = lines[i][commonIndent:]
+			}
+		}
+	}
+
+	start := 0
+	end := len(lines)
+
+	for start < end && leadingWhitespace(lines[start]) == math.MaxInt32 {
+		start++
+	}
+
+	for start < end && leadingWhitespace(lines[end-1]) == math.MaxInt32 {
+		end--
+	}
+
+	return strings.Join(lines[start:end], "\n")
+}
+
+func leadingWhitespace(str string) int {
+	for i, r := range str {
+		if r != ' ' && r != '\t' {
+			return i
+		}
+	}
+	// this line is made up entirely of whitespace, its leading whitespace doesnt count.
+	return math.MaxInt32
+}
diff --git a/internal/gqlparser/lexer/lexer.go b/internal/gqlparser/lexer/lexer.go
new file mode 100644
index 0000000000..f25555e650
--- /dev/null
+++ b/internal/gqlparser/lexer/lexer.go
@@ -0,0 +1,517 @@
+package lexer
+
+import (
+	"bytes"
+	"unicode/utf8"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+)
+
+// Lexer turns graphql request and schema strings into tokens
+type Lexer struct {
+	*ast.Source
+	// An offset into the string in bytes
+	start int
+	// An offset into the string in runes
+	startRunes int
+	// An offset into the string in bytes
+	end int
+	// An offset into the string in runes
+	endRunes int
+	// the current line number
+	line int
+	// An offset into the string in rune
+	lineStartRunes int
+}
+
+func New(src *ast.Source) Lexer {
+	return Lexer{
+		Source: src,
+		line:   1,
+	}
+}
+
+// take one rune from input and advance end
+func (s *Lexer) peek() (rune, int) {
+	return utf8.DecodeRuneInString(s.Input[s.end:])
+}
+
+func (s *Lexer) makeToken(kind Type) (Token, error) {
+	return s.makeValueToken(kind, s.Input[s.start:s.end])
+}
+
+func (s *Lexer) makeValueToken(kind Type, value string) (Token, error) {
+	return Token{
+		Kind:  kind,
+		Value: value,
+		Pos: ast.Position{
+			Start:  s.startRunes,
+			End:    s.endRunes,
+			Line:   s.line,
+			Column: s.startRunes - s.lineStartRunes + 1,
+			Src:    s.Source,
+		},
+	}, nil
+}
+
+func (s *Lexer) makeError(format string, args ...interface{}) (Token, error) {
+	column := s.endRunes - s.lineStartRunes + 1
+	return Token{
+		Kind: Invalid,
+		Pos: ast.Position{
+			Start:  s.startRunes,
+			End:    s.endRunes,
+			Line:   s.line,
+			Column: column,
+			Src:    s.Source,
+		},
+	}, gqlerror.ErrorLocf(s.Source.Name, s.line, column, format, args...)
+}
+
+// ReadToken gets the next token from the source starting at the given position.
+//
+// This skips over whitespace and comments until it finds the next lexable
+// token, then lexes punctuators immediately or calls the appropriate helper
+// function for more complicated tokens.
+func (s *Lexer) ReadToken() (token Token, err error) {
+
+	s.ws()
+	s.start = s.end
+	s.startRunes = s.endRunes
+
+	if s.end >= len(s.Input) {
+		return s.makeToken(EOF)
+	}
+	r := s.Input[s.start]
+	s.end++
+	s.endRunes++
+	switch r {
+	case '!':
+		return s.makeValueToken(Bang, "")
+
+	case '$':
+		return s.makeValueToken(Dollar, "")
+	case '&':
+		return s.makeValueToken(Amp, "")
+	case '(':
+		return s.makeValueToken(ParenL, "")
+	case ')':
+		return s.makeValueToken(ParenR, "")
+	case '.':
+		if len(s.Input) > s.start+2 && s.Input[s.start:s.start+3] == "..." {
+			s.end += 2
+			s.endRunes += 2
+			return s.makeValueToken(Spread, "")
+		}
+	case ':':
+		return s.makeValueToken(Colon, "")
+	case '=':
+		return s.makeValueToken(Equals, "")
+	case '@':
+		return s.makeValueToken(At, "")
+	case '[':
+		return s.makeValueToken(BracketL, "")
+	case ']':
+		return s.makeValueToken(BracketR, "")
+	case '{':
+		return s.makeValueToken(BraceL, "")
+	case '}':
+		return s.makeValueToken(BraceR, "")
+	case '|':
+		return s.makeValueToken(Pipe, "")
+	case '#':
+		if comment, err := s.readComment(); err != nil {
+			return comment, err
+		}
+		return s.ReadToken()
+
+	case '_', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z':
+		return s.readName()
+
+	case '-', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		return s.readNumber()
+
+	case '"':
+		if len(s.Input) > s.start+2 && s.Input[s.start:s.start+3] == `"""` {
+			return s.readBlockString()
+		}
+
+		return s.readString()
+	}
+
+	s.end--
+	s.endRunes--
+
+	if r < 0x0020 && r != 0x0009 && r != 0x000a && r != 0x000d {
+		return s.makeError(`Cannot contain the invalid character "\u%04d"`, r)
+	}
+
+	if r == '\'' {
+		return s.makeError(`Unexpected single quote character ('), did you mean to use a double quote (")?`)
+	}
+
+	return s.makeError(`Cannot parse the unexpected character "%s".`, string(r))
+}
+
+// ws reads from body starting at startPosition until it finds a non-whitespace
+// or commented character, and updates the token end to include all whitespace
+func (s *Lexer) ws() {
+	for s.end < len(s.Input) {
+		switch s.Input[s.end] {
+		case '\t', ' ', ',':
+			s.end++
+			s.endRunes++
+		case '\n':
+			s.end++
+			s.endRunes++
+			s.line++
+			s.lineStartRunes = s.endRunes
+		case '\r':
+			s.end++
+			s.endRunes++
+			s.line++
+			s.lineStartRunes = s.endRunes
+			// skip the following newline if its there
+			if s.end < len(s.Input) && s.Input[s.end] == '\n' {
+				s.end++
+				s.endRunes++
+			}
+			// byte order mark, given ws is hot path we aren't relying on the unicode package here.
+		case 0xef:
+			if s.end+2 < len(s.Input) && s.Input[s.end+1] == 0xBB && s.Input[s.end+2] == 0xBF {
+				s.end += 3
+				s.endRunes++
+			} else {
+				return
+			}
+		default:
+			return
+		}
+	}
+}
+
+// readComment from the input
+//
+// #[\u0009\u0020-\uFFFF]*
+func (s *Lexer) readComment() (Token, error) {
+	for s.end < len(s.Input) {
+		r, w := s.peek()
+
+		// SourceCharacter but not LineTerminator
+		if r > 0x001f || r == '\t' {
+			s.end += w
+			s.endRunes++
+		} else {
+			break
+		}
+	}
+
+	return s.makeToken(Comment)
+}
+
+// readNumber from the input, either a float
+// or an int depending on whether a decimal point appears.
+//
+// Int:   -?(0|[1-9][0-9]*)
+// Float: -?(0|[1-9][0-9]*)(\.[0-9]+)?((E|e)(+|-)?[0-9]+)?
+func (s *Lexer) readNumber() (Token, error) {
+	float := false
+
+	// backup to the first digit
+	s.end--
+	s.endRunes--
+
+	s.acceptByte('-')
+
+	if s.acceptByte('0') {
+		if consumed := s.acceptDigits(); consumed != 0 {
+			s.end -= consumed
+			s.endRunes -= consumed
+			return s.makeError("Invalid number, unexpected digit after 0: %s.", s.describeNext())
+		}
+	} else {
+		if consumed := s.acceptDigits(); consumed == 0 {
+			return s.makeError("Invalid number, expected digit but got: %s.", s.describeNext())
+		}
+	}
+
+	if s.acceptByte('.') {
+		float = true
+
+		if consumed := s.acceptDigits(); consumed == 0 {
+			return s.makeError("Invalid number, expected digit but got: %s.", s.describeNext())
+		}
+	}
+
+	if s.acceptByte('e', 'E') {
+		float = true
+
+		s.acceptByte('-', '+')
+
+		if consumed := s.acceptDigits(); consumed == 0 {
+			return s.makeError("Invalid number, expected digit but got: %s.", s.describeNext())
+		}
+	}
+
+	if float {
+		return s.makeToken(Float)
+	}
+	return s.makeToken(Int)
+
+}
+
+// acceptByte if it matches any of given bytes, returning true if it found anything
+func (s *Lexer) acceptByte(bytes ...uint8) bool {
+	if s.end >= len(s.Input) {
+		return false
+	}
+
+	for _, accepted := range bytes {
+		if s.Input[s.end] == accepted {
+			s.end++
+			s.endRunes++
+			return true
+		}
+	}
+	return false
+}
+
+// acceptDigits from the input, returning the number of digits it found
+func (s *Lexer) acceptDigits() int {
+	consumed := 0
+	for s.end < len(s.Input) && s.Input[s.end] >= '0' && s.Input[s.end] <= '9' {
+		s.end++
+		s.endRunes++
+		consumed++
+	}
+
+	return consumed
+}
+
+// describeNext peeks at the input and returns a human readable string. This should will alloc
+// and should only be used in errors
+func (s *Lexer) describeNext() string {
+	if s.end < len(s.Input) {
+		return `"` + string(s.Input[s.end]) + `"`
+	}
+	return "<EOF>"
+}
+
+// readString from the input
+//
+// "([^"\\\u000A\u000D]|(\\(u[0-9a-fA-F]{4}|["\\/bfnrt])))*"
+func (s *Lexer) readString() (Token, error) {
+	inputLen := len(s.Input)
+
+	// this buffer is lazily created only if there are escape characters.
+	var buf *bytes.Buffer
+
+	// skip the opening quote
+	s.start++
+	s.startRunes++
+
+	for s.end < inputLen {
+		r := s.Input[s.end]
+		if r == '\n' || r == '\r' {
+			break
+		}
+		if r < 0x0020 && r != '\t' {
+			return s.makeError(`Invalid character within String: "\u%04d".`, r)
+		}
+		switch r {
+		default:
+			var char = rune(r)
+			var w = 1
+
+			// skip unicode overhead if we are in the ascii range
+			if r >= 127 {
+				char, w = utf8.DecodeRuneInString(s.Input[s.end:])
+			}
+			s.end += w
+			s.endRunes++
+
+			if buf != nil {
+				buf.WriteRune(char)
+			}
+
+		case '"':
+			t, err := s.makeToken(String)
+			// the token should not include the quotes in its value, but should cover them in its position
+			t.Pos.Start--
+			t.Pos.End++
+
+			if buf != nil {
+				t.Value = buf.String()
+			}
+
+			// skip the close quote
+			s.end++
+			s.endRunes++
+
+			return t, err
+
+		case '\\':
+			if s.end+1 >= inputLen {
+				s.end++
+				s.endRunes++
+				return s.makeError(`Invalid character escape sequence.`)
+			}
+
+			if buf == nil {
+				buf = bytes.NewBufferString(s.Input[s.start:s.end])
+			}
+
+			escape := s.Input[s.end+1]
+
+			if escape == 'u' {
+				if s.end+6 >= inputLen {
+					s.end++
+					s.endRunes++
+					return s.makeError("Invalid character escape sequence: \\%s.", s.Input[s.end:])
+				}
+
+				r, ok := unhex(s.Input[s.end+2 : s.end+6])
+				if !ok {
+					s.end++
+					s.endRunes++
+					return s.makeError("Invalid character escape sequence: \\%s.", s.Input[s.end:s.end+5])
+				}
+				buf.WriteRune(r)
+				s.end += 6
+				s.endRunes += 6
+			} else {
+				switch escape {
+				case '"', '/', '\\':
+					buf.WriteByte(escape)
+				case 'b':
+					buf.WriteByte('\b')
+				case 'f':
+					buf.WriteByte('\f')
+				case 'n':
+					buf.WriteByte('\n')
+				case 'r':
+					buf.WriteByte('\r')
+				case 't':
+					buf.WriteByte('\t')
+				default:
+					s.end++
+					s.endRunes++
+					return s.makeError("Invalid character escape sequence: \\%s.", string(escape))
+				}
+				s.end += 2
+				s.endRunes += 2
+			}
+		}
+	}
+
+	return s.makeError("Unterminated string.")
+}
+
+// readBlockString from the input
+//
+// """("?"?(\\"""|\\(?!=""")|[^"\\]))*"""
+func (s *Lexer) readBlockString() (Token, error) {
+	inputLen := len(s.Input)
+
+	var buf bytes.Buffer
+
+	// skip the opening quote
+	s.start += 3
+	s.startRunes += 3
+	s.end += 2
+	s.endRunes += 2
+
+	for s.end < inputLen {
+		r := s.Input[s.end]
+
+		// Closing triple quote (""")
+		if r == '"' && s.end+3 <= inputLen && s.Input[s.end:s.end+3] == `"""` {
+			t, err := s.makeValueToken(BlockString, blockStringValue(buf.String()))
+
+			// the token should not include the quotes in its value, but should cover them in its position
+			t.Pos.Start -= 3
+			t.Pos.End += 3
+
+			// skip the close quote
+			s.end += 3
+			s.endRunes += 3
+			return t, err
+		}
+
+		// SourceCharacter
+		if r < 0x0020 && r != '\t' && r != '\n' && r != '\r' {
+			return s.makeError(`Invalid character within String: "\u%04d".`, r)
+		}
+
+		if r == '\\' && s.end+4 <= inputLen && s.Input[s.end:s.end+4] == `\"""` {
+			buf.WriteString(`"""`)
+			s.end += 4
+			s.endRunes += 4
+		} else if r == '\r' {
+			if s.end+1 < inputLen && s.Input[s.end+1] == '\n' {
+				s.end++
+				s.endRunes++
+			}
+
+			buf.WriteByte('\n')
+			s.end++
+			s.endRunes++
+			s.line++
+			s.lineStartRunes = s.endRunes
+		} else {
+			var char = rune(r)
+			var w = 1
+
+			// skip unicode overhead if we are in the ascii range
+			if r >= 127 {
+				char, w = utf8.DecodeRuneInString(s.Input[s.end:])
+			}
+			s.end += w
+			s.endRunes++
+			buf.WriteRune(char)
+			if r == '\n' {
+				s.line++
+				s.lineStartRunes = s.endRunes
+			}
+		}
+	}
+
+	return s.makeError("Unterminated string.")
+}
+
+func unhex(b string) (v rune, ok bool) {
+	for _, c := range b {
+		v <<= 4
+		switch {
+		case '0' <= c && c <= '9':
+			v |= c - '0'
+		case 'a' <= c && c <= 'f':
+			v |= c - 'a' + 10
+		case 'A' <= c && c <= 'F':
+			v |= c - 'A' + 10
+		default:
+			return 0, false
+		}
+	}
+
+	return v, true
+}
+
+// readName from the input
+//
+// [_A-Za-z][_0-9A-Za-z]*
+func (s *Lexer) readName() (Token, error) {
+	for s.end < len(s.Input) {
+		r, w := s.peek()
+
+		if (r >= '0' && r <= '9') || (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || r == '_' {
+			s.end += w
+			s.endRunes++
+		} else {
+			break
+		}
+	}
+
+	return s.makeToken(Name)
+}
diff --git a/internal/gqlparser/lexer/lexer_test.yml b/internal/gqlparser/lexer/lexer_test.yml
new file mode 100644
index 0000000000..5c4d5f0ff5
--- /dev/null
+++ b/internal/gqlparser/lexer/lexer_test.yml
@@ -0,0 +1,692 @@
+encoding:
+  - name: disallows uncommon control characters
+    input: "\u0007"
+    error:
+      message: 'Cannot contain the invalid character "\u0007"'
+      locations: [{line: 1, column: 1}]
+
+  - name: accepts BOM header
+    input: "\uFEFF foo"
+    tokens:
+      -
+        kind: NAME
+        start: 2
+        end: 5
+        value: 'foo'
+
+simple tokens:
+  - name: records line and column
+    input: "\n \r\n \r  foo\n"
+    tokens:
+      -
+        kind: NAME
+        start: 8
+        end: 11
+        line: 4
+        column: 3
+        value: 'foo'
+
+  - name: skips whitespace
+    input: "\n\n    foo\n\n\n"
+    tokens:
+      -
+        kind: NAME
+        start: 6
+        end: 9
+        value: 'foo'
+
+  - name: skips comments
+    input: "\n    #comment\n    foo#comment\n"
+    tokens:
+      -
+        kind: NAME
+        start: 18
+        end: 21
+        value: 'foo'
+
+  - name: skips commas
+    input: ",,,foo,,,"
+    tokens:
+      -
+        kind: NAME
+        start: 3
+        end: 6
+        value: 'foo'
+
+  - name: errors respect whitespace
+    input: "\n\n    ?\n\n\n"
+    error:
+      message: 'Cannot parse the unexpected character "?".'
+      locations: [{line: 3, column: 5}]
+      string: |
+        Syntax Error: Cannot parse the unexpected character "?".
+        GraphQL request (3:5)
+        2:
+        3:     ?
+               ^
+        4:
+
+  - name: lex reports useful information for dashes in names
+    input: "a-b"
+    error:
+      message: 'Invalid number, expected digit but got: "b".'
+      locations: [{ line: 1, column: 3 }]
+    tokens:
+      -
+        kind: Name
+        start: 0
+        end: 1
+        value: a
+
+lexes strings:
+  - name: basic
+    input: '"simple"'
+    tokens:
+      -
+        kind: STRING
+        start: 0
+        end: 8
+        value: 'simple'
+
+  - name: whitespace
+    input: '" white space "'
+    tokens:
+      -
+        kind: STRING
+        start: 0
+        end: 15
+        value: ' white space '
+
+  - name: quote
+    input: '"quote \""'
+    tokens:
+      -
+        kind: STRING
+        start: 0
+        end: 10
+        value: 'quote "'
+
+  - name: escaped
+    input: '"escaped \n\r\b\t\f"'
+    tokens:
+      -
+        kind: STRING
+        start: 0
+        end: 20
+        value: "escaped \n\r\b\t\f"
+
+  - name: slashes
+    input: '"slashes \\ \/"'
+    tokens:
+      -
+        kind: STRING
+        start: 0
+        end: 15
+        value: 'slashes \ /'
+
+  - name: unicode
+    input: '"unicode \u1234\u5678\u90AB\uCDEF"'
+    tokens:
+      -
+        kind: STRING
+        start: 0
+        end: 34
+        value: "unicode \u1234\u5678\u90AB\uCDEF"
+
+lex reports useful string errors:
+  - name: unterminated
+    input: '"'
+    error:
+      message: "Unterminated string."
+      locations: [{ line: 1, column: 2 }]
+
+  - name: no end quote
+    input: '"no end quote'
+    error:
+      message: 'Unterminated string.'
+      locations: [{ line: 1, column: 14 }]
+
+  - name: single quotes
+    input: "'single quotes'"
+    error:
+      message: "Unexpected single quote character ('), did you mean to use a double quote (\")?"
+      locations: [{ line: 1, column: 1 }]
+
+  - name: control characters
+    input: "\"contains unescaped \u0007 control char\""
+    error:
+      message: 'Invalid character within String: "\u0007".'
+      locations: [{ line: 1, column: 21 }]
+
+  - name: null byte
+    input: "\"null-byte is not \u0000 end of file\""
+    error:
+      message: 'Invalid character within String: "\u0000".'
+      locations: [{ line: 1, column: 19 }]
+
+  - name: unterminated newline
+    input: "\"multi\nline\""
+    error:
+      message: 'Unterminated string.'
+      locations: [{line: 1, column: 7 }]
+
+  - name: unterminated carriage return
+    input: "\"multi\rline\""
+    error:
+      message: 'Unterminated string.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: bad escape character
+    input: '"bad \z esc"'
+    error:
+      message: 'Invalid character escape sequence: \z.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: hex escape sequence
+    input: '"bad \x esc"'
+    error:
+      message: 'Invalid character escape sequence: \x.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: short escape sequence
+    input: '"bad \u1 esc"'
+    error:
+      message: 'Invalid character escape sequence: \u1 es.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: invalid escape sequence 1
+    input: '"bad \u0XX1 esc"'
+    error:
+      message: 'Invalid character escape sequence: \u0XX1.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: invalid escape sequence 2
+    input: '"bad \uXXXX esc"'
+    error:
+      message: 'Invalid character escape sequence: \uXXXX.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: invalid escape sequence 3
+    input: '"bad \uFXXX esc"'
+    error:
+      message: 'Invalid character escape sequence: \uFXXX.'
+      locations: [{ line: 1, column: 7 }]
+
+  - name: invalid character escape sequence
+    input: '"bad \uXXXF esc"'
+    error:
+      message: 'Invalid character escape sequence: \uXXXF.'
+      locations: [{ line: 1, column: 7 }]
+
+lexes block strings:
+  - name: simple
+    input: '"""simple"""'
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 12
+        value: 'simple'
+
+  - name: white space
+    input: '""" white space """'
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 19
+        value: ' white space '
+
+  - name: contains quote
+    input: '"""contains " quote"""'
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 22
+        value: 'contains " quote'
+
+  - name: contains triplequote
+    input: "\"\"\"contains \\\"\"\" triplequote\"\"\""
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 31
+        value: 'contains """ triplequote'
+
+  - name: multi line
+    input: "\"\"\"multi\nline\"\"\""
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 16
+        value: "multi\nline"
+
+  - name: multi line normalized
+    input: "\"\"\"multi\rline\r\nnormalized\"\"\""
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 28
+        value: "multi\nline\nnormalized"
+
+  - name: unescaped
+    input: '"""unescaped \n\r\b\t\f\u1234"""'
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 32
+        value: 'unescaped \n\r\b\t\f\u1234'
+
+  - name: slashes
+    input: '"""slashes \\ \/"""'
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 19
+        value: 'slashes \\ \/'
+
+  - name: multiple lines
+    input: |
+      """
+
+      spans
+        multiple
+          lines
+
+      """
+    tokens:
+      -
+        kind: BLOCK_STRING
+        start: 0
+        end: 36
+        value: "spans\n  multiple\n    lines"
+
+  - name: records correct line and column after block string
+    input: |
+      """
+      
+      some
+      description
+      
+      """ foo
+    tokens:
+      -
+        kind: BLOCK_STRING
+        value: "some\ndescription"
+      -
+        kind: NAME
+        start: 27
+        end: 30
+        line: 6
+        column: 5
+        value: 'foo'
+
+lex reports useful block string errors:
+  - name: unterminated string
+    input: '"""'
+    error:
+      message: "Unterminated string."
+      locations: [{ line: 1, column: 4 }]
+
+  - name: unescaped control characters
+    input: "\"\"\"contains unescaped \u0007 control char\"\"\""
+    error:
+      message: 'Invalid character within String: "\u0007".'
+      locations: [{ line: 1, column: 23 }]
+
+  - name: null byte
+    input: "\"\"\"null-byte is not \u0000 end of file\"\"\""
+    error:
+      message: 'Invalid character within String: "\u0000".'
+      locations: [{ line: 1, column: 21 }]
+
+lexes numbers:
+  - name: integer
+    input: "4"
+    tokens:
+      -
+        kind: INT
+        start: 0
+        end: 1
+        value: '4'
+
+  - name: float
+    input: "4.123"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 5
+        value: '4.123'
+
+  - name: negative
+    input: "-4"
+    tokens:
+      -
+        kind: INT
+        start: 0
+        end: 2
+        value: '-4'
+
+  - name: nine
+    input: "9"
+    tokens:
+      -
+        kind: INT
+        start: 0
+        end: 1
+        value: '9'
+
+  - name: zero
+    input: "0"
+    tokens:
+      -
+        kind: INT
+        start: 0
+        end: 1
+        value: '0'
+
+  - name: negative float
+    input: "-4.123"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 6
+        value: '-4.123'
+
+  - name: float leading zero
+    input: "0.123"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 5
+        value: '0.123'
+
+  - name: exponent whole
+    input: "123e4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 5
+        value: '123e4'
+
+  - name: exponent uppercase
+    input: "123E4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 5
+        value: '123E4'
+
+  - name: exponent negative power
+    input: "123e-4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 6
+        value: '123e-4'
+
+  - name: exponent positive power
+    input: "123e+4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 6
+        value: '123e+4'
+
+  - name: exponent negative base
+    input: "-1.123e4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 8
+        value: '-1.123e4'
+
+  - name: exponent negative base upper
+    input: "-1.123E4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 8
+        value: '-1.123E4'
+
+  - name: exponent negative base negative power
+    input: "-1.123e-4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 9
+        value: '-1.123e-4'
+
+  - name: exponent negative base positive power
+    input: "-1.123e+4"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 9
+        value: '-1.123e+4'
+
+  - name: exponent negative base large power
+    input: "-1.123e4567"
+    tokens:
+      -
+        kind: FLOAT
+        start: 0
+        end: 11
+        value: '-1.123e4567'
+
+lex reports useful number errors:
+  - name: zero
+    input: "00"
+    error:
+      message: 'Invalid number, unexpected digit after 0: "0".'
+      locations: [{ line: 1, column: 2 }]
+
+  - name: positive
+    input: "+1"
+    error:
+      message: 'Cannot parse the unexpected character "+".'
+      locations: [{ line: 1, column: 1 }]
+
+  - name: trailing dot
+    input: "1."
+    error:
+      message: 'Invalid number, expected digit but got: <EOF>.'
+      locations: [{ line: 1, column: 3 }]
+
+  - name: traililng dot exponent
+    input: "1.e1"
+    error:
+      message: 'Invalid number, expected digit but got: "e".'
+      locations: [{ line: 1, column: 3 }]
+
+  - name: missing leading zero
+    input: ".123"
+    error:
+      message: 'Cannot parse the unexpected character ".".'
+      locations: [{ line: 1, column: 1 }]
+
+  - name: characters
+    input: "1.A"
+    error:
+      message: 'Invalid number, expected digit but got: "A".'
+      locations: [{ line: 1, column: 3 }]
+
+  - name: negative characters
+    input: "-A"
+    error:
+      message: 'Invalid number, expected digit but got: "A".'
+      locations: [{ line: 1, column: 2 }]
+
+  - name: missing exponent
+    input: '1.0e'
+    error:
+      message: 'Invalid number, expected digit but got: <EOF>.'
+      locations: [{ line: 1, column: 5 }]
+
+  - name: character exponent
+    input: "1.0eA"
+    error:
+      message: 'Invalid number, expected digit but got: "A".'
+      locations: [{ line: 1, column: 5 }]
+
+lexes punctuation:
+  - name: bang
+    input: "!"
+    tokens:
+      -
+        kind: BANG
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: dollar
+    input: "$"
+    tokens:
+      -
+        kind: DOLLAR
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: open paren
+    input: "("
+    tokens:
+      -
+        kind: PAREN_L
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: close paren
+    input: ")"
+    tokens:
+      -
+        kind: PAREN_R
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: spread
+    input: "..."
+    tokens:
+      -
+        kind: SPREAD
+        start: 0
+        end: 3
+        value: undefined
+
+  - name: colon
+    input: ":"
+    tokens:
+      -
+        kind: COLON
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: equals
+    input: "="
+    tokens:
+      -
+        kind: EQUALS
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: at
+    input: "@"
+    tokens:
+      -
+        kind: AT
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: open bracket
+    input: "["
+    tokens:
+      -
+        kind: BRACKET_L
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: close bracket
+    input: "]"
+    tokens:
+      -
+        kind: BRACKET_R
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: open brace
+    input: "{"
+    tokens:
+      -
+        kind: BRACE_L
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: close brace
+    input: "}"
+    tokens:
+      -
+        kind: BRACE_R
+        start: 0
+        end: 1
+        value: undefined
+
+  - name: pipe
+    input: "|"
+    tokens:
+      -
+        kind: PIPE
+        start: 0
+        end: 1
+        value: undefined
+
+lex reports useful unknown character error:
+  - name: not a spread
+    input: ".."
+    error:
+      message: 'Cannot parse the unexpected character ".".'
+      locations: [{ line: 1, column: 1 }]
+
+  - name: question mark
+    input: "?"
+    error:
+      message: 'Cannot parse the unexpected character "?".'
+      message: 'Cannot parse the unexpected character "?".'
+      locations: [{ line: 1, column: 1 }]
+
+  - name: unicode 203
+    input: "\u203B"
+    error:
+      message: 'Cannot parse the unexpected character "â".'
+      locations: [{ line: 1, column: 1 }]
+
+  - name: unicode 200
+    input: "\u200b"
+    error:
+      message: 'Cannot parse the unexpected character "â".'
+      locations: [{ line: 1, column: 1 }]
+
diff --git a/internal/gqlparser/lexer/token.go b/internal/gqlparser/lexer/token.go
new file mode 100644
index 0000000000..79eefd0f4e
--- /dev/null
+++ b/internal/gqlparser/lexer/token.go
@@ -0,0 +1,148 @@
+package lexer
+
+import (
+	"strconv"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+)
+
+const (
+	Invalid Type = iota
+	EOF
+	Bang
+	Dollar
+	Amp
+	ParenL
+	ParenR
+	Spread
+	Colon
+	Equals
+	At
+	BracketL
+	BracketR
+	BraceL
+	BraceR
+	Pipe
+	Name
+	Int
+	Float
+	String
+	BlockString
+	Comment
+)
+
+func (t Type) Name() string {
+	switch t {
+	case Invalid:
+		return "Invalid"
+	case EOF:
+		return "EOF"
+	case Bang:
+		return "Bang"
+	case Dollar:
+		return "Dollar"
+	case Amp:
+		return "Amp"
+	case ParenL:
+		return "ParenL"
+	case ParenR:
+		return "ParenR"
+	case Spread:
+		return "Spread"
+	case Colon:
+		return "Colon"
+	case Equals:
+		return "Equals"
+	case At:
+		return "At"
+	case BracketL:
+		return "BracketL"
+	case BracketR:
+		return "BracketR"
+	case BraceL:
+		return "BraceL"
+	case BraceR:
+		return "BraceR"
+	case Pipe:
+		return "Pipe"
+	case Name:
+		return "Name"
+	case Int:
+		return "Int"
+	case Float:
+		return "Float"
+	case String:
+		return "String"
+	case BlockString:
+		return "BlockString"
+	case Comment:
+		return "Comment"
+	}
+	return "Unknown " + strconv.Itoa(int(t))
+}
+
+func (t Type) String() string {
+	switch t {
+	case Invalid:
+		return "<Invalid>"
+	case EOF:
+		return "<EOF>"
+	case Bang:
+		return "!"
+	case Dollar:
+		return "$"
+	case Amp:
+		return "&"
+	case ParenL:
+		return "("
+	case ParenR:
+		return ")"
+	case Spread:
+		return "..."
+	case Colon:
+		return ":"
+	case Equals:
+		return "="
+	case At:
+		return "@"
+	case BracketL:
+		return "["
+	case BracketR:
+		return "]"
+	case BraceL:
+		return "{"
+	case BraceR:
+		return "}"
+	case Pipe:
+		return "|"
+	case Name:
+		return "Name"
+	case Int:
+		return "Int"
+	case Float:
+		return "Float"
+	case String:
+		return "String"
+	case BlockString:
+		return "BlockString"
+	case Comment:
+		return "Comment"
+	}
+	return "Unknown " + strconv.Itoa(int(t))
+}
+
+// Kind represents a type of token. The types are predefined as constants.
+type Type int
+
+type Token struct {
+	Kind  Type         // The token type.
+	Value string       // The literal value consumed.
+	Pos   ast.Position // The file and line this token was read from
+}
+
+func (t Token) String() string {
+	if t.Value != "" {
+		return t.Kind.String() + " " + strconv.Quote(t.Value)
+	}
+	return t.Kind.String()
+}
diff --git a/internal/gqlparser/parser/parser.go b/internal/gqlparser/parser/parser.go
new file mode 100644
index 0000000000..c0d2b4a3b7
--- /dev/null
+++ b/internal/gqlparser/parser/parser.go
@@ -0,0 +1,136 @@
+package parser
+
+import (
+	"strconv"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+	"github.com/open-policy-agent/opa/internal/gqlparser/lexer"
+)
+
+type parser struct {
+	lexer lexer.Lexer
+	err   error
+
+	peeked    bool
+	peekToken lexer.Token
+	peekError error
+
+	prev lexer.Token
+}
+
+func (p *parser) peekPos() *ast.Position {
+	if p.err != nil {
+		return nil
+	}
+
+	peek := p.peek()
+	return &peek.Pos
+}
+
+func (p *parser) peek() lexer.Token {
+	if p.err != nil {
+		return p.prev
+	}
+
+	if !p.peeked {
+		p.peekToken, p.peekError = p.lexer.ReadToken()
+		p.peeked = true
+	}
+
+	return p.peekToken
+}
+
+func (p *parser) error(tok lexer.Token, format string, args ...interface{}) {
+	if p.err != nil {
+		return
+	}
+	p.err = gqlerror.ErrorLocf(tok.Pos.Src.Name, tok.Pos.Line, tok.Pos.Column, format, args...)
+}
+
+func (p *parser) next() lexer.Token {
+	if p.err != nil {
+		return p.prev
+	}
+	if p.peeked {
+		p.peeked = false
+		p.prev, p.err = p.peekToken, p.peekError
+	} else {
+		p.prev, p.err = p.lexer.ReadToken()
+	}
+	return p.prev
+}
+
+func (p *parser) expectKeyword(value string) lexer.Token {
+	tok := p.peek()
+	if tok.Kind == lexer.Name && tok.Value == value {
+		return p.next()
+	}
+
+	p.error(tok, "Expected %s, found %s", strconv.Quote(value), tok.String())
+	return tok
+}
+
+func (p *parser) expect(kind lexer.Type) lexer.Token {
+	tok := p.peek()
+	if tok.Kind == kind {
+		return p.next()
+	}
+
+	p.error(tok, "Expected %s, found %s", kind, tok.Kind.String())
+	return tok
+}
+
+func (p *parser) skip(kind lexer.Type) bool {
+	if p.err != nil {
+		return false
+	}
+
+	tok := p.peek()
+
+	if tok.Kind != kind {
+		return false
+	}
+	p.next()
+	return true
+}
+
+func (p *parser) unexpectedError() {
+	p.unexpectedToken(p.peek())
+}
+
+func (p *parser) unexpectedToken(tok lexer.Token) {
+	p.error(tok, "Unexpected %s", tok.String())
+}
+
+func (p *parser) many(start lexer.Type, end lexer.Type, cb func()) {
+	hasDef := p.skip(start)
+	if !hasDef {
+		return
+	}
+
+	for p.peek().Kind != end && p.err == nil {
+		cb()
+	}
+	p.next()
+}
+
+func (p *parser) some(start lexer.Type, end lexer.Type, cb func()) {
+	hasDef := p.skip(start)
+	if !hasDef {
+		return
+	}
+
+	called := false
+	for p.peek().Kind != end && p.err == nil {
+		called = true
+		cb()
+	}
+
+	if !called {
+		p.error(p.peek(), "expected at least one definition, found %s", p.peek().Kind.String())
+		return
+	}
+
+	p.next()
+}
diff --git a/internal/gqlparser/parser/query.go b/internal/gqlparser/parser/query.go
new file mode 100644
index 0000000000..319425f587
--- /dev/null
+++ b/internal/gqlparser/parser/query.go
@@ -0,0 +1,349 @@
+package parser
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/lexer"
+
+	//nolint:revive
+	. "github.com/open-policy-agent/opa/internal/gqlparser/ast"
+)
+
+func ParseQuery(source *Source) (*QueryDocument, error) {
+	p := parser{
+		lexer: lexer.New(source),
+	}
+	return p.parseQueryDocument(), p.err
+}
+
+func (p *parser) parseQueryDocument() *QueryDocument {
+	var doc QueryDocument
+	for p.peek().Kind != lexer.EOF {
+		if p.err != nil {
+			return &doc
+		}
+		doc.Position = p.peekPos()
+		switch p.peek().Kind {
+		case lexer.Name:
+			switch p.peek().Value {
+			case "query", "mutation", "subscription":
+				doc.Operations = append(doc.Operations, p.parseOperationDefinition())
+			case "fragment":
+				doc.Fragments = append(doc.Fragments, p.parseFragmentDefinition())
+			default:
+				p.unexpectedError()
+			}
+		case lexer.BraceL:
+			doc.Operations = append(doc.Operations, p.parseOperationDefinition())
+		default:
+			p.unexpectedError()
+		}
+	}
+
+	return &doc
+}
+
+func (p *parser) parseOperationDefinition() *OperationDefinition {
+	if p.peek().Kind == lexer.BraceL {
+		return &OperationDefinition{
+			Position:     p.peekPos(),
+			Operation:    Query,
+			SelectionSet: p.parseRequiredSelectionSet(),
+		}
+	}
+
+	var od OperationDefinition
+	od.Position = p.peekPos()
+	od.Operation = p.parseOperationType()
+
+	if p.peek().Kind == lexer.Name {
+		od.Name = p.next().Value
+	}
+
+	od.VariableDefinitions = p.parseVariableDefinitions()
+	od.Directives = p.parseDirectives(false)
+	od.SelectionSet = p.parseRequiredSelectionSet()
+
+	return &od
+}
+
+func (p *parser) parseOperationType() Operation {
+	tok := p.next()
+	switch tok.Value {
+	case "query":
+		return Query
+	case "mutation":
+		return Mutation
+	case "subscription":
+		return Subscription
+	}
+	p.unexpectedToken(tok)
+	return ""
+}
+
+func (p *parser) parseVariableDefinitions() VariableDefinitionList {
+	var defs []*VariableDefinition
+	p.many(lexer.ParenL, lexer.ParenR, func() {
+		defs = append(defs, p.parseVariableDefinition())
+	})
+
+	return defs
+}
+
+func (p *parser) parseVariableDefinition() *VariableDefinition {
+	var def VariableDefinition
+	def.Position = p.peekPos()
+	def.Variable = p.parseVariable()
+
+	p.expect(lexer.Colon)
+
+	def.Type = p.parseTypeReference()
+
+	if p.skip(lexer.Equals) {
+		def.DefaultValue = p.parseValueLiteral(true)
+	}
+
+	def.Directives = p.parseDirectives(false)
+
+	return &def
+}
+
+func (p *parser) parseVariable() string {
+	p.expect(lexer.Dollar)
+	return p.parseName()
+}
+
+func (p *parser) parseOptionalSelectionSet() SelectionSet {
+	var selections []Selection
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		selections = append(selections, p.parseSelection())
+	})
+
+	return SelectionSet(selections)
+}
+
+func (p *parser) parseRequiredSelectionSet() SelectionSet {
+	if p.peek().Kind != lexer.BraceL {
+		p.error(p.peek(), "Expected %s, found %s", lexer.BraceL, p.peek().Kind.String())
+		return nil
+	}
+
+	var selections []Selection
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		selections = append(selections, p.parseSelection())
+	})
+
+	return SelectionSet(selections)
+}
+
+func (p *parser) parseSelection() Selection {
+	if p.peek().Kind == lexer.Spread {
+		return p.parseFragment()
+	}
+	return p.parseField()
+}
+
+func (p *parser) parseField() *Field {
+	var field Field
+	field.Position = p.peekPos()
+	field.Alias = p.parseName()
+
+	if p.skip(lexer.Colon) {
+		field.Name = p.parseName()
+	} else {
+		field.Name = field.Alias
+	}
+
+	field.Arguments = p.parseArguments(false)
+	field.Directives = p.parseDirectives(false)
+	if p.peek().Kind == lexer.BraceL {
+		field.SelectionSet = p.parseOptionalSelectionSet()
+	}
+
+	return &field
+}
+
+func (p *parser) parseArguments(isConst bool) ArgumentList {
+	var arguments ArgumentList
+	p.many(lexer.ParenL, lexer.ParenR, func() {
+		arguments = append(arguments, p.parseArgument(isConst))
+	})
+
+	return arguments
+}
+
+func (p *parser) parseArgument(isConst bool) *Argument {
+	arg := Argument{}
+	arg.Position = p.peekPos()
+	arg.Name = p.parseName()
+	p.expect(lexer.Colon)
+
+	arg.Value = p.parseValueLiteral(isConst)
+	return &arg
+}
+
+func (p *parser) parseFragment() Selection {
+	p.expect(lexer.Spread)
+
+	if peek := p.peek(); peek.Kind == lexer.Name && peek.Value != "on" {
+		return &FragmentSpread{
+			Position:   p.peekPos(),
+			Name:       p.parseFragmentName(),
+			Directives: p.parseDirectives(false),
+		}
+	}
+
+	var def InlineFragment
+	def.Position = p.peekPos()
+	if p.peek().Value == "on" {
+		p.next() // "on"
+
+		def.TypeCondition = p.parseName()
+	}
+
+	def.Directives = p.parseDirectives(false)
+	def.SelectionSet = p.parseRequiredSelectionSet()
+	return &def
+}
+
+func (p *parser) parseFragmentDefinition() *FragmentDefinition {
+	var def FragmentDefinition
+	def.Position = p.peekPos()
+	p.expectKeyword("fragment")
+
+	def.Name = p.parseFragmentName()
+	def.VariableDefinition = p.parseVariableDefinitions()
+
+	p.expectKeyword("on")
+
+	def.TypeCondition = p.parseName()
+	def.Directives = p.parseDirectives(false)
+	def.SelectionSet = p.parseRequiredSelectionSet()
+	return &def
+}
+
+func (p *parser) parseFragmentName() string {
+	if p.peek().Value == "on" {
+		p.unexpectedError()
+		return ""
+	}
+
+	return p.parseName()
+}
+
+func (p *parser) parseValueLiteral(isConst bool) *Value {
+	token := p.peek()
+
+	var kind ValueKind
+	switch token.Kind {
+	case lexer.BracketL:
+		return p.parseList(isConst)
+	case lexer.BraceL:
+		return p.parseObject(isConst)
+	case lexer.Dollar:
+		if isConst {
+			p.unexpectedError()
+			return nil
+		}
+		return &Value{Position: &token.Pos, Raw: p.parseVariable(), Kind: Variable}
+	case lexer.Int:
+		kind = IntValue
+	case lexer.Float:
+		kind = FloatValue
+	case lexer.String:
+		kind = StringValue
+	case lexer.BlockString:
+		kind = BlockValue
+	case lexer.Name:
+		switch token.Value {
+		case "true", "false":
+			kind = BooleanValue
+		case "null":
+			kind = NullValue
+		default:
+			kind = EnumValue
+		}
+	default:
+		p.unexpectedError()
+		return nil
+	}
+
+	p.next()
+
+	return &Value{Position: &token.Pos, Raw: token.Value, Kind: kind}
+}
+
+func (p *parser) parseList(isConst bool) *Value {
+	var values ChildValueList
+	pos := p.peekPos()
+	p.many(lexer.BracketL, lexer.BracketR, func() {
+		values = append(values, &ChildValue{Value: p.parseValueLiteral(isConst)})
+	})
+
+	return &Value{Children: values, Kind: ListValue, Position: pos}
+}
+
+func (p *parser) parseObject(isConst bool) *Value {
+	var fields ChildValueList
+	pos := p.peekPos()
+	p.many(lexer.BraceL, lexer.BraceR, func() {
+		fields = append(fields, p.parseObjectField(isConst))
+	})
+
+	return &Value{Children: fields, Kind: ObjectValue, Position: pos}
+}
+
+func (p *parser) parseObjectField(isConst bool) *ChildValue {
+	field := ChildValue{}
+	field.Position = p.peekPos()
+	field.Name = p.parseName()
+
+	p.expect(lexer.Colon)
+
+	field.Value = p.parseValueLiteral(isConst)
+	return &field
+}
+
+func (p *parser) parseDirectives(isConst bool) []*Directive {
+	var directives []*Directive
+
+	for p.peek().Kind == lexer.At {
+		if p.err != nil {
+			break
+		}
+		directives = append(directives, p.parseDirective(isConst))
+	}
+	return directives
+}
+
+func (p *parser) parseDirective(isConst bool) *Directive {
+	p.expect(lexer.At)
+
+	return &Directive{
+		Position:  p.peekPos(),
+		Name:      p.parseName(),
+		Arguments: p.parseArguments(isConst),
+	}
+}
+
+func (p *parser) parseTypeReference() *Type {
+	var typ Type
+
+	if p.skip(lexer.BracketL) {
+		typ.Position = p.peekPos()
+		typ.Elem = p.parseTypeReference()
+		p.expect(lexer.BracketR)
+	} else {
+		typ.Position = p.peekPos()
+		typ.NamedType = p.parseName()
+	}
+
+	if p.skip(lexer.Bang) {
+		typ.NonNull = true
+	}
+	return &typ
+}
+
+func (p *parser) parseName() string {
+	token := p.expect(lexer.Name)
+
+	return token.Value
+}
diff --git a/internal/gqlparser/parser/query_test.yml b/internal/gqlparser/parser/query_test.yml
new file mode 100644
index 0000000000..a46a01e718
--- /dev/null
+++ b/internal/gqlparser/parser/query_test.yml
@@ -0,0 +1,544 @@
+parser provides useful errors:
+  - name: unclosed paren
+    input: '{'
+    error:
+      message: "Expected Name, found <EOF>"
+      locations: [{line: 1, column: 2}]
+
+  - name: missing on in fragment
+    input: |
+      { ...MissingOn }
+      fragment MissingOn Type
+    error:
+      message: 'Expected "on", found Name "Type"'
+      locations: [{ line: 2, column: 20 }]
+
+  - name: missing name after alias
+    input: '{ field: {} }'
+    error:
+      message: "Expected Name, found {"
+      locations: [{ line: 1, column: 10 }]
+
+  - name: not an operation
+    input: 'notanoperation Foo { field }'
+    error:
+      message: 'Unexpected Name "notanoperation"'
+      locations: [{ line: 1, column: 1 }]
+
+  - name: a wild splat appears
+    input: '...'
+    error:
+      message: 'Unexpected ...'
+      locations: [{ line: 1, column: 1}]
+
+variables:
+  - name: are allowed in args
+    input: '{ field(complex: { a: { b: [ $var ] } }) }'
+
+  - name: are not allowed in default args
+    input: 'query Foo($x: Complex = { a: { b: [ $var ] } }) { field }'
+    error:
+      message: 'Unexpected $'
+      locations: [{ line: 1, column: 37 }]
+
+  - name: can have directives
+    input: 'query ($withDirective: String @first @second, $withoutDirective: String) { f }'
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            VariableDefinitions: [VariableDefinition]
+            - <VariableDefinition>
+                Variable: "withDirective"
+                Type: String
+                Directives: [Directive]
+                - <Directive>
+                    Name: "first"
+                - <Directive>
+                    Name: "second"
+            - <VariableDefinition>
+                Variable: "withoutDirective"
+                Type: String
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "f"
+                Name: "f"
+
+fragments:
+  - name: can not be named 'on'
+    input: 'fragment on on on { on }'
+    error:
+      message: 'Unexpected Name "on"'
+      locations: [{ line: 1, column: 10 }]
+
+  - name: can not spread fragments called 'on'
+    input: '{ ...on }'
+    error:
+      message: 'Expected Name, found }'
+      locations: [{ line: 1, column: 9 }]
+
+encoding:
+  - name: multibyte characters are supported
+    input: |
+      # This comment has a ਊ multi-byte character.
+      { field(arg: "Has a ਊ multi-byte character.") }
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "field"
+                Name: "field"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "arg"
+                    Value: "Has a ਊ multi-byte character."
+
+keywords are allowed anywhere a name is:
+  - name: on
+    input: |
+      query on {
+        ... a
+        ... on on { field }
+      }
+      fragment a on Type {
+        on(on: $on)
+          @on(on: on)
+      }
+
+  - name: subscription
+    input: |
+      query subscription {
+        ... subscription
+        ... on subscription { field }
+      }
+      fragment subscription on Type {
+        subscription(subscription: $subscription)
+          @subscription(subscription: subscription)
+      }
+
+  - name: true
+    input: |
+      query true {
+        ... true
+        ... on true { field }
+      }
+      fragment true on Type {
+        true(true: $true)
+          @true(true: true)
+      }
+
+operations:
+  - name: anonymous mutation
+    input: 'mutation { mutationField }'
+
+  - name: named mutation
+    input: 'mutation Foo { mutationField }'
+
+  - name: anonymous subscription
+    input: 'subscription { subscriptionField }'
+
+  - name: named subscription
+    input: 'subscription Foo { subscriptionField }'
+
+
+ast:
+  - name: simple query
+    input: |
+      {
+        node(id: 4) {
+          id,
+          name
+        }
+      }
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "node"
+                Name: "node"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "id"
+                    Value: 4
+                SelectionSet: [Selection]
+                - <Field>
+                    Alias: "id"
+                    Name: "id"
+                - <Field>
+                    Alias: "name"
+                    Name: "name"
+
+  - name: nameless query with no variables
+    input: |
+      query {
+        node {
+          id
+        }
+      }
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "node"
+                Name: "node"
+                SelectionSet: [Selection]
+                - <Field>
+                    Alias: "id"
+                    Name: "id"
+
+  - name: fragment defined variables
+    input: 'fragment a($v: Boolean = false) on t { f(v: $v) }'
+    ast: |
+      <QueryDocument>
+        Fragments: [FragmentDefinition]
+        - <FragmentDefinition>
+            Name: "a"
+            VariableDefinition: [VariableDefinition]
+            - <VariableDefinition>
+                Variable: "v"
+                Type: Boolean
+                DefaultValue: false
+            TypeCondition: "t"
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "f"
+                Name: "f"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "v"
+                    Value: $v
+
+
+values:
+  - name: null
+    input: '{ f(id: null) }'
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "f"
+                Name: "f"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "id"
+                    Value: null
+
+  - name: strings
+    input: '{ f(long: """long""", short: "short") } '
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "f"
+                Name: "f"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "long"
+                    Value: "long"
+                - <Argument>
+                    Name: "short"
+                    Value: "short"
+
+  - name: list
+    input: '{ f(id: [1,2]) }'
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "f"
+                Name: "f"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "id"
+                    Value: [1,2]
+
+types:
+  - name: common types
+    input: 'query ($string: String, $int: Int, $arr: [Arr], $notnull: [Arr!]!) { f }'
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            VariableDefinitions: [VariableDefinition]
+            - <VariableDefinition>
+                Variable: "string"
+                Type: String
+            - <VariableDefinition>
+                Variable: "int"
+                Type: Int
+            - <VariableDefinition>
+                Variable: "arr"
+                Type: [Arr]
+            - <VariableDefinition>
+                Variable: "notnull"
+                Type: [Arr!]!
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "f"
+                Name: "f"
+
+large queries:
+  - name: kitchen sink
+    input: |
+      # Copyright (c) 2015-present, Facebook, Inc.
+      #
+      # This source code is licensed under the MIT license found in the
+      # LICENSE file in the root directory of this source tree.
+
+      query queryName($foo: ComplexType, $site: Site = MOBILE) {
+        whoever123is: node(id: [123, 456]) {
+          id ,
+          ... on User @defer {
+            field2 {
+              id ,
+              alias: field1(first:10, after:$foo,) @include(if: $foo) {
+                id,
+                ...frag
+              }
+            }
+          }
+          ... @skip(unless: $foo) {
+            id
+          }
+          ... {
+            id
+          }
+        }
+      }
+
+      mutation likeStory {
+        like(story: 123) @defer {
+          story {
+            id
+          }
+        }
+      }
+
+      subscription StoryLikeSubscription($input: StoryLikeSubscribeInput) {
+        storyLikeSubscribe(input: $input) {
+          story {
+            likers {
+              count
+            }
+            likeSentence {
+              text
+            }
+          }
+        }
+      }
+
+      fragment frag on Friend {
+        foo(size: $size, bar: $b, obj: {key: "value", block: """
+            block string uses \"""
+        """})
+      }
+
+      {
+        unnamed(truthy: true, falsey: false, nullish: null),
+        query
+      }
+    ast: |
+      <QueryDocument>
+        Operations: [OperationDefinition]
+        - <OperationDefinition>
+            Operation: Operation("query")
+            Name: "queryName"
+            VariableDefinitions: [VariableDefinition]
+            - <VariableDefinition>
+                Variable: "foo"
+                Type: ComplexType
+            - <VariableDefinition>
+                Variable: "site"
+                Type: Site
+                DefaultValue: MOBILE
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "whoever123is"
+                Name: "node"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "id"
+                    Value: [123,456]
+                SelectionSet: [Selection]
+                - <Field>
+                    Alias: "id"
+                    Name: "id"
+                - <InlineFragment>
+                    TypeCondition: "User"
+                    Directives: [Directive]
+                    - <Directive>
+                        Name: "defer"
+                    SelectionSet: [Selection]
+                    - <Field>
+                        Alias: "field2"
+                        Name: "field2"
+                        SelectionSet: [Selection]
+                        - <Field>
+                            Alias: "id"
+                            Name: "id"
+                        - <Field>
+                            Alias: "alias"
+                            Name: "field1"
+                            Arguments: [Argument]
+                            - <Argument>
+                                Name: "first"
+                                Value: 10
+                            - <Argument>
+                                Name: "after"
+                                Value: $foo
+                            Directives: [Directive]
+                            - <Directive>
+                                Name: "include"
+                                Arguments: [Argument]
+                                - <Argument>
+                                    Name: "if"
+                                    Value: $foo
+                            SelectionSet: [Selection]
+                            - <Field>
+                                Alias: "id"
+                                Name: "id"
+                            - <FragmentSpread>
+                                Name: "frag"
+                - <InlineFragment>
+                    Directives: [Directive]
+                    - <Directive>
+                        Name: "skip"
+                        Arguments: [Argument]
+                        - <Argument>
+                            Name: "unless"
+                            Value: $foo
+                    SelectionSet: [Selection]
+                    - <Field>
+                        Alias: "id"
+                        Name: "id"
+                - <InlineFragment>
+                    SelectionSet: [Selection]
+                    - <Field>
+                        Alias: "id"
+                        Name: "id"
+        - <OperationDefinition>
+            Operation: Operation("mutation")
+            Name: "likeStory"
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "like"
+                Name: "like"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "story"
+                    Value: 123
+                Directives: [Directive]
+                - <Directive>
+                    Name: "defer"
+                SelectionSet: [Selection]
+                - <Field>
+                    Alias: "story"
+                    Name: "story"
+                    SelectionSet: [Selection]
+                    - <Field>
+                        Alias: "id"
+                        Name: "id"
+        - <OperationDefinition>
+            Operation: Operation("subscription")
+            Name: "StoryLikeSubscription"
+            VariableDefinitions: [VariableDefinition]
+            - <VariableDefinition>
+                Variable: "input"
+                Type: StoryLikeSubscribeInput
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "storyLikeSubscribe"
+                Name: "storyLikeSubscribe"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "input"
+                    Value: $input
+                SelectionSet: [Selection]
+                - <Field>
+                    Alias: "story"
+                    Name: "story"
+                    SelectionSet: [Selection]
+                    - <Field>
+                        Alias: "likers"
+                        Name: "likers"
+                        SelectionSet: [Selection]
+                        - <Field>
+                            Alias: "count"
+                            Name: "count"
+                    - <Field>
+                        Alias: "likeSentence"
+                        Name: "likeSentence"
+                        SelectionSet: [Selection]
+                        - <Field>
+                            Alias: "text"
+                            Name: "text"
+        - <OperationDefinition>
+            Operation: Operation("query")
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "unnamed"
+                Name: "unnamed"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "truthy"
+                    Value: true
+                - <Argument>
+                    Name: "falsey"
+                    Value: false
+                - <Argument>
+                    Name: "nullish"
+                    Value: null
+            - <Field>
+                Alias: "query"
+                Name: "query"
+        Fragments: [FragmentDefinition]
+        - <FragmentDefinition>
+            Name: "frag"
+            TypeCondition: "Friend"
+            SelectionSet: [Selection]
+            - <Field>
+                Alias: "foo"
+                Name: "foo"
+                Arguments: [Argument]
+                - <Argument>
+                    Name: "size"
+                    Value: $size
+                - <Argument>
+                    Name: "bar"
+                    Value: $b
+                - <Argument>
+                    Name: "obj"
+                    Value: {key:"value",block:"block string uses \"\"\""}
+
+fuzzer:
+- name: 01
+  input: '{__typename{...}}'
+  error:
+    message: 'Expected {, found }'
+    locations: [{ line: 1, column: 16 }]
+
+- name: 02
+  input: '{...{__typename{...{}}}}'
+  error:
+    message: 'expected at least one definition, found }'
+    locations: [{ line: 1, column: 21 }]
diff --git a/internal/gqlparser/parser/schema.go b/internal/gqlparser/parser/schema.go
new file mode 100644
index 0000000000..32c293399b
--- /dev/null
+++ b/internal/gqlparser/parser/schema.go
@@ -0,0 +1,535 @@
+package parser
+
+import (
+	//nolint:revive
+	. "github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/lexer"
+)
+
+func ParseSchema(source *Source) (*SchemaDocument, error) {
+	p := parser{
+		lexer: lexer.New(source),
+	}
+	ast, err := p.parseSchemaDocument(), p.err
+	if err != nil {
+		return nil, err
+	}
+
+	for _, def := range ast.Definitions {
+		def.BuiltIn = source.BuiltIn
+	}
+	for _, def := range ast.Extensions {
+		def.BuiltIn = source.BuiltIn
+	}
+
+	return ast, nil
+}
+
+func ParseSchemas(inputs ...*Source) (*SchemaDocument, error) {
+	ast := &SchemaDocument{}
+	for _, input := range inputs {
+		inputAst, err := ParseSchema(input)
+		if err != nil {
+			return nil, err
+		}
+		ast.Merge(inputAst)
+	}
+	return ast, nil
+}
+
+func (p *parser) parseSchemaDocument() *SchemaDocument {
+	var doc SchemaDocument
+	doc.Position = p.peekPos()
+	for p.peek().Kind != lexer.EOF {
+		if p.err != nil {
+			return nil
+		}
+
+		var description string
+		if p.peek().Kind == lexer.BlockString || p.peek().Kind == lexer.String {
+			description = p.parseDescription()
+		}
+
+		if p.peek().Kind != lexer.Name {
+			p.unexpectedError()
+			break
+		}
+
+		switch p.peek().Value {
+		case "scalar", "type", "interface", "union", "enum", "input":
+			doc.Definitions = append(doc.Definitions, p.parseTypeSystemDefinition(description))
+		case "schema":
+			doc.Schema = append(doc.Schema, p.parseSchemaDefinition(description))
+		case "directive":
+			doc.Directives = append(doc.Directives, p.parseDirectiveDefinition(description))
+		case "extend":
+			if description != "" {
+				p.unexpectedToken(p.prev)
+			}
+			p.parseTypeSystemExtension(&doc)
+		default:
+			p.unexpectedError()
+			return nil
+		}
+	}
+
+	return &doc
+}
+
+func (p *parser) parseDescription() string {
+	token := p.peek()
+
+	if token.Kind != lexer.BlockString && token.Kind != lexer.String {
+		return ""
+	}
+
+	return p.next().Value
+}
+
+func (p *parser) parseTypeSystemDefinition(description string) *Definition {
+	tok := p.peek()
+	if tok.Kind != lexer.Name {
+		p.unexpectedError()
+		return nil
+	}
+
+	switch tok.Value {
+	case "scalar":
+		return p.parseScalarTypeDefinition(description)
+	case "type":
+		return p.parseObjectTypeDefinition(description)
+	case "interface":
+		return p.parseInterfaceTypeDefinition(description)
+	case "union":
+		return p.parseUnionTypeDefinition(description)
+	case "enum":
+		return p.parseEnumTypeDefinition(description)
+	case "input":
+		return p.parseInputObjectTypeDefinition(description)
+	default:
+		p.unexpectedError()
+		return nil
+	}
+}
+
+func (p *parser) parseSchemaDefinition(description string) *SchemaDefinition {
+	p.expectKeyword("schema")
+
+	def := SchemaDefinition{Description: description}
+	def.Position = p.peekPos()
+	def.Description = description
+	def.Directives = p.parseDirectives(true)
+
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		def.OperationTypes = append(def.OperationTypes, p.parseOperationTypeDefinition())
+	})
+	return &def
+}
+
+func (p *parser) parseOperationTypeDefinition() *OperationTypeDefinition {
+	var op OperationTypeDefinition
+	op.Position = p.peekPos()
+	op.Operation = p.parseOperationType()
+	p.expect(lexer.Colon)
+	op.Type = p.parseName()
+	return &op
+}
+
+func (p *parser) parseScalarTypeDefinition(description string) *Definition {
+	p.expectKeyword("scalar")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Scalar
+	def.Description = description
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	return &def
+}
+
+func (p *parser) parseObjectTypeDefinition(description string) *Definition {
+	p.expectKeyword("type")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Object
+	def.Description = description
+	def.Name = p.parseName()
+	def.Interfaces = p.parseImplementsInterfaces()
+	def.Directives = p.parseDirectives(true)
+	def.Fields = p.parseFieldsDefinition()
+	return &def
+}
+
+func (p *parser) parseImplementsInterfaces() []string {
+	var types []string
+	if p.peek().Value == "implements" {
+		p.next()
+		// optional leading ampersand
+		p.skip(lexer.Amp)
+
+		types = append(types, p.parseName())
+		for p.skip(lexer.Amp) && p.err == nil {
+			types = append(types, p.parseName())
+		}
+	}
+	return types
+}
+
+func (p *parser) parseFieldsDefinition() FieldList {
+	var defs FieldList
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		defs = append(defs, p.parseFieldDefinition())
+	})
+	return defs
+}
+
+func (p *parser) parseFieldDefinition() *FieldDefinition {
+	var def FieldDefinition
+	def.Position = p.peekPos()
+	def.Description = p.parseDescription()
+	def.Name = p.parseName()
+	def.Arguments = p.parseArgumentDefs()
+	p.expect(lexer.Colon)
+	def.Type = p.parseTypeReference()
+	def.Directives = p.parseDirectives(true)
+
+	return &def
+}
+
+func (p *parser) parseArgumentDefs() ArgumentDefinitionList {
+	var args ArgumentDefinitionList
+	p.some(lexer.ParenL, lexer.ParenR, func() {
+		args = append(args, p.parseArgumentDef())
+	})
+	return args
+}
+
+func (p *parser) parseArgumentDef() *ArgumentDefinition {
+	var def ArgumentDefinition
+	def.Position = p.peekPos()
+	def.Description = p.parseDescription()
+	def.Name = p.parseName()
+	p.expect(lexer.Colon)
+	def.Type = p.parseTypeReference()
+	if p.skip(lexer.Equals) {
+		def.DefaultValue = p.parseValueLiteral(true)
+	}
+	def.Directives = p.parseDirectives(true)
+	return &def
+}
+
+func (p *parser) parseInputValueDef() *FieldDefinition {
+	var def FieldDefinition
+	def.Position = p.peekPos()
+	def.Description = p.parseDescription()
+	def.Name = p.parseName()
+	p.expect(lexer.Colon)
+	def.Type = p.parseTypeReference()
+	if p.skip(lexer.Equals) {
+		def.DefaultValue = p.parseValueLiteral(true)
+	}
+	def.Directives = p.parseDirectives(true)
+	return &def
+}
+
+func (p *parser) parseInterfaceTypeDefinition(description string) *Definition {
+	p.expectKeyword("interface")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Interface
+	def.Description = description
+	def.Name = p.parseName()
+	def.Interfaces = p.parseImplementsInterfaces()
+	def.Directives = p.parseDirectives(true)
+	def.Fields = p.parseFieldsDefinition()
+	return &def
+}
+
+func (p *parser) parseUnionTypeDefinition(description string) *Definition {
+	p.expectKeyword("union")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Union
+	def.Description = description
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	def.Types = p.parseUnionMemberTypes()
+	return &def
+}
+
+func (p *parser) parseUnionMemberTypes() []string {
+	var types []string
+	if p.skip(lexer.Equals) {
+		// optional leading pipe
+		p.skip(lexer.Pipe)
+
+		types = append(types, p.parseName())
+		for p.skip(lexer.Pipe) && p.err == nil {
+			types = append(types, p.parseName())
+		}
+	}
+	return types
+}
+
+func (p *parser) parseEnumTypeDefinition(description string) *Definition {
+	p.expectKeyword("enum")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Enum
+	def.Description = description
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	def.EnumValues = p.parseEnumValuesDefinition()
+	return &def
+}
+
+func (p *parser) parseEnumValuesDefinition() EnumValueList {
+	var values EnumValueList
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		values = append(values, p.parseEnumValueDefinition())
+	})
+	return values
+}
+
+func (p *parser) parseEnumValueDefinition() *EnumValueDefinition {
+	return &EnumValueDefinition{
+		Position:    p.peekPos(),
+		Description: p.parseDescription(),
+		Name:        p.parseName(),
+		Directives:  p.parseDirectives(true),
+	}
+}
+
+func (p *parser) parseInputObjectTypeDefinition(description string) *Definition {
+	p.expectKeyword("input")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = InputObject
+	def.Description = description
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	def.Fields = p.parseInputFieldsDefinition()
+	return &def
+}
+
+func (p *parser) parseInputFieldsDefinition() FieldList {
+	var values FieldList
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		values = append(values, p.parseInputValueDef())
+	})
+	return values
+}
+
+func (p *parser) parseTypeSystemExtension(doc *SchemaDocument) {
+	p.expectKeyword("extend")
+
+	switch p.peek().Value {
+	case "schema":
+		doc.SchemaExtension = append(doc.SchemaExtension, p.parseSchemaExtension())
+	case "scalar":
+		doc.Extensions = append(doc.Extensions, p.parseScalarTypeExtension())
+	case "type":
+		doc.Extensions = append(doc.Extensions, p.parseObjectTypeExtension())
+	case "interface":
+		doc.Extensions = append(doc.Extensions, p.parseInterfaceTypeExtension())
+	case "union":
+		doc.Extensions = append(doc.Extensions, p.parseUnionTypeExtension())
+	case "enum":
+		doc.Extensions = append(doc.Extensions, p.parseEnumTypeExtension())
+	case "input":
+		doc.Extensions = append(doc.Extensions, p.parseInputObjectTypeExtension())
+	default:
+		p.unexpectedError()
+	}
+}
+
+func (p *parser) parseSchemaExtension() *SchemaDefinition {
+	p.expectKeyword("schema")
+
+	var def SchemaDefinition
+	def.Position = p.peekPos()
+	def.Directives = p.parseDirectives(true)
+	p.some(lexer.BraceL, lexer.BraceR, func() {
+		def.OperationTypes = append(def.OperationTypes, p.parseOperationTypeDefinition())
+	})
+	if len(def.Directives) == 0 && len(def.OperationTypes) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseScalarTypeExtension() *Definition {
+	p.expectKeyword("scalar")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Scalar
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	if len(def.Directives) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseObjectTypeExtension() *Definition {
+	p.expectKeyword("type")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Object
+	def.Name = p.parseName()
+	def.Interfaces = p.parseImplementsInterfaces()
+	def.Directives = p.parseDirectives(true)
+	def.Fields = p.parseFieldsDefinition()
+	if len(def.Interfaces) == 0 && len(def.Directives) == 0 && len(def.Fields) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseInterfaceTypeExtension() *Definition {
+	p.expectKeyword("interface")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Interface
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	def.Fields = p.parseFieldsDefinition()
+	if len(def.Directives) == 0 && len(def.Fields) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseUnionTypeExtension() *Definition {
+	p.expectKeyword("union")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Union
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	def.Types = p.parseUnionMemberTypes()
+
+	if len(def.Directives) == 0 && len(def.Types) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseEnumTypeExtension() *Definition {
+	p.expectKeyword("enum")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = Enum
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(true)
+	def.EnumValues = p.parseEnumValuesDefinition()
+	if len(def.Directives) == 0 && len(def.EnumValues) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseInputObjectTypeExtension() *Definition {
+	p.expectKeyword("input")
+
+	var def Definition
+	def.Position = p.peekPos()
+	def.Kind = InputObject
+	def.Name = p.parseName()
+	def.Directives = p.parseDirectives(false)
+	def.Fields = p.parseInputFieldsDefinition()
+	if len(def.Directives) == 0 && len(def.Fields) == 0 {
+		p.unexpectedError()
+	}
+	return &def
+}
+
+func (p *parser) parseDirectiveDefinition(description string) *DirectiveDefinition {
+	p.expectKeyword("directive")
+	p.expect(lexer.At)
+
+	var def DirectiveDefinition
+	def.Position = p.peekPos()
+	def.Description = description
+	def.Name = p.parseName()
+	def.Arguments = p.parseArgumentDefs()
+
+	if peek := p.peek(); peek.Kind == lexer.Name && peek.Value == "repeatable" {
+		def.IsRepeatable = true
+		p.skip(lexer.Name)
+	}
+
+	p.expectKeyword("on")
+	def.Locations = p.parseDirectiveLocations()
+	return &def
+}
+
+func (p *parser) parseDirectiveLocations() []DirectiveLocation {
+	p.skip(lexer.Pipe)
+
+	locations := []DirectiveLocation{p.parseDirectiveLocation()}
+
+	for p.skip(lexer.Pipe) && p.err == nil {
+		locations = append(locations, p.parseDirectiveLocation())
+	}
+
+	return locations
+}
+
+func (p *parser) parseDirectiveLocation() DirectiveLocation {
+	name := p.expect(lexer.Name)
+
+	switch name.Value {
+	case `QUERY`:
+		return LocationQuery
+	case `MUTATION`:
+		return LocationMutation
+	case `SUBSCRIPTION`:
+		return LocationSubscription
+	case `FIELD`:
+		return LocationField
+	case `FRAGMENT_DEFINITION`:
+		return LocationFragmentDefinition
+	case `FRAGMENT_SPREAD`:
+		return LocationFragmentSpread
+	case `INLINE_FRAGMENT`:
+		return LocationInlineFragment
+	case `VARIABLE_DEFINITION`:
+		return LocationVariableDefinition
+	case `SCHEMA`:
+		return LocationSchema
+	case `SCALAR`:
+		return LocationScalar
+	case `OBJECT`:
+		return LocationObject
+	case `FIELD_DEFINITION`:
+		return LocationFieldDefinition
+	case `ARGUMENT_DEFINITION`:
+		return LocationArgumentDefinition
+	case `INTERFACE`:
+		return LocationInterface
+	case `UNION`:
+		return LocationUnion
+	case `ENUM`:
+		return LocationEnum
+	case `ENUM_VALUE`:
+		return LocationEnumValue
+	case `INPUT_OBJECT`:
+		return LocationInputObject
+	case `INPUT_FIELD_DEFINITION`:
+		return LocationInputFieldDefinition
+	}
+
+	p.unexpectedToken(name)
+	return ""
+}
diff --git a/internal/gqlparser/parser/schema_test.yml b/internal/gqlparser/parser/schema_test.yml
new file mode 100644
index 0000000000..8b6a5d0ca3
--- /dev/null
+++ b/internal/gqlparser/parser/schema_test.yml
@@ -0,0 +1,646 @@
+object types:
+  - name: simple
+    input: |
+      type Hello {
+        world: String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Type: String
+
+  - name: with description
+    input: |
+      "Description"
+      type Hello {
+        world: String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Description: "Description"
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Type: String
+
+  - name: with block description
+    input: |
+      """
+      Description
+      """
+      # Even with comments between them
+      type Hello {
+        world: String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Description: "Description"
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Type: String
+  - name: with field arg
+    input: |
+      type Hello {
+        world(flag: Boolean): String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Arguments: [ArgumentDefinition]
+                - <ArgumentDefinition>
+                    Name: "flag"
+                    Type: Boolean
+                Type: String
+
+  - name: with field arg and default value
+    input: |
+      type Hello {
+        world(flag: Boolean = true): String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Arguments: [ArgumentDefinition]
+                - <ArgumentDefinition>
+                    Name: "flag"
+                    DefaultValue: true
+                    Type: Boolean
+                Type: String
+
+  - name: with field list arg
+    input: |
+      type Hello {
+        world(things: [String]): String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Arguments: [ArgumentDefinition]
+                - <ArgumentDefinition>
+                    Name: "things"
+                    Type: [String]
+                Type: String
+
+  - name: with two args
+    input: |
+      type Hello {
+        world(argOne: Boolean, argTwo: Int): String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Arguments: [ArgumentDefinition]
+                - <ArgumentDefinition>
+                    Name: "argOne"
+                    Type: Boolean
+                - <ArgumentDefinition>
+                    Name: "argTwo"
+                    Type: Int
+                Type: String
+  - name: must define one or more fields
+    input: |
+      type Hello {}
+    error:
+      message: "expected at least one definition, found }"
+      locations: [{ line: 1, column: 13 }]
+
+type extensions:
+  - name: Object extension
+    input: |
+      extend type Hello {
+        world: String
+      }
+    ast: |
+      <SchemaDocument>
+        Extensions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Type: String
+
+  - name: without any fields
+    input: "extend type Hello implements Greeting"
+    ast: |
+      <SchemaDocument>
+        Extensions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Interfaces: [string]
+            - "Greeting"
+
+  - name: without fields twice
+    input: |
+      extend type Hello implements Greeting
+      extend type Hello implements SecondGreeting
+    ast: |
+      <SchemaDocument>
+        Extensions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Interfaces: [string]
+            - "Greeting"
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Interfaces: [string]
+            - "SecondGreeting"
+
+  - name: without anything errors
+    input: "extend type Hello"
+    error:
+      message: "Unexpected <EOF>"
+      locations: [{ line: 1, column: 18 }]
+
+  - name: can have descriptions # hmm, this might not be spec compliant...
+    input: |
+      "Description"
+      extend type Hello {
+        world: String
+      }
+    error:
+      message: 'Unexpected String "Description"'
+      locations: [{ line: 1, column: 2 }]
+
+  - name: can not have descriptions on types
+    input: |
+      extend "Description" type Hello {
+        world: String
+      }
+    error:
+      message: Unexpected String "Description"
+      locations: [{ line: 1, column: 9 }]
+
+  - name: all can have directives
+    input: |
+      extend scalar Foo @deprecated
+      extend type Foo @deprecated
+      extend interface Foo @deprecated
+      extend union Foo @deprecated
+      extend enum Foo @deprecated
+      extend input Foo @deprecated
+    ast: |
+      <SchemaDocument>
+        Extensions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("SCALAR")
+            Name: "Foo"
+            Directives: [Directive]
+            - <Directive>
+                Name: "deprecated"
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Foo"
+            Directives: [Directive]
+            - <Directive>
+                Name: "deprecated"
+        - <Definition>
+            Kind: DefinitionKind("INTERFACE")
+            Name: "Foo"
+            Directives: [Directive]
+            - <Directive>
+                Name: "deprecated"
+        - <Definition>
+            Kind: DefinitionKind("UNION")
+            Name: "Foo"
+            Directives: [Directive]
+            - <Directive>
+                Name: "deprecated"
+        - <Definition>
+            Kind: DefinitionKind("ENUM")
+            Name: "Foo"
+            Directives: [Directive]
+            - <Directive>
+                Name: "deprecated"
+        - <Definition>
+            Kind: DefinitionKind("INPUT_OBJECT")
+            Name: "Foo"
+            Directives: [Directive]
+            - <Directive>
+                Name: "deprecated"
+
+schema definition:
+  - name: simple
+    input: |
+      schema {
+        query: Query
+      }
+    ast: |
+      <SchemaDocument>
+        Schema: [SchemaDefinition]
+        - <SchemaDefinition>
+            OperationTypes: [OperationTypeDefinition]
+            - <OperationTypeDefinition>
+                Operation: Operation("query")
+                Type: "Query"
+
+schema extensions:
+  - name: simple
+    input: |
+       extend schema {
+         mutation: Mutation
+       }
+    ast: |
+      <SchemaDocument>
+        SchemaExtension: [SchemaDefinition]
+        - <SchemaDefinition>
+            OperationTypes: [OperationTypeDefinition]
+            - <OperationTypeDefinition>
+                Operation: Operation("mutation")
+                Type: "Mutation"
+
+  - name: directive only
+    input: "extend schema @directive"
+    ast: |
+      <SchemaDocument>
+        SchemaExtension: [SchemaDefinition]
+        - <SchemaDefinition>
+            Directives: [Directive]
+            - <Directive>
+                Name: "directive"
+
+  - name: without anything errors
+    input: "extend schema"
+    error:
+      message: "Unexpected <EOF>"
+      locations: [{ line: 1, column: 14}]
+
+inheritance:
+  - name: single
+    input: "type Hello implements World { field: String }"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Interfaces: [string]
+            - "World"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "field"
+                Type: String
+
+  - name: multi
+    input: "type Hello implements Wo & rld { field: String }"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Interfaces: [string]
+            - "Wo"
+            - "rld"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "field"
+                Type: String
+
+  - name: multi with leading amp
+    input: "type Hello implements & Wo & rld { field: String }"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "Hello"
+            Interfaces: [string]
+            - "Wo"
+            - "rld"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "field"
+                Type: String
+
+enums:
+  - name: single value
+    input: "enum Hello { WORLD }"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("ENUM")
+            Name: "Hello"
+            EnumValues: [EnumValueDefinition]
+            - <EnumValueDefinition>
+                Name: "WORLD"
+
+  - name: double value
+    input: "enum Hello { WO, RLD }"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("ENUM")
+            Name: "Hello"
+            EnumValues: [EnumValueDefinition]
+            - <EnumValueDefinition>
+                Name: "WO"
+            - <EnumValueDefinition>
+                Name: "RLD"
+  - name: must define one or more unique enum values
+    input: |
+      enum Hello {}
+    error:
+      message: "expected at least one definition, found }"
+      locations: [{ line: 1, column: 13 }]
+
+interface:
+  - name: simple
+    input: |
+      interface Hello {
+        world: String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("INTERFACE")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Type: String
+  - name: must define one or more fields
+    input: |
+      interface Hello {}
+    error:
+      message: "expected at least one definition, found }"
+      locations: [{ line: 1, column: 18 }]
+
+  - name: may define intermediate interfaces
+    input: |
+      interface IA {
+          id: ID!
+      }
+
+      interface IIA implements IA {
+          id: ID!
+      }
+
+      type A implements IIA {
+          id: ID!
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("INTERFACE")
+            Name: "IA"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "id"
+                Type: ID!
+        - <Definition>
+            Kind: DefinitionKind("INTERFACE")
+            Name: "IIA"
+            Interfaces: [string]
+            - "IA"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "id"
+                Type: ID!
+        - <Definition>
+            Kind: DefinitionKind("OBJECT")
+            Name: "A"
+            Interfaces: [string]
+            - "IIA"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "id"
+                Type: ID!
+
+unions:
+  - name: simple
+    input: "union Hello = World"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("UNION")
+            Name: "Hello"
+            Types: [string]
+            - "World"
+
+  - name: with two types
+    input: "union Hello = Wo | Rld"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("UNION")
+            Name: "Hello"
+            Types: [string]
+            - "Wo"
+            - "Rld"
+
+  - name: with leading pipe
+    input: "union Hello = | Wo | Rld"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("UNION")
+            Name: "Hello"
+            Types: [string]
+            - "Wo"
+            - "Rld"
+
+  - name: cant be empty
+    input: "union Hello = || Wo | Rld"
+    error:
+      message: "Expected Name, found |"
+      locations: [{ line: 1, column: 16 }]
+
+  - name: cant double pipe
+    input: "union Hello = Wo || Rld"
+    error:
+      message: "Expected Name, found |"
+      locations: [{ line: 1, column: 19 }]
+
+  - name: cant have trailing pipe
+    input: "union Hello = | Wo | Rld |"
+    error:
+      message: "Expected Name, found <EOF>"
+      locations: [{ line: 1, column: 27 }]
+
+scalar:
+  - name: simple
+    input: "scalar Hello"
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("SCALAR")
+            Name: "Hello"
+
+input object:
+  - name: simple
+    input: |
+      input Hello {
+        world: String
+      }
+    ast: |
+      <SchemaDocument>
+        Definitions: [Definition]
+        - <Definition>
+            Kind: DefinitionKind("INPUT_OBJECT")
+            Name: "Hello"
+            Fields: [FieldDefinition]
+            - <FieldDefinition>
+                Name: "world"
+                Type: String
+
+  - name: can not have args
+    input: |
+      input Hello {
+        world(foo: Int): String
+      }
+    error:
+      message: "Expected :, found ("
+      locations: [{ line: 2, column: 8 }]
+  - name: must define one or more input fields
+    input: |
+      input Hello {}
+    error:
+      message: "expected at least one definition, found }"
+      locations: [{ line: 1, column: 14 }]
+
+directives:
+  - name: simple
+    input: directive @foo on FIELD
+    ast: |
+      <SchemaDocument>
+        Directives: [DirectiveDefinition]
+        - <DirectiveDefinition>
+            Name: "foo"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("FIELD")
+            IsRepeatable: false
+
+  - name: executable
+    input: |
+      directive @onQuery on QUERY
+      directive @onMutation on MUTATION
+      directive @onSubscription on SUBSCRIPTION
+      directive @onField on FIELD
+      directive @onFragmentDefinition on FRAGMENT_DEFINITION
+      directive @onFragmentSpread on FRAGMENT_SPREAD
+      directive @onInlineFragment on INLINE_FRAGMENT
+      directive @onVariableDefinition on VARIABLE_DEFINITION
+    ast: |
+      <SchemaDocument>
+        Directives: [DirectiveDefinition]
+        - <DirectiveDefinition>
+            Name: "onQuery"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("QUERY")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onMutation"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("MUTATION")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onSubscription"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("SUBSCRIPTION")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onField"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("FIELD")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onFragmentDefinition"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("FRAGMENT_DEFINITION")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onFragmentSpread"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("FRAGMENT_SPREAD")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onInlineFragment"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("INLINE_FRAGMENT")
+            IsRepeatable: false
+        - <DirectiveDefinition>
+            Name: "onVariableDefinition"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("VARIABLE_DEFINITION")
+            IsRepeatable: false
+  
+  - name: repeatable
+    input: directive @foo repeatable on FIELD
+    ast: |
+      <SchemaDocument>
+        Directives: [DirectiveDefinition]
+        - <DirectiveDefinition>
+            Name: "foo"
+            Locations: [DirectiveLocation]
+            - DirectiveLocation("FIELD")
+            IsRepeatable: true
+
+  - name: invalid location
+    input: "directive @foo on FIELD | INCORRECT_LOCATION"
+    error:
+      message: 'Unexpected Name "INCORRECT_LOCATION"'
+      locations: [{ line: 1, column: 27 }]
+
+fuzzer:
+  - name: 1
+    input: "type o{d(g:["
+    error:
+      message: 'Expected Name, found <EOF>'
+      locations: [{ line: 1, column: 13 }]
+  - name: 2
+    input: "\"\"\"\r"
+    error:
+      message: 'Unexpected <Invalid>'
+      locations: [{ line: 2, column: 1 }]
diff --git a/internal/gqlparser/parser/testrunner/runner.go b/internal/gqlparser/parser/testrunner/runner.go
new file mode 100644
index 0000000000..606661f1f4
--- /dev/null
+++ b/internal/gqlparser/parser/testrunner/runner.go
@@ -0,0 +1,139 @@
+package testrunner
+
+import (
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/andreyvit/diff"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+	"gopkg.in/yaml.v2"
+)
+
+type Features map[string][]Spec
+
+type Spec struct {
+	Name   string
+	Input  string
+	Error  *gqlerror.Error
+	Tokens []Token
+	AST    string
+}
+
+type Token struct {
+	Kind   string
+	Value  string
+	Start  int
+	End    int
+	Line   int
+	Column int
+	Src    string
+}
+
+func (t Token) String() string {
+	return t.Kind + " " + strconv.Quote(t.Value)
+}
+
+func Test(t *testing.T, filename string, f func(t *testing.T, input string) Spec) {
+	b, err := os.ReadFile(filename)
+	if err != nil {
+		panic(err)
+	}
+	var tests Features
+	err = yaml.Unmarshal(b, &tests)
+	if err != nil {
+		t.Errorf("unable to load %s: %s", filename, err.Error())
+		return
+	}
+
+	for name, specs := range tests {
+		t.Run(name, func(t *testing.T) {
+			for _, spec := range specs {
+				t.Run(spec.Name, func(t *testing.T) {
+					result := f(t, spec.Input)
+
+					if spec.Error == nil {
+						if result.Error != nil {
+							gqlErr := err.(*gqlerror.Error)
+							t.Errorf("unexpected error %s", gqlErr.Message)
+						}
+					} else if result.Error == nil {
+						t.Errorf("expected error but got none")
+					} else {
+						if result.Error.Message != spec.Error.Message {
+							t.Errorf("wrong error returned\nexpected: %s\ngot:      %s", spec.Error.Message, result.Error.Message)
+						}
+
+						if result.Error.Locations[0].Column != spec.Error.Locations[0].Column || result.Error.Locations[0].Line != spec.Error.Locations[0].Line {
+							t.Errorf(
+								"wrong error location:\nexpected: line %d column %d\ngot:      line %d column %d",
+								spec.Error.Locations[0].Line,
+								spec.Error.Locations[0].Column,
+								result.Error.Locations[0].Line,
+								result.Error.Locations[0].Column,
+							)
+						}
+					}
+
+					if len(spec.Tokens) != len(result.Tokens) {
+						var tokensStr []string
+						for _, t := range result.Tokens {
+							tokensStr = append(tokensStr, t.String())
+						}
+						t.Errorf("token count mismatch, got: \n%s", strings.Join(tokensStr, "\n"))
+					} else {
+						for i, tok := range result.Tokens {
+							expected := spec.Tokens[i]
+
+							if !strings.EqualFold(strings.Replace(expected.Kind, "_", "", -1), tok.Kind) {
+								t.Errorf("token[%d].kind should be %s, was %s", i, expected.Kind, tok.Kind)
+							}
+							if expected.Value != "undefined" && expected.Value != tok.Value {
+								t.Errorf("token[%d].value incorrect\nexpected: %s\ngot:      %s", i, strconv.Quote(expected.Value), strconv.Quote(tok.Value))
+							}
+							if expected.Start != 0 && expected.Start != tok.Start {
+								t.Errorf("token[%d].start should be %d, was %d", i, expected.Start, tok.Start)
+							}
+							if expected.End != 0 && expected.End != tok.End {
+								t.Errorf("token[%d].end should be %d, was %d", i, expected.End, tok.End)
+							}
+							if expected.Line != 0 && expected.Line != tok.Line {
+								t.Errorf("token[%d].line should be %d, was %d", i, expected.Line, tok.Line)
+							}
+							if expected.Column != 0 && expected.Column != tok.Column {
+								t.Errorf("token[%d].column should be %d, was %d", i, expected.Column, tok.Column)
+							}
+							if tok.Src != "spec" {
+								t.Errorf("token[%d].source.name should be spec, was %s", i, strconv.Quote(tok.Src))
+							}
+						}
+					}
+
+					spec.AST = strings.TrimSpace(spec.AST)
+					result.AST = strings.TrimSpace(result.AST)
+
+					if spec.AST != "" && spec.AST != result.AST {
+						diff := diff.LineDiff(spec.AST, result.AST)
+						if diff != "" {
+							t.Errorf("AST mismatch:\n%s", diff)
+						}
+					}
+
+					if t.Failed() {
+						t.Logf("input: %s", strconv.Quote(spec.Input))
+						if result.Error != nil {
+							t.Logf("error: %s", result.Error.Message)
+						}
+						t.Log("tokens: ")
+						for _, tok := range result.Tokens {
+							t.Logf("  - %s", tok.String())
+						}
+						t.Logf("  - <EOF>")
+					}
+				})
+			}
+		})
+	}
+
+}
diff --git a/internal/gqlparser/remove-tests.sh b/internal/gqlparser/remove-tests.sh
new file mode 100755
index 0000000000..13080ccce6
--- /dev/null
+++ b/internal/gqlparser/remove-tests.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -e
+
+# Remove tests from library.
+find . -name "*_test.go" -delete
diff --git a/internal/gqlparser/rewrite-deps.sh b/internal/gqlparser/rewrite-deps.sh
new file mode 100755
index 0000000000..77d1f6163f
--- /dev/null
+++ b/internal/gqlparser/rewrite-deps.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -e
+
+# Relies on perl to do in-place regex search-and-replace for the module strings.
+# Relies on find to recursively enumerate all the Go files.
+
+# Rewrite imports to use this module.
+for f in $(find . -name "*.go"); do perl -pi -e "s/github.com\/vektah\/gqlparser\/v2/github.com\/open-policy-agent\/opa\/internal\/gqlparser/" $f; done
diff --git a/internal/gqlparser/validator/error.go b/internal/gqlparser/validator/error.go
new file mode 100644
index 0000000000..f31f180a2e
--- /dev/null
+++ b/internal/gqlparser/validator/error.go
@@ -0,0 +1,55 @@
+package validator
+
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+)
+
+type ErrorOption func(err *gqlerror.Error)
+
+func Message(msg string, args ...interface{}) ErrorOption {
+	return func(err *gqlerror.Error) {
+		err.Message += fmt.Sprintf(msg, args...)
+	}
+}
+
+func At(position *ast.Position) ErrorOption {
+	return func(err *gqlerror.Error) {
+		if position == nil {
+			return
+		}
+		err.Locations = append(err.Locations, gqlerror.Location{
+			Line:   position.Line,
+			Column: position.Column,
+		})
+		if position.Src.Name != "" {
+			err.SetFile(position.Src.Name)
+		}
+	}
+}
+
+func SuggestListQuoted(prefix string, typed string, suggestions []string) ErrorOption {
+	suggested := SuggestionList(typed, suggestions)
+	return func(err *gqlerror.Error) {
+		if len(suggested) > 0 {
+			err.Message += " " + prefix + " " + QuotedOrList(suggested...) + "?"
+		}
+	}
+}
+
+func SuggestListUnquoted(prefix string, typed string, suggestions []string) ErrorOption {
+	suggested := SuggestionList(typed, suggestions)
+	return func(err *gqlerror.Error) {
+		if len(suggested) > 0 {
+			err.Message += " " + prefix + " " + OrList(suggested...) + "?"
+		}
+	}
+}
+
+func Suggestf(suggestion string, args ...interface{}) ErrorOption {
+	return func(err *gqlerror.Error) {
+		err.Message += " Did you mean " + fmt.Sprintf(suggestion, args...) + "?"
+	}
+}
diff --git a/internal/gqlparser/validator/imported/LICENSE b/internal/gqlparser/validator/imported/LICENSE
new file mode 100644
index 0000000000..fce4519eb4
--- /dev/null
+++ b/internal/gqlparser/validator/imported/LICENSE
@@ -0,0 +1,33 @@
+The files in this testdata directory are derived from the graphql-js project:
+https://github.com/graphql/graphql-js
+
+BSD License
+
+For GraphQL software
+
+Copyright (c) 2015, Facebook, Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook nor the names of its contributors may be used to
+   endorse or promote products derived from this software without specific
+   prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/internal/gqlparser/validator/imported/babel.config.json b/internal/gqlparser/validator/imported/babel.config.json
new file mode 100644
index 0000000000..10f844c621
--- /dev/null
+++ b/internal/gqlparser/validator/imported/babel.config.json
@@ -0,0 +1,7 @@
+{
+    "plugins": ["@babel/plugin-transform-typescript"],
+    "presets": [
+        "@babel/preset-env",
+        "@babel/preset-flow"
+    ]
+}
diff --git a/internal/gqlparser/validator/imported/deviations.yml b/internal/gqlparser/validator/imported/deviations.yml
new file mode 100644
index 0000000000..a29b7d4550
--- /dev/null
+++ b/internal/gqlparser/validator/imported/deviations.yml
@@ -0,0 +1,29 @@
+- rule: 'ExecutableDefinitionsRule/.*'
+  skip: "These are impossible to generate because the parser is split between Query and Schema"
+
+- rule: 'FieldsOnCorrectType/Defined on implementors but not on interface'
+  errors:
+    - message: Cannot query field "nickname" on type "Pet". Did you mean to use an inline fragment on "Cat" or "Dog"?
+      locations:
+        - {line: 3, column: 9}
+
+- rule: 'KnownDirectivesRule/within schema language/with misplaced directives'
+  skip: "When the syntax of schema is mixed in query, parser can't consume schema syntax and ignore it"
+
+- rule: 'KnownTypeNamesRule/ignores type definitions'
+  skip: "When the syntax of schema is mixed in query, parser can't consume schema syntax and ignore it"
+
+- rule: 'OverlappingFieldsCanBeMergedRule/return types must be unambiguous/reports correctly when a non-exclusive follows an exclusive'
+  skip: "Spec issue? scalar is not exists on SomeBox"
+
+- rule: 'ValuesOfCorrectTypeRule/.*custom scalar.*'
+  skip: "Custom scalars are a runtime feature, maybe they dont belong in here?"
+
+- rule: 'NoDeprecatedCustomRule/.*'
+  skip: "This rule is optional and is not part of the Validation section of the GraphQL Specification"
+
+- rule: 'NoSchemaIntrospectionCustomRule/.*'
+  skip: "This rule is optional and is not part of the Validation section of the GraphQL Specification"
+
+- rule: 'KnownTypeNamesRule/references to standard scalars that are missing in schema'
+  skip: "standard scalars must be exists in schema"
\ No newline at end of file
diff --git a/internal/gqlparser/validator/imported/export.js b/internal/gqlparser/validator/imported/export.js
new file mode 100644
index 0000000000..234cc10dec
--- /dev/null
+++ b/internal/gqlparser/validator/imported/export.js
@@ -0,0 +1,191 @@
+import fs from "fs";
+import Module from "module";
+import { testSchema } from "./graphql-js/src/validation/__tests__/harness";
+import { printSchema } from "./graphql-js/src/utilities";
+import yaml from "js-yaml";
+
+let schemas = [];
+function registerSchema(schema) {
+  for (let i = 0; i < schemas.length; i++) {
+    if (schemas[i] === schema) {
+      return i;
+    }
+  }
+  schemas.push(schema);
+  return schemas.length - 1;
+}
+
+function resultProxy(start, base = {}) {
+  const funcWithPath = (path) => {
+    const f = () => {};
+    f.path = path;
+    return f;
+  };
+  let handler = {
+    get: function (obj, prop) {
+      if (base[prop]) {
+        return base[prop];
+      }
+      return new Proxy(funcWithPath(`${obj.path}.${prop}`), handler);
+    },
+  };
+
+  return new Proxy(funcWithPath(start), handler);
+}
+
+// replace empty lines with the normal amount of whitespace
+// so that yaml correctly preserves the whitespace
+function normalizeWs(rawString) {
+  const lines = rawString.split(/\r\n|[\n\r]/g);
+
+  let commonIndent = 1000000;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim()) {
+      continue;
+    }
+
+    const indent = line.search(/\S/);
+    if (indent < commonIndent) {
+      commonIndent = indent;
+    }
+  }
+
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i].length < commonIndent) {
+      lines[i] = " ".repeat(commonIndent);
+    }
+  }
+  return lines.join("\n");
+}
+
+const harness = {
+  testSchema,
+
+  expectValidationErrorsWithSchema(schema, rule, queryStr) {
+    return resultProxy("expectValidationErrorsWithSchema", {
+      toDeepEqual(expected) {
+        tests.push({
+          name: names.slice(1).join("/"),
+          rule: rule.name.replace(/Rule$/, ""),
+          schema: registerSchema(schema),
+          query: normalizeWs(queryStr),
+          errors: expected,
+        });
+      },
+    });
+  },
+  expectValidationErrors(rule, queryStr) {
+    return harness.expectValidationErrorsWithSchema(testSchema, rule, queryStr);
+  },
+  expectSDLValidationErrors(schema, rule, sdlStr) {
+    return resultProxy("expectSDLValidationErrors", {
+      toDeepEqual(expected) {
+        // ignore now...
+        // console.warn(rule.name, sdlStr, JSON.stringify(expected, null, 2));
+      },
+    });
+  },
+};
+
+let tests = [];
+let names = [];
+const fakeModules = {
+  mocha: {
+    describe(name, f) {
+      names.push(name);
+      f();
+      names.pop();
+    },
+    it(name, f) {
+      names.push(name);
+      f();
+      names.pop();
+    },
+  },
+  chai: {
+    expect(it) {
+      const expect = {
+        get to() {
+          return expect;
+        },
+        get have() {
+          return expect;
+        },
+        get nested() {
+          return expect;
+        },
+        equal(value) {
+          // currently ignored, we know all we need to add an assertion here.
+        },
+        property(path, value) {
+          // currently ignored, we know all we need to add an assertion here.
+        },
+      };
+
+      return expect;
+    },
+  },
+  "./harness": harness,
+};
+
+const originalLoader = Module._load;
+Module._load = function (request, parent, isMain) {
+  return fakeModules[request] || originalLoader(request, parent, isMain);
+};
+
+fs.readdirSync("./graphql-js/src/validation/__tests__").forEach((file) => {
+  if (!file.endsWith("-test.ts")) {
+    return;
+  }
+
+  if (file === "validation-test.ts") {
+    return;
+  }
+
+  require(`./graphql-js/src/validation/__tests__/${file}`);
+
+  let dump = yaml.dump(tests, {
+    skipInvalid: true,
+    flowLevel: 5,
+    noRefs: true,
+    lineWidth: 1000,
+  });
+  fs.writeFileSync(`./spec/${file.replace("-test.ts", ".spec.yml")}`, dump);
+
+  tests = [];
+});
+
+let schemaList = schemas.map((s) => printSchema(s));
+
+schemaList[0] += `
+# injected becuase upstream spec is missing some types
+extend type QueryRoot {
+    field: T
+    f1: Type
+    f2: Type
+    f3: Type
+}
+
+type Type {
+    a: String
+    b: String
+    c: String
+}
+type T {
+    a: String
+    b: String
+    c: String
+    d: String
+    y: String
+    deepField: T
+    deeperField: T
+}`;
+
+let dump = yaml.dump(schemaList, {
+  skipInvalid: true,
+  flowLevel: 5,
+  noRefs: true,
+  lineWidth: 1000,
+});
+fs.writeFileSync("./spec/schemas.yml", dump);
diff --git a/internal/gqlparser/validator/imported/export.sh b/internal/gqlparser/validator/imported/export.sh
new file mode 100755
index 0000000000..a422003802
--- /dev/null
+++ b/internal/gqlparser/validator/imported/export.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+REPO_DIR=./graphql-js
+EXPORTER_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+cd "$EXPORTER_ROOT" || exit
+
+GIT_REF=origin/main
+
+if [[ -f "$EXPORTER_ROOT/graphql-js-commit.log" ]] ; then
+  GIT_REF=$(cat "$EXPORTER_ROOT/graphql-js-commit.log")
+fi
+echo $GIT_REF
+
+if [[ -d "$REPO_DIR" ]] ; then
+    echo "fetching graphql-js with ${GIT_REF}"
+    cd "$REPO_DIR" || exit
+    git fetch origin master
+    git checkout "$GIT_REF"
+    git reset --hard
+else
+    echo "cloning graphql-js with ${GIT_REF}"
+    git clone --no-tags --single-branch -- https://github.com/graphql/graphql-js $REPO_DIR
+    cd "$REPO_DIR" || exit
+    git checkout "$GIT_REF"
+fi
+git rev-parse HEAD > $EXPORTER_ROOT/graphql-js-commit.log
+
+cd "$EXPORTER_ROOT" || exit
+
+echo "installing js dependencies"
+npm ci
+
+echo "exporting tests"
+npx babel-node -x ".ts,.js" ./export.js
diff --git a/internal/gqlparser/validator/imported/graphql-js-commit.log b/internal/gqlparser/validator/imported/graphql-js-commit.log
new file mode 100644
index 0000000000..293640ad86
--- /dev/null
+++ b/internal/gqlparser/validator/imported/graphql-js-commit.log
@@ -0,0 +1 @@
+f597c694339b7c488f05496806e404659f6ff955
diff --git a/internal/gqlparser/validator/imported/package-lock.json b/internal/gqlparser/validator/imported/package-lock.json
new file mode 100644
index 0000000000..92fededb0a
--- /dev/null
+++ b/internal/gqlparser/validator/imported/package-lock.json
@@ -0,0 +1,5314 @@
+{
+  "name": "imported",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@babel/cli": "^7.16.8",
+        "@babel/core": "^7.16.12",
+        "@babel/node": "^7.16.8",
+        "@babel/plugin-transform-typescript": "^7.16.8",
+        "@babel/preset-env": "^7.16.11",
+        "@babel/preset-flow": "^7.16.7",
+        "chai": "^4.3.6",
+        "iterall": "^1.3.0",
+        "js-yaml": "^4.0.0"
+      },
+      "devDependencies": {
+        "prettier": "^2.5.1"
+      }
+    },
+    "node_modules/@babel/cli": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/cli/-/cli-7.16.8.tgz",
+      "integrity": "sha512-FTKBbxyk5TclXOGmwYyqelqP5IF6hMxaeJskd85jbR5jBfYlwqgwAbJwnixi1ZBbTqKfFuAA95mdmUFeSRwyJA==",
+      "dependencies": {
+        "commander": "^4.0.1",
+        "convert-source-map": "^1.1.0",
+        "fs-readdir-recursive": "^1.1.0",
+        "glob": "^7.0.0",
+        "make-dir": "^2.1.0",
+        "slash": "^2.0.0",
+        "source-map": "^0.5.0"
+      },
+      "bin": {
+        "babel": "bin/babel.js",
+        "babel-external-helpers": "bin/babel-external-helpers.js"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "optionalDependencies": {
+        "@nicolo-ribaudo/chokidar-2": "2.1.8-no-fsevents.3",
+        "chokidar": "^3.4.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.16.7.tgz",
+      "integrity": "sha512-iAXqUn8IIeBTNd72xsFlgaXHkMBMt6y4HJp1tIaK465CWLT/fG1aqB7ykr95gHHmlBdGbFeWWfyB4NJJ0nmeIg==",
+      "dependencies": {
+        "@babel/highlight": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.16.8.tgz",
+      "integrity": "sha512-m7OkX0IdKLKPpBlJtF561YJal5y/jyI5fNfWbPxh2D/nbzzGI4qRyrD8xO2jB24u7l+5I2a43scCG2IrfjC50Q==",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.16.12",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.16.12.tgz",
+      "integrity": "sha512-dK5PtG1uiN2ikk++5OzSYsitZKny4wOCD0nrO4TqnW4BVBTQ2NGS3NgilvT/TEyxTST7LNyWV/T4tXDoD3fOgg==",
+      "dependencies": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/generator": "^7.16.8",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helpers": "^7.16.7",
+        "@babel/parser": "^7.16.12",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.10",
+        "@babel/types": "^7.16.8",
+        "convert-source-map": "^1.7.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.1.2",
+        "semver": "^6.3.0",
+        "source-map": "^0.5.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.16.8.tgz",
+      "integrity": "sha512-1ojZwE9+lOXzcWdWmO6TbUzDfqLD39CmEhN8+2cX9XkDo5yW1OpgfejfliysR2AWLpMamTiOiAp/mtroaymhpw==",
+      "dependencies": {
+        "@babel/types": "^7.16.8",
+        "jsesc": "^2.5.1",
+        "source-map": "^0.5.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-annotate-as-pure": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.16.7.tgz",
+      "integrity": "sha512-s6t2w/IPQVTAET1HitoowRGXooX8mCgtuP5195wD/QJPV6wYjpujCGF7JuMODVX2ZAJOf1GT6DT9MHEZvLOFSw==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-builder-binary-assignment-operator-visitor": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.16.7.tgz",
+      "integrity": "sha512-C6FdbRaxYjwVu/geKW4ZeQ0Q31AftgRcdSnZ5/jsH6BzCJbtvXvhpfkbkThYSuutZA7nCXpPR6AD9zd1dprMkA==",
+      "dependencies": {
+        "@babel/helper-explode-assignable-expression": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.16.7.tgz",
+      "integrity": "sha512-mGojBwIWcwGD6rfqgRXVlVYmPAv7eOpIemUG3dGnDdCY4Pae70ROij3XmfrH6Fa1h1aiDylpglbZyktfzyo/hA==",
+      "dependencies": {
+        "@babel/compat-data": "^7.16.4",
+        "@babel/helper-validator-option": "^7.16.7",
+        "browserslist": "^4.17.5",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-create-class-features-plugin": {
+      "version": "7.16.10",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.16.10.tgz",
+      "integrity": "sha512-wDeej0pu3WN/ffTxMNCPW5UCiOav8IcLRxSIyp/9+IF2xJUM9h/OYjg0IJLHaL6F8oU8kqMz9nc1vryXhMsgXg==",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-member-expression-to-functions": "^7.16.7",
+        "@babel/helper-optimise-call-expression": "^7.16.7",
+        "@babel/helper-replace-supers": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-create-regexp-features-plugin": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.16.7.tgz",
+      "integrity": "sha512-fk5A6ymfp+O5+p2yCkXAu5Kyj6v0xh0RBeNcAkYUMDvvAAoxvSKXn+Jb37t/yWFiQVDFK1ELpUTD8/aLhCPu+g==",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "regexpu-core": "^4.7.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-define-polyfill-provider": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.1.tgz",
+      "integrity": "sha512-J9hGMpJQmtWmj46B3kBHmL38UhJGhYX7eqkcq+2gsstyYt341HmPeWspihX43yVRA0mS+8GGk2Gckc7bY/HCmA==",
+      "dependencies": {
+        "@babel/helper-compilation-targets": "^7.13.0",
+        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/helper-plugin-utils": "^7.13.0",
+        "@babel/traverse": "^7.13.0",
+        "debug": "^4.1.1",
+        "lodash.debounce": "^4.0.8",
+        "resolve": "^1.14.2",
+        "semver": "^6.1.2"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.4.0-0"
+      }
+    },
+    "node_modules/@babel/helper-environment-visitor": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.16.7.tgz",
+      "integrity": "sha512-SLLb0AAn6PkUeAfKJCCOl9e1R53pQlGAfc4y4XuMRZfqeMYLE0dM1LMhqbGAlGQY0lfw5/ohoYWAe9V1yibRag==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-explode-assignable-expression": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.16.7.tgz",
+      "integrity": "sha512-KyUenhWMC8VrxzkGP0Jizjo4/Zx+1nNZhgocs+gLzyZyB8SHidhoq9KK/8Ato4anhwsivfkBLftky7gvzbZMtQ==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-function-name": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.16.7.tgz",
+      "integrity": "sha512-QfDfEnIUyyBSR3HtrtGECuZ6DAyCkYFp7GHl75vFtTnn6pjKeK0T1DB5lLkFvBea8MdaiUABx3osbgLyInoejA==",
+      "dependencies": {
+        "@babel/helper-get-function-arity": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-get-function-arity": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.16.7.tgz",
+      "integrity": "sha512-flc+RLSOBXzNzVhcLu6ujeHUrD6tANAOU5ojrRx/as+tbzf8+stUCj7+IfRRoAbEZqj/ahXEMsjhOhgeZsrnTw==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-hoist-variables": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.16.7.tgz",
+      "integrity": "sha512-m04d/0Op34H5v7pbZw6pSKP7weA6lsMvfiIAMeIvkY/R4xQtBSMFEigu9QTZ2qB/9l22vsxtM8a+Q8CzD255fg==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-member-expression-to-functions": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.16.7.tgz",
+      "integrity": "sha512-VtJ/65tYiU/6AbMTDwyoXGPKHgTsfRarivm+YbB5uAzKUyuPjgZSgAFeG87FCigc7KNHu2Pegh1XIT3lXjvz3Q==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.16.7.tgz",
+      "integrity": "sha512-LVtS6TqjJHFc+nYeITRo6VLXve70xmq7wPhWTqDJusJEgGmkAACWwMiTNrvfoQo6hEhFwAIixNkvB0jPXDL8Wg==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.16.7.tgz",
+      "integrity": "sha512-gaqtLDxJEFCeQbYp9aLAefjhkKdjKcdh6DB7jniIGU3Pz52WAmP268zK0VgPz9hUNkMSYeH976K2/Y6yPadpng==",
+      "dependencies": {
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-module-imports": "^7.16.7",
+        "@babel/helper-simple-access": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-optimise-call-expression": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.16.7.tgz",
+      "integrity": "sha512-EtgBhg7rd/JcnpZFXpBy0ze1YRfdm7BnBX4uKMBd3ixa3RGAE002JZB66FJyNH7g0F38U05pXmA5P8cBh7z+1w==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.16.7.tgz",
+      "integrity": "sha512-Qg3Nk7ZxpgMrsox6HreY1ZNKdBq7K72tDSliA6dCl5f007jR4ne8iD5UzuNnCJH2xBf2BEEVGr+/OL6Gdp7RxA==",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-remap-async-to-generator": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.16.8.tgz",
+      "integrity": "sha512-fm0gH7Flb8H51LqJHy3HJ3wnE1+qtYR2A99K06ahwrawLdOFsCEWjZOrYricXJHoPSudNKxrMBUPEIPxiIIvBw==",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-wrap-function": "^7.16.8",
+        "@babel/types": "^7.16.8"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-replace-supers": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.16.7.tgz",
+      "integrity": "sha512-y9vsWilTNaVnVh6xiJfABzsNpgDPKev9HnAgz6Gb1p6UUwf9NepdlsV7VXGCftJM+jqD5f7JIEubcpLjZj5dBw==",
+      "dependencies": {
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-member-expression-to-functions": "^7.16.7",
+        "@babel/helper-optimise-call-expression": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-simple-access": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.16.7.tgz",
+      "integrity": "sha512-ZIzHVyoeLMvXMN/vok/a4LWRy8G2v205mNP0XOuf9XRLyX5/u9CnVulUtDgUTama3lT+bf/UqucuZjqiGuTS1g==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.16.0.tgz",
+      "integrity": "sha512-+il1gTy0oHwUsBQZyJvukbB4vPMdcYBrFHa0Uc4AizLxbq6BOYC51Rv4tWocX9BLBDLZ4kc6qUFpQ6HRgL+3zw==",
+      "dependencies": {
+        "@babel/types": "^7.16.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-split-export-declaration": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.16.7.tgz",
+      "integrity": "sha512-xbWoy/PFoxSWazIToT9Sif+jJTlrMcndIsaOKvTA6u7QEo7ilkRZpjew18/W3c7nm8fXdUDXh02VXTbZ0pGDNw==",
+      "dependencies": {
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.16.7.tgz",
+      "integrity": "sha512-hsEnFemeiW4D08A5gUAZxLBTXpZ39P+a+DGDsHw1yxqyQ/jzFEnxf5uTEGp+3bzAbNOxU1paTgYS4ECU/IgfDw==",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.16.7.tgz",
+      "integrity": "sha512-TRtenOuRUVo9oIQGPC5G9DgK4743cdxvtOw0weQNpZXaS16SCBi5MNjZF8vba3ETURjZpTbVn7Vvcf2eAwFozQ==",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-wrap-function": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.16.8.tgz",
+      "integrity": "sha512-8RpyRVIAW1RcDDGTA+GpPAwV22wXCfKOoM9bet6TLkGIFTkRQSkH1nMQ5Yet4MpoXe1ZwHPVtNasc2w0uZMqnw==",
+      "dependencies": {
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.8",
+        "@babel/types": "^7.16.8"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.16.7.tgz",
+      "integrity": "sha512-9ZDoqtfY7AuEOt3cxchfii6C7GDyyMBffktR5B2jvWv8u2+efwvpnVKXMWzNehqy68tKgAfSwfdw/lWpthS2bw==",
+      "dependencies": {
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/highlight": {
+      "version": "7.16.10",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.16.10.tgz",
+      "integrity": "sha512-5FnTQLSLswEj6IkgVw5KusNUUFY9ZGqe/TRFnP/BKYHYgfh7tc+C7mwiy95/yNP7Dh9x580Vv8r7u7ZfTBFxdw==",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "chalk": "^2.0.0",
+        "js-tokens": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/node": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/node/-/node-7.16.8.tgz",
+      "integrity": "sha512-V2dopEtPUL4LD+e8UtMIZB6BbsmMsS/7E1ZAvWNINzBfi7Cf3X9MLCpzHVZT4HeeF1lQl72IRtqqVt2RUImwyA==",
+      "dependencies": {
+        "@babel/register": "^7.16.8",
+        "commander": "^4.0.1",
+        "core-js": "^3.20.2",
+        "node-environment-flags": "^1.0.5",
+        "regenerator-runtime": "^0.13.4",
+        "v8flags": "^3.1.1"
+      },
+      "bin": {
+        "babel-node": "bin/babel-node.js"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.16.12",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.16.12.tgz",
+      "integrity": "sha512-VfaV15po8RiZssrkPweyvbGVSe4x2y+aciFCgn0n0/SJMR22cwofRV1mtnJQYcSB1wUTaA/X1LnA3es66MCO5A==",
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.16.7.tgz",
+      "integrity": "sha512-anv/DObl7waiGEnC24O9zqL0pSuI9hljihqiDuFHC8d7/bjr/4RLGPWuc8rYOff/QPzbEPSkzG8wGG9aDuhHRg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.16.7.tgz",
+      "integrity": "sha512-di8vUHRdf+4aJ7ltXhaDbPoszdkh59AQtJM5soLsuHpQJdFQZOA4uGj0V2u/CZ8bJ/u8ULDL5yq6FO/bCXnKHw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.16.0",
+        "@babel/plugin-proposal-optional-chaining": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.13.0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-async-generator-functions": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.16.8.tgz",
+      "integrity": "sha512-71YHIvMuiuqWJQkebWJtdhQTfd4Q4mF76q2IX37uZPkG9+olBxsX+rH1vkhFto4UeJZ9dPY2s+mDvhDm1u2BGQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-remap-async-to-generator": "^7.16.8",
+        "@babel/plugin-syntax-async-generators": "^7.8.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-class-properties": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.16.7.tgz",
+      "integrity": "sha512-IobU0Xme31ewjYOShSIqd/ZGM/r/cuOz2z0MDbNrhF5FW+ZVgi0f2lyeoj9KFPDOAqsYxmLWZte1WOwlvY9aww==",
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-class-static-block": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.16.7.tgz",
+      "integrity": "sha512-dgqJJrcZoG/4CkMopzhPJjGxsIe9A8RlkQLnL/Vhhx8AA9ZuaRwGSlscSh42hazc7WSrya/IK7mTeoF0DP9tEw==",
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.12.0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-dynamic-import": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.16.7.tgz",
+      "integrity": "sha512-I8SW9Ho3/8DRSdmDdH3gORdyUuYnk1m4cMxUAdu5oy4n3OfN8flDEH+d60iG7dUfi0KkYwSvoalHzzdRzpWHTg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-export-namespace-from": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.16.7.tgz",
+      "integrity": "sha512-ZxdtqDXLRGBL64ocZcs7ovt71L3jhC1RGSyR996svrCi3PYqHNkb3SwPJCs8RIzD86s+WPpt2S73+EHCGO+NUA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-json-strings": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.16.7.tgz",
+      "integrity": "sha512-lNZ3EEggsGY78JavgbHsK9u5P3pQaW7k4axlgFLYkMd7UBsiNahCITShLjNQschPyjtO6dADrL24757IdhBrsQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-json-strings": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-logical-assignment-operators": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.16.7.tgz",
+      "integrity": "sha512-K3XzyZJGQCr00+EtYtrDjmwX7o7PLK6U9bi1nCwkQioRFVUv6dJoxbQjtWVtP+bCPy82bONBKG8NPyQ4+i6yjg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-nullish-coalescing-operator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.16.7.tgz",
+      "integrity": "sha512-aUOrYU3EVtjf62jQrCj63pYZ7k6vns2h/DQvHPWGmsJRYzWXZ6/AsfgpiRy6XiuIDADhJzP2Q9MwSMKauBQ+UQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-numeric-separator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.16.7.tgz",
+      "integrity": "sha512-vQgPMknOIgiuVqbokToyXbkY/OmmjAzr/0lhSIbG/KmnzXPGwW/AdhdKpi+O4X/VkWiWjnkKOBiqJrTaC98VKw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-object-rest-spread": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.16.7.tgz",
+      "integrity": "sha512-3O0Y4+dw94HA86qSg9IHfyPktgR7q3gpNVAeiKQd+8jBKFaU5NQS1Yatgo4wY+UFNuLjvxcSmzcsHqrhgTyBUA==",
+      "dependencies": {
+        "@babel/compat-data": "^7.16.4",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-transform-parameters": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-optional-catch-binding": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.16.7.tgz",
+      "integrity": "sha512-eMOH/L4OvWSZAE1VkHbr1vckLG1WUcHGJSLqqQwl2GaUqG6QjddvrOaTUMNYiv77H5IKPMZ9U9P7EaHwvAShfA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-optional-chaining": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.16.7.tgz",
+      "integrity": "sha512-eC3xy+ZrUcBtP7x+sq62Q/HYd674pPTb/77XZMb5wbDPGWIdUbSr4Agr052+zaUPSb+gGRnjxXfKFvx5iMJ+DA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.16.0",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-private-methods": {
+      "version": "7.16.11",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.16.11.tgz",
+      "integrity": "sha512-F/2uAkPlXDr8+BHpZvo19w3hLFKge+k75XUprE6jaqKxjGkSYcK+4c+bup5PdW/7W/Rpjwql7FTVEDW+fRAQsw==",
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.16.10",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-private-property-in-object": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.16.7.tgz",
+      "integrity": "sha512-rMQkjcOFbm+ufe3bTZLyOfsOUOxyvLXZJCTARhJr+8UMSoZmqTe1K1BgkFcrW37rAchWg57yI69ORxiWvUINuQ==",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-unicode-property-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.16.7.tgz",
+      "integrity": "sha512-QRK0YI/40VLhNVGIjRNAAQkEHws0cswSdFFjpFyt943YmJIU1da9uW63Iu6NFV6CxTZW5eTDCrwZUstBWgp/Rg==",
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-async-generators": {
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-class-properties": {
+      "version": "7.12.13",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.12.13"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-class-static-block": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-dynamic-import": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz",
+      "integrity": "sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-export-namespace-from": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz",
+      "integrity": "sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.3"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-flow": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-flow/-/plugin-syntax-flow-7.16.7.tgz",
+      "integrity": "sha512-UDo3YGQO0jH6ytzVwgSLv9i/CzMcUjbKenL67dTrAZPPv6GFAtDhe6jqnvmoKzC/7htNTohhos+onPtDMqJwaQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-json-strings": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-numeric-separator": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-object-rest-spread": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-optional-catch-binding": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-optional-chaining": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-private-property-in-object": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-top-level-await": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-typescript": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.16.7.tgz",
+      "integrity": "sha512-YhUIJHHGkqPgEcMYkPCKTyGUdoGKWtopIycQyjJH8OjvRgOYsXsaKehLVPScKJWAULPxMa4N1vCe6szREFlZ7A==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-arrow-functions": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.16.7.tgz",
+      "integrity": "sha512-9ffkFFMbvzTvv+7dTp/66xvZAWASuPD5Tl9LK3Z9vhOmANo6j94rik+5YMBt4CwHVMWLWpMsriIc2zsa3WW3xQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-async-to-generator": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.16.8.tgz",
+      "integrity": "sha512-MtmUmTJQHCnyJVrScNzNlofQJ3dLFuobYn3mwOTKHnSCMtbNsqvF71GQmJfFjdrXSsAA7iysFmYWw4bXZ20hOg==",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-remap-async-to-generator": "^7.16.8"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-block-scoped-functions": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.16.7.tgz",
+      "integrity": "sha512-JUuzlzmF40Z9cXyytcbZEZKckgrQzChbQJw/5PuEHYeqzCsvebDx0K0jWnIIVcmmDOAVctCgnYs0pMcrYj2zJg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-block-scoping": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.16.7.tgz",
+      "integrity": "sha512-ObZev2nxVAYA4bhyusELdo9hb3H+A56bxH3FZMbEImZFiEDYVHXQSJ1hQKFlDnlt8G9bBrCZ5ZpURZUrV4G5qQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-classes": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.16.7.tgz",
+      "integrity": "sha512-WY7og38SFAGYRe64BrjKf8OrE6ulEHtr5jEYaZMwox9KebgqPi67Zqz8K53EKk1fFEJgm96r32rkKZ3qA2nCWQ==",
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-optimise-call-expression": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-replace-supers": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "globals": "^11.1.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-computed-properties": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.16.7.tgz",
+      "integrity": "sha512-gN72G9bcmenVILj//sv1zLNaPyYcOzUho2lIJBMh/iakJ9ygCo/hEF9cpGb61SCMEDxbbyBoVQxrt+bWKu5KGw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-destructuring": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.16.7.tgz",
+      "integrity": "sha512-VqAwhTHBnu5xBVDCvrvqJbtLUa++qZaWC0Fgr2mqokBlulZARGyIvZDoqbPlPaKImQ9dKAcCzbv+ul//uqu70A==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-dotall-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.16.7.tgz",
+      "integrity": "sha512-Lyttaao2SjZF6Pf4vk1dVKv8YypMpomAbygW+mU5cYP3S5cWTfCJjG8xV6CFdzGFlfWK81IjL9viiTvpb6G7gQ==",
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-duplicate-keys": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.16.7.tgz",
+      "integrity": "sha512-03DvpbRfvWIXyK0/6QiR1KMTWeT6OcQ7tbhjrXyFS02kjuX/mu5Bvnh5SDSWHxyawit2g5aWhKwI86EE7GUnTw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-exponentiation-operator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.16.7.tgz",
+      "integrity": "sha512-8UYLSlyLgRixQvlYH3J2ekXFHDFLQutdy7FfFAMm3CPZ6q9wHCwnUyiXpQCe3gVVnQlHc5nsuiEVziteRNTXEA==",
+      "dependencies": {
+        "@babel/helper-builder-binary-assignment-operator-visitor": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-flow-strip-types": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-flow-strip-types/-/plugin-transform-flow-strip-types-7.16.7.tgz",
+      "integrity": "sha512-mzmCq3cNsDpZZu9FADYYyfZJIOrSONmHcop2XEKPdBNMa4PDC4eEvcOvzZaCNcjKu72v0XQlA5y1g58aLRXdYg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-flow": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-for-of": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.16.7.tgz",
+      "integrity": "sha512-/QZm9W92Ptpw7sjI9Nx1mbcsWz33+l8kuMIQnDwgQBG5s3fAfQvkRjQ7NqXhtNcKOnPkdICmUHyCaWW06HCsqg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-function-name": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.16.7.tgz",
+      "integrity": "sha512-SU/C68YVwTRxqWj5kgsbKINakGag0KTgq9f2iZEXdStoAbOzLHEBRYzImmA6yFo8YZhJVflvXmIHUO7GWHmxxA==",
+      "dependencies": {
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.16.7.tgz",
+      "integrity": "sha512-6tH8RTpTWI0s2sV6uq3e/C9wPo4PTqqZps4uF0kzQ9/xPLFQtipynvmT1g/dOfEJ+0EQsHhkQ/zyRId8J2b8zQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-member-expression-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.16.7.tgz",
+      "integrity": "sha512-mBruRMbktKQwbxaJof32LT9KLy2f3gH+27a5XSuXo6h7R3vqltl0PgZ80C8ZMKw98Bf8bqt6BEVi3svOh2PzMw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-amd": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.16.7.tgz",
+      "integrity": "sha512-KaaEtgBL7FKYwjJ/teH63oAmE3lP34N3kshz8mm4VMAw7U3PxjVwwUmxEFksbgsNUaO3wId9R2AVQYSEGRa2+g==",
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-commonjs": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.16.8.tgz",
+      "integrity": "sha512-oflKPvsLT2+uKQopesJt3ApiaIS2HW+hzHFcwRNtyDGieAeC/dIHZX8buJQ2J2X1rxGPy4eRcUijm3qcSPjYcA==",
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-simple-access": "^7.16.7",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-systemjs": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.16.7.tgz",
+      "integrity": "sha512-DuK5E3k+QQmnOqBR9UkusByy5WZWGRxfzV529s9nPra1GE7olmxfqO2FHobEOYSPIjPBTr4p66YDcjQnt8cBmw==",
+      "dependencies": {
+        "@babel/helper-hoist-variables": "^7.16.7",
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-umd": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.16.7.tgz",
+      "integrity": "sha512-EMh7uolsC8O4xhudF2F6wedbSHm1HHZ0C6aJ7K67zcDNidMzVcxWdGr+htW9n21klm+bOn+Rx4CBsAntZd3rEQ==",
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-named-capturing-groups-regex": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.16.8.tgz",
+      "integrity": "sha512-j3Jw+n5PvpmhRR+mrgIh04puSANCk/T/UA3m3P1MjJkhlK906+ApHhDIqBQDdOgL/r1UYpz4GNclTXxyZrYGSw==",
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-new-target": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.16.7.tgz",
+      "integrity": "sha512-xiLDzWNMfKoGOpc6t3U+etCE2yRnn3SM09BXqWPIZOBpL2gvVrBWUKnsJx0K/ADi5F5YC5f8APFfWrz25TdlGg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-object-super": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.16.7.tgz",
+      "integrity": "sha512-14J1feiQVWaGvRxj2WjyMuXS2jsBkgB3MdSN5HuC2G5nRspa5RK9COcs82Pwy5BuGcjb+fYaUj94mYcOj7rCvw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-replace-supers": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-parameters": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.16.7.tgz",
+      "integrity": "sha512-AT3MufQ7zZEhU2hwOA11axBnExW0Lszu4RL/tAlUJBuNoRak+wehQW8h6KcXOcgjY42fHtDxswuMhMjFEuv/aw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-property-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.16.7.tgz",
+      "integrity": "sha512-z4FGr9NMGdoIl1RqavCqGG+ZuYjfZ/hkCIeuH6Do7tXmSm0ls11nYVSJqFEUOSJbDab5wC6lRE/w6YjVcr6Hqw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-regenerator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.16.7.tgz",
+      "integrity": "sha512-mF7jOgGYCkSJagJ6XCujSQg+6xC1M77/03K2oBmVJWoFGNUtnVJO4WHKJk3dnPC8HCcj4xBQP1Egm8DWh3Pb3Q==",
+      "dependencies": {
+        "regenerator-transform": "^0.14.2"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-reserved-words": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.16.7.tgz",
+      "integrity": "sha512-KQzzDnZ9hWQBjwi5lpY5v9shmm6IVG0U9pB18zvMu2i4H90xpT4gmqwPYsn8rObiadYe2M0gmgsiOIF5A/2rtg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-shorthand-properties": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.16.7.tgz",
+      "integrity": "sha512-hah2+FEnoRoATdIb05IOXf+4GzXYTq75TVhIn1PewihbpyrNWUt2JbudKQOETWw6QpLe+AIUpJ5MVLYTQbeeUg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-spread": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.16.7.tgz",
+      "integrity": "sha512-+pjJpgAngb53L0iaA5gU/1MLXJIfXcYepLgXB3esVRf4fqmj8f2cxM3/FKaHsZms08hFQJkFccEWuIpm429TXg==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.16.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-sticky-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.16.7.tgz",
+      "integrity": "sha512-NJa0Bd/87QV5NZZzTuZG5BPJjLYadeSZ9fO6oOUoL4iQx+9EEuw/eEM92SrsT19Yc2jgB1u1hsjqDtH02c3Drw==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-template-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.16.7.tgz",
+      "integrity": "sha512-VwbkDDUeenlIjmfNeDX/V0aWrQH2QiVyJtwymVQSzItFDTpxfyJh3EVaQiS0rIN/CqbLGr0VcGmuwyTdZtdIsA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-typeof-symbol": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.16.7.tgz",
+      "integrity": "sha512-p2rOixCKRJzpg9JB4gjnG4gjWkWa89ZoYUnl9snJ1cWIcTH/hvxZqfO+WjG6T8DRBpctEol5jw1O5rA8gkCokQ==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-typescript": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.16.8.tgz",
+      "integrity": "sha512-bHdQ9k7YpBDO2d0NVfkj51DpQcvwIzIusJ7mEUaMlbZq3Kt/U47j24inXZHQ5MDiYpCs+oZiwnXyKedE8+q7AQ==",
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-typescript": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-unicode-escapes": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.16.7.tgz",
+      "integrity": "sha512-TAV5IGahIz3yZ9/Hfv35TV2xEm+kaBDaZQCn2S/hG9/CZ0DktxJv9eKfPc7yYCvOYR4JGx1h8C+jcSOvgaaI/Q==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-unicode-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.16.7.tgz",
+      "integrity": "sha512-oC5tYYKw56HO75KZVLQ+R/Nl3Hro9kf8iG0hXoaHP7tjAyCpvqBiSNe6vGrZni1Z6MggmUOC6A7VP7AVmw225Q==",
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-env": {
+      "version": "7.16.11",
+      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.16.11.tgz",
+      "integrity": "sha512-qcmWG8R7ZW6WBRPZK//y+E3Cli151B20W1Rv7ln27vuPaXU/8TKms6jFdiJtF7UDTxcrb7mZd88tAeK9LjdT8g==",
+      "dependencies": {
+        "@babel/compat-data": "^7.16.8",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-validator-option": "^7.16.7",
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.16.7",
+        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.16.7",
+        "@babel/plugin-proposal-async-generator-functions": "^7.16.8",
+        "@babel/plugin-proposal-class-properties": "^7.16.7",
+        "@babel/plugin-proposal-class-static-block": "^7.16.7",
+        "@babel/plugin-proposal-dynamic-import": "^7.16.7",
+        "@babel/plugin-proposal-export-namespace-from": "^7.16.7",
+        "@babel/plugin-proposal-json-strings": "^7.16.7",
+        "@babel/plugin-proposal-logical-assignment-operators": "^7.16.7",
+        "@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.7",
+        "@babel/plugin-proposal-numeric-separator": "^7.16.7",
+        "@babel/plugin-proposal-object-rest-spread": "^7.16.7",
+        "@babel/plugin-proposal-optional-catch-binding": "^7.16.7",
+        "@babel/plugin-proposal-optional-chaining": "^7.16.7",
+        "@babel/plugin-proposal-private-methods": "^7.16.11",
+        "@babel/plugin-proposal-private-property-in-object": "^7.16.7",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.16.7",
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-class-properties": "^7.12.13",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+        "@babel/plugin-syntax-top-level-await": "^7.14.5",
+        "@babel/plugin-transform-arrow-functions": "^7.16.7",
+        "@babel/plugin-transform-async-to-generator": "^7.16.8",
+        "@babel/plugin-transform-block-scoped-functions": "^7.16.7",
+        "@babel/plugin-transform-block-scoping": "^7.16.7",
+        "@babel/plugin-transform-classes": "^7.16.7",
+        "@babel/plugin-transform-computed-properties": "^7.16.7",
+        "@babel/plugin-transform-destructuring": "^7.16.7",
+        "@babel/plugin-transform-dotall-regex": "^7.16.7",
+        "@babel/plugin-transform-duplicate-keys": "^7.16.7",
+        "@babel/plugin-transform-exponentiation-operator": "^7.16.7",
+        "@babel/plugin-transform-for-of": "^7.16.7",
+        "@babel/plugin-transform-function-name": "^7.16.7",
+        "@babel/plugin-transform-literals": "^7.16.7",
+        "@babel/plugin-transform-member-expression-literals": "^7.16.7",
+        "@babel/plugin-transform-modules-amd": "^7.16.7",
+        "@babel/plugin-transform-modules-commonjs": "^7.16.8",
+        "@babel/plugin-transform-modules-systemjs": "^7.16.7",
+        "@babel/plugin-transform-modules-umd": "^7.16.7",
+        "@babel/plugin-transform-named-capturing-groups-regex": "^7.16.8",
+        "@babel/plugin-transform-new-target": "^7.16.7",
+        "@babel/plugin-transform-object-super": "^7.16.7",
+        "@babel/plugin-transform-parameters": "^7.16.7",
+        "@babel/plugin-transform-property-literals": "^7.16.7",
+        "@babel/plugin-transform-regenerator": "^7.16.7",
+        "@babel/plugin-transform-reserved-words": "^7.16.7",
+        "@babel/plugin-transform-shorthand-properties": "^7.16.7",
+        "@babel/plugin-transform-spread": "^7.16.7",
+        "@babel/plugin-transform-sticky-regex": "^7.16.7",
+        "@babel/plugin-transform-template-literals": "^7.16.7",
+        "@babel/plugin-transform-typeof-symbol": "^7.16.7",
+        "@babel/plugin-transform-unicode-escapes": "^7.16.7",
+        "@babel/plugin-transform-unicode-regex": "^7.16.7",
+        "@babel/preset-modules": "^0.1.5",
+        "@babel/types": "^7.16.8",
+        "babel-plugin-polyfill-corejs2": "^0.3.0",
+        "babel-plugin-polyfill-corejs3": "^0.5.0",
+        "babel-plugin-polyfill-regenerator": "^0.3.0",
+        "core-js-compat": "^3.20.2",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-flow": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/preset-flow/-/preset-flow-7.16.7.tgz",
+      "integrity": "sha512-6ceP7IyZdUYQ3wUVqyRSQXztd1YmFHWI4Xv11MIqAlE4WqxBSd/FZ61V9k+TS5Gd4mkHOtQtPp9ymRpxH4y1Ug==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-validator-option": "^7.16.7",
+        "@babel/plugin-transform-flow-strip-types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-modules": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
+      "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
+        "@babel/plugin-transform-dotall-regex": "^7.4.4",
+        "@babel/types": "^7.4.4",
+        "esutils": "^2.0.2"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/register": {
+      "version": "7.16.9",
+      "resolved": "https://registry.npmjs.org/@babel/register/-/register-7.16.9.tgz",
+      "integrity": "sha512-jJ72wcghdRIlENfvALcyODhNoGE5j75cYHdC+aQMh6cU/P86tiiXTp9XYZct1UxUMo/4+BgQRyNZEGx0KWGS+g==",
+      "dependencies": {
+        "clone-deep": "^4.0.1",
+        "find-cache-dir": "^2.0.0",
+        "make-dir": "^2.1.0",
+        "pirates": "^4.0.0",
+        "source-map-support": "^0.5.16"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/runtime": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.16.7.tgz",
+      "integrity": "sha512-9E9FJowqAsytyOY6LG+1KuueckRL+aQW+mKvXRXnuFGyRAyepJPmEo9vgMfXUA6O9u3IeEdv9MAkppFcaQwogQ==",
+      "dependencies": {
+        "regenerator-runtime": "^0.13.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.16.7.tgz",
+      "integrity": "sha512-I8j/x8kHUrbYRTUxXrrMbfCa7jxkE7tZre39x3kjr9hvI82cK1FfqLygotcWN5kdPGWcLdWMHpSBavse5tWw3w==",
+      "dependencies": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/parser": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.16.10",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.16.10.tgz",
+      "integrity": "sha512-yzuaYXoRJBGMlBhsMJoUW7G1UmSb/eXr/JHYM/MsOJgavJibLwASijW7oXBdw3NQ6T0bW7Ty5P/VarOs9cHmqw==",
+      "dependencies": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/generator": "^7.16.8",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-hoist-variables": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "@babel/parser": "^7.16.10",
+        "@babel/types": "^7.16.8",
+        "debug": "^4.1.0",
+        "globals": "^11.1.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.16.8.tgz",
+      "integrity": "sha512-smN2DQc5s4M7fntyjGtyIPbRJv6wW4rU/94fmYJ7PKQuZkC0qGMHXJbg6sNGt12JmVr4k5YaptI/XtiLJBnmIg==",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "to-fast-properties": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@nicolo-ribaudo/chokidar-2": {
+      "version": "2.1.8-no-fsevents.3",
+      "resolved": "https://registry.npmjs.org/@nicolo-ribaudo/chokidar-2/-/chokidar-2-2.1.8-no-fsevents.3.tgz",
+      "integrity": "sha512-s88O1aVtXftvp5bCPB7WnmXc5IwOZZ7YPuwNPt+GtOOXpPvad1LfbmjYv+qII7zP6RU2QGnqve27dnLycEnyEQ==",
+      "optional": true
+    },
+    "node_modules/ansi-styles": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+      "dependencies": {
+        "color-convert": "^1.9.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/anymatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.2.tgz",
+      "integrity": "sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==",
+      "optional": true,
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+    },
+    "node_modules/assertion-error": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-1.1.0.tgz",
+      "integrity": "sha512-jgsaNduz+ndvGyFt3uSuWqvy4lCnIJiovtouQN5JZHOKCS2QuhEdbcQHFhVksz2N2U9hXJo8odG7ETyWlEeuDw==",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/babel-plugin-dynamic-import-node": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/babel-plugin-dynamic-import-node/-/babel-plugin-dynamic-import-node-2.3.3.tgz",
+      "integrity": "sha512-jZVI+s9Zg3IqA/kdi0i6UDCybUI3aSBLnglhYbSSjKlV7yF1F/5LWv8MakQmvYpnbJDS6fcBL2KzHSxNCMtWSQ==",
+      "dependencies": {
+        "object.assign": "^4.1.0"
+      }
+    },
+    "node_modules/babel-plugin-polyfill-corejs2": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.1.tgz",
+      "integrity": "sha512-v7/T6EQcNfVLfcN2X8Lulb7DjprieyLWJK/zOWH5DUYcAgex9sP3h25Q+DLsX9TloXe3y1O8l2q2Jv9q8UVB9w==",
+      "dependencies": {
+        "@babel/compat-data": "^7.13.11",
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "semver": "^6.1.1"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/babel-plugin-polyfill-corejs3": {
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.5.1.tgz",
+      "integrity": "sha512-TihqEe4sQcb/QcPJvxe94/9RZuLQuF1+To4WqQcRvc+3J3gLCPIPgDKzGLG6zmQLfH3nn25heRuDNkS2KR4I8A==",
+      "dependencies": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "core-js-compat": "^3.20.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/babel-plugin-polyfill-regenerator": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.3.1.tgz",
+      "integrity": "sha512-Y2B06tvgHYt1x0yz17jGkGeeMr5FeKUu+ASJ+N6nB5lQ8Dapfg42i0OVrf8PNGJ3zKL4A23snMi1IRwrqqND7A==",
+      "dependencies": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "node_modules/binary-extensions": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
+      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "optional": true,
+      "dependencies": {
+        "fill-range": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.19.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.19.1.tgz",
+      "integrity": "sha512-u2tbbG5PdKRTUoctO3NBD8FQ5HdPh1ZXPHzp1rwaa5jTc+RV9/+RlWiAIKmjRPQF+xbGM9Kklj5bZQFa2s/38A==",
+      "dependencies": {
+        "caniuse-lite": "^1.0.30001286",
+        "electron-to-chromium": "^1.4.17",
+        "escalade": "^3.1.1",
+        "node-releases": "^2.0.1",
+        "picocolors": "^1.0.0"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/browserslist"
+      }
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="
+    },
+    "node_modules/call-bind": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
+      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
+      "dependencies": {
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001304",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001304.tgz",
+      "integrity": "sha512-bdsfZd6K6ap87AGqSHJP/s1V+U6Z5lyrcbBu3ovbCCf8cSYpwTtGrCBObMpJqwxfTbLW6YTIdbb1jEeTelcpYQ==",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/browserslist"
+      }
+    },
+    "node_modules/chai": {
+      "version": "4.3.6",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-4.3.6.tgz",
+      "integrity": "sha512-bbcp3YfHCUzMOvKqsztczerVgBKSsEijCySNlHHbX3VG1nskvqjz5Rfso1gGwD6w6oOV3eI60pKuMOV5MV7p3Q==",
+      "dependencies": {
+        "assertion-error": "^1.1.0",
+        "check-error": "^1.0.2",
+        "deep-eql": "^3.0.1",
+        "get-func-name": "^2.0.0",
+        "loupe": "^2.3.1",
+        "pathval": "^1.1.1",
+        "type-detect": "^4.0.5"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+      "dependencies": {
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/check-error": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/check-error/-/check-error-1.0.2.tgz",
+      "integrity": "sha1-V00xLt2Iu13YkS6Sht1sCu1KrII=",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/chokidar": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://paulmillr.com/funding/"
+        }
+      ],
+      "optional": true,
+      "dependencies": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      },
+      "engines": {
+        "node": ">= 8.10.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/clone-deep": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-4.0.1.tgz",
+      "integrity": "sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==",
+      "dependencies": {
+        "is-plain-object": "^2.0.4",
+        "kind-of": "^6.0.2",
+        "shallow-clone": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "dependencies": {
+        "color-name": "1.1.3"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU="
+    },
+    "node_modules/commander": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
+      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/commondir": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha1-3dgA2gxmEnOTzKWVDqloo6rxJTs="
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
+    },
+    "node_modules/convert-source-map": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.8.0.tgz",
+      "integrity": "sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==",
+      "dependencies": {
+        "safe-buffer": "~5.1.1"
+      }
+    },
+    "node_modules/core-js": {
+      "version": "3.20.3",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.20.3.tgz",
+      "integrity": "sha512-vVl8j8ph6tRS3B8qir40H7yw7voy17xL0piAjlbBUsH7WIfzoedL/ZOr1OV9FyZQLWXsayOJyV4tnRyXR85/ag==",
+      "hasInstallScript": true,
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/core-js"
+      }
+    },
+    "node_modules/core-js-compat": {
+      "version": "3.20.3",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.20.3.tgz",
+      "integrity": "sha512-c8M5h0IkNZ+I92QhIpuSijOxGAcj3lgpsWdkCqmUTZNwidujF4r3pi6x1DCN+Vcs5qTS2XWWMfWSuCqyupX8gw==",
+      "dependencies": {
+        "browserslist": "^4.19.1",
+        "semver": "7.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/core-js"
+      }
+    },
+    "node_modules/core-js-compat/node_modules/semver": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.0.0.tgz",
+      "integrity": "sha512-+GB6zVA9LWh6zovYQLALHwv5rb2PHGlJi3lfiqIHxR0uuwCgefcOJc59v9fv1w8GbStwxuuqqAjI9NMAOOgq1A==",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
+      "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
+      "dependencies": {
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deep-eql": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-3.0.1.tgz",
+      "integrity": "sha512-+QeIQyN5ZuO+3Uk5DYh6/1eKO0m0YmJFGNmFHGACpf1ClL1nmlV/p4gNgbl2pJGxgXb4faqo6UE+M5ACEMyVcw==",
+      "dependencies": {
+        "type-detect": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.12"
+      }
+    },
+    "node_modules/define-properties": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.3.tgz",
+      "integrity": "sha512-3MqfYKj2lLzdMSf8ZIZE/V+Zuy+BgD6f164e8K2w7dgnpKArBDerGYpM46IYYcjnkdPNMjPk9A6VFB8+3SKlXQ==",
+      "dependencies": {
+        "object-keys": "^1.0.12"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.4.57",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.57.tgz",
+      "integrity": "sha512-FNC+P5K1n6pF+M0zIK+gFCoXcJhhzDViL3DRIGy2Fv5PohuSES1JHR7T+GlwxSxlzx4yYbsuzCZvHxcBSRCIOw=="
+    },
+    "node_modules/es-abstract": {
+      "version": "1.19.1",
+      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.19.1.tgz",
+      "integrity": "sha512-2vJ6tjA/UfqLm2MPs7jxVybLoB8i1t1Jd9R3kISld20sIxPcTbLuggQOUxeWeAvIUkduv/CfMjuh4WmiXr2v9w==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "es-to-primitive": "^1.2.1",
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.1.1",
+        "get-symbol-description": "^1.0.0",
+        "has": "^1.0.3",
+        "has-symbols": "^1.0.2",
+        "internal-slot": "^1.0.3",
+        "is-callable": "^1.2.4",
+        "is-negative-zero": "^2.0.1",
+        "is-regex": "^1.1.4",
+        "is-shared-array-buffer": "^1.0.1",
+        "is-string": "^1.0.7",
+        "is-weakref": "^1.0.1",
+        "object-inspect": "^1.11.0",
+        "object-keys": "^1.1.1",
+        "object.assign": "^4.1.2",
+        "string.prototype.trimend": "^1.0.4",
+        "string.prototype.trimstart": "^1.0.4",
+        "unbox-primitive": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/es-to-primitive": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz",
+      "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==",
+      "dependencies": {
+        "is-callable": "^1.1.4",
+        "is-date-object": "^1.0.1",
+        "is-symbol": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/escalade": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
+      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "optional": true,
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/find-cache-dir": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-2.1.0.tgz",
+      "integrity": "sha512-Tq6PixE0w/VMFfCgbONnkiQIVol/JJL7nRMi20fqzA4NRs9AfeqMGeRdPi3wIhYkxjeBaWh2rxwapn5Tu3IqOQ==",
+      "dependencies": {
+        "commondir": "^1.0.1",
+        "make-dir": "^2.0.0",
+        "pkg-dir": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-3.0.0.tgz",
+      "integrity": "sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==",
+      "dependencies": {
+        "locate-path": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/fs-readdir-recursive": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fs-readdir-recursive/-/fs-readdir-recursive-1.1.0.tgz",
+      "integrity": "sha512-GNanXlVr2pf02+sPN40XN8HG+ePaNcvM0q5mZBd668Obwb0yD5GiUbZOFgwn8kGMY6I3mdyDJzieUy3PTYyTRA=="
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8="
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "hasInstallScript": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
+      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-func-name": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/get-func-name/-/get-func-name-2.0.0.tgz",
+      "integrity": "sha1-6td0q+5y4gQJQzoGY2YCPdaIekE=",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.1.tgz",
+      "integrity": "sha512-kWZrnVM42QCiEA2Ig1bG8zjoIMOgxWwYCEeNdwY6Tv/cOSeGpcoX4pXHfKUxNKVoArnrEr2e9srnAxxGIraS9Q==",
+      "dependencies": {
+        "function-bind": "^1.1.1",
+        "has": "^1.0.3",
+        "has-symbols": "^1.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-symbol-description": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz",
+      "integrity": "sha512-2EmdH1YvIQiZpltCNgkuiUnyukzxM/R6NDJX31Ke3BG1Nq5b0S2PhX59UKi9vZpPDQVdqn+1IcaAwnzTT5vCjw==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "get-intrinsic": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/glob": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.0.tgz",
+      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "optional": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/globals": {
+      "version": "11.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/has": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
+      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
+      "dependencies": {
+        "function-bind": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/has-bigints": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.1.tgz",
+      "integrity": "sha512-LSBS2LjbNBTf6287JEbEzvJgftkF5qFkmCo9hDRpAzKhUOlJ+hx8dd4USs00SgsUNwc4617J9ki5YtEClM2ffA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.2.tgz",
+      "integrity": "sha512-chXa79rL/UC2KlX17jo3vRGz0azaWEx5tGqZg5pO3NUyEJVB17dMruQlzCCOfUvElghKcm5194+BCRvi2Rv/Gw==",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
+      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
+      "dependencies": {
+        "has-symbols": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/homedir-polyfill": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/homedir-polyfill/-/homedir-polyfill-1.0.3.tgz",
+      "integrity": "sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==",
+      "dependencies": {
+        "parse-passwd": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/internal-slot": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.3.tgz",
+      "integrity": "sha512-O0DB1JC/sPyZl7cIo78n5dR7eUSwwpYPiXRhTzNxZVAMUuB8vlnRFyLxdrVToks6XPLVnFfbzaVd5WLjhgg+vA==",
+      "dependencies": {
+        "get-intrinsic": "^1.1.0",
+        "has": "^1.0.3",
+        "side-channel": "^1.0.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/is-bigint": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz",
+      "integrity": "sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==",
+      "dependencies": {
+        "has-bigints": "^1.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "optional": true,
+      "dependencies": {
+        "binary-extensions": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-boolean-object": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz",
+      "integrity": "sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-callable": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.4.tgz",
+      "integrity": "sha512-nsuwtxZfMX67Oryl9LCQ+upnC0Z0BgpwntpS89m1H/TLF0zNfzfLMV/9Wa/6MZsj0acpEjAO0KF1xT6ZdLl95w==",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-core-module": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.8.1.tgz",
+      "integrity": "sha512-SdNCUs284hr40hFTFP6l0IfZ/RSrMXF3qgoRHd3/79unUTvrFO/JoXwkGm+5J/Oe3E/b5GsnG330uUNgRpu1PA==",
+      "dependencies": {
+        "has": "^1.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-date-object": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.5.tgz",
+      "integrity": "sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==",
+      "dependencies": {
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "optional": true,
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-negative-zero": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz",
+      "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "optional": true,
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/is-number-object": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.0.6.tgz",
+      "integrity": "sha512-bEVOqiRcvo3zO1+G2lVMy+gkkEm9Yh7cDMRusKKu5ZJKPUYSJwICTKZrNKHA2EbSP0Tu0+6B/emsYNHZyn6K8g==",
+      "dependencies": {
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-plain-object": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
+      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+      "dependencies": {
+        "isobject": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-regex": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
+      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-shared-array-buffer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.1.tgz",
+      "integrity": "sha512-IU0NmyknYZN0rChcKhRO1X8LYz5Isj/Fsqh8NJOSf+N/hCOTwy29F32Ik7a+QszE63IdvmwdTPDd6cZ5pg4cwA==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-string": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz",
+      "integrity": "sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==",
+      "dependencies": {
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-symbol": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.4.tgz",
+      "integrity": "sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==",
+      "dependencies": {
+        "has-symbols": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-weakref": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
+      "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==",
+      "dependencies": {
+        "call-bind": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/isobject": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
+      "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/iterall": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/iterall/-/iterall-1.3.0.tgz",
+      "integrity": "sha512-QZ9qOMdF+QLHxy1QIpUHUU1D5pS2CG2P69LF6L6CPjPYA/XMOmKV3PZpawHoAjHNyB0swdVTRxdYT4tbBbxqwg=="
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/jsesc": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/kind-of": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
+      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/locate-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-3.0.0.tgz",
+      "integrity": "sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==",
+      "dependencies": {
+        "p-locate": "^3.0.0",
+        "path-exists": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/lodash.debounce": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+      "integrity": "sha1-gteb/zCmfEAF/9XiUVMArZyk168="
+    },
+    "node_modules/loupe": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/loupe/-/loupe-2.3.1.tgz",
+      "integrity": "sha512-EN1D3jyVmaX4tnajVlfbREU4axL647hLec1h/PXAb8CPDMJiYitcWF2UeLVNttRqaIqQs4x+mRvXf+d+TlDrCA==",
+      "dependencies": {
+        "get-func-name": "^2.0.0"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-2.1.0.tgz",
+      "integrity": "sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==",
+      "dependencies": {
+        "pify": "^4.0.1",
+        "semver": "^5.6.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/make-dir/node_modules/semver": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
+      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
+    },
+    "node_modules/node-environment-flags": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/node-environment-flags/-/node-environment-flags-1.0.6.tgz",
+      "integrity": "sha512-5Evy2epuL+6TM0lCQGpFIj6KwiEsGh1SrHUhTbNX+sLbBtjidPZFAnVK9y5yU1+h//RitLbRHTIMyxQPtxMdHw==",
+      "dependencies": {
+        "object.getownpropertydescriptors": "^2.0.3",
+        "semver": "^5.7.0"
+      }
+    },
+    "node_modules/node-environment-flags/node_modules/semver": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
+      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.1.tgz",
+      "integrity": "sha512-CqyzN6z7Q6aMeF/ktcMVTzhAHCEpf8SOarwpzpf8pNBY2k5/oM34UHldUwp8VKI7uxct2HxSRdJjBaZeESzcxA=="
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.0.tgz",
+      "integrity": "sha512-Ho2z80bVIvJloH+YzRmpZVQe87+qASmBUKZDWgx9cu+KDrX2ZDH/3tMy+gXbZETVGs2M8YdxObOh7XAtim9Y0g==",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/object-keys": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/object.assign": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.2.tgz",
+      "integrity": "sha512-ixT2L5THXsApyiUPYKmW+2EHpXXe5Ii3M+f4e+aJFAHao5amFRW6J0OO6c/LU8Be47utCx2GL89hxGB6XSmKuQ==",
+      "dependencies": {
+        "call-bind": "^1.0.0",
+        "define-properties": "^1.1.3",
+        "has-symbols": "^1.0.1",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/object.getownpropertydescriptors": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/object.getownpropertydescriptors/-/object.getownpropertydescriptors-2.1.3.tgz",
+      "integrity": "sha512-VdDoCwvJI4QdC6ndjpqFmoL3/+HxffFBbcJzKi5hwLLqqx3mdbedRpfZDdK0SrOSauj8X4GzBvnDZl4vTN7dOw==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.1.3",
+        "es-abstract": "^1.19.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "dependencies": {
+        "p-try": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-3.0.0.tgz",
+      "integrity": "sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==",
+      "dependencies": {
+        "p-limit": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/p-try": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/parse-passwd": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/parse-passwd/-/parse-passwd-1.0.0.tgz",
+      "integrity": "sha1-bVuTSkVpk7I9N/QKOC1vFmao5cY=",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz",
+      "integrity": "sha1-zg6+ql94yxiSXqfYENe1mwEP1RU=",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="
+    },
+    "node_modules/pathval": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.1.tgz",
+      "integrity": "sha512-Dp6zGqpTdETdR63lehJYPeIOqpiNBNtc7BpWSLrOje7UaIsE5aY92r/AunQA7rsXvet3lrJ3JnZX29UPTKXyKQ==",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
+      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ=="
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "optional": true,
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pify": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-4.0.1.tgz",
+      "integrity": "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/pirates": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.5.tgz",
+      "integrity": "sha512-8V9+HQPupnaXMA23c5hvl69zXvTwTzyAYasnkb0Tts4XvO4CliqONMOnvlq26rkhLC3nWDFBJf73LU1e1VZLaQ==",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/pkg-dir": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-3.0.0.tgz",
+      "integrity": "sha512-/E57AYkoeQ25qkxMj5PBOVgF8Kiu/h7cYS30Z5+R7WaiCCBfLq58ZI/dSeaEKb9WVJV5n/03QwrN3IeWIFllvw==",
+      "dependencies": {
+        "find-up": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.5.1.tgz",
+      "integrity": "sha512-vBZcPRUR5MZJwoyi3ZoyQlc1rXeEck8KgeC9AwwOn+exuxLxq5toTRDTSaVrXHxelDMHy9zlicw8u66yxoSUFg==",
+      "dev": true,
+      "bin": {
+        "prettier": "bin-prettier.js"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "optional": true,
+      "dependencies": {
+        "picomatch": "^2.2.1"
+      },
+      "engines": {
+        "node": ">=8.10.0"
+      }
+    },
+    "node_modules/regenerate": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
+      "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A=="
+    },
+    "node_modules/regenerate-unicode-properties": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-9.0.0.tgz",
+      "integrity": "sha512-3E12UeNSPfjrgwjkR81m5J7Aw/T55Tu7nUyZVQYCKEOs+2dkxEY+DpPtZzO4YruuiPb7NkYLVcyJC4+zCbk5pA==",
+      "dependencies": {
+        "regenerate": "^1.4.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/regenerator-runtime": {
+      "version": "0.13.9",
+      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.9.tgz",
+      "integrity": "sha512-p3VT+cOEgxFsRRA9X4lkI1E+k2/CtnKtU4gcxyaCUreilL/vqI6CdZ3wxVUx3UOUg+gnUOQQcRI7BmSI656MYA=="
+    },
+    "node_modules/regenerator-transform": {
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.14.5.tgz",
+      "integrity": "sha512-eOf6vka5IO151Jfsw2NO9WpGX58W6wWmefK3I1zEGr0lOD0u8rwPaNqQL1aRxUaxLeKO3ArNh3VYg1KbaD+FFw==",
+      "dependencies": {
+        "@babel/runtime": "^7.8.4"
+      }
+    },
+    "node_modules/regexpu-core": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-4.8.0.tgz",
+      "integrity": "sha512-1F6bYsoYiz6is+oz70NWur2Vlh9KWtswuRuzJOfeYUrfPX2o8n74AnUVaOGDbUqVGO9fNHu48/pjJO4sNVwsOg==",
+      "dependencies": {
+        "regenerate": "^1.4.2",
+        "regenerate-unicode-properties": "^9.0.0",
+        "regjsgen": "^0.5.2",
+        "regjsparser": "^0.7.0",
+        "unicode-match-property-ecmascript": "^2.0.0",
+        "unicode-match-property-value-ecmascript": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/regjsgen": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.5.2.tgz",
+      "integrity": "sha512-OFFT3MfrH90xIW8OOSyUrk6QHD5E9JOTeGodiJeBS3J6IwlgzJMNE/1bZklWz5oTg+9dCMyEetclvCVXOPoN3A=="
+    },
+    "node_modules/regjsparser": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.7.0.tgz",
+      "integrity": "sha512-A4pcaORqmNMDVwUjWoTzuhwMGpP+NykpfqAsEgI1FSH/EzC7lrN5TMd+kN8YCovX+jMpu8eaqXgXPCa0g8FQNQ==",
+      "dependencies": {
+        "jsesc": "~0.5.0"
+      },
+      "bin": {
+        "regjsparser": "bin/parser"
+      }
+    },
+    "node_modules/regjsparser/node_modules/jsesc": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-0.5.0.tgz",
+      "integrity": "sha1-597mbjXW/Bb3EP6R1c9p9w8IkR0=",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      }
+    },
+    "node_modules/resolve": {
+      "version": "1.22.0",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.0.tgz",
+      "integrity": "sha512-Hhtrw0nLeSrFQ7phPp4OOcVjLPIeMnRlr5mcnVuMe7M/7eBn98A3hmFRLoFo3DLZkivSYwhRUJTyPyWAk56WLw==",
+      "dependencies": {
+        "is-core-module": "^2.8.1",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+    },
+    "node_modules/semver": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/shallow-clone": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-3.0.1.tgz",
+      "integrity": "sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==",
+      "dependencies": {
+        "kind-of": "^6.0.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/side-channel": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
+      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "dependencies": {
+        "call-bind": "^1.0.0",
+        "get-intrinsic": "^1.0.2",
+        "object-inspect": "^1.9.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/slash": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-2.0.0.tgz",
+      "integrity": "sha512-ZYKh3Wh2z1PpEXWr0MpSBZ0V6mZHAQfYevttO11c51CaWjGTaadiKZ+wVt1PbMlDV5qhMFslpZCemhwOK7C89A==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.5.7",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
+      "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/source-map-support/node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/string.prototype.trimend": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.4.tgz",
+      "integrity": "sha512-y9xCjw1P23Awk8EvTpcyL2NIr1j7wJ39f+k6lvRnSMz+mz9CGz9NYPelDk42kOz6+ql8xjfK8oYzy3jAP5QU5A==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.1.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/string.prototype.trimstart": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.4.tgz",
+      "integrity": "sha512-jh6e984OBfvxS50tdY2nRZnoC5/mLFKOREQfw8t5yytkoUsJRNxvI/E39qu1sD0OtWI3OC0XgKSmcWwziwYuZw==",
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.1.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "dependencies": {
+        "has-flag": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/to-fast-properties": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4=",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "optional": true,
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/type-detect": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
+      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unbox-primitive": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.1.tgz",
+      "integrity": "sha512-tZU/3NqK3dA5gpE1KtyiJUrEB0lxnGkMFHptJ7q6ewdZ8s12QrODwNbhIJStmJkd1QDXa1NRA8aF2A1zk/Ypyw==",
+      "dependencies": {
+        "function-bind": "^1.1.1",
+        "has-bigints": "^1.0.1",
+        "has-symbols": "^1.0.2",
+        "which-boxed-primitive": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/unicode-canonical-property-names-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unicode-match-property-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+      "dependencies": {
+        "unicode-canonical-property-names-ecmascript": "^2.0.0",
+        "unicode-property-aliases-ecmascript": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unicode-match-property-value-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-7Yhkc0Ye+t4PNYzOGKedDhXbYIBe1XEQYQxOPyhcXNMJ0WCABqqj6ckydd6pWRZTHV4GuCPKdBAUiMc60tsKVw==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unicode-property-aliases-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5Zfuy9q/DFr4tfO7ZPeVXb1aPoeQSdeFMLpYuFebehDAhbuevLs5yxSZmIFN1tP5F9Wl4IpJrYojg85/zgyZHQ==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/v8flags": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/v8flags/-/v8flags-3.2.0.tgz",
+      "integrity": "sha512-mH8etigqMfiGWdeXpaaqGfs6BndypxusHHcv2qSHyZkGEznCd/qAXCWWRzeowtL54147cktFOC4P5y+kl8d8Jg==",
+      "dependencies": {
+        "homedir-polyfill": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/which-boxed-primitive": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz",
+      "integrity": "sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg==",
+      "dependencies": {
+        "is-bigint": "^1.0.1",
+        "is-boolean-object": "^1.1.0",
+        "is-number-object": "^1.0.4",
+        "is-string": "^1.0.5",
+        "is-symbol": "^1.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+    }
+  },
+  "dependencies": {
+    "@babel/cli": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/cli/-/cli-7.16.8.tgz",
+      "integrity": "sha512-FTKBbxyk5TclXOGmwYyqelqP5IF6hMxaeJskd85jbR5jBfYlwqgwAbJwnixi1ZBbTqKfFuAA95mdmUFeSRwyJA==",
+      "requires": {
+        "@nicolo-ribaudo/chokidar-2": "2.1.8-no-fsevents.3",
+        "chokidar": "^3.4.0",
+        "commander": "^4.0.1",
+        "convert-source-map": "^1.1.0",
+        "fs-readdir-recursive": "^1.1.0",
+        "glob": "^7.0.0",
+        "make-dir": "^2.1.0",
+        "slash": "^2.0.0",
+        "source-map": "^0.5.0"
+      }
+    },
+    "@babel/code-frame": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.16.7.tgz",
+      "integrity": "sha512-iAXqUn8IIeBTNd72xsFlgaXHkMBMt6y4HJp1tIaK465CWLT/fG1aqB7ykr95gHHmlBdGbFeWWfyB4NJJ0nmeIg==",
+      "requires": {
+        "@babel/highlight": "^7.16.7"
+      }
+    },
+    "@babel/compat-data": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.16.8.tgz",
+      "integrity": "sha512-m7OkX0IdKLKPpBlJtF561YJal5y/jyI5fNfWbPxh2D/nbzzGI4qRyrD8xO2jB24u7l+5I2a43scCG2IrfjC50Q=="
+    },
+    "@babel/core": {
+      "version": "7.16.12",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.16.12.tgz",
+      "integrity": "sha512-dK5PtG1uiN2ikk++5OzSYsitZKny4wOCD0nrO4TqnW4BVBTQ2NGS3NgilvT/TEyxTST7LNyWV/T4tXDoD3fOgg==",
+      "requires": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/generator": "^7.16.8",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helpers": "^7.16.7",
+        "@babel/parser": "^7.16.12",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.10",
+        "@babel/types": "^7.16.8",
+        "convert-source-map": "^1.7.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.1.2",
+        "semver": "^6.3.0",
+        "source-map": "^0.5.0"
+      }
+    },
+    "@babel/generator": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.16.8.tgz",
+      "integrity": "sha512-1ojZwE9+lOXzcWdWmO6TbUzDfqLD39CmEhN8+2cX9XkDo5yW1OpgfejfliysR2AWLpMamTiOiAp/mtroaymhpw==",
+      "requires": {
+        "@babel/types": "^7.16.8",
+        "jsesc": "^2.5.1",
+        "source-map": "^0.5.0"
+      }
+    },
+    "@babel/helper-annotate-as-pure": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.16.7.tgz",
+      "integrity": "sha512-s6t2w/IPQVTAET1HitoowRGXooX8mCgtuP5195wD/QJPV6wYjpujCGF7JuMODVX2ZAJOf1GT6DT9MHEZvLOFSw==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-builder-binary-assignment-operator-visitor": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.16.7.tgz",
+      "integrity": "sha512-C6FdbRaxYjwVu/geKW4ZeQ0Q31AftgRcdSnZ5/jsH6BzCJbtvXvhpfkbkThYSuutZA7nCXpPR6AD9zd1dprMkA==",
+      "requires": {
+        "@babel/helper-explode-assignable-expression": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-compilation-targets": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.16.7.tgz",
+      "integrity": "sha512-mGojBwIWcwGD6rfqgRXVlVYmPAv7eOpIemUG3dGnDdCY4Pae70ROij3XmfrH6Fa1h1aiDylpglbZyktfzyo/hA==",
+      "requires": {
+        "@babel/compat-data": "^7.16.4",
+        "@babel/helper-validator-option": "^7.16.7",
+        "browserslist": "^4.17.5",
+        "semver": "^6.3.0"
+      }
+    },
+    "@babel/helper-create-class-features-plugin": {
+      "version": "7.16.10",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.16.10.tgz",
+      "integrity": "sha512-wDeej0pu3WN/ffTxMNCPW5UCiOav8IcLRxSIyp/9+IF2xJUM9h/OYjg0IJLHaL6F8oU8kqMz9nc1vryXhMsgXg==",
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-member-expression-to-functions": "^7.16.7",
+        "@babel/helper-optimise-call-expression": "^7.16.7",
+        "@babel/helper-replace-supers": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7"
+      }
+    },
+    "@babel/helper-create-regexp-features-plugin": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.16.7.tgz",
+      "integrity": "sha512-fk5A6ymfp+O5+p2yCkXAu5Kyj6v0xh0RBeNcAkYUMDvvAAoxvSKXn+Jb37t/yWFiQVDFK1ELpUTD8/aLhCPu+g==",
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "regexpu-core": "^4.7.1"
+      }
+    },
+    "@babel/helper-define-polyfill-provider": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.1.tgz",
+      "integrity": "sha512-J9hGMpJQmtWmj46B3kBHmL38UhJGhYX7eqkcq+2gsstyYt341HmPeWspihX43yVRA0mS+8GGk2Gckc7bY/HCmA==",
+      "requires": {
+        "@babel/helper-compilation-targets": "^7.13.0",
+        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/helper-plugin-utils": "^7.13.0",
+        "@babel/traverse": "^7.13.0",
+        "debug": "^4.1.1",
+        "lodash.debounce": "^4.0.8",
+        "resolve": "^1.14.2",
+        "semver": "^6.1.2"
+      }
+    },
+    "@babel/helper-environment-visitor": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.16.7.tgz",
+      "integrity": "sha512-SLLb0AAn6PkUeAfKJCCOl9e1R53pQlGAfc4y4XuMRZfqeMYLE0dM1LMhqbGAlGQY0lfw5/ohoYWAe9V1yibRag==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-explode-assignable-expression": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.16.7.tgz",
+      "integrity": "sha512-KyUenhWMC8VrxzkGP0Jizjo4/Zx+1nNZhgocs+gLzyZyB8SHidhoq9KK/8Ato4anhwsivfkBLftky7gvzbZMtQ==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-function-name": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.16.7.tgz",
+      "integrity": "sha512-QfDfEnIUyyBSR3HtrtGECuZ6DAyCkYFp7GHl75vFtTnn6pjKeK0T1DB5lLkFvBea8MdaiUABx3osbgLyInoejA==",
+      "requires": {
+        "@babel/helper-get-function-arity": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-get-function-arity": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.16.7.tgz",
+      "integrity": "sha512-flc+RLSOBXzNzVhcLu6ujeHUrD6tANAOU5ojrRx/as+tbzf8+stUCj7+IfRRoAbEZqj/ahXEMsjhOhgeZsrnTw==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-hoist-variables": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.16.7.tgz",
+      "integrity": "sha512-m04d/0Op34H5v7pbZw6pSKP7weA6lsMvfiIAMeIvkY/R4xQtBSMFEigu9QTZ2qB/9l22vsxtM8a+Q8CzD255fg==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-member-expression-to-functions": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.16.7.tgz",
+      "integrity": "sha512-VtJ/65tYiU/6AbMTDwyoXGPKHgTsfRarivm+YbB5uAzKUyuPjgZSgAFeG87FCigc7KNHu2Pegh1XIT3lXjvz3Q==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-module-imports": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.16.7.tgz",
+      "integrity": "sha512-LVtS6TqjJHFc+nYeITRo6VLXve70xmq7wPhWTqDJusJEgGmkAACWwMiTNrvfoQo6hEhFwAIixNkvB0jPXDL8Wg==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-module-transforms": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.16.7.tgz",
+      "integrity": "sha512-gaqtLDxJEFCeQbYp9aLAefjhkKdjKcdh6DB7jniIGU3Pz52WAmP268zK0VgPz9hUNkMSYeH976K2/Y6yPadpng==",
+      "requires": {
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-module-imports": "^7.16.7",
+        "@babel/helper-simple-access": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-optimise-call-expression": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.16.7.tgz",
+      "integrity": "sha512-EtgBhg7rd/JcnpZFXpBy0ze1YRfdm7BnBX4uKMBd3ixa3RGAE002JZB66FJyNH7g0F38U05pXmA5P8cBh7z+1w==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-plugin-utils": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.16.7.tgz",
+      "integrity": "sha512-Qg3Nk7ZxpgMrsox6HreY1ZNKdBq7K72tDSliA6dCl5f007jR4ne8iD5UzuNnCJH2xBf2BEEVGr+/OL6Gdp7RxA=="
+    },
+    "@babel/helper-remap-async-to-generator": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.16.8.tgz",
+      "integrity": "sha512-fm0gH7Flb8H51LqJHy3HJ3wnE1+qtYR2A99K06ahwrawLdOFsCEWjZOrYricXJHoPSudNKxrMBUPEIPxiIIvBw==",
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-wrap-function": "^7.16.8",
+        "@babel/types": "^7.16.8"
+      }
+    },
+    "@babel/helper-replace-supers": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.16.7.tgz",
+      "integrity": "sha512-y9vsWilTNaVnVh6xiJfABzsNpgDPKev9HnAgz6Gb1p6UUwf9NepdlsV7VXGCftJM+jqD5f7JIEubcpLjZj5dBw==",
+      "requires": {
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-member-expression-to-functions": "^7.16.7",
+        "@babel/helper-optimise-call-expression": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-simple-access": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.16.7.tgz",
+      "integrity": "sha512-ZIzHVyoeLMvXMN/vok/a4LWRy8G2v205mNP0XOuf9XRLyX5/u9CnVulUtDgUTama3lT+bf/UqucuZjqiGuTS1g==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-skip-transparent-expression-wrappers": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.16.0.tgz",
+      "integrity": "sha512-+il1gTy0oHwUsBQZyJvukbB4vPMdcYBrFHa0Uc4AizLxbq6BOYC51Rv4tWocX9BLBDLZ4kc6qUFpQ6HRgL+3zw==",
+      "requires": {
+        "@babel/types": "^7.16.0"
+      }
+    },
+    "@babel/helper-split-export-declaration": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.16.7.tgz",
+      "integrity": "sha512-xbWoy/PFoxSWazIToT9Sif+jJTlrMcndIsaOKvTA6u7QEo7ilkRZpjew18/W3c7nm8fXdUDXh02VXTbZ0pGDNw==",
+      "requires": {
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/helper-validator-identifier": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.16.7.tgz",
+      "integrity": "sha512-hsEnFemeiW4D08A5gUAZxLBTXpZ39P+a+DGDsHw1yxqyQ/jzFEnxf5uTEGp+3bzAbNOxU1paTgYS4ECU/IgfDw=="
+    },
+    "@babel/helper-validator-option": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.16.7.tgz",
+      "integrity": "sha512-TRtenOuRUVo9oIQGPC5G9DgK4743cdxvtOw0weQNpZXaS16SCBi5MNjZF8vba3ETURjZpTbVn7Vvcf2eAwFozQ=="
+    },
+    "@babel/helper-wrap-function": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.16.8.tgz",
+      "integrity": "sha512-8RpyRVIAW1RcDDGTA+GpPAwV22wXCfKOoM9bet6TLkGIFTkRQSkH1nMQ5Yet4MpoXe1ZwHPVtNasc2w0uZMqnw==",
+      "requires": {
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.8",
+        "@babel/types": "^7.16.8"
+      }
+    },
+    "@babel/helpers": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.16.7.tgz",
+      "integrity": "sha512-9ZDoqtfY7AuEOt3cxchfii6C7GDyyMBffktR5B2jvWv8u2+efwvpnVKXMWzNehqy68tKgAfSwfdw/lWpthS2bw==",
+      "requires": {
+        "@babel/template": "^7.16.7",
+        "@babel/traverse": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/highlight": {
+      "version": "7.16.10",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.16.10.tgz",
+      "integrity": "sha512-5FnTQLSLswEj6IkgVw5KusNUUFY9ZGqe/TRFnP/BKYHYgfh7tc+C7mwiy95/yNP7Dh9x580Vv8r7u7ZfTBFxdw==",
+      "requires": {
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "chalk": "^2.0.0",
+        "js-tokens": "^4.0.0"
+      }
+    },
+    "@babel/node": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/node/-/node-7.16.8.tgz",
+      "integrity": "sha512-V2dopEtPUL4LD+e8UtMIZB6BbsmMsS/7E1ZAvWNINzBfi7Cf3X9MLCpzHVZT4HeeF1lQl72IRtqqVt2RUImwyA==",
+      "requires": {
+        "@babel/register": "^7.16.8",
+        "commander": "^4.0.1",
+        "core-js": "^3.20.2",
+        "node-environment-flags": "^1.0.5",
+        "regenerator-runtime": "^0.13.4",
+        "v8flags": "^3.1.1"
+      }
+    },
+    "@babel/parser": {
+      "version": "7.16.12",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.16.12.tgz",
+      "integrity": "sha512-VfaV15po8RiZssrkPweyvbGVSe4x2y+aciFCgn0n0/SJMR22cwofRV1mtnJQYcSB1wUTaA/X1LnA3es66MCO5A=="
+    },
+    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.16.7.tgz",
+      "integrity": "sha512-anv/DObl7waiGEnC24O9zqL0pSuI9hljihqiDuFHC8d7/bjr/4RLGPWuc8rYOff/QPzbEPSkzG8wGG9aDuhHRg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.16.7.tgz",
+      "integrity": "sha512-di8vUHRdf+4aJ7ltXhaDbPoszdkh59AQtJM5soLsuHpQJdFQZOA4uGj0V2u/CZ8bJ/u8ULDL5yq6FO/bCXnKHw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.16.0",
+        "@babel/plugin-proposal-optional-chaining": "^7.16.7"
+      }
+    },
+    "@babel/plugin-proposal-async-generator-functions": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.16.8.tgz",
+      "integrity": "sha512-71YHIvMuiuqWJQkebWJtdhQTfd4Q4mF76q2IX37uZPkG9+olBxsX+rH1vkhFto4UeJZ9dPY2s+mDvhDm1u2BGQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-remap-async-to-generator": "^7.16.8",
+        "@babel/plugin-syntax-async-generators": "^7.8.4"
+      }
+    },
+    "@babel/plugin-proposal-class-properties": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.16.7.tgz",
+      "integrity": "sha512-IobU0Xme31ewjYOShSIqd/ZGM/r/cuOz2z0MDbNrhF5FW+ZVgi0f2lyeoj9KFPDOAqsYxmLWZte1WOwlvY9aww==",
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-proposal-class-static-block": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.16.7.tgz",
+      "integrity": "sha512-dgqJJrcZoG/4CkMopzhPJjGxsIe9A8RlkQLnL/Vhhx8AA9ZuaRwGSlscSh42hazc7WSrya/IK7mTeoF0DP9tEw==",
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5"
+      }
+    },
+    "@babel/plugin-proposal-dynamic-import": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.16.7.tgz",
+      "integrity": "sha512-I8SW9Ho3/8DRSdmDdH3gORdyUuYnk1m4cMxUAdu5oy4n3OfN8flDEH+d60iG7dUfi0KkYwSvoalHzzdRzpWHTg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-export-namespace-from": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.16.7.tgz",
+      "integrity": "sha512-ZxdtqDXLRGBL64ocZcs7ovt71L3jhC1RGSyR996svrCi3PYqHNkb3SwPJCs8RIzD86s+WPpt2S73+EHCGO+NUA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-json-strings": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.16.7.tgz",
+      "integrity": "sha512-lNZ3EEggsGY78JavgbHsK9u5P3pQaW7k4axlgFLYkMd7UBsiNahCITShLjNQschPyjtO6dADrL24757IdhBrsQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-json-strings": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-logical-assignment-operators": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.16.7.tgz",
+      "integrity": "sha512-K3XzyZJGQCr00+EtYtrDjmwX7o7PLK6U9bi1nCwkQioRFVUv6dJoxbQjtWVtP+bCPy82bONBKG8NPyQ4+i6yjg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
+      }
+    },
+    "@babel/plugin-proposal-nullish-coalescing-operator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.16.7.tgz",
+      "integrity": "sha512-aUOrYU3EVtjf62jQrCj63pYZ7k6vns2h/DQvHPWGmsJRYzWXZ6/AsfgpiRy6XiuIDADhJzP2Q9MwSMKauBQ+UQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-numeric-separator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.16.7.tgz",
+      "integrity": "sha512-vQgPMknOIgiuVqbokToyXbkY/OmmjAzr/0lhSIbG/KmnzXPGwW/AdhdKpi+O4X/VkWiWjnkKOBiqJrTaC98VKw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+      }
+    },
+    "@babel/plugin-proposal-object-rest-spread": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.16.7.tgz",
+      "integrity": "sha512-3O0Y4+dw94HA86qSg9IHfyPktgR7q3gpNVAeiKQd+8jBKFaU5NQS1Yatgo4wY+UFNuLjvxcSmzcsHqrhgTyBUA==",
+      "requires": {
+        "@babel/compat-data": "^7.16.4",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-transform-parameters": "^7.16.7"
+      }
+    },
+    "@babel/plugin-proposal-optional-catch-binding": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.16.7.tgz",
+      "integrity": "sha512-eMOH/L4OvWSZAE1VkHbr1vckLG1WUcHGJSLqqQwl2GaUqG6QjddvrOaTUMNYiv77H5IKPMZ9U9P7EaHwvAShfA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-optional-chaining": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.16.7.tgz",
+      "integrity": "sha512-eC3xy+ZrUcBtP7x+sq62Q/HYd674pPTb/77XZMb5wbDPGWIdUbSr4Agr052+zaUPSb+gGRnjxXfKFvx5iMJ+DA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.16.0",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-private-methods": {
+      "version": "7.16.11",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.16.11.tgz",
+      "integrity": "sha512-F/2uAkPlXDr8+BHpZvo19w3hLFKge+k75XUprE6jaqKxjGkSYcK+4c+bup5PdW/7W/Rpjwql7FTVEDW+fRAQsw==",
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.16.10",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-proposal-private-property-in-object": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.16.7.tgz",
+      "integrity": "sha512-rMQkjcOFbm+ufe3bTZLyOfsOUOxyvLXZJCTARhJr+8UMSoZmqTe1K1BgkFcrW37rAchWg57yI69ORxiWvUINuQ==",
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
+      }
+    },
+    "@babel/plugin-proposal-unicode-property-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.16.7.tgz",
+      "integrity": "sha512-QRK0YI/40VLhNVGIjRNAAQkEHws0cswSdFFjpFyt943YmJIU1da9uW63Iu6NFV6CxTZW5eTDCrwZUstBWgp/Rg==",
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-syntax-async-generators": {
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-class-properties": {
+      "version": "7.12.13",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.12.13"
+      }
+    },
+    "@babel/plugin-syntax-class-static-block": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      }
+    },
+    "@babel/plugin-syntax-dynamic-import": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz",
+      "integrity": "sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-export-namespace-from": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz",
+      "integrity": "sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.3"
+      }
+    },
+    "@babel/plugin-syntax-flow": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-flow/-/plugin-syntax-flow-7.16.7.tgz",
+      "integrity": "sha512-UDo3YGQO0jH6ytzVwgSLv9i/CzMcUjbKenL67dTrAZPPv6GFAtDhe6jqnvmoKzC/7htNTohhos+onPtDMqJwaQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-syntax-json-strings": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-logical-assignment-operators": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      }
+    },
+    "@babel/plugin-syntax-nullish-coalescing-operator": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-numeric-separator": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      }
+    },
+    "@babel/plugin-syntax-object-rest-spread": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-optional-catch-binding": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-optional-chaining": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-private-property-in-object": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      }
+    },
+    "@babel/plugin-syntax-top-level-await": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      }
+    },
+    "@babel/plugin-syntax-typescript": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.16.7.tgz",
+      "integrity": "sha512-YhUIJHHGkqPgEcMYkPCKTyGUdoGKWtopIycQyjJH8OjvRgOYsXsaKehLVPScKJWAULPxMa4N1vCe6szREFlZ7A==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-arrow-functions": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.16.7.tgz",
+      "integrity": "sha512-9ffkFFMbvzTvv+7dTp/66xvZAWASuPD5Tl9LK3Z9vhOmANo6j94rik+5YMBt4CwHVMWLWpMsriIc2zsa3WW3xQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-async-to-generator": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.16.8.tgz",
+      "integrity": "sha512-MtmUmTJQHCnyJVrScNzNlofQJ3dLFuobYn3mwOTKHnSCMtbNsqvF71GQmJfFjdrXSsAA7iysFmYWw4bXZ20hOg==",
+      "requires": {
+        "@babel/helper-module-imports": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-remap-async-to-generator": "^7.16.8"
+      }
+    },
+    "@babel/plugin-transform-block-scoped-functions": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.16.7.tgz",
+      "integrity": "sha512-JUuzlzmF40Z9cXyytcbZEZKckgrQzChbQJw/5PuEHYeqzCsvebDx0K0jWnIIVcmmDOAVctCgnYs0pMcrYj2zJg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-block-scoping": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.16.7.tgz",
+      "integrity": "sha512-ObZev2nxVAYA4bhyusELdo9hb3H+A56bxH3FZMbEImZFiEDYVHXQSJ1hQKFlDnlt8G9bBrCZ5ZpURZUrV4G5qQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-classes": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.16.7.tgz",
+      "integrity": "sha512-WY7og38SFAGYRe64BrjKf8OrE6ulEHtr5jEYaZMwox9KebgqPi67Zqz8K53EKk1fFEJgm96r32rkKZ3qA2nCWQ==",
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.16.7",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-optimise-call-expression": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-replace-supers": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "globals": "^11.1.0"
+      }
+    },
+    "@babel/plugin-transform-computed-properties": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.16.7.tgz",
+      "integrity": "sha512-gN72G9bcmenVILj//sv1zLNaPyYcOzUho2lIJBMh/iakJ9ygCo/hEF9cpGb61SCMEDxbbyBoVQxrt+bWKu5KGw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-destructuring": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.16.7.tgz",
+      "integrity": "sha512-VqAwhTHBnu5xBVDCvrvqJbtLUa++qZaWC0Fgr2mqokBlulZARGyIvZDoqbPlPaKImQ9dKAcCzbv+ul//uqu70A==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-dotall-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.16.7.tgz",
+      "integrity": "sha512-Lyttaao2SjZF6Pf4vk1dVKv8YypMpomAbygW+mU5cYP3S5cWTfCJjG8xV6CFdzGFlfWK81IjL9viiTvpb6G7gQ==",
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-duplicate-keys": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.16.7.tgz",
+      "integrity": "sha512-03DvpbRfvWIXyK0/6QiR1KMTWeT6OcQ7tbhjrXyFS02kjuX/mu5Bvnh5SDSWHxyawit2g5aWhKwI86EE7GUnTw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-exponentiation-operator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.16.7.tgz",
+      "integrity": "sha512-8UYLSlyLgRixQvlYH3J2ekXFHDFLQutdy7FfFAMm3CPZ6q9wHCwnUyiXpQCe3gVVnQlHc5nsuiEVziteRNTXEA==",
+      "requires": {
+        "@babel/helper-builder-binary-assignment-operator-visitor": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-flow-strip-types": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-flow-strip-types/-/plugin-transform-flow-strip-types-7.16.7.tgz",
+      "integrity": "sha512-mzmCq3cNsDpZZu9FADYYyfZJIOrSONmHcop2XEKPdBNMa4PDC4eEvcOvzZaCNcjKu72v0XQlA5y1g58aLRXdYg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-flow": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-for-of": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.16.7.tgz",
+      "integrity": "sha512-/QZm9W92Ptpw7sjI9Nx1mbcsWz33+l8kuMIQnDwgQBG5s3fAfQvkRjQ7NqXhtNcKOnPkdICmUHyCaWW06HCsqg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-function-name": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.16.7.tgz",
+      "integrity": "sha512-SU/C68YVwTRxqWj5kgsbKINakGag0KTgq9f2iZEXdStoAbOzLHEBRYzImmA6yFo8YZhJVflvXmIHUO7GWHmxxA==",
+      "requires": {
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.16.7.tgz",
+      "integrity": "sha512-6tH8RTpTWI0s2sV6uq3e/C9wPo4PTqqZps4uF0kzQ9/xPLFQtipynvmT1g/dOfEJ+0EQsHhkQ/zyRId8J2b8zQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-member-expression-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.16.7.tgz",
+      "integrity": "sha512-mBruRMbktKQwbxaJof32LT9KLy2f3gH+27a5XSuXo6h7R3vqltl0PgZ80C8ZMKw98Bf8bqt6BEVi3svOh2PzMw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-modules-amd": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.16.7.tgz",
+      "integrity": "sha512-KaaEtgBL7FKYwjJ/teH63oAmE3lP34N3kshz8mm4VMAw7U3PxjVwwUmxEFksbgsNUaO3wId9R2AVQYSEGRa2+g==",
+      "requires": {
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      }
+    },
+    "@babel/plugin-transform-modules-commonjs": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.16.8.tgz",
+      "integrity": "sha512-oflKPvsLT2+uKQopesJt3ApiaIS2HW+hzHFcwRNtyDGieAeC/dIHZX8buJQ2J2X1rxGPy4eRcUijm3qcSPjYcA==",
+      "requires": {
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-simple-access": "^7.16.7",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      }
+    },
+    "@babel/plugin-transform-modules-systemjs": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.16.7.tgz",
+      "integrity": "sha512-DuK5E3k+QQmnOqBR9UkusByy5WZWGRxfzV529s9nPra1GE7olmxfqO2FHobEOYSPIjPBTr4p66YDcjQnt8cBmw==",
+      "requires": {
+        "@babel/helper-hoist-variables": "^7.16.7",
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      }
+    },
+    "@babel/plugin-transform-modules-umd": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.16.7.tgz",
+      "integrity": "sha512-EMh7uolsC8O4xhudF2F6wedbSHm1HHZ0C6aJ7K67zcDNidMzVcxWdGr+htW9n21klm+bOn+Rx4CBsAntZd3rEQ==",
+      "requires": {
+        "@babel/helper-module-transforms": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-named-capturing-groups-regex": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.16.8.tgz",
+      "integrity": "sha512-j3Jw+n5PvpmhRR+mrgIh04puSANCk/T/UA3m3P1MjJkhlK906+ApHhDIqBQDdOgL/r1UYpz4GNclTXxyZrYGSw==",
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-new-target": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.16.7.tgz",
+      "integrity": "sha512-xiLDzWNMfKoGOpc6t3U+etCE2yRnn3SM09BXqWPIZOBpL2gvVrBWUKnsJx0K/ADi5F5YC5f8APFfWrz25TdlGg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-object-super": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.16.7.tgz",
+      "integrity": "sha512-14J1feiQVWaGvRxj2WjyMuXS2jsBkgB3MdSN5HuC2G5nRspa5RK9COcs82Pwy5BuGcjb+fYaUj94mYcOj7rCvw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-replace-supers": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-parameters": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.16.7.tgz",
+      "integrity": "sha512-AT3MufQ7zZEhU2hwOA11axBnExW0Lszu4RL/tAlUJBuNoRak+wehQW8h6KcXOcgjY42fHtDxswuMhMjFEuv/aw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-property-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.16.7.tgz",
+      "integrity": "sha512-z4FGr9NMGdoIl1RqavCqGG+ZuYjfZ/hkCIeuH6Do7tXmSm0ls11nYVSJqFEUOSJbDab5wC6lRE/w6YjVcr6Hqw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-regenerator": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.16.7.tgz",
+      "integrity": "sha512-mF7jOgGYCkSJagJ6XCujSQg+6xC1M77/03K2oBmVJWoFGNUtnVJO4WHKJk3dnPC8HCcj4xBQP1Egm8DWh3Pb3Q==",
+      "requires": {
+        "regenerator-transform": "^0.14.2"
+      }
+    },
+    "@babel/plugin-transform-reserved-words": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.16.7.tgz",
+      "integrity": "sha512-KQzzDnZ9hWQBjwi5lpY5v9shmm6IVG0U9pB18zvMu2i4H90xpT4gmqwPYsn8rObiadYe2M0gmgsiOIF5A/2rtg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-shorthand-properties": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.16.7.tgz",
+      "integrity": "sha512-hah2+FEnoRoATdIb05IOXf+4GzXYTq75TVhIn1PewihbpyrNWUt2JbudKQOETWw6QpLe+AIUpJ5MVLYTQbeeUg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-spread": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.16.7.tgz",
+      "integrity": "sha512-+pjJpgAngb53L0iaA5gU/1MLXJIfXcYepLgXB3esVRf4fqmj8f2cxM3/FKaHsZms08hFQJkFccEWuIpm429TXg==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.16.0"
+      }
+    },
+    "@babel/plugin-transform-sticky-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.16.7.tgz",
+      "integrity": "sha512-NJa0Bd/87QV5NZZzTuZG5BPJjLYadeSZ9fO6oOUoL4iQx+9EEuw/eEM92SrsT19Yc2jgB1u1hsjqDtH02c3Drw==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-template-literals": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.16.7.tgz",
+      "integrity": "sha512-VwbkDDUeenlIjmfNeDX/V0aWrQH2QiVyJtwymVQSzItFDTpxfyJh3EVaQiS0rIN/CqbLGr0VcGmuwyTdZtdIsA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-typeof-symbol": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.16.7.tgz",
+      "integrity": "sha512-p2rOixCKRJzpg9JB4gjnG4gjWkWa89ZoYUnl9snJ1cWIcTH/hvxZqfO+WjG6T8DRBpctEol5jw1O5rA8gkCokQ==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-typescript": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.16.8.tgz",
+      "integrity": "sha512-bHdQ9k7YpBDO2d0NVfkj51DpQcvwIzIusJ7mEUaMlbZq3Kt/U47j24inXZHQ5MDiYpCs+oZiwnXyKedE8+q7AQ==",
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/plugin-syntax-typescript": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-unicode-escapes": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.16.7.tgz",
+      "integrity": "sha512-TAV5IGahIz3yZ9/Hfv35TV2xEm+kaBDaZQCn2S/hG9/CZ0DktxJv9eKfPc7yYCvOYR4JGx1h8C+jcSOvgaaI/Q==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/plugin-transform-unicode-regex": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.16.7.tgz",
+      "integrity": "sha512-oC5tYYKw56HO75KZVLQ+R/Nl3Hro9kf8iG0hXoaHP7tjAyCpvqBiSNe6vGrZni1Z6MggmUOC6A7VP7AVmw225Q==",
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7"
+      }
+    },
+    "@babel/preset-env": {
+      "version": "7.16.11",
+      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.16.11.tgz",
+      "integrity": "sha512-qcmWG8R7ZW6WBRPZK//y+E3Cli151B20W1Rv7ln27vuPaXU/8TKms6jFdiJtF7UDTxcrb7mZd88tAeK9LjdT8g==",
+      "requires": {
+        "@babel/compat-data": "^7.16.8",
+        "@babel/helper-compilation-targets": "^7.16.7",
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-validator-option": "^7.16.7",
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.16.7",
+        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.16.7",
+        "@babel/plugin-proposal-async-generator-functions": "^7.16.8",
+        "@babel/plugin-proposal-class-properties": "^7.16.7",
+        "@babel/plugin-proposal-class-static-block": "^7.16.7",
+        "@babel/plugin-proposal-dynamic-import": "^7.16.7",
+        "@babel/plugin-proposal-export-namespace-from": "^7.16.7",
+        "@babel/plugin-proposal-json-strings": "^7.16.7",
+        "@babel/plugin-proposal-logical-assignment-operators": "^7.16.7",
+        "@babel/plugin-proposal-nullish-coalescing-operator": "^7.16.7",
+        "@babel/plugin-proposal-numeric-separator": "^7.16.7",
+        "@babel/plugin-proposal-object-rest-spread": "^7.16.7",
+        "@babel/plugin-proposal-optional-catch-binding": "^7.16.7",
+        "@babel/plugin-proposal-optional-chaining": "^7.16.7",
+        "@babel/plugin-proposal-private-methods": "^7.16.11",
+        "@babel/plugin-proposal-private-property-in-object": "^7.16.7",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.16.7",
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-class-properties": "^7.12.13",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+        "@babel/plugin-syntax-top-level-await": "^7.14.5",
+        "@babel/plugin-transform-arrow-functions": "^7.16.7",
+        "@babel/plugin-transform-async-to-generator": "^7.16.8",
+        "@babel/plugin-transform-block-scoped-functions": "^7.16.7",
+        "@babel/plugin-transform-block-scoping": "^7.16.7",
+        "@babel/plugin-transform-classes": "^7.16.7",
+        "@babel/plugin-transform-computed-properties": "^7.16.7",
+        "@babel/plugin-transform-destructuring": "^7.16.7",
+        "@babel/plugin-transform-dotall-regex": "^7.16.7",
+        "@babel/plugin-transform-duplicate-keys": "^7.16.7",
+        "@babel/plugin-transform-exponentiation-operator": "^7.16.7",
+        "@babel/plugin-transform-for-of": "^7.16.7",
+        "@babel/plugin-transform-function-name": "^7.16.7",
+        "@babel/plugin-transform-literals": "^7.16.7",
+        "@babel/plugin-transform-member-expression-literals": "^7.16.7",
+        "@babel/plugin-transform-modules-amd": "^7.16.7",
+        "@babel/plugin-transform-modules-commonjs": "^7.16.8",
+        "@babel/plugin-transform-modules-systemjs": "^7.16.7",
+        "@babel/plugin-transform-modules-umd": "^7.16.7",
+        "@babel/plugin-transform-named-capturing-groups-regex": "^7.16.8",
+        "@babel/plugin-transform-new-target": "^7.16.7",
+        "@babel/plugin-transform-object-super": "^7.16.7",
+        "@babel/plugin-transform-parameters": "^7.16.7",
+        "@babel/plugin-transform-property-literals": "^7.16.7",
+        "@babel/plugin-transform-regenerator": "^7.16.7",
+        "@babel/plugin-transform-reserved-words": "^7.16.7",
+        "@babel/plugin-transform-shorthand-properties": "^7.16.7",
+        "@babel/plugin-transform-spread": "^7.16.7",
+        "@babel/plugin-transform-sticky-regex": "^7.16.7",
+        "@babel/plugin-transform-template-literals": "^7.16.7",
+        "@babel/plugin-transform-typeof-symbol": "^7.16.7",
+        "@babel/plugin-transform-unicode-escapes": "^7.16.7",
+        "@babel/plugin-transform-unicode-regex": "^7.16.7",
+        "@babel/preset-modules": "^0.1.5",
+        "@babel/types": "^7.16.8",
+        "babel-plugin-polyfill-corejs2": "^0.3.0",
+        "babel-plugin-polyfill-corejs3": "^0.5.0",
+        "babel-plugin-polyfill-regenerator": "^0.3.0",
+        "core-js-compat": "^3.20.2",
+        "semver": "^6.3.0"
+      }
+    },
+    "@babel/preset-flow": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/preset-flow/-/preset-flow-7.16.7.tgz",
+      "integrity": "sha512-6ceP7IyZdUYQ3wUVqyRSQXztd1YmFHWI4Xv11MIqAlE4WqxBSd/FZ61V9k+TS5Gd4mkHOtQtPp9ymRpxH4y1Ug==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.16.7",
+        "@babel/helper-validator-option": "^7.16.7",
+        "@babel/plugin-transform-flow-strip-types": "^7.16.7"
+      }
+    },
+    "@babel/preset-modules": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
+      "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
+        "@babel/plugin-transform-dotall-regex": "^7.4.4",
+        "@babel/types": "^7.4.4",
+        "esutils": "^2.0.2"
+      }
+    },
+    "@babel/register": {
+      "version": "7.16.9",
+      "resolved": "https://registry.npmjs.org/@babel/register/-/register-7.16.9.tgz",
+      "integrity": "sha512-jJ72wcghdRIlENfvALcyODhNoGE5j75cYHdC+aQMh6cU/P86tiiXTp9XYZct1UxUMo/4+BgQRyNZEGx0KWGS+g==",
+      "requires": {
+        "clone-deep": "^4.0.1",
+        "find-cache-dir": "^2.0.0",
+        "make-dir": "^2.1.0",
+        "pirates": "^4.0.0",
+        "source-map-support": "^0.5.16"
+      }
+    },
+    "@babel/runtime": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.16.7.tgz",
+      "integrity": "sha512-9E9FJowqAsytyOY6LG+1KuueckRL+aQW+mKvXRXnuFGyRAyepJPmEo9vgMfXUA6O9u3IeEdv9MAkppFcaQwogQ==",
+      "requires": {
+        "regenerator-runtime": "^0.13.4"
+      }
+    },
+    "@babel/template": {
+      "version": "7.16.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.16.7.tgz",
+      "integrity": "sha512-I8j/x8kHUrbYRTUxXrrMbfCa7jxkE7tZre39x3kjr9hvI82cK1FfqLygotcWN5kdPGWcLdWMHpSBavse5tWw3w==",
+      "requires": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/parser": "^7.16.7",
+        "@babel/types": "^7.16.7"
+      }
+    },
+    "@babel/traverse": {
+      "version": "7.16.10",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.16.10.tgz",
+      "integrity": "sha512-yzuaYXoRJBGMlBhsMJoUW7G1UmSb/eXr/JHYM/MsOJgavJibLwASijW7oXBdw3NQ6T0bW7Ty5P/VarOs9cHmqw==",
+      "requires": {
+        "@babel/code-frame": "^7.16.7",
+        "@babel/generator": "^7.16.8",
+        "@babel/helper-environment-visitor": "^7.16.7",
+        "@babel/helper-function-name": "^7.16.7",
+        "@babel/helper-hoist-variables": "^7.16.7",
+        "@babel/helper-split-export-declaration": "^7.16.7",
+        "@babel/parser": "^7.16.10",
+        "@babel/types": "^7.16.8",
+        "debug": "^4.1.0",
+        "globals": "^11.1.0"
+      }
+    },
+    "@babel/types": {
+      "version": "7.16.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.16.8.tgz",
+      "integrity": "sha512-smN2DQc5s4M7fntyjGtyIPbRJv6wW4rU/94fmYJ7PKQuZkC0qGMHXJbg6sNGt12JmVr4k5YaptI/XtiLJBnmIg==",
+      "requires": {
+        "@babel/helper-validator-identifier": "^7.16.7",
+        "to-fast-properties": "^2.0.0"
+      }
+    },
+    "@nicolo-ribaudo/chokidar-2": {
+      "version": "2.1.8-no-fsevents.3",
+      "resolved": "https://registry.npmjs.org/@nicolo-ribaudo/chokidar-2/-/chokidar-2-2.1.8-no-fsevents.3.tgz",
+      "integrity": "sha512-s88O1aVtXftvp5bCPB7WnmXc5IwOZZ7YPuwNPt+GtOOXpPvad1LfbmjYv+qII7zP6RU2QGnqve27dnLycEnyEQ==",
+      "optional": true
+    },
+    "ansi-styles": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+      "requires": {
+        "color-convert": "^1.9.0"
+      }
+    },
+    "anymatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.2.tgz",
+      "integrity": "sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==",
+      "optional": true,
+      "requires": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      }
+    },
+    "argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+    },
+    "assertion-error": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-1.1.0.tgz",
+      "integrity": "sha512-jgsaNduz+ndvGyFt3uSuWqvy4lCnIJiovtouQN5JZHOKCS2QuhEdbcQHFhVksz2N2U9hXJo8odG7ETyWlEeuDw=="
+    },
+    "babel-plugin-dynamic-import-node": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/babel-plugin-dynamic-import-node/-/babel-plugin-dynamic-import-node-2.3.3.tgz",
+      "integrity": "sha512-jZVI+s9Zg3IqA/kdi0i6UDCybUI3aSBLnglhYbSSjKlV7yF1F/5LWv8MakQmvYpnbJDS6fcBL2KzHSxNCMtWSQ==",
+      "requires": {
+        "object.assign": "^4.1.0"
+      }
+    },
+    "babel-plugin-polyfill-corejs2": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.1.tgz",
+      "integrity": "sha512-v7/T6EQcNfVLfcN2X8Lulb7DjprieyLWJK/zOWH5DUYcAgex9sP3h25Q+DLsX9TloXe3y1O8l2q2Jv9q8UVB9w==",
+      "requires": {
+        "@babel/compat-data": "^7.13.11",
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "semver": "^6.1.1"
+      }
+    },
+    "babel-plugin-polyfill-corejs3": {
+      "version": "0.5.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.5.1.tgz",
+      "integrity": "sha512-TihqEe4sQcb/QcPJvxe94/9RZuLQuF1+To4WqQcRvc+3J3gLCPIPgDKzGLG6zmQLfH3nn25heRuDNkS2KR4I8A==",
+      "requires": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "core-js-compat": "^3.20.0"
+      }
+    },
+    "babel-plugin-polyfill-regenerator": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.3.1.tgz",
+      "integrity": "sha512-Y2B06tvgHYt1x0yz17jGkGeeMr5FeKUu+ASJ+N6nB5lQ8Dapfg42i0OVrf8PNGJ3zKL4A23snMi1IRwrqqND7A==",
+      "requires": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1"
+      }
+    },
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "binary-extensions": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
+      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
+      "optional": true
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "optional": true,
+      "requires": {
+        "fill-range": "^7.0.1"
+      }
+    },
+    "browserslist": {
+      "version": "4.19.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.19.1.tgz",
+      "integrity": "sha512-u2tbbG5PdKRTUoctO3NBD8FQ5HdPh1ZXPHzp1rwaa5jTc+RV9/+RlWiAIKmjRPQF+xbGM9Kklj5bZQFa2s/38A==",
+      "requires": {
+        "caniuse-lite": "^1.0.30001286",
+        "electron-to-chromium": "^1.4.17",
+        "escalade": "^3.1.1",
+        "node-releases": "^2.0.1",
+        "picocolors": "^1.0.0"
+      }
+    },
+    "buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="
+    },
+    "call-bind": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
+      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
+      "requires": {
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.0.2"
+      }
+    },
+    "caniuse-lite": {
+      "version": "1.0.30001304",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001304.tgz",
+      "integrity": "sha512-bdsfZd6K6ap87AGqSHJP/s1V+U6Z5lyrcbBu3ovbCCf8cSYpwTtGrCBObMpJqwxfTbLW6YTIdbb1jEeTelcpYQ=="
+    },
+    "chai": {
+      "version": "4.3.6",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-4.3.6.tgz",
+      "integrity": "sha512-bbcp3YfHCUzMOvKqsztczerVgBKSsEijCySNlHHbX3VG1nskvqjz5Rfso1gGwD6w6oOV3eI60pKuMOV5MV7p3Q==",
+      "requires": {
+        "assertion-error": "^1.1.0",
+        "check-error": "^1.0.2",
+        "deep-eql": "^3.0.1",
+        "get-func-name": "^2.0.0",
+        "loupe": "^2.3.1",
+        "pathval": "^1.1.1",
+        "type-detect": "^4.0.5"
+      }
+    },
+    "chalk": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+      "requires": {
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
+      }
+    },
+    "check-error": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/check-error/-/check-error-1.0.2.tgz",
+      "integrity": "sha1-V00xLt2Iu13YkS6Sht1sCu1KrII="
+    },
+    "chokidar": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
+      "optional": true,
+      "requires": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "fsevents": "~2.3.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      }
+    },
+    "clone-deep": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-4.0.1.tgz",
+      "integrity": "sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==",
+      "requires": {
+        "is-plain-object": "^2.0.4",
+        "kind-of": "^6.0.2",
+        "shallow-clone": "^3.0.0"
+      }
+    },
+    "color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "requires": {
+        "color-name": "1.1.3"
+      }
+    },
+    "color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU="
+    },
+    "commander": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
+      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA=="
+    },
+    "commondir": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha1-3dgA2gxmEnOTzKWVDqloo6rxJTs="
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
+    },
+    "convert-source-map": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.8.0.tgz",
+      "integrity": "sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==",
+      "requires": {
+        "safe-buffer": "~5.1.1"
+      }
+    },
+    "core-js": {
+      "version": "3.20.3",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.20.3.tgz",
+      "integrity": "sha512-vVl8j8ph6tRS3B8qir40H7yw7voy17xL0piAjlbBUsH7WIfzoedL/ZOr1OV9FyZQLWXsayOJyV4tnRyXR85/ag=="
+    },
+    "core-js-compat": {
+      "version": "3.20.3",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.20.3.tgz",
+      "integrity": "sha512-c8M5h0IkNZ+I92QhIpuSijOxGAcj3lgpsWdkCqmUTZNwidujF4r3pi6x1DCN+Vcs5qTS2XWWMfWSuCqyupX8gw==",
+      "requires": {
+        "browserslist": "^4.19.1",
+        "semver": "7.0.0"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.0.0",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.0.0.tgz",
+          "integrity": "sha512-+GB6zVA9LWh6zovYQLALHwv5rb2PHGlJi3lfiqIHxR0uuwCgefcOJc59v9fv1w8GbStwxuuqqAjI9NMAOOgq1A=="
+        }
+      }
+    },
+    "debug": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
+      "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
+      "requires": {
+        "ms": "2.1.2"
+      }
+    },
+    "deep-eql": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-3.0.1.tgz",
+      "integrity": "sha512-+QeIQyN5ZuO+3Uk5DYh6/1eKO0m0YmJFGNmFHGACpf1ClL1nmlV/p4gNgbl2pJGxgXb4faqo6UE+M5ACEMyVcw==",
+      "requires": {
+        "type-detect": "^4.0.0"
+      }
+    },
+    "define-properties": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.3.tgz",
+      "integrity": "sha512-3MqfYKj2lLzdMSf8ZIZE/V+Zuy+BgD6f164e8K2w7dgnpKArBDerGYpM46IYYcjnkdPNMjPk9A6VFB8+3SKlXQ==",
+      "requires": {
+        "object-keys": "^1.0.12"
+      }
+    },
+    "electron-to-chromium": {
+      "version": "1.4.57",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.57.tgz",
+      "integrity": "sha512-FNC+P5K1n6pF+M0zIK+gFCoXcJhhzDViL3DRIGy2Fv5PohuSES1JHR7T+GlwxSxlzx4yYbsuzCZvHxcBSRCIOw=="
+    },
+    "es-abstract": {
+      "version": "1.19.1",
+      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.19.1.tgz",
+      "integrity": "sha512-2vJ6tjA/UfqLm2MPs7jxVybLoB8i1t1Jd9R3kISld20sIxPcTbLuggQOUxeWeAvIUkduv/CfMjuh4WmiXr2v9w==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "es-to-primitive": "^1.2.1",
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.1.1",
+        "get-symbol-description": "^1.0.0",
+        "has": "^1.0.3",
+        "has-symbols": "^1.0.2",
+        "internal-slot": "^1.0.3",
+        "is-callable": "^1.2.4",
+        "is-negative-zero": "^2.0.1",
+        "is-regex": "^1.1.4",
+        "is-shared-array-buffer": "^1.0.1",
+        "is-string": "^1.0.7",
+        "is-weakref": "^1.0.1",
+        "object-inspect": "^1.11.0",
+        "object-keys": "^1.1.1",
+        "object.assign": "^4.1.2",
+        "string.prototype.trimend": "^1.0.4",
+        "string.prototype.trimstart": "^1.0.4",
+        "unbox-primitive": "^1.0.1"
+      }
+    },
+    "es-to-primitive": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz",
+      "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==",
+      "requires": {
+        "is-callable": "^1.1.4",
+        "is-date-object": "^1.0.1",
+        "is-symbol": "^1.0.2"
+      }
+    },
+    "escalade": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
+      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw=="
+    },
+    "escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ="
+    },
+    "esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="
+    },
+    "fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "optional": true,
+      "requires": {
+        "to-regex-range": "^5.0.1"
+      }
+    },
+    "find-cache-dir": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-2.1.0.tgz",
+      "integrity": "sha512-Tq6PixE0w/VMFfCgbONnkiQIVol/JJL7nRMi20fqzA4NRs9AfeqMGeRdPi3wIhYkxjeBaWh2rxwapn5Tu3IqOQ==",
+      "requires": {
+        "commondir": "^1.0.1",
+        "make-dir": "^2.0.0",
+        "pkg-dir": "^3.0.0"
+      }
+    },
+    "find-up": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-3.0.0.tgz",
+      "integrity": "sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==",
+      "requires": {
+        "locate-path": "^3.0.0"
+      }
+    },
+    "fs-readdir-recursive": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fs-readdir-recursive/-/fs-readdir-recursive-1.1.0.tgz",
+      "integrity": "sha512-GNanXlVr2pf02+sPN40XN8HG+ePaNcvM0q5mZBd668Obwb0yD5GiUbZOFgwn8kGMY6I3mdyDJzieUy3PTYyTRA=="
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8="
+    },
+    "fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "optional": true
+    },
+    "function-bind": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
+      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
+    },
+    "gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg=="
+    },
+    "get-func-name": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/get-func-name/-/get-func-name-2.0.0.tgz",
+      "integrity": "sha1-6td0q+5y4gQJQzoGY2YCPdaIekE="
+    },
+    "get-intrinsic": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.1.tgz",
+      "integrity": "sha512-kWZrnVM42QCiEA2Ig1bG8zjoIMOgxWwYCEeNdwY6Tv/cOSeGpcoX4pXHfKUxNKVoArnrEr2e9srnAxxGIraS9Q==",
+      "requires": {
+        "function-bind": "^1.1.1",
+        "has": "^1.0.3",
+        "has-symbols": "^1.0.1"
+      }
+    },
+    "get-symbol-description": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz",
+      "integrity": "sha512-2EmdH1YvIQiZpltCNgkuiUnyukzxM/R6NDJX31Ke3BG1Nq5b0S2PhX59UKi9vZpPDQVdqn+1IcaAwnzTT5vCjw==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "get-intrinsic": "^1.1.1"
+      }
+    },
+    "glob": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.0.tgz",
+      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "optional": true,
+      "requires": {
+        "is-glob": "^4.0.1"
+      }
+    },
+    "globals": {
+      "version": "11.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA=="
+    },
+    "has": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
+      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
+      "requires": {
+        "function-bind": "^1.1.1"
+      }
+    },
+    "has-bigints": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.1.tgz",
+      "integrity": "sha512-LSBS2LjbNBTf6287JEbEzvJgftkF5qFkmCo9hDRpAzKhUOlJ+hx8dd4USs00SgsUNwc4617J9ki5YtEClM2ffA=="
+    },
+    "has-flag": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0="
+    },
+    "has-symbols": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.2.tgz",
+      "integrity": "sha512-chXa79rL/UC2KlX17jo3vRGz0azaWEx5tGqZg5pO3NUyEJVB17dMruQlzCCOfUvElghKcm5194+BCRvi2Rv/Gw=="
+    },
+    "has-tostringtag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
+      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
+      "requires": {
+        "has-symbols": "^1.0.2"
+      }
+    },
+    "homedir-polyfill": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/homedir-polyfill/-/homedir-polyfill-1.0.3.tgz",
+      "integrity": "sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==",
+      "requires": {
+        "parse-passwd": "^1.0.0"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "internal-slot": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.3.tgz",
+      "integrity": "sha512-O0DB1JC/sPyZl7cIo78n5dR7eUSwwpYPiXRhTzNxZVAMUuB8vlnRFyLxdrVToks6XPLVnFfbzaVd5WLjhgg+vA==",
+      "requires": {
+        "get-intrinsic": "^1.1.0",
+        "has": "^1.0.3",
+        "side-channel": "^1.0.4"
+      }
+    },
+    "is-bigint": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz",
+      "integrity": "sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==",
+      "requires": {
+        "has-bigints": "^1.0.1"
+      }
+    },
+    "is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "optional": true,
+      "requires": {
+        "binary-extensions": "^2.0.0"
+      }
+    },
+    "is-boolean-object": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz",
+      "integrity": "sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "has-tostringtag": "^1.0.0"
+      }
+    },
+    "is-callable": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.4.tgz",
+      "integrity": "sha512-nsuwtxZfMX67Oryl9LCQ+upnC0Z0BgpwntpS89m1H/TLF0zNfzfLMV/9Wa/6MZsj0acpEjAO0KF1xT6ZdLl95w=="
+    },
+    "is-core-module": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.8.1.tgz",
+      "integrity": "sha512-SdNCUs284hr40hFTFP6l0IfZ/RSrMXF3qgoRHd3/79unUTvrFO/JoXwkGm+5J/Oe3E/b5GsnG330uUNgRpu1PA==",
+      "requires": {
+        "has": "^1.0.3"
+      }
+    },
+    "is-date-object": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.5.tgz",
+      "integrity": "sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==",
+      "requires": {
+        "has-tostringtag": "^1.0.0"
+      }
+    },
+    "is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
+      "optional": true
+    },
+    "is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "optional": true,
+      "requires": {
+        "is-extglob": "^2.1.1"
+      }
+    },
+    "is-negative-zero": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz",
+      "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA=="
+    },
+    "is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "optional": true
+    },
+    "is-number-object": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.0.6.tgz",
+      "integrity": "sha512-bEVOqiRcvo3zO1+G2lVMy+gkkEm9Yh7cDMRusKKu5ZJKPUYSJwICTKZrNKHA2EbSP0Tu0+6B/emsYNHZyn6K8g==",
+      "requires": {
+        "has-tostringtag": "^1.0.0"
+      }
+    },
+    "is-plain-object": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
+      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+      "requires": {
+        "isobject": "^3.0.1"
+      }
+    },
+    "is-regex": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
+      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "has-tostringtag": "^1.0.0"
+      }
+    },
+    "is-shared-array-buffer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.1.tgz",
+      "integrity": "sha512-IU0NmyknYZN0rChcKhRO1X8LYz5Isj/Fsqh8NJOSf+N/hCOTwy29F32Ik7a+QszE63IdvmwdTPDd6cZ5pg4cwA=="
+    },
+    "is-string": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz",
+      "integrity": "sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==",
+      "requires": {
+        "has-tostringtag": "^1.0.0"
+      }
+    },
+    "is-symbol": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.4.tgz",
+      "integrity": "sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==",
+      "requires": {
+        "has-symbols": "^1.0.2"
+      }
+    },
+    "is-weakref": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
+      "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==",
+      "requires": {
+        "call-bind": "^1.0.2"
+      }
+    },
+    "isobject": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
+      "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8="
+    },
+    "iterall": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/iterall/-/iterall-1.3.0.tgz",
+      "integrity": "sha512-QZ9qOMdF+QLHxy1QIpUHUU1D5pS2CG2P69LF6L6CPjPYA/XMOmKV3PZpawHoAjHNyB0swdVTRxdYT4tbBbxqwg=="
+    },
+    "js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
+    },
+    "js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "requires": {
+        "argparse": "^2.0.1"
+      }
+    },
+    "jsesc": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA=="
+    },
+    "json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg=="
+    },
+    "kind-of": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
+      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw=="
+    },
+    "locate-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-3.0.0.tgz",
+      "integrity": "sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==",
+      "requires": {
+        "p-locate": "^3.0.0",
+        "path-exists": "^3.0.0"
+      }
+    },
+    "lodash.debounce": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+      "integrity": "sha1-gteb/zCmfEAF/9XiUVMArZyk168="
+    },
+    "loupe": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/loupe/-/loupe-2.3.1.tgz",
+      "integrity": "sha512-EN1D3jyVmaX4tnajVlfbREU4axL647hLec1h/PXAb8CPDMJiYitcWF2UeLVNttRqaIqQs4x+mRvXf+d+TlDrCA==",
+      "requires": {
+        "get-func-name": "^2.0.0"
+      }
+    },
+    "make-dir": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-2.1.0.tgz",
+      "integrity": "sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==",
+      "requires": {
+        "pify": "^4.0.1",
+        "semver": "^5.6.0"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "5.7.1",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
+          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+        }
+      }
+    },
+    "minimatch": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
+    },
+    "node-environment-flags": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/node-environment-flags/-/node-environment-flags-1.0.6.tgz",
+      "integrity": "sha512-5Evy2epuL+6TM0lCQGpFIj6KwiEsGh1SrHUhTbNX+sLbBtjidPZFAnVK9y5yU1+h//RitLbRHTIMyxQPtxMdHw==",
+      "requires": {
+        "object.getownpropertydescriptors": "^2.0.3",
+        "semver": "^5.7.0"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "5.7.1",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
+          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+        }
+      }
+    },
+    "node-releases": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.1.tgz",
+      "integrity": "sha512-CqyzN6z7Q6aMeF/ktcMVTzhAHCEpf8SOarwpzpf8pNBY2k5/oM34UHldUwp8VKI7uxct2HxSRdJjBaZeESzcxA=="
+    },
+    "normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "optional": true
+    },
+    "object-inspect": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.0.tgz",
+      "integrity": "sha512-Ho2z80bVIvJloH+YzRmpZVQe87+qASmBUKZDWgx9cu+KDrX2ZDH/3tMy+gXbZETVGs2M8YdxObOh7XAtim9Y0g=="
+    },
+    "object-keys": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA=="
+    },
+    "object.assign": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.2.tgz",
+      "integrity": "sha512-ixT2L5THXsApyiUPYKmW+2EHpXXe5Ii3M+f4e+aJFAHao5amFRW6J0OO6c/LU8Be47utCx2GL89hxGB6XSmKuQ==",
+      "requires": {
+        "call-bind": "^1.0.0",
+        "define-properties": "^1.1.3",
+        "has-symbols": "^1.0.1",
+        "object-keys": "^1.1.1"
+      }
+    },
+    "object.getownpropertydescriptors": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/object.getownpropertydescriptors/-/object.getownpropertydescriptors-2.1.3.tgz",
+      "integrity": "sha512-VdDoCwvJI4QdC6ndjpqFmoL3/+HxffFBbcJzKi5hwLLqqx3mdbedRpfZDdK0SrOSauj8X4GzBvnDZl4vTN7dOw==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.1.3",
+        "es-abstract": "^1.19.1"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "requires": {
+        "p-try": "^2.0.0"
+      }
+    },
+    "p-locate": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-3.0.0.tgz",
+      "integrity": "sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==",
+      "requires": {
+        "p-limit": "^2.0.0"
+      }
+    },
+    "p-try": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ=="
+    },
+    "parse-passwd": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/parse-passwd/-/parse-passwd-1.0.0.tgz",
+      "integrity": "sha1-bVuTSkVpk7I9N/QKOC1vFmao5cY="
+    },
+    "path-exists": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz",
+      "integrity": "sha1-zg6+ql94yxiSXqfYENe1mwEP1RU="
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18="
+    },
+    "path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="
+    },
+    "pathval": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.1.tgz",
+      "integrity": "sha512-Dp6zGqpTdETdR63lehJYPeIOqpiNBNtc7BpWSLrOje7UaIsE5aY92r/AunQA7rsXvet3lrJ3JnZX29UPTKXyKQ=="
+    },
+    "picocolors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
+      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ=="
+    },
+    "picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "optional": true
+    },
+    "pify": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-4.0.1.tgz",
+      "integrity": "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g=="
+    },
+    "pirates": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.5.tgz",
+      "integrity": "sha512-8V9+HQPupnaXMA23c5hvl69zXvTwTzyAYasnkb0Tts4XvO4CliqONMOnvlq26rkhLC3nWDFBJf73LU1e1VZLaQ=="
+    },
+    "pkg-dir": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-3.0.0.tgz",
+      "integrity": "sha512-/E57AYkoeQ25qkxMj5PBOVgF8Kiu/h7cYS30Z5+R7WaiCCBfLq58ZI/dSeaEKb9WVJV5n/03QwrN3IeWIFllvw==",
+      "requires": {
+        "find-up": "^3.0.0"
+      }
+    },
+    "prettier": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.5.1.tgz",
+      "integrity": "sha512-vBZcPRUR5MZJwoyi3ZoyQlc1rXeEck8KgeC9AwwOn+exuxLxq5toTRDTSaVrXHxelDMHy9zlicw8u66yxoSUFg==",
+      "dev": true
+    },
+    "readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "optional": true,
+      "requires": {
+        "picomatch": "^2.2.1"
+      }
+    },
+    "regenerate": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
+      "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A=="
+    },
+    "regenerate-unicode-properties": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-9.0.0.tgz",
+      "integrity": "sha512-3E12UeNSPfjrgwjkR81m5J7Aw/T55Tu7nUyZVQYCKEOs+2dkxEY+DpPtZzO4YruuiPb7NkYLVcyJC4+zCbk5pA==",
+      "requires": {
+        "regenerate": "^1.4.2"
+      }
+    },
+    "regenerator-runtime": {
+      "version": "0.13.9",
+      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.9.tgz",
+      "integrity": "sha512-p3VT+cOEgxFsRRA9X4lkI1E+k2/CtnKtU4gcxyaCUreilL/vqI6CdZ3wxVUx3UOUg+gnUOQQcRI7BmSI656MYA=="
+    },
+    "regenerator-transform": {
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.14.5.tgz",
+      "integrity": "sha512-eOf6vka5IO151Jfsw2NO9WpGX58W6wWmefK3I1zEGr0lOD0u8rwPaNqQL1aRxUaxLeKO3ArNh3VYg1KbaD+FFw==",
+      "requires": {
+        "@babel/runtime": "^7.8.4"
+      }
+    },
+    "regexpu-core": {
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-4.8.0.tgz",
+      "integrity": "sha512-1F6bYsoYiz6is+oz70NWur2Vlh9KWtswuRuzJOfeYUrfPX2o8n74AnUVaOGDbUqVGO9fNHu48/pjJO4sNVwsOg==",
+      "requires": {
+        "regenerate": "^1.4.2",
+        "regenerate-unicode-properties": "^9.0.0",
+        "regjsgen": "^0.5.2",
+        "regjsparser": "^0.7.0",
+        "unicode-match-property-ecmascript": "^2.0.0",
+        "unicode-match-property-value-ecmascript": "^2.0.0"
+      }
+    },
+    "regjsgen": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.5.2.tgz",
+      "integrity": "sha512-OFFT3MfrH90xIW8OOSyUrk6QHD5E9JOTeGodiJeBS3J6IwlgzJMNE/1bZklWz5oTg+9dCMyEetclvCVXOPoN3A=="
+    },
+    "regjsparser": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.7.0.tgz",
+      "integrity": "sha512-A4pcaORqmNMDVwUjWoTzuhwMGpP+NykpfqAsEgI1FSH/EzC7lrN5TMd+kN8YCovX+jMpu8eaqXgXPCa0g8FQNQ==",
+      "requires": {
+        "jsesc": "~0.5.0"
+      },
+      "dependencies": {
+        "jsesc": {
+          "version": "0.5.0",
+          "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-0.5.0.tgz",
+          "integrity": "sha1-597mbjXW/Bb3EP6R1c9p9w8IkR0="
+        }
+      }
+    },
+    "resolve": {
+      "version": "1.22.0",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.0.tgz",
+      "integrity": "sha512-Hhtrw0nLeSrFQ7phPp4OOcVjLPIeMnRlr5mcnVuMe7M/7eBn98A3hmFRLoFo3DLZkivSYwhRUJTyPyWAk56WLw==",
+      "requires": {
+        "is-core-module": "^2.8.1",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      }
+    },
+    "safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+    },
+    "semver": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw=="
+    },
+    "shallow-clone": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-3.0.1.tgz",
+      "integrity": "sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==",
+      "requires": {
+        "kind-of": "^6.0.2"
+      }
+    },
+    "side-channel": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
+      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "requires": {
+        "call-bind": "^1.0.0",
+        "get-intrinsic": "^1.0.2",
+        "object-inspect": "^1.9.0"
+      }
+    },
+    "slash": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-2.0.0.tgz",
+      "integrity": "sha512-ZYKh3Wh2z1PpEXWr0MpSBZ0V6mZHAQfYevttO11c51CaWjGTaadiKZ+wVt1PbMlDV5qhMFslpZCemhwOK7C89A=="
+    },
+    "source-map": {
+      "version": "0.5.7",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
+      "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w="
+    },
+    "source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "requires": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      },
+      "dependencies": {
+        "source-map": {
+          "version": "0.6.1",
+          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="
+        }
+      }
+    },
+    "string.prototype.trimend": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.4.tgz",
+      "integrity": "sha512-y9xCjw1P23Awk8EvTpcyL2NIr1j7wJ39f+k6lvRnSMz+mz9CGz9NYPelDk42kOz6+ql8xjfK8oYzy3jAP5QU5A==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.1.3"
+      }
+    },
+    "string.prototype.trimstart": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.4.tgz",
+      "integrity": "sha512-jh6e984OBfvxS50tdY2nRZnoC5/mLFKOREQfw8t5yytkoUsJRNxvI/E39qu1sD0OtWI3OC0XgKSmcWwziwYuZw==",
+      "requires": {
+        "call-bind": "^1.0.2",
+        "define-properties": "^1.1.3"
+      }
+    },
+    "supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "requires": {
+        "has-flag": "^3.0.0"
+      }
+    },
+    "supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="
+    },
+    "to-fast-properties": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4="
+    },
+    "to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "optional": true,
+      "requires": {
+        "is-number": "^7.0.0"
+      }
+    },
+    "type-detect": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
+      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g=="
+    },
+    "unbox-primitive": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.1.tgz",
+      "integrity": "sha512-tZU/3NqK3dA5gpE1KtyiJUrEB0lxnGkMFHptJ7q6ewdZ8s12QrODwNbhIJStmJkd1QDXa1NRA8aF2A1zk/Ypyw==",
+      "requires": {
+        "function-bind": "^1.1.1",
+        "has-bigints": "^1.0.1",
+        "has-symbols": "^1.0.2",
+        "which-boxed-primitive": "^1.0.2"
+      }
+    },
+    "unicode-canonical-property-names-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ=="
+    },
+    "unicode-match-property-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+      "requires": {
+        "unicode-canonical-property-names-ecmascript": "^2.0.0",
+        "unicode-property-aliases-ecmascript": "^2.0.0"
+      }
+    },
+    "unicode-match-property-value-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-7Yhkc0Ye+t4PNYzOGKedDhXbYIBe1XEQYQxOPyhcXNMJ0WCABqqj6ckydd6pWRZTHV4GuCPKdBAUiMc60tsKVw=="
+    },
+    "unicode-property-aliases-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5Zfuy9q/DFr4tfO7ZPeVXb1aPoeQSdeFMLpYuFebehDAhbuevLs5yxSZmIFN1tP5F9Wl4IpJrYojg85/zgyZHQ=="
+    },
+    "v8flags": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/v8flags/-/v8flags-3.2.0.tgz",
+      "integrity": "sha512-mH8etigqMfiGWdeXpaaqGfs6BndypxusHHcv2qSHyZkGEznCd/qAXCWWRzeowtL54147cktFOC4P5y+kl8d8Jg==",
+      "requires": {
+        "homedir-polyfill": "^1.0.1"
+      }
+    },
+    "which-boxed-primitive": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz",
+      "integrity": "sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg==",
+      "requires": {
+        "is-bigint": "^1.0.1",
+        "is-boolean-object": "^1.1.0",
+        "is-number-object": "^1.0.4",
+        "is-string": "^1.0.5",
+        "is-symbol": "^1.0.3"
+      }
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
+    }
+  }
+}
diff --git a/internal/gqlparser/validator/imported/package.json b/internal/gqlparser/validator/imported/package.json
new file mode 100644
index 0000000000..48859f41e1
--- /dev/null
+++ b/internal/gqlparser/validator/imported/package.json
@@ -0,0 +1,19 @@
+{
+  "scripts": {
+    "fmt": "prettier -w '*.js'"
+  },
+  "dependencies": {
+    "@babel/cli": "^7.16.8",
+    "@babel/core": "^7.16.12",
+    "@babel/node": "^7.16.8",
+    "@babel/plugin-transform-typescript": "^7.16.8",
+    "@babel/preset-env": "^7.16.11",
+    "@babel/preset-flow": "^7.16.7",
+    "chai": "^4.3.6",
+    "iterall": "^1.3.0",
+    "js-yaml": "^4.0.0"
+  },
+  "devDependencies": {
+    "prettier": "^2.5.1"
+  }
+}
diff --git a/internal/gqlparser/validator/imported/readme.md b/internal/gqlparser/validator/imported/readme.md
new file mode 100644
index 0000000000..f403dfc0fe
--- /dev/null
+++ b/internal/gqlparser/validator/imported/readme.md
@@ -0,0 +1,13 @@
+# graphql.js spec importer
+
+These specs have been generated from the testsuite in [graphql/graph-js](https://github.com/graphql/graphql-js).
+
+Direct modifications should not be made, instead take a look at the exporter.
+
+```shell script
+# update to latest
+$ rm graphql-js-commit.log && ./export.sh
+
+# re-generate with known revision
+$ ./export.sh
+```
diff --git a/internal/gqlparser/validator/imported/spec/ExecutableDefinitionsRule.spec.yml b/internal/gqlparser/validator/imported/spec/ExecutableDefinitionsRule.spec.yml
new file mode 100644
index 0000000000..8286c9645e
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/ExecutableDefinitionsRule.spec.yml
@@ -0,0 +1,80 @@
+- name: with only operation
+  rule: ExecutableDefinitions
+  schema: 0
+  query: |2-
+
+          query Foo {
+            dog {
+              name
+            }
+          }
+
+  errors: []
+- name: with operation and fragment
+  rule: ExecutableDefinitions
+  schema: 0
+  query: |2-
+
+          query Foo {
+            dog {
+              name
+              ...Frag
+            }
+          }
+          
+          fragment Frag on Dog {
+            name
+          }
+
+  errors: []
+- name: with type definition
+  rule: ExecutableDefinitions
+  schema: 0
+  query: |2-
+
+          query Foo {
+            dog {
+              name
+            }
+          }
+          
+          type Cow {
+            name: String
+          }
+          
+          extend type Dog {
+            color: String
+          }
+
+  errors:
+    - message: The "Cow" definition is not executable.
+      locations:
+        - {line: 8, column: 7}
+    - message: The "Dog" definition is not executable.
+      locations:
+        - {line: 12, column: 7}
+- name: with schema definition
+  rule: ExecutableDefinitions
+  schema: 0
+  query: |2-
+
+          schema {
+            query: Query
+          }
+          
+          type Query {
+            test: String
+          }
+          
+          extend schema @directive
+
+  errors:
+    - message: The schema definition is not executable.
+      locations:
+        - {line: 2, column: 7}
+    - message: The "Query" definition is not executable.
+      locations:
+        - {line: 6, column: 7}
+    - message: The schema definition is not executable.
+      locations:
+        - {line: 10, column: 7}
diff --git a/internal/gqlparser/validator/imported/spec/FieldsOnCorrectTypeRule.spec.yml b/internal/gqlparser/validator/imported/spec/FieldsOnCorrectTypeRule.spec.yml
new file mode 100644
index 0000000000..a582cb770b
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/FieldsOnCorrectTypeRule.spec.yml
@@ -0,0 +1,244 @@
+- name: Object field selection
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment objectFieldSelection on Dog {
+            __typename
+            name
+          }
+
+  errors: []
+- name: Aliased object field selection
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment aliasedObjectFieldSelection on Dog {
+            tn : __typename
+            otherName : name
+          }
+
+  errors: []
+- name: Interface field selection
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment interfaceFieldSelection on Pet {
+            __typename
+            name
+          }
+
+  errors: []
+- name: Aliased interface field selection
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment interfaceFieldSelection on Pet {
+            otherName : name
+          }
+
+  errors: []
+- name: Lying alias selection
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment lyingAliasSelection on Dog {
+            name : nickname
+          }
+
+  errors: []
+- name: Ignores fields on unknown type
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment unknownSelection on UnknownType {
+            unknownField
+          }
+
+  errors: []
+- name: reports errors when type is known again
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment typeKnownAgain on Pet {
+            unknown_pet_field {
+              ... on Cat {
+                unknown_cat_field
+              }
+            }
+          }
+
+  errors:
+    - message: Cannot query field "unknown_pet_field" on type "Pet".
+      locations:
+        - {line: 3, column: 9}
+    - message: Cannot query field "unknown_cat_field" on type "Cat".
+      locations:
+        - {line: 5, column: 13}
+- name: Field not defined on fragment
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment fieldNotDefined on Dog {
+            meowVolume
+          }
+
+  errors:
+    - message: Cannot query field "meowVolume" on type "Dog". Did you mean "barkVolume"?
+      locations:
+        - {line: 3, column: 9}
+- name: Ignores deeply unknown field
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment deepFieldNotDefined on Dog {
+            unknown_field {
+              deeper_unknown_field
+            }
+          }
+
+  errors:
+    - message: Cannot query field "unknown_field" on type "Dog".
+      locations:
+        - {line: 3, column: 9}
+- name: Sub-field not defined
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment subFieldNotDefined on Human {
+            pets {
+              unknown_field
+            }
+          }
+
+  errors:
+    - message: Cannot query field "unknown_field" on type "Pet".
+      locations:
+        - {line: 4, column: 11}
+- name: Field not defined on inline fragment
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment fieldNotDefined on Pet {
+            ... on Dog {
+              meowVolume
+            }
+          }
+
+  errors:
+    - message: Cannot query field "meowVolume" on type "Dog". Did you mean "barkVolume"?
+      locations:
+        - {line: 4, column: 11}
+- name: Aliased field target not defined
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment aliasedFieldTargetNotDefined on Dog {
+            volume : mooVolume
+          }
+
+  errors:
+    - message: Cannot query field "mooVolume" on type "Dog". Did you mean "barkVolume"?
+      locations:
+        - {line: 3, column: 9}
+- name: Aliased lying field target not defined
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment aliasedLyingFieldTargetNotDefined on Dog {
+            barkVolume : kawVolume
+          }
+
+  errors:
+    - message: Cannot query field "kawVolume" on type "Dog". Did you mean "barkVolume"?
+      locations:
+        - {line: 3, column: 9}
+- name: Not defined on interface
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment notDefinedOnInterface on Pet {
+            tailLength
+          }
+
+  errors:
+    - message: Cannot query field "tailLength" on type "Pet".
+      locations:
+        - {line: 3, column: 9}
+- name: Defined on implementors but not on interface
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment definedOnImplementorsButNotInterface on Pet {
+            nickname
+          }
+
+  errors:
+    - message: Cannot query field "nickname" on type "Pet". Did you mean to use an inline fragment on "Cat" or "Dog"?
+      locations:
+        - {line: 3, column: 9}
+- name: Meta field selection on union
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment directFieldSelectionOnUnion on CatOrDog {
+            __typename
+          }
+
+  errors: []
+- name: Direct field selection on union
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment directFieldSelectionOnUnion on CatOrDog {
+            directField
+          }
+
+  errors:
+    - message: Cannot query field "directField" on type "CatOrDog".
+      locations:
+        - {line: 3, column: 9}
+- name: Defined on implementors queried on union
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment definedOnImplementorsQueriedOnUnion on CatOrDog {
+            name
+          }
+
+  errors:
+    - message: Cannot query field "name" on type "CatOrDog". Did you mean to use an inline fragment on "Pet", "Cat", or "Dog"?
+      locations:
+        - {line: 3, column: 9}
+- name: valid field in inline fragment
+  rule: FieldsOnCorrectType
+  schema: 1
+  query: |2-
+
+          fragment objectFieldSelection on Pet {
+            ... on Dog {
+              name
+            }
+            ... {
+              name
+            }
+          }
+
+  errors: []
diff --git a/internal/gqlparser/validator/imported/spec/FragmentsOnCompositeTypesRule.spec.yml b/internal/gqlparser/validator/imported/spec/FragmentsOnCompositeTypesRule.spec.yml
new file mode 100644
index 0000000000..3d9e7a89b7
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/FragmentsOnCompositeTypesRule.spec.yml
@@ -0,0 +1,120 @@
+- name: object is valid fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment validFragment on Dog {
+            barks
+          }
+
+  errors: []
+- name: interface is valid fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment validFragment on Pet {
+            name
+          }
+
+  errors: []
+- name: object is valid inline fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment validFragment on Pet {
+            ... on Dog {
+              barks
+            }
+          }
+
+  errors: []
+- name: interface is valid inline fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment validFragment on Mammal {
+            ... on Canine {
+              name
+            }
+          }
+
+  errors: []
+- name: inline fragment without type is valid
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment validFragment on Pet {
+            ... {
+              name
+            }
+          }
+
+  errors: []
+- name: union is valid fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment validFragment on CatOrDog {
+            __typename
+          }
+
+  errors: []
+- name: scalar is invalid fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment scalarFragment on Boolean {
+            bad
+          }
+
+  errors:
+    - message: Fragment "scalarFragment" cannot condition on non composite type "Boolean".
+      locations:
+        - {line: 2, column: 34}
+- name: enum is invalid fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment scalarFragment on FurColor {
+            bad
+          }
+
+  errors:
+    - message: Fragment "scalarFragment" cannot condition on non composite type "FurColor".
+      locations:
+        - {line: 2, column: 34}
+- name: input object is invalid fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment inputFragment on ComplexInput {
+            stringField
+          }
+
+  errors:
+    - message: Fragment "inputFragment" cannot condition on non composite type "ComplexInput".
+      locations:
+        - {line: 2, column: 33}
+- name: scalar is invalid inline fragment type
+  rule: FragmentsOnCompositeTypes
+  schema: 0
+  query: |2-
+
+          fragment invalidFragment on Pet {
+            ... on String {
+              barks
+            }
+          }
+
+  errors:
+    - message: Fragment cannot condition on non composite type "String".
+      locations:
+        - {line: 3, column: 16}
diff --git a/internal/gqlparser/validator/imported/spec/KnownArgumentNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/KnownArgumentNamesRule.spec.yml
new file mode 100644
index 0000000000..03ca5158a0
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/KnownArgumentNamesRule.spec.yml
@@ -0,0 +1,195 @@
+- name: single arg is known
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment argOnRequiredArg on Dog {
+            doesKnowCommand(dogCommand: SIT)
+          }
+
+  errors: []
+- name: multiple args are known
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment multipleArgs on ComplicatedArgs {
+            multipleReqs(req1: 1, req2: 2)
+          }
+
+  errors: []
+- name: ignores args of unknown fields
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment argOnUnknownField on Dog {
+            unknownField(unknownArg: SIT)
+          }
+
+  errors: []
+- name: multiple args in reverse order are known
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment multipleArgsReverseOrder on ComplicatedArgs {
+            multipleReqs(req2: 2, req1: 1)
+          }
+
+  errors: []
+- name: no args on optional arg
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment noArgOnOptionalArg on Dog {
+            isHouseTrained
+          }
+
+  errors: []
+- name: args are known deeply
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog {
+              doesKnowCommand(dogCommand: SIT)
+            }
+            human {
+              pet {
+                ... on Dog {
+                  doesKnowCommand(dogCommand: SIT)
+                }
+              }
+            }
+          }
+
+  errors: []
+- name: directive args are known
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog @skip(if: true)
+          }
+
+  errors: []
+- name: field args are invalid
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog @skip(unless: true)
+          }
+
+  errors:
+    - message: Unknown argument "unless" on directive "@skip".
+      locations:
+        - {line: 3, column: 19}
+- name: directive without args is valid
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog @onField
+          }
+
+  errors: []
+- name: arg passed to directive without arg is reported
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog @onField(if: true)
+          }
+
+  errors:
+    - message: Unknown argument "if" on directive "@onField".
+      locations:
+        - {line: 3, column: 22}
+- name: misspelled directive args are reported
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog @skip(iff: true)
+          }
+
+  errors:
+    - message: Unknown argument "iff" on directive "@skip". Did you mean "if"?
+      locations:
+        - {line: 3, column: 19}
+- name: invalid arg name
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment invalidArgName on Dog {
+            doesKnowCommand(unknown: true)
+          }
+
+  errors:
+    - message: Unknown argument "unknown" on field "Dog.doesKnowCommand".
+      locations:
+        - {line: 3, column: 25}
+- name: misspelled arg name is reported
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment invalidArgName on Dog {
+            doesKnowCommand(DogCommand: true)
+          }
+
+  errors:
+    - message: Unknown argument "DogCommand" on field "Dog.doesKnowCommand". Did you mean "dogCommand"?
+      locations:
+        - {line: 3, column: 25}
+- name: unknown args amongst known args
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          fragment oneGoodArgOneInvalidArg on Dog {
+            doesKnowCommand(whoKnows: 1, dogCommand: SIT, unknown: true)
+          }
+
+  errors:
+    - message: Unknown argument "whoKnows" on field "Dog.doesKnowCommand".
+      locations:
+        - {line: 3, column: 25}
+    - message: Unknown argument "unknown" on field "Dog.doesKnowCommand".
+      locations:
+        - {line: 3, column: 55}
+- name: unknown args deeply
+  rule: KnownArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            dog {
+              doesKnowCommand(unknown: true)
+            }
+            human {
+              pet {
+                ... on Dog {
+                  doesKnowCommand(unknown: true)
+                }
+              }
+            }
+          }
+
+  errors:
+    - message: Unknown argument "unknown" on field "Dog.doesKnowCommand".
+      locations:
+        - {line: 4, column: 27}
+    - message: Unknown argument "unknown" on field "Dog.doesKnowCommand".
+      locations:
+        - {line: 9, column: 31}
diff --git a/internal/gqlparser/validator/imported/spec/KnownDirectivesRule.spec.yml b/internal/gqlparser/validator/imported/spec/KnownDirectivesRule.spec.yml
new file mode 100644
index 0000000000..36fc9a5bab
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/KnownDirectivesRule.spec.yml
@@ -0,0 +1,162 @@
+- name: with no directives
+  rule: KnownDirectives
+  schema: 2
+  query: |2-
+
+          query Foo {
+            name
+            ...Frag
+          }
+          
+          fragment Frag on Dog {
+            name
+          }
+
+  errors: []
+- name: with standard directives
+  rule: KnownDirectives
+  schema: 2
+  query: |2-
+
+          {
+            human @skip(if: false) {
+              name
+              pets {
+                ... on Dog @include(if: true) {
+                  name
+                }
+              }
+            }
+          }
+
+  errors: []
+- name: with unknown directive
+  rule: KnownDirectives
+  schema: 2
+  query: |2-
+
+          {
+            human @unknown(directive: "value") {
+              name
+            }
+          }
+
+  errors:
+    - message: Unknown directive "@unknown".
+      locations:
+        - {line: 3, column: 15}
+- name: with many unknown directives
+  rule: KnownDirectives
+  schema: 2
+  query: |2-
+
+          {
+            __typename @unknown
+            human @unknown {
+              name
+              pets @unknown {
+                name
+              }
+            }
+          }
+
+  errors:
+    - message: Unknown directive "@unknown".
+      locations:
+        - {line: 3, column: 20}
+    - message: Unknown directive "@unknown".
+      locations:
+        - {line: 4, column: 15}
+    - message: Unknown directive "@unknown".
+      locations:
+        - {line: 6, column: 16}
+- name: with well placed directives
+  rule: KnownDirectives
+  schema: 2
+  query: |2-
+
+          query ($var: Boolean @onVariableDefinition) @onQuery {
+            human @onField {
+              ...Frag @onFragmentSpread
+              ... @onInlineFragment {
+                name @onField
+              }
+            }
+          }
+          
+          mutation @onMutation {
+            someField @onField
+          }
+          
+          subscription @onSubscription {
+            someField @onField
+          }
+          
+          fragment Frag on Human @onFragmentDefinition {
+            name @onField
+          }
+
+  errors: []
+- name: with misplaced directives
+  rule: KnownDirectives
+  schema: 2
+  query: |2-
+
+          query ($var: Boolean @onQuery) @onMutation {
+            human @onQuery {
+              ...Frag @onQuery
+              ... @onQuery {
+                name @onQuery
+              }
+            }
+          }
+          
+          mutation @onQuery {
+            someField @onQuery
+          }
+          
+          subscription @onQuery {
+            someField @onQuery
+          }
+          
+          fragment Frag on Human @onQuery {
+            name @onQuery
+          }
+
+  errors:
+    - message: Directive "@onQuery" may not be used on VARIABLE_DEFINITION.
+      locations:
+        - {line: 2, column: 28}
+    - message: Directive "@onMutation" may not be used on QUERY.
+      locations:
+        - {line: 2, column: 38}
+    - message: Directive "@onQuery" may not be used on FIELD.
+      locations:
+        - {line: 3, column: 15}
+    - message: Directive "@onQuery" may not be used on FRAGMENT_SPREAD.
+      locations:
+        - {line: 4, column: 19}
+    - message: Directive "@onQuery" may not be used on INLINE_FRAGMENT.
+      locations:
+        - {line: 5, column: 15}
+    - message: Directive "@onQuery" may not be used on FIELD.
+      locations:
+        - {line: 6, column: 18}
+    - message: Directive "@onQuery" may not be used on MUTATION.
+      locations:
+        - {line: 11, column: 16}
+    - message: Directive "@onQuery" may not be used on FIELD.
+      locations:
+        - {column: 19, line: 12}
+    - message: Directive "@onQuery" may not be used on SUBSCRIPTION.
+      locations:
+        - {column: 20, line: 15}
+    - message: Directive "@onQuery" may not be used on FIELD.
+      locations:
+        - {column: 19, line: 16}
+    - message: Directive "@onQuery" may not be used on FRAGMENT_DEFINITION.
+      locations:
+        - {column: 30, line: 19}
+    - message: Directive "@onQuery" may not be used on FIELD.
+      locations:
+        - {column: 14, line: 20}
diff --git a/internal/gqlparser/validator/imported/spec/KnownFragmentNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/KnownFragmentNamesRule.spec.yml
new file mode 100644
index 0000000000..ba997f49e8
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/KnownFragmentNamesRule.spec.yml
@@ -0,0 +1,56 @@
+- name: known fragment names are valid
+  rule: KnownFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            human(id: 4) {
+              ...HumanFields1
+              ... on Human {
+                ...HumanFields2
+              }
+              ... {
+                name
+              }
+            }
+          }
+          fragment HumanFields1 on Human {
+            name
+            ...HumanFields3
+          }
+          fragment HumanFields2 on Human {
+            name
+          }
+          fragment HumanFields3 on Human {
+            name
+          }
+
+  errors: []
+- name: unknown fragment names are invalid
+  rule: KnownFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            human(id: 4) {
+              ...UnknownFragment1
+              ... on Human {
+                ...UnknownFragment2
+              }
+            }
+          }
+          fragment HumanFields on Human {
+            name
+            ...UnknownFragment3
+          }
+
+  errors:
+    - message: Unknown fragment "UnknownFragment1".
+      locations:
+        - {line: 4, column: 14}
+    - message: Unknown fragment "UnknownFragment2".
+      locations:
+        - {line: 6, column: 16}
+    - message: Unknown fragment "UnknownFragment3".
+      locations:
+        - {line: 12, column: 12}
diff --git a/internal/gqlparser/validator/imported/spec/KnownTypeNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/KnownTypeNamesRule.spec.yml
new file mode 100644
index 0000000000..2007840eca
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/KnownTypeNamesRule.spec.yml
@@ -0,0 +1,64 @@
+- name: known type names are valid
+  rule: KnownTypeNames
+  schema: 0
+  query: |2-
+
+          query Foo(
+            $var: String
+            $required: [Int!]!
+            $introspectionType: __EnumValue
+          ) {
+            user(id: 4) {
+              pets { ... on Pet { name }, ...PetFields, ... { name } }
+            }
+          }
+          
+          fragment PetFields on Pet {
+            name
+          }
+
+  errors: []
+- name: unknown type names are invalid
+  rule: KnownTypeNames
+  schema: 0
+  query: |2-
+
+          query Foo($var: [JumbledUpLetters!]!) {
+            user(id: 4) {
+              name
+              pets { ... on Badger { name }, ...PetFields }
+            }
+          }
+          fragment PetFields on Peat {
+            name
+          }
+
+  errors:
+    - message: Unknown type "JumbledUpLetters".
+      locations:
+        - {line: 2, column: 24}
+    - message: Unknown type "Badger".
+      locations:
+        - {line: 5, column: 25}
+    - message: Unknown type "Peat". Did you mean "Pet" or "Cat"?
+      locations:
+        - {line: 8, column: 29}
+- name: references to standard scalars that are missing in schema
+  rule: KnownTypeNames
+  schema: 3
+  query: |2-
+
+          query ($id: ID, $float: Float, $int: Int) {
+            __typename
+          }
+
+  errors:
+    - message: Unknown type "ID".
+      locations:
+        - {line: 2, column: 19}
+    - message: Unknown type "Float".
+      locations:
+        - {line: 2, column: 31}
+    - message: Unknown type "Int".
+      locations:
+        - {line: 2, column: 44}
diff --git a/internal/gqlparser/validator/imported/spec/LoneAnonymousOperationRule.spec.yml b/internal/gqlparser/validator/imported/spec/LoneAnonymousOperationRule.spec.yml
new file mode 100644
index 0000000000..0950467b40
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/LoneAnonymousOperationRule.spec.yml
@@ -0,0 +1,98 @@
+- name: no operations
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          fragment fragA on Type {
+            field
+          }
+
+  errors: []
+- name: one anon operation
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          {
+            field
+          }
+
+  errors: []
+- name: multiple named operations
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          query Foo {
+            field
+          }
+          
+          query Bar {
+            field
+          }
+
+  errors: []
+- name: anon operation with fragment
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          {
+            ...Foo
+          }
+          fragment Foo on Type {
+            field
+          }
+
+  errors: []
+- name: multiple anon operations
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          {
+            fieldA
+          }
+          {
+            fieldB
+          }
+
+  errors:
+    - message: This anonymous operation must be the only defined operation.
+      locations:
+        - {line: 2, column: 7}
+    - message: This anonymous operation must be the only defined operation.
+      locations:
+        - {line: 5, column: 7}
+- name: anon operation with a mutation
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          {
+            fieldA
+          }
+          mutation Foo {
+            fieldB
+          }
+
+  errors:
+    - message: This anonymous operation must be the only defined operation.
+      locations:
+        - {line: 2, column: 7}
+- name: anon operation with a subscription
+  rule: LoneAnonymousOperation
+  schema: 0
+  query: |2-
+
+          {
+            fieldA
+          }
+          subscription Foo {
+            fieldB
+          }
+
+  errors:
+    - message: This anonymous operation must be the only defined operation.
+      locations:
+        - {line: 2, column: 7}
diff --git a/internal/gqlparser/validator/imported/spec/LoneSchemaDefinitionRule.spec.yml b/internal/gqlparser/validator/imported/spec/LoneSchemaDefinitionRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/LoneSchemaDefinitionRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/NoDeprecatedCustomRule.spec.yml b/internal/gqlparser/validator/imported/spec/NoDeprecatedCustomRule.spec.yml
new file mode 100644
index 0000000000..ff8df4ac56
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/NoDeprecatedCustomRule.spec.yml
@@ -0,0 +1,209 @@
+- name: no deprecated fields/ignores fields that are not deprecated
+  rule: NoDeprecatedCustom
+  schema: 4
+  query: |2-
+
+            {
+              normalField
+            }
+
+  errors: []
+- name: no deprecated fields/ignores unknown fields
+  rule: NoDeprecatedCustom
+  schema: 4
+  query: |2-
+
+            {
+              unknownField
+            }
+            
+            fragment UnknownFragment on UnknownType {
+              deprecatedField
+            }
+
+  errors: []
+- name: no deprecated fields/reports error when a deprecated field is selected
+  rule: NoDeprecatedCustom
+  schema: 4
+  query: |2-
+
+            {
+              deprecatedField
+            }
+            
+            fragment QueryFragment on Query {
+              deprecatedField
+            }
+
+  errors:
+    - message: The field Query.deprecatedField is deprecated. Some field reason.
+      locations:
+        - {line: 3, column: 11}
+    - message: The field Query.deprecatedField is deprecated. Some field reason.
+      locations:
+        - {line: 7, column: 11}
+- name: no deprecated arguments on fields/ignores arguments that are not deprecated
+  rule: NoDeprecatedCustom
+  schema: 5
+  query: |2-
+
+            {
+              normalField(normalArg: "")
+            }
+
+  errors: []
+- name: no deprecated arguments on fields/ignores unknown arguments
+  rule: NoDeprecatedCustom
+  schema: 5
+  query: |2-
+
+            {
+              someField(unknownArg: "")
+              unknownField(deprecatedArg: "")
+            }
+
+  errors: []
+- name: no deprecated arguments on fields/reports error when a deprecated argument is used
+  rule: NoDeprecatedCustom
+  schema: 5
+  query: |2-
+
+            {
+              someField(deprecatedArg: "")
+            }
+
+  errors:
+    - message: Field "Query.someField" argument "deprecatedArg" is deprecated. Some arg reason.
+      locations:
+        - {line: 3, column: 21}
+- name: no deprecated arguments on directives/ignores arguments that are not deprecated
+  rule: NoDeprecatedCustom
+  schema: 6
+  query: |2-
+
+            {
+              someField @someDirective(normalArg: "")
+            }
+
+  errors: []
+- name: no deprecated arguments on directives/ignores unknown arguments
+  rule: NoDeprecatedCustom
+  schema: 6
+  query: |2-
+
+            {
+              someField @someDirective(unknownArg: "")
+              someField @unknownDirective(deprecatedArg: "")
+            }
+
+  errors: []
+- name: no deprecated arguments on directives/reports error when a deprecated argument is used
+  rule: NoDeprecatedCustom
+  schema: 6
+  query: |2-
+
+            {
+              someField @someDirective(deprecatedArg: "")
+            }
+
+  errors:
+    - message: Directive "@someDirective" argument "deprecatedArg" is deprecated. Some arg reason.
+      locations:
+        - {line: 3, column: 36}
+- name: no deprecated input fields/ignores input fields that are not deprecated
+  rule: NoDeprecatedCustom
+  schema: 7
+  query: |2-
+
+            {
+              someField(
+                someArg: { normalField: "" }
+              ) @someDirective(someArg: { normalField: "" })
+            }
+
+  errors: []
+- name: no deprecated input fields/ignores unknown input fields
+  rule: NoDeprecatedCustom
+  schema: 7
+  query: |2-
+
+            {
+              someField(
+                someArg: { unknownField: "" }
+              )
+            
+              someField(
+                unknownArg: { unknownField: "" }
+              )
+            
+              unknownField(
+                unknownArg: { unknownField: "" }
+              )
+            }
+
+  errors: []
+- name: no deprecated input fields/reports error when a deprecated input field is used
+  rule: NoDeprecatedCustom
+  schema: 7
+  query: |2-
+
+            {
+              someField(
+                someArg: { deprecatedField: "" }
+              ) @someDirective(someArg: { deprecatedField: "" })
+            }
+
+  errors:
+    - message: The input field InputType.deprecatedField is deprecated. Some input field reason.
+      locations:
+        - {line: 4, column: 24}
+    - message: The input field InputType.deprecatedField is deprecated. Some input field reason.
+      locations:
+        - {line: 5, column: 39}
+- name: no deprecated enum values/ignores enum values that are not deprecated
+  rule: NoDeprecatedCustom
+  schema: 8
+  query: |2-
+
+            {
+              normalField(enumArg: NORMAL_VALUE)
+            }
+
+  errors: []
+- name: no deprecated enum values/ignores unknown enum values
+  rule: NoDeprecatedCustom
+  schema: 8
+  query: |2-
+
+            query (
+              $unknownValue: EnumType = UNKNOWN_VALUE
+              $unknownType: UnknownType = UNKNOWN_VALUE
+            ) {
+              someField(enumArg: UNKNOWN_VALUE)
+              someField(unknownArg: UNKNOWN_VALUE)
+              unknownField(unknownArg: UNKNOWN_VALUE)
+            }
+            
+            fragment SomeFragment on Query {
+              someField(enumArg: UNKNOWN_VALUE)
+            }
+
+  errors: []
+- name: no deprecated enum values/reports error when a deprecated enum value is used
+  rule: NoDeprecatedCustom
+  schema: 8
+  query: |2-
+
+            query (
+              $variable: EnumType = DEPRECATED_VALUE
+            ) {
+              someField(enumArg: DEPRECATED_VALUE)
+            }
+
+  errors:
+    - message: The enum value "EnumType.DEPRECATED_VALUE" is deprecated. Some enum reason.
+      locations:
+        - {line: 3, column: 33}
+    - message: The enum value "EnumType.DEPRECATED_VALUE" is deprecated. Some enum reason.
+      locations:
+        - {line: 5, column: 30}
diff --git a/internal/gqlparser/validator/imported/spec/NoFragmentCyclesRule.spec.yml b/internal/gqlparser/validator/imported/spec/NoFragmentCyclesRule.spec.yml
new file mode 100644
index 0000000000..b2bbdb8abd
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/NoFragmentCyclesRule.spec.yml
@@ -0,0 +1,225 @@
+- name: single reference is valid
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB }
+          fragment fragB on Dog { name }
+
+  errors: []
+- name: spreading twice is not circular
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB, ...fragB }
+          fragment fragB on Dog { name }
+
+  errors: []
+- name: spreading twice indirectly is not circular
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB, ...fragC }
+          fragment fragB on Dog { ...fragC }
+          fragment fragC on Dog { name }
+
+  errors: []
+- name: double spread within abstract types
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment nameFragment on Pet {
+            ... on Dog { name }
+            ... on Cat { name }
+          }
+          
+          fragment spreadsInAnon on Pet {
+            ... on Dog { ...nameFragment }
+            ... on Cat { ...nameFragment }
+          }
+
+  errors: []
+- name: does not false positive on unknown fragment
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment nameFragment on Pet {
+            ...UnknownFragment
+          }
+
+  errors: []
+- name: spreading recursively within field fails
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Human { relatives { ...fragA } },
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself.
+      locations:
+        - {line: 2, column: 45}
+- name: no spreading itself directly
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragA }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself.
+      locations:
+        - {line: 2, column: 31}
+- name: no spreading itself directly within inline fragment
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Pet {
+            ... on Dog {
+              ...fragA
+            }
+          }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself.
+      locations:
+        - {line: 4, column: 11}
+- name: no spreading itself indirectly
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB }
+          fragment fragB on Dog { ...fragA }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself via "fragB".
+      locations:
+        - {line: 2, column: 31}
+        - {line: 3, column: 31}
+- name: no spreading itself indirectly reports opposite order
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragB on Dog { ...fragA }
+          fragment fragA on Dog { ...fragB }
+
+  errors:
+    - message: Cannot spread fragment "fragB" within itself via "fragA".
+      locations:
+        - {line: 2, column: 31}
+        - {line: 3, column: 31}
+- name: no spreading itself indirectly within inline fragment
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Pet {
+            ... on Dog {
+              ...fragB
+            }
+          }
+          fragment fragB on Pet {
+            ... on Dog {
+              ...fragA
+            }
+          }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself via "fragB".
+      locations:
+        - {line: 4, column: 11}
+        - {line: 9, column: 11}
+- name: no spreading itself deeply
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB }
+          fragment fragB on Dog { ...fragC }
+          fragment fragC on Dog { ...fragO }
+          fragment fragX on Dog { ...fragY }
+          fragment fragY on Dog { ...fragZ }
+          fragment fragZ on Dog { ...fragO }
+          fragment fragO on Dog { ...fragP }
+          fragment fragP on Dog { ...fragA, ...fragX }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself via "fragB", "fragC", "fragO", "fragP".
+      locations:
+        - {line: 2, column: 31}
+        - {line: 3, column: 31}
+        - {line: 4, column: 31}
+        - {line: 8, column: 31}
+        - {line: 9, column: 31}
+    - message: Cannot spread fragment "fragO" within itself via "fragP", "fragX", "fragY", "fragZ".
+      locations:
+        - {line: 8, column: 31}
+        - {line: 9, column: 41}
+        - {line: 5, column: 31}
+        - {line: 6, column: 31}
+        - {line: 7, column: 31}
+- name: no spreading itself deeply two paths
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB, ...fragC }
+          fragment fragB on Dog { ...fragA }
+          fragment fragC on Dog { ...fragA }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself via "fragB".
+      locations:
+        - {line: 2, column: 31}
+        - {line: 3, column: 31}
+    - message: Cannot spread fragment "fragA" within itself via "fragC".
+      locations:
+        - {line: 2, column: 41}
+        - {line: 4, column: 31}
+- name: no spreading itself deeply two paths -- alt traverse order
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragC }
+          fragment fragB on Dog { ...fragC }
+          fragment fragC on Dog { ...fragA, ...fragB }
+
+  errors:
+    - message: Cannot spread fragment "fragA" within itself via "fragC".
+      locations:
+        - {line: 2, column: 31}
+        - {line: 4, column: 31}
+    - message: Cannot spread fragment "fragC" within itself via "fragB".
+      locations:
+        - {line: 4, column: 41}
+        - {line: 3, column: 31}
+- name: no spreading itself deeply and immediately
+  rule: NoFragmentCycles
+  schema: 0
+  query: |2-
+
+          fragment fragA on Dog { ...fragB }
+          fragment fragB on Dog { ...fragB, ...fragC }
+          fragment fragC on Dog { ...fragA, ...fragB }
+
+  errors:
+    - message: Cannot spread fragment "fragB" within itself.
+      locations:
+        - {line: 3, column: 31}
+    - message: Cannot spread fragment "fragA" within itself via "fragB", "fragC".
+      locations:
+        - {line: 2, column: 31}
+        - {line: 3, column: 41}
+        - {line: 4, column: 31}
+    - message: Cannot spread fragment "fragB" within itself via "fragC".
+      locations:
+        - {line: 3, column: 41}
+        - {line: 4, column: 41}
diff --git a/internal/gqlparser/validator/imported/spec/NoSchemaIntrospectionCustomRule.spec.yml b/internal/gqlparser/validator/imported/spec/NoSchemaIntrospectionCustomRule.spec.yml
new file mode 100644
index 0000000000..12ca2f27d0
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/NoSchemaIntrospectionCustomRule.spec.yml
@@ -0,0 +1,102 @@
+- name: ignores valid fields including __typename
+  rule: NoSchemaIntrospectionCustom
+  schema: 9
+  query: |2-
+
+          {
+            someQuery {
+              __typename
+              someField
+            }
+          }
+
+  errors: []
+- name: ignores fields not in the schema
+  rule: NoSchemaIntrospectionCustom
+  schema: 9
+  query: |2-
+
+          {
+            __introspect
+          }
+
+  errors: []
+- name: reports error when a field with an introspection type is requested
+  rule: NoSchemaIntrospectionCustom
+  schema: 9
+  query: |2-
+
+          {
+            __schema {
+              queryType {
+                name
+              }
+            }
+          }
+
+  errors:
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "__schema".
+      locations:
+        - {line: 3, column: 9}
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "queryType".
+      locations:
+        - {line: 4, column: 11}
+- name: reports error when a field with an introspection type is requested and aliased
+  rule: NoSchemaIntrospectionCustom
+  schema: 9
+  query: |2-
+
+          {
+            s: __schema {
+              queryType {
+                name
+              }
+            }
+          }
+
+  errors:
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "__schema".
+      locations:
+        - {line: 3, column: 9}
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "queryType".
+      locations:
+        - {line: 4, column: 11}
+- name: reports error when using a fragment with a field with an introspection type
+  rule: NoSchemaIntrospectionCustom
+  schema: 9
+  query: |2-
+
+          {
+            ...QueryFragment
+          }
+          
+          fragment QueryFragment on Query {
+            __schema {
+              queryType {
+                name
+              }
+            }
+          }
+
+  errors:
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "__schema".
+      locations:
+        - {line: 7, column: 9}
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "queryType".
+      locations:
+        - {line: 8, column: 11}
+- name: reports error for non-standard introspection fields
+  rule: NoSchemaIntrospectionCustom
+  schema: 9
+  query: |2-
+
+          {
+            someQuery {
+              introspectionField
+            }
+          }
+
+  errors:
+    - message: GraphQL introspection has been disabled, but the requested query contained the field "introspectionField".
+      locations:
+        - {line: 4, column: 11}
diff --git a/internal/gqlparser/validator/imported/spec/NoUndefinedVariablesRule.spec.yml b/internal/gqlparser/validator/imported/spec/NoUndefinedVariablesRule.spec.yml
new file mode 100644
index 0000000000..84e4c2f79d
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/NoUndefinedVariablesRule.spec.yml
@@ -0,0 +1,356 @@
+- name: all variables defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            field(a: $a, b: $b, c: $c)
+          }
+
+  errors: []
+- name: all variables deeply defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            field(a: $a) {
+              field(b: $b) {
+                field(c: $c)
+              }
+            }
+          }
+
+  errors: []
+- name: all variables deeply in inline fragments defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            ... on Type {
+              field(a: $a) {
+                field(b: $b) {
+                  ... on Type {
+                    field(c: $c)
+                  }
+                }
+              }
+            }
+          }
+
+  errors: []
+- name: all variables in fragments deeply defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragB
+            }
+          }
+          fragment FragB on Type {
+            field(b: $b) {
+              ...FragC
+            }
+          }
+          fragment FragC on Type {
+            field(c: $c)
+          }
+
+  errors: []
+- name: variable within single fragment defined in multiple operations
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String) {
+            ...FragA
+          }
+          query Bar($a: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+
+  errors: []
+- name: variable within fragments defined in operations
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String) {
+            ...FragA
+          }
+          query Bar($b: String) {
+            ...FragB
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+          fragment FragB on Type {
+            field(b: $b)
+          }
+
+  errors: []
+- name: variable within recursive fragment defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragA
+            }
+          }
+
+  errors: []
+- name: variable not defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            field(a: $a, b: $b, c: $c, d: $d)
+          }
+
+  errors:
+    - message: Variable "$d" is not defined by operation "Foo".
+      locations:
+        - {line: 3, column: 39}
+        - {line: 2, column: 7}
+- name: variable not defined by un-named query
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          {
+            field(a: $a)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined.
+      locations:
+        - {line: 3, column: 18}
+        - {line: 2, column: 7}
+- name: multiple variables not defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            field(a: $a, b: $b, c: $c)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined by operation "Foo".
+      locations:
+        - {line: 3, column: 18}
+        - {line: 2, column: 7}
+    - message: Variable "$c" is not defined by operation "Foo".
+      locations:
+        - {line: 3, column: 32}
+        - {line: 2, column: 7}
+- name: variable in fragment not defined by un-named query
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined.
+      locations:
+        - {line: 6, column: 18}
+        - {line: 2, column: 7}
+- name: variable in fragment not defined by operation
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragB
+            }
+          }
+          fragment FragB on Type {
+            field(b: $b) {
+              ...FragC
+            }
+          }
+          fragment FragC on Type {
+            field(c: $c)
+          }
+
+  errors:
+    - message: Variable "$c" is not defined by operation "Foo".
+      locations:
+        - {line: 16, column: 18}
+        - {line: 2, column: 7}
+- name: multiple variables in fragments not defined
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragB
+            }
+          }
+          fragment FragB on Type {
+            field(b: $b) {
+              ...FragC
+            }
+          }
+          fragment FragC on Type {
+            field(c: $c)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined by operation "Foo".
+      locations:
+        - {line: 6, column: 18}
+        - {line: 2, column: 7}
+    - message: Variable "$c" is not defined by operation "Foo".
+      locations:
+        - {line: 16, column: 18}
+        - {line: 2, column: 7}
+- name: single variable in fragment not defined by multiple operations
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String) {
+            ...FragAB
+          }
+          query Bar($a: String) {
+            ...FragAB
+          }
+          fragment FragAB on Type {
+            field(a: $a, b: $b)
+          }
+
+  errors:
+    - message: Variable "$b" is not defined by operation "Foo".
+      locations:
+        - {line: 9, column: 25}
+        - {line: 2, column: 7}
+    - message: Variable "$b" is not defined by operation "Bar".
+      locations:
+        - {line: 9, column: 25}
+        - {line: 5, column: 7}
+- name: variables in fragment not defined by multiple operations
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            ...FragAB
+          }
+          query Bar($a: String) {
+            ...FragAB
+          }
+          fragment FragAB on Type {
+            field(a: $a, b: $b)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined by operation "Foo".
+      locations:
+        - {line: 9, column: 18}
+        - {line: 2, column: 7}
+    - message: Variable "$b" is not defined by operation "Bar".
+      locations:
+        - {line: 9, column: 25}
+        - {line: 5, column: 7}
+- name: variable in fragment used by other operation
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            ...FragA
+          }
+          query Bar($a: String) {
+            ...FragB
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+          fragment FragB on Type {
+            field(b: $b)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined by operation "Foo".
+      locations:
+        - {line: 9, column: 18}
+        - {line: 2, column: 7}
+    - message: Variable "$b" is not defined by operation "Bar".
+      locations:
+        - {line: 12, column: 18}
+        - {line: 5, column: 7}
+- name: multiple undefined variables produce multiple errors
+  rule: NoUndefinedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            ...FragAB
+          }
+          query Bar($a: String) {
+            ...FragAB
+          }
+          fragment FragAB on Type {
+            field1(a: $a, b: $b)
+            ...FragC
+            field3(a: $a, b: $b)
+          }
+          fragment FragC on Type {
+            field2(c: $c)
+          }
+
+  errors:
+    - message: Variable "$a" is not defined by operation "Foo".
+      locations:
+        - {line: 9, column: 19}
+        - {line: 2, column: 7}
+    - message: Variable "$a" is not defined by operation "Foo".
+      locations:
+        - {line: 11, column: 19}
+        - {line: 2, column: 7}
+    - message: Variable "$c" is not defined by operation "Foo".
+      locations:
+        - {line: 14, column: 19}
+        - {line: 2, column: 7}
+    - message: Variable "$b" is not defined by operation "Bar".
+      locations:
+        - {line: 9, column: 26}
+        - {line: 5, column: 7}
+    - message: Variable "$b" is not defined by operation "Bar".
+      locations:
+        - {line: 11, column: 26}
+        - {line: 5, column: 7}
+    - message: Variable "$c" is not defined by operation "Bar".
+      locations:
+        - {line: 14, column: 19}
+        - {line: 5, column: 7}
diff --git a/internal/gqlparser/validator/imported/spec/NoUnusedFragmentsRule.spec.yml b/internal/gqlparser/validator/imported/spec/NoUnusedFragmentsRule.spec.yml
new file mode 100644
index 0000000000..42f14df085
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/NoUnusedFragmentsRule.spec.yml
@@ -0,0 +1,150 @@
+- name: all fragment names are used
+  rule: NoUnusedFragments
+  schema: 0
+  query: |2-
+
+          {
+            human(id: 4) {
+              ...HumanFields1
+              ... on Human {
+                ...HumanFields2
+              }
+            }
+          }
+          fragment HumanFields1 on Human {
+            name
+            ...HumanFields3
+          }
+          fragment HumanFields2 on Human {
+            name
+          }
+          fragment HumanFields3 on Human {
+            name
+          }
+
+  errors: []
+- name: all fragment names are used by multiple operations
+  rule: NoUnusedFragments
+  schema: 0
+  query: |2-
+
+          query Foo {
+            human(id: 4) {
+              ...HumanFields1
+            }
+          }
+          query Bar {
+            human(id: 4) {
+              ...HumanFields2
+            }
+          }
+          fragment HumanFields1 on Human {
+            name
+            ...HumanFields3
+          }
+          fragment HumanFields2 on Human {
+            name
+          }
+          fragment HumanFields3 on Human {
+            name
+          }
+
+  errors: []
+- name: contains unknown fragments
+  rule: NoUnusedFragments
+  schema: 0
+  query: |2-
+
+          query Foo {
+            human(id: 4) {
+              ...HumanFields1
+            }
+          }
+          query Bar {
+            human(id: 4) {
+              ...HumanFields2
+            }
+          }
+          fragment HumanFields1 on Human {
+            name
+            ...HumanFields3
+          }
+          fragment HumanFields2 on Human {
+            name
+          }
+          fragment HumanFields3 on Human {
+            name
+          }
+          fragment Unused1 on Human {
+            name
+          }
+          fragment Unused2 on Human {
+            name
+          }
+
+  errors:
+    - message: Fragment "Unused1" is never used.
+      locations:
+        - {line: 22, column: 7}
+    - message: Fragment "Unused2" is never used.
+      locations:
+        - {line: 25, column: 7}
+- name: contains unknown fragments with ref cycle
+  rule: NoUnusedFragments
+  schema: 0
+  query: |2-
+
+          query Foo {
+            human(id: 4) {
+              ...HumanFields1
+            }
+          }
+          query Bar {
+            human(id: 4) {
+              ...HumanFields2
+            }
+          }
+          fragment HumanFields1 on Human {
+            name
+            ...HumanFields3
+          }
+          fragment HumanFields2 on Human {
+            name
+          }
+          fragment HumanFields3 on Human {
+            name
+          }
+          fragment Unused1 on Human {
+            name
+            ...Unused2
+          }
+          fragment Unused2 on Human {
+            name
+            ...Unused1
+          }
+
+  errors:
+    - message: Fragment "Unused1" is never used.
+      locations:
+        - {line: 22, column: 7}
+    - message: Fragment "Unused2" is never used.
+      locations:
+        - {line: 26, column: 7}
+- name: contains unknown and undef fragments
+  rule: NoUnusedFragments
+  schema: 0
+  query: |2-
+
+          query Foo {
+            human(id: 4) {
+              ...bar
+            }
+          }
+          fragment foo on Human {
+            name
+          }
+
+  errors:
+    - message: Fragment "foo" is never used.
+      locations:
+        - {line: 7, column: 7}
diff --git a/internal/gqlparser/validator/imported/spec/NoUnusedVariablesRule.spec.yml b/internal/gqlparser/validator/imported/spec/NoUnusedVariablesRule.spec.yml
new file mode 100644
index 0000000000..515a9ffaeb
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/NoUnusedVariablesRule.spec.yml
@@ -0,0 +1,227 @@
+- name: uses all variables
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query ($a: String, $b: String, $c: String) {
+            field(a: $a, b: $b, c: $c)
+          }
+
+  errors: []
+- name: uses all variables deeply
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            field(a: $a) {
+              field(b: $b) {
+                field(c: $c)
+              }
+            }
+          }
+
+  errors: []
+- name: uses all variables deeply in inline fragments
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            ... on Type {
+              field(a: $a) {
+                field(b: $b) {
+                  ... on Type {
+                    field(c: $c)
+                  }
+                }
+              }
+            }
+          }
+
+  errors: []
+- name: uses all variables in fragments
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragB
+            }
+          }
+          fragment FragB on Type {
+            field(b: $b) {
+              ...FragC
+            }
+          }
+          fragment FragC on Type {
+            field(c: $c)
+          }
+
+  errors: []
+- name: variable used by fragment in multiple operations
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String) {
+            ...FragA
+          }
+          query Bar($b: String) {
+            ...FragB
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+          fragment FragB on Type {
+            field(b: $b)
+          }
+
+  errors: []
+- name: variable used by recursive fragment
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragA
+            }
+          }
+
+  errors: []
+- name: variable not used
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query ($a: String, $b: String, $c: String) {
+            field(a: $a, b: $b)
+          }
+
+  errors:
+    - message: Variable "$c" is never used.
+      locations:
+        - {line: 2, column: 38}
+- name: multiple variables not used
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            field(b: $b)
+          }
+
+  errors:
+    - message: Variable "$a" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 17}
+    - message: Variable "$c" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 41}
+- name: variable not used in fragments
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a) {
+              ...FragB
+            }
+          }
+          fragment FragB on Type {
+            field(b: $b) {
+              ...FragC
+            }
+          }
+          fragment FragC on Type {
+            field
+          }
+
+  errors:
+    - message: Variable "$c" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 41}
+- name: multiple variables not used in fragments
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: String, $c: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field {
+              ...FragB
+            }
+          }
+          fragment FragB on Type {
+            field(b: $b) {
+              ...FragC
+            }
+          }
+          fragment FragC on Type {
+            field
+          }
+
+  errors:
+    - message: Variable "$a" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 17}
+    - message: Variable "$c" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 41}
+- name: variable not used by unreferenced fragment
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            ...FragA
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+          fragment FragB on Type {
+            field(b: $b)
+          }
+
+  errors:
+    - message: Variable "$b" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 17}
+- name: variable not used by fragment used by other operation
+  rule: NoUnusedVariables
+  schema: 0
+  query: |2-
+
+          query Foo($b: String) {
+            ...FragA
+          }
+          query Bar($a: String) {
+            ...FragB
+          }
+          fragment FragA on Type {
+            field(a: $a)
+          }
+          fragment FragB on Type {
+            field(b: $b)
+          }
+
+  errors:
+    - message: Variable "$b" is never used in operation "Foo".
+      locations:
+        - {line: 2, column: 17}
+    - message: Variable "$a" is never used in operation "Bar".
+      locations:
+        - {line: 5, column: 17}
diff --git a/internal/gqlparser/validator/imported/spec/OverlappingFieldsCanBeMergedRule.spec.yml b/internal/gqlparser/validator/imported/spec/OverlappingFieldsCanBeMergedRule.spec.yml
new file mode 100644
index 0000000000..895e40201b
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/OverlappingFieldsCanBeMergedRule.spec.yml
@@ -0,0 +1,909 @@
+- name: unique fields
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment uniqueFields on Dog {
+            name
+            nickname
+          }
+
+  errors: []
+- name: identical fields
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment mergeIdenticalFields on Dog {
+            name
+            name
+          }
+
+  errors: []
+- name: identical fields with identical args
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment mergeIdenticalFieldsWithIdenticalArgs on Dog {
+            doesKnowCommand(dogCommand: SIT)
+            doesKnowCommand(dogCommand: SIT)
+          }
+
+  errors: []
+- name: identical fields with identical directives
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment mergeSameFieldsWithSameDirectives on Dog {
+            name @include(if: true)
+            name @include(if: true)
+          }
+
+  errors: []
+- name: different args with different aliases
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment differentArgsWithDifferentAliases on Dog {
+            knowsSit: doesKnowCommand(dogCommand: SIT)
+            knowsDown: doesKnowCommand(dogCommand: DOWN)
+          }
+
+  errors: []
+- name: different directives with different aliases
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment differentDirectivesWithDifferentAliases on Dog {
+            nameIfTrue: name @include(if: true)
+            nameIfFalse: name @include(if: false)
+          }
+
+  errors: []
+- name: different skip/include directives accepted
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment differentDirectivesWithDifferentAliases on Dog {
+            name @include(if: true)
+            name @include(if: false)
+          }
+
+  errors: []
+- name: Same aliases with different field targets
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment sameAliasesWithDifferentFieldTargets on Dog {
+            fido: name
+            fido: nickname
+          }
+
+  errors:
+    - message: Fields "fido" conflict because "name" and "nickname" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 9}
+- name: Same aliases allowed on non-overlapping fields
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment sameAliasesWithDifferentFieldTargets on Pet {
+            ... on Dog {
+              name
+            }
+            ... on Cat {
+              name: nickname
+            }
+          }
+
+  errors: []
+- name: Alias masking direct field access
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment aliasMaskingDirectFieldAccess on Dog {
+            name: nickname
+            name
+          }
+
+  errors:
+    - message: Fields "name" conflict because "nickname" and "name" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 9}
+- name: different args, second adds an argument
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment conflictingArgs on Dog {
+            doesKnowCommand
+            doesKnowCommand(dogCommand: HEEL)
+          }
+
+  errors:
+    - message: Fields "doesKnowCommand" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 9}
+- name: different args, second missing an argument
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment conflictingArgs on Dog {
+            doesKnowCommand(dogCommand: SIT)
+            doesKnowCommand
+          }
+
+  errors:
+    - message: Fields "doesKnowCommand" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 9}
+- name: conflicting arg values
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment conflictingArgs on Dog {
+            doesKnowCommand(dogCommand: SIT)
+            doesKnowCommand(dogCommand: HEEL)
+          }
+
+  errors:
+    - message: Fields "doesKnowCommand" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 9}
+- name: conflicting arg names
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment conflictingArgs on Dog {
+            isAtLocation(x: 0)
+            isAtLocation(y: 0)
+          }
+
+  errors:
+    - message: Fields "isAtLocation" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 9}
+- name: allows different args where no conflict is possible
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment conflictingArgs on Pet {
+            ... on Dog {
+              name(surname: true)
+            }
+            ... on Cat {
+              name
+            }
+          }
+
+  errors: []
+- name: allows different order of args
+  rule: OverlappingFieldsCanBeMerged
+  schema: 10
+  query: |2-
+
+            {
+              someField(a: null, b: null)
+              someField(b: null, a: null)
+            }
+
+  errors: []
+- name: allows different order of input object fields in arg values
+  rule: OverlappingFieldsCanBeMerged
+  schema: 11
+  query: |2-
+
+            {
+              someField(arg: { a: null, b: null })
+              someField(arg: { b: null, a: null })
+            }
+
+  errors: []
+- name: encounters conflict in fragments
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            ...A
+            ...B
+          }
+          fragment A on Type {
+            x: a
+          }
+          fragment B on Type {
+            x: b
+          }
+
+  errors:
+    - message: Fields "x" conflict because "a" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 7, column: 9}
+        - {line: 10, column: 9}
+- name: reports each conflict once
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            f1 {
+              ...A
+              ...B
+            }
+            f2 {
+              ...B
+              ...A
+            }
+            f3 {
+              ...A
+              ...B
+              x: c
+            }
+          }
+          fragment A on Type {
+            x: a
+          }
+          fragment B on Type {
+            x: b
+          }
+
+  errors:
+    - message: Fields "x" conflict because "a" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 18, column: 9}
+        - {line: 21, column: 9}
+    - message: Fields "x" conflict because "c" and "a" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 14, column: 11}
+        - {line: 18, column: 9}
+    - message: Fields "x" conflict because "c" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 14, column: 11}
+        - {line: 21, column: 9}
+- name: deep conflict
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field {
+              x: a
+            },
+            field {
+              x: b
+            }
+          }
+
+  errors:
+    - message: Fields "field" conflict because subfields "x" conflict because "a" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 11}
+        - {line: 6, column: 9}
+        - {line: 7, column: 11}
+- name: deep conflict with multiple issues
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field {
+              x: a
+              y: c
+            },
+            field {
+              x: b
+              y: d
+            }
+          }
+
+  errors:
+    - message: Fields "field" conflict because subfields "x" conflict because "a" and "b" are different fields and subfields "y" conflict because "c" and "d" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 11}
+        - {line: 5, column: 11}
+        - {line: 7, column: 9}
+        - {line: 8, column: 11}
+        - {line: 9, column: 11}
+- name: very deep conflict
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field {
+              deepField {
+                x: a
+              }
+            },
+            field {
+              deepField {
+                x: b
+              }
+            }
+          }
+
+  errors:
+    - message: Fields "field" conflict because subfields "deepField" conflict because subfields "x" conflict because "a" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 4, column: 11}
+        - {line: 5, column: 13}
+        - {line: 8, column: 9}
+        - {line: 9, column: 11}
+        - {line: 10, column: 13}
+- name: reports deep conflict to nearest common ancestor
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field {
+              deepField {
+                x: a
+              }
+              deepField {
+                x: b
+              }
+            },
+            field {
+              deepField {
+                y
+              }
+            }
+          }
+
+  errors:
+    - message: Fields "deepField" conflict because subfields "x" conflict because "a" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 4, column: 11}
+        - {line: 5, column: 13}
+        - {line: 7, column: 11}
+        - {line: 8, column: 13}
+- name: reports deep conflict to nearest common ancestor in fragments
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field {
+              ...F
+            }
+            field {
+              ...F
+            }
+          }
+          fragment F on T {
+            deepField {
+              deeperField {
+                x: a
+              }
+              deeperField {
+                x: b
+              }
+            },
+            deepField {
+              deeperField {
+                y
+              }
+            }
+          }
+
+  errors:
+    - message: Fields "deeperField" conflict because subfields "x" conflict because "a" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 12, column: 11}
+        - {line: 13, column: 13}
+        - {line: 15, column: 11}
+        - {line: 16, column: 13}
+- name: reports deep conflict in nested fragments
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field {
+              ...F
+            }
+            field {
+              ...I
+            }
+          }
+          fragment F on T {
+            x: a
+            ...G
+          }
+          fragment G on T {
+            y: c
+          }
+          fragment I on T {
+            y: d
+            ...J
+          }
+          fragment J on T {
+            x: b
+          }
+
+  errors:
+    - message: Fields "field" conflict because subfields "x" conflict because "a" and "b" are different fields and subfields "y" conflict because "c" and "d" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 11, column: 9}
+        - {line: 15, column: 9}
+        - {line: 6, column: 9}
+        - {line: 22, column: 9}
+        - {line: 18, column: 9}
+- name: ignores unknown fragments
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            field
+            ...Unknown
+            ...Known
+          }
+          
+          fragment Known on T {
+            field
+            ...OtherUnknown
+          }
+
+  errors: []
+- name: return types must be unambiguous/conflicting return types which potentially overlap
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ...on IntBox {
+                    scalar
+                  }
+                  ...on NonNullStringBox1 {
+                    scalar
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "scalar" conflict because they return conflicting types "Int" and "String!". Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 17}
+        - {line: 8, column: 17}
+- name: return types must be unambiguous/compatible return shapes on different return types
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on SomeBox {
+                    deepBox {
+                      unrelatedField
+                    }
+                  }
+                  ... on StringBox {
+                    deepBox {
+                      unrelatedField
+                    }
+                  }
+                }
+              }
+
+  errors: []
+- name: return types must be unambiguous/disallows differing return types despite no overlap
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    scalar
+                  }
+                  ... on StringBox {
+                    scalar
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "scalar" conflict because they return conflicting types "Int" and "String". Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 17}
+        - {line: 8, column: 17}
+- name: return types must be unambiguous/reports correctly when a non-exclusive follows an exclusive
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    deepBox {
+                      ...X
+                    }
+                  }
+                }
+                someBox {
+                  ... on StringBox {
+                    deepBox {
+                      ...Y
+                    }
+                  }
+                }
+                memoed: someBox {
+                  ... on IntBox {
+                    deepBox {
+                      ...X
+                    }
+                  }
+                }
+                memoed: someBox {
+                  ... on StringBox {
+                    deepBox {
+                      ...Y
+                    }
+                  }
+                }
+                other: someBox {
+                  ...X
+                }
+                other: someBox {
+                  ...Y
+                }
+              }
+              fragment X on SomeBox {
+                scalar
+              }
+              fragment Y on SomeBox {
+                scalar: unrelatedField
+              }
+
+  errors:
+    - message: Fields "other" conflict because subfields "scalar" conflict because "scalar" and "unrelatedField" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 31, column: 13}
+        - {line: 39, column: 13}
+        - {line: 34, column: 13}
+        - {line: 42, column: 13}
+- name: return types must be unambiguous/disallows differing return type nullability despite no overlap
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on NonNullStringBox1 {
+                    scalar
+                  }
+                  ... on StringBox {
+                    scalar
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "scalar" conflict because they return conflicting types "String!" and "String". Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 17}
+        - {line: 8, column: 17}
+- name: return types must be unambiguous/disallows differing return type list despite no overlap
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    box: listStringBox {
+                      scalar
+                    }
+                  }
+                  ... on StringBox {
+                    box: stringBox {
+                      scalar
+                    }
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "box" conflict because they return conflicting types "[StringBox]" and "StringBox". Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 17}
+        - {line: 10, column: 17}
+- name: return types must be unambiguous/disallows differing return type list despite no overlap
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    box: stringBox {
+                      scalar
+                    }
+                  }
+                  ... on StringBox {
+                    box: listStringBox {
+                      scalar
+                    }
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "box" conflict because they return conflicting types "StringBox" and "[StringBox]". Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 17}
+        - {line: 10, column: 17}
+- name: return types must be unambiguous/disallows differing subfields
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    box: stringBox {
+                      val: scalar
+                      val: unrelatedField
+                    }
+                  }
+                  ... on StringBox {
+                    box: stringBox {
+                      val: scalar
+                    }
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "val" conflict because "scalar" and "unrelatedField" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 6, column: 19}
+        - {line: 7, column: 19}
+- name: return types must be unambiguous/disallows differing deep return types despite no overlap
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    box: stringBox {
+                      scalar
+                    }
+                  }
+                  ... on StringBox {
+                    box: intBox {
+                      scalar
+                    }
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "box" conflict because subfields "scalar" conflict because they return conflicting types "String" and "Int". Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 17}
+        - {line: 6, column: 19}
+        - {line: 10, column: 17}
+        - {line: 11, column: 19}
+- name: return types must be unambiguous/allows non-conflicting overlapping types
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ... on IntBox {
+                    scalar: unrelatedField
+                  }
+                  ... on StringBox {
+                    scalar
+                  }
+                }
+              }
+
+  errors: []
+- name: return types must be unambiguous/same wrapped scalar return types
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ...on NonNullStringBox1 {
+                    scalar
+                  }
+                  ...on NonNullStringBox2 {
+                    scalar
+                  }
+                }
+              }
+
+  errors: []
+- name: return types must be unambiguous/allows inline fragments without type condition
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                a
+                ... {
+                  a
+                }
+              }
+
+  errors: []
+- name: return types must be unambiguous/compares deep types including list
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                connection {
+                  ...edgeID
+                  edges {
+                    node {
+                      id: name
+                    }
+                  }
+                }
+              }
+              
+              fragment edgeID on Connection {
+                edges {
+                  node {
+                    id
+                  }
+                }
+              }
+
+  errors:
+    - message: Fields "edges" conflict because subfields "node" conflict because subfields "id" conflict because "name" and "id" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 5, column: 15}
+        - {line: 6, column: 17}
+        - {line: 7, column: 19}
+        - {line: 14, column: 13}
+        - {line: 15, column: 15}
+        - {line: 16, column: 17}
+- name: return types must be unambiguous/ignores unknown types
+  rule: OverlappingFieldsCanBeMerged
+  schema: 12
+  query: |2-
+
+              {
+                someBox {
+                  ...on UnknownType {
+                    scalar
+                  }
+                  ...on NonNullStringBox2 {
+                    scalar
+                  }
+                }
+              }
+
+  errors: []
+- name: return types must be unambiguous/works for field names that are JS keywords
+  rule: OverlappingFieldsCanBeMerged
+  schema: 13
+  query: |2-
+
+              {
+                foo {
+                  constructor
+                }
+              }
+
+  errors: []
+- name: does not infinite loop on recursive fragment
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+          }
+          
+          fragment fragA on Human { name, relatives { name, ...fragA } }
+
+  errors: []
+- name: does not infinite loop on immediately recursive fragment
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+          }
+          
+          fragment fragA on Human { name, ...fragA }
+
+  errors: []
+- name: does not infinite loop on recursive fragment with a field named after fragment
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+            fragA
+          }
+          
+          fragment fragA on Query { ...fragA }
+
+  errors: []
+- name: finds invalid cases even with field named after fragment
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            fragA
+            ...fragA
+          }
+          
+          fragment fragA on Type {
+            fragA: b
+          }
+
+  errors:
+    - message: Fields "fragA" conflict because "fragA" and "b" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 3, column: 9}
+        - {line: 8, column: 9}
+- name: does not infinite loop on transitively recursive fragment
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+            fragB
+          }
+          
+          fragment fragA on Human { name, ...fragB }
+          fragment fragB on Human { name, ...fragC }
+          fragment fragC on Human { name, ...fragA }
+
+  errors: []
+- name: finds invalid case even with immediately recursive fragment
+  rule: OverlappingFieldsCanBeMerged
+  schema: 0
+  query: |2-
+
+          fragment sameAliasesWithDifferentFieldTargets on Dog {
+            ...sameAliasesWithDifferentFieldTargets
+            fido: name
+            fido: nickname
+          }
+
+  errors:
+    - message: Fields "fido" conflict because "name" and "nickname" are different fields. Use different aliases on the fields to fetch both if this was intentional.
+      locations:
+        - {line: 4, column: 9}
+        - {line: 5, column: 9}
diff --git a/internal/gqlparser/validator/imported/spec/PossibleFragmentSpreadsRule.spec.yml b/internal/gqlparser/validator/imported/spec/PossibleFragmentSpreadsRule.spec.yml
new file mode 100644
index 0000000000..099c551206
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/PossibleFragmentSpreadsRule.spec.yml
@@ -0,0 +1,250 @@
+- name: of the same object
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment objectWithinObject on Dog { ...dogFragment }
+          fragment dogFragment on Dog { barkVolume }
+
+  errors: []
+- name: of the same object with inline fragment
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment objectWithinObjectAnon on Dog { ... on Dog { barkVolume } }
+
+  errors: []
+- name: object into an implemented interface
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment objectWithinInterface on Pet { ...dogFragment }
+          fragment dogFragment on Dog { barkVolume }
+
+  errors: []
+- name: object into containing union
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment objectWithinUnion on CatOrDog { ...dogFragment }
+          fragment dogFragment on Dog { barkVolume }
+
+  errors: []
+- name: union into contained object
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment unionWithinObject on Dog { ...catOrDogFragment }
+          fragment catOrDogFragment on CatOrDog { __typename }
+
+  errors: []
+- name: union into overlapping interface
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment unionWithinInterface on Pet { ...catOrDogFragment }
+          fragment catOrDogFragment on CatOrDog { __typename }
+
+  errors: []
+- name: union into overlapping union
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment unionWithinUnion on DogOrHuman { ...catOrDogFragment }
+          fragment catOrDogFragment on CatOrDog { __typename }
+
+  errors: []
+- name: interface into implemented object
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment interfaceWithinObject on Dog { ...petFragment }
+          fragment petFragment on Pet { name }
+
+  errors: []
+- name: interface into overlapping interface
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment interfaceWithinInterface on Pet { ...beingFragment }
+          fragment beingFragment on Being { name }
+
+  errors: []
+- name: interface into overlapping interface in inline fragment
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment interfaceWithinInterface on Pet { ... on Being { name } }
+
+  errors: []
+- name: interface into overlapping union
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment interfaceWithinUnion on CatOrDog { ...petFragment }
+          fragment petFragment on Pet { name }
+
+  errors: []
+- name: ignores incorrect type (caught by FragmentsOnCompositeTypesRule)
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment petFragment on Pet { ...badInADifferentWay }
+          fragment badInADifferentWay on String { name }
+
+  errors: []
+- name: ignores unknown fragments (caught by KnownFragmentNamesRule)
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment petFragment on Pet { ...UnknownFragment }
+
+  errors: []
+- name: different object into object
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidObjectWithinObject on Cat { ...dogFragment }
+          fragment dogFragment on Dog { barkVolume }
+
+  errors:
+    - message: Fragment "dogFragment" cannot be spread here as objects of type "Cat" can never be of type "Dog".
+      locations:
+        - {line: 2, column: 51}
+- name: different object into object in inline fragment
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidObjectWithinObjectAnon on Cat {
+            ... on Dog { barkVolume }
+          }
+
+  errors:
+    - message: Fragment cannot be spread here as objects of type "Cat" can never be of type "Dog".
+      locations:
+        - {line: 3, column: 9}
+- name: object into not implementing interface
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidObjectWithinInterface on Pet { ...humanFragment }
+          fragment humanFragment on Human { pets { name } }
+
+  errors:
+    - message: Fragment "humanFragment" cannot be spread here as objects of type "Pet" can never be of type "Human".
+      locations:
+        - {line: 2, column: 54}
+- name: object into not containing union
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidObjectWithinUnion on CatOrDog { ...humanFragment }
+          fragment humanFragment on Human { pets { name } }
+
+  errors:
+    - message: Fragment "humanFragment" cannot be spread here as objects of type "CatOrDog" can never be of type "Human".
+      locations:
+        - {line: 2, column: 55}
+- name: union into not contained object
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidUnionWithinObject on Human { ...catOrDogFragment }
+          fragment catOrDogFragment on CatOrDog { __typename }
+
+  errors:
+    - message: Fragment "catOrDogFragment" cannot be spread here as objects of type "Human" can never be of type "CatOrDog".
+      locations:
+        - {line: 2, column: 52}
+- name: union into non overlapping interface
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidUnionWithinInterface on Pet { ...humanOrAlienFragment }
+          fragment humanOrAlienFragment on HumanOrAlien { __typename }
+
+  errors:
+    - message: Fragment "humanOrAlienFragment" cannot be spread here as objects of type "Pet" can never be of type "HumanOrAlien".
+      locations:
+        - {line: 2, column: 53}
+- name: union into non overlapping union
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidUnionWithinUnion on CatOrDog { ...humanOrAlienFragment }
+          fragment humanOrAlienFragment on HumanOrAlien { __typename }
+
+  errors:
+    - message: Fragment "humanOrAlienFragment" cannot be spread here as objects of type "CatOrDog" can never be of type "HumanOrAlien".
+      locations:
+        - {line: 2, column: 54}
+- name: interface into non implementing object
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidInterfaceWithinObject on Cat { ...intelligentFragment }
+          fragment intelligentFragment on Intelligent { iq }
+
+  errors:
+    - message: Fragment "intelligentFragment" cannot be spread here as objects of type "Cat" can never be of type "Intelligent".
+      locations:
+        - {line: 2, column: 54}
+- name: interface into non overlapping interface
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidInterfaceWithinInterface on Pet {
+            ...intelligentFragment
+          }
+          fragment intelligentFragment on Intelligent { iq }
+
+  errors:
+    - message: Fragment "intelligentFragment" cannot be spread here as objects of type "Pet" can never be of type "Intelligent".
+      locations:
+        - {line: 3, column: 9}
+- name: interface into non overlapping interface in inline fragment
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidInterfaceWithinInterfaceAnon on Pet {
+            ...on Intelligent { iq }
+          }
+
+  errors:
+    - message: Fragment cannot be spread here as objects of type "Pet" can never be of type "Intelligent".
+      locations:
+        - {line: 3, column: 9}
+- name: interface into non overlapping union
+  rule: PossibleFragmentSpreads
+  schema: 14
+  query: |2-
+
+          fragment invalidInterfaceWithinUnion on HumanOrAlien { ...petFragment }
+          fragment petFragment on Pet { name }
+
+  errors:
+    - message: Fragment "petFragment" cannot be spread here as objects of type "HumanOrAlien" can never be of type "Pet".
+      locations:
+        - {line: 2, column: 62}
diff --git a/internal/gqlparser/validator/imported/spec/PossibleTypeExtensionsRule.spec.yml b/internal/gqlparser/validator/imported/spec/PossibleTypeExtensionsRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/PossibleTypeExtensionsRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/ProvidedRequiredArgumentsRule.spec.yml b/internal/gqlparser/validator/imported/spec/ProvidedRequiredArgumentsRule.spec.yml
new file mode 100644
index 0000000000..f5369bc1b0
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/ProvidedRequiredArgumentsRule.spec.yml
@@ -0,0 +1,235 @@
+- name: ignores unknown arguments
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+          {
+            dog {
+              isHouseTrained(unknownArgument: true)
+            }
+          }
+
+  errors: []
+- name: Valid non-nullable value/Arg on optional arg
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                isHouseTrained(atOtherHomes: true)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/No Arg on optional arg
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                isHouseTrained
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/No arg on non-null field with default
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                nonNullFieldWithDefault
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple args
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req1: 1, req2: 2)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple args reverse order
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req2: 2, req1: 1)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/No args on multiple optional
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOpts
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/One arg on multiple optional
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOpts(opt1: 1)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Second arg on multiple optional
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOpts(opt2: 1)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple required args on mixedList
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOptAndReq(req1: 3, req2: 4)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple required and one optional arg on mixedList
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOptAndReq(req1: 3, req2: 4, opt1: 5)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/All required and optional args on mixedList
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOptAndReq(req1: 3, req2: 4, opt1: 5, opt2: 6)
+              }
+            }
+
+  errors: []
+- name: Invalid non-nullable value/Missing one non-nullable argument
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req2: 2)
+              }
+            }
+
+  errors:
+    - message: Field "multipleReqs" argument "req1" of type "Int!" is required, but it was not provided.
+      locations:
+        - {line: 4, column: 13}
+- name: Invalid non-nullable value/Missing multiple non-nullable arguments
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs
+              }
+            }
+
+  errors:
+    - message: Field "multipleReqs" argument "req1" of type "Int!" is required, but it was not provided.
+      locations:
+        - {line: 4, column: 13}
+    - message: Field "multipleReqs" argument "req2" of type "Int!" is required, but it was not provided.
+      locations:
+        - {line: 4, column: 13}
+- name: Invalid non-nullable value/Incorrect value and missing argument
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req1: "one")
+              }
+            }
+
+  errors:
+    - message: Field "multipleReqs" argument "req2" of type "Int!" is required, but it was not provided.
+      locations:
+        - {line: 4, column: 13}
+- name: Directive arguments/ignores unknown directives
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              dog @unknown
+            }
+
+  errors: []
+- name: Directive arguments/with directives of valid types
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              dog @include(if: true) {
+                name
+              }
+              human @skip(if: false) {
+                name
+              }
+            }
+
+  errors: []
+- name: Directive arguments/with directive with missing types
+  rule: ProvidedRequiredArguments
+  schema: 0
+  query: |2-
+
+            {
+              dog @include {
+                name @skip
+              }
+            }
+
+  errors:
+    - message: Directive "@include" argument "if" of type "Boolean!" is required, but it was not provided.
+      locations:
+        - {line: 3, column: 15}
+    - message: Directive "@skip" argument "if" of type "Boolean!" is required, but it was not provided.
+      locations:
+        - {line: 4, column: 18}
diff --git a/internal/gqlparser/validator/imported/spec/ScalarLeafsRule.spec.yml b/internal/gqlparser/validator/imported/spec/ScalarLeafsRule.spec.yml
new file mode 100644
index 0000000000..7a7a521fb8
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/ScalarLeafsRule.spec.yml
@@ -0,0 +1,111 @@
+- name: valid scalar selection
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelection on Dog {
+            barks
+          }
+
+  errors: []
+- name: object type missing selection
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          query directQueryOnObjectWithoutSubFields {
+            human
+          }
+
+  errors:
+    - message: Field "human" of type "Human" must have a selection of subfields. Did you mean "human { ... }"?
+      locations:
+        - {line: 3, column: 9}
+- name: interface type missing selection
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          {
+            human { pets }
+          }
+
+  errors:
+    - message: Field "pets" of type "[Pet]" must have a selection of subfields. Did you mean "pets { ... }"?
+      locations:
+        - {line: 3, column: 17}
+- name: valid scalar selection with args
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelectionWithArgs on Dog {
+            doesKnowCommand(dogCommand: SIT)
+          }
+
+  errors: []
+- name: scalar selection not allowed on Boolean
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelectionsNotAllowedOnBoolean on Dog {
+            barks { sinceWhen }
+          }
+
+  errors:
+    - message: Field "barks" must not have a selection since type "Boolean" has no subfields.
+      locations:
+        - {line: 3, column: 15}
+- name: scalar selection not allowed on Enum
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelectionsNotAllowedOnEnum on Cat {
+            furColor { inHexDec }
+          }
+
+  errors:
+    - message: Field "furColor" must not have a selection since type "FurColor" has no subfields.
+      locations:
+        - {line: 3, column: 18}
+- name: scalar selection not allowed with args
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelectionsNotAllowedWithArgs on Dog {
+            doesKnowCommand(dogCommand: SIT) { sinceWhen }
+          }
+
+  errors:
+    - message: Field "doesKnowCommand" must not have a selection since type "Boolean" has no subfields.
+      locations:
+        - {line: 3, column: 42}
+- name: Scalar selection not allowed with directives
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelectionsNotAllowedWithDirectives on Dog {
+            name @include(if: true) { isAlsoHumanName }
+          }
+
+  errors:
+    - message: Field "name" must not have a selection since type "String" has no subfields.
+      locations:
+        - {line: 3, column: 33}
+- name: Scalar selection not allowed with directives and args
+  rule: ScalarLeafs
+  schema: 0
+  query: |2-
+
+          fragment scalarSelectionsNotAllowedWithDirectivesAndArgs on Dog {
+            doesKnowCommand(dogCommand: SIT) @include(if: true) { sinceWhen }
+          }
+
+  errors:
+    - message: Field "doesKnowCommand" must not have a selection since type "Boolean" has no subfields.
+      locations:
+        - {line: 3, column: 61}
diff --git a/internal/gqlparser/validator/imported/spec/SingleFieldSubscriptionsRule.spec.yml b/internal/gqlparser/validator/imported/spec/SingleFieldSubscriptionsRule.spec.yml
new file mode 100644
index 0000000000..ad715545e2
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/SingleFieldSubscriptionsRule.spec.yml
@@ -0,0 +1,241 @@
+- name: valid subscription
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            importantEmails
+          }
+
+  errors: []
+- name: valid subscription with fragment
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription sub {
+            ...newMessageFields
+          }
+          
+          fragment newMessageFields on SubscriptionRoot {
+            newMessage {
+              body
+              sender
+            }
+          }
+
+  errors: []
+- name: valid subscription with fragment and field
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription sub {
+            newMessage {
+              body
+            }
+            ...newMessageFields
+          }
+          
+          fragment newMessageFields on SubscriptionRoot {
+            newMessage {
+              body
+              sender
+            }
+          }
+
+  errors: []
+- name: fails with more than one root field
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            importantEmails
+            notImportantEmails
+          }
+
+  errors:
+    - message: Subscription "ImportantEmails" must select only one top level field.
+      locations:
+        - {line: 4, column: 9}
+- name: fails with more than one root field including introspection
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            importantEmails
+            __typename
+          }
+
+  errors:
+    - message: Subscription "ImportantEmails" must select only one top level field.
+      locations:
+        - {line: 4, column: 9}
+    - message: Subscription "ImportantEmails" must not select an introspection top level field.
+      locations:
+        - {line: 4, column: 9}
+- name: fails with more than one root field including aliased introspection via fragment
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            importantEmails
+            ...Introspection
+          }
+          fragment Introspection on SubscriptionRoot {
+            typename: __typename
+          }
+
+  errors:
+    - message: Subscription "ImportantEmails" must select only one top level field.
+      locations:
+        - {line: 7, column: 9}
+    - message: Subscription "ImportantEmails" must not select an introspection top level field.
+      locations:
+        - {line: 7, column: 9}
+- name: fails with many more than one root field
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            importantEmails
+            notImportantEmails
+            spamEmails
+          }
+
+  errors:
+    - message: Subscription "ImportantEmails" must select only one top level field.
+      locations:
+        - {line: 4, column: 9}
+        - {line: 5, column: 9}
+- name: fails with many more than one root field via fragments
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            importantEmails
+            ... {
+              more: moreImportantEmails
+            }
+            ...NotImportantEmails
+          }
+          fragment NotImportantEmails on SubscriptionRoot {
+            notImportantEmails
+            deleted: deletedEmails
+            ...SpamEmails
+          }
+          fragment SpamEmails on SubscriptionRoot {
+            spamEmails
+          }
+
+  errors:
+    - message: Subscription "ImportantEmails" must select only one top level field.
+      locations:
+        - {line: 5, column: 11}
+        - {line: 10, column: 9}
+        - {line: 11, column: 9}
+        - {line: 15, column: 9}
+- name: does not infinite loop on recursive fragments
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription NoInfiniteLoop {
+            ...A
+          }
+          fragment A on SubscriptionRoot {
+            ...A
+          }
+
+  errors: []
+- name: fails with many more than one root field via fragments (anonymous)
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription {
+            importantEmails
+            ... {
+              more: moreImportantEmails
+              ...NotImportantEmails
+            }
+            ...NotImportantEmails
+          }
+          fragment NotImportantEmails on SubscriptionRoot {
+            notImportantEmails
+            deleted: deletedEmails
+            ... {
+              ... {
+                archivedEmails
+              }
+            }
+            ...SpamEmails
+          }
+          fragment SpamEmails on SubscriptionRoot {
+            spamEmails
+            ...NonExistentFragment
+          }
+
+  errors:
+    - message: Anonymous Subscription must select only one top level field.
+      locations:
+        - {line: 5, column: 11}
+        - {line: 11, column: 9}
+        - {line: 12, column: 9}
+        - {line: 15, column: 13}
+        - {line: 21, column: 9}
+- name: fails with more than one root field in anonymous subscriptions
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription {
+            importantEmails
+            notImportantEmails
+          }
+
+  errors:
+    - message: Anonymous Subscription must select only one top level field.
+      locations:
+        - {line: 4, column: 9}
+- name: fails with introspection field
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription ImportantEmails {
+            __typename
+          }
+
+  errors:
+    - message: Subscription "ImportantEmails" must not select an introspection top level field.
+      locations:
+        - {line: 3, column: 9}
+- name: fails with introspection field in anonymous subscription
+  rule: SingleFieldSubscriptions
+  schema: 15
+  query: |2-
+
+          subscription {
+            __typename
+          }
+
+  errors:
+    - message: Anonymous Subscription must not select an introspection top level field.
+      locations:
+        - {line: 3, column: 9}
+- name: skips if not subscription type
+  rule: SingleFieldSubscriptions
+  schema: 16
+  query: |2-
+
+            subscription {
+              __typename
+            }
+
+  errors: []
diff --git a/internal/gqlparser/validator/imported/spec/UniqueArgumentDefinitionNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueArgumentDefinitionNamesRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueArgumentDefinitionNamesRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/UniqueArgumentNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueArgumentNamesRule.spec.yml
new file mode 100644
index 0000000000..f3553cce25
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueArgumentNamesRule.spec.yml
@@ -0,0 +1,149 @@
+- name: no arguments on field
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field
+          }
+
+  errors: []
+- name: no arguments on directive
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field @directive
+          }
+
+  errors: []
+- name: argument on field
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: "value")
+          }
+
+  errors: []
+- name: argument on directive
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field @directive(arg: "value")
+          }
+
+  errors: []
+- name: same argument on two fields
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            one: field(arg: "value")
+            two: field(arg: "value")
+          }
+
+  errors: []
+- name: same argument on field and directive
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: "value") @directive(arg: "value")
+          }
+
+  errors: []
+- name: same argument on two directives
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field @directive1(arg: "value") @directive2(arg: "value")
+          }
+
+  errors: []
+- name: multiple field arguments
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg1: "value", arg2: "value", arg3: "value")
+          }
+
+  errors: []
+- name: multiple directive arguments
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field @directive(arg1: "value", arg2: "value", arg3: "value")
+          }
+
+  errors: []
+- name: duplicate field arguments
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg1: "value", arg1: "value")
+          }
+
+  errors:
+    - message: There can be only one argument named "arg1".
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 30}
+- name: many duplicate field arguments
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg1: "value", arg1: "value", arg1: "value")
+          }
+
+  errors:
+    - message: There can be only one argument named "arg1".
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 30}
+        - {line: 3, column: 45}
+- name: duplicate directive arguments
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field @directive(arg1: "value", arg1: "value")
+          }
+
+  errors:
+    - message: There can be only one argument named "arg1".
+      locations:
+        - {line: 3, column: 26}
+        - {line: 3, column: 41}
+- name: many duplicate directive arguments
+  rule: UniqueArgumentNames
+  schema: 0
+  query: |2-
+
+          {
+            field @directive(arg1: "value", arg1: "value", arg1: "value")
+          }
+
+  errors:
+    - message: There can be only one argument named "arg1".
+      locations:
+        - {line: 3, column: 26}
+        - {line: 3, column: 41}
+        - {line: 3, column: 56}
diff --git a/internal/gqlparser/validator/imported/spec/UniqueDirectiveNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueDirectiveNamesRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueDirectiveNamesRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/UniqueDirectivesPerLocationRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueDirectivesPerLocationRule.spec.yml
new file mode 100644
index 0000000000..81acb06687
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueDirectivesPerLocationRule.spec.yml
@@ -0,0 +1,143 @@
+- name: no directives
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type {
+            field
+          }
+
+  errors: []
+- name: unique directives in different locations
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type @directiveA {
+            field @directiveB
+          }
+
+  errors: []
+- name: unique directives in same locations
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type @directiveA @directiveB {
+            field @directiveA @directiveB
+          }
+
+  errors: []
+- name: same directives in different locations
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type @directiveA {
+            field @directiveA
+          }
+
+  errors: []
+- name: same directives in similar locations
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type {
+            field @directive
+            field @directive
+          }
+
+  errors: []
+- name: repeatable directives in same location
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type @repeatable @repeatable {
+            field @repeatable @repeatable
+          }
+
+  errors: []
+- name: unknown directives must be ignored
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          type Test @unknown @unknown {
+            field: String! @unknown @unknown
+          }
+          
+          extend type Test @unknown {
+            anotherField: String!
+          }
+
+  errors: []
+- name: duplicate directives in one location
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type {
+            field @directive @directive
+          }
+
+  errors:
+    - message: The directive "@directive" can only be used once at this location.
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 26}
+- name: many duplicate directives in one location
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type {
+            field @directive @directive @directive
+          }
+
+  errors:
+    - message: The directive "@directive" can only be used once at this location.
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 26}
+    - message: The directive "@directive" can only be used once at this location.
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 37}
+- name: different duplicate directives in one location
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type {
+            field @directiveA @directiveB @directiveA @directiveB
+          }
+
+  errors:
+    - message: The directive "@directiveA" can only be used once at this location.
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 39}
+    - message: The directive "@directiveB" can only be used once at this location.
+      locations:
+        - {line: 3, column: 27}
+        - {line: 3, column: 51}
+- name: duplicate directives in many locations
+  rule: UniqueDirectivesPerLocation
+  schema: 17
+  query: |2-
+
+          fragment Test on Type @directive @directive {
+            field @directive @directive
+          }
+
+  errors:
+    - message: The directive "@directive" can only be used once at this location.
+      locations:
+        - {line: 2, column: 29}
+        - {line: 2, column: 40}
+    - message: The directive "@directive" can only be used once at this location.
+      locations:
+        - {line: 3, column: 15}
+        - {line: 3, column: 26}
diff --git a/internal/gqlparser/validator/imported/spec/UniqueEnumValueNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueEnumValueNamesRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueEnumValueNamesRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/UniqueFieldDefinitionNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueFieldDefinitionNamesRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueFieldDefinitionNamesRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/UniqueFragmentNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueFragmentNamesRule.spec.yml
new file mode 100644
index 0000000000..4d294f0c20
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueFragmentNamesRule.spec.yml
@@ -0,0 +1,110 @@
+- name: no fragments
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            field
+          }
+
+  errors: []
+- name: one fragment
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+          }
+          
+          fragment fragA on Type {
+            field
+          }
+
+  errors: []
+- name: many fragments
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+            ...fragB
+            ...fragC
+          }
+          fragment fragA on Type {
+            fieldA
+          }
+          fragment fragB on Type {
+            fieldB
+          }
+          fragment fragC on Type {
+            fieldC
+          }
+
+  errors: []
+- name: inline fragments are always unique
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            ...on Type {
+              fieldA
+            }
+            ...on Type {
+              fieldB
+            }
+          }
+
+  errors: []
+- name: fragment and operation named the same
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            ...Foo
+          }
+          fragment Foo on Type {
+            field
+          }
+
+  errors: []
+- name: fragments named the same
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          {
+            ...fragA
+          }
+          fragment fragA on Type {
+            fieldA
+          }
+          fragment fragA on Type {
+            fieldB
+          }
+
+  errors:
+    - message: There can be only one fragment named "fragA".
+      locations:
+        - {line: 5, column: 16}
+        - {line: 8, column: 16}
+- name: fragments named the same without being referenced
+  rule: UniqueFragmentNames
+  schema: 0
+  query: |2-
+
+          fragment fragA on Type {
+            fieldA
+          }
+          fragment fragA on Type {
+            fieldB
+          }
+
+  errors:
+    - message: There can be only one fragment named "fragA".
+      locations:
+        - {line: 2, column: 16}
+        - {line: 5, column: 16}
diff --git a/internal/gqlparser/validator/imported/spec/UniqueInputFieldNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueInputFieldNamesRule.spec.yml
new file mode 100644
index 0000000000..5f28dd6ae1
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueInputFieldNamesRule.spec.yml
@@ -0,0 +1,94 @@
+- name: input object with fields
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: { f: true })
+          }
+
+  errors: []
+- name: same input object within two args
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg1: { f: true }, arg2: { f: true })
+          }
+
+  errors: []
+- name: multiple input object fields
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: { f1: "value", f2: "value", f3: "value" })
+          }
+
+  errors: []
+- name: allows for nested input objects with similar fields
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: {
+              deep: {
+                deep: {
+                  id: 1
+                }
+                id: 1
+              }
+              id: 1
+            })
+          }
+
+  errors: []
+- name: duplicate input object fields
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: { f1: "value", f1: "value" })
+          }
+
+  errors:
+    - message: There can be only one input field named "f1".
+      locations:
+        - {line: 3, column: 22}
+        - {line: 3, column: 35}
+- name: many duplicate input object fields
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: { f1: "value", f1: "value", f1: "value" })
+          }
+
+  errors:
+    - message: There can be only one input field named "f1".
+      locations:
+        - {line: 3, column: 22}
+        - {line: 3, column: 35}
+    - message: There can be only one input field named "f1".
+      locations:
+        - {line: 3, column: 22}
+        - {line: 3, column: 48}
+- name: nested duplicate input object fields
+  rule: UniqueInputFieldNames
+  schema: 0
+  query: |2-
+
+          {
+            field(arg: { f1: {f2: "value", f2: "value" }})
+          }
+
+  errors:
+    - message: There can be only one input field named "f2".
+      locations:
+        - {line: 3, column: 27}
+        - {line: 3, column: 40}
diff --git a/internal/gqlparser/validator/imported/spec/UniqueOperationNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueOperationNamesRule.spec.yml
new file mode 100644
index 0000000000..195803eb8a
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueOperationNamesRule.spec.yml
@@ -0,0 +1,126 @@
+- name: no operations
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          fragment fragA on Type {
+            field
+          }
+
+  errors: []
+- name: one anon operation
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          {
+            field
+          }
+
+  errors: []
+- name: one named operation
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            field
+          }
+
+  errors: []
+- name: multiple operations
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            field
+          }
+          
+          query Bar {
+            field
+          }
+
+  errors: []
+- name: multiple operations of different types
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            field
+          }
+          
+          mutation Bar {
+            field
+          }
+          
+          subscription Baz {
+            field
+          }
+
+  errors: []
+- name: fragment and operation named the same
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            ...Foo
+          }
+          fragment Foo on Type {
+            field
+          }
+
+  errors: []
+- name: multiple operations of same name
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            fieldA
+          }
+          query Foo {
+            fieldB
+          }
+
+  errors:
+    - message: There can be only one operation named "Foo".
+      locations:
+        - {line: 2, column: 13}
+        - {line: 5, column: 13}
+- name: multiple ops of same name of different types (mutation)
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            fieldA
+          }
+          mutation Foo {
+            fieldB
+          }
+
+  errors:
+    - message: There can be only one operation named "Foo".
+      locations:
+        - {line: 2, column: 13}
+        - {line: 5, column: 16}
+- name: multiple ops of same name of different types (subscription)
+  rule: UniqueOperationNames
+  schema: 0
+  query: |2-
+
+          query Foo {
+            fieldA
+          }
+          subscription Foo {
+            fieldB
+          }
+
+  errors:
+    - message: There can be only one operation named "Foo".
+      locations:
+        - {line: 2, column: 13}
+        - {line: 5, column: 20}
diff --git a/internal/gqlparser/validator/imported/spec/UniqueOperationTypesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueOperationTypesRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueOperationTypesRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/UniqueTypeNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueTypeNamesRule.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueTypeNamesRule.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/UniqueVariableNamesRule.spec.yml b/internal/gqlparser/validator/imported/spec/UniqueVariableNamesRule.spec.yml
new file mode 100644
index 0000000000..8a380da909
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/UniqueVariableNamesRule.spec.yml
@@ -0,0 +1,32 @@
+- name: unique variable names
+  rule: UniqueVariableNames
+  schema: 0
+  query: |2-
+
+          query A($x: Int, $y: String) { __typename }
+          query B($x: String, $y: Int) { __typename }
+
+  errors: []
+- name: duplicate variable names
+  rule: UniqueVariableNames
+  schema: 0
+  query: |2-
+
+          query A($x: Int, $x: Int, $x: String) { __typename }
+          query B($x: String, $x: Int) { __typename }
+          query C($x: Int, $x: Int) { __typename }
+
+  errors:
+    - message: There can be only one variable named "$x".
+      locations:
+        - {line: 2, column: 16}
+        - {line: 2, column: 25}
+        - {line: 2, column: 34}
+    - message: There can be only one variable named "$x".
+      locations:
+        - {line: 3, column: 16}
+        - {line: 3, column: 28}
+    - message: There can be only one variable named "$x".
+      locations:
+        - {line: 4, column: 16}
+        - {line: 4, column: 25}
diff --git a/internal/gqlparser/validator/imported/spec/ValidationContext.spec.yml b/internal/gqlparser/validator/imported/spec/ValidationContext.spec.yml
new file mode 100644
index 0000000000..fe51488c70
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/ValidationContext.spec.yml
@@ -0,0 +1 @@
+[]
diff --git a/internal/gqlparser/validator/imported/spec/ValuesOfCorrectTypeRule.spec.yml b/internal/gqlparser/validator/imported/spec/ValuesOfCorrectTypeRule.spec.yml
new file mode 100644
index 0000000000..83990de5d5
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/ValuesOfCorrectTypeRule.spec.yml
@@ -0,0 +1,1115 @@
+- name: Valid values/Good int value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: 2)
+              }
+            }
+
+  errors: []
+- name: Valid values/Good negative int value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: -2)
+              }
+            }
+
+  errors: []
+- name: Valid values/Good boolean value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                booleanArgField(booleanArg: true)
+              }
+            }
+
+  errors: []
+- name: Valid values/Good string value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringArgField(stringArg: "foo")
+              }
+            }
+
+  errors: []
+- name: Valid values/Good float value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                floatArgField(floatArg: 1.1)
+              }
+            }
+
+  errors: []
+- name: Valid values/Good negative float value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                floatArgField(floatArg: -1.1)
+              }
+            }
+
+  errors: []
+- name: Valid values/Int into Float
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                floatArgField(floatArg: 1)
+              }
+            }
+
+  errors: []
+- name: Valid values/Int into ID
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                idArgField(idArg: 1)
+              }
+            }
+
+  errors: []
+- name: Valid values/String into ID
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                idArgField(idArg: "someIdString")
+              }
+            }
+
+  errors: []
+- name: Valid values/Good enum value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: SIT)
+              }
+            }
+
+  errors: []
+- name: Valid values/Enum with undefined value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                enumArgField(enumArg: UNKNOWN)
+              }
+            }
+
+  errors: []
+- name: Valid values/Enum with null value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                enumArgField(enumArg: NO_FUR)
+              }
+            }
+
+  errors: []
+- name: Valid values/null into nullable type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: null)
+              }
+            }
+
+  errors: []
+- name: Valid values/null into nullable type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog(a: null, b: null, c:{ requiredField: true, intField: null }) {
+                name
+              }
+            }
+
+  errors: []
+- name: Invalid String values/Int into String
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringArgField(stringArg: 1)
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: 1'
+      locations:
+        - {line: 4, column: 39}
+- name: Invalid String values/Float into String
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringArgField(stringArg: 1.0)
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: 1.0'
+      locations:
+        - {line: 4, column: 39}
+- name: Invalid String values/Boolean into String
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringArgField(stringArg: true)
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: true'
+      locations:
+        - {line: 4, column: 39}
+- name: Invalid String values/Unquoted String into String
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringArgField(stringArg: BAR)
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: BAR'
+      locations:
+        - {line: 4, column: 39}
+- name: Invalid Int values/String into Int
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: "3")
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: "3"'
+      locations:
+        - {line: 4, column: 33}
+- name: Invalid Int values/Big Int into Int
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: 829384293849283498239482938)
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non 32-bit signed integer value: 829384293849283498239482938'
+      locations:
+        - {line: 4, column: 33}
+- name: Invalid Int values/Unquoted String into Int
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: FOO)
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: FOO'
+      locations:
+        - {line: 4, column: 33}
+- name: Invalid Int values/Simple Float into Int
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: 3.0)
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: 3.0'
+      locations:
+        - {line: 4, column: 33}
+- name: Invalid Int values/Float into Int
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                intArgField(intArg: 3.333)
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: 3.333'
+      locations:
+        - {line: 4, column: 33}
+- name: Invalid Float values/String into Float
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                floatArgField(floatArg: "3.333")
+              }
+            }
+
+  errors:
+    - message: 'Float cannot represent non numeric value: "3.333"'
+      locations:
+        - {line: 4, column: 37}
+- name: Invalid Float values/Boolean into Float
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                floatArgField(floatArg: true)
+              }
+            }
+
+  errors:
+    - message: 'Float cannot represent non numeric value: true'
+      locations:
+        - {line: 4, column: 37}
+- name: Invalid Float values/Unquoted into Float
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                floatArgField(floatArg: FOO)
+              }
+            }
+
+  errors:
+    - message: 'Float cannot represent non numeric value: FOO'
+      locations:
+        - {line: 4, column: 37}
+- name: Invalid Boolean value/Int into Boolean
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                booleanArgField(booleanArg: 2)
+              }
+            }
+
+  errors:
+    - message: 'Boolean cannot represent a non boolean value: 2'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Boolean value/Float into Boolean
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                booleanArgField(booleanArg: 1.0)
+              }
+            }
+
+  errors:
+    - message: 'Boolean cannot represent a non boolean value: 1.0'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Boolean value/String into Boolean
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                booleanArgField(booleanArg: "true")
+              }
+            }
+
+  errors:
+    - message: 'Boolean cannot represent a non boolean value: "true"'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Boolean value/Unquoted into Boolean
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                booleanArgField(booleanArg: TRUE)
+              }
+            }
+
+  errors:
+    - message: 'Boolean cannot represent a non boolean value: TRUE'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid ID value/Float into ID
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                idArgField(idArg: 1.0)
+              }
+            }
+
+  errors:
+    - message: 'ID cannot represent a non-string and non-integer value: 1.0'
+      locations:
+        - {line: 4, column: 31}
+- name: Invalid ID value/Boolean into ID
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                idArgField(idArg: true)
+              }
+            }
+
+  errors:
+    - message: 'ID cannot represent a non-string and non-integer value: true'
+      locations:
+        - {line: 4, column: 31}
+- name: Invalid ID value/Unquoted into ID
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                idArgField(idArg: SOMETHING)
+              }
+            }
+
+  errors:
+    - message: 'ID cannot represent a non-string and non-integer value: SOMETHING'
+      locations:
+        - {line: 4, column: 31}
+- name: Invalid Enum value/Int into Enum
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: 2)
+              }
+            }
+
+  errors:
+    - message: 'Enum "DogCommand" cannot represent non-enum value: 2.'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Enum value/Float into Enum
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: 1.0)
+              }
+            }
+
+  errors:
+    - message: 'Enum "DogCommand" cannot represent non-enum value: 1.0.'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Enum value/String into Enum
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: "SIT")
+              }
+            }
+
+  errors:
+    - message: 'Enum "DogCommand" cannot represent non-enum value: "SIT". Did you mean the enum value "SIT"?'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Enum value/Boolean into Enum
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: true)
+              }
+            }
+
+  errors:
+    - message: 'Enum "DogCommand" cannot represent non-enum value: true.'
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Enum value/Unknown Enum Value into Enum
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: JUGGLE)
+              }
+            }
+
+  errors:
+    - message: Value "JUGGLE" does not exist in "DogCommand" enum.
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid Enum value/Different case Enum Value into Enum
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                doesKnowCommand(dogCommand: sit)
+              }
+            }
+
+  errors:
+    - message: Value "sit" does not exist in "DogCommand" enum. Did you mean the enum value "SIT"?
+      locations:
+        - {line: 4, column: 41}
+- name: Valid List value/Good list value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringListArgField(stringListArg: ["one", null, "two"])
+              }
+            }
+
+  errors: []
+- name: Valid List value/Empty list value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringListArgField(stringListArg: [])
+              }
+            }
+
+  errors: []
+- name: Valid List value/Null value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringListArgField(stringListArg: null)
+              }
+            }
+
+  errors: []
+- name: Valid List value/Single value into List
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringListArgField(stringListArg: "one")
+              }
+            }
+
+  errors: []
+- name: Invalid List value/Incorrect item type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringListArgField(stringListArg: ["one", 2])
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: 2'
+      locations:
+        - {line: 4, column: 55}
+- name: Invalid List value/Single value of incorrect type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                stringListArgField(stringListArg: 1)
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: 1'
+      locations:
+        - {line: 4, column: 47}
+- name: Valid non-nullable value/Arg on optional arg
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                isHouseTrained(atOtherHomes: true)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/No Arg on optional arg
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog {
+                isHouseTrained
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple args
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req1: 1, req2: 2)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple args reverse order
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req2: 2, req1: 1)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/No args on multiple optional
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOpts
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/One arg on multiple optional
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOpts(opt1: 1)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Second arg on multiple optional
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOpts(opt2: 1)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple required args on mixedList
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOptAndReq(req1: 3, req2: 4)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/Multiple required and one optional arg on mixedList
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOptAndReq(req1: 3, req2: 4, opt1: 5)
+              }
+            }
+
+  errors: []
+- name: Valid non-nullable value/All required and optional args on mixedList
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleOptAndReq(req1: 3, req2: 4, opt1: 5, opt2: 6)
+              }
+            }
+
+  errors: []
+- name: Invalid non-nullable value/Incorrect value type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req2: "two", req1: "one")
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: "two"'
+      locations:
+        - {line: 4, column: 32}
+    - message: 'Int cannot represent non-integer value: "one"'
+      locations:
+        - {line: 4, column: 45}
+- name: Invalid non-nullable value/Incorrect value and missing argument (ProvidedRequiredArgumentsRule)
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req1: "one")
+              }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: "one"'
+      locations:
+        - {line: 4, column: 32}
+- name: Invalid non-nullable value/Null value
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                multipleReqs(req1: null)
+              }
+            }
+
+  errors:
+    - message: Expected value of type "Int!", found null.
+      locations:
+        - {line: 4, column: 32}
+- name: Valid input object value/Optional arg, despite required field in type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField
+              }
+            }
+
+  errors: []
+- name: Valid input object value/Partial object, only required
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: { requiredField: true })
+              }
+            }
+
+  errors: []
+- name: Valid input object value/Partial object, required field can be falsy
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: { requiredField: false })
+              }
+            }
+
+  errors: []
+- name: Valid input object value/Partial object, including required
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: { requiredField: true, intField: 4 })
+              }
+            }
+
+  errors: []
+- name: Valid input object value/Full object
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: {
+                  requiredField: true,
+                  intField: 4,
+                  stringField: "foo",
+                  booleanField: false,
+                  stringListField: ["one", "two"]
+                })
+              }
+            }
+
+  errors: []
+- name: Valid input object value/Full object with fields in different order
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: {
+                  stringListField: ["one", "two"],
+                  booleanField: false,
+                  requiredField: true,
+                  stringField: "foo",
+                  intField: 4,
+                })
+              }
+            }
+
+  errors: []
+- name: Invalid input object value/Partial object, missing required
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: { intField: 4 })
+              }
+            }
+
+  errors:
+    - message: Field "ComplexInput.requiredField" of required type "Boolean!" was not provided.
+      locations:
+        - {line: 4, column: 41}
+- name: Invalid input object value/Partial object, invalid field type
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: {
+                  stringListField: ["one", 2],
+                  requiredField: true,
+                })
+              }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: 2'
+      locations:
+        - {line: 5, column: 40}
+- name: Invalid input object value/Partial object, null to non-null field
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: {
+                  requiredField: true,
+                  nonNullField: null,
+                })
+              }
+            }
+
+  errors:
+    - message: Expected value of type "Boolean!", found null.
+      locations:
+        - {line: 6, column: 29}
+- name: Invalid input object value/Partial object, unknown field arg
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              complicatedArgs {
+                complexArgField(complexArg: {
+                  requiredField: true,
+                  invalidField: "value"
+                })
+              }
+            }
+
+  errors:
+    - message: Field "invalidField" is not defined by type "ComplexInput". Did you mean "intField"?
+      locations:
+        - {line: 6, column: 15}
+- name: Invalid input object value/reports error for custom scalar that returns undefined
+  rule: ValuesOfCorrectType
+  schema: 18
+  query: '{ invalidArg(arg: 123) }'
+  errors:
+    - message: Expected value of type "CustomScalar", found 123.
+      locations:
+        - {line: 1, column: 19}
+- name: Invalid input object value/allows custom scalar to accept complex literals
+  rule: ValuesOfCorrectType
+  schema: 19
+  query: |2-
+
+              {
+                test1: anyArg(arg: 123)
+                test2: anyArg(arg: "abc")
+                test3: anyArg(arg: [123, "abc"])
+                test4: anyArg(arg: {deep: [123, "abc"]})
+              }
+
+  errors: []
+- name: Directive arguments/with directives of valid types
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog @include(if: true) {
+                name
+              }
+              human @skip(if: false) {
+                name
+              }
+            }
+
+  errors: []
+- name: Directive arguments/with directive with incorrect types
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            {
+              dog @include(if: "yes") {
+                name @skip(if: ENUM)
+              }
+            }
+
+  errors:
+    - message: 'Boolean cannot represent a non boolean value: "yes"'
+      locations:
+        - {line: 3, column: 28}
+    - message: 'Boolean cannot represent a non boolean value: ENUM'
+      locations:
+        - {line: 4, column: 28}
+- name: Variable default values/variables with valid default values
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query WithDefaultValues(
+              $a: Int = 1,
+              $b: String = "ok",
+              $c: ComplexInput = { requiredField: true, intField: 3 }
+              $d: Int! = 123
+            ) {
+              dog { name }
+            }
+
+  errors: []
+- name: Variable default values/variables with valid default null values
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query WithDefaultValues(
+              $a: Int = null,
+              $b: String = null,
+              $c: ComplexInput = { requiredField: true, intField: null }
+            ) {
+              dog { name }
+            }
+
+  errors: []
+- name: Variable default values/variables with invalid default null values
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query WithDefaultValues(
+              $a: Int! = null,
+              $b: String! = null,
+              $c: ComplexInput = { requiredField: null, intField: null }
+            ) {
+              dog { name }
+            }
+
+  errors:
+    - message: Expected value of type "Int!", found null.
+      locations:
+        - {line: 3, column: 22}
+    - message: Expected value of type "String!", found null.
+      locations:
+        - {line: 4, column: 25}
+    - message: Expected value of type "Boolean!", found null.
+      locations:
+        - {line: 5, column: 47}
+- name: Variable default values/variables with invalid default values
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query InvalidDefaultValues(
+              $a: Int = "one",
+              $b: String = 4,
+              $c: ComplexInput = "NotVeryComplex"
+            ) {
+              dog { name }
+            }
+
+  errors:
+    - message: 'Int cannot represent non-integer value: "one"'
+      locations:
+        - {line: 3, column: 21}
+    - message: 'String cannot represent a non string value: 4'
+      locations:
+        - {line: 4, column: 24}
+    - message: Expected value of type "ComplexInput", found "NotVeryComplex".
+      locations:
+        - {line: 5, column: 30}
+- name: Variable default values/variables with complex invalid default values
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query WithDefaultValues(
+              $a: ComplexInput = { requiredField: 123, intField: "abc" }
+            ) {
+              dog { name }
+            }
+
+  errors:
+    - message: 'Boolean cannot represent a non boolean value: 123'
+      locations:
+        - {line: 3, column: 47}
+    - message: 'Int cannot represent non-integer value: "abc"'
+      locations:
+        - {line: 3, column: 62}
+- name: Variable default values/complex variables missing required field
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query MissingRequiredField($a: ComplexInput = {intField: 3}) {
+              dog { name }
+            }
+
+  errors:
+    - message: Field "ComplexInput.requiredField" of required type "Boolean!" was not provided.
+      locations:
+        - {line: 2, column: 55}
+- name: Variable default values/list variables with invalid item
+  rule: ValuesOfCorrectType
+  schema: 0
+  query: |2-
+
+            query InvalidItem($a: [String] = ["one", 2]) {
+              dog { name }
+            }
+
+  errors:
+    - message: 'String cannot represent a non string value: 2'
+      locations:
+        - {line: 2, column: 50}
diff --git a/internal/gqlparser/validator/imported/spec/VariablesAreInputTypesRule.spec.yml b/internal/gqlparser/validator/imported/spec/VariablesAreInputTypesRule.spec.yml
new file mode 100644
index 0000000000..be0813d4c0
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/VariablesAreInputTypesRule.spec.yml
@@ -0,0 +1,39 @@
+- name: unknown types are ignored
+  rule: VariablesAreInputTypes
+  schema: 0
+  query: |2-
+
+          query Foo($a: Unknown, $b: [[Unknown!]]!) {
+            field(a: $a, b: $b)
+          }
+
+  errors: []
+- name: input types are valid
+  rule: VariablesAreInputTypes
+  schema: 0
+  query: |2-
+
+          query Foo($a: String, $b: [Boolean!]!, $c: ComplexInput) {
+            field(a: $a, b: $b, c: $c)
+          }
+
+  errors: []
+- name: output types are invalid
+  rule: VariablesAreInputTypes
+  schema: 0
+  query: |2-
+
+          query Foo($a: Dog, $b: [[CatOrDog!]]!, $c: Pet) {
+            field(a: $a, b: $b, c: $c)
+          }
+
+  errors:
+    - locations:
+        - {line: 2, column: 21}
+      message: Variable "$a" cannot be non-input type "Dog".
+    - locations:
+        - {line: 2, column: 30}
+      message: Variable "$b" cannot be non-input type "[[CatOrDog!]]!".
+    - locations:
+        - {line: 2, column: 50}
+      message: Variable "$c" cannot be non-input type "Pet".
diff --git a/internal/gqlparser/validator/imported/spec/VariablesInAllowedPositionRule.spec.yml b/internal/gqlparser/validator/imported/spec/VariablesInAllowedPositionRule.spec.yml
new file mode 100644
index 0000000000..f9b48c957b
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/VariablesInAllowedPositionRule.spec.yml
@@ -0,0 +1,348 @@
+- name: Boolean => Boolean
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($booleanArg: Boolean)
+          {
+            complicatedArgs {
+              booleanArgField(booleanArg: $booleanArg)
+            }
+          }
+
+  errors: []
+- name: Boolean => Boolean within fragment
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          fragment booleanArgFrag on ComplicatedArgs {
+            booleanArgField(booleanArg: $booleanArg)
+          }
+          query Query($booleanArg: Boolean)
+          {
+            complicatedArgs {
+              ...booleanArgFrag
+            }
+          }
+
+  errors: []
+- name: Boolean => Boolean within fragment
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($booleanArg: Boolean)
+          {
+            complicatedArgs {
+              ...booleanArgFrag
+            }
+          }
+          fragment booleanArgFrag on ComplicatedArgs {
+            booleanArgField(booleanArg: $booleanArg)
+          }
+
+  errors: []
+- name: Boolean! => Boolean
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($nonNullBooleanArg: Boolean!)
+          {
+            complicatedArgs {
+              booleanArgField(booleanArg: $nonNullBooleanArg)
+            }
+          }
+
+  errors: []
+- name: Boolean! => Boolean within fragment
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          fragment booleanArgFrag on ComplicatedArgs {
+            booleanArgField(booleanArg: $nonNullBooleanArg)
+          }
+          
+          query Query($nonNullBooleanArg: Boolean!)
+          {
+            complicatedArgs {
+              ...booleanArgFrag
+            }
+          }
+
+  errors: []
+- name: '[String] => [String]'
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringListVar: [String])
+          {
+            complicatedArgs {
+              stringListArgField(stringListArg: $stringListVar)
+            }
+          }
+
+  errors: []
+- name: '[String!] => [String]'
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringListVar: [String!])
+          {
+            complicatedArgs {
+              stringListArgField(stringListArg: $stringListVar)
+            }
+          }
+
+  errors: []
+- name: String => [String] in item position
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringVar: String)
+          {
+            complicatedArgs {
+              stringListArgField(stringListArg: [$stringVar])
+            }
+          }
+
+  errors: []
+- name: String! => [String] in item position
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringVar: String!)
+          {
+            complicatedArgs {
+              stringListArgField(stringListArg: [$stringVar])
+            }
+          }
+
+  errors: []
+- name: ComplexInput => ComplexInput
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($complexVar: ComplexInput)
+          {
+            complicatedArgs {
+              complexArgField(complexArg: $complexVar)
+            }
+          }
+
+  errors: []
+- name: ComplexInput => ComplexInput in field position
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($boolVar: Boolean = false)
+          {
+            complicatedArgs {
+              complexArgField(complexArg: {requiredArg: $boolVar})
+            }
+          }
+
+  errors: []
+- name: Boolean! => Boolean! in directive
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($boolVar: Boolean!)
+          {
+            dog @include(if: $boolVar)
+          }
+
+  errors: []
+- name: Int => Int!
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($intArg: Int) {
+            complicatedArgs {
+              nonNullIntArgField(nonNullIntArg: $intArg)
+            }
+          }
+
+  errors:
+    - message: Variable "$intArg" of type "Int" used in position expecting type "Int!".
+      locations:
+        - {line: 2, column: 19}
+        - {line: 4, column: 45}
+- name: Int => Int! within fragment
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          fragment nonNullIntArgFieldFrag on ComplicatedArgs {
+            nonNullIntArgField(nonNullIntArg: $intArg)
+          }
+          
+          query Query($intArg: Int) {
+            complicatedArgs {
+              ...nonNullIntArgFieldFrag
+            }
+          }
+
+  errors:
+    - message: Variable "$intArg" of type "Int" used in position expecting type "Int!".
+      locations:
+        - {line: 6, column: 19}
+        - {line: 3, column: 43}
+- name: Int => Int! within nested fragment
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          fragment outerFrag on ComplicatedArgs {
+            ...nonNullIntArgFieldFrag
+          }
+          
+          fragment nonNullIntArgFieldFrag on ComplicatedArgs {
+            nonNullIntArgField(nonNullIntArg: $intArg)
+          }
+          
+          query Query($intArg: Int) {
+            complicatedArgs {
+              ...outerFrag
+            }
+          }
+
+  errors:
+    - message: Variable "$intArg" of type "Int" used in position expecting type "Int!".
+      locations:
+        - {line: 10, column: 19}
+        - {line: 7, column: 43}
+- name: String over Boolean
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringVar: String) {
+            complicatedArgs {
+              booleanArgField(booleanArg: $stringVar)
+            }
+          }
+
+  errors:
+    - message: Variable "$stringVar" of type "String" used in position expecting type "Boolean".
+      locations:
+        - {line: 2, column: 19}
+        - {line: 4, column: 39}
+- name: String => [String]
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringVar: String) {
+            complicatedArgs {
+              stringListArgField(stringListArg: $stringVar)
+            }
+          }
+
+  errors:
+    - message: Variable "$stringVar" of type "String" used in position expecting type "[String]".
+      locations:
+        - {line: 2, column: 19}
+        - {line: 4, column: 45}
+- name: Boolean => Boolean! in directive
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($boolVar: Boolean) {
+            dog @include(if: $boolVar)
+          }
+
+  errors:
+    - message: Variable "$boolVar" of type "Boolean" used in position expecting type "Boolean!".
+      locations:
+        - {line: 2, column: 19}
+        - {line: 3, column: 26}
+- name: String => Boolean! in directive
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringVar: String) {
+            dog @include(if: $stringVar)
+          }
+
+  errors:
+    - message: Variable "$stringVar" of type "String" used in position expecting type "Boolean!".
+      locations:
+        - {line: 2, column: 19}
+        - {line: 3, column: 26}
+- name: '[String] => [String!]'
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+          query Query($stringListVar: [String])
+          {
+            complicatedArgs {
+              stringListNonNullArgField(stringListNonNullArg: $stringListVar)
+            }
+          }
+
+  errors:
+    - message: Variable "$stringListVar" of type "[String]" used in position expecting type "[String!]".
+      locations:
+        - {line: 2, column: 19}
+        - {line: 5, column: 59}
+- name: Allows optional (nullable) variables with default values/Int => Int! fails when variable provides null default value
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+            query Query($intVar: Int = null) {
+              complicatedArgs {
+                nonNullIntArgField(nonNullIntArg: $intVar)
+              }
+            }
+
+  errors:
+    - message: Variable "$intVar" of type "Int" used in position expecting type "Int!".
+      locations:
+        - {line: 2, column: 21}
+        - {line: 4, column: 47}
+- name: Allows optional (nullable) variables with default values/Int => Int! when variable provides non-null default value
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+            query Query($intVar: Int = 1) {
+              complicatedArgs {
+                nonNullIntArgField(nonNullIntArg: $intVar)
+              }
+            }
+  errors: []
+- name: Allows optional (nullable) variables with default values/Int => Int! when optional argument provides default value
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+            query Query($intVar: Int) {
+              complicatedArgs {
+                nonNullFieldWithDefault(nonNullIntArg: $intVar)
+              }
+            }
+  errors: []
+- name: Allows optional (nullable) variables with default values/Boolean => Boolean! in directive with default value with option
+  rule: VariablesInAllowedPosition
+  schema: 0
+  query: |2-
+
+            query Query($boolVar: Boolean = false) {
+              dog @include(if: $boolVar)
+            }
+  errors: []
diff --git a/internal/gqlparser/validator/imported/spec/schemas.yml b/internal/gqlparser/validator/imported/spec/schemas.yml
new file mode 100644
index 0000000000..5eeafed367
--- /dev/null
+++ b/internal/gqlparser/validator/imported/spec/schemas.yml
@@ -0,0 +1,490 @@
+- |-
+  schema {
+    query: QueryRoot
+  }
+
+  directive @onField on FIELD
+
+  interface Mammal {
+    mother: Mammal
+    father: Mammal
+  }
+
+  interface Pet {
+    name(surname: Boolean): String
+  }
+
+  interface Canine implements Mammal {
+    name(surname: Boolean): String
+    mother: Canine
+    father: Canine
+  }
+
+  enum DogCommand {
+    SIT
+    HEEL
+    DOWN
+  }
+
+  type Dog implements Pet & Mammal & Canine {
+    name(surname: Boolean): String
+    nickname: String
+    barkVolume: Int
+    barks: Boolean
+    doesKnowCommand(dogCommand: DogCommand): Boolean
+    isHouseTrained(atOtherHomes: Boolean = true): Boolean
+    isAtLocation(x: Int, y: Int): Boolean
+    mother: Dog
+    father: Dog
+  }
+
+  type Cat implements Pet {
+    name(surname: Boolean): String
+    nickname: String
+    meows: Boolean
+    meowsVolume: Int
+    furColor: FurColor
+  }
+
+  union CatOrDog = Cat | Dog
+
+  type Human {
+    name(surname: Boolean): String
+    pets: [Pet]
+    relatives: [Human]
+  }
+
+  enum FurColor {
+    BROWN
+    BLACK
+    TAN
+    SPOTTED
+    NO_FUR
+    UNKNOWN
+  }
+
+  input ComplexInput {
+    requiredField: Boolean!
+    nonNullField: Boolean! = false
+    intField: Int
+    stringField: String
+    booleanField: Boolean
+    stringListField: [String]
+  }
+
+  type ComplicatedArgs {
+    intArgField(intArg: Int): String
+    nonNullIntArgField(nonNullIntArg: Int!): String
+    stringArgField(stringArg: String): String
+    booleanArgField(booleanArg: Boolean): String
+    enumArgField(enumArg: FurColor): String
+    floatArgField(floatArg: Float): String
+    idArgField(idArg: ID): String
+    stringListArgField(stringListArg: [String]): String
+    stringListNonNullArgField(stringListNonNullArg: [String!]): String
+    complexArgField(complexArg: ComplexInput): String
+    multipleReqs(req1: Int!, req2: Int!): String
+    nonNullFieldWithDefault(arg: Int! = 0): String
+    multipleOpts(opt1: Int = 0, opt2: Int = 0): String
+    multipleOptAndReq(req1: Int!, req2: Int!, opt1: Int = 0, opt2: Int = 0): String
+  }
+
+  type QueryRoot {
+    human(id: ID): Human
+    dog: Dog
+    cat: Cat
+    pet: Pet
+    catOrDog: CatOrDog
+    complicatedArgs: ComplicatedArgs
+  }
+  # injected becuase upstream spec is missing some types
+  extend type QueryRoot {
+      field: T
+      f1: Type
+      f2: Type
+      f3: Type
+  }
+
+  type Type {
+      a: String
+      b: String
+      c: String
+  }
+  type T {
+      a: String
+      b: String
+      c: String
+      d: String
+      y: String
+      deepField: T
+      deeperField: T
+  }
+- |-
+  interface Pet {
+    name: String
+  }
+
+  type Dog implements Pet {
+    name: String
+    nickname: String
+    barkVolume: Int
+  }
+
+  type Cat implements Pet {
+    name: String
+    nickname: String
+    meowVolume: Int
+  }
+
+  union CatOrDog = Cat | Dog
+
+  type Human {
+    name: String
+    pets: [Pet]
+  }
+
+  type Query {
+    human: Human
+  }
+- |-
+  directive @onQuery on QUERY
+
+  directive @onMutation on MUTATION
+
+  directive @onSubscription on SUBSCRIPTION
+
+  directive @onField on FIELD
+
+  directive @onFragmentDefinition on FRAGMENT_DEFINITION
+
+  directive @onFragmentSpread on FRAGMENT_SPREAD
+
+  directive @onInlineFragment on INLINE_FRAGMENT
+
+  directive @onVariableDefinition on VARIABLE_DEFINITION
+
+  type Query {
+    dummy: String
+  }
+- |-
+  type Query {
+    foo: String
+  }
+- |-
+  type Query {
+    normalField: String
+    deprecatedField: String @deprecated(reason: "Some field reason.")
+  }
+- |-
+  type Query {
+    someField(normalArg: String, deprecatedArg: String @deprecated(reason: "Some arg reason.")): String
+  }
+- |-
+  directive @someDirective(normalArg: String, deprecatedArg: String @deprecated(reason: "Some arg reason.")) on FIELD
+
+  type Query {
+    someField: String
+  }
+- |-
+  directive @someDirective(someArg: InputType) on FIELD
+
+  input InputType {
+    normalField: String
+    deprecatedField: String @deprecated(reason: "Some input field reason.")
+  }
+
+  type Query {
+    someField(someArg: InputType): String
+  }
+- |-
+  enum EnumType {
+    NORMAL_VALUE
+    DEPRECATED_VALUE @deprecated(reason: "Some enum reason.")
+  }
+
+  type Query {
+    someField(enumArg: EnumType): String
+  }
+- |-
+  type Query {
+    someQuery: SomeType
+  }
+
+  type SomeType {
+    someField: String
+    introspectionField: __EnumValue
+  }
+- |-
+  type Query {
+    someField(a: String, b: String): String
+  }
+- |-
+  input SomeInput {
+    a: String
+    b: String
+  }
+
+  type Query {
+    someField(arg: SomeInput): String
+  }
+- |-
+  interface SomeBox {
+    deepBox: SomeBox
+    unrelatedField: String
+  }
+
+  type StringBox implements SomeBox {
+    scalar: String
+    deepBox: StringBox
+    unrelatedField: String
+    listStringBox: [StringBox]
+    stringBox: StringBox
+    intBox: IntBox
+  }
+
+  type IntBox implements SomeBox {
+    scalar: Int
+    deepBox: IntBox
+    unrelatedField: String
+    listStringBox: [StringBox]
+    stringBox: StringBox
+    intBox: IntBox
+  }
+
+  interface NonNullStringBox1 {
+    scalar: String!
+  }
+
+  type NonNullStringBox1Impl implements SomeBox & NonNullStringBox1 {
+    scalar: String!
+    unrelatedField: String
+    deepBox: SomeBox
+  }
+
+  interface NonNullStringBox2 {
+    scalar: String!
+  }
+
+  type NonNullStringBox2Impl implements SomeBox & NonNullStringBox2 {
+    scalar: String!
+    unrelatedField: String
+    deepBox: SomeBox
+  }
+
+  type Connection {
+    edges: [Edge]
+  }
+
+  type Edge {
+    node: Node
+  }
+
+  type Node {
+    id: ID
+    name: String
+  }
+
+  type Query {
+    someBox: SomeBox
+    connection: Connection
+  }
+- |-
+  type Foo {
+    constructor: String
+  }
+
+  type Query {
+    foo: Foo
+  }
+- |-
+  interface Being {
+    name: String
+  }
+
+  interface Pet implements Being {
+    name: String
+  }
+
+  type Dog implements Being & Pet {
+    name: String
+    barkVolume: Int
+  }
+
+  type Cat implements Being & Pet {
+    name: String
+    meowVolume: Int
+  }
+
+  union CatOrDog = Cat | Dog
+
+  interface Intelligent {
+    iq: Int
+  }
+
+  type Human implements Being & Intelligent {
+    name: String
+    pets: [Pet]
+    iq: Int
+  }
+
+  type Alien implements Being & Intelligent {
+    name: String
+    iq: Int
+  }
+
+  union DogOrHuman = Dog | Human
+
+  union HumanOrAlien = Human | Alien
+
+  type Query {
+    catOrDog: CatOrDog
+    dogOrHuman: DogOrHuman
+    humanOrAlien: HumanOrAlien
+  }
+- |-
+  schema {
+    query: QueryRoot
+    subscription: SubscriptionRoot
+  }
+
+  type Message {
+    body: String
+    sender: String
+  }
+
+  type SubscriptionRoot {
+    importantEmails: [String]
+    notImportantEmails: [String]
+    moreImportantEmails: [String]
+    spamEmails: [String]
+    deletedEmails: [String]
+    newMessage: Message
+  }
+
+  type QueryRoot {
+    dummy: String
+  }
+- |-
+  type Query {
+    dummy: String
+  }
+- |-
+  schema {
+    query: QueryRoot
+  }
+
+  directive @onField on FIELD
+
+  directive @directive on FIELD | FRAGMENT_DEFINITION
+
+  directive @directiveA on FIELD | FRAGMENT_DEFINITION
+
+  directive @directiveB on FIELD | FRAGMENT_DEFINITION
+
+  directive @repeatable repeatable on FIELD | FRAGMENT_DEFINITION
+
+  interface Mammal {
+    mother: Mammal
+    father: Mammal
+  }
+
+  interface Pet {
+    name(surname: Boolean): String
+  }
+
+  interface Canine implements Mammal {
+    name(surname: Boolean): String
+    mother: Canine
+    father: Canine
+  }
+
+  enum DogCommand {
+    SIT
+    HEEL
+    DOWN
+  }
+
+  type Dog implements Pet & Mammal & Canine {
+    name(surname: Boolean): String
+    nickname: String
+    barkVolume: Int
+    barks: Boolean
+    doesKnowCommand(dogCommand: DogCommand): Boolean
+    isHouseTrained(atOtherHomes: Boolean = true): Boolean
+    isAtLocation(x: Int, y: Int): Boolean
+    mother: Dog
+    father: Dog
+  }
+
+  type Cat implements Pet {
+    name(surname: Boolean): String
+    nickname: String
+    meows: Boolean
+    meowsVolume: Int
+    furColor: FurColor
+  }
+
+  union CatOrDog = Cat | Dog
+
+  type Human {
+    name(surname: Boolean): String
+    pets: [Pet]
+    relatives: [Human]
+  }
+
+  enum FurColor {
+    BROWN
+    BLACK
+    TAN
+    SPOTTED
+    NO_FUR
+    UNKNOWN
+  }
+
+  input ComplexInput {
+    requiredField: Boolean!
+    nonNullField: Boolean! = false
+    intField: Int
+    stringField: String
+    booleanField: Boolean
+    stringListField: [String]
+  }
+
+  type ComplicatedArgs {
+    intArgField(intArg: Int): String
+    nonNullIntArgField(nonNullIntArg: Int!): String
+    stringArgField(stringArg: String): String
+    booleanArgField(booleanArg: Boolean): String
+    enumArgField(enumArg: FurColor): String
+    floatArgField(floatArg: Float): String
+    idArgField(idArg: ID): String
+    stringListArgField(stringListArg: [String]): String
+    stringListNonNullArgField(stringListNonNullArg: [String!]): String
+    complexArgField(complexArg: ComplexInput): String
+    multipleReqs(req1: Int!, req2: Int!): String
+    nonNullFieldWithDefault(arg: Int! = 0): String
+    multipleOpts(opt1: Int = 0, opt2: Int = 0): String
+    multipleOptAndReq(req1: Int!, req2: Int!, opt1: Int = 0, opt2: Int = 0): String
+  }
+
+  type QueryRoot {
+    human(id: ID): Human
+    dog: Dog
+    cat: Cat
+    pet: Pet
+    catOrDog: CatOrDog
+    complicatedArgs: ComplicatedArgs
+  }
+- |-
+  type Query {
+    invalidArg(arg: CustomScalar): String
+  }
+
+  scalar CustomScalar
+- |-
+  type Query {
+    anyArg(arg: Any): String
+  }
+
+  scalar Any
+- ""
diff --git a/internal/gqlparser/validator/imported/tests.json b/internal/gqlparser/validator/imported/tests.json
new file mode 100644
index 0000000000..93a0c41f33
--- /dev/null
+++ b/internal/gqlparser/validator/imported/tests.json
@@ -0,0 +1,5250 @@
+  {
+  "schemas": [
+    "schema {\n  query: QueryRoot\n}\n\ndirective @onQuery on QUERY\n\ndirective @onMutation on MUTATION\n\ndirective @onSubscription on SUBSCRIPTION\n\ndirective @onField on FIELD\n\ndirective @onFragmentDefinition on FRAGMENT_DEFINITION\n\ndirective @onFragmentSpread on FRAGMENT_SPREAD\n\ndirective @onInlineFragment on INLINE_FRAGMENT\n\ndirective @onSchema on SCHEMA\n\ndirective @onScalar on SCALAR\n\ndirective @onObject on OBJECT\n\ndirective @onFieldDefinition on FIELD_DEFINITION\n\ndirective @onArgumentDefinition on ARGUMENT_DEFINITION\n\ndirective @onInterface on INTERFACE\n\ndirective @onUnion on UNION\n\ndirective @onEnum on ENUM\n\ndirective @onEnumValue on ENUM_VALUE\n\ndirective @onInputObject on INPUT_OBJECT\n\ndirective @onInputFieldDefinition on INPUT_FIELD_DEFINITION\n\ntype Alien implements Being & Intelligent {\n  iq: Int\n  name(surname: Boolean): String\n  numEyes: Int\n}\n\nscalar Any\n\ninterface Being {\n  name(surname: Boolean): String\n}\n\ninterface Canine {\n  name(surname: Boolean): String\n}\n\ntype Cat implements Being & Pet {\n  name(surname: Boolean): String\n  nickname: String\n  meows: Boolean\n  meowVolume: Int\n  furColor: FurColor\n}\n\nunion CatOrDog = Dog | Cat\n\ninput ComplexInput {\n  requiredField: Boolean!\n  nonNullField: Boolean! = false\n  intField: Int\n  stringField: String\n  booleanField: Boolean\n  stringListField: [String]\n}\n\ntype ComplicatedArgs {\n  intArgField(intArg: Int): String\n  nonNullIntArgField(nonNullIntArg: Int!): String\n  stringArgField(stringArg: String): String\n  booleanArgField(booleanArg: Boolean): String\n  enumArgField(enumArg: FurColor): String\n  floatArgField(floatArg: Float): String\n  idArgField(idArg: ID): String\n  stringListArgField(stringListArg: [String]): String\n  stringListNonNullArgField(stringListNonNullArg: [String!]): String\n  complexArgField(complexArg: ComplexInput): String\n  multipleReqs(req1: Int!, req2: Int!): String\n  nonNullFieldWithDefault(arg: Int! = 0): String\n  multipleOpts(opt1: Int = 0, opt2: Int = 0): String\n  multipleOptAndReq(req1: Int!, req2: Int!, opt1: Int = 0, opt2: Int = 0): String\n}\n\ntype Dog implements Being & Pet & Canine {\n  name(surname: Boolean): String\n  nickname: String\n  barkVolume: Int\n  barks: Boolean\n  doesKnowCommand(dogCommand: DogCommand): Boolean\n  isHousetrained(atOtherHomes: Boolean = true): Boolean\n  isAtLocation(x: Int, y: Int): Boolean\n}\n\nenum DogCommand {\n  SIT\n  HEEL\n  DOWN\n}\n\nunion DogOrHuman = Dog | Human\n\nenum FurColor {\n  BROWN\n  BLACK\n  TAN\n  SPOTTED\n  NO_FUR\n  UNKNOWN\n}\n\ntype Human implements Being & Intelligent {\n  name(surname: Boolean): String\n  pets: [Pet]\n  relatives: [Human]\n  iq: Int\n}\n\nunion HumanOrAlien = Human | Alien\n\ninterface Intelligent {\n  iq: Int\n}\n\nscalar Invalid\n\ninterface Pet {\n  name(surname: Boolean): String\n}\n\ntype QueryRoot {\n  human(id: ID): Human\n  alien: Alien\n  dog: Dog\n  cat: Cat\n  pet: Pet\n  catOrDog: CatOrDog\n  dogOrHuman: DogOrHuman\n  humanOrAlien: HumanOrAlien\n  complicatedArgs: ComplicatedArgs\n  invalidArg(arg: Invalid): String\n  anyArg(arg: Any): String\n}\n",
+    "schema {\n  query: QueryRoot\n}\n\ntype Connection {\n  edges: [Edge]\n}\n\ntype Edge {\n  node: Node\n}\n\ntype IntBox implements SomeBox {\n  scalar: Int\n  deepBox: IntBox\n  unrelatedField: String\n  listStringBox: [StringBox]\n  stringBox: StringBox\n  intBox: IntBox\n}\n\ntype Node {\n  id: ID\n  name: String\n}\n\ninterface NonNullStringBox1 {\n  scalar: String!\n}\n\ntype NonNullStringBox1Impl implements SomeBox & NonNullStringBox1 {\n  scalar: String!\n  unrelatedField: String\n  deepBox: SomeBox\n}\n\ninterface NonNullStringBox2 {\n  scalar: String!\n}\n\ntype NonNullStringBox2Impl implements SomeBox & NonNullStringBox2 {\n  scalar: String!\n  unrelatedField: String\n  deepBox: SomeBox\n}\n\ntype QueryRoot {\n  someBox: SomeBox\n  connection: Connection\n}\n\ninterface SomeBox {\n  deepBox: SomeBox\n  unrelatedField: String\n}\n\ntype StringBox implements SomeBox {\n  scalar: String\n  deepBox: StringBox\n  unrelatedField: String\n  listStringBox: [StringBox]\n  stringBox: StringBox\n  intBox: IntBox\n}\n",
+    "type Foo {\n  constructor: String\n}\n\ntype Query {\n  foo: Foo\n}\n"
+  ],
+  "tests": [
+    {
+      "name": "Validate: Executable definitions/with only operation",
+      "rule": "ExecutableDefinitions",
+      "schema": 0,
+      "query": "\n      query Foo {\n        dog {\n          name\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Executable definitions/with operation and fragment",
+      "rule": "ExecutableDefinitions",
+      "schema": 0,
+      "query": "\n      query Foo {\n        dog {\n          name\n          ...Frag\n        }\n      }\n\n      fragment Frag on Dog {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Executable definitions/with type definition",
+      "rule": "ExecutableDefinitions",
+      "schema": 0,
+      "query": "\n      query Foo {\n        dog {\n          name\n        }\n      }\n\n      type Cow {\n        name: String\n      }\n\n      extend type Dog {\n        color: String\n      }\n    ",
+      "errors": [
+        {
+          "message": "The Cow definition is not executable.",
+          "locations": [
+            {
+              "line": 8,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "The Dog definition is not executable.",
+          "locations": [
+            {
+              "line": 12,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Executable definitions/with schema definition",
+      "rule": "ExecutableDefinitions",
+      "schema": 0,
+      "query": "\n      schema {\n        query: Query\n      }\n\n      type Query {\n        test: String\n      }\n\n      extend schema @directive\n    ",
+      "errors": [
+        {
+          "message": "The schema definition is not executable.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "The Query definition is not executable.",
+          "locations": [
+            {
+              "line": 6,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "The schema definition is not executable.",
+          "locations": [
+            {
+              "line": 10,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Object field selection",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment objectFieldSelection on Dog {\n        __typename\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/Aliased object field selection",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment aliasedObjectFieldSelection on Dog {\n        tn : __typename\n        otherName : name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/Interface field selection",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment interfaceFieldSelection on Pet {\n        __typename\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/Aliased interface field selection",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment interfaceFieldSelection on Pet {\n        otherName : name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/Lying alias selection",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment lyingAliasSelection on Dog {\n        name : nickname\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/Ignores fields on unknown type",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment unknownSelection on UnknownType {\n        unknownField\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/reports errors when type is known again",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment typeKnownAgain on Pet {\n        unknown_pet_field {\n          ... on Cat {\n            unknown_cat_field\n          }\n        }\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"unknown_pet_field\" on type \"Pet\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        },
+        {
+          "message": "Cannot query field \"unknown_cat_field\" on type \"Cat\".",
+          "locations": [
+            {
+              "line": 5,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Field not defined on fragment",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment fieldNotDefined on Dog {\n        meowVolume\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"meowVolume\" on type \"Dog\". Did you mean \"barkVolume\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Ignores deeply unknown field",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment deepFieldNotDefined on Dog {\n        unknown_field {\n          deeper_unknown_field\n        }\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"unknown_field\" on type \"Dog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Sub-field not defined",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment subFieldNotDefined on Human {\n        pets {\n          unknown_field\n        }\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"unknown_field\" on type \"Pet\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 11
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Field not defined on inline fragment",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment fieldNotDefined on Pet {\n        ... on Dog {\n          meowVolume\n        }\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"meowVolume\" on type \"Dog\". Did you mean \"barkVolume\"?",
+          "locations": [
+            {
+              "line": 4,
+              "column": 11
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Aliased field target not defined",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment aliasedFieldTargetNotDefined on Dog {\n        volume : mooVolume\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"mooVolume\" on type \"Dog\". Did you mean \"barkVolume\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Aliased lying field target not defined",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment aliasedLyingFieldTargetNotDefined on Dog {\n        barkVolume : kawVolume\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"kawVolume\" on type \"Dog\". Did you mean \"barkVolume\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Not defined on interface",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment notDefinedOnInterface on Pet {\n        tailLength\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"tailLength\" on type \"Pet\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Defined on implementors but not on interface",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment definedOnImplementorsButNotInterface on Pet {\n        nickname\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"nickname\" on type \"Pet\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Meta field selection on union",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment directFieldSelectionOnUnion on CatOrDog {\n        __typename\n      }",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fields on correct type/Direct field selection on union",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment directFieldSelectionOnUnion on CatOrDog {\n        directField\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"directField\" on type \"CatOrDog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/Defined on implementors queried on union",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment definedOnImplementorsQueriedOnUnion on CatOrDog {\n        name\n      }",
+      "errors": [
+        {
+          "message": "Cannot query field \"name\" on type \"CatOrDog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fields on correct type/valid field in inline fragment",
+      "rule": "FieldsOnCorrectType",
+      "schema": 0,
+      "query": "\n      fragment objectFieldSelection on Pet {\n        ... on Dog {\n          name\n        }\n        ... {\n          name\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fragments on composite types/object is valid fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment validFragment on Dog {\n        barks\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fragments on composite types/interface is valid fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment validFragment on Pet {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fragments on composite types/object is valid inline fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment validFragment on Pet {\n        ... on Dog {\n          barks\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fragments on composite types/inline fragment without type is valid",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment validFragment on Pet {\n        ... {\n          name\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fragments on composite types/union is valid fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment validFragment on CatOrDog {\n        __typename\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Fragments on composite types/scalar is invalid fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment scalarFragment on Boolean {\n        bad\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"scalarFragment\" cannot condition on non composite type \"Boolean\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 34
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fragments on composite types/enum is invalid fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment scalarFragment on FurColor {\n        bad\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"scalarFragment\" cannot condition on non composite type \"FurColor\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 34
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fragments on composite types/input object is invalid fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment inputFragment on ComplexInput {\n        stringField\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"inputFragment\" cannot condition on non composite type \"ComplexInput\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Fragments on composite types/scalar is invalid inline fragment type",
+      "rule": "FragmentsOnCompositeTypes",
+      "schema": 0,
+      "query": "\n      fragment invalidFragment on Pet {\n        ... on String {\n          barks\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment cannot condition on non composite type \"String\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 16
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known argument names/single arg is known",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment argOnRequiredArg on Dog {\n        doesKnowCommand(dogCommand: SIT)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/multiple args are known",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment multipleArgs on ComplicatedArgs {\n        multipleReqs(req1: 1, req2: 2)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/ignores args of unknown fields",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment argOnUnknownField on Dog {\n        unknownField(unknownArg: SIT)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/multiple args in reverse order are known",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment multipleArgsReverseOrder on ComplicatedArgs {\n        multipleReqs(req2: 2, req1: 1)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/no args on optional arg",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment noArgOnOptionalArg on Dog {\n        isHousetrained\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/args are known deeply",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        dog {\n          doesKnowCommand(dogCommand: SIT)\n        }\n        human {\n          pet {\n            ... on Dog {\n              doesKnowCommand(dogCommand: SIT)\n            }\n          }\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/directive args are known",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        dog @skip(if: true)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known argument names/undirective args are invalid",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        dog @skip(unless: true)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown argument \"unless\" on directive \"@skip\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 19
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known argument names/misspelled directive args are reported",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        dog @skip(iff: true)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown argument \"iff\" on directive \"@skip\". Did you mean \"if\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 19
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known argument names/invalid arg name",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment invalidArgName on Dog {\n        doesKnowCommand(unknown: true)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown argument \"unknown\" on field \"doesKnowCommand\" of type \"Dog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 25
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known argument names/misspelled arg name is reported",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment invalidArgName on Dog {\n        doesKnowCommand(dogcommand: true)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown argument \"dogcommand\" on field \"doesKnowCommand\" of type \"Dog\". Did you mean \"dogCommand\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 25
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known argument names/unknown args amongst known args",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      fragment oneGoodArgOneInvalidArg on Dog {\n        doesKnowCommand(whoknows: 1, dogCommand: SIT, unknown: true)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown argument \"whoknows\" on field \"doesKnowCommand\" of type \"Dog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 25
+            }
+          ]
+        },
+        {
+          "message": "Unknown argument \"unknown\" on field \"doesKnowCommand\" of type \"Dog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 55
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known argument names/unknown args deeply",
+      "rule": "KnownArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        dog {\n          doesKnowCommand(unknown: true)\n        }\n        human {\n          pet {\n            ... on Dog {\n              doesKnowCommand(unknown: true)\n            }\n          }\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown argument \"unknown\" on field \"doesKnowCommand\" of type \"Dog\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 27
+            }
+          ]
+        },
+        {
+          "message": "Unknown argument \"unknown\" on field \"doesKnowCommand\" of type \"Dog\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known directives/with no directives",
+      "rule": "KnownDirectives",
+      "schema": 0,
+      "query": "\n      query Foo {\n        name\n        ...Frag\n      }\n\n      fragment Frag on Dog {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known directives/with known directives",
+      "rule": "KnownDirectives",
+      "schema": 0,
+      "query": "\n      {\n        dog @include(if: true) {\n          name\n        }\n        human @skip(if: false) {\n          name\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known directives/with unknown directive",
+      "rule": "KnownDirectives",
+      "schema": 0,
+      "query": "\n      {\n        dog @unknown(directive: \"value\") {\n          name\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown directive \"unknown\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known directives/with many unknown directives",
+      "rule": "KnownDirectives",
+      "schema": 0,
+      "query": "\n      {\n        dog @unknown(directive: \"value\") {\n          name\n        }\n        human @unknown(directive: \"value\") {\n          name\n          pets @unknown(directive: \"value\") {\n            name\n          }\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown directive \"unknown\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 13
+            }
+          ]
+        },
+        {
+          "message": "Unknown directive \"unknown\".",
+          "locations": [
+            {
+              "line": 6,
+              "column": 15
+            }
+          ]
+        },
+        {
+          "message": "Unknown directive \"unknown\".",
+          "locations": [
+            {
+              "line": 8,
+              "column": 16
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known directives/with well placed directives",
+      "rule": "KnownDirectives",
+      "schema": 0,
+      "query": "\n      query Foo @onQuery {\n        name @include(if: true)\n        ...Frag @include(if: true)\n        skippedField @skip(if: true)\n        ...SkippedFrag @skip(if: true)\n      }\n\n      mutation Bar @onMutation {\n        someField\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known directives/with misplaced directives",
+      "rule": "KnownDirectives",
+      "schema": 0,
+      "query": "\n      query Foo @include(if: true) {\n        name @onQuery\n        ...Frag @onQuery\n      }\n\n      mutation Bar @onQuery {\n        someField\n      }\n    ",
+      "errors": [
+        {
+          "message": "Directive \"include\" may not be used on QUERY.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 17
+            }
+          ]
+        },
+        {
+          "message": "Directive \"onQuery\" may not be used on FIELD.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 14
+            }
+          ]
+        },
+        {
+          "message": "Directive \"onQuery\" may not be used on FRAGMENT_SPREAD.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 17
+            }
+          ]
+        },
+        {
+          "message": "Directive \"onQuery\" may not be used on MUTATION.",
+          "locations": [
+            {
+              "line": 7,
+              "column": 20
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known fragment names/known fragment names are valid",
+      "rule": "KnownFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        human(id: 4) {\n          ...HumanFields1\n          ... on Human {\n            ...HumanFields2\n          }\n          ... {\n            name\n          }\n        }\n      }\n      fragment HumanFields1 on Human {\n        name\n        ...HumanFields3\n      }\n      fragment HumanFields2 on Human {\n        name\n      }\n      fragment HumanFields3 on Human {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known fragment names/unknown fragment names are invalid",
+      "rule": "KnownFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        human(id: 4) {\n          ...UnknownFragment1\n          ... on Human {\n            ...UnknownFragment2\n          }\n        }\n      }\n      fragment HumanFields on Human {\n        name\n        ...UnknownFragment3\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown fragment \"UnknownFragment1\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 14
+            }
+          ]
+        },
+        {
+          "message": "Unknown fragment \"UnknownFragment2\".",
+          "locations": [
+            {
+              "line": 6,
+              "column": 16
+            }
+          ]
+        },
+        {
+          "message": "Unknown fragment \"UnknownFragment3\".",
+          "locations": [
+            {
+              "line": 12,
+              "column": 12
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Known type names/known type names are valid",
+      "rule": "KnownTypeNames",
+      "schema": 0,
+      "query": "\n      query Foo($var: String, $required: [String!]!) {\n        user(id: 4) {\n          pets { ... on Pet { name }, ...PetFields, ... { name } }\n        }\n      }\n      fragment PetFields on Pet {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Known type names/unknown type names are invalid",
+      "rule": "KnownTypeNames",
+      "schema": 0,
+      "query": "\n      query Foo($var: JumbledUpLetters) {\n        user(id: 4) {\n          name\n          pets { ... on Badger { name }, ...PetFields }\n        }\n      }\n      fragment PetFields on Peettt {\n        name\n      }\n    ",
+      "errors": [
+        {
+          "message": "Unknown type \"JumbledUpLetters\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 23
+            }
+          ]
+        },
+        {
+          "message": "Unknown type \"Badger\".",
+          "locations": [
+            {
+              "line": 5,
+              "column": 25
+            }
+          ]
+        },
+        {
+          "message": "Unknown type \"Peettt\".",
+          "locations": [
+            {
+              "line": 8,
+              "column": 29
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/no operations",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      fragment fragA on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/one anon operation",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/multiple named operations",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      query Foo {\n        field\n      }\n\n      query Bar {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/anon operation with fragment",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      {\n        ...Foo\n      }\n      fragment Foo on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/multiple anon operations",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      {\n        fieldA\n      }\n      {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "This anonymous operation must be the only defined operation.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "This anonymous operation must be the only defined operation.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/anon operation with a mutation",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      {\n        fieldA\n      }\n      mutation Foo {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "This anonymous operation must be the only defined operation.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Anonymous operation must be alone/anon operation with a subscription",
+      "rule": "LoneAnonymousOperation",
+      "schema": 0,
+      "query": "\n      {\n        fieldA\n      }\n      subscription Foo {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "This anonymous operation must be the only defined operation.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/single reference is valid",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB }\n      fragment fragB on Dog { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No circular fragment spreads/spreading twice is not circular",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB, ...fragB }\n      fragment fragB on Dog { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No circular fragment spreads/spreading twice indirectly is not circular",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB, ...fragC }\n      fragment fragB on Dog { ...fragC }\n      fragment fragC on Dog { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No circular fragment spreads/double spread within abstract types",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment nameFragment on Pet {\n        ... on Dog { name }\n        ... on Cat { name }\n      }\n\n      fragment spreadsInAnon on Pet {\n        ... on Dog { ...nameFragment }\n        ... on Cat { ...nameFragment }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No circular fragment spreads/does not false positive on unknown fragment",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment nameFragment on Pet {\n        ...UnknownFragment\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No circular fragment spreads/spreading recursively within field fails",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Human { relatives { ...fragA } },\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 45
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself directly",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragA }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself directly within inline fragment",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Pet {\n        ... on Dog {\n          ...fragA\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 11
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself indirectly",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB }\n      fragment fragB on Dog { ...fragA }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragB.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            },
+            {
+              "line": 3,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself indirectly reports opposite order",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragB on Dog { ...fragA }\n      fragment fragA on Dog { ...fragB }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragB\" within itself via fragA.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            },
+            {
+              "line": 3,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself indirectly within inline fragment",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Pet {\n        ... on Dog {\n          ...fragB\n        }\n      }\n      fragment fragB on Pet {\n        ... on Dog {\n          ...fragA\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragB.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 11
+            },
+            {
+              "line": 9,
+              "column": 11
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself deeply",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB }\n      fragment fragB on Dog { ...fragC }\n      fragment fragC on Dog { ...fragO }\n      fragment fragX on Dog { ...fragY }\n      fragment fragY on Dog { ...fragZ }\n      fragment fragZ on Dog { ...fragO }\n      fragment fragO on Dog { ...fragP }\n      fragment fragP on Dog { ...fragA, ...fragX }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragB, fragC, fragO, fragP.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            },
+            {
+              "line": 3,
+              "column": 31
+            },
+            {
+              "line": 4,
+              "column": 31
+            },
+            {
+              "line": 8,
+              "column": 31
+            },
+            {
+              "line": 9,
+              "column": 31
+            }
+          ]
+        },
+        {
+          "message": "Cannot spread fragment \"fragO\" within itself via fragP, fragX, fragY, fragZ.",
+          "locations": [
+            {
+              "line": 8,
+              "column": 31
+            },
+            {
+              "line": 9,
+              "column": 41
+            },
+            {
+              "line": 5,
+              "column": 31
+            },
+            {
+              "line": 6,
+              "column": 31
+            },
+            {
+              "line": 7,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself deeply two paths",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB, ...fragC }\n      fragment fragB on Dog { ...fragA }\n      fragment fragC on Dog { ...fragA }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragB.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            },
+            {
+              "line": 3,
+              "column": 31
+            }
+          ]
+        },
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragC.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 41
+            },
+            {
+              "line": 4,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself deeply two paths -- alt traverse order",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragC }\n      fragment fragB on Dog { ...fragC }\n      fragment fragC on Dog { ...fragA, ...fragB }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragC.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            },
+            {
+              "line": 4,
+              "column": 31
+            }
+          ]
+        },
+        {
+          "message": "Cannot spread fragment \"fragC\" within itself via fragB.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            },
+            {
+              "line": 3,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No circular fragment spreads/no spreading itself deeply and immediately",
+      "rule": "NoFragmentCycles",
+      "schema": 0,
+      "query": "\n      fragment fragA on Dog { ...fragB }\n      fragment fragB on Dog { ...fragB, ...fragC }\n      fragment fragC on Dog { ...fragA, ...fragB }\n    ",
+      "errors": [
+        {
+          "message": "Cannot spread fragment \"fragB\" within itself.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 31
+            }
+          ]
+        },
+        {
+          "message": "Cannot spread fragment \"fragA\" within itself via fragB, fragC.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 31
+            },
+            {
+              "line": 3,
+              "column": 41
+            },
+            {
+              "line": 4,
+              "column": 31
+            }
+          ]
+        },
+        {
+          "message": "Cannot spread fragment \"fragB\" within itself via fragC.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 41
+            },
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/all variables defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        field(a: $a, b: $b, c: $c)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/all variables deeply defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        field(a: $a) {\n          field(b: $b) {\n            field(c: $c)\n          }\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/all variables deeply in inline fragments defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        ... on Type {\n          field(a: $a) {\n            field(b: $b) {\n              ... on Type {\n                field(c: $c)\n              }\n            }\n          }\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/all variables in fragments deeply defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragB\n        }\n      }\n      fragment FragB on Type {\n        field(b: $b) {\n          ...FragC\n        }\n      }\n      fragment FragC on Type {\n        field(c: $c)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/variable within single fragment defined in multiple operations",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String) {\n        ...FragA\n      }\n      query Bar($a: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/variable within fragments defined in operations",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String) {\n        ...FragA\n      }\n      query Bar($b: String) {\n        ...FragB\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n      fragment FragB on Type {\n        field(b: $b)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/variable within recursive fragment defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragA\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No undefined variables/variable not defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        field(a: $a, b: $b, c: $c, d: $d)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$d\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 39
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/variable not defined by un-named query",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      {\n        field(a: $a)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/multiple variables not defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        field(a: $a, b: $b, c: $c)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$c\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 32
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/variable in fragment not defined by un-named query",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined.",
+          "locations": [
+            {
+              "line": 6,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/variable in fragment not defined by operation",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragB\n        }\n      }\n      fragment FragB on Type {\n        field(b: $b) {\n          ...FragC\n        }\n      }\n      fragment FragC on Type {\n        field(c: $c)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$c\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 16,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/multiple variables in fragments not defined",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragB\n        }\n      }\n      fragment FragB on Type {\n        field(b: $b) {\n          ...FragC\n        }\n      }\n      fragment FragC on Type {\n        field(c: $c)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 6,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$c\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 16,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/single variable in fragment not defined by multiple operations",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String) {\n        ...FragAB\n      }\n      query Bar($a: String) {\n        ...FragAB\n      }\n      fragment FragAB on Type {\n        field(a: $a, b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$b\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 25
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$b\" is not defined by operation \"Bar\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 25
+            },
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/variables in fragment not defined by multiple operations",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        ...FragAB\n      }\n      query Bar($a: String) {\n        ...FragAB\n      }\n      fragment FragAB on Type {\n        field(a: $a, b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$b\" is not defined by operation \"Bar\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 25
+            },
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/variable in fragment used by other operation",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        ...FragA\n      }\n      query Bar($a: String) {\n        ...FragB\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n      fragment FragB on Type {\n        field(b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 18
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$b\" is not defined by operation \"Bar\".",
+          "locations": [
+            {
+              "line": 12,
+              "column": 18
+            },
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No undefined variables/multiple undefined variables produce multiple errors",
+      "rule": "NoUndefinedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        ...FragAB\n      }\n      query Bar($a: String) {\n        ...FragAB\n      }\n      fragment FragAB on Type {\n        field1(a: $a, b: $b)\n        ...FragC\n        field3(a: $a, b: $b)\n      }\n      fragment FragC on Type {\n        field2(c: $c)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 19
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$a\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 11,
+              "column": 19
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$c\" is not defined by operation \"Foo\".",
+          "locations": [
+            {
+              "line": 14,
+              "column": 19
+            },
+            {
+              "line": 2,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$b\" is not defined by operation \"Bar\".",
+          "locations": [
+            {
+              "line": 9,
+              "column": 26
+            },
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$b\" is not defined by operation \"Bar\".",
+          "locations": [
+            {
+              "line": 11,
+              "column": 26
+            },
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$c\" is not defined by operation \"Bar\".",
+          "locations": [
+            {
+              "line": 14,
+              "column": 19
+            },
+            {
+              "line": 5,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused fragments/all fragment names are used",
+      "rule": "NoUnusedFragments",
+      "schema": 0,
+      "query": "\n      {\n        human(id: 4) {\n          ...HumanFields1\n          ... on Human {\n            ...HumanFields2\n          }\n        }\n      }\n      fragment HumanFields1 on Human {\n        name\n        ...HumanFields3\n      }\n      fragment HumanFields2 on Human {\n        name\n      }\n      fragment HumanFields3 on Human {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused fragments/all fragment names are used by multiple operations",
+      "rule": "NoUnusedFragments",
+      "schema": 0,
+      "query": "\n      query Foo {\n        human(id: 4) {\n          ...HumanFields1\n        }\n      }\n      query Bar {\n        human(id: 4) {\n          ...HumanFields2\n        }\n      }\n      fragment HumanFields1 on Human {\n        name\n        ...HumanFields3\n      }\n      fragment HumanFields2 on Human {\n        name\n      }\n      fragment HumanFields3 on Human {\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused fragments/contains unknown fragments",
+      "rule": "NoUnusedFragments",
+      "schema": 0,
+      "query": "\n      query Foo {\n        human(id: 4) {\n          ...HumanFields1\n        }\n      }\n      query Bar {\n        human(id: 4) {\n          ...HumanFields2\n        }\n      }\n      fragment HumanFields1 on Human {\n        name\n        ...HumanFields3\n      }\n      fragment HumanFields2 on Human {\n        name\n      }\n      fragment HumanFields3 on Human {\n        name\n      }\n      fragment Unused1 on Human {\n        name\n      }\n      fragment Unused2 on Human {\n        name\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"Unused1\" is never used.",
+          "locations": [
+            {
+              "line": 22,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Fragment \"Unused2\" is never used.",
+          "locations": [
+            {
+              "line": 25,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused fragments/contains unknown fragments with ref cycle",
+      "rule": "NoUnusedFragments",
+      "schema": 0,
+      "query": "\n      query Foo {\n        human(id: 4) {\n          ...HumanFields1\n        }\n      }\n      query Bar {\n        human(id: 4) {\n          ...HumanFields2\n        }\n      }\n      fragment HumanFields1 on Human {\n        name\n        ...HumanFields3\n      }\n      fragment HumanFields2 on Human {\n        name\n      }\n      fragment HumanFields3 on Human {\n        name\n      }\n      fragment Unused1 on Human {\n        name\n        ...Unused2\n      }\n      fragment Unused2 on Human {\n        name\n        ...Unused1\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"Unused1\" is never used.",
+          "locations": [
+            {
+              "line": 22,
+              "column": 7
+            }
+          ]
+        },
+        {
+          "message": "Fragment \"Unused2\" is never used.",
+          "locations": [
+            {
+              "line": 26,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused fragments/contains unknown and undef fragments",
+      "rule": "NoUnusedFragments",
+      "schema": 0,
+      "query": "\n      query Foo {\n        human(id: 4) {\n          ...bar\n        }\n      }\n      fragment foo on Human {\n        name\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"foo\" is never used.",
+          "locations": [
+            {
+              "line": 7,
+              "column": 7
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused variables/uses all variables",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query ($a: String, $b: String, $c: String) {\n        field(a: $a, b: $b, c: $c)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused variables/uses all variables deeply",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        field(a: $a) {\n          field(b: $b) {\n            field(c: $c)\n          }\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused variables/uses all variables deeply in inline fragments",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        ... on Type {\n          field(a: $a) {\n            field(b: $b) {\n              ... on Type {\n                field(c: $c)\n              }\n            }\n          }\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused variables/uses all variables in fragments",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragB\n        }\n      }\n      fragment FragB on Type {\n        field(b: $b) {\n          ...FragC\n        }\n      }\n      fragment FragC on Type {\n        field(c: $c)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused variables/variable used by fragment in multiple operations",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String) {\n        ...FragA\n      }\n      query Bar($b: String) {\n        ...FragB\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n      fragment FragB on Type {\n        field(b: $b)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused variables/variable used by recursive fragment",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragA\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: No unused variables/variable not used",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query ($a: String, $b: String, $c: String) {\n        field(a: $a, b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$c\" is never used.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 38
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused variables/multiple variables not used",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        field(b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 17
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$c\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused variables/variable not used in fragments",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a) {\n          ...FragB\n        }\n      }\n      fragment FragB on Type {\n        field(b: $b) {\n          ...FragC\n        }\n      }\n      fragment FragC on Type {\n        field\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$c\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused variables/multiple variables not used in fragments",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: String, $c: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field {\n          ...FragB\n        }\n      }\n      fragment FragB on Type {\n        field(b: $b) {\n          ...FragC\n        }\n      }\n      fragment FragC on Type {\n        field\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$a\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 17
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$c\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused variables/variable not used by unreferenced fragment",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        ...FragA\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n      fragment FragB on Type {\n        field(b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$b\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 17
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: No unused variables/variable not used by fragment used by other operation",
+      "rule": "NoUnusedVariables",
+      "schema": 0,
+      "query": "\n      query Foo($b: String) {\n        ...FragA\n      }\n      query Bar($a: String) {\n        ...FragB\n      }\n      fragment FragA on Type {\n        field(a: $a)\n      }\n      fragment FragB on Type {\n        field(b: $b)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$b\" is never used in operation \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 17
+            }
+          ]
+        },
+        {
+          "message": "Variable \"$a\" is never used in operation \"Bar\".",
+          "locations": [
+            {
+              "line": 5,
+              "column": 17
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/unique fields",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment uniqueFields on Dog {\n        name\n        nickname\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/identical fields",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment mergeIdenticalFields on Dog {\n        name\n        name\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/identical fields with identical args",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment mergeIdenticalFieldsWithIdenticalArgs on Dog {\n        doesKnowCommand(dogCommand: SIT)\n        doesKnowCommand(dogCommand: SIT)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/identical fields with identical directives",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment mergeSameFieldsWithSameDirectives on Dog {\n        name @include(if: true)\n        name @include(if: true)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/different args with different aliases",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment differentArgsWithDifferentAliases on Dog {\n        knowsSit: doesKnowCommand(dogCommand: SIT)\n        knowsDown: doesKnowCommand(dogCommand: DOWN)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/different directives with different aliases",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment differentDirectivesWithDifferentAliases on Dog {\n        nameIfTrue: name @include(if: true)\n        nameIfFalse: name @include(if: false)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/different skip/include directives accepted",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment differentDirectivesWithDifferentAliases on Dog {\n        name @include(if: true)\n        name @include(if: false)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/Same aliases with different field targets",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment sameAliasesWithDifferentFieldTargets on Dog {\n        fido: name\n        fido: nickname\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"fido\" conflict because name and nickname are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/Same aliases allowed on non-overlapping fields",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment sameAliasesWithDifferentFieldTargets on Pet {\n        ... on Dog {\n          name\n        }\n        ... on Cat {\n          name: nickname\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/Alias masking direct field access",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment aliasMaskingDirectFieldAccess on Dog {\n        name: nickname\n        name\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"name\" conflict because nickname and name are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/different args, second adds an argument",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment conflictingArgs on Dog {\n        doesKnowCommand\n        doesKnowCommand(dogCommand: HEEL)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"doesKnowCommand\" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/different args, second missing an argument",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment conflictingArgs on Dog {\n        doesKnowCommand(dogCommand: SIT)\n        doesKnowCommand\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"doesKnowCommand\" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/conflicting args",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment conflictingArgs on Dog {\n        doesKnowCommand(dogCommand: SIT)\n        doesKnowCommand(dogCommand: HEEL)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"doesKnowCommand\" conflict because they have differing arguments. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/allows different args where no conflict is possible",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment conflictingArgs on Pet {\n        ... on Dog {\n          name(surname: true)\n        }\n        ... on Cat {\n          name\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/encounters conflict in fragments",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        ...A\n        ...B\n      }\n      fragment A on Type {\n        x: a\n      }\n      fragment B on Type {\n        x: b\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"x\" conflict because a and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 7,
+              "column": 9
+            },
+            {
+              "line": 10,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/reports each conflict once",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        f1 {\n          ...A\n          ...B\n        }\n        f2 {\n          ...B\n          ...A\n        }\n        f3 {\n          ...A\n          ...B\n          x: c\n        }\n      }\n      fragment A on Type {\n        x: a\n      }\n      fragment B on Type {\n        x: b\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"x\" conflict because a and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 18,
+              "column": 9
+            },
+            {
+              "line": 21,
+              "column": 9
+            }
+          ]
+        },
+        {
+          "message": "Fields \"x\" conflict because c and a are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 14,
+              "column": 11
+            },
+            {
+              "line": 18,
+              "column": 9
+            }
+          ]
+        },
+        {
+          "message": "Fields \"x\" conflict because c and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 14,
+              "column": 11
+            },
+            {
+              "line": 21,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/deep conflict",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        field {\n          x: a\n        },\n        field {\n          x: b\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"field\" conflict because subfields \"x\" conflict because a and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 11
+            },
+            {
+              "line": 6,
+              "column": 9
+            },
+            {
+              "line": 7,
+              "column": 11
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/deep conflict with multiple issues",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        field {\n          x: a\n          y: c\n        },\n        field {\n          x: b\n          y: d\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"field\" conflict because subfields \"x\" conflict because a and b are different fields and subfields \"y\" conflict because c and d are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 11
+            },
+            {
+              "line": 5,
+              "column": 11
+            },
+            {
+              "line": 7,
+              "column": 9
+            },
+            {
+              "line": 8,
+              "column": 11
+            },
+            {
+              "line": 9,
+              "column": 11
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/very deep conflict",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        field {\n          deepField {\n            x: a\n          }\n        },\n        field {\n          deepField {\n            x: b\n          }\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"field\" conflict because subfields \"deepField\" conflict because subfields \"x\" conflict because a and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 4,
+              "column": 11
+            },
+            {
+              "line": 5,
+              "column": 13
+            },
+            {
+              "line": 8,
+              "column": 9
+            },
+            {
+              "line": 9,
+              "column": 11
+            },
+            {
+              "line": 10,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/reports deep conflict to nearest common ancestor",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        field {\n          deepField {\n            x: a\n          }\n          deepField {\n            x: b\n          }\n        },\n        field {\n          deepField {\n            y\n          }\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"deepField\" conflict because subfields \"x\" conflict because a and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 11
+            },
+            {
+              "line": 5,
+              "column": 13
+            },
+            {
+              "line": 7,
+              "column": 11
+            },
+            {
+              "line": 8,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/reports deep conflict to nearest common ancestor in fragments",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        field {\n          ...F\n        }\n        field {\n          ...F\n        }\n      }\n      fragment F on T {\n        deepField {\n          deeperField {\n            x: a\n          }\n          deeperField {\n            x: b\n          }\n        },\n        deepField {\n          deeperField {\n            y\n          }\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"deeperField\" conflict because subfields \"x\" conflict because a and b are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 12,
+              "column": 11
+            },
+            {
+              "line": 13,
+              "column": 13
+            },
+            {
+              "line": 15,
+              "column": 11
+            },
+            {
+              "line": 16,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/reports deep conflict in nested fragments",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      {\n        field {\n          ...F\n        }\n        field {\n          ...I\n        }\n      }\n      fragment F on T {\n        x: a\n        ...G\n      }\n      fragment G on T {\n        y: c\n      }\n      fragment I on T {\n        y: d\n        ...J\n      }\n      fragment J on T {\n        x: b\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"field\" conflict because subfields \"x\" conflict because a and b are different fields and subfields \"y\" conflict because c and d are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            },
+            {
+              "line": 11,
+              "column": 9
+            },
+            {
+              "line": 15,
+              "column": 9
+            },
+            {
+              "line": 6,
+              "column": 9
+            },
+            {
+              "line": 22,
+              "column": 9
+            },
+            {
+              "line": 18,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/ignores unknown fragments",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n    {\n      field\n      ...Unknown\n      ...Known\n    }\n\n    fragment Known on T {\n      field\n      ...OtherUnknown\n    }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/conflicting return types which potentially overlap",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ...on IntBox {\n              scalar\n            }\n            ...on NonNullStringBox1 {\n              scalar\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"scalar\" conflict because they return conflicting types Int and String!. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 15
+            },
+            {
+              "line": 8,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/compatible return shapes on different return types",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n      {\n        someBox {\n          ... on SomeBox {\n            deepBox {\n              unrelatedField\n            }\n          }\n          ... on StringBox {\n            deepBox {\n              unrelatedField\n            }\n          }\n        }\n      }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/disallows differing return types despite no overlap",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ... on IntBox {\n              scalar\n            }\n            ... on StringBox {\n              scalar\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"scalar\" conflict because they return conflicting types Int and String. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 15
+            },
+            {
+              "line": 8,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/disallows differing return type nullability despite no overlap",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ... on NonNullStringBox1 {\n              scalar\n            }\n            ... on StringBox {\n              scalar\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"scalar\" conflict because they return conflicting types String! and String. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 15
+            },
+            {
+              "line": 8,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/disallows differing return type list despite no overlap",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ... on IntBox {\n              box: listStringBox {\n                scalar\n              }\n            }\n            ... on StringBox {\n              box: stringBox {\n                scalar\n              }\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"box\" conflict because they return conflicting types [StringBox] and StringBox. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 15
+            },
+            {
+              "line": 10,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/disallows differing return type list despite no overlap",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ... on IntBox {\n              box: stringBox {\n                scalar\n              }\n            }\n            ... on StringBox {\n              box: listStringBox {\n                scalar\n              }\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"box\" conflict because they return conflicting types StringBox and [StringBox]. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 15
+            },
+            {
+              "line": 10,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/disallows differing deep return types despite no overlap",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ... on IntBox {\n              box: stringBox {\n                scalar\n              }\n            }\n            ... on StringBox {\n              box: intBox {\n                scalar\n              }\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"box\" conflict because subfields \"scalar\" conflict because they return conflicting types String and Int. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 15
+            },
+            {
+              "line": 6,
+              "column": 17
+            },
+            {
+              "line": 10,
+              "column": 15
+            },
+            {
+              "line": 11,
+              "column": 17
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/allows non-conflicting overlaping types",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ... on IntBox {\n              scalar: unrelatedField\n            }\n            ... on StringBox {\n              scalar\n            }\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/same wrapped scalar return types",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ...on NonNullStringBox1 {\n              scalar\n            }\n            ...on NonNullStringBox2 {\n              scalar\n            }\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/allows inline typeless fragments",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          a\n          ... {\n            a\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/compares deep types including list",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          connection {\n            ...edgeID\n            edges {\n              node {\n                id: name\n              }\n            }\n          }\n        }\n\n        fragment edgeID on Connection {\n          edges {\n            node {\n              id\n            }\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Fields \"edges\" conflict because subfields \"node\" conflict because subfields \"id\" conflict because name and id are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 13
+            },
+            {
+              "line": 6,
+              "column": 15
+            },
+            {
+              "line": 7,
+              "column": 17
+            },
+            {
+              "line": 14,
+              "column": 11
+            },
+            {
+              "line": 15,
+              "column": 13
+            },
+            {
+              "line": 16,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/ignores unknown types",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 1,
+      "query": "\n        {\n          someBox {\n            ...on UnknownType {\n              scalar\n            }\n            ...on NonNullStringBox2 {\n              scalar\n            }\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/return types must be unambiguous/works for field names that are JS keywords",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 2,
+      "query": "{\n          foo {\n            constructor\n          }\n        }",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/does not infinite loop on recursive fragment",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment fragA on Human { name, relatives { name, ...fragA } }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/does not infinite loop on immediately recursive fragment",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment fragA on Human { name, ...fragA }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/does not infinite loop on transitively recursive fragment",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment fragA on Human { name, ...fragB }\n      fragment fragB on Human { name, ...fragC }\n      fragment fragC on Human { name, ...fragA }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Overlapping fields can be merged/finds invalid case even with immediately recursive fragment",
+      "rule": "OverlappingFieldsCanBeMerged",
+      "schema": 0,
+      "query": "\n      fragment sameAliasesWithDifferentFieldTargets on Dog {\n        ...sameAliasesWithDifferentFieldTargets\n        fido: name\n        fido: nickname\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fields \"fido\" conflict because name and nickname are different fields. Use different aliases on the fields to fetch both if this was intentional.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 9
+            },
+            {
+              "line": 5,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/of the same object",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment objectWithinObject on Dog { ...dogFragment }\n      fragment dogFragment on Dog { barkVolume }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/of the same object with inline fragment",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment objectWithinObjectAnon on Dog { ... on Dog { barkVolume } }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/object into an implemented interface",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment objectWithinInterface on Pet { ...dogFragment }\n      fragment dogFragment on Dog { barkVolume }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/object into containing union",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment objectWithinUnion on CatOrDog { ...dogFragment }\n      fragment dogFragment on Dog { barkVolume }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/union into contained object",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment unionWithinObject on Dog { ...catOrDogFragment }\n      fragment catOrDogFragment on CatOrDog { __typename }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/union into overlapping interface",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment unionWithinInterface on Pet { ...catOrDogFragment }\n      fragment catOrDogFragment on CatOrDog { __typename }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/union into overlapping union",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment unionWithinUnion on DogOrHuman { ...catOrDogFragment }\n      fragment catOrDogFragment on CatOrDog { __typename }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into implemented object",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment interfaceWithinObject on Dog { ...petFragment }\n      fragment petFragment on Pet { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into overlapping interface",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment interfaceWithinInterface on Pet { ...beingFragment }\n      fragment beingFragment on Being { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into overlapping interface in inline fragment",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment interfaceWithinInterface on Pet { ... on Being { name } }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into overlapping union",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment interfaceWithinUnion on CatOrDog { ...petFragment }\n      fragment petFragment on Pet { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/ignores incorrect type (caught by FragmentsOnCompositeTypes)",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment petFragment on Pet { ...badInADifferentWay }\n      fragment badInADifferentWay on String { name }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Possible fragment spreads/different object into object",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidObjectWithinObject on Cat { ...dogFragment }\n      fragment dogFragment on Dog { barkVolume }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"dogFragment\" cannot be spread here as objects of type \"Cat\" can never be of type \"Dog\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 51
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/different object into object in inline fragment",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidObjectWithinObjectAnon on Cat {\n        ... on Dog { barkVolume }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment cannot be spread here as objects of type \"Cat\" can never be of type \"Dog\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/object into not implementing interface",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidObjectWithinInterface on Pet { ...humanFragment }\n      fragment humanFragment on Human { pets { name } }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"humanFragment\" cannot be spread here as objects of type \"Pet\" can never be of type \"Human\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 54
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/object into not containing union",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidObjectWithinUnion on CatOrDog { ...humanFragment }\n      fragment humanFragment on Human { pets { name } }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"humanFragment\" cannot be spread here as objects of type \"CatOrDog\" can never be of type \"Human\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 55
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/union into not contained object",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidUnionWithinObject on Human { ...catOrDogFragment }\n      fragment catOrDogFragment on CatOrDog { __typename }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"catOrDogFragment\" cannot be spread here as objects of type \"Human\" can never be of type \"CatOrDog\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 52
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/union into non overlapping interface",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidUnionWithinInterface on Pet { ...humanOrAlienFragment }\n      fragment humanOrAlienFragment on HumanOrAlien { __typename }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"humanOrAlienFragment\" cannot be spread here as objects of type \"Pet\" can never be of type \"HumanOrAlien\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 53
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/union into non overlapping union",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidUnionWithinUnion on CatOrDog { ...humanOrAlienFragment }\n      fragment humanOrAlienFragment on HumanOrAlien { __typename }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"humanOrAlienFragment\" cannot be spread here as objects of type \"CatOrDog\" can never be of type \"HumanOrAlien\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 54
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into non implementing object",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidInterfaceWithinObject on Cat { ...intelligentFragment }\n      fragment intelligentFragment on Intelligent { iq }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"intelligentFragment\" cannot be spread here as objects of type \"Cat\" can never be of type \"Intelligent\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 54
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into non overlapping interface",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidInterfaceWithinInterface on Pet {\n        ...intelligentFragment\n      }\n      fragment intelligentFragment on Intelligent { iq }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"intelligentFragment\" cannot be spread here as objects of type \"Pet\" can never be of type \"Intelligent\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into non overlapping interface in inline fragment",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidInterfaceWithinInterfaceAnon on Pet {\n        ...on Intelligent { iq }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Fragment cannot be spread here as objects of type \"Pet\" can never be of type \"Intelligent\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Possible fragment spreads/interface into non overlapping union",
+      "rule": "PossibleFragmentSpreads",
+      "schema": 0,
+      "query": "\n      fragment invalidInterfaceWithinUnion on HumanOrAlien { ...petFragment }\n      fragment petFragment on Pet { name }\n    ",
+      "errors": [
+        {
+          "message": "Fragment \"petFragment\" cannot be spread here as objects of type \"HumanOrAlien\" can never be of type \"Pet\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 62
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Provided required arguments/ignores unknown arguments",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n      {\n        dog {\n          isHousetrained(unknownArgument: true)\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/Arg on optional arg",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            isHousetrained(atOtherHomes: true)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/No Arg on optional arg",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            isHousetrained\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/No arg on non-null field with default",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            nonNullFieldWithDefault\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/Multiple args",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req1: 1, req2: 2)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/Multiple args reverse order",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req2: 2, req1: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/No args on multiple optional",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOpts\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/One arg on multiple optional",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOpts(opt1: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/Second arg on multiple optional",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOpts(opt2: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/Multiple reqs on mixedList",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOptAndReq(req1: 3, req2: 4)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/Multiple reqs and one opt on mixedList",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOptAndReq(req1: 3, req2: 4, opt1: 5)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Valid non-nullable value/All reqs and opts on mixedList",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOptAndReq(req1: 3, req2: 4, opt1: 5, opt2: 6)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Invalid non-nullable value/Missing one non-nullable argument",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req2: 2)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Field \"multipleReqs\" argument \"req1\" of type \"Int!\" is required but not provided.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Provided required arguments/Invalid non-nullable value/Missing multiple non-nullable arguments",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Field \"multipleReqs\" argument \"req1\" of type \"Int!\" is required but not provided.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 13
+            }
+          ]
+        },
+        {
+          "message": "Field \"multipleReqs\" argument \"req2\" of type \"Int!\" is required but not provided.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Provided required arguments/Invalid non-nullable value/Incorrect value and missing argument",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req1: \"one\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Field \"multipleReqs\" argument \"req2\" of type \"Int!\" is required but not provided.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Provided required arguments/Directive arguments/ignores unknown directives",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          dog @unknown\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Directive arguments/with directives of valid types",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          dog @include(if: true) {\n            name\n          }\n          human @skip(if: false) {\n            name\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Provided required arguments/Directive arguments/with directive with missing types",
+      "rule": "ProvidedRequiredArguments",
+      "schema": 0,
+      "query": "\n        {\n          dog @include {\n            name @skip\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Directive \"@include\" argument \"if\" of type \"Boolean!\" is required but not provided.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            }
+          ]
+        },
+        {
+          "message": "Directive \"@skip\" argument \"if\" of type \"Boolean!\" is required but not provided.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 18
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/valid scalar selection",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelection on Dog {\n        barks\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Scalar leafs/object type missing selection",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      query directQueryOnObjectWithoutSubFields {\n        human\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"human\" of type \"Human\" must have a selection of subfields. Did you mean \"human { ... }\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/interface type missing selection",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      {\n        human { pets }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"pets\" of type \"[Pet]\" must have a selection of subfields. Did you mean \"pets { ... }\"?",
+          "locations": [
+            {
+              "line": 3,
+              "column": 17
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/valid scalar selection with args",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelectionWithArgs on Dog {\n        doesKnowCommand(dogCommand: SIT)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Scalar leafs/scalar selection not allowed on Boolean",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelectionsNotAllowedOnBoolean on Dog {\n        barks { sinceWhen }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"barks\" must not have a selection since type \"Boolean\" has no subfields.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/scalar selection not allowed on Enum",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelectionsNotAllowedOnEnum on Cat {\n        furColor { inHexdec }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"furColor\" must not have a selection since type \"FurColor\" has no subfields.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 18
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/scalar selection not allowed with args",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelectionsNotAllowedWithArgs on Dog {\n        doesKnowCommand(dogCommand: SIT) { sinceWhen }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"doesKnowCommand\" must not have a selection since type \"Boolean\" has no subfields.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 42
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/Scalar selection not allowed with directives",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelectionsNotAllowedWithDirectives on Dog {\n        name @include(if: true) { isAlsoHumanName }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"name\" must not have a selection since type \"String\" has no subfields.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Scalar leafs/Scalar selection not allowed with directives and args",
+      "rule": "ScalarLeafs",
+      "schema": 0,
+      "query": "\n      fragment scalarSelectionsNotAllowedWithDirectivesAndArgs on Dog {\n        doesKnowCommand(dogCommand: SIT) @include(if: true) { sinceWhen }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Field \"doesKnowCommand\" must not have a selection since type \"Boolean\" has no subfields.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 61
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Subscriptions with single field/valid subscription",
+      "rule": "SingleFieldSubscriptions",
+      "schema": 0,
+      "query": "\n      subscription ImportantEmails {\n        importantEmails\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Subscriptions with single field/fails with more than one root field",
+      "rule": "SingleFieldSubscriptions",
+      "schema": 0,
+      "query": "\n      subscription ImportantEmails {\n        importantEmails\n        notImportantEmails\n      }\n    ",
+      "errors": [
+        {
+          "message": "Subscription \"ImportantEmails\" must select only one top level field.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Subscriptions with single field/fails with more than one root field including introspection",
+      "rule": "SingleFieldSubscriptions",
+      "schema": 0,
+      "query": "\n      subscription ImportantEmails {\n        importantEmails\n        __typename\n      }\n    ",
+      "errors": [
+        {
+          "message": "Subscription \"ImportantEmails\" must select only one top level field.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Subscriptions with single field/fails with many more than one root field",
+      "rule": "SingleFieldSubscriptions",
+      "schema": 0,
+      "query": "\n      subscription ImportantEmails {\n        importantEmails\n        notImportantEmails\n        spamEmails\n      }\n    ",
+      "errors": [
+        {
+          "message": "Subscription \"ImportantEmails\" must select only one top level field.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 9
+            },
+            {
+              "line": 5,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Subscriptions with single field/fails with more than one root field in anonymous subscriptions",
+      "rule": "SingleFieldSubscriptions",
+      "schema": 0,
+      "query": "\n      subscription {\n        importantEmails\n        notImportantEmails\n      }\n    ",
+      "errors": [
+        {
+          "message": "Anonymous Subscription must select only one top level field.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 9
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique argument names/no arguments on field",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/no arguments on directive",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field @directive\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/argument on field",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/argument on directive",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field @directive(arg: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/same argument on two fields",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        one: field(arg: \"value\")\n        two: field(arg: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/same argument on field and directive",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: \"value\") @directive(arg: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/same argument on two directives",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field @directive1(arg: \"value\") @directive2(arg: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/multiple field arguments",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg1: \"value\", arg2: \"value\", arg3: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/multiple directive arguments",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field @directive(arg1: \"value\", arg2: \"value\", arg3: \"value\")\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique argument names/duplicate field arguments",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg1: \"value\", arg1: \"value\")\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one argument named \"arg1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 30
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique argument names/many duplicate field arguments",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg1: \"value\", arg1: \"value\", arg1: \"value\")\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one argument named \"arg1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 30
+            }
+          ]
+        },
+        {
+          "message": "There can be only one argument named \"arg1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 45
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique argument names/duplicate directive arguments",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field @directive(arg1: \"value\", arg1: \"value\")\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one argument named \"arg1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 26
+            },
+            {
+              "line": 3,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique argument names/many duplicate directive arguments",
+      "rule": "UniqueArgumentNames",
+      "schema": 0,
+      "query": "\n      {\n        field @directive(arg1: \"value\", arg1: \"value\", arg1: \"value\")\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one argument named \"arg1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 26
+            },
+            {
+              "line": 3,
+              "column": 41
+            }
+          ]
+        },
+        {
+          "message": "There can be only one argument named \"arg1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 26
+            },
+            {
+              "line": 3,
+              "column": 56
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/no directives",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/unique directives in different locations",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type @directiveA {\n        field @directiveB\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/unique directives in same locations",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type @directiveA @directiveB {\n        field @directiveA @directiveB\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/same directives in different locations",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type @directiveA {\n        field @directiveA\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/same directives in similar locations",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type {\n        field @directive\n        field @directive\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/duplicate directives in one location",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type {\n        field @directive @directive\n      }\n    ",
+      "errors": [
+        {
+          "message": "The directive \"directive\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 26
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/many duplicate directives in one location",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type {\n        field @directive @directive @directive\n      }\n    ",
+      "errors": [
+        {
+          "message": "The directive \"directive\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 26
+            }
+          ]
+        },
+        {
+          "message": "The directive \"directive\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 37
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/different duplicate directives in one location",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type {\n        field @directiveA @directiveB @directiveA @directiveB\n      }\n    ",
+      "errors": [
+        {
+          "message": "The directive \"directiveA\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 39
+            }
+          ]
+        },
+        {
+          "message": "The directive \"directiveB\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 27
+            },
+            {
+              "line": 3,
+              "column": 51
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Directives Are Unique Per Location/duplicate directives in many locations",
+      "rule": "UniqueDirectivesPerLocation",
+      "schema": 0,
+      "query": "\n      fragment Test on Type @directive @directive {\n        field @directive @directive\n      }\n    ",
+      "errors": [
+        {
+          "message": "The directive \"directive\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 29
+            },
+            {
+              "line": 2,
+              "column": 40
+            }
+          ]
+        },
+        {
+          "message": "The directive \"directive\" can only be used once at this location.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 15
+            },
+            {
+              "line": 3,
+              "column": 26
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique fragment names/no fragments",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique fragment names/one fragment",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        ...fragA\n      }\n\n      fragment fragA on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique fragment names/many fragments",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        ...fragA\n        ...fragB\n        ...fragC\n      }\n      fragment fragA on Type {\n        fieldA\n      }\n      fragment fragB on Type {\n        fieldB\n      }\n      fragment fragC on Type {\n        fieldC\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique fragment names/inline fragments are always unique",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        ...on Type {\n          fieldA\n        }\n        ...on Type {\n          fieldB\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique fragment names/fragment and operation named the same",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        ...Foo\n      }\n      fragment Foo on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique fragment names/fragments named the same",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      {\n        ...fragA\n      }\n      fragment fragA on Type {\n        fieldA\n      }\n      fragment fragA on Type {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one fragment named \"fragA\".",
+          "locations": [
+            {
+              "line": 5,
+              "column": 16
+            },
+            {
+              "line": 8,
+              "column": 16
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique fragment names/fragments named the same without being referenced",
+      "rule": "UniqueFragmentNames",
+      "schema": 0,
+      "query": "\n      fragment fragA on Type {\n        fieldA\n      }\n      fragment fragA on Type {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one fragment named \"fragA\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 16
+            },
+            {
+              "line": 5,
+              "column": 16
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique input field names/input object with fields",
+      "rule": "UniqueInputFieldNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: { f: true })\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique input field names/same input object within two args",
+      "rule": "UniqueInputFieldNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg1: { f: true }, arg2: { f: true })\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique input field names/multiple input object fields",
+      "rule": "UniqueInputFieldNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: { f1: \"value\", f2: \"value\", f3: \"value\" })\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique input field names/allows for nested input objects with similar fields",
+      "rule": "UniqueInputFieldNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: {\n          deep: {\n            deep: {\n              id: 1\n            }\n            id: 1\n          }\n          id: 1\n        })\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique input field names/duplicate input object fields",
+      "rule": "UniqueInputFieldNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: { f1: \"value\", f1: \"value\" })\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one input field named \"f1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 22
+            },
+            {
+              "line": 3,
+              "column": 35
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique input field names/many duplicate input object fields",
+      "rule": "UniqueInputFieldNames",
+      "schema": 0,
+      "query": "\n      {\n        field(arg: { f1: \"value\", f1: \"value\", f1: \"value\" })\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one input field named \"f1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 22
+            },
+            {
+              "line": 3,
+              "column": 35
+            }
+          ]
+        },
+        {
+          "message": "There can be only one input field named \"f1\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 22
+            },
+            {
+              "line": 3,
+              "column": 48
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique operation names/no operations",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      fragment fragA on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique operation names/one anon operation",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique operation names/one named operation",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique operation names/multiple operations",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        field\n      }\n\n      query Bar {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique operation names/multiple operations of different types",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        field\n      }\n\n      mutation Bar {\n        field\n      }\n\n      subscription Baz {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique operation names/fragment and operation named the same",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        ...Foo\n      }\n      fragment Foo on Type {\n        field\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique operation names/multiple operations of same name",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        fieldA\n      }\n      query Foo {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one operation named \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 13
+            },
+            {
+              "line": 5,
+              "column": 13
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique operation names/multiple ops of same name of different types (mutation)",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        fieldA\n      }\n      mutation Foo {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one operation named \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 13
+            },
+            {
+              "line": 5,
+              "column": 16
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique operation names/multiple ops of same name of different types (subscription)",
+      "rule": "UniqueOperationNames",
+      "schema": 0,
+      "query": "\n      query Foo {\n        fieldA\n      }\n      subscription Foo {\n        fieldB\n      }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one operation named \"Foo\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 13
+            },
+            {
+              "line": 5,
+              "column": 20
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Unique variable names/unique variable names",
+      "rule": "UniqueVariableNames",
+      "schema": 0,
+      "query": "\n      query A($x: Int, $y: String) { __typename }\n      query B($x: String, $y: Int) { __typename }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Unique variable names/duplicate variable names",
+      "rule": "UniqueVariableNames",
+      "schema": 0,
+      "query": "\n      query A($x: Int, $x: Int, $x: String) { __typename }\n      query B($x: String, $x: Int) { __typename }\n      query C($x: Int, $x: Int) { __typename }\n    ",
+      "errors": [
+        {
+          "message": "There can be only one variable named \"x\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 16
+            },
+            {
+              "line": 2,
+              "column": 25
+            }
+          ]
+        },
+        {
+          "message": "There can be only one variable named \"x\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 16
+            },
+            {
+              "line": 2,
+              "column": 34
+            }
+          ]
+        },
+        {
+          "message": "There can be only one variable named \"x\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 16
+            },
+            {
+              "line": 3,
+              "column": 28
+            }
+          ]
+        },
+        {
+          "message": "There can be only one variable named \"x\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 16
+            },
+            {
+              "line": 4,
+              "column": 25
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good int value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: 2)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good negative int value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: -2)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good boolean value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            booleanArgField(booleanArg: true)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good string value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringArgField(stringArg: \"foo\")\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good float value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            floatArgField(floatArg: 1.1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good negative float value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            floatArgField(floatArg: -1.1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Int into Float",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            floatArgField(floatArg: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Int into ID",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            idArgField(idArg: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/String into ID",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            idArgField(idArg: \"someIdString\")\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Good enum value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: SIT)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Enum with undefined value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            enumArgField(enumArg: UNKNOWN)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/Enum with null value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            enumArgField(enumArg: NO_FUR)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/null into nullable type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: null)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid values/null into nullable type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog(a: null, b: null, c:{ requiredField: true, intField: null }) {\n            name\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid String values/Int into String",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringArgField(stringArg: 1)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found 1.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 39
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid String values/Float into String",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringArgField(stringArg: 1.0)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found 1.0.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 39
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid String values/Boolean into String",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringArgField(stringArg: true)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found true.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 39
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid String values/Unquoted String into String",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringArgField(stringArg: BAR)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found BAR.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 39
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Int values/String into Int",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: \"3\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int, found \"3\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Int values/Big Int into Int",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: 829384293849283498239482938)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int, found 829384293849283498239482938.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Int values/Unquoted String into Int",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: FOO)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int, found FOO.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Int values/Simple Float into Int",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: 3.0)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int, found 3.0.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Int values/Float into Int",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            intArgField(intArg: 3.333)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int, found 3.333.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 33
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Float values/String into Float",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            floatArgField(floatArg: \"3.333\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Float, found \"3.333\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 37
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Float values/Boolean into Float",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            floatArgField(floatArg: true)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Float, found true.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 37
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Float values/Unquoted into Float",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            floatArgField(floatArg: FOO)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Float, found FOO.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 37
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Boolean value/Int into Boolean",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            booleanArgField(booleanArg: 2)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean, found 2.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Boolean value/Float into Boolean",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            booleanArgField(booleanArg: 1.0)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean, found 1.0.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Boolean value/String into Boolean",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            booleanArgField(booleanArg: \"true\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean, found \"true\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Boolean value/Unquoted into Boolean",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            booleanArgField(booleanArg: TRUE)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean, found TRUE.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid ID value/Float into ID",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            idArgField(idArg: 1.0)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type ID, found 1.0.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid ID value/Boolean into ID",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            idArgField(idArg: true)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type ID, found true.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid ID value/Unquoted into ID",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            idArgField(idArg: SOMETHING)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type ID, found SOMETHING.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 31
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Enum value/Int into Enum",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: 2)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type DogCommand, found 2.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Enum value/Float into Enum",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: 1.0)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type DogCommand, found 1.0.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Enum value/String into Enum",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: \"SIT\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type DogCommand, found \"SIT\"; Did you mean the enum value SIT?",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Enum value/Boolean into Enum",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: true)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type DogCommand, found true.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Enum value/Unknown Enum Value into Enum",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: JUGGLE)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type DogCommand, found JUGGLE.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid Enum value/Different case Enum Value into Enum",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            doesKnowCommand(dogCommand: sit)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type DogCommand, found sit; Did you mean the enum value SIT?",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Valid List value/Good list value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringListArgField(stringListArg: [\"one\", null, \"two\"])\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid List value/Empty list value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringListArgField(stringListArg: [])\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid List value/Null value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringListArgField(stringListArg: null)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid List value/Single value into List",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringListArgField(stringListArg: \"one\")\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid List value/Incorrect item type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringListArgField(stringListArg: [\"one\", 2])\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found 2.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 55
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid List value/Single value of incorrect type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            stringListArgField(stringListArg: 1)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type [String], found 1.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 47
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/Arg on optional arg",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            isHousetrained(atOtherHomes: true)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/No Arg on optional arg",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog {\n            isHousetrained\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/Multiple args",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req1: 1, req2: 2)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/Multiple args reverse order",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req2: 2, req1: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/No args on multiple optional",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOpts\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/One arg on multiple optional",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOpts(opt1: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/Second arg on multiple optional",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOpts(opt2: 1)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/Multiple reqs on mixedList",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOptAndReq(req1: 3, req2: 4)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/Multiple reqs and one opt on mixedList",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOptAndReq(req1: 3, req2: 4, opt1: 5)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid non-nullable value/All reqs and opts on mixedList",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleOptAndReq(req1: 3, req2: 4, opt1: 5, opt2: 6)\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid non-nullable value/Incorrect value type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req2: \"two\", req1: \"one\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int!, found \"two\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 32
+            }
+          ]
+        },
+        {
+          "message": "Expected type Int!, found \"one\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 45
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid non-nullable value/Incorrect value and missing argument (ProvidedRequiredArguments)",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req1: \"one\")\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int!, found \"one\".",
+          "locations": [
+            {
+              "line": 4,
+              "column": 32
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid non-nullable value/Null value",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            multipleReqs(req1: null)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int!, found null.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 32
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Valid input object value/Optional arg, despite required field in type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid input object value/Partial object, only required",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: { requiredField: true })\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid input object value/Partial object, required field can be falsey",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: { requiredField: false })\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid input object value/Partial object, including required",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: { requiredField: true, intField: 4 })\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid input object value/Full object",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: {\n              requiredField: true,\n              intField: 4,\n              stringField: \"foo\",\n              booleanField: false,\n              stringListField: [\"one\", \"two\"]\n            })\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Valid input object value/Full object with fields in different order",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: {\n              stringListField: [\"one\", \"two\"],\n              booleanField: false,\n              requiredField: true,\n              stringField: \"foo\",\n              intField: 4,\n            })\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid input object value/Partial object, missing required",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: { intField: 4 })\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Field ComplexInput.requiredField of required type Boolean! was not provided.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 41
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid input object value/Partial object, invalid field type",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: {\n              stringListField: [\"one\", 2],\n              requiredField: true,\n            })\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found 2.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 40
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid input object value/Partial object, null to non-null field",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: {\n              requiredField: true,\n              nonNullField: null,\n            })\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean!, found null.",
+          "locations": [
+            {
+              "line": 6,
+              "column": 29
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid input object value/Partial object, unknown field arg",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          complicatedArgs {\n            complexArgField(complexArg: {\n              requiredField: true,\n              unknownField: \"value\"\n            })\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Field \"unknownField\" is not defined by type ComplexInput; Did you mean nonNullField, intField, or booleanField?",
+          "locations": [
+            {
+              "line": 6,
+              "column": 15
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid input object value/reports original error for custom scalar which throws",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          invalidArg(arg: 123)\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Invalid, found 123; Invalid scalar is always invalid: 123",
+          "locations": [
+            {
+              "line": 3,
+              "column": 27
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Invalid input object value/allows custom scalar to accept complex literals",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          test1: anyArg(arg: 123)\n          test2: anyArg(arg: \"abc\")\n          test3: anyArg(arg: [123, \"abc\"])\n          test4: anyArg(arg: {deep: [123, \"abc\"]})\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Directive arguments/with directives of valid types",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog @include(if: true) {\n            name\n          }\n          human @skip(if: false) {\n            name\n          }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Directive arguments/with directive with incorrect types",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        {\n          dog @include(if: \"yes\") {\n            name @skip(if: ENUM)\n          }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean!, found \"yes\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 28
+            }
+          ]
+        },
+        {
+          "message": "Expected type Boolean!, found ENUM.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 28
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/variables with valid default values",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query WithDefaultValues(\n          $a: Int = 1,\n          $b: String = \"ok\",\n          $c: ComplexInput = { requiredField: true, intField: 3 }\n          $d: Int! = 123\n        ) {\n          dog { name }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/variables with valid default null values",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query WithDefaultValues(\n          $a: Int = null,\n          $b: String = null,\n          $c: ComplexInput = { requiredField: true, intField: null }\n        ) {\n          dog { name }\n        }\n      ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/variables with invalid default null values",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query WithDefaultValues(\n          $a: Int! = null,\n          $b: String! = null,\n          $c: ComplexInput = { requiredField: null, intField: null }\n        ) {\n          dog { name }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int!, found null.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 22
+            }
+          ]
+        },
+        {
+          "message": "Expected type String!, found null.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 25
+            }
+          ]
+        },
+        {
+          "message": "Expected type Boolean!, found null.",
+          "locations": [
+            {
+              "line": 5,
+              "column": 47
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/variables with invalid default values",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query InvalidDefaultValues(\n          $a: Int = \"one\",\n          $b: String = 4,\n          $c: ComplexInput = \"notverycomplex\"\n        ) {\n          dog { name }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Int, found \"one\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 21
+            }
+          ]
+        },
+        {
+          "message": "Expected type String, found 4.",
+          "locations": [
+            {
+              "line": 4,
+              "column": 24
+            }
+          ]
+        },
+        {
+          "message": "Expected type ComplexInput, found \"notverycomplex\".",
+          "locations": [
+            {
+              "line": 5,
+              "column": 30
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/variables with complex invalid default values",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query WithDefaultValues(\n          $a: ComplexInput = { requiredField: 123, intField: \"abc\" }\n        ) {\n          dog { name }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type Boolean!, found 123.",
+          "locations": [
+            {
+              "line": 3,
+              "column": 47
+            }
+          ]
+        },
+        {
+          "message": "Expected type Int, found \"abc\".",
+          "locations": [
+            {
+              "line": 3,
+              "column": 62
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/complex variables missing required field",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query MissingRequiredField($a: ComplexInput = {intField: 3}) {\n          dog { name }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Field ComplexInput.requiredField of required type Boolean! was not provided.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 55
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Values of correct type/Variable default values/list variables with invalid item",
+      "rule": "ValuesOfCorrectType",
+      "schema": 0,
+      "query": "\n        query InvalidItem($a: [String] = [\"one\", 2]) {\n          dog { name }\n        }\n      ",
+      "errors": [
+        {
+          "message": "Expected type String, found 2.",
+          "locations": [
+            {
+              "line": 2,
+              "column": 50
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are input types/input types are valid",
+      "rule": "VariablesAreInputTypes",
+      "schema": 0,
+      "query": "\n      query Foo($a: String, $b: [Boolean!]!, $c: ComplexInput) {\n        field(a: $a, b: $b, c: $c)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are input types/output types are invalid",
+      "rule": "VariablesAreInputTypes",
+      "schema": 0,
+      "query": "\n      query Foo($a: Dog, $b: [[CatOrDog!]]!, $c: Pet) {\n        field(a: $a, b: $b, c: $c)\n      }\n    ",
+      "errors": [
+        {
+          "locations": [
+            {
+              "line": 2,
+              "column": 21
+            }
+          ],
+          "message": "Variable \"$a\" cannot be non-input type \"Dog\"."
+        },
+        {
+          "locations": [
+            {
+              "line": 2,
+              "column": 30
+            }
+          ],
+          "message": "Variable \"$b\" cannot be non-input type \"[[CatOrDog!]]!\"."
+        },
+        {
+          "locations": [
+            {
+              "line": 2,
+              "column": 50
+            }
+          ],
+          "message": "Variable \"$c\" cannot be non-input type \"Pet\"."
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean => Boolean",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($booleanArg: Boolean)\n      {\n        complicatedArgs {\n          booleanArgField(booleanArg: $booleanArg)\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean => Boolean within fragment",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      fragment booleanArgFrag on ComplicatedArgs {\n        booleanArgField(booleanArg: $booleanArg)\n      }\n      query Query($booleanArg: Boolean)\n      {\n        complicatedArgs {\n          ...booleanArgFrag\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean => Boolean within fragment",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($booleanArg: Boolean)\n      {\n        complicatedArgs {\n          ...booleanArgFrag\n        }\n      }\n      fragment booleanArgFrag on ComplicatedArgs {\n        booleanArgField(booleanArg: $booleanArg)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean! => Boolean",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($nonNullBooleanArg: Boolean!)\n      {\n        complicatedArgs {\n          booleanArgField(booleanArg: $nonNullBooleanArg)\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean! => Boolean within fragment",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      fragment booleanArgFrag on ComplicatedArgs {\n        booleanArgField(booleanArg: $nonNullBooleanArg)\n      }\n\n      query Query($nonNullBooleanArg: Boolean!)\n      {\n        complicatedArgs {\n          ...booleanArgFrag\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/[String] => [String]",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringListVar: [String])\n      {\n        complicatedArgs {\n          stringListArgField(stringListArg: $stringListVar)\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/[String!] => [String]",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringListVar: [String!])\n      {\n        complicatedArgs {\n          stringListArgField(stringListArg: $stringListVar)\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/String => [String] in item position",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringVar: String)\n      {\n        complicatedArgs {\n          stringListArgField(stringListArg: [$stringVar])\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/String! => [String] in item position",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringVar: String!)\n      {\n        complicatedArgs {\n          stringListArgField(stringListArg: [$stringVar])\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/ComplexInput => ComplexInput",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($complexVar: ComplexInput)\n      {\n        complicatedArgs {\n          complexArgField(complexArg: $complexVar)\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/ComplexInput => ComplexInput in field position",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($boolVar: Boolean = false)\n      {\n        complicatedArgs {\n          complexArgField(complexArg: {requiredArg: $boolVar})\n        }\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean! => Boolean! in directive",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($boolVar: Boolean!)\n      {\n        dog @include(if: $boolVar)\n      }\n    ",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Int => Int!",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($intArg: Int) {\n        complicatedArgs {\n          nonNullIntArgField(nonNullIntArg: $intArg)\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$intArg\" of type \"Int\" used in position expecting type \"Int!\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 19
+            },
+            {
+              "line": 4,
+              "column": 45
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Int => Int! within fragment",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      fragment nonNullIntArgFieldFrag on ComplicatedArgs {\n        nonNullIntArgField(nonNullIntArg: $intArg)\n      }\n\n      query Query($intArg: Int) {\n        complicatedArgs {\n          ...nonNullIntArgFieldFrag\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$intArg\" of type \"Int\" used in position expecting type \"Int!\".",
+          "locations": [
+            {
+              "line": 6,
+              "column": 19
+            },
+            {
+              "line": 3,
+              "column": 43
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Int => Int! within nested fragment",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      fragment outerFrag on ComplicatedArgs {\n        ...nonNullIntArgFieldFrag\n      }\n\n      fragment nonNullIntArgFieldFrag on ComplicatedArgs {\n        nonNullIntArgField(nonNullIntArg: $intArg)\n      }\n\n      query Query($intArg: Int) {\n        complicatedArgs {\n          ...outerFrag\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$intArg\" of type \"Int\" used in position expecting type \"Int!\".",
+          "locations": [
+            {
+              "line": 10,
+              "column": 19
+            },
+            {
+              "line": 7,
+              "column": 43
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/String over Boolean",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringVar: String) {\n        complicatedArgs {\n          booleanArgField(booleanArg: $stringVar)\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$stringVar\" of type \"String\" used in position expecting type \"Boolean\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 19
+            },
+            {
+              "line": 4,
+              "column": 39
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/String => [String]",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringVar: String) {\n        complicatedArgs {\n          stringListArgField(stringListArg: $stringVar)\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$stringVar\" of type \"String\" used in position expecting type \"[String]\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 19
+            },
+            {
+              "line": 4,
+              "column": 45
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Boolean => Boolean! in directive",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($boolVar: Boolean) {\n        dog @include(if: $boolVar)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$boolVar\" of type \"Boolean\" used in position expecting type \"Boolean!\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 19
+            },
+            {
+              "line": 3,
+              "column": 26
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/String => Boolean! in directive",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringVar: String) {\n        dog @include(if: $stringVar)\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$stringVar\" of type \"String\" used in position expecting type \"Boolean!\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 19
+            },
+            {
+              "line": 3,
+              "column": 26
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/[String] => [String!]",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n      query Query($stringListVar: [String])\n      {\n        complicatedArgs {\n          stringListNonNullArgField(stringListNonNullArg: $stringListVar)\n        }\n      }\n    ",
+      "errors": [
+        {
+          "message": "Variable \"$stringListVar\" of type \"[String]\" used in position expecting type \"[String!]\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 19
+            },
+            {
+              "line": 5,
+              "column": 59
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Allows optional (nullable) variables with default values/Int => Int! fails when variable provides null default value",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n        query Query($intVar: Int = null) {\n          complicatedArgs {\n            nonNullIntArgField(nonNullIntArg: $intVar)\n          }\n        }",
+      "errors": [
+        {
+          "message": "Variable \"$intVar\" of type \"Int\" used in position expecting type \"Int!\".",
+          "locations": [
+            {
+              "line": 2,
+              "column": 21
+            },
+            {
+              "line": 4,
+              "column": 47
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Allows optional (nullable) variables with default values/Int => Int! when variable provides non-null default value",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n        query Query($intVar: Int = 1) {\n          complicatedArgs {\n            nonNullIntArgField(nonNullIntArg: $intVar)\n          }\n        }",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Allows optional (nullable) variables with default values/Int => Int! when optional argument provides default value",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n        query Query($intVar: Int) {\n          complicatedArgs {\n            nonNullFieldWithDefault(nonNullIntArg: $intVar)\n          }\n        }",
+      "errors": []
+    },
+    {
+      "name": "Validate: Variables are in allowed positions/Allows optional (nullable) variables with default values/Boolean => Boolean! in directive with default value with option",
+      "rule": "VariablesInAllowedPosition",
+      "schema": 0,
+      "query": "\n        query Query($boolVar: Boolean = false) {\n          dog @include(if: $boolVar)\n        }",
+      "errors": []
+    }
+  ]
+}
\ No newline at end of file
diff --git a/internal/gqlparser/validator/messaging.go b/internal/gqlparser/validator/messaging.go
new file mode 100644
index 0000000000..f1ab5873f3
--- /dev/null
+++ b/internal/gqlparser/validator/messaging.go
@@ -0,0 +1,39 @@
+package validator
+
+import "bytes"
+
+// Given [ A, B, C ] return '"A", "B", or "C"'.
+func QuotedOrList(items ...string) string {
+	itemsQuoted := make([]string, len(items))
+	for i, item := range items {
+		itemsQuoted[i] = `"` + item + `"`
+	}
+	return OrList(itemsQuoted...)
+}
+
+// Given [ A, B, C ] return 'A, B, or C'.
+func OrList(items ...string) string {
+	var buf bytes.Buffer
+
+	if len(items) > 5 {
+		items = items[:5]
+	}
+	if len(items) == 2 {
+		buf.WriteString(items[0])
+		buf.WriteString(" or ")
+		buf.WriteString(items[1])
+		return buf.String()
+	}
+
+	for i, item := range items {
+		if i != 0 {
+			if i == len(items)-1 {
+				buf.WriteString(", or ")
+			} else {
+				buf.WriteString(", ")
+			}
+		}
+		buf.WriteString(item)
+	}
+	return buf.String()
+}
diff --git a/internal/gqlparser/validator/prelude.go b/internal/gqlparser/validator/prelude.go
new file mode 100644
index 0000000000..86796fab6c
--- /dev/null
+++ b/internal/gqlparser/validator/prelude.go
@@ -0,0 +1,16 @@
+package validator
+
+import (
+	_ "embed"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+)
+
+//go:embed prelude.graphql
+var preludeGraphql string
+
+var Prelude = &ast.Source{
+	Name:    "prelude.graphql",
+	Input:   preludeGraphql,
+	BuiltIn: true,
+}
diff --git a/internal/gqlparser/validator/prelude.graphql b/internal/gqlparser/validator/prelude.graphql
new file mode 100644
index 0000000000..bdca0096a5
--- /dev/null
+++ b/internal/gqlparser/validator/prelude.graphql
@@ -0,0 +1,121 @@
+# This file defines all the implicitly declared types that are required by the graphql spec. It is implicitly included by calls to LoadSchema
+
+"The `Int` scalar type represents non-fractional signed whole numeric values. Int can represent values between -(2^31) and 2^31 - 1."
+scalar Int
+
+"The `Float` scalar type represents signed double-precision fractional values as specified by [IEEE 754](http://en.wikipedia.org/wiki/IEEE_floating_point)."
+scalar Float
+
+"The `String`scalar type represents textual data, represented as UTF-8 character sequences. The String type is most often used by GraphQL to represent free-form human-readable text."
+scalar String
+
+"The `Boolean` scalar type represents `true` or `false`."
+scalar Boolean
+
+"""The `ID` scalar type represents a unique identifier, often used to refetch an object or as key for a cache. The ID type appears in a JSON response as a String; however, it is not intended to be human-readable. When expected as an input type, any string (such as "4") or integer (such as 4) input value will be accepted as an ID."""
+scalar ID
+
+"The @include directive may be provided for fields, fragment spreads, and inline fragments, and allows for conditional inclusion during execution as described by the if argument."
+directive @include(if: Boolean!) on FIELD | FRAGMENT_SPREAD | INLINE_FRAGMENT
+
+"The @skip directive may be provided for fields, fragment spreads, and inline fragments, and allows for conditional exclusion during execution as described by the if argument."
+directive @skip(if: Boolean!) on FIELD | FRAGMENT_SPREAD | INLINE_FRAGMENT
+
+"The @deprecated built-in directive is used within the type system definition language to indicate deprecated portions of a GraphQL service's schema, such as deprecated fields on a type, arguments on a field, input fields on an input type, or values of an enum type."
+directive @deprecated(reason: String = "No longer supported") on FIELD_DEFINITION | ARGUMENT_DEFINITION | INPUT_FIELD_DEFINITION | ENUM_VALUE
+
+"The @specifiedBy built-in directive is used within the type system definition language to provide a scalar specification URL for specifying the behavior of custom scalar types."
+directive @specifiedBy(url: String!) on SCALAR
+
+type __Schema {
+  description: String
+  types: [__Type!]!
+  queryType: __Type!
+  mutationType: __Type
+  subscriptionType: __Type
+  directives: [__Directive!]!
+}
+
+type __Type {
+  kind: __TypeKind!
+  name: String
+  description: String
+  # must be non-null for OBJECT and INTERFACE, otherwise null.
+  fields(includeDeprecated: Boolean = false): [__Field!]
+  # must be non-null for OBJECT and INTERFACE, otherwise null.
+  interfaces: [__Type!]
+  # must be non-null for INTERFACE and UNION, otherwise null.
+  possibleTypes: [__Type!]
+  # must be non-null for ENUM, otherwise null.
+  enumValues(includeDeprecated: Boolean = false): [__EnumValue!]
+  # must be non-null for INPUT_OBJECT, otherwise null.
+  inputFields: [__InputValue!]
+  # must be non-null for NON_NULL and LIST, otherwise null.
+  ofType: __Type
+  # may be non-null for custom SCALAR, otherwise null.
+  specifiedByURL: String
+}
+
+type __Field {
+  name: String!
+  description: String
+  args: [__InputValue!]!
+  type: __Type!
+  isDeprecated: Boolean!
+  deprecationReason: String
+}
+
+type __InputValue {
+  name: String!
+  description: String
+  type: __Type!
+  defaultValue: String
+}
+
+type __EnumValue {
+  name: String!
+  description: String
+  isDeprecated: Boolean!
+  deprecationReason: String
+}
+
+enum __TypeKind {
+  SCALAR
+  OBJECT
+  INTERFACE
+  UNION
+  ENUM
+  INPUT_OBJECT
+  LIST
+  NON_NULL
+}
+
+type __Directive {
+  name: String!
+  description: String
+  locations: [__DirectiveLocation!]!
+  args: [__InputValue!]!
+  isRepeatable: Boolean!
+}
+
+enum __DirectiveLocation {
+  QUERY
+  MUTATION
+  SUBSCRIPTION
+  FIELD
+  FRAGMENT_DEFINITION
+  FRAGMENT_SPREAD
+  INLINE_FRAGMENT
+  VARIABLE_DEFINITION
+  SCHEMA
+  SCALAR
+  OBJECT
+  FIELD_DEFINITION
+  ARGUMENT_DEFINITION
+  INTERFACE
+  UNION
+  ENUM
+  ENUM_VALUE
+  INPUT_OBJECT
+  INPUT_FIELD_DEFINITION
+}
diff --git a/internal/gqlparser/validator/rules/fields_on_correct_type.go b/internal/gqlparser/validator/rules/fields_on_correct_type.go
new file mode 100644
index 0000000000..d536e5e5f4
--- /dev/null
+++ b/internal/gqlparser/validator/rules/fields_on_correct_type.go
@@ -0,0 +1,97 @@
+package validator
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("FieldsOnCorrectType", func(observers *Events, addError AddErrFunc) {
+		observers.OnField(func(walker *Walker, field *ast.Field) {
+			if field.ObjectDefinition == nil || field.Definition != nil {
+				return
+			}
+
+			message := fmt.Sprintf(`Cannot query field "%s" on type "%s".`, field.Name, field.ObjectDefinition.Name)
+
+			if suggestedTypeNames := getSuggestedTypeNames(walker, field.ObjectDefinition, field.Name); suggestedTypeNames != nil {
+				message += " Did you mean to use an inline fragment on " + QuotedOrList(suggestedTypeNames...) + "?"
+			} else if suggestedFieldNames := getSuggestedFieldNames(field.ObjectDefinition, field.Name); suggestedFieldNames != nil {
+				message += " Did you mean " + QuotedOrList(suggestedFieldNames...) + "?"
+			}
+
+			addError(
+				Message(message),
+				At(field.Position),
+			)
+		})
+	})
+}
+
+// Go through all of the implementations of type, as well as the interfaces
+// that they implement. If any of those types include the provided field,
+// suggest them, sorted by how often the type is referenced,  starting
+// with Interfaces.
+func getSuggestedTypeNames(walker *Walker, parent *ast.Definition, name string) []string {
+	if !parent.IsAbstractType() {
+		return nil
+	}
+
+	possibleTypes := walker.Schema.GetPossibleTypes(parent)
+	var suggestedObjectTypes = make([]string, 0, len(possibleTypes))
+	var suggestedInterfaceTypes []string
+	interfaceUsageCount := map[string]int{}
+
+	for _, possibleType := range possibleTypes {
+		field := possibleType.Fields.ForName(name)
+		if field == nil {
+			continue
+		}
+
+		suggestedObjectTypes = append(suggestedObjectTypes, possibleType.Name)
+
+		for _, possibleInterface := range possibleType.Interfaces {
+			interfaceField := walker.Schema.Types[possibleInterface]
+			if interfaceField != nil && interfaceField.Fields.ForName(name) != nil {
+				if interfaceUsageCount[possibleInterface] == 0 {
+					suggestedInterfaceTypes = append(suggestedInterfaceTypes, possibleInterface)
+				}
+				interfaceUsageCount[possibleInterface]++
+			}
+		}
+	}
+
+	suggestedTypes := append(suggestedInterfaceTypes, suggestedObjectTypes...)
+
+	sort.SliceStable(suggestedTypes, func(i, j int) bool {
+		typeA, typeB := suggestedTypes[i], suggestedTypes[j]
+		diff := interfaceUsageCount[typeB] - interfaceUsageCount[typeA]
+		if diff != 0 {
+			return diff < 0
+		}
+		return strings.Compare(typeA, typeB) < 0
+	})
+
+	return suggestedTypes
+}
+
+// For the field name provided, determine if there are any similar field names
+// that may be the result of a typo.
+func getSuggestedFieldNames(parent *ast.Definition, name string) []string {
+	if parent.Kind != ast.Object && parent.Kind != ast.Interface {
+		return nil
+	}
+
+	var possibleFieldNames = make([]string, 0, len(parent.Fields))
+	for _, field := range parent.Fields {
+		possibleFieldNames = append(possibleFieldNames, field.Name)
+	}
+
+	return SuggestionList(name, possibleFieldNames)
+}
diff --git a/internal/gqlparser/validator/rules/fragments_on_composite_types.go b/internal/gqlparser/validator/rules/fragments_on_composite_types.go
new file mode 100644
index 0000000000..1af9c4f966
--- /dev/null
+++ b/internal/gqlparser/validator/rules/fragments_on_composite_types.go
@@ -0,0 +1,41 @@
+package validator
+
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("FragmentsOnCompositeTypes", func(observers *Events, addError AddErrFunc) {
+		observers.OnInlineFragment(func(walker *Walker, inlineFragment *ast.InlineFragment) {
+			fragmentType := walker.Schema.Types[inlineFragment.TypeCondition]
+			if fragmentType == nil || fragmentType.IsCompositeType() {
+				return
+			}
+
+			message := fmt.Sprintf(`Fragment cannot condition on non composite type "%s".`, inlineFragment.TypeCondition)
+
+			addError(
+				Message(message),
+				At(inlineFragment.Position),
+			)
+		})
+
+		observers.OnFragment(func(walker *Walker, fragment *ast.FragmentDefinition) {
+			if fragment.Definition == nil || fragment.TypeCondition == "" || fragment.Definition.IsCompositeType() {
+				return
+			}
+
+			message := fmt.Sprintf(`Fragment "%s" cannot condition on non composite type "%s".`, fragment.Name, fragment.TypeCondition)
+
+			addError(
+				Message(message),
+				At(fragment.Position),
+			)
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/known_argument_names.go b/internal/gqlparser/validator/rules/known_argument_names.go
new file mode 100644
index 0000000000..d9aa8873e0
--- /dev/null
+++ b/internal/gqlparser/validator/rules/known_argument_names.go
@@ -0,0 +1,59 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("KnownArgumentNames", func(observers *Events, addError AddErrFunc) {
+		// A GraphQL field is only valid if all supplied arguments are defined by that field.
+		observers.OnField(func(walker *Walker, field *ast.Field) {
+			if field.Definition == nil || field.ObjectDefinition == nil {
+				return
+			}
+			for _, arg := range field.Arguments {
+				def := field.Definition.Arguments.ForName(arg.Name)
+				if def != nil {
+					continue
+				}
+
+				var suggestions []string
+				for _, argDef := range field.Definition.Arguments {
+					suggestions = append(suggestions, argDef.Name)
+				}
+
+				addError(
+					Message(`Unknown argument "%s" on field "%s.%s".`, arg.Name, field.ObjectDefinition.Name, field.Name),
+					SuggestListQuoted("Did you mean", arg.Name, suggestions),
+					At(field.Position),
+				)
+			}
+		})
+
+		observers.OnDirective(func(walker *Walker, directive *ast.Directive) {
+			if directive.Definition == nil {
+				return
+			}
+			for _, arg := range directive.Arguments {
+				def := directive.Definition.Arguments.ForName(arg.Name)
+				if def != nil {
+					continue
+				}
+
+				var suggestions []string
+				for _, argDef := range directive.Definition.Arguments {
+					suggestions = append(suggestions, argDef.Name)
+				}
+
+				addError(
+					Message(`Unknown argument "%s" on directive "@%s".`, arg.Name, directive.Name),
+					SuggestListQuoted("Did you mean", arg.Name, suggestions),
+					At(directive.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/known_directives.go b/internal/gqlparser/validator/rules/known_directives.go
new file mode 100644
index 0000000000..016541e821
--- /dev/null
+++ b/internal/gqlparser/validator/rules/known_directives.go
@@ -0,0 +1,49 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("KnownDirectives", func(observers *Events, addError AddErrFunc) {
+		type mayNotBeUsedDirective struct {
+			Name   string
+			Line   int
+			Column int
+		}
+		var seen = map[mayNotBeUsedDirective]bool{}
+		observers.OnDirective(func(walker *Walker, directive *ast.Directive) {
+			if directive.Definition == nil {
+				addError(
+					Message(`Unknown directive "@%s".`, directive.Name),
+					At(directive.Position),
+				)
+				return
+			}
+
+			for _, loc := range directive.Definition.Locations {
+				if loc == directive.Location {
+					return
+				}
+			}
+
+			// position must be exists if directive.Definition != nil
+			tmp := mayNotBeUsedDirective{
+				Name:   directive.Name,
+				Line:   directive.Position.Line,
+				Column: directive.Position.Column,
+			}
+
+			if !seen[tmp] {
+				addError(
+					Message(`Directive "@%s" may not be used on %s.`, directive.Name, directive.Location),
+					At(directive.Position),
+				)
+				seen[tmp] = true
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/known_fragment_names.go b/internal/gqlparser/validator/rules/known_fragment_names.go
new file mode 100644
index 0000000000..94583dac33
--- /dev/null
+++ b/internal/gqlparser/validator/rules/known_fragment_names.go
@@ -0,0 +1,21 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("KnownFragmentNames", func(observers *Events, addError AddErrFunc) {
+		observers.OnFragmentSpread(func(walker *Walker, fragmentSpread *ast.FragmentSpread) {
+			if fragmentSpread.Definition == nil {
+				addError(
+					Message(`Unknown fragment "%s".`, fragmentSpread.Name),
+					At(fragmentSpread.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/known_root_type.go b/internal/gqlparser/validator/rules/known_root_type.go
new file mode 100644
index 0000000000..ab97cd9017
--- /dev/null
+++ b/internal/gqlparser/validator/rules/known_root_type.go
@@ -0,0 +1,37 @@
+package validator
+
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("KnownRootType", func(observers *Events, addError AddErrFunc) {
+		// A query's root must be a valid type.  Surprisingly, this isn't
+		// checked anywhere else!
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			var def *ast.Definition
+			switch operation.Operation {
+			case ast.Query, "":
+				def = walker.Schema.Query
+			case ast.Mutation:
+				def = walker.Schema.Mutation
+			case ast.Subscription:
+				def = walker.Schema.Subscription
+			default:
+				// This shouldn't even parse; if it did we probably need to
+				// update this switch block to add the new operation type.
+				panic(fmt.Sprintf(`got unknown operation type "%s"`, operation.Operation))
+			}
+			if def == nil {
+				addError(
+					Message(`Schema does not support operation type "%s"`, operation.Operation),
+					At(operation.Position))
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/known_type_names.go b/internal/gqlparser/validator/rules/known_type_names.go
new file mode 100644
index 0000000000..aa9809be34
--- /dev/null
+++ b/internal/gqlparser/validator/rules/known_type_names.go
@@ -0,0 +1,61 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("KnownTypeNames", func(observers *Events, addError AddErrFunc) {
+		observers.OnVariable(func(walker *Walker, variable *ast.VariableDefinition) {
+			typeName := variable.Type.Name()
+			typdef := walker.Schema.Types[typeName]
+			if typdef != nil {
+				return
+			}
+
+			addError(
+				Message(`Unknown type "%s".`, typeName),
+				At(variable.Position),
+			)
+		})
+
+		observers.OnInlineFragment(func(walker *Walker, inlineFragment *ast.InlineFragment) {
+			typedName := inlineFragment.TypeCondition
+			if typedName == "" {
+				return
+			}
+
+			def := walker.Schema.Types[typedName]
+			if def != nil {
+				return
+			}
+
+			addError(
+				Message(`Unknown type "%s".`, typedName),
+				At(inlineFragment.Position),
+			)
+		})
+
+		observers.OnFragment(func(walker *Walker, fragment *ast.FragmentDefinition) {
+			typeName := fragment.TypeCondition
+			def := walker.Schema.Types[typeName]
+			if def != nil {
+				return
+			}
+
+			var possibleTypes []string
+			for _, t := range walker.Schema.Types {
+				possibleTypes = append(possibleTypes, t.Name)
+			}
+
+			addError(
+				Message(`Unknown type "%s".`, typeName),
+				SuggestListQuoted("Did you mean", typeName, possibleTypes),
+				At(fragment.Position),
+			)
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/lone_anonymous_operation.go b/internal/gqlparser/validator/rules/lone_anonymous_operation.go
new file mode 100644
index 0000000000..2af7b5a038
--- /dev/null
+++ b/internal/gqlparser/validator/rules/lone_anonymous_operation.go
@@ -0,0 +1,21 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("LoneAnonymousOperation", func(observers *Events, addError AddErrFunc) {
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			if operation.Name == "" && len(walker.Document.Operations) > 1 {
+				addError(
+					Message(`This anonymous operation must be the only defined operation.`),
+					At(operation.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/no_fragment_cycles.go b/internal/gqlparser/validator/rules/no_fragment_cycles.go
new file mode 100644
index 0000000000..a7de611f17
--- /dev/null
+++ b/internal/gqlparser/validator/rules/no_fragment_cycles.go
@@ -0,0 +1,95 @@
+package validator
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("NoFragmentCycles", func(observers *Events, addError AddErrFunc) {
+		visitedFrags := make(map[string]bool)
+
+		observers.OnFragment(func(walker *Walker, fragment *ast.FragmentDefinition) {
+			var spreadPath []*ast.FragmentSpread
+			spreadPathIndexByName := make(map[string]int)
+
+			var recursive func(fragment *ast.FragmentDefinition)
+			recursive = func(fragment *ast.FragmentDefinition) {
+				if visitedFrags[fragment.Name] {
+					return
+				}
+
+				visitedFrags[fragment.Name] = true
+
+				spreadNodes := getFragmentSpreads(fragment.SelectionSet)
+				if len(spreadNodes) == 0 {
+					return
+				}
+				spreadPathIndexByName[fragment.Name] = len(spreadPath)
+
+				for _, spreadNode := range spreadNodes {
+					spreadName := spreadNode.Name
+
+					cycleIndex, ok := spreadPathIndexByName[spreadName]
+
+					spreadPath = append(spreadPath, spreadNode)
+					if !ok {
+						spreadFragment := walker.Document.Fragments.ForName(spreadName)
+						if spreadFragment != nil {
+							recursive(spreadFragment)
+						}
+					} else {
+						cyclePath := spreadPath[cycleIndex : len(spreadPath)-1]
+						var fragmentNames []string
+						for _, fs := range cyclePath {
+							fragmentNames = append(fragmentNames, fmt.Sprintf(`"%s"`, fs.Name))
+						}
+						var via string
+						if len(fragmentNames) != 0 {
+							via = fmt.Sprintf(" via %s", strings.Join(fragmentNames, ", "))
+						}
+						addError(
+							Message(`Cannot spread fragment "%s" within itself%s.`, spreadName, via),
+							At(spreadNode.Position),
+						)
+					}
+
+					spreadPath = spreadPath[:len(spreadPath)-1]
+				}
+
+				delete(spreadPathIndexByName, fragment.Name)
+			}
+
+			recursive(fragment)
+		})
+	})
+}
+
+func getFragmentSpreads(node ast.SelectionSet) []*ast.FragmentSpread {
+	var spreads []*ast.FragmentSpread
+
+	setsToVisit := []ast.SelectionSet{node}
+
+	for len(setsToVisit) != 0 {
+		set := setsToVisit[len(setsToVisit)-1]
+		setsToVisit = setsToVisit[:len(setsToVisit)-1]
+
+		for _, selection := range set {
+			switch selection := selection.(type) {
+			case *ast.FragmentSpread:
+				spreads = append(spreads, selection)
+			case *ast.Field:
+				setsToVisit = append(setsToVisit, selection.SelectionSet)
+			case *ast.InlineFragment:
+				setsToVisit = append(setsToVisit, selection.SelectionSet)
+			}
+		}
+	}
+
+	return spreads
+}
diff --git a/internal/gqlparser/validator/rules/no_undefined_variables.go b/internal/gqlparser/validator/rules/no_undefined_variables.go
new file mode 100644
index 0000000000..e45a5e3d51
--- /dev/null
+++ b/internal/gqlparser/validator/rules/no_undefined_variables.go
@@ -0,0 +1,30 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("NoUndefinedVariables", func(observers *Events, addError AddErrFunc) {
+		observers.OnValue(func(walker *Walker, value *ast.Value) {
+			if walker.CurrentOperation == nil || value.Kind != ast.Variable || value.VariableDefinition != nil {
+				return
+			}
+
+			if walker.CurrentOperation.Name != "" {
+				addError(
+					Message(`Variable "%s" is not defined by operation "%s".`, value, walker.CurrentOperation.Name),
+					At(value.Position),
+				)
+			} else {
+				addError(
+					Message(`Variable "%s" is not defined.`, value),
+					At(value.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/no_unused_fragments.go b/internal/gqlparser/validator/rules/no_unused_fragments.go
new file mode 100644
index 0000000000..f82cfe9f9c
--- /dev/null
+++ b/internal/gqlparser/validator/rules/no_unused_fragments.go
@@ -0,0 +1,32 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("NoUnusedFragments", func(observers *Events, addError AddErrFunc) {
+
+		inFragmentDefinition := false
+		fragmentNameUsed := make(map[string]bool)
+
+		observers.OnFragmentSpread(func(walker *Walker, fragmentSpread *ast.FragmentSpread) {
+			if !inFragmentDefinition {
+				fragmentNameUsed[fragmentSpread.Name] = true
+			}
+		})
+
+		observers.OnFragment(func(walker *Walker, fragment *ast.FragmentDefinition) {
+			inFragmentDefinition = true
+			if !fragmentNameUsed[fragment.Name] {
+				addError(
+					Message(`Fragment "%s" is never used.`, fragment.Name),
+					At(fragment.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/no_unused_variables.go b/internal/gqlparser/validator/rules/no_unused_variables.go
new file mode 100644
index 0000000000..c019ae42e0
--- /dev/null
+++ b/internal/gqlparser/validator/rules/no_unused_variables.go
@@ -0,0 +1,32 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("NoUnusedVariables", func(observers *Events, addError AddErrFunc) {
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			for _, varDef := range operation.VariableDefinitions {
+				if varDef.Used {
+					continue
+				}
+
+				if operation.Name != "" {
+					addError(
+						Message(`Variable "$%s" is never used in operation "%s".`, varDef.Variable, operation.Name),
+						At(varDef.Position),
+					)
+				} else {
+					addError(
+						Message(`Variable "$%s" is never used.`, varDef.Variable),
+						At(varDef.Position),
+					)
+				}
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/overlapping_fields_can_be_merged.go b/internal/gqlparser/validator/rules/overlapping_fields_can_be_merged.go
new file mode 100644
index 0000000000..bda9a90b33
--- /dev/null
+++ b/internal/gqlparser/validator/rules/overlapping_fields_can_be_merged.go
@@ -0,0 +1,562 @@
+package validator
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+
+	AddRule("OverlappingFieldsCanBeMerged", func(observers *Events, addError AddErrFunc) {
+		/**
+		 * Algorithm:
+		 *
+		 * Conflicts occur when two fields exist in a query which will produce the same
+		 * response name, but represent differing values, thus creating a conflict.
+		 * The algorithm below finds all conflicts via making a series of comparisons
+		 * between fields. In order to compare as few fields as possible, this makes
+		 * a series of comparisons "within" sets of fields and "between" sets of fields.
+		 *
+		 * Given any selection set, a collection produces both a set of fields by
+		 * also including all inline fragments, as well as a list of fragments
+		 * referenced by fragment spreads.
+		 *
+		 * A) Each selection set represented in the document first compares "within" its
+		 * collected set of fields, finding any conflicts between every pair of
+		 * overlapping fields.
+		 * Note: This is the *only time* that a the fields "within" a set are compared
+		 * to each other. After this only fields "between" sets are compared.
+		 *
+		 * B) Also, if any fragment is referenced in a selection set, then a
+		 * comparison is made "between" the original set of fields and the
+		 * referenced fragment.
+		 *
+		 * C) Also, if multiple fragments are referenced, then comparisons
+		 * are made "between" each referenced fragment.
+		 *
+		 * D) When comparing "between" a set of fields and a referenced fragment, first
+		 * a comparison is made between each field in the original set of fields and
+		 * each field in the the referenced set of fields.
+		 *
+		 * E) Also, if any fragment is referenced in the referenced selection set,
+		 * then a comparison is made "between" the original set of fields and the
+		 * referenced fragment (recursively referring to step D).
+		 *
+		 * F) When comparing "between" two fragments, first a comparison is made between
+		 * each field in the first referenced set of fields and each field in the the
+		 * second referenced set of fields.
+		 *
+		 * G) Also, any fragments referenced by the first must be compared to the
+		 * second, and any fragments referenced by the second must be compared to the
+		 * first (recursively referring to step F).
+		 *
+		 * H) When comparing two fields, if both have selection sets, then a comparison
+		 * is made "between" both selection sets, first comparing the set of fields in
+		 * the first selection set with the set of fields in the second.
+		 *
+		 * I) Also, if any fragment is referenced in either selection set, then a
+		 * comparison is made "between" the other set of fields and the
+		 * referenced fragment.
+		 *
+		 * J) Also, if two fragments are referenced in both selection sets, then a
+		 * comparison is made "between" the two fragments.
+		 *
+		 */
+
+		m := &overlappingFieldsCanBeMergedManager{
+			comparedFragmentPairs: pairSet{data: make(map[string]map[string]bool)},
+		}
+
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			m.walker = walker
+			conflicts := m.findConflictsWithinSelectionSet(operation.SelectionSet)
+			for _, conflict := range conflicts {
+				conflict.addFieldsConflictMessage(addError)
+			}
+		})
+		observers.OnField(func(walker *Walker, field *ast.Field) {
+			if walker.CurrentOperation == nil {
+				// When checking both Operation and Fragment, errors are duplicated when processing FragmentDefinition referenced from Operation
+				return
+			}
+			m.walker = walker
+			conflicts := m.findConflictsWithinSelectionSet(field.SelectionSet)
+			for _, conflict := range conflicts {
+				conflict.addFieldsConflictMessage(addError)
+			}
+		})
+		observers.OnInlineFragment(func(walker *Walker, inlineFragment *ast.InlineFragment) {
+			m.walker = walker
+			conflicts := m.findConflictsWithinSelectionSet(inlineFragment.SelectionSet)
+			for _, conflict := range conflicts {
+				conflict.addFieldsConflictMessage(addError)
+			}
+		})
+		observers.OnFragment(func(walker *Walker, fragment *ast.FragmentDefinition) {
+			m.walker = walker
+			conflicts := m.findConflictsWithinSelectionSet(fragment.SelectionSet)
+			for _, conflict := range conflicts {
+				conflict.addFieldsConflictMessage(addError)
+			}
+		})
+	})
+}
+
+type pairSet struct {
+	data map[string]map[string]bool
+}
+
+func (pairSet *pairSet) Add(a *ast.FragmentSpread, b *ast.FragmentSpread, areMutuallyExclusive bool) {
+	add := func(a *ast.FragmentSpread, b *ast.FragmentSpread) {
+		m := pairSet.data[a.Name]
+		if m == nil {
+			m = make(map[string]bool)
+			pairSet.data[a.Name] = m
+		}
+		m[b.Name] = areMutuallyExclusive
+	}
+	add(a, b)
+	add(b, a)
+}
+
+func (pairSet *pairSet) Has(a *ast.FragmentSpread, b *ast.FragmentSpread, areMutuallyExclusive bool) bool {
+	am, ok := pairSet.data[a.Name]
+	if !ok {
+		return false
+	}
+	result, ok := am[b.Name]
+	if !ok {
+		return false
+	}
+
+	// areMutuallyExclusive being false is a superset of being true,
+	// hence if we want to know if this PairSet "has" these two with no
+	// exclusivity, we have to ensure it was added as such.
+	if !areMutuallyExclusive {
+		return !result
+	}
+
+	return true
+}
+
+type sequentialFieldsMap struct {
+	// We can't use map[string][]*ast.Field. because map is not stable...
+	seq  []string
+	data map[string][]*ast.Field
+}
+
+type fieldIterateEntry struct {
+	ResponseName string
+	Fields       []*ast.Field
+}
+
+func (m *sequentialFieldsMap) Push(responseName string, field *ast.Field) {
+	fields, ok := m.data[responseName]
+	if !ok {
+		m.seq = append(m.seq, responseName)
+	}
+	fields = append(fields, field)
+	m.data[responseName] = fields
+}
+
+func (m *sequentialFieldsMap) Get(responseName string) ([]*ast.Field, bool) {
+	fields, ok := m.data[responseName]
+	return fields, ok
+}
+
+func (m *sequentialFieldsMap) Iterator() [][]*ast.Field {
+	fieldsList := make([][]*ast.Field, 0, len(m.seq))
+	for _, responseName := range m.seq {
+		fields := m.data[responseName]
+		fieldsList = append(fieldsList, fields)
+	}
+	return fieldsList
+}
+
+func (m *sequentialFieldsMap) KeyValueIterator() []*fieldIterateEntry {
+	fieldEntriesList := make([]*fieldIterateEntry, 0, len(m.seq))
+	for _, responseName := range m.seq {
+		fields := m.data[responseName]
+		fieldEntriesList = append(fieldEntriesList, &fieldIterateEntry{
+			ResponseName: responseName,
+			Fields:       fields,
+		})
+	}
+	return fieldEntriesList
+}
+
+type conflictMessageContainer struct {
+	Conflicts []*ConflictMessage
+}
+
+type ConflictMessage struct {
+	Message      string
+	ResponseName string
+	Names        []string
+	SubMessage   []*ConflictMessage
+	Position     *ast.Position
+}
+
+func (m *ConflictMessage) String(buf *bytes.Buffer) {
+	if len(m.SubMessage) == 0 {
+		buf.WriteString(m.Message)
+		return
+	}
+
+	for idx, subMessage := range m.SubMessage {
+		buf.WriteString(`subfields "`)
+		buf.WriteString(subMessage.ResponseName)
+		buf.WriteString(`" conflict because `)
+		subMessage.String(buf)
+		if idx != len(m.SubMessage)-1 {
+			buf.WriteString(" and ")
+		}
+	}
+}
+
+func (m *ConflictMessage) addFieldsConflictMessage(addError AddErrFunc) {
+	var buf bytes.Buffer
+	m.String(&buf)
+	addError(
+		Message(`Fields "%s" conflict because %s. Use different aliases on the fields to fetch both if this was intentional.`, m.ResponseName, buf.String()),
+		At(m.Position),
+	)
+}
+
+type overlappingFieldsCanBeMergedManager struct {
+	walker *Walker
+
+	// per walker
+	comparedFragmentPairs pairSet
+	// cachedFieldsAndFragmentNames interface{}
+
+	// per selectionSet
+	comparedFragments map[string]bool
+}
+
+func (m *overlappingFieldsCanBeMergedManager) findConflictsWithinSelectionSet(selectionSet ast.SelectionSet) []*ConflictMessage {
+	if len(selectionSet) == 0 {
+		return nil
+	}
+
+	fieldsMap, fragmentSpreads := getFieldsAndFragmentNames(selectionSet)
+
+	var conflicts conflictMessageContainer
+
+	// (A) Find find all conflicts "within" the fieldMap of this selection set.
+	// Note: this is the *only place* `collectConflictsWithin` is called.
+	m.collectConflictsWithin(&conflicts, fieldsMap)
+
+	m.comparedFragments = make(map[string]bool)
+	for idx, fragmentSpreadA := range fragmentSpreads {
+		// (B) Then collect conflicts between these fieldMap and those represented by
+		// each spread fragment name found.
+		m.collectConflictsBetweenFieldsAndFragment(&conflicts, false, fieldsMap, fragmentSpreadA)
+
+		for _, fragmentSpreadB := range fragmentSpreads[idx+1:] {
+			// (C) Then compare this fragment with all other fragments found in this
+			// selection set to collect conflicts between fragments spread together.
+			// This compares each item in the list of fragment names to every other
+			// item in that same list (except for itself).
+			m.collectConflictsBetweenFragments(&conflicts, false, fragmentSpreadA, fragmentSpreadB)
+		}
+	}
+
+	return conflicts.Conflicts
+}
+
+func (m *overlappingFieldsCanBeMergedManager) collectConflictsBetweenFieldsAndFragment(conflicts *conflictMessageContainer, areMutuallyExclusive bool, fieldsMap *sequentialFieldsMap, fragmentSpread *ast.FragmentSpread) {
+	if m.comparedFragments[fragmentSpread.Name] {
+		return
+	}
+	m.comparedFragments[fragmentSpread.Name] = true
+
+	if fragmentSpread.Definition == nil {
+		return
+	}
+
+	fieldsMapB, fragmentSpreads := getFieldsAndFragmentNames(fragmentSpread.Definition.SelectionSet)
+
+	// Do not compare a fragment's fieldMap to itself.
+	if reflect.DeepEqual(fieldsMap, fieldsMapB) {
+		return
+	}
+
+	// (D) First collect any conflicts between the provided collection of fields
+	// and the collection of fields represented by the given fragment.
+	m.collectConflictsBetween(conflicts, areMutuallyExclusive, fieldsMap, fieldsMapB)
+
+	// (E) Then collect any conflicts between the provided collection of fields
+	// and any fragment names found in the given fragment.
+	baseFragmentSpread := fragmentSpread
+	for _, fragmentSpread := range fragmentSpreads {
+		if fragmentSpread.Name == baseFragmentSpread.Name {
+			continue
+		}
+		m.collectConflictsBetweenFieldsAndFragment(conflicts, areMutuallyExclusive, fieldsMap, fragmentSpread)
+	}
+}
+
+func (m *overlappingFieldsCanBeMergedManager) collectConflictsBetweenFragments(conflicts *conflictMessageContainer, areMutuallyExclusive bool, fragmentSpreadA *ast.FragmentSpread, fragmentSpreadB *ast.FragmentSpread) {
+
+	var check func(fragmentSpreadA *ast.FragmentSpread, fragmentSpreadB *ast.FragmentSpread)
+	check = func(fragmentSpreadA *ast.FragmentSpread, fragmentSpreadB *ast.FragmentSpread) {
+
+		if fragmentSpreadA.Name == fragmentSpreadB.Name {
+			return
+		}
+
+		if m.comparedFragmentPairs.Has(fragmentSpreadA, fragmentSpreadB, areMutuallyExclusive) {
+			return
+		}
+		m.comparedFragmentPairs.Add(fragmentSpreadA, fragmentSpreadB, areMutuallyExclusive)
+
+		if fragmentSpreadA.Definition == nil {
+			return
+		}
+		if fragmentSpreadB.Definition == nil {
+			return
+		}
+
+		fieldsMapA, fragmentSpreadsA := getFieldsAndFragmentNames(fragmentSpreadA.Definition.SelectionSet)
+		fieldsMapB, fragmentSpreadsB := getFieldsAndFragmentNames(fragmentSpreadB.Definition.SelectionSet)
+
+		// (F) First, collect all conflicts between these two collections of fields
+		// (not including any nested fragments).
+		m.collectConflictsBetween(conflicts, areMutuallyExclusive, fieldsMapA, fieldsMapB)
+
+		// (G) Then collect conflicts between the first fragment and any nested
+		// fragments spread in the second fragment.
+		for _, fragmentSpread := range fragmentSpreadsB {
+			check(fragmentSpreadA, fragmentSpread)
+		}
+		// (G) Then collect conflicts between the second fragment and any nested
+		// fragments spread in the first fragment.
+		for _, fragmentSpread := range fragmentSpreadsA {
+			check(fragmentSpread, fragmentSpreadB)
+		}
+	}
+
+	check(fragmentSpreadA, fragmentSpreadB)
+}
+
+func (m *overlappingFieldsCanBeMergedManager) findConflictsBetweenSubSelectionSets(areMutuallyExclusive bool, selectionSetA ast.SelectionSet, selectionSetB ast.SelectionSet) *conflictMessageContainer {
+	var conflicts conflictMessageContainer
+
+	fieldsMapA, fragmentSpreadsA := getFieldsAndFragmentNames(selectionSetA)
+	fieldsMapB, fragmentSpreadsB := getFieldsAndFragmentNames(selectionSetB)
+
+	// (H) First, collect all conflicts between these two collections of field.
+	m.collectConflictsBetween(&conflicts, areMutuallyExclusive, fieldsMapA, fieldsMapB)
+
+	// (I) Then collect conflicts between the first collection of fields and
+	// those referenced by each fragment name associated with the second.
+	for _, fragmentSpread := range fragmentSpreadsB {
+		m.comparedFragments = make(map[string]bool)
+		m.collectConflictsBetweenFieldsAndFragment(&conflicts, areMutuallyExclusive, fieldsMapA, fragmentSpread)
+	}
+
+	// (I) Then collect conflicts between the second collection of fields and
+	// those referenced by each fragment name associated with the first.
+	for _, fragmentSpread := range fragmentSpreadsA {
+		m.comparedFragments = make(map[string]bool)
+		m.collectConflictsBetweenFieldsAndFragment(&conflicts, areMutuallyExclusive, fieldsMapB, fragmentSpread)
+	}
+
+	// (J) Also collect conflicts between any fragment names by the first and
+	// fragment names by the second. This compares each item in the first set of
+	// names to each item in the second set of names.
+	for _, fragmentSpreadA := range fragmentSpreadsA {
+		for _, fragmentSpreadB := range fragmentSpreadsB {
+			m.collectConflictsBetweenFragments(&conflicts, areMutuallyExclusive, fragmentSpreadA, fragmentSpreadB)
+		}
+	}
+
+	if len(conflicts.Conflicts) == 0 {
+		return nil
+	}
+
+	return &conflicts
+}
+
+func (m *overlappingFieldsCanBeMergedManager) collectConflictsWithin(conflicts *conflictMessageContainer, fieldsMap *sequentialFieldsMap) {
+	for _, fields := range fieldsMap.Iterator() {
+		for idx, fieldA := range fields {
+			for _, fieldB := range fields[idx+1:] {
+				conflict := m.findConflict(false, fieldA, fieldB)
+				if conflict != nil {
+					conflicts.Conflicts = append(conflicts.Conflicts, conflict)
+				}
+			}
+		}
+	}
+}
+
+func (m *overlappingFieldsCanBeMergedManager) collectConflictsBetween(conflicts *conflictMessageContainer, parentFieldsAreMutuallyExclusive bool, fieldsMapA *sequentialFieldsMap, fieldsMapB *sequentialFieldsMap) {
+	for _, fieldsEntryA := range fieldsMapA.KeyValueIterator() {
+		fieldsB, ok := fieldsMapB.Get(fieldsEntryA.ResponseName)
+		if !ok {
+			continue
+		}
+		for _, fieldA := range fieldsEntryA.Fields {
+			for _, fieldB := range fieldsB {
+				conflict := m.findConflict(parentFieldsAreMutuallyExclusive, fieldA, fieldB)
+				if conflict != nil {
+					conflicts.Conflicts = append(conflicts.Conflicts, conflict)
+				}
+			}
+		}
+	}
+}
+
+func (m *overlappingFieldsCanBeMergedManager) findConflict(parentFieldsAreMutuallyExclusive bool, fieldA *ast.Field, fieldB *ast.Field) *ConflictMessage {
+	if fieldA.ObjectDefinition == nil || fieldB.ObjectDefinition == nil {
+		return nil
+	}
+
+	areMutuallyExclusive := parentFieldsAreMutuallyExclusive
+	if !areMutuallyExclusive {
+		tmp := fieldA.ObjectDefinition.Name != fieldB.ObjectDefinition.Name
+		tmp = tmp && fieldA.ObjectDefinition.Kind == ast.Object
+		tmp = tmp && fieldB.ObjectDefinition.Kind == ast.Object
+		tmp = tmp && fieldA.Definition != nil && fieldB.Definition != nil
+		areMutuallyExclusive = tmp
+	}
+
+	fieldNameA := fieldA.Name
+	if fieldA.Alias != "" {
+		fieldNameA = fieldA.Alias
+	}
+
+	if !areMutuallyExclusive {
+		// Two aliases must refer to the same field.
+		if fieldA.Name != fieldB.Name {
+			return &ConflictMessage{
+				ResponseName: fieldNameA,
+				Message:      fmt.Sprintf(`"%s" and "%s" are different fields`, fieldA.Name, fieldB.Name),
+				Position:     fieldB.Position,
+			}
+		}
+
+		// Two field calls must have the same arguments.
+		if !sameArguments(fieldA.Arguments, fieldB.Arguments) {
+			return &ConflictMessage{
+				ResponseName: fieldNameA,
+				Message:      "they have differing arguments",
+				Position:     fieldB.Position,
+			}
+		}
+	}
+
+	if fieldA.Definition != nil && fieldB.Definition != nil && doTypesConflict(m.walker, fieldA.Definition.Type, fieldB.Definition.Type) {
+		return &ConflictMessage{
+			ResponseName: fieldNameA,
+			Message:      fmt.Sprintf(`they return conflicting types "%s" and "%s"`, fieldA.Definition.Type.String(), fieldB.Definition.Type.String()),
+			Position:     fieldB.Position,
+		}
+	}
+
+	// Collect and compare sub-fields. Use the same "visited fragment names" list
+	// for both collections so fields in a fragment reference are never
+	// compared to themselves.
+	conflicts := m.findConflictsBetweenSubSelectionSets(areMutuallyExclusive, fieldA.SelectionSet, fieldB.SelectionSet)
+	if conflicts == nil {
+		return nil
+	}
+	return &ConflictMessage{
+		ResponseName: fieldNameA,
+		SubMessage:   conflicts.Conflicts,
+		Position:     fieldB.Position,
+	}
+}
+
+func sameArguments(args1 []*ast.Argument, args2 []*ast.Argument) bool {
+	if len(args1) != len(args2) {
+		return false
+	}
+	for _, arg1 := range args1 {
+		var matched bool
+		for _, arg2 := range args2 {
+			if arg1.Name == arg2.Name && sameValue(arg1.Value, arg2.Value) {
+				matched = true
+				break
+			}
+		}
+		if !matched {
+			return false
+		}
+	}
+	return true
+}
+
+func sameValue(value1 *ast.Value, value2 *ast.Value) bool {
+	if value1.Kind != value2.Kind {
+		return false
+	}
+	if value1.Raw != value2.Raw {
+		return false
+	}
+	return true
+}
+
+func doTypesConflict(walker *Walker, type1 *ast.Type, type2 *ast.Type) bool {
+	if type1.Elem != nil {
+		if type2.Elem != nil {
+			return doTypesConflict(walker, type1.Elem, type2.Elem)
+		}
+		return true
+	}
+	if type2.Elem != nil {
+		return true
+	}
+	if type1.NonNull && !type2.NonNull {
+		return true
+	}
+	if !type1.NonNull && type2.NonNull {
+		return true
+	}
+
+	t1 := walker.Schema.Types[type1.NamedType]
+	t2 := walker.Schema.Types[type2.NamedType]
+	if (t1.Kind == ast.Scalar || t1.Kind == ast.Enum) && (t2.Kind == ast.Scalar || t2.Kind == ast.Enum) {
+		return t1.Name != t2.Name
+	}
+
+	return false
+}
+
+func getFieldsAndFragmentNames(selectionSet ast.SelectionSet) (*sequentialFieldsMap, []*ast.FragmentSpread) {
+	fieldsMap := sequentialFieldsMap{
+		data: make(map[string][]*ast.Field),
+	}
+	var fragmentSpreads []*ast.FragmentSpread
+
+	var walk func(selectionSet ast.SelectionSet)
+	walk = func(selectionSet ast.SelectionSet) {
+		for _, selection := range selectionSet {
+			switch selection := selection.(type) {
+			case *ast.Field:
+				responseName := selection.Name
+				if selection.Alias != "" {
+					responseName = selection.Alias
+				}
+				fieldsMap.Push(responseName, selection)
+
+			case *ast.InlineFragment:
+				walk(selection.SelectionSet)
+
+			case *ast.FragmentSpread:
+				fragmentSpreads = append(fragmentSpreads, selection)
+			}
+		}
+	}
+	walk(selectionSet)
+
+	return &fieldsMap, fragmentSpreads
+}
diff --git a/internal/gqlparser/validator/rules/possible_fragment_spreads.go b/internal/gqlparser/validator/rules/possible_fragment_spreads.go
new file mode 100644
index 0000000000..79cb20c49c
--- /dev/null
+++ b/internal/gqlparser/validator/rules/possible_fragment_spreads.go
@@ -0,0 +1,70 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("PossibleFragmentSpreads", func(observers *Events, addError AddErrFunc) {
+
+		validate := func(walker *Walker, parentDef *ast.Definition, fragmentName string, emitError func()) {
+			if parentDef == nil {
+				return
+			}
+
+			var parentDefs []*ast.Definition
+			switch parentDef.Kind {
+			case ast.Object:
+				parentDefs = []*ast.Definition{parentDef}
+			case ast.Interface, ast.Union:
+				parentDefs = walker.Schema.GetPossibleTypes(parentDef)
+			default:
+				return
+			}
+
+			fragmentDefType := walker.Schema.Types[fragmentName]
+			if fragmentDefType == nil {
+				return
+			}
+			if !fragmentDefType.IsCompositeType() {
+				// checked by FragmentsOnCompositeTypes
+				return
+			}
+			fragmentDefs := walker.Schema.GetPossibleTypes(fragmentDefType)
+
+			for _, fragmentDef := range fragmentDefs {
+				for _, parentDef := range parentDefs {
+					if parentDef.Name == fragmentDef.Name {
+						return
+					}
+				}
+			}
+
+			emitError()
+		}
+
+		observers.OnInlineFragment(func(walker *Walker, inlineFragment *ast.InlineFragment) {
+			validate(walker, inlineFragment.ObjectDefinition, inlineFragment.TypeCondition, func() {
+				addError(
+					Message(`Fragment cannot be spread here as objects of type "%s" can never be of type "%s".`, inlineFragment.ObjectDefinition.Name, inlineFragment.TypeCondition),
+					At(inlineFragment.Position),
+				)
+			})
+		})
+
+		observers.OnFragmentSpread(func(walker *Walker, fragmentSpread *ast.FragmentSpread) {
+			if fragmentSpread.Definition == nil {
+				return
+			}
+			validate(walker, fragmentSpread.ObjectDefinition, fragmentSpread.Definition.TypeCondition, func() {
+				addError(
+					Message(`Fragment "%s" cannot be spread here as objects of type "%s" can never be of type "%s".`, fragmentSpread.Name, fragmentSpread.ObjectDefinition.Name, fragmentSpread.Definition.TypeCondition),
+					At(fragmentSpread.Position),
+				)
+			})
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/provided_required_arguments.go b/internal/gqlparser/validator/rules/provided_required_arguments.go
new file mode 100644
index 0000000000..20364f8ba9
--- /dev/null
+++ b/internal/gqlparser/validator/rules/provided_required_arguments.go
@@ -0,0 +1,64 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("ProvidedRequiredArguments", func(observers *Events, addError AddErrFunc) {
+		observers.OnField(func(walker *Walker, field *ast.Field) {
+			if field.Definition == nil {
+				return
+			}
+
+		argDef:
+			for _, argDef := range field.Definition.Arguments {
+				if !argDef.Type.NonNull {
+					continue
+				}
+				if argDef.DefaultValue != nil {
+					continue
+				}
+				for _, arg := range field.Arguments {
+					if arg.Name == argDef.Name {
+						continue argDef
+					}
+				}
+
+				addError(
+					Message(`Field "%s" argument "%s" of type "%s" is required, but it was not provided.`, field.Name, argDef.Name, argDef.Type.String()),
+					At(field.Position),
+				)
+			}
+		})
+
+		observers.OnDirective(func(walker *Walker, directive *ast.Directive) {
+			if directive.Definition == nil {
+				return
+			}
+
+		argDef:
+			for _, argDef := range directive.Definition.Arguments {
+				if !argDef.Type.NonNull {
+					continue
+				}
+				if argDef.DefaultValue != nil {
+					continue
+				}
+				for _, arg := range directive.Arguments {
+					if arg.Name == argDef.Name {
+						continue argDef
+					}
+				}
+
+				addError(
+					Message(`Directive "@%s" argument "%s" of type "%s" is required, but it was not provided.`, directive.Definition.Name, argDef.Name, argDef.Type.String()),
+					At(directive.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/scalar_leafs.go b/internal/gqlparser/validator/rules/scalar_leafs.go
new file mode 100644
index 0000000000..cd17b47c87
--- /dev/null
+++ b/internal/gqlparser/validator/rules/scalar_leafs.go
@@ -0,0 +1,38 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("ScalarLeafs", func(observers *Events, addError AddErrFunc) {
+		observers.OnField(func(walker *Walker, field *ast.Field) {
+			if field.Definition == nil {
+				return
+			}
+
+			fieldType := walker.Schema.Types[field.Definition.Type.Name()]
+			if fieldType == nil {
+				return
+			}
+
+			if fieldType.IsLeafType() && len(field.SelectionSet) > 0 {
+				addError(
+					Message(`Field "%s" must not have a selection since type "%s" has no subfields.`, field.Name, fieldType.Name),
+					At(field.Position),
+				)
+			}
+
+			if !fieldType.IsLeafType() && len(field.SelectionSet) == 0 {
+				addError(
+					Message(`Field "%s" of type "%s" must have a selection of subfields.`, field.Name, field.Definition.Type.String()),
+					Suggestf(`"%s { ... }"`, field.Name),
+					At(field.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/single_field_subscriptions.go b/internal/gqlparser/validator/rules/single_field_subscriptions.go
new file mode 100644
index 0000000000..98cb984b40
--- /dev/null
+++ b/internal/gqlparser/validator/rules/single_field_subscriptions.go
@@ -0,0 +1,88 @@
+package validator
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("SingleFieldSubscriptions", func(observers *Events, addError AddErrFunc) {
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			if walker.Schema.Subscription == nil || operation.Operation != ast.Subscription {
+				return
+			}
+
+			fields := retrieveTopFieldNames(operation.SelectionSet)
+
+			name := "Anonymous Subscription"
+			if operation.Name != "" {
+				name = `Subscription ` + strconv.Quote(operation.Name)
+			}
+
+			if len(fields) > 1 {
+				addError(
+					Message(`%s must select only one top level field.`, name),
+					At(fields[1].position),
+				)
+			}
+
+			for _, field := range fields {
+				if strings.HasPrefix(field.name, "__") {
+					addError(
+						Message(`%s must not select an introspection top level field.`, name),
+						At(field.position),
+					)
+				}
+			}
+		})
+	})
+}
+
+type topField struct {
+	name     string
+	position *ast.Position
+}
+
+func retrieveTopFieldNames(selectionSet ast.SelectionSet) []*topField {
+	fields := []*topField{}
+	inFragmentRecursive := map[string]bool{}
+	var walk func(selectionSet ast.SelectionSet)
+	walk = func(selectionSet ast.SelectionSet) {
+		for _, selection := range selectionSet {
+			switch selection := selection.(type) {
+			case *ast.Field:
+				fields = append(fields, &topField{
+					name:     selection.Name,
+					position: selection.GetPosition(),
+				})
+			case *ast.InlineFragment:
+				walk(selection.SelectionSet)
+			case *ast.FragmentSpread:
+				if selection.Definition == nil {
+					return
+				}
+				fragment := selection.Definition.Name
+				if !inFragmentRecursive[fragment] {
+					inFragmentRecursive[fragment] = true
+					walk(selection.Definition.SelectionSet)
+				}
+			}
+		}
+	}
+	walk(selectionSet)
+
+	seen := make(map[string]bool, len(fields))
+	uniquedFields := make([]*topField, 0, len(fields))
+	for _, field := range fields {
+		if !seen[field.name] {
+			uniquedFields = append(uniquedFields, field)
+		}
+		seen[field.name] = true
+	}
+	return uniquedFields
+}
diff --git a/internal/gqlparser/validator/rules/unique_argument_names.go b/internal/gqlparser/validator/rules/unique_argument_names.go
new file mode 100644
index 0000000000..4466d56720
--- /dev/null
+++ b/internal/gqlparser/validator/rules/unique_argument_names.go
@@ -0,0 +1,35 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("UniqueArgumentNames", func(observers *Events, addError AddErrFunc) {
+		observers.OnField(func(walker *Walker, field *ast.Field) {
+			checkUniqueArgs(field.Arguments, addError)
+		})
+
+		observers.OnDirective(func(walker *Walker, directive *ast.Directive) {
+			checkUniqueArgs(directive.Arguments, addError)
+		})
+	})
+}
+
+func checkUniqueArgs(args ast.ArgumentList, addError AddErrFunc) {
+	knownArgNames := map[string]int{}
+
+	for _, arg := range args {
+		if knownArgNames[arg.Name] == 1 {
+			addError(
+				Message(`There can be only one argument named "%s".`, arg.Name),
+				At(arg.Position),
+			)
+		}
+
+		knownArgNames[arg.Name]++
+	}
+}
diff --git a/internal/gqlparser/validator/rules/unique_directives_per_location.go b/internal/gqlparser/validator/rules/unique_directives_per_location.go
new file mode 100644
index 0000000000..09968a7416
--- /dev/null
+++ b/internal/gqlparser/validator/rules/unique_directives_per_location.go
@@ -0,0 +1,26 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("UniqueDirectivesPerLocation", func(observers *Events, addError AddErrFunc) {
+		observers.OnDirectiveList(func(walker *Walker, directives []*ast.Directive) {
+			seen := map[string]bool{}
+
+			for _, dir := range directives {
+				if dir.Name != "repeatable" && seen[dir.Name] {
+					addError(
+						Message(`The directive "@%s" can only be used once at this location.`, dir.Name),
+						At(dir.Position),
+					)
+				}
+				seen[dir.Name] = true
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/unique_fragment_names.go b/internal/gqlparser/validator/rules/unique_fragment_names.go
new file mode 100644
index 0000000000..3da46467e8
--- /dev/null
+++ b/internal/gqlparser/validator/rules/unique_fragment_names.go
@@ -0,0 +1,24 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("UniqueFragmentNames", func(observers *Events, addError AddErrFunc) {
+		seenFragments := map[string]bool{}
+
+		observers.OnFragment(func(walker *Walker, fragment *ast.FragmentDefinition) {
+			if seenFragments[fragment.Name] {
+				addError(
+					Message(`There can be only one fragment named "%s".`, fragment.Name),
+					At(fragment.Position),
+				)
+			}
+			seenFragments[fragment.Name] = true
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/unique_input_field_names.go b/internal/gqlparser/validator/rules/unique_input_field_names.go
new file mode 100644
index 0000000000..f9f69051bf
--- /dev/null
+++ b/internal/gqlparser/validator/rules/unique_input_field_names.go
@@ -0,0 +1,29 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("UniqueInputFieldNames", func(observers *Events, addError AddErrFunc) {
+		observers.OnValue(func(walker *Walker, value *ast.Value) {
+			if value.Kind != ast.ObjectValue {
+				return
+			}
+
+			seen := map[string]bool{}
+			for _, field := range value.Children {
+				if seen[field.Name] {
+					addError(
+						Message(`There can be only one input field named "%s".`, field.Name),
+						At(field.Position),
+					)
+				}
+				seen[field.Name] = true
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/unique_operation_names.go b/internal/gqlparser/validator/rules/unique_operation_names.go
new file mode 100644
index 0000000000..dc937795bd
--- /dev/null
+++ b/internal/gqlparser/validator/rules/unique_operation_names.go
@@ -0,0 +1,24 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("UniqueOperationNames", func(observers *Events, addError AddErrFunc) {
+		seen := map[string]bool{}
+
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			if seen[operation.Name] {
+				addError(
+					Message(`There can be only one operation named "%s".`, operation.Name),
+					At(operation.Position),
+				)
+			}
+			seen[operation.Name] = true
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/unique_variable_names.go b/internal/gqlparser/validator/rules/unique_variable_names.go
new file mode 100644
index 0000000000..94dab3cf13
--- /dev/null
+++ b/internal/gqlparser/validator/rules/unique_variable_names.go
@@ -0,0 +1,26 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("UniqueVariableNames", func(observers *Events, addError AddErrFunc) {
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			seen := map[string]int{}
+			for _, def := range operation.VariableDefinitions {
+				// add the same error only once per a variable.
+				if seen[def.Variable] == 1 {
+					addError(
+						Message(`There can be only one variable named "$%s".`, def.Variable),
+						At(def.Position),
+					)
+				}
+				seen[def.Variable]++
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/values_of_correct_type.go b/internal/gqlparser/validator/rules/values_of_correct_type.go
new file mode 100644
index 0000000000..88d8f53c45
--- /dev/null
+++ b/internal/gqlparser/validator/rules/values_of_correct_type.go
@@ -0,0 +1,170 @@
+package validator
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("ValuesOfCorrectType", func(observers *Events, addError AddErrFunc) {
+		observers.OnValue(func(walker *Walker, value *ast.Value) {
+			if value.Definition == nil || value.ExpectedType == nil {
+				return
+			}
+
+			if value.Kind == ast.NullValue && value.ExpectedType.NonNull {
+				addError(
+					Message(`Expected value of type "%s", found %s.`, value.ExpectedType.String(), value.String()),
+					At(value.Position),
+				)
+			}
+
+			if value.Definition.Kind == ast.Scalar {
+				// Skip custom validating scalars
+				if !value.Definition.OneOf("Int", "Float", "String", "Boolean", "ID") {
+					return
+				}
+			}
+
+			var possibleEnums []string
+			if value.Definition.Kind == ast.Enum {
+				for _, val := range value.Definition.EnumValues {
+					possibleEnums = append(possibleEnums, val.Name)
+				}
+			}
+
+			rawVal, err := value.Value(nil)
+			if err != nil {
+				unexpectedTypeMessage(addError, value)
+			}
+
+			switch value.Kind {
+			case ast.NullValue:
+				return
+			case ast.ListValue:
+				if value.ExpectedType.Elem == nil {
+					unexpectedTypeMessage(addError, value)
+					return
+				}
+
+			case ast.IntValue:
+				if !value.Definition.OneOf("Int", "Float", "ID") {
+					unexpectedTypeMessage(addError, value)
+				}
+
+			case ast.FloatValue:
+				if !value.Definition.OneOf("Float") {
+					unexpectedTypeMessage(addError, value)
+				}
+
+			case ast.StringValue, ast.BlockValue:
+				if value.Definition.Kind == ast.Enum {
+					rawValStr := fmt.Sprint(rawVal)
+					addError(
+						Message(`Enum "%s" cannot represent non-enum value: %s.`, value.ExpectedType.String(), value.String()),
+						SuggestListQuoted("Did you mean the enum value", rawValStr, possibleEnums),
+						At(value.Position),
+					)
+				} else if !value.Definition.OneOf("String", "ID") {
+					unexpectedTypeMessage(addError, value)
+				}
+
+			case ast.EnumValue:
+				if value.Definition.Kind != ast.Enum {
+					rawValStr := fmt.Sprint(rawVal)
+					addError(
+						unexpectedTypeMessageOnly(value),
+						SuggestListUnquoted("Did you mean the enum value", rawValStr, possibleEnums),
+						At(value.Position),
+					)
+				} else if value.Definition.EnumValues.ForName(value.Raw) == nil {
+					rawValStr := fmt.Sprint(rawVal)
+					addError(
+						Message(`Value "%s" does not exist in "%s" enum.`, value.String(), value.ExpectedType.String()),
+						SuggestListQuoted("Did you mean the enum value", rawValStr, possibleEnums),
+						At(value.Position),
+					)
+				}
+
+			case ast.BooleanValue:
+				if !value.Definition.OneOf("Boolean") {
+					unexpectedTypeMessage(addError, value)
+				}
+
+			case ast.ObjectValue:
+
+				for _, field := range value.Definition.Fields {
+					if field.Type.NonNull {
+						fieldValue := value.Children.ForName(field.Name)
+						if fieldValue == nil && field.DefaultValue == nil {
+							addError(
+								Message(`Field "%s.%s" of required type "%s" was not provided.`, value.Definition.Name, field.Name, field.Type.String()),
+								At(value.Position),
+							)
+							continue
+						}
+					}
+				}
+
+				for _, fieldValue := range value.Children {
+					if value.Definition.Fields.ForName(fieldValue.Name) == nil {
+						var suggestions []string
+						for _, fieldValue := range value.Definition.Fields {
+							suggestions = append(suggestions, fieldValue.Name)
+						}
+
+						addError(
+							Message(`Field "%s" is not defined by type "%s".`, fieldValue.Name, value.Definition.Name),
+							SuggestListQuoted("Did you mean", fieldValue.Name, suggestions),
+							At(fieldValue.Position),
+						)
+					}
+				}
+
+			case ast.Variable:
+				return
+
+			default:
+				panic(fmt.Errorf("unhandled %T", value))
+			}
+		})
+	})
+}
+
+func unexpectedTypeMessage(addError AddErrFunc, v *ast.Value) {
+	addError(
+		unexpectedTypeMessageOnly(v),
+		At(v.Position),
+	)
+}
+
+func unexpectedTypeMessageOnly(v *ast.Value) ErrorOption {
+	switch v.ExpectedType.String() {
+	case "Int", "Int!":
+		if _, err := strconv.ParseInt(v.Raw, 10, 32); err != nil && errors.Is(err, strconv.ErrRange) {
+			return Message(`Int cannot represent non 32-bit signed integer value: %s`, v.String())
+		}
+		return Message(`Int cannot represent non-integer value: %s`, v.String())
+	case "String", "String!", "[String]":
+		return Message(`String cannot represent a non string value: %s`, v.String())
+	case "Boolean", "Boolean!":
+		return Message(`Boolean cannot represent a non boolean value: %s`, v.String())
+	case "Float", "Float!":
+		return Message(`Float cannot represent non numeric value: %s`, v.String())
+	case "ID", "ID!":
+		return Message(`ID cannot represent a non-string and non-integer value: %s`, v.String())
+	//case "Enum":
+	//		return Message(`Enum "%s" cannot represent non-enum value: %s`, v.ExpectedType.String(), v.String())
+	default:
+		if v.Definition.Kind == ast.Enum {
+			return Message(`Enum "%s" cannot represent non-enum value: %s.`, v.ExpectedType.String(), v.String())
+		}
+		return Message(`Expected value of type "%s", found %s.`, v.ExpectedType.String(), v.String())
+	}
+}
diff --git a/internal/gqlparser/validator/rules/variables_are_input_types.go b/internal/gqlparser/validator/rules/variables_are_input_types.go
new file mode 100644
index 0000000000..51cb77ca31
--- /dev/null
+++ b/internal/gqlparser/validator/rules/variables_are_input_types.go
@@ -0,0 +1,30 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("VariablesAreInputTypes", func(observers *Events, addError AddErrFunc) {
+		observers.OnOperation(func(walker *Walker, operation *ast.OperationDefinition) {
+			for _, def := range operation.VariableDefinitions {
+				if def.Definition == nil {
+					continue
+				}
+				if !def.Definition.IsInputType() {
+					addError(
+						Message(
+							`Variable "$%s" cannot be non-input type "%s".`,
+							def.Variable,
+							def.Type.String(),
+						),
+						At(def.Position),
+					)
+				}
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/rules/variables_in_allowed_position.go b/internal/gqlparser/validator/rules/variables_in_allowed_position.go
new file mode 100644
index 0000000000..08a8e18c09
--- /dev/null
+++ b/internal/gqlparser/validator/rules/variables_in_allowed_position.go
@@ -0,0 +1,40 @@
+package validator
+
+import (
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+
+	//nolint:revive // Validator rules each use dot imports for convenience.
+	. "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+)
+
+func init() {
+	AddRule("VariablesInAllowedPosition", func(observers *Events, addError AddErrFunc) {
+		observers.OnValue(func(walker *Walker, value *ast.Value) {
+			if value.Kind != ast.Variable || value.ExpectedType == nil || value.VariableDefinition == nil || walker.CurrentOperation == nil {
+				return
+			}
+
+			tmp := *value.ExpectedType
+
+			// todo: move me into walk
+			// If there is a default non nullable types can be null
+			if value.VariableDefinition.DefaultValue != nil && value.VariableDefinition.DefaultValue.Kind != ast.NullValue {
+				if value.ExpectedType.NonNull {
+					tmp.NonNull = false
+				}
+			}
+
+			if !value.VariableDefinition.Type.IsCompatible(&tmp) {
+				addError(
+					Message(
+						`Variable "%s" of type "%s" used in position expecting type "%s".`,
+						value,
+						value.VariableDefinition.Type.String(),
+						value.ExpectedType.String(),
+					),
+					At(value.Position),
+				)
+			}
+		})
+	})
+}
diff --git a/internal/gqlparser/validator/schema.go b/internal/gqlparser/validator/schema.go
new file mode 100644
index 0000000000..c9c542195d
--- /dev/null
+++ b/internal/gqlparser/validator/schema.go
@@ -0,0 +1,513 @@
+package validator
+
+import (
+	"sort"
+	"strconv"
+	"strings"
+
+	//nolint:revive
+	. "github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+	"github.com/open-policy-agent/opa/internal/gqlparser/parser"
+)
+
+func LoadSchema(inputs ...*Source) (*Schema, error) {
+	ast, err := parser.ParseSchemas(inputs...)
+	if err != nil {
+		return nil, err
+	}
+	return ValidateSchemaDocument(ast)
+}
+
+func ValidateSchemaDocument(ast *SchemaDocument) (*Schema, error) {
+	schema := Schema{
+		Types:         map[string]*Definition{},
+		Directives:    map[string]*DirectiveDefinition{},
+		PossibleTypes: map[string][]*Definition{},
+		Implements:    map[string][]*Definition{},
+	}
+
+	for i, def := range ast.Definitions {
+		if schema.Types[def.Name] != nil {
+			return nil, gqlerror.ErrorPosf(def.Position, "Cannot redeclare type %s.", def.Name)
+		}
+		schema.Types[def.Name] = ast.Definitions[i]
+	}
+
+	defs := append(DefinitionList{}, ast.Definitions...)
+
+	for _, ext := range ast.Extensions {
+		def := schema.Types[ext.Name]
+		if def == nil {
+			schema.Types[ext.Name] = &Definition{
+				Kind:     ext.Kind,
+				Name:     ext.Name,
+				Position: ext.Position,
+			}
+			def = schema.Types[ext.Name]
+			defs = append(defs, def)
+		}
+
+		if def.Kind != ext.Kind {
+			return nil, gqlerror.ErrorPosf(ext.Position, "Cannot extend type %s because the base type is a %s, not %s.", ext.Name, def.Kind, ext.Kind)
+		}
+
+		def.Directives = append(def.Directives, ext.Directives...)
+		def.Interfaces = append(def.Interfaces, ext.Interfaces...)
+		def.Fields = append(def.Fields, ext.Fields...)
+		def.Types = append(def.Types, ext.Types...)
+		def.EnumValues = append(def.EnumValues, ext.EnumValues...)
+	}
+
+	for _, def := range defs {
+		switch def.Kind {
+		case Union:
+			for _, t := range def.Types {
+				schema.AddPossibleType(def.Name, schema.Types[t])
+				schema.AddImplements(t, def)
+			}
+		case InputObject, Object:
+			for _, intf := range def.Interfaces {
+				schema.AddPossibleType(intf, def)
+				schema.AddImplements(def.Name, schema.Types[intf])
+			}
+			schema.AddPossibleType(def.Name, def)
+		case Interface:
+			for _, intf := range def.Interfaces {
+				schema.AddPossibleType(intf, def)
+				schema.AddImplements(def.Name, schema.Types[intf])
+			}
+		}
+	}
+
+	for i, dir := range ast.Directives {
+		if schema.Directives[dir.Name] != nil {
+			// While the spec says SDL must not (§3.5) explicitly define builtin
+			// scalars, it may (§3.13) define builtin directives. Here we check for
+			// that, and reject doubly-defined directives otherwise.
+			switch dir.Name {
+			case "include", "skip", "deprecated", "specifiedBy": // the builtins
+				// In principle here we might want to validate that the
+				// directives are the same. But they might not be, if the
+				// server has an older spec than we do. (Plus, validating this
+				// is a lot of work.) So we just keep the first one we saw.
+				// That's an arbitrary choice, but in theory the only way it
+				// fails is if the server is using features newer than this
+				// version of gqlparser, in which case they're in trouble
+				// anyway.
+			default:
+				return nil, gqlerror.ErrorPosf(dir.Position, "Cannot redeclare directive %s.", dir.Name)
+			}
+		}
+		schema.Directives[dir.Name] = ast.Directives[i]
+	}
+
+	if len(ast.Schema) > 1 {
+		return nil, gqlerror.ErrorPosf(ast.Schema[1].Position, "Cannot have multiple schema entry points, consider schema extensions instead.")
+	}
+
+	if len(ast.Schema) == 1 {
+		schema.Description = ast.Schema[0].Description
+		for _, entrypoint := range ast.Schema[0].OperationTypes {
+			def := schema.Types[entrypoint.Type]
+			if def == nil {
+				return nil, gqlerror.ErrorPosf(entrypoint.Position, "Schema root %s refers to a type %s that does not exist.", entrypoint.Operation, entrypoint.Type)
+			}
+			switch entrypoint.Operation {
+			case Query:
+				schema.Query = def
+			case Mutation:
+				schema.Mutation = def
+			case Subscription:
+				schema.Subscription = def
+			}
+		}
+	}
+
+	for _, ext := range ast.SchemaExtension {
+		for _, entrypoint := range ext.OperationTypes {
+			def := schema.Types[entrypoint.Type]
+			if def == nil {
+				return nil, gqlerror.ErrorPosf(entrypoint.Position, "Schema root %s refers to a type %s that does not exist.", entrypoint.Operation, entrypoint.Type)
+			}
+			switch entrypoint.Operation {
+			case Query:
+				schema.Query = def
+			case Mutation:
+				schema.Mutation = def
+			case Subscription:
+				schema.Subscription = def
+			}
+		}
+	}
+
+	if err := validateTypeDefinitions(&schema); err != nil {
+		return nil, err
+	}
+
+	if err := validateDirectiveDefinitions(&schema); err != nil {
+		return nil, err
+	}
+
+	// Inferred root operation type names should be performed only when a `schema` directive is
+	// **not** provided, when it is, `Mutation` and `Subscription` becomes valid types and are not
+	// assigned as a root operation on the schema.
+	if len(ast.Schema) == 0 {
+		if schema.Query == nil && schema.Types["Query"] != nil {
+			schema.Query = schema.Types["Query"]
+		}
+
+		if schema.Mutation == nil && schema.Types["Mutation"] != nil {
+			schema.Mutation = schema.Types["Mutation"]
+		}
+
+		if schema.Subscription == nil && schema.Types["Subscription"] != nil {
+			schema.Subscription = schema.Types["Subscription"]
+		}
+	}
+
+	if schema.Query != nil {
+		schema.Query.Fields = append(
+			schema.Query.Fields,
+			&FieldDefinition{
+				Name: "__schema",
+				Type: NonNullNamedType("__Schema", nil),
+			},
+			&FieldDefinition{
+				Name: "__type",
+				Type: NamedType("__Type", nil),
+				Arguments: ArgumentDefinitionList{
+					{Name: "name", Type: NonNullNamedType("String", nil)},
+				},
+			},
+		)
+	}
+
+	return &schema, nil
+}
+
+func validateTypeDefinitions(schema *Schema) *gqlerror.Error {
+	types := make([]string, 0, len(schema.Types))
+	for typ := range schema.Types {
+		types = append(types, typ)
+	}
+	sort.Strings(types)
+	for _, typ := range types {
+		err := validateDefinition(schema, schema.Types[typ])
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateDirectiveDefinitions(schema *Schema) *gqlerror.Error {
+	directives := make([]string, 0, len(schema.Directives))
+	for directive := range schema.Directives {
+		directives = append(directives, directive)
+	}
+	sort.Strings(directives)
+	for _, directive := range directives {
+		err := validateDirective(schema, schema.Directives[directive])
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateDirective(schema *Schema, def *DirectiveDefinition) *gqlerror.Error {
+	if err := validateName(def.Position, def.Name); err != nil {
+		// now, GraphQL spec doesn't have reserved directive name
+		return err
+	}
+
+	return validateArgs(schema, def.Arguments, def)
+}
+
+func validateDefinition(schema *Schema, def *Definition) *gqlerror.Error {
+	for _, field := range def.Fields {
+		if err := validateName(field.Position, field.Name); err != nil {
+			// now, GraphQL spec doesn't have reserved field name
+			return err
+		}
+		if err := validateTypeRef(schema, field.Type); err != nil {
+			return err
+		}
+		if err := validateArgs(schema, field.Arguments, nil); err != nil {
+			return err
+		}
+		wantDirLocation := LocationFieldDefinition
+		if def.Kind == InputObject {
+			wantDirLocation = LocationInputFieldDefinition
+		}
+		if err := validateDirectives(schema, field.Directives, wantDirLocation, nil); err != nil {
+			return err
+		}
+	}
+
+	for _, typ := range def.Types {
+		typDef := schema.Types[typ]
+		if typDef == nil {
+			return gqlerror.ErrorPosf(def.Position, "Undefined type %s.", strconv.Quote(typ))
+		}
+		if !isValidKind(typDef.Kind, Object) {
+			return gqlerror.ErrorPosf(def.Position, "%s type %s must be %s.", def.Kind, strconv.Quote(typ), kindList(Object))
+		}
+	}
+
+	for _, intf := range def.Interfaces {
+		if err := validateImplements(schema, def, intf); err != nil {
+			return err
+		}
+	}
+
+	switch def.Kind {
+	case Object, Interface:
+		if len(def.Fields) == 0 {
+			return gqlerror.ErrorPosf(def.Position, "%s %s: must define one or more fields.", def.Kind, def.Name)
+		}
+		for _, field := range def.Fields {
+			if typ, ok := schema.Types[field.Type.Name()]; ok {
+				if !isValidKind(typ.Kind, Scalar, Object, Interface, Union, Enum) {
+					return gqlerror.ErrorPosf(field.Position, "%s %s: field must be one of %s.", def.Kind, def.Name, kindList(Scalar, Object, Interface, Union, Enum))
+				}
+			}
+		}
+	case Enum:
+		if len(def.EnumValues) == 0 {
+			return gqlerror.ErrorPosf(def.Position, "%s %s: must define one or more unique enum values.", def.Kind, def.Name)
+		}
+		for _, value := range def.EnumValues {
+			for _, nonEnum := range [3]string{"true", "false", "null"} {
+				if value.Name == nonEnum {
+					return gqlerror.ErrorPosf(def.Position, "%s %s: non-enum value %s.", def.Kind, def.Name, value.Name)
+				}
+			}
+		}
+	case InputObject:
+		if len(def.Fields) == 0 {
+			return gqlerror.ErrorPosf(def.Position, "%s %s: must define one or more input fields.", def.Kind, def.Name)
+		}
+		for _, field := range def.Fields {
+			if typ, ok := schema.Types[field.Type.Name()]; ok {
+				if !isValidKind(typ.Kind, Scalar, Enum, InputObject) {
+					return gqlerror.ErrorPosf(field.Position, "%s %s: field must be one of %s.", typ.Kind, field.Name, kindList(Scalar, Enum, InputObject))
+				}
+			}
+		}
+	}
+
+	for idx, field1 := range def.Fields {
+		for _, field2 := range def.Fields[idx+1:] {
+			if field1.Name == field2.Name {
+				return gqlerror.ErrorPosf(field2.Position, "Field %s.%s can only be defined once.", def.Name, field2.Name)
+			}
+		}
+	}
+
+	if !def.BuiltIn {
+		// GraphQL spec has reserved type names a lot!
+		err := validateName(def.Position, def.Name)
+		if err != nil {
+			return err
+		}
+	}
+
+	return validateDirectives(schema, def.Directives, DirectiveLocation(def.Kind), nil)
+}
+
+func validateTypeRef(schema *Schema, typ *Type) *gqlerror.Error {
+	if schema.Types[typ.Name()] == nil {
+		return gqlerror.ErrorPosf(typ.Position, "Undefined type %s.", typ.Name())
+	}
+	return nil
+}
+
+func validateArgs(schema *Schema, args ArgumentDefinitionList, currentDirective *DirectiveDefinition) *gqlerror.Error {
+	for _, arg := range args {
+		if err := validateName(arg.Position, arg.Name); err != nil {
+			// now, GraphQL spec doesn't have reserved argument name
+			return err
+		}
+		if err := validateTypeRef(schema, arg.Type); err != nil {
+			return err
+		}
+		def := schema.Types[arg.Type.Name()]
+		if !def.IsInputType() {
+			return gqlerror.ErrorPosf(
+				arg.Position,
+				"cannot use %s as argument %s because %s is not a valid input type",
+				arg.Type.String(),
+				arg.Name,
+				def.Kind,
+			)
+		}
+		if err := validateDirectives(schema, arg.Directives, LocationArgumentDefinition, currentDirective); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateDirectives(schema *Schema, dirs DirectiveList, location DirectiveLocation, currentDirective *DirectiveDefinition) *gqlerror.Error {
+	for _, dir := range dirs {
+		if err := validateName(dir.Position, dir.Name); err != nil {
+			// now, GraphQL spec doesn't have reserved directive name
+			return err
+		}
+		if currentDirective != nil && dir.Name == currentDirective.Name {
+			return gqlerror.ErrorPosf(dir.Position, "Directive %s cannot refer to itself.", currentDirective.Name)
+		}
+		if schema.Directives[dir.Name] == nil {
+			return gqlerror.ErrorPosf(dir.Position, "Undefined directive %s.", dir.Name)
+		}
+		validKind := false
+		for _, dirLocation := range schema.Directives[dir.Name].Locations {
+			if dirLocation == location {
+				validKind = true
+				break
+			}
+		}
+		if !validKind {
+			return gqlerror.ErrorPosf(dir.Position, "Directive %s is not applicable on %s.", dir.Name, location)
+		}
+		dir.Definition = schema.Directives[dir.Name]
+	}
+	return nil
+}
+
+func validateImplements(schema *Schema, def *Definition, intfName string) *gqlerror.Error {
+	// see validation rules at the bottom of
+	// https://facebook.github.io/graphql/October2021/#sec-Objects
+	intf := schema.Types[intfName]
+	if intf == nil {
+		return gqlerror.ErrorPosf(def.Position, "Undefined type %s.", strconv.Quote(intfName))
+	}
+	if intf.Kind != Interface {
+		return gqlerror.ErrorPosf(def.Position, "%s is a non interface type %s.", strconv.Quote(intfName), intf.Kind)
+	}
+	for _, requiredField := range intf.Fields {
+		foundField := def.Fields.ForName(requiredField.Name)
+		if foundField == nil {
+			return gqlerror.ErrorPosf(def.Position,
+				`For %s to implement %s it must have a field called %s.`,
+				def.Name, intf.Name, requiredField.Name,
+			)
+		}
+
+		if !isCovariant(schema, requiredField.Type, foundField.Type) {
+			return gqlerror.ErrorPosf(foundField.Position,
+				`For %s to implement %s the field %s must have type %s.`,
+				def.Name, intf.Name, requiredField.Name, requiredField.Type.String(),
+			)
+		}
+
+		for _, requiredArg := range requiredField.Arguments {
+			foundArg := foundField.Arguments.ForName(requiredArg.Name)
+			if foundArg == nil {
+				return gqlerror.ErrorPosf(foundField.Position,
+					`For %s to implement %s the field %s must have the same arguments but it is missing %s.`,
+					def.Name, intf.Name, requiredField.Name, requiredArg.Name,
+				)
+			}
+
+			if !requiredArg.Type.IsCompatible(foundArg.Type) {
+				return gqlerror.ErrorPosf(foundArg.Position,
+					`For %s to implement %s the field %s must have the same arguments but %s has the wrong type.`,
+					def.Name, intf.Name, requiredField.Name, requiredArg.Name,
+				)
+			}
+		}
+		for _, foundArgs := range foundField.Arguments {
+			if requiredField.Arguments.ForName(foundArgs.Name) == nil && foundArgs.Type.NonNull && foundArgs.DefaultValue == nil {
+				return gqlerror.ErrorPosf(foundArgs.Position,
+					`For %s to implement %s any additional arguments on %s must be optional or have a default value but %s is required.`,
+					def.Name, intf.Name, foundField.Name, foundArgs.Name,
+				)
+			}
+		}
+	}
+	return validateTypeImplementsAncestors(schema, def, intfName)
+}
+
+// validateTypeImplementsAncestors
+// https://github.com/graphql/graphql-js/blob/47bd8c8897c72d3efc17ecb1599a95cee6bac5e8/src/type/validate.ts#L428
+func validateTypeImplementsAncestors(schema *Schema, def *Definition, intfName string) *gqlerror.Error {
+	intf := schema.Types[intfName]
+	if intf == nil {
+		return gqlerror.ErrorPosf(def.Position, "Undefined type %s.", strconv.Quote(intfName))
+	}
+	for _, transitive := range intf.Interfaces {
+		if !containsString(def.Interfaces, transitive) {
+			if transitive == def.Name {
+				return gqlerror.ErrorPosf(def.Position,
+					`Type %s cannot implement %s because it would create a circular reference.`,
+					def.Name, intfName,
+				)
+			}
+			return gqlerror.ErrorPosf(def.Position,
+				`Type %s must implement %s because it is implemented by %s.`,
+				def.Name, transitive, intfName,
+			)
+		}
+	}
+	return nil
+}
+
+func containsString(slice []string, want string) bool {
+	for _, str := range slice {
+		if want == str {
+			return true
+		}
+	}
+	return false
+}
+
+func isCovariant(schema *Schema, required *Type, actual *Type) bool {
+	if required.NonNull && !actual.NonNull {
+		return false
+	}
+
+	if required.NamedType != "" {
+		if required.NamedType == actual.NamedType {
+			return true
+		}
+		for _, pt := range schema.PossibleTypes[required.NamedType] {
+			if pt.Name == actual.NamedType {
+				return true
+			}
+		}
+		return false
+	}
+
+	if required.Elem != nil && actual.Elem == nil {
+		return false
+	}
+
+	return isCovariant(schema, required.Elem, actual.Elem)
+}
+
+func validateName(pos *Position, name string) *gqlerror.Error {
+	if strings.HasPrefix(name, "__") {
+		return gqlerror.ErrorPosf(pos, `Name "%s" must not begin with "__", which is reserved by GraphQL introspection.`, name)
+	}
+	return nil
+}
+
+func isValidKind(kind DefinitionKind, valid ...DefinitionKind) bool {
+	for _, k := range valid {
+		if kind == k {
+			return true
+		}
+	}
+	return false
+}
+
+func kindList(kinds ...DefinitionKind) string {
+	s := make([]string, len(kinds))
+	for i, k := range kinds {
+		s[i] = string(k)
+	}
+	return strings.Join(s, ", ")
+}
diff --git a/internal/gqlparser/validator/schema_test.yml b/internal/gqlparser/validator/schema_test.yml
new file mode 100644
index 0000000000..7034a4697c
--- /dev/null
+++ b/internal/gqlparser/validator/schema_test.yml
@@ -0,0 +1,678 @@
+types:
+  - name: cannot be redeclared
+    input: |
+      type A {
+        name: String
+      }
+      type A {
+        name: String
+      }
+    error:
+      message: "Cannot redeclare type A."
+      locations: [{line: 4, column: 6}]
+  - name: cannot be duplicated field at same definition 1
+    input: |
+      type A {
+        name: String
+        name: String
+      }
+    error:
+      message: "Field A.name can only be defined once."
+      locations: [{line: 3, column: 3}]
+  - name: cannot be duplicated field at same definition 2
+    input: |
+      type A {
+        name: String
+      }
+      extend type A {
+        name: String
+      }
+    error:
+      message: "Field A.name can only be defined once."
+      locations: [{line: 5, column: 3}]
+  - name: cannot be duplicated field at same definition 3
+    input: |
+      type A {
+        name: String
+      }
+      extend type A {
+        age: Int
+        age: Int
+      }
+    error:
+      message: "Field A.age can only be defined once."
+      locations: [{line: 6, column: 3}]
+
+object types:
+  - name: must define one or more fields
+    input: |
+      directive @D on OBJECT
+
+      # This pattern rejected by parser
+      # type InvalidObject1 {}
+
+      type InvalidObject2 @D
+
+      type ValidObject {
+        id: ID
+      }
+      extend type ValidObject @D
+      extend type ValidObject {
+        b: Int
+      }
+    error:
+      message: 'OBJECT InvalidObject2: must define one or more fields.'
+      locations: [{line: 6, column: 6}]
+  - name: check reserved names on type name
+    input: |
+      type __FooBar {
+        id: ID
+      }
+    error:
+      message: 'Name "__FooBar" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 1, column: 6}]
+  - name: check reserved names on type field
+    input: |
+      type FooBar {
+        __id: ID
+      }
+    error:
+      message: 'Name "__id" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 2, column: 3}]
+
+  - name: check reserved names on type field argument
+    input: |
+      type FooBar {
+        foo(__bar: ID): ID
+      }
+    error:
+      message: 'Name "__bar" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 2, column: 7}]
+
+  - name: must not allow input object as field type
+    input: |
+      input Input {
+        id: ID
+      }
+      type Query {
+        input: Input!
+      }
+    error:
+      message: 'OBJECT Query: field must be one of SCALAR, OBJECT, INTERFACE, UNION, ENUM.'
+      locations: [{line: 5, column: 3}]
+
+interfaces:
+  - name: must exist
+    input: |
+      type Thing implements Object {
+        id: ID!
+      }
+
+      type Query {
+        Things: [Thing!]!
+      }
+    error:
+      message: 'Undefined type "Object".'
+      locations: [{line: 1, column: 6}]
+
+  - name: must be an interface
+    input: |
+      type Thing implements Object {
+        id: ID!
+      }
+
+      type Query {
+        Things: [Thing!]!
+      }
+
+      type Object {
+        name: String
+      }
+    error:
+      message: '"Object" is a non interface type OBJECT.'
+      locations: [{line: 1, column: 6}]
+
+  - name: must define one or more fields
+    input: |
+      directive @D on INTERFACE
+
+      # This pattern rejected by parser
+      # interface InvalidInterface1 {}
+
+      interface InvalidInterface2 @D
+
+      interface ValidInterface {
+        id: ID
+      }
+      extend interface ValidInterface @D
+      extend interface ValidInterface {
+        b: Int
+      }
+    error:
+      message: 'INTERFACE InvalidInterface2: must define one or more fields.'
+      locations: [{line: 6, column: 11}]
+
+  - name: check reserved names on type name
+    input: |
+      interface __FooBar {
+        id: ID
+      }
+    error:
+      message: 'Name "__FooBar" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 1, column: 11}]
+
+  - name: must not allow input object as field type
+    input: |
+      input Input {
+        id: ID
+      }
+      type Query {
+        foo: Foo!
+      }
+      interface Foo {
+        input: Input!
+      }
+    error:
+      message: 'INTERFACE Foo: field must be one of SCALAR, OBJECT, INTERFACE, UNION, ENUM.'
+      locations: [{line: 8, column: 3}]
+
+  - name: must have all fields from interface
+    input: |
+      type Bar implements BarInterface {
+          someField: Int!
+      }
+
+      interface BarInterface {
+          id: ID!
+      }
+    error:
+      message: 'For Bar to implement BarInterface it must have a field called id.'
+      locations: [{line: 1, column: 6}]
+
+  - name: must have same type of fields
+    input: |
+      type Bar implements BarInterface {
+          id: Int!
+      }
+
+      interface BarInterface {
+          id: ID!
+      }
+    error:
+      message: 'For Bar to implement BarInterface the field id must have type ID!.'
+      locations: [{line: 2, column: 5}]
+
+  - name: must have all required arguments
+    input: |
+      type Bar implements BarInterface {
+          id: ID!
+      }
+
+      interface BarInterface {
+          id(ff: Int!): ID!
+      }
+    error:
+      message: 'For Bar to implement BarInterface the field id must have the same arguments but it is missing ff.'
+      locations: [{line: 2, column: 5}]
+
+  - name: must have same argument types
+    input: |
+      type Bar implements BarInterface {
+          id(ff: ID!): ID!
+      }
+
+      interface BarInterface {
+          id(ff: Int!): ID!
+      }
+    error:
+      message: 'For Bar to implement BarInterface the field id must have the same arguments but ff has the wrong type.'
+      locations: [{line: 2, column: 8}]
+
+  - name: may defined additional nullable arguments
+    input: |
+      type Bar implements BarInterface {
+          id(opt: Int): ID!
+      }
+
+      interface BarInterface {
+          id: ID!
+      }
+
+  - name: may defined additional required arguments with defaults
+    input: |
+      type Bar implements BarInterface {
+          id(opt: Int! = 1): ID!
+      }
+
+      interface BarInterface {
+          id: ID!
+      }
+
+  - name: must not define additional required arguments without defaults
+    input: |
+      type Bar implements BarInterface {
+          id(opt: Int!): ID!
+      }
+
+      interface BarInterface {
+          id: ID!
+      }
+    error:
+      message: 'For Bar to implement BarInterface any additional arguments on id must be optional or have a default value but opt is required.'
+      locations: [{line: 2, column: 8}]
+
+  - name: can have covariant argument types
+    input: |
+      union U = A|B
+
+      type A { name: String }
+      type B { name: String }
+
+      type Bar implements BarInterface {
+          f: A!
+      }
+
+      interface BarInterface {
+          f: U!
+      }
+
+  - name: may define intermediate interfaces
+    input: |
+      interface IA {
+          id: ID!
+      }
+
+      interface IIA implements IA {
+          id: ID!
+      }
+
+      type A implements IIA & IA {
+          id: ID!
+      }
+
+  - name: Type Foo must implement Baz because it is implemented by Bar
+    input: |
+      interface Baz {
+          baz: String
+      }
+
+      interface Bar implements Baz {
+          bar: String
+          baz: String
+      }
+
+      type Foo implements Bar {
+          foo: String
+          bar: String
+          baz: String
+      }
+    error:
+      message: 'Type Foo must implement Baz because it is implemented by Bar.'
+      locations: [{line: 10, column: 6}]
+
+  - name: circular reference error
+    input: |
+      interface Circular1 implements Circular2 {
+        id: ID!
+      }
+
+      interface Circular2 implements Circular1 {
+        id: ID!
+      }
+    error:
+      message: 'Type Circular1 cannot implement Circular2 because it would create a circular reference.'
+      locations: [{line: 1, column: 11}]
+
+inputs:
+  - name: must define one or more input fields
+    input: |
+      directive @D on INPUT_OBJECT
+
+      # This pattern rejected by parser
+      # input InvalidInput1 {}
+
+      input InvalidInput2 @D
+
+      input ValidInput {
+        id: ID
+      }
+      extend input ValidInput @D
+      extend input ValidInput {
+        b: Int
+      }
+    error:
+      message: 'INPUT_OBJECT InvalidInput2: must define one or more input fields.'
+      locations: [{line: 6, column: 7}]
+  - name: check reserved names on type name
+    input: |
+      input __FooBar {
+        id: ID
+      }
+    error:
+      message: 'Name "__FooBar" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 1, column: 7}]
+
+  - name: fields cannot be Objects
+    input: |
+      type Object { id: ID }
+      input Foo { a: Object! }
+    error:
+      message: 'OBJECT a: field must be one of SCALAR, ENUM, INPUT_OBJECT.'
+      locations: [{line: 2, column: 13}]
+
+  - name: fields cannot be Interfaces
+    input: |
+      interface Interface { id: ID! }
+      input Foo { a: Interface! }
+    error:
+      message: 'INTERFACE a: field must be one of SCALAR, ENUM, INPUT_OBJECT.'
+      locations: [{line: 2, column: 13}]
+
+  - name: fields cannot be Unions
+    input: |
+      type Object { id: ID }
+      union Union = Object
+      input Foo { a: Union! }
+    error:
+      message: 'UNION a: field must be one of SCALAR, ENUM, INPUT_OBJECT.'
+      locations: [{line: 3, column: 13}]
+
+args:
+  - name: Valid arg types
+    input: |
+        input Input { id: ID }
+        enum Enum { A }
+        scalar Scalar
+
+        type Query {
+          f(a: Input, b: Scalar, c: Enum): Boolean!
+        }
+
+  - name: Objects not allowed
+    input: |
+      type Object { id: ID }
+      type Query { f(a: Object): Boolean! }
+
+    error:
+      message: 'cannot use Object as argument a because OBJECT is not a valid input type'
+      locations: [{line: 2, column: 16}]
+
+  - name: Union not allowed
+    input: |
+      type Object { id: ID }
+      union Union = Object
+      type Query { f(a: Union): Boolean! }
+
+    error:
+      message: 'cannot use Union as argument a because UNION is not a valid input type'
+      locations: [{line: 3, column: 16}]
+
+  - name: Interface not allowed
+    input: |
+      interface Interface { id: ID }
+      type Query { f(a: Interface): Boolean! }
+
+    error:
+      message: 'cannot use Interface as argument a because INTERFACE is not a valid input type'
+      locations: [{line: 2, column: 16}]
+
+enums:
+  - name: must define one or more unique enum values
+    input: |
+      directive @D on ENUM
+
+      # This pattern rejected by parser
+      # enum InvalidEmum1 {}
+
+      enum InvalidEnum2 @D
+
+      enum ValidEnum {
+        FOO
+      }
+      extend enum ValidEnum @D
+      extend enum ValidEnum {
+        BAR
+      }
+    error:
+      message: 'ENUM InvalidEnum2: must define one or more unique enum values.'
+      locations: [{line: 6, column: 6}]
+  - name: check reserved names on type name
+    input: |
+      enum __FooBar {
+        A
+        B
+      }
+    error:
+      message: 'Name "__FooBar" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 1, column: 6}]
+
+unions:
+  - name: union types must be defined
+    input: |
+      union Foo = Bar | Baz
+      type Bar {
+        id: ID
+      }
+    error:
+      message: "Undefined type \"Baz\"."
+      locations: [{line: 1, column: 7}]
+  - name: union types must be objects
+    input: |
+      union Foo = Baz
+      interface Baz {
+        id: ID
+      }
+    error:
+      message: "UNION type \"Baz\" must be OBJECT."
+      locations: [{line: 1, column: 7}]
+
+  - name: unions of pure type extensions are valid
+    input: |
+
+      type Review {
+          body: String!
+          author: User! @provides(fields: "username")
+          product: Product!
+      }
+
+      extend type User @key(fields: "id") {
+        id: ID! @external
+        reviews: [Review]
+      }
+
+      extend type Product @key(fields: "upc") {
+        upc: String! @external
+        reviews: [Review]
+      }
+
+      union Foo = User | Product
+      scalar _Any
+      scalar _FieldSet
+      directive @external on FIELD_DEFINITION
+      directive @requires(fields: _FieldSet!) on FIELD_DEFINITION
+      directive @provides(fields: _FieldSet!) on FIELD_DEFINITION
+      directive @key(fields: _FieldSet!) on OBJECT | INTERFACE
+      directive @extends on OBJECT
+
+
+
+type extensions:
+  - name: can extend non existant types
+    input: |
+      extend type A {
+        name: String
+      }
+
+
+  - name: cannot extend incorret type existant types
+    input: |
+      scalar A
+      extend type A {
+        name: String
+      }
+    error:
+      message: "Cannot extend type A because the base type is a SCALAR, not OBJECT."
+      locations: [{line: 2, column: 13}]
+
+directives:
+  - name: cannot redeclare directives
+    input: |
+      directive @A on FIELD_DEFINITION
+      directive @A on FIELD_DEFINITION
+    error:
+      message: "Cannot redeclare directive A."
+      locations: [{line: 2, column: 12}]
+
+  - name: can redeclare builtin directives
+    input: |
+      directive @skip(if: Boolean!) on FIELD | FRAGMENT_SPREAD | INLINE_FRAGMENT
+      directive @skip(if: Boolean!) on FIELD | FRAGMENT_SPREAD | INLINE_FRAGMENT
+
+  - name: must be declared
+    input: |
+      type User {
+        name: String @foo
+      }
+    error:
+      message: "Undefined directive foo."
+      locations: [{line: 2, column: 17}]
+
+  - name: cannot be self-referential
+    input: |
+      directive @A(foo: Int! @A) on FIELD_DEFINITION
+    error:
+      message: "Directive A cannot refer to itself."
+      locations: [{line: 1, column: 25}]
+  - name: check reserved names on type name
+    input: |
+      directive @__A on FIELD_DEFINITION
+    error:
+      message: 'Name "__A" must not begin with "__", which is reserved by GraphQL introspection.'
+      locations: [{line: 1, column: 12}]
+
+  - name: Valid arg types
+    input: |
+      input Input { id: ID }
+      enum Enum { A }
+      scalar Scalar
+
+      directive @A(a: Input, b: Scalar, c: Enum) on FIELD_DEFINITION
+
+  - name: Objects not allowed
+    input: |
+      type Object { id: ID }
+      directive @A(a: Object) on FIELD_DEFINITION
+
+    error:
+      message: 'cannot use Object as argument a because OBJECT is not a valid input type'
+      locations: [{line: 2, column: 14}]
+
+  - name: Union not allowed
+    input: |
+      type Object { id: ID }
+      union Union = Object
+      directive @A(a: Union) on FIELD_DEFINITION
+
+    error:
+      message: 'cannot use Union as argument a because UNION is not a valid input type'
+      locations: [{line: 3, column: 14}]
+
+  - name: Interface not allowed
+    input: |
+      interface Interface { id: ID }
+      directive @A(a: Interface) on FIELD_DEFINITION
+
+    error:
+      message: 'cannot use Interface as argument a because INTERFACE is not a valid input type'
+      locations: [{line: 2, column: 14}]
+
+  - name: Invalid location usage not allowed
+    input: |
+      directive @test on FIELD_DEFINITION
+      input I1 @test { f: String }
+
+    error:
+      message: 'Directive test is not applicable on INPUT_OBJECT.'
+      locations: [{line: 2, column: 11}]
+
+  - name: Valid location usage
+    input: |
+      directive @testInputField on INPUT_FIELD_DEFINITION
+      directive @testField on FIELD_DEFINITION
+      directive @inp on INPUT_OBJECT
+      input I1 @inp { f: String @testInputField }
+      type P { name: String @testField }
+      interface I { id: ID @testField }
+
+
+entry points:
+  - name: multiple schema entry points
+    input: |
+      schema {
+        query: Query
+      }
+      schema {
+        query: Query
+      }
+      scalar Query
+    error:
+      message: "Cannot have multiple schema entry points, consider schema extensions instead."
+      locations: [{line: 4, column: 8}]
+
+  - name: Undefined schema entrypoint
+    input: |
+      schema {
+        query: Query
+      }
+    error:
+      message: "Schema root query refers to a type Query that does not exist."
+      locations: [{line: 2, column: 3}]
+
+entry point extensions:
+  - name: Undefined schema entrypoint
+    input: |
+      schema {
+        query: Query
+      }
+      scalar Query
+      extend schema {
+        mutation: Mutation
+      }
+    error:
+      message: "Schema root mutation refers to a type Mutation that does not exist."
+      locations: [{line: 6, column: 3}]
+
+type references:
+  - name: Field types
+    input: |
+      type User {
+        posts: Post
+      }
+    error:
+      message: "Undefined type Post."
+      locations: [{line: 2, column: 10}]
+
+  - name: Arg types
+    input: |
+      type User {
+        posts(foo: FooBar): String
+      }
+    error:
+      message: "Undefined type FooBar."
+      locations: [{line: 2, column: 14}]
+
+  - name: Directive arg types
+    input: |
+      directive @Foo(foo: FooBar) on FIELD_DEFINITION
+
+    error:
+      message: "Undefined type FooBar."
+      locations: [{line: 1, column: 21}]
+
+  - name: Invalid enum value
+    input: |
+      enum Enum { true }
+
+    error:
+      message: "ENUM Enum: non-enum value true."
+      locations: [{line: 1, column: 6}]
diff --git a/internal/gqlparser/validator/spec/FragmentsOnCompositeTypes.spec.yml b/internal/gqlparser/validator/spec/FragmentsOnCompositeTypes.spec.yml
new file mode 100644
index 0000000000..ec8ad0be34
--- /dev/null
+++ b/internal/gqlparser/validator/spec/FragmentsOnCompositeTypes.spec.yml
@@ -0,0 +1,9 @@
+- name: Undefined type assertions
+  schema: 0
+  query: |
+    fragment c on Float
+    {...c}
+
+  errors:
+    - message: Fragment "c" cannot condition on non composite type "Float".
+    - message: Cannot spread fragment "c" within itself.
diff --git a/internal/gqlparser/validator/spec/Fuzz.spec.yml b/internal/gqlparser/validator/spec/Fuzz.spec.yml
new file mode 100644
index 0000000000..80c6851dd0
--- /dev/null
+++ b/internal/gqlparser/validator/spec/Fuzz.spec.yml
@@ -0,0 +1,34 @@
+- name: 01
+  schema: 0
+  query: '{r{__typename(s:0)}}'
+  errors:
+    - message: Cannot query field "r" on type "QueryRoot".
+
+- name: 02 - infinit loop occured in OverlappingFieldsCanBeMerged rule
+  schema: |
+    type Query {
+      fieldA: A
+    }
+    type A {
+      s: String
+    }
+  query: |
+    { ...F }
+    fragment F on Query {
+      fieldA { s }
+      ...{
+        ...{
+          ...F
+        }
+        fieldA {
+          ...notExists
+        }
+      }
+    }
+  errors:
+    # from KnownFragmentNames rule
+    - message: Unknown fragment "notExists".
+    - message: Unknown fragment "notExists".
+    - message: Unknown fragment "notExists".
+    # from NoFragmentCycles rule
+    - message: Cannot spread fragment "F" within itself.
diff --git a/internal/gqlparser/validator/spec/KnownRootTypeRule.spec.yml b/internal/gqlparser/validator/spec/KnownRootTypeRule.spec.yml
new file mode 100644
index 0000000000..651e6582b1
--- /dev/null
+++ b/internal/gqlparser/validator/spec/KnownRootTypeRule.spec.yml
@@ -0,0 +1,19 @@
+- name: Known root type
+  rule: KnownRootType
+  schema: 0
+  query: |
+    query { dog { name } }
+- name: Valid root type but not in schema
+  rule: KnownRootType
+  schema: 0
+  query: |
+    mutation { dog { name } }
+  errors:
+    - message: Schema does not support operation type "mutation"
+- name: Valid root type but schema is entirely empty
+  rule: KnownRootType
+  schema: 20
+  query: |
+    { dog { name } }
+  errors:
+    - message: Schema does not support operation type "query"
diff --git a/internal/gqlparser/validator/spec/NonExistantTypes.spec.yml b/internal/gqlparser/validator/spec/NonExistantTypes.spec.yml
new file mode 100644
index 0000000000..a9778b6195
--- /dev/null
+++ b/internal/gqlparser/validator/spec/NonExistantTypes.spec.yml
@@ -0,0 +1,20 @@
+- name: Undefined type assertions
+  schema: 0
+  query: |
+    query panic{
+      panic{
+        ...PanicInput
+        __typename
+      }
+    }
+    fragment PanicInput on Panic {
+      __typename
+    }
+
+  errors:
+    - message: Unknown type "Panic". Did you mean "Canine"?
+      locations:
+      - {line: 7, column: 7}
+    - message: Cannot query field "panic" on type "QueryRoot".
+      locations:
+      - {line: 2, column: 14}
diff --git a/internal/gqlparser/validator/suggestionList.go b/internal/gqlparser/validator/suggestionList.go
new file mode 100644
index 0000000000..f0bbc32786
--- /dev/null
+++ b/internal/gqlparser/validator/suggestionList.go
@@ -0,0 +1,69 @@
+package validator
+
+import (
+	"math"
+	"sort"
+	"strings"
+
+	"github.com/agnivade/levenshtein"
+)
+
+// Given an invalid input string and a list of valid options, returns a filtered
+// list of valid options sorted based on their similarity with the input.
+func SuggestionList(input string, options []string) []string {
+	var results []string
+	optionsByDistance := map[string]int{}
+
+	for _, option := range options {
+		distance := lexicalDistance(input, option)
+		threshold := calcThreshold(input)
+		if distance <= threshold {
+			results = append(results, option)
+			optionsByDistance[option] = distance
+		}
+	}
+
+	sort.Slice(results, func(i, j int) bool {
+		return optionsByDistance[results[i]] < optionsByDistance[results[j]]
+	})
+	return results
+}
+
+func calcThreshold(a string) (threshold int) {
+	// the logic is copied from here
+	// https://github.com/graphql/graphql-js/blob/47bd8c8897c72d3efc17ecb1599a95cee6bac5e8/src/jsutils/suggestionList.ts#L14
+	threshold = int(math.Floor(float64(len(a))*0.4) + 1)
+
+	if threshold < 1 {
+		threshold = 1
+	}
+	return
+}
+
+// Computes the lexical distance between strings A and B.
+//
+// The "distance" between two strings is given by counting the minimum number
+// of edits needed to transform string A into string B. An edit can be an
+// insertion, deletion, or substitution of a single character, or a swap of two
+// adjacent characters.
+//
+// Includes a custom alteration from Damerau-Levenshtein to treat case changes
+// as a single edit which helps identify mis-cased values with an edit distance
+// of 1.
+//
+// This distance can be useful for detecting typos in input or sorting
+func lexicalDistance(a, b string) int {
+	if a == b {
+		return 0
+	}
+
+	a = strings.ToLower(a)
+	b = strings.ToLower(b)
+
+	// Any case change counts as a single edit
+	if a == b {
+		return 1
+	}
+
+	return levenshtein.ComputeDistance(a, b)
+}
diff --git a/internal/gqlparser/validator/testdata/default_root_operation_type_names.graphql b/internal/gqlparser/validator/testdata/default_root_operation_type_names.graphql
new file mode 100644
index 0000000000..1e4cf6c8fc
--- /dev/null
+++ b/internal/gqlparser/validator/testdata/default_root_operation_type_names.graphql
@@ -0,0 +1,16 @@
+schema {
+    query: Query
+}
+
+type Query {
+    mutation: Mutation!
+    subscription: Subscription!
+}
+
+type Mutation {
+    name: String!
+}
+
+type Subscription {
+    name: String!
+}
diff --git a/internal/gqlparser/validator/testdata/extensions.graphql b/internal/gqlparser/validator/testdata/extensions.graphql
new file mode 100644
index 0000000000..ab7537039b
--- /dev/null
+++ b/internal/gqlparser/validator/testdata/extensions.graphql
@@ -0,0 +1,31 @@
+schema {
+    query: Query
+}
+
+extend schema {
+    subscription: Subscription
+}
+
+type Query {
+    dogs: [Dog!]!
+}
+
+type Subscription {
+    dogEvents: [Dog!]!
+}
+
+type Dog {
+    name: String!
+}
+
+type Person @favorite(name: "sushi") @favorite(name: "tempura") {
+    name: String!
+}
+
+directive @favorite(name: String!) repeatable on OBJECT
+
+extend type Dog {
+    owner: Person! @permission(permission: "admin")
+}
+
+directive @permission(permission: String!) on FIELD_DEFINITION
diff --git a/internal/gqlparser/validator/testdata/interfaces.graphql b/internal/gqlparser/validator/testdata/interfaces.graphql
new file mode 100644
index 0000000000..1555188b55
--- /dev/null
+++ b/internal/gqlparser/validator/testdata/interfaces.graphql
@@ -0,0 +1,14 @@
+interface Mammal {
+  mother: Mammal
+  father: Mammal
+}
+
+interface Pet {
+  name(surname: Boolean): String
+}
+
+interface Canine implements Mammal {
+  name(surname: Boolean): String
+  mother: Canine
+  father: Canine
+}
\ No newline at end of file
diff --git a/internal/gqlparser/validator/testdata/swapi.graphql b/internal/gqlparser/validator/testdata/swapi.graphql
new file mode 100644
index 0000000000..38422b7f71
--- /dev/null
+++ b/internal/gqlparser/validator/testdata/swapi.graphql
@@ -0,0 +1,147 @@
+schema {
+    query: Query
+    mutation: Mutation
+    subscription: Subscription
+}
+
+# The query type, represents all of the entry points into our object graph
+type Query {
+    hero(episode: Episode): Character
+    reviews(episode: Episode!): [Review]
+    search(text: String): [SearchResult]
+    character(id: ID!): Character
+    droid(id: ID!): Droid
+    human(id: ID!): Human
+    starship(id: ID!): Starship
+}
+# The mutation type, represents all updates we can make to our data
+type Mutation {
+    createReview(episode: Episode, review: ReviewInput!): Review
+}
+# The subscription type, represents all subscriptions we can make to our data
+type Subscription {
+    reviewAdded(episode: Episode): Review
+}
+# The episodes in the Star Wars trilogy
+enum Episode {
+    # Star Wars Episode IV: A New Hope, released in 1977.
+    NEWHOPE
+    # Star Wars Episode V: The Empire Strikes Back, released in 1980.
+    EMPIRE
+    # Star Wars Episode VI: Return of the Jedi, released in 1983.
+    JEDI
+}
+# A character from the Star Wars universe
+interface Character {
+    # The ID of the character
+    id: ID!
+    # The name of the character
+    name: String!
+    # The friends of the character, or an empty list if they have none
+    friends: [Character]
+    # The friends of the character exposed as a connection with edges
+    friendsConnection(first: Int, after: ID): FriendsConnection!
+    # The movies this character appears in
+    appearsIn: [Episode]!
+}
+# Units of height
+enum LengthUnit {
+    # The standard unit around the world
+    METER
+    # Primarily used in the United States
+    FOOT
+}
+# A humanoid creature from the Star Wars universe
+type Human implements Character {
+    # The ID of the human
+    id: ID!
+    # What this human calls themselves
+    name: String!
+    # The home planet of the human, or null if unknown
+    homePlanet: String
+    # Height in the preferred unit, default is meters
+    height(unit: LengthUnit = METER): Float
+    # Mass in kilograms, or null if unknown
+    mass: Float
+    # This human's friends, or an empty list if they have none
+    friends: [Character]
+    # The friends of the human exposed as a connection with edges
+    friendsConnection(first: Int, after: ID): FriendsConnection!
+    # The movies this human appears in
+    appearsIn: [Episode]!
+    # A list of starships this person has piloted, or an empty list if none
+    starships: [Starship]
+}
+# An autonomous mechanical character in the Star Wars universe
+type Droid implements Character {
+    # The ID of the droid
+    id: ID!
+    # What others call this droid
+    name: String!
+    # This droid's friends, or an empty list if they have none
+    friends: [Character]
+    # The friends of the droid exposed as a connection with edges
+    friendsConnection(first: Int, after: ID): FriendsConnection!
+    # The movies this droid appears in
+    appearsIn: [Episode]!
+    # This droid's primary function
+    primaryFunction: String
+}
+# A connection object for a character's friends
+type FriendsConnection {
+    # The total number of friends
+    totalCount: Int
+    # The edges for each of the character's friends.
+    edges: [FriendsEdge]
+    # A list of the friends, as a convenience when edges are not needed.
+    friends: [Character]
+    # Information for paginating this connection
+    pageInfo: PageInfo!
+}
+# An edge object for a character's friends
+type FriendsEdge {
+    # A cursor used for pagination
+    cursor: ID!
+    # The character represented by this friendship edge
+    node: Character
+}
+# Information for paginating this connection
+type PageInfo {
+    startCursor: ID
+    endCursor: ID
+    hasNextPage: Boolean!
+}
+# Represents a review for a movie
+type Review {
+    # The movie
+    episode: Episode
+    # The number of stars this review gave, 1-5
+    stars: Int!
+    # Comment about the movie
+    commentary: String
+}
+# The input object sent when someone is creating a new review
+input ReviewInput {
+    # 0-5 stars
+    stars: Int!
+    # Comment about the movie, optional
+    commentary: String
+    # Favorite color, optional
+    favorite_color: ColorInput
+}
+# The input object sent when passing in a color
+input ColorInput {
+    red: Int!
+    green: Int!
+    blue: Int!
+}
+type Starship {
+    # The ID of the starship
+    id: ID!
+    # The name of the starship
+    name: String!
+    # Length of the starship, along the longest axis
+    length(unit: LengthUnit = METER): Float
+    coordinates: [[Float!]!]
+}
+union SearchResult = Human | Droid | Starship
\ No newline at end of file
diff --git a/internal/gqlparser/validator/testdata/vars.graphql b/internal/gqlparser/validator/testdata/vars.graphql
new file mode 100644
index 0000000000..fe2e6cfd6d
--- /dev/null
+++ b/internal/gqlparser/validator/testdata/vars.graphql
@@ -0,0 +1,38 @@
+type Query {
+    optionalIntArg(i: Int): Boolean!
+    intArg(i: Int!): Boolean!
+    stringArg(i: String): Boolean!
+    boolArg(i: Boolean!): Boolean!
+    floatArg(i: Float!): Boolean!
+    idArg(i: ID!): Boolean!
+    scalarArg(i: Custom!): Boolean!
+    structArg(i: InputType!): Boolean!
+    defaultStructArg(i: InputType! = {name: "foo"}): Boolean!
+    arrayArg(i: [InputType!]): Boolean!
+    intArrayArg(i: [Int]): Boolean!
+    stringArrayArg(i: [String]): Boolean!
+    boolArrayArg(i: [Boolean]): Boolean!
+    typeArrayArg(i: [CustomType]): Boolean!
+}
+
+input InputType {
+    name: String!
+    nullName: String
+    nullEmbedded: Embedded
+    enum: Enum
+    defaultName: String! = "defaultFoo"
+}
+
+input Embedded {
+    name: String!
+}
+
+input CustomType {
+    and: [Int!]
+}
+
+enum Enum {
+    A
+}
+
+scalar Custom
diff --git a/internal/gqlparser/validator/validator.go b/internal/gqlparser/validator/validator.go
new file mode 100644
index 0000000000..05f5b91669
--- /dev/null
+++ b/internal/gqlparser/validator/validator.go
@@ -0,0 +1,45 @@
+package validator
+
+import (
+	//nolint:revive
+	. "github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+)
+
+type AddErrFunc func(options ...ErrorOption)
+
+type ruleFunc func(observers *Events, addError AddErrFunc)
+
+type rule struct {
+	name string
+	rule ruleFunc
+}
+
+var rules []rule
+
+// addRule to rule set.
+// f is called once each time `Validate` is executed.
+func AddRule(name string, f ruleFunc) {
+	rules = append(rules, rule{name: name, rule: f})
+}
+
+func Validate(schema *Schema, doc *QueryDocument) gqlerror.List {
+	var errs gqlerror.List
+
+	observers := &Events{}
+	for i := range rules {
+		rule := rules[i]
+		rule.rule(observers, func(options ...ErrorOption) {
+			err := &gqlerror.Error{
+				Rule: rule.name,
+			}
+			for _, o := range options {
+				o(err)
+			}
+			errs = append(errs, err)
+		})
+	}
+
+	Walk(schema, doc, observers)
+	return errs
+}
diff --git a/internal/gqlparser/validator/vars.go b/internal/gqlparser/validator/vars.go
new file mode 100644
index 0000000000..86be7c4df2
--- /dev/null
+++ b/internal/gqlparser/validator/vars.go
@@ -0,0 +1,258 @@
+package validator
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	"github.com/open-policy-agent/opa/internal/gqlparser/gqlerror"
+)
+
+var ErrUnexpectedType = fmt.Errorf("Unexpected Type")
+
+// VariableValues coerces and validates variable values
+func VariableValues(schema *ast.Schema, op *ast.OperationDefinition, variables map[string]interface{}) (map[string]interface{}, error) {
+	coercedVars := map[string]interface{}{}
+
+	validator := varValidator{
+		path:   ast.Path{ast.PathName("variable")},
+		schema: schema,
+	}
+
+	for _, v := range op.VariableDefinitions {
+		validator.path = append(validator.path, ast.PathName(v.Variable))
+
+		if !v.Definition.IsInputType() {
+			return nil, gqlerror.ErrorPathf(validator.path, "must an input type")
+		}
+
+		val, hasValue := variables[v.Variable]
+
+		if !hasValue {
+			if v.DefaultValue != nil {
+				var err error
+				val, err = v.DefaultValue.Value(nil)
+				if err != nil {
+					return nil, gqlerror.WrapPath(validator.path, err)
+				}
+				hasValue = true
+			} else if v.Type.NonNull {
+				return nil, gqlerror.ErrorPathf(validator.path, "must be defined")
+			}
+		}
+
+		if hasValue {
+			if val == nil {
+				if v.Type.NonNull {
+					return nil, gqlerror.ErrorPathf(validator.path, "cannot be null")
+				}
+				coercedVars[v.Variable] = nil
+			} else {
+				rv := reflect.ValueOf(val)
+
+				jsonNumber, isJSONNumber := val.(json.Number)
+				if isJSONNumber {
+					if v.Type.NamedType == "Int" {
+						n, err := jsonNumber.Int64()
+						if err != nil {
+							return nil, gqlerror.ErrorPathf(validator.path, "cannot use value %d as %s", n, v.Type.NamedType)
+						}
+						rv = reflect.ValueOf(n)
+					} else if v.Type.NamedType == "Float" {
+						f, err := jsonNumber.Float64()
+						if err != nil {
+							return nil, gqlerror.ErrorPathf(validator.path, "cannot use value %f as %s", f, v.Type.NamedType)
+						}
+						rv = reflect.ValueOf(f)
+
+					}
+				}
+				if rv.Kind() == reflect.Ptr || rv.Kind() == reflect.Interface {
+					rv = rv.Elem()
+				}
+
+				rval, err := validator.validateVarType(v.Type, rv)
+				if err != nil {
+					return nil, err
+				}
+				coercedVars[v.Variable] = rval.Interface()
+			}
+		}
+
+		validator.path = validator.path[0 : len(validator.path)-1]
+	}
+	return coercedVars, nil
+}
+
+type varValidator struct {
+	path   ast.Path
+	schema *ast.Schema
+}
+
+func (v *varValidator) validateVarType(typ *ast.Type, val reflect.Value) (reflect.Value, *gqlerror.Error) {
+	currentPath := v.path
+	resetPath := func() {
+		v.path = currentPath
+	}
+	defer resetPath()
+	if typ.Elem != nil {
+		if val.Kind() != reflect.Slice {
+			// GraphQL spec says that non-null values should be coerced to an array when possible.
+			// Hence if the value is not a slice, we create a slice and add val to it.
+			slc := reflect.MakeSlice(reflect.SliceOf(val.Type()), 0, 0)
+			slc = reflect.Append(slc, val)
+			val = slc
+		}
+		for i := 0; i < val.Len(); i++ {
+			resetPath()
+			v.path = append(v.path, ast.PathIndex(i))
+			field := val.Index(i)
+			if field.Kind() == reflect.Ptr || field.Kind() == reflect.Interface {
+				if typ.Elem.NonNull && field.IsNil() {
+					return val, gqlerror.ErrorPathf(v.path, "cannot be null")
+				}
+				field = field.Elem()
+			}
+			_, err := v.validateVarType(typ.Elem, field)
+			if err != nil {
+				return val, err
+			}
+		}
+		return val, nil
+	}
+	def := v.schema.Types[typ.NamedType]
+	if def == nil {
+		panic(fmt.Errorf("missing def for %s", typ.NamedType))
+	}
+
+	if !typ.NonNull && !val.IsValid() {
+		// If the type is not null and we got a invalid value namely null/nil, then it's valid
+		return val, nil
+	}
+
+	switch def.Kind {
+	case ast.Enum:
+		kind := val.Type().Kind()
+		if kind != reflect.Int && kind != reflect.Int32 && kind != reflect.Int64 && kind != reflect.String {
+			return val, gqlerror.ErrorPathf(v.path, "enums must be ints or strings")
+		}
+		isValidEnum := false
+		for _, enumVal := range def.EnumValues {
+			if strings.EqualFold(val.String(), enumVal.Name) {
+				isValidEnum = true
+			}
+		}
+		if !isValidEnum {
+			return val, gqlerror.ErrorPathf(v.path, "%s is not a valid %s", val.String(), def.Name)
+		}
+		return val, nil
+	case ast.Scalar:
+		kind := val.Type().Kind()
+		switch typ.NamedType {
+		case "Int":
+			if kind == reflect.Int || kind == reflect.Int32 || kind == reflect.Int64 || kind == reflect.Float32 || kind == reflect.Float64 || IsValidIntString(val, kind) {
+				return val, nil
+			}
+		case "Float":
+			if kind == reflect.Float32 || kind == reflect.Float64 || kind == reflect.Int || kind == reflect.Int32 || kind == reflect.Int64 || IsValidFloatString(val, kind) {
+				return val, nil
+			}
+		case "String":
+			if kind == reflect.String {
+				return val, nil
+			}
+
+		case "Boolean":
+			if kind == reflect.Bool {
+				return val, nil
+			}
+
+		case "ID":
+			if kind == reflect.Int || kind == reflect.Int32 || kind == reflect.Int64 || kind == reflect.String {
+				return val, nil
+			}
+		default:
+			// assume custom scalars are ok
+			return val, nil
+		}
+		return val, gqlerror.ErrorPathf(v.path, "cannot use %s as %s", kind.String(), typ.NamedType)
+	case ast.InputObject:
+		if val.Kind() != reflect.Map {
+			return val, gqlerror.ErrorPathf(v.path, "must be a %s", def.Name)
+		}
+
+		// check for unknown fields
+		for _, name := range val.MapKeys() {
+			val.MapIndex(name)
+			fieldDef := def.Fields.ForName(name.String())
+			resetPath()
+			v.path = append(v.path, ast.PathName(name.String()))
+
+			switch {
+			case name.String() == "__typename":
+				continue
+			case fieldDef == nil:
+				return val, gqlerror.ErrorPathf(v.path, "unknown field")
+			}
+		}
+
+		for _, fieldDef := range def.Fields {
+			resetPath()
+			v.path = append(v.path, ast.PathName(fieldDef.Name))
+
+			field := val.MapIndex(reflect.ValueOf(fieldDef.Name))
+			if !field.IsValid() {
+				if fieldDef.Type.NonNull {
+					if fieldDef.DefaultValue != nil {
+						var err error
+						_, err = fieldDef.DefaultValue.Value(nil)
+						if err == nil {
+							continue
+						}
+					}
+					return val, gqlerror.ErrorPathf(v.path, "must be defined")
+				}
+				continue
+			}
+
+			if field.Kind() == reflect.Ptr || field.Kind() == reflect.Interface {
+				if fieldDef.Type.NonNull && field.IsNil() {
+					return val, gqlerror.ErrorPathf(v.path, "cannot be null")
+				}
+				//allow null object field and skip it
+				if !fieldDef.Type.NonNull && field.IsNil() {
+					continue
+				}
+				field = field.Elem()
+			}
+			cval, err := v.validateVarType(fieldDef.Type, field)
+			if err != nil {
+				return val, err
+			}
+			val.SetMapIndex(reflect.ValueOf(fieldDef.Name), cval)
+		}
+	default:
+		panic(fmt.Errorf("unsupported type %s", def.Kind))
+	}
+	return val, nil
+}
+
+func IsValidIntString(val reflect.Value, kind reflect.Kind) bool {
+	if kind != reflect.String {
+		return false
+	}
+	_, e := strconv.ParseInt(fmt.Sprintf("%v", val.Interface()), 10, 64)
+
+	return e == nil
+}
+
+func IsValidFloatString(val reflect.Value, kind reflect.Kind) bool {
+	if kind != reflect.String {
+		return false
+	}
+	_, e := strconv.ParseFloat(fmt.Sprintf("%v", val.Interface()), 64)
+	return e == nil
+}
diff --git a/internal/gqlparser/validator/walk.go b/internal/gqlparser/validator/walk.go
new file mode 100644
index 0000000000..f722871869
--- /dev/null
+++ b/internal/gqlparser/validator/walk.go
@@ -0,0 +1,292 @@
+package validator
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/internal/gqlparser/ast"
+)
+
+type Events struct {
+	operationVisitor []func(walker *Walker, operation *ast.OperationDefinition)
+	field            []func(walker *Walker, field *ast.Field)
+	fragment         []func(walker *Walker, fragment *ast.FragmentDefinition)
+	inlineFragment   []func(walker *Walker, inlineFragment *ast.InlineFragment)
+	fragmentSpread   []func(walker *Walker, fragmentSpread *ast.FragmentSpread)
+	directive        []func(walker *Walker, directive *ast.Directive)
+	directiveList    []func(walker *Walker, directives []*ast.Directive)
+	value            []func(walker *Walker, value *ast.Value)
+	variable         []func(walker *Walker, variable *ast.VariableDefinition)
+}
+
+func (o *Events) OnOperation(f func(walker *Walker, operation *ast.OperationDefinition)) {
+	o.operationVisitor = append(o.operationVisitor, f)
+}
+func (o *Events) OnField(f func(walker *Walker, field *ast.Field)) {
+	o.field = append(o.field, f)
+}
+func (o *Events) OnFragment(f func(walker *Walker, fragment *ast.FragmentDefinition)) {
+	o.fragment = append(o.fragment, f)
+}
+func (o *Events) OnInlineFragment(f func(walker *Walker, inlineFragment *ast.InlineFragment)) {
+	o.inlineFragment = append(o.inlineFragment, f)
+}
+func (o *Events) OnFragmentSpread(f func(walker *Walker, fragmentSpread *ast.FragmentSpread)) {
+	o.fragmentSpread = append(o.fragmentSpread, f)
+}
+func (o *Events) OnDirective(f func(walker *Walker, directive *ast.Directive)) {
+	o.directive = append(o.directive, f)
+}
+func (o *Events) OnDirectiveList(f func(walker *Walker, directives []*ast.Directive)) {
+	o.directiveList = append(o.directiveList, f)
+}
+func (o *Events) OnValue(f func(walker *Walker, value *ast.Value)) {
+	o.value = append(o.value, f)
+}
+func (o *Events) OnVariable(f func(walker *Walker, variable *ast.VariableDefinition)) {
+	o.variable = append(o.variable, f)
+}
+
+func Walk(schema *ast.Schema, document *ast.QueryDocument, observers *Events) {
+	w := Walker{
+		Observers: observers,
+		Schema:    schema,
+		Document:  document,
+	}
+
+	w.walk()
+}
+
+type Walker struct {
+	Context   context.Context
+	Observers *Events
+	Schema    *ast.Schema
+	Document  *ast.QueryDocument
+
+	validatedFragmentSpreads map[string]bool
+	CurrentOperation         *ast.OperationDefinition
+}
+
+func (w *Walker) walk() {
+	for _, child := range w.Document.Operations {
+		w.validatedFragmentSpreads = make(map[string]bool)
+		w.walkOperation(child)
+	}
+	for _, child := range w.Document.Fragments {
+		w.validatedFragmentSpreads = make(map[string]bool)
+		w.walkFragment(child)
+	}
+}
+
+func (w *Walker) walkOperation(operation *ast.OperationDefinition) {
+	w.CurrentOperation = operation
+	for _, varDef := range operation.VariableDefinitions {
+		varDef.Definition = w.Schema.Types[varDef.Type.Name()]
+		for _, v := range w.Observers.variable {
+			v(w, varDef)
+		}
+		if varDef.DefaultValue != nil {
+			varDef.DefaultValue.ExpectedType = varDef.Type
+			varDef.DefaultValue.Definition = w.Schema.Types[varDef.Type.Name()]
+		}
+	}
+
+	var def *ast.Definition
+	var loc ast.DirectiveLocation
+	switch operation.Operation {
+	case ast.Query, "":
+		def = w.Schema.Query
+		loc = ast.LocationQuery
+	case ast.Mutation:
+		def = w.Schema.Mutation
+		loc = ast.LocationMutation
+	case ast.Subscription:
+		def = w.Schema.Subscription
+		loc = ast.LocationSubscription
+	}
+
+	for _, varDef := range operation.VariableDefinitions {
+		if varDef.DefaultValue != nil {
+			w.walkValue(varDef.DefaultValue)
+		}
+		w.walkDirectives(varDef.Definition, varDef.Directives, ast.LocationVariableDefinition)
+	}
+
+	w.walkDirectives(def, operation.Directives, loc)
+	w.walkSelectionSet(def, operation.SelectionSet)
+
+	for _, v := range w.Observers.operationVisitor {
+		v(w, operation)
+	}
+	w.CurrentOperation = nil
+}
+
+func (w *Walker) walkFragment(it *ast.FragmentDefinition) {
+	def := w.Schema.Types[it.TypeCondition]
+
+	it.Definition = def
+
+	w.walkDirectives(def, it.Directives, ast.LocationFragmentDefinition)
+	w.walkSelectionSet(def, it.SelectionSet)
+
+	for _, v := range w.Observers.fragment {
+		v(w, it)
+	}
+}
+
+func (w *Walker) walkDirectives(parentDef *ast.Definition, directives []*ast.Directive, location ast.DirectiveLocation) {
+	for _, dir := range directives {
+		def := w.Schema.Directives[dir.Name]
+		dir.Definition = def
+		dir.ParentDefinition = parentDef
+		dir.Location = location
+
+		for _, arg := range dir.Arguments {
+			var argDef *ast.ArgumentDefinition
+			if def != nil {
+				argDef = def.Arguments.ForName(arg.Name)
+			}
+
+			w.walkArgument(argDef, arg)
+		}
+
+		for _, v := range w.Observers.directive {
+			v(w, dir)
+		}
+	}
+
+	for _, v := range w.Observers.directiveList {
+		v(w, directives)
+	}
+}
+
+func (w *Walker) walkValue(value *ast.Value) {
+	if value.Kind == ast.Variable && w.CurrentOperation != nil {
+		value.VariableDefinition = w.CurrentOperation.VariableDefinitions.ForName(value.Raw)
+		if value.VariableDefinition != nil {
+			value.VariableDefinition.Used = true
+		}
+	}
+
+	if value.Kind == ast.ObjectValue {
+		for _, child := range value.Children {
+			if value.Definition != nil {
+				fieldDef := value.Definition.Fields.ForName(child.Name)
+				if fieldDef != nil {
+					child.Value.ExpectedType = fieldDef.Type
+					child.Value.Definition = w.Schema.Types[fieldDef.Type.Name()]
+				}
+			}
+			w.walkValue(child.Value)
+		}
+	}
+
+	if value.Kind == ast.ListValue {
+		for _, child := range value.Children {
+			if value.ExpectedType != nil && value.ExpectedType.Elem != nil {
+				child.Value.ExpectedType = value.ExpectedType.Elem
+				child.Value.Definition = value.Definition
+			}
+
+			w.walkValue(child.Value)
+		}
+	}
+
+	for _, v := range w.Observers.value {
+		v(w, value)
+	}
+}
+
+func (w *Walker) walkArgument(argDef *ast.ArgumentDefinition, arg *ast.Argument) {
+	if argDef != nil {
+		arg.Value.ExpectedType = argDef.Type
+		arg.Value.Definition = w.Schema.Types[argDef.Type.Name()]
+	}
+
+	w.walkValue(arg.Value)
+}
+
+func (w *Walker) walkSelectionSet(parentDef *ast.Definition, it ast.SelectionSet) {
+	for _, child := range it {
+		w.walkSelection(parentDef, child)
+	}
+}
+
+func (w *Walker) walkSelection(parentDef *ast.Definition, it ast.Selection) {
+	switch it := it.(type) {
+	case *ast.Field:
+		var def *ast.FieldDefinition
+		if it.Name == "__typename" {
+			def = &ast.FieldDefinition{
+				Name: "__typename",
+				Type: ast.NamedType("String", nil),
+			}
+		} else if parentDef != nil {
+			def = parentDef.Fields.ForName(it.Name)
+		}
+
+		it.Definition = def
+		it.ObjectDefinition = parentDef
+
+		var nextParentDef *ast.Definition
+		if def != nil {
+			nextParentDef = w.Schema.Types[def.Type.Name()]
+		}
+
+		for _, arg := range it.Arguments {
+			var argDef *ast.ArgumentDefinition
+			if def != nil {
+				argDef = def.Arguments.ForName(arg.Name)
+			}
+
+			w.walkArgument(argDef, arg)
+		}
+
+		w.walkDirectives(nextParentDef, it.Directives, ast.LocationField)
+		w.walkSelectionSet(nextParentDef, it.SelectionSet)
+
+		for _, v := range w.Observers.field {
+			v(w, it)
+		}
+
+	case *ast.InlineFragment:
+		it.ObjectDefinition = parentDef
+
+		nextParentDef := parentDef
+		if it.TypeCondition != "" {
+			nextParentDef = w.Schema.Types[it.TypeCondition]
+		}
+
+		w.walkDirectives(nextParentDef, it.Directives, ast.LocationInlineFragment)
+		w.walkSelectionSet(nextParentDef, it.SelectionSet)
+
+		for _, v := range w.Observers.inlineFragment {
+			v(w, it)
+		}
+
+	case *ast.FragmentSpread:
+		def := w.Document.Fragments.ForName(it.Name)
+		it.Definition = def
+		it.ObjectDefinition = parentDef
+
+		var nextParentDef *ast.Definition
+		if def != nil {
+			nextParentDef = w.Schema.Types[def.TypeCondition]
+		}
+
+		w.walkDirectives(nextParentDef, it.Directives, ast.LocationFragmentSpread)
+
+		if def != nil && !w.validatedFragmentSpreads[def.Name] {
+			// prevent inifinite recursion
+			w.validatedFragmentSpreads[def.Name] = true
+			w.walkSelectionSet(nextParentDef, def.SelectionSet)
+		}
+
+		for _, v := range w.Observers.fragmentSpread {
+			v(w, it)
+		}
+
+	default:
+		panic(fmt.Errorf("unsupported %T", it))
+	}
+}
diff --git a/internal/ir/ir.go b/internal/ir/ir.go
deleted file mode 100644
index d907bce0c6..0000000000
--- a/internal/ir/ir.go
+++ /dev/null
@@ -1,497 +0,0 @@
-// Copyright 2018 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-// Package ir defines an intermediate representation (IR) for Rego.
-//
-// The IR specifies an imperative execution model for Rego policies similar to a
-// query plan in traditional databases.
-package ir
-
-import (
-	"fmt"
-
-	"github.com/open-policy-agent/opa/types"
-)
-
-type (
-	// Policy represents a planned policy query.
-	Policy struct {
-		Static *Static
-		Plans  *Plans
-		Funcs  *Funcs
-	}
-
-	// Static represents a static data segment that is indexed into by the policy.
-	Static struct {
-		Strings      []*StringConst
-		BuiltinFuncs []*BuiltinFunc
-		Files        []*StringConst
-	}
-
-	// BuiltinFunc represents a built-in function that may be required by the
-	// policy.
-	BuiltinFunc struct {
-		Name string
-		Decl *types.Function
-	}
-
-	// Plans represents a collection of named query plans to expose in the policy.
-	Plans struct {
-		Plans []*Plan
-	}
-
-	// Funcs represents a collection of planned functions to include in the
-	// policy.
-	Funcs struct {
-		Funcs []*Func
-	}
-
-	// Func represents a named plan (function) that can be invoked. Functions
-	// accept one or more parameters and return a value. By convention, the
-	// input document and data documents are always passed as the first and
-	// second arguments (respectively).
-	Func struct {
-		Name   string
-		Params []Local
-		Return Local
-		Blocks []*Block // TODO(tsandall): should this be a plan?
-		Path   []string // optional: if non-nil, include in data function tree
-	}
-
-	// Plan represents an ordered series of blocks to execute. Plan execution
-	// stops when a return statement is reached. Blocks are executed in-order.
-	Plan struct {
-		Name   string
-		Blocks []*Block
-	}
-
-	// Block represents an ordered sequence of statements to execute. Blocks are
-	// executed until a return statement is encountered, a statement is undefined,
-	// or there are no more statements. If all statements are defined but no return
-	// statement is encountered, the block is undefined.
-	Block struct {
-		Stmts []Stmt
-	}
-
-	// Stmt represents an operation (e.g., comparison, loop, dot, etc.) to execute.
-	Stmt interface {
-		locationStmt
-	}
-
-	locationStmt interface {
-		SetLocation(index, row, col int, file, text string)
-		GetLocation() *Location
-	}
-
-	// Local represents a plan-scoped variable.
-	//
-	// TODO(tsandall): should this be int32 for safety?
-	Local int
-
-	// Const represents a constant value from the policy.
-	Const interface {
-		typeMarker()
-	}
-
-	// NullConst represents a null value.
-	NullConst struct{}
-
-	// BooleanConst represents a boolean value.
-	BooleanConst struct {
-		Value bool
-	}
-
-	// StringConst represents a string value.
-	StringConst struct {
-		Value string
-	}
-
-	// IntConst represents an integer constant.
-	IntConst struct {
-		Value int64
-	}
-
-	// FloatConst represents a floating-point constant.
-	FloatConst struct {
-		Value float64
-	}
-)
-
-const (
-	// Input is the local variable that refers to the global input document.
-	Input Local = iota
-
-	// Data is the local variable that refers to the global data document.
-	Data
-
-	// Unused is the free local variable that can be allocated in a plan.
-	Unused
-)
-
-func (a *Policy) String() string {
-	return "Policy"
-}
-
-func (a *Static) String() string {
-	return fmt.Sprintf("Static (%d strings, %d files)", len(a.Strings), len(a.Files))
-}
-
-func (a *Funcs) String() string {
-	return fmt.Sprintf("Funcs (%d funcs)", len(a.Funcs))
-}
-
-func (a *Func) String() string {
-	return fmt.Sprintf("%v (%d params: %v, %d blocks, path: %v)", a.Name, len(a.Params), a.Params, len(a.Blocks), a.Path)
-}
-
-func (a *Plan) String() string {
-	return fmt.Sprintf("Plan %v (%d blocks)", a.Name, len(a.Blocks))
-}
-
-func (a *Block) String() string {
-	return fmt.Sprintf("Block (%d statements)", len(a.Stmts))
-}
-
-func (*BooleanConst) typeMarker() {}
-func (*NullConst) typeMarker()    {}
-func (*IntConst) typeMarker()     {}
-func (*FloatConst) typeMarker()   {}
-func (*StringConst) typeMarker()  {}
-
-// ReturnLocalStmt represents a return statement that yields a local value.
-type ReturnLocalStmt struct {
-	Source Local
-
-	Location
-}
-
-// CallStmt represents a named function call. The result should be stored in the
-// result local.
-type CallStmt struct {
-	Func   string
-	Args   []LocalOrConst
-	Result Local
-
-	Location
-}
-
-// CallDynamicStmt represents an indirect (data) function call. The result should
-// be stored in the result local.
-type CallDynamicStmt struct {
-	Args   []Local
-	Result Local
-	Path   []LocalOrConst
-
-	Location
-}
-
-// LocalOrConst is a tagged union of the two types, Local and StringIndex.
-type LocalOrConst interface {
-	fmt.Stringer
-	localOrConst()
-}
-
-func (Local) localOrConst() {}
-func (l Local) String() string {
-	return fmt.Sprintf("Local<%d>", int(l))
-}
-
-// StringIndex represents the index into the plan's list of constant strings
-// of a constant string.
-type StringIndex int
-
-func (StringIndex) localOrConst() {}
-func (s StringIndex) String() string {
-	return fmt.Sprintf("String<%d>", int(s))
-}
-
-// Bool represents a constant boolean.
-type Bool bool
-
-func (Bool) localOrConst() {}
-func (b Bool) String() string {
-	return fmt.Sprintf("Bool<%v>", bool(b))
-}
-
-// BlockStmt represents a nested block. Nested blocks and break statements can
-// be used to short-circuit execution.
-type BlockStmt struct {
-	Blocks []*Block
-
-	Location
-}
-
-func (a *BlockStmt) String() string {
-	return fmt.Sprintf("BlockStmt (%d blocks) %v", len(a.Blocks), a.GetLocation())
-}
-
-// BreakStmt represents a jump out of the current block. The index specifies how
-// many blocks to jump starting from zero (the current block). Execution will
-// continue from the end of the block that is jumped to.
-type BreakStmt struct {
-	Index uint32
-
-	Location
-}
-
-// DotStmt represents a lookup operation on a value (e.g., array, object, etc.)
-// The source of a DotStmt may be a scalar value in which case the statement
-// will be undefined.
-type DotStmt struct {
-	Source LocalOrConst
-	Key    LocalOrConst
-	Target Local
-
-	Location
-}
-
-// LenStmt represents a length() operation on a local variable. The
-// result is stored in the target local variable.
-type LenStmt struct {
-	Source LocalOrConst
-	Target Local
-
-	Location
-}
-
-// ScanStmt represents a linear scan over a composite value. The
-// source may be a scalar in which case the block will never execute.
-type ScanStmt struct {
-	Source Local
-	Key    Local
-	Value  Local
-	Block  *Block
-
-	Location
-}
-
-// NotStmt represents a negated statement.
-type NotStmt struct {
-	Block *Block
-
-	Location
-}
-
-// AssignIntStmt represents an assignment of an integer value to a
-// local variable.
-type AssignIntStmt struct {
-	Value  int64
-	Target Local
-
-	Location
-}
-
-// AssignVarStmt represents an assignment of one local variable to another.
-type AssignVarStmt struct {
-	Source LocalOrConst
-	Target Local
-
-	Location
-}
-
-// AssignVarOnceStmt represents an assignment of one local variable to another.
-// If the target is defined, execution aborts with a conflict error.
-//
-// TODO(tsandall): is there a better name for this?
-type AssignVarOnceStmt struct {
-	Target Local
-	Source LocalOrConst
-
-	Location
-}
-
-// ResetLocalStmt resets a local variable to 0.
-type ResetLocalStmt struct {
-	Target Local
-
-	Location
-}
-
-// MakeNullStmt constructs a local variable that refers to a null value.
-type MakeNullStmt struct {
-	Target Local
-
-	Location
-}
-
-// MakeNumberIntStmt constructs a local variable that refers to an integer value.
-type MakeNumberIntStmt struct {
-	Value  int64
-	Target Local
-
-	Location
-}
-
-// MakeNumberRefStmt constructs a local variable that refers to a number stored as a string.
-type MakeNumberRefStmt struct {
-	Index  int
-	Target Local
-
-	Location
-}
-
-// MakeArrayStmt constructs a local variable that refers to an array value.
-type MakeArrayStmt struct {
-	Capacity int32
-	Target   Local
-
-	Location
-}
-
-// MakeObjectStmt constructs a local variable that refers to an object value.
-type MakeObjectStmt struct {
-	Target Local
-
-	Location
-}
-
-// MakeSetStmt constructs a local variable that refers to a set value.
-type MakeSetStmt struct {
-	Target Local
-
-	Location
-}
-
-// EqualStmt represents an value-equality check of two local variables.
-type EqualStmt struct {
-	A LocalOrConst
-	B LocalOrConst
-
-	Location
-}
-
-// NotEqualStmt represents a != check of two local variables.
-type NotEqualStmt struct {
-	A LocalOrConst
-	B LocalOrConst
-
-	Location
-}
-
-// IsArrayStmt represents a dynamic type check on a local variable.
-type IsArrayStmt struct {
-	Source LocalOrConst
-
-	Location
-}
-
-// IsObjectStmt represents a dynamic type check on a local variable.
-type IsObjectStmt struct {
-	Source LocalOrConst
-
-	Location
-}
-
-// IsDefinedStmt represents a check of whether a local variable is defined.
-type IsDefinedStmt struct {
-	Source Local
-
-	Location
-}
-
-// IsUndefinedStmt represents a check of whether local variable is undefined.
-type IsUndefinedStmt struct {
-	Source Local
-
-	Location
-}
-
-// ArrayAppendStmt represents a dynamic append operation of a value
-// onto an array.
-type ArrayAppendStmt struct {
-	Value LocalOrConst
-	Array Local
-
-	Location
-}
-
-// ObjectInsertStmt represents a dynamic insert operation of a
-// key/value pair into an object.
-type ObjectInsertStmt struct {
-	Key    LocalOrConst
-	Value  LocalOrConst
-	Object Local
-
-	Location
-}
-
-// ObjectInsertOnceStmt represents a dynamic insert operation of a key/value
-// pair into an object. If the key already exists and the value differs,
-// execution aborts with a conflict error.
-type ObjectInsertOnceStmt struct {
-	Key    LocalOrConst
-	Value  LocalOrConst
-	Object Local
-
-	Location
-}
-
-// ObjectMergeStmt performs a recursive merge of two object values. If either of
-// the locals refer to non-object values this operation will abort with a
-// conflict error. Overlapping object keys are merged recursively.
-type ObjectMergeStmt struct {
-	A      Local
-	B      Local
-	Target Local
-
-	Location
-}
-
-// SetAddStmt represents a dynamic add operation of an element into a set.
-type SetAddStmt struct {
-	Value LocalOrConst
-	Set   Local
-
-	Location
-}
-
-// WithStmt replaces the Local or a portion of the document referred to by the
-// Local with the Value and executes the contained block. If the Path is
-// non-empty, the Value is upserted into the Local. If the intermediate nodes in
-// the Local referred to by the Path do not exist, they will be created. When
-// the WithStmt finishes the Local is reset to it's original value.
-type WithStmt struct {
-	Local Local
-	Path  []int
-	Value LocalOrConst
-	Block *Block
-
-	Location
-}
-
-// NopStmt adds a nop instruction. Useful during development and debugging only.
-type NopStmt struct {
-	Location
-}
-
-// ResultSetAdd adds a value into the result set returned by the query plan.
-type ResultSetAdd struct {
-	Value Local
-
-	Location
-}
-
-// Location records the filen index, and the row and column inside that file
-// that a statement can be connected to.
-type Location struct {
-	Index      int // filename string constant index
-	Col, Row   int
-	file, text string // only used for debugging
-}
-
-// SetLocation sets the Location for a given Stmt.
-func (l *Location) SetLocation(index, row, col int, file, text string) {
-	*l = Location{
-		Index: index,
-		Row:   row,
-		Col:   col,
-		file:  file,
-		text:  text,
-	}
-}
-
-// GetLocation returns a Stmt's Location.
-func (l *Location) GetLocation() *Location {
-	return l
-}
diff --git a/internal/json/patch/patch.go b/internal/json/patch/patch.go
new file mode 100644
index 0000000000..31c89869da
--- /dev/null
+++ b/internal/json/patch/patch.go
@@ -0,0 +1,45 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package patch
+
+import (
+	"strings"
+
+	"github.com/open-policy-agent/opa/storage"
+)
+
+// ParsePatchPathEscaped returns a new path for the given escaped str.
+// This is based on storage.ParsePathEscaped so will do URL unescaping of
+// the provided str for backwards compatibility, but also handles the
+// specific escape strings defined in RFC 6901 (JSON Pointer) because
+// that's what's mandated by RFC 6902 (JSON Patch).
+func ParsePatchPathEscaped(str string) (path storage.Path, ok bool) {
+	path, ok = storage.ParsePathEscaped(str)
+	if !ok {
+		return
+	}
+	for i := range path {
+		// RFC 6902 section 4: "[The "path" member's] value is a string containing
+		// a JSON-Pointer value [RFC6901] that references a location within the
+		// target document (the "target location") where the operation is performed."
+		//
+		// RFC 6901 section 3: "Because the characters '~' (%x7E) and '/' (%x2F)
+		// have special meanings in JSON Pointer, '~' needs to be encoded as '~0'
+		// and '/' needs to be encoded as '~1' when these characters appear in a
+		// reference token."
+
+		// RFC 6901 section 4: "Evaluation of each reference token begins by
+		// decoding any escaped character sequence.  This is performed by first
+		// transforming any occurrence of the sequence '~1' to '/', and then
+		// transforming any occurrence of the sequence '~0' to '~'.  By performing
+		// the substitutions in this order, an implementation avoids the error of
+		// turning '~01' first into '~1' and then into '/', which would be
+		// incorrect (the string '~01' correctly becomes '~1' after transformation)."
+		path[i] = strings.Replace(path[i], "~1", "/", -1)
+		path[i] = strings.Replace(path[i], "~0", "~", -1)
+	}
+
+	return
+}
diff --git a/internal/json/patch/patch_test.go b/internal/json/patch/patch_test.go
new file mode 100644
index 0000000000..026a6cf40c
--- /dev/null
+++ b/internal/json/patch/patch_test.go
@@ -0,0 +1,87 @@
+package patch
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/open-policy-agent/opa/storage"
+)
+
+func TestParsePatchPathEscaped(t *testing.T) {
+	tests := []struct {
+		note         string
+		path         string
+		expectedPath storage.Path
+		expectedOK   bool
+	}{
+		// success-path tests
+		{
+			note:         "single-level",
+			path:         "/single-level",
+			expectedPath: storage.Path{"single-level"},
+			expectedOK:   true,
+		},
+		{
+			note:         "multi-level",
+			path:         "/a/multi-level/path",
+			expectedPath: storage.Path{"a", "multi-level", "path"},
+			expectedOK:   true,
+		},
+		{
+			note:         "end",
+			path:         "/-",
+			expectedPath: storage.Path{"-"},
+			expectedOK:   true,
+		},
+		{ // not strictly correct but included for backwards compatibility with existing OPA
+			note:         "url-escaped forward slash",
+			path:         "/github.com%2Fopen-policy-agent",
+			expectedPath: storage.Path{"github.com/open-policy-agent"},
+			expectedOK:   true,
+		},
+		{
+			note:         "json-pointer-escaped forward slash",
+			path:         "/github.com~1open-policy-agent",
+			expectedPath: storage.Path{"github.com/open-policy-agent"},
+			expectedOK:   true,
+		},
+		{
+			note:         "json-pointer-escaped tilde",
+			path:         "/~0opa",
+			expectedPath: storage.Path{"~opa"},
+			expectedOK:   true,
+		},
+		{
+			note:         "json-pointer-escape correctness",
+			path:         "/~01",
+			expectedPath: storage.Path{"~1"},
+			expectedOK:   true,
+		},
+
+		// failure-path tests
+		{ // not possible with existing callers but for completeness...
+			note:       "empty string",
+			path:       "",
+			expectedOK: false,
+		},
+		{ // not possible with existing callers but for completeness...
+			note:       "string that doesn't start with /",
+			path:       "foo",
+			expectedOK: false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			actualPath, actualOK := ParsePatchPathEscaped(tc.path)
+
+			if tc.expectedOK != actualOK {
+				t.Fatalf("Expected ok to be %v but was %v", tc.expectedOK, actualOK)
+			}
+
+			if !reflect.DeepEqual(tc.expectedPath, actualPath) {
+				t.Fatalf("Expected path to be %v but was %v", tc.expectedPath, actualPath)
+			}
+		})
+	}
+}
diff --git a/internal/jwx/buffer/buffer.go b/internal/jwx/buffer/buffer.go
index ca4ac419b9..c383ff3b54 100644
--- a/internal/jwx/buffer/buffer.go
+++ b/internal/jwx/buffer/buffer.go
@@ -7,8 +7,7 @@ import (
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
-
-	"github.com/pkg/errors"
+	"fmt"
 )
 
 // Buffer wraps `[]byte` and provides functions that are often used in
@@ -35,7 +34,7 @@ func FromUint(v uint64) Buffer {
 func FromBase64(v []byte) (Buffer, error) {
 	b := Buffer{}
 	if err := b.Base64Decode(v); err != nil {
-		return Buffer(nil), errors.Wrap(err, "failed to decode from base64")
+		return Buffer(nil), fmt.Errorf("failed to decode from base64: %w", err)
 	}
 
 	return b, nil
@@ -85,7 +84,7 @@ func (b *Buffer) Base64Decode(v []byte) error {
 	out := make([]byte, enc.DecodedLen(len(v)))
 	n, err := enc.Decode(out, v)
 	if err != nil {
-		return errors.Wrap(err, "failed to decode from base64")
+		return fmt.Errorf("failed to decode from base64: %w", err)
 	}
 	out = out[:n]
 	*b = Buffer(out)
@@ -97,7 +96,7 @@ func (b *Buffer) Base64Decode(v []byte) error {
 func (b Buffer) MarshalJSON() ([]byte, error) {
 	v, err := b.Base64Encode()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to encode to base64")
+		return nil, fmt.Errorf("failed to encode to base64: %w", err)
 	}
 	return json.Marshal(string(v))
 }
@@ -107,7 +106,7 @@ func (b Buffer) MarshalJSON() ([]byte, error) {
 func (b *Buffer) UnmarshalJSON(data []byte) error {
 	var x string
 	if err := json.Unmarshal(data, &x); err != nil {
-		return errors.Wrap(err, "failed to unmarshal JSON")
+		return fmt.Errorf("failed to unmarshal JSON: %w", err)
 	}
 	return b.Base64Decode([]byte(x))
 }
diff --git a/internal/jwx/jwa/key_type.go b/internal/jwx/jwa/key_type.go
index 076bd39ed7..98f0cc42e2 100644
--- a/internal/jwx/jwa/key_type.go
+++ b/internal/jwx/jwa/key_type.go
@@ -1,9 +1,9 @@
 package jwa
 
 import (
+	"errors"
+	"fmt"
 	"strconv"
-
-	"github.com/pkg/errors"
 )
 
 // KeyType represents the key type ("kty") that are supported
@@ -29,11 +29,11 @@ func (keyType *KeyType) Accept(value interface{}) error {
 	case KeyType:
 		tmp = x
 	default:
-		return errors.Errorf(`invalid type for jwa.KeyType: %T`, value)
+		return fmt.Errorf("invalid type for jwa.KeyType: %T", value)
 	}
 	_, ok := keyTypeAlg[tmp.String()]
 	if !ok {
-		return errors.Errorf("Unknown Key Type algorithm")
+		return errors.New("unknown Key Type algorithm")
 	}
 
 	*keyType = tmp
@@ -53,14 +53,14 @@ func (keyType *KeyType) UnmarshalJSON(data []byte) error {
 		var err error
 		quoted, err = strconv.Unquote(string(data))
 		if err != nil {
-			return errors.Wrap(err, "Failed to process signature algorithm")
+			return fmt.Errorf("failed to process signature algorithm: %w", err)
 		}
 	} else {
 		quoted = string(data)
 	}
 	_, ok := keyTypeAlg[quoted]
 	if !ok {
-		return errors.Errorf("Unknown signature algorithm")
+		return errors.New("unknown signature algorithm")
 	}
 	*keyType = KeyType(quoted)
 	return nil
diff --git a/internal/jwx/jwa/signature.go b/internal/jwx/jwa/signature.go
index a0988ecabf..45e400176d 100644
--- a/internal/jwx/jwa/signature.go
+++ b/internal/jwx/jwa/signature.go
@@ -1,9 +1,9 @@
 package jwa
 
 import (
+	"errors"
+	"fmt"
 	"strconv"
-
-	"github.com/pkg/errors"
 )
 
 // SignatureAlgorithm represents the various signature algorithms as described in https://tools.ietf.org/html/rfc7518#section-3.1
@@ -27,6 +27,7 @@ const (
 	RS384       SignatureAlgorithm = "RS384" // RSASSA-PKCS-v1.5 using SHA-384
 	RS512       SignatureAlgorithm = "RS512" // RSASSA-PKCS-v1.5 using SHA-512
 	NoValue     SignatureAlgorithm = ""      // No value is different from none
+	Unsupported SignatureAlgorithm = "unsupported"
 )
 
 // Accept is used when conversion from values given by
@@ -39,11 +40,11 @@ func (signature *SignatureAlgorithm) Accept(value interface{}) error {
 	case SignatureAlgorithm:
 		tmp = x
 	default:
-		return errors.Errorf(`invalid type for jwa.SignatureAlgorithm: %T`, value)
+		return fmt.Errorf("invalid type for jwa.SignatureAlgorithm: %T", value)
 	}
 	_, ok := signatureAlg[tmp.String()]
 	if !ok {
-		return errors.Errorf("Unknown signature algorithm")
+		return errors.New("unknown signature algorithm")
 	}
 	*signature = tmp
 	return nil
@@ -62,14 +63,15 @@ func (signature *SignatureAlgorithm) UnmarshalJSON(data []byte) error {
 		var err error
 		quoted, err = strconv.Unquote(string(data))
 		if err != nil {
-			return errors.Wrap(err, "Failed to process signature algorithm")
+			return fmt.Errorf("failed to process signature algorithm: %w", err)
 		}
 	} else {
 		quoted = string(data)
 	}
 	_, ok := signatureAlg[quoted]
 	if !ok {
-		return errors.Errorf("Unknown signature algorithm")
+		*signature = Unsupported
+		return nil
 	}
 	*signature = SignatureAlgorithm(quoted)
 	return nil
diff --git a/internal/jwx/jwk/ecdsa.go b/internal/jwx/jwk/ecdsa.go
index 30bee46b4b..b46689f037 100644
--- a/internal/jwx/jwk/ecdsa.go
+++ b/internal/jwx/jwk/ecdsa.go
@@ -3,10 +3,10 @@ package jwk
 import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
+	"errors"
+	"fmt"
 	"math/big"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
 
@@ -15,7 +15,7 @@ func newECDSAPublicKey(key *ecdsa.PublicKey) (*ECDSAPublicKey, error) {
 	var hdr StandardHeaders
 	err := hdr.Set(KeyTypeKey, jwa.EC)
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to set Key Type")
+		return nil, fmt.Errorf("failed to set Key Type: %w", err)
 	}
 
 	return &ECDSAPublicKey{
@@ -29,7 +29,7 @@ func newECDSAPrivateKey(key *ecdsa.PrivateKey) (*ECDSAPrivateKey, error) {
 	var hdr StandardHeaders
 	err := hdr.Set(KeyTypeKey, jwa.EC)
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to set Key Type")
+		return nil, fmt.Errorf("failed to set Key Type: %w", err)
 	}
 
 	return &ECDSAPrivateKey{
@@ -54,7 +54,7 @@ func (k *ECDSAPublicKey) GenerateKey(keyJSON *RawKeyJSON) error {
 	var x, y big.Int
 
 	if keyJSON.X == nil || keyJSON.Y == nil || keyJSON.Crv == "" {
-		return errors.Errorf("Missing mandatory key parameters X, Y or Crv")
+		return errors.New("missing mandatory key parameters X, Y or Crv")
 	}
 
 	x.SetBytes(keyJSON.X.Bytes())
@@ -69,7 +69,7 @@ func (k *ECDSAPublicKey) GenerateKey(keyJSON *RawKeyJSON) error {
 	case jwa.P521:
 		curve = elliptic.P521()
 	default:
-		return errors.Errorf(`invalid curve name %s`, keyJSON.Crv)
+		return fmt.Errorf("invalid curve name %s", keyJSON.Crv)
 	}
 
 	*k = ECDSAPublicKey{
@@ -87,12 +87,12 @@ func (k *ECDSAPublicKey) GenerateKey(keyJSON *RawKeyJSON) error {
 func (k *ECDSAPrivateKey) GenerateKey(keyJSON *RawKeyJSON) error {
 
 	if keyJSON.D == nil {
-		return errors.Errorf("Missing mandatory key parameter D")
+		return errors.New("missing mandatory key parameter D")
 	}
 	eCDSAPublicKey := &ECDSAPublicKey{}
 	err := eCDSAPublicKey.GenerateKey(keyJSON)
 	if err != nil {
-		return errors.Wrap(err, `failed to generate public key`)
+		return fmt.Errorf("failed to generate public key: %w", err)
 	}
 	dBytes := keyJSON.D.Bytes()
 	// The length of this octet string MUST be ceiling(log-base-2(n)/8)
@@ -106,7 +106,7 @@ func (k *ECDSAPrivateKey) GenerateKey(keyJSON *RawKeyJSON) error {
 	n := eCDSAPublicKey.key.Params().N
 	octetLength := (new(big.Int).Sub(n, big.NewInt(1)).BitLen() + 7) >> 3
 	if octetLength-len(dBytes) != 0 {
-		return errors.Errorf("Failed to generate private key. Incorrect D value")
+		return errors.New("failed to generate private key. Incorrect D value")
 	}
 	privateKey := &ecdsa.PrivateKey{
 		PublicKey: *eCDSAPublicKey.key,
diff --git a/internal/jwx/jwk/headers.go b/internal/jwx/jwk/headers.go
index cf700ee864..b0fd51e901 100644
--- a/internal/jwx/jwk/headers.go
+++ b/internal/jwx/jwk/headers.go
@@ -1,7 +1,7 @@
 package jwk
 
 import (
-	"github.com/pkg/errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
@@ -122,7 +122,7 @@ func (h *StandardHeaders) Set(name string, value interface{}) error {
 	case AlgorithmKey:
 		var acceptor jwa.SignatureAlgorithm
 		if err := acceptor.Accept(value); err != nil {
-			return errors.Wrapf(err, `invalid value for %s key`, AlgorithmKey)
+			return fmt.Errorf("invalid value for %s key: %w", AlgorithmKey, err)
 		}
 		h.Algorithm = &acceptor
 		return nil
@@ -131,15 +131,15 @@ func (h *StandardHeaders) Set(name string, value interface{}) error {
 			h.KeyID = v
 			return nil
 		}
-		return errors.Errorf("invalid value for %s key: %T", KeyIDKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", KeyIDKey, value)
 	case KeyOpsKey:
 		if err := h.KeyOps.Accept(value); err != nil {
-			return errors.Wrapf(err, "invalid value for %s key", KeyOpsKey)
+			return fmt.Errorf("invalid value for %s key: %w", KeyOpsKey, err)
 		}
 		return nil
 	case KeyTypeKey:
 		if err := h.KeyType.Accept(value); err != nil {
-			return errors.Wrapf(err, "invalid value for %s key", KeyTypeKey)
+			return fmt.Errorf("invalid value for %s key: %w", KeyTypeKey, err)
 		}
 		return nil
 	case KeyUsageKey:
@@ -147,15 +147,15 @@ func (h *StandardHeaders) Set(name string, value interface{}) error {
 			h.KeyUsage = v
 			return nil
 		}
-		return errors.Errorf("invalid value for %s key: %T", KeyUsageKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", KeyUsageKey, value)
 	case PrivateParamsKey:
 		if v, ok := value.(map[string]interface{}); ok {
 			h.PrivateParams = v
 			return nil
 		}
-		return errors.Errorf("invalid value for %s key: %T", PrivateParamsKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", PrivateParamsKey, value)
 	default:
-		return errors.Errorf(`invalid key: %s`, name)
+		return fmt.Errorf("invalid key: %s", name)
 	}
 }
 
@@ -164,14 +164,14 @@ func (h StandardHeaders) Walk(f func(string, interface{}) error) error {
 	for _, key := range []string{AlgorithmKey, KeyIDKey, KeyOpsKey, KeyTypeKey, KeyUsageKey, PrivateParamsKey} {
 		if v, ok := h.Get(key); ok {
 			if err := f(key, v); err != nil {
-				return errors.Wrapf(err, `walk function returned error for %s`, key)
+				return fmt.Errorf("walk function returned error for %s: %w", key, err)
 			}
 		}
 	}
 
 	for k, v := range h.PrivateParams {
 		if err := f(k, v); err != nil {
-			return errors.Wrapf(err, `walk function returned error for %s`, k)
+			return fmt.Errorf("walk function returned error for %s: %w", k, err)
 		}
 	}
 	return nil
diff --git a/internal/jwx/jwk/jwk.go b/internal/jwx/jwk/jwk.go
index 22ccf8dfc6..aa22a3830f 100644
--- a/internal/jwx/jwk/jwk.go
+++ b/internal/jwx/jwk/jwk.go
@@ -5,8 +5,8 @@ import (
 	"crypto/ecdsa"
 	"crypto/rsa"
 	"encoding/json"
-
-	"github.com/pkg/errors"
+	"errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
@@ -17,7 +17,7 @@ import (
 // public key cannot be deduced, an error is returned
 func GetPublicKey(key interface{}) (interface{}, error) {
 	if key == nil {
-		return nil, errors.New(`jwk.New requires a non-nil key`)
+		return nil, errors.New("jwk.New requires a non-nil key")
 	}
 
 	switch v := key.(type) {
@@ -32,7 +32,7 @@ func GetPublicKey(key interface{}) (interface{}, error) {
 	case []byte:
 		return v, nil
 	default:
-		return nil, errors.Errorf(`invalid key type %T`, key)
+		return nil, fmt.Errorf("invalid key type %T", key)
 	}
 }
 
@@ -54,7 +54,7 @@ func GetKeyTypeFromKey(key interface{}) jwa.KeyType {
 // New creates a jwk.Key from the given key.
 func New(key interface{}) (Key, error) {
 	if key == nil {
-		return nil, errors.New(`jwk.New requires a non-nil key`)
+		return nil, errors.New("jwk.New requires a non-nil key")
 	}
 
 	switch v := key.(type) {
@@ -69,7 +69,7 @@ func New(key interface{}) (Key, error) {
 	case []byte:
 		return newSymmetricKey(v)
 	default:
-		return nil, errors.Errorf(`invalid key type %T`, key)
+		return nil, fmt.Errorf("invalid key type %T", key)
 	}
 }
 
@@ -80,7 +80,7 @@ func parse(jwkSrc string) (*Set, error) {
 	rawKeySetJSON := &RawKeySetJSON{}
 	err := json.Unmarshal([]byte(jwkSrc), rawKeySetJSON)
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to unmarshal JWK Set")
+		return nil, fmt.Errorf("failed to unmarshal JWK Set: %w", err)
 	}
 	if len(rawKeySetJSON.Keys) == 0 {
 
@@ -88,20 +88,23 @@ func parse(jwkSrc string) (*Set, error) {
 		rawKeyJSON := &RawKeyJSON{}
 		err := json.Unmarshal([]byte(jwkSrc), rawKeyJSON)
 		if err != nil {
-			return nil, errors.Wrap(err, "Failed to unmarshal JWK")
+			return nil, fmt.Errorf("failed to unmarshal JWK: %w", err)
 		}
 		jwkKey, err = rawKeyJSON.GenerateKey()
 		if err != nil {
-			return nil, errors.Wrap(err, "Failed to generate key")
+			return nil, fmt.Errorf("failed to generate key: %w", err)
 		}
 		// Add to set
 		jwkKeySet.Keys = append(jwkKeySet.Keys, jwkKey)
 	} else {
 		for i := range rawKeySetJSON.Keys {
 			rawKeyJSON := rawKeySetJSON.Keys[i]
+			if rawKeyJSON.Algorithm != nil && *rawKeyJSON.Algorithm == jwa.Unsupported {
+				continue
+			}
 			jwkKey, err = rawKeyJSON.GenerateKey()
 			if err != nil {
-				return nil, errors.Wrap(err, "Failed to generate key: %s")
+				return nil, fmt.Errorf("failed to generate key: %w", err)
 			}
 			jwkKeySet.Keys = append(jwkKeySet.Keys, jwkKey)
 		}
@@ -140,11 +143,11 @@ func (r *RawKeyJSON) GenerateKey() (Key, error) {
 	case jwa.OctetSeq:
 		key = &SymmetricKey{}
 	default:
-		return nil, errors.Errorf(`Unrecognized key type`)
+		return nil, errors.New("unrecognized key type")
 	}
 	err := key.GenerateKey(r)
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to generate key from JWK")
+		return nil, fmt.Errorf("failed to generate key from JWK: %w", err)
 	}
 	return key, nil
 }
diff --git a/internal/jwx/jwk/key_ops.go b/internal/jwx/jwk/key_ops.go
index 36d4dd3eab..e8fe4cd854 100644
--- a/internal/jwx/jwk/key_ops.go
+++ b/internal/jwx/jwk/key_ops.go
@@ -3,8 +3,6 @@ package jwk
 import (
 	"encoding/json"
 	"fmt"
-
-	"github.com/pkg/errors"
 )
 
 // KeyUsageType is used to denote what this key should be used for
@@ -46,7 +44,7 @@ func (keyOperationList *KeyOperationList) Accept(v interface{}) error {
 		*keyOperationList = x
 		return nil
 	default:
-		return errors.Errorf(`invalid value %T`, v)
+		return fmt.Errorf(`invalid value %T`, v)
 	}
 }
 
diff --git a/internal/jwx/jwk/rsa.go b/internal/jwx/jwk/rsa.go
index 1a5cba47b6..11b8e3b56b 100644
--- a/internal/jwx/jwk/rsa.go
+++ b/internal/jwx/jwk/rsa.go
@@ -3,10 +3,10 @@ package jwk
 import (
 	"crypto/rsa"
 	"encoding/binary"
+	"errors"
+	"fmt"
 	"math/big"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
 
@@ -15,7 +15,7 @@ func newRSAPublicKey(key *rsa.PublicKey) (*RSAPublicKey, error) {
 	var hdr StandardHeaders
 	err := hdr.Set(KeyTypeKey, jwa.RSA)
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to set Key Type")
+		return nil, fmt.Errorf("failed to set Key Type: %w", err)
 	}
 	return &RSAPublicKey{
 		StandardHeaders: &hdr,
@@ -28,7 +28,7 @@ func newRSAPrivateKey(key *rsa.PrivateKey) (*RSAPrivateKey, error) {
 	var hdr StandardHeaders
 	err := hdr.Set(KeyTypeKey, jwa.RSA)
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to set Key Type")
+		return nil, fmt.Errorf("failed to set Key Type: %w", err)
 	}
 
 	var algoParams jwa.AlgorithmParameters
@@ -67,7 +67,7 @@ func newRSAPrivateKey(key *rsa.PrivateKey) (*RSAPrivateKey, error) {
 // Materialize returns the standard RSA Public Key representation stored in the internal representation
 func (k *RSAPublicKey) Materialize() (interface{}, error) {
 	if k.key == nil {
-		return nil, errors.New(`key has no rsa.PublicKey associated with it`)
+		return nil, errors.New("key has no rsa.PublicKey associated with it")
 	}
 	return k.key, nil
 }
@@ -75,7 +75,7 @@ func (k *RSAPublicKey) Materialize() (interface{}, error) {
 // Materialize returns the standard RSA Private Key representation stored in the internal representation
 func (k *RSAPrivateKey) Materialize() (interface{}, error) {
 	if k.key == nil {
-		return nil, errors.New(`key has no rsa.PrivateKey associated with it`)
+		return nil, errors.New("key has no rsa.PrivateKey associated with it")
 	}
 	return k.key, nil
 }
@@ -84,7 +84,7 @@ func (k *RSAPrivateKey) Materialize() (interface{}, error) {
 func (k *RSAPublicKey) GenerateKey(keyJSON *RawKeyJSON) error {
 
 	if keyJSON.N == nil || keyJSON.E == nil {
-		return errors.Errorf("Missing mandatory key parameters N or E")
+		return errors.New("missing mandatory key parameters N or E")
 	}
 	rsaPublicKey := &rsa.PublicKey{
 		N: (&big.Int{}).SetBytes(keyJSON.N.Bytes()),
@@ -101,11 +101,11 @@ func (k *RSAPrivateKey) GenerateKey(keyJSON *RawKeyJSON) error {
 	rsaPublicKey := &RSAPublicKey{}
 	err := rsaPublicKey.GenerateKey(keyJSON)
 	if err != nil {
-		return errors.Wrap(err, "failed to generate public key")
+		return fmt.Errorf("failed to generate public key: %w", err)
 	}
 
 	if keyJSON.D == nil || keyJSON.P == nil || keyJSON.Q == nil {
-		return errors.Errorf("Missing mandatory key parameters D, P or Q")
+		return errors.New("missing mandatory key parameters D, P or Q")
 	}
 	privateKey := &rsa.PrivateKey{
 		PublicKey: *rsaPublicKey.key,
diff --git a/internal/jwx/jwk/symmetric.go b/internal/jwx/jwk/symmetric.go
index 8a07361556..e0cc0751e6 100644
--- a/internal/jwx/jwk/symmetric.go
+++ b/internal/jwx/jwk/symmetric.go
@@ -1,7 +1,7 @@
 package jwk
 
 import (
-	"github.com/pkg/errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
@@ -11,7 +11,7 @@ func newSymmetricKey(key []byte) (*SymmetricKey, error) {
 
 	err := hdr.Set(KeyTypeKey, jwa.OctetSeq)
 	if err != nil {
-		return nil, errors.Wrapf(err, "Failed to set Key Type")
+		return nil, fmt.Errorf("failed to set Key Type: %w", err)
 	}
 	return &SymmetricKey{
 		StandardHeaders: &hdr,
diff --git a/internal/jwx/jwk/symmetric_test.go b/internal/jwx/jwk/symmetric_test.go
index c31ba7006e..f8ca50b50c 100644
--- a/internal/jwx/jwk/symmetric_test.go
+++ b/internal/jwx/jwk/symmetric_test.go
@@ -45,7 +45,7 @@ func TestSymmetric(t *testing.T) {
 }`)
 		var jwkKey jwk.Key
 		rawKeySetJSON := &jwk.RawKeySetJSON{}
-		err = json.Unmarshal([]byte(jwkSrc), rawKeySetJSON)
+		err = json.Unmarshal(jwkSrc, rawKeySetJSON)
 		if err != nil {
 			t.Fatalf("Failed to unmarshal JWK Set: %s", err.Error())
 		}
@@ -96,7 +96,7 @@ func TestSymmetric(t *testing.T) {
   ]
 }`)
 		rawKeySetJSON := &jwk.RawKeySetJSON{}
-		err := json.Unmarshal([]byte(jwkSrc), rawKeySetJSON)
+		err := json.Unmarshal(jwkSrc, rawKeySetJSON)
 		if err != nil {
 			t.Fatalf("Failed to unmarshal JWK Set: %s", err.Error())
 		}
diff --git a/internal/jwx/jws/headers.go b/internal/jwx/jws/headers.go
index 045e38fa1e..0c8b355087 100644
--- a/internal/jwx/jws/headers.go
+++ b/internal/jwx/jws/headers.go
@@ -1,7 +1,7 @@
 package jws
 
 import (
-	"github.com/pkg/errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
@@ -103,7 +103,7 @@ func (h *StandardHeaders) Set(name string, value interface{}) error {
 	switch name {
 	case AlgorithmKey:
 		if err := h.Algorithm.Accept(value); err != nil {
-			return errors.Wrapf(err, `invalid value for %s key`, AlgorithmKey)
+			return fmt.Errorf("invalid value for %s key: %w", AlgorithmKey, err)
 		}
 		return nil
 	case ContentTypeKey:
@@ -111,44 +111,44 @@ func (h *StandardHeaders) Set(name string, value interface{}) error {
 			h.ContentType = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, ContentTypeKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", ContentTypeKey, value)
 	case CriticalKey:
 		if v, ok := value.([]string); ok {
 			h.Critical = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, CriticalKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", CriticalKey, value)
 	case JWKKey:
 		if v, ok := value.(string); ok {
 			h.JWK = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, JWKKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", JWKKey, value)
 	case JWKSetURLKey:
 		if v, ok := value.(string); ok {
 			h.JWKSetURL = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, JWKSetURLKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", JWKSetURLKey, value)
 	case KeyIDKey:
 		if v, ok := value.(string); ok {
 			h.KeyID = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, KeyIDKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", KeyIDKey, value)
 	case PrivateParamsKey:
 		if v, ok := value.(map[string]interface{}); ok {
 			h.PrivateParams = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, PrivateParamsKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", PrivateParamsKey, value)
 	case TypeKey:
 		if v, ok := value.(string); ok {
 			h.Type = v
 			return nil
 		}
-		return errors.Errorf(`invalid value for %s key: %T`, TypeKey, value)
+		return fmt.Errorf("invalid value for %s key: %T", TypeKey, value)
 	default:
-		return errors.Errorf(`invalid key: %s`, name)
+		return fmt.Errorf("invalid key: %s", name)
 	}
 }
diff --git a/internal/jwx/jws/headers_test.go b/internal/jwx/jws/headers_test.go
index cde814fcbe..7327972f03 100644
--- a/internal/jwx/jws/headers_test.go
+++ b/internal/jwx/jws/headers_test.go
@@ -112,9 +112,11 @@ func TestHeader(t *testing.T) {
 		headers := `{"typ":"JWT",` + "\r\n" + ` "alg":"dummy"}`
 		var standardHeaders jws.StandardHeaders
 		err := json.Unmarshal([]byte(headers), &standardHeaders)
-		if err == nil {
-			t.Fatal("Unmarshal should have failed")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if standardHeaders.Algorithm != jwa.Unsupported {
+			t.Errorf("expected unsupported algorithm")
 		}
-
 	})
 }
diff --git a/internal/jwx/jws/jws.go b/internal/jwx/jws/jws.go
index bfa498bb0f..2a5fe3c173 100644
--- a/internal/jwx/jws/jws.go
+++ b/internal/jwx/jws/jws.go
@@ -4,8 +4,8 @@
 // If you do not care about the details, the only things that you
 // would need to use are the following functions:
 //
-//     jws.SignWithOption(Payload, algorithm, key)
-//     jws.Verify(encodedjws, algorithm, key)
+//	jws.SignWithOption(Payload, algorithm, key)
+//	jws.Verify(encodedjws, algorithm, key)
 //
 // To sign, simply use `jws.SignWithOption`. `Payload` is a []byte buffer that
 // contains whatever data you want to sign. `alg` is one of the
@@ -24,6 +24,8 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"io"
 	"strings"
 
@@ -31,14 +33,11 @@ import (
 	"github.com/open-policy-agent/opa/internal/jwx/jwk"
 	"github.com/open-policy-agent/opa/internal/jwx/jws/sign"
 	"github.com/open-policy-agent/opa/internal/jwx/jws/verify"
-
-	"github.com/pkg/errors"
 )
 
 // SignLiteral generates a Signature for the given Payload and Headers, and serializes
 // it in compact serialization format. In this format you may NOT use
 // multiple signers.
-//
 func SignLiteral(payload []byte, alg jwa.SignatureAlgorithm, key interface{}, hdrBuf []byte, rnd io.Reader) ([]byte, error) {
 	encodedHdr := base64.RawURLEncoding.EncodeToString(hdrBuf)
 	encodedPayload := base64.RawURLEncoding.EncodeToString(payload)
@@ -50,7 +49,7 @@ func SignLiteral(payload []byte, alg jwa.SignatureAlgorithm, key interface{}, hd
 	)
 	signer, err := sign.New(alg)
 	if err != nil {
-		return nil, errors.Wrap(err, `failed to create signer`)
+		return nil, fmt.Errorf("failed to create signer: %w", err)
 	}
 
 	var signature []byte
@@ -61,7 +60,7 @@ func SignLiteral(payload []byte, alg jwa.SignatureAlgorithm, key interface{}, hd
 		signature, err = signer.Sign([]byte(signingInput), key)
 	}
 	if err != nil {
-		return nil, errors.Wrap(err, `failed to sign Payload`)
+		return nil, fmt.Errorf("failed to sign Payload: %w", err)
 	}
 	encodedSignature := base64.RawURLEncoding.EncodeToString(signature)
 	compactSerialization := strings.Join(
@@ -83,12 +82,12 @@ func SignWithOption(payload []byte, alg jwa.SignatureAlgorithm, key interface{})
 
 	err := headers.Set(AlgorithmKey, alg)
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to set alg value")
+		return nil, fmt.Errorf("failed to set alg value: %w", err)
 	}
 
 	hdrBuf, err := json.Marshal(headers)
 	if err != nil {
-		return nil, errors.Wrap(err, `failed to marshal Headers`)
+		return nil, fmt.Errorf("failed to marshal Headers: %w", err)
 	}
 	// NOTE(sr): we don't use SignWithOption -- if we did, this rand.Reader
 	// should come from the BuiltinContext's Seed, too.
@@ -104,7 +103,7 @@ func Verify(buf []byte, alg jwa.SignatureAlgorithm, key interface{}) (ret []byte
 
 	verifier, err := verify.New(alg)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create verifier")
+		return nil, fmt.Errorf("failed to create verifier: %w", err)
 	}
 
 	buf = bytes.TrimSpace(buf)
@@ -114,7 +113,7 @@ func Verify(buf []byte, alg jwa.SignatureAlgorithm, key interface{}) (ret []byte
 
 	parts, err := SplitCompact(string(buf[:]))
 	if err != nil {
-		return nil, errors.Wrap(err, `failed extract from compact serialization format`)
+		return nil, fmt.Errorf("failed extract from compact serialization format: %w", err)
 	}
 
 	signingInput := strings.Join(
@@ -126,16 +125,16 @@ func Verify(buf []byte, alg jwa.SignatureAlgorithm, key interface{}) (ret []byte
 
 	decodedSignature, err := base64.RawURLEncoding.DecodeString(parts[2])
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to decode signature")
+		return nil, fmt.Errorf("failed to decode signature: %w", err)
 	}
 	if err := verifier.Verify([]byte(signingInput), decodedSignature, key); err != nil {
-		return nil, errors.Wrap(err, "Failed to verify message")
+		return nil, fmt.Errorf("failed to verify message: %w", err)
 	}
 
 	if decodedPayload, err := base64.RawURLEncoding.DecodeString(parts[1]); err == nil {
 		return decodedPayload, nil
 	}
-	return nil, errors.Wrap(err, "Failed to decode Payload")
+	return nil, fmt.Errorf("failed to decode Payload: %w", err)
 }
 
 // VerifyWithJWK verifies the JWS message using the specified JWK
@@ -143,7 +142,7 @@ func VerifyWithJWK(buf []byte, key jwk.Key) (payload []byte, err error) {
 
 	keyVal, err := key.Materialize()
 	if err != nil {
-		return nil, errors.Wrap(err, "Failed to materialize key")
+		return nil, fmt.Errorf("failed to materialize key: %w", err)
 	}
 	return Verify(buf, key.GetAlgorithm(), keyVal)
 }
@@ -179,7 +178,7 @@ func SplitCompact(jwsCompact string) ([]string, error) {
 
 	parts := strings.Split(jwsCompact, ".")
 	if len(parts) < 3 {
-		return nil, errors.New("Failed to split compact serialization")
+		return nil, errors.New("failed to split compact serialization")
 	}
 	return parts, nil
 }
@@ -190,24 +189,24 @@ func parseCompact(str string) (m *Message, err error) {
 	var decodedHeader, decodedPayload, decodedSignature []byte
 	parts, err := SplitCompact(str)
 	if err != nil {
-		return nil, errors.Wrap(err, `invalid compact serialization format`)
+		return nil, fmt.Errorf("invalid compact serialization format: %w", err)
 	}
 
 	if decodedHeader, err = base64.RawURLEncoding.DecodeString(parts[0]); err != nil {
-		return nil, errors.Wrap(err, `failed to decode Headers`)
+		return nil, fmt.Errorf("failed to decode Headers: %w", err)
 	}
 	var hdr StandardHeaders
 	if err := json.Unmarshal(decodedHeader, &hdr); err != nil {
-		return nil, errors.Wrap(err, `failed to parse JOSE Headers`)
+		return nil, fmt.Errorf("failed to parse JOSE Headers: %w", err)
 	}
 
 	if decodedPayload, err = base64.RawURLEncoding.DecodeString(parts[1]); err != nil {
-		return nil, errors.Wrap(err, `failed to decode Payload`)
+		return nil, fmt.Errorf("failed to decode Payload: %w", err)
 	}
 
 	if len(parts) > 2 {
 		if decodedSignature, err = base64.RawURLEncoding.DecodeString(parts[2]); err != nil {
-			return nil, errors.Wrap(err, `failed to decode Signature`)
+			return nil, fmt.Errorf("failed to decode Signature: %w", err)
 		}
 	}
 
diff --git a/internal/jwx/jws/jws_test.go b/internal/jwx/jws/jws_test.go
index 815210db86..3a694d4814 100644
--- a/internal/jwx/jws/jws_test.go
+++ b/internal/jwx/jws/jws_test.go
@@ -82,8 +82,11 @@ func TestAlgError(t *testing.T) {
 		const hdr = `{"typ":"JWT",` + "\r\n" + ` "alg":"unknown"}`
 		var standardHeaders jws.StandardHeaders
 		err := json.Unmarshal([]byte(hdr), &standardHeaders)
-		if err == nil {
-			t.Fatal("header parsing should have failed")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if standardHeaders.Algorithm != jwa.Unsupported {
+			t.Errorf("expected unsupported algorithm")
 		}
 	})
 }
diff --git a/internal/jwx/jws/sign/ecdsa.go b/internal/jwx/jws/sign/ecdsa.go
index 62af72b6c1..db1aadec67 100644
--- a/internal/jwx/jws/sign/ecdsa.go
+++ b/internal/jwx/jws/sign/ecdsa.go
@@ -4,11 +4,11 @@ import (
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/rand"
+	"errors"
+	"fmt"
 	"io"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
-
-	"github.com/pkg/errors"
 )
 
 var ecdsaSignFuncs = map[jwa.SignatureAlgorithm]ecdsaSignFunc{}
@@ -37,7 +37,7 @@ func makeECDSASignFunc(hash crypto.Hash) ecdsaSignFunc {
 		h.Write(payload)
 		r, s, err := ecdsa.Sign(rnd, key, h.Sum(nil))
 		if err != nil {
-			return nil, errors.Wrap(err, "failed to sign payload using ecdsa")
+			return nil, fmt.Errorf("failed to sign payload using ecdsa: %w", err)
 		}
 
 		rBytes := r.Bytes()
@@ -56,7 +56,7 @@ func makeECDSASignFunc(hash crypto.Hash) ecdsaSignFunc {
 func newECDSA(alg jwa.SignatureAlgorithm) (*ECDSASigner, error) {
 	signfn, ok := ecdsaSignFuncs[alg]
 	if !ok {
-		return nil, errors.Errorf(`unsupported algorithm while trying to create ECDSA signer: %s`, alg)
+		return nil, fmt.Errorf("unsupported algorithm while trying to create ECDSA signer: %s", alg)
 	}
 
 	return &ECDSASigner{
@@ -74,12 +74,12 @@ func (s ECDSASigner) Algorithm() jwa.SignatureAlgorithm {
 // source (such as `rand.Reader`).
 func (s ECDSASigner) SignWithRand(payload []byte, key interface{}, r io.Reader) ([]byte, error) {
 	if key == nil {
-		return nil, errors.New(`missing private key while signing payload`)
+		return nil, errors.New("missing private key while signing payload")
 	}
 
 	privateKey, ok := key.(*ecdsa.PrivateKey)
 	if !ok {
-		return nil, errors.Errorf(`invalid key type %T. *ecdsa.PrivateKey is required`, key)
+		return nil, fmt.Errorf("invalid key type %T. *ecdsa.PrivateKey is required", key)
 	}
 	return s.sign(payload, privateKey, r)
 }
diff --git a/internal/jwx/jws/sign/hmac.go b/internal/jwx/jws/sign/hmac.go
index cbf7b9f0a1..a4fad4208b 100644
--- a/internal/jwx/jws/sign/hmac.go
+++ b/internal/jwx/jws/sign/hmac.go
@@ -4,11 +4,11 @@ import (
 	"crypto/hmac"
 	"crypto/sha256"
 	"crypto/sha512"
+	"errors"
+	"fmt"
 	"hash"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
-
-	"github.com/pkg/errors"
 )
 
 var hmacSignFuncs = map[jwa.SignatureAlgorithm]hmacSignFunc{}
@@ -29,7 +29,7 @@ func init() {
 func newHMAC(alg jwa.SignatureAlgorithm) (*HMACSigner, error) {
 	signer, ok := hmacSignFuncs[alg]
 	if !ok {
-		return nil, errors.Errorf(`unsupported algorithm while trying to create HMAC signer: %s`, alg)
+		return nil, fmt.Errorf(`unsupported algorithm while trying to create HMAC signer: %s`, alg)
 	}
 
 	return &HMACSigner{
@@ -55,7 +55,7 @@ func (s HMACSigner) Algorithm() jwa.SignatureAlgorithm {
 func (s HMACSigner) Sign(payload []byte, key interface{}) ([]byte, error) {
 	hmackey, ok := key.([]byte)
 	if !ok {
-		return nil, errors.Errorf(`invalid key type %T. []byte is required`, key)
+		return nil, fmt.Errorf(`invalid key type %T. []byte is required`, key)
 	}
 
 	if len(hmackey) == 0 {
diff --git a/internal/jwx/jws/sign/rsa.go b/internal/jwx/jws/sign/rsa.go
index bc51dbcd03..1e02993eb0 100644
--- a/internal/jwx/jws/sign/rsa.go
+++ b/internal/jwx/jws/sign/rsa.go
@@ -4,10 +4,10 @@ import (
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
+	"errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
-
-	"github.com/pkg/errors"
 )
 
 var rsaSignFuncs = map[jwa.SignatureAlgorithm]rsaSignFunc{}
@@ -69,7 +69,7 @@ func makeSignPSS(hash crypto.Hash) rsaSignFunc {
 func newRSA(alg jwa.SignatureAlgorithm) (*RSASigner, error) {
 	signfn, ok := rsaSignFuncs[alg]
 	if !ok {
-		return nil, errors.Errorf(`unsupported algorithm while trying to create RSA signer: %s`, alg)
+		return nil, fmt.Errorf(`unsupported algorithm while trying to create RSA signer: %s`, alg)
 	}
 	return &RSASigner{
 		alg:  alg,
@@ -90,7 +90,7 @@ func (s RSASigner) Sign(payload []byte, key interface{}) ([]byte, error) {
 	}
 	rsakey, ok := key.(*rsa.PrivateKey)
 	if !ok {
-		return nil, errors.Errorf(`invalid key type %T. *rsa.PrivateKey is required`, key)
+		return nil, fmt.Errorf(`invalid key type %T. *rsa.PrivateKey is required`, key)
 	}
 
 	return s.sign(payload, rsakey)
diff --git a/internal/jwx/jws/sign/sign.go b/internal/jwx/jws/sign/sign.go
index ec88060681..7db7bbd69c 100644
--- a/internal/jwx/jws/sign/sign.go
+++ b/internal/jwx/jws/sign/sign.go
@@ -5,8 +5,6 @@ import (
 	"encoding/pem"
 	"fmt"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
 
@@ -20,7 +18,7 @@ func New(alg jwa.SignatureAlgorithm) (Signer, error) {
 	case jwa.HS256, jwa.HS384, jwa.HS512:
 		return newHMAC(alg)
 	default:
-		return nil, errors.Errorf(`unsupported signature algorithm %s`, alg)
+		return nil, fmt.Errorf(`unsupported signature algorithm %s`, alg)
 	}
 }
 
@@ -62,6 +60,6 @@ func GetSigningKey(key string, alg jwa.SignatureAlgorithm) (interface{}, error)
 	case jwa.HS256, jwa.HS384, jwa.HS512:
 		return []byte(key), nil
 	default:
-		return nil, errors.Errorf("unsupported signature algorithm: %s", alg)
+		return nil, fmt.Errorf("unsupported signature algorithm: %s", alg)
 	}
 }
diff --git a/internal/jwx/jws/verify/ecdsa.go b/internal/jwx/jws/verify/ecdsa.go
index e71dc6f8f5..0d4971dc19 100644
--- a/internal/jwx/jws/verify/ecdsa.go
+++ b/internal/jwx/jws/verify/ecdsa.go
@@ -3,10 +3,10 @@ package verify
 import (
 	"crypto"
 	"crypto/ecdsa"
+	"errors"
+	"fmt"
 	"math/big"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
 
@@ -45,7 +45,7 @@ func makeECDSAVerifyFunc(hash crypto.Hash) ecdsaVerifyFunc {
 func newECDSA(alg jwa.SignatureAlgorithm) (*ECDSAVerifier, error) {
 	verifyfn, ok := ecdsaVerifyFuncs[alg]
 	if !ok {
-		return nil, errors.Errorf(`unsupported algorithm while trying to create ECDSA verifier: %s`, alg)
+		return nil, fmt.Errorf(`unsupported algorithm while trying to create ECDSA verifier: %s`, alg)
 	}
 
 	return &ECDSAVerifier{
@@ -60,7 +60,7 @@ func (v ECDSAVerifier) Verify(payload []byte, signature []byte, key interface{})
 	}
 	ecdsakey, ok := key.(*ecdsa.PublicKey)
 	if !ok {
-		return errors.Errorf(`invalid key type %T. *ecdsa.PublicKey is required`, key)
+		return fmt.Errorf(`invalid key type %T. *ecdsa.PublicKey is required`, key)
 	}
 
 	return v.verify(payload, signature, ecdsakey)
diff --git a/internal/jwx/jws/verify/hmac.go b/internal/jwx/jws/verify/hmac.go
index 77e45887ae..d8498f50f2 100644
--- a/internal/jwx/jws/verify/hmac.go
+++ b/internal/jwx/jws/verify/hmac.go
@@ -2,8 +2,8 @@ package verify
 
 import (
 	"crypto/hmac"
-
-	"github.com/pkg/errors"
+	"errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 	"github.com/open-policy-agent/opa/internal/jwx/jws/sign"
@@ -13,7 +13,7 @@ func newHMAC(alg jwa.SignatureAlgorithm) (*HMACVerifier, error) {
 
 	s, err := sign.New(alg)
 	if err != nil {
-		return nil, errors.Wrap(err, `failed to generate HMAC signer`)
+		return nil, fmt.Errorf("failed to generate HMAC signer: %w", err)
 	}
 	return &HMACVerifier{signer: s}, nil
 }
@@ -23,11 +23,11 @@ func (v HMACVerifier) Verify(signingInput, signature []byte, key interface{}) (e
 
 	expected, err := v.signer.Sign(signingInput, key)
 	if err != nil {
-		return errors.Wrap(err, `failed to generated signature`)
+		return fmt.Errorf("failed to generated signature: %w", err)
 	}
 
 	if !hmac.Equal(signature, expected) {
-		return errors.New(`failed to match hmac signature`)
+		return errors.New("failed to match hmac signature")
 	}
 	return nil
 }
diff --git a/internal/jwx/jws/verify/rsa.go b/internal/jwx/jws/verify/rsa.go
index 8188ceb1fe..edc560dfa6 100644
--- a/internal/jwx/jws/verify/rsa.go
+++ b/internal/jwx/jws/verify/rsa.go
@@ -3,10 +3,10 @@ package verify
 import (
 	"crypto"
 	"crypto/rsa"
+	"errors"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
-
-	"github.com/pkg/errors"
 )
 
 var rsaVerifyFuncs = map[jwa.SignatureAlgorithm]rsaVerifyFunc{}
@@ -66,7 +66,7 @@ func makeVerifyPSS(hash crypto.Hash) rsaVerifyFunc {
 func newRSA(alg jwa.SignatureAlgorithm) (*RSAVerifier, error) {
 	verifyfn, ok := rsaVerifyFuncs[alg]
 	if !ok {
-		return nil, errors.Errorf(`unsupported algorithm while trying to create RSA verifier: %s`, alg)
+		return nil, fmt.Errorf(`unsupported algorithm while trying to create RSA verifier: %s`, alg)
 	}
 
 	return &RSAVerifier{
@@ -81,7 +81,7 @@ func (v RSAVerifier) Verify(payload, signature []byte, key interface{}) error {
 	}
 	rsaKey, ok := key.(*rsa.PublicKey)
 	if !ok {
-		return errors.Errorf(`invalid key type %T. *rsa.PublicKey is required`, key)
+		return fmt.Errorf(`invalid key type %T. *rsa.PublicKey is required`, key)
 	}
 
 	return v.verify(payload, signature, rsaKey)
diff --git a/internal/jwx/jws/verify/verify.go b/internal/jwx/jws/verify/verify.go
index 1bb3bf83a9..05720a64e0 100644
--- a/internal/jwx/jws/verify/verify.go
+++ b/internal/jwx/jws/verify/verify.go
@@ -7,8 +7,6 @@ import (
 	"encoding/pem"
 	"fmt"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 )
 
@@ -23,7 +21,7 @@ func New(alg jwa.SignatureAlgorithm) (Verifier, error) {
 	case jwa.HS256, jwa.HS384, jwa.HS512:
 		return newHMAC(alg)
 	default:
-		return nil, errors.Errorf(`unsupported signature algorithm: %s`, alg)
+		return nil, fmt.Errorf(`unsupported signature algorithm: %s`, alg)
 	}
 }
 
@@ -52,6 +50,6 @@ func GetSigningKey(key string, alg jwa.SignatureAlgorithm) (interface{}, error)
 	case jwa.HS256, jwa.HS384, jwa.HS512:
 		return []byte(key), nil
 	default:
-		return nil, errors.Errorf("unsupported signature algorithm: %s", alg)
+		return nil, fmt.Errorf("unsupported signature algorithm: %s", alg)
 	}
 }
diff --git a/internal/logging/logging.go b/internal/logging/logging.go
index 5d07b06d2f..f97686cf44 100644
--- a/internal/logging/logging.go
+++ b/internal/logging/logging.go
@@ -11,16 +11,33 @@ import (
 	"strings"
 
 	"github.com/sirupsen/logrus"
+
+	"github.com/open-policy-agent/opa/logging"
 )
 
-func GetFormatter(format string) logrus.Formatter {
+func GetLevel(level string) (logging.Level, error) {
+	switch strings.ToLower(level) {
+	case "debug":
+		return logging.Debug, nil
+	case "", "info":
+		return logging.Info, nil
+	case "warn":
+		return logging.Warn, nil
+	case "error":
+		return logging.Error, nil
+	default:
+		return logging.Debug, fmt.Errorf("invalid log level: %v", level)
+	}
+}
+
+func GetFormatter(format, timestampFormat string) logrus.Formatter {
 	switch format {
 	case "text":
 		return &prettyFormatter{}
 	case "json-pretty":
-		return &logrus.JSONFormatter{PrettyPrint: true}
+		return &logrus.JSONFormatter{PrettyPrint: true, TimestampFormat: timestampFormat}
 	default:
-		return &logrus.JSONFormatter{}
+		return &logrus.JSONFormatter{TimestampFormat: timestampFormat}
 	}
 }
 
diff --git a/internal/oracle/oracle.go b/internal/oracle/oracle.go
index af2fca93ed..e3eb3afa1a 100644
--- a/internal/oracle/oracle.go
+++ b/internal/oracle/oracle.go
@@ -52,6 +52,8 @@ func (o *Oracle) FindDefinition(q DefinitionQuery) (*DefinitionQueryResult, erro
 	// TODO(tsandall): how can we cache the results of compilation and parsing so that
 	// multiple queries can be executed without having to re-compute the same values?
 	// Ditto for caching across runs. Avoid repeating the same work.
+
+	// NOTE(sr): "SetRuleTree" because it's needed for compiler.GetRulesExact() below
 	compiler, parsed, err := compileUpto("SetRuleTree", q.Modules, q.Buffer, q.Filename)
 	if err != nil {
 		return nil, err
@@ -220,7 +222,8 @@ func getLocMinMax(x ast.Node) (int, int) {
 
 	// Special case bodies because location text is only for the first expr.
 	if body, ok := x.(ast.Body); ok {
-		extraLoc := body[len(body)-1].Loc()
+		last := findLastExpr(body)
+		extraLoc := last.Loc()
 		if extraLoc == nil {
 			return -1, -1
 		}
@@ -229,3 +232,20 @@ func getLocMinMax(x ast.Node) (int, int) {
 
 	return min, min + len(loc.Text)
 }
+
+// findLastExpr returns the last expression in an ast.Body that has not been generated
+// by the compiler. It's used to cope with the fact that a compiler stage before SetRuleTree
+// has rewritten the rule bodies slightly. By ignoring appended generated body expressions,
+// we can still use the "circling in on the variable" logic based on node locations.
+func findLastExpr(body ast.Body) *ast.Expr {
+	for i := len(body) - 1; i >= 0; i-- {
+		if !body[i].Generated {
+			return body[i]
+		}
+	}
+	// NOTE(sr): I believe this shouldn't happen -- we only ever start circling in on a node
+	// inside a body if there's something in that body. A body that only consists of generated
+	// expressions should not appear here. Either way, the caller deals with `nil` returned by
+	// this helper.
+	return nil
+}
diff --git a/internal/oracle/oracle_test.go b/internal/oracle/oracle_test.go
index 55636734a0..f75472a72b 100644
--- a/internal/oracle/oracle_test.go
+++ b/internal/oracle/oracle_test.go
@@ -158,6 +158,13 @@ y[1]
 s = input
 bar = 7`
 
+	// NOTE(sr): Early ref rewriting adds an expression to the rule body for `x.y`
+	const varInRuleRefModule = `package foo
+q[x.y] = 10 {
+	x := input
+	some z
+	z = 1
+}`
 	cases := []struct {
 		note    string
 		modules map[string]string
@@ -350,6 +357,20 @@ bar = 7`
 				Text:   []byte("i"),
 			},
 		},
+		{
+			note: "intra-rule: ref head",
+			modules: map[string]string{
+				"buffer.rego": varInRuleRefModule,
+			},
+			pos: 47, // "z" in "z = 1"
+			exp: &ast.Location{
+				File:   "buffer.rego",
+				Row:    4,
+				Col:    7,
+				Offset: 44,
+				Text:   []byte("z"),
+			},
+		},
 	}
 
 	for _, tc := range cases {
@@ -362,10 +383,20 @@ bar = 7`
 					t.Fatal(err)
 				}
 			}
+			buffer := tc.modules["buffer.rego"]
+			before := tc.pos - 4
+			if before < 0 {
+				before = 0
+			}
+			after := tc.pos + 5
+			if after > len(buffer) {
+				after = len(buffer)
+			}
+			t.Logf("pos is %d: \"%s<%s>%s\"", tc.pos, buffer[before:tc.pos], string(buffer[tc.pos]), buffer[tc.pos+1:after])
 			o := New()
 			result, err := o.FindDefinition(DefinitionQuery{
 				Modules:  modules,
-				Buffer:   []byte(tc.modules["buffer.rego"]),
+				Buffer:   []byte(buffer),
 				Filename: "buffer.rego",
 				Pos:      tc.pos,
 			})
diff --git a/internal/planner/planner.go b/internal/planner/planner.go
index f3835f477f..75e286b60d 100644
--- a/internal/planner/planner.go
+++ b/internal/planner/planner.go
@@ -14,7 +14,7 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/ast/location"
 	"github.com/open-policy-agent/opa/internal/debug"
-	"github.com/open-policy-agent/opa/internal/ir"
+	"github.com/open-policy-agent/opa/ir"
 )
 
 // QuerySet represents the input to the planner.
@@ -36,11 +36,12 @@ type Planner struct {
 	externs map[string]*ast.Builtin // built-in functions that are required in execution environment
 	decls   map[string]*ast.Builtin // built-in functions that may be provided in execution environment
 	rules   *ruletrie               // rules that may be planned
+	mocks   *functionMocksStack     // replacements for built-in functions
 	funcs   *funcstack              // functions that have been planned
 	plan    *ir.Plan                // in-progress query plan
 	curr    *ir.Block               // in-progress query block
 	vars    *varstack               // in-scope variables
-	ltarget ir.LocalOrConst         // target variable or constant of last planned statement
+	ltarget ir.Operand              // target variable or constant of last planned statement
 	lnext   ir.Local                // next variable to use
 	loc     *location.Location      // location currently "being planned"
 	debug   debug.Debug             // debug information produced during planning
@@ -76,6 +77,7 @@ func New() *Planner {
 		}),
 		rules: newRuletrie(),
 		funcs: newFuncstack(),
+		mocks: newFunctionMocksStack(),
 		debug: debug.Discard(),
 	}
 }
@@ -145,24 +147,48 @@ func (p *Planner) buildFunctrie() error {
 		}
 
 		for _, rule := range module.Rules {
-			val := p.rules.LookupOrInsert(rule.Path())
+			r := rule.Ref()
+			switch r[len(r)-1].Value.(type) {
+			case ast.String: // pass
+			default: // cut off
+				r = r[:len(r)-1]
+			}
+			val := p.rules.LookupOrInsert(r)
 			val.rules = append(val.rules, rule)
 		}
 	}
-
 	return nil
 }
 
 func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
-
-	pathRef := rules[0].Path()
-	path := pathRef.String()
+	pathRef := rules[0].Ref()
+
+	// figure out what our rules' collective name/path is:
+	// if we're planning both p.q.r and p.q[s], we'll name
+	// the function p.q (for the mapping table)
+	// TODO(sr): this has to change when allowing `p[v].q.r[w]` ref rules
+	// including the mapping lookup structure and lookup functions
+	pieces := len(pathRef)
+	for i := range rules {
+		r := rules[i].Ref()
+		if _, ok := r[len(r)-1].Value.(ast.String); !ok {
+			pieces = len(r) - 1
+		}
+	}
+	// control if p.a = 1 is to return 1 directly; or insert 1 under key "a" into an object
+	buildObject := pieces != len(pathRef)
 
 	var pathPieces []string
-	for i := 1; /* skip `data` */ i < len(pathRef); i++ {
-		pathPieces = append(pathPieces, string(pathRef[i].Value.(ast.String)))
+	for i := 1; /* skip `data` */ i < pieces; i++ {
+		switch q := pathRef[i].Value.(type) {
+		case ast.String:
+			pathPieces = append(pathPieces, string(q))
+		default:
+			panic("impossible")
+		}
 	}
 
+	path := pathRef[:pieces].String()
 	if funcName, ok := p.funcs.Get(path); ok {
 		return funcName, nil
 	}
@@ -204,10 +230,12 @@ func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
 
 	// Initialize return value for partial set/object rules. Complete document
 	// rules assign directly to `fn.Return`.
-	switch rules[0].Head.DocKind() {
-	case ast.PartialObjectDoc:
-		fn.Blocks = append(fn.Blocks, p.blockWithStmt(&ir.MakeObjectStmt{Target: fn.Return}))
-	case ast.PartialSetDoc:
+	switch rules[0].Head.RuleKind() {
+	case ast.SingleValue:
+		if buildObject {
+			fn.Blocks = append(fn.Blocks, p.blockWithStmt(&ir.MakeObjectStmt{Target: fn.Return}))
+		}
+	case ast.MultiValue:
 		fn.Blocks = append(fn.Blocks, p.blockWithStmt(&ir.MakeSetStmt{Target: fn.Return}))
 	}
 
@@ -277,6 +305,7 @@ func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
 				p.appendStmt(&ir.IsUndefinedStmt{Source: lresult})
 			} else {
 				// The first rule body resets the local, so it can be reused.
+				// TODO(sr): I don't think we need this anymore. Double-check? Perhaps multi-value rules need it.
 				p.appendStmt(&ir.ResetLocalStmt{Target: lresult})
 			}
 
@@ -285,11 +314,27 @@ func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
 			err := p.planFuncParams(params, rule.Head.Args, 0, func() error {
 
 				// Run planner on the rule body.
-				err := p.planQuery(rule.Body, 0, func() error {
+				return p.planQuery(rule.Body, 0, func() error {
 
 					// Run planner on the result.
-					switch rule.Head.DocKind() {
-					case ast.CompleteDoc:
+					switch rule.Head.RuleKind() {
+					case ast.SingleValue:
+						if buildObject {
+							ref := rule.Head.Ref()
+							last := ref[len(ref)-1]
+							return p.planTerm(last, func() error {
+								key := p.ltarget
+								return p.planTerm(rule.Head.Value, func() error {
+									value := p.ltarget
+									p.appendStmt(&ir.ObjectInsertOnceStmt{
+										Object: fn.Return,
+										Key:    key,
+										Value:  value,
+									})
+									return nil
+								})
+							})
+						}
 						return p.planTerm(rule.Head.Value, func() error {
 							p.appendStmt(&ir.AssignVarOnceStmt{
 								Target: lresult,
@@ -297,7 +342,7 @@ func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
 							})
 							return nil
 						})
-					case ast.PartialSetDoc:
+					case ast.MultiValue:
 						return p.planTerm(rule.Head.Key, func() error {
 							p.appendStmt(&ir.SetAddStmt{
 								Set:   fn.Return,
@@ -305,29 +350,10 @@ func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
 							})
 							return nil
 						})
-					case ast.PartialObjectDoc:
-						return p.planTerm(rule.Head.Key, func() error {
-							key := p.ltarget
-							return p.planTerm(rule.Head.Value, func() error {
-								value := p.ltarget
-								p.appendStmt(&ir.ObjectInsertOnceStmt{
-									Object: fn.Return,
-									Key:    key,
-									Value:  value,
-								})
-								return nil
-							})
-						})
 					default:
 						return fmt.Errorf("illegal rule kind")
 					}
 				})
-
-				if err != nil {
-					return err
-				}
-
-				return nil
 			})
 
 			if err != nil {
@@ -336,13 +362,13 @@ func (p *Planner) planRules(rules []*ast.Rule) (string, error) {
 		}
 
 		// rule[i] and its else-rule(s), if present, are done
-		if rules[i].Head.DocKind() == ast.CompleteDoc {
+		if rules[i].Head.RuleKind() == ast.SingleValue && !buildObject {
 			end := &ir.Block{}
 			p.appendStmtToBlock(&ir.IsDefinedStmt{Source: lresult}, end)
 			p.appendStmtToBlock(
 				&ir.AssignVarOnceStmt{
 					Target: fn.Return,
-					Source: lresult,
+					Source: op(lresult),
 				},
 				end)
 			*blocks = append(*blocks, end)
@@ -400,7 +426,7 @@ func (p *Planner) planFuncParams(params []ir.Local, args ast.Args, idx int, iter
 	if idx >= len(args) {
 		return iter()
 	}
-	return p.planUnifyLocal(params[idx], args[idx], func() error {
+	return p.planUnifyLocal(op(params[idx]), args[idx], func() error {
 		return p.planFuncParams(params, args, idx+1, iter)
 	})
 }
@@ -460,13 +486,13 @@ func (p *Planner) planQueries() error {
 					if !rw.IsGenerated() && !rw.IsWildcard() {
 						p.appendStmt(&ir.ObjectInsertStmt{
 							Object: lr,
-							Key:    lvarnames[rw],
-							Value:  p.vars.GetOrEmpty(qv),
+							Key:    op(lvarnames[rw]),
+							Value:  p.vars.GetOpOrEmpty(qv),
 						})
 					}
 				}
 
-				p.appendStmt(&ir.ResultSetAdd{
+				p.appendStmt(&ir.ResultSetAddStmt{
 					Value: lr,
 				})
 
@@ -514,16 +540,18 @@ func (p *Planner) planQuery(q ast.Body, index int, iter planiter) error {
 // TODO(tsandall): improve errors to include location information.
 func (p *Planner) planExpr(e *ast.Expr, iter planiter) error {
 
-	if e.Negated {
+	switch {
+	case e.Negated:
 		return p.planNot(e, iter)
-	}
 
-	if len(e.With) > 0 {
+	case len(e.With) > 0:
 		return p.planWith(e, iter)
-	}
 
-	if e.IsCall() {
+	case e.IsCall():
 		return p.planExprCall(e, iter)
+
+	case e.IsEvery():
+		return p.planExprEvery(e, iter)
 	}
 
 	return p.planExprTerm(e, iter)
@@ -549,23 +577,40 @@ func (p *Planner) planNot(e *ast.Expr, iter planiter) error {
 
 func (p *Planner) planWith(e *ast.Expr, iter planiter) error {
 
-	// Plan the values that will be applied by the with modifiers. All values
+	// Plan the values that will be applied by the `with` modifiers. All values
 	// must be defined for the overall expression to evaluate.
-	values := make([]*ast.Term, len(e.With))
+	values := make([]*ast.Term, 0, len(e.With)) // NOTE(sr): we could be overallocating if there are builtin replacements
+	targets := make([]ast.Ref, 0, len(e.With))
+
+	mocks := frame{}
+
+	for _, w := range e.With {
+		v := w.Target.Value.(ast.Ref)
+
+		switch {
+		case p.isFunction(v): // nothing to do
+
+		case ast.DefaultRootDocument.Equal(v[0]) ||
+			ast.InputRootDocument.Equal(v[0]):
+
+			values = append(values, w.Value)
+			targets = append(targets, w.Target.Value.(ast.Ref))
 
-	for i := range e.With {
-		values[i] = e.With[i].Value
+			continue // not a mock
+		}
+
+		mocks[w.Target.String()] = w.Value
 	}
 
-	return p.planTermSlice(values, func(locals []ir.LocalOrConst) error {
+	return p.planTermSlice(values, func(locals []ir.Operand) error {
+
+		p.mocks.PushFrame(mocks)
 
-		paths := make([][]int, len(e.With))
+		paths := make([][]int, len(targets))
 		saveVars := ast.NewVarSet()
 		dataRefs := []ast.Ref{}
 
-		for i := range e.With {
-
-			target := e.With[i].Target.Value.(ast.Ref)
+		for i, target := range targets {
 			paths[i] = make([]int, len(target)-1)
 
 			for j := 1; j < len(target); j++ {
@@ -589,15 +634,16 @@ func (p *Planner) planWith(e *ast.Expr, iter planiter) error {
 		for i, v := range saveVars.Sorted() {
 			lorig := p.vars.GetOrEmpty(v)
 			lsave := p.newLocal()
-			p.appendStmt(&ir.AssignVarStmt{Source: lorig, Target: lsave})
+			p.appendStmt(&ir.AssignVarStmt{Source: op(lorig), Target: lsave})
 			restore[i] = [2]ir.Local{lorig, lsave}
 		}
 
 		// If any of the `with` statements targeted the data document, overwriting
-		// parts of the ruletrie, we shadow the existing planned functions during
-		// expression planning. This causes the planner to re-plan any rules that
-		// may be required during planning of this expression (transitively).
-		shadowing := p.dataRefsShadowRuletrie(dataRefs)
+		// parts of the ruletrie; or if a function has been mocked, we shadow the
+		// existing planned functions during expression planning.
+		// This causes the planner to re-plan any rules that may be required during
+		// planning of this expression (transitively).
+		shadowing := p.dataRefsShadowRuletrie(dataRefs) || len(mocks) > 0
 		if shadowing {
 			p.funcs.Push(map[string]string{})
 			for _, ref := range dataRefs {
@@ -606,6 +652,7 @@ func (p *Planner) planWith(e *ast.Expr, iter planiter) error {
 		}
 
 		err := p.planWithRec(e, paths, locals, 0, func() error {
+			p.mocks.PopFrame()
 			if shadowing {
 				p.funcs.Pop()
 				for i := len(dataRefs) - 1; i >= 0; i-- {
@@ -617,6 +664,7 @@ func (p *Planner) planWith(e *ast.Expr, iter planiter) error {
 
 				err := iter()
 
+				p.mocks.PushFrame(mocks)
 				if shadowing {
 					p.funcs.Push(map[string]string{})
 					for _, ref := range dataRefs {
@@ -629,6 +677,7 @@ func (p *Planner) planWith(e *ast.Expr, iter planiter) error {
 			return err
 		})
 
+		p.mocks.PopFrame()
 		if shadowing {
 			p.funcs.Pop()
 			for i := len(dataRefs) - 1; i >= 0; i-- {
@@ -640,8 +689,8 @@ func (p *Planner) planWith(e *ast.Expr, iter planiter) error {
 	})
 }
 
-func (p *Planner) planWithRec(e *ast.Expr, targets [][]int, values []ir.LocalOrConst, index int, iter planiter) error {
-	if index >= len(e.With) {
+func (p *Planner) planWithRec(e *ast.Expr, targets [][]int, values []ir.Operand, index int, iter planiter) error {
+	if index >= len(targets) {
 		return p.planExpr(e.NoWith(), iter)
 	}
 
@@ -688,7 +737,7 @@ func (p *Planner) planWithUndoRec(restore [][2]ir.Local, index int, iter planite
 
 	p.appendStmt(&ir.WithStmt{
 		Local: lorig,
-		Value: lsave,
+		Value: op(lsave),
 		Block: block,
 	})
 
@@ -708,12 +757,80 @@ func (p *Planner) planExprTerm(e *ast.Expr, iter planiter) error {
 	return p.planTerm(e.Terms.(*ast.Term), func() error {
 		p.appendStmt(&ir.NotEqualStmt{
 			A: p.ltarget,
-			B: ir.Bool(false),
+			B: op(ir.Bool(false)),
 		})
 		return iter()
 	})
 }
 
+func (p *Planner) planExprEvery(e *ast.Expr, iter planiter) error {
+	every := e.Terms.(*ast.Every)
+
+	cond0 := p.newLocal() // outer not
+	cond1 := p.newLocal() // inner not
+
+	// We're using condition variables together with IsDefinedStmt to encode
+	// this:
+	// every x, y in xs { p(x,y) }
+	// ~> p(x1, y1) AND p(x2, y2) AND ... AND p(xn, yn)
+	// ~> NOT (NOT p(x1, y1) OR NOT p(x2, y2) OR ... OR NOT p(xn, yn))
+	//
+	// cond1 is initialized to 0, and set to TRUE if p(xi, yi) succeeds for
+	// a binding of (xi, yi). We then use IsUndefined to check that this has NOT
+	// happened (NOT p(xi, yi)).
+	// cond0 is initialized to 0, and set to TRUE if cond1 happens to not
+	// be set: it's encoding the NOT ( ... OR ... OR ... ) part of this.
+
+	p.appendStmt(&ir.ResetLocalStmt{
+		Target: cond0,
+	})
+
+	err := p.planTerm(every.Domain, func() error {
+		return p.planScan(every.Key, func(ir.Local) error {
+			p.appendStmt(&ir.ResetLocalStmt{
+				Target: cond1,
+			})
+			nested := &ir.BlockStmt{Blocks: []*ir.Block{{}}}
+
+			prev := p.curr
+			p.curr = nested.Blocks[0]
+
+			lval := p.ltarget
+			err := p.planUnifyLocal(lval, every.Value, func() error {
+				return p.planQuery(every.Body, 0, func() error {
+					p.appendStmt(&ir.AssignVarStmt{
+						Source: op(ir.Bool(true)),
+						Target: cond1,
+					})
+					return nil
+				})
+			})
+			if err != nil {
+				return err
+			}
+
+			p.curr = prev
+			p.appendStmt(nested)
+			p.appendStmt(&ir.IsUndefinedStmt{
+				Source: cond1,
+			})
+			p.appendStmt(&ir.AssignVarStmt{
+				Source: op(ir.Bool(true)),
+				Target: cond0,
+			})
+			return nil
+		})
+	})
+	if err != nil {
+		return err
+	}
+
+	p.appendStmt(&ir.IsUndefinedStmt{
+		Source: cond0,
+	})
+	return iter()
+}
+
 func (p *Planner) planExprCall(e *ast.Expr, iter planiter) error {
 	operator := e.Operator().String()
 	switch operator {
@@ -726,21 +843,57 @@ func (p *Planner) planExprCall(e *ast.Expr, iter planiter) error {
 		var name string
 		var arity int
 		var void bool
-		var args []ir.LocalOrConst
+		var args []ir.Operand
+		var err error
 
-		node := p.rules.Lookup(e.Operator())
+		operands := e.Operands()
+		op := e.Operator()
+
+		if replacement := p.mocks.Lookup(operator); replacement != nil {
+			switch r := replacement.Value.(type) {
+			case ast.Ref:
+				if !r.HasPrefix(ast.DefaultRootRef) && !r.HasPrefix(ast.InputRootRef) {
+					// replacement is builtin
+					operator = r.String()
+					bi := p.decls[operator]
+					p.externs[operator] = bi
+
+					// void functions and relations are forbidden; arity validation happened in compiler
+					return p.planExprCallFunc(operator, len(bi.Decl.FuncArgs().Args), void, operands, args, iter)
+				}
 
-		if node != nil {
-			var err error
+				// replacement is a function (rule)
+				if node := p.rules.Lookup(r); node != nil {
+					if node.Arity() > 0 {
+						p.mocks.Push() // new scope
+						name, err = p.planRules(node.Rules())
+						if err != nil {
+							return err
+						}
+						p.mocks.Pop()
+						return p.planExprCallFunc(name, node.Arity(), void, operands, p.defaultOperands(), iter)
+					}
+					// arity==0 => replacement is a ref to a rule to be used as value (fallthrough)
+				}
+			}
+
+			// replacement is a value, or ref
+			if bi, ok := p.decls[operator]; ok {
+				return p.planExprCallValue(replacement, len(bi.Decl.FuncArgs().Args), operands, iter)
+			}
+			if node := p.rules.Lookup(op); node != nil {
+				return p.planExprCallValue(replacement, node.Arity(), operands, iter)
+			}
+			return fmt.Errorf("illegal replacement of operator %q by %v", operator, replacement) // should be unreachable
+		}
+
+		if node := p.rules.Lookup(op); node != nil {
 			name, err = p.planRules(node.Rules())
 			if err != nil {
 				return err
 			}
 			arity = node.Arity()
-			args = []ir.LocalOrConst{
-				p.vars.GetOrEmpty(ast.InputRootDocument.Value.(ast.Var)),
-				p.vars.GetOrEmpty(ast.DefaultRootDocument.Value.(ast.Var)),
-			}
+			args = p.defaultOperands()
 		} else if decl, ok := p.decls[operator]; ok {
 			relation = decl.Relation
 			arity = len(decl.Decl.Args())
@@ -751,8 +904,6 @@ func (p *Planner) planExprCall(e *ast.Expr, iter planiter) error {
 			return fmt.Errorf("illegal call: unknown operator %q", operator)
 		}
 
-		operands := e.Operands()
-
 		if len(operands) < arity || len(operands) > arity+1 {
 			return fmt.Errorf("illegal call: wrong number of operands: got %v, want %v)", len(operands), arity)
 		}
@@ -765,12 +916,12 @@ func (p *Planner) planExprCall(e *ast.Expr, iter planiter) error {
 	}
 }
 
-func (p *Planner) planExprCallRelation(name string, arity int, operands []*ast.Term, args []ir.LocalOrConst, iter planiter) error {
+func (p *Planner) planExprCallRelation(name string, arity int, operands []*ast.Term, args []ir.Operand, iter planiter) error {
 
 	if len(operands) == arity {
-		return p.planCallArgs(operands, 0, args, func(args []ir.LocalOrConst) error {
-			p.ltarget = p.newLocal()
-			ltarget := p.ltarget.(ir.Local)
+		return p.planCallArgs(operands, 0, args, func(args []ir.Operand) error {
+			p.ltarget = p.newOperand()
+			ltarget := p.ltarget.Value.(ir.Local)
 			p.appendStmt(&ir.CallStmt{
 				Func:   name,
 				Args:   args,
@@ -780,7 +931,7 @@ func (p *Planner) planExprCallRelation(name string, arity int, operands []*ast.T
 			lsize := p.newLocal()
 
 			p.appendStmt(&ir.LenStmt{
-				Source: ltarget,
+				Source: op(ltarget),
 				Target: lsize,
 			})
 
@@ -792,22 +943,22 @@ func (p *Planner) planExprCallRelation(name string, arity int, operands []*ast.T
 			})
 
 			p.appendStmt(&ir.NotEqualStmt{
-				A: lsize,
-				B: lzero,
+				A: op(lsize),
+				B: op(lzero),
 			})
 
 			return iter()
 		})
 	}
 
-	return p.planCallArgs(operands[:len(operands)-1], 0, args, func(args []ir.LocalOrConst) error {
+	return p.planCallArgs(operands[:len(operands)-1], 0, args, func(args []ir.Operand) error {
 
-		p.ltarget = p.newLocal()
+		p.ltarget = p.newOperand()
 
 		p.appendStmt(&ir.CallStmt{
 			Func:   name,
 			Args:   args,
-			Result: p.ltarget.(ir.Local),
+			Result: p.ltarget.Value.(ir.Local),
 		})
 
 		return p.planScanValues(operands[len(operands)-1], func(ir.Local) error {
@@ -816,14 +967,15 @@ func (p *Planner) planExprCallRelation(name string, arity int, operands []*ast.T
 	})
 }
 
-func (p *Planner) planExprCallFunc(name string, arity int, void bool, operands []*ast.Term, args []ir.LocalOrConst, iter planiter) error {
+func (p *Planner) planExprCallFunc(name string, arity int, void bool, operands []*ast.Term, args []ir.Operand, iter planiter) error {
 
-	if len(operands) == arity {
+	switch {
+	case len(operands) == arity:
 		// definition: f(x) = y { ... }
 		// call: f(x) # result not captured
-		return p.planCallArgs(operands, 0, args, func(args []ir.LocalOrConst) error {
-			p.ltarget = p.newLocal()
-			ltarget := p.ltarget.(ir.Local)
+		return p.planCallArgs(operands, 0, args, func(args []ir.Operand) error {
+			p.ltarget = p.newOperand()
+			ltarget := p.ltarget.Value.(ir.Local)
 			p.appendStmt(&ir.CallStmt{
 				Func:   name,
 				Args:   args,
@@ -832,29 +984,59 @@ func (p *Planner) planExprCallFunc(name string, arity int, void bool, operands [
 
 			if !void {
 				p.appendStmt(&ir.NotEqualStmt{
-					A: ltarget,
-					B: ir.Bool(false),
+					A: op(ltarget),
+					B: op(ir.Bool(false)),
 				})
 			}
 
 			return iter()
 		})
+
+	case len(operands) == arity+1:
+		// definition: f(x) = y { ... }
+		// call: f(x, 1) # caller captures result
+		return p.planCallArgs(operands[:len(operands)-1], 0, args, func(args []ir.Operand) error {
+			result := p.newLocal()
+			p.appendStmt(&ir.CallStmt{
+				Func:   name,
+				Args:   args,
+				Result: result,
+			})
+			return p.planUnifyLocal(op(result), operands[len(operands)-1], iter)
+		})
+
+	default:
+		return fmt.Errorf("impossible replacement, arity mismatch")
 	}
+}
 
-	// definition: f(x) = y { ... }
-	// call: f(x, 1)  # caller captures result
-	return p.planCallArgs(operands[:len(operands)-1], 0, args, func(args []ir.LocalOrConst) error {
-		result := p.newLocal()
-		p.appendStmt(&ir.CallStmt{
-			Func:   name,
-			Args:   args,
-			Result: result,
+func (p *Planner) planExprCallValue(value *ast.Term, arity int, operands []*ast.Term, iter planiter) error {
+	switch {
+	case len(operands) == arity: // call: f(x) # result not captured
+		return p.planCallArgs(operands, 0, nil, func([]ir.Operand) error {
+			p.ltarget = p.newOperand()
+			return p.planTerm(value, func() error {
+				p.appendStmt(&ir.NotEqualStmt{
+					A: p.ltarget,
+					B: op(ir.Bool(false)),
+				})
+				return iter()
+			})
 		})
-		return p.planUnifyLocal(result, operands[len(operands)-1], iter)
-	})
+
+	case len(operands) == arity+1: // call: f(x, 1) # caller captures result
+		return p.planCallArgs(operands[:len(operands)-1], 0, nil, func([]ir.Operand) error {
+			p.ltarget = p.newOperand()
+			return p.planTerm(value, func() error {
+				return p.planUnifyLocal(p.ltarget, operands[len(operands)-1], iter)
+			})
+		})
+	default:
+		return fmt.Errorf("impossible replacement, arity mismatch")
+	}
 }
 
-func (p *Planner) planCallArgs(terms []*ast.Term, idx int, args []ir.LocalOrConst, iter func([]ir.LocalOrConst) error) error {
+func (p *Planner) planCallArgs(terms []*ast.Term, idx int, args []ir.Operand, iter func([]ir.Operand) error) error {
 	if idx >= len(terms) {
 		return iter(args)
 	}
@@ -881,6 +1063,10 @@ func (p *Planner) planUnify(a, b *ast.Term, iter planiter) error {
 			return p.planTerm(b, func() error {
 				return p.planUnifyLocalArray(p.ltarget, va, iter)
 			})
+		case *ast.ArrayComprehension:
+			return p.planTerm(b, func() error {
+				return p.planUnifyLocalArray(p.ltarget, va, iter)
+			})
 		case *ast.Array:
 			if va.Len() == vb.Len() {
 				return p.planUnifyArraysRec(va, vb, 0, iter)
@@ -905,22 +1091,31 @@ func (p *Planner) planUnify(a, b *ast.Term, iter planiter) error {
 
 func (p *Planner) planUnifyVar(a ast.Var, b *ast.Term, iter planiter) error {
 
-	if la, ok := p.vars.Get(a); ok {
+	if la, ok := p.vars.GetOp(a); ok {
 		return p.planUnifyLocal(la, b, iter)
 	}
 
 	return p.planTerm(b, func() error {
-		target := p.newLocal()
-		p.vars.Put(a, target)
-		p.appendStmt(&ir.AssignVarStmt{
-			Source: p.ltarget,
-			Target: target,
-		})
+		// `a` may have become known while planning b, like in `a = input.x[a]`
+		la, ok := p.vars.GetOp(a)
+		if ok {
+			p.appendStmt(&ir.EqualStmt{
+				A: la,
+				B: p.ltarget,
+			})
+		} else {
+			target := p.newLocal()
+			p.vars.Put(a, target)
+			p.appendStmt(&ir.AssignVarStmt{
+				Source: p.ltarget,
+				Target: target,
+			})
+		}
 		return iter()
 	})
 }
 
-func (p *Planner) planUnifyLocal(a ir.LocalOrConst, b *ast.Term, iter planiter) error {
+func (p *Planner) planUnifyLocal(a ir.Operand, b *ast.Term, iter planiter) error {
 	switch vb := b.Value.(type) {
 	case ast.Null, ast.Boolean, ast.Number, ast.String, ast.Ref, ast.Set, *ast.SetComprehension, *ast.ArrayComprehension, *ast.ObjectComprehension:
 		return p.planTerm(b, func() error {
@@ -931,7 +1126,7 @@ func (p *Planner) planUnifyLocal(a ir.LocalOrConst, b *ast.Term, iter planiter)
 			return iter()
 		})
 	case ast.Var:
-		if lv, ok := p.vars.Get(vb); ok {
+		if lv, ok := p.vars.GetOp(vb); ok {
 			p.appendStmt(&ir.EqualStmt{
 				A: a,
 				B: lv,
@@ -954,7 +1149,7 @@ func (p *Planner) planUnifyLocal(a ir.LocalOrConst, b *ast.Term, iter planiter)
 	return fmt.Errorf("not implemented: unifyLocal(%v, %v)", a, b)
 }
 
-func (p *Planner) planUnifyLocalArray(a ir.LocalOrConst, b *ast.Array, iter planiter) error {
+func (p *Planner) planUnifyLocalArray(a ir.Operand, b *ast.Array, iter planiter) error {
 	p.appendStmt(&ir.IsArrayStmt{
 		Source: a,
 	})
@@ -973,8 +1168,8 @@ func (p *Planner) planUnifyLocalArray(a ir.LocalOrConst, b *ast.Array, iter plan
 	})
 
 	p.appendStmt(&ir.EqualStmt{
-		A: alen,
-		B: blen,
+		A: op(alen),
+		B: op(blen),
 	})
 
 	lkey := p.newLocal()
@@ -988,7 +1183,7 @@ func (p *Planner) planUnifyLocalArray(a ir.LocalOrConst, b *ast.Array, iter plan
 	return p.planUnifyLocalArrayRec(a, 0, b, lkey, lval, iter)
 }
 
-func (p *Planner) planUnifyLocalArrayRec(a ir.LocalOrConst, index int, b *ast.Array, lkey, lval ir.Local, iter planiter) error {
+func (p *Planner) planUnifyLocalArrayRec(a ir.Operand, index int, b *ast.Array, lkey, lval ir.Local, iter planiter) error {
 	if b.Len() == index {
 		return iter()
 	}
@@ -999,12 +1194,12 @@ func (p *Planner) planUnifyLocalArrayRec(a ir.LocalOrConst, index int, b *ast.Ar
 	})
 
 	p.appendStmt(&ir.DotStmt{
-		Source: a.(ir.Local),
-		Key:    lkey,
+		Source: a,
+		Key:    op(lkey),
 		Target: lval,
 	})
 
-	return p.planUnifyLocal(lval, b.Elem(index), func() error {
+	return p.planUnifyLocal(op(lval), b.Elem(index), func() error {
 		return p.planUnifyLocalArrayRec(a, index+1, b, lkey, lval, iter)
 	})
 }
@@ -1034,7 +1229,7 @@ func (p *Planner) planUnifyObjects(a, b ast.Object, iter planiter) error {
 	})
 }
 
-func (p *Planner) planUnifyObjectLocals(a, b ir.LocalOrConst, keys []*ast.Term, index int, l0, l1 ir.Local, iter planiter) error {
+func (p *Planner) planUnifyObjectLocals(a, b ir.Operand, keys []*ast.Term, index int, l0, l1 ir.Local, iter planiter) error {
 	if index == len(keys) {
 		return iter()
 	}
@@ -1051,15 +1246,15 @@ func (p *Planner) planUnifyObjectLocals(a, b ir.LocalOrConst, keys []*ast.Term,
 			Target: l1,
 		})
 		p.appendStmt(&ir.EqualStmt{
-			A: l0,
-			B: l1,
+			A: op(l0),
+			B: op(l1),
 		})
 
 		return p.planUnifyObjectLocals(a, b, keys, index+1, l0, l1, iter)
 	})
 }
 
-func (p *Planner) planUnifyLocalObject(a ir.LocalOrConst, b ast.Object, iter planiter) error {
+func (p *Planner) planUnifyLocalObject(a ir.Operand, b ast.Object, iter planiter) error {
 	p.appendStmt(&ir.IsObjectStmt{
 		Source: a,
 	})
@@ -1078,8 +1273,8 @@ func (p *Planner) planUnifyLocalObject(a ir.LocalOrConst, b ast.Object, iter pla
 	})
 
 	p.appendStmt(&ir.EqualStmt{
-		A: alen,
-		B: blen,
+		A: op(alen),
+		B: op(blen),
 	})
 
 	lval := p.newLocal()
@@ -1088,7 +1283,7 @@ func (p *Planner) planUnifyLocalObject(a ir.LocalOrConst, b ast.Object, iter pla
 	return p.planUnifyLocalObjectRec(a, 0, bkeys, b, lval, iter)
 }
 
-func (p *Planner) planUnifyLocalObjectRec(a ir.LocalOrConst, index int, keys []*ast.Term, b ast.Object, lval ir.Local, iter planiter) error {
+func (p *Planner) planUnifyLocalObjectRec(a ir.Operand, index int, keys []*ast.Term, b ast.Object, lval ir.Local, iter planiter) error {
 
 	if index == len(keys) {
 		return iter()
@@ -1100,7 +1295,7 @@ func (p *Planner) planUnifyLocalObjectRec(a ir.LocalOrConst, index int, keys []*
 			Key:    p.ltarget,
 			Target: lval,
 		})
-		return p.planUnifyLocal(lval, b.Get(keys[index]), func() error {
+		return p.planUnifyLocal(op(lval), b.Get(keys[index]), func() error {
 			return p.planUnifyLocalObjectRec(a, index+1, keys, b, lval, iter)
 		})
 	})
@@ -1132,8 +1327,11 @@ func (p *Planner) planUnifyObjectsRec(a, b ast.Object, keys []*ast.Term, index i
 }
 
 func (p *Planner) planTerm(t *ast.Term, iter planiter) error {
+	return p.planValue(t.Value, t.Loc(), iter)
+}
 
-	switch v := t.Value.(type) {
+func (p *Planner) planValue(t ast.Value, loc *ast.Location, iter planiter) error {
+	switch v := t.(type) {
 	case ast.Null:
 		return p.planNull(v, iter)
 	case ast.Boolean:
@@ -1153,13 +1351,13 @@ func (p *Planner) planTerm(t *ast.Term, iter planiter) error {
 	case ast.Set:
 		return p.planSet(v, iter)
 	case *ast.SetComprehension:
-		p.loc = t.Loc()
+		p.loc = loc
 		return p.planSetComprehension(v, iter)
 	case *ast.ArrayComprehension:
-		p.loc = t.Loc()
+		p.loc = loc
 		return p.planArrayComprehension(v, iter)
 	case *ast.ObjectComprehension:
-		p.loc = t.Loc()
+		p.loc = loc
 		return p.planObjectComprehension(v, iter)
 	default:
 		return fmt.Errorf("%v term not implemented", ast.TypeName(v))
@@ -1174,14 +1372,14 @@ func (p *Planner) planNull(null ast.Null, iter planiter) error {
 		Target: target,
 	})
 
-	p.ltarget = target
+	p.ltarget = op(target)
 
 	return iter()
 }
 
 func (p *Planner) planBoolean(b ast.Boolean, iter planiter) error {
 
-	p.ltarget = ir.Bool(b)
+	p.ltarget = op(ir.Bool(b))
 	return iter()
 }
 
@@ -1195,21 +1393,21 @@ func (p *Planner) planNumber(num ast.Number, iter planiter) error {
 		Target: target,
 	})
 
-	p.ltarget = target
+	p.ltarget = op(target)
 	return iter()
 }
 
 func (p *Planner) planString(str ast.String, iter planiter) error {
 
-	p.ltarget = ir.StringIndex(p.getStringConst(string(str)))
+	p.ltarget = op(ir.StringIndex(p.getStringConst(string(str))))
 
 	return iter()
 }
 
 func (p *Planner) planVar(v ast.Var, iter planiter) error {
-	p.ltarget = p.vars.GetOrElse(v, func() ir.Local {
+	p.ltarget = op(p.vars.GetOrElse(v, func() ir.Local {
 		return p.newLocal()
-	})
+	}))
 	return iter()
 }
 
@@ -1227,7 +1425,7 @@ func (p *Planner) planArray(arr *ast.Array, iter planiter) error {
 
 func (p *Planner) planArrayRec(arr *ast.Array, index int, larr ir.Local, iter planiter) error {
 	if index == arr.Len() {
-		p.ltarget = larr
+		p.ltarget = op(larr)
 		return iter()
 	}
 
@@ -1255,7 +1453,7 @@ func (p *Planner) planObject(obj ast.Object, iter planiter) error {
 
 func (p *Planner) planObjectRec(obj ast.Object, index int, keys []*ast.Term, lobj ir.Local, iter planiter) error {
 	if index == len(keys) {
-		p.ltarget = lobj
+		p.ltarget = op(lobj)
 		return iter()
 	}
 
@@ -1287,7 +1485,7 @@ func (p *Planner) planSet(set ast.Set, iter planiter) error {
 
 func (p *Planner) planSetRec(set ast.Set, index int, elems []*ast.Term, lset ir.Local, iter planiter) error {
 	if index == len(elems) {
-		p.ltarget = lset
+		p.ltarget = op(lset)
 		return iter()
 	}
 
@@ -1367,16 +1565,14 @@ func (p *Planner) planComprehension(body ast.Body, closureIter planiter, target
 	// below.
 	p.vars.Push(map[ast.Var]ir.Local{})
 	prev := p.curr
-	p.curr = &ir.Block{}
+	block := &ir.Block{}
+	p.curr = block
 	ploc := p.loc
 
-	if err := p.planQuery(body, 0, func() error {
-		return closureIter()
-	}); err != nil {
+	if err := p.planQuery(body, 0, closureIter); err != nil {
 		return err
 	}
 
-	block := p.curr
 	p.curr = prev
 	p.loc = ploc
 	p.vars.Pop()
@@ -1387,7 +1583,7 @@ func (p *Planner) planComprehension(body ast.Body, closureIter planiter, target
 		},
 	})
 
-	p.ltarget = target
+	p.ltarget = op(target)
 	return iter()
 }
 
@@ -1410,7 +1606,7 @@ func (p *Planner) planRef(ref ast.Ref, iter planiter) error {
 		})
 	}
 
-	p.ltarget, ok = p.vars.Get(head)
+	p.ltarget, ok = p.vars.GetOp(head)
 	if !ok {
 		return fmt.Errorf("illegal ref: unsafe head")
 	}
@@ -1473,23 +1669,26 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 
 			// We're planning a structure like this:
 			//
-			// block a
-			//   block b
-			//     block c1
-			//       opa_mapping_lookup || br c1
-			//       call_indirect      || br a
-			//       br b
-			//     end
-			//     block c2
-			//       dot i   || br c2
-			//       dot i+1 || br c2
-			//       br b
+			// block res
+			//   block a
+			//     block b
+			//       block c1
+			//         opa_mapping_lookup || br c1
+			//         call_indirect      || br res
+			//         br b
+			//       end
+			//       block c2
+			//         dot i   || br c2
+			//         dot i+1 || br c2
+			//         br b
+			//       end
+			//       br a
 			//     end
-			//     br a
-			//   end
-			//   dot i+2 || br a
-			//   dot i+3 || br a
-			// end
+			//     dot i+2 || br res
+			//     dot i+3 || br res
+			//   end; a
+			//   [add_to_result_set]
+			// end; res
 			//
 			// We have to do it like this because the dot IR stmts
 			// are compiled to `br 0`, the innermost block, if they
@@ -1499,7 +1698,7 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 			// to call_dynamic.
 
 			ltarget := p.newLocal()
-			p.ltarget = ltarget
+			p.ltarget = op(ltarget)
 			prev := p.curr
 
 			callDynBlock := &ir.Block{} // "c1" in the sketch
@@ -1516,31 +1715,32 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 
 			dotBlock := &ir.Block{} // "c2" in the sketch above
 			p.curr = dotBlock
-			p.ltarget = p.vars.GetOrEmpty(ast.DefaultRootDocument.Value.(ast.Var))
+			p.ltarget = p.vars.GetOpOrEmpty(ast.DefaultRootDocument.Value.(ast.Var))
 
 			return p.planRefRec(ref[:index+1], 1, func() error {
 				p.appendStmt(&ir.AssignVarStmt{
-					Source: p.ltarget.(ir.Local),
+					Source: p.ltarget,
 					Target: ltarget,
 				})
 				p.appendStmt(&ir.BreakStmt{Index: 1})
-				p.ltarget = ltarget
+				p.ltarget = op(ltarget)
 
 				outerBlock := &ir.Block{Stmts: []ir.Stmt{
 					&ir.BlockStmt{Blocks: []*ir.Block{
 						{ // block "b" in the sketch above
 							Stmts: []ir.Stmt{
 								&ir.BlockStmt{Blocks: []*ir.Block{callDynBlock, dotBlock}},
-								&ir.BreakStmt{Index: 1}},
+								&ir.BreakStmt{Index: 2}},
 						},
 					}},
 				}}
 				p.curr = outerBlock
-				return p.planRefRec(ref, index+1, func() error { // rest of the ref
-					p.curr = prev
-					p.appendStmt(&ir.BlockStmt{Blocks: []*ir.Block{outerBlock}})
-					return iter()
-				})
+				if err := p.planRefRec(ref, index+1, iter); err != nil { // rest of the ref
+					return err
+				}
+				p.curr = prev
+				p.appendStmt(&ir.BlockStmt{Blocks: []*ir.Block{outerBlock}})
+				return nil
 			})
 		}
 	}
@@ -1550,15 +1750,16 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 	if ref[index].IsGround() {
 
 		var vchild *ruletrie
+		var rules []*ast.Rule
 
 		if virtual != nil {
+
 			vchild = virtual.Get(ref[index].Value)
+			rules = vchild.Rules() // hit or miss
 		}
 
-		rules := vchild.Rules()
-
 		if len(rules) > 0 {
-			p.ltarget = p.newLocal()
+			p.ltarget = p.newOperand()
 
 			funcName, err := p.planRules(rules)
 			if err != nil {
@@ -1566,12 +1767,9 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 			}
 
 			p.appendStmt(&ir.CallStmt{
-				Func: funcName,
-				Args: []ir.LocalOrConst{
-					p.vars.GetOrEmpty(ast.InputRootDocument.Value.(ast.Var)),
-					p.vars.GetOrEmpty(ast.DefaultRootDocument.Value.(ast.Var)),
-				},
-				Result: p.ltarget.(ir.Local),
+				Func:   funcName,
+				Args:   p.defaultOperands(),
+				Result: p.ltarget.Value.(ir.Local),
 			})
 
 			return p.planRefRec(ref, index+1, iter)
@@ -1579,7 +1777,6 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 
 		bchild := *base
 		bchild.path = append(bchild.path, ref[index])
-
 		return p.planRefData(vchild, &bchild, ref, index+1, iter)
 	}
 
@@ -1629,11 +1826,11 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 	// trees that are rooted at the same key as any of the virtual sub trees. To
 	// prevent this we build a set of keys that are to be excluded and check
 	// below during the base scan.
-	var lexclude *ir.Local
+	var lexclude *ir.Operand
 
 	if exclude.Len() > 0 {
 		if err := p.planSet(exclude, func() error {
-			v := p.ltarget.(ir.Local)
+			v := p.ltarget
 			lexclude = &v
 			return nil
 		}); err != nil {
@@ -1643,7 +1840,7 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 		// Perform a scan of the base documents starting from the location referred
 		// to by the 'path' data pointer. Use the `lexclude` set to avoid revisiting
 		// sub trees.
-		p.ltarget = base.local
+		p.ltarget = op(base.local)
 		return p.planRefRec(base.path, 0, func() error {
 			return p.planScan(ref[index], func(lkey ir.Local) error {
 				if lexclude != nil {
@@ -1651,24 +1848,24 @@ func (p *Planner) planRefData(virtual *ruletrie, base *baseptr, ref ast.Ref, ind
 					p.appendStmt(&ir.NotStmt{
 						Block: p.blockWithStmt(&ir.DotStmt{
 							Source: *lexclude,
-							Key:    lkey,
+							Key:    op(lkey),
 							Target: lignore,
 						})})
 				}
 
 				// Assume that virtual sub trees have been visited already so
 				// recurse without the virtual node.
-				return p.planRefData(nil, &baseptr{local: p.ltarget.(ir.Local)}, ref, index+1, iter)
+				return p.planRefData(nil, &baseptr{local: p.ltarget.Value.(ir.Local)}, ref, index+1, iter)
 			})
 		})
 	}
 
 	// There is nothing to exclude, so we do the same thing done above, but
 	// use planRefRec to avoid the scan if ref[index] is ground or seen.
-	p.ltarget = base.local
+	p.ltarget = op(base.local)
 	base.path = append(base.path, ref[index])
 	return p.planRefRec(base.path, 0, func() error {
-		return p.planRefData(nil, &baseptr{local: p.ltarget.(ir.Local)}, ref, index+1, iter)
+		return p.planRefData(nil, &baseptr{local: p.ltarget.Value.(ir.Local)}, ref, index+1, iter)
 	})
 }
 
@@ -1688,37 +1885,20 @@ func (p *Planner) planRefDataExtent(virtual *ruletrie, base *baseptr, iter plani
 			Target: vtarget,
 		})
 
+		anyKeyNonGround := false
 		for _, key := range virtual.Children() {
-			child := virtual.Get(key)
-
-			// Skip functions.
-			if child.Arity() > 0 {
-				continue
+			if !key.IsGround() {
+				anyKeyNonGround = true
+				break
 			}
-
-			lkey := ir.StringIndex(p.getStringConst(string(key.(ast.String))))
-
-			rules := child.Rules()
-
-			// Build object hierarchy depth-first.
-			if len(rules) == 0 {
-				err := p.planRefDataExtent(child, nil, func() error {
-					p.appendStmt(&ir.ObjectInsertStmt{
-						Object: vtarget,
-						Key:    lkey,
-						Value:  p.ltarget,
-					})
-					return nil
-				})
-				if err != nil {
-					return err
-				}
-				continue
+		}
+		if anyKeyNonGround {
+			var rules []*ast.Rule
+			for _, key := range virtual.Children() {
+				// TODO(sr): skip functions
+				rules = append(rules, virtual.Get(key).Rules()...)
 			}
 
-			// Generate virtual document for leaf.
-			lvalue := p.newLocal()
-
 			funcName, err := p.planRules(rules)
 			if err != nil {
 				return err
@@ -1727,26 +1907,70 @@ func (p *Planner) planRefDataExtent(virtual *ruletrie, base *baseptr, iter plani
 			// Add leaf to object if defined.
 			b := &ir.Block{}
 			p.appendStmtToBlock(&ir.CallStmt{
-				Func: funcName,
-				Args: []ir.LocalOrConst{
-					p.vars.GetOrEmpty(ast.InputRootDocument.Value.(ast.Var)),
-					p.vars.GetOrEmpty(ast.DefaultRootDocument.Value.(ast.Var)),
-				},
-				Result: lvalue,
-			}, b)
-			p.appendStmtToBlock(&ir.ObjectInsertStmt{
-				Object: vtarget,
-				Key:    lkey,
-				Value:  lvalue,
+				Func:   funcName,
+				Args:   p.defaultOperands(),
+				Result: vtarget,
 			}, b)
 			p.appendStmt(&ir.BlockStmt{Blocks: []*ir.Block{b}})
+		} else {
+			for _, key := range virtual.Children() {
+				child := virtual.Get(key)
+
+				// Skip functions.
+				if child.Arity() > 0 {
+					continue
+				}
+
+				rules := child.Rules()
+				err := p.planValue(key, nil, func() error {
+					lkey := p.ltarget
+
+					// Build object hierarchy depth-first.
+					if len(rules) == 0 {
+						return p.planRefDataExtent(child, nil, func() error {
+							p.appendStmt(&ir.ObjectInsertStmt{
+								Object: vtarget,
+								Key:    lkey,
+								Value:  p.ltarget,
+							})
+							return nil
+						})
+					}
+
+					// Generate virtual document for leaf.
+					lvalue := p.newLocal()
+
+					funcName, err := p.planRules(rules)
+					if err != nil {
+						return err
+					}
+
+					// Add leaf to object if defined.
+					b := &ir.Block{}
+					p.appendStmtToBlock(&ir.CallStmt{
+						Func:   funcName,
+						Args:   p.defaultOperands(),
+						Result: lvalue,
+					}, b)
+					p.appendStmtToBlock(&ir.ObjectInsertStmt{
+						Object: vtarget,
+						Key:    lkey,
+						Value:  op(lvalue),
+					}, b)
+					p.appendStmt(&ir.BlockStmt{Blocks: []*ir.Block{b}})
+					return nil
+				})
+				if err != nil {
+					return err
+				}
+			}
 		}
 
 		// At this point vtarget refers to the full extent of the virtual
 		// document at ref. If the base pointer is unset, no further processing
 		// is required.
 		if base == nil {
-			p.ltarget = vtarget
+			p.ltarget = op(vtarget)
 			return iter()
 		}
 	}
@@ -1755,16 +1979,16 @@ func (p *Planner) planRefDataExtent(virtual *ruletrie, base *baseptr, iter plani
 	// document value above if needed.
 	prev := p.curr
 	p.curr = &ir.Block{}
-	p.ltarget = base.local
+	p.ltarget = op(base.local)
 	target := p.newLocal()
 
 	err := p.planRefRec(base.path, 0, func() error {
 
 		if virtual == nil {
-			target = p.ltarget.(ir.Local)
+			target = p.ltarget.Value.(ir.Local)
 		} else {
 			stmt := &ir.ObjectMergeStmt{
-				A:      p.ltarget.(ir.Local),
+				A:      p.ltarget.Value.(ir.Local),
 				B:      vtarget,
 				Target: target,
 			}
@@ -1788,7 +2012,7 @@ func (p *Planner) planRefDataExtent(virtual *ruletrie, base *baseptr, iter plani
 
 	if virtual != nil {
 		p.appendStmt(&ir.AssignVarStmt{
-			Source: vtarget,
+			Source: op(vtarget),
 			Target: target,
 		})
 	} else {
@@ -1801,7 +2025,7 @@ func (p *Planner) planRefDataExtent(virtual *ruletrie, base *baseptr, iter plani
 
 	// At this point, target refers to either the full extent of the base and
 	// virtual documents at ref or just the base document at ref.
-	p.ltarget = target
+	p.ltarget = op(target)
 
 	return iter()
 }
@@ -1820,7 +2044,7 @@ func (p *Planner) planDot(key *ast.Term, iter planiter) error {
 			Target: target,
 		})
 
-		p.ltarget = target
+		p.ltarget = op(target)
 
 		return iter()
 	})
@@ -1831,7 +2055,7 @@ type scaniter func(ir.Local) error
 func (p *Planner) planScan(key *ast.Term, iter scaniter) error {
 
 	scan := &ir.ScanStmt{
-		Source: p.ltarget.(ir.Local),
+		Source: p.ltarget.Value.(ir.Local),
 		Key:    p.newLocal(),
 		Value:  p.newLocal(),
 		Block:  &ir.Block{},
@@ -1840,8 +2064,8 @@ func (p *Planner) planScan(key *ast.Term, iter scaniter) error {
 	prev := p.curr
 	p.curr = scan.Block
 
-	if err := p.planUnifyLocal(scan.Key, key, func() error {
-		p.ltarget = scan.Value
+	if err := p.planUnifyLocal(op(scan.Key), key, func() error {
+		p.ltarget = op(scan.Value)
 		return iter(scan.Key)
 	}); err != nil {
 		return err
@@ -1857,7 +2081,7 @@ func (p *Planner) planScan(key *ast.Term, iter scaniter) error {
 func (p *Planner) planScanValues(val *ast.Term, iter scaniter) error {
 
 	scan := &ir.ScanStmt{
-		Source: p.ltarget.(ir.Local),
+		Source: p.ltarget.Value.(ir.Local),
 		Key:    p.newLocal(),
 		Value:  p.newLocal(),
 		Block:  &ir.Block{},
@@ -1866,8 +2090,8 @@ func (p *Planner) planScanValues(val *ast.Term, iter scaniter) error {
 	prev := p.curr
 	p.curr = scan.Block
 
-	if err := p.planUnifyLocal(scan.Value, val, func() error {
-		p.ltarget = scan.Value
+	if err := p.planUnifyLocal(op(scan.Value), val, func() error {
+		p.ltarget = op(scan.Value)
 		return iter(scan.Value)
 	}); err != nil {
 		return err
@@ -1879,13 +2103,13 @@ func (p *Planner) planScanValues(val *ast.Term, iter scaniter) error {
 	return nil
 }
 
-type termsliceiter func([]ir.LocalOrConst) error
+type termsliceiter func([]ir.Operand) error
 
 func (p *Planner) planTermSlice(terms []*ast.Term, iter termsliceiter) error {
-	return p.planTermSliceRec(terms, make([]ir.LocalOrConst, len(terms)), 0, iter)
+	return p.planTermSliceRec(terms, make([]ir.Operand, len(terms)), 0, iter)
 }
 
-func (p *Planner) planTermSliceRec(terms []*ast.Term, locals []ir.LocalOrConst, index int, iter termsliceiter) error {
+func (p *Planner) planTermSliceRec(terms []*ast.Term, locals []ir.Operand, index int, iter termsliceiter) error {
 	if index >= len(terms) {
 		return iter(locals)
 	}
@@ -1970,6 +2194,10 @@ func (p *Planner) newLocal() ir.Local {
 	return x
 }
 
+func (p *Planner) newOperand() ir.Operand {
+	return op(p.newLocal())
+}
+
 func rewrittenVar(vars map[ast.Var]ast.Var, k ast.Var) ast.Var {
 	rw, ok := vars[k]
 	if !ok {
@@ -1984,17 +2212,17 @@ func rewrittenVar(vars map[ast.Var]ast.Var, k ast.Var) ast.Var {
 // allow for optimization using CallDynamicStmt.
 //
 // It's possible if all of these conditions hold:
-// - all vars in ref have been seen
-// - all ground terms (strings) match some child key on their respective
-//   layer of the ruletrie
-// - there are no child trees left (only rulesets) if we're done checking
-//   ref
+//   - all vars in ref have been seen
+//   - all ground terms (strings) match some child key on their respective
+//     layer of the ruletrie
+//   - there are no child trees left (only rulesets) if we're done checking
+//     ref
 //
 // The last condition is necessary because we don't deal with _which key a
 // var actually matched_ -- so we don't know which subtree to evaluate
 // with the results.
-func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.LocalOrConst, int, bool) {
-	dont := func() ([][]*ast.Rule, []ir.LocalOrConst, int, bool) {
+func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.Operand, int, bool) {
+	dont := func() ([][]*ast.Rule, []ir.Operand, int, bool) {
 		return nil, nil, 0, false
 	}
 	if t == nil {
@@ -2007,6 +2235,7 @@ func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.
 	var index int
 
 	// ref[0] is data, ignore
+outer:
 	for i := 1; i < len(ref); i++ {
 		index = i
 		r := ref[i]
@@ -2030,7 +2259,7 @@ func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.
 				}
 			}
 		case ast.String:
-			// take matching children
+			// take all children that either match or have a var key
 			for _, node := range nodes {
 				if node := node.Get(r); node != nil {
 					nextNodes = append(nextNodes, node)
@@ -2043,15 +2272,26 @@ func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.
 
 		nodes = nextNodes
 
-		// if all nodes have 0 children, abort ref check and optimize
-		all := true
+		// if all nodes have rules() > 0, abort ref check and optimize
+		// NOTE(sr): for a.b[c] = ... and a.b.d = ..., we stop at a.b, as its rules()
+		// will collect the children rules
+		// We keep the "all nodes have 0 children" check since it's cheaper and might
+		// let us break, too.
+		all := 0
 		for _, node := range nodes {
-			all = all && len(node.Children()) == 0
+			all += node.ChildrenCount()
 		}
-		if all {
+		if all == 0 {
 			p.debugf("ref %s: all nodes have 0 children, break", ref[0:index+1])
 			break
 		}
+
+		for _, node := range nodes {
+			if len(node.Rules()) > 0 {
+				p.debugf("ref %s: at least one rule has 1+ rules, break", ref[0:index+1])
+				break outer
+			}
+		}
 	}
 
 	var res [][]*ast.Rule
@@ -2066,7 +2306,7 @@ func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.
 	for _, node := range nodes {
 		// we're done with ref, check if there's only ruleset leaves; collect rules
 		if index == len(ref)-1 {
-			if len(node.Children()) > 0 {
+			if len(node.Rules()) == 0 && node.ChildrenCount() > 0 {
 				p.debugf("no optimization of %s: unbalanced ruletrie", ref)
 				return dont()
 			}
@@ -2080,22 +2320,22 @@ func (p *Planner) optimizeLookup(t *ruletrie, ref ast.Ref) ([][]*ast.Rule, []ir.
 		return nil, nil, index, true
 	}
 
-	var path []ir.LocalOrConst
+	var path []ir.Operand
 
 	// plan generation
-	path = append(path, ir.StringIndex(p.getStringConst(fmt.Sprintf("g%d", p.funcs.gen()))))
+	path = append(path, op(ir.StringIndex(p.getStringConst(fmt.Sprintf("g%d", p.funcs.gen())))))
 
 	for i := 1; i <= index; i++ {
 		switch r := ref[i].Value.(type) {
 		case ast.Var:
-			lv, ok := p.vars.Get(r)
+			lv, ok := p.vars.GetOp(r)
 			if !ok {
 				p.debugf("no optimization of %s: ref[%d] not a seen var: %v", ref, i, ref[i])
 				return dont()
 			}
 			path = append(path, lv)
 		case ast.String:
-			path = append(path, ir.StringIndex(p.getStringConst(string(r))))
+			path = append(path, op(ir.StringIndex(p.getStringConst(string(r)))))
 		}
 	}
 
@@ -2115,3 +2355,21 @@ func (p *Planner) unseenVars(t *ast.Term) bool {
 	})
 	return unseen
 }
+
+func (p *Planner) defaultOperands() []ir.Operand {
+	return []ir.Operand{
+		p.vars.GetOpOrEmpty(ast.InputRootDocument.Value.(ast.Var)),
+		p.vars.GetOpOrEmpty(ast.DefaultRootDocument.Value.(ast.Var)),
+	}
+}
+
+func (p *Planner) isFunction(r ast.Ref) bool {
+	if node := p.rules.Lookup(r); node != nil {
+		return node.Arity() > 0
+	}
+	return false
+}
+
+func op(v ir.Val) ir.Operand {
+	return ir.Operand{Value: v}
+}
diff --git a/internal/planner/planner_test.go b/internal/planner/planner_test.go
index e9f79c3699..cb22d67448 100644
--- a/internal/planner/planner_test.go
+++ b/internal/planner/planner_test.go
@@ -8,10 +8,11 @@ import (
 	"fmt"
 	"os"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/internal/ir"
+	"github.com/open-policy-agent/opa/ir"
 )
 
 func TestPlannerHelloWorld(t *testing.T) {
@@ -86,7 +87,7 @@ func TestPlannerHelloWorld(t *testing.T) {
 		},
 		{
 			note:    "complete rules",
-			queries: []string{"true"},
+			queries: []string{"data.test.p = x"},
 			modules: []string{`
 				package test
 				p = x { x = 1 }
@@ -141,6 +142,23 @@ func TestPlannerHelloWorld(t *testing.T) {
 				p["b"] = 2
 			`},
 		},
+		{ // NOTE(sr): these are handled differently with ref-heads
+			note:    "partial object with var",
+			queries: []string{`data.test.p = x`},
+			modules: []string{`
+				package test
+				p["a"] = 1
+				p[v] = 2 { v := "b" }
+			`},
+		},
+		{
+			note:    "every",
+			queries: []string{`data.test.p`},
+			modules: []string{`
+				package test
+				p { xs = [1]; every k, v in xs { k < v } }
+			`},
+		},
 		{
 			note:    "virtual extent",
 			queries: []string{`data`},
@@ -337,7 +355,8 @@ q = 2`,
 			modules := make([]*ast.Module, len(tc.modules))
 			for i := range modules {
 				file := fmt.Sprintf("module-%d.rego", i)
-				m, err := ast.ParseModule(file, tc.modules[i])
+				opts := ast.ParserOptions{AllFutureKeywords: true}
+				m, err := ast.ParseModuleWithOpts(file, tc.modules[i], opts)
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -377,7 +396,9 @@ func (*cmpWalker) Before(interface{}) {}
 func (*cmpWalker) After(interface{})  {}
 
 // Visit takes, for example,
-//     *ir.MakeNullStmt{Location: ir.Location{Index:0, Col:1, Row:1}},
+//
+//	*ir.MakeNullStmt{Location: ir.Location{Index:0, Col:1, Row:1}},
+//
 // and for the first MakeNullStmt it finds, extracts its location,
 // and compares it to the one passed was needle. Other fields of the
 // struct, such as Target for ir.MakeNullStmt, are ignored.
@@ -413,7 +434,7 @@ func findInPolicy(needle interface{}, loc string, p interface{}) error {
 }
 
 // Assert some selected statements' location mappings. Note that for debugging,
-// it's worthwhile to no use tabs in the multi-line strings, as they may be
+// it's worthwhile to not use tabs in the multi-line strings, as they may be
 // counted differently in the editor vs. in code.
 func TestPlannerLocations(t *testing.T) {
 
@@ -585,7 +606,7 @@ a = true`},
 				&ir.CallStmt{}:         "<query>:1:1: data[y].a = x",
 				&ir.MakeObjectStmt{}:   "<query>:1:1: data[y].a = x",
 				&ir.ObjectInsertStmt{}: "<query>:1:1: data[y].a = x",
-				&ir.ResultSetAdd{}:     "<query>:1:1: data[y].a = x",
+				&ir.ResultSetAddStmt{}: "<query>:1:1: data[y].a = x",
 				&ir.DotStmt{}:          "<query>:1:1: data[y].a = x",
 			},
 			where: func(p *ir.Policy) interface{} {
@@ -603,7 +624,7 @@ a {
 				&ir.CallStmt{}:         "<query>:1:1: data.test.a = x",
 				&ir.MakeObjectStmt{}:   "<query>:1:1: data.test.a = x",
 				&ir.ObjectInsertStmt{}: "<query>:1:1: data.test.a = x",
-				&ir.ResultSetAdd{}:     "<query>:1:1: data.test.a = x",
+				&ir.ResultSetAddStmt{}: "<query>:1:1: data.test.a = x",
 				&ir.ScanStmt{}:         `module-0.rego:3:3: data.test1[_].y = "z"`,
 			},
 		},
@@ -710,14 +731,20 @@ func ref(r string) ast.Ref {
 }
 
 func TestOptimizeLookup(t *testing.T) {
-	r0, r1, r2 := ast.Rule{}, ast.Rule{}, ast.Rule{}
+	r0, r1, r2 := ast.MustParseRule("p = 0 { true }"), ast.MustParseRule("p = 1 { true }"), ast.MustParseRule("p = 2 { true }")
+	planner := func() *Planner {
+		if testing.Verbose() {
+			return New().WithDebug(os.Stderr)
+		}
+		return New()
+	}
 
 	t.Run("seen variable (last), one ruleset", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.bar"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner()
 		l := p.newLocal()
 		p.vars.Put(ast.Var("x"), l)
 
@@ -738,7 +765,7 @@ func TestOptimizeLookup(t *testing.T) {
 		if exp, act := 3, len(path); exp != act {
 			t.Fatalf("expected path len %d, got %d\n", exp, act)
 		}
-		last, ok := path[len(path)-1].(ir.Local)
+		last, ok := path[len(path)-1].Value.(ir.Local)
 		if exp, act := true, ok; exp != act {
 			t.Fatalf("expected last path pieces to be local, got %T\n", last)
 		}
@@ -750,9 +777,9 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("ref shorter than ruletrie depth", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.bar.baz"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner().WithDebug(os.Stderr)
 		l := p.newLocal()
 		p.vars.Put(ast.Var("x"), l)
 
@@ -765,11 +792,11 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("seen variable (last), multiple rulesets", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.bar"))
-		val.rules = append(val.rules, &r0, &r1)
+		val.rules = append(val.rules, r0, r1)
 		val = r.LookupOrInsert(ref("foo.baz"))
-		val.rules = append(val.rules, &r2)
+		val.rules = append(val.rules, r2)
 
-		p := New()
+		p := planner()
 		p.vars.Put(ast.Var("x"), p.newLocal())
 
 		rulesets, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x]"))
@@ -790,9 +817,9 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("unseen variable (last)", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.bar"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner()
 
 		_, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x]"))
 		if exp, act := false, opt; exp != act {
@@ -803,9 +830,9 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("all ground refs", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.bar.baz"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner()
 
 		_, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo.bar.baz"))
 		if exp, act := false, opt; exp != act {
@@ -816,9 +843,9 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("multiple seen vars, one rule set", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.aaa.bar.bbb.q"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner()
 		lx, ly := p.newLocal(), p.newLocal()
 		p.vars.Put(ast.Var("x"), lx)
 		p.vars.Put(ast.Var("y"), ly)
@@ -845,9 +872,9 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("one seen var, one unseen, one rule set", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.aaa.bar.bbb.q"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner()
 		p.vars.Put(ast.Var("x"), p.newLocal())
 
 		_, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x].bar[y].q"))
@@ -859,11 +886,11 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("one seen var, one rule set and children left", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.aaa.bar.bbb.q"))
-		val.rules = append(val.rules, &r0)
+		val.rules = append(val.rules, r0)
 		val = r.LookupOrInsert(ref("foo.ccc.bar"))
-		val.rules = append(val.rules, &r1, &r2)
+		val.rules = append(val.rules, r1, r2)
 
-		p := New()
+		p := planner()
 		p.vars.Put(ast.Var("x"), p.newLocal())
 
 		_, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x].bar"))
@@ -875,9 +902,9 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("ref goes into the rules' result", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.aaa.bar.q"))
-		val.rules = append(val.rules, &r0, &r1, &r2)
+		val.rules = append(val.rules, r0, r1, r2)
 
-		p := New()
+		p := planner()
 		p.vars.Put(ast.Var("x"), p.newLocal())
 
 		rulesets, path, index, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x].bar.q.p.r"))
@@ -902,10 +929,10 @@ func TestOptimizeLookup(t *testing.T) {
 	t.Run("one leaf without rules", func(t *testing.T) {
 		r := newRuletrie()
 		val := r.LookupOrInsert(ref("foo.aaa.bar.q"))
-		val.rules = append(val.rules, &r0, &r1)
+		val.rules = append(val.rules, r0, r1)
 		r.LookupOrInsert(ref("foo.bbb.bar.q"))
 
-		p := New()
+		p := planner()
 		p.vars.Put(ast.Var("x"), p.newLocal())
 
 		rulesets, _, index, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x].bar.q"))
@@ -928,7 +955,7 @@ func TestOptimizeLookup(t *testing.T) {
 		r.LookupOrInsert(ref("foo.aaa.bar.q"))
 		r.LookupOrInsert(ref("foo.bbb.bar.q"))
 
-		p := New()
+		p := planner()
 		p.vars.Put(ast.Var("x"), p.newLocal())
 
 		rulesets, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.foo[x].bar.q"))
@@ -939,4 +966,252 @@ func TestOptimizeLookup(t *testing.T) {
 			t.Fatalf("expected %d rulesets, got %d\n", exp, act)
 		}
 	})
+
+	t.Run("ref heads, mixed case: string and var last term", func(t *testing.T) {
+		r0, r1 := ast.MustParseRule("b.q.s = 1 { true }"), ast.MustParseRule(`b.q[x] = 2 { x = "t" }`)
+		r := newRuletrie()
+		val := r.LookupOrInsert(ref("a.b.q.s")) // b.q.s = 1 (package a)
+		val.rules = append(val.rules, r0)
+		val = r.LookupOrInsert(ref("a.b.q")) // b.q[x] = 2
+		val.rules = append(val.rules, r1)
+
+		rules := r.Lookup(ref("a.b.q")).Rules()
+		if exp, act := 2, len(rules); exp != act {
+			t.Fatalf("ruletrie: expected %d rules, got %d", exp, act)
+		}
+		if testing.Verbose() {
+			t.Logf("rules: %v", r)
+		}
+
+		p := planner()
+		p.vars.Put(ast.Var("x"), p.newLocal())
+		rulesets, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.a[x].q"))
+
+		if exp, act := true, opt; exp != act {
+			t.Errorf("expected 'optimize' %v, got %v\n", exp, act)
+		}
+		if exp, act := 1, len(rulesets); exp != act {
+			t.Fatalf("expected %d rulesets, got %d\n", exp, act)
+		}
+
+		if exp, act := 2, len(rulesets[0]); exp != act {
+			t.Fatalf("expected %d rules in ruleset[0], got %d\n", exp, act)
+		}
+	})
+
+	t.Run("ref heads, mixed case: string and number last term", func(t *testing.T) {
+		r0, r1 := ast.MustParseRule("b.q[1] = 1 { true }"), ast.MustParseRule(`b.q[x] = 2 { x = "t" }`)
+		r := newRuletrie()
+		val := r.LookupOrInsert(ref("a.b.q")) // b.q[1] = 1 (package a)
+		val.rules = append(val.rules, r0)
+		val = r.LookupOrInsert(ref("a.b.q")) // b.q[x] = 2
+		val.rules = append(val.rules, r1)
+
+		rules := r.Lookup(ref("a.b.q")).Rules()
+		if exp, act := 2, len(rules); exp != act {
+			t.Fatalf("ruletrie: expected %d rules, got %d", exp, act)
+		}
+		if testing.Verbose() {
+			t.Logf("rules: %v", r)
+		}
+
+		p := planner()
+		p.vars.Put(ast.Var("x"), p.newLocal())
+		rulesets, _, _, opt := p.optimizeLookup(r, ast.MustParseRef("data.a[x].q"))
+
+		if exp, act := true, opt; exp != act {
+			t.Errorf("expected 'optimize' %v, got %v\n", exp, act)
+		}
+		if exp, act := 1, len(rulesets); exp != act {
+			t.Fatalf("expected %d rulesets, got %d\n", exp, act)
+		}
+
+		if exp, act := 2, len(rulesets[0]); exp != act {
+			t.Fatalf("expected %d rules in ruleset[0], got %d\n", exp, act)
+		}
+	})
+}
+
+func TestPlannerCallDynamic(t *testing.T) {
+	tests := []struct {
+		note    string
+		queries []string
+		modules []string
+		path    []interface{}                // path expected on irCallDynamicStmt, string => string const, int => local
+		where   func(*ir.Policy) interface{} // where to start walking search for `exps`
+		extras  []func(interface{}) error
+	}{
+		{
+			note:    "CallDynamicStmt optimization",
+			queries: []string{`x := "a"; data.test[x] = y`},
+			modules: []string{`package test
+a { true }`},
+			path: []interface{}{"g0", "test", 2},
+			extras: []func(interface{}) error{
+				findFunc("g0.data.test.a", "g0.test.a"),
+			},
+		},
+		{
+			note:    "simple single-val ref head",
+			queries: []string{`x := "a"; data.test.a[x].c = y`},
+			modules: []string{`package test
+a.b.c = 1 { true }`},
+			path: []interface{}{"g0", "test", "a", 2, "c"},
+			extras: []func(interface{}) error{
+				findFunc("g0.data.test.a.b.c", "g0.test.a.b.c"),
+			},
+		},
+		{
+			note:    "two single-val ref heads, string+var",
+			queries: []string{`x := "a"; data.test.a[x] = y`},
+			modules: []string{`package test
+a.b.c = 1 { true }
+a.b[t] = 2 { t := input }`},
+			path: []interface{}{"g0", "test", "a", 2},
+			extras: []func(interface{}) error{
+				findFunc("g0.data.test.a.b", "g0.test.a.b"),
+			},
+		},
+		{
+			note:    "two single-val ref heads, number+var",
+			queries: []string{`x := "a"; data.test.a[x] = y`},
+			modules: []string{`package test
+a.b[1] = 1 { true }
+a.b[t] = 2 { t := input }`},
+			path: []interface{}{"g0", "test", "a", 2},
+			extras: []func(interface{}) error{
+				findFunc("g0.data.test.a.b", "g0.test.a.b"),
+			},
+		},
+		{
+			note:    "one single-val ref head, number",
+			queries: []string{`x := "a"; data.test.a[x] = y`},
+			modules: []string{`package test
+a.b[1] = 1 { true }`},
+			path: []interface{}{"g0", "test", "a", 2},
+			extras: []func(interface{}) error{
+				findFunc("g0.data.test.a.b", "g0.test.a.b"),
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			queries := make([]ast.Body, len(tc.queries))
+			for i := range queries {
+				queries[i] = ast.MustParseBody(tc.queries[i])
+			}
+			modules := make([]*ast.Module, len(tc.modules))
+			for i := range modules {
+				file := fmt.Sprintf("module-%d.rego", i)
+				m, err := ast.ParseModule(file, tc.modules[i])
+				if err != nil {
+					t.Fatal(err)
+				}
+				modules[i] = m
+			}
+			planner := New().WithQueries([]QuerySet{
+				{
+					Name:    "test",
+					Queries: queries,
+				},
+			}).WithModules(modules).WithBuiltinDecls(ast.BuiltinMap)
+			if testing.Verbose() {
+				planner = planner.WithDebug(os.Stderr)
+			}
+			policy, err := planner.Plan()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if testing.Verbose() {
+				err = ir.Pretty(os.Stderr, policy)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+			start := interface{}(policy)
+			if tc.where != nil {
+				start = tc.where(policy)
+			}
+
+			if tc.path != nil {
+				exp := make([]ir.Operand, len(tc.path))
+				for i := range tc.path {
+					switch x := tc.path[i].(type) {
+					case string:
+						exp[i] = op(ir.StringIndex(planner.getStringConst(x)))
+					case int:
+						exp[i] = op(ir.Local(x))
+					}
+				}
+				if err := findCallDynamic(exp, start); err != nil {
+					t.Error(err)
+				}
+			}
+
+			if tc.extras == nil {
+				return
+			}
+			for _, e := range tc.extras {
+				if err := e(start); err != nil {
+					t.Error(err)
+				}
+			}
+		})
+	}
+}
+
+type stmtCmpWalker struct {
+	stmt  interface{}
+	found bool // stop comparing after first found needle
+}
+
+func (*stmtCmpWalker) Before(interface{}) {}
+func (*stmtCmpWalker) After(interface{})  {}
+func (w *stmtCmpWalker) Visit(x interface{}) (ir.Visitor, error) {
+	if !w.found {
+		switch s := w.stmt.(type) {
+		case *ir.CallDynamicStmt:
+			c, ok := x.(*ir.CallDynamicStmt)
+			if ok {
+				w.found = true
+				if !reflect.DeepEqual(s.Path, c.Path) {
+					return nil, fmt.Errorf("call dynamic %v: expected path %v, got %v", c, s.Path, c.Path)
+				}
+			}
+		case *ir.Func:
+			f, ok := x.(*ir.Func)
+			if ok && s.Name == f.Name {
+				w.found = true
+				if !reflect.DeepEqual(s.Path, f.Path) {
+					return nil, fmt.Errorf("func %v: expected path %v, got %v", f, s.Path, f.Path)
+				}
+			}
+		}
+	}
+	return w, nil
+}
+
+func findCallDynamic(path []ir.Operand, p interface{}) error {
+	w := &stmtCmpWalker{stmt: &ir.CallDynamicStmt{Path: path}}
+	if err := ir.Walk(w, p); err != nil {
+		return err
+	}
+	if !w.found {
+		return fmt.Errorf("not found")
+	}
+	return nil
+}
+
+func findFunc(name, path string) func(interface{}) error {
+	return func(p interface{}) error {
+		w := &stmtCmpWalker{stmt: &ir.Func{Name: name, Path: strings.Split(path, ".")}}
+		if err := ir.Walk(w, p); err != nil {
+			return err
+		}
+		if !w.found {
+			return fmt.Errorf("not found")
+		}
+		return nil
+	}
 }
diff --git a/internal/planner/rules.go b/internal/planner/rules.go
index 3abf3e3957..06fa6d158d 100644
--- a/internal/planner/rules.go
+++ b/internal/planner/rules.go
@@ -1,6 +1,7 @@
 package planner
 
 import (
+	"fmt"
 	"sort"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -82,7 +83,27 @@ func (t *ruletrie) Arity() int {
 
 func (t *ruletrie) Rules() []*ast.Rule {
 	if t != nil {
-		return t.rules
+		if t.rules == nil {
+			return nil
+		}
+		rules := make([]*ast.Rule, len(t.rules), len(t.rules)+len(t.children)) // could be too little
+		copy(rules, t.rules)
+
+		// NOTE(sr): We pull in one layer of children: the compiler ensures
+		// that these are the only possible, relevant rule sources for a given
+		// ref: If the trie is what we get for
+		//
+		//     a.b.c  = 1 { ... }
+		//     a.b[x] = 2 { ... }
+		//
+		// and we're retrieving a.b, we want Rules() to include the rule body
+		// of a.b.c.
+		for _, rs := range t.children {
+			if r := rs[len(rs)-1].rules; r != nil {
+				rules = append(rules, r...)
+			}
+		}
+		return rules
 	}
 	return nil
 }
@@ -143,7 +164,14 @@ func (t *ruletrie) LookupOrInsert(key ast.Ref) *ruletrie {
 	return t.Insert(key)
 }
 
+func (t *ruletrie) ChildrenCount() int {
+	return len(t.children)
+}
+
 func (t *ruletrie) Children() []ast.Value {
+	if t == nil {
+		return nil
+	}
 	sorted := make([]ast.Value, 0, len(t.children))
 	for key := range t.children {
 		if t.Get(key) != nil {
@@ -166,3 +194,81 @@ func (t *ruletrie) Get(k ast.Value) *ruletrie {
 	}
 	return nodes[len(nodes)-1]
 }
+
+func (t *ruletrie) DepthFirst(f func(*ruletrie) bool) {
+	if f(t) {
+		return
+	}
+	for _, rules := range t.children {
+		for i := range rules {
+			rules[i].DepthFirst(f)
+		}
+	}
+}
+
+func (t *ruletrie) Depth() int {
+	if len(t.Children()) == 0 {
+		return 0
+	}
+	c := make([]int, 0, len(t.Children()))
+	for _, nodes := range t.children {
+		c = append(c, nodes[len(nodes)-1].Depth())
+	}
+	max := 0
+	for i := range c {
+		if max < c[i] {
+			max = c[i]
+		}
+	}
+	return max + 1
+}
+
+func (t *ruletrie) String() string {
+	return fmt.Sprintf("<ruletrie rules:%v children:%v>", t.rules, t.children)
+}
+
+type functionMocksStack struct {
+	stack []*functionMocksElem
+}
+
+type functionMocksElem []frame
+
+type frame map[string]*ast.Term
+
+func newFunctionMocksStack() *functionMocksStack {
+	stack := &functionMocksStack{}
+	stack.Push()
+	return stack
+}
+
+func newFunctionMocksElem() *functionMocksElem {
+	return &functionMocksElem{}
+}
+
+func (s *functionMocksStack) Push() {
+	s.stack = append(s.stack, newFunctionMocksElem())
+}
+
+func (s *functionMocksStack) Pop() {
+	s.stack = s.stack[:len(s.stack)-1]
+}
+
+func (s *functionMocksStack) PushFrame(f frame) {
+	current := s.stack[len(s.stack)-1]
+	*current = append(*current, f)
+}
+
+func (s *functionMocksStack) PopFrame() {
+	current := s.stack[len(s.stack)-1]
+	*current = (*current)[:len(*current)-1]
+}
+
+func (s *functionMocksStack) Lookup(f string) *ast.Term {
+	current := *s.stack[len(s.stack)-1]
+	for i := len(current) - 1; i >= 0; i-- {
+		if t, ok := current[i][f]; ok {
+			return t
+		}
+	}
+	return nil
+}
diff --git a/internal/planner/varstack.go b/internal/planner/varstack.go
index 7dbf8f43c0..dccff1b5c1 100644
--- a/internal/planner/varstack.go
+++ b/internal/planner/varstack.go
@@ -6,7 +6,7 @@ package planner
 
 import (
 	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/internal/ir"
+	"github.com/open-policy-agent/opa/ir"
 )
 
 type varstack []map[ast.Var]ir.Local
@@ -42,6 +42,19 @@ func (vs varstack) Get(k ast.Var) (ir.Local, bool) {
 	return 0, false
 }
 
+func (vs varstack) GetOpOrEmpty(k ast.Var) ir.Operand {
+	l := vs.GetOrEmpty(k)
+	return ir.Operand{Value: l}
+}
+
+func (vs varstack) GetOp(k ast.Var) (ir.Operand, bool) {
+	l, ok := vs.Get(k)
+	if !ok {
+		return ir.Operand{}, false
+	}
+	return ir.Operand{Value: l}, true
+}
+
 func (vs varstack) Put(k ast.Var, v ir.Local) {
 	vs[len(vs)-1][k] = v
 }
diff --git a/internal/planner/varstack_test.go b/internal/planner/varstack_test.go
index e342065645..5a56b28670 100644
--- a/internal/planner/varstack_test.go
+++ b/internal/planner/varstack_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/internal/ir"
+	"github.com/open-policy-agent/opa/ir"
 )
 
 func TestVarStackPushPop(t *testing.T) {
diff --git a/internal/presentation/presentation.go b/internal/presentation/presentation.go
index fbe1149a01..7a024d87f2 100644
--- a/internal/presentation/presentation.go
+++ b/internal/presentation/presentation.go
@@ -75,7 +75,7 @@ func (o DepAnalysisOutput) Pretty(w io.Writer) error {
 		}
 	} else if len(o.Virtual) > 0 {
 		headers = []string{"Virtual Documents"}
-		rows = make([][]string, len(o.Base))
+		rows = make([][]string, len(o.Virtual))
 		for i := range rows {
 			rows[i] = []string{o.Virtual[i].String()}
 		}
@@ -223,7 +223,8 @@ func (e OutputErrors) Error() string {
 		prefix = fmt.Sprintf("%d errors occurred:\n", len(e))
 	}
 
-	var s []string
+	// We preallocate for at least the minimum number of strings.
+	s := make([]string, 0, len(e))
 	for _, err := range e {
 		s = append(s, err.Error())
 		if l, ok := err.Details.(string); ok {
@@ -346,7 +347,7 @@ func Source(w io.Writer, r Output) error {
 
 	for i := range r.Partial.Queries {
 		fmt.Fprintf(w, "# Query %d\n", i+1)
-		bs, err := format.Ast(r.Partial.Queries[i])
+		bs, err := format.AstWithOpts(r.Partial.Queries[i], format.Opts{IgnoreLocations: true})
 		if err != nil {
 			return err
 		}
@@ -355,7 +356,7 @@ func Source(w io.Writer, r Output) error {
 
 	for i := range r.Partial.Support {
 		fmt.Fprintf(w, "# Module %d\n", i+1)
-		bs, err := format.Ast(r.Partial.Support[i])
+		bs, err := format.AstWithOpts(r.Partial.Support[i], format.Opts{IgnoreLocations: true})
 		if err != nil {
 			return err
 		}
@@ -455,10 +456,11 @@ func prettyPartial(w io.Writer, pq *rego.PartialQueries) error {
 	return nil
 }
 
+// prettyASTNode is used for pretty-printing the result of partial eval
 func prettyASTNode(x interface{}) (string, int, error) {
-	bs, err := format.Ast(x)
+	bs, err := format.AstWithOpts(x, format.Opts{IgnoreLocations: true})
 	if err != nil {
-		return "", 0, fmt.Errorf("format error: %v", err)
+		return "", 0, fmt.Errorf("format error: %w", err)
 	}
 	var maxLineWidth int
 	s := strings.Trim(strings.Replace(string(bs), "\t", "  ", -1), "\n")
@@ -494,14 +496,16 @@ func prettyAggregatedMetrics(w io.Writer, ms map[string]interface{}, limit int)
 
 func prettyProfile(w io.Writer, profile []profiler.ExprStats) error {
 	tableProfile := generateTableProfile(w)
+
 	for _, rs := range profile {
 		line := []string{}
 		timeNs := time.Duration(rs.ExprTimeNs) * time.Nanosecond
 		timeNsStr := timeNs.String()
 		numEval := strconv.FormatInt(int64(rs.NumEval), 10)
 		numRedo := strconv.FormatInt(int64(rs.NumRedo), 10)
+		numGenExpr := strconv.FormatInt(int64(rs.NumGenExpr), 10)
 		loc := rs.Location.String()
-		line = append(line, timeNsStr, numEval, numRedo, loc)
+		line = append(line, timeNsStr, numEval, numRedo, numGenExpr, loc)
 		tableProfile.Append(line)
 	}
 	if tableProfile.NumLines() > 0 {
@@ -511,7 +515,7 @@ func prettyProfile(w io.Writer, profile []profiler.ExprStats) error {
 }
 
 func prettyAggregatedProfile(w io.Writer, profile []profiler.ExprStatsAggregated) error {
-	tableProfile := generateTableWithKeys(w, append(statKeys, "num eval", "num redo", "location")...)
+	tableProfile := generateTableWithKeys(w, append(statKeys, "num eval", "num redo", "num gen expr", "location")...)
 	for _, rs := range profile {
 		line := []string{}
 		for _, k := range statKeys {
@@ -524,8 +528,9 @@ func prettyAggregatedProfile(w io.Writer, profile []profiler.ExprStatsAggregated
 		}
 		numEval := strconv.FormatInt(int64(rs.NumEval), 10)
 		numRedo := strconv.FormatInt(int64(rs.NumRedo), 10)
+		numGenExpr := strconv.FormatInt(int64(rs.NumGenExpr), 10)
 		loc := rs.Location.String()
-		line = append(line, numEval, numRedo, loc)
+		line = append(line, numEval, numRedo, numGenExpr, loc)
 		tableProfile.Append(line)
 	}
 	if tableProfile.NumLines() > 0 {
@@ -596,10 +601,10 @@ func generateTableMetrics(writer io.Writer) *tablewriter.Table {
 
 func generateTableWithKeys(writer io.Writer, keys ...string) *tablewriter.Table {
 	table := tablewriter.NewWriter(writer)
-	aligns := []int{}
-	var hdrs []string
+	aligns := make([]int, 0, len(keys))
+	hdrs := make([]string, 0, len(keys))
 	for _, k := range keys {
-		hdrs = append(hdrs, strings.Title((k)))
+		hdrs = append(hdrs, strings.Title(k)) //nolint:staticcheck // SA1019, no unicode here
 		aligns = append(aligns, tablewriter.ALIGN_LEFT)
 	}
 	table.SetHeader(hdrs)
@@ -609,7 +614,7 @@ func generateTableWithKeys(writer io.Writer, keys ...string) *tablewriter.Table
 }
 
 func generateTableProfile(writer io.Writer) *tablewriter.Table {
-	return generateTableWithKeys(writer, "Time", "Num Eval", "Num Redo", "Location")
+	return generateTableWithKeys(writer, "Time", "Num Eval", "Num Redo", "Num Gen Expr", "Location")
 }
 
 func populateTableMetrics(m metrics.Metrics, table *tablewriter.Table, prettyLimit int) {
diff --git a/internal/presentation/presentation_test.go b/internal/presentation/presentation_test.go
index 4ab7a229db..f92bcb73f2 100644
--- a/internal/presentation/presentation_test.go
+++ b/internal/presentation/presentation_test.go
@@ -11,15 +11,15 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 
-	"github.com/open-policy-agent/opa/util"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/loader"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
+	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -197,6 +197,8 @@ func TestOutputJSONErrorStructuredAstErr(t *testing.T) {
 			  "want": {
 				"args": [
 				  {
+					"description": "the set/array/object/string to be counted",
+					"name": "collection",
 					"of": [
 					  {
 						"type": "string"
@@ -228,6 +230,8 @@ func TestOutputJSONErrorStructuredAstErr(t *testing.T) {
 					"type": "any"
 				  },
 				  {
+					"description": "the count of elements, key/val pairs, or characters, respectively.",
+					"name": "n",
 					"type": "number"
 				  }
 				]
@@ -506,3 +510,67 @@ func TestRaw(t *testing.T) {
 		})
 	}
 }
+
+func TestDepsAnalysisPrettyOutput(t *testing.T) {
+	tests := []struct {
+		note   string
+		output DepAnalysisOutput
+		want   []string
+	}{
+		{
+			note:   "base document",
+			output: DepAnalysisOutput{Base: []ast.Ref{ast.InputRootRef}},
+			want: []string{
+				"+----------------+",
+				"| BASE DOCUMENTS |",
+				"+----------------+",
+				"| input          |",
+				"+----------------+",
+			},
+		},
+		{
+			note: "virtual document",
+			output: DepAnalysisOutput{
+				Virtual: []ast.Ref{[]*ast.Term{
+					ast.VarTerm("data"), ast.StringTerm("policy"), ast.StringTerm("allow")},
+				},
+			},
+			want: []string{
+				"+-------------------+",
+				"| VIRTUAL DOCUMENTS |",
+				"+-------------------+",
+				"| data.policy.allow |",
+				"+-------------------+",
+			},
+		},
+		{
+			note: "base document and virtual document",
+			output: DepAnalysisOutput{
+				Base: []ast.Ref{ast.InputRootRef},
+				Virtual: []ast.Ref{[]*ast.Term{
+					ast.VarTerm("data"), ast.StringTerm("policy"), ast.StringTerm("allow")},
+				},
+			},
+			want: []string{
+				"+----------------+-------------------+",
+				"| BASE DOCUMENTS | VIRTUAL DOCUMENTS |",
+				"+----------------+-------------------+",
+				"| input          | data.policy.allow |",
+				"+----------------+-------------------+",
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			buf := new(bytes.Buffer)
+			if err := tc.output.Pretty(buf); err != nil {
+				t.Fatalf("unexpected error %v", err)
+			}
+			expected := strings.Join(tc.want, "\n") + "\n"
+			if buf.String() != expected {
+				t.Errorf("expected %v, got %v", expected, buf.String())
+			}
+		})
+	}
+}
diff --git a/internal/prometheus/prometheus.go b/internal/prometheus/prometheus.go
index 3b504ef685..a9bac6ab22 100644
--- a/internal/prometheus/prometheus.go
+++ b/internal/prometheus/prometheus.go
@@ -7,12 +7,18 @@ package prometheus
 import (
 	"bufio"
 	"encoding/json"
+	"fmt"
+	"math"
 	"net"
 	"net/http"
+	"runtime"
 	"strconv"
 
+	// Need to keep deprecated package for compatibility with prometheus/client_golang
+	"github.com/golang/protobuf/jsonpb" // nolint:staticcheck
+	"github.com/golang/protobuf/proto"  // nolint:staticcheck
+
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 
 	"github.com/open-policy-agent/opa/metrics"
@@ -25,13 +31,15 @@ type Provider struct {
 	durationHistogram    *prometheus.HistogramVec
 	cancellationCounters *prometheus.CounterVec
 	inner                metrics.Metrics
-	logger               func(attrs map[string]interface{}, f string, a ...interface{})
+	logger               loggerFunc
 }
 
+type loggerFunc func(attrs map[string]interface{}, f string, a ...interface{})
+
 // New returns a new Provider object.
-func New(inner metrics.Metrics, logger func(attrs map[string]interface{}, f string, a ...interface{})) *Provider {
+func New(inner metrics.Metrics, logger loggerFunc) *Provider {
 	registry := prometheus.NewRegistry()
-	registry.MustRegister(collectors.NewGoCollector())
+	registry.MustRegister(collector())
 	durationHistogram := prometheus.NewHistogramVec(
 		prometheus.HistogramOpts{
 			Name: "http_request_duration_seconds",
@@ -73,6 +81,7 @@ func New(inner metrics.Metrics, logger func(attrs map[string]interface{}, f stri
 
 // RegisterEndpoints registers `/metrics` endpoint
 func (p *Provider) RegisterEndpoints(registrar func(path, method string, handler http.Handler)) {
+	registrar("/metrics/alloc_bytes", http.MethodGet, http.HandlerFunc(allocHandler))
 	registrar("/metrics", http.MethodGet, promhttp.HandlerFor(p.registry, promhttp.HandlerOpts{}))
 }
 
@@ -116,12 +125,21 @@ func (p *Provider) All() map[string]interface{} {
 	}
 
 	for _, f := range families {
-		all[f.GetName()] = f
+		all[f.GetName()] = wrap{family: f}
 	}
 
 	return all
 }
 
+type wrap struct{ family proto.Message }
+
+var marshaler = jsonpb.Marshaler{}
+
+func (w wrap) MarshalJSON() ([]byte, error) {
+	s, err := marshaler.MarshalToString(w.family)
+	return []byte(s), err
+}
+
 // MarshalJSON returns a JSON representation of the unioned metrics.
 func (p *Provider) MarshalJSON() ([]byte, error) {
 	return json.Marshal(p.All())
@@ -149,6 +167,21 @@ func (p *Provider) Clear() {
 	p.inner.Clear()
 }
 
+// Register register the collectors on OPA prometheus registry
+func (p *Provider) Register(c prometheus.Collector) error {
+	return p.registry.Register(c)
+}
+
+// MustRegister register the collectors on OPA prometheus registry and panics when an error occurs
+func (p *Provider) MustRegister(cs ...prometheus.Collector) {
+	p.registry.MustRegister(cs...)
+}
+
+// Unregister unregister the collectors on OPA prometheus registry
+func (p *Provider) Unregister(c prometheus.Collector) bool {
+	return p.registry.Unregister(c)
+}
+
 type captureStatusResponseWriter struct {
 	http.ResponseWriter
 	status int
@@ -167,3 +200,31 @@ func (c *captureStatusResponseWriter) WriteHeader(statusCode int) {
 	c.ResponseWriter.WriteHeader(statusCode)
 	c.status = statusCode
 }
+
+func prettyByteSize(b uint64) string {
+	bf := float64(b)
+	for _, unit := range []string{"", "K", "M", "G", "T", "P", "E", "Z"} {
+		if math.Abs(bf) < 1000.0 {
+			return fmt.Sprintf("%3.1f%sB", bf, unit)
+		}
+		bf /= 1000.0
+	}
+	return fmt.Sprintf("%.1fYiB", bf)
+}
+
+func allocHandler(rsp http.ResponseWriter, req *http.Request) {
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+
+	total := m.HeapInuse + m.StackInuse + m.MCacheInuse + m.MSpanInuse
+
+	var alloc string
+	if req.URL.Query().Get("pretty") == "true" {
+		alloc = prettyByteSize(total)
+	} else {
+		alloc = fmt.Sprintf("%d", total)
+	}
+
+	rsp.WriteHeader(200)
+	_, _ = fmt.Fprintln(rsp, alloc)
+}
diff --git a/internal/prometheus/prometheus_go1.17.go b/internal/prometheus/prometheus_go1.17.go
new file mode 100644
index 0000000000..2bc0bea91b
--- /dev/null
+++ b/internal/prometheus/prometheus_go1.17.go
@@ -0,0 +1,18 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package prometheus
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/collectors"
+)
+
+func collector() prometheus.Collector {
+	return collectors.NewGoCollector(
+		collectors.WithGoCollectorRuntimeMetrics(
+			collectors.MetricsAll,
+		),
+	)
+}
diff --git a/internal/prometheus/prometheus_go1.19_test.go b/internal/prometheus/prometheus_go1.19_test.go
new file mode 100644
index 0000000000..ffed0ca14f
--- /dev/null
+++ b/internal/prometheus/prometheus_go1.19_test.go
@@ -0,0 +1,145 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// NOTE(sr): Different go runtime metrics on 1.19.
+// This can be removed when we drop support for go 1.19.
+//go:build go1.19 && !go1.20
+// +build go1.19,!go1.20
+
+package prometheus
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/metrics"
+)
+
+func TestJSONSerialization(t *testing.T) {
+	inner := metrics.New()
+	logger := func(logger logging.Logger) loggerFunc {
+		return func(attrs map[string]interface{}, f string, a ...interface{}) {
+			logger.WithFields(attrs).Error(f, a...)
+		}
+	}(logging.NewNoOpLogger())
+
+	prom := New(inner, logger)
+
+	m := prom.All()
+	bs, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	act := make(map[string]map[string]interface{}, len(m))
+	err = json.Unmarshal(bs, &act)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// NOTE(sr): "http_request_duration_seconds" only shows up after there has been a request
+	exp := map[string][]string{
+		"GAUGE": {
+			"go_gc_heap_goal_bytes",
+			"go_gc_heap_objects_objects",
+			"go_gc_stack_starting_size_bytes",
+			"go_gc_limiter_last_enabled_gc_cycle",
+			"go_goroutines",
+			"go_info",
+			"go_memory_classes_heap_free_bytes",
+			"go_memory_classes_heap_objects_bytes",
+			"go_memory_classes_heap_released_bytes",
+			"go_memory_classes_heap_stacks_bytes",
+			"go_memory_classes_heap_unused_bytes",
+			"go_memory_classes_metadata_mcache_free_bytes",
+			"go_memory_classes_metadata_mcache_inuse_bytes",
+			"go_memory_classes_metadata_mspan_free_bytes",
+			"go_memory_classes_metadata_mspan_inuse_bytes",
+			"go_memory_classes_metadata_other_bytes",
+			"go_memory_classes_os_stacks_bytes",
+			"go_memory_classes_other_bytes",
+			"go_memory_classes_profiling_buckets_bytes",
+			"go_memory_classes_total_bytes",
+			"go_memstats_alloc_bytes",
+			"go_memstats_buck_hash_sys_bytes",
+			// "go_memstats_gc_cpu_fraction", // removed: https://github.com/prometheus/client_golang/issues/842#issuecomment-861812034
+			"go_memstats_gc_sys_bytes",
+			"go_memstats_heap_alloc_bytes",
+			"go_memstats_heap_idle_bytes",
+			"go_memstats_heap_inuse_bytes",
+			"go_memstats_heap_objects",
+			"go_memstats_heap_released_bytes",
+			"go_memstats_heap_sys_bytes",
+			"go_memstats_last_gc_time_seconds",
+			"go_memstats_mcache_inuse_bytes",
+			"go_memstats_mcache_sys_bytes",
+			"go_memstats_mspan_inuse_bytes",
+			"go_memstats_mspan_sys_bytes",
+			"go_memstats_next_gc_bytes",
+			"go_memstats_other_sys_bytes",
+			"go_memstats_stack_inuse_bytes",
+			"go_memstats_stack_sys_bytes",
+			"go_memstats_sys_bytes",
+			"go_sched_goroutines_goroutines",
+			"go_sched_gomaxprocs_threads",
+			"go_threads",
+		},
+		"COUNTER": {
+			"go_gc_cycles_automatic_gc_cycles_total",
+			"go_gc_cycles_forced_gc_cycles_total",
+			"go_gc_cycles_total_gc_cycles_total",
+			"go_gc_heap_allocs_bytes_total",
+			"go_gc_heap_allocs_objects_total",
+			"go_gc_heap_tiny_allocs_objects_total",
+			"go_gc_heap_frees_bytes_total",
+			"go_gc_heap_frees_objects_total",
+			"go_cgo_go_to_c_calls_calls_total",
+			"go_memstats_alloc_bytes_total",
+			"go_memstats_lookups_total",
+			"go_memstats_mallocs_total",
+			"go_memstats_frees_total",
+		},
+		"SUMMARY": {
+			"go_gc_duration_seconds",
+		},
+		"HISTOGRAM": {
+			"go_gc_pauses_seconds",            // was: "go_gc_pauses_seconds_total"
+			"go_gc_heap_allocs_by_size_bytes", // was: "go_gc_heap_allocs_by_size_bytes_total"
+			"go_gc_heap_frees_by_size_bytes",  // was: "go_gc_heap_frees_by_size_bytes_total"
+			"go_sched_latencies_seconds",
+		},
+	}
+	found := 0
+	for typ, es := range exp {
+		for _, e := range es {
+			a, ok := act[e]
+			if !ok {
+				t.Errorf("%v: metric missing", e)
+				continue
+			}
+			if act, ok := a["type"].(string); !ok || act != typ {
+				t.Errorf("%v: unexpected type: %v (expected %v)", e, act, typ)
+				continue
+			}
+			found++
+		}
+	}
+	if len(act) != found {
+		t.Errorf("unexpected extra metrics, expected %d, got %d", found, len(act))
+		for a, ty := range act {
+			found := false
+			for _, es := range exp {
+				for _, e := range es {
+					if a == e {
+						found = true
+					}
+				}
+			}
+			if !found {
+				t.Errorf("unexpected metric: %v (type: %v)", a, ty)
+			}
+		}
+	}
+}
diff --git a/internal/prometheus/prometheus_test.go b/internal/prometheus/prometheus_test.go
new file mode 100644
index 0000000000..75636b454c
--- /dev/null
+++ b/internal/prometheus/prometheus_test.go
@@ -0,0 +1,157 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// NOTE(an): Different go runtime metrics on 1.20.
+// This can be removed when we drop support for go 1.19.
+//go:build go1.20
+// +build go1.20
+
+package prometheus
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/metrics"
+)
+
+func TestJSONSerialization(t *testing.T) {
+	inner := metrics.New()
+	logger := func(logger logging.Logger) loggerFunc {
+		return func(attrs map[string]interface{}, f string, a ...interface{}) {
+			logger.WithFields(attrs).Error(f, a...)
+		}
+	}(logging.NewNoOpLogger())
+
+	prom := New(inner, logger)
+
+	m := prom.All()
+	bs, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	act := make(map[string]map[string]interface{}, len(m))
+	err = json.Unmarshal(bs, &act)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// NOTE(sr): "http_request_duration_seconds" only shows up after there has been a request
+	exp := map[string][]string{
+		"GAUGE": {
+			"go_gc_heap_goal_bytes",
+			"go_gc_heap_objects_objects",
+			"go_gc_stack_starting_size_bytes",
+			"go_gc_limiter_last_enabled_gc_cycle",
+			"go_goroutines",
+			"go_info",
+			"go_memory_classes_heap_free_bytes",
+			"go_memory_classes_heap_objects_bytes",
+			"go_memory_classes_heap_released_bytes",
+			"go_memory_classes_heap_stacks_bytes",
+			"go_memory_classes_heap_unused_bytes",
+			"go_memory_classes_metadata_mcache_free_bytes",
+			"go_memory_classes_metadata_mcache_inuse_bytes",
+			"go_memory_classes_metadata_mspan_free_bytes",
+			"go_memory_classes_metadata_mspan_inuse_bytes",
+			"go_memory_classes_metadata_other_bytes",
+			"go_memory_classes_os_stacks_bytes",
+			"go_memory_classes_other_bytes",
+			"go_memory_classes_profiling_buckets_bytes",
+			"go_memory_classes_total_bytes",
+			"go_memstats_alloc_bytes",
+			"go_memstats_buck_hash_sys_bytes",
+			// "go_memstats_gc_cpu_fraction", // removed: https://github.com/prometheus/client_golang/issues/842#issuecomment-861812034
+			"go_memstats_gc_sys_bytes",
+			"go_memstats_heap_alloc_bytes",
+			"go_memstats_heap_idle_bytes",
+			"go_memstats_heap_inuse_bytes",
+			"go_memstats_heap_objects",
+			"go_memstats_heap_released_bytes",
+			"go_memstats_heap_sys_bytes",
+			"go_memstats_last_gc_time_seconds",
+			"go_memstats_mcache_inuse_bytes",
+			"go_memstats_mcache_sys_bytes",
+			"go_memstats_mspan_inuse_bytes",
+			"go_memstats_mspan_sys_bytes",
+			"go_memstats_next_gc_bytes",
+			"go_memstats_other_sys_bytes",
+			"go_memstats_stack_inuse_bytes",
+			"go_memstats_stack_sys_bytes",
+			"go_memstats_sys_bytes",
+			"go_sched_goroutines_goroutines",
+			"go_sched_gomaxprocs_threads",
+			"go_threads",
+		},
+		"COUNTER": {
+			"go_gc_cycles_automatic_gc_cycles_total",
+			"go_gc_cycles_forced_gc_cycles_total",
+			"go_gc_cycles_total_gc_cycles_total",
+			"go_gc_heap_allocs_bytes_total",
+			"go_gc_heap_allocs_objects_total",
+			"go_gc_heap_tiny_allocs_objects_total",
+			"go_gc_heap_frees_bytes_total",
+			"go_gc_heap_frees_objects_total",
+			"go_cgo_go_to_c_calls_calls_total",
+			"go_memstats_alloc_bytes_total",
+			"go_memstats_lookups_total",
+			"go_memstats_mallocs_total",
+			"go_memstats_frees_total",
+			"go_cpu_classes_idle_cpu_seconds_total",
+			"go_cpu_classes_gc_mark_dedicated_cpu_seconds_total",
+			"go_cpu_classes_scavenge_background_cpu_seconds_total",
+			"go_cpu_classes_user_cpu_seconds_total",
+			"go_cpu_classes_scavenge_assist_cpu_seconds_total",
+			"go_cpu_classes_gc_mark_idle_cpu_seconds_total",
+			"go_cpu_classes_scavenge_total_cpu_seconds_total",
+			"go_cpu_classes_gc_mark_assist_cpu_seconds_total",
+			"go_cpu_classes_total_cpu_seconds_total",
+			"go_cpu_classes_gc_total_cpu_seconds_total",
+			"go_sync_mutex_wait_total_seconds_total",
+			"go_cpu_classes_gc_pause_cpu_seconds_total",
+		},
+		"SUMMARY": {
+			"go_gc_duration_seconds",
+		},
+		"HISTOGRAM": {
+			"go_gc_pauses_seconds",            // was: "go_gc_pauses_seconds_total"
+			"go_gc_heap_allocs_by_size_bytes", // was: "go_gc_heap_allocs_by_size_bytes_total"
+			"go_gc_heap_frees_by_size_bytes",  // was: "go_gc_heap_frees_by_size_bytes_total"
+			"go_sched_latencies_seconds",
+		},
+	}
+	found := 0
+	for typ, es := range exp {
+		for _, e := range es {
+			a, ok := act[e]
+			if !ok {
+				t.Errorf("%v: metric missing", e)
+				continue
+			}
+			if act, ok := a["type"].(string); !ok || act != typ {
+				t.Errorf("%v: unexpected type: %v (expected %v)", e, act, typ)
+				continue
+			}
+			found++
+		}
+	}
+	if len(act) != found {
+		t.Errorf("unexpected extra metrics, expected %d, got %d", found, len(act))
+		for a, ty := range act {
+			found := false
+			for _, es := range exp {
+				for _, e := range es {
+					if a == e {
+						found = true
+					}
+				}
+			}
+			if !found {
+				t.Errorf("unexpected metric: %v (type: %v)", a, ty)
+			}
+		}
+	}
+}
diff --git a/internal/providers/aws/NOTICE.txt b/internal/providers/aws/NOTICE.txt
new file mode 100644
index 0000000000..5f14d1162e
--- /dev/null
+++ b/internal/providers/aws/NOTICE.txt
@@ -0,0 +1,3 @@
+AWS SDK for Go
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved. 
+Copyright 2014-2015 Stripe, Inc.
diff --git a/internal/providers/aws/crypto/compare.go b/internal/providers/aws/crypto/compare.go
new file mode 100644
index 0000000000..1d0f25f8c2
--- /dev/null
+++ b/internal/providers/aws/crypto/compare.go
@@ -0,0 +1,30 @@
+package crypto
+
+import "fmt"
+
+// ConstantTimeByteCompare is a constant-time byte comparison of x and y. This function performs an absolute comparison
+// if the two byte slices assuming they represent a big-endian number.
+//
+//		 error if len(x) != len(y)
+//	  -1 if x <  y
+//	   0 if x == y
+//	  +1 if x >  y
+func ConstantTimeByteCompare(x, y []byte) (int, error) {
+	if len(x) != len(y) {
+		return 0, fmt.Errorf("slice lengths do not match")
+	}
+
+	xLarger, yLarger := 0, 0
+
+	for i := 0; i < len(x); i++ {
+		xByte, yByte := int(x[i]), int(y[i])
+
+		x := ((yByte - xByte) >> 8) & 1
+		y := ((xByte - yByte) >> 8) & 1
+
+		xLarger |= x &^ yLarger
+		yLarger |= y &^ xLarger
+	}
+
+	return xLarger - yLarger, nil
+}
diff --git a/internal/providers/aws/crypto/compare_test.go b/internal/providers/aws/crypto/compare_test.go
new file mode 100644
index 0000000000..1de09f36a1
--- /dev/null
+++ b/internal/providers/aws/crypto/compare_test.go
@@ -0,0 +1,52 @@
+package crypto
+
+import (
+	"bytes"
+	"math/big"
+	"testing"
+)
+
+func TestConstantTimeByteCompare(t *testing.T) {
+	cases := []struct {
+		x, y      []byte
+		r         int
+		expectErr bool
+	}{
+		{x: []byte{}, y: []byte{}, r: 0},
+		{x: []byte{40}, y: []byte{30}, r: 1},
+		{x: []byte{30}, y: []byte{40}, r: -1},
+		{x: []byte{60, 40, 30, 10, 20}, y: []byte{50, 30, 20, 0, 10}, r: 1},
+		{x: []byte{50, 30, 20, 0, 10}, y: []byte{60, 40, 30, 10, 20}, r: -1},
+		{x: nil, y: []byte{}, r: 0},
+		{x: []byte{}, y: nil, r: 0},
+		{x: []byte{}, y: []byte{10}, expectErr: true},
+		{x: []byte{10}, y: []byte{}, expectErr: true},
+		{x: []byte{10, 20}, y: []byte{10}, expectErr: true},
+	}
+
+	for _, tt := range cases {
+		compare, err := ConstantTimeByteCompare(tt.x, tt.y)
+		if (err != nil) != tt.expectErr {
+			t.Fatalf("expectErr=%v, got %v", tt.expectErr, err)
+		}
+		if e, a := tt.r, compare; e != a {
+			t.Errorf("expect %v, got %v", e, a)
+		}
+	}
+}
+
+func BenchmarkConstantTimeCompare(b *testing.B) {
+	x, y := big.NewInt(1023), big.NewInt(1024)
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, _ = ConstantTimeByteCompare(x.Bytes(), y.Bytes())
+	}
+}
+
+func BenchmarkCompare(b *testing.B) {
+	x, y := big.NewInt(1023).Bytes(), big.NewInt(1024).Bytes()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		bytes.Compare(x, y)
+	}
+}
diff --git a/internal/providers/aws/crypto/ecc.go b/internal/providers/aws/crypto/ecc.go
new file mode 100644
index 0000000000..758c73fcb3
--- /dev/null
+++ b/internal/providers/aws/crypto/ecc.go
@@ -0,0 +1,113 @@
+package crypto
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hmac"
+	"encoding/asn1"
+	"encoding/binary"
+	"fmt"
+	"hash"
+	"math"
+	"math/big"
+)
+
+type ecdsaSignature struct {
+	R, S *big.Int
+}
+
+// ECDSAKey takes the given elliptic curve, and private key (d) byte slice
+// and returns the private ECDSA key.
+func ECDSAKey(curve elliptic.Curve, d []byte) *ecdsa.PrivateKey {
+	return ECDSAKeyFromPoint(curve, (&big.Int{}).SetBytes(d))
+}
+
+// ECDSAKeyFromPoint takes the given elliptic curve and point and returns the
+// private and public keypair
+func ECDSAKeyFromPoint(curve elliptic.Curve, d *big.Int) *ecdsa.PrivateKey {
+	pX, pY := curve.ScalarBaseMult(d.Bytes())
+
+	privKey := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: curve,
+			X:     pX,
+			Y:     pY,
+		},
+		D: d,
+	}
+
+	return privKey
+}
+
+// ECDSAPublicKey takes the provide curve and (x, y) coordinates and returns
+// *ecdsa.PublicKey. Returns an error if the given points are not on the curve.
+func ECDSAPublicKey(curve elliptic.Curve, x, y []byte) (*ecdsa.PublicKey, error) {
+	xPoint := (&big.Int{}).SetBytes(x)
+	yPoint := (&big.Int{}).SetBytes(y)
+
+	if !curve.IsOnCurve(xPoint, yPoint) {
+		return nil, fmt.Errorf("point(%v, %v) is not on the given curve", xPoint.String(), yPoint.String())
+	}
+
+	return &ecdsa.PublicKey{
+		Curve: curve,
+		X:     xPoint,
+		Y:     yPoint,
+	}, nil
+}
+
+// VerifySignature takes the provided public key, hash, and asn1 encoded signature and returns
+// whether the given signature is valid.
+func VerifySignature(key *ecdsa.PublicKey, hash []byte, signature []byte) (bool, error) {
+	var ecdsaSignature ecdsaSignature
+
+	_, err := asn1.Unmarshal(signature, &ecdsaSignature)
+	if err != nil {
+		return false, err
+	}
+
+	return ecdsa.Verify(key, hash, ecdsaSignature.R, ecdsaSignature.S), nil
+}
+
+// HMACKeyDerivation provides an implementation of a NIST-800-108 of a KDF (Key Derivation Function) in Counter Mode.
+// For the purposes of this implantation HMAC is used as the PRF (Pseudorandom function), where the value of
+// `r` is defined as a 4 byte counter.
+func HMACKeyDerivation(hash func() hash.Hash, bitLen int, key []byte, label, context []byte) ([]byte, error) {
+	// verify that we won't overflow the counter
+	n := int64(math.Ceil((float64(bitLen) / 8) / float64(hash().Size())))
+	if n > 0x7FFFFFFF {
+		return nil, fmt.Errorf("unable to derive key of size %d using 32-bit counter", bitLen)
+	}
+
+	// verify the requested bit length is not larger then the length encoding size
+	if int64(bitLen) > 0x7FFFFFFF {
+		return nil, fmt.Errorf("bitLen is greater than 32-bits")
+	}
+
+	fixedInput := bytes.NewBuffer(nil)
+	fixedInput.Write(label)
+	fixedInput.WriteByte(0x00)
+	fixedInput.Write(context)
+	if err := binary.Write(fixedInput, binary.BigEndian, int32(bitLen)); err != nil {
+		return nil, fmt.Errorf("failed to write bit length to fixed input string: %v", err)
+	}
+
+	var output []byte
+
+	h := hmac.New(hash, key)
+
+	for i := int64(1); i <= n; i++ {
+		h.Reset()
+		if err := binary.Write(h, binary.BigEndian, int32(i)); err != nil {
+			return nil, err
+		}
+		_, err := h.Write(fixedInput.Bytes())
+		if err != nil {
+			return nil, err
+		}
+		output = append(output, h.Sum(nil)...)
+	}
+
+	return output[:bitLen/8], nil
+}
diff --git a/internal/providers/aws/crypto/ecc_test.go b/internal/providers/aws/crypto/ecc_test.go
new file mode 100644
index 0000000000..fb3e97165c
--- /dev/null
+++ b/internal/providers/aws/crypto/ecc_test.go
@@ -0,0 +1,277 @@
+package crypto
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"io"
+	"testing"
+)
+
+func TestECDSAPublicKeyDerivation_P256(t *testing.T) {
+	d := []byte{
+		0xc9, 0x80, 0x68, 0x98, 0xa0, 0x33, 0x49, 0x16, 0xc8, 0x60, 0x74, 0x88, 0x80, 0xa5, 0x41, 0xf0,
+		0x93, 0xb5, 0x79, 0xa9, 0xb1, 0xf3, 0x29, 0x34, 0xd8, 0x6c, 0x36, 0x3c, 0x39, 0x80, 0x03, 0x57,
+	}
+
+	x := []byte{
+		0xd0, 0x72, 0x0d, 0xc6, 0x91, 0xaa, 0x80, 0x09, 0x6b, 0xa3, 0x2f, 0xed, 0x1c, 0xb9, 0x7c, 0x2b,
+		0x62, 0x06, 0x90, 0xd0, 0x6d, 0xe0, 0x31, 0x7b, 0x86, 0x18, 0xd5, 0xce, 0x65, 0xeb, 0x72, 0x8f,
+	}
+
+	y := []byte{
+		0x96, 0x81, 0xb5, 0x17, 0xb1, 0xcd, 0xa1, 0x7d, 0x0d, 0x83, 0xd3, 0x35, 0xd9, 0xc4, 0xa8, 0xa9,
+		0xa9, 0xb0, 0xb1, 0xb3, 0xc7, 0x10, 0x6d, 0x8f, 0x3c, 0x72, 0xbc, 0x50, 0x93, 0xdc, 0x27, 0x5f,
+	}
+
+	testKeyDerivation(t, elliptic.P256(), d, x, y)
+}
+
+func TestECDSAPublicKeyDerivation_P384(t *testing.T) {
+	d := []byte{
+		0x53, 0x94, 0xf7, 0x97, 0x3e, 0xa8, 0x68, 0xc5, 0x2b, 0xf3, 0xff, 0x8d, 0x8c, 0xee, 0xb4, 0xdb,
+		0x90, 0xa6, 0x83, 0x65, 0x3b, 0x12, 0x48, 0x5d, 0x5f, 0x62, 0x7c, 0x3c, 0xe5, 0xab, 0xd8, 0x97,
+		0x8f, 0xc9, 0x67, 0x3d, 0x14, 0xa7, 0x1d, 0x92, 0x57, 0x47, 0x93, 0x16, 0x62, 0x49, 0x3c, 0x37,
+	}
+
+	x := []byte{
+		0xfd, 0x3c, 0x84, 0xe5, 0x68, 0x9b, 0xed, 0x27, 0x0e, 0x60, 0x1b, 0x3d, 0x80, 0xf9, 0x0d, 0x67,
+		0xa9, 0xae, 0x45, 0x1c, 0xce, 0x89, 0x0f, 0x53, 0xe5, 0x83, 0x22, 0x9a, 0xd0, 0xe2, 0xee, 0x64,
+		0x56, 0x11, 0xfa, 0x99, 0x36, 0xdf, 0xa4, 0x53, 0x06, 0xec, 0x18, 0x06, 0x67, 0x74, 0xaa, 0x24,
+	}
+
+	y := []byte{
+		0xb8, 0x3c, 0xa4, 0x12, 0x6c, 0xfc, 0x4c, 0x4d, 0x1d, 0x18, 0xa4, 0xb6, 0xc2, 0x1c, 0x7f, 0x69,
+		0x9d, 0x51, 0x23, 0xdd, 0x9c, 0x24, 0xf6, 0x6f, 0x83, 0x38, 0x46, 0xee, 0xb5, 0x82, 0x96, 0x19,
+		0x6b, 0x42, 0xec, 0x06, 0x42, 0x5d, 0xb5, 0xb7, 0x0a, 0x4b, 0x81, 0xb7, 0xfc, 0xf7, 0x05, 0xa0,
+	}
+
+	testKeyDerivation(t, elliptic.P384(), d, x, y)
+}
+
+func TestECDSAKnownSigningValue_P256(t *testing.T) {
+	d := []byte{
+		0x51, 0x9b, 0x42, 0x3d, 0x71, 0x5f, 0x8b, 0x58, 0x1f, 0x4f, 0xa8, 0xee, 0x59, 0xf4, 0x77, 0x1a,
+		0x5b, 0x44, 0xc8, 0x13, 0x0b, 0x4e, 0x3e, 0xac, 0xca, 0x54, 0xa5, 0x6d, 0xda, 0x72, 0xb4, 0x64,
+	}
+
+	testKnownSigningValue(t, elliptic.P256(), d)
+}
+
+func TestECDSAKnownSigningValue_P384(t *testing.T) {
+	d := []byte{
+		0x53, 0x94, 0xf7, 0x97, 0x3e, 0xa8, 0x68, 0xc5, 0x2b, 0xf3, 0xff, 0x8d, 0x8c, 0xee, 0xb4, 0xdb,
+		0x90, 0xa6, 0x83, 0x65, 0x3b, 0x12, 0x48, 0x5d, 0x5f, 0x62, 0x7c, 0x3c, 0xe5, 0xab, 0xd8, 0x97,
+		0x8f, 0xc9, 0x67, 0x3d, 0x14, 0xa7, 0x1d, 0x92, 0x57, 0x47, 0x93, 0x16, 0x62, 0x49, 0x3c, 0x37,
+	}
+
+	testKnownSigningValue(t, elliptic.P384(), d)
+}
+
+func testKeyDerivation(t *testing.T, curve elliptic.Curve, d, expectedX, expectedY []byte) {
+	privKey := ECDSAKey(curve, d)
+
+	if e, a := d, privKey.D.Bytes(); !bytes.Equal(e, a) {
+		t.Errorf("expected % x, got % x", e, a)
+	}
+
+	if e, a := expectedX, privKey.X.Bytes(); !bytes.Equal(e, a) {
+		t.Errorf("expected % x, got % x", e, a)
+	}
+
+	if e, a := expectedY, privKey.Y.Bytes(); !bytes.Equal(e, a) {
+		t.Errorf("expected % x, got % x", e, a)
+	}
+}
+
+func testKnownSigningValue(t *testing.T, curve elliptic.Curve, d []byte) {
+	signingKey := ECDSAKey(curve, d)
+
+	message := []byte{
+		0x59, 0x05, 0x23, 0x88, 0x77, 0xc7, 0x74, 0x21, 0xf7, 0x3e, 0x43, 0xee, 0x3d, 0xa6, 0xf2, 0xd9,
+		0xe2, 0xcc, 0xad, 0x5f, 0xc9, 0x42, 0xdc, 0xec, 0x0c, 0xbd, 0x25, 0x48, 0x29, 0x35, 0xfa, 0xaf,
+		0x41, 0x69, 0x83, 0xfe, 0x16, 0x5b, 0x1a, 0x04, 0x5e, 0xe2, 0xbc, 0xd2, 0xe6, 0xdc, 0xa3, 0xbd,
+		0xf4, 0x6c, 0x43, 0x10, 0xa7, 0x46, 0x1f, 0x9a, 0x37, 0x96, 0x0c, 0xa6, 0x72, 0xd3, 0xfe, 0xb5,
+		0x47, 0x3e, 0x25, 0x36, 0x05, 0xfb, 0x1d, 0xdf, 0xd2, 0x80, 0x65, 0xb5, 0x3c, 0xb5, 0x85, 0x8a,
+		0x8a, 0xd2, 0x81, 0x75, 0xbf, 0x9b, 0xd3, 0x86, 0xa5, 0xe4, 0x71, 0xea, 0x7a, 0x65, 0xc1, 0x7c,
+		0xc9, 0x34, 0xa9, 0xd7, 0x91, 0xe9, 0x14, 0x91, 0xeb, 0x37, 0x54, 0xd0, 0x37, 0x99, 0x79, 0x0f,
+		0xe2, 0xd3, 0x08, 0xd1, 0x61, 0x46, 0xd5, 0xc9, 0xb0, 0xd0, 0xde, 0xbd, 0x97, 0xd7, 0x9c, 0xe8,
+	}
+
+	sha256Hash := sha256.New()
+	_, err := io.Copy(sha256Hash, bytes.NewReader(message))
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	msgHash := sha256Hash.Sum(nil)
+	msgSignature, err := signingKey.Sign(rand.Reader, msgHash, crypto.SHA256)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	verified, err := VerifySignature(&signingKey.PublicKey, msgHash, msgSignature)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	if !verified {
+		t.Fatalf("failed to verify message msgSignature")
+	}
+}
+
+func TestECDSAInvalidSignature_P256(t *testing.T) {
+	testInvalidSignature(t, elliptic.P256())
+}
+
+func TestECDSAInvalidSignature_P384(t *testing.T) {
+	testInvalidSignature(t, elliptic.P384())
+}
+
+func TestECDSAGenKeySignature_P256(t *testing.T) {
+	testGenKeySignature(t, elliptic.P256())
+}
+
+func TestECDSAGenKeySignature_P384(t *testing.T) {
+	testGenKeySignature(t, elliptic.P384())
+}
+
+func testInvalidSignature(t *testing.T, curve elliptic.Curve) {
+	privateKey, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		t.Fatalf("failed to generate key: %v", err)
+	}
+
+	message := []byte{
+		0x59, 0x05, 0x23, 0x88, 0x77, 0xc7, 0x74, 0x21, 0xf7, 0x3e, 0x43, 0xee, 0x3d, 0xa6, 0xf2, 0xd9,
+		0xe2, 0xcc, 0xad, 0x5f, 0xc9, 0x42, 0xdc, 0xec, 0x0c, 0xbd, 0x25, 0x48, 0x29, 0x35, 0xfa, 0xaf,
+		0x41, 0x69, 0x83, 0xfe, 0x16, 0x5b, 0x1a, 0x04, 0x5e, 0xe2, 0xbc, 0xd2, 0xe6, 0xdc, 0xa3, 0xbd,
+		0xf4, 0x6c, 0x43, 0x10, 0xa7, 0x46, 0x1f, 0x9a, 0x37, 0x96, 0x0c, 0xa6, 0x72, 0xd3, 0xfe, 0xb5,
+		0x47, 0x3e, 0x25, 0x36, 0x05, 0xfb, 0x1d, 0xdf, 0xd2, 0x80, 0x65, 0xb5, 0x3c, 0xb5, 0x85, 0x8a,
+		0x8a, 0xd2, 0x81, 0x75, 0xbf, 0x9b, 0xd3, 0x86, 0xa5, 0xe4, 0x71, 0xea, 0x7a, 0x65, 0xc1, 0x7c,
+		0xc9, 0x34, 0xa9, 0xd7, 0x91, 0xe9, 0x14, 0x91, 0xeb, 0x37, 0x54, 0xd0, 0x37, 0x99, 0x79, 0x0f,
+		0xe2, 0xd3, 0x08, 0xd1, 0x61, 0x46, 0xd5, 0xc9, 0xb0, 0xd0, 0xde, 0xbd, 0x97, 0xd7, 0x9c, 0xe8,
+	}
+
+	sha256Hash := sha256.New()
+	_, err = io.Copy(sha256Hash, bytes.NewReader(message))
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	msgHash := sha256Hash.Sum(nil)
+	msgSignature, err := privateKey.Sign(rand.Reader, msgHash, crypto.SHA256)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	byteToFlip := 15
+	switch msgSignature[byteToFlip] {
+	case 0:
+		msgSignature[byteToFlip] = 0x0a
+	default:
+		msgSignature[byteToFlip] &^= msgSignature[byteToFlip]
+	}
+
+	verified, err := VerifySignature(&privateKey.PublicKey, msgHash, msgSignature)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	if verified {
+		t.Fatalf("expected message verification to fail")
+	}
+}
+
+func testGenKeySignature(t *testing.T, curve elliptic.Curve) {
+	privateKey, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		t.Fatalf("failed to generate key: %v", err)
+	}
+
+	message := []byte{
+		0x59, 0x05, 0x23, 0x88, 0x77, 0xc7, 0x74, 0x21, 0xf7, 0x3e, 0x43, 0xee, 0x3d, 0xa6, 0xf2, 0xd9,
+		0xe2, 0xcc, 0xad, 0x5f, 0xc9, 0x42, 0xdc, 0xec, 0x0c, 0xbd, 0x25, 0x48, 0x29, 0x35, 0xfa, 0xaf,
+		0x41, 0x69, 0x83, 0xfe, 0x16, 0x5b, 0x1a, 0x04, 0x5e, 0xe2, 0xbc, 0xd2, 0xe6, 0xdc, 0xa3, 0xbd,
+		0xf4, 0x6c, 0x43, 0x10, 0xa7, 0x46, 0x1f, 0x9a, 0x37, 0x96, 0x0c, 0xa6, 0x72, 0xd3, 0xfe, 0xb5,
+		0x47, 0x3e, 0x25, 0x36, 0x05, 0xfb, 0x1d, 0xdf, 0xd2, 0x80, 0x65, 0xb5, 0x3c, 0xb5, 0x85, 0x8a,
+		0x8a, 0xd2, 0x81, 0x75, 0xbf, 0x9b, 0xd3, 0x86, 0xa5, 0xe4, 0x71, 0xea, 0x7a, 0x65, 0xc1, 0x7c,
+		0xc9, 0x34, 0xa9, 0xd7, 0x91, 0xe9, 0x14, 0x91, 0xeb, 0x37, 0x54, 0xd0, 0x37, 0x99, 0x79, 0x0f,
+		0xe2, 0xd3, 0x08, 0xd1, 0x61, 0x46, 0xd5, 0xc9, 0xb0, 0xd0, 0xde, 0xbd, 0x97, 0xd7, 0x9c, 0xe8,
+	}
+
+	sha256Hash := sha256.New()
+	_, err = io.Copy(sha256Hash, bytes.NewReader(message))
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	msgHash := sha256Hash.Sum(nil)
+	msgSignature, err := privateKey.Sign(rand.Reader, msgHash, crypto.SHA256)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	verified, err := VerifySignature(&privateKey.PublicKey, msgHash, msgSignature)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	if !verified {
+		t.Fatalf("expected message verification to fail")
+	}
+}
+
+func TestECDSASignatureFormat(t *testing.T) {
+	asn1Signature := []byte{
+		0x30, 0x45, 0x02, 0x21, 0x00, 0xd7, 0xc5, 0xb9, 0x9e, 0x0b, 0xb1, 0x1a, 0x1f, 0x32, 0xda, 0x66, 0xe0, 0xff,
+		0x59, 0xb7, 0x8a, 0x5e, 0xb3, 0x94, 0x9c, 0x23, 0xb3, 0xfc, 0x1f, 0x18, 0xcc, 0xf6, 0x61, 0x67, 0x8b, 0xf1,
+		0xc1, 0x02, 0x20, 0x26, 0x4d, 0x8b, 0x7c, 0xaa, 0x52, 0x4c, 0xc0, 0x2e, 0x5f, 0xf6, 0x7e, 0x24, 0x82, 0xe5,
+		0xfb, 0xcb, 0xc7, 0x9b, 0x83, 0x0d, 0x19, 0x7e, 0x7a, 0x40, 0x37, 0x87, 0xdd, 0x1c, 0x93, 0x13, 0xc4,
+	}
+
+	x := []byte{
+		0x1c, 0xcb, 0xe9, 0x1c, 0x07, 0x5f, 0xc7, 0xf4, 0xf0, 0x33, 0xbf, 0xa2, 0x48, 0xdb, 0x8f, 0xcc,
+		0xd3, 0x56, 0x5d, 0xe9, 0x4b, 0xbf, 0xb1, 0x2f, 0x3c, 0x59, 0xff, 0x46, 0xc2, 0x71, 0xbf, 0x83,
+	}
+
+	y := []byte{
+		0xce, 0x40, 0x14, 0xc6, 0x88, 0x11, 0xf9, 0xa2, 0x1a, 0x1f, 0xdb, 0x2c, 0x0e, 0x61, 0x13, 0xe0,
+		0x6d, 0xb7, 0xca, 0x93, 0xb7, 0x40, 0x4e, 0x78, 0xdc, 0x7c, 0xcd, 0x5c, 0xa8, 0x9a, 0x4c, 0xa9,
+	}
+
+	publicKey, err := ECDSAPublicKey(elliptic.P256(), x, y)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	message := []byte{
+		0x59, 0x05, 0x23, 0x88, 0x77, 0xc7, 0x74, 0x21, 0xf7, 0x3e, 0x43, 0xee, 0x3d, 0xa6, 0xf2, 0xd9,
+		0xe2, 0xcc, 0xad, 0x5f, 0xc9, 0x42, 0xdc, 0xec, 0x0c, 0xbd, 0x25, 0x48, 0x29, 0x35, 0xfa, 0xaf,
+		0x41, 0x69, 0x83, 0xfe, 0x16, 0x5b, 0x1a, 0x04, 0x5e, 0xe2, 0xbc, 0xd2, 0xe6, 0xdc, 0xa3, 0xbd,
+		0xf4, 0x6c, 0x43, 0x10, 0xa7, 0x46, 0x1f, 0x9a, 0x37, 0x96, 0x0c, 0xa6, 0x72, 0xd3, 0xfe, 0xb5,
+		0x47, 0x3e, 0x25, 0x36, 0x05, 0xfb, 0x1d, 0xdf, 0xd2, 0x80, 0x65, 0xb5, 0x3c, 0xb5, 0x85, 0x8a,
+		0x8a, 0xd2, 0x81, 0x75, 0xbf, 0x9b, 0xd3, 0x86, 0xa5, 0xe4, 0x71, 0xea, 0x7a, 0x65, 0xc1, 0x7c,
+		0xc9, 0x34, 0xa9, 0xd7, 0x91, 0xe9, 0x14, 0x91, 0xeb, 0x37, 0x54, 0xd0, 0x37, 0x99, 0x79, 0x0f,
+		0xe2, 0xd3, 0x08, 0xd1, 0x61, 0x46, 0xd5, 0xc9, 0xb0, 0xd0, 0xde, 0xbd, 0x97, 0xd7, 0x9c, 0xe8,
+	}
+
+	hash := sha256.New()
+	_, err = io.Copy(hash, bytes.NewReader(message))
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+	msgHash := hash.Sum(nil)
+
+	verifySignature, err := VerifySignature(publicKey, msgHash, asn1Signature)
+	if err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+
+	if !verifySignature {
+		t.Fatalf("failed to verify signature")
+	}
+}
diff --git a/internal/providers/aws/ecr.go b/internal/providers/aws/ecr.go
new file mode 100644
index 0000000000..179b5b5d5e
--- /dev/null
+++ b/internal/providers/aws/ecr.go
@@ -0,0 +1,148 @@
+package aws
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math/big"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/open-policy-agent/opa/internal/version"
+	"github.com/open-policy-agent/opa/logging"
+)
+
+// Values taken from
+// https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetAuthorizationToken.html
+const (
+	ecrGetAuthorizationTokenTarget = "AmazonEC2ContainerRegistry_V20150921.GetAuthorizationToken"
+	ecrEndpointFmt                 = "https://ecr.%s.amazonaws.com/"
+)
+
+// ECR is used to request tokens from Elastic Container Registry.
+type ECR struct {
+	// endpoint returns the region-specifc ECR endpoint.
+	// It can be overridden by tests.
+	endpoint func(region string) string
+
+	// client is used to send authorization tokens requests.
+	client *http.Client
+
+	logger logging.Logger
+}
+
+func NewECR(logger logging.Logger) *ECR {
+	return &ECR{
+		endpoint: func(region string) string {
+			return fmt.Sprintf(ecrEndpointFmt, region)
+		},
+		client: &http.Client{},
+		logger: logger,
+	}
+}
+
+// GetAuthorizationToken requests a token that can be used to authenticate image pull requests.
+func (e *ECR) GetAuthorizationToken(ctx context.Context, creds Credentials, signatureVersion string) (ECRAuthorizationToken, error) {
+	endpoint := e.endpoint(creds.RegionName)
+	body := strings.NewReader("{}")
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, body)
+	if err != nil {
+		return ECRAuthorizationToken{}, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("X-Amz-Target", ecrGetAuthorizationTokenTarget)
+	req.Header.Set("Accept-Encoding", "identity")
+	req.Header.Set("Content-Type", "application/x-amz-json-1.1")
+	req.Header.Set("User-Agent", version.UserAgent)
+
+	e.logger.Debug("Signing ECR authorization token request")
+
+	if err := SignRequest(req, "ecr", creds, time.Now(), signatureVersion); err != nil {
+		return ECRAuthorizationToken{}, fmt.Errorf("failed to sign request: %w", err)
+	}
+
+	resp, err := DoRequestWithClient(req, e.client, "ecr get authorization token", e.logger)
+	if err != nil {
+		return ECRAuthorizationToken{}, err
+	}
+
+	var data struct {
+		AuthorizationData []struct {
+			AuthorizationToken string      `json:"authorizationToken"`
+			ExpiresAt          json.Number `json:"expiresAt"`
+		} `json:"authorizationData"`
+	}
+	if err := json.Unmarshal(resp, &data); err != nil {
+		return ECRAuthorizationToken{}, fmt.Errorf("failed to unmarshal response: %w", err)
+	}
+
+	if len(data.AuthorizationData) < 1 {
+		return ECRAuthorizationToken{}, errors.New("empty authorization data")
+	}
+
+	// The GetAuthorizationToken request returns a list of tokens for
+	// backwards compatibility reasons. We should only ever get one token back
+	// because we don't define any registryIDs in the request.
+	// See https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetAuthorizationToken.html#API_GetAuthorizationToken_ResponseSyntax
+	resultToken := data.AuthorizationData[0]
+
+	expiresAt, err := parseTimestamp(resultToken.ExpiresAt)
+	if err != nil {
+		return ECRAuthorizationToken{}, fmt.Errorf("failed to parse expiresAt: %w", err)
+	}
+
+	return ECRAuthorizationToken{
+		AuthorizationToken: resultToken.AuthorizationToken,
+		ExpiresAt:          expiresAt,
+	}, nil
+}
+
+// ECRAuthorizationToken can sign requests to AWS ECR.
+//
+// It corresponds to data returned by the AWS GetAuthorizationToken API.
+// See https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_AuthorizationData.html
+type ECRAuthorizationToken struct {
+	AuthorizationToken string
+	ExpiresAt          time.Time
+}
+
+// IsValid returns true if the token is set and not expired.
+// It respects a margin of error for time handling and will mark it as expired early.
+func (t *ECRAuthorizationToken) IsValid() bool {
+	const tokenExpirationMargin = 5 * time.Minute
+
+	expired := time.Now().Add(tokenExpirationMargin).After(t.ExpiresAt)
+	return t.AuthorizationToken != "" && !expired
+}
+
+var millisecondsFloat = new(big.Float).SetInt64(1e3)
+
+// parseTimestamp parses the AWS format for timestamps.
+// The time precision is in milliseconds.
+//
+// The logic is taken from
+// https://github.com/aws/aws-sdk-go/blob/41717ba2c04d3fd03f94d09ea984a10899574935/private/protocol/json/jsonutil/unmarshal.go#L294-L302
+func parseTimestamp(raw json.Number) (time.Time, error) {
+	s := raw.String()
+
+	float, ok := new(big.Float).SetString(s)
+	if !ok {
+		return time.Time{}, fmt.Errorf("not a float: %q", raw)
+	}
+
+	// The float is expected to be in second resolution with millisecond
+	// decimal places.
+	// Multiply by millisecondsFloat to obtain an integer in millisecond
+	// resolution
+	ms, _ := float.Mul(float, millisecondsFloat).Int64()
+
+	// Multiply again to obtain nanosecond resolution for time.Unix
+	ns := ms * 1e6
+
+	t := time.Unix(0, ns).UTC()
+
+	return t, nil
+}
diff --git a/internal/providers/aws/ecr_test.go b/internal/providers/aws/ecr_test.go
new file mode 100644
index 0000000000..c231b2aca2
--- /dev/null
+++ b/internal/providers/aws/ecr_test.go
@@ -0,0 +1,118 @@
+package aws
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/open-policy-agent/opa/logging"
+)
+
+func TestECR(t *testing.T) {
+	payload := `{
+		"authorizationData": [
+			{
+				"authorizationToken": "secret",
+				"expiresAt": 1.676258918209E9
+			}
+		]
+	}`
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if _, err := io.WriteString(w, payload); err != nil {
+			t.Fatalf("io.WriteString(w, payload) = %v", err)
+		}
+	}))
+	defer server.Close()
+
+	logger := logging.New()
+	logger.SetLevel(logging.Debug)
+
+	ecr := ECR{
+		endpoint: func(string) string { return server.URL },
+		client:   server.Client(),
+		logger:   logger,
+	}
+
+	creds := Credentials{}
+	token, err := ecr.GetAuthorizationToken(context.Background(), creds, "v4")
+	if err != nil {
+		t.Errorf("ecrServer.getAuthorizationToken = %v", err)
+	}
+
+	if token.AuthorizationToken != "secret" {
+		t.Errorf("token.AuthorizationToken = %q, want = %q", token.AuthorizationToken, "secret")
+	}
+
+	got := token.ExpiresAt
+	want := time.Date(2023, 02, 13, 03, 28, 38, 209*1000*1000, time.UTC)
+	if !got.Equal(want) {
+		t.Errorf("token.ExpiresAt = %v, want = %v", got, want)
+	}
+
+}
+
+func TestParseAWSTimestamp(t *testing.T) {
+	type testCase struct {
+		name       string
+		raw        json.Number
+		wantParsed time.Time
+		wantErr    bool
+	}
+
+	run := func(t *testing.T, tc testCase) {
+		got, err := parseTimestamp(tc.raw)
+		if err != nil && tc.wantErr == false {
+			t.Fatalf("expected no error, got: %s", err)
+		}
+
+		if err == nil && tc.wantErr {
+			t.Fatal("expected error")
+		}
+
+		if !tc.wantParsed.Equal(got) {
+			t.Fatalf("expected %s, got %s", tc.wantParsed, got)
+		}
+	}
+
+	testCases := []testCase{
+		{
+			name:    "empty raw value",
+			wantErr: true,
+		},
+		{
+			name:    "no number",
+			raw:     "no-number",
+			wantErr: true,
+		},
+		{
+			name:       "float in e notation",
+			raw:        "1.676258918209E9", // actual timestamp returned from the API
+			wantParsed: time.Date(2023, 02, 13, 03, 28, 38, 209*1000*1000, time.UTC),
+		},
+		{
+			name:       "raw float",
+			raw:        "1676258918.209",
+			wantParsed: time.Date(2023, 02, 13, 03, 28, 38, 209*1000*1000, time.UTC),
+		},
+		{
+			name:       "cuts down to ms resolution",
+			raw:        "1676258918.209123",
+			wantParsed: time.Date(2023, 02, 13, 03, 28, 38, 209*1000*1000, time.UTC),
+		},
+		{
+			name:       "integer without ms",
+			raw:        "1676258918",
+			wantParsed: time.Date(2023, 02, 13, 03, 28, 38, 0, time.UTC),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
diff --git a/internal/providers/aws/signing_v4.go b/internal/providers/aws/signing_v4.go
new file mode 100644
index 0000000000..79662b10ff
--- /dev/null
+++ b/internal/providers/aws/signing_v4.go
@@ -0,0 +1,204 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package aws
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/open-policy-agent/opa/ast"
+)
+
+func stringFromTerm(t *ast.Term) string {
+	if v, ok := t.Value.(ast.String); ok {
+		return string(v)
+	}
+	return ""
+}
+
+// Headers that may be mutated before reaching an aws service (eg by a proxy) should be added here to omit them from
+// the sigv4 canonical request
+// ref. https://github.com/aws/aws-sdk-go/blob/master/aws/signer/v4/v4.go#L92
+var awsSigv4IgnoredHeaders = map[string]struct{}{
+	"authorization":   {},
+	"user-agent":      {},
+	"x-amzn-trace-id": {},
+}
+
+type Credentials struct {
+	AccessKey    string
+	SecretKey    string
+	RegionName   string
+	SessionToken string
+}
+
+func CredentialsFromObject(v ast.Object) Credentials {
+	var creds Credentials
+	awsAccessKey := v.Get(ast.StringTerm("aws_access_key"))
+	awsSecretKey := v.Get(ast.StringTerm("aws_secret_access_key"))
+	awsRegion := v.Get(ast.StringTerm("aws_region"))
+	awsSessionToken := v.Get(ast.StringTerm("aws_session_token"))
+
+	creds.AccessKey = stringFromTerm(awsAccessKey)
+	creds.SecretKey = stringFromTerm(awsSecretKey)
+	creds.RegionName = stringFromTerm(awsRegion)
+	if awsSessionToken != nil {
+		creds.SessionToken = stringFromTerm(awsSessionToken)
+	}
+	return creds
+}
+
+func sha256MAC(message string, key []byte) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write([]byte(message))
+	return mac.Sum(nil)
+}
+
+func sortKeys(strMap map[string][]string) []string {
+	keys := make([]string, len(strMap))
+
+	i := 0
+	for k := range strMap {
+		keys[i] = k
+		i++
+	}
+	sort.Strings(keys)
+
+	return keys
+}
+
+// SignRequest modifies an http.Request to include an AWS V4 signature based on the provided credentials.
+func SignRequest(req *http.Request, service string, creds Credentials, theTime time.Time, sigVersion string) error {
+	// General ref. https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
+	// S3 ref. https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
+	// APIGateway ref. https://docs.aws.amazon.com/apigateway/api-reference/signing-requests/
+
+	var body []byte
+	if req.Body == nil {
+		body = []byte("")
+	} else {
+		var err error
+		body, err = io.ReadAll(req.Body)
+		if err != nil {
+			return errors.New("error getting request body: " + err.Error())
+		}
+		// Since ReadAll consumed the body ReadCloser, we must create a new ReadCloser for the request so that the
+		// subsequent read starts from the beginning
+		req.Body = io.NopCloser(bytes.NewReader(body))
+	}
+
+	now := theTime.UTC()
+
+	if sigVersion == "4a" {
+		signedHeaders := SignV4a(req.Header, req.Method, req.URL, body, service, creds, now)
+		req.Header = signedHeaders
+	} else {
+		authHeader, awsHeaders := SignV4(req.Header, req.Method, req.URL, body, service, creds, now)
+		req.Header.Set("Authorization", authHeader)
+		for k, v := range awsHeaders {
+			req.Header.Add(k, v)
+		}
+	}
+
+	return nil
+}
+
+// SignV4 modifies a map[string][]string of headers to generate an AWS V4 signature + headers based on the config/credentials provided.
+func SignV4(headers map[string][]string, method string, theURL *url.URL, body []byte, service string, awsCreds Credentials, theTime time.Time) (string, map[string]string) {
+	// General ref. https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
+	// S3 ref. https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
+	// APIGateway ref. https://docs.aws.amazon.com/apigateway/api-reference/signing-requests/
+	bodyHexHash := fmt.Sprintf("%x", sha256.Sum256(body))
+
+	now := theTime.UTC()
+
+	// V4 signing has specific ideas of how it wants to see dates/times encoded
+	dateNow := now.Format("20060102")
+	iso8601Now := now.Format("20060102T150405Z")
+
+	awsHeaders := map[string]string{
+		"host":       theURL.Host,
+		"x-amz-date": iso8601Now,
+	}
+
+	// s3 and glacier require the extra x-amz-content-sha256 header. other services do not.
+	if service == "s3" || service == "glacier" {
+		awsHeaders["x-amz-content-sha256"] = bodyHexHash
+	}
+
+	// the security token header is necessary for ephemeral credentials, e.g. from
+	// the EC2 metadata service
+	if awsCreds.SessionToken != "" {
+		awsHeaders["x-amz-security-token"] = awsCreds.SessionToken
+	}
+
+	headersToSign := map[string][]string{}
+	// sign all of the aws headers.
+	for k, v := range awsHeaders {
+		headersToSign[k] = []string{v}
+	}
+
+	// sign all of the request's headers, except for those in the ignore list
+	for k, v := range headers {
+		lowercaseHeader := strings.ToLower(k)
+		if _, ok := awsSigv4IgnoredHeaders[lowercaseHeader]; !ok {
+			headersToSign[lowercaseHeader] = v
+		}
+	}
+
+	// the "canonical request" is the normalized version of the AWS service access
+	// that we're attempting to perform
+	canonicalReq := method + "\n"               // HTTP method
+	canonicalReq += theURL.EscapedPath() + "\n" // URI-escaped path
+	canonicalReq += theURL.RawQuery + "\n"      // RAW Query String
+
+	// include the values for the signed headers
+	orderedKeys := sortKeys(headersToSign)
+	for _, k := range orderedKeys {
+		canonicalReq += k + ":" + strings.Join(headersToSign[k], ",") + "\n"
+	}
+	canonicalReq += "\n" // linefeed to terminate headers
+
+	// include the list of the signed headers
+	headerList := strings.Join(orderedKeys, ";")
+	canonicalReq += headerList + "\n"
+	canonicalReq += bodyHexHash
+
+	// the "string to sign" is a time-bounded, scoped request token which
+	// is linked to the "canonical request" by inclusion of its SHA-256 hash
+	strToSign := "AWS4-HMAC-SHA256\n"                                                    // V4 signing with SHA-256 HMAC
+	strToSign += iso8601Now + "\n"                                                       // ISO 8601 time
+	strToSign += dateNow + "/" + awsCreds.RegionName + "/" + service + "/aws4_request\n" // scoping for signature
+	strToSign += fmt.Sprintf("%x", sha256.Sum256([]byte(canonicalReq)))                  // SHA-256 of canonical request
+
+	// the "signing key" is generated by repeated HMAC-SHA256 based on the same
+	// scoping that's included in the "string to sign"; but including the secret key
+	// to allow AWS to validate it
+	signingKey := sha256MAC(dateNow, []byte("AWS4"+awsCreds.SecretKey))
+	signingKey = sha256MAC(awsCreds.RegionName, signingKey)
+	signingKey = sha256MAC(service, signingKey)
+	signingKey = sha256MAC("aws4_request", signingKey)
+
+	// the "signature" is finally the "string to sign" signed by the "signing key"
+	signature := sha256MAC(strToSign, signingKey)
+
+	// required format of Authorization header; n.b. the access key corresponding to
+	// the secret key is included here
+	authHeader := "AWS4-HMAC-SHA256 Credential=" + awsCreds.AccessKey + "/" + dateNow
+	authHeader += "/" + awsCreds.RegionName + "/" + service + "/aws4_request,"
+	authHeader += "SignedHeaders=" + headerList + ","
+	authHeader += "Signature=" + fmt.Sprintf("%x", signature)
+
+	return authHeader, awsHeaders
+}
diff --git a/internal/providers/aws/signing_v4a.go b/internal/providers/aws/signing_v4a.go
new file mode 100644
index 0000000000..f1235a68b6
--- /dev/null
+++ b/internal/providers/aws/signing_v4a.go
@@ -0,0 +1,410 @@
+// modified from github.com/aws/aws-sdk-go-v2/internal/v4a@7a32d707af
+package aws
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"io"
+	"math/big"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	signerCrypto "github.com/open-policy-agent/opa/internal/providers/aws/crypto"
+	v4Internal "github.com/open-policy-agent/opa/internal/providers/aws/v4"
+)
+
+const (
+	// AmzRegionSetKey represents the region set header used for sigv4a
+	AmzRegionSetKey     = "X-Amz-Region-Set"
+	amzSecurityTokenKey = v4Internal.AmzSecurityTokenKey
+	amzDateKey          = v4Internal.AmzDateKey
+	authorizationHeader = "Authorization"
+
+	signingAlgorithm = "AWS4-ECDSA-P256-SHA256"
+
+	timeFormat      = "20060102T150405Z"
+	shortTimeFormat = "20060102"
+)
+
+var (
+	p256          elliptic.Curve
+	nMinusTwoP256 *big.Int
+
+	one = new(big.Int).SetInt64(1)
+
+	cache = credsCache{}
+
+	randomSource = rand.Reader
+)
+
+func init() {
+	// Ensure the elliptic curve parameters are initialized on package import rather then on first usage
+	p256 = elliptic.P256()
+
+	nMinusTwoP256 = new(big.Int).SetBytes(p256.Params().N.Bytes())
+	nMinusTwoP256 = nMinusTwoP256.Sub(nMinusTwoP256, new(big.Int).SetInt64(2))
+}
+
+type credsCache struct {
+	asymmetric atomic.Value
+	m          sync.Mutex
+}
+
+// SetRandomSource used for testing to override rand so tests can expect stable output
+func SetRandomSource(reader io.Reader) {
+	randomSource = reader
+}
+
+// deriveKeyFromAccessKeyPair derives a NIST P-256 PrivateKey from the given
+// IAM AccessKey and SecretKey pair.
+//
+// Based on FIPS.186-4 Appendix B.4.2
+func deriveKeyFromAccessKeyPair(accessKey, secretKey string) (*ecdsa.PrivateKey, error) {
+	params := p256.Params()
+	bitLen := params.BitSize // Testing random candidates does not require an additional 64 bits
+	counter := 0x01
+
+	buffer := make([]byte, 1+len(accessKey)) // 1 byte counter + len(accessKey)
+	kdfContext := bytes.NewBuffer(buffer)
+
+	inputKey := append([]byte("AWS4A"), []byte(secretKey)...)
+
+	d := new(big.Int)
+	for {
+		kdfContext.Reset()
+		kdfContext.WriteString(accessKey)
+		kdfContext.WriteByte(byte(counter))
+
+		key, err := signerCrypto.HMACKeyDerivation(sha256.New, bitLen, inputKey, []byte(signingAlgorithm), kdfContext.Bytes())
+		if err != nil {
+			return nil, err
+		}
+
+		// Check key first before calling SetBytes if key is in fact a valid candidate.
+		// This ensures the byte slice is the correct length (32-bytes) to compare in constant-time
+		cmp, err := signerCrypto.ConstantTimeByteCompare(key, nMinusTwoP256.Bytes())
+		if err != nil {
+			return nil, err
+		}
+		if cmp == -1 {
+			d.SetBytes(key)
+			break
+		}
+
+		counter++
+		if counter > 0xFF {
+			return nil, fmt.Errorf("exhausted single byte external counter")
+		}
+	}
+	d = d.Add(d, one)
+
+	priv := new(ecdsa.PrivateKey)
+	priv.PublicKey.Curve = p256
+	priv.D = d
+	priv.PublicKey.X, priv.PublicKey.Y = p256.ScalarBaseMult(d.Bytes())
+
+	return priv, nil
+}
+
+// v4aCredentials is Context, ECDSA, and Optional Session Token that can be used
+// to sign requests using SigV4a
+type v4aCredentials struct {
+	Context      string
+	PrivateKey   *ecdsa.PrivateKey
+	SessionToken string
+}
+
+// retrievePrivateKey returns credentials suitable for SigV4a signing
+func retrievePrivateKey(symmetric Credentials) (v4aCredentials, error) {
+	cache.m.Lock()
+	defer cache.m.Unlock()
+
+	// try to get creds from cache
+	v := cache.asymmetric.Load()
+	if v != nil {
+		c := v.(*v4aCredentials)
+		// if the cached Context matches the symmetric AccessKey ID, then use cached value. Otherwise, creds have
+		// changed and we need to derive new asymmetric creds
+		if c != nil && c.Context == symmetric.AccessKey {
+			return *c, nil
+		}
+	}
+
+	privateKey, err := deriveKeyFromAccessKeyPair(symmetric.AccessKey, symmetric.SecretKey)
+	if err != nil {
+		return v4aCredentials{}, fmt.Errorf("failed to derive asymmetric key from credentials")
+	}
+
+	creds := v4aCredentials{
+		Context:      symmetric.AccessKey,
+		PrivateKey:   privateKey,
+		SessionToken: symmetric.SessionToken,
+	}
+
+	// cache derived asymmetric creds so we don't derive new ones until symmetric creds change
+	cache.asymmetric.Store(&creds)
+
+	return creds, nil
+}
+
+type httpSigner struct {
+	Request     *http.Request
+	ServiceName string
+	RegionSet   []string
+	Time        time.Time
+	Credentials v4aCredentials
+
+	// PayloadHash is the hex encoded SHA-256 hash of the request payload
+	// If len(PayloadHash) == 0 the signer will attempt to send the request
+	// as an unsigned payload. Note: Unsigned payloads only work for a subset of services.
+	PayloadHash string
+}
+
+func (s *httpSigner) setRequiredSigningFields(headers http.Header, query url.Values) {
+	amzDate := s.Time.Format(timeFormat)
+
+	headers.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
+	headers.Set(amzDateKey, amzDate)
+	if len(s.Credentials.SessionToken) > 0 {
+		headers.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
+	}
+}
+
+// Build modifies the Request attribute of the httpSigner, adding an Authorization header
+func (s *httpSigner) Build() (signedRequest, error) {
+	req := s.Request
+
+	query := req.URL.Query()
+	headers := req.Header
+
+	// seemingly required by S3/MRAP -- 403 Forbidden otherwise
+	headers.Set("host", req.URL.Host)
+	headers.Set("x-amz-content-sha256", s.PayloadHash)
+
+	s.setRequiredSigningFields(headers, query)
+
+	// Sort Each Query Key's Values
+	for key := range query {
+		sort.Strings(query[key])
+	}
+
+	v4Internal.SanitizeHostForHeader(req)
+
+	credentialScope := s.buildCredentialScope()
+	credentialStr := s.Credentials.Context + "/" + credentialScope
+
+	unsignedHeaders := headers
+
+	host := req.URL.Host
+	if len(req.Host) > 0 {
+		host = req.Host
+	}
+
+	signedHeaders, signedHeadersStr, canonicalHeaderStr := s.buildCanonicalHeaders(host, v4Internal.IgnoredHeaders, unsignedHeaders, s.Request.ContentLength)
+
+	rawQuery := strings.Replace(query.Encode(), "+", "%20", -1)
+
+	canonicalURI := v4Internal.GetURIPath(req.URL)
+
+	canonicalString := s.buildCanonicalString(
+		req.Method,
+		canonicalURI,
+		rawQuery,
+		signedHeadersStr,
+		canonicalHeaderStr,
+	)
+
+	strToSign := s.buildStringToSign(credentialScope, canonicalString)
+	signingSignature, err := s.buildSignature(strToSign)
+	if err != nil {
+		return signedRequest{}, err
+	}
+
+	headers[authorizationHeader] = append(headers[authorizationHeader][:0], buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature))
+
+	req.URL.RawQuery = rawQuery
+
+	return signedRequest{
+		Request:         req,
+		SignedHeaders:   signedHeaders,
+		CanonicalString: canonicalString,
+		StringToSign:    strToSign,
+	}, nil
+}
+
+func (s *httpSigner) buildCredentialScope() string {
+	return strings.Join([]string{
+		s.Time.Format(shortTimeFormat),
+		s.ServiceName,
+		"aws4_request",
+	}, "/")
+
+}
+
+func buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature string) string {
+	const credential = "Credential="
+	const signedHeaders = "SignedHeaders="
+	const signature = "Signature="
+	const commaSpace = ", "
+
+	var parts strings.Builder
+	parts.Grow(len(signingAlgorithm) + 1 +
+		len(credential) + len(credentialStr) + len(commaSpace) +
+		len(signedHeaders) + len(signedHeadersStr) + len(commaSpace) +
+		len(signature) + len(signingSignature),
+	)
+	parts.WriteString(signingAlgorithm)
+	parts.WriteRune(' ')
+	parts.WriteString(credential)
+	parts.WriteString(credentialStr)
+	parts.WriteString(commaSpace)
+	parts.WriteString(signedHeaders)
+	parts.WriteString(signedHeadersStr)
+	parts.WriteString(commaSpace)
+	parts.WriteString(signature)
+	parts.WriteString(signingSignature)
+	return parts.String()
+}
+
+func (s *httpSigner) buildCanonicalHeaders(host string, rule v4Internal.Rule, header http.Header, length int64) (signed http.Header, signedHeaders, canonicalHeadersStr string) {
+	signed = make(http.Header)
+
+	const hostHeader = "host"
+	headers := make([]string, 0)
+
+	if length > 0 {
+		const contentLengthHeader = "content-length"
+		headers = append(headers, contentLengthHeader)
+		signed[contentLengthHeader] = append(signed[contentLengthHeader], strconv.FormatInt(length, 10))
+	}
+
+	for k, v := range header {
+		if !rule.IsValid(k) {
+			continue // ignored header
+		}
+
+		lowerCaseKey := strings.ToLower(k)
+		if _, ok := signed[lowerCaseKey]; ok {
+			// include additional values
+			signed[lowerCaseKey] = append(signed[lowerCaseKey], v...)
+			continue
+		}
+
+		headers = append(headers, lowerCaseKey)
+		signed[lowerCaseKey] = v
+	}
+	sort.Strings(headers)
+
+	signedHeaders = strings.Join(headers, ";")
+
+	var canonicalHeaders strings.Builder
+	n := len(headers)
+	const colon = ':'
+	for i := 0; i < n; i++ {
+		if headers[i] == hostHeader {
+			canonicalHeaders.WriteString(hostHeader)
+			canonicalHeaders.WriteRune(colon)
+			canonicalHeaders.WriteString(v4Internal.StripExcessSpaces(host))
+		} else {
+			canonicalHeaders.WriteString(headers[i])
+			canonicalHeaders.WriteRune(colon)
+			// Trim out leading, trailing, and dedup inner spaces from signed header values.
+			values := signed[headers[i]]
+			for j, v := range values {
+				cleanedValue := strings.TrimSpace(v4Internal.StripExcessSpaces(v))
+				canonicalHeaders.WriteString(cleanedValue)
+				if j < len(values)-1 {
+					canonicalHeaders.WriteRune(',')
+				}
+			}
+		}
+		canonicalHeaders.WriteRune('\n')
+	}
+	canonicalHeadersStr = canonicalHeaders.String()
+
+	return signed, signedHeaders, canonicalHeadersStr
+}
+
+func (s *httpSigner) buildCanonicalString(method, uri, query, signedHeaders, canonicalHeaders string) string {
+	return strings.Join([]string{
+		method,
+		uri,
+		query,
+		canonicalHeaders,
+		signedHeaders,
+		s.PayloadHash,
+	}, "\n")
+}
+
+func (s *httpSigner) buildStringToSign(credentialScope, canonicalRequestString string) string {
+	return strings.Join([]string{
+		signingAlgorithm,
+		s.Time.Format(timeFormat),
+		credentialScope,
+		hex.EncodeToString(makeHash(sha256.New(), []byte(canonicalRequestString))),
+	}, "\n")
+}
+
+func makeHash(hash hash.Hash, b []byte) []byte {
+	hash.Reset()
+	hash.Write(b)
+	return hash.Sum(nil)
+}
+
+func (s *httpSigner) buildSignature(strToSign string) (string, error) {
+	sig, err := s.Credentials.PrivateKey.Sign(randomSource, makeHash(sha256.New(), []byte(strToSign)), crypto.SHA256)
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(sig), nil
+}
+
+type signedRequest struct {
+	Request         *http.Request
+	SignedHeaders   http.Header
+	CanonicalString string
+	StringToSign    string
+}
+
+// SignV4a returns a map[string][]string of headers, including an added AWS V4a signature based on the config/credentials provided.
+func SignV4a(headers map[string][]string, method string, theURL *url.URL, body []byte, service string, awsCreds Credentials, theTime time.Time) map[string][]string {
+	bodyHexHash := fmt.Sprintf("%x", sha256.Sum256(body))
+
+	key, err := retrievePrivateKey(awsCreds)
+	if err != nil {
+		return map[string][]string{}
+	}
+
+	bodyReader := bytes.NewReader(body)
+	req, _ := http.NewRequest(method, theURL.String(), bodyReader)
+	req.Header = headers
+
+	signer := &httpSigner{
+		Request:     req,
+		PayloadHash: bodyHexHash,
+		ServiceName: service,
+		RegionSet:   []string{"*"},
+		Credentials: key,
+		Time:        theTime,
+	}
+
+	_, err = signer.Build()
+	if err != nil {
+		return map[string][]string{}
+	}
+
+	return req.Header
+}
diff --git a/internal/providers/aws/util.go b/internal/providers/aws/util.go
new file mode 100644
index 0000000000..e1e8a949f5
--- /dev/null
+++ b/internal/providers/aws/util.go
@@ -0,0 +1,45 @@
+package aws
+
+import (
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/open-policy-agent/opa/logging"
+)
+
+// DoRequestWithClient is a convenience function to get the body of an http response with
+// appropriate error-handling boilerplate and logging.
+func DoRequestWithClient(req *http.Request, client *http.Client, desc string, logger logging.Logger) ([]byte, error) {
+	resp, err := client.Do(req)
+	if err != nil {
+		// some kind of catastrophe talking to the service
+		return nil, errors.New(desc + " HTTP request failed: " + err.Error())
+	}
+	defer resp.Body.Close()
+
+	logger.WithFields(map[string]interface{}{
+		"url":     req.URL.String(),
+		"status":  resp.Status,
+		"headers": resp.Header,
+	}).Debug("Received response from " + desc + " service.")
+
+	if resp.StatusCode != 200 {
+		if logger.GetLevel() == logging.Debug {
+			body, err := io.ReadAll(resp.Body)
+			if err == nil {
+				logger.Debug("Error response with response body: %s", body)
+			}
+		}
+		// could be 404 for role that's not available, but cover all the bases
+		return nil, errors.New(desc + " HTTP request returned unexpected status: " + resp.Status)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		// deal with problems reading the body, whatever those might be
+		return nil, errors.New(desc + " HTTP response body could not be read: " + err.Error())
+	}
+
+	return body, nil
+}
diff --git a/internal/providers/aws/v4/const.go b/internal/providers/aws/v4/const.go
new file mode 100644
index 0000000000..89a76e2eaa
--- /dev/null
+++ b/internal/providers/aws/v4/const.go
@@ -0,0 +1,36 @@
+package v4
+
+const (
+	// EmptyStringSHA256 is the hex encoded sha256 value of an empty string
+	EmptyStringSHA256 = `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
+
+	// UnsignedPayload indicates that the request payload body is unsigned
+	UnsignedPayload = "UNSIGNED-PAYLOAD"
+
+	// AmzAlgorithmKey indicates the signing algorithm
+	AmzAlgorithmKey = "X-Amz-Algorithm"
+
+	// AmzSecurityTokenKey indicates the security token to be used with temporary credentials
+	AmzSecurityTokenKey = "X-Amz-Security-Token"
+
+	// AmzDateKey is the UTC timestamp for the request in the format YYYYMMDD'T'HHMMSS'Z'
+	AmzDateKey = "X-Amz-Date"
+
+	// AmzCredentialKey is the access key ID and credential scope
+	AmzCredentialKey = "X-Amz-Credential"
+
+	// AmzSignedHeadersKey is the set of headers signed for the request
+	AmzSignedHeadersKey = "X-Amz-SignedHeaders"
+
+	// AmzSignatureKey is the query parameter to store the SigV4 signature
+	AmzSignatureKey = "X-Amz-Signature"
+
+	// TimeFormat is the time format to be used in the X-Amz-Date header or query parameter
+	TimeFormat = "20060102T150405Z"
+
+	// ShortTimeFormat is the shorten time format used in the credential scope
+	ShortTimeFormat = "20060102"
+
+	// ContentSHAKey is the SHA256 of request body
+	ContentSHAKey = "X-Amz-Content-Sha256"
+)
diff --git a/internal/providers/aws/v4/header_rules.go b/internal/providers/aws/v4/header_rules.go
new file mode 100644
index 0000000000..baf6d12cc6
--- /dev/null
+++ b/internal/providers/aws/v4/header_rules.go
@@ -0,0 +1,87 @@
+package v4
+
+import (
+	"strings"
+)
+
+// Rules houses a set of Rule needed for validation of a
+// string value
+type Rules []Rule
+
+// Rule interface allows for more flexible rules and just simply
+// checks whether or not a value adheres to that Rule
+type Rule interface {
+	IsValid(value string) bool
+}
+
+// IsValid will iterate through all rules and see if any rules
+// apply to the value and supports nested rules
+func (r Rules) IsValid(value string) bool {
+	for _, rule := range r {
+		if rule.IsValid(value) {
+			return true
+		}
+	}
+	return false
+}
+
+// MapRule generic Rule for maps
+type MapRule map[string]struct{}
+
+// IsValid for the map Rule satisfies whether it exists in the map
+func (m MapRule) IsValid(value string) bool {
+	_, ok := m[value]
+	return ok
+}
+
+// AllowList is a generic Rule for whitelisting
+type AllowList struct {
+	Rule
+}
+
+// IsValid for AllowList checks if the value is within the AllowList
+func (w AllowList) IsValid(value string) bool {
+	return w.Rule.IsValid(value)
+}
+
+// DenyList is a generic Rule for blacklisting
+type DenyList struct {
+	Rule
+}
+
+// IsValid for AllowList checks if the value is within the AllowList
+func (b DenyList) IsValid(value string) bool {
+	return !b.Rule.IsValid(value)
+}
+
+// Patterns is a list of strings to match against
+type Patterns []string
+
+// FORK: copied from aws-sdk-go-v2/internal/strings
+func hasPrefixFold(s, prefix string) bool {
+	return len(s) >= len(prefix) && strings.EqualFold(s[0:len(prefix)], prefix)
+}
+
+// IsValid for Patterns checks each pattern and returns if a match has
+// been found
+func (p Patterns) IsValid(value string) bool {
+	for _, pattern := range p {
+		if hasPrefixFold(value, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+// InclusiveRules rules allow for rules to depend on one another
+type InclusiveRules []Rule
+
+// IsValid will return true if all rules are true
+func (r InclusiveRules) IsValid(value string) bool {
+	for _, rule := range r {
+		if !rule.IsValid(value) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/providers/aws/v4/headers.go b/internal/providers/aws/v4/headers.go
new file mode 100644
index 0000000000..3487dc3352
--- /dev/null
+++ b/internal/providers/aws/v4/headers.go
@@ -0,0 +1,67 @@
+package v4
+
+// IgnoredHeaders is a list of headers that are ignored during signing
+var IgnoredHeaders = Rules{
+	DenyList{
+		MapRule{
+			"Authorization":   struct{}{},
+			"User-Agent":      struct{}{},
+			"X-Amzn-Trace-Id": struct{}{},
+		},
+	},
+}
+
+// RequiredSignedHeaders is a whitelist for Build canonical headers.
+var RequiredSignedHeaders = Rules{
+	AllowList{
+		MapRule{
+			"Cache-Control":                         struct{}{},
+			"Content-Disposition":                   struct{}{},
+			"Content-Encoding":                      struct{}{},
+			"Content-Language":                      struct{}{},
+			"Content-Md5":                           struct{}{},
+			"Content-Type":                          struct{}{},
+			"Expires":                               struct{}{},
+			"If-Match":                              struct{}{},
+			"If-Modified-Since":                     struct{}{},
+			"If-None-Match":                         struct{}{},
+			"If-Unmodified-Since":                   struct{}{},
+			"Range":                                 struct{}{},
+			"X-Amz-Acl":                             struct{}{},
+			"X-Amz-Copy-Source":                     struct{}{},
+			"X-Amz-Copy-Source-If-Match":            struct{}{},
+			"X-Amz-Copy-Source-If-Modified-Since":   struct{}{},
+			"X-Amz-Copy-Source-If-None-Match":       struct{}{},
+			"X-Amz-Copy-Source-If-Unmodified-Since": struct{}{},
+			"X-Amz-Copy-Source-Range":               struct{}{},
+			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm": struct{}{},
+			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key":       struct{}{},
+			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5":   struct{}{},
+			"X-Amz-Grant-Full-control":                                    struct{}{},
+			"X-Amz-Grant-Read":                                            struct{}{},
+			"X-Amz-Grant-Read-Acp":                                        struct{}{},
+			"X-Amz-Grant-Write":                                           struct{}{},
+			"X-Amz-Grant-Write-Acp":                                       struct{}{},
+			"X-Amz-Metadata-Directive":                                    struct{}{},
+			"X-Amz-Mfa":                                                   struct{}{},
+			"X-Amz-Request-Payer":                                         struct{}{},
+			"X-Amz-Server-Side-Encryption":                                struct{}{},
+			"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id":                 struct{}{},
+			"X-Amz-Server-Side-Encryption-Customer-Algorithm":             struct{}{},
+			"X-Amz-Server-Side-Encryption-Customer-Key":                   struct{}{},
+			"X-Amz-Server-Side-Encryption-Customer-Key-Md5":               struct{}{},
+			"X-Amz-Storage-Class":                                         struct{}{},
+			"X-Amz-Website-Redirect-Location":                             struct{}{},
+			"X-Amz-Content-Sha256":                                        struct{}{},
+			"X-Amz-Tagging":                                               struct{}{},
+		},
+	},
+	Patterns{"X-Amz-Meta-"},
+}
+
+// AllowedQueryHoisting is a whitelist for Build query headers. The boolean value
+// represents whether or not it is a pattern.
+var AllowedQueryHoisting = InclusiveRules{
+	DenyList{RequiredSignedHeaders},
+	Patterns{"X-Amz-"},
+}
diff --git a/internal/providers/aws/v4/host.go b/internal/providers/aws/v4/host.go
new file mode 100644
index 0000000000..bf93659a43
--- /dev/null
+++ b/internal/providers/aws/v4/host.go
@@ -0,0 +1,75 @@
+package v4
+
+import (
+	"net/http"
+	"strings"
+)
+
+// SanitizeHostForHeader removes default port from host and updates request.Host
+func SanitizeHostForHeader(r *http.Request) {
+	host := getHost(r)
+	port := portOnly(host)
+	if port != "" && isDefaultPort(r.URL.Scheme, port) {
+		r.Host = stripPort(host)
+	}
+}
+
+// Returns host from request
+func getHost(r *http.Request) string {
+	if r.Host != "" {
+		return r.Host
+	}
+
+	return r.URL.Host
+}
+
+// Hostname returns u.Host, without any port number.
+//
+// If Host is an IPv6 literal with a port number, Hostname returns the
+// IPv6 literal without the square brackets. IPv6 literals may include
+// a zone identifier.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func stripPort(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return hostport
+	}
+	if i := strings.IndexByte(hostport, ']'); i != -1 {
+		return strings.TrimPrefix(hostport[:i], "[")
+	}
+	return hostport[:colon]
+}
+
+// Port returns the port part of u.Host, without the leading colon.
+// If u.Host doesn't contain a port, Port returns an empty string.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func portOnly(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return ""
+	}
+	if i := strings.Index(hostport, "]:"); i != -1 {
+		return hostport[i+len("]:"):]
+	}
+	if strings.Contains(hostport, "]") {
+		return ""
+	}
+	return hostport[colon+len(":"):]
+}
+
+// Returns true if the specified URI is using the standard port
+// (i.e. port 80 for HTTP URIs or 443 for HTTPS URIs)
+func isDefaultPort(scheme, port string) bool {
+	if port == "" {
+		return true
+	}
+
+	lowerCaseScheme := strings.ToLower(scheme)
+	if (lowerCaseScheme == "http" && port == "80") || (lowerCaseScheme == "https" && port == "443") {
+		return true
+	}
+
+	return false
+}
diff --git a/internal/providers/aws/v4/util.go b/internal/providers/aws/v4/util.go
new file mode 100644
index 0000000000..0cb9cffaf5
--- /dev/null
+++ b/internal/providers/aws/v4/util.go
@@ -0,0 +1,64 @@
+package v4
+
+import (
+	"net/url"
+	"strings"
+)
+
+const doubleSpace = "  "
+
+// StripExcessSpaces will rewrite the passed in slice's string values to not
+// contain multiple side-by-side spaces.
+func StripExcessSpaces(str string) string {
+	var j, k, l, m, spaces int
+	// Trim trailing spaces
+	for j = len(str) - 1; j >= 0 && str[j] == ' '; j-- {
+	}
+
+	// Trim leading spaces
+	for k = 0; k < j && str[k] == ' '; k++ {
+	}
+	str = str[k : j+1]
+
+	// Strip multiple spaces.
+	j = strings.Index(str, doubleSpace)
+	if j < 0 {
+		return str
+	}
+
+	buf := []byte(str)
+	for k, m, l = j, j, len(buf); k < l; k++ {
+		if buf[k] == ' ' {
+			if spaces == 0 {
+				// First space.
+				buf[m] = buf[k]
+				m++
+			}
+			spaces++
+		} else {
+			// End of multiple spaces.
+			spaces = 0
+			buf[m] = buf[k]
+			m++
+		}
+	}
+
+	return string(buf[:m])
+}
+
+// GetURIPath returns the escaped URI component from the provided URL
+func GetURIPath(u *url.URL) string {
+	var uri string
+
+	if len(u.Opaque) > 0 {
+		uri = "/" + strings.Join(strings.Split(u.Opaque, "/")[3:], "/")
+	} else {
+		uri = u.EscapedPath()
+	}
+
+	if len(uri) == 0 {
+		uri = "/"
+	}
+
+	return uri
+}
diff --git a/internal/providers/aws/v4/util_test.go b/internal/providers/aws/v4/util_test.go
new file mode 100644
index 0000000000..c29c1fa850
--- /dev/null
+++ b/internal/providers/aws/v4/util_test.go
@@ -0,0 +1,75 @@
+package v4
+
+import (
+	"testing"
+)
+
+func TestStripExcessHeaders(t *testing.T) {
+	vals := []string{
+		"",
+		"123",
+		"1 2 3",
+		"1 2 3 ",
+		"  1 2 3",
+		"1  2 3",
+		"1  23",
+		"1  2  3",
+		"1  2  ",
+		" 1  2  ",
+		"12   3",
+		"12   3   1",
+		"12           3     1",
+		"12     3       1abc123",
+	}
+
+	expected := []string{
+		"",
+		"123",
+		"1 2 3",
+		"1 2 3",
+		"1 2 3",
+		"1 2 3",
+		"1 23",
+		"1 2 3",
+		"1 2",
+		"1 2",
+		"12 3",
+		"12 3 1",
+		"12 3 1",
+		"12 3 1abc123",
+	}
+
+	for i := 0; i < len(vals); i++ {
+		r := StripExcessSpaces(vals[i])
+		if e, a := expected[i], r; e != a {
+			t.Errorf("%d, expect %v, got %v", i, e, a)
+		}
+	}
+}
+
+var stripExcessSpaceCases = []string{
+	`AWS4-HMAC-SHA256 Credential=AKIDFAKEIDFAKEID/20160628/us-west-2/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=1234567890abcdef1234567890abcdef1234567890abcdef`,
+	`123   321   123   321`,
+	`   123   321   123   321   `,
+	`   123    321    123          321   `,
+	"123",
+	"1 2 3",
+	"  1 2 3",
+	"1  2 3",
+	"1  23",
+	"1  2  3",
+	"1  2  ",
+	" 1  2  ",
+	"12   3",
+	"12   3   1",
+	"12           3     1",
+	"12     3       1abc123",
+}
+
+func BenchmarkStripExcessSpaces(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		for _, v := range stripExcessSpaceCases {
+			StripExcessSpaces(v)
+		}
+	}
+}
diff --git a/internal/ref/ref.go b/internal/ref/ref.go
index 9bdde5c81f..6e84df4b08 100644
--- a/internal/ref/ref.go
+++ b/internal/ref/ref.go
@@ -26,3 +26,14 @@ func ParseDataPath(s string) (ast.Ref, error) {
 
 	return path.Ref(ast.DefaultRootDocument), nil
 }
+
+// ArrayPath will take an ast.Array and build an ast.Ref using the ast.Terms in the Array
+func ArrayPath(a *ast.Array) ast.Ref {
+	var ref ast.Ref
+
+	a.Foreach(func(term *ast.Term) {
+		ref = append(ref, term)
+	})
+
+	return ref
+}
diff --git a/internal/rego/opa/options.go b/internal/rego/opa/options.go
index ec6b2f0b5a..ea1e339c1b 100644
--- a/internal/rego/opa/options.go
+++ b/internal/rego/opa/options.go
@@ -4,7 +4,9 @@ import (
 	"io"
 	"time"
 
+	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
 )
@@ -22,5 +24,7 @@ type EvalOpts struct {
 	Time                   time.Time
 	Seed                   io.Reader
 	InterQueryBuiltinCache cache.InterQueryCache
+	NDBuiltinCache         builtins.NDBCache
 	PrintHook              print.Hook
+	Capabilities           *ast.Capabilities
 }
diff --git a/internal/report/report.go b/internal/report/report.go
index f80915dc83..53eb10d41e 100644
--- a/internal/report/report.go
+++ b/internal/report/report.go
@@ -10,6 +10,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"runtime"
+	"strconv"
 	"strings"
 
 	"github.com/open-policy-agent/opa/keys"
@@ -28,13 +30,13 @@ import (
 //
 // Override at build time via:
 //
-//    -ldflags "-X github.com/open-policy-agent/opa/internal/report.ExternalServiceURL=<url>"
+//	-ldflags "-X github.com/open-policy-agent/opa/internal/report.ExternalServiceURL=<url>"
 //
 // This will be overridden if the OPA_TELEMETRY_SERVICE_URL environment variable
 // is provided.
 var ExternalServiceURL = "https://telemetry.openpolicyagent.org"
 
-// Reporter reports the version of the running OPA instance to an external service
+// Reporter reports information such as the version, heap usage about the running OPA instance to an external service
 type Reporter struct {
 	body   map[string]string
 	client rest.Client
@@ -84,11 +86,16 @@ func New(id string, opts Options) (*Reporter, error) {
 	return &r, nil
 }
 
-// SendReport sends the version report to the external service
+// SendReport sends the telemetry report which includes information such as the OPA version, current memory usage to
+// the external service
 func (r *Reporter) SendReport(ctx context.Context) (*DataResponse, error) {
 	rCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+	r.body["heap_usage_bytes"] = strconv.FormatUint(m.Alloc, 10)
+
 	resp, err := r.client.WithJSON(r.body).Do(rCtx, "POST", "/v1/version")
 	if err != nil {
 		return nil, err
@@ -137,9 +144,10 @@ func (dr *DataResponse) Pretty() string {
 		return ""
 	}
 
-	var lines []string
+	pairs := dr.Slice()
+	lines := make([]string, 0, len(pairs))
 
-	for _, pair := range dr.Slice() {
+	for _, pair := range pairs {
 		lines = append(lines, fmt.Sprintf("%v: %v", pair[0], pair[1]))
 	}
 
diff --git a/internal/report/report_test.go b/internal/report/report_test.go
index da1aa5cb04..70ca42685a 100644
--- a/internal/report/report_test.go
+++ b/internal/report/report_test.go
@@ -7,16 +7,13 @@ package report
 import (
 	"context"
 	"encoding/json"
-
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"reflect"
 	"testing"
 )
 
 func TestNewReportDefaultURL(t *testing.T) {
-	os.Unsetenv("OPA_TELEMETRY_SERVICE_URL")
 
 	reporter, err := New("", Options{})
 	if err != nil {
@@ -35,7 +32,7 @@ func TestSendReportBadRespStatus(t *testing.T) {
 	baseURL, teardown := getTestServer(nil, http.StatusBadRequest)
 	defer teardown()
 
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
 
 	reporter, err := New("", Options{})
 	if err != nil {
@@ -60,7 +57,7 @@ func TestSendReportDecodeError(t *testing.T) {
 	baseURL, teardown := getTestServer("foo", http.StatusOK)
 	defer teardown()
 
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
 
 	reporter, err := New("", Options{})
 	if err != nil {
@@ -86,7 +83,7 @@ func TestSendReportWithOPAUpdate(t *testing.T) {
 	baseURL, teardown := getTestServer(exp, http.StatusOK)
 	defer teardown()
 
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
 
 	reporter, err := New("", Options{})
 	if err != nil {
@@ -104,6 +101,29 @@ func TestSendReportWithOPAUpdate(t *testing.T) {
 	}
 }
 
+func TestReportWithHeapStats(t *testing.T) {
+	// test server
+	baseURL, teardown := getTestServer(nil, http.StatusOK)
+	defer teardown()
+
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", baseURL)
+
+	reporter, err := New("", Options{})
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+
+	_, err = reporter.SendReport(context.Background())
+
+	if err != nil {
+		t.Fatalf("Expected no error but got %v", err)
+	}
+
+	if _, ok := reporter.body["heap_usage_bytes"]; !ok {
+		t.Fatal("Expected key \"heap_usage_bytes\" in the report")
+	}
+}
+
 func TestPretty(t *testing.T) {
 	dr := DataResponse{}
 	resp := dr.Pretty()
diff --git a/internal/runtime/init/init.go b/internal/runtime/init/init.go
index 1f88e1e218..fc3f43fad2 100644
--- a/internal/runtime/init/init.go
+++ b/internal/runtime/init/init.go
@@ -7,11 +7,11 @@ package init
 
 import (
 	"context"
+	"fmt"
+	"io/fs"
 	"path/filepath"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	storedversion "github.com/open-policy-agent/opa/internal/version"
@@ -39,10 +39,9 @@ type InsertAndCompileResult struct {
 // InsertAndCompile writes data and policy into the store and returns a compiler for the
 // store contents.
 func InsertAndCompile(ctx context.Context, opts InsertAndCompileOptions) (*InsertAndCompileResult, error) {
-
 	if len(opts.Files.Documents) > 0 {
 		if err := opts.Store.Write(ctx, opts.Txn, storage.AddOp, storage.Path{}, opts.Files.Documents); err != nil {
-			return nil, errors.Wrap(err, "storage error")
+			return nil, fmt.Errorf("storage error: %w", err)
 		}
 	}
 
@@ -77,13 +76,13 @@ func InsertAndCompile(ctx context.Context, opts InsertAndCompileOptions) (*Inser
 	// modules loaded outside of bundles will need to be added manually.
 	for id, parsed := range opts.Files.Modules {
 		if err := opts.Store.UpsertPolicy(ctx, opts.Txn, id, parsed.Raw); err != nil {
-			return nil, errors.Wrap(err, "storage error")
+			return nil, fmt.Errorf("storage error: %w", err)
 		}
 	}
 
 	// Set the version in the store last to prevent data files from overwriting.
 	if err := storedversion.Write(ctx, opts.Store, opts.Txn); err != nil {
-		return nil, errors.Wrap(err, "storage error")
+		return nil, fmt.Errorf("storage error: %w", err)
 	}
 
 	return &InsertAndCompileResult{Compiler: compiler, Metrics: m}, nil
@@ -115,7 +114,18 @@ type Descriptor struct {
 
 // LoadPaths reads data and policy from the given paths and returns a set of bundles or
 // raw loader file results.
-func LoadPaths(paths []string, filter loader.Filter, asBundle bool, bvc *bundle.VerificationConfig, skipVerify bool) (*LoadPathsResult, error) {
+func LoadPaths(paths []string,
+	filter loader.Filter,
+	asBundle bool,
+	bvc *bundle.VerificationConfig,
+	skipVerify bool,
+	processAnnotations bool,
+	caps *ast.Capabilities,
+	fsys fs.FS) (*LoadPathsResult, error) {
+
+	if caps == nil {
+		caps = ast.CapabilitiesForThisVersion()
+	}
 
 	var result LoadPathsResult
 	var err error
@@ -123,8 +133,14 @@ func LoadPaths(paths []string, filter loader.Filter, asBundle bool, bvc *bundle.
 	if asBundle {
 		result.Bundles = make(map[string]*bundle.Bundle, len(paths))
 		for _, path := range paths {
-			result.Bundles[path], err = loader.NewFileLoader().WithBundleVerificationConfig(bvc).
-				WithSkipBundleVerification(skipVerify).AsBundle(path)
+			result.Bundles[path], err = loader.NewFileLoader().
+				WithFS(fsys).
+				WithBundleVerificationConfig(bvc).
+				WithSkipBundleVerification(skipVerify).
+				WithFilter(filter).
+				WithProcessAnnotation(processAnnotations).
+				WithCapabilities(caps).
+				AsBundle(path)
 			if err != nil {
 				return nil, err
 			}
@@ -132,7 +148,11 @@ func LoadPaths(paths []string, filter loader.Filter, asBundle bool, bvc *bundle.
 		return &result, nil
 	}
 
-	files, err := loader.NewFileLoader().Filtered(paths, filter)
+	files, err := loader.NewFileLoader().
+		WithFS(fsys).
+		WithProcessAnnotation(processAnnotations).
+		WithCapabilities(caps).
+		Filtered(paths, filter)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/runtime/init/init_test.go b/internal/runtime/init/init_test.go
index 27e6643d34..85ea3966fa 100644
--- a/internal/runtime/init/init_test.go
+++ b/internal/runtime/init/init_test.go
@@ -7,13 +7,16 @@ package init
 import (
 	"context"
 	"io"
+	"io/fs"
+	"os"
 	"path"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/open-policy-agent/opa/loader"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
 	"github.com/open-policy-agent/opa/version"
@@ -103,81 +106,80 @@ p = true { 1 = 2 }`
 
 	ctx := context.Background()
 
-	for _, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
-			test.WithTempFS(tc.fs, func(rootDir string) {
+	for _, useMemoryFS := range []bool{false, true} {
+		for _, tc := range tests {
+			t.Run(tc.note, func(t *testing.T) {
+				test.WithTestFS(tc.fs, useMemoryFS, func(rootDir string, fsys fs.FS) {
+					paths := []string{}
 
-				paths := []string{}
-
-				for _, fileName := range tc.loadParams {
-					paths = append(paths, filepath.Join(rootDir, fileName))
-				}
-
-				// Create a new store and perform a file load/insert sequence.
-				store := inmem.New()
-
-				err := storage.Txn(ctx, store, storage.WriteParams, func(txn storage.Transaction) error {
-
-					loaded, err := LoadPaths(paths, nil, tc.asBundle, nil, true)
-					if err != nil {
-						return err
+					for _, fileName := range tc.loadParams {
+						paths = append(paths, filepath.Join(rootDir, fileName))
 					}
+					// Create a new store and perform a file load/insert sequence.
+					store := inmem.New()
+
+					err := storage.Txn(ctx, store, storage.WriteParams, func(txn storage.Transaction) error {
+						loaded, err := LoadPaths(paths, nil, tc.asBundle, nil, true, false, nil, fsys)
+						if err != nil {
+							return err
+						}
+
+						_, err = InsertAndCompile(ctx, InsertAndCompileOptions{
+							Store:     store,
+							Txn:       txn,
+							Files:     loaded.Files,
+							Bundles:   loaded.Bundles,
+							MaxErrors: -1,
+						})
 
-					_, err = InsertAndCompile(ctx, InsertAndCompileOptions{
-						Store:     store,
-						Txn:       txn,
-						Files:     loaded.Files,
-						Bundles:   loaded.Bundles,
-						MaxErrors: -1,
+						return err
 					})
 
-					return err
-				})
-
-				if err != nil {
-					t.Fatal(err)
-				}
+					if err != nil {
+						t.Fatal(err)
+					}
 
-				// Verify the loading was successful as expected.
-				txn := storage.NewTransactionOrDie(ctx, store)
+					// Verify the loading was successful as expected.
+					txn := storage.NewTransactionOrDie(ctx, store)
 
-				for storePath, expected := range tc.expectedData {
-					node, err := store.Read(ctx, txn, storage.MustParsePath(storePath))
-					if util.Compare(node, expected) != 0 || err != nil {
-						t.Fatalf("Expected %v but got %v (err: %v)", expected, node, err)
+					for storePath, expected := range tc.expectedData {
+						node, err := store.Read(ctx, txn, storage.MustParsePath(storePath))
+						if util.Compare(node, expected) != 0 || err != nil {
+							t.Fatalf("Expected %v but got %v (err: %v)", expected, node, err)
+						}
 					}
-				}
 
-				ids, err := store.ListPolicies(ctx, txn)
-				if err != nil {
-					t.Fatal(err)
-				}
+					ids, err := store.ListPolicies(ctx, txn)
+					if err != nil {
+						t.Fatal(err)
+					}
 
-				if len(tc.expectedMods) != len(ids) {
-					t.Fatalf("Expected %d modules, got %d", len(tc.expectedMods), len(ids))
-				}
+					if len(tc.expectedMods) != len(ids) {
+						t.Fatalf("Expected %d modules, got %d", len(tc.expectedMods), len(ids))
+					}
 
-				actualMods := map[string]struct{}{}
-				for _, id := range ids {
-					result, err := store.GetPolicy(ctx, txn, id)
-					if err != nil {
-						t.Fatalf("Unexpected error: %s", err)
+					actualMods := map[string]struct{}{}
+					for _, id := range ids {
+						result, err := store.GetPolicy(ctx, txn, id)
+						if err != nil {
+							t.Fatalf("Unexpected error: %s", err)
+						}
+						actualMods[string(result)] = struct{}{}
 					}
-					actualMods[string(result)] = struct{}{}
-				}
 
-				for _, expectedMod := range tc.expectedMods {
-					if _, found := actualMods[expectedMod]; !found {
-						t.Fatalf("Expected %v but got: %v", expectedMod, actualMods)
+					for _, expectedMod := range tc.expectedMods {
+						if _, found := actualMods[expectedMod]; !found {
+							t.Fatalf("Expected %v but got: %v", expectedMod, actualMods)
+						}
 					}
-				}
 
-				_, err = store.Read(ctx, txn, storage.MustParsePath("/system/version"))
-				if err != nil {
-					t.Fatal(err)
-				}
+					_, err = store.Read(ctx, txn, storage.MustParsePath("/system/version"))
+					if err != nil {
+						t.Fatal(err)
+					}
+				})
 			})
-		})
+		}
 	}
 }
 
@@ -251,3 +253,39 @@ func TestWalkPaths(t *testing.T) {
 		}
 	})
 }
+
+func TestLoadPathsBundleModeWithFilter(t *testing.T) {
+	files := map[string]string{
+		"a/data.json":      `{"foo": "not-bar"}`,
+		"policy.rego":      "package foo\n p = 1",
+		"policy_test.rego": "package foo\n test_p { p }",
+		"a/.manifest":      `{"roots": ["a", "foo"]}`,
+	}
+
+	test.WithTempFS(files, func(rootDir string) {
+
+		paths := []string{rootDir}
+
+		// bundle mode
+		loaded, err := LoadPaths(paths, func(abspath string, info os.FileInfo, depth int) bool {
+			return loader.GlobExcludeName("*_test.rego", 1)(abspath, info, depth)
+		}, true, nil, true, false, nil, nil)
+		if err != nil {
+			t.Fatalf("Unexpected error: %s", err)
+		}
+
+		if len(loaded.Bundles) != len(paths) {
+			t.Fatalf("Expected %v bundle loaders but got %v", len(paths), len(loaded.Bundles))
+		}
+
+		b, ok := loaded.Bundles[rootDir]
+		if !ok {
+			t.Fatalf("expected bundle %v", rootDir)
+		}
+
+		expected := 1
+		if len(b.Modules) != expected {
+			t.Fatalf("expected %v module but got %v", expected, len(b.Modules))
+		}
+	})
+}
diff --git a/internal/storage/mock/mock.go b/internal/storage/mock/mock.go
index c05cdaf81a..5ecdb61c58 100644
--- a/internal/storage/mock/mock.go
+++ b/internal/storage/mock/mock.go
@@ -247,6 +247,10 @@ func (s *Store) Abort(ctx context.Context, txn storage.Transaction) {
 	mockTxn.Aborted++
 }
 
+func (s *Store) Truncate(ctx context.Context, txn storage.Transaction, params storage.TransactionParams, it storage.Iterator) error {
+	return s.inmem.Truncate(ctx, getRealTxn(txn), params, it)
+}
+
 func getRealTxn(txn storage.Transaction) storage.Transaction {
 	return txn.(*Transaction).txn
 }
diff --git a/internal/strings/strings.go b/internal/strings/strings.go
index 63a71be7da..76fb9ee8c8 100644
--- a/internal/strings/strings.go
+++ b/internal/strings/strings.go
@@ -16,7 +16,7 @@ import (
 // "ideal" width and returns the shortened paths by replacing the middle parts of paths
 // with "...", ex: bundle1/.../a/b/policy.rego
 func TruncateFilePaths(maxIdealWidth, maxWidth int, path ...string) (map[string]string, int) {
-	var canShorten [][]byte
+	canShorten := make([][]byte, 0, len(path))
 
 	for _, p := range path {
 		canShorten = append(canShorten, []byte(getPathFromFirstSeparator(p)))
diff --git a/internal/strvals/doc.go b/internal/strvals/doc.go
index 500a79ac8c..019dc87bb9 100644
--- a/internal/strvals/doc.go
+++ b/internal/strvals/doc.go
@@ -13,7 +13,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-/*Package strvals provides tools for working with strval lines.
+/*
+Package strvals provides tools for working with strval lines.
 
 OPA runtime config supports a compressed format for YAML settings which we call strvals.
 The format is roughly like this:
diff --git a/internal/strvals/parser.go b/internal/strvals/parser.go
index b5afafcca0..0fc8936af1 100644
--- a/internal/strvals/parser.go
+++ b/internal/strvals/parser.go
@@ -29,6 +29,10 @@ import (
 // ErrNotList indicates that a non-list was treated as a list.
 var ErrNotList = errors.New("not a list")
 
+// MaxIndex is the maximum index that will be allowed by setIndex.
+// The default value 65536 = 1024 * 64
+var MaxIndex = 65536
+
 // ToYAML takes a string of arguments and converts to a YAML document.
 func ToYAML(s string) (string, error) {
 	m, err := Parse(s)
@@ -216,14 +220,29 @@ func set(data map[string]interface{}, key string, val interface{}) {
 	data[key] = val
 }
 
-func setIndex(list []interface{}, index int, val interface{}) []interface{} {
+func setIndex(list []interface{}, index int, val interface{}) (l2 []interface{}, err error) {
+	// There are possible index values that are out of range on a target system
+	// causing a panic. This will catch the panic and return an error instead.
+	// The value of the index that causes a panic varies from system to system.
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("error processing index %d: %s", index, r)
+		}
+	}()
+
+	if index < 0 {
+		return list, fmt.Errorf("negative %d index not allowed", index)
+	}
+	if index > MaxIndex {
+		return list, fmt.Errorf("index of %d is greater than maximum supported index of %d", index, MaxIndex)
+	}
 	if len(list) <= index {
 		newlist := make([]interface{}, index+1)
 		copy(newlist, list)
 		list = newlist
 	}
 	list[index] = val
-	return list
+	return list, nil
 }
 
 func (t *parser) keyIndex() (int, error) {
@@ -238,6 +257,9 @@ func (t *parser) keyIndex() (int, error) {
 
 }
 func (t *parser) listItem(list []interface{}, i int) ([]interface{}, error) {
+	if i < 0 {
+		return list, fmt.Errorf("negative %d index not allowed", i)
+	}
 	stop := runeSet([]rune{'[', '.', '='})
 	switch k, last, err := runesUntil(t.sc, stop); {
 	case len(k) > 0:
@@ -248,16 +270,19 @@ func (t *parser) listItem(list []interface{}, i int) ([]interface{}, error) {
 		vl, e := t.valList()
 		switch e {
 		case nil:
-			return setIndex(list, i, vl), nil
+			return setIndex(list, i, vl)
 		case io.EOF:
-			return setIndex(list, i, ""), err
+			return setIndex(list, i, "")
 		case ErrNotList:
 			rs, e := t.val()
 			if e != nil && e != io.EOF {
 				return list, e
 			}
 			v, e := t.runesToVal(rs)
-			return setIndex(list, i, v), e
+			if e != nil {
+				return nil, e
+			}
+			return setIndex(list, i, v)
 		default:
 			return list, e
 		}
@@ -269,7 +294,10 @@ func (t *parser) listItem(list []interface{}, i int) ([]interface{}, error) {
 		}
 		// Now we need to get the value after the ].
 		list2, err := t.listItem(list, i)
-		return setIndex(list, i, list2), err
+		if err != nil {
+			return nil, err
+		}
+		return setIndex(list, i, list2)
 	case last == '.':
 		// We have a nested object. Send to t.key
 		inner := map[string]interface{}{}
@@ -285,7 +313,10 @@ func (t *parser) listItem(list []interface{}, i int) ([]interface{}, error) {
 
 		// Recurse
 		e := t.key(inner)
-		return setIndex(list, i, inner), e
+		if e != nil {
+			return list, e
+		}
+		return setIndex(list, i, inner)
 	default:
 		return nil, fmt.Errorf("parse error: unexpected token %v", last)
 	}
diff --git a/internal/strvals/parser_test.go b/internal/strvals/parser_test.go
index fa51a3ba63..d1445406b7 100644
--- a/internal/strvals/parser_test.go
+++ b/internal/strvals/parser_test.go
@@ -28,6 +28,7 @@ func TestSetIndex(t *testing.T) {
 		expect  []interface{}
 		add     int
 		val     int
+		err     bool
 	}{
 		{
 			name:    "short",
@@ -50,16 +51,47 @@ func TestSetIndex(t *testing.T) {
 			add:     3,
 			val:     4,
 		},
+		{
+			name:    "negative",
+			initial: []interface{}{0, 1, 2, 3, 4, 5},
+			expect:  []interface{}{0, 1, 2, 3, 4, 5},
+			add:     -1,
+			val:     4,
+			err:     true,
+		},
+		{
+			name:    "large",
+			initial: []interface{}{0, 1, 2, 3, 4, 5},
+			expect:  []interface{}{0, 1, 2, 3, 4, 5},
+			add:     MaxIndex + 1,
+			val:     4,
+			err:     true,
+		},
 	}
 
 	for _, tt := range tests {
-		got := setIndex(tt.initial, tt.add, tt.val)
+		got, err := setIndex(tt.initial, tt.add, tt.val)
+
+		if err != nil && tt.err == false {
+			t.Fatalf("%s: Expected no error but error returned", tt.name)
+		} else if err == nil && tt.err == true {
+			t.Fatalf("%s: Expected error but no error returned", tt.name)
+		}
+
 		if len(got) != len(tt.expect) {
 			t.Fatalf("%s: Expected length %d, got %d", tt.name, len(tt.expect), len(got))
 		}
 
-		if gg := got[tt.add].(int); gg != tt.val {
-			t.Errorf("%s, Expected value %d, got %d", tt.name, tt.val, gg)
+		if !tt.err {
+			if gg := got[tt.add].(int); gg != tt.val {
+				t.Errorf("%s, Expected value %d, got %d", tt.name, tt.val, gg)
+			}
+		}
+
+		for k, v := range got {
+			if v != tt.expect[k] {
+				t.Errorf("%s, Expected value %d, got %d", tt.name, tt.expect[k], v)
+			}
 		}
 	}
 }
diff --git a/internal/wasm/encoding/encoding_test.go b/internal/wasm/encoding/encoding_test.go
index 54d6718124..d922979c00 100644
--- a/internal/wasm/encoding/encoding_test.go
+++ b/internal/wasm/encoding/encoding_test.go
@@ -6,7 +6,7 @@ package encoding
 
 import (
 	"bytes"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"reflect"
 	"testing"
@@ -17,7 +17,7 @@ import (
 
 func TestRoundtrip(t *testing.T) {
 
-	bs, err := ioutil.ReadFile(filepath.Join("testdata", "test1.wasm"))
+	bs, err := os.ReadFile(filepath.Join("testdata", "test1.wasm"))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -63,11 +63,7 @@ func TestRoundtrip(t *testing.T) {
 
 func TestRoundtripOPA(t *testing.T) {
 
-	bs, err := opa.Bytes()
-	if err != nil {
-		t.Fatal(err)
-	}
-
+	bs := opa.Bytes()
 	module1, err := ReadModule(bytes.NewBuffer(bs))
 	if err != nil {
 		t.Fatal(err)
diff --git a/internal/wasm/encoding/reader.go b/internal/wasm/encoding/reader.go
index 1ec2651260..d9c1bda3da 100644
--- a/internal/wasm/encoding/reader.go
+++ b/internal/wasm/encoding/reader.go
@@ -9,9 +9,6 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
-	"io/ioutil"
-
-	"github.com/pkg/errors"
 
 	"github.com/open-policy-agent/opa/internal/leb128"
 	"github.com/open-policy-agent/opa/internal/wasm/constant"
@@ -27,7 +24,7 @@ func ReadModule(r io.Reader) (*module.Module, error) {
 	wr := &reader{r: r, n: 0}
 	module, err := readModule(wr)
 	if err != nil {
-		return nil, errors.Wrapf(err, "offset 0x%x", wr.n)
+		return nil, fmt.Errorf("offset 0x%x: %w", wr.n, err)
 	}
 
 	return module, nil
@@ -39,7 +36,7 @@ func ReadCodeEntry(r io.Reader) (*module.CodeEntry, error) {
 	wr := &reader{r: r, n: 0}
 	entry, err := readCodeEntry(wr)
 	if err != nil {
-		return nil, errors.Wrapf(err, "offset 0x%x", wr.n)
+		return nil, fmt.Errorf("offset 0x%x: %w", wr.n, err)
 	}
 
 	return entry, nil
@@ -97,7 +94,7 @@ func readCodeEntry(r io.Reader) (*module.CodeEntry, error) {
 	var entry module.CodeEntry
 
 	if err := readLocals(r, &entry.Func.Locals); err != nil {
-		return nil, errors.Wrapf(err, "local declarations")
+		return nil, fmt.Errorf("local declarations: %w", err)
 	}
 
 	return &entry, readExpr(r, &entry.Func.Expr)
@@ -145,61 +142,61 @@ func readSections(r io.Reader, m *module.Module) error {
 		switch id {
 		case constant.StartSectionID:
 			if err := readStartSection(bufr, &m.Start); err != nil {
-				return errors.Wrap(err, "start section")
+				return fmt.Errorf("start section: %w", err)
 			}
 		case constant.CustomSectionID:
 			var name string
 			if err := readByteVectorString(bufr, &name); err != nil {
-				return errors.Wrap(err, "read custom section type")
+				return fmt.Errorf("read custom section type: %w", err)
 			}
 			if name == "name" {
 				if err := readCustomNameSections(bufr, &m.Names); err != nil {
-					return errors.Wrap(err, "custom 'name' section")
+					return fmt.Errorf("custom 'name' section: %w", err)
 				}
 			} else {
 				if err := readCustomSection(bufr, name, &m.Customs); err != nil {
-					return errors.Wrap(err, "custom section")
+					return fmt.Errorf("custom section: %w", err)
 				}
 			}
 		case constant.TypeSectionID:
 			if err := readTypeSection(bufr, &m.Type); err != nil {
-				return errors.Wrap(err, "type section")
+				return fmt.Errorf("type section: %w", err)
 			}
 		case constant.ImportSectionID:
 			if err := readImportSection(bufr, &m.Import); err != nil {
-				return errors.Wrap(err, "import section")
+				return fmt.Errorf("import section: %w", err)
 			}
 		case constant.TableSectionID:
 			if err := readTableSection(bufr, &m.Table); err != nil {
-				return errors.Wrap(err, "table section")
+				return fmt.Errorf("table section: %w", err)
 			}
 		case constant.MemorySectionID:
 			if err := readMemorySection(bufr, &m.Memory); err != nil {
-				return errors.Wrap(err, "memory section")
+				return fmt.Errorf("memory section: %w", err)
 			}
 		case constant.GlobalSectionID:
 			if err := readGlobalSection(bufr, &m.Global); err != nil {
-				return errors.Wrap(err, "global section")
+				return fmt.Errorf("global section: %w", err)
 			}
 		case constant.FunctionSectionID:
 			if err := readFunctionSection(bufr, &m.Function); err != nil {
-				return errors.Wrap(err, "function section")
+				return fmt.Errorf("function section: %w", err)
 			}
 		case constant.ExportSectionID:
 			if err := readExportSection(bufr, &m.Export); err != nil {
-				return errors.Wrap(err, "export section")
+				return fmt.Errorf("export section: %w", err)
 			}
 		case constant.ElementSectionID:
 			if err := readElementSection(bufr, &m.Element); err != nil {
-				return errors.Wrap(err, "element section")
+				return fmt.Errorf("element section: %w", err)
 			}
 		case constant.DataSectionID:
 			if err := readDataSection(bufr, &m.Data); err != nil {
-				return errors.Wrap(err, "data section")
+				return fmt.Errorf("data section: %w", err)
 			}
 		case constant.CodeSectionID:
 			if err := readRawCodeSection(bufr, &m.Code); err != nil {
-				return errors.Wrap(err, "code section")
+				return fmt.Errorf("code section: %w", err)
 			}
 		default:
 			return fmt.Errorf("illegal section id")
@@ -208,7 +205,7 @@ func readSections(r io.Reader, m *module.Module) error {
 }
 
 func readCustomSection(r io.Reader, name string, s *[]module.CustomSection) error {
-	buf, err := ioutil.ReadAll(r)
+	buf, err := io.ReadAll(r)
 	if err != nil {
 		return err
 	}
diff --git a/internal/wasm/encoding/writer.go b/internal/wasm/encoding/writer.go
index 91e4389a29..6917b8d1d1 100644
--- a/internal/wasm/encoding/writer.go
+++ b/internal/wasm/encoding/writer.go
@@ -229,7 +229,7 @@ func writeFunctionSection(w io.Writer, s module.FunctionSection) error {
 	}
 
 	for _, idx := range s.TypeIndices {
-		if err := leb128.WriteVarUint32(&buf, uint32(idx)); err != nil {
+		if err := leb128.WriteVarUint32(&buf, idx); err != nil {
 			return err
 		}
 	}
diff --git a/internal/wasm/sdk/examples/basic/main.go b/internal/wasm/sdk/examples/basic/main.go
index 1550b82206..3ddfcdcb82 100644
--- a/internal/wasm/sdk/examples/basic/main.go
+++ b/internal/wasm/sdk/examples/basic/main.go
@@ -6,7 +6,6 @@ package main
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 
@@ -26,7 +25,7 @@ func main() {
 
 	// Setup the SDK
 
-	policy, err := ioutil.ReadFile(path.Join(directory, "example-1.wasm"))
+	policy, err := os.ReadFile(path.Join(directory, "example-1.wasm"))
 	if err != nil {
 		fmt.Printf("error: %v\n", err)
 		return
@@ -71,7 +70,7 @@ func main() {
 
 	// Update the policy on the fly.
 
-	policy, err = ioutil.ReadFile(path.Join(directory, "example-2.wasm"))
+	policy, err = os.ReadFile(path.Join(directory, "example-2.wasm"))
 	if err != nil {
 		fmt.Printf("error: %v\n", err)
 		return
diff --git a/internal/wasm/sdk/internal/wasm/bindings.go b/internal/wasm/sdk/internal/wasm/bindings.go
index 6c27e330a4..f90031c532 100644
--- a/internal/wasm/sdk/internal/wasm/bindings.go
+++ b/internal/wasm/sdk/internal/wasm/bindings.go
@@ -16,7 +16,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/bytecodealliance/wasmtime-go"
+	wasmtime "github.com/bytecodealliance/wasmtime-go/v3"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/metrics"
@@ -81,7 +81,13 @@ func (d *builtinDispatcher) SetMap(m map[int32]topdown.BuiltinFunc) {
 }
 
 // Reset is called in Eval before using the builtinDispatcher.
-func (d *builtinDispatcher) Reset(ctx context.Context, seed io.Reader, ns time.Time, iqbCache cache.InterQueryCache, ph print.Hook) {
+func (d *builtinDispatcher) Reset(ctx context.Context,
+	seed io.Reader,
+	ns time.Time,
+	iqbCache cache.InterQueryCache,
+	ndbCache builtins.NDBCache,
+	ph print.Hook,
+	capabilities *ast.Capabilities) {
 	if ns.IsZero() {
 		ns = time.Now()
 	}
@@ -102,7 +108,9 @@ func (d *builtinDispatcher) Reset(ctx context.Context, seed io.Reader, ns time.T
 		QueryID:                0,
 		ParentID:               0,
 		InterQueryBuiltinCache: iqbCache,
+		NDBuiltinCache:         ndbCache,
 		PrintHook:              ph,
+		Capabilities:           capabilities,
 	}
 
 }
diff --git a/internal/wasm/sdk/internal/wasm/pool.go b/internal/wasm/sdk/internal/wasm/pool.go
index 1df418d52a..bfc211240b 100644
--- a/internal/wasm/sdk/internal/wasm/pool.go
+++ b/internal/wasm/sdk/internal/wasm/pool.go
@@ -9,7 +9,7 @@ import (
 	"context"
 	"sync"
 
-	"github.com/bytecodealliance/wasmtime-go"
+	wasmtime "github.com/bytecodealliance/wasmtime-go/v3"
 
 	"github.com/open-policy-agent/opa/internal/wasm/sdk/opa/errors"
 	"github.com/open-policy-agent/opa/internal/wasm/util"
@@ -41,7 +41,7 @@ type Pool struct {
 func NewPool(poolSize, memoryMinPages, memoryMaxPages uint32) *Pool {
 
 	cfg := wasmtime.NewConfig()
-	cfg.SetInterruptable(true)
+	cfg.SetEpochInterruption(true)
 
 	available := make(chan struct{}, poolSize)
 	for i := uint32(0); i < poolSize; i++ {
diff --git a/internal/wasm/sdk/internal/wasm/pool_test.go b/internal/wasm/sdk/internal/wasm/pool_test.go
index 64089379e7..3254b62439 100644
--- a/internal/wasm/sdk/internal/wasm/pool_test.go
+++ b/internal/wasm/sdk/internal/wasm/pool_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/open-policy-agent/opa/internal/wasm/sdk/internal/wasm"
 	wasm_util "github.com/open-policy-agent/opa/internal/wasm/util"
 	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -176,7 +177,7 @@ func ensurePoolResults(t *testing.T, ctx context.Context, testPool *wasm.Pool, p
 		toRelease = append(toRelease, vm)
 
 		cfg, _ := cache.ParseCachingConfig(nil)
-		result, err := vm.Eval(ctx, 0, input, metrics.New(), rand.New(rand.NewSource(0)), time.Now(), cache.NewInterQueryCache(cfg), nil)
+		result, err := vm.Eval(ctx, 0, input, metrics.New(), rand.New(rand.NewSource(0)), time.Now(), cache.NewInterQueryCache(cfg), builtins.NDBCache{}, nil, nil)
 		if err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
diff --git a/internal/wasm/sdk/internal/wasm/vm.go b/internal/wasm/sdk/internal/wasm/vm.go
index e768dab448..40453682c4 100644
--- a/internal/wasm/sdk/internal/wasm/vm.go
+++ b/internal/wasm/sdk/internal/wasm/vm.go
@@ -14,13 +14,14 @@ import (
 	"strings"
 	"time"
 
-	"github.com/bytecodealliance/wasmtime-go"
+	wasmtime "github.com/bytecodealliance/wasmtime-go/v3"
 
 	"github.com/open-policy-agent/opa/ast"
 	sdk_errors "github.com/open-policy-agent/opa/internal/wasm/sdk/opa/errors"
 	"github.com/open-policy-agent/opa/internal/wasm/util"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
 )
@@ -31,7 +32,6 @@ type VM struct {
 	engine               *wasmtime.Engine
 	store                *wasmtime.Store
 	instance             *wasmtime.Instance // Pointer to avoid unintented destruction (triggering finalizers within).
-	intHandle            *wasmtime.InterruptHandle
 	policy               []byte
 	abiMajorVersion      int32
 	abiMinorVersion      int32
@@ -59,6 +59,10 @@ type VM struct {
 	free                 func(context.Context, int32) error
 	valueAddPath         func(context.Context, int32, int32, int32) (int32, error)
 	valueRemovePath      func(context.Context, int32, int32) (int32, error)
+	valueFree            func(context.Context, int32) error
+	heapBlocksStash      func(context.Context) error
+	heapBlocksRestore    func(context.Context) error
+	heapStashClear       func(context.Context) error
 }
 
 type vmOpts struct {
@@ -74,6 +78,7 @@ func newVM(opts vmOpts, engine *wasmtime.Engine) (*VM, error) {
 	ctx := context.Background()
 	v := &VM{engine: engine}
 	store := wasmtime.NewStore(engine)
+	store.SetEpochDeadline(1)
 	memorytype := wasmtime.NewMemoryType(opts.memoryMin, true, opts.memoryMax)
 	memory, err := wasmtime.NewMemory(store, memorytype)
 	if err != nil {
@@ -101,16 +106,12 @@ func newVM(opts vmOpts, engine *wasmtime.Engine) (*VM, error) {
 	if err != nil {
 		return nil, err
 	}
-	v.intHandle, err = store.InterruptHandle()
-	if err != nil {
-		return nil, fmt.Errorf("get interrupt handle: %w", err)
-	}
 
 	v.abiMajorVersion, v.abiMinorVersion, err = getABIVersion(i, store)
 	if err != nil {
 		return nil, fmt.Errorf("invalid module: %w", err)
 	}
-	if v.abiMajorVersion != int32(1) || (v.abiMinorVersion != int32(1) && v.abiMinorVersion != int32(2)) {
+	if v.abiMajorVersion != int32(1) || (v.abiMinorVersion != int32(1) && v.abiMinorVersion != int32(3)) {
 		return nil, fmt.Errorf("invalid module: unsupported ABI version: %d.%d", v.abiMajorVersion, v.abiMinorVersion)
 	}
 
@@ -158,6 +159,18 @@ func newVM(opts vmOpts, engine *wasmtime.Engine) (*VM, error) {
 	v.valueRemovePath = func(ctx context.Context, a int32, b int32) (int32, error) {
 		return call(ctx, v, "opa_value_remove_path", a, b)
 	}
+	v.valueFree = func(ctx context.Context, a int32) error {
+		return callVoid(ctx, v, "opa_value_free", a)
+	}
+	v.heapBlocksStash = func(ctx context.Context) error {
+		return callVoid(ctx, v, "opa_heap_blocks_stash")
+	}
+	v.heapBlocksRestore = func(ctx context.Context) error {
+		return callVoid(ctx, v, "opa_heap_blocks_restore")
+	}
+	v.heapStashClear = func(ctx context.Context) error {
+		return callVoid(ctx, v, "opa_heap_stash_clear")
+	}
 
 	// Initialize the heap.
 
@@ -275,9 +288,11 @@ func (i *VM) Eval(ctx context.Context,
 	seed io.Reader,
 	ns time.Time,
 	iqbCache cache.InterQueryCache,
-	ph print.Hook) ([]byte, error) {
+	ndbCache builtins.NDBCache,
+	ph print.Hook,
+	capabilities *ast.Capabilities) ([]byte, error) {
 	if i.abiMinorVersion < int32(2) {
-		return i.evalCompat(ctx, entrypoint, input, metrics, seed, ns, iqbCache, ph)
+		return i.evalCompat(ctx, entrypoint, input, metrics, seed, ns, iqbCache, ndbCache, ph, capabilities)
 	}
 
 	metrics.Timer("wasm_vm_eval").Start()
@@ -328,10 +343,10 @@ func (i *VM) Eval(ctx context.Context,
 	// make use of it (e.g. `http.send`); and it will spawn a go routine
 	// cancelling the builtins that use topdown.Cancel, when the context is
 	// cancelled.
-	i.dispatcher.Reset(ctx, seed, ns, iqbCache, ph)
+	i.dispatcher.Reset(ctx, seed, ns, iqbCache, ndbCache, ph, capabilities)
 
 	metrics.Timer("wasm_vm_eval_call").Start()
-	resultAddr, err := i.evalOneOff(ctx, int32(entrypoint), i.dataAddr, inputAddr, inputLen, heapPtr)
+	resultAddr, err := i.evalOneOff(ctx, entrypoint, i.dataAddr, inputAddr, inputLen, heapPtr)
 	if err != nil {
 		return nil, err
 	}
@@ -357,7 +372,9 @@ func (i *VM) evalCompat(ctx context.Context,
 	seed io.Reader,
 	ns time.Time,
 	iqbCache cache.InterQueryCache,
-	ph print.Hook) ([]byte, error) {
+	ndbCache builtins.NDBCache,
+	ph print.Hook,
+	capabilities *ast.Capabilities) ([]byte, error) {
 	metrics.Timer("wasm_vm_eval").Start()
 	defer metrics.Timer("wasm_vm_eval").Stop()
 
@@ -367,7 +384,7 @@ func (i *VM) evalCompat(ctx context.Context,
 	// make use of it (e.g. `http.send`); and it will spawn a go routine
 	// cancelling the builtins that use topdown.Cancel, when the context is
 	// cancelled.
-	i.dispatcher.Reset(ctx, seed, ns, iqbCache, ph)
+	i.dispatcher.Reset(ctx, seed, ns, iqbCache, ndbCache, ph, capabilities)
 
 	err := i.setHeapState(ctx, i.evalHeapPtr)
 	if err != nil {
@@ -386,7 +403,7 @@ func (i *VM) evalCompat(ctx context.Context,
 		}
 	}
 
-	if err := i.evalCtxSetEntrypoint(ctx, ctxAddr, int32(entrypoint)); err != nil {
+	if err := i.evalCtxSetEntrypoint(ctx, ctxAddr, entrypoint); err != nil {
 		return nil, err
 	}
 
@@ -451,11 +468,16 @@ func (i *VM) SetPolicyData(ctx context.Context, opts vmOpts) error {
 
 	i.dataAddr = 0
 
-	var err error
-	if err = i.setHeapState(ctx, i.baseHeapPtr); err != nil {
+	// Release any stashed heap blocks since they will be above the base heap pointer
+	if err := i.heapStashClear(ctx); err != nil {
 		return err
 	}
 
+	if err := i.setHeapState(ctx, i.baseHeapPtr); err != nil {
+		return err
+	}
+
+	var err error
 	if opts.parsedData != nil {
 		if uint32(i.memory.DataSize(i.store))-uint32(i.baseHeapPtr) < uint32(len(opts.parsedData)) {
 			delta := uint32(len(opts.parsedData)) - (uint32(i.memory.DataSize(i.store)) - uint32(i.baseHeapPtr))
@@ -469,7 +491,7 @@ func (i *VM) SetPolicyData(ctx context.Context, opts vmOpts) error {
 		copy(mem[i.baseHeapPtr:i.baseHeapPtr+len], opts.parsedData)
 		i.dataAddr = opts.parsedDataAddr
 
-		i.evalHeapPtr = i.baseHeapPtr + int32(len)
+		i.evalHeapPtr = i.baseHeapPtr + len
 		err := i.setHeapState(ctx, i.evalHeapPtr)
 		if err != nil {
 			return err
@@ -480,7 +502,13 @@ func (i *VM) SetPolicyData(ctx context.Context, opts vmOpts) error {
 		}
 	}
 
-	if i.evalHeapPtr, err = i.getHeapState(ctx); err != nil {
+	// Stash any free blocks so that eval()/setHeapState() won't leak them
+	if err := i.heapBlocksStash(ctx); err != nil {
+		return err
+	}
+
+	i.evalHeapPtr, err = i.getHeapState(ctx)
+	if err != nil {
 		return err
 	}
 
@@ -521,8 +549,12 @@ func (i *VM) Entrypoints() map[string]int32 {
 func (i *VM) SetDataPath(ctx context.Context, path []string, value interface{}) error {
 	// Reset the heap ptr before patching the vm to try and keep any
 	// new allocations safe from subsequent heap resets on eval.
-	err := i.setHeapState(ctx, i.evalHeapPtr)
-	if err != nil {
+	if err := i.setHeapState(ctx, i.evalHeapPtr); err != nil {
+		return err
+	}
+
+	// Restore saved blocks protected from leaking in eval()/setHeapState()
+	if err := i.heapBlocksRestore(ctx); err != nil {
 		return err
 	}
 
@@ -544,8 +576,12 @@ func (i *VM) SetDataPath(ctx context.Context, path []string, value interface{})
 	// We don't need to free the value, assume it is "owned" as part of the
 	// overall data object now.
 	// We do need to free the path
+	if err := i.valueFree(ctx, pathAddr); err != nil {
+		return err
+	}
 
-	if err := i.free(ctx, pathAddr); err != nil {
+	// Stash free blocks so eval() calls don't leak them when calling setHeapState()
+	if err := i.heapBlocksStash(ctx); err != nil {
 		return err
 	}
 
@@ -568,6 +604,18 @@ func (i *VM) SetDataPath(ctx context.Context, path []string, value interface{})
 // specified path. If an error occurs the instance is still in a valid state, however
 // the data will not have been modified.
 func (i *VM) RemoveDataPath(ctx context.Context, path []string) error {
+	// Reset the heap ptr before patching the vm to try and keep any
+	// new allocations safe from subsequent heap resets on eval.
+	err := i.setHeapState(ctx, i.evalHeapPtr)
+	if err != nil {
+		return err
+	}
+
+	// Restore saved blocks protected from leaking in eval()/setHeapState()
+	if err := i.heapBlocksRestore(ctx); err != nil {
+		return err
+	}
+
 	pathAddr, err := i.toRegoJSON(ctx, path, true)
 	if err != nil {
 		return err
@@ -578,7 +626,17 @@ func (i *VM) RemoveDataPath(ctx context.Context, path []string) error {
 		return err
 	}
 
-	if err := i.free(ctx, pathAddr); err != nil {
+	if err := i.valueFree(ctx, pathAddr); err != nil {
+		return err
+	}
+
+	// Stash free blocks so eval() calls don't leak them when calling setHeapState()
+	if err = i.heapBlocksStash(ctx); err != nil {
+		return err
+	}
+
+	// Update the eval heap pointer to accommodate for any newly available memory
+	if i.evalHeapPtr, err = i.getHeapState(ctx); err != nil {
 		return err
 	}
 
@@ -712,7 +770,7 @@ func callOrCancel(ctx context.Context, vm *VM, name string, args ...int32) (inte
 	go func() {
 		select {
 		case <-ctx.Done():
-			vm.intHandle.Interrupt()
+			vm.store.Engine.IncrementEpoch()
 		case <-done:
 		}
 		close(ctxdone)
@@ -745,9 +803,8 @@ func callOrCancel(ctx context.Context, vm *VM, name string, args ...int32) (inte
 		// if last err was trap, extract information
 		var t *wasmtime.Trap
 		if errors.As(err, &t) {
-			code := t.Code()
-			if code != nil && *code == wasmtime.Interrupt {
-				return 0, sdk_errors.New(sdk_errors.CancelledErr, getStack(t.Frames(), "interrupted"))
+			if strings.Contains(t.Message(), "wasm trap: interrupt") {
+				return 0, sdk_errors.New(sdk_errors.CancelledErr, "interrupted")
 			}
 			return 0, sdk_errors.New(sdk_errors.InternalErr, getStack(t.Frames(), "trapped"))
 		}
diff --git a/internal/wasm/sdk/opa/capabilities/capabilities_nowasm.go b/internal/wasm/sdk/opa/capabilities/capabilities_nowasm.go
index cb3ed90126..6b17984bb8 100644
--- a/internal/wasm/sdk/opa/capabilities/capabilities_nowasm.go
+++ b/internal/wasm/sdk/opa/capabilities/capabilities_nowasm.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build !opa_wasm && !generate
 // +build !opa_wasm,!generate
 
 package capabilities
diff --git a/internal/wasm/sdk/opa/config.go b/internal/wasm/sdk/opa/config.go
index 64a4a105de..2d2713f58b 100644
--- a/internal/wasm/sdk/opa/config.go
+++ b/internal/wasm/sdk/opa/config.go
@@ -6,7 +6,7 @@ package opa
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"os"
 
 	"github.com/open-policy-agent/opa/internal/wasm/sdk/opa/errors"
 	"github.com/open-policy-agent/opa/internal/wasm/util"
@@ -14,7 +14,7 @@ import (
 
 // WithPolicyFile configures a policy file to load.
 func (o *OPA) WithPolicyFile(fileName string) *OPA {
-	policy, err := ioutil.ReadFile(fileName)
+	policy, err := os.ReadFile(fileName)
 	if err != nil {
 		o.configErr = errors.New(errors.InvalidConfigErr, err.Error())
 		return o
@@ -32,7 +32,7 @@ func (o *OPA) WithPolicyBytes(policy []byte) *OPA {
 
 // WithDataFile configures the JSON data file to load.
 func (o *OPA) WithDataFile(fileName string) *OPA {
-	data, err := ioutil.ReadFile(fileName)
+	data, err := os.ReadFile(fileName)
 	if err != nil {
 		o.configErr = errors.New(errors.InvalidConfigErr, err.Error())
 		return o
diff --git a/internal/wasm/sdk/opa/loader/file/loader_test.go b/internal/wasm/sdk/opa/loader/file/loader_test.go
index 3f26446409..25cec6b606 100644
--- a/internal/wasm/sdk/opa/loader/file/loader_test.go
+++ b/internal/wasm/sdk/opa/loader/file/loader_test.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build opa_wasm
 // +build opa_wasm
 
 package file
@@ -9,7 +10,6 @@ package file
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"os"
 	"reflect"
 	"sync"
@@ -22,7 +22,7 @@ import (
 func TestFileLoader(t *testing.T) {
 	// Assign a temp file.
 
-	f, err := ioutil.TempFile("", "test-file-loader")
+	f, err := os.CreateTemp("", "test-file-loader")
 	if err != nil {
 		panic(err)
 	}
@@ -124,7 +124,7 @@ func writeBundle(name string, policy string, data interface{}) {
 		panic(err)
 	}
 
-	if err := ioutil.WriteFile(name, buf.Bytes(), 0644); err != nil {
+	if err := os.WriteFile(name, buf.Bytes(), 0644); err != nil {
 		panic(err)
 	}
 }
diff --git a/internal/wasm/sdk/opa/loader/http/loader.go b/internal/wasm/sdk/opa/loader/http/loader.go
index 87f212976f..ec46428809 100644
--- a/internal/wasm/sdk/opa/loader/http/loader.go
+++ b/internal/wasm/sdk/opa/loader/http/loader.go
@@ -8,7 +8,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"net/http"
 	"sync"
@@ -252,6 +251,6 @@ func (l *Loader) get(ctx context.Context, tag string) (*bundle.Bundle, error) {
 // close closes the HTTP response gracefully, first draining it, to
 // avoid resource leaks.
 func (l *Loader) close(resp *http.Response) {
-	_, _ = io.Copy(ioutil.Discard, resp.Body) // Ignore errors.
+	_, _ = io.Copy(io.Discard, resp.Body) // Ignore errors.
 	_ = resp.Body.Close()
 }
diff --git a/internal/wasm/sdk/opa/loader/http/util.go b/internal/wasm/sdk/opa/loader/http/util.go
index 6585f5c040..fc47c30e15 100644
--- a/internal/wasm/sdk/opa/loader/http/util.go
+++ b/internal/wasm/sdk/opa/loader/http/util.go
@@ -22,6 +22,7 @@ func backoff(base, max, jitter, factor float64, retries int) time.Duration {
 		return 0
 	}
 
+	//nolint:unconvert
 	backoff, max := float64(base), float64(max)
 	for backoff < max && retries > 0 {
 		backoff *= factor
diff --git a/internal/wasm/sdk/opa/opa.go b/internal/wasm/sdk/opa/opa.go
index 95130cc715..2f6ee96274 100644
--- a/internal/wasm/sdk/opa/opa.go
+++ b/internal/wasm/sdk/opa/opa.go
@@ -12,10 +12,12 @@ import (
 	"sync"
 	"time"
 
+	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/internal/wasm/sdk/internal/wasm"
 	"github.com/open-policy-agent/opa/internal/wasm/sdk/opa/errors"
 	sdk_errors "github.com/open-policy-agent/opa/internal/wasm/sdk/opa/errors"
 	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
 )
@@ -164,7 +166,9 @@ type EvalOpts struct {
 	Time                   time.Time
 	Seed                   io.Reader
 	InterQueryBuiltinCache cache.InterQueryCache
+	NDBuiltinCache         builtins.NDBCache
 	PrintHook              print.Hook
+	Capabilities           *ast.Capabilities
 }
 
 // Eval evaluates the policy with the given input, returning the
@@ -188,7 +192,7 @@ func (o *OPA) Eval(ctx context.Context, opts EvalOpts) (*Result, error) {
 
 	defer o.pool.Release(instance, m)
 
-	result, err := instance.Eval(ctx, opts.Entrypoint, opts.Input, m, opts.Seed, opts.Time, opts.InterQueryBuiltinCache, opts.PrintHook)
+	result, err := instance.Eval(ctx, opts.Entrypoint, opts.Input, m, opts.Seed, opts.Time, opts.InterQueryBuiltinCache, opts.NDBuiltinCache, opts.PrintHook, opts.Capabilities)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/wasm/sdk/test/e2e/exceptions.yaml b/internal/wasm/sdk/test/e2e/exceptions.yaml
index 371d791a76..714af1ba93 100644
--- a/internal/wasm/sdk/test/e2e/exceptions.yaml
+++ b/internal/wasm/sdk/test/e2e/exceptions.yaml
@@ -1,2 +1,6 @@
 # Exception Format is <test name>: <reason>
-"functions/default": "not supported in topdown, https://github.com/open-policy-agent/opa/issues/2445"
\ No newline at end of file
+"functions/default": "not supported in topdown, https://github.com/open-policy-agent/opa/issues/2445"
+"data/toplevel integer": "https://github.com/open-policy-agent/opa/issues/3711"
+"data/nested integer": "https://github.com/open-policy-agent/opa/issues/3711"
+"withkeyword/function: indirect call, arity 1, replacement is value that needs eval (array comprehension)": "https://github.com/open-policy-agent/opa/issues/5311"
+"withkeyword/builtin: indirect call, arity 1, replacement is value that needs eval (array comprehension)": "https://github.com/open-policy-agent/opa/issues/5311"
\ No newline at end of file
diff --git a/internal/wasm/sdk/test/e2e/external_test.go b/internal/wasm/sdk/test/e2e/external_test.go
index 15b3d7ac41..bdd98526f0 100644
--- a/internal/wasm/sdk/test/e2e/external_test.go
+++ b/internal/wasm/sdk/test/e2e/external_test.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build wasm_sdk_e2e
 // +build wasm_sdk_e2e
 
 package e2e
@@ -12,7 +13,6 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -37,7 +37,7 @@ var exceptions map[string]string
 func TestMain(m *testing.M) {
 	exceptions = map[string]string{}
 
-	bs, err := ioutil.ReadFile(*exceptionsFile)
+	bs, err := os.ReadFile(*exceptionsFile)
 	if err != nil {
 		fmt.Println("Unable to load exceptions file: " + err.Error())
 		os.Exit(1)
@@ -71,6 +71,9 @@ func TestWasmE2E(t *testing.T) {
 			for i := range tc.Modules {
 				opts = append(opts, rego.Module(fmt.Sprintf("module-%d.rego", i), tc.Modules[i]))
 			}
+			if testing.Verbose() {
+				opts = append(opts, rego.Dump(os.Stderr))
+			}
 			cr, err := rego.New(opts...).Compile(ctx)
 			if err != nil {
 				t.Fatal(err)
diff --git a/ir/encoding/encoding_test.go b/ir/encoding/encoding_test.go
new file mode 100644
index 0000000000..a14e42fb40
--- /dev/null
+++ b/ir/encoding/encoding_test.go
@@ -0,0 +1,71 @@
+package planner
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/planner"
+	"github.com/open-policy-agent/opa/ir"
+)
+
+func TestRoundTrip(t *testing.T) {
+
+	c, err := ast.CompileModules(map[string]string{
+		"test.rego": `
+			package test
+
+			p {
+				input.foo == 7
+			}
+		`,
+	})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	modules := []*ast.Module{}
+
+	for _, m := range c.Modules {
+		modules = append(modules, m)
+	}
+
+	planner := planner.New().
+		WithQueries([]planner.QuerySet{
+			{
+				Name: "main",
+				Queries: []ast.Body{
+					ast.MustParseBody("data.test.p = true"),
+				},
+			},
+		}).
+		WithModules(modules).
+		WithBuiltinDecls(ast.BuiltinMap)
+
+	plan, err := planner.Plan()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bs, err := json.MarshalIndent(plan, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var cpy ir.Policy
+	err = json.Unmarshal(bs, &cpy)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bs2, err := json.MarshalIndent(plan, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !bytes.Equal(bs, bs2) {
+		t.Fatal("expected bytes to be equal")
+	}
+}
diff --git a/ir/ir.go b/ir/ir.go
new file mode 100644
index 0000000000..d98b96e2c8
--- /dev/null
+++ b/ir/ir.go
@@ -0,0 +1,479 @@
+// Copyright 2018 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package ir defines an intermediate representation (IR) for Rego.
+//
+// The IR specifies an imperative execution model for Rego policies similar to a
+// query plan in traditional databases.
+package ir
+
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/types"
+)
+
+type (
+	// Policy represents a planned policy query.
+	Policy struct {
+		Static *Static `json:"static,omitempty"`
+		Plans  *Plans  `json:"plans,omitempty"`
+		Funcs  *Funcs  `json:"funcs,omitempty"`
+	}
+
+	// Static represents a static data segment that is indexed into by the policy.
+	Static struct {
+		Strings      []*StringConst `json:"strings,omitempty"`
+		BuiltinFuncs []*BuiltinFunc `json:"builtin_funcs,omitempty"`
+		Files        []*StringConst `json:"files,omitempty"`
+	}
+
+	// BuiltinFunc represents a built-in function that may be required by the
+	// policy.
+	BuiltinFunc struct {
+		Name string          `json:"name"`
+		Decl *types.Function `json:"decl"`
+	}
+
+	// Plans represents a collection of named query plans to expose in the policy.
+	Plans struct {
+		Plans []*Plan `json:"plans"`
+	}
+
+	// Funcs represents a collection of planned functions to include in the
+	// policy.
+	Funcs struct {
+		Funcs []*Func `json:"funcs"`
+	}
+
+	// Func represents a named plan (function) that can be invoked. Functions
+	// accept one or more parameters and return a value. By convention, the
+	// input document and data documents are always passed as the first and
+	// second arguments (respectively).
+	Func struct {
+		Name   string   `json:"name"`
+		Params []Local  `json:"params"`
+		Return Local    `json:"return"`
+		Blocks []*Block `json:"blocks"`         // TODO(tsandall): should this be a plan?
+		Path   []string `json:"path,omitempty"` // optional: if non-nil, include in data function tree
+	}
+
+	// Plan represents an ordered series of blocks to execute. Plan execution
+	// stops when a return statement is reached. Blocks are executed in-order.
+	Plan struct {
+		Name   string   `json:"name"`
+		Blocks []*Block `json:"blocks"`
+	}
+
+	// Block represents an ordered sequence of statements to execute. Blocks are
+	// executed until a return statement is encountered, a statement is undefined,
+	// or there are no more statements. If all statements are defined but no return
+	// statement is encountered, the block is undefined.
+	Block struct {
+		Stmts []Stmt `json:"stmts"`
+	}
+
+	// Stmt represents an operation (e.g., comparison, loop, dot, etc.) to execute.
+	Stmt interface {
+		locationStmt
+	}
+
+	locationStmt interface {
+		SetLocation(index, row, col int, file, text string)
+		GetLocation() *Location
+	}
+
+	// Local represents a plan-scoped variable.
+	//
+	// TODO(tsandall): should this be int32 for safety?
+	Local int
+
+	// StringConst represents a string value.
+	StringConst struct {
+		Value string `json:"value"`
+	}
+)
+
+const (
+	// Input is the local variable that refers to the global input document.
+	Input Local = iota
+
+	// Data is the local variable that refers to the global data document.
+	Data
+
+	// Unused is the free local variable that can be allocated in a plan.
+	Unused
+)
+
+func (a *Policy) String() string {
+	return "Policy"
+}
+
+func (a *Static) String() string {
+	return fmt.Sprintf("Static (%d strings, %d files)", len(a.Strings), len(a.Files))
+}
+
+func (a *Funcs) String() string {
+	return fmt.Sprintf("Funcs (%d funcs)", len(a.Funcs))
+}
+
+func (a *Func) String() string {
+	return fmt.Sprintf("%v (%d params: %v, %d blocks, path: %v)", a.Name, len(a.Params), a.Params, len(a.Blocks), a.Path)
+}
+
+func (a *Plan) String() string {
+	return fmt.Sprintf("Plan %v (%d blocks)", a.Name, len(a.Blocks))
+}
+
+func (a *Block) String() string {
+	return fmt.Sprintf("Block (%d statements)", len(a.Stmts))
+}
+
+// Operand represents a value that a statement operates on.
+type Operand struct {
+	Value Val `json:"value"`
+}
+
+// Val represents an abstract value that statements operate on. There are currently
+// 3 types of values:
+//
+// 1. Local - a local variable that can refer to any type.
+// 2. StringIndex - a string constant that refers to a compiled string.
+// 3. Bool - a boolean constant.
+type Val interface {
+	fmt.Stringer
+	typeHint() string
+}
+
+func (Local) typeHint() string { return "local" }
+func (l Local) String() string {
+	return fmt.Sprintf("Local<%d>", int(l))
+}
+
+// StringIndex represents the index into the plan's list of constant strings
+// of a constant string.
+type StringIndex int
+
+func (StringIndex) typeHint() string { return "string_index" }
+func (s StringIndex) String() string {
+	return fmt.Sprintf("String<%d>", int(s))
+}
+
+// Bool represents a constant boolean.
+type Bool bool
+
+func (Bool) typeHint() string { return "bool" }
+func (b Bool) String() string {
+	return fmt.Sprintf("Bool<%v>", bool(b))
+}
+
+// ReturnLocalStmt represents a return statement that yields a local value.
+type ReturnLocalStmt struct {
+	Source Local `json:"source"`
+
+	Location
+}
+
+// CallStmt represents a named function call. The result should be stored in the
+// result local.
+type CallStmt struct {
+	Func   string    `json:"func"`
+	Args   []Operand `json:"args"`
+	Result Local     `json:"result"`
+
+	Location
+}
+
+// CallDynamicStmt represents an indirect (data) function call. The result should
+// be stored in the result local.
+type CallDynamicStmt struct {
+	Args   []Local   `json:"args"`
+	Result Local     `json:"result"`
+	Path   []Operand `json:"path"`
+
+	Location
+}
+
+// BlockStmt represents a nested block. Nested blocks and break statements can
+// be used to short-circuit execution.
+type BlockStmt struct {
+	Blocks []*Block `json:"blocks"`
+
+	Location
+}
+
+func (a *BlockStmt) String() string {
+	return fmt.Sprintf("BlockStmt (%d blocks) %v", len(a.Blocks), a.GetLocation())
+}
+
+// BreakStmt represents a jump out of the current block. The index specifies how
+// many blocks to jump starting from zero (the current block). Execution will
+// continue from the end of the block that is jumped to.
+type BreakStmt struct {
+	Index uint32 `json:"index"`
+
+	Location
+}
+
+// DotStmt represents a lookup operation on a value (e.g., array, object, etc.)
+// The source of a DotStmt may be a scalar value in which case the statement
+// will be undefined.
+type DotStmt struct {
+	Source Operand `json:"source"`
+	Key    Operand `json:"key"`
+	Target Local   `json:"target"`
+
+	Location
+}
+
+// LenStmt represents a length() operation on a local variable. The
+// result is stored in the target local variable.
+type LenStmt struct {
+	Source Operand `json:"source"`
+	Target Local   `json:"target"`
+
+	Location
+}
+
+// ScanStmt represents a linear scan over a composite value. The
+// source may be a scalar in which case the block will never execute.
+type ScanStmt struct {
+	Source Local  `json:"source"`
+	Key    Local  `json:"key"`
+	Value  Local  `json:"value"`
+	Block  *Block `json:"block"`
+
+	Location
+}
+
+// NotStmt represents a negated statement.
+type NotStmt struct {
+	Block *Block `json:"block"`
+
+	Location
+}
+
+// AssignIntStmt represents an assignment of an integer value to a
+// local variable.
+type AssignIntStmt struct {
+	Value  int64 `json:"value"`
+	Target Local `json:"target"`
+
+	Location
+}
+
+// AssignVarStmt represents an assignment of one local variable to another.
+type AssignVarStmt struct {
+	Source Operand `json:"source"`
+	Target Local   `json:"target"`
+
+	Location
+}
+
+// AssignVarOnceStmt represents an assignment of one local variable to another.
+// If the target is defined, execution aborts with a conflict error.
+//
+// TODO(tsandall): is there a better name for this?
+type AssignVarOnceStmt struct {
+	Source Operand `json:"source"`
+	Target Local   `json:"target"`
+
+	Location
+}
+
+// ResetLocalStmt resets a local variable to 0.
+type ResetLocalStmt struct {
+	Target Local `json:"target"`
+
+	Location
+}
+
+// MakeNullStmt constructs a local variable that refers to a null value.
+type MakeNullStmt struct {
+	Target Local `json:"target"`
+
+	Location
+}
+
+// MakeNumberIntStmt constructs a local variable that refers to an integer value.
+type MakeNumberIntStmt struct {
+	Value  int64 `json:"value"`
+	Target Local `json:"target"`
+
+	Location
+}
+
+// MakeNumberRefStmt constructs a local variable that refers to a number stored as a string.
+type MakeNumberRefStmt struct {
+	Index  int
+	Target Local `json:"target"`
+
+	Location
+}
+
+// MakeArrayStmt constructs a local variable that refers to an array value.
+type MakeArrayStmt struct {
+	Capacity int32 `json:"capacity"`
+	Target   Local `json:"target"`
+
+	Location
+}
+
+// MakeObjectStmt constructs a local variable that refers to an object value.
+type MakeObjectStmt struct {
+	Target Local `json:"target"`
+
+	Location
+}
+
+// MakeSetStmt constructs a local variable that refers to a set value.
+type MakeSetStmt struct {
+	Target Local `json:"target"`
+
+	Location
+}
+
+// EqualStmt represents an value-equality check of two local variables.
+type EqualStmt struct {
+	A Operand `json:"a"`
+	B Operand `json:"b"`
+
+	Location
+}
+
+// NotEqualStmt represents a != check of two local variables.
+type NotEqualStmt struct {
+	A Operand `json:"a"`
+	B Operand `json:"b"`
+
+	Location
+}
+
+// IsArrayStmt represents a dynamic type check on a local variable.
+type IsArrayStmt struct {
+	Source Operand `json:"source"`
+
+	Location
+}
+
+// IsObjectStmt represents a dynamic type check on a local variable.
+type IsObjectStmt struct {
+	Source Operand `json:"source"`
+
+	Location
+}
+
+// IsDefinedStmt represents a check of whether a local variable is defined.
+type IsDefinedStmt struct {
+	Source Local `json:"source"`
+
+	Location
+}
+
+// IsUndefinedStmt represents a check of whether local variable is undefined.
+type IsUndefinedStmt struct {
+	Source Local `json:"source"`
+
+	Location
+}
+
+// ArrayAppendStmt represents a dynamic append operation of a value
+// onto an array.
+type ArrayAppendStmt struct {
+	Value Operand `json:"value"`
+	Array Local   `json:"array"`
+
+	Location
+}
+
+// ObjectInsertStmt represents a dynamic insert operation of a
+// key/value pair into an object.
+type ObjectInsertStmt struct {
+	Key    Operand `json:"key"`
+	Value  Operand `json:"value"`
+	Object Local   `json:"object"`
+
+	Location
+}
+
+// ObjectInsertOnceStmt represents a dynamic insert operation of a key/value
+// pair into an object. If the key already exists and the value differs,
+// execution aborts with a conflict error.
+type ObjectInsertOnceStmt struct {
+	Key    Operand `json:"key"`
+	Value  Operand `json:"value"`
+	Object Local   `json:"object"`
+
+	Location
+}
+
+// ObjectMergeStmt performs a recursive merge of two object values. If either of
+// the locals refer to non-object values this operation will abort with a
+// conflict error. Overlapping object keys are merged recursively.
+type ObjectMergeStmt struct {
+	A      Local `json:"a"`
+	B      Local `json:"b"`
+	Target Local `json:"target"`
+
+	Location
+}
+
+// SetAddStmt represents a dynamic add operation of an element into a set.
+type SetAddStmt struct {
+	Value Operand `json:"value"`
+	Set   Local   `json:"set"`
+
+	Location
+}
+
+// WithStmt replaces the Local or a portion of the document referred to by the
+// Local with the Value and executes the contained block. If the Path is
+// non-empty, the Value is upserted into the Local. If the intermediate nodes in
+// the Local referred to by the Path do not exist, they will be created. When
+// the WithStmt finishes the Local is reset to it's original value.
+type WithStmt struct {
+	Local Local   `json:"local"`
+	Path  []int   `json:"path"`
+	Value Operand `json:"value"`
+	Block *Block  `json:"block"`
+
+	Location
+}
+
+// NopStmt adds a nop instruction. Useful during development and debugging only.
+type NopStmt struct {
+	Location
+}
+
+// ResultSetAddStmt adds a value into the result set returned by the query plan.
+type ResultSetAddStmt struct {
+	Value Local `json:"value"`
+
+	Location
+}
+
+// Location records the filen index, and the row and column inside that file
+// that a statement can be connected to.
+type Location struct {
+	File       int    `json:"file"` // filename string constant index
+	Col        int    `json:"col"`
+	Row        int    `json:"row"`
+	file, text string // only used for debugging
+}
+
+// SetLocation sets the Location for a given Stmt.
+func (l *Location) SetLocation(index, row, col int, file, text string) {
+	*l = Location{
+		File: index,
+		Row:  row,
+		Col:  col,
+		file: file,
+		text: text,
+	}
+}
+
+// GetLocation returns a Stmt's Location.
+func (l *Location) GetLocation() *Location {
+	return l
+}
diff --git a/ir/marshal.go b/ir/marshal.go
new file mode 100644
index 0000000000..69f4b5caf6
--- /dev/null
+++ b/ir/marshal.go
@@ -0,0 +1,137 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package ir
+
+import (
+	"encoding/json"
+	"reflect"
+)
+
+func (a *Block) MarshalJSON() ([]byte, error) {
+	var result typedBlock
+	result.Stmts = make([]typedStmt, len(a.Stmts))
+	for i := range a.Stmts {
+		tpe := reflect.Indirect(reflect.ValueOf(a.Stmts[i])).Type().Name()
+		result.Stmts[i] = typedStmt{
+			Type: tpe,
+			Stmt: a.Stmts[i],
+		}
+	}
+	return json.Marshal(result)
+}
+
+func (a *Block) UnmarshalJSON(bs []byte) error {
+	var typed rawTypedBlock
+	if err := json.Unmarshal(bs, &typed); err != nil {
+		return err
+	}
+	a.Stmts = make([]Stmt, len(typed.Stmts))
+	for i := range typed.Stmts {
+		var err error
+		a.Stmts[i], err = typed.Stmts[i].Unmarshal()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (a *Operand) MarshalJSON() ([]byte, error) {
+	var result typedOperand
+	result.Value = a.Value
+	result.Type = a.Value.typeHint()
+	return json.Marshal(result)
+}
+
+func (a *Operand) UnmarshalJSON(bs []byte) error {
+	var typed rawTypedOperand
+	if err := json.Unmarshal(bs, &typed); err != nil {
+		return err
+	}
+	x := valFactories[typed.Type]()
+	if err := json.Unmarshal(typed.Value, &x); err != nil {
+		return err
+	}
+	a.Value = x
+	return nil
+}
+
+type typedBlock struct {
+	Stmts []typedStmt `json:"stmts"`
+}
+
+type typedStmt struct {
+	Type string `json:"type"`
+	Stmt Stmt   `json:"stmt"`
+}
+
+type rawTypedBlock struct {
+	Stmts []rawTypedStmt `json:"stmts"`
+}
+
+type rawTypedStmt struct {
+	Type string          `json:"type"`
+	Stmt json.RawMessage `json:"stmt"`
+}
+
+func (raw rawTypedStmt) Unmarshal() (Stmt, error) {
+	x := stmtFactories[raw.Type]()
+	if err := json.Unmarshal(raw.Stmt, &x); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type rawTypedOperand struct {
+	Type  string          `json:"type"`
+	Value json.RawMessage `json:"value"`
+}
+
+type typedOperand struct {
+	Type  string `json:"type"`
+	Value Val    `json:"value"`
+}
+
+var stmtFactories = map[string]func() Stmt{
+	"ReturnLocalStmt":      func() Stmt { return &ReturnLocalStmt{} },
+	"CallStmt":             func() Stmt { return &CallStmt{} },
+	"CallDynamicStmt":      func() Stmt { return &CallDynamicStmt{} },
+	"BlockStmt":            func() Stmt { return &BlockStmt{} },
+	"BreakStmt":            func() Stmt { return &BreakStmt{} },
+	"DotStmt":              func() Stmt { return &DotStmt{} },
+	"LenStmt":              func() Stmt { return &LenStmt{} },
+	"ScanStmt":             func() Stmt { return &ScanStmt{} },
+	"NotStmt":              func() Stmt { return &NotStmt{} },
+	"AssignIntStmt":        func() Stmt { return &AssignIntStmt{} },
+	"AssignVarStmt":        func() Stmt { return &AssignVarStmt{} },
+	"AssignVarOnceStmt":    func() Stmt { return &AssignVarOnceStmt{} },
+	"ResetLocalStmt":       func() Stmt { return &ResetLocalStmt{} },
+	"MakeNullStmt":         func() Stmt { return &MakeNullStmt{} },
+	"MakeNumberIntStmt":    func() Stmt { return &MakeNumberIntStmt{} },
+	"MakeNumberRefStmt":    func() Stmt { return &MakeNumberRefStmt{} },
+	"MakeArrayStmt":        func() Stmt { return &MakeArrayStmt{} },
+	"MakeObjectStmt":       func() Stmt { return &MakeObjectStmt{} },
+	"MakeSetStmt":          func() Stmt { return &MakeSetStmt{} },
+	"EqualStmt":            func() Stmt { return &EqualStmt{} },
+	"NotEqualStmt":         func() Stmt { return &NotEqualStmt{} },
+	"IsArrayStmt":          func() Stmt { return &IsArrayStmt{} },
+	"IsObjectStmt":         func() Stmt { return &IsObjectStmt{} },
+	"IsDefinedStmt":        func() Stmt { return &IsDefinedStmt{} },
+	"IsUndefinedStmt":      func() Stmt { return &IsUndefinedStmt{} },
+	"ArrayAppendStmt":      func() Stmt { return &ArrayAppendStmt{} },
+	"ObjectInsertStmt":     func() Stmt { return &ObjectInsertStmt{} },
+	"ObjectInsertOnceStmt": func() Stmt { return &ObjectInsertOnceStmt{} },
+	"ObjectMergeStmt":      func() Stmt { return &ObjectMergeStmt{} },
+	"SetAddStmt":           func() Stmt { return &SetAddStmt{} },
+	"WithStmt":             func() Stmt { return &WithStmt{} },
+	"NopStmt":              func() Stmt { return &NopStmt{} },
+	"ResultSetAddStmt":     func() Stmt { return &ResultSetAddStmt{} },
+}
+
+var valFactories = map[string]func() Val{
+	"bool":         func() Val { var x Bool; return &x },
+	"string_index": func() Val { var x StringIndex; return &x },
+	"local":        func() Val { var x Local; return &x },
+}
diff --git a/internal/ir/pretty.go b/ir/pretty.go
similarity index 100%
rename from internal/ir/pretty.go
rename to ir/pretty.go
diff --git a/internal/ir/walk.go b/ir/walk.go
similarity index 100%
rename from internal/ir/walk.go
rename to ir/walk.go
diff --git a/keys/keys.go b/keys/keys.go
index 8272168ed4..de03496943 100644
--- a/keys/keys.go
+++ b/keys/keys.go
@@ -3,7 +3,6 @@ package keys
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 
 	"github.com/open-policy-agent/opa/util"
@@ -57,7 +56,7 @@ func (k *Config) validateAndInjectDefaults(id string) error {
 func NewKeyConfig(key, alg, scope string) (*Config, error) {
 	var pubKey string
 	if _, err := os.Stat(key); err == nil {
-		bs, err := ioutil.ReadFile(key)
+		bs, err := os.ReadFile(key)
 		if err != nil {
 			return nil, err
 		}
diff --git a/loader/filter/filter.go b/loader/filter/filter.go
new file mode 100644
index 0000000000..f0554e0aa6
--- /dev/null
+++ b/loader/filter/filter.go
@@ -0,0 +1,5 @@
+package filter
+
+import "io/fs"
+
+type LoaderFilter func(abspath string, info fs.FileInfo, depth int) bool
diff --git a/loader/internal/embedtest/bar/bar.rego b/loader/internal/embedtest/bar/bar.rego
new file mode 100644
index 0000000000..08bbfb0ac6
--- /dev/null
+++ b/loader/internal/embedtest/bar/bar.rego
@@ -0,0 +1,3 @@
+package bar
+
+p = true { true }
diff --git a/loader/internal/embedtest/bar/bar.yaml b/loader/internal/embedtest/bar/bar.yaml
new file mode 100644
index 0000000000..8baef1b4ab
--- /dev/null
+++ b/loader/internal/embedtest/bar/bar.yaml
@@ -0,0 +1 @@
+abc
diff --git a/loader/internal/embedtest/baz/qux/qux.json b/loader/internal/embedtest/baz/qux/qux.json
new file mode 100644
index 0000000000..19765bd501
--- /dev/null
+++ b/loader/internal/embedtest/baz/qux/qux.json
@@ -0,0 +1 @@
+null
diff --git a/loader/internal/embedtest/foo.json b/loader/internal/embedtest/foo.json
new file mode 100644
index 0000000000..3cc0ecbedf
--- /dev/null
+++ b/loader/internal/embedtest/foo.json
@@ -0,0 +1 @@
+[1,2,3]
diff --git a/loader/loader.go b/loader/loader.go
index d2f7cee6c6..d4d05943c2 100644
--- a/loader/loader.go
+++ b/loader/loader.go
@@ -8,7 +8,7 @@ package loader
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"sort"
@@ -20,6 +20,7 @@ import (
 	"github.com/open-policy-agent/opa/bundle"
 	fileurl "github.com/open-policy-agent/opa/internal/file/url"
 	"github.com/open-policy-agent/opa/internal/merge"
+	"github.com/open-policy-agent/opa/loader/filter"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/storage/inmem"
@@ -55,7 +56,13 @@ func (l *Result) Compiler() (*ast.Compiler, error) {
 
 // Store returns a Store object with the documents from this loader result.
 func (l *Result) Store() (storage.Store, error) {
-	return inmem.NewFromObject(l.Documents), nil
+	return l.StoreWithOpts()
+}
+
+// StoreWithOpts returns a Store object with the documents from this loader result,
+// instantiated with the passed options.
+func (l *Result) StoreWithOpts(opts ...inmem.Opt) (storage.Store, error) {
+	return inmem.NewFromObjectWithOpts(l.Documents, opts...), nil
 }
 
 // RegoFile represents the result of loading a single Rego source file.
@@ -67,12 +74,12 @@ type RegoFile struct {
 
 // Filter defines the interface for filtering files during loading. If the
 // filter returns true, the file should be excluded from the result.
-type Filter func(abspath string, info os.FileInfo, depth int) bool
+type Filter = filter.LoaderFilter
 
 // GlobExcludeName excludes files and directories whose names do not match the
 // shell style pattern at minDepth or greater.
 func GlobExcludeName(pattern string, minDepth int) Filter {
-	return func(abspath string, info os.FileInfo, depth int) bool {
+	return func(abspath string, info fs.FileInfo, depth int) bool {
 		match, _ := filepath.Match(pattern, info.Name())
 		return match && depth >= minDepth
 	}
@@ -84,10 +91,14 @@ type FileLoader interface {
 	All(paths []string) (*Result, error)
 	Filtered(paths []string, filter Filter) (*Result, error)
 	AsBundle(path string) (*bundle.Bundle, error)
-	WithMetrics(m metrics.Metrics) FileLoader
+	WithFS(fs.FS) FileLoader
+	WithMetrics(metrics.Metrics) FileLoader
+	WithFilter(Filter) FileLoader
 	WithBundleVerificationConfig(*bundle.VerificationConfig) FileLoader
-	WithSkipBundleVerification(skipVerify bool) FileLoader
-	WithProcessAnnotation(processAnnotation bool) FileLoader
+	WithSkipBundleVerification(bool) FileLoader
+	WithProcessAnnotation(bool) FileLoader
+	WithCapabilities(*ast.Capabilities) FileLoader
+	WithJSONOptions(*ast.JSONOptions) FileLoader
 }
 
 // NewFileLoader returns a new FileLoader instance.
@@ -100,10 +111,20 @@ func NewFileLoader() FileLoader {
 
 type fileLoader struct {
 	metrics    metrics.Metrics
+	filter     Filter
 	bvc        *bundle.VerificationConfig
 	skipVerify bool
 	files      map[string]bundle.FileInfo
 	opts       ast.ParserOptions
+	fsys       fs.FS
+}
+
+// WithFS provides an fs.FS to use for loading files. You can pass nil to
+// use plain IO calls (e.g. os.Open, os.Stat, etc.), this is the default
+// behaviour.
+func (fl *fileLoader) WithFS(fsys fs.FS) FileLoader {
+	fl.fsys = fsys
+	return fl
 }
 
 // WithMetrics provides the metrics instance to use while loading
@@ -112,6 +133,12 @@ func (fl *fileLoader) WithMetrics(m metrics.Metrics) FileLoader {
 	return fl
 }
 
+// WithFilter specifies the filter object to use to filter files while loading
+func (fl *fileLoader) WithFilter(filter Filter) FileLoader {
+	fl.filter = filter
+	return fl
+}
+
 // WithBundleVerificationConfig sets the key configuration used to verify a signed bundle
 func (fl *fileLoader) WithBundleVerificationConfig(config *bundle.VerificationConfig) FileLoader {
 	fl.bvc = config
@@ -130,6 +157,18 @@ func (fl *fileLoader) WithProcessAnnotation(processAnnotation bool) FileLoader {
 	return fl
 }
 
+// WithCapabilities sets the supported capabilities when loading the files
+func (fl *fileLoader) WithCapabilities(caps *ast.Capabilities) FileLoader {
+	fl.opts.Capabilities = caps
+	return fl
+}
+
+// WithJSONOptions sets the JSONOptions for use when parsing files
+func (fl *fileLoader) WithJSONOptions(opts *ast.JSONOptions) FileLoader {
+	fl.opts.JSONOptions = opts
+	return fl
+}
+
 // All returns a Result object loaded (recursively) from the specified paths.
 func (fl fileLoader) All(paths []string) (*Result, error) {
 	return fl.Filtered(paths, nil)
@@ -139,9 +178,17 @@ func (fl fileLoader) All(paths []string) (*Result, error) {
 // paths while applying the given filters. If any filter returns true, the
 // file/directory is excluded.
 func (fl fileLoader) Filtered(paths []string, filter Filter) (*Result, error) {
-	return all(paths, filter, func(curr *Result, path string, depth int) error {
-
-		bs, err := ioutil.ReadFile(path)
+	return all(fl.fsys, paths, filter, func(curr *Result, path string, depth int) error {
+
+		var (
+			bs  []byte
+			err error
+		)
+		if fl.fsys != nil {
+			bs, err = fs.ReadFile(fl.fsys, path)
+		} else {
+			bs, err = os.ReadFile(path)
+		}
 		if err != nil {
 			return err
 		}
@@ -172,7 +219,7 @@ func (fl fileLoader) AsBundle(path string) (*bundle.Bundle, error) {
 	if err != nil {
 		return nil, err
 	}
-	bundleLoader, isDir, err := GetBundleDirectoryLoader(path)
+	bundleLoader, isDir, err := GetBundleDirectoryLoaderFS(fl.fsys, path, fl.filter)
 	if err != nil {
 		return nil, err
 	}
@@ -181,7 +228,9 @@ func (fl fileLoader) AsBundle(path string) (*bundle.Bundle, error) {
 		WithMetrics(fl.metrics).
 		WithBundleVerificationConfig(fl.bvc).
 		WithSkipBundleVerification(fl.skipVerify).
-		WithProcessAnnotations(fl.opts.ProcessAnnotation)
+		WithProcessAnnotations(fl.opts.ProcessAnnotation).
+		WithCapabilities(fl.opts.Capabilities).
+		WithJSONOptions(fl.opts.JSONOptions)
 
 	// For bundle directories add the full path in front of module file names
 	// to simplify debugging.
@@ -198,39 +247,74 @@ func (fl fileLoader) AsBundle(path string) (*bundle.Bundle, error) {
 }
 
 // GetBundleDirectoryLoader returns a bundle directory loader which can be used to load
-// files in the directory.
+// files in the directory
 func GetBundleDirectoryLoader(path string) (bundle.DirectoryLoader, bool, error) {
+	return GetBundleDirectoryLoaderFS(nil, path, nil)
+}
+
+// GetBundleDirectoryLoaderWithFilter returns a bundle directory loader which can be used to load
+// files in the directory after applying the given filter.
+func GetBundleDirectoryLoaderWithFilter(path string, filter Filter) (bundle.DirectoryLoader, bool, error) {
+	return GetBundleDirectoryLoaderFS(nil, path, filter)
+}
+
+// GetBundleDirectoryLoaderFS returns a bundle directory loader which can be used to load
+// files in the directory.
+func GetBundleDirectoryLoaderFS(fsys fs.FS, path string, filter Filter) (bundle.DirectoryLoader, bool, error) {
 	path, err := fileurl.Clean(path)
 	if err != nil {
 		return nil, false, err
 	}
 
-	fi, err := os.Stat(path)
+	var fi fs.FileInfo
+	if fsys != nil {
+		fi, err = fs.Stat(fsys, path)
+	} else {
+		fi, err = os.Stat(path)
+	}
 	if err != nil {
 		return nil, false, fmt.Errorf("error reading %q: %s", path, err)
 	}
 
 	var bundleLoader bundle.DirectoryLoader
-
 	if fi.IsDir() {
-		bundleLoader = bundle.NewDirectoryLoader(path)
+		if fsys != nil {
+			bundleLoader = bundle.NewFSLoaderWithRoot(fsys, path)
+		} else {
+			bundleLoader = bundle.NewDirectoryLoader(path)
+		}
 	} else {
-		fh, err := os.Open(path)
+		var fh fs.File
+		if fsys != nil {
+			fh, err = fsys.Open(path)
+		} else {
+			fh, err = os.Open(path)
+		}
 		if err != nil {
 			return nil, false, err
 		}
 		bundleLoader = bundle.NewTarballLoaderWithBaseURL(fh, path)
 	}
+
+	if filter != nil {
+		bundleLoader = bundleLoader.WithFilter(filter)
+	}
 	return bundleLoader, fi.IsDir(), nil
 }
 
-// FilteredPaths return a list of files from the specified
+// FilteredPaths is the same as FilterPathsFS using the current diretory file
+// system
+func FilteredPaths(paths []string, filter Filter) ([]string, error) {
+	return FilteredPathsFS(nil, paths, filter)
+}
+
+// FilteredPathsFS return a list of files from the specified
 // paths while applying the given filters. If any filter returns true, the
 // file/directory is excluded.
-func FilteredPaths(paths []string, filter Filter) ([]string, error) {
+func FilteredPathsFS(fsys fs.FS, paths []string, filter Filter) ([]string, error) {
 	result := []string{}
 
-	_, err := all(paths, filter, func(_ *Result, path string, _ int) error {
+	_, err := all(fsys, paths, filter, func(_ *Result, path string, _ int) error {
 		result = append(result, path)
 		return nil
 	})
@@ -337,7 +421,7 @@ func getSchemaSetByPathKey(path string) ast.Ref {
 }
 
 func loadOneSchema(path string) (interface{}, error) {
-	bs, err := ioutil.ReadFile(path)
+	bs, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
@@ -391,7 +475,7 @@ func RegoWithOpts(path string, opts ast.ParserOptions) (*RegoFile, error) {
 	if err != nil {
 		return nil, err
 	}
-	bs, err := ioutil.ReadFile(path)
+	bs, err := os.ReadFile(path)
 	if err != nil {
 		return nil, err
 	}
@@ -434,7 +518,7 @@ func Dirs(paths []string) []string {
 		unique[dir] = struct{}{}
 	}
 
-	var u []string
+	u := make([]string, 0, len(unique))
 	for k := range unique {
 		u = append(u, k)
 	}
@@ -507,7 +591,7 @@ func newResult() *Result {
 	}
 }
 
-func all(paths []string, filter Filter, f func(*Result, string, int) error) (*Result, error) {
+func all(fsys fs.FS, paths []string, filter Filter, f func(*Result, string, int) error) (*Result, error) {
 	errs := Errors{}
 	root := newResult()
 
@@ -524,7 +608,7 @@ func all(paths []string, filter Filter, f func(*Result, string, int) error) (*Re
 			}
 		}
 
-		allRec(path, filter, &errs, loaded, 0, f)
+		allRec(fsys, path, filter, &errs, loaded, 0, f)
 	}
 
 	if len(errs) > 0 {
@@ -534,7 +618,7 @@ func all(paths []string, filter Filter, f func(*Result, string, int) error) (*Re
 	return root, nil
 }
 
-func allRec(path string, filter Filter, errors *Errors, loaded *Result, depth int, f func(*Result, string, int) error) {
+func allRec(fsys fs.FS, path string, filter Filter, errors *Errors, loaded *Result, depth int, f func(*Result, string, int) error) {
 
 	path, err := fileurl.Clean(path)
 	if err != nil {
@@ -542,7 +626,12 @@ func allRec(path string, filter Filter, errors *Errors, loaded *Result, depth in
 		return
 	}
 
-	info, err := os.Stat(path)
+	var info fs.FileInfo
+	if fsys != nil {
+		info, err = fs.Stat(fsys, path)
+	} else {
+		info, err = os.Stat(path)
+	}
 	if err != nil {
 		errors.add(err)
 		return
@@ -565,14 +654,19 @@ func allRec(path string, filter Filter, errors *Errors, loaded *Result, depth in
 		loaded = loaded.withParent(info.Name())
 	}
 
-	files, err := ioutil.ReadDir(path)
+	var files []fs.DirEntry
+	if fsys != nil {
+		files, err = fs.ReadDir(fsys, path)
+	} else {
+		files, err = os.ReadDir(path)
+	}
 	if err != nil {
 		errors.add(err)
 		return
 	}
 
 	for _, file := range files {
-		allRec(filepath.Join(path, file.Name()), filter, errors, loaded, depth+1, f)
+		allRec(fsys, filepath.Join(path, file.Name()), filter, errors, loaded, depth+1, f)
 	}
 }
 
diff --git a/loader/loader_test.go b/loader/loader_test.go
index 30634491a2..71bd621c70 100644
--- a/loader/loader_test.go
+++ b/loader/loader_test.go
@@ -6,7 +6,10 @@ package loader
 
 import (
 	"bytes"
+	"embed"
+	"encoding/json"
 	"io"
+	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
@@ -529,6 +532,7 @@ func TestLoadRooted(t *testing.T) {
 		paths[0] = "one.two:" + paths[0]
 		paths[1] = "three:" + paths[1]
 		paths[2] = "four:" + paths[2]
+		t.Log(paths)
 		loaded, err := NewFileLoader().All(paths)
 		if err != nil {
 			t.Fatalf("Unexpected error: %v", err)
@@ -542,6 +546,88 @@ func TestLoadRooted(t *testing.T) {
 	})
 }
 
+//go:embed internal/embedtest
+var embedTestFS embed.FS
+
+func TestLoadFS(t *testing.T) {
+	paths := []string{
+		"four:foo.json",
+		"one.two:bar",
+		"three:baz",
+	}
+
+	fsys, err := fs.Sub(embedTestFS, "internal/embedtest")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	loaded, err := NewFileLoader().WithFS(fsys).All(paths)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	expectedRegoBytes, err := fs.ReadFile(fsys, "bar/bar.rego")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+	expectedRego := ast.MustParseModule(string(expectedRegoBytes))
+	moduleFile := "bar/bar.rego"
+	if !expectedRego.Equal(loaded.Modules[moduleFile].Parsed) {
+		t.Fatalf(
+			"Expected:\n%v\n\nGot:\n%v",
+			expectedRego,
+			loaded.Modules[moduleFile],
+		)
+	}
+
+	expected := parseJSON(`
+	{"four": [1,2,3], "one": {"two": "abc"}, "three": {"qux": null}}
+	`)
+	if !reflect.DeepEqual(loaded.Documents, expected) {
+		t.Fatalf("Expected %v but got: %v", expected, loaded.Documents)
+	}
+}
+
+func TestLoadWithJSONOptions(t *testing.T) {
+	paths := []string{
+		"four:foo.json",
+		"one.two:bar",
+		"three:baz",
+	}
+
+	fsys, err := fs.Sub(embedTestFS, "internal/embedtest")
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	// load the file with JSON options set to include location data
+	loaded, err := NewFileLoader().WithFS(fsys).WithJSONOptions(&ast.JSONOptions{
+		MarshalOptions: ast.JSONMarshalOptions{
+			IncludeLocation: ast.NodeToggle{
+				Package: true,
+			},
+		},
+	}).All(paths)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	mod, ok := loaded.Modules["bar/bar.rego"]
+	if !ok {
+		t.Fatalf("Expected bar/bar.rego to be loaded")
+	}
+
+	bs, err := json.Marshal(mod.Parsed.Package)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	exp := `{"location":{"file":"bar/bar.rego","row":1,"col":1},"path":[{"type":"var","value":"data"},{"type":"string","value":"bar"}]}`
+	if string(bs) != exp {
+		t.Fatalf("Expected %v but got: %v", exp, string(bs))
+	}
+}
+
 func TestGlobExcludeName(t *testing.T) {
 
 	files := map[string]string{
diff --git a/logging/logging.go b/logging/logging.go
index 83f6bc9b45..3ce76da468 100644
--- a/logging/logging.go
+++ b/logging/logging.go
@@ -1,6 +1,7 @@
 package logging
 
 import (
+	"context"
 	"io"
 
 	"github.com/sirupsen/logrus"
@@ -28,7 +29,6 @@ type Logger interface {
 	Warn(fmt string, a ...interface{})
 
 	WithFields(map[string]interface{}) Logger
-	GetFields() map[string]interface{}
 
 	GetLevel() Level
 	SetLevel(Level)
@@ -79,8 +79,8 @@ func (l *StandardLogger) WithFields(fields map[string]interface{}) Logger {
 	return &cp
 }
 
-// GetFields returns additional fields of this logger
-func (l *StandardLogger) GetFields() map[string]interface{} {
+// getFields returns additional fields of this logger
+func (l *StandardLogger) getFields() map[string]interface{} {
 	return l.fields
 }
 
@@ -88,8 +88,8 @@ func (l *StandardLogger) GetFields() map[string]interface{} {
 func (l *StandardLogger) SetLevel(level Level) {
 	var logrusLevel logrus.Level
 	switch level {
-	case Error:
-		logrusLevel = logrus.ErrorLevel
+	case Error: // set logging level report Warn or higher (includes Error)
+		logrusLevel = logrus.WarnLevel
 	case Warn:
 		logrusLevel = logrus.WarnLevel
 	case Info:
@@ -110,10 +110,8 @@ func (l *StandardLogger) GetLevel() Level {
 
 	var level Level
 	switch logrusLevel {
-	case logrus.ErrorLevel:
-		level = Error
 	case logrus.WarnLevel:
-		level = Warn
+		level = Error
 	case logrus.InfoLevel:
 		level = Info
 	case logrus.DebugLevel:
@@ -128,22 +126,22 @@ func (l *StandardLogger) GetLevel() Level {
 
 // Debug logs at debug level
 func (l *StandardLogger) Debug(fmt string, a ...interface{}) {
-	l.logger.WithFields(l.GetFields()).Debugf(fmt, a...)
+	l.logger.WithFields(l.getFields()).Debugf(fmt, a...)
 }
 
 // Info logs at info level
 func (l *StandardLogger) Info(fmt string, a ...interface{}) {
-	l.logger.WithFields(l.GetFields()).Infof(fmt, a...)
+	l.logger.WithFields(l.getFields()).Infof(fmt, a...)
 }
 
 // Error logs at error level
 func (l *StandardLogger) Error(fmt string, a ...interface{}) {
-	l.logger.WithFields(l.GetFields()).Errorf(fmt, a...)
+	l.logger.WithFields(l.getFields()).Errorf(fmt, a...)
 }
 
 // Warn logs at warn level
 func (l *StandardLogger) Warn(fmt string, a ...interface{}) {
-	l.logger.WithFields(l.GetFields()).Errorf(fmt, a...)
+	l.logger.WithFields(l.getFields()).Warnf(fmt, a...)
 }
 
 // NoOpLogger logging implementation that does nothing
@@ -167,12 +165,6 @@ func (l *NoOpLogger) WithFields(fields map[string]interface{}) Logger {
 	return &cp
 }
 
-// GetFields returns additional fields of this logger
-// Implemented here primarily to be able to switch between implementations without loss of data.
-func (l *NoOpLogger) GetFields() map[string]interface{} {
-	return l.fields
-}
-
 // Debug noop
 func (*NoOpLogger) Debug(string, ...interface{}) {}
 
@@ -194,3 +186,48 @@ func (l *NoOpLogger) SetLevel(level Level) {
 func (l *NoOpLogger) GetLevel() Level {
 	return l.level
 }
+
+type requestContextKey string
+
+const reqCtxKey = requestContextKey("request-context-key")
+
+// RequestContext represents the request context used to store data
+// related to the request that could be used on logs.
+type RequestContext struct {
+	ClientAddr string
+	ReqID      uint64
+	ReqMethod  string
+	ReqPath    string
+}
+
+// Fields adapts the RequestContext fields to logrus.Fields.
+func (rctx RequestContext) Fields() logrus.Fields {
+	return logrus.Fields{
+		"client_addr": rctx.ClientAddr,
+		"req_id":      rctx.ReqID,
+		"req_method":  rctx.ReqMethod,
+		"req_path":    rctx.ReqPath,
+	}
+}
+
+// NewContext returns a copy of parent with an associated RequestContext.
+func NewContext(parent context.Context, val *RequestContext) context.Context {
+	return context.WithValue(parent, reqCtxKey, val)
+}
+
+// FromContext returns the RequestContext associated with ctx, if any.
+func FromContext(ctx context.Context) (*RequestContext, bool) {
+	requestContext, ok := ctx.Value(reqCtxKey).(*RequestContext)
+	return requestContext, ok
+}
+
+const decisionCtxKey = requestContextKey("decision_id")
+
+func WithDecisionID(parent context.Context, id string) context.Context {
+	return context.WithValue(parent, decisionCtxKey, id)
+}
+
+func DecisionIDFromContext(ctx context.Context) (string, bool) {
+	s, ok := ctx.Value(decisionCtxKey).(string)
+	return s, ok
+}
diff --git a/logging/logging_test.go b/logging/logging_test.go
index 33b539d28a..2c1aaa027f 100644
--- a/logging/logging_test.go
+++ b/logging/logging_test.go
@@ -1,7 +1,13 @@
 package logging
 
 import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"strings"
 	"testing"
+
+	"github.com/open-policy-agent/opa/internal/uuid"
 )
 
 func TestWithFields(t *testing.T) {
@@ -19,6 +25,26 @@ func TestWithFields(t *testing.T) {
 	}
 }
 
+func TestCaptureWarningWithErrorSet(t *testing.T) {
+	buf := bytes.Buffer{}
+	logger := New()
+	logger.SetOutput(&buf)
+	logger.SetLevel(Error)
+
+	logger.Warn("This is a warning. Next time, I won't compile.")
+	logger.Error("Fix your issues. I'm not compiling.")
+
+	expected := []string{
+		`level=warning msg="This is a warning. Next time, I won't compile."`,
+		`level=error msg="Fix your issues. I'm not compiling."`,
+	}
+	for _, exp := range expected {
+		if !strings.Contains(buf.String(), exp) {
+			t.Errorf("expected string %q not found in logs", exp)
+		}
+	}
+}
+
 func TestWithFieldsOverrides(t *testing.T) {
 	logger := New().
 		WithFields(map[string]interface{}{"context": "contextvalue"}).
@@ -60,3 +86,63 @@ func TestWithFieldsMerges(t *testing.T) {
 		t.Fatal("Logger did not contain configured field value")
 	}
 }
+
+func TestRequestContextFields(t *testing.T) {
+	fields := RequestContext{
+		ClientAddr: "127.0.0.1",
+		ReqID:      1,
+		ReqMethod:  "GET",
+		ReqPath:    "/test",
+	}.Fields()
+
+	var fieldvalue interface{}
+	var ok bool
+
+	if fieldvalue, ok = fields["client_addr"]; !ok {
+		t.Fatal("Fields did not contain the client_addr field")
+	}
+
+	if fieldvalue.(string) != "127.0.0.1" {
+		t.Fatal("Fields did not contain the configured client_addr value")
+	}
+
+	if fieldvalue, ok = fields["req_id"]; !ok {
+		t.Fatal("Fields did not contain the req_id field")
+	}
+
+	if fieldvalue.(uint64) != 1 {
+		t.Fatal("Fields did not contain the configured req_id value")
+	}
+
+	if fieldvalue, ok = fields["req_method"]; !ok {
+		t.Fatal("Fields did not contain the req_method field")
+	}
+
+	if fieldvalue.(string) != "GET" {
+		t.Fatal("Fields did not contain the configured req_method value")
+	}
+
+	if fieldvalue, ok = fields["req_path"]; !ok {
+		t.Fatal("Fields did not contain the req_path field")
+	}
+
+	if fieldvalue.(string) != "/test" {
+		t.Fatal("Fields did not contain the configured req_path value")
+	}
+}
+
+func TestDecsionIDFromContext(t *testing.T) {
+	id, err := uuid.New(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx := WithDecisionID(context.Background(), id)
+
+	act, ok := DecisionIDFromContext(ctx)
+	if !ok {
+		t.Fatalf("expected 'ok' to be true")
+	}
+	if exp := id; act != exp {
+		t.Errorf("Expected %q to be %q", act, exp)
+	}
+}
diff --git a/logging/test/test.go b/logging/test/test.go
index f0fd9a454b..fa9a05cd0d 100644
--- a/logging/test/test.go
+++ b/logging/test/test.go
@@ -51,12 +51,6 @@ func (l *Logger) WithFields(fields map[string]interface{}) logging.Logger {
 	return &cp
 }
 
-// GetFields returns additional fields of this logger
-// Implemented here primarily to be able to switch between implementations without loss of data.
-func (l *Logger) GetFields() map[string]interface{} {
-	return l.fields
-}
-
 // Debug buffers a log message.
 func (l *Logger) Debug(f string, a ...interface{}) {
 	l.append(logging.Debug, f, a...)
diff --git a/main.go b/main.go
index a96fd0e881..5aba68b3e8 100644
--- a/main.go
+++ b/main.go
@@ -5,7 +5,6 @@
 package main
 
 import (
-	"fmt"
 	"os"
 
 	"github.com/open-policy-agent/opa/cmd"
@@ -13,13 +12,10 @@ import (
 
 func main() {
 	if err := cmd.RootCommand.Execute(); err != nil {
-		fmt.Println(err)
 		os.Exit(1)
 	}
 }
 
-// Capabilities file generation:
+// Capabilities + built-in metadata file generation:
 //go:generate build/gen-run-go.sh internal/cmd/genopacapabilities/main.go capabilities.json
-
-// WASM base binary generation:
-//go:generate build/gen-run-go.sh internal/cmd/genopawasm/main.go -o internal/compiler/wasm/opa/opa.go internal/compiler/wasm/opa/opa.wasm  internal/compiler/wasm/opa/callgraph.csv
+//go:generate build/gen-run-go.sh internal/cmd/genbuiltinmetadata/main.go builtin_metadata.json
diff --git a/metrics/metrics.go b/metrics/metrics.go
index 4f31a44515..53cd606a36 100644
--- a/metrics/metrics.go
+++ b/metrics/metrics.go
@@ -76,7 +76,7 @@ type metric struct {
 	Value interface{}
 }
 
-func (m *metrics) Info() Info {
+func (*metrics) Info() Info {
 	return Info{
 		Name: "<built-in>",
 	}
diff --git a/netlify.toml b/netlify.toml
index ef214aac9d..f5503833fd 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -1,9 +1,15 @@
 [build]
 publish = "docs/website/public"
 command = "make netlify-prod WASM_ENABLED=0 CGO_ENABLED=0"
+ignore = "./build/docs-build-needed.sh"
+edge_functions = "docs/website/edge"
+
+[[edge_functions]]
+path = "/badge-endpoint/*"
+function = "badge"
 
 [build.environment]
-HUGO_VERSION = "0.88.1"
+HUGO_VERSION = "0.109.0"
 
 [context.deploy-preview]
 command = "make netlify-preview WASM_ENABLED=0 CGO_ENABLED=0"
@@ -15,6 +21,7 @@ command = "make netlify-preview WASM_ENABLED=0 CGO_ENABLED=0"
 # "netlify dev" will serve the static content using netlify locally
 # with all the redirects and other netlify specific rules in place.
 publish = "docs/website/public"
+framework = "#static"
 
 # To run the netlify dev service with hugo dev server "live" behind
 # it uncomment these lines:
diff --git a/plugins/bundle/config.go b/plugins/bundle/config.go
index d5a88fd0f6..1cafbccc2d 100644
--- a/plugins/bundle/config.go
+++ b/plugins/bundle/config.go
@@ -170,10 +170,8 @@ func (c *Config) validateAndInjectDefaults(services []string, keys map[string]*k
 			source.Resource = path.Join(defaultBundlePathPrefix, name)
 		}
 
-		var err error
-
 		if source.Signing != nil {
-			err = source.Signing.ValidateAndInjectDefaults(keys)
+			err := source.Signing.ValidateAndInjectDefaults(keys)
 			if err != nil {
 				return fmt.Errorf("invalid configuration for bundle %q: %s", name, err.Error())
 			}
@@ -183,33 +181,27 @@ func (c *Config) validateAndInjectDefaults(services []string, keys map[string]*k
 			}
 		}
 
-		// If the resource specifies a file:// URL then we can ignore the
-		// service configuration error.
-		ignoreServiceConfigErr := false
-
 		if strings.HasPrefix(source.Resource, "file://") {
 			if _, err := url.Parse(source.Resource); err != nil {
 				return fmt.Errorf("invalid URL for bundle %q: %v", name, err)
 			}
-			ignoreServiceConfigErr = true
-		}
-
-		source.Service, err = c.getServiceFromList(source.Service, services)
-		if err != nil {
-			return fmt.Errorf("invalid configuration for bundle %q: %s", name, err.Error())
+		} else {
+			svc, err := c.getServiceFromList(source.Service, services)
+			if err != nil {
+				return fmt.Errorf("invalid configuration for bundle %q: %s", name, err.Error())
+			}
+			source.Service = svc
 		}
 
 		t, err := plugins.ValidateAndInjectDefaultsForTriggerMode(trigger, source.Trigger)
 		if err != nil {
 			return fmt.Errorf("invalid configuration for bundle %q: %w", name, err)
 		}
+
 		source.Trigger = t
 
-		if err == nil || ignoreServiceConfigErr {
-			err = source.Config.ValidateAndInjectDefaults()
-			if err != nil {
-				return fmt.Errorf("invalid configuration for bundle %q: %w", name, err)
-			}
+		if err := source.Config.ValidateAndInjectDefaults(); err != nil {
+			return fmt.Errorf("invalid configuration for bundle %q: %w", name, err)
 		}
 
 		if source.SizeLimitBytes <= 0 {
@@ -255,7 +247,7 @@ func (c *Config) getServiceFromList(service string, services []string) (string,
 	return service, fmt.Errorf("service name %q not found", service)
 }
 
-// generateLegacyDownloadPath will return the Resource path
+// generateLegacyResourcePath will return the Resource path
 // from the older style prefix+name configuration.
 func (c *Config) generateLegacyResourcePath() string {
 	joined := path.Join(*c.Prefix, c.Name)
diff --git a/plugins/bundle/config_test.go b/plugins/bundle/config_test.go
index 161c933d2f..d4b0ea9723 100644
--- a/plugins/bundle/config_test.go
+++ b/plugins/bundle/config_test.go
@@ -341,7 +341,7 @@ b4:
 			resource: "/some/longer/path/bundle.tar.gz",
 		},
 		"b4": {
-			service:  "s1",
+			service:  "", // service will be unset because it is a file:// url
 			resource: "file:///foo/bar",
 		},
 	}
@@ -364,6 +364,17 @@ b4:
 	}
 }
 
+func TestParseBundlesConfigSimpleFileURL(t *testing.T) {
+
+	config := []byte(`{"test": {"resource": "file:///b.tar.gz"}}`)
+
+	_, err := ParseBundlesConfig(config, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+}
+
 func TestConfigIsMultiBundle(t *testing.T) {
 	tests := []struct {
 		conf     Config
diff --git a/plugins/bundle/plugin.go b/plugins/bundle/plugin.go
index bc63dfe322..4953d8c7eb 100644
--- a/plugins/bundle/plugin.go
+++ b/plugins/bundle/plugin.go
@@ -14,6 +14,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strings"
 	"sync"
 	"time"
 
@@ -27,6 +28,18 @@ import (
 	"github.com/open-policy-agent/opa/storage"
 )
 
+// maxActivationRetry represents the maximum number of attempts
+// to activate persisted bundles. Activation retries are useful
+// in scenarios where a persisted bundle may have a dependency on some
+// other persisted bundle. As there are no ordering guarantees for which
+// bundle loads first, retries could help in the bundle activation process.
+// Typically, multiple bundles are not encouraged. The value chosen for
+// maxActivationRetry allows upto 10 bundles to successfully activate
+// in the worst case that they depend on each other. At the same time, it also
+// ensures that too much time is not spent to activate bundles that will never
+// successfully activate.
+const maxActivationRetry = 10
+
 // Loader defines the interface that the bundle plugin uses to control bundle
 // loading via HTTP, disk, etc.
 type Loader interface {
@@ -102,12 +115,9 @@ func (p *Plugin) Start(ctx context.Context) error {
 		return err
 	}
 
-	err = p.loadAndActivateBundlesFromDisk(ctx)
-	if err != nil {
-		return err
-	}
+	p.loadAndActivateBundlesFromDisk(ctx)
 
-	p.initDownloaders()
+	p.initDownloaders(ctx)
 	for name, dl := range p.downloaders {
 		p.log(name).Info("Starting bundle loader.")
 		dl.Start(ctx)
@@ -179,7 +189,7 @@ func (p *Plugin) Reconfigure(ctx context.Context, config interface{}) {
 
 	// Deactivate the bundles that were removed
 	params := storage.WriteParams
-	params.Context = storage.NewContext()
+	params.Context = storage.NewContext() // TODO(sr): metrics?
 	err := storage.Txn(ctx, p.manager.Store, params, func(txn storage.Transaction) error {
 		opts := &bundle.DeactivateOpts{
 			Ctx:         ctx,
@@ -213,8 +223,16 @@ func (p *Plugin) Reconfigure(ctx context.Context, config interface{}) {
 			} else {
 				p.log(name).Info("Bundle loader configuration changed. Restarting bundle loader.")
 			}
-			p.downloaders[name] = p.newDownloader(name, source)
+
+			downloader := p.newDownloader(name, source)
+
+			etag := p.readBundleEtagFromStore(ctx, name)
+			downloader.SetCache(etag)
+
+			p.downloaders[name] = downloader
+			p.etags[name] = etag
 			p.downloaders[name].Start(ctx)
+
 			readyNow = false
 		}
 	}
@@ -294,32 +312,77 @@ func (p *Plugin) Config() *Config {
 	return &p.config
 }
 
-func (p *Plugin) initDownloaders() {
+func (p *Plugin) initDownloaders(ctx context.Context) {
+
 	// Initialize a downloader for each bundle configured.
 	for name, source := range p.config.Bundles {
-		p.downloaders[name] = p.newDownloader(name, source)
+		downloader := p.newDownloader(name, source)
+
+		etag := p.readBundleEtagFromStore(ctx, name)
+		downloader.SetCache(etag)
+
+		p.downloaders[name] = downloader
+		p.etags[name] = etag
 	}
 }
 
-func (p *Plugin) loadAndActivateBundlesFromDisk(ctx context.Context) error {
+func (p *Plugin) readBundleEtagFromStore(ctx context.Context, name string) string {
+	var etag string
+	err := storage.Txn(ctx, p.manager.Store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+		var loadErr error
+		etag, loadErr = bundle.ReadBundleEtagFromStore(ctx, p.manager.Store, txn, name)
+		if loadErr != nil && !storage.IsNotFound(loadErr) {
+			p.log(name).Error("Failed to load bundle etag from store: %v", loadErr)
+			return loadErr
+		}
+		return nil
+	})
+	if err != nil {
+		// TODO: This probably shouldn't panic. But OPA shouldn't
+		// continue in a potentially inconsistent state.
+		panic(errors.New("Unable to load bundle etag from store: " + err.Error()))
+	}
+
+	return etag
+}
+
+func (p *Plugin) loadAndActivateBundlesFromDisk(ctx context.Context) {
+
+	persistedBundles := map[string]*bundle.Bundle{}
+
 	for name, src := range p.config.Bundles {
 		if p.persistBundle(name) {
 			b, err := loadBundleFromDisk(p.bundlePersistPath, name, src)
 			if err != nil {
 				p.log(name).Error("Failed to load bundle from disk: %v", err)
-				return err
+				p.status[name].SetError(err)
+				continue
 			}
 
 			if b == nil {
-				return nil
+				continue
 			}
 
+			persistedBundles[name] = b
+		}
+	}
+
+	if len(persistedBundles) == 0 {
+		return
+	}
+
+	for retry := 0; retry < maxActivationRetry; retry++ {
+
+		numActivatedBundles := 0
+		for name, b := range persistedBundles {
 			p.status[name].Metrics = metrics.New()
+			p.status[name].Type = b.Type()
 
-			err = p.activate(ctx, name, b)
+			err := p.activate(ctx, name, b)
 			if err != nil {
 				p.log(name).Error("Bundle activation failed: %v", err)
-				return err
+				p.status[name].SetError(err)
+				continue
 			}
 
 			p.status[name].SetError(nil)
@@ -328,9 +391,13 @@ func (p *Plugin) loadAndActivateBundlesFromDisk(ctx context.Context) error {
 			p.checkPluginReadiness()
 
 			p.log(name).Debug("Bundle loaded from disk and activated successfully.")
+			numActivatedBundles++
+		}
+
+		if numActivatedBundles == len(persistedBundles) {
+			return
 		}
 	}
-	return nil
 }
 
 func (p *Plugin) newDownloader(name string, source *Source) Loader {
@@ -355,11 +422,23 @@ func (p *Plugin) newDownloader(name string, source *Source) Loader {
 		// wrap the callback to include the name of the bundle that was updated
 		p.oneShot(ctx, name, u)
 	}
+	if strings.ToLower(client.Config().Type) == "oci" {
+		ociStorePath := filepath.Join(os.TempDir(), "opa", "oci") // use temporary folder /tmp/opa/oci
+		if p.manager.Config.PersistenceDirectory != nil {
+			ociStorePath = filepath.Join(*p.manager.Config.PersistenceDirectory, "oci")
+		}
+		return download.NewOCI(conf, client, path, ociStorePath).
+			WithCallback(callback).
+			WithBundleVerificationConfig(source.Signing).
+			WithSizeLimitBytes(source.SizeLimitBytes).
+			WithBundlePersistence(p.persistBundle(name))
+	}
 	return download.New(conf, client, path).
 		WithCallback(callback).
 		WithBundleVerificationConfig(source.Signing).
 		WithSizeLimitBytes(source.SizeLimitBytes).
-		WithBundlePersistence(p.persistBundle(name))
+		WithBundlePersistence(p.persistBundle(name)).
+		WithLazyLoadingMode(true).WithBundleName(name)
 }
 
 func (p *Plugin) oneShot(ctx context.Context, name string, u download.Update) {
@@ -409,6 +488,7 @@ func (p *Plugin) process(ctx context.Context, name string, u download.Update) {
 	p.status[name].LastSuccessfulRequest = p.status[name].LastRequest
 
 	if u.Bundle != nil {
+		p.status[name].Type = u.Bundle.Type()
 		p.status[name].LastSuccessfulDownload = p.status[name].LastSuccessfulRequest
 
 		p.status[name].Metrics.Timer(metrics.RegoLoadBundles).Start()
@@ -424,7 +504,7 @@ func (p *Plugin) process(ctx context.Context, name string, u download.Update) {
 			return
 		}
 
-		if p.persistBundle(name) {
+		if u.Bundle.Type() == bundle.SnapshotBundleType && p.persistBundle(name) {
 			p.log(name).Debug("Persisting bundle to disk in progress.")
 
 			err := p.saveBundleToDisk(name, u.Raw)
@@ -442,6 +522,7 @@ func (p *Plugin) process(ctx context.Context, name string, u download.Update) {
 
 		p.status[name].SetError(nil)
 		p.status[name].SetActivateSuccess(u.Bundle.Manifest.Revision)
+		p.status[name].SetBundleSize(u.Size)
 
 		if u.ETag != "" {
 			p.log(name).Info("Bundle loaded and activated successfully. Etag updated to %v.", u.ETag)
@@ -480,10 +561,10 @@ func (p *Plugin) checkPluginReadiness() {
 }
 
 func (p *Plugin) activate(ctx context.Context, name string, b *bundle.Bundle) error {
-	p.log(name).Debug("Bundle activation in progress. Opening storage transaction.")
+	p.log(name).Debug("Bundle activation in progress (%v). Opening storage transaction.", b.Manifest.Revision)
 
 	params := storage.WriteParams
-	params.Context = storage.NewContext()
+	params.Context = storage.NewContext().WithMetrics(p.status[name].Metrics)
 
 	err := storage.Txn(ctx, p.manager.Store, params, func(txn storage.Transaction) error {
 		p.log(name).Debug("Opened storage transaction (%v).", txn.ID())
@@ -491,8 +572,18 @@ func (p *Plugin) activate(ctx context.Context, name string, b *bundle.Bundle) er
 
 		// Compile the bundle modules with a new compiler and set it on the
 		// transaction params for use by onCommit hooks.
-		compiler := ast.NewCompiler().
-			WithPathConflictsCheck(storage.NonEmpty(ctx, p.manager.Store, txn)).
+		// If activating a delta bundle, use the manager's compiler which should have
+		// the polices compiled on it.
+		var compiler *ast.Compiler
+		if b.Type() == bundle.DeltaBundleType {
+			compiler = p.manager.GetCompiler()
+		}
+
+		if compiler == nil {
+			compiler = ast.NewCompiler()
+		}
+
+		compiler = compiler.WithPathConflictsCheck(storage.NonEmpty(ctx, p.manager.Store, txn)).
 			WithEnablePrintStatements(p.manager.EnablePrintStatements())
 
 		var activateErr error
@@ -563,10 +654,9 @@ func (p *Plugin) configDelta(newConfig *Config) (map[string]*Source, map[string]
 func (p *Plugin) saveBundleToDisk(name string, raw io.Reader) error {
 
 	bundleDir := filepath.Join(p.bundlePersistPath, name)
-	tmpFile := filepath.Join(bundleDir, ".bundle.tar.gz.tmp")
 	bundleFile := filepath.Join(bundleDir, "bundle.tar.gz")
 
-	saveErr := saveCurrentBundleToDisk(bundleDir, ".bundle.tar.gz.tmp", raw)
+	tmpFile, saveErr := saveCurrentBundleToDisk(bundleDir, raw)
 	if saveErr != nil {
 		p.log(name).Error("Failed to save new bundle to disk: %v", saveErr)
 
@@ -584,54 +674,15 @@ func (p *Plugin) saveBundleToDisk(name string, raw io.Reader) error {
 	return os.Rename(tmpFile, bundleFile)
 }
 
-func saveCurrentBundleToDisk(path, filename string, raw io.Reader) error {
-	if _, err := os.Stat(path); os.IsNotExist(err) {
-		err = os.MkdirAll(path, os.ModePerm)
-		if err != nil {
-			return err
-		}
-	}
-
-	if raw == nil {
-		return fmt.Errorf("no raw bundle bytes to persist to disk")
-	}
-
-	dest, err := os.OpenFile(filepath.Join(path, filename), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
-	if err != nil {
-		return err
-	}
-	defer dest.Close()
-
-	_, err = io.Copy(dest, raw)
-	return err
+func saveCurrentBundleToDisk(path string, raw io.Reader) (string, error) {
+	return bundleUtils.SaveBundleToDisk(path, raw)
 }
 
 func loadBundleFromDisk(path, name string, src *Source) (*bundle.Bundle, error) {
-	bundlePath := filepath.Join(path, name, "bundle.tar.gz")
-
-	if _, err := os.Stat(bundlePath); err == nil {
-		f, err := os.Open(filepath.Join(bundlePath))
-		if err != nil {
-			return nil, err
-		}
-		defer f.Close()
-
-		r := bundle.NewReader(f)
-
-		if src != nil {
-			r = r.WithBundleVerificationConfig(src.Signing)
-		}
-
-		b, err := r.Read()
-		if err != nil {
-			return nil, err
-		}
-		return &b, nil
-	} else if os.IsNotExist(err) {
-		return nil, nil
-	} else {
-		return nil, err
+	if src != nil {
+		return bundleUtils.LoadBundleFromDisk(path, name, src.Signing)
 	}
+	return bundleUtils.LoadBundleFromDisk(path, name, nil)
 }
 
 func (p *Plugin) log(name string) logging.Logger {
@@ -684,15 +735,30 @@ func (fl *fileLoader) Trigger(ctx context.Context) error {
 func (fl *fileLoader) oneShot(ctx context.Context) {
 	var u download.Update
 	u.Metrics = metrics.New()
-	f, err := os.Open(fl.path)
+
+	info, err := os.Stat(fl.path)
 	u.Error = err
 	if err != nil {
 		fl.f(ctx, fl.name, u)
 		return
 	}
 
-	defer f.Close()
-	b, err := bundle.NewReader(f).
+	var reader *bundle.Reader
+
+	if info.IsDir() {
+		reader = bundle.NewCustomReader(bundle.NewDirectoryLoader(fl.path))
+	} else {
+		f, err := os.Open(fl.path)
+		u.Error = err
+		if err != nil {
+			fl.f(ctx, fl.name, u)
+			return
+		}
+		defer f.Close()
+		reader = bundle.NewReader(f)
+	}
+
+	b, err := reader.
 		WithMetrics(u.Metrics).
 		WithBundleVerificationConfig(fl.bvc).
 		WithSizeLimitBytes(fl.sizeLimitBytes).Read()
diff --git a/plugins/bundle/plugin_test.go b/plugins/bundle/plugin_test.go
index 75841a3ec2..eb11b7e4ac 100644
--- a/plugins/bundle/plugin_test.go
+++ b/plugins/bundle/plugin_test.go
@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -23,20 +22,25 @@ import (
 	"testing"
 	"time"
 
-	"github.com/open-policy-agent/opa/internal/file/archive"
-
-	"github.com/open-policy-agent/opa/util/test"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/config"
 	"github.com/open-policy-agent/opa/download"
+	"github.com/open-policy-agent/opa/internal/file/archive"
 	"github.com/open-policy-agent/opa/keys"
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/storage/disk"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
+	"github.com/open-policy-agent/opa/util/test"
+)
+
+const (
+	deltaBundleSize    = 128
+	snapshotBundleSize = 1024
 )
 
 func TestPluginOneShot(t *testing.T) {
@@ -62,14 +66,23 @@ func TestPluginOneShot(t *testing.T) {
 				Raw:    []byte(module),
 			},
 		},
+		Etag: "foo",
 	}
 
 	b.Manifest.Init()
 
-	plugin.oneShot(ctx, bundleName, download.Update{Bundle: &b, Metrics: metrics.New()})
+	plugin.oneShot(ctx, bundleName, download.Update{Bundle: &b, Metrics: metrics.New(), Size: snapshotBundleSize})
 
 	ensurePluginState(t, plugin, plugins.StateOK)
 
+	if status, ok := plugin.status[bundleName]; !ok {
+		t.Fatalf("Expected to find status for %s, found nil", bundleName)
+	} else if status.Type != bundle.SnapshotBundleType {
+		t.Fatalf("expected snapshot bundle but got %v", status.Type)
+	} else if status.Size != snapshotBundleSize {
+		t.Fatalf("expected snapshot bundle size %d but got %d", snapshotBundleSize, status.Size)
+	}
+
 	txn := storage.NewTransactionOrDie(ctx, manager.Store)
 	defer manager.Store.Abort(ctx, txn)
 
@@ -89,7 +102,7 @@ func TestPluginOneShot(t *testing.T) {
 	}
 
 	data, err := manager.Store.Read(ctx, txn, storage.Path{})
-	expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
+	expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"etag": "foo", "manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
 	if err != nil {
 		t.Fatal(err)
 	} else if !reflect.DeepEqual(data, expData) {
@@ -97,6 +110,348 @@ func TestPluginOneShot(t *testing.T) {
 	}
 }
 
+func TestPluginStartLazyLoadInMem(t *testing.T) {
+	ctx := context.Background()
+
+	module := "package authz\n\ncorge=1"
+
+	// setup fake http server with mock bundle
+	mockBundle1 := bundle.Bundle{
+		Data: map[string]interface{}{"p": "x1"},
+		Modules: []bundle.ModuleFile{
+			{
+				URL:    "/bar/policy.rego",
+				Path:   "/bar/policy.rego",
+				Parsed: ast.MustParseModule(module),
+				Raw:    []byte(module),
+			},
+		},
+		Manifest: bundle.Manifest{
+			Roots: &[]string{"p", "authz"},
+		},
+	}
+
+	s1 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		err := bundle.NewWriter(w).Write(mockBundle1)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}))
+
+	mockBundle2 := bundle.Bundle{
+		Data:    map[string]interface{}{"q": "x2"},
+		Modules: []bundle.ModuleFile{},
+		Manifest: bundle.Manifest{
+			Roots: &[]string{"q"},
+		},
+	}
+
+	s2 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		err := bundle.NewWriter(w).Write(mockBundle2)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}))
+
+	config := []byte(fmt.Sprintf(`{
+		"services": {
+			"default": {
+				"url": %q
+			},
+			"acmecorp": {
+				"url": %q
+			}
+		}
+	}`, s1.URL, s2.URL))
+
+	manager := getTestManagerWithOpts(config)
+	defer manager.Stop(ctx)
+
+	var mode plugins.TriggerMode = "manual"
+
+	plugin := New(&Config{
+		Bundles: map[string]*Source{
+			"test-1": {
+				Service:        "default",
+				SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+				Config:         download.Config{Trigger: &mode},
+			},
+			"test-2": {
+				Service:        "acmecorp",
+				SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+				Config:         download.Config{Trigger: &mode},
+			},
+		},
+	}, manager)
+
+	statusCh := make(chan map[string]*Status)
+
+	// register for bundle updates to observe changes and start the plugin
+	plugin.RegisterBulkListener("test-case", func(st map[string]*Status) {
+		statusCh <- st
+	})
+
+	err := plugin.Start(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// manually trigger bundle download on all configured bundles
+	go func() {
+		_ = plugin.Trigger(ctx)
+	}()
+
+	// wait for bundle update and then assert on data content
+	<-statusCh
+	<-statusCh
+
+	result, err := storage.ReadOne(ctx, manager.Store, storage.Path{"p"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(result, mockBundle1.Data["p"]) {
+		t.Fatalf("expected data to be %v but got %v", mockBundle1.Data, result)
+	}
+
+	result, err = storage.ReadOne(ctx, manager.Store, storage.Path{"q"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if !reflect.DeepEqual(result, mockBundle2.Data["q"]) {
+		t.Fatalf("expected data to be %v but got %v", mockBundle2.Data, result)
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, manager.Store)
+	defer manager.Store.Abort(ctx, txn)
+
+	ids, err := manager.Store.ListPolicies(ctx, txn)
+	if err != nil {
+		t.Fatal(err)
+	} else if len(ids) != 1 {
+		t.Fatal("Expected 1 policy")
+	}
+
+	bs, err := manager.Store.GetPolicy(ctx, txn, ids[0])
+	exp := []byte("package authz\n\ncorge=1")
+	if err != nil {
+		t.Fatal(err)
+	} else if !bytes.Equal(bs, exp) {
+		t.Fatalf("Bad policy content. Exp:\n%v\n\nGot:\n\n%v", string(exp), string(bs))
+	}
+
+	data, err := manager.Store.Read(ctx, txn, storage.Path{})
+	expData := util.MustUnmarshalJSON([]byte(`{"p": "x1", "q": "x2", "system": {"bundles": {"test-1": {"etag": "", "manifest": {"revision": "", "roots": ["p", "authz"]}}, "test-2": {"etag": "", "manifest": {"revision": "", "roots": ["q"]}}}}}`))
+	if err != nil {
+		t.Fatal(err)
+	} else if !reflect.DeepEqual(data, expData) {
+		t.Fatalf("Bad data content. Exp:\n%v\n\nGot:\n\n%v", expData, data)
+	}
+}
+
+func TestPluginOneShotDiskStorageMetrics(t *testing.T) {
+
+	test.WithTempFS(nil, func(dir string) {
+		ctx := context.Background()
+		met := metrics.New()
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+			Partitions: []storage.Path{
+				storage.MustParsePath("/foo"),
+			},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		manager := getTestManagerWithOpts(nil, store)
+		defer manager.Stop(ctx)
+		plugin := New(&Config{}, manager)
+		bundleName := "test-bundle"
+		plugin.status[bundleName] = &Status{Name: bundleName, Metrics: met}
+		plugin.downloaders[bundleName] = download.New(download.Config{}, plugin.manager.Client(""), bundleName)
+
+		ensurePluginState(t, plugin, plugins.StateNotReady)
+
+		module := "package foo\n\ncorge=1"
+
+		b := bundle.Bundle{
+			Manifest: bundle.Manifest{Revision: "quickbrownfaux"},
+			Data:     util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}}`)).(map[string]interface{}),
+			Modules: []bundle.ModuleFile{
+				{
+					Path:   "/foo/bar",
+					Parsed: ast.MustParseModule(module),
+					Raw:    []byte(module),
+				},
+			},
+		}
+
+		b.Manifest.Init()
+
+		met = metrics.New()
+		plugin.oneShot(ctx, bundleName, download.Update{Bundle: &b, Metrics: met})
+
+		ensurePluginState(t, plugin, plugins.StateOK)
+
+		// NOTE(sr): These assertions reflect the current behaviour only! Not prescriptive.
+		name := "disk_deleted_keys"
+		if exp, act := 3, met.Counter(name).Value(); act.(uint64) != uint64(exp) {
+			t.Errorf("%s: expected %v, got %v", name, exp, act)
+		}
+		name = "disk_written_keys"
+		if exp, act := 6, met.Counter(name).Value(); act.(uint64) != uint64(exp) {
+			t.Errorf("%s: expected %v, got %v", name, exp, act)
+		}
+		name = "disk_read_keys"
+		if exp, act := 13, met.Counter(name).Value(); act.(uint64) != uint64(exp) {
+			t.Errorf("%s: expected %v, got %v", name, exp, act)
+		}
+		name = "disk_read_bytes"
+		if exp, act := 269, met.Counter(name).Value(); act.(uint64) != uint64(exp) {
+			t.Errorf("%s: expected %v, got %v", name, exp, act)
+		}
+		for _, timer := range []string{
+			"disk_commit",
+			"disk_write",
+			"disk_read",
+		} {
+			if act := met.Timer(timer).Int64(); act <= 0 {
+				t.Errorf("%s: expected non-zero timer, got %v", timer, act)
+			}
+		}
+		if t.Failed() {
+			t.Logf("all metrics: %v", met.All())
+		}
+
+		// Ensure we can read it all back -- this is the only bundle plugin test using disk storage,
+		// so some duplicating with TestPluginOneShot is OK:
+
+		txn := storage.NewTransactionOrDie(ctx, manager.Store)
+		defer manager.Store.Abort(ctx, txn)
+
+		ids, err := manager.Store.ListPolicies(ctx, txn)
+		if err != nil {
+			t.Fatal(err)
+		} else if len(ids) != 1 {
+			t.Fatal("Expected 1 policy")
+		}
+
+		bs, err := manager.Store.GetPolicy(ctx, txn, ids[0])
+		exp := []byte("package foo\n\ncorge=1")
+		if err != nil {
+			t.Fatal(err)
+		} else if !bytes.Equal(bs, exp) {
+			t.Fatalf("Bad policy content. Exp:\n%v\n\nGot:\n\n%v", string(exp), string(bs))
+		}
+
+		data, err := manager.Store.Read(ctx, txn, storage.Path{})
+		expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"etag": "", "manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
+		if err != nil {
+			t.Fatal(err)
+		} else if !reflect.DeepEqual(data, expData) {
+			t.Fatalf("Bad data content. Exp:\n%v\n\nGot:\n\n%v", expData, data)
+		}
+	})
+}
+
+func TestPluginOneShotDeltaBundle(t *testing.T) {
+
+	ctx := context.Background()
+	manager := getTestManager()
+	plugin := New(&Config{}, manager)
+	bundleName := "test-bundle"
+	plugin.status[bundleName] = &Status{Name: bundleName, Metrics: metrics.New()}
+	plugin.downloaders[bundleName] = download.New(download.Config{}, plugin.manager.Client(""), bundleName)
+
+	ensurePluginState(t, plugin, plugins.StateNotReady)
+
+	module := "package a\n\ncorge=1"
+
+	b := bundle.Bundle{
+		Manifest: bundle.Manifest{Revision: "quickbrownfaux", Roots: &[]string{"a"}},
+		Data: map[string]interface{}{
+			"a": map[string]interface{}{
+				"baz": "qux",
+			},
+		},
+		Modules: []bundle.ModuleFile{
+			{
+				Path:   "a/policy.rego",
+				Parsed: ast.MustParseModule(module),
+				Raw:    []byte(module),
+			},
+		},
+	}
+
+	plugin.oneShot(ctx, bundleName, download.Update{Bundle: &b, Metrics: metrics.New()})
+
+	ensurePluginState(t, plugin, plugins.StateOK)
+
+	// simulate a delta bundle download
+
+	// replace a value
+	p1 := bundle.PatchOperation{
+		Op:    "replace",
+		Path:  "a/baz",
+		Value: "bux",
+	}
+
+	// add a new object member
+	p2 := bundle.PatchOperation{
+		Op:    "upsert",
+		Path:  "/a/foo",
+		Value: []interface{}{"hello", "world"},
+	}
+
+	b2 := bundle.Bundle{
+		Manifest: bundle.Manifest{Revision: "delta", Roots: &[]string{"a"}},
+		Patch:    bundle.Patch{Data: []bundle.PatchOperation{p1, p2}},
+		Etag:     "foo",
+	}
+
+	plugin.process(ctx, bundleName, download.Update{Bundle: &b2, Metrics: metrics.New(), Size: deltaBundleSize})
+
+	ensurePluginState(t, plugin, plugins.StateOK)
+
+	if status, ok := plugin.status[bundleName]; !ok {
+		t.Fatalf("Expected to find status for %s, found nil", bundleName)
+	} else if status.Type != bundle.DeltaBundleType {
+		t.Fatalf("expected delta bundle but got %v", status.Type)
+	} else if status.Size != deltaBundleSize {
+		t.Fatalf("expected delta bundle size %d but got %d", deltaBundleSize, status.Size)
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, manager.Store)
+	defer manager.Store.Abort(ctx, txn)
+
+	ids, err := manager.Store.ListPolicies(ctx, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 1 {
+		t.Fatalf("Expected 1 policy, got %d", len(ids))
+	}
+
+	bs, err := manager.Store.GetPolicy(ctx, txn, ids[0])
+	if err != nil {
+		t.Fatal(err)
+	}
+	exp := []byte("package a\n\ncorge=1")
+	if !bytes.Equal(bs, exp) {
+		t.Fatalf("Bad policy content. Exp:\n%v\n\nGot:\n\n%v", string(exp), string(bs))
+	}
+
+	data, err := manager.Store.Read(ctx, txn, storage.Path{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	expData := util.MustUnmarshalJSON([]byte(`{"a": {"baz": "bux", "foo": ["hello", "world"]}, "system": {"bundles": {"test-bundle": {"etag": "foo", "manifest": {"revision": "delta", "roots": ["a"]}}}}}`))
+	if !reflect.DeepEqual(data, expData) {
+		t.Fatalf("Bad data content. Exp:\n%#v\n\nGot:\n\n%#v", expData, data)
+	}
+}
+
 func TestPluginStart(t *testing.T) {
 
 	ctx := context.Background()
@@ -180,12 +535,7 @@ func TestPluginOneShotBundlePersistence(t *testing.T) {
 	ctx := context.Background()
 	manager := getTestManager()
 
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundleName := "test-bundle"
 	bundleSource := Source{
@@ -214,7 +564,6 @@ func TestPluginOneShotBundlePersistence(t *testing.T) {
 
 	// download a bundle and persist to disk. Then verify the bundle persisted to disk
 	module := "package foo\n\ncorge=1"
-
 	b := bundle.Bundle{
 		Manifest: bundle.Manifest{Revision: "quickbrownfaux"},
 		Data:     util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}}`)).(map[string]interface{}),
@@ -226,9 +575,11 @@ func TestPluginOneShotBundlePersistence(t *testing.T) {
 				Raw:    []byte(module),
 			},
 		},
+		Etag: "foo",
 	}
 
 	b.Manifest.Init()
+	expBndl := b.Copy() // We're opting out of roundtripping in storage/inmem, so we copy ourselves.
 
 	var buf bytes.Buffer
 	if err := bundle.NewWriter(&buf).UseModulePath(true).Write(b); err != nil {
@@ -244,8 +595,8 @@ func TestPluginOneShotBundlePersistence(t *testing.T) {
 		t.Fatal("unexpected error:", err)
 	}
 
-	if !result.Equal(b) {
-		t.Fatal("expected the downloaded bundle to be equal to the one loaded from disk")
+	if !result.Equal(expBndl) {
+		t.Fatalf("expected the downloaded bundle to be equal to the one loaded from disk: result=%v, exp=%v", result, expBndl)
 	}
 
 	// simulate a bundle download error and verify that the bundle on disk is activated
@@ -272,7 +623,7 @@ func TestPluginOneShotBundlePersistence(t *testing.T) {
 	}
 
 	data, err := manager.Store.Read(ctx, txn, storage.Path{})
-	expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
+	expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"etag": "foo", "manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
 	if err != nil {
 		t.Fatal(err)
 	} else if !reflect.DeepEqual(data, expData) {
@@ -285,12 +636,7 @@ func TestPluginOneShotSignedBundlePersistence(t *testing.T) {
 	ctx := context.Background()
 	manager := getTestManager()
 
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundleName := "test-bundle"
 	vc := bundle.NewVerificationConfig(map[string]*bundle.KeyConfig{"foo": {Key: "secret", Algorithm: "HS256"}}, "foo", "", nil)
@@ -333,11 +679,13 @@ func TestPluginOneShotSignedBundlePersistence(t *testing.T) {
 
 	var dup bytes.Buffer
 	tee := io.TeeReader(buf, &dup)
-	reader := bundle.NewReader(tee).WithBundleVerificationConfig(vc)
+	reader := bundle.NewReader(tee).WithBundleVerificationConfig(vc).WithBundleEtag("foo")
 	b, err := reader.Read()
 	if err != nil {
 		t.Fatal("unexpected error:", err)
 	}
+	// We've opted out of having storage/inmem roundtrip our data, so we need to copy ourselves.
+	expBndl := b.Copy()
 
 	plugin.oneShot(ctx, bundleName, download.Update{Bundle: &b, Metrics: metrics.New(), Raw: &dup})
 
@@ -349,7 +697,7 @@ func TestPluginOneShotSignedBundlePersistence(t *testing.T) {
 		t.Fatal("unexpected error:", err)
 	}
 
-	if !result.Equal(b) {
+	if !result.Equal(expBndl) {
 		t.Fatal("expected the downloaded bundle to be equal to the one loaded from disk")
 	}
 
@@ -373,7 +721,7 @@ func TestPluginOneShotSignedBundlePersistence(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	expData := util.MustUnmarshalJSON([]byte(`{"example1": {"foo": "bar"}, "example2": {"x": true}, "system": {"bundles": {"test-bundle": {"manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
+	expData := util.MustUnmarshalJSON([]byte(`{"example1": {"foo": "bar"}, "example2": {"x": true}, "system": {"bundles": {"test-bundle": {"etag": "foo", "manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
 	if !reflect.DeepEqual(data, expData) {
 		t.Fatalf("Bad data content. Exp:\n%v\n\nGot:\n\n%v", expData, data)
 	}
@@ -384,12 +732,7 @@ func TestLoadAndActivateBundlesFromDisk(t *testing.T) {
 	ctx := context.Background()
 	manager := getTestManager()
 
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundleName := "test-bundle"
 	bundleSource := Source{
@@ -406,10 +749,7 @@ func TestLoadAndActivateBundlesFromDisk(t *testing.T) {
 	plugin := New(&Config{Bundles: bundles}, manager)
 	plugin.bundlePersistPath = filepath.Join(dir, ".opa")
 
-	err = plugin.loadAndActivateBundlesFromDisk(ctx)
-	if err != nil {
-		t.Fatal("unexpected error:", err)
-	}
+	plugin.loadAndActivateBundlesFromDisk(ctx)
 
 	// persist a bundle to disk and then load it
 	module := "package foo\n\ncorge=1"
@@ -434,15 +774,12 @@ func TestLoadAndActivateBundlesFromDisk(t *testing.T) {
 		t.Fatal("unexpected error:", err)
 	}
 
-	err = plugin.saveBundleToDisk(bundleName, &buf)
+	err := plugin.saveBundleToDisk(bundleName, &buf)
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 
-	err = plugin.loadAndActivateBundlesFromDisk(ctx)
-	if err != nil {
-		t.Fatal("unexpected error:", err)
-	}
+	plugin.loadAndActivateBundlesFromDisk(ctx)
 
 	txn := storage.NewTransactionOrDie(ctx, manager.Store)
 	defer manager.Store.Abort(ctx, txn)
@@ -463,7 +800,7 @@ func TestLoadAndActivateBundlesFromDisk(t *testing.T) {
 	}
 
 	data, err := manager.Store.Read(ctx, txn, storage.Path{})
-	expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
+	expData := util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}, "system": {"bundles": {"test-bundle": {"etag": "", "manifest": {"revision": "quickbrownfaux", "roots": [""]}}}}}`))
 	if err != nil {
 		t.Fatal(err)
 	} else if !reflect.DeepEqual(data, expData) {
@@ -471,6 +808,176 @@ func TestLoadAndActivateBundlesFromDisk(t *testing.T) {
 	}
 }
 
+func TestLoadAndActivateDepBundlesFromDisk(t *testing.T) {
+	ctx := context.Background()
+	manager := getTestManager()
+
+	dir := t.TempDir()
+
+	bundleName := "test-bundle-main"
+	bundleSource := Source{
+		Persist: true,
+	}
+
+	bundleNameOther := "test-bundle-lib"
+	bundleSourceOther := Source{
+		Persist: true,
+	}
+
+	bundles := map[string]*Source{}
+	bundles[bundleName] = &bundleSource
+	bundles[bundleNameOther] = &bundleSourceOther
+
+	plugin := New(&Config{Bundles: bundles}, manager)
+	plugin.bundlePersistPath = filepath.Join(dir, ".opa")
+
+	module1 := `
+package bar
+
+import data.foo
+
+default allow = false
+
+allow {
+	foo.is_one(1)
+}`
+
+	module2 := `
+package foo
+
+is_one(x) {
+	x == 1
+}`
+
+	b1 := bundle.Bundle{
+		Manifest: bundle.Manifest{Revision: "quickbrownfauxbar", Roots: &[]string{"bar"}},
+		Data:     map[string]interface{}{},
+		Modules: []bundle.ModuleFile{
+			{
+				URL:    "/bar/policy.rego",
+				Path:   "/bar/policy.rego",
+				Parsed: ast.MustParseModule(module1),
+				Raw:    []byte(module1),
+			},
+		},
+	}
+
+	b1.Manifest.Init()
+
+	b2 := bundle.Bundle{
+		Manifest: bundle.Manifest{Revision: "quickbrownfauxfoo", Roots: &[]string{"foo"}},
+		Data:     map[string]interface{}{},
+		Modules: []bundle.ModuleFile{
+			{
+				URL:    "/foo/policy.rego",
+				Path:   "/foo/policy.rego",
+				Parsed: ast.MustParseModule(module2),
+				Raw:    []byte(module2),
+			},
+		},
+	}
+
+	b2.Manifest.Init()
+
+	var buf1 bytes.Buffer
+	if err := bundle.NewWriter(&buf1).UseModulePath(true).Write(b1); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err := plugin.saveBundleToDisk(bundleName, &buf1)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	var buf2 bytes.Buffer
+	if err := bundle.NewWriter(&buf2).UseModulePath(true).Write(b2); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err = plugin.saveBundleToDisk(bundleNameOther, &buf2)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	plugin.loadAndActivateBundlesFromDisk(ctx)
+
+	txn := storage.NewTransactionOrDie(ctx, manager.Store)
+	defer manager.Store.Abort(ctx, txn)
+
+	ids, err := manager.Store.ListPolicies(ctx, txn)
+	if err != nil {
+		t.Fatal(err)
+	} else if len(ids) != 2 {
+		t.Fatal("Expected 2 policies")
+	}
+}
+
+func TestLoadAndActivateDepBundlesFromDiskMaxAttempts(t *testing.T) {
+	ctx := context.Background()
+	manager := getTestManager()
+
+	dir := t.TempDir()
+
+	bundleName := "test-bundle-main"
+	bundleSource := Source{
+		Persist: true,
+	}
+
+	bundles := map[string]*Source{}
+	bundles[bundleName] = &bundleSource
+
+	plugin := New(&Config{Bundles: bundles}, manager)
+	plugin.bundlePersistPath = filepath.Join(dir, ".opa")
+
+	module := `
+package bar
+
+import data.foo
+
+default allow = false
+
+allow {
+	foo.is_one(1)
+}`
+
+	b := bundle.Bundle{
+		Manifest: bundle.Manifest{Revision: "quickbrownfaux", Roots: &[]string{"bar"}},
+		Data:     map[string]interface{}{},
+		Modules: []bundle.ModuleFile{
+			{
+				URL:    "/bar/policy.rego",
+				Path:   "/bar/policy.rego",
+				Parsed: ast.MustParseModule(module),
+				Raw:    []byte(module),
+			},
+		},
+	}
+
+	b.Manifest.Init()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).UseModulePath(true).Write(b); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err := plugin.saveBundleToDisk(bundleName, &buf)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	plugin.loadAndActivateBundlesFromDisk(ctx)
+
+	txn := storage.NewTransactionOrDie(ctx, manager.Store)
+	defer manager.Store.Abort(ctx, txn)
+
+	ids, err := manager.Store.ListPolicies(ctx, txn)
+	if err != nil {
+		t.Fatal(err)
+	} else if len(ids) != 0 {
+		t.Fatal("Expected 0 policies")
+	}
+}
+
 func TestPluginOneShotCompileError(t *testing.T) {
 
 	ctx := context.Background()
@@ -539,23 +1046,62 @@ func TestPluginOneShotCompileError(t *testing.T) {
 		},
 	}
 
-	b3.Manifest.Init()
-	plugin.oneShot(ctx, bundleName, download.Update{Bundle: b3})
-
-	ensurePluginState(t, plugin, plugins.StateOK)
-
-	txn = storage.NewTransactionOrDie(ctx, manager.Store)
-
-	_, err = manager.Store.GetPolicy(ctx, txn, filepath.Join(bundleName, "/example.rego"))
-	if err != nil {
-		t.Fatalf("Unexpected error: %v", err)
-	}
-
-	data, err = manager.Store.Read(ctx, txn, storage.Path{"a"})
-	if err != nil || !reflect.DeepEqual("b", data) {
-		t.Fatalf("Expected data to be intact but got: %v, err: %v", data, err)
+	b3.Manifest.Init()
+	plugin.oneShot(ctx, bundleName, download.Update{Bundle: b3})
+
+	ensurePluginState(t, plugin, plugins.StateOK)
+
+	txn = storage.NewTransactionOrDie(ctx, manager.Store)
+
+	_, err = manager.Store.GetPolicy(ctx, txn, filepath.Join(bundleName, "/example.rego"))
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	data, err = manager.Store.Read(ctx, txn, storage.Path{"a"})
+	if err != nil || !reflect.DeepEqual("b", data) {
+		t.Fatalf("Expected data to be intact but got: %v, err: %v", data, err)
+	}
+
+}
+
+func TestPluginOneShotHTTPError(t *testing.T) {
+	ctx := context.Background()
+	manager := getTestManager()
+	plugin := New(&Config{}, manager)
+	bundleName := "test-bundle"
+	plugin.status[bundleName] = &Status{Name: bundleName}
+	plugin.downloaders[bundleName] = download.New(download.Config{}, plugin.manager.Client(""), bundleName)
+	ch := make(chan Status)
+	listenerName := "test"
+	plugin.Register(listenerName, func(status Status) {
+		ch <- status
+	})
+	go plugin.oneShot(ctx, bundleName, download.Update{Error: download.HTTPError{StatusCode: 403}})
+	s := <-ch
+	if s.HTTPCode != "403" {
+		t.Fatal("expected http_code to be 403 instead of ", s.HTTPCode)
+	}
+
+	module := "package foo\n\ncorge=1"
+	b := bundle.Bundle{
+		Manifest: bundle.Manifest{Revision: "quickbrownfaux"},
+		Data:     util.MustUnmarshalJSON([]byte(`{"foo": {"bar": 1, "baz": "qux"}}`)).(map[string]interface{}),
+		Modules: []bundle.ModuleFile{
+			{
+				Path:   "/foo/bar",
+				Parsed: ast.MustParseModule(module),
+				Raw:    []byte(module),
+			},
+		},
+	}
+
+	b.Manifest.Init()
+	go plugin.oneShot(ctx, bundleName, download.Update{Bundle: &b})
+	s = <-ch
+	if s.HTTPCode != "" {
+		t.Fatal("expected http_code to be empty instead of ", s.HTTPCode)
 	}
-
 }
 
 func TestPluginOneShotActivationRemovesOld(t *testing.T) {
@@ -854,7 +1400,7 @@ func validateStatus(t *testing.T, actual Status, expected string, expectStatusEr
 	if expectStatusErr && !isErrStatus(actual) {
 		t.Errorf("Expected status to be in an error state, but no error has occurred.")
 	} else if !expectStatusErr && isErrStatus(actual) {
-		t.Errorf("Unexpected error status %s", actual)
+		t.Errorf("Unexpected error status %v", actual)
 	}
 
 	if actual.ActiveRevision != expected {
@@ -1329,7 +1875,7 @@ func TestPluginSetCompilerOnContext(t *testing.T) {
 
 	if err := storage.Txn(ctx, manager.Store, storage.WriteParams, func(txn storage.Transaction) error {
 		_, err := manager.Store.Register(ctx, txn, storage.TriggerConfig{
-			OnCommit: func(ctx context.Context, txn storage.Transaction, event storage.TriggerEvent) {
+			OnCommit: func(_ context.Context, _ storage.Transaction, event storage.TriggerEvent) {
 				events = append(events, event)
 			},
 		})
@@ -1356,8 +1902,12 @@ func getTestManager() *plugins.Manager {
 	return getTestManagerWithOpts(nil)
 }
 
-func getTestManagerWithOpts(config []byte) *plugins.Manager {
+func getTestManagerWithOpts(config []byte, stores ...storage.Store) *plugins.Manager {
 	store := inmem.New()
+	if len(stores) == 1 {
+		store = stores[0]
+	}
+
 	manager, err := plugins.New(config, "test-instance-id", store)
 	if err != nil {
 		panic(err)
@@ -1848,36 +2398,27 @@ func TestSaveBundleToDiskNew(t *testing.T) {
 
 	manager := getTestManager()
 
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundles := map[string]*Source{}
 	plugin := New(&Config{Bundles: bundles}, manager)
 	plugin.bundlePersistPath = filepath.Join(dir, ".opa")
 
-	err = plugin.saveBundleToDisk("foo", getTestRawBundle(t))
+	err := plugin.saveBundleToDisk("foo", getTestRawBundle(t))
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 }
 
 func TestSaveBundleToDiskNewConfiguredPersistDir(t *testing.T) {
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	manager := getTestManager()
 	manager.Config.PersistenceDirectory = &dir
 	bundles := map[string]*Source{}
 	plugin := New(&Config{Bundles: bundles}, manager)
 
-	err = plugin.Start(context.Background())
+	err := plugin.Start(context.Background())
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
@@ -1899,12 +2440,7 @@ func TestSaveBundleToDiskOverWrite(t *testing.T) {
 	manager := getTestManager()
 
 	// test to check existing bundle is replaced
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundles := map[string]*Source{}
 	plugin := New(&Config{Bundles: bundles}, manager)
@@ -1913,7 +2449,7 @@ func TestSaveBundleToDiskOverWrite(t *testing.T) {
 	bundleName := "foo"
 	bundleDir := filepath.Join(plugin.bundlePersistPath, bundleName)
 
-	err = os.MkdirAll(bundleDir, os.ModePerm)
+	err := os.MkdirAll(bundleDir, os.ModePerm)
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
@@ -1960,23 +2496,18 @@ func TestSaveBundleToDiskOverWrite(t *testing.T) {
 }
 
 func TestSaveCurrentBundleToDisk(t *testing.T) {
-	srcDir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(srcDir)
+	srcDir := t.TempDir()
 
-	err = saveCurrentBundleToDisk(srcDir, "bundle.tar.gz", getTestRawBundle(t))
+	bundlePath, err := saveCurrentBundleToDisk(srcDir, getTestRawBundle(t))
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 
-	if _, err := os.Stat(filepath.Join(srcDir, "bundle.tar.gz")); err != nil {
+	if _, err := os.Stat(bundlePath); err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 
-	err = saveCurrentBundleToDisk(srcDir, "bundle.tar.gz", nil)
+	_, err = saveCurrentBundleToDisk(srcDir, nil)
 	if err == nil {
 		t.Fatal("expected error but got nil")
 	}
@@ -1996,12 +2527,7 @@ func TestLoadBundleFromDisk(t *testing.T) {
 	}
 
 	// create a test bundle and load it from disk
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundleName := "foo"
 	bundleDir := filepath.Join(dir, bundleName)
@@ -2032,12 +2558,7 @@ func TestLoadSignedBundleFromDisk(t *testing.T) {
 	}
 
 	// create a test signed bundle and load it from disk
-	dir, err := ioutil.TempDir("", "")
-	if err != nil {
-		t.Fatalf("unexpected error %v", err)
-	}
-
-	defer os.RemoveAll(dir)
+	dir := t.TempDir()
 
 	bundleName := "foo"
 	bundleDir := filepath.Join(dir, bundleName)
@@ -2153,6 +2674,218 @@ func TestPluginUsingFileLoader(t *testing.T) {
 
 }
 
+func TestPluginUsingDirectoryLoader(t *testing.T) {
+	test.WithTempFS(map[string]string{
+		"test.rego": `package test
+
+		p := 7`,
+	}, func(dir string) {
+
+		mgr := getTestManager()
+		url := "file://" + dir
+
+		p := New(&Config{Bundles: map[string]*Source{
+			"test": {
+				SizeLimitBytes: 1e5,
+				Resource:       url,
+			},
+		}}, mgr)
+
+		ch := make(chan Status)
+
+		p.Register("test", func(s Status) {
+			ch <- s
+		})
+
+		if err := p.Start(context.Background()); err != nil {
+			t.Fatal(err)
+		}
+
+		s := <-ch
+
+		if s.LastSuccessfulActivation.IsZero() {
+			t.Fatal("expected successful activation")
+		}
+	})
+}
+
+func TestPluginReadBundleEtagFromDiskStore(t *testing.T) {
+
+	// setup fake http server with mock bundle
+	mockBundle := bundle.Bundle{
+		Data:    map[string]interface{}{"p": "x1"},
+		Modules: []bundle.ModuleFile{},
+	}
+
+	notModifiedCount := 0
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+		etag := r.Header.Get("If-None-Match")
+		if etag == "foo" {
+			notModifiedCount++
+			w.WriteHeader(304)
+			return
+		}
+
+		w.Header().Add("Etag", "foo")
+		w.WriteHeader(200)
+
+		err := bundle.NewWriter(w).Write(mockBundle)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}))
+
+	test.WithTempFS(nil, func(dir string) {
+		ctx := context.Background()
+
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+			Partitions: []storage.Path{
+				storage.MustParsePath("/foo"),
+			},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// setup plugin pointing at fake server
+		manager := getTestManagerWithOpts([]byte(fmt.Sprintf(`{
+		"services": {
+				"default": {
+					"url": %q
+				}
+			}
+		}`, s.URL)), store)
+
+		var mode plugins.TriggerMode = "manual"
+
+		plugin := New(&Config{
+			Bundles: map[string]*Source{
+				"test": {
+					Service:        "default",
+					SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+					Config:         download.Config{Trigger: &mode},
+				},
+			},
+		}, manager)
+
+		statusCh := make(chan map[string]*Status)
+
+		// register for bundle updates to observe changes and start the plugin
+		plugin.RegisterBulkListener("test-case", func(st map[string]*Status) {
+			statusCh <- st
+		})
+
+		err = plugin.Start(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// manually trigger bundle download
+		go func() {
+			_ = plugin.Loaders()["test"].Trigger(ctx)
+		}()
+
+		// wait for bundle update and then verify that activated bundle etag written to store
+		<-statusCh
+
+		txn := storage.NewTransactionOrDie(ctx, manager.Store)
+
+		actual, err := manager.Store.Read(ctx, txn, storage.MustParsePath("/system/bundles/test/etag"))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if actual != "foo" {
+			t.Fatalf("Expected etag foo but got %v", actual)
+		}
+
+		// Stop the "read" transaction
+		manager.Store.Abort(ctx, txn)
+
+		// Stop the plugin and reinitialize it. Verify that etag is retrieved from store in the bundle request.
+		// The server should respond with a 304 as OPA has the right bundle loaded.
+		plugin.Stop(ctx)
+
+		plugin = New(&Config{
+			Bundles: map[string]*Source{
+				"test": {
+					Service:        "default",
+					SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+					Config:         download.Config{Trigger: &mode},
+				},
+			},
+		}, manager)
+
+		statusCh = make(chan map[string]*Status)
+
+		// register for bundle updates to observe changes and start the plugin
+		plugin.RegisterBulkListener("test-case", func(st map[string]*Status) {
+			statusCh <- st
+		})
+
+		err = plugin.Start(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		val, ok := plugin.etags["test"]
+		if !ok {
+			t.Fatal("Expected etag entry for bundle \"test\"")
+		}
+
+		if val != "foo" {
+			t.Fatalf("Expected etag foo but got %v", val)
+		}
+
+		// manually trigger bundle download
+		go func() {
+			_ = plugin.Loaders()["test"].Trigger(ctx)
+		}()
+
+		<-statusCh
+
+		if notModifiedCount != 1 {
+			t.Fatalf("Expected one bundle response with HTTP status 304 but got %v", notModifiedCount)
+		}
+
+		// reconfigure the plugin
+		cfg := &Config{
+			Bundles: map[string]*Source{
+				"test": {
+					Service:        "default",
+					SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+					Config:         download.Config{Trigger: &mode},
+					Resource:       "/new/path/bundles/bundle.tar.gz",
+				},
+			},
+		}
+
+		plugin.Reconfigure(ctx, cfg)
+
+		// manually trigger bundle download
+		go func() {
+			_ = plugin.Loaders()["test"].Trigger(ctx)
+		}()
+
+		<-statusCh
+
+		if notModifiedCount != 2 {
+			t.Fatalf("Expected two bundle responses with HTTP status 304 but got %v", notModifiedCount)
+		}
+
+		val, ok = plugin.etags["test"]
+		if !ok {
+			t.Fatal("Expected etag entry for bundle \"test\"")
+		}
+
+		if val != "foo" {
+			t.Fatalf("Expected etag foo but got %v", val)
+		}
+	})
+}
+
 func TestPluginManualTrigger(t *testing.T) {
 
 	ctx := context.Background()
@@ -2241,6 +2974,155 @@ func TestPluginManualTrigger(t *testing.T) {
 	}
 }
 
+func TestPluginManualTriggerMultipleDiskStorage(t *testing.T) {
+
+	ctx := context.Background()
+
+	module := "package authz\n\ncorge=1"
+
+	// setup fake http server with mock bundle
+	mockBundle1 := bundle.Bundle{
+		Data: map[string]interface{}{"p": "x1"},
+		Modules: []bundle.ModuleFile{
+			{
+				URL:    "/bar/policy.rego",
+				Path:   "/bar/policy.rego",
+				Parsed: ast.MustParseModule(module),
+				Raw:    []byte(module),
+			},
+		},
+		Manifest: bundle.Manifest{
+			Roots: &[]string{"p", "authz"},
+		},
+	}
+
+	s1 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		err := bundle.NewWriter(w).Write(mockBundle1)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}))
+
+	mockBundle2 := bundle.Bundle{
+		Data:    map[string]interface{}{"q": "x2"},
+		Modules: []bundle.ModuleFile{},
+		Manifest: bundle.Manifest{
+			Roots: &[]string{"q"},
+		},
+	}
+
+	s2 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		err := bundle.NewWriter(w).Write(mockBundle2)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}))
+
+	test.WithTempFS(nil, func(dir string) {
+		store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir: dir,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		config := []byte(fmt.Sprintf(`{
+		"services": {
+			"default": {
+				"url": %q
+			},
+			"acmecorp": {
+				"url": %q
+			}
+		}
+	}`, s1.URL, s2.URL))
+
+		manager := getTestManagerWithOpts(config, store)
+		defer manager.Stop(ctx)
+
+		var mode plugins.TriggerMode = "manual"
+
+		plugin := New(&Config{
+			Bundles: map[string]*Source{
+				"test-1": {
+					Service:        "default",
+					SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+					Config:         download.Config{Trigger: &mode},
+				},
+				"test-2": {
+					Service:        "acmecorp",
+					SizeLimitBytes: int64(bundle.DefaultSizeLimitBytes),
+					Config:         download.Config{Trigger: &mode},
+				},
+			},
+		}, manager)
+
+		statusCh := make(chan map[string]*Status)
+
+		// register for bundle updates to observe changes and start the plugin
+		plugin.RegisterBulkListener("test-case", func(st map[string]*Status) {
+			statusCh <- st
+		})
+
+		err = plugin.Start(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// manually trigger bundle download on all configured bundles
+		go func() {
+			_ = plugin.Trigger(ctx)
+		}()
+
+		// wait for bundle update and then assert on data content
+		<-statusCh
+		<-statusCh
+
+		result, err := storage.ReadOne(ctx, manager.Store, storage.Path{"p"})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if !reflect.DeepEqual(result, mockBundle1.Data["p"]) {
+			t.Fatalf("expected data to be %v but got %v", mockBundle1.Data, result)
+		}
+
+		result, err = storage.ReadOne(ctx, manager.Store, storage.Path{"q"})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if !reflect.DeepEqual(result, mockBundle2.Data["q"]) {
+			t.Fatalf("expected data to be %v but got %v", mockBundle2.Data, result)
+		}
+
+		txn := storage.NewTransactionOrDie(ctx, manager.Store)
+		defer manager.Store.Abort(ctx, txn)
+
+		ids, err := manager.Store.ListPolicies(ctx, txn)
+		if err != nil {
+			t.Fatal(err)
+		} else if len(ids) != 1 {
+			t.Fatal("Expected 1 policy")
+		}
+
+		bs, err := manager.Store.GetPolicy(ctx, txn, ids[0])
+		exp := []byte("package authz\n\ncorge=1")
+		if err != nil {
+			t.Fatal(err)
+		} else if !bytes.Equal(bs, exp) {
+			t.Fatalf("Bad policy content. Exp:\n%v\n\nGot:\n\n%v", string(exp), string(bs))
+		}
+
+		data, err := manager.Store.Read(ctx, txn, storage.Path{})
+		expData := util.MustUnmarshalJSON([]byte(`{"p": "x1", "q": "x2", "system": {"bundles": {"test-1": {"etag": "", "manifest": {"revision": "", "roots": ["p", "authz"]}}, "test-2": {"etag": "", "manifest": {"revision": "", "roots": ["q"]}}}}}`))
+		if err != nil {
+			t.Fatal(err)
+		} else if !reflect.DeepEqual(data, expData) {
+			t.Fatalf("Bad data content. Exp:\n%v\n\nGot:\n\n%v", expData, data)
+		}
+	})
+}
+
 func TestPluginManualTriggerMultiple(t *testing.T) {
 
 	ctx := context.Background()
@@ -2421,7 +3303,7 @@ func writeTestBundleToDisk(t *testing.T, srcDir string, signed bool) bundle.Bund
 		t.Fatalf("unexpected error %v", err)
 	}
 
-	if err := ioutil.WriteFile(filepath.Join(srcDir, "bundle.tar.gz"), buf.Bytes(), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(srcDir, "bundle.tar.gz"), buf.Bytes(), 0644); err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 
diff --git a/plugins/bundle/status.go b/plugins/bundle/status.go
index da5cd72bab..b65718ccef 100644
--- a/plugins/bundle/status.go
+++ b/plugins/bundle/status.go
@@ -5,11 +5,13 @@
 package bundle
 
 import (
+	"encoding/json"
+	"errors"
+	"strconv"
 	"time"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/download"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/server/types"
 )
@@ -23,6 +25,8 @@ type Status struct {
 	Name                     string          `json:"name"`
 	ActiveRevision           string          `json:"active_revision,omitempty"`
 	LastSuccessfulActivation time.Time       `json:"last_successful_activation,omitempty"`
+	Type                     string          `json:"type,omitempty"`
+	Size                     int             `json:"size,omitempty"`
 	LastSuccessfulDownload   time.Time       `json:"last_successful_download,omitempty"`
 	LastSuccessfulRequest    time.Time       `json:"last_successful_request,omitempty"`
 	LastRequest              time.Time       `json:"last_request,omitempty"`
@@ -30,6 +34,7 @@ type Status struct {
 	Message                  string          `json:"message,omitempty"`
 	Errors                   []error         `json:"errors,omitempty"`
 	Metrics                  metrics.Metrics `json:"metrics,omitempty"`
+	HTTPCode                 json.Number     `json:"http_code,omitempty"`
 }
 
 // SetActivateSuccess updates the status object to reflect a successful
@@ -50,28 +55,42 @@ func (s *Status) SetRequest() {
 	s.LastRequest = time.Now().UTC()
 }
 
+func (s *Status) SetBundleSize(size int) {
+	s.Size = size
+}
+
 // SetError updates the status object to reflect a failure to download or
 // activate. If err is nil, the error status is cleared.
 func (s *Status) SetError(err error) {
-
-	if err == nil {
+	var (
+		astErrors ast.Errors
+		httpError download.HTTPError
+	)
+	switch {
+	case err == nil:
 		s.Code = ""
+		s.HTTPCode = ""
 		s.Message = ""
 		s.Errors = nil
-		return
-	}
-
-	cause := errors.Cause(err)
 
-	if astErr, ok := cause.(ast.Errors); ok {
+	case errors.As(err, &astErrors):
 		s.Code = errCode
+		s.HTTPCode = ""
 		s.Message = types.MsgCompileModuleError
-		s.Errors = make([]error, len(astErr))
-		for i := range astErr {
-			s.Errors[i] = astErr[i]
+		s.Errors = make([]error, len(astErrors))
+		for i := range astErrors {
+			s.Errors[i] = astErrors[i]
 		}
-	} else {
+
+	case errors.As(err, &httpError):
+		s.Code = errCode
+		s.HTTPCode = json.Number(strconv.Itoa(httpError.StatusCode))
+		s.Message = err.Error()
+		s.Errors = nil
+
+	default:
 		s.Code = errCode
+		s.HTTPCode = ""
 		s.Message = err.Error()
 		s.Errors = nil
 	}
diff --git a/plugins/discovery/config.go b/plugins/discovery/config.go
index f6de8035bc..a157f7abb1 100644
--- a/plugins/discovery/config.go
+++ b/plugins/discovery/config.go
@@ -20,12 +20,13 @@ import (
 // Config represents the configuration for the discovery feature.
 type Config struct {
 	download.Config                            // bundle downloader configuration
-	Name            *string                    `json:"name"`               // name of the discovery bundle
+	Name            *string                    `json:"name"`               // Deprecated: name of the discovery bundle, use `Resource` instead.
 	Prefix          *string                    `json:"prefix,omitempty"`   // Deprecated: use `Resource` instead.
 	Decision        *string                    `json:"decision"`           // the name of the query to run on the bundle to get the config
 	Service         string                     `json:"service"`            // the name of the service used to download discovery bundle from
 	Resource        *string                    `json:"resource,omitempty"` // the resource path which will be downloaded from the service
 	Signing         *bundle.VerificationConfig `json:"signing,omitempty"`  // configuration used to verify a signed bundle
+	Persist         bool                       `json:"persist"`            // control whether to persist activated discovery bundle to disk
 
 	service string
 	path    string
@@ -97,7 +98,7 @@ func (c *Config) validateAndInjectDefaults(services []string, confKeys map[strin
 	if c.Signing != nil {
 		err := c.Signing.ValidateAndInjectDefaults(copy)
 		if err != nil {
-			return fmt.Errorf("invalid configuration for discovery service %q: %s", *c.Name, err.Error())
+			return fmt.Errorf("invalid configuration for discovery service: %s", err.Error())
 		}
 	} else {
 		if len(confKeys) > 0 {
diff --git a/plugins/discovery/config_test.go b/plugins/discovery/config_test.go
index adad748c46..ae236270c3 100644
--- a/plugins/discovery/config_test.go
+++ b/plugins/discovery/config_test.go
@@ -69,10 +69,10 @@ func TestConfigValidation(t *testing.T) {
 		t.Run(fmt.Sprintf("TestConfigValidation_case_%d", i), func(t *testing.T) {
 			_, err := NewConfigBuilder().WithBytes([]byte(test.input)).WithServices(test.services).WithKeyConfigs(keys).Parse()
 			if err != nil && !test.wantErr {
-				t.Fail()
+				t.Fatalf("unexpected error while parsing config: %s", err.Error())
 			}
 			if err == nil && test.wantErr {
-				t.Fail()
+				t.Fatal("expected error while parsing config, but got none")
 			}
 		})
 	}
@@ -137,7 +137,7 @@ func TestConfigService(t *testing.T) {
 		t.Run(fmt.Sprintf("TestConfigService_case_%d", i), func(t *testing.T) {
 			c, err := NewConfigBuilder().WithBytes([]byte(test.input)).WithServices(test.services).Parse()
 			if err != nil {
-				t.Fatal("unexpected error while parsing config")
+				t.Fatalf("unexpected error while parsing config: %s", err)
 			}
 
 			if c.service != test.service {
@@ -174,7 +174,7 @@ func TestConfigPath(t *testing.T) {
 		t.Run(fmt.Sprintf("TestConfigDecision_case_%d", i), func(t *testing.T) {
 			c, err := NewConfigBuilder().WithBytes([]byte(test.input)).WithServices([]string{"service1"}).Parse()
 			if err != nil {
-				t.Fatal("unexpected error while parsing config")
+				t.Fatalf("unexpected error while parsing config: %s", err.Error())
 			}
 
 			if c.path != test.path {
diff --git a/plugins/discovery/discovery.go b/plugins/discovery/discovery.go
index fc7dae3a03..8b44a171f1 100644
--- a/plugins/discovery/discovery.go
+++ b/plugins/discovery/discovery.go
@@ -9,6 +9,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
 
@@ -16,6 +19,7 @@ import (
 	bundleApi "github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/config"
 	"github.com/open-policy-agent/opa/download"
+	bundleUtils "github.com/open-policy-agent/opa/internal/bundle"
 	cfg "github.com/open-policy-agent/opa/internal/config"
 	"github.com/open-policy-agent/opa/keys"
 	"github.com/open-policy-agent/opa/logging"
@@ -28,24 +32,33 @@ import (
 	"github.com/open-policy-agent/opa/storage/inmem"
 )
 
-// Name is the discovery plugin name that will be registered with the plugin manager.
-const Name = "discovery"
+const (
+	// Name is the discovery plugin name that will be registered with the plugin manager.
+	Name = "discovery"
+
+	// maxActivationRetry represents the maximum number of attempts
+	// to activate a persisted discovery bundle. The value chosen for
+	// maxActivationRetry ensures that too much time is not spent to activate
+	// a bundle that will never successfully activate.
+	maxActivationRetry = 10
+)
 
 // Discovery implements configuration discovery for OPA. When discovery is
 // started it will periodically download a configuration bundle and try to
 // reconfigure the OPA.
 type Discovery struct {
-	manager      *plugins.Manager
-	config       *Config
-	factories    map[string]plugins.Factory
-	downloader   *download.Downloader                // discovery bundle downloader
-	status       *bundle.Status                      // discovery status
-	listenersMtx sync.Mutex                          // lock for listener map
-	listeners    map[interface{}]func(bundle.Status) // listeners for discovery update events
-	etag         string                              // discovery bundle etag for caching purposes
-	metrics      metrics.Metrics
-	readyOnce    sync.Once
-	logger       logging.Logger
+	manager           *plugins.Manager
+	config            *Config
+	factories         map[string]plugins.Factory
+	downloader        bundle.Loader                       // discovery bundle downloader
+	status            *bundle.Status                      // discovery status
+	listenersMtx      sync.Mutex                          // lock for listener map
+	listeners         map[interface{}]func(bundle.Status) // listeners for discovery update events
+	etag              string                              // discovery bundle etag for caching purposes
+	metrics           metrics.Metrics
+	readyOnce         sync.Once
+	logger            logging.Logger
+	bundlePersistPath string
 }
 
 // Factories provides a set of factory functions to use for
@@ -90,8 +103,18 @@ func New(manager *plugins.Manager, opts ...func(*Discovery)) (*Discovery, error)
 	}
 
 	result.config = config
-	result.downloader = download.New(config.Config, manager.Client(config.service), config.path).WithCallback(result.oneShot).
-		WithBundleVerificationConfig(config.Signing)
+	restClient := manager.Client(config.service)
+	if strings.ToLower(restClient.Config().Type) == "oci" {
+		ociStorePath := filepath.Join(os.TempDir(), "opa", "oci") // use temporary folder /tmp/opa/oci
+		if manager.Config.PersistenceDirectory != nil {
+			ociStorePath = filepath.Join(*manager.Config.PersistenceDirectory, "oci")
+		}
+		result.downloader = download.NewOCI(config.Config, restClient, config.path, ociStorePath).WithCallback(result.oneShot).
+			WithBundleVerificationConfig(config.Signing)
+	} else {
+		result.downloader = download.New(config.Config, restClient, config.path).WithCallback(result.oneShot).
+			WithBundleVerificationConfig(config.Signing)
+	}
 	result.status = &bundle.Status{
 		Name: Name,
 	}
@@ -104,6 +127,15 @@ func New(manager *plugins.Manager, opts ...func(*Discovery)) (*Discovery, error)
 
 // Start starts the dynamic discovery process if configured.
 func (c *Discovery) Start(ctx context.Context) error {
+
+	bundlePersistPath, err := c.getBundlePersistPath()
+	if err != nil {
+		return err
+	}
+	c.bundlePersistPath = bundlePersistPath
+
+	c.loadAndActivateBundleFromDisk(ctx)
+
 	if c.downloader != nil {
 		c.downloader.Start(ctx)
 	} else {
@@ -142,6 +174,9 @@ func (c *Discovery) TriggerMode() *plugins.TriggerMode {
 }
 
 func (c *Discovery) Trigger(ctx context.Context) error {
+	if c.downloader == nil {
+		return nil
+	}
 	return c.downloader.Trigger(ctx)
 }
 
@@ -156,6 +191,94 @@ func (c *Discovery) RegisterListener(name interface{}, f func(bundle.Status)) {
 	c.listeners[name] = f
 }
 
+func (c *Discovery) getBundlePersistPath() (string, error) {
+	persistDir, err := c.manager.Config.GetPersistenceDirectory()
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Join(persistDir, "bundles"), nil
+}
+
+func (c *Discovery) loadAndActivateBundleFromDisk(ctx context.Context) {
+
+	if c.config != nil && c.config.Persist {
+		b, err := c.loadBundleFromDisk()
+		if err != nil {
+			c.logger.Error("Failed to load discovery bundle from disk: %v", err)
+			c.status.SetError(err)
+			return
+		}
+
+		if b == nil {
+			return
+		}
+
+		for retry := 0; retry < maxActivationRetry; retry++ {
+
+			ps, err := c.processBundle(ctx, b)
+			if err != nil {
+				c.logger.Error("Discovery bundle processing error occurred: %v", err)
+				c.status.SetError(err)
+				continue
+			}
+
+			for _, p := range ps.Start {
+				if err := p.Start(ctx); err != nil {
+					c.logger.Error("Failed to start configured plugins: %v", err)
+					c.status.SetError(err)
+					return
+				}
+			}
+
+			for _, p := range ps.Reconfig {
+				p.Plugin.Reconfigure(ctx, p.Config)
+			}
+
+			c.status.SetError(nil)
+			c.status.SetActivateSuccess(b.Manifest.Revision)
+
+			// On the first activation success mark the plugin as being in OK state
+			c.readyOnce.Do(func() {
+				c.manager.UpdatePluginStatus(Name, &plugins.Status{State: plugins.StateOK})
+			})
+
+			c.logger.Debug("Discovery bundle loaded from disk and activated successfully.")
+		}
+	}
+}
+
+func (c *Discovery) loadBundleFromDisk() (*bundleApi.Bundle, error) {
+	return bundleUtils.LoadBundleFromDisk(c.bundlePersistPath, c.discoveryBundleDirName(), c.config.Signing)
+}
+
+func (c *Discovery) saveBundleToDisk(raw io.Reader) error {
+
+	bundleDir := filepath.Join(c.bundlePersistPath, c.discoveryBundleDirName())
+	bundleFile := filepath.Join(bundleDir, "bundle.tar.gz")
+
+	tmpFile, saveErr := saveCurrentBundleToDisk(bundleDir, raw)
+	if saveErr != nil {
+		c.logger.Error("Failed to save new discovery bundle to disk: %v", saveErr)
+
+		if err := os.Remove(tmpFile); err != nil {
+			c.logger.Warn("Failed to remove temp file ('%s'): %v", tmpFile, err)
+		}
+
+		if _, err := os.Stat(bundleFile); err == nil {
+			c.logger.Warn("Older version of activated discovery bundle persisted, ignoring error")
+			return nil
+		}
+		return saveErr
+	}
+
+	return os.Rename(tmpFile, bundleFile)
+}
+
+func saveCurrentBundleToDisk(path string, raw io.Reader) (string, error) {
+	return bundleUtils.SaveBundleToDisk(path, raw)
+}
+
 func (c *Discovery) oneShot(ctx context.Context, u download.Update) {
 
 	c.processUpdate(ctx, u)
@@ -185,7 +308,9 @@ func (c *Discovery) processUpdate(ctx context.Context, u download.Update) {
 	c.status.LastSuccessfulRequest = c.status.LastRequest
 
 	if u.Bundle != nil {
+		c.status.Type = u.Bundle.Type()
 		c.status.LastSuccessfulDownload = c.status.LastSuccessfulRequest
+		c.status.SetBundleSize(u.Size)
 
 		if err := c.reconfigure(ctx, u); err != nil {
 			c.logger.Error("Discovery reconfiguration error occurred: %v", err)
@@ -194,6 +319,19 @@ func (c *Discovery) processUpdate(ctx context.Context, u download.Update) {
 			return
 		}
 
+		if c.config != nil && c.config.Persist {
+			c.logger.Debug("Persisting discovery bundle to disk in progress.")
+
+			err := c.saveBundleToDisk(u.Raw)
+			if err != nil {
+				c.logger.Error("Persisting discovery bundle to disk failed: %v", err)
+				c.status.SetError(err)
+				c.downloader.SetCache("")
+				return
+			}
+			c.logger.Debug("Discovery bundle persisted to disk successfully at path %v.", filepath.Join(c.bundlePersistPath, c.discoveryBundleDirName()))
+		}
+
 		c.status.SetError(nil)
 		c.status.SetActivateSuccess(u.Bundle.Manifest.Revision)
 
@@ -254,7 +392,7 @@ func (c *Discovery) processBundle(ctx context.Context, b *bundleApi.Bundle) (*pl
 		Raw:        config.Services,
 		AuthPlugin: c.manager.AuthPlugin,
 		Keys:       c.manager.PublicKeys(),
-		Logger:     c.logger.WithFields(c.manager.Client(c.config.service).Logger().GetFields()),
+		Logger:     c.logger.WithFields(c.manager.Client(c.config.service).LoggerFields()),
 	}
 	services, err := cfg.ParseServicesConfig(opts)
 	if err != nil {
@@ -274,10 +412,12 @@ func (c *Discovery) processBundle(ctx context.Context, b *bundleApi.Bundle) (*pl
 		return nil, err
 	}
 
-	for key, kc := range keys {
-		if curr, ok := c.config.Signing.PublicKeys[key]; ok {
-			if !curr.Equal(kc) {
-				return nil, fmt.Errorf("updates to keys specified in the boot configuration are not allowed")
+	if c.config.Signing != nil {
+		for key, kc := range keys {
+			if curr, ok := c.config.Signing.PublicKeys[key]; ok {
+				if !curr.Equal(kc) {
+					return nil, fmt.Errorf("updates to keys specified in the boot configuration are not allowed")
+				}
 			}
 		}
 	}
@@ -289,6 +429,15 @@ func (c *Discovery) processBundle(ctx context.Context, b *bundleApi.Bundle) (*pl
 	return getPluginSet(c.factories, c.manager, config, c.metrics, c.config.Trigger)
 }
 
+// discoveryBundleDirName returns the name of the directory where the discovery bundle will be persisted.
+// It wraps the deprecated config.Name and uses Name as a default.
+func (c *Discovery) discoveryBundleDirName() string {
+	if c.config.Name != nil {
+		return *c.config.Name
+	}
+	return Name
+}
+
 func evaluateBundle(ctx context.Context, id string, info *ast.Term, b *bundleApi.Bundle, query string) (*config.Config, error) {
 
 	modules := b.ParsedModules("discovery")
@@ -299,7 +448,7 @@ func evaluateBundle(ctx context.Context, id string, info *ast.Term, b *bundleApi
 		return nil, compiler.Errors
 	}
 
-	store := inmem.NewFromObject(b.Data)
+	store := inmem.NewFromObjectWithOpts(b.Data, inmem.OptRoundTripOnWrite(false))
 
 	rego := rego.New(
 		rego.Query(query),
diff --git a/plugins/discovery/discovery_test.go b/plugins/discovery/discovery_test.go
index 0729b17a59..8538a9517f 100644
--- a/plugins/discovery/discovery_test.go
+++ b/plugins/discovery/discovery_test.go
@@ -6,6 +6,7 @@
 package discovery
 
 import (
+	"bytes"
 	"compress/gzip"
 	"context"
 	"encoding/json"
@@ -13,32 +14,35 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"reflect"
 	"sync"
 	"testing"
 	"time"
 
-	"github.com/open-policy-agent/opa/storage"
-
-	"github.com/open-policy-agent/opa/rego"
-
-	"github.com/open-policy-agent/opa/logging/test"
-
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/bundle"
 	bundleApi "github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/download"
+	"github.com/open-policy-agent/opa/logging/test"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
-	"github.com/open-policy-agent/opa/plugins/bundle"
+	bundlePlugin "github.com/open-policy-agent/opa/plugins/bundle"
 	"github.com/open-policy-agent/opa/plugins/logs"
 	"github.com/open-policy-agent/opa/plugins/status"
+	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/server"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/storage"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/version"
 )
 
+const (
+	snapshotBundleSize = 1024
+)
+
 func TestMain(m *testing.M) {
 	if version.Version == "" {
 		version.Version = "unit-test"
@@ -90,13 +94,13 @@ func TestEvaluateBundle(t *testing.T) {
 		t.Fatal("Expected a bundle configuration")
 	}
 
-	var parsedConfig bundle.Config
+	var parsedConfig bundlePlugin.Config
 
 	if err := util.Unmarshal(config.Bundle, &parsedConfig); err != nil {
 		t.Fatal("Unexpected error:", err)
 	}
 
-	expectedBundleConfig := bundle.Config{
+	expectedBundleConfig := bundlePlugin.Config{
 		Name:    "test/bundle1",
 		Service: "example",
 	}
@@ -376,6 +380,555 @@ func (r *reconfigureTestPlugin) Reconfigure(_ context.Context, config interface{
 	r.counts["reconfig"]++
 }
 
+func TestStartWithBundlePersistence(t *testing.T) {
+	dir := t.TempDir()
+
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	bundleDir := filepath.Join(dir, "bundles", "config")
+
+	err := os.MkdirAll(bundleDir, os.ModePerm)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	if err := os.WriteFile(filepath.Join(bundleDir, "bundle.tar.gz"), buf.Bytes(), 0644); err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	manager.Config.PersistenceDirectory = &dir
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = disco.Start(context.Background())
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	ensurePluginState(t, disco, plugins.StateOK)
+
+	// verify the test plugin was registered on the manager
+	if plugin := manager.Plugin("test_plugin"); plugin == nil {
+		t.Fatalf("expected \"test_plugin\" to be regsitered with the plugin manager")
+	}
+
+	// verify the test plugin was started
+	count, ok := testPlugin.counts["start"]
+	if !ok {
+		t.Fatal("expected test plugin to have start counter")
+	}
+
+	if count != 1 {
+		t.Fatalf("expected test plugin to have a start count of 1 but got %v", count)
+	}
+}
+
+func TestOneShotWithBundlePersistence(t *testing.T) {
+	dir := t.TempDir()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+
+	disco.bundlePersistPath = filepath.Join(dir, ".opa")
+
+	ensurePluginState(t, disco, plugins.StateNotReady)
+
+	// simulate a bundle download error with no bundle on disk
+	disco.oneShot(ctx, download.Update{Error: fmt.Errorf("unknown error")})
+
+	if disco.status.Message == "" {
+		t.Fatal("expected error but got none")
+	}
+
+	ensurePluginState(t, disco, plugins.StateNotReady)
+
+	// download a bundle and persist to disk. Then verify the bundle persisted to disk
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+	expBndl := initialBundle.Copy()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	disco.oneShot(ctx, download.Update{Bundle: initialBundle, ETag: "etag-1", Raw: &buf})
+
+	ensurePluginState(t, disco, plugins.StateOK)
+
+	result, err := disco.loadBundleFromDisk()
+	if err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	if !result.Equal(expBndl) {
+		t.Fatalf("expected the downloaded bundle to be equal to the one loaded from disk: result=%v, exp=%v", result, expBndl)
+	}
+
+	// verify the test plugin was registered on the manager
+	if plugin := manager.Plugin("test_plugin"); plugin == nil {
+		t.Fatalf("expected \"test_plugin\" to be regsitered with the plugin manager")
+	}
+
+	// verify the test plugin was started
+	count, ok := testPlugin.counts["start"]
+	if !ok {
+		t.Fatal("expected test plugin to have start counter")
+	}
+
+	if count != 1 {
+		t.Fatalf("expected test plugin to have a start count of 1 but got %v", count)
+	}
+}
+
+func TestLoadAndActivateBundleFromDisk(t *testing.T) {
+	dir := t.TempDir()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+
+	disco.bundlePersistPath = filepath.Join(dir, ".opa")
+
+	ensurePluginState(t, disco, plugins.StateNotReady)
+
+	// persist a bundle to disk and then load it
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				},
+				"services": {
+					"acmecorp": {
+						"url": "http://localhost:8181"
+					}
+				},
+				"bundles": {
+					"authz": {
+						"service": "acmecorp"
+					}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err = disco.saveBundleToDisk(&buf)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	disco.loadAndActivateBundleFromDisk(ctx)
+
+	ensurePluginState(t, disco, plugins.StateOK)
+
+	// verify the test plugin was registered on the manager
+	if plugin := manager.Plugin("test_plugin"); plugin == nil {
+		t.Fatalf("expected \"test_plugin\" to be regsitered with the plugin manager")
+	}
+
+	// verify the test plugin was started
+	count, ok := testPlugin.counts["start"]
+	if !ok {
+		t.Fatal("expected test plugin to have start counter")
+	}
+
+	if count != 1 {
+		t.Fatalf("expected test plugin to have a start count of 1 but got %v", count)
+	}
+
+	// verify the bundle plugin was registered on the manager
+	if plugin := bundlePlugin.Lookup(disco.manager); plugin == nil {
+		t.Fatalf("expected bundle plugin to be regsitered with the plugin manager")
+	}
+}
+
+func TestLoadAndActivateSignedBundleFromDisk(t *testing.T) {
+	dir := t.TempDir()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+
+	disco.bundlePersistPath = filepath.Join(dir, ".opa")
+	disco.config.Signing = bundle.NewVerificationConfig(map[string]*bundle.KeyConfig{"foo": {Key: "secret", Algorithm: "HS256"}}, "foo", "", nil)
+
+	ensurePluginState(t, disco, plugins.StateNotReady)
+
+	// persist a bundle to disk and then load it
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				},
+				"services": {
+					"acmecorp": {
+						"url": "http://localhost:8181"
+					}
+				},
+				"bundles": {
+					"authz": {
+						"service": "acmecorp"
+					}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+
+	if err := initialBundle.GenerateSignature(bundle.NewSigningConfig("secret", "HS256", ""), "foo", false); err != nil {
+		t.Fatal("Unexpected error:", err)
+	}
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err = disco.saveBundleToDisk(&buf)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	disco.loadAndActivateBundleFromDisk(ctx)
+
+	ensurePluginState(t, disco, plugins.StateOK)
+
+	// verify the test plugin was registered on the manager
+	if plugin := manager.Plugin("test_plugin"); plugin == nil {
+		t.Fatalf("expected \"test_plugin\" to be regsitered with the plugin manager")
+	}
+
+	// verify the test plugin was started
+	count, ok := testPlugin.counts["start"]
+	if !ok {
+		t.Fatal("expected test plugin to have start counter")
+	}
+
+	if count != 1 {
+		t.Fatalf("expected test plugin to have a start count of 1 but got %v", count)
+	}
+
+	// verify the bundle plugin was registered on the manager
+	if plugin := bundlePlugin.Lookup(disco.manager); plugin == nil {
+		t.Fatalf("expected bundle plugin to be regsitered with the plugin manager")
+	}
+}
+
+func TestLoadAndActivateBundleFromDiskMaxAttempts(t *testing.T) {
+	dir := t.TempDir()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+
+	disco.bundlePersistPath = filepath.Join(dir, ".opa")
+
+	ensurePluginState(t, disco, plugins.StateNotReady)
+
+	// persist a bundle to disk and then load it
+	// this bundle should never activate as the service discovery depends on is modified
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				},
+				"services": {
+					"localhost": {
+						"url": "http://localhost:8181"
+					}
+				},
+				"bundles": {
+					"authz": {
+						"service": "localhost"
+					}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err = disco.saveBundleToDisk(&buf)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	disco.loadAndActivateBundleFromDisk(ctx)
+
+	ensurePluginState(t, disco, plugins.StateNotReady)
+
+	if len(manager.Plugins()) != 0 {
+		t.Fatal("expected no plugins to be registered with the plugin manager")
+	}
+}
+
+func TestSaveBundleToDiskNew(t *testing.T) {
+	dir := t.TempDir()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	disco.bundlePersistPath = filepath.Join(dir, ".opa")
+
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err = disco.saveBundleToDisk(&buf)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+}
+
+func TestSaveBundleToDiskNewConfiguredPersistDir(t *testing.T) {
+	dir := t.TempDir()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config", "persist": true},
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// configure persistence dir instead of using the default. Discover plugin should pick this up
+	manager.Config.PersistenceDirectory = &dir
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = disco.Start(context.Background())
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"labels": {"x": "label value changed"},
+				"default_decision": "bar/baz",
+				"default_authorization_decision": "baz/qux",
+				"plugins": {
+					"test_plugin": {"a": "b"}
+				}
+			}
+		}
+	`)
+
+	initialBundle.Manifest.Init()
+
+	var buf bytes.Buffer
+	if err := bundle.NewWriter(&buf).Write(*initialBundle); err != nil {
+		t.Fatal("unexpected error:", err)
+	}
+
+	err = disco.saveBundleToDisk(&buf)
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	expectBundlePath := filepath.Join(dir, "bundles", "config", "bundle.tar.gz")
+	_, err = os.Stat(expectBundlePath)
+	if err != nil {
+		t.Errorf("expected bundle persisted at path %v, %v", expectBundlePath, err)
+	}
+}
+
 func TestReconfigure(t *testing.T) {
 
 	manager, err := plugins.New([]byte(`{
@@ -404,7 +957,7 @@ func TestReconfigure(t *testing.T) {
 	initialBundle := makeDataBundle(1, `
 		{
 			"config": {
-				"labels": {"x": "label value changed"},
+				"labels": {"x": "label value changed", "y": "new label"},
 				"default_decision": "bar/baz",
 				"default_authorization_decision": "baz/qux",
 				"plugins": {
@@ -414,10 +967,18 @@ func TestReconfigure(t *testing.T) {
 		}
 	`)
 
-	disco.oneShot(ctx, download.Update{Bundle: initialBundle})
+	disco.oneShot(ctx, download.Update{Bundle: initialBundle, Size: snapshotBundleSize})
 
-	// Verify labels are unchanged
-	exp := map[string]string{"x": "y", "id": "test-id", "version": version.Version}
+	if disco.status == nil {
+		t.Fatal("Expected to find status, found nil")
+	} else if disco.status.Type != bundle.SnapshotBundleType {
+		t.Fatalf("expected snapshot bundle but got %v", disco.status.Type)
+	} else if disco.status.Size != snapshotBundleSize {
+		t.Fatalf("expected snapshot bundle size %d but got %d", snapshotBundleSize, disco.status.Size)
+	}
+
+	// Verify labels are unchanged but allow additions
+	exp := map[string]string{"x": "y", "y": "new label", "id": "test-id", "version": version.Version}
 	if !reflect.DeepEqual(manager.Labels(), exp) {
 		t.Errorf("Expected labels to be unchanged (%v) but got %v", exp, manager.Labels())
 	}
@@ -441,7 +1002,7 @@ func TestReconfigure(t *testing.T) {
 	updatedBundle := makeDataBundle(2, `
 		{
 			"config": {
-				"labels": {"x": "label value changed"},
+				"labels": {"x": "label value changed", "z": "another added label" },
 				"default_decision": "bar/baz",
 				"default_authorization_decision": "baz/qux",
 				"plugins": {
@@ -453,10 +1014,21 @@ func TestReconfigure(t *testing.T) {
 
 	disco.oneShot(ctx, download.Update{Bundle: updatedBundle})
 
+	// Verify label additions are always on top of bootstrap config with multiple discovery documents
+	exp = map[string]string{"x": "y", "z": "another added label", "id": "test-id", "version": version.Version}
+	if !reflect.DeepEqual(manager.Labels(), exp) {
+		t.Errorf("Expected labels to be unchanged (%v) but got %v", exp, manager.Labels())
+	}
+
+	if disco.status == nil {
+		t.Fatal("Expected to find status, found nil")
+	} else if disco.status.Type != bundle.SnapshotBundleType {
+		t.Fatalf("expected snapshot bundle but got %v", disco.status.Type)
+	}
+
 	if !reflect.DeepEqual(testPlugin.counts, map[string]int{"start": 1, "reconfig": 1}) {
 		t.Errorf("Expected one plugin start and one reconfig but got %v", testPlugin)
 	}
-
 }
 
 func TestReconfigureWithUpdates(t *testing.T) {
@@ -619,7 +1191,7 @@ func TestReconfigureWithUpdates(t *testing.T) {
 		t.Fatalf("Expected two services but got %v\n", len(disco.manager.Services()))
 	}
 
-	bPlugin := bundle.Lookup(disco.manager)
+	bPlugin := bundlePlugin.Lookup(disco.manager)
 	config := bPlugin.Config()
 	expected := "acmecorp"
 	if config.Bundles["authz"].Service != expected {
@@ -648,7 +1220,7 @@ func TestReconfigureWithUpdates(t *testing.T) {
 		t.Fatalf("Unexpected error %v", err)
 	}
 
-	bPlugin = bundle.Lookup(disco.manager)
+	bPlugin = bundlePlugin.Lookup(disco.manager)
 	config = bPlugin.Config()
 	expectedSvc := "localhost"
 	if config.Bundles["authz"].Service != expectedSvc {
@@ -814,7 +1386,42 @@ func TestProcessBundleWithSigning(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Unexpected error %v", err)
 	}
+}
+
+func TestProcessBundleWithNoSigningConfig(t *testing.T) {
+	ctx := context.Background()
+
+	manager, err := plugins.New([]byte(`{
+		"labels": {"x": "y"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+		"discovery": {"name": "config"}
+	}`), "test-id", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	disco, err := New(manager)
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	initialBundle := makeDataBundle(1, `
+		{
+			"config": {
+				"bundles": {"test1": {"service": "localhost"}},
+				"keys": {"my_local_key": {"algorithm": "HS256", "key": "new_secret"}}
+			}
+		}
+	`)
+
+	_, err = disco.processBundle(ctx, initialBundle)
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
 }
 
 type testServer struct {
@@ -1109,7 +1716,7 @@ func TestStatusMetricsForLogDrops(t *testing.T) {
 	}
 
 	builtInMet := e.Fields["metrics"].(map[string]interface{})["<built-in>"]
-	dropCount := builtInMet.(map[string]interface{})["counter_decision_logs_dropped"]
+	dropCount := builtInMet.(map[string]interface{})["counter_decision_logs_dropped_rate_limit_exceeded"]
 
 	actual, err := dropCount.(json.Number).Int64()
 	if err != nil {
@@ -1163,11 +1770,11 @@ bundle:
 		t.Fatalf("Unexpected error: %s", err)
 	}
 
-	p := manager.Plugin(bundle.Name)
+	p := manager.Plugin(bundlePlugin.Name)
 	if p == nil {
 		t.Fatal("Unable to find bundle plugin on manager")
 	}
-	bp := p.(*bundle.Plugin)
+	bp := p.(*bundlePlugin.Plugin)
 
 	// make sure the older style `bundle` config takes precedence
 	if bp.Config().Name != "bundle-classic" {
@@ -1200,11 +1807,11 @@ bundles:
 		t.Fatalf("Unexpected error: %s", err)
 	}
 
-	p := manager.Plugin(bundle.Name)
+	p := manager.Plugin(bundlePlugin.Name)
 	if p == nil {
 		t.Fatal("Unable to find bundle plugin on manager")
 	}
-	bp := p.(*bundle.Plugin)
+	bp := p.(*bundlePlugin.Plugin)
 
 	if len(bp.Config().Bundles) != 1 {
 		t.Fatal("Expected a single bundle configured")
@@ -1483,6 +2090,70 @@ func TestInterQueryBuiltinCacheConfigUpdate(t *testing.T) {
 	}
 }
 
+func TestNDBuiltinCacheConfigUpdate(t *testing.T) {
+	type exampleConfig struct {
+		v bool
+	}
+	var config1 *exampleConfig
+	var config2 *exampleConfig
+	manager, err := plugins.New([]byte(`{
+		"discovery": {"name": "config"},
+		"services": {
+			"localhost": {
+				"url": "http://localhost:9999"
+			}
+		},
+  }`), "test-id", inmem.New())
+	manager.RegisterNDCacheTrigger(func(x bool) {
+		if config1 == nil {
+			config1 = &exampleConfig{v: x}
+		} else if config2 == nil {
+			config2 = &exampleConfig{v: x}
+		} else {
+			t.Fatal("Expected cache trigger to only be called twice")
+		}
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testPlugin := &reconfigureTestPlugin{counts: map[string]int{}}
+	testFactory := testFactory{p: testPlugin}
+
+	disco, err := New(manager, Factories(map[string]plugins.Factory{"test_plugin": testFactory}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+
+	initialBundle := makeDataBundle(1, `{
+		"config": {
+			"nd_builtin_cache": true
+		}
+	}`)
+
+	disco.oneShot(ctx, download.Update{Bundle: initialBundle})
+
+	// Verify NDBuiltinCache is triggered with initial config
+	if config1 == nil || config1.v != true {
+		t.Fatalf("Expected ND builtin cache to be enabled after initial discovery, got: %v", config1.v)
+	}
+
+	// Verify NDBuiltinCache is reconfigured
+	updatedBundle := makeDataBundle(2, `{
+		"config": {
+			"nd_builtin_cache": false
+		}
+	}`)
+
+	disco.oneShot(ctx, download.Update{Bundle: updatedBundle})
+
+	if config2 == nil || config2.v != false {
+		t.Fatalf("Expected ND builtin cache to be disabled after discovery reconfigure, got: %v", config2.v)
+	}
+}
+
 func TestPluginManualTriggerLifecycle(t *testing.T) {
 	ctx := context.Background()
 	m := metrics.New()
@@ -1742,7 +2413,7 @@ func (t *testFixture) loop(ctx context.Context) {
 			close(done)
 
 		case done := <-t.bundleTrigger:
-			if p, ok := t.manager.Plugin(bundle.Name).(plugins.Triggerable); ok {
+			if p, ok := t.manager.Plugin(bundlePlugin.Name).(plugins.Triggerable); ok {
 				_ = p.Trigger(ctx)
 			}
 			close(done)
@@ -2012,3 +2683,15 @@ func (t *testFixtureServer) start() {
 func (t *testFixtureServer) stop() {
 	t.server.Close()
 }
+
+func ensurePluginState(t *testing.T, d *Discovery, state plugins.State) {
+	t.Helper()
+	status, ok := d.manager.PluginStatus()[Name]
+	if !ok {
+		t.Fatalf("Expected to find state for %s, found nil", Name)
+		return
+	}
+	if status.State != state {
+		t.Fatalf("Unexpected status state found in plugin manager for %s:\n\n\tFound:%+v\n\n\tExpected: %s", Name, status.State, state)
+	}
+}
diff --git a/plugins/logs/encoder.go b/plugins/logs/encoder.go
index 2428b0e9b2..6bc07247e9 100644
--- a/plugins/logs/encoder.go
+++ b/plugins/logs/encoder.go
@@ -15,12 +15,13 @@ import (
 )
 
 const (
-	encHardLimitThreshold            = 0.9
-	softLimitBaseFactor              = 2
-	softLimitExponentScaleFactor     = 0.2
-	encSoftLimitScaleUpCounterName   = "enc_soft_limit_scale_up"
-	encSoftLimitScaleDownCounterName = "enc_soft_limit_scale_down"
-	encSoftLimitStableCounterName    = "enc_soft_limit_stable"
+	encHardLimitThreshold              = 0.9
+	softLimitBaseFactor                = 2
+	softLimitExponentScaleFactor       = 0.2
+	encLogExUploadSizeLimitCounterName = "enc_log_exceeded_upload_size_limit_bytes"
+	encSoftLimitScaleUpCounterName     = "enc_soft_limit_scale_up"
+	encSoftLimitScaleDownCounterName   = "enc_soft_limit_scale_down"
+	encSoftLimitStableCounterName      = "enc_soft_limit_stable"
 )
 
 // chunkEncoder implements log buffer chunking and compression. Log events are
@@ -65,7 +66,11 @@ func (enc *chunkEncoder) Write(event EventV1) (result [][]byte, err error) {
 	if len(bs) == 0 {
 		return nil, nil
 	} else if int64(len(bs)+2) > enc.limit {
-		return nil, fmt.Errorf("upload chunk size too small")
+		if enc.metrics != nil {
+			enc.metrics.Counter(encLogExUploadSizeLimitCounterName).Incr()
+		}
+		return nil, fmt.Errorf("upload chunk size (%d) exceeds upload_size_limit_bytes (%d)",
+			int64(len(bs)+2), enc.limit)
 	}
 
 	if int64(len(bs)+enc.bytesWritten+1) > enc.softLimit {
@@ -119,6 +124,7 @@ func (enc *chunkEncoder) Flush() ([][]byte, error) {
 	return enc.reset()
 }
 
+//nolint:unconvert
 func (enc *chunkEncoder) reset() ([][]byte, error) {
 
 	// Adjust the encoder's soft limit based on the current amount of
diff --git a/plugins/logs/encoder_test.go b/plugins/logs/encoder_test.go
index 207dc8f435..950cf27f70 100644
--- a/plugins/logs/encoder_test.go
+++ b/plugins/logs/encoder_test.go
@@ -53,6 +53,36 @@ func TestChunkEncoder(t *testing.T) {
 	}
 }
 
+func TestChunkEncoderSizeLimit(t *testing.T) {
+	enc := newChunkEncoder(1).WithMetrics(metrics.New())
+	var result interface{} = false
+	var expInput interface{} = map[string]interface{}{"method": "GET"}
+	ts, err := time.Parse(time.RFC3339Nano, "2018-01-01T12:00:00.123456Z")
+	if err != nil {
+		t.Fatal(err)
+	}
+	event := EventV1{
+		Labels: map[string]string{
+			"id":  "test-instance-id",
+			"app": "example-app",
+		},
+		DecisionID:  "123",
+		Path:        "foo/bar",
+		Input:       &expInput,
+		Result:      &result,
+		RequestedBy: "test",
+		Timestamp:   ts,
+	}
+	_, err = enc.Write(event)
+	if err == nil {
+		t.Error("Expected error as upload chunk size exceeds configured limit")
+	}
+	expected := "upload chunk size (200) exceeds upload_size_limit_bytes (1)"
+	if err.Error() != expected {
+		t.Errorf("expected: '%s', got: '%s'", expected, err.Error())
+	}
+}
+
 func TestChunkEncoderAdaptive(t *testing.T) {
 
 	enc := newChunkEncoder(1000).WithMetrics(metrics.New())
diff --git a/plugins/logs/mask.go b/plugins/logs/mask.go
index 765500c35d..81bb52af39 100644
--- a/plugins/logs/mask.go
+++ b/plugins/logs/mask.go
@@ -5,14 +5,12 @@
 package logs
 
 import (
-	"encoding/json"
 	"fmt"
 	"net/url"
 	"strconv"
 	"strings"
 
 	"github.com/open-policy-agent/opa/internal/deepcopy"
-	"github.com/open-policy-agent/opa/util"
 )
 
 type maskOP string
@@ -21,8 +19,9 @@ const (
 	maskOPRemove maskOP = "remove"
 	maskOPUpsert maskOP = "upsert"
 
-	partInput  = "input"
-	partResult = "result"
+	partInput    = "input"
+	partResult   = "result"
+	partNDBCache = "nd_builtin_cache"
 )
 
 var (
@@ -64,18 +63,20 @@ func newMaskRule(path string, opts ...maskRuleOption) (*maskRule, error) {
 
 	parts := strings.Split(path[1:], "/")
 
-	if parts[0] != partInput && parts[0] != partResult {
+	switch parts[0] {
+	case partInput, partResult, partNDBCache: // OK
+	default:
 		return nil, fmt.Errorf("mask prefix not allowed: %v", parts[0])
 	}
 
 	escapedParts := make([]string, len(parts))
 	for i := range parts {
-		_, err := url.QueryUnescape(parts[i])
+		_, err := url.PathUnescape(parts[i])
 		if err != nil {
 			return nil, err
 		}
 
-		escapedParts[i] = url.QueryEscape(parts[i])
+		escapedParts[i] = url.PathEscape(parts[i])
 	}
 
 	modifyFullObj := false
@@ -101,15 +102,11 @@ func newMaskRule(path string, opts ...maskRuleOption) (*maskRule, error) {
 
 func withOP(op maskOP) maskRuleOption {
 	return func(r *maskRule) error {
-
-		var supportedMaskOPS = [...]maskOP{maskOPRemove, maskOPUpsert}
-		for _, sOP := range supportedMaskOPS {
-			if op == sOP {
-				r.OP = op
-				return nil
-			}
+		switch op {
+		case maskOPRemove, maskOPUpsert:
+			r.OP = op
+			return nil
 		}
-
 		return fmt.Errorf("mask op is not supported: %s", op)
 	}
 }
@@ -130,8 +127,8 @@ func withFailUndefinedPath() maskRuleOption {
 
 func (r maskRule) Mask(event *EventV1) error {
 
-	var maskObj *interface{}     // pointer to event Input|Result object
-	var maskObjPtr **interface{} // pointer to the event Input|Result pointer itself
+	var maskObj *interface{}     // pointer to event Input|Result|NDBCache object
+	var maskObjPtr **interface{} // pointer to the event Input|Result|NDBCache pointer itself
 
 	switch p := r.escapedParts[0]; p {
 	case partInput:
@@ -143,7 +140,6 @@ func (r maskRule) Mask(event *EventV1) error {
 		}
 		maskObj = event.Input
 		maskObjPtr = &event.Input
-
 	case partResult:
 		if event.Result == nil {
 			if r.failUndefinedPath {
@@ -153,6 +149,15 @@ func (r maskRule) Mask(event *EventV1) error {
 		}
 		maskObj = event.Result
 		maskObjPtr = &event.Result
+	case partNDBCache:
+		if event.NDBuiltinCache == nil {
+			if r.failUndefinedPath {
+				return errMaskInvalidObject
+			}
+			return nil
+		}
+		maskObj = event.NDBuiltinCache
+		maskObjPtr = &event.NDBuiltinCache
 	default:
 		return fmt.Errorf("illegal path value: %s", p)
 	}
@@ -265,17 +270,12 @@ func (r maskRule) mkdirp(node map[string]interface{}, path []string, value inter
 }
 
 func newMaskRuleSet(rv interface{}, onRuleError func(*maskRule, error)) (*maskRuleSet, error) {
-	bs, err := json.Marshal(rv)
-	if err != nil {
-		return nil, err
-	}
 	var mRuleSet = &maskRuleSet{
 		OnRuleError: onRuleError,
 	}
-	var rawRules []interface{}
-
-	if err := util.Unmarshal(bs, &rawRules); err != nil {
-		return nil, err
+	rawRules, ok := rv.([]interface{})
+	if !ok {
+		return nil, fmt.Errorf("unexpected rule format %v (%[1]T)", rv)
 	}
 
 	for _, iface := range rawRules {
@@ -293,20 +293,23 @@ func newMaskRuleSet(rv interface{}, onRuleError func(*maskRule, error)) (*maskRu
 			mRuleSet.Rules = append(mRuleSet.Rules, rule)
 
 		case map[string]interface{}:
-
-			bs, err := json.Marshal(v)
-			if err != nil {
-				return nil, err
-			}
-
 			rule := &maskRule{}
+			op, set := getString(v, "op")
+			if set && op == "" {
+				return nil, fmt.Errorf("invalid \"op\" value: %v %[1]T", v["op"])
+			}
+			rule.OP = maskOP(op)
 
-			if err := util.Unmarshal(bs, rule); err != nil {
-				return nil, err
+			path, set := getString(v, "path")
+			if set && path == "" {
+				return nil, fmt.Errorf("invalid \"path\" value: %v %[1]T", v["path"])
 			}
+			rule.Path = path
+
+			rule.Value = v["value"]
 
 			// use unmarshalled values to create new Mask Rule
-			rule, err = newMaskRule(rule.Path, withOP(rule.OP), withValue(rule.Value))
+			rule, err := newMaskRule(rule.Path, withOP(rule.OP), withValue(rule.Value))
 
 			// TODO add withFailUndefinedPath() option based on
 			//   A) new syntax in user defined mask rule
@@ -343,3 +346,17 @@ func (rs maskRuleSet) Mask(event *EventV1) {
 		}
 	}
 }
+
+// bool return means the field was set, if the string is still "", the
+// value was invalid
+func getString(x map[string]any, key string) (string, bool) {
+	y, ok := x[key]
+	if !ok {
+		return "", false
+	}
+	s, ok := y.(string)
+	if !ok {
+		return "", true
+	}
+	return s, true
+}
diff --git a/plugins/logs/mask_test.go b/plugins/logs/mask_test.go
index de371fc0a3..36f2b26a48 100644
--- a/plugins/logs/mask_test.go
+++ b/plugins/logs/mask_test.go
@@ -541,6 +541,25 @@ func TestMaskRuleMask(t *testing.T) {
 			event: `{"input": {"foo": [{"bar": 1, "baz": 2}]}}`,
 			exp:   `{"input": {"foo": [{"baz": 2}]}, "erased": ["/input/foo/0/bar"]}`,
 		},
+		{
+			note: "erase input: special character in path",
+			ptr: &maskRule{
+				OP:   maskOPRemove,
+				Path: "/input/:path",
+			},
+			event: `{"input": {"bar": 1, ":path": "token"}}`,
+			exp:   `{"input": {"bar": 1}, "erased": ["/input/:path"]}`,
+		},
+		{
+			note: "upsert input: special character in path",
+			ptr: &maskRule{
+				OP:    maskOPUpsert,
+				Path:  "/input/:path",
+				Value: "upserted",
+			},
+			event: `{"input": {"bar": 1, ":path": "token"}}`,
+			exp:   `{"input": {"bar": 1, ":path": "upserted"}, "masked": ["/input/:path"]}`,
+		},
 	}
 
 	for _, tc := range tests {
@@ -588,37 +607,34 @@ func TestMaskRuleMask(t *testing.T) {
 
 func TestNewMaskRuleSet(t *testing.T) {
 	tests := []struct {
-		onRuleError func(*maskRule, error)
-		note        string
-		value       interface{}
-		exp         *maskRuleSet
-		err         error
+		note  string
+		value interface{}
+		exp   *maskRuleSet
+		err   error
 	}{
 		{
-			onRuleError: func(mRule *maskRule, err error) {},
-			note:        "invalid format: not []interface{}",
-			value:       map[string]int{"invalid": 1},
-			err:         fmt.Errorf("json: cannot unmarshal object into Go value of type []interface {}"),
+			note:  "invalid format: not []interface{}",
+			value: map[string]int{"invalid": 1},
+			err:   fmt.Errorf("unexpected rule format map[invalid:1] (map[string]int)"),
 		},
 		{
-			onRuleError: func(mRule *maskRule, err error) {},
-			note:        "invalid format: nested type not string or map[string]interface{}",
+			note: "invalid format: nested type not string or map[string]interface{}",
 			value: []interface{}{
 				[]int{1, 2},
 			},
-			err: fmt.Errorf("invalid mask rule format encountered: []interface {}"),
+			err: fmt.Errorf("invalid mask rule format encountered: []int"),
 		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			_, err := newMaskRuleSet(tc.value, func(mRule *maskRule, err error) {})
-
 			if err != nil {
-				if tc.err.Error() != err.Error() {
-					t.Fatalf("Expected: %s\nGot: %s", tc.err.Error(), err.Error())
+				if exp, act := tc.err.Error(), err.Error(); exp != act {
+					t.Fatalf("Expected: %s\nGot: %s", exp, act)
 				}
+			} else if tc.err != nil {
+				t.Errorf("expected error %v, got nil", tc.err)
 			}
 		})
 	}
diff --git a/plugins/logs/plugin.go b/plugins/logs/plugin.go
index 854928480a..661906cc34 100644
--- a/plugins/logs/plugin.go
+++ b/plugins/logs/plugin.go
@@ -11,14 +11,12 @@ import (
 	"fmt"
 	"math"
 	"math/rand"
-	"net/http"
 	"net/url"
 	"reflect"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/pkg/errors"
 	"golang.org/x/time/rate"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -26,7 +24,9 @@ import (
 	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
+	lstat "github.com/open-policy-agent/opa/plugins/logs/status"
 	"github.com/open-policy-agent/opa/plugins/rest"
+	"github.com/open-policy-agent/opa/plugins/status"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/server"
 	"github.com/open-policy-agent/opa/storage"
@@ -45,20 +45,25 @@ type Logger interface {
 // the struct. Any changes here MUST be reflected in the AST()
 // implementation below.
 type EventV1 struct {
-	Labels      map[string]string       `json:"labels"`
-	DecisionID  string                  `json:"decision_id"`
-	Revision    string                  `json:"revision,omitempty"` // Deprecated: Use Bundles instead
-	Bundles     map[string]BundleInfoV1 `json:"bundles,omitempty"`
-	Path        string                  `json:"path,omitempty"`
-	Query       string                  `json:"query,omitempty"`
-	Input       *interface{}            `json:"input,omitempty"`
-	Result      *interface{}            `json:"result,omitempty"`
-	Erased      []string                `json:"erased,omitempty"`
-	Masked      []string                `json:"masked,omitempty"`
-	Error       error                   `json:"error,omitempty"`
-	RequestedBy string                  `json:"requested_by"`
-	Timestamp   time.Time               `json:"timestamp"`
-	Metrics     map[string]interface{}  `json:"metrics,omitempty"`
+	Labels         map[string]string       `json:"labels"`
+	DecisionID     string                  `json:"decision_id"`
+	TraceID        string                  `json:"trace_id,omitempty"`
+	SpanID         string                  `json:"span_id,omitempty"`
+	Revision       string                  `json:"revision,omitempty"` // Deprecated: Use Bundles instead
+	Bundles        map[string]BundleInfoV1 `json:"bundles,omitempty"`
+	Path           string                  `json:"path,omitempty"`
+	Query          string                  `json:"query,omitempty"`
+	Input          *interface{}            `json:"input,omitempty"`
+	Result         *interface{}            `json:"result,omitempty"`
+	MappedResult   *interface{}            `json:"mapped_result,omitempty"`
+	NDBuiltinCache *interface{}            `json:"nd_builtin_cache,omitempty"`
+	Erased         []string                `json:"erased,omitempty"`
+	Masked         []string                `json:"masked,omitempty"`
+	Error          error                   `json:"error,omitempty"`
+	RequestedBy    string                  `json:"requested_by,omitempty"`
+	Timestamp      time.Time               `json:"timestamp"`
+	Metrics        map[string]interface{}  `json:"metrics,omitempty"`
+	RequestID      uint64                  `json:"req_id,omitempty"`
 
 	inputAST ast.Value
 }
@@ -86,12 +91,15 @@ var pathKey = ast.StringTerm("path")
 var queryKey = ast.StringTerm("query")
 var inputKey = ast.StringTerm("input")
 var resultKey = ast.StringTerm("result")
+var mappedResultKey = ast.StringTerm("mapped_result")
+var ndBuiltinCacheKey = ast.StringTerm("nd_builtin_cache")
 var erasedKey = ast.StringTerm("erased")
 var maskedKey = ast.StringTerm("masked")
 var errorKey = ast.StringTerm("error")
 var requestedByKey = ast.StringTerm("requested_by")
 var timestampKey = ast.StringTerm("timestamp")
 var metricsKey = ast.StringTerm("metrics")
+var requestIDKey = ast.StringTerm("req_id")
 
 // AST returns the Rego AST representation for a given EventV1 object.
 // This avoids having to round trip through JSON while applying a decision log
@@ -150,6 +158,22 @@ func (e *EventV1) AST() (ast.Value, error) {
 		event.Insert(resultKey, ast.NewTerm(results))
 	}
 
+	if e.MappedResult != nil {
+		mResults, err := roundtripJSONToAST(e.MappedResult)
+		if err != nil {
+			return nil, err
+		}
+		event.Insert(mappedResultKey, ast.NewTerm(mResults))
+	}
+
+	if e.NDBuiltinCache != nil {
+		ndbCache, err := roundtripJSONToAST(e.NDBuiltinCache)
+		if err != nil {
+			return nil, err
+		}
+		event.Insert(ndBuiltinCacheKey, ast.NewTerm(ndbCache))
+	}
+
 	if len(e.Erased) > 0 {
 		erased := make([]*ast.Term, len(e.Erased))
 		for i, v := range e.Erased {
@@ -174,7 +198,9 @@ func (e *EventV1) AST() (ast.Value, error) {
 		event.Insert(errorKey, ast.NewTerm(evalErr))
 	}
 
-	event.Insert(requestedByKey, ast.StringTerm(e.RequestedBy))
+	if len(e.RequestedBy) > 0 {
+		event.Insert(requestedByKey, ast.StringTerm(e.RequestedBy))
+	}
 
 	// Use the timestamp JSON marshaller to ensure the format is the same as
 	// round tripping through JSON.
@@ -192,6 +218,10 @@ func (e *EventV1) AST() (ast.Value, error) {
 		event.Insert(metricsKey, ast.NewTerm(m))
 	}
 
+	if e.RequestID > 0 {
+		event.Insert(requestIDKey, ast.UIntNumberTerm(e.RequestID))
+	}
+
 	return event, nil
 }
 
@@ -208,14 +238,18 @@ func roundtripJSONToAST(x interface{}) (ast.Value, error) {
 
 const (
 	// min amount of time to wait following a failure
-	minRetryDelay               = time.Millisecond * 100
-	defaultMinDelaySeconds      = int64(300)
-	defaultMaxDelaySeconds      = int64(600)
-	defaultUploadSizeLimitBytes = int64(32768) // 32KB limit
-	defaultBufferSizeLimitBytes = int64(0)     // unlimited
-	defaultMaskDecisionPath     = "/system/log/mask"
-	logDropCounterName          = "decision_logs_dropped"
-	defaultResourcePath         = "/logs"
+	minRetryDelay                       = time.Millisecond * 100
+	defaultMinDelaySeconds              = int64(300)
+	defaultMaxDelaySeconds              = int64(600)
+	defaultUploadSizeLimitBytes         = int64(32768) // 32KB limit
+	defaultBufferSizeLimitBytes         = int64(0)     // unlimited
+	defaultMaskDecisionPath             = "/system/log/mask"
+	defaultDropDecisionPath             = "/system/log/drop"
+	logRateLimitExDropCounterName       = "decision_logs_dropped_rate_limit_exceeded"
+	logNDBDropCounterName               = "decision_logs_nd_builtin_cache_dropped"
+	logBufferSizeLimitExDropCounterName = "decision_logs_dropped_buffer_size_limit_bytes_exceeded"
+	logEncodingFailureCounterName       = "decision_logs_encoding_failure"
+	defaultResourcePath                 = "/logs"
 )
 
 // ReportingConfig represents configuration for the plugin's reporting behaviour.
@@ -235,9 +269,12 @@ type Config struct {
 	PartitionName   string          `json:"partition_name,omitempty"`
 	Reporting       ReportingConfig `json:"reporting"`
 	MaskDecision    *string         `json:"mask_decision"`
+	DropDecision    *string         `json:"drop_decision"`
 	ConsoleLogs     bool            `json:"console"`
 	Resource        *string         `json:"resource"`
+	NDBuiltinCache  bool            `json:"nd_builtin_cache,omitempty"`
 	maskDecisionRef ast.Ref
+	dropDecisionRef ast.Ref
 }
 
 func (c *Config) validateAndInjectDefaults(services []string, pluginsList []string, trigger *plugins.TriggerMode) error {
@@ -274,13 +311,9 @@ func (c *Config) validateAndInjectDefaults(services []string, pluginsList []stri
 		}
 	}
 
-	if c.Plugin == nil && c.Service == "" && !c.ConsoleLogs {
-		return fmt.Errorf("invalid decision_log config, must have a `service`, `plugin`, or `console` logging enabled")
-	}
-
 	t, err := plugins.ValidateAndInjectDefaultsForTriggerMode(trigger, c.Reporting.Trigger)
 	if err != nil {
-		return errors.Wrap(err, "invalid decision_log config")
+		return fmt.Errorf("invalid decision_log config: %w", err)
 	}
 	c.Reporting.Trigger = t
 
@@ -334,7 +367,17 @@ func (c *Config) validateAndInjectDefaults(services []string, pluginsList []stri
 
 	c.maskDecisionRef, err = ref.ParseDataPath(*c.MaskDecision)
 	if err != nil {
-		return errors.Wrap(err, "invalid mask_decision in decision_logs")
+		return fmt.Errorf("invalid mask_decision in decision_logs: %w", err)
+	}
+
+	if c.DropDecision == nil {
+		dropDecision := defaultDropDecisionPath
+		c.DropDecision = &dropDecision
+	}
+
+	c.dropDecisionRef, err = ref.ParseDataPath(*c.DropDecision)
+	if err != nil {
+		return fmt.Errorf("invalid drop_decision in decision_logs: %w", err)
 	}
 
 	if c.PartitionName != "" {
@@ -363,9 +406,12 @@ type Plugin struct {
 	reconfig  chan reconfigure
 	mask      *rego.PreparedEvalQuery
 	maskMutex sync.Mutex
+	drop      *rego.PreparedEvalQuery
+	dropMutex sync.Mutex
 	limiter   *rate.Limiter
 	metrics   metrics.Metrics
 	logger    logging.Logger
+	status    *lstat.Status
 }
 
 type reconfigure struct {
@@ -433,6 +479,11 @@ func (b *ConfigBuilder) Parse() (*Config, error) {
 		return nil, err
 	}
 
+	if parsedConfig.Plugin == nil && parsedConfig.Service == "" && len(b.services) == 0 && !parsedConfig.ConsoleLogs {
+		// Nothing to validate or inject
+		return nil, nil
+	}
+
 	if err := parsedConfig.validateAndInjectDefaults(b.services, b.plugins, b.trigger); err != nil {
 		return nil, err
 	}
@@ -451,6 +502,7 @@ func New(parsedConfig *Config, manager *plugins.Manager) *Plugin {
 		enc:      newChunkEncoder(*parsedConfig.Reporting.UploadSizeLimitBytes),
 		reconfig: make(chan reconfigure),
 		logger:   manager.Logger().WithFields(map[string]interface{}{"plugin": Name}),
+		status:   &lstat.Status{},
 	}
 
 	if parsedConfig.Reporting.MaxDecisionsPerSecond != nil {
@@ -545,17 +597,38 @@ func (p *Plugin) Log(ctx context.Context, decision *server.Info) error {
 	}
 
 	event := EventV1{
-		Labels:      p.manager.Labels(),
-		DecisionID:  decision.DecisionID,
-		Revision:    decision.Revision,
-		Bundles:     bundles,
-		Path:        decision.Path,
-		Query:       decision.Query,
-		Input:       decision.Input,
-		Result:      decision.Results,
-		RequestedBy: decision.RemoteAddr,
-		Timestamp:   decision.Timestamp,
-		inputAST:    decision.InputAST,
+		Labels:         p.manager.Labels(),
+		DecisionID:     decision.DecisionID,
+		TraceID:        decision.TraceID,
+		SpanID:         decision.SpanID,
+		Revision:       decision.Revision,
+		Bundles:        bundles,
+		Path:           decision.Path,
+		Query:          decision.Query,
+		Input:          decision.Input,
+		Result:         decision.Results,
+		MappedResult:   decision.MappedResults,
+		NDBuiltinCache: decision.NDBuiltinCache,
+		RequestedBy:    decision.RemoteAddr,
+		Timestamp:      decision.Timestamp,
+		RequestID:      decision.RequestID,
+		inputAST:       decision.InputAST,
+	}
+
+	input, err := event.AST()
+	if err != nil {
+		return err
+	}
+
+	drop, err := p.dropEvent(ctx, decision.Txn, input)
+	if err != nil {
+		p.logger.Error("Log drop decision failed: %v.", err)
+		return nil
+	}
+
+	if drop {
+		p.logger.Debug("Decision log event to path %v dropped", event.Path)
+		return nil
 	}
 
 	if decision.Metrics != nil {
@@ -566,16 +639,14 @@ func (p *Plugin) Log(ctx context.Context, decision *server.Info) error {
 		event.Error = decision.Error
 	}
 
-	err := p.maskEvent(ctx, decision.Txn, &event)
-	if err != nil {
+	if err := p.maskEvent(ctx, decision.Txn, input, &event); err != nil {
 		// TODO(tsandall): see note below about error handling.
 		p.logger.Error("Log event masking failed: %v.", err)
 		return nil
 	}
 
 	if p.config.ConsoleLogs {
-		err := p.logEvent(event)
-		if err != nil {
+		if err := p.logEvent(event); err != nil {
 			p.logger.Error("Failed to log to console: %v.", err)
 		}
 	}
@@ -607,6 +678,10 @@ func (p *Plugin) Reconfigure(_ context.Context, config interface{}) {
 	defer p.maskMutex.Unlock()
 	p.mask = nil
 
+	p.dropMutex.Lock()
+	defer p.dropMutex.Unlock()
+	p.drop = nil
+
 	<-done
 }
 
@@ -638,19 +713,24 @@ func (p *Plugin) Trigger(ctx context.Context) error {
 // compilerUpdated is called when a compiler trigger on the plugin manager
 // fires. This indicates a new compiler instance is available. The decision
 // logger needs to prepare a new masking query.
-func (p *Plugin) compilerUpdated(txn storage.Transaction) {
+func (p *Plugin) compilerUpdated(storage.Transaction) {
 	p.maskMutex.Lock()
 	defer p.maskMutex.Unlock()
 	p.mask = nil
+
+	p.dropMutex.Lock()
+	defer p.dropMutex.Unlock()
+	p.drop = nil
 }
 
 func (p *Plugin) loop() {
 
 	ctx, cancel := context.WithCancel(context.Background())
 
+	var retry int
+
 	for {
 
-		var retry int
 		var waitC chan struct{}
 
 		if *p.config.Reporting.Trigger == plugins.TriggerPeriodic && p.config.Service != "" {
@@ -699,6 +779,15 @@ func (p *Plugin) loop() {
 func (p *Plugin) doOneShot(ctx context.Context) error {
 	uploaded, err := p.oneShot(ctx)
 
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	p.status.SetError(err)
+
+	if s := status.Lookup(p.manager); s != nil {
+		s.UpdateDecisionLogsStatus(*p.status)
+	}
+
 	if err != nil {
 		p.logger.Error("%v.", err)
 	} else if uploaded {
@@ -779,11 +868,14 @@ func (p *Plugin) reconfigure(config interface{}) {
 	p.config = *newConfig
 }
 
+// NOTE(philipc): Because ND builtins caching can cause unbounded growth in
+// decision log entry size, we do best-effort event encoding here, and when we
+// run out of space, we drop the ND builtins cache, and try encoding again.
 func (p *Plugin) encodeAndBufferEvent(event EventV1) {
 	if p.limiter != nil {
 		if !p.limiter.Allow() {
 			if p.metrics != nil {
-				p.metrics.Counter(logDropCounterName).Incr()
+				p.metrics.Counter(logRateLimitExDropCounterName).Incr()
 			}
 
 			p.logger.Error("Decision log dropped as rate limit exceeded. Reduce reporting interval or increase rate limit.")
@@ -793,11 +885,36 @@ func (p *Plugin) encodeAndBufferEvent(event EventV1) {
 
 	result, err := p.enc.Write(event)
 	if err != nil {
-		// TODO(tsandall): revisit this now that we have an API that
-		// can return an error. Should the default behaviour be to
-		// fail-closed as we do for plugins?
-		p.logger.Error("Log encoding failed: %v.", err)
-		return
+		// If there's no ND builtins cache in the event, then we don't
+		// need to retry encoding anything.
+		if event.NDBuiltinCache == nil {
+			// TODO(tsandall): revisit this now that we have an API that
+			// can return an error. Should the default behaviour be to
+			// fail-closed as we do for plugins?
+
+			if p.metrics != nil {
+				p.metrics.Counter(logEncodingFailureCounterName).Incr()
+			}
+			p.logger.Error("Log encoding failed: %v.", err)
+			return
+		}
+
+		// Attempt to encode the event again, dropping the ND builtins cache.
+		newEvent := event
+		newEvent.NDBuiltinCache = nil
+
+		result, err = p.enc.Write(newEvent)
+		if err != nil {
+			if p.metrics != nil {
+				p.metrics.Counter(logEncodingFailureCounterName).Incr()
+			}
+			p.logger.Error("Log encoding failed: %v.", err)
+			return
+		}
+
+		// Re-encoding was successful, but we still need to alert users.
+		p.logger.Error("ND builtins cache dropped from this event to fit under maximum upload size limits. Increase upload size limit or change usage of non-deterministic builtins.")
+		p.metrics.Counter(logNDBDropCounterName).Incr()
 	}
 
 	for _, chunk := range result {
@@ -808,11 +925,14 @@ func (p *Plugin) encodeAndBufferEvent(event EventV1) {
 func (p *Plugin) bufferChunk(buffer *logBuffer, bs []byte) {
 	dropped := buffer.Push(bs)
 	if dropped > 0 {
+		if p.metrics != nil {
+			p.metrics.Counter(logBufferSizeLimitExDropCounterName).Incr()
+		}
 		p.logger.Error("Dropped %v chunks from buffer. Reduce reporting interval or increase buffer size.", dropped)
 	}
 }
 
-func (p *Plugin) maskEvent(ctx context.Context, txn storage.Transaction, event *EventV1) error {
+func (p *Plugin) maskEvent(ctx context.Context, txn storage.Transaction, input ast.Value, event *EventV1) error {
 
 	mask, err := func() (rego.PreparedEvalQuery, error) {
 
@@ -848,11 +968,6 @@ func (p *Plugin) maskEvent(ctx context.Context, txn storage.Transaction, event *
 		return err
 	}
 
-	input, err := event.AST()
-	if err != nil {
-		return err
-	}
-
 	rs, err := mask.Eval(
 		ctx,
 		rego.EvalParsedInput(input),
@@ -880,6 +995,53 @@ func (p *Plugin) maskEvent(ctx context.Context, txn storage.Transaction, event *
 	return nil
 }
 
+func (p *Plugin) dropEvent(ctx context.Context, txn storage.Transaction, input ast.Value) (bool, error) {
+
+	drop, err := func() (rego.PreparedEvalQuery, error) {
+
+		p.dropMutex.Lock()
+		defer p.dropMutex.Unlock()
+
+		if p.drop == nil {
+			query := ast.NewBody(ast.NewExpr(ast.NewTerm(p.config.dropDecisionRef)))
+			r := rego.New(
+				rego.ParsedQuery(query),
+				rego.Compiler(p.manager.GetCompiler()),
+				rego.Store(p.manager.Store),
+				rego.Transaction(txn),
+				rego.Runtime(p.manager.Info),
+				rego.EnablePrintStatements(p.manager.EnablePrintStatements()),
+				rego.PrintHook(p.manager.PrintHook()),
+			)
+
+			pq, err := r.PrepareForEval(context.Background())
+			if err != nil {
+				return rego.PreparedEvalQuery{}, err
+			}
+
+			p.drop = &pq
+		}
+
+		return *p.drop, nil
+	}()
+
+	if err != nil {
+		return false, err
+	}
+
+	rs, err := drop.Eval(
+		ctx,
+		rego.EvalParsedInput(input),
+		rego.EvalTransaction(txn),
+	)
+
+	if err != nil {
+		return false, err
+	}
+
+	return rs.Allowed(), nil
+}
+
 func uploadChunk(ctx context.Context, client rest.Client, uploadPath string, data []byte) error {
 
 	resp, err := client.
@@ -889,21 +1051,16 @@ func uploadChunk(ctx context.Context, client rest.Client, uploadPath string, dat
 		Do(ctx, "POST", uploadPath)
 
 	if err != nil {
-		return errors.Wrap(err, "Log upload failed")
+		return fmt.Errorf("log upload failed: %w", err)
 	}
 
 	defer util.Close(resp)
 
-	switch resp.StatusCode {
-	case http.StatusOK:
-		return nil
-	case http.StatusNotFound:
-		return fmt.Errorf("Log upload failed, server replied with not found")
-	case http.StatusUnauthorized:
-		return fmt.Errorf("Log upload failed, server replied with not authorized")
-	default:
-		return fmt.Errorf("Log upload failed, server replied with HTTP %v", resp.StatusCode)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return lstat.HTTPError{StatusCode: resp.StatusCode}
 	}
+
+	return nil
 }
 
 func (p *Plugin) logEvent(event EventV1) error {
diff --git a/plugins/logs/plugin_benchmark_test.go b/plugins/logs/plugin_benchmark_test.go
index 8583b974b7..1087592301 100644
--- a/plugins/logs/plugin_benchmark_test.go
+++ b/plugins/logs/plugin_benchmark_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/open-policy-agent/opa/plugins"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
 )
 
@@ -154,25 +154,22 @@ func BenchmarkMaskingNop(b *testing.B) {
 	}
 	plugin := New(cfg, manager)
 
+	var event EventV1
+	if err := util.UnmarshalJSON([]byte(largeEvent), &event); err != nil {
+		b.Fatal(err)
+	}
+	input, err := event.AST()
+	if err != nil {
+		b.Fatal(err)
+	}
+
 	b.ResetTimer()
 
 	for i := 0; i < b.N; i++ {
-
-		b.StopTimer()
-
-		var event EventV1
-
-		if err := util.UnmarshalJSON([]byte(largeEvent), &event); err != nil {
-			b.Fatal(err)
-		}
-
-		b.StartTimer()
-
-		if err := plugin.maskEvent(ctx, nil, &event); err != nil {
+		if err := plugin.maskEvent(ctx, nil, input, &event); err != nil {
 			b.Fatal(err)
 		}
 	}
-
 }
 
 func BenchmarkMaskingRuleCountsNop(b *testing.B) {
@@ -195,20 +192,20 @@ func BenchmarkMaskingRuleCountsNop(b *testing.B) {
 	}
 	plugin := New(cfg, manager)
 
-	for _, ruleCount := range numRules {
+	var event EventV1
+	if err := util.UnmarshalJSON([]byte(largeEvent), &event); err != nil {
+		b.Fatal(err)
+	}
+	input, err := event.AST()
+	if err != nil {
+		b.Fatal(err)
+	}
 
+	for _, ruleCount := range numRules {
 		b.Run(fmt.Sprintf("%dRules", ruleCount), func(b *testing.B) {
 			b.ResetTimer()
 			for i := 0; i < b.N; i++ {
-				b.StopTimer()
-				var event EventV1
-				if err := util.UnmarshalJSON([]byte(largeEvent), &event); err != nil {
-					b.Fatal(err)
-				}
-
-				b.StartTimer()
-
-				if err := plugin.maskEvent(ctx, nil, &event); err != nil {
+				if err := plugin.maskEvent(ctx, nil, input, &event); err != nil {
 					b.Fatal(err)
 				}
 			}
@@ -247,22 +244,19 @@ func BenchmarkMaskingErase(b *testing.B) {
 		b.Fatal(err)
 	}
 	plugin := New(cfg, manager)
+	var event EventV1
+	if err := util.UnmarshalJSON([]byte(largeEvent), &event); err != nil {
+		b.Fatal(err)
+	}
+	input, err := event.AST()
+	if err != nil {
+		b.Fatal(err)
+	}
 
 	b.ResetTimer()
 
 	for i := 0; i < b.N; i++ {
-
-		b.StopTimer()
-
-		var event EventV1
-
-		if err := util.UnmarshalJSON([]byte(largeEvent), &event); err != nil {
-			b.Fatal(err)
-		}
-
-		b.StartTimer()
-
-		if err := plugin.maskEvent(ctx, nil, &event); err != nil {
+		if err := plugin.maskEvent(ctx, nil, input, &event); err != nil {
 			b.Fatal(err)
 		}
 
@@ -270,5 +264,4 @@ func BenchmarkMaskingErase(b *testing.B) {
 			b.Fatal("Expected input to be erased")
 		}
 	}
-
 }
diff --git a/plugins/logs/plugin_test.go b/plugins/logs/plugin_test.go
index 6dc3c946db..4c8aa3c855 100644
--- a/plugins/logs/plugin_test.go
+++ b/plugins/logs/plugin_test.go
@@ -17,6 +17,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
@@ -29,8 +30,9 @@ import (
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/server"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/print"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/version"
@@ -321,6 +323,10 @@ func TestPluginStartSameInput(t *testing.T) {
 	if !reflect.DeepEqual(chunk3[expLen3-1], exp) {
 		t.Fatalf("Expected %+v but got %+v", exp, chunk3[expLen3-1])
 	}
+
+	if fixture.plugin.status.Code != "" {
+		t.Fatal("expected no error in status update")
+	}
 }
 
 func TestPluginStartChangingInputValues(t *testing.T) {
@@ -748,6 +754,357 @@ func TestPluginRateLimitFloat(t *testing.T) {
 	compareLogEvent(t, chunk[0], exp)
 }
 
+func TestPluginStatusUpdateHTTPError(t *testing.T) {
+	ctx := context.Background()
+
+	fixture := newTestFixture(t, testFixtureOptions{ReportingUploadSizeLimitBytes: 300})
+	defer fixture.server.stop()
+
+	fixture.server.ch = make(chan []EventV1, 3)
+
+	var input interface{} = map[string]interface{}{"method": "GET"}
+	var result1 interface{} = false
+
+	_ = fixture.plugin.Log(ctx, logServerInfo("abc", input, result1))
+	_ = fixture.plugin.Log(ctx, logServerInfo("def", input, result1))
+	_ = fixture.plugin.Log(ctx, logServerInfo("ghi", input, result1))
+
+	bufLen := fixture.plugin.buffer.Len()
+	if bufLen < 1 {
+		t.Fatal("Expected buffer length of at least 1")
+	}
+
+	fixture.server.expCode = 500
+	err := fixture.plugin.doOneShot(ctx)
+	if err == nil {
+		t.Fatal("Expected error")
+	}
+
+	<-fixture.server.ch
+
+	if fixture.plugin.buffer.Len() < bufLen {
+		t.Fatal("Expected buffer to be preserved")
+	}
+
+	if fixture.plugin.status.HTTPCode != "500" {
+		t.Fatal("expected http_code to be 500 instead of ", fixture.plugin.status.HTTPCode)
+	}
+
+	msg := "log upload failed, server replied with HTTP 500 Internal Server Error"
+	if fixture.plugin.status.Message != msg {
+		t.Fatalf("expected status message to be %v instead of %v", msg, fixture.plugin.status.Message)
+	}
+}
+
+func TestPluginStatusUpdateEncodingFailure(t *testing.T) {
+	ctx := context.Background()
+	testLogger := test.New()
+
+	ts, err := time.Parse(time.RFC3339Nano, "2018-01-01T12:00:00.123456Z")
+	if err != nil {
+		panic(err)
+	}
+
+	fixture := newTestFixture(t, testFixtureOptions{
+		ConsoleLogger:                 testLogger,
+		ReportingUploadSizeLimitBytes: 1,
+	})
+	defer fixture.server.stop()
+
+	m := metrics.New()
+	fixture.plugin.metrics = m
+	fixture.plugin.enc.metrics = m
+
+	var input interface{} = map[string]interface{}{"method": "GET"}
+	var result interface{} = false
+
+	event := &server.Info{
+		DecisionID: "abc",
+		Path:       "foo/bar",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-1",
+		Timestamp:  ts,
+	}
+
+	err = fixture.plugin.Log(ctx, event)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	fixture.plugin.mtx.Lock()
+	if fixture.plugin.enc.bytesWritten != 0 {
+		t.Fatal("Expected no event to be written into the encoder")
+	}
+	fixture.plugin.mtx.Unlock()
+
+	// Create a status plugin that logs to console
+	pluginConfig := []byte(`{
+			"console": true,
+		}`)
+
+	config, _ := status.ParseConfig(pluginConfig, fixture.manager.Services(), nil)
+	p := status.New(config, fixture.manager).WithMetrics(fixture.plugin.metrics)
+
+	fixture.manager.Register(status.Name, p)
+	if err := fixture.manager.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	// Trigger a status update
+	fixture.server.expCode = 200
+	err = fixture.plugin.doOneShot(ctx)
+	if err != nil {
+		t.Fatal("Unexpected error")
+	}
+
+	// Give the logger / console some time to process and print the events
+	time.Sleep(10 * time.Millisecond)
+	p.Stop(ctx)
+
+	entries := testLogger.Entries()
+	if len(entries) == 0 {
+		t.Fatal("Expected log entries but got none")
+	}
+
+	// Pick the last entry as it should have the decision log metrics
+	e := entries[len(entries)-1]
+
+	if _, ok := e.Fields["metrics"]; !ok {
+		t.Fatal("Expected metrics field in status update")
+	}
+
+	fmt.Println(e.Fields["metrics"])
+
+	exp := map[string]interface{}{"<built-in>": map[string]interface{}{"counter_decision_logs_encoding_failure": json.Number("1"),
+		"counter_enc_log_exceeded_upload_size_limit_bytes": json.Number("1")}}
+
+	if !reflect.DeepEqual(e.Fields["metrics"], exp) {
+		t.Fatalf("Expected %v but got %v", exp, e.Fields["metrics"])
+	}
+}
+
+func TestPluginStatusUpdateBufferSizeExceeded(t *testing.T) {
+	ctx := context.Background()
+	testLogger := test.New()
+
+	ts, err := time.Parse(time.RFC3339Nano, "2018-01-01T12:00:00.123456Z")
+	if err != nil {
+		panic(err)
+	}
+
+	fixture := newTestFixture(t, testFixtureOptions{
+		ConsoleLogger:                 testLogger,
+		ReportingBufferSizeLimitBytes: 200,
+		ReportingUploadSizeLimitBytes: 300,
+	})
+	defer fixture.server.stop()
+
+	fixture.server.ch = make(chan []EventV1, 1)
+
+	fixture.plugin.metrics = metrics.New()
+
+	var input interface{} = map[string]interface{}{"method": "GET"}
+	var result interface{} = false
+
+	event1 := &server.Info{
+		DecisionID: "abc",
+		Path:       "foo/bar",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-1",
+		Timestamp:  ts,
+	}
+
+	event2 := &server.Info{
+		DecisionID: "def",
+		Path:       "foo/baz",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-2",
+		Timestamp:  ts,
+	}
+
+	event3 := &server.Info{
+		DecisionID: "ghi",
+		Path:       "foo/aux",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-3",
+		Timestamp:  ts,
+	}
+
+	// write event 1 and 2 into the encoder and check the chunk is inserted into the buffer
+	_ = fixture.plugin.Log(ctx, event1)
+	_ = fixture.plugin.Log(ctx, event2)
+
+	fixture.plugin.mtx.Lock()
+	if fixture.plugin.enc.bytesWritten == 0 {
+		t.Fatal("Expected event to be written into the encoder")
+	}
+
+	if fixture.plugin.buffer.Len() == 0 {
+		t.Fatal("Expected one chunk to be written into the buffer")
+	}
+	fixture.plugin.mtx.Unlock()
+
+	// write event 3 into the encoder and then flush the encoder which will result in the event being
+	// written to the buffer. But given the buffer size it won't be able to hold this event and will
+	// drop the existing chunk
+	_ = fixture.plugin.Log(ctx, event3)
+
+	// Create a status plugin that logs to console
+	pluginConfig := []byte(`{
+			"console": true,
+		}`)
+
+	config, _ := status.ParseConfig(pluginConfig, fixture.manager.Services(), nil)
+	p := status.New(config, fixture.manager).WithMetrics(fixture.plugin.metrics)
+
+	fixture.manager.Register(status.Name, p)
+	if err := fixture.manager.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	// Trigger a status update
+	fixture.server.expCode = 200
+	err = fixture.plugin.doOneShot(ctx)
+	if err != nil {
+		t.Fatal("Unexpected error")
+	}
+
+	<-fixture.server.ch
+
+	// Give the logger / console some time to process and print the events
+	time.Sleep(10 * time.Millisecond)
+	p.Stop(ctx)
+
+	entries := testLogger.Entries()
+	if len(entries) == 0 {
+		t.Fatal("Expected log entries but got none")
+	}
+
+	// Pick the last entry as it should have the decision log metrics
+	e := entries[len(entries)-1]
+
+	if _, ok := e.Fields["metrics"]; !ok {
+		t.Fatal("Expected metrics field in status update")
+	}
+
+	exp := map[string]interface{}{"<built-in>": map[string]interface{}{"counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded": json.Number("1")}}
+
+	if !reflect.DeepEqual(e.Fields["metrics"], exp) {
+		t.Fatalf("Expected %v but got %v", exp, e.Fields["metrics"])
+	}
+}
+
+func TestPluginStatusUpdateRateLimitExceeded(t *testing.T) {
+	ctx := context.Background()
+	testLogger := test.New()
+
+	ts, err := time.Parse(time.RFC3339Nano, "2018-01-01T12:00:00.123456Z")
+	if err != nil {
+		panic(err)
+	}
+
+	numDecisions := 1 // 1 decision per second
+	fixture := newTestFixture(t, testFixtureOptions{
+		ConsoleLogger:                  testLogger,
+		ReportingMaxDecisionsPerSecond: float64(numDecisions),
+		ReportingUploadSizeLimitBytes:  300,
+	})
+	defer fixture.server.stop()
+
+	fixture.server.ch = make(chan []EventV1, 1)
+
+	fixture.plugin.metrics = metrics.New()
+
+	var input interface{} = map[string]interface{}{"method": "GET"}
+	var result interface{} = false
+
+	event1 := &server.Info{
+		DecisionID: "abc",
+		Path:       "foo/bar",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-1",
+		Timestamp:  ts,
+	}
+
+	event2 := &server.Info{
+		DecisionID: "def",
+		Path:       "foo/baz",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-2",
+		Timestamp:  ts,
+	}
+
+	event3 := &server.Info{
+		DecisionID: "ghi",
+		Path:       "foo/aux",
+		Input:      &input,
+		Results:    &result,
+		RemoteAddr: "test-3",
+		Timestamp:  ts,
+	}
+
+	_ = fixture.plugin.Log(ctx, event1) // event 1 should be written into the encoder
+
+	fixture.plugin.mtx.Lock()
+	if fixture.plugin.enc.bytesWritten == 0 {
+		t.Fatal("Expected event to be written into the encoder")
+	}
+	fixture.plugin.mtx.Unlock()
+
+	// Create a status plugin that logs to console
+	pluginConfig := []byte(`{
+			"console": true,
+		}`)
+
+	config, _ := status.ParseConfig(pluginConfig, fixture.manager.Services(), nil)
+	p := status.New(config, fixture.manager).WithMetrics(fixture.plugin.metrics)
+
+	fixture.manager.Register(status.Name, p)
+	if err := fixture.manager.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
+
+	_ = fixture.plugin.Log(ctx, event2) // event 2 should not be written into the encoder as rate limit exceeded
+	_ = fixture.plugin.Log(ctx, event3) // event 3 should not be written into the encoder as rate limit exceeded
+
+	// Trigger a status update
+	fixture.server.expCode = 200
+	err = fixture.plugin.doOneShot(ctx)
+	if err != nil {
+		t.Fatal("Unexpected error")
+	}
+
+	<-fixture.server.ch
+
+	// Give the logger / console some time to process and print the events
+	time.Sleep(10 * time.Millisecond)
+	p.Stop(ctx)
+
+	entries := testLogger.Entries()
+	if len(entries) == 0 {
+		t.Fatal("Expected log entries but got none")
+	}
+
+	// Pick the last entry as it should have the decision log metrics
+	e := entries[len(entries)-1]
+
+	if _, ok := e.Fields["metrics"]; !ok {
+		t.Fatal("Expected metrics field in status update")
+	}
+
+	exp := map[string]interface{}{"<built-in>": map[string]interface{}{"counter_decision_logs_dropped_rate_limit_exceeded": json.Number("2")}}
+
+	if !reflect.DeepEqual(e.Fields["metrics"], exp) {
+		t.Fatalf("Expected %v but got %v", exp, e.Fields["metrics"])
+	}
+}
+
 func TestPluginRateLimitRequeue(t *testing.T) {
 	ctx := context.Background()
 
@@ -904,13 +1261,64 @@ func TestPluginRateLimitDropCountStatus(t *testing.T) {
 		t.Fatal("Expected metrics")
 	}
 
-	exp := map[string]interface{}{"<built-in>": map[string]interface{}{"counter_decision_logs_dropped": json.Number("2")}}
+	exp := map[string]interface{}{"<built-in>": map[string]interface{}{"counter_decision_logs_dropped_rate_limit_exceeded": json.Number("2")}}
 
 	if !reflect.DeepEqual(e.Fields["metrics"], exp) {
 		t.Fatalf("Expected %v but got %v", exp, e.Fields["metrics"])
 	}
 }
 
+func TestChunkMaxUploadSizeLimitNDBCacheDropping(t *testing.T) {
+	ctx := context.Background()
+	testLogger := test.New()
+
+	ts, err := time.Parse(time.RFC3339Nano, "2018-01-01T12:00:00.123456Z")
+	if err != nil {
+		panic(err)
+	}
+
+	fixture := newTestFixture(t, testFixtureOptions{
+		ConsoleLogger:                  testLogger,
+		ReportingMaxDecisionsPerSecond: float64(1), // 1 decision per second
+		ReportingUploadSizeLimitBytes:  400,
+	})
+	defer fixture.server.stop()
+
+	fixture.plugin.metrics = metrics.New()
+
+	var input interface{} = map[string]interface{}{"method": "GET"}
+	var result interface{} = false
+
+	// Purposely oversized NDBCache entry will force dropping during Log().
+	var ndbCacheExample interface{} = ast.MustJSON(builtins.NDBCache{
+		"test.custom_space_waster": ast.NewObject([2]*ast.Term{
+			ast.ArrayTerm(),
+			ast.StringTerm(strings.Repeat("Wasted space... ", 200)),
+		}),
+	}.AsValue())
+
+	event := &server.Info{
+		DecisionID:     "abc",
+		Path:           "foo/bar",
+		Input:          &input,
+		Results:        &result,
+		RemoteAddr:     "test",
+		Timestamp:      ts,
+		NDBuiltinCache: &ndbCacheExample,
+	}
+
+	beforeNDBDropCount := fixture.plugin.metrics.Counter(logNDBDropCounterName).Value().(uint64)
+	err = fixture.plugin.Log(ctx, event) // event should be written into the encoder
+	if err != nil {
+		t.Fatal(err)
+	}
+	afterNDBDropCount := fixture.plugin.metrics.Counter(logNDBDropCounterName).Value().(uint64)
+
+	if afterNDBDropCount != beforeNDBDropCount+1 {
+		t.Fatalf("Expected %v NDBCache drop events, saw %v events instead.", beforeNDBDropCount+1, afterNDBDropCount)
+	}
+}
+
 func TestPluginRateLimitBadConfig(t *testing.T) {
 	manager, _ := plugins.New(nil, "test-instance-id", inmem.New())
 
@@ -936,12 +1344,48 @@ func TestPluginRateLimitBadConfig(t *testing.T) {
 	}
 }
 
+func TestPluginNoLogging(t *testing.T) {
+	// Given no custom plugin, no service(s) and no console logging configured,
+	// this should not be an error, but neither do we need to initiate the plugin
+	cases := []struct {
+		note   string
+		config []byte
+	}{
+		{
+			note:   "no plugin attributes",
+			config: []byte(`{}`),
+		},
+		{
+			note:   "empty plugin configuration",
+			config: []byte(`{"decision_logs": {}}`),
+		},
+		{
+			note:   "only disabled console logger",
+			config: []byte(`{"decision_logs": {"console": "false"}}`),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			config, err := ParseConfig(tc.config, []string{}, nil)
+			if err != nil {
+				t.Errorf("expected no error: %v", err)
+			}
+			if config != nil {
+				t.Errorf("excected no config for a no-op logging plugin")
+			}
+		})
+	}
+}
+
 func TestPluginTriggerManual(t *testing.T) {
 	ctx := context.Background()
 
 	fixture := newTestFixture(t)
 	defer fixture.server.stop()
 
+	fixture.server.server.Config.SetKeepAlivesEnabled(false)
+
 	fixture.server.ch = make(chan []EventV1, 4)
 	tr := plugins.TriggerManual
 	fixture.plugin.config.Reporting.Trigger = &tr
@@ -1299,16 +1743,18 @@ func (a appendingPrintHook) Print(_ print.Context, s string) error {
 
 func TestPluginMasking(t *testing.T) {
 	tests := []struct {
-		note        string
-		rawPolicy   []byte
-		expErased   []string
-		expMasked   []string
-		expPrinted  []string
-		errManager  error
-		expErr      error
-		input       interface{}
-		expected    interface{}
-		reconfigure bool
+		note          string
+		rawPolicy     []byte
+		expErased     []string
+		expMasked     []string
+		expPrinted    []string
+		errManager    error
+		expErr        error
+		input         interface{}
+		expected      interface{}
+		ndbcache      interface{}
+		ndbc_expected interface{}
+		reconfigure   bool
 	}{
 		{
 			note: "simple erase (with body true)",
@@ -1525,6 +1971,59 @@ func TestPluginMasking(t *testing.T) {
 			},
 			expPrinted: []string{"Erasing /input/password"},
 		},
+		{
+			note: "simple upsert on nd_builtin_cache",
+			rawPolicy: []byte(`
+				package system.log
+				mask[{"op": "upsert", "path": "/nd_builtin_cache/rand.intn", "value": x}] {
+					input.nd_builtin_cache["rand.intn"]
+					x := "**REDACTED**"
+				}`),
+			expMasked: []string{"/nd_builtin_cache/rand.intn"},
+			ndbcache: map[string]interface{}{
+				// Simulate rand.intn("z", 15) call, with output of 7.
+				"rand.intn": map[string]interface{}{"[\"z\",15]": json.Number("7")},
+			},
+			ndbc_expected: map[string]interface{}{
+				"rand.intn": "**REDACTED**",
+			},
+		},
+		{
+			note: "simple upsert on nd_builtin_cache with multiple entries",
+			rawPolicy: []byte(`
+				package system.log
+				mask[{"op": "upsert", "path": "/nd_builtin_cache/rand.intn", "value": x}] {
+					input.nd_builtin_cache["rand.intn"]
+					x := "**REDACTED**"
+				}
+
+				mask[{"op": "upsert", "path": "/nd_builtin_cache/net.lookup_ip_addr", "value": y}] {
+					obj := input.nd_builtin_cache["net.lookup_ip_addr"]
+					y := object.union({k: "4.4.x.x" | obj[k]; startswith(k, "[\"4.4.")},
+					                  {k: obj[k] | obj[k]; not startswith(k, "[\"4.4.")})
+				}
+				`),
+			expMasked: []string{"/nd_builtin_cache/net.lookup_ip_addr", "/nd_builtin_cache/rand.intn"},
+			ndbcache: map[string]interface{}{
+				// Simulate rand.intn("z", 15) call, with output of 7.
+				"rand.intn": map[string]interface{}{"[\"z\",15]": json.Number("7")},
+				"net.lookup_ip_addr": map[string]interface{}{
+					"[\"1.1.1.1\"]": "1.1.1.1",
+					"[\"2.2.2.2\"]": "2.2.2.2",
+					"[\"3.3.3.3\"]": "3.3.3.3",
+					"[\"4.4.4.4\"]": "4.4.4.4",
+				},
+			},
+			ndbc_expected: map[string]interface{}{
+				"rand.intn": "**REDACTED**",
+				"net.lookup_ip_addr": map[string]interface{}{
+					"[\"1.1.1.1\"]": "1.1.1.1",
+					"[\"2.2.2.2\"]": "2.2.2.2",
+					"[\"3.3.3.3\"]": "3.3.3.3",
+					"[\"4.4.4.4\"]": "4.4.x.x",
+				},
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -1561,6 +2060,7 @@ func TestPluginMasking(t *testing.T) {
 					if tc.errManager.Error() != err.Error() {
 						t.Fatalf("expected error %s, but got %s", tc.errManager.Error(), err.Error())
 					}
+					return
 				}
 			}
 
@@ -1576,10 +2076,15 @@ func TestPluginMasking(t *testing.T) {
 			}
 
 			event := &EventV1{
-				Input: &tc.input,
+				Input:          &tc.input,
+				NDBuiltinCache: &tc.ndbcache,
+			}
+			input, err := event.AST()
+			if err != nil {
+				t.Fatal(err)
 			}
 
-			if err := plugin.maskEvent(ctx, nil, event); err != nil {
+			if err := plugin.maskEvent(ctx, nil, input, event); err != nil {
 				t.Fatal(err)
 			}
 
@@ -1587,6 +2092,10 @@ func TestPluginMasking(t *testing.T) {
 				t.Fatalf("Expected %#+v but got %#+v:", tc.expected, *event.Input)
 			}
 
+			if !reflect.DeepEqual(tc.ndbc_expected, *event.NDBuiltinCache) {
+				t.Fatalf("Expected %#+v but got %#+v:", tc.ndbc_expected, *event.NDBuiltinCache)
+			}
+
 			if len(tc.expErased) > 0 {
 				if !reflect.DeepEqual(tc.expErased, event.Erased) {
 					t.Fatalf("Expected erased %v set but got %v", tc.expErased, event.Erased)
@@ -1617,8 +2126,12 @@ func TestPluginMasking(t *testing.T) {
 				event = &EventV1{
 					Input: &tc.input,
 				}
+				input, err := event.AST()
+				if err != nil {
+					t.Fatal(err)
+				}
 
-				if err := plugin.maskEvent(ctx, nil, event); err != nil {
+				if err := plugin.maskEvent(ctx, nil, input, event); err != nil {
 					t.Fatal(err)
 				}
 
@@ -1632,10 +2145,104 @@ func TestPluginMasking(t *testing.T) {
 	}
 }
 
+func TestPluginDrop(t *testing.T) {
+	// Test cases
+	tests := []struct {
+		note      string
+		rawPolicy []byte
+		event     *EventV1
+		expected  bool
+	}{
+		{
+			note: "simple drop",
+			rawPolicy: []byte(`
+			package system.log
+			drop {
+				endswith(input.path, "bar")
+			}`),
+			event: &EventV1{Path: "foo/bar"},
+
+			expected: true,
+		},
+		{
+			note: "no drop",
+			rawPolicy: []byte(`
+			package system.log
+			drop {
+				endswith(input.path, "bar")
+			}`),
+			event:    &EventV1{Path: "foo/foo"},
+			expected: false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			// Setup fixture. Populate store with simple drop policy.
+			ctx := context.Background()
+			store := inmem.New()
+
+			//checks if raw policy is valid and stores policy in store
+			err := storage.Txn(ctx, store, storage.WriteParams, func(txn storage.Transaction) error {
+				if err := store.UpsertPolicy(ctx, txn, "test.rego", tc.rawPolicy); err != nil {
+					return err
+				}
+				return nil
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			var output []string
+
+			// Create and start manager. Start is required so that stored policies
+			// get compiled and made available to the plugin.
+			manager, err := plugins.New(
+				nil,
+				"test",
+				store,
+				plugins.EnablePrintStatements(true),
+				plugins.PrintHook(appendingPrintHook{printed: &output}),
+			)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := manager.Start(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			// Instantiate the plugin.
+			cfg := &Config{Service: "svc"}
+			trigger := plugins.DefaultTriggerMode
+			cfg.validateAndInjectDefaults([]string{"svc"}, nil, &trigger)
+
+			plugin := New(cfg, manager)
+
+			if err := plugin.Start(ctx); err != nil {
+				t.Fatal(err)
+			}
+			input, err := tc.event.AST()
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			drop, err := plugin.dropEvent(ctx, nil, input)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if tc.expected != drop {
+				t.Errorf("Plugin: Expected drop to be %v got %v", tc.expected, drop)
+			}
+		})
+	}
+}
+
 type testFixtureOptions struct {
 	ConsoleLogger                  *test.Logger
 	ReportingUploadSizeLimitBytes  int64
 	ReportingMaxDecisionsPerSecond float64
+	ReportingBufferSizeLimitBytes  int64
 	Resource                       *string
 	TestServerPath                 *string
 	PartitionName                  *string
@@ -1746,6 +2353,10 @@ func newTestFixture(t *testing.T, opts ...testFixtureOptions) testFixture {
 		config.Reporting.UploadSizeLimitBytes = &options.ReportingUploadSizeLimitBytes
 	}
 
+	if options.ReportingBufferSizeLimitBytes != 0 {
+		config.Reporting.BufferSizeLimitBytes = &options.ReportingBufferSizeLimitBytes
+	}
+
 	if s, ok := manager.PluginStatus()[Name]; ok {
 		t.Fatalf("Unexpected status found in plugin manager for %s: %+v", Name, s)
 	}
@@ -1807,16 +2418,6 @@ func TestParseConfigDefaultServiceWithConsole(t *testing.T) {
 	}
 }
 
-func TestParseConfigDefaultServiceWithNoServiceOrConsole(t *testing.T) {
-	loggerConfig := []byte(`{}`)
-
-	_, err := ParseConfig([]byte(loggerConfig), []string{}, nil)
-
-	if err == nil {
-		t.Errorf("Expected an error but err==nil")
-	}
-}
-
 func TestParseConfigTriggerMode(t *testing.T) {
 	cases := []struct {
 		note     string
@@ -1894,6 +2495,13 @@ func TestEventV1ToAST(t *testing.T) {
 		t.Fatalf("Unexpected error: %s", err)
 	}
 
+	var ndbCacheExample interface{} = ast.MustJSON(builtins.NDBCache{
+		"time.now_ns": ast.NewObject([2]*ast.Term{
+			ast.ArrayTerm(),
+			ast.NumberTerm("1663803565571081429"),
+		}),
+	}.AsValue())
+
 	cases := []struct {
 		note  string
 		event EventV1
@@ -2012,6 +2620,44 @@ func TestEventV1ToAST(t *testing.T) {
 			note:  "big event",
 			event: bigEvent,
 		},
+		{
+			note: "event with nd_builtin_cache",
+			event: EventV1{
+				Labels:     map[string]string{"foo": "1", "bar": "2"},
+				DecisionID: "1234567890",
+				Bundles: map[string]BundleInfoV1{
+					"b1": {"revision7"},
+					"b2": {"0"},
+					"b3": {},
+				},
+				Input:          &goInput,
+				Path:           "/http/authz/allow",
+				RequestedBy:    "[::1]:59943",
+				Result:         &result,
+				Timestamp:      time.Now(),
+				inputAST:       astInput,
+				NDBuiltinCache: &ndbCacheExample,
+			},
+		},
+		{
+			note: "event with req id",
+			event: EventV1{
+				Labels:     map[string]string{"foo": "1", "bar": "2"},
+				DecisionID: "1234567890",
+				Bundles: map[string]BundleInfoV1{
+					"b1": {"revision7"},
+					"b2": {"0"},
+					"b3": {},
+				},
+				Input:       &goInput,
+				Path:        "/http/authz/allow",
+				RequestedBy: "[::1]:59943",
+				Result:      &result,
+				Timestamp:   time.Now(),
+				RequestID:   1,
+				inputAST:    astInput,
+			},
+		},
 	}
 
 	for _, tc := range cases {
diff --git a/plugins/logs/status/status.go b/plugins/logs/status/status.go
new file mode 100644
index 0000000000..4a9b24f7bb
--- /dev/null
+++ b/plugins/logs/status/status.go
@@ -0,0 +1,58 @@
+// Copyright 2023 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package status
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/open-policy-agent/opa/metrics"
+)
+
+const (
+	errCode = "decision_log_error"
+)
+
+// Status represents the status of processing a decision log.
+type Status struct {
+	Code     string          `json:"code,omitempty"`
+	Message  string          `json:"message,omitempty"`
+	HTTPCode json.Number     `json:"http_code,omitempty"`
+	Metrics  metrics.Metrics `json:"metrics,omitempty"`
+}
+
+// SetError updates the status object to reflect a failure to upload or
+// process a log. If err is nil, the error status is cleared.
+func (s *Status) SetError(err error) {
+	var httpError HTTPError
+
+	switch {
+	case err == nil:
+		s.Code = ""
+		s.HTTPCode = ""
+		s.Message = ""
+
+	case errors.As(err, &httpError):
+		s.Code = errCode
+		s.HTTPCode = json.Number(strconv.Itoa(httpError.StatusCode))
+		s.Message = err.Error()
+
+	default:
+		s.Code = errCode
+		s.HTTPCode = ""
+		s.Message = err.Error()
+	}
+}
+
+type HTTPError struct {
+	StatusCode int
+}
+
+func (e HTTPError) Error() string {
+	return fmt.Sprintf("log upload failed, server replied with HTTP %v %v", e.StatusCode, http.StatusText(e.StatusCode))
+}
diff --git a/plugins/plugins.go b/plugins/plugins.go
index 89250c935f..019084967e 100644
--- a/plugins/plugins.go
+++ b/plugins/plugins.go
@@ -11,6 +11,9 @@ import (
 	"sync"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
+	"go.opentelemetry.io/otel/sdk/trace"
+
 	"github.com/gorilla/mux"
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
@@ -36,11 +39,11 @@ import (
 // configuration blob. If your plugin has not been configured, your
 // factory will not be invoked.
 //
-//   plugins:
-//     my_plugin1:
-//       some_key: foo
-//     # my_plugin2:
-//     #   some_key2: bar
+//	plugins:
+//	  my_plugin1:
+//	    some_key: foo
+//	  # my_plugin2:
+//	  #   some_key2: bar
 //
 // If OPA was started with the configuration above and received two
 // calls to runtime.RegisterPlugins (one with NAME "my_plugin1" and
@@ -169,7 +172,7 @@ type Manager struct {
 	services                     map[string]rest.Client
 	keys                         map[string]*keys.Config
 	plugins                      []namedplugin
-	registeredTriggers           []func(txn storage.Transaction)
+	registeredTriggers           []func(storage.Transaction)
 	mtx                          sync.Mutex
 	pluginStatus                 map[string]*Status
 	pluginStatusListeners        map[string]StatusListener
@@ -187,6 +190,10 @@ type Manager struct {
 	printHook                    print.Hook
 	enablePrintStatements        bool
 	router                       *mux.Router
+	prometheusRegister           prometheus.Registerer
+	tracerProvider               *trace.TracerProvider
+	registeredNDCacheTriggers    []func(bool)
+	bootstrapConfigLabels        map[string]string
 }
 
 type managerContextKey string
@@ -344,6 +351,20 @@ func WithRouter(r *mux.Router) func(*Manager) {
 	}
 }
 
+// WithPrometheusRegister sets the passed prometheus.Registerer to be used by plugins
+func WithPrometheusRegister(prometheusRegister prometheus.Registerer) func(*Manager) {
+	return func(m *Manager) {
+		m.prometheusRegister = prometheusRegister
+	}
+}
+
+// WithTracerProvider sets the passed *trace.TracerProvider to be used by plugins
+func WithTracerProvider(tracerProvider *trace.TracerProvider) func(*Manager) {
+	return func(m *Manager) {
+		m.tracerProvider = tracerProvider
+	}
+}
+
 // New creates a new Manager using config.
 func New(raw []byte, id string, store storage.Store, opts ...func(*Manager)) (*Manager, error) {
 
@@ -372,6 +393,7 @@ func New(raw []byte, id string, store storage.Store, opts ...func(*Manager)) (*M
 		maxErrors:                    -1,
 		interQueryBuiltinCacheConfig: interQueryBuiltinCacheConfig,
 		serverInitialized:            make(chan struct{}),
+		bootstrapConfigLabels:        parsedConfig.Labels,
 	}
 
 	for _, f := range opts {
@@ -536,7 +558,7 @@ func (m *Manager) GetRouter() *mux.Router {
 
 // RegisterCompilerTrigger registers for change notifications when the compiler
 // is changed.
-func (m *Manager) RegisterCompilerTrigger(f func(txn storage.Transaction)) {
+func (m *Manager) RegisterCompilerTrigger(f func(storage.Transaction)) {
 	m.mtx.Lock()
 	defer m.mtx.Unlock()
 	m.registeredTriggers = append(m.registeredTriggers, f)
@@ -588,8 +610,11 @@ func (m *Manager) Start(ctx context.Context) error {
 	return nil
 }
 
-// Stop stops the manager, stopping all the plugins registered with it. Any plugin that needs to perform cleanup should
-// do so within the duration of the graceful shutdown period passed with the context as a timeout.
+// Stop stops the manager, stopping all the plugins registered with it.
+// Any plugin that needs to perform cleanup should do so within the duration
+// of the graceful shutdown period passed with the context as a timeout.
+// Note that a graceful shutdown period configured with the Manager instance
+// will override the timeout of the passed in context (if applicable).
 func (m *Manager) Stop(ctx context.Context) {
 	var toStop []Plugin
 
@@ -602,11 +627,21 @@ func (m *Manager) Stop(ctx context.Context) {
 		}
 	}()
 
-	ctx, cancel := context.WithTimeout(ctx, time.Duration(m.gracefulShutdownPeriod)*time.Second)
+	var cancel context.CancelFunc
+	if m.gracefulShutdownPeriod > 0 {
+		ctx, cancel = context.WithTimeout(ctx, time.Duration(m.gracefulShutdownPeriod)*time.Second)
+	} else {
+		ctx, cancel = context.WithCancel(ctx)
+	}
 	defer cancel()
 	for i := range toStop {
 		toStop[i].Stop(ctx)
 	}
+	if c, ok := m.Store.(interface{ Close(context.Context) error }); ok {
+		if err := c.Close(ctx); err != nil {
+			m.logger.Error("Error closing store: %v", err)
+		}
+	}
 }
 
 // Reconfigure updates the configuration on the manager.
@@ -635,7 +670,16 @@ func (m *Manager) Reconfigure(config *config.Config) error {
 
 	m.mtx.Lock()
 	defer m.mtx.Unlock()
-	config.Labels = m.Config.Labels // don't overwrite labels
+
+	// don't overwrite existing labels, only allow additions - always based on the boostrap config
+	if config.Labels == nil {
+		config.Labels = m.bootstrapConfigLabels
+	} else {
+		for label, value := range m.bootstrapConfigLabels {
+			config.Labels[label] = value
+		}
+	}
+
 	m.Config = config
 	m.interQueryBuiltinCacheConfig = interQueryBuiltinCacheConfig
 	for name, client := range services {
@@ -650,6 +694,10 @@ func (m *Manager) Reconfigure(config *config.Config) error {
 		trigger(interQueryBuiltinCacheConfig)
 	}
 
+	for _, trigger := range m.registeredNDCacheTriggers {
+		trigger(config.NDBuiltinCache)
+	}
+
 	return nil
 }
 
@@ -799,10 +847,6 @@ func (m *Manager) updateWasmResolversData(ctx context.Context, event storage.Tri
 	m.wasmResolversMtx.Lock()
 	defer m.wasmResolversMtx.Unlock()
 
-	if len(m.wasmResolvers) == 0 {
-		return nil
-	}
-
 	for _, resolver := range m.wasmResolvers {
 		for _, dataEvent := range event.Data {
 			var err error
@@ -885,3 +929,19 @@ func (m *Manager) RegisterCacheTrigger(trigger func(*cache.Config)) {
 	defer m.mtx.Unlock()
 	m.registeredCacheTriggers = append(m.registeredCacheTriggers, trigger)
 }
+
+// PrometheusRegister gets the prometheus.Registerer for this plugin manager.
+func (m *Manager) PrometheusRegister() prometheus.Registerer {
+	return m.prometheusRegister
+}
+
+// TracerProvider gets the *trace.TracerProvider for this plugin manager.
+func (m *Manager) TracerProvider() *trace.TracerProvider {
+	return m.tracerProvider
+}
+
+func (m *Manager) RegisterNDCacheTrigger(trigger func(bool)) {
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+	m.registeredNDCacheTriggers = append(m.registeredNDCacheTriggers, trigger)
+}
diff --git a/plugins/plugins_test.go b/plugins/plugins_test.go
index 7824547515..9ab07d9d7d 100644
--- a/plugins/plugins_test.go
+++ b/plugins/plugins_test.go
@@ -11,12 +11,14 @@ import (
 	"reflect"
 	"testing"
 
+	internal_tracing "github.com/open-policy-agent/opa/internal/distributedtracing"
 	"github.com/open-policy-agent/opa/internal/storage/mock"
 	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/logging/test"
 	"github.com/open-policy-agent/opa/plugins/rest"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/topdown/cache"
+	prom "github.com/prometheus/client_golang/prometheus"
 )
 
 func TestManagerCacheTriggers(t *testing.T) {
@@ -26,7 +28,7 @@ func TestManagerCacheTriggers(t *testing.T) {
 	}
 
 	l1Called := false
-	m.RegisterCacheTrigger(func(c *cache.Config) {
+	m.RegisterCacheTrigger(func(*cache.Config) {
 		l1Called = true
 	})
 
@@ -35,7 +37,7 @@ func TestManagerCacheTriggers(t *testing.T) {
 	}
 
 	l2Called := false
-	m.RegisterCacheTrigger(func(c *cache.Config) {
+	m.RegisterCacheTrigger(func(*cache.Config) {
 		l2Called = true
 	})
 
@@ -57,6 +59,44 @@ func TestManagerCacheTriggers(t *testing.T) {
 	}
 }
 
+func TestManagerNDCacheTriggers(t *testing.T) {
+	m, err := New([]byte{}, "test", inmem.New())
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	l1Called := false
+	m.RegisterNDCacheTrigger(func(bool) {
+		l1Called = true
+	})
+
+	if m.registeredNDCacheTriggers[0] == nil {
+		t.Fatal("First listener failed to register")
+	}
+
+	l2Called := false
+	m.RegisterNDCacheTrigger(func(bool) {
+		l2Called = true
+	})
+
+	if m.registeredNDCacheTriggers[0] == nil || m.registeredNDCacheTriggers[1] == nil {
+		t.Fatal("Second listener failed to register")
+	}
+
+	if l1Called == true || l2Called == true {
+		t.Fatal("Listeners should not be called yet")
+	}
+
+	err = m.Reconfigure(m.Config)
+	if err != nil {
+		t.Fatalf("Unexpected error: %s", err)
+	}
+
+	if l1Called == false || l2Called == false {
+		t.Fatal("Listeners should hav been called")
+	}
+}
+
 func TestManagerPluginStatusListener(t *testing.T) {
 	m, err := New([]byte{}, "test", inmem.New())
 	if err != nil {
@@ -148,16 +188,16 @@ type testPlugin struct {
 	m *Manager
 }
 
-func (p *testPlugin) Start(ctx context.Context) error {
+func (p *testPlugin) Start(context.Context) error {
 	p.m.UpdatePluginStatus("p1", &Status{State: StateOK})
 	return nil
 }
 
-func (p *testPlugin) Stop(ctx context.Context) {
+func (p *testPlugin) Stop(context.Context) {
 	p.m.UpdatePluginStatus("p1", &Status{State: StateNotReady})
 }
 
-func (p *testPlugin) Reconfigure(ctx context.Context, config interface{}) {
+func (p *testPlugin) Reconfigure(context.Context, interface{}) {
 	p.m.UpdatePluginStatus("p1", &Status{State: StateNotReady})
 }
 
@@ -255,6 +295,24 @@ func TestManagerWithCachingConfig(t *testing.T) {
 	}
 }
 
+func TestManagerWithNDCachingConfig(t *testing.T) {
+	m, err := New([]byte(`{"nd_builtin_cache": true}`), "test", inmem.New())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := true
+	if !m.Config.NDBuiltinCache == expected {
+		t.Fatalf("want %+v got %+v", expected, m.Config.NDBuiltinCache)
+	}
+
+	// config error
+	_, err = New([]byte(`{"nd_builtin_cache": "x"}`), "test", inmem.New())
+	if err == nil {
+		t.Fatal("expected error but got nil")
+	}
+}
+
 type mockForInitStartOrdering struct {
 	Manager *Manager
 	Started bool
@@ -340,6 +398,36 @@ func TestPluginManagerConsoleLogger(t *testing.T) {
 	}
 }
 
+func TestPluginManagerPrometheusRegister(t *testing.T) {
+	register := prometheusRegisterMock{Collectors: map[prom.Collector]bool{}}
+	mgr, err := New([]byte(`{}`), "", inmem.New(), WithPrometheusRegister(register))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	counter := prom.NewCounter(prom.CounterOpts{})
+	if err := mgr.PrometheusRegister().Register(counter); err != nil {
+		t.Fatal(err)
+	}
+	if register.Collectors[counter] != true {
+		t.Fatalf("Counter metric was not registered on prometheus")
+	}
+}
+
+func TestPluginManagerTracerProvider(t *testing.T) {
+	_, tracerProvider, err := internal_tracing.Init(context.TODO(), []byte(`{ "distributed_tracing": { "type": "grpc" } }`), "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	m, err := New([]byte(`{}`), "test", inmem.New(), WithTracerProvider(tracerProvider))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if m.TracerProvider() != tracerProvider {
+		t.Fatal("TracerProvider was not configured on plugin manager")
+	}
+}
 func TestPluginManagerServerInitialized(t *testing.T) {
 	// Verify that ServerInitializedChannel is closed when
 	// ServerInitialized is called.
@@ -395,3 +483,23 @@ func (*myAuthPluginMock) Stop(context.Context) {
 }
 func (*myAuthPluginMock) Reconfigure(context.Context, interface{}) {
 }
+
+type prometheusRegisterMock struct {
+	Collectors map[prom.Collector]bool
+}
+
+func (p prometheusRegisterMock) Register(collector prom.Collector) error {
+	p.Collectors[collector] = true
+	return nil
+}
+
+func (p prometheusRegisterMock) MustRegister(collector ...prom.Collector) {
+	for _, c := range collector {
+		p.Collectors[c] = true
+	}
+}
+
+func (p prometheusRegisterMock) Unregister(collector prom.Collector) bool {
+	delete(p.Collectors, collector)
+	return true
+}
diff --git a/plugins/rest/auth.go b/plugins/rest/auth.go
new file mode 100644
index 0000000000..dedbcb8d1b
--- /dev/null
+++ b/plugins/rest/auth.go
@@ -0,0 +1,693 @@
+// Copyright 2019 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package rest
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/open-policy-agent/opa/internal/jwx/jwa"
+	"github.com/open-policy-agent/opa/internal/jwx/jws"
+	"github.com/open-policy-agent/opa/internal/jwx/jws/sign"
+	"github.com/open-policy-agent/opa/internal/providers/aws"
+	"github.com/open-policy-agent/opa/internal/uuid"
+	"github.com/open-policy-agent/opa/keys"
+	"github.com/open-policy-agent/opa/logging"
+)
+
+const (
+	// Default to s3 when the service for sigv4 signing is not specified for backwards compatibility
+	awsSigv4SigningDefaultService = "s3"
+)
+
+// DefaultTLSConfig defines standard TLS configurations based on the Config
+func DefaultTLSConfig(c Config) (*tls.Config, error) {
+	t := &tls.Config{}
+	url, err := url.Parse(c.URL)
+	if err != nil {
+		return nil, err
+	}
+	if url.Scheme == "https" {
+		t.InsecureSkipVerify = c.AllowInsecureTLS
+	}
+
+	if c.TLS != nil && c.TLS.CACert != "" {
+		caCert, err := os.ReadFile(c.TLS.CACert)
+		if err != nil {
+			return nil, err
+		}
+
+		var rootCAs *x509.CertPool
+		if c.TLS.SystemCARequired {
+			rootCAs, err = x509.SystemCertPool()
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			rootCAs = x509.NewCertPool()
+		}
+
+		ok := rootCAs.AppendCertsFromPEM(caCert)
+		if !ok {
+			return nil, errors.New("unable to parse and append CA certificate to certificate pool")
+		}
+		t.RootCAs = rootCAs
+	}
+
+	return t, nil
+}
+
+// DefaultRoundTripperClient is a reasonable set of defaults for HTTP auth plugins
+func DefaultRoundTripperClient(t *tls.Config, timeout int64) *http.Client {
+	// Ensure we use a http.Transport with proper settings: the zero values are not
+	// a good choice, as they cause leaking connections:
+	// https://github.com/golang/go/issues/19620
+
+	// copy, we don't want to alter the default client's Transport
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.ResponseHeaderTimeout = time.Duration(timeout) * time.Second
+	tr.TLSClientConfig = t
+
+	c := *http.DefaultClient
+	c.Transport = tr
+	return &c
+}
+
+// defaultAuthPlugin represents baseline 'no auth' behavior if no alternative plugin is specified for a service
+type defaultAuthPlugin struct{}
+
+func (*defaultAuthPlugin) NewClient(c Config) (*http.Client, error) {
+	t, err := DefaultTLSConfig(c)
+	if err != nil {
+		return nil, err
+	}
+	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
+}
+
+func (*defaultAuthPlugin) Prepare(*http.Request) error {
+	return nil
+}
+
+type serverTLSConfig struct {
+	CACert           string `json:"ca_cert,omitempty"`
+	SystemCARequired bool   `json:"system_ca_required,omitempty"`
+}
+
+// bearerAuthPlugin represents authentication via a bearer token in the HTTP Authorization header
+type bearerAuthPlugin struct {
+	Token     string `json:"token"`
+	TokenPath string `json:"token_path"`
+	Scheme    string `json:"scheme,omitempty"`
+
+	// encode is set to true for the OCIDownloader because
+	// it expects tokens in plain text but needs them in base64.
+	encode bool
+}
+
+func (ap *bearerAuthPlugin) NewClient(c Config) (*http.Client, error) {
+	t, err := DefaultTLSConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	if ap.Token != "" && ap.TokenPath != "" {
+		return nil, errors.New("invalid config: specify a value for either the \"token\" or \"token_path\" field")
+	}
+
+	if ap.Scheme == "" {
+		ap.Scheme = "Bearer"
+	}
+
+	if c.Type == "oci" {
+		// Standard rest clients use the bearer token as it is defined in the Config
+		// but the OCIDownloader needs it encoded to base64 before using to sign a request.
+		ap.encode = true
+	}
+
+	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
+}
+
+func (ap *bearerAuthPlugin) Prepare(req *http.Request) error {
+	token := ap.Token
+
+	if ap.TokenPath != "" {
+		bytes, err := os.ReadFile(ap.TokenPath)
+		if err != nil {
+			return err
+		}
+		token = strings.TrimSpace(string(bytes))
+	}
+
+	if ap.encode {
+		token = base64.StdEncoding.EncodeToString([]byte(token))
+	}
+
+	req.Header.Add("Authorization", fmt.Sprintf("%v %v", ap.Scheme, token))
+	return nil
+}
+
+type tokenEndpointResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	ExpiresIn   int64  `json:"expires_in"`
+}
+
+// oauth2ClientCredentialsAuthPlugin represents authentication via a bearer token in the HTTP Authorization header
+// obtained through the OAuth2 client credentials flow
+type oauth2ClientCredentialsAuthPlugin struct {
+	GrantType            string                 `json:"grant_type"`
+	TokenURL             string                 `json:"token_url"`
+	ClientID             string                 `json:"client_id"`
+	ClientSecret         string                 `json:"client_secret"`
+	SigningKeyID         string                 `json:"signing_key"`
+	Thumbprint           string                 `json:"thumbprint"`
+	Claims               map[string]interface{} `json:"additional_claims"`
+	IncludeJti           bool                   `json:"include_jti_claim"`
+	Scopes               []string               `json:"scopes,omitempty"`
+	AdditionalHeaders    map[string]string      `json:"additional_headers,omitempty"`
+	AdditionalParameters map[string]string      `json:"additional_parameters,omitempty"`
+
+	signingKey       *keys.Config
+	signingKeyParsed interface{}
+	tokenCache       *oauth2Token
+	tlsSkipVerify    bool
+	logger           logging.Logger
+}
+
+type oauth2Token struct {
+	Token     string
+	ExpiresAt time.Time
+}
+
+func (ap *oauth2ClientCredentialsAuthPlugin) createAuthJWT(claims map[string]interface{}, signingKey interface{}) (*string, error) {
+	now := time.Now()
+	baseClaims := map[string]interface{}{
+		"iat": now.Unix(),
+		"exp": now.Add(10 * time.Minute).Unix(),
+	}
+	if claims == nil {
+		claims = make(map[string]interface{})
+	}
+	for k, v := range baseClaims {
+		claims[k] = v
+	}
+
+	if len(ap.Scopes) > 0 {
+		claims["scope"] = strings.Join(ap.Scopes, " ")
+	}
+
+	if ap.IncludeJti {
+		jti, err := uuid.New(rand.Reader)
+		if err != nil {
+			return nil, err
+		}
+		claims["jti"] = jti
+	}
+
+	payload, err := json.Marshal(claims)
+	if err != nil {
+		return nil, err
+	}
+
+	var jwsHeaders []byte
+	if ap.Thumbprint != "" {
+		bytes, err := hex.DecodeString(ap.Thumbprint)
+		if err != nil {
+			return nil, err
+		}
+		x5t := base64.URLEncoding.EncodeToString(bytes)
+		jwsHeaders = []byte(fmt.Sprintf(`{"typ":"JWT","alg":"%s","x5t":"%s"}`, ap.signingKey.Algorithm, x5t))
+	} else {
+		jwsHeaders = []byte(fmt.Sprintf(`{"typ":"JWT","alg":"%s"}`, ap.signingKey.Algorithm))
+	}
+
+	jwsCompact, err := jws.SignLiteral(payload,
+		jwa.SignatureAlgorithm(ap.signingKey.Algorithm),
+		signingKey,
+		jwsHeaders,
+		rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	jwt := string(jwsCompact)
+
+	return &jwt, nil
+}
+
+func (ap *oauth2ClientCredentialsAuthPlugin) parseSigningKey(c Config) (err error) {
+	if ap.SigningKeyID == "" {
+		return errors.New("signing_key required for jwt_bearer grant type")
+	}
+
+	if val, ok := c.keys[ap.SigningKeyID]; ok {
+		if val.PrivateKey == "" {
+			return errors.New("referenced signing_key does not include a private key")
+		}
+		ap.signingKey = val
+	} else {
+		return errors.New("signing_key refers to non-existent key")
+	}
+
+	alg := jwa.SignatureAlgorithm(ap.signingKey.Algorithm)
+	ap.signingKeyParsed, err = sign.GetSigningKey(ap.signingKey.PrivateKey, alg)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (ap *oauth2ClientCredentialsAuthPlugin) NewClient(c Config) (*http.Client, error) {
+	t, err := DefaultTLSConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	if ap.GrantType == "" {
+		// Use client_credentials as default to not break existing config
+		ap.GrantType = grantTypeClientCredentials
+	} else if ap.GrantType != grantTypeClientCredentials && ap.GrantType != grantTypeJwtBearer {
+		return nil, errors.New("grant_type must be either client_credentials or jwt_bearer")
+	}
+
+	if ap.GrantType == grantTypeJwtBearer || (ap.GrantType == grantTypeClientCredentials && ap.SigningKeyID != "") {
+		if err = ap.parseSigningKey(c); err != nil {
+			return nil, err
+		}
+	}
+
+	// Inherit skip verify from the "parent" settings. Should this be configurable on the credentials too?
+	ap.tlsSkipVerify = c.AllowInsecureTLS
+
+	ap.logger = c.logger
+
+	if !strings.HasPrefix(ap.TokenURL, "https://") {
+		return nil, errors.New("token_url required to use https scheme")
+	}
+	if ap.GrantType == grantTypeClientCredentials {
+		if ap.ClientSecret != "" && ap.SigningKeyID != "" {
+			return nil, errors.New("can only use one of client_secret and signing_key for client_credentials")
+		}
+		if ap.SigningKeyID == "" && (ap.ClientID == "" || ap.ClientSecret == "") {
+			return nil, errors.New("client_id and client_secret required")
+		}
+	}
+
+	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
+}
+
+// requestToken tries to obtain an access token using either the client credentials flow
+// https://tools.ietf.org/html/rfc6749#section-4.4
+// or the JWT authorization grant
+// https://tools.ietf.org/html/rfc7523
+func (ap *oauth2ClientCredentialsAuthPlugin) requestToken(ctx context.Context) (*oauth2Token, error) {
+	body := url.Values{}
+	if ap.GrantType == grantTypeJwtBearer {
+		authJwt, err := ap.createAuthJWT(ap.Claims, ap.signingKeyParsed)
+		if err != nil {
+			return nil, err
+		}
+		body.Add("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer")
+		body.Add("assertion", *authJwt)
+	} else {
+		body.Add("grant_type", grantTypeClientCredentials)
+
+		if ap.SigningKeyID != "" {
+			authJwt, err := ap.createAuthJWT(ap.Claims, ap.signingKeyParsed)
+			if err != nil {
+				return nil, err
+			}
+			body.Add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
+			body.Add("client_assertion", *authJwt)
+
+			if ap.ClientID != "" {
+				body.Add("client_id", ap.ClientID)
+			}
+		}
+	}
+
+	if len(ap.Scopes) > 0 {
+		body.Add("scope", strings.Join(ap.Scopes, " "))
+	}
+
+	for k, v := range ap.AdditionalParameters {
+		body.Set(k, v)
+	}
+
+	r, err := http.NewRequestWithContext(ctx, "POST", ap.TokenURL, strings.NewReader(body.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	if ap.GrantType == grantTypeClientCredentials && ap.ClientSecret != "" {
+		r.SetBasicAuth(ap.ClientID, ap.ClientSecret)
+	}
+
+	for k, v := range ap.AdditionalHeaders {
+		r.Header.Add(k, v)
+	}
+
+	client := DefaultRoundTripperClient(&tls.Config{InsecureSkipVerify: ap.tlsSkipVerify}, 10)
+	response, err := client.Do(r)
+	if err != nil {
+		return nil, err
+	}
+
+	bodyRaw, err := io.ReadAll(response.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	if response.StatusCode != 200 {
+		return nil, fmt.Errorf("error in response from OAuth2 token endpoint: %v", string(bodyRaw))
+	}
+
+	var tokenResponse tokenEndpointResponse
+	err = json.Unmarshal(bodyRaw, &tokenResponse)
+	if err != nil {
+		return nil, err
+	}
+
+	if strings.ToLower(tokenResponse.TokenType) != "bearer" {
+		return nil, errors.New("unknown token type returned from token endpoint")
+	}
+
+	return &oauth2Token{
+		Token:     strings.TrimSpace(tokenResponse.AccessToken),
+		ExpiresAt: time.Now().Add(time.Duration(tokenResponse.ExpiresIn) * time.Second),
+	}, nil
+}
+
+func (ap *oauth2ClientCredentialsAuthPlugin) Prepare(req *http.Request) error {
+	minTokenLifetime := float64(10)
+	if ap.tokenCache == nil || time.Until(ap.tokenCache.ExpiresAt).Seconds() < minTokenLifetime {
+		ap.logger.Debug("Requesting token from token_url %v", ap.TokenURL)
+		token, err := ap.requestToken(req.Context())
+		if err != nil {
+			return err
+		}
+		ap.tokenCache = token
+	}
+
+	req.Header.Add("Authorization", fmt.Sprintf("Bearer %v", ap.tokenCache.Token))
+	return nil
+}
+
+// clientTLSAuthPlugin represents authentication via client certificate on a TLS connection
+type clientTLSAuthPlugin struct {
+	Cert                 string `json:"cert"`
+	PrivateKey           string `json:"private_key"`
+	PrivateKeyPassphrase string `json:"private_key_passphrase,omitempty"`
+	CACert               string `json:"ca_cert,omitempty"`            // Deprecated: Use `services[_].tls.ca_cert` instead
+	SystemCARequired     bool   `json:"system_ca_required,omitempty"` // Deprecated: Use `services[_].tls.system_ca_required` instead
+}
+
+func (ap *clientTLSAuthPlugin) NewClient(c Config) (*http.Client, error) {
+	tlsConfig, err := DefaultTLSConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	if ap.Cert == "" {
+		return nil, errors.New("client certificate is needed when client TLS is enabled")
+	}
+	if ap.PrivateKey == "" {
+		return nil, errors.New("private key is needed when client TLS is enabled")
+	}
+
+	var keyPEMBlock []byte
+	data, err := os.ReadFile(ap.PrivateKey)
+	if err != nil {
+		return nil, err
+	}
+
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, errors.New("PEM data could not be found")
+	}
+
+	// nolint: staticcheck // We don't want to forbid users from using this encryption.
+	if x509.IsEncryptedPEMBlock(block) {
+		if ap.PrivateKeyPassphrase == "" {
+			return nil, errors.New("client certificate passphrase is needed, because the certificate is password encrypted")
+		}
+		// nolint: staticcheck // We don't want to forbid users from using this encryption.
+		block, err := x509.DecryptPEMBlock(block, []byte(ap.PrivateKeyPassphrase))
+		if err != nil {
+			return nil, err
+		}
+		key, err := x509.ParsePKCS8PrivateKey(block)
+		if err != nil {
+			key, err = x509.ParsePKCS1PrivateKey(block)
+			if err != nil {
+				return nil, fmt.Errorf("private key should be a PEM or plain PKCS1 or PKCS8; parse error: %v", err)
+			}
+		}
+		rsa, ok := key.(*rsa.PrivateKey)
+		if !ok {
+			return nil, errors.New("private key is invalid")
+		}
+		keyPEMBlock = pem.EncodeToMemory(
+			&pem.Block{
+				Type:  "RSA PRIVATE KEY",
+				Bytes: x509.MarshalPKCS1PrivateKey(rsa),
+			},
+		)
+	} else {
+		keyPEMBlock = data
+	}
+
+	certPEMBlock, err := os.ReadFile(ap.Cert)
+	if err != nil {
+		return nil, err
+	}
+
+	cert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
+	if err != nil {
+		return nil, err
+	}
+	tlsConfig.Certificates = []tls.Certificate{cert}
+
+	var client *http.Client
+
+	if c.TLS != nil && c.TLS.CACert != "" {
+		client = DefaultRoundTripperClient(tlsConfig, *c.ResponseHeaderTimeoutSeconds)
+	} else {
+		if ap.CACert != "" {
+			c.logger.Warn("Deprecated 'services[_].credentials.client_tls.ca_cert' configuration specified. Use 'services[_].tls.ca_cert' instead. See https://www.openpolicyagent.org/docs/latest/configuration/#services")
+			caCert, err := os.ReadFile(ap.CACert)
+			if err != nil {
+				return nil, err
+			}
+
+			var caCertPool *x509.CertPool
+			if ap.SystemCARequired {
+				caCertPool, err = x509.SystemCertPool()
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				caCertPool = x509.NewCertPool()
+			}
+
+			ok := caCertPool.AppendCertsFromPEM(caCert)
+			if !ok {
+				return nil, errors.New("unable to parse and append CA certificate to certificate pool")
+			}
+			tlsConfig.RootCAs = caCertPool
+		}
+
+		client = DefaultRoundTripperClient(tlsConfig, *c.ResponseHeaderTimeoutSeconds)
+	}
+
+	return client, nil
+}
+
+func (ap *clientTLSAuthPlugin) Prepare(req *http.Request) error {
+	return nil
+}
+
+// awsSigningAuthPlugin represents authentication using AWS V4 HMAC signing in the Authorization header
+type awsSigningAuthPlugin struct {
+	AWSEnvironmentCredentials *awsEnvironmentCredentialService `json:"environment_credentials,omitempty"`
+	AWSMetadataCredentials    *awsMetadataCredentialService    `json:"metadata_credentials,omitempty"`
+	AWSWebIdentityCredentials *awsWebIdentityCredentialService `json:"web_identity_credentials,omitempty"`
+	AWSProfileCredentials     *awsProfileCredentialService     `json:"profile_credentials,omitempty"`
+
+	AWSService          string `json:"service,omitempty"`
+	AWSSignatureVersion string `json:"signature_version,omitempty"`
+
+	ecrAuthPlugin *ecrAuthPlugin
+
+	logger logging.Logger
+}
+
+type awsCredentialServiceChain struct {
+	awsCredentialServices []awsCredentialService
+	logger                logging.Logger
+}
+
+func (acs *awsCredentialServiceChain) addService(service awsCredentialService) {
+	acs.awsCredentialServices = append(acs.awsCredentialServices, service)
+}
+
+func (acs *awsCredentialServiceChain) credentials(ctx context.Context) (aws.Credentials, error) {
+	for _, service := range acs.awsCredentialServices {
+		credential, err := service.credentials(ctx)
+		if err != nil {
+			acs.logger.Debug("awsSigningAuthPlugin:%T failed: %v", service, err)
+
+			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+				return aws.Credentials{}, err
+			}
+
+			continue
+		}
+
+		acs.logger.Debug("awsSigningAuthPlugin:%T successful", service)
+		return credential, nil
+	}
+
+	return aws.Credentials{}, errors.New("all AWS credential providers failed")
+}
+
+func (ap *awsSigningAuthPlugin) awsCredentialService() awsCredentialService {
+	chain := awsCredentialServiceChain{
+		logger: ap.logger,
+	}
+
+	/*
+		Here we maintain the order of addition to the chain inline with
+		the order of credential providers followed by default by the
+		AWS SDK. For example
+
+		https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.html
+	*/
+
+	if ap.AWSEnvironmentCredentials != nil {
+		ap.AWSEnvironmentCredentials.logger = ap.logger
+		chain.addService(ap.AWSEnvironmentCredentials)
+	}
+
+	if ap.AWSWebIdentityCredentials != nil {
+		ap.AWSWebIdentityCredentials.logger = ap.logger
+		chain.addService(ap.AWSWebIdentityCredentials)
+	}
+
+	if ap.AWSProfileCredentials != nil {
+		ap.AWSProfileCredentials.logger = ap.logger
+		chain.addService(ap.AWSProfileCredentials)
+	}
+
+	if ap.AWSMetadataCredentials != nil {
+		ap.AWSMetadataCredentials.logger = ap.logger
+		chain.addService(ap.AWSMetadataCredentials)
+	}
+
+	return &chain
+}
+
+func (ap *awsSigningAuthPlugin) NewClient(c Config) (*http.Client, error) {
+	t, err := DefaultTLSConfig(c)
+	if err != nil {
+		return nil, err
+	}
+
+	if ap.logger == nil {
+		ap.logger = c.logger
+	}
+
+	if err := ap.validateAndSetDefaults(c.Type); err != nil {
+		return nil, err
+	}
+
+	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
+}
+
+func (ap *awsSigningAuthPlugin) Prepare(req *http.Request) error {
+	switch ap.AWSService {
+	case "ecr":
+		return ap.ecrAuthPlugin.Prepare(req)
+	default:
+		creds, err := ap.awsCredentialService().credentials(req.Context())
+		if err != nil {
+			return fmt.Errorf("failed to get aws credentials: %w", err)
+		}
+
+		ap.logger.Debug("Signing request with AWS credentials.")
+
+		return aws.SignRequest(req, ap.AWSService, creds, time.Now(), ap.AWSSignatureVersion)
+	}
+}
+
+func (ap *awsSigningAuthPlugin) validateAndSetDefaults(serviceType string) error {
+	cfgs := map[bool]int{}
+	cfgs[ap.AWSEnvironmentCredentials != nil]++
+	cfgs[ap.AWSMetadataCredentials != nil]++
+	cfgs[ap.AWSWebIdentityCredentials != nil]++
+	cfgs[ap.AWSProfileCredentials != nil]++
+
+	if cfgs[true] == 0 {
+		return errors.New("a AWS credential service must be specified when S3 signing is enabled")
+	}
+
+	if ap.AWSMetadataCredentials != nil {
+		if ap.AWSMetadataCredentials.RegionName == "" {
+			return errors.New("at least aws_region must be specified for AWS metadata credential service")
+		}
+	}
+
+	if ap.AWSWebIdentityCredentials != nil {
+		if err := ap.AWSWebIdentityCredentials.populateFromEnv(); err != nil {
+			return err
+		}
+	}
+
+	ap.AWSService = strings.ToLower(ap.AWSService)
+
+	// Only allow ECR for OCI service types
+	if serviceType == "oci" {
+		if ap.AWSService == "" {
+			ap.AWSService = "ecr"
+		}
+
+		if ap.AWSService != "ecr" {
+			return fmt.Errorf(`cannot use aws service %q with service type "oci"`, ap.AWSService)
+		}
+
+		// We need to setup a special auth plugin for ECR.
+		ap.ecrAuthPlugin = newECRAuthPlugin(ap)
+	} else {
+		// Disallow ECR for non-OCI service types
+		if ap.AWSService == "ecr" {
+			return errors.New(`aws service "ecr" must be used with service type "oci"`)
+		}
+		if ap.AWSService == "" {
+			ap.AWSService = awsSigv4SigningDefaultService
+		}
+	}
+
+	if ap.AWSSignatureVersion == "" {
+		ap.AWSSignatureVersion = "4"
+	}
+
+	return nil
+}
diff --git a/plugins/rest/auth_test.go b/plugins/rest/auth_test.go
new file mode 100644
index 0000000000..ddfc5db10f
--- /dev/null
+++ b/plugins/rest/auth_test.go
@@ -0,0 +1,93 @@
+package rest
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/keys"
+)
+
+func TestOCIWithAWSAuthSetsUpECRAuthPlugin(t *testing.T) {
+	conf := `{
+		"type": "oci",
+		"credentials": {
+			"s3_signing": {
+				"environment_credentials": {}
+			}
+		}
+	}`
+
+	client, err := New([]byte(conf), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatalf("New() = %v", err)
+	}
+
+	if _, err := client.config.Credentials.S3Signing.NewClient(client.config); err != nil {
+		t.Fatalf("S3Signing.NewClient() = %q", err)
+	}
+
+	if client.config.Credentials.S3Signing.AWSService != "ecr" {
+		t.Errorf("S3Signing.AWSService = %v, want = %v", client.config.Credentials.S3Signing.AWSService, "ecr")
+	}
+
+	if client.config.Credentials.S3Signing.ecrAuthPlugin == nil {
+		t.Errorf("S3Signing.ecrAuthPlugin isn't setup")
+	}
+}
+
+func TestOCIWithAWSWrongService(t *testing.T) {
+	conf := `{
+		"type": "oci",
+		"credentials": {
+			"s3_signing": {
+				"service": "ec2",
+				"environment_credentials": {}
+			}
+		}
+	}`
+
+	client, err := New([]byte(conf), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatalf("New() = %q", err)
+	}
+
+	{
+		_, err := client.config.Credentials.S3Signing.NewClient(client.config)
+		if err == nil {
+			t.Fatalf("S3Signing.NewClient(): expected error")
+		}
+
+		wantContains := "ec2"
+		if !strings.Contains(err.Error(), wantContains) {
+			t.Errorf("got: %q, should contain: %q", err.Error(), wantContains)
+		}
+	}
+}
+
+func TestECRWithoutOCIFails(t *testing.T) {
+	conf := `{
+		"credentials": {
+			"s3_signing": {
+				"service": "ecr",
+				"environment_credentials": {}
+			}
+		}
+	}`
+
+	client, err := New([]byte(conf), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatalf("New() = %q", err)
+	}
+
+	{
+		_, err := client.config.Credentials.S3Signing.NewClient(client.config)
+		if err == nil {
+			t.Fatal("S3Signing.NewClient(): expected error")
+		}
+
+		wantContains := "oci"
+		if !strings.Contains(err.Error(), wantContains) {
+			t.Fatalf("S3Signing.NewClient() = %q, should contain = %q", err, wantContains)
+		}
+	}
+}
diff --git a/plugins/rest/aws.go b/plugins/rest/aws.go
index f583769591..bef903e6bf 100644
--- a/plugins/rest/aws.go
+++ b/plugins/rest/aws.go
@@ -5,24 +5,20 @@
 package rest
 
 import (
-	"bytes"
-	"crypto/hmac"
-	"crypto/sha256"
+	"context"
 	"encoding/json"
 	"encoding/xml"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
-	"sort"
 	"strings"
 	"time"
 
 	"github.com/go-ini/ini"
-
+	"github.com/open-policy-agent/opa/internal/providers/aws"
 	"github.com/open-policy-agent/opa/logging"
 )
 
@@ -58,26 +54,9 @@ const (
 	securityTokenGlobalSetting = "aws_session_token"
 )
 
-// Headers that may be mutated before reaching an aws service (eg by a proxy) should be added here to omit them from
-// the sigv4 canonical request
-// ref. https://github.com/aws/aws-sdk-go/blob/master/aws/signer/v4/v4.go#L92
-var awsSigv4IgnoredHeaders = map[string]bool{
-	"authorization":   true,
-	"user-agent":      true,
-	"x-amzn-trace-id": true,
-}
-
-// awsCredentials represents the credentials obtained from an AWS credential provider
-type awsCredentials struct {
-	AccessKey    string
-	SecretKey    string
-	RegionName   string
-	SessionToken string
-}
-
 // awsCredentialService represents the interface for AWS credential providers
 type awsCredentialService interface {
-	credentials() (awsCredentials, error)
+	credentials(context.Context) (aws.Credentials, error)
 }
 
 // awsEnvironmentCredentialService represents an static environment-variable credential provider for AWS
@@ -85,8 +64,8 @@ type awsEnvironmentCredentialService struct {
 	logger logging.Logger
 }
 
-func (cs *awsEnvironmentCredentialService) credentials() (awsCredentials, error) {
-	var creds awsCredentials
+func (cs *awsEnvironmentCredentialService) credentials(context.Context) (aws.Credentials, error) {
+	var creds aws.Credentials
 	creds.AccessKey = os.Getenv(accessKeyEnvVar)
 	if creds.AccessKey == "" {
 		return creds, errors.New("no " + accessKeyEnvVar + " set in environment")
@@ -133,8 +112,8 @@ type awsProfileCredentialService struct {
 	logger logging.Logger
 }
 
-func (cs *awsProfileCredentialService) credentials() (awsCredentials, error) {
-	var creds awsCredentials
+func (cs *awsProfileCredentialService) credentials(context.Context) (aws.Credentials, error) {
+	var creds aws.Credentials
 
 	filename, err := cs.path()
 	if err != nil {
@@ -161,7 +140,7 @@ func (cs *awsProfileCredentialService) credentials() (awsCredentials, error) {
 		return creds, fmt.Errorf("profile \"%v\" in credentials file %v does not contain \"%v\"", cs.Profile, cs.Path, secretKeyGlobalSetting)
 	}
 
-	creds.SessionToken = profile.Key(securityTokenGlobalSetting).String() //default to empty string
+	creds.SessionToken = profile.Key(securityTokenGlobalSetting).String() // default to empty string
 
 	if cs.RegionName == "" {
 		if cs.RegionName = os.Getenv(awsRegionEnvVar); cs.RegionName == "" {
@@ -210,7 +189,7 @@ func (cs *awsProfileCredentialService) profile() string {
 type awsMetadataCredentialService struct {
 	RoleName        string `json:"iam_role,omitempty"`
 	RegionName      string `json:"aws_region"`
-	creds           awsCredentials
+	creds           aws.Credentials
 	expiration      time.Time
 	credServicePath string
 	tokenPath       string
@@ -237,13 +216,13 @@ func (cs *awsMetadataCredentialService) urlForMetadataService() (string, error)
 	return "", errors.New("metadata endpoint cannot be determined from settings and environment")
 }
 
-func (cs *awsMetadataCredentialService) tokenRequest() (*http.Request, error) {
+func (cs *awsMetadataCredentialService) tokenRequest(ctx context.Context) (*http.Request, error) {
 	tokenURL := ec2DefaultTokenPath
 	if cs.tokenPath != "" {
 		// override for testing
 		tokenURL = cs.tokenPath
 	}
-	req, err := http.NewRequest(http.MethodPut, tokenURL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, tokenURL, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -253,7 +232,7 @@ func (cs *awsMetadataCredentialService) tokenRequest() (*http.Request, error) {
 	return req, nil
 }
 
-func (cs *awsMetadataCredentialService) refreshFromService() error {
+func (cs *awsMetadataCredentialService) refreshFromService(ctx context.Context) error {
 	// define the expected JSON payload from the EC2 credential service
 	// ref. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
 	type metadataPayload struct {
@@ -264,8 +243,10 @@ func (cs *awsMetadataCredentialService) refreshFromService() error {
 		Expiration      time.Time
 	}
 
-	// short circuit if a reasonable amount of time until credential expiration remains
-	if time.Now().Add(time.Minute * 5).Before(cs.expiration) {
+	// Short circuit if a reasonable amount of time until credential expiration remains
+	const tokenExpirationMargin = 5 * time.Minute
+
+	if time.Now().Add(tokenExpirationMargin).Before(cs.expiration) {
 		cs.logger.Debug("Credentials previously obtained from metadata service still valid.")
 		return nil
 	}
@@ -279,7 +260,7 @@ func (cs *awsMetadataCredentialService) refreshFromService() error {
 
 	// construct an HTTP client with a reasonably short timeout
 	client := &http.Client{Timeout: time.Second * 10}
-	req, err := http.NewRequest(http.MethodGet, metaDataURL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, metaDataURL, nil)
 	if err != nil {
 		return errors.New("unable to construct metadata HTTP request: " + err.Error())
 	}
@@ -288,11 +269,11 @@ func (cs *awsMetadataCredentialService) refreshFromService() error {
 	// PUT request on the token endpoint before it will give the credentials, this provides
 	// protection from SSRF attacks
 	if !isECS() {
-		tokenReq, err := cs.tokenRequest()
+		tokenReq, err := cs.tokenRequest(ctx)
 		if err != nil {
 			return errors.New("unable to construct metadata token HTTP request: " + err.Error())
 		}
-		body, err := doMetaDataRequestWithClient(tokenReq, client, "metadata token", cs.logger)
+		body, err := aws.DoRequestWithClient(tokenReq, client, "metadata token", cs.logger)
 		if err != nil {
 			return err
 		}
@@ -300,7 +281,7 @@ func (cs *awsMetadataCredentialService) refreshFromService() error {
 		req.Header.Set("X-aws-ec2-metadata-token", string(body))
 	}
 
-	body, err := doMetaDataRequestWithClient(req, client, "metadata", cs.logger)
+	body, err := aws.DoRequestWithClient(req, client, "metadata", cs.logger)
 	if err != nil {
 		return err
 	}
@@ -327,8 +308,8 @@ func (cs *awsMetadataCredentialService) refreshFromService() error {
 	return nil
 }
 
-func (cs *awsMetadataCredentialService) credentials() (awsCredentials, error) {
-	err := cs.refreshFromService()
+func (cs *awsMetadataCredentialService) credentials(ctx context.Context) (aws.Credentials, error) {
+	err := cs.refreshFromService(ctx)
 	if err != nil {
 		return cs.creds, err
 	}
@@ -342,7 +323,7 @@ type awsWebIdentityCredentialService struct {
 	RegionName           string `json:"aws_region"`
 	SessionName          string `json:"session_name"`
 	stsURL               string
-	creds                awsCredentials
+	creds                aws.Credentials
 	expiration           time.Time
 	logger               logging.Logger
 }
@@ -378,7 +359,7 @@ func (cs *awsWebIdentityCredentialService) stsPath() string {
 	return stsPath
 }
 
-func (cs *awsWebIdentityCredentialService) refreshFromService() error {
+func (cs *awsWebIdentityCredentialService) refreshFromService(ctx context.Context) error {
 	// define the expected JSON payload from the EC2 credential service
 	// ref. https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html
 	type responsePayload struct {
@@ -407,7 +388,7 @@ func (cs *awsWebIdentityCredentialService) refreshFromService() error {
 		sessionName = cs.SessionName
 	}
 
-	tokenData, err := ioutil.ReadFile(cs.WebIdentityTokenFile)
+	tokenData, err := os.ReadFile(cs.WebIdentityTokenFile)
 	if err != nil {
 		return errors.New("unable to read web token for sts HTTP request: " + err.Error())
 	}
@@ -425,14 +406,14 @@ func (cs *awsWebIdentityCredentialService) refreshFromService() error {
 
 	// construct an HTTP client with a reasonably short timeout
 	client := &http.Client{Timeout: time.Second * 10}
-	req, err := http.NewRequest(http.MethodPost, stsRequestURL.String(), strings.NewReader(queryVals.Encode()))
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, stsRequestURL.String(), strings.NewReader(queryVals.Encode()))
 	if err != nil {
 		return errors.New("unable to construct STS HTTP request: " + err.Error())
 	}
 
 	req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 
-	body, err := doMetaDataRequestWithClient(req, client, "STS", cs.logger)
+	body, err := aws.DoRequestWithClient(req, client, "STS", cs.logger)
 	if err != nil {
 		return err
 	}
@@ -452,8 +433,8 @@ func (cs *awsWebIdentityCredentialService) refreshFromService() error {
 	return nil
 }
 
-func (cs *awsWebIdentityCredentialService) credentials() (awsCredentials, error) {
-	err := cs.refreshFromService()
+func (cs *awsWebIdentityCredentialService) credentials(ctx context.Context) (aws.Credentials, error) {
+	err := cs.refreshFromService(ctx)
 	if err != nil {
 		return cs.creds, err
 	}
@@ -466,171 +447,59 @@ func isECS() bool {
 	return isECS
 }
 
-func doMetaDataRequestWithClient(req *http.Request, client *http.Client, desc string, logger logging.Logger) ([]byte, error) {
-	// convenience function to get the body of an AWS EC2 metadata service request with
-	// appropriate error-handling boilerplate and logging for this special case
-	resp, err := client.Do(req)
-	if err != nil {
-		// some kind of catastrophe talking to the EC2 service
-		return nil, errors.New(desc + " HTTP request failed: " + err.Error())
-	}
-	defer resp.Body.Close()
-
-	logger.WithFields(map[string]interface{}{
-		"url":     req.URL.String(),
-		"status":  resp.Status,
-		"headers": resp.Header,
-	}).Debug("Received response from " + desc + " service.")
-
-	if resp.StatusCode != 200 {
-		if logger.GetLevel() == logging.Debug {
-			body, err := ioutil.ReadAll(resp.Body)
-			if err != nil {
-				logger.Debug("Error response with response body: %v", body)
-			}
-		}
-		// could be 404 for role that's not available, but cover all the bases
-		return nil, errors.New(desc + " HTTP request returned unexpected status: " + resp.Status)
-	}
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		// deal with problems reading the body, whatever those might be
-		return nil, errors.New(desc + " HTTP response body could not be read: " + err.Error())
-	}
-	return body, nil
-}
+// ecrAuthPlugin authorizes requests to AWS ECR.
+type ecrAuthPlugin struct {
+	token aws.ECRAuthorizationToken
 
-func sha256MAC(message []byte, key []byte) []byte {
-	mac := hmac.New(sha256.New, key)
-	mac.Write(message)
-	return mac.Sum(nil)
-}
+	// awsAuthPlugin is used to sign ecr authorization token requests.
+	awsAuthPlugin *awsSigningAuthPlugin
 
-func sortKeys(strMap map[string][]string) []string {
-	keys := make([]string, len(strMap))
+	// ecr represents the service we request tokens from.
+	ecr ecr
 
-	i := 0
-	for k := range strMap {
-		keys[i] = k
-		i++
-	}
-	sort.Strings(keys)
-	return keys
+	logger logging.Logger
 }
 
-// signV4 modifies an http.Request to include an AWS V4 signature based on a credential provider
-func signV4(req *http.Request, service string, credService awsCredentialService, theTime time.Time) error {
-	// General ref. https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
-	// S3 ref. https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
-	// APIGateway ref. https://docs.aws.amazon.com/apigateway/api-reference/signing-requests/
-
-	var body []byte
-	if req.Body == nil {
-		body = []byte("")
-	} else {
-		var err error
-		body, err = ioutil.ReadAll(req.Body)
-		if err != nil {
-			return errors.New("error getting request body: " + err.Error())
-		}
-		// Since ReadAll consumed the body ReadCloser, we must create a new ReadCloser for the request so that the
-		// subsequent read starts from the beginning
-		req.Body = ioutil.NopCloser(bytes.NewReader(body))
-	}
-	creds, err := credService.credentials()
-	if err != nil {
-		return errors.New("error getting AWS credentials: " + err.Error())
-	}
-
-	bodyHexHash := fmt.Sprintf("%x", sha256.Sum256(body))
-
-	now := theTime.UTC()
-
-	// V4 signing has specific ideas of how it wants to see dates/times encoded
-	dateNow := now.Format("20060102")
-	iso8601Now := now.Format("20060102T150405Z")
-
-	awsHeaders := map[string]string{
-		"host":       req.URL.Host,
-		"x-amz-date": iso8601Now,
-	}
-
-	// s3 and glacier require the extra x-amz-content-sha256 header. other services do not.
-	if service == "s3" || service == "glacier" {
-		awsHeaders["x-amz-content-sha256"] = bodyHexHash
-	}
-
-	// the security token header is necessary for ephemeral credentials, e.g. from
-	// the EC2 metadata service
-	if creds.SessionToken != "" {
-		awsHeaders["x-amz-security-token"] = creds.SessionToken
-	}
-
-	headersToSign := map[string][]string{}
+type ecr interface {
+	GetAuthorizationToken(context.Context, aws.Credentials, string) (aws.ECRAuthorizationToken, error)
+}
 
-	// sign all of the aws headers
-	for k, v := range awsHeaders {
-		headersToSign[k] = []string{v}
+func newECRAuthPlugin(ap *awsSigningAuthPlugin) *ecrAuthPlugin {
+	return &ecrAuthPlugin{
+		awsAuthPlugin: ap,
+		ecr:           aws.NewECR(ap.logger),
+		logger:        ap.logger,
 	}
+}
 
-	// sign all of the request's headers, except for those in the ignore list
-	for k, v := range req.Header {
-		lowerCaseHeader := strings.ToLower(k)
-		if !awsSigv4IgnoredHeaders[lowerCaseHeader] {
-			headersToSign[lowerCaseHeader] = v
+// Prepare should be called with any request to AWS ECR.
+// It takes care of retrieving an ECR authorization token to sign
+// the request with.
+func (ap *ecrAuthPlugin) Prepare(r *http.Request) error {
+	if !ap.token.IsValid() {
+		ap.logger.Debug("Refreshing ECR auth token")
+		if err := ap.refreshAuthorizationToken(r.Context()); err != nil {
+			return err
 		}
 	}
 
-	// the "canonical request" is the normalized version of the AWS service access
-	// that we're attempting to perform; in this case, a GET from an S3 bucket
-	canonicalReq := req.Method + "\n"            // HTTP method
-	canonicalReq += req.URL.EscapedPath() + "\n" // URI-escaped path
-	canonicalReq += "\n"                         // query string; not implemented
-
-	// include the values for the signed headers
-	orderedKeys := sortKeys(headersToSign)
-	for _, k := range orderedKeys {
-		canonicalReq += k + ":" + strings.Join(headersToSign[k], ",") + "\n"
-	}
-	canonicalReq += "\n" // linefeed to terminate headers
-
-	// include the list of the signed headers
-	headerList := strings.Join(orderedKeys, ";")
-	canonicalReq += headerList + "\n"
-	canonicalReq += bodyHexHash
-
-	// the "string to sign" is a time-bounded, scoped request token which
-	// is linked to the "canonical request" by inclusion of its SHA-256 hash
-	strToSign := "AWS4-HMAC-SHA256\n"                                                 // V4 signing with SHA-256 HMAC
-	strToSign += iso8601Now + "\n"                                                    // ISO 8601 time
-	strToSign += dateNow + "/" + creds.RegionName + "/" + service + "/aws4_request\n" // scoping for signature
-	strToSign += fmt.Sprintf("%x", sha256.Sum256([]byte(canonicalReq)))               // SHA-256 of canonical request
-
-	// the "signing key" is generated by repeated HMAC-SHA256 based on the same
-	// scoping that's included in the "string to sign"; but including the secret key
-	// to allow AWS to validate it
-	signingKey := sha256MAC([]byte(dateNow), []byte("AWS4"+creds.SecretKey))
-	signingKey = sha256MAC([]byte(creds.RegionName), signingKey)
-	signingKey = sha256MAC([]byte(service), signingKey)
-	signingKey = sha256MAC([]byte("aws4_request"), signingKey)
+	ap.logger.Debug("Signing request with ECR authorization token")
 
-	// the "signature" is finally the "string to sign" signed by the "signing key"
-	signature := sha256MAC([]byte(strToSign), signingKey)
-
-	// required format of Authorization header; n.b. the access key corresponding to
-	// the secret key is included here
-	authHdr := "AWS4-HMAC-SHA256 Credential=" + creds.AccessKey + "/" + dateNow
-	authHdr += "/" + creds.RegionName + "/" + service + "/aws4_request,"
-	authHdr += "SignedHeaders=" + headerList + ","
-	authHdr += "Signature=" + fmt.Sprintf("%x", signature)
+	r.Header.Set("Authorization", fmt.Sprintf("Basic %s", ap.token.AuthorizationToken))
+	return nil
+}
 
-	// add the computed Authorization
-	req.Header.Set("Authorization", authHdr)
+func (ap *ecrAuthPlugin) refreshAuthorizationToken(ctx context.Context) error {
+	creds, err := ap.awsAuthPlugin.awsCredentialService().credentials(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get aws credentials: %w", err)
+	}
 
-	// populate the other signed headers into the request
-	for k := range awsHeaders {
-		req.Header.Add(k, awsHeaders[k])
+	token, err := ap.ecr.GetAuthorizationToken(ctx, creds, ap.awsAuthPlugin.AWSSignatureVersion)
+	if err != nil {
+		return fmt.Errorf("ecr: failed to get authorization token: %w", err)
 	}
 
+	ap.token = token
 	return nil
 }
diff --git a/plugins/rest/aws_test.go b/plugins/rest/aws_test.go
index e1d5ca6a3a..79b83a08a0 100644
--- a/plugins/rest/aws_test.go
+++ b/plugins/rest/aws_test.go
@@ -5,9 +5,11 @@
 package rest
 
 import (
+	"context"
+	"crypto/rand"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -16,9 +18,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/open-policy-agent/opa/util/test"
-
+	"github.com/open-policy-agent/opa/internal/providers/aws"
 	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/util/test"
 )
 
 // this is usually private; but we need it here
@@ -30,13 +32,22 @@ type metadataPayload struct {
 	Expiration      time.Time
 }
 
-// quicky and dirty assertions
+// quick and dirty assertions
 func assertEq(expected string, actual string, t *testing.T) {
 	t.Helper()
 	if actual != expected {
 		t.Error("expected: ", expected, " but got: ", actual)
 	}
 }
+func assertIn(candidates []string, actual string, t *testing.T) {
+	t.Helper()
+	for _, expected := range candidates {
+		if actual == expected {
+			return
+		}
+	}
+	t.Error("value: '", actual, "' not found in: ", candidates)
+}
 
 func assertErr(expected string, actual error, t *testing.T) {
 	t.Helper()
@@ -46,33 +57,23 @@ func assertErr(expected string, actual error, t *testing.T) {
 }
 
 func TestEnvironmentCredentialService(t *testing.T) {
-	reset := func() {
-		os.Unsetenv("AWS_ACCESS_KEY_ID")
-		os.Unsetenv("AWS_SECRET_ACCESS_KEY")
-		os.Unsetenv("AWS_REGION")
-		os.Unsetenv("AWS_SECURITY_TOKEN")
-		os.Unsetenv("AWS_SESSION_TOKEN")
-	}
-	reset()
-	t.Cleanup(reset) // reset again when we're done
-
 	cs := &awsEnvironmentCredentialService{}
 
 	// wrong path: some required environment is missing
-	_, err := cs.credentials()
+	_, err := cs.credentials(context.Background())
 	assertErr("no AWS_ACCESS_KEY_ID set in environment", err, t)
 
-	os.Setenv("AWS_ACCESS_KEY_ID", "MYAWSACCESSKEYGOESHERE")
-	_, err = cs.credentials()
+	t.Setenv("AWS_ACCESS_KEY_ID", "MYAWSACCESSKEYGOESHERE")
+	_, err = cs.credentials(context.Background())
 	assertErr("no AWS_SECRET_ACCESS_KEY set in environment", err, t)
 
-	os.Setenv("AWS_SECRET_ACCESS_KEY", "MYAWSSECRETACCESSKEYGOESHERE")
-	_, err = cs.credentials()
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "MYAWSSECRETACCESSKEYGOESHERE")
+	_, err = cs.credentials(context.Background())
 	assertErr("no AWS_REGION set in environment", err, t)
 
-	os.Setenv("AWS_REGION", "us-east-1")
+	t.Setenv("AWS_REGION", "us-east-1")
 
-	expectedCreds := awsCredentials{
+	expectedCreds := aws.Credentials{
 		AccessKey:    "MYAWSACCESSKEYGOESHERE",
 		SecretKey:    "MYAWSSECRETACCESSKEYGOESHERE",
 		RegionName:   "us-east-1",
@@ -91,10 +92,12 @@ func TestEnvironmentCredentialService(t *testing.T) {
 	}
 
 	for _, testCase := range testCases {
-		os.Setenv(testCase.tokenEnv, testCase.tokenValue)
+		if testCase.tokenEnv != "" {
+			t.Setenv(testCase.tokenEnv, testCase.tokenValue)
+		}
 		expectedCreds.SessionToken = testCase.tokenValue
 
-		envCreds, err := cs.credentials()
+		envCreds, err := cs.credentials(context.Background())
 		if err != nil {
 			t.Error("unexpected error: " + err.Error())
 		}
@@ -138,12 +141,12 @@ aws_secret_access_key=%v
 			Profile:    "foo",
 			RegionName: fooRegion,
 		}
-		creds, err := cs.credentials()
+		creds, err := cs.credentials(context.Background())
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		expected := awsCredentials{
+		expected := aws.Credentials{
 			AccessKey:    fooKey,
 			SecretKey:    fooSecret,
 			RegionName:   fooRegion,
@@ -161,12 +164,12 @@ aws_secret_access_key=%v
 			RegionName: defaultRegion,
 		}
 
-		creds, err = cs.credentials()
+		creds, err = cs.credentials(context.Background())
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		expected = awsCredentials{
+		expected = aws.Credentials{
 			AccessKey:    defaultKey,
 			SecretKey:    defaultSecret,
 			RegionName:   defaultRegion,
@@ -199,23 +202,17 @@ aws_session_token=%s
 	test.WithTempFS(files, func(path string) {
 		cfgPath := filepath.Join(path, "example.ini")
 
-		os.Setenv(awsCredentialsFileEnvVar, cfgPath)
-		os.Setenv(awsProfileEnvVar, profile)
-		os.Setenv(awsRegionEnvVar, defaultRegion)
-
-		t.Cleanup(func() {
-			os.Unsetenv(awsCredentialsFileEnvVar)
-			os.Unsetenv(awsProfileEnvVar)
-			os.Unsetenv(awsRegionEnvVar)
-		})
+		t.Setenv(awsCredentialsFileEnvVar, cfgPath)
+		t.Setenv(awsProfileEnvVar, profile)
+		t.Setenv(awsRegionEnvVar, defaultRegion)
 
 		cs := &awsProfileCredentialService{}
-		creds, err := cs.credentials()
+		creds, err := cs.credentials(context.Background())
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		expected := awsCredentials{
+		expected := aws.Credentials{
 			AccessKey:    defaultKey,
 			SecretKey:    defaultSecret,
 			RegionName:   defaultRegion,
@@ -242,18 +239,11 @@ aws_session_token=%s
 `, defaultKey, defaultSecret, defaultSessionToken)
 
 	files := map[string]string{}
-	oldUserProfile := os.Getenv("USERPROFILE")
-	oldHome := os.Getenv("HOME")
 
 	test.WithTempFS(files, func(path string) {
 
-		os.Setenv("USERPROFILE", path)
-		os.Setenv("HOME", path)
-
-		t.Cleanup(func() {
-			os.Setenv("USERPROFILE", oldUserProfile)
-			os.Setenv("HOME", oldHome)
-		})
+		t.Setenv("USERPROFILE", path)
+		t.Setenv("HOME", path)
 
 		cfgDir := filepath.Join(path, ".aws")
 		err := os.MkdirAll(cfgDir, os.ModePerm)
@@ -261,17 +251,17 @@ aws_session_token=%s
 			t.Fatal(err)
 		}
 
-		if err := ioutil.WriteFile(filepath.Join(cfgDir, "credentials"), []byte(config), 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(cfgDir, "credentials"), []byte(config), 0600); err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
 		cs := &awsProfileCredentialService{RegionName: defaultRegion}
-		creds, err := cs.credentials()
+		creds, err := cs.credentials(context.Background())
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		expected := awsCredentials{
+		expected := aws.Credentials{
 			AccessKey:    defaultKey,
 			SecretKey:    defaultSecret,
 			RegionName:   defaultRegion,
@@ -323,7 +313,7 @@ aws_access_key_id=accessKey
 				cs := &awsProfileCredentialService{
 					Path: cfgPath,
 				}
-				_, err := cs.credentials()
+				_, err := cs.credentials(context.Background())
 				if err == nil {
 					t.Fatal("Expected error but got nil")
 				}
@@ -348,7 +338,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/token",
 		logger:          logging.Get(),
 	}
-	_, err := cs.credentials()
+	_, err := cs.credentials(context.Background())
 	assertErr("unsupported protocol scheme \"\"", err, t)
 
 	// wrong path: no role set but no ECS URI in environment
@@ -357,7 +347,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		RegionName: "us-east-1",
 		logger:     logging.Get(),
 	}
-	_, err = cs.credentials()
+	_, err = cs.credentials(context.Background())
 	assertErr("metadata endpoint cannot be determined from settings and environment", err, t)
 
 	// wrong path: creds not found
@@ -368,7 +358,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/token",
 		logger:          logging.Get(),
 	}
-	_, err = cs.credentials()
+	_, err = cs.credentials(context.Background())
 	assertErr("metadata HTTP request returned unexpected status: 404 Not Found", err, t)
 
 	// wrong path: malformed JSON body
@@ -379,7 +369,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/token",
 		logger:          logging.Get(),
 	}
-	_, err = cs.credentials()
+	_, err = cs.credentials(context.Background())
 	assertErr("failed to parse credential response from metadata service: invalid character 'T' looking for beginning of value", err, t)
 
 	// wrong path: token service error
@@ -390,7 +380,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/missing_token",
 		logger:          logging.Get(),
 	} // will 404
-	_, err = cs.credentials()
+	_, err = cs.credentials(context.Background())
 	assertErr("metadata token HTTP request returned unexpected status: 404 Not Found", err, t)
 
 	// wrong path: token service returns bad token
@@ -401,7 +391,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/bad_token",
 		logger:          logging.Get(),
 	} // not good
-	_, err = cs.credentials()
+	_, err = cs.credentials(context.Background())
 	assertErr("metadata HTTP request returned unexpected status: 401 Unauthorized", err, t)
 
 	// wrong path: bad result code from EC2 metadata service
@@ -418,7 +408,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/token",
 		logger:          logging.Get(),
 	}
-	_, err = cs.credentials()
+	_, err = cs.credentials(context.Background())
 	assertErr("metadata service query did not succeed: Failure", err, t)
 
 	// happy path: base case
@@ -435,8 +425,8 @@ func TestMetadataCredentialService(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/token",
 		logger:          logging.Get(),
 	}
-	var creds awsCredentials
-	creds, err = cs.credentials()
+	var creds aws.Credentials
+	creds, err = cs.credentials(context.Background())
 	if err != nil {
 		// Cannot proceed with test if unable to fetch credentials.
 		t.Fatal(err)
@@ -449,7 +439,7 @@ func TestMetadataCredentialService(t *testing.T) {
 
 	// happy path: verify credentials are cached based on expiry
 	ts.payload.AccessKeyID = "ICHANGEDTHISBUTWEWONTSEEIT"
-	creds, err = cs.credentials()
+	creds, err = cs.credentials(context.Background())
 	if err != nil {
 		// Cannot proceed with test if unable to fetch credentials.
 		t.Fatal(err)
@@ -476,7 +466,7 @@ func TestMetadataCredentialService(t *testing.T) {
 		Token:           "MYAWSSECURITYTOKENGOESHERE",
 		Expiration:      time.Now().UTC().Add(time.Minute * 2)} // short time
 
-	creds, err = cs.credentials()
+	creds, err = cs.credentials(context.Background())
 	if err != nil {
 		// Cannot proceed with test if unable to fetch credentials.
 		t.Fatal(err)
@@ -489,7 +479,7 @@ func TestMetadataCredentialService(t *testing.T) {
 
 	// second time through, with changes
 	ts.payload.AccessKeyID = "ICHANGEDTHISANDWEWILLSEEIT"
-	creds, err = cs.credentials()
+	creds, err = cs.credentials(context.Background())
 	if err != nil {
 		// Cannot proceed with test if unable to fetch credentials.
 		t.Fatal(err)
@@ -501,7 +491,7 @@ func TestMetadataCredentialService(t *testing.T) {
 	assertEq(creds.SessionToken, ts.payload.Token, t)
 }
 
-func TestV4Signing(t *testing.T) {
+func TestMetadataServiceErrorHandled(t *testing.T) {
 	ts := ec2CredTestServer{}
 	ts.start()
 	defer ts.stop()
@@ -514,13 +504,18 @@ func TestV4Signing(t *testing.T) {
 		tokenPath:       ts.server.URL + "/latest/api/token",
 		logger:          logging.Get(),
 	}
-	req, _ := http.NewRequest("GET", "https://mybucket.s3.amazonaws.com/bundle.tar.gz", strings.NewReader(""))
-	err := signV4(req, "s3", cs, time.Unix(1556129697, 0))
 
-	assertErr("error getting AWS credentials: metadata HTTP request returned unexpected status: 404 Not Found", err, t)
+	_, err := cs.credentials(context.Background())
+	assertErr("metadata HTTP request returned unexpected status: 404 Not Found", err, t)
+}
+
+func TestV4Signing(t *testing.T) {
+	ts := ec2CredTestServer{}
+	ts.start()
+	defer ts.stop()
 
 	// happy path: sign correctly
-	cs = &awsMetadataCredentialService{
+	cs := &awsMetadataCredentialService{
 		RoleName:        "my_iam_role", // not present
 		RegionName:      "us-east-1",
 		credServicePath: ts.server.URL + "/latest/meta-data/iam/security-credentials/",
@@ -533,23 +528,58 @@ func TestV4Signing(t *testing.T) {
 		Code:            "Success",
 		Token:           "MYAWSSECURITYTOKENGOESHERE",
 		Expiration:      time.Now().UTC().Add(time.Minute * 2)}
-	req, _ = http.NewRequest("GET", "https://mybucket.s3.amazonaws.com/bundle.tar.gz", strings.NewReader(""))
-	err = signV4(req, "s3", cs, time.Unix(1556129697, 0))
+	req, _ := http.NewRequest("GET", "https://mybucket.s3.amazonaws.com/bundle.tar.gz", strings.NewReader(""))
 
-	if err != nil {
-		t.Fatal("unexpected error during signing")
+	// force a non-random source so that we can predict the v4a signing key and, thus, signature
+	myReader := strings.NewReader("000000000000000000000000000000000")
+	aws.SetRandomSource(myReader)
+	defer func() { aws.SetRandomSource(rand.Reader) }()
+
+	tests := []struct {
+		sigVersion            string
+		expectedAuthorization []string
+	}{
+		{
+			sigVersion: "4",
+			expectedAuthorization: []string{
+				"AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/us-east-1/s3/aws4_request," +
+					"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token," +
+					"Signature=d3f0561abae5e35d9ee2c15e678bb7acacc4b4743707a8f7fbcbfdb519078990",
+			},
+		},
+		{
+			sigVersion: "4a",
+			expectedAuthorization: []string{
+				// this signature is for go 1.20+, which changed crypto/ecdsa so signatures differ from go 1.18
+				"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/s3/aws4_request, " +
+					"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
+					"Signature=3045022031b9dd601cd02650193586a32721d0614bf2e34bbc76cff0d9812366d1dc8878022100d0cfbd91bd2dd98f1e2d7feb9091c48f8b66a20174922770ec9e3b74db8e1826",
+				// this signature is for go 1.18+. Remove this and only test for a single value when OPA drops go 1.19
+				"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/s3/aws4_request, " +
+					"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
+					"Signature=304402207d1bcb6fb68d85be3e9f6948a8dc8596a531b3f5a82ca2350acabe98941312bc02207d81ed07c7356226d93611820548a806c8e1f0cc72ff41ba672d23901e5a06bf",
+			},
+		},
 	}
 
-	// expect mandatory headers
-	assertEq(req.Header.Get("Host"), "mybucket.s3.amazonaws.com", t)
-	assertEq(req.Header.Get("Authorization"),
-		"AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/us-east-1/s3/aws4_request,"+
-			"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token,"+
-			"Signature=d3f0561abae5e35d9ee2c15e678bb7acacc4b4743707a8f7fbcbfdb519078990", t)
-	assertEq(req.Header.Get("X-Amz-Content-Sha256"),
-		"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", t)
-	assertEq(req.Header.Get("X-Amz-Date"), "20190424T181457Z", t)
-	assertEq(req.Header.Get("X-Amz-Security-Token"), "MYAWSSECURITYTOKENGOESHERE", t)
+	for _, test := range tests {
+		creds, err := cs.credentials(context.Background())
+		if err != nil {
+			t.Fatal("unexpected error getting credentials")
+		}
+
+		if err := aws.SignRequest(req, "s3", creds, time.Unix(1556129697, 0), test.sigVersion); err != nil {
+			t.Fatal("unexpected error during signing", err)
+		}
+
+		// expect mandatory headers
+		assertEq("mybucket.s3.amazonaws.com", req.Header.Get("Host"), t)
+		assertIn(test.expectedAuthorization, req.Header.Get("Authorization"), t)
+		assertEq("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+			req.Header.Get("X-Amz-Content-Sha256"), t)
+		assertEq("20190424T181457Z", req.Header.Get("X-Amz-Date"), t)
+		assertEq("MYAWSSECURITYTOKENGOESHERE", req.Header.Get("X-Amz-Security-Token"), t)
+	}
 }
 
 func TestV4SigningForApiGateway(t *testing.T) {
@@ -574,9 +604,12 @@ func TestV4SigningForApiGateway(t *testing.T) {
 		strings.NewReader("{ \"payload\": 42 }"))
 	req.Header.Set("Content-Type", "application/json")
 
-	err := signV4(req, "execute-api", cs, time.Unix(1556129697, 0))
-
+	creds, err := cs.credentials(context.Background())
 	if err != nil {
+		t.Fatal("unexpected error getting credentials")
+	}
+
+	if err := aws.SignRequest(req, "execute-api", creds, time.Unix(1556129697, 0), "4"); err != nil {
 		t.Fatal("unexpected error during signing")
 	}
 
@@ -619,20 +652,54 @@ func TestV4SigningOmitsIgnoredHeaders(t *testing.T) {
 	req.Header.Set("Authorization", "Auth header will be overwritten, and shouldn't be signed")
 	req.Header.Set("X-Amzn-Trace-Id", "Some trace id")
 
-	err := signV4(req, "execute-api", cs, time.Unix(1556129697, 0))
+	// force a non-random source so that we can predict the v4a signing key and, thus, signature
+	myReader := strings.NewReader("000000000000000000000000000000000")
+	aws.SetRandomSource(myReader)
+	defer func() { aws.SetRandomSource(rand.Reader) }()
 
-	if err != nil {
-		t.Fatal("unexpected error during signing")
+	tests := []struct {
+		sigVersion            string
+		expectedAuthorization []string
+	}{
+		{
+			sigVersion: "4",
+			expectedAuthorization: []string{"AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/us-east-1/execute-api/aws4_request," +
+				"SignedHeaders=content-type;host;x-amz-date;x-amz-security-token," +
+				"Signature=c8ee72cc45050b255bcbf19defc693f7cd788959b5380fa0985de6e865635339",
+			},
+		},
+		{
+			sigVersion: "4a",
+			expectedAuthorization: []string{
+				// this signature is for go 1.20+, which changed crypto/ecdsa so signatures differ from go 1.18
+				"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
+					"SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
+					"Signature=3045022100e62b33949d5d5666c1cc737db6673600d7893b977df48e4eb64a6e8747582a2f022011f56ad285472956a3e00c6971d03ebd8ecb579804d8fd91a6fb483a1f502118",
+				// this signature is for go 1.18+. Remove this and only test for a single value when OPA drops go 1.19
+				"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
+					"SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
+					"Signature=30450221009f3b0cda178456dfd1bec61b78bdbd115c0cf497eaa52c58bbb2850ad9c49c3002207009cb88a1219a4a6626056c31823a6b5bc2728bc88bc98a06e12e1148482c94",
+			},
+		},
+	}
+
+	for _, test := range tests {
+		creds, err := cs.credentials(context.Background())
+		if err != nil {
+			t.Fatal("unexpected error getting credentials")
+		}
+
+		if err := aws.SignRequest(req, "execute-api", creds, time.Unix(1556129697, 0), test.sigVersion); err != nil {
+			t.Fatal("unexpected error during signing")
+		}
+
+		// Check the signed headers doesn't include user-agent, authorization or x-amz-trace-id
+		assertIn(test.expectedAuthorization, req.Header.Get("Authorization"), t)
+		// The headers omitted from signing should still be present in the request
+		assertEq(req.Header.Get("User-Agent"), "Unit Tests!", t)
+		assertEq(req.Header.Get("X-Amzn-Trace-Id"), "Some trace id", t)
 	}
 
-	// Check the signed headers doesn't include user-agent, authorization or x-amz-trace-id
-	assertEq(req.Header.Get("Authorization"),
-		"AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/us-east-1/execute-api/aws4_request,"+
-			"SignedHeaders=content-type;host;x-amz-date;x-amz-security-token,"+
-			"Signature=c8ee72cc45050b255bcbf19defc693f7cd788959b5380fa0985de6e865635339", t)
-	// The headers omitted from signing should still be present in the request
-	assertEq(req.Header.Get("User-Agent"), "Unit Tests!", t)
-	assertEq(req.Header.Get("X-Amzn-Trace-Id"), "Some trace id", t)
 }
 
 func TestV4SigningCustomPort(t *testing.T) {
@@ -654,9 +721,13 @@ func TestV4SigningCustomPort(t *testing.T) {
 		Token:           "MYAWSSECURITYTOKENGOESHERE",
 		Expiration:      time.Now().UTC().Add(time.Minute * 2)}
 	req, _ := http.NewRequest("GET", "https://custom.s3.server:9000/bundle.tar.gz", strings.NewReader(""))
-	err := signV4(req, "s3", cs, time.Unix(1556129697, 0))
 
+	creds, err := cs.credentials(context.Background())
 	if err != nil {
+		t.Fatal("unexpected error getting credentials")
+	}
+
+	if err := aws.SignRequest(req, "s3", creds, time.Unix(1556129697, 0), "4"); err != nil {
 		t.Fatal("unexpected error during signing")
 	}
 
@@ -690,18 +761,36 @@ func TestV4SigningDoesNotMutateBody(t *testing.T) {
 		Code:            "Success",
 		Token:           "MYAWSSECURITYTOKENGOESHERE",
 		Expiration:      time.Now().UTC().Add(time.Minute * 2)}
-	req, _ := http.NewRequest("POST", "https://myrestapi.execute-api.us-east-1.amazonaws.com/prod/logs",
-		strings.NewReader("{ \"payload\": 42 }"))
 
-	err := signV4(req, "execute-api", cs, time.Unix(1556129697, 0))
+	// force a non-random source so that we can predict the v4a signing key and, thus, signature
+	myReader := strings.NewReader("000000000000000000000000000000000")
+	aws.SetRandomSource(myReader)
+	defer func() { aws.SetRandomSource(rand.Reader) }()
 
-	if err != nil {
-		t.Fatal("unexpected error during signing")
+	tests := []struct {
+		sigVersion string
+	}{
+		{sigVersion: "4"},
+		{sigVersion: "4a"},
 	}
 
-	// Read the body and check that it was not mutated
-	body, _ := ioutil.ReadAll(req.Body)
-	assertEq(string(body), "{ \"payload\": 42 }", t)
+	for _, test := range tests {
+		req, _ := http.NewRequest("POST", "https://myrestapi.execute-api.us-east-1.amazonaws.com/prod/logs",
+			strings.NewReader("{ \"payload\": 42 }"))
+
+		creds, err := cs.credentials(context.Background())
+		if err != nil {
+			t.Fatal("unexpected error getting credentials")
+		}
+
+		if err := aws.SignRequest(req, "execute-api", creds, time.Unix(1556129697, 0), test.sigVersion); err != nil {
+			t.Fatal("unexpected error during signing")
+		}
+
+		// Read the body and check that it was not mutated
+		body, _ := io.ReadAll(req.Body)
+		assertEq(string(body), "{ \"payload\": 42 }", t)
+	}
 }
 
 func TestV4SigningWithMultiValueHeaders(t *testing.T) {
@@ -727,20 +816,57 @@ func TestV4SigningWithMultiValueHeaders(t *testing.T) {
 	req.Header.Add("Accept", "text/plain")
 	req.Header.Add("Accept", "text/html")
 
-	err := signV4(req, "execute-api", cs, time.Unix(1556129697, 0))
+	// force a non-random source so that we can predict the v4a signing key and, thus, signature
+	myReader := strings.NewReader("000000000000000000000000000000000")
+	aws.SetRandomSource(myReader)
+	defer func() { aws.SetRandomSource(rand.Reader) }()
 
-	if err != nil {
-		t.Fatal("unexpected error during signing")
+	tests := []struct {
+		sigVersion            string
+		expectedAuthorization []string
+	}{
+		{
+			sigVersion: "4",
+			expectedAuthorization: []string{
+				"AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/us-east-1/execute-api/aws4_request," +
+					"SignedHeaders=accept;host;x-amz-date;x-amz-security-token," +
+					"Signature=0237b0c789cad36212f0efba70c02549e1f659ab9caaca16423930cc7236c046",
+			},
+		},
+		{
+			sigVersion: "4a",
+			expectedAuthorization: []string{
+				// this signature is for go 1.20+, which changed crypto/ecdsa so signatures differ from go 1.18
+				"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
+					"SignedHeaders=accept;content-length;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
+					"Signature=3046022100f7fd07e2a00b1be3074be0c2e3871bd42ddc4c01549b1ffc4809ef3fafde80780221008c6bf906cdb9040ebeb94d1134598e7920fa8cb7bda91b00ce0ab9838b79631b",
+				// this signature is for go 1.18+. Remove this and only test for a single value when OPA drops go 1.19
+				"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
+					"SignedHeaders=accept;content-length;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
+					"Signature=304402202d5f2d4d42fe59b2e61fa455cb35a335139d109c2d37aaa8946d45fd0fb4989c022068238cbfbc80326f5cc391f2b6837910191ceabb58ec0bf986c0141f76046594",
+			},
+		},
 	}
 
-	// Check the signed headers includes our multi-value 'accept' header
-	assertEq(req.Header.Get("Authorization"),
-		"AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/us-east-1/execute-api/aws4_request,"+
-			"SignedHeaders=accept;host;x-amz-date;x-amz-security-token,"+
-			"Signature=0237b0c789cad36212f0efba70c02549e1f659ab9caaca16423930cc7236c046", t)
-	// The multi-value headers are preserved
-	assertEq(req.Header.Values("Accept")[0], "text/plain", t)
-	assertEq(req.Header.Values("Accept")[1], "text/html", t)
+	for _, test := range tests {
+		creds, err := cs.credentials(context.Background())
+		if err != nil {
+			t.Fatal("unexpected error getting credentials")
+		}
+
+		if err := aws.SignRequest(req, "execute-api", creds, time.Unix(1556129697, 0), test.sigVersion); err != nil {
+			t.Fatal("unexpected error during signing")
+		}
+
+		if len(req.Header.Values("Authorization")) != 1 {
+			t.Fatal("Authorization header is multi-valued. This will break AWS v4 signing.")
+		}
+		// Check the signed headers includes our multi-value 'accept' header
+		assertIn(test.expectedAuthorization, req.Header.Get("Authorization"), t)
+		// The multi-value headers are preserved
+		assertEq("text/plain", req.Header.Values("Accept")[0], t)
+		assertEq("text/html", req.Header.Values("Accept")[1], t)
+	}
 }
 
 // simulate EC2 metadata service
@@ -797,15 +923,7 @@ func (t *ec2CredTestServer) stop() {
 }
 
 func TestWebIdentityCredentialService(t *testing.T) {
-	reset := func() {
-		os.Unsetenv("AWS_WEB_IDENTITY_TOKEN_FILE")
-		os.Unsetenv("AWS_ROLE_ARN")
-		os.Unsetenv("AWS_REGION")
-	}
-	reset()
-	t.Cleanup(reset)
-
-	os.Setenv("AWS_REGION", "us-west-1")
+	t.Setenv("AWS_REGION", "us-west-1")
 
 	testAccessKey := "ASgeIAIOSFODNN7EXAMPLE"
 	ts := stsTestServer{
@@ -831,12 +949,12 @@ func TestWebIdentityCredentialService(t *testing.T) {
 		// wrong path: no AWS_ROLE_ARN set
 		err := cs.populateFromEnv()
 		assertErr("no AWS_ROLE_ARN set in environment", err, t)
-		os.Setenv("AWS_ROLE_ARN", "role:arn")
+		t.Setenv("AWS_ROLE_ARN", "role:arn")
 
 		// wrong path: no AWS_WEB_IDENTITY_TOKEN_FILE set
 		err = cs.populateFromEnv()
 		assertErr("no AWS_WEB_IDENTITY_TOKEN_FILE set in environment", err, t)
-		os.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", "/nonsense")
+		t.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", "/nonsense")
 
 		// happy path: both env vars set
 		err = cs.populateFromEnv()
@@ -845,52 +963,52 @@ func TestWebIdentityCredentialService(t *testing.T) {
 		}
 
 		// wrong path: refresh with invalid web token file
-		err = cs.refreshFromService()
+		err = cs.refreshFromService(context.Background())
 		assertErr("unable to read web token for sts HTTP request: open /nonsense: no such file or directory", err, t)
 
 		// wrong path: refresh with "bad token"
-		os.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", badTokenFile)
+		t.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", badTokenFile)
 		_ = cs.populateFromEnv()
-		err = cs.refreshFromService()
+		err = cs.refreshFromService(context.Background())
 		assertErr("STS HTTP request returned unexpected status: 401 Unauthorized", err, t)
 
 		// happy path: refresh with "good token"
-		os.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", goodTokenFile)
+		t.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", goodTokenFile)
 		_ = cs.populateFromEnv()
-		err = cs.refreshFromService()
+		err = cs.refreshFromService(context.Background())
 		if err != nil {
 			t.Fatalf("Unexpected err: %s", err)
 		}
 
 		// happy path: refresh and get credentials
-		creds, _ := cs.credentials()
+		creds, _ := cs.credentials(context.Background())
 		assertEq(creds.AccessKey, testAccessKey, t)
 
 		// happy path: refresh with session and get credentials
 		cs.expiration = time.Now()
 		cs.SessionName = "TEST_SESSION"
-		creds, _ = cs.credentials()
+		creds, _ = cs.credentials(context.Background())
 		assertEq(creds.AccessKey, testAccessKey, t)
 
 		// happy path: don't refresh, but get credentials
 		ts.accessKey = "OTHERKEY"
-		creds, _ = cs.credentials()
+		creds, _ = cs.credentials(context.Background())
 		assertEq(creds.AccessKey, testAccessKey, t)
 
 		// happy/wrong path: refresh with "bad token" but return previous credentials
-		os.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", badTokenFile)
+		t.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", badTokenFile)
 		_ = cs.populateFromEnv()
 		cs.expiration = time.Now()
-		creds, err = cs.credentials()
+		creds, err = cs.credentials(context.Background())
 		assertEq(creds.AccessKey, testAccessKey, t)
 		assertErr("STS HTTP request returned unexpected status: 401 Unauthorized", err, t)
 
 		// wrong path: refresh with "bad token" but return previous credentials
-		os.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", goodTokenFile)
-		os.Setenv("AWS_ROLE_ARN", "BrokenRole")
+		t.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", goodTokenFile)
+		t.Setenv("AWS_ROLE_ARN", "BrokenRole")
 		_ = cs.populateFromEnv()
 		cs.expiration = time.Now()
-		creds, err = cs.credentials()
+		creds, err = cs.credentials(context.Background())
 		assertErr("failed to parse credential response from STS service: EOF", err, t)
 	})
 }
@@ -972,3 +1090,80 @@ func (t *stsTestServer) start() {
 func (t *stsTestServer) stop() {
 	t.server.Close()
 }
+
+func TestECRAuthPluginFailsWithoutAWSAuthPlugins(t *testing.T) {
+	ap := newECRAuthPlugin(&awsSigningAuthPlugin{
+		logger: logging.NewNoOpLogger(),
+	})
+
+	req := httptest.NewRequest("", "http://somewhere.com", nil)
+
+	err := ap.Prepare(req)
+	if err == nil {
+		t.Error("ecrAuthPlugin.Prepare(): expected and error")
+	}
+}
+
+func TestECRAuthPluginRequestsAuthorizationToken(t *testing.T) {
+	// Environment credentials to sign the ecr get authorization token request
+	t.Setenv(accessKeyEnvVar, "blablabla")
+	t.Setenv(secretKeyEnvVar, "tatata")
+	t.Setenv(awsRegionEnvVar, "us-east-1")
+	t.Setenv(sessionTokenEnvVar, "lalala")
+
+	awsAuthPlugin := awsSigningAuthPlugin{
+		logger:                    logging.NewNoOpLogger(),
+		AWSEnvironmentCredentials: &awsEnvironmentCredentialService{},
+	}
+
+	ap := newECRAuthPlugin(&awsAuthPlugin)
+	ap.ecr = &ecrStub{token: aws.ECRAuthorizationToken{
+		AuthorizationToken: "secret",
+	}}
+
+	req := httptest.NewRequest("", "http://somewhere.com", nil)
+
+	if err := ap.Prepare(req); err != nil {
+		t.Errorf("ecrAuthPlugin.Prepare() = %q", err)
+	}
+
+	got := req.Header.Get("Authorization")
+	want := "Basic secret"
+	if got != want {
+		t.Errorf("req.Header.Get(\"Authorization\") = %q, want %q", got, want)
+	}
+}
+
+type ecrStub struct {
+	token aws.ECRAuthorizationToken
+}
+
+func (es *ecrStub) GetAuthorizationToken(context.Context, aws.Credentials, string) (aws.ECRAuthorizationToken, error) {
+	return es.token, nil
+}
+
+func TestECRAuthPluginReusesCachedToken(t *testing.T) {
+	logger := logging.NewNoOpLogger()
+	ap := ecrAuthPlugin{
+		token: aws.ECRAuthorizationToken{
+			AuthorizationToken: "secret",
+			ExpiresAt:          time.Now().Add(time.Hour),
+		},
+		awsAuthPlugin: &awsSigningAuthPlugin{
+			logger: logger,
+		},
+		logger: logger,
+	}
+
+	req := httptest.NewRequest("", "http://somewhere.com", nil)
+
+	if err := ap.Prepare(req); err != nil {
+		t.Errorf("ecrAuthPlugin.Prepare() = %q", err)
+	}
+
+	got := req.Header.Get("Authorization")
+	want := "Basic secret"
+	if got != want {
+		t.Errorf("req.Header.Get(\"Authorization\") = %q, want %q", got, want)
+	}
+}
diff --git a/plugins/rest/azure.go b/plugins/rest/azure.go
index b40aca1cb2..6a85dea681 100644
--- a/plugins/rest/azure.go
+++ b/plugins/rest/azure.go
@@ -2,8 +2,9 @@ package rest
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"time"
@@ -49,6 +50,10 @@ type azureManagedIdentitiesAuthPlugin struct {
 }
 
 func (ap *azureManagedIdentitiesAuthPlugin) NewClient(c Config) (*http.Client, error) {
+	if c.Type == "oci" {
+		return nil, errors.New("azure managed identities auth: OCI service not supported")
+	}
+
 	if ap.Endpoint == "" {
 		ap.Endpoint = azureIMDSEndpoint
 	}
@@ -102,7 +107,7 @@ func azureManagedIdentitiesTokenRequest(
 	}
 	defer response.Body.Close()
 
-	data, err := ioutil.ReadAll(response.Body)
+	data, err := io.ReadAll(response.Body)
 	if err != nil {
 		return token, err
 	}
diff --git a/plugins/rest/gcp.go b/plugins/rest/gcp.go
index 04f103039b..c717105c7f 100644
--- a/plugins/rest/gcp.go
+++ b/plugins/rest/gcp.go
@@ -8,7 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -164,7 +164,7 @@ func gcpMetadataServiceRequest(endpoint string) ([]byte, error) {
 		return nil, &gcpMetadataError{errGCPMetadataUnexpected, endpoint, s}
 	}
 
-	data, err := ioutil.ReadAll(response.Body)
+	data, err := io.ReadAll(response.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/plugins/rest/rest.go b/plugins/rest/rest.go
index 805409644d..93b23aedb9 100644
--- a/plugins/rest/rest.go
+++ b/plugins/rest/rest.go
@@ -10,8 +10,10 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
+	"net/http/httputil"
 	"reflect"
 	"strings"
 
@@ -23,6 +25,7 @@ import (
 
 const (
 	defaultResponseHeaderTimeoutSeconds = int64(10)
+	defaultResponseSizeLimitBytes       = 1024
 
 	grantTypeClientCredentials = "client_credentials"
 	grantTypeJwtBearer         = "jwt_bearer"
@@ -31,8 +34,8 @@ const (
 // An HTTPAuthPlugin represents a mechanism to construct and configure HTTP authentication for a REST service
 type HTTPAuthPlugin interface {
 	// implementations can assume NewClient will be called before Prepare
-	NewClient(c Config) (*http.Client, error)
-	Prepare(req *http.Request) error
+	NewClient(Config) (*http.Client, error)
+	Prepare(*http.Request) error
 }
 
 // Config represents configuration for a REST client.
@@ -52,6 +55,7 @@ type Config struct {
 		AzureManagedIdentity *azureManagedIdentitiesAuthPlugin  `json:"azure_managed_identity,omitempty"`
 		Plugin               *string                            `json:"plugin,omitempty"`
 	} `json:"credentials"`
+	Type   string `json:"type,omitempty"`
 	keys   map[string]*keys.Config
 	logger logging.Logger
 }
@@ -63,13 +67,24 @@ func (c *Config) Equal(other *Config) bool {
 	return reflect.DeepEqual(c, &otherWithoutLogger)
 }
 
-func (c *Config) authPlugin(authPluginLookup func(string) HTTPAuthPlugin) (HTTPAuthPlugin, error) {
+// An AuthPluginLookupFunc can lookup auth plugins by their name.
+type AuthPluginLookupFunc func(name string) HTTPAuthPlugin
+
+// AuthPlugin should be used to get an authentication method from the config.
+func (c *Config) AuthPlugin(lookup AuthPluginLookupFunc) (HTTPAuthPlugin, error) {
 	var candidate HTTPAuthPlugin
-	if c.Credentials.Plugin != nil && authPluginLookup != nil {
-		candidate := authPluginLookup(*c.Credentials.Plugin)
-		if candidate != nil {
-			return candidate, nil
+	if c.Credentials.Plugin != nil {
+		if lookup == nil {
+			// if no authPluginLookup function is passed we can't resolve the plugin
+			return nil, errors.New("missing auth plugin lookup function")
+		}
+
+		candidate := lookup(*c.Credentials.Plugin)
+		if candidate == nil {
+			return nil, fmt.Errorf("auth plugin %q not found", *c.Credentials.Plugin)
 		}
+
+		return candidate, nil
 	}
 	// reflection avoids need for this code to change as auth plugins are added
 	s := reflect.ValueOf(c.Credentials)
@@ -77,27 +92,30 @@ func (c *Config) authPlugin(authPluginLookup func(string) HTTPAuthPlugin) (HTTPA
 		if s.Field(i).IsNil() {
 			continue
 		}
+
 		if candidate != nil {
 			return nil, errors.New("a maximum one credential method must be specified")
 		}
+
 		candidate = s.Field(i).Interface().(HTTPAuthPlugin)
 	}
+
 	if candidate == nil {
 		return &defaultAuthPlugin{}, nil
 	}
 	return candidate, nil
 }
 
-func (c *Config) authHTTPClient(authPluginLookup func(string) HTTPAuthPlugin) (*http.Client, error) {
-	plugin, err := c.authPlugin(authPluginLookup)
+func (c *Config) authHTTPClient(lookup AuthPluginLookupFunc) (*http.Client, error) {
+	plugin, err := c.AuthPlugin(lookup)
 	if err != nil {
 		return nil, err
 	}
 	return plugin.NewClient(*c)
 }
 
-func (c *Config) authPrepare(req *http.Request, authPluginLookup func(string) HTTPAuthPlugin) error {
-	plugin, err := c.authPlugin(authPluginLookup)
+func (c *Config) authPrepare(req *http.Request, lookup AuthPluginLookupFunc) error {
+	plugin, err := c.AuthPlugin(lookup)
 	if err != nil {
 		return err
 	}
@@ -111,8 +129,9 @@ type Client struct {
 	json             *interface{}
 	config           Config
 	headers          map[string]string
-	authPluginLookup func(string) HTTPAuthPlugin
+	authPluginLookup AuthPluginLookupFunc
 	logger           logging.Logger
+	loggerFields     map[string]interface{}
 }
 
 // Name returns an option that overrides the service name on the client.
@@ -126,7 +145,7 @@ func Name(s string) func(*Client) {
 // It's intended to be used when creating a Client using New(). Usually this is passed
 // the plugins.AuthPlugin func, which retrieves a registered HTTPAuthPlugin from the
 // plugin manager.
-func AuthPluginLookup(l func(string) HTTPAuthPlugin) func(*Client) {
+func AuthPluginLookup(l AuthPluginLookupFunc) func(*Client) {
 	return func(c *Client) {
 		c.authPluginLookup = l
 	}
@@ -142,7 +161,6 @@ func Logger(l logging.Logger) func(*Client) {
 // New returns a new Client for config.
 func New(config []byte, keys map[string]*keys.Config, opts ...func(*Client)) (Client, error) {
 	var parsedConfig Config
-
 	if err := util.Unmarshal(config, &parsedConfig); err != nil {
 		return Client{}, err
 	}
@@ -150,9 +168,8 @@ func New(config []byte, keys map[string]*keys.Config, opts ...func(*Client)) (Cl
 	parsedConfig.URL = strings.TrimRight(parsedConfig.URL, "/")
 
 	if parsedConfig.ResponseHeaderTimeoutSeconds == nil {
-		timeout := new(int64)
-		*timeout = defaultResponseHeaderTimeoutSeconds
-		parsedConfig.ResponseHeaderTimeoutSeconds = timeout
+		timeout := defaultResponseHeaderTimeoutSeconds
+		parsedConfig.ResponseHeaderTimeoutSeconds = &timeout
 	}
 
 	parsedConfig.keys = keys
@@ -168,11 +185,18 @@ func New(config []byte, keys map[string]*keys.Config, opts ...func(*Client)) (Cl
 	if client.logger == nil {
 		client.logger = logging.Get()
 	}
+
 	client.config.logger = client.logger
 
 	return client, nil
 }
 
+// AuthPluginLookup returns the lookup function to find a custom registered
+// auth plugin by its name.
+func (c Client) AuthPluginLookup() AuthPluginLookupFunc {
+	return c.authPluginLookup
+}
+
 // Service returns the name of the service this Client is configured for.
 func (c Client) Service() string {
 	return c.config.Name
@@ -194,6 +218,11 @@ func (c Client) Logger() logging.Logger {
 	return c.logger
 }
 
+// LoggerFields returns the fields used for log statements used by Client
+func (c Client) LoggerFields() map[string]interface{} {
+	return c.loggerFields
+}
+
 // WithHeader returns a shallow copy of the client with a header to include the
 // requests.
 func (c Client) WithHeader(k, v string) Client {
@@ -236,8 +265,7 @@ func (c Client) Do(ctx context.Context, method, path string) (*http.Response, er
 	var body io.Reader
 
 	if c.bytes != nil {
-		buf := bytes.NewBuffer(*c.bytes)
-		body = buf
+		body = bytes.NewReader(*c.bytes)
 	} else if c.json != nil {
 		var buf bytes.Buffer
 		if err := json.NewEncoder(&buf).Encode(*c.json); err != nil {
@@ -277,23 +305,51 @@ func (c Client) Do(ctx context.Context, method, path string) (*http.Response, er
 		return nil, err
 	}
 
-	c.logger.WithFields(map[string]interface{}{
-		"method":  method,
-		"url":     url,
-		"headers": req.Header,
-	}).Debug("Sending request.")
+	if c.logger.GetLevel() >= logging.Debug {
+		c.loggerFields = map[string]interface{}{
+			"method":  method,
+			"url":     url,
+			"headers": withMaskedAuthorizationHeader(req.Header),
+		}
+
+		c.logger.WithFields(c.loggerFields).Debug("Sending request.")
+	}
 
 	resp, err := httpClient.Do(req)
-	if resp != nil {
+
+	if resp != nil && c.logger.GetLevel() >= logging.Debug {
 		// Only log for debug purposes. If an error occurred, the caller should handle
 		// that. In the non-error case, the caller may not do anything.
-		c.logger.WithFields(map[string]interface{}{
-			"method":  method,
-			"url":     url,
-			"status":  resp.Status,
-			"headers": resp.Header,
-		}).Debug("Received response.")
+		c.loggerFields["status"] = resp.Status
+		c.loggerFields["headers"] = resp.Header
+
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			dump, err := httputil.DumpResponse(resp, true)
+			if err != nil {
+				return nil, err
+			}
+
+			if len(string(dump)) < defaultResponseSizeLimitBytes {
+				c.loggerFields["response"] = string(dump)
+			} else {
+				c.loggerFields["response"] = fmt.Sprintf("%v...", string(dump[:defaultResponseSizeLimitBytes]))
+			}
+		}
+		c.logger.WithFields(c.loggerFields).Debug("Received response.")
 	}
 
 	return resp, err
 }
+
+func withMaskedAuthorizationHeader(headers http.Header) http.Header {
+	authzHeader := headers.Get("Authorization")
+	if authzHeader != "" {
+		masked := make(http.Header)
+		for k, v := range headers {
+			masked[k] = v
+		}
+		masked.Set("Authorization", "REDACTED")
+		return masked
+	}
+	return headers
+}
diff --git a/plugins/rest/rest_auth.go b/plugins/rest/rest_auth.go
deleted file mode 100644
index 3b718d41c0..0000000000
--- a/plugins/rest/rest_auth.go
+++ /dev/null
@@ -1,579 +0,0 @@
-// Copyright 2019 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-package rest
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/open-policy-agent/opa/internal/jwx/jwa"
-	"github.com/open-policy-agent/opa/internal/jwx/jws"
-	"github.com/open-policy-agent/opa/internal/jwx/jws/sign"
-	"github.com/open-policy-agent/opa/internal/uuid"
-	"github.com/open-policy-agent/opa/keys"
-	"github.com/open-policy-agent/opa/logging"
-)
-
-const (
-	// Default to s3 when the service for sigv4 signing is not specified for backwards compatibility
-	awsSigv4SigningDefaultService = "s3"
-)
-
-// DefaultTLSConfig defines standard TLS configurations based on the Config
-func DefaultTLSConfig(c Config) (*tls.Config, error) {
-	t := &tls.Config{}
-	url, err := url.Parse(c.URL)
-	if err != nil {
-		return nil, err
-	}
-	if url.Scheme == "https" {
-		t.InsecureSkipVerify = c.AllowInsecureTLS
-	}
-
-	if c.TLS != nil && c.TLS.CACert != "" {
-		caCert, err := ioutil.ReadFile(c.TLS.CACert)
-		if err != nil {
-			return nil, err
-		}
-
-		var rootCAs *x509.CertPool
-		if c.TLS.SystemCARequired {
-			rootCAs, err = x509.SystemCertPool()
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			rootCAs = x509.NewCertPool()
-		}
-
-		ok := rootCAs.AppendCertsFromPEM(caCert)
-		if !ok {
-			return nil, errors.New("unable to parse and append CA certificate to certificate pool")
-		}
-		t.RootCAs = rootCAs
-	}
-
-	return t, nil
-}
-
-// DefaultRoundTripperClient is a reasonable set of defaults for HTTP auth plugins
-func DefaultRoundTripperClient(t *tls.Config, timeout int64) *http.Client {
-	// Ensure we use a http.Transport with proper settings: the zero values are not
-	// a good choice, as they cause leaking connections:
-	// https://github.com/golang/go/issues/19620
-
-	// copy, we don't want to alter the default client's Transport
-	tr := http.DefaultTransport.(*http.Transport).Clone()
-	tr.ResponseHeaderTimeout = time.Duration(timeout) * time.Second
-	tr.TLSClientConfig = t
-
-	c := *http.DefaultClient
-	c.Transport = tr
-	return &c
-}
-
-// defaultAuthPlugin represents baseline 'no auth' behavior if no alternative plugin is specified for a service
-type defaultAuthPlugin struct{}
-
-func (ap *defaultAuthPlugin) NewClient(c Config) (*http.Client, error) {
-	t, err := DefaultTLSConfig(c)
-	if err != nil {
-		return nil, err
-	}
-	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
-}
-
-func (ap *defaultAuthPlugin) Prepare(req *http.Request) error {
-	return nil
-}
-
-type serverTLSConfig struct {
-	CACert           string `json:"ca_cert,omitempty"`
-	SystemCARequired bool   `json:"system_ca_required,omitempty"`
-}
-
-// bearerAuthPlugin represents authentication via a bearer token in the HTTP Authorization header
-type bearerAuthPlugin struct {
-	Token     string `json:"token"`
-	TokenPath string `json:"token_path"`
-	Scheme    string `json:"scheme,omitempty"`
-}
-
-func (ap *bearerAuthPlugin) NewClient(c Config) (*http.Client, error) {
-	t, err := DefaultTLSConfig(c)
-	if err != nil {
-		return nil, err
-	}
-
-	if ap.Token != "" && ap.TokenPath != "" {
-		return nil, errors.New("invalid config: specify a value for either the \"token\" or \"token_path\" field")
-	}
-
-	if ap.Scheme == "" {
-		ap.Scheme = "Bearer"
-	}
-
-	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
-}
-
-func (ap *bearerAuthPlugin) Prepare(req *http.Request) error {
-	token := ap.Token
-
-	if ap.TokenPath != "" {
-		bytes, err := ioutil.ReadFile(ap.TokenPath)
-		if err != nil {
-			return err
-		}
-		token = strings.TrimSpace(string(bytes))
-	}
-
-	req.Header.Add("Authorization", fmt.Sprintf("%v %v", ap.Scheme, token))
-	return nil
-}
-
-type tokenEndpointResponse struct {
-	AccessToken string `json:"access_token"`
-	TokenType   string `json:"token_type"`
-	ExpiresIn   int64  `json:"expires_in"`
-}
-
-// oauth2ClientCredentialsAuthPlugin represents authentication via a bearer token in the HTTP Authorization header
-// obtained through the OAuth2 client credentials flow
-type oauth2ClientCredentialsAuthPlugin struct {
-	GrantType    string                 `json:"grant_type"`
-	TokenURL     string                 `json:"token_url"`
-	ClientID     string                 `json:"client_id"`
-	ClientSecret string                 `json:"client_secret"`
-	SigningKeyID string                 `json:"signing_key"`
-	Thumbprint   string                 `json:"thumbprint"`
-	Claims       map[string]interface{} `json:"additional_claims"`
-	IncludeJti   bool                   `json:"include_jti_claim"`
-	Scopes       []string               `json:"scopes,omitempty"`
-
-	signingKey       *keys.Config
-	signingKeyParsed interface{}
-	tokenCache       *oauth2Token
-	tlsSkipVerify    bool
-	logger           logging.Logger
-}
-
-type oauth2Token struct {
-	Token     string
-	ExpiresAt time.Time
-}
-
-func (ap *oauth2ClientCredentialsAuthPlugin) createAuthJWT(claims map[string]interface{}, signingKey interface{}) (*string, error) {
-	now := time.Now()
-	baseClaims := map[string]interface{}{
-		"iat": now.Unix(),
-		"exp": now.Add(10 * time.Minute).Unix(),
-	}
-	if claims == nil {
-		claims = make(map[string]interface{})
-	}
-	for k, v := range baseClaims {
-		claims[k] = v
-	}
-
-	if len(ap.Scopes) > 0 {
-		claims["scope"] = strings.Join(ap.Scopes, " ")
-	}
-
-	if ap.IncludeJti {
-		jti, err := uuid.New(rand.Reader)
-		if err != nil {
-			return nil, err
-		}
-		claims["jti"] = jti
-	}
-
-	payload, err := json.Marshal(claims)
-	if err != nil {
-		return nil, err
-	}
-
-	var jwsHeaders []byte
-	if ap.Thumbprint != "" {
-		bytes, err := hex.DecodeString(ap.Thumbprint)
-		if err != nil {
-			return nil, err
-		}
-		x5t := base64.URLEncoding.EncodeToString(bytes)
-		jwsHeaders = []byte(fmt.Sprintf(`{"typ":"JWT","alg":"%s","x5t":"%s"}`, ap.signingKey.Algorithm, x5t))
-	} else {
-		jwsHeaders = []byte(fmt.Sprintf(`{"typ":"JWT","alg":"%s"}`, ap.signingKey.Algorithm))
-	}
-
-	jwsCompact, err := jws.SignLiteral(payload,
-		jwa.SignatureAlgorithm(ap.signingKey.Algorithm),
-		signingKey,
-		jwsHeaders,
-		rand.Reader)
-	if err != nil {
-		return nil, err
-	}
-	jwt := string(jwsCompact)
-
-	return &jwt, nil
-}
-
-func (ap *oauth2ClientCredentialsAuthPlugin) parseSigningKey(c Config) (err error) {
-	if ap.SigningKeyID == "" {
-		return errors.New("signing_key required for jwt_bearer grant type")
-	}
-
-	if val, ok := c.keys[ap.SigningKeyID]; ok {
-		if val.PrivateKey == "" {
-			return errors.New("referenced signing_key does not include a private key")
-		}
-		ap.signingKey = val
-	} else {
-		return errors.New("signing_key refers to non-existent key")
-	}
-
-	alg := jwa.SignatureAlgorithm(ap.signingKey.Algorithm)
-	ap.signingKeyParsed, err = sign.GetSigningKey(ap.signingKey.PrivateKey, alg)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (ap *oauth2ClientCredentialsAuthPlugin) NewClient(c Config) (*http.Client, error) {
-	t, err := DefaultTLSConfig(c)
-	if err != nil {
-		return nil, err
-	}
-
-	if ap.GrantType == "" {
-		// Use client_credentials as default to not break existing config
-		ap.GrantType = grantTypeClientCredentials
-	} else if ap.GrantType != grantTypeClientCredentials && ap.GrantType != grantTypeJwtBearer {
-		return nil, errors.New("grant_type must be either client_credentials or jwt_bearer")
-	}
-
-	if ap.GrantType == grantTypeJwtBearer || (ap.GrantType == grantTypeClientCredentials && ap.SigningKeyID != "") {
-		if err = ap.parseSigningKey(c); err != nil {
-			return nil, err
-		}
-	}
-
-	// Inherit skip verify from the "parent" settings. Should this be configurable on the credentials too?
-	ap.tlsSkipVerify = c.AllowInsecureTLS
-
-	ap.logger = c.logger
-
-	if !strings.HasPrefix(ap.TokenURL, "https://") {
-		return nil, errors.New("token_url required to use https scheme")
-	}
-	if ap.GrantType == grantTypeClientCredentials {
-		if ap.ClientSecret != "" && ap.SigningKeyID != "" {
-			return nil, errors.New("can only use one of client_secret and signing_key for client_credentials")
-		}
-		if ap.SigningKeyID == "" && (ap.ClientID == "" || ap.ClientSecret == "") {
-			return nil, errors.New("client_id and client_secret required")
-		}
-	}
-
-	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
-}
-
-// requestToken tries to obtain an access token using either the client credentials flow
-// https://tools.ietf.org/html/rfc6749#section-4.4
-// or the JWT authorization grant
-// https://tools.ietf.org/html/rfc7523
-func (ap *oauth2ClientCredentialsAuthPlugin) requestToken() (*oauth2Token, error) {
-	body := url.Values{}
-	if ap.GrantType == grantTypeJwtBearer {
-		authJwt, err := ap.createAuthJWT(ap.Claims, ap.signingKeyParsed)
-		if err != nil {
-			return nil, err
-		}
-		body.Add("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer")
-		body.Add("assertion", *authJwt)
-	} else {
-		body.Add("grant_type", grantTypeClientCredentials)
-
-		if ap.SigningKeyID != "" {
-			authJwt, err := ap.createAuthJWT(ap.Claims, ap.signingKeyParsed)
-			if err != nil {
-				return nil, err
-			}
-			body.Add("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
-			body.Add("client_assertion", *authJwt)
-
-			if ap.ClientID != "" {
-				body.Add("client_id", ap.ClientID)
-			}
-		}
-	}
-
-	if len(ap.Scopes) > 0 {
-		body.Add("scope", strings.Join(ap.Scopes, " "))
-	}
-
-	r, err := http.NewRequest("POST", ap.TokenURL, strings.NewReader(body.Encode()))
-	if err != nil {
-		return nil, err
-	}
-	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	if ap.GrantType == grantTypeClientCredentials && ap.ClientSecret != "" {
-		r.SetBasicAuth(ap.ClientID, ap.ClientSecret)
-	}
-
-	client := DefaultRoundTripperClient(&tls.Config{InsecureSkipVerify: ap.tlsSkipVerify}, 10)
-	response, err := client.Do(r)
-	if err != nil {
-		return nil, err
-	}
-
-	bodyRaw, err := ioutil.ReadAll(response.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	if response.StatusCode != 200 {
-		return nil, fmt.Errorf("error in response from OAuth2 token endpoint: %v", string(bodyRaw))
-	}
-
-	var tokenResponse tokenEndpointResponse
-	err = json.Unmarshal(bodyRaw, &tokenResponse)
-	if err != nil {
-		return nil, err
-	}
-
-	if strings.ToLower(tokenResponse.TokenType) != "bearer" {
-		return nil, errors.New("unknown token type returned from token endpoint")
-	}
-
-	return &oauth2Token{
-		Token:     strings.TrimSpace(tokenResponse.AccessToken),
-		ExpiresAt: time.Now().Add(time.Duration(tokenResponse.ExpiresIn) * time.Second),
-	}, nil
-}
-
-func (ap *oauth2ClientCredentialsAuthPlugin) Prepare(req *http.Request) error {
-	minTokenLifetime := float64(10)
-	if ap.tokenCache == nil || time.Until(ap.tokenCache.ExpiresAt).Seconds() < minTokenLifetime {
-		ap.logger.Debug("Requesting token from token_url %v", ap.TokenURL)
-		token, err := ap.requestToken()
-		if err != nil {
-			return err
-		}
-		ap.tokenCache = token
-	}
-
-	req.Header.Add("Authorization", fmt.Sprintf("Bearer %v", ap.tokenCache.Token))
-	return nil
-}
-
-// clientTLSAuthPlugin represents authentication via client certificate on a TLS connection
-type clientTLSAuthPlugin struct {
-	Cert                 string `json:"cert"`
-	PrivateKey           string `json:"private_key"`
-	PrivateKeyPassphrase string `json:"private_key_passphrase,omitempty"`
-	CACert               string `json:"ca_cert,omitempty"`            // Deprecated: Use `services[_].tls.ca_cert` instead
-	SystemCARequired     bool   `json:"system_ca_required,omitempty"` // Deprecated: Use `services[_].tls.system_ca_required` instead
-}
-
-func (ap *clientTLSAuthPlugin) NewClient(c Config) (*http.Client, error) {
-	tlsConfig, err := DefaultTLSConfig(c)
-	if err != nil {
-		return nil, err
-	}
-
-	if ap.Cert == "" {
-		return nil, errors.New("client certificate is needed when client TLS is enabled")
-	}
-	if ap.PrivateKey == "" {
-		return nil, errors.New("private key is needed when client TLS is enabled")
-	}
-
-	var keyPEMBlock []byte
-	data, err := ioutil.ReadFile(ap.PrivateKey)
-	if err != nil {
-		return nil, err
-	}
-
-	block, _ := pem.Decode(data)
-	if block == nil {
-		return nil, errors.New("PEM data could not be found")
-	}
-
-	// nolint: staticcheck // We don't want to forbid users from using this encryption.
-	if x509.IsEncryptedPEMBlock(block) {
-		if ap.PrivateKeyPassphrase == "" {
-			return nil, errors.New("client certificate passphrase is needed, because the certificate is password encrypted")
-		}
-		// nolint: staticcheck // We don't want to forbid users from using this encryption.
-		block, err := x509.DecryptPEMBlock(block, []byte(ap.PrivateKeyPassphrase))
-		if err != nil {
-			return nil, err
-		}
-		key, err := x509.ParsePKCS8PrivateKey(block)
-		if err != nil {
-			key, err = x509.ParsePKCS1PrivateKey(block)
-			if err != nil {
-				return nil, fmt.Errorf("private key should be a PEM or plain PKCS1 or PKCS8; parse error: %v", err)
-			}
-		}
-		rsa, ok := key.(*rsa.PrivateKey)
-		if !ok {
-			return nil, errors.New("private key is invalid")
-		}
-		keyPEMBlock = pem.EncodeToMemory(
-			&pem.Block{
-				Type:  "RSA PRIVATE KEY",
-				Bytes: x509.MarshalPKCS1PrivateKey(rsa),
-			},
-		)
-	} else {
-		keyPEMBlock = data
-	}
-
-	certPEMBlock, err := ioutil.ReadFile(ap.Cert)
-	if err != nil {
-		return nil, err
-	}
-
-	cert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
-	if err != nil {
-		return nil, err
-	}
-	tlsConfig.Certificates = []tls.Certificate{cert}
-
-	var client *http.Client
-
-	if c.TLS != nil && c.TLS.CACert != "" {
-		client = DefaultRoundTripperClient(tlsConfig, *c.ResponseHeaderTimeoutSeconds)
-	} else {
-		if ap.CACert != "" {
-			c.logger.Warn("Deprecated 'services[_].credentials.client_tls.ca_cert' configuration specified. Use 'services[_].tls.ca_cert' instead. See https://www.openpolicyagent.org/docs/latest/configuration/#services")
-			caCert, err := ioutil.ReadFile(ap.CACert)
-			if err != nil {
-				return nil, err
-			}
-
-			var caCertPool *x509.CertPool
-			if ap.SystemCARequired {
-				caCertPool, err = x509.SystemCertPool()
-				if err != nil {
-					return nil, err
-				}
-			} else {
-				caCertPool = x509.NewCertPool()
-			}
-
-			ok := caCertPool.AppendCertsFromPEM(caCert)
-			if !ok {
-				return nil, errors.New("unable to parse and append CA certificate to certificate pool")
-			}
-			tlsConfig.RootCAs = caCertPool
-		}
-
-		client = DefaultRoundTripperClient(tlsConfig, *c.ResponseHeaderTimeoutSeconds)
-	}
-
-	return client, nil
-}
-
-func (ap *clientTLSAuthPlugin) Prepare(req *http.Request) error {
-	return nil
-}
-
-// awsSigningAuthPlugin represents authentication using AWS V4 HMAC signing in the Authorization header
-type awsSigningAuthPlugin struct {
-	AWSEnvironmentCredentials *awsEnvironmentCredentialService `json:"environment_credentials,omitempty"`
-	AWSMetadataCredentials    *awsMetadataCredentialService    `json:"metadata_credentials,omitempty"`
-	AWSWebIdentityCredentials *awsWebIdentityCredentialService `json:"web_identity_credentials,omitempty"`
-	AWSProfileCredentials     *awsProfileCredentialService     `json:"profile_credentials,omitempty"`
-	AWSService                string                           `json:"service,omitempty"`
-
-	logger logging.Logger
-}
-
-func (ap *awsSigningAuthPlugin) awsCredentialService() awsCredentialService {
-	if ap.AWSEnvironmentCredentials != nil {
-		ap.AWSEnvironmentCredentials.logger = ap.logger
-		return ap.AWSEnvironmentCredentials
-	}
-	if ap.AWSWebIdentityCredentials != nil {
-		ap.AWSWebIdentityCredentials.logger = ap.logger
-		return ap.AWSWebIdentityCredentials
-	}
-	if ap.AWSMetadataCredentials != nil {
-		ap.AWSMetadataCredentials.logger = ap.logger
-		return ap.AWSMetadataCredentials
-	}
-	ap.AWSProfileCredentials.logger = ap.logger
-	return ap.AWSProfileCredentials
-}
-
-func (ap *awsSigningAuthPlugin) NewClient(c Config) (*http.Client, error) {
-	t, err := DefaultTLSConfig(c)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := ap.validateConfig(); err != nil {
-		return nil, err
-	}
-
-	if ap.logger == nil {
-		ap.logger = c.logger
-	}
-
-	return DefaultRoundTripperClient(t, *c.ResponseHeaderTimeoutSeconds), nil
-}
-
-func (ap *awsSigningAuthPlugin) Prepare(req *http.Request) error {
-	ap.logger.Debug("Signing request with AWS credentials.")
-	return signV4(req, ap.AWSService, ap.awsCredentialService(), time.Now())
-}
-
-func (ap *awsSigningAuthPlugin) validateConfig() error {
-	cfgs := map[bool]int{}
-	cfgs[ap.AWSEnvironmentCredentials != nil]++
-	cfgs[ap.AWSMetadataCredentials != nil]++
-	cfgs[ap.AWSWebIdentityCredentials != nil]++
-	cfgs[ap.AWSProfileCredentials != nil]++
-
-	switch n := cfgs[true]; {
-	case n == 0:
-		return errors.New("a AWS credential service must be specified when S3 signing is enabled")
-	case n > 1:
-		return errors.New("exactly one AWS credential service must be specified when S3 signing is enabled")
-	}
-
-	if ap.AWSMetadataCredentials != nil {
-		if ap.AWSMetadataCredentials.RegionName == "" {
-			return errors.New("at least aws_region must be specified for AWS metadata credential service")
-		}
-	}
-	if ap.AWSWebIdentityCredentials != nil {
-		if err := ap.AWSWebIdentityCredentials.populateFromEnv(); err != nil {
-			return err
-		}
-	}
-	if ap.AWSService == "" {
-		ap.AWSService = awsSigv4SigningDefaultService
-	}
-	return nil
-}
diff --git a/plugins/rest/rest_test.go b/plugins/rest/rest_test.go
index 002e9f08bc..7d3bff86b7 100644
--- a/plugins/rest/rest_test.go
+++ b/plugins/rest/rest_test.go
@@ -5,6 +5,7 @@
 package rest
 
 import (
+	"bytes"
 	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
@@ -18,7 +19,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"math/big"
 	"net"
 	"net/http"
@@ -34,15 +35,41 @@ import (
 	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 	"github.com/open-policy-agent/opa/internal/jwx/jws"
 	"github.com/open-policy-agent/opa/keys"
+	"github.com/open-policy-agent/opa/logging"
 
 	"github.com/open-policy-agent/opa/internal/version"
 	"github.com/open-policy-agent/opa/util/test"
+
+	testlogger "github.com/open-policy-agent/opa/logging/test"
 )
 
 const keyID = "key1"
 
-func TestNew(t *testing.T) {
+func TestAuthPluginWithNoAuthPluginLookup(t *testing.T) {
+	authPlugin := "anything"
+	cfg := Config{
+		Credentials: struct {
+			Bearer               *bearerAuthPlugin                  `json:"bearer,omitempty"`
+			OAuth2               *oauth2ClientCredentialsAuthPlugin `json:"oauth2,omitempty"`
+			ClientTLS            *clientTLSAuthPlugin               `json:"client_tls,omitempty"`
+			S3Signing            *awsSigningAuthPlugin              `json:"s3_signing,omitempty"`
+			GCPMetadata          *gcpMetadataAuthPlugin             `json:"gcp_metadata,omitempty"`
+			AzureManagedIdentity *azureManagedIdentitiesAuthPlugin  `json:"azure_managed_identity,omitempty"`
+			Plugin               *string                            `json:"plugin,omitempty"`
+		}{
+			Plugin: &authPlugin,
+		},
+	}
+	_, err := cfg.AuthPlugin(nil)
+	if err == nil {
+		t.Error("Expected error but got nil")
+	}
+	if want, have := "missing auth plugin lookup function", err.Error(); want != have {
+		t.Errorf("Unexpected error, want %q, have %q", want, have)
+	}
+}
 
+func TestNew(t *testing.T) {
 	tests := []struct {
 		name    string
 		input   string
@@ -193,7 +220,7 @@ func TestNew(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "TooManyS3CredOptions/metadata+environment",
+			name: "MultipleS3CredOptions/metadata+environment",
 			input: `{
 				"name": "foo",
 				"url": "http://localhost",
@@ -207,10 +234,10 @@ func TestNew(t *testing.T) {
 					}
 				}
 			}`,
-			wantErr: true,
+			wantErr: false,
 		},
 		{
-			name: "TooManyS3CredOptions/metadata+profile+environment+webidentity",
+			name: "MultipleS3CredOptions/metadata+profile+environment+webidentity",
 			input: `{
 				"name": "foo",
 				"url": "http://localhost",
@@ -219,14 +246,22 @@ func TestNew(t *testing.T) {
 						"profile_credentials": {},
 						"environment_credentials": {},
 						"web_identity_credentials": {},
-						"metadata_credentials": {}
+						"metadata_credentials": {
+							"aws_region": "us-east-1",
+							"iam_role": "my_iam_role"
+						}
 					}
 				}
 			}`,
-			wantErr: true,
+			env: map[string]string{
+				awsRoleArnEnvVar:              "TEST",
+				awsWebIdentityTokenFileEnvVar: "TEST",
+				awsRegionEnvVar:               "us-west-2",
+			},
+			wantErr: false,
 		},
 		{
-			name: "TooManyCredentialsOptions",
+			name: "MultipleCredentialsOptions",
 			input: `{
 				"name": "foo",
 				"url": "http://localhost",
@@ -237,7 +272,7 @@ func TestNew(t *testing.T) {
 					"bearer": {
 						"scheme": "Acmecorp-Token",
 						"token": "secret"
-					}					
+					}
 				}
 			}`,
 			wantErr: true,
@@ -623,6 +658,17 @@ func TestNew(t *testing.T) {
         }
 			}`,
 		},
+		{
+			name: "Unknown plugin",
+			input: `{
+				"name": "foo",
+				"url": "http://localhost",
+				"credentials": {
+					"plugin": "unknown_plugin"
+        }
+			}`,
+			wantErr: true,
+		},
 	}
 
 	var results []Client
@@ -654,22 +700,16 @@ func TestNew(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			for key, val := range tc.env {
-				_ = os.Setenv(key, val)
+				t.Setenv(key, val)
 			}
 
-			t.Cleanup(func() {
-				for key := range tc.env {
-					_ = os.Unsetenv(key)
-				}
-			})
-
 			client, err := New([]byte(tc.input), ks, AuthPluginLookup(mockAuthPluginLookup))
 			if err != nil {
 				// We never want an error here and cannot proceed if there is one.
 				t.Fatalf("Unexpected error: %v", err)
 			}
 
-			plugin, err := client.config.authPlugin(mockAuthPluginLookup)
+			plugin, err := client.config.AuthPlugin(mockAuthPluginLookup)
 			if err != nil {
 				if tc.wantErr {
 					return
@@ -762,6 +802,76 @@ func TestDoWithResponseHeaderTimeout(t *testing.T) {
 	}
 }
 
+func TestDoWithResponseInClientLog(t *testing.T) {
+	ctx := context.Background()
+
+	body := "Some Bad Request was received"
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		fmt.Fprintln(w, body)
+	}))
+	defer ts.Close()
+
+	buf := bytes.Buffer{}
+	logger := logging.New()
+	logger.SetOutput(&buf)
+	logger.SetLevel(logging.Debug)
+
+	config := fmt.Sprintf(`{
+				"name": "foo",
+				"url": %q,
+			}`, ts.URL)
+	ks := map[string]*keys.Config{}
+	client, err := New([]byte(config), ks, Logger(logger))
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	_, err = client.Do(ctx, "GET", ts.URL)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	if !strings.Contains(buf.String(), body) {
+		t.Errorf("expected string %q not found in client logs", body)
+	}
+}
+
+func TestDoWithTruncatedResponseInClientLog(t *testing.T) {
+	ctx := context.Background()
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		fmt.Fprintln(w, strings.Repeat("Some Bad Request was received", 50))
+	}))
+	defer ts.Close()
+
+	buf := bytes.Buffer{}
+	logger := logging.New()
+	logger.SetOutput(&buf)
+	logger.SetLevel(logging.Debug)
+
+	config := fmt.Sprintf(`{
+				"name": "foo",
+				"url": %q,
+			}`, ts.URL)
+	ks := map[string]*keys.Config{}
+	client, err := New([]byte(config), ks, Logger(logger))
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	_, err = client.Do(ctx, "GET", ts.URL)
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	exp := "Some Bad Request was recei..."
+	if !strings.Contains(buf.String(), exp) {
+		t.Errorf("expected string %q not found in client logs", exp)
+	}
+}
+
 func TestValidUrl(t *testing.T) {
 	ts := testServer{
 		t:         t,
@@ -854,7 +964,7 @@ func TestBearerTokenPath(t *testing.T) {
 		client = newTestBearerClient(t, &ts, tokenPath)
 
 		if resp, err := client.Do(ctx, "GET", "test"); err == nil {
-			bodyBytes, err := ioutil.ReadAll(resp.Body)
+			bodyBytes, err := io.ReadAll(resp.Body)
 			if err != nil {
 				t.Fatalf("Unexpected error: %v", err)
 			}
@@ -873,7 +983,7 @@ func TestBearerTokenPath(t *testing.T) {
 		}
 
 		// Update the token file and try again
-		if err := ioutil.WriteFile(filepath.Join(path, "token.txt"), []byte("newsecret"), 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(path, "token.txt"), []byte("newsecret"), 0600); err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 
@@ -978,6 +1088,41 @@ func TestBearerTokenInvalidConfig(t *testing.T) {
 	}
 }
 
+func TestBearerTokenIsEncodedForOCI(t *testing.T) {
+	config := `{
+		"name": "foo",
+		"type": "oci",
+		"credentials": {
+			"bearer": {
+				"token": "secret",
+				"scheme": "Bearer"
+			}
+		}
+	}`
+
+	client, err := New([]byte(config), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatalf("New() = %q", err)
+	}
+
+	if _, err := client.config.Credentials.Bearer.NewClient(client.config); err != nil {
+		t.Errorf("Bearer.NewClient() = %q", err)
+	}
+
+	req := httptest.NewRequest("", "http://somewhere.com", nil)
+	if err := client.config.Credentials.Bearer.Prepare(req); err != nil {
+		t.Errorf("Bearer.Prepare() = %q", err)
+	}
+
+	token := base64.StdEncoding.EncodeToString([]byte("secret"))
+
+	want := fmt.Sprintf("Bearer %s", token)
+	got := req.Header.Get("Authorization")
+	if got != want {
+		t.Errorf("req.Header.Get(\"Authorization\") = %q, want = %q", got, want)
+	}
+}
+
 func newTestBearerClient(t *testing.T, ts *testServer, tokenPath string) *Client {
 	config := fmt.Sprintf(`{
 			"name": "foo",
@@ -1034,10 +1179,10 @@ func TestClientCert(t *testing.T) {
 		}
 
 		// Update the key files and try again..
-		if err := ioutil.WriteFile(filepath.Join(path, "client.pem"), ts.clientCertPem, 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(path, "client.pem"), ts.clientCertPem, 0600); err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
-		if err := ioutil.WriteFile(filepath.Join(path, "client.key"), ts.clientCertKey, 0600); err != nil {
+		if err := os.WriteFile(filepath.Join(path, "client.key"), ts.clientCertKey, 0600); err != nil {
 			t.Fatalf("Unexpected error: %s", err)
 		}
 		if _, err := client.Do(ctx, "GET", "test"); err != nil {
@@ -1164,6 +1309,20 @@ func TestOauth2ClientCredentials(t *testing.T) {
 				c.Credentials.OAuth2.Scopes = []string{"read", "opa"}
 			},
 		},
+		{
+			ts:  &testServer{t: t},
+			ots: &oauth2TestServer{t: t, expHeaders: map[string]string{"x-custom-header": "custom-value"}},
+			options: func(c *Config) {
+				c.Credentials.OAuth2.AdditionalHeaders = map[string]string{"x-custom-header": "custom-value"}
+			},
+		},
+		{
+			ts:  &testServer{t: t},
+			ots: &oauth2TestServer{t: t, expBody: map[string]string{"custom_field": "custom-value"}},
+			options: func(c *Config) {
+				c.Credentials.OAuth2.AdditionalParameters = map[string]string{"custom_field": "custom-value"}
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -1466,6 +1625,187 @@ func TestS3SigningInstantiationInitializesLogger(t *testing.T) {
 	}
 }
 
+func TestS3SigningMultiCredentialProvider(t *testing.T) {
+	credentialProviderCount := 4
+	config := `{
+		"name": "foo",
+		"url": "https://bundles.example.com",
+		"credentials": {
+			"s3_signing": {
+				"environment_credentials": {},
+				"profile_credentials": {},
+				"metadata_credentials": {},
+				"web_identity_credentials": {}
+			}
+		}
+	}`
+
+	client, err := New([]byte(config), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	awsPlugin := client.config.Credentials.S3Signing
+	if awsPlugin == nil {
+		t.Fatalf("Client config S3 signing credentials setup unexpected")
+	}
+
+	awsCredentialServiceChain, ok := awsPlugin.awsCredentialService().(*awsCredentialServiceChain)
+	if !ok {
+		t.Fatalf("Unexpected AWS credential service:%v is not a chain",
+			reflect.TypeOf(awsCredentialServiceChain))
+	}
+
+	if len(awsCredentialServiceChain.awsCredentialServices) != credentialProviderCount {
+		t.Fatalf("Credential provider count mismatch %d != %d", credentialProviderCount,
+			len(awsCredentialServiceChain.awsCredentialServices))
+	}
+
+	expectedOrder := []awsCredentialService{
+		&awsEnvironmentCredentialService{},
+		&awsWebIdentityCredentialService{},
+		&awsProfileCredentialService{},
+		&awsMetadataCredentialService{},
+	}
+
+	if !reflect.DeepEqual(awsCredentialServiceChain.awsCredentialServices,
+		expectedOrder) {
+		t.Fatalf("Ordering is unexpected")
+	}
+}
+
+func TestAWSCredentialServiceChain(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		wantErr bool
+		env     map[string]string
+	}{
+		{
+			name: "Fallback to Environment Credential",
+			input: `{
+				"name": "foo",
+				"url": "https://bundles.example.com",
+				"credentials": {
+					"s3_signing": {
+						"web_identity_credentials": {},
+						"environment_credentials": {},
+						"profile_credentials": {},
+						"metadata_credentials": {}
+					}
+				}
+			}`,
+			wantErr: false,
+			env: map[string]string{
+				accessKeyEnvVar: "a",
+				secretKeyEnvVar: "a",
+				awsRegionEnvVar: "us-east-1",
+			},
+		},
+		{
+			name: "No provider is successful",
+			input: `{
+				"name": "foo",
+				"url": "https://bundles.example.com",
+				"credentials": {
+					"s3_signing": {
+						"web_identity_credentials": {},
+						"environment_credentials": {},
+						"profile_credentials": {},
+						"metadata_credentials": {}
+					}
+				}
+			}`,
+			wantErr: true,
+			env:     map[string]string{},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			for key, val := range tc.env {
+				_ = os.Setenv(key, val)
+			}
+
+			t.Cleanup(func() {
+				for key := range tc.env {
+					_ = os.Unsetenv(key)
+				}
+			})
+
+			client, err := New([]byte(tc.input), map[string]*keys.Config{})
+			if err != nil {
+				t.Fatalf("Unexpected error: %v", err)
+			}
+
+			awsPlugin := client.config.Credentials.S3Signing
+			if awsPlugin == nil {
+				t.Fatalf("Client config S3 signing credentials setup unexpected")
+			}
+
+			req, err := http.NewRequest("GET", "/example/bundle.tar.gz", nil)
+			if err != nil {
+				t.Fatalf("Failed to create HTTP request: %v", err)
+			}
+
+			awsPlugin.logger = client.logger
+			err = awsPlugin.Prepare(req)
+			if err != nil && !tc.wantErr {
+				t.Fatalf("Unexpected error: %v", err)
+			} else if err == nil && tc.wantErr {
+				t.Fatalf("Expected error for input %v", tc.input)
+			}
+		})
+	}
+}
+
+func TestDebugLoggingRequestMaskAuthorizationHeader(t *testing.T) {
+	token := "secret"
+	ts := testServer{t: t, expBearerToken: token}
+	ts.start()
+	defer ts.stop()
+
+	config := fmt.Sprintf(`{
+		"name": "foo",
+		"url": %q,
+		"credentials": {
+			"bearer": {
+				"token": %q
+			}
+		}
+	}`, ts.server.URL, token)
+	client, err := New([]byte(config), map[string]*keys.Config{})
+	if err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	logger := testlogger.New()
+	logger.SetLevel(logging.Debug)
+	client.logger = logger
+
+	ctx := context.Background()
+	if _, err := client.Do(ctx, "GET", "test"); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	var reqLogFound bool
+	for _, entry := range logger.Entries() {
+		if entry.Fields["headers"] != nil {
+			headers := entry.Fields["headers"].(http.Header)
+			authzHeader := headers.Get("Authorization")
+			if authzHeader != "" {
+				reqLogFound = true
+				if authzHeader != "REDACTED" {
+					t.Errorf("Excpected redacted Authorization header value, got %v", authzHeader)
+				}
+			}
+		}
+	}
+	if !reqLogFound {
+		t.Fatalf("Expected log entry from request")
+	}
+}
+
 func newTestClient(t *testing.T, ts *testServer, certPath string, keypath string) *Client {
 	config := fmt.Sprintf(`{
 			"name": "foo",
@@ -1518,6 +1858,8 @@ type oauth2TestServer struct {
 	expGrantType     string
 	expClientID      string
 	expClientSecret  string
+	expHeaders       map[string]string
+	expBody          map[string]string
 	expJwtCredential bool
 	expScope         *[]string
 	expAlgorithm     jwa.SignatureAlgorithm
@@ -1673,6 +2015,18 @@ func (t *oauth2TestServer) handle(w http.ResponseWriter, r *http.Request) {
 		t.t.Fatalf("Expected grant_type=%v", t.expGrantType)
 	}
 
+	for k, v := range t.expBody {
+		if r.Form[k][0] != v {
+			t.t.Fatalf("Expected header %s=%s got %s", k, v, r.Form[k][0])
+		}
+	}
+
+	for k, v := range t.expHeaders {
+		if r.Header.Get(k) != v {
+			t.t.Fatalf("Expected header %s=%s got %s", k, v, r.Header.Get(k))
+		}
+	}
+
 	if len(r.Form["scope"]) > 0 {
 		scope := strings.Split(r.Form["scope"][0], " ")
 		if !reflect.DeepEqual(*t.expScope, scope) {
diff --git a/plugins/server/encoding/config.go b/plugins/server/encoding/config.go
new file mode 100644
index 0000000000..4da12d0c07
--- /dev/null
+++ b/plugins/server/encoding/config.go
@@ -0,0 +1,91 @@
+package encoding
+
+import (
+	"compress/gzip"
+	"fmt"
+
+	"github.com/open-policy-agent/opa/util"
+)
+
+var defaultGzipMinLength = 1024
+var defaultGzipCompressionLevel = gzip.BestCompression
+
+// Config represents the configuration for the Server.Encoding settings
+type Config struct {
+	Gzip *Gzip `json:"gzip,omitempty"`
+}
+
+// Gzip represents the configuration for the Server.Encoding.Gzip settings
+type Gzip struct {
+	MinLength        *int `json:"min_length,omitempty"`        // the minimum length of a response that will be gzipped
+	CompressionLevel *int `json:"compression_level,omitempty"` // the compression level for gzip
+}
+
+// ConfigBuilder assists in the construction of the plugin configuration.
+type ConfigBuilder struct {
+	raw []byte
+}
+
+// NewConfigBuilder returns a new ConfigBuilder to build and parse the server config
+func NewConfigBuilder() *ConfigBuilder {
+	return &ConfigBuilder{}
+}
+
+// WithBytes sets the raw server config
+func (b *ConfigBuilder) WithBytes(config []byte) *ConfigBuilder {
+	b.raw = config
+	return b
+}
+
+// Parse returns a valid Config object with defaults injected.
+func (b *ConfigBuilder) Parse() (*Config, error) {
+	if b.raw == nil {
+		defaultConfig := &Config{
+			Gzip: &Gzip{
+				MinLength:        &defaultGzipMinLength,
+				CompressionLevel: &defaultGzipCompressionLevel,
+			},
+		}
+		return defaultConfig, nil
+	}
+
+	var result Config
+
+	if err := util.Unmarshal(b.raw, &result); err != nil {
+		return nil, err
+	}
+
+	return &result, result.validateAndInjectDefaults()
+}
+
+func (c *Config) validateAndInjectDefaults() error {
+	if c.Gzip == nil {
+		c.Gzip = &Gzip{
+			MinLength:        &defaultGzipMinLength,
+			CompressionLevel: &defaultGzipCompressionLevel,
+		}
+	}
+	if c.Gzip.MinLength == nil {
+		c.Gzip.MinLength = &defaultGzipMinLength
+	}
+
+	if c.Gzip.CompressionLevel == nil {
+		c.Gzip.CompressionLevel = &defaultGzipCompressionLevel
+	}
+
+	if *c.Gzip.MinLength <= 0 {
+		return fmt.Errorf("invalid value for server.encoding.gzip.min_length field, should be a positive number")
+	}
+
+	acceptedCompressionLevels := map[int]bool{
+		gzip.NoCompression:   true,
+		gzip.BestSpeed:       true,
+		gzip.BestCompression: true,
+	}
+	_, compressionLevelAccepted := acceptedCompressionLevels[*c.Gzip.CompressionLevel]
+	if !compressionLevelAccepted {
+		return fmt.Errorf("invalid value for server.encoding.gzip.compression_level field, accepted values are 0, 1 or 9")
+	}
+
+	return nil
+}
diff --git a/plugins/server/encoding/config_test.go b/plugins/server/encoding/config_test.go
new file mode 100644
index 0000000000..d8aa7482a3
--- /dev/null
+++ b/plugins/server/encoding/config_test.go
@@ -0,0 +1,105 @@
+package encoding
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestConfigValidation(t *testing.T) {
+	tests := []struct {
+		input   string
+		wantErr bool
+	}{
+		{
+			input:   `{}`,
+			wantErr: false,
+		},
+		{
+			input:   `{"gzip": {"min_length": "not-a-number"}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip": {min_length": 42}}`,
+			wantErr: false,
+		},
+		{
+			input:   `{"gzip":{"min_length": "42"}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip":{"min_length": 0}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip":{"min_length": -10}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip":{"random_key": 0}}`,
+			wantErr: false,
+		},
+		{
+			input:   `{"gzip": {"min_length": -10, "compression_level": 13}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip":{"compression_level": "not-an-number"}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip":{"compression_level": 1}}`,
+			wantErr: false,
+		},
+		{
+			input:   `{"gzip":{"compression_level": 13}}`,
+			wantErr: true,
+		},
+		{
+			input:   `{"gzip":{"min_length": 42, "compression_level": 9}}`,
+			wantErr: false,
+		},
+	}
+
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("TestConfigValidation_case_%d", i), func(t *testing.T) {
+			_, err := NewConfigBuilder().WithBytes([]byte(test.input)).Parse()
+			if err != nil && !test.wantErr {
+				t.Fail()
+			}
+			if err == nil && test.wantErr {
+				t.Fail()
+			}
+		})
+	}
+}
+
+func TestConfigValue(t *testing.T) {
+	tests := []struct {
+		input                         string
+		minLengthExpectedValue        int
+		compressionLevelExpectedValue int
+	}{
+		{
+			input:                         `{}`,
+			minLengthExpectedValue:        1024,
+			compressionLevelExpectedValue: 9,
+		},
+		{
+			input:                         `{"gzip":{"min_length": 42, "compression_level": 1}}`,
+			minLengthExpectedValue:        42,
+			compressionLevelExpectedValue: 1,
+		},
+	}
+
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("TestConfigValue_case_%d", i), func(t *testing.T) {
+			config, err := NewConfigBuilder().WithBytes([]byte(test.input)).Parse()
+			if err != nil {
+				t.Fail()
+			}
+			if *config.Gzip.MinLength != test.minLengthExpectedValue || *config.Gzip.CompressionLevel != test.compressionLevelExpectedValue {
+				t.Fail()
+			}
+		})
+	}
+}
diff --git a/plugins/status/metrics.go b/plugins/status/metrics.go
new file mode 100644
index 0000000000..acfbe67cf7
--- /dev/null
+++ b/plugins/status/metrics.go
@@ -0,0 +1,67 @@
+package status
+
+import (
+	"github.com/open-policy-agent/opa/version"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+var (
+	opaInfo = prometheus.NewGauge(
+		prometheus.GaugeOpts{
+			Name:        "opa_info",
+			Help:        "Information about the OPA environment.",
+			ConstLabels: map[string]string{"version": version.Version},
+		},
+	)
+	pluginStatus = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "plugin_status_gauge",
+			Help: "Gauge for the plugin by status."},
+		[]string{"name", "status"},
+	)
+	loaded = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "bundle_loaded_counter",
+			Help: "Counter for the bundle loaded."},
+		[]string{"name"},
+	)
+	failLoad = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "bundle_failed_load_counter",
+			Help: "Counter for the failed bundle load."},
+		[]string{"name", "code", "message"},
+	)
+	lastRequest = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "last_bundle_request",
+			Help: "Gauge for the last bundle request."},
+		[]string{"name"},
+	)
+	lastSuccessfulActivation = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "last_success_bundle_activation",
+			Help: "Gauge for the last success bundle activation."},
+		[]string{"name", "active_revision"},
+	)
+	lastSuccessfulDownload = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "last_success_bundle_download",
+			Help: "Gauge for the last success bundle download."},
+		[]string{"name"},
+	)
+	lastSuccessfulRequest = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name: "last_success_bundle_request",
+			Help: "Gauge for the last success bundle request."},
+		[]string{"name"},
+	)
+	bundleLoadDuration = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Name:    "bundle_loading_duration_ns",
+		Help:    "Histogram for the bundle loading duration by stage.",
+		Buckets: prometheus.ExponentialBuckets(1000, 2, 20),
+	}, []string{"name", "stage"})
+)
+
+func init() {
+	opaInfo.Set(1)
+}
diff --git a/plugins/status/plugin.go b/plugins/status/plugin.go
index 45c53cc7f0..21be29a781 100644
--- a/plugins/status/plugin.go
+++ b/plugins/status/plugin.go
@@ -12,7 +12,8 @@ import (
 	"net/http"
 	"reflect"
 
-	"github.com/pkg/errors"
+	lstat "github.com/open-policy-agent/opa/plugins/logs/status"
+	prom "github.com/prometheus/client_golang/prometheus"
 
 	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
@@ -31,32 +32,35 @@ type Logger interface {
 // UpdateRequestV1 represents the status update message that OPA sends to
 // remote HTTP endpoints.
 type UpdateRequestV1 struct {
-	Labels    map[string]string          `json:"labels"`
-	Bundle    *bundle.Status             `json:"bundle,omitempty"` // Deprecated: Use bulk `bundles` status updates instead
-	Bundles   map[string]*bundle.Status  `json:"bundles,omitempty"`
-	Discovery *bundle.Status             `json:"discovery,omitempty"`
-	Metrics   map[string]interface{}     `json:"metrics,omitempty"`
-	Plugins   map[string]*plugins.Status `json:"plugins,omitempty"`
+	Labels       map[string]string          `json:"labels"`
+	Bundle       *bundle.Status             `json:"bundle,omitempty"` // Deprecated: Use bulk `bundles` status updates instead
+	Bundles      map[string]*bundle.Status  `json:"bundles,omitempty"`
+	Discovery    *bundle.Status             `json:"discovery,omitempty"`
+	DecisionLogs *lstat.Status              `json:"decision_logs,omitempty"`
+	Metrics      map[string]interface{}     `json:"metrics,omitempty"`
+	Plugins      map[string]*plugins.Status `json:"plugins,omitempty"`
 }
 
 // Plugin implements status reporting. Updates can be triggered by the caller.
 type Plugin struct {
-	manager            *plugins.Manager
-	config             Config
-	bundleCh           chan bundle.Status // Deprecated: Use bulk bundle status updates instead
-	lastBundleStatus   *bundle.Status     // Deprecated: Use bulk bundle status updates instead
-	bulkBundleCh       chan map[string]*bundle.Status
-	lastBundleStatuses map[string]*bundle.Status
-	discoCh            chan bundle.Status
-	lastDiscoStatus    *bundle.Status
-	pluginStatusCh     chan map[string]*plugins.Status
-	lastPluginStatuses map[string]*plugins.Status
-	queryCh            chan chan *UpdateRequestV1
-	stop               chan chan struct{}
-	reconfig           chan interface{}
-	metrics            metrics.Metrics
-	logger             logging.Logger
-	trigger            chan trigger
+	manager                *plugins.Manager
+	config                 Config
+	bundleCh               chan bundle.Status // Deprecated: Use bulk bundle status updates instead
+	lastBundleStatus       *bundle.Status     // Deprecated: Use bulk bundle status updates instead
+	bulkBundleCh           chan map[string]*bundle.Status
+	lastBundleStatuses     map[string]*bundle.Status
+	discoCh                chan bundle.Status
+	lastDiscoStatus        *bundle.Status
+	pluginStatusCh         chan map[string]*plugins.Status
+	decisionLogsCh         chan lstat.Status
+	lastDecisionLogsStatus *lstat.Status
+	lastPluginStatuses     map[string]*plugins.Status
+	queryCh                chan chan *UpdateRequestV1
+	stop                   chan chan struct{}
+	reconfig               chan interface{}
+	metrics                metrics.Metrics
+	logger                 logging.Logger
+	trigger                chan trigger
 }
 
 // Config contains configuration for the plugin.
@@ -65,6 +69,7 @@ type Config struct {
 	Service       string               `json:"service"`
 	PartitionName string               `json:"partition_name,omitempty"`
 	ConsoleLogs   bool                 `json:"console"`
+	Prometheus    bool                 `json:"prometheus"`
 	Trigger       *plugins.TriggerMode `json:"trigger,omitempty"` // trigger mode
 }
 
@@ -86,7 +91,7 @@ func (c *Config) validateAndInjectDefaults(services []string, pluginsList []stri
 		if !found {
 			return fmt.Errorf("invalid plugin name %q in status", *c.Plugin)
 		}
-	} else if c.Service == "" && len(services) != 0 && !c.ConsoleLogs {
+	} else if c.Service == "" && len(services) != 0 && !(c.ConsoleLogs || c.Prometheus) {
 		// For backwards compatibility allow defaulting to the first
 		// service listed, but only if console logging is disabled. If enabled
 		// we can't tell if the deployer wanted to use only console logs or
@@ -107,14 +112,9 @@ func (c *Config) validateAndInjectDefaults(services []string, pluginsList []stri
 		}
 	}
 
-	// If a plugin or service wasn't found, and console logging isn't enabled.
-	if c.Plugin == nil && c.Service == "" && !c.ConsoleLogs {
-		return fmt.Errorf("invalid status config, must have a `service`, `plugin`, or `console` logging specified")
-	}
-
 	t, err := plugins.ValidateAndInjectDefaultsForTriggerMode(trigger, c.Trigger)
 	if err != nil {
-		return errors.Wrap(err, "invalid status config")
+		return fmt.Errorf("invalid status config: %w", err)
 	}
 	c.Trigger = t
 
@@ -176,6 +176,11 @@ func (b *ConfigBuilder) Parse() (*Config, error) {
 		return nil, err
 	}
 
+	if parsedConfig.Plugin == nil && parsedConfig.Service == "" && len(b.services) == 0 && !parsedConfig.ConsoleLogs && !parsedConfig.Prometheus {
+		// Nothing to validate or inject
+		return nil, nil
+	}
+
 	if err := parsedConfig.validateAndInjectDefaults(b.services, b.plugins, b.trigger); err != nil {
 		return nil, err
 	}
@@ -191,6 +196,7 @@ func New(parsedConfig *Config, manager *plugins.Manager) *Plugin {
 		bundleCh:       make(chan bundle.Status),
 		bulkBundleCh:   make(chan map[string]*bundle.Status),
 		discoCh:        make(chan bundle.Status),
+		decisionLogsCh: make(chan lstat.Status),
 		stop:           make(chan chan struct{}),
 		reconfig:       make(chan interface{}),
 		pluginStatusCh: make(chan map[string]*plugins.Status),
@@ -231,6 +237,12 @@ func (p *Plugin) Start(ctx context.Context) error {
 	// to prevent blocking threads pushing the plugin updates.
 	p.manager.RegisterPluginStatusListener(Name, p.UpdatePluginStatus)
 
+	if p.config.Prometheus && p.manager.PrometheusRegister() != nil {
+		p.register(p.manager.PrometheusRegister(), opaInfo, pluginStatus, loaded, failLoad,
+			lastRequest, lastSuccessfulActivation, lastSuccessfulDownload,
+			lastSuccessfulRequest, bundleLoadDuration)
+	}
+
 	// Set the status plugin's status to OK now that everything is registered and
 	// the loop is running. This will trigger an update on the listener with the
 	// current status of all the other plugins too.
@@ -238,6 +250,14 @@ func (p *Plugin) Start(ctx context.Context) error {
 	return nil
 }
 
+func (p *Plugin) register(r prom.Registerer, cs ...prom.Collector) {
+	for _, c := range cs {
+		if err := r.Register(c); err != nil {
+			p.logger.Error("Status metric failed to register on prometheus :%v.", err)
+		}
+	}
+}
+
 // Stop stops the plugin.
 func (p *Plugin) Stop(ctx context.Context) {
 	p.logger.Info("Stopping status reporter.")
@@ -264,6 +284,11 @@ func (p *Plugin) UpdateDiscoveryStatus(status bundle.Status) {
 	p.discoCh <- status
 }
 
+// UpdateDecisionLogsStatus notifies the plugin that status of a decision log upload event.
+func (p *Plugin) UpdateDecisionLogsStatus(status lstat.Status) {
+	p.decisionLogsCh <- status
+}
+
 // UpdatePluginStatus notifies the plugin that a plugin status was updated.
 func (p *Plugin) UpdatePluginStatus(status map[string]*plugins.Status) {
 	p.pluginStatusCh <- status
@@ -283,7 +308,7 @@ func (p *Plugin) Snapshot() *UpdateRequestV1 {
 }
 
 // Trigger can be used to control when the plugin attempts to upload
-//status in manual triggering mode.
+// status in manual triggering mode.
 func (p *Plugin) Trigger(ctx context.Context) error {
 	done := make(chan error)
 	p.trigger <- trigger{ctx: ctx, done: done}
@@ -343,6 +368,16 @@ func (p *Plugin) loop() {
 					p.logger.Info("Status update sent successfully in response to discovery update.")
 				}
 			}
+		case status := <-p.decisionLogsCh:
+			p.lastDecisionLogsStatus = &status
+			if *p.config.Trigger == plugins.TriggerPeriodic {
+				err := p.oneShot(ctx)
+				if err != nil {
+					p.logger.Error("%v.", err)
+				} else {
+					p.logger.Info("Status update sent successfully in response to discovery update.")
+				}
+			}
 		case newConfig := <-p.reconfig:
 			p.reconfigure(newConfig)
 		case respCh := <-p.queryCh:
@@ -377,6 +412,10 @@ func (p *Plugin) oneShot(ctx context.Context) error {
 		}
 	}
 
+	if p.config.Prometheus {
+		updatePrometheusMetrics(req)
+	}
+
 	if p.config.Plugin != nil {
 		proxy, ok := p.manager.Plugin(*p.config.Plugin).(Logger)
 		if !ok {
@@ -391,20 +430,13 @@ func (p *Plugin) oneShot(ctx context.Context) error {
 			Do(ctx, "POST", fmt.Sprintf("/status/%v", p.config.PartitionName))
 
 		if err != nil {
-			return errors.Wrap(err, "Status update failed")
+			return fmt.Errorf("Status update failed: %w", err)
 		}
 
 		defer util.Close(resp)
 
-		switch resp.StatusCode {
-		case http.StatusOK:
-			return nil
-		case http.StatusNotFound:
-			return fmt.Errorf("status update failed, server replied with not found")
-		case http.StatusUnauthorized:
-			return fmt.Errorf("status update failed, server replied with not authorized")
-		default:
-			return fmt.Errorf("status update failed, server replied with HTTP %v", resp.StatusCode)
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			return fmt.Errorf("status update failed, server replied with HTTP %v %v", resp.StatusCode, http.StatusText(resp.StatusCode))
 		}
 	}
 	return nil
@@ -425,11 +457,12 @@ func (p *Plugin) reconfigure(config interface{}) {
 func (p *Plugin) snapshot() *UpdateRequestV1 {
 
 	s := &UpdateRequestV1{
-		Labels:    p.manager.Labels(),
-		Discovery: p.lastDiscoStatus,
-		Bundle:    p.lastBundleStatus,
-		Bundles:   p.lastBundleStatuses,
-		Plugins:   p.lastPluginStatuses,
+		Labels:       p.manager.Labels(),
+		Discovery:    p.lastDiscoStatus,
+		DecisionLogs: p.lastDecisionLogsStatus,
+		Bundle:       p.lastBundleStatus,
+		Bundles:      p.lastBundleStatuses,
+		Plugins:      p.lastPluginStatuses,
 	}
 
 	if p.metrics != nil {
@@ -454,3 +487,30 @@ func (p *Plugin) logUpdate(update *UpdateRequestV1) error {
 	}).Info("Status Log")
 	return nil
 }
+
+func updatePrometheusMetrics(u *UpdateRequestV1) {
+	pluginStatus.Reset()
+	for name, plugin := range u.Plugins {
+		pluginStatus.WithLabelValues(name, string(plugin.State)).Set(1)
+	}
+	lastSuccessfulActivation.Reset()
+	for _, bundle := range u.Bundles {
+		if bundle.Code == "" && !bundle.LastSuccessfulActivation.IsZero() {
+			loaded.WithLabelValues(bundle.Name).Inc()
+		} else {
+			failLoad.WithLabelValues(bundle.Name, bundle.Code, bundle.Message).Inc()
+		}
+		lastSuccessfulActivation.WithLabelValues(bundle.Name, bundle.ActiveRevision).Set(float64(bundle.LastSuccessfulActivation.UnixNano()))
+		lastSuccessfulDownload.WithLabelValues(bundle.Name).Set(float64(bundle.LastSuccessfulDownload.UnixNano()))
+		lastSuccessfulRequest.WithLabelValues(bundle.Name).Set(float64(bundle.LastSuccessfulRequest.UnixNano()))
+		lastRequest.WithLabelValues(bundle.Name).Set(float64(bundle.LastRequest.UnixNano()))
+		if bundle.Metrics != nil {
+			for stage, metric := range bundle.Metrics.All() {
+				switch stage {
+				case "timer_bundle_request_ns", "timer_rego_data_parse_ns", "timer_rego_module_parse_ns", "timer_rego_module_compile_ns", "timer_rego_load_bundles_ns":
+					bundleLoadDuration.WithLabelValues(bundle.Name, stage).Observe(float64(metric.(int64)))
+				}
+			}
+		}
+	}
+}
diff --git a/plugins/status/plugin_go1.17_test.go b/plugins/status/plugin_go1.17_test.go
new file mode 100644
index 0000000000..b4008c2efa
--- /dev/null
+++ b/plugins/status/plugin_go1.17_test.go
@@ -0,0 +1,198 @@
+// Copyright 2018 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+//go:build go1.17
+// +build go1.17
+
+// NOTE(sr): Split off of plugin_test.go, because time.UnixMilli doesn't
+// exist before go 1.17. Can be merged with the other file once we drop
+// support for go 1.16.
+
+package status
+
+import (
+	"context"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/open-policy-agent/opa/plugins/bundle"
+	"github.com/open-policy-agent/opa/version"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/testutil"
+)
+
+func TestPluginPrometheus(t *testing.T) {
+	fixture := newTestFixture(t, nil, func(c *Config) {
+		c.Prometheus = true
+	})
+	fixture.server.ch = make(chan UpdateRequestV1)
+	defer fixture.server.stop()
+
+	ctx := context.Background()
+
+	err := fixture.plugin.Start(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fixture.plugin.Stop(ctx)
+	<-fixture.server.ch
+
+	status := testStatus()
+
+	fixture.plugin.BulkUpdateBundleStatus(map[string]*bundle.Status{"bundle": status})
+	<-fixture.server.ch
+
+	registerMock := fixture.manager.PrometheusRegister().(*prometheusRegisterMock)
+
+	assertOpInformationGauge(t, registerMock)
+
+	if registerMock.Collectors[pluginStatus] != true {
+		t.Fatalf("Plugin status metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[loaded] != true {
+		t.Fatalf("Loaded metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[failLoad] != true {
+		t.Fatalf("FailLoad metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[lastRequest] != true {
+		t.Fatalf("Last request metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[lastSuccessfulActivation] != true {
+		t.Fatalf("Last Successful Activation metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[lastSuccessfulDownload] != true {
+		t.Fatalf("Last Successful Download metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[lastSuccessfulRequest] != true {
+		t.Fatalf("Last Successful Request metric was not registered on prometheus")
+	}
+	if registerMock.Collectors[bundleLoadDuration] != true {
+		t.Fatalf("Bundle Load Duration metric was not registered on prometheus")
+	}
+	if len(registerMock.Collectors) != 9 {
+		t.Fatalf("Number of collectors expected (%v), got %v", 9, len(registerMock.Collectors))
+	}
+
+	lastRequestMetricResult := time.UnixMilli(int64(testutil.ToFloat64(lastRequest) / 1e6))
+	if !lastRequestMetricResult.Equal(status.LastRequest) {
+		t.Fatalf("Last request expected (%v), got %v", status.LastRequest.UTC(), lastRequestMetricResult.UTC())
+	}
+
+	lastSuccessfulRequestMetricResult := time.UnixMilli(int64(testutil.ToFloat64(lastSuccessfulRequest) / 1e6))
+	if !lastSuccessfulRequestMetricResult.Equal(status.LastSuccessfulRequest) {
+		t.Fatalf("Last request expected (%v), got %v", status.LastSuccessfulRequest.UTC(), lastSuccessfulRequestMetricResult.UTC())
+	}
+
+	lastSuccessfulDownloadMetricResult := time.UnixMilli(int64(testutil.ToFloat64(lastSuccessfulDownload) / 1e6))
+	if !lastSuccessfulDownloadMetricResult.Equal(status.LastSuccessfulDownload) {
+		t.Fatalf("Last request expected (%v), got %v", status.LastSuccessfulDownload.UTC(), lastSuccessfulDownloadMetricResult.UTC())
+	}
+
+	lastSuccessfulActivationMetricResult := time.UnixMilli(int64(testutil.ToFloat64(lastSuccessfulActivation) / 1e6))
+	if !lastSuccessfulActivationMetricResult.Equal(status.LastSuccessfulActivation) {
+		t.Fatalf("Last request expected (%v), got %v", status.LastSuccessfulActivation.UTC(), lastSuccessfulActivationMetricResult.UTC())
+	}
+
+	bundlesLoaded := testutil.CollectAndCount(loaded)
+	if bundlesLoaded != 1 {
+		t.Fatalf("Unexpected number of bundle loads (%v), got %v", 1, bundlesLoaded)
+	}
+
+	bundlesFailedToLoad := testutil.CollectAndCount(failLoad)
+	if bundlesFailedToLoad != 0 {
+		t.Fatalf("Unexpected number of bundle fails load (%v), got %v", 0, bundlesFailedToLoad)
+	}
+
+	pluginsStatus := testutil.CollectAndCount(pluginStatus)
+	if pluginsStatus != 1 {
+		t.Fatalf("Unexpected number of plugins (%v), got %v", 1, pluginsStatus)
+	}
+}
+
+func assertOpInformationGauge(t *testing.T, registerMock *prometheusRegisterMock) {
+	gauges := filterGauges(registerMock)
+	if len(gauges) != 1 {
+		t.Fatalf("Expected one registered gauge on prometheus but got %v", len(gauges))
+	}
+
+	gauge := gauges[0]
+
+	fqName := getName(gauge)
+	if fqName != "opa_info" {
+		t.Fatalf("Expected gauge to have name opa_info but was %s", fqName)
+	}
+
+	labels := getConstLabels(gauge)
+	versionAct := labels["version"]
+	if versionAct != version.Version {
+		t.Fatalf("Expected gauge to have version label with value %s but was %s", version.Version, versionAct)
+	}
+}
+
+func getName(gauge prometheus.Gauge) string {
+	desc := reflect.Indirect(reflect.ValueOf(gauge.Desc()))
+	fqName := desc.FieldByName("fqName").String()
+	return fqName
+}
+
+func getConstLabels(gauge prometheus.Gauge) prometheus.Labels {
+	desc := reflect.Indirect(reflect.ValueOf(gauge.Desc()))
+	constLabelPairs := desc.FieldByName("constLabelPairs")
+
+	// put all label pairs into a map for easier comparison.
+	labels := make(prometheus.Labels, constLabelPairs.Len())
+	for i := 0; i < constLabelPairs.Len(); i++ {
+		name := constLabelPairs.Index(i).Elem().FieldByName("Name").Elem().String()
+		value := constLabelPairs.Index(i).Elem().FieldByName("Value").Elem().String()
+		labels[name] = value
+	}
+	return labels
+}
+
+func filterGauges(registerMock *prometheusRegisterMock) []prometheus.Gauge {
+	fltd := make([]prometheus.Gauge, 0)
+
+	for m := range registerMock.Collectors {
+		switch metric := m.(type) {
+		case prometheus.Gauge:
+			fltd = append(fltd, metric)
+		}
+	}
+	return fltd
+}
+
+func TestMetricsBundleWithoutRevision(t *testing.T) {
+	fixture := newTestFixture(t, nil, func(c *Config) {
+		c.Prometheus = true
+	})
+	fixture.server.ch = make(chan UpdateRequestV1)
+	defer fixture.server.stop()
+
+	ctx := context.Background()
+
+	err := fixture.plugin.Start(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fixture.plugin.Stop(ctx)
+	<-fixture.server.ch
+
+	status := testStatus()
+	status.ActiveRevision = ""
+
+	fixture.plugin.BulkUpdateBundleStatus(map[string]*bundle.Status{"bundle": status})
+	<-fixture.server.ch
+
+	bundlesLoaded := testutil.CollectAndCount(loaded)
+	if bundlesLoaded != 1 {
+		t.Fatalf("Unexpected number of bundle loads (%v), got %v", 1, bundlesLoaded)
+	}
+
+	bundlesFailedToLoad := testutil.CollectAndCount(failLoad)
+	if bundlesFailedToLoad != 0 {
+		t.Fatalf("Unexpected number of bundle fails load (%v), got %v", 0, bundlesFailedToLoad)
+	}
+}
diff --git a/plugins/status/plugin_test.go b/plugins/status/plugin_test.go
index edc1651901..06344d8480 100644
--- a/plugins/status/plugin_test.go
+++ b/plugins/status/plugin_test.go
@@ -15,12 +15,16 @@ import (
 	"testing"
 	"time"
 
+	prom "github.com/prometheus/client_golang/prometheus"
+
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
 	"github.com/open-policy-agent/opa/plugins/bundle"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/version"
+
+	lstat "github.com/open-policy-agent/opa/plugins/logs/status"
 )
 
 func TestMain(m *testing.M) {
@@ -75,6 +79,40 @@ func TestPluginStart(t *testing.T) {
 	}
 }
 
+func TestPluginNoLogging(t *testing.T) {
+	// Given no custom plugin, no service(s) and no console logging configured,
+	// this should not be an error, but neither do we need to initiate the plugin
+	cases := []struct {
+		note   string
+		config []byte
+	}{
+		{
+			note:   "no plugin attributes",
+			config: []byte(`{}`),
+		},
+		{
+			note:   "empty plugin configuration",
+			config: []byte(`{"status": {}}`),
+		},
+		{
+			note:   "only disabled console logger",
+			config: []byte(`{"status": {"console": "false"}}`),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			config, err := ParseConfig(tc.config, []string{}, nil)
+			if err != nil {
+				t.Errorf("expected no error: %v", err)
+			}
+			if config != nil {
+				t.Errorf("excected no config for a no-op logging plugin")
+			}
+		})
+	}
+}
+
 func TestPluginStartTriggerManual(t *testing.T) {
 
 	fixture := newTestFixture(t, nil)
@@ -428,6 +466,49 @@ func TestPluginStartDiscovery(t *testing.T) {
 	}
 }
 
+func TestPluginStartDecisionLogs(t *testing.T) {
+
+	fixture := newTestFixture(t, nil)
+	fixture.server.ch = make(chan UpdateRequestV1)
+	defer fixture.server.stop()
+
+	ctx := context.Background()
+
+	err := fixture.plugin.Start(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer fixture.plugin.Stop(ctx)
+
+	// Ignore the plugin updating its status (tested elsewhere)
+	<-fixture.server.ch
+
+	status := &lstat.Status{
+		Code:     "decision_log_error",
+		Message:  "Upload Failed",
+		HTTPCode: "400",
+	}
+
+	fixture.plugin.UpdateDecisionLogsStatus(*status)
+	result := <-fixture.server.ch
+
+	exp := UpdateRequestV1{
+		Labels: map[string]string{
+			"id":      "test-instance-id",
+			"app":     "example-app",
+			"version": version.Version,
+		},
+		DecisionLogs: status,
+		Plugins: map[string]*plugins.Status{
+			"status": {State: plugins.StateOK},
+		},
+	}
+
+	if !reflect.DeepEqual(result, exp) {
+		t.Fatalf("Expected: %+v but got: %+v", exp, result)
+	}
+}
+
 func TestPluginBadAuth(t *testing.T) {
 	fixture := newTestFixture(t, nil)
 	ctx := context.Background()
@@ -438,6 +519,9 @@ func TestPluginBadAuth(t *testing.T) {
 	if err == nil {
 		t.Fatal("Expected error")
 	}
+	if err.Error() != "status update failed, server replied with HTTP 401 Unauthorized" {
+		t.Fatalf("Unexpected error contents: %v", err)
+	}
 }
 
 func TestPluginBadPath(t *testing.T) {
@@ -450,6 +534,9 @@ func TestPluginBadPath(t *testing.T) {
 	if err == nil {
 		t.Fatal("Expected error")
 	}
+	if err.Error() != "status update failed, server replied with HTTP 404 Not Found" {
+		t.Fatalf("Unexpected error contents: %v", err)
+	}
 }
 
 func TestPluginBadStatus(t *testing.T) {
@@ -462,6 +549,36 @@ func TestPluginBadStatus(t *testing.T) {
 	if err == nil {
 		t.Fatal("Expected error")
 	}
+	if err.Error() != "status update failed, server replied with HTTP 500 Internal Server Error" {
+		t.Fatalf("Unexpected error contents: %v", err)
+	}
+}
+
+func TestPluginNonstandardStatus(t *testing.T) {
+	fixture := newTestFixture(t, nil)
+	ctx := context.Background()
+	fixture.server.expCode = 599
+	defer fixture.server.stop()
+	fixture.plugin.lastBundleStatuses = map[string]*bundle.Status{}
+	err := fixture.plugin.oneShot(ctx)
+	if err == nil {
+		t.Fatal("Expected error")
+	}
+	if err.Error() != "status update failed, server replied with HTTP 599 " {
+		t.Fatalf("Unexpected error contents: %v", err)
+	}
+}
+
+func TestPlugin2xxStatus(t *testing.T) {
+	fixture := newTestFixture(t, nil)
+	ctx := context.Background()
+	fixture.server.expCode = 204
+	defer fixture.server.stop()
+	fixture.plugin.lastBundleStatuses = map[string]*bundle.Status{}
+	err := fixture.plugin.oneShot(ctx)
+	if err != nil {
+		t.Fatal("Expected no error")
+	}
 }
 
 func TestPluginReconfigure(t *testing.T) {
@@ -560,16 +677,6 @@ func TestParseConfigDefaultServiceWithConsole(t *testing.T) {
 	}
 }
 
-func TestParseConfigDefaultServiceWithNoServiceOrConsole(t *testing.T) {
-	loggerConfig := []byte(`{}`)
-
-	_, err := ParseConfig(loggerConfig, []string{}, nil)
-
-	if err == nil {
-		t.Error("Expected an error but err==nil")
-	}
-}
-
 func TestParseConfigTriggerMode(t *testing.T) {
 	cases := []struct {
 		note     string
@@ -664,7 +771,10 @@ func newTestFixture(t *testing.T, m metrics.Metrics, options ...testPluginCustom
 				}
 			]}`, ts.server.URL))
 
-	manager, err := plugins.New(managerConfig, "test-instance-id", inmem.New())
+	registerMock := &prometheusRegisterMock{
+		Collectors: map[prom.Collector]bool{},
+	}
+	manager, err := plugins.New(managerConfig, "test-instance-id", inmem.New(), plugins.WithPrometheusRegister(registerMock))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -719,15 +829,18 @@ func (t *testServer) stop() {
 }
 
 func testStatus() *bundle.Status {
-
 	tDownload, _ := time.Parse(time.RFC3339Nano, "2018-01-01T00:00:00.0000000Z")
 	tActivate, _ := time.Parse(time.RFC3339Nano, "2018-01-01T00:00:01.0000000Z")
+	tSuccessfulRequest, _ := time.Parse(time.RFC3339Nano, "2018-01-01T00:00:02.0000000Z")
+	tRequest, _ := time.Parse(time.RFC3339Nano, "2018-01-01T00:00:03.0000000Z")
 
 	status := bundle.Status{
 		Name:                     "example/authz",
 		ActiveRevision:           "quickbrawnfaux",
 		LastSuccessfulDownload:   tDownload,
 		LastSuccessfulActivation: tActivate,
+		LastRequest:              tRequest,
+		LastSuccessfulRequest:    tSuccessfulRequest,
 	}
 
 	return &status
@@ -778,3 +891,23 @@ func TestPluginCustomBackend(t *testing.T) {
 		t.Fatalf("Unexpected number of reqs: expected 2, got %d: %v", len(backend.reqs), backend.reqs)
 	}
 }
+
+type prometheusRegisterMock struct {
+	Collectors map[prom.Collector]bool
+}
+
+func (p prometheusRegisterMock) Register(collector prom.Collector) error {
+	p.Collectors[collector] = true
+	return nil
+}
+
+func (p prometheusRegisterMock) MustRegister(collector ...prom.Collector) {
+	for _, c := range collector {
+		p.Collectors[c] = true
+	}
+}
+
+func (p prometheusRegisterMock) Unregister(collector prom.Collector) bool {
+	delete(p.Collectors, collector)
+	return true
+}
diff --git a/profiler/profiler.go b/profiler/profiler.go
index 6908f9f4b5..62dfd2d38d 100644
--- a/profiler/profiler.go
+++ b/profiler/profiler.go
@@ -16,13 +16,15 @@ import (
 
 // Profiler computes and reports on the time spent on expressions.
 type Profiler struct {
-	hits        map[string]map[int]ExprStats
-	activeTimer time.Time
-	prevExpr    exprInfo
+	hits            map[string]map[int]ExprStats
+	hitsByExprIndex map[string]map[int]map[int]ExprStats
+	activeTimer     time.Time
+	prevExpr        exprInfo
 }
 
 // exprInfo stores information about an expression.
 type exprInfo struct {
+	index    int
 	location *ast.Location
 	op       topdown.Op
 }
@@ -30,7 +32,8 @@ type exprInfo struct {
 // New returns a new Profiler object.
 func New() *Profiler {
 	return &Profiler{
-		hits: map[string]map[int]ExprStats{},
+		hits:            map[string]map[int]ExprStats{},
+		hitsByExprIndex: map[string]map[int]map[int]ExprStats{},
 	}
 }
 
@@ -52,9 +55,13 @@ func (p *Profiler) ReportByFile() Report {
 	p.processLastExpr()
 
 	report := Report{Files: map[string]*FileReport{}}
+
 	for file, hits := range p.hits {
 		stats := []ExprStats{}
-		for _, stat := range hits {
+		for row, stat := range hits {
+			if entry, ok := p.hitsByExprIndex[file][row]; ok {
+				stat.NumGenExpr = len(entry)
+			}
 			stats = append(stats, stat)
 		}
 
@@ -66,6 +73,7 @@ func (p *Profiler) ReportByFile() Report {
 		}
 		fr.Result = stats
 	}
+
 	return report
 }
 
@@ -73,10 +81,14 @@ func (p *Profiler) ReportByFile() Report {
 // criteria. If N <= 0, all the results based on the criteria are returned.
 func (p *Profiler) ReportTopNResults(numResults int, criteria []string) []ExprStats {
 	p.processLastExpr()
+
 	stats := []ExprStats{}
 
-	for _, hits := range p.hits {
-		for _, stat := range hits {
+	for file, hits := range p.hits {
+		for row, stat := range hits {
+			if entry, ok := p.hitsByExprIndex[file][row]; ok {
+				stat.NumGenExpr = len(entry)
+			}
 			stats = append(stats, stat)
 		}
 	}
@@ -92,6 +104,9 @@ func (p *Profiler) ReportTopNResults(numResults int, criteria []string) []ExprSt
 	allowedCriteria["num_redo"] = func(stat1, stat2 *ExprStats) bool {
 		return stat1.NumRedo > stat2.NumRedo
 	}
+	allowedCriteria["num_gen_expr"] = func(stat1, stat2 *ExprStats) bool {
+		return stat1.NumGenExpr > stat2.NumGenExpr
+	}
 	allowedCriteria["file"] = func(stat1, stat2 *ExprStats) bool {
 		return stat1.Location.File > stat2.Location.File
 	}
@@ -156,11 +171,14 @@ func (p *Profiler) processExpr(expr *ast.Expr, eventType topdown.Op) {
 		p.prevExpr = exprInfo{
 			op:       eventType,
 			location: expr.Location,
+			index:    expr.Index,
 		}
 		return
 	}
 
 	// record the profiler results for the previous expression
+	p.calculateHitsByExprIndex()
+
 	file := p.prevExpr.location.File
 	hits, ok := p.hits[file]
 	if !ok {
@@ -190,16 +208,53 @@ func (p *Profiler) processExpr(expr *ast.Expr, eventType topdown.Op) {
 	p.prevExpr = exprInfo{
 		op:       eventType,
 		location: expr.Location,
+		index:    expr.Index,
 	}
 }
 
 func (p *Profiler) processLastExpr() {
 	expr := ast.Expr{
 		Location: p.prevExpr.location,
+		Index:    p.prevExpr.index,
 	}
 	p.processExpr(&expr, p.prevExpr.op)
 }
 
+func (p *Profiler) calculateHitsByExprIndex() {
+	file := p.prevExpr.location.File
+	hitsUnique, ok := p.hitsByExprIndex[file]
+
+	if !ok {
+		hitsUnique = map[int]map[int]ExprStats{}
+		hitsUnique[p.prevExpr.location.Row] = map[int]ExprStats{p.prevExpr.index: getProfilerStats(p.prevExpr, p.activeTimer)}
+		p.hitsByExprIndex[file] = hitsUnique
+	} else {
+		row := p.prevExpr.location.Row
+		idx := p.prevExpr.index
+
+		pStats, ok := hitsUnique[row]
+		if !ok {
+			hitsUnique[row] = map[int]ExprStats{idx: getProfilerStats(p.prevExpr, p.activeTimer)}
+		} else {
+			pStatsIdx, ok := pStats[idx]
+			if !ok {
+				hitsUnique[row][idx] = getProfilerStats(p.prevExpr, p.activeTimer)
+			} else {
+				pStatsIdx.ExprTimeNs += time.Since(p.activeTimer).Nanoseconds()
+
+				switch p.prevExpr.op {
+				case topdown.EvalOp:
+					pStatsIdx.NumEval++
+				case topdown.RedoOp:
+					pStatsIdx.NumRedo++
+				}
+
+				hitsUnique[row][idx] = pStatsIdx
+			}
+		}
+	}
+}
+
 func getProfilerStats(expr exprInfo, timer time.Time) ExprStats {
 	profilerStats := ExprStats{}
 	profilerStats.ExprTimeNs = time.Since(timer).Nanoseconds()
@@ -219,6 +274,7 @@ type ExprStats struct {
 	ExprTimeNs int64         `json:"total_time_ns"`
 	NumEval    int           `json:"num_eval"`
 	NumRedo    int           `json:"num_redo"`
+	NumGenExpr int           `json:"num_gen_expr"`
 	Location   *ast.Location `json:"location"`
 }
 
@@ -228,6 +284,7 @@ type ExprStatsAggregated struct {
 	ExprTimeNsStats interface{}   `json:"total_time_ns_stats"`
 	NumEval         int           `json:"num_eval"`
 	NumRedo         int           `json:"num_redo"`
+	NumGenExpr      int           `json:"num_gen_expr"`
 	Location        *ast.Location `json:"location"`
 }
 
@@ -236,11 +293,12 @@ func aggregate(stats ...ExprStats) ExprStatsAggregated {
 		return ExprStatsAggregated{}
 	}
 	res := ExprStatsAggregated{
-		NumEval:  stats[0].NumEval,
-		NumRedo:  stats[0].NumRedo,
-		Location: stats[0].Location,
+		NumEval:    stats[0].NumEval,
+		NumRedo:    stats[0].NumRedo,
+		NumGenExpr: stats[0].NumGenExpr,
+		Location:   stats[0].Location,
 	}
-	var timeNs []int64
+	timeNs := make([]int64, 0, len(stats))
 	for _, s := range stats {
 		timeNs = append(timeNs, s.ExprTimeNs)
 	}
diff --git a/profiler/profiler_test.go b/profiler/profiler_test.go
index a02ad29d9d..a706415960 100644
--- a/profiler/profiler_test.go
+++ b/profiler/profiler_test.go
@@ -23,6 +23,7 @@ func TestProfilerLargeArray(t *testing.T) {
 	module := `package test
 
 foo {
+	p
 	bar
 	not baz
 	bee
@@ -44,7 +45,15 @@ baz {
 	true
 	false
 	true
-}`
+}
+
+p {
+	a := 1
+	b := 2
+	c := 3
+	x = a + b * c
+}
+`
 
 	_, err := ast.ParseModule("test.rego", module)
 	if err != nil {
@@ -71,13 +80,14 @@ baz {
 		t.Fatal("Expected file report for test.rego")
 	}
 
-	if len(fr.Result) != 11 {
-		t.Fatalf("Expected file report length to be 11 instead got %v", len(fr.Result))
+	if len(fr.Result) != 16 {
+		t.Fatalf("Expected file report length to be 16 instead got %v", len(fr.Result))
 	}
 
-	expectedNumEval := []int{1, 2, 1, 1, 1, 1633, 1, 1, 1, 1, 1}
-	expectedNumRedo := []int{1, 0, 0, 1, 1633, 0, 1, 1, 1, 1, 0}
-	expectedRow := []int{4, 5, 6, 10, 11, 12, 16, 17, 18, 22, 23}
+	expectedNumEval := []int{1, 1, 2, 1, 1, 1, 1633, 1, 1, 1, 1, 1, 1, 1, 1, 3}
+	expectedNumRedo := []int{1, 1, 0, 0, 1, 1633, 0, 1, 1, 1, 1, 0, 1, 1, 1, 3}
+	expectedRow := []int{4, 5, 6, 7, 11, 12, 13, 17, 18, 19, 23, 24, 29, 30, 31, 32}
+	expectedNumGenExpr := []int{1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3}
 
 	for idx, actualExprStat := range fr.Result {
 		if actualExprStat.NumEval != expectedNumEval[idx] {
@@ -92,6 +102,9 @@ baz {
 			t.Fatalf("Index %v: Expected row %v but got %v", idx, expectedRow[idx], actualExprStat.Location.Row)
 		}
 
+		if actualExprStat.NumGenExpr != expectedNumGenExpr[idx] {
+			t.Fatalf("Index %v: Expected number of generated expressions %v but got %v", idx, expectedNumGenExpr[idx], actualExprStat.NumGenExpr)
+		}
 	}
 }
 
@@ -106,10 +119,10 @@ func TestProfileCheckExprDuration(t *testing.T) {
 		),
 	})
 
-	topdown.RegisterFunctionalBuiltin1("test.sleep", func(a ast.Value) (ast.Value, error) {
-		d, _ := time.ParseDuration(string(a.(ast.String)))
+	topdown.RegisterBuiltinFunc("test.sleep", func(_ topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		d, _ := time.ParseDuration(string(operands[0].Value.(ast.String)))
 		time.Sleep(d)
-		return ast.Null{}, nil
+		return iter(ast.NullTerm())
 	})
 
 	module := `package test
@@ -151,8 +164,8 @@ func TestProfileCheckExprDuration(t *testing.T) {
 		t.Fatalf("Expected text is test.sleep(\"100ms\") but got %v", string(fr.Result[0].Location.Text))
 	}
 
-	if fr.Result[0].ExprTimeNs <= time.Duration(50*time.Millisecond).Nanoseconds() {
-		t.Fatalf("Expected eval time is atleast 100 msec but got %v", fr.Result[0].ExprTimeNs)
+	if fr.Result[0].ExprTimeNs <= 50*time.Millisecond.Nanoseconds() {
+		t.Fatalf("Expected eval time is at least 100 msec but got %v", fr.Result[0].ExprTimeNs)
 	}
 
 }
@@ -464,6 +477,7 @@ allowed_operations = [
 
 	expectedNumEval := []int{2, 1}
 	expectedNumRedo := []int{2, 1}
+	expectedNumGenExpr := []int{1, 1}
 	expectedLocation := []string{"???", "data.partial.__result__"}
 
 	for idx, actualExprStat := range fr.Result {
@@ -475,10 +489,13 @@ allowed_operations = [
 			t.Fatalf("Index %v: Expected number of redos %v but got %v", idx, expectedNumRedo[idx], actualExprStat.NumRedo)
 		}
 
+		if actualExprStat.NumGenExpr != expectedNumGenExpr[idx] {
+			t.Fatalf("Index %v: Expected number of generated expressions %v but got %v", idx, expectedNumGenExpr[idx], actualExprStat.NumGenExpr)
+		}
+
 		if string(actualExprStat.Location.Text) != expectedLocation[idx] {
 			t.Fatalf("Index %v: Expected location %v but got %v", idx, expectedLocation[idx], string(actualExprStat.Location.Text))
 		}
-
 	}
 }
 
diff --git a/refactor/refactor_test.go b/refactor/refactor_test.go
index ac55d89b05..6a06318142 100644
--- a/refactor/refactor_test.go
+++ b/refactor/refactor_test.go
@@ -337,7 +337,7 @@ p = 7`)
 		t.Fatal("Expected error but got nil")
 	}
 
-	errMsg := "rego_type_error: conflicting rules named p found"
+	errMsg := "rego_type_error: conflicting rules data.b.p found"
 	if !strings.Contains(err.Error(), errMsg) {
 		t.Fatalf("Expected error message %v but got %v", errMsg, err.Error())
 	}
diff --git a/rego/example_test.go b/rego/example_test.go
index 039c52986c..851d2a45af 100644
--- a/rego/example_test.go
+++ b/rego/example_test.go
@@ -10,11 +10,12 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strings"
 
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/storage/disk"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
@@ -341,7 +342,7 @@ func ExampleRego_Eval_persistent_storage() {
 	}
 
 	// Manually create a persistent storage-layer in a temporary directory.
-	rootDir, err := ioutil.TempDir("", "rego_example")
+	rootDir, err := os.MkdirTemp("", "rego_example")
 	if err != nil {
 		panic(err)
 	}
@@ -352,7 +353,7 @@ func ExampleRego_Eval_persistent_storage() {
 	// user's data is stored on a different row. Assuming the policy only reads
 	// data for a single user to process the policy query, OPA can avoid loading
 	// _all_ user data into memory this way.
-	store, err := disk.New(ctx, disk.Options{
+	store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
 		Dir:        rootDir,
 		Partitions: []storage.Path{{"example", "user"}},
 	})
@@ -379,7 +380,7 @@ func ExampleRego_Eval_persistent_storage() {
 	// Re-open the store in the same directory.
 	store.Close(ctx)
 
-	store2, err := disk.New(ctx, disk.Options{
+	store2, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
 		Dir:        rootDir,
 		Partitions: []storage.Path{{"example", "user"}},
 	})
@@ -704,6 +705,7 @@ func ExampleRego_Eval_trace_simple() {
 	//
 	// query:1     Enter x = 1
 	// query:1     | Eval x = 1
+	// query:1     | Unify x = 1
 	// query:1     | Exit x = 1
 	// query:1     Redo x = 1
 	// query:1     | Redo x = 1
@@ -731,6 +733,7 @@ func ExampleRego_Eval_tracer() {
 	//
 	// query:1     Enter x = 1
 	// query:1     | Eval x = 1
+	// query:1     | Unify x = 1
 	// query:1     | Exit x = 1
 	// query:1     Redo x = 1
 	// query:1     | Redo x = 1
@@ -944,6 +947,47 @@ func ExampleRego_custom_function_caching() {
 	// y: 1
 }
 
+func ExampleRego_custom_function_nondeterministic() {
+	ndbCache := builtins.NDBCache{}
+	r := rego.New(
+		// An example query that uses a custom function.
+		rego.Query(`x = myrandom()`),
+
+		// A custom function that uses caching.
+		rego.FunctionDyn(
+			&rego.Function{
+				Name:             "myrandom",
+				Memoize:          true,
+				Nondeterministic: true,
+				Decl: types.NewFunction(
+					nil,     // one string input
+					types.N, // one number output
+				),
+			},
+			func(_ topdown.BuiltinContext, args []*ast.Term) (*ast.Term, error) {
+				i := 55555
+				return ast.IntNumberTerm(i), nil
+			},
+		),
+		rego.NDBuiltinCache(ndbCache),
+	)
+
+	rs, err := r.Eval(context.Background())
+	if err != nil {
+		// handle error
+	}
+
+	// Check the binding, and what the NDBCache saw.
+	// This ensures the Nondeterministic flag propagated through correctly.
+	fmt.Println("x:", rs[0].Bindings["x"])
+	fmt.Println("NDBCache:", ndbCache["myrandom"])
+
+	// Output:
+	//
+	// x: 55555
+	// NDBCache: {[]: 55555}
+}
+
 func ExampleRego_custom_function_global() {
 
 	decl := &rego.Function{
diff --git a/rego/rego.go b/rego/rego.go
index 29ed235255..b3211a9047 100644
--- a/rego/rego.go
+++ b/rego/rego.go
@@ -19,18 +19,20 @@ import (
 	bundleUtils "github.com/open-policy-agent/opa/internal/bundle"
 	"github.com/open-policy-agent/opa/internal/compiler/wasm"
 	"github.com/open-policy-agent/opa/internal/future"
-	"github.com/open-policy-agent/opa/internal/ir"
 	"github.com/open-policy-agent/opa/internal/planner"
 	"github.com/open-policy-agent/opa/internal/rego/opa"
 	"github.com/open-policy-agent/opa/internal/wasm/encoding"
+	"github.com/open-policy-agent/opa/ir"
 	"github.com/open-policy-agent/opa/loader"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/resolver"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/storage/inmem"
 	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
+	"github.com/open-policy-agent/opa/tracing"
 	"github.com/open-policy-agent/opa/types"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -114,9 +116,12 @@ type EvalContext struct {
 	indexing               bool
 	earlyExit              bool
 	interQueryBuiltinCache cache.InterQueryCache
+	ndBuiltinCache         builtins.NDBCache
 	resolvers              []refResolver
 	sortSets               bool
+	copyMaps               bool
 	printHook              print.Hook
+	capabilities           *ast.Capabilities
 }
 
 // EvalOption defines a function to set an option on an EvalConfig
@@ -251,6 +256,14 @@ func EvalInterQueryBuiltinCache(c cache.InterQueryCache) EvalOption {
 	}
 }
 
+// EvalNDBuiltinCache sets the non-deterministic builtin cache that built-in functions can
+// use during evaluation.
+func EvalNDBuiltinCache(c builtins.NDBCache) EvalOption {
+	return func(e *EvalContext) {
+		e.ndBuiltinCache = c
+	}
+}
+
 // EvalResolver sets a Resolver for a specified ref path for this evaluation.
 func EvalResolver(ref ast.Ref, r resolver.Resolver) EvalOption {
 	return func(e *EvalContext) {
@@ -265,6 +278,13 @@ func EvalSortSets(yes bool) EvalOption {
 	}
 }
 
+// EvalCopyMaps causes the evaluator to copy `map[string]interface{}`s before returning them.
+func EvalCopyMaps(yes bool) EvalOption {
+	return func(e *EvalContext) {
+		e.copyMaps = yes
+	}
+}
+
 // EvalPrintHook sets the object to use for handling print statement outputs.
 func EvalPrintHook(ph print.Hook) EvalOption {
 	return func(e *EvalContext) {
@@ -310,6 +330,7 @@ func (pq preparedQuery) newEvalContext(ctx context.Context, options []EvalOption
 		earlyExit:        true,
 		resolvers:        pq.r.resolvers,
 		printHook:        pq.r.printHook,
+		capabilities:     pq.r.capabilities,
 	}
 
 	for _, o := range options {
@@ -505,7 +526,9 @@ type Rego struct {
 	bundles                map[string]*bundle.Bundle
 	skipBundleVerification bool
 	interQueryBuiltinCache cache.InterQueryCache
+	ndBuiltinCache         builtins.NDBCache
 	strictBuiltinErrors    bool
+	builtinErrorList       *[]topdown.Error
 	resolvers              []refResolver
 	schemaSet              *ast.SchemaSet
 	target                 string // target type (wasm, rego, etc.)
@@ -513,13 +536,16 @@ type Rego struct {
 	generateJSON           func(*ast.Term, *EvalContext) (interface{}, error)
 	printHook              print.Hook
 	enablePrintStatements  bool
+	distributedTacingOpts  tracing.Options
+	strict                 bool
 }
 
 // Function represents a built-in function that is callable in Rego.
 type Function struct {
-	Name    string
-	Decl    *types.Function
-	Memoize bool
+	Name             string
+	Decl             *types.Function
+	Memoize          bool
+	Nondeterministic bool
 }
 
 // BuiltinContext contains additional attributes from the evaluator that
@@ -546,8 +572,9 @@ type (
 // RegisterBuiltin1 adds a built-in function globally inside the OPA runtime.
 func RegisterBuiltin1(decl *Function, impl Builtin1) {
 	ast.RegisterBuiltin(&ast.Builtin{
-		Name: decl.Name,
-		Decl: decl.Decl,
+		Name:             decl.Name,
+		Decl:             decl.Decl,
+		Nondeterministic: decl.Nondeterministic,
 	})
 	topdown.RegisterBuiltinFunc(decl.Name, func(bctx BuiltinContext, terms []*ast.Term, iter func(*ast.Term) error) error {
 		result, err := memoize(decl, bctx, terms, func() (*ast.Term, error) { return impl(bctx, terms[0]) })
@@ -558,8 +585,9 @@ func RegisterBuiltin1(decl *Function, impl Builtin1) {
 // RegisterBuiltin2 adds a built-in function globally inside the OPA runtime.
 func RegisterBuiltin2(decl *Function, impl Builtin2) {
 	ast.RegisterBuiltin(&ast.Builtin{
-		Name: decl.Name,
-		Decl: decl.Decl,
+		Name:             decl.Name,
+		Decl:             decl.Decl,
+		Nondeterministic: decl.Nondeterministic,
 	})
 	topdown.RegisterBuiltinFunc(decl.Name, func(bctx BuiltinContext, terms []*ast.Term, iter func(*ast.Term) error) error {
 		result, err := memoize(decl, bctx, terms, func() (*ast.Term, error) { return impl(bctx, terms[0], terms[1]) })
@@ -570,8 +598,9 @@ func RegisterBuiltin2(decl *Function, impl Builtin2) {
 // RegisterBuiltin3 adds a built-in function globally inside the OPA runtime.
 func RegisterBuiltin3(decl *Function, impl Builtin3) {
 	ast.RegisterBuiltin(&ast.Builtin{
-		Name: decl.Name,
-		Decl: decl.Decl,
+		Name:             decl.Name,
+		Decl:             decl.Decl,
+		Nondeterministic: decl.Nondeterministic,
 	})
 	topdown.RegisterBuiltinFunc(decl.Name, func(bctx BuiltinContext, terms []*ast.Term, iter func(*ast.Term) error) error {
 		result, err := memoize(decl, bctx, terms, func() (*ast.Term, error) { return impl(bctx, terms[0], terms[1], terms[2]) })
@@ -582,8 +611,9 @@ func RegisterBuiltin3(decl *Function, impl Builtin3) {
 // RegisterBuiltin4 adds a built-in function globally inside the OPA runtime.
 func RegisterBuiltin4(decl *Function, impl Builtin4) {
 	ast.RegisterBuiltin(&ast.Builtin{
-		Name: decl.Name,
-		Decl: decl.Decl,
+		Name:             decl.Name,
+		Decl:             decl.Decl,
+		Nondeterministic: decl.Nondeterministic,
 	})
 	topdown.RegisterBuiltinFunc(decl.Name, func(bctx BuiltinContext, terms []*ast.Term, iter func(*ast.Term) error) error {
 		result, err := memoize(decl, bctx, terms, func() (*ast.Term, error) { return impl(bctx, terms[0], terms[1], terms[2], terms[3]) })
@@ -594,8 +624,9 @@ func RegisterBuiltin4(decl *Function, impl Builtin4) {
 // RegisterBuiltinDyn adds a built-in function globally inside the OPA runtime.
 func RegisterBuiltinDyn(decl *Function, impl BuiltinDyn) {
 	ast.RegisterBuiltin(&ast.Builtin{
-		Name: decl.Name,
-		Decl: decl.Decl,
+		Name:             decl.Name,
+		Decl:             decl.Decl,
+		Nondeterministic: decl.Nondeterministic,
 	})
 	topdown.RegisterBuiltinFunc(decl.Name, func(bctx BuiltinContext, terms []*ast.Term, iter func(*ast.Term) error) error {
 		result, err := memoize(decl, bctx, terms, func() (*ast.Term, error) { return impl(bctx, terms) })
@@ -1011,6 +1042,13 @@ func InterQueryBuiltinCache(c cache.InterQueryCache) func(r *Rego) {
 	}
 }
 
+// NDBuiltinCache sets the non-deterministic builtins cache.
+func NDBuiltinCache(c builtins.NDBCache) func(r *Rego) {
+	return func(r *Rego) {
+		r.ndBuiltinCache = c
+	}
+}
+
 // StrictBuiltinErrors tells the evaluator to treat all built-in function errors as fatal errors.
 func StrictBuiltinErrors(yes bool) func(r *Rego) {
 	return func(r *Rego) {
@@ -1018,6 +1056,13 @@ func StrictBuiltinErrors(yes bool) func(r *Rego) {
 	}
 }
 
+// BuiltinErrorList supplies an error slice to store built-in function errors.
+func BuiltinErrorList(list *[]topdown.Error) func(r *Rego) {
+	return func(r *Rego) {
+		r.builtinErrorList = list
+	}
+}
+
 // Resolver sets a Resolver for a specified ref path.
 func Resolver(ref ast.Ref, r resolver.Resolver) func(r *Rego) {
 	return func(rego *Rego) {
@@ -1062,6 +1107,13 @@ func PrintHook(h print.Hook) func(r *Rego) {
 	}
 }
 
+// DistributedTracingOpts sets the options to be used by distributed tracing.
+func DistributedTracingOpts(tr tracing.Options) func(r *Rego) {
+	return func(r *Rego) {
+		r.distributedTacingOpts = tr
+	}
+}
+
 // EnablePrintStatements enables print() calls. If this option is not provided,
 // print() calls will be erased from the policy. This option only applies to
 // queries and policies that passed as raw strings, i.e., this function will not
@@ -1072,6 +1124,13 @@ func EnablePrintStatements(yes bool) func(r *Rego) {
 	}
 }
 
+// Strict enables or disables strict-mode in the compiler
+func Strict(yes bool) func(r *Rego) {
+	return func(r *Rego) {
+		r.strict = yes
+	}
+}
+
 // New returns a new Rego object.
 func New(options ...func(r *Rego)) *Rego {
 
@@ -1095,7 +1154,9 @@ func New(options ...func(r *Rego)) *Rego {
 			WithDebug(r.dump).
 			WithSchemas(r.schemaSet).
 			WithCapabilities(r.capabilities).
-			WithEnablePrintStatements(r.enablePrintStatements)
+			WithEnablePrintStatements(r.enablePrintStatements).
+			WithStrict(r.strict).
+			WithUseTypeCheckAnnotations(true)
 	}
 
 	if r.store == nil {
@@ -1154,6 +1215,10 @@ func (r *Rego) Eval(ctx context.Context) (ResultSet, error) {
 		EvalSeed(r.seed),
 	}
 
+	if r.ndBuiltinCache != nil {
+		evalArgs = append(evalArgs, EvalNDBuiltinCache(r.ndBuiltinCache))
+	}
+
 	for _, qt := range r.queryTracers {
 		evalArgs = append(evalArgs, EvalQueryTracer(qt))
 	}
@@ -1226,6 +1291,10 @@ func (r *Rego) Partial(ctx context.Context) (*PartialQueries, error) {
 		EvalInterQueryBuiltinCache(r.interQueryBuiltinCache),
 	}
 
+	if r.ndBuiltinCache != nil {
+		evalArgs = append(evalArgs, EvalNDBuiltinCache(r.ndBuiltinCache))
+	}
+
 	for _, t := range r.queryTracers {
 		evalArgs = append(evalArgs, EvalQueryTracer(t))
 	}
@@ -1268,7 +1337,7 @@ func (r *Rego) Compile(ctx context.Context, opts ...CompileOption) (*CompileResu
 	}
 
 	var queries []ast.Body
-	var modules []*ast.Module
+	modules := make([]*ast.Module, 0, len(r.compiler.Modules))
 
 	if cfg.partial {
 
@@ -1620,7 +1689,14 @@ func (r *Rego) prepare(ctx context.Context, qType queryType, extras []extraStage
 }
 
 func (r *Rego) parseModules(ctx context.Context, txn storage.Transaction, m metrics.Metrics) error {
-	if len(r.modules) == 0 {
+	ids, err := r.store.ListPolicies(ctx, txn)
+	if err != nil {
+		return err
+	}
+
+	// if there are no raw modules, nor modules in the store, then there
+	// is nothing to do.
+	if len(r.modules) == 0 && len(ids) == 0 {
 		return nil
 	}
 
@@ -1631,11 +1707,6 @@ func (r *Rego) parseModules(ctx context.Context, txn storage.Transaction, m metr
 	// Parse any modules in the are saved to the store, but only if
 	// another compile step is going to occur (ie. we have parsed modules
 	// that need to be compiled).
-	ids, err := r.store.ListPolicies(ctx, txn)
-	if err != nil {
-		return err
-	}
-
 	for _, id := range ids {
 		// if it is already on the compiler we're using
 		// then don't bother to re-parse it from source
@@ -1660,7 +1731,14 @@ func (r *Rego) parseModules(ctx context.Context, txn storage.Transaction, m metr
 	for _, module := range r.modules {
 		p, err := module.Parse()
 		if err != nil {
-			errs = append(errs, err)
+			switch errorWithType := err.(type) {
+			case ast.Errors:
+				for _, e := range errorWithType {
+					errs = append(errs, e)
+				}
+			default:
+				errs = append(errs, errorWithType)
+			}
 		}
 		r.parsedModules[module.filename] = p
 	}
@@ -1682,7 +1760,7 @@ func (r *Rego) loadFiles(ctx context.Context, txn storage.Transaction, m metrics
 
 	result, err := loader.NewFileLoader().
 		WithMetrics(m).
-		WithProcessAnnotation(r.schemaSet != nil).
+		WithProcessAnnotation(true).
 		Filtered(r.loadPaths.paths, r.loadPaths.filter)
 	if err != nil {
 		return err
@@ -1711,7 +1789,7 @@ func (r *Rego) loadBundles(ctx context.Context, txn storage.Transaction, m metri
 	for _, path := range r.bundlePaths {
 		bndl, err := loader.NewFileLoader().
 			WithMetrics(m).
-			WithProcessAnnotation(r.schemaSet != nil).
+			WithProcessAnnotation(true).
 			WithSkipBundleVerification(r.skipBundleVerification).
 			AsBundle(path)
 		if err != nil {
@@ -1762,6 +1840,7 @@ func (r *Rego) parseQuery(futureImports []*ast.Import, m metrics.Metrics) (ast.B
 	if err != nil {
 		return nil, err
 	}
+	popts.SkipRules = true
 	return ast.ParseBodyWithOpts(r.query, popts)
 }
 
@@ -1866,7 +1945,8 @@ func (r *Rego) compileQuery(query ast.Body, imports []*ast.Import, m metrics.Met
 	qc := r.compiler.QueryCompiler().
 		WithContext(qctx).
 		WithUnsafeBuiltins(r.unsafeBuiltins).
-		WithEnablePrintStatements(r.enablePrintStatements)
+		WithEnablePrintStatements(r.enablePrintStatements).
+		WithStrict(false)
 
 	for _, extra := range extras {
 		qc = qc.WithStageAfter(extra.after, extra.stage)
@@ -1896,13 +1976,19 @@ func (r *Rego) eval(ctx context.Context, ectx *EvalContext) (ResultSet, error) {
 		WithEarlyExit(ectx.earlyExit).
 		WithInterQueryBuiltinCache(ectx.interQueryBuiltinCache).
 		WithStrictBuiltinErrors(r.strictBuiltinErrors).
+		WithBuiltinErrorList(r.builtinErrorList).
 		WithSeed(ectx.seed).
-		WithPrintHook(ectx.printHook)
+		WithPrintHook(ectx.printHook).
+		WithDistributedTracingOpts(r.distributedTacingOpts)
 
 	if !ectx.time.IsZero() {
 		q = q.WithTime(ectx.time)
 	}
 
+	if ectx.ndBuiltinCache != nil {
+		q = q.WithNDBuiltinCache(ectx.ndBuiltinCache)
+	}
+
 	for i := range ectx.queryTracers {
 		q = q.WithQueryTracer(ectx.queryTracers[i])
 	}
@@ -1958,7 +2044,9 @@ func (r *Rego) evalWasm(ctx context.Context, ectx *EvalContext) (ResultSet, erro
 		Time:                   ectx.time,
 		Seed:                   ectx.seed,
 		InterQueryBuiltinCache: ectx.interQueryBuiltinCache,
+		NDBuiltinCache:         ectx.ndBuiltinCache,
 		PrintHook:              ectx.printHook,
+		Capabilities:           ectx.capabilities,
 	})
 	if err != nil {
 		return nil, err
@@ -2065,6 +2153,7 @@ func (r *Rego) partialResult(ctx context.Context, pCfg *PrepareConfig) (PartialR
 		instrumentation:  r.instrumentation,
 		indexing:         true,
 		resolvers:        r.resolvers,
+		capabilities:     r.capabilities,
 	}
 
 	disableInlining := r.disableInlining
@@ -2133,9 +2222,10 @@ func (r *Rego) partial(ctx context.Context, ectx *EvalContext) (*PartialQueries,
 
 	var unknowns []*ast.Term
 
-	if ectx.parsedUnknowns != nil {
+	switch {
+	case ectx.parsedUnknowns != nil:
 		unknowns = ectx.parsedUnknowns
-	} else if ectx.unknowns != nil {
+	case ectx.unknowns != nil:
 		unknowns = make([]*ast.Term, len(ectx.unknowns))
 		for i := range ectx.unknowns {
 			var err error
@@ -2144,7 +2234,7 @@ func (r *Rego) partial(ctx context.Context, ectx *EvalContext) (*PartialQueries,
 				return nil, err
 			}
 		}
-	} else {
+	default:
 		// Use input document as unknown if caller has not specified any.
 		unknowns = []*ast.Term{ast.NewTerm(ast.InputRootRef)}
 	}
@@ -2174,6 +2264,10 @@ func (r *Rego) partial(ctx context.Context, ectx *EvalContext) (*PartialQueries,
 		q = q.WithTime(ectx.time)
 	}
 
+	if ectx.ndBuiltinCache != nil {
+		q = q.WithNDBuiltinCache(ectx.ndBuiltinCache)
+	}
+
 	for i := range ectx.queryTracers {
 		q = q.WithQueryTracer(ectx.queryTracers[i])
 	}
@@ -2505,8 +2599,9 @@ func finishFunction(name string, bctx topdown.BuiltinContext, result *ast.Term,
 func newFunction(decl *Function, f topdown.BuiltinFunc) func(*Rego) {
 	return func(r *Rego) {
 		r.builtinDecls[decl.Name] = &ast.Builtin{
-			Name: decl.Name,
-			Decl: decl.Decl,
+			Name:             decl.Name,
+			Decl:             decl.Decl,
+			Nondeterministic: decl.Nondeterministic,
 		}
 		r.builtinFuncs[decl.Name] = &topdown.Builtin{
 			Decl: r.builtinDecls[decl.Name],
@@ -2516,5 +2611,9 @@ func newFunction(decl *Function, f topdown.BuiltinFunc) func(*Rego) {
 }
 
 func generateJSON(term *ast.Term, ectx *EvalContext) (interface{}, error) {
-	return ast.JSONWithOpt(term.Value, ast.JSONOpt{SortSets: ectx.sortSets})
+	return ast.JSONWithOpt(term.Value,
+		ast.JSONOpt{
+			SortSets: ectx.sortSets,
+			CopyMaps: ectx.copyMaps,
+		})
 }
diff --git a/rego/rego_bench_test.go b/rego/rego_bench_test.go
new file mode 100644
index 0000000000..b64e02f9b7
--- /dev/null
+++ b/rego/rego_bench_test.go
@@ -0,0 +1,70 @@
+package rego
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/runtime"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
+	"github.com/open-policy-agent/opa/util/test"
+)
+
+func BenchmarkPartialObjectRuleCrossModule(b *testing.B) {
+	ctx := context.Background()
+	sizes := []int{10, 100, 1000}
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			store := inmem.NewFromObject(map[string]interface{}{})
+			mods := test.PartialObjectBenchmarkCrossModule(n)
+			query := "data.test.foo"
+
+			input := make(map[string]interface{})
+			for idx := 0; idx <= 3; idx++ {
+				input[fmt.Sprintf("test_input_%d", idx)] = "test_input_10"
+			}
+			inputAST, err := ast.InterfaceToValue(input)
+			if err != nil {
+				b.Fatal(err)
+			}
+
+			compiler := ast.MustCompileModules(map[string]string{
+				"test/foo.rego": mods[0],
+				"test/bar.rego": mods[1],
+				"test/baz.rego": mods[2],
+			})
+			info, err := runtime.Term(runtime.Params{})
+			if err != nil {
+				b.Fatal(err)
+			}
+
+			pq, err := New(
+				Query(query),
+				Compiler(compiler),
+				Store(store),
+				Runtime(info),
+			).PrepareForEval(ctx)
+
+			if err != nil {
+				b.Fatal(err)
+			}
+
+			b.ResetTimer()
+
+			for i := 0; i < b.N; i++ {
+				_, err = pq.Eval(
+					ctx,
+					EvalParsedInput(inputAST),
+					EvalRuleIndexing(true),
+					EvalEarlyExit(true),
+				)
+
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
diff --git a/rego/rego_test.go b/rego/rego_test.go
index 0b251ec5d1..ad80cd599e 100644
--- a/rego/rego_test.go
+++ b/rego/rego_test.go
@@ -18,6 +18,7 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -29,6 +30,7 @@ import (
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/storage/inmem"
 	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/types"
 	"github.com/open-policy-agent/opa/util"
@@ -243,13 +245,13 @@ func TestRegoCancellation(t *testing.T) {
 		),
 	})
 
-	topdown.RegisterFunctionalBuiltin1("test.sleep", func(a ast.Value) (ast.Value, error) {
-		d, _ := time.ParseDuration(string(a.(ast.String)))
+	topdown.RegisterBuiltinFunc("test.sleep", func(_ topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		d, _ := time.ParseDuration(string(operands[0].Value.(ast.String)))
 		time.Sleep(d)
-		return ast.Null{}, nil
+		return iter(ast.NullTerm())
 	})
 
-	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond*50)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond*10)
 	r := New(Query(`test.sleep("1s")`))
 	rs, err := r.Eval(ctx)
 	cancel()
@@ -606,6 +608,65 @@ func TestRegoDisableIndexing(t *testing.T) {
 	}
 }
 
+func TestRegoDisableIndexingWithMatch(t *testing.T) {
+	tracer := topdown.NewBufferTracer()
+	mod := `
+	package test
+
+	p {
+		input.x = 1
+	}
+
+	p {
+		input.y = 1
+	}
+	`
+	pq, err := New(
+		Query("data"),
+		Module("foo.rego", mod),
+	).PrepareForEval(context.Background())
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+
+	rs, err := pq.Eval(
+		context.Background(),
+		EvalQueryTracer(tracer),
+		EvalRuleIndexing(false),
+		EvalInput(map[string]interface{}{"x": 1}),
+	)
+	if err != nil {
+		t.Fatalf("unexpected error %s", err)
+	}
+
+	assertResultSet(t, rs, `[[{"test": {"p": true}}]]`)
+
+	var evalNodes []string
+	for _, e := range *tracer {
+		if e.Op == topdown.EvalOp {
+			evalNodes = append(evalNodes, string(e.Node.Loc().Text))
+		}
+	}
+
+	expectedEvalNodes := []string{
+		"input.x = 1",
+		"input.y = 1",
+	}
+
+	for _, expected := range expectedEvalNodes {
+		found := false
+		for _, actual := range evalNodes {
+			if actual == expected {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Fatalf("Missing expected eval node in trace: %q\nGot: %q\n", expected, evalNodes)
+		}
+	}
+}
+
 func TestRegoCatchPathConflicts(t *testing.T) {
 	r := New(
 		Query("data"),
@@ -658,6 +719,61 @@ func TestPartialRewriteEquals(t *testing.T) {
 	}
 }
 
+// NOTE(sr): https://github.com/open-policy-agent/opa/issues/4345
+func TestPrepareAndEvalRaceConditions(t *testing.T) {
+	tests := []struct {
+		note   string
+		module string
+		exp    string
+	}{
+		{
+			note: "object",
+			module: `package test
+			p[{"x":"y"}]`,
+			exp: `[[[{"x":"y"}]]]`,
+		},
+		{
+			note: "set",
+			module: `package test
+			p[{"x"}]`,
+			exp: `[[[["x"]]]]`,
+		},
+		{
+			note: "array",
+			module: `package test
+			p[["x"]]`,
+			exp: `[[[["x"]]]]`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			r := New(
+				Query("data.test.p"),
+				Module("", tc.module),
+				Package("foo"),
+			)
+
+			pq, err := r.PrepareForEval(context.Background())
+			if err != nil {
+				t.Fatalf("Unexpected error: %s", err.Error())
+			}
+
+			// run this 1000 times concurrently
+			var wg sync.WaitGroup
+			wg.Add(1000)
+			for i := 0; i < 1000; i++ {
+				go func(t *testing.T) {
+					t.Helper()
+					assertPreparedEvalQueryEval(t, pq, []EvalOption{}, tc.exp)
+					wg.Done()
+				}(t)
+			}
+			wg.Wait()
+		})
+	}
+}
+
 func TestPrepareAndEvalNewInput(t *testing.T) {
 	module := `
 	package test
@@ -880,6 +996,29 @@ func TestPrepareAndEvalOriginal(t *testing.T) {
 	assertEval(t, r, "[[2]]")
 }
 
+func TestPrepareAndEvalOnlyOneErrorOccurredPrintOnce(t *testing.T) {
+	module := `
+	package test
+    package test
+	x = input.y
+	`
+
+	r := New(
+		Query("data.test.x"),
+		Module("", module),
+		Package("foo"),
+		Input(map[string]int{"y": 2}),
+	)
+
+	_, err := r.PrepareForEval(context.Background())
+	if err == nil {
+		t.Fatal("Expected error but got nil")
+	}
+	if strings.Count(err.Error(), "1 error occurred") > 1 {
+		t.Fatalf("Expected to print '1 error occurred' only once")
+	}
+}
+
 func TestPrepareAndEvalNewPrintHook(t *testing.T) {
 	module := `
 	package test
@@ -1380,6 +1519,7 @@ func TestUnsafeBuiltins(t *testing.T) {
 	ctx := context.Background()
 
 	unsafeCountExpr := "unsafe built-in function calls in expression: count"
+	unsafeCountExprWith := `with keyword replacing built-in function: target must not be unsafe: "count"`
 
 	t.Run("unsafe query", func(t *testing.T) {
 		r := New(
@@ -1391,6 +1531,16 @@ func TestUnsafeBuiltins(t *testing.T) {
 		}
 	})
 
+	t.Run("unsafe query, 'with' replacement", func(t *testing.T) {
+		r := New(
+			Query(`is_array([1, 2, 3]) with is_array as count`),
+			UnsafeBuiltins(map[string]struct{}{"count": {}}),
+		)
+		if _, err := r.Eval(ctx); err == nil || !strings.Contains(err.Error(), unsafeCountExprWith) {
+			t.Fatalf("Expected unsafe built-in error but got %v", err)
+		}
+	})
+
 	t.Run("unsafe module", func(t *testing.T) {
 		r := New(
 			Query(`data.pkg.deny`),
@@ -1406,6 +1556,36 @@ func TestUnsafeBuiltins(t *testing.T) {
 		}
 	})
 
+	t.Run("unsafe module, 'with' replacement in query", func(t *testing.T) {
+		r := New(
+			Query(`data.pkg.deny with is_array as count`),
+			Module("pkg.rego", `package pkg
+			deny {
+				is_array(input.requests) > 10
+			}
+			`),
+			UnsafeBuiltins(map[string]struct{}{"count": {}}),
+		)
+		if _, err := r.Eval(ctx); err == nil || !strings.Contains(err.Error(), unsafeCountExprWith) {
+			t.Fatalf("Expected unsafe built-in error but got %v", err)
+		}
+	})
+
+	t.Run("unsafe module, 'with' replacement in module", func(t *testing.T) {
+		r := New(
+			Query(`data.pkg.deny`),
+			Module("pkg.rego", `package pkg
+			deny {
+				is_array(input.requests) > 10 with is_array as count
+			}
+			`),
+			UnsafeBuiltins(map[string]struct{}{"count": {}}),
+		)
+		if _, err := r.Eval(ctx); err == nil || !strings.Contains(err.Error(), unsafeCountExprWith) {
+			t.Fatalf("Expected unsafe built-in error but got %v", err)
+		}
+	})
+
 	t.Run("inherit in query", func(t *testing.T) {
 		r := New(
 			Compiler(ast.NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"count": {}})),
@@ -1416,6 +1596,16 @@ func TestUnsafeBuiltins(t *testing.T) {
 		}
 	})
 
+	t.Run("inherit in query, 'with' replacement", func(t *testing.T) {
+		r := New(
+			Compiler(ast.NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"count": {}})),
+			Query("is_array([]) with is_array as count"),
+		)
+		if _, err := r.Eval(ctx); err == nil || !strings.Contains(err.Error(), unsafeCountExprWith) {
+			t.Fatalf("Expected unsafe built-in error but got %v", err)
+		}
+	})
+
 	t.Run("override/disable in query", func(t *testing.T) {
 		r := New(
 			Compiler(ast.NewCompiler().WithUnsafeBuiltins(map[string]struct{}{"count": {}})),
@@ -1463,7 +1653,7 @@ func TestPreparedQueryGetModules(t *testing.T) {
 		"c.rego": "package c\nr = 1",
 	}
 
-	var regoArgs []func(r *Rego)
+	regoArgs := make([]func(r *Rego), 0, len(mods)+1)
 
 	for name, mod := range mods {
 		regoArgs = append(regoArgs, Module(name, mod))
@@ -1759,7 +1949,6 @@ func TestRegoCustomBuiltinPartialPropagate(t *testing.T) {
 }
 
 func TestRegoPartialResultRecursiveRefs(t *testing.T) {
-
 	r := New(Query("data"), Module("test.rego", `package foo.bar
 
 	default p = false
@@ -1954,6 +2143,179 @@ func TestEvalWithInterQueryCache(t *testing.T) {
 	}
 }
 
+// We use http.send to ensure the NDBuiltinCache is involved.
+func TestEvalWithNDCache(t *testing.T) {
+	var requests []*http.Request
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r)
+		_, _ = w.Write([]byte(`{"x": 1}`))
+	}))
+	defer ts.Close()
+	query := fmt.Sprintf(`http.send({"method": "get", "url": "%s", "force_json_decode": true})`, ts.URL)
+
+	// Set up the ND cache, and put in some arbitrary constants for the first K/V pair.
+	arbitraryKey := ast.Number(strconv.Itoa(2015))
+	arbitraryValue := ast.String("First commit year")
+	ndBC := builtins.NDBCache{}
+	ndBC.Put("arbitrary_experiment", arbitraryKey, arbitraryValue)
+
+	// Query execution of http.send should add an entry to the NDBuiltinCache.
+	ctx := context.Background()
+	_, err := New(Query(query), NDBuiltinCache(ndBC)).Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Check and make sure we got exactly 2x items back in the ND builtin cache.
+	// NDBuiltinCache always has the structure: map[ast.String]map[ast.Array]ast.Value
+	if len(ndBC) != 2 {
+		t.Fatalf("Expected exactly 2 items in non-deterministic builtin cache. Found %d items.\n", len(ndBC))
+	}
+	// Check the cached k/v types for the HTTP section of the cache.
+	if cachedResults, ok := ndBC["http.send"]; ok {
+		err := cachedResults.Iter(func(k, v *ast.Term) error {
+			if _, ok := k.Value.(*ast.Array); !ok {
+				t.Fatalf("http.send failed to store Object key in the ND builtins cache")
+			}
+			if _, ok := v.Value.(ast.Object); !ok {
+				t.Fatalf("http.send failed to store Object value in the ND builtins cache")
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// Ensure our original arbitrary data in the cache was preserved.
+	if v, ok := ndBC.Get("arbitrary_experiment", arbitraryKey); ok {
+		if v != arbitraryValue {
+			t.Fatalf("Non-deterministic builtins cache value was mangled. Expected: %v, got: %v\n", arbitraryValue, v)
+		}
+	} else {
+		t.Fatal("Non-deterministic builtins cache lookup failed.")
+	}
+}
+
+func TestEvalWithPrebuiltNDCache(t *testing.T) {
+	query := "time.now_ns()"
+	ndBC := builtins.NDBCache{}
+
+	// Populate the cache for time.now_ns with an arbitrary timestamp.
+	timeValue, err := time.Parse("2006-01-02T15:04:05Z", "2015-12-28T14:08:25Z")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Timestamp ns value will be: 1451311705000000000
+	ndBC.Put("time.now_ns", ast.NewArray(), ast.Number(json.Number(strconv.FormatInt(timeValue.UnixNano(), 10))))
+	// time.now_ns should use the cached entry instead of the current time.
+	ctx := context.Background()
+	rs, err := New(Query(query), NDBuiltinCache(ndBC)).Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Check that we got the correct time value in the result set.
+	assertResultSet(t, rs, "[[1451311705000000000]]")
+}
+
+func TestNDBCacheWithRuleBody(t *testing.T) {
+	ctx := context.Background()
+	ts := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	defer ts.Close()
+
+	ndBC := builtins.NDBCache{}
+	query := "data.foo.p = x"
+	_, err := New(
+		Query(query),
+		NDBuiltinCache(ndBC),
+		Module("test.rego", fmt.Sprintf(`package foo
+p {
+	http.send({"url": "%s", "method":"get"})
+}`, ts.URL)),
+	).Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, ok := ndBC["http.send"]
+	if !ok {
+		t.Fatalf("expected http.send cache entry")
+	}
+}
+
+// Catches issues around iteration with ND builtins.
+func TestNDBCacheWithRuleBodyAndIteration(t *testing.T) {
+	ctx := context.Background()
+	ts := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+	}))
+	defer ts.Close()
+
+	ndBC := builtins.NDBCache{}
+	query := "data.foo.results = x"
+	_, err := New(
+		Query(query),
+		NDBuiltinCache(ndBC),
+		Module("test.rego", fmt.Sprintf(`package foo
+
+import future.keywords
+
+urls := [
+	"%[1]s/headers",
+	"%[1]s/ip",
+	"%[1]s/user-agent"
+]
+
+results[response] {
+	some url in urls
+	response := http.send({
+		"method": "GET",
+		"url": url
+	})
+}`, ts.URL)),
+	).Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Ensure that the cache exists, and has exactly 3 entries.
+	entries, ok := ndBC["http.send"]
+	if !ok {
+		t.Fatalf("expected http.send cache entry")
+	}
+	if entries.Len() != 3 {
+		t.Fatalf("expected 3 http.send cache entries, received:\n%v", ndBC)
+	}
+}
+
+// This test ensures that the NDBCache correctly serializes/deserializes.
+func TestNDBCacheMarshalUnmarshalJSON(t *testing.T) {
+	original := builtins.NDBCache{}
+
+	// Populate the cache for time.now_ns with an arbitrary timestamp.
+	original.Put("time.now_ns", ast.NewArray(), ast.Number(json.Number(strconv.FormatInt(1451311705000000000, 10))))
+	jOriginal, err := json.Marshal(original)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var other builtins.NDBCache
+	err = json.Unmarshal(jOriginal, &other)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	jOther, err := json.Marshal(other)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Check that the two NDBCache value's JSONified forms match exactly.
+	if !bytes.Equal(jOriginal, jOther) {
+		t.Fatalf("JSONified values of NDBCaches do not match; expected %s, got %s", string(jOriginal), string(jOther))
+	}
+}
+
 func TestStrictBuiltinErrors(t *testing.T) {
 	_, err := New(Query("1/0"), StrictBuiltinErrors(true)).Eval(context.Background())
 	if err == nil {
@@ -1973,6 +2335,23 @@ func TestStrictBuiltinErrors(t *testing.T) {
 	}
 }
 
+func TestBuiltinErrorList(t *testing.T) {
+	var buf []topdown.Error
+
+	_, err := New(Query("1/0"), BuiltinErrorList(&buf)).Eval(context.Background())
+	if err != nil {
+		t.Fatal("unexpected error")
+	}
+
+	if len(buf) != 1 {
+		t.Fatal("expected 1 error in buffer")
+	}
+
+	if buf[0].Error() != "1/0: eval_builtin_error: div: divide by zero" {
+		t.Fatal("expected divide by zero error but got:", buf[0].Error())
+	}
+}
+
 func TestTimeSeedingOptions(t *testing.T) {
 
 	ctx := context.Background()
@@ -2082,3 +2461,97 @@ func TestGenerateJSON(t *testing.T) {
 	)
 	assertEval(t, r, `[["converted-input"]]`)
 }
+
+func TestRegoLazyObjDefault(t *testing.T) {
+	foo := map[string]interface{}{"foo": "bar", "other": 1}
+	store := inmem.NewFromObjectWithOpts(map[string]interface{}{
+		"stored": foo,
+	})
+	r := New(
+		Query("x = data.stored"),
+		Store(store),
+	)
+
+	ctx := context.Background()
+	rs, err := r.Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	act, ok := rs[0].Bindings["x"]
+	if !ok {
+		t.Fatalf("expected binding for \"x\", got %v", rs[0].Bindings)
+	}
+	m, ok := act.(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected %T, got %T: %[2]v", m, act)
+	}
+	m["fox"] = true
+
+	if _, ok := foo["fox"]; ok {
+		t.Errorf("expected no change in foo, found one: %v", foo)
+	}
+}
+
+func TestRegoLazyObjNoRoundTripOnWrite(t *testing.T) {
+	foo := map[string]interface{}{"foo": "bar", "other": 1}
+	store := inmem.NewFromObjectWithOpts(map[string]interface{}{
+		"stored": foo,
+	}, inmem.OptRoundTripOnWrite(false))
+	r := New(
+		Query("x = data.stored"),
+		Store(store),
+	)
+
+	ctx := context.Background()
+	rs, err := r.Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	act, ok := rs[0].Bindings["x"]
+	if !ok {
+		t.Fatalf("expected binding for \"x\", got %v", rs[0].Bindings)
+	}
+	m, ok := act.(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected %T, got %T: %[2]v", m, act)
+	}
+	m["fox"] = true
+
+	if v, ok := foo["fox"]; !ok || !v.(bool) {
+		t.Errorf("expected change in foo, found none: %v", foo)
+	}
+}
+
+func TestRegoLazyObjCopyMaps(t *testing.T) {
+	foo := map[string]interface{}{"foo": "bar", "other": 1}
+	store := inmem.NewFromObjectWithOpts(map[string]interface{}{
+		"stored": foo,
+	}, inmem.OptRoundTripOnWrite(false))
+	r := New(
+		Query("x = data.stored"),
+		Store(store),
+	)
+
+	ctx := context.Background()
+	pq, err := r.PrepareForEval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rs, err := pq.Eval(ctx, EvalCopyMaps(true))
+	if err != nil {
+		t.Fatal(err)
+	}
+	act, ok := rs[0].Bindings["x"]
+	if !ok {
+		t.Fatalf("expected binding for \"x\", got %v", rs[0].Bindings)
+	}
+	m, ok := act.(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected %T, got %T: %[2]v", m, act)
+	}
+	m["fox"] = true
+
+	if _, ok := foo["fox"]; ok {
+		t.Errorf("expected no change in foo, found one: %v", foo)
+	}
+}
diff --git a/rego/rego_wasmtarget_test.go b/rego/rego_wasmtarget_test.go
index 787fe4fbc4..3d874ae44a 100644
--- a/rego/rego_wasmtarget_test.go
+++ b/rego/rego_wasmtarget_test.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build opa_wasm
 // +build opa_wasm
 
 package rego
@@ -12,6 +13,8 @@ import (
 	"math/rand"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -22,6 +25,7 @@ import (
 	"github.com/open-policy-agent/opa/storage/inmem"
 	"github.com/open-policy-agent/opa/topdown"
 	"github.com/open-policy-agent/opa/topdown/cache"
+	"github.com/open-policy-agent/opa/util/test"
 
 	_ "github.com/open-policy-agent/opa/features/wasm"
 )
@@ -127,6 +131,8 @@ func TestWasmTimeOfDay(t *testing.T) {
 }
 
 func TestEvalWithContextTimeout(t *testing.T) {
+	test.Skip(t)
+
 	ts := httptest.NewServer(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
 		select {
 		case <-r.Context().Done():
@@ -338,3 +344,53 @@ func TestEvalWasmWithInterQueryCache(t *testing.T) {
 		t.Fatal("Expected server to be called only once")
 	}
 }
+
+func TestEvalWasmWithHTTPAllowNet(t *testing.T) {
+	var requests []*http.Request
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r)
+
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"x": 1}`))
+	}))
+	defer ts.Close()
+
+	serverUrl, err := url.Parse(ts.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	serverHost := strings.Split(serverUrl.Host, ":")[0]
+
+	query := fmt.Sprintf(`http.send({"method": "get", "url": "%s", "force_json_decode": true, "cache": true})`, ts.URL)
+	capabilities := ast.CapabilitiesForThisVersion()
+	capabilities.AllowNet = []string{"example.com"}
+
+	// add an inter-query cache
+	config, _ := cache.ParseCachingConfig(nil)
+	interQueryCache := cache.NewInterQueryCache(config)
+
+	ctx := context.Background()
+	// StrictBuiltinErrors(true) has no effect when target is 'wasm'
+	// this request should be rejected by the allow_net allowlist
+	_, err = New(Target("wasm"), Query(query), InterQueryBuiltinCache(interQueryCache), Capabilities(capabilities)).Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(requests) != 0 {
+		t.Fatal("Expected server to not be called")
+	}
+
+	capabilities.AllowNet = []string{serverHost}
+
+	// eval again with same query
+	// this request should not be rejected by the allow_net allowlist
+	_, err = New(Target("wasm"), Query(query), InterQueryBuiltinCache(interQueryCache), Capabilities(capabilities)).Eval(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(requests) != 1 {
+		t.Fatal("Expected server to never be called")
+	}
+}
diff --git a/repl/repl.go b/repl/repl.go
index 1cd3c2bd0a..b7a82d7fa0 100644
--- a/repl/repl.go
+++ b/repl/repl.go
@@ -50,6 +50,7 @@ type REPL struct {
 	metrics             metrics.Metrics
 	profiler            bool
 	strictBuiltinErrors bool
+	capabilities        *ast.Capabilities
 
 	// TODO(tsandall): replace this state with rule definitions
 	// inside the default module.
@@ -78,8 +79,27 @@ const (
 	explainFull  explainMode = "full"
 	explainNotes explainMode = "notes"
 	explainFails explainMode = "fails"
+	explainDebug explainMode = "debug"
 )
 
+func parseExplainMode(str string) (explainMode, error) {
+	validExplainModes := []string{
+		string(explainOff),
+		string(explainFull),
+		string(explainNotes),
+		string(explainFails),
+		string(explainDebug),
+	}
+
+	for _, mode := range validExplainModes {
+		if mode == str {
+			return explainMode(mode), nil
+		}
+	}
+
+	return "", fmt.Errorf("invalid explain mode, expected one of: %s", strings.Join(validExplainModes, ", "))
+}
+
 const defaultPrettyLimit = 80
 
 var allowedTargets = map[string]bool{compile.TargetRego: true, compile.TargetWasm: true}
@@ -93,6 +113,7 @@ func New(store storage.Store, historyPath string, output io.Writer, outputFormat
 		output:       output,
 		store:        store,
 		modules:      map[string]*ast.Module{},
+		capabilities: ast.CapabilitiesForThisVersion(),
 		outputFormat: outputFormat,
 		explain:      explainOff,
 		historyPath:  historyPath,
@@ -105,6 +126,11 @@ func New(store storage.Store, historyPath string, output io.Writer, outputFormat
 	}
 }
 
+func (r *REPL) WithCapabilities(capabilities *ast.Capabilities) *REPL {
+	r.capabilities = capabilities
+	return r
+}
+
 func defaultModule() *ast.Module {
 	return ast.MustParseModule(`package repl`)
 }
@@ -249,6 +275,17 @@ func (r *REPL) OneShot(ctx context.Context, line string) error {
 			case "pretty-limit":
 				return r.cmdPrettyLimit(cmd.args)
 			case "trace":
+				// If an argument is specified, e.g. `trace notes`, parse that
+				// argument and toggle that specific mode.  If no argument is
+				// specified, toggle full explain mode since that is backwards-
+				// compatible.
+				if len(cmd.args) == 1 {
+					explainMode, err := parseExplainMode(cmd.args[0])
+					if err != nil {
+						return err
+					}
+					return r.cmdTrace(explainMode)
+				}
 				return r.cmdTrace(explainFull)
 			case "notes":
 				return r.cmdTrace(explainNotes)
@@ -688,7 +725,10 @@ func (r *REPL) recompile(ctx context.Context, cpy *ast.Module) error {
 		}
 	}
 
-	compiler := ast.NewCompiler().SetErrorLimit(r.errLimit).WithEnablePrintStatements(true)
+	compiler := ast.NewCompiler().
+		SetErrorLimit(r.errLimit).
+		WithEnablePrintStatements(true).
+		WithCapabilities(r.capabilities)
 
 	if r.instrument {
 		compiler.WithMetrics(r.metrics)
@@ -754,7 +794,10 @@ func (r *REPL) compileRule(ctx context.Context, rule *ast.Rule) error {
 		policies[id] = mod
 	}
 
-	compiler := ast.NewCompiler().SetErrorLimit(r.errLimit).WithEnablePrintStatements(true)
+	compiler := ast.NewCompiler().
+		SetErrorLimit(r.errLimit).
+		WithEnablePrintStatements(true).
+		WithCapabilities(r.capabilities)
 
 	if r.instrument {
 		compiler.WithMetrics(r.metrics)
@@ -768,11 +811,9 @@ func (r *REPL) compileRule(ctx context.Context, rule *ast.Rule) error {
 	switch r.outputFormat {
 	case "json":
 	default:
-		var msg string
+		msg := "defined"
 		if unset {
 			msg = "re-defined"
-		} else {
-			msg = "defined"
 		}
 		fmt.Fprintf(r.output, "Rule '%v' %v in %v. Type 'show' to see rules.\n", rule.Head.Name, msg, mod.Package)
 	}
@@ -871,7 +912,10 @@ func (r *REPL) loadCompiler(ctx context.Context) (*ast.Compiler, error) {
 		policies[id] = mod
 	}
 
-	compiler := ast.NewCompiler().SetErrorLimit(r.errLimit).WithEnablePrintStatements(true)
+	compiler := ast.NewCompiler().
+		SetErrorLimit(r.errLimit).
+		WithEnablePrintStatements(true).
+		WithCapabilities(r.capabilities)
 
 	if r.instrument {
 		compiler.WithMetrics(r.metrics)
@@ -995,8 +1039,10 @@ func (r *REPL) evalBody(ctx context.Context, compiler *ast.Compiler, input ast.V
 	output = output.WithLimit(r.prettyLimit)
 
 	switch r.explain {
+	case explainDebug:
+		output.Explanation = lineage.Debug(*tracebuf)
 	case explainFull:
-		output.Explanation = *tracebuf
+		output.Explanation = lineage.Full(*tracebuf)
 	case explainNotes:
 		output.Explanation = lineage.Notes(*tracebuf)
 	case explainFails:
@@ -1046,8 +1092,10 @@ func (r *REPL) evalPartial(ctx context.Context, compiler *ast.Compiler, input as
 	}
 
 	switch r.explain {
+	case explainDebug:
+		output.Explanation = lineage.Debug(*buf)
 	case explainFull:
-		output.Explanation = *buf
+		output.Explanation = lineage.Full(*buf)
 	case explainNotes:
 		output.Explanation = lineage.Notes(*buf)
 	case explainFails:
@@ -1103,16 +1151,16 @@ func (r *REPL) evalPackage(p *ast.Package) error {
 // converted into a rule and compiled, then it will be interpreted as such. This
 // allows users to define constants in the REPL. For example:
 //
-//	> a = 1
-//  > a
-//  1
+//		> a = 1
+//	 > a
+//	 1
 //
 // If the expression is a = statement, then an additional check on the left
 // hand side occurs. For example:
 //
-//	> b = 2
-//  > b = 2
-//  true      # not redefined!
+//		> b = 2
+//	 > b = 2
+//	 true      # not redefined!
 func (r *REPL) interpretAsRule(ctx context.Context, compiler *ast.Compiler, body ast.Body) (bool, error) {
 
 	if len(body) != 1 {
@@ -1127,10 +1175,16 @@ func (r *REPL) interpretAsRule(ctx context.Context, compiler *ast.Compiler, body
 
 	if expr.IsAssignment() {
 		rule, err := ast.ParseCompleteDocRuleFromAssignmentExpr(r.getCurrentOrDefaultModule(), expr.Operand(0), expr.Operand(1))
-		if err == nil {
-			if err := r.compileRule(ctx, rule); err != nil {
-				return false, err
-			}
+		if err != nil {
+			return false, nil
+		}
+		// TODO(sr): support interactive ref head rule definitions
+		if len(rule.Head.Ref()) > 1 {
+			return false, nil
+		}
+
+		if err := r.compileRule(ctx, rule); err != nil {
+			return false, err
 		}
 		return rule != nil, nil
 	}
@@ -1144,12 +1198,17 @@ func (r *REPL) interpretAsRule(ctx context.Context, compiler *ast.Compiler, body
 	}
 
 	rule, err := ast.ParseCompleteDocRuleFromEqExpr(r.getCurrentOrDefaultModule(), expr.Operand(0), expr.Operand(1))
-	if err == nil {
-		if err := r.compileRule(ctx, rule); err != nil {
-			return false, err
-		}
+	if err != nil {
+		return false, nil
+	}
+	// TODO(sr): support interactive ref head rule definitions
+	if len(rule.Head.Ref()) > 1 {
+		return false, nil
 	}
 
+	if err := r.compileRule(ctx, rule); err != nil {
+		return false, err
+	}
 	return rule != nil, nil
 }
 
@@ -1263,7 +1322,7 @@ var builtin = [...]commandDesc{
 	{"json", []string{}, "set output format to JSON"},
 	{"pretty", []string{}, "set output format to pretty"},
 	{"pretty-limit", []string{}, "set pretty value output limit"},
-	{"trace", []string{}, "toggle full trace"},
+	{"trace", []string{"[mode]"}, "toggle full trace or specific mode"},
 	{"notes", []string{}, "toggle notes trace"},
 	{"fails", []string{}, "toggle fails trace"},
 	{"metrics", []string{}, "toggle metrics"},
@@ -1295,12 +1354,13 @@ type command struct {
 }
 
 func newCommand(line string) *command {
-	p := strings.Fields(strings.TrimSpace(strings.ToLower(line)))
+	p := strings.Fields(strings.TrimSpace(line))
 	if len(p) == 0 {
 		return nil
 	}
+	inputCommand := strings.ToLower(p[0])
 	for _, c := range builtin {
-		if c.name == p[0] {
+		if c.name == inputCommand {
 			return &command{
 				op:   c.name,
 				args: p[1:],
diff --git a/repl/repl_test.go b/repl/repl_test.go
index adcc33dc23..8b740b44fd 100644
--- a/repl/repl_test.go
+++ b/repl/repl_test.go
@@ -11,7 +11,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -22,7 +21,7 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/internal/presentation"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
 )
 
@@ -287,7 +286,7 @@ func TestDumpPath(t *testing.T) {
 	var buffer bytes.Buffer
 	repl := newRepl(store, &buffer)
 
-	dir, err := ioutil.TempDir("", "dump-path-test")
+	dir, err := os.MkdirTemp("", "dump-path-test")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -307,7 +306,54 @@ func TestDumpPath(t *testing.T) {
 		t.Errorf("Expected no output but got: %v", buffer.String())
 	}
 
-	bs, err := ioutil.ReadFile(file)
+	bs, err := os.ReadFile(file)
+	if err != nil {
+		t.Fatalf("Expected file read to succeed but got: %v", err)
+	}
+
+	var result map[string]interface{}
+	if err := util.UnmarshalJSON(bs, &result); err != nil {
+		t.Fatalf("Expected json unmarshal to succeed but got: %v", err)
+	}
+
+	if !reflect.DeepEqual(data, result) {
+		t.Fatalf("Expected dumped json to equal %v but got: %v", data, result)
+	}
+}
+
+func TestDumpPathCaseSensitive(t *testing.T) {
+	ctx := context.Background()
+	input := `{"a": [1,2,3,4]}`
+	var data map[string]interface{}
+	err := util.UnmarshalJSON([]byte(input), &data)
+	if err != nil {
+		panic(err)
+	}
+	store := inmem.NewFromObject(data)
+	var buffer bytes.Buffer
+	repl := newRepl(store, &buffer)
+
+	dir, err := os.MkdirTemp("", "DumpPathCaseSensitiveTest")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(func() {
+		err := os.RemoveAll(dir)
+		if err != nil {
+			t.Errorf("error cleaning up with RemoveAll(): %v", err)
+		}
+	})
+	file := filepath.Join(dir, "tmpfile")
+	if err := repl.OneShot(ctx, fmt.Sprintf("dump %s", file)); err != nil {
+		t.Fatalf("Unexpected error: %v", err)
+	}
+
+	if buffer.String() != "" {
+		t.Errorf("Expected no output but got: %v", buffer.String())
+	}
+
+	bs, err := os.ReadFile(file)
 	if err != nil {
 		t.Fatalf("Expected file read to succeed but got: %v", err)
 	}
@@ -2676,6 +2722,46 @@ func TestUnsetPackage(t *testing.T) {
 	}
 }
 
+func TestCapabilities(t *testing.T) {
+	capabilities := ast.CapabilitiesForThisVersion()
+	allowedBuiltins := []*ast.Builtin{}
+	for _, builtin := range capabilities.Builtins {
+		if builtin.Name != "http.send" {
+			allowedBuiltins = append(allowedBuiltins, builtin)
+		}
+	}
+	capabilities.Builtins = allowedBuiltins
+	ctx := context.Background()
+	store := inmem.New()
+	var buffer bytes.Buffer
+	repl := newRepl(store, &buffer).WithCapabilities(capabilities)
+	if err := repl.OneShot(ctx, `http.send({"url": "http://example.com", "method": "GET"})`); err != nil {
+		if !strings.Contains(fmt.Sprintf("%v", err), "undefined function http.send") {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+	} else {
+		t.Fatalf("Expected error on http.send")
+	}
+}
+
+func TestTraceArgument(t *testing.T) {
+	ctx := context.Background()
+	store := inmem.New()
+	var buffer bytes.Buffer
+	repl := newRepl(store, &buffer)
+	if err := repl.OneShot(ctx, "trace debug"); err != nil {
+		t.Fatal(err)
+	}
+	if err := repl.OneShot(ctx, "show debug"); err != nil {
+		t.Fatal(err)
+	}
+	output := buffer.String()
+	expected := `"explain": "debug"`
+	if !strings.Contains(output, expected) {
+		t.Fatalf("Expected output to contain %s but got %s", expected, output)
+	}
+}
+
 func assertREPLText(t *testing.T, buf bytes.Buffer, expected string) {
 	t.Helper()
 	result := buf.String()
diff --git a/runtime/check_user_linux.go b/runtime/check_user_linux.go
new file mode 100644
index 0000000000..430b659c93
--- /dev/null
+++ b/runtime/check_user_linux.go
@@ -0,0 +1,29 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package runtime
+
+import (
+	"os"
+	"os/user"
+
+	"github.com/open-policy-agent/opa/logging"
+)
+
+// checkUserPrivileges on Linux could be running in Docker, so we check if
+// we're running in the official container image.
+func checkUserPrivileges(logger logging.Logger) {
+	usr, err := user.Current()
+	if err != nil {
+		logger.Debug("Failed to determine uid/gid of process owner")
+	} else if usr.Uid == "0" || usr.Gid == "0" {
+		message := "OPA running with uid or gid 0. Running OPA with root privileges is not recommended."
+		logger.Warn(message)
+	}
+
+	if os.Getenv("OPA_DOCKER_IMAGE_TAG") == "rootless" {
+		message := "The -rootless image tag will not be published after OPA v0.52.0."
+		logger.Error(message)
+	}
+}
diff --git a/runtime/check_user_unix.go b/runtime/check_user_unix.go
new file mode 100644
index 0000000000..a47ec5ecee
--- /dev/null
+++ b/runtime/check_user_unix.go
@@ -0,0 +1,24 @@
+// +build !linux,!windows
+
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package runtime
+
+import (
+	"os/user"
+
+	"github.com/open-policy-agent/opa/logging"
+)
+
+// checkUserPrivileges could not be running in Docker, so we only warn
+// if run as uid/gid 0.
+func checkUserPrivileges(logger logging.Logger) {
+	usr, err := user.Current()
+	if err != nil {
+		logger.Debug("Failed to determine uid/gid of process owner")
+	} else if usr.Uid == "0" || usr.Gid == "0" {
+		logger.Warn("OPA running with uid or gid 0. Running OPA with root privileges is not recommended.")
+	}
+}
diff --git a/runtime/check_user_windows.go b/runtime/check_user_windows.go
new file mode 100644
index 0000000000..68f943c123
--- /dev/null
+++ b/runtime/check_user_windows.go
@@ -0,0 +1,14 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package runtime
+
+import (
+	"github.com/open-policy-agent/opa/logging"
+)
+
+// checkUserPrivileges is a no-op in Windows to avoid lookups with
+// Active Directory and the like, when we don't care for the output
+// anyways.
+func checkUserPrivileges(logging.Logger) {}
diff --git a/runtime/logging.go b/runtime/logging.go
index 96baa86d1f..7303d06c41 100644
--- a/runtime/logging.go
+++ b/runtime/logging.go
@@ -5,22 +5,16 @@
 package runtime
 
 import (
-	"bufio"
 	"bytes"
-	"context"
-	"errors"
+	"compress/gzip"
 	"io"
-	"io/ioutil"
-	"net"
 	"net/http"
-	"net/url"
+	"strings"
 	"sync/atomic"
 	"time"
 
 	"github.com/open-policy-agent/opa/logging"
-	"github.com/open-policy-agent/opa/server/types"
 	"github.com/open-policy-agent/opa/topdown/print"
-	"github.com/sirupsen/logrus"
 )
 
 type loggingPrintHook struct {
@@ -30,7 +24,7 @@ type loggingPrintHook struct {
 func (h loggingPrintHook) Print(pctx print.Context, msg string) error {
 	// NOTE(tsandall): if the request context is not present then do not panic,
 	// just log the print message without the additional context.
-	rctx, _ := pctx.Context.Value(reqCtxKey).(requestContext)
+	rctx, _ := logging.FromContext(pctx.Context)
 	fields := rctx.Fields()
 	fields["line"] = pctx.Location.String()
 	h.logger.WithFields(fields).Info(msg)
@@ -58,28 +52,8 @@ func (h *LoggingHandler) loggingEnabled(level logging.Level) bool {
 	return level <= h.logger.GetLevel()
 }
 
-type requestContextKey string
-
-const reqCtxKey = requestContextKey("request-context-key")
-
-type requestContext struct {
-	ClientAddr string
-	ReqID      uint64
-	ReqMethod  string
-	ReqPath    string
-}
-
-func (rctx requestContext) Fields() logrus.Fields {
-	return logrus.Fields{
-		"client_addr": rctx.ClientAddr,
-		"req_id":      rctx.ReqID,
-		"req_method":  rctx.ReqMethod,
-		"req_path":    rctx.ReqPath,
-	}
-}
-
 func (h *LoggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	var rctx requestContext
+	var rctx logging.RequestContext
 	rctx.ReqID = atomic.AddUint64(&h.requestID, uint64(1))
 	recorder := newRecorder(h.logger, w, r, rctx.ReqID, h.loggingEnabled(logging.Debug))
 	t0 := time.Now()
@@ -89,7 +63,7 @@ func (h *LoggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		rctx.ClientAddr = r.RemoteAddr
 		rctx.ReqMethod = r.Method
 		rctx.ReqPath = r.URL.EscapedPath()
-		r = r.WithContext(context.WithValue(r.Context(), reqCtxKey, rctx))
+		r = r.WithContext(logging.NewContext(r.Context(), &rctx))
 
 		var err error
 		fields := rctx.Fields()
@@ -100,8 +74,26 @@ func (h *LoggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				bs, r.Body, err = readBody(r.Body)
 			}
 			if err == nil {
-				fields["req_body"] = string(bs)
-			} else {
+				if gzipReceived(r.Header) {
+					// the request is compressed
+					var gzReader *gzip.Reader
+					var plainOutput []byte
+					reader := bytes.NewReader(bs)
+					gzReader, err = gzip.NewReader(reader)
+					if err == nil {
+						plainOutput, err = io.ReadAll(gzReader)
+						if err == nil {
+							defer gzReader.Close()
+							fields["req_body"] = string(plainOutput)
+						}
+					}
+				} else {
+					fields["req_body"] = string(bs)
+				}
+			}
+
+			// err can be thrown on different statements
+			if err != nil {
 				fields["err"] = err
 			}
 
@@ -117,10 +109,6 @@ func (h *LoggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	params := r.URL.Query()
 
-	if _, ok := params["watch"]; ok {
-		h.logger.Warn("Deprecated 'watch' parameter specified in request. See https://github.com/open-policy-agent/opa/releases/tag/v0.23.0 for details.")
-	}
-
 	if _, ok := params["partial"]; ok {
 		h.logger.Warn("Deprecated 'partial' parameter specified in request. See https://github.com/open-policy-agent/opa/releases/tag/v0.23.0 for details.")
 	}
@@ -145,13 +133,79 @@ func (h *LoggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 
 		if h.loggingEnabled(logging.Debug) {
-			fields["resp_body"] = recorder.buf.String()
+			switch {
+			case isPprofEndpoint(r):
+				// pprof always sends binary data (protobuf)
+				fields["resp_body"] = "[binary payload]"
+
+			case gzipAccepted(r.Header) && isMetricsEndpoint(r):
+				// metrics endpoint does so when the client accepts it (e.g. prometheus)
+				fields["resp_body"] = "[compressed payload]"
+
+			case gzipAccepted(r.Header) && gzipReceived(w.Header()) && (isDataEndpoint(r) || isCompileEndpoint(r)):
+				// data and compile endpoints might compress the response
+				gzReader, gzErr := gzip.NewReader(recorder.buf)
+				if gzErr == nil {
+					plainOutput, readErr := io.ReadAll(gzReader)
+					if readErr == nil {
+						defer gzReader.Close()
+						fields["resp_body"] = string(plainOutput)
+					} else {
+						h.logger.Error("Failed to decompressed the payload: %v", readErr.Error())
+					}
+				} else {
+					h.logger.Error("Failed to read the compressed payload: %v", gzErr.Error())
+				}
+
+			default:
+				fields["resp_body"] = recorder.buf.String()
+			}
 		}
 
 		h.logger.WithFields(fields).Info("Sent response.")
 	}
 }
 
+func gzipAccepted(header http.Header) bool {
+	a := header.Get("Accept-Encoding")
+	parts := strings.Split(a, ",")
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "gzip" || strings.HasPrefix(part, "gzip;") {
+			return true
+		}
+	}
+	return false
+}
+
+func gzipReceived(header http.Header) bool {
+	a := header.Get("Content-Encoding")
+	parts := strings.Split(a, ",")
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "gzip" || strings.HasPrefix(part, "gzip;") {
+			return true
+		}
+	}
+	return false
+}
+
+func isPprofEndpoint(req *http.Request) bool {
+	return strings.HasPrefix(req.URL.Path, "/debug/pprof/")
+}
+
+func isMetricsEndpoint(req *http.Request) bool {
+	return strings.HasPrefix(req.URL.Path, "/metrics")
+}
+
+func isDataEndpoint(req *http.Request) bool {
+	return strings.HasPrefix(req.URL.Path, "/v1/data") || strings.HasPrefix(req.URL.Path, "/v0/data")
+}
+
+func isCompileEndpoint(req *http.Request) bool {
+	return strings.HasPrefix(req.URL.Path, "/v1/compile")
+}
+
 type recorder struct {
 	logger logging.Logger
 	inner  http.ResponseWriter
@@ -194,46 +248,6 @@ func (r *recorder) WriteHeader(s int) {
 	r.inner.WriteHeader(s)
 }
 
-func (r *recorder) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	h, ok := r.inner.(http.Hijacker)
-	if !ok {
-		return nil, nil, errors.New("response writer is not a http.Hijacker")
-	}
-
-	c, rw, err := h.Hijack()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	fields := map[string]interface{}{
-		"client_addr": r.req.RemoteAddr,
-		"req_id":      r.id,
-		"req_method":  r.req.Method,
-		"req_path":    r.req.URL.EscapedPath(),
-	}
-
-	queries := r.req.URL.Query()[types.ParamQueryV1]
-	if len(queries) > 0 {
-		fields["req_query"] = queries[len(queries)-1]
-	}
-	r.logger.WithFields(fields).Info("Started watch.")
-
-	return c, rw, nil
-}
-
-func dropInputParam(u *url.URL) string {
-	cpy := url.Values{}
-	for k, v := range u.Query() {
-		if k != types.ParamInputV1 {
-			cpy[k] = v
-		}
-	}
-	if len(cpy) == 0 {
-		return u.Path
-	}
-	return u.Path + "?" + cpy.Encode()
-}
-
 func readBody(r io.ReadCloser) ([]byte, io.ReadCloser, error) {
 	if r == http.NoBody {
 		return nil, r, nil
@@ -242,5 +256,5 @@ func readBody(r io.ReadCloser) ([]byte, io.ReadCloser, error) {
 	if _, err := buf.ReadFrom(r); err != nil {
 		return nil, r, err
 	}
-	return buf.Bytes(), ioutil.NopCloser(bytes.NewReader(buf.Bytes())), nil
+	return buf.Bytes(), io.NopCloser(bytes.NewReader(buf.Bytes())), nil
 }
diff --git a/runtime/logging_test.go b/runtime/logging_test.go
index d53f087ebf..6a823ac388 100644
--- a/runtime/logging_test.go
+++ b/runtime/logging_test.go
@@ -6,43 +6,306 @@
 package runtime
 
 import (
-	"fmt"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
+
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/logging/test"
 )
 
-func TestDropInputParam(t *testing.T) {
+func TestValidateGzipHeader(t *testing.T) {
 
-	// Without other params.
-	abc := `a.b.c:{"foo":[1,2,3,4]}`
-	abcEncoded := url.QueryEscape(abc)
+	httpHeader := http.Header{}
+	httpHeader.Add("Accept", "*/*")
+	if result, expected := gzipAccepted(httpHeader), false; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
 
-	uri, err := url.ParseRequestURI(fmt.Sprintf(`http://localhost:8181/v1/data/foo/bar?input=%v`, abcEncoded))
-	if err != nil {
-		panic(err)
+	httpHeader.Add("Accept-Encoding", "gzip")
+	if result, expected := gzipAccepted(httpHeader), true; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
 	}
 
-	result := dropInputParam(uri)
-	expected := "/v1/data/foo/bar"
+	httpHeader.Set("Accept-Encoding", "gzip, deflate, br")
+	if result, expected := gzipAccepted(httpHeader), true; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
 
-	if result != expected {
+	httpHeader.Set("Accept-Encoding", "br;q=1.0, gzip;q=0.8, *;q=0.1")
+	if result, expected := gzipAccepted(httpHeader), true; result != expected {
 		t.Errorf("Expected %v but got: %v", expected, result)
 	}
+}
 
-	// With other params.
-	def := `d.e.f:{"bar":{"baz":null}}`
-	defEncoded := url.QueryEscape(def)
+func TestValidateReceivedGzipHeader(t *testing.T) {
 
-	uri, err = url.ParseRequestURI(fmt.Sprintf(`http://localhost:8181/v1/data/foo/bar?input=%v&pretty=true&depth=1&input=%v`, abcEncoded, defEncoded))
-	if err != nil {
-		panic(err)
+	httpHeader := http.Header{}
+	httpHeader.Set("Content-Encoding", "*/*")
+	if result, expected := gzipReceived(httpHeader), false; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
 	}
 
-	result = dropInputParam(uri)
-	expected = "/v1/data/foo/bar?depth=1&pretty=true"
+	httpHeader.Set("Content-Encoding", "gzip")
+	if result, expected := gzipReceived(httpHeader), true; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
 
-	if result != expected {
+	httpHeader.Set("Content-Encoding", "gzip, deflate, br")
+	if result, expected := gzipReceived(httpHeader), true; result != expected {
 		t.Errorf("Expected %v but got: %v", expected, result)
 	}
 
+	httpHeader.Set("Content-Encoding", "br;q=1.0, gzip;q=0.8, *;q=0.1")
+	if result, expected := gzipReceived(httpHeader), true; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
+}
+
+func TestValidatePprofUrl(t *testing.T) {
+
+	req := http.Request{}
+
+	req.URL = &url.URL{Path: "/metrics"}
+	if result, expected := isPprofEndpoint(&req), false; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
+
+	req.URL = &url.URL{Path: "/debug/pprof/"}
+	if result, expected := isPprofEndpoint(&req), true; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
+}
+
+func TestValidateMetricsUrl(t *testing.T) {
+
+	req := http.Request{}
+
+	req.URL = &url.URL{Path: "/metrics"}
+	if result, expected := isMetricsEndpoint(&req), true; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
+
+	req.URL = &url.URL{Path: "/debug/pprof/"}
+	if result, expected := isMetricsEndpoint(&req), false; result != expected {
+		t.Errorf("Expected %v but got: %v", expected, result)
+	}
+}
+
+func TestRequestLogging(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	logger := test.New()
+	logger.SetLevel(logging.Debug)
+
+	// set the threshold to a low value so the server compresses the response when asked to
+	gzipMinLength := "server.encoding.gzip.min_length=5"
+	shutdownSeconds := 1
+	params := NewParams()
+	params.Addrs = &[]string{":0"}
+	params.Logger = logger
+	params.PprofEnabled = true
+	params.GracefulShutdownPeriod = shutdownSeconds // arbitrary, must be non-zero
+	params.ConfigOverrides = []string{gzipMinLength}
+
+	rt, err := NewRuntime(ctx, params)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	initChannel := rt.Manager.ServerInitializedChannel()
+	go func() {
+		if err := rt.Serve(ctx); err != nil {
+			t.Error(err)
+		}
+	}()
+	<-initChannel
+
+	// prepare the request bodies to be used
+	var dataEndpointBody = []byte(`{"input": {"data": "checkForMe"}}`)
+	var compileEndpointBody = []byte(`{"unknowns": ["input"], "query": "data.checkForMe = true"}`)
+	var dataEndpointCompressedBody = zipString(`{"input": {"data": "checkForMe"}}`)
+	var compileEndpointCompressedBody = zipString(`{"unknowns": ["input"], "query": "data.checkForMe = true"}`)
+
+	tests := []struct {
+		path             string
+		acceptEncoding   string
+		expected         string
+		expectedEncoding string
+		contentEncoding  string
+		requestBody      *[]byte
+	}{
+		{
+			path:             "/metrics",
+			acceptEncoding:   "gzip",
+			expected:         "[compressed payload]",
+			expectedEncoding: "gzip",
+			contentEncoding:  "",
+			requestBody:      nil,
+		},
+		{
+			path:             "/metrics",
+			acceptEncoding:   "*/*",
+			expected:         "HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.",
+			expectedEncoding: "",
+			contentEncoding:  "",
+			requestBody:      nil,
+		},
+		{ // the data handler on GET will compress the response if response is above server.encoding.gzip.min_length in size
+			path:             "/v1/data",
+			acceptEncoding:   "gzip",
+			expected:         "{\"result\":{}}",
+			expectedEncoding: "gzip",
+			contentEncoding:  "",
+			requestBody:      nil,
+		},
+		{ // the data handler on POST can compress the response if response is above server.encoding.gzip.min_length in size
+			path:             "/v1/data",
+			acceptEncoding:   "gzip",
+			expected:         "{\"result\":{}}",
+			expectedEncoding: "gzip",
+			contentEncoding:  "",
+			requestBody:      &dataEndpointBody,
+		},
+		{ // the data handler on POST can consume compressed request
+			path:             "/v1/data",
+			acceptEncoding:   "gzip",
+			expected:         "{\"result\":{}}",
+			expectedEncoding: "gzip",
+			contentEncoding:  "gzip",
+			requestBody:      &dataEndpointCompressedBody,
+		},
+		{ // the compile handler will compress the response if response is above server.encoding.gzip.min_length in size
+			path:             "/v1/compile",
+			acceptEncoding:   "gzip",
+			expected:         "{\"result\":{}}",
+			expectedEncoding: "gzip",
+			contentEncoding:  "",
+			requestBody:      &compileEndpointBody,
+		},
+		{ // the compile handler can consume compressed request
+			path:             "/v1/compile",
+			acceptEncoding:   "gzip",
+			expected:         "{\"result\":{}}",
+			expectedEncoding: "gzip",
+			contentEncoding:  "gzip",
+			requestBody:      &compileEndpointCompressedBody,
+		},
+		{ // the handlers return plain data
+			path:             "/v1/data",
+			acceptEncoding:   "*/*",
+			expected:         "{\"result\":{}}",
+			expectedEncoding: "",
+			contentEncoding:  "",
+			requestBody:      nil,
+		},
+		{ // accept-encoding does not matter for pprof: it's always protobuf
+			path:             "/debug/pprof/cmdline",
+			acceptEncoding:   "*/*",
+			expected:         "[binary payload]",
+			expectedEncoding: "",
+			contentEncoding:  "",
+			requestBody:      nil,
+		},
+	}
+
+	// execute all the requests
+	for _, tc := range tests {
+		rec := httptest.NewRecorder()
+		method := "GET"
+		var body io.Reader
+		if tc.requestBody != nil {
+			method = "POST"
+			body = bytes.NewReader(*tc.requestBody)
+		}
+		req, err := http.NewRequest(method, tc.path, body)
+
+		if err != nil {
+			t.Fatal(err)
+		}
+		req.Header.Set("Accept-Encoding", tc.acceptEncoding)
+		if tc.contentEncoding != "" {
+			req.Header.Set("Content-Encoding", tc.contentEncoding)
+		}
+		rt.server.Handler.ServeHTTP(rec, req)
+		if exp, act := http.StatusOK, rec.Result().StatusCode; exp != act {
+			t.Errorf("%s %s: expected HTTP %d, got %d", method, tc.path, exp, act)
+		}
+		contentEncoding := rec.Result().Header.Get("Content-Encoding")
+		if contentEncoding != tc.expectedEncoding {
+			t.Errorf("%s %s: expected content encoding %s, got %s", method, tc.path, tc.expectedEncoding, contentEncoding)
+		}
+	}
+
+	cancel()
+
+	// check the logs
+	ents := logger.Entries()
+	for j, tc := range tests {
+		i := uint64(j + 1)
+		foundResponse := false
+		foundRequest := false
+		for _, ent := range entriesForReq(ents, i) {
+			if ent.Message == "Sent response." {
+				act := ent.Fields["resp_body"].(string)
+				if !strings.Contains(act, tc.expected) {
+					t.Errorf("expected %q in resp_body field, got %q", tc.expected, act)
+				}
+				foundResponse = true
+			}
+			if tc.requestBody != nil && ent.Message == "Received request." {
+				if tc.requestBody != nil {
+					// the req_body is always uncompressed
+					act := ent.Fields["req_body"].(string)
+					if !strings.Contains(act, "checkForMe") {
+						t.Errorf("expected string %q in req_body field, got %q", "checkForMe", act)
+					}
+					foundRequest = true
+				}
+			}
+		}
+		if !foundResponse {
+			t.Errorf("Expected \"Sent response.\" log for request %d (path %s)", j, tc.path)
+		}
+		if tc.requestBody != nil && !foundRequest {
+			t.Errorf("Expected \"Received request.\" log for request %d (path %s)", j, tc.path)
+		}
+
+	}
+	if t.Failed() {
+		t.Logf("logs: %v", ents)
+	}
+}
+
+func entriesForReq(ents []test.LogEntry, n uint64) []test.LogEntry {
+	var ret []test.LogEntry
+	for _, e := range ents {
+		if r, ok := e.Fields["req_id"]; ok {
+			if i, ok := r.(uint64); ok {
+				if i == n {
+					ret = append(ret, e)
+				}
+			}
+		}
+	}
+	return ret
+}
+func zipString(input string) []byte {
+	var b bytes.Buffer
+	gz := gzip.NewWriter(&b)
+	if _, err := gz.Write([]byte(input)); err != nil {
+		log.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		log.Fatal(err)
+	}
+	return b.Bytes()
 }
diff --git a/runtime/runtime.go b/runtime/runtime.go
index a7f13f0c47..a350af6ef2 100644
--- a/runtime/runtime.go
+++ b/runtime/runtime.go
@@ -13,6 +13,7 @@ import (
 	"fmt"
 	"io"
 	mr "math/rand"
+	"net/url"
 	"os"
 	"os/signal"
 	"strings"
@@ -22,12 +23,15 @@ import (
 
 	"github.com/fsnotify/fsnotify"
 	"github.com/gorilla/mux"
-	"github.com/pkg/errors"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+	"go.opentelemetry.io/otel/propagation"
 	"go.uber.org/automaxprocs/maxprocs"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/internal/config"
+	internal_tracing "github.com/open-policy-agent/opa/internal/distributedtracing"
 	internal_logging "github.com/open-policy-agent/opa/internal/logging"
 	"github.com/open-policy-agent/opa/internal/prometheus"
 	"github.com/open-policy-agent/opa/internal/report"
@@ -43,7 +47,9 @@ import (
 	"github.com/open-policy-agent/opa/repl"
 	"github.com/open-policy-agent/opa/server"
 	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/disk"
 	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/tracing"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/version"
 )
@@ -70,7 +76,6 @@ func RegisterPlugin(name string, factory plugins.Factory) {
 
 // Params stores the configuration for an OPA instance.
 type Params struct {
-
 	// Globally unique identifier for this OPA instance. If an ID is not specified,
 	// the runtime will generate one.
 	ID string
@@ -199,12 +204,26 @@ type Params struct {
 	// Router uses a first-matching-route-wins strategy, so no existing routes are overridden
 	// If it is nil, a new mux.Router will be created
 	Router *mux.Router
+
+	// DiskStorage, if set, will make the runtime instantiate a disk-backed storage
+	// implementation (instead of the default, in-memory store).
+	// It can also be enabled via config, and this runtime field takes precedence.
+	DiskStorage *disk.Options
+
+	DistributedTracingOpts tracing.Options
+
+	// Check if default Addr is set or the user has changed it.
+	AddrSetByUser bool
+
+	// UnixSocketPerm specifies the permission for the Unix domain socket if used to listen for connections
+	UnixSocketPerm *string
 }
 
 // LoggingConfig stores the configuration for OPA's logging behaviour.
 type LoggingConfig struct {
-	Level  string
-	Format string
+	Level           string
+	Format          string
+	TimestampFormat string
 }
 
 // NewParams returns a new Params object.
@@ -222,10 +241,11 @@ type Runtime struct {
 	Store   storage.Store
 	Manager *plugins.Manager
 
-	logger   logging.Logger
-	server   *server.Server
-	metrics  *prometheus.Provider
-	reporter *report.Reporter
+	logger        logging.Logger
+	server        *server.Server
+	metrics       *prometheus.Provider
+	reporter      *report.Reporter
+	traceExporter *otlptrace.Exporter
 
 	serverInitialized bool
 	serverInitMtx     sync.RWMutex
@@ -235,7 +255,6 @@ type Runtime struct {
 // NewRuntime returns a new Runtime object initialized with params. Clients must
 // call StartServer() or StartREPL() to start the runtime in either mode.
 func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
-
 	if params.ID == "" {
 		var err error
 		params.ID, err = generateInstanceID()
@@ -244,7 +263,7 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 		}
 	}
 
-	level, err := getLoggingLevel(params.Logging.Level)
+	level, err := internal_logging.GetLevel(params.Logging.Level)
 	if err != nil {
 		return nil, err
 	}
@@ -256,7 +275,7 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 	// that the logging configuration is applied. Once we remove all usage of
 	// the global logger and we remove the API that allows callers to access the
 	// global logger, we can remove this.
-	logging.Get().SetFormatter(internal_logging.GetFormatter(params.Logging.Format))
+	logging.Get().SetFormatter(internal_logging.GetFormatter(params.Logging.Format, params.Logging.TimestampFormat))
 	logging.Get().SetLevel(level)
 
 	var logger logging.Logger
@@ -266,13 +285,29 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 	} else {
 		stdLogger := logging.New()
 		stdLogger.SetLevel(level)
-		stdLogger.SetFormatter(internal_logging.GetFormatter(params.Logging.Format))
+		stdLogger.SetFormatter(internal_logging.GetFormatter(params.Logging.Format, params.Logging.TimestampFormat))
 		logger = stdLogger
 	}
 
+	var filePaths []string
+	urlPathCount := 0
+	for _, path := range params.Paths {
+		if strings.HasPrefix(path, "http://") || strings.HasPrefix(path, "https://") {
+			urlPathCount++
+			override, err := urlPathToConfigOverride(urlPathCount, path)
+			if err != nil {
+				return nil, err
+			}
+			params.ConfigOverrides = append(params.ConfigOverrides, override...)
+		} else {
+			filePaths = append(filePaths, path)
+		}
+	}
+	params.Paths = filePaths
+
 	config, err := config.Load(params.ConfigFile, params.ConfigOverrides, params.ConfigOverrideFiles)
 	if err != nil {
-		return nil, errors.Wrap(err, "config error")
+		return nil, fmt.Errorf("config error: %w", err)
 	}
 
 	var reporter *report.Reporter
@@ -280,13 +315,13 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 		var err error
 		reporter, err = report.New(params.ID, report.Options{Logger: logger})
 		if err != nil {
-			return nil, errors.Wrap(err, "config error")
+			return nil, fmt.Errorf("config error: %w", err)
 		}
 	}
 
-	loaded, err := initload.LoadPaths(params.Paths, params.Filter, params.BundleMode, params.BundleVerificationConfig, params.SkipBundleVerification)
+	loaded, err := initload.LoadPaths(params.Paths, params.Filter, params.BundleMode, params.BundleVerificationConfig, params.SkipBundleVerification, false, nil, nil)
 	if err != nil {
-		return nil, errors.Wrap(err, "load error")
+		return nil, fmt.Errorf("load error: %w", err)
 	}
 
 	info, err := runtime.Term(runtime.Params{Config: config})
@@ -294,23 +329,50 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 		return nil, err
 	}
 
-	var consoleLogger logging.Logger
-
-	if params.ConsoleLogger == nil {
+	consoleLogger := params.ConsoleLogger
+	if consoleLogger == nil {
 		l := logging.New()
-		l.SetFormatter(internal_logging.GetFormatter(params.Logging.Format))
+		l.SetFormatter(internal_logging.GetFormatter(params.Logging.Format, params.Logging.TimestampFormat))
 		consoleLogger = l
-	} else {
-		consoleLogger = params.ConsoleLogger
 	}
 
 	if params.Router == nil {
 		params.Router = mux.NewRouter()
 	}
 
+	metrics := prometheus.New(metrics.New(), errorLogger(logger))
+
+	var store storage.Store
+	if params.DiskStorage == nil {
+		params.DiskStorage, err = disk.OptionsFromConfig(config, params.ID)
+		if err != nil {
+			return nil, fmt.Errorf("parse disk store configuration: %w", err)
+		}
+	}
+
+	if params.DiskStorage != nil {
+		store, err = disk.New(ctx, logger, metrics, *params.DiskStorage)
+		if err != nil {
+			return nil, fmt.Errorf("initialize disk store: %w", err)
+		}
+	} else {
+		store = inmem.NewWithOpts(inmem.OptRoundTripOnWrite(false))
+	}
+
+	traceExporter, tracerProvider, err := internal_tracing.Init(ctx, config, params.ID)
+	if err != nil {
+		return nil, fmt.Errorf("config error: %w", err)
+	}
+	if tracerProvider != nil {
+		params.DistributedTracingOpts = tracing.NewOptions(
+			otelhttp.WithTracerProvider(tracerProvider),
+			otelhttp.WithPropagators(propagation.TraceContext{}),
+		)
+	}
+
 	manager, err := plugins.New(config,
 		params.ID,
-		inmem.New(),
+		store,
 		plugins.Info(info),
 		plugins.InitBundles(loaded.Bundles),
 		plugins.InitFiles(loaded.Files),
@@ -320,23 +382,23 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 		plugins.Logger(logger),
 		plugins.EnablePrintStatements(logger.GetLevel() >= logging.Info),
 		plugins.PrintHook(loggingPrintHook{logger: logger}),
-		plugins.WithRouter(params.Router))
+		plugins.WithRouter(params.Router),
+		plugins.WithPrometheusRegister(metrics),
+		plugins.WithTracerProvider(tracerProvider))
 	if err != nil {
-		return nil, errors.Wrap(err, "config error")
+		return nil, fmt.Errorf("config error: %w", err)
 	}
 
 	if err := manager.Init(ctx); err != nil {
-		return nil, errors.Wrap(err, "initialization error")
+		return nil, fmt.Errorf("initialization error: %w", err)
 	}
 
-	metrics := prometheus.New(metrics.New(), errorLogger(logger))
-
 	disco, err := discovery.New(manager, discovery.Factories(registeredPlugins), discovery.Metrics(metrics))
 	if err != nil {
-		return nil, errors.Wrap(err, "config error")
+		return nil, fmt.Errorf("config error: %w", err)
 	}
 
-	manager.Register("discovery", disco)
+	manager.Register(discovery.Name, disco)
 
 	rt := &Runtime{
 		Store:             manager.Store,
@@ -346,6 +408,7 @@ func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
 		metrics:           metrics,
 		reporter:          reporter,
 		serverInitialized: false,
+		traceExporter:     traceExporter,
 	}
 
 	return rt, nil
@@ -364,11 +427,15 @@ func (rt *Runtime) StartServer(ctx context.Context) {
 // will block until either: an error occurs, the context is canceled, or
 // a SIGTERM or SIGKILL signal is sent.
 func (rt *Runtime) Serve(ctx context.Context) error {
-
 	if rt.Params.Addrs == nil {
 		return fmt.Errorf("at least one address must be configured in runtime parameters")
 	}
 
+	serverInitializingMessage := "Initializing server."
+	if !rt.Params.AddrSetByUser {
+		serverInitializingMessage += " OPA is running on a public (0.0.0.0) network interface. Unless you intend to expose OPA outside of the host, binding to the localhost interface (--addr localhost:8181) is recommended. See https://www.openpolicyagent.org/docs/latest/security/#interface-binding"
+	}
+
 	if rt.Params.DiagnosticAddrs == nil {
 		rt.Params.DiagnosticAddrs = &[]string{}
 	}
@@ -376,19 +443,20 @@ func (rt *Runtime) Serve(ctx context.Context) error {
 	rt.logger.WithFields(map[string]interface{}{
 		"addrs":            *rt.Params.Addrs,
 		"diagnostic-addrs": *rt.Params.DiagnosticAddrs,
-	}).Info("Initializing server.")
+	}).Info(serverInitializingMessage)
 
 	if rt.Params.Authorization == server.AuthorizationOff && rt.Params.Authentication == server.AuthenticationToken {
 		rt.logger.Error("Token authentication enabled without authorization. Authentication will be ineffective. See https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization for more information.")
 	}
 
+	checkUserPrivileges(rt.logger)
+
 	// NOTE(tsandall): at some point, hopefully we can remove this because the
 	// Go runtime will just do the right thing. Until then, try to set
 	// GOMAXPROCS based on the CPU quota applied to the process.
 	undo, err := maxprocs.Set(maxprocs.Logger(func(f string, a ...interface{}) {
 		rt.logger.Debug(f, a...)
 	}))
-
 	if err != nil {
 		rt.logger.WithFields(map[string]interface{}{"err": err}).Debug("Failed to set GOMAXPROCS from CPU quota.")
 	}
@@ -402,6 +470,20 @@ func (rt *Runtime) Serve(ctx context.Context) error {
 
 	defer rt.Manager.Stop(ctx)
 
+	if rt.traceExporter != nil {
+		if err := rt.traceExporter.Start(ctx); err != nil {
+			rt.logger.WithFields(map[string]interface{}{"err": err}).Error("Failed to start OpenTelemetry trace exporter.")
+			return err
+		}
+
+		defer func() {
+			err := rt.traceExporter.Shutdown(ctx)
+			if err != nil {
+				rt.logger.WithFields(map[string]interface{}{"err": err}).Error("Failed to shutdown OpenTelemetry trace exporter gracefully.")
+			}
+		}()
+	}
+
 	rt.server = server.New().
 		WithRouter(rt.Params.Router).
 		WithStore(rt.Store).
@@ -419,12 +501,22 @@ func (rt *Runtime) Serve(ctx context.Context) error {
 		WithDecisionLoggerWithErr(rt.decisionLogger).
 		WithRuntime(rt.Manager.Info).
 		WithMetrics(rt.metrics).
-		WithMinTLSVersion(rt.Params.MinTLSVersion)
+		WithMinTLSVersion(rt.Params.MinTLSVersion).
+		WithDistributedTracingOpts(rt.Params.DistributedTracingOpts)
+
+	// If decision_logging plugin enabled, check to see if we opted in to the ND builtins cache.
+	if lp := logs.Lookup(rt.Manager); lp != nil {
+		rt.server = rt.server.WithNDBCacheEnabled(rt.Manager.Config.NDBuiltinCacheEnabled())
+	}
 
 	if rt.Params.DiagnosticAddrs != nil {
 		rt.server = rt.server.WithDiagnosticAddresses(*rt.Params.DiagnosticAddrs)
 	}
 
+	if rt.Params.UnixSocketPerm != nil {
+		rt.server = rt.server.WithUnixSocketPermission(rt.Params.UnixSocketPerm)
+	}
+
 	rt.server, err = rt.server.Init(ctx)
 	if err != nil {
 		rt.logger.WithFields(map[string]interface{}{"err": err}).Error("Unable to initialize server.")
@@ -529,7 +621,6 @@ func (rt *Runtime) DiagnosticAddrs() []string {
 
 // StartREPL starts the runtime in REPL mode. This function will block the calling goroutine.
 func (rt *Runtime) StartREPL(ctx context.Context) {
-
 	if err := rt.Manager.Start(ctx); err != nil {
 		fmt.Fprintln(rt.Params.Output, "error starting plugins:", err)
 		os.Exit(1)
@@ -552,11 +643,16 @@ func (rt *Runtime) StartREPL(ctx context.Context) {
 		go func() {
 			repl.SetOPAVersionReport(rt.checkOPAUpdate(ctx).Slice())
 		}()
-
 	}
 	repl.Loop(ctx)
 }
 
+// SetDistributedTracingLogging configures the distributed tracing's ErrorHandler,
+// and logger instances.
+func (rt *Runtime) SetDistributedTracingLogging() {
+	internal_tracing.SetupLogging(rt.logger)
+}
+
 func (rt *Runtime) checkOPAUpdate(ctx context.Context) *report.DataResponse {
 	resp, _ := rt.reporter.SendReport(ctx)
 	return resp
@@ -564,7 +660,7 @@ func (rt *Runtime) checkOPAUpdate(ctx context.Context) *report.DataResponse {
 
 func (rt *Runtime) checkOPAUpdateLoop(ctx context.Context, uploadDuration time.Duration, done chan struct{}) {
 	ticker := time.NewTicker(uploadDuration)
-	mr.Seed(time.Now().UnixNano())
+	mr.New(mr.NewSource(time.Now().UnixNano())) // Seed the PRNG.
 
 	for {
 		resp, err := rt.reporter.SendReport(ctx)
@@ -607,7 +703,6 @@ func (rt *Runtime) decisionIDFactory() string {
 }
 
 func (rt *Runtime) decisionLogger(ctx context.Context, event *server.Info) error {
-
 	plugin := logs.Lookup(rt.Manager)
 	if plugin == nil {
 		return nil
@@ -645,8 +740,7 @@ func (rt *Runtime) readWatcher(ctx context.Context, watcher *fsnotify.Watcher, p
 }
 
 func (rt *Runtime) processWatcherUpdate(ctx context.Context, paths []string, removed string) error {
-
-	loaded, err := initload.LoadPaths(paths, rt.Params.Filter, rt.Params.BundleMode, nil, true)
+	loaded, err := initload.LoadPaths(paths, rt.Params.Filter, rt.Params.BundleMode, nil, true, false, nil, nil)
 	if err != nil {
 		return err
 	}
@@ -654,7 +748,6 @@ func (rt *Runtime) processWatcherUpdate(ctx context.Context, paths []string, rem
 	removed = loader.CleanPath(removed)
 
 	return storage.Txn(ctx, rt.Store, storage.WriteParams, func(txn storage.Transaction) error {
-
 		if !rt.Params.BundleMode {
 			ids, err := rt.Store.ListPolicies(ctx, txn)
 			if err != nil {
@@ -753,11 +846,10 @@ func (rt *Runtime) onReloadLogger(d time.Duration, err error) {
 	rt.logger.WithFields(map[string]interface{}{
 		"duration": d,
 		"err":      err,
-	}).Warn("Processed file watch event.")
+	}).Info("Processed file watch event.")
 }
 
 func (rt *Runtime) getWatcher(rootPaths []string) (*fsnotify.Watcher, error) {
-
 	watchPaths, err := getWatchPaths(rootPaths)
 	if err != nil {
 		return nil, err
@@ -778,9 +870,28 @@ func (rt *Runtime) getWatcher(rootPaths []string) (*fsnotify.Watcher, error) {
 	return watcher, nil
 }
 
+func urlPathToConfigOverride(pathCount int, path string) ([]string, error) {
+	uri, err := url.Parse(path)
+	if err != nil {
+		return nil, err
+	}
+	baseURL := uri.Scheme + "://" + uri.Host
+	urlPath := uri.Path
+	if uri.RawQuery != "" {
+		urlPath += "?" + uri.RawQuery
+	}
+
+	return []string{
+		fmt.Sprintf("services.cli%d.url=%s", pathCount, baseURL),
+		fmt.Sprintf("bundles.cli%d.service=cli%d", pathCount, pathCount),
+		fmt.Sprintf("bundles.cli%d.resource=%s", pathCount, urlPath),
+		fmt.Sprintf("bundles.cli%d.persist=true", pathCount),
+	}, nil
+}
+
 func errorLogger(logger logging.Logger) func(attrs map[string]interface{}, f string, a ...interface{}) {
 	return func(attrs map[string]interface{}, f string, a ...interface{}) {
-		logger.WithFields(map[string]interface{}(attrs)).Error(f, a...)
+		logger.WithFields(attrs).Error(f, a...)
 	}
 }
 
@@ -823,21 +934,6 @@ func generateDecisionID() string {
 	return id
 }
 
-func getLoggingLevel(s string) (logging.Level, error) {
-	switch strings.ToLower(s) {
-	case "debug":
-		return logging.Debug, nil
-	case "", "info":
-		return logging.Info, nil
-	case "warn":
-		return logging.Warn, nil
-	case "error":
-		return logging.Error, nil
-	default:
-		return logging.Debug, fmt.Errorf("invalid log level: %v", s)
-	}
-}
-
 func init() {
 	registeredPlugins = make(map[string]plugins.Factory)
 }
diff --git a/runtime/runtime_test.go b/runtime/runtime_test.go
index dcafaef66f..4f02e64994 100644
--- a/runtime/runtime_test.go
+++ b/runtime/runtime_test.go
@@ -8,7 +8,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -21,6 +20,7 @@ import (
 
 	"github.com/open-policy-agent/opa/internal/report"
 	"github.com/open-policy-agent/opa/logging"
+	testLog "github.com/open-policy-agent/opa/logging/test"
 	"github.com/open-policy-agent/opa/server"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -104,7 +104,7 @@ func testRuntimeProcessWatchEvents(t *testing.T, asBundle bool) {
 			"hello": "world-2",
 		}
 
-		if err := ioutil.WriteFile(path.Join(rootDir, "some/data.json"), util.MustMarshalJSON(expected), 0644); err != nil {
+		if err := os.WriteFile(path.Join(rootDir, "some/data.json"), util.MustMarshalJSON(expected), 0644); err != nil {
 			panic(err)
 		}
 
@@ -194,7 +194,7 @@ func testRuntimeProcessWatchEventPolicyError(t *testing.T, asBundle bool) {
 
 		default x = 2`)
 
-		if err := ioutil.WriteFile(path.Join(rootDir, "y.rego"), newModule, 0644); err != nil {
+		if err := os.WriteFile(path.Join(rootDir, "y.rego"), newModule, 0644); err != nil {
 			t.Fatal(err)
 		}
 
@@ -369,6 +369,51 @@ func TestServerInitialized(t *testing.T) {
 		t.Fatal("expected ServerInitializedChannel to be closed")
 	}
 }
+func TestUrlPathToConfigOverride(t *testing.T) {
+	params := NewParams()
+	params.Paths = []string{"https://www.example.com/bundles/bundle.tar.gz"}
+	ctx := context.Background()
+	rt, err := NewRuntime(ctx, params)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var serviceConf map[string]interface{}
+	if err = json.Unmarshal(rt.Manager.Config.Services, &serviceConf); err != nil {
+		t.Fatal(err)
+	}
+
+	cliService, ok := serviceConf["cli1"].(map[string]interface{})
+	if !ok {
+		t.Fatal("excpected service configuration for 'cli1' service")
+	}
+
+	if cliService["url"] != "https://www.example.com" {
+		t.Error("expected cli1 service url value: 'https://www.example.com'")
+	}
+
+	var bundleConf map[string]interface{}
+	if err = json.Unmarshal(rt.Manager.Config.Bundles, &bundleConf); err != nil {
+		t.Fatal(err)
+	}
+
+	cliBundle, ok := bundleConf["cli1"].(map[string]interface{})
+	if !ok {
+		t.Fatal("excpected bundle configuration for 'cli1' bundle")
+	}
+
+	if cliBundle["service"] != "cli1" {
+		t.Error("expected cli1 bundle service value: 'cli1'")
+	}
+
+	if cliBundle["resource"] != "/bundles/bundle.tar.gz" {
+		t.Error("expected cli1 bundle resource value: 'bundles/bundle.tar.gz'")
+	}
+
+	if cliBundle["persist"] != true {
+		t.Error("expected cli1 bundle persist value: true")
+	}
+}
 
 func getTestServer(update interface{}, statusCode int) (baseURL string, teardownFn func()) {
 	mux := http.NewServeMux()
@@ -385,7 +430,7 @@ func getTestServer(update interface{}, statusCode int) (baseURL string, teardown
 
 func testCheckOPAUpdate(t *testing.T, url string, expected *report.DataResponse) {
 	t.Helper()
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", url)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", url)
 
 	ctx := context.Background()
 	rt := getTestRuntime(ctx, t, logging.NewNoOpLogger())
@@ -398,7 +443,7 @@ func testCheckOPAUpdate(t *testing.T, url string, expected *report.DataResponse)
 
 func testCheckOPAUpdateLoop(t *testing.T, url, expected string) {
 	t.Helper()
-	os.Setenv("OPA_TELEMETRY_SERVICE_URL", url)
+	t.Setenv("OPA_TELEMETRY_SERVICE_URL", url)
 
 	ctx := context.Background()
 
@@ -434,3 +479,53 @@ func getTestRuntime(ctx context.Context, t *testing.T, logger logging.Logger) *R
 	}
 	return rt
 }
+
+func TestAddrWarningMessage(t *testing.T) {
+	testCases := []struct {
+		name          string
+		addrSetByUser bool
+		containsMsg   bool
+	}{
+		{"WarningMessage", false, true},
+		{"NoWarningMessage", true, false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Millisecond)
+			defer cancel()
+
+			params := NewParams()
+
+			logger := testLog.New()
+			logLevel := logging.Info
+
+			params.Logger = logger
+			params.Addrs = &[]string{":8181"}
+			params.AddrSetByUser = tc.addrSetByUser
+			params.GracefulShutdownPeriod = 1
+			rt, err := NewRuntime(ctx, params)
+			if err != nil {
+				t.Fatalf("Unexpected error %v", err)
+			}
+
+			done := make(chan struct{})
+			go func() {
+				rt.StartServer(ctx)
+				close(done)
+			}()
+			<-done
+
+			warning := " OPA is running on a public (0.0.0.0) network interface. Unless you intend to expose OPA outside of the host, binding to the localhost interface (--addr localhost:8181) is recommended. See https://www.openpolicyagent.org/docs/latest/security/#interface-binding"
+			containsWarning := strings.Contains(logger.Entries()[0].Message, warning)
+
+			if containsWarning != tc.containsMsg {
+				t.Fatal("Mismatch between OPA server displaying the interface warning message and user setting the server address")
+			}
+
+			if logger.GetLevel() != logLevel {
+				t.Fatalf("Expected log level to be: \"%v\" but got \"%v\"", logLevel, logger.GetLevel())
+			}
+		})
+	}
+}
diff --git a/sdk/RawMapper.go b/sdk/RawMapper.go
new file mode 100644
index 0000000000..14221e41c9
--- /dev/null
+++ b/sdk/RawMapper.go
@@ -0,0 +1,17 @@
+package sdk
+
+import (
+	"github.com/open-policy-agent/opa/rego"
+)
+
+type RawMapper struct {
+}
+
+func (e *RawMapper) MapResults(pq *rego.PartialQueries) (interface{}, error) {
+
+	return pq, nil
+}
+
+func (e *RawMapper) ResultToJSON(results interface{}) (interface{}, error) {
+	return results, nil
+}
diff --git a/sdk/opa.go b/sdk/opa.go
index bfb163f8d6..7946a5d4da 100644
--- a/sdk/opa.go
+++ b/sdk/opa.go
@@ -25,9 +25,14 @@ import (
 	"github.com/open-policy-agent/opa/plugins/logs"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/server"
+	"github.com/open-policy-agent/opa/server/types"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
+	"github.com/open-policy-agent/opa/topdown/print"
+	"github.com/open-policy-agent/opa/version"
 )
 
 // OPA represents an instance of the policy engine. OPA can be started with
@@ -52,9 +57,14 @@ type state struct {
 // options that specify an OPA configuration file.
 func New(ctx context.Context, opts Options) (*OPA, error) {
 
-	id, err := uuid.New(rand.Reader)
-	if err != nil {
-		return nil, err
+	var err error
+
+	id := opts.ID
+	if id == "" {
+		id, err = uuid.New(rand.Reader)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	if err := opts.init(); err != nil {
@@ -76,6 +86,14 @@ func New(ctx context.Context, opts Options) (*OPA, error) {
 	return opa, opa.configure(ctx, opa.config, opts.Ready, opts.block)
 }
 
+// Plugin returns the named plugin. If the plugin does not exist, this function
+// returns nil.
+func (opa *OPA) Plugin(name string) plugins.Plugin {
+	opa.mtx.Lock()
+	defer opa.mtx.Unlock()
+	return opa.state.manager.Plugin(name)
+}
+
 // Configure updates the configuration of the OPA in-place. This function should
 // be called in response to configuration updates in the environment. This
 // function is atomic. If the configuration update cannot be successfully
@@ -101,7 +119,7 @@ func (opa *OPA) Configure(ctx context.Context, opts ConfigOptions) error {
 }
 
 func (opa *OPA) configure(ctx context.Context, bs []byte, ready chan struct{}, block bool) error {
-	info, err := runtime.Term(runtime.Params{})
+	info, err := runtime.Term(runtime.Params{Config: opa.config})
 	if err != nil {
 		return err
 	}
@@ -112,12 +130,14 @@ func (opa *OPA) configure(ctx context.Context, bs []byte, ready chan struct{}, b
 		inmem.New(),
 		plugins.Info(info),
 		plugins.Logger(opa.logger),
-		plugins.ConsoleLogger(opa.console))
+		plugins.ConsoleLogger(opa.console),
+		plugins.EnablePrintStatements(opa.logger.GetLevel() >= logging.Info),
+		plugins.PrintHook(loggingPrintHook{logger: opa.logger}))
 	if err != nil {
 		return err
 	}
 
-	manager.RegisterCompilerTrigger(func(_ storage.Transaction) {
+	manager.RegisterCompilerTrigger(func(storage.Transaction) {
 		opa.mtx.Lock()
 		opa.state.queryCache.Clear()
 		opa.mtx.Unlock()
@@ -204,8 +224,90 @@ func (opa *OPA) Stop(ctx context.Context) {
 // Decision returns a named decision. This function is threadsafe.
 func (opa *OPA) Decision(ctx context.Context, options DecisionOptions) (*DecisionResult, error) {
 
-	m := metrics.New()
-	m.Timer(metrics.SDKDecisionEval).Start()
+	record := server.Info{
+		Timestamp:      options.Now,
+		Path:           options.Path,
+		Input:          &options.Input,
+		NDBuiltinCache: &options.NDBCache,
+		Metrics:        options.Metrics,
+	}
+
+	// Only use non-deterministic builtins cache if it's available.
+	var ndbc builtins.NDBCache
+	if options.NDBCache != nil {
+		if v, ok := options.NDBCache.(builtins.NDBCache); ok {
+			ndbc = v
+		}
+	}
+
+	result, err := opa.executeTransaction(
+		ctx,
+		&record,
+		func(s state, result *DecisionResult) {
+			result.Result, result.Provenance, record.InputAST, record.Bundles, record.Error = evaluate(ctx, evalArgs{
+				runtime:             s.manager.Info,
+				printHook:           s.manager.PrintHook(),
+				compiler:            s.manager.GetCompiler(),
+				store:               s.manager.Store,
+				queryCache:          s.queryCache,
+				interQueryCache:     s.interQueryBuiltinCache,
+				ndbcache:            ndbc,
+				txn:                 record.Txn,
+				now:                 record.Timestamp,
+				path:                record.Path,
+				input:               *record.Input,
+				m:                   record.Metrics,
+				strictBuiltinErrors: options.StrictBuiltinErrors,
+				tracer:              options.Tracer,
+				profiler:            options.Profiler,
+				instrument:          options.Instrument,
+			})
+			if record.Error == nil {
+				record.Results = &result.Result
+			}
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return result, record.Error
+}
+
+// DecisionOptions contains parameters for query evaluation.
+type DecisionOptions struct {
+	Now                 time.Time           // specifies wallclock time used for time.now_ns(), decision log timestamp, etc.
+	Path                string              // specifies name of policy decision to evaluate (e.g., example/allow)
+	Input               interface{}         // specifies value of the input document to evaluate policy with
+	NDBCache            interface{}         // specifies the non-deterministic builtins cache to use for evaluation.
+	StrictBuiltinErrors bool                // treat built-in function errors as fatal
+	Tracer              topdown.QueryTracer // specifies the tracer to use for evaluation, optional
+	Metrics             metrics.Metrics     // specifies the metrics to use for preparing and evaluation, optional
+	Profiler            topdown.QueryTracer // specifies the profiler to use, optional
+	Instrument          bool                // if true, instrumentation will be enabled
+}
+
+// DecisionResult contains the output of query evaluation.
+type DecisionResult struct {
+	ID         string             // provides a globally unique identifier for this decision (which is included in the decision log.)
+	Result     interface{}        // provides the output of query evaluation.
+	Provenance types.ProvenanceV1 // wraps the bundle build/version information
+}
+
+func newDecisionResult() (*DecisionResult, error) {
+	id, err := uuid.New(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	result := &DecisionResult{ID: id}
+	return result, nil
+}
+
+func (opa *OPA) executeTransaction(ctx context.Context, record *server.Info, work func(state, *DecisionResult)) (*DecisionResult, error) {
+	if record.Metrics == nil {
+		record.Metrics = metrics.New()
+	}
+	record.Metrics.Timer(metrics.SDKDecisionEval).Start()
 
 	result, err := newDecisionResult()
 	if err != nil {
@@ -216,13 +318,7 @@ func (opa *OPA) Decision(ctx context.Context, options DecisionOptions) (*Decisio
 	s := *opa.state
 	opa.mtx.Unlock()
 
-	record := server.Info{
-		DecisionID: result.ID,
-		Timestamp:  options.Now,
-		Path:       options.Path,
-		Input:      &options.Input,
-		Metrics:    m,
-	}
+	record.DecisionID = result.ID
 
 	if record.Timestamp.IsZero() {
 		record.Timestamp = time.Now().UTC()
@@ -236,54 +332,109 @@ func (opa *OPA) Decision(ctx context.Context, options DecisionOptions) (*Decisio
 
 	if record.Error == nil {
 		defer s.manager.Store.Abort(ctx, record.Txn)
-		result.Result, record.InputAST, record.Bundles, record.Error = evaluate(ctx, evalArgs{
-			runtime:         s.manager.Info,
-			compiler:        s.manager.GetCompiler(),
-			store:           s.manager.Store,
-			txn:             record.Txn,
-			queryCache:      s.queryCache,
-			interQueryCache: s.interQueryBuiltinCache,
-			now:             record.Timestamp,
-			path:            record.Path,
-			input:           *record.Input,
-			m:               record.Metrics,
-		})
-		if record.Error == nil {
-			record.Results = &result.Result
-		}
+		work(s, result)
 	}
 
-	m.Timer(metrics.SDKDecisionEval).Stop()
+	record.Metrics.Timer(metrics.SDKDecisionEval).Stop()
 
 	if logger := logs.Lookup(s.manager); logger != nil {
-		if err := logger.Log(ctx, &record); err != nil {
+		if err := logger.Log(ctx, record); err != nil {
 			return result, fmt.Errorf("decision log: %w", err)
 		}
 	}
-
-	return result, record.Error
+	return result, nil
 }
 
-// DecisionOptions contains parameters for query evaluation.
-type DecisionOptions struct {
-	Now   time.Time   // specifies wallclock time used for time.now_ns(), decision log timestamp, etc.
-	Path  string      // specifies name of policy decision to evaluate (e.g., example/allow)
-	Input interface{} // specifies value of the input document to evaluate policy with
-}
+// Partial returns a named decision. This function is threadsafe.
+// Note(philipc): The NDBCache is unused here, because non-deterministic
+// builtins are not run during partial evaluation.
+func (opa *OPA) Partial(ctx context.Context, options PartialOptions) (*PartialResult, error) {
 
-// DecisionResult contains the output of query evaluation.
-type DecisionResult struct {
-	ID     string      // provides a globally unique identifier for this decision (which is included in the decision log.)
-	Result interface{} // provides the output of query evaluation.
-}
+	if options.Mapper == nil {
+		options.Mapper = &RawMapper{}
+	}
 
-func newDecisionResult() (*DecisionResult, error) {
-	id, err := uuid.New(rand.Reader)
+	record := server.Info{
+		Timestamp: options.Now,
+		Input:     &options.Input,
+		Query:     options.Query,
+		Metrics:   options.Metrics,
+	}
+
+	var provenance types.ProvenanceV1
+
+	var pq *rego.PartialQueries
+	decision, err := opa.executeTransaction(
+		ctx,
+		&record,
+		func(s state, result *DecisionResult) {
+			pq, provenance, record.InputAST, record.Bundles, record.Error = partial(ctx, partialEvalArgs{
+				runtime:             s.manager.Info,
+				printHook:           s.manager.PrintHook(),
+				compiler:            s.manager.GetCompiler(),
+				store:               s.manager.Store,
+				txn:                 record.Txn,
+				now:                 record.Timestamp,
+				query:               record.Query,
+				unknowns:            options.Unknowns,
+				input:               *record.Input,
+				m:                   record.Metrics,
+				strictBuiltinErrors: options.StrictBuiltinErrors,
+				tracer:              options.Tracer,
+				profiler:            options.Profiler,
+				instrument:          options.Instrument,
+			})
+			if record.Error == nil {
+				result.Result, record.Error = options.Mapper.MapResults(pq)
+				var pqAst interface{}
+				if record.Error == nil {
+					var mappedResults interface{}
+					mappedResults, record.Error = options.Mapper.ResultToJSON(result.Result)
+					record.MappedResults = &mappedResults
+					pqAst = pq
+					record.Results = &pqAst
+				}
+			}
+		},
+	)
 	if err != nil {
 		return nil, err
 	}
-	result := &DecisionResult{ID: id}
-	return result, nil
+
+	return &PartialResult{
+		ID:         decision.ID,
+		Result:     decision.Result,
+		AST:        pq,
+		Provenance: provenance,
+	}, record.Error
+}
+
+type PartialQueryMapper interface {
+	// The first interface being returned is the type that will be used for further processing
+	MapResults(pq *rego.PartialQueries) (interface{}, error)
+	// This should be able to take the Result object from MapResults and return a type that can be logged as JSON
+	ResultToJSON(result interface{}) (interface{}, error)
+}
+
+// PartialOptions contains parameters for partial query evaluation.
+type PartialOptions struct {
+	Now                 time.Time           // specifies wallclock time used for time.now_ns(), decision log timestamp, etc.
+	Input               interface{}         // specifies value of the input document to evaluate policy with
+	Query               string              // specifies the query to be partially evaluated
+	Unknowns            []string            // specifies the unknown elements of the policy
+	Mapper              PartialQueryMapper  // specifies the mapper to use when processing results
+	StrictBuiltinErrors bool                // treat built-in function errors as fatal
+	Tracer              topdown.QueryTracer // specifies the tracer to use for evaluation, optional
+	Metrics             metrics.Metrics     // specifies the metrics to use for preparing and evaluation, optional
+	Profiler            topdown.QueryTracer // specifies the profiler to use, optional
+	Instrument          bool                // if true, instrumentation will be enabled
+}
+
+type PartialResult struct {
+	ID         string               // decision ID
+	Result     interface{}          // mapped result
+	AST        *rego.PartialQueries // raw result
+	Provenance types.ProvenanceV1   // wraps the bundle build/version information
 }
 
 // Error represents an internal error in the SDK.
@@ -315,28 +466,46 @@ func IsUndefinedErr(err error) bool {
 }
 
 type evalArgs struct {
-	runtime         *ast.Term
-	compiler        *ast.Compiler
-	store           storage.Store
-	txn             storage.Transaction
-	queryCache      *queryCache
-	interQueryCache cache.InterQueryCache
-	now             time.Time
-	path            string
-	input           interface{}
-	m               metrics.Metrics
+	runtime             *ast.Term
+	printHook           print.Hook
+	compiler            *ast.Compiler
+	store               storage.Store
+	txn                 storage.Transaction
+	queryCache          *queryCache
+	interQueryCache     cache.InterQueryCache
+	now                 time.Time
+	path                string
+	input               interface{}
+	ndbcache            builtins.NDBCache
+	m                   metrics.Metrics
+	strictBuiltinErrors bool
+	tracer              topdown.QueryTracer
+	profiler            topdown.QueryTracer
+	instrument          bool
 }
 
-func evaluate(ctx context.Context, args evalArgs) (interface{}, ast.Value, map[string]server.BundleInfo, error) {
+func evaluate(ctx context.Context, args evalArgs) (interface{}, types.ProvenanceV1, ast.Value, map[string]server.BundleInfo, error) {
 
+	provenance := types.ProvenanceV1{
+		Version:   version.Version,
+		Vcs:       version.Vcs,
+		Timestamp: version.Timestamp,
+		Hostname:  version.Hostname,
+		Bundles:   make(map[string]types.ProvenanceBundleV1),
+	}
 	bundles, err := bundles(ctx, args.store, args.txn)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, provenance, nil, nil, err
+	}
+	for b, info := range bundles {
+		provenance.Bundles[b] = types.ProvenanceBundleV1{
+			Revision: info.Revision,
+		}
 	}
 
 	r, err := ref.ParseDataPath(args.path)
 	if err != nil {
-		return nil, nil, bundles, err
+		return nil, provenance, nil, bundles, err
 	}
 
 	pq, err := args.queryCache.Get(r.String(), func(query string) (*rego.PreparedEvalQuery, error) {
@@ -347,6 +516,9 @@ func evaluate(ctx context.Context, args evalArgs) (interface{}, ast.Value, map[s
 			rego.Compiler(args.compiler),
 			rego.Store(args.store),
 			rego.Transaction(args.txn),
+			rego.PrintHook(args.printHook),
+			rego.StrictBuiltinErrors(args.strictBuiltinErrors),
+			rego.Instrument(args.instrument),
 			rego.Runtime(args.runtime)).PrepareForEval(ctx)
 		if err != nil {
 			return nil, err
@@ -354,12 +526,12 @@ func evaluate(ctx context.Context, args evalArgs) (interface{}, ast.Value, map[s
 		return &pq, err
 	})
 	if err != nil {
-		return nil, nil, bundles, err
+		return nil, provenance, nil, bundles, err
 	}
 
 	inputAST, err := ast.InterfaceToValue(args.input)
 	if err != nil {
-		return nil, nil, bundles, err
+		return nil, provenance, nil, bundles, err
 	}
 
 	rs, err := pq.Eval(
@@ -369,14 +541,81 @@ func evaluate(ctx context.Context, args evalArgs) (interface{}, ast.Value, map[s
 		rego.EvalTransaction(args.txn),
 		rego.EvalMetrics(args.m),
 		rego.EvalInterQueryBuiltinCache(args.interQueryCache),
+		rego.EvalNDBuiltinCache(args.ndbcache),
+		rego.EvalQueryTracer(args.tracer),
+		rego.EvalMetrics(args.m),
+		rego.EvalQueryTracer(args.profiler),
+		rego.EvalInstrument(args.instrument),
 	)
 	if err != nil {
-		return nil, inputAST, bundles, err
+		return nil, provenance, inputAST, bundles, err
 	} else if len(rs) == 0 {
-		return nil, inputAST, bundles, undefinedDecisionErr(args.path)
+		return nil, provenance, inputAST, bundles, undefinedDecisionErr(args.path)
+	}
+
+	return rs[0].Expressions[0].Value, provenance, inputAST, bundles, nil
+}
+
+type partialEvalArgs struct {
+	runtime             *ast.Term
+	compiler            *ast.Compiler
+	printHook           print.Hook
+	store               storage.Store
+	txn                 storage.Transaction
+	unknowns            []string
+	query               string
+	now                 time.Time
+	input               interface{}
+	m                   metrics.Metrics
+	strictBuiltinErrors bool
+	tracer              topdown.QueryTracer
+	profiler            topdown.QueryTracer
+	instrument          bool
+}
+
+func partial(ctx context.Context, args partialEvalArgs) (*rego.PartialQueries, types.ProvenanceV1, ast.Value, map[string]server.BundleInfo, error) {
+
+	provenance := types.ProvenanceV1{
+		Version: version.Version,
+		Bundles: make(map[string]types.ProvenanceBundleV1),
+	}
+
+	bundles, err := bundles(ctx, args.store, args.txn)
+	if err != nil {
+		return nil, provenance, nil, nil, err
+	}
+	for b, info := range bundles {
+		provenance.Bundles[b] = types.ProvenanceBundleV1{
+			Revision: info.Revision,
+		}
 	}
 
-	return rs[0].Expressions[0].Value, inputAST, bundles, nil
+	inputAST, err := ast.InterfaceToValue(args.input)
+	if err != nil {
+		return nil, provenance, nil, bundles, err
+	}
+	re := rego.New(
+		rego.Time(args.now),
+		rego.Metrics(args.m),
+		rego.Store(args.store),
+		rego.Compiler(args.compiler),
+		rego.Transaction(args.txn),
+		rego.Runtime(args.runtime),
+		rego.Input(args.input),
+		rego.Query(args.query),
+		rego.Unknowns(args.unknowns),
+		rego.PrintHook(args.printHook),
+		rego.StrictBuiltinErrors(args.strictBuiltinErrors),
+		rego.QueryTracer(args.tracer),
+		rego.QueryTracer(args.profiler),
+		rego.Instrument(args.instrument),
+	)
+
+	pq, err := re.Partial(ctx)
+	if err != nil {
+		return nil, provenance, nil, bundles, err
+	}
+	return pq, provenance, inputAST, bundles, err
 }
 
 type queryCache struct {
@@ -428,3 +667,12 @@ func bundles(ctx context.Context, store storage.Store, txn storage.Transaction)
 	}
 	return bundles, nil
 }
+
+type loggingPrintHook struct {
+	logger logging.Logger
+}
+
+func (h loggingPrintHook) Print(pctx print.Context, msg string) error {
+	h.logger.WithFields(map[string]interface{}{"line": pctx.Location.String()}).Info(msg)
+	return nil
+}
diff --git a/sdk/opa_test.go b/sdk/opa_test.go
index 5f20c6d1a3..97877bda86 100644
--- a/sdk/opa_test.go
+++ b/sdk/opa_test.go
@@ -5,15 +5,26 @@
 package sdk_test
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/open-policy-agent/opa/server/types"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/logging"
+	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/profiler"
+	"github.com/open-policy-agent/opa/rego"
+	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
+	"github.com/open-policy-agent/opa/topdown/lineage"
+
 	"github.com/fortytw2/leaktest"
 	loggingtest "github.com/open-policy-agent/opa/logging/test"
 	"github.com/open-policy-agent/opa/plugins"
@@ -22,79 +33,1056 @@ import (
 	"github.com/open-policy-agent/opa/version"
 )
 
-// Plugin creates an empty plugin to test plugin initialization
+// Plugin creates an empty plugin to test plugin initialization and shutdown
 type plugin struct {
-	manager *plugins.Manager
+	manager  *plugins.Manager
+	shutdown time.Duration // to simulate a shutdown that takes some time
+}
+
+type factory struct {
+	shutdown time.Duration
+}
+
+func (p *plugin) Start(context.Context) error {
+	p.manager.UpdatePluginStatus("test_plugin", &plugins.Status{State: plugins.StateOK})
+	return nil
+}
+
+func (p *plugin) Stop(ctx context.Context) {
+	select {
+	case <-ctx.Done():
+	case <-time.After(p.shutdown):
+	}
+}
+
+func (*plugin) Reconfigure(context.Context, interface{}) {
+}
+
+func (f factory) New(manager *plugins.Manager, config interface{}) plugins.Plugin {
+	return &plugin{
+		manager:  manager,
+		shutdown: f.shutdown,
+	}
+}
+
+func (factory) Validate(*plugins.Manager, []byte) (interface{}, error) {
+	return nil, nil
+}
+
+func TestPlugins(t *testing.T) {
+
+	ctx := context.Background()
+
+	config := `{
+        "plugins": {
+            "test_plugin": {}
+		}
+	}`
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+		Plugins: map[string]plugins.Factory{
+			"test_plugin": factory{},
+		},
+	})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+}
+
+func TestPluginPanic(t *testing.T) {
+	ctx := context.Background()
+
+	opa, err := sdk.New(ctx, sdk.Options{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	opa.Stop(ctx)
+}
+
+func TestSDKConfigurableID(t *testing.T) {
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = time.now_ns()
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL())
+
+	testLogger := loggingtest.New()
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config:        strings.NewReader(config),
+		ConsoleLogger: testLogger,
+		ID:            "164031de-e511-11ec-8fea-0242ac120002"})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	if _, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Now: time.Unix(0, 1619868194450288000).UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	entries := testLogger.Entries()
+
+	if entries[0].Fields["labels"].(map[string]interface{})["id"] != "164031de-e511-11ec-8fea-0242ac120002" {
+		t.Fatalf("expected %v but got %v", "164031de-e511-11ec-8fea-0242ac120002", entries[0].Fields["labels"].(map[string]interface{})["id"])
+	}
+
+}
+
+func TestDecision(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = true
+
+str = "foo"
+
+loopback = input
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(bool); !ok || !decision {
+		t.Fatal("expected true but got:", decision, ok)
+	}
+
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/system/str"}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(string); !ok || decision != "foo" {
+		t.Fatal(`expected "foo" but got:`, decision)
+	}
+
+	exp := map[string]interface{}{"foo": "bar"}
+
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/system/loopback", Input: map[string]interface{}{"foo": "bar"}}); err != nil {
+		t.Fatal(err)
+	} else if !reflect.DeepEqual(result.Result, exp) {
+		t.Fatalf("expected %v but got %v", exp, result.Result)
+	}
+}
+
+func TestDecisionWithStrictBuiltinErrors(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package example
+
+erroring_function(number) = output {
+	output := number / 0
+}
+
+allow {
+	erroring_function(1)
+}
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	_, err = opa.Decision(ctx, sdk.DecisionOptions{
+		StrictBuiltinErrors: true,
+		Path:                "/example/allow",
+	})
+	if err == nil {
+		t.Fatal("expected error but got nil")
+	}
+
+	actual, ok := err.(*topdown.Error)
+	if !ok || actual.Code != "eval_builtin_error" {
+		t.Fatalf("expected eval_builtin_error but got %v", actual)
+	}
+
+	if exp, act := "div: divide by zero", actual.Message; exp != act {
+		t.Fatalf("expected %v but got %v", exp, act)
+	}
+}
+
+func TestDecisionWithTrace(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main {
+	trace("foobar")
+	true
+}
+			`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	tracer := topdown.NewBufferTracer()
+
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Path:   "/system/main",
+		Tracer: tracer,
+	}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(bool); !ok || !decision {
+		t.Fatal("expected true but got:", decision, ok)
+	}
+
+	events := lineage.Notes(*(tracer))
+	if exp, act := 3, len(events); exp != act {
+		t.Fatalf("expected %d events, got %d", exp, act)
+	}
+
+	if exp, act := "Enter", string(events[0].Op); exp != act {
+		t.Errorf("expected %s event, got %s", exp, act)
+	}
+	if exp, act := "data.system.main", string(events[0].Location.Text); exp != act {
+		t.Errorf("expected location %q got %q", exp, act)
+	}
+	if exp, act := "Enter", string(events[1].Op); exp != act {
+		t.Errorf("expected %s event, got %v", exp, act)
+	}
+	if exp, act := "Note", string(events[2].Op); exp != act {
+		t.Errorf("expected %s event, got %v", exp, act)
+	}
+	if exp, act := "foobar", events[2].Message; exp != act {
+		t.Errorf("unexpected message, wanted %q, got %q", exp, act)
+	}
 }
 
-type factory struct{}
+func TestDecisionWithMetrics(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = true
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	m := metrics.New()
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Metrics: m,
+	}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(bool); !ok || !decision {
+		t.Fatal("expected true but got:", decision, ok)
+	}
+
+	if exp, act := 5, len(m.All()); exp != act {
+		t.Fatalf("expected %d metrics, got %d", exp, act)
+	}
+
+	expectedRecordedMetricGroups := map[string]bool{
+		"timer_rego": false,
+		"timer_sdk":  false,
+	}
+	for k := range m.All() {
+		for group, found := range expectedRecordedMetricGroups {
+			if found {
+				continue
+			}
+			if strings.HasPrefix(k, group) {
+				expectedRecordedMetricGroups[group] = true
+			}
+		}
+	}
+	for group, found := range expectedRecordedMetricGroups {
+		if !found {
+			t.Errorf("expected metric group %s not recorded", group)
+		}
+	}
+
+}
+
+func TestDecisionWithIntrumentationAndProfile(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = true
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	m := metrics.New()
+	p := profiler.New()
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Metrics:    m,
+		Profiler:   p,
+		Instrument: true,
+	}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(bool); !ok || !decision {
+		t.Fatal("expected true but got:", decision, ok)
+	}
+
+	if exp, act := 26, len(m.All()); exp != act {
+		t.Fatalf("expected %d metrics, got %d", exp, act)
+	}
+
+	expectedRecordedMetricGroups := map[string]bool{
+		"counter_eval":        false,
+		"histogram_eval":      false,
+		"timer_query_compile": false,
+		"timer_eval":          false,
+		"timer_rego":          false,
+		"timer_sdk":           false,
+	}
+	for k := range m.All() {
+		for group, found := range expectedRecordedMetricGroups {
+			if found {
+				continue
+			}
+			if strings.HasPrefix(k, group) {
+				expectedRecordedMetricGroups[group] = true
+			}
+		}
+	}
+	for group, found := range expectedRecordedMetricGroups {
+		if !found {
+			t.Errorf("expected metric group %s not recorded", group)
+		}
+	}
+
+	stats := p.ReportTopNResults(10, []string{"line"})
+
+	if exp, act := 2, len(stats); exp != act {
+		t.Fatalf("expected %d stats, got %d", exp, act)
+	}
+	if exp, act := "true", string(stats[0].Location.Text); exp != act {
+		t.Errorf("expected location %q got %q", exp, act)
+	}
+	if exp, act := "data.system.main", string(stats[1].Location.Text); exp != act {
+		t.Errorf("expected location %q got %q", exp, act)
+	}
+
+}
+
+func TestDecisionWithProvenance(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = true
+`,
+			".manifest": `{"revision": "v1.0.0"}`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	result, err := opa.Decision(ctx, sdk.DecisionOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if decision, ok := result.Result.(bool); !ok || !decision {
+		t.Fatal("expected true but got:", decision, ok)
+	}
+
+	expectedProvenance := types.ProvenanceV1{
+		Version: version.Version,
+		Bundles: map[string]types.ProvenanceBundleV1{
+			"test": {
+				Revision: "v1.0.0",
+			},
+		},
+	}
+
+	if result.Provenance.Version == "" {
+		t.Error("expected non empty provenance version")
+	}
+
+	if !reflect.DeepEqual(result.Provenance, expectedProvenance) {
+		t.Fatalf("expected %v but got %v", expectedProvenance, result.Provenance)
+	}
+
+}
+
+func TestDecisionWithBundleData(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = data.foo
+`,
+			"data.json": `{"foo": "bar"}`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	result, err := opa.Decision(ctx, sdk.DecisionOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	exp := "bar"
+	if act, ok := result.Result.(string); !ok || act != exp {
+		t.Fatalf("expected %s but got %s", exp, act)
+	}
+
+}
+
+func TestPartial(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package test
+
+allow {
+	data.junk.x = input.y
+}
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL())
+
+	testLogger := loggingtest.New()
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config:        strings.NewReader(config),
+		ConsoleLogger: testLogger,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	var result *sdk.PartialResult
+	if result, err = opa.Partial(ctx, sdk.PartialOptions{
+		Input:    map[string]int{"y": 2},
+		Query:    "data.test.allow = true",
+		Unknowns: []string{"data.junk.x"},
+		Mapper:   &sdk.RawMapper{},
+		Now:      time.Unix(0, 1619868194450288000).UTC(),
+	}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(*rego.PartialQueries); !ok || decision.Queries[0].String() != "2 = data.junk.x" {
+		t.Fatal("expected &{[2 = data.junk.x] []} true but got:", decision, ok)
+	}
+
+	entries := testLogger.Entries()
+
+	if l := len(entries); l != 1 {
+		t.Fatalf("expected %v but got %v", 1, l)
+	}
+
+	// just checking for existence, since it's a complex value
+	if entries[0].Fields["mapped_result"] == nil {
+		t.Fatalf("expected not nil value for mapped_result but got nil")
+	}
+
+	if entries[0].Fields["result"] == nil {
+		t.Fatalf("expected not nil value for result but got nil")
+	}
+
+	if entries[0].Fields["timestamp"] != "2021-05-01T11:23:14.450288Z" {
+		t.Fatalf("expected %v but got %v", "2021-05-01T11:23:14.450288Z", entries[0].Fields["timestamp"])
+	}
+
+}
+
+func TestPartialWithStrictBuiltinErrors(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package example
+
+erroring_function(number) = output {
+	output := number / 0
+}
+
+allow {
+	erroring_function(1)
+}
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL())
+
+	testLogger := loggingtest.New()
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config:        strings.NewReader(config),
+		ConsoleLogger: testLogger,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	_, err = opa.Partial(ctx, sdk.PartialOptions{
+		Input:               map[string]interface{}{},
+		Query:               "data.example.allow",
+		Unknowns:            []string{},
+		Mapper:              &sdk.RawMapper{},
+		Now:                 time.Unix(0, 1619868194450288000).UTC(),
+		StrictBuiltinErrors: true,
+	})
+	if err == nil {
+		t.Fatal("expected error but got nil")
+	}
+
+	actual, ok := err.(*topdown.Error)
+	if !ok || actual.Code != "eval_builtin_error" {
+		t.Fatalf("expected eval_builtin_error but got %v", actual)
+	}
+
+	if exp, act := "div: divide by zero", actual.Message; exp != act {
+		t.Fatalf("expected %v but got %v", exp, act)
+	}
+}
+
+func TestPartialWithTrace(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main {
+	trace("foobar")
+}
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL())
+
+	testLogger := loggingtest.New()
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config:        strings.NewReader(config),
+		ConsoleLogger: testLogger,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	tracer := topdown.NewBufferTracer()
+	_, err = opa.Partial(ctx, sdk.PartialOptions{
+		Input:    map[string]interface{}{},
+		Query:    "data.system.main",
+		Unknowns: []string{},
+		Mapper:   &sdk.RawMapper{},
+		Now:      time.Unix(0, 1619868194450288000).UTC(),
+		Tracer:   tracer,
+	})
+	if err != nil {
+		t.Fatalf("unexpected error %v", err)
+	}
+
+	events := lineage.Notes(*(tracer))
+
+	if exp, act := 3, len(events); exp != act {
+		t.Fatalf("expected %d events, got %d", exp, act)
+	}
+
+	if exp, act := "Enter", string(events[0].Op); exp != act {
+		t.Errorf("expected %s event, got %s", exp, act)
+	}
+	if exp, act := "data.system.main", string(events[0].Location.Text); exp != act {
+		t.Errorf("expected location %q got %q", exp, act)
+	}
+	if exp, act := "Enter", string(events[1].Op); exp != act {
+		t.Errorf("expected %s event, got %v", exp, act)
+	}
+	if exp, act := "Note", string(events[2].Op); exp != act {
+		t.Errorf("expected %s event, got %v", exp, act)
+	}
+	if exp, act := "foobar", events[2].Message; exp != act {
+		t.Errorf("unexpected message, wanted %q, got %q", exp, act)
+	}
+}
+
+func TestPartialWithMetrics(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package test
+
+allow {
+	data.junk.x = input.y
+}
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
 
-func (p *plugin) Start(ctx context.Context) error {
-	p.manager.UpdatePluginStatus("test_plugin", &plugins.Status{State: plugins.StateOK})
-	return nil
-}
+	defer opa.Stop(ctx)
 
-func (p *plugin) Stop(ctx context.Context) {
-}
+	m := metrics.New()
+	var result *sdk.PartialResult
+	if result, err = opa.Partial(ctx, sdk.PartialOptions{
+		Input:    map[string]int{"y": 2},
+		Query:    "data.test.allow = true",
+		Unknowns: []string{"data.junk.x"},
+		Mapper:   &sdk.RawMapper{},
+		Now:      time.Unix(0, 1619868194450288000).UTC(),
+		Metrics:  m,
+	}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(*rego.PartialQueries); !ok || decision.Queries[0].String() != "2 = data.junk.x" {
+		t.Fatal("expected &{[2 = data.junk.x] []} true but got:", decision, ok)
+	}
 
-func (p *plugin) Reconfigure(ctx context.Context, config interface{}) {
-}
+	if exp, act := 6, len(m.All()); exp != act {
+		t.Fatalf("expected %d metrics, got %d", exp, act)
+	}
 
-func (factory) New(manager *plugins.Manager, config interface{}) plugins.Plugin {
-	return &plugin{
-		manager: manager,
+	expectedRecordedMetricGroups := map[string]bool{
+		"timer_rego": false,
+		"timer_sdk":  false,
+	}
+	for k := range m.All() {
+		for group, found := range expectedRecordedMetricGroups {
+			if found {
+				continue
+			}
+			if strings.HasPrefix(k, group) {
+				expectedRecordedMetricGroups[group] = true
+			}
+		}
+	}
+	for group, found := range expectedRecordedMetricGroups {
+		if !found {
+			t.Errorf("expected metric group %s not recorded", group)
+		}
 	}
-}
 
-func (factory) Validate(manager *plugins.Manager, config []byte) (interface{}, error) {
-	return nil, nil
 }
 
-func TestPlugins(t *testing.T) {
+func TestPartialWithInstrumentationAndProfile(t *testing.T) {
 
 	ctx := context.Background()
 
-	config := []byte(`{
-        "plugins": {
-            "test_plugin": {}
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package test
+
+allow {
+	data.junk.x = input.y
+}
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
 		}
-	}`)
+	}`, server.URL())
 
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
-		Plugins: map[string]plugins.Factory{
-			"test_plugin": factory{},
-		},
+		Config: strings.NewReader(config),
 	})
-
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	defer opa.Stop(ctx)
+
+	m := metrics.New()
+	p := profiler.New()
+	var result *sdk.PartialResult
+	if result, err = opa.Partial(ctx, sdk.PartialOptions{
+		Input:      map[string]int{"y": 2},
+		Query:      "data.test.allow = true",
+		Unknowns:   []string{"data.junk.x"},
+		Mapper:     &sdk.RawMapper{},
+		Now:        time.Unix(0, 1619868194450288000).UTC(),
+		Metrics:    m,
+		Profiler:   p,
+		Instrument: true,
+	}); err != nil {
+		t.Fatal(err)
+	} else if decision, ok := result.Result.(*rego.PartialQueries); !ok || decision.Queries[0].String() != "2 = data.junk.x" {
+		t.Fatal("expected &{[2 = data.junk.x] []} true but got:", decision, ok)
+	}
+
+	if exp, act := 33, len(m.All()); exp != act {
+		t.Fatalf("expected %d metrics, got %d", exp, act)
+	}
+
+	expectedRecordedMetricGroups := map[string]bool{
+		"histogram_eval":      false,
+		"histogram_partial":   false,
+		"timer_query_compile": false,
+		"timer_eval":          false,
+		"timer_partial":       false,
+		"timer_rego":          false,
+		"timer_sdk":           false,
+	}
+
+	for k := range m.All() {
+		for group, found := range expectedRecordedMetricGroups {
+			if found {
+				continue
+			}
+			if strings.HasPrefix(k, group) {
+				expectedRecordedMetricGroups[group] = true
+			}
+		}
+	}
+	for group, found := range expectedRecordedMetricGroups {
+		if !found {
+			t.Errorf("expected metric group %s not recorded", group)
+		}
+	}
+
+	stats := p.ReportTopNResults(10, []string{"line"})
+
+	if exp, act := 2, len(stats); exp != act {
+		t.Fatalf("expected %d stats, got %d", exp, act)
+	}
+	if exp, act := "data.junk.x = input.y", string(stats[0].Location.Text); exp != act {
+		t.Errorf("expected location %q got %q", exp, act)
+	}
+	if exp, act := "data.test.allow = true", string(stats[1].Location.Text); exp != act {
+		t.Errorf("expected location %q got %q", exp, act)
+	}
+
 }
 
-func TestDecision(t *testing.T) {
+func TestPartialWithProvenance(t *testing.T) {
 
 	ctx := context.Background()
 
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
 			"main.rego": `
-				package system
-
-				main = true
-
-				str = "foo"
+package test
 
-				loopback = input
-			`,
+allow {
+	data.junk.x = input.y
+}
+`,
+			".manifest": `{"revision": "v1.0.0"}`,
 		}),
 	)
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -104,11 +1092,14 @@ func TestDecision(t *testing.T) {
 			"test": {
 				"resource": "/bundles/bundle.tar.gz"
 			}
+		},
+		"decision_logs": {
+			"console": true
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -116,25 +1107,35 @@ func TestDecision(t *testing.T) {
 
 	defer opa.Stop(ctx)
 
-	if result, err := opa.Decision(ctx, sdk.DecisionOptions{}); err != nil {
+	var result *sdk.PartialResult
+	if result, err = opa.Partial(ctx, sdk.PartialOptions{
+		Input:    map[string]int{"y": 2},
+		Query:    "data.test.allow = true",
+		Unknowns: []string{"data.junk.x"},
+		Mapper:   &sdk.RawMapper{},
+		Now:      time.Unix(0, 1619868194450288000).UTC(),
+	}); err != nil {
 		t.Fatal(err)
-	} else if decision, ok := result.Result.(bool); !ok || !decision {
-		t.Fatal("expected true but got:", decision, ok)
+	} else if decision, ok := result.Result.(*rego.PartialQueries); !ok || decision.Queries[0].String() != "2 = data.junk.x" {
+		t.Fatal("expected &{[2 = data.junk.x] []} true but got:", decision, ok)
 	}
 
-	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/system/str"}); err != nil {
-		t.Fatal(err)
-	} else if decision, ok := result.Result.(string); !ok || decision != "foo" {
-		t.Fatal(`expected "foo" but got:`, decision)
+	expectedProvenance := types.ProvenanceV1{
+		Version:   version.Version,
+		Vcs:       version.Vcs,
+		Timestamp: version.Timestamp,
+		Hostname:  version.Hostname,
+		Bundles: map[string]types.ProvenanceBundleV1{
+			"test": {
+				Revision: "v1.0.0",
+			},
+		},
 	}
 
-	exp := map[string]interface{}{"foo": "bar"}
-
-	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/system/loopback", Input: map[string]interface{}{"foo": "bar"}}); err != nil {
-		t.Fatal(err)
-	} else if !reflect.DeepEqual(result.Result, exp) {
-		t.Fatalf("expected %v but got %v", exp, result.Result)
+	if !reflect.DeepEqual(result.Provenance, expectedProvenance) {
+		t.Fatalf("expected %v but got %v", expectedProvenance, result.Provenance)
 	}
+
 }
 
 func TestUndefinedError(t *testing.T) {
@@ -149,7 +1150,7 @@ func TestUndefinedError(t *testing.T) {
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -160,10 +1161,10 @@ func TestUndefinedError(t *testing.T) {
 				"resource": "/bundles/bundle.tar.gz"
 			}
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -188,13 +1189,17 @@ func TestDecisionLogging(t *testing.T) {
 
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
-			"main.rego": "package system\nmain = time.now_ns()",
+			"main.rego": `
+package system
+
+main = time.now_ns()
+`,
 		}),
 	)
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -208,11 +1213,11 @@ func TestDecisionLogging(t *testing.T) {
 		"decision_logs": {
 			"console": true
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	testLogger := loggingtest.New()
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config:        bytes.NewReader(config),
+		Config:        strings.NewReader(config),
 		ConsoleLogger: testLogger,
 	})
 	if err != nil {
@@ -244,19 +1249,23 @@ func TestDecisionLogging(t *testing.T) {
 
 }
 
-func TestQueryCaching(t *testing.T) {
+func TestDecisionLoggingWithNDBCache(t *testing.T) {
 
 	ctx := context.Background()
 
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
-			"main.rego": "package system\nmain = 7",
+			"main.rego": `
+package system
+
+main = time.now_ns()
+`,
 		}),
 	)
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -268,13 +1277,14 @@ func TestQueryCaching(t *testing.T) {
 			}
 		},
 		"decision_logs": {
-			"console": true
+			"console": true,
+			"nd_builtin_cache": true
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	testLogger := loggingtest.New()
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config:        bytes.NewReader(config),
+		Config:        strings.NewReader(config),
 		ConsoleLogger: testLogger,
 	})
 	if err != nil {
@@ -283,27 +1293,98 @@ func TestQueryCaching(t *testing.T) {
 
 	defer opa.Stop(ctx)
 
-	// Execute two queries.
-	if _, err := opa.Decision(ctx, sdk.DecisionOptions{}); err != nil {
+	// Build ND builtins cache, and populate with an unused builtin.
+	ndbc := builtins.NDBCache{}
+	ndbc.Put("rand.intn", ast.NewArray(), ast.NewObject([2]*ast.Term{ast.StringTerm("z"), ast.IntNumberTerm(7)}))
+
+	// Verify that timestamp matches time.now_ns() value.
+	if _, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Now:      time.Unix(0, 1619868194450288000).UTC(),
+		NDBCache: ndbc,
+	}); err != nil {
 		t.Fatal(err)
 	}
 
-	if _, err := opa.Decision(ctx, sdk.DecisionOptions{}); err != nil {
+	entries := testLogger.Entries()
+
+	// Check the contents of the ND builtins cache.
+	if cache, ok := entries[0].Fields["nd_builtin_cache"]; ok {
+		// Ensure the original cache entry for rand.intn is still there.
+		if _, ok := cache.(map[string]interface{})["rand.intn"]; !ok {
+			t.Fatalf("ND builtins cache was not preserved during evaluation.")
+		}
+		// Ensure time.now_ns entry was picked up correctly.
+		if _, ok := cache.(map[string]interface{})["time.now_ns"]; !ok {
+			t.Fatalf("ND builtins cache did not observe time.now_ns call during evaluation.")
+		}
+	} else {
+		t.Fatalf("ND builtins cache missing.")
+	}
+
+}
+
+func TestQueryCaching(t *testing.T) {
+
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+main = 7
+`,
+		}),
+	)
+
+	defer server.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/bundle.tar.gz"
+			}
+		},
+		"decision_logs": {
+			"console": true
+		}
+	}`, server.URL())
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Expect two log entries, one with timers for query preparation and the other without.
-	entries := testLogger.Entries()
+	defer opa.Stop(ctx)
 
-	if len(entries) != 2 {
-		t.Fatal("expected two log entries but got:", entries)
+	// Execute two queries with metrics
+	m1 := metrics.New()
+	if _, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Metrics: m1,
+	}); err != nil {
+		t.Fatal(err)
 	}
 
-	_, ok1 := entries[0].Fields["metrics"].(map[string]interface{})["timer_rego_query_parse_ns"]
-	_, ok2 := entries[1].Fields["metrics"].(map[string]interface{})["timer_rego_query_parse_ns"]
+	m2 := metrics.New()
+	if _, err := opa.Decision(ctx, sdk.DecisionOptions{
+		Metrics: m2,
+	}); err != nil {
+		t.Fatal(err)
+	}
 
-	if !ok1 || ok2 {
-		t.Fatal("expected first query to require preparation but not the second")
+	// Expect only the metrics from the first query to contain preparation metrics
+	if _, ok := m1.All()["timer_rego_query_parse_ns"]; !ok {
+		t.Fatal("first query should have preparation metrics")
+	}
+	if _, ok := m2.All()["timer_rego_query_parse_ns"]; ok {
+		t.Fatal("second query should not have preparation metrics")
 	}
 
 }
@@ -315,23 +1396,23 @@ func TestDiscovery(t *testing.T) {
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/discovery.tar.gz", map[string]string{
 			"bundles.rego": `
-				package bundles
+package bundles
 
-				test := {"resource": "/bundles/bundle.tar.gz"}
+test := {"resource": "/bundles/bundle.tar.gz"}
 			`,
 		}),
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
 			"main.rego": `
-				package system
+package system
 
-				main = 7
+main = 7
 			`,
 		}),
 	)
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -340,10 +1421,10 @@ func TestDiscovery(t *testing.T) {
 		"discovery": {
 			"resource": "/bundles/discovery.tar.gz"
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -371,13 +1452,17 @@ func TestAsync(t *testing.T) {
 	server := sdktest.MustNewServer(
 		sdktest.Ready(callerReadyCh),
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
-			"main.rego": "package system\nmain = 7",
+			"main.rego": `
+package system
+
+main = 7
+`,
 		}),
 	)
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -388,10 +1473,10 @@ func TestAsync(t *testing.T) {
 				"resource": "/bundles/bundle.tar.gz"
 			}
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 		Ready:  readyCh,
 	})
 	if err != nil {
@@ -422,7 +1507,7 @@ func TestCancelStartup(t *testing.T) {
 	server := sdktest.MustNewServer()
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -433,39 +1518,75 @@ func TestCancelStartup(t *testing.T) {
 				"resource": "/bundles/doesnotexist.tar.gz"
 			}
 		}
-		}`, server.URL()))
+		}`, server.URL())
 
 	// Server will return 404 responses because bundle does not exist. OPA should timeout.
 	ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond*100)
 	defer cancel()
 
 	_, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 	})
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Fatalf("expected deadline exceeded error but got %v", err)
 	}
 }
 
+// TestStopWithDeadline asserts that a graceful shutdown of the SDK is possible.
+func TestStopWithDeadline(t *testing.T) {
+
+	ctx := context.Background()
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(`{
+			"plugins": {
+				"test_plugin": {}
+			}
+		}`),
+		Plugins: map[string]plugins.Factory{
+			"test_plugin": factory{shutdown: time.Second},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	const timeout = 20 * time.Millisecond
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	before := time.Now()
+	opa.Stop(ctx) // 1s timeout is ignored
+
+	dur := time.Since(before)
+	diff := dur - timeout
+	maxDelta := 500 * time.Millisecond
+	if diff > maxDelta || diff < -maxDelta {
+		t.Errorf("expected shutdown to have %v grace period, measured shutdown in %v (max delta %v)", timeout, dur, maxDelta)
+	}
+}
+
 func TestConfigAsYAML(t *testing.T) {
 
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
-			"main.rego": "package system\nmain = 7",
+			"main.rego": `
+package system
+
+main = 7
+`,
 		}),
 	)
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`services:
+	config := fmt.Sprintf(`services:
   test:
     url: %q
 bundles:
   test:
-    resource: "/bundles/bundle.tar.gz"`, server.URL()))
+    resource: "/bundles/bundle.tar.gz"`, server.URL())
 
 	ctx := context.Background()
 	_, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -477,16 +1598,24 @@ func TestConfigure(t *testing.T) {
 
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/bundle1.tar.gz", map[string]string{
-			"main.rego": "package system\nmain = 7",
+			"main.rego": `
+package system
+
+main = 7
+`,
 		}),
 		sdktest.MockBundle("/bundles/bundle2.tar.gz", map[string]string{
-			"main.rego": "package system\nmain = 8",
+			"main.rego": `
+package system
+
+main = 8
+`,
 		}),
 	)
 	defer server.Stop()
 
 	// Startup new OPA with first config.
-	config1 := []byte(fmt.Sprintf(`{
+	config1 := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -497,11 +1626,11 @@ func TestConfigure(t *testing.T) {
 				"resource": "/bundles/bundle1.tar.gz"
 			}
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	ctx := context.Background()
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config1),
+		Config: strings.NewReader(config1),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -518,7 +1647,7 @@ func TestConfigure(t *testing.T) {
 	}
 
 	// Reconfigure with new config to make sure update is picked up.
-	config2 := []byte(fmt.Sprintf(`{
+	config2 := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -529,10 +1658,10 @@ func TestConfigure(t *testing.T) {
 				"resource": "/bundles/bundle2.tar.gz"
 			}
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	err = opa.Configure(ctx, sdk.ConfigOptions{
-		Config: bytes.NewReader(config2),
+		Config: strings.NewReader(config2),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -549,7 +1678,7 @@ func TestConfigure(t *testing.T) {
 	// Reconfigure w/ same config to verify that readiness channel is closed.
 	ch := make(chan struct{})
 	err = opa.Configure(ctx, sdk.ConfigOptions{
-		Config: bytes.NewReader(config2),
+		Config: strings.NewReader(config2),
 		Ready:  ch,
 	})
 	if err != nil {
@@ -565,15 +1694,16 @@ func TestOpaVersion(t *testing.T) {
 	server := sdktest.MustNewServer(
 		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
 			"main.rego": `
-				package system
-				opa_version := opa.runtime().version
+package system
+
+opa_version := opa.runtime().version
 			`,
 		}),
 	)
 
 	defer server.Stop()
 
-	config := []byte(fmt.Sprintf(`{
+	config := fmt.Sprintf(`{
 		"services": {
 			"test": {
 				"url": %q
@@ -584,10 +1714,10 @@ func TestOpaVersion(t *testing.T) {
 				"resource": "/bundles/bundle.tar.gz"
 			}
 		}
-	}`, server.URL()))
+	}`, server.URL())
 
 	opa, err := sdk.New(ctx, sdk.Options{
-		Config: bytes.NewReader(config),
+		Config: strings.NewReader(config),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -603,3 +1733,121 @@ func TestOpaVersion(t *testing.T) {
 		t.Fatalf("expected %v but got %v", exp, result.Result)
 	}
 }
+
+func TestOpaRuntimeConfig(t *testing.T) {
+	ctx := context.Background()
+
+	server := sdktest.MustNewServer(
+		sdktest.MockBundle("/bundles/bundle.tar.gz", map[string]string{
+			"main.rego": `
+package system
+
+rt := opa.runtime()
+
+result := {
+	"service_url": rt.config.services.test.url,
+	"bundle_resource": rt.config.bundles.test.resource,
+	"test_label": rt.config.labels.test
+}
+			`,
+		}),
+	)
+
+	defer server.Stop()
+
+	testBundleResource := "/bundles/bundle.tar.gz"
+	testLabel := "a label"
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": %q
+			}
+		},
+		"labels": {
+			"test": %q
+		}
+	}`, server.URL(), testBundleResource, testLabel)
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	exp := map[string]interface{}{
+		"service_url":     server.URL(),
+		"bundle_resource": testBundleResource,
+		"test_label":      testLabel,
+	}
+
+	if result, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/system/result"}); err != nil {
+		t.Fatal(err)
+	} else if !reflect.DeepEqual(result.Result, exp) {
+		t.Fatalf("expected %v but got %v", exp, result.Result)
+	}
+}
+
+func TestPrintStatements(t *testing.T) {
+
+	ctx := context.Background()
+
+	s := sdktest.MustNewServer(sdktest.MockBundle("/bundles/b.tar.gz", map[string]string{
+		"x.rego": `
+package foo
+
+p { print("XXX") }
+`,
+	}))
+
+	defer s.Stop()
+
+	config := fmt.Sprintf(`{
+		"services": {
+			"test": {
+				"url": %q
+			}
+		},
+		"bundles": {
+			"test": {
+				"resource": "/bundles/b.tar.gz"
+			}
+		}
+	}`, s.URL())
+
+	logger := loggingtest.New()
+	logger.SetLevel(logging.Info)
+
+	opa, err := sdk.New(ctx, sdk.Options{
+		Logger: logger,
+		Config: strings.NewReader(config),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	defer opa.Stop(ctx)
+
+	if _, err := opa.Decision(ctx, sdk.DecisionOptions{Path: "/foo/p"}); err != nil {
+		t.Fatal(err)
+	}
+
+	entries := logger.Entries()
+	if len(entries) == 0 {
+		t.Fatal("expected logs")
+	}
+
+	e := entries[len(entries)-1]
+
+	if e.Message != "XXX" || e.Fields["line"].(string) != "/x.rego:4" {
+		t.Fatal("expected print output but got:", e)
+	}
+}
diff --git a/sdk/options.go b/sdk/options.go
index f768fb1f0a..51e9a5a25b 100644
--- a/sdk/options.go
+++ b/sdk/options.go
@@ -6,7 +6,6 @@ package sdk
 
 import (
 	"io"
-	"io/ioutil"
 
 	"github.com/sirupsen/logrus"
 
@@ -40,6 +39,11 @@ type Options struct {
 	// registered with the OPA SDK instance.
 	Plugins map[string]plugins.Factory
 
+	// ID provides an option to set a static ID for the OPA system, avoiding
+	// the need to generate a random one at initialization. Setting a static ID
+	// is recommended, as it makes it easier to track the system over time.
+	ID string
+
 	config []byte
 	block  bool
 }
@@ -61,12 +65,16 @@ func (o *Options) init() error {
 		o.ConsoleLogger = l
 	}
 
-	bs, err := ioutil.ReadAll(o.Config)
-	if err != nil {
-		return err
+	if o.Config == nil {
+		o.config = []byte("{}")
+	} else {
+		bs, err := io.ReadAll(o.Config)
+		if err != nil {
+			return err
+		}
+		o.config = bs
 	}
 
-	o.config = bs
 	return nil
 }
 
@@ -95,7 +103,7 @@ func (o *ConfigOptions) init() error {
 		o.block = true
 	}
 
-	bs, err := ioutil.ReadAll(o.Config)
+	bs, err := io.ReadAll(o.Config)
 	if err != nil {
 		return err
 	}
diff --git a/sdk/test/test.go b/sdk/test/test.go
index a4ca126d7f..186446aeb4 100644
--- a/sdk/test/test.go
+++ b/sdk/test/test.go
@@ -2,26 +2,50 @@ package test
 
 import (
 	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/compile"
+
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 // MockBundle sets a bundle named file on the test server containing the given
 // policies.
 func MockBundle(file string, policies map[string]string) func(*Server) error {
 	return func(s *Server) error {
+		if !strings.HasPrefix(file, "/bundles/") {
+			return fmt.Errorf("mock bundle filename must be prefixed with '/bundle/ but got %q", file)
+		}
 		s.bundles[file] = policies
 		return nil
 	}
 }
 
+// MockOCIBundle prepares the server to allow serving "/v2" OCI responses from the supplied policies
+// Ref parameter must be in the form of <registry>/<org>/<repo>:<tag> that will be used in detecting future calls
+func MockOCIBundle(ref string, policies map[string]string) func(*Server) error {
+	return func(s *Server) error {
+		if !strings.Contains(ref, "/") {
+			return fmt.Errorf("mock oci bundle ref must contain 'org/repo' but got %q", ref)
+		}
+		return s.buildBundles(ref, policies)
+	}
+}
+
 // Ready provides a channel that the server will use to gate readiness. The
 // caller can provide this channel to prevent the server from becoming ready.
 // The server will response with HTTP 500 responses until ready. The caller
@@ -83,6 +107,112 @@ func (s *Server) URL() string {
 	return s.server.URL
 }
 
+// Builds the tarball from the supplied policies and prepares the layers in a temporary directory
+func (s *Server) buildBundles(ref string, policies map[string]string) error {
+	// Prepare the modules to include in the bundle. Sort them so bundles are deterministic.
+	modules := make([]bundle.ModuleFile, 0, len(policies))
+	for url, str := range policies {
+		module, err := ast.ParseModule(url, str)
+		if err != nil {
+			return fmt.Errorf("failed to parse module: %v", err)
+		}
+		modules = append(modules, bundle.ModuleFile{
+			URL:    url,
+			Parsed: module,
+		})
+	}
+	sort.Slice(modules, func(i, j int) bool {
+		return modules[i].URL < modules[j].URL
+	})
+
+	// Compile the bundle out into a buffer
+	buf := bytes.NewBuffer(nil)
+	err := compile.New().WithOutput(buf).WithBundle(&bundle.Bundle{
+		Data:    map[string]interface{}{},
+		Modules: modules,
+	}).Build(context.Background())
+	if err != nil {
+		return err
+	}
+	directoryName, err := os.MkdirTemp("", "oci-test-temp")
+	fmt.Println("Testing OCI temporary directory:", directoryName)
+	if err != nil {
+		return err
+	}
+	// Write buf tarball to layer
+	tarLayer := filepath.Join(directoryName, "tar.layer")
+	err = os.WriteFile(tarLayer, buf.Bytes(), 0655)
+	if err != nil {
+		return err
+	}
+	// Write empty config layer
+	configLayer := filepath.Join(directoryName, "config.layer")
+	err = os.WriteFile(configLayer, []byte("{}"), 0655)
+	if err != nil {
+		return err
+	}
+	// Calculate SHA and size and prepare manifest layer
+	tarSHA, err := getFileSHA(tarLayer)
+	if err != nil {
+		return err
+	}
+
+	configSHA, err := getFileSHA(configLayer)
+	if err != nil {
+		return err
+	}
+
+	var manifest ocispec.Manifest
+	manifest.SchemaVersion = 2
+	manifest.Config = ocispec.Descriptor{
+		MediaType: ocispec.MediaTypeImageConfig,
+		Digest:    digest.Digest(fmt.Sprintf("sha256:%x", configSHA)),
+		Size:      int64(2), // config size is set to 2 as an empty config is used
+	}
+	manifest.Layers = []ocispec.Descriptor{
+		{
+			MediaType: ocispec.MediaTypeImageLayerGzip,
+			Digest:    digest.Digest(fmt.Sprintf("sha256:%x", tarSHA)),
+			Size:      int64(buf.Len()),
+			Annotations: map[string]string{
+				ocispec.AnnotationTitle:   ref,
+				ocispec.AnnotationCreated: time.Now().Format(time.RFC3339),
+			},
+		},
+	}
+
+	manifestData, err := json.Marshal(manifest)
+	if err != nil {
+		return err
+	}
+	manifestLayer := filepath.Join(directoryName, "manifest.layer")
+	err = os.WriteFile(manifestLayer, manifestData, 0655)
+	if err != nil {
+		return err
+	}
+
+	// Set ref layer paths to server bundles
+	s.bundles[ref] = map[string]string{
+		"manifest": manifestLayer,
+		"config":   configLayer,
+		"tar":      tarLayer,
+	}
+	return nil
+}
+
+func getFileSHA(filePath string) ([]byte, error) {
+	f, err := os.Open(filePath)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	hash := sha256.New()
+	if _, err := io.Copy(hash, f); err != nil {
+		return nil, err
+	}
+	return hash.Sum(nil), nil
+}
+
 func (s *Server) handle(w http.ResponseWriter, r *http.Request) {
 
 	select {
@@ -92,6 +222,11 @@ func (s *Server) handle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if strings.HasPrefix(r.URL.Path, "/v2") {
+		s.handleOCIBundles(w, r)
+		return
+	}
+
 	if strings.HasPrefix(r.URL.Path, "/bundles") {
 		s.handleBundles(w, r)
 		return
@@ -100,6 +235,124 @@ func (s *Server) handle(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusInternalServerError)
 }
 
+func (s *Server) handleOCIBundles(w http.ResponseWriter, r *http.Request) {
+	ref := ""  // key used to detect layers from s.bundles
+	tag := ""  // image tag used in request path verification
+	repo := "" // image repo used in request path verification
+	var buf bytes.Buffer
+	//get first key that matches request url pattern
+	for key := range s.bundles {
+		// extract tag
+		parsedRef := strings.Split(key, ":")
+		checkRef := strings.Split(parsedRef[0], "/")
+		// check if request path contains org and repository
+		if strings.Contains(r.URL.Path, checkRef[1]) && strings.Contains(r.URL.Path, checkRef[2]) {
+			ref = key
+			tag = parsedRef[1]
+			repo = checkRef[1] + "/" + checkRef[2]
+			break
+		}
+	}
+	if ref == "" || tag == "" || repo == "" {
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+	layers := s.bundles[ref]
+	fi, err := os.Stat(layers["manifest"])
+	if err != nil {
+		w.WriteHeader(http.StatusFailedDependency)
+		return
+	}
+	manifestSize := fi.Size()
+	manifestSHA, err := getFileSHA(layers["manifest"])
+	if err != nil {
+		w.WriteHeader(http.StatusFailedDependency)
+		return
+	}
+	fi, err = os.Stat(layers["config"])
+	if err != nil {
+		w.WriteHeader(http.StatusFailedDependency)
+		return
+	}
+	configSize := fi.Size()
+	configSHA, err := getFileSHA(layers["config"])
+	if err != nil {
+		w.WriteHeader(http.StatusFailedDependency)
+		return
+	}
+	fi, err = os.Stat(layers["tar"])
+	if err != nil {
+		w.WriteHeader(http.StatusFailedDependency)
+		return
+	}
+	// get the size
+	tarSize := fi.Size()
+	tarSHA, err := getFileSHA(layers["tar"])
+	if err != nil {
+		w.WriteHeader(http.StatusFailedDependency)
+		return
+	}
+
+	if r.URL.Path == fmt.Sprintf("/v2/%s/manifests/%s", repo, tag) {
+		w.Header().Add("Content-Length", fmt.Sprintf("%d", manifestSize))
+		w.Header().Add("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+		w.Header().Add("Docker-Content-Digest", fmt.Sprintf("sha256:%x", manifestSHA))
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+	if r.URL.Path == fmt.Sprintf("/v2/%s/manifests/sha256:%x", repo, manifestSHA) {
+		w.Header().Add("Content-Length", fmt.Sprintf("%d", manifestSize))
+		w.Header().Add("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+		w.Header().Add("Docker-Content-Digest", fmt.Sprintf("sha256:%x", manifestSHA))
+		w.WriteHeader(200)
+		bs, err := os.ReadFile(layers["manifest"])
+		if err != nil {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		buf.WriteString(string(bs))
+		_, err = w.Write(buf.Bytes())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+		return
+	}
+	if r.URL.Path == fmt.Sprintf("/v2/%s/blobs/sha256:%x", repo, configSHA) {
+		w.Header().Add("Content-Length", fmt.Sprintf("%d", configSize))
+		w.Header().Add("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+		w.Header().Add("Docker-Content-Digest", fmt.Sprintf("sha256:%x", configSHA))
+		w.WriteHeader(200)
+		bs, err := os.ReadFile(layers["config"])
+		if err != nil {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		buf.WriteString(string(bs))
+		_, err = w.Write(buf.Bytes())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+		return
+	}
+	if r.URL.Path == fmt.Sprintf("/v2/%s/blobs/sha256:%x", repo, tarSHA) {
+		w.Header().Add("Content-Length", fmt.Sprintf("%d", tarSize))
+		w.Header().Add("Content-Type", "application/vnd.oci.image.manifest.v1+json")
+		w.Header().Add("Docker-Content-Digest", fmt.Sprintf("sha256:%x", tarSHA))
+		w.WriteHeader(200)
+		bs, err := os.ReadFile(layers["tar"])
+		if err != nil {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		buf.WriteString(string(bs))
+		_, err = w.Write(buf.Bytes())
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+		return
+	}
+}
+
 func (s *Server) handleBundles(w http.ResponseWriter, r *http.Request) {
 
 	// Return 404 if bundle path does not exist.
@@ -109,19 +362,58 @@ func (s *Server) handleBundles(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Prepare a mapping to store bundle data
+	data := map[string]interface{}{}
+
+	// Prepare a manifest for use if a .manifest file exists.
+	var manifest bundle.Manifest
+
 	// Prepare the modules to include in the bundle. Sort them so bundles are deterministic.
-	var modules []bundle.ModuleFile
+	modules := make([]bundle.ModuleFile, 0, len(b))
 	for url, str := range b {
-		module, err := ast.ParseModule(url, str)
-		if err != nil {
+		switch {
+		case url == ".manifest":
+			err := json.Unmarshal([]byte(str), &manifest)
+			if err != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, "error unmarshaling .manifest file: %v", err)
+				return
+			}
+		case strings.HasSuffix(url, ".rego"):
+			module, err := ast.ParseModule(url, str)
+			if err != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = w.Write([]byte(err.Error()))
+				return
+			}
+			modules = append(modules, bundle.ModuleFile{
+				URL:    url,
+				Parsed: module,
+			})
+		case strings.HasSuffix(url, ".json"):
+			if strings.Contains(url, "/") {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, "nested data documents are not implemented in the dummy server: %s", url)
+				return
+			}
+
+			var d map[string]interface{}
+
+			err := json.Unmarshal([]byte(str), &d)
+			if err != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, "error unmarshaling json file: %v", err)
+				return
+			}
+
+			for k, v := range d {
+				data[k] = v
+			}
+		default:
 			w.WriteHeader(http.StatusInternalServerError)
-			_, _ = w.Write([]byte(err.Error()))
+			fmt.Fprintf(w, "unexpected file in dummy bundle: %s", url)
 			return
 		}
-		modules = append(modules, bundle.ModuleFile{
-			URL:    url,
-			Parsed: module,
-		})
 	}
 	sort.Slice(modules, func(i, j int) bool {
 		return modules[i].URL < modules[j].URL
@@ -130,8 +422,9 @@ func (s *Server) handleBundles(w http.ResponseWriter, r *http.Request) {
 	// Compile the bundle out into a buffer
 	buf := bytes.NewBuffer(nil)
 	err := compile.New().WithOutput(buf).WithBundle(&bundle.Bundle{
-		Data:    map[string]interface{}{},
-		Modules: modules,
+		Data:     data,
+		Modules:  modules,
+		Manifest: manifest,
 	}).Build(r.Context())
 	if err != nil {
 		w.WriteHeader(http.StatusInternalServerError)
diff --git a/server/authorizer/authorizer.go b/server/authorizer/authorizer.go
index dd7344d435..225870a9ff 100644
--- a/server/authorizer/authorizer.go
+++ b/server/authorizer/authorizer.go
@@ -7,7 +7,7 @@ package authorizer
 
 import (
 	"context"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"strings"
@@ -18,6 +18,7 @@ import (
 	"github.com/open-policy-agent/opa/server/types"
 	"github.com/open-policy-agent/opa/server/writer"
 	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -31,6 +32,7 @@ type Basic struct {
 	decision              func() ast.Ref
 	printHook             print.Hook
 	enablePrintStatements bool
+	interQueryCache       cache.InterQueryCache
 }
 
 // Runtime returns an argument that sets the runtime on the authorizer.
@@ -65,6 +67,13 @@ func EnablePrintStatements(yes bool) func(r *Basic) {
 	}
 }
 
+// InterQueryCache enables the inter-query cache on the authorizer
+func InterQueryCache(interQueryCache cache.InterQueryCache) func(*Basic) {
+	return func(b *Basic) {
+		b.interQueryCache = interQueryCache
+	}
+}
+
 // NewBasic returns a new Basic object.
 func NewBasic(inner http.Handler, compiler func() *ast.Compiler, store storage.Store, opts ...func(*Basic)) http.Handler {
 	b := &Basic{
@@ -98,6 +107,7 @@ func (h *Basic) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		rego.Runtime(h.runtime),
 		rego.EnablePrintStatements(h.enablePrintStatements),
 		rego.PrintHook(h.printHook),
+		rego.InterQueryBuiltinCache(h.interQueryCache),
 	)
 
 	rs, err := rego.Eval(r.Context())
@@ -188,6 +198,11 @@ func makeInput(r *http.Request) (*http.Request, interface{}, error) {
 		input["identity"] = identity
 	}
 
+	clientCertificates, ok := identifier.ClientCertificates(r)
+	if ok {
+		input["client_certificates"] = clientCertificates
+	}
+
 	return r, input, nil
 }
 
@@ -219,7 +234,7 @@ func expectYAML(r *http.Request) bool {
 
 func readBody(r *http.Request) ([]byte, error) {
 
-	bs, err := ioutil.ReadAll(r.Body)
+	bs, err := io.ReadAll(r.Body)
 
 	if err != nil {
 		return nil, err
diff --git a/server/authorizer/authorizer_test.go b/server/authorizer/authorizer_test.go
index 6803a3c996..e30833fe52 100644
--- a/server/authorizer/authorizer_test.go
+++ b/server/authorizer/authorizer_test.go
@@ -7,6 +7,7 @@ package authorizer
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
@@ -17,6 +18,7 @@ import (
 	"github.com/open-policy-agent/opa/server/identifier"
 	"github.com/open-policy-agent/opa/server/types"
 	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -260,7 +262,7 @@ func TestBasicEscapeError(t *testing.T) {
 	recorder := httptest.NewRecorder()
 	req, err := http.NewRequest(http.MethodGet, "http://localhost:8181", nil)
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	req.URL.Path = `/invalid/path/foo%LALALA`
@@ -293,7 +295,7 @@ func TestMakeInput(t *testing.T) {
 	path := "/foo/bar?pretty=true&explain=\"full\""
 	req, err := http.NewRequest(http.MethodGet, "http://localhost:8181"+path, nil)
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	req.Header.Add("x-custom", "foo")
@@ -312,7 +314,7 @@ func TestMakeInput(t *testing.T) {
 
 	_, result, err := makeInput(req)
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 
 	expectedResult := util.MustUnmarshalJSON([]byte(`
@@ -455,6 +457,64 @@ func TestMakeInputWithBody(t *testing.T) {
 
 }
 
+func TestInterQueryCache(t *testing.T) {
+
+	count := 0
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		count++
+	}))
+
+	t.Cleanup(func() {
+		ts.Close()
+	})
+
+	compiler := func() *ast.Compiler {
+		module := fmt.Sprintf(`
+        package system.authz
+
+        allow {
+            http.send({
+                "method": "GET",
+                "url": "%v",
+                "force_cache": true,
+                "force_cache_duration_seconds": 60
+            }).status_code == 200
+        }
+        `, ts.URL)
+		c := ast.NewCompiler()
+		c.Compile(map[string]*ast.Module{
+			"test.rego": ast.MustParseModule(module),
+		})
+		if c.Failed() {
+			t.Fatalf("Unexpected error compiling test module: %v", c.Errors)
+		}
+		return c
+	}
+
+	recorder := httptest.NewRecorder()
+	req, err := http.NewRequest(http.MethodGet, "http://localhost:8181/v1/data", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	config, _ := cache.ParseCachingConfig(nil)
+	interQueryCache := cache.NewInterQueryCache(config)
+
+	basic := NewBasic(&mockHandler{}, compiler, inmem.New(), InterQueryCache(interQueryCache), Decision(func() ast.Ref {
+		return ast.MustParseRef("data.system.authz.allow")
+	}))
+
+	// Execute the policy twice
+	basic.ServeHTTP(recorder, req)
+	basic.ServeHTTP(recorder, req)
+
+	// And make sure the test server was only hit once
+	if count != 1 {
+		t.Error("Expected http.send response to be cached")
+	}
+}
+
 func Equal(a, b []string) bool {
 	if len(a) != len(b) {
 		return false
diff --git a/server/buffer.go b/server/buffer.go
index 363450c79e..634cdd006e 100644
--- a/server/buffer.go
+++ b/server/buffer.go
@@ -15,20 +15,25 @@ import (
 
 // Info contains information describing a policy decision.
 type Info struct {
-	Txn        storage.Transaction
-	Revision   string // Deprecated: Use `Bundles` instead
-	Bundles    map[string]BundleInfo
-	DecisionID string
-	RemoteAddr string
-	Query      string
-	Path       string
-	Timestamp  time.Time
-	Input      *interface{}
-	InputAST   ast.Value
-	Results    *interface{}
-	Error      error
-	Metrics    metrics.Metrics
-	Trace      []*topdown.Event
+	Txn            storage.Transaction
+	Revision       string // Deprecated: Use `Bundles` instead
+	Bundles        map[string]BundleInfo
+	DecisionID     string
+	TraceID        string
+	SpanID         string
+	RemoteAddr     string
+	Query          string
+	Path           string
+	Timestamp      time.Time
+	Input          *interface{}
+	InputAST       ast.Value
+	Results        *interface{}
+	MappedResults  *interface{}
+	NDBuiltinCache *interface{}
+	Error          error
+	Metrics        metrics.Metrics
+	Trace          []*topdown.Event
+	RequestID      uint64
 }
 
 // BundleInfo contains information describing a bundle.
diff --git a/server/features.go b/server/features.go
index 37de967a71..ea846a427a 100644
--- a/server/features.go
+++ b/server/features.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build opa_wasm
 // +build opa_wasm
 
 package server
diff --git a/server/handlers/compress.go b/server/handlers/compress.go
new file mode 100644
index 0000000000..1994269d10
--- /dev/null
+++ b/server/handlers/compress.go
@@ -0,0 +1,194 @@
+package handlers
+
+import (
+	"compress/gzip"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+)
+
+const (
+	acceptEncodingHeader  = "Accept-Encoding"
+	contentEncodingHeader = "Content-Encoding"
+	contentLengthHeader   = "Content-Length"
+	gzipEncodingValue     = "gzip"
+)
+
+// This handler applies only for data and compile endpoints, for selected HTTP methods
+//
+// If the client asked for a gzip response, this handler will buffer the response and
+// wait until it reached a certain threshold. If the threshold is not hit, the uncompressed response is sent
+//
+// If a gzip response is not asked by the client, it'll send the uncompressed response
+//
+// The threshold and the gzip compression level can be modified from server's configuration
+
+func CompressHandler(handler http.Handler, gzipMinLength int, gzipCompressionLevel int) http.Handler {
+	initGzipPool(gzipCompressionLevel)
+
+	return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+		enabledForEndpoint := isDataEndpoint(request) || isCompileEndpoint(request)
+		if !enabledForEndpoint {
+			handler.ServeHTTP(responseWriter, request)
+			return
+		}
+
+		responseWriter.Header().Add("Vary", acceptEncodingHeader)
+
+		if !gzipHeaderDetected(request.Header) {
+			handler.ServeHTTP(responseWriter, request)
+			return
+		}
+
+		crw := &compressResponseWriter{
+			ResponseWriter: responseWriter,
+			headerWritten:  false,
+			minlength:      gzipMinLength,
+		}
+		defer crw.Close()
+		handler.ServeHTTP(crw, request)
+	})
+}
+
+type compressResponseWriter struct {
+	gzipWriter *gzip.Writer
+	http.ResponseWriter
+	buffer        []byte
+	statusCode    int
+	headerWritten bool
+	minlength     int
+}
+
+var gzipPool *sync.Pool
+
+func initGzipPool(compressionLevel int) {
+	if gzipPool == nil {
+		gzipPool = &sync.Pool{
+			New: func() interface{} {
+				writer, _ := gzip.NewWriterLevel(io.Discard, compressionLevel)
+				return writer
+			},
+		}
+	}
+}
+
+func (w *compressResponseWriter) WriteHeader(statusCode int) {
+	// save the status code for later use
+	w.statusCode = statusCode
+}
+
+func (w *compressResponseWriter) Write(bytes []byte) (int, error) {
+	if w.isGzipInitialized() {
+		return w.gzipWriter.Write(bytes)
+	}
+
+	// accumulate the buffer
+	w.buffer = append(w.buffer, bytes...)
+
+	// if the buffer is above threshold, use compression
+	if len(w.buffer) >= w.minlength {
+		err := w.doCompressedResponse()
+		if err != nil {
+			return 0, err
+		}
+		return len(bytes), nil
+	}
+
+	// wait for more data
+	return len(bytes), nil
+}
+
+func (w *compressResponseWriter) Flush() {
+	if w.isGzipInitialized() {
+		w.gzipWriter.Flush()
+		flusher, canFlush := w.ResponseWriter.(http.Flusher)
+		if canFlush {
+			flusher.Flush()
+		}
+	}
+}
+
+func (w *compressResponseWriter) Close() error {
+	if !w.isGzipInitialized() {
+		// gzip didn't handle the response, send it plain
+		err := w.doUncompressedResponse()
+		if err != nil {
+			err = fmt.Errorf("error writing uncompressed data: %v", err.Error())
+		}
+		return err
+	}
+
+	err := w.gzipWriter.Close()
+	defer gzipPool.Put(w.gzipWriter)
+	w.gzipWriter = nil
+	return err
+}
+
+func (w *compressResponseWriter) doCompressedResponse() error {
+	w.ResponseWriter.Header().Set(contentEncodingHeader, gzipEncodingValue)
+	w.Header().Del(contentLengthHeader)
+	w.writeHeader()
+	// there's nothing to write
+	if w.buffer == nil || len(w.buffer) <= 0 {
+		return nil
+	}
+	gzipWriter := gzipPool.Get().(*gzip.Writer)
+	gzipWriter.Reset(w.ResponseWriter)
+	w.gzipWriter = gzipWriter
+	_, err := w.gzipWriter.Write(w.buffer)
+	return err
+}
+
+func (w *compressResponseWriter) doUncompressedResponse() error {
+	w.writeHeader()
+	// there's nothing to write
+	if w.buffer == nil {
+		return nil
+	}
+	_, err := w.ResponseWriter.Write(w.buffer)
+	w.buffer = nil
+	return err
+}
+
+func (w *compressResponseWriter) isGzipInitialized() bool {
+	return w.gzipWriter != nil
+}
+
+func (w *compressResponseWriter) writeHeader() {
+	if !w.headerWritten && w.statusCode != 0 {
+		w.ResponseWriter.WriteHeader(w.statusCode)
+		w.headerWritten = true
+	}
+}
+
+func isDataEndpoint(req *http.Request) bool {
+	isPostOrGetMethod := isPostMethod(req) || isGetMethod(req)
+	isV1rV0 := strings.HasPrefix(req.URL.Path, "/v1/data") || strings.HasPrefix(req.URL.Path, "/v0/data")
+	return isPostOrGetMethod && isV1rV0
+}
+
+func isCompileEndpoint(req *http.Request) bool {
+	return isPostMethod(req) && strings.HasPrefix(req.URL.Path, "/v1/compile")
+}
+
+func isPostMethod(req *http.Request) bool {
+	return req.Method == "POST"
+}
+
+func isGetMethod(req *http.Request) bool {
+	return req.Method == "GET"
+}
+
+func gzipHeaderDetected(header http.Header) bool {
+	a := header.Get("Accept-Encoding")
+	parts := strings.Split(a, ",")
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == gzipEncodingValue || strings.HasPrefix(part, gzipEncodingValue+";") {
+			return true
+		}
+	}
+	return false
+}
diff --git a/server/handlers/compress_test.go b/server/handlers/compress_test.go
new file mode 100644
index 0000000000..1da6649726
--- /dev/null
+++ b/server/handlers/compress_test.go
@@ -0,0 +1,182 @@
+package handlers
+
+import (
+	"bytes"
+	"compress/gzip"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+const (
+	gzipEncoding = "gzip"
+	requestBody  = "Hello World!\n"
+)
+
+var defaultCompressionLevel = gzip.BestCompression
+
+type compressHandlerTestScenario struct {
+	path                       string
+	method                     string
+	acceptEncoding             string
+	gzipMinSize                int
+	expectedCompressedResponse bool
+}
+
+func executeRequest(w *httptest.ResponseRecorder, testScenario compressHandlerTestScenario) {
+	CompressHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, err := io.WriteString(w, requestBody)
+		if err != nil {
+			log.Fatalf("Error writing the request body: %v", err)
+		}
+	}), testScenario.gzipMinSize, defaultCompressionLevel).ServeHTTP(w, &http.Request{
+		URL:    &url.URL{Path: testScenario.path},
+		Method: testScenario.method,
+		Header: http.Header{
+			"Accept-Encoding": []string{testScenario.acceptEncoding},
+		},
+	})
+}
+
+func TestCompressHandlerWithGzipOnInScopeEndpoints(t *testing.T) {
+	tests := map[string]compressHandlerTestScenario{
+		"v0PostDataCompressed": {
+			path:                       "/v0/data",
+			method:                     "POST",
+			acceptEncoding:             gzipEncoding,
+			gzipMinSize:                1,
+			expectedCompressedResponse: true,
+		},
+		"v1PostDataCompressed": {
+			path:                       "/v1/data",
+			method:                     "POST",
+			acceptEncoding:             gzipEncoding,
+			gzipMinSize:                1,
+			expectedCompressedResponse: true,
+		},
+		"v1PostCompileCompressed": {
+			path:                       "/v1/compile",
+			method:                     "POST",
+			acceptEncoding:             gzipEncoding,
+			gzipMinSize:                1,
+			expectedCompressedResponse: true,
+		},
+		"v0PostDataUncompressed": {
+			path:                       "/v0/data",
+			method:                     "POST",
+			acceptEncoding:             gzipEncoding,
+			gzipMinSize:                1024,
+			expectedCompressedResponse: false,
+		},
+		"v1PostDataUncompressed": {
+			path:                       "/v1/data",
+			method:                     "POST",
+			acceptEncoding:             gzipEncoding,
+			gzipMinSize:                1024,
+			expectedCompressedResponse: false,
+		},
+		"v1PostCompileUncompressed": {
+			path:                       "/v1/compile",
+			method:                     "POST",
+			acceptEncoding:             gzipEncoding,
+			gzipMinSize:                1024,
+			expectedCompressedResponse: false,
+		},
+		"v1PostCompileAcceptEncodingAll": {
+			path:                       "/v1/compile",
+			method:                     "POST",
+			acceptEncoding:             "*/*",
+			gzipMinSize:                1024,
+			expectedCompressedResponse: false,
+		},
+	}
+	for name, ts := range tests {
+		w := httptest.NewRecorder()
+		executeRequest(w, ts)
+		if w.Result().Header.Get("Vary") != "Accept-Encoding" {
+			t.Error("missing the Vary header")
+		}
+		contentEncodingValue := w.Result().Header.Get("Content-Encoding")
+		if ts.expectedCompressedResponse {
+			if contentEncodingValue != gzipEncoding {
+				t.Errorf("wrong content encoding, got %q want %q", contentEncodingValue, gzipEncoding)
+			}
+			expectedLength := len(zipString(requestBody))
+			receivedLength := w.Body.Len()
+			if receivedLength != expectedLength {
+				t.Errorf("test: %s wrong len, got %d want %d", name, w.Body.Len(), expectedLength)
+			}
+			receivedBody := unzip(w.Body.Bytes())
+			if receivedBody != requestBody {
+				t.Errorf("test: %s wrong body, got %v, want %v", name, receivedBody, requestBody)
+			}
+		} else {
+			if contentEncodingValue == gzipEncoding {
+				t.Errorf("wrong content encoding, got %q want %q", contentEncodingValue, "")
+			}
+			expectedLength := len(requestBody)
+			receivedLength := w.Body.Len()
+			if receivedLength != expectedLength {
+				t.Errorf("test: %s wrong len, got %d want %d", name, w.Body.Len(), expectedLength)
+			}
+			receivedBody := w.Body.String()
+			if receivedBody != requestBody {
+				t.Errorf("test: %s wrong body, got %v, want %v", name, receivedBody, requestBody)
+			}
+		}
+	}
+}
+
+func TestHandlerOnEndpointsWithoutCompression(t *testing.T) {
+	testScenario := compressHandlerTestScenario{
+		path:           "/metrics",
+		method:         "GET",
+		acceptEncoding: gzipEncoding,
+		gzipMinSize:    1,
+	}
+	w := httptest.NewRecorder()
+	executeRequest(w, testScenario)
+	contentEncodingValue := w.Result().Header.Get("Content-Encoding")
+	if contentEncodingValue != "" {
+		t.Errorf("wrong content encoding, got %q want %q", contentEncodingValue, gzipEncoding)
+	}
+
+	expectedLength := len(requestBody)
+	receivedLength := w.Body.Len()
+	if receivedLength != expectedLength {
+		t.Errorf("wrong len, got %d want %d", w.Body.Len(), expectedLength)
+	}
+}
+
+func zipString(input string) []byte {
+	var b bytes.Buffer
+	gz := gzip.NewWriter(&b)
+	if _, err := gz.Write([]byte(input)); err != nil {
+		log.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		log.Fatal(err)
+	}
+	return b.Bytes()
+}
+
+func unzip(body []byte) string {
+	reader := bytes.NewReader(body)
+	gzReader, err := gzip.NewReader(reader)
+	if err != nil {
+		log.Fatalf("Unexpected gzip error: %v", err)
+	}
+	plainOutput, err := io.ReadAll(gzReader)
+	if err != nil {
+		log.Fatalf("Unexpected gzip error: %v", err)
+	}
+	err = gzReader.Close()
+	if err != nil {
+		log.Fatalf("Unexpected gzip close err: %v", err)
+	}
+	return string(plainOutput)
+}
diff --git a/server/identifier/certs.go b/server/identifier/certs.go
new file mode 100644
index 0000000000..17ad1ea80c
--- /dev/null
+++ b/server/identifier/certs.go
@@ -0,0 +1,25 @@
+package identifier
+
+import (
+	"context"
+	"crypto/x509"
+	"net/http"
+)
+
+type clientCertificatesKey string
+
+const clientCertificates = clientCertificatesKey("org.openpolicyagent/client-certificates")
+
+// ClientCertificates returns the ClientCertificates of the caller associated with ctx.
+func ClientCertificates(r *http.Request) ([]*x509.Certificate, bool) {
+	ctx := r.Context()
+
+	certs, ok := ctx.Value(clientCertificates).([]*x509.Certificate)
+
+	return certs, ok
+}
+
+// SetClientCertificates returns a new http.Request with the ClientCertificates set to v.
+func SetClientCertificates(r *http.Request, v []*x509.Certificate) *http.Request {
+	return r.WithContext(context.WithValue(r.Context(), clientCertificates, v))
+}
diff --git a/server/identifier/identifier.go b/server/identifier/identifier.go
index 6de3ad0d3a..de0c7dd82f 100644
--- a/server/identifier/identifier.go
+++ b/server/identifier/identifier.go
@@ -2,15 +2,18 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
-// Package identifier provides handlers for associating an identity with incoming requests.
+// Package identifier provides handlers for associating identity information with incoming requests.
 package identifier
 
 import (
 	"context"
 	"net/http"
-	"regexp"
 )
 
+type identityKey string
+
+const identity = identityKey("org.openpolicyagent/identity")
+
 // Identity returns the identity of the caller associated with ctx.
 func Identity(r *http.Request) (string, bool) {
 	ctx := r.Context()
@@ -25,34 +28,3 @@ func Identity(r *http.Request) (string, bool) {
 func SetIdentity(r *http.Request, v string) *http.Request {
 	return r.WithContext(context.WithValue(r.Context(), identity, v))
 }
-
-type identityKey string
-
-const identity = identityKey("org.openpolicyagent/identity")
-
-// TokenBased extracts Bearer tokens from the request.
-type TokenBased struct {
-	inner http.Handler
-}
-
-// NewTokenBased returns a new TokenBased object.
-func NewTokenBased(inner http.Handler) *TokenBased {
-	return &TokenBased{
-		inner: inner,
-	}
-}
-
-var bearerTokenRegexp = regexp.MustCompile(`^Bearer\s+(\S+)$`)
-
-func (h *TokenBased) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-
-	value := r.Header.Get("Authorization")
-	if len(value) > 0 {
-		match := bearerTokenRegexp.FindStringSubmatch(value)
-		if len(match) > 0 {
-			r = SetIdentity(r, match[1])
-		}
-	}
-
-	h.inner.ServeHTTP(w, r)
-}
diff --git a/server/identifier/identifier_test.go b/server/identifier/identifier_test.go
deleted file mode 100644
index 1f1dcfad58..0000000000
--- a/server/identifier/identifier_test.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Copyright 2017 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-package identifier_test
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/open-policy-agent/opa/server/identifier"
-)
-
-type mockHandler struct {
-	identity string
-	defined  bool
-}
-
-func (h *mockHandler) ServeHTTP(_ http.ResponseWriter, r *http.Request) {
-	h.identity, h.defined = identifier.Identity(r)
-}
-
-func TestTokenBased(t *testing.T) {
-
-	mock := &mockHandler{}
-	handler := identifier.NewTokenBased(mock)
-
-	req, err := http.NewRequest(http.MethodGet, "/foo/bar/baz", nil)
-	if err != nil {
-		t.Fatalf("Unexpected error creating request: %v", err)
-	}
-
-	tests := []struct {
-		value    string
-		expected string
-		defined  bool
-	}{
-		{"", "", false},
-		{"Bearer this-is-the-token", "this-is-the-token", true},
-		{"Bearer    this-is-the-token-with-spaces", "this-is-the-token-with-spaces", true},
-	}
-
-	for _, tc := range tests {
-
-		if tc.value != "" {
-			req.Header.Set("Authorization", tc.value)
-		}
-
-		handler.ServeHTTP(nil, req)
-
-		if mock.defined != tc.defined {
-			t.Fatalf("Expected defined to be %v but got: %v", tc.defined, mock.defined)
-		}
-
-		if mock.identity != tc.expected {
-			t.Fatalf("Expected identity to be %s but got: %s", tc.expected, mock.identity)
-		}
-	}
-
-}
diff --git a/server/identifier/mock_test.go b/server/identifier/mock_test.go
new file mode 100644
index 0000000000..58ff792ed6
--- /dev/null
+++ b/server/identifier/mock_test.go
@@ -0,0 +1,21 @@
+package identifier_test
+
+import (
+	"crypto/x509"
+	"net/http"
+
+	"github.com/open-policy-agent/opa/server/identifier"
+)
+
+type mockHandler struct {
+	identity        string
+	identityDefined bool
+
+	clientCertificates        []*x509.Certificate
+	clientCertificatesDefined bool
+}
+
+func (h *mockHandler) ServeHTTP(_ http.ResponseWriter, r *http.Request) {
+	h.identity, h.identityDefined = identifier.Identity(r)
+	h.clientCertificates, h.clientCertificatesDefined = identifier.ClientCertificates(r)
+}
diff --git a/server/identifier/testdata/spiffe-svid-cert.pem b/server/identifier/testdata/spiffe-svid-cert.pem
new file mode 100644
index 0000000000..a31fe5e4a0
--- /dev/null
+++ b/server/identifier/testdata/spiffe-svid-cert.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICMjCCAdegAwIBAgIIKoc+GoX4gH8wCgYIKoZIzj0EAwIwXDELMAkGA1UEBhMC
+R0IxFDASBgNVBAoTC0V4YW1wbGUgT3JnMRkwFwYDVQQLExBFeGFtcGxlIE9yZyBV
+bml0MRwwGgYDVQQFExMxNTEwNjM0Mzk1MTQyOTY4MzA4MCAXDTIzMDIyMzE2NTYw
+M1oYDzIxMjIwMTMwMTY1NjAzWjBcMQswCQYDVQQGEwJHQjEUMBIGA1UEChMLRXhh
+bXBsZSBPcmcxGTAXBgNVBAsTEEV4YW1wbGUgT3JnIFVuaXQxHDAaBgNVBAUTEzMw
+NjQ0ODYzNTUwODY2MzkyMzEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATsy0fp
+ZR6jixkkbWFEvjPhymHX5qo0w7FTfXEzYmmjF2neQv3IWRFCBwbyb5qn1sy0mlkv
+MvZY/7KxqEBYf4YLo4GAMH4wDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsG
+AQUFBwMCBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMD8GA1UdEQQ4MDaGNHNwaWZm
+ZTovL2V4YW1wbGUuY29tL3Byb2QvZXUvY2x1c3Rlci9zZXJ2aWNlcy9mb29iYXIw
+CgYIKoZIzj0EAwIDSQAwRgIhANmslXIVd++AgReE1oVUkCGQqSZLHs6F6Q4qS8Pb
+/YAQAiEAy4FtOuqHyI2jKBZJjHXYYtE1mQPicAC9E1+fhLLRhg4=
+-----END CERTIFICATE-----
diff --git a/server/identifier/testdata/spiffe-svid-key.pem b/server/identifier/testdata/spiffe-svid-key.pem
new file mode 100644
index 0000000000..1c3aee999a
--- /dev/null
+++ b/server/identifier/testdata/spiffe-svid-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgC40SqDYRW5hWbr0P
+ofGXXE355mXlYIEOSMWYCaE553OhRANCAATsy0fpZR6jixkkbWFEvjPhymHX5qo0
+w7FTfXEzYmmjF2neQv3IWRFCBwbyb5qn1sy0mlkvMvZY/7KxqEBYf4YL
+-----END PRIVATE KEY-----
diff --git a/server/identifier/tls.go b/server/identifier/tls.go
index dc1373c6e6..d17c9f1314 100644
--- a/server/identifier/tls.go
+++ b/server/identifier/tls.go
@@ -24,6 +24,7 @@ func (h *TLSBased) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if tls := r.TLS; tls != nil {
 		if certs := tls.PeerCertificates; len(certs) > 0 {
 			r = SetIdentity(r, certs[0].Subject.ToRDNSequence().String())
+			r = SetClientCertificates(r, certs)
 		}
 	}
 
diff --git a/server/identifier/tls_test.go b/server/identifier/tls_test.go
index 372d031ab3..d7257478f3 100644
--- a/server/identifier/tls_test.go
+++ b/server/identifier/tls_test.go
@@ -6,6 +6,8 @@ package identifier_test
 
 import (
 	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -22,33 +24,46 @@ func TestTLSBased(t *testing.T) {
 	handler := identifier.NewTLSBased(mock)
 
 	tests := []struct {
-		desc     string
-		cert     string
-		key      string
-		expected string
-		defined  bool
+		desc                      string
+		cert                      string
+		key                       string
+		identityExpected          string
+		identityDefined           bool
+		clientCertificatesDefined bool
 	}{
 		{
 			desc: "no cert",
 		},
 		{
-			desc:     "cert with CN=<name>",
-			cert:     "testdata/cn-cert.pem",
-			key:      "testdata/key.pem",
-			expected: "CN=my-client",
-			defined:  true,
+			desc:                      "cert with CN=<name>",
+			cert:                      "testdata/cn-cert.pem",
+			key:                       "testdata/key.pem",
+			identityExpected:          "CN=my-client",
+			identityDefined:           true,
+			clientCertificatesDefined: true,
 		},
 		{
-			desc:     "cert with long DN",
-			cert:     "testdata/ou-cert.pem",
-			key:      "testdata/key.pem",
-			expected: "OU=opa-client-01,O=Torchwood",
-			defined:  true,
+			desc:                      "cert with long DN",
+			cert:                      "testdata/ou-cert.pem",
+			key:                       "testdata/key.pem",
+			identityExpected:          "OU=opa-client-01,O=Torchwood",
+			identityDefined:           true,
+			clientCertificatesDefined: true,
+		},
+		{
+			desc:                      "SPIFFE cert",
+			cert:                      "testdata/spiffe-svid-cert.pem",
+			key:                       "testdata/spiffe-svid-key.pem",
+			identityExpected:          "SERIALNUMBER=3064486355086639231,OU=Example Org Unit,O=Example Org,C=GB",
+			identityDefined:           true,
+			clientCertificatesDefined: true,
 		},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.desc, func(t *testing.T) {
+			var err error
+
 			// Note: some re-use happens if this server is outside of the tests loop,
 			// causing weird overlaps. Let's keep setting up a fresh one in each
 			// iteration to be safe.
@@ -58,26 +73,57 @@ func TestTLSBased(t *testing.T) {
 			defer s.Close()
 			c := s.Client() // trusts the httptest server's TLS cert
 
+			var cert tls.Certificate
 			if tc.cert != "" && tc.key != "" {
-				cert, err := tls.LoadX509KeyPair(tc.cert, tc.key)
+				cert, err = tls.LoadX509KeyPair(tc.cert, tc.key)
 				if err != nil {
 					t.Fatalf("read test cert/key (%s/%s): %s", tc.cert, tc.key, err)
 				}
 				c.Transport.(*http.Transport).TLSClientConfig.Certificates = []tls.Certificate{cert}
 			}
 
-			_, err := c.Get(s.URL)
+			_, err = c.Get(s.URL)
 			if err != nil {
 				t.Fatalf("unexpected error in GET %s: %s", s.URL, err)
 			}
-			if mock.defined != tc.defined {
-				t.Fatalf("Expected defined to be %v but got: %v", tc.defined, mock.defined)
+			if mock.identityDefined != tc.identityDefined {
+				t.Fatalf("Expected identityDefined to be %v but got: %v", tc.identityDefined, mock.identityDefined)
 			}
 
-			if mock.identity != tc.expected {
-				t.Fatalf("Expected identity to be %s but got: %s", tc.expected, mock.identity)
+			if tc.identityDefined {
+				if mock.identity != tc.identityExpected {
+					t.Fatalf("Expected identity to be %s but got: %s", tc.identityExpected, mock.identity)
+				}
+			}
+
+			if mock.clientCertificatesDefined != tc.clientCertificatesDefined {
+				t.Fatalf("Expected clientCertificatesDefined to be %v but got: %v", tc.clientCertificatesDefined, mock.clientCertificatesDefined)
+			}
+
+			if tc.clientCertificatesDefined {
+				if len(mock.clientCertificates) != 1 {
+					t.Fatalf("Expected clientCertificates to have 1 cert but got: %d", len(mock.clientCertificates))
+				}
+
+				gotPemData := pem.EncodeToMemory(&pem.Block{
+					Type:  "CERTIFICATE",
+					Bytes: mock.clientCertificates[0].Raw,
+				})
+
+				parsedWantedCert, err := x509.ParseCertificate(cert.Certificate[0])
+				if err != nil {
+					t.Fatalf("Error parsing expected cert: %s", err)
+				}
+
+				wantPemData := pem.EncodeToMemory(&pem.Block{
+					Type:  "CERTIFICATE",
+					Bytes: parsedWantedCert.Raw,
+				})
+
+				if got, want := string(gotPemData), string(wantPemData); got != want {
+					t.Fatalf("Expected clientCertificates to be \n%s\n but got: \n%s\n", want, got)
+				}
 			}
 		})
 	}
-
 }
diff --git a/server/identifier/token.go b/server/identifier/token.go
new file mode 100644
index 0000000000..a5d57b38db
--- /dev/null
+++ b/server/identifier/token.go
@@ -0,0 +1,33 @@
+package identifier
+
+import (
+	"net/http"
+	"regexp"
+)
+
+// TokenBased extracts Bearer tokens from the request.
+type TokenBased struct {
+	inner http.Handler
+}
+
+// NewTokenBased returns a new TokenBased object.
+func NewTokenBased(inner http.Handler) *TokenBased {
+	return &TokenBased{
+		inner: inner,
+	}
+}
+
+var bearerTokenRegexp = regexp.MustCompile(`^Bearer\s+(\S+)$`)
+
+func (h *TokenBased) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+
+	value := r.Header.Get("Authorization")
+	if len(value) > 0 {
+		match := bearerTokenRegexp.FindStringSubmatch(value)
+		if len(match) > 0 {
+			r = SetIdentity(r, match[1])
+		}
+	}
+
+	h.inner.ServeHTTP(w, r)
+}
diff --git a/server/identifier/token_test.go b/server/identifier/token_test.go
new file mode 100644
index 0000000000..e315995349
--- /dev/null
+++ b/server/identifier/token_test.go
@@ -0,0 +1,63 @@
+// Copyright 2017 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package identifier_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/open-policy-agent/opa/server/identifier"
+)
+
+func TestTokenBased(t *testing.T) {
+
+	mock := &mockHandler{}
+	handler := identifier.NewTokenBased(mock)
+
+	req, err := http.NewRequest(http.MethodGet, "/foo/bar/baz", nil)
+	if err != nil {
+		t.Fatalf("Unexpected error creating request: %v", err)
+	}
+
+	tests := []struct {
+		value           string
+		expected        string
+		identityDefined bool
+	}{
+		{
+			"",
+			"",
+			false,
+		},
+		{
+			"Bearer this-is-the-token",
+			"this-is-the-token",
+			true,
+		},
+		{
+			"Bearer    this-is-the-token-with-spaces",
+			"this-is-the-token-with-spaces",
+			true,
+		},
+	}
+
+	for _, tc := range tests {
+
+		if tc.value != "" {
+			req.Header.Set("Authorization", tc.value)
+		}
+
+		handler.ServeHTTP(nil, req)
+
+		if mock.identityDefined != tc.identityDefined {
+			t.Fatalf("Expected identityDefined to be %v but got: %v", tc.identityDefined, mock.identityDefined)
+		}
+
+		if mock.identity != tc.expected {
+			t.Fatalf("Expected identity to be %s but got: %s", tc.expected, mock.identity)
+		}
+	}
+
+}
diff --git a/server/server.go b/server/server.go
index 327d8dc2f2..43f08824c3 100644
--- a/server/server.go
+++ b/server/server.go
@@ -6,14 +6,15 @@ package server
 
 import (
 	"bytes"
+	"compress/gzip"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"html/template"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/pprof"
@@ -24,27 +25,35 @@ import (
 	"sync"
 	"time"
 
+	serverEncodingPlugin "github.com/open-policy-agent/opa/plugins/server/encoding"
+
 	"github.com/gorilla/mux"
-	"github.com/pkg/errors"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/internal/json/patch"
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
 	bundlePlugin "github.com/open-policy-agent/opa/plugins/bundle"
 	"github.com/open-policy-agent/opa/plugins/status"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/server/authorizer"
+	"github.com/open-policy-agent/opa/server/handlers"
 	"github.com/open-policy-agent/opa/server/identifier"
 	"github.com/open-policy-agent/opa/server/types"
 	"github.com/open-policy-agent/opa/server/writer"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/topdown"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 	iCache "github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/lineage"
+	"github.com/open-policy-agent/opa/tracing"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/version"
 )
@@ -86,10 +95,14 @@ const (
 	PromHandlerIndex      = "index"
 	PromHandlerCatch      = "catchall"
 	PromHandlerHealth     = "health"
+	PromHandlerAPIAuthz   = "authz"
 )
 
 const pqMaxCacheSize = 100
 
+// OpenTelemetry attributes
+const otelDecisionIDAttr = "opa.decision_id"
+
 // map of unsafe builtins
 var unsafeBuiltinsMap = map[string]struct{}{ast.HTTPSend.Name: {}}
 
@@ -128,6 +141,9 @@ type Server struct {
 	defaultDecisionPath    string
 	interQueryBuiltinCache iCache.InterQueryCache
 	allPluginsOkOnce       bool
+	distributedTracingOpts tracing.Options
+	ndbCacheEnabled        bool
+	unixSocketPerm         *string
 }
 
 // Metrics defines the interface that the server requires for recording HTTP
@@ -150,8 +166,6 @@ func New() *Server {
 // from s.Listeners().
 func (s *Server) Init(ctx context.Context) (*Server, error) {
 	s.initRouters()
-	s.Handler = s.initHandlerAuth(s.Handler)
-	s.DiagnosticHandler = s.initHandlerAuth(s.DiagnosticHandler)
 
 	txn, err := s.store.NewTransaction(ctx, storage.WriteParams)
 	if err != nil {
@@ -171,8 +185,16 @@ func (s *Server) Init(ctx context.Context) (*Server, error) {
 	s.partials = map[string]rego.PartialResult{}
 	s.preparedEvalQueries = newCache(pqMaxCacheSize)
 	s.defaultDecisionPath = s.generateDefaultDecisionPath()
-	s.interQueryBuiltinCache = iCache.NewInterQueryCache(s.manager.InterQueryBuiltinCacheConfig())
-	s.manager.RegisterCacheTrigger(s.updateCacheConfig)
+	s.manager.RegisterNDCacheTrigger(s.updateNDCache)
+
+	s.Handler = s.initHandlerAuthn(s.Handler)
+
+	// compression handler
+	s.Handler, err = s.initHandlerCompression(s.Handler)
+	if err != nil {
+		return nil, err
+	}
+	s.DiagnosticHandler = s.initHandlerAuthn(s.DiagnosticHandler)
 
 	return s, s.store.Commit(ctx, txn)
 }
@@ -333,6 +355,25 @@ func (s *Server) WithMinTLSVersion(minTLSVersion uint16) *Server {
 	return s
 }
 
+// WithDistributedTracingOpts sets the options to be used by distributed tracing.
+func (s *Server) WithDistributedTracingOpts(opts tracing.Options) *Server {
+	s.distributedTracingOpts = opts
+	return s
+}
+
+// WithNDBCacheEnabled sets whether the ND builtins cache is to be used.
+func (s *Server) WithNDBCacheEnabled(ndbCacheEnabled bool) *Server {
+	s.ndbCacheEnabled = ndbCacheEnabled
+	return s
+}
+
+// WithUnixSocketPermission sets the permission for the Unix domain socket if used to listen for
+// incoming connections. Applies to the sockets the server is listening on including diagnostic API's.
+func (s *Server) WithUnixSocketPermission(unixSocketPerm *string) *Server {
+	s.unixSocketPerm = unixSocketPerm
+	return s
+}
+
 // Listeners returns functions that listen and serve connections.
 func (s *Server) Listeners() ([]Loop, error) {
 	loops := []Loop{}
@@ -601,15 +642,35 @@ func (s *Server) getListenerForUNIXSocket(u *url.URL, h http.Handler, t httpList
 		return nil, nil, err
 	}
 
+	if s.unixSocketPerm != nil {
+		modeVal, err := strconv.ParseUint(*s.unixSocketPerm, 8, 32)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		if err := os.Chmod(socketPath, os.FileMode(modeVal)); err != nil {
+			return nil, nil, err
+		}
+	}
+
 	l := newHTTPUnixSocketListener(&domainSocketServer, unixListener, t)
 
 	domainSocketLoop := func() error { return domainSocketServer.Serve(unixListener) }
 	return domainSocketLoop, l, nil
 }
 
-func (s *Server) initHandlerAuth(handler http.Handler) http.Handler {
-	// Add authorization handler. This must come BEFORE authentication handler
-	// so that the latter can run first.
+func (s *Server) initHandlerAuthn(handler http.Handler) http.Handler {
+	switch s.authentication {
+	case AuthenticationToken:
+		handler = identifier.NewTokenBased(handler)
+	case AuthenticationTLS:
+		handler = identifier.NewTLSBased(handler)
+	}
+
+	return handler
+}
+
+func (s *Server) initHandlerAuthz(handler http.Handler) http.Handler {
 	switch s.authorization {
 	case AuthorizationBasic:
 		handler = authorizer.NewBasic(
@@ -619,19 +680,32 @@ func (s *Server) initHandlerAuth(handler http.Handler) http.Handler {
 			authorizer.Runtime(s.runtime),
 			authorizer.Decision(s.manager.Config.DefaultAuthorizationDecisionRef),
 			authorizer.PrintHook(s.manager.PrintHook()),
-			authorizer.EnablePrintStatements(s.manager.EnablePrintStatements()))
-	}
+			authorizer.EnablePrintStatements(s.manager.EnablePrintStatements()),
+			authorizer.InterQueryCache(s.interQueryBuiltinCache))
 
-	switch s.authentication {
-	case AuthenticationToken:
-		handler = identifier.NewTokenBased(handler)
-	case AuthenticationTLS:
-		handler = identifier.NewTLSBased(handler)
+		if s.metrics != nil {
+			handler = s.instrumentHandler(handler.ServeHTTP, PromHandlerAPIAuthz)
+		}
 	}
 
 	return handler
 }
 
+func (s *Server) initHandlerCompression(handler http.Handler) (http.Handler, error) {
+	var encodingRawConfig json.RawMessage
+	serverConfig := s.manager.Config.Server
+	if serverConfig != nil {
+		encodingRawConfig = serverConfig.Encoding
+	}
+	encodingConfig, err := serverEncodingPlugin.NewConfigBuilder().WithBytes(encodingRawConfig).Parse()
+	if err != nil {
+		return nil, err
+	}
+	compressHandler := handlers.CompressHandler(handler, *encodingConfig.Gzip.MinLength, *encodingConfig.Gzip.CompressionLevel)
+
+	return compressHandler, nil
+}
+
 func (s *Server) initRouters() {
 	mainRouter := s.router
 	if mainRouter == nil {
@@ -640,6 +714,16 @@ func (s *Server) initRouters() {
 
 	diagRouter := mux.NewRouter()
 
+	// authorizer, if configured, needs the iCache to be set up already
+	s.interQueryBuiltinCache = iCache.NewInterQueryCache(s.manager.InterQueryBuiltinCacheConfig())
+	s.manager.RegisterCacheTrigger(s.updateCacheConfig)
+
+	// Add authorization handler. This must come BEFORE authentication handler
+	// so that the latter can run first.
+	handlerAuthz := s.initHandlerAuthz(mainRouter)
+
+	handlerAuthzDiag := s.initHandlerAuthz(diagRouter)
+
 	// All routers get the same base configuration *and* diagnostic API's
 	for _, router := range []*mux.Router{mainRouter, diagRouter} {
 		router.StrictSlash(true)
@@ -695,42 +779,50 @@ func (s *Server) initRouters() {
 	mainRouter.Handle("/", s.instrumentHandler(s.unversionedPost, PromHandlerIndex)).Methods(http.MethodPost)
 	mainRouter.Handle("/", s.instrumentHandler(s.indexGet, PromHandlerIndex)).Methods(http.MethodGet)
 
-	// These are catch all handlers that respond 405 for resources that exist but the method is not allowed
-	mainRouter.Handle("/v0/data/{path:.*}", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodGet, http.MethodHead,
+	// These are catch all handlers that respond http.StatusMethodNotAllowed for resources that exist but the method is not allowed
+	mainRouter.Handle("/v0/data/{path:.*}", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodGet, http.MethodHead,
 		http.MethodConnect, http.MethodDelete, http.MethodOptions, http.MethodPatch, http.MethodPut, http.MethodTrace)
-	mainRouter.Handle("/v0/data", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodGet, http.MethodHead,
+	mainRouter.Handle("/v0/data", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodGet, http.MethodHead,
 		http.MethodConnect, http.MethodDelete, http.MethodOptions, http.MethodPatch, http.MethodPut,
 		http.MethodTrace)
 	// v1 Data catch all
-	mainRouter.Handle("/v1/data/{path:.*}", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodHead,
+	mainRouter.Handle("/v1/data/{path:.*}", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodHead,
 		http.MethodConnect, http.MethodOptions, http.MethodTrace)
-	mainRouter.Handle("/v1/data", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodHead,
+	mainRouter.Handle("/v1/data", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodHead,
 		http.MethodConnect, http.MethodDelete, http.MethodOptions, http.MethodTrace)
 	// Policies catch all
-	mainRouter.Handle("/v1/policies", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodHead,
+	mainRouter.Handle("/v1/policies", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodHead,
 		http.MethodConnect, http.MethodDelete, http.MethodOptions, http.MethodTrace, http.MethodPost, http.MethodPut,
 		http.MethodPatch)
 	// Policies (/policies/{path.+} catch all
-	mainRouter.Handle("/v1/policies/{path:.*}", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodHead,
+	mainRouter.Handle("/v1/policies/{path:.*}", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodHead,
 		http.MethodConnect, http.MethodOptions, http.MethodTrace, http.MethodPost)
 	// Query catch all
-	mainRouter.Handle("/v1/query/{path:.*}", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodHead,
+	mainRouter.Handle("/v1/query/{path:.*}", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodHead,
 		http.MethodConnect, http.MethodDelete, http.MethodOptions, http.MethodTrace, http.MethodPost, http.MethodPut, http.MethodPatch)
-	mainRouter.Handle("/v1/query", s.instrumentHandler(writer.HTTPStatus(405), PromHandlerCatch)).Methods(http.MethodHead,
+	mainRouter.Handle("/v1/query", s.instrumentHandler(writer.HTTPStatus(http.StatusMethodNotAllowed), PromHandlerCatch)).Methods(http.MethodHead,
 		http.MethodConnect, http.MethodDelete, http.MethodOptions, http.MethodTrace, http.MethodPut, http.MethodPatch)
 
 	s.Handler = mainRouter
 	s.DiagnosticHandler = diagRouter
+
+	// Add authorization handler in the end so that it can run first
+	s.Handler = handlerAuthz
+	s.DiagnosticHandler = handlerAuthzDiag
 }
 
 func (s *Server) instrumentHandler(handler func(http.ResponseWriter, *http.Request), label string) http.Handler {
+	var httpHandler http.Handler = http.HandlerFunc(handler)
+	if len(s.distributedTracingOpts) > 0 {
+		httpHandler = tracing.NewHandler(httpHandler, label, s.distributedTracingOpts)
+	}
 	if s.metrics != nil {
-		return s.metrics.InstrumentHandler(http.HandlerFunc(handler), label)
+		return s.metrics.InstrumentHandler(httpHandler, label)
 	}
-	return http.HandlerFunc(handler)
+	return httpHandler
 }
 
-func (s *Server) execQuery(ctx context.Context, r *http.Request, br bundleRevisions, txn storage.Transaction, decisionID string, parsedQuery ast.Body, input ast.Value, m metrics.Metrics, explainMode types.ExplainModeV1, includeMetrics, includeInstrumentation, pretty bool) (results types.QueryResponseV1, err error) {
+func (s *Server) execQuery(ctx context.Context, r *http.Request, br bundleRevisions, txn storage.Transaction, parsedQuery ast.Body, input ast.Value, m metrics.Metrics, explainMode types.ExplainModeV1, includeMetrics, includeInstrumentation, pretty bool) (results types.QueryResponseV1, err error) {
 
 	logger := s.getDecisionLogger(br)
 
@@ -748,6 +840,11 @@ func (s *Server) execQuery(ctx context.Context, r *http.Request, br bundleRevisi
 		rawInput = &x
 	}
 
+	var ndbCache builtins.NDBCache
+	if s.ndbCacheEnabled {
+		ndbCache = builtins.NDBCache{}
+	}
+
 	opts := []func(*rego.Rego){
 		rego.Store(s.store),
 		rego.Transaction(txn),
@@ -762,6 +859,8 @@ func (s *Server) execQuery(ctx context.Context, r *http.Request, br bundleRevisi
 		rego.InterQueryBuiltinCache(s.interQueryBuiltinCache),
 		rego.PrintHook(s.manager.PrintHook()),
 		rego.EnablePrintStatements(s.manager.EnablePrintStatements()),
+		rego.DistributedTracingOpts(s.distributedTracingOpts),
+		rego.NDBuiltinCache(ndbCache),
 	}
 
 	for _, r := range s.manager.GetWasmResolvers() {
@@ -774,7 +873,7 @@ func (s *Server) execQuery(ctx context.Context, r *http.Request, br bundleRevisi
 
 	output, err := rego.Eval(ctx)
 	if err != nil {
-		_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, "", parsedQuery.String(), rawInput, input, nil, err, m)
+		_ = logger.Log(ctx, txn, "", parsedQuery.String(), rawInput, input, nil, ndbCache, err, m)
 		return results, err
 	}
 
@@ -791,7 +890,7 @@ func (s *Server) execQuery(ctx context.Context, r *http.Request, br bundleRevisi
 	}
 
 	var x interface{} = results.Result
-	err = logger.Log(ctx, txn, decisionID, r.RemoteAddr, "", parsedQuery.String(), rawInput, input, &x, nil, m)
+	err = logger.Log(ctx, txn, "", parsedQuery.String(), rawInput, input, &x, ndbCache, nil, m)
 	return results, err
 }
 
@@ -848,7 +947,7 @@ func getRevisions(ctx context.Context, store storage.Store, txn storage.Transact
 	return br, nil
 }
 
-func (s *Server) reload(ctx context.Context, txn storage.Transaction, event storage.TriggerEvent) {
+func (s *Server) reload(context.Context, storage.Transaction, storage.TriggerEvent) {
 
 	// NOTE(tsandall): We currently rely on the storage txn to provide
 	// critical sections in the server.
@@ -876,11 +975,12 @@ func (s *Server) v0QueryPath(w http.ResponseWriter, r *http.Request, urlPath str
 	m.Timer(metrics.ServerHandler).Start()
 
 	decisionID := s.generateDecisionID()
+	ctx := logging.WithDecisionID(r.Context(), decisionID)
+	annotateSpan(ctx, decisionID)
 
-	ctx := r.Context()
 	input, err := readInputV0(r)
 	if err != nil {
-		writer.ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, errors.Wrapf(err, "unexpected parse error for input"))
+		writer.ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, fmt.Errorf("unexpected parse error for input: %w", err))
 		return
 	}
 
@@ -888,7 +988,7 @@ func (s *Server) v0QueryPath(w http.ResponseWriter, r *http.Request, urlPath str
 	if input != nil {
 		x, err := ast.JSON(input)
 		if err != nil {
-			writer.ErrorString(w, http.StatusInternalServerError, types.CodeInvalidParameter, errors.Wrapf(err, "could not marshal input"))
+			writer.ErrorString(w, http.StatusInternalServerError, types.CodeInvalidParameter, fmt.Errorf("could not marshal input: %w", err))
 			return
 		}
 		goInput = &x
@@ -915,20 +1015,17 @@ func (s *Server) v0QueryPath(w http.ResponseWriter, r *http.Request, urlPath str
 
 	logger := s.getDecisionLogger(br)
 
+	var ndbCache builtins.NDBCache
+	if s.ndbCacheEnabled {
+		ndbCache = builtins.NDBCache{}
+	}
+
 	pqID := "v0QueryPath::" + urlPath
 	preparedQuery, ok := s.getCachedPreparedEvalQuery(pqID, m)
 	if !ok {
-		path := stringPathToDataRef(urlPath)
-
 		opts := []func(*rego.Rego){
 			rego.Compiler(s.getCompiler()),
 			rego.Store(s.store),
-			rego.Transaction(txn),
-			rego.Query(path.String()),
-			rego.Metrics(m),
-			rego.Runtime(s.runtime),
-			rego.UnsafeBuiltins(unsafeBuiltinsMap),
-			rego.PrintHook(s.manager.PrintHook()),
 		}
 
 		// Set resolvers on the base Rego object to avoid having them get
@@ -939,9 +1036,17 @@ func (s *Server) v0QueryPath(w http.ResponseWriter, r *http.Request, urlPath str
 			}
 		}
 
-		pq, err := rego.New(opts...).PrepareForEval(ctx)
+		partial, strictBuiltinErrors, instrument := false, false, false
+		rego, err := s.makeRego(ctx, partial, strictBuiltinErrors, txn, input, urlPath, m, instrument, nil, opts)
 		if err != nil {
-			_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+			_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
+			writer.ErrorAuto(w, err)
+			return
+		}
+
+		pq, err := rego.PrepareForEval(ctx)
+		if err != nil {
+			_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 			writer.ErrorAuto(w, err)
 			return
 		}
@@ -954,6 +1059,7 @@ func (s *Server) v0QueryPath(w http.ResponseWriter, r *http.Request, urlPath str
 		rego.EvalParsedInput(input),
 		rego.EvalMetrics(m),
 		rego.EvalInterQueryBuiltinCache(s.interQueryBuiltinCache),
+		rego.EvalNDBuiltinCache(ndbCache),
 	}
 
 	rs, err := preparedQuery.Eval(
@@ -965,29 +1071,35 @@ func (s *Server) v0QueryPath(w http.ResponseWriter, r *http.Request, urlPath str
 
 	// Handle results.
 	if err != nil {
-		_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+		_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 		writer.ErrorAuto(w, err)
 		return
 	}
 
 	if len(rs) == 0 {
-		err := types.NewErrorV1(types.CodeUndefinedDocument, fmt.Sprintf("%v: %v", types.MsgUndefinedError, stringPathToDataRef(urlPath)))
-		if logErr := logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m); logErr != nil {
+		ref := stringPathToDataRef(urlPath)
+
+		var messageType = types.MsgMissingError
+		if len(s.getCompiler().GetRulesForVirtualDocument(ref)) > 0 {
+			messageType = types.MsgFoundUndefinedError
+		}
+		err := types.NewErrorV1(types.CodeUndefinedDocument, fmt.Sprintf("%v: %v", messageType, ref))
+		if logErr := logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m); logErr != nil {
 			writer.ErrorAuto(w, logErr)
 			return
 		}
 
-		writer.Error(w, 404, err)
+		writer.Error(w, http.StatusNotFound, err)
 		return
 	}
-	err = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, &rs[0].Expressions[0].Value, nil, m)
+	err = logger.Log(ctx, txn, urlPath, "", goInput, input, &rs[0].Expressions[0].Value, ndbCache, nil, m)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
 	}
 
 	pretty := getBoolParam(r.URL, types.ParamPrettyV1, true)
-	writer.JSON(w, 200, rs[0].Expressions[0].Value, pretty)
+	writer.JSON(w, http.StatusOK, rs[0].Expressions[0].Value, pretty)
 }
 
 func (s *Server) getCachedPreparedEvalQuery(key string, m metrics.Metrics) (*rego.PreparedEvalQuery, bool) {
@@ -1193,7 +1305,15 @@ func (s *Server) v1CompilePost(w http.ResponseWriter, r *http.Request) {
 	m.Timer(metrics.ServerHandler).Start()
 	m.Timer(metrics.RegoQueryParse).Start()
 
-	request, reqErr := readInputCompilePostV1(r.Body)
+	// decompress the input if sent as zip
+	body, err := readPlainBody(r)
+	if err != nil {
+		reqErr := types.NewErrorV1(types.CodeInvalidParameter, "could not decompress the body")
+		writer.Error(w, http.StatusBadRequest, reqErr)
+		return
+	}
+
+	request, reqErr := readInputCompilePostV1(body)
 	if reqErr != nil {
 		writer.Error(w, http.StatusBadRequest, reqErr)
 		return
@@ -1201,7 +1321,8 @@ func (s *Server) v1CompilePost(w http.ResponseWriter, r *http.Request) {
 
 	m.Timer(metrics.RegoQueryParse).Stop()
 
-	txn, err := s.store.NewTransaction(ctx)
+	c := storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, storage.TransactionParams{Context: c})
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1221,6 +1342,7 @@ func (s *Server) v1CompilePost(w http.ResponseWriter, r *http.Request) {
 		rego.ParsedQuery(request.Query),
 		rego.ParsedInput(request.Input),
 		rego.ParsedUnknowns(request.Unknowns),
+		rego.DisableInlining(request.Options.DisableInlining),
 		rego.QueryTracer(buf),
 		rego.Instrument(includeInstrumentation),
 		rego.Metrics(m),
@@ -1260,7 +1382,7 @@ func (s *Server) v1CompilePost(w http.ResponseWriter, r *http.Request) {
 
 	result.Result = &i
 
-	writer.JSON(w, 200, result, pretty)
+	writer.JSON(w, http.StatusOK, result, pretty)
 }
 
 func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
@@ -1269,8 +1391,9 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 	m.Timer(metrics.ServerHandler).Start()
 
 	decisionID := s.generateDecisionID()
+	ctx := logging.WithDecisionID(r.Context(), decisionID)
+	annotateSpan(ctx, decisionID)
 
-	ctx := r.Context()
 	vars := mux.Vars(r)
 	urlPath := vars["path"]
 	pretty := getBoolParam(r.URL, types.ParamPrettyV1, true)
@@ -1299,7 +1422,7 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 	if input != nil {
 		x, err := ast.JSON(input)
 		if err != nil {
-			writer.ErrorString(w, http.StatusInternalServerError, types.CodeInvalidParameter, errors.Wrapf(err, "could not marshal input"))
+			writer.ErrorString(w, http.StatusInternalServerError, types.CodeInvalidParameter, fmt.Errorf("could not marshal input: %w", err))
 			return
 		}
 		goInput = &x
@@ -1308,7 +1431,8 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 	m.Timer(metrics.RegoInputParse).Stop()
 
 	// Prepare for query.
-	txn, err := s.store.NewTransaction(ctx)
+	c := storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, storage.TransactionParams{Context: c})
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1323,6 +1447,11 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 
 	logger := s.getDecisionLogger(br)
 
+	var ndbCache builtins.NDBCache
+	if s.ndbCacheEnabled {
+		ndbCache = builtins.NDBCache{}
+	}
+
 	var buf *topdown.BufferTracer
 
 	if explainMode != types.ExplainOffV1 {
@@ -1339,16 +1468,6 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 		opts := []func(*rego.Rego){
 			rego.Compiler(s.getCompiler()),
 			rego.Store(s.store),
-			rego.Transaction(txn),
-			rego.ParsedInput(input),
-			rego.Query(stringPathToDataRef(urlPath).String()),
-			rego.Metrics(m),
-			rego.QueryTracer(buf),
-			rego.Instrument(includeInstrumentation),
-			rego.Runtime(s.runtime),
-			rego.UnsafeBuiltins(unsafeBuiltinsMap),
-			rego.StrictBuiltinErrors(strictBuiltinErrors),
-			rego.PrintHook(s.manager.PrintHook()),
 		}
 
 		for _, r := range s.manager.GetWasmResolvers() {
@@ -1357,9 +1476,17 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 
-		pq, err := rego.New(opts...).PrepareForEval(ctx)
+		partial := false
+		rego, err := s.makeRego(ctx, partial, strictBuiltinErrors, txn, input, urlPath, m, includeInstrumentation, buf, opts)
 		if err != nil {
-			_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+			_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
+			writer.ErrorAuto(w, err)
+			return
+		}
+
+		pq, err := rego.PrepareForEval(ctx)
+		if err != nil {
+			_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 			writer.ErrorAuto(w, err)
 			return
 		}
@@ -1374,6 +1501,7 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 		rego.EvalQueryTracer(buf),
 		rego.EvalInterQueryBuiltinCache(s.interQueryBuiltinCache),
 		rego.EvalInstrument(includeInstrumentation),
+		rego.EvalNDBuiltinCache(ndbCache),
 	}
 
 	rs, err := preparedQuery.Eval(
@@ -1385,7 +1513,7 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 
 	// Handle results.
 	if err != nil {
-		_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+		_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 		writer.ErrorAuto(w, err)
 		return
 	}
@@ -1404,17 +1532,19 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 
 	if len(rs) == 0 {
 		if explainMode == types.ExplainFullV1 {
-			result.Explanation, err = types.NewTraceV1(*buf, pretty)
+			result.Explanation, err = types.NewTraceV1(lineage.Full(*buf), pretty)
 			if err != nil {
 				writer.ErrorAuto(w, err)
+				return
 			}
 		}
-		err = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, nil, m)
+
+		err = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, nil, m)
 		if err != nil {
 			writer.ErrorAuto(w, err)
 			return
 		}
-		writer.JSON(w, 200, result, pretty)
+		writer.JSON(w, http.StatusOK, result, pretty)
 		return
 	}
 
@@ -1424,24 +1554,30 @@ func (s *Server) v1DataGet(w http.ResponseWriter, r *http.Request) {
 		result.Explanation = s.getExplainResponse(explainMode, *buf, pretty)
 	}
 
-	err = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, result.Result, nil, m)
+	err = logger.Log(ctx, txn, urlPath, "", goInput, input, result.Result, ndbCache, nil, m)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
 	}
-	writer.JSON(w, 200, result, pretty)
+	writer.JSON(w, http.StatusOK, result, pretty)
 }
 
 func (s *Server) v1DataPatch(w http.ResponseWriter, r *http.Request) {
+	m := metrics.New()
+	m.Timer(metrics.ServerHandler).Start()
+	defer m.Timer(metrics.ServerHandler).Stop()
+
 	ctx := r.Context()
 	vars := mux.Vars(r)
-
+	includeMetrics := getBoolParam(r.URL, types.ParamMetricsV1, true)
 	ops := []types.PatchV1{}
 
+	m.Timer(metrics.RegoInputParse).Start()
 	if err := util.NewJSONDecoder(r.Body).Decode(&ops); err != nil {
 		writer.ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, err)
 		return
 	}
+	m.Timer(metrics.RegoInputParse).Stop()
 
 	patches, err := s.prepareV1PatchSlice(vars["path"], ops)
 	if err != nil {
@@ -1449,7 +1585,9 @@ func (s *Server) v1DataPatch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	txn, err := s.store.NewTransaction(ctx, storage.WriteParams)
+	params := storage.WriteParams
+	params.Context = storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1475,9 +1613,18 @@ func (s *Server) v1DataPatch(w http.ResponseWriter, r *http.Request) {
 
 	if err := s.store.Commit(ctx, txn); err != nil {
 		writer.ErrorAuto(w, err)
-	} else {
-		writer.Bytes(w, 204, nil)
+		return
 	}
+
+	if includeMetrics {
+		result := types.DataResponseV1{
+			Metrics: m.All(),
+		}
+		writer.JSON(w, http.StatusOK, result, false)
+		return
+	}
+
+	writer.Bytes(w, http.StatusNoContent, nil)
 }
 
 func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
@@ -1485,8 +1632,9 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 	m.Timer(metrics.ServerHandler).Start()
 
 	decisionID := s.generateDecisionID()
+	ctx := logging.WithDecisionID(r.Context(), decisionID)
+	annotateSpan(ctx, decisionID)
 
-	ctx := r.Context()
 	vars := mux.Vars(r)
 	urlPath := vars["path"]
 	pretty := getBoolParam(r.URL, types.ParamPrettyV1, true)
@@ -1509,7 +1657,7 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 	if input != nil {
 		x, err := ast.JSON(input)
 		if err != nil {
-			writer.ErrorString(w, http.StatusInternalServerError, types.CodeInvalidParameter, errors.Wrapf(err, "could not marshal input"))
+			writer.ErrorString(w, http.StatusInternalServerError, types.CodeInvalidParameter, fmt.Errorf("could not marshal input: %w", err))
 			return
 		}
 		goInput = &x
@@ -1517,7 +1665,7 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 
 	m.Timer(metrics.RegoInputParse).Stop()
 
-	txn, err := s.store.NewTransaction(ctx)
+	txn, err := s.store.NewTransaction(ctx, storage.TransactionParams{Context: storage.NewContext().WithMetrics(m)})
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1533,6 +1681,11 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 
 	logger := s.getDecisionLogger(br)
 
+	var ndbCache builtins.NDBCache
+	if s.ndbCacheEnabled {
+		ndbCache = builtins.NDBCache{}
+	}
+
 	var buf *topdown.BufferTracer
 
 	if explainMode != types.ExplainOffV1 {
@@ -1552,7 +1705,6 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 		opts := []func(*rego.Rego){
 			rego.Compiler(s.getCompiler()),
 			rego.Store(s.store),
-			rego.StrictBuiltinErrors(strictBuiltinErrors),
 		}
 
 		// Set resolvers on the base Rego object to avoid having them get
@@ -1563,17 +1715,16 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 
-		rego, err := s.makeRego(ctx, partial, txn, input, urlPath, m, includeInstrumentation, buf, opts)
-
+		rego, err := s.makeRego(ctx, partial, strictBuiltinErrors, txn, input, urlPath, m, includeInstrumentation, buf, opts)
 		if err != nil {
-			_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+			_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 			writer.ErrorAuto(w, err)
 			return
 		}
 
 		pq, err := rego.PrepareForEval(ctx)
 		if err != nil {
-			_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+			_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 			writer.ErrorAuto(w, err)
 			return
 		}
@@ -1588,6 +1739,7 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 		rego.EvalQueryTracer(buf),
 		rego.EvalInterQueryBuiltinCache(s.interQueryBuiltinCache),
 		rego.EvalInstrument(includeInstrumentation),
+		rego.EvalNDBuiltinCache(ndbCache),
 	}
 
 	rs, err := preparedQuery.Eval(
@@ -1599,7 +1751,7 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 
 	// Handle results.
 	if err != nil {
-		_ = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, err, m)
+		_ = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, err, m)
 		writer.ErrorAuto(w, err)
 		return
 	}
@@ -1608,6 +1760,10 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 		DecisionID: decisionID,
 	}
 
+	if input == nil {
+		result.Warning = types.NewWarning(types.CodeAPIUsageWarn, types.MsgInputKeyMissing)
+	}
+
 	if includeMetrics || includeInstrumentation {
 		result.Metrics = m.All()
 	}
@@ -1618,18 +1774,18 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 
 	if len(rs) == 0 {
 		if explainMode == types.ExplainFullV1 {
-			result.Explanation, err = types.NewTraceV1(*buf, pretty)
+			result.Explanation, err = types.NewTraceV1(lineage.Full(*buf), pretty)
 			if err != nil {
 				writer.ErrorAuto(w, err)
 				return
 			}
 		}
-		err = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, nil, nil, m)
+		err = logger.Log(ctx, txn, urlPath, "", goInput, input, nil, ndbCache, nil, m)
 		if err != nil {
 			writer.ErrorAuto(w, err)
 			return
 		}
-		writer.JSON(w, 200, result, pretty)
+		writer.JSON(w, http.StatusOK, result, pretty)
 		return
 	}
 
@@ -1639,23 +1795,30 @@ func (s *Server) v1DataPost(w http.ResponseWriter, r *http.Request) {
 		result.Explanation = s.getExplainResponse(explainMode, *buf, pretty)
 	}
 
-	err = logger.Log(ctx, txn, decisionID, r.RemoteAddr, urlPath, "", goInput, input, result.Result, nil, m)
+	err = logger.Log(ctx, txn, urlPath, "", goInput, input, result.Result, ndbCache, nil, m)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
 	}
-	writer.JSON(w, 200, result, pretty)
+	writer.JSON(w, http.StatusOK, result, pretty)
 }
 
 func (s *Server) v1DataPut(w http.ResponseWriter, r *http.Request) {
+	m := metrics.New()
+	m.Timer(metrics.ServerHandler).Start()
+	defer m.Timer(metrics.ServerHandler).Stop()
+
 	ctx := r.Context()
 	vars := mux.Vars(r)
+	includeMetrics := getBoolParam(r.URL, types.ParamMetricsV1, true)
 
+	m.Timer(metrics.RegoInputParse).Start()
 	var value interface{}
 	if err := util.NewJSONDecoder(r.Body).Decode(&value); err != nil {
 		writer.ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, err)
 		return
 	}
+	m.Timer(metrics.RegoInputParse).Stop()
 
 	path, ok := storage.ParsePathEscaped("/" + strings.Trim(vars["path"], "/"))
 	if !ok {
@@ -1663,7 +1826,9 @@ func (s *Server) v1DataPut(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	txn, err := s.store.NewTransaction(ctx, storage.WriteParams)
+	params := storage.WriteParams
+	params.Context = storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1675,19 +1840,20 @@ func (s *Server) v1DataPut(w http.ResponseWriter, r *http.Request) {
 	}
 
 	_, err = s.store.Read(ctx, txn, path)
-
 	if err != nil {
 		if !storage.IsNotFound(err) {
 			s.abortAuto(ctx, txn, w, err)
 			return
 		}
-		if err := storage.MakeDir(ctx, s.store, txn, path[:len(path)-1]); err != nil {
-			s.abortAuto(ctx, txn, w, err)
-			return
+		if len(path) > 0 {
+			if err := storage.MakeDir(ctx, s.store, txn, path[:len(path)-1]); err != nil {
+				s.abortAuto(ctx, txn, w, err)
+				return
+			}
 		}
 	} else if r.Header.Get("If-None-Match") == "*" {
 		s.store.Abort(ctx, txn)
-		writer.Bytes(w, 304, nil)
+		writer.Bytes(w, http.StatusNotModified, nil)
 		return
 	}
 
@@ -1704,14 +1870,28 @@ func (s *Server) v1DataPut(w http.ResponseWriter, r *http.Request) {
 
 	if err := s.store.Commit(ctx, txn); err != nil {
 		writer.ErrorAuto(w, err)
-	} else {
-		writer.Bytes(w, 204, nil)
+		return
 	}
+
+	if includeMetrics {
+		result := types.DataResponseV1{
+			Metrics: m.All(),
+		}
+		writer.JSON(w, http.StatusOK, result, false)
+		return
+	}
+
+	writer.Bytes(w, http.StatusNoContent, nil)
 }
 
 func (s *Server) v1DataDelete(w http.ResponseWriter, r *http.Request) {
+	m := metrics.New()
+	m.Timer(metrics.ServerHandler).Start()
+	defer m.Timer(metrics.ServerHandler).Stop()
+
 	ctx := r.Context()
 	vars := mux.Vars(r)
+	includeMetrics := getBoolParam(r.URL, types.ParamMetricsV1, true)
 
 	path, ok := storage.ParsePathEscaped("/" + strings.Trim(vars["path"], "/"))
 	if !ok {
@@ -1719,7 +1899,9 @@ func (s *Server) v1DataDelete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	txn, err := s.store.NewTransaction(ctx, storage.WriteParams)
+	params := storage.WriteParams
+	params.Context = storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1743,16 +1925,25 @@ func (s *Server) v1DataDelete(w http.ResponseWriter, r *http.Request) {
 
 	if err := s.store.Commit(ctx, txn); err != nil {
 		writer.ErrorAuto(w, err)
-	} else {
-		writer.Bytes(w, 204, nil)
+		return
+	}
+
+	if includeMetrics {
+		result := types.DataResponseV1{
+			Metrics: m.All(),
+		}
+		writer.JSON(w, http.StatusOK, result, false)
+		return
 	}
+
+	writer.Bytes(w, http.StatusNoContent, nil)
 }
 
 func (s *Server) v1PoliciesDelete(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	vars := mux.Vars(r)
 	pretty := getBoolParam(r.URL, types.ParamPrettyV1, true)
-	includeMetrics := getBoolParam(r.URL, types.ParamPrettyV1, true)
+	includeMetrics := getBoolParam(r.URL, types.ParamMetricsV1, true)
 
 	id, err := url.PathUnescape(vars["path"])
 	if err != nil {
@@ -1761,8 +1952,9 @@ func (s *Server) v1PoliciesDelete(w http.ResponseWriter, r *http.Request) {
 	}
 
 	m := metrics.New()
-
-	txn, err := s.store.NewTransaction(ctx, storage.WriteParams)
+	params := storage.WriteParams
+	params.Context = storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -1900,7 +2092,7 @@ func (s *Server) v1PoliciesPut(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	vars := mux.Vars(r)
 
-	path, err := url.PathUnescape(vars["path"])
+	id, err := url.PathUnescape(vars["path"])
 	if err != nil {
 		writer.ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, err)
 		return
@@ -1912,7 +2104,7 @@ func (s *Server) v1PoliciesPut(w http.ResponseWriter, r *http.Request) {
 
 	m.Timer("server_read_bytes").Start()
 
-	buf, err := ioutil.ReadAll(r.Body)
+	buf, err := io.ReadAll(r.Body)
 	if err != nil {
 		writer.ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, err)
 		return
@@ -1920,13 +2112,20 @@ func (s *Server) v1PoliciesPut(w http.ResponseWriter, r *http.Request) {
 
 	m.Timer("server_read_bytes").Stop()
 
-	txn, err := s.store.NewTransaction(ctx, storage.WriteParams)
+	params := storage.WriteParams
+	params.Context = storage.NewContext().WithMetrics(m)
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
 	}
 
-	if bs, err := s.store.GetPolicy(ctx, txn, path); err != nil {
+	if err := s.checkPolicyIDScope(ctx, txn, id); err != nil && !storage.IsNotFound(err) {
+		s.abortAuto(ctx, txn, w, err)
+		return
+	}
+
+	if bs, err := s.store.GetPolicy(ctx, txn, id); err != nil {
 		if !storage.IsNotFound(err) {
 			s.abortAuto(ctx, txn, w, err)
 			return
@@ -1942,7 +2141,7 @@ func (s *Server) v1PoliciesPut(w http.ResponseWriter, r *http.Request) {
 	}
 
 	m.Timer(metrics.RegoModuleParse).Start()
-	parsedMod, err := ast.ParseModule(path, string(buf))
+	parsedMod, err := ast.ParseModule(id, string(buf))
 	m.Timer(metrics.RegoModuleParse).Stop()
 
 	if err != nil {
@@ -1973,7 +2172,7 @@ func (s *Server) v1PoliciesPut(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	modules[path] = parsedMod
+	modules[id] = parsedMod
 
 	c := ast.NewCompiler().
 		SetErrorLimit(s.errLimit).
@@ -1991,7 +2190,7 @@ func (s *Server) v1PoliciesPut(w http.ResponseWriter, r *http.Request) {
 
 	m.Timer(metrics.RegoModuleCompile).Stop()
 
-	if err := s.store.UpsertPolicy(ctx, txn, path, buf); err != nil {
+	if err := s.store.UpsertPolicy(ctx, txn, id, buf); err != nil {
 		s.abortAuto(ctx, txn, w, err)
 		return
 	}
@@ -2014,8 +2213,9 @@ func (s *Server) v1QueryGet(w http.ResponseWriter, r *http.Request) {
 	m := metrics.New()
 
 	decisionID := s.generateDecisionID()
+	ctx := logging.WithDecisionID(r.Context(), decisionID)
+	annotateSpan(ctx, decisionID)
 
-	ctx := r.Context()
 	values := r.URL.Query()
 
 	qStrs := values[types.ParamQueryV1]
@@ -2042,7 +2242,8 @@ func (s *Server) v1QueryGet(w http.ResponseWriter, r *http.Request) {
 	includeMetrics := getBoolParam(r.URL, types.ParamMetricsV1, true)
 	includeInstrumentation := getBoolParam(r.URL, types.ParamInstrumentV1, true)
 
-	txn, err := s.store.NewTransaction(ctx)
+	params := storage.TransactionParams{Context: storage.NewContext().WithMetrics(m)}
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -2056,7 +2257,7 @@ func (s *Server) v1QueryGet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	results, err := s.execQuery(ctx, r, br, txn, decisionID, parsedQuery, nil, m, explainMode, includeMetrics, includeInstrumentation, pretty)
+	results, err := s.execQuery(ctx, r, br, txn, parsedQuery, nil, m, explainMode, includeMetrics, includeInstrumentation, pretty)
 	if err != nil {
 		switch err := err.(type) {
 		case ast.Errors:
@@ -2067,15 +2268,16 @@ func (s *Server) v1QueryGet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	writer.JSON(w, 200, results, pretty)
+	writer.JSON(w, http.StatusOK, results, pretty)
 }
 
 func (s *Server) v1QueryPost(w http.ResponseWriter, r *http.Request) {
 	m := metrics.New()
+	m.Timer(metrics.ServerHandler).Start()
 
 	decisionID := s.generateDecisionID()
-
-	ctx := r.Context()
+	ctx := logging.WithDecisionID(r.Context(), decisionID)
+	annotateSpan(ctx, decisionID)
 
 	var request types.QueryRequestV1
 	err := util.NewJSONDecoder(r.Body).Decode(&request)
@@ -2111,7 +2313,8 @@ func (s *Server) v1QueryPost(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	txn, err := s.store.NewTransaction(ctx)
+	params := storage.TransactionParams{Context: storage.NewContext().WithMetrics(m)}
+	txn, err := s.store.NewTransaction(ctx, params)
 	if err != nil {
 		writer.ErrorAuto(w, err)
 		return
@@ -2125,7 +2328,7 @@ func (s *Server) v1QueryPost(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	results, err := s.execQuery(ctx, r, br, txn, decisionID, parsedQuery, input, m, explainMode, includeMetrics, includeInstrumentation, pretty)
+	results, err := s.execQuery(ctx, r, br, txn, parsedQuery, input, m, explainMode, includeMetrics, includeInstrumentation, pretty)
 	if err != nil {
 		switch err := err.(type) {
 		case ast.Errors:
@@ -2136,7 +2339,13 @@ func (s *Server) v1QueryPost(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	writer.JSON(w, 200, results, pretty)
+	m.Timer(metrics.ServerHandler).Stop()
+
+	if includeMetrics || includeInstrumentation {
+		results.Metrics = m.All()
+	}
+
+	writer.JSON(w, http.StatusOK, results, pretty)
 }
 
 func (s *Server) v1ConfigGet(w http.ResponseWriter, r *http.Request) {
@@ -2270,7 +2479,13 @@ func (s *Server) getExplainResponse(explainMode types.ExplainModeV1, trace []*to
 		}
 	case types.ExplainFullV1:
 		var err error
-		explanation, err = types.NewTraceV1(trace, pretty)
+		explanation, err = types.NewTraceV1(lineage.Full(trace), pretty)
+		if err != nil {
+			break
+		}
+	case types.ExplainDebugV1:
+		var err error
+		explanation, err = types.NewTraceV1(lineage.Debug(trace), pretty)
 		if err != nil {
 			break
 		}
@@ -2317,7 +2532,17 @@ func (s *Server) getCompiler() *ast.Compiler {
 	return s.manager.GetCompiler()
 }
 
-func (s *Server) makeRego(ctx context.Context, partial bool, txn storage.Transaction, input ast.Value, urlPath string, m metrics.Metrics, instrument bool, tracer topdown.QueryTracer, opts []func(*rego.Rego)) (*rego.Rego, error) {
+func (s *Server) makeRego(ctx context.Context,
+	partial bool,
+	strictBuiltinErrors bool,
+	txn storage.Transaction,
+	input ast.Value,
+	urlPath string,
+	m metrics.Metrics,
+	instrument bool,
+	tracer topdown.QueryTracer,
+	opts []func(*rego.Rego),
+) (*rego.Rego, error) {
 	queryPath := stringPathToDataRef(urlPath).String()
 
 	opts = append(
@@ -2330,7 +2555,9 @@ func (s *Server) makeRego(ctx context.Context, partial bool, txn storage.Transac
 		rego.Instrument(instrument),
 		rego.Runtime(s.runtime),
 		rego.UnsafeBuiltins(unsafeBuiltinsMap),
+		rego.StrictBuiltinErrors(strictBuiltinErrors),
 		rego.PrintHook(s.manager.PrintHook()),
+		rego.DistributedTracingOpts(s.distributedTracingOpts),
 	)
 
 	if partial {
@@ -2394,7 +2621,7 @@ func (s *Server) prepareV1PatchSlice(root string, ops []types.PatchV1) (result [
 		}
 
 		var ok bool
-		impl.path, ok = parsePatchPathEscaped(path)
+		impl.path, ok = patch.ParsePatchPathEscaped(path)
 		if !ok {
 			return nil, types.BadPatchPathErr(op.Path)
 		}
@@ -2460,37 +2687,10 @@ func (s *Server) updateCacheConfig(cacheConfig *iCache.Config) {
 	s.interQueryBuiltinCache.UpdateConfig(cacheConfig)
 }
 
-// parsePatchPathEscaped returns a new path for the given escaped str.
-// This is based on storage.ParsePathEscaped so will do URL unescaping of
-// the provided str for backwards compatibility, but also handles the
-// specific escape strings defined in RFC 6901 (JSON Pointer) because
-// that's what's mandated by RFC 6902 (JSON Patch).
-func parsePatchPathEscaped(str string) (path storage.Path, ok bool) {
-	path, ok = storage.ParsePathEscaped(str)
-	if !ok {
-		return
-	}
-	for i := range path {
-		// RFC 6902 section 4: "[The "path" member's] value is a string containing
-		// a JSON-Pointer value [RFC6901] that references a location within the
-		// target document (the "target location") where the operation is performed."
-		//
-		// RFC 6901 section 3: "Because the characters '~' (%x7E) and '/' (%x2F)
-		// have special meanings in JSON Pointer, '~' needs to be encoded as '~0'
-		// and '/' needs to be encoded as '~1' when these characters appear in a
-		// reference token."
-
-		// RFC 6901 section 4: "Evaluation of each reference token begins by
-		// decoding any escaped character sequence.  This is performed by first
-		// transforming any occurrence of the sequence '~1' to '/', and then
-		// transforming any occurrence of the sequence '~0' to '~'.  By performing
-		// the substitutions in this order, an implementation avoids the error of
-		// turning '~01' first into '~1' and then into '/', which would be
-		// incorrect (the string '~01' correctly becomes '~1' after transformation)."
-		path[i] = strings.Replace(path[i], "~1", "/", -1)
-		path[i] = strings.Replace(path[i], "~0", "~", -1)
-	}
-	return
+func (s *Server) updateNDCache(enabled bool) {
+	s.mtx.Lock()
+	defer s.mtx.Unlock()
+	s.ndbCacheEnabled = enabled
 }
 
 func stringPathToDataRef(s string) (r ast.Ref) {
@@ -2522,13 +2722,7 @@ func stringPathToRef(s string) (r ast.Ref) {
 }
 
 func validateQuery(query string) (ast.Body, error) {
-
-	var body ast.Body
-	body, err := ast.ParseBody(query)
-	if err != nil {
-		return nil, err
-	}
-	return body, nil
+	return ast.ParseBody(query)
 }
 
 func getBoolParam(url *url.URL, name string, ifEmpty bool) bool {
@@ -2576,6 +2770,8 @@ func getExplain(p []string, zero types.ExplainModeV1) types.ExplainModeV1 {
 			return types.ExplainNotesV1
 		case string(types.ExplainFullV1):
 			return types.ExplainFullV1
+		case string(types.ExplainDebugV1):
+			return types.ExplainDebugV1
 		}
 	}
 	return zero
@@ -2588,24 +2784,29 @@ func readInputV0(r *http.Request) (ast.Value, error) {
 		return ast.InterfaceToValue(parsed)
 	}
 
-	bs, err := ioutil.ReadAll(r.Body)
+	// decompress the input if sent as zip
+	body, err := readPlainBody(r)
 	if err != nil {
-		return nil, err
-	}
-
-	bs = bytes.TrimSpace(bs)
-	if len(bs) == 0 {
-		return nil, nil
+		return nil, fmt.Errorf("could not decompress the body: %w", err)
 	}
 
 	var x interface{}
 
 	if strings.Contains(r.Header.Get("Content-Type"), "yaml") {
-		if err := util.Unmarshal(bs, &x); err != nil {
+		bs, err := io.ReadAll(body)
+		if err != nil {
 			return nil, err
 		}
-	} else if err := util.UnmarshalJSON(bs, &x); err != nil {
-		return nil, err
+		if len(bs) > 0 {
+			if err = util.Unmarshal(bs, &x); err != nil {
+				return nil, fmt.Errorf("body contains malformed input document: %w", err)
+			}
+		}
+	} else {
+		dec := util.NewJSONDecoder(body)
+		if err := dec.Decode(&x); err != nil && err != io.EOF {
+			return nil, fmt.Errorf("body contains malformed input document: %w", err)
+		}
 	}
 
 	return ast.InterfaceToValue(x)
@@ -2614,7 +2815,7 @@ func readInputV0(r *http.Request) (ast.Value, error) {
 func readInputGetV1(str string) (ast.Value, error) {
 	var input interface{}
 	if err := util.UnmarshalJSON([]byte(str), &input); err != nil {
-		return nil, errors.Wrapf(err, "parameter contains malformed input document")
+		return nil, fmt.Errorf("parameter contains malformed input document: %w", err)
 	}
 	return ast.InterfaceToValue(input)
 }
@@ -2631,42 +2832,50 @@ func readInputPostV1(r *http.Request) (ast.Value, error) {
 		return nil, nil
 	}
 
-	bs, err := ioutil.ReadAll(r.Body)
+	var request types.DataRequestV1
 
+	// decompress the input if sent as zip
+	body, err := readPlainBody(r)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("could not decompress the body: %w", err)
 	}
 
-	if len(bs) > 0 {
-
-		ct := r.Header.Get("Content-Type")
-
-		var request types.DataRequestV1
-
-		// There is no standard for yaml mime-type so we just look for
-		// anything related
-		if strings.Contains(ct, "yaml") {
-			if err := util.Unmarshal(bs, &request); err != nil {
-				return nil, errors.Wrapf(err, "body contains malformed input document")
+	ct := r.Header.Get("Content-Type")
+	// There is no standard for yaml mime-type so we just look for
+	// anything related
+	if strings.Contains(ct, "yaml") {
+		bs, err := io.ReadAll(body)
+		if err != nil {
+			return nil, err
+		}
+		if len(bs) > 0 {
+			if err = util.Unmarshal(bs, &request); err != nil {
+				return nil, fmt.Errorf("body contains malformed input document: %w", err)
 			}
-		} else if err := util.UnmarshalJSON(bs, &request); err != nil {
-			return nil, errors.Wrapf(err, "body contains malformed input document")
 		}
-
-		if request.Input == nil {
-			return nil, nil
+	} else {
+		dec := util.NewJSONDecoder(body)
+		if err := dec.Decode(&request); err != nil && err != io.EOF {
+			return nil, fmt.Errorf("body contains malformed input document: %w", err)
 		}
+	}
 
-		return ast.InterfaceToValue(*request.Input)
+	if request.Input == nil {
+		return nil, nil
 	}
 
-	return nil, nil
+	return ast.InterfaceToValue(*request.Input)
 }
 
 type compileRequest struct {
 	Query    ast.Body
 	Input    ast.Value
 	Unknowns []*ast.Term
+	Options  compileRequestOptions
+}
+
+type compileRequestOptions struct {
+	DisableInlining []string
 }
 
 func readInputCompilePostV1(r io.ReadCloser) (*compileRequest, *types.ErrorV1) {
@@ -2713,6 +2922,9 @@ func readInputCompilePostV1(r io.ReadCloser) (*compileRequest, *types.ErrorV1) {
 		Query:    query,
 		Input:    input,
 		Unknowns: unknowns,
+		Options: compileRequestOptions{
+			DisableInlining: request.Options.DisableInlining,
+		},
 	}
 
 	return result, nil
@@ -2781,20 +2993,26 @@ type decisionLogger struct {
 	logger    func(context.Context, *Info) error
 }
 
-func (l decisionLogger) Log(ctx context.Context, txn storage.Transaction, decisionID, remoteAddr, path string, query string, goInput *interface{}, astInput ast.Value, goResults *interface{}, err error, m metrics.Metrics) error {
+func (l decisionLogger) Log(ctx context.Context, txn storage.Transaction, path string, query string, goInput *interface{}, astInput ast.Value, goResults *interface{}, ndbCache builtins.NDBCache, err error, m metrics.Metrics) error {
 
 	bundles := map[string]BundleInfo{}
 	for name, rev := range l.revisions {
 		bundles[name] = BundleInfo{Revision: rev}
 	}
 
+	rctx := logging.RequestContext{}
+	if r, ok := logging.FromContext(ctx); ok {
+		rctx = *r
+	}
+	decisionID, _ := logging.DecisionIDFromContext(ctx)
+
 	info := &Info{
 		Txn:        txn,
 		Revision:   l.revision,
 		Bundles:    bundles,
 		Timestamp:  time.Now().UTC(),
 		DecisionID: decisionID,
-		RemoteAddr: remoteAddr,
+		RemoteAddr: rctx.ClientAddr,
 		Path:       path,
 		Query:      query,
 		Input:      goInput,
@@ -2802,11 +3020,26 @@ func (l decisionLogger) Log(ctx context.Context, txn storage.Transaction, decisi
 		Results:    goResults,
 		Error:      err,
 		Metrics:    m,
+		RequestID:  rctx.ReqID,
+	}
+
+	if ndbCache != nil {
+		x, err := ast.JSON(ndbCache.AsValue())
+		if err != nil {
+			return err
+		}
+		info.NDBuiltinCache = &x
+	}
+
+	sctx := trace.SpanFromContext(ctx).SpanContext()
+	if sctx.IsValid() {
+		info.TraceID = sctx.TraceID().String()
+		info.SpanID = sctx.SpanID().String()
 	}
 
 	if l.logger != nil {
 		if err := l.logger(ctx, info); err != nil {
-			return errors.Wrap(err, "decision_logs")
+			return fmt.Errorf("decision_logs: %w", err)
 		}
 	}
 
@@ -2829,3 +3062,27 @@ func parseURL(s string, useHTTPSByDefault bool) (*url.URL, error) {
 	}
 	return url.Parse(s)
 }
+
+func annotateSpan(ctx context.Context, decisionID string) {
+	if decisionID == "" {
+		return
+	}
+	trace.SpanFromContext(ctx).
+		SetAttributes(attribute.String(otelDecisionIDAttr, decisionID))
+}
+
+func readPlainBody(r *http.Request) (io.ReadCloser, error) {
+	if strings.Contains(r.Header.Get("Content-Encoding"), "gzip") {
+		gzReader, err := gzip.NewReader(r.Body)
+		if err != nil {
+			return nil, err
+		}
+		bytesBody, err := io.ReadAll(gzReader)
+		if err != nil {
+			return nil, err
+		}
+		defer gzReader.Close()
+		return io.NopCloser(bytes.NewReader(bytesBody)), err
+	}
+	return r.Body, nil
+}
diff --git a/server/server_test.go b/server/server_test.go
index 56994b40b2..3335b2601a 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -7,24 +7,33 @@ package server
 
 import (
 	"bytes"
+	"compress/gzip"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"log"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"reflect"
 	"sort"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/gorilla/mux"
-	"github.com/pkg/errors"
+	"github.com/open-policy-agent/opa/internal/prometheus"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/propagation"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/config"
+	"github.com/open-policy-agent/opa/internal/distributedtracing"
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/plugins"
 	pluginBundle "github.com/open-policy-agent/opa/plugins/bundle"
@@ -32,9 +41,13 @@ import (
 	"github.com/open-policy-agent/opa/server/authorizer"
 	"github.com/open-policy-agent/opa/server/identifier"
 	"github.com/open-policy-agent/opa/server/types"
+	"github.com/open-policy-agent/opa/server/writer"
 	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/disk"
 	"github.com/open-policy-agent/opa/storage/inmem"
+	"github.com/open-policy-agent/opa/tracing"
 	"github.com/open-policy-agent/opa/util"
+	"github.com/open-policy-agent/opa/util/test"
 	"github.com/open-policy-agent/opa/version"
 )
 
@@ -842,6 +855,10 @@ func TestCompileV1(t *testing.T) {
 	default r = true
 
 	r { input.x = 1 }
+
+	custom_func(x) { data.a[i] == x }
+
+	s { custom_func(input.x) }
 	`
 
 	expQuery := func(s string) string {
@@ -912,6 +929,34 @@ func TestCompileV1(t *testing.T) {
 					`)},
 			},
 		},
+		{
+			note: "function without disableInlining",
+			trs: []tr{
+				{http.MethodPut, "/policies/test", mod, 200, ""},
+				{http.MethodPost, "/compile", `{
+					"unknowns": ["data.a"],
+					"query": "data.test.s = true",
+					"input": { "x": 1 }
+				}`, 200, expQuery("data.a[i2] = 1")},
+			},
+		},
+		{
+			note: "function with disableInlining",
+			trs: []tr{
+				{http.MethodPut, "/policies/test", mod, 200, ""},
+				{http.MethodPost, "/compile", `{
+					"unknowns": ["data.a"],
+					"query": "data.test.s = true",
+					"options": { "disableInlining": ["data.test"] },
+					"input": { "x": 1 }
+				}`, 200, expQueryAndSupport(
+					`data.partial.test.s = true`,
+					`package partial.test
+					s { data.partial.test.custom_func(1) }
+					custom_func(__local0__2) { data.a[i2] = __local0__2 }
+					`)},
+			},
+		},
 		{
 			note: "empty unknowns",
 			trs: []tr{
@@ -956,35 +1001,49 @@ func TestCompileV1(t *testing.T) {
 }
 
 func TestCompileV1Observability(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	test.WithTempFS(nil, func(root string) {
+		disk, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir: root})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer disk.Close(ctx)
+		f := newFixtureWithStore(t, disk)
 
-	f := newFixture(t)
-
-	err := f.v1(http.MethodPut, "/policies/test", `package test
+		err = f.v1(http.MethodPut, "/policies/test", `package test
 
 	p { input.x = 1 }`, 200, "")
-	if err != nil {
-		t.Fatal(err)
-	}
+		if err != nil {
+			t.Fatal(err)
+		}
 
-	compileReq := newReqV1(http.MethodPost, "/compile?metrics&explain=full", `{
+		compileReq := newReqV1(http.MethodPost, "/compile?metrics&explain=full", `{
 		"query": "data.test.p = true"
 	}`)
 
-	f.reset()
-	f.server.Handler.ServeHTTP(f.recorder, compileReq)
+		f.reset()
+		f.server.Handler.ServeHTTP(f.recorder, compileReq)
 
-	var response types.CompileResponseV1
-	if err := json.NewDecoder(f.recorder.Body).Decode(&response); err != nil {
-		t.Fatal(err)
-	}
+		var response types.CompileResponseV1
+		if err := json.NewDecoder(f.recorder.Body).Decode(&response); err != nil {
+			t.Fatal(err)
+		}
 
-	if len(response.Explanation) == 0 {
-		t.Fatal("Expected non-empty explanation")
-	}
+		if len(response.Explanation) == 0 {
+			t.Fatal("Expected non-empty explanation")
+		}
 
-	if _, ok := response.Metrics["timer_rego_partial_eval_ns"]; !ok {
-		t.Fatal("Expected partial evaluation latency")
-	}
+		assertMetricsExist(t, response.Metrics, []string{
+			"timer_rego_partial_eval_ns",
+			"timer_rego_query_compile_ns",
+			"timer_rego_query_parse_ns",
+			"timer_rego_module_parse_ns",
+			"timer_server_handler_ns",
+			"counter_disk_read_keys",
+			"timer_disk_read_ns",
+		})
+	})
 }
 
 func TestCompileV1UnsafeBuiltin(t *testing.T) {
@@ -1140,13 +1199,23 @@ p = true { false }`
 		}},
 		{"patch root", []tr{
 			{http.MethodPatch, "/data", `[
-				{"op": "add",
-				 "path": "/",
-				 "value": {"a": 1, "b": 2}
+				{
+					"op": "add",
+					"path": "/",
+					"value": {"a": 1, "b": 2}
 				}
 			]`, 204, ""},
 			{http.MethodGet, "/data", "", 200, `{"result": {"a": 1, "b": 2}}`},
 		}},
+		{"patch root invalid", []tr{
+			{http.MethodPatch, "/data", `[
+				{
+					"op": "add",
+					"path": "/",
+					"value": [1,2,3]
+				}
+			]`, 400, ""},
+		}},
 		{"patch invalid", []tr{
 			{http.MethodPatch, "/data", `[
 				{
@@ -1275,9 +1344,26 @@ p = true { false }`
 			{http.MethodGet, "/data", "", 200, `{"result": {"testmod": {"p": [1,2,3,4], "q": {"a":1, "b": 2}}, "x": [1,2,3,4]}}`},
 		}},
 		{"post root", []tr{
-			{http.MethodPost, "/data", "", 200, `{"result": {}}`},
+			{http.MethodPost, "/data", "", 200, `{
+				"result": {},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 			{http.MethodPut, "/policies/test", testMod2, 200, ""},
-			{http.MethodPost, "/data", "", 200, `{"result": {"testmod": {"p": [1,2,3,4], "q": {"b": 2, "a": 1}}}}`},
+			{http.MethodPost, "/data", "", 200, `{
+				"result": {
+					"testmod": {
+						"p": [1,2,3,4],
+						"q": {"b": 2, "a": 1}
+					}
+				},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 		}},
 		{"post input", []tr{
 			{http.MethodPut, "/policies/test", testMod1, 200, ""},
@@ -1290,7 +1376,13 @@ p = true { false }`
 			}`},
 		}},
 		{"post empty object", []tr{
-			{http.MethodPost, "/data", `{}`, 200, `{"result": {}}`},
+			{http.MethodPost, "/data", `{}`, 200, `{
+				"result": {},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 		}},
 		{"post partial", []tr{
 			{http.MethodPut, "/policies/test", testMod7, 200, ""},
@@ -1313,9 +1405,20 @@ p = true { false }`
 		}},
 		{"partial invalidate data", []tr{
 			{http.MethodPut, "/policies/test", testMod8, 200, ""},
-			{http.MethodPost, "/data/testmod/p?partial", "", 200, `{}`},
+			{http.MethodPost, "/data/testmod/p?partial", "", 200, `{
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 			{http.MethodPut, "/data/x", `1`, 204, ""},
-			{http.MethodPost, "/data/testmod/p?partial", "", 200, `{"result": true}`},
+			{http.MethodPost, "/data/testmod/p?partial", "", 200, `{
+				"result": true,
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 		}},
 		{"partial ineffective fallback to normal", []tr{
 			{http.MethodPut, "/policies/test", testMod7, 200, ""},
@@ -1326,6 +1429,10 @@ p = true { false }`
 					"q": [],
 					"r": []
 					}
+				},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
 				}
 			}`},
 			{http.MethodPost, "/data", "", 200, `{
@@ -1335,6 +1442,10 @@ p = true { false }`
 					"q": [],
 					"r": []
 					}
+				},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
 				}
 			}`},
 		}},
@@ -1382,10 +1493,32 @@ p = true { false }`
 			{http.MethodGet, "/data", "", 200, `{"result": {"a/b": {"c/d": 1}}}`},
 			{http.MethodGet, "/data/a%2Fb/c%2Fd", "", 200, `{"result": 1}`},
 			{http.MethodGet, "/data/a/b", "", 200, `{}`},
-			{http.MethodPost, "/data/a%2Fb/c%2Fd", "", 200, `{"result": 1}`},
-			{http.MethodPost, "/data/a/b", "", 200, `{}`},
+			{http.MethodPost, "/data/a%2Fb/c%2Fd", "", 200, `{
+				"result": 1,
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
+			{http.MethodPost, "/data/a/b", "", 200, `{
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 			{http.MethodPatch, "/data/a%2Fb", `[{"op": "add", "path": "/e%2Ff", "value": 2}]`, 204, ""},
-			{http.MethodPost, "/data", "", 200, `{"result": {"a/b": {"c/d": 1, "e/f": 2}}}`},
+			{http.MethodPost, "/data", "", 200, `{
+				"result": {
+					"a/b": {
+						"c/d": 1,
+						"e/f": 2
+					}
+				},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 		}},
 		{"strict-builtin-errors", []tr{
 			{http.MethodPut, "/policies/test", `
@@ -1411,7 +1544,13 @@ p = true { false }`
 				  }
 				]
 			  }`},
-			{http.MethodPost, "/data/test/p", "", 200, `{"result": false}`},
+			{http.MethodPost, "/data/test/p", "", 200, `{
+				"result": false,
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
 			{http.MethodPost, "/data/test/p?strict-builtin-errors", "", 500, `{
 				"code": "internal_error",
 				"message": "error(s) occurred while evaluating query",
@@ -1428,15 +1567,79 @@ p = true { false }`
 				]
 			  }`},
 		}},
+		{"post api usage warning", []tr{
+			{http.MethodPost, "/data", "", 200, `{
+				"result": {},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				}
+			}`},
+			{http.MethodPost, "/data", `{"input": {}}`, 200, `{"result": {}}`},
+		}},
 	}
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-			executeRequests(t, tc.reqs)
+			test.WithTempFS(nil, func(root string) {
+				ctx, cancel := context.WithCancel(context.Background())
+				defer cancel()
+				disk, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir: root})
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer disk.Close(ctx)
+				executeRequests(t, tc.reqs,
+					variant{"inmem", nil},
+					variant{"disk", []func(*Server){
+						func(s *Server) {
+							s.WithStore(disk)
+						},
+					}},
+				)
+			})
 		})
 	}
 }
 
+func TestDataV1Metrics(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	test.WithTempFS(nil, func(root string) {
+		disk, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir: root})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer disk.Close(ctx)
+
+		f := newFixtureWithStore(t, disk)
+		put := newReqV1(http.MethodPut, `/data?metrics`, `{"foo":"bar"}`)
+		f.server.Handler.ServeHTTP(f.recorder, put)
+
+		if f.recorder.Code != 200 {
+			t.Fatalf("Expected success but got %v", f.recorder)
+		}
+
+		var result types.DataResponseV1
+		err = util.UnmarshalJSON(f.recorder.Body.Bytes(), &result)
+		if err != nil {
+			t.Fatalf("Unexpected error while unmarshalling result: %v", err)
+		}
+
+		assertMetricsExist(t, result.Metrics, []string{
+			"counter_disk_read_keys",
+			"counter_disk_deleted_keys",
+			"counter_disk_written_keys",
+			"counter_disk_read_bytes",
+			"timer_rego_input_parse_ns",
+			"timer_server_handler_ns",
+			"timer_disk_read_ns",
+			"timer_disk_write_ns",
+			"timer_disk_commit_ns",
+		})
+	})
+}
+
 func TestConfigV1(t *testing.T) {
 	f := newFixture(t)
 
@@ -1564,186 +1767,466 @@ func TestDataPutV1IfNoneMatch(t *testing.T) {
 	}
 }
 
-func TestParsePatchPathEscaped(t *testing.T) {
+func TestDataPostV0CompressedResponse(t *testing.T) {
 	tests := []struct {
-		note         string
-		path         string
-		expectedPath storage.Path
-		expectedOK   bool
+		gzipMinLength      int
+		compressedResponse bool
 	}{
-		// success-path tests
 		{
-			note:         "single-level",
-			path:         "/single-level",
-			expectedPath: storage.Path{"single-level"},
-			expectedOK:   true,
+			gzipMinLength:      3,
+			compressedResponse: true,
 		},
 		{
-			note:         "multi-level",
-			path:         "/a/multi-level/path",
-			expectedPath: storage.Path{"a", "multi-level", "path"},
-			expectedOK:   true,
+			gzipMinLength:      1400,
+			compressedResponse: false,
 		},
+	}
+
+	for _, test := range tests {
+		f := newFixtureWithConfig(t, fmt.Sprintf(`{"server":{"encoding":{"gzip":{"min_length": %d}}}}`, test.gzipMinLength))
+		// create the policy
+		err := f.v1(http.MethodPut, "/policies/test", `package opa.examples
+import input.example.flag
+allow_request { flag == true }
+`, 200, "")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// execute the request
+		req := newReqV0(http.MethodPost, "/data/opa/examples/allow_request", `{"example": {"flag": true}}`)
+		req.Header.Set("Accept-Encoding", "gzip")
+		f.reset()
+		f.server.Handler.ServeHTTP(f.recorder, req)
+
+		// check for content encoding
+		expectedEncoding := "gzip"
+		if !test.compressedResponse {
+			expectedEncoding = ""
+		}
+		receivedEncodingHeaderValue := f.recorder.Header().Get("Content-Encoding")
+		if receivedEncodingHeaderValue != expectedEncoding {
+			t.Fatalf("Expected Content-Encoding %v but got: %v", expectedEncoding, receivedEncodingHeaderValue)
+		}
+
+		var plainOutput []byte
+		if test.compressedResponse {
+			// unzip the response
+			gzReader, err := gzip.NewReader(f.recorder.Body)
+			if err != nil {
+				t.Fatalf("Unexpected gzip error: %v", err)
+			}
+			plainOutput, err = io.ReadAll(gzReader)
+			if err != nil {
+				t.Fatalf("Unexpected error on reading the response: %v", err)
+			}
+		} else {
+			plainOutput = f.recorder.Body.Bytes()
+		}
+
+		expected := "true"
+		result := strings.TrimSuffix(string(plainOutput), "\n")
+		if plainOutput == nil || result != expected {
+			t.Fatalf("Expected %v but got: %v", expected, result)
+		}
+	}
+}
+
+func TestDataPostV1CompressedResponse(t *testing.T) {
+	tests := []struct {
+		gzipMinLength      int
+		compressedResponse bool
+	}{
 		{
-			note:         "end",
-			path:         "/-",
-			expectedPath: storage.Path{"-"},
-			expectedOK:   true,
-		},
-		{ // not strictly correct but included for backwards compatibility with existing OPA
-			note:         "url-escaped forward slash",
-			path:         "/github.com%2Fopen-policy-agent",
-			expectedPath: storage.Path{"github.com/open-policy-agent"},
-			expectedOK:   true,
+			gzipMinLength:      3,
+			compressedResponse: true,
 		},
 		{
-			note:         "json-pointer-escaped forward slash",
-			path:         "/github.com~1open-policy-agent",
-			expectedPath: storage.Path{"github.com/open-policy-agent"},
-			expectedOK:   true,
+			gzipMinLength:      1400,
+			compressedResponse: false,
 		},
+	}
+
+	for _, test := range tests {
+		f := newFixtureWithConfig(t, fmt.Sprintf(`{"server":{"encoding":{"gzip":{"min_length": %d}}}}`, test.gzipMinLength))
+		// create the policy
+		err := f.v1(http.MethodPut, "/policies/test", `package test
+default hello := false
+hello {
+	input.message == "world"
+}
+`, 200, "")
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// execute the request
+		req := newReqV1(http.MethodPost, "/data/test", `{"input": {"message": "world"}}`)
+		req.Header.Set("Accept-Encoding", "gzip")
+		f.reset()
+		f.server.Handler.ServeHTTP(f.recorder, req)
+
+		var result types.DataResponseV1
+
+		// check for content encoding
+		expectedEncoding := "gzip"
+		if !test.compressedResponse {
+			expectedEncoding = ""
+		}
+		receivedEncodingHeaderValue := f.recorder.Header().Get("Content-Encoding")
+		if receivedEncodingHeaderValue != expectedEncoding {
+			t.Fatalf("Expected Content-Encoding %v but got: %v", expectedEncoding, receivedEncodingHeaderValue)
+		}
+
+		if test.compressedResponse {
+			// unzip and unmarshall the response
+			gzReader, err := gzip.NewReader(f.recorder.Body)
+			if err != nil {
+				t.Fatalf("Unexpected gzip error: %v", err)
+			}
+			if err := util.NewJSONDecoder(gzReader).Decode(&result); err != nil {
+				t.Fatalf("Unexpected JSON decode error: %v", err)
+			}
+		} else {
+			// unmarshall the response
+			if err := util.NewJSONDecoder(f.recorder.Body).Decode(&result); err != nil {
+				t.Fatalf("Unexpected JSON decode error: %v", err)
+			}
+		}
+
+		var expected interface{}
+		if err := util.UnmarshalJSON([]byte(`{"hello": true}`), &expected); err != nil {
+			panic(err)
+		}
+		if result.Result == nil || !reflect.DeepEqual(*result.Result, expected) {
+			t.Fatalf("Expected %v but got: %v", expected, *result.Result)
+		}
+	}
+}
+
+func TestCompileV1CompressedResponse(t *testing.T) {
+	tests := []struct {
+		gzipMinLength      int
+		compressedResponse bool
+	}{
 		{
-			note:         "json-pointer-escaped tilde",
-			path:         "/~0opa",
-			expectedPath: storage.Path{"~opa"},
-			expectedOK:   true,
+			gzipMinLength:      3,
+			compressedResponse: true,
 		},
 		{
-			note:         "json-pointer-escape correctness",
-			path:         "/~01",
-			expectedPath: storage.Path{"~1"},
-			expectedOK:   true,
+			gzipMinLength:      1400,
+			compressedResponse: false,
 		},
+	}
 
-		// failure-path tests
-		{ // not possible with existing callers but for completeness...
-			note:       "empty string",
-			path:       "",
-			expectedOK: false,
-		},
-		{ // not possible with existing callers but for completeness...
-			note:       "string that doesn't start with /",
-			path:       "foo",
-			expectedOK: false,
-		},
+	for _, test := range tests {
+		f := newFixtureWithConfig(t, fmt.Sprintf(`{"server":{"encoding":{"gzip":{"min_length": %d}}}}`, test.gzipMinLength))
+
+		// create the policy
+		mod := `package test
+
+	p {
+		input.x = 1
 	}
 
-	for _, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
-			actualPath, actualOK := parsePatchPathEscaped(tc.path)
+	q {
+		data.a[i] = input.x
+	}
 
-			if tc.expectedOK != actualOK {
-				t.Fatalf("Expected ok to be %v but was %v", tc.expectedOK, actualOK)
-			}
+	default r = true
+
+	r { input.x = 1 }
+
+	custom_func(x) { data.a[i] == x }
+
+	s { custom_func(input.x) }
+	`
+		err := f.v1(http.MethodPut, "/policies/test", mod, 200, "")
+		if err != nil {
+			t.Fatal(err)
+		}
 
-			if !reflect.DeepEqual(tc.expectedPath, actualPath) {
-				t.Fatalf("Expected path to be %v but was %v", tc.expectedPath, actualPath)
+		// execute the request
+		req := newReqV1(http.MethodPost, "/compile", `{"unknowns": ["input"], "query": "data.test.p = true"}`)
+		req.Header.Set("Accept-Encoding", "gzip")
+		f.reset()
+		f.server.Handler.ServeHTTP(f.recorder, req)
+
+		var result types.CompileResponseV1
+
+		// check for content encoding
+		expectedEncoding := "gzip"
+		if !test.compressedResponse {
+			expectedEncoding = ""
+		}
+		receivedEncodingHeaderValue := f.recorder.Header().Get("Content-Encoding")
+		if receivedEncodingHeaderValue != expectedEncoding {
+			t.Fatalf("Expected Content-Encoding %v but got: %v", expectedEncoding, receivedEncodingHeaderValue)
+		}
+
+		if test.compressedResponse {
+			// unzip and unmarshall the response
+			gzReader, err := gzip.NewReader(f.recorder.Body)
+			if err != nil {
+				t.Fatalf("Unexpected gzip error: %v", err)
 			}
-		})
+			if err := util.NewJSONDecoder(gzReader).Decode(&result); err != nil {
+				t.Fatalf("Unexpected JSON decode error: %v", err)
+			}
+		} else {
+			// unmarshall the response
+			if err := util.NewJSONDecoder(f.recorder.Body).Decode(&result); err != nil {
+				t.Fatalf("Unexpected JSON decode error: %v", err)
+			}
+		}
+
+		var expected interface{}
+		expectedStr := fmt.Sprintf(`{"queries": [%v]}`, string(util.MustMarshalJSON(ast.MustParseBody("input.x = 1"))))
+		if err := util.UnmarshalJSON([]byte(expectedStr), &expected); err != nil {
+			panic(err)
+		}
+
+		if result.Result == nil || !reflect.DeepEqual(*result.Result, expected) {
+			t.Fatalf("Expected %v but got: %v", expected, *result.Result)
+		}
 	}
 }
 
-func TestBundleScope(t *testing.T) {
+func TestDataPostV0CompressedRequest(t *testing.T) {
+	f := newFixture(t)
+	// create the policy
+	err := f.v1(http.MethodPut, "/policies/test", `package opa.examples
+import input.example.flag
+allow_request { flag == true }
+`, 200, "")
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	ctx := context.Background()
+	// execute the request
+	compressedBoy := zipString(`{"example": {"flag": true}}`)
+	req := newStreamedReqV0(http.MethodPost, "/data/opa/examples/allow_request", bytes.NewReader(compressedBoy))
+	req.Header.Set("Content-Encoding", "gzip")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
 
+	expected := "true"
+	result := strings.TrimSuffix(f.recorder.Body.String(), "\n")
+	if result != expected {
+		t.Fatalf("Expected %v but got: %v", expected, result)
+	}
+}
+
+func TestDataPostV1CompressedRequest(t *testing.T) {
 	f := newFixture(t)
+	// create the policy
+	err := f.v1(http.MethodPut, "/policies/test", `package test
+default hello := false
+hello {
+	input.message == "world"
+}
+`, 200, "")
+	if err != nil {
+		t.Fatal(err)
+	}
 
-	txn := storage.NewTransactionOrDie(ctx, f.server.store, storage.WriteParams)
+	// execute the request
+	compressedBoy := zipString(`{"input": {"message": "world"}}`)
+	req := newStreamedReqV1(http.MethodPost, "/data/test", bytes.NewReader(compressedBoy))
+	req.Header.Set("Content-Encoding", "gzip")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
 
-	if err := bundle.WriteManifestToStore(ctx, f.server.store, txn, "test-bundle", bundle.Manifest{
-		Revision: "AAAAA",
-		Roots:    &[]string{"a/b/c", "x/y", "foobar"},
-	}); err != nil {
-		t.Fatal(err)
+	var result types.DataResponseV1
+
+	// unmarshall the response
+	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&result); err != nil {
+		t.Fatalf("Unexpected JSON decode error: %v", err)
 	}
 
-	if err := f.server.store.UpsertPolicy(ctx, txn, "someid", []byte(`package x.y.z`)); err != nil {
-		t.Fatal(err)
+	var expected interface{}
+	if err := util.UnmarshalJSON([]byte(`{"hello": true}`), &expected); err != nil {
+		panic(err)
 	}
+	if result.Result == nil || !reflect.DeepEqual(*result.Result, expected) {
+		t.Fatalf("Expected %v but got: %v", expected, *result.Result)
+	}
+}
 
-	if err := f.server.store.Commit(ctx, txn); err != nil {
-		t.Fatal(err)
+func TestCompileV1CompressedRequest(t *testing.T) {
+	f := newFixture(t)
+	// create the policy
+	mod := `package test
+
+	p {
+		input.x = 1
 	}
 
-	cases := []tr{
-		{
-			method: "PUT",
-			path:   "/data/a/b",
-			body:   "1",
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path a/b is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "PUT",
-			path:   "/data/a/b/c",
-			body:   "1",
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path a/b/c is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "PUT",
-			path:   "/data/a/b/c/d",
-			body:   "1",
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path a/b/c/d is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "PUT",
-			path:   "/data/a/b/d",
-			body:   "1",
-			code:   http.StatusNoContent,
-		},
-		{
-			method: "PATCH",
-			path:   "/data/a",
-			body:   `[{"path": "/b/c", "op": "add", "value": 1}]`,
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path a/b/c is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "DELETE",
-			path:   "/data/a",
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path a is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "PUT",
-			path:   "/policies/test1",
-			body:   `package a.b`,
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path a/b is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "DELETE",
-			path:   "/policies/someid",
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "path x/y/z is owned by bundle \"test-bundle\""}`,
-		},
-		{
-			method: "PUT",
-			path:   "/data/foo/bar",
-			body:   "1",
-			code:   http.StatusNoContent,
-		},
-		{
-			method: "PUT",
-			path:   "/data/foo",
-			body:   "1",
-			code:   http.StatusNoContent,
-		},
-		{
-			method: "PUT",
-			path:   "/data",
-			body:   `{"a": "b"}`,
-			code:   http.StatusBadRequest,
-			resp:   `{"code": "invalid_parameter", "message": "can't write to document root with bundle roots configured"}`,
-		},
+	q {
+		data.a[i] = input.x
 	}
 
-	if err := f.v1TestRequests(cases); err != nil {
+	default r = true
+
+	r { input.x = 1 }
+
+	custom_func(x) { data.a[i] == x }
+
+	s { custom_func(input.x) }
+	`
+	err := f.v1(http.MethodPut, "/policies/test", mod, 200, "")
+	if err != nil {
 		t.Fatal(err)
 	}
+
+	// execute the request
+	compressedBoy := zipString(`{"unknowns": ["input"], "query": "data.test.p = true"}`)
+	req := newStreamedReqV1(http.MethodPost, "/compile", bytes.NewReader(compressedBoy))
+	req.Header.Set("Content-Encoding", "gzip")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
+
+	var result types.CompileResponseV1
+
+	// unmarshall the response
+	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&result); err != nil {
+		t.Fatalf("Unexpected JSON decode error: %v", err)
+	}
+
+	var expected interface{}
+	expectedStr := fmt.Sprintf(`{"queries": [%v]}`, string(util.MustMarshalJSON(ast.MustParseBody("input.x = 1"))))
+	if err := util.UnmarshalJSON([]byte(expectedStr), &expected); err != nil {
+		panic(err)
+	}
+
+	if result.Result == nil || !reflect.DeepEqual(*result.Result, expected) {
+		t.Fatalf("Expected %v but got: %v", expected, *result.Result)
+	}
+}
+
+func TestBundleScope(t *testing.T) {
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	test.WithTempFS(nil, func(root string) {
+		disk, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir: root})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer disk.Close(ctx)
+
+		for _, v := range []variant{
+			{"inmem", nil},
+			{"disk", []func(*Server){func(s *Server) { s.WithStore(disk) }}},
+		} {
+			t.Run(v.name, func(t *testing.T) {
+				f := newFixture(t, v.opts...)
+
+				txn := storage.NewTransactionOrDie(ctx, f.server.store, storage.WriteParams)
+
+				if err := bundle.WriteManifestToStore(ctx, f.server.store, txn, "test-bundle", bundle.Manifest{
+					Revision: "AAAAA",
+					Roots:    &[]string{"a/b/c", "x/y", "foobar"},
+				}); err != nil {
+					t.Fatal(err)
+				}
+
+				if err := f.server.store.UpsertPolicy(ctx, txn, "someid", []byte(`package x.y.z`)); err != nil {
+					t.Fatal(err)
+				}
+
+				if err := f.server.store.Commit(ctx, txn); err != nil {
+					t.Fatal(err)
+				}
+
+				cases := []tr{
+					{
+						method: "PUT",
+						path:   "/data/a/b",
+						body:   "1",
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path a/b is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "PUT",
+						path:   "/data/a/b/c",
+						body:   "1",
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path a/b/c is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "PUT",
+						path:   "/data/a/b/c/d",
+						body:   "1",
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path a/b/c/d is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "PUT",
+						path:   "/data/a/b/d",
+						body:   "1",
+						code:   http.StatusNoContent,
+					},
+					{
+						method: "PATCH",
+						path:   "/data/a",
+						body:   `[{"path": "/b/c", "op": "add", "value": 1}]`,
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path a/b/c is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "DELETE",
+						path:   "/data/a",
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path a is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "PUT",
+						path:   "/policies/test1",
+						body:   `package a.b`,
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path a/b is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "PUT",
+						path:   "/policies/someid",
+						body:   `package other.path`,
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path x/y/z is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "DELETE",
+						path:   "/policies/someid",
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "path x/y/z is owned by bundle \"test-bundle\""}`,
+					},
+					{
+						method: "PUT",
+						path:   "/data/foo/bar",
+						body:   "1",
+						code:   http.StatusNoContent,
+					},
+					{
+						method: "PUT",
+						path:   "/data/foo",
+						body:   "1",
+						code:   http.StatusNoContent,
+					},
+					{
+						method: "PUT",
+						path:   "/data",
+						body:   `{"a": "b"}`,
+						code:   http.StatusBadRequest,
+						resp:   `{"code": "invalid_parameter", "message": "can't write to document root with bundle roots configured"}`,
+					},
+				}
+
+				if err := f.v1TestRequests(cases); err != nil {
+					t.Fatal(err)
+				}
+			})
+		}
+	})
 }
 
 func TestBundleScopeMultiBundle(t *testing.T) {
@@ -1904,13 +2387,23 @@ func TestDataGetExplainFull(t *testing.T) {
 		t.Fatalf("Expected exactly %d events but got %d", nexpect, len(explain))
 	}
 
-	_, ok := explain[2].Node.(ast.Body)
+	exitEvent := -1
+	for i := 0; i < len(explain) && exitEvent < 0; i++ {
+		if explain[i].Op == "exit" {
+			exitEvent = i
+		}
+	}
+	if exitEvent < 0 {
+		t.Fatalf("Expected one exit node but found none")
+	}
+
+	_, ok := explain[exitEvent].Node.(ast.Body)
 	if !ok {
-		t.Fatalf("Expected body for node but got: %v", explain[2].Node)
+		t.Fatalf("Expected body for node but got: %v", explain[exitEvent].Node)
 	}
 
-	if len(explain[2].Locals) != 1 {
-		t.Fatalf("Expected one binding but got: %v", explain[2].Locals)
+	if len(explain[exitEvent].Locals) != 1 {
+		t.Fatalf("Expected one binding but got: %v", explain[exitEvent].Locals)
 	}
 
 	req = newReqV1(http.MethodGet, "/data/deadbeef?explain=full", "")
@@ -1928,12 +2421,14 @@ func TestDataGetExplainFull(t *testing.T) {
 	}
 
 	explain = mustUnmarshalTrace(result.Explanation)
-	if len(explain) != 3 {
-		t.Fatalf("Expected exactly 3 events but got %d", len(explain))
+	nexpect = 3
+	if len(explain) != nexpect {
+		t.Fatalf("Expected exactly %d events but got %d", nexpect, len(explain))
 	}
 
-	if explain[2].Op != "fail" {
-		t.Fatalf("Expected last event to be 'fail' but got: %v", explain[2])
+	lastEvent := len(explain) - 1
+	if explain[lastEvent].Op != "fail" {
+		t.Fatalf("Expected last event to be 'fail' but got: %v", explain[lastEvent])
 	}
 
 	req = newReqV1(http.MethodGet, "/data/x?explain=full&pretty=true", "")
@@ -2268,51 +2763,76 @@ func TestDataProvenanceMultiBundle(t *testing.T) {
 }
 
 func TestDataMetricsEval(t *testing.T) {
-	f := newFixture(t)
+	// These tests all use the POST /v1/data API with ?metrics appended.
+	// We're setting up the disk store because that injects a few extra metrics,
+	// which storage/inmem does not.
 
-	// Make a request to evaluate `data`
-	testDataMetrics(t, f, "/data?metrics", []string{
-		"counter_server_query_cache_hit",
-		"timer_rego_input_parse_ns",
-		"timer_rego_query_parse_ns",
-		"timer_rego_query_compile_ns",
-		"timer_rego_query_eval_ns",
-		"timer_server_handler_ns",
-		"timer_rego_external_resolve_ns",
-	})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	test.WithTempFS(nil, func(root string) {
+		disk, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir: root})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer disk.Close(ctx)
+
+		f := newFixtureWithStore(t, disk)
+
+		// Make a request to evaluate `data`
+		testDataMetrics(t, f, "/data?metrics", []string{
+			"counter_server_query_cache_hit",
+			"counter_disk_read_keys",
+			"counter_disk_read_bytes",
+			"timer_rego_input_parse_ns",
+			"timer_rego_query_parse_ns",
+			"timer_rego_query_compile_ns",
+			"timer_rego_query_eval_ns",
+			"timer_server_handler_ns",
+			"timer_disk_read_ns",
+			"timer_rego_external_resolve_ns",
+		})
 
-	// Repeat previous request, expect to have hit the query cache
-	// so fewer timers should have been reported.
-	testDataMetrics(t, f, "/data?metrics", []string{
-		"counter_server_query_cache_hit",
-		"timer_rego_input_parse_ns",
-		"timer_rego_query_eval_ns",
-		"timer_server_handler_ns",
-		"timer_rego_external_resolve_ns",
-	})
+		// Repeat previous request, expect to have hit the query cache
+		// so fewer timers should have been reported.
+		testDataMetrics(t, f, "/data?metrics", []string{
+			"counter_server_query_cache_hit",
+			"counter_disk_read_keys",
+			"counter_disk_read_bytes",
+			"timer_rego_input_parse_ns",
+			"timer_rego_query_eval_ns",
+			"timer_server_handler_ns",
+			"timer_disk_read_ns",
+			"timer_rego_external_resolve_ns",
+		})
 
-	// Make a request to evaluate `data` and use partial evaluation,
-	// this should not hit the same query cache result as the previous
-	// request.
-	testDataMetrics(t, f, "/data?metrics&partial", []string{
-		"counter_server_query_cache_hit",
-		"timer_rego_input_parse_ns",
-		"timer_rego_module_compile_ns",
-		"timer_rego_query_parse_ns",
-		"timer_rego_query_compile_ns",
-		"timer_rego_query_eval_ns",
-		"timer_rego_partial_eval_ns",
-		"timer_server_handler_ns",
-		"timer_rego_external_resolve_ns",
-	})
+		// Make a request to evaluate `data` and use partial evaluation,
+		// this should not hit the same query cache result as the previous
+		// request.
+		testDataMetrics(t, f, "/data?metrics&partial", []string{
+			"counter_server_query_cache_hit",
+			"counter_disk_read_keys",
+			"counter_disk_read_bytes",
+			"timer_rego_input_parse_ns",
+			"timer_rego_module_compile_ns",
+			"timer_rego_query_parse_ns",
+			"timer_rego_query_compile_ns",
+			"timer_rego_query_eval_ns",
+			"timer_rego_partial_eval_ns",
+			"timer_server_handler_ns",
+			"timer_disk_read_ns",
+			"timer_rego_external_resolve_ns",
+		})
 
-	// Repeat previous partial eval request, this time it should
-	// be cached
-	testDataMetrics(t, f, "/data?metrics&partial", []string{
-		"counter_server_query_cache_hit",
-		"timer_rego_input_parse_ns",
-		"timer_rego_query_eval_ns",
-		"timer_server_handler_ns",
+		// Repeat previous partial eval request, this time it should
+		// be cached
+		testDataMetrics(t, f, "/data?metrics&partial", []string{
+			"counter_server_query_cache_hit",
+			"counter_disk_read_keys",
+			"timer_rego_input_parse_ns",
+			"timer_rego_query_eval_ns",
+			"timer_server_handler_ns",
+			"timer_disk_read_ns",
+		})
 	})
 }
 
@@ -2327,9 +2847,14 @@ func testDataMetrics(t *testing.T, f *fixture, url string, expected []string) {
 	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&result); err != nil {
 		t.Fatalf("Unexpected JSON decode error: %v", err)
 	}
+	assertMetricsExist(t, result.Metrics, expected)
+}
+
+func assertMetricsExist(t *testing.T, metrics types.MetricsV1, expected []string) {
+	t.Helper()
 
 	for _, key := range expected {
-		v, ok := result.Metrics[key]
+		v, ok := metrics[key]
 		if !ok {
 			t.Errorf("Missing expected metric: %s", key)
 		} else if v == nil {
@@ -2338,8 +2863,8 @@ func testDataMetrics(t *testing.T, f *fixture, url string, expected []string) {
 
 	}
 
-	if len(expected) != len(result.Metrics) {
-		t.Errorf("Expected %d metrics, got %d\n\n\tValues: %+v", len(expected), len(result.Metrics), result.Metrics)
+	if len(expected) != len(metrics) {
+		t.Errorf("Expected %d metrics, got %d\n\n\tValues: %+v", len(expected), len(metrics), metrics)
 	}
 }
 
@@ -2727,24 +3252,137 @@ func TestPoliciesUrlEncoded(t *testing.T) {
 		t.Fatalf("Unexpected unmarshal error: %v", err)
 	}
 
-	if getResponse.Result.ID != expectedPolicyID {
-		t.Fatalf(`Expected policy ID to be "%s" but got "%s"`, expectedPolicyID, getResponse.Result.ID)
+	if getResponse.Result.ID != expectedPolicyID {
+		t.Fatalf(`Expected policy ID to be "%s" but got "%s"`, expectedPolicyID, getResponse.Result.ID)
+	}
+
+	// end GET policy with URL encoded ID
+	f.reset()
+	// DELETE policy with URL encoded ID
+
+	deleteRequest := newReqV1(http.MethodDelete, fmt.Sprintf("/policies/%s", urlEscapedPolicyID), "")
+	f.server.Handler.ServeHTTP(f.recorder, deleteRequest)
+	if f.recorder.Code != 200 {
+		t.Fatalf("Expected success but got %v", f.recorder)
+	}
+}
+
+func TestStatusV1(t *testing.T) {
+
+	f := newFixture(t)
+
+	// Expect HTTP 500 before status plugin is registered
+	req := newReqV1(http.MethodGet, "/status", "")
+	f.server.Handler.ServeHTTP(f.recorder, req)
+
+	if f.recorder.Result().StatusCode != http.StatusInternalServerError {
+		t.Fatal("expected internal error")
+	}
+
+	// Expect HTTP 200 after status plus is registered
+	manual := plugins.TriggerManual
+	bs := pluginStatus.New(&pluginStatus.Config{Trigger: &manual}, f.server.manager)
+	err := bs.Start(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f.server.manager.Register(pluginStatus.Name, bs)
+
+	req = newReqV1(http.MethodGet, "/status", "")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
+	if f.recorder.Result().StatusCode != http.StatusOK {
+		t.Fatal("expected ok")
+	}
+
+	var resp1 struct {
+		Result struct {
+			Plugins struct {
+				Status struct {
+					State string
+				}
+			}
+		}
+	}
+	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&resp1); err != nil {
+		t.Fatal(err)
+	} else if resp1.Result.Plugins.Status.State != "OK" {
+		t.Fatal("expected plugin state for status to be 'OK' but got:", resp1)
+	}
+
+	// Expect HTTP 200 and updated status after bundle update occurs
+	bs.BulkUpdateBundleStatus(map[string]*pluginBundle.Status{
+		"test": {
+			Name:     "test",
+			HTTPCode: "403",
+		},
+	})
+
+	req = newReqV1(http.MethodGet, "/status", "")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
+
+	if f.recorder.Result().StatusCode != http.StatusOK {
+		t.Fatal("expected ok")
+	}
+
+	var resp2 struct {
+		Result struct {
+			Bundles struct {
+				Test struct {
+					Name     string
+					HTTPCode json.Number `json:"http_code"`
+				}
+			}
+		}
+	}
+
+	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&resp2); err != nil {
+		t.Fatal(err)
+	}
+	if resp2.Result.Bundles.Test.Name != "test" {
+		t.Fatal("expected bundle to exist in status response but got:", resp2)
+	}
+	if resp2.Result.Bundles.Test.HTTPCode != "403" {
+		t.Fatal("expected HTTPCode to equal 403 but got:", resp2)
+	}
+}
+
+func TestStatusV1MetricsWithSystemAuthzPolicy(t *testing.T) {
+
+	ctx := context.Background()
+
+	// Add the authz policy
+	store := inmem.New()
+	txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+	authzPolicy := `package system.authz
+	default allow = false
+	allow {
+		input.path = ["v1", "status"]
+	}`
+
+	if err := store.UpsertPolicy(ctx, txn, "test", []byte(authzPolicy)); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := store.Commit(ctx, txn); err != nil {
+		t.Fatal(err)
 	}
 
-	// end GET policy with URL encoded ID
-	f.reset()
-	// DELETE policy with URL encoded ID
+	// Add Prometheus Registerer to be used by plugins
+	inner := metrics.New()
 
-	deleteRequest := newReqV1(http.MethodDelete, fmt.Sprintf("/policies/%s", urlEscapedPolicyID), "")
-	f.server.Handler.ServeHTTP(f.recorder, deleteRequest)
-	if f.recorder.Code != 200 {
-		t.Fatalf("Expected success but got %v", f.recorder)
-	}
-}
+	logger := func(logger logging.Logger) func(attrs map[string]interface{}, f string, a ...interface{}) {
+		return func(attrs map[string]interface{}, f string, a ...interface{}) {
+			logger.WithFields(attrs).Error(f, a...)
+		}
+	}(logging.NewNoOpLogger())
 
-func TestStatusV1(t *testing.T) {
+	prom := prometheus.New(inner, logger)
+	serverOpts := []func(s *Server){func(s *Server) { s.WithAuthorization(AuthorizationBasic) }, func(s *Server) { s.WithMetrics(prom) }}
 
-	f := newFixture(t)
+	f := newFixtureWithStore(t, store, serverOpts...)
 
 	// Expect HTTP 500 before status plugin is registered
 	req := newReqV1(http.MethodGet, "/status", "")
@@ -2754,16 +3392,16 @@ func TestStatusV1(t *testing.T) {
 		t.Fatal("expected internal error")
 	}
 
-	// Expect HTTP 200 after status plus is registered
+	// Register Status plugin
 	manual := plugins.TriggerManual
-	bs := pluginStatus.New(&pluginStatus.Config{Trigger: &manual}, f.server.manager)
+	bs := pluginStatus.New(&pluginStatus.Config{Trigger: &manual, Prometheus: true}, f.server.manager).WithMetrics(prom)
 	err := bs.Start(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
-
 	f.server.manager.Register(pluginStatus.Name, bs)
 
+	// Fetch the status info
 	req = newReqV1(http.MethodGet, "/status", "")
 	f.reset()
 	f.server.Handler.ServeHTTP(f.recorder, req)
@@ -2786,12 +3424,24 @@ func TestStatusV1(t *testing.T) {
 		t.Fatal("expected plugin state for status to be 'OK' but got:", resp1)
 	}
 
-	// Expect HTTP 200 and updated status after bundle update occurs
-	bs.BulkUpdateBundleStatus(map[string]*pluginBundle.Status{
-		"test": {
-			Name: "test",
-		},
-	})
+	// Make requests that should get denied
+	req = newReqV1(http.MethodGet, "/policies", "")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
+
+	if f.recorder.Result().StatusCode != http.StatusUnauthorized {
+		t.Fatalf("Expected success but got %v", f.recorder)
+	}
+
+	req = newReqV1(http.MethodGet, "/data", "")
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, req)
+
+	if f.recorder.Result().StatusCode != http.StatusUnauthorized {
+		t.Fatalf("Expected success but got %v", f.recorder)
+	}
+
+	// Check Prometheus status metrics in the Status API
 
 	req = newReqV1(http.MethodGet, "/status", "")
 	f.reset()
@@ -2801,20 +3451,61 @@ func TestStatusV1(t *testing.T) {
 		t.Fatal("expected ok")
 	}
 
-	var resp2 struct {
+	var resp struct {
 		Result struct {
-			Bundles struct {
-				Test struct {
-					Name string
+			Plugins struct {
+				Status struct {
+					State string
 				}
 			}
+			Metrics map[string]interface{}
 		}
 	}
-
-	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&resp2); err != nil {
+	if err := util.NewJSONDecoder(f.recorder.Body).Decode(&resp); err != nil {
 		t.Fatal(err)
-	} else if resp2.Result.Bundles.Test.Name != "test" {
-		t.Fatal("expected bundle to exist in status response but got:", resp2)
+	} else if resp.Result.Plugins.Status.State != "OK" {
+		t.Fatal("expected plugin state for status to be 'OK' but got:", resp)
+	}
+
+	met, ok := resp.Result.Metrics["prometheus"]
+	if !ok {
+		t.Fatal("expected prometheus metrics to be present in status")
+	}
+
+	promMet, ok := met.(map[string]interface{})
+	if !ok {
+		t.Fatal("expected prometheus metrics to be a map")
+	}
+
+	httpMet, ok := promMet["http_request_duration_seconds"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected http_request_duration_seconds metric to be a map")
+	}
+
+	innerMet, ok := httpMet["metric"].([]interface{})
+	if !ok {
+		t.Fatal("expected http_request_duration_seconds histogram metric to be a list")
+	}
+
+	expected := []interface{}{map[string]interface{}{"name": "code", "value": "401"},
+		map[string]interface{}{"name": "handler", "value": "authz"},
+		map[string]interface{}{"name": "method", "value": "get"}}
+
+	found := false
+	for _, m := range innerMet {
+		item, ok := m.(map[string]interface{})
+		if ok {
+			if reflect.DeepEqual(item["label"].([]interface{}), expected) {
+				found = true
+				break
+			}
+		} else {
+			t.Fatal("expected each http_request_duration_seconds histogram metric element to be a map")
+		}
+	}
+
+	if !found {
+		t.Fatalf("expected to find metrics %v but found no match", expected)
 	}
 }
 
@@ -2861,7 +3552,13 @@ func TestDecisionIDs(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := f.v1("POST", "/data/undefined", "", 200, `{"decision_id": "2"}`); err != nil {
+	if err := f.v1("POST", "/data/undefined", "", 200, `{
+		"decision_id": "2",
+		"warning": {
+			"code": "api_usage_warning",
+			"message": "'input' key missing from the request"
+		}
+	}`); err != nil {
 		t.Fatal(err)
 	}
 
@@ -2869,7 +3566,14 @@ func TestDecisionIDs(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := f.v1("POST", "/data", "", 200, `{"decision_id": "4", "result": {}}`); err != nil {
+	if err := f.v1("POST", "/data", "", 200, `{
+		"decision_id": "4",
+		"result": {},
+		"warning": {
+			"code": "api_usage_warning",
+			"message": "'input' key missing from the request"
+		}
+	}`); err != nil {
 		t.Fatal(err)
 	}
 
@@ -2914,9 +3618,16 @@ func TestDecisionLogging(t *testing.T) {
 			response: "{}",
 		},
 		{
-			method:   "POST",
-			path:     "/data",
-			response: `{"result": {}, "decision_id": "1"}`,
+			method: "POST",
+			path:   "/data",
+			response: `{
+				"result": {},
+				"warning": {
+					"code": "api_usage_warning",
+					"message": "'input' key missing from the request"
+				},
+				"decision_id": "1"
+			}`,
 		},
 		{
 			method:   "GET",
@@ -2989,7 +3700,7 @@ func TestDecisionLogging(t *testing.T) {
 			code:   404,
 			response: `{
 				"code": "undefined_document",
-				"message": "document missing or undefined: data.test"
+				"message": "document missing: data.test"
 			  }`,
 		},
 	}
@@ -3077,31 +3788,50 @@ func TestDecisionLogErrorMessage(t *testing.T) {
 }
 
 func TestQueryV1(t *testing.T) {
-	f := newFixture(t)
-	get := newReqV1(http.MethodGet, `/query?q=a=[1,2,3]%3Ba[i]=x`, "")
-	f.server.Handler.ServeHTTP(f.recorder, get)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	test.WithTempFS(nil, func(root string) {
+		disk, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir: root})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer disk.Close(ctx)
 
-	if f.recorder.Code != 200 {
-		t.Fatalf("Expected success but got %v", f.recorder)
-	}
+		f := newFixtureWithStore(t, disk)
+		get := newReqV1(http.MethodGet, `/query?q=a=[1,2,3]%3Ba[i]=x&metrics`, "")
+		f.server.Handler.ServeHTTP(f.recorder, get)
+
+		if f.recorder.Code != 200 {
+			t.Fatalf("Expected success but got %v", f.recorder)
+		}
 
-	var expected types.QueryResponseV1
-	err := util.UnmarshalJSON([]byte(`{
+		var expected types.QueryResponseV1
+		err = util.UnmarshalJSON([]byte(`{
 		"result": [{"a":[1,2,3],"i":0,"x":1},{"a":[1,2,3],"i":1,"x":2},{"a":[1,2,3],"i":2,"x":3}]
 	}`), &expected)
-	if err != nil {
-		panic(err)
-	}
+		if err != nil {
+			panic(err)
+		}
 
-	var result types.QueryResponseV1
-	err = util.UnmarshalJSON(f.recorder.Body.Bytes(), &result)
-	if err != nil {
-		t.Fatalf("Unexpected error while unmarshalling result: %v", err)
-	}
+		var result types.QueryResponseV1
+		err = util.UnmarshalJSON(f.recorder.Body.Bytes(), &result)
+		if err != nil {
+			t.Fatalf("Unexpected error while unmarshalling result: %v", err)
+		}
 
-	if !reflect.DeepEqual(result, expected) {
-		t.Fatalf("Expected %v but got: %v", expected, result)
-	}
+		assertMetricsExist(t, result.Metrics, []string{
+			"counter_disk_read_keys",
+			"timer_rego_query_compile_ns",
+			"timer_rego_query_eval_ns",
+			// "timer_server_handler_ns", // TODO(sr): we're not consistent about timing this?
+			"timer_disk_read_ns",
+		})
+
+		result.Metrics = nil
+		if !reflect.DeepEqual(result, expected) {
+			t.Fatalf("Expected %v but got: %v", expected, result)
+		}
+	})
 }
 
 func TestBadQueryV1(t *testing.T) {
@@ -3178,6 +3908,15 @@ func TestUnversionedPost(t *testing.T) {
 		t.Fatalf("Expected not found before policy added but got %v", f.recorder)
 	}
 
+	expectedBody := `{
+  "code": "undefined_document",
+  "message": "document missing: data.system.main"
+}
+`
+	if f.recorder.Body.String() != expectedBody {
+		t.Errorf("Expected %s got %s", expectedBody, f.recorder.Body.String())
+	}
+
 	module := `
 	package system.main
 
@@ -3193,15 +3932,45 @@ func TestUnversionedPost(t *testing.T) {
 	f.reset()
 	f.server.Handler.ServeHTTP(f.recorder, post())
 
-	expected := `{"agg":6}`
+	expected := "{\"agg\":6}\n"
 	if f.recorder.Code != 200 || f.recorder.Body.String() != expected {
 		t.Fatalf(`Expected HTTP 200 / %v but got: %v`, expected, f.recorder)
 	}
+
+	module = `
+	package system
+
+	main {
+		input.foo == "bar"
+	}
+	`
+
+	if err := f.v1("PUT", "/policies/test", module, 200, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	f.reset()
+	f.server.Handler.ServeHTTP(f.recorder, func() *http.Request {
+		return newReqUnversioned(http.MethodPost, "/", `{"input": {"foo": "bar"}}`)
+	}())
+
+	if f.recorder.Code != 404 {
+		t.Fatalf("Expected not found before policy added but got %v", f.recorder)
+	}
+
+	expectedBody = `{
+  "code": "undefined_document",
+  "message": "document undefined: data.system.main"
+}
+`
+	if f.recorder.Body.String() != expectedBody {
+		t.Errorf("Expected %s got %s", expectedBody, f.recorder.Body.String())
+	}
 }
 
 func TestQueryV1Explain(t *testing.T) {
 	f := newFixture(t)
-	get := newReqV1(http.MethodGet, `/query?q=a=[1,2,3]%3Ba[i]=x&explain=full`, "")
+	get := newReqV1(http.MethodGet, `/query?q=a=[1,2,3]%3Ba[i]=x&explain=debug`, "")
 	f.server.Handler.ServeHTTP(f.recorder, get)
 
 	if f.recorder.Code != 200 {
@@ -3214,9 +3983,10 @@ func TestQueryV1Explain(t *testing.T) {
 		t.Fatalf("Unexpected JSON decode error: %v", err)
 	}
 
+	nexpect := 21
 	explain := mustUnmarshalTrace(result.Explanation)
-	if len(explain) != 13 {
-		t.Fatalf("Expected exactly 10 trace events for full query but got %d", len(explain))
+	if len(explain) != nexpect {
+		t.Fatalf("Expected exactly %d trace events for full query but got %d", nexpect, len(explain))
 	}
 }
 
@@ -3339,6 +4109,73 @@ func TestAuthorization(t *testing.T) {
 	}
 }
 
+func TestAuthorizationUsesInterQueryCache(t *testing.T) {
+
+	ctx := context.Background()
+	store := inmem.New()
+	m, err := plugins.New([]byte{}, "test", store)
+	if err != nil {
+		panic(err)
+	}
+
+	if err := m.Start(ctx); err != nil {
+		panic(err)
+	}
+
+	txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+	var c uint64
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		atomic.AddUint64(&c, 1)
+		fmt.Fprintf(w, `{"count": %d}`, c)
+	}))
+
+	authzPolicy := fmt.Sprintf(`package system.authz
+
+default allow := false
+
+allow {
+	resp := http.send({
+		"method": "GET", "url": "%[1]s/foo",
+		"force_cache": true,
+		"force_json_decode": true,
+		"force_cache_duration_seconds": 60,
+	})
+
+	resp.body.count == 1
+}
+`, ts.URL)
+	t.Log(authzPolicy)
+
+	if err := store.UpsertPolicy(ctx, txn, "test", []byte(authzPolicy)); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := store.Commit(ctx, txn); err != nil {
+		t.Fatal(err)
+	}
+
+	server, err := New().
+		WithAddresses([]string{":8182"}).
+		WithStore(store).
+		WithManager(m).
+		WithAuthorization(AuthorizationBasic).
+		Init(ctx)
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for i := 0; i < 5; i++ {
+		req1, err := http.NewRequest(http.MethodGet, "http://localhost:8182/health", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		validateAuthorizedRequest(t, server, req1, http.StatusOK)
+	}
+}
+
 func validateAuthorizedRequest(t *testing.T, s *Server, req *http.Request, exp int) {
 	t.Helper()
 
@@ -3347,7 +4184,7 @@ func validateAuthorizedRequest(t *testing.T, s *Server, req *http.Request, exp i
 	// First check the main router
 	s.Handler.ServeHTTP(r, req)
 	if r.Code != exp {
-		t.Fatalf("(Default Handler) Expected %v but got: %v", exp, r)
+		t.Errorf("(Default Handler) Expected %v but got: %v", exp, r)
 	}
 
 	r = httptest.NewRecorder()
@@ -3355,7 +4192,7 @@ func validateAuthorizedRequest(t *testing.T, s *Server, req *http.Request, exp i
 	// Ensure that auth happens for the diagnostic handler as well
 	s.DiagnosticHandler.ServeHTTP(r, req)
 	if r.Code != exp {
-		t.Fatalf("(Diagnostic Handler) Expected %v but got: %v", exp, r)
+		t.Errorf("(Diagnostic Handler) Expected %v but got: %v", exp, r)
 	}
 }
 
@@ -3493,6 +4330,10 @@ func (queryBindingErrStore) Abort(ctx context.Context, txn storage.Transaction)
 
 }
 
+func (queryBindingErrStore) Truncate(context.Context, storage.Transaction, storage.TransactionParams, storage.Iterator) error {
+	return nil
+}
+
 func (queryBindingErrStore) Register(context.Context, storage.Transaction, storage.TriggerConfig) (storage.TriggerHandle, error) {
 	return nil, nil
 }
@@ -3558,26 +4399,54 @@ type fixture struct {
 
 func newFixture(t *testing.T, opts ...func(*Server)) *fixture {
 	ctx := context.Background()
-	store := inmem.New()
-	m, err := plugins.New([]byte{}, "test", store)
-	if err != nil {
-		panic(err)
+	server := New().
+		WithAddresses([]string{"localhost:8182"}).
+		WithStore(inmem.New()) // potentially overridden via opts
+	for _, opt := range opts {
+		opt(server)
 	}
 
+	m, err := plugins.New([]byte{}, "test", server.store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server = server.WithManager(m)
 	if err := m.Start(ctx); err != nil {
-		panic(err)
+		t.Fatal(err)
+	}
+	server, err = server.Init(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	recorder := httptest.NewRecorder()
+
+	return &fixture{
+		server:   server,
+		recorder: recorder,
+		t:        t,
 	}
+}
 
+func newFixtureWithConfig(t *testing.T, config string, opts ...func(*Server)) *fixture {
+	ctx := context.Background()
 	server := New().
 		WithAddresses([]string{"localhost:8182"}).
-		WithStore(store).
-		WithManager(m)
+		WithStore(inmem.New()) // potentially overridden via opts
 	for _, opt := range opts {
 		opt(server)
 	}
+
+	m, err := plugins.New([]byte(config), "test", server.store)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server = server.WithManager(m)
+	if err := m.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
 	server, err = server.Init(ctx)
 	if err != nil {
-		panic(err)
+		t.Fatal(err)
 	}
 	recorder := httptest.NewRecorder()
 
@@ -3622,7 +4491,7 @@ func newFixtureWithStore(t *testing.T, store storage.Store, opts ...func(*Server
 func (f *fixture) v1TestRequests(trs []tr) error {
 	for i, tr := range trs {
 		if err := f.v1(tr.method, tr.path, tr.body, tr.code, tr.resp); err != nil {
-			return errors.Wrapf(err, "error on test request #%d", i+1)
+			return fmt.Errorf("error on test request #%d: %w", i+1, err)
 		}
 	}
 	return nil
@@ -3688,13 +4557,22 @@ func (f *fixture) reset() {
 	f.recorder = httptest.NewRecorder()
 }
 
-func executeRequests(t *testing.T, reqs []tr) {
+type variant struct {
+	name string
+	opts []func(*Server)
+}
+
+func executeRequests(t *testing.T, reqs []tr, variants ...variant) {
 	t.Helper()
-	f := newFixture(t)
-	for i, req := range reqs {
-		if err := f.v1(req.method, req.path, req.body, req.code, req.resp); err != nil {
-			t.Errorf("Unexpected response on request %d: %v", i+1, err)
-		}
+	for _, v := range variants {
+		t.Run(v.name, func(t *testing.T) {
+			f := newFixture(t, v.opts...)
+			for i, req := range reqs {
+				if err := f.v1(req.method, req.path, req.body, req.code, req.resp); err != nil {
+					t.Errorf("Unexpected response on request %d: %v", i+1, err)
+				}
+			}
+		})
 	}
 }
 
@@ -3750,6 +4628,26 @@ func newReqUnversioned(method, path, body string) *http.Request {
 	return req
 }
 
+func newStreamedReqV0(method string, path string, body io.Reader) *http.Request {
+	return newStreamedReq(0, method, path, body)
+}
+
+func newStreamedReqV1(method string, path string, body io.Reader) *http.Request {
+	return newStreamedReq(1, method, path, body)
+}
+
+func newStreamedReq(version int, method string, path string, body io.Reader) *http.Request {
+	return newStreamedReqUnversioned(method, fmt.Sprintf("/v%d", version)+path, body)
+}
+
+func newStreamedReqUnversioned(method string, path string, body io.Reader) *http.Request {
+	req, err := http.NewRequest(method, path, body)
+	if err != nil {
+		panic(err)
+	}
+	return req
+}
+
 func mustUnmarshalTrace(t types.TraceV1) (trace types.TraceV1Raw) {
 	if err := json.Unmarshal(t, &trace); err != nil {
 		panic("not reached")
@@ -4052,19 +4950,51 @@ func TestDiagnosticRoutes(t *testing.T) {
 
 }
 
+func TestDistributedTracingEnabled(t *testing.T) {
+	c := []byte(`{"distributed_tracing": {
+		"type": "grpc"
+		}}`)
+
+	ctx := context.Background()
+	_, tracerProvider, err := distributedtracing.Init(ctx, c, "foo")
+	if err != nil {
+		t.Fatalf("Unexpected error initializing trace exporter %v", err)
+	}
+	traceOpts := tracing.NewOptions(
+		otelhttp.WithTracerProvider(tracerProvider),
+		otelhttp.WithPropagators(propagation.TraceContext{}),
+	)
+	s := New()
+	s.WithDistributedTracingOpts(traceOpts)
+	handler := s.instrumentHandler(writer.HTTPStatus(405), "test")
+	_, ok := handler.(*otelhttp.Handler)
+	if !ok {
+		t.Fatal("Expected otelhttp handler if distributed tracing enabled")
+	}
+}
+
+func TestDistributedTracingDisabled(t *testing.T) {
+	s := New()
+	handler := s.instrumentHandler(writer.HTTPStatus(405), "test")
+	_, ok := handler.(*otelhttp.Handler)
+	if ok {
+		t.Fatal("Unexpected otelhttp handler if distributed tracing disabled")
+	}
+}
+
 type mockHTTPHandler struct{}
 
-func (m *mockHTTPHandler) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
+func (*mockHTTPHandler) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
 	w.WriteHeader(http.StatusOK)
 }
 
 type mockMetricsProvider struct{}
 
-func (m *mockMetricsProvider) RegisterEndpoints(registrar func(path, method string, handler http.Handler)) {
+func (*mockMetricsProvider) RegisterEndpoints(registrar func(string, string, http.Handler)) {
 	registrar("/metrics", "GET", new(mockHTTPHandler))
 }
 
-func (m *mockMetricsProvider) InstrumentHandler(handler http.Handler, label string) http.Handler {
+func (*mockMetricsProvider) InstrumentHandler(handler http.Handler, _ string) http.Handler {
 	return handler
 }
 
@@ -4076,21 +5006,19 @@ type mockHTTPListener struct {
 	t            httpListenerType
 }
 
-var _ httpListener = (*mockHTTPListener)(nil)
-
 func (m mockHTTPListener) Addr() string {
 	return m.addrs
 }
 
-func (m mockHTTPListener) ListenAndServe() error {
+func (mockHTTPListener) ListenAndServe() error {
 	return errors.New("not implemented")
 }
 
-func (m mockHTTPListener) ListenAndServeTLS(certFile, keyFile string) error {
+func (mockHTTPListener) ListenAndServeTLS(string, string) error {
 	return errors.New("not implemented")
 }
 
-func (m mockHTTPListener) Shutdown(ctx context.Context) error {
+func (m mockHTTPListener) Shutdown(context.Context) error {
 	var err error
 	if m.shutdownHook != nil {
 		err = m.shutdownHook()
@@ -4101,3 +5029,15 @@ func (m mockHTTPListener) Shutdown(ctx context.Context) error {
 func (m mockHTTPListener) Type() httpListenerType {
 	return m.t
 }
+
+func zipString(input string) []byte {
+	var b bytes.Buffer
+	gz := gzip.NewWriter(&b)
+	if _, err := gz.Write([]byte(input)); err != nil {
+		log.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		log.Fatal(err)
+	}
+	return b.Bytes()
+}
diff --git a/server/types/types.go b/server/types/types.go
index c5d3d74ea3..6b8e5657cf 100644
--- a/server/types/types.go
+++ b/server/types/types.go
@@ -80,6 +80,8 @@ const (
 	MsgUnauthorizedUndefinedError = "authorization policy missing or undefined"
 	MsgUnauthorizedError          = "request rejected by administrative policy"
 	MsgUndefinedError             = "document missing or undefined"
+	MsgMissingError               = "document missing"
+	MsgFoundUndefinedError        = "document undefined"
 	MsgPluginConfigError          = "error(s) occurred while configuring plugin(s)"
 )
 
@@ -149,6 +151,24 @@ type DataResponseV1 struct {
 	Explanation TraceV1       `json:"explanation,omitempty"`
 	Metrics     MetricsV1     `json:"metrics,omitempty"`
 	Result      *interface{}  `json:"result,omitempty"`
+	Warning     *Warning      `json:"warning,omitempty"`
+}
+
+// Warning models DataResponse warnings
+type Warning struct {
+	Code    string `json:"code,omitempty"`
+	Message string `json:"message,omitempty"`
+}
+
+// Warning Codes
+const CodeAPIUsageWarn = "api_usage_warning"
+
+// Warning Messages
+const MsgInputKeyMissing = "'input' key missing from the request"
+
+// NewWarning returns a new Warning object
+func NewWarning(code, message string) *Warning {
+	return &Warning{Code: code, Message: message}
 }
 
 // MetricsV1 models a collection of performance metrics.
@@ -173,6 +193,7 @@ const (
 	ExplainFullV1  ExplainModeV1 = "full"
 	ExplainNotesV1 ExplainModeV1 = "notes"
 	ExplainFailsV1 ExplainModeV1 = "fails"
+	ExplainDebugV1 ExplainModeV1 = "debug"
 )
 
 // TraceV1 models the trace result returned for queries that include the
@@ -352,6 +373,9 @@ type CompileRequestV1 struct {
 	Input    *interface{} `json:"input"`
 	Query    string       `json:"query"`
 	Unknowns *[]string    `json:"unknowns"`
+	Options  struct {
+		DisableInlining []string `json:"disableInlining,omitempty"`
+	} `json:"options,omitempty"`
 }
 
 // CompileResponseV1 models the response message for Compile API operations.
diff --git a/server/writer/writer.go b/server/writer/writer.go
index 069b6acbea..e0131beeca 100644
--- a/server/writer/writer.go
+++ b/server/writer/writer.go
@@ -25,32 +25,20 @@ func HTTPStatus(code int) http.HandlerFunc {
 // ErrorAuto writes a response with status and code set automatically based on
 // the type of err.
 func ErrorAuto(w http.ResponseWriter, err error) {
-	if types.IsBadRequest(err) {
+	switch {
+	case types.IsBadRequest(err):
 		ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, err)
-		return
-	}
-
-	if storage.IsWriteConflictError(err) {
+	case storage.IsWriteConflictError(err):
 		ErrorString(w, http.StatusNotFound, types.CodeResourceConflict, err)
-		return
-	}
-
-	if topdown.IsError(err) {
+	case topdown.IsError(err):
 		Error(w, http.StatusInternalServerError, types.NewErrorV1(types.CodeInternal, types.MsgEvaluationError).WithError(err))
-		return
-	}
-
-	if storage.IsInvalidPatch(err) {
+	case storage.IsInvalidPatch(err):
 		ErrorString(w, http.StatusBadRequest, types.CodeInvalidParameter, err)
-		return
-	}
-
-	if storage.IsNotFound(err) {
+	case storage.IsNotFound(err):
 		ErrorString(w, http.StatusNotFound, types.CodeResourceNotFound, err)
-		return
+	default:
+		ErrorString(w, http.StatusInternalServerError, types.CodeInternal, err)
 	}
-
-	ErrorString(w, http.StatusInternalServerError, types.CodeInternal, err)
 }
 
 // ErrorString writes a response with specified status, code, and message set to
@@ -70,27 +58,18 @@ func Error(w http.ResponseWriter, status int, err *types.ErrorV1) {
 // JSON writes a response with the specified status code and object. The object
 // will be JSON serialized.
 func JSON(w http.ResponseWriter, code int, v interface{}, pretty bool) {
-
-	var bs []byte
-	var err error
-
+	enc := json.NewEncoder(w)
 	if pretty {
-		bs, err = json.MarshalIndent(v, "", "  ")
-	} else {
-		bs, err = json.Marshal(v)
+		enc.SetIndent("", "  ")
 	}
 
-	if err != nil {
+	w.Header().Add("Content-Type", "application/json")
+	w.WriteHeader(code)
+
+	if err := enc.Encode(v); err != nil {
 		ErrorAuto(w, err)
 		return
 	}
-	headers := w.Header()
-	headers.Add("Content-Type", "application/json")
-	Bytes(w, code, bs)
-
-	if pretty {
-		_, _ = w.Write([]byte("\n"))
-	}
 }
 
 // Bytes writes a response with the specified status code and bytes.
diff --git a/storage/disk/config.go b/storage/disk/config.go
new file mode 100644
index 0000000000..bab976cebc
--- /dev/null
+++ b/storage/disk/config.go
@@ -0,0 +1,82 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package disk
+
+import (
+	"errors"
+	"fmt"
+	"os"
+
+	badger "github.com/dgraph-io/badger/v3"
+	"github.com/open-policy-agent/opa/config"
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/util"
+)
+
+type cfg struct {
+	Dir        string   `json:"directory"`
+	AutoCreate bool     `json:"auto_create"`
+	Partitions []string `json:"partitions"`
+	Badger     string   `json:"badger"`
+}
+
+var ErrInvalidPartitionPath = errors.New("invalid storage path")
+
+// OptionsFromConfig parses the passed config, extracts the disk storage
+// settings, validates it, and returns a *Options struct pointer on success.
+func OptionsFromConfig(raw []byte, id string) (*Options, error) {
+	parsedConfig, err := config.ParseConfig(raw, id)
+	if err != nil {
+		return nil, err
+	}
+
+	if parsedConfig.Storage == nil || len(parsedConfig.Storage.Disk) == 0 {
+		return nil, nil
+	}
+
+	var c cfg
+	if err := util.Unmarshal(parsedConfig.Storage.Disk, &c); err != nil {
+		return nil, err
+	}
+
+	if _, err := os.Stat(c.Dir); err != nil {
+		if os.IsNotExist(err) && c.AutoCreate {
+			err = os.MkdirAll(c.Dir, 0700) // overwrite err
+		}
+		if err != nil {
+			return nil, fmt.Errorf("directory %v invalid: %w", c.Dir, err)
+		}
+	}
+
+	opts := Options{
+		Dir:    c.Dir,
+		Badger: c.Badger,
+	}
+	for _, path := range c.Partitions {
+		p, ok := storage.ParsePath(path)
+		if !ok {
+			return nil, fmt.Errorf("partition path '%v': %w", path, ErrInvalidPartitionPath)
+		}
+		opts.Partitions = append(opts.Partitions, p)
+	}
+
+	return &opts, nil
+}
+
+func badgerConfigFromOptions(opts Options) (badger.Options, error) {
+	// Set some things _after_ FromSuperFlag to prohibit overriding them
+
+	dir, err := dataDir(opts.Dir)
+	if err != nil {
+		return badger.DefaultOptions(""), err
+	}
+
+	return badger.DefaultOptions("").
+			FromSuperFlag(opts.Badger).
+			WithDir(dir).
+			WithValueDir(dir).
+			WithDetectConflicts(false), // We only allow one write txn at a time; so conflicts cannot happen.
+		nil
+}
diff --git a/storage/disk/config_test.go b/storage/disk/config_test.go
new file mode 100644
index 0000000000..4d90e90858
--- /dev/null
+++ b/storage/disk/config_test.go
@@ -0,0 +1,229 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package disk
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/dgraph-io/badger/v3"
+	"github.com/open-policy-agent/opa/logging"
+)
+
+func TestNewFromConfig(t *testing.T) {
+	tmpdir := t.TempDir()
+
+	for _, tc := range []struct {
+		note    string
+		config  string
+		err     error // gets unwrapped
+		nothing bool  // returns no disk options?
+	}{
+		{
+			note:    "no storage section",
+			config:  "",
+			nothing: true,
+		},
+		{
+			note: "successful init, no partitions",
+			config: `
+storage:
+  disk:
+    directory: "` + tmpdir + `"
+`,
+		},
+		{
+			note: "successful init, valid partitions",
+			config: `
+storage:
+  disk:
+    directory: "` + tmpdir + `"
+    partitions:
+    - /foo/bar
+    - /baz
+`,
+		},
+		{
+			note: "partitions invalid",
+			config: `
+storage:
+  disk:
+    directory: "` + tmpdir + `"
+    partitions:
+    - /foo/bar
+    - baz
+`,
+			err: ErrInvalidPartitionPath,
+		},
+		{
+			note: "directory does not exist",
+			config: `
+storage:
+  disk:
+    directory: "` + tmpdir + `/foobar"
+`,
+			err: os.ErrNotExist,
+		},
+		{
+			note: "auto-create directory, does not exist",
+			config: `
+storage:
+  disk:
+    auto_create: true
+    directory: "` + tmpdir + `/foobar"
+`,
+		},
+		{
+			note: "auto-create directory, does already exist", // could be the second run
+			config: `
+storage:
+  disk:
+    auto_create: true
+    directory: "` + tmpdir + `"
+`,
+		},
+	} {
+		t.Run(tc.note, func(t *testing.T) {
+			d, err := OptionsFromConfig([]byte(tc.config), "id")
+			if !errors.Is(err, tc.err) {
+				t.Errorf("err: expected %v, got %v", tc.err, err)
+			}
+			if tc.nothing && d != nil {
+				t.Errorf("expected no disk options, got %v", d)
+			}
+		})
+	}
+}
+
+func TestDataDirPrefix(t *testing.T) {
+	ctx := context.Background()
+	tmpdir := t.TempDir()
+
+	d, err := New(ctx, logging.NewNoOpLogger(), nil, Options{
+		Dir: tmpdir,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	d.Close(ctx)
+
+	dir := filepath.Join(tmpdir, "data")
+	if _, err := os.Stat(dir); err != nil {
+		t.Fatalf("stat %v: %v", dir, err)
+	}
+	files, err := os.ReadDir(tmpdir)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// We currently only expect a single directory here: "data"
+	for _, file := range files {
+		if file.Name() != "data" {
+			t.Errorf("unexpected file in dir: %v", file.Name())
+		}
+	}
+}
+
+func TestBadgerConfigFromOptions(t *testing.T) {
+	type check func(*testing.T, badger.Options)
+	checks := func(c ...check) []check {
+		return c
+	}
+	valueDir := func(exp string) check {
+		return func(t *testing.T, o badger.Options) {
+			if act := o.ValueDir; act != exp {
+				t.Errorf("ValueDir: expected %v, got %v", exp, act)
+			}
+		}
+	}
+	dir := func(exp string) check {
+		return func(t *testing.T, o badger.Options) {
+			if act := o.Dir; act != exp {
+				t.Errorf("Dir: expected %v, got %v", exp, act)
+			}
+		}
+	}
+	conflict := func(exp bool) check {
+		return func(t *testing.T, o badger.Options) {
+			if act := o.DetectConflicts; act != exp {
+				t.Errorf("DetectConflicts: expected %v, got %v", exp, act)
+			}
+		}
+	}
+	nummemtables := func(exp int) check {
+		return func(t *testing.T, o badger.Options) {
+			if act := o.NumMemtables; act != exp {
+				t.Errorf("Dir: expected %v, got %v", exp, act)
+			}
+		}
+	}
+	numversionstokeep := func(exp int) check {
+		return func(t *testing.T, o badger.Options) {
+			if act := o.NumVersionsToKeep; act != exp {
+				t.Errorf("Dir: expected %v, got %v", exp, act)
+			}
+		}
+	}
+
+	tests := []struct {
+		note   string
+		opts   Options
+		checks []check
+	}{
+		{
+			"defaults",
+			Options{
+				Dir: "foo",
+			},
+			checks(
+				valueDir("foo/data"),
+				dir("foo/data"),
+				conflict(false),
+			),
+		},
+		{
+			"valuedir+dir override",
+			Options{
+				Dir:    "foo",
+				Badger: `valuedir="baz"; dir="quz"`,
+			},
+			checks(
+				valueDir("foo/data"),
+				dir("foo/data"),
+			),
+		},
+		{
+			"conflict detection override",
+			Options{
+				Dir:    "foo",
+				Badger: `detectconflicts=true`,
+			},
+			checks(conflict(false)),
+		},
+		{
+			"two valid overrides", // NOTE(sr): This is just one example
+			Options{
+				Dir:    "foo",
+				Badger: `nummemtables=123; numversionstokeep=123`,
+			},
+			checks(
+				nummemtables(123),
+				numversionstokeep(123),
+			),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			act, _ := badgerConfigFromOptions(tc.opts)
+			for _, check := range tc.checks {
+				check(t, act)
+			}
+		})
+	}
+}
diff --git a/storage/disk/disk.go b/storage/disk/disk.go
index b9f42093ce..71b06c4761 100644
--- a/storage/disk/disk.go
+++ b/storage/disk/disk.go
@@ -26,10 +26,14 @@
 // to a single key). Similarly, values that fall outside of partitions are
 // stored under individual keys at the root (e.g., the full extent of the value
 // at /qux would be stored under one key.)
+// There is support for wildcards in partitions: {/foo/*} will cause /foo/bar/abc
+// and /foo/buz/def to be written to separate keys. Multiple wildcards are
+// supported (/tenants/*/users/*/bindings), and they can also appear at the end
+// of a partition (/users/*).
 //
 // All keys written by the disk.Store implementation are prefixed as follows:
 //
-//   /<schema_version>/<partition_version>/<type>
+//	/<schema_version>/<partition_version>/<type>
 //
 // The <schema_version> value represents the version of the schema understood by
 // this version of OPA. Currently this is always set to 1. The
@@ -56,33 +60,51 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
 	"sync"
 	"sync/atomic"
+	"time"
 
 	badger "github.com/dgraph-io/badger/v3"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/util"
 )
 
-// TODO(tsandall): deal w/ slashes in paths
-// TODO(tsandall): support multi-level partitioning for use cases like k8s
 // TODO(tsandall): add support for migrations
+// TODO(sr): validate partition patterns properly: if the partitions were {/foo/bar}
+//           before and the new ones are {/foo/*}, it should be OK.
+
+// a value log file be rewritten if half the space can be discarded
+const valueLogGCDiscardRatio = 0.5
 
 // Options contains parameters that configure the disk-based store.
 type Options struct {
 	Dir        string         // specifies directory to store data inside of
 	Partitions []storage.Path // data prefixes that enable efficient layout
+	Badger     string         // badger-internal configurables
 }
 
 // Store provides a disk-based implementation of the storage.Store interface.
 type Store struct {
 	db         *badger.DB           // underlying key-value store
 	xid        uint64               // next transaction id
-	mu         sync.Mutex           // synchronizes trigger execution
+	rmu        sync.RWMutex         // reader-writer lock
+	wmu        sync.Mutex           // writer lock
 	pm         *pathMapper          // maps logical storage paths to underlying store keys
 	partitions *partitionTrie       // data structure to support path mapping
 	triggers   map[*handle]struct{} // registered triggers
+	gcTicker   *time.Ticker         // gc ticker
+	close      chan struct{}        // close-only channel for stopping the GC goroutine
+	backupDB   *badger.DB           // backup of the underlying key-value store
 }
 
 const (
@@ -96,6 +118,9 @@ const (
 	// basePartitionVersion represents the version of the caller-supplied data
 	// layout (aka partitioning).
 	basePartitionVersion int64 = 1
+
+	// symlink to directory path where badger write its files to
+	symlinkKey = "active"
 )
 
 type metadata struct {
@@ -104,38 +129,105 @@ type metadata struct {
 	Partitions       []storage.Path `json:"partitions"`        // caller-supplied data layout
 }
 
+// systemPartition is the partition we add automatically: no user-defined partition
+// should apply to the /system path.
+const systemPartition = "/system/*"
+
 // New returns a new disk-based store based on the provided options.
-func New(ctx context.Context, opts Options) (*Store, error) {
+func New(ctx context.Context, logger logging.Logger, prom prometheus.Registerer, opts Options) (*Store, error) {
 
 	partitions := make(pathSet, len(opts.Partitions))
 	copy(partitions, opts.Partitions)
 	partitions = partitions.Sorted()
 
 	if !partitions.IsDisjoint() {
-		return nil, &storage.Error{Code: storage.InternalErr, Message: fmt.Sprintf("partitions are overlapped: %v", opts.Partitions)}
+		return nil, &storage.Error{
+			Code:    storage.InternalErr,
+			Message: fmt.Sprintf("partitions are overlapped: %v", opts.Partitions),
+		}
+	}
+
+	partitions = append(partitions, storage.MustParsePath(systemPartition))
+	if !partitions.IsDisjoint() {
+		return nil, &storage.Error{
+			Code:    storage.InternalErr,
+			Message: fmt.Sprintf("system partitions are managed: %v", opts.Partitions),
+		}
 	}
 
-	db, err := badger.Open(badger.DefaultOptions(opts.Dir).WithLogger(nil))
+	options, err := badgerConfigFromOptions(opts)
 	if err != nil {
 		return nil, wrapError(err)
 	}
 
+	options = options.WithLogger(&wrap{logger})
+	db, err := badger.Open(options)
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	if prom != nil {
+		if err := initPrometheus(prom); err != nil {
+			return nil, err
+		}
+	}
+
 	store := &Store{
 		db:         db,
 		partitions: buildPartitionTrie(partitions),
 		triggers:   map[*handle]struct{}{},
+		close:      make(chan struct{}),
+		gcTicker:   time.NewTicker(time.Minute),
 	}
 
-	return store, db.Update(func(txn *badger.Txn) error {
+	go store.GC(logger)
+
+	if err := db.Update(func(txn *badger.Txn) error {
 		return store.init(ctx, txn, partitions)
-	})
+	}); err != nil {
+		store.Close(ctx)
+		return nil, err
+	}
+
+	return store, store.diagnostics(ctx, partitions, logger)
+}
+
+func (db *Store) GC(logger logging.Logger) {
+	for {
+		select {
+		case <-db.close:
+			return
+		case <-db.gcTicker.C:
+			for err := error(nil); err == nil; err = db.db.RunValueLogGC(valueLogGCDiscardRatio) {
+				logger.Debug("RunValueLogGC: err=%v", err)
+			}
+		}
+	}
 }
 
 // Close finishes the DB connection and allows other processes to acquire it.
 func (db *Store) Close(context.Context) error {
+	db.gcTicker.Stop()
 	return wrapError(db.db.Close())
 }
 
+// If the log level is debug, we'll output the badger logs in their corresponding
+// log levels; if it's not debug, we'll suppress all badger logs.
+type wrap struct {
+	l logging.Logger
+}
+
+func (w *wrap) debugDo(f func(string, ...interface{}), fmt string, as ...interface{}) {
+	if w.l.GetLevel() >= logging.Debug {
+		f("badger: "+fmt, as...)
+	}
+}
+
+func (w *wrap) Debugf(f string, as ...interface{})   { w.debugDo(w.l.Debug, f, as...) }
+func (w *wrap) Infof(f string, as ...interface{})    { w.debugDo(w.l.Info, f, as...) }
+func (w *wrap) Warningf(f string, as ...interface{}) { w.debugDo(w.l.Warn, f, as...) }
+func (w *wrap) Errorf(f string, as ...interface{})   { w.debugDo(w.l.Error, f, as...) }
+
 // NewTransaction implements the storage.Store interface.
 func (db *Store) NewTransaction(ctx context.Context, params ...storage.TransactionParams) (storage.Transaction, error) {
 	var write bool
@@ -147,11 +239,237 @@ func (db *Store) NewTransaction(ctx context.Context, params ...storage.Transacti
 	}
 
 	xid := atomic.AddUint64(&db.xid, uint64(1))
+	if write {
+		db.wmu.Lock() // only one concurrent write txn
+	} else {
+		db.rmu.RLock()
+	}
 	underlying := db.db.NewTransaction(write)
 
 	return newTransaction(xid, write, underlying, context, db.pm, db.partitions, db), nil
 }
 
+// Truncate implements the storage.Store interface. This method must be called within a transaction.
+func (db *Store) Truncate(ctx context.Context, txn storage.Transaction, params storage.TransactionParams, it storage.Iterator) error {
+
+	// backup the existing store
+	currentDB, err := db.backupAndLoadDB()
+	if err != nil {
+		return wrapError(err)
+	}
+
+	db.backupDB = currentDB
+
+	// commit in-flight txn on the existing store
+	uTxn, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+
+	_, err = uTxn.Commit(ctx)
+	if err != nil {
+		return wrapError(err)
+	}
+
+	// write new bundle policy and data into the existing DB
+	underlying := db.db.NewTransaction(true)
+	xid := atomic.AddUint64(&db.xid, uint64(1))
+	underlyingTxn := newTransaction(xid, true, underlying, params.Context, db.pm, db.partitions, db)
+
+	// For backwards compatibility, check if `RootOverwrite` was configured.
+	if params.RootOverwrite || overwriteRoot(params.BasePaths) {
+		newPath, ok := storage.ParsePathEscaped("/")
+		if !ok {
+			return fmt.Errorf("storage path invalid: %v", newPath)
+		}
+
+		sTxn, err := db.doTruncateData(ctx, underlyingTxn, db.db, params, newPath, map[string]interface{}{})
+		if err != nil {
+			return wrapError(err)
+		}
+
+		if sTxn != nil {
+			underlyingTxn = sTxn
+		}
+	}
+
+	for {
+		var update *storage.Update
+
+		update, err = it.Next()
+		if err == io.EOF {
+			break
+		}
+
+		if err != nil {
+			return wrapError(err)
+		}
+
+		if update.IsPolicy {
+			err = underlyingTxn.UpsertPolicy(ctx, strings.TrimLeft(update.Path.String(), "/"), update.Value)
+			if err != nil {
+				if err != badger.ErrTxnTooBig {
+					return wrapError(err)
+				}
+
+				_, err = underlyingTxn.Commit(ctx)
+				if err != nil {
+					return wrapError(err)
+				}
+
+				underlying = db.db.NewTransaction(true)
+				xid = atomic.AddUint64(&db.xid, uint64(1))
+				underlyingTxn = newTransaction(xid, true, underlying, params.Context, db.pm, db.partitions, db)
+
+				if err = underlyingTxn.UpsertPolicy(ctx, strings.TrimLeft(update.Path.String(), "/"), update.Value); err != nil {
+					return wrapError(err)
+				}
+			}
+		} else {
+			if len(update.Path) > 0 {
+				sTxn, err := db.doTruncateData(ctx, underlyingTxn, db.db, params, update.Path, update.Value)
+				if err != nil {
+					return wrapError(err)
+				}
+
+				if sTxn != nil {
+					underlyingTxn = sTxn
+				}
+			} else {
+				for _, root := range params.BasePaths {
+					newPath, ok := storage.ParsePathEscaped("/" + root)
+					if !ok {
+						return fmt.Errorf("storage path invalid: %v", newPath)
+					}
+
+					value, ok, err := lookup(newPath, update.Value)
+					if err != nil {
+						return err
+					}
+
+					if ok {
+						if len(newPath) > 0 {
+							if err := storage.MakeDir(ctx, db, underlyingTxn, newPath[:len(newPath)-1]); err != nil {
+								return err
+							}
+						}
+
+						sTxn, err := db.doTruncateData(ctx, underlyingTxn, db.db, params, newPath, value)
+						if err != nil {
+							return wrapError(err)
+						}
+
+						if sTxn != nil {
+							underlyingTxn = sTxn
+						}
+					}
+				}
+			}
+		}
+	}
+
+	if err != nil && err != io.EOF {
+		return wrapError(err)
+	}
+
+	// commit active transaction on existing store
+	_, err = underlyingTxn.Commit(ctx)
+	if err != nil {
+		return wrapError(err)
+	}
+
+	// Open write txn on the existing store in-case there are more write operations.
+	// The caller will either commit or abort this transaction
+	uTxn.stale = false
+	uTxn.underlying = db.db.NewTransaction(true)
+
+	return nil
+}
+
+func (db *Store) doTruncateData(ctx context.Context, underlying *transaction, badgerdb *badger.DB,
+	params storage.TransactionParams, path storage.Path, value interface{}) (*transaction, error) {
+
+	err := underlying.Write(ctx, storage.AddOp, path, value)
+	if err != nil {
+		if err != badger.ErrTxnTooBig {
+			return nil, wrapError(err)
+		}
+
+		_, err = underlying.Commit(ctx)
+		if err != nil {
+			return nil, wrapError(err)
+		}
+
+		txn := badgerdb.NewTransaction(true)
+		xid := atomic.AddUint64(&db.xid, uint64(1))
+		sTxn := newTransaction(xid, true, txn, params.Context, db.pm, db.partitions, db)
+
+		if err = sTxn.Write(ctx, storage.AddOp, path, value); err != nil {
+			return nil, wrapError(err)
+		}
+
+		return sTxn, nil
+	}
+
+	return nil, nil
+}
+
+func (db *Store) backupAndLoadDB() (*badger.DB, error) {
+	currDir := db.db.Opts().Dir
+
+	// backup db
+	backupDir, err := os.MkdirTemp(path.Dir(currDir), "backup")
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	bak, err := os.CreateTemp(backupDir, "badgerbak")
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	_, err = db.db.Backup(bak, 0)
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	// restore db
+	newDBDir, err := os.MkdirTemp(path.Dir(currDir), "backup")
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	opts := db.db.Opts().WithDir(newDBDir).WithValueDir(newDBDir)
+
+	// open new db
+	newDB, err := badger.Open(opts)
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	bak, err = os.Open(bak.Name())
+	if err != nil {
+		return nil, err
+	}
+	defer bak.Close()
+
+	err = newDB.Load(bak, 16)
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	return newDB, wrapError(os.RemoveAll(backupDir))
+}
+
+func (db *Store) cleanup(oldDB *badger.DB) error {
+	err := oldDB.Close()
+	if err != nil {
+		return wrapError(err)
+	}
+
+	return wrapError(os.RemoveAll(oldDB.Opts().Dir))
+}
+
 // Commit implements the storage.Store interface.
 func (db *Store) Commit(ctx context.Context, txn storage.Transaction) error {
 	underlying, err := db.underlying(txn)
@@ -159,17 +477,32 @@ func (db *Store) Commit(ctx context.Context, txn storage.Transaction) error {
 		return err
 	}
 	if underlying.write {
+		db.rmu.Lock() // blocks until all readers are done
 		event, err := underlying.Commit(ctx)
 		if err != nil {
 			return err
 		}
-		db.mu.Lock()
-		defer db.mu.Unlock()
+		write := false // read only txn
+		readOnly := db.db.NewTransaction(write)
+		xid := atomic.AddUint64(&db.xid, uint64(1))
+		readTxn := newTransaction(xid, write, readOnly, nil, db.pm, db.partitions, db)
 		for h := range db.triggers {
-			h.cb(ctx, txn, event)
+			h.cb(ctx, readTxn, event)
 		}
-	} else {
+
+		// cleanup backup db
+		if db.backupDB != nil {
+			if err := db.cleanup(db.backupDB); err != nil {
+				panic(err)
+			}
+			db.backupDB = nil
+		}
+
+		db.rmu.Unlock()
+		db.wmu.Unlock()
+	} else { // committing read txn
 		underlying.Abort(ctx)
+		db.rmu.RUnlock()
 	}
 	return nil
 }
@@ -181,6 +514,39 @@ func (db *Store) Abort(ctx context.Context, txn storage.Transaction) {
 		panic(err)
 	}
 	underlying.Abort(ctx)
+
+	if underlying.write {
+
+		if db.backupDB != nil {
+			db.rmu.Lock()
+
+			// update symlink to point to the backup db
+			symlink := filepath.Join(path.Dir(db.backupDB.Opts().Dir), symlinkKey)
+			// "active" -> "backupXXXX" is what we want, not
+			// "active" -> "DIR/backupXXX", since that won't work when using a relative directory
+			target := filepath.Base(db.backupDB.Opts().Dir)
+
+			err = createSymlink(target, symlink)
+			if err != nil {
+				panic(err)
+			}
+
+			// swap db
+			oldDb := db.db
+			db.db = db.backupDB
+
+			// cleanup existing db
+			if err := db.cleanup(oldDb); err != nil {
+				panic(err)
+			}
+
+			db.rmu.Unlock()
+		}
+
+		db.wmu.Unlock()
+	} else {
+		db.rmu.RUnlock()
+	}
 }
 
 // ListPolicies implements the storage.Policy interface.
@@ -223,7 +589,7 @@ func (db *Store) DeletePolicy(ctx context.Context, txn storage.Transaction, id s
 }
 
 // Register implements the storage.Trigger interface.
-func (db *Store) Register(ctx context.Context, txn storage.Transaction, config storage.TriggerConfig) (storage.TriggerHandle, error) {
+func (db *Store) Register(_ context.Context, txn storage.Transaction, config storage.TriggerConfig) (storage.TriggerHandle, error) {
 	underlying, err := db.underlying(txn)
 	if err != nil {
 		return nil, err
@@ -235,8 +601,6 @@ func (db *Store) Register(ctx context.Context, txn storage.Transaction, config s
 		}
 	}
 	h := &handle{db: db, cb: config.OnCommit}
-	db.mu.Lock()
-	defer db.mu.Unlock()
 	db.triggers[h] = struct{}{}
 	return h, nil
 }
@@ -302,9 +666,7 @@ func (h *handle) Unregister(ctx context.Context, txn storage.Transaction) {
 			Message: "triggers must be unregistered with a write transaction",
 		})
 	}
-	h.db.mu.Lock()
 	delete(h.db.triggers, h)
-	h.db.mu.Unlock()
 }
 
 func (db *Store) loadMetadata(txn *badger.Txn, m *metadata) (bool, error) {
@@ -395,13 +757,32 @@ func (db *Store) validatePartitions(ctx context.Context, txn *badger.Txn, existi
 	removedPartitions := oldPathSet.Diff(newPathSet)
 	addedPartitions := newPathSet.Diff(oldPathSet)
 
-	if len(removedPartitions) > 0 {
+	// It's OK to replace partitions with wildcard partitions that overlap them:
+	// REMOVED: /foo/bar
+	// ADDED:   /foo/*
+	// and the like.
+	replaced := make(pathSet, 0)
+	replacements := make(pathSet, 0)
+	for _, removed := range removedPartitions {
+		for _, added := range addedPartitions {
+			if isMatchedBy(removed, added) {
+				replaced = append(replaced, removed)
+				replacements = append(replacements, added)
+			}
+		}
+	}
+
+	rest := removedPartitions.Diff(replaced)
+	if len(rest) > 0 {
 		return &storage.Error{
 			Code:    storage.InternalErr,
-			Message: fmt.Sprintf("partitions are backwards incompatible (old: %v, new: %v, missing: %v)", oldPathSet.Sorted(), newPathSet.Sorted(), removedPartitions.Sorted())}
+			Message: fmt.Sprintf("partitions are backwards incompatible (old: %v, new: %v, missing: %v)", oldPathSet, newPathSet, rest)}
 	}
 
-	for _, path := range addedPartitions {
+	for _, path := range addedPartitions.Diff(replacements) {
+		if prefix, wildcard := hasWildcard(path); wildcard {
+			path = prefix
+		}
 		for i := len(path); i > 0; i-- {
 			key, err := db.pm.DataPath2Key(path[:i])
 			if err != nil {
@@ -421,3 +802,232 @@ func (db *Store) validatePartitions(ctx context.Context, txn *badger.Txn, existi
 
 	return nil
 }
+
+// MakeDir makes Store a storage.MakeDirer, to avoid the superfluous MakeDir
+// steps -- MakeDir is implicit in the disk storage's data layout, since
+//
+//	{"foo": {"bar": {"baz": 10}}}
+//
+// writes value `10` to key `/foo/bar/baz`.
+//
+// Here, we only check if it's a write transaction, for consistency with
+// other implementations, and do nothing.
+func (db *Store) MakeDir(_ context.Context, txn storage.Transaction, path storage.Path) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	if !underlying.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "MakeDir must be called with a write transaction",
+		}
+	}
+	return nil
+}
+
+// diagnostics prints relevant partition and database related information at
+// debug level.
+func (db *Store) diagnostics(ctx context.Context, partitions pathSet, logger logging.Logger) error {
+	if logger.GetLevel() < logging.Debug {
+		return nil
+	}
+	if len(partitions) == 1 { // '/system/*' is always present
+		logger.Warn("no partitions configured")
+		if err := db.logPrefixStatistics(ctx, storage.MustParsePath("/"), logger); err != nil {
+			return err
+		}
+	}
+	for _, partition := range partitions {
+		if err := db.logPrefixStatistics(ctx, partition, logger); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (db *Store) logPrefixStatistics(ctx context.Context, partition storage.Path, logger logging.Logger) error {
+
+	if prefix, ok := hasWildcard(partition); ok {
+		return db.logPrefixStatisticsWildcardPartition(ctx, prefix, partition, logger)
+	}
+
+	key, err := db.pm.DataPrefix2Key(partition)
+	if err != nil {
+		return err
+	}
+
+	opt := badger.DefaultIteratorOptions
+	opt.PrefetchValues = false
+	opt.Prefix = key
+
+	var count, size uint64
+	if err := db.db.View(func(txn *badger.Txn) error {
+		it := txn.NewIterator(opt)
+		defer it.Close()
+		for it.Rewind(); it.Valid(); it.Next() {
+			if err := ctx.Err(); err != nil {
+				return err
+			}
+			count++
+			size += uint64(it.Item().EstimatedSize()) // key length + value length
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	logger.Debug("partition %s: key count: %d (estimated size %d bytes)", partition, count, size)
+	return nil
+}
+
+func hasWildcard(path storage.Path) (storage.Path, bool) {
+	for i := range path {
+		if path[i] == pathWildcard {
+			return path[:i], true
+		}
+	}
+	return nil, false
+}
+
+func (db *Store) logPrefixStatisticsWildcardPartition(ctx context.Context, prefix, partition storage.Path, logger logging.Logger) error {
+	// we iterate all keys, and count things according to their concrete partition
+	type diagInfo struct{ count, size uint64 }
+	diag := map[string]*diagInfo{}
+
+	key, err := db.pm.DataPrefix2Key(prefix)
+	if err != nil {
+		return err
+	}
+
+	opt := badger.DefaultIteratorOptions
+	opt.PrefetchValues = false
+	opt.Prefix = key
+	if err := db.db.View(func(txn *badger.Txn) error {
+		it := txn.NewIterator(opt)
+		defer it.Close()
+		for it.Rewind(); it.Valid(); it.Next() {
+			if err := ctx.Err(); err != nil {
+				return err
+			}
+			if part, ok := db.prefixInPattern(it.Item().Key(), partition); ok {
+				p := part.String()
+				if diag[p] == nil {
+					diag[p] = &diagInfo{}
+				}
+				diag[p].count++
+				diag[p].size += uint64(it.Item().EstimatedSize()) // key length + value length
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+	if len(diag) == 0 {
+		logger.Debug("partition pattern %s: key count: 0 (estimated size 0 bytes)", toString(partition))
+	}
+	for part, diag := range diag {
+		logger.Debug("partition %s (pattern %s): key count: %d (estimated size %d bytes)", part, toString(partition), diag.count, diag.size)
+	}
+	return nil
+}
+
+func (db *Store) prefixInPattern(key []byte, partition storage.Path) (storage.Path, bool) {
+	var part storage.Path
+	path, err := db.pm.DataKey2Path(key)
+	if err != nil {
+		return nil, false
+	}
+	for i := range partition {
+		if path[i] != partition[i] && partition[i] != pathWildcard {
+			return nil, false
+		}
+		part = append(part, path[i])
+	}
+	return part, true
+}
+
+func toString(path storage.Path) string {
+	if len(path) == 0 {
+		return "/"
+	}
+	buf := strings.Builder{}
+	for _, p := range path {
+		fmt.Fprintf(&buf, "/%s", p)
+	}
+	return buf.String()
+}
+
+// dataDir prefixes the configured storage location: what it returns is
+// what we have badger write its files to. It is done to give us some
+// wiggle room in the future should we need to put further files on the
+// file system (like backups): we can then just use the opts.Dir.
+func dataDir(dir string) (string, error) {
+
+	symlink := filepath.Join(dir, symlinkKey)
+	if _, err := os.Lstat(symlink); err == nil {
+		return filepath.EvalSymlinks(symlink)
+	}
+
+	return filepath.Join(dir, "data"), nil
+}
+
+func createSymlink(target, symlink string) error {
+	var lerr error
+
+	if _, lerr = os.Lstat(symlink); lerr == nil {
+		if err := os.Remove(symlink); err != nil {
+			return err
+		}
+
+		if err := os.Symlink(target, symlink); err != nil {
+			return err
+		}
+	} else if errors.Is(lerr, os.ErrNotExist) {
+		if err := os.Symlink(target, symlink); err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	return lerr
+}
+
+func lookup(path storage.Path, data []byte) (interface{}, bool, error) {
+	var obj map[string]json.RawMessage
+	err := util.Unmarshal(data, &obj)
+	if err != nil {
+		return nil, false, err
+	}
+
+	if len(path) == 0 {
+		return obj, true, nil
+	}
+
+	for i := 0; i < len(path)-1; i++ {
+		value, ok := obj[path[i]]
+		if !ok {
+			return nil, false, nil
+		}
+
+		var next map[string]json.RawMessage
+		err := util.Unmarshal(value, &next)
+		if err != nil {
+			return nil, false, err
+		}
+
+		obj = next
+	}
+
+	value, ok := obj[path[len(path)-1]]
+	return value, ok, nil
+}
+
+func overwriteRoot(roots []string) bool {
+	for _, root := range roots {
+		if root == "" {
+			return true
+		}
+	}
+	return false
+}
diff --git a/storage/disk/disk_test.go b/storage/disk/disk_test.go
index 0158e571c3..20e5b35f20 100644
--- a/storage/disk/disk_test.go
+++ b/storage/disk/disk_test.go
@@ -7,9 +7,21 @@ package disk
 import (
 	"bytes"
 	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 
+	"github.com/open-policy-agent/opa/internal/file/archive"
+
+	"github.com/open-policy-agent/opa/bundle"
+
+	badger "github.com/dgraph-io/badger/v3"
+
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
@@ -32,14 +44,75 @@ type testWriteError struct {
 	value string
 }
 
+// testCount lets you assert the number of keys under a prefix.
+// Note that we don't do exact matches, so the assertions should be
+// as exact as possible:
+//
+//	testCount{"/foo", 1}
+//	testCount{"/foo/bar", 1}
+//
+// both of these would be true for one element under key `/foo/bar`.
+type testCount struct {
+	key   string
+	count int
+}
+
+func (tc *testCount) assert(t *testing.T, s *Store) {
+	t.Helper()
+	key, err := s.pm.DataPath2Key(storage.MustParsePath(tc.key))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	opt := badger.DefaultIteratorOptions
+	opt.PrefetchValues = false
+	opt.Prefix = key
+
+	var count int
+	if err := s.db.View(func(txn *badger.Txn) error {
+		it := txn.NewIterator(opt)
+		defer it.Close()
+		for it.Rewind(); it.Valid(); it.Next() {
+			count++
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	if tc.count != count {
+		t.Errorf("key %v: expected %d keys, found %d", tc.key, tc.count, count)
+	}
+}
+
+type testDump struct{} // for debugging purposes
+
+func (*testDump) do(t *testing.T, s *Store) {
+	t.Helper()
+	opt := badger.DefaultIteratorOptions
+	opt.PrefetchValues = true
+
+	if err := s.db.View(func(txn *badger.Txn) error {
+		it := txn.NewIterator(opt)
+		defer it.Close()
+		for it.Rewind(); it.Valid(); it.Next() {
+			t.Logf("%v -> %v", string(it.Item().Key()), it.Item().ValueSize())
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestPolicies(t *testing.T) {
 
 	test.WithTempFS(map[string]string{}, func(dir string) {
 		ctx := context.Background()
-		s, err := New(ctx, Options{Dir: dir, Partitions: nil})
+		s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: nil})
 		if err != nil {
 			t.Fatal(err)
 		}
+		defer s.Close(ctx)
 
 		err = storage.Txn(ctx, s, storage.WriteParams, func(txn storage.Transaction) error {
 			ids, err := s.ListPolicies(ctx, txn)
@@ -96,10 +169,235 @@ func TestPolicies(t *testing.T) {
 	})
 }
 
+func TestTruncateAbsoluteStoragePath(t *testing.T) {
+	test.WithTempFS(map[string]string{}, func(dir string) {
+		runTruncateTest(t, dir)
+	})
+}
+
+func TestTruncateRelativeStoragePath(t *testing.T) {
+	dir := "foobar"
+	err := os.Mkdir(dir, 0700)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+	runTruncateTest(t, dir)
+}
+
+func runTruncateTest(t *testing.T, dir string) {
+	ctx := context.Background()
+	s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: nil})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close(ctx)
+
+	txn := storage.NewTransactionOrDie(ctx, s, storage.WriteParams)
+
+	var archiveFiles = map[string]string{
+		"/a/b/c/data.json":   "[1,2,3]",
+		"/a/b/d/data.json":   `e: true`,
+		"/data.json":         `{"x": {"y": true}, "a": {"b": {"z": true}}}}`,
+		"/a/b/y/data.yaml":   `foo: 1`,
+		"/policy.rego":       "package foo\n p = 1",
+		"/roles/policy.rego": "package bar\n p = 1",
+	}
+
+	files := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	b, err := bundle.NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := bundle.NewIterator(b.Raw)
+
+	params := storage.WriteParams
+	params.BasePaths = []string{""}
+	err = s.Truncate(ctx, txn, params, iterator)
+	if err != nil {
+		t.Fatalf("Unexpected truncate error: %v", err)
+	}
+
+	if err := s.Commit(ctx, txn); err != nil {
+		t.Fatalf("Unexpected commit error: %v", err)
+	}
+
+	// check symlink not created
+	symlink := filepath.Join(dir, symlinkKey)
+	_, err = os.Lstat(symlink)
+	if err == nil {
+		t.Fatal("Expected error but got nil")
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, s)
+
+	actual, err := s.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `
+		{
+			"a": {
+				"b": {
+					"c": [1,2,3],
+					"d": {
+						"e": true
+					},
+					"y": {
+						"foo": 1
+					},
+					"z": true
+				}
+			},
+			"x": {
+				"y": true
+			}
+		}
+		`
+	jsn := util.MustUnmarshalJSON([]byte(expected))
+
+	if !reflect.DeepEqual(jsn, actual) {
+		t.Fatalf("Expected reader's read to be %v but got: %v", jsn, actual)
+	}
+
+	s.Abort(ctx, txn)
+
+	txn = storage.NewTransactionOrDie(ctx, s)
+	ids, err := s.ListPolicies(ctx, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedIds := map[string]struct{}{"policy.rego": {}, "roles/policy.rego": {}}
+
+	for _, id := range ids {
+		if _, ok := expectedIds[id]; !ok {
+			t.Fatalf("Expected list policies to contain %v but got: %v", expectedIds, id)
+		}
+	}
+
+	bs, err := s.GetPolicy(ctx, txn, "policy.rego")
+	expectedBytes := []byte("package foo\n p = 1")
+	if err != nil || !reflect.DeepEqual(expectedBytes, bs) {
+		t.Fatalf("Expected get policy to return %v but got: %v (err: %v)", expectedBytes, bs, err)
+	}
+
+	bs, err = s.GetPolicy(ctx, txn, "roles/policy.rego")
+	expectedBytes = []byte("package bar\n p = 1")
+	if err != nil || !reflect.DeepEqual(expectedBytes, bs) {
+		t.Fatalf("Expected get policy to return %v but got: %v (err: %v)", expectedBytes, bs, err)
+	}
+
+	// Close and re-open store
+	if err := s.Close(ctx); err != nil {
+		t.Fatalf("store close: %v", err)
+	}
+
+	if _, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: nil}); err != nil {
+		t.Fatalf("store re-open: %v", err)
+	}
+}
+
+func TestTruncateMultipleTxn(t *testing.T) {
+	test.WithTempFS(map[string]string{}, func(dir string) {
+		ctx := context.Background()
+		s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: nil, Badger: "memtablesize=4000;valuethreshold=600"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer s.Close(ctx)
+
+		txn := storage.NewTransactionOrDie(ctx, s, storage.WriteParams)
+
+		archiveFiles := map[string]string{}
+
+		for i := 0; i < 20; i++ {
+
+			path := fmt.Sprintf("users/user%d/data.json", i)
+
+			obj := map[string][]byte{}
+			obj[fmt.Sprintf("key%d", i)] = bytes.Repeat([]byte("a"), 1<<20) // 1 MB.
+
+			bs, err := json.Marshal(obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			archiveFiles[path] = string(bs)
+		}
+
+		// additional data file at root
+		archiveFiles["/data.json"] = `{"a": {"b": {"z": true}}}}`
+
+		files := make([][2]string, 0, len(archiveFiles))
+		for name, content := range archiveFiles {
+			files = append(files, [2]string{name, content})
+		}
+
+		buf := archive.MustWriteTarGz(files)
+		b, err := bundle.NewReader(buf).WithLazyLoadingMode(true).Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		iterator := bundle.NewIterator(b.Raw)
+
+		params := storage.WriteParams
+		params.BasePaths = []string{""}
+		err = s.Truncate(ctx, txn, params, iterator)
+		if err != nil {
+			t.Fatalf("Unexpected truncate error: %v", err)
+		}
+
+		if err := s.Commit(ctx, txn); err != nil {
+			t.Fatalf("Unexpected commit error: %v", err)
+		}
+
+		txn = storage.NewTransactionOrDie(ctx, s)
+
+		_, err = s.Read(ctx, txn, storage.MustParsePath("/users/user19"))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		s.Abort(ctx, txn)
+
+		txn = storage.NewTransactionOrDie(ctx, s)
+
+		actual, err := s.Read(ctx, txn, storage.MustParsePath("/a"))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expected := `
+		{
+			"b": {
+				"z": true
+			}
+		}
+		`
+		jsn := util.MustUnmarshalJSON([]byte(expected))
+
+		if !reflect.DeepEqual(jsn, actual) {
+			t.Fatalf("Expected reader's read to be %v but got: %v", jsn, actual)
+		}
+	})
+}
+
 func TestDataPartitioningValidation(t *testing.T) {
 
 	closeFn := func(ctx context.Context, s *Store) {
 		t.Helper()
+		if s == nil {
+			return
+		}
 		if err := s.Close(ctx); err != nil {
 			t.Fatal(err)
 		}
@@ -109,7 +407,7 @@ func TestDataPartitioningValidation(t *testing.T) {
 
 		ctx := context.Background()
 
-		_, err := New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		_, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/bar/baz"),
 		}})
@@ -122,7 +420,8 @@ func TestDataPartitioningValidation(t *testing.T) {
 			t.Fatal("unexpected code or message, got:", err)
 		}
 
-		s, err := New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		// set up two partitions
+		s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/baz"),
 		}})
@@ -132,7 +431,8 @@ func TestDataPartitioningValidation(t *testing.T) {
 
 		closeFn(ctx, s)
 
-		s, err = New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		// init with same settings: nothing wrong
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/baz"),
 			storage.MustParsePath("/foo/bar"),
 		}})
@@ -142,7 +442,8 @@ func TestDataPartitioningValidation(t *testing.T) {
 
 		closeFn(ctx, s)
 
-		s, err = New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		// adding another partition
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/baz"),
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/qux"),
@@ -151,6 +452,9 @@ func TestDataPartitioningValidation(t *testing.T) {
 			t.Fatal(err)
 		}
 
+		// We're writing data under the partitions: this affects how
+		// some partition changes are treated: if they don't affect existing
+		// data, they are accepted.
 		err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/foo/corge"), "x")
 		if err != nil {
 			t.Fatal(err)
@@ -163,18 +467,19 @@ func TestDataPartitioningValidation(t *testing.T) {
 
 		closeFn(ctx, s)
 
-		s, err = New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/baz"),
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/qux/corge"),
 		}})
-		if err == nil || !strings.Contains(err.Error(), "partitions are backwards incompatible (old: [/foo/bar /foo/baz /foo/qux], new: [/foo/bar /foo/baz /foo/qux/corge], missing: [/foo/qux])") {
+		if err == nil || !strings.Contains(err.Error(),
+			"partitions are backwards incompatible (old: [/foo/bar /foo/baz /foo/qux /system/*], new: [/foo/bar /foo/baz /foo/qux/corge /system/*], missing: [/foo/qux])") {
 			t.Fatal(err)
 		}
 
 		closeFn(ctx, s)
 
-		s, err = New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/baz"),
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/qux"),
@@ -186,7 +491,7 @@ func TestDataPartitioningValidation(t *testing.T) {
 
 		closeFn(ctx, s)
 
-		s, err = New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/baz"),
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/qux"),
@@ -198,7 +503,7 @@ func TestDataPartitioningValidation(t *testing.T) {
 
 		closeFn(ctx, s)
 
-		s, err = New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo/baz"),
 			storage.MustParsePath("/foo/bar"),
 			storage.MustParsePath("/foo/qux"),
@@ -209,9 +514,95 @@ func TestDataPartitioningValidation(t *testing.T) {
 		}
 
 		closeFn(ctx, s)
+
+		// switching to wildcard partition
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath("/foo/*"),
+		}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		closeFn(ctx, s)
+
+		// adding another partition
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath("/fox/in/the/snow/*"),
+			storage.MustParsePath("/foo/*"),
+		}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		closeFn(ctx, s)
+
+		// switching to a partition with multiple wildcards
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath("/fox/in/*/*/*"),
+			storage.MustParsePath("/foo/*"),
+		}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		closeFn(ctx, s)
+
+		// there is no going back
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath("/fox/in/the/snow/*"),
+			storage.MustParsePath("/foo/*"),
+		}})
+		if err == nil || !strings.Contains(err.Error(),
+			"partitions are backwards incompatible (old: [/foo/* /fox/in/*/*/* /system/*], new: [/foo/* /fox/in/the/snow/* /system/*], missing: [/fox/in/*/*/*])",
+		) {
+			t.Fatal(err)
+		}
+		closeFn(ctx, s)
+
+		// adding a wildcard partition requires no content on the non-wildcard prefix
+		// we open the db with previously used partitions, write another key, and
+		// re-open with an extra wildcard partition
+		// switching to a partition with multiple wildcards
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath("/fox/in/*/*/*"),
+			storage.MustParsePath("/foo/*"),
+		}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/peanutbutter/jelly"), true)
+		if err != nil {
+			t.Fatal(err)
+		}
+		closeFn(ctx, s)
+		s, err = New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath("/fox/in/*/*/*"),
+			storage.MustParsePath("/peanutbutter/*"),
+			storage.MustParsePath("/foo/*"),
+		}})
+		if err == nil || !strings.Contains(err.Error(), "partitions are backwards incompatible (existing data: /peanutbutter)") {
+			t.Fatal("expected to find existing key but got:", err)
+		}
+		closeFn(ctx, s)
 	})
 }
 
+func TestDataPartitioningSystemPartitions(t *testing.T) {
+	ctx := context.Background()
+	dir := "unused"
+
+	for _, part := range []string{
+		"/system",
+		"/system/*",
+		"/system/a",
+		"/system/a/b",
+	} {
+		_, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+			storage.MustParsePath(part),
+		}})
+		if err == nil || !strings.Contains(err.Error(), "system partitions are managed") {
+			t.Fatal(err)
+		}
+	}
+}
+
 func TestDataPartitioningReadsAndWrites(t *testing.T) {
 
 	tests := []struct {
@@ -232,6 +623,7 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 					path: "/foo/bar",
 					exp:  `"x"`,
 				},
+				testCount{"/foo/bar", 1},
 			},
 		},
 		{
@@ -247,6 +639,7 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 					path: "/foo/bar/baz",
 					exp:  `"x"`,
 				},
+				testCount{"/foo/bar/baz", 1},
 			},
 		},
 		{
@@ -262,6 +655,8 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 					path: "/deadbeef",
 					exp:  `"x"`,
 				},
+				testCount{"/foo", 0},
+				testCount{"/deadbeef", 1},
 			},
 		},
 		{
@@ -301,6 +696,8 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 					path: "/foo/bar/baz",
 					exp:  `8`,
 				},
+				testCount{"/foo/bar", 1},
+				testCount{"/foo/bar/baz", 0},
 			},
 		},
 		{
@@ -364,7 +761,27 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 			},
 		},
 		{
-			note:       "read-modify-write: add: array overwrite",
+			note:       "read-modify-write: add: array append (via last index)",
+			partitions: []string{"/foo"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/bar",
+					value: `[1]`,
+				},
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/bar/1",
+					value: `8`,
+				},
+				testRead{
+					path: "/foo/bar",
+					exp:  `[1, 8]`,
+				},
+			},
+		},
+		{
+			note:       "read-modify-write: add: array insert",
 			partitions: []string{"/foo"},
 			sequence: []interface{}{
 				testWrite{
@@ -379,7 +796,7 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 				},
 				testRead{
 					path: "/foo/bar",
-					exp:  `[8]`,
+					exp:  `[8, 7]`,
 				},
 			},
 		},
@@ -403,6 +820,26 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 				},
 			},
 		},
+		{
+			note:       "read-modify-write: replace: array",
+			partitions: []string{"/foo"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/bar",
+					value: `[7]`,
+				},
+				testWrite{
+					op:    storage.ReplaceOp,
+					path:  "/foo/bar/0",
+					value: `8`,
+				},
+				testRead{
+					path: "/foo/bar",
+					exp:  `[8]`,
+				},
+			},
+		},
 		{
 			note:       "read-modify-write: remove",
 			partitions: []string{"/foo"},
@@ -422,6 +859,25 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 				},
 			},
 		},
+		{
+			note:       "read-modify-write: remove: array",
+			partitions: []string{"/foo"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/bar",
+					value: `[7, 8]`,
+				},
+				testWrite{
+					op:   storage.RemoveOp,
+					path: "/foo/bar/0",
+				},
+				testRead{
+					path: "/foo/bar",
+					exp:  `[8]`,
+				},
+			},
+		},
 		{
 			note:       "read-modify-write: multi-level: map",
 			partitions: []string{"/foo"},
@@ -471,6 +927,8 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 					path:  "/foo",
 					value: `{"bar": 7, "baz": 8}`,
 				},
+
+				testCount{"/foo", 2},
 				testRead{
 					path: "/foo/bar",
 					exp:  `7`,
@@ -591,6 +1049,87 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 				},
 			},
 		},
+		{
+			note:       "pattern partitions: middle wildcard: match",
+			partitions: []string{"/foo/*/bar"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/a/bar",
+					value: `{"baz": 7}`,
+				},
+				testCount{"/foo/a/bar/baz", 1},
+				testRead{"/foo/a/bar/baz", `7`},
+			},
+		},
+		{
+			note:       "pattern partitions: middle wildcard: no-match",
+			partitions: []string{"/foo/*/bar"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/b/baz",
+					value: `{"quz": 1}`,
+				},
+				testCount{"/foo/b/baz", 1},
+				testCount{"/foo/b/baz/quz", 0},
+				testRead{"/foo/b/baz/quz", `1`},
+			},
+		},
+		{
+			note:       "pattern partitions: middle wildcard: partial match",
+			partitions: []string{"/foo/*/bar"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/b",
+					value: `{"bar": {"quz": 1}, "x": "y"}`,
+				},
+				testCount{"/foo/b/bar/quz", 1},
+				testRead{"/foo/b/bar/quz", `1`},
+				testCount{"/foo/b/x", 1},
+				testRead{"/foo/b/x", `"y"`},
+			},
+		},
+		{
+			note:       "pattern partitions: 2x middle wildcard: partial match",
+			partitions: []string{"/foo/*/*/bar"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/foo/b/c",
+					value: `{"bar": {"quz": 1}, "x": "y"}`,
+				},
+				testCount{"/foo/b/c/bar/quz", 1},
+				testRead{"/foo/b/c/bar/quz", `1`},
+				testCount{"/foo/b/c/x", 1},
+				testRead{"/foo/b/c/x", `"y"`},
+			},
+		},
+		{
+			note:       "pattern partitions: wildcard at the end",
+			partitions: []string{"/users/*"},
+			sequence: []interface{}{
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/users",
+					value: `{"alice": {"bar": {"quz": 1}, "x": "y"}}`,
+				},
+				testWrite{
+					op:    storage.AddOp,
+					path:  "/users/bob",
+					value: `{"baz": {"one": 1}, "y": "x"}`,
+				},
+				testCount{"/users/alice/bar", 1},
+				testRead{"/users/alice/bar/quz", `1`},
+				testCount{"/users/alice/x", 1},
+				testRead{"/users/alice/x", `"y"`},
+				testCount{"/users/bob/baz", 1},
+				testRead{"/users/bob/baz/one", `1`},
+				testCount{"/users/bob/y", 1},
+				testRead{"/users/bob/y", `"x"`},
+			},
+		},
 	}
 
 	for _, tc := range tests {
@@ -603,14 +1142,16 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 				}
 
 				ctx := context.Background()
-				s, err := New(ctx, Options{Dir: dir, Partitions: partitions})
-
+				s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: partitions})
 				if err != nil {
 					t.Fatal(err)
 				}
+				defer s.Close(ctx)
 
 				for _, x := range tc.sequence {
 					switch x := x.(type) {
+					case testCount:
+						x.assert(t, s)
 					case testWrite:
 						executeTestWrite(ctx, t, s, x)
 					case testRead:
@@ -625,6 +1166,8 @@ func TestDataPartitioningReadsAndWrites(t *testing.T) {
 						if cmp := util.Compare(result, exp); cmp != 0 {
 							t.Fatalf("expected %v but got %v", x.exp, result)
 						}
+					case testDump:
+						x.do(t, s)
 					default:
 						panic("unexpected type")
 					}
@@ -751,11 +1294,11 @@ func TestDataPartitioningReadNotFoundErrors(t *testing.T) {
 				}
 
 				ctx := context.Background()
-				s, err := New(ctx, Options{Dir: dir, Partitions: partitions})
-
+				s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: partitions})
 				if err != nil {
 					t.Fatal(err)
 				}
+				defer s.Close(ctx)
 
 				for _, x := range tc.sequence {
 					switch x := x.(type) {
@@ -785,60 +1328,6 @@ func TestDataPartitioningWriteNotFoundErrors(t *testing.T) {
 		partitions []string
 		sequence   []interface{}
 	}{
-		{
-			note:       "unpartitioned",
-			partitions: []string{"/foo"},
-			sequence: []interface{}{
-				testWriteError{
-					op:    storage.AddOp,
-					path:  "/does/notexist",
-					value: `7`,
-				},
-			},
-		},
-		{
-			note:       "unpartitioned: nested",
-			partitions: []string{"/foo"},
-			sequence: []interface{}{
-				testWrite{
-					op:    storage.AddOp,
-					path:  "/deadbeef",
-					value: `{}`,
-				},
-				testWriteError{
-					op:    storage.AddOp,
-					path:  "/deadbeef/x/y",
-					value: `{}`,
-				},
-			},
-		},
-		{
-			note:       "partitioned: nested",
-			partitions: []string{"/foo"},
-			sequence: []interface{}{
-				testWriteError{
-					op:    storage.AddOp,
-					path:  "/foo/bar/baz",
-					value: `{}`,
-				},
-			},
-		},
-		{
-			note:       "partitioned: nested: 2-level",
-			partitions: []string{"/foo"},
-			sequence: []interface{}{
-				testWrite{
-					op:    storage.AddOp,
-					path:  "/foo/bar",
-					value: `{}`,
-				},
-				testWriteError{
-					op:    storage.AddOp,
-					path:  "/foo/bar/baz/qux",
-					value: `7`,
-				},
-			},
-		},
 		{
 			note:       "patch: remove: non-existent key",
 			partitions: []string{},
@@ -957,11 +1446,12 @@ func TestDataPartitioningWriteNotFoundErrors(t *testing.T) {
 				}
 
 				ctx := context.Background()
-				s, err := New(ctx, Options{Dir: dir, Partitions: partitions})
+				s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: partitions})
 
 				if err != nil {
 					t.Fatal(err)
 				}
+				defer s.Close(ctx)
 
 				for _, x := range tc.sequence {
 					switch x := x.(type) {
@@ -990,52 +1480,394 @@ func TestDataPartitioningWriteNotFoundErrors(t *testing.T) {
 }
 
 func TestDataPartitioningWriteInvalidPatchError(t *testing.T) {
+	for _, pt := range []string{"/*", "/foo"} {
+		t.Run(pt, func(t *testing.T) {
+			test.WithTempFS(map[string]string{}, func(dir string) {
+				ctx := context.Background()
+				s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
+					storage.MustParsePath("/foo"),
+				}})
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer s.Close(ctx)
+
+				err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/foo"), util.MustUnmarshalJSON([]byte(`[1,2,3]`)))
+				if err == nil {
+					t.Fatal("expected error")
+				} else if sErr, ok := err.(*storage.Error); !ok {
+					t.Fatal("expected storage error but got:", err)
+				} else if sErr.Code != storage.InvalidPatchErr {
+					t.Fatal("expected invalid patch error but got:", err)
+				}
+
+				err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/"), util.MustUnmarshalJSON([]byte(`{"foo": [1,2,3]}`)))
+				if err == nil {
+					t.Fatal("expected error")
+				} else if sErr, ok := err.(*storage.Error); !ok {
+					t.Fatal("expected storage error but got:", err)
+				} else if sErr.Code != storage.InvalidPatchErr {
+					t.Fatal("expected invalid patch error but got:", err)
+				}
+
+				err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/"), util.MustUnmarshalJSON([]byte(`[1,2,3]`)))
+				if err == nil {
+					t.Fatal("expected error")
+				} else if sErr, ok := err.(*storage.Error); !ok {
+					t.Fatal("expected storage error but got:", err)
+				} else if sErr.Code != storage.InvalidPatchErr {
+					t.Fatal("expected invalid patch error but got:", err)
+				}
+			})
+		})
+	}
+}
+
+func executeTestWrite(ctx context.Context, t *testing.T, s storage.Store, x testWrite) {
+	t.Helper()
+	var val interface{}
+	if x.value != "" {
+		val = util.MustUnmarshalJSON([]byte(x.value))
+	}
+	err := storage.WriteOne(ctx, s, x.op, storage.MustParsePath(x.path), val)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestDiskTriggers(t *testing.T) {
 	test.WithTempFS(map[string]string{}, func(dir string) {
 		ctx := context.Background()
-		s, err := New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		store, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo"),
 		}})
 		if err != nil {
 			t.Fatal(err)
 		}
+		defer store.Close(ctx)
+		writeTxn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+		readTxn := storage.NewTransactionOrDie(ctx, store)
 
-		err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/foo"), util.MustUnmarshalJSON([]byte(`[1,2,3]`)))
-		if err == nil {
-			t.Fatal("expected error")
-		} else if sErr, ok := err.(*storage.Error); !ok {
-			t.Fatal("expected storage error but got:", err)
-		} else if sErr.Code != storage.InvalidPatchErr {
-			t.Fatal("expected invalid patch error but got:", err)
+		_, err = store.Register(ctx, readTxn, storage.TriggerConfig{
+			OnCommit: func(context.Context, storage.Transaction, storage.TriggerEvent) {},
+		})
+
+		if err == nil || !storage.IsInvalidTransaction(err) {
+			t.Fatalf("Expected transaction error: %v", err)
 		}
 
-		err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/"), util.MustUnmarshalJSON([]byte(`{"foo": [1,2,3]}`)))
-		if err == nil {
-			t.Fatal("expected error")
-		} else if sErr, ok := err.(*storage.Error); !ok {
-			t.Fatal("expected storage error but got:", err)
-		} else if sErr.Code != storage.InvalidPatchErr {
-			t.Fatal("expected invalid patch error but got:", err)
+		store.Abort(ctx, readTxn)
+
+		var event storage.TriggerEvent
+		modifiedPath := storage.MustParsePath("/a")
+		expectedValue := "hello"
+
+		_, err = store.Register(ctx, writeTxn, storage.TriggerConfig{
+			OnCommit: func(ctx context.Context, txn storage.Transaction, evt storage.TriggerEvent) {
+				result, err := store.Read(ctx, txn, modifiedPath)
+				if err != nil || !reflect.DeepEqual(result, expectedValue) {
+					t.Fatalf("Expected result to be hello for trigger read but got: %v (err: %v)", result, err)
+				}
+				event = evt
+			},
+		})
+		if err != nil {
+			t.Fatalf("Failed to register callback: %v", err)
 		}
 
-		err = storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/"), util.MustUnmarshalJSON([]byte(`[1,2,3]`)))
-		if err == nil {
-			t.Fatal("expected error")
-		} else if sErr, ok := err.(*storage.Error); !ok {
-			t.Fatal("expected storage error but got:", err)
-		} else if sErr.Code != storage.InvalidPatchErr {
-			t.Fatal("expected invalid patch error but got:", err)
+		if err := store.Write(ctx, writeTxn, storage.ReplaceOp, modifiedPath, expectedValue); err != nil {
+			t.Fatalf("Unexpected write error: %v", err)
+		}
+
+		id := "test"
+		data := []byte("package abc")
+		if err := store.UpsertPolicy(ctx, writeTxn, id, data); err != nil {
+			t.Fatalf("Unexpected upsert error: %v", err)
+		}
+
+		if err := store.Commit(ctx, writeTxn); err != nil {
+			t.Fatalf("Unexpected commit error: %v", err)
+		}
+
+		if event.IsZero() || !event.PolicyChanged() || !event.DataChanged() {
+			t.Fatalf("Expected policy and data change but got: %v", event)
+		}
+
+		expData := storage.DataEvent{Path: modifiedPath, Data: expectedValue, Removed: false}
+		if d := event.Data[0]; !reflect.DeepEqual(expData, d) {
+			t.Fatalf("Expected data event %v, got %v", expData, d)
+		}
+
+		expPolicy := storage.PolicyEvent{ID: id, Data: data, Removed: false}
+		if p := event.Policy[0]; !reflect.DeepEqual(expPolicy, p) {
+			t.Fatalf("Expected policy event %v, got %v", expPolicy, p)
 		}
 	})
 }
 
-func executeTestWrite(ctx context.Context, t *testing.T, s storage.Store, x testWrite) {
-	t.Helper()
-	var val interface{}
-	if x.value != "" {
-		val = util.MustUnmarshalJSON([]byte(x.value))
+func TestLookup(t *testing.T) {
+	cases := []struct {
+		note     string
+		input    []byte
+		path     string
+		expected []byte
+	}{
+		{
+			note:     "empty path",
+			input:    []byte(`{"hello": "world"}`),
+			path:     "",
+			expected: []byte(`{"hello": "world"}`),
+		},
+		{
+			note:     "single path",
+			input:    []byte(`{"a": {"b": {"c": "d"}}}`),
+			path:     "a",
+			expected: []byte(`{"b": {"c": "d"}}`),
+		},
+		{
+			note:     "nested path-1",
+			input:    []byte(`{"a": {"b": {"c": "d"}}}`),
+			path:     "a/b",
+			expected: []byte(`{"c": "d"}`),
+		},
+		{
+			note:     "nested path-2",
+			input:    []byte(`{"a": {"b": {"c": {"d": [1,2,3]}}}}`),
+			path:     "a/b/c",
+			expected: []byte(`{"d": [1,2,3]}`),
+		},
 	}
-	err := storage.WriteOne(ctx, s, x.op, storage.MustParsePath(x.path), val)
-	if err != nil {
-		t.Fatal(err)
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+
+			path, ok := storage.ParsePathEscaped("/" + tc.path)
+			if !ok {
+				t.Fatalf("storage path invalid: %v", path)
+			}
+
+			result, _, err := lookup(path, tc.input)
+			if err != nil {
+				t.Fatalf("Unexpected error %v", err)
+			}
+
+			switch v := result.(type) {
+			case map[string]json.RawMessage:
+				var obj map[string]json.RawMessage
+				err := util.Unmarshal(tc.expected, &obj)
+				if err != nil {
+					t.Fatalf("Unexpected error %v", err)
+				}
+
+				if !reflect.DeepEqual(v, obj) {
+					t.Fatalf("Expected result %v, got %v", obj, result)
+				}
+			case json.RawMessage:
+				if !bytes.Equal(v, tc.expected) {
+					t.Fatalf("Expected result %v, got %v", tc.expected, result)
+				}
+			}
+		})
 	}
 }
+
+func TestDiskDiagnostics(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("no partitions", func(t *testing.T) {
+		test.WithTempFS(nil, func(dir string) {
+			buf := bytes.Buffer{}
+			logger := logging.New()
+			logger.SetOutput(&buf)
+			logger.SetLevel(logging.Debug)
+			store, err := New(ctx, logger, nil, Options{Dir: dir})
+			if err != nil {
+				t.Fatal(err)
+			}
+			// store something, won't show up in the logs yet (they're calculated on startup only)
+			if err := storage.WriteOne(ctx, store, storage.AddOp, storage.MustParsePath("/foo"), util.MustUnmarshalJSON([]byte(`{"baz": 1000}`))); err != nil {
+				t.Fatal(err)
+			}
+			if err := storage.WriteOne(ctx, store, storage.AddOp, storage.MustParsePath("/bar"), util.MustUnmarshalJSON([]byte(`{"quz": 2000}`))); err != nil {
+				t.Fatal(err)
+			}
+			if err := store.Close(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			expected := []string{
+				`level=warning msg="no partitions configured"`,
+				`level=debug msg="partition /: key count: 0 (estimated size 0 bytes)"`,
+			}
+			for _, exp := range expected {
+				if !strings.Contains(buf.String(), exp) {
+					t.Errorf("expected string %q not found in logs", exp)
+				}
+			}
+			if t.Failed() {
+				t.Log("log output: ", buf.String())
+			}
+
+			// re-open
+			buf = bytes.Buffer{}
+			logger = logging.New()
+			logger.SetOutput(&buf)
+			logger.SetLevel(logging.Debug)
+			store, err = New(ctx, logger, nil, Options{Dir: dir})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := store.Close(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			expected = []string{
+				`level=debug msg="partition /: key count: 2 (estimated size 50 bytes)"`,
+			}
+			for _, exp := range expected {
+				if !strings.Contains(buf.String(), exp) {
+					t.Errorf("expected string %q not found in logs", exp)
+				}
+			}
+			if t.Failed() {
+				t.Log("log oputput: ", buf.String())
+			}
+		})
+	})
+
+	t.Run("two partitions", func(t *testing.T) {
+		test.WithTempFS(nil, func(dir string) {
+			opts := Options{
+				Dir: dir,
+				Partitions: []storage.Path{
+					storage.MustParsePath("/foo"),
+					storage.MustParsePath("/bar"),
+				}}
+			buf := bytes.Buffer{}
+			logger := logging.New()
+			logger.SetOutput(&buf)
+			logger.SetLevel(logging.Debug)
+			store, err := New(ctx, logger, nil, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			// store something, won't show up in the logs yet (they're calculated on startup only)
+			if err := storage.WriteOne(ctx, store, storage.AddOp, storage.MustParsePath("/foo"), util.MustUnmarshalJSON([]byte(`{"baz": 1000}`))); err != nil {
+				t.Fatal(err)
+			}
+
+			if err := store.Close(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			expected := []string{
+				`level=debug msg="partition /bar: key count: 0 (estimated size 0 bytes)"`,
+				`level=debug msg="partition /foo: key count: 0 (estimated size 0 bytes)"`,
+			}
+			for _, exp := range expected {
+				if !strings.Contains(buf.String(), exp) {
+					t.Errorf("expected string %q not found in logs", exp)
+				}
+			}
+			if t.Failed() {
+				t.Log("log oputput: ", buf.String())
+			}
+
+			// re-open
+			buf = bytes.Buffer{}
+			logger = logging.New()
+			logger.SetOutput(&buf)
+			logger.SetLevel(logging.Debug)
+			store, err = New(ctx, logger, nil, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := store.Close(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			expected = []string{
+				`level=debug msg="partition /bar: key count: 0 (estimated size 0 bytes)"`,
+				`level=debug msg="partition /foo: key count: 1 (estimated size 21 bytes)"`,
+			}
+			for _, exp := range expected {
+				if !strings.Contains(buf.String(), exp) {
+					t.Errorf("expected string %q not found in logs", exp)
+				}
+			}
+			if t.Failed() {
+				t.Log("log oputput: ", buf.String())
+			}
+		})
+	})
+
+	t.Run("patterned partitions", func(t *testing.T) {
+		test.WithTempFS(nil, func(dir string) {
+			opts := Options{Dir: dir,
+				Partitions: []storage.Path{
+					storage.MustParsePath("/foo/*/bar"),
+					storage.MustParsePath("/bar"),
+				}}
+			buf := bytes.Buffer{}
+			logger := logging.New()
+			logger.SetOutput(&buf)
+			logger.SetLevel(logging.Debug)
+			store, err := New(ctx, logger, nil, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			// store something, won't show up in the logs yet (they're calculated on startup only)
+			if err := storage.WriteOne(ctx, store, storage.AddOp, storage.MustParsePath("/foo/x/bar"), util.MustUnmarshalJSON([]byte(`{"baz": 1000}`))); err != nil {
+				t.Fatal(err)
+			}
+			if err := storage.WriteOne(ctx, store, storage.AddOp, storage.MustParsePath("/bar"), util.MustUnmarshalJSON([]byte(`{"quz": 1000}`))); err != nil {
+				t.Fatal(err)
+			}
+
+			if err := store.Close(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			expected := []string{
+				`level=debug msg="partition /bar: key count: 0 (estimated size 0 bytes)"`,
+				`level=debug msg="partition pattern /foo/*/bar: key count: 0 (estimated size 0 bytes)"`,
+			}
+			for _, exp := range expected {
+				if !strings.Contains(buf.String(), exp) {
+					t.Errorf("expected string %q not found in logs", exp)
+				}
+			}
+			if t.Failed() {
+				t.Log("log oputput: ", buf.String())
+			}
+
+			// re-open
+			buf = bytes.Buffer{}
+			logger = logging.New()
+			logger.SetOutput(&buf)
+			logger.SetLevel(logging.Debug)
+			store, err = New(ctx, logger, nil, opts)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := store.Close(ctx); err != nil {
+				t.Fatal(err)
+			}
+
+			expected = []string{
+				`level=debug msg="partition /bar: key count: 1 (estimated size 21 bytes)"`,
+				`level=debug msg="partition /foo/x/bar (pattern /foo/*/bar): key count: 1 (estimated size 27 bytes)"`,
+			}
+			for _, exp := range expected {
+				if !strings.Contains(buf.String(), exp) {
+					t.Errorf("expected string %q not found in logs", exp)
+				}
+			}
+			if t.Failed() {
+				t.Log("log oputput: ", buf.String())
+			}
+		})
+	})
+}
diff --git a/storage/disk/example_test.go b/storage/disk/example_test.go
index 33847e95b9..641f511c6f 100644
--- a/storage/disk/example_test.go
+++ b/storage/disk/example_test.go
@@ -7,9 +7,9 @@ package disk_test
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/storage/disk"
 	"github.com/open-policy-agent/opa/util"
@@ -26,14 +26,14 @@ func Example_store() {
 	ctx := context.Background()
 
 	// Create a temporary directory for store.
-	dir, err := ioutil.TempDir("", "opa_disk_example")
+	dir, err := os.MkdirTemp("", "opa_disk_example")
 	check(err)
 
 	// Cleanup temporary directory after finishing.
 	defer os.RemoveAll(dir)
 
 	// Create a new disk-based store.
-	store, err := disk.New(ctx, disk.Options{
+	store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
 		Dir: dir,
 		Partitions: []storage.Path{
 			storage.MustParsePath("/authz/tenants"),
@@ -63,7 +63,7 @@ func Example_store() {
 	check(err)
 
 	// Re-create the disk-based store using the same options.
-	store2, err := disk.New(ctx, disk.Options{
+	store2, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
 		Dir: dir,
 		Partitions: []storage.Path{
 			storage.MustParsePath("/authz/tenants"),
@@ -75,6 +75,9 @@ func Example_store() {
 	value, err := storage.ReadOne(ctx, store2, storage.MustParsePath("/authz/tenants/acmecorp.openpolicyagent.org"))
 	check(err)
 
+	err = store2.Close(ctx)
+	check(err)
+
 	fmt.Println(value)
 
 	// Output:
diff --git a/storage/disk/metrics.go b/storage/disk/metrics.go
new file mode 100644
index 0000000000..f7e53eba57
--- /dev/null
+++ b/storage/disk/metrics.go
@@ -0,0 +1,51 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package disk
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+var (
+	// storage read transactions never delete or write
+	keysReadPerStoreRead  = newHist("keys_read_per_store_read_txn", "How many database reads had to occur for a storage read transaction")
+	bytesReadPerStoreRead = newHist("key_bytes_read_per_store_read_txn", "How many bytes of data were read for a storage read transaction")
+
+	keysReadPerStoreWrite    = newHist("keys_read_per_store_write_txn", "How many database reads had to occur for a storage write transaction")
+	keysWrittenPerStoreWrite = newHist("keys_written_per_store_write_txn", "How many database writes had to occur for a storage write transaction")
+	keysDeletedPerStoreWrite = newHist("keys_deleted_per_store_write_txn", "How many database writes had to occur for a storage write transaction")
+	bytesReadPerStoreWrite   = newHist("key_bytes_read_per_store_write_txn", "How many bytes of data were read for a storage write transaction")
+)
+
+func initPrometheus(reg prometheus.Registerer) error {
+	for _, hist := range []prometheus.Histogram{
+		keysReadPerStoreRead,
+		bytesReadPerStoreRead,
+		keysReadPerStoreWrite,
+		keysWrittenPerStoreWrite,
+		keysDeletedPerStoreWrite,
+		bytesReadPerStoreWrite,
+	} {
+		if err := reg.Register(hist); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func newHist(name, desc string) prometheus.Histogram {
+	return prometheus.NewHistogram(prometheus.HistogramOpts{
+		Name:    name,
+		Help:    desc,
+		Buckets: prometheus.LinearBuckets(1, 1, 10), // TODO different buckets? exp?
+	})
+}
+
+func forwardMetric(m map[string]interface{}, counter string, hist prometheus.Histogram) {
+	key := "counter_" + counter
+	if s, ok := m[key]; ok {
+		hist.Observe(float64(s.(uint64)))
+	}
+}
diff --git a/storage/disk/partition.go b/storage/disk/partition.go
index adee4fe153..a10fc96405 100644
--- a/storage/disk/partition.go
+++ b/storage/disk/partition.go
@@ -29,7 +29,12 @@ func newPartitionTrie() *partitionTrie {
 func (p *partitionTrie) Find(path storage.Path) (int, *partitionTrie) {
 	node := p
 	for i, x := range path {
-		next, ok := node.partitions[x]
+		next, ok := node.partitions[pathWildcard]
+		if ok {
+			node = next
+			continue
+		}
+		next, ok = node.partitions[x]
 		if !ok {
 			return i + 1, nil
 		}
diff --git a/storage/disk/partition_test.go b/storage/disk/partition_test.go
index 506b40533b..29fc830ca8 100644
--- a/storage/disk/partition_test.go
+++ b/storage/disk/partition_test.go
@@ -18,11 +18,13 @@ func TestPartitionTrie(t *testing.T) {
 		storage.MustParsePath("/foo/bar"),
 		storage.MustParsePath("/foo/baz/qux"),
 		storage.MustParsePath("/corge"),
+		storage.MustParsePath("/tenants/*/bindings"), // wildcard in the middle
+		storage.MustParsePath("/users/*"),            // wildcard at the end
 	})
 
 	// Assert on counts...
-	if len(root.partitions) != 2 {
-		t.Fatal("expected root to contain two partitions")
+	if exp, act := 4, len(root.partitions); exp != act {
+		t.Fatalf("expected root to contain %d partitions, got %d", exp, act)
 	}
 
 	if len(root.partitions["foo"].partitions) != 2 {
@@ -82,6 +84,22 @@ func TestPartitionTrie(t *testing.T) {
 			path:    "/deadbeef",
 			wantIdx: 1,
 			wantPtr: nil,
+		}, {
+			path:    "/tenants/deadbeef/bindings/user01",
+			wantIdx: 4,
+			wantPtr: nil,
+		}, {
+			path:    "/tenants/deadbeef/bindings",
+			wantIdx: 3,
+			wantPtr: root.partitions["tenants"].partitions["*"].partitions["bindings"],
+		}, {
+			path:    "/tenants/deadbeef/foo",
+			wantIdx: 3,
+			wantPtr: nil,
+		}, {
+			path:    "/users/deadbeef",
+			wantIdx: 2,
+			wantPtr: root.partitions["users"].partitions["*"],
 		},
 	}
 
diff --git a/storage/disk/paths.go b/storage/disk/paths.go
index c052421e2b..f231608c93 100644
--- a/storage/disk/paths.go
+++ b/storage/disk/paths.go
@@ -7,10 +7,13 @@ package disk
 import (
 	"fmt"
 	"sort"
+	"strings"
 
 	"github.com/open-policy-agent/opa/storage"
 )
 
+const pathWildcard = "*"
+
 type pathMapper struct {
 	dataPrefix                string
 	dataPrefixNoTrailingSlash string
@@ -38,7 +41,7 @@ func (pm *pathMapper) PolicyID2Key(id string) []byte {
 }
 
 func (pm *pathMapper) DataKey2Path(key []byte) (storage.Path, error) {
-	p, ok := storage.ParsePath(string(key))
+	p, ok := storage.ParsePathEscaped(string(key))
 	if !ok {
 		return nil, &storage.Error{Code: storage.InternalErr, Message: fmt.Sprintf("corrupt key: %s", key)}
 	}
@@ -62,11 +65,27 @@ func (pm *pathMapper) DataPath2Key(path storage.Path) ([]byte, error) {
 
 type pathSet []storage.Path
 
+func (ps pathSet) String() string {
+	if len(ps) == 0 {
+		return "[]"
+	}
+	buf := strings.Builder{}
+	buf.WriteRune('[')
+	for j, p := range ps.Sorted() {
+		if j != 0 {
+			buf.WriteRune(' ')
+		}
+		buf.WriteString(toString(p))
+	}
+	buf.WriteRune(']')
+	return buf.String()
+}
+
 func (ps pathSet) IsDisjoint() bool {
 	for i := range ps {
 		for j := range ps {
 			if i != j {
-				if ps[i].HasPrefix(ps[j]) || ps[j].HasPrefix(ps[i]) {
+				if hasPrefixWithWildcard(ps[i], ps[j]) {
 					return false
 				}
 			}
@@ -75,6 +94,40 @@ func (ps pathSet) IsDisjoint() bool {
 	return true
 }
 
+// hasPrefixWithWildcard returns true if p starts with other; respecting
+// wildcards
+func hasPrefixWithWildcard(p, other storage.Path) bool {
+	if len(other) > len(p) {
+		return false
+	}
+	for i := range other {
+		if p[i] == pathWildcard || other[i] == pathWildcard {
+			continue
+		}
+		if p[i] != other[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// isMatchedBy returns true if p starts with other, or is matched by it
+// respecting wildcards _in other_ -- not in p.
+func isMatchedBy(p, other storage.Path) bool {
+	if len(other) != len(p) {
+		return false
+	}
+	for i := range other {
+		if other[i] == pathWildcard {
+			continue
+		}
+		if p[i] != other[i] {
+			return false
+		}
+	}
+	return true
+}
+
 func (ps pathSet) Diff(other pathSet) pathSet {
 	diff := pathSet{}
 	for _, x := range ps {
diff --git a/storage/disk/paths_test.go b/storage/disk/paths_test.go
new file mode 100644
index 0000000000..92993a2d89
--- /dev/null
+++ b/storage/disk/paths_test.go
@@ -0,0 +1,59 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package disk
+
+import (
+	"testing"
+
+	"github.com/open-policy-agent/opa/storage"
+)
+
+func TestIsDisjoint(t *testing.T) {
+	paths := func(ps ...string) pathSet {
+		ret := make([]storage.Path, len(ps))
+		for i := range ps {
+			ret[i] = storage.MustParsePath(ps[i])
+		}
+		return ret
+	}
+
+	for _, tc := range []struct {
+		note       string
+		ps         pathSet
+		overlapped bool
+	}{
+		{
+			note: "simple disjoint",
+			ps:   paths("/foo", "/bar", "/baz"),
+		},
+		{
+			note:       "simple overlapping",
+			ps:         paths("/foo", "/foo/bar"),
+			overlapped: true,
+		},
+		{
+			note:       "three overlapping",
+			ps:         paths("/fox", "/foo/bar", "/foo"),
+			overlapped: true,
+		},
+		{
+			note:       "wildcard overlapping, last",
+			ps:         paths("/foo", "/foo/*"),
+			overlapped: true,
+		},
+		{
+			note:       "wildcard overlapping, middle",
+			ps:         paths("/foo/bar/baz", "/foo/*/baz"),
+			overlapped: true,
+		},
+	} {
+		t.Run(tc.note, func(t *testing.T) {
+			act := tc.ps.IsDisjoint()
+			if !tc.overlapped != act {
+				t.Errorf("path set: %v, disjoint == %v, expected %v", tc.ps, act, !tc.overlapped)
+			}
+		})
+	}
+}
diff --git a/storage/disk/txn.go b/storage/disk/txn.go
index 40e4ecf044..95f962db5e 100644
--- a/storage/disk/txn.go
+++ b/storage/disk/txn.go
@@ -9,27 +9,52 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strconv"
 
 	badger "github.com/dgraph-io/badger/v3"
 
+	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/storage/internal/errors"
 	"github.com/open-policy-agent/opa/storage/internal/ptr"
 	"github.com/open-policy-agent/opa/util"
 )
 
+const (
+	readValueBytesCounter = "disk_read_bytes"
+	readKeysCounter       = "disk_read_keys"
+	writtenKeysCounter    = "disk_written_keys"
+	deletedKeysCounter    = "disk_deleted_keys"
+
+	commitTimer = "disk_commit"
+	readTimer   = "disk_read"
+	writeTimer  = "disk_write"
+)
+
 type transaction struct {
-	underlying *badger.Txn      // handle for the underlying badger transaction
-	partitions *partitionTrie   // index for partitioning structure in underlying store
-	pm         *pathMapper      // used for mapping between logical storage paths and actual storage keys
-	db         *Store           // handle for the database this transaction was created on
-	xid        uint64           // unique id for this transaction
-	stale      bool             // bit to indicate if the transaction was already aborted/committed
-	write      bool             // bit to indicate if the transaction may perform writes
-	context    *storage.Context // context supplied by the caller to be included in triggers
+	underlying *badger.Txn          // handle for the underlying badger transaction
+	partitions *partitionTrie       // index for partitioning structure in underlying store
+	pm         *pathMapper          // used for mapping between logical storage paths and actual storage keys
+	db         *Store               // handle for the database this transaction was created on
+	xid        uint64               // unique id for this transaction
+	stale      bool                 // bit to indicate if the transaction was already aborted/committed
+	write      bool                 // bit to indicate if the transaction may perform writes
+	event      storage.TriggerEvent // constructed as we go, supplied by the caller to be included in triggers
+	metrics    metrics.Metrics      // per-transaction metrics
 }
 
 func newTransaction(xid uint64, write bool, underlying *badger.Txn, context *storage.Context, pm *pathMapper, trie *partitionTrie, db *Store) *transaction {
+
+	// Even if the caller is not interested, these will contribute
+	// to the prometheus metrics on commit.
+	var m metrics.Metrics
+	if context != nil {
+		m = context.Metrics()
+	}
+	if m == nil {
+		m = metrics.New()
+	}
+
 	return &transaction{
 		underlying: underlying,
 		partitions: trie,
@@ -38,7 +63,10 @@ func newTransaction(xid uint64, write bool, underlying *badger.Txn, context *sto
 		xid:        xid,
 		stale:      false,
 		write:      write,
-		context:    context,
+		event: storage.TriggerEvent{
+			Context: context,
+		},
+		metrics: m,
 	}
 }
 
@@ -46,16 +74,31 @@ func (txn *transaction) ID() uint64 {
 	return txn.xid
 }
 
+// Commit will commit the underlying transaction, and forward the per-transaction
+// metrics into prometheus metrics.
+// NOTE(sr): aborted transactions are not measured
 func (txn *transaction) Commit(context.Context) (storage.TriggerEvent, error) {
-	// TODO(tsandall): This implementation does not provide any data or policy
-	// events because they are of minimal value given that the transcation
-	// cannot be used for reads once the commit finishes. This differs from the
-	// in-memory store.
-	//
-	// We should figure out how to remove the code in the plugin manager that
-	// performs reads on committed transactions.
 	txn.stale = true
-	return storage.TriggerEvent{Context: txn.context}, wrapError(txn.underlying.Commit())
+	txn.metrics.Timer(commitTimer).Start()
+	err := wrapError(txn.underlying.Commit())
+	txn.metrics.Timer(commitTimer).Stop()
+
+	if err != nil {
+		return txn.event, err
+	}
+
+	m := txn.metrics.All()
+	if txn.write {
+		forwardMetric(m, readKeysCounter, keysReadPerStoreWrite)
+		forwardMetric(m, readKeysCounter, keysReadPerStoreWrite)
+		forwardMetric(m, writtenKeysCounter, keysWrittenPerStoreWrite)
+		forwardMetric(m, deletedKeysCounter, keysDeletedPerStoreWrite)
+		forwardMetric(m, readValueBytesCounter, bytesReadPerStoreWrite)
+	} else {
+		forwardMetric(m, readKeysCounter, keysReadPerStoreRead)
+		forwardMetric(m, readValueBytesCounter, bytesReadPerStoreRead)
+	}
+	return txn.event, nil
 }
 
 func (txn *transaction) Abort(context.Context) {
@@ -63,12 +106,13 @@ func (txn *transaction) Abort(context.Context) {
 	txn.underlying.Discard()
 }
 
-func (txn *transaction) Read(_ context.Context, path storage.Path) (interface{}, error) {
+func (txn *transaction) Read(ctx context.Context, path storage.Path) (interface{}, error) {
+	txn.metrics.Timer(readTimer).Start()
+	defer txn.metrics.Timer(readTimer).Stop()
 
 	i, node := txn.partitions.Find(path)
 
 	if node == nil {
-
 		key, err := txn.pm.DataPath2Key(path[:i])
 		if err != nil {
 			return nil, err
@@ -87,10 +131,10 @@ func (txn *transaction) Read(_ context.Context, path storage.Path) (interface{},
 		return nil, err
 	}
 
-	return txn.readMultiple(i, key)
+	return txn.readMultiple(ctx, i, key)
 }
 
-func (txn *transaction) readMultiple(offset int, prefix []byte) (interface{}, error) {
+func (txn *transaction) readMultiple(ctx context.Context, offset int, prefix []byte) (interface{}, error) {
 
 	result := map[string]interface{}{}
 
@@ -98,8 +142,14 @@ func (txn *transaction) readMultiple(offset int, prefix []byte) (interface{}, er
 	defer it.Close()
 
 	var keybuf, valbuf []byte
+	var count uint64
 
 	for it.Rewind(); it.Valid(); it.Next() {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+
+		count++
 
 		keybuf = it.Item().KeyCopy(keybuf)
 		path, err := txn.pm.DataKey2Path(keybuf)
@@ -111,6 +161,7 @@ func (txn *transaction) readMultiple(offset int, prefix []byte) (interface{}, er
 		if err != nil {
 			return nil, wrapError(err)
 		}
+		txn.metrics.Counter(readValueBytesCounter).Add(uint64(len(valbuf)))
 
 		var value interface{}
 		if err := deserialize(valbuf, &value); err != nil {
@@ -135,6 +186,8 @@ func (txn *transaction) readMultiple(offset int, prefix []byte) (interface{}, er
 		node[path[len(path)-1]] = value
 	}
 
+	txn.metrics.Counter(readKeysCounter).Add(count)
+
 	if len(result) == 0 {
 		return nil, errNotFound
 	}
@@ -143,6 +196,7 @@ func (txn *transaction) readMultiple(offset int, prefix []byte) (interface{}, er
 }
 
 func (txn *transaction) readOne(key []byte) (interface{}, error) {
+	txn.metrics.Counter(readKeysCounter).Add(1)
 
 	item, err := txn.underlying.Get(key)
 	if err != nil {
@@ -155,6 +209,7 @@ func (txn *transaction) readOne(key []byte) (interface{}, error) {
 	var val interface{}
 
 	err = item.Value(func(bs []byte) error {
+		txn.metrics.Counter(readValueBytesCounter).Add(uint64(len(bs)))
 		return deserialize(bs, &val)
 	})
 
@@ -164,66 +219,50 @@ func (txn *transaction) readOne(key []byte) (interface{}, error) {
 type update struct {
 	key    []byte
 	value  []byte
+	data   interface{}
 	delete bool
 }
 
-// errTxnTooBigErrorHandler checks if the passed error was caused by a transaction
-// that was _too big_. If so, it attempts to commit the transaction and opens a new one.
-// See https://dgraph.io/docs/badger/get-started/#read-write-transactions
-func errTxnTooBigErrorHandler(txn *transaction, err error) error {
-	errSetCommit := txn.underlying.Commit()
-	if errSetCommit != nil {
-		return wrapError(errSetCommit)
-	}
-	txn.underlying = txn.db.db.NewTransaction(true)
-	return nil
-}
-
-// !!!  infinite recursion only if infinite txn too big error occurred
-func deleteWithErrTxnTooBigErrorHandling(txn *transaction, u *update) error {
-	err := txn.underlying.Delete(u.key)
-	if err == badger.ErrTxnTooBig {
-		if txnErr := errTxnTooBigErrorHandler(txn, err); txnErr != nil {
-			return txnErr
-		}
-		return deleteWithErrTxnTooBigErrorHandling(txn, u)
-	}
-	return wrapError(err)
-}
-
-// !!! infinite recursion only if infinite txn too big error occurred
-func setWithErrTxnTooBigErrorHandling(txn *transaction, u *update) error {
-	err := txn.underlying.Set(u.key, u.value)
-	if err == badger.ErrTxnTooBig {
-		if txnErr := errTxnTooBigErrorHandler(txn, err); txnErr != nil {
-			return txnErr
-		}
-		return setWithErrTxnTooBigErrorHandling(txn, u)
-	}
-	return wrapError(err)
-}
-
 func (txn *transaction) Write(_ context.Context, op storage.PatchOp, path storage.Path, value interface{}) error {
+	txn.metrics.Timer(writeTimer).Start()
+	defer txn.metrics.Timer(writeTimer).Stop()
+
 	updates, err := txn.partitionWrite(op, path, value)
 	if err != nil {
 		return err
 	}
+
 	for _, u := range updates {
 		if u.delete {
-			if err := deleteWithErrTxnTooBigErrorHandling(txn, &u); err != nil {
+			if err := txn.underlying.Delete(u.key); err != nil {
 				return err
 			}
+			txn.metrics.Counter(deletedKeysCounter).Add(1)
 		} else {
-			if err := setWithErrTxnTooBigErrorHandling(txn, &u); err != nil {
+			if err := txn.underlying.Set(u.key, u.value); err != nil {
 				return err
 			}
+			txn.metrics.Counter(writtenKeysCounter).Add(1)
 		}
+
+		txn.event.Data = append(txn.event.Data, storage.DataEvent{
+			Path:    path,   // ?
+			Data:    u.data, // nil if delete == true
+			Removed: u.delete,
+		})
 	}
 	return nil
 }
 
 func (txn *transaction) partitionWrite(op storage.PatchOp, path storage.Path, value interface{}) ([]update, error) {
 
+	if op == storage.RemoveOp && len(path) == 0 {
+		return nil, &storage.Error{
+			Code:    storage.InvalidPatchErr,
+			Message: "root cannot be removed",
+		}
+	}
+
 	i, node := txn.partitions.Find(path)
 
 	if node == nil {
@@ -241,11 +280,11 @@ func (txn *transaction) partitionWrite(op storage.PatchOp, path storage.Path, va
 		}
 
 		curr, err := txn.readOne(key)
-		if err != nil {
+		if err != nil && err != errNotFound {
 			return nil, err
 		}
 
-		modified, err := patch(curr, op, path[i:], value)
+		modified, err := patch(curr, op, path, i, value)
 		if err != nil {
 			return nil, err
 		}
@@ -254,8 +293,7 @@ func (txn *transaction) partitionWrite(op storage.PatchOp, path storage.Path, va
 		if err != nil {
 			return nil, err
 		}
-
-		return []update{{key: key, value: bs}}, nil
+		return []update{{key: key, value: bs, data: modified}}, nil
 	}
 
 	key, err := txn.pm.DataPrefix2Key(path)
@@ -270,6 +308,7 @@ func (txn *transaction) partitionWrite(op storage.PatchOp, path storage.Path, va
 
 	for it.Rewind(); it.Valid(); it.Next() {
 		updates = append(updates, update{key: it.Item().KeyCopy(nil), delete: true})
+		txn.metrics.Counter(readKeysCounter).Add(1)
 	}
 
 	if op == storage.RemoveOp {
@@ -280,34 +319,62 @@ func (txn *transaction) partitionWrite(op storage.PatchOp, path storage.Path, va
 }
 
 func (txn *transaction) partitionWriteMultiple(node *partitionTrie, path storage.Path, value interface{}, result []update) ([]update, error) {
-
 	// NOTE(tsandall): value must be an object so that it can be partitioned; in
 	// the future, arrays could be supported but that requires investigation.
-	obj, ok := value.(map[string]interface{})
-	if !ok {
+
+	switch v := value.(type) {
+	case map[string]interface{}:
+		bs, err := serialize(v)
+		if err != nil {
+			return nil, err
+		}
+		return txn.doPartitionWriteMultiple(node, path, bs, result)
+	case map[string]json.RawMessage:
+		bs, err := serialize(v)
+		if err != nil {
+			return nil, err
+		}
+		return txn.doPartitionWriteMultiple(node, path, bs, result)
+	case json.RawMessage:
+		return txn.doPartitionWriteMultiple(node, path, v, result)
+	case []uint8:
+		return txn.doPartitionWriteMultiple(node, path, v, result)
+	}
+
+	return nil, &storage.Error{Code: storage.InvalidPatchErr, Message: "value cannot be partitioned"}
+}
+
+func (txn *transaction) doPartitionWriteMultiple(node *partitionTrie, path storage.Path, bs []byte, result []update) ([]update, error) {
+	var obj map[string]json.RawMessage
+	err := util.Unmarshal(bs, &obj)
+	if err != nil {
 		return nil, &storage.Error{Code: storage.InvalidPatchErr, Message: "value cannot be partitioned"}
 	}
 
 	for k, v := range obj {
 		child := append(path, k)
 		next, ok := node.partitions[k]
-		if !ok {
-			key, err := txn.pm.DataPath2Key(child)
-			if err != nil {
-				return nil, err
-			}
-			bs, err := serialize(v)
-			if err != nil {
-				return nil, err
-			}
-			result = append(result, update{key: key, value: bs})
-		} else {
+		if !ok { // try wildcard
+			next, ok = node.partitions[pathWildcard]
+		}
+		if ok {
 			var err error
 			result, err = txn.partitionWriteMultiple(next, child, v, result)
 			if err != nil {
 				return nil, err
 			}
+			continue
+		}
+
+		key, err := txn.pm.DataPath2Key(child)
+		if err != nil {
+			return nil, err
+		}
+		bs, err := serialize(v)
+		if err != nil {
+			return nil, err
 		}
+		result = append(result, update{key: key, value: bs, data: v})
 	}
 
 	return result, nil
@@ -328,10 +395,10 @@ func (txn *transaction) partitionWriteOne(op storage.PatchOp, path storage.Path,
 		return nil, err
 	}
 
-	return []update{{key: key, value: val}}, nil
+	return []update{{key: key, value: val, data: value}}, nil
 }
 
-func (txn *transaction) ListPolicies(context.Context) ([]string, error) {
+func (txn *transaction) ListPolicies(ctx context.Context) ([]string, error) {
 
 	var result []string
 
@@ -344,6 +411,10 @@ func (txn *transaction) ListPolicies(context.Context) ([]string, error) {
 	var key []byte
 
 	for it.Rewind(); it.Valid(); it.Next() {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+		txn.metrics.Counter(readKeysCounter).Add(1)
 		item := it.Item()
 		key = item.KeyCopy(key)
 		result = append(result, txn.pm.PolicyKey2ID(key))
@@ -353,23 +424,49 @@ func (txn *transaction) ListPolicies(context.Context) ([]string, error) {
 }
 
 func (txn *transaction) GetPolicy(_ context.Context, id string) ([]byte, error) {
+	txn.metrics.Counter(readKeysCounter).Add(1)
 	item, err := txn.underlying.Get(txn.pm.PolicyID2Key(id))
 	if err != nil {
+		if err == badger.ErrKeyNotFound {
+			return nil, errors.NewNotFoundErrorf("policy id %q", id)
+		}
 		return nil, err
 	}
 	bs, err := item.ValueCopy(nil)
+	txn.metrics.Counter(readValueBytesCounter).Add(uint64(len(bs)))
 	return bs, wrapError(err)
 }
 
 func (txn *transaction) UpsertPolicy(_ context.Context, id string, bs []byte) error {
-	return wrapError(txn.underlying.Set(txn.pm.PolicyID2Key(id), bs))
+	if err := txn.underlying.Set(txn.pm.PolicyID2Key(id), bs); err != nil {
+		return wrapError(err)
+	}
+	txn.metrics.Counter(writtenKeysCounter).Add(1)
+	txn.event.Policy = append(txn.event.Policy, storage.PolicyEvent{
+		ID:   id,
+		Data: bs,
+	})
+	return nil
 }
 
 func (txn *transaction) DeletePolicy(_ context.Context, id string) error {
-	return wrapError(txn.underlying.Delete(txn.pm.PolicyID2Key(id)))
+	if err := txn.underlying.Delete(txn.pm.PolicyID2Key(id)); err != nil {
+		return wrapError(err)
+	}
+	txn.metrics.Counter(deletedKeysCounter).Add(1)
+	txn.event.Policy = append(txn.event.Policy, storage.PolicyEvent{
+		ID:      id,
+		Removed: true,
+	})
+	return nil
 }
 
 func serialize(value interface{}) ([]byte, error) {
+	val, ok := value.([]byte)
+	if ok {
+		return val, nil
+	}
+
 	bs, err := json.Marshal(value)
 	return bs, wrapError(err)
 }
@@ -379,79 +476,130 @@ func deserialize(bs []byte, result interface{}) error {
 	return wrapError(d.Decode(&result))
 }
 
-func patch(data interface{}, op storage.PatchOp, path storage.Path, value interface{}) (interface{}, error) {
-
-	if len(path) == 0 {
+func patch(data interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (interface{}, error) {
+	if idx == len(path) {
 		panic("unreachable")
 	}
 
+	val := value
+	switch v := value.(type) {
+	case json.RawMessage:
+		var obj map[string]json.RawMessage
+		err := util.Unmarshal(v, &obj)
+		if err == nil {
+			val = obj
+		} else {
+			var obj interface{}
+			err := util.Unmarshal(v, &obj)
+			if err != nil {
+				return nil, err
+			}
+			val = obj
+		}
+	case []uint8:
+		var obj map[string]json.RawMessage
+		err := util.Unmarshal(v, &obj)
+		if err == nil {
+			val = obj
+		} else {
+			var obj interface{}
+			err := util.Unmarshal(v, &obj)
+			if err != nil {
+				return nil, err
+			}
+			val = obj
+		}
+	}
+
 	// Base case: mutate the data value in-place.
-	if len(path) == 1 {
+	if len(path) == idx+1 { // last element
 		switch x := data.(type) {
 		case map[string]interface{}:
+			key := path[len(path)-1]
 			switch op {
 			case storage.RemoveOp:
-				key := path[len(path)-1]
 				if _, ok := x[key]; !ok {
 					return nil, errors.NewNotFoundError(path)
 				}
 				delete(x, key)
 				return x, nil
 			case storage.ReplaceOp:
-				key := path[len(path)-1]
 				if _, ok := x[key]; !ok {
 					return nil, errors.NewNotFoundError(path)
 				}
-				x[key] = value
+				x[key] = val
 				return x, nil
 			case storage.AddOp:
-				key := path[len(path)-1]
-				x[key] = value
+				x[key] = val
 				return x, nil
 			}
 		case []interface{}:
-			if path[0] == "-" {
-				return append(x, value), nil
-			}
-			idx, err := ptr.ValidateArrayIndex(x, path[0], path)
-			if err != nil {
-				return nil, err
+			switch op {
+			case storage.AddOp:
+				if path[idx] == "-" || path[idx] == strconv.Itoa(len(x)) {
+					return append(x, val), nil
+				}
+				i, err := ptr.ValidateArrayIndexForWrite(x, path[idx], idx, path)
+				if err != nil {
+					return nil, err
+				}
+				// insert at i
+				return append(x[:i], append([]interface{}{val}, x[i:]...)...), nil
+			case storage.ReplaceOp:
+				i, err := ptr.ValidateArrayIndexForWrite(x, path[idx], idx, path)
+				if err != nil {
+					return nil, err
+				}
+				x[i] = val
+				return x, nil
+			case storage.RemoveOp:
+				i, err := ptr.ValidateArrayIndexForWrite(x, path[idx], idx, path)
+				if err != nil {
+					return nil, err
+
+				}
+				return append(x[:i], x[i+1:]...), nil // i is skipped
+			default:
+				panic("unreachable")
 			}
-			x[idx] = value
-			return x, nil
+		case nil: // data wasn't set before
+			return map[string]interface{}{path[idx]: val}, nil
 		default:
 			return nil, errors.NewNotFoundError(path)
 		}
 	}
 
 	// Recurse on the value located at the next part of the path.
-	key := path[0]
+	key := path[idx]
 
 	switch x := data.(type) {
 	case map[string]interface{}:
-		child, ok := x[key]
-		if !ok {
-			return nil, errors.NewNotFoundError(path)
-		}
-		modified, err := patch(child, op, path[1:], value)
+		modified, err := patch(x[key], op, path, idx+1, val)
 		if err != nil {
 			return nil, err
 		}
 		x[key] = modified
 		return x, nil
 	case []interface{}:
-		idx, err := ptr.ValidateArrayIndex(x, path[0], path)
+		i, err := ptr.ValidateArrayIndexForWrite(x, path[idx], idx+1, path)
 		if err != nil {
 			return nil, err
 		}
-		modified, err := patch(x[idx], op, path[1:], value)
+		modified, err := patch(x[i], op, path, idx+1, val)
 		if err != nil {
 			return nil, err
 		}
-		x[idx] = modified
+		x[i] = modified
 		return x, nil
+	case nil: // data isn't there yet
+		y := make(map[string]interface{}, 1)
+		modified, err := patch(nil, op, path, idx+1, val)
+		if err != nil {
+			return nil, err
+		}
+		y[key] = modified
+		return y, nil
 	default:
 		return nil, errors.NewNotFoundError(path)
 	}
-
 }
diff --git a/storage/disk/txn_test.go b/storage/disk/txn_test.go
index fa319f3023..2f2d4906f0 100644
--- a/storage/disk/txn_test.go
+++ b/storage/disk/txn_test.go
@@ -6,13 +6,14 @@ package disk
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"math/rand"
-	"strconv"
-	"strings"
 	"testing"
 
+	"github.com/dgraph-io/badger/v3"
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/util"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -26,57 +27,54 @@ func randomString(n int) string {
 	return string(s)
 }
 
-func fixture(nbKeys int) interface{} {
-	i := 1
-	var keyValues = []string{}
-	for i <= nbKeys {
-		keyValues = append(keyValues, "\""+strconv.Itoa(i)+randomString(4)+"\": \""+randomString(3)+"\"")
-		i++
+func fixture(n int) map[string]interface{} {
+	foo := map[string]string{}
+	for i := 0; i < n; i++ {
+		foo[fmt.Sprintf(`"%d%s"`, i, randomString(4))] = randomString(3)
 	}
-	jsonBytes := []byte(`{"foo":{` + strings.Join(keyValues, ",") + `}}`)
-	return util.MustUnmarshalJSON(jsonBytes)
+	return map[string]interface{}{"foo": foo}
 }
 
-func TestSetTxnIsTooBigToFitIntoOneRequestWhenUseDiskStore(t *testing.T) {
-	test.WithTempFS(map[string]string{}, func(dir string) {
+func TestSetTxnIsTooBigToFitIntoOneRequestWhenUseDiskStoreReturnsError(t *testing.T) {
+	test.WithTempFS(nil, func(dir string) {
 		ctx := context.Background()
-		s, err := New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo"),
 		}})
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		nbKeys := 140_000 // !!! 135_000 it's ok, but 140_000 not
+		nbKeys := 140_000 // 135_000 is ok, but 140_000 not
 		jsonFixture := fixture(nbKeys)
-		errTxn := storage.Txn(ctx, s, storage.WriteParams, func(txn storage.Transaction) error {
-
-			errTxnWrite := s.Write(ctx, txn, storage.AddOp, storage.MustParsePath("/"), jsonFixture)
-			if errTxnWrite != nil {
-				t.Fatal(errTxnWrite)
+		err = storage.Txn(ctx, s, storage.WriteParams, func(txn storage.Transaction) error {
+			err := s.Write(ctx, txn, storage.AddOp, storage.MustParsePath("/"), jsonFixture)
+			if !errors.Is(err, badger.ErrTxnTooBig) {
+				t.Errorf("expected %v, got %v", badger.ErrTxnTooBig, err)
 			}
-			return nil
+			return err
 		})
-		if errTxn != nil {
-			t.Fatal(errTxn)
+		if !errors.Is(err, badger.ErrTxnTooBig) {
+			t.Errorf("expected %v, got %v", badger.ErrTxnTooBig, err)
 		}
 
-		result, errRead := storage.ReadOne(ctx, s, storage.MustParsePath("/foo"))
-		if errRead != nil {
-			t.Fatal(errRead)
+		_, err = storage.ReadOne(ctx, s, storage.MustParsePath("/foo"))
+		var notFound *storage.Error
+		ok := errors.As(err, &notFound)
+		if !ok {
+			t.Errorf("expected %T, got %v", notFound, err)
 		}
-		actualNbKeys := len(result.(map[string]interface{}))
-		if nbKeys != actualNbKeys {
-			t.Fatalf("Expected %d keys, read %d", nbKeys, actualNbKeys)
+		if exp, act := storage.NotFoundErr, notFound.Code; exp != act {
+			t.Errorf("expected code %v, got %v", exp, act)
 		}
 	})
 
 }
 
 func TestDeleteTxnIsTooBigToFitIntoOneRequestWhenUseDiskStore(t *testing.T) {
-	test.WithTempFS(map[string]string{}, func(dir string) {
+	test.WithTempFS(nil, func(dir string) {
 		ctx := context.Background()
-		s, err := New(ctx, Options{Dir: dir, Partitions: []storage.Path{
+		s, err := New(ctx, logging.NewNoOpLogger(), nil, Options{Dir: dir, Partitions: []storage.Path{
 			storage.MustParsePath("/foo"),
 		}})
 		if err != nil {
@@ -84,36 +82,45 @@ func TestDeleteTxnIsTooBigToFitIntoOneRequestWhenUseDiskStore(t *testing.T) {
 		}
 		nbKeys := 200_000
 		jsonFixture := fixture(nbKeys)
-		errTxn := storage.Txn(ctx, s, storage.WriteParams, func(txn storage.Transaction) error {
+		foo := jsonFixture["foo"].(map[string]string)
 
-			errTxnWrite := s.Write(ctx, txn, storage.AddOp, storage.MustParsePath("/"), jsonFixture)
-			if errTxnWrite != nil {
-				t.Fatal(errTxnWrite)
+		// Write data in increments so we don't step over the too-large-txn limit
+		for k, v := range foo {
+			err := storage.WriteOne(ctx, s, storage.AddOp, storage.MustParsePath("/foo/"+k), v)
+			if err != nil {
+				t.Fatal(err)
 			}
-			return nil
-		})
-		if errTxn != nil {
-			t.Fatal(errTxn)
 		}
 
-		errTxnD := storage.Txn(ctx, s, storage.WriteParams, func(txn storage.Transaction) error {
-			errTxnWrite := s.Write(ctx, txn, storage.RemoveOp, storage.MustParsePath("/foo"), jsonFixture)
-			if errTxnWrite != nil {
-				t.Fatal(errTxnWrite)
+		// check expected state
+		res, err := storage.ReadOne(ctx, s, storage.MustParsePath("/foo"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if exp, act := nbKeys, len(res.(map[string]interface{})); exp != act {
+			t.Fatalf("expected %d keys, read %d", exp, act)
+		}
+
+		err = storage.Txn(ctx, s, storage.WriteParams, func(txn storage.Transaction) error {
+			err := s.Write(ctx, txn, storage.RemoveOp, storage.MustParsePath("/foo"), jsonFixture)
+			if !errors.Is(err, badger.ErrTxnTooBig) {
+				t.Errorf("expected %v, got %v", badger.ErrTxnTooBig, err)
 			}
-			return nil
+			return err
 		})
-		if errTxnD != nil {
-			t.Fatal(errTxnD)
+		if !errors.Is(err, badger.ErrTxnTooBig) {
+			t.Errorf("expected %v, got %v", badger.ErrTxnTooBig, err)
 		}
 
-		results, errRead := storage.ReadOne(ctx, s, storage.MustParsePath("/foo"))
-		if !storage.IsNotFound(errRead) {
-			t.Fatal(errRead)
+		// check expected state again
+		res, err = storage.ReadOne(ctx, s, storage.MustParsePath("/foo"))
+		if err != nil {
+			t.Fatal(err)
 		}
-		if results != nil {
-			t.Fatalf("Unexpected results %v", results)
+		if exp, act := nbKeys, len(res.(map[string]interface{})); exp != act {
+			t.Fatalf("expected %d keys, read %d", exp, act)
 		}
+
 	})
 
 }
diff --git a/storage/errors.go b/storage/errors.go
index d83b275ac7..8c789052ed 100644
--- a/storage/errors.go
+++ b/storage/errors.go
@@ -51,7 +51,7 @@ func (err *Error) Error() string {
 	if err.Message != "" {
 		return fmt.Sprintf("%v: %v", err.Code, err.Message)
 	}
-	return string(err.Code)
+	return err.Code
 }
 
 // IsNotFound returns true if this error is a NotFoundErr.
@@ -99,7 +99,7 @@ func IsIndexingNotSupported(error) bool { return false }
 func writeConflictError(path Path) *Error {
 	return &Error{
 		Code:    WriteConflictErr,
-		Message: fmt.Sprint(path),
+		Message: path.String(),
 	}
 }
 
diff --git a/storage/inmem/inmem.go b/storage/inmem/inmem.go
index b691800499..b6433795a3 100644
--- a/storage/inmem/inmem.go
+++ b/storage/inmem/inmem.go
@@ -19,25 +19,46 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"path/filepath"
+	"strings"
 	"sync"
 	"sync/atomic"
 
+	"github.com/open-policy-agent/opa/internal/merge"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/util"
 )
 
 // New returns an empty in-memory store.
 func New() storage.Store {
-	return &store{
-		data:     map[string]interface{}{},
-		triggers: map[*handle]storage.TriggerConfig{},
-		policies: map[string][]byte{},
+	return NewWithOpts()
+}
+
+// NewWithOpts returns an empty in-memory store, with extra options passed.
+func NewWithOpts(opts ...Opt) storage.Store {
+	s := &store{
+		data:             map[string]interface{}{},
+		triggers:         map[*handle]storage.TriggerConfig{},
+		policies:         map[string][]byte{},
+		roundTripOnWrite: true,
+	}
+
+	for _, opt := range opts {
+		opt(s)
 	}
+
+	return s
 }
 
 // NewFromObject returns a new in-memory store from the supplied data object.
 func NewFromObject(data map[string]interface{}) storage.Store {
-	db := New()
+	return NewFromObjectWithOpts(data)
+}
+
+// NewFromObject returns a new in-memory store from the supplied data object, with the
+// options passed.
+func NewFromObjectWithOpts(data map[string]interface{}, opts ...Opt) storage.Store {
+	db := NewWithOpts(opts...)
 	ctx := context.Background()
 	txn, err := db.NewTransaction(ctx, storage.WriteParams)
 	if err != nil {
@@ -55,12 +76,18 @@ func NewFromObject(data map[string]interface{}) storage.Store {
 // NewFromReader returns a new in-memory store from a reader that produces a
 // JSON serialized object. This function is for test purposes.
 func NewFromReader(r io.Reader) storage.Store {
+	return NewFromReaderWithOpts(r)
+}
+
+// NewFromReader returns a new in-memory store from a reader that produces a
+// JSON serialized object, with extra options. This function is for test purposes.
+func NewFromReaderWithOpts(r io.Reader, opts ...Opt) storage.Store {
 	d := util.NewJSONDecoder(r)
 	var data map[string]interface{}
 	if err := d.Decode(&data); err != nil {
 		panic(err)
 	}
-	return NewFromObject(data)
+	return NewFromObjectWithOpts(data, opts...)
 }
 
 type store struct {
@@ -70,18 +97,22 @@ type store struct {
 	data     map[string]interface{}            // raw data
 	policies map[string][]byte                 // raw policies
 	triggers map[*handle]storage.TriggerConfig // registered triggers
+
+	// roundTripOnWrite, if true, means that every call to Write round trips the
+	// data through JSON before adding the data to the store. Defaults to true.
+	roundTripOnWrite bool
 }
 
 type handle struct {
 	db *store
 }
 
-func (db *store) NewTransaction(ctx context.Context, params ...storage.TransactionParams) (storage.Transaction, error) {
+func (db *store) NewTransaction(_ context.Context, params ...storage.TransactionParams) (storage.Transaction, error) {
 	var write bool
-	var context *storage.Context
+	var ctx *storage.Context
 	if len(params) > 0 {
 		write = params[0].Write
-		context = params[0].Context
+		ctx = params[0].Context
 	}
 	xid := atomic.AddUint64(&db.xid, uint64(1))
 	if write {
@@ -89,7 +120,90 @@ func (db *store) NewTransaction(ctx context.Context, params ...storage.Transacti
 	} else {
 		db.rmu.RLock()
 	}
-	return newTransaction(xid, write, context, db), nil
+	return newTransaction(xid, write, ctx, db), nil
+}
+
+// Truncate implements the storage.Store interface. This method must be called within a transaction.
+func (db *store) Truncate(ctx context.Context, txn storage.Transaction, params storage.TransactionParams, it storage.Iterator) error {
+	var update *storage.Update
+	var err error
+	mergedData := map[string]interface{}{}
+
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+
+	for {
+		update, err = it.Next()
+		if err != nil {
+			break
+		}
+
+		if update.IsPolicy {
+			err = underlying.UpsertPolicy(strings.TrimLeft(update.Path.String(), "/"), update.Value)
+			if err != nil {
+				return err
+			}
+		} else {
+			var value interface{}
+			err = util.Unmarshal(update.Value, &value)
+			if err != nil {
+				return err
+			}
+
+			var key []string
+			dirpath := strings.TrimLeft(update.Path.String(), "/")
+			if len(dirpath) > 0 {
+				key = strings.Split(dirpath, "/")
+			}
+
+			if value != nil {
+				obj, err := mktree(key, value)
+				if err != nil {
+					return err
+				}
+
+				merged, ok := merge.InterfaceMaps(mergedData, obj)
+				if !ok {
+					return fmt.Errorf("failed to insert data file from path %s", filepath.Join(key...))
+				}
+				mergedData = merged
+			}
+		}
+	}
+
+	if err != nil && err != io.EOF {
+		return err
+	}
+
+	// For backwards compatibility, check if `RootOverwrite` was configured.
+	if params.RootOverwrite {
+		newPath, ok := storage.ParsePathEscaped("/")
+		if !ok {
+			return fmt.Errorf("storage path invalid: %v", newPath)
+		}
+		return underlying.Write(storage.AddOp, newPath, mergedData)
+	}
+
+	for _, root := range params.BasePaths {
+		newPath, ok := storage.ParsePathEscaped("/" + root)
+		if !ok {
+			return fmt.Errorf("storage path invalid: %v", newPath)
+		}
+
+		if value, ok := lookup(newPath, mergedData); ok {
+			if len(newPath) > 0 {
+				if err := storage.MakeDir(ctx, db, txn, newPath[:len(newPath)-1]); err != nil {
+					return err
+				}
+			}
+			if err := underlying.Write(storage.AddOp, newPath, value); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
 }
 
 func (db *store) Commit(ctx context.Context, txn storage.Transaction) error {
@@ -101,7 +215,7 @@ func (db *store) Commit(ctx context.Context, txn storage.Transaction) error {
 		db.rmu.Lock()
 		event := underlying.Commit()
 		db.runOnCommitTriggers(ctx, txn, event)
-		// Mark the transaction stale after executing triggers so they can
+		// Mark the transaction stale after executing triggers, so they can
 		// perform store operations if needed.
 		underlying.stale = true
 		db.rmu.Unlock()
@@ -112,7 +226,7 @@ func (db *store) Commit(ctx context.Context, txn storage.Transaction) error {
 	return nil
 }
 
-func (db *store) Abort(ctx context.Context, txn storage.Transaction) {
+func (db *store) Abort(_ context.Context, txn storage.Transaction) {
 	underlying, err := db.underlying(txn)
 	if err != nil {
 		panic(err)
@@ -160,7 +274,7 @@ func (db *store) DeletePolicy(_ context.Context, txn storage.Transaction, id str
 	return underlying.DeletePolicy(id)
 }
 
-func (db *store) Register(ctx context.Context, txn storage.Transaction, config storage.TriggerConfig) (storage.TriggerHandle, error) {
+func (db *store) Register(_ context.Context, txn storage.Transaction, config storage.TriggerConfig) (storage.TriggerHandle, error) {
 	underlying, err := db.underlying(txn)
 	if err != nil {
 		return nil, err
@@ -176,7 +290,7 @@ func (db *store) Register(ctx context.Context, txn storage.Transaction, config s
 	return h, nil
 }
 
-func (db *store) Read(ctx context.Context, txn storage.Transaction, path storage.Path) (interface{}, error) {
+func (db *store) Read(_ context.Context, txn storage.Transaction, path storage.Path) (interface{}, error) {
 	underlying, err := db.underlying(txn)
 	if err != nil {
 		return nil, err
@@ -184,19 +298,21 @@ func (db *store) Read(ctx context.Context, txn storage.Transaction, path storage
 	return underlying.Read(path)
 }
 
-func (db *store) Write(ctx context.Context, txn storage.Transaction, op storage.PatchOp, path storage.Path, value interface{}) error {
+func (db *store) Write(_ context.Context, txn storage.Transaction, op storage.PatchOp, path storage.Path, value interface{}) error {
 	underlying, err := db.underlying(txn)
 	if err != nil {
 		return err
 	}
 	val := util.Reference(value)
-	if err := util.RoundTrip(val); err != nil {
-		return err
+	if db.roundTripOnWrite {
+		if err := util.RoundTrip(val); err != nil {
+			return err
+		}
 	}
 	return underlying.Write(op, path, *val)
 }
 
-func (h *handle) Unregister(ctx context.Context, txn storage.Transaction) {
+func (h *handle) Unregister(_ context.Context, txn storage.Transaction) {
 	underlying, err := h.db.underlying(txn)
 	if err != nil {
 		panic(err)
@@ -239,8 +355,8 @@ func (db *store) underlying(txn storage.Transaction) (*transaction, error) {
 	return underlying, nil
 }
 
-var rootMustBeObjectMsg = "root must be object"
-var rootCannotBeRemovedMsg = "root cannot be removed"
+const rootMustBeObjectMsg = "root must be object"
+const rootCannotBeRemovedMsg = "root cannot be removed"
 
 func invalidPatchError(f string, a ...interface{}) *storage.Error {
 	return &storage.Error{
@@ -248,3 +364,43 @@ func invalidPatchError(f string, a ...interface{}) *storage.Error {
 		Message: fmt.Sprintf(f, a...),
 	}
 }
+
+func mktree(path []string, value interface{}) (map[string]interface{}, error) {
+	if len(path) == 0 {
+		// For 0 length path the value is the full tree.
+		obj, ok := value.(map[string]interface{})
+		if !ok {
+			return nil, invalidPatchError(rootMustBeObjectMsg)
+		}
+		return obj, nil
+	}
+
+	dir := map[string]interface{}{}
+	for i := len(path) - 1; i > 0; i-- {
+		dir[path[i]] = value
+		value = dir
+		dir = map[string]interface{}{}
+	}
+	dir[path[0]] = value
+
+	return dir, nil
+}
+
+func lookup(path storage.Path, data map[string]interface{}) (interface{}, bool) {
+	if len(path) == 0 {
+		return data, true
+	}
+	for i := 0; i < len(path)-1; i++ {
+		value, ok := data[path[i]]
+		if !ok {
+			return nil, false
+		}
+		obj, ok := value.(map[string]interface{})
+		if !ok {
+			return nil, false
+		}
+		data = obj
+	}
+	value, ok := data[path[len(path)-1]]
+	return value, ok
+}
diff --git a/storage/inmem/inmem_test.go b/storage/inmem/inmem_test.go
index ced8fb95d3..0999c13934 100644
--- a/storage/inmem/inmem_test.go
+++ b/storage/inmem/inmem_test.go
@@ -11,7 +11,9 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/open-policy-agent/opa/storage/internal/errors"
+	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/internal/file/archive"
+	storageerrors "github.com/open-policy-agent/opa/storage/internal/errors"
 
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/util"
@@ -35,12 +37,12 @@ func TestInMemoryRead(t *testing.T) {
 		{"/d/e/1", "baz"},
 		{"/d/e", []interface{}{"bar", "baz"}},
 		{"/c/0/z", map[string]interface{}{"p": true, "q": false}},
-		{"/a/0/beef", errors.NewNotFoundError(storage.MustParsePath("/a/0/beef"))},
-		{"/d/100", errors.NewNotFoundError(storage.MustParsePath("/d/100"))},
-		{"/dead/beef", errors.NewNotFoundError(storage.MustParsePath("/dead/beef"))},
-		{"/a/str", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/str"), errors.ArrayIndexTypeMsg)},
-		{"/a/100", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/100"), errors.OutOfRangeMsg)},
-		{"/a/-1", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/-1"), errors.OutOfRangeMsg)},
+		{"/a/0/beef", storageerrors.NewNotFoundError(storage.MustParsePath("/a/0/beef"))},
+		{"/d/100", storageerrors.NewNotFoundError(storage.MustParsePath("/d/100"))},
+		{"/dead/beef", storageerrors.NewNotFoundError(storage.MustParsePath("/dead/beef"))},
+		{"/a/str", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/str"), storageerrors.ArrayIndexTypeMsg)},
+		{"/a/100", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/100"), storageerrors.OutOfRangeMsg)},
+		{"/a/-1", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/-1"), storageerrors.OutOfRangeMsg)},
 	}
 
 	store := NewFromObject(data)
@@ -87,12 +89,15 @@ func TestInMemoryWrite(t *testing.T) {
 		{"add obj (existing)", "add", "/b/v2", `"x"`, nil, "/b", `{"v1": "hello", "v2": "x"}`},
 
 		{"append arr", "add", "/a/-", `"x"`, nil, "/a", `[1,2,3,4,"x"]`},
+		{"append arr-2", "add", "/a/4", `"x"`, nil, "/a", `[1,2,3,4,"x"]`},
 		{"append obj/arr", "add", `/c/0/x/-`, `"x"`, nil, "/c/0/x", `[true,false,"foo","x"]`},
+		{"append obj/arr-2", "add", `/c/0/x/3`, `"x"`, nil, "/c/0/x", `[true,false,"foo","x"]`},
 		{"append arr/arr", "add", `/h/0/-`, `"x"`, nil, `/h/0/3`, `"x"`},
+		{"append arr/arr-2", "add", `/h/0/3`, `"x"`, nil, `/h/0/3`, `"x"`},
 		{"append err", "remove", "/c/0/x/-", "", invalidPatchError("/c/0/x/-: invalid patch path"), "", nil},
 		{"append err-2", "replace", "/c/0/x/-", "", invalidPatchError("/c/0/x/-: invalid patch path"), "", nil},
 
-		{"remove", "remove", "/a", "", nil, "/a", errors.NewNotFoundError(storage.MustParsePath("/a"))},
+		{"remove", "remove", "/a", "", nil, "/a", storageerrors.NewNotFoundError(storage.MustParsePath("/a"))},
 		{"remove arr", "remove", "/a/1", "", nil, "/a", "[1,3,4]"},
 		{"remove obj/arr", "remove", "/c/0/x/1", "", nil, "/c/0/x", `[true,"foo"]`},
 		{"remove arr/arr", "remove", "/h/0/1", "", nil, "/h/0", "[1,3]"},
@@ -105,21 +110,21 @@ func TestInMemoryWrite(t *testing.T) {
 
 		{"err: bad root type", "add", "/", "[1,2,3]", invalidPatchError(rootMustBeObjectMsg), "", nil},
 		{"err: remove root", "remove", "/", "", invalidPatchError(rootCannotBeRemovedMsg), "", nil},
-		{"err: add arr (non-integer)", "add", "/a/foo", "1", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/foo"), errors.ArrayIndexTypeMsg), "", nil},
-		{"err: add arr (non-integer)", "add", "/a/3.14", "1", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/3.14"), errors.ArrayIndexTypeMsg), "", nil},
-		{"err: add arr (out of range)", "add", "/a/5", "1", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/5"), errors.OutOfRangeMsg), "", nil},
-		{"err: add arr (out of range)", "add", "/a/-1", "1", errors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/-1"), errors.OutOfRangeMsg), "", nil},
-		{"err: add arr (missing root)", "add", "/dead/beef/0", "1", errors.NewNotFoundError(storage.MustParsePath("/dead/beef/0")), "", nil},
-		{"err: add non-coll", "add", "/a/1/2", "1", errors.NewNotFoundError(storage.MustParsePath("/a/1/2")), "", nil},
-		{"err: append (missing)", "add", `/dead/beef/-`, "1", errors.NewNotFoundError(storage.MustParsePath("/dead/beef/-")), "", nil},
-		{"err: append obj/arr", "add", `/c/0/deadbeef/-`, `"x"`, errors.NewNotFoundError(storage.MustParsePath("/c/0/deadbeef/-")), "", nil},
-		{"err: append arr/arr (out of range)", "add", `/h/9999/-`, `"x"`, errors.NewNotFoundErrorWithHint(storage.MustParsePath("/h/9999/-"), errors.OutOfRangeMsg), "", nil},
-		{"err: append append+add", "add", `/a/-/b/-`, `"x"`, errors.NewNotFoundErrorWithHint(storage.MustParsePath(`/a/-/b/-`), errors.ArrayIndexTypeMsg), "", nil},
-		{"err: append arr/arr (non-array)", "add", `/b/v1/-`, "1", errors.NewNotFoundError(storage.MustParsePath("/b/v1/-")), "", nil},
-		{"err: remove missing", "remove", "/dead/beef/0", "", errors.NewNotFoundError(storage.MustParsePath("/dead/beef/0")), "", nil},
-		{"err: remove obj (missing)", "remove", "/b/deadbeef", "", errors.NewNotFoundError(storage.MustParsePath("/b/deadbeef")), "", nil},
-		{"err: replace root (missing)", "replace", "/deadbeef", "1", errors.NewNotFoundError(storage.MustParsePath("/deadbeef")), "", nil},
-		{"err: replace missing", "replace", "/dead/beef/1", "1", errors.NewNotFoundError(storage.MustParsePath("/dead/beef/1")), "", nil},
+		{"err: add arr (non-integer)", "add", "/a/foo", "1", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/foo"), storageerrors.ArrayIndexTypeMsg), "", nil},
+		{"err: add arr (non-integer)", "add", "/a/3.14", "1", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/3.14"), storageerrors.ArrayIndexTypeMsg), "", nil},
+		{"err: add arr (out of range)", "add", "/a/5", "1", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/5"), storageerrors.OutOfRangeMsg), "", nil},
+		{"err: add arr (out of range)", "add", "/a/-1", "1", storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/a/-1"), storageerrors.OutOfRangeMsg), "", nil},
+		{"err: add arr (missing root)", "add", "/dead/beef/0", "1", storageerrors.NewNotFoundError(storage.MustParsePath("/dead/beef/0")), "", nil},
+		{"err: add non-coll", "add", "/a/1/2", "1", storageerrors.NewNotFoundError(storage.MustParsePath("/a/1/2")), "", nil},
+		{"err: append (missing)", "add", `/dead/beef/-`, "1", storageerrors.NewNotFoundError(storage.MustParsePath("/dead/beef/-")), "", nil},
+		{"err: append obj/arr", "add", `/c/0/deadbeef/-`, `"x"`, storageerrors.NewNotFoundError(storage.MustParsePath("/c/0/deadbeef/-")), "", nil},
+		{"err: append arr/arr (out of range)", "add", `/h/9999/-`, `"x"`, storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath("/h/9999/-"), storageerrors.OutOfRangeMsg), "", nil},
+		{"err: append append+add", "add", `/a/-/b/-`, `"x"`, storageerrors.NewNotFoundErrorWithHint(storage.MustParsePath(`/a/-/b/-`), storageerrors.ArrayIndexTypeMsg), "", nil},
+		{"err: append arr/arr (non-array)", "add", `/b/v1/-`, "1", storageerrors.NewNotFoundError(storage.MustParsePath("/b/v1/-")), "", nil},
+		{"err: remove missing", "remove", "/dead/beef/0", "", storageerrors.NewNotFoundError(storage.MustParsePath("/dead/beef/0")), "", nil},
+		{"err: remove obj (missing)", "remove", "/b/deadbeef", "", storageerrors.NewNotFoundError(storage.MustParsePath("/b/deadbeef")), "", nil},
+		{"err: replace root (missing)", "replace", "/deadbeef", "1", storageerrors.NewNotFoundError(storage.MustParsePath("/deadbeef")), "", nil},
+		{"err: replace missing", "replace", "/dead/beef/1", "1", storageerrors.NewNotFoundError(storage.MustParsePath("/dead/beef/1")), "", nil},
 	}
 
 	ctx := context.Background()
@@ -255,12 +260,14 @@ func TestInMemoryTxnMultipleWrites(t *testing.T) {
 		{storage.AddOp, "/a/-", "[]"},
 		{storage.AddOp, "/a/4/-", "1"},
 		{storage.AddOp, "/a/4/-", "2"},
+		{storage.AddOp, "/a/4/2", "3"},
 		{storage.AddOp, "/b/foo", "{}"},
 		{storage.AddOp, "/b/foo/bar", "{}"},
 		{storage.AddOp, "/b/foo/bar/baz", "1"},
 		{storage.AddOp, "/arr", "[]"},
 		{storage.AddOp, "/arr/-", "1"},
 		{storage.AddOp, "/arr/0", "2"},
+		{storage.AddOp, "/arr/2", "3"},
 		{storage.AddOp, "/c/0/x/-", "0"},
 		{storage.AddOp, "/_", "null"}, // introduce new txn.log head
 		{storage.AddOp, "/c/0", `"new c[0]"`},
@@ -275,9 +282,9 @@ func TestInMemoryTxnMultipleWrites(t *testing.T) {
 		path     string
 		expected string
 	}{
-		{"/a", `[1,2,3,4,[1,2]]`},
+		{"/a", `[1,2,3,4,[1,2,3]]`},
 		{"/b/foo", `{"bar": {"baz": 1}}`},
-		{"/arr", `[2,1]`},
+		{"/arr", `[2,1,3]`},
 		{"/c/0", `"new c[0]"`},
 		{"/c/1", `"new c[1]"`},
 		{"/d/f", `{"g": {"h": 0, "i": {"j": 1}}}`},
@@ -318,6 +325,230 @@ func TestInMemoryTxnMultipleWrites(t *testing.T) {
 	}
 }
 
+func TestTruncateNoExistingPath(t *testing.T) {
+	ctx := context.Background()
+	store := NewFromObject(map[string]interface{}{})
+	txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+	var archiveFiles = map[string]string{
+		"/a/b/c/data.json": "[1,2,3]",
+	}
+
+	files := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	b, err := bundle.NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := bundle.NewIterator(b.Raw)
+
+	params := storage.WriteParams
+	params.BasePaths = []string{""}
+
+	err = store.Truncate(ctx, txn, params, iterator)
+	if err != nil {
+		t.Fatalf("Unexpected truncate error: %v", err)
+	}
+
+	if err := store.Commit(ctx, txn); err != nil {
+		t.Fatalf("Unexpected commit error: %v", err)
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, store)
+
+	actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `
+{
+	"a": {
+		"b": {
+			"c": [1,2,3]
+		}
+	}
+}
+`
+	jsn := util.MustUnmarshalJSON([]byte(expected))
+
+	if !reflect.DeepEqual(jsn, actual) {
+		t.Fatalf("Expected reader's read to be %v but got: %v", jsn, actual)
+	}
+}
+
+func TestTruncate(t *testing.T) {
+	ctx := context.Background()
+	store := NewFromObject(map[string]interface{}{})
+	txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+	var archiveFiles = map[string]string{
+		"/a/b/c/data.json":   "[1,2,3]",
+		"/a/b/d/data.json":   "true",
+		"/data.json":         `{"x": {"y": true}, "a": {"b": {"z": true}}}}`,
+		"/a/b/y/data.yaml":   `foo: 1`,
+		"/policy.rego":       "package foo\n p = 1",
+		"/roles/policy.rego": "package bar\n p = 1",
+	}
+
+	files := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	b, err := bundle.NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := bundle.NewIterator(b.Raw)
+
+	params := storage.WriteParams
+	params.BasePaths = []string{""}
+
+	err = store.Truncate(ctx, txn, params, iterator)
+	if err != nil {
+		t.Fatalf("Unexpected truncate error: %v", err)
+	}
+
+	if err := store.Commit(ctx, txn); err != nil {
+		t.Fatalf("Unexpected commit error: %v", err)
+	}
+
+	txn = storage.NewTransactionOrDie(ctx, store)
+
+	actual, err := store.Read(ctx, txn, storage.MustParsePath("/"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expected := `
+{
+	"a": {
+		"b": {
+			"c": [1,2,3],
+			"d": true,
+			"y": {
+				"foo": 1
+			},
+			"z": true
+		}
+	},
+	"x": {
+		"y": true
+	}
+}
+`
+	jsn := util.MustUnmarshalJSON([]byte(expected))
+
+	if !reflect.DeepEqual(jsn, actual) {
+		t.Fatalf("Expected reader's read to be %v but got: %v", jsn, actual)
+	}
+
+	store.Abort(ctx, txn)
+
+	txn = storage.NewTransactionOrDie(ctx, store)
+	ids, err := store.ListPolicies(ctx, txn)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	expectedIds := map[string]struct{}{"policy.rego": {}, "roles/policy.rego": {}}
+
+	for _, id := range ids {
+		if _, ok := expectedIds[id]; !ok {
+			t.Fatalf("Expected list policies to contain %v but got: %v", id, expectedIds)
+		}
+	}
+
+	bs, err := store.GetPolicy(ctx, txn, "policy.rego")
+	expectedBytes := []byte("package foo\n p = 1")
+	if err != nil || !reflect.DeepEqual(expectedBytes, bs) {
+		t.Fatalf("Expected get policy to return %v but got: %v (err: %v)", expectedBytes, bs, err)
+	}
+
+	bs, err = store.GetPolicy(ctx, txn, "roles/policy.rego")
+	expectedBytes = []byte("package bar\n p = 1")
+	if err != nil || !reflect.DeepEqual(expectedBytes, bs) {
+		t.Fatalf("Expected get policy to return %v but got: %v (err: %v)", expectedBytes, bs, err)
+	}
+}
+
+func TestTruncateDataMergeError(t *testing.T) {
+	ctx := context.Background()
+	store := NewFromObject(map[string]interface{}{})
+	txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+	var archiveFiles = map[string]string{
+		"/a/b/data.json": `{"c": "foo"}`,
+		"/data.json":     `{"a": {"b": {"c": "bar"}}}`,
+	}
+
+	files := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	b, err := bundle.NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := bundle.NewIterator(b.Raw)
+
+	err = store.Truncate(ctx, txn, storage.WriteParams, iterator)
+	if err == nil {
+		t.Fatal("Expected truncate error but got nil")
+	}
+
+	expected := "failed to insert data file from path a/b"
+	if err.Error() != expected {
+		t.Fatalf("Expected error %v but got %v", expected, err.Error())
+	}
+}
+
+func TestTruncateBadRootWrite(t *testing.T) {
+	ctx := context.Background()
+	store := NewFromObject(map[string]interface{}{})
+	txn := storage.NewTransactionOrDie(ctx, store, storage.WriteParams)
+
+	var archiveFiles = map[string]string{
+		"/a/b/d/data.json":   "true",
+		"/data.json":         "[1,2,3]",
+		"/roles/policy.rego": "package bar\n p = 1",
+	}
+
+	files := make([][2]string, 0, len(archiveFiles))
+	for name, content := range archiveFiles {
+		files = append(files, [2]string{name, content})
+	}
+
+	buf := archive.MustWriteTarGz(files)
+	b, err := bundle.NewReader(buf).WithLazyLoadingMode(true).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	iterator := bundle.NewIterator(b.Raw)
+
+	err = store.Truncate(ctx, txn, storage.WriteParams, iterator)
+	if err == nil {
+		t.Fatal("Expected truncate error but got nil")
+	}
+
+	expected := "storage_invalid_patch_error: root must be object"
+	if err.Error() != expected {
+		t.Fatalf("Expected error %v but got %v", expected, err.Error())
+	}
+}
+
 func TestInMemoryTxnWriteFailures(t *testing.T) {
 
 	ctx := context.Background()
@@ -337,6 +568,7 @@ func TestInMemoryTxnWriteFailures(t *testing.T) {
 		{storage.AddOp, "/a/0/beef", "", storage.NotFoundErr},
 		{storage.AddOp, "/arr", `[1,2,3]`, ""},
 		{storage.AddOp, "/arr/0/foo", "", storage.NotFoundErr},
+		{storage.AddOp, "/arr/4", "", storage.NotFoundErr},
 	}
 
 	for _, w := range writes {
@@ -604,7 +836,7 @@ func TestInMemoryContext(t *testing.T) {
 	}
 
 	_, err = store.Register(ctx, txn, storage.TriggerConfig{
-		OnCommit: func(ctx context.Context, txn storage.Transaction, event storage.TriggerEvent) {
+		OnCommit: func(_ context.Context, _ storage.Transaction, event storage.TriggerEvent) {
 			if event.Context.Get("foo") != "bar" {
 				t.Fatalf("Expected foo/bar in context but got: %+v", event.Context)
 			} else if event.Context.Get("deadbeef") != nil {
@@ -674,3 +906,70 @@ func loadSmallTestData() map[string]interface{} {
 	}
 	return data
 }
+
+func TestOptRoundTripOnWrite(t *testing.T) {
+	validObject := map[string]string{"foo": "bar"}
+
+	// self-referential objects are not serializable to JSON.
+	invalidObject := map[string]interface{}{}
+	invalidObject["foo"] = invalidObject
+
+	tests := []struct {
+		name    string
+		opts    []Opt
+		obj     interface{}
+		wantErr bool
+	}{{
+		name:    "success on valid object no Opts",
+		opts:    nil,
+		obj:     validObject,
+		wantErr: false,
+	}, {
+		name:    "success on valid object round trip enabled",
+		opts:    []Opt{OptRoundTripOnWrite(true)},
+		obj:     validObject,
+		wantErr: false,
+	}, {
+		name:    "success on valid object round trip disabled",
+		opts:    []Opt{OptRoundTripOnWrite(false)},
+		obj:     validObject,
+		wantErr: false,
+	}, {
+		// Ensure the setting defaults to "true".
+		name:    "failure on invalid object no Opts",
+		opts:    nil,
+		obj:     invalidObject,
+		wantErr: true,
+	}, {
+		name:    "failure on invalid object round trip enabled",
+		opts:    []Opt{OptRoundTripOnWrite(true)},
+		obj:     invalidObject,
+		wantErr: true,
+	}, {
+		// While this represents a bad use case, it's how we know the round-tripping
+		// has been disabled.
+		name:    "success on invalid object round trip disabled",
+		opts:    []Opt{OptRoundTripOnWrite(false)},
+		obj:     invalidObject,
+		wantErr: false,
+	}}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db := NewWithOpts(tt.opts...)
+			ctx := context.Background()
+
+			txn, err := db.NewTransaction(ctx, storage.WriteParams)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			err = db.Write(ctx, txn, storage.AddOp, []string{"data"}, tt.obj)
+			if tt.wantErr && err == nil {
+				t.Fatal("got Write error = nil, want error")
+			} else if !tt.wantErr && err != nil {
+				t.Fatalf("got Write error, want nil")
+			}
+		})
+	}
+}
diff --git a/storage/inmem/opts.go b/storage/inmem/opts.go
new file mode 100644
index 0000000000..fb8dc8e2bf
--- /dev/null
+++ b/storage/inmem/opts.go
@@ -0,0 +1,25 @@
+package inmem
+
+// An Opt modifies store at instantiation.
+type Opt func(*store)
+
+// OptRoundTripOnWrite sets whether incoming objects written to store are
+// round-tripped through JSON to ensure they are serializable to JSON.
+//
+// Callers should disable this if they can guarantee all objects passed to
+// Write() are serializable to JSON. Failing to do so may result in undefined
+// behavior, including panics.
+//
+// Usually, when only storing objects in the inmem store that have been read
+// via encoding/json, this is safe to disable, and comes with an improvement
+// in performance and memory use.
+//
+// If setting to false, callers should deep-copy any objects passed to Write()
+// unless they can guarantee the objects will not be mutated after being written,
+// and that mutations happening to the objects after they have been passed into
+// Write() don't affect their logic.
+func OptRoundTripOnWrite(enabled bool) Opt {
+	return func(s *store) {
+		s.roundTripOnWrite = enabled
+	}
+}
diff --git a/storage/inmem/test/testutil.go b/storage/inmem/test/testutil.go
new file mode 100644
index 0000000000..195a869cf0
--- /dev/null
+++ b/storage/inmem/test/testutil.go
@@ -0,0 +1,22 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package test
+
+import (
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/inmem"
+)
+
+// New returns an inmem store with some common options set: opt-out of write
+// roundtripping.
+func New() storage.Store {
+	return inmem.NewWithOpts(inmem.OptRoundTripOnWrite(false))
+}
+
+// NewFromObject returns an inmem store from the passed object, with some
+// common options set: opt-out of write roundtripping.
+func NewFromObject(x map[string]interface{}) storage.Store {
+	return inmem.NewFromObjectWithOpts(x, inmem.OptRoundTripOnWrite(false))
+}
diff --git a/storage/inmem/txn.go b/storage/inmem/txn.go
index 2f52972bde..3a61018291 100644
--- a/storage/inmem/txn.go
+++ b/storage/inmem/txn.go
@@ -296,7 +296,7 @@ func newUpdate(data interface{}, op storage.PatchOp, path storage.Path, idx int,
 func newUpdateArray(data []interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
 
 	if idx == len(path)-1 {
-		if path[idx] == "-" {
+		if path[idx] == "-" || path[idx] == strconv.Itoa(len(data)) {
 			if op != storage.AddOp {
 				return nil, invalidPatchError("%v: invalid patch path", path)
 			}
@@ -311,20 +311,21 @@ func newUpdateArray(data []interface{}, op storage.PatchOp, path storage.Path, i
 			return nil, err
 		}
 
-		if op == storage.AddOp {
+		switch op {
+		case storage.AddOp:
 			cpy := make([]interface{}, len(data)+1)
 			copy(cpy[:pos], data[:pos])
 			copy(cpy[pos+1:], data[pos:])
 			cpy[pos] = value
 			return &update{path[:len(path)-1], false, cpy}, nil
 
-		} else if op == storage.RemoveOp {
+		case storage.RemoveOp:
 			cpy := make([]interface{}, len(data)-1)
 			copy(cpy[:pos], data[:pos])
 			copy(cpy[pos:], data[pos+1:])
 			return &update{path[:len(path)-1], false, cpy}, nil
 
-		} else {
+		default:
 			cpy := make([]interface{}, len(data))
 			copy(cpy, data)
 			cpy[pos] = value
@@ -374,6 +375,9 @@ func (u *update) Apply(data interface{}) interface{} {
 	}
 	switch parent := parent.(type) {
 	case map[string]interface{}:
+		if parent == nil {
+			parent = make(map[string]interface{}, 1)
+		}
 		parent[key] = u.value
 	case []interface{}:
 		idx, err := strconv.Atoi(key)
diff --git a/storage/interface.go b/storage/interface.go
index f150716127..6baca9a59f 100644
--- a/storage/interface.go
+++ b/storage/interface.go
@@ -6,6 +6,8 @@ package storage
 
 import (
 	"context"
+
+	"github.com/open-policy-agent/opa/metrics"
 )
 
 // Transaction defines the interface that identifies a consistent snapshot over
@@ -20,25 +22,42 @@ type Store interface {
 	Policy
 
 	// NewTransaction is called create a new transaction in the store.
-	NewTransaction(ctx context.Context, params ...TransactionParams) (Transaction, error)
+	NewTransaction(context.Context, ...TransactionParams) (Transaction, error)
 
 	// Read is called to fetch a document referred to by path.
-	Read(ctx context.Context, txn Transaction, path Path) (interface{}, error)
+	Read(context.Context, Transaction, Path) (interface{}, error)
 
 	// Write is called to modify a document referred to by path.
-	Write(ctx context.Context, txn Transaction, op PatchOp, path Path, value interface{}) error
+	Write(context.Context, Transaction, PatchOp, Path, interface{}) error
 
 	// Commit is called to finish the transaction. If Commit returns an error, the
 	// transaction must be automatically aborted by the Store implementation.
-	Commit(ctx context.Context, txn Transaction) error
+	Commit(context.Context, Transaction) error
+
+	// Truncate is called to make a copy of the underlying store, write documents in the new store
+	// by creating multiple transactions in the new store as needed and finally swapping
+	// over to the new storage instance. This method must be called within a transaction on the original store.
+	Truncate(context.Context, Transaction, TransactionParams, Iterator) error
 
 	// Abort is called to cancel the transaction.
-	Abort(ctx context.Context, txn Transaction)
+	Abort(context.Context, Transaction)
+}
+
+// MakeDirer defines the interface a Store could realize to override the
+// generic MakeDir functionality in storage.MakeDir
+type MakeDirer interface {
+	MakeDir(context.Context, Transaction, Path) error
 }
 
 // TransactionParams describes a new transaction.
 type TransactionParams struct {
 
+	// BasePaths indicates the top-level paths where write operations will be performed in this transaction.
+	BasePaths []string
+
+	// RootOverwrite is deprecated. Use BasePaths instead.
+	RootOverwrite bool
+
 	// Write indicates if this transaction will perform any write operations.
 	Write bool
 
@@ -71,6 +90,27 @@ func (ctx *Context) Put(key, value interface{}) {
 	ctx.values[key] = value
 }
 
+var metricsKey = struct{}{}
+
+// WithMetrics allows passing metrics via the Context.
+// It puts the metrics object in the ctx, and returns the same
+// ctx (not a copy) for convenience.
+func (ctx *Context) WithMetrics(m metrics.Metrics) *Context {
+	ctx.values[metricsKey] = m
+	return ctx
+}
+
+// Metrics() allows using a Context's metrics. Returns nil if metrics
+// were not attached to the Context.
+func (ctx *Context) Metrics() metrics.Metrics {
+	if m, ok := ctx.values[metricsKey]; ok {
+		if met, ok := m.(metrics.Metrics); ok {
+			return met
+		}
+	}
+	return nil
+}
+
 // WriteParams specifies the TransactionParams for a write transaction.
 var WriteParams = TransactionParams{
 	Write: true,
@@ -90,7 +130,7 @@ const (
 // interface which may be used if the backend does not support writes.
 type WritesNotSupported struct{}
 
-func (WritesNotSupported) Write(ctx context.Context, txn Transaction, op PatchOp, path Path, value interface{}) error {
+func (WritesNotSupported) Write(context.Context, Transaction, PatchOp, Path, interface{}) error {
 	return writesNotSupportedError()
 }
 
@@ -169,13 +209,13 @@ type TriggerConfig struct {
 	// OnCommit is invoked when a transaction is successfully committed. The
 	// callback is invoked with a handle to the write transaction that
 	// successfully committed before other clients see the changes.
-	OnCommit func(ctx context.Context, txn Transaction, event TriggerEvent)
+	OnCommit func(context.Context, Transaction, TriggerEvent)
 }
 
 // Trigger defines the interface that stores implement to register for change
 // notifications when the store is changed.
 type Trigger interface {
-	Register(ctx context.Context, txn Transaction, config TriggerConfig) (TriggerHandle, error)
+	Register(context.Context, Transaction, TriggerConfig) (TriggerHandle, error)
 }
 
 // TriggersNotSupported provides default implementations of the Trigger
@@ -190,5 +230,18 @@ func (TriggersNotSupported) Register(context.Context, Transaction, TriggerConfig
 // TriggerHandle defines the interface that can be used to unregister triggers that have
 // been registered on a Store.
 type TriggerHandle interface {
-	Unregister(ctx context.Context, txn Transaction)
+	Unregister(context.Context, Transaction)
+}
+
+// Iterator defines the interface that can be used to read files from a directory starting with
+// files at the base of the directory, then sub-directories etc.
+type Iterator interface {
+	Next() (*Update, error)
+}
+
+// Update contains information about a file
+type Update struct {
+	Path     Path
+	Value    []byte
+	IsPolicy bool
 }
diff --git a/storage/internal/errors/errors.go b/storage/internal/errors/errors.go
index 74792f63e4..0bba74b907 100644
--- a/storage/internal/errors/errors.go
+++ b/storage/internal/errors/errors.go
@@ -30,3 +30,10 @@ func NewNotFoundErrorf(f string, a ...interface{}) *storage.Error {
 		Message: msg,
 	}
 }
+
+func NewWriteConflictError(p storage.Path) *storage.Error {
+	return &storage.Error{
+		Code:    storage.WriteConflictErr,
+		Message: p.String(),
+	}
+}
diff --git a/storage/internal/ptr/ptr.go b/storage/internal/ptr/ptr.go
index 6778805faa..56772f7976 100644
--- a/storage/internal/ptr/ptr.go
+++ b/storage/internal/ptr/ptr.go
@@ -37,12 +37,32 @@ func Ptr(data interface{}, path storage.Path) (interface{}, error) {
 }
 
 func ValidateArrayIndex(arr []interface{}, s string, path storage.Path) (int, error) {
-	idx, err := strconv.Atoi(s)
-	if err != nil {
+	idx, ok := isInt(s)
+	if !ok {
 		return 0, errors.NewNotFoundErrorWithHint(path, errors.ArrayIndexTypeMsg)
 	}
-	if idx < 0 || idx >= len(arr) {
+	return inRange(idx, arr, path)
+}
+
+// ValidateArrayIndexForWrite also checks that `s` is a valid way to address an
+// array element like `ValidateArrayIndex`, but returns a `resource_conflict` error
+// if it is not.
+func ValidateArrayIndexForWrite(arr []interface{}, s string, i int, path storage.Path) (int, error) {
+	idx, ok := isInt(s)
+	if !ok {
+		return 0, errors.NewWriteConflictError(path[:i-1])
+	}
+	return inRange(idx, arr, path)
+}
+
+func isInt(s string) (int, bool) {
+	idx, err := strconv.Atoi(s)
+	return idx, err == nil
+}
+
+func inRange(i int, arr []interface{}, path storage.Path) (int, error) {
+	if i < 0 || i >= len(arr) {
 		return 0, errors.NewNotFoundErrorWithHint(path, errors.OutOfRangeMsg)
 	}
-	return idx, nil
+	return i, nil
 }
diff --git a/storage/storage.go b/storage/storage.go
index 323a0dba70..1e290c50bb 100644
--- a/storage/storage.go
+++ b/storage/storage.go
@@ -51,14 +51,18 @@ func WriteOne(ctx context.Context, store Store, op PatchOp, path Path, value int
 
 // MakeDir inserts an empty object at path. If the parent path does not exist,
 // MakeDir will create it recursively.
-func MakeDir(ctx context.Context, store Store, txn Transaction, path Path) (err error) {
+func MakeDir(ctx context.Context, store Store, txn Transaction, path Path) error {
+
+	// Allow the Store implementation to deal with this in its own way.
+	if md, ok := store.(MakeDirer); ok {
+		return md.MakeDir(ctx, txn, path)
+	}
 
 	if len(path) == 0 {
 		return nil
 	}
 
 	node, err := store.Read(ctx, txn, path)
-
 	if err != nil {
 		if !IsNotFound(err) {
 			return err
@@ -66,19 +70,15 @@ func MakeDir(ctx context.Context, store Store, txn Transaction, path Path) (err
 
 		if err := MakeDir(ctx, store, txn, path[:len(path)-1]); err != nil {
 			return err
-		} else if err := store.Write(ctx, txn, AddOp, path, map[string]interface{}{}); err != nil {
-			return err
 		}
 
-		return nil
+		return store.Write(ctx, txn, AddOp, path, map[string]interface{}{})
 	}
 
 	if _, ok := node.(map[string]interface{}); ok {
 		return nil
 	}
-
 	return writeConflictError(path)
-
 }
 
 // Txn is a convenience function that executes f inside a new transaction
diff --git a/test/authz/authz_bench_test.go b/test/authz/authz_bench_test.go
index 9311ca8bc1..3334539da5 100644
--- a/test/authz/authz_bench_test.go
+++ b/test/authz/authz_bench_test.go
@@ -9,13 +9,20 @@ import (
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/disk"
 	"github.com/open-policy-agent/opa/storage/inmem"
 )
 
 func BenchmarkAuthzForbidAuthn(b *testing.B) {
-	runAuthzBenchmark(b, ForbidIdentity, 10)
+	b.Run("inmem", func(b *testing.B) {
+		runAuthzBenchmark(b, ForbidIdentity, 10)
+	})
+	b.Run("disk", func(b *testing.B) {
+		runAuthzBenchmark(b, ForbidIdentity, 10, true)
+	})
 }
 
 func BenchmarkAuthzForbidPath(b *testing.B) {
@@ -38,7 +45,7 @@ func BenchmarkAuthzAllow1000Paths(b *testing.B) {
 	runAuthzBenchmark(b, Allow, 1000)
 }
 
-func runAuthzBenchmark(b *testing.B, mode InputMode, numPaths int) {
+func runAuthzBenchmark(b *testing.B, mode InputMode, numPaths int, extras ...bool) {
 
 	profile := DataSetProfile{
 		NumTokens: 1000,
@@ -47,7 +54,32 @@ func runAuthzBenchmark(b *testing.B, mode InputMode, numPaths int) {
 
 	ctx := context.Background()
 	data := GenerateDataset(profile)
-	store := inmem.NewFromObject(data)
+
+	useDisk := false
+	if len(extras) > 0 {
+		useDisk = extras[0]
+	}
+
+	var store storage.Store
+	var err error
+	if useDisk {
+		rootDir := b.TempDir()
+		store, err = disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{
+			Dir:        rootDir,
+			Partitions: nil,
+		})
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		err = storage.WriteOne(ctx, store, storage.AddOp, storage.Path{}, data)
+		if err != nil {
+			b.Fatal(err)
+		}
+	} else {
+		store = inmem.NewFromObject(data)
+	}
+
 	txn := storage.NewTransactionOrDie(ctx, store)
 	compiler := ast.NewCompiler()
 	module := ast.MustParseModule(Policy)
diff --git a/test/cases/cases.go b/test/cases/cases.go
index d14f265005..a614d75e8e 100644
--- a/test/cases/cases.go
+++ b/test/cases/cases.go
@@ -7,7 +7,6 @@ package cases
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sort"
@@ -75,7 +74,7 @@ func loadRecursive(dirpath string) (Set, error) {
 			return nil
 		}
 
-		bs, err := ioutil.ReadFile(path)
+		bs, err := os.ReadFile(path)
 		if err != nil {
 			return fmt.Errorf("%s: %w", path, err)
 		}
diff --git a/test/cases/testdata/aggregates/test-aggregates-0001.yaml b/test/cases/testdata/aggregates/test-aggregates-0001.yaml
index 08e77d81c8..566f619a7d 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0001.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0001.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0002.yaml b/test/cases/testdata/aggregates/test-aggregates-0002.yaml
index f3d02ff8f7..ec0c44a4da 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0002.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0002.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0003.yaml b/test/cases/testdata/aggregates/test-aggregates-0003.yaml
index 6f4dad9f5d..75a5c27997 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0003.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0003.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0004.yaml b/test/cases/testdata/aggregates/test-aggregates-0004.yaml
index 56862d3c81..556960fbe2 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0004.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0004.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0005.yaml b/test/cases/testdata/aggregates/test-aggregates-0005.yaml
index 2503f62af8..60a64b5a6a 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0005.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0005.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0006.yaml b/test/cases/testdata/aggregates/test-aggregates-0006.yaml
index 7e2ee24ea3..0cf48e728d 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0006.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0006.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0007.yaml b/test/cases/testdata/aggregates/test-aggregates-0007.yaml
index b9833e7bd4..519941112e 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0007.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0007.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0008.yaml b/test/cases/testdata/aggregates/test-aggregates-0008.yaml
index adcd9ba6b3..560ec23eb0 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0008.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0008.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0009.yaml b/test/cases/testdata/aggregates/test-aggregates-0009.yaml
index e414305eed..220c6e24df 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0009.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0009.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0010.yaml b/test/cases/testdata/aggregates/test-aggregates-0010.yaml
index a49b3dbca1..f37a47848a 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0010.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0010.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0011.yaml b/test/cases/testdata/aggregates/test-aggregates-0011.yaml
index 3a9f5ddb6d..8e60e01a4c 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0011.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0011.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0012.yaml b/test/cases/testdata/aggregates/test-aggregates-0012.yaml
index 7b0510de9e..7ceb0ade70 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0012.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0012.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0013.yaml b/test/cases/testdata/aggregates/test-aggregates-0013.yaml
index eeb9a821bb..42a45b54da 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0013.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0013.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0014.yaml b/test/cases/testdata/aggregates/test-aggregates-0014.yaml
index 1a63b0756e..6c583e7c07 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0014.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0014.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0015.yaml b/test/cases/testdata/aggregates/test-aggregates-0015.yaml
index f1aa215f0d..86438558ef 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0015.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0015.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0016.yaml b/test/cases/testdata/aggregates/test-aggregates-0016.yaml
index ecbdfe269d..29a31435f3 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0016.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0016.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0017.yaml b/test/cases/testdata/aggregates/test-aggregates-0017.yaml
index 410b83b9aa..68802eed3d 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0017.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0017.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0018.yaml b/test/cases/testdata/aggregates/test-aggregates-0018.yaml
index bf5738ca6a..75f1a756e0 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0018.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0018.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0019.yaml b/test/cases/testdata/aggregates/test-aggregates-0019.yaml
index e956025eba..43f564b14f 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0019.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0019.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0020.yaml b/test/cases/testdata/aggregates/test-aggregates-0020.yaml
index 5422c695f7..c840a75e12 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0020.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0020.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0021.yaml b/test/cases/testdata/aggregates/test-aggregates-0021.yaml
index d5d9cfe09c..e5bffa7632 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0021.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0021.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0022.yaml b/test/cases/testdata/aggregates/test-aggregates-0022.yaml
index 576411d5d1..d6049d994d 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0022.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0022.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0023.yaml b/test/cases/testdata/aggregates/test-aggregates-0023.yaml
index f94382fdd0..b96812788a 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0023.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0023.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0024.yaml b/test/cases/testdata/aggregates/test-aggregates-0024.yaml
index eae2691d73..639ffaafb3 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0024.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0024.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0025.yaml b/test/cases/testdata/aggregates/test-aggregates-0025.yaml
index 247dc86c43..a2b11d9348 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0025.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0025.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0026.yaml b/test/cases/testdata/aggregates/test-aggregates-0026.yaml
index 1da61148dc..7f81168908 100644
--- a/test/cases/testdata/aggregates/test-aggregates-0026.yaml
+++ b/test/cases/testdata/aggregates/test-aggregates-0026.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/aggregates/test-aggregates-0028.yaml b/test/cases/testdata/aggregates/test-aggregates-0028.yaml
new file mode 100644
index 0000000000..a80cd898ad
--- /dev/null
+++ b/test/cases/testdata/aggregates/test-aggregates-0028.yaml
@@ -0,0 +1,29 @@
+cases:
+- modules:
+  - |
+    package generated
+
+    p = x {
+      count(input.foo, x)
+    }
+  note: aggregates/count error null
+  query: data.generated.p = x
+  input:
+    foo: null
+  strict_error: true
+  want_error_code: eval_type_error
+  want_error: 'operand 1 must be one of {array, object, set, string} but got null'
+- modules:
+  - |
+    package generated
+
+    p = x {
+      count(input.foo, x)
+    }
+  note: aggregates/count error number
+  query: data.generated.p = x
+  input:
+    foo: 5
+  strict_error: true
+  want_error_code: eval_type_error
+  want_error: 'operand 1 must be one of {array, object, set, string} but got number'
diff --git a/test/cases/testdata/aggregates/test-membership.yaml b/test/cases/testdata/aggregates/test-membership.yaml
index 801020d75f..bb9d18eaa4 100644
--- a/test/cases/testdata/aggregates/test-membership.yaml
+++ b/test/cases/testdata/aggregates/test-membership.yaml
@@ -1,5 +1,5 @@
 cases:
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -12,7 +12,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -24,7 +24,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -36,7 +36,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -48,7 +48,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -60,7 +60,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -72,7 +72,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -84,7 +84,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -96,7 +96,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -108,7 +108,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -120,7 +120,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -132,7 +132,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: false
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -144,7 +144,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: false
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -156,7 +156,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: false
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -168,7 +168,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -182,7 +182,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -194,7 +194,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -206,7 +206,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -219,7 +219,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -232,7 +232,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -245,7 +245,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -258,7 +258,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -271,7 +271,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -284,7 +284,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -296,7 +296,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -308,7 +308,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: false
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -320,7 +320,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: false
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -332,7 +332,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: false
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -343,8 +343,11 @@ cases:
   note: aggregates/member+some simple, array
   query: data.test.p = x
   want_result:
-  - x: [1, 2, 3]
-- data:
+  - x:
+    - 1
+    - 2
+    - 3
+- data: {}
   modules:
   - |
     package test
@@ -356,7 +359,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -368,7 +371,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -380,7 +383,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: 100
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -392,7 +395,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: 100
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -404,7 +407,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: true
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -415,7 +418,7 @@ cases:
   note: aggregates/member+some ground composite containee (false)
   query: data.test.p = x
   want_result: []
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -427,7 +430,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: 100
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -439,7 +442,7 @@ cases:
   query: data.test.p = x
   want_result:
   - x: what
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -453,7 +456,7 @@ cases:
   - x:
       foo: 100
       what: ever
-- data:
+- data: {}
   modules:
   - |
     package test
@@ -496,7 +499,9 @@ cases:
   note: aggregates/member+some+key+ref
   query: data.test.p = x
   want_result:
-  - x: [3, 2]
+  - x:
+    - 3
+    - 2
 - data:
     object:
       array:
@@ -514,4 +519,21 @@ cases:
   note: aggregates/member+some+key+ref with other variable
   query: data.test.p = x
   want_result:
-  - x: [3, 2, "array"]
\ No newline at end of file
+  - x:
+    - 3
+    - 2
+    - array
+- data: {}
+  modules:
+  - |
+    package test
+    import future.keywords.in
+    p[[k, v]] {
+      some k, v in input with input.foo as "bar"
+    }
+  note: aggregates/member+some+with
+  query: data.test.p = x
+  want_result:
+  - x:
+    - - foo
+      - bar
diff --git a/test/cases/testdata/all/test-all-0027.yaml b/test/cases/testdata/all/test-all-0027.yaml
index 41dfc39469..d0887af923 100644
--- a/test/cases/testdata/all/test-all-0027.yaml
+++ b/test/cases/testdata/all/test-all-0027.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/all/test-all-0028.yaml b/test/cases/testdata/all/test-all-0028.yaml
index e4c8e9be13..389a29bf32 100644
--- a/test/cases/testdata/all/test-all-0028.yaml
+++ b/test/cases/testdata/all/test-all-0028.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/all/test-all-0029.yaml b/test/cases/testdata/all/test-all-0029.yaml
index 48ed2e62d7..c44a0d23ab 100644
--- a/test/cases/testdata/all/test-all-0029.yaml
+++ b/test/cases/testdata/all/test-all-0029.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/all/test-all-0030.yaml b/test/cases/testdata/all/test-all-0030.yaml
index 3dfbbb38e4..9f1fdbe5a6 100644
--- a/test/cases/testdata/all/test-all-0030.yaml
+++ b/test/cases/testdata/all/test-all-0030.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/all/test-all-0031.yaml b/test/cases/testdata/all/test-all-0031.yaml
index 71ce1677bc..216ededd63 100644
--- a/test/cases/testdata/all/test-all-0031.yaml
+++ b/test/cases/testdata/all/test-all-0031.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/all/test-all-0032.yaml b/test/cases/testdata/all/test-all-0032.yaml
index 905c303820..53bda8cf8b 100644
--- a/test/cases/testdata/all/test-all-0032.yaml
+++ b/test/cases/testdata/all/test-all-0032.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/all/test-all-0033.yaml b/test/cases/testdata/all/test-all-0033.yaml
index 9ed973c573..79117623ab 100644
--- a/test/cases/testdata/all/test-all-0033.yaml
+++ b/test/cases/testdata/all/test-all-0033.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0034.yaml b/test/cases/testdata/any/test-any-0034.yaml
index 53b2f2861d..1c973e9583 100644
--- a/test/cases/testdata/any/test-any-0034.yaml
+++ b/test/cases/testdata/any/test-any-0034.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0035.yaml b/test/cases/testdata/any/test-any-0035.yaml
index ffec3d976d..4d97c9595c 100644
--- a/test/cases/testdata/any/test-any-0035.yaml
+++ b/test/cases/testdata/any/test-any-0035.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0036.yaml b/test/cases/testdata/any/test-any-0036.yaml
index 5b5ad57b16..7b22998714 100644
--- a/test/cases/testdata/any/test-any-0036.yaml
+++ b/test/cases/testdata/any/test-any-0036.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0037.yaml b/test/cases/testdata/any/test-any-0037.yaml
index 12aacc3e44..d3dd71b809 100644
--- a/test/cases/testdata/any/test-any-0037.yaml
+++ b/test/cases/testdata/any/test-any-0037.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0038.yaml b/test/cases/testdata/any/test-any-0038.yaml
index a0f2c78b20..2304c4aaaa 100644
--- a/test/cases/testdata/any/test-any-0038.yaml
+++ b/test/cases/testdata/any/test-any-0038.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0039.yaml b/test/cases/testdata/any/test-any-0039.yaml
index 05e073d911..b2d0994911 100644
--- a/test/cases/testdata/any/test-any-0039.yaml
+++ b/test/cases/testdata/any/test-any-0039.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/any/test-any-0040.yaml b/test/cases/testdata/any/test-any-0040.yaml
index e1aa205c60..d046c194b5 100644
--- a/test/cases/testdata/any/test-any-0040.yaml
+++ b/test/cases/testdata/any/test-any-0040.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0810.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0810.yaml
index 8ebb414dfc..952870a46a 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0810.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0810.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0811.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0811.yaml
index 3a16a39e39..3e18903c77 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0811.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0811.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0812.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0812.yaml
index 716e0151f5..2d7a229bcc 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0812.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0812.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0814.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0814.yaml
index 1e9e36f4bb..0aea1da955 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0814.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0814.yaml
@@ -13,6 +13,6 @@ cases:
     }
   note: arithmetic/divide+error
   query: data.generated.p = x
+  strict_error: true
   want_error: divide by zero
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0815.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0815.yaml
index bfa22eb25e..cbb8b1ac44 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0815.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0815.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0816.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0816.yaml
index e39dcd2f0a..d7ba6f9a96 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0816.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0816.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0819.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0819.yaml
index bd7da05115..abdff45a97 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0819.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0819.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0820.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0820.yaml
index 2806213b9d..bbd0b23637 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0820.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0820.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0821.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0821.yaml
index aec89932b5..ae2a996fda 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0821.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0821.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0822.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0822.yaml
index a32ef0b86d..1d558012ca 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0822.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0822.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/arithmetic/test-arithmetic-0823.yaml b/test/cases/testdata/arithmetic/test-arithmetic-0823.yaml
index f51abbb070..5346052bb3 100644
--- a/test/cases/testdata/arithmetic/test-arithmetic-0823.yaml
+++ b/test/cases/testdata/arithmetic/test-arithmetic-0823.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0041.yaml b/test/cases/testdata/array/test-array-0041.yaml
index 50a3904c3a..a347f049de 100644
--- a/test/cases/testdata/array/test-array-0041.yaml
+++ b/test/cases/testdata/array/test-array-0041.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0042.yaml b/test/cases/testdata/array/test-array-0042.yaml
index c9b120558b..f8184aad21 100644
--- a/test/cases/testdata/array/test-array-0042.yaml
+++ b/test/cases/testdata/array/test-array-0042.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -93,6 +14,6 @@ cases:
     }
   note: 'array/concat: err'
   query: data.generated.p = x
+  strict_error: true
   want_error: 'array.concat: operand 1 must be array but got object'
   want_error_code: eval_type_error
-  strict_error: true
\ No newline at end of file
diff --git a/test/cases/testdata/array/test-array-0043.yaml b/test/cases/testdata/array/test-array-0043.yaml
index a108d5f696..869f660795 100644
--- a/test/cases/testdata/array/test-array-0043.yaml
+++ b/test/cases/testdata/array/test-array-0043.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -93,6 +14,6 @@ cases:
     }
   note: 'array/concat: err rhs'
   query: data.generated.p = x
+  strict_error: true
   want_error: 'array.concat: operand 2 must be array but got object'
   want_error_code: eval_type_error
-  strict_error: true
diff --git a/test/cases/testdata/array/test-array-0044.yaml b/test/cases/testdata/array/test-array-0044.yaml
index 39b3614de5..5755ee1d94 100644
--- a/test/cases/testdata/array/test-array-0044.yaml
+++ b/test/cases/testdata/array/test-array-0044.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0045.yaml b/test/cases/testdata/array/test-array-0045.yaml
index d1944851f7..337fafa6fe 100644
--- a/test/cases/testdata/array/test-array-0045.yaml
+++ b/test/cases/testdata/array/test-array-0045.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0046.yaml b/test/cases/testdata/array/test-array-0046.yaml
index 10ef93fbfb..9f9cdedd94 100644
--- a/test/cases/testdata/array/test-array-0046.yaml
+++ b/test/cases/testdata/array/test-array-0046.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0047.yaml b/test/cases/testdata/array/test-array-0047.yaml
index d5f99da78f..920123ff87 100644
--- a/test/cases/testdata/array/test-array-0047.yaml
+++ b/test/cases/testdata/array/test-array-0047.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0048.yaml b/test/cases/testdata/array/test-array-0048.yaml
index 4052546a8a..7d726bd010 100644
--- a/test/cases/testdata/array/test-array-0048.yaml
+++ b/test/cases/testdata/array/test-array-0048.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0049.yaml b/test/cases/testdata/array/test-array-0049.yaml
index 30983f05b9..015c8ebb99 100644
--- a/test/cases/testdata/array/test-array-0049.yaml
+++ b/test/cases/testdata/array/test-array-0049.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0050.yaml b/test/cases/testdata/array/test-array-0050.yaml
index 5fdf4842b3..04b8f19722 100644
--- a/test/cases/testdata/array/test-array-0050.yaml
+++ b/test/cases/testdata/array/test-array-0050.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0051.yaml b/test/cases/testdata/array/test-array-0051.yaml
index fd6a55d158..9127e6db28 100644
--- a/test/cases/testdata/array/test-array-0051.yaml
+++ b/test/cases/testdata/array/test-array-0051.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/array/test-array-0052.yaml b/test/cases/testdata/array/test-array-0052.yaml
new file mode 100644
index 0000000000..920be3b754
--- /dev/null
+++ b/test/cases/testdata/array/test-array-0052.yaml
@@ -0,0 +1,43 @@
+cases:
+- data:
+    foo:
+    - 1
+    - 2
+    - 3
+  modules:
+  - |
+    package test
+
+    p := array.reverse(data.foo)
+  note: array/reverse_123
+  query: data.test.p = x
+  want_result:
+  - x:
+    - 3
+    - 2
+    - 1
+- data:
+    foo: []
+  modules:
+  - |
+    package test
+
+    p := array.reverse(data.foo)
+  note: array/reverse_empty
+  query: data.test.p = x
+  want_result:
+  - x: []
+- data:
+    foo:
+      bar: baz
+      baz: bar
+  modules:
+  - |
+    package test
+
+    p := array.reverse(data.foo)
+  note: array/reverse_object_error
+  query: data.test.p = x
+  strict_error: true
+  want_error: 'array.reverse: operand 1 must be array but got object'
+  want_error_code: eval_type_error
diff --git a/test/cases/testdata/assignments/test-file-level-assignments.yaml b/test/cases/testdata/assignments/test-file-level-assignments.yaml
new file mode 100644
index 0000000000..4f56e55091
--- /dev/null
+++ b/test/cases/testdata/assignments/test-file-level-assignments.yaml
@@ -0,0 +1,48 @@
+cases:
+  - note: assignments/file-level/default_value
+    query: data.test = x
+    modules:
+      - |
+        package test
+
+        default a := 1
+    want_result: [ { "x": { "a": 1 } } ]
+  - note: assignments/file-level/rule
+    query: data.test = x
+    modules:
+      - |
+        package test
+        
+        b := 2
+    want_result: [ { "x": { "b": 2 } } ]
+  - note: assignments/file-level/else_keyword
+    query: data.test = x
+    modules:
+      - |
+        package test
+        
+        c := 3 {
+           false
+        } else := 4 {
+           true
+        }
+    want_result: [ { "x": { "c": 4, } } ]
+  - note: assignments/file-level/partial_rule
+    query: data.test = x
+    modules:
+      - |
+        package test
+        
+        d[msg] := 5 {
+           msg = [1, 2, 3][_]
+        }
+    want_result: [ { "x": { "d": { "1": 5, "2": 5, "3": 5 } } } ]
+  - note: assignments/file-level/function_return_value
+    query: data.test = x
+    modules:
+      - |
+        package test
+        
+        e := f(6)
+        f(x) := x
+    want_result: [ { "x": { "e": 6 } } ]
\ No newline at end of file
diff --git a/test/cases/testdata/base64builtins/test-base64builtins-0929.yaml b/test/cases/testdata/base64builtins/test-base64builtins-0929.yaml
index e7ade2f62f..86e11a5bf5 100644
--- a/test/cases/testdata/base64builtins/test-base64builtins-0929.yaml
+++ b/test/cases/testdata/base64builtins/test-base64builtins-0929.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/base64builtins/test-base64builtins-0930.yaml b/test/cases/testdata/base64builtins/test-base64builtins-0930.yaml
index bdad424718..bc50bd80ec 100644
--- a/test/cases/testdata/base64builtins/test-base64builtins-0930.yaml
+++ b/test/cases/testdata/base64builtins/test-base64builtins-0930.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/base64builtins/test-base64builtins-0931.yaml b/test/cases/testdata/base64builtins/test-base64builtins-0931.yaml
index 3bc4f83268..79fb39007a 100644
--- a/test/cases/testdata/base64builtins/test-base64builtins-0931.yaml
+++ b/test/cases/testdata/base64builtins/test-base64builtins-0931.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/base64builtins/test-base64builtins-0932.yaml b/test/cases/testdata/base64builtins/test-base64builtins-0932.yaml
index 4ef2f1256c..f0cf95055d 100644
--- a/test/cases/testdata/base64builtins/test-base64builtins-0932.yaml
+++ b/test/cases/testdata/base64builtins/test-base64builtins-0932.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/base64builtins/test-base64builtins-0933.yaml b/test/cases/testdata/base64builtins/test-base64builtins-0933.yaml
index f6dc44e458..d408fc9925 100644
--- a/test/cases/testdata/base64builtins/test-base64builtins-0933.yaml
+++ b/test/cases/testdata/base64builtins/test-base64builtins-0933.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/base64builtins/test-base64builtins-0934.yaml b/test/cases/testdata/base64builtins/test-base64builtins-0934.yaml
index 6f522c02f1..138cd7db8e 100644
--- a/test/cases/testdata/base64builtins/test-base64builtins-0934.yaml
+++ b/test/cases/testdata/base64builtins/test-base64builtins-0934.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0695.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0695.yaml
index 6bf4bfe445..df554f7883 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0695.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0695.yaml
@@ -7,23 +7,9 @@ cases:
             x:
             - 100
             - 200
-            "y": false
+            y: false
             z:
               a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0696.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0696.yaml
index fb743e4d2d..d57c45cfa3 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0696.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0696.yaml
@@ -7,23 +7,9 @@ cases:
             x:
             - 100
             - 200
-            "y": false
+            y: false
             z:
               a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0697.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0697.yaml
index d3e13ac4de..e89941271f 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0697.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0697.yaml
@@ -7,23 +7,9 @@ cases:
             x:
             - 100
             - 200
-            "y": false
+            y: false
             z:
               a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
   input_term: '{}'
   modules:
   - |
@@ -301,6 +287,6 @@ cases:
         x:
         - 100
         - 200
-        "y": false
+        y: false
         z:
           a: b
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0698.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0698.yaml
index 5fc184e8e4..8613cdf732 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0698.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0698.yaml
@@ -1,23 +1,6 @@
 cases:
 - data:
     topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
       set:
         u:
         - 1
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0699.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0699.yaml
index bf6e6c4504..1b41a749d3 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0699.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0699.yaml
@@ -1,29 +1,5 @@
 cases:
-- data:
-    topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
+- data: {}
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0700.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0700.yaml
index 8d8e94eb67..66f9819e93 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0700.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0700.yaml
@@ -1,29 +1,5 @@
 cases:
-- data:
-    topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
+- data: {}
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0701.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0701.yaml
index 84dd1efbf9..61f5830593 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0701.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0701.yaml
@@ -1,29 +1,12 @@
 cases:
 - data:
     topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
       g:
         h:
           k:
           - 1
           - 2
           - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0702.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0702.yaml
index 3026ca2a0e..be8dcac901 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0702.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0702.yaml
@@ -1,29 +1,5 @@
 cases:
-- data:
-    topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
+- data: {}
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0703.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0703.yaml
index b9abe6988d..bcfae04835 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0703.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0703.yaml
@@ -1,29 +1,5 @@
 cases:
-- data:
-    topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
+- data: {}
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0704.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0704.yaml
index 2717314542..3e2344fc73 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0704.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0704.yaml
@@ -1,29 +1,8 @@
 cases:
 - data:
     topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
       conflicts:
         k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0705.yaml b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0705.yaml
index b3a69da8e7..b01348b43d 100644
--- a/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0705.yaml
+++ b/test/cases/testdata/baseandvirtualdocs/test-baseandvirtualdocs-0705.yaml
@@ -1,29 +1,5 @@
 cases:
-- data:
-    topdown:
-      a:
-        b:
-          c:
-            x:
-            - 100
-            - 200
-            "y": false
-            z:
-              a: b
-      conflicts:
-        k: foo
-      g:
-        h:
-          k:
-          - 1
-          - 2
-          - 3
-      set:
-        u:
-        - 1
-        - 2
-        - 3
-        - 4
+- data: {}
   input_term: '{}'
   modules:
   - |
@@ -172,9 +148,9 @@ cases:
     r["b"] = 2
   note: baseandvirtualdocs/enumerate virtual errors
   query: data.enum_errors.caller.p = x
+  strict_error: true
   want_error: divide by zero
   want_error_code: eval_builtin_error
-  strict_error: true
   want_result:
   - x:
       b:
diff --git a/test/cases/testdata/casts/test-casts-0077.yaml b/test/cases/testdata/casts/test-casts-0077.yaml
index 37833b9aa9..b99dc75aaf 100644
--- a/test/cases/testdata/casts/test-casts-0077.yaml
+++ b/test/cases/testdata/casts/test-casts-0077.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/casts/test-casts-0079.yaml b/test/cases/testdata/casts/test-casts-0079.yaml
index 52fe7b3aae..ecd2d81ed8 100644
--- a/test/cases/testdata/casts/test-casts-0079.yaml
+++ b/test/cases/testdata/casts/test-casts-0079.yaml
@@ -1,6 +1,9 @@
 cases:
 - data:
-    op1: [1, 2, 3]
+    op1:
+    - 1
+    - 2
+    - 3
   modules:
   - |
     package generated
@@ -10,6 +13,6 @@ cases:
     }
   note: casts/string invalid
   query: data.generated.p = x
-  want_error: ""
-  want_error_code: eval_type_error
   strict_error: true
+  want_error: ''
+  want_error_code: eval_type_error
diff --git a/test/cases/testdata/casts/test-casts-0080.yaml b/test/cases/testdata/casts/test-casts-0080.yaml
index b52ac85b5f..8e0a5c573d 100644
--- a/test/cases/testdata/casts/test-casts-0080.yaml
+++ b/test/cases/testdata/casts/test-casts-0080.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/casts/test-casts-0082.yaml b/test/cases/testdata/casts/test-casts-0082.yaml
index 907293e4fc..f302a7e996 100644
--- a/test/cases/testdata/casts/test-casts-0082.yaml
+++ b/test/cases/testdata/casts/test-casts-0082.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/casts/test-casts-0824.yaml b/test/cases/testdata/casts/test-casts-0824.yaml
index 84917ddd55..0d608cad82 100644
--- a/test/cases/testdata/casts/test-casts-0824.yaml
+++ b/test/cases/testdata/casts/test-casts-0824.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/casts/test-casts-0825.yaml b/test/cases/testdata/casts/test-casts-0825.yaml
index 36012fa365..d85d92e079 100644
--- a/test/cases/testdata/casts/test-casts-0825.yaml
+++ b/test/cases/testdata/casts/test-casts-0825.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/casts/test-casts-0826.yaml b/test/cases/testdata/casts/test-casts-0826.yaml
index b4bd65abfc..d60bdf7644 100644
--- a/test/cases/testdata/casts/test-casts-0826.yaml
+++ b/test/cases/testdata/casts/test-casts-0826.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0608.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0608.yaml
index 3ad13b2908..6e4904359f 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0608.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0608.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0609.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0609.yaml
index 059000f2a4..6d0b343723 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0609.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0609.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0610.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0610.yaml
index 9f7f83bec2..0f379469e7 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0610.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0610.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0611.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0611.yaml
index b84879ce9d..78f01ac9c4 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0611.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0611.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0612.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0612.yaml
index 3d792cde56..e6b702ff6b 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0612.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0612.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0613.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0613.yaml
index 12991883af..c0c8d13d34 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0613.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0613.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0614.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0614.yaml
index 00efe7f5de..9594a337bf 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0614.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0614.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0615.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0615.yaml
index 61fdb65116..bd9c7fb2ef 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0615.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0615.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0616.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0616.yaml
index 8146334f1d..b74ea57ac7 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0616.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0616.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0617.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0617.yaml
index 2d59a34223..db9ec004d1 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0617.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0617.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0618.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0618.yaml
index d99c2eecd7..95ed040280 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0618.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0618.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0619.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0619.yaml
index f48fd97cd4..cbd97f5123 100644
--- a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0619.yaml
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0619.yaml
@@ -1,93 +1,10 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
-  modules:
+- modules:
   - |
     package generated
 
     p {
-      1 < -1
+      1 <= -1
     }
   note: 'comparisonexpr/undefined: lteq'
   query: data.generated.p = x
diff --git a/test/cases/testdata/comparisonexpr/test-comparisonexpr-0620.yaml b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0620.yaml
new file mode 100644
index 0000000000..8479d208ba
--- /dev/null
+++ b/test/cases/testdata/comparisonexpr/test-comparisonexpr-0620.yaml
@@ -0,0 +1,47 @@
+cases:
+# Leaving out floats as map keys until this is resolved:
+# https://github.com/open-policy-agent/opa/issues/4797
+- modules:
+  - |
+    package comparison
+
+    p {
+      1 == 1.0
+    }
+  note: 'comparisonexpr/numbers: int and float comparison'
+  query: data.comparison.p = x
+  want_result:
+    - x: true
+- modules:
+  - |
+    package comparison
+  
+    p {
+      [1] == [1.0]
+    }
+  note: 'comparisonexpr/numbers: int and float array comparison'
+  query: data.comparison.p = x
+  want_result:
+  - x: true
+- modules:
+    - |
+      package comparison
+      
+      p {
+        {1: 1} == {1: 1.0}
+      }
+  note: 'comparisonexpr/numbers: int and float object comparison'
+  query: data.comparison.p = x
+  want_result:
+    - x: true
+- modules:
+    - |
+      package comparison
+      
+      p {
+        {"x": [1, 2, {"b": 3.0}]} == {"x": [1, 2, {"b": 3}]}
+      }
+  note: 'comparisonexpr/numbers: int and float nested object comparison'
+  query: data.comparison.p = x
+  want_result:
+    - x: true
diff --git a/test/cases/testdata/completedoc/test-completedoc-0495.yaml b/test/cases/testdata/completedoc/test-completedoc-0495.yaml
index 325faf0250..ffd477fef5 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0495.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0495.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0496.yaml b/test/cases/testdata/completedoc/test-completedoc-0496.yaml
index 8a3978ee78..2eabcb8db2 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0496.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0496.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0497.yaml b/test/cases/testdata/completedoc/test-completedoc-0497.yaml
index 4b5c13c4fd..92c67fdce5 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0497.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0497.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0498.yaml b/test/cases/testdata/completedoc/test-completedoc-0498.yaml
index f7160f9765..ae688c4a4f 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0498.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0498.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0499.yaml b/test/cases/testdata/completedoc/test-completedoc-0499.yaml
index fcb2220bc5..ee066d57b4 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0499.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0499.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0500.yaml b/test/cases/testdata/completedoc/test-completedoc-0500.yaml
index f564264984..3ed93a82a5 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0500.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0500.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0501.yaml b/test/cases/testdata/completedoc/test-completedoc-0501.yaml
index af39a1e4b2..448832c9b3 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0501.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0501.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0502.yaml b/test/cases/testdata/completedoc/test-completedoc-0502.yaml
index 08c8f2349a..cf4b4ddc3c 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0502.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0502.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0503.yaml b/test/cases/testdata/completedoc/test-completedoc-0503.yaml
index d3a45beb53..35b7aa68c8 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0503.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0503.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -90,4 +8,4 @@ cases:
   note: 'completedoc/string: ""'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/completedoc/test-completedoc-0504.yaml b/test/cases/testdata/completedoc/test-completedoc-0504.yaml
index e3a5bc8287..61db8843a6 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0504.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0504.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0505.yaml b/test/cases/testdata/completedoc/test-completedoc-0505.yaml
index 933e9c81f4..1e5b683c7d 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0505.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0505.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0506.yaml b/test/cases/testdata/completedoc/test-completedoc-0506.yaml
index f4a44bd461..86554fc39a 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0506.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0506.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0507.yaml b/test/cases/testdata/completedoc/test-completedoc-0507.yaml
index ef4416846e..8f58d7e3b7 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0507.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0507.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,5 +9,5 @@ cases:
   query: data.generated.p = x
   want_result:
   - x:
+      '1': 2
       '{"3":4}': 5
-      "1": 2
diff --git a/test/cases/testdata/completedoc/test-completedoc-0508.yaml b/test/cases/testdata/completedoc/test-completedoc-0508.yaml
index 515b01c412..b6f7e44818 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0508.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0508.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0509.yaml b/test/cases/testdata/completedoc/test-completedoc-0509.yaml
index 3d72fbab46..0126a9e332 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0509.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0509.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/completedoc/test-completedoc-0510.yaml b/test/cases/testdata/completedoc/test-completedoc-0510.yaml
index 651da83f8e..64f3732111 100644
--- a/test/cases/testdata/completedoc/test-completedoc-0510.yaml
+++ b/test/cases/testdata/completedoc/test-completedoc-0510.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -96,4 +14,3 @@ cases:
   query: data.generated.p = x
   want_error: complete rules must not produce multiple outputs
   want_error_code: eval_conflict_error
-# TODO(sr): non-strict-mode error, skipped in WASM e2e
\ No newline at end of file
diff --git a/test/cases/testdata/compositebasedereference/test-compositebasedereference-1073.yaml b/test/cases/testdata/compositebasedereference/test-compositebasedereference-1073.yaml
index 04370c191c..21c865215c 100644
--- a/test/cases/testdata/compositebasedereference/test-compositebasedereference-1073.yaml
+++ b/test/cases/testdata/compositebasedereference/test-compositebasedereference-1073.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/compositebasedereference/test-compositebasedereference-1074.yaml b/test/cases/testdata/compositebasedereference/test-compositebasedereference-1074.yaml
index 34e833aab0..e5abbf5557 100644
--- a/test/cases/testdata/compositebasedereference/test-compositebasedereference-1074.yaml
+++ b/test/cases/testdata/compositebasedereference/test-compositebasedereference-1074.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/compositebasedereference/test-compositebasedereference-1075.yaml b/test/cases/testdata/compositebasedereference/test-compositebasedereference-1075.yaml
index f2f195805c..fa9524b850 100644
--- a/test/cases/testdata/compositebasedereference/test-compositebasedereference-1075.yaml
+++ b/test/cases/testdata/compositebasedereference/test-compositebasedereference-1075.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0781.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0781.yaml
index c2f6c9a49a..f6b26e2195 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0781.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0781.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0782.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0782.yaml
index 873064bf72..27fd5f5f77 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0782.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0782.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0783.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0783.yaml
index b495c086c7..3cfbf134dd 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0783.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0783.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0784.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0784.yaml
index 1e86c8faae..61f086f055 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0784.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0784.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0785.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0785.yaml
index cc6da0bff4..084ed20f25 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0785.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0785.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0786.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0786.yaml
index 0a0d568715..a322553344 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0786.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0786.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0787.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0787.yaml
index 281cd5c28a..1045703215 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0787.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0787.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0788.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0788.yaml
index 62ceae40d1..8f03141639 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0788.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0788.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -96,6 +19,6 @@ cases:
   sort_bindings: true
   want_result:
   - x:
-    - "2"
-    - "3"
-    - "4"
+    - '2'
+    - '3'
+    - '4'
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0789.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0789.yaml
index f08a9b1855..d6b39a15ff 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0789.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0789.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0790.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0790.yaml
index 218d97bb5d..c0f4b3c80b 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0790.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0790.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0791.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0791.yaml
index 719b939ce4..6585542c1c 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0791.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0791.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -97,6 +20,6 @@ cases:
   sort_bindings: true
   want_result:
   - x:
-    - "2"
-    - "3"
-    - "4"
+    - '2'
+    - '3'
+    - '4'
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0792.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0792.yaml
index 3f2036a5d5..8e5d47a8fa 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0792.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0792.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -97,6 +20,6 @@ cases:
   sort_bindings: true
   want_result:
   - x:
-    - "2"
-    - "3"
-    - "4"
+    - '2'
+    - '3'
+    - '4'
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0793.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0793.yaml
index a53f0ab6bb..6e2e9dc726 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0793.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0793.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -94,7 +17,7 @@ cases:
   query: data.generated.p = x
   want_result:
   - x:
-    - "1": 1
-      "2": 2
-      "3": 3
-      "4": 4
+    - '1': 1
+      '2': 2
+      '3': 3
+      '4': 4
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0794.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0794.yaml
index 3f8c26b59d..b1811daa89 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0794.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0794.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0795.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0795.yaml
index bc16201a49..9fe951e284 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0795.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0795.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0796.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0796.yaml
index 0f66ae27af..165b0be203 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0796.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0796.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0797.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0797.yaml
index 9f9822c562..e9f6fc9651 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0797.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0797.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0798.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0798.yaml
index ec95adcd95..881e4c3fbc 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0798.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0798.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0799.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0799.yaml
index 5174207a6d..5ad6dc1ff5 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0799.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0799.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0800.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0800.yaml
index 7a6ed58e0d..fbbc61c735 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0800.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0800.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0801.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0801.yaml
index 03de6638a5..cfc6183067 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0801.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0801.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0802.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0802.yaml
index 89ffda1fff..16211d7e35 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0802.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0802.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/comprehensions/test-comprehensions-0803.yaml b/test/cases/testdata/comprehensions/test-comprehensions-0803.yaml
index b3aef88709..b84f6e6621 100644
--- a/test/cases/testdata/comprehensions/test-comprehensions-0803.yaml
+++ b/test/cases/testdata/comprehensions/test-comprehensions-0803.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/containskeyword/test-contains-future-keyword.yaml b/test/cases/testdata/containskeyword/test-contains-future-keyword.yaml
new file mode 100644
index 0000000000..9c54f6e72c
--- /dev/null
+++ b/test/cases/testdata/containskeyword/test-contains-future-keyword.yaml
@@ -0,0 +1,67 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+    p {
+      contains("fireplace", "repl")
+    }
+  note: containskeyword/base case
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.contains
+
+    p {
+      contains("fireplace", "repl")
+    }
+  note: containskeyword/with unused kw import
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.contains
+
+    p contains "x" {
+      contains("fireplace", "repl")
+    }
+  note: containskeyword/with kw and builtin used
+  query: data.test.p = x
+  want_result:
+  - x: [x]
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.contains
+
+    p contains "x"
+  note: containskeyword/empty body
+  query: data.test.p = x
+  want_result:
+  - x: [x]
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.contains
+
+    p contains msg {
+      msg := "nono"
+    }
+    p contains msg {
+      msg := "nonono"
+    }
+  note: containskeyword/ordinary deny rule
+  query: data.test.p = x
+  want_result:
+  - x:
+    - nono
+    - nonono
diff --git a/test/cases/testdata/cryptohmacequal/test-cryptohmacequal.yaml b/test/cases/testdata/cryptohmacequal/test-cryptohmacequal.yaml
new file mode 100644
index 0000000000..0bb37b016f
--- /dev/null
+++ b/test/cases/testdata/cryptohmacequal/test-cryptohmacequal.yaml
@@ -0,0 +1,66 @@
+cases:
+  - note: cryptohmacequal/crypto.hmac.equal_md5
+    query: data.test.p = x
+    modules:
+    - |
+      package test
+      
+      p[res] {
+        res := crypto.hmac.equal(input.mac1, input.mac2)
+      }
+    input: {"mac1": "31b6db9e5eb4addb42f1a6ca07367adc", "mac2": "31b6db9e5eb4addb42f1a6ca07367adc"}
+    want_result:
+    - x:
+      - true
+  - note: cryptohmacequal/crypto.hmac.equal_sha1
+    query: data.test.p = x
+    modules:
+    - |
+      package test
+      
+      p[res] {
+        res := crypto.hmac.equal(input.mac1, input.mac2)
+      }
+    input: {"mac1": "85d155c55ed286a300bd1cf124de08d87e914f3a", "mac2": "85d155c55ed286a300bd1cf124de08d87e914f3a"}
+    want_result:
+    - x:
+      - true
+  - note: cryptohmacequal/crypto.hmac.equal_sha256
+    query: data.test.p = x
+    modules:
+    - |
+      package test
+      
+      p[res] {
+        res := crypto.hmac.equal(input.mac1, input.mac2)
+      }
+    input: {"mac1": "147933218aaabc0b8b10a2b3a5c34684c8d94341bcf10a4736dc7270f7741851", "mac2": "147933218aaabc0b8b10a2b3a5c34684c8d94341bcf10a4736dc7270f7741851"}
+    want_result:
+    - x:
+      - true
+  - note: cryptohmacequal/crypto.hmac.equal_sha512
+    query: data.test.p = x
+    modules:
+    - |
+      package test
+      
+      p[res] {
+        res := crypto.hmac.equal(input.mac1, input.mac2)
+      }
+    input: {"mac1": "24257d7210582a65c731ec55159c8184cc24c02489453e58587f71f44c23a2d61b4b72154a89d17b2d49448a8452ea066f4fc56a2bcead45c088572ffccdb3d8", "mac2": "24257d7210582a65c731ec55159c8184cc24c02489453e58587f71f44c23a2d61b4b72154a89d17b2d49448a8452ea066f4fc56a2bcead45c088572ffccdb3d8"}
+    want_result:
+    - x:
+      - true  
+  - note: cryptohmacequal/crypto.hmac.equal_false
+    query: data.test.p = x
+    modules:
+    - |
+      package test
+      
+      p[res] {
+        res := crypto.hmac.equal(input.mac1, input.mac2)
+      }
+    input: {"mac1": "31b6db9e5eb4addb42f1a6ca07367adc", "mac2": "31b6db9e5eb4addb"}
+    want_result:
+    - x:
+      - false
\ No newline at end of file
diff --git a/test/cases/testdata/cryptosha1/test-cryptosha1-0131.yaml b/test/cases/testdata/cryptosha1/test-cryptosha1-0131.yaml
index 0ffcea68c6..3031455a13 100644
--- a/test/cases/testdata/cryptosha1/test-cryptosha1-0131.yaml
+++ b/test/cases/testdata/cryptosha1/test-cryptosha1-0131.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptosha256/test-cryptosha256-0132.yaml b/test/cases/testdata/cryptosha256/test-cryptosha256-0132.yaml
index 394f2c8ccb..cf71b8c7f8 100644
--- a/test/cases/testdata/cryptosha256/test-cryptosha256-0132.yaml
+++ b/test/cases/testdata/cryptosha256/test-cryptosha256-0132.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0125.yaml b/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0125.yaml
index 7c0c86527e..f185e168dd 100644
--- a/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0125.yaml
+++ b/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0125.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0126.yaml b/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0126.yaml
index c2f4875e82..f61d53406c 100644
--- a/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0126.yaml
+++ b/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0126.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0127.yaml b/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0127.yaml
index 3dfb8fe71d..a7ee00b5d5 100644
--- a/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0127.yaml
+++ b/test/cases/testdata/cryptox509parsecertificaterequest/test-cryptox509parsecertificaterequest-0127.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0117.yaml b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0117.yaml
index 1b6f97d5d3..216c0d9fec 100644
--- a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0117.yaml
+++ b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0117.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0118.yaml b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0118.yaml
index 963b8a7780..f8b2e02d4a 100644
--- a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0118.yaml
+++ b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0118.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0119.yaml b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0119.yaml
index 2cc3ba3196..14d5821d3d 100644
--- a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0119.yaml
+++ b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0119.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0120.yaml b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0120.yaml
index 00d9f45b9b..bfbc8b3c58 100644
--- a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0120.yaml
+++ b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0120.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0121.yaml b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0121.yaml
index 5d94bfdb70..d08d55d8a4 100644
--- a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0121.yaml
+++ b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0121.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0122.yaml b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0122.yaml
index 0ce88707b4..61e6dc8279 100644
--- a/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0122.yaml
+++ b/test/cases/testdata/cryptox509parsecertificates/test-cryptox509parsecertificates-0122.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/cryptox509parsersaprivatekey/test-cryptox509parsersaprivatekey-1.yaml b/test/cases/testdata/cryptox509parsersaprivatekey/test-cryptox509parsersaprivatekey-1.yaml
new file mode 100644
index 0000000000..b6cd5adf0a
--- /dev/null
+++ b/test/cases/testdata/cryptox509parsersaprivatekey/test-cryptox509parsersaprivatekey-1.yaml
@@ -0,0 +1,33 @@
+cases:
+  - data:
+    modules:
+      - |
+        package testing
+        
+        pem := "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEA9D/bK4171aiTNUkrUCHKGMLSQooV+o3wdz2889h9iv0HhhBJ\nCAGU54K3duB8ofHpmYL50QodcR4RLw1vSkaI+FPdPDMyKxKj/YcmofJjz4kW+Iqw\nFbBcbMnKnEVzye+CyW9YYOTu0xWtcgen80zGp2opG0GZX86hBjjXJnjOdrJTk6x2\nNAiJIbjsQevysmj+2MyqVm8widxw0x+rGhTaCD+ZXWitN0a0WO1aaA8c/7i99I9z\nhe2peKvXzEtMaqYO9ptHcYmq2z0QWvZuJVMv5Yn0mScLWyh91R099IOtn6sNaMMs\nOyTpi7E/2IlVgI2uKGPEopKkMFV8Fl2YaAbo7wIDAQABAoIBAAyMZ08ygqU0dvOq\n4a3JPp/NCo5el8h6mFsX8eg5PCHy4/sQRSBDLIpEXfaei+iqDA1V/E2wDlksaUeY\nkhony4uui1Q3cSFjYMd6tRJm6JfV/DcisO88U1NHfsBOlSdPxdFhhhHcUSTJHVMZ\nb5iBXkdlnd0HnsCcVguCyhLw6/KPFyiA+NYRz68flxze7admyVp5C6i/HbMPq8Pr\nMilBUvOFtxuaGeJBAiavuzUe9I70dRwpe424tMvisSA8h7Xbm8BeN/PJHDV/2JrI\nURgQ563yQ5So/Qg8AgxXRkpgWM9zAh7r31PBO86vq/B4ZbON/TtWdcZVsAcVB4Pk\ntqc8JNkCgYEA+g8V+y92SETdcwUkbd5O9Fg5CkfdsALsBXVH6FunrCUV5HS9l5o6\nMMBbJ/08odW/bP5BmOa4A/Hbk9uG/UfQn2KQ3HCgPlxUEwQO07R1/FcQOe4xmyG6\nJpDgQ30viE1RtlCkceQWUeitCIqZsYu0i8sLZLWJH+V/07OB4G17ELMCgYEA+g1v\nhrlAFNhZvrIX/zcP3xF2pZ+AqkFXdL/tWQZkWAVToONn/LlXTH71C/TO2x+OaQRm\nqX1bA9Zhyjf1gYQN9RenjUswvggk0aY2Tk28wUqowMGSsjQHmZ20EphHNMWNJpdS\nfKFfrQIFKCnLlpQVNz+j3bLWZUnq+jPaYnJP7NUCgYEA48qcVo7c7Ga3aNEVZ3St\nbg90HrZq760pvqshDz13V+0MrWnfUFxxh/mi0KHy+uYRlMNllFkQ5p8LTP0dUlt6\nY8dReU6r20MWX6BBtX9eP7o8ENm4nL4zqnAtq609gKgWuMNrmkiSQJl6Dx7bdY5z\nsSkNPvfUa5cQRBTxSjXRdtsCgYBHrzpdwRXh4/Q2ew/uFnbyWCtPZ96W8IyF58+/\nSdnSchR7dzYEeY3RXEQb3V6/6tgEu0JDLLC+9OKr+kbjjlwB+3oJQ5kBoYwMnj3L\nTPXj4+dk+xl3BPt4yoEpI4amVkwU2CTJnemzy3R3AyReUq2SXSg5El/sQbifaeYd\neu/20QKBgH/5IZHGBKiRAe1ww2FzOpDtL8VXXTe3EAXKutfajrHTqPz9+lXknX/D\nUMosh264nYXYS29WqxhJVutbE9u8e0VpuY1qIN9/3R0WKfTLTMUFlZtbqTepvsy1\nW2UbK732I4Nfp0/mtUvOSdMZO8dxbSdEeMnw/Ec8QgxK9a1rRu9+\n-----END RSA PRIVATE KEY-----"
+        
+        p := crypto.x509.parse_rsa_private_key(pem)
+    note: cryptox509parsersaprivatekey/valid
+    query: data.testing.p = x
+    want_result:
+      - x:
+          "d": "DIxnTzKCpTR286rhrck-n80Kjl6XyHqYWxfx6Dk8IfLj-xBFIEMsikRd9p6L6KoMDVX8TbAOWSxpR5iSGifLi66LVDdxIWNgx3q1Embol9X8NyKw7zxTU0d-wE6VJ0_F0WGGEdxRJMkdUxlvmIFeR2Wd3QeewJxWC4LKEvDr8o8XKID41hHPrx-XHN7tp2bJWnkLqL8dsw-rw-syKUFS84W3G5oZ4kECJq-7NR70jvR1HCl7jbi0y-KxIDyHtdubwF4388kcNX_YmshRGBDnrfJDlKj9CDwCDFdGSmBYz3MCHuvfU8E7zq-r8Hhls439O1Z1xlWwBxUHg-S2pzwk2Q"
+          "dp": "48qcVo7c7Ga3aNEVZ3Stbg90HrZq760pvqshDz13V-0MrWnfUFxxh_mi0KHy-uYRlMNllFkQ5p8LTP0dUlt6Y8dReU6r20MWX6BBtX9eP7o8ENm4nL4zqnAtq609gKgWuMNrmkiSQJl6Dx7bdY5zsSkNPvfUa5cQRBTxSjXRdts"
+          "dq": "R686XcEV4eP0NnsP7hZ28lgrT2felvCMhefPv0nZ0nIUe3c2BHmN0VxEG91ev-rYBLtCQyywvvTiq_pG445cAft6CUOZAaGMDJ49y0z14-PnZPsZdwT7eMqBKSOGplZMFNgkyZ3ps8t0dwMkXlKtkl0oORJf7EG4n2nmHXrv9tE"
+          "e": "AQAB"
+          "kty": "RSA"
+          "n": "9D_bK4171aiTNUkrUCHKGMLSQooV-o3wdz2889h9iv0HhhBJCAGU54K3duB8ofHpmYL50QodcR4RLw1vSkaI-FPdPDMyKxKj_YcmofJjz4kW-IqwFbBcbMnKnEVzye-CyW9YYOTu0xWtcgen80zGp2opG0GZX86hBjjXJnjOdrJTk6x2NAiJIbjsQevysmj-2MyqVm8widxw0x-rGhTaCD-ZXWitN0a0WO1aaA8c_7i99I9zhe2peKvXzEtMaqYO9ptHcYmq2z0QWvZuJVMv5Yn0mScLWyh91R099IOtn6sNaMMsOyTpi7E_2IlVgI2uKGPEopKkMFV8Fl2YaAbo7w"
+          "p": "-g8V-y92SETdcwUkbd5O9Fg5CkfdsALsBXVH6FunrCUV5HS9l5o6MMBbJ_08odW_bP5BmOa4A_Hbk9uG_UfQn2KQ3HCgPlxUEwQO07R1_FcQOe4xmyG6JpDgQ30viE1RtlCkceQWUeitCIqZsYu0i8sLZLWJH-V_07OB4G17ELM"
+          "q": "-g1vhrlAFNhZvrIX_zcP3xF2pZ-AqkFXdL_tWQZkWAVToONn_LlXTH71C_TO2x-OaQRmqX1bA9Zhyjf1gYQN9RenjUswvggk0aY2Tk28wUqowMGSsjQHmZ20EphHNMWNJpdSfKFfrQIFKCnLlpQVNz-j3bLWZUnq-jPaYnJP7NU"
+          "qi": "f_khkcYEqJEB7XDDYXM6kO0vxVddN7cQBcq619qOsdOo_P36VeSdf8NQyiyHbridhdhLb1arGElW61sT27x7RWm5jWog33_dHRYp9MtMxQWVm1upN6m-zLVbZRsrvfYjg1-nT-a1S85J0xk7x3FtJ0R4yfD8RzxCDEr1rWtG734"
+  - data:
+    modules:
+      - |
+        package testing 
+        
+        p := crypto.x509.parse_rsa_private_key("invalid")
+    note: cryptox509parsersaprivatekey/invalid
+    query: data.testing.p = x
+    want_error: illegal base64
+    want_error_code: eval_builtin_error
+    strict_error: true
diff --git a/test/cases/testdata/dataderef/test-data-derefs.yaml b/test/cases/testdata/dataderef/test-data-derefs.yaml
new file mode 100644
index 0000000000..e3a3a6556c
--- /dev/null
+++ b/test/cases/testdata/dataderef/test-data-derefs.yaml
@@ -0,0 +1,34 @@
+cases:
+- data:
+    "2": bar
+  modules:
+  - |
+    package test
+    p := data[2]
+  note: data/toplevel integer
+  query: data.test.p = x
+  want_result:
+  - x: bar
+- data:
+    nested:
+      "2": bar
+  modules:
+  - |
+    package test
+    p := data.nested[2]
+  note: data/nested integer
+  query: data.test.p = x
+  want_result:
+  - x: bar
+- data:
+    nested:
+      "2": bar
+  modules:
+  - |
+    package test
+    p := obj[2] {
+      obj := data.nested
+    }
+  note: "data/negative case: nested integer"
+  query: data.test.p = x
+  want_result: []
\ No newline at end of file
diff --git a/test/cases/testdata/defaultkeyword/test-default-functions.yaml b/test/cases/testdata/defaultkeyword/test-default-functions.yaml
new file mode 100644
index 0000000000..6ece177203
--- /dev/null
+++ b/test/cases/testdata/defaultkeyword/test-default-functions.yaml
@@ -0,0 +1,33 @@
+# NOTE(sr): default functions are not supported, but they had sneaked into
+# the full extent of a package. These cases assert that this won't happen.
+cases:
+- note: defaultkeyword/function with var arg
+  modules:
+  - |
+    package test
+
+    default f(_) := 100
+  query: data.test = x
+  want_result:
+  - x: {}
+- note: defaultkeyword/function with ground arg
+  modules:
+  - |
+    package test
+
+    default f(10) := 100
+  query: data.test = x
+  want_result:
+  - x: {}
+- note: defaultkeyword/function with ground arg, ref head
+  modules:
+  - |
+    package test
+
+    default p.q.r.f(10) := 100
+  query: data.test = x
+  want_result:
+  - x:
+      p:
+        q:
+          r: {}
\ No newline at end of file
diff --git a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0804.yaml b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0804.yaml
index b27fcc9825..9307c32a2e 100644
--- a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0804.yaml
+++ b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0804.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0805.yaml b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0805.yaml
index c2b92a6ed1..125496929f 100644
--- a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0805.yaml
+++ b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0805.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0806.yaml b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0806.yaml
index ac2f501924..ca98b06c8f 100644
--- a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0806.yaml
+++ b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0806.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0807.yaml b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0807.yaml
index 37c0991beb..5296908d05 100644
--- a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0807.yaml
+++ b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0807.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0808.yaml b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0808.yaml
index deca48bd7f..f70c80c98b 100644
--- a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0808.yaml
+++ b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0808.yaml
@@ -1,87 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0809.yaml b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0809.yaml
index 67abd51790..3d518617fd 100644
--- a/test/cases/testdata/defaultkeyword/test-defaultkeyword-0809.yaml
+++ b/test/cases/testdata/defaultkeyword/test-defaultkeyword-0809.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0763.yaml b/test/cases/testdata/disjunction/test-disjunction-0763.yaml
index 7c0e583791..5a9d9304d3 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0763.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0763.yaml
@@ -8,80 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0764.yaml b/test/cases/testdata/disjunction/test-disjunction-0764.yaml
index 1885103c63..9c076c94e4 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0764.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0764.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0765.yaml b/test/cases/testdata/disjunction/test-disjunction-0765.yaml
index 93f4caf4e0..ffa887ac5d 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0765.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0765.yaml
@@ -8,30 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
     g:
       a:
       - 1
@@ -48,40 +24,6 @@ cases:
       - 0
       - 0
       - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0766.yaml b/test/cases/testdata/disjunction/test-disjunction-0766.yaml
index 1ebad26604..bfb5f50fed 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0766.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0766.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0767.yaml b/test/cases/testdata/disjunction/test-disjunction-0767.yaml
index ab89b8a640..a18620b609 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0767.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0767.yaml
@@ -8,80 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0768.yaml b/test/cases/testdata/disjunction/test-disjunction-0768.yaml
index 07c1c52359..c1d17edbbc 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0768.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0768.yaml
@@ -8,80 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0769.yaml b/test/cases/testdata/disjunction/test-disjunction-0769.yaml
index 22a4f9d291..6663b9e88a 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0769.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0769.yaml
@@ -8,30 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
     g:
       a:
       - 1
@@ -48,40 +24,6 @@ cases:
       - 0
       - 0
       - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0770.yaml b/test/cases/testdata/disjunction/test-disjunction-0770.yaml
index 2966194e14..1e97d537ea 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0770.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0770.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0771.yaml b/test/cases/testdata/disjunction/test-disjunction-0771.yaml
index 083acb9a3a..f77f995bb9 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0771.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0771.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0772.yaml b/test/cases/testdata/disjunction/test-disjunction-0772.yaml
index d6d5fab768..f1ddf1b9a9 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0772.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0772.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0773.yaml b/test/cases/testdata/disjunction/test-disjunction-0773.yaml
index cd79a5f57c..c802ca7b40 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0773.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0773.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0774.yaml b/test/cases/testdata/disjunction/test-disjunction-0774.yaml
index 74c5344ce5..5022cabff5 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0774.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0774.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/disjunction/test-disjunction-0776.yaml b/test/cases/testdata/disjunction/test-disjunction-0776.yaml
index cfb2f887ac..3a785b9d31 100644
--- a/test/cases/testdata/disjunction/test-disjunction-0776.yaml
+++ b/test/cases/testdata/disjunction/test-disjunction-0776.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1054.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1054.yaml
index b80cf0e91a..4758c18f0c 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1054.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1054.yaml
@@ -1,249 +1,12 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
     no_op {
       true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
+    } else = false {
       true
     }
   note: elsekeyword/no-op
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1055.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1055.yaml
index 48bcd7aa63..8a11debc72 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1055.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1055.yaml
@@ -1,249 +1,12 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
     bool {
       false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
+    } else = true {
       true
     }
   note: elsekeyword/trivial
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1056.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1056.yaml
index b9ce41eb55..1ee74cd130 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1056.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1056.yaml
@@ -1,249 +1,12 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
     non_bool = null {
       false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
+    } else = [100] {
       true
     }
   note: elsekeyword/trivial-non-bool
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1057.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1057.yaml
index a51d8a7cc0..5a7c92cb26 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1057.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1057.yaml
@@ -1,249 +1,14 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
     triple {
       false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
     } else {
       false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
+    } else = "hello" {
       true
     }
   note: elsekeyword/trivial-3
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1058.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1058.yaml
index 9fa6149f5c..8441987638 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1058.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1058.yaml
@@ -8,244 +8,15 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
     vars {
       false
-    }
-
-    else = ["hello", x] {
+    } else = ["hello", x] {
       data.b.v2 = x
     }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/var-head
   query: data.ex.vars = x
   want_result:
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1059.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1059.yaml
index 5f28a11c47..ce67fb866a 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1059.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1059.yaml
@@ -8,244 +8,17 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
     refs {
       false
-    }
-
-    else = __local6__ {
+    } else = __local6__ {
       true
       __local7__ = data.b.v2
       __local6__ = ["hello", __local7__]
     }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/ref-head
   query: data.ex.refs = x
   want_result:
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1060.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1060.yaml
index 25c90f3e6e..e1fb19ebb2 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1060.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1060.yaml
@@ -1,249 +1,14 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
     multiple_defined = false {
       false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
     } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
       true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
+    } else = false {
       true
     }
   note: elsekeyword/first-match
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1061.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1061.yaml
index 804c2a4712..7155278f18 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1061.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1061.yaml
@@ -1,157 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
     default default_1 = 1
 
     default_1 {
@@ -159,93 +11,6 @@ cases:
     }
 
     default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/default-1
   query: data.ex.default_1 = x
   want_result:
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1062.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1062.yaml
index 1a9caf816b..74061d4fe3 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1062.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1062.yaml
@@ -1,165 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
     default default_2 = 2
 
     default_2 {
@@ -169,83 +13,6 @@ cases:
     default_2 = 1 {
       false
     }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/default-2
   query: data.ex.default_2 = x
   want_result:
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1063.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1063.yaml
index a31b9f5be3..5d9d8db80b 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1063.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1063.yaml
@@ -1,175 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
     multiple_roots {
       false
     } else = 1 {
@@ -187,65 +21,6 @@ cases:
     } else = 2 {
       true
     }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/multiple-roots
   query: data.ex.multiple_roots = x
   want_result:
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1064.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1064.yaml
index 89a117eefa..c750a38a28 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1064.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1064.yaml
@@ -5,189 +5,10 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
     indexed {
       data.a[0] = 0
     } else = 2 {
@@ -206,46 +27,6 @@ cases:
       x = 1
       data.a[2] = 3
     }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/indexed
   query: data.ex.indexed = x
   want_result:
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1065.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1065.yaml
index 026035e2f7..3b26a95075 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1065.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1065.yaml
@@ -1,251 +1,16 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
     conflict_1 {
       false
-    }
-
-    else = true {
+    } else = true {
       true
     }
 
     conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    fn_result = [x, y, z] {
-      data.ex.fn(101, true, x)
-      data.ex.fn(100, true, y)
-      data.ex.fn(100, false, z)
-    }
-
-    fn(__local0__, __local1__) = "large" {
-      __local0__ > 100
-    } else = "small" {
-      __local3__ = true
-    } else = "medium" {
-      true
-    }
   note: elsekeyword/conflict-1
   query: data.ex.conflict_1 = x
   want_error: complete rules must not produce multiple outputs
diff --git a/test/cases/testdata/elsekeyword/test-elsekeyword-1067.yaml b/test/cases/testdata/elsekeyword/test-elsekeyword-1067.yaml
index 8d45a5af36..5d358f57b9 100644
--- a/test/cases/testdata/elsekeyword/test-elsekeyword-1067.yaml
+++ b/test/cases/testdata/elsekeyword/test-elsekeyword-1067.yaml
@@ -1,238 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
 
-    no_op {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    bool {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    non_bool = null {
-      false
-    }
-
-    else = [100] {
-      true
-    }
-
-    triple {
-      false
-    }
-
-    else {
-      false
-    }
-
-    else = "hello" {
-      true
-    }
-
-    vars {
-      false
-    }
-
-    else = ["hello", x] {
-      data.b.v2 = x
-    }
-
-    refs {
-      false
-    }
-
-    else = __local6__ {
-      true
-      __local7__ = data.b.v2
-      __local6__ = ["hello", __local7__]
-    }
-
-    multiple_defined = false {
-      false
-    }
-
-    else {
-      true
-    }
-
-    else = false {
-      true
-    }
-
-    default default_1 = 1
-
-    default_1 {
-      false
-    }
-
-    default_1 = 2
-
-    default default_2 = 2
-
-    default_2 {
-      false
-    }
-
-    default_2 = 1 {
-      false
-    }
-
-    multiple_roots {
-      false
-    } else = 1 {
-      false
-    } else = 2 {
-      true
-    } else = 3 {
-      true
-    }
-
-    multiple_roots = 2
-
-    multiple_roots = 3 {
-      false
-    } else = 2 {
-      true
-    }
-
-    indexed {
-      data.a[0] = 0
-    } else = 2 {
-      data.a[0] = 1
-    } else = 3 {
-      data.a[0] = 1
-    }
-
-    indexed {
-      data.a[0] = 1
-      data.a[2] = 2
-    } else {
-      false
-    } else = 2 {
-      data.a[0] = x
-      x = 1
-      data.a[2] = 3
-    }
-
-    conflict_1 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
-    conflict_1 = false
-
-    conflict_2 {
-      false
-    }
-
-    else = false {
-      true
-    }
-
-    conflict_2 {
-      false
-    }
-
-    else = true {
-      true
-    }
-
     fn_result = [x, y, z] {
       data.ex.fn(101, true, x)
       data.ex.fn(100, true, y)
diff --git a/test/cases/testdata/embeddedvirtualdoc/test-embeddedvirtualdoc-0976.yaml b/test/cases/testdata/embeddedvirtualdoc/test-embeddedvirtualdoc-0976.yaml
index 8b8c3c43ce..1a64d8a215 100644
--- a/test/cases/testdata/embeddedvirtualdoc/test-embeddedvirtualdoc-0976.yaml
+++ b/test/cases/testdata/embeddedvirtualdoc/test-embeddedvirtualdoc-0976.yaml
@@ -5,33 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
     g:
       a:
       - 1
@@ -48,40 +21,6 @@ cases:
       - 0
       - 0
       - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   input_term: '{}'
   modules:
   - |
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0545.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0545.yaml
index 23d05dfa93..9d4962ed16 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0545.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0545.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0546.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0546.yaml
index 90c65b608c..17ab888fe0 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0546.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0546.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0547.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0547.yaml
index ee24d06411..b51b562651 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0547.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0547.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0548.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0548.yaml
index 5c7782ca56..6f1be6ca1e 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0548.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0548.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0549.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0549.yaml
index f201e21232..420343eb71 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0549.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0549.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0550.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0550.yaml
index 3892c74446..8f84e394e2 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0550.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0550.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0551.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0551.yaml
index 5fac0c5d89..f1b0412ba1 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0551.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0551.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0552.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0552.yaml
index 5fe0024be3..31c3450a83 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0552.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0552.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0553.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0553.yaml
index e9daff6d71..3b2d40fc4a 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0553.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0553.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0554.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0554.yaml
index b934d4976c..b3e3d4e073 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0554.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0554.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0555.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0555.yaml
index 1d142506e9..cfc76a4319 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0555.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0555.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0556.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0556.yaml
index 35574128e3..aeccc6a646 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0556.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0556.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0557.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0557.yaml
index c81099e9ac..970ff62cf7 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0557.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0557.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0558.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0558.yaml
index 6a5f91c189..ebeccb4ad7 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0558.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0558.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0559.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0559.yaml
index aa2de683af..f1e4fba313 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0559.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0559.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0560.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0560.yaml
index 7cc476fd7a..c0ad231288 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0560.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0560.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0561.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0561.yaml
index 9c185d254d..a070bd0a4e 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0561.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0561.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0562.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0562.yaml
index a912e18a14..ce74dbd3f2 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0562.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0562.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0563.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0563.yaml
index 28fda5be32..9da082c796 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0563.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0563.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0564.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0564.yaml
index 17d3c38d48..453e0da8fb 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0564.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0564.yaml
@@ -1,87 +1,7 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
-      v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0565.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0565.yaml
index 5b4d6db7cc..a7a81482ad 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0565.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0565.yaml
@@ -1,87 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0566.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0566.yaml
index e13cf07bb7..12105d2e72 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0566.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0566.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0567.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0567.yaml
index f44bcbca13..4af687659d 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0567.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0567.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0568.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0568.yaml
index 8a66b314a7..77fc8f1245 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0568.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0568.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0569.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0569.yaml
index bf8e0545ed..fc7cc52651 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0569.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0569.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0570.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0570.yaml
index 6763a643c5..f2e18d1a58 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0570.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0570.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0571.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0571.yaml
index 55707b84e9..dd9ed0cfde 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0571.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0571.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0572.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0572.yaml
index f2182ccc9b..ae3339c2f8 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0572.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0572.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0573.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0573.yaml
index 6659dd2d36..f24ed042d4 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0573.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0573.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0574.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0574.yaml
index 9b5998c691..fe2736a4c1 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0574.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0574.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0575.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0575.yaml
index 15ee09a82d..08181885c8 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0575.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0575.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0576.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0576.yaml
index 7f73516671..550d539016 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0576.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0576.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0577.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0577.yaml
index 92db44749a..9d8262de39 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0577.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0577.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0578.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0578.yaml
index 5a83fab757..adccb42a9c 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0578.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0578.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0579.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0579.yaml
index 2096d3f934..50988f0408 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0579.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0579.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0580.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0580.yaml
index 4684f27e0b..83cf6810b1 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0580.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0580.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0581.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0581.yaml
index 53084ff7d3..a2b66cba62 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0581.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0581.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0582.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0582.yaml
index d05adef610..724f4b12a8 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0582.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0582.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0583.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0583.yaml
index b91ce992af..a13c3b0397 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0583.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0583.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0584.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0584.yaml
index 401776035e..f5b8a4fa4b 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0584.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0584.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0585.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0585.yaml
index f16fdad09f..d0b6966d45 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0585.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0585.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0586.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0586.yaml
index 6f16519c65..3f5d399a60 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0586.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0586.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0587.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0587.yaml
index 32f1d15f42..309575dec2 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0587.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0587.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0588.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0588.yaml
index 296f8f5b1d..3f36a99973 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0588.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0588.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0589.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0589.yaml
index 5e77b6734f..fe3455d555 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0589.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0589.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0590.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0590.yaml
index f1c0fe5bad..40ddd21eec 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0590.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0590.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0591.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0591.yaml
index e5c6e6be60..75cff90897 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0591.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0591.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0592.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0592.yaml
index a373f4a29d..401d36b306 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0592.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0592.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0593.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0593.yaml
index 8d447c44fb..3e981da1b1 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0593.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0593.yaml
@@ -1,28 +1,5 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
     f:
     - xs:
       - 1
@@ -32,56 +9,6 @@ cases:
       - 2
       ys:
       - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0594.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0594.yaml
index c9d378ed3d..f7c2339cc1 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0594.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0594.yaml
@@ -1,28 +1,5 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
     f:
     - xs:
       - 1
@@ -32,56 +9,6 @@ cases:
       - 2
       ys:
       - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0595.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0595.yaml
index ebc81bcde5..3c32a62d3c 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0595.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0595.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0597.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0597.yaml
index 203216ff41..65ff297ff2 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0597.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0597.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0598.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0598.yaml
index 65958d4d1e..cb1d7260db 100644
--- a/test/cases/testdata/eqexpr/test-eqexpr-0598.yaml
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0598.yaml
@@ -5,33 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
     g:
       a:
       - 1
@@ -48,40 +21,6 @@ cases:
       - 0
       - 0
       - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/eqexpr/test-eqexpr-0599.yaml b/test/cases/testdata/eqexpr/test-eqexpr-0599.yaml
new file mode 100644
index 0000000000..b943a8c5ae
--- /dev/null
+++ b/test/cases/testdata/eqexpr/test-eqexpr-0599.yaml
@@ -0,0 +1,19 @@
+cases:
+  - input_term: "1.0"
+    modules:
+      - |
+        package test
+        p { input == 1.0 }
+    note: "eqexpr/indexing: input is 1.0"
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - input_term: "1"
+    modules:
+      - |
+        package test
+        p { input == 1.0 }
+    note: "eqexpr/indexing: input is 1"
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0525.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0525.yaml
index 90f461a062..e815fcc5e1 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0525.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0525.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0526.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0526.yaml
index f568df0969..772bae9ae4 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0526.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0526.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0527.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0527.yaml
index 619640a569..6649b94c14 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0527.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0527.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0528.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0528.yaml
index afa33b3310..13823db18b 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0528.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0528.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0529.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0529.yaml
index d78d837f4c..ca8e8e6c91 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0529.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0529.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0530.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0530.yaml
index aa58bd9669..f8d666bab9 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0530.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0530.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0531.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0531.yaml
index 34cdce1d2e..89d495b74b 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0531.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0531.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0532.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0532.yaml
index 50f69d7146..4db4af1a38 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0532.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0532.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0533.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0533.yaml
index 62c6f4a113..47dd8d0009 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0533.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0533.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0534.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0534.yaml
index 890f6a5b4c..2a06741dec 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0534.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0534.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0535.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0535.yaml
index 6897a6b73b..ef402da881 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0535.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0535.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0536.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0536.yaml
index fb9f08bd88..58106e1a72 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0536.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0536.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0537.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0537.yaml
index 49e997b58e..cc6e52e1b0 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0537.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0537.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0538.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0538.yaml
index 31fc6fc51e..574a1f364a 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0538.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0538.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0539.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0539.yaml
index aed7bf70c5..6a650817da 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0539.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0539.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0540.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0540.yaml
index dbf7b32e88..8b4f0f5bce 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0540.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0540.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0541.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0541.yaml
index 67517dbd81..7b1fd27a10 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0541.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0541.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0542.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0542.yaml
index 531e59372f..356ad7be74 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0542.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0542.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0543.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0543.yaml
index e56a3dd292..4afbaafd44 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0543.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0543.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0544.yaml b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0544.yaml
index 81352c3d87..a8473ecfae 100644
--- a/test/cases/testdata/evaltermexpr/test-evaltermexpr-0544.yaml
+++ b/test/cases/testdata/evaltermexpr/test-evaltermexpr-0544.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/every/every.yaml b/test/cases/testdata/every/every.yaml
new file mode 100644
index 0000000000..e4fea5d06c
--- /dev/null
+++ b/test/cases/testdata/every/every.yaml
@@ -0,0 +1,131 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every x in [] { x != x }
+    }
+  note: every/empty domain
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every _ in input { true }
+    }
+  note: every/domain undefined
+  query: data.test.p = x
+  want_result: []
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every x in numbers.range(1, 10) { x >= 1 }
+    }
+  note: every/domain is call
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every k, v in [1, 2] { k+1 == v }
+    }
+  note: every/simple key/val
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      i := 10
+      every k, v in [1, 2] { k+v != i }
+    }
+  note: every/outer bindings
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every v in [1, 2] { v != 1 }
+    }
+  note: every/simple failure, first
+  query: data.test.p = x
+  want_result: []
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every v in [1, 2] { v != 2 }
+    }
+  note: every/simple failure, last
+  query: data.test.p = x
+  want_result: []
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every v in input { v == 1 } with input as [1, 1, 1]
+    }
+  note: 'every/with: domain'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every v in [1, 2] { v in input } with input as [1, 2, 1, 0]
+    }
+  note: 'every/with: body'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p[v] {
+      every v in [1, 2] { v < 3 }
+      v := 10
+      v > 3
+    }
+  note: 'every/followed by another query'
+  query: data.test.p = x
+  want_result:
+  - x: [10]
\ No newline at end of file
diff --git a/test/cases/testdata/every/textbook.yaml b/test/cases/testdata/every/textbook.yaml
new file mode 100644
index 0000000000..d434c9a91f
--- /dev/null
+++ b/test/cases/testdata/every/textbook.yaml
@@ -0,0 +1,148 @@
+cases:
+- data:
+  input:
+    containers:
+    - image: bitcoin-miner
+    - image: acmecorp.com/webapp
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every x in input.containers {
+        startswith(x.image, "acmecorp.com/")
+      }
+    }
+  note: every/example, fail
+  query: data.test.p = x
+  want_result: []
+- data:
+  input:
+    containers:
+    - image: acmecorp.com/bitcoin-miner
+    - image: acmecorp.com/webapp
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      every x in input.containers {
+        startswith(x.image, "acmecorp.com/")
+      }
+    }
+  note: every/example, success
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  input:
+    containers:
+    - image: acmecorp.com/bitcoin-miner
+    - image: acmecorp.com/webapp
+    init_containers:
+    - image: acmecorp.com/bitcoin-miner
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      containers := { c | c := input.containers[_] }
+      init_containers := { c | c := input.init_containers[_] }
+      every x in containers | init_containers {
+        startswith(x.image, "acmecorp.com/")
+      }
+    }
+  note: every/example with two sets
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  input:
+    containers:
+    - image: acmecorp.com/bitcoin-miner
+    - image: acmecorp.com/webapp
+    init_containers:
+    - image: bitcoin-miner
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    p {
+      containers := { c | c := input.containers[_] }
+      init_containers := { c | c := input.init_containers[_] }
+      every x in containers | init_containers {
+        startswith(x.image, "acmecorp.com/")
+      }
+    }
+  note: every/example with two sets (fail)
+  query: data.test.p = x
+  want_result: []
+- data:
+  input:
+    containers:
+    - image: hooli.com/bitcoin-miner
+    - image: acmecorp.net/webapp
+    - image: nginx
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    allowed_repos := {"hooli.com/", "acmecorp.net/"}
+
+    p {
+      every c in input.containers {
+        some repo in allowed_repos
+        startswith(c.image, repo)
+      }
+    }
+  note: every/example every/some, fail
+  query: data.test.p = x
+  want_result: []
+- data:
+  input:
+    containers:
+    - image: hooli.com/bitcoin-miner
+    - image: acmecorp.net/webapp
+    - image: hooli.com/nginx
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    allowed_repos := {"hooli.com/", "acmecorp.net/"}
+
+    p {
+      every c in input.containers {
+        some repo in allowed_repos
+        startswith(c.image, repo)
+      }
+    }
+  note: every/example every/some, success
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  input:
+    servers:
+    - ports: [80, 443]
+    - ports: [80]
+  modules:
+  - |
+    package test
+    import future.keywords.every
+
+    deny {
+      some s in input.servers
+      every port in s.ports {
+        port != 443
+      }
+    }
+  note: every/example some/every
+  query: data.test.deny = x
+  want_result:
+  - x: true
diff --git a/test/cases/testdata/functionerrors/test-conflicts.yaml b/test/cases/testdata/functionerrors/test-conflicts.yaml
new file mode 100644
index 0000000000..ddd29d18ca
--- /dev/null
+++ b/test/cases/testdata/functionerrors/test-conflicts.yaml
@@ -0,0 +1,21 @@
+cases:
+- modules:
+  - |
+    package test
+    o = ["1", "2"]
+    f(x) := o[_] == x
+    p { f("1") }
+  note: 'functionerrors/conflict: plain false and true result, first round'
+  query: data.test.p = x
+  want_error: functions must not produce multiple outputs for same inputs
+  want_error_code: eval_conflict_error
+- modules:
+  - |
+    package test
+    o = ["1", "2"]
+    f(x) := o[_] == x
+    p { f("2") }
+  note: 'functionerrors/conflict: plain false and true result, second round'
+  query: data.test.p = x
+  want_error: functions must not produce multiple outputs for same inputs
+  want_error_code: eval_conflict_error
diff --git a/test/cases/testdata/functions/test-functions-0991.yaml b/test/cases/testdata/functions/test-functions-0991.yaml
index 7f70284615..5cc89e6589 100644
--- a/test/cases/testdata/functions/test-functions-0991.yaml
+++ b/test/cases/testdata/functions/test-functions-0991.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-0992.yaml b/test/cases/testdata/functions/test-functions-0992.yaml
index ace17c6a70..1df1fb8f47 100644
--- a/test/cases/testdata/functions/test-functions-0992.yaml
+++ b/test/cases/testdata/functions/test-functions-0992.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package topdown_test_partial
diff --git a/test/cases/testdata/functions/test-functions-0993.yaml b/test/cases/testdata/functions/test-functions-0993.yaml
index 459ea5918d..437bc961ee 100644
--- a/test/cases/testdata/functions/test-functions-0993.yaml
+++ b/test/cases/testdata/functions/test-functions-0993.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package topdown_test_partial
diff --git a/test/cases/testdata/functions/test-functions-0994.yaml b/test/cases/testdata/functions/test-functions-0994.yaml
index 8f9edb17bc..c05cc7d7fe 100644
--- a/test/cases/testdata/functions/test-functions-0994.yaml
+++ b/test/cases/testdata/functions/test-functions-0994.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package topdown_test_partial
diff --git a/test/cases/testdata/functions/test-functions-0995.yaml b/test/cases/testdata/functions/test-functions-0995.yaml
index 09b87a12f3..2d1e91a0b8 100644
--- a/test/cases/testdata/functions/test-functions-0995.yaml
+++ b/test/cases/testdata/functions/test-functions-0995.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.l1.l2
diff --git a/test/cases/testdata/functions/test-functions-0996.yaml b/test/cases/testdata/functions/test-functions-0996.yaml
index cf37347c55..d1c229588b 100644
--- a/test/cases/testdata/functions/test-functions-0996.yaml
+++ b/test/cases/testdata/functions/test-functions-0996.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-0997.yaml b/test/cases/testdata/functions/test-functions-0997.yaml
index 69c0632a22..01c698223b 100644
--- a/test/cases/testdata/functions/test-functions-0997.yaml
+++ b/test/cases/testdata/functions/test-functions-0997.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-0998.yaml b/test/cases/testdata/functions/test-functions-0998.yaml
index ca1085d5b6..e85bbbca53 100644
--- a/test/cases/testdata/functions/test-functions-0998.yaml
+++ b/test/cases/testdata/functions/test-functions-0998.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.l1.l3
diff --git a/test/cases/testdata/functions/test-functions-0999.yaml b/test/cases/testdata/functions/test-functions-0999.yaml
index d3a348e8c3..b04fc31a41 100644
--- a/test/cases/testdata/functions/test-functions-0999.yaml
+++ b/test/cases/testdata/functions/test-functions-0999.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-1000.yaml b/test/cases/testdata/functions/test-functions-1000.yaml
index de8302695f..3ebae964a7 100644
--- a/test/cases/testdata/functions/test-functions-1000.yaml
+++ b/test/cases/testdata/functions/test-functions-1000.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package topdown_test_partial
diff --git a/test/cases/testdata/functions/test-functions-1001.yaml b/test/cases/testdata/functions/test-functions-1001.yaml
index 4ef75a2f23..166e070a79 100644
--- a/test/cases/testdata/functions/test-functions-1001.yaml
+++ b/test/cases/testdata/functions/test-functions-1001.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-1002.yaml b/test/cases/testdata/functions/test-functions-1002.yaml
index 23759702fe..76395cbc9a 100644
--- a/test/cases/testdata/functions/test-functions-1002.yaml
+++ b/test/cases/testdata/functions/test-functions-1002.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
diff --git a/test/cases/testdata/functions/test-functions-1003.yaml b/test/cases/testdata/functions/test-functions-1003.yaml
index 7401db479b..1498b6bbd8 100644
--- a/test/cases/testdata/functions/test-functions-1003.yaml
+++ b/test/cases/testdata/functions/test-functions-1003.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.l1.l2
diff --git a/test/cases/testdata/functions/test-functions-1004.yaml b/test/cases/testdata/functions/test-functions-1004.yaml
index 709f6627d4..8340e988a9 100644
--- a/test/cases/testdata/functions/test-functions-1004.yaml
+++ b/test/cases/testdata/functions/test-functions-1004.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.omit_result
diff --git a/test/cases/testdata/functions/test-functions-1005.yaml b/test/cases/testdata/functions/test-functions-1005.yaml
index ffa1e34245..959573ba13 100644
--- a/test/cases/testdata/functions/test-functions-1005.yaml
+++ b/test/cases/testdata/functions/test-functions-1005.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.l1.l3
diff --git a/test/cases/testdata/functions/test-functions-1006.yaml b/test/cases/testdata/functions/test-functions-1006.yaml
index 866a72e6da..01a302bb7d 100644
--- a/test/cases/testdata/functions/test-functions-1006.yaml
+++ b/test/cases/testdata/functions/test-functions-1006.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.omit_result
diff --git a/test/cases/testdata/functions/test-functions-1007.yaml b/test/cases/testdata/functions/test-functions-1007.yaml
index 6753d2df4d..dcb32c3e70 100644
--- a/test/cases/testdata/functions/test-functions-1007.yaml
+++ b/test/cases/testdata/functions/test-functions-1007.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
diff --git a/test/cases/testdata/functions/test-functions-1008.yaml b/test/cases/testdata/functions/test-functions-1008.yaml
index 12db1ae57f..3bf0bf4aa3 100644
--- a/test/cases/testdata/functions/test-functions-1008.yaml
+++ b/test/cases/testdata/functions/test-functions-1008.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.omit_result
diff --git a/test/cases/testdata/functions/test-functions-1009.yaml b/test/cases/testdata/functions/test-functions-1009.yaml
index cc3f9d1216..649c22195c 100644
--- a/test/cases/testdata/functions/test-functions-1009.yaml
+++ b/test/cases/testdata/functions/test-functions-1009.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-1010.yaml b/test/cases/testdata/functions/test-functions-1010.yaml
index 1cb3602953..ea3693e381 100644
--- a/test/cases/testdata/functions/test-functions-1010.yaml
+++ b/test/cases/testdata/functions/test-functions-1010.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/functions/test-functions-1011.yaml b/test/cases/testdata/functions/test-functions-1011.yaml
index dc612eded1..756e4d5295 100644
--- a/test/cases/testdata/functions/test-functions-1011.yaml
+++ b/test/cases/testdata/functions/test-functions-1011.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test
diff --git a/test/cases/testdata/globmatch/test-globmatch-0133.yaml b/test/cases/testdata/globmatch/test-globmatch-0133.yaml
index fdea2ef961..37a276c8c3 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0133.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0133.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0134.yaml b/test/cases/testdata/globmatch/test-globmatch-0134.yaml
index 2e040509fc..ff08e31175 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0134.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0134.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0135.yaml b/test/cases/testdata/globmatch/test-globmatch-0135.yaml
index 30c43c5e0d..cc0b3824c8 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0135.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0135.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0136.yaml b/test/cases/testdata/globmatch/test-globmatch-0136.yaml
index e27442f075..c64f14e287 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0136.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0136.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0137.yaml b/test/cases/testdata/globmatch/test-globmatch-0137.yaml
index bee4df9e61..25edda8bd4 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0137.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0137.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0138.yaml b/test/cases/testdata/globmatch/test-globmatch-0138.yaml
index 5d86824686..2014bd4b7a 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0138.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0138.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0139.yaml b/test/cases/testdata/globmatch/test-globmatch-0139.yaml
index 71f8486bf5..bdfb2dd52a 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0139.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0139.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0140.yaml b/test/cases/testdata/globmatch/test-globmatch-0140.yaml
index 3fab621e1b..8fe4cc58d3 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0140.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0140.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0141.yaml b/test/cases/testdata/globmatch/test-globmatch-0141.yaml
index 656003cab3..0ccc69df88 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0141.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0141.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0142.yaml b/test/cases/testdata/globmatch/test-globmatch-0142.yaml
index acbb2c4004..df9622bd42 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0142.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0142.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0143.yaml b/test/cases/testdata/globmatch/test-globmatch-0143.yaml
index aa81eb6d43..53f4733ad5 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0143.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0143.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0144.yaml b/test/cases/testdata/globmatch/test-globmatch-0144.yaml
index 07017a87de..67605603cc 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0144.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0144.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0145.yaml b/test/cases/testdata/globmatch/test-globmatch-0145.yaml
index 794139bb1f..a0c7bee6fd 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0145.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0145.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0146.yaml b/test/cases/testdata/globmatch/test-globmatch-0146.yaml
index 23ce9a0cee..af9c313ac2 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0146.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0146.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0147.yaml b/test/cases/testdata/globmatch/test-globmatch-0147.yaml
index bddf51dd0f..67b264dc0f 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0147.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0147.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0148.yaml b/test/cases/testdata/globmatch/test-globmatch-0148.yaml
index a088acb487..29f5debf8b 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0148.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0148.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0149.yaml b/test/cases/testdata/globmatch/test-globmatch-0149.yaml
index f188942425..ed41d844f5 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0149.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0149.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0150.yaml b/test/cases/testdata/globmatch/test-globmatch-0150.yaml
index d28f7887f8..ce9f2a64ed 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0150.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0150.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0151.yaml b/test/cases/testdata/globmatch/test-globmatch-0151.yaml
index 6bd5a29019..9ca2340ff6 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0151.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0151.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0152.yaml b/test/cases/testdata/globmatch/test-globmatch-0152.yaml
index b312a699fc..94a4a29817 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0152.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0152.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0153.yaml b/test/cases/testdata/globmatch/test-globmatch-0153.yaml
index 3f328dd591..a4a38a5ea6 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0153.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0153.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0154.yaml b/test/cases/testdata/globmatch/test-globmatch-0154.yaml
index 9f9ae7a17e..a6868a4d75 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0154.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0154.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0155.yaml b/test/cases/testdata/globmatch/test-globmatch-0155.yaml
index c2263d790c..698a6f2f08 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0155.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0155.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0156.yaml b/test/cases/testdata/globmatch/test-globmatch-0156.yaml
index 6be1a514b0..8fb9a00019 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0156.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0156.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0157.yaml b/test/cases/testdata/globmatch/test-globmatch-0157.yaml
index 7cf68ecea5..4f2c0eee57 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0157.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0157.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0158.yaml b/test/cases/testdata/globmatch/test-globmatch-0158.yaml
index d55f40a5fb..fb03de5891 100644
--- a/test/cases/testdata/globmatch/test-globmatch-0158.yaml
+++ b/test/cases/testdata/globmatch/test-globmatch-0158.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globmatch/test-globmatch-0159.yaml b/test/cases/testdata/globmatch/test-globmatch-0159.yaml
new file mode 100644
index 0000000000..f69746b37b
--- /dev/null
+++ b/test/cases/testdata/globmatch/test-globmatch-0159.yaml
@@ -0,0 +1,29 @@
+cases:
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p[x] {
+      glob.match("*", null, "foo.bar", x)
+    }
+  note: globmatch/glob match single without default delimiter
+  query: data.generated.p = x
+  sort_bindings: true
+  want_result:
+  - x:
+    - true
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p[x] {
+      glob.match("foo*", null, "foo.bar", x)
+    }
+  note: globmatch/glob match single without default delimiter, glob non-empty
+  query: data.generated.p = x
+  sort_bindings: true
+  want_result:
+  - x:
+    - true
\ No newline at end of file
diff --git a/test/cases/testdata/globmatch/test-globmatch-issue-5273.yaml b/test/cases/testdata/globmatch/test-globmatch-issue-5273.yaml
new file mode 100644
index 0000000000..415103e2d8
--- /dev/null
+++ b/test/cases/testdata/globmatch/test-globmatch-issue-5273.yaml
@@ -0,0 +1,15 @@
+cases:
+- modules:
+  - |
+    package test
+
+    p[x] {
+      glob.match("*.github.com", ["."], "api.github.com", x)
+      glob.match("*.github.com", ["."], "api.github.com", x)
+    }
+  # See: https://github.com/open-policy-agent/opa/issues/5273
+  note: globmatch/no deadlocks for glob match
+  query: data.test.p = x
+  want_result:
+  - x:
+    - true
diff --git a/test/cases/testdata/globmatch/test-globmatch-issue-5283.yaml b/test/cases/testdata/globmatch/test-globmatch-issue-5283.yaml
new file mode 100644
index 0000000000..4c2c0a106c
--- /dev/null
+++ b/test/cases/testdata/globmatch/test-globmatch-issue-5283.yaml
@@ -0,0 +1,24 @@
+# See https://github.com/open-policy-agent/opa/issues/528
+cases:
+- modules:
+  - |
+    package test
+    p = x {
+      x := glob.match("*.github.com", ["."], input)
+    }
+  input: api.example.com
+  note: globmatch/captured negative results, variable
+  query: data.test.p = x
+  want_result:
+  - x: false
+- modules:
+  - |
+    package test
+    p {
+      glob.match("*.github.com", ["."], input, false)
+    }
+  input: api.example.com
+  note: globmatch/captured negative result, constant
+  query: data.test.p = x
+  want_result:
+  - x: true
\ No newline at end of file
diff --git a/test/cases/testdata/globquotemeta/test-globquotemeta-0159.yaml b/test/cases/testdata/globquotemeta/test-globquotemeta-0159.yaml
index 84f9f5c20d..d9a718d4fd 100644
--- a/test/cases/testdata/globquotemeta/test-globquotemeta-0159.yaml
+++ b/test/cases/testdata/globquotemeta/test-globquotemeta-0159.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globsmatch/test-globsmatch-0865.yaml b/test/cases/testdata/globsmatch/test-globsmatch-0865.yaml
index 03a204bb99..763d876509 100644
--- a/test/cases/testdata/globsmatch/test-globsmatch-0865.yaml
+++ b/test/cases/testdata/globsmatch/test-globsmatch-0865.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globsmatch/test-globsmatch-0866.yaml b/test/cases/testdata/globsmatch/test-globsmatch-0866.yaml
index ec061d2091..934b458054 100644
--- a/test/cases/testdata/globsmatch/test-globsmatch-0866.yaml
+++ b/test/cases/testdata/globsmatch/test-globsmatch-0866.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globsmatch/test-globsmatch-0868.yaml b/test/cases/testdata/globsmatch/test-globsmatch-0868.yaml
index b0f093445a..7964074e28 100644
--- a/test/cases/testdata/globsmatch/test-globsmatch-0868.yaml
+++ b/test/cases/testdata/globsmatch/test-globsmatch-0868.yaml
@@ -1,87 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globsmatch/test-globsmatch-0869.yaml b/test/cases/testdata/globsmatch/test-globsmatch-0869.yaml
index 586befe63b..14156e1464 100644
--- a/test/cases/testdata/globsmatch/test-globsmatch-0869.yaml
+++ b/test/cases/testdata/globsmatch/test-globsmatch-0869.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/globsmatch/test-globsmatch-0870.yaml b/test/cases/testdata/globsmatch/test-globsmatch-0870.yaml
index 412f4764be..5d0daceae1 100644
--- a/test/cases/testdata/globsmatch/test-globsmatch-0870.yaml
+++ b/test/cases/testdata/globsmatch/test-globsmatch-0870.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/graphql/test-graphql-basic-ast.yaml b/test/cases/testdata/graphql/test-graphql-basic-ast.yaml
new file mode 100644
index 0000000000..3b6655a6a9
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-basic-ast.yaml
@@ -0,0 +1,307 @@
+# These unit tests check that we get JSON AST structures with
+# expected structure and content. If these ever break, policies
+# depending on the GraphQL ASTs will too!
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        ast := {
+          "Operations": [
+            {
+              "Name": "",
+              "Operation": "query",
+              "SelectionSet": [
+                {
+                  "Alias": "hero",
+                  "Name": "hero",
+                  "SelectionSet": [
+                    {
+                      "Alias": "name",
+                      "Name": "name"
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+        p {
+          graphql.parse_query("{hero {name}}") == ast
+        }
+    note: graphql_parse_query/success-basic-ast simple query
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `query hero ($episode: Episode!) {
+            hero (episode: $episode) {
+                id
+                name
+                friends {
+                    id
+                    name
+                    friends {
+                        id
+                        name
+                        appearsIn
+                    }
+                    appearsIn
+                }
+                appearsIn
+            }
+        }`
+        ast := {
+          "Operations": [
+            {
+              "Name": "hero",
+              "Operation": "query",
+              "SelectionSet": [
+                {
+                  "Alias": "hero",
+                  "Arguments": [
+                    {
+                      "Name": "episode",
+                      "Value": {
+                        "Kind": 0,
+                        "Raw": "episode"
+                      }
+                    }
+                  ],
+                  "Name": "hero",
+                  "SelectionSet": [
+                    {
+                      "Alias": "id",
+                      "Name": "id"
+                    },
+                    {
+                      "Alias": "name",
+                      "Name": "name"
+                    },
+                    {
+                      "Alias": "friends",
+                      "Name": "friends",
+                      "SelectionSet": [
+                        {
+                          "Alias": "id",
+                          "Name": "id"
+                        },
+                        {
+                          "Alias": "name",
+                          "Name": "name"
+                        },
+                        {
+                          "Alias": "friends",
+                          "Name": "friends",
+                          "SelectionSet": [
+                            {
+                              "Alias": "id",
+                              "Name": "id"
+                            },
+                            {
+                              "Alias": "name",
+                              "Name": "name"
+                            },
+                            {
+                              "Alias": "appearsIn",
+                              "Name": "appearsIn"
+                            }
+                          ]
+                        },
+                        {
+                          "Alias": "appearsIn",
+                          "Name": "appearsIn"
+                        }
+                      ]
+                    },
+                    {
+                      "Alias": "appearsIn",
+                      "Name": "appearsIn"
+                    }
+                  ]
+                }
+              ],
+              "VariableDefinitions": [
+                {
+                  "Type": {
+                    "NamedType": "Episode",
+                    "NonNull": true
+                  },
+                  "Used": false,
+                  "Variable": "episode"
+                }
+              ]
+            }
+          ]
+        }
+        p {
+          graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-basic-ast with arguments
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `query HeroForEpisode($ep: Episode!) {
+          hero(episode: $ep) {
+            name
+            ... on Droid {
+              primaryFunction
+            }
+            ... on Human {
+              height
+            }
+          }
+        }`
+        ast := {
+          "Operations": [
+            {
+              "Name": "HeroForEpisode",
+              "Operation": "query",
+              "SelectionSet": [
+                {
+                  "Alias": "hero",
+                  "Arguments": [
+                    {
+                      "Name": "episode",
+                      "Value": {
+                        "Kind": 0,
+                        "Raw": "ep"
+                      }
+                    }
+                  ],
+                  "Name": "hero",
+                  "SelectionSet": [
+                    {
+                      "Alias": "name",
+                      "Name": "name"
+                    },
+                    {
+                      "SelectionSet": [
+                        {
+                          "Alias": "primaryFunction",
+                          "Name": "primaryFunction"
+                        }
+                      ],
+                      "TypeCondition": "Droid"
+                    },
+                    {
+                      "SelectionSet": [
+                        {
+                          "Alias": "height",
+                          "Name": "height"
+                        }
+                      ],
+                      "TypeCondition": "Human"
+                    }
+                  ]
+                }
+              ],
+              "VariableDefinitions": [
+                {
+                  "Type": {
+                    "NamedType": "Episode",
+                    "NonNull": true
+                  },
+                  "Used": false,
+                  "Variable": "ep"
+                }
+              ]
+            }
+          ]
+        }
+        p {
+          graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-basic-ast inline fragments and type conditions
+    query: data.test.p = x
+    want_result:
+      - x: true
+  # Inline fragments
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{
+          search(text: "an") {
+            __typename
+            ... on Human {
+              name
+            }
+            ... on Droid {
+              name
+            }
+            ... on Starship {
+              name
+            }
+          }
+        }`
+        ast := {
+          "Operations": [
+            {
+              "Name": "",
+              "Operation": "query",
+              "SelectionSet": [
+                {
+                  "Alias": "search",
+                  "Arguments": [
+                    {
+                      "Name": "text",
+                      "Value": {
+                        "Kind": 3,
+                        "Raw": "an"
+                      }
+                    }
+                  ],
+                  "Name": "search",
+                  "SelectionSet": [
+                    {
+                      "Alias": "__typename",
+                      "Name": "__typename"
+                    },
+                    {
+                      "SelectionSet": [
+                        {
+                          "Alias": "name",
+                          "Name": "name"
+                        }
+                      ],
+                      "TypeCondition": "Human"
+                    },
+                    {
+                      "SelectionSet": [
+                        {
+                          "Alias": "name",
+                          "Name": "name"
+                        }
+                      ],
+                      "TypeCondition": "Droid"
+                    },
+                    {
+                      "SelectionSet": [
+                        {
+                          "Alias": "name",
+                          "Name": "name"
+                        }
+                      ],
+                      "TypeCondition": "Starship"
+                    }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+        p {
+          graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-basic-ast meta fields and introspection
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/graphql/test-graphql-is-valid.yaml b/test/cases/testdata/graphql/test-graphql-is-valid.yaml
new file mode 100644
index 0000000000..7ec2f7d1ef
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-is-valid.yaml
@@ -0,0 +1,175 @@
+# This suite of tests is adapted from the underlying GraphQL parser library's
+# own test suite, as it provides a fairly comprehensive set of good/degenerate
+# test cases, which we want to make sure to react correctly to.
+# See: https://github.com/vektah/gqlparser/blob/master/validator/validator_test.yml
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type User {
+              id: ID!
+          }
+          extend type Product {
+              upc: String!
+          }
+          union _Entity = Product | User
+          extend type Query {
+            entity: _Entity
+          }
+        `
+        query := `
+          {
+            entity {
+              ... on User {
+              id
+              }
+            }
+          }
+        `
+        p {
+            graphql.is_valid(query, schema)
+        }
+    note: graphql_is_valid/success extending non-existent types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        query := `
+          query SomeOperation {
+            # Note: Not providing mandatory parameter: (myEnum: Locale!)
+            myAction {
+              id
+            }
+          }
+        `
+        # We use the unification style from semver's is_valid tests here:
+        p = x {
+            x = graphql.is_valid(query, schema)
+        }
+    note: graphql_is_valid/success validation rules are independent case 1
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        query := `
+          # Note: there is default enum value in variables
+          query SomeOperation ($locale: Locale! = DE) {
+            myAction(myEnum: $locale) {
+              id
+            }
+          }
+        `
+        p {
+            graphql.is_valid(query, schema)
+        }
+    note: graphql_is_valid/success validation rules are independent case 2
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type DeprecatedType {
+            deprecatedField: String @deprecated
+            newField(deprecatedArg: Int): Boolean
+          }
+          enum DeprecatedEnum {
+            ALPHA @deprecated
+          }
+        `
+        query := ``
+        p {
+            graphql.is_valid(query, schema)
+        }
+    note: graphql_is_valid/success deprecating types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Query {
+            bar: String!
+          }
+        `
+        query := `
+          query Foo($flag: Boolean!) {
+            ...Bar
+          }
+          fragment Bar on Query {
+            bar @include(if: $flag)
+          }
+        `
+        p {
+            graphql.is_valid(query, schema)
+        }
+    note: graphql_is_valid/success no unused variables
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema_ast := graphql.parse_schema(`
+          type Employee {
+            id: String!
+            salary: Int!
+          }
+
+          schema {
+            query: Query
+          }
+
+          type Query {
+            employeeByID(id: String): Employee
+          }
+        `)
+        query_ast := graphql.parse_query(`
+          query { employeeByID(id: "alice") { salary }}
+        `)
+        p {
+            graphql.is_valid(query_ast, schema_ast)
+        }
+    note: graphql_is_valid/success - AST objects - Employee example
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/graphql/test-graphql-parse-and-verify.yaml b/test/cases/testdata/graphql/test-graphql-parse-and-verify.yaml
new file mode 100644
index 0000000000..b1fcba4e21
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-parse-and-verify.yaml
@@ -0,0 +1,183 @@
+# This suite of tests is adapted from the underlying GraphQL parser library's
+# own test suite, as it provides a fairly comprehensive set of good/degenerate
+# test cases, which we want to make sure to react correctly to.
+# See: https://github.com/vektah/gqlparser/blob/master/validator/validator_test.yml
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type User {
+              id: ID!
+          }
+          extend type Product {
+              upc: String!
+          }
+          union _Entity = Product | User
+          extend type Query {
+            entity: _Entity
+          }
+        `
+        query := `
+          {
+            entity {
+              ... on User {
+              id
+              }
+            }
+          }
+        `
+        q_ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "entity", "Name": "entity", "SelectionSet": [{"SelectionSet": [{"Alias": "id", "Name": "id"}], "TypeCondition": "User"}]}]}]}
+        p {
+            [valid, q_ast, _] = graphql.parse_and_verify(query, schema)
+            valid
+        }
+    note: graphql_parse_and_verify/success extending non-existent types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        query := `
+          query SomeOperation {
+            # Note: Not providing mandatory parameter: (myEnum: Locale!)
+            myAction {
+              id
+            }
+          }
+        `
+        p {
+            [valid, q_ast, _] = graphql.parse_and_verify(query, schema)
+            not valid
+        }
+    note: graphql_parse_and_verify/success validation rules are independent case 1
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        query := `
+          # Note: there is default enum value in variables
+          query SomeOperation ($locale: Locale! = DE) {
+            myAction(myEnum: $locale) {
+              id
+            }
+          }
+        `
+        q_ast := {"Operations": [{"Name": "SomeOperation", "Operation": "query", "SelectionSet": [{"Alias": "myAction", "Arguments": [{"Name": "myEnum", "Value": {"Kind": 0, "Raw": "locale"}}], "Name": "myAction", "SelectionSet": [{"Alias": "id", "Name": "id"}]}], "VariableDefinitions": [{"DefaultValue": {"Kind": 7, "Raw": "DE"}, "Type": {"NamedType": "Locale", "NonNull": true}, "Used": false, "Variable": "locale"}]}]}
+        p {
+            [valid, q_ast, _] = graphql.parse_and_verify(query, schema)
+            valid
+        }
+    note: graphql_parse_and_verify/success validation rules are independent case 2
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type DeprecatedType {
+            deprecatedField: String @deprecated
+            newField(deprecatedArg: Int): Boolean
+          }
+          enum DeprecatedEnum {
+            ALPHA @deprecated
+          }
+        `
+        query := ``
+        p {
+            [valid, {}, _] = graphql.parse_and_verify(query, schema)
+            valid
+        }
+    note: graphql_parse_and_verify/success deprecating types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Query {
+            bar: String!
+          }
+        `
+        query := `
+          query Foo($flag: Boolean!) {
+            ...Bar
+          }
+          fragment Bar on Query {
+            bar @include(if: $flag)
+          }
+        `
+        q_ast := {"Fragments": [{"Name": "Bar", "SelectionSet": [{"Alias": "bar", "Directives": [{"Arguments": [{"Name": "if", "Value": {"Kind": 0, "Raw": "flag"}}], "Location": "", "Name": "include"}], "Name": "bar"}], "TypeCondition": "Query"}], "Operations": [{"Name": "Foo", "Operation": "query", "SelectionSet": [{"Name": "Bar"}], "VariableDefinitions": [{"Type": {"NamedType": "Boolean", "NonNull": true}, "Used": false, "Variable": "flag"}]}]}
+        p {
+            [valid, q_ast, _] = graphql.parse_and_verify(query, schema)
+            valid
+        }
+    note: graphql_parse_and_verify/success no unused variables
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema_ast := graphql.parse_schema(`
+          type Employee {
+            id: String!
+            salary: Int!
+          }
+
+          schema {
+            query: Query
+          }
+
+          type Query {
+            employeeByID(id: String): Employee
+          }
+        `)
+        query_ast := graphql.parse_query(`
+          query { employeeByID(id: "alice") { salary }}
+        `)
+        p {
+            [valid, query_ast, schema_ast] = graphql.parse_and_verify(query_ast, schema_ast)
+            valid
+        }
+    note: graphql_parse_and_verify/success - AST objects - Employee example
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/graphql/test-graphql-parse-query.yaml b/test/cases/testdata/graphql/test-graphql-parse-query.yaml
new file mode 100644
index 0000000000..62a4b5510f
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-parse-query.yaml
@@ -0,0 +1,478 @@
+# This suite of tests is adapted from the underlying GraphQL parser library's
+# own test suite, as it provides a fairly comprehensive set of good/degenerate
+# test cases, which we want to make sure to react correctly to.
+# See: https://github.com/vektah/gqlparser/blob/master/parser/query_test.yml
+cases:
+# parser provides useful errors:
+  - data:
+    modules:
+      - |
+        package test
+        p {
+            graphql.parse_query(`{`)
+        }
+    note: graphql_parse_query/failure-unclosed paren
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Expected Name, found <EOF> in GraphQL string at location 1:2'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          { ...MissingOn }
+          fragment MissingOn Type
+        `
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-missing on in fragment
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Expected "on", found Name "Type" in GraphQL string at location 3:22'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{ field: {} }`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-missing name after alias
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Expected Name, found { in GraphQL string at location 1:10'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `notanoperation Foo { field }`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-not an operation
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Unexpected Name "notanoperation" in GraphQL string at location 1:1'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `...`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-a wild splat appears
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Unexpected ... in GraphQL string at location 1:1'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# variables:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{ field(complex: { a: { b: [ $var ] } }) }`
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "field", "Arguments": [{"Name": "complex", "Value": {"Children": [{"Name": "a", "Value": {"Children": [{"Name": "b", "Value": {"Children": [{"Name": "", "Value": {"Kind": 0, "Raw": "var"}}], "Kind": 8, "Raw": ""}}], "Kind": 9, "Raw": ""}}], "Kind": 9, "Raw": ""}}], "Name": "field"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-variables are allowed in args
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `query Foo($x: Complex = { a: { b: [ $var ] } }) { field }`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-variables are not allowed in default args
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Unexpected $ in GraphQL string at location 1:37'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `query ($withDirective: String @first @second, $withoutDirective: String) { f }`
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "f", "Name": "f"}], "VariableDefinitions": [{"Directives": [{"Location": "", "Name": "first"}, {"Location": "", "Name": "second"}], "Type": {"NamedType": "String", "NonNull": false}, "Used": false, "Variable": "withDirective"}, {"Type": {"NamedType": "String", "NonNull": false}, "Used": false, "Variable": "withoutDirective"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-variables can have directives
+    query: data.test.p = x
+    want_result:
+      - x: true
+# fragments:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `fragment on on on { on }`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-fragment can not be named 'on'
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Unexpected Name "on" in GraphQL string at location 1:10'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{ ...on }`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-fragment can not spread fragments called 'on'
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Expected Name, found } in GraphQL string at location 1:9'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# encoding:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          # This comment has a ਊ multi-byte character.
+          { field(arg: "Has a ਊ multi-byte character.") }
+        `
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "field", "Arguments": [{"Name": "arg", "Value": {"Kind": 3, "Raw": "Has a ਊ multi-byte character."}}], "Name": "field"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-encoding multibyte characters are supported
+    query: data.test.p = x
+    want_result:
+      - x: true
+# keywords are allowed anywhere a name is:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          query on {
+            ... a
+            ... on on { field }
+          }
+          fragment a on Type {
+            on(on: $on)
+              @on(on: on)
+          }
+        `
+        ast := {"Fragments": [{"Name": "a", "SelectionSet": [{"Alias": "on", "Arguments": [{"Name": "on", "Value": {"Kind": 0, "Raw": "on"}}], "Directives": [{"Arguments": [{"Name": "on", "Value": {"Kind": 7, "Raw": "on"}}], "Location": "", "Name": "on"}], "Name": "on"}], "TypeCondition": "Type"}], "Operations": [{"Name": "on", "Operation": "query", "SelectionSet": [{"Name": "a"}, {"SelectionSet": [{"Alias": "field", "Name": "field"}], "TypeCondition": "on"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-keywords-allowed-where-names-are on
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          query subscription {
+            ... subscription
+            ... on subscription { field }
+          }
+          fragment subscription on Type {
+            subscription(subscription: $subscription)
+              @subscription(subscription: subscription)
+          }
+        `
+        ast := {"Fragments": [{"Name": "subscription", "SelectionSet": [{"Alias": "subscription", "Arguments": [{"Name": "subscription", "Value": {"Kind": 0, "Raw": "subscription"}}], "Directives": [{"Arguments": [{"Name": "subscription", "Value": {"Kind": 7, "Raw": "subscription"}}], "Location": "", "Name": "subscription"}], "Name": "subscription"}], "TypeCondition": "Type"}], "Operations": [{"Name": "subscription", "Operation": "query", "SelectionSet": [{"Name": "subscription"}, {"SelectionSet": [{"Alias": "field", "Name": "field"}], "TypeCondition": "subscription"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-keywords-allowed-where-names-are subscription
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          query true {
+            ... true
+            ... on true { field }
+          }
+          fragment true on Type {
+            true(true: $true)
+              @true(true: true)
+          }
+        `
+        ast := {"Fragments": [{"Name": "true", "SelectionSet": [{"Alias": "true", "Arguments": [{"Name": "true", "Value": {"Kind": 0, "Raw": "true"}}], "Directives": [{"Arguments": [{"Name": "true", "Value": {"Kind": 5, "Raw": "true"}}], "Location": "", "Name": "true"}], "Name": "true"}], "TypeCondition": "Type"}], "Operations": [{"Name": "true", "Operation": "query", "SelectionSet": [{"Name": "true"}, {"SelectionSet": [{"Alias": "field", "Name": "field"}], "TypeCondition": "true"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-keywords-allowed-where-names-are true
+    query: data.test.p = x
+    want_result:
+      - x: true
+# operations:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `mutation { mutationField }`
+        ast := {"Operations": [{"Name": "", "Operation": "mutation", "SelectionSet": [{"Alias": "mutationField", "Name": "mutationField"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-operations anonymous mutation
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `mutation Foo { mutationField }`
+        ast := {"Operations": [{"Name": "Foo", "Operation": "mutation", "SelectionSet": [{"Alias": "mutationField", "Name": "mutationField"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-operations named mutation
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `subscription { subscriptionField }`
+        ast := {"Operations": [{"Name": "", "Operation": "subscription", "SelectionSet": [{"Alias": "subscriptionField", "Name": "subscriptionField"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-operations anonymous subscription
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `subscription Foo { subscriptionField }`
+        ast := {"Operations": [{"Name": "Foo", "Operation": "subscription", "SelectionSet": [{"Alias": "subscriptionField", "Name": "subscriptionField"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-operations named subscription
+    query: data.test.p = x
+    want_result:
+      - x: true
+# ast:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          {
+            node(id: 4) {
+              id,
+              name
+            }
+          }
+        `
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "node", "Arguments": [{"Name": "id", "Value": {"Kind": 1, "Raw": "4"}}], "Name": "node", "SelectionSet": [{"Alias": "id", "Name": "id"}, {"Alias": "name", "Name": "name"}]}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-ast simple query
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          query {
+            node {
+              id
+            }
+          }
+        `
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "node", "Name": "node", "SelectionSet": [{"Alias": "id", "Name": "id"}]}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-ast nameless query with no variables
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `fragment a($v: Boolean = false) on t { f(v: $v) }`
+        ast := {"Fragments": [{"Name": "a", "SelectionSet": [{"Alias": "f", "Arguments": [{"Name": "v", "Value": {"Kind": 0, "Raw": "v"}}], "Name": "f"}], "TypeCondition": "t", "VariableDefinition": [{"DefaultValue": {"Kind": 5, "Raw": "false"}, "Type": {"NamedType": "Boolean", "NonNull": false}, "Used": false, "Variable": "v"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-ast fragment defined variables
+    query: data.test.p = x
+    want_result:
+      - x: true
+# values:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{ f(id: null) }`
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "f", "Arguments": [{"Name": "id", "Value": {"Kind": 6, "Raw": "null"}}], "Name": "f"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-values null
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{ f(long: """long""", short: "short") }`
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "f", "Arguments": [{"Name": "long", "Value": {"Kind": 4, "Raw": "long"}}, {"Name": "short", "Value": {"Kind": 3, "Raw": "short"}}], "Name": "f"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-values strings
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{ f(id: [1,2]) }`
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "f", "Arguments": [{"Name": "id", "Value": {"Children": [{"Name": "", "Value": {"Kind": 1, "Raw": "1"}}, {"Name": "", "Value": {"Kind": 1, "Raw": "2"}}], "Kind": 8, "Raw": ""}}], "Name": "f"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-values list
+    query: data.test.p = x
+    want_result:
+      - x: true
+# types:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `query ($string: String, $int: Int, $arr: [Arr], $notnull: [Arr!]!) { f }`
+        ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "f", "Name": "f"}], "VariableDefinitions": [{"Type": {"NamedType": "String", "NonNull": false}, "Used": false, "Variable": "string"}, {"Type": {"NamedType": "Int", "NonNull": false}, "Used": false, "Variable": "int"}, {"Type": {"Elem": {"NamedType": "Arr", "NonNull": false}, "NamedType": "", "NonNull": false}, "Used": false, "Variable": "arr"}, {"Type": {"Elem": {"NamedType": "Arr", "NonNull": true}, "NamedType": "", "NonNull": true}, "Used": false, "Variable": "notnull"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-types common types
+    query: data.test.p = x
+    want_result:
+      - x: true
+# large queries:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          # Copyright (c) 2015-present, Facebook, Inc.
+          #
+          # This source code is licensed under the MIT license found in the
+          # LICENSE file in the root directory of this source tree.
+          query queryName($foo: ComplexType, $site: Site = MOBILE) {
+            whoever123is: node(id: [123, 456]) {
+              id ,
+              ... on User @defer {
+                field2 {
+                  id ,
+                  alias: field1(first:10, after:$foo,) @include(if: $foo) {
+                    id,
+                    ...frag
+                  }
+                }
+              }
+              ... @skip(unless: $foo) {
+                id
+              }
+              ... {
+                id
+              }
+            }
+          }
+          mutation likeStory {
+            like(story: 123) @defer {
+              story {
+                id
+              }
+            }
+          }
+          subscription StoryLikeSubscription($input: StoryLikeSubscribeInput) {
+            storyLikeSubscribe(input: $input) {
+              story {
+                likers {
+                  count
+                }
+                likeSentence {
+                  text
+                }
+              }
+            }
+          }
+          fragment frag on Friend {
+            foo(size: $size, bar: $b, obj: {key: "value", block: """
+                block string uses \"""
+            """})
+          }
+          {
+            unnamed(truthy: true, falsey: false, nullish: null),
+            query
+          }
+        `
+        ast := {"Fragments": [{"Name": "frag", "SelectionSet": [{"Alias": "foo", "Arguments": [{"Name": "size", "Value": {"Kind": 0, "Raw": "size"}}, {"Name": "bar", "Value": {"Kind": 0, "Raw": "b"}}, {"Name": "obj", "Value": {"Children": [{"Name": "key", "Value": {"Kind": 3, "Raw": "value"}}, {"Name": "block", "Value": {"Kind": 4, "Raw": "block string uses \"\"\""}}], "Kind": 9, "Raw": ""}}], "Name": "foo"}], "TypeCondition": "Friend"}], "Operations": [{"Name": "queryName", "Operation": "query", "SelectionSet": [{"Alias": "whoever123is", "Arguments": [{"Name": "id", "Value": {"Children": [{"Name": "", "Value": {"Kind": 1, "Raw": "123"}}, {"Name": "", "Value": {"Kind": 1, "Raw": "456"}}], "Kind": 8, "Raw": ""}}], "Name": "node", "SelectionSet": [{"Alias": "id", "Name": "id"}, {"Directives": [{"Location": "", "Name": "defer"}], "SelectionSet": [{"Alias": "field2", "Name": "field2", "SelectionSet": [{"Alias": "id", "Name": "id"}, {"Alias": "alias", "Arguments": [{"Name": "first", "Value": {"Kind": 1, "Raw": "10"}}, {"Name": "after", "Value": {"Kind": 0, "Raw": "foo"}}], "Directives": [{"Arguments": [{"Name": "if", "Value": {"Kind": 0, "Raw": "foo"}}], "Location": "", "Name": "include"}], "Name": "field1", "SelectionSet": [{"Alias": "id", "Name": "id"}, {"Name": "frag"}]}]}], "TypeCondition": "User"}, {"Directives": [{"Arguments": [{"Name": "unless", "Value": {"Kind": 0, "Raw": "foo"}}], "Location": "", "Name": "skip"}], "SelectionSet": [{"Alias": "id", "Name": "id"}], "TypeCondition": ""}, {"SelectionSet": [{"Alias": "id", "Name": "id"}], "TypeCondition": ""}]}], "VariableDefinitions": [{"Type": {"NamedType": "ComplexType", "NonNull": false}, "Used": false, "Variable": "foo"}, {"DefaultValue": {"Kind": 7, "Raw": "MOBILE"}, "Type": {"NamedType": "Site", "NonNull": false}, "Used": false, "Variable": "site"}]}, {"Name": "likeStory", "Operation": "mutation", "SelectionSet": [{"Alias": "like", "Arguments": [{"Name": "story", "Value": {"Kind": 1, "Raw": "123"}}], "Directives": [{"Location": "", "Name": "defer"}], "Name": "like", "SelectionSet": [{"Alias": "story", "Name": "story", "SelectionSet": [{"Alias": "id", "Name": "id"}]}]}]}, {"Name": "StoryLikeSubscription", "Operation": "subscription", "SelectionSet": [{"Alias": "storyLikeSubscribe", "Arguments": [{"Name": "input", "Value": {"Kind": 0, "Raw": "input"}}], "Name": "storyLikeSubscribe", "SelectionSet": [{"Alias": "story", "Name": "story", "SelectionSet": [{"Alias": "likers", "Name": "likers", "SelectionSet": [{"Alias": "count", "Name": "count"}]}, {"Alias": "likeSentence", "Name": "likeSentence", "SelectionSet": [{"Alias": "text", "Name": "text"}]}]}]}], "VariableDefinitions": [{"Type": {"NamedType": "StoryLikeSubscribeInput", "NonNull": false}, "Used": false, "Variable": "input"}]}, {"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "unnamed", "Arguments": [{"Name": "truthy", "Value": {"Kind": 5, "Raw": "true"}}, {"Name": "falsey", "Value": {"Kind": 5, "Raw": "false"}}, {"Name": "nullish", "Value": {"Kind": 6, "Raw": "null"}}], "Name": "unnamed"}, {"Alias": "query", "Name": "query"}]}]}
+        p {
+            graphql.parse_query(gql) == ast
+        }
+    note: graphql_parse_query/success-large-queries kitchen sink
+    query: data.test.p = x
+    want_result:
+      - x: true
+# fuzzer:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{__typename{...}}`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-fuzzer 01
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: Expected {, found } in GraphQL string at location 1:16'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `{...{__typename{...{}}}}`
+        p {
+            graphql.parse_query(gql)
+        }
+    note: graphql_parse_query/failure-fuzzer 02
+    query: data.test.p = x
+    want_error: 'graphql.parse_query: expected at least one definition, found } in GraphQL string at location 1:21'
+    want_error_code: eval_builtin_error
+    strict_error: true
diff --git a/test/cases/testdata/graphql/test-graphql-parse-schema.yaml b/test/cases/testdata/graphql/test-graphql-parse-schema.yaml
new file mode 100644
index 0000000000..91e424d01e
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-parse-schema.yaml
@@ -0,0 +1,685 @@
+# This suite of tests is adapted from the underlying GraphQL parser library's
+# own test suite, as it provides a fairly comprehensive set of good/degenerate
+# test cases, which we want to make sure to react correctly to.
+# See: https://github.com/vektah/gqlparser/blob/master/parser/schema_test.yml
+cases:
+# object types:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          type Hello {
+            world: String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          "Description"
+          type Hello {
+            world: String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "Description", "Fields": [{"Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types with description
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          """
+          Description
+          """
+          # Even with comments between them
+          type Hello {
+            world: String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "Description", "Fields": [{"Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types with block description
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          type Hello {
+            world(flag: Boolean): String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Arguments": [{"Description": "", "Name": "flag", "Type": {"NamedType": "Boolean", "NonNull": false}}], "Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types with field arg
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          type Hello {
+            world(flag: Boolean = true): String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Arguments": [{"DefaultValue": {"Kind": 5, "Raw": "true"}, "Description": "", "Name": "flag", "Type": {"NamedType": "Boolean", "NonNull": false}}], "Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types with field arg and default value
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          type Hello {
+            world(things: [String]): String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Arguments": [{"Description": "", "Name": "things", "Type": {"Elem": {"NamedType": "String", "NonNull": false}, "NamedType": "", "NonNull": false}}], "Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types with field list arg
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          type Hello {
+            world(argOne: Boolean, argTwo: Int): String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Arguments": [{"Description": "", "Name": "argOne", "Type": {"NamedType": "Boolean", "NonNull": false}}, {"Description": "", "Name": "argTwo", "Type": {"NamedType": "Int", "NonNull": false}}], "Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-object-types with two args
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `type Hello {}`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-object-types must define one or more fields
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: expected at least one definition, found } in GraphQL string at location 1:13'
+    want_error_code: eval_builtin_error
+    strict_error: true
+
+# type extensions:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          extend type Hello {
+            world: String
+          }
+        `
+        ast := {"Extensions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-type-extensions Object extension
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `extend type Hello implements Greeting`
+        ast := {"Extensions": [{"BuiltIn": false, "Description": "", "Interfaces": ["Greeting"], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-type-extensions without any fields
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          extend type Hello implements Greeting
+          extend type Hello implements SecondGreeting
+        `
+        ast := {"Extensions": [{"BuiltIn": false, "Description": "", "Interfaces": ["Greeting"], "Kind": "OBJECT", "Name": "Hello"}, {"BuiltIn": false, "Description": "", "Interfaces": ["SecondGreeting"], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-type-extensions without fields twice
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `extend type Hello`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-type-extensions without anything errors
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Unexpected <EOF> in GraphQL string at location 1:18'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          "Description"
+          extend type Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-type-extensions can have descriptions # hmm, this might not be spec compliant...
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Unexpected String "Description" in GraphQL string at location 2:4'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          extend "Description" type Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-type-extensions can not have descriptions on types
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Unexpected String "Description" in GraphQL string at location 2:11'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          extend scalar Foo @deprecated
+          extend type Foo @deprecated
+          extend interface Foo @deprecated
+          extend union Foo @deprecated
+          extend enum Foo @deprecated
+          extend input Foo @deprecated
+        `
+        ast := {"Extensions": [{"BuiltIn": false, "Description": "", "Directives": [{"Location": "", "Name": "deprecated"}], "Kind": "SCALAR", "Name": "Foo"}, {"BuiltIn": false, "Description": "", "Directives": [{"Location": "", "Name": "deprecated"}], "Kind": "OBJECT", "Name": "Foo"}, {"BuiltIn": false, "Description": "", "Directives": [{"Location": "", "Name": "deprecated"}], "Kind": "INTERFACE", "Name": "Foo"}, {"BuiltIn": false, "Description": "", "Directives": [{"Location": "", "Name": "deprecated"}], "Kind": "UNION", "Name": "Foo"}, {"BuiltIn": false, "Description": "", "Directives": [{"Location": "", "Name": "deprecated"}], "Kind": "ENUM", "Name": "Foo"}, {"BuiltIn": false, "Description": "", "Directives": [{"Location": "", "Name": "deprecated"}], "Kind": "INPUT_OBJECT", "Name": "Foo"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-type-extensions all can have directives
+    query: data.test.p = x
+    want_result:
+      - x: true
+# schema definition:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          schema {
+            query: Query
+          }
+        `
+        ast := {"Schema": [{"Description": "", "OperationTypes": [{"Operation": "query", "Type": "Query"}]}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-schema-definition simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+# schema extensions:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          extend schema {
+            mutation: Mutation
+          }
+        `
+        ast := {"SchemaExtension": [{"Description": "", "OperationTypes": [{"Operation": "mutation", "Type": "Mutation"}]}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-schema-extensions simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `extend schema @directive`
+        ast := {"SchemaExtension": [{"Description": "", "Directives": [{"Location": "", "Name": "directive"}]}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-schema-extensions directive only
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `extend schema`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-schema-extensions without anything errors
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Unexpected <EOF> in GraphQL string at location 1:14'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# inheritance:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `type Hello implements World { field: String }`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "field", "Type": {"NamedType": "String", "NonNull": false}}], "Interfaces": ["World"], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-inheritance single
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `type Hello implements Wo & rld { field: String }`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "field", "Type": {"NamedType": "String", "NonNull": false}}], "Interfaces": ["Wo", "rld"], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-inheritance multi
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `type Hello implements & Wo & rld { field: String }`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "field", "Type": {"NamedType": "String", "NonNull": false}}], "Interfaces": ["Wo", "rld"], "Kind": "OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-inheritance multi with leading amp
+    query: data.test.p = x
+    want_result:
+      - x: true
+# enums:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `enum Hello { WORLD }`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "EnumValues": [{"Description": "", "Name": "WORLD"}], "Kind": "ENUM", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-enums single value
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `enum Hello { WO, RLD }`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "EnumValues": [{"Description": "", "Name": "WO"}, {"Description": "", "Name": "RLD"}], "Kind": "ENUM", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/success-enums double value
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `enum Hello {}`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-enums must define one or more unique enum values
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: expected at least one definition, found } in GraphQL string at location 1:13'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# interface:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          interface Hello {
+            world: String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "INTERFACE", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-interface simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `interface Hello {}`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-interface must define one or more fields
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: expected at least one definition, found } in GraphQL string at location 1:18'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          interface IA {
+              id: ID!
+          }
+          interface IIA implements IA {
+              id: ID!
+          }
+          type A implements IIA {
+              id: ID!
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "id", "Type": {"NamedType": "ID", "NonNull": true}}], "Kind": "INTERFACE", "Name": "IA"}, {"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "id", "Type": {"NamedType": "ID", "NonNull": true}}], "Interfaces": ["IA"], "Kind": "INTERFACE", "Name": "IIA"}, {"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "id", "Type": {"NamedType": "ID", "NonNull": true}}], "Interfaces": ["IIA"], "Kind": "OBJECT", "Name": "A"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-interface may define intermediate interfaces
+    query: data.test.p = x
+    want_result:
+      - x: true
+# unions:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `union Hello = World`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Kind": "UNION", "Name": "Hello", "Types": ["World"]}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-unions simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `union Hello = Wo | Rld`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Kind": "UNION", "Name": "Hello", "Types": ["Wo", "Rld"]}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-unions with two types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `union Hello = | Wo | Rld`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Kind": "UNION", "Name": "Hello", "Types": ["Wo", "Rld"]}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-unions with leading pipe
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `union Hello = || Wo | Rld`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-unions cant be empty
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Expected Name, found | in GraphQL string at location 1:16'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `union Hello = Wo || Rld`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-unions cant double pipe
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Expected Name, found | in GraphQL string at location 1:19'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `union Hello = | Wo | Rld |`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-unions cant have trailing pipe
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Expected Name, found <EOF> in GraphQL string at location 1:27'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# scalar:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `scalar Hello`
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Kind": "SCALAR", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-scalar simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+# input object:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          input Hello {
+            world: String
+          }
+        `
+        ast := {"Definitions": [{"BuiltIn": false, "Description": "", "Fields": [{"Description": "", "Name": "world", "Type": {"NamedType": "String", "NonNull": false}}], "Kind": "INPUT_OBJECT", "Name": "Hello"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-input-object simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          input Hello {
+            world(foo: Int): String
+          }
+        `
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-input-object can not have args
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Expected :, found ( in GraphQL string at location 3:10'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `input Hello {}`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-input-object must define one or more input fields
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: expected at least one definition, found } in GraphQL string at location 1:14'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# directives:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `directive @foo on FIELD`
+        ast := {"Directives": [{"Description": "", "IsRepeatable": false, "Locations": ["FIELD"], "Name": "foo"}]}
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/success-directives simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `
+          directive @onQuery on QUERY
+          directive @onMutation on MUTATION
+          directive @onSubscription on SUBSCRIPTION
+          directive @onField on FIELD
+          directive @onFragmentDefinition on FRAGMENT_DEFINITION
+          directive @onFragmentSpread on FRAGMENT_SPREAD
+          directive @onInlineFragment on INLINE_FRAGMENT
+          directive @onVariableDefinition on VARIABLE_DEFINITION
+        `
+        ast := {"Directives": [{"Description": "", "IsRepeatable": false, "Locations": ["QUERY"], "Name": "onQuery"}, {"Description": "", "IsRepeatable": false, "Locations": ["MUTATION"], "Name": "onMutation"}, {"Description": "", "IsRepeatable": false, "Locations": ["SUBSCRIPTION"], "Name": "onSubscription"}, {"Description": "", "IsRepeatable": false, "Locations": ["FIELD"], "Name": "onField"}, {"Description": "", "IsRepeatable": false, "Locations": ["FRAGMENT_DEFINITION"], "Name": "onFragmentDefinition"}, {"Description": "", "IsRepeatable": false, "Locations": ["FRAGMENT_SPREAD"], "Name": "onFragmentSpread"}, {"Description": "", "IsRepeatable": false, "Locations": ["INLINE_FRAGMENT"], "Name": "onInlineFragment"}, {"Description": "", "IsRepeatable": false, "Locations": ["VARIABLE_DEFINITION"], "Name": "onVariableDefinition"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-directives executable
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `directive @foo repeatable on FIELD`
+        ast := {"Directives": [{"Description": "", "IsRepeatable": true, "Locations": ["FIELD"], "Name": "foo"}]}
+        p {
+            graphql.parse_schema(gql) == ast
+        }
+    note: graphql_parse_schema/success-directives repeatable
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := `directive @foo on FIELD | INCORRECT_LOCATION`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-directives invalid location
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Unexpected Name "INCORRECT_LOCATION" in GraphQL string at location 1:27'
+    want_error_code: eval_builtin_error
+    strict_error: true
+# fuzzer:
+  - data:
+    modules:
+      - |
+        package test
+        gql := `type o{d(g:[`
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-fuzzer 1
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Expected Name, found <EOF> in GraphQL string at location 1:13'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        gql := "\"\"\"\r"
+        p {
+            graphql.parse_schema(gql)
+        }
+    note: graphql_parse_schema/failure-fuzzer 2
+    query: data.test.p = x
+    want_error: 'graphql.parse_schema: Unexpected <Invalid> in GraphQL string at location 2:1'
+    want_error_code: eval_builtin_error
+    strict_error: true
diff --git a/test/cases/testdata/graphql/test-graphql-parse.yaml b/test/cases/testdata/graphql/test-graphql-parse.yaml
new file mode 100644
index 0000000000..8d66782a5a
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-parse.yaml
@@ -0,0 +1,178 @@
+# This suite of tests is adapted from the underlying GraphQL parser library's
+# own test suite, as it provides a fairly comprehensive set of good/degenerate
+# test cases, which we want to make sure to react correctly to.
+# See: https://github.com/vektah/gqlparser/blob/master/validator/validator_test.yml
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type User {
+              id: ID!
+          }
+          extend type Product {
+              upc: String!
+          }
+          union _Entity = Product | User
+          extend type Query {
+            entity: _Entity
+          }
+        `
+        query := `
+          {
+            entity {
+              ... on User {
+              id
+              }
+            }
+          }
+        `
+        q_ast := {"Operations": [{"Name": "", "Operation": "query", "SelectionSet": [{"Alias": "entity", "Name": "entity", "SelectionSet": [{"SelectionSet": [{"Alias": "id", "Name": "id"}], "TypeCondition": "User"}]}]}]}
+        p {
+            [q_ast, _] = graphql.parse(query, schema)
+        }
+    note: graphql_parse/success extending non-existent types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        query := `
+          query SomeOperation {
+            # Note: Not providing mandatory parameter: (myEnum: Locale!)
+            myAction {
+              id
+            }
+          }
+        `
+        p {
+            graphql.parse(query, schema)
+        }
+    note: graphql_parse/failure validation rules are independent case 1
+    query: data.test.p = x
+    want_error: 'graphql.parse: Field "myAction" argument "myEnum" of type "Locale!" is required, but it was not provided in GraphQL query string at location 4:5'
+    want_error_code: eval_builtin_error
+    strict_error: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        query := `
+          # Note: there is default enum value in variables
+          query SomeOperation ($locale: Locale! = DE) {
+            myAction(myEnum: $locale) {
+              id
+            }
+          }
+        `
+        q_ast := {"Operations": [{"Name": "SomeOperation", "Operation": "query", "SelectionSet": [{"Alias": "myAction", "Arguments": [{"Name": "myEnum", "Value": {"Kind": 0, "Raw": "locale"}}], "Name": "myAction", "SelectionSet": [{"Alias": "id", "Name": "id"}]}], "VariableDefinitions": [{"DefaultValue": {"Kind": 7, "Raw": "DE"}, "Type": {"NamedType": "Locale", "NonNull": true}, "Used": false, "Variable": "locale"}]}]}
+        p {
+            [q_ast, _] = graphql.parse(query, schema)
+        }
+    note: graphql_parse/success validation rules are independent case 2
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type DeprecatedType {
+            deprecatedField: String @deprecated
+            newField(deprecatedArg: Int): Boolean
+          }
+          enum DeprecatedEnum {
+            ALPHA @deprecated
+          }
+        `
+        query := ``
+        p {
+            [{}, _] = graphql.parse(query, schema)
+        }
+    note: graphql_parse/success deprecating types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Query {
+            bar: String!
+          }
+        `
+        query := `
+          query Foo($flag: Boolean!) {
+            ...Bar
+          }
+          fragment Bar on Query {
+            bar @include(if: $flag)
+          }
+        `
+        q_ast := {"Fragments": [{"Name": "Bar", "SelectionSet": [{"Alias": "bar", "Directives": [{"Arguments": [{"Name": "if", "Value": {"Kind": 0, "Raw": "flag"}}], "Location": "", "Name": "include"}], "Name": "bar"}], "TypeCondition": "Query"}], "Operations": [{"Name": "Foo", "Operation": "query", "SelectionSet": [{"Name": "Bar"}], "VariableDefinitions": [{"Type": {"NamedType": "Boolean", "NonNull": true}, "Used": false, "Variable": "flag"}]}]}
+        p {
+            [q_ast, _] = graphql.parse(query, schema)
+        }
+    note: graphql_parse/success no unused variables
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema_ast := graphql.parse_schema(`
+          type Employee {
+            id: String!
+            salary: Int!
+          }
+
+          schema {
+            query: Query
+          }
+
+          type Query {
+            employeeByID(id: String): Employee
+          }
+        `)
+        query_ast := graphql.parse_query(`
+          query { employeeByID(id: "alice") { salary }}
+        `)
+        p {
+            [query_ast, schema_ast] = graphql.parse(query_ast, schema_ast)
+        }
+    note: graphql_parse/success - AST objects - Employee example
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/graphql/test-graphql-schema-is-valid.yaml b/test/cases/testdata/graphql/test-graphql-schema-is-valid.yaml
new file mode 100644
index 0000000000..9cb5dfbf04
--- /dev/null
+++ b/test/cases/testdata/graphql/test-graphql-schema-is-valid.yaml
@@ -0,0 +1,772 @@
+# This suite of tests is adapted from the underlying GraphQL parser library's
+# own test suite, as it provides a fairly comprehensive set of good/degenerate
+# test cases, which we want to make sure to react correctly to.
+# See: https://github.com/vektah/gqlparser/blob/master/validator/validator_test.yml
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type User {
+              id: ID!
+          }
+          extend type Product {
+              upc: String!
+          }
+          union _Entity = Product | User
+          extend type Query {
+            entity: _Entity
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success extending non-existent types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Query {
+              myAction(myEnum: Locale!): SomeResult!
+          }
+          type SomeResult {
+              id: String
+          }
+          enum Locale {
+              EN
+              LT
+              DE
+          }
+        `
+        # We use the unification style from semver's is_valid tests here:
+        p = x {
+            x = graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success validation rules are independent case 1 and 2
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type DeprecatedType {
+            deprecatedField: String @deprecated
+            newField(deprecatedArg: Int): Boolean
+          }
+          enum DeprecatedEnum {
+            ALPHA @deprecated
+          }
+        `
+        query := ``
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success deprecating types
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Query {
+            bar: String!
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success no unused variables
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema_ast := graphql.parse_schema(`
+          type Employee {
+            id: String!
+            salary: Int!
+          }
+
+          schema {
+            query: Query
+          }
+
+          type Query {
+            employeeByID(id: String): Employee
+          }
+        `)
+        p {
+            graphql.schema_is_valid(schema_ast)
+        }
+    note: graphql_schema_is_valid/success - AST objects - Employee example
+    query: data.test.p = x
+    want_result:
+      - x: true
+# tests derived from gqlparser/parser/schema_test.yml
+# object extensions:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          "Description"
+          type Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions with description
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          """
+          Description
+          """
+          # Even with comments between them
+          type Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions with block description
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello {
+            world(flag: Boolean): String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions with field arg
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello {
+            world(flag: Boolean = true): String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions with field arg and default value
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello {
+            world(things: [String]): String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions with field list arg
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello {
+            world(argOne: Boolean, argTwo: Int): String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-object-extensions with two args
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello {}
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-object-extensions must define one or more fields
+    query: data.test.p = x
+    want_result:
+      - x: false
+# type extensions:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-type-extensions object extension
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Hello implements Greeting
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-type-extensions without any fields
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Hello implements Greeting
+          extend type Hello implements SecondGreeting
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-type-extensions without fields twice
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend type Hello
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-type-extensions without anything errors
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          "Description"
+          extend type Hello {
+            world: String
+          }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-type-extensions can have descriptions
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend "Description" type Hello {
+            world: String
+          }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-type-extensions can not have descriptions on types
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend scalar Foo @deprecated
+          extend type Foo @deprecated
+          extend interface Foo @deprecated
+          extend union Foo @deprecated
+          extend enum Foo @deprecated
+          extend input Foo @deprecated
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-type-extensions all can have directives
+    query: data.test.p = x
+    want_result:
+      - x: false
+# schema definition:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          schema {
+            query: Query
+          }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-schema-definition simple
+    query: data.test.p = x
+    want_result:
+      - x: false
+#schema extensions:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend schema {
+            mutation: Mutation
+          }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-schema-extensions simple
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend schema @directive
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-schema-extensions directive only
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          extend schema
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-schema-extensions without anything errors
+    query: data.test.p = x
+    want_result:
+      - x: false
+# inheritance:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello implements World { field: String }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-inheritance single
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello implements Wo & rld { field: String }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-inheritance multi
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          type Hello implements & Wo & rld { field: String }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-inheritance multi with leading amp
+    query: data.test.p = x
+    want_result:
+      - x: false
+# enums:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          enum Hello { WORLD }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-enums single value
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          enum Hello { WO, RLD }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-enums double value
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          enum Hello {}
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-enums must define one or more unique enum values
+    query: data.test.p = x
+    want_result:
+      - x: false
+# interface:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          interface Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-interface simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          interface Hello {}
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-interface must define one or more fields
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          interface IA {
+            id: ID!
+          }
+          interface IIA implements IA {
+            id: ID!
+          }
+          type A implements IIA {
+            id: ID!
+          }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-interface may define intermediate interfaces
+    query: data.test.p = x
+    want_result:
+      - x: false
+# unions:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          union Hello = World
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-unions simple
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          union Hello = Wo | Rld
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-unions with two types
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          union Hello = | Wo | Rld
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-unions with leading pipe
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          union Hello = || Wo | Rld
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-unions cant be empty
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          union Hello = Wo || Rld
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-unions cant double pipe
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          union Hello = | Wo | Rld |
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-unions cant have trailing pipe
+    query: data.test.p = x
+    want_result:
+      - x: false
+# scalar:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          scalar Hello
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-scalar simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+# input objects:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          input Hello {
+            world: String
+          }
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-input-objects simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          input Hello {
+            world(foo: Int): String
+          }
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-input-objects can not have args
+    query: data.test.p = x
+    want_result:
+      - x: false
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          input Hello {}
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-input-objects must define one or more input fields
+    query: data.test.p = x
+    want_result:
+      - x: false
+# directives:
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          directive @foo on FIELD
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-directives simple
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          directive @onQuery on QUERY
+          directive @onMutation on MUTATION
+          directive @onSubscription on SUBSCRIPTION
+          directive @onField on FIELD
+          directive @onFragmentDefinition on FRAGMENT_DEFINITION
+          directive @onFragmentSpread on FRAGMENT_SPREAD
+          directive @onInlineFragment on INLINE_FRAGMENT
+          directive @onVariableDefinition on VARIABLE_DEFINITION
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-directives executable
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          directive @foo repeatable on FIELD
+        `
+        p {
+            graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/success-directives repeatable
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        schema := `
+          directive @foo on FIELD | INCORRECT_LOCATION
+        `
+        p = x {
+            x := graphql.schema_is_valid(schema)
+        }
+    note: graphql_schema_is_valid/failure-directives invalid location
+    query: data.test.p = x
+    want_result:
+      - x: false
\ No newline at end of file
diff --git a/test/cases/testdata/helloworld/test-helloworld-1.yaml b/test/cases/testdata/helloworld/test-helloworld-1.yaml
index eeabba14d1..d2f12e84c7 100644
--- a/test/cases/testdata/helloworld/test-helloworld-1.yaml
+++ b/test/cases/testdata/helloworld/test-helloworld-1.yaml
@@ -1,5 +1,3 @@
-# This file shows how to implement test cases for Rego evaluation.
-#
 # If you are adding new built-in functions to Rego, you must include test cases in this format.
 #
 # Each test file contains a set of test 'cases'. Each test case includes a globally unique
@@ -27,8 +25,10 @@
 #   go test ./topdown -v -run 'TestRego/helloworld'
 #
 cases:
-- note: helloworld/test_case
-  query: data.test.p = x
+- data:
+    foo: bar
+  input:
+    baz: bar
   modules:
   - |
     package test
@@ -38,14 +38,12 @@ cases:
     }
 
     q = input.baz
-  data: {"foo": "bar"}
-  input: {"baz": "bar"}
-  want_result: [{x: 7}]
+  note: helloworld/test_case
+  query: data.test.p = x
+  want_result:
+  - x: 7
 - note: helloworld/another_test_for_builtin_error
   query: 1 / 0
-  want_error_code: eval_builtin_error
+  strict_error: true
   want_error: 'div: divide by zero'
-  # `strict_error` indicates that the error is only returned when
-  # "strict builtin errors" are enabled. Otherwise, the test result
-  # is expected to be "undefined".
-  strict_error: true
\ No newline at end of file
+  want_error_code: eval_builtin_error
diff --git a/test/cases/testdata/indirectreferences/test-indirectreferences-0758.yaml b/test/cases/testdata/indirectreferences/test-indirectreferences-0758.yaml
index a8dc85dfd9..f6f9524629 100644
--- a/test/cases/testdata/indirectreferences/test-indirectreferences-0758.yaml
+++ b/test/cases/testdata/indirectreferences/test-indirectreferences-0758.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/indirectreferences/test-indirectreferences-0759.yaml b/test/cases/testdata/indirectreferences/test-indirectreferences-0759.yaml
index 3678601c59..7c18594f70 100644
--- a/test/cases/testdata/indirectreferences/test-indirectreferences-0759.yaml
+++ b/test/cases/testdata/indirectreferences/test-indirectreferences-0759.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/indirectreferences/test-indirectreferences-0760.yaml b/test/cases/testdata/indirectreferences/test-indirectreferences-0760.yaml
index 9c103e6175..fae0d80fd6 100644
--- a/test/cases/testdata/indirectreferences/test-indirectreferences-0760.yaml
+++ b/test/cases/testdata/indirectreferences/test-indirectreferences-0760.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/indirectreferences/test-indirectreferences-0761.yaml b/test/cases/testdata/indirectreferences/test-indirectreferences-0761.yaml
index b7a24fad07..0fb199019e 100644
--- a/test/cases/testdata/indirectreferences/test-indirectreferences-0761.yaml
+++ b/test/cases/testdata/indirectreferences/test-indirectreferences-0761.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/indirectreferences/test-indirectreferences-0762.yaml b/test/cases/testdata/indirectreferences/test-indirectreferences-0762.yaml
index 62b664a8b8..3b4b9ff34d 100644
--- a/test/cases/testdata/indirectreferences/test-indirectreferences-0762.yaml
+++ b/test/cases/testdata/indirectreferences/test-indirectreferences-0762.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0977.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0977.yaml
index 3ab5b0e1a6..4d08fc16c7 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0977.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0977.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"foo": 1}'
   modules:
   - |
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0978.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0978.yaml
index 6c9d0ee1b6..10d0163f50 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0978.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0978.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package z
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0979.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0979.yaml
index b5fac5b18c..653d1da09f 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0979.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0979.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   input_term: '{"req1": {"foo": 4}, "req2": {"bar": 4}}'
   modules:
   - |
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0980.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0980.yaml
index 7ef5c38b89..0730e3d08a 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0980.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0980.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   input_term: '{"req1": {"foo": 4}}'
   modules:
   - |
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0981.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0981.yaml
index e5efce731c..08e844f718 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0981.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0981.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"req3": {"a": {"b": {"x": [1, 2, 3, 4]}}}}'
   modules:
   - |
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0982.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0982.yaml
index 0280950cb5..b1a63b3afc 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0982.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0982.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"req4": {"a": {"b": {"x": [1, 2, 3, 4]}}}}'
   modules:
   - |
diff --git a/test/cases/testdata/inputvalues/test-inputvalues-0983.yaml b/test/cases/testdata/inputvalues/test-inputvalues-0983.yaml
index 5195f87ab7..db206a74e5 100644
--- a/test/cases/testdata/inputvalues/test-inputvalues-0983.yaml
+++ b/test/cases/testdata/inputvalues/test-inputvalues-0983.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"foo": {{1}}}'
   modules:
   - |
diff --git a/test/cases/testdata/intersection/test-intersection-0352.yaml b/test/cases/testdata/intersection/test-intersection-0352.yaml
index dee93befc0..a00e17ef97 100644
--- a/test/cases/testdata/intersection/test-intersection-0352.yaml
+++ b/test/cases/testdata/intersection/test-intersection-0352.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/intersection/test-intersection-0353.yaml b/test/cases/testdata/intersection/test-intersection-0353.yaml
index d45b0bd0fb..8353d91eb1 100644
--- a/test/cases/testdata/intersection/test-intersection-0353.yaml
+++ b/test/cases/testdata/intersection/test-intersection-0353.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/intersection/test-intersection-0354.yaml b/test/cases/testdata/intersection/test-intersection-0354.yaml
index acbca14d18..c548358900 100644
--- a/test/cases/testdata/intersection/test-intersection-0354.yaml
+++ b/test/cases/testdata/intersection/test-intersection-0354.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/intersection/test-intersection-0355.yaml b/test/cases/testdata/intersection/test-intersection-0355.yaml
index 6260c94bee..56ca018c37 100644
--- a/test/cases/testdata/intersection/test-intersection-0355.yaml
+++ b/test/cases/testdata/intersection/test-intersection-0355.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/intersection/test-intersection-0356.yaml b/test/cases/testdata/intersection/test-intersection-0356.yaml
index 44d155a732..e4ce495aa6 100644
--- a/test/cases/testdata/intersection/test-intersection-0356.yaml
+++ b/test/cases/testdata/intersection/test-intersection-0356.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jsonbuiltins/test-is-valid.yaml b/test/cases/testdata/jsonbuiltins/test-is-valid.yaml
index 60366f6371..35c0748cad 100644
--- a/test/cases/testdata/jsonbuiltins/test-is-valid.yaml
+++ b/test/cases/testdata/jsonbuiltins/test-is-valid.yaml
@@ -12,6 +12,7 @@ cases:
     ]
 
     p = [x | doc = documents[_]; json.is_valid(doc, x)]
+  strict_error: true
   want_result:
   - x:
     - false
@@ -28,9 +29,9 @@ cases:
     }
   query: data.generated.p = x
   input: {"foo": 1}
-  want_error: operand 1 must be string but got number
-  want_error_code: eval_type_error
   strict_error: true
+  want_result:
+  - x: false
 
 - note: jsonbuiltins/yaml is_valid
   query: data.generated.p = x
@@ -49,6 +50,7 @@ cases:
     ]
 
     p = [x | doc = documents[_]; yaml.is_valid(doc, x)]
+  strict_error: true
   want_result:
   - x:
     - true
@@ -65,6 +67,6 @@ cases:
     }
   query: data.generated.p = x
   input: {"foo": 1}
-  want_error: operand 1 must be string but got number
-  want_error_code: eval_type_error
   strict_error: true
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0924.yaml b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0924.yaml
index 91218a8e34..bcec696fbc 100644
--- a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0924.yaml
+++ b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0924.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0925.yaml b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0925.yaml
index a9ec15d45d..2c4937cb06 100644
--- a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0925.yaml
+++ b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0925.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0926.yaml b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0926.yaml
index ec62ca04e7..6d35592418 100644
--- a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0926.yaml
+++ b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0926.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
@@ -92,6 +15,6 @@ cases:
     }
   note: jsonbuiltins/unmarshal-non-string
   query: data.generated.p = x
+  strict_error: true
   want_error: operand 1 must be string but got number
   want_error_code: eval_type_error
-  strict_error: true
diff --git a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0927.yaml b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0927.yaml
index b55559fd3f..f01e3f4d65 100644
--- a/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0927.yaml
+++ b/test/cases/testdata/jsonbuiltins/test-jsonbuiltins-0927.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jsonpatch/coverage.yaml b/test/cases/testdata/jsonpatch/coverage.yaml
index d5e4556e40..a048968907 100644
--- a/test/cases/testdata/jsonpatch/coverage.yaml
+++ b/test/cases/testdata/jsonpatch/coverage.yaml
@@ -1,6 +1,6 @@
 cases:
 # These tests cover mostly error scenarios.
-- note: jsonpatch/set
+- note: jsonpatch/set-failure add-to-bad-path
   query: data.main.result = x
   want_result: []
   modules:
diff --git a/test/cases/testdata/jsonpatch/json-patch-tests.yaml b/test/cases/testdata/jsonpatch/json-patch-tests.yaml
index 7692887d9a..9d58bc2853 100644
--- a/test/cases/testdata/jsonpatch/json-patch-tests.yaml
+++ b/test/cases/testdata/jsonpatch/json-patch-tests.yaml
@@ -16,7 +16,7 @@ cases:
     # Grab all cases from the modules inside `data.json_patch_cases` and
     # construct an object with readable index names.
     all_cases[k] = t {
-      t := data.json_patch_cases[p]["cases"][i]
+      t := data.json_patch_cases[p].cases[i]
       k := sprintf("%s/%d", [p, i])
     }
 
diff --git a/test/cases/testdata/jsonpatch/set.yaml b/test/cases/testdata/jsonpatch/set.yaml
index 602c0aa437..48b0669b97 100644
--- a/test/cases/testdata/jsonpatch/set.yaml
+++ b/test/cases/testdata/jsonpatch/set.yaml
@@ -1,7 +1,7 @@
 cases:
 # Here are some tests that cover dealing with sets and json.patch, since that
 # is not covered by the spec.
-- note: jsonpatch/set
+- note: jsonpatch/set-success basic-remove
   query: data.main.result.foo = x
   want_result:
   - x:
@@ -14,7 +14,7 @@ cases:
     patch = [{"op": "remove", "path": "foo/b"}]
     result = r {r = json.patch(doc, patch)}
   sort_bindings: true
-- note: jsonpatch/set
+- note: jsonpatch/set-success basic-add
   query: data.main.result.foo = x
   want_result:
   - x:
@@ -29,7 +29,7 @@ cases:
     patch = [{"op": "add", "path": "foo/d", "value": "d"}]
     result = r {r = json.patch(doc, patch)}
   sort_bindings: true
-- note: jsonpatch/set
+- note: jsonpatch/set-failure add-with-mismatched-key-value
   query: data.main.result.foo = x
   want_result: [] # value does not match key
   modules:
@@ -38,7 +38,7 @@ cases:
     doc = {"foo": {"a", "b", "c"}}
     patch = [{"op": "add", "path": "foo/d", "value": "e"}]
     result = r {r = json.patch(doc, patch)}
-- note: jsonpatch/set
+- note: jsonpatch/set-success basic-move
   query: 'data.main.result.foo = x; data.main.result.bar = z'
   want_result:
   - x:
@@ -54,7 +54,7 @@ cases:
     patch = [{"op": "move", "from": "foo/a", "path": "bar/a"}]
     result = r {r = json.patch(doc, patch)}
   sort_bindings: true
-- note: jsonpatch/set
+- note: jsonpatch/set-success add-to-nested-array
   query: data.main.result = x
   want_result:
   - x:
diff --git a/test/cases/testdata/jsonschema/test-json-match_schema.yaml b/test/cases/testdata/jsonschema/test-json-match_schema.yaml
new file mode 100644
index 0000000000..f5f85d9ce5
--- /dev/null
+++ b/test/cases/testdata/jsonschema/test-json-match_schema.yaml
@@ -0,0 +1,97 @@
+cases:
+  - note: json_match_schema/success
+    modules:
+      - |
+        package test
+        
+        document := {"id": 5}
+        schema := {
+          "properties": {
+            "id": {
+              "type": "integer"
+            }
+          },
+          "required": ["id"]
+        }
+        p := json.match_schema(document, schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ true, [ ] ]
+  - note: json_match_schema/success string document
+    modules:
+      - |
+        package test
+
+        document := `{"id": 5}`
+        schema := {
+          "properties": {
+            "id": {
+              "type": "integer"
+            }
+          },
+          "required": ["id"]
+        }
+        p := json.match_schema(document, schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ true, [ ] ]
+  - note: json_match_schema/success string schema
+    modules:
+      - |
+        package test
+
+        document := {"id": 5}
+        schema := `{
+          "properties": {
+            "id": {
+              "type": "integer"
+            }
+          },
+          "required": ["id"]
+        }`
+        p := json.match_schema(document, schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ true, [ ] ]
+  - note: json_match_schema/invalid document
+    modules:
+      - |
+        package test
+
+        document := {"id": "foo"}
+        schema := {
+          "properties": {
+            "id": {
+              "type": "integer"
+            }
+          },
+          "required": ["id"]
+        }
+        p := json.match_schema(document, schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ false, [ {
+        "desc": "Invalid type. Expected: integer, given: string",
+        "error": "id: Invalid type. Expected: integer, given: string",
+        "field": "id",
+        "type": "invalid_type"
+      } ] ]
+  - note: json_match_schema/invalid schema
+    modules:
+      - |
+        package test
+
+        document := {"id": "foo"}
+        schema := {
+          "properties": {
+            "id": {
+              "type": "unknown"
+            }
+          },
+          "required": ["id"]
+        }
+        p := json.match_schema(document, schema)
+    query: data.test.p = x
+    strict_error: true
+    want_error: 'json.match_schema: has a primitive type that is NOT VALID -- given: /unknown/ Expected valid values are:[array boolean integer number null object string]'
+    want_error_code: eval_builtin_error
\ No newline at end of file
diff --git a/test/cases/testdata/jsonschema/test-json-verify_schema.yaml b/test/cases/testdata/jsonschema/test-json-verify_schema.yaml
new file mode 100644
index 0000000000..03d605723f
--- /dev/null
+++ b/test/cases/testdata/jsonschema/test-json-verify_schema.yaml
@@ -0,0 +1,41 @@
+cases:
+  - note: json_verify_schema/valid schema string
+    modules:
+      - |
+        package test
+        
+        schema := `{"type": "boolean"}`
+        p := json.verify_schema(schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ true, null ]
+  - note: json_verify_schema/valid schema object
+    modules:
+      - |
+        package test
+        
+        schema := {"type": "boolean"}
+        p := json.verify_schema(schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ true, null ]
+  - note: json_verify_schema/invalid schema string
+    modules:
+      - |
+        package test
+
+        schema := `{"type": "unknown_type"}`
+        p := json.verify_schema(schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ false, "jsonschema: has a primitive type that is NOT VALID -- given: /unknown_type/ Expected valid values are:[array boolean integer number null object string]" ]
+  - note: json_verify_schema/invalid schema object
+    modules:
+      - |
+        package test
+
+        schema := {"type": "unknown_type"}
+        p := json.verify_schema(schema)
+    query: data.test.p = x
+    want_result:
+      - x: [ false, "jsonschema: has a primitive type that is NOT VALID -- given: /unknown_type/ Expected valid values are:[array boolean integer number null object string]" ]
\ No newline at end of file
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0389.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0389.yaml
index f0838f38d2..61f03aa88f 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0389.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0389.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -96,5 +14,5 @@ cases:
     - alg: HS256
       typ: JWT
     - iss: opa
-      sub: "0"
+      sub: '0'
     - 5e65682e81c8de9c4cb4c3bf59138d3122731940cff690e3cbc269d3fb5d4576
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0390.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0390.yaml
index 585e0b71e7..08a1b3ec2d 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0390.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0390.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0391.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0391.yaml
index b02f84f9c2..b9533a6bfc 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0391.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0391.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtbuiltins/no-support-jwe
   query: data.generated.p = x
+  strict_error: true
   want_error: JWT is a JWE object, which is not supported
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0392.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0392.yaml
index 5c5059f8c9..072498e860 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0392.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0392.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtbuiltins/no-periods
   query: data.generated.p = x
+  strict_error: true
   want_error: encoded JWT had no period separators
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0393.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0393.yaml
index c7fb28da60..2388c6dfe3 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0393.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0393.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtbuiltins/wrong-period-count
   query: data.generated.p = x
+  strict_error: true
   want_error: encoded JWT must have 3 sections, found 2
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0394.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0394.yaml
index 619e42b928..513c0c0e22 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0394.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0394.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,7 +9,7 @@ cases:
     }
   note: jwtbuiltins/bad-header-encoding
   query: data.generated.p = x
+  strict_error: true
   want_error: 'JWT header had invalid encoding: illegal base64 data at input byte
     13'
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0395.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0395.yaml
index bc7d83265e..3e200b76a2 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0395.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0395.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,7 +9,7 @@ cases:
     }
   note: jwtbuiltins/bad-payload-encoding
   query: data.generated.p = x
+  strict_error: true
   want_error: 'JWT payload had invalid encoding: illegal base64 data at input byte
     17'
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0396.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0396.yaml
index c2972f322b..268db03a0e 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0396.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0396.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,7 +9,7 @@ cases:
     }
   note: jwtbuiltins/bad-signature-encoding
   query: data.generated.p = x
+  strict_error: true
   want_error: 'JWT signature had invalid encoding: illegal base64 data at input byte
     15'
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0397.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0397.yaml
index 4a4716361f..b9aabaece1 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0397.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0397.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -96,5 +14,5 @@ cases:
     - alg: HS256
       typ: JWT
     - iss: opa
-      sub: "0"
+      sub: '0'
     - 5e65682e81c8de9c4cb4c3bf59138d3122731940cff690e3cbc269d3fb5d4576
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0398.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0398.yaml
index 2cd411e71b..28673b2092 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0398.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0398.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -96,5 +14,5 @@ cases:
     - alg: HS256
       typ: JWT
     - iss: opa
-      sub: "0"
+      sub: '0'
     - 5e65682e81c8de9c4cb4c3bf59138d3122731940cff690e3cbc269d3fb5d4576
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0399.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0399.yaml
index e07a939046..bc03d1e079 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0399.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0399.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -96,10 +14,10 @@ cases:
     - alg: HS256
       typ: JWT
     - ext:
-        abc: "123"
+        abc: '123'
         cba:
         - 10
-        - "10"
+        - '10'
       iss: opa
-      sub: "0"
+      sub: '0'
     - 208c45fae27a8b82b90e3ef5c4d2e751ea81f639ae8e5eae8d32278628b53f11
diff --git a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0400.yaml b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0400.yaml
index 30da1f4460..17e3b3ee39 100644
--- a/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0400.yaml
+++ b/test/cases/testdata/jwtbuiltins/test-jwtbuiltins-0400.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -89,15 +7,6 @@ cases:
     p = [x, y, z] {
       io.jwt.decode("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiAiMCIsImlzcyI6ICJub3Qgb3BhIiwgImlzcyI6ICJhbHNvIG5vdCBvcGEiLCAiaXNzIjogIm9wYSJ9.XmVoLoHI3pxMtMO_WRONMSJzGUDP9pDjy8Jp0_tdRXY", [x, y, z])
     }
-  # The test below checks that payloads with duplicate keys
-  # in their encoding produce a token object that binds the key
-  # to the last occurring value, as per RFC 7519 Section 4.
-  # It tests a payload encoding that has 3 duplicates of the
-  # "iss" key, with the values "not opa", "also not opa" and
-  # "opa", in that order.
-  # Go's json.Unmarshal exhibits this behavior, but it is not
-  # documented, so this test is meant to catch that behavior
-  # if it changes.
   note: jwtbuiltins/duplicate-keys
   query: data.generated.p = x
   want_result:
@@ -105,5 +14,5 @@ cases:
     - alg: HS256
       typ: JWT
     - iss: opa
-      sub: "0"
+      sub: '0'
     - 5e65682e81c8de9c4cb4c3bf59138d3122731940cff690e3cbc269d3fb5d4576
diff --git a/test/cases/testdata/jwtdecodeverify/test-jwtdecodeverify-invalid-exp-type.yaml b/test/cases/testdata/jwtdecodeverify/test-jwtdecodeverify-invalid-exp-type.yaml
new file mode 100644
index 0000000000..35a2a43d16
--- /dev/null
+++ b/test/cases/testdata/jwtdecodeverify/test-jwtdecodeverify-invalid-exp-type.yaml
@@ -0,0 +1,15 @@
+cases:
+  - data:
+    modules:
+      - |
+        package generated
+        
+        token := io.jwt.encode_sign({"alg": "HS256"}, {"exp": null}, {"kty": "oct", "k": base64url.encode_no_pad("42")})
+        
+        decoded := io.jwt.decode_verify(token, {"secret": "42"})
+
+    note: jwtdecodeverify/invalid-exp
+    query: data.generated.decoded = x
+    strict_error: true
+    want_error: exp value must be a number
+    want_error_code: eval_builtin_error
\ No newline at end of file
diff --git a/test/cases/testdata/jwtdecodeverify/test-jwtdecodeverify-invalid-nbf-type.yaml b/test/cases/testdata/jwtdecodeverify/test-jwtdecodeverify-invalid-nbf-type.yaml
new file mode 100644
index 0000000000..3ec6193cc7
--- /dev/null
+++ b/test/cases/testdata/jwtdecodeverify/test-jwtdecodeverify-invalid-nbf-type.yaml
@@ -0,0 +1,15 @@
+cases:
+  - data:
+    modules:
+      - |
+        package generated
+        
+        token := io.jwt.encode_sign({"alg": "HS256"}, {"nbf": "string is not valid here"}, {"kty": "oct", "k": base64url.encode_no_pad("42")})
+        
+        decoded := io.jwt.decode_verify(token, {"secret": "42"})
+
+    note: jwtdecodeverify/invalid-nbf
+    query: data.generated.decoded = x
+    strict_error: true
+    want_error: nbf value must be a number
+    want_error_code: eval_builtin_error
\ No newline at end of file
diff --git a/test/cases/testdata/jwtencodesign/test-jwtencodesign-0492.yaml b/test/cases/testdata/jwtencodesign/test-jwtencodesign-0492.yaml
index cd9414242e..1d2d68c191 100644
--- a/test/cases/testdata/jwtencodesign/test-jwtencodesign-0492.yaml
+++ b/test/cases/testdata/jwtencodesign/test-jwtencodesign-0492.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtencodesign/test-jwtencodesign-0493.yaml b/test/cases/testdata/jwtencodesign/test-jwtencodesign-0493.yaml
index 5fd28972c4..c922d6bd94 100644
--- a/test/cases/testdata/jwtencodesign/test-jwtencodesign-0493.yaml
+++ b/test/cases/testdata/jwtencodesign/test-jwtencodesign-0493.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtencodesign/test-jwtencodesign-0494.yaml b/test/cases/testdata/jwtencodesign/test-jwtencodesign-0494.yaml
index fdf161f908..87da035a68 100644
--- a/test/cases/testdata/jwtencodesign/test-jwtencodesign-0494.yaml
+++ b/test/cases/testdata/jwtencodesign/test-jwtencodesign-0494.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0379.yaml b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0379.yaml
index b3a507e26c..87e34f523a 100644
--- a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0379.yaml
+++ b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0379.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignheadererrors/Unknown signature algorithm
   query: data.generated.p = x
+  strict_error: true
   want_error: invalid character
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0380.yaml b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0380.yaml
index 3add5b9f77..859b62c9ec 100644
--- a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0380.yaml
+++ b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0380.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -89,8 +7,8 @@ cases:
     p = x {
       io.jwt.encode_sign_raw("{\"alg\":\"dummy\"}", "{\"iss\":\"joe\",\r\n \"exp\":1300819380,\r\n \"http://example.com/is_root\":true}", "{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\n}", x)
     }
-  note: jwtencodesignheadererrors/Unknown signature algorithm
+  note: jwtencodesignheadererrors/unknown signature algorithm
   query: data.generated.p = x
-  want_error: Unknown signature algorithm
-  want_error_code: eval_builtin_error
   strict_error: true
+  want_error: unknown signature algorithm
+  want_error_code: eval_builtin_error
diff --git a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0381.yaml b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0381.yaml
index 838cedd238..e75d24f75a 100644
--- a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0381.yaml
+++ b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0381.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignheadererrors/Empty JSON header Error
   query: data.generated.p = x
+  strict_error: true
   want_error: unsupported signature algorithm
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0382.yaml b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0382.yaml
index a882047f16..c502c2c3e7 100644
--- a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0382.yaml
+++ b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0382.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignheadererrors/Empty headers input error
   query: data.generated.p = x
+  strict_error: true
   want_error: unexpected end of JSON input
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0383.yaml b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0383.yaml
index cf3a0d7cfd..051d20d8a7 100644
--- a/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0383.yaml
+++ b/test/cases/testdata/jwtencodesignheadererrors/test-jwtencodesignheadererrors-0383.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignheadererrors/No JSON Error
   query: data.generated.p = x
+  strict_error: true
   want_error: invalid character
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0376.yaml b/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0376.yaml
index d9fc8d28b1..2d6987bc26 100644
--- a/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0376.yaml
+++ b/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0376.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignpayloaderrors/No Payload
   query: data.generated.p = x
+  strict_error: true
   want_error: type is JWT but payload is not JSON
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0377.yaml b/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0377.yaml
index 6509d1eb29..021b496964 100644
--- a/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0377.yaml
+++ b/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0377.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignpayloaderrors/Payload JSON Error
   query: data.generated.p = x
+  strict_error: true
   want_error: type is JWT but payload is not JSON
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0378.yaml b/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0378.yaml
index 896f4c8894..384a8375a9 100644
--- a/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0378.yaml
+++ b/test/cases/testdata/jwtencodesignpayloaderrors/test-jwtencodesignpayloaderrors-0378.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtencodesignpayloaderrors/Non JSON Error
   query: data.generated.p = x
+  strict_error: true
   want_error: type is JWT but payload is not JSON
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0384.yaml b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0384.yaml
index 28717f0582..f10c77bd95 100644
--- a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0384.yaml
+++ b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0384.yaml
@@ -1,92 +1,10 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
-  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"JWT\",\r\n
-    \"alg\":\"HS256\"}`, `{\"iss\":\"joe\",\r\n \"exp\":1300819380,\r\n \"http://example.com/is_root\":true}`,
-    `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\n}`,
-    x)\n}\n"
+  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"JWT\",\r\n\
+    \ \"alg\":\"HS256\"}`, `{\"iss\":\"joe\",\r\n \"exp\":1300819380,\r\n \"http://example.com/is_root\"\
+    :true}`, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\
+    \n}`, x)\n}\n"
   note: jwtencodesignraw/https://tools.ietf.org/html/rfc7515#appendix-A.1
   query: data.generated.p = x
   want_result:
diff --git a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0385.yaml b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0385.yaml
index c8ff414f70..5a25286751 100644
--- a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0385.yaml
+++ b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0385.yaml
@@ -1,91 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
-  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"text/plain\",\r\n
-    \"alg\":\"HS256\"}`, ``, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\n}`,
-    x)\n}\n"
+  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"text/plain\"\
+    ,\r\n \"alg\":\"HS256\"}`, ``, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\
+    \n}`, x)\n}\n"
   note: jwtencodesignraw/No Payload but Media Type is Plain
   query: data.generated.p = x
   want_result:
diff --git a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0386.yaml b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0386.yaml
index 5c4f73e158..f53c39953e 100644
--- a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0386.yaml
+++ b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0386.yaml
@@ -1,91 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
-  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"text/plain\",\r\n
-    \"alg\":\"HS256\"}`, `e`, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\n}`,
-    x)\n}\n"
+  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"text/plain\"\
+    ,\r\n \"alg\":\"HS256\"}`, `e`, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\
+    \n}`, x)\n}\n"
   note: jwtencodesignraw/text/plain media type
   query: data.generated.p = x
   want_result:
diff --git a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0387.yaml b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0387.yaml
index 3beeaa5820..a782bb93cc 100644
--- a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0387.yaml
+++ b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0387.yaml
@@ -1,91 +1,9 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
-  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"JWT\",\r\n
-    \"alg\":\"HS256\"}`, `{}`, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\n}`,
-    x)\n}\n"
+  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"typ\":\"JWT\",\r\n\
+    \ \"alg\":\"HS256\"}`, `{}`, `{\n\"kty\":\"oct\",\n\"k\":\"AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow\"\
+    \n}`, x)\n}\n"
   note: jwtencodesignraw/Empty JSON payload
   query: data.generated.p = x
   want_result:
diff --git a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0388.yaml b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0388.yaml
index 0010a2e420..ce6eea5c02 100644
--- a/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0388.yaml
+++ b/test/cases/testdata/jwtencodesignraw/test-jwtencodesignraw-0388.yaml
@@ -1,98 +1,16 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
-  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"alg\":\"RS256\"}`,
-    `{\"iss\":\"joe\",\r\n \"exp\":1300819380,\r\n \"http://example.com/is_root\":true}`,
-    `{\n    \"kty\":\"RSA\",\n    \"n\":\"ofgWCuLjybRlzo0tZWJjNiuSfb4p4fAkd_wWJcyQoTbji9k0l8W26mPddxHmfHQp-Vaw-4qPCJrcS2mJPMEzP1Pt0Bm4d4QlL-yRT-SFd2lZS-pCgNMsD1W_YpRPEwOWvG6b32690r2jZ47soMZo9wGzjb_7OMg0LOL-bSf63kpaSHSXndS5z5rexMdbBYUsLA9e-KXBdQOS-UTo7WTBEMa2R2CapHg665xsmtdVMTBQY4uDZlxvb3qCo5ZwKh9kG4LT6_I5IhlJH7aGhyxXFvUK-DWNmoudF8NAco9_h9iaGNj8q2ethFkMLs91kzk2PAcDTW9gb54h4FRWyuXpoQ\",\n
-    \   \"e\":\"AQAB\",\n    \"d\":\"Eq5xpGnNCivDflJsRQBXHx1hdR1k6Ulwe2JZD50LpXyWPEAeP88vLNO97IjlA7_GQ5sLKMgvfTeXZx9SE-7YwVol2NXOoAJe46sui395IW_GO-pWJ1O0BkTGoVEn2bKVRUCgu-GjBVaYLU6f3l9kJfFNS3E0QbVdxzubSu3Mkqzjkn439X0M_V51gfpRLI9JYanrC4D4qAdGcopV_0ZHHzQlBjudU2QvXt4ehNYTCBr6XCLQUShb1juUO1ZdiYoFaFQT5Tw8bGUl_x_jTj3ccPDVZFD9pIuhLhBOneufuBiB4cS98l2SR_RQyGWSeWjnczT0QU91p1DhOVRuOopznQ\",\n
-    \   \"p\":\"4BzEEOtIpmVdVEZNCqS7baC4crd0pqnRH_5IB3jw3bcxGn6QLvnEtfdUdiYrqBdss1l58BQ3KhooKeQTa9AB0Hw_Py5PJdTJNPY8cQn7ouZ2KKDcmnPGBY5t7yLc1QlQ5xHdwW1VhvKn-nXqhJTBgIPgtldC-KDV5z-y2XDwGUc\",\n
-    \   \"q\":\"uQPEfgmVtjL0Uyyx88GZFF1fOunH3-7cepKmtH4pxhtCoHqpWmT8YAmZxaewHgHAjLYsp1ZSe7zFYHj7C6ul7TjeLQeZD_YwD66t62wDmpe_HlB-TnBA-njbglfIsRLtXlnDzQkv5dTltRJ11BKBBypeeF6689rjcJIDEz9RWdc\",\n
-    \   \"dp\":\"BwKfV3Akq5_MFZDFZCnW-wzl-CCo83WoZvnLQwCTeDv8uzluRSnm71I3QCLdhrqE2e9YkxvuxdBfpT_PI7Yz-FOKnu1R6HsJeDCjn12Sk3vmAktV2zb34MCdy7cpdTh_YVr7tss2u6vneTwrA86rZtu5Mbr1C1XsmvkxHQAdYo0\",\n
-    \   \"dq\":\"h_96-mK1R_7glhsum81dZxjTnYynPbZpHziZjeeHcXYsXaaMwkOlODsWa7I9xXDoRwbKgB719rrmI2oKr6N3Do9U0ajaHF-NKJnwgjMd2w9cjz3_-kyNlxAr2v4IKhGNpmM5iIgOS1VZnOZ68m6_pbLBSp3nssTdlqvd0tIiTHU\",\n
-    \   \"qi\":\"IYd7DHOhrWvxkwPQsRM2tOgrjbcrfvtQJipd-DlcxyVuuM9sQLdgjVk2oy26F0EmpScGLq2MowX7fhd_QJQ3ydy5cY7YIBi87w93IKLEdfnbJtoOPLUW0ITrJReOgo1cq9SbsxYawBgfp_gh6A5603k2-ZQwVK0JKSHuLFkuQ3U\"\n
-    \ }`, x)\n}\n"
+  - "package generated\n\np = x {\n  io.jwt.encode_sign_raw(`{\"alg\":\"RS256\"}`,\
+    \ `{\"iss\":\"joe\",\r\n \"exp\":1300819380,\r\n \"http://example.com/is_root\"\
+    :true}`, `{\n    \"kty\":\"RSA\",\n    \"n\":\"ofgWCuLjybRlzo0tZWJjNiuSfb4p4fAkd_wWJcyQoTbji9k0l8W26mPddxHmfHQp-Vaw-4qPCJrcS2mJPMEzP1Pt0Bm4d4QlL-yRT-SFd2lZS-pCgNMsD1W_YpRPEwOWvG6b32690r2jZ47soMZo9wGzjb_7OMg0LOL-bSf63kpaSHSXndS5z5rexMdbBYUsLA9e-KXBdQOS-UTo7WTBEMa2R2CapHg665xsmtdVMTBQY4uDZlxvb3qCo5ZwKh9kG4LT6_I5IhlJH7aGhyxXFvUK-DWNmoudF8NAco9_h9iaGNj8q2ethFkMLs91kzk2PAcDTW9gb54h4FRWyuXpoQ\"\
+    ,\n    \"e\":\"AQAB\",\n    \"d\":\"Eq5xpGnNCivDflJsRQBXHx1hdR1k6Ulwe2JZD50LpXyWPEAeP88vLNO97IjlA7_GQ5sLKMgvfTeXZx9SE-7YwVol2NXOoAJe46sui395IW_GO-pWJ1O0BkTGoVEn2bKVRUCgu-GjBVaYLU6f3l9kJfFNS3E0QbVdxzubSu3Mkqzjkn439X0M_V51gfpRLI9JYanrC4D4qAdGcopV_0ZHHzQlBjudU2QvXt4ehNYTCBr6XCLQUShb1juUO1ZdiYoFaFQT5Tw8bGUl_x_jTj3ccPDVZFD9pIuhLhBOneufuBiB4cS98l2SR_RQyGWSeWjnczT0QU91p1DhOVRuOopznQ\"\
+    ,\n    \"p\":\"4BzEEOtIpmVdVEZNCqS7baC4crd0pqnRH_5IB3jw3bcxGn6QLvnEtfdUdiYrqBdss1l58BQ3KhooKeQTa9AB0Hw_Py5PJdTJNPY8cQn7ouZ2KKDcmnPGBY5t7yLc1QlQ5xHdwW1VhvKn-nXqhJTBgIPgtldC-KDV5z-y2XDwGUc\"\
+    ,\n    \"q\":\"uQPEfgmVtjL0Uyyx88GZFF1fOunH3-7cepKmtH4pxhtCoHqpWmT8YAmZxaewHgHAjLYsp1ZSe7zFYHj7C6ul7TjeLQeZD_YwD66t62wDmpe_HlB-TnBA-njbglfIsRLtXlnDzQkv5dTltRJ11BKBBypeeF6689rjcJIDEz9RWdc\"\
+    ,\n    \"dp\":\"BwKfV3Akq5_MFZDFZCnW-wzl-CCo83WoZvnLQwCTeDv8uzluRSnm71I3QCLdhrqE2e9YkxvuxdBfpT_PI7Yz-FOKnu1R6HsJeDCjn12Sk3vmAktV2zb34MCdy7cpdTh_YVr7tss2u6vneTwrA86rZtu5Mbr1C1XsmvkxHQAdYo0\"\
+    ,\n    \"dq\":\"h_96-mK1R_7glhsum81dZxjTnYynPbZpHziZjeeHcXYsXaaMwkOlODsWa7I9xXDoRwbKgB719rrmI2oKr6N3Do9U0ajaHF-NKJnwgjMd2w9cjz3_-kyNlxAr2v4IKhGNpmM5iIgOS1VZnOZ68m6_pbLBSp3nssTdlqvd0tIiTHU\"\
+    ,\n    \"qi\":\"IYd7DHOhrWvxkwPQsRM2tOgrjbcrfvtQJipd-DlcxyVuuM9sQLdgjVk2oy26F0EmpScGLq2MowX7fhd_QJQ3ydy5cY7YIBi87w93IKLEdfnbJtoOPLUW0ITrJReOgo1cq9SbsxYawBgfp_gh6A5603k2-ZQwVK0JKSHuLFkuQ3U\"\
+    \n  }`, x)\n}\n"
   note: jwtencodesignraw/https://tools.ietf.org/html/rfc7515#appendix-A.2
   query: data.generated.p = x
   want_result:
diff --git a/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0440.yaml b/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0440.yaml
index 078e7cc1dc..696b0f6943 100644
--- a/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0440.yaml
+++ b/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0440.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0441.yaml b/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0441.yaml
index c2ce90eb0a..4b54ab1328 100644
--- a/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0441.yaml
+++ b/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0441.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0442.yaml b/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0442.yaml
index 4d5eee6831..4ccb0f4ea4 100644
--- a/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0442.yaml
+++ b/test/cases/testdata/jwtverifyhs256/test-jwtverifyhs256-0442.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyhs256/failure-invalid token
   query: data.generated.p = x
+  strict_error: true
   want_error: encoded JWT must have 3 sections, found 2
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0443.yaml b/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0443.yaml
index 5341aa276d..3cfd67fc35 100644
--- a/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0443.yaml
+++ b/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0443.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0444.yaml b/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0444.yaml
index 3972f1fc54..89e0ba1612 100644
--- a/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0444.yaml
+++ b/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0444.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0445.yaml b/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0445.yaml
index b4134bbd63..ea9d885722 100644
--- a/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0445.yaml
+++ b/test/cases/testdata/jwtverifyhs384/test-jwtverifyhs384-0445.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyhs384/failure-invalid token
   query: data.generated.p = x
+  strict_error: true
   want_error: encoded JWT must have 3 sections, found 2
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0446.yaml b/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0446.yaml
index 6b445f311a..3a9cb8b873 100644
--- a/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0446.yaml
+++ b/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0446.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0447.yaml b/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0447.yaml
index 74b67ac9b8..1630d745cb 100644
--- a/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0447.yaml
+++ b/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0447.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0448.yaml b/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0448.yaml
index 32bd42ce37..3f3c42adca 100644
--- a/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0448.yaml
+++ b/test/cases/testdata/jwtverifyhs512/test-jwtverifyhs512-0448.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyhs512/failure-invalid token
   query: data.generated.p = x
+  strict_error: true
   want_error: encoded JWT must have 3 sections, found 2
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0401.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0401.yaml
index 2123a8658d..ecb720686b 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0401.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0401.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0402.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0402.yaml
index 9b91e0ff5c..17fba965b3 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0402.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0402.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0403.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0403.yaml
index f7ff061dda..915f291ef3 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0403.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0403.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0404.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0404.yaml
index 8c78acfe2a..0d3f78b72e 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0404.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0404.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0405.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0405.yaml
index f4affabcef..7fce39710d 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0405.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0405.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0406.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0406.yaml
index 69aca9e752..1ab1394f7e 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0406.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0406.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0407.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0407.yaml
index badffbe9e2..4078450627 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0407.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0407.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0408.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0408.yaml
index db9f1c24de..f9031f175b 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0408.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0408.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0409.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0409.yaml
index dd389c908d..1dfda0a826 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0409.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0409.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0410.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0410.yaml
index 5e62887d1a..cf4de8b17b 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0410.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0410.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0411.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0411.yaml
index 36759fd6fa..17612d41a8 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0411.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0411.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyrsa/failure-invalid token
   query: data.generated.p = x
+  strict_error: true
   want_error: encoded JWT must have 3 sections, found 2
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0412.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0412.yaml
index 21f4b7be8f..04c1781865 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0412.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0412.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyrsa/failure-bad pem certificate block
   query: data.generated.p = x
+  strict_error: true
   want_error: failed to extract a Key from the PEM certificate
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0413.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0413.yaml
index 29d7dd3bc0..5cf90feeff 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0413.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0413.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyrsa/failure-extra data after pem certificate block
   query: data.generated.p = x
+  strict_error: true
   want_error: extra data after a PEM certificate block
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0414.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0414.yaml
index 65bd924184..03a8174363 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0414.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0414.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyrsa/failure-bad pem certificate
   query: data.generated.p = x
+  strict_error: true
   want_error: failed to parse a PEM certificate
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0415.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0415.yaml
index 869d34be44..bf890d78da 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0415.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0415.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,6 +9,6 @@ cases:
     }
   note: jwtverifyrsa/failure-bad jwk key
   query: data.generated.p = x
+  strict_error: true
   want_error: failed to parse a JWK key (set)
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0416.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0416.yaml
index 927dc1e133..5577200e6e 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0416.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0416.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0417.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0417.yaml
index 9bb84d047c..4b3edcab86 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0417.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0417.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0418.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0418.yaml
index febc32c26f..cf8a4bddfc 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0418.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0418.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0419.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0419.yaml
index e4c6846c8c..98b9cd90ab 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0419.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0419.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0420.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0420.yaml
index 66210fd6ce..b4775fc2a0 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0420.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0420.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0421.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0421.yaml
index 515f74d0c6..0237e40f54 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0421.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0421.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0422.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0422.yaml
index 27d955c027..df57f7b845 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0422.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0422.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0423.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0423.yaml
index 7cea22d99e..0cc908dca6 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0423.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0423.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0424.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0424.yaml
index cdec43e90a..eab36c3bf2 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0424.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0424.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0425.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0425.yaml
index 4e64d34af7..38028b7068 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0425.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0425.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0426.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0426.yaml
index c3c682f109..58217125c2 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0426.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0426.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0427.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0427.yaml
index 30843dc693..9fd4201f69 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0427.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0427.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0428.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0428.yaml
index b440e07921..41e47bcb6b 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0428.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0428.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0429.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0429.yaml
index 086e51cb93..ae4ae16f60 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0429.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0429.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0430.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0430.yaml
index 35bd9f07c7..740738ae63 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0430.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0430.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0431.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0431.yaml
index 96152a83ce..1e77cd2235 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0431.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0431.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0432.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0432.yaml
index b8306d4440..6d3a5996c6 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0432.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0432.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0433.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0433.yaml
index 041fb916bb..0d6b50dfb1 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0433.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0433.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0434.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0434.yaml
index 9bd7da2326..552c546b6c 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0434.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0434.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0435.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0435.yaml
index c3c7908627..59d75ca427 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0435.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0435.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0436.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0436.yaml
index 845509a17a..527f3e1152 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0436.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0436.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0437.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0437.yaml
index 4e79cad1cb..161d5dd28e 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0437.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0437.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0438.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0438.yaml
index 54ebbbc48a..11f6292369 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0438.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0438.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0439.yaml b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0439.yaml
index 3b9e1a08e6..3172690bec 100644
--- a/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0439.yaml
+++ b/test/cases/testdata/jwtverifyrsa/test-jwtverifyrsa-0439.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/negation/test-negation-0779.yaml b/test/cases/testdata/negation/test-negation-0779.yaml
index 6911c82d94..7679884d43 100644
--- a/test/cases/testdata/negation/test-negation-0779.yaml
+++ b/test/cases/testdata/negation/test-negation-0779.yaml
@@ -1,8 +1,5 @@
 cases:
-- data:
-    b:
-      v1: hello
-      v2: goodbye
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/negation/test-negation-data-ref-with-var.yaml b/test/cases/testdata/negation/test-negation-data-ref-with-var.yaml
index 41244bec2d..3d2b5b01d9 100644
--- a/test/cases/testdata/negation/test-negation-data-ref-with-var.yaml
+++ b/test/cases/testdata/negation/test-negation-data-ref-with-var.yaml
@@ -69,4 +69,4 @@ cases:
     p = 7
   note: 'negation/neg: ref with variable (miss) and virtual doc (hit)'
   query: data.foo.p = x
-  want_result: []
\ No newline at end of file
+  want_result: []
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0709.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0709.yaml
index 8453703949..a5d297bdde 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0709.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0709.yaml
@@ -5,49 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
     h:
     - - 1
       - 2
@@ -55,33 +12,6 @@ cases:
     - - 2
       - 3
       - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0710.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0710.yaml
index 3893d27648..5a35581e7f 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0710.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0710.yaml
@@ -5,49 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
     h:
     - - 1
       - 2
@@ -55,33 +12,6 @@ cases:
     - - 2
       - 3
       - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0711.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0711.yaml
index f66b32a53a..f9c91d863f 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0711.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0711.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0712.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0712.yaml
index 697867dd6a..cf7a0c1333 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0712.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0712.yaml
@@ -5,49 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
     h:
     - - 1
       - 2
@@ -55,33 +12,6 @@ cases:
     - - 2
       - 3
       - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0713.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0713.yaml
index 73bafb893c..761be5c57a 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0713.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0713.yaml
@@ -5,49 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
     h:
     - - 1
       - 2
@@ -55,33 +12,6 @@ cases:
     - - 2
       - 3
       - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0714.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0714.yaml
index 489a8c1744..60e64fbfdf 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0714.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0714.yaml
@@ -5,82 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
     three: 3
   modules:
   - |
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0715.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0715.yaml
index f1e50ede3c..4217e0e9cc 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0715.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0715.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0716.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0716.yaml
index 806b2df74c..8b39ce88ce 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0716.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0716.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0717.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0717.yaml
index 9db0c27b35..8151c4f89b 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0717.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0717.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0718.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0718.yaml
index c485fde44d..1afa891a2c 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0718.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0718.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0719.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0719.yaml
index 9086965f7e..2797a63894 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0719.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0719.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0720.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0720.yaml
index 4e2392e143..0739fda201 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0720.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0720.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0721.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0721.yaml
index 8f9ed6b89a..eb16a90132 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0721.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0721.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0722.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0722.yaml
index 27bd4fa699..a9c499aa39 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0722.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0722.yaml
@@ -8,80 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0723.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0723.yaml
index 41b7263974..e62c205e49 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0723.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0723.yaml
@@ -8,80 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0724.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0724.yaml
index 9f7f0a2a0d..c53c953ee2 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0724.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0724.yaml
@@ -5,83 +5,14 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
     strings:
       bar: 2
       baz: 3
       foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/nestedreferences/test-nestedreferences-0725.yaml b/test/cases/testdata/nestedreferences/test-nestedreferences-0725.yaml
index 255f36ccce..712c1ef044 100644
--- a/test/cases/testdata/nestedreferences/test-nestedreferences-0725.yaml
+++ b/test/cases/testdata/nestedreferences/test-nestedreferences-0725.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0092.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0092.yaml
index 39198580d3..2a3b5cae3a 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0092.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0092.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0093.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0093.yaml
index b73846ebc0..6d72c77e62 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0093.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0093.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0094.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0094.yaml
index a4b7210982..aa46995913 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0094.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0094.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0095.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0095.yaml
index b5716f0842..13418b7ed6 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0095.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0095.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0096.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0096.yaml
index c309de7dde..ccf0f869bd 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0096.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0096.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0097.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0097.yaml
index ebb1819b81..8ed6a84991 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0097.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0097.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0098.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0098.yaml
index 494230d951..9c49209a3e 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0098.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0098.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0099.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0099.yaml
index 5b9e0f485c..77fe4666dd 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0099.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0099.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0102.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0102.yaml
index 1c41682608..7dd2de8868 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0102.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0102.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0103.yaml b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0103.yaml
index 3266d6dc61..43ef778503 100644
--- a/test/cases/testdata/netcidrcontains/test-netcidrcontains-0103.yaml
+++ b/test/cases/testdata/netcidrcontains/test-netcidrcontains-0103.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0104.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0104.yaml
index f04ab8c024..5c93aafc5b 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0104.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0104.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0105.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0105.yaml
index e951cf5e8b..a3f3172d66 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0105.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0105.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0106.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0106.yaml
index b0414fd7d4..71ab89f039 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0106.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0106.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0107.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0107.yaml
index 64fc8f97d1..647851b8b1 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0107.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0107.yaml
@@ -13,7 +13,7 @@ cases:
     }
   note: netcidrcontainsmatches/bad array
   query: data.generated.p = x
+  strict_error: true
   want_error: 'net.cidr_contains_matches: operand 2: element must be string or non-empty
     array'
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0108.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0108.yaml
index 5a623932ff..fed10d441b 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0108.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0108.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0109.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0109.yaml
index d55704ab85..8a3413bf5c 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0109.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0109.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0110.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0110.yaml
index e5da8d7f6e..1f99501e71 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0110.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0110.yaml
@@ -13,7 +13,7 @@ cases:
     }
   note: netcidrcontainsmatches/bad set
   query: data.generated.p = x
+  strict_error: true
   want_error: 'net.cidr_contains_matches: operand 2: element must be string or non-empty
     array'
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0112.yaml b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0112.yaml
index ca6c3151e9..583d9b1b79 100644
--- a/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0112.yaml
+++ b/test/cases/testdata/netcidrcontainsmatches/test-netcidrcontainsmatches-0112.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrexpand/test-netcidrexpand-0114.yaml b/test/cases/testdata/netcidrexpand/test-netcidrexpand-0114.yaml
index d7f1e4e978..e83238f5b5 100644
--- a/test/cases/testdata/netcidrexpand/test-netcidrexpand-0114.yaml
+++ b/test/cases/testdata/netcidrexpand/test-netcidrexpand-0114.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrexpand/test-netcidrexpand-0115.yaml b/test/cases/testdata/netcidrexpand/test-netcidrexpand-0115.yaml
index 89638ec9df..17046788fb 100644
--- a/test/cases/testdata/netcidrexpand/test-netcidrexpand-0115.yaml
+++ b/test/cases/testdata/netcidrexpand/test-netcidrexpand-0115.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0086.yaml b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0086.yaml
index 2bf7125ea6..c876bdc88e 100644
--- a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0086.yaml
+++ b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0086.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0087.yaml b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0087.yaml
index 2ec6bf288f..aff07ad81c 100644
--- a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0087.yaml
+++ b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0087.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0088.yaml b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0088.yaml
index 1fe050a026..e216d93251 100644
--- a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0088.yaml
+++ b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0088.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0089.yaml b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0089.yaml
index 38479033cf..79f1c5aa2e 100644
--- a/test/cases/testdata/netcidrintersects/test-netcidrintersects-0089.yaml
+++ b/test/cases/testdata/netcidrintersects/test-netcidrintersects-0089.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidrisvalid/test_netcidrisvalid-0001.yaml b/test/cases/testdata/netcidrisvalid/test_netcidrisvalid-0001.yaml
new file mode 100644
index 0000000000..2c46d5ed1b
--- /dev/null
+++ b/test/cases/testdata/netcidrisvalid/test_netcidrisvalid-0001.yaml
@@ -0,0 +1,66 @@
+cases:
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p = x {
+      net.cidr_is_valid("192.168.1.0/24", __local0__)
+      x = __local0__
+    }
+  note: valid ipv4 cidr
+  query: data.generated.p = x
+  want_result:
+  - x: true
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p = x {
+      net.cidr_is_valid("", __local0__)
+      x = __local0__
+    }
+  note: empty cidr
+  query: data.generated.p = x
+  want_result:
+  - x: false
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p = x {
+      net.cidr_is_valid("there goes a string", __local0__)
+      x = __local0__
+    }
+  note: random string
+  query: data.generated.p = x
+  want_result:
+  - x: false
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p = x {
+      net.cidr_is_valid("192.168.1.2", __local0__)
+      x = __local0__
+    }
+  note: valid ipv4 address
+  query: data.generated.p = x
+  want_result:
+  - x: false
+- data: {}
+  modules:
+  - |
+    package generated
+
+    p = x {
+      net.cidr_is_valid("2002::1234:abcd:ffff:c0a8:101/64", __local0__)
+      x = __local0__
+    }
+  note: valid ipv6 cidr
+  query: data.generated.p = x
+  want_result:
+  - x: true
diff --git a/test/cases/testdata/netcidrmerge/test-ipv6-with-and-without-prefix.yaml b/test/cases/testdata/netcidrmerge/test-ipv6-with-and-without-prefix.yaml
new file mode 100644
index 0000000000..8642fc6e0a
--- /dev/null
+++ b/test/cases/testdata/netcidrmerge/test-ipv6-with-and-without-prefix.yaml
@@ -0,0 +1,59 @@
+cases:
+- note: netcidrmerge/cidr ipv6 with prefix
+  modules:
+  - |
+    package test
+
+    p = x {
+      net.cidr_merge(["2601:600:8a80:207e:a57d:7567:e2c9:e7b3/128"], x)
+    }
+  query: data.test.p = x
+  want_result:
+  - x:
+    - "2601:600:8a80:207e:a57d:7567:e2c9:e7b3/128"
+- note: netcidrmerge/cidr ipv6 with prefix, same twice
+  modules:
+  - |
+    package test
+
+    p = x {
+      net.cidr_merge(["2601:600:8a80:207e:a57d:7567:e2c9:e7b3/128", "2601:600:8a80:207e:a57d:7567:e2c9:e7b3/128"], x)
+    }
+  query: data.test.p = x
+  want_result:
+  - x:
+    - "2601:600:8a80:207e:a57d:7567:e2c9:e7b3/128"
+- note: netcidrmerge/cidr ipv6 with prefix, two different prefixes
+  modules:
+  - |
+    package test
+
+    p = x {
+      net.cidr_merge(["2601:600:8a80:207e:a57d:7567:e2c9:e7b3/64", "2601:600:8a80:207e:a57d:7567:e2c9:e7b3/128"], x)
+    }
+  query: data.test.p = x
+  want_result:
+  - x:
+    - "2601:600:8a80:207e::/64"
+- note: netcidrmerge/cidr ipv6 without prefix
+  modules:
+  - |
+    package test
+
+    p = x {
+      net.cidr_merge(["2601:600:8a80:207e:a57d:7567:e2c9:e7b3"], x)
+    }
+  query: data.test.p = x
+  strict_error: true
+  want_error: "eval_builtin_error: net.cidr_merge: IPv6 invalid: needs prefix length"
+- note: netcidrmerge/cidr ipv6 without prefix, same twice
+  modules:
+  - |
+    package test
+
+    p = x {
+      net.cidr_merge(["2601:600:8a80:207e:a57d:7567:e2c9:e7b3", "2601:600:8a80:207e:a57d:7567:e2c9:e7b3"], x)
+    }
+  query: data.test.p = x
+  strict_error: true
+  want_error: "eval_builtin_error: net.cidr_merge: IPv6 invalid: needs prefix length"
\ No newline at end of file
diff --git a/test/cases/testdata/netcidroverlap/test-netcidroverlap-0084.yaml b/test/cases/testdata/netcidroverlap/test-netcidroverlap-0084.yaml
index 39b10f7ef4..dc3dd17cf5 100644
--- a/test/cases/testdata/netcidroverlap/test-netcidroverlap-0084.yaml
+++ b/test/cases/testdata/netcidroverlap/test-netcidroverlap-0084.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/netcidroverlap/test-netcidroverlap-0085.yaml b/test/cases/testdata/netcidroverlap/test-netcidroverlap-0085.yaml
index 1fe721b63e..d339ee4040 100644
--- a/test/cases/testdata/netcidroverlap/test-netcidroverlap-0085.yaml
+++ b/test/cases/testdata/netcidroverlap/test-netcidroverlap-0085.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/objectfilter/test-objectfilter-0314.yaml b/test/cases/testdata/objectfilter/test-objectfilter-0314.yaml
index 89efc74626..af808d8ebf 100644
--- a/test/cases/testdata/objectfilter/test-objectfilter-0314.yaml
+++ b/test/cases/testdata/objectfilter/test-objectfilter-0314.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectfilter/error invalid key param type string input
   query: data.generated.p = x
-  want_error: 'object.filter: operand 2 must be one of {object, string, array} but
-    got string'
+  want_error: 'object.filter: operand 2 must be one of {object, set, array} but got string'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectfilter/test-objectfilter-0315.yaml b/test/cases/testdata/objectfilter/test-objectfilter-0315.yaml
index 7e5ee7297f..b43d273919 100644
--- a/test/cases/testdata/objectfilter/test-objectfilter-0315.yaml
+++ b/test/cases/testdata/objectfilter/test-objectfilter-0315.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectfilter/error invalid key param type boolean input
   query: data.generated.p = x
-  want_error: 'object.filter: operand 2 must be one of {object, string, array} but
-    got boolean'
+  want_error: 'object.filter: operand 2 must be one of {object, set, array} but got boolean'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectfilter/test-objectfilter-0316.yaml b/test/cases/testdata/objectfilter/test-objectfilter-0316.yaml
index 43305dca96..b2b54243d7 100644
--- a/test/cases/testdata/objectfilter/test-objectfilter-0316.yaml
+++ b/test/cases/testdata/objectfilter/test-objectfilter-0316.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectfilter/error invalid key param type number input
   query: data.generated.p = x
-  want_error: 'object.filter: operand 2 must be one of {object, string, array} but
-    got number'
+  want_error: 'object.filter: operand 2 must be one of {object, set, array} but got number'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectfilter/test-objectfilter-0317.yaml b/test/cases/testdata/objectfilter/test-objectfilter-0317.yaml
index 4a4eb6e95c..8717b735a0 100644
--- a/test/cases/testdata/objectfilter/test-objectfilter-0317.yaml
+++ b/test/cases/testdata/objectfilter/test-objectfilter-0317.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectfilter/error invalid key param type nil input
   query: data.generated.p = x
-  want_error: 'object.filter: operand 2 must be one of {object, string, array} but
-    got null'
+  want_error: 'object.filter: operand 2 must be one of {object, set, array} but got null'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectget/test-objectget-path.yaml b/test/cases/testdata/objectget/test-objectget-path.yaml
new file mode 100644
index 0000000000..9a0a08a80d
--- /dev/null
+++ b/test/cases/testdata/objectget/test-objectget-path.yaml
@@ -0,0 +1,124 @@
+cases:
+- note: objectget/empty_path_returns_object
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({"a": 1}, [], 2)
+      }
+  want_result: [{x: {a: 1}}]
+
+- note: objectget/path_with_single_element
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": 1 }, ["a"], 2)
+      }
+  want_result: [{x: 1}]
+
+- note: objectget/path_with_two_elements
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": { "b": 1 } }, ["a", "b"], 2)
+      }
+  want_result: [{x: 1}]
+
+- note: objectget/path_with_three_elements
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": { "b": { "c": 1 } } }, ["a", "b", "c"], 2)
+      }
+  want_result: [{x: 1}]
+
+- note: objectget/path_with_single_element_no_result
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": 1 }, ["b"], 2)
+      }
+  want_result: [{x: 2}]
+
+- note: objectget/path_with_two_elements_no_result
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": { "b": 1 } }, ["b", "a"], 2)
+      }
+  want_result: [{x: 2}]
+
+- note: objectget/path_with_three_elements_no_result
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": { "b": { "c": 1 } } }, ["a", "b", "a"], 2)
+      }
+  want_result: [{x: 2}]
+
+- note: objectget/path_with_non_string_keys
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ 1: { "b": { [1,2,3]: 1 } } }, [1, "b", [1,2,3]], 2)
+      }
+  want_result: [{x: 1}]
+
+- note: objectget/get_intermediate_non_object
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": { "b": [1,2,3] } }, ["a", "b", "a"], 2)
+      }
+  want_result: [{x: 2}]
+
+- note: objectget/get_intermediate_array
+  query: data.test.p = x
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get({ "a": { "b": [{"c": 1}] } }, ["a", "b", 0, "c"], 2)
+      }
+  want_result: [{x: 1}]
+
+- note: objectget/get_for_non_object
+  query: data.test.p = x
+  input_term: '{"obj":"object"}'
+  modules:
+    - |
+      package test
+      
+      p = x {
+        x := object.get(input.obj, ["a"], 2)
+      }
+  want_error: 'object.get: operand 1 must be object but got string'
+  want_error_code: eval_type_error
+  strict_error: true
diff --git a/test/cases/testdata/objectkeys/test-objectkeys.yaml b/test/cases/testdata/objectkeys/test-objectkeys.yaml
new file mode 100644
index 0000000000..d75374e133
--- /dev/null
+++ b/test/cases/testdata/objectkeys/test-objectkeys.yaml
@@ -0,0 +1,69 @@
+cases:
+  - note: objectkeys/string_keys_found
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := object.keys({"a": 1, "b": 2})
+    want_result:
+      - x:
+          - a
+          - b
+  - note: objectkeys/number_keys_found
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := object.keys({1: 1, 2: 2})
+    want_result:
+      - x:
+          - 1
+          - 2
+  - note: objectkeys/object_keys_found
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := object.keys({{"a": 1}: 1, {"b": 2}: 2})
+    want_result:
+      - x:
+          - a: 1
+          - b: 2
+  - note: objectkeys/set_keys_found
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := object.keys({{"a"}: 1, {"b"}: 2})
+    want_result:
+      - x:
+          - [a]
+          - [b]
+  - note: objectkeys/array_keys_found
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := object.keys({["a"]: 1, ["b"]: 2})
+    want_result:
+      - x:
+          - [a]
+          - [b]
+  - note: objectkeys/empty_result
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := object.keys({})
+    want_result:
+      - x: []
+  - note: objectkeys/error_on_non_object
+    query: data.test.p = x
+    input_term: '{"obj":"object"}'
+    modules:
+      - |
+        package test
+        p := object.keys(input.obj)
+    want_error: 'object.keys: operand 1 must be object but got string'
+    want_error_code: eval_type_error
+    strict_error: true
diff --git a/test/cases/testdata/objectremove/test-objectremove-0294.yaml b/test/cases/testdata/objectremove/test-objectremove-0294.yaml
index 918783e93a..946baac88b 100644
--- a/test/cases/testdata/objectremove/test-objectremove-0294.yaml
+++ b/test/cases/testdata/objectremove/test-objectremove-0294.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectremove/error invalid key param type string input
   query: data.generated.p = x
-  want_error: 'object.remove: operand 2 must be one of {object, string, array} but
-    got string'
+  want_error: 'object.remove: operand 2 must be one of {object, set, array} but got string'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectremove/test-objectremove-0295.yaml b/test/cases/testdata/objectremove/test-objectremove-0295.yaml
index e6bf64b323..2b1dce7e1b 100644
--- a/test/cases/testdata/objectremove/test-objectremove-0295.yaml
+++ b/test/cases/testdata/objectremove/test-objectremove-0295.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectremove/error invalid key param type boolean input
   query: data.generated.p = x
-  want_error: 'object.remove: operand 2 must be one of {object, string, array} but
-    got boolean'
+  want_error: 'object.remove: operand 2 must be one of {object, set, array} but got boolean'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectremove/test-objectremove-0296.yaml b/test/cases/testdata/objectremove/test-objectremove-0296.yaml
index d686ae8037..cf7811588e 100644
--- a/test/cases/testdata/objectremove/test-objectremove-0296.yaml
+++ b/test/cases/testdata/objectremove/test-objectremove-0296.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectremove/error invalid key param type number input
   query: data.generated.p = x
-  want_error: 'object.remove: operand 2 must be one of {object, string, array} but
-    got number'
+  want_error: 'object.remove: operand 2 must be one of {object, set, array} but got number'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectremove/test-objectremove-0297.yaml b/test/cases/testdata/objectremove/test-objectremove-0297.yaml
index 1e8ee4c06f..b23d47856c 100644
--- a/test/cases/testdata/objectremove/test-objectremove-0297.yaml
+++ b/test/cases/testdata/objectremove/test-objectremove-0297.yaml
@@ -12,7 +12,6 @@ cases:
     }
   note: objectremove/error invalid key param type nil input
   query: data.generated.p = x
-  want_error: 'object.remove: operand 2 must be one of {object, string, array} but
-    got null'
+  want_error: 'object.remove: operand 2 must be one of {object, set, array} but got null'
   want_error_code: eval_type_error
   strict_error: true
diff --git a/test/cases/testdata/objectunionn/test-objectunionn-0001.yaml b/test/cases/testdata/objectunionn/test-objectunionn-0001.yaml
new file mode 100644
index 0000000000..447d9f3d56
--- /dev/null
+++ b/test/cases/testdata/objectunionn/test-objectunionn-0001.yaml
@@ -0,0 +1,79 @@
+cases:
+- note: objectunionn/empty array
+  modules:
+  - |
+    package test
+
+    p := object.union_n([{}])
+
+  query: data.test.p = x
+  want_result:
+  - x: {}
+
+- note: objectunionn/single item array
+  modules:
+  - |
+    package test
+
+    p := object.union_n([{"foo": "bar"}])
+
+  query: data.test.p = x
+  want_result:
+  - x: {"foo": "bar"}
+
+- note: objectunionn/merge objects
+  modules:
+    - |
+      package test
+
+      x := object.union_n([{"foo": "bar"}, {"x": "y"}])
+
+  query: data.test.x = x
+  want_result:
+    - x: {"foo": "bar", "x": "y"}
+
+- note: objectunionn/merge objects conflict
+  modules:
+    - |
+      package test
+
+      x := object.union_n([{"foo": "bar"}, {"foo": "baz"}])
+
+  query: data.test.x = x
+  want_result:
+    - x: {"foo": "baz"}
+
+- note: objectunionn/merge objects extended
+  modules:
+    - |
+      package test
+
+      x := object.union_n([{
+        "a": 1,
+        "b": 2,
+        "c": 3,
+      }, {
+        "foo": "baz",
+        "a": "a",
+        "b": 2,
+        "d": 4,
+      }, {
+        "a": "final A!",
+        "e": 5.0,
+      }])
+
+  query: data.test.x = x
+  want_result:
+    - x: {"foo": "baz", "a": "final A!", "b": 2, "c": 3, "d": 4, "e": 5.0}
+
+- note: "# 5073 regression test"
+  input_term: '[{"foo": 1}, {"bar": 2}, "baz"]'
+  modules:
+    - |
+      package test
+
+      x := object.union_n(input)
+
+  query: data.test.x = x
+  want_error_code: eval_type_error
+  strict_error: true
diff --git a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0984.yaml b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0984.yaml
index 94a25ccb49..d80072f0c6 100644
--- a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0984.yaml
+++ b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0984.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
diff --git a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0985.yaml b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0985.yaml
index d04646d187..0811c79444 100644
--- a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0985.yaml
+++ b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0985.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
diff --git a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0986.yaml b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0986.yaml
index e66291fb4e..cc1c963d26 100644
--- a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0986.yaml
+++ b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0986.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"foo": 7}'
   modules:
   - |
diff --git a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0987.yaml b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0987.yaml
index 4159a4a5e7..6e902cc540 100644
--- a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0987.yaml
+++ b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0987.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package topdown_test_partial
diff --git a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0988.yaml b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0988.yaml
index b9f658ee30..30ed7aca98 100644
--- a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0988.yaml
+++ b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0988.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package ex
diff --git a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0989.yaml b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0989.yaml
index 8fc51a00ac..0a7d7a3a10 100644
--- a/test/cases/testdata/partialdocconstants/test-partialdocconstants-0989.yaml
+++ b/test/cases/testdata/partialdocconstants/test-partialdocconstants-0989.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"foo": 7}'
   modules:
   - |
diff --git a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0519.yaml b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0519.yaml
index bb1e0ee01f..051823d64a 100644
--- a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0519.yaml
+++ b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0519.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0520.yaml b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0520.yaml
index 569dc5755a..9aea1abaac 100644
--- a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0520.yaml
+++ b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0520.yaml
@@ -1,87 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0521.yaml b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0521.yaml
index 998f5fcb53..67aeed8f77 100644
--- a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0521.yaml
+++ b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0521.yaml
@@ -5,33 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
     g:
       a:
       - 1
@@ -48,40 +21,6 @@ cases:
       - 0
       - 0
       - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0522.yaml b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0522.yaml
index c10c8a1323..14762ac163 100644
--- a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0522.yaml
+++ b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0522.yaml
@@ -1,37 +1,5 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
     g:
       a:
       - 1
@@ -48,40 +16,6 @@ cases:
       - 0
       - 0
       - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0523.yaml b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0523.yaml
index 2ffec22b15..1a5fa97f85 100644
--- a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0523.yaml
+++ b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0523.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0524.yaml b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0524.yaml
index 1927f2bb18..92170292cd 100644
--- a/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0524.yaml
+++ b/test/cases/testdata/partialobjectdoc/test-partialobjectdoc-0524.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -94,6 +12,6 @@ cases:
   query: data.generated.p = x
   want_result:
   - x:
+      '1': 1
+      'null': 1
       '{}': 1
-      "1": 1
-      "null": 1
diff --git a/test/cases/testdata/partialobjectdoc/test-wasm-cases.yaml b/test/cases/testdata/partialobjectdoc/test-wasm-cases.yaml
new file mode 100644
index 0000000000..d1da298df4
--- /dev/null
+++ b/test/cases/testdata/partialobjectdoc/test-wasm-cases.yaml
@@ -0,0 +1,106 @@
+
+# NOTE(sr): These test cases stem from cases we run against the wasm
+# module but since the ref-heads change made them fail -- because of
+# changes to the typing of partial object rules (which are now single-
+# valued rules), they're added to the topdown tests, too.
+cases:
+  - note: wasm/additive
+    query: 'data.x.q = x'
+    modules:
+      - |
+        package x
+        p["a"] = 1
+        p["b"] = 2
+
+        q {
+          p == {"a": 1, "b": 2}
+        }
+    want_result:
+    - x: true
+  - note: wasm/additive (negative)
+    query: 'data.x.p = input'
+    input: {"a": 1, "b": 2}
+    modules:
+      - |
+        package x
+        p["a"] = 1
+        p["b"] = 2
+        p["c"] = 3
+    want_result: []
+  - note: wasm/input
+    query: 'data.x.q = x'
+    modules:
+      - |
+        package x
+        p["a"] = 1 { input.x = 1 }
+        p["b"] = 2 { input.y = 2 }
+
+        q {
+          p == {"a": 1, "b": 2}
+        }
+    input: {"x": 1, "y": 2}
+    want_result:
+    - x: true
+  - note: wasm/input (negative)
+    query: 'data.x.q = x'
+    data:
+      z:
+        a: 1
+        b: 2
+    modules:
+      - |
+        package x
+        p["a"] = 1 { input.x = 1 }
+        p["b"] = 2 { input.y = 2 }
+        p["c"] = 3 { input.z = 3 }
+
+        q {
+          p == data.z
+        }
+    want_result:
+    - x: true
+    input: {"x": 1, "y": 2}
+  - note: wasm/composites
+    query: 'data.x.q = x'
+    modules:
+      - |
+        package x
+        p[x] = [y] { x = "a"; y = 1 }
+        p[x] = [y] { x = "b"; y = 2 }
+
+        q { p == {"a": [1], "b": [2]} }
+    want_result:
+    - x : true
+  - note: wasm/conflict error
+    query: 'data.x.q = x'
+    data:
+      z:
+        a: 1
+    modules:
+      - |
+        package x
+        p["x"] = 1
+        p["x"] = 2
+        q { 
+          p == data.z
+        }
+    want_error: "test-0.rego:3: eval_conflict_error: complete rules must not produce multiple outputs"
+    want_error_code: eval_conflict_error
+  - note: wasm/object dereference
+    query: 'data.x.q = x'
+    modules:
+      - |
+        package x
+        p["a"] = {"b": 1}
+        q { 
+          p.a.b = 1
+        }
+    want_result:
+    - x: true
+  - note: wasm/object dereference (negative)
+    query: data.x.p.a.b = 1
+    modules:
+      - |
+        package x
+        p["a"] = {"b": 2}
+    want_result: []
diff --git a/test/cases/testdata/partialsetdoc/test-issue-3819.yaml b/test/cases/testdata/partialsetdoc/test-issue-3819.yaml
index ad188dd9a5..83050747c5 100644
--- a/test/cases/testdata/partialsetdoc/test-issue-3819.yaml
+++ b/test/cases/testdata/partialsetdoc/test-issue-3819.yaml
@@ -1,8 +1,8 @@
 cases:
 - data:
     a:
-      bananas: 1
       apples: 2
+      bananas: 1
       clementines: 3
   modules:
   - |
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0511.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0511.yaml
index 9b6b9722e6..2fa9b71c5d 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0511.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0511.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0512.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0512.yaml
index 4bdef9f3a7..455396511b 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0512.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0512.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0513.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0513.yaml
index 9947f7656a..8ef8bc1af3 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0513.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0513.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0514.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0514.yaml
index ed1ec9fbc8..60bca63492 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0514.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0514.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0515.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0515.yaml
index ac9a98b9ce..867af715f4 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0515.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0515.yaml
@@ -1,28 +1,5 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
     f:
     - xs:
       - 1
@@ -32,56 +9,6 @@ cases:
       - 2
       ys:
       - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0516.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0516.yaml
index fd47af5c32..aabc06f38e 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0516.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0516.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0517.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0517.yaml
index 8b1a97f454..264ef7ce11 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0517.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0517.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0518.yaml b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0518.yaml
index 897f2a4ec2..f770b8c51b 100644
--- a/test/cases/testdata/partialsetdoc/test-partialsetdoc-0518.yaml
+++ b/test/cases/testdata/partialsetdoc/test-partialsetdoc-0518.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/planner-ir/test-array-ir-unify.yaml b/test/cases/testdata/planner-ir/test-array-ir-unify.yaml
new file mode 100644
index 0000000000..5ede0b0693
--- /dev/null
+++ b/test/cases/testdata/planner-ir/test-array-ir-unify.yaml
@@ -0,0 +1,46 @@
+cases:
+- note: ir/unification array and array comprehension
+  query: 'data.test.p = x'
+  modules:
+    - |
+      package test
+      p = foo {
+        [foo] = [x | x := 1]
+      }
+  want_result:
+  - x: 1
+- note: ir/unification array comprehension and array
+  query: 'data.test.p = x'
+  modules:
+    - |
+      package test
+      p = foo {
+        [x | x := 1] = [foo]
+      }
+  want_result:
+  - x: 1
+- note: ir/fixpoint key/value (negative)
+  query: 'data.test.p = x'
+  input:
+    foos: ["foo"]
+  modules:
+    - |
+      package test
+      p {
+        some foo
+        foo == input.foos[foo]
+      }
+  want_result: []
+- note: ir/fixpoint key/value
+  query: 'data.test.p = x'
+  input:
+    foos: [2, 1, 0]
+  modules:
+    - |
+      package test
+      p = foo {
+        some foo
+        foo == input.foos[foo]
+      }
+  want_result:
+  - x: 1
diff --git a/test/cases/testdata/planner-ir/test-call-dynamic.yaml b/test/cases/testdata/planner-ir/test-call-dynamic.yaml
new file mode 100644
index 0000000000..2993cb794f
--- /dev/null
+++ b/test/cases/testdata/planner-ir/test-call-dynamic.yaml
@@ -0,0 +1,69 @@
+cases:
+- note: ir/call_dynamic in comprehension
+  modules:
+  - |
+    package test
+    p := x {
+      b := input
+      x := { y | y := data.a[b][_] }
+    }
+  - |
+    package a
+    b := {"foo", "bar"}
+  - |
+    package a
+    c := {"x", "y" }
+  query: data.test.p = x
+  sort_bindings: true
+  input: "b"
+  want_result:
+  - x:
+    - bar
+    - foo
+- note: ir/no call-dynamic with mixed partial rules
+  modules:
+  - |
+    package test
+    import future.keywords.if
+    p := data.a.b[c] if c := "c"
+  - |
+    package a
+    import future.keywords.if
+    b[c] := "C" if c := "c"
+    b["d"] := "D"
+  query: data.test.p = x
+  want_result:
+  - x: C
+- note: ir/call-dynamic with mixed partial rules
+  modules:
+  - |
+    package test
+    import future.keywords.if
+    p := a[b].c if b := "b"
+    a.b.c := "C" if b := "b"
+    a.x.d := "D"
+  query: data.test.p = x
+  want_result:
+  - x: C
+- note: ir/no call-dynamic with mixed partial rules, ref heads
+  modules:
+  - |
+    package test
+    import future.keywords.if
+    p := a.b[c] if c := "c"
+    a.b[c] := "C" if c := "c"
+    a.b["d"] := "D"
+  query: data.test.p = x
+  want_result:
+  - x: C
+- note: ir/call-dynamic with mixed partial rules, ref heads
+  modules:
+  - |
+    package test
+    import future.keywords.if
+    p := a[b][c] if { b := "b"; c := "c" }
+    a.b.c := "C"
+    a.x.d := "D"
+  query: data.test.p = x
+  want_result:
+  - x: C
\ No newline at end of file
diff --git a/test/cases/testdata/providers-aws/aws-sign_req-errors.yaml b/test/cases/testdata/providers-aws/aws-sign_req-errors.yaml
new file mode 100644
index 0000000000..2b12e14448
--- /dev/null
+++ b/test/cases/testdata/providers-aws/aws-sign_req-errors.yaml
@@ -0,0 +1,148 @@
+cases:
+# http request object errors:
+- data:
+  modules:
+  - |
+    package test
+    req := {}
+    aws_config := {
+      "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+      "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+      "aws_session_token": "MYAWSSECURITYTOKENGOESHERE",
+      "aws_service": "s3",
+      "aws_region": "us-east-1",
+    }
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=0047a7016c81e5c7f29cd522f97e911e04fc472fced0aee7916cbc287ad6c8e3",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/failure-simple-missing http request keys
+  query: data.test.p = x
+  want_error_code: eval_type_error
+  want_error: "providers.aws.sign_req: operand 1 missing required request parameters(s): {\"method\", \"url\"}"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": set(), "url": set()}
+    aws_config := {
+      "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+      "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+      "aws_session_token": "MYAWSSECURITYTOKENGOESHERE",
+      "aws_service": "s3",
+      "aws_region": "us-east-1",
+    }
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=0047a7016c81e5c7f29cd522f97e911e04fc472fced0aee7916cbc287ad6c8e3",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/failure-simple-invalid type http request keys
+  query: data.test.p = x
+  want_error_code: eval_type_error
+  want_error: "providers.aws.sign_req: operand 1 invalid values for required request parameters(s): {\"method\", \"url\"}"
+  strict_error: true
+# aws config object errors:
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com"}
+    aws_config := {"example": "example"}
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=0047a7016c81e5c7f29cd522f97e911e04fc472fced0aee7916cbc287ad6c8e3",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/failure-simple-missing aws keys
+  query: data.test.p = x
+  want_error_code: eval_type_error
+  want_error: "providers.aws.sign_req: operand 2 missing required AWS config parameters(s): {\"aws_access_key\", \"aws_region\", \"aws_secret_access_key\", \"aws_service\"}"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com"}
+    aws_config := {
+      "aws_access_key": 1,
+      "aws_secret_access_key": 2,
+      "aws_session_token": 3,
+      "aws_service": 4,
+      "aws_region": 5,
+    }
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=0047a7016c81e5c7f29cd522f97e911e04fc472fced0aee7916cbc287ad6c8e3",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/failure-simple-invalid type aws keys
+  query: data.test.p = x
+  want_error_code: eval_type_error
+  want_error: "providers.aws.sign_req: operand 2 invalid values for required AWS config parameters(s): {\"aws_access_key\", \"aws_region\", \"aws_secret_access_key\", \"aws_service\"}"
+  strict_error: true
+# timestamp errors:
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com"}
+    aws_config := {
+      "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+      "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+      "aws_session_token": "MYAWSSECURITYTOKENGOESHERE",
+      "aws_service": "s3",
+      "aws_region": "us-east-1",
+    }
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=0047a7016c81e5c7f29cd522f97e911e04fc472fced0aee7916cbc287ad6c8e3",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, -1e9) == expected
+    }
+  note: providers-aws-sign_req/failure-simple-bad timestamp
+  query: data.test.p = x
+  want_error_code: eval_type_error
+  want_error: "providers.aws.sign_req: operand 3 could not convert time_ns value into a unix timestamp"
+  strict_error: true
diff --git a/test/cases/testdata/providers-aws/aws-sign_req.yaml b/test/cases/testdata/providers-aws/aws-sign_req.yaml
new file mode 100644
index 0000000000..3979196b1d
--- /dev/null
+++ b/test/cases/testdata/providers-aws/aws-sign_req.yaml
@@ -0,0 +1,160 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com"}
+    aws_config := {
+      "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+      "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+      "aws_service": "s3",
+      "aws_region": "us-east-1",
+    }
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=0047a7016c81e5c7f29cd522f97e911e04fc472fced0aee7916cbc287ad6c8e3",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/success-simple-no body
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+    - |
+      package test
+      req := {"method": "get", "url": "http://example.com", "headers": {"foo": "bar"}}
+      aws_config := {
+        "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+        "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+        "aws_service": "s3",
+        "aws_region": "us-east-1",
+      }
+      expected := {
+        "headers": {
+          "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=foo;host;x-amz-content-sha256;x-amz-date,Signature=8f1dc7c9b9978356a0d0989fd26a95307f4f8a4aa264d8220647b7097d839952",
+          "host": "example.com",
+          "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+          "x-amz-date": "20151228T140825Z"
+        },
+        "method": "get",
+        "url": "http://example.com"
+      }
+      p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+      }
+  note: providers-aws-sign_req/success-simple-with headers no body
+  query: data.test.p = x
+  want_result:
+    - x: true
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com"}
+    aws_config := {
+      "aws_access_key": "MYAWSACCESSKEYGOESHERE",
+      "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE",
+      "aws_session_token": "MYAWSSECURITYTOKENGOESHERE",
+      "aws_service": "s3",
+      "aws_region": "us-east-1",
+    }
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-security-token,Signature=23c31bda8a74630c0a94f6b82a3511e7e74728df98e6f54ed0840488dbbdc8d1",
+        "host": "example.com",
+        "x-amz-content-sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "x-amz-date": "20151228T140825Z",
+        "x-amz-security-token": "MYAWSSECURITYTOKENGOESHERE"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/success-simple-no body-with session token
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com", "body": {"example": {1, 2, 3, 4}}}
+    aws_config := {"aws_access_key": "MYAWSACCESSKEYGOESHERE", "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE", "aws_service": "s3", "aws_region": "us-east-1"}
+    expected := {
+      "body": {"example": {1, 2, 3, 4}},
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=5fb06ab1cfd74c8fcb3af95b8cce696708cf6155d971dac10f254d79799c6e88",
+        "host": "example.com",
+        "x-amz-content-sha256": "bacff6243c850423883052ac3c336fd645994442933408dfd3f9e858e69bda07",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/success-simple-body
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com", "raw_body": "{\"example\": {1, 2, 3, 4}}"}
+    aws_config := {"aws_access_key": "MYAWSACCESSKEYGOESHERE", "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE", "aws_service": "s3", "aws_region": "us-east-1"}
+    expected := {
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=5bf26e169cb8b02330dba39d53932532438fc856c2f10537689a09ed807c7195",
+        "host": "example.com",
+        "x-amz-content-sha256": "22906461e2a98a3e780d0fd260e341bed5e544661e97c5936fc7f3af11aaad8b",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "raw_body": "{\"example\": {1, 2, 3, 4}}",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/success-simple-raw_body
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    req := {"method": "get", "url": "http://example.com", "body": {"example": {1, 2, 3, 4}}, "raw_body": "{\"example\": {1, 2, 3, 4}}"}
+    aws_config := {"aws_access_key": "MYAWSACCESSKEYGOESHERE", "aws_secret_access_key": "MYAWSSECRETACCESSKEYGOESHERE", "aws_service": "s3", "aws_region": "us-east-1"}
+    expected := {
+      "body": {"example": {1, 2, 3, 4}},
+      "headers": {
+        "Authorization": "AWS4-HMAC-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20151228/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=5bf26e169cb8b02330dba39d53932532438fc856c2f10537689a09ed807c7195",
+        "host": "example.com",
+        "x-amz-content-sha256": "22906461e2a98a3e780d0fd260e341bed5e544661e97c5936fc7f3af11aaad8b",
+        "x-amz-date": "20151228T140825Z"
+      },
+      "method": "get",
+      "raw_body": "{\"example\": {1, 2, 3, 4}}",
+      "url": "http://example.com"
+    }
+    p {
+        providers.aws.sign_req(req, aws_config, 1451311705000000000) == expected
+    }
+  note: providers-aws-sign_req/success-simple-body-and-raw_body
+  query: data.test.p = x
+  want_result:
+  - x: true
diff --git a/test/cases/testdata/rand/test-rand.intn.yaml b/test/cases/testdata/rand/test-rand.intn.yaml
new file mode 100644
index 0000000000..66834ce696
--- /dev/null
+++ b/test/cases/testdata/rand/test-rand.intn.yaml
@@ -0,0 +1,13 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+
+    p = count(rands) {
+      rands := { rand.intn("key", 100) | numbers.range(1,100)[_] }
+    }
+  note: rand.intn/consistent values for same arguments
+  query: data.test.p = x
+  want_result:
+  - x: 1
diff --git a/test/cases/testdata/reachable/test-reachable-0326.yaml b/test/cases/testdata/reachable/test-reachable-0326.yaml
index 54fbc467de..5f6be70f23 100644
--- a/test/cases/testdata/reachable/test-reachable-0326.yaml
+++ b/test/cases/testdata/reachable/test-reachable-0326.yaml
@@ -13,5 +13,5 @@ cases:
     }
   note: reachable/malformed 1
   query: data.generated.p = x
-  want_result:
-  - x: []
+  want_error_code: eval_type_error
+  strict_error: true
\ No newline at end of file
diff --git a/test/cases/testdata/reachable/test-reachable-0328.yaml b/test/cases/testdata/reachable/test-reachable-0328.yaml
index 54e50e6b61..f2ebdccb8f 100644
--- a/test/cases/testdata/reachable/test-reachable-0328.yaml
+++ b/test/cases/testdata/reachable/test-reachable-0328.yaml
@@ -13,5 +13,5 @@ cases:
     }
   note: reachable/malformed 3
   query: data.generated.p = x
-  want_result:
-  - x: []
+  want_error_code: eval_type_error
+  strict_error: true
\ No newline at end of file
diff --git a/test/cases/testdata/reachable/test-reachable-paths-0422.yaml b/test/cases/testdata/reachable/test-reachable-paths-0422.yaml
new file mode 100644
index 0000000000..9c5cac34f0
--- /dev/null
+++ b/test/cases/testdata/reachable/test-reachable-paths-0422.yaml
@@ -0,0 +1,190 @@
+cases:
+  - data: {}
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths({}, {"a"}, result)
+        }
+    note: reachable_paths/empty
+    query: data.reachable.p = x
+    want_result:
+      - x: []
+  - data: {}
+    input_term: '{
+        "graph": {
+          "a": {"b"},
+          "b": {"c"},
+          "c": {"a"},
+        },
+        "initial": {"a"}
+      }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/cycle
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - a
+            - b
+            - c
+  - data: {}
+    input_term: '{
+      "graph": {
+        "a": {"b", "c"},
+        "b": {"d"},
+        "c": {"d"},
+        "d": set(),
+        "e": {"f"},
+        "f": {"e"},
+        "x": {"x"},
+      },
+      "initial": {
+        "b", "e"
+      }
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/components
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - b
+            - d
+          - - e
+            - f
+  - data: {}
+    input_term: '{
+      "graph": {
+        "a": ["b"],
+        "b": ["c"],
+        "c": ["a"],
+      },
+      "initial": ["a"]
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/arrays
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - a
+            - b
+            - c
+  - data: {}
+    input_term: '{
+      "graph": 1,
+      "initial": [1]
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/malformed 1
+    query: data.reachable.p = x
+    want_error_code: eval_type_error
+    strict_error: true
+  - data: {}
+    input_term: '{
+      "graph": {
+        "a": null
+      },
+      "initial": ["a"]
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/malformed 2
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - a
+  - data: {}
+    input_term: '{
+      "graph": {
+        "a": []
+      },
+      "initial": "a"
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/malformed 3
+    query: data.reachable.p = x
+    want_error_code: eval_type_error
+    strict_error: true
+  - data: {}
+    input_term: '{
+      "graph": {
+        "a": ["b", "c"],
+        "b": ["c"],
+        "c": [],
+      },
+      "initial": {"a"}
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/multiple_paths
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - a
+            - b
+            - c
+          - - a
+            - c
+
+  - data: {}
+    input_term: '{
+      "graph": {
+        "a": ["b"],
+        "b": ["nonexistent"],
+      },
+      "initial": {"a", "b"}
+    }'
+    modules:
+      - |
+        package reachable
+        
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/invalid_end
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - a
+            - b
+          - - b
diff --git a/test/cases/testdata/reachable/test-reachable-paths-1022.yaml b/test/cases/testdata/reachable/test-reachable-paths-1022.yaml
new file mode 100644
index 0000000000..02bdba80a7
--- /dev/null
+++ b/test/cases/testdata/reachable/test-reachable-paths-1022.yaml
@@ -0,0 +1,128 @@
+  cases:
+  - data: {}
+    input_term: '{
+        "graph": {
+          "one": ["two","five"],
+          "two": ["four"],
+          "three": [""],
+          "four": ["three"],
+          "five": ["seven","six"],
+          "six": ["nine"],
+          "seven": ["eight"],
+          "eight": [""],
+          "nine": [""],
+        },
+        "initial": {"one"}
+      }'
+    modules:
+      - |
+        package reachable
+
+        p = result {
+          graph.reachable_paths(input.graph, input.initial, result)
+        }
+    note: reachable_paths/cycle_1022_1
+    query: data.reachable.p = x
+    want_result:
+      - x:
+          - - one
+            - five
+            - seven
+            - eight
+
+          - - one
+            - five
+            - six
+            - nine
+
+          - - one
+            - two
+            - four
+            - three
+
+  - data: {}
+    input_term: '{
+        "graph": {
+          "one": {"two","five"},
+          "two": {"four"},
+          "three": {""},
+          "four": {"three"},
+          "five": {"seven","six"},
+          "six": {"nine"},
+          "seven": {"eight"},
+          "eight": {""},
+          "nine": {""},
+        },
+        "initial": {"one"}
+      }'
+    modules:
+        - |
+          package reachable
+
+          p = result {
+            graph.reachable_paths(input.graph, input.initial, result)
+          }
+    note: reachable_paths/cycle_1022_2
+    query: data.reachable.p = x
+    want_result:
+        - x:
+            - - one
+              - five
+              - seven
+              - eight
+
+            - - one
+              - five
+              - six
+              - nine
+
+            - - one
+              - two
+              - four
+              - three
+
+  - data: {}
+    input_term: '{
+          "graph": {
+            "one": ["two","five"],
+            "two": ["four"],
+            "three": [""],
+            "four": ["three"],
+            "five": ["seven","six"],
+            "six": ["nine","seven"],
+            "seven": ["eight"],
+            "eight": ["three"],
+            "nine": [""],
+          },
+          "initial": {"one"}
+        }'
+    modules:
+        - |
+          package reachable
+
+          p = result {
+            graph.reachable_paths(input.graph, input.initial, result)
+          }
+    note: reachable_paths/cycle_1022_3
+    query: data.reachable.p = x
+    want_result:
+        - x:
+            - - one
+              - five
+              - seven
+              - eight
+              - three
+
+            - - one
+              - five
+              - six
+
+            - - one
+              - five
+              - six
+              - nine
+
+            - - one
+              - two
+              - four
+              - three
\ No newline at end of file
diff --git a/test/cases/testdata/refheads/test-refs-as-rule-heads.yaml b/test/cases/testdata/refheads/test-refs-as-rule-heads.yaml
new file mode 100644
index 0000000000..f8d00b5a7e
--- /dev/null
+++ b/test/cases/testdata/refheads/test-refs-as-rule-heads.yaml
@@ -0,0 +1,313 @@
+cases:
+- modules:
+  - |
+    package test
+
+    p.q.r = 1
+    p.q.s = 2
+  note: 'refheads/single-value'
+  query: data.test.p = x
+  want_result:
+  - x:
+      q:
+        r: 1
+        s: 2
+- modules:
+  - |
+    package test
+
+    p.q.r = 1
+    p.q[s] = 2 { s := "s" }
+  note: 'refheads/single-value, with var'
+  query: data.test.p = x
+  want_result:
+  - x:
+      q:
+        r: 1
+        s: 2
+- modules:
+  - |
+    package test
+
+    a.b.c.p { true }
+  note: 'refheads/complete: direct query'
+  query: data.test.a.b.c.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    q = 0
+  note: 'refheads/complete: direct query q'
+  query: data.test.q = x
+  want_result:
+  - x: 0
+- modules:
+  - |
+    package test
+
+    a.b.c.p { true }
+  note: 'refheads/complete: full package extent'
+  query: data.test = x
+  want_result:
+  - x:
+      a:
+        b:
+          c:
+            p: true
+- modules:
+  - |
+    package test
+
+    a.b.c.p = 1
+    q = 0
+    a.b.d = 3
+
+    p {
+      q == 0
+      a.b.c.p == 1
+      a.b.d == 3
+    }
+  note: refheads/complete+mixed
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    a.b[x] = y { x := "c"; y := "d" }
+  note: refheads/single-value rule
+  query: data.test.a = x
+  want_result:
+  - x:
+      b:
+        c: d
+- modules:
+  - |
+    package test
+    import future.keywords
+
+    a.b contains x if some x in [1,2,3]
+  note: refheads/multi-value
+  query: data.test.a = x
+  want_result:
+  - x:
+      b: [1, 2, 3]
+# NOTE(sr): This isn't supported yet
+# - modules:
+#   - |
+#     package test
+#     import future.keywords
+
+#     a.b[c] contains x if { c := "c"; some x in [1,2,3] }
+#   note: refheads/multi-value with var in ref
+#   query: data.test.a = x
+#   want_result:
+#   - x:
+#       b:
+#         c: [1, 2, 3]
+- modules:
+  - |
+    package test
+    import future.keywords
+
+    a.b[x] = i if some i, x in [1, 2, 3]
+  note: 'refheads/single-value: previously partial object'
+  query: data.test.a.b = x
+  want_result:
+  - x:
+      1: 0
+      2: 1
+      3: 2
+- modules:
+  - |
+    package test
+    import future.keywords
+
+    a.b.c.d contains 1 if true
+  - |
+    package test.a
+    import future.keywords
+
+    b.c.d contains 2 if true
+  note: 'refheads/multi-value: same rule'
+  query: data.test.a = x
+  want_result:
+  - x:
+      b:
+        c:
+          d: [1, 2]
+- modules:
+  - |
+    package test
+
+    default a.b.c := "d"
+  note: refheads/single-value default rule
+  query: data.test.a = x
+  want_result:
+  - x:
+      b:
+        c: d
+- modules:
+  - |
+    package test
+    import future.keywords
+
+    q[7] = 8 if true
+    a[x] if q[x]
+  note: refheads/single-value example
+  query: data.test.a = x
+  want_result:
+  - x:
+      7: true
+- modules:
+  - |
+    package test
+    import future.keywords
+
+    q[7] = 8 if false
+    a[x] if q[x]
+  note: refheads/single-value example, false
+  query: data.test.a = x
+  want_result:
+  - x: {}
+- modules:
+  - |
+    package test
+    import future.keywords
+
+    a.b.c = "d" if true
+    a.b.e = "f" if true
+    a.b.g contains x if some x in numbers.range(1, 3)
+    a.b.h[x] = 1 if x := "one"
+  note: refheads/mixed example, multiple rules
+  query: data.test.a.b = x
+  want_result:
+  - x:
+      c: d
+      e: f
+      g:
+      - 1
+      - 2
+      - 3
+      h:
+        one: 1
+- modules:
+  - |
+    package example
+    import future.keywords
+
+    apps_by_hostname[hostname] := app if {
+      some i
+      server := sites[_].servers[_]
+      hostname := server.hostname
+      apps[i].servers[_] == server.name
+      app := apps[i].name
+    }
+
+    sites := [
+      {
+          "region": "east",
+          "name": "prod",
+          "servers": [
+              {
+                  "name": "web-0",
+                  "hostname": "hydrogen"
+              },
+              {
+                  "name": "web-1",
+                  "hostname": "helium"
+              },
+              {
+                  "name": "db-0",
+                  "hostname": "lithium"
+              }
+          ]
+        },
+        {
+          "region": "west",
+          "name": "smoke",
+          "servers": [
+              {
+                  "name": "web-1000",
+                  "hostname": "beryllium"
+              },
+              {
+                  "name": "web-1001",
+                  "hostname": "boron"
+              },
+              {
+                  "name": "db-1000",
+                  "hostname": "carbon"
+              }
+          ]
+        },
+        {
+          "region": "west",
+          "name": "dev",
+          "servers": [
+              {
+                  "name": "web-dev",
+                  "hostname": "nitrogen"
+              },
+              {
+                  "name": "db-dev",
+                  "hostname": "oxygen"
+              }
+          ]
+        }
+    ]
+
+    apps := [
+      {
+          "name": "web",
+          "servers": ["web-0", "web-1", "web-1000", "web-1001", "web-dev"]
+      },
+      {
+          "name": "mysql",
+          "servers": ["db-0", "db-1000"]
+      },
+      {
+          "name": "mongodb",
+          "servers": ["db-dev"]
+      }
+    ]
+
+    containers := [
+      {
+          "image": "redis",
+          "ipaddress": "10.0.0.1",
+          "name": "big_stallman"
+      },
+      {
+          "image": "nginx",
+          "ipaddress": "10.0.0.2",
+          "name": "cranky_euclid"
+      }
+    ]
+  note: refheads/website-example/partial-obj
+  query: data.example.apps_by_hostname.helium = x
+  want_result:
+  - x: web
+- modules:
+  - |
+    package example
+    import future.keywords
+
+    public_network contains net.id if {
+      some net in input.networks
+      net.public
+    }
+  note: refheads/website-example/partial-set
+  query: data.example.public_network = x
+  input:
+    networks:
+    - id: n1
+      public: true
+    - id: n2
+      public: false
+  want_result:
+  - x:
+    - n1
\ No newline at end of file
diff --git a/test/cases/testdata/refheads/test-regressions.yaml b/test/cases/testdata/refheads/test-regressions.yaml
new file mode 100644
index 0000000000..2d09f71345
--- /dev/null
+++ b/test/cases/testdata/refheads/test-regressions.yaml
@@ -0,0 +1,154 @@
+# NOTE(sr): These tests are not really related to ref heads, but collection
+# regressions found when introducing ref heads.
+cases:
+- note: regression/ref-not-hashable
+  modules:
+  - |
+    package test
+
+    ms[m.z] = m {
+      m := input.xs[y]
+    }
+  input:
+    xs:
+      something:
+        z: a
+  query: data.test = x
+  want_result:
+  - x:
+      ms:
+        a:
+          z: a
+- note: regression/function refs and package extent
+  modules:
+  - |
+    package test
+    import future.keywords.if
+
+    foo.bar(x) = x+1
+    x := foo.bar(2)
+  query: data.test = x
+  want_result:
+  - x:
+      foo: {}
+      x: 3
+
+- note: regression/rule refs and package extent
+  modules:
+  - |
+    package test
+    import future.keywords.if
+
+    buz.quz = 3 if input == 3
+    x := y {
+      y := buz.quz with input as 3
+    }
+  query: data.test = x
+  want_result:
+  - x:
+      buz: {}
+      x: 3
+- note: regression/rule refs and package extents, multiple modules
+  modules:
+  - |
+    package test
+    import future.keywords.if
+
+    x := y {
+      y := data.test.buz.quz with input as 3
+    }
+  - |
+    package test.buz
+    import future.keywords.if
+
+    quz = 3 if input == 3
+  query: data.test = x
+  want_result:
+  - x:
+      buz: {}
+      x: 3
+- note: regression/type checking with ref rules
+  modules:
+  - |
+    package test
+    all[0] = [2]
+    level := 1
+
+    p := y { y := all[level-1][_] }
+  query: data.test.p = x
+  want_result:
+  - x: 2
+- note: regression/type checking with ref rules, number
+  modules:
+  - |
+    package test
+    p[0] = 1
+  query: 'data.test.p[0] = x'
+  want_result:
+  - x: 1
+- note: regression/type checking with ref rules, bool
+  modules:
+  - |
+    package test
+    p[true] = 1
+  query: 'data.test.p[true] = x'
+  want_result:
+  - x: 1
+- note: regression/full extent with partial object rule with empty indexer lookup result
+  modules:
+  - |
+    package test
+    p[x] = 2 {
+      x := input # we'll get 0 rules for data.test.p
+      false
+    }
+  query: data.test = x
+  want_result:
+  - x:
+      p: {}
+- note: regression/obj in ref head query
+  modules:
+  - |
+    package test
+    p[{"a": "b"}] = true
+  query: data.test.p[{"a":"b"}] = x
+  want_result:
+  - x: true
+- note: regression/full extent with non-string (number) last term
+  modules:
+  - |
+    package test
+    p[0] = true
+  query: data.test = x
+  want_result:
+  - x:
+     p:
+       "0": true # stringified key
+- note: regression/full extent with non-string last term, comparison
+  modules:
+  - |
+    package test
+    p[0] = 1
+    q { p[0] == 1 }
+  query: data.test.q = x
+  want_result:
+  - x: true
+- note: regression/full extent with non-string (boolean) last term
+  modules:
+  - |
+    package test
+    p[true] = true
+  query: data.test = x
+  want_result:
+  - x:
+     p:
+       "true": true # stringified key
+- note: regression/full extent with non-string last term, comparison
+  modules:
+  - |
+    package test
+    p[true] = false
+    q { p[true] == false }
+  query: data.test.q = x
+  want_result:
+  - x: true
diff --git a/test/cases/testdata/regexisvalid/test-regexisvalid-0330.yaml b/test/cases/testdata/regexisvalid/test-regexisvalid-0330.yaml
index 7415b847bf..6eeeea6f70 100644
--- a/test/cases/testdata/regexisvalid/test-regexisvalid-0330.yaml
+++ b/test/cases/testdata/regexisvalid/test-regexisvalid-0330.yaml
@@ -1,6 +1,5 @@
 cases:
-- data:
-    num: 10
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexisvalid/test-regexisvalid-0331.yaml b/test/cases/testdata/regexisvalid/test-regexisvalid-0331.yaml
index 2811ce0955..33f50f4dfc 100644
--- a/test/cases/testdata/regexisvalid/test-regexisvalid-0331.yaml
+++ b/test/cases/testdata/regexisvalid/test-regexisvalid-0331.yaml
@@ -1,6 +1,5 @@
 cases:
-- data:
-    num: 10
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexmatch/test-regexmatch-0855.yaml b/test/cases/testdata/regexmatch/test-regexmatch-0855.yaml
index 7b7e39c322..6ea6b2b9dd 100644
--- a/test/cases/testdata/regexmatch/test-regexmatch-0855.yaml
+++ b/test/cases/testdata/regexmatch/test-regexmatch-0855.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexmatch/test-regexmatch-0856.yaml b/test/cases/testdata/regexmatch/test-regexmatch-0856.yaml
index 9f4c88d60d..e1f8cd0c98 100644
--- a/test/cases/testdata/regexmatch/test-regexmatch-0856.yaml
+++ b/test/cases/testdata/regexmatch/test-regexmatch-0856.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexmatch/test-regexmatch-0858.yaml b/test/cases/testdata/regexmatch/test-regexmatch-0858.yaml
index 08ceca8035..d992e9e2cd 100644
--- a/test/cases/testdata/regexmatch/test-regexmatch-0858.yaml
+++ b/test/cases/testdata/regexmatch/test-regexmatch-0858.yaml
@@ -1,87 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexmatch/test-regexmatch-0859.yaml b/test/cases/testdata/regexmatch/test-regexmatch-0859.yaml
index 55478768cc..45077b783d 100644
--- a/test/cases/testdata/regexmatch/test-regexmatch-0859.yaml
+++ b/test/cases/testdata/regexmatch/test-regexmatch-0859.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexmatch/test-regexmatch-0860.yaml b/test/cases/testdata/regexmatch/test-regexmatch-0860.yaml
index 35661758a7..e2025cfb1e 100644
--- a/test/cases/testdata/regexmatch/test-regexmatch-0860.yaml
+++ b/test/cases/testdata/regexmatch/test-regexmatch-0860.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexmatch/test-regexmatch-0861.yaml b/test/cases/testdata/regexmatch/test-regexmatch-0861.yaml
index 69f221bfb9..8301500df8 100644
--- a/test/cases/testdata/regexmatch/test-regexmatch-0861.yaml
+++ b/test/cases/testdata/regexmatch/test-regexmatch-0861.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexreplace/test-regexreplace-0001.yaml b/test/cases/testdata/regexreplace/test-regexreplace-0001.yaml
new file mode 100644
index 0000000000..e84d0f2086
--- /dev/null
+++ b/test/cases/testdata/regexreplace/test-regexreplace-0001.yaml
@@ -0,0 +1,39 @@
+cases:
+- data: {}
+  modules:
+  - |
+    package test
+
+    p = x {
+      s := "-wy-wxxy-"
+      x := regex.replace(s, "w(x*)y", "0")
+    }
+  note: 'regex.replace: test pattern match and replace'
+  query: data.test.p = x
+  want_result:
+  - x: -0-0-
+- data: {}
+  modules:
+  - |
+    package test
+
+    p = x {
+      s := "foo"
+      x := regex.replace(s, "(foo)", "$1$1")
+    }
+  note: 'regex.replace: work with groups'
+  query: data.test.p = x
+  want_result:
+    - x: foofoo
+- data: {}
+  modules:
+  - |
+    package test
+
+    p = x {
+      s := "foo"
+      x := regex.replace(s, "[", "$1")
+    }
+  note: 'regex.replace: bad regex pattern: Syntax error'
+  query: data.test.p = x
+  want_result: []
diff --git a/test/cases/testdata/regexsplit/test-regexsplit-0862.yaml b/test/cases/testdata/regexsplit/test-regexsplit-0862.yaml
index 9dde614ab3..3bdaab7917 100644
--- a/test/cases/testdata/regexsplit/test-regexsplit-0862.yaml
+++ b/test/cases/testdata/regexsplit/test-regexsplit-0862.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: 'regexsplit/regex.split: empty string'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/regexsplit/test-regexsplit-0863.yaml b/test/cases/testdata/regexsplit/test-regexsplit-0863.yaml
index 7c6a14a876..889300e732 100644
--- a/test/cases/testdata/regexsplit/test-regexsplit-0863.yaml
+++ b/test/cases/testdata/regexsplit/test-regexsplit-0863.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regexsplit/test-regexsplit-0864.yaml b/test/cases/testdata/regexsplit/test-regexsplit-0864.yaml
index 3be93baf41..2f926db19b 100644
--- a/test/cases/testdata/regexsplit/test-regexsplit-0864.yaml
+++ b/test/cases/testdata/regexsplit/test-regexsplit-0864.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/regometadatachain/test-regometadatachain-1.yaml b/test/cases/testdata/regometadatachain/test-regometadatachain-1.yaml
new file mode 100644
index 0000000000..7cc28ad8ec
--- /dev/null
+++ b/test/cases/testdata/regometadatachain/test-regometadatachain-1.yaml
@@ -0,0 +1,98 @@
+cases:
+  - data:
+    note: regometadatachain/simple
+    modules:
+      - |
+        # METADATA
+        # description: The Rego test suite
+        package testing
+        
+        # METADATA
+        # title: Testing annotations
+        # authors:
+        # - The OPA contributors
+        p := x {
+            x := rego.metadata.chain()
+        }
+    query: data.testing.p = x
+    want_result:
+      - x:
+          - annotations:
+              authors:
+                - name: The OPA contributors
+              scope: rule
+              title: Testing annotations
+            path:
+              - testing
+              - p
+          - annotations:
+              description: The Rego test suite
+              scope: package
+            path:
+              - testing
+  - data:
+    note: regometadatachain/rule mixed scope
+    modules:
+      - |
+        # METADATA
+        # description: The Rego test suite
+        package testing
+
+        # METADATA
+        # scope: document
+        # title: Testing annotations
+        # authors:
+        # - The OPA contributors
+        p := "foo" {
+            false
+        }
+
+        # METADATA
+        # title: Another annotation
+        p := x {
+            x := rego.metadata.chain()
+        }
+    query: data.testing.p = x
+    want_result:
+      - x:
+          - annotations:
+              scope: rule
+              title: Another annotation
+            path:
+              - testing
+              - p
+          - annotations:
+              authors:
+                - name: The OPA contributors
+              scope: document
+              title: Testing annotations
+            path:
+              - testing
+              - p
+          - annotations:
+              description: The Rego test suite
+              scope: package
+            path:
+              - testing
+  - data:
+    note: regometadatachain/package spanning modules
+    modules:
+      - |
+        # METADATA
+        # description: A set of package annotations seen across multiple modules
+        package testing
+      - |
+        package testing
+        
+        p := rego.metadata.chain()
+    query: data.testing.p = x
+    want_result:
+      - x:
+          - path:
+              - testing
+              - p
+          - path:
+              - testing
+            annotations:
+              scope: package
+              description: A set of package annotations seen across multiple modules
diff --git a/test/cases/testdata/regometadatarule/test-regometadatarule-1.yaml b/test/cases/testdata/regometadatarule/test-regometadatarule-1.yaml
new file mode 100644
index 0000000000..c0cc15cb8c
--- /dev/null
+++ b/test/cases/testdata/regometadatarule/test-regometadatarule-1.yaml
@@ -0,0 +1,50 @@
+cases:
+  - data:
+    modules:
+      - |
+        # METADATA
+        # description: The Rego test suite
+        package testing
+  
+        # METADATA
+        # title: Testing annotations
+        # authors:
+        # - The OPA contributors
+        p := x {
+            x := rego.metadata.rule()
+        }
+    note: regometadatarule/simple
+    query: data.testing.p = x
+    want_result:
+      - x:
+          title: Testing annotations
+          authors:
+            - name: The OPA contributors
+          scope: rule
+  - data:
+    modules:
+      - |
+        # METADATA
+        # description: The Rego test suite
+        package testing
+        
+        # METADATA
+        # title: Testing annotations
+        # authors:
+        # - The OPA contributors
+        p := "foo" {
+            false
+        }
+        
+        # METADATA
+        # title: Another annotation
+        p := x {
+            x := rego.metadata.rule()
+        }
+    note: regometadatarule/rule scope only
+    query: data.testing.p = x
+    want_result:
+      - x:
+          title: Another annotation
+          scope: rule
+
diff --git a/test/cases/testdata/regoparsemodule/test-regoparsemodule-0320.yaml b/test/cases/testdata/regoparsemodule/test-regoparsemodule-0320.yaml
index e1a09a4db2..c03232cd33 100644
--- a/test/cases/testdata/regoparsemodule/test-regoparsemodule-0320.yaml
+++ b/test/cases/testdata/regoparsemodule/test-regoparsemodule-0320.yaml
@@ -1,6 +1,5 @@
 cases:
 - data:
-    err: package foo.
     ok: "package foo.bar\n\n\t\timport data.a\n\n\t\tp { a = true }"
   modules:
   - |
diff --git a/test/cases/testdata/regoparsemodule/test-regoparsemodule-0321.yaml b/test/cases/testdata/regoparsemodule/test-regoparsemodule-0321.yaml
index da6bf0ebfc..ee7314edbd 100644
--- a/test/cases/testdata/regoparsemodule/test-regoparsemodule-0321.yaml
+++ b/test/cases/testdata/regoparsemodule/test-regoparsemodule-0321.yaml
@@ -1,7 +1,6 @@
 cases:
 - data:
     err: package foo.
-    ok: "package foo.bar\n\n\t\timport data.a\n\n\t\tp { a = true }"
   modules:
   - |
     package generated
@@ -12,6 +11,6 @@ cases:
     }
   note: regoparsemodule/error
   query: data.generated.p = x
+  strict_error: true
   want_error: 'rego_parse_error: unexpected eof token: expected ident'
   want_error_code: eval_builtin_error
-  strict_error: true
diff --git a/test/cases/testdata/replacen/test-replacen-bad-operands.yaml b/test/cases/testdata/replacen/test-replacen-bad-operands.yaml
index 6e7ff0c4a4..e9b6c354ee 100644
--- a/test/cases/testdata/replacen/test-replacen-bad-operands.yaml
+++ b/test/cases/testdata/replacen/test-replacen-bad-operands.yaml
@@ -1,5 +1,5 @@
 cases:
-- data:
+- data: null
   modules:
   - |
     package test
@@ -7,9 +7,9 @@ cases:
     p = strings.replace_n({2: "x" | true}, "foo")
   note: replacen/bad pattern object operand/non-string key
   query: data.test.p = x
-  want_error: "strings.replace_n: operand 1 non-string key found in pattern object"
-  want_error_code: eval_type_error
   strict_error: true
+  want_error: 'strings.replace_n: operand 1 non-string key found in pattern object'
+  want_error_code: eval_type_error
 - data:
     pattern:
       f: 100
@@ -20,9 +20,9 @@ cases:
     p = strings.replace_n(data.pattern, "foo")
   note: replacen/bad pattern object operand/non-string value
   query: data.test.p = x
-  want_error: "strings.replace_n: operand 1 non-string value found in pattern object"
-  want_error_code: eval_type_error
   strict_error: true
+  want_error: 'strings.replace_n: operand 1 non-string value found in pattern object'
+  want_error_code: eval_type_error
 - data:
     string: 100
   modules:
@@ -32,6 +32,6 @@ cases:
     p = strings.replace_n({"foo":"baz"}, data.string)
   note: replacen/bad pattern object operand/non-string value
   query: data.test.p = x
-  want_error: "strings.replace_n: operand 2 must be string but got number"
-  want_error_code: eval_type_error
   strict_error: true
+  want_error: 'strings.replace_n: operand 2 must be string but got number'
+  want_error_code: eval_type_error
diff --git a/test/cases/testdata/sets/test-sets-0871.yaml b/test/cases/testdata/sets/test-sets-0871.yaml
index 88c511deba..023129c90c 100644
--- a/test/cases/testdata/sets/test-sets-0871.yaml
+++ b/test/cases/testdata/sets/test-sets-0871.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/sets/test-sets-0872.yaml b/test/cases/testdata/sets/test-sets-0872.yaml
index e748cb03bf..8f05ca00ec 100644
--- a/test/cases/testdata/sets/test-sets-0872.yaml
+++ b/test/cases/testdata/sets/test-sets-0872.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/sets/test-sets-0873.yaml b/test/cases/testdata/sets/test-sets-0873.yaml
index 52d82c3117..ce9e36d687 100644
--- a/test/cases/testdata/sets/test-sets-0873.yaml
+++ b/test/cases/testdata/sets/test-sets-0873.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/sets/test-sets-0874.yaml b/test/cases/testdata/sets/test-sets-0874.yaml
index 9ae8aa4234..5b965c2718 100644
--- a/test/cases/testdata/sets/test-sets-0874.yaml
+++ b/test/cases/testdata/sets/test-sets-0874.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/sets/test-sets-0875.yaml b/test/cases/testdata/sets/test-sets-0875.yaml
index 5f23fa9352..9274ccc654 100644
--- a/test/cases/testdata/sets/test-sets-0875.yaml
+++ b/test/cases/testdata/sets/test-sets-0875.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/sets/test-sets-0876.yaml b/test/cases/testdata/sets/test-sets-0876.yaml
index 691286d33f..5e828e52a5 100644
--- a/test/cases/testdata/sets/test-sets-0876.yaml
+++ b/test/cases/testdata/sets/test-sets-0876.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-anyprefixmatch.yaml b/test/cases/testdata/strings/test-anyprefixmatch.yaml
new file mode 100644
index 0000000000..4da395cc0b
--- /dev/null
+++ b/test/cases/testdata/strings/test-anyprefixmatch.yaml
@@ -0,0 +1,340 @@
+cases:
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: ["a/", "d/"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: ["f/", "d/"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: ["a/b/", "a/"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: ["d/", "e/f/g"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["aa/bb/cc", "aa/bb/dd", "ee/ff/gg"]
+    prefixes: ["aa/b", "e/f"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["aa/bb/cc", "aa/bb/dd", "ee/ff/gg"]
+    prefixes: ["a/b", "e/f"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["aa/bb/cc", "aa/bb/dd", "ee/ff/gg"]
+    prefixes: ["b/cc"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: []
+    prefixes: ["a/b", "e/f"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: []
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: []
+    prefixes: []
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_prefix_match(input.strings, input.prefixes)
+    }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefix: "a/"
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefix)
+      }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+    - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefix: "d/"
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefix)
+      }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    string: "a/b/c"
+    prefixes: ["a/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.string, input.prefixes)
+      }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+    - x: true
+- input:
+    string: "a/b/c"
+    prefixes: ["g/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.string, input.prefixes)
+      }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: ["a/", "d/"]
+  modules:
+    - |
+      package test
+      
+      strings_set[str] {
+        str := input.strings[_]
+      }
+      
+      prefixes_set[prefix] {
+        prefix := input.prefixes[_]
+      }
+      
+      p {
+        strings.any_prefix_match(strings_set, prefixes_set)
+      }
+  note: strings/any_prefix_match/match
+  query: data.test.p = x
+  want_result:
+    - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      strings_set[str] {
+        str := input.strings[_]
+      }
+      
+      prefixes_set[prefix] {
+        prefix := input.prefixes[_]
+      }
+      
+      p {
+        strings.any_prefix_match(strings_set, prefixes_set)
+      }
+  note: strings/any_prefix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: [1, 2, 3]
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: 1
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: [1, 2]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: 1
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: [1, 2, 3]
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_prefix_match: operand 1 must be array of strings but got array containing number"
+- input:
+    strings: 1
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_prefix_match: operand 1 must be one of {string, set, array} but got number"
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: [1, 2]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_prefix_match: operand 2 must be array of strings but got array containing number"
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: 1
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_prefix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_prefix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_prefix_match: operand 2 must be one of {string, set, array} but got number"
diff --git a/test/cases/testdata/strings/test-anysuffixmatch.yaml b/test/cases/testdata/strings/test-anysuffixmatch.yaml
new file mode 100644
index 0000000000..43e387d9c5
--- /dev/null
+++ b/test/cases/testdata/strings/test-anysuffixmatch.yaml
@@ -0,0 +1,341 @@
+cases:
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: ["/c", "/a"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: ["/f", "/a"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: ["/b/c", "/d"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: ["/a", "e/f/g"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["aa/bb/cc", "aa/bb/dd", "ee/ff/gg"]
+    suffixes: ["b/cc", "f/g"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+  - x: true
+- input:
+    strings: ["aa/bb/cc", "aa/bb/dd", "ee/ff/gg"]
+    suffixes: ["b/c", "f/g"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["aa/bb/cc", "aa/bb/dd", "ee/ff/gg"]
+    suffixes: ["aa/b"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: []
+    suffixes: ["a/b", "e/f"]
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: []
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: []
+    suffixes: []
+  modules:
+  - |
+    package test
+
+    p {
+      strings.any_suffix_match(input.strings, input.suffixes)
+    }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffix: "/c"
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.suffix)
+      }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+    - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffix: "/h"
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.suffix)
+      }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    string: "a/b/c"
+    suffixes: ["/c", "/a"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.string, input.suffixes)
+      }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+    - x: true
+- input:
+    string: "a/b/g"
+    suffixes: ["/c", "/a"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.string, input.suffixes)
+      }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: ["/c", "/a"]
+  modules:
+    - |
+      package test
+        
+      strings_set[str] {
+        str := input.strings[_]
+      }
+
+      suffixes_set[suffix] {
+        suffix := input.suffixes[_]
+      }
+      
+      p {
+        strings.any_suffix_match(strings_set, suffixes_set)
+      }
+  note: strings/any_suffix_match/match
+  query: data.test.p = x
+  want_result:
+    - x: true
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    suffixes: ["/f", "/a"]
+  modules:
+    - |
+      package test
+
+      strings_set[str] {
+        str := input.strings[_]
+      }
+
+      suffixes_set[suffix] {
+        suffix := input.suffixes[_]
+      }
+
+      p {
+        strings.any_suffix_match(strings_set, suffixes_set)
+      }
+  note: strings/any_suffix_match/nomatch
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: [1, 2, 3]
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: 1
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: [1, 2]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: 1
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_nostrict
+  query: data.test.p = x
+  want_result: []
+- input:
+    strings: [1, 2, 3]
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_suffix_match: operand 1 must be array of strings but got array containing number"
+- input:
+    strings: 1
+    prefixes: ["f/", "d/"]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_suffix_match: operand 1 must be one of {string, set, array} but got number"
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: [1, 2]
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_suffix_match: operand 2 must be array of strings but got array containing number"
+- input:
+    strings: ["a/b/c", "a/b/d", "e/f/g"]
+    prefixes: 1
+  modules:
+    - |
+      package test
+      
+      p {
+        strings.any_suffix_match(input.strings, input.prefixes)
+      }
+  note: strings/any_suffix_match/type_error_strict
+  query: data.test.p = x
+  strict_error: true
+  want_error: "test-0.rego:4: eval_type_error: strings.any_suffix_match: operand 2 must be one of {string, set, array} but got number"
+
diff --git a/test/cases/testdata/strings/test-strings-0877.yaml b/test/cases/testdata/strings/test-strings-0877.yaml
index 6917d205fe..410e60eb78 100644
--- a/test/cases/testdata/strings/test-strings-0877.yaml
+++ b/test/cases/testdata/strings/test-strings-0877.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0878.yaml b/test/cases/testdata/strings/test-strings-0878.yaml
index adb7037cee..e315f31d3d 100644
--- a/test/cases/testdata/strings/test-strings-0878.yaml
+++ b/test/cases/testdata/strings/test-strings-0878.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0879.yaml b/test/cases/testdata/strings/test-strings-0879.yaml
index 6788cfd7e2..53cdb1c4a7 100644
--- a/test/cases/testdata/strings/test-strings-0879.yaml
+++ b/test/cases/testdata/strings/test-strings-0879.yaml
@@ -1,87 +1,10 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
     numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+    - '1'
+    - '2'
+    - '3'
+    - '4'
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0880.yaml b/test/cases/testdata/strings/test-strings-0880.yaml
index cd5db3510c..075f7aeefc 100644
--- a/test/cases/testdata/strings/test-strings-0880.yaml
+++ b/test/cases/testdata/strings/test-strings-0880.yaml
@@ -1,87 +1,10 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
     numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+    - '1'
+    - '2'
+    - '3'
+    - '4'
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0882.yaml b/test/cases/testdata/strings/test-strings-0882.yaml
index cd37b07715..e3b4ac4281 100644
--- a/test/cases/testdata/strings/test-strings-0882.yaml
+++ b/test/cases/testdata/strings/test-strings-0882.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0884.yaml b/test/cases/testdata/strings/test-strings-0884.yaml
index 378297f11b..51e2bd1bae 100644
--- a/test/cases/testdata/strings/test-strings-0884.yaml
+++ b/test/cases/testdata/strings/test-strings-0884.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0885.yaml b/test/cases/testdata/strings/test-strings-0885.yaml
index 9982d5c3ea..84bab7b89f 100644
--- a/test/cases/testdata/strings/test-strings-0885.yaml
+++ b/test/cases/testdata/strings/test-strings-0885.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0886.yaml b/test/cases/testdata/strings/test-strings-0886.yaml
index d1a04c6fdf..04d47f711b 100644
--- a/test/cases/testdata/strings/test-strings-0886.yaml
+++ b/test/cases/testdata/strings/test-strings-0886.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0888.yaml b/test/cases/testdata/strings/test-strings-0888.yaml
index 6e37342ae5..2da783adf1 100644
--- a/test/cases/testdata/strings/test-strings-0888.yaml
+++ b/test/cases/testdata/strings/test-strings-0888.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0889.yaml b/test/cases/testdata/strings/test-strings-0889.yaml
index 49a98b7759..d02d30cf9b 100644
--- a/test/cases/testdata/strings/test-strings-0889.yaml
+++ b/test/cases/testdata/strings/test-strings-0889.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -94,13 +12,8 @@ cases:
   want_result:
   - x: cde
 - modules:
-  - |
-    package generated
-
-    p = x {
-      substring("åäö", 0, 2, x)
-    }
+  - "package generated\n\np = x {\n  substring(\"\xE5\xE4\xF6\", 0, 2, x)\n}\n"
   note: 'strings/substring: unicode'
   query: data.generated.p = x
   want_result:
-  - x: åä
+  - x: "\xE5\xE4"
diff --git a/test/cases/testdata/strings/test-strings-0890.yaml b/test/cases/testdata/strings/test-strings-0890.yaml
index fc35c3aaab..4c120b4ec0 100644
--- a/test/cases/testdata/strings/test-strings-0890.yaml
+++ b/test/cases/testdata/strings/test-strings-0890.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -94,13 +12,8 @@ cases:
   want_result:
   - x: cdefgh
 - modules:
-  - |
-    package generated
-
-    p = x {
-      substring("aåäö", 2, -1, x)
-    }
+  - "package generated\n\np = x {\n  substring(\"a\xE5\xE4\xF6\", 2, -1, x)\n}\n"
   note: 'strings/substring: remainder unicode'
   query: data.generated.p = x
   want_result:
-  - x: äö
+  - x: "\xE4\xF6"
diff --git a/test/cases/testdata/strings/test-strings-0891.yaml b/test/cases/testdata/strings/test-strings-0891.yaml
index 5e38a4c988..aea5498a27 100644
--- a/test/cases/testdata/strings/test-strings-0891.yaml
+++ b/test/cases/testdata/strings/test-strings-0891.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -94,13 +12,9 @@ cases:
   want_result:
   - x: cdefgh
 - modules:
-  - |
-    package generated
-
-    p = x {
-      substring("abcdefghåäö", 2, 10000, x)
-    }
+  - "package generated\n\np = x {\n  substring(\"abcdefgh\xE5\xE4\xF6\", 2, 10000,\
+    \ x)\n}\n"
   note: 'strings/substring: too long unicode'
   query: data.generated.p = x
   want_result:
-  - x: cdefghåäö
+  - x: "cdefgh\xE5\xE4\xF6"
diff --git a/test/cases/testdata/strings/test-strings-0893.yaml b/test/cases/testdata/strings/test-strings-0893.yaml
index 2f9e4f6a51..ebc2147baa 100644
--- a/test/cases/testdata/strings/test-strings-0893.yaml
+++ b/test/cases/testdata/strings/test-strings-0893.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,15 +10,10 @@ cases:
   note: 'strings/substring: offset too long'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
 - modules:
-  - |
-    package generated
-
-    p = x {
-      substring("åäö", 3, -1, x)
-    }
+  - "package generated\n\np = x {\n  substring(\"\xE5\xE4\xF6\", 3, -1, x)\n}\n"
   note: 'strings/substring: offset too long unicode'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/strings/test-strings-0894.yaml b/test/cases/testdata/strings/test-strings-0894.yaml
index 74a72f06a5..f422274782 100644
--- a/test/cases/testdata/strings/test-strings-0894.yaml
+++ b/test/cases/testdata/strings/test-strings-0894.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,15 +10,10 @@ cases:
   note: 'strings/substring: offset too long 2'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
 - modules:
-  - |
-    package generated
-
-    p = x {
-      substring("åäö", 4, -1, x)
-    }
+  - "package generated\n\np = x {\n  substring(\"\xE5\xE4\xF6\", 4, -1, x)\n}\n"
   note: 'strings/substring: offset too long 2 unicode'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/strings/test-strings-0895.yaml b/test/cases/testdata/strings/test-strings-0895.yaml
index d65a8a56ac..2b42392e97 100644
--- a/test/cases/testdata/strings/test-strings-0895.yaml
+++ b/test/cases/testdata/strings/test-strings-0895.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0896.yaml b/test/cases/testdata/strings/test-strings-0896.yaml
index af99f948fe..d829e07897 100644
--- a/test/cases/testdata/strings/test-strings-0896.yaml
+++ b/test/cases/testdata/strings/test-strings-0896.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0897.yaml b/test/cases/testdata/strings/test-strings-0897.yaml
index 9969c75efb..d9559474c2 100644
--- a/test/cases/testdata/strings/test-strings-0897.yaml
+++ b/test/cases/testdata/strings/test-strings-0897.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0898.yaml b/test/cases/testdata/strings/test-strings-0898.yaml
index bb538cd6fc..2dc5f0b6b5 100644
--- a/test/cases/testdata/strings/test-strings-0898.yaml
+++ b/test/cases/testdata/strings/test-strings-0898.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0899.yaml b/test/cases/testdata/strings/test-strings-0899.yaml
index 64ba618fe4..a94fd1089a 100644
--- a/test/cases/testdata/strings/test-strings-0899.yaml
+++ b/test/cases/testdata/strings/test-strings-0899.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0900.yaml b/test/cases/testdata/strings/test-strings-0900.yaml
index 81114b7948..6784072979 100644
--- a/test/cases/testdata/strings/test-strings-0900.yaml
+++ b/test/cases/testdata/strings/test-strings-0900.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0901.yaml b/test/cases/testdata/strings/test-strings-0901.yaml
index e7f2b89c2f..b01870b510 100644
--- a/test/cases/testdata/strings/test-strings-0901.yaml
+++ b/test/cases/testdata/strings/test-strings-0901.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0902.yaml b/test/cases/testdata/strings/test-strings-0902.yaml
index 3eb6dd57f2..c71e794c54 100644
--- a/test/cases/testdata/strings/test-strings-0902.yaml
+++ b/test/cases/testdata/strings/test-strings-0902.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0903.yaml b/test/cases/testdata/strings/test-strings-0903.yaml
index c871f6ef77..1edc1498fc 100644
--- a/test/cases/testdata/strings/test-strings-0903.yaml
+++ b/test/cases/testdata/strings/test-strings-0903.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: 'strings/split: empty string'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/strings/test-strings-0904.yaml b/test/cases/testdata/strings/test-strings-0904.yaml
index 3d9c9e12a8..ef633c812c 100644
--- a/test/cases/testdata/strings/test-strings-0904.yaml
+++ b/test/cases/testdata/strings/test-strings-0904.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0905.yaml b/test/cases/testdata/strings/test-strings-0905.yaml
index e73e550eec..99269ac596 100644
--- a/test/cases/testdata/strings/test-strings-0905.yaml
+++ b/test/cases/testdata/strings/test-strings-0905.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0906.yaml b/test/cases/testdata/strings/test-strings-0906.yaml
index 78d1dd4f88..291c5af4ea 100644
--- a/test/cases/testdata/strings/test-strings-0906.yaml
+++ b/test/cases/testdata/strings/test-strings-0906.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: 'strings/replace: empty string'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/strings/test-strings-0907.yaml b/test/cases/testdata/strings/test-strings-0907.yaml
index d9a9795373..bdf73c6ed3 100644
--- a/test/cases/testdata/strings/test-strings-0907.yaml
+++ b/test/cases/testdata/strings/test-strings-0907.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0908.yaml b/test/cases/testdata/strings/test-strings-0908.yaml
index 72b2dd8cff..ead0cc8cad 100644
--- a/test/cases/testdata/strings/test-strings-0908.yaml
+++ b/test/cases/testdata/strings/test-strings-0908.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0909.yaml b/test/cases/testdata/strings/test-strings-0909.yaml
index 4f3396e254..9002d70710 100644
--- a/test/cases/testdata/strings/test-strings-0909.yaml
+++ b/test/cases/testdata/strings/test-strings-0909.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0910.yaml b/test/cases/testdata/strings/test-strings-0910.yaml
index 73cfd51e39..0e062f0878 100644
--- a/test/cases/testdata/strings/test-strings-0910.yaml
+++ b/test/cases/testdata/strings/test-strings-0910.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: 'strings/trim: empty string'
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/strings/test-strings-0911.yaml b/test/cases/testdata/strings/test-strings-0911.yaml
index 531bb91b63..b52d6f55c1 100644
--- a/test/cases/testdata/strings/test-strings-0911.yaml
+++ b/test/cases/testdata/strings/test-strings-0911.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0912.yaml b/test/cases/testdata/strings/test-strings-0912.yaml
index d4c8c71812..0b1f0324fa 100644
--- a/test/cases/testdata/strings/test-strings-0912.yaml
+++ b/test/cases/testdata/strings/test-strings-0912.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0913.yaml b/test/cases/testdata/strings/test-strings-0913.yaml
index 6a02f9a7a0..f646fd5c6a 100644
--- a/test/cases/testdata/strings/test-strings-0913.yaml
+++ b/test/cases/testdata/strings/test-strings-0913.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0914.yaml b/test/cases/testdata/strings/test-strings-0914.yaml
index 23a040bcad..98fba84c67 100644
--- a/test/cases/testdata/strings/test-strings-0914.yaml
+++ b/test/cases/testdata/strings/test-strings-0914.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0915.yaml b/test/cases/testdata/strings/test-strings-0915.yaml
index f5caeaaa37..dc62ffdc3d 100644
--- a/test/cases/testdata/strings/test-strings-0915.yaml
+++ b/test/cases/testdata/strings/test-strings-0915.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0916.yaml b/test/cases/testdata/strings/test-strings-0916.yaml
index a77607e345..255b133608 100644
--- a/test/cases/testdata/strings/test-strings-0916.yaml
+++ b/test/cases/testdata/strings/test-strings-0916.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0917.yaml b/test/cases/testdata/strings/test-strings-0917.yaml
index 4daecc2d13..39f2d0ade7 100644
--- a/test/cases/testdata/strings/test-strings-0917.yaml
+++ b/test/cases/testdata/strings/test-strings-0917.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0918.yaml b/test/cases/testdata/strings/test-strings-0918.yaml
index b3199e9449..6c96254854 100644
--- a/test/cases/testdata/strings/test-strings-0918.yaml
+++ b/test/cases/testdata/strings/test-strings-0918.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0919.yaml b/test/cases/testdata/strings/test-strings-0919.yaml
index fc48b40b6d..a77d8a4dc4 100644
--- a/test/cases/testdata/strings/test-strings-0919.yaml
+++ b/test/cases/testdata/strings/test-strings-0919.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0920.yaml b/test/cases/testdata/strings/test-strings-0920.yaml
index aca19f23cc..f4e9ad1848 100644
--- a/test/cases/testdata/strings/test-strings-0920.yaml
+++ b/test/cases/testdata/strings/test-strings-0920.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0921.yaml b/test/cases/testdata/strings/test-strings-0921.yaml
index 0053cfeff7..00caae77bd 100644
--- a/test/cases/testdata/strings/test-strings-0921.yaml
+++ b/test/cases/testdata/strings/test-strings-0921.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0922.yaml b/test/cases/testdata/strings/test-strings-0922.yaml
index 599a58c8df..1c97d90a8e 100644
--- a/test/cases/testdata/strings/test-strings-0922.yaml
+++ b/test/cases/testdata/strings/test-strings-0922.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0923.yaml b/test/cases/testdata/strings/test-strings-0923.yaml
index 7ca5d32453..81389f8862 100644
--- a/test/cases/testdata/strings/test-strings-0923.yaml
+++ b/test/cases/testdata/strings/test-strings-0923.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/strings/test-strings-0924.yaml b/test/cases/testdata/strings/test-strings-0924.yaml
new file mode 100644
index 0000000000..f39684256b
--- /dev/null
+++ b/test/cases/testdata/strings/test-strings-0924.yaml
@@ -0,0 +1,70 @@
+cases:
+- data:
+    foo: bar
+  modules:
+  - |
+    package test
+
+    p := strings.reverse(data.foo)
+  note: strings/reverse_bar
+  query: data.test.p = x
+  want_result:
+  - x: rab
+- data:
+    foo: "2\uFE0F\u20E3"
+  modules:
+  - |
+    package test
+
+    p := strings.reverse(data.foo)
+  note: strings/reverse_unicode_multi_char_emojii
+  query: data.test.p = x
+  want_result:
+  - x: "\u20E3\uFE0F2"
+- data:
+    foo: "1\U0001F600\U0001D6FE"
+  modules:
+  - |
+    package test
+
+    p := strings.reverse(data.foo)
+  note: strings/reverse_unicode
+  query: data.test.p = x
+  want_result:
+  - x: "\U0001D6FE\U0001F6001"
+- data:
+    foo: ''
+  modules:
+  - |
+    package test
+
+    p := strings.reverse(data.foo)
+  note: strings/reverse_empty
+  query: data.test.p = x
+  want_result:
+  - x: ''
+- data:
+    foo: 123
+  modules:
+  - |
+    package test
+
+    p := strings.reverse(data.foo)
+  note: strings/reverse_number_error
+  query: data.test.p = x
+  strict_error: true
+  want_error: 'reverse: operand 1 must be string but got number'
+  want_error_code: eval_type_error
+- data:
+    foo:
+      bar: baz
+  modules:
+  - |
+    package test
+
+    p := strings.reverse(data.foo)
+  note: strings/reverse_object_error
+  query: data.test.p = x
+  strict_error: true
+  want_error: 'reverse: operand 1 must be string but got object'
+  want_error_code: eval_type_error
diff --git a/test/cases/testdata/strings/test-strings-0925.yaml b/test/cases/testdata/strings/test-strings-0925.yaml
new file mode 100644
index 0000000000..a5d21524e9
--- /dev/null
+++ b/test/cases/testdata/strings/test-strings-0925.yaml
@@ -0,0 +1,41 @@
+cases:
+  - note: 'strings/indexof_n_single_match'
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := indexof_n("dogcat", "cat")
+    want_result:
+      - x: [3]
+  - note: 'strings/indexof_n_multiple_matches'
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := indexof_n("dogcatdogcat", "cat")
+    want_result:
+      - x: [3, 9]
+  - note: 'strings/indexof_n_no_match'
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := indexof_n("dogcat", "rabbit")
+    want_result:
+      - x: []
+  - note: 'strings/indexof_n_unicode_matches'
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := indexof_n("😇😀😇😀😇😀", "😀")
+    want_result:
+      - x: [1, 3, 5]
+  - note: 'strings/indexof_n_unicode_no_match'
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        p := indexof_n("😇😀😇😀😇😀", "😂")
+    want_result:
+      - x: []
\ No newline at end of file
diff --git a/test/cases/testdata/subset/test-subset.yaml b/test/cases/testdata/subset/test-subset.yaml
new file mode 100644
index 0000000000..91c15b3ea3
--- /dev/null
+++ b/test/cases/testdata/subset/test-subset.yaml
@@ -0,0 +1,388 @@
+cases:
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {
+          "a": 5,
+          "b": 7,
+          "c": 15
+        }
+
+        B := {
+          "a": 5,
+        }
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/simple object subset 1
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {
+          "a": 5,
+          "b": 7,
+          "c": 15
+        }
+
+        B := {
+          "a": 5,
+          "b": 10,
+        }
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          not AsubB     # B is not a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/simple object subset 2
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {
+          "a": 5,
+          "b": 7,
+          "c": 15,
+          "nested": {
+            "x": 10,
+            "y": 15,
+            "z": 20
+          }
+        }
+
+        B := {
+          "a": 5,
+          "nested": {
+            "x": 10,
+            "y": 15,
+            "z": 20
+          }
+        }
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/nested object subset 1
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {
+          "a": 5,
+          "b": 7,
+          "c": 15,
+          "nested": {
+            "x": 10,
+            "y": 15,
+            "z": 20
+          }
+        }
+
+        # The subset operation applies recursively to nested objects
+
+        B := {
+          "a": 5,
+          "nested": {
+            "x": 10,
+            "y": 15,
+          }
+        }
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/nested object subset 2
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {
+          "a": 5,
+          "b": 7,
+          "c": 15,
+          "nested": {
+            "x": 10,
+            "y": 15,
+            "z": 20,
+            "set1": {1,2,3,4},
+            "arr1": [6,7,8,9]
+          }
+        }
+
+        # The subset operation applies recursively to nested objects
+
+        B := {
+          "a": 5,
+          "nested": {
+            "x": 10,
+            "y": 15,
+            "set1": {4, 1},
+            "arr1": [6,7]
+          }
+        }
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/nested object subset 3
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {1, 2, 3}
+        B := {3, 2}
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/sets 1
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {1, 2, 3, {"a", "b", "c"}}
+        B := {3, 2, {"a", "b", "c"}}
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/nested sets 1
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := {1, 2, 3, {"a", "b", "c"}}
+        B := {3, 2, {"a", "b"}}
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        # Notice that there isn't really a well-defined way to "match" the two
+        # nested sets to one another, so we B is not a subset of A in this
+        # case.
+
+        test_result {
+          not AsubB # B is not a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/nested sets 2
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := [1,2,3,4,5,6]
+        B := [3,4,5]
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        # Notice that there isn't really a well-defined way to "match" the two
+        # nested sets to one another, so we B is not a subset of A in this
+        # case.
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/arrays 1
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := [1,2,3,4,5,6]
+        B := [1,2,3]
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        # Notice that there isn't really a well-defined way to "match" the two
+        # nested sets to one another, so we B is not a subset of A in this
+        # case.
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/arrays 2
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := [1,2,3,4,5,6]
+        B := [4,5,6]
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        # Notice that there isn't really a well-defined way to "match" the two
+        # nested sets to one another, so we B is not a subset of A in this
+        # case.
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # A is not a subset of B
+        }
+
+    note: subset/arrays 3
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := [1,2,3,4,5,6]
+        B := [1,2,3,4,5,6]
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        # Notice that there isn't really a well-defined way to "match" the two
+        # nested sets to one another, so we B is not a subset of A in this
+        # case.
+
+        test_result {
+          AsubB     # B is a subset of A
+          BsubA     # A is a subset of B
+        }
+
+    note: subset/arrays 4
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := [1,2,3,4,5,6]
+        B := {4,3,2}
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          AsubB     # B is a subset of A
+          not BsubA # It is invalid operands
+        }
+
+    note: subset/array and set 1
+    query: data.test.test_result = x
+    want_result:
+      - x: true
+
+  - data:
+    modules:
+      - |
+        package test
+
+        A := [1,2,3,4,5,6]
+        B := {9,8,7}
+
+        AsubB := object.subset(A, B)
+        BsubA := object.subset(B, A)
+
+        test_result {
+          not AsubB     # B is not a subset of A
+          not BsubA     # It is invalid operands
+        }
+
+    note: subset/array and set 2
+    query: data.test.test_result = x
+    want_result:
+      - x: true
\ No newline at end of file
diff --git a/test/cases/testdata/time/test-time-0947.yaml b/test/cases/testdata/time/test-time-0947.yaml
index 288f956d12..40ea6b6851 100644
--- a/test/cases/testdata/time/test-time-0947.yaml
+++ b/test/cases/testdata/time/test-time-0947.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0950.yaml b/test/cases/testdata/time/test-time-0950.yaml
index acee2ca4bb..2cdf84e0c1 100644
--- a/test/cases/testdata/time/test-time-0950.yaml
+++ b/test/cases/testdata/time/test-time-0950.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0951.yaml b/test/cases/testdata/time/test-time-0951.yaml
index 812fba9a78..8cebcc899d 100644
--- a/test/cases/testdata/time/test-time-0951.yaml
+++ b/test/cases/testdata/time/test-time-0951.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0952.yaml b/test/cases/testdata/time/test-time-0952.yaml
index 952daf13fe..5f1492c7c2 100644
--- a/test/cases/testdata/time/test-time-0952.yaml
+++ b/test/cases/testdata/time/test-time-0952.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0953.yaml b/test/cases/testdata/time/test-time-0953.yaml
index b2277aec60..82a3778f01 100644
--- a/test/cases/testdata/time/test-time-0953.yaml
+++ b/test/cases/testdata/time/test-time-0953.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0954.yaml b/test/cases/testdata/time/test-time-0954.yaml
index 9c75ccbde8..fe9c061fb8 100644
--- a/test/cases/testdata/time/test-time-0954.yaml
+++ b/test/cases/testdata/time/test-time-0954.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0956.yaml b/test/cases/testdata/time/test-time-0956.yaml
index 91db34a53d..3e91879d55 100644
--- a/test/cases/testdata/time/test-time-0956.yaml
+++ b/test/cases/testdata/time/test-time-0956.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0957.yaml b/test/cases/testdata/time/test-time-0957.yaml
index 8d52f70b4c..edf87f4ec7 100644
--- a/test/cases/testdata/time/test-time-0957.yaml
+++ b/test/cases/testdata/time/test-time-0957.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0958.yaml b/test/cases/testdata/time/test-time-0958.yaml
index d52617b668..ec7b2e06b3 100644
--- a/test/cases/testdata/time/test-time-0958.yaml
+++ b/test/cases/testdata/time/test-time-0958.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0960.yaml b/test/cases/testdata/time/test-time-0960.yaml
index 451df0f87f..d3be511288 100644
--- a/test/cases/testdata/time/test-time-0960.yaml
+++ b/test/cases/testdata/time/test-time-0960.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0961.yaml b/test/cases/testdata/time/test-time-0961.yaml
index c9cb86dfd8..8bb70c4299 100644
--- a/test/cases/testdata/time/test-time-0961.yaml
+++ b/test/cases/testdata/time/test-time-0961.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0962.yaml b/test/cases/testdata/time/test-time-0962.yaml
index 70860c5cbb..a192f3622e 100644
--- a/test/cases/testdata/time/test-time-0962.yaml
+++ b/test/cases/testdata/time/test-time-0962.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0963.yaml b/test/cases/testdata/time/test-time-0963.yaml
index 9ddec13f25..7d636e0101 100644
--- a/test/cases/testdata/time/test-time-0963.yaml
+++ b/test/cases/testdata/time/test-time-0963.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0964.yaml b/test/cases/testdata/time/test-time-0964.yaml
index 815b17ecec..8eddb47f45 100644
--- a/test/cases/testdata/time/test-time-0964.yaml
+++ b/test/cases/testdata/time/test-time-0964.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0965.yaml b/test/cases/testdata/time/test-time-0965.yaml
index b88d5973dc..c10c2b07dd 100644
--- a/test/cases/testdata/time/test-time-0965.yaml
+++ b/test/cases/testdata/time/test-time-0965.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0966.yaml b/test/cases/testdata/time/test-time-0966.yaml
index 9f5d1029c5..faa38a5583 100644
--- a/test/cases/testdata/time/test-time-0966.yaml
+++ b/test/cases/testdata/time/test-time-0966.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/time/test-time-0971.yaml b/test/cases/testdata/time/test-time-0971.yaml
new file mode 100644
index 0000000000..88af3a0f1d
--- /dev/null
+++ b/test/cases/testdata/time/test-time-0971.yaml
@@ -0,0 +1,35 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+
+    time_ns := 1670006453141828752
+
+    a := time.format(time_ns)
+
+    b := time.format([time_ns, "Asia/Kolkata"])
+
+    c := time.format([time_ns,"Asia/Kolkata","Mon Jan 02 15:04:05 -0700 2006"])
+
+  note: time/format
+  query: >
+    data.test.a = no_timezone;
+    data.test.b = with_timezone;
+    data.test.c = with_layout
+  want_result:
+  - no_timezone: "2022-12-02T18:40:53.141828752Z"
+    with_timezone: "2022-12-03T00:10:53.141828752+05:30"
+    with_layout: "Sat Dec 03 00:10:53 +0530 2022"
+- data:
+  modules:
+  - |
+    package generated
+
+    p := time.format(1582977600 * 10e12)
+
+  note: time/format too big
+  query: data.generated.p = x
+  want_error: timestamp too big
+  want_error_code: eval_builtin_error
+  strict_error: true
diff --git a/test/cases/testdata/toarray/test-toarray-0071.yaml b/test/cases/testdata/toarray/test-toarray-0071.yaml
index f79b72382e..37dcfc8a12 100644
--- a/test/cases/testdata/toarray/test-toarray-0071.yaml
+++ b/test/cases/testdata/toarray/test-toarray-0071.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/toarray/test-toarray-0072.yaml b/test/cases/testdata/toarray/test-toarray-0072.yaml
index 34b41c6e6e..5079efc1eb 100644
--- a/test/cases/testdata/toarray/test-toarray-0072.yaml
+++ b/test/cases/testdata/toarray/test-toarray-0072.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/toset/test-toset-0074.yaml b/test/cases/testdata/toset/test-toset-0074.yaml
index fb488e9699..c71381189b 100644
--- a/test/cases/testdata/toset/test-toset-0074.yaml
+++ b/test/cases/testdata/toset/test-toset-0074.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/toset/test-toset-0075.yaml b/test/cases/testdata/toset/test-toset-0075.yaml
index a8b0033d94..fe65d6485b 100644
--- a/test/cases/testdata/toset/test-toset-0075.yaml
+++ b/test/cases/testdata/toset/test-toset-0075.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0828.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0828.yaml
index 7aec7e9e4e..5ac3e9b3bc 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0828.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0828.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0829.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0829.yaml
index c7e64570b5..82e8472dc0 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0829.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0829.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_number
   query: data.generated.p = x
-  want_result: []
+  want_result:
+   - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0830.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0830.yaml
index f3ae18ecc5..987b368a34 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0830.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0830.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_number
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0831.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0831.yaml
index c884d90cb4..210c9a3f5f 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0831.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0831.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0832.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0832.yaml
index e7e8c61a6e..1838c589b1 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0832.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0832.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0833.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0833.yaml
index 3374bfff25..302ab1575e 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0833.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0833.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_string
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0834.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0834.yaml
index 16da2ac0f2..fec94667fb 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0834.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0834.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_string
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0835.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0835.yaml
index 2cde2bf67c..79bd2ea195 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0835.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0835.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0836.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0836.yaml
index 1c90581b7c..6c85b27ab8 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0836.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0836.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0837.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0837.yaml
index dbdfdd44ce..518e208c54 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0837.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0837.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_boolean
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0838.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0838.yaml
index 9ccccbfc91..4a5e2c8a30 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0838.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0838.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_boolean
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0839.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0839.yaml
index e6dd7d57b2..ec7af28775 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0839.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0839.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0840.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0840.yaml
index 72a382d533..c64bcc4035 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0840.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0840.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0841.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0841.yaml
index e154aa0625..20a3d9156c 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0841.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0841.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_array
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0842.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0842.yaml
index 7fbb466f0c..fc051786f0 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0842.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0842.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0843.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0843.yaml
index 8fdb8b00bf..6f88300274 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0843.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0843.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_set
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0844.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0844.yaml
index 51cbc1b5a3..ba7adab929 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0844.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0844.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0845.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0845.yaml
index 342e001f3e..be13e819b7 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0845.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0845.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_object
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0846.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0846.yaml
index 2eb0c38c84..741d1a29b4 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0846.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0846.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typebuiltin/test-typebuiltin-0847.yaml b/test/cases/testdata/typebuiltin/test-typebuiltin-0847.yaml
index 5cfcea3d6d..04a3234249 100644
--- a/test/cases/testdata/typebuiltin/test-typebuiltin-0847.yaml
+++ b/test/cases/testdata/typebuiltin/test-typebuiltin-0847.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -91,4 +9,5 @@ cases:
     }
   note: typebuiltin/is_null
   query: data.generated.p = x
-  want_result: []
+  want_result:
+  - x: false
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0848.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0848.yaml
index 760beac7b9..d2f147723f 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0848.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0848.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: typenamebuiltin/type_name
   query: data.generated.p = x
   want_result:
-  - x: "null"
+  - x: 'null'
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0849.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0849.yaml
index 705f33b8ed..7841c9c38e 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0849.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0849.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0850.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0850.yaml
index 9f43f61b64..5acdfb784d 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0850.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0850.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0851.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0851.yaml
index fec3d1f268..efd3dedb2c 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0851.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0851.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0852.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0852.yaml
index f3fcb47696..7b56ecff41 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0852.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0852.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0853.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0853.yaml
index 00e23bb63c..821f23c188 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0853.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0853.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0854.yaml b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0854.yaml
index d04d0efb5d..361c85d9e1 100644
--- a/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0854.yaml
+++ b/test/cases/testdata/typenamebuiltin/test-typenamebuiltin-0854.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0599.yaml b/test/cases/testdata/undos/test-undos-0599.yaml
index caa15effb3..a6a5c2b06e 100644
--- a/test/cases/testdata/undos/test-undos-0599.yaml
+++ b/test/cases/testdata/undos/test-undos-0599.yaml
@@ -1,14 +1,5 @@
 cases:
-- data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0600.yaml b/test/cases/testdata/undos/test-undos-0600.yaml
index 60a61680e0..3f38b74268 100644
--- a/test/cases/testdata/undos/test-undos-0600.yaml
+++ b/test/cases/testdata/undos/test-undos-0600.yaml
@@ -1,14 +1,5 @@
 cases:
-- data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0601.yaml b/test/cases/testdata/undos/test-undos-0601.yaml
index aaa332aa98..6820510437 100644
--- a/test/cases/testdata/undos/test-undos-0601.yaml
+++ b/test/cases/testdata/undos/test-undos-0601.yaml
@@ -1,14 +1,5 @@
 cases:
-- data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0602.yaml b/test/cases/testdata/undos/test-undos-0602.yaml
index 6e3d4ae9be..bba332ed19 100644
--- a/test/cases/testdata/undos/test-undos-0602.yaml
+++ b/test/cases/testdata/undos/test-undos-0602.yaml
@@ -3,12 +3,6 @@ cases:
     arr_ref:
     - 1
     - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0603.yaml b/test/cases/testdata/undos/test-undos-0603.yaml
index 409e8b1719..3ab9cf2599 100644
--- a/test/cases/testdata/undos/test-undos-0603.yaml
+++ b/test/cases/testdata/undos/test-undos-0603.yaml
@@ -1,14 +1,5 @@
 cases:
-- data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0604.yaml b/test/cases/testdata/undos/test-undos-0604.yaml
index fe52052dcf..e537d537d4 100644
--- a/test/cases/testdata/undos/test-undos-0604.yaml
+++ b/test/cases/testdata/undos/test-undos-0604.yaml
@@ -1,14 +1,5 @@
 cases:
-- data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0605.yaml b/test/cases/testdata/undos/test-undos-0605.yaml
index 2c3692fb4c..dc900d5b38 100644
--- a/test/cases/testdata/undos/test-undos-0605.yaml
+++ b/test/cases/testdata/undos/test-undos-0605.yaml
@@ -1,14 +1,5 @@
 cases:
-- data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0606.yaml b/test/cases/testdata/undos/test-undos-0606.yaml
index 523f8746fd..ebdbb6ea3f 100644
--- a/test/cases/testdata/undos/test-undos-0606.yaml
+++ b/test/cases/testdata/undos/test-undos-0606.yaml
@@ -1,14 +1,8 @@
 cases:
 - data:
-    arr_ref:
-    - 1
-    - null
     obj_ref:
       x: 1
-      "y": null
-    obj_ref_missing_key:
-      x: 3
-      z: 2
+      y: null
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/undos/test-undos-0607.yaml b/test/cases/testdata/undos/test-undos-0607.yaml
index 09afc98c1f..f6f2a0a234 100644
--- a/test/cases/testdata/undos/test-undos-0607.yaml
+++ b/test/cases/testdata/undos/test-undos-0607.yaml
@@ -1,11 +1,5 @@
 cases:
 - data:
-    arr_ref:
-    - 1
-    - null
-    obj_ref:
-      x: 1
-      "y": null
     obj_ref_missing_key:
       x: 3
       z: 2
diff --git a/test/cases/testdata/union/test-union-0357.yaml b/test/cases/testdata/union/test-union-0357.yaml
index e9d81e0a3c..22d62b3672 100644
--- a/test/cases/testdata/union/test-union-0357.yaml
+++ b/test/cases/testdata/union/test-union-0357.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/union/test-union-0358.yaml b/test/cases/testdata/union/test-union-0358.yaml
index 4ad234c55d..d170217ae1 100644
--- a/test/cases/testdata/union/test-union-0358.yaml
+++ b/test/cases/testdata/union/test-union-0358.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/union/test-union-0359.yaml b/test/cases/testdata/union/test-union-0359.yaml
index f9d78b8387..4ccfd953b7 100644
--- a/test/cases/testdata/union/test-union-0359.yaml
+++ b/test/cases/testdata/union/test-union-0359.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/union/test-union-0360.yaml b/test/cases/testdata/union/test-union-0360.yaml
index 4d73e544f7..a847d91d7b 100644
--- a/test/cases/testdata/union/test-union-0360.yaml
+++ b/test/cases/testdata/union/test-union-0360.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/union/test-union-0361.yaml b/test/cases/testdata/union/test-union-0361.yaml
index 019cb558b2..0f3337e037 100644
--- a/test/cases/testdata/union/test-union-0361.yaml
+++ b/test/cases/testdata/union/test-union-0361.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/units/test-issue-4856.yaml b/test/cases/testdata/units/test-issue-4856.yaml
new file mode 100644
index 0000000000..c76138fef2
--- /dev/null
+++ b/test/cases/testdata/units/test-issue-4856.yaml
@@ -0,0 +1,35 @@
+---
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        p {
+            units.parse("500m") == 0.5
+        }
+    note: units_parse/exact comparison - regression case 1
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        p {
+            units.parse("0.0005K") == 0.5
+        }
+    note: units_parse/exact comparison - regression case 2
+    query: data.test.p = x
+    want_result:
+      - x: true
+  - data:
+    modules:
+      - |
+        package test
+        p {
+            units.parse("0.0000005M") == 0.5
+        }
+    note: units_parse/exact comparison - regression case 3
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/units/test-parse-bytes-comparisons.yaml b/test/cases/testdata/units/test-parse-bytes-comparisons.yaml
index 3d84ad7d8a..3bc50acc5a 100644
--- a/test/cases/testdata/units/test-parse-bytes-comparisons.yaml
+++ b/test/cases/testdata/units/test-parse-bytes-comparisons.yaml
@@ -6,7 +6,7 @@ cases:
     p {
         units.parse_bytes("8kb") > units.parse_bytes("7kb")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -17,7 +17,7 @@ cases:
     p {
         units.parse_bytes("8gb") > units.parse_bytes("8mb")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -28,7 +28,7 @@ cases:
     p {
         units.parse_bytes("1234kb") < units.parse_bytes("1gb")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -39,7 +39,7 @@ cases:
     p {
         units.parse_bytes("1024") == units.parse_bytes("1KiB")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -50,7 +50,7 @@ cases:
     p {
         units.parse_bytes("2MiB") == units.parse_bytes("2097152")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -61,7 +61,7 @@ cases:
     p {
         units.parse_bytes("3MiB") > units.parse_bytes("3MB")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -72,7 +72,7 @@ cases:
     p {
         units.parse_bytes("2MiB") == units.parse_bytes("2Mi")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -83,7 +83,7 @@ cases:
     p {
         units.parse_bytes("4Mi") > units.parse_bytes("4M")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -94,7 +94,7 @@ cases:
     p {
         units.parse_bytes("4.1Mi") > units.parse_bytes("4Mi")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
@@ -105,7 +105,7 @@ cases:
     p {
         units.parse_bytes("128Gi") == units.parse_bytes("137438953472")
     }
-  note: parse_bytes/comparison
+  note: units_parse_bytes/comparison
   query: data.test.p = x
   want_result:
   - x: true
\ No newline at end of file
diff --git a/test/cases/testdata/units/test-parse-bytes-errors.yaml b/test/cases/testdata/units/test-parse-bytes-errors.yaml
index 1fbebe7d24..04fe9014b2 100644
--- a/test/cases/testdata/units/test-parse-bytes-errors.yaml
+++ b/test/cases/testdata/units/test-parse-bytes-errors.yaml
@@ -6,9 +6,10 @@ cases:
     p {
         units.parse_bytes("")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: no byte amount provided"
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: no byte amount provided"
   strict_error: true
 - data:
   modules:
@@ -17,9 +18,10 @@ cases:
     p {
         units.parse_bytes("GB")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: no byte amount provided"
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: no byte amount provided"
   strict_error: true
 - data:
   modules:
@@ -28,9 +30,10 @@ cases:
     p {
         units.parse_bytes("foo")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: no byte amount provided"
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: no byte amount provided"
   strict_error: true
 - data:
   modules:
@@ -39,9 +42,10 @@ cases:
     p {
         units.parse_bytes("0.0.0")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: could not parse byte amount to a number"
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: could not parse byte amount to a number"
   strict_error: true
 - data:
   modules:
@@ -50,9 +54,10 @@ cases:
     p {
         units.parse_bytes(".5.2")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: could not parse byte amount to a number"
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: could not parse byte amount to a number"
   strict_error: true
 - data:
   modules:
@@ -61,9 +66,10 @@ cases:
     p {
         units.parse_bytes("100 kb")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: spaces not allowed in resource strings"
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: spaces not allowed in resource strings"
   strict_error: true
 - data:
   modules:
@@ -72,7 +78,8 @@ cases:
     p {
         units.parse_bytes(" 327MiB ")
     }
-  note: parse_bytes/failure
+  note: units_parse_bytes/failure
   query: data.test.p = x
-  want_error: "units.parse_bytes error: spaces not allowed in resource strings"
-  strict_error: true
\ No newline at end of file
+  want_error_code: eval_builtin_error
+  want_error: "units.parse_bytes: spaces not allowed in resource strings"
+  strict_error: true
diff --git a/test/cases/testdata/units/test-parse-bytes.yaml b/test/cases/testdata/units/test-parse-bytes.yaml
index c7ef0c2a7e..b372413f25 100644
--- a/test/cases/testdata/units/test-parse-bytes.yaml
+++ b/test/cases/testdata/units/test-parse-bytes.yaml
@@ -6,7 +6,7 @@ cases:
     p {
         units.parse_bytes("\"100TIB\"") == 109951162777600
     }
-  note: parse_bytes/removes quotes and lowercases string
+  note: units_parse_bytes/removes quotes and lowercases string
   query: data.test.p = x
   want_result:
   - x: true
@@ -17,7 +17,7 @@ cases:
     p {
         units.parse_bytes("0") == 0
     }
-  note: parse_bytes/zero
+  note: units_parse_bytes/zero
   query: data.test.p = x
   want_result:
   - x: true
@@ -29,7 +29,7 @@ cases:
     p {
         units.parse_bytes("0.0") == 0
     }
-  note: parse_bytes/zero float
+  note: units_parse_bytes/zero float
   query: data.test.p = x
   want_result:
   - x: true
@@ -41,7 +41,7 @@ cases:
     p {
         units.parse_bytes(".0") == 0
     }
-  note: parse_bytes/zero bare float
+  note: units_parse_bytes/zero bare float
   query: data.test.p = x
   want_result:
   - x: true
@@ -53,7 +53,7 @@ cases:
     p {
         units.parse_bytes("12345") == 12345
     }
-  note: parse_bytes/raw number
+  note: units_parse_bytes/raw number
   query: data.test.p = x
   want_result:
   - x: true
@@ -65,7 +65,7 @@ cases:
     p {
         units.parse_bytes("10KB") == 10000
     }
-  note: parse_bytes/10 kilobytes uppercase
+  note: units_parse_bytes/10 kilobytes uppercase
   query: data.test.p = x
   want_result:
   - x: true
@@ -77,7 +77,7 @@ cases:
     p {
         units.parse_bytes("10KIB") == 10240
     }
-  note: parse_bytes/10 KiB uppercase
+  note: units_parse_bytes/10 KiB uppercase
   query: data.test.p = x
   want_result:
   - x: true
@@ -89,7 +89,7 @@ cases:
     p {
         units.parse_bytes("10kb") == 10000
     }
-  note: parse_bytes/10 KB lowercase
+  note: units_parse_bytes/10 KB lowercase
   query: data.test.p = x
   want_result:
   - x: true
@@ -101,7 +101,7 @@ cases:
     p {
         units.parse_bytes("10Kib") == 10240
     }
-  note: parse_bytes/10 KiB mixed case
+  note: units_parse_bytes/10 KiB mixed case
   query: data.test.p = x
   want_result:
   - x: true
@@ -113,7 +113,7 @@ cases:
     p {
         units.parse_bytes("200mb") == 200000000
     }
-  note: parse_bytes/200 megabytes as mb
+  note: units_parse_bytes/200 megabytes as mb
   query: data.test.p = x
   want_result:
   - x: true
@@ -125,7 +125,7 @@ cases:
     p {
         units.parse_bytes("300GiB") == 322122547200
     }
-  note: parse_bytes/300 GiB
+  note: units_parse_bytes/300 GiB
   query: data.test.p = x
   want_result:
   - x: true
@@ -137,7 +137,7 @@ cases:
     p {
         units.parse_bytes("1.1KB") == 1100
     }
-  note: parse_bytes/1.1 KB floating point
+  note: units_parse_bytes/1.1 KB floating point
   query: data.test.p = x
   want_result:
   - x: true
@@ -149,7 +149,7 @@ cases:
     p {
         units.parse_bytes("1.1KiB") == 1126
     }
-  note: parse_bytes/1.1 KiB floating point rounded
+  note: units_parse_bytes/1.1 KiB floating point rounded
   query: data.test.p = x
   want_result:
   - x: true
@@ -161,7 +161,7 @@ cases:
     p {
         units.parse_bytes(".5KB") == 500
     }
-  note: parse_bytes/.5 KB bare floating point
+  note: units_parse_bytes/.5 KB bare floating point
   query: data.test.p = x
   want_result:
   - x: true
@@ -173,7 +173,7 @@ cases:
     p {
         units.parse_bytes("100k") == 100000
     }
-  note: parse_bytes/100 kilobytes as k
+  note: units_parse_bytes/100 kilobytes as k
   query: data.test.p = x
   want_result:
   - x: true
@@ -185,7 +185,7 @@ cases:
     p {
         units.parse_bytes("100kb") == 100000
     }
-  note: parse_bytes/100 kilobytes as kb
+  note: units_parse_bytes/100 kilobytes as kb
   query: data.test.p = x
   want_result:
   - x: true
@@ -197,7 +197,7 @@ cases:
     p {
         units.parse_bytes("100ki") == 102400
     }
-  note: parse_bytes/100 kibibytes as ki
+  note: units_parse_bytes/100 kibibytes as ki
   query: data.test.p = x
   want_result:
   - x: true
@@ -209,7 +209,7 @@ cases:
     p {
         units.parse_bytes("100kib") == 102400
     }
-  note: parse_bytes/100 kibibytes as kib
+  note: units_parse_bytes/100 kibibytes as kib
   query: data.test.p = x
   want_result:
   - x: true
@@ -221,7 +221,7 @@ cases:
     p {
         units.parse_bytes("100m") == 100000000
     }
-  note: parse_bytes/100 megabytes as m
+  note: units_parse_bytes/100 megabytes as m
   query: data.test.p = x
   want_result:
   - x: true
@@ -233,7 +233,7 @@ cases:
     p {
         units.parse_bytes("100mb") == 100000000
     }
-  note: parse_bytes/100 megabytes as mb
+  note: units_parse_bytes/100 megabytes as mb
   query: data.test.p = x
   want_result:
   - x: true
@@ -245,7 +245,7 @@ cases:
     p {
         units.parse_bytes("100mi") == 104857600
     }
-  note: parse_bytes/100 mebibytes as mi
+  note: units_parse_bytes/100 mebibytes as mi
   query: data.test.p = x
   want_result:
   - x: true
@@ -257,7 +257,7 @@ cases:
     p {
         units.parse_bytes("100mib") == 104857600
     }
-  note: parse_bytes/100 mebibytes as mib
+  note: units_parse_bytes/100 mebibytes as mib
   query: data.test.p = x
   want_result:
   - x: true
@@ -269,7 +269,7 @@ cases:
     p {
         units.parse_bytes("100g") == 100000000000
     }
-  note: parse_bytes/100 gigabytes as g
+  note: units_parse_bytes/100 gigabytes as g
   query: data.test.p = x
   want_result:
   - x: true
@@ -281,7 +281,7 @@ cases:
     p {
         units.parse_bytes("100gb") == 100000000000
     }
-  note: parse_bytes/100 gigabytes as gb
+  note: units_parse_bytes/100 gigabytes as gb
   query: data.test.p = x
   want_result:
   - x: true
@@ -293,7 +293,7 @@ cases:
     p {
         units.parse_bytes("100gi") == 107374182400
     }
-  note: parse_bytes/100 gibibytes as gi
+  note: units_parse_bytes/100 gibibytes as gi
   query: data.test.p = x
   want_result:
   - x: true
@@ -305,7 +305,7 @@ cases:
     p {
         units.parse_bytes("100gib") == 107374182400
     }
-  note: parse_bytes/100 gibibytes as gib
+  note: units_parse_bytes/100 gibibytes as gib
   query: data.test.p = x
   want_result:
   - x: true
@@ -317,7 +317,7 @@ cases:
     p {
         units.parse_bytes("100t") == 100000000000000
     }
-  note: parse_bytes/100 terabytes as t
+  note: units_parse_bytes/100 terabytes as t
   query: data.test.p = x
   want_result:
   - x: true
@@ -329,7 +329,7 @@ cases:
     p {
         units.parse_bytes("100tb") == 100000000000000
     }
-  note: parse_bytes/100 terabytes as tb
+  note: units_parse_bytes/100 terabytes as tb
   query: data.test.p = x
   want_result:
   - x: true
@@ -341,7 +341,7 @@ cases:
     p {
         units.parse_bytes("100ti") == 109951162777600
     }
-  note: parse_bytes/100 tebibytes as ti
+  note: units_parse_bytes/100 tebibytes as ti
   query: data.test.p = x
   want_result:
   - x: true
@@ -353,7 +353,7 @@ cases:
     p {
         units.parse_bytes("100tib") == 109951162777600
     }
-  note: parse_bytes/100 tebibytes as tib
+  note: units_parse_bytes/100 tebibytes as tib
   query: data.test.p = x
   want_result:
   - x: true
@@ -365,7 +365,7 @@ cases:
     p {
         units.parse_bytes("100p") == 100000000000000000
     }
-  note: parse_bytes/100 petabytes as p
+  note: units_parse_bytes/100 petabytes as p
   query: data.test.p = x
   want_result:
   - x: true
@@ -377,7 +377,7 @@ cases:
     p {
         units.parse_bytes("100pb") == 100000000000000000
     }
-  note: parse_bytes/100 petabytes as pb
+  note: units_parse_bytes/100 petabytes as pb
   query: data.test.p = x
   want_result:
   - x: true
@@ -389,7 +389,7 @@ cases:
     p {
         units.parse_bytes("100pi") == 112589990684262400
     }
-  note: parse_bytes/100 pebibytes as pi
+  note: units_parse_bytes/100 pebibytes as pi
   query: data.test.p = x
   want_result:
   - x: true
@@ -401,7 +401,7 @@ cases:
     p {
         units.parse_bytes("100pib") == 112589990684262400
     }
-  note: parse_bytes/100 pebibytes as pib
+  note: units_parse_bytes/100 pebibytes as pib
   query: data.test.p = x
   want_result:
   - x: true
@@ -413,7 +413,7 @@ cases:
     p {
         units.parse_bytes("10e") == 10000000000000000000
     }
-  note: parse_bytes/10 etabytes as e
+  note: units_parse_bytes/10 etabytes as e
   query: data.test.p = x
   want_result:
   - x: true
@@ -425,7 +425,7 @@ cases:
     p {
         units.parse_bytes("10eb") == 10000000000000000000
     }
-  note: parse_bytes/10 etabytes as eb
+  note: units_parse_bytes/10 etabytes as eb
   query: data.test.p = x
   want_result:
   - x: true
@@ -437,7 +437,7 @@ cases:
     p {
         units.parse_bytes("10ei") == 11529215046068469760
     }
-  note: parse_bytes/10 ebibytes as ei
+  note: units_parse_bytes/10 ebibytes as ei
   query: data.test.p = x
   want_result:
   - x: true
@@ -449,7 +449,7 @@ cases:
     p {
         units.parse_bytes("10eib") == 11529215046068469760
     }
-  note: parse_bytes/10 ebibytes as eib
+  note: units_parse_bytes/10 ebibytes as eib
   query: data.test.p = x
   want_result:
   - x: true
\ No newline at end of file
diff --git a/test/cases/testdata/units/test-parse-units-comparisons.yaml b/test/cases/testdata/units/test-parse-units-comparisons.yaml
new file mode 100644
index 0000000000..b1a6461bc8
--- /dev/null
+++ b/test/cases/testdata/units/test-parse-units-comparisons.yaml
@@ -0,0 +1,111 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("8k") > units.parse("7k")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("8g") > units.parse("8m")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("1234k") < units.parse("1g")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("1024") == units.parse("1Ki")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("2Mi") == units.parse("2097152")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("3Mi") > units.parse("3M")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("2Mi") == units.parse("2Mi")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("4Mi") > units.parse("4M")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("4.1Mi") > units.parse("4Mi")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("128Gi") == units.parse("137438953472")
+    }
+  note: units_parse/comparison
+  query: data.test.p = x
+  want_result:
+  - x: true
diff --git a/test/cases/testdata/units/test-parse-units-errors.yaml b/test/cases/testdata/units/test-parse-units-errors.yaml
new file mode 100644
index 0000000000..5d79cb0a32
--- /dev/null
+++ b/test/cases/testdata/units/test-parse-units-errors.yaml
@@ -0,0 +1,85 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: no amount provided"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("G")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: no amount provided"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("foo")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: no amount provided"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("0.0.0")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: could not parse amount to a number"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse(".5.2")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: could not parse amount to a number"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100 k")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: spaces not allowed in resource strings"
+  strict_error: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse(" 327Mi ")
+    }
+  note: units_parse/failure
+  query: data.test.p = x
+  want_error_code: eval_builtin_error
+  want_error: "units.parse: spaces not allowed in resource strings"
+  strict_error: true
diff --git a/test/cases/testdata/units/test-parse-units.yaml b/test/cases/testdata/units/test-parse-units.yaml
new file mode 100644
index 0000000000..ab59a9a5c6
--- /dev/null
+++ b/test/cases/testdata/units/test-parse-units.yaml
@@ -0,0 +1,431 @@
+cases:
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("\"100TI\"") == 109951162777600
+    }
+  note: units_parse/removes quotes and lowercases string
+  query: data.test.p = x
+  want_result:
+  - x: true
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("0") == 0
+    }
+  note: units_parse/zero
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("0.0") == 0
+    }
+  note: units_parse/zero float
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse(".0") == 0
+    }
+  note: units_parse/zero bare float
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("12345") == 12345
+    }
+  note: units_parse/raw number
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10K") == 10000
+    }
+  note: units_parse/10 kilo uppercase
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10KI") == 10240
+    }
+  note: units_parse/10 Ki uppercase
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10k") == 10000
+    }
+  note: units_parse/10 K lowercase
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10Ki") == 10240
+    }
+  note: units_parse/10 Ki mixed case
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("200M") == 200000000
+    }
+  note: units_parse/200 mega
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("300Gi") == 322122547200
+    }
+  note: units_parse/300 Gi
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("1.1K") == 1100
+    }
+  note: units_parse/1.1 K floating point
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("1.1Ki") == 1126.4
+    }
+  note: units_parse/1.1 Ki floating point, not rounded
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse(".5K") == 500
+    }
+  note: units_parse/.5 K bare floating point
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100k") == 100000
+    }
+  note: units_parse/100 kilo as k
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100K") == 100000
+    }
+  note: units_parse/100 kilo as K
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100ki") == 102400
+    }
+  note: units_parse/100 kibi as ki
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100Ki") == 102400
+    }
+  note: units_parse/100 kibi as Ki
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        round(units.parse("100m") * 1000) == 100
+    }
+  note: units_parse/100 milli as m
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100M") == 100000000
+    }
+  note: units_parse/100 mega as M
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100mi") == 104857600
+    }
+  note: units_parse/100 mebi as mi
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100Mi") == 104857600
+    }
+  note: units_parse/100 mebi as Mi
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100g") == 100000000000
+    }
+  note: units_parse/100 giga as g
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100gi") == 107374182400
+    }
+  note: units_parse/100 gibi as gi
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100t") == 100000000000000
+    }
+  note: units_parse/100 tera as t
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100T") == 100000000000000
+    }
+  note: units_parse/100 tera as T
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100ti") == 109951162777600
+    }
+  note: units_parse/100 tebi as ti
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100Ti") == 109951162777600
+    }
+  note: units_parse/100 tebi as Ti
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100p") == 100000000000000000
+    }
+  note: units_parse/100 peta as p
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100P") == 100000000000000000
+    }
+  note: units_parse/100 peta as P
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100pi") == 112589990684262400
+    }
+  note: units_parse/100 pebi as pi
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("100Pi") == 112589990684262400
+    }
+  note: units_parse/100 pebi as Pi
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10e") == 10000000000000000000
+    }
+  note: units_parse/10 eta as e
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10E") == 10000000000000000000
+    }
+  note: units_parse/10 eta as E
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10ei") == 11529215046068469760
+    }
+  note: units_parse/10 ebi as ei
+  query: data.test.p = x
+  want_result:
+  - x: true
+
+- data:
+  modules:
+  - |
+    package test
+    p {
+        units.parse("10Ei") == 11529215046068469760
+    }
+  note: units_parse/10 ebi as Ei
+  query: data.test.p = x
+  want_result:
+  - x: true
diff --git a/test/cases/testdata/units/test-units-precision.yaml b/test/cases/testdata/units/test-units-precision.yaml
new file mode 100644
index 0000000000..c42933adb4
--- /dev/null
+++ b/test/cases/testdata/units/test-units-precision.yaml
@@ -0,0 +1,13 @@
+---
+cases:
+  - data:
+    modules:
+      - |
+        package test
+        p {
+            json.marshal(units.parse("1G")) == json.marshal(1000000000)
+        }
+    note: units_parse/no decimal places for integers
+    query: data.test.p = x
+    want_result:
+      - x: true
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0939.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0939.yaml
index c41b0eb48e..f1e5fae62c 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0939.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0939.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0940.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0940.yaml
index 05903b35d6..0da2d6421a 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0940.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0940.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: urlbuiltins/encode empty
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0941.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0941.yaml
index 0277e8a443..2f66f25ee7 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0941.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0941.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0942.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0942.yaml
index 5c5023f816..ad1ba0108b 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0942.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0942.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
@@ -92,4 +10,4 @@ cases:
   note: urlbuiltins/encode_object empty
   query: data.generated.p = x
   want_result:
-  - x: ""
+  - x: ''
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0943.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0943.yaml
index 566a723dbd..1ddf183182 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0943.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0943.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0944.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0944.yaml
index f070b0ef05..eb87517063 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0944.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0944.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0945.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0945.yaml
index f3c80c9255..99bf486be8 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0945.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0945.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0946.yaml b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0946.yaml
index 9a50bf9ed2..c08da5fcd1 100644
--- a/test/cases/testdata/urlbuiltins/test-urlbuiltins-0946.yaml
+++ b/test/cases/testdata/urlbuiltins/test-urlbuiltins-0946.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0726.yaml b/test/cases/testdata/varreferences/test-varreferences-0726.yaml
index 5b0bd1e410..0633dbc44c 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0726.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0726.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0727.yaml b/test/cases/testdata/varreferences/test-varreferences-0727.yaml
index f12548d724..8d5007ed17 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0727.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0727.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0728.yaml b/test/cases/testdata/varreferences/test-varreferences-0728.yaml
index 739482b233..a3e40278a2 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0728.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0728.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0729.yaml b/test/cases/testdata/varreferences/test-varreferences-0729.yaml
index 2f1e2be553..4770446f3a 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0729.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0729.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0730.yaml b/test/cases/testdata/varreferences/test-varreferences-0730.yaml
index 8fc9b7211d..6a92c8252d 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0730.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0730.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0731.yaml b/test/cases/testdata/varreferences/test-varreferences-0731.yaml
index 4cc4d5c2e9..03c0de7fe8 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0731.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0731.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0732.yaml b/test/cases/testdata/varreferences/test-varreferences-0732.yaml
index ada50c586c..2525e805e4 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0732.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0732.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0733.yaml b/test/cases/testdata/varreferences/test-varreferences-0733.yaml
index 5056d7e9ed..513db65901 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0733.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0733.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0734.yaml b/test/cases/testdata/varreferences/test-varreferences-0734.yaml
index bf95e94d5f..09d68a27fe 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0734.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0734.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0735.yaml b/test/cases/testdata/varreferences/test-varreferences-0735.yaml
index e808c16dd9..78bb362cfa 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0735.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0735.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0736.yaml b/test/cases/testdata/varreferences/test-varreferences-0736.yaml
index 662453c1f9..950ec5180c 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0736.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0736.yaml
@@ -1,87 +1,10 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
     numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+    - '1'
+    - '2'
+    - '3'
+    - '4'
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0737.yaml b/test/cases/testdata/varreferences/test-varreferences-0737.yaml
index 45dec8e57e..be92a06b75 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0737.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0737.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0738.yaml b/test/cases/testdata/varreferences/test-varreferences-0738.yaml
index 743c97b22f..8ba756e992 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0738.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0738.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0739.yaml b/test/cases/testdata/varreferences/test-varreferences-0739.yaml
index 38e08933bc..223b1efbe6 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0739.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0739.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0740.yaml b/test/cases/testdata/varreferences/test-varreferences-0740.yaml
index 2b417ec0c6..bdde050d53 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0740.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0740.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0741.yaml b/test/cases/testdata/varreferences/test-varreferences-0741.yaml
index 24d6a86782..367f8a3ae8 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0741.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0741.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/varreferences/test-varreferences-0742.yaml b/test/cases/testdata/varreferences/test-varreferences-0742.yaml
index 2a36cbbcc9..0d725e8ac0 100644
--- a/test/cases/testdata/varreferences/test-varreferences-0742.yaml
+++ b/test/cases/testdata/varreferences/test-varreferences-0742.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0620.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0620.yaml
index 53f5587ee6..cb8a4b0d6c 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0620.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0620.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0621.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0621.yaml
index 83f764ccf0..d5395e0199 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0621.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0621.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0622.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0622.yaml
index 87148b2215..74915570d5 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0622.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0622.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0623.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0623.yaml
index 759ee1b608..f06049bd4a 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0623.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0623.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0624.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0624.yaml
index ff24cdae74..1f86187622 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0624.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0624.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0625.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0625.yaml
index 5780774a0e..09928a1b66 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0625.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0625.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0626.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0626.yaml
index 988b773fc5..eac8ee06a1 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0626.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0626.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0627.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0627.yaml
index 41d2237010..022e5e6793 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0627.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0627.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0628.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0628.yaml
index 423f6499b0..2042b91799 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0628.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0628.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0629.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0629.yaml
index eef70b8a95..734df069ed 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0629.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0629.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0630.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0630.yaml
index 892f380a69..0712b9eb68 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0630.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0630.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0631.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0631.yaml
index 75551c2422..45b00c728d 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0631.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0631.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0632.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0632.yaml
index b5143b1ba2..01a8b2b081 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0632.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0632.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0633.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0633.yaml
index d6d74c3aaf..4b77f2ac01 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0633.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0633.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0634.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0634.yaml
index da7a0de84a..a2debe4bec 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0634.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0634.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0635.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0635.yaml
index f0396e2c4c..6331a6790c 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0635.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0635.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0636.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0636.yaml
index 9e5f4c202f..9836fd1570 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0636.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0636.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0637.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0637.yaml
index 6e0de08777..f04df38882 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0637.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0637.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0638.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0638.yaml
index c2d92b0b15..fd7cc8d146 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0638.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0638.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0639.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0639.yaml
index dbbbe587c1..eb2d2dde20 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0639.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0639.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0640.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0640.yaml
index f824da828d..82ee376c8f 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0640.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0640.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0641.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0641.yaml
index 3419e77c4a..07fd8870b1 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0641.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0641.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0642.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0642.yaml
index 03098d05a5..c3f04eadd7 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0642.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0642.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0643.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0643.yaml
index 988dc597c3..4825fc8ebf 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0643.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0643.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0644.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0644.yaml
index 23ed4c1704..ea960ceaa0 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0644.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0644.yaml
@@ -1,87 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0645.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0645.yaml
index ee8cb3c96e..f85ccb59e5 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0645.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0645.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0646.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0646.yaml
index b7a41ed0b4..6039fe6406 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0646.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0646.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0647.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0647.yaml
index 267ab5d2b6..5d9d853140 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0647.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0647.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0649.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0649.yaml
index 42648d02a3..a4ac15624c 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0649.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0649.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0650.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0650.yaml
index ba422ea63f..4908338053 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0650.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0650.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0651.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0651.yaml
index db641ba80c..a51b791483 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0651.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0651.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0653.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0653.yaml
index 4897afb209..881ae687b3 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0653.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0653.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0654.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0654.yaml
index 1c9baf4f6f..b21ba044e1 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0654.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0654.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0655.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0655.yaml
index d2d9321eae..c5c685ec0c 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0655.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0655.yaml
@@ -1,60 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
     l:
     - a: bob
       b: -1
@@ -71,17 +20,6 @@ cases:
       - 4
       - 5
       d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0656.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0656.yaml
index e325b3f704..9177220e84 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0656.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0656.yaml
@@ -1,60 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
     l:
     - a: bob
       b: -1
@@ -71,17 +20,6 @@ cases:
       - 4
       - 5
       d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0657.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0657.yaml
index f8210b6ce6..03c2c1f8c7 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0657.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0657.yaml
@@ -1,60 +1,9 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
     l:
     - a: bob
       b: -1
@@ -71,17 +20,6 @@ cases:
       - 4
       - 5
       d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0658.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0658.yaml
index 7cfcf37219..f5088068f1 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0658.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0658.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0659.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0659.yaml
index 3c23e172ac..930f7c4f71 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0659.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0659.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0660.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0660.yaml
index be47e54922..fdf50fd55f 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0660.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0660.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0661.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0661.yaml
index 9f6b761e5b..f9fb49a9cf 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0661.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0661.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0662.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0662.yaml
index 3a426e5ea8..8902c34c57 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0662.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0662.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0663.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0663.yaml
index e141c5620b..0d8c9c465b 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0663.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0663.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0664.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0664.yaml
index 4191de3b24..a9ce918235 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0664.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0664.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0665.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0665.yaml
index a7cbcfbef5..ba1b6ab0fd 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0665.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0665.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0666.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0666.yaml
index fe0c51ee8d..d7dafd9d67 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0666.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0666.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0667.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0667.yaml
index 5fde6f9f24..50da88fab0 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0667.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0667.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0668.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0668.yaml
index d63aed55d5..66ca2a264c 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0668.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0668.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0669.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0669.yaml
index b7a28b8f0e..d87ec1d058 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0669.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0669.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0670.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0670.yaml
index 2638680179..166c1b1b85 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0670.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0670.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0671.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0671.yaml
index 699b77fd03..dd476434dd 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0671.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0671.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0672.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0672.yaml
index f6b17b5028..bec93137d3 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0672.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0672.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0673.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0673.yaml
index 0f90c72f9d..f0a25453b9 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0673.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0673.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0674.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0674.yaml
index 35e8fabc37..fc6a43d440 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0674.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0674.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0675.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0675.yaml
index 3e6be00f94..f5c523d44f 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0675.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0675.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0676.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0676.yaml
index 1f344c0829..464feb1879 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0676.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0676.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0677.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0677.yaml
index 852518fe0a..f424183007 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0677.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0677.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0678.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0678.yaml
index b62f311b1f..85aafaffb5 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0678.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0678.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0679.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0679.yaml
index 5195718f91..32ba636d95 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0679.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0679.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0680.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0680.yaml
index 77e40f7e5a..c31a6cc41d 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0680.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0680.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0681.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0681.yaml
index d0e19e1680..bbfbc671ab 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0681.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0681.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0682.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0682.yaml
index d0d4101237..1c3b1c1586 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0682.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0682.yaml
@@ -1,87 +1,12 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
     d:
       e:
       - bar
       - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0683.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0683.yaml
index 5cf6f73f1e..65dc1db06d 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0683.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0683.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0684.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0684.yaml
index 2373b1cf15..a178839d7c 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0684.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0684.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0685.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0685.yaml
index 564c01ca2d..543fb039ae 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0685.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0685.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0686.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0686.yaml
index 9b45faaef8..777535c750 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0686.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0686.yaml
@@ -1,87 +1,16 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
     c:
     - x:
       - true
       - false
       - foo
-      "y":
+      y:
       - null
       - 3.14159
       z:
         p: true
         q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0687.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0687.yaml
index 32aaa7f6fd..912f78377b 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0687.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0687.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0688.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0688.yaml
index 2ad9b58f36..a4a8955475 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0688.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0688.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0689.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0689.yaml
index fb88a8263d..d80feea91d 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0689.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0689.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0690.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0690.yaml
index ddf7305091..c2b82f99b2 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0690.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0690.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0691.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0691.yaml
index 19c77dbe2a..18c5018925 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0691.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0691.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0692.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0692.yaml
index 90b59a0b93..d84ed16c12 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0692.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0692.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0693.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0693.yaml
index a7a07e5bee..948dd42d99 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0693.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0693.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/virtualdocs/test-virtualdocs-0694.yaml b/test/cases/testdata/virtualdocs/test-virtualdocs-0694.yaml
index 64a8b71cd8..f2b1dc6371 100644
--- a/test/cases/testdata/virtualdocs/test-virtualdocs-0694.yaml
+++ b/test/cases/testdata/virtualdocs/test-virtualdocs-0694.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0970.yaml b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0970.yaml
index d0ab715c4f..2fb64d5778 100644
--- a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0970.yaml
+++ b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0970.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0971.yaml b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0971.yaml
index adede97f41..95d0b69cd3 100644
--- a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0971.yaml
+++ b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0971.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0972.yaml b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0972.yaml
index 4dbcf82c80..542c0d7fe1 100644
--- a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0972.yaml
+++ b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0972.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0973.yaml b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0973.yaml
index ae5b20b91d..6a89e633e7 100644
--- a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0973.yaml
+++ b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0973.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0974.yaml b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0974.yaml
index 4e6ad4848a..20e49522bd 100644
--- a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0974.yaml
+++ b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0974.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0975.yaml b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0975.yaml
index b7f703e12e..e626c85cbc 100644
--- a/test/cases/testdata/walkbuiltin/test-walkbuiltin-0975.yaml
+++ b/test/cases/testdata/walkbuiltin/test-walkbuiltin-0975.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-with-and-ndbcache-issue.yaml b/test/cases/testdata/withkeyword/test-with-and-ndbcache-issue.yaml
new file mode 100644
index 0000000000..aaa125e0e9
--- /dev/null
+++ b/test/cases/testdata/withkeyword/test-with-and-ndbcache-issue.yaml
@@ -0,0 +1,16 @@
+cases:
+- modules:
+  - |
+    package rules
+
+    p {
+      time.now_ns(now)
+    }
+
+    q { p with data.x as 7 }
+  note: "with: ndb_cache-issue"
+  query: data.rules = x
+  want_result:
+  - x:
+      p: true
+      q: true
\ No newline at end of file
diff --git a/test/cases/testdata/withkeyword/test-with-builtin-mock.yaml b/test/cases/testdata/withkeyword/test-with-builtin-mock.yaml
new file mode 100644
index 0000000000..0dad7eb735
--- /dev/null
+++ b/test/cases/testdata/withkeyword/test-with-builtin-mock.yaml
@@ -0,0 +1,451 @@
+cases:
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p = y {
+      y = time.now_ns() with time.now_ns as f
+    }
+  note: 'withkeyword/builtin: direct call, arity 0'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+
+    f(_) = 1
+    p = y {
+      y = count([1,2,3]) with count as f
+    }
+  note: 'withkeyword/builtin: direct call, arity 1'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+
+    f(_) = 1
+    p {
+      q with count as f
+    }
+    q {
+      count([1,2,3]) == 1
+    }
+  note: 'withkeyword/builtin: indirect call, arity 1'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p {
+      q with time.now_ns as f
+    }
+    q {
+      time.now_ns() == 1
+    }
+  note: 'withkeyword/builtin: indirect call, arity 0'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p {
+      q with time.now_ns as f
+      not q
+    }
+    q {
+      time.now_ns() == 1
+    }
+  note: 'withkeyword/builtin: indirect call, arity 0, rule queried with and without mock'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p {
+      q with time.now_ns as f
+    }
+    q {
+      time.now_ns() == 1
+    }
+  note: 'withkeyword/builtin: indirect call, arity 0, query package'
+  query: data.test = x
+  want_result:
+  - x:
+      f: 1
+      p: true
+- modules:
+  - |
+    package test
+    import future.keywords.in
+
+    pass_resp = {"body": {"roles": ["admin"]}}
+    deny_resp = {"body": {"roles": []}}
+    mock_http_send(req) = pass_resp {
+      req.body.name == "alice"
+    } else = deny_resp
+
+    test_allow {
+      allow with http.send as mock_http_send with input.name as "alice"
+    }
+
+    allow {
+      "admin" in http.send({"method": "GET", "body": input}).body.roles
+    }
+  note: 'withkeyword/builtin: http.send example'
+  query: data.test.test_allow = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+    import future.keywords.in
+
+    pass_resp = {"body": {"jwt": "myjot"}}
+    deny_resp = {"body"}
+    mock_http_send(req) = pass_resp {
+      req.body.name == "alice"
+    } else = deny_resp
+
+    mock_decode_verify("myjot", _) = [true, {}, {"owner": "alice"}]
+
+    test_allow {
+      allow
+        with data.verification.cert as "cert"
+        with input.name as "alice"
+        with http.send as mock_http_send
+        with io.jwt.decode_verify as mock_decode_verify
+    }
+
+    allow {
+      payload.owner == input.name
+    }
+
+    claims[k] = v {
+      resp := http.send({"method": "GET", "body": input}).body
+      some k, v in resp
+    }
+    payload = p {
+      some p
+      [true, _, p] = io.jwt.decode_verify(claims.jwt, { "cert": data.verification.cert, "iss": "issuer"})
+    }
+  note: 'withkeyword/builtin: nested, multiple mocks'
+  query: data.test.test_allow = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p {
+      q with time.now_ns as f
+    }
+    q {
+      valid_time(1)
+    }
+    valid_time(x) { time.now_ns() == x }
+  note: 'withkeyword/builtin: indirect call through function'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p {
+      q with time.now_ns as f
+      not q
+    }
+    q {
+      valid_time(1)
+    }
+    valid_time(x) { time.now_ns() == x }
+  note: 'withkeyword/builtin: indirect call through function, rule with and without mock'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f() = 1
+    p {
+      q with time.now_ns as f
+    }
+    q {
+      valid_time(1)
+    }
+    valid_time(x) { time.now_ns() == x }
+  note: 'withkeyword/builtin: indirect call through function, query package'
+  query: data.test = x
+  want_result:
+  - x:
+      f: 1
+      p: true 
+- modules:
+  - |
+    package test
+    import future.keywords.in
+
+    mock_count("one") = 1
+    mock_count(x) = count(x) {
+      x != "one"
+    }
+
+    numbers := {"one", "two", "tree"}
+    p = s {
+      s := { count(n) | some n in numbers } with count as mock_count
+    }
+  note: 'withkeyword/builtin: mock function calls original'
+  query: data.test.p = x
+  want_result:
+  - x:
+    - 1
+    - 3
+    - 4
+- modules:
+  - |
+    package test
+    import future.keywords.in
+
+    mock_concat("one", _) = ["one"]
+    mock_concat("one", x) = x
+
+    numbers := ["one", "one"]
+    p = s {
+      s := { concat(n, [n]) | some n in numbers } with concat as mock_concat
+    }
+  note: 'withkeyword/builtin: mock function returns same result for both rule defs'
+  query: data.test.p = x
+  want_result:
+  - x: [["one"]]
+- modules:
+  - |
+    package test
+    import future.keywords.in
+
+    mock_concat("one", _) = ["one"]
+    mock_concat("one", x) = x
+
+    count_four(4) = 4
+    count_four(x) = count(x)
+
+    numbers := {"one", "two", "tree"}
+    q = s {
+      s := { concat(n, [n]) | some n in numbers } with concat as mock_concat
+      r
+    }
+    r {
+      count(input.four) == 4
+    }
+    p = y {
+      y := q
+        with concat as mock_concat
+        with count as count_four
+        with input.four as 4
+    }
+  note: 'withkeyword/builtin: nested, mock function calls original'
+  query: data.test.p = x
+  want_result:
+  - x: [["one"]]
+- modules:
+  - |
+    package test
+
+    f(_) = 1
+    g(x) = count(x) # replaced with f by inner "with"
+
+    q = y {
+      y = count([1,2,3]) with count as f
+    }
+    p = y {
+      y = q with count as g
+    }
+  note: 'withkeyword/builtin: multiple with'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+
+    f(x) = object.union_n(x) { { x: i | x := ["a", "a"][i]} } # never called, runtime error
+    g(x) = count(x)
+    p {
+      q with count as f
+    }
+    q {
+      r with object.union_n as g
+    }
+    r {
+      object.union_n([{}])
+    }
+  note: 'withkeyword/builtin: mock will not call other mock'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f(x) = object.union_n(x) # b1
+    g(x) = 123 {
+      count(x) # b2
+      s with array.reverse as h
+    }
+    h(_) = ["replaced"]
+    p { q with object.union_n as f }
+    q { r with count as g }
+    r { x := [{"foo": 4}, {"baz": 5}]; count(x) == 123; object.union_n(x) == {"foo": 4, "baz": 5} }
+    s { x := [{}]; array.reverse(x) == ["replaced"] }
+  note: 'withkeyword/builtin: nested scope handling'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    p = y {
+      y = time.now_ns() with time.now_ns as 12300
+    }
+  note: 'withkeyword/builtin-value: arity-0, captured output'
+  query: data.test.p = x
+  want_result:
+  - x: 12300
+- modules:
+  - |
+    package test
+
+    p {
+      time.now_ns() with time.now_ns as false
+    }
+  note: 'withkeyword/builtin-value: arity-0, false'
+  query: data.test.p = x
+  want_result: []
+- modules:
+  - |
+    package test
+
+    p {
+      time.now_ns() with time.now_ns as true
+    }
+  note: 'withkeyword/builtin-value: arity-0'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    p {
+      x := true
+      time.now_ns() with time.now_ns as x
+    }
+  note: 'withkeyword/builtin-value: arity-0, var'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    p {
+      count([]) == 1 with count as 1
+    }
+  note: 'withkeyword/builtin-value: arity-1'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    p {
+      count([], 1) with count as 1
+    }
+  note: 'withkeyword/builtin-value: arity-1, captured'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    p {
+      count(input) == 1 with count as 1
+    }
+  note: 'withkeyword/builtin-value: arity-1, input must still be defined'
+  query: data.test.p = x
+  want_result: []
+- modules:
+  - |
+    package test
+
+    p = x {
+      x = time.now_ns() with time.now_ns as opa.runtime
+    }
+  note: 'withkeyword/builtin-builtin: arity 0'
+  query: data.test.p = x
+  want_result:
+  - x: {}
+- modules:
+  - |
+    package test
+
+    p = x {
+      x = count([{}, {"foo": 3}]) with count as object.union_n
+    }
+  note: 'withkeyword/builtin-builtin: arity 1, replacement is compound'
+  query: data.test.p = x
+  want_result:
+  - x:
+      foo: 3
+- modules:
+  - |
+    package test
+
+    p = x {
+      x = object.union_n([{}, {"foo": 3}]) with object.union_n as count
+    }
+  note: 'withkeyword/builtin-builtin: arity 1, replacement is simple'
+  query: data.test.p = x
+  want_result:
+  - x: 2
+- modules:
+  - |
+    package test
+    p {
+      count([1,2,3]) == 1 with count as [1|true][0]
+    }
+  note: 'withkeyword/builtin: direct call, arity 1, replacement is value that needs eval (array comprehension)'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+    p {
+      q with count as [1|true][0]
+    }
+    q {
+      count([1,2,3]) == 1
+    }
+  note: 'withkeyword/builtin: indirect call, arity 1, replacement is value that needs eval (array comprehension)'
+  query: data.test.p = x
+  want_result:
+  - x: true
\ No newline at end of file
diff --git a/test/cases/testdata/withkeyword/test-with-function-mock.yaml b/test/cases/testdata/withkeyword/test-with-function-mock.yaml
new file mode 100644
index 0000000000..3020aa4cdf
--- /dev/null
+++ b/test/cases/testdata/withkeyword/test-with-function-mock.yaml
@@ -0,0 +1,127 @@
+cases:
+- modules:
+  - |
+    package test
+    f(_) = 2
+    p = y {
+      y = f(true) with f as 1
+    }
+  note: 'withkeyword/function: direct call, value replacement, arity 1' # NOTE(sr): arity-0 functions fail typechecking
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+    f(_) = 2
+    g(_) = 1
+    p = y {
+      y = f(true) with f as g
+    }
+  note: 'withkeyword/function: direct call, function replacement, arity 1'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+    f(_) = 2
+    g(_) = 1
+    p {
+      f(true, 1) with f as g
+    }
+  note: 'withkeyword/function: direct call, function replacement, arity 1, result captured'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+    f(_) = 2
+    p = y {
+      y = f([1]) with f as count
+    }
+  note: 'withkeyword/function: direct call, built-in replacement, arity 1'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+    f(_) = 2
+    p {
+      f([1], 1) with f as count
+    }
+  note: 'withkeyword/function: direct call, built-in replacement, arity 1, result captured'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f1(x) = object.union_n(x)
+    f2(x) = count(x)
+    f3(x) = array.reverse(x)
+    f(x) = f1(x)
+    g(x) = 123 {
+      f2(x)
+      s with f3 as h
+    }
+    h(_) = ["replaced"]
+    p { q with f1 as f }
+    q { r with f2 as g }
+    r { x := [{"foo": 4}, {"baz": 5}]; f2(x) == 123; f1(x) == {"foo": 4, "baz": 5} }
+    s { x := [{}]; f3(x) == ["replaced"] }
+  note: 'withkeyword/function: nested scope handling'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+
+    f(x) = 2
+    g(x) = f(x)
+    p = y { y := f(1) with f as g }
+  note: 'withkeyword/function: simple scope handling (no recursion here)'
+  query: data.test.p = x
+  want_result:
+  - x: 2
+- modules:
+  - |
+    package test
+
+    f(_) = 1 {
+      input.x = "x"
+    }
+    p = y { y := f(1) with f as 2 }
+  note: 'withkeyword/function: rule indexing irrelevant'
+  query: data.test.p = x
+  want_result:
+  - x: 2
+- modules:
+  - |
+    package test
+    f(_) = 1
+    p {
+      f([1,2,3]) == 1 with f as [1|true][0]
+    }
+  note: 'withkeyword/function: direct call, arity 1, replacement is value that needs eval (array comprehension)'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+    f(_) = 1
+    p {
+      q with f as [1|true][0]
+    }
+    q {
+      f([1,2,3]) == 1
+    }
+  note: 'withkeyword/function: indirect call, arity 1, replacement is value that needs eval (array comprehension)'
+  query: data.test.p = x
+  want_result:
+  - x: true
\ No newline at end of file
diff --git a/test/cases/testdata/withkeyword/test-with-function-mocks-issue-5299.yaml b/test/cases/testdata/withkeyword/test-with-function-mocks-issue-5299.yaml
new file mode 100644
index 0000000000..d36e53f68a
--- /dev/null
+++ b/test/cases/testdata/withkeyword/test-with-function-mocks-issue-5299.yaml
@@ -0,0 +1,59 @@
+cases:
+- modules:
+  - |
+    package test
+    f(_) = 2
+    f0 := 1 # a rule
+    p = y {
+      y = f(true) with f as f0
+    }
+  note: 'withkeyword/function: direct call, rule replacement'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+    f(_) = 2
+    f0 := 1 # a rule
+    p {
+      f(true, 1) with f as f0
+    }
+  note: 'withkeyword/function: captured result, rule replacement'
+  query: data.test.p = x
+  want_result:
+  - x: true
+- modules:
+  - |
+    package test
+    f := 1 # a rule
+    p = y {
+      y = time.now_ns() with time.now_ns as f
+    }
+  note: 'withkeyword/builtin: direct call, arity 0, rule replacement'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+    f := 1 # a rule
+    p = y {
+      y = count([1,2,3]) with count as f
+    }
+  note: 'withkeyword/builtin: direct call, arity 1, rule replacement'
+  query: data.test.p = x
+  want_result:
+  - x: 1
+- modules:
+  - |
+    package test
+    f := 1 # a rule
+    g(x) := count(x)
+    p = y {
+      y = g([1,2,3]) with count as f
+    }
+  note: 'withkeyword/builtin: indirect call, arity 1, rule replacement'
+  query: data.test.p = x
+  want_result:
+  - x: 1
\ No newline at end of file
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1015.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1015.yaml
index 0efcee6bb1..5cfe09518f 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1015.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1015.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1016.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1016.yaml
index 7d9e12a7ce..13d97240a7 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1016.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1016.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1017.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1017.yaml
index 2e0eaa7494..a9595c716e 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1017.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1017.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1018.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1018.yaml
index c4511ab663..58f3afc0d3 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1018.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1018.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1020.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1020.yaml
index 3f1d4789cc..8a09d37e26 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1020.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1020.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"a": {"d": 3}, "e": 4}'
   modules:
   - |
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1021.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1021.yaml
index e262a4e63d..c6790be342 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1021.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1021.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"a": {"d": 3}, "e": 4}'
   modules:
   - |
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1022.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1022.yaml
index 0f4691ba00..66e8b0e86a 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1022.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1022.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1023.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1023.yaml
index 6a4ca23871..c7022ceb66 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1023.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1023.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package test.a
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1024.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1024.yaml
index 95451a16ca..bb8250fbcc 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1024.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1024.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '{"a": {"b": 1, "c": 2}}'
   modules:
   - |
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1025.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1025.yaml
index 0e04f2e80f..3b0984165a 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1025.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1025.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1026.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1026.yaml
index 39f78bd17e..f5c3b95a7a 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1026.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1026.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1027.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1027.yaml
index aeb4b7416f..552f8d4cd5 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1027.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1027.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '"b"'
   modules:
   - |
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1028.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1028.yaml
index 21e1d82473..8f7f13f628 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1028.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1028.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   input_term: '"c"'
   modules:
   - |
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1029.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1029.yaml
index 37b3e7185c..f9a20fdd25 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1029.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1029.yaml
@@ -1,88 +1,6 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
-  input_term: "2"
+- data: {}
+  input_term: '2'
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1030.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1030.yaml
index 4521297ea1..1e6b2003b1 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1030.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1030.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1031.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1031.yaml
index aad4739def..23b3cdf132 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1031.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1031.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1032.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1032.yaml
index 91444c3f6b..55bee69494 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1032.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1032.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1033.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1033.yaml
index 0a2adff586..e957aa2ed4 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1033.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1033.yaml
@@ -1,87 +1,8 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1034.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1034.yaml
index 5b40c52301..f32d388078 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1034.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1034.yaml
@@ -8,80 +8,6 @@ cases:
     b:
       v1: hello
       v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1035.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1035.yaml
index 74bb1e0e33..6c4fe62a0b 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1035.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1035.yaml
@@ -1,6 +1,5 @@
 cases:
-- data:
-    a: testdata
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1036.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1036.yaml
index 76d33b22d5..3aa4022412 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1036.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1036.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1037.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1037.yaml
index d1326ff3a1..d5f22174ac 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1037.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1037.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1038.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1038.yaml
index 049fd9f498..3455ee743e 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1038.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1038.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1039.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1039.yaml
index f2e18b5733..b8169840a8 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1039.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1039.yaml
@@ -1,60 +1,5 @@
 cases:
 - data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
     l:
     - a: bob
       b: -1
@@ -71,17 +16,6 @@ cases:
       - 4
       - 5
       d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1040.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1040.yaml
index dd97839f7d..10f8fe2e2c 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1040.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1040.yaml
@@ -1,13 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1041.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1041.yaml
index 62a69bf287..b346d81097 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1041.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1041.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1042.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1042.yaml
index 49878322fd..6d64e8683a 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1042.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1042.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1043.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1043.yaml
index aa495a2258..482f9f412b 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1043.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1043.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1044.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1044.yaml
index e59378f74e..98817efa5c 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1044.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1044.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1045.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1045.yaml
index 396dad2a11..dfd06f3fdb 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1045.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1045.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1046.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1046.yaml
index c5eea20327..1202d3bbc3 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1046.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1046.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1047.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1047.yaml
index f951e62704..9e06602a4e 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1047.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1047.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1048.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1048.yaml
index 4fd6f3afb3..48953a4b45 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1048.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1048.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1049.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1049.yaml
index 4c7b08c848..7463e54227 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1049.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1049.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1050.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1050.yaml
index 0083022c9d..a40e2c4f7d 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1050.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1050.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1051.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1051.yaml
index 4cad932976..04a6055311 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1051.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1051.yaml
@@ -5,83 +5,6 @@ cases:
     - 2
     - 3
     - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1052.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1052.yaml
index ca3c8b1663..6b4eaa7dab 100644
--- a/test/cases/testdata/withkeyword/test-withkeyword-1052.yaml
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1052.yaml
@@ -1,87 +1,5 @@
 cases:
-- data:
-    a:
-    - 1
-    - 2
-    - 3
-    - 4
-    b:
-      v1: hello
-      v2: goodbye
-    c:
-    - x:
-      - true
-      - false
-      - foo
-      "y":
-      - null
-      - 3.14159
-      z:
-        p: true
-        q: false
-    d:
-      e:
-      - bar
-      - baz
-    f:
-    - xs:
-      - 1
-      ys:
-      - 2
-    - xs:
-      - 2
-      ys:
-      - 3
-    g:
-      a:
-      - 1
-      - 0
-      - 0
-      - 0
-      b:
-      - 0
-      - 2
-      - 0
-      - 0
-      c:
-      - 0
-      - 0
-      - 0
-      - 4
-    h:
-    - - 1
-      - 2
-      - 3
-    - - 2
-      - 3
-      - 4
-    l:
-    - a: bob
-      b: -1
-      c:
-      - 1
-      - 2
-      - 3
-      - 4
-    - a: alice
-      b: 1
-      c:
-      - 2
-      - 3
-      - 4
-      - 5
-      d: null
-    m: []
-    numbers:
-    - "1"
-    - "2"
-    - "3"
-    - "4"
-    strings:
-      bar: 2
-      baz: 3
-      foo: 1
-    three: 3
+- data: {}
   modules:
   - |
     package generated
diff --git a/test/cases/testdata/withkeyword/test-withkeyword-1054.yaml b/test/cases/testdata/withkeyword/test-withkeyword-1054.yaml
new file mode 100644
index 0000000000..e599438d0e
--- /dev/null
+++ b/test/cases/testdata/withkeyword/test-withkeyword-1054.yaml
@@ -0,0 +1,76 @@
+cases:
+- data:
+  modules:
+    - |
+      package test
+      
+      allow {
+        a := {"x": 0}
+      
+        input.x == 0 with input as a
+      }
+  note: withkeyword/rewrite declared variables in with value
+  query: data.test.allow = x
+  want_result:
+    - x: true
+- data:
+  modules:
+    - |
+      package test
+      
+      allow {
+        a := {"x": 0}
+      
+        input.x == 1 with input as object.union(a, {"x": 1})
+        input.x == -1 with input as object.union(a, {"x": -1})
+      
+        input.x == 2 with input as object.union(a, object.union(a, {"x": 2}))
+        input.x == -2 with input as object.union(a, object.union(a, {"x": -2}))
+      }
+  note: withkeyword/rewrite declared variables nested in function call in with value
+  query: data.test.allow = x
+  want_result:
+    - x: true
+- data:
+  modules:
+    - |
+      package test
+      
+      allow {
+        a := 1
+        input[0] == 1 with input as [a]
+        input[0][0] == 1 with input as [[a]]
+      }
+  note: withkeyword/rewrite declared variables nested in array in with value
+  query: data.test.allow = x
+  want_result:
+    - x: true
+- data:
+  modules:
+    - |
+      package test
+      
+      allow {
+        a := 1
+        input.a == 1 with input as {"a": a}
+        input.nested.a == 1 with input as {"nested": {"a": a}}
+      }
+  note: withkeyword/rewrite declared variables nested in object in with value
+  query: data.test.allow = x
+  want_result:
+    - x: true
+- data:
+  modules:
+    - |
+      package test
+      
+      allow {
+        a := 1
+        b := 2
+      
+        input.min == 1 with input as object.union({"min": 0}, {"min": min([a, b])}) 
+      }
+  note: withkeyword/rewrite declared variables nested in function/array/object in with value
+  query: data.test.allow = x
+  want_result:
+    - x: true
diff --git a/test/cli/smoke/.gitignore b/test/cli/smoke/.gitignore
new file mode 100644
index 0000000000..35c5bbe553
--- /dev/null
+++ b/test/cli/smoke/.gitignore
@@ -0,0 +1 @@
+!bundle.tar.gz
diff --git a/test/cli/smoke/.manifest b/test/cli/smoke/.manifest
new file mode 100644
index 0000000000..17a3a0e9a6
--- /dev/null
+++ b/test/cli/smoke/.manifest
@@ -0,0 +1,3 @@
+{
+    "roots": ["test", "namespace", "x"]
+}
\ No newline at end of file
diff --git a/test/cli/smoke/data.yaml b/test/cli/smoke/data.yaml
new file mode 100644
index 0000000000..14bb2664dd
--- /dev/null
+++ b/test/cli/smoke/data.yaml
@@ -0,0 +1,3 @@
+x:
+  foo:
+    bar: true
diff --git a/test/cli/smoke/golden-bundle.tar.gz b/test/cli/smoke/golden-bundle.tar.gz
new file mode 100644
index 0000000000..c48dac1da7
Binary files /dev/null and b/test/cli/smoke/golden-bundle.tar.gz differ
diff --git a/test/cli/smoke/input.json b/test/cli/smoke/input.json
new file mode 100644
index 0000000000..7f9c93371c
--- /dev/null
+++ b/test/cli/smoke/input.json
@@ -0,0 +1 @@
+{"yay": true}
diff --git a/test/cli/smoke/namespace/data.json b/test/cli/smoke/namespace/data.json
new file mode 100644
index 0000000000..e63d37b65a
--- /dev/null
+++ b/test/cli/smoke/namespace/data.json
@@ -0,0 +1,3 @@
+{
+    "foo": "bar"
+}
diff --git a/test/cli/smoke/test.rego b/test/cli/smoke/test.rego
new file mode 100644
index 0000000000..33dfa774a5
--- /dev/null
+++ b/test/cli/smoke/test.rego
@@ -0,0 +1,8 @@
+package test
+import future.keywords.if
+
+# METADATA
+# entrypoint: true
+result if foo[input.yay]
+
+foo := data.x.foo
diff --git a/test/e2e/authz/authz_bench_integration_test.go b/test/e2e/authz/authz_bench_integration_test.go
index 92605b2e54..7d3f2a0338 100644
--- a/test/e2e/authz/authz_bench_integration_test.go
+++ b/test/e2e/authz/authz_bench_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"flag"
-	"io/ioutil"
+	"io"
 	"os"
 	"strings"
 	"testing"
@@ -24,7 +24,8 @@ func TestMain(m *testing.M) {
 	flag.Parse()
 
 	testServerParams := e2e.NewAPIServerTestParams()
-
+	disk, cleanup := diskStorage()
+	testServerParams.DiskStorage = disk
 	var err error
 	testRuntime, err = e2e.NewTestRuntime(testServerParams)
 	if err != nil {
@@ -32,6 +33,11 @@ func TestMain(m *testing.M) {
 	}
 
 	errc := testRuntime.RunTests(m)
+	if cleanup != nil {
+		if err := cleanup(); err != nil {
+			panic(err)
+		}
+	}
 	os.Exit(errc)
 }
 
@@ -101,7 +107,7 @@ func runAuthzBenchmark(b *testing.B, mode testAuthz.InputMode, numPaths int) {
 		}
 		b.StopTimer()
 
-		body, err := ioutil.ReadAll(resp)
+		body, err := io.ReadAll(resp)
 		if err != nil {
 			b.Fatalf("unexpected error reading response body: %s", err)
 		}
diff --git a/test/e2e/authz/disk.go b/test/e2e/authz/disk.go
new file mode 100644
index 0000000000..058320b6fe
--- /dev/null
+++ b/test/e2e/authz/disk.go
@@ -0,0 +1,24 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+//go:build bench_disk
+// +build bench_disk
+
+// nolint: deadcode,unused // build tags confuse these linters
+package authz
+
+import (
+	"os"
+
+	"github.com/open-policy-agent/opa/storage/disk"
+)
+
+func diskStorage() (*disk.Options, func() error) {
+	dir, err := os.MkdirTemp("", "disk-store")
+	if err != nil {
+		panic(err)
+	}
+
+	return &disk.Options{Dir: dir, Partitions: nil}, func() error { return os.RemoveAll(dir) }
+}
diff --git a/test/e2e/authz/nodisk.go b/test/e2e/authz/nodisk.go
new file mode 100644
index 0000000000..8849441bd1
--- /dev/null
+++ b/test/e2e/authz/nodisk.go
@@ -0,0 +1,15 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+//go:build !bench_disk
+// +build !bench_disk
+
+// nolint: deadcode,unused // build tags confuse these linters
+package authz
+
+import "github.com/open-policy-agent/opa/storage/disk"
+
+func diskStorage() (*disk.Options, func() error) {
+	return nil, nil
+}
diff --git a/test/e2e/certrefresh/certrefresh_test.go b/test/e2e/certrefresh/certrefresh_test.go
index 70fa800706..ae51fced9e 100644
--- a/test/e2e/certrefresh/certrefresh_test.go
+++ b/test/e2e/certrefresh/certrefresh_test.go
@@ -10,7 +10,6 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
@@ -43,7 +42,7 @@ var certFile, certKeyFile string
 
 func TestMain(m *testing.M) {
 	flag.Parse()
-	caCertPEM, err := ioutil.ReadFile("testdata/ca.pem")
+	caCertPEM, err := os.ReadFile("testdata/ca.pem")
 	if err != nil {
 		fatal(err)
 	}
@@ -94,38 +93,39 @@ func TestMain(m *testing.M) {
 }
 
 func TestCertificateRotation(t *testing.T) {
+	wait := 20 * time.Millisecond // file reload happens every millisecond
 
 	// before rotation
 	cert := getCert(t)
-	if exp, act := serial0, string(cert.SerialNumber.String()); exp != act {
+	if exp, act := serial0, cert.SerialNumber.String(); exp != act {
 		t.Fatalf("expected signature %s, got %s", exp, act)
 	}
 
 	// replace file on disk
 	replaceCerts(t, certFile1, certKeyFile1)
-	time.Sleep(10 * time.Millisecond) // file reload happens every millisecond
+	time.Sleep(wait)
 
 	// after rotation
 	cert = getCert(t)
-	if exp, act := serial1, string(cert.SerialNumber.String()); exp != act {
+	if exp, act := serial1, cert.SerialNumber.String(); exp != act {
 		t.Fatalf("expected signature %s, got %s", exp, act)
 	}
 
 	// replace file with nothing
 	replaceCerts(t, os.DevNull, os.DevNull)
-	time.Sleep(10 * time.Millisecond)
+	time.Sleep(wait)
 
 	// second cert still used
 	cert = getCert(t)
-	if exp, act := serial1, string(cert.SerialNumber.String()); exp != act {
+	if exp, act := serial1, cert.SerialNumber.String(); exp != act {
 		t.Fatalf("expected signature %s, got %s", exp, act)
 	}
 
 	// go back to first cert
 	replaceCerts(t, certFile0, certKeyFile0)
-	time.Sleep(10 * time.Millisecond)
+	time.Sleep(wait)
 	cert = getCert(t)
-	if exp, act := serial0, string(cert.SerialNumber.String()); exp != act {
+	if exp, act := serial0, cert.SerialNumber.String(); exp != act {
 		t.Fatalf("expected signature %s, got %s", exp, act)
 	}
 }
@@ -154,7 +154,12 @@ func copy(from, to string) error {
 	defer dst.Close()
 
 	_, err = io.Copy(dst, src)
-	return err
+	if err != nil {
+		return err
+	}
+
+	// Ensure that our writes get committed to disk, even on slower systems.
+	return dst.Sync()
 }
 
 func getCert(t *testing.T) *x509.Certificate {
diff --git a/test/e2e/concurrency/concurrency_test.go b/test/e2e/concurrency/concurrency_test.go
index e302ca3766..d81993d31f 100644
--- a/test/e2e/concurrency/concurrency_test.go
+++ b/test/e2e/concurrency/concurrency_test.go
@@ -1,4 +1,4 @@
-package metrics
+package concurrency
 
 import (
 	"flag"
@@ -8,6 +8,8 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/open-policy-agent/opa/server/types"
+	"github.com/open-policy-agent/opa/storage/disk"
 	"github.com/open-policy-agent/opa/test/e2e"
 )
 
@@ -17,16 +19,29 @@ func TestMain(m *testing.M) {
 	flag.Parse()
 	testServerParams := e2e.NewAPIServerTestParams()
 
-	var err error
-	testRuntime, err = e2e.NewTestRuntimeWithOpts(e2e.TestRuntimeOpts{}, testServerParams)
+	dir, err := os.MkdirTemp("", "disk-store")
 	if err != nil {
-		os.Exit(1)
+		panic(err)
 	}
+	defer func() { os.RemoveAll(dir) }()
 
-	os.Exit(testRuntime.RunTests(m))
+	for _, opts := range []*disk.Options{
+		nil,
+		{Dir: dir, Partitions: nil},
+	} {
+		var err error
+		testServerParams.DiskStorage = opts
+		testRuntime, err = e2e.NewTestRuntime(testServerParams)
+		if err != nil {
+			panic(err)
+		}
+		if ec := testRuntime.RunTests(m); ec != 0 {
+			os.Exit(ec)
+		}
+	}
 }
 
-func TestConcurrency(t *testing.T) {
+func TestConcurrencyGetV1Data(t *testing.T) {
 
 	policy := `
 	package test
@@ -39,10 +54,12 @@ func TestConcurrency(t *testing.T) {
 	}
 
 	var wg sync.WaitGroup
+	num := runtime.NumCPU()
+	wg.Add(num)
 
-	for i := 0; i < runtime.NumCPU(); i++ {
-		wg.Add(1)
+	for i := 0; i < num; i++ {
 		go func() {
+			defer wg.Done()
 			for n := 0; n < 1000; n++ {
 				dr := struct {
 					Result bool `json:"result"`
@@ -56,10 +73,49 @@ func TestConcurrency(t *testing.T) {
 					return
 				}
 			}
-			wg.Done()
 		}()
 	}
 
 	wg.Wait()
+}
+
+func TestConcurrencyCompile(t *testing.T) {
+
+	policy := `
+	package test
+	f(_)
+	p {
+		not q
+	}
+	q {
+		not f(input.foo)
+	}
+	`
+
+	err := testRuntime.UploadPolicy(t.Name(), strings.NewReader(policy))
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	req := types.CompileRequestV1{
+		Query: "data.test.p",
+	}
+
+	var wg sync.WaitGroup
+	num := runtime.NumCPU()
+	wg.Add(num)
+
+	for i := 0; i < num; i++ {
+		go func() {
+			defer wg.Done()
+			for n := 0; n < 1000; n++ {
+				if _, err := testRuntime.CompileRequest(req); err != nil {
+					t.Error(err)
+					return
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
 }
diff --git a/test/e2e/distributedtracing/distributedtracing_test.go b/test/e2e/distributedtracing/distributedtracing_test.go
new file mode 100644
index 0000000000..6fea8c77a2
--- /dev/null
+++ b/test/e2e/distributedtracing/distributedtracing_test.go
@@ -0,0 +1,641 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package distributedtracing
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/logging/test"
+	"github.com/open-policy-agent/opa/runtime"
+	"github.com/open-policy-agent/opa/server"
+	"github.com/open-policy-agent/opa/test/e2e"
+	"github.com/open-policy-agent/opa/tracing"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+)
+
+var testRuntime *e2e.TestRuntime
+var spanExporter *tracetest.InMemoryExporter
+
+func TestMain(m *testing.M) {
+	spanExporter = tracetest.NewInMemoryExporter()
+	options := tracing.NewOptions(
+		otelhttp.WithTracerProvider(trace.NewTracerProvider(trace.WithSpanProcessor(trace.NewSimpleSpanProcessor(spanExporter)))),
+	)
+
+	flag.Parse()
+	testServerParams := e2e.NewAPIServerTestParams()
+	testServerParams.DistributedTracingOpts = options
+
+	var err error
+	testRuntime, err = e2e.NewTestRuntime(testServerParams)
+	if err != nil {
+		os.Exit(1)
+	}
+
+	os.Exit(testRuntime.RunTests(m))
+}
+
+// TestServerSpan exemplarily asserts that the server handlers emit OpenTelemetry spans
+// with the correct attributes. It does NOT exercise all handlers, but contains one test
+// with a GET and one with a POST.
+func TestServerSpan(t *testing.T) {
+	spanExporter.Reset()
+
+	t.Run("POST v0/data", func(t *testing.T) {
+		t.Cleanup(spanExporter.Reset)
+
+		mr, err := http.Post(testRuntime.URL()+"/v0/data", "application/json", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		spans := spanExporter.GetSpans()
+		if got, expected := len(spans), 1; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[0].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[0].SpanContext)
+		}
+		if got, expected := spans[0].SpanKind.String(), "server"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.host", strings.Replace(testRuntime.URL(), "http://", "", 1)),
+			attribute.String("http.method", "POST"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.server_name", "v0/data"),
+			attribute.Int("http.status_code", 200),
+			attribute.String("http.target", "/v0/data"),
+			attribute.String("http.user_agent", "Go-http-client/1.1"),
+			attribute.Int("http.wrote_bytes", 3),
+			attribute.String("net.transport", "ip_tcp"),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[0].Attributes...))
+	})
+
+	t.Run("GET v1/data", func(t *testing.T) {
+		t.Cleanup(spanExporter.Reset)
+
+		mr, err := http.Get(testRuntime.URL() + "/v1/data")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		spans := spanExporter.GetSpans()
+		if got, expected := len(spans), 1; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[0].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[0].SpanContext)
+		}
+		if got, expected := spans[0].SpanKind.String(), "server"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.host", strings.Replace(testRuntime.URL(), "http://", "", 1)),
+			attribute.String("http.method", "GET"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.server_name", "v1/data"),
+			attribute.Int("http.status_code", 200),
+			attribute.String("http.target", "/v1/data"),
+			attribute.String("http.user_agent", "Go-http-client/1.1"),
+			attribute.Int("http.wrote_bytes", 67),
+			attribute.String("net.transport", "ip_tcp"),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[0].Attributes...))
+	})
+}
+
+func TestServerSpanWithDecisionLogging(t *testing.T) {
+	// setup
+	spanExp := tracetest.NewInMemoryExporter()
+	options := tracing.NewOptions(
+		otelhttp.WithTracerProvider(trace.NewTracerProvider(trace.WithSpanProcessor(trace.NewSimpleSpanProcessor(spanExp)))),
+	)
+
+	testServerParams := e2e.NewAPIServerTestParams()
+	testServerParams.ConfigOverrides = []string{
+		"decision_logs.console=true",
+	}
+
+	// Ensure decisions are logged regardless of regular log level
+	testServerParams.Logging = runtime.LoggingConfig{Level: "error"}
+	consoleLogger := test.New()
+	testServerParams.ConsoleLogger = consoleLogger
+
+	testServerParams.DistributedTracingOpts = options
+
+	e2e.WithRuntime(t, e2e.TestRuntimeOpts{}, testServerParams, func(rt *e2e.TestRuntime) {
+
+		spanExp.Reset()
+		rt.ConsoleLogger = consoleLogger
+
+		mr, err := http.Post(rt.URL()+"/v1/data", "application/json", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		if mr.StatusCode != http.StatusOK {
+			t.Fatalf("expected status %v but got %v", http.StatusOK, mr.StatusCode)
+		}
+
+		spans := spanExp.GetSpans()
+		if got, expected := len(spans), 1; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[0].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[0].SpanContext)
+		}
+
+		if got, expected := spans[0].SpanKind.String(), "server"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		var entry test.LogEntry
+		var found bool
+
+		for _, entry = range rt.ConsoleLogger.Entries() {
+			if entry.Message == "Decision Log" {
+				found = true
+			}
+		}
+
+		if !found {
+			t.Fatalf("Did not find 'Decision Log' event in captured log entries")
+		}
+
+		// Check for some important fields
+		expectedFields := map[string]*struct {
+			found bool
+			match func(*testing.T, string)
+		}{
+			"labels":      {},
+			"decision_id": {},
+			"trace_id":    {},
+			"span_id":     {},
+			"result":      {},
+			"timestamp":   {},
+			"type": {match: func(t *testing.T, actual string) {
+				if actual != "openpolicyagent.org/decision_logs" {
+					t.Fatalf("Expected field 'type' to be 'openpolicyagent.org/decision_logs'")
+				}
+			}},
+		}
+
+		// Ensure expected fields exist
+		for fieldName, rawField := range entry.Fields {
+			if fd, ok := expectedFields[fieldName]; ok {
+				if fieldValue, ok := rawField.(string); ok && fd.match != nil {
+					fd.match(t, fieldValue)
+				}
+				fd.found = true
+			}
+		}
+
+		for field, fd := range expectedFields {
+			if !fd.found {
+				t.Errorf("Missing expected field in decision log: %s\n\nEntry: %+v\n\n", field, entry)
+			}
+		}
+	})
+}
+
+// TestClientSpan asserts that for all handlers that end up evaluating policies, the
+// http.send calls will emit the proper spans related to the incoming requests.
+//
+// NOTE(sr): `{GET,POST} v1/query` are omitted, http.send is forbidden for ad-hoc queries
+func TestClientSpan(t *testing.T) {
+	type resp struct {
+		DecisionID string `json:"decision_id"`
+	}
+
+	policy := `
+	package test
+
+	response := http.send({"method": "get", "url": "%s/health"})
+	`
+
+	policy = fmt.Sprintf(policy, testRuntime.URL())
+	err := testRuntime.UploadPolicy(t.Name(), strings.NewReader(policy))
+	if err != nil {
+		t.Fatal(err)
+	}
+	spanExporter.Reset()
+
+	t.Run("POST v0/data", func(t *testing.T) {
+		t.Cleanup(spanExporter.Reset)
+
+		mr, err := http.Post(testRuntime.URL()+"/v0/data/test", "application/json", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		spans := spanExporter.GetSpans()
+
+		// Ordered by span emission, which is the reverse of the processing
+		// code flow:
+		// 3 = GET /health (HTTP server handler)
+		//     + http.send (HTTP client instrumentation)
+		//     + GET /v1/data/test (HTTP server handler)
+		if got, expected := len(spans), 3; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[1].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[1].SpanContext)
+		}
+		if got, expected := spans[1].SpanKind.String(), "client"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		parentSpanID := spans[2].SpanContext.SpanID()
+		if got, expected := spans[1].Parent.SpanID(), parentSpanID; got != expected {
+			t.Errorf("expected span to be child of %v, got parent %v", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.method", "GET"),
+			attribute.String("http.url", testRuntime.URL()+"/health"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.host", strings.Replace(testRuntime.URL(), "http://", "", 1)),
+			attribute.String("http.flavor", "1.1"),
+			attribute.Int("http.status_code", 200),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[1].Attributes...))
+	})
+
+	t.Run("GET v1/data", func(t *testing.T) {
+		t.Cleanup(spanExporter.Reset)
+
+		mr, err := http.Get(testRuntime.URL() + "/v1/data/test")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+		var r resp
+		if err := json.NewDecoder(mr.Body).Decode(&r); err != nil {
+			t.Fatal(err)
+		}
+		if r.DecisionID == "" {
+			t.Fatal("expected decision id")
+		}
+
+		spans := spanExporter.GetSpans()
+		if got, expected := len(spans), 3; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[1].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[1].SpanContext)
+		}
+		if got, expected := spans[1].SpanKind.String(), "client"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		parentSpanID := spans[2].SpanContext.SpanID()
+		if got, expected := spans[1].Parent.SpanID(), parentSpanID; got != expected {
+			t.Errorf("expected span to be child of %v, got parent %v", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.method", "GET"),
+			attribute.String("http.url", testRuntime.URL()+"/health"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.host", strings.Replace(testRuntime.URL(), "http://", "", 1)),
+			attribute.String("http.flavor", "1.1"),
+			attribute.Int("http.status_code", 200),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[1].Attributes...))
+
+		// The (parent) server span carries the decision ID
+		expected = []attribute.KeyValue{
+			attribute.String("opa.decision_id", r.DecisionID),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[2].Attributes...))
+	})
+
+	t.Run("POST v1/data", func(t *testing.T) {
+		t.Cleanup(spanExporter.Reset)
+
+		payload := strings.NewReader(`{"input": "meow"}`)
+		mr, err := http.Post(testRuntime.URL()+"/v1/data/test", "application/json", payload)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+		var r resp
+		if err := json.NewDecoder(mr.Body).Decode(&r); err != nil {
+			t.Fatal(err)
+		}
+		if r.DecisionID == "" {
+			t.Fatal("expected decision id")
+		}
+
+		spans := spanExporter.GetSpans()
+		if got, expected := len(spans), 3; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[1].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[1].SpanContext)
+		}
+		if got, expected := spans[1].SpanKind.String(), "client"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		parentSpanID := spans[2].SpanContext.SpanID()
+		if got, expected := spans[1].Parent.SpanID(), parentSpanID; got != expected {
+			t.Errorf("expected span to be child of %v, got parent %v", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.method", "GET"),
+			attribute.String("http.url", testRuntime.URL()+"/health"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.host", strings.Replace(testRuntime.URL(), "http://", "", 1)),
+			attribute.String("http.flavor", "1.1"),
+			attribute.Int("http.status_code", 200),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[1].Attributes...))
+
+		// The (parent) server span carries the decision ID
+		expected = []attribute.KeyValue{
+			attribute.String("opa.decision_id", r.DecisionID),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[2].Attributes...))
+	})
+
+	t.Run("POST /", func(t *testing.T) {
+		t.Cleanup(spanExporter.Reset)
+
+		main := fmt.Sprintf(`
+		package system.main
+
+		response := http.send({"method": "get", "url": "%s/health"})
+		`, testRuntime.URL())
+		err := testRuntime.UploadPolicy("system.main", strings.NewReader(main))
+		if err != nil {
+			t.Fatal(err)
+		}
+		spanExporter.Reset()
+
+		mr, err := http.Post(testRuntime.URL()+"/", "application/json", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		spans := spanExporter.GetSpans()
+		if got, expected := len(spans), 3; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[1].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[1].SpanContext)
+		}
+		if got, expected := spans[1].SpanKind.String(), "client"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		parentSpanID := spans[2].SpanContext.SpanID()
+		if got, expected := spans[1].Parent.SpanID(), parentSpanID; got != expected {
+			t.Errorf("expected span to be child of %v, got parent %v", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.method", "GET"),
+			attribute.String("http.url", testRuntime.URL()+"/health"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.host", strings.Replace(testRuntime.URL(), "http://", "", 1)),
+			attribute.String("http.flavor", "1.1"),
+			attribute.Int("http.status_code", 200),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[1].Attributes...))
+	})
+}
+
+func TestClientSpanWithDecisionLogging(t *testing.T) {
+	// setup
+	spanExp := tracetest.NewInMemoryExporter()
+	options := tracing.NewOptions(
+		otelhttp.WithTracerProvider(trace.NewTracerProvider(trace.WithSpanProcessor(trace.NewSimpleSpanProcessor(spanExp)))),
+	)
+
+	testServerParams := e2e.NewAPIServerTestParams()
+	testServerParams.ConfigOverrides = []string{
+		"decision_logs.console=true",
+	}
+
+	// Ensure decisions are logged regardless of regular log level
+	testServerParams.Logging = runtime.LoggingConfig{Level: "error"}
+	consoleLogger := test.New()
+	testServerParams.ConsoleLogger = consoleLogger
+
+	testServerParams.DistributedTracingOpts = options
+
+	e2e.WithRuntime(t, e2e.TestRuntimeOpts{}, testServerParams, func(rt *e2e.TestRuntime) {
+
+		spanExp.Reset()
+		rt.ConsoleLogger = consoleLogger
+
+		policy := `
+		package test
+
+		response := http.send({"method": "get", "url": "%s/health"})
+		`
+
+		policy = fmt.Sprintf(policy, testRuntime.URL())
+		err := rt.UploadPolicy(t.Name(), strings.NewReader(policy))
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		mr, err := http.Post(rt.URL()+"/v1/data/test", "application/json", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		if mr.StatusCode != http.StatusOK {
+			t.Fatalf("expected status %v but got %v", http.StatusOK, mr.StatusCode)
+		}
+
+		spans := spanExp.GetSpans()
+		// Ordered by span emission, which is the reverse of the processing
+		// code flow:
+		// 3 = GET /health (HTTP server handler)
+		//     + http.send (HTTP client instrumentation)
+		//     + GET /v1/data/test (HTTP server handler)
+		if got, expected := len(spans), 3; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+
+		if !spans[1].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[1].SpanContext)
+		}
+		if got, expected := spans[1].SpanKind.String(), "client"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		parentTraceID := spans[2].SpanContext.TraceID()
+		parentSpanID := spans[2].SpanContext.SpanID()
+		if got, expected := spans[1].Parent.SpanID(), parentSpanID; got != expected {
+			t.Errorf("expected span to be child of %v, got parent %v", expected, got)
+		}
+
+		var entry test.LogEntry
+		var found bool
+
+		for _, entry = range rt.ConsoleLogger.Entries() {
+			if entry.Message == "Decision Log" {
+				found = true
+			}
+		}
+
+		if !found {
+			t.Fatalf("Did not find 'Decision Log' event in captured log entries")
+		}
+
+		// Check for some important fields
+		expectedFields := map[string]*struct {
+			found bool
+			match func(*testing.T, string)
+		}{
+			"labels":      {},
+			"decision_id": {},
+			"trace_id": {match: func(t *testing.T, actual string) {
+				if actual != parentTraceID.String() {
+					t.Fatalf("Expected field 'trace_id' to be %v", parentTraceID.String())
+				}
+			}},
+			"span_id": {match: func(t *testing.T, actual string) {
+				if actual != parentSpanID.String() {
+					t.Fatalf("Expected field 'span_id' to be %v", parentSpanID.String())
+				}
+			}},
+			"result":    {},
+			"timestamp": {},
+			"type": {match: func(t *testing.T, actual string) {
+				if actual != "openpolicyagent.org/decision_logs" {
+					t.Fatalf("Expected field 'type' to be 'openpolicyagent.org/decision_logs'")
+				}
+			}},
+		}
+
+		// Ensure expected fields exist
+		for fieldName, rawField := range entry.Fields {
+			if fd, ok := expectedFields[fieldName]; ok {
+				if fieldValue, ok := rawField.(string); ok && fd.match != nil {
+					fd.match(t, fieldValue)
+				}
+				fd.found = true
+			}
+		}
+
+		for field, fd := range expectedFields {
+			if !fd.found {
+				t.Errorf("Missing expected field in decision log: %s\n\nEntry: %+v\n\n", field, entry)
+			}
+		}
+	})
+}
+
+func TestServerSpanWithSystemAuthzPolicy(t *testing.T) {
+
+	// setup
+	spanExp := tracetest.NewInMemoryExporter()
+	options := tracing.NewOptions(
+		otelhttp.WithTracerProvider(trace.NewTracerProvider(trace.WithSpanProcessor(trace.NewSimpleSpanProcessor(spanExp)))),
+	)
+
+	authzPolicy := []byte(`package system.authz
+default allow = false
+allow {
+	input.path = ["health"]
+}`)
+
+	tmpfile, err := os.CreateTemp("", "authz.*.rego")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(tmpfile.Name())
+
+	if _, err := tmpfile.Write(authzPolicy); err != nil {
+		t.Fatal(err)
+	}
+	if err := tmpfile.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	testServerParams := e2e.NewAPIServerTestParams()
+	testServerParams.DistributedTracingOpts = options
+	testServerParams.Authorization = server.AuthorizationBasic
+	testServerParams.Paths = []string{"system.authz:" + tmpfile.Name()}
+
+	e2e.WithRuntime(t, e2e.TestRuntimeOpts{}, testServerParams, func(rt *e2e.TestRuntime) {
+
+		spanExp.Reset()
+
+		mr, err := http.Post(rt.URL()+"/v1/data", "application/json", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer mr.Body.Close()
+
+		if mr.StatusCode != http.StatusUnauthorized {
+			t.Fatalf("expected status %v but got %v", http.StatusUnauthorized, mr.StatusCode)
+		}
+
+		spans := spanExp.GetSpans()
+		if got, expected := len(spans), 1; got != expected {
+			t.Fatalf("got %d span(s), expected %d", got, expected)
+		}
+		if !spans[0].SpanContext.IsValid() {
+			t.Fatalf("invalid span created: %#v", spans[0].SpanContext)
+		}
+
+		if got, expected := spans[0].SpanKind.String(), "server"; got != expected {
+			t.Fatalf("Expected span kind to be %q but got %q", expected, got)
+		}
+
+		expected := []attribute.KeyValue{
+			attribute.String("http.host", strings.Replace(rt.URL(), "http://", "", 1)),
+			attribute.String("http.method", "POST"),
+			attribute.String("http.scheme", "http"),
+			attribute.String("http.server_name", server.PromHandlerAPIAuthz),
+			attribute.Int("http.status_code", 401),
+			attribute.String("http.target", "/v1/data"),
+			attribute.String("http.user_agent", "Go-http-client/1.1"),
+			attribute.Int("http.wrote_bytes", 87),
+			attribute.String("net.transport", "ip_tcp"),
+		}
+		compareSpanAttributes(t, expected, attribute.NewSet(spans[0].Attributes...))
+
+	})
+}
+
+func compareSpanAttributes(t *testing.T, expectedAttributes []attribute.KeyValue, spanAttributes attribute.Set) {
+	t.Helper()
+	for _, exp := range expectedAttributes {
+		value, exists := spanAttributes.Value(exp.Key)
+		if !exists {
+			t.Fatalf("Expected span attributes to contain %q key", exp.Key)
+		}
+		if value != exp.Value {
+			t.Fatalf("Expected %q attribute to be %s but got %s", exp.Key, exp.Value.Emit(), value.Emit())
+		}
+	}
+}
diff --git a/test/e2e/http/http_test.go b/test/e2e/http/http_test.go
new file mode 100644
index 0000000000..3a18ac9555
--- /dev/null
+++ b/test/e2e/http/http_test.go
@@ -0,0 +1,158 @@
+package http_test
+
+import (
+	"crypto/md5"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/test/e2e"
+)
+
+var testRuntime *e2e.TestRuntime
+
+func TestMain(m *testing.M) {
+	flag.Parse()
+
+	var err error
+	testRuntime, err = e2e.NewTestRuntime(e2e.NewAPIServerTestParams())
+	if err != nil {
+		os.Exit(1)
+	}
+
+	os.Exit(testRuntime.RunTests(m))
+}
+
+func TestHttpSendInterQueryForceCache(t *testing.T) {
+	tests := []struct {
+		note        string
+		respHeaders map[string][]string
+		noForce     bool
+	}{
+		{
+			note:        "http.send GET no force_cache",
+			respHeaders: map[string][]string{},
+			noForce:     true,
+		},
+		{
+			note:        "http.send GET force_cache default headers",
+			respHeaders: map[string][]string{},
+		},
+		{
+			note:        "http.send GET force_cache no Date header",
+			respHeaders: map[string][]string{"Date": nil},
+		},
+		{
+			note:        "http.send GET force_cache Date ignored",
+			respHeaders: map[string][]string{"Date": {"Wed, 31 Dec 2005 07:28:00 GMT"}},
+		},
+		{
+			note:        "http.send GET force_cache Expires ignored",
+			respHeaders: map[string][]string{"Expires": {"Wed, 31 Dec 2005 07:28:00 GMT"}},
+		},
+		{
+			note:        "http.send GET force_cache Cache-Control no-cache ignored",
+			respHeaders: map[string][]string{"Cache-Control": {"no-store"}},
+		},
+		{
+			note:        "http.send GET force_cache Cache-Control max-age ignored",
+			respHeaders: map[string][]string{"Cache-Control": {"no-store", "max-age=0"}},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			counter := 0
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				counter++
+				w.Header()["Content-Type"] = []string{"application/json"}
+				for k, v := range tc.respHeaders {
+					w.Header()[k] = v
+				}
+				w.WriteHeader(http.StatusOK)
+				_, err := w.Write([]byte(fmt.Sprintf(`{"c": %d}`, counter)))
+				if err != nil {
+					t.Fatal(err)
+				}
+			}))
+			defer ts.Close()
+
+			var module string
+			if tc.noForce {
+				module = `
+				package test
+			
+				response := http.send({
+					"method": "get",
+					"url": "%s"
+				}).body
+				`
+			} else {
+				module = `
+				package test
+			
+				response := http.send({
+					"method": "get",
+					"url": "%s",
+					"force_cache": true,
+					"force_cache_duration_seconds": 60
+				}).body
+				`
+			}
+
+			// Since we are using the same request data for all tests (and only the response headers differ), we need
+			// to ensure that each test has some distinct identifier appended to the URL, or else the same cache key
+			// would be used for all of the tests!
+			url := ts.URL + "?test=" + fmt.Sprintf("%x", md5.Sum([]byte(tc.note)))
+
+			if err := testRuntime.UploadPolicy("test", strings.NewReader(fmt.Sprintf(module, url))); err != nil {
+				t.Fatal(err)
+			}
+
+			parsedBody := struct {
+				Result map[string]int `json:"result"`
+			}{}
+			expect := map[string]int{"c": 1}
+
+			resultJSON, err := testRuntime.GetDataWithInput("test/response", map[string]string{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err = json.Unmarshal(resultJSON, &parsedBody); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(parsedBody.Result, expect) {
+				t.Errorf("Expected response %v, got %v", expect, parsedBody.Result)
+			}
+
+			// Repeat once more to see if the result is cached between queries
+
+			if tc.noForce {
+				expect = map[string]int{"c": 2}
+			}
+
+			resultJSON, err = testRuntime.GetDataWithInput("test/response", map[string]string{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err = json.Unmarshal(resultJSON, &parsedBody); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(parsedBody.Result, expect) {
+				t.Errorf("Expected response %v, got %v", expect, parsedBody.Result)
+			}
+
+			// Cleanup
+
+			if err := testRuntime.DeletePolicy("test"); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
diff --git a/test/e2e/logs/remote/remote_decision_logger_benchmark_test.go b/test/e2e/logs/remote/remote_decision_logger_benchmark_test.go
index c64f2d9edb..5e71434e0b 100644
--- a/test/e2e/logs/remote/remote_decision_logger_benchmark_test.go
+++ b/test/e2e/logs/remote/remote_decision_logger_benchmark_test.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build noisy
 // +build noisy
 
 package remote
@@ -11,7 +12,6 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strings"
 	"testing"
@@ -113,7 +113,7 @@ func runAuthzBenchmark(b *testing.B, mode testAuthz.InputMode, numPaths int) {
 		resp, err := testRuntime.GetDataWithRawInput(url, inputReader)
 		b.StopTimer()
 
-		body, err := ioutil.ReadAll(resp)
+		body, err := io.ReadAll(resp)
 		if err != nil {
 			b.Fatalf("unexpected error reading response body: %s", err)
 		}
diff --git a/test/e2e/metrics/metrics_test.go b/test/e2e/metrics/metrics_test.go
index 15741b39ca..e067909915 100644
--- a/test/e2e/metrics/metrics_test.go
+++ b/test/e2e/metrics/metrics_test.go
@@ -2,7 +2,7 @@ package metrics
 
 import (
 	"flag"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"os"
 	"strings"
@@ -58,7 +58,7 @@ func TestMetricsEndpoint(t *testing.T) {
 
 	defer mr.Body.Close()
 
-	bs, err := ioutil.ReadAll(mr.Body)
+	bs, err := io.ReadAll(mr.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -162,7 +162,7 @@ func TestRequestWithInstrumentationV1CompileAPI(t *testing.T) {
 		Unknowns: &[]string{"data.y"},
 	}
 
-	resp, err := testRuntime.CompileRequestWitInstrumentation(req)
+	resp, err := testRuntime.CompileRequestWithInstrumentation(req)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/test/e2e/oci/oci_test.go b/test/e2e/oci/oci_test.go
new file mode 100644
index 0000000000..5c24c58852
--- /dev/null
+++ b/test/e2e/oci/oci_test.go
@@ -0,0 +1,117 @@
+package test
+
+import (
+	"bytes"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/open-policy-agent/opa/logging"
+	test_sdk "github.com/open-policy-agent/opa/sdk/test"
+	"github.com/open-policy-agent/opa/test/e2e"
+)
+
+type SafeBuffer struct {
+	b bytes.Buffer
+	m sync.Mutex
+}
+
+func (b *SafeBuffer) Read(p []byte) (n int, err error) {
+	b.m.Lock()
+	defer b.m.Unlock()
+	return b.b.Read(p)
+}
+func (b *SafeBuffer) Write(p []byte) (n int, err error) {
+	b.m.Lock()
+	defer b.m.Unlock()
+	return b.b.Write(p)
+}
+func (b *SafeBuffer) String() string {
+	b.m.Lock()
+	defer b.m.Unlock()
+	return b.b.String()
+}
+
+func TestEnablePrintStatementsForBundles(t *testing.T) {
+	ref := "registry.io/someorg/somerepo:tag"
+	server := test_sdk.MustNewServer(test_sdk.MockOCIBundle(ref, map[string]string{
+		"post.rego": `
+		package peoplefinder.POST.api.users
+
+		import input.user.properties as user_props
+		
+		default allowed = false
+		
+		allowed {
+			user_props.department == "Operations"
+			user_props.title == "IT Manager"
+		}	
+		`,
+	}))
+	params := e2e.NewAPIServerTestParams()
+
+	buf := SafeBuffer{}
+
+	logger := logging.New()
+	logger.SetLevel(logging.Debug) // set to debug to see the the bundle download skip message
+	logger.SetOutput(&buf)
+	params.Logger = logger
+
+	params.ConfigOverrides = []string{
+		"services.test.url=" + server.URL(),
+		"services.test.type=oci",
+		"bundles.test.resource=" + ref,
+		"bundles.test.polling.min_delay_seconds=1",
+		"bundles.test.polling.max_delay_seconds=3",
+	}
+
+	// Test runtime uses the local OCI image layers stored in download testdata that contain the
+	// rego policies based on the https://github.com/aserto-dev/policy-peoplefinder-abac template
+	e2e.WithRuntime(t, e2e.TestRuntimeOpts{WaitForBundles: true}, params, func(rt *e2e.TestRuntime) {
+		var readBuf []byte
+		type Props struct {
+			Department string `json:"department"`
+			Title      string `json:"title"`
+		}
+		type Attributes struct {
+			Properties Props `json:"properties"`
+		}
+		type Input struct {
+			User Attributes `json:"user"`
+		}
+
+		inputAllowed := Input{User: Attributes{Properties: Props{Department: "Operations", Title: "IT Manager"}}}
+
+		inputNotAllowed := Input{User: Attributes{Properties: Props{Department: "IT", Title: "Engineer"}}}
+
+		readBuf, err := rt.GetDataWithInput("peoplefinder/POST/api/users/allowed", inputAllowed)
+		if err != nil {
+			t.Fatal("failed to get data from runtime")
+		}
+
+		response := string(readBuf)
+		if !strings.Contains(response, "true") {
+			t.Fatalf("expected true but got: %s", response)
+		}
+		readBuf, err = rt.GetDataWithInput("peoplefinder/POST/api/users/allowed", inputNotAllowed)
+		if err != nil {
+			t.Fatal("failed to get data from runtime")
+		}
+		if !strings.Contains(string(readBuf), "false") {
+			t.Fatalf("expected true but got: %s", response)
+		}
+
+		time.Sleep(3 * time.Second) // wait for the downloader pooling mechanism to kick in
+		expContains := "Bundle loaded and activated successfully"
+		skipContains := "Bundle load skipped, server replied with not modified."
+
+		if !strings.Contains(buf.String(), expContains) {
+			t.Fatalf("expected logs to contain %q but got: %v", expContains, buf.String())
+		}
+		time.Sleep(3 * time.Second) // wait a couple of seconds for the second trigger to kick in
+		if !strings.Contains(buf.String(), skipContains) {
+			t.Fatalf("expected logs to contain %q but got: %v", skipContains, buf.String())
+		}
+	})
+}
diff --git a/test/e2e/shutdown/shutdown_test.go b/test/e2e/shutdown/shutdown_test.go
index a3e5580734..8579d8e2b4 100644
--- a/test/e2e/shutdown/shutdown_test.go
+++ b/test/e2e/shutdown/shutdown_test.go
@@ -43,7 +43,7 @@ func TestShutdownWaitPeriod(t *testing.T) {
 
 	time.Sleep(1500 * time.Millisecond)
 
-	// Ensure that OPA i still running
+	// Ensure that OPA is still running
 	err = testRuntime.HealthCheck(testRuntime.URL())
 	if err != nil {
 		t.Fatalf("Expected health endpoint to be up but got:\n\n%v", err)
diff --git a/test/e2e/testing.go b/test/e2e/testing.go
index 80a748b646..db6a18beab 100644
--- a/test/e2e/testing.go
+++ b/test/e2e/testing.go
@@ -7,10 +7,10 @@ package e2e
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
@@ -20,6 +20,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/open-policy-agent/opa/internal/uuid"
 	"github.com/open-policy-agent/opa/logging"
 	"github.com/open-policy-agent/opa/logging/test"
 	"github.com/open-policy-agent/opa/runtime"
@@ -50,6 +51,13 @@ func NewAPIServerTestParams() runtime.Params {
 
 	params.GracefulShutdownPeriod = 10 // seconds
 
+	params.DecisionIDFactory = func() string {
+		id, err := uuid.New(rand.Reader)
+		if err != nil {
+			return ""
+		}
+		return id
+	}
 	return params
 }
 
@@ -205,7 +213,7 @@ func (t *TestRuntime) runTests(m *testing.M, suppressLogs bool) int {
 	go func() {
 		// Suppress the stdlogger in the server
 		if suppressLogs {
-			logging.Get().SetOutput(ioutil.Discard)
+			logging.Get().SetOutput(io.Discard)
 		}
 		err := t.Runtime.Serve(t.Ctx)
 		done <- err
@@ -214,7 +222,7 @@ func (t *TestRuntime) runTests(m *testing.M, suppressLogs bool) int {
 	// Turns out this thread gets a different stdlogger
 	// so we need to set the output on it here too.
 	if suppressLogs {
-		logging.Get().SetOutput(ioutil.Discard)
+		logging.Get().SetOutput(io.Discard)
 	}
 
 	// wait for the server to be ready
@@ -295,6 +303,22 @@ func (t *TestRuntime) WaitForServer() error {
 	return fmt.Errorf("API Server not ready in time")
 }
 
+// DeletePolicy will delete the given policy in the runtime via the v1 policy API
+func (t *TestRuntime) DeletePolicy(name string) error {
+	req, err := http.NewRequest("DELETE", t.URL()+"/v1/policies/"+name, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := t.Client.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to DELETE the test policy: %s", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected response: %d %s", resp.StatusCode, resp.Status)
+	}
+	return nil
+}
+
 // UploadPolicy will upload the given policy to the runtime via the v1 policy API
 func (t *TestRuntime) UploadPolicy(name string, policy io.Reader) error {
 	req, err := http.NewRequest("PUT", t.URL()+"/v1/policies/"+name, policy)
@@ -354,7 +378,7 @@ func (t *TestRuntime) GetDataWithInput(path string, input interface{}) ([]byte,
 		return nil, err
 	}
 
-	body, err := ioutil.ReadAll(resp)
+	body, err := io.ReadAll(resp)
 	if err != nil {
 		return nil, fmt.Errorf("unexpected error reading response body: %s", err)
 	}
@@ -374,16 +398,29 @@ func (t *TestRuntime) GetData(url string) (io.ReadCloser, error) {
 	return t.request("GET", url, nil)
 }
 
-// CompileRequestWitInstrumentation will use the v1 compile API and POST with the given request and instrumentation enabled.
-func (t *TestRuntime) CompileRequestWitInstrumentation(req types.CompileRequestV1) (*types.CompileResponseV1, error) {
+// CompileRequestWithInstrumentation will use the v1 compile API and POST with the given request and instrumentation enabled.
+func (t *TestRuntime) CompileRequestWithInstrumentation(req types.CompileRequestV1) (*types.CompileResponseV1, error) {
+	return t.compileRequest(req, true)
+}
+
+// CompileRequest will use the v1 compile API and POST with the given request.
+func (t *TestRuntime) CompileRequest(req types.CompileRequestV1) (*types.CompileResponseV1, error) {
+	return t.compileRequest(req, false)
+}
+
+func (t *TestRuntime) compileRequest(req types.CompileRequestV1, instrument bool) (*types.CompileResponseV1, error) {
 	inputPayload := util.MustMarshalJSON(req)
 
-	resp, err := t.request("POST", t.URL()+"/v1/compile?instrument", bytes.NewReader(inputPayload))
+	url := t.URL() + "/v1/compile"
+	if instrument {
+		url += "?instrument"
+	}
+	resp, err := t.request("POST", url, bytes.NewReader(inputPayload))
 	if err != nil {
 		return nil, err
 	}
 
-	body, err := ioutil.ReadAll(resp)
+	body, err := io.ReadAll(resp)
 	if err != nil {
 		return nil, fmt.Errorf("unexpected error reading response body: %s", err)
 	}
diff --git a/test/e2e/tls/tls_test.go b/test/e2e/tls/tls_test.go
index 37386089cd..b5d1eea6eb 100644
--- a/test/e2e/tls/tls_test.go
+++ b/test/e2e/tls/tls_test.go
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"os"
@@ -38,7 +37,7 @@ func TestMain(m *testing.M) {
 	TLSVersion := minTLSVersions[*minTLSVersion]
 	flag.Parse()
 
-	caCertPEM, err := ioutil.ReadFile("testdata/ca.pem")
+	caCertPEM, err := os.ReadFile("testdata/ca.pem")
 	if err != nil {
 		fatal(err)
 	}
@@ -62,7 +61,7 @@ allow {
 	identity = "CN=my-client"
 }`)
 
-	tmpfile, err := ioutil.TempFile("", "authz.*.rego")
+	tmpfile, err := os.CreateTemp("", "authz.*.rego")
 	if err != nil {
 		fatal(err)
 	}
diff --git a/test/e2e/wasm/authz/authz_bench_integration_test.go b/test/e2e/wasm/authz/authz_bench_integration_test.go
index 9c1923d497..847189c606 100644
--- a/test/e2e/wasm/authz/authz_bench_integration_test.go
+++ b/test/e2e/wasm/authz/authz_bench_integration_test.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build opa_wasm
 // +build opa_wasm
 
 package authz
@@ -11,7 +12,7 @@ import (
 	"context"
 	"encoding/json"
 	"flag"
-	"io/ioutil"
+	"io"
 	"os"
 	"strings"
 	"testing"
@@ -36,7 +37,8 @@ func TestMain(m *testing.M) {
 	flag.Parse()
 
 	testServerParams := e2e.NewAPIServerTestParams()
-
+	var cleanup func() error
+	testServerParams.DiskStorage, cleanup = diskStorage()
 	var err error
 	testRuntime, err = e2e.NewTestRuntime(testServerParams)
 	if err != nil {
@@ -93,6 +95,11 @@ func TestMain(m *testing.M) {
 	}
 
 	errc := testRuntime.RunTests(m)
+	if errc == 0 && cleanup != nil {
+		if err := cleanup(); err != nil {
+			panic(err)
+		}
+	}
 	os.Exit(errc)
 }
 
@@ -112,11 +119,11 @@ func BenchmarkRESTAuthzAllow10Paths(b *testing.B) {
 	runAuthzBenchmark(b, testAuthz.Allow, 10)
 }
 
-func BenchmarkRESTAuthzAllow100Paths(b *testing.B) {
-	runAuthzBenchmark(b, testAuthz.Allow, 100)
-}
-
 // TODO: Re-enable when performance issues have been addressed.
+//func BenchmarkRESTAuthzAllow100Paths(b *testing.B) {
+//	runAuthzBenchmark(b, testAuthz.Allow, 100)
+//}
+
 // func BenchmarkRESTAuthzAllow1000Paths(b *testing.B) {
 // 	runAuthzBenchmark(b, testAuthz.Allow, 1000)
 // }
@@ -157,7 +164,7 @@ func runAuthzBenchmark(b *testing.B, mode testAuthz.InputMode, numPaths int) {
 		}
 		b.StopTimer()
 
-		body, err := ioutil.ReadAll(resp)
+		body, err := io.ReadAll(resp)
 		if err != nil {
 			b.Fatalf("unexpected error reading response body: %s", err)
 		}
diff --git a/test/e2e/wasm/authz/disk.go b/test/e2e/wasm/authz/disk.go
new file mode 100644
index 0000000000..edd2423c73
--- /dev/null
+++ b/test/e2e/wasm/authz/disk.go
@@ -0,0 +1,24 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+//go:build bench_disk
+// +build bench_disk
+
+// nolint: deadcode,unused // build tags confuse these linters
+package authz
+
+import (
+	"os"
+
+	"github.com/open-policy-agent/opa/storage/disk"
+)
+
+func diskStorage() (*disk.Options, func() error) {
+	dir, err := os.CreateTemp("", "disk-store")
+	if err != nil {
+		panic(err)
+	}
+
+	return &disk.Options{Dir: dir, Partitions: nil}, func() error { return os.RemoveAll(dir) }
+}
diff --git a/test/e2e/wasm/authz/nodisk.go b/test/e2e/wasm/authz/nodisk.go
new file mode 100644
index 0000000000..8849441bd1
--- /dev/null
+++ b/test/e2e/wasm/authz/nodisk.go
@@ -0,0 +1,15 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+//go:build !bench_disk
+// +build !bench_disk
+
+// nolint: deadcode,unused // build tags confuse these linters
+package authz
+
+import "github.com/open-policy-agent/opa/storage/disk"
+
+func diskStorage() (*disk.Options, func() error) {
+	return nil, nil
+}
diff --git a/test/wasm/assets/012_partialobjects.yaml b/test/wasm/assets/012_partialobjects.yaml
index 621ae6be96..39c0f752c7 100644
--- a/test/wasm/assets/012_partialobjects.yaml
+++ b/test/wasm/assets/012_partialobjects.yaml
@@ -8,7 +8,8 @@ cases:
         p["b"] = 2
     want_defined: true
   - note: additive (negative)
-    query:  'data.x.p = {"a": 1, "b": 2}'
+    query: 'data.x.p = input'
+    input: {"a": 1, "b": 2}
     modules:
       - |
         package x
@@ -18,15 +19,19 @@ cases:
     want_defined: false
   - note: input
     query: 'data.x.p = {"b": 2, "a": 1}'
+    input: {"x": 1, "y": 2}
     modules:
       - |
         package x
         p["a"] = 1 { input.x = 1 }
         p["b"] = 2 { input.y = 2 }
     want_defined: true
-    input: {"x": 1, "y": 2}
   - note: input (negative)
-    query: 'data.x.p = {"a": 1, "b": 2}'
+    query: 'data.x.p = data.z'
+    data:
+      z:
+        a: 1
+        b: 2
     modules:
       - |
         package x
@@ -44,13 +49,16 @@ cases:
         p[x] = [y] { x = "b"; y = 2 }
     want_defined: true
   - note: conflict error
-    query: 'data.x.p = {"a": 1}'
+    data:
+      z:
+        a: 1
+    query: 'data.x.p = data.z'
     modules:
       - |
         package x
         p["x"] = 1
         p["x"] = 2
-    want_error: "module0.rego:3:1: object insert conflict"
+    want_error: "module0.rego:3:1: var assignment conflict"
   - note: object dereference
     query: data.x.p.a.b = 1
     modules:
diff --git a/test/wasm/assets/019_call_indirect_optimization.yaml b/test/wasm/assets/019_call_indirect_optimization.yaml
index 596e3f4a7b..afe3fb906b 100644
--- a/test/wasm/assets/019_call_indirect_optimization.yaml
+++ b/test/wasm/assets/019_call_indirect_optimization.yaml
@@ -120,4 +120,72 @@ cases:
         q:
           baz: 8
     want_result:
-      - x: 100
\ No newline at end of file
+      - x: 100
+  - note: func lookup unsuccessful, data deref unsuccessful
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+
+        p {
+          x := "foo"
+          data.other[x].p
+        }
+      - |
+        package other.bar # not "foo", but existence triggers dynamic lookup
+
+        p = true
+    data: {}
+    want_defined: false
+  - note: func lookup successful, but call yields undefined
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+
+        p {
+          x := "foo"
+          data.other[x].p
+        }
+      - package other.foo # empty
+      - |
+        package other.bar # not foo
+
+        p = true
+    data: {}
+    want_defined: false
+  - note: func lookup successful, but call yields undefined (in a loop)
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        xs := {"foo", "baz", "123"}
+        p {
+          xs[x]
+          data.other[x].p
+        }
+      - package other.foo # empty
+      - |
+        package other.bar # not foo
+
+        p = true
+    data: {}
+    want_defined: false
+  - note: func lookup in a loop, one call yields a result
+    query: data.test.p = x
+    modules:
+      - |
+        package test
+        xs := {"fox", "baz", "123", "xyz"}
+        p = y {
+          xs[x]
+          y := data.other[x].p
+        }
+      - package other.foo # empty
+      - |
+        package other.xyz
+
+        p = "yay"
+    data: {}
+    want_result:
+      - x: yay
diff --git a/test/wasm/cmd/wasm-rego-testgen/main.go b/test/wasm/cmd/wasm-rego-testgen/main.go
index 4a0d9a934b..a286288a24 100644
--- a/test/wasm/cmd/wasm-rego-testgen/main.go
+++ b/test/wasm/cmd/wasm-rego-testgen/main.go
@@ -11,13 +11,11 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
 	"strings"
 
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 
 	"github.com/open-policy-agent/opa/rego"
@@ -43,7 +41,7 @@ type compiledTestCase struct {
 }
 
 func compileTestCases(ctx context.Context, tests cases.Set) (*compiledTestCaseSet, error) {
-	var result []compiledTestCase
+	result := make([]compiledTestCase, 0, len(tests.Cases))
 	for _, tc := range tests.Cases {
 
 		var numExpects int
@@ -142,7 +140,7 @@ func run(params params) error {
 	tw := tar.NewWriter(gw)
 	defer tw.Close()
 
-	files, err := ioutil.ReadDir(params.InputDir)
+	files, err := os.ReadDir(params.InputDir)
 	if err != nil {
 		return err
 	}
@@ -152,7 +150,7 @@ func run(params params) error {
 			err := func() error {
 				abspath := filepath.Join(params.InputDir, files[i].Name())
 
-				bs, err := ioutil.ReadFile(abspath)
+				bs, err := os.ReadFile(abspath)
 				if err != nil {
 					return err
 				}
@@ -177,10 +175,10 @@ func run(params params) error {
 				return writeFile(tw, dst, bs)
 			}()
 			if err != nil {
-				return errors.Wrap(err, files[i].Name())
+				return fmt.Errorf("%s: %w", files[i].Name(), err)
 			}
 		} else if err != nil {
-			return errors.Wrap(err, files[i].Name())
+			return fmt.Errorf("%s: %w", files[i].Name(), err)
 		}
 	}
 
diff --git a/tester/reporter.go b/tester/reporter.go
index 7efecc30a1..74a7f4802d 100644
--- a/tester/reporter.go
+++ b/tester/reporter.go
@@ -11,10 +11,9 @@ import (
 	"io"
 	"strings"
 
-	"github.com/open-policy-agent/opa/topdown"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/cover"
+	"github.com/open-policy-agent/opa/topdown"
 )
 
 // Reporter defines the interface for reporting test results.
@@ -39,7 +38,8 @@ func (r PrettyReporter) Report(ch chan *Result) error {
 
 	dirty := false
 	var pass, fail, skip, errs int
-	var results, failures []*Result
+	results := make([]*Result, 0, len(ch))
+	var failures []*Result
 
 	for tr := range ch {
 		if tr.Pass() {
@@ -71,11 +71,20 @@ func (r PrettyReporter) Report(ch chan *Result) error {
 	}
 
 	// Report individual tests.
+	var lastFile string
 	for _, tr := range results {
+
 		if tr.Pass() && r.BenchmarkResults {
 			dirty = true
 			fmt.Fprintln(r.Output, r.fmtBenchmark(tr))
-		} else if r.Verbose {
+		} else if r.Verbose || !tr.Pass() {
+			if tr.Location != nil && tr.Location.File != lastFile {
+				if lastFile != "" {
+					fmt.Fprintln(r.Output, "")
+				}
+				fmt.Fprintf(r.Output, "%s:\n", tr.Location.File)
+				lastFile = tr.Location.File
+			}
 			dirty = true
 			fmt.Fprintln(r.Output, tr)
 			if len(tr.Output) > 0 {
@@ -83,22 +92,6 @@ func (r PrettyReporter) Report(ch chan *Result) error {
 				fmt.Fprintln(newIndentingWriter(r.Output), strings.TrimSpace(string(tr.Output)))
 				fmt.Fprintln(r.Output)
 			}
-		} else if !tr.Pass() {
-			dirty = true
-			if r.FailureLine {
-				if tr.FailedAt != nil {
-					fmt.Fprintf(r.Output, "%v (%s:%d) \n", tr, tr.FailedAt.Location.File, tr.FailedAt.Location.Row)
-				} else {
-					fmt.Fprintf(r.Output, "%v (test skipped because success not possible) \n", tr)
-				}
-			} else {
-				fmt.Fprintln(r.Output, tr)
-				if len(tr.Output) > 0 {
-					fmt.Fprintln(r.Output)
-					fmt.Fprintln(newIndentingWriter(r.Output), strings.TrimSpace(string(tr.Output)))
-					fmt.Fprintln(r.Output)
-				}
-			}
 		}
 		if tr.Error != nil {
 			fmt.Fprintf(r.Output, "  %v\n", tr.Error)
@@ -149,7 +142,7 @@ func (r PrettyReporter) fmtBenchmark(tr *Result) string {
 		// like BenchmarkDataFooBarTestAuth.
 		camelCaseName := ""
 		for _, part := range strings.Split(strings.Replace(name, "_", ".", -1), ".") {
-			camelCaseName += strings.Title(part)
+			camelCaseName += strings.Title(part) //nolint:staticcheck // SA1019, no unicode here
 		}
 		name = "Benchmark" + camelCaseName
 	}
@@ -169,7 +162,7 @@ type JSONReporter struct {
 
 // Report prints the test report to the reporter's output.
 func (r JSONReporter) Report(ch chan *Result) error {
-	var report []*Result
+	report := make([]*Result, 0, len(ch))
 	for tr := range ch {
 		report = append(report, tr)
 	}
diff --git a/tester/reporter_test.go b/tester/reporter_test.go
index 9976d2a174..56d98b2d57 100644
--- a/tester/reporter_test.go
+++ b/tester/reporter_test.go
@@ -36,29 +36,52 @@ func TestPrettyReporterVerbose(t *testing.T) {
 			Package: "data.foo.bar",
 			Name:    "test_baz",
 			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_qux",
 			Error:   fmt.Errorf("some err"),
 			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_corge",
 			Fail:    true,
 			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy2.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "todo_test_qux",
 			Skip:    true,
 			Trace:   nil,
+			Location: &ast.Location{
+				File: "policy2.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_contains_print",
 			Output:  []byte("fake print output\n"),
+			Location: &ast.Location{
+				File: "policy3.rego",
+			},
+		},
+		{
+			Package: "data.foo.baz",
+			Name:    "p.q.r.test_quz",
+			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy4.rego",
+			},
 		},
 	}
 
@@ -80,20 +103,28 @@ data.foo.bar.test_corge: FAIL (0s)
 
 SUMMARY
 --------------------------------------------------------------------------------
+policy1.rego:
 data.foo.bar.test_baz: PASS (0s)
 data.foo.bar.test_qux: ERROR (0s)
   some err
+
+policy2.rego:
 data.foo.bar.test_corge: FAIL (0s)
 data.foo.bar.todo_test_qux: SKIPPED
+
+policy3.rego:
 data.foo.bar.test_contains_print: PASS (0s)
 
   fake print output
 
+
+policy4.rego:
+data.foo.baz.p.q.r.test_quz: PASS (0s)
 --------------------------------------------------------------------------------
-PASS: 2/5
-FAIL: 1/5
-SKIPPED: 1/5
-ERROR: 1/5
+PASS: 3/6
+FAIL: 1/6
+SKIPPED: 1/6
+ERROR: 1/6
 `
 
 	str := buf.String()
@@ -113,35 +144,62 @@ func TestPrettyReporter(t *testing.T) {
 			Package: "data.foo.bar",
 			Name:    "test_baz",
 			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_qux",
 			Error:   fmt.Errorf("some err"),
 			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_corge",
 			Fail:    true,
 			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "todo_test_qux",
 			Skip:    true,
 			Trace:   nil,
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_contains_print_pass",
 			Output:  []byte("fake print output\n"),
+			Location: &ast.Location{
+				File: "policy1.rego",
+			},
 		},
 		{
 			Package: "data.foo.bar",
 			Name:    "test_contains_print_fail",
 			Fail:    true,
 			Output:  []byte("fake print output2\n"),
+			Location: &ast.Location{
+				File: "policy2.rego",
+			},
+		},
+		{
+			Package: "data.foo.baz",
+			Name:    "p.q.r.test_quz",
+			Fail:    true,
+			Trace:   getFakeTraceEvents(),
+			Location: &ast.Location{
+				File: "policy3.rego",
+			},
 		},
 	}
 
@@ -154,19 +212,25 @@ func TestPrettyReporter(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	exp := `data.foo.bar.test_qux: ERROR (0s)
+	exp := `policy1.rego:
+data.foo.bar.test_qux: ERROR (0s)
   some err
 data.foo.bar.test_corge: FAIL (0s)
 data.foo.bar.todo_test_qux: SKIPPED
+
+policy2.rego:
 data.foo.bar.test_contains_print_fail: FAIL (0s)
 
   fake print output2
 
+
+policy3.rego:
+data.foo.baz.p.q.r.test_quz: FAIL (0s)
 --------------------------------------------------------------------------------
-PASS: 2/6
-FAIL: 2/6
-SKIPPED: 1/6
-ERROR: 1/6
+PASS: 2/7
+FAIL: 3/7
+SKIPPED: 1/7
+ERROR: 1/7
 `
 
 	if exp != buf.String() {
@@ -205,6 +269,10 @@ func TestJSONReporter(t *testing.T) {
 			Name:    "test_contains_print",
 			Output:  []byte("fake print output\n"),
 		},
+		{
+			Package: "data.foo.baz",
+			Name:    "p.q.r.test_quz",
+		},
 	}
 
 	r := JSONReporter{
@@ -365,7 +433,13 @@ func TestJSONReporter(t *testing.T) {
 	  "name": "test_contains_print",
 	  "output": "ZmFrZSBwcmludCBvdXRwdXQK",
 	  "duration": 0
-  }
+  },
+  {
+	"location": null,
+	"package": "data.foo.baz",
+	"name": "p.q.r.test_quz",
+	"duration": 0
+}
 ]
 `))
 
diff --git a/tester/runner.go b/tester/runner.go
index 1117e06f33..cae4730129 100644
--- a/tester/runner.go
+++ b/tester/runner.go
@@ -119,12 +119,12 @@ type Runner struct {
 	trace                 bool
 	enablePrintStatements bool
 	runtime               *ast.Term
-	failureLine           bool
 	timeout               time.Duration
 	modules               map[string]*ast.Module
 	bundles               map[string]*bundle.Bundle
 	filter                string
 	target                string // target type (wasm, rego, etc.)
+	customBuiltins        []*Builtin
 }
 
 // NewRunner returns a new runner.
@@ -140,6 +140,16 @@ func (r *Runner) SetCompiler(compiler *ast.Compiler) *Runner {
 	return r
 }
 
+type Builtin struct {
+	Decl *ast.Builtin
+	Func func(*rego.Rego)
+}
+
+func (r *Runner) AddCustomBuiltins(builtinsList []*Builtin) *Runner {
+	r.customBuiltins = builtinsList
+	return r
+}
+
 // SetStore sets the store to execute tests over.
 func (r *Runner) SetStore(store storage.Store) *Runner {
 	r.store = store
@@ -188,12 +198,6 @@ func (r *Runner) EnableTracing(yes bool) *Runner {
 	return r
 }
 
-// EnableFailureLine if set will provide the exact failure line
-func (r *Runner) EnableFailureLine(yes bool) *Runner {
-	r.failureLine = yes
-	return r
-}
-
 // SetRuntime sets runtime information to expose to the evaluation engine.
 func (r *Runner) SetRuntime(term *ast.Term) *Runner {
 	r.runtime = term
@@ -282,19 +286,27 @@ func (r *Runner) runTests(ctx context.Context, txn storage.Transaction, enablePr
 	}
 
 	if r.compiler == nil {
+		capabilities := ast.CapabilitiesForThisVersion()
+
+		// Add custom builtins declarations to compiler
+		for _, builtin := range r.customBuiltins {
+			capabilities.Builtins = append(capabilities.Builtins, builtin.Decl)
+		}
+
 		r.compiler = ast.NewCompiler().
+			WithCapabilities(capabilities).
 			WithEnablePrintStatements(enablePrintStatements)
 	}
 
 	// rewrite duplicate test_* rule names as we compile modules
-	r.compiler.WithStageAfter("ResolveRefs", ast.CompilerStageDefinition{
+	r.compiler.WithStageAfter("RewriteRuleHeadRefs", ast.CompilerStageDefinition{
 		Name:       "RewriteDuplicateTestNames",
 		MetricName: "rewrite_duplicate_test_names",
 		Stage:      rewriteDuplicateTestNames,
 	})
 
 	if r.store == nil {
-		r.store = inmem.New()
+		r.store = inmem.NewWithOpts(inmem.OptRoundTripOnWrite(false))
 	}
 
 	if r.bundles != nil && len(r.bundles) > 0 {
@@ -328,7 +340,7 @@ func (r *Runner) runTests(ctx context.Context, txn storage.Transaction, enablePr
 		}
 	}
 
-	if r.modules != nil && len(r.modules) > 0 {
+	if len(r.modules) > 0 {
 		if r.compiler.Compile(r.modules); r.compiler.Failed() {
 			return nil, r.compiler.Errors
 		}
@@ -368,7 +380,7 @@ func (r *Runner) runTests(ctx context.Context, txn storage.Transaction, enablePr
 }
 
 func (r *Runner) shouldRun(rule *ast.Rule, testRegex *regexp.Regexp) bool {
-	ruleName := string(rule.Head.Name)
+	ruleName := ruleName(rule.Head)
 
 	// All tests must have the right prefix
 	if !strings.HasPrefix(ruleName, TestPrefix) && !strings.HasPrefix(ruleName, SkipTestPrefix) {
@@ -376,7 +388,7 @@ func (r *Runner) shouldRun(rule *ast.Rule, testRegex *regexp.Regexp) bool {
 	}
 
 	// Even with the prefix it needs to pass the regex (if applicable)
-	fullName := fmt.Sprintf("%s.%s", rule.Module.Package.Path.String(), ruleName)
+	fullName := rule.Ref().String()
 	if testRegex != nil && !testRegex.MatchString(fullName) {
 		return false
 	}
@@ -391,13 +403,20 @@ func rewriteDuplicateTestNames(compiler *ast.Compiler) *ast.Error {
 	count := map[string]int{}
 	for _, mod := range compiler.Modules {
 		for _, rule := range mod.Rules {
-			name := rule.Head.Name.String()
+			name := ruleName(rule.Head)
 			if !strings.HasPrefix(name, TestPrefix) {
 				continue
 			}
-			key := rule.Path().String()
+			key := rule.Ref().String()
 			if k, ok := count[key]; ok {
-				rule.Head.Name = ast.Var(fmt.Sprintf("%s#%02d", name, k))
+				ref := rule.Head.Ref()
+				newName := fmt.Sprintf("%s#%02d", name, k)
+				if len(ref) == 1 {
+					ref[0] = ast.VarTerm(newName)
+				} else {
+					ref[len(ref)-1] = ast.StringTerm(newName)
+				}
+				rule.Head.SetRef(ref)
 			}
 			count[key]++
 		}
@@ -405,6 +424,23 @@ func rewriteDuplicateTestNames(compiler *ast.Compiler) *ast.Error {
 	return nil
 }
 
+// ruleName is a helper to be used when checking if a function
+// (a) is a test, or
+// (b) needs to be skipped
+// -- it'll resolve `p.q.r` to `r`. For representing results, we'll
+// use rule.Head.Ref()
+func ruleName(h *ast.Head) string {
+	ref := h.Ref()
+	switch last := ref[len(ref)-1].Value.(type) {
+	case ast.Var:
+		return string(last)
+	case ast.String:
+		return string(last)
+	default:
+		return ""
+	}
+}
+
 func (r *Runner) runTest(ctx context.Context, txn storage.Transaction, mod *ast.Module, rule *ast.Rule) (*Result, bool) {
 	var bufferTracer *topdown.BufferTracer
 	var bufFailureLineTracer *topdown.BufferTracer
@@ -415,15 +451,11 @@ func (r *Runner) runTest(ctx context.Context, txn storage.Transaction, mod *ast.
 	} else if r.trace {
 		bufferTracer = topdown.NewBufferTracer()
 		tracer = bufferTracer
-	} else if r.failureLine {
-		bufFailureLineTracer = topdown.NewBufferTracer()
-		tracer = bufFailureLineTracer
 	}
 
-	ruleName := string(rule.Head.Name)
-
-	if strings.HasPrefix(ruleName, SkipTestPrefix) {
-		tr := newResult(rule.Loc(), mod.Package.Path.String(), ruleName, 0*time.Second, nil, nil)
+	ruleName := ruleName(rule.Head)
+	if strings.HasPrefix(ruleName, SkipTestPrefix) { // TODO(sr): add test
+		tr := newResult(rule.Loc(), mod.Package.Path.String(), rule.Head.Ref().String(), 0*time.Second, nil, nil)
 		tr.Skip = true
 		return tr, false
 	}
@@ -441,6 +473,11 @@ func (r *Runner) runTest(ctx context.Context, txn storage.Transaction, mod *ast.
 		rego.PrintHook(topdown.NewPrintHook(printbuf)),
 	)
 
+	// Register custom builtins on rego instance
+	for _, v := range r.customBuiltins {
+		v.Func(rg)
+	}
+
 	t0 := time.Now()
 	rs, err := rg.Eval(ctx)
 	dt := time.Since(t0)
@@ -451,7 +488,7 @@ func (r *Runner) runTest(ctx context.Context, txn storage.Transaction, mod *ast.
 		trace = *bufferTracer
 	}
 
-	tr := newResult(rule.Loc(), mod.Package.Path.String(), ruleName, dt, trace, printbuf.Bytes())
+	tr := newResult(rule.Loc(), mod.Package.Path.String(), rule.Head.Ref().String(), dt, trace, printbuf.Bytes())
 	tr.Error = err
 	var stop bool
 
@@ -475,7 +512,7 @@ func (r *Runner) runBenchmark(ctx context.Context, txn storage.Transaction, mod
 	tr := &Result{
 		Location: rule.Loc(),
 		Package:  mod.Package.Path.String(),
-		Name:     string(rule.Head.Name),
+		Name:     rule.Head.Ref().String(), // TODO(sr): test
 	}
 
 	var stop bool
diff --git a/tester/runner_test.go b/tester/runner_test.go
index 2f3a6c2fc8..a613bf2065 100644
--- a/tester/runner_test.go
+++ b/tester/runner_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/cover"
+	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/tester"
 	"github.com/open-policy-agent/opa/topdown"
@@ -19,78 +20,6 @@ import (
 	"github.com/open-policy-agent/opa/util/test"
 )
 
-func TestRunner_EnableFailureLine(t *testing.T) {
-
-	ctx := context.Background()
-
-	files := map[string]string{
-		"/a_test.rego": `package foo
-			test_a {
-				true
-				false
-				true
-			}
-			test_b {
-				false
-				true
-			}
-			test_c {
-				input.x = 1  # indexer understands this
-			}`,
-	}
-
-	tests := map[[2]string]struct {
-		wantErr  bool
-		wantFail bool
-		FailRow  int
-	}{
-		{"data.foo", "test_a"}: {false, true, 4},
-		{"data.foo", "test_b"}: {false, true, 8},
-		{"data.foo", "test_c"}: {false, true, 0},
-	}
-
-	test.WithTempFS(files, func(d string) {
-		paths := []string{d}
-		modules, store, err := tester.Load(paths, nil)
-		if err != nil {
-			t.Fatal(err)
-		}
-		ch, err := tester.NewRunner().EnableFailureLine(true).SetStore(store).Run(ctx, modules)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var rs []*tester.Result
-		for r := range ch {
-			rs = append(rs, r)
-		}
-		seen := map[[2]string]struct{}{}
-		for i := range rs {
-			k := [2]string{rs[i].Package, rs[i].Name}
-			seen[k] = struct{}{}
-			exp, ok := tests[k]
-			if !ok {
-				t.Errorf("Unexpected result for %v", k)
-			} else if exp.wantErr != (rs[i].Error != nil) || exp.wantFail != rs[i].Fail {
-				t.Errorf("Expected %v for %v but got: %v", exp, k, rs[i])
-			} else if exp.FailRow != 0 {
-				if rs[i].FailedAt == nil || rs[i].FailedAt.Location == nil {
-					t.Errorf("Failed line not set")
-				} else if rs[i].FailedAt.Location.Row != exp.FailRow {
-					t.Errorf("Expected Failed Line %v but got: %v", exp.FailRow, rs[i].FailedAt.Location.Row)
-				}
-			} else if rs[i].FailedAt != nil {
-				t.Errorf("Failed line set, but expected not set.")
-			}
-		}
-		// This makes sure all tests were executed
-		for k := range tests {
-			if _, ok := seen[k]; !ok {
-				t.Errorf("Expected result for %v", k)
-			}
-		}
-	})
-}
-
 func TestRun(t *testing.T) {
 	testRun(t, testRunConfig{})
 }
@@ -146,19 +75,33 @@ func testRun(t *testing.T, conf testRunConfig) map[string]*ast.Module {
 			`,
 		"/b_test.rego": `package bar
 
-		test_duplicate { true }`,
+			test_duplicate { true }`,
+		"/c_test.rego": `package baz
+
+			a.b.test_duplicate { false }
+			a.b.test_duplicate { true }
+			a.b.test_duplicate { true }`,
+		// Regression test for issue #5496.
+		"/d_test.rego": `package test
+
+		a[0] := 1
+		test_pass { true }`,
 	}
 
 	tests := expectedTestResults{
-		{"data.foo", "test_pass"}:          {false, false, false},
-		{"data.foo", "test_fail"}:          {false, true, false},
-		{"data.foo", "test_fail_non_bool"}: {false, true, false},
-		{"data.foo", "test_duplicate"}:     {false, true, false},
-		{"data.foo", "test_duplicate#01"}:  {false, false, false},
-		{"data.foo", "test_duplicate#02"}:  {false, false, false},
-		{"data.foo", "test_err"}:           {true, false, false},
-		{"data.foo", "todo_test_skip"}:     {false, false, true},
-		{"data.bar", "test_duplicate"}:     {false, false, false},
+		{"data.foo", "test_pass"}:                  {false, false, false},
+		{"data.foo", "test_fail"}:                  {false, true, false},
+		{"data.foo", "test_fail_non_bool"}:         {false, true, false},
+		{"data.foo", "test_duplicate"}:             {false, true, false},
+		{"data.foo", "test_duplicate#01"}:          {false, false, false},
+		{"data.foo", "test_duplicate#02"}:          {false, false, false},
+		{"data.foo", "test_err"}:                   {true, false, false},
+		{"data.foo", "todo_test_skip"}:             {false, false, true},
+		{"data.bar", "test_duplicate"}:             {false, false, false},
+		{"data.baz", "a.b.test_duplicate"}:         {false, true, false},
+		{"data.baz", "a.b[\"test_duplicate#01\"]"}: {false, false, false},
+		{"data.baz", "a.b[\"test_duplicate#02\"]"}: {false, false, false},
+		{"data.test", "test_pass"}:                 {false, false, false},
 	}
 
 	var modules map[string]*ast.Module
@@ -257,6 +200,11 @@ func TestRunWithFilterRegex(t *testing.T) {
 		"/b_test.rego": `package bar
 
 		test_duplicate { true }`,
+		"/c_test.rego": `package baz
+
+		a.b.test_duplicate { false }
+		a.b.test_duplicate { true }
+		a.b.test_duplicate { true }`,
 	}
 
 	cases := []struct {
@@ -268,32 +216,38 @@ func TestRunWithFilterRegex(t *testing.T) {
 			note:  "all tests match",
 			regex: ".*",
 			tests: expectedTestResults{
-				{"data.foo", "test_pass"}:          {false, false, false},
-				{"data.foo", "test_fail"}:          {false, true, false},
-				{"data.foo", "test_fail_non_bool"}: {false, true, false},
-				{"data.foo", "test_duplicate"}:     {false, true, false},
-				{"data.foo", "test_duplicate#01"}:  {false, false, false},
-				{"data.foo", "test_duplicate#02"}:  {false, false, false},
-				{"data.foo", "test_err"}:           {true, false, false},
-				{"data.foo", "todo_test_skip"}:     {false, false, true},
-				{"data.foo", "todo_test_skip_too"}: {false, false, true},
-				{"data.bar", "test_duplicate"}:     {false, false, false},
+				{"data.foo", "test_pass"}:                  {false, false, false},
+				{"data.foo", "test_fail"}:                  {false, true, false},
+				{"data.foo", "test_fail_non_bool"}:         {false, true, false},
+				{"data.foo", "test_duplicate"}:             {false, true, false},
+				{"data.foo", "test_duplicate#01"}:          {false, false, false},
+				{"data.foo", "test_duplicate#02"}:          {false, false, false},
+				{"data.foo", "test_err"}:                   {true, false, false},
+				{"data.foo", "todo_test_skip"}:             {false, false, true},
+				{"data.foo", "todo_test_skip_too"}:         {false, false, true},
+				{"data.bar", "test_duplicate"}:             {false, false, false},
+				{"data.baz", "a.b.test_duplicate"}:         {false, true, false},
+				{"data.baz", "a.b[\"test_duplicate#01\"]"}: {false, false, false},
+				{"data.baz", "a.b[\"test_duplicate#02\"]"}: {false, false, false},
 			},
 		},
 		{
 			note:  "no filter",
 			regex: "",
 			tests: expectedTestResults{
-				{"data.foo", "test_pass"}:          {false, false, false},
-				{"data.foo", "test_fail"}:          {false, true, false},
-				{"data.foo", "test_fail_non_bool"}: {false, true, false},
-				{"data.foo", "test_duplicate"}:     {false, true, false},
-				{"data.foo", "test_duplicate#01"}:  {false, false, false},
-				{"data.foo", "test_duplicate#02"}:  {false, false, false},
-				{"data.foo", "test_err"}:           {true, false, false},
-				{"data.foo", "todo_test_skip"}:     {false, false, true},
-				{"data.foo", "todo_test_skip_too"}: {false, false, true},
-				{"data.bar", "test_duplicate"}:     {false, false, false},
+				{"data.foo", "test_pass"}:                  {false, false, false},
+				{"data.foo", "test_fail"}:                  {false, true, false},
+				{"data.foo", "test_fail_non_bool"}:         {false, true, false},
+				{"data.foo", "test_duplicate"}:             {false, true, false},
+				{"data.foo", "test_duplicate#01"}:          {false, false, false},
+				{"data.foo", "test_duplicate#02"}:          {false, false, false},
+				{"data.foo", "test_err"}:                   {true, false, false},
+				{"data.foo", "todo_test_skip"}:             {false, false, true},
+				{"data.foo", "todo_test_skip_too"}:         {false, false, true},
+				{"data.bar", "test_duplicate"}:             {false, false, false},
+				{"data.baz", "a.b.test_duplicate"}:         {false, true, false},
+				{"data.baz", "a.b[\"test_duplicate#01\"]"}: {false, false, false},
+				{"data.baz", "a.b[\"test_duplicate#02\"]"}: {false, false, false},
 			},
 		},
 		{
@@ -359,6 +313,15 @@ func TestRunWithFilterRegex(t *testing.T) {
 				{"data.bar", "test_duplicate"}: {false, false, false},
 			},
 		},
+		{
+			note:  "matching ref rule halfways",
+			regex: "data.baz.a",
+			tests: expectedTestResults{
+				{"data.baz", "a.b.test_duplicate"}:         {false, true, false},
+				{"data.baz", "a.b[\"test_duplicate#01\"]"}: {false, false, false},
+				{"data.baz", "a.b[\"test_duplicate#02\"]"}: {false, false, false},
+			},
+		},
 	}
 
 	test.WithTempFS(files, func(d string) {
@@ -434,6 +397,7 @@ func testCancel(t *testing.T, bench bool) {
 }
 
 func TestRunnerTimeout(t *testing.T) {
+	test.Skip(t)
 	testTimeout(t, false)
 }
 
@@ -506,7 +470,8 @@ func TestRunnerPrintOutput(t *testing.T) {
 
 		test_a { print("A") }
 		test_b { false; print("B") }
-		test_c { print("C"); false }`,
+		test_c { print("C"); false }
+		p.q.r.test_d { print("D") }`,
 	}
 
 	ctx := context.Background()
@@ -531,9 +496,10 @@ func TestRunnerPrintOutput(t *testing.T) {
 		}
 
 		exp := map[string]string{
-			"test_a": "A\n",
-			"test_b": "",
-			"test_c": "C\n",
+			"test_a":       "A\n",
+			"test_b":       "",
+			"test_c":       "C\n",
+			"p.q.r.test_d": "D\n",
 		}
 
 		got := map[string]string{}
@@ -557,9 +523,89 @@ func registerSleepBuiltin() {
 		),
 	})
 
-	topdown.RegisterFunctionalBuiltin1("test.sleep", func(a ast.Value) (ast.Value, error) {
-		d, _ := time.ParseDuration(string(a.(ast.String)))
+	topdown.RegisterBuiltinFunc("test.sleep", func(_ topdown.BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		d, _ := time.ParseDuration(string(operands[0].Value.(ast.String)))
 		time.Sleep(d)
-		return ast.Null{}, nil
+		return iter(ast.NullTerm())
+	})
+}
+
+func TestRunnerWithCustomBuiltin(t *testing.T) {
+
+	var myBuiltinDecl = &ast.Builtin{
+		Name: "my_sum",
+		Decl: types.NewFunction(
+			types.Args(
+				types.N,
+				types.N,
+			),
+			types.N,
+		),
+	}
+
+	var myBuiltin = &tester.Builtin{
+		Decl: myBuiltinDecl,
+		Func: rego.Function2(
+			&rego.Function{
+				Name: myBuiltinDecl.Name,
+				Decl: myBuiltinDecl.Decl,
+			},
+			func(_ rego.BuiltinContext, a, b *ast.Term) (*ast.Term, error) {
+				var num1, num2 int
+				if err := ast.As(a.Value, &num1); err != nil {
+					return nil, err
+				}
+				if err := ast.As(b.Value, &num2); err != nil {
+					return nil, err
+				}
+				return ast.IntNumberTerm(num1 + num2), nil
+			},
+		),
+	}
+
+	files := map[string]string{
+		"/test.rego": `package test
+
+		test_a { my_sum(2,3) == 5 }
+		test_b { my_sum(5,4) == 1 }
+		test_c { my_sum(4,1.0) == 5 }`,
+	}
+
+	ctx := context.Background()
+
+	test.WithTempFS(files, func(d string) {
+		paths := []string{d}
+		modules, store, err := tester.Load(paths, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		txn := storage.NewTransactionOrDie(ctx, store)
+		runner := tester.NewRunner().SetStore(store).SetModules(modules).AddCustomBuiltins([]*tester.Builtin{myBuiltin})
+		ch, err := runner.RunTests(ctx, txn)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		var results []*tester.Result
+
+		for r := range ch {
+			results = append(results, r)
+		}
+
+		exp := map[string]bool{
+			"test_a": true,
+			"test_b": false,
+			"test_c": false,
+		}
+
+		got := map[string]bool{}
+
+		for _, tr := range results {
+			got[tr.Name] = tr.Pass()
+		}
+
+		if !reflect.DeepEqual(exp, got) {
+			t.Fatal("expected:", exp, "got:", got)
+		}
 	})
 }
diff --git a/topdown/aggregates.go b/topdown/aggregates.go
index 63d60f56df..a0f67a7c95 100644
--- a/topdown/aggregates.go
+++ b/topdown/aggregates.go
@@ -11,22 +11,22 @@ import (
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinCount(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinCount(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case *ast.Array:
-		return ast.IntNumberTerm(a.Len()).Value, nil
+		return iter(ast.IntNumberTerm(a.Len()))
 	case ast.Object:
-		return ast.IntNumberTerm(a.Len()).Value, nil
+		return iter(ast.IntNumberTerm(a.Len()))
 	case ast.Set:
-		return ast.IntNumberTerm(a.Len()).Value, nil
+		return iter(ast.IntNumberTerm(a.Len()))
 	case ast.String:
-		return ast.IntNumberTerm(len([]rune(a))).Value, nil
+		return iter(ast.IntNumberTerm(len([]rune(a))))
 	}
-	return nil, builtins.NewOperandTypeErr(1, a, "array", "object", "set")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "array", "object", "set", "string")
 }
 
-func builtinSum(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinSum(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case *ast.Array:
 		sum := big.NewFloat(0)
 		err := a.Iter(func(x *ast.Term) error {
@@ -37,7 +37,10 @@ func builtinSum(a ast.Value) (ast.Value, error) {
 			sum = new(big.Float).Add(sum, builtins.NumberToFloat(n))
 			return nil
 		})
-		return builtins.FloatToNumber(sum), err
+		if err != nil {
+			return err
+		}
+		return iter(ast.NewTerm(builtins.FloatToNumber(sum)))
 	case ast.Set:
 		sum := big.NewFloat(0)
 		err := a.Iter(func(x *ast.Term) error {
@@ -48,13 +51,16 @@ func builtinSum(a ast.Value) (ast.Value, error) {
 			sum = new(big.Float).Add(sum, builtins.NumberToFloat(n))
 			return nil
 		})
-		return builtins.FloatToNumber(sum), err
+		if err != nil {
+			return err
+		}
+		return iter(ast.NewTerm(builtins.FloatToNumber(sum)))
 	}
-	return nil, builtins.NewOperandTypeErr(1, a, "set", "array")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "set", "array")
 }
 
-func builtinProduct(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinProduct(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case *ast.Array:
 		product := big.NewFloat(1)
 		err := a.Iter(func(x *ast.Term) error {
@@ -65,7 +71,10 @@ func builtinProduct(a ast.Value) (ast.Value, error) {
 			product = new(big.Float).Mul(product, builtins.NumberToFloat(n))
 			return nil
 		})
-		return builtins.FloatToNumber(product), err
+		if err != nil {
+			return err
+		}
+		return iter(ast.NewTerm(builtins.FloatToNumber(product)))
 	case ast.Set:
 		product := big.NewFloat(1)
 		err := a.Iter(func(x *ast.Term) error {
@@ -76,16 +85,19 @@ func builtinProduct(a ast.Value) (ast.Value, error) {
 			product = new(big.Float).Mul(product, builtins.NumberToFloat(n))
 			return nil
 		})
-		return builtins.FloatToNumber(product), err
+		if err != nil {
+			return err
+		}
+		return iter(ast.NewTerm(builtins.FloatToNumber(product)))
 	}
-	return nil, builtins.NewOperandTypeErr(1, a, "set", "array")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "set", "array")
 }
 
-func builtinMax(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinMax(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case *ast.Array:
 		if a.Len() == 0 {
-			return nil, BuiltinEmpty{}
+			return nil
 		}
 		var max = ast.Value(ast.Null{})
 		a.Foreach(func(x *ast.Term) {
@@ -93,10 +105,10 @@ func builtinMax(a ast.Value) (ast.Value, error) {
 				max = x.Value
 			}
 		})
-		return max, nil
+		return iter(ast.NewTerm(max))
 	case ast.Set:
 		if a.Len() == 0 {
-			return nil, BuiltinEmpty{}
+			return nil
 		}
 		max, err := a.Reduce(ast.NullTerm(), func(max *ast.Term, elem *ast.Term) (*ast.Term, error) {
 			if ast.Compare(max, elem) <= 0 {
@@ -104,17 +116,20 @@ func builtinMax(a ast.Value) (ast.Value, error) {
 			}
 			return max, nil
 		})
-		return max.Value, err
+		if err != nil {
+			return err
+		}
+		return iter(max)
 	}
 
-	return nil, builtins.NewOperandTypeErr(1, a, "set", "array")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "set", "array")
 }
 
-func builtinMin(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinMin(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case *ast.Array:
 		if a.Len() == 0 {
-			return nil, BuiltinEmpty{}
+			return nil
 		}
 		min := a.Elem(0).Value
 		a.Foreach(func(x *ast.Term) {
@@ -122,10 +137,10 @@ func builtinMin(a ast.Value) (ast.Value, error) {
 				min = x.Value
 			}
 		})
-		return min, nil
+		return iter(ast.NewTerm(min))
 	case ast.Set:
 		if a.Len() == 0 {
-			return nil, BuiltinEmpty{}
+			return nil
 		}
 		min, err := a.Reduce(ast.NullTerm(), func(min *ast.Term, elem *ast.Term) (*ast.Term, error) {
 			// The null term is considered to be less than any other term,
@@ -140,24 +155,27 @@ func builtinMin(a ast.Value) (ast.Value, error) {
 			}
 			return min, nil
 		})
-		return min.Value, err
+		if err != nil {
+			return err
+		}
+		return iter(min)
 	}
 
-	return nil, builtins.NewOperandTypeErr(1, a, "set", "array")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "set", "array")
 }
 
-func builtinSort(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinSort(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case *ast.Array:
-		return a.Sorted(), nil
+		return iter(ast.NewTerm(a.Sorted()))
 	case ast.Set:
-		return a.Sorted(), nil
+		return iter(ast.NewTerm(a.Sorted()))
 	}
-	return nil, builtins.NewOperandTypeErr(1, a, "set", "array")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "set", "array")
 }
 
-func builtinAll(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinAll(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case ast.Set:
 		res := true
 		match := ast.BooleanTerm(true)
@@ -168,7 +186,7 @@ func builtinAll(a ast.Value) (ast.Value, error) {
 			}
 			return false
 		})
-		return ast.Boolean(res), nil
+		return iter(ast.BooleanTerm(res))
 	case *ast.Array:
 		res := true
 		match := ast.BooleanTerm(true)
@@ -179,17 +197,17 @@ func builtinAll(a ast.Value) (ast.Value, error) {
 			}
 			return false
 		})
-		return ast.Boolean(res), nil
+		return iter(ast.BooleanTerm(res))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "array", "set")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "array", "set")
 	}
 }
 
-func builtinAny(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinAny(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case ast.Set:
 		res := val.Len() > 0 && val.Contains(ast.BooleanTerm(true))
-		return ast.Boolean(res), nil
+		return iter(ast.BooleanTerm(res))
 	case *ast.Array:
 		res := false
 		match := ast.BooleanTerm(true)
@@ -200,15 +218,15 @@ func builtinAny(a ast.Value) (ast.Value, error) {
 			}
 			return false
 		})
-		return ast.Boolean(res), nil
+		return iter(ast.BooleanTerm(res))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "array", "set")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "array", "set")
 	}
 }
 
-func builtinMember(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	containee := args[0]
-	switch c := args[1].Value.(type) {
+func builtinMember(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	containee := operands[0]
+	switch c := operands[1].Value.(type) {
 	case ast.Set:
 		return iter(ast.BooleanTerm(c.Contains(containee)))
 	case *ast.Array:
@@ -233,9 +251,9 @@ func builtinMember(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) erro
 	return iter(ast.BooleanTerm(false))
 }
 
-func builtinMemberWithKey(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	key, val := args[0], args[1]
-	switch c := args[2].Value.(type) {
+func builtinMemberWithKey(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	key, val := operands[0], operands[1]
+	switch c := operands[2].Value.(type) {
 	case interface{ Get(*ast.Term) *ast.Term }:
 		ret := false
 		if act := c.Get(key); act != nil {
@@ -247,14 +265,14 @@ func builtinMemberWithKey(_ BuiltinContext, args []*ast.Term, iter func(*ast.Ter
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.Count.Name, builtinCount)
-	RegisterFunctionalBuiltin1(ast.Sum.Name, builtinSum)
-	RegisterFunctionalBuiltin1(ast.Product.Name, builtinProduct)
-	RegisterFunctionalBuiltin1(ast.Max.Name, builtinMax)
-	RegisterFunctionalBuiltin1(ast.Min.Name, builtinMin)
-	RegisterFunctionalBuiltin1(ast.Sort.Name, builtinSort)
-	RegisterFunctionalBuiltin1(ast.Any.Name, builtinAny)
-	RegisterFunctionalBuiltin1(ast.All.Name, builtinAll)
+	RegisterBuiltinFunc(ast.Count.Name, builtinCount)
+	RegisterBuiltinFunc(ast.Sum.Name, builtinSum)
+	RegisterBuiltinFunc(ast.Product.Name, builtinProduct)
+	RegisterBuiltinFunc(ast.Max.Name, builtinMax)
+	RegisterBuiltinFunc(ast.Min.Name, builtinMin)
+	RegisterBuiltinFunc(ast.Sort.Name, builtinSort)
+	RegisterBuiltinFunc(ast.Any.Name, builtinAny)
+	RegisterBuiltinFunc(ast.All.Name, builtinAll)
 	RegisterBuiltinFunc(ast.Member.Name, builtinMember)
 	RegisterBuiltinFunc(ast.MemberWithKey.Name, builtinMemberWithKey)
 }
diff --git a/topdown/arithmetic.go b/topdown/arithmetic.go
index 7e9252ff6d..c75f816a4f 100644
--- a/topdown/arithmetic.go
+++ b/topdown/arithmetic.go
@@ -81,72 +81,72 @@ func arithRem(a, b *big.Int) (*big.Int, error) {
 	return new(big.Int).Rem(a, b), nil
 }
 
-func builtinArithArity1(fn arithArity1) FunctionalBuiltin1 {
-	return func(a ast.Value) (ast.Value, error) {
-		n, err := builtins.NumberOperand(a, 1)
+func builtinArithArity1(fn arithArity1) BuiltinFunc {
+	return func(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		n, err := builtins.NumberOperand(operands[0].Value, 1)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		f, err := fn(builtins.NumberToFloat(n))
 		if err != nil {
-			return nil, err
+			return err
 		}
-		return builtins.FloatToNumber(f), nil
+		return iter(ast.NewTerm(builtins.FloatToNumber(f)))
 	}
 }
 
-func builtinArithArity2(fn arithArity2) FunctionalBuiltin2 {
-	return func(a, b ast.Value) (ast.Value, error) {
-		n1, err := builtins.NumberOperand(a, 1)
+func builtinArithArity2(fn arithArity2) BuiltinFunc {
+	return func(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		n1, err := builtins.NumberOperand(operands[0].Value, 1)
 		if err != nil {
-			return nil, err
+			return err
 		}
-		n2, err := builtins.NumberOperand(b, 2)
+		n2, err := builtins.NumberOperand(operands[1].Value, 2)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		f, err := fn(builtins.NumberToFloat(n1), builtins.NumberToFloat(n2))
 		if err != nil {
-			return nil, err
+			return err
 		}
-		return builtins.FloatToNumber(f), nil
+		return iter(ast.NewTerm(builtins.FloatToNumber(f)))
 	}
 }
 
-func builtinMinus(a, b ast.Value) (ast.Value, error) {
+func builtinMinus(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	n1, ok1 := a.(ast.Number)
-	n2, ok2 := b.(ast.Number)
+	n1, ok1 := operands[0].Value.(ast.Number)
+	n2, ok2 := operands[1].Value.(ast.Number)
 
 	if ok1 && ok2 {
 		f, err := arithMinus(builtins.NumberToFloat(n1), builtins.NumberToFloat(n2))
 		if err != nil {
-			return nil, err
+			return err
 		}
-		return builtins.FloatToNumber(f), nil
+		return iter(ast.NewTerm(builtins.FloatToNumber(f)))
 	}
 
-	s1, ok3 := a.(ast.Set)
-	s2, ok4 := b.(ast.Set)
+	s1, ok3 := operands[0].Value.(ast.Set)
+	s2, ok4 := operands[1].Value.(ast.Set)
 
 	if ok3 && ok4 {
-		return s1.Diff(s2), nil
+		return iter(ast.NewTerm(s1.Diff(s2)))
 	}
 
 	if !ok1 && !ok3 {
-		return nil, builtins.NewOperandTypeErr(1, a, "number", "set")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "number", "set")
 	}
 
 	if ok2 {
-		return nil, builtins.NewOperandTypeErr(2, b, "set")
+		return builtins.NewOperandTypeErr(2, operands[1].Value, "set")
 	}
 
-	return nil, builtins.NewOperandTypeErr(2, b, "number")
+	return builtins.NewOperandTypeErr(2, operands[1].Value, "number")
 }
 
-func builtinRem(a, b ast.Value) (ast.Value, error) {
-	n1, ok1 := a.(ast.Number)
-	n2, ok2 := b.(ast.Number)
+func builtinRem(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	n1, ok1 := operands[0].Value.(ast.Number)
+	n2, ok2 := operands[1].Value.(ast.Number)
 
 	if ok1 && ok2 {
 
@@ -154,31 +154,31 @@ func builtinRem(a, b ast.Value) (ast.Value, error) {
 		op2, err2 := builtins.NumberToInt(n2)
 
 		if err1 != nil || err2 != nil {
-			return nil, fmt.Errorf("modulo on floating-point number")
+			return fmt.Errorf("modulo on floating-point number")
 		}
 
 		i, err := arithRem(op1, op2)
 		if err != nil {
-			return nil, err
+			return err
 		}
-		return builtins.IntToNumber(i), nil
+		return iter(ast.NewTerm(builtins.IntToNumber(i)))
 	}
 
 	if !ok1 {
-		return nil, builtins.NewOperandTypeErr(1, a, "number")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "number")
 	}
 
-	return nil, builtins.NewOperandTypeErr(2, b, "number")
+	return builtins.NewOperandTypeErr(2, operands[1].Value, "number")
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.Abs.Name, builtinArithArity1(arithAbs))
-	RegisterFunctionalBuiltin1(ast.Round.Name, builtinArithArity1(arithRound))
-	RegisterFunctionalBuiltin1(ast.Ceil.Name, builtinArithArity1(arithCeil))
-	RegisterFunctionalBuiltin1(ast.Floor.Name, builtinArithArity1(arithFloor))
-	RegisterFunctionalBuiltin2(ast.Plus.Name, builtinArithArity2(arithPlus))
-	RegisterFunctionalBuiltin2(ast.Minus.Name, builtinMinus)
-	RegisterFunctionalBuiltin2(ast.Multiply.Name, builtinArithArity2(arithMultiply))
-	RegisterFunctionalBuiltin2(ast.Divide.Name, builtinArithArity2(arithDivide))
-	RegisterFunctionalBuiltin2(ast.Rem.Name, builtinRem)
+	RegisterBuiltinFunc(ast.Abs.Name, builtinArithArity1(arithAbs))
+	RegisterBuiltinFunc(ast.Round.Name, builtinArithArity1(arithRound))
+	RegisterBuiltinFunc(ast.Ceil.Name, builtinArithArity1(arithCeil))
+	RegisterBuiltinFunc(ast.Floor.Name, builtinArithArity1(arithFloor))
+	RegisterBuiltinFunc(ast.Plus.Name, builtinArithArity2(arithPlus))
+	RegisterBuiltinFunc(ast.Minus.Name, builtinMinus)
+	RegisterBuiltinFunc(ast.Multiply.Name, builtinArithArity2(arithMultiply))
+	RegisterBuiltinFunc(ast.Divide.Name, builtinArithArity2(arithDivide))
+	RegisterBuiltinFunc(ast.Rem.Name, builtinRem)
 }
diff --git a/topdown/array.go b/topdown/array.go
index ca3e0d9fae..e7fe5be643 100644
--- a/topdown/array.go
+++ b/topdown/array.go
@@ -9,15 +9,15 @@ import (
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinArrayConcat(a, b ast.Value) (ast.Value, error) {
-	arrA, err := builtins.ArrayOperand(a, 1)
+func builtinArrayConcat(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	arrA, err := builtins.ArrayOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	arrB, err := builtins.ArrayOperand(b, 2)
+	arrB, err := builtins.ArrayOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	arrC := make([]*ast.Term, arrA.Len()+arrB.Len())
@@ -33,23 +33,23 @@ func builtinArrayConcat(a, b ast.Value) (ast.Value, error) {
 		i++
 	})
 
-	return ast.NewArray(arrC...), nil
+	return iter(ast.NewTerm(ast.NewArray(arrC...)))
 }
 
-func builtinArraySlice(a, i, j ast.Value) (ast.Value, error) {
-	arr, err := builtins.ArrayOperand(a, 1)
+func builtinArraySlice(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	arr, err := builtins.ArrayOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	startIndex, err := builtins.IntOperand(i, 2)
+	startIndex, err := builtins.IntOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	stopIndex, err := builtins.IntOperand(j, 3)
+	stopIndex, err := builtins.IntOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// Clamp stopIndex to avoid out-of-range errors. If negative, clamp to zero.
@@ -68,10 +68,27 @@ func builtinArraySlice(a, i, j ast.Value) (ast.Value, error) {
 		startIndex = stopIndex
 	}
 
-	return arr.Slice(startIndex, stopIndex), nil
+	return iter(ast.NewTerm(arr.Slice(startIndex, stopIndex)))
+}
+
+func builtinArrayReverse(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	arr, err := builtins.ArrayOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	length := arr.Len()
+	reversedArr := make([]*ast.Term, length)
+
+	for index := 0; index < length; index++ {
+		reversedArr[index] = arr.Elem(length - index - 1)
+	}
+
+	return iter(ast.ArrayTerm(reversedArr...))
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.ArrayConcat.Name, builtinArrayConcat)
-	RegisterFunctionalBuiltin3(ast.ArraySlice.Name, builtinArraySlice)
+	RegisterBuiltinFunc(ast.ArrayConcat.Name, builtinArrayConcat)
+	RegisterBuiltinFunc(ast.ArraySlice.Name, builtinArraySlice)
+	RegisterBuiltinFunc(ast.ArrayReverse.Name, builtinArrayReverse)
 }
diff --git a/topdown/binary.go b/topdown/binary.go
index 3cab5def1e..b4f9dbd392 100644
--- a/topdown/binary.go
+++ b/topdown/binary.go
@@ -9,37 +9,37 @@ import (
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinBinaryAnd(a ast.Value, b ast.Value) (ast.Value, error) {
+func builtinBinaryAnd(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	s1, err := builtins.SetOperand(a, 1)
+	s1, err := builtins.SetOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	s2, err := builtins.SetOperand(b, 2)
+	s2, err := builtins.SetOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return s1.Intersect(s2), nil
+	return iter(ast.NewTerm(s1.Intersect(s2)))
 }
 
-func builtinBinaryOr(a ast.Value, b ast.Value) (ast.Value, error) {
+func builtinBinaryOr(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	s1, err := builtins.SetOperand(a, 1)
+	s1, err := builtins.SetOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	s2, err := builtins.SetOperand(b, 2)
+	s2, err := builtins.SetOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return s1.Union(s2), nil
+	return iter(ast.NewTerm(s1.Union(s2)))
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.And.Name, builtinBinaryAnd)
-	RegisterFunctionalBuiltin2(ast.Or.Name, builtinBinaryOr)
+	RegisterBuiltinFunc(ast.And.Name, builtinBinaryAnd)
+	RegisterBuiltinFunc(ast.Or.Name, builtinBinaryOr)
 }
diff --git a/topdown/bindings.go b/topdown/bindings.go
index 52321bb139..7621dac529 100644
--- a/topdown/bindings.go
+++ b/topdown/bindings.go
@@ -87,6 +87,9 @@ func (u *bindings) plugNamespaced(a *ast.Term, caller *bindings) *ast.Term {
 		}
 		return u.namespaceVar(b, caller)
 	case *ast.Array:
+		if a.IsGround() {
+			return a
+		}
 		cpy := *a
 		arr := make([]*ast.Term, v.Len())
 		for i := 0; i < len(arr); i++ {
@@ -104,6 +107,9 @@ func (u *bindings) plugNamespaced(a *ast.Term, caller *bindings) *ast.Term {
 		})
 		return &cpy
 	case ast.Set:
+		if a.IsGround() {
+			return a
+		}
 		cpy := *a
 		cpy.Value, _ = v.Map(func(x *ast.Term) (*ast.Term, error) {
 			return u.plugNamespaced(x, caller), nil
@@ -242,6 +248,9 @@ func (vis namespacingVisitor) namespaceTerm(a *ast.Term) *ast.Term {
 	case ast.Var:
 		return vis.b.namespaceVar(a, vis.caller)
 	case *ast.Array:
+		if a.IsGround() {
+			return a
+		}
 		cpy := *a
 		arr := make([]*ast.Term, v.Len())
 		for i := 0; i < len(arr); i++ {
@@ -259,6 +268,9 @@ func (vis namespacingVisitor) namespaceTerm(a *ast.Term) *ast.Term {
 		})
 		return &cpy
 	case ast.Set:
+		if a.IsGround() {
+			return a
+		}
 		cpy := *a
 		cpy.Value, _ = v.Map(func(x *ast.Term) (*ast.Term, error) {
 			return vis.namespaceTerm(x), nil
diff --git a/topdown/builtins.go b/topdown/builtins.go
index 4253638121..5a7f2bc910 100644
--- a/topdown/builtins.go
+++ b/topdown/builtins.go
@@ -16,19 +16,20 @@ import (
 	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/print"
+	"github.com/open-policy-agent/opa/tracing"
 )
 
 type (
-	// FunctionalBuiltin1 is deprecated. Use BuiltinFunc instead.
+	// Deprecated: Functional-style builtins are deprecated. Use BuiltinFunc instead.
 	FunctionalBuiltin1 func(op1 ast.Value) (output ast.Value, err error)
 
-	// FunctionalBuiltin2 is deprecated. Use BuiltinFunc instead.
+	// Deprecated: Functional-style builtins are deprecated. Use BuiltinFunc instead.
 	FunctionalBuiltin2 func(op1, op2 ast.Value) (output ast.Value, err error)
 
-	// FunctionalBuiltin3 is deprecated. Use BuiltinFunc instead.
+	// Deprecated: Functional-style builtins are deprecated. Use BuiltinFunc instead.
 	FunctionalBuiltin3 func(op1, op2, op3 ast.Value) (output ast.Value, err error)
 
-	// FunctionalBuiltin4 is deprecated. Use BuiltinFunc instead.
+	// Deprecated: Functional-style builtins are deprecated. Use BuiltinFunc instead.
 	FunctionalBuiltin4 func(op1, op2, op3, op4 ast.Value) (output ast.Value, err error)
 
 	// BuiltinContext contains context from the evaluator that may be used by
@@ -42,6 +43,7 @@ type (
 		Runtime                *ast.Term             // runtime information on the OPA instance
 		Cache                  builtins.Cache        // built-in function state cache
 		InterQueryBuiltinCache cache.InterQueryCache // cross-query built-in function state cache
+		NDBuiltinCache         builtins.NDBCache     // cache for non-deterministic built-in state
 		Location               *ast.Location         // location of built-in call
 		Tracers                []Tracer              // Deprecated: Use QueryTracers instead
 		QueryTracers           []QueryTracer         // tracer objects for trace() built-in function
@@ -49,7 +51,9 @@ type (
 		QueryID                uint64                // identifies query being evaluated
 		ParentID               uint64                // identifies parent of query being evaluated
 		PrintHook              print.Hook            // provides callback function to use for printing
+		DistributedTracingOpts tracing.Options       // options to be used by distributed tracing.
 		rand                   *rand.Rand            // randomization source for non-security-sensitive operations
+		Capabilities           *ast.Capabilities
 	}
 
 	// BuiltinFunc defines an interface for implementing built-in functions.
@@ -84,22 +88,22 @@ func RegisterBuiltinFunc(name string, f BuiltinFunc) {
 	builtinFunctions[name] = builtinErrorWrapper(name, f)
 }
 
-// RegisterFunctionalBuiltin1 is deprecated use RegisterBuiltinFunc instead.
+// Deprecated: Functional-style builtins are deprecated. Use RegisterBuiltinFunc instead.
 func RegisterFunctionalBuiltin1(name string, fun FunctionalBuiltin1) {
 	builtinFunctions[name] = functionalWrapper1(name, fun)
 }
 
-// RegisterFunctionalBuiltin2 is deprecated use RegisterBuiltinFunc instead.
+// Deprecated: Functional-style builtins are deprecated. Use RegisterBuiltinFunc instead.
 func RegisterFunctionalBuiltin2(name string, fun FunctionalBuiltin2) {
 	builtinFunctions[name] = functionalWrapper2(name, fun)
 }
 
-// RegisterFunctionalBuiltin3 is deprecated use RegisterBuiltinFunc instead.
+// Deprecated: Functional-style builtins are deprecated. Use RegisterBuiltinFunc instead.
 func RegisterFunctionalBuiltin3(name string, fun FunctionalBuiltin3) {
 	builtinFunctions[name] = functionalWrapper3(name, fun)
 }
 
-// RegisterFunctionalBuiltin4 is deprecated use RegisterBuiltinFunc instead.
+// Deprecated: Functional-style builtins are deprecated. Use RegisterBuiltinFunc instead.
 func RegisterFunctionalBuiltin4(name string, fun FunctionalBuiltin4) {
 	builtinFunctions[name] = functionalWrapper4(name, fun)
 }
@@ -109,7 +113,7 @@ func GetBuiltin(name string) BuiltinFunc {
 	return builtinFunctions[name]
 }
 
-// BuiltinEmpty is deprecated.
+// Deprecated: The BuiltinEmpty type is no longer needed. Use nil return values instead.
 type BuiltinEmpty struct{}
 
 func (BuiltinEmpty) Error() string {
@@ -180,13 +184,13 @@ func handleBuiltinErr(name string, loc *ast.Location, err error) error {
 	case builtins.ErrOperand:
 		return &Error{
 			Code:     TypeErr,
-			Message:  fmt.Sprintf("%v: %v", string(name), err.Error()),
+			Message:  fmt.Sprintf("%v: %v", name, err.Error()),
 			Location: loc,
 		}
 	default:
 		return &Error{
 			Code:     BuiltinErr,
-			Message:  fmt.Sprintf("%v: %v", string(name), err.Error()),
+			Message:  fmt.Sprintf("%v: %v", name, err.Error()),
 			Location: loc,
 		}
 	}
@@ -200,3 +204,17 @@ func readInt64(r io.Reader) (int64, error) {
 	}
 	return int64(binary.BigEndian.Uint64(bs)), nil
 }
+
+// Used to get older-style (ast.Term, error) tuples out of newer functions.
+func getResult(fn BuiltinFunc, operands ...*ast.Term) (*ast.Term, error) {
+	var result *ast.Term
+	extractionFn := func(r *ast.Term) error {
+		result = r
+		return nil
+	}
+	err := fn(BuiltinContext{}, operands, extractionFn)
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
diff --git a/topdown/builtins/builtins.go b/topdown/builtins/builtins.go
index fa0e0a2800..d7c3afbd89 100644
--- a/topdown/builtins/builtins.go
+++ b/topdown/builtins/builtins.go
@@ -6,11 +6,13 @@
 package builtins
 
 import (
+	"encoding/json"
 	"fmt"
 	"math/big"
 	"strings"
 
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/util"
 )
 
 // Cache defines the built-in cache used by the top-down evaluation. The keys
@@ -28,6 +30,85 @@ func (c Cache) Get(k interface{}) (interface{}, bool) {
 	return v, ok
 }
 
+// We use an ast.Object for the cached keys/values because a naive
+// map[ast.Value]ast.Value will not correctly detect value equality of
+// the member keys.
+type NDBCache map[string]ast.Object
+
+func (c NDBCache) AsValue() ast.Value {
+	out := ast.NewObject()
+	for bname, obj := range c {
+		out.Insert(ast.StringTerm(bname), ast.NewTerm(obj))
+	}
+	return out
+}
+
+// Put updates the cache for the named built-in.
+// Automatically creates the 2-level hierarchy as needed.
+func (c NDBCache) Put(name string, k, v ast.Value) {
+	if _, ok := c[name]; !ok {
+		c[name] = ast.NewObject()
+	}
+	c[name].Insert(ast.NewTerm(k), ast.NewTerm(v))
+}
+
+// Get returns the cached value for k for the named builtin.
+func (c NDBCache) Get(name string, k ast.Value) (ast.Value, bool) {
+	if m, ok := c[name]; ok {
+		v := m.Get(ast.NewTerm(k))
+		if v != nil {
+			return v.Value, true
+		}
+		return nil, false
+	}
+	return nil, false
+}
+
+// Convenience functions for serializing the data structure.
+func (c NDBCache) MarshalJSON() ([]byte, error) {
+	v, err := ast.JSON(c.AsValue())
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(v)
+}
+
+func (c *NDBCache) UnmarshalJSON(data []byte) error {
+	out := map[string]ast.Object{}
+	var incoming interface{}
+
+	// Note: We use util.Unmarshal instead of json.Unmarshal to get
+	// correct deserialization of number types.
+	err := util.Unmarshal(data, &incoming)
+	if err != nil {
+		return err
+	}
+
+	// Convert interface types back into ast.Value types.
+	nestedObject, err := ast.InterfaceToValue(incoming)
+	if err != nil {
+		return err
+	}
+
+	// Reconstruct NDBCache from nested ast.Object structure.
+	if source, ok := nestedObject.(ast.Object); ok {
+		err = source.Iter(func(k, v *ast.Term) error {
+			if obj, ok := v.Value.(ast.Object); ok {
+				out[string(k.Value.(ast.String))] = obj
+				return nil
+			}
+			return fmt.Errorf("expected Object, got other Value type in conversion")
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	*c = out
+
+	return nil
+}
+
 // ErrOperand represents an invalid operand has been passed to a built-in
 // function. Built-ins should return ErrOperand to indicate a type error has
 // occurred.
@@ -189,24 +270,30 @@ func IntToNumber(i *big.Int) ast.Number {
 
 // StringSliceOperand converts x to a []string. If the cast fails, a descriptive error is
 // returned.
-func StringSliceOperand(x ast.Value, pos int) ([]string, error) {
-	a, err := ArrayOperand(x, pos)
-	if err != nil {
-		return nil, err
+func StringSliceOperand(a ast.Value, pos int) ([]string, error) {
+	type iterable interface {
+		Iter(func(*ast.Term) error) error
+		Len() int
 	}
 
-	var f = make([]string, a.Len())
-	for k := 0; k < a.Len(); k++ {
-		b := a.Elem(k)
-		c, ok := b.Value.(ast.String)
+	strs, ok := a.(iterable)
+	if !ok {
+		return nil, NewOperandTypeErr(pos, a, "array", "set")
+	}
+
+	var outStrs = make([]string, 0, strs.Len())
+	if err := strs.Iter(func(x *ast.Term) error {
+		s, ok := x.Value.(ast.String)
 		if !ok {
-			return nil, NewOperandElementErr(pos, x, b.Value, "[]string")
+			return NewOperandElementErr(pos, a, x.Value, "string")
 		}
-
-		f[k] = string(c)
+		outStrs = append(outStrs, string(s))
+		return nil
+	}); err != nil {
+		return nil, err
 	}
 
-	return f, nil
+	return outStrs, nil
 }
 
 // RuneSliceOperand converts x to a []rune. If the cast fails, a descriptive error is
diff --git a/topdown/cache.go b/topdown/cache.go
index 96c250e13c..710efee475 100644
--- a/topdown/cache.go
+++ b/topdown/cache.go
@@ -14,8 +14,9 @@ type virtualCache struct {
 }
 
 type virtualCacheElem struct {
-	value    *ast.Term
-	children *util.HashMap
+	value     *ast.Term
+	children  *util.HashMap
+	undefined bool
 }
 
 func newVirtualCache() *virtualCache {
@@ -32,18 +33,31 @@ func (c *virtualCache) Pop() {
 	c.stack = c.stack[:len(c.stack)-1]
 }
 
-func (c *virtualCache) Get(ref ast.Ref) *ast.Term {
+// Returns the resolved value of the AST term and a flag indicating if the value
+// should be interpretted as undefined:
+//
+//	nil, true indicates the ref is undefined
+//	ast.Term, false indicates the ref is defined
+//	nil, false indicates the ref has not been cached
+//	ast.Term, true is impossible
+func (c *virtualCache) Get(ref ast.Ref) (*ast.Term, bool) {
 	node := c.stack[len(c.stack)-1]
 	for i := 0; i < len(ref); i++ {
 		x, ok := node.children.Get(ref[i])
 		if !ok {
-			return nil
+			return nil, false
 		}
 		node = x.(*virtualCacheElem)
 	}
-	return node.value
+	if node.undefined {
+		return nil, true
+	}
+
+	return node.value, false
 }
 
+// If value is a nil pointer, set the 'undefined' flag on the cache element to
+// indicate that the Ref has resolved to undefined.
 func (c *virtualCache) Put(ref ast.Ref, value *ast.Term) {
 	node := c.stack[len(c.stack)-1]
 	for i := 0; i < len(ref); i++ {
@@ -56,7 +70,11 @@ func (c *virtualCache) Put(ref ast.Ref, value *ast.Term) {
 			node = next
 		}
 	}
-	node.value = value
+	if value != nil {
+		node.value = value
+	} else {
+		node.undefined = true
+	}
 }
 
 func newVirtualCacheElem() *virtualCacheElem {
@@ -235,3 +253,57 @@ func newComprehensionCacheHashMap() *util.HashMap {
 		return x.(*ast.Term).Hash()
 	})
 }
+
+type functionMocksStack struct {
+	stack []*functionMocksElem
+}
+
+type functionMocksElem []frame
+
+type frame map[string]*ast.Term
+
+func newFunctionMocksStack() *functionMocksStack {
+	stack := &functionMocksStack{}
+	stack.Push()
+	return stack
+}
+
+func newFunctionMocksElem() *functionMocksElem {
+	return &functionMocksElem{}
+}
+
+func (s *functionMocksStack) Push() {
+	s.stack = append(s.stack, newFunctionMocksElem())
+}
+
+func (s *functionMocksStack) Pop() {
+	s.stack = s.stack[:len(s.stack)-1]
+}
+
+func (s *functionMocksStack) PopPairs() {
+	current := s.stack[len(s.stack)-1]
+	*current = (*current)[:len(*current)-1]
+}
+
+func (s *functionMocksStack) PutPairs(mocks [][2]*ast.Term) {
+	el := frame{}
+	for i := range mocks {
+		el[mocks[i][0].Value.String()] = mocks[i][1]
+	}
+	s.Put(el)
+}
+
+func (s *functionMocksStack) Put(el frame) {
+	current := s.stack[len(s.stack)-1]
+	*current = append(*current, el)
+}
+
+func (s *functionMocksStack) Get(f ast.Ref) (*ast.Term, bool) {
+	current := *s.stack[len(s.stack)-1]
+	for i := len(current) - 1; i >= 0; i-- {
+		if r, ok := current[i][f.String()]; ok {
+			return r, true
+		}
+	}
+	return nil, false
+}
diff --git a/topdown/cache/cache.go b/topdown/cache/cache.go
index 5e32b39c78..d3f7a1a0d0 100644
--- a/topdown/cache/cache.go
+++ b/topdown/cache/cache.go
@@ -75,15 +75,20 @@ type InterQueryCache interface {
 // NewInterQueryCache returns a new inter-query cache.
 func NewInterQueryCache(config *Config) InterQueryCache {
 	return &cache{
-		items:  map[string]InterQueryCacheValue{},
+		items:  map[string]cacheItem{},
 		usage:  0,
 		config: config,
 		l:      list.New(),
 	}
 }
 
+type cacheItem struct {
+	value      InterQueryCacheValue
+	keyElement *list.Element
+}
+
 type cache struct {
-	items  map[string]InterQueryCacheValue
+	items  map[string]cacheItem
 	usage  int64
 	config *Config
 	l      *list.List
@@ -101,7 +106,12 @@ func (c *cache) Insert(k ast.Value, v InterQueryCacheValue) (dropped int) {
 func (c *cache) Get(k ast.Value) (InterQueryCacheValue, bool) {
 	c.mtx.Lock()
 	defer c.mtx.Unlock()
-	return c.unsafeGet(k)
+	cacheItem, ok := c.unsafeGet(k)
+
+	if ok {
+		return cacheItem.value, true
+	}
+	return nil, false
 }
 
 // Delete deletes the value in the cache for k.
@@ -130,33 +140,38 @@ func (c *cache) unsafeInsert(k ast.Value, v InterQueryCacheValue) (dropped int)
 			return dropped
 		}
 
-		for key := c.l.Front(); key != nil && (c.usage+size > limit); key = key.Next() {
+		for key := c.l.Front(); key != nil && (c.usage+size > limit); key = c.l.Front() {
 			dropKey := key.Value.(ast.Value)
 			c.unsafeDelete(dropKey)
-			c.l.Remove(key)
 			dropped++
 		}
 	}
 
-	c.items[k.String()] = v
-	c.l.PushBack(k)
+	// By deleting the old value, if it exists, we ensure the usage variable stays correct
+	c.unsafeDelete(k)
+
+	c.items[k.String()] = cacheItem{
+		value:      v,
+		keyElement: c.l.PushBack(k),
+	}
 	c.usage += size
 	return dropped
 }
 
-func (c *cache) unsafeGet(k ast.Value) (InterQueryCacheValue, bool) {
+func (c *cache) unsafeGet(k ast.Value) (cacheItem, bool) {
 	value, ok := c.items[k.String()]
 	return value, ok
 }
 
 func (c *cache) unsafeDelete(k ast.Value) {
-	value, ok := c.unsafeGet(k)
+	cacheItem, ok := c.unsafeGet(k)
 	if !ok {
 		return
 	}
 
-	c.usage -= int64(value.SizeInBytes())
+	c.usage -= cacheItem.value.SizeInBytes()
 	delete(c.items, k.String())
+	c.l.Remove(cacheItem.keyElement)
 }
 
 func (c *cache) maxSizeBytes() int64 {
diff --git a/topdown/cache/cache_test.go b/topdown/cache/cache_test.go
index 32a5a68d0a..577c48e60b 100644
--- a/topdown/cache/cache_test.go
+++ b/topdown/cache/cache_test.go
@@ -6,6 +6,7 @@ package cache
 
 import (
 	"reflect"
+	"sync"
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -118,6 +119,96 @@ func TestInsert(t *testing.T) {
 	if found {
 		t.Fatal("Unexpected key \"foo\" in cache")
 	}
+	cacheValue3 := newInterQueryCacheValue(ast.StringTerm("bar3").Value, 10)
+	cache.Insert(ast.StringTerm("foo3").Value, cacheValue3)
+	cacheValue4 := newInterQueryCacheValue(ast.StringTerm("bar4").Value, 10)
+	cache.Insert(ast.StringTerm("foo4").Value, cacheValue4)
+	cacheValue5 := newInterQueryCacheValue(ast.StringTerm("bar5").Value, 20)
+	dropped = cache.Insert(ast.StringTerm("foo5").Value, cacheValue5)
+	if dropped != 2 {
+		t.Fatal("Expected dropped to be two")
+	}
+	_, found = cache.Get(ast.StringTerm("foo3").Value)
+	if found {
+		t.Fatal("Unexpected key \"foo3\" in cache")
+	}
+	_, found = cache.Get(ast.StringTerm("foo4").Value)
+	if found {
+		t.Fatal("Unexpected key \"foo4\" in cache")
+	}
+	_, found = cache.Get(ast.StringTerm("foo5").Value)
+	if !found {
+		t.Fatal("Expected key \"foo5\" in cache")
+	}
+	verifyCacheList(t, cache)
+
+	// replacing an existing key should not affect cache size
+	cache = NewInterQueryCache(config)
+
+	cacheValue6 := newInterQueryCacheValue(ast.String("bar6"), 10)
+	cache.Insert(ast.String("foo6"), cacheValue6)
+	cache.Insert(ast.String("foo6"), cacheValue6)
+	verifyCacheList(t, cache)
+
+	cacheValue7 := newInterQueryCacheValue(ast.String("bar7"), 10)
+	dropped = cache.Insert(ast.StringTerm("foo7").Value, cacheValue7)
+	verifyCacheList(t, cache)
+
+	if dropped != 0 {
+		t.Fatal("Expected dropped to be zero")
+	}
+}
+
+func TestConcurrentInsert(t *testing.T) {
+	in := `{"inter_query_builtin_cache": {"max_size_bytes": 20},}` // 20 byte limit for test purposes
+
+	config, err := ParseCachingConfig([]byte(in))
+	if err != nil {
+		t.Fatalf("Unexpected error %v", err)
+	}
+
+	cache := NewInterQueryCache(config)
+
+	cacheValue := newInterQueryCacheValue(ast.String("bar"), 10)
+	cache.Insert(ast.String("foo"), cacheValue)
+
+	wg := sync.WaitGroup{}
+
+	for i := 0; i < 5; i++ {
+		wg.Add(1)
+
+		go func() {
+			defer wg.Done()
+
+			cacheValue2 := newInterQueryCacheValue(ast.String("bar2"), 5)
+			cache.Insert(ast.String("foo2"), cacheValue2)
+
+		}()
+	}
+	wg.Wait()
+
+	cacheValue3 := newInterQueryCacheValue(ast.String("bar3"), 5)
+	dropped := cache.Insert(ast.String("foo3"), cacheValue3)
+	verifyCacheList(t, cache)
+
+	if dropped != 0 {
+		t.Fatal("Expected dropped to be zero")
+	}
+
+	_, found := cache.Get(ast.String("foo"))
+	if !found {
+		t.Fatal("Expected key \"foo\" in cache")
+	}
+
+	_, found = cache.Get(ast.String("foo2"))
+	if !found {
+		t.Fatal("Expected key \"foo2\" in cache")
+	}
+
+	_, found = cache.Get(ast.String("foo3"))
+	if !found {
+		t.Fatal("Expected key \"foo3\" in cache")
+	}
 }
 
 func TestDelete(t *testing.T) {
@@ -134,6 +225,7 @@ func TestDelete(t *testing.T) {
 	if dropped != 0 {
 		t.Fatal("Expected dropped to be zero")
 	}
+	verifyCacheList(t, cache)
 
 	cache.Delete(ast.StringTerm("foo").Value)
 
@@ -141,6 +233,7 @@ func TestDelete(t *testing.T) {
 	if found {
 		t.Fatal("Unexpected key \"foo\" in cache")
 	}
+	verifyCacheList(t, cache)
 }
 
 func TestUpdateConfig(t *testing.T) {
@@ -181,6 +274,19 @@ func TestDefaultMaxSizeBytes(t *testing.T) {
 	}
 }
 
+// Verifies that the size of c.l is identical to the size of c.items
+// Since the size of c.items is limited by c.usage, this helps us
+// avoid a situation where c.l can grow indefinitely causing a memory leak
+func verifyCacheList(t *testing.T, c InterQueryCache) {
+	actualC, ok := c.(*cache)
+	if !ok {
+		t.Fatal("Unexpected error converting InterQueryCache to cache struct")
+	}
+	if len(actualC.items) != actualC.l.Len() {
+		t.Fatal("actualC.l should contain equally many elements as actualC.items")
+	}
+}
+
 type testInterQueryCacheValue struct {
 	value ast.Value
 	size  int
diff --git a/topdown/cache_bench_test.go b/topdown/cache_bench_test.go
index ea29298f37..2136490257 100644
--- a/topdown/cache_bench_test.go
+++ b/topdown/cache_bench_test.go
@@ -39,7 +39,7 @@ func BenchmarkVirtualCache(b *testing.B) {
 	for i := 0; i < b.N; i++ {
 		idx := i % max
 		cache.Put(keys[idx], values[idx])
-		result := cache.Get(keys[idx])
+		result, _ := cache.Get(keys[idx])
 		if !result.Equal(values[idx]) {
 			b.Fatal("expected equal")
 		}
diff --git a/topdown/cache_test.go b/topdown/cache_test.go
index 7e06f2c687..965c60f77c 100644
--- a/topdown/cache_test.go
+++ b/topdown/cache_test.go
@@ -14,7 +14,7 @@ func TestVirtualCacheCompositeKey(t *testing.T) {
 	cache := newVirtualCache()
 	ref := ast.MustParseRef("data.x.y[[1]].z")
 	cache.Put(ref, ast.BooleanTerm(true))
-	result := cache.Get(ref)
+	result, _ := cache.Get(ref)
 	if !result.Equal(ast.BooleanTerm(true)) {
 		t.Fatalf("Expected true but got %v", result)
 	}
@@ -25,12 +25,24 @@ func TestVirtualCacheInvalidate(t *testing.T) {
 	cache.Push()
 	cache.Put(ast.MustParseRef("data.x.p"), ast.BooleanTerm(true))
 	cache.Pop()
-	result := cache.Get(ast.MustParseRef("data.x.p"))
+	result, _ := cache.Get(ast.MustParseRef("data.x.p"))
 	if result != nil {
 		t.Fatal("Expected nil result but got:", result)
 	}
 }
 
+func TestSetAndRetriveUndefined(t *testing.T) {
+	cache := newVirtualCache()
+	cache.Put(ast.MustParseRef("data.foo.bar"), nil)
+	result, undefined := cache.Get(ast.MustParseRef("data.foo.bar"))
+	if result != nil {
+		t.Fatal("Expected nil result but got:", result)
+	}
+	if !undefined {
+		t.Fatal("Expected 'undefined' flag to be false got true")
+	}
+}
+
 func TestBaseCacheGetExactMatch(t *testing.T) {
 	cache := newBaseCache()
 	cache.Put(ast.MustParseRef("data.x.foo"), ast.StringTerm("bar").Value)
diff --git a/topdown/casts.go b/topdown/casts.go
index c207bfd142..2eb8f97fc9 100644
--- a/topdown/casts.go
+++ b/topdown/casts.go
@@ -11,32 +11,32 @@ import (
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinToNumber(a ast.Value) (ast.Value, error) {
-	switch a := a.(type) {
+func builtinToNumber(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch a := operands[0].Value.(type) {
 	case ast.Null:
-		return ast.Number("0"), nil
+		return iter(ast.NumberTerm("0"))
 	case ast.Boolean:
 		if a {
-			return ast.Number("1"), nil
+			return iter(ast.NumberTerm("1"))
 		}
-		return ast.Number("0"), nil
+		return iter(ast.NumberTerm("0"))
 	case ast.Number:
-		return a, nil
+		return iter(ast.NewTerm(a))
 	case ast.String:
 		_, err := strconv.ParseFloat(string(a), 64)
 		if err != nil {
-			return nil, err
+			return err
 		}
-		return ast.Number(a), nil
+		return iter(ast.NewTerm(ast.Number(a)))
 	}
-	return nil, builtins.NewOperandTypeErr(1, a, "null", "boolean", "number", "string")
+	return builtins.NewOperandTypeErr(1, operands[0].Value, "null", "boolean", "number", "string")
 }
 
 // Deprecated in v0.13.0.
-func builtinToArray(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinToArray(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case *ast.Array:
-		return val, nil
+		return iter(ast.NewTerm(val))
 	case ast.Set:
 		arr := make([]*ast.Term, val.Len())
 		i := 0
@@ -44,74 +44,74 @@ func builtinToArray(a ast.Value) (ast.Value, error) {
 			arr[i] = term
 			i++
 		})
-		return ast.NewArray(arr...), nil
+		return iter(ast.NewTerm(ast.NewArray(arr...)))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "array", "set")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "array", "set")
 	}
 }
 
 // Deprecated in v0.13.0.
-func builtinToSet(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinToSet(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case *ast.Array:
 		s := ast.NewSet()
 		val.Foreach(func(v *ast.Term) {
 			s.Add(v)
 		})
-		return s, nil
+		return iter(ast.NewTerm(s))
 	case ast.Set:
-		return val, nil
+		return iter(ast.NewTerm(val))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "array", "set")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "array", "set")
 	}
 }
 
 // Deprecated in v0.13.0.
-func builtinToString(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinToString(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case ast.String:
-		return val, nil
+		return iter(ast.NewTerm(val))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "string")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "string")
 	}
 }
 
 // Deprecated in v0.13.0.
-func builtinToBoolean(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinToBoolean(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case ast.Boolean:
-		return val, nil
+		return iter(ast.NewTerm(val))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "boolean")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "boolean")
 	}
 }
 
 // Deprecated in v0.13.0.
-func builtinToNull(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinToNull(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case ast.Null:
-		return val, nil
+		return iter(ast.NewTerm(val))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "null")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "null")
 	}
 }
 
 // Deprecated in v0.13.0.
-func builtinToObject(a ast.Value) (ast.Value, error) {
-	switch val := a.(type) {
+func builtinToObject(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch val := operands[0].Value.(type) {
 	case ast.Object:
-		return val, nil
+		return iter(ast.NewTerm(val))
 	default:
-		return nil, builtins.NewOperandTypeErr(1, a, "object")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "object")
 	}
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.ToNumber.Name, builtinToNumber)
-	RegisterFunctionalBuiltin1(ast.CastArray.Name, builtinToArray)
-	RegisterFunctionalBuiltin1(ast.CastSet.Name, builtinToSet)
-	RegisterFunctionalBuiltin1(ast.CastString.Name, builtinToString)
-	RegisterFunctionalBuiltin1(ast.CastBoolean.Name, builtinToBoolean)
-	RegisterFunctionalBuiltin1(ast.CastNull.Name, builtinToNull)
-	RegisterFunctionalBuiltin1(ast.CastObject.Name, builtinToObject)
+	RegisterBuiltinFunc(ast.ToNumber.Name, builtinToNumber)
+	RegisterBuiltinFunc(ast.CastArray.Name, builtinToArray)
+	RegisterBuiltinFunc(ast.CastSet.Name, builtinToSet)
+	RegisterBuiltinFunc(ast.CastString.Name, builtinToString)
+	RegisterBuiltinFunc(ast.CastBoolean.Name, builtinToBoolean)
+	RegisterBuiltinFunc(ast.CastNull.Name, builtinToNull)
+	RegisterBuiltinFunc(ast.CastObject.Name, builtinToObject)
 }
diff --git a/topdown/cidr.go b/topdown/cidr.go
index 2123698c7c..5b011bd161 100644
--- a/topdown/cidr.go
+++ b/topdown/cidr.go
@@ -61,44 +61,44 @@ func getLastIP(cidr *net.IPNet) (net.IP, error) {
 	return lastIP, nil
 }
 
-func builtinNetCIDRIntersects(a, b ast.Value) (ast.Value, error) {
-	cidrnetA, err := getNetFromOperand(a)
+func builtinNetCIDRIntersects(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	cidrnetA, err := getNetFromOperand(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	cidrnetB, err := getNetFromOperand(b)
+	cidrnetB, err := getNetFromOperand(operands[1].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// If either net contains the others starting IP they are overlapping
-	cidrsOverlap := (cidrnetA.Contains(cidrnetB.IP) || cidrnetB.Contains(cidrnetA.IP))
+	cidrsOverlap := cidrnetA.Contains(cidrnetB.IP) || cidrnetB.Contains(cidrnetA.IP)
 
-	return ast.Boolean(cidrsOverlap), nil
+	return iter(ast.BooleanTerm(cidrsOverlap))
 }
 
-func builtinNetCIDRContains(a, b ast.Value) (ast.Value, error) {
-	cidrnetA, err := getNetFromOperand(a)
+func builtinNetCIDRContains(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	cidrnetA, err := getNetFromOperand(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// b could be either an IP addressor CIDR string, try to parse it as an IP first, fall back to CIDR
-	bStr, err := builtins.StringOperand(b, 1)
+	bStr, err := builtins.StringOperand(operands[1].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	ip := net.ParseIP(string(bStr))
 	if ip != nil {
-		return ast.Boolean(cidrnetA.Contains(ip)), nil
+		return iter(ast.BooleanTerm(cidrnetA.Contains(ip)))
 	}
 
 	// It wasn't an IP, try and parse it as a CIDR
-	cidrnetB, err := getNetFromOperand(b)
+	cidrnetB, err := getNetFromOperand(operands[1].Value)
 	if err != nil {
-		return nil, fmt.Errorf("not a valid textual representation of an IP address or CIDR: %s", string(bStr))
+		return fmt.Errorf("not a valid textual representation of an IP address or CIDR: %s", string(bStr))
 	}
 
 	// We can determine if cidr A contains cidr B if and only if A contains
@@ -108,12 +108,12 @@ func builtinNetCIDRContains(a, b ast.Value) (ast.Value, error) {
 		// Only spend time calculating the last IP if the starting IP is already verified to be in cidr A
 		lastIP, err := getLastIP(cidrnetB)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		cidrContained = cidrnetA.Contains(lastIP)
 	}
 
-	return ast.Boolean(cidrContained), nil
+	return iter(ast.BooleanTerm(cidrContained))
 }
 
 var errNetCIDRContainsMatchElementType = errors.New("element must be string or non-empty array")
@@ -167,13 +167,13 @@ func evalNetCIDRContainsMatchesOperand(operand int, a *ast.Term, iter func(cidr,
 	return nil
 }
 
-func builtinNetCIDRContainsMatches(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinNetCIDRContainsMatches(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	result := ast.NewSet()
-	err := evalNetCIDRContainsMatchesOperand(1, args[0], func(cidr1 *ast.Term, index1 *ast.Term) error {
-		return evalNetCIDRContainsMatchesOperand(2, args[1], func(cidr2 *ast.Term, index2 *ast.Term) error {
-			if v, err := builtinNetCIDRContains(cidr1.Value, cidr2.Value); err != nil {
+	err := evalNetCIDRContainsMatchesOperand(1, operands[0], func(cidr1 *ast.Term, index1 *ast.Term) error {
+		return evalNetCIDRContainsMatchesOperand(2, operands[1], func(cidr2 *ast.Term, index2 *ast.Term) error {
+			if v, err := getResult(builtinNetCIDRContains, cidr1, cidr2); err != nil {
 				return err
-			} else if vb, ok := v.(ast.Boolean); ok && bool(vb) {
+			} else if vb, ok := v.Value.(ast.Boolean); ok && bool(vb) {
 				result.Add(ast.ArrayTerm(index1, index2))
 			}
 			return nil
@@ -216,6 +216,18 @@ func builtinNetCIDRExpand(bctx BuiltinContext, operands []*ast.Term, iter func(*
 	return iter(ast.NewTerm(result))
 }
 
+func builtinNetCIDRIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	cidr, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+
+	if _, _, err := net.ParseCIDR(string(cidr)); err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+	return iter(ast.BooleanTerm(true))
+}
+
 type cidrBlockRange struct {
 	First   *net.IP
 	Last    *net.IP
@@ -257,7 +269,7 @@ func (c cidrBlockRanges) Less(i, j int) bool {
 // builtinNetCIDRMerge merges the provided list of IP addresses and subnets into the smallest possible list of CIDRs.
 // It merges adjacent subnets where possible, those contained within others and also removes any duplicates.
 // Original Algorithm: https://github.com/netaddr/netaddr.
-func builtinNetCIDRMerge(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+func builtinNetCIDRMerge(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	networks := []*net.IPNet{}
 
 	switch v := operands[0].Value.(type) {
@@ -300,7 +312,7 @@ func evalNetCIDRMerge(networks []*net.IPNet) []*net.IPNet {
 		return nil
 	}
 
-	var ranges cidrBlockRanges
+	ranges := make(cidrBlockRanges, 0, len(networks))
 
 	// For each CIDR, create an IP range. Sort them and merge when possible.
 	for _, network := range networks {
@@ -332,25 +344,25 @@ func evalNetCIDRMerge(networks []*net.IPNet) []*net.IPNet {
 }
 
 func generateIPNet(term *ast.Term) (*net.IPNet, error) {
-	switch e := term.Value.(type) {
-	case ast.String:
-		network := &net.IPNet{}
-		// try to parse element as an IP first, fall back to CIDR
-		ip := net.ParseIP(string(e))
-		if ip != nil {
-			network.IP = ip
-			network.Mask = ip.DefaultMask()
-		} else {
-			var err error
-			_, network, err = net.ParseCIDR(string(e))
-			if err != nil {
-				return nil, err
-			}
-		}
-		return network, nil
-	default:
+	e, ok := term.Value.(ast.String)
+	if !ok {
 		return nil, errors.New("element must be string")
 	}
+
+	// try to parse element as an IP first, fall back to CIDR
+	ip := net.ParseIP(string(e))
+	if ip == nil {
+		_, network, err := net.ParseCIDR(string(e))
+		return network, err
+	}
+
+	if ip.To4() != nil {
+		return &net.IPNet{
+			IP:   ip,
+			Mask: ip.DefaultMask(),
+		}, nil
+	}
+	return nil, errors.New("IPv6 invalid: needs prefix length")
 }
 
 func mergeCIDRs(ranges cidrBlockRanges) cidrBlockRanges {
@@ -396,10 +408,11 @@ func incIP(ip net.IP) {
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.NetCIDROverlap.Name, builtinNetCIDRContains)
-	RegisterFunctionalBuiltin2(ast.NetCIDRIntersects.Name, builtinNetCIDRIntersects)
-	RegisterFunctionalBuiltin2(ast.NetCIDRContains.Name, builtinNetCIDRContains)
+	RegisterBuiltinFunc(ast.NetCIDROverlap.Name, builtinNetCIDRContains)
+	RegisterBuiltinFunc(ast.NetCIDRIntersects.Name, builtinNetCIDRIntersects)
+	RegisterBuiltinFunc(ast.NetCIDRContains.Name, builtinNetCIDRContains)
 	RegisterBuiltinFunc(ast.NetCIDRContainsMatches.Name, builtinNetCIDRContainsMatches)
 	RegisterBuiltinFunc(ast.NetCIDRExpand.Name, builtinNetCIDRExpand)
 	RegisterBuiltinFunc(ast.NetCIDRMerge.Name, builtinNetCIDRMerge)
+	RegisterBuiltinFunc(ast.NetCIDRIsValid.Name, builtinNetCIDRIsValid)
 }
diff --git a/topdown/cidr_test.go b/topdown/cidr_test.go
index bfbfacdd63..1bbabeaa73 100644
--- a/topdown/cidr_test.go
+++ b/topdown/cidr_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 )
 
 func TestNetCIDRExpandCancellation(t *testing.T) {
@@ -22,7 +22,7 @@ func TestNetCIDRExpandCancellation(t *testing.T) {
 		`,
 	})
 
-	store := inmem.NewFromObject(map[string]interface{}{})
+	store := inmem.New()
 	txn := storage.NewTransactionOrDie(ctx, store)
 	cancel := NewCancel()
 
diff --git a/topdown/comparison.go b/topdown/comparison.go
index 96be984ac4..0d033d2c32 100644
--- a/topdown/comparison.go
+++ b/topdown/comparison.go
@@ -32,17 +32,17 @@ func compareEq(a, b ast.Value) bool {
 	return ast.Compare(a, b) == 0
 }
 
-func builtinCompare(cmp compareFunc) FunctionalBuiltin2 {
-	return func(a, b ast.Value) (ast.Value, error) {
-		return ast.Boolean(cmp(a, b)), nil
+func builtinCompare(cmp compareFunc) BuiltinFunc {
+	return func(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		return iter(ast.BooleanTerm(cmp(operands[0].Value, operands[1].Value)))
 	}
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.GreaterThan.Name, builtinCompare(compareGreaterThan))
-	RegisterFunctionalBuiltin2(ast.GreaterThanEq.Name, builtinCompare(compareGreaterThanEq))
-	RegisterFunctionalBuiltin2(ast.LessThan.Name, builtinCompare(compareLessThan))
-	RegisterFunctionalBuiltin2(ast.LessThanEq.Name, builtinCompare(compareLessThanEq))
-	RegisterFunctionalBuiltin2(ast.NotEqual.Name, builtinCompare(compareNotEq))
-	RegisterFunctionalBuiltin2(ast.Equal.Name, builtinCompare(compareEq))
+	RegisterBuiltinFunc(ast.GreaterThan.Name, builtinCompare(compareGreaterThan))
+	RegisterBuiltinFunc(ast.GreaterThanEq.Name, builtinCompare(compareGreaterThanEq))
+	RegisterBuiltinFunc(ast.LessThan.Name, builtinCompare(compareLessThan))
+	RegisterBuiltinFunc(ast.LessThanEq.Name, builtinCompare(compareLessThanEq))
+	RegisterBuiltinFunc(ast.NotEqual.Name, builtinCompare(compareNotEq))
+	RegisterBuiltinFunc(ast.Equal.Name, builtinCompare(compareEq))
 }
diff --git a/topdown/copypropagation/copypropagation.go b/topdown/copypropagation/copypropagation.go
index 2dee16f09c..4c6b8c42c7 100644
--- a/topdown/copypropagation/copypropagation.go
+++ b/topdown/copypropagation/copypropagation.go
@@ -5,6 +5,7 @@
 package copypropagation
 
 import (
+	"fmt"
 	"sort"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -31,6 +32,18 @@ type CopyPropagator struct {
 	sorted             []ast.Var  // sorted copy of vars to ensure deterministic result
 	ensureNonEmptyBody bool
 	compiler           *ast.Compiler
+	localvargen        *localVarGenerator
+}
+
+type localVarGenerator struct {
+	next int
+}
+
+func (l *localVarGenerator) Generate() ast.Var {
+	result := ast.Var(fmt.Sprintf("__localcp%d__", l.next))
+	l.next++
+	return result
+
 }
 
 // New returns a new CopyPropagator that optimizes queries while preserving vars
@@ -46,7 +59,7 @@ func New(livevars ast.VarSet) *CopyPropagator {
 		return sorted[i].Compare(sorted[j]) < 0
 	})
 
-	return &CopyPropagator{livevars: livevars, sorted: sorted}
+	return &CopyPropagator{livevars: livevars, sorted: sorted, localvargen: &localVarGenerator{}}
 }
 
 // WithEnsureNonEmptyBody configures p to ensure that results are always non-empty.
@@ -166,7 +179,16 @@ func (p *CopyPropagator) Apply(query ast.Body) ast.Body {
 			providesSafety = true
 		}
 
-		if providesSafety || !containedIn(b.v, result) {
+		safevarRef := false // don't add something like `_ = input`
+		if r, ok := b.v.(ast.Ref); ok {
+			if len(r) == 1 {
+				if v, ok := r[0].Value.(ast.Var); ok {
+					safevarRef = safe.Contains(v)
+				}
+			}
+		}
+
+		if providesSafety || (!safevarRef && !containedIn(b.v, result)) {
 			result.Append(removedEq)
 			safe.Update(outputVars)
 		}
@@ -282,12 +304,16 @@ func (t bindingPlugTransform) plugBindingsRef(pctx *plugContext, v ast.Ref) ast.
 // updateBindings returns false if the expression can be killed. If the
 // expression is killed, the binding list is updated to map a var to value.
 func (p *CopyPropagator) updateBindings(pctx *plugContext, expr *ast.Expr) bool {
-	if pctx.negated || len(expr.With) > 0 {
+	switch {
+	case pctx.negated || len(expr.With) > 0:
 		return true
-	}
-	if expr.IsEquality() {
+
+	case expr.IsEquality():
 		a, b := expr.Operand(0), expr.Operand(1)
 		if a.Equal(b) {
+			if p.livevarRef(a) {
+				pctx.removedEqs.Put(p.localvargen.Generate(), a.Value)
+			}
 			return false
 		}
 		k, v, keep := p.updateBindingsEq(a, b)
@@ -297,7 +323,8 @@ func (p *CopyPropagator) updateBindings(pctx *plugContext, expr *ast.Expr) bool
 			}
 			return false
 		}
-	} else if expr.IsCall() {
+
+	case expr.IsCall():
 		terms := expr.Terms.([]*ast.Term)
 		if p.compiler.GetArity(expr.Operator()) == len(terms)-2 { // with captured output
 			output := terms[len(terms)-1]
@@ -310,6 +337,21 @@ func (p *CopyPropagator) updateBindings(pctx *plugContext, expr *ast.Expr) bool
 	return !isNoop(expr)
 }
 
+func (p *CopyPropagator) livevarRef(a *ast.Term) bool {
+	ref, ok := a.Value.(ast.Ref)
+	if !ok {
+		return false
+	}
+
+	for _, v := range p.sorted {
+		if ref[0].Value.Compare(v) == 0 {
+			return true
+		}
+	}
+
+	return false
+}
+
 func (p *CopyPropagator) updateBindingsEq(a, b *ast.Term) (ast.Var, ast.Value, bool) {
 	k, v, keep := p.updateBindingsEqAsymmetric(a, b)
 	if !keep {
@@ -340,30 +382,42 @@ type plugContext struct {
 }
 
 type binding struct {
-	k ast.Value
-	v ast.Value
+	k, v ast.Value
 }
 
 func containedIn(value ast.Value, x interface{}) bool {
 	var stop bool
-	switch v := value.(type) {
-	case ast.Ref:
-		ast.WalkRefs(x, func(other ast.Ref) bool {
-			if stop || other.HasPrefix(v) {
+
+	var vis *ast.GenericVisitor
+	vis = ast.NewGenericVisitor(func(x interface{}) bool {
+		switch x := x.(type) {
+		case *ast.Every: // skip body
+			vis.Walk(x.Key)
+			vis.Walk(x.Value)
+			vis.Walk(x.Domain)
+			return true
+		case *ast.ArrayComprehension, *ast.ObjectComprehension, *ast.SetComprehension: // skip
+			return true
+		case ast.Ref:
+			var match bool
+			if v, ok := value.(ast.Ref); ok {
+				match = x.HasPrefix(v)
+			} else {
+				match = x.Compare(value) == 0
+			}
+			if stop || match {
 				stop = true
 				return stop
 			}
-			return false
-		})
-	default:
-		ast.WalkTerms(x, func(other *ast.Term) bool {
-			if stop || other.Value.Compare(v) == 0 {
+		case ast.Value:
+			if stop || x.Compare(value) == 0 {
 				stop = true
 				return stop
 			}
-			return false
-		})
-	}
+		}
+		return stop
+	})
+	vis.Walk(x)
 	return stop
 }
 
@@ -374,7 +428,7 @@ func sortbindings(bindings *ast.ValueMap) []*binding {
 		return false
 	})
 	sort.Slice(sorted, func(i, j int) bool {
-		return sorted[i].k.Compare(sorted[j].k) < 0
+		return sorted[i].k.Compare(sorted[j].k) > 0
 	})
 	return sorted
 }
@@ -397,17 +451,21 @@ func makeDisjointSets(livevars ast.VarSet, query ast.Body) (*unionFind, bool) {
 			a, b := expr.Operand(0), expr.Operand(1)
 			varA, ok1 := a.Value.(ast.Var)
 			varB, ok2 := b.Value.(ast.Var)
-			if ok1 && ok2 {
+
+			switch {
+			case ok1 && ok2:
 				if _, ok := uf.Merge(varA, varB); !ok {
 					return nil, false
 				}
-			} else if ok1 && ast.IsConstant(b.Value) {
+
+			case ok1 && ast.IsConstant(b.Value):
 				root := uf.MakeSet(varA)
 				if root.constant != nil && !root.constant.Equal(b) {
 					return nil, false
 				}
 				root.constant = b
-			} else if ok2 && ast.IsConstant(a.Value) {
+
+			case ok2 && ast.IsConstant(a.Value):
 				root := uf.MakeSet(varB)
 				if root.constant != nil && !root.constant.Equal(a) {
 					return nil, false
@@ -422,7 +480,7 @@ func makeDisjointSets(livevars ast.VarSet, query ast.Body) (*unionFind, bool) {
 
 func isNoop(expr *ast.Expr) bool {
 
-	if !expr.IsCall() {
+	if !expr.IsCall() && !expr.IsEvery() {
 		term := expr.Terms.(*ast.Term)
 		if !ast.IsConstant(term.Value) {
 			return false
diff --git a/topdown/crypto.go b/topdown/crypto.go
index 2b5a96eaff..b9b3816af2 100644
--- a/topdown/crypto.go
+++ b/topdown/crypto.go
@@ -17,7 +17,6 @@ import (
 	"encoding/pem"
 	"fmt"
 	"hash"
-	"io/ioutil"
 	"os"
 	"strings"
 
@@ -42,24 +41,28 @@ const (
 	blockTypePrivateKey = "PRIVATE KEY"
 )
 
-func builtinCryptoX509ParseCertificates(a ast.Value) (ast.Value, error) {
-	input, err := builtins.StringOperand(a, 1)
+func builtinCryptoX509ParseCertificates(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	input, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	certs, err := getX509CertsFromString(string(input))
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.InterfaceToValue(certs)
+	v, err := ast.InterfaceToValue(certs)
+	if err != nil {
+		return err
+	}
+
+	return iter(ast.NewTerm(v))
 }
 
-func builtinCryptoX509ParseAndVerifyCertificates(
-	_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinCryptoX509ParseAndVerifyCertificates(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	a := args[0].Value
+	a := operands[0].Value
 	input, err := builtins.StringOperand(a, 1)
 	if err != nil {
 		return err
@@ -93,11 +96,10 @@ func builtinCryptoX509ParseAndVerifyCertificates(
 	return iter(valid)
 }
 
-func builtinCryptoX509ParseCertificateRequest(a ast.Value) (ast.Value, error) {
-
-	input, err := builtins.StringOperand(a, 1)
+func builtinCryptoX509ParseCertificateRequest(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	input, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// data to be passed to x509.ParseCertificateRequest
@@ -107,13 +109,13 @@ func builtinCryptoX509ParseCertificateRequest(a ast.Value) (ast.Value, error) {
 	if str := string(input); !strings.HasPrefix(str, "-----BEGIN CERTIFICATE REQUEST-----") {
 		bytes, err = base64.StdEncoding.DecodeString(str)
 		if err != nil {
-			return nil, err
+			return err
 		}
 	}
 
 	p, _ := pem.Decode(bytes)
 	if p != nil && p.Type != blockTypeCertificateRequest {
-		return nil, fmt.Errorf("invalid PEM-encoded certificate signing request")
+		return fmt.Errorf("invalid PEM-encoded certificate signing request")
 	}
 	if p != nil {
 		bytes = p.Bytes
@@ -121,24 +123,30 @@ func builtinCryptoX509ParseCertificateRequest(a ast.Value) (ast.Value, error) {
 
 	csr, err := x509.ParseCertificateRequest(bytes)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	bs, err := json.Marshal(csr)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	var x interface{}
 	if err := util.UnmarshalJSON(bs, &x); err != nil {
-		return nil, err
+		return err
+	}
+
+	v, err := ast.InterfaceToValue(x)
+	if err != nil {
+		return err
 	}
-	return ast.InterfaceToValue(x)
+
+	return iter(ast.NewTerm(v))
 }
 
-func builtinCryptoX509ParseRSAPrivateKey(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinCryptoX509ParseRSAPrivateKey(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	a := args[0].Value
+	a := operands[0].Value
 	input, err := builtins.StringOperand(a, 1)
 	if err != nil {
 		return err
@@ -181,26 +189,38 @@ func hashHelper(a ast.Value, h func(ast.String) string) (ast.Value, error) {
 	return ast.String(h(s)), nil
 }
 
-func builtinCryptoMd5(a ast.Value) (ast.Value, error) {
-	return hashHelper(a, func(s ast.String) string { return fmt.Sprintf("%x", md5.Sum([]byte(s))) })
+func builtinCryptoMd5(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	res, err := hashHelper(operands[0].Value, func(s ast.String) string { return fmt.Sprintf("%x", md5.Sum([]byte(s))) })
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(res))
 }
 
-func builtinCryptoSha1(a ast.Value) (ast.Value, error) {
-	return hashHelper(a, func(s ast.String) string { return fmt.Sprintf("%x", sha1.Sum([]byte(s))) })
+func builtinCryptoSha1(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	res, err := hashHelper(operands[0].Value, func(s ast.String) string { return fmt.Sprintf("%x", sha1.Sum([]byte(s))) })
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(res))
 }
 
-func builtinCryptoSha256(a ast.Value) (ast.Value, error) {
-	return hashHelper(a, func(s ast.String) string { return fmt.Sprintf("%x", sha256.Sum256([]byte(s))) })
+func builtinCryptoSha256(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	res, err := hashHelper(operands[0].Value, func(s ast.String) string { return fmt.Sprintf("%x", sha256.Sum256([]byte(s))) })
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(res))
 }
 
-func hmacHelper(args []*ast.Term, iter func(*ast.Term) error, h func() hash.Hash) error {
-	a1 := args[0].Value
+func hmacHelper(operands []*ast.Term, iter func(*ast.Term) error, h func() hash.Hash) error {
+	a1 := operands[0].Value
 	message, err := builtins.StringOperand(a1, 1)
 	if err != nil {
 		return err
 	}
 
-	a2 := args[1].Value
+	a2 := operands[1].Value
 	key, err := builtins.StringOperand(a2, 2)
 	if err != nil {
 		return err
@@ -213,34 +233,53 @@ func hmacHelper(args []*ast.Term, iter func(*ast.Term) error, h func() hash.Hash
 	return iter(ast.StringTerm(fmt.Sprintf("%x", messageDigest)))
 }
 
-func builtinCryptoHmacMd5(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	return hmacHelper(args, iter, md5.New)
+func builtinCryptoHmacMd5(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	return hmacHelper(operands, iter, md5.New)
 }
 
-func builtinCryptoHmacSha1(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	return hmacHelper(args, iter, sha1.New)
+func builtinCryptoHmacSha1(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	return hmacHelper(operands, iter, sha1.New)
 }
 
-func builtinCryptoHmacSha256(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	return hmacHelper(args, iter, sha256.New)
+func builtinCryptoHmacSha256(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	return hmacHelper(operands, iter, sha256.New)
 }
 
-func builtinCryptoHmacSha512(_ BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	return hmacHelper(args, iter, sha512.New)
+func builtinCryptoHmacSha512(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	return hmacHelper(operands, iter, sha512.New)
+}
+
+func builtinCryptoHmacEqual(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	a1 := operands[0].Value
+	mac1, err := builtins.StringOperand(a1, 1)
+	if err != nil {
+		return err
+	}
+
+	a2 := operands[1].Value
+	mac2, err := builtins.StringOperand(a2, 2)
+	if err != nil {
+		return err
+	}
+
+	res := hmac.Equal([]byte(mac1), []byte(mac2))
+
+	return iter(ast.BooleanTerm(res))
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.CryptoX509ParseCertificates.Name, builtinCryptoX509ParseCertificates)
+	RegisterBuiltinFunc(ast.CryptoX509ParseCertificates.Name, builtinCryptoX509ParseCertificates)
 	RegisterBuiltinFunc(ast.CryptoX509ParseAndVerifyCertificates.Name, builtinCryptoX509ParseAndVerifyCertificates)
-	RegisterFunctionalBuiltin1(ast.CryptoMd5.Name, builtinCryptoMd5)
-	RegisterFunctionalBuiltin1(ast.CryptoSha1.Name, builtinCryptoSha1)
-	RegisterFunctionalBuiltin1(ast.CryptoSha256.Name, builtinCryptoSha256)
-	RegisterFunctionalBuiltin1(ast.CryptoX509ParseCertificateRequest.Name, builtinCryptoX509ParseCertificateRequest)
+	RegisterBuiltinFunc(ast.CryptoMd5.Name, builtinCryptoMd5)
+	RegisterBuiltinFunc(ast.CryptoSha1.Name, builtinCryptoSha1)
+	RegisterBuiltinFunc(ast.CryptoSha256.Name, builtinCryptoSha256)
+	RegisterBuiltinFunc(ast.CryptoX509ParseCertificateRequest.Name, builtinCryptoX509ParseCertificateRequest)
 	RegisterBuiltinFunc(ast.CryptoX509ParseRSAPrivateKey.Name, builtinCryptoX509ParseRSAPrivateKey)
 	RegisterBuiltinFunc(ast.CryptoHmacMd5.Name, builtinCryptoHmacMd5)
 	RegisterBuiltinFunc(ast.CryptoHmacSha1.Name, builtinCryptoHmacSha1)
 	RegisterBuiltinFunc(ast.CryptoHmacSha256.Name, builtinCryptoHmacSha256)
 	RegisterBuiltinFunc(ast.CryptoHmacSha512.Name, builtinCryptoHmacSha512)
+	RegisterBuiltinFunc(ast.CryptoHmacEqual.Name, builtinCryptoHmacEqual)
 }
 
 func verifyX509CertificateChain(certs []*x509.Certificate) ([]*x509.Certificate, error) {
@@ -386,7 +425,7 @@ func addCACertsFromBytes(pool *x509.CertPool, pemBytes []byte) (*x509.CertPool,
 	return pool, nil
 }
 
-// addCACertsFromBytes adds CA certificates from the environment variable named
+// addCACertsFromEnv adds CA certificates from the environment variable named
 // by envName into the given pool. If pool is nil, it creates a new x509.CertPool.
 // pool is returned.
 func addCACertsFromEnv(pool *x509.CertPool, envName string) (*x509.CertPool, error) {
@@ -401,7 +440,7 @@ func addCACertsFromEnv(pool *x509.CertPool, envName string) (*x509.CertPool, err
 // ReadCertFromFile reads a cert from file
 func readCertFromFile(localCertFile string) ([]byte, error) {
 	// Read in the cert file
-	certPEM, err := ioutil.ReadFile(localCertFile)
+	certPEM, err := os.ReadFile(localCertFile)
 	if err != nil {
 		return nil, err
 	}
@@ -411,7 +450,7 @@ func readCertFromFile(localCertFile string) ([]byte, error) {
 // ReadKeyFromFile reads a key from file
 func readKeyFromFile(localKeyFile string) ([]byte, error) {
 	// Read in the cert file
-	key, err := ioutil.ReadFile(localKeyFile)
+	key, err := os.ReadFile(localKeyFile)
 	if err != nil {
 		return nil, err
 	}
diff --git a/topdown/encoding.go b/topdown/encoding.go
index fa1cfc8838..f2129d8cd0 100644
--- a/topdown/encoding.go
+++ b/topdown/encoding.go
@@ -20,99 +20,103 @@ import (
 	"github.com/open-policy-agent/opa/util"
 )
 
-func builtinJSONMarshal(a ast.Value) (ast.Value, error) {
+func builtinJSONMarshal(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	asJSON, err := ast.JSON(a)
+	asJSON, err := ast.JSON(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	bs, err := json.Marshal(asJSON)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(string(bs)), nil
+	return iter(ast.StringTerm(string(bs)))
 }
 
-func builtinJSONUnmarshal(a ast.Value) (ast.Value, error) {
+func builtinJSONUnmarshal(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	str, err := builtins.StringOperand(a, 1)
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	var x interface{}
 
 	if err := util.UnmarshalJSON([]byte(str), &x); err != nil {
-		return nil, err
+		return err
 	}
-
-	return ast.InterfaceToValue(x)
+	v, err := ast.InterfaceToValue(x)
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(v))
 }
 
-func builtinJSONIsValid(a ast.Value) (ast.Value, error) {
+func builtinJSONIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	str, err := builtins.StringOperand(a, 1)
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return iter(ast.BooleanTerm(false))
 	}
 
-	var x interface{}
-	err = util.UnmarshalJSON([]byte(str), &x)
-	return ast.Boolean(err == nil), nil
+	return iter(ast.BooleanTerm(json.Valid([]byte(str))))
 }
 
-func builtinBase64Encode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinBase64Encode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(base64.StdEncoding.EncodeToString([]byte(str))), nil
+	return iter(ast.StringTerm(base64.StdEncoding.EncodeToString([]byte(str))))
 }
 
-func builtinBase64Decode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinBase64Decode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	result, err := base64.StdEncoding.DecodeString(string(str))
-	return ast.String(result), err
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(ast.String(result)))
 }
 
-func builtinBase64IsValid(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinBase64IsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return iter(ast.BooleanTerm(false))
 	}
 
 	_, err = base64.StdEncoding.DecodeString(string(str))
-	return ast.Boolean(err == nil), nil
+	return iter(ast.BooleanTerm(err == nil))
 }
 
-func builtinBase64UrlEncode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinBase64UrlEncode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(base64.URLEncoding.EncodeToString([]byte(str))), nil
+	return iter(ast.StringTerm(base64.URLEncoding.EncodeToString([]byte(str))))
 }
 
-func builtinBase64UrlEncodeNoPad(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinBase64UrlEncodeNoPad(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.String(base64.RawURLEncoding.EncodeToString([]byte(str))), nil
+	return iter(ast.StringTerm(base64.RawURLEncoding.EncodeToString([]byte(str))))
 }
 
-func builtinBase64UrlDecode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinBase64UrlDecode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	s := string(str)
 
@@ -127,44 +131,47 @@ func builtinBase64UrlDecode(a ast.Value) (ast.Value, error) {
 		case 3:
 			s += "="
 		default:
-			return nil, fmt.Errorf("illegal base64url string: %s", s)
+			return fmt.Errorf("illegal base64url string: %s", s)
 		}
 	}
 	result, err := base64.URLEncoding.DecodeString(s)
-	return ast.String(result), err
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(ast.String(result)))
 }
 
-func builtinURLQueryEncode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinURLQueryEncode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.String(url.QueryEscape(string(str))), nil
+	return iter(ast.StringTerm(url.QueryEscape(string(str))))
 }
 
-func builtinURLQueryDecode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinURLQueryDecode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	s, err := url.QueryUnescape(string(str))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.String(s), nil
+	return iter(ast.StringTerm(s))
 }
 
 var encodeObjectErr = builtins.NewOperandErr(1, "values must be string, array[string], or set[string]")
 
-func builtinURLQueryEncodeObject(a ast.Value) (ast.Value, error) {
-	asJSON, err := ast.JSON(a)
+func builtinURLQueryEncodeObject(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	asJSON, err := ast.JSON(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	inputs, ok := asJSON.(map[string]interface{})
 	if !ok {
-		return nil, builtins.NewOperandTypeErr(1, a, "object")
+		return builtins.NewOperandTypeErr(1, operands[0].Value, "object")
 	}
 
 	query := url.Values{}
@@ -177,19 +184,19 @@ func builtinURLQueryEncodeObject(a ast.Value) (ast.Value, error) {
 			for _, val := range vv {
 				strVal, ok := val.(string)
 				if !ok {
-					return nil, encodeObjectErr
+					return encodeObjectErr
 				}
 				query.Add(k, strVal)
 			}
 		default:
-			return nil, encodeObjectErr
+			return encodeObjectErr
 		}
 	}
 
-	return ast.String(query.Encode()), nil
+	return iter(ast.StringTerm(query.Encode()))
 }
 
-func builtinURLQueryDecodeObject(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+func builtinURLQueryDecodeObject(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	query, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return err
@@ -212,37 +219,37 @@ func builtinURLQueryDecodeObject(bctx BuiltinContext, operands []*ast.Term, iter
 	return iter(ast.NewTerm(queryObject))
 }
 
-func builtinYAMLMarshal(a ast.Value) (ast.Value, error) {
+func builtinYAMLMarshal(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	asJSON, err := ast.JSON(a)
+	asJSON, err := ast.JSON(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	var buf bytes.Buffer
 	encoder := json.NewEncoder(&buf)
 	if err := encoder.Encode(asJSON); err != nil {
-		return nil, err
+		return err
 	}
 
 	bs, err := ghodss.JSONToYAML(buf.Bytes())
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(string(bs)), nil
+	return iter(ast.StringTerm(string(bs)))
 }
 
-func builtinYAMLUnmarshal(a ast.Value) (ast.Value, error) {
+func builtinYAMLUnmarshal(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	str, err := builtins.StringOperand(a, 1)
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	bs, err := ghodss.YAMLToJSON([]byte(str))
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	buf := bytes.NewBuffer(bs)
@@ -250,60 +257,63 @@ func builtinYAMLUnmarshal(a ast.Value) (ast.Value, error) {
 	var val interface{}
 	err = decoder.Decode(&val)
 	if err != nil {
-		return nil, err
+		return err
 	}
-
-	return ast.InterfaceToValue(val)
+	v, err := ast.InterfaceToValue(val)
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(v))
 }
 
-func builtinYAMLIsValid(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinYAMLIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return iter(ast.BooleanTerm(false))
 	}
 
 	var x interface{}
 	err = ghodss.Unmarshal([]byte(str), &x)
-	return ast.Boolean(err == nil), nil
+	return iter(ast.BooleanTerm(err == nil))
 }
 
-func builtinHexEncode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinHexEncode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.String(hex.EncodeToString([]byte(str))), nil
+	return iter(ast.StringTerm(hex.EncodeToString([]byte(str))))
 }
 
-func builtinHexDecode(a ast.Value) (ast.Value, error) {
-	str, err := builtins.StringOperand(a, 1)
+func builtinHexDecode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	val, err := hex.DecodeString(string(str))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.String(val), nil
+	return iter(ast.NewTerm(ast.String(val)))
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.JSONMarshal.Name, builtinJSONMarshal)
-	RegisterFunctionalBuiltin1(ast.JSONUnmarshal.Name, builtinJSONUnmarshal)
-	RegisterFunctionalBuiltin1(ast.JSONIsValid.Name, builtinJSONIsValid)
-	RegisterFunctionalBuiltin1(ast.Base64Encode.Name, builtinBase64Encode)
-	RegisterFunctionalBuiltin1(ast.Base64Decode.Name, builtinBase64Decode)
-	RegisterFunctionalBuiltin1(ast.Base64IsValid.Name, builtinBase64IsValid)
-	RegisterFunctionalBuiltin1(ast.Base64UrlEncode.Name, builtinBase64UrlEncode)
-	RegisterFunctionalBuiltin1(ast.Base64UrlEncodeNoPad.Name, builtinBase64UrlEncodeNoPad)
-	RegisterFunctionalBuiltin1(ast.Base64UrlDecode.Name, builtinBase64UrlDecode)
-	RegisterFunctionalBuiltin1(ast.URLQueryDecode.Name, builtinURLQueryDecode)
-	RegisterFunctionalBuiltin1(ast.URLQueryEncode.Name, builtinURLQueryEncode)
-	RegisterFunctionalBuiltin1(ast.URLQueryEncodeObject.Name, builtinURLQueryEncodeObject)
+	RegisterBuiltinFunc(ast.JSONMarshal.Name, builtinJSONMarshal)
+	RegisterBuiltinFunc(ast.JSONUnmarshal.Name, builtinJSONUnmarshal)
+	RegisterBuiltinFunc(ast.JSONIsValid.Name, builtinJSONIsValid)
+	RegisterBuiltinFunc(ast.Base64Encode.Name, builtinBase64Encode)
+	RegisterBuiltinFunc(ast.Base64Decode.Name, builtinBase64Decode)
+	RegisterBuiltinFunc(ast.Base64IsValid.Name, builtinBase64IsValid)
+	RegisterBuiltinFunc(ast.Base64UrlEncode.Name, builtinBase64UrlEncode)
+	RegisterBuiltinFunc(ast.Base64UrlEncodeNoPad.Name, builtinBase64UrlEncodeNoPad)
+	RegisterBuiltinFunc(ast.Base64UrlDecode.Name, builtinBase64UrlDecode)
+	RegisterBuiltinFunc(ast.URLQueryDecode.Name, builtinURLQueryDecode)
+	RegisterBuiltinFunc(ast.URLQueryEncode.Name, builtinURLQueryEncode)
+	RegisterBuiltinFunc(ast.URLQueryEncodeObject.Name, builtinURLQueryEncodeObject)
 	RegisterBuiltinFunc(ast.URLQueryDecodeObject.Name, builtinURLQueryDecodeObject)
-	RegisterFunctionalBuiltin1(ast.YAMLMarshal.Name, builtinYAMLMarshal)
-	RegisterFunctionalBuiltin1(ast.YAMLUnmarshal.Name, builtinYAMLUnmarshal)
-	RegisterFunctionalBuiltin1(ast.YAMLIsValid.Name, builtinYAMLIsValid)
-	RegisterFunctionalBuiltin1(ast.HexEncode.Name, builtinHexEncode)
-	RegisterFunctionalBuiltin1(ast.HexDecode.Name, builtinHexDecode)
+	RegisterBuiltinFunc(ast.YAMLMarshal.Name, builtinYAMLMarshal)
+	RegisterBuiltinFunc(ast.YAMLUnmarshal.Name, builtinYAMLUnmarshal)
+	RegisterBuiltinFunc(ast.YAMLIsValid.Name, builtinYAMLIsValid)
+	RegisterBuiltinFunc(ast.HexEncode.Name, builtinHexEncode)
+	RegisterBuiltinFunc(ast.HexDecode.Name, builtinHexDecode)
 }
diff --git a/topdown/eval.go b/topdown/eval.go
index 3dbe15db51..1072c95c06 100644
--- a/topdown/eval.go
+++ b/topdown/eval.go
@@ -15,6 +15,8 @@ import (
 	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/copypropagation"
 	"github.com/open-policy-agent/opa/topdown/print"
+	"github.com/open-policy-agent/opa/tracing"
+	"github.com/open-policy-agent/opa/types"
 )
 
 type evalIterator func(*eval) error
@@ -72,10 +74,13 @@ type eval struct {
 	targetStack            *refStack
 	tracers                []QueryTracer
 	traceEnabled           bool
+	traceLastLocation      *ast.Location // Last location of a trace event.
 	plugTraceVars          bool
 	instr                  *Instrumentation
 	builtins               map[string]*Builtin
 	builtinCache           builtins.Cache
+	ndBuiltinCache         builtins.NDBCache
+	functionMocks          *functionMocksStack
 	virtualCache           *virtualCache
 	comprehensionCache     *comprehensionCache
 	interQueryBuiltinCache cache.InterQueryCache
@@ -90,7 +95,9 @@ type eval struct {
 	runtime                *ast.Term
 	builtinErrors          *builtinErrors
 	printHook              print.Hook
+	tracingOpts            tracing.Options
 	findOne                bool
+	strictObjects          bool
 }
 
 func (e *eval) Run(iter evalIterator) error {
@@ -232,14 +239,23 @@ func (e *eval) traceEvent(op Op, x ast.Node, msg string, target *ast.Ref) {
 		parentID = e.parent.queryID
 	}
 
+	location := x.Loc()
+	if location == nil {
+		location = e.traceLastLocation
+	} else {
+		e.traceLastLocation = location
+	}
+
 	evt := Event{
 		QueryID:  e.queryID,
 		ParentID: parentID,
 		Op:       op,
 		Node:     x,
-		Location: x.Loc(),
+		Location: location,
 		Message:  msg,
 		Ref:      target,
+		input:    e.input,
+		bindings: e.bindings,
 	}
 
 	// Skip plugging the local variables, unless any of the tracers
@@ -314,7 +330,6 @@ func (e *eval) evalExpr(iter evalIterator) error {
 		}
 		return nil
 	}
-
 	expr := e.query[e.index]
 
 	e.traceEval(expr)
@@ -338,17 +353,17 @@ func (e *eval) evalStep(iter evalIterator) error {
 
 	var defined bool
 	var err error
-
 	switch terms := expr.Terms.(type) {
 	case []*ast.Term:
-		if expr.IsEquality() {
+		switch {
+		case expr.IsEquality():
 			err = e.unify(terms[1], terms[2], func() error {
 				defined = true
 				err := iter(e)
 				e.traceRedo(expr)
 				return err
 			})
-		} else {
+		default:
 			err = e.evalCall(terms, func() error {
 				defined = true
 				err := iter(e)
@@ -372,6 +387,27 @@ func (e *eval) evalStep(iter evalIterator) error {
 			}
 			return nil
 		})
+	case *ast.Every:
+		eval := evalEvery{
+			e:    e,
+			expr: expr,
+			generator: ast.NewBody(
+				ast.Equality.Expr(
+					ast.RefTerm(terms.Domain, terms.Key).SetLocation(terms.Domain.Location),
+					terms.Value,
+				).SetLocation(terms.Domain.Location),
+			),
+			body: terms.Body,
+		}
+		err = eval.eval(func() error {
+			defined = true
+			err := iter(e)
+			e.traceRedo(expr)
+			return err
+		})
+
+	default: // guard-rail for adding extra (Expr).Terms types
+		return fmt.Errorf("got %T terms: %[1]v", terms)
 	}
 
 	if err != nil {
@@ -421,43 +457,69 @@ func (e *eval) evalNot(iter evalIterator) error {
 func (e *eval) evalWith(iter evalIterator) error {
 
 	expr := e.query[e.index]
+
+	// Disable inlining on all references in the expression so the result of
+	// partial evaluation has the same semantics w/ the with statements
+	// preserved.
 	var disable []ast.Ref
+	disableRef := func(x ast.Ref) bool {
+		disable = append(disable, x.GroundPrefix())
+		return false
+	}
 
 	if e.partial() {
 
 		// If the value is unknown the with statement cannot be evaluated and so
 		// the entire expression should be saved to be safe. In the future this
 		// could be relaxed in certain cases (e.g., if the with statement would
-		// have no affect.)
+		// have no effect.)
 		for _, with := range expr.With {
+			if isFunction(e.compiler.TypeEnv, with.Target) || // non-builtin function replaced
+				isOtherRef(with.Target) { // built-in replaced
+
+				ast.WalkRefs(with.Value, disableRef)
+				continue
+			}
+
+			// with target is data or input (not built-in)
 			if e.saveSet.ContainsRecursive(with.Value, e.bindings) {
 				return e.saveExprMarkUnknowns(expr, e.bindings, func() error {
 					return e.next(iter)
 				})
 			}
+			ast.WalkRefs(with.Target, disableRef)
+			ast.WalkRefs(with.Value, disableRef)
 		}
 
-		// Disable inlining on all references in the expression so the result of
-		// partial evaluation has the same semantics w/ the with statements
-		// preserved.
-		ast.WalkRefs(expr, func(x ast.Ref) bool {
-			disable = append(disable, x.GroundPrefix())
-			return false
-		})
+		ast.WalkRefs(expr.NoWith(), disableRef)
 	}
 
 	pairsInput := [][2]*ast.Term{}
 	pairsData := [][2]*ast.Term{}
+	functionMocks := [][2]*ast.Term{}
 	targets := []ast.Ref{}
 
 	for i := range expr.With {
+		target := expr.With[i].Target
 		plugged := e.bindings.Plug(expr.With[i].Value)
-		if isInputRef(expr.With[i].Target) {
-			pairsInput = append(pairsInput, [...]*ast.Term{expr.With[i].Target, plugged})
-		} else if isDataRef(expr.With[i].Target) {
-			pairsData = append(pairsData, [...]*ast.Term{expr.With[i].Target, plugged})
+		switch {
+		// NOTE(sr): ordering matters here: isFunction's ref is also covered by isDataRef
+		case isFunction(e.compiler.TypeEnv, target):
+			functionMocks = append(functionMocks, [...]*ast.Term{target, plugged})
+
+		case isInputRef(target):
+			pairsInput = append(pairsInput, [...]*ast.Term{target, plugged})
+
+		case isDataRef(target):
+			pairsData = append(pairsData, [...]*ast.Term{target, plugged})
+
+		default: // target must be builtin
+			if _, _, ok := e.builtinFunc(target.String()); ok {
+				functionMocks = append(functionMocks, [...]*ast.Term{target, plugged})
+				continue // don't append to disabled targets below
+			}
 		}
-		targets = append(targets, expr.With[i].Target.Value.(ast.Ref))
+		targets = append(targets, target.Value.(ast.Ref))
 	}
 
 	input, err := mergeTermWithValues(e.input, pairsInput)
@@ -478,12 +540,12 @@ func (e *eval) evalWith(iter evalIterator) error {
 		}
 	}
 
-	oldInput, oldData := e.evalWithPush(input, data, targets, disable)
+	oldInput, oldData := e.evalWithPush(input, data, functionMocks, targets, disable)
 
 	err = e.evalStep(func(e *eval) error {
 		e.evalWithPop(oldInput, oldData)
 		err := e.next(iter)
-		oldInput, oldData = e.evalWithPush(input, data, targets, disable)
+		oldInput, oldData = e.evalWithPush(input, data, functionMocks, targets, disable)
 		return err
 	})
 
@@ -492,7 +554,7 @@ func (e *eval) evalWith(iter evalIterator) error {
 	return err
 }
 
-func (e *eval) evalWithPush(input, data *ast.Term, targets, disable []ast.Ref) (*ast.Term, *ast.Term) {
+func (e *eval) evalWithPush(input, data *ast.Term, functionMocks [][2]*ast.Term, targets, disable []ast.Ref) (*ast.Term, *ast.Term) {
 	var oldInput *ast.Term
 
 	if input != nil {
@@ -511,6 +573,7 @@ func (e *eval) evalWithPush(input, data *ast.Term, targets, disable []ast.Ref) (
 	e.virtualCache.Push()
 	e.targetStack.Push(targets)
 	e.inliningControl.PushDisable(disable, true)
+	e.functionMocks.PutPairs(functionMocks)
 
 	return oldInput, oldData
 }
@@ -520,6 +583,7 @@ func (e *eval) evalWithPop(input, data *ast.Term) {
 	e.targetStack.Pop()
 	e.virtualCache.Pop()
 	e.comprehensionCache.Pop()
+	e.functionMocks.PopPairs()
 	e.data = data
 	e.input = input
 }
@@ -639,18 +703,12 @@ func (e *eval) evalNotPartialSupport(negationID uint64, expr *ast.Expr, unknowns
 	}
 
 	// Save expression that refers to support rule set.
-
-	terms := expr.Terms
-	expr.Terms = nil // Prevent unnecessary copying the terms.
-	cpy := expr.Copy()
-	expr.Terms = terms
+	cpy := expr.CopyWithoutTerms()
 
 	if len(args) > 0 {
 		terms := make([]*ast.Term, len(args)+1)
 		terms[0] = term
-		for i := 0; i < len(args); i++ {
-			terms[i+1] = args[i]
-		}
+		copy(terms[1:], args)
 		cpy.Terms = terms
 	} else {
 		cpy.Terms = term
@@ -665,7 +723,32 @@ func (e *eval) evalCall(terms []*ast.Term, iter unifyIterator) error {
 
 	ref := terms[0].Value.(ast.Ref)
 
+	var mocked bool
+	mock, mocked := e.functionMocks.Get(ref)
+	if mocked {
+		if m, ok := mock.Value.(ast.Ref); ok && isFunction(e.compiler.TypeEnv, m) { // builtin or data function
+			mockCall := append([]*ast.Term{ast.NewTerm(m)}, terms[1:]...)
+
+			e.functionMocks.Push()
+			err := e.evalCall(mockCall, func() error {
+				e.functionMocks.Pop()
+				err := iter()
+				e.functionMocks.Push()
+				return err
+			})
+			e.functionMocks.Pop()
+			return err
+		}
+	}
+	// 'mocked' true now indicates that the replacement is a value: if
+	// it was a ref to a function, we'd have called that above.
+
 	if ref[0].Equal(ast.DefaultRootDocument) {
+		if mocked {
+			f := e.compiler.TypeEnv.Get(ref).(*types.Function)
+			return e.evalCallValue(len(f.FuncArgs().Args), terms, mock, iter)
+		}
+
 		var ir *ast.IndexResult
 		var err error
 		if e.partial() {
@@ -676,6 +759,7 @@ func (e *eval) evalCall(terms []*ast.Term, iter unifyIterator) error {
 		if err != nil {
 			return err
 		}
+
 		eval := evalFunc{
 			e:     e,
 			ref:   ref,
@@ -685,11 +769,16 @@ func (e *eval) evalCall(terms []*ast.Term, iter unifyIterator) error {
 		return eval.eval(iter)
 	}
 
-	bi, f, ok := e.builtinFunc(ref.String())
+	builtinName := ref.String()
+	bi, f, ok := e.builtinFunc(builtinName)
 	if !ok {
 		return unsupportedBuiltinErr(e.query[e.index].Location)
 	}
 
+	if mocked { // value replacement of built-in call
+		return e.evalCallValue(len(bi.Decl.Args()), terms, mock, iter)
+	}
+
 	if e.unknown(e.query[e.index], e.bindings) {
 		return e.saveCall(len(bi.Decl.Args()), terms, iter)
 	}
@@ -699,6 +788,11 @@ func (e *eval) evalCall(terms []*ast.Term, iter unifyIterator) error {
 		parentID = e.parent.queryID
 	}
 
+	var capabilities *ast.Capabilities
+	if e.compiler != nil {
+		capabilities = e.compiler.Capabilities()
+	}
+
 	bctx := BuiltinContext{
 		Context:                e.ctx,
 		Metrics:                e.metrics,
@@ -708,12 +802,15 @@ func (e *eval) evalCall(terms []*ast.Term, iter unifyIterator) error {
 		Runtime:                e.runtime,
 		Cache:                  e.builtinCache,
 		InterQueryBuiltinCache: e.interQueryBuiltinCache,
+		NDBuiltinCache:         e.ndBuiltinCache,
 		Location:               e.query[e.index].Location,
 		QueryTracers:           e.tracers,
 		TraceEnabled:           e.traceEnabled,
 		QueryID:                e.queryID,
 		ParentID:               parentID,
 		PrintHook:              e.printHook,
+		DistributedTracingOpts: e.tracingOpts,
+		Capabilities:           capabilities,
 	}
 
 	eval := evalBuiltin{
@@ -723,9 +820,24 @@ func (e *eval) evalCall(terms []*ast.Term, iter unifyIterator) error {
 		f:     f,
 		terms: terms[1:],
 	}
+
 	return eval.eval(iter)
 }
 
+func (e *eval) evalCallValue(arity int, terms []*ast.Term, mock *ast.Term, iter unifyIterator) error {
+	switch {
+	case len(terms) == arity+2: // captured var
+		return e.unify(terms[len(terms)-1], mock, iter)
+
+	case len(terms) == arity+1:
+		if mock.Value.Compare(ast.Boolean(false)) != 0 {
+			return iter()
+		}
+		return nil
+	}
+	panic("unreachable")
+}
+
 func (e *eval) unify(a, b *ast.Term, iter unifyIterator) error {
 	return e.biunify(a, b, e.bindings, e.bindings, iter)
 }
@@ -733,6 +845,9 @@ func (e *eval) unify(a, b *ast.Term, iter unifyIterator) error {
 func (e *eval) biunify(a, b *ast.Term, b1, b2 *bindings, iter unifyIterator) error {
 	a, b1 = b1.apply(a)
 	b, b2 = b2.apply(b)
+	if e.traceEnabled {
+		e.traceEvent(UnifyOp, ast.Equality.Expr(a, b), "", nil)
+	}
 	switch vA := a.Value.(type) {
 	case ast.Var, ast.Ref, *ast.ArrayComprehension, *ast.SetComprehension, *ast.ObjectComprehension:
 		return e.biunifyValues(a, b, b1, b2, iter)
@@ -808,20 +923,20 @@ func (e *eval) biunifyObjects(a, b ast.Object, b1, b2 *bindings, iter unifyItera
 		b = plugKeys(b, b2)
 	}
 
-	return e.biunifyObjectsRec(a, b, b1, b2, iter, a, 0)
+	return e.biunifyObjectsRec(a, b, b1, b2, iter, a, a.KeysIterator())
 }
 
-func (e *eval) biunifyObjectsRec(a, b ast.Object, b1, b2 *bindings, iter unifyIterator, keys ast.Object, idx int) error {
-	if idx == keys.Len() {
+func (e *eval) biunifyObjectsRec(a, b ast.Object, b1, b2 *bindings, iter unifyIterator, keys ast.Object, oki ast.ObjectKeysIterator) error {
+	key, more := oki.Next() // Get next key from iterator.
+	if !more {
 		return iter()
 	}
-	key, _ := keys.Elem(idx)
 	v2 := b.Get(key)
 	if v2 == nil {
 		return nil
 	}
 	return e.biunify(a.Get(key), v2, b1, b2, func() error {
-		return e.biunifyObjectsRec(a, b, b1, b2, iter, keys, idx+1)
+		return e.biunifyObjectsRec(a, b, b1, b2, iter, keys, oki)
 	})
 }
 
@@ -1189,8 +1304,7 @@ func (e *eval) biunifyComprehensionObject(x *ast.ObjectComprehension, b *ast.Ter
 }
 
 func (e *eval) saveExpr(expr *ast.Expr, b *bindings, iter unifyIterator) error {
-	expr.With = e.query[e.index].With
-	expr.Location = e.query[e.index].Location
+	e.updateFromQuery(expr)
 	e.saveStack.Push(expr, b, b)
 	e.traceSave(expr)
 	err := iter()
@@ -1199,8 +1313,7 @@ func (e *eval) saveExpr(expr *ast.Expr, b *bindings, iter unifyIterator) error {
 }
 
 func (e *eval) saveExprMarkUnknowns(expr *ast.Expr, b *bindings, iter unifyIterator) error {
-	expr.With = e.query[e.index].With
-	expr.Location = e.query[e.index].Location
+	e.updateFromQuery(expr)
 	declArgsLen, err := e.getDeclArgsLen(expr)
 	if err != nil {
 		return err
@@ -1225,8 +1338,7 @@ func (e *eval) saveExprMarkUnknowns(expr *ast.Expr, b *bindings, iter unifyItera
 func (e *eval) saveUnify(a, b *ast.Term, b1, b2 *bindings, iter unifyIterator) error {
 	e.instr.startTimer(partialOpSaveUnify)
 	expr := ast.Equality.Expr(a, b)
-	expr.With = e.query[e.index].With
-	expr.Location = e.query[e.index].Location
+	e.updateFromQuery(expr)
 	pops := 0
 	if pairs := getSavePairsFromTerm(a, b1, nil); len(pairs) > 0 {
 		pops += len(pairs)
@@ -1256,8 +1368,7 @@ func (e *eval) saveUnify(a, b *ast.Term, b1, b2 *bindings, iter unifyIterator) e
 
 func (e *eval) saveCall(declArgsLen int, terms []*ast.Term, iter unifyIterator) error {
 	expr := ast.NewExpr(terms)
-	expr.With = e.query[e.index].With
-	expr.Location = e.query[e.index].Location
+	e.updateFromQuery(expr)
 
 	// If call-site includes output value then partial eval must add vars in output
 	// position to the save set.
@@ -1292,7 +1403,7 @@ func (e *eval) saveInlinedNegatedExprs(exprs []*ast.Expr, iter unifyIterator) er
 	}
 
 	for _, expr := range exprs {
-		expr.With = with
+		expr.With = e.updateSavedMocks(with)
 		e.saveStack.Push(expr, nil, nil)
 		e.traceSave(expr)
 	}
@@ -1397,8 +1508,6 @@ func (e *evalResolver) Resolve(ref ast.Ref) (ast.Value, error) {
 		if e.e.data != nil {
 			if v, err := e.e.data.Value.Find(ref[1:]); err == nil {
 				repValue = v
-			} else {
-				repValue = nil
 			}
 		}
 
@@ -1426,7 +1535,7 @@ func (e *evalResolver) Resolve(ref ast.Ref) (ast.Value, error) {
 			if !ok {
 				err = mergeConflictErr(ref[0].Location)
 			}
-		} else {
+		} else { // baseCache miss
 			e.e.instr.counterIncr(evalOpBaseCacheMiss)
 			merged, err = e.e.resolveReadFromStorage(ref, repValue)
 		}
@@ -1443,11 +1552,10 @@ func (e *eval) resolveReadFromStorage(ref ast.Ref, a ast.Value) (ast.Value, erro
 	}
 
 	v, err := e.external.Resolve(e, ref)
-
 	if err != nil {
 		return nil, err
-	} else if v == nil {
-
+	}
+	if v == nil {
 		path, err := storage.NewPathForRef(ref)
 		if err != nil {
 			if !storage.IsNotFound(err) {
@@ -1488,14 +1596,18 @@ func (e *eval) resolveReadFromStorage(ref ast.Ref, a ast.Value) (ast.Value, erro
 						return nil, err
 					}
 					blob = cpy
-
 				}
 			}
 		}
 
-		var ok bool
-		v, ok = blob.(ast.Value)
-		if !ok {
+		switch blob := blob.(type) {
+		case ast.Value:
+			v = blob
+		default:
+			if blob, ok := blob.(map[string]interface{}); ok && !e.strictObjects {
+				v = ast.LazyObject(blob)
+				break
+			}
 			v, err = ast.InterfaceToValue(blob)
 			if err != nil {
 				return nil, err
@@ -1557,6 +1669,15 @@ func (e *eval) getDeclArgsLen(x *ast.Expr) (int, error) {
 	return len(ir.Rules[0].Head.Args), nil
 }
 
+// updateFromQuery enriches the passed expression with Location and With
+// fields of the currently looked-at query item (`e.query[e.index]`).
+// With values are namespaced to ensure that replacement functions of
+// mocked built-ins are properly referenced in the support module.
+func (e *eval) updateFromQuery(expr *ast.Expr) {
+	expr.With = e.updateSavedMocks(e.query[e.index].With)
+	expr.Location = e.query[e.index].Location
+}
+
 type evalBuiltin struct {
 	e     *eval
 	bi    *ast.Builtin
@@ -1565,35 +1686,86 @@ type evalBuiltin struct {
 	terms []*ast.Term
 }
 
+// Is this builtin non-deterministic, and did the caller provide an NDBCache?
+func (e *evalBuiltin) canUseNDBCache(bi *ast.Builtin) bool {
+	return bi.Nondeterministic && e.bctx.NDBuiltinCache != nil
+}
+
 func (e evalBuiltin) eval(iter unifyIterator) error {
 
 	operands := make([]*ast.Term, len(e.terms))
 
-	for i := 0; i < len(e.terms); i++ {
+	for i := range e.terms {
 		operands[i] = e.e.bindings.Plug(e.terms[i])
 	}
 
 	numDeclArgs := len(e.bi.Decl.FuncArgs().Args)
 
 	e.e.instr.startTimer(evalOpBuiltinCall)
+	var err error
+
+	// NOTE(philipc): We sometimes have to drop the very last term off
+	// the args list for cases where a builtin's result is used/assigned,
+	// because the last term will be a generated term, not an actual
+	// argument to the builtin.
+	endIndex := len(operands)
+	if len(operands) > numDeclArgs {
+		endIndex--
+	}
+
+	// We skip evaluation of the builtin entirely if the NDBCache is
+	// present, and we have a non-deterministic builtin already cached.
+	if e.canUseNDBCache(e.bi) {
+		e.e.instr.stopTimer(evalOpBuiltinCall)
+
+		// Unify against the NDBCache result if present.
+		if v, ok := e.bctx.NDBuiltinCache.Get(e.bi.Name, ast.NewArray(operands[:endIndex]...)); ok {
+			switch {
+			case e.bi.Decl.Result() == nil:
+				return iter()
+			case len(operands) == numDeclArgs:
+				if v.Compare(ast.Boolean(false)) == 0 {
+					return nil // nothing to do
+				}
+				return iter()
+			default:
+				return e.e.unify(e.terms[endIndex], ast.NewTerm(v), iter)
+			}
+		}
+
+		// Otherwise, we'll need to go through the normal unify flow.
+		e.e.instr.startTimer(evalOpBuiltinCall)
+	}
 
-	err := e.f(e.bctx, operands, func(output *ast.Term) error {
+	// Normal unification flow for builtins:
+	err = e.f(e.bctx, operands, func(output *ast.Term) error {
 
 		e.e.instr.stopTimer(evalOpBuiltinCall)
 
 		var err error
 
-		if e.bi.Decl.Result() == nil {
+		switch {
+		case e.bi.Decl.Result() == nil:
 			err = iter()
-		} else if len(operands) == numDeclArgs {
+		case len(operands) == numDeclArgs:
 			if output.Value.Compare(ast.Boolean(false)) != 0 {
 				err = iter()
-			}
-		} else {
-			err = e.e.unify(e.terms[len(e.terms)-1], output, iter)
+			} // else: nothing to do, don't iter()
+		default:
+			err = e.e.unify(e.terms[endIndex], output, iter)
+		}
+
+		// If the NDBCache is present, we can assume this builtin
+		// call was not cached earlier.
+		if e.canUseNDBCache(e.bi) {
+			// Populate the NDBCache from the output term.
+			e.bctx.NDBuiltinCache.Put(e.bi.Name, ast.NewArray(operands[:endIndex]...), output.Value)
 		}
 
 		if err != nil {
+			// NOTE(sr): We wrap the errors here into Halt{} because we don't want to
+			// record them into builtinErrors below. The errors set here are coming from
+			// the call to iter(), not from the builtin implementation.
 			err = Halt{Err: err}
 		}
 
@@ -1702,7 +1874,7 @@ func (e evalFunc) evalCache(argCount int, iter unifyIterator) (ast.Ref, bool, er
 		cacheKey[i] = e.e.bindings.Plug(e.terms[i])
 	}
 
-	cached := e.e.virtualCache.Get(cacheKey)
+	cached, _ := e.e.virtualCache.Get(cacheKey)
 	if cached != nil {
 		e.e.instr.counterIncr(evalOpVirtualCacheHit)
 		if argCount == len(e.terms)-1 { // f(x)
@@ -1756,6 +1928,7 @@ func (e evalFunc) evalOneRule(iter unifyIterator, rule *ast.Rule, cacheKey ast.R
 					if prev != nil && ast.Compare(prev, result) != 0 {
 						return functionConflictErr(rule.Location)
 					}
+					prev = result
 					return nil
 				}
 			}
@@ -1834,9 +2007,10 @@ func (e evalFunc) partialEvalSupportRule(rule *ast.Rule, path ast.Ref) error {
 		// Type-checking failure means the rule body will never succeed.
 		if e.e.compiler.PassesTypeCheck(plugged) {
 			head := &ast.Head{
-				Name:  rule.Head.Name,
-				Value: child.bindings.PlugNamespaced(rule.Head.Value, e.e.caller.bindings),
-				Args:  make([]*ast.Term, len(rule.Head.Args)),
+				Name:      rule.Head.Name,
+				Reference: rule.Head.Reference,
+				Value:     child.bindings.PlugNamespaced(rule.Head.Value, e.e.caller.bindings),
+				Args:      make([]*ast.Term, len(rule.Head.Args)),
 			}
 			for i, a := range rule.Head.Args {
 				head.Args[i] = child.bindings.PlugNamespaced(a, e.e.caller.bindings)
@@ -1957,13 +2131,13 @@ func (e evalTree) enumerate(iter unifyIterator) error {
 				}
 			}
 		case ast.Object:
-			err := doc.Iter(func(k, _ *ast.Term) error {
-				return e.e.biunify(k, e.ref[e.pos], e.bindings, e.bindings, func() error {
+			ki := doc.KeysIterator()
+			for k, more := ki.Next(); more; k, more = ki.Next() {
+				if err := e.e.biunify(k, e.ref[e.pos], e.bindings, e.bindings, func() error {
 					return e.next(iter, k)
-				})
-			})
-			if err != nil {
-				return err
+				}); err != nil {
+					return err
+				}
 			}
 		case ast.Set:
 			err := doc.Iter(func(elem *ast.Term) error {
@@ -2022,6 +2196,8 @@ func (e evalTree) extent() (*ast.Term, error) {
 	return ast.NewTerm(virtual), nil
 }
 
+// leaves builds a tree from evaluating the full rule tree extent, by recursing into all
+// branches, and building up objects as it goes.
 func (e evalTree) leaves(plugged ast.Ref, node *ast.TreeNode) (ast.Object, error) {
 
 	if e.node == nil {
@@ -2092,7 +2268,7 @@ func (e evalVirtual) eval(iter unifyIterator) error {
 	}
 
 	switch ir.Kind {
-	case ast.PartialSetDoc:
+	case ast.MultiValue:
 		eval := evalVirtualPartial{
 			e:         e.e,
 			ref:       e.ref,
@@ -2105,7 +2281,22 @@ func (e evalVirtual) eval(iter unifyIterator) error {
 			empty:     ast.SetTerm(),
 		}
 		return eval.eval(iter)
-	case ast.PartialObjectDoc:
+	case ast.SingleValue:
+		// NOTE(sr): If we allow vars in others than the last position of a ref, we need
+		//           to start reworking things here
+		if ir.OnlyGroundRefs {
+			eval := evalVirtualComplete{
+				e:         e.e,
+				ref:       e.ref,
+				plugged:   e.plugged,
+				pos:       e.pos,
+				ir:        ir,
+				bindings:  e.bindings,
+				rterm:     e.rterm,
+				rbindings: e.rbindings,
+			}
+			return eval.eval(iter)
+		}
 		eval := evalVirtualPartial{
 			e:         e.e,
 			ref:       e.ref,
@@ -2119,17 +2310,7 @@ func (e evalVirtual) eval(iter unifyIterator) error {
 		}
 		return eval.eval(iter)
 	default:
-		eval := evalVirtualComplete{
-			e:         e.e,
-			ref:       e.ref,
-			plugged:   e.plugged,
-			pos:       e.pos,
-			ir:        ir,
-			bindings:  e.bindings,
-			rterm:     e.rterm,
-			rbindings: e.rbindings,
-		}
-		return eval.eval(iter)
+		panic("unreachable")
 	}
 }
 
@@ -2209,7 +2390,7 @@ func (e evalVirtualPartial) evalEachRule(iter unifyIterator, unknown bool) error
 func (e evalVirtualPartial) evalAllRules(iter unifyIterator, rules []*ast.Rule) error {
 
 	cacheKey := e.plugged[:e.pos+1]
-	result := e.e.virtualCache.Get(cacheKey)
+	result, _ := e.e.virtualCache.Get(cacheKey)
 	if result != nil {
 		e.e.instr.counterIncr(evalOpVirtualCacheHit)
 		return e.e.biunify(result, e.rterm, e.bindings, e.rbindings, iter)
@@ -2263,13 +2444,17 @@ func (e evalVirtualPartial) evalOneRulePreUnify(iter unifyIterator, rule *ast.Ru
 	child.traceEnter(rule)
 	var defined bool
 
-	err := child.biunify(rule.Head.Key, key, child.bindings, e.bindings, func() error {
+	headKey := rule.Head.Key
+	if headKey == nil {
+		headKey = rule.Head.Reference[len(rule.Head.Reference)-1]
+	}
+	err := child.biunify(headKey, key, child.bindings, e.bindings, func() error {
 		defined = true
 		return child.eval(func(child *eval) error {
 
 			term := rule.Head.Value
 			if term == nil {
-				term = rule.Head.Key
+				term = headKey
 			}
 
 			if hint.key != nil {
@@ -2376,7 +2561,8 @@ func (e evalVirtualPartial) partialEvalSupport(iter unifyIterator) error {
 			ok, err := e.partialEvalSupportRule(e.ir.Rules[i], path)
 			if err != nil {
 				return err
-			} else if ok {
+			}
+			if ok {
 				defined = true
 			}
 		}
@@ -2466,7 +2652,7 @@ func (e evalVirtualPartial) evalCache(iter unifyIterator) (evalVirtualPartialCac
 		return hint, nil
 	}
 
-	if cached := e.e.virtualCache.Get(e.plugged[:e.pos+1]); cached != nil { // have full extent cached
+	if cached, _ := e.e.virtualCache.Get(e.plugged[:e.pos+1]); cached != nil { // have full extent cached
 		e.e.instr.counterIncr(evalOpVirtualCacheHit)
 		hint.hit = true
 		return hint, e.evalTerm(iter, e.pos+1, cached, e.bindings)
@@ -2477,7 +2663,7 @@ func (e evalVirtualPartial) evalCache(iter unifyIterator) (evalVirtualPartialCac
 	if plugged.IsGround() {
 		hint.key = append(e.plugged[:e.pos+1], plugged)
 
-		if cached := e.e.virtualCache.Get(hint.key); cached != nil {
+		if cached, _ := e.e.virtualCache.Get(hint.key); cached != nil {
 			e.e.instr.counterIncr(evalOpVirtualCacheHit)
 			hint.hit = true
 			return hint, e.evalTerm(iter, e.pos+2, cached, e.bindings)
@@ -2495,13 +2681,15 @@ func (e evalVirtualPartial) evalCache(iter unifyIterator) (evalVirtualPartialCac
 func (e evalVirtualPartial) reduce(head *ast.Head, b *bindings, result *ast.Term) (*ast.Term, bool, error) {
 
 	var exists bool
-	key := b.Plug(head.Key)
 
 	switch v := result.Value.(type) {
-	case ast.Set:
+	case ast.Set: // MultiValue
+		key := b.Plug(head.Key)
 		exists = v.Contains(key)
 		v.Add(key)
-	case ast.Object:
+	case ast.Object: // SingleValue
+		key := head.Reference[len(head.Reference)-1] // NOTE(sr): multiple vars in ref heads need to deal with this better
+		key = b.Plug(key)
 		value := b.Plug(head.Value)
 		if curr := v.Get(key); curr != nil {
 			if !curr.Equal(value) {
@@ -2533,7 +2721,9 @@ func (e evalVirtualComplete) eval(iter unifyIterator) error {
 		return nil
 	}
 
-	if len(e.ir.Rules) > 0 && len(e.ir.Rules[0].Head.Args) > 0 {
+	// When evaluating the full extent, skip functions.
+	if len(e.ir.Rules) > 0 && len(e.ir.Rules[0].Head.Args) > 0 ||
+		e.ir.Default != nil && len(e.ir.Default.Head.Args) > 0 {
 		return nil
 	}
 
@@ -2561,7 +2751,12 @@ func (e evalVirtualComplete) eval(iter unifyIterator) error {
 }
 
 func (e evalVirtualComplete) evalValue(iter unifyIterator, findOne bool) error {
-	cached := e.e.virtualCache.Get(e.plugged[:e.pos+1])
+	cached, undefined := e.e.virtualCache.Get(e.plugged[:e.pos+1])
+	if undefined {
+		e.e.instr.counterIncr(evalOpVirtualCacheHit)
+		return nil
+	}
+
 	if cached != nil {
 		e.e.instr.counterIncr(evalOpVirtualCacheHit)
 		return e.evalTerm(iter, cached, e.bindings)
@@ -2597,6 +2792,10 @@ func (e evalVirtualComplete) evalValue(iter unifyIterator, findOne bool) error {
 		return err
 	}
 
+	if prev == nil {
+		e.e.virtualCache.Put(e.plugged[:e.pos+1], nil)
+	}
+
 	return nil
 }
 
@@ -2608,6 +2807,7 @@ func (e evalVirtualComplete) evalValueRule(iter unifyIterator, rule *ast.Rule, p
 	var result *ast.Term
 	err := child.eval(func(child *eval) error {
 		child.traceExit(rule)
+
 		result = child.bindings.Plug(rule.Head.Value)
 
 		if prev != nil {
@@ -2620,8 +2820,8 @@ func (e evalVirtualComplete) evalValueRule(iter unifyIterator, rule *ast.Rule, p
 
 		prev = result
 		e.e.virtualCache.Put(e.plugged[:e.pos+1], result)
-		term, termbindings := child.bindings.apply(rule.Head.Value)
 
+		term, termbindings := child.bindings.apply(rule.Head.Value)
 		err := e.evalTerm(iter, term, termbindings)
 		if err != nil {
 			return err
@@ -2666,42 +2866,65 @@ func (e evalVirtualComplete) partialEvalSupport(iter unifyIterator) error {
 	path := e.e.namespaceRef(e.plugged[:e.pos+1])
 	term := ast.NewTerm(e.e.namespaceRef(e.ref))
 
-	if !e.e.saveSupport.Exists(path) {
+	var defined bool
 
+	if e.e.saveSupport.Exists(path) {
+		defined = true
+	} else {
 		for i := range e.ir.Rules {
-			err := e.partialEvalSupportRule(e.ir.Rules[i], path)
+			ok, err := e.partialEvalSupportRule(e.ir.Rules[i], path)
 			if err != nil {
 				return err
 			}
+			if ok {
+				defined = true
+			}
 		}
 
 		if e.ir.Default != nil {
-			err := e.partialEvalSupportRule(e.ir.Default, path)
+			ok, err := e.partialEvalSupportRule(e.ir.Default, path)
 			if err != nil {
 				return err
 			}
+			if ok {
+				defined = true
+			}
 		}
 	}
 
+	if !defined {
+		return nil
+	}
+
 	return e.e.saveUnify(term, e.rterm, e.bindings, e.rbindings, iter)
 }
 
-func (e evalVirtualComplete) partialEvalSupportRule(rule *ast.Rule, path ast.Ref) error {
+func (e evalVirtualComplete) partialEvalSupportRule(rule *ast.Rule, path ast.Ref) (bool, error) {
 
 	child := e.e.child(rule.Body)
 	child.traceEnter(rule)
 
 	e.e.saveStack.PushQuery(nil)
+	var defined bool
 
 	err := child.eval(func(child *eval) error {
 		child.traceExit(rule)
+		defined = true
 
 		current := e.e.saveStack.PopQuery()
 		plugged := current.Plug(e.e.caller.bindings)
 		// Skip this rule body if it fails to type-check.
 		// Type-checking failure means the rule body will never succeed.
 		if e.e.compiler.PassesTypeCheck(plugged) {
-			head := ast.NewHead(rule.Head.Name, nil, child.bindings.PlugNamespaced(rule.Head.Value, e.e.caller.bindings))
+			var name ast.Var
+			switch ref := rule.Head.Ref().GroundPrefix(); len(ref) {
+			case 1:
+				name = ref[0].Value.(ast.Var)
+			default:
+				s := ref[len(ref)-1].Value.(ast.String)
+				name = ast.Var(s)
+			}
+			head := ast.NewHead(name, nil, child.bindings.PlugNamespaced(rule.Head.Value, e.e.caller.bindings))
 
 			if !e.e.inliningControl.shallow {
 				cp := copypropagation.New(head.Vars()).
@@ -2721,7 +2944,7 @@ func (e evalVirtualComplete) partialEvalSupportRule(rule *ast.Rule, path ast.Ref
 		return nil
 	})
 	e.e.saveStack.PopQuery()
-	return err
+	return defined, err
 }
 
 func (e evalVirtualComplete) evalTerm(iter unifyIterator, term *ast.Term, termbindings *bindings) error {
@@ -2872,15 +3095,93 @@ func (e evalTerm) save(iter unifyIterator) error {
 		suffix := e.ref[e.pos:]
 		ref := make(ast.Ref, len(suffix)+1)
 		ref[0] = v
-		for i := 0; i < len(suffix); i++ {
-			ref[i+1] = suffix[i]
-		}
+		copy(ref[1:], suffix)
 
 		return e.e.biunify(ast.NewTerm(ref), e.rterm, e.bindings, e.rbindings, iter)
 	})
 
 }
 
+type evalEvery struct {
+	e         *eval
+	expr      *ast.Expr
+	generator ast.Body
+	body      ast.Body
+}
+
+func (e evalEvery) eval(iter unifyIterator) error {
+	// unknowns in domain or body: save the expression, PE its body
+	if e.e.unknown(e.generator, e.e.bindings) || e.e.unknown(e.body, e.e.bindings) {
+		return e.save(iter)
+	}
+
+	domain := e.e.closure(e.generator)
+	all := true // all generator evaluations yield one successful body evaluation
+
+	domain.traceEnter(e.expr)
+
+	err := domain.eval(func(child *eval) error {
+		if !all {
+			// NOTE(sr): Is this good enough? We don't have a "fail EE".
+			// This would do extra work, like iterating needlessly if domain was a large array.
+			return nil
+		}
+		body := child.closure(e.body)
+		body.findOne = true
+		body.traceEnter(e.body)
+		done := false
+		err := body.eval(func(*eval) error {
+			body.traceExit(e.body)
+			done = true
+			body.traceRedo(e.body)
+			return nil
+		})
+		if !done {
+			all = false
+		}
+
+		child.traceRedo(e.expr)
+		return err
+	})
+	if err != nil {
+		return err
+	}
+	if all {
+		err := iter()
+		domain.traceExit(e.expr)
+		return err
+	}
+	domain.traceFail(e.expr)
+	return nil
+}
+
+func (e *evalEvery) save(iter unifyIterator) error {
+	return e.e.saveExpr(e.plug(e.expr), e.e.bindings, iter)
+}
+
+func (e *evalEvery) plug(expr *ast.Expr) *ast.Expr {
+	cpy := expr.Copy()
+	every := cpy.Terms.(*ast.Every)
+	for i := range every.Body {
+		switch t := every.Body[i].Terms.(type) {
+		case *ast.Term:
+			every.Body[i].Terms = e.e.bindings.PlugNamespaced(t, e.e.caller.bindings)
+		case []*ast.Term:
+			for j := 1; j < len(t); j++ { // don't plug operator, t[0]
+				t[j] = e.e.bindings.PlugNamespaced(t[j], e.e.caller.bindings)
+			}
+		case *ast.Every:
+			every.Body[i] = e.plug(every.Body[i])
+		}
+	}
+
+	every.Key = e.e.bindings.PlugNamespaced(every.Key, e.e.caller.bindings)
+	every.Value = e.e.bindings.PlugNamespaced(every.Value, e.e.caller.bindings)
+	every.Domain = e.e.bindings.PlugNamespaced(every.Domain, e.e.caller.bindings)
+	cpy.Terms = every
+	return cpy
+}
+
 func (e *eval) comprehensionIndex(term *ast.Term) *ast.ComprehensionIndex {
 	if e.queryCompiler != nil {
 		return e.queryCompiler.ComprehensionIndex(term)
@@ -3087,6 +3388,30 @@ func isDataRef(term *ast.Term) bool {
 	return false
 }
 
+func isOtherRef(term *ast.Term) bool {
+	ref, ok := term.Value.(ast.Ref)
+	if !ok {
+		panic("unreachable")
+	}
+	return !ref.HasPrefix(ast.DefaultRootRef) && !ref.HasPrefix(ast.InputRootRef)
+}
+
+func isFunction(env *ast.TypeEnv, ref interface{}) bool {
+	var r ast.Ref
+	switch v := ref.(type) {
+	case ast.Ref:
+		r = v
+	case *ast.Term:
+		return isFunction(env, v.Value)
+	case ast.Value:
+		return false
+	default:
+		panic("expected ast.Value or *ast.Term")
+	}
+	_, ok := env.Get(r).(*types.Function)
+	return ok
+}
+
 func merge(a, b ast.Value) (ast.Value, bool) {
 	aObj, ok1 := a.(ast.Object)
 	bObj, ok2 := b.(ast.Object)
@@ -3152,3 +3477,14 @@ func suppressEarlyExit(err error) error {
 	}
 	return ee.prev // nil if we're done
 }
+
+func (e *eval) updateSavedMocks(withs []*ast.With) []*ast.With {
+	ret := make([]*ast.With, 0, len(withs))
+	for _, w := range withs {
+		if isOtherRef(w.Target) || isFunction(e.compiler.TypeEnv, w.Target) {
+			continue
+		}
+		ret = append(ret, w.Copy())
+	}
+	return ret
+}
diff --git a/topdown/eval_test.go b/topdown/eval_test.go
index e1db650bc9..ace27b65c2 100644
--- a/topdown/eval_test.go
+++ b/topdown/eval_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 )
 
 func TestQueryIDFactory(t *testing.T) {
diff --git a/topdown/exported_test.go b/topdown/exported_test.go
index 27bec2e260..675132d423 100644
--- a/topdown/exported_test.go
+++ b/topdown/exported_test.go
@@ -7,14 +7,16 @@ package topdown
 import (
 	"context"
 	"fmt"
+	"os"
 	"sort"
 	"strings"
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/test/cases"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
 func TestRego(t *testing.T) {
@@ -33,7 +35,19 @@ func TestOPARego(t *testing.T) {
 	}
 }
 
-func testRun(t *testing.T, tc cases.TestCase) {
+func TestRegoWithNDBCache(t *testing.T) {
+	for _, tc := range cases.MustLoad("../test/cases/testdata").Sorted().Cases {
+		t.Run(tc.Note, func(t *testing.T) {
+			testRun(t, tc, func(q *Query) *Query {
+				return q.WithNDBuiltinCache(builtins.NDBCache{})
+			})
+		})
+	}
+}
+
+type opt func(*Query) *Query
+
+func testRun(t *testing.T, tc cases.TestCase, opts ...opt) {
 
 	ctx := context.Background()
 
@@ -67,13 +81,20 @@ func testRun(t *testing.T, tc cases.TestCase) {
 		input = ast.NewTerm(ast.MustInterfaceToValue(*tc.Input))
 	}
 
-	rs, err := NewQuery(query).
+	buf := NewBufferTracer()
+	q := NewQuery(query).
 		WithCompiler(compiler).
 		WithStore(store).
 		WithTransaction(txn).
 		WithInput(input).
 		WithStrictBuiltinErrors(tc.StrictError).
-		Run(ctx)
+		WithTracer(buf)
+
+	for _, o := range opts {
+		q = o(q)
+	}
+
+	rs, err := q.Run(ctx)
 
 	if tc.WantError != nil {
 		testAssertErrorText(t, *tc.WantError, err)
@@ -94,6 +115,10 @@ func testRun(t *testing.T, tc cases.TestCase) {
 	if tc.WantResult == nil && tc.WantErrorCode == nil && tc.WantError == nil {
 		t.Fatal("expected one of: 'want_result', 'want_error_code', or 'want_error'")
 	}
+
+	if testing.Verbose() {
+		PrettyTrace(os.Stderr, *buf)
+	}
 }
 
 func testAssertResultSet(t *testing.T, wantResult []map[string]interface{}, rs QueryResultSet, sortBindings bool) {
diff --git a/topdown/glob.go b/topdown/glob.go
index 98052a0c6a..2afead73a2 100644
--- a/topdown/glob.go
+++ b/topdown/glob.go
@@ -1,7 +1,7 @@
 package topdown
 
 import (
-	"fmt"
+	"strings"
 	"sync"
 
 	"github.com/gobwas/glob"
@@ -13,53 +13,74 @@ import (
 var globCacheLock = sync.Mutex{}
 var globCache map[string]glob.Glob
 
-func builtinGlobMatch(a, b, c ast.Value) (ast.Value, error) {
-	pattern, err := builtins.StringOperand(a, 1)
+func builtinGlobMatch(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	pattern, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	delimiters, err := builtins.RuneSliceOperand(b, 2)
+	var delimiters []rune
+	switch operands[1].Value.(type) {
+	case ast.Null:
+		delimiters = []rune{}
+	case *ast.Array:
+		delimiters, err = builtins.RuneSliceOperand(operands[1].Value, 2)
+		if err != nil {
+			return err
+		}
+		if len(delimiters) == 0 {
+			delimiters = []rune{'.'}
+		}
+	default:
+		return builtins.NewOperandTypeErr(2, operands[1].Value, "array", "null")
+	}
+
+	match, err := builtins.StringOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	if len(delimiters) == 0 {
-		delimiters = []rune{'.'}
+	builder := strings.Builder{}
+	builder.WriteString(string(pattern))
+	builder.WriteRune('-')
+	for _, v := range delimiters {
+		builder.WriteRune(v)
 	}
+	id := builder.String()
 
-	match, err := builtins.StringOperand(c, 3)
+	m, err := globCompileAndMatch(id, string(pattern), string(match), delimiters)
 	if err != nil {
-		return nil, err
+		return err
 	}
+	return iter(ast.BooleanTerm(m))
+}
 
-	id := fmt.Sprintf("%s-%v", pattern, delimiters)
-
+func globCompileAndMatch(id, pattern, match string, delimiters []rune) (bool, error) {
 	globCacheLock.Lock()
 	defer globCacheLock.Unlock()
 	p, ok := globCache[id]
 	if !ok {
 		var err error
-		if p, err = glob.Compile(string(pattern), delimiters...); err != nil {
-			return nil, err
+		if p, err = glob.Compile(pattern, delimiters...); err != nil {
+			return false, err
 		}
 		globCache[id] = p
 	}
-
-	return ast.Boolean(p.Match(string(match))), nil
+	out := p.Match(match)
+	return out, nil
 }
 
-func builtinGlobQuoteMeta(a ast.Value) (ast.Value, error) {
-	pattern, err := builtins.StringOperand(a, 1)
+func builtinGlobQuoteMeta(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	pattern, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(glob.QuoteMeta(string(pattern))), nil
+	return iter(ast.StringTerm(glob.QuoteMeta(string(pattern))))
 }
 
 func init() {
 	globCache = map[string]glob.Glob{}
-	RegisterFunctionalBuiltin3(ast.GlobMatch.Name, builtinGlobMatch)
-	RegisterFunctionalBuiltin1(ast.GlobQuoteMeta.Name, builtinGlobQuoteMeta)
+	RegisterBuiltinFunc(ast.GlobMatch.Name, builtinGlobMatch)
+	RegisterBuiltinFunc(ast.GlobQuoteMeta.Name, builtinGlobQuoteMeta)
 }
diff --git a/topdown/graphql.go b/topdown/graphql.go
new file mode 100644
index 0000000000..8fb1b58a76
--- /dev/null
+++ b/topdown/graphql.go
@@ -0,0 +1,485 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	gqlast "github.com/open-policy-agent/opa/internal/gqlparser/ast"
+	gqlparser "github.com/open-policy-agent/opa/internal/gqlparser/parser"
+	gqlvalidator "github.com/open-policy-agent/opa/internal/gqlparser/validator"
+
+	// Side-effecting import. Triggers GraphQL library's validation rule init() functions.
+	_ "github.com/open-policy-agent/opa/internal/gqlparser/validator/rules"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/topdown/builtins"
+)
+
+// Parses a GraphQL schema, and returns the GraphQL AST for the schema.
+func parseSchema(schema string) (*gqlast.SchemaDocument, error) {
+	// NOTE(philipc): We don't include the "built-in schema defs" from the
+	// underlying graphql parsing library here, because those definitions
+	// generate enormous AST blobs. In the future, if there is demand for
+	// a "full-spec" version of schema ASTs, we may need to provide a
+	// version of this function that includes the built-in schema
+	// definitions.
+	schemaAST, err := gqlparser.ParseSchema(&gqlast.Source{Input: schema})
+	if err != nil {
+		errorParts := strings.SplitN(err.Error(), ":", 4)
+		msg := strings.TrimLeft(errorParts[3], " ")
+		return nil, fmt.Errorf("%s in GraphQL string at location %s:%s", msg, errorParts[1], errorParts[2])
+	}
+	return schemaAST, nil
+}
+
+// Parses a GraphQL query, and returns the GraphQL AST for the query.
+func parseQuery(query string) (*gqlast.QueryDocument, error) {
+	queryAST, err := gqlparser.ParseQuery(&gqlast.Source{Input: query})
+	if err != nil {
+		errorParts := strings.SplitN(err.Error(), ":", 4)
+		msg := strings.TrimLeft(errorParts[3], " ")
+		return nil, fmt.Errorf("%s in GraphQL string at location %s:%s", msg, errorParts[1], errorParts[2])
+	}
+	return queryAST, nil
+}
+
+// Validates a GraphQL query against a schema, and returns an error.
+// In this case, we get a wrappered error list type, and pluck out
+// just the first error message in the list.
+func validateQuery(schema *gqlast.Schema, query *gqlast.QueryDocument) error {
+	// Validate the query against the schema, erroring if there's an issue.
+	err := gqlvalidator.Validate(schema, query)
+	if err != nil {
+		// We use strings.TrimSuffix to remove the '.' characters that the library
+		// authors include on most of their validation errors. This should be safe,
+		// since variable names in their error messages are usually quoted, and
+		// this affects only the last character(s) in the string.
+		// NOTE(philipc): We know the error location will be in the query string,
+		// because schema validation always happens before this function is called.
+		errorParts := strings.SplitN(err.Error(), ":", 4)
+		msg := strings.TrimSuffix(strings.TrimLeft(errorParts[3], " "), ".\n")
+		return fmt.Errorf("%s in GraphQL query string at location %s:%s", msg, errorParts[1], errorParts[2])
+	}
+	return nil
+}
+
+func getBuiltinSchema() *gqlast.SchemaDocument {
+	schema, err := gqlparser.ParseSchema(gqlvalidator.Prelude)
+	if err != nil {
+		panic(fmt.Errorf("Error in gqlparser Prelude (should be impossible): %w", err))
+	}
+	return schema
+}
+
+// NOTE(philipc): This function expects *validated* schema documents, and will break
+// if it is fed arbitrary structures.
+func mergeSchemaDocuments(docA *gqlast.SchemaDocument, docB *gqlast.SchemaDocument) *gqlast.SchemaDocument {
+	ast := &gqlast.SchemaDocument{}
+	ast.Merge(docA)
+	ast.Merge(docB)
+	return ast
+}
+
+// Converts a SchemaDocument into a gqlast.Schema object that can be used for validation.
+// It merges in the builtin schema typedefs exactly as gqltop.LoadSchema did internally.
+func convertSchema(schemaDoc *gqlast.SchemaDocument) (*gqlast.Schema, error) {
+	// Merge builtin schema + schema we were provided.
+	builtinsSchemaDoc := getBuiltinSchema()
+	mergedSchemaDoc := mergeSchemaDocuments(builtinsSchemaDoc, schemaDoc)
+	schema, err := gqlvalidator.ValidateSchemaDocument(mergedSchemaDoc)
+	if err != nil {
+		return nil, fmt.Errorf("Error in gqlparser SchemaDocument to Schema conversion: %w", err)
+	}
+	return schema, nil
+}
+
+// Converts an ast.Object into a gqlast.QueryDocument object.
+func objectToQueryDocument(value ast.Object) (*gqlast.QueryDocument, error) {
+	// Convert ast.Term to interface{} for JSON encoding below.
+	asJSON, err := ast.JSON(value)
+	if err != nil {
+		return nil, err
+	}
+	// Marshal to JSON.
+	bs, err := json.Marshal(asJSON)
+	if err != nil {
+		return nil, err
+	}
+	// Unmarshal from JSON -> gqlast.QueryDocument.
+	var result gqlast.QueryDocument
+	err = json.Unmarshal(bs, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// Converts an ast.Object into a gqlast.SchemaDocument object.
+func objectToSchemaDocument(value ast.Object) (*gqlast.SchemaDocument, error) {
+	// Convert ast.Term to interface{} for JSON encoding below.
+	asJSON, err := ast.JSON(value)
+	if err != nil {
+		return nil, err
+	}
+	// Marshal to JSON.
+	bs, err := json.Marshal(asJSON)
+	if err != nil {
+		return nil, err
+	}
+	// Unmarshal from JSON -> gqlast.SchemaDocument.
+	var result gqlast.SchemaDocument
+	err = json.Unmarshal(bs, &result)
+	if err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// Recursively traverses an AST that has been run through InterfaceToValue,
+// and prunes away the fields with null or empty values, and all `Position`
+// structs.
+// NOTE(philipc): We currently prune away null values to reduce the level
+// of clutter in the returned AST objects. In the future, if there is demand
+// for ASTs that have a more regular/fixed structure, we may need to provide
+// a "raw" version of the AST, where we still prune away the `Position`
+// structs, but leave in the null fields.
+func pruneIrrelevantGraphQLASTNodes(value ast.Value) ast.Value {
+	// We iterate over the Value we've been provided, and recurse down
+	// in the case of complex types, such as Arrays/Objects.
+	// We are guaranteed to only have to deal with standard JSON types,
+	// so this is much less ugly than what we'd need for supporting every
+	// extant ast type!
+	switch x := value.(type) {
+	case *ast.Array:
+		result := ast.NewArray()
+		// Iterate over the array's elements, and do the following:
+		// - Drop any Nulls
+		// - Drop any any empty object/array value (after running the pruner)
+		for i := 0; i < x.Len(); i++ {
+			vTerm := x.Elem(i)
+			switch v := vTerm.Value.(type) {
+			case ast.Null:
+				continue
+			case *ast.Array:
+				// Safe, because we knew the type before going to prune it.
+				va := pruneIrrelevantGraphQLASTNodes(v).(*ast.Array)
+				if va.Len() > 0 {
+					result = result.Append(ast.NewTerm(va))
+				}
+			case ast.Object:
+				// Safe, because we knew the type before going to prune it.
+				vo := pruneIrrelevantGraphQLASTNodes(v).(ast.Object)
+				if len(vo.Keys()) > 0 {
+					result = result.Append(ast.NewTerm(vo))
+				}
+			default:
+				result = result.Append(vTerm)
+			}
+		}
+		return result
+	case ast.Object:
+		result := ast.NewObject()
+		// Iterate over our object's keys, and do the following:
+		// - Drop "Position".
+		// - Drop any key with a Null value.
+		// - Drop any key with an empty object/array value (after running the pruner)
+		keys := x.Keys()
+		for _, k := range keys {
+			// We drop the "Position" objects because we don't need the
+			// source-backref/location info they provide for policy rules.
+			// Note that keys are ast.Strings.
+			if ast.String("Position").Equal(k.Value) {
+				continue
+			}
+			vTerm := x.Get(k)
+			switch v := vTerm.Value.(type) {
+			case ast.Null:
+				continue
+			case *ast.Array:
+				// Safe, because we knew the type before going to prune it.
+				va := pruneIrrelevantGraphQLASTNodes(v).(*ast.Array)
+				if va.Len() > 0 {
+					result.Insert(k, ast.NewTerm(va))
+				}
+			case ast.Object:
+				// Safe, because we knew the type before going to prune it.
+				vo := pruneIrrelevantGraphQLASTNodes(v).(ast.Object)
+				if len(vo.Keys()) > 0 {
+					result.Insert(k, ast.NewTerm(vo))
+				}
+			default:
+				result.Insert(k, vTerm)
+			}
+		}
+		return result
+	default:
+		return x
+	}
+}
+
+// Reports errors from parsing/validation.
+func builtinGraphQLParse(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	var queryDoc *gqlast.QueryDocument
+	var schemaDoc *gqlast.SchemaDocument
+	var err error
+
+	// Parse/translate query if it's a string/object.
+	switch x := operands[0].Value.(type) {
+	case ast.String:
+		queryDoc, err = parseQuery(string(x))
+	case ast.Object:
+		queryDoc, err = objectToQueryDocument(x)
+	default:
+		// Error if wrong type.
+		return builtins.NewOperandTypeErr(0, x, "string", "object")
+	}
+	if err != nil {
+		return err
+	}
+
+	// Parse/translate schema if it's a string/object.
+	switch x := operands[1].Value.(type) {
+	case ast.String:
+		schemaDoc, err = parseSchema(string(x))
+	case ast.Object:
+		schemaDoc, err = objectToSchemaDocument(x)
+	default:
+		// Error if wrong type.
+		return builtins.NewOperandTypeErr(1, x, "string", "object")
+	}
+	if err != nil {
+		return err
+	}
+
+	// Transform the ASTs into Objects.
+	queryASTValue, err := ast.InterfaceToValue(queryDoc)
+	if err != nil {
+		return err
+	}
+	schemaASTValue, err := ast.InterfaceToValue(schemaDoc)
+	if err != nil {
+		return err
+	}
+
+	// Validate the query against the schema, erroring if there's an issue.
+	schema, err := convertSchema(schemaDoc)
+	if err != nil {
+		return err
+	}
+	if err := validateQuery(schema, queryDoc); err != nil {
+		return err
+	}
+
+	// Recursively remove irrelevant AST structures.
+	queryResult := pruneIrrelevantGraphQLASTNodes(queryASTValue.(ast.Object))
+	querySchema := pruneIrrelevantGraphQLASTNodes(schemaASTValue.(ast.Object))
+
+	// Construct return value.
+	verified := ast.ArrayTerm(
+		ast.NewTerm(queryResult),
+		ast.NewTerm(querySchema),
+	)
+
+	return iter(verified)
+}
+
+// Returns default value when errors occur.
+func builtinGraphQLParseAndVerify(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	var queryDoc *gqlast.QueryDocument
+	var schemaDoc *gqlast.SchemaDocument
+	var err error
+
+	unverified := ast.ArrayTerm(
+		ast.BooleanTerm(false),
+		ast.NewTerm(ast.NewObject()),
+		ast.NewTerm(ast.NewObject()),
+	)
+
+	// Parse/translate query if it's a string/object.
+	switch x := operands[0].Value.(type) {
+	case ast.String:
+		queryDoc, err = parseQuery(string(x))
+	case ast.Object:
+		queryDoc, err = objectToQueryDocument(x)
+	default:
+		// Error if wrong type.
+		return iter(unverified)
+	}
+	if err != nil {
+		return iter(unverified)
+	}
+
+	// Parse/translate schema if it's a string/object.
+	switch x := operands[1].Value.(type) {
+	case ast.String:
+		schemaDoc, err = parseSchema(string(x))
+	case ast.Object:
+		schemaDoc, err = objectToSchemaDocument(x)
+	default:
+		// Error if wrong type.
+		return iter(unverified)
+	}
+	if err != nil {
+		return iter(unverified)
+	}
+
+	// Transform the ASTs into Objects.
+	queryASTValue, err := ast.InterfaceToValue(queryDoc)
+	if err != nil {
+		return iter(unverified)
+	}
+	schemaASTValue, err := ast.InterfaceToValue(schemaDoc)
+	if err != nil {
+		return iter(unverified)
+	}
+
+	// Validate the query against the schema, erroring if there's an issue.
+	schema, err := convertSchema(schemaDoc)
+	if err != nil {
+		return iter(unverified)
+	}
+	if err := validateQuery(schema, queryDoc); err != nil {
+		return iter(unverified)
+	}
+
+	// Recursively remove irrelevant AST structures.
+	queryResult := pruneIrrelevantGraphQLASTNodes(queryASTValue.(ast.Object))
+	querySchema := pruneIrrelevantGraphQLASTNodes(schemaASTValue.(ast.Object))
+
+	// Construct return value.
+	verified := ast.ArrayTerm(
+		ast.BooleanTerm(true),
+		ast.NewTerm(queryResult),
+		ast.NewTerm(querySchema),
+	)
+
+	return iter(verified)
+}
+
+func builtinGraphQLParseQuery(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	raw, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	// Get the highly-nested AST struct, along with any errors generated.
+	query, err := parseQuery(string(raw))
+	if err != nil {
+		return err
+	}
+
+	// Transform the AST into an Object.
+	value, err := ast.InterfaceToValue(query)
+	if err != nil {
+		return err
+	}
+
+	// Recursively remove irrelevant AST structures.
+	result := pruneIrrelevantGraphQLASTNodes(value.(ast.Object))
+
+	return iter(ast.NewTerm(result))
+}
+
+func builtinGraphQLParseSchema(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	raw, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	// Get the highly-nested AST struct, along with any errors generated.
+	schema, err := parseSchema(string(raw))
+	if err != nil {
+		return err
+	}
+
+	// Transform the AST into an Object.
+	value, err := ast.InterfaceToValue(schema)
+	if err != nil {
+		return err
+	}
+
+	// Recursively remove irrelevant AST structures.
+	result := pruneIrrelevantGraphQLASTNodes(value.(ast.Object))
+
+	return iter(ast.NewTerm(result))
+}
+
+func builtinGraphQLIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	var queryDoc *gqlast.QueryDocument
+	var schemaDoc *gqlast.SchemaDocument
+	var err error
+
+	switch x := operands[0].Value.(type) {
+	case ast.String:
+		queryDoc, err = parseQuery(string(x))
+	case ast.Object:
+		queryDoc, err = objectToQueryDocument(x)
+	default:
+		// Error if wrong type.
+		return iter(ast.BooleanTerm(false))
+	}
+	if err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+
+	switch x := operands[1].Value.(type) {
+	case ast.String:
+		schemaDoc, err = parseSchema(string(x))
+	case ast.Object:
+		schemaDoc, err = objectToSchemaDocument(x)
+	default:
+		// Error if wrong type.
+		return iter(ast.BooleanTerm(false))
+	}
+	if err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+
+	// Validate the query against the schema, erroring if there's an issue.
+	schema, err := convertSchema(schemaDoc)
+	if err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+	if err := validateQuery(schema, queryDoc); err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+
+	// If we got this far, the GraphQL query passed validation.
+	return iter(ast.BooleanTerm(true))
+}
+
+func builtinGraphQLSchemaIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	var schemaDoc *gqlast.SchemaDocument
+	var err error
+
+	switch x := operands[0].Value.(type) {
+	case ast.String:
+		schemaDoc, err = parseSchema(string(x))
+	case ast.Object:
+		schemaDoc, err = objectToSchemaDocument(x)
+	default:
+		// Error if wrong type.
+		return iter(ast.BooleanTerm(false))
+	}
+	if err != nil {
+		return iter(ast.BooleanTerm(false))
+	}
+
+	// Validate the schema, this determines the result
+	_, err = convertSchema(schemaDoc)
+	return iter(ast.BooleanTerm(err == nil))
+}
+
+func init() {
+	RegisterBuiltinFunc(ast.GraphQLParse.Name, builtinGraphQLParse)
+	RegisterBuiltinFunc(ast.GraphQLParseAndVerify.Name, builtinGraphQLParseAndVerify)
+	RegisterBuiltinFunc(ast.GraphQLParseQuery.Name, builtinGraphQLParseQuery)
+	RegisterBuiltinFunc(ast.GraphQLParseSchema.Name, builtinGraphQLParseSchema)
+	RegisterBuiltinFunc(ast.GraphQLIsValid.Name, builtinGraphQLIsValid)
+	RegisterBuiltinFunc(ast.GraphQLSchemaIsValid.Name, builtinGraphQLSchemaIsValid)
+}
diff --git a/topdown/http.go b/topdown/http.go
index 6b9b15ce60..081646b1af 100644
--- a/topdown/http.go
+++ b/topdown/http.go
@@ -11,7 +11,7 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"math"
 	"net"
 	"net/http"
@@ -26,6 +26,7 @@ import (
 	"github.com/open-policy-agent/opa/internal/version"
 	"github.com/open-policy-agent/opa/topdown/builtins"
 	"github.com/open-policy-agent/opa/topdown/cache"
+	"github.com/open-policy-agent/opa/tracing"
 	"github.com/open-policy-agent/opa/util"
 )
 
@@ -45,6 +46,7 @@ var allowedKeyNames = [...]string{
 	"body",
 	"enable_redirect",
 	"force_json_decode",
+	"force_yaml_decode",
 	"headers",
 	"raw_body",
 	"tls_use_system_certs",
@@ -65,10 +67,27 @@ var allowedKeyNames = [...]string{
 	"force_cache_duration_seconds",
 	"raise_error",
 	"caching_mode",
+	"max_retry_attempts",
+}
+
+// ref: https://www.rfc-editor.org/rfc/rfc7231#section-6.1
+var cacheableHTTPStatusCodes = [...]int{
+	http.StatusOK,
+	http.StatusNonAuthoritativeInfo,
+	http.StatusNoContent,
+	http.StatusPartialContent,
+	http.StatusMultipleChoices,
+	http.StatusMovedPermanently,
+	http.StatusNotFound,
+	http.StatusMethodNotAllowed,
+	http.StatusGone,
+	http.StatusRequestURITooLong,
+	http.StatusNotImplemented,
 }
 
 var (
 	allowedKeys                 = ast.NewSet()
+	cacheableCodes              = ast.NewSet()
 	requiredKeys                = ast.NewSet(ast.StringTerm("method"), ast.StringTerm("url"))
 	httpSendLatencyMetricKey    = "rego_builtin_" + strings.ReplaceAll(ast.HTTPSend.Name, ".", "_")
 	httpSendInterQueryCacheHits = httpSendLatencyMetricKey + "_interquery_cache_hits"
@@ -86,10 +105,16 @@ const (
 
 	// HTTPSendNetworkErr represents a network error.
 	HTTPSendNetworkErr string = "eval_http_send_network_error"
+
+	// minRetryDelay is amount of time to backoff after the first failure.
+	minRetryDelay = time.Millisecond * 100
+
+	// maxRetryDelay is the upper bound of backoff delay.
+	maxRetryDelay = time.Second * 60
 )
 
-func builtinHTTPSend(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	req, err := validateHTTPRequestOperand(args[0], 1)
+func builtinHTTPSend(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	req, err := validateHTTPRequestOperand(operands[0], 1)
 	if err != nil {
 		return handleBuiltinErr(ast.HTTPSend.Name, bctx.Location, err)
 	}
@@ -134,7 +159,7 @@ func getHTTPResponse(bctx BuiltinContext, req ast.Object) (*ast.Term, error) {
 		return nil, err
 	}
 
-	// check if cache already has a response for this query
+	// Check if cache already has a response for this query
 	resp, err := reqExecutor.CheckCache()
 	if err != nil {
 		return nil, err
@@ -143,10 +168,11 @@ func getHTTPResponse(bctx BuiltinContext, req ast.Object) (*ast.Term, error) {
 	if resp == nil {
 		httpResp, err := reqExecutor.ExecuteHTTPRequest()
 		if err != nil {
+			reqExecutor.InsertErrorIntoCache(err)
 			return nil, err
 		}
 		defer util.Close(httpResp)
-		// add result to cache
+		// Add result to intra/inter-query cache.
 		resp, err = reqExecutor.InsertIntoCache(httpResp)
 		if err != nil {
 			return nil, err
@@ -160,6 +186,7 @@ func getHTTPResponse(bctx BuiltinContext, req ast.Object) (*ast.Term, error) {
 
 func init() {
 	createAllowedKeys()
+	createCacheableHTTPStatusCodes()
 	initDefaults()
 	RegisterBuiltinFunc(ast.HTTPSend.Name, builtinHTTPSend)
 }
@@ -235,7 +262,7 @@ func canonicalizeHeaders(headers map[string]interface{}) map[string]interface{}
 // useSocket examines the url for "unix://" and returns a *http.Transport with
 // a DialContext that opens a socket (specified in the http call).
 // The url is expected to contain socket=/path/to/socket (url encoded)
-// Ex. "unix:localhost/end/point?socket=%2Ftmp%2Fhttp.sock"
+// Ex. "unix://localhost/end/point?socket=%2Ftmp%2Fhttp.sock"
 func useSocket(rawURL string, tlsConfig *tls.Config) (bool, string, *http.Transport) {
 	u, err := url.Parse(rawURL)
 	if err != nil {
@@ -246,21 +273,59 @@ func useSocket(rawURL string, tlsConfig *tls.Config) (bool, string, *http.Transp
 		return false, rawURL, nil
 	}
 
-	// Get the path to the socket
 	v, err := url.ParseQuery(u.RawQuery)
 	if err != nil {
 		return false, rawURL, nil
 	}
 
+	// Rewrite URL targeting the UNIX domain socket.
+	u.Scheme = "http"
+
+	// Extract the path to the socket.
+	// Only retrieve the first value. Subsequent values are ignored and removed
+	// to prevent HTTP parameter pollution.
+	socket := v.Get("socket")
+	v.Del("socket")
+	u.RawQuery = v.Encode()
+
 	tr := http.DefaultTransport.(*http.Transport).Clone()
 	tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
-		return http.DefaultTransport.(*http.Transport).DialContext(ctx, u.Scheme, v.Get("socket"))
+		return http.DefaultTransport.(*http.Transport).DialContext(ctx, "unix", socket)
 	}
 	tr.TLSClientConfig = tlsConfig
 	tr.DisableKeepAlives = true
 
-	rawURL = strings.Replace(rawURL, "unix:", "http:", 1)
-	return true, rawURL, tr
+	return true, u.String(), tr
+}
+
+func verifyHost(bctx BuiltinContext, host string) error {
+	if bctx.Capabilities == nil || bctx.Capabilities.AllowNet == nil {
+		return nil
+	}
+
+	for _, allowed := range bctx.Capabilities.AllowNet {
+		if allowed == host {
+			return nil
+		}
+	}
+
+	return fmt.Errorf("unallowed host: %s", host)
+}
+
+func verifyURLHost(bctx BuiltinContext, unverifiedURL string) error {
+	// Eager return to avoid unnecessary URL parsing
+	if bctx.Capabilities == nil || bctx.Capabilities.AllowNet == nil {
+		return nil
+	}
+
+	parsedURL, err := url.Parse(unverifiedURL)
+	if err != nil {
+		return err
+	}
+
+	host := strings.Split(parsedURL.Host, ":")[0]
+
+	return verifyHost(bctx, host)
 }
 
 func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *http.Client, error) {
@@ -304,7 +369,7 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 		var strVal string
 
 		if s, ok := obj.Get(val).Value.(ast.String); ok {
-			strVal = string(s)
+			strVal = strings.Trim(string(s), "\"")
 		} else {
 			// Most parameters are strings, so consolidate the type checking.
 			switch key {
@@ -327,9 +392,13 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 
 		switch key {
 		case "method":
-			method = strings.ToUpper(strings.Trim(strVal, "\""))
+			method = strings.ToUpper(strVal)
 		case "url":
-			url = strings.Trim(strVal, "\"")
+			err := verifyURLHost(bctx, strVal)
+			if err != nil {
+				return nil, nil, err
+			}
+			url = strVal
 		case "enable_redirect":
 			enableRedirect, err = strconv.ParseBool(obj.Get(val).String())
 			if err != nil {
@@ -356,25 +425,25 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 			}
 			tlsUseSystemCerts = &tempTLSUseSystemCerts
 		case "tls_ca_cert":
-			tlsCaCert = bytes.Trim([]byte(strVal), "\"")
+			tlsCaCert = []byte(strVal)
 		case "tls_ca_cert_file":
-			tlsCaCertFile = strings.Trim(strVal, "\"")
+			tlsCaCertFile = strVal
 		case "tls_ca_cert_env_variable":
-			tlsCaCertEnvVar = strings.Trim(strVal, "\"")
+			tlsCaCertEnvVar = strVal
 		case "tls_client_cert":
-			tlsClientCert = bytes.Trim([]byte(strVal), "\"")
+			tlsClientCert = []byte(strVal)
 		case "tls_client_cert_file":
-			tlsClientCertFile = strings.Trim(strVal, "\"")
+			tlsClientCertFile = strVal
 		case "tls_client_cert_env_variable":
-			tlsClientCertEnvVar = strings.Trim(strVal, "\"")
+			tlsClientCertEnvVar = strVal
 		case "tls_client_key":
-			tlsClientKey = bytes.Trim([]byte(strVal), "\"")
+			tlsClientKey = []byte(strVal)
 		case "tls_client_key_file":
-			tlsClientKeyFile = strings.Trim(strVal, "\"")
+			tlsClientKeyFile = strVal
 		case "tls_client_key_env_variable":
-			tlsClientKeyEnvVar = strings.Trim(strVal, "\"")
+			tlsClientKeyEnvVar = strVal
 		case "tls_server_name":
-			tlsServerName = strings.Trim(strVal, "\"")
+			tlsServerName = strVal
 		case "headers":
 			headersVal := obj.Get(val).Value
 			headersValInterface, err := ast.JSON(headersVal)
@@ -396,7 +465,10 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 			if err != nil {
 				return nil, nil, err
 			}
-		case "cache", "force_cache", "force_cache_duration_seconds", "force_json_decode", "raise_error", "caching_mode": // no-op
+		case "cache", "caching_mode",
+			"force_cache", "force_cache_duration_seconds",
+			"force_json_decode", "force_yaml_decode",
+			"raise_error", "max_retry_attempts": // no-op
 		default:
 			return nil, nil, fmt.Errorf("invalid parameter %q", key)
 		}
@@ -405,6 +477,9 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 	isTLS := false
 	client := &http.Client{
 		Timeout: timeout,
+		CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
 	}
 
 	if tlsInsecureSkipVerify {
@@ -466,7 +541,7 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 
 	if len(tlsCaCert) != 0 {
 		tlsCaCert = bytes.Replace(tlsCaCert, []byte("\\n"), []byte("\n"), -1)
-		pool, err := addCACertsFromBytes(tlsConfig.RootCAs, []byte(tlsCaCert))
+		pool, err := addCACertsFromBytes(tlsConfig.RootCAs, tlsCaCert)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -513,9 +588,9 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 	}
 
 	// check if redirects are enabled
-	if !enableRedirect {
-		client.CheckRedirect = func(*http.Request, []*http.Request) error {
-			return http.ErrUseLastResponse
+	if enableRedirect {
+		client.CheckRedirect = func(req *http.Request, _ []*http.Request) error {
+			return verifyURLHost(bctx, req.URL.String())
 		}
 	}
 
@@ -572,52 +647,156 @@ func createHTTPRequest(bctx BuiltinContext, obj ast.Object) (*http.Request, *htt
 		tlsConfig.ServerName = tlsServerName
 	}
 
+	if len(bctx.DistributedTracingOpts) > 0 {
+		client.Transport = tracing.NewTransport(client.Transport, bctx.DistributedTracingOpts)
+	}
+
 	return req, client, nil
 }
 
-func executeHTTPRequest(req *http.Request, client *http.Client) (*http.Response, error) {
-	return client.Do(req)
+func executeHTTPRequest(req *http.Request, client *http.Client, inputReqObj ast.Object) (*http.Response, error) {
+	var err error
+	var retry int
+
+	retry, err = getNumberValFromReqObj(inputReqObj, ast.StringTerm("max_retry_attempts"))
+	if err != nil {
+		return nil, err
+	}
+
+	for i := 0; true; i++ {
+
+		var resp *http.Response
+		resp, err = client.Do(req)
+		if err == nil {
+			return resp, nil
+		}
+
+		// final attempt
+		if i == retry {
+			break
+		}
+
+		if err == context.Canceled {
+			return nil, err
+		}
+
+		select {
+		case <-time.After(util.DefaultBackoff(float64(minRetryDelay), float64(maxRetryDelay), i)):
+		case <-req.Context().Done():
+			return nil, context.Canceled
+		}
+	}
+	return nil, err
+}
+
+func isContentType(header http.Header, typ ...string) bool {
+	for _, t := range typ {
+		if strings.Contains(header.Get("Content-Type"), t) {
+			return true
+		}
+	}
+	return false
+}
+
+type httpSendCacheEntry struct {
+	response *ast.Value
+	error    error
+}
+
+// The httpSendCache is used for intra-query caching of http.send results.
+type httpSendCache struct {
+	entries *util.HashMap
+}
+
+func newHTTPSendCache() *httpSendCache {
+	return &httpSendCache{
+		entries: util.NewHashMap(valueEq, valueHash),
+	}
+}
+
+func valueHash(v util.T) int {
+	return v.(ast.Value).Hash()
+}
+
+func valueEq(a, b util.T) bool {
+	av := a.(ast.Value)
+	bv := b.(ast.Value)
+	return av.Compare(bv) == 0
+}
+
+func (cache *httpSendCache) get(k ast.Value) *httpSendCacheEntry {
+	if v, ok := cache.entries.Get(k); ok {
+		v := v.(httpSendCacheEntry)
+		return &v
+	}
+	return nil
+}
+
+func (cache *httpSendCache) putResponse(k ast.Value, v *ast.Value) {
+	cache.entries.Put(k, httpSendCacheEntry{response: v})
 }
 
-func isContentTypeJSON(header http.Header) bool {
-	return strings.Contains(header.Get("Content-Type"), "application/json")
+func (cache *httpSendCache) putError(k ast.Value, v error) {
+	cache.entries.Put(k, httpSendCacheEntry{error: v})
 }
 
 // In the BuiltinContext cache we only store a single entry that points to
 // our ValueMap which is the "real" http.send() cache.
-func getHTTPSendCache(bctx BuiltinContext) *ast.ValueMap {
+func getHTTPSendCache(bctx BuiltinContext) *httpSendCache {
 	raw, ok := bctx.Cache.Get(httpSendBuiltinCacheKey)
 	if !ok {
 		// Initialize if it isn't there
-		cache := ast.NewValueMap()
-		bctx.Cache.Put(httpSendBuiltinCacheKey, cache)
-		return cache
+		c := newHTTPSendCache()
+		bctx.Cache.Put(httpSendBuiltinCacheKey, c)
+		return c
 	}
 
-	cache, ok := raw.(*ast.ValueMap)
+	c, ok := raw.(*httpSendCache)
 	if !ok {
 		return nil
 	}
-	return cache
+	return c
 }
 
 // checkHTTPSendCache checks for the given key's value in the cache
-func checkHTTPSendCache(bctx BuiltinContext, key ast.Object) ast.Value {
+func checkHTTPSendCache(bctx BuiltinContext, key ast.Object) (ast.Value, error) {
 	requestCache := getHTTPSendCache(bctx)
 	if requestCache == nil {
-		return nil
+		return nil, nil
+	}
+
+	v := requestCache.get(key)
+	if v != nil {
+		if v.error != nil {
+			return nil, v.error
+		}
+		if v.response != nil {
+			return *v.response, nil
+		}
+		// This should never happen
 	}
 
-	return requestCache.Get(key)
+	return nil, nil
 }
 
 func insertIntoHTTPSendCache(bctx BuiltinContext, key ast.Object, value ast.Value) {
 	requestCache := getHTTPSendCache(bctx)
 	if requestCache == nil {
 		// Should never happen.. if it does just skip caching the value
+		// FIXME: return error instead, to prevent inconsistencies?
 		return
 	}
-	requestCache.Put(key, value)
+	requestCache.putResponse(key, &value)
+}
+
+func insertErrorIntoHTTPSendCache(bctx BuiltinContext, key ast.Object, err error) {
+	requestCache := getHTTPSendCache(bctx)
+	if requestCache == nil {
+		// Should never happen.. if it does just skip caching the value
+		// FIXME: return error instead, to prevent inconsistencies?
+		return
+	}
+	requestCache.putError(key, err)
 }
 
 // checkHTTPSendInterQueryCache checks for the given key's value in the inter-query cache
@@ -644,25 +823,25 @@ func (c *interQueryCache) checkHTTPSendInterQueryCache() (ast.Value, error) {
 		return nil, nil
 	}
 
-	headers, err := parseResponseHeaders(cachedRespData.Headers)
-	if err != nil {
-		return nil, err
-	}
-
-	// check the freshness of the cached response
-	if isCachedResponseFresh(c.bctx, headers, c.forceCacheParams) {
-		return cachedRespData.formatToAST(c.forceJSONDecode)
+	if getCurrentTime(c.bctx).Before(cachedRespData.ExpiresAt) {
+		return cachedRespData.formatToAST(c.forceJSONDecode, c.forceYAMLDecode)
 	}
 
+	var err error
 	c.httpReq, c.httpClient, err = createHTTPRequest(c.bctx, c.key)
 	if err != nil {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
 
+	headers, err := parseResponseHeaders(cachedRespData.Headers)
+	if err != nil {
+		return nil, err
+	}
+
 	// check with the server if the stale response is still up-to-date.
 	// If server returns a new response (ie. status_code=200), update the cache with the new response
 	// If server returns an unmodified response (ie. status_code=304), update the headers for the existing response
-	result, modified, err := revalidateCachedResponse(c.httpReq, c.httpClient, headers)
+	result, modified, err := revalidateCachedResponse(c.httpReq, c.httpClient, c.key, headers)
 	requestCache.Delete(c.key)
 	if err != nil || result == nil {
 		return nil, err
@@ -679,6 +858,12 @@ func (c *interQueryCache) checkHTTPSendInterQueryCache() (ast.Value, error) {
 			}
 		}
 
+		expiresAt, err := expiryFromHeaders(result.Header)
+		if err != nil {
+			return nil, err
+		}
+		cachedRespData.ExpiresAt = expiresAt
+
 		cachingMode, err := getCachingMode(c.key)
 		if err != nil {
 			return nil, err
@@ -697,16 +882,15 @@ func (c *interQueryCache) checkHTTPSendInterQueryCache() (ast.Value, error) {
 
 		c.bctx.InterQueryBuiltinCache.Insert(c.key, pcv)
 
-		return cachedRespData.formatToAST(c.forceJSONDecode)
+		return cachedRespData.formatToAST(c.forceJSONDecode, c.forceYAMLDecode)
 	}
 
-	newValue, respBody, err := formatHTTPResponseToAST(result, c.forceJSONDecode)
+	newValue, respBody, err := formatHTTPResponseToAST(result, c.forceJSONDecode, c.forceYAMLDecode)
 	if err != nil {
 		return nil, err
 	}
 
-	err = insertIntoHTTPSendInterQueryCache(c.bctx, c.key, result, respBody, c.forceCacheParams != nil)
-	if err != nil {
+	if err := insertIntoHTTPSendInterQueryCache(c.bctx, c.key, result, respBody, c.forceCacheParams); err != nil {
 		return nil, err
 	}
 
@@ -714,8 +898,8 @@ func (c *interQueryCache) checkHTTPSendInterQueryCache() (ast.Value, error) {
 }
 
 // insertIntoHTTPSendInterQueryCache inserts given key and value in the inter-query cache
-func insertIntoHTTPSendInterQueryCache(bctx BuiltinContext, key ast.Value, resp *http.Response, respBody []byte, force bool) error {
-	if resp == nil || (!force && !canStore(resp.Header)) {
+func insertIntoHTTPSendInterQueryCache(bctx BuiltinContext, key ast.Value, resp *http.Response, respBody []byte, cacheParams *forceCacheParams) error {
+	if resp == nil || (!forceCaching(cacheParams) && !canStore(resp.Header)) || !cacheableCodes.Contains(ast.IntNumberTerm(resp.StatusCode)) {
 		return nil
 	}
 
@@ -734,9 +918,9 @@ func insertIntoHTTPSendInterQueryCache(bctx BuiltinContext, key ast.Value, resp
 	var pcv cache.InterQueryCacheValue
 
 	if cachingMode == defaultCachingMode {
-		pcv, err = newInterQueryCacheValue(resp, respBody)
+		pcv, err = newInterQueryCacheValue(bctx, resp, respBody, cacheParams)
 	} else {
-		pcv, err = newInterQueryCacheData(resp, respBody)
+		pcv, err = newInterQueryCacheData(bctx, resp, respBody, cacheParams)
 	}
 
 	if err != nil {
@@ -753,6 +937,12 @@ func createAllowedKeys() {
 	}
 }
 
+func createCacheableHTTPStatusCodes() {
+	for _, element := range cacheableHTTPStatusCodes {
+		cacheableCodes.Add(ast.IntNumberTerm(element))
+	}
+}
+
 func parseTimeout(timeoutVal ast.Value) (time.Duration, error) {
 	var timeout time.Duration
 	switch t := timeoutVal.(type) {
@@ -792,6 +982,23 @@ func getBoolValFromReqObj(req ast.Object, key *ast.Term) (bool, error) {
 	return bool(b), nil
 }
 
+func getNumberValFromReqObj(req ast.Object, key *ast.Term) (int, error) {
+	term := req.Get(key)
+	if term == nil {
+		return 0, nil
+	}
+
+	if t, ok := term.Value.(ast.Number); ok {
+		num, ok := t.Int()
+		if !ok || num < 0 {
+			return 0, fmt.Errorf("invalid value %v for field %v", t.String(), key.String())
+		}
+		return num, nil
+	}
+
+	return 0, fmt.Errorf("invalid value %v for field %v", term.String(), key.String())
+}
+
 func getCachingMode(req ast.Object) (cachingMode, error) {
 	key := ast.StringTerm("caching_mode")
 	var s ast.String
@@ -808,15 +1015,15 @@ func getCachingMode(req ast.Object) (cachingMode, error) {
 			return "", fmt.Errorf("invalid value specified for %v field: %v", key.String(), string(s))
 		}
 	}
-	return cachingMode(defaultCachingMode), nil
+	return defaultCachingMode, nil
 }
 
 type interQueryCacheValue struct {
 	Data []byte
 }
 
-func newInterQueryCacheValue(resp *http.Response, respBody []byte) (*interQueryCacheValue, error) {
-	data, err := newInterQueryCacheData(resp, respBody)
+func newInterQueryCacheValue(bctx BuiltinContext, resp *http.Response, respBody []byte, cacheParams *forceCacheParams) (*interQueryCacheValue, error) {
+	data, err := newInterQueryCacheData(bctx, resp, respBody, cacheParams)
 	if err != nil {
 		return nil, err
 	}
@@ -846,15 +1053,48 @@ type interQueryCacheData struct {
 	Status     string
 	StatusCode int
 	Headers    http.Header
+	ExpiresAt  time.Time
+}
+
+func forceCaching(cacheParams *forceCacheParams) bool {
+	return cacheParams != nil && cacheParams.forceCacheDurationSeconds > 0
 }
 
-func newInterQueryCacheData(resp *http.Response, respBody []byte) (*interQueryCacheData, error) {
-	_, err := parseResponseHeaders(resp.Header)
+func expiryFromHeaders(headers http.Header) (time.Time, error) {
+	var expiresAt time.Time
+	maxAge, err := parseMaxAgeCacheDirective(parseCacheControlHeader(headers))
 	if err != nil {
-		return nil, err
+		return time.Time{}, err
+	}
+	if maxAge != -1 {
+		createdAt, err := getResponseHeaderDate(headers)
+		if err != nil {
+			return time.Time{}, err
+		}
+		expiresAt = createdAt.Add(time.Second * time.Duration(maxAge))
+	} else {
+		expiresAt = getResponseHeaderExpires(headers)
+	}
+	return expiresAt, nil
+}
+
+func newInterQueryCacheData(bctx BuiltinContext, resp *http.Response, respBody []byte, cacheParams *forceCacheParams) (*interQueryCacheData, error) {
+	var expiresAt time.Time
+
+	if forceCaching(cacheParams) {
+		createdAt := getCurrentTime(bctx)
+		expiresAt = createdAt.Add(time.Second * time.Duration(cacheParams.forceCacheDurationSeconds))
+	} else {
+		var err error
+		expiresAt, err = expiryFromHeaders(resp.Header)
+		if err != nil {
+			return nil, err
+		}
 	}
 
-	cv := interQueryCacheData{RespBody: respBody,
+	cv := interQueryCacheData{
+		ExpiresAt:  expiresAt,
+		RespBody:   respBody,
 		Status:     resp.Status,
 		StatusCode: resp.StatusCode,
 		Headers:    resp.Header}
@@ -862,8 +1102,8 @@ func newInterQueryCacheData(resp *http.Response, respBody []byte) (*interQueryCa
 	return &cv, nil
 }
 
-func (c *interQueryCacheData) formatToAST(forceJSONDecode bool) (ast.Value, error) {
-	return prepareASTResult(c.Headers, forceJSONDecode, c.RespBody, c.Status, c.StatusCode)
+func (c *interQueryCacheData) formatToAST(forceJSONDecode, forceYAMLDecode bool) (ast.Value, error) {
+	return prepareASTResult(c.Headers, forceJSONDecode, forceYAMLDecode, c.RespBody, c.Status, c.StatusCode)
 }
 
 func (c *interQueryCacheData) toCacheValue() (*interQueryCacheValue, error) {
@@ -915,7 +1155,7 @@ func parseResponseHeaders(headers http.Header) (*responseHeaders, error) {
 	return &result, nil
 }
 
-func revalidateCachedResponse(req *http.Request, client *http.Client, headers *responseHeaders) (*http.Response, bool, error) {
+func revalidateCachedResponse(req *http.Request, client *http.Client, inputReqObj ast.Object, headers *responseHeaders) (*http.Response, bool, error) {
 	etag := headers.etag
 	lastModified := headers.lastModified
 
@@ -933,7 +1173,7 @@ func revalidateCachedResponse(req *http.Request, client *http.Client, headers *r
 		cloneReq.Header.Set("if-modified-since", lastModified)
 	}
 
-	response, err := client.Do(cloneReq)
+	response, err := executeHTTPRequest(cloneReq, client, inputReqObj)
 	if err != nil {
 		return nil, false, err
 	}
@@ -961,58 +1201,6 @@ func canStore(headers http.Header) bool {
 	return true
 }
 
-func isCachedResponseFresh(bctx BuiltinContext, headers *responseHeaders, cacheParams *forceCacheParams) bool {
-	if headers.date.IsZero() {
-		return false
-	}
-
-	currentTime := getCurrentTime(bctx)
-	if currentTime.IsZero() {
-		return false
-	}
-
-	currentAge := currentTime.Sub(headers.date)
-
-	// The time.Sub operation uses wall clock readings and
-	// not monotonic clock readings as the parsed version of the response time
-	// does not contain monotonic clock readings. This can result in negative durations.
-	// Another scenario where a negative duration can occur, is when a server sets the Date
-	// response header. As per https://tools.ietf.org/html/rfc7231#section-7.1.1.2,
-	// an origin server MUST NOT send a Date header field if it does not
-	// have a clock capable of providing a reasonable approximation of the
-	// current instance in Coordinated Universal Time.
-	// Hence, consider the cached response as stale if a negative duration is encountered.
-	if currentAge < 0 {
-		return false
-	}
-
-	if cacheParams != nil {
-		// override the cache directives set by the server
-		maxAgeDur := time.Second * time.Duration(cacheParams.forceCacheDurationSeconds)
-		if maxAgeDur > currentAge {
-			return true
-		}
-	} else {
-		// Check "max-age" cache directive.
-		// The "max-age" response directive indicates that the response is to be
-		// considered stale after its age is greater than the specified number
-		// of seconds.
-		if headers.maxAge != -1 {
-			maxAgeDur := time.Second * time.Duration(headers.maxAge)
-			if maxAgeDur > currentAge {
-				return true
-			}
-		} else {
-			// Check "Expires" header.
-			// Note: "max-age" if set, takes precedence over "Expires"
-			if headers.expires.Sub(headers.date) > currentAge {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 func getCurrentTime(bctx BuiltinContext) time.Time {
 	var current time.Time
 
@@ -1106,14 +1294,14 @@ func parseMaxAgeCacheDirective(cc map[string]string) (deltaSeconds, error) {
 	return deltaSeconds(val), nil
 }
 
-func formatHTTPResponseToAST(resp *http.Response, forceJSONDecode bool) (ast.Value, []byte, error) {
+func formatHTTPResponseToAST(resp *http.Response, forceJSONDecode, forceYAMLDecode bool) (ast.Value, []byte, error) {
 
-	resultRawBody, err := ioutil.ReadAll(resp.Body)
+	resultRawBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, nil, err
 	}
 
-	resultObj, err := prepareASTResult(resp.Header, forceJSONDecode, resultRawBody, resp.Status, resp.StatusCode)
+	resultObj, err := prepareASTResult(resp.Header, forceJSONDecode, forceYAMLDecode, resultRawBody, resp.Status, resp.StatusCode)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -1121,14 +1309,17 @@ func formatHTTPResponseToAST(resp *http.Response, forceJSONDecode bool) (ast.Val
 	return resultObj, resultRawBody, nil
 }
 
-func prepareASTResult(headers http.Header, forceJSONDecode bool, body []byte, status string, statusCode int) (ast.Value, error) {
+func prepareASTResult(headers http.Header, forceJSONDecode, forceYAMLDecode bool, body []byte, status string, statusCode int) (ast.Value, error) {
 	var resultBody interface{}
 
-	// If the response body cannot be JSON decoded,
-	// an error will not be returned. Instead the "body" field
+	// If the response body cannot be JSON/YAML decoded,
+	// an error will not be returned. Instead, the "body" field
 	// in the result will be null.
-	if isContentTypeJSON(headers) || forceJSONDecode {
+	switch {
+	case forceJSONDecode || isContentType(headers, "application/json"):
 		_ = util.UnmarshalJSON(body, &resultBody)
+	case forceYAMLDecode || isContentType(headers, "application/yaml", "application/x-yaml"):
+		_ = util.Unmarshal(body, &resultBody)
 	}
 
 	result := make(map[string]interface{})
@@ -1162,6 +1353,7 @@ func getResponseHeaders(headers http.Header) map[string]interface{} {
 type httpRequestExecutor interface {
 	CheckCache() (ast.Value, error)
 	InsertIntoCache(value *http.Response) (ast.Value, error)
+	InsertErrorIntoCache(err error)
 	ExecuteHTTPRequest() (*http.Response, error)
 }
 
@@ -1185,6 +1377,7 @@ type interQueryCache struct {
 	httpReq          *http.Request
 	httpClient       *http.Client
 	forceJSONDecode  bool
+	forceYAMLDecode  bool
 	forceCacheParams *forceCacheParams
 }
 
@@ -1196,37 +1389,55 @@ func newInterQueryCache(bctx BuiltinContext, key ast.Object, forceCacheParams *f
 func (c *interQueryCache) CheckCache() (ast.Value, error) {
 	var err error
 
+	// Checking the intra-query cache first ensures consistency of errors and HTTP responses within a query.
+	resp, err := checkHTTPSendCache(c.bctx, c.key)
+	if err != nil {
+		return nil, err
+	}
+	if resp != nil {
+		return resp, nil
+	}
+
 	c.forceJSONDecode, err = getBoolValFromReqObj(c.key, ast.StringTerm("force_json_decode"))
 	if err != nil {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
-
-	resp, err := c.checkHTTPSendInterQueryCache()
-
-	// fallback to the http send cache if response not found in the inter-query cache or inter-query cache look-up results
-	// in an error
-	if resp == nil || err != nil {
-		return checkHTTPSendCache(c.bctx, c.key), nil
+	c.forceYAMLDecode, err = getBoolValFromReqObj(c.key, ast.StringTerm("force_yaml_decode"))
+	if err != nil {
+		return nil, handleHTTPSendErr(c.bctx, err)
 	}
 
+	resp, err = c.checkHTTPSendInterQueryCache()
+	// Always insert the result of the inter-query cache into the intra-query cache, to maintain consistency within the same query.
+	if err != nil {
+		insertErrorIntoHTTPSendCache(c.bctx, c.key, err)
+	}
+	if resp != nil {
+		insertIntoHTTPSendCache(c.bctx, c.key, resp)
+	}
 	return resp, err
 }
 
 // InsertIntoCache inserts the key set on this object into the cache with the given value
 func (c *interQueryCache) InsertIntoCache(value *http.Response) (ast.Value, error) {
-	result, respBody, err := formatHTTPResponseToAST(value, c.forceJSONDecode)
+	result, respBody, err := formatHTTPResponseToAST(value, c.forceJSONDecode, c.forceYAMLDecode)
 	if err != nil {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
 
-	// fallback to the http send cache if error encountered while inserting response in inter-query cache
-	err = insertIntoHTTPSendInterQueryCache(c.bctx, c.key, value, respBody, c.forceCacheParams != nil)
-	if err != nil {
-		insertIntoHTTPSendCache(c.bctx, c.key, result)
-	}
+	// Always insert into the intra-query cache, to maintain consistency within the same query.
+	insertIntoHTTPSendCache(c.bctx, c.key, result)
+
+	// We ignore errors when populating the inter-query cache, because we've already populated the intra-cache,
+	// and query consistency is our primary concern.
+	_ = insertIntoHTTPSendInterQueryCache(c.bctx, c.key, value, respBody, c.forceCacheParams)
 	return result, nil
 }
 
+func (c *interQueryCache) InsertErrorIntoCache(err error) {
+	insertErrorIntoHTTPSendCache(c.bctx, c.key, err)
+}
+
 // ExecuteHTTPRequest executes a HTTP request
 func (c *interQueryCache) ExecuteHTTPRequest() (*http.Response, error) {
 	var err error
@@ -1235,7 +1446,7 @@ func (c *interQueryCache) ExecuteHTTPRequest() (*http.Response, error) {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
 
-	return executeHTTPRequest(c.httpReq, c.httpClient)
+	return executeHTTPRequest(c.httpReq, c.httpClient, c.key)
 }
 
 type intraQueryCache struct {
@@ -1249,7 +1460,7 @@ func newIntraQueryCache(bctx BuiltinContext, key ast.Object) (*intraQueryCache,
 
 // CheckCache checks the cache for the value of the key set on this object
 func (c *intraQueryCache) CheckCache() (ast.Value, error) {
-	return checkHTTPSendCache(c.bctx, c.key), nil
+	return checkHTTPSendCache(c.bctx, c.key)
 }
 
 // InsertIntoCache inserts the key set on this object into the cache with the given value
@@ -1258,23 +1469,34 @@ func (c *intraQueryCache) InsertIntoCache(value *http.Response) (ast.Value, erro
 	if err != nil {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
+	forceYAMLDecode, err := getBoolValFromReqObj(c.key, ast.StringTerm("force_yaml_decode"))
+	if err != nil {
+		return nil, handleHTTPSendErr(c.bctx, err)
+	}
 
-	result, _, err := formatHTTPResponseToAST(value, forceJSONDecode)
+	result, _, err := formatHTTPResponseToAST(value, forceJSONDecode, forceYAMLDecode)
 	if err != nil {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
 
-	insertIntoHTTPSendCache(c.bctx, c.key, result)
+	if cacheableCodes.Contains(ast.IntNumberTerm(value.StatusCode)) {
+		insertIntoHTTPSendCache(c.bctx, c.key, result)
+	}
+
 	return result, nil
 }
 
+func (c *intraQueryCache) InsertErrorIntoCache(err error) {
+	insertErrorIntoHTTPSendCache(c.bctx, c.key, err)
+}
+
 // ExecuteHTTPRequest executes a HTTP request
 func (c *intraQueryCache) ExecuteHTTPRequest() (*http.Response, error) {
 	httpReq, httpClient, err := createHTTPRequest(c.bctx, c.key)
 	if err != nil {
 		return nil, handleHTTPSendErr(c.bctx, err)
 	}
-	return executeHTTPRequest(httpReq, httpClient)
+	return executeHTTPRequest(httpReq, httpClient, c.key)
 }
 
 func useInterQueryCache(req ast.Object) (bool, *forceCacheParams, error) {
diff --git a/topdown/http_fixup.go b/topdown/http_fixup.go
new file mode 100644
index 0000000000..1b9ffc2350
--- /dev/null
+++ b/topdown/http_fixup.go
@@ -0,0 +1,8 @@
+//go:build !go1.18 || !darwin
+// +build !go1.18 !darwin
+
+package topdown
+
+func fixupDarwinGo118(x string, _ string) string {
+	return x
+}
diff --git a/topdown/http_fixup_darwin.go b/topdown/http_fixup_darwin.go
new file mode 100644
index 0000000000..ff3058ef40
--- /dev/null
+++ b/topdown/http_fixup_darwin.go
@@ -0,0 +1,13 @@
+//go:build go1.18
+// +build go1.18
+
+package topdown
+
+func fixupDarwinGo118(x, y string) string {
+	switch x {
+	case "x509: certificate signed by unknown authority":
+		return y
+	default:
+		return x
+	}
+}
diff --git a/topdown/http_slow_test.go b/topdown/http_slow_test.go
index 823c370083..521bcfa2ad 100644
--- a/topdown/http_slow_test.go
+++ b/topdown/http_slow_test.go
@@ -2,18 +2,22 @@
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
+//go:build slow
 // +build slow
 
 package topdown
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/open-policy-agent/opa/ast"
 )
 
 func TestHTTPSendTimeout(t *testing.T) {
@@ -117,3 +121,96 @@ func TestHTTPSendTimeout(t *testing.T) {
 		defaultHTTPRequestTimeout = originalDefaultTimeout
 	}
 }
+
+func TestHTTPSendRetryRequest(t *testing.T) {
+
+	tests := []struct {
+		note        string
+		query       string
+		response    string
+		evalTimeout time.Duration
+		cancel      Cancel
+		wantErr     bool
+		err         error
+	}{
+		{
+			note:     "success",
+			query:    `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "max_retry_attempts": 100,  "timeout": "500ms"}, x)`,
+			response: `{"x": 1}`,
+		},
+		{
+			note:        "eval timeout",
+			query:       `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "max_retry_attempts": 100,  "timeout": "500ms"}, x)`,
+			evalTimeout: 2 * time.Second,
+			wantErr:     true,
+			err:         fmt.Errorf("eval_cancel_error: http.send: timed out (context deadline exceeded)"),
+		},
+		{
+			note:    "cancel query",
+			query:   `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "max_retry_attempts": 100,  "timeout": "500ms"}, x)`,
+			cancel:  NewCancel(),
+			wantErr: true,
+			err:     fmt.Errorf("eval_cancel_error: caller cancelled query execution"),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				_, err := w.Write([]byte(tc.response))
+				if err != nil {
+					t.Fatal(err)
+				}
+			}))
+
+			defer ts.Close()
+
+			// delay server start to exercise retry logic
+			go func() {
+				time.Sleep(time.Second * 5)
+				ts.Start()
+			}()
+
+			ctx := context.Background()
+			if tc.evalTimeout > 0 {
+				ctx, _ = context.WithTimeout(ctx, tc.evalTimeout)
+			}
+
+			q := newQuery(strings.ReplaceAll(tc.query, "%URL%", "http://"+ts.Listener.Addr().String()), time.Now())
+
+			if tc.cancel != nil {
+				q.WithCancel(tc.cancel)
+
+				go func() {
+					time.Sleep(2 * time.Second)
+					tc.cancel.Cancel()
+				}()
+			}
+
+			res, err := q.Run(ctx)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatal("Expected error but got nil")
+				}
+
+				if tc.err != nil && tc.err.Error() != err.Error() {
+					t.Fatalf("Expected error message %v but got %v", tc.err.Error(), err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("Unexpected error %v", err)
+				}
+
+				if len(res) != 1 {
+					t.Fatalf("Expected one result but got %v", len(res))
+				}
+
+				resResponse := res[0]["x"].Value.(ast.Object).Get(ast.StringTerm("raw_body"))
+				if ast.String(tc.response).Compare(resResponse.Value) != 0 {
+					t.Fatalf("Expected response %v but got %v", tc.response, resResponse.String())
+				}
+			}
+		})
+	}
+}
diff --git a/topdown/http_test.go b/topdown/http_test.go
index e013c1de8d..860636079c 100644
--- a/topdown/http_test.go
+++ b/topdown/http_test.go
@@ -13,7 +13,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"math"
 	"net"
 	"net/http"
@@ -28,8 +28,12 @@ import (
 
 	"github.com/open-policy-agent/opa/internal/version"
 	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/topdown/builtins"
+	"github.com/open-policy-agent/opa/tracing"
+	"github.com/open-policy-agent/opa/util"
 
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	iCache "github.com/open-policy-agent/opa/topdown/cache"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -43,7 +47,6 @@ type Person struct {
 
 // TestHTTPGetRequest returns the list of persons
 func TestHTTPGetRequest(t *testing.T) {
-
 	var people []Person
 
 	// test data
@@ -75,10 +78,7 @@ func TestHTTPGetRequest(t *testing.T) {
 		"test-header":    []interface{}{"test-value"},
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
-	}
+	resultObj := ast.MustInterfaceToValue(expectedResult)
 
 	// run the test
 	tests := []struct {
@@ -101,7 +101,6 @@ func TestHTTPGetRequest(t *testing.T) {
 
 // TestHTTPGetRequest returns the list of persons
 func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
-
 	var people []Person
 
 	// test data
@@ -129,28 +128,24 @@ func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
 		"content-type":   []interface{}{"text/plain; charset=utf-8"},
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
+	resultObj := ast.MustInterfaceToValue(expectedResult)
+
+	type httpsStruct struct {
+		note     string
+		rules    []string
+		expected interface{}
 	}
 
 	// run the test
-	tests := []struct {
-		note          string
-		rules         []string
-		expected      interface{}
-		expectedError error
-	}{
-		{note: "http.send", rules: []string{fmt.Sprintf(
-			`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true}, x) }`, ts.URL)}, expected: &Error{Message: "x509: certificate signed by unknown authority"}},
-		{note: "http.send", rules: []string{fmt.Sprintf(
-			`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true}, resp); x := clean_headers(resp) }`, ts.URL)}, expected: resultObj.String()},
-		// This case verifies that `tls_insecure_skip_verify`
-		// is still applied, even if other TLS settings are
-		// present.
-		{note: "http.send", rules: []string{fmt.Sprintf(
-			`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true, "tls_use_system_certs": true,}, resp); x := clean_headers(resp) }`, ts.URL)}, expected: resultObj.String()},
-	}
+	tests := []httpsStruct{}
+	tests = append(tests, httpsStruct{note: "http.send", rules: []string{fmt.Sprintf(
+		`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true}, resp); x := clean_headers(resp) }`, ts.URL)}, expected: resultObj.String()})
+
+	// This case verifies that `tls_insecure_skip_verify`
+	// is still applied, even if other TLS settings are
+	// present.
+	tests = append(tests, httpsStruct{note: "http.send", rules: []string{fmt.Sprintf(
+		`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true, "tls_insecure_skip_verify": true, "tls_use_system_certs": true,}, resp); x := clean_headers(resp) }`, ts.URL)}, expected: resultObj.String()})
 
 	data := loadSmallTestData()
 
@@ -159,51 +154,147 @@ func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
 	}
 }
 
-func TestHTTPEnableJSONDecode(t *testing.T) {
-
-	// test server
+func TestHTTPEnableJSONOrYAMLDecode(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body := "*Hello World®"
-		fmt.Fprint(w, body)
+		switch r.URL.Path {
+		case "/json-no-header":
+			fmt.Fprintf(w, `{"foo":"bar"}`)
+		case "/yaml-no-header":
+			fmt.Fprintf(w, `foo: bar`)
+		case "/json":
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			fmt.Fprintf(w, `{"foo":"bar"}`)
+		case "/yaml":
+			w.Header().Set("Content-Type", "application/yaml")
+			w.WriteHeader(http.StatusOK)
+			fmt.Fprintf(w, `foo: bar`)
+		case "/x-yaml":
+			w.Header().Set("Content-Type", "application/x-yaml")
+			w.WriteHeader(http.StatusOK)
+			fmt.Fprintf(w, `foo: bar`)
+		case "/text-no-header":
+			fmt.Fprintf(w, "*Hello World®")
+		}
 	}))
 
 	defer ts.Close()
 
-	// expected result
-	expectedResult := make(map[string]interface{})
-	expectedResult["status"] = "200 OK"
-	expectedResult["status_code"] = http.StatusOK
-	expectedResult["body"] = nil
-	expectedResult["raw_body"] = "*Hello World®"
-	expectedResult["headers"] = map[string]interface{}{
-		"content-length": []interface{}{"14"},
-		"content-type":   []interface{}{"text/plain; charset=utf-8"},
+	body := func(b interface{}) func(map[string]interface{}) {
+		return func(x map[string]interface{}) {
+			x["body"] = b
+		}
+	}
+	rawBody := func(b interface{}) func(map[string]interface{}) {
+		return func(x map[string]interface{}) {
+			x["raw_body"] = b
+		}
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
+	headers := func(xs ...string) func(map[string]interface{}) {
+		hdrs := map[string]interface{}{}
+		for i := 0; i < len(xs)/2; i++ {
+			hdrs[xs[2*i]] = []interface{}{xs[2*i+1]}
+		}
+		return func(x map[string]interface{}) {
+			x["headers"] = hdrs
+		}
 	}
 
-	// run the test
+	ok := func(and ...func(map[string]interface{})) ast.Value {
+		o := map[string]interface{}{
+			"status":      "200 OK",
+			"status_code": http.StatusOK,
+		}
+		for _, a := range and {
+			a(o)
+		}
+		return ast.MustInterfaceToValue(o)
+	}
+
+	resultObjText := ok(
+		body(nil),
+		rawBody("*Hello World®"),
+		headers("content-length", "14", "content-type", "text/plain; charset=utf-8"),
+	)
+
 	tests := []struct {
 		note     string
-		rules    []string
-		expected interface{}
+		rule     string
+		expected ast.Value
 	}{
-		{"http.send", []string{fmt.Sprintf(
-			`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true}, resp); x := clean_headers(resp) }`, ts.URL)}, resultObj.String()},
+		{
+			note:     "text response, force json",
+			rule:     fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/text-no-header", "force_json_decode": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: resultObjText,
+		},
+		{
+			note:     "text response, force yaml",
+			rule:     fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/text-no-header", "force_yaml_decode": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: resultObjText,
+		},
+		{
+			note: "json response, proper header",
+			rule: fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/json"}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: ok(
+				body(map[string]interface{}{"foo": "bar"}),
+				rawBody(`{"foo":"bar"}`),
+				headers("content-length", "13", "content-type", "application/json"),
+			),
+		},
+		{
+			note: "yaml response, proper header",
+			rule: fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/yaml"}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: ok(
+				body(map[string]interface{}{"foo": "bar"}),
+				rawBody(`foo: bar`),
+				headers("content-length", "8", "content-type", "application/yaml"),
+			),
+		},
+		{
+			note: "yaml response, x-yaml header",
+			rule: fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/x-yaml"}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: ok(
+				body(map[string]interface{}{"foo": "bar"}),
+				rawBody(`foo: bar`),
+				headers("content-length", "8", "content-type", "application/x-yaml"),
+			),
+		},
+		{
+			note: "json response, no header",
+			rule: fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/json-no-header", "force_json_decode": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: ok(
+				body(map[string]interface{}{"foo": "bar"}),
+				rawBody(`{"foo":"bar"}`),
+				headers("content-length", "13", "content-type", "text/plain; charset=utf-8"),
+			),
+		},
+		{
+			note: "yaml response, no header",
+			rule: fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/yaml-no-header", "force_yaml_decode": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: ok(
+				body(map[string]interface{}{"foo": "bar"}),
+				rawBody(`foo: bar`),
+				headers("content-length", "8", "content-type", "text/plain; charset=utf-8"),
+			),
+		},
+		{
+			note: "json response, no header, yaml decode",
+			rule: fmt.Sprintf(`p = x { http.send({"method": "get", "url": "%s/json-no-header", "force_yaml_decode": true}, resp); x := clean_headers(resp) }`, ts.URL),
+			expected: ok(
+				body(map[string]interface{}{"foo": "bar"}),
+				rawBody(`{"foo":"bar"}`),
+				headers("content-length", "13", "content-type", "text/plain; charset=utf-8"),
+			),
+		},
 	}
 
-	data := loadSmallTestData()
-
 	for _, tc := range tests {
-		runTopDownTestCase(t, data, tc.note, append(tc.rules, httpSendHelperRules...), tc.expected)
+		runTopDownTestCase(t, map[string]interface{}{}, tc.note, append([]string{tc.rule}, httpSendHelperRules...), tc.expected.String())
 	}
 }
 
 func echoCustomHeaders(w http.ResponseWriter, r *http.Request) {
-
 	headers := make(map[string][]string)
 	w.Header().Set("Content-Type", "application/json")
 	for k, v := range r.Header {
@@ -216,7 +307,6 @@ func echoCustomHeaders(w http.ResponseWriter, r *http.Request) {
 
 // TestHTTPSendCustomRequestHeaders adds custom headers to request
 func TestHTTPSendCustomRequestHeaders(t *testing.T) {
-
 	// test server
 	ts := httptest.NewServer(http.HandlerFunc(echoCustomHeaders))
 	defer ts.Close()
@@ -269,7 +359,6 @@ func TestHTTPSendCustomRequestHeaders(t *testing.T) {
 
 // TestHTTPHostHeader tests Host header support
 func TestHTTPHostHeader(t *testing.T) {
-
 	// test server
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
@@ -307,12 +396,10 @@ func TestHTTPHostHeader(t *testing.T) {
 
 // TestHTTPPostRequest adds a new person
 func TestHTTPPostRequest(t *testing.T) {
-
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-
 		contentType := r.Header.Get("Content-Type")
 
-		bs, err := ioutil.ReadAll(r.Body)
+		bs, err := io.ReadAll(r.Body)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -333,7 +420,6 @@ func TestHTTPPostRequest(t *testing.T) {
 		respHeaders string
 		expected    interface{}
 	}{
-
 		{
 			note: "basic",
 			params: `{
@@ -410,7 +496,6 @@ func TestHTTPPostRequest(t *testing.T) {
 }
 
 func TestHTTPDeleteRequest(t *testing.T) {
-
 	var people []Person
 
 	// test data
@@ -419,7 +504,6 @@ func TestHTTPDeleteRequest(t *testing.T) {
 
 	// test server
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-
 		var person Person
 		if r.Body == nil {
 			http.Error(w, "Please send a request body", 400)
@@ -461,10 +545,7 @@ func TestHTTPDeleteRequest(t *testing.T) {
 		"content-type":   []interface{}{"application/json"},
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
-	}
+	resultObj := ast.MustInterfaceToValue(expectedResult)
 
 	// delete a new person
 	personToDelete := Person{ID: "2", Firstname: "Joe"}
@@ -491,7 +572,6 @@ func TestHTTPDeleteRequest(t *testing.T) {
 // TestInvalidKeyError returns an error when an invalid key is passed in the
 // http.send builtin
 func TestInvalidKeyError(t *testing.T) {
-
 	// run the test
 	tests := []struct {
 		note     string
@@ -509,6 +589,25 @@ func TestInvalidKeyError(t *testing.T) {
 	}
 }
 
+func TestInvalidRetryParam(t *testing.T) {
+	// run the test
+	tests := []struct {
+		note     string
+		rules    []string
+		expected interface{}
+	}{
+		{"invalid retry param", []string{`p = x { http.send({"method": "get", "url": "http://127.0.0.1:51113", "max_retry_attempts": "bad_value"}, x) }`}, &Error{Code: BuiltinErr, Message: `http.send: invalid value "bad_value" for field "max_retry_attempts"`}},
+		{"invalid number", []string{`p = x { http.send({"method": "get", "url": "http://127.0.0.1:51113", "max_retry_attempts": 1.2}, x) }`}, &Error{Code: BuiltinErr, Message: `http.send: invalid value 1.2 for field "max_retry_attempts"`}},
+		{"negative number", []string{`p = x { http.send({"method": "get", "url": "http://127.0.0.1:51113", "max_retry_attempts": -1000}, x) }`}, &Error{Code: BuiltinErr, Message: `http.send: invalid value -1000 for field "max_retry_attempts"`}},
+	}
+
+	data := loadSmallTestData()
+
+	for _, tc := range tests {
+		runTopDownTestCase(t, data, tc.note, tc.rules, tc.expected)
+	}
+}
+
 func TestParseTimeout(t *testing.T) {
 	tests := []struct {
 		note     string
@@ -604,7 +703,6 @@ func TestParseTimeout(t *testing.T) {
 
 // TestHTTPRedirectDisable tests redirects are not enabled by default
 func TestHTTPRedirectDisable(t *testing.T) {
-
 	// test server
 	baseURL, teardown := getTestServer()
 	defer teardown()
@@ -621,10 +719,7 @@ func TestHTTPRedirectDisable(t *testing.T) {
 		"location":       []interface{}{"/test"},
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
-	}
+	resultObj := ast.MustInterfaceToValue(expectedResult)
 
 	data := loadSmallTestData()
 	rules := append(
@@ -634,12 +729,10 @@ func TestHTTPRedirectDisable(t *testing.T) {
 
 	// run the test
 	runTopDownTestCase(t, data, "http.send", rules, resultObj.String())
-
 }
 
 // TestHTTPRedirectEnable tests redirects are enabled
 func TestHTTPRedirectEnable(t *testing.T) {
-
 	// test server
 	baseURL, teardown := getTestServer()
 	defer teardown()
@@ -654,10 +747,7 @@ func TestHTTPRedirectEnable(t *testing.T) {
 		"content-length": []interface{}{"0"},
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
-	}
+	resultObj := ast.MustInterfaceToValue(expectedResult)
 
 	data := loadSmallTestData()
 	rules := append(
@@ -669,8 +759,73 @@ func TestHTTPRedirectEnable(t *testing.T) {
 	runTopDownTestCase(t, data, "http.send", rules, resultObj.String())
 }
 
-func TestHTTPSendRaiseError(t *testing.T) {
+func TestHTTPRedirectAllowNet(t *testing.T) {
+	// test server
+	baseURL, teardown := getTestServer()
+	defer teardown()
+
+	// host
+	serverURL, err := url.Parse(baseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	serverHost := strings.Split(serverURL.Host, ":")[0]
+
+	// expected result
+	expectedResult := make(map[string]interface{})
+	expectedResult["status"] = "200 OK"
+	expectedResult["status_code"] = http.StatusOK
+	expectedResult["body"] = nil
+	expectedResult["raw_body"] = ""
+
+	resultObj := ast.MustInterfaceToValue(expectedResult)
+
+	expectedError := &Error{Code: "eval_builtin_error", Message: fmt.Sprintf("http.send: unallowed host: %s", serverHost)}
+
+	rules := []string{fmt.Sprintf(
+		`p = x { http.send({"method": "get", "url": "%s", "enable_redirect": true, "force_json_decode": true}, resp); x := remove_headers(resp) }`, baseURL)}
+
+	// run the test
+	tests := []struct {
+		note     string
+		rules    []string
+		options  func(*Query) *Query
+		expected interface{}
+	}{
+		{
+			"http.send allow_net nil",
+			rules,
+			setAllowNet(nil),
+			resultObj.String(),
+		},
+		{
+			"http.send allow_net match",
+			rules,
+			setAllowNet([]string{serverHost}),
+			resultObj.String(),
+		},
+		{
+			"http.send allow_net empty",
+			rules,
+			setAllowNet([]string{}),
+			expectedError,
+		},
+		{
+			"http.send allow_net no match",
+			rules,
+			setAllowNet([]string{"example.com"}),
+			expectedError,
+		},
+	}
+
+	data := loadSmallTestData()
+
+	for _, tc := range tests {
+		runTopDownTestCase(t, data, tc.note, append(tc.rules, httpSendHelperRules...), tc.expected, tc.options)
+	}
+}
 
+func TestHTTPSendRaiseError(t *testing.T) {
 	// test server
 	baseURL, teardown := getTestServer()
 	defer teardown()
@@ -679,28 +834,19 @@ func TestHTTPSendRaiseError(t *testing.T) {
 	networkErrObj["code"] = HTTPSendNetworkErr
 	networkErrObj["message"] = "Get \"foo://foo.com\": unsupported protocol scheme \"foo\""
 
-	networkErr, err := ast.InterfaceToValue(networkErrObj)
-	if err != nil {
-		panic(err)
-	}
+	networkErr := ast.MustInterfaceToValue(networkErrObj)
 
 	internalErrObj := make(map[string]interface{})
 	internalErrObj["code"] = HTTPSendInternalErr
 	internalErrObj["message"] = fmt.Sprintf(`http.send({"method": "get", "url": "%s", "force_json_decode": true, "raise_error": false, "force_cache": true}): eval_builtin_error: http.send: 'force_cache' set but 'force_cache_duration_seconds' parameter is missing`, baseURL)
 
-	internalErr, err := ast.InterfaceToValue(internalErrObj)
-	if err != nil {
-		panic(err)
-	}
+	internalErr := ast.MustInterfaceToValue(internalErrObj)
 
 	responseObj := make(map[string]interface{})
 	responseObj["status_code"] = 0
 	responseObj["error"] = internalErrObj
 
-	response, err := ast.InterfaceToValue(responseObj)
-	if err != nil {
-		panic(err)
-	}
+	response := ast.MustInterfaceToValue(responseObj)
 
 	tests := []struct {
 		note         string
@@ -855,7 +1001,6 @@ func TestHTTPSendCaching(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			var requests []*http.Request
 			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				requests = append(requests, r)
@@ -879,158 +1024,82 @@ func TestHTTPSendCaching(t *testing.T) {
 	}
 }
 
-func TestHTTPSendInterQueryCaching(t *testing.T) {
+func TestHTTPSendIntraQueryCaching(t *testing.T) {
 	tests := []struct {
-		note             string
-		ruleTemplate     string
-		headers          map[string][]string
-		body             string
-		response         string
-		expectedReqCount int
+		note                       string
+		request                    string
+		ruleTemplate               string
+		headers                    map[string][]string
+		body                       string
+		response                   string
+		expectedReqCount           int
+		expectedInterQueryCacheHit bool
 	}{
 		{
-			note:             "http.send GET single",
-			ruleTemplate:     `p = x { http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, r); x = r.body }`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 1,
-		},
-		{
-			note: "http.send GET cache hit (max_age_response_fresh)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # cached and fresh
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # cached and fresh
-									r1 == r2
-									r2 == r3
-									x = r1.body
-								}`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 1,
-		},
-		{
-			note: "http.send GET cache hit (expires_header_response_fresh)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # cached and fresh
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # cached and fresh
-									r1 == r2
-									r2 == r3
-									x = r1.body
-								}`,
-			headers:          map[string][]string{"Expires": {"Wed, 31 Dec 2115 07:28:00 GMT"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 1,
-		},
-		{
-			note: "http.send GET (expires_header_invalid_value)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # not cached
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # not cached
-									r1 == r2
-									r2 == r3
-									x = r1.body
-								}`,
-			headers:          map[string][]string{"Expires": {"0"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 3,
-		},
-		{
-			note: "http.send GET no-store cache",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # not cached
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})  # not cached
-									r1 == r2
-									r2 == r3
-									x = r1.body
-								}`,
-			headers:          map[string][]string{"Cache-Control": {"no-store"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 3,
-		},
-		{
-			note: "http.send GET (response_stale_revalidate_with_etag)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r1 == r2
-									r2 == r3
-									x = r1.body
-								}`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Etag": {"1234"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 3,
-		},
-		{
-			note: "http.send GET (response_stale_revalidate_with_last_modified)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r1 == r2
-									r2 == r3
-									x = r1.body
-								}`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Last-Modified": {"Wed, 31 Dec 2115 07:28:00 GMT"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 3,
+			note:                       "http.send GET single",
+			request:                    `{"method": "get", "url": "%URL%", "force_json_decode": true}`,
+			ruleTemplate:               `p = x { http.send(%REQ%, r); x = r.body }`,
+			headers:                    map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
+			response:                   `{"x": 1}`,
+			expectedReqCount:           1,
+			expectedInterQueryCacheHit: false,
 		},
 		{
-			note: "http.send GET (response_age_negative_duration)",
+			note:    "http.send GET multiple",
+			request: `{"method": "get", "url": "%URL%", "force_json_decode": true}`,
 			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
+									r1 = http.send(%REQ%)
+									r2 = http.send(%REQ%)  # cached
+									r3 = http.send(%REQ%)  # cached
 									r1 == r2
 									r2 == r3
 									x = r1.body
 								}`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Last-Modified": {"Wed, 31 Dec 2115 07:28:00 GMT"}, "Date": {"Wed, 31 Dec 2115 07:28:00 GMT"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 3,
+			headers:                    map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
+			response:                   `{"x": 1}`,
+			expectedReqCount:           1,
+			expectedInterQueryCacheHit: false,
 		},
 		{
-			note: "http.send GET cache hit deserialized mode (max_age_response_fresh)",
+			note:    "http.send GET multiple (inter-query cache enabled)",
+			request: `{"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}`,
 			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"})  # cached and fresh
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"})  # cached and fresh
+									r1 = http.send(%REQ%)
+									r2 = http.send(%REQ%) # cached; intra-query populated but ignored
+									r3 = http.send(%REQ%) # cached; intra-query populated but ignored
 									r1 == r2
 									r2 == r3
 									x = r1.body
 								}`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 1,
+			headers:                    map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
+			response:                   `{"x": 1}`,
+			expectedReqCount:           1,
+			expectedInterQueryCacheHit: true,
 		},
 		{
-			note: "http.send GET cache hit serialized mode explicit (max_age_response_fresh)",
+			note:    "http.send GET multiple (inter-query cache enabled, )",
+			request: `{"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}`,
 			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "serialized"})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "serialized"})  # cached and fresh
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "serialized"})  # cached and fresh
+									r1 = http.send(%REQ%)
+									r2 = http.send(%REQ%) # cached; intra-query not populated
+									r3 = http.send(%REQ%) # cached; intra-query not populated
 									r1 == r2
 									r2 == r3
 									x = r1.body
 								}`,
-			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
-			response:         `{"x": 1}`,
-			expectedReqCount: 1,
+			headers:                    map[string][]string{"Cache-Control": {"no-store"}},
+			response:                   `{"x": 1}`,
+			expectedReqCount:           1,
+			expectedInterQueryCacheHit: false,
 		},
 	}
 
 	data := loadSmallTestData()
 
 	t0 := time.Now()
-	opts := setTime(t0)
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			var requests []*http.Request
 			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				requests = append(requests, r)
@@ -1060,7 +1129,17 @@ func TestHTTPSendInterQueryCaching(t *testing.T) {
 			}))
 			defer ts.Close()
 
-			runTopDownTestCase(t, data, tc.note, []string{strings.ReplaceAll(tc.ruleTemplate, "%URL%", ts.URL)}, tc.response, opts)
+			config, _ := iCache.ParseCachingConfig(nil)
+			interQueryCache := iCache.NewInterQueryCache(config)
+
+			opts := []func(*Query) *Query{
+				setTime(t0),
+				setInterQueryCache(interQueryCache),
+			}
+
+			request := strings.ReplaceAll(tc.request, "%URL%", ts.URL)
+			rule := strings.ReplaceAll(tc.ruleTemplate, "%REQ%", request)
+			runTopDownTestCase(t, data, tc.note, []string{rule}, tc.response, opts...)
 
 			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
 			// eval first), so expect 2x the total request count the test case specified.
@@ -1068,25 +1147,181 @@ func TestHTTPSendInterQueryCaching(t *testing.T) {
 			if actualCount != tc.expectedReqCount {
 				t.Fatalf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
 			}
+
+			var x interface{}
+			if err := util.UnmarshalJSON([]byte(request), &x); err != nil {
+				t.Fatalf("failed to unmarshal request: %v", err)
+			}
+			cacheKey, err := ast.InterfaceToValue(x)
+			if err != nil {
+				t.Fatalf("failed create request object: %v", err)
+			}
+
+			if _, found := interQueryCache.Get(cacheKey); found != tc.expectedInterQueryCacheHit {
+				t.Fatalf("Expected inter-query cache hit: %v, got: %v", tc.expectedInterQueryCacheHit, found)
+			}
 		})
 	}
 }
 
-func TestHTTPSendInterQueryForceCaching(t *testing.T) {
+func TestHTTPSendInterQueryCaching(t *testing.T) {
 	tests := []struct {
 		note             string
-		ruleTemplate     string
+		query            string // each query is run three times
 		headers          map[string][]string
 		body             string
 		response         string
 		expectedReqCount int
 	}{
 		{
-			note: "http.send GET cache hit (force_cache_only)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
+			note:             "http.send GET cache hit (max_age_response_fresh)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 1,
+		},
+		{
+			note:             "http.send GET cache hit (expires_header_response_fresh)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Expires": {"Wed, 31 Dec 2115 07:28:00 GMT"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 1,
+		},
+		{
+			note:             "http.send GET (expires_header_invalid_value)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Expires": {"0"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 3,
+		},
+		{
+			note:             "http.send GET no-store cache",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"no-store"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 3,
+		},
+		{
+			note:             "http.send GET (response_stale_revalidate_with_etag)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Etag": {"1234"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 3,
+		},
+		{
+			note:             "http.send GET (response_stale_revalidate_with_last_modified)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Last-Modified": {"Wed, 31 Dec 2115 07:28:00 GMT"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 3,
+		},
+		{
+			note:             "http.send GET (response_age_negative_duration)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Last-Modified": {"Wed, 31 Dec 2115 07:28:00 GMT"}, "Date": {"Wed, 31 Dec 2115 07:28:00 GMT"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 3,
+		},
+		{
+			note:             "http.send GET cache hit deserialized mode (max_age_response_fresh)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 1,
+		},
+		{
+			note:             "http.send GET cache hit serialized mode explicit (max_age_response_fresh)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "serialized"}, x)`,
+			headers:          map[string][]string{"Cache-Control": {"max-age=290304000, public"}},
+			response:         `{"x": 1}`,
+			expectedReqCount: 1,
+		},
+		{
+			note:  "http.send GET cache hit serialized mode explicit (max_age_response_fresh), when parsing a yaml response",
+			query: `http.send({"method": "get", "url": "%URL%", "cache": true, "caching_mode": "serialized"}, x)`,
+			headers: map[string][]string{
+				"Cache-Control": {"max-age=290304000, public"},
+				"Content-Type":  {"application/yaml"},
+			},
+			// NOTE: fed into runTopDownTestCase, so it has to be JSON; but we're making use of YAML being a superset of JSON
+			response:         `{"x": 1}`,
+			expectedReqCount: 1,
+		},
+	}
+
+	t0 := time.Now()
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			var requests []*http.Request
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				requests = append(requests, r)
+				headers := w.Header()
+
+				for k, v := range tc.headers {
+					headers[k] = v
+				}
+
+				headers.Set("Date", t0.Format(time.RFC850))
+
+				etag := w.Header().Get("etag")
+				lm := w.Header().Get("last-modified")
+
+				if etag != "" {
+					if r.Header.Get("if-none-match") == etag {
+						w.WriteHeader(http.StatusNotModified)
+					}
+				} else if lm != "" {
+					if r.Header.Get("if-modified-since") == lm {
+						w.WriteHeader(http.StatusNotModified)
+					}
+				} else {
+					w.WriteHeader(http.StatusOK)
+				}
+				_, _ = w.Write([]byte(tc.response)) // ignore error
+			}))
+			defer ts.Close()
+
+			qStr := strings.ReplaceAll(tc.query, "%URL%", ts.URL)
+			q := newQuery(qStr, t0)
+
+			for i := 0; i < 3; i++ {
+				res, err := q.Run(context.Background())
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				resResponse := res[0]["x"].Value.(ast.Object).Get(ast.StringTerm("raw_body"))
+				if ast.String(tc.response).Compare(resResponse.Value) != 0 {
+					t.Fatalf("Expected response on query %d to be %v, got %v", i, tc.response, resResponse.String())
+				}
+			}
+
+			actualCount := len(requests)
+			if actualCount != tc.expectedReqCount {
+				t.Fatalf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
+			}
+		})
+	}
+}
+
+func TestHTTPSendInterQueryForceCaching(t *testing.T) {
+	tests := []struct {
+		note             string
+		query            string
+		ruleTemplate     string
+		headers          map[string][]string
+		body             string
+		response         string
+		expectedReqCount int
+	}{
+		{
+			note:  "http.send GET cache hit (force_cache_only)",
+			query: `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300}, x)`,
+			ruleTemplate: `p = x {
+									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})
+									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
+									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
 									r1 == r2
 									r2 == r3
 									x = r1.body
@@ -1096,7 +1331,23 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 			expectedReqCount: 1,
 		},
 		{
-			note: "http.send GET cache hit (cache_param_override)",
+			note:  "http.send GET cache hit, empty headers (force_cache_only)",
+			query: `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300}, x)`,
+			ruleTemplate: `p = x {
+									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})
+									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
+									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
+									r1 == r2
+									r2 == r3
+									x = r1.body
+								}`,
+			headers:          map[string][]string{},
+			response:         `{"x": 1}`,
+			expectedReqCount: 1,
+		},
+		{
+			note:  "http.send GET cache hit (cache_param_override)",
+			query: `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300}, x)`,
 			ruleTemplate: `p = x {
 									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300})
 									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
@@ -1110,7 +1361,8 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 			expectedReqCount: 1,
 		},
 		{
-			note: "http.send GET cache hit (force_cache_only_no_store_override)",
+			note:  "http.send GET cache hit (force_cache_only_no_store_override)",
+			query: `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300}, x)`,
 			ruleTemplate: `p = x {
 									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})
 									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
@@ -1127,7 +1379,8 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 			expectedReqCount: 1,
 		},
 		{
-			note: "http.send GET cache hit (cache_param_override_no_store_override)",
+			note:  "http.send GET cache hit (cache_param_override_no_store_override)",
+			query: `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300}, x)`,
 			ruleTemplate: `p = x {
 									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300})
 									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
@@ -1144,7 +1397,8 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 			expectedReqCount: 1,
 		},
 		{
-			note: "http.send GET cache hit (cache_param_override_no_store_override_invalid_expires_header_value)",
+			note:  "http.send GET cache hit (cache_param_override_no_store_override_invalid_expires_header_value)",
+			query: `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300}, x)`,
 			ruleTemplate: `p = x {
 									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300})
 									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "force_cache": true, "force_cache_duration_seconds": 300})  # cached and fresh
@@ -1162,13 +1416,9 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 		},
 	}
 
-	data := loadSmallTestData()
-
-	t0 := time.Now()
-	opts := setTime(t0)
-
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
+			t0 := time.Now().UTC()
 
 			var requests []*http.Request
 			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1179,7 +1429,7 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 					headers[k] = v
 				}
 
-				headers.Set("Date", t0.Format(time.RFC850))
+				headers.Set("Date", t0.Format(http.TimeFormat))
 
 				w.WriteHeader(http.StatusOK)
 				_, err := w.Write([]byte(tc.response))
@@ -1189,13 +1439,26 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 			}))
 			defer ts.Close()
 
-			runTopDownTestCase(t, data, tc.note, []string{strings.ReplaceAll(tc.ruleTemplate, "%URL%", ts.URL)}, tc.response, opts)
+			//runTopDownTestCase(t, data, tc.note, []string{strings.ReplaceAll(tc.ruleTemplate, "%URL%", ts.URL)}, tc.response, opts)
 
-			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
-			// eval first), so expect 2x the total request count the test case specified.
-			actualCount := len(requests) / 2
+			qStr := strings.ReplaceAll(tc.query, "%URL%", ts.URL)
+			q := newQuery(qStr, t0)
+
+			for i := 0; i < 3; i++ {
+				res, err := q.Run(context.Background())
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				resResponse := res[0]["x"].Value.(ast.Object).Get(ast.StringTerm("raw_body"))
+				if ast.String(tc.response).Compare(resResponse.Value) != 0 {
+					t.Fatalf("Expected response on query %d to be %v, got %v", i, tc.response, resResponse.String())
+				}
+			}
+
+			actualCount := len(requests)
 			if actualCount != tc.expectedReqCount {
-				t.Fatalf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
+				t.Errorf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
 			}
 		})
 	}
@@ -1204,59 +1467,38 @@ func TestHTTPSendInterQueryForceCaching(t *testing.T) {
 func TestHTTPSendInterQueryCachingModifiedResp(t *testing.T) {
 	tests := []struct {
 		note             string
-		ruleTemplate     string
+		query            string
 		headers          map[string][]string
 		body             string
 		response         string
 		expectedReqCount int
 	}{
 		{
-			note: "http.send GET (response_stale_revalidate_with_etag)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # cached and fresh
-									r2 == r3
-									x = r1.body
-								}`,
+			note:             "http.send GET (response_stale_revalidate_with_etag)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
 			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Etag": {"1234"}, "location": {"/test"}},
 			response:         `{"x": 1}`,
 			expectedReqCount: 2,
 		},
 		{
-			note: "http.send GET cache deserialized mode (response_stale_revalidate_with_etag)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"}) # stale
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"}) # cached and fresh
-									r2 == r3
-									x = r1.body
-								}`,
+			note:             "http.send GET cache deserialized mode (response_stale_revalidate_with_etag)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true, "caching_mode": "deserialized"}, x)`,
 			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Etag": {"1234"}, "location": {"/test"}},
 			response:         `{"x": 1}`,
 			expectedReqCount: 2,
 		},
 		{
-			note: "http.send GET (response_stale_revalidate_with_no_etag)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r1 == r2
-									x = r1.body
-								}`,
+			note:             "http.send GET (response_stale_revalidate_with_no_etag)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
 			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}},
 			response:         `{"x": 1}`,
-			expectedReqCount: 2,
+			expectedReqCount: 3,
 		},
 	}
 
-	data := loadSmallTestData()
-
-	t0 := time.Now()
-	opts := setTime(t0)
-
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
+			t0 := time.Now().UTC()
 
 			var requests []*http.Request
 			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1267,7 +1509,7 @@ func TestHTTPSendInterQueryCachingModifiedResp(t *testing.T) {
 					headers[k] = v
 				}
 
-				headers.Set("Date", t0.Format(time.RFC850))
+				headers.Set("Date", t0.Format(http.TimeFormat))
 
 				etag := w.Header().Get("etag")
 
@@ -1285,11 +1527,24 @@ func TestHTTPSendInterQueryCachingModifiedResp(t *testing.T) {
 			}))
 			defer ts.Close()
 
-			runTopDownTestCase(t, data, tc.note, []string{strings.ReplaceAll(tc.ruleTemplate, "%URL%", ts.URL)}, tc.response, opts)
+			qStr := strings.ReplaceAll(tc.query, "%URL%", ts.URL)
+			q := newQuery(qStr, t0)
+
+			for i := 0; i < 3; i++ {
+				res, err := q.Run(context.Background())
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				resResponse := res[0]["x"].Value.(ast.Object).Get(ast.StringTerm("raw_body"))
+				if ast.String(tc.response).Compare(resResponse.Value) != 0 {
+					t.Fatalf("Expected response on query %d to be %v, got %v", i, tc.response, resResponse.String())
+				}
+			}
 
 			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
 			// eval first), so expect 2x the total request count the test case specified.
-			actualCount := len(requests) / 2
+			actualCount := len(requests)
 			if actualCount != tc.expectedReqCount {
 				t.Fatalf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
 			}
@@ -1300,33 +1555,24 @@ func TestHTTPSendInterQueryCachingModifiedResp(t *testing.T) {
 func TestHTTPSendInterQueryCachingNewResp(t *testing.T) {
 	tests := []struct {
 		note             string
-		ruleTemplate     string
+		query            string // each query will be run three times
 		headers          map[string][]string
 		body             string
 		response         string
 		expectedReqCount int
 	}{
 		{
-			note: "http.send GET (response_stale_revalidate_with_etag)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true})
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # stale
-									r3 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # cached and fresh
-									x = r1.body
-								}`,
+			note:             "http.send GET (response_stale_revalidate_with_etag)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
 			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Etag": {"1234"}, "location": {"/test"}},
 			response:         `{"x": 1}`,
 			expectedReqCount: 2,
 		},
 	}
 
-	data := loadSmallTestData()
-
-	t0 := time.Now()
-	opts := setTime(t0)
-
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
+			t0 := time.Now().UTC()
 
 			var requests []*http.Request
 			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1337,7 +1583,7 @@ func TestHTTPSendInterQueryCachingNewResp(t *testing.T) {
 					headers[k] = v
 				}
 
-				headers.Set("Date", t0.Format(time.RFC850))
+				headers.Set("Date", t0.Format(http.TimeFormat))
 
 				etag := w.Header().Get("etag")
 
@@ -1354,11 +1600,22 @@ func TestHTTPSendInterQueryCachingNewResp(t *testing.T) {
 			}))
 			defer ts.Close()
 
-			runTopDownTestCase(t, data, tc.note, []string{strings.ReplaceAll(tc.ruleTemplate, "%URL%", ts.URL)}, tc.response, opts)
+			qStr := strings.ReplaceAll(tc.query, "%URL%", ts.URL)
+			q := newQuery(qStr, t0)
 
-			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
-			// eval first), so expect 2x the total request count the test case specified.
-			actualCount := len(requests) / 2
+			for i := 0; i < 3; i++ {
+				res, err := q.Run(context.Background())
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				resResponse := res[0]["x"].Value.(ast.Object).Get(ast.StringTerm("raw_body"))
+				if ast.String(tc.response).Compare(resResponse.Value) != 0 {
+					t.Fatalf("Expected response on query %d to be %v, got %v", i, tc.response, resResponse.String())
+				}
+			}
+
+			actualCount := len(requests)
 			if actualCount != tc.expectedReqCount {
 				t.Fatalf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
 			}
@@ -1366,46 +1623,50 @@ func TestHTTPSendInterQueryCachingNewResp(t *testing.T) {
 	}
 }
 
+func newQuery(qStr string, t0 time.Time) *Query {
+	config, _ := iCache.ParseCachingConfig(nil)
+	interQueryCache := iCache.NewInterQueryCache(config)
+	ctx := context.Background()
+	store := inmem.New()
+	txn := storage.NewTransactionOrDie(ctx, store)
+	q := NewQuery(ast.MustParseBody(qStr)).
+		WithCompiler(ast.NewCompiler()).
+		WithInterQueryBuiltinCache(interQueryCache).
+		WithStore(store).
+		WithTransaction(txn).
+		WithTime(t0)
+	return q
+}
+
 func TestInsertIntoHTTPSendInterQueryCacheError(t *testing.T) {
 	tests := []struct {
 		note             string
-		ruleTemplate     string
+		query            string
 		headers          map[string][]string
 		body             string
 		response         string
 		expectedReqCount int
 	}{
 		{
-			note: "http.send GET (bad_date_header_value)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # fallback to normal cache
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # retrieved from normal cache
-									r1 == r2
-									x = r1.body
-								}`,
+			note:             "http.send GET (bad_date_header_value)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
 			headers:          map[string][]string{"Cache-Control": {"max-age=0, public"}, "Date": {"Wed, 32 Dec 2115 07:28:00 GMT"}},
 			response:         `{"x": 1}`,
-			expectedReqCount: 1,
+			expectedReqCount: 3,
 		},
 		{
-			note: "http.send GET (bad_cache_control_header_value)",
-			ruleTemplate: `p = x {
-									r1 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # fallback to normal cache
-									r2 = http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}) # retrieved from normal cache
-									r1 == r2
-									x = r1.body
-								}`,
+			note:             "http.send GET (bad_cache_control_header_value)",
+			query:            `http.send({"method": "get", "url": "%URL%", "force_json_decode": true, "cache": true}, x)`,
 			headers:          map[string][]string{"Cache-Control": {"max-age=\"foo\", public"}},
 			response:         `{"x": 1}`,
-			expectedReqCount: 1,
+			expectedReqCount: 3,
 		},
 	}
 
-	data := loadSmallTestData()
-
 	for _, tc := range tests {
-		t.Run(tc.note, func(t *testing.T) {
+		t0 := time.Now().UTC()
 
+		t.Run(tc.note, func(t *testing.T) {
 			var requests []*http.Request
 			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				requests = append(requests, r)
@@ -1423,11 +1684,22 @@ func TestInsertIntoHTTPSendInterQueryCacheError(t *testing.T) {
 			}))
 			defer ts.Close()
 
-			runTopDownTestCase(t, data, tc.note, []string{strings.ReplaceAll(tc.ruleTemplate, "%URL%", ts.URL)}, tc.response)
+			qStr := strings.ReplaceAll(tc.query, "%URL%", ts.URL)
+			q := newQuery(qStr, t0)
 
-			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
-			// eval first), so expect 2x the total request count the test case specified.
-			actualCount := len(requests) / 2
+			for i := 0; i < 3; i++ {
+				res, err := q.Run(context.Background())
+				if err != nil {
+					t.Fatal(err)
+				}
+
+				resResponse := res[0]["x"].Value.(ast.Object).Get(ast.StringTerm("raw_body"))
+				if ast.String(tc.response).Compare(resResponse.Value) != 0 {
+					t.Fatalf("Expected response on query %d to be %v, got %v", i, tc.response, resResponse.String())
+				}
+			}
+
+			actualCount := len(requests)
 			if actualCount != tc.expectedReqCount {
 				t.Fatalf("Expected to get %d requests, got %d", tc.expectedReqCount, actualCount)
 			}
@@ -1477,7 +1749,6 @@ func TestGetCachingMode(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			actual, err := getCachingMode(tc.input)
 			if tc.wantError {
 				if err == nil {
@@ -1512,19 +1783,6 @@ func TestGetResponseHeaderDateEmpty(t *testing.T) {
 	}
 }
 
-func TestIsCachedResponseFreshZeroTime(t *testing.T) {
-	zeroTime := new(time.Time)
-	result := isCachedResponseFresh(BuiltinContext{}, &responseHeaders{date: *zeroTime}, nil)
-	if result {
-		t.Fatal("Expected stale cache response")
-	}
-
-	result = isCachedResponseFresh(BuiltinContext{Time: ast.NullTerm()}, &responseHeaders{date: time.Now()}, nil)
-	if result {
-		t.Fatal("Expected stale cache response")
-	}
-}
-
 func TestParseMaxAgeCacheDirective(t *testing.T) {
 	tests := []struct {
 		note      string
@@ -1572,7 +1830,6 @@ func TestParseMaxAgeCacheDirective(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			actual, err := parseMaxAgeCacheDirective(tc.input)
 			if tc.wantError {
 				if err == nil {
@@ -1591,13 +1848,11 @@ func TestParseMaxAgeCacheDirective(t *testing.T) {
 			if actual != tc.expected {
 				t.Fatalf("Expected value for max-age %v but got %v", tc.expected, actual)
 			}
-
 		})
 	}
 }
 
 func TestNewForceCacheParams(t *testing.T) {
-
 	tests := []struct {
 		note      string
 		input     ast.Object
@@ -1637,7 +1892,6 @@ func TestNewForceCacheParams(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			actual, err := newForceCacheParams(tc.input)
 			if tc.wantError {
 				if err == nil {
@@ -1703,7 +1957,6 @@ func TestGetBoolValFromReqObj(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.note, func(t *testing.T) {
-
 			actual, err := getBoolValFromReqObj(tc.input, tc.key)
 			if tc.wantError {
 				if err == nil {
@@ -1722,7 +1975,6 @@ func TestGetBoolValFromReqObj(t *testing.T) {
 			if actual != tc.expected {
 				t.Fatalf("Expected value for key %v is %v but got %v", tc.key, tc.expected, actual)
 			}
-
 		})
 	}
 }
@@ -1743,31 +1995,39 @@ func TestInterQueryCheckCacheError(t *testing.T) {
 }
 
 func TestNewInterQueryCacheValue(t *testing.T) {
+	date := "Wed, 31 Dec 2115 07:28:00 GMT"
+	maxAge := 290304000
+
 	headers := make(http.Header)
 	headers.Set("test-header", "test-value")
-	headers.Set("Cache-Control", "max-age=290304000, public")
-	headers.Set("Date", "Wed, 31 Dec 2115 07:28:00 GMT")
+	headers.Set("Cache-Control", fmt.Sprintf("max-age=%d, public", maxAge))
+	headers.Set("Date", date)
 
 	// test data
-	var b = []byte(`[{"ID": "1", "Firstname": "John"}]`)
+	b := []byte(`[{"ID": "1", "Firstname": "John"}]`)
 
 	response := &http.Response{
 		Status:     "200 OK",
 		StatusCode: http.StatusOK,
 		Header:     headers,
 		Request:    &http.Request{Method: "Get"},
-		Body:       ioutil.NopCloser(bytes.NewBuffer(b)),
+		Body:       io.NopCloser(bytes.NewBuffer(b)),
 	}
 
-	result, err := newInterQueryCacheValue(response, b)
+	result, err := newInterQueryCacheValue(BuiltinContext{}, response, b, &forceCacheParams{})
 	if err != nil {
 		t.Fatalf("Unexpected error %v", err)
 	}
 
-	cvd := interQueryCacheData{RespBody: b,
+	dateTime, _ := http.ParseTime(date)
+
+	cvd := interQueryCacheData{
+		RespBody:   b,
 		Status:     "200 OK",
 		StatusCode: http.StatusOK,
-		Headers:    headers}
+		Headers:    headers,
+		ExpiresAt:  dateTime.Add(time.Duration(maxAge) * time.Second),
+	}
 
 	cvdBytes, err := json.Marshal(cvd)
 	if err != nil {
@@ -1829,7 +2089,6 @@ func getTLSTestServer() (ts *httptest.Server) {
 }
 
 func TestHTTPSClient(t *testing.T) {
-
 	const (
 		localClientCertFile  = "testdata/client-cert.pem"
 		localClientCert2File = "testdata/client-cert-2.pem"
@@ -1839,7 +2098,7 @@ func TestHTTPSClient(t *testing.T) {
 		localServerKeyFile   = "testdata/server-key.pem"
 	)
 
-	caCertPEM, err := ioutil.ReadFile(localCaFile)
+	caCertPEM, err := os.ReadFile(localCaFile)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1858,22 +2117,14 @@ func TestHTTPSClient(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = os.Setenv("CLIENT_CERT_ENV", string(clientCert))
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Setenv("CLIENT_CERT_ENV", string(clientCert))
+
 	clientKey, err := readKeyFromFile(localClientKeyFile)
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = os.Setenv("CLIENT_KEY_ENV", string(clientKey))
-	if err != nil {
-		t.Fatal(err)
-	}
-	err = os.Setenv("CLIENT_CA_ENV", string(caCertPEM))
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Setenv("CLIENT_KEY_ENV", string(clientKey))
+	t.Setenv("CLIENT_CA_ENV", string(caCertPEM))
 
 	// Replicating some of what happens in the server's HTTPS listener
 	s := getTLSTestServer()
@@ -1930,17 +2181,17 @@ func TestHTTPSClient(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		ca, err := ioutil.ReadFile(localCaFile)
+		ca, err := os.ReadFile(localCaFile)
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		cert, err := ioutil.ReadFile(localClientCertFile)
+		cert, err := os.ReadFile(localClientCertFile)
 		if err != nil {
 			t.Fatal(err)
 		}
 
-		key, err := ioutil.ReadFile(localClientKeyFile)
+		key, err := os.ReadFile(localClientKeyFile)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -2066,8 +2317,7 @@ func TestHTTPSClient(t *testing.T) {
 	})
 
 	t.Run("Negative Test: No Root Ca", func(t *testing.T) {
-
-		expectedResult := &Error{Code: BuiltinErr, Message: "x509: certificate signed by unknown authority", Location: nil}
+		expectedResult := &Error{Code: BuiltinErr, Message: fixupDarwinGo118("x509: certificate signed by unknown authority", `“my-server” certificate is not standards compliant`), Location: nil}
 		data := loadSmallTestData()
 		rule := []string{fmt.Sprintf(
 			`p = x { http.send({"method": "get", "url": "%s", "tls_client_cert_file": "%s", "tls_client_key_file": "%s"}, x) }`, s.URL, localClientCertFile, localClientKeyFile)}
@@ -2077,7 +2327,6 @@ func TestHTTPSClient(t *testing.T) {
 	})
 
 	t.Run("Negative Test: Wrong Cert/Key Pair", func(t *testing.T) {
-
 		expectedResult := &Error{Code: BuiltinErr, Message: "tls: private key does not match public key", Location: nil}
 		data := loadSmallTestData()
 		rule := []string{fmt.Sprintf(
@@ -2088,8 +2337,7 @@ func TestHTTPSClient(t *testing.T) {
 	})
 
 	t.Run("Negative Test: System Certs do not include local rootCA", func(t *testing.T) {
-
-		expectedResult := &Error{Code: BuiltinErr, Message: "x509: certificate signed by unknown authority", Location: nil}
+		expectedResult := &Error{Code: BuiltinErr, Message: fixupDarwinGo118("x509: certificate signed by unknown authority", `“my-server” certificate is not standards compliant`), Location: nil}
 		data := loadSmallTestData()
 		rule := []string{fmt.Sprintf(
 			`p = x { http.send({"method": "get", "url": "%s", "tls_client_cert_file": "%s", "tls_client_key_file": "%s", "tls_use_system_certs": true}, x) }`, s.URL, localClientCertFile, localClientKeyFile)}
@@ -2134,14 +2382,13 @@ func TestHTTPSClient(t *testing.T) {
 }
 
 func TestHTTPSNoClientCerts(t *testing.T) {
-
 	const (
 		localCaFile         = "testdata/ca.pem"
 		localServerCertFile = "testdata/server-cert.pem"
 		localServerKeyFile  = "testdata/server-key.pem"
 	)
 
-	caCertPEM, err := ioutil.ReadFile(localCaFile)
+	caCertPEM, err := os.ReadFile(localCaFile)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2155,10 +2402,7 @@ func TestHTTPSNoClientCerts(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = os.Setenv("CLIENT_CA_ENV", string(caCertPEM))
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Setenv("CLIENT_CA_ENV", string(caCertPEM))
 
 	// Replicating some of what happens in the server's HTTPS listener
 	s := getTLSTestServer()
@@ -2209,7 +2453,7 @@ func TestHTTPSNoClientCerts(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		ca, err := ioutil.ReadFile(localCaFile)
+		ca, err := os.ReadFile(localCaFile)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -2332,8 +2576,7 @@ func TestHTTPSNoClientCerts(t *testing.T) {
 	})
 
 	t.Run("Negative Test: System Certs do not include local rootCA", func(t *testing.T) {
-
-		expectedResult := &Error{Code: BuiltinErr, Message: "x509: certificate signed by unknown authority", Location: nil}
+		expectedResult := &Error{Code: BuiltinErr, Message: fixupDarwinGo118("x509: certificate signed by unknown authority", `“my-server” certificate is not standards compliant`), Location: nil}
 		data := loadSmallTestData()
 		rule := []string{fmt.Sprintf(
 			`p = x { http.send({"method": "get", "url": "%s", "tls_use_system_certs": true}, x) }`, s.URL)}
@@ -2343,13 +2586,24 @@ func TestHTTPSNoClientCerts(t *testing.T) {
 	})
 }
 
+// Note(philipc): In Go 1.18, the crypto/x509 package deprecated the
+// (*CertPool).Subjects() function. The precise reasoning for why this was
+// done traces back to:
+//
+//	https://github.com/golang/go/issues/46287
+//
+// For now, most projects seem to be working around this deprecation by
+// changing how they verify certificates, and when CertPools are needed in
+// tests, some larger projects have just slapped linter ignores on the
+// offending callsites. Since we only use (*CertPool).Subjects() here for
+// tests, we've gone with using linter ignores for now.
 func TestCertSelectionLogic(t *testing.T) {
 	const (
 		localCaFile = "testdata/ca.pem"
 	)
 
 	// Set up Environment
-	caCertPEM, err := ioutil.ReadFile(localCaFile)
+	caCertPEM, err := os.ReadFile(localCaFile)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2359,15 +2613,12 @@ func TestCertSelectionLogic(t *testing.T) {
 		t.Fatal("failed to parse CA cert")
 	}
 
-	ca, err := ioutil.ReadFile(localCaFile)
+	ca, err := os.ReadFile(localCaFile)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	err = os.Setenv("CLIENT_CA_ENV", string(caCertPEM))
-	if err != nil {
-		t.Fatal(err)
-	}
+	t.Setenv("CLIENT_CA_ENV", string(caCertPEM))
 
 	getClientTLSConfig := func(obj ast.Object) *tls.Config {
 		_, client, err := createHTTPRequest(BuiltinContext{Context: context.Background()}, obj)
@@ -2403,7 +2654,7 @@ func TestCertSelectionLogic(t *testing.T) {
 		{
 			note:     "tls_use_system_certs set to true",
 			input:    map[*ast.Term]*ast.Term{ast.StringTerm("tls_use_system_certs"): ast.BooleanTerm(true)},
-			expected: systemCertsPool.Subjects(),
+			expected: systemCertsPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use system certs",
 		},
 		{
@@ -2415,25 +2666,25 @@ func TestCertSelectionLogic(t *testing.T) {
 		{
 			note:     "no CAs specified",
 			input:    nil,
-			expected: systemCertsPool.Subjects(),
+			expected: systemCertsPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use system certs",
 		},
 		{
 			note:     "CA cert provided directly",
 			input:    map[*ast.Term]*ast.Term{ast.StringTerm("tls_ca_cert"): ast.StringTerm(string(ca))},
-			expected: caPool.Subjects(),
+			expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use provided CA certs",
 		},
 		{
 			note:     "CA cert file path provided",
 			input:    map[*ast.Term]*ast.Term{ast.StringTerm("tls_ca_cert_file"): ast.StringTerm(localCaFile)},
-			expected: caPool.Subjects(),
+			expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use provided CA certs in file",
 		},
 		{
 			note:     "CA cert provided in env variable",
 			input:    map[*ast.Term]*ast.Term{ast.StringTerm("tls_ca_cert_env_variable"): ast.StringTerm("CLIENT_CA_ENV")},
-			expected: caPool.Subjects(),
+			expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use provided CA certs in env variable",
 		},
 		{
@@ -2442,7 +2693,7 @@ func TestCertSelectionLogic(t *testing.T) {
 				ast.StringTerm("tls_ca_cert"):          ast.StringTerm(string(ca)),
 				ast.StringTerm("tls_use_system_certs"): ast.BooleanTerm(false),
 			},
-			expected: caPool.Subjects(),
+			expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use provided CA certs only",
 		},
 		{
@@ -2451,7 +2702,7 @@ func TestCertSelectionLogic(t *testing.T) {
 				ast.StringTerm("tls_ca_cert"):          ast.StringTerm(string(ca)),
 				ast.StringTerm("tls_use_system_certs"): ast.BooleanTerm(true),
 			},
-			expected: systemCertsAndCaPool.Subjects(),
+			expected: systemCertsAndCaPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 			msg:      "Expected TLS config to use provided CA certs and system certs",
 		},
 	}
@@ -2468,6 +2719,7 @@ func TestCertSelectionLogic(t *testing.T) {
 					t.Fatalf(tc.msg)
 				}
 			} else {
+				// nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
 				if !reflect.DeepEqual(tlsConfig.RootCAs.Subjects(), tc.expected) {
 					t.Fatal(tc.msg)
 				}
@@ -2476,8 +2728,320 @@ func TestCertSelectionLogic(t *testing.T) {
 	}
 }
 
-func TestHTTPSendMetrics(t *testing.T) {
+func TestHTTPSendCacheDefaultStatusCodesIntraQueryCache(t *testing.T) {
+
+	// run test server
+	var requests []*http.Request
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r)
+		if len(requests)%2 == 0 {
+			headers := w.Header()
+			headers["Cache-Control"] = []string{"max-age=290304000, public"}
+			w.WriteHeader(http.StatusOK)
+		} else {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}))
+
+	defer ts.Close()
+
+	t.Run("non-cacheable status code: intra-query cache", func(t *testing.T) {
+		base := fmt.Sprintf(`http.send({"method": "get", "url": %q, "cache": true})`, ts.URL)
+		query := fmt.Sprintf("%v;%v;%v", base, base, base)
+
+		q := NewQuery(ast.MustParseBody(query))
+
+		// Execute three http.send calls within a query.
+		// Since the server returns a http.StatusInternalServerError on the first request, this should NOT be cached as
+		// http.StatusInternalServerError is not a cacheable status code. The second request should result in OPA reaching
+		// out to the server again and getting a http.StatusOK response status code.
+		// The third request should now be served from the cache.
+
+		_, err := q.Run(context.Background())
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expectedReqCount := 2
+		if len(requests) != expectedReqCount {
+			t.Fatalf("Expected to get %d requests, got %d", expectedReqCount, len(requests))
+		}
+	})
+}
+
+func TestHTTPSendCacheDefaultStatusCodesInterQueryCache(t *testing.T) {
 
+	// run test server
+	var requests []*http.Request
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests = append(requests, r)
+		if len(requests)%2 == 0 {
+			headers := w.Header()
+			headers["Cache-Control"] = []string{"max-age=290304000, public"}
+			w.WriteHeader(http.StatusOK)
+		} else {
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}))
+
+	defer ts.Close()
+
+	t.Run("non-cacheable status code: inter-query cache", func(t *testing.T) {
+
+		// add an inter-query cache
+		config, _ := iCache.ParseCachingConfig(nil)
+		interQueryCache := iCache.NewInterQueryCache(config)
+
+		m := metrics.New()
+
+		q := NewQuery(ast.MustParseBody(fmt.Sprintf(`http.send({"method": "get", "url": %q, "cache": true})`, ts.URL))).
+			WithMetrics(m).WithInterQueryBuiltinCache(interQueryCache)
+
+		// Execute three queries.
+		// Since the server returns a http.StatusInternalServerError on the first request, this should NOT be cached as
+		// http.StatusInternalServerError is not a cacheable status code. The second request should result in OPA reaching
+		// out to the server again and getting a http.StatusOK response status code.
+		// The third request should now be served from the cache.
+
+		_, err := q.Run(context.Background())
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_, err = q.Run(context.Background())
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		_, err = q.Run(context.Background())
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expectedReqCount := 2
+		if len(requests) != expectedReqCount {
+			t.Fatalf("Expected to get %d requests, got %d", expectedReqCount, len(requests))
+		}
+
+		// verify http.send inter-query cache hit metric is incremented due to the third request.
+		if exp, act := uint64(1), m.Counter(httpSendInterQueryCacheHits).Value(); exp != act {
+			t.Fatalf("expected %d cache hits, got %d", exp, act)
+		}
+	})
+}
+
+type onlyOnceInterQueryCache struct {
+	value   *interQueryCacheData
+	counter int
+}
+
+func (c *onlyOnceInterQueryCache) Get(_ ast.Value) (value iCache.InterQueryCacheValue, found bool) {
+	c.counter++
+	if c.counter == 1 {
+		return c.value, true
+	}
+	return nil, false
+}
+
+func (c *onlyOnceInterQueryCache) Insert(_ ast.Value, _ iCache.InterQueryCacheValue) int {
+	return 0
+}
+
+func (c *onlyOnceInterQueryCache) Delete(_ ast.Value) {}
+
+func (c *onlyOnceInterQueryCache) UpdateConfig(_ *iCache.Config) {}
+
+func TestInterQueryCacheConcurrentModification(t *testing.T) {
+
+	// create an inter-query cache that'll return a value on first access, but none at subsequent accesses.
+	clock := time.Now()
+	req := ast.NewObject(
+		[2]*ast.Term{ast.StringTerm("method"), ast.StringTerm("get")},
+		[2]*ast.Term{ast.StringTerm("url"), ast.StringTerm("foobar")},
+		[2]*ast.Term{ast.StringTerm("cache"), ast.BooleanTerm(true)},
+	)
+	resp := interQueryCacheData{
+		Headers: map[string][]string{
+			"Date": {"Thu, 01 Jan 1970 00:00:00 GMT"},
+		},
+		ExpiresAt: clock.Add(time.Hour),
+	}
+	interQueryCache := onlyOnceInterQueryCache{value: &resp}
+
+	reqStr := req.String()
+	rule := fmt.Sprintf(`package test
+	p := http.send(%s)
+	q := http.send(%s)
+`, reqStr, reqStr)
+	c, err := compileRules([]string{}, []string{}, []string{rule})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	qStr := "x = data.test.p; y = data.test.q"
+	ctx := context.Background()
+	store := inmem.New()
+	txn := storage.NewTransactionOrDie(ctx, store)
+	q := NewQuery(ast.MustParseBody(qStr)).
+		WithCompiler(c).
+		WithStore(store).
+		WithTransaction(txn).
+		WithInterQueryBuiltinCache(&interQueryCache).
+		WithTime(clock)
+
+	res, err := q.Run(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if res[0]["x"].Value.Compare(res[0]["y"].Value) != 0 {
+		t.Fatalf("Expected x and y to be equal, got %v and %v", res[0]["x"].Value, res[0]["y"].Value)
+	}
+}
+
+func TestIntraQueryCache_ClientError(t *testing.T) {
+	data := loadSmallTestData()
+
+	tests := []struct {
+		note     string
+		rules    []string
+		expected string
+	}{
+		{
+			note: "raised errors",
+			rules: []string{`p["one"] { 
+	not http.send({"method": "GET", "url": "%URL%", "timeout": "10ms"}) 
+}`,
+				`p["two"] { 
+	not http.send({"method": "GET", "url": "%URL%", "timeout": "10ms"})
+}`},
+			expected: `["one", "two"]`,
+		},
+		{
+			note: "no raised errors",
+			rules: []string{`p["one"] { 
+	r := http.send({"method": "GET", "url": "%URL%", "timeout": "10ms", "raise_error": false}) 
+	r.error.code == "eval_http_send_network_error"
+}`,
+				`p["two"] { 
+	r := http.send({"method": "GET", "url": "%URL%", "timeout": "10ms", "raise_error": false})
+	r.error.code == "eval_http_send_network_error"
+}`},
+			expected: `["one", "two"]`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			ch := make(chan *http.Request)
+			// A HTTP server that always causes a timeout
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				ch <- r
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte(`{"foo": "bar"}`)) // ignore error
+			}))
+			defer ts.Close()
+
+			var rules []string
+			for _, r := range tc.rules {
+				rules = append(rules, strings.ReplaceAll(r, "%URL%", ts.URL))
+			}
+
+			runTopDownTestCase(t, data, tc.note, rules, tc.expected)
+			requests := getAllRequests(ch)
+
+			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
+			// eval first), so expect 2x the total request count the test case specified.
+			actualCount := len(requests) / 2
+
+			if actualCount != 1 {
+				t.Fatalf("Expected exactly 1 call to HTTP server, got %v", actualCount)
+			}
+		})
+	}
+}
+
+func TestInterQueryCache_ClientError(t *testing.T) {
+	data := loadSmallTestData()
+
+	tests := []struct {
+		note     string
+		rules    []string
+		expected string
+	}{
+		{
+			note: "raised errors",
+			rules: []string{`p["one"] { 
+	not http.send({"method": "GET", "url": "%URL%", "timeout": "10ms", "cache": true}) 
+}`,
+				`p["two"] { 
+	not http.send({"method": "GET", "url": "%URL%", "timeout": "10ms", "cache": true})
+}`},
+			expected: `["one", "two"]`,
+		},
+		{
+			note: "no raised errors",
+			rules: []string{`p["one"] { 
+	r := http.send({"method": "GET", "url": "%URL%", "timeout": "10ms", "cache": true, "raise_error": false}) 
+	r.error.code == "eval_http_send_network_error"
+}`,
+				`p["two"] { 
+	r := http.send({"method": "GET", "url": "%URL%", "timeout": "10ms", "cache": true, "raise_error": false})
+	r.error.code == "eval_http_send_network_error"
+}`},
+			expected: `["one", "two"]`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			ch := make(chan *http.Request)
+
+			// A HTTP server that always causes a timeout
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				ch <- r
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write([]byte(`{"foo": "bar"}`)) // ignore error
+			}))
+			defer ts.Close()
+
+			var rules []string
+			for _, r := range tc.rules {
+				rules = append(rules, strings.ReplaceAll(r, "%URL%", ts.URL))
+			}
+
+			runTopDownTestCase(t, data, tc.note, rules, tc.expected)
+			requests := getAllRequests(ch)
+
+			// Note: The runTopDownTestCase ends up evaluating twice (once with and once without partial
+			// eval first), so expect 2x the total request count the test case specified.
+			actualCount := len(requests) / 2
+
+			if actualCount != 1 {
+				t.Fatalf("Expected exactly 1 call to HTTP server, got %v", actualCount)
+			}
+		})
+	}
+}
+
+func getAllRequests(ch chan *http.Request) []*http.Request {
+	defer close(ch)
+	var requests []*http.Request
+	for {
+		select {
+		case x, ok := <-ch:
+			if ok {
+				requests = append(requests, x)
+			} else {
+				return requests
+			}
+		default:
+			return requests
+		}
+	}
+}
+
+func TestHTTPSendMetrics(t *testing.T) {
 	// run test server
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -2526,8 +3090,7 @@ func TestHTTPSendMetrics(t *testing.T) {
 }
 
 func TestInitDefaults(t *testing.T) {
-	os.Setenv("HTTP_SEND_TIMEOUT", "300mss")
-	defer os.Unsetenv("HTTP_SEND_TIMEOUT")
+	t.Setenv("HTTP_SEND_TIMEOUT", "300mss")
 
 	defer func() {
 		if r := recover(); r == nil {
@@ -2553,14 +3116,14 @@ func TestSocketHTTPGetRequest(t *testing.T) {
 	people = append(people, Person{ID: "1", Firstname: "John"})
 
 	// Create a local socket
-	tmpF, err := ioutil.TempFile("", "")
+	tmpF, err := os.CreateTemp("", "")
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	socketPath := tmpF.Name()
 	tmpF.Close()
-	os.Remove(socketPath)
+	_ = os.Remove(socketPath)
 
 	socket, err := net.Listen("unix", socketPath)
 	if err != nil {
@@ -2571,6 +3134,7 @@ func TestSocketHTTPGetRequest(t *testing.T) {
 		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			headers := w.Header()
 			headers["test-header"] = []string{"test-value"}
+			headers["echo-query-string"] = []string{r.URL.RawQuery}
 			w.WriteHeader(http.StatusOK)
 			_ = json.NewEncoder(w).Encode(people)
 		}),
@@ -2582,7 +3146,7 @@ func TestSocketHTTPGetRequest(t *testing.T) {
 	defer rs.Close()
 
 	path := fmt.Sprintf("socket=%s", url.PathEscape(socketPath))
-	rawURL := fmt.Sprintf("unix://localhost/end/point?%s", path) // Send a request to the server over the socket
+	rawURL := fmt.Sprintf("unix://localhost/end/point?%s&param1=value1&param2=value2", path) // Send a request to the server over the socket
 
 	// expected result
 	expectedResult := make(map[string]interface{})
@@ -2595,15 +3159,13 @@ func TestSocketHTTPGetRequest(t *testing.T) {
 	expectedResult["body"] = body
 	expectedResult["raw_body"] = "[{\"id\":\"1\",\"firstname\":\"John\"}]\n"
 	expectedResult["headers"] = map[string]interface{}{
-		"content-length": []interface{}{"32"},
-		"content-type":   []interface{}{"text/plain; charset=utf-8"},
-		"test-header":    []interface{}{"test-value"},
+		"content-length":    []interface{}{"32"},
+		"content-type":      []interface{}{"text/plain; charset=utf-8"},
+		"test-header":       []interface{}{"test-value"},
+		"echo-query-string": []interface{}{"param1=value1&param2=value2"},
 	}
 
-	resultObj, err := ast.InterfaceToValue(expectedResult)
-	if err != nil {
-		panic(err)
-	}
+	resultObj := ast.MustInterfaceToValue(expectedResult)
 
 	// run the test
 	tests := []struct {
@@ -2623,3 +3185,140 @@ func TestSocketHTTPGetRequest(t *testing.T) {
 		runTopDownTestCase(t, data, tc.note, append(tc.rules, httpSendHelperRules...), tc.expected)
 	}
 }
+
+type tracemock struct {
+	called int
+}
+
+func (m *tracemock) NewTransport(rt http.RoundTripper, _ tracing.Options) http.RoundTripper {
+	m.called++
+	return rt
+}
+
+func (*tracemock) NewHandler(http.Handler, string, tracing.Options) http.Handler {
+	panic("unreachable")
+}
+
+func TestDistributedTracingEnabled(t *testing.T) {
+	mock := tracemock{}
+	tracing.RegisterHTTPTracing(&mock)
+
+	builtinContext := BuiltinContext{
+		Context:                context.Background(),
+		DistributedTracingOpts: tracing.NewOptions(true), // any option means it's enabled
+	}
+
+	_, client, err := createHTTPRequest(builtinContext, ast.NewObject())
+	if err != nil {
+		t.Fatalf("Unexpected error creating HTTP request %v", err)
+	}
+	if client.Transport == nil {
+		t.Fatal("No Transport defined")
+	}
+
+	if exp, act := 1, mock.called; exp != act {
+		t.Errorf("calls to NewTransported: expected %d, got %d", exp, act)
+	}
+}
+
+func TestDistributedTracingDisabled(t *testing.T) {
+	mock := tracemock{}
+	tracing.RegisterHTTPTracing(&mock)
+
+	builtinContext := BuiltinContext{
+		Context: context.Background(),
+	}
+
+	_, client, err := createHTTPRequest(builtinContext, ast.NewObject())
+	if err != nil {
+		t.Fatalf("Unexpected error creating HTTP request %v", err)
+	}
+	if client.Transport == nil {
+		t.Fatal("No Transport defined")
+	}
+
+	if exp, act := 0, mock.called; exp != act {
+		t.Errorf("calls to NewTransported: expected %d, got %d", exp, act)
+	}
+}
+
+func TestHTTPGetRequestAllowNet(t *testing.T) {
+	// test data
+	body := map[string]bool{"ok": true}
+
+	// test server
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(body)
+	}))
+
+	defer ts.Close()
+
+	// host
+	serverURL, err := url.Parse(ts.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	serverHost := strings.Split(serverURL.Host, ":")[0]
+
+	// expected result
+	expectedResult := make(map[string]interface{})
+	expectedResult["status"] = "200 OK"
+	expectedResult["status_code"] = http.StatusOK
+
+	expectedResult["body"] = body
+	expectedResult["raw_body"] = "{\"ok\":true}\n"
+
+	resultObj := ast.MustInterfaceToValue(expectedResult)
+
+	expectedError := &Error{Code: "eval_builtin_error", Message: fmt.Sprintf("http.send: unallowed host: %s", serverHost)}
+
+	rules := []string{fmt.Sprintf(
+		`p = x { http.send({"method": "get", "url": "%s", "force_json_decode": true}, resp); x := remove_headers(resp) }`, ts.URL)}
+
+	// run the test
+	tests := []struct {
+		note     string
+		rules    []string
+		options  func(*Query) *Query
+		expected interface{}
+	}{
+		{
+			"http.send allow_net nil",
+			rules,
+
+			setAllowNet(nil),
+			resultObj.String(),
+		},
+		{
+			"http.send allow_net match",
+			rules,
+			setAllowNet([]string{serverHost}),
+			resultObj.String(),
+		},
+		{
+			"http.send allow_net match + additional host",
+			rules,
+			setAllowNet([]string{serverHost, "example.com"}),
+			resultObj.String(),
+		},
+		{
+			"http.send allow_net empty",
+			rules,
+			setAllowNet([]string{}),
+			expectedError,
+		},
+		{
+			"http.send allow_net no match",
+			rules,
+			setAllowNet([]string{"example.com"}),
+			expectedError,
+		},
+	}
+
+	data := loadSmallTestData()
+
+	for _, tc := range tests {
+		runTopDownTestCase(t, data, tc.note, append(tc.rules, httpSendHelperRules...), tc.expected, tc.options)
+	}
+}
diff --git a/topdown/json.go b/topdown/json.go
index 09a0ea6a93..8a5d232836 100644
--- a/topdown/json.go
+++ b/topdown/json.go
@@ -11,10 +11,11 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/topdown/builtins"
+
+	"github.com/open-policy-agent/opa/internal/edittree"
 )
 
 func builtinJSONRemove(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-
 	// Expect an object and a string or array/set of strings
 	_, err := builtins.ObjectOperand(operands[0].Value, 1)
 	if err != nil {
@@ -116,7 +117,6 @@ func jsonRemove(a *ast.Term, b *ast.Term) (*ast.Term, error) {
 }
 
 func builtinJSONFilter(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-
 	// Ensure we have the right parameters, expect an object and a string or array/set of strings
 	obj, err := builtins.ObjectOperand(operands[0].Value, 1)
 	if err != nil {
@@ -196,13 +196,18 @@ func parsePath(path *ast.Term) (ast.Ref, error) {
 }
 
 func pathsToObject(paths []ast.Ref) ast.Object {
-
 	root := ast.NewObject()
 
 	for _, path := range paths {
 		node := root
 		var done bool
 
+		// If the path is an empty JSON path, skip all further processing.
+		if len(path) == 0 {
+			done = true
+		}
+
+		// Otherwise, we should have 1+ path segments to work with.
 		for i := 0; i < len(path)-1 && !done; i++ {
 
 			k := path[i]
@@ -233,288 +238,147 @@ func pathsToObject(paths []ast.Ref) ast.Object {
 	return root
 }
 
-// toIndex tries to convert path elements (that may be strings) into indices into
-// an array.
-func toIndex(arr *ast.Array, term *ast.Term) (int, error) {
-	i := 0
+type jsonPatch struct {
+	op    string
+	path  *ast.Term
+	from  *ast.Term
+	value *ast.Term
+}
+
+func getPatch(o ast.Object) (jsonPatch, error) {
+	validOps := map[string]struct{}{"add": {}, "remove": {}, "replace": {}, "move": {}, "copy": {}, "test": {}}
+	var out jsonPatch
 	var ok bool
-	switch v := term.Value.(type) {
-	case ast.Number:
-		if i, ok = v.Int(); !ok {
-			return 0, fmt.Errorf("Invalid number type for indexing")
+	getAttribute := func(attr string) (*ast.Term, error) {
+		if term := o.Get(ast.StringTerm(attr)); term != nil {
+			return term, nil
 		}
-	case ast.String:
-		if v == "-" {
-			return arr.Len(), nil
-		}
-		num := ast.Number(v)
-		if i, ok = num.Int(); !ok {
-			return 0, fmt.Errorf("Invalid string for indexing")
-		}
-		if v != "0" && strings.HasPrefix(string(v), "0") {
-			return 0, fmt.Errorf("Leading zeros are not allowed in JSON paths")
-		}
-	default:
-		return 0, fmt.Errorf("Invalid type for indexing")
-	}
-
-	return i, nil
-}
 
-// patchWorkerris a worker that modifies a direct child of a term located
-// at the given key.  It returns the new term, and optionally a result that
-// is passed back to the caller.
-type patchWorker = func(parent, key *ast.Term) (updated, result *ast.Term)
-
-func jsonPatchTraverse(
-	target *ast.Term,
-	path ast.Ref,
-	worker patchWorker,
-) (*ast.Term, *ast.Term) {
-	if len(path) < 1 {
-		return nil, nil
+		return nil, fmt.Errorf("missing '%s' attribute", attr)
 	}
 
-	key := path[0]
-	if len(path) == 1 {
-		return worker(target, key)
+	opTerm, err := getAttribute("op")
+	if err != nil {
+		return out, err
+	}
+	op, ok := opTerm.Value.(ast.String)
+	if !ok {
+		return out, fmt.Errorf("attribute 'op' must be a string")
+	}
+	out.op = string(op)
+	if _, found := validOps[out.op]; !found {
+		out.op = ""
+		return out, fmt.Errorf("unrecognized op '%s'", string(op))
 	}
 
-	success := false
-	var updated, result *ast.Term
-	switch parent := target.Value.(type) {
-	case ast.Object:
-		obj := ast.NewObject()
-		parent.Foreach(func(k, v *ast.Term) {
-			if k.Equal(key) {
-				if v, result = jsonPatchTraverse(v, path[1:], worker); v != nil {
-					obj.Insert(k, v)
-					success = true
-				}
-			} else {
-				obj.Insert(k, v)
-			}
-		})
-		updated = ast.NewTerm(obj)
+	pathTerm, err := getAttribute("path")
+	if err != nil {
+		return out, err
+	}
+	out.path = pathTerm
 
-	case *ast.Array:
-		idx, err := toIndex(parent, key)
+	// Only fetch the "from" parameter for move/copy ops.
+	switch out.op {
+	case "move", "copy":
+		fromTerm, err := getAttribute("from")
 		if err != nil {
-			return nil, nil
+			return out, err
 		}
-		arr := ast.NewArray()
-		for i := 0; i < parent.Len(); i++ {
-			v := parent.Elem(i)
-			if idx == i {
-				if v, result = jsonPatchTraverse(v, path[1:], worker); v != nil {
-					arr = arr.Append(v)
-					success = true
-				}
-			} else {
-				arr = arr.Append(v)
-			}
-		}
-		updated = ast.NewTerm(arr)
-
-	case ast.Set:
-		set := ast.NewSet()
-		parent.Foreach(func(k *ast.Term) {
-			if k.Equal(key) {
-				if k, result = jsonPatchTraverse(k, path[1:], worker); k != nil {
-					set.Add(k)
-					success = true
-				}
-			} else {
-				set.Add(k)
-			}
-		})
-		updated = ast.NewTerm(set)
+		out.from = fromTerm
 	}
 
-	if success {
-		return updated, result
+	// Only fetch the "value" parameter for add/replace/test ops.
+	switch out.op {
+	case "add", "replace", "test":
+		valueTerm, err := getAttribute("value")
+		if err != nil {
+			return out, err
+		}
+		out.value = valueTerm
 	}
 
-	return nil, nil
+	return out, nil
 }
 
-// jsonPatchGet goes one step further than jsonPatchTraverse and returns the
-// term at the location specified by the path.  It is used in functions
-// where we want to read a value but not manipulate its parent: for example
-// jsonPatchTest and jsonPatchCopy.
-//
-// Because it uses jsonPatchTraverse, it makes shallow copies of the objects
-// along the path.  We could possibly add a signaling mechanism that we didn't
-// make any changes to avoid this.
-func jsonPatchGet(target *ast.Term, path ast.Ref) *ast.Term {
-	// Special case: get entire document.
-	if len(path) == 0 {
-		return target
-	}
+func applyPatches(source *ast.Term, operations *ast.Array) (*ast.Term, error) {
+	et := edittree.NewEditTree(source)
+	for i := 0; i < operations.Len(); i++ {
+		object, ok := operations.Elem(i).Value.(ast.Object)
+		if !ok {
+			return nil, fmt.Errorf("must be an array of JSON-Patch objects, but at least one element is not an object")
+		}
+		patch, err := getPatch(object)
+		if err != nil {
+			return nil, err
+		}
+		path, err := parsePath(patch.path)
+		if err != nil {
+			return nil, err
+		}
 
-	_, result := jsonPatchTraverse(target, path, func(parent, key *ast.Term) (*ast.Term, *ast.Term) {
-		switch v := parent.Value.(type) {
-		case ast.Object:
-			return parent, v.Get(key)
-		case *ast.Array:
-			i, err := toIndex(v, key)
-			if err == nil {
-				return parent, v.Elem(i)
+		switch patch.op {
+		case "add":
+			_, err = et.InsertAtPath(path, patch.value)
+			if err != nil {
+				return nil, err
 			}
-		case ast.Set:
-			if v.Contains(key) {
-				return parent, key
+		case "remove":
+			_, err = et.DeleteAtPath(path)
+			if err != nil {
+				return nil, err
 			}
-		}
-		return nil, nil
-	})
-	return result
-}
-
-func jsonPatchAdd(target *ast.Term, path ast.Ref, value *ast.Term) *ast.Term {
-	// Special case: replacing root document.
-	if len(path) == 0 {
-		return value
-	}
-
-	target, _ = jsonPatchTraverse(target, path, func(parent *ast.Term, key *ast.Term) (*ast.Term, *ast.Term) {
-		switch original := parent.Value.(type) {
-		case ast.Object:
-			obj := ast.NewObject()
-			original.Foreach(func(k, v *ast.Term) {
-				obj.Insert(k, v)
-			})
-			obj.Insert(key, value)
-			return ast.NewTerm(obj), nil
-		case *ast.Array:
-			idx, err := toIndex(original, key)
-			if err != nil || idx < 0 || idx > original.Len() {
-				return nil, nil
+		case "replace":
+			_, err = et.DeleteAtPath(path)
+			if err != nil {
+				return nil, err
 			}
-			arr := ast.NewArray()
-			for i := 0; i < idx; i++ {
-				arr = arr.Append(original.Elem(i))
+			_, err = et.InsertAtPath(path, patch.value)
+			if err != nil {
+				return nil, err
 			}
-			arr = arr.Append(value)
-			for i := idx; i < original.Len(); i++ {
-				arr = arr.Append(original.Elem(i))
+		case "move":
+			from, err := parsePath(patch.from)
+			if err != nil {
+				return nil, err
 			}
-			return ast.NewTerm(arr), nil
-		case ast.Set:
-			if !key.Equal(value) {
-				return nil, nil
+			chunk, err := et.RenderAtPath(from)
+			if err != nil {
+				return nil, err
 			}
-			set := ast.NewSet()
-			original.Foreach(func(k *ast.Term) {
-				set.Add(k)
-			})
-			set.Add(key)
-			return ast.NewTerm(set), nil
-		}
-		return nil, nil
-	})
-
-	return target
-}
-
-func jsonPatchRemove(target *ast.Term, path ast.Ref) (*ast.Term, *ast.Term) {
-	// Special case: replacing root document.
-	if len(path) == 0 {
-		return nil, nil
-	}
-
-	target, removed := jsonPatchTraverse(target, path, func(parent *ast.Term, key *ast.Term) (*ast.Term, *ast.Term) {
-		var removed *ast.Term
-		switch original := parent.Value.(type) {
-		case ast.Object:
-			obj := ast.NewObject()
-			original.Foreach(func(k, v *ast.Term) {
-				if k.Equal(key) {
-					removed = v
-				} else {
-					obj.Insert(k, v)
-				}
-			})
-			return ast.NewTerm(obj), removed
-		case *ast.Array:
-			idx, err := toIndex(original, key)
-			if err != nil || idx < 0 || idx >= original.Len() {
-				return nil, nil
+			_, err = et.DeleteAtPath(from)
+			if err != nil {
+				return nil, err
+			}
+			_, err = et.InsertAtPath(path, chunk)
+			if err != nil {
+				return nil, err
+			}
+		case "copy":
+			from, err := parsePath(patch.from)
+			if err != nil {
+				return nil, err
 			}
-			arr := ast.NewArray()
-			for i := 0; i < idx; i++ {
-				arr = arr.Append(original.Elem(i))
+			chunk, err := et.RenderAtPath(from)
+			if err != nil {
+				return nil, err
+			}
+			_, err = et.InsertAtPath(path, chunk)
+			if err != nil {
+				return nil, err
+			}
+		case "test":
+			chunk, err := et.RenderAtPath(path)
+			if err != nil {
+				return nil, err
 			}
-			removed = original.Elem(idx)
-			for i := idx + 1; i < original.Len(); i++ {
-				arr = arr.Append(original.Elem(i))
+			if !chunk.Equal(patch.value) {
+				return nil, fmt.Errorf("value from EditTree != patch value.\n\nExpected: %v\n\nFound: %v", patch.value, chunk)
 			}
-			return ast.NewTerm(arr), removed
-		case ast.Set:
-			set := ast.NewSet()
-			original.Foreach(func(k *ast.Term) {
-				if k.Equal(key) {
-					removed = k
-				} else {
-					set.Add(k)
-				}
-			})
-			return ast.NewTerm(set), removed
 		}
-		return nil, nil
-	})
-
-	if target != nil && removed != nil {
-		return target, removed
-	}
-
-	return nil, nil
-}
-
-func jsonPatchReplace(target *ast.Term, path ast.Ref, value *ast.Term) *ast.Term {
-	// Special case: replacing the whole document.
-	if len(path) == 0 {
-		return value
-	}
-
-	// Replace is specified as `remove` followed by `add`.
-	if target, _ = jsonPatchRemove(target, path); target == nil {
-		return nil
-	}
-
-	return jsonPatchAdd(target, path, value)
-}
-
-func jsonPatchMove(target *ast.Term, path ast.Ref, from ast.Ref) *ast.Term {
-	// Move is specified as `remove` followed by `add`.
-	target, removed := jsonPatchRemove(target, from)
-	if target == nil || removed == nil {
-		return nil
-	}
-
-	return jsonPatchAdd(target, path, removed)
-}
-
-func jsonPatchCopy(target *ast.Term, path ast.Ref, from ast.Ref) *ast.Term {
-	value := jsonPatchGet(target, from)
-	if value == nil {
-		return nil
 	}
-
-	return jsonPatchAdd(target, path, value)
-}
-
-func jsonPatchTest(target *ast.Term, path ast.Ref, value *ast.Term) *ast.Term {
-	actual := jsonPatchGet(target, path)
-	if actual == nil {
-		return nil
-	}
-
-	if actual.Equal(value) {
-		return target
-	}
-
-	return nil
+	final := et.Render()
+	// TODO: Nil check here?
+	return final, nil
 }
 
 func builtinJSONPatch(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
@@ -527,93 +391,11 @@ func builtinJSONPatch(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Ter
 		return err
 	}
 
-	// Apply operations one by one.
-	for i := 0; i < operations.Len(); i++ {
-		if object, ok := operations.Elem(i).Value.(ast.Object); ok {
-			getAttribute := func(attr string) (*ast.Term, error) {
-				if term := object.Get(ast.StringTerm(attr)); term != nil {
-					return term, nil
-				}
-
-				return nil, builtins.NewOperandErr(2, fmt.Sprintf("patch is missing '%s' attribute", attr))
-			}
-
-			getPathAttribute := func(attr string) (ast.Ref, error) {
-				term, err := getAttribute(attr)
-				if err != nil {
-					return ast.Ref{}, err
-				}
-				path, err := parsePath(term)
-				if err != nil {
-					return ast.Ref{}, err
-				}
-				return path, nil
-			}
-
-			// Parse operation.
-			opTerm, err := getAttribute("op")
-			if err != nil {
-				return err
-			}
-			op, ok := opTerm.Value.(ast.String)
-			if !ok {
-				return builtins.NewOperandErr(2, "patch attribute 'op' must be a string")
-			}
-
-			// Parse path.
-			path, err := getPathAttribute("path")
-			if err != nil {
-				return err
-			}
-
-			switch op {
-			case "add":
-				value, err := getAttribute("value")
-				if err != nil {
-					return err
-				}
-				target = jsonPatchAdd(target, path, value)
-			case "remove":
-				target, _ = jsonPatchRemove(target, path)
-			case "replace":
-				value, err := getAttribute("value")
-				if err != nil {
-					return err
-				}
-				target = jsonPatchReplace(target, path, value)
-			case "move":
-				from, err := getPathAttribute("from")
-				if err != nil {
-					return err
-				}
-				target = jsonPatchMove(target, path, from)
-			case "copy":
-				from, err := getPathAttribute("from")
-				if err != nil {
-					return err
-				}
-				target = jsonPatchCopy(target, path, from)
-			case "test":
-				value, err := getAttribute("value")
-				if err != nil {
-					return err
-				}
-				target = jsonPatchTest(target, path, value)
-			default:
-				return builtins.NewOperandErr(2, "must be an array of JSON-Patch objects")
-			}
-		} else {
-			return builtins.NewOperandErr(2, "must be an array of JSON-Patch objects")
-		}
-
-		// JSON patches should work atomically; and if one of them fails,
-		// we should not try to continue.
-		if target == nil {
-			return nil
-		}
+	patched, err := applyPatches(target, operations)
+	if err != nil {
+		return nil
 	}
-
-	return iter(target)
+	return iter(patched)
 }
 
 func init() {
diff --git a/topdown/json_bench_test.go b/topdown/json_bench_test.go
new file mode 100644
index 0000000000..2f1049dc5d
--- /dev/null
+++ b/topdown/json_bench_test.go
@@ -0,0 +1,537 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/storage"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
+)
+
+// Tests on only single-layer composite data types.
+// func BenchmarkJSONPatchAdd(b *testing.B) {
+// 	ctx := context.Background()
+
+// 	sizes := []int{10, 100, 1000, 1000}
+// }
+
+// func BenchmarkJSONPatchRemove(b *testing.B) {
+// 	ctx := context.Background()
+
+// 	sizes := []int{10, 100, 1000, 1000}
+// }
+
+// func BenchmarkJSONPatchReplace(b *testing.B) {
+// 	ctx := context.Background()
+
+// 	sizes := []int{10, 100, 1000, 1000}
+
+// }
+func BenchmarkJSONPatchAddShallowScalar(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000, 10000}
+
+	// Object case
+	for _, n := range sizes {
+		source := genTestObject(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("object-%d-%d", n, m)
+			// Build dataset right before use:
+			plArrayObj := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("add", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, ast.IntNumberTerm(i+n)))
+			}
+			patchList := ast.NewArray(plArrayObj...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+
+	// Array case
+	for _, n := range sizes {
+		source := genTestArray(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("array-%d-%d", n, m)
+			// Build dataset right before use:
+			plArrayObj := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("add", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, ast.IntNumberTerm(i+n)))
+			}
+			patchList := ast.NewArray(plArrayObj...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+	// Set case
+	for _, n := range sizes {
+		source := genTestSet(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("set-%d-%d", n, m)
+			// Build dataset right before use:
+			plSet := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plSet = append(plSet, genTestJSONPatchObject("add", ast.ArrayTerm(ast.IntNumberTerm(i+n)), nil, ast.IntNumberTerm(i+n)))
+			}
+			patchList := ast.NewArray(plSet...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+}
+
+func BenchmarkJSONPatchAddShallowComposite(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000, 10000}
+
+	// Object case
+	for _, n := range sizes {
+		source := genTestObject(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("object-%d-%d", n, m)
+			// Build dataset right before use:
+			plArrayObj := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("add", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, ast.ArrayTerm(ast.IntNumberTerm(i+n))))
+			}
+			patchList := ast.NewArray(plArrayObj...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+
+	// Array case
+	for _, n := range sizes {
+		source := genTestArray(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("array-%d-%d", n, m)
+			// Build dataset right before use:
+			plArrayObj := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("add", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, ast.ArrayTerm(ast.IntNumberTerm(i+n))))
+			}
+			patchList := ast.NewArray(plArrayObj...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+	// Set case
+	for _, n := range sizes {
+		source := genTestSet(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("set-%d-%d", n, m)
+			// Build dataset right before use:
+			plSet := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plSet = append(plSet, genTestJSONPatchObject("add", ast.ArrayTerm(ast.ArrayTerm(ast.IntNumberTerm(i+n))), nil, ast.ArrayTerm(ast.IntNumberTerm(i+n))))
+			}
+			patchList := ast.NewArray(plSet...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+}
+
+func BenchmarkJSONPatchAddRemove(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000, 10000}
+
+	// Object case
+	for _, n := range sizes {
+		source := genTestObject(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("object-%d-%d", n, m)
+			// Build dataset right before use:
+			plArrayObj := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("add", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, ast.IntNumberTerm(i+n)))
+			}
+			// remove ops
+			for i := m - 1; i >= 0; i-- {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("remove", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, nil))
+			}
+			patchList := ast.NewArray(plArrayObj...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+
+	// Array case
+	for _, n := range sizes {
+		source := genTestArray(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("array-%d-%d", n, m)
+			// Build dataset right before use:
+			plArrayObj := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("add", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, ast.IntNumberTerm(i+n)))
+			}
+			// remove ops
+			for i := m - 1; i >= 0; i-- {
+				plArrayObj = append(plArrayObj, genTestJSONPatchObject("remove", ast.StringTerm("/"+strconv.FormatInt(int64(i+n), 10)), nil, nil))
+			}
+			patchList := ast.NewArray(plArrayObj...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+
+	// Set case
+	for _, n := range sizes {
+		source := genTestSet(n)
+		for _, m := range sizes {
+			testName := fmt.Sprintf("set-%d-%d", n, m)
+			// Build dataset right before use:
+			plSet := make([]*ast.Term, 0, m*2)
+			// add ops
+			for i := 0; i < m; i++ {
+				plSet = append(plSet, genTestJSONPatchObject("add", ast.ArrayTerm(ast.IntNumberTerm(i+n)), nil, ast.IntNumberTerm(i+n)))
+			}
+			// remove ops
+			for i := m - 1; i >= 0; i-- {
+				plSet = append(plSet, genTestJSONPatchObject("remove", ast.ArrayTerm(ast.IntNumberTerm(i+n)), nil, nil))
+			}
+			patchList := ast.NewArray(plSet...)
+
+			b.ResetTimer()
+			b.Run(testName, func(b *testing.B) {
+				runJSONPatchBenchmarkTest(ctx, b, source, patchList)
+			})
+		}
+	}
+}
+
+func genTestJSONPatchObject(op string, path, from, value *ast.Term) *ast.Term {
+	patchObj := ast.NewObject(
+		[2]*ast.Term{ast.StringTerm("op"), ast.StringTerm(op)},
+		[2]*ast.Term{ast.StringTerm("path"), path},
+	)
+	if from != nil {
+		patchObj.Insert(ast.StringTerm("from"), from)
+	}
+	if value != nil {
+		patchObj.Insert(ast.StringTerm("value"), value)
+	}
+	return ast.NewTerm(patchObj)
+}
+
+func genTestObject(width int) ast.Value {
+	out := ast.NewObject()
+	for i := 0; i < width; i++ {
+		out.Insert(ast.IntNumberTerm(i), ast.IntNumberTerm(i))
+	}
+	return out
+}
+
+func genTestArray(width int) ast.Value {
+	out := ast.NewArray()
+	for i := 0; i < width; i++ {
+		out = out.Append(ast.IntNumberTerm(i))
+	}
+	return out
+}
+
+func genTestSet(width int) ast.Value {
+	out := ast.NewSet()
+	for i := 0; i < width; i++ {
+		out.Add(ast.IntNumberTerm(i))
+	}
+	return out
+}
+
+// For the purposes of addressing the original Github issue (#4409), a
+// fairly shallow object with many keys ought to do the trick.
+func gen3LayerObject(l1Keys, l2Keys, l3Keys int) ast.Value {
+	obj := ast.NewObject()
+	for i := 0; i < l1Keys; i++ {
+		l2Obj := ast.NewObject()
+		for j := 0; j < l2Keys; j++ {
+			l3Obj := ast.NewObject()
+			for k := 0; k < l3Keys; k++ {
+				l3Obj.Insert(ast.StringTerm(fmt.Sprintf("%d", k)), ast.BooleanTerm(true))
+			}
+			l2Obj.Insert(ast.StringTerm(fmt.Sprintf("%d", j)), ast.NewTerm(l3Obj))
+		}
+		obj.Insert(ast.StringTerm(fmt.Sprintf("%d", i)), ast.NewTerm(l2Obj))
+	}
+	return obj
+}
+
+// Generates a list of paths for JSON operations. N keys per level, M levels. P patches.
+// TODO: Generate non-conflicting paths.
+func genRandom3LayerObjectJSONPatchListData(l1Keys, l2Keys, l3Keys, p int) ast.Value {
+	patchList := make([]*ast.Term, p)
+	numKeys := []int{l1Keys, l2Keys, l3Keys}
+	for i := 0; i < p; i++ {
+		patchObj := ast.NewObject(
+			[2]*ast.Term{ast.StringTerm("op"), ast.StringTerm("replace")},
+			[2]*ast.Term{ast.StringTerm("value"), ast.IntNumberTerm(2)},
+		)
+		// Random path depth.
+		depth := rand.Intn(3) + 1 // (max - min) + min method of getting a random range.
+
+		// Random values for each path segment.
+		segments := []string{}
+		for j := 0; j < depth; j++ {
+			pathSegment := strconv.FormatInt(int64(rand.Intn(numKeys[j])), 10)
+			segments = append(segments, "/", pathSegment)
+		}
+		path := strings.Join(segments, "")
+		patchObj.Insert(ast.StringTerm("path"), ast.StringTerm(path))
+		patchList[i] = ast.NewTerm(patchObj)
+	}
+	return ast.NewArray(patchList...)
+}
+
+func BenchmarkJSONPatchReplace(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000}
+
+	// Pre-generate the test datasets/patches.
+	testdata := map[string][2]ast.Value{}
+	for _, n := range sizes {
+		for _, m := range sizes {
+			testObj := gen3LayerObject(n, m, 10)
+			for _, p := range sizes {
+				testdata[fmt.Sprintf("%dx%dx10-%dp", n, m, p)] = [2]ast.Value{testObj, genRandom3LayerObjectJSONPatchListData(n, m, 10, p)}
+			}
+		}
+	}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			for _, p := range sizes {
+				testName := fmt.Sprintf("%dx%dx10-%dp", n, m, p)
+				b.Run(testName, func(b *testing.B) {
+					store := inmem.NewFromObject(map[string]interface{}{
+						"obj":     testdata[testName][0],
+						"patches": testdata[testName][1],
+					})
+
+					module := `package test
+
+					result := json.patch(data.obj, data.patches)`
+
+					query := ast.MustParseBody("data.test.result")
+					compiler := ast.MustCompileModules(map[string]string{
+						"test.rego": module,
+					})
+
+					b.ResetTimer()
+
+					for i := 0; i < b.N; i++ {
+
+						err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+							q := NewQuery(query).
+								WithCompiler(compiler).
+								WithStore(store).
+								WithTransaction(txn)
+
+							_, err := q.Run(ctx)
+							if err != nil {
+								return err
+							}
+
+							return nil
+						})
+
+						if err != nil {
+							b.Fatal(err)
+						}
+					}
+				})
+			}
+		}
+	}
+}
+
+func BenchmarkJSONPatchPathologicalNestedAddChainObject(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 500, 1000, 5000, 10000}
+	// Pre-generate the test datasets/patches.
+	testdata := map[string]ast.Value{}
+	for _, n := range sizes {
+		patchList := make([]*ast.Term, n)
+		path := ""
+		for i := 0; i < n; i++ {
+			patchObj := ast.NewObject(
+				[2]*ast.Term{ast.StringTerm("op"), ast.StringTerm("add")},
+				[2]*ast.Term{ast.StringTerm("value"), ast.ObjectTerm()},
+			)
+
+			path = path + "/a"
+
+			patchObj.Insert(ast.StringTerm("path"), ast.StringTerm(path))
+			patchList[i] = ast.NewTerm(patchObj)
+		}
+		testdata[fmt.Sprintf("%d", n)] = ast.NewArray(patchList...)
+	}
+
+	for _, n := range sizes {
+		testName := fmt.Sprintf("%d", n)
+		b.Run(testName, func(b *testing.B) {
+			runJSONPatchBenchmarkTest(ctx, b, ast.NewObject(), testdata[testName])
+		})
+	}
+}
+
+func BenchmarkJSONPatchPathologicalNestedAddChainArray(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 500, 1000, 5000, 10000}
+	// Pre-generate the test datasets/patches.
+	testdata := map[string]ast.Value{}
+	for _, n := range sizes {
+		patchList := make([]*ast.Term, n)
+		path := ""
+		for i := 0; i < n; i++ {
+			patchObj := ast.NewObject(
+				[2]*ast.Term{ast.StringTerm("op"), ast.StringTerm("add")},
+				[2]*ast.Term{ast.StringTerm("value"), ast.ArrayTerm()},
+			)
+
+			path = path + "/0"
+
+			patchObj.Insert(ast.StringTerm("path"), ast.StringTerm(path))
+			patchList[i] = ast.NewTerm(patchObj)
+		}
+		testdata[fmt.Sprintf("%d", n)] = ast.NewArray(patchList...)
+	}
+
+	for _, n := range sizes {
+		testName := fmt.Sprintf("%d", n)
+		b.Run(testName, func(b *testing.B) {
+			runJSONPatchBenchmarkTest(ctx, b, ast.NewArray(), testdata[testName])
+		})
+	}
+}
+
+// This one is tricky, because sets used content-based addressing.
+// That means our sets for the path have to be recursively constructed!
+func BenchmarkJSONPatchPathologicalNestedAddChainSet(b *testing.B) {
+	ctx := context.Background()
+	sizes := []int{10, 100, 500, 1000}
+
+	// Pre-generate the test datasets/patches.
+	testdata := map[string]ast.Value{}
+	for _, n := range sizes {
+		patchList := make([]*ast.Term, n)
+		for i := 0; i < n; i++ {
+			patchObj := ast.NewObject(
+				[2]*ast.Term{ast.StringTerm("op"), ast.StringTerm("add")},
+			)
+			value := ast.SetTerm(ast.StringTerm("a"))
+			constructedPath := ast.NewArray(ast.SetTerm(ast.StringTerm("a")))
+			for j := 0; j < i; j++ {
+				constructedPath = constructedPath.Append(value)
+				value = ast.SetTerm(ast.StringTerm("a"), value)
+			}
+
+			// Reverse the ast.Array slice.
+			path := ast.NewArray()
+			pathLength := constructedPath.Len() - 1
+			for j := 0; j < constructedPath.Len(); j++ {
+				path = path.Append(constructedPath.Elem(pathLength - j))
+			}
+
+			patchObj.Insert(ast.StringTerm("value"), ast.SetTerm(ast.StringTerm("a")))
+			patchObj.Insert(ast.StringTerm("path"), ast.NewTerm(path))
+			patchList[i] = ast.NewTerm(patchObj)
+		}
+		testdata[fmt.Sprintf("%d", n)] = ast.NewArray(patchList...)
+	}
+
+	for _, n := range sizes {
+		testName := fmt.Sprintf("%d", n)
+		b.Run(testName, func(b *testing.B) {
+			runJSONPatchBenchmarkTest(ctx, b, ast.NewSet(ast.StringTerm("a")), testdata[testName])
+		})
+	}
+}
+
+func runJSONPatchBenchmarkTest(ctx context.Context, b *testing.B, source ast.Value, patches ast.Value) {
+	store := inmem.NewFromObject(map[string]interface{}{
+		"source":  source,
+		"patches": patches,
+	})
+
+	module := `package test
+
+			result := json.patch(data.source, data.patches)`
+
+	query := ast.MustParseBody("data.test.result")
+	compiler := ast.MustCompileModules(map[string]string{
+		"test.rego": module,
+	})
+
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+
+		err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+			q := NewQuery(query).
+				WithCompiler(compiler).
+				WithStore(store).
+				WithTransaction(txn)
+
+			_, err := q.Run(ctx)
+			if err != nil {
+				return err
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+
+}
diff --git a/topdown/json_test.go b/topdown/json_test.go
index 53d114e4ae..f1056f0c98 100644
--- a/topdown/json_test.go
+++ b/topdown/json_test.go
@@ -16,6 +16,11 @@ func TestFiltersToObject(t *testing.T) {
 		filters  []string
 		expected string
 	}{
+		{
+			note:     "empty path",
+			filters:  []string{`""`},
+			expected: `{}`,
+		},
 		{
 			note:     "base",
 			filters:  []string{`"a/b/c"`},
@@ -81,6 +86,11 @@ func TestFiltersToObject(t *testing.T) {
 			filters:  []string{`"a/~0b~1c/d~1~0"`},
 			expected: `{"a": {"~b/c": {"d/~": null}}}`,
 		},
+		{
+			note:     "empty strings mixed with normal paths",
+			filters:  []string{`"a/b/c"`, `""`, `"a/b/d"`, `"a/e/f"`, `""`},
+			expected: `{"a": {"b": {"c": null, "d": null}, "e": {"f": null}}}`,
+		},
 	}
 
 	for _, tc := range cases {
diff --git a/topdown/jsonschema.go b/topdown/jsonschema.go
new file mode 100644
index 0000000000..f44398f1e7
--- /dev/null
+++ b/topdown/jsonschema.go
@@ -0,0 +1,109 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"encoding/json"
+	"errors"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/gojsonschema"
+)
+
+// astValueToJSONSchemaLoader converts a value to JSON Loader.
+// Value can be ast.String or ast.Object.
+func astValueToJSONSchemaLoader(value ast.Value) (gojsonschema.JSONLoader, error) {
+	var loader gojsonschema.JSONLoader
+	var err error
+
+	// ast.Value type selector.
+	switch x := value.(type) {
+	case ast.String:
+		// In case of string pass it as is as a raw JSON string.
+		// Make pre-check that it's a valid JSON at all because gojsonschema won't do that.
+		if !json.Valid([]byte(x)) {
+			return nil, errors.New("invalid JSON string")
+		}
+		loader = gojsonschema.NewStringLoader(string(x))
+	case ast.Object:
+		// In case of object serialize it to JSON representation.
+		var data interface{}
+		data, err = ast.JSON(value)
+		if err != nil {
+			return nil, err
+		}
+		loader = gojsonschema.NewGoLoader(data)
+	default:
+		// Any other cases will produce an error.
+		return nil, errors.New("wrong type, expected string or object")
+	}
+
+	return loader, nil
+}
+
+func newResultTerm(valid bool, data *ast.Term) *ast.Term {
+	return ast.ArrayTerm(ast.BooleanTerm(valid), data)
+}
+
+// builtinJSONSchemaVerify accepts 1 argument which can be string or object and checks if it is valid JSON schema.
+// Returns array [false, <string>] with error string at index 1, or [true, ""] with empty string at index 1 otherwise.
+func builtinJSONSchemaVerify(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	// Take first argument and make JSON Loader from it.
+	loader, err := astValueToJSONSchemaLoader(operands[0].Value)
+	if err != nil {
+		return iter(newResultTerm(false, ast.StringTerm("jsonschema: "+err.Error())))
+	}
+
+	// Check that schema is correct and parses without errors.
+	if _, err = gojsonschema.NewSchema(loader); err != nil {
+		return iter(newResultTerm(false, ast.StringTerm("jsonschema: "+err.Error())))
+	}
+
+	return iter(newResultTerm(true, ast.NullTerm()))
+}
+
+// builtinJSONMatchSchema accepts 2 arguments both can be string or object and verifies if the document matches the JSON schema.
+// Returns an array where first element is a boolean indicating a successful match, and the second is an array of errors that is empty on success and populated on failure.
+// In case of internal error returns empty array.
+func builtinJSONMatchSchema(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	// Take first argument and make JSON Loader from it.
+	// This is a JSON document made from Rego JSON string or object.
+	documentLoader, err := astValueToJSONSchemaLoader(operands[0].Value)
+	if err != nil {
+		return err
+	}
+
+	// Take second argument and make JSON Loader from it.
+	// This is a JSON schema made from Rego JSON string or object.
+	schemaLoader, err := astValueToJSONSchemaLoader(operands[1].Value)
+	if err != nil {
+		return err
+	}
+
+	// Use schema to validate document.
+	result, err := gojsonschema.Validate(schemaLoader, documentLoader)
+	if err != nil {
+		return err
+	}
+
+	// In case of validation errors produce Rego array of objects to describe the errors.
+	arr := ast.NewArray()
+	for _, re := range result.Errors() {
+		o := ast.NewObject(
+			[...]*ast.Term{ast.StringTerm("error"), ast.StringTerm(re.String())},
+			[...]*ast.Term{ast.StringTerm("type"), ast.StringTerm(re.Type())},
+			[...]*ast.Term{ast.StringTerm("field"), ast.StringTerm(re.Field())},
+			[...]*ast.Term{ast.StringTerm("desc"), ast.StringTerm(re.Description())},
+		)
+		arr = arr.Append(ast.NewTerm(o))
+	}
+
+	return iter(newResultTerm(result.Valid(), ast.NewTerm(arr)))
+}
+
+func init() {
+	RegisterBuiltinFunc(ast.JSONSchemaVerify.Name, builtinJSONSchemaVerify)
+	RegisterBuiltinFunc(ast.JSONMatchSchema.Name, builtinJSONMatchSchema)
+}
diff --git a/topdown/jsonschema_test.go b/topdown/jsonschema_test.go
new file mode 100644
index 0000000000..5ff2791d82
--- /dev/null
+++ b/topdown/jsonschema_test.go
@@ -0,0 +1,275 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+)
+
+func TestAstValueToJSONSchemaLoader(t *testing.T) {
+	cases := []struct {
+		note   string
+		schema ast.Value
+		valid  bool
+	}{
+		{
+			note:   "string empty json object",
+			schema: ast.String(`{}`),
+			valid:  true,
+		},
+		{
+			note:   "string broken json",
+			schema: ast.String(`{ "properties": { id: {} } }`),
+			valid:  false,
+		},
+		{
+			note: "string simple schema",
+			schema: ast.String(`
+			{
+				"properties": {
+					"id": {
+						"type": "integer"
+					}
+				},
+				"required": ["id"]
+			}
+			`),
+			valid: true,
+		},
+		{
+			note:   "object empty",
+			schema: ast.NewObject(),
+			valid:  true,
+		},
+		{
+			note: "object simple schema",
+			schema: ast.NewObject(
+				[...]*ast.Term{
+					ast.StringTerm("properties"),
+					ast.NewTerm(ast.NewObject(
+						[...]*ast.Term{
+							ast.StringTerm("id"),
+							ast.NewTerm(ast.NewObject(
+								[...]*ast.Term{
+									ast.StringTerm("type"),
+									ast.StringTerm("integer"),
+								},
+							)),
+						},
+					)),
+				},
+			),
+			valid: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			_, err := astValueToJSONSchemaLoader(tc.schema)
+			if tc.valid && err != nil {
+				t.Errorf("Unexpected JSON Schema validation result, expected valid = true, got = false: %s", err)
+				return
+			}
+			if !tc.valid && err == nil {
+				t.Errorf("Unexpected JSON Schema validation result, expected valid = false, got = true")
+				return
+			}
+		})
+	}
+}
+
+func TestBuiltinJSONSchemaVerify(t *testing.T) {
+	cases := []struct {
+		note   string
+		schema ast.Value
+		result ast.Value
+		err    bool
+	}{
+		{
+			note:   "string empty schema",
+			schema: ast.String(`{}`),
+			result: ast.NewArray(ast.BooleanTerm(true), ast.NullTerm()),
+			err:    false,
+		},
+		{
+			note:   "string broken JSON",
+			schema: ast.String(`{ "a": "`),
+			result: ast.NewArray(ast.BooleanTerm(false), ast.StringTerm("jsonschema: invalid JSON string")),
+			err:    false,
+		},
+		{
+			note: "string simple schema",
+			schema: ast.String(`
+			{
+				"properties": {
+					"id": {
+						"type": "integer"
+					}
+				},
+				"required": ["id"]
+			}
+			`),
+			result: ast.NewArray(ast.BooleanTerm(true), ast.NullTerm()),
+			err:    false,
+		},
+		{
+			note: "string broken schema",
+			schema: ast.String(`
+			{
+				"properties": {
+					"id": {
+						"type": "UNKNOWN"
+					}
+				},
+				"required": ["id"]
+			}
+			`),
+			result: ast.NewArray(ast.BooleanTerm(false), ast.StringTerm("jsonschema: has a primitive type that is NOT VALID -- given: /UNKNOWN/ Expected valid values are:[array boolean integer number null object string]")),
+			err:    false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			result := ast.NullTerm().Value
+			err := builtinJSONSchemaVerify(
+				BuiltinContext{},
+				[]*ast.Term{ast.NewTerm(tc.schema)},
+				func(term *ast.Term) error {
+					result = term.Value
+					return nil
+				},
+			)
+
+			if tc.err && err == nil {
+				t.Errorf("Unexpected schema validation, expected error, got nil")
+				return
+			}
+			if !tc.err && err != nil {
+				t.Errorf("Unexpected schema validation, expected nil, got error: %s", err)
+				return
+			}
+			if tc.result.Compare(result) != 0 {
+				t.Errorf("Unexpected schema validation, expected result %s, got result %s", tc.result.String(), result.String())
+				return
+			}
+		})
+	}
+}
+
+func TestBuiltinJSONMatchSchema(t *testing.T) {
+	cases := []struct {
+		note     string
+		document ast.Value
+		schema   ast.Value
+		result   ast.Value
+		err      bool
+	}{
+		{
+			note:     "string empty document, empty schema",
+			document: ast.String(`{}`),
+			schema:   ast.String(`{}`),
+			result:   ast.NewArray(ast.BooleanTerm(true), ast.ArrayTerm()),
+			err:      false,
+		},
+		{
+			note:     "string empty document, broken schema",
+			document: ast.String(`{}`),
+			schema:   ast.String(`{ "a": "`),
+			result:   ast.NullTerm().Value,
+			err:      true,
+		},
+		{
+			note:     "string broken document, empty schema",
+			document: ast.String(`{ "a": "`),
+			schema:   ast.String(`{}`),
+			result:   ast.NullTerm().Value,
+			err:      true,
+		},
+		{
+			note:     "string correct document, simple schema",
+			document: ast.String(`{ "id": 5 }`),
+			schema: ast.String(`
+			{
+				"properties": {
+					"id": {
+						"type": "integer"
+					}
+				},
+				"required": ["id"]
+			}
+			`),
+			result: ast.NewArray(ast.BooleanTerm(true), ast.ArrayTerm()),
+			err:    false,
+		},
+		{
+			note:     "string correct document, invalid schema",
+			document: ast.String(`{ "id": 5 }`),
+			schema: ast.String(`
+			{
+				"properties": {
+					"id": {
+						"type": "UNKNOWN"
+					}
+				},
+				"required": ["id"]
+			}
+			`),
+			result: ast.NullTerm().Value,
+			err:    true,
+		},
+		{
+			note:     "string invalid document, correct schema",
+			document: ast.String(`{ "id": "test" }`),
+			schema: ast.String(`
+			{
+				"properties": {
+					"id": {
+						"type": "integer"
+					}
+				},
+				"required": ["id"]
+			}
+			`),
+			result: ast.NewArray(ast.BooleanTerm(false),
+				ast.ArrayTerm(ast.NewTerm(ast.NewObject(
+					[...]*ast.Term{ast.StringTerm("error"), ast.StringTerm("id: Invalid type. Expected: integer, given: string")},
+					[...]*ast.Term{ast.StringTerm("type"), ast.StringTerm("invalid_type")},
+					[...]*ast.Term{ast.StringTerm("field"), ast.StringTerm("id")},
+					[...]*ast.Term{ast.StringTerm("desc"), ast.StringTerm("Invalid type. Expected: integer, given: string")},
+				)))),
+			err: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			result := ast.NullTerm().Value
+			err := builtinJSONMatchSchema(
+				BuiltinContext{},
+				[]*ast.Term{ast.NewTerm(tc.document), ast.NewTerm(tc.schema)},
+				func(term *ast.Term) error {
+					result = term.Value
+					return nil
+				},
+			)
+
+			if tc.err && err == nil {
+				t.Errorf("Unexpected schema validation, expected error, got nil")
+				return
+			}
+			if !tc.err && err != nil {
+				t.Errorf("Unexpected schema validation, expected nil, got error: %s", err)
+				return
+			}
+			if tc.result.Compare(result) != 0 {
+				t.Errorf("Unexpected schema validation, expected result %s, got result %s", tc.result.String(), result.String())
+				return
+			}
+		})
+	}
+}
diff --git a/topdown/lineage/lineage.go b/topdown/lineage/lineage.go
index 393d1c38dc..c4631d9e0e 100644
--- a/topdown/lineage/lineage.go
+++ b/topdown/lineage/lineage.go
@@ -8,6 +8,22 @@ import (
 	"github.com/open-policy-agent/opa/topdown"
 )
 
+// Debug contains everything in the log.
+func Debug(trace []*topdown.Event) []*topdown.Event {
+	return trace
+}
+
+// Full returns a filtered trace that contains everything except Uninfy ops
+func Full(trace []*topdown.Event) (result []*topdown.Event) {
+	// Do not use Filter since this event will only occur at the leaf positions.
+	for _, event := range trace {
+		if event.Op != topdown.UnifyOp {
+			result = append(result, event)
+		}
+	}
+	return
+}
+
 // Notes returns a filtered trace that contains Note events and context to
 // understand where the Note was emitted.
 func Notes(trace []*topdown.Event) []*topdown.Event {
diff --git a/topdown/net.go b/topdown/net.go
index 24b2d0b032..534520529a 100644
--- a/topdown/net.go
+++ b/topdown/net.go
@@ -6,6 +6,7 @@ package topdown
 
 import (
 	"net"
+	"strings"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/topdown/builtins"
@@ -17,7 +18,13 @@ type lookupIPAddrCacheKey string
 var resolv = &net.Resolver{}
 
 func builtinLookupIPAddr(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-	name, err := builtins.StringOperand(operands[0].Value, 1)
+	a, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+	name := string(a)
+
+	err = verifyHost(bctx, name)
 	if err != nil {
 		return err
 	}
@@ -27,10 +34,10 @@ func builtinLookupIPAddr(bctx BuiltinContext, operands []*ast.Term, iter func(*a
 		return iter(val.(*ast.Term))
 	}
 
-	addrs, err := resolv.LookupIPAddr(bctx.Context, string(name))
+	addrs, err := resolv.LookupIPAddr(bctx.Context, name)
 	if err != nil {
 		// NOTE(sr): We can't do better than this right now, see https://github.com/golang/go/issues/36208
-		if err.Error() == "operation was canceled" || err.Error() == "i/o timeout" {
+		if strings.Contains(err.Error(), "operation was canceled") || strings.Contains(err.Error(), "i/o timeout") {
 			return Halt{
 				Err: &Error{
 					Code:     CancelErr,
diff --git a/topdown/net_test.go b/topdown/net_test.go
index 9db8b72087..41a18a433e 100644
--- a/topdown/net_test.go
+++ b/topdown/net_test.go
@@ -155,6 +155,63 @@ func TestNetLookupIPAddr(t *testing.T) {
 			}
 		})
 	}
+
+	addr := "v4.org"
+	exp := ast.NewSet(ast.StringTerm("1.2.3.4"))
+	for name, allowNet := range map[string][]string{
+		"allow_net nil":                     nil,
+		"allow_net match":                   {addr},
+		"allow_net match + additional host": {addr, "example.com"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			capabilities := ast.CapabilitiesForThisVersion()
+			capabilities.AllowNet = allowNet
+			bctx := BuiltinContext{
+				Context:      ctx,
+				Cache:        make(builtins.Cache),
+				Capabilities: capabilities,
+			}
+			srv.PatchNet(resolv)
+			err := builtinLookupIPAddr(bctx, []*ast.Term{ast.StringTerm(addr)}, func(act *ast.Term) error {
+				if exp.Compare(act.Value) != 0 {
+					t.Errorf("expected %v, got %v", exp, act)
+				}
+				return nil
+			})
+			if err != nil {
+				t.Error(err)
+			}
+		})
+	}
+
+	expError := fmt.Errorf("unallowed host: %s", addr)
+	for name, allowNet := range map[string][]string{
+		"allow_net empty":    {},
+		"allow_net no match": {"example.com"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			capabilities := ast.CapabilitiesForThisVersion()
+			capabilities.AllowNet = allowNet
+			bctx := BuiltinContext{
+				Context:      ctx,
+				Cache:        make(builtins.Cache),
+				Capabilities: capabilities,
+			}
+			srv.PatchNet(resolv)
+			err := builtinLookupIPAddr(bctx, []*ast.Term{ast.StringTerm(addr)}, func(act *ast.Term) error {
+				t.Fatal("expected not to be called")
+				return nil
+			})
+			if err == nil {
+				t.Error("expected error")
+			}
+			assertError(t, expError, err)
+		})
+	}
 }
 
 type sink struct{}
diff --git a/topdown/numbers.go b/topdown/numbers.go
index 9d57c8790a..b0953b0fdb 100644
--- a/topdown/numbers.go
+++ b/topdown/numbers.go
@@ -56,15 +56,15 @@ func builtinNumbersRange(bctx BuiltinContext, operands []*ast.Term, iter func(*a
 	return iter(ast.NewTerm(result))
 }
 
-func builtinRandIntn(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinRandIntn(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	strOp, err := builtins.StringOperand(args[0].Value, 1)
+	strOp, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return err
 
 	}
 
-	n, err := builtins.IntOperand(args[1].Value, 2)
+	n, err := builtins.IntOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
diff --git a/topdown/object.go b/topdown/object.go
index ff01b4f96b..e3baf1fecc 100644
--- a/topdown/object.go
+++ b/topdown/object.go
@@ -6,8 +6,8 @@ package topdown
 
 import (
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/ref"
 	"github.com/open-policy-agent/opa/topdown/builtins"
-	"github.com/open-policy-agent/opa/types"
 )
 
 func builtinObjectUnion(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
@@ -26,6 +26,38 @@ func builtinObjectUnion(_ BuiltinContext, operands []*ast.Term, iter func(*ast.T
 	return iter(ast.NewTerm(r))
 }
 
+func builtinObjectUnionN(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	arr, err := builtins.ArrayOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	// Because we need merge-with-overwrite behavior, we can iterate
+	// back-to-front, and get a mostly correct set of key assignments that
+	// give us the "last assignment wins, with merges" behavior we want.
+	// However, if a non-object overwrites an object value anywhere in the
+	// chain of assignments for a key, we have to "freeze" that key to
+	// prevent accidentally picking up nested objects that could merge with
+	// it from earlier in the input array.
+	// Example:
+	//   Input: [{"a": {"b": 2}}, {"a": 4}, {"a": {"c": 3}}]
+	//   Want Output: {"a": {"c": 3}}
+	result := ast.NewObject()
+	frozenKeys := map[*ast.Term]struct{}{}
+	for i := arr.Len() - 1; i >= 0; i-- {
+		o, ok := arr.Elem(i).Value.(ast.Object)
+		if !ok {
+			return builtins.NewOperandElementErr(1, arr, arr.Elem(i).Value, "object")
+		}
+		mergewithOverwriteInPlace(result, o, frozenKeys)
+		if err != nil {
+			return err
+		}
+	}
+
+	return iter(ast.NewTerm(result))
+}
+
 func builtinObjectRemove(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	// Expect an object and an array/set/object of keys
 	obj, err := builtins.ObjectOperand(operands[0].Value, 1)
@@ -81,11 +113,40 @@ func builtinObjectGet(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Ter
 		return err
 	}
 
-	if ret := object.Get(operands[1]); ret != nil {
-		return iter(ret)
+	// if the get key is not an array, attempt to get the top level key for the operand value in the object
+	path, err := builtins.ArrayOperand(operands[1].Value, 2)
+	if err != nil {
+		if ret := object.Get(operands[1]); ret != nil {
+			return iter(ret)
+		}
+
+		return iter(operands[2])
+	}
+
+	// if the path is empty, then we skip selecting nested keys and return the whole object
+	if path.Len() == 0 {
+		return iter(operands[0])
 	}
 
-	return iter(operands[2])
+	// build an ast.Ref from the array and see if it matches within the object
+	pathRef := ref.ArrayPath(path)
+	value, err := object.Find(pathRef)
+	if err != nil {
+		return iter(operands[2])
+	}
+
+	return iter(ast.NewTerm(value))
+}
+
+func builtinObjectKeys(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	object, err := builtins.ObjectOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	keys := ast.SetTerm(object.Keys()...)
+
+	return iter(keys)
 }
 
 // getObjectKeysParam returns a set of key values
@@ -110,7 +171,7 @@ func getObjectKeysParam(arrayOrSet ast.Value) (ast.Set, error) {
 			return nil
 		})
 	default:
-		return nil, builtins.NewOperandTypeErr(2, arrayOrSet, ast.TypeName(types.Object{}), ast.TypeName(types.S), ast.TypeName(types.Array{}))
+		return nil, builtins.NewOperandTypeErr(2, arrayOrSet, "object", "set", "array")
 	}
 
 	return keys, nil
@@ -132,9 +193,37 @@ func mergeWithOverwrite(objA, objB ast.Object) ast.Object {
 	return merged
 }
 
+// Modifies obj with any new keys from other, and recursively
+// merges any keys where the values are both objects.
+func mergewithOverwriteInPlace(obj, other ast.Object, frozenKeys map[*ast.Term]struct{}) {
+	other.Foreach(func(k, v *ast.Term) {
+		v2 := obj.Get(k)
+		// The key didn't exist in other, keep the original value.
+		if v2 == nil {
+			obj.Insert(k, v)
+			return
+		}
+		// The key exists in both. Merge or reject change.
+		updateValueObj, ok2 := v.Value.(ast.Object)
+		originalValueObj, ok1 := v2.Value.(ast.Object)
+		// Both are objects? Merge recursively.
+		if ok1 && ok2 {
+			// Check to make sure that this key isn't frozen before merging.
+			if _, ok := frozenKeys[v2]; !ok {
+				mergewithOverwriteInPlace(originalValueObj, updateValueObj, frozenKeys)
+			}
+		} else {
+			// Else, original value wins. Freeze the key.
+			frozenKeys[v2] = struct{}{}
+		}
+	})
+}
+
 func init() {
 	RegisterBuiltinFunc(ast.ObjectUnion.Name, builtinObjectUnion)
+	RegisterBuiltinFunc(ast.ObjectUnionN.Name, builtinObjectUnionN)
 	RegisterBuiltinFunc(ast.ObjectRemove.Name, builtinObjectRemove)
 	RegisterBuiltinFunc(ast.ObjectFilter.Name, builtinObjectFilter)
 	RegisterBuiltinFunc(ast.ObjectGet.Name, builtinObjectGet)
+	RegisterBuiltinFunc(ast.ObjectKeys.Name, builtinObjectKeys)
 }
diff --git a/topdown/object_bench_test.go b/topdown/object_bench_test.go
new file mode 100644
index 0000000000..34dfe0b3b7
--- /dev/null
+++ b/topdown/object_bench_test.go
@@ -0,0 +1,122 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/storage"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
+)
+
+func genNxMObjectBenchmarkData(n, m int) ast.Value {
+	objList := make([]*ast.Term, n)
+	for i := 0; i < n; i++ {
+		v := ast.NewObject()
+		for j := 0; j < m; j++ {
+			v.Insert(ast.StringTerm(fmt.Sprintf("%d,%d", i, j)), ast.BooleanTerm(true))
+		}
+		objList[i] = ast.NewTerm(v)
+	}
+	return ast.NewArray(objList...)
+}
+
+func BenchmarkObjectUnionN(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 250}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			b.Run(fmt.Sprintf("%dx%d", n, m), func(b *testing.B) {
+				store := inmem.NewFromObject(map[string]interface{}{"objs": genNxMObjectBenchmarkData(n, m)})
+				module := `package test
+
+				combined := object.union_n(data.objs)`
+
+				query := ast.MustParseBody("data.test.combined")
+				compiler := ast.MustCompileModules(map[string]string{
+					"test.rego": module,
+				})
+
+				b.ResetTimer()
+
+				for i := 0; i < b.N; i++ {
+
+					err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+						q := NewQuery(query).
+							WithCompiler(compiler).
+							WithStore(store).
+							WithTransaction(txn)
+
+						_, err := q.Run(ctx)
+						if err != nil {
+							return err
+						}
+
+						return nil
+					})
+
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		}
+	}
+}
+
+func BenchmarkObjectUnionNSlow(b *testing.B) {
+	// This benchmarks the suggested means to implement union
+	// without using the builtin, to give us an idea of whether or not
+	// the builtin is actually making things any faster.
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 250}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			b.Run(fmt.Sprintf("%dx%d", n, m), func(b *testing.B) {
+				store := inmem.NewFromObject(map[string]interface{}{"objs": genNxMObjectBenchmarkData(n, m)})
+				module := `package test
+
+				combined := {k: true | s := data.objs[_]; s[k]}`
+
+				query := ast.MustParseBody("data.test.combined")
+				compiler := ast.MustCompileModules(map[string]string{
+					"test.rego": module,
+				})
+
+				b.ResetTimer()
+
+				for i := 0; i < b.N; i++ {
+
+					err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+						q := NewQuery(query).
+							WithCompiler(compiler).
+							WithStore(store).
+							WithTransaction(txn)
+
+						_, err := q.Run(ctx)
+						if err != nil {
+							return err
+						}
+
+						return nil
+					})
+
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		}
+	}
+}
diff --git a/topdown/object_test.go b/topdown/object_test.go
new file mode 100644
index 0000000000..287a396cbd
--- /dev/null
+++ b/topdown/object_test.go
@@ -0,0 +1,81 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+)
+
+func TestObjectUnionNBuiltin(t *testing.T) {
+	tests := []struct {
+		note     string
+		query    string
+		input    string
+		expected string
+	}{
+		// NOTE(philipc): These tests assume that erroneous types are
+		// checked elsewhere, and focus only on functional correctness.
+		{
+			note:     "Empty",
+			input:    `[]`,
+			expected: `{}`,
+		},
+		{
+			note:     "Singletons",
+			input:    `[{1: true}, {2: true}, {3: true}]`,
+			expected: `{1: true, 2: true, 3: true}`,
+		},
+		{
+			note:     "One object",
+			input:    `[{1: true, 2: true, 3: true}]`,
+			expected: `{1: true, 2: true, 3: true}`,
+		},
+		{
+			note:     "One object + empty",
+			input:    `[{1: true, 2: true, 3: true}, {}]`,
+			expected: `{1: true, 2: true, 3: true}`,
+		},
+		{
+			note:     "Multiple objects, with scalar duplicates",
+			input:    `[{"A": 1, "B": 2, "C": 3}, {"A": 1, "B": 2}, {"C": 3}, {"D": 4, "E": 5}]`,
+			expected: `{"A": 1, "B": 2, "C": 3, "D": 4, "E": 5}`,
+		},
+		{
+			note:     "2x objects, with simple merge on key",
+			input:    `[{"A": 1, "B": {"D": 4}, "C": 3},  {"B": 200}]`,
+			expected: `{"A": 1, "B": 200, "C": 3,}`,
+		},
+		{
+			note:     "2x objects, with complex merge on nested object",
+			input:    `[{"A": 1, "B": {"N1": {"X": true, "Z": false}}, "C": 3},  {"B": {"N1": {"X": 49, "Z": 50}}}]`,
+			expected: `{"A": 1, "B": {"N1": {"X": 49, "Z": 50}}, "C": 3}`,
+		},
+		{
+			note:     "Multiple objects, with scalar, then object, overwrite on nested key",
+			input:    `[{"A": 1, "B": {"N1": {"X": true, "Z": false}}, "C": 3}, {"B": {"N1": 23}}, {"B": {"N1": {"Z": 50}}}]`,
+			expected: `{"A": 1, "B": {"N1": {"Z": 50}}, "C": 3}`,
+		},
+		{
+			note:     "Multiple objects, with complex overwrite on nested key",
+			input:    `[{"A": 1, "B": {"N1": {"X": true, "Z": false}}, "C": 3}, {"B": {"N1": 23}}, {"B": {"N1": {"Z": 50}}}, {"B": {"N1": {"Z": 35}}}]`,
+			expected: `{"A": 1, "B": {"N1": {"Z": 35}}, "C": 3}`,
+		},
+	}
+
+	for _, tc := range tests {
+		inputs := ast.MustParseTerm(tc.input)
+		result, err := getResult(builtinObjectUnionN, inputs)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expected := ast.MustParseTerm(tc.expected)
+		if !result.Equal(expected) {
+			t.Fatalf("Expected %v but got %v", expected, result)
+		}
+	}
+}
diff --git a/topdown/parse.go b/topdown/parse.go
index dc6e6fc51b..c46222b413 100644
--- a/topdown/parse.go
+++ b/topdown/parse.go
@@ -7,41 +7,53 @@ package topdown
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinRegoParseModule(a, b ast.Value) (ast.Value, error) {
+func builtinRegoParseModule(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	filename, err := builtins.StringOperand(a, 1)
+	filename, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	input, err := builtins.StringOperand(b, 1)
+	input, err := builtins.StringOperand(operands[1].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	module, err := ast.ParseModule(string(filename), string(input))
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	var buf bytes.Buffer
 	if err := json.NewEncoder(&buf).Encode(module); err != nil {
-		return nil, err
+		return err
 	}
 
 	term, err := ast.ParseTerm(buf.String())
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return term.Value, nil
+	return iter(term)
+}
+
+func registerRegoMetadataBuiltinFunction(builtin *ast.Builtin) {
+	f := func(BuiltinContext, []*ast.Term, func(*ast.Term) error) error {
+		// The compiler should replace all usage of this function, so the only way to get here is within a query;
+		// which cannot define rules.
+		return fmt.Errorf("the %s function must only be called within the scope of a rule", builtin.Name)
+	}
+	RegisterBuiltinFunc(builtin.Name, f)
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.RegoParseModule.Name, builtinRegoParseModule)
+	RegisterBuiltinFunc(ast.RegoParseModule.Name, builtinRegoParseModule)
+	registerRegoMetadataBuiltinFunction(ast.RegoMetadataChain)
+	registerRegoMetadataBuiltinFunction(ast.RegoMetadataRule)
 }
diff --git a/topdown/parse_bytes.go b/topdown/parse_bytes.go
index 6e58d2327c..9d8fe50681 100644
--- a/topdown/parse_bytes.go
+++ b/topdown/parse_bytes.go
@@ -32,17 +32,17 @@ const (
 )
 
 func parseNumBytesError(msg string) error {
-	return fmt.Errorf("%s error: %s", ast.UnitsParseBytes.Name, msg)
+	return fmt.Errorf("%s: %s", ast.UnitsParseBytes.Name, msg)
 }
 
-func errUnitNotRecognized(unit string) error {
+func errBytesUnitNotRecognized(unit string) error {
 	return parseNumBytesError(fmt.Sprintf("byte unit %s not recognized", unit))
 }
 
 var (
-	errNoAmount       = parseNumBytesError("no byte amount provided")
-	errNumConv        = parseNumBytesError("could not parse byte amount to a number")
-	errIncludesSpaces = parseNumBytesError("spaces not allowed in resource strings")
+	errBytesValueNoAmount       = parseNumBytesError("no byte amount provided")
+	errBytesValueNumConv        = parseNumBytesError("could not parse byte amount to a number")
+	errBytesValueIncludesSpaces = parseNumBytesError("spaces not allowed in resource strings")
 )
 
 func builtinNumBytes(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
@@ -56,12 +56,12 @@ func builtinNumBytes(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.T
 	s := formatString(raw)
 
 	if strings.Contains(s, " ") {
-		return errIncludesSpaces
+		return errBytesValueIncludesSpaces
 	}
 
 	num, unit := extractNumAndUnit(s)
 	if num == "" {
-		return errNoAmount
+		return errBytesValueNoAmount
 	}
 
 	switch unit {
@@ -92,12 +92,12 @@ func builtinNumBytes(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.T
 	case "eib", "ei":
 		m.SetUint64(ei)
 	default:
-		return errUnitNotRecognized(unit)
+		return errBytesUnitNotRecognized(unit)
 	}
 
 	numFloat, ok := new(big.Float).SetString(num)
 	if !ok {
-		return errNumConv
+		return errBytesValueNumConv
 	}
 
 	var total big.Int
diff --git a/topdown/parse_units.go b/topdown/parse_units.go
new file mode 100644
index 0000000000..daf240214c
--- /dev/null
+++ b/topdown/parse_units.go
@@ -0,0 +1,125 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"encoding/json"
+	"fmt"
+	"math/big"
+	"strings"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/topdown/builtins"
+)
+
+// Binary Si unit constants are borrowed from topdown/parse_bytes
+const siMilli = 0.001
+const (
+	siK uint64 = 1000
+	siM        = siK * 1000
+	siG        = siM * 1000
+	siT        = siG * 1000
+	siP        = siT * 1000
+	siE        = siP * 1000
+)
+
+func parseUnitsError(msg string) error {
+	return fmt.Errorf("%s: %s", ast.UnitsParse.Name, msg)
+}
+
+func errUnitNotRecognized(unit string) error {
+	return parseUnitsError(fmt.Sprintf("unit %s not recognized", unit))
+}
+
+var (
+	errNoAmount       = parseUnitsError("no amount provided")
+	errNumConv        = parseUnitsError("could not parse amount to a number")
+	errIncludesSpaces = parseUnitsError("spaces not allowed in resource strings")
+)
+
+// Accepts both normal SI and binary SI units.
+func builtinUnits(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	var x big.Rat
+
+	raw, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	// We remove escaped quotes from strings here to retain parity with units.parse_bytes.
+	s := string(raw)
+	s = strings.Replace(s, "\"", "", -1)
+
+	if strings.Contains(s, " ") {
+		return errIncludesSpaces
+	}
+
+	num, unit := extractNumAndUnit(s)
+	if num == "" {
+		return errNoAmount
+	}
+
+	// Unlike in units.parse_bytes, we only lowercase after the first letter,
+	// so that we can distinguish between 'm' and 'M'.
+	if len(unit) > 1 {
+		lower := strings.ToLower(unit[1:])
+		unit = unit[:1] + lower
+	}
+
+	switch unit {
+	case "m":
+		x.SetFloat64(siMilli)
+	case "":
+		x.SetUint64(none)
+	case "k", "K":
+		x.SetUint64(siK)
+	case "ki", "Ki":
+		x.SetUint64(ki)
+	case "M":
+		x.SetUint64(siM)
+	case "mi", "Mi":
+		x.SetUint64(mi)
+	case "g", "G":
+		x.SetUint64(siG)
+	case "gi", "Gi":
+		x.SetUint64(gi)
+	case "t", "T":
+		x.SetUint64(siT)
+	case "ti", "Ti":
+		x.SetUint64(ti)
+	case "p", "P":
+		x.SetUint64(siP)
+	case "pi", "Pi":
+		x.SetUint64(pi)
+	case "e", "E":
+		x.SetUint64(siE)
+	case "ei", "Ei":
+		x.SetUint64(ei)
+	default:
+		return errUnitNotRecognized(unit)
+	}
+
+	numRat, ok := new(big.Rat).SetString(num)
+	if !ok {
+		return errNumConv
+	}
+
+	numRat.Mul(numRat, &x)
+
+	// Cleaner printout when we have a pure integer value.
+	if numRat.IsInt() {
+		return iter(ast.NumberTerm(json.Number(numRat.Num().String())))
+	}
+
+	// When using just big.Float, we had floating-point precision
+	// issues because quantities like 0.001 are not exactly representable.
+	// Rationals (such as big.Rat) do not suffer this problem, but are
+	// more expensive to compute with in general.
+	return iter(ast.NumberTerm(json.Number(numRat.FloatString(10))))
+}
+
+func init() {
+	RegisterBuiltinFunc(ast.UnitsParse.Name, builtinUnits)
+}
diff --git a/topdown/providers.go b/topdown/providers.go
new file mode 100644
index 0000000000..0b9e012268
--- /dev/null
+++ b/topdown/providers.go
@@ -0,0 +1,191 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"encoding/json"
+	"net/url"
+	"time"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/providers/aws"
+	"github.com/open-policy-agent/opa/topdown/builtins"
+)
+
+var awsRequiredConfigKeyNames = ast.NewSet(
+	ast.StringTerm("aws_service"),
+	ast.StringTerm("aws_access_key"),
+	ast.StringTerm("aws_secret_access_key"),
+	ast.StringTerm("aws_region"),
+)
+
+func stringFromTerm(t *ast.Term) string {
+	if v, ok := t.Value.(ast.String); ok {
+		return string(v)
+	}
+	return ""
+}
+
+func getReqBodyBytes(body, rawBody *ast.Term) ([]byte, error) {
+	var out []byte
+
+	switch {
+	case rawBody != nil:
+		out = []byte(stringFromTerm(rawBody))
+	case body != nil:
+		bodyVal := body.Value
+		bodyValInterface, err := ast.JSON(bodyVal)
+		if err != nil {
+			return nil, err
+		}
+		bodyValBytes, err := json.Marshal(bodyValInterface)
+		if err != nil {
+			return nil, err
+		}
+		out = bodyValBytes
+	default:
+		out = []byte("")
+	}
+
+	return out, nil
+}
+
+func objectToMap(o ast.Object) map[string][]string {
+	out := make(map[string][]string, o.Len())
+	o.Foreach(func(k, v *ast.Term) {
+		ks := stringFromTerm(k)
+		vs := stringFromTerm(v)
+		out[ks] = []string{vs}
+	})
+	return out
+}
+
+// Note(philipc): This is roughly the same approach used for http.send.
+func validateAWSAuthParameters(o ast.Object) error {
+	awsKeys := ast.NewSet(o.Keys()...)
+
+	missingKeys := awsRequiredConfigKeyNames.Diff(awsKeys)
+	if missingKeys.Len() != 0 {
+		return builtins.NewOperandErr(2, "missing required AWS config parameters(s): %v", missingKeys)
+	}
+
+	invalidKeys := ast.NewSet()
+	awsRequiredConfigKeyNames.Foreach(func(t *ast.Term) {
+		if v := o.Get(t); v != nil {
+			if _, ok := v.Value.(ast.String); !ok {
+				invalidKeys.Add(t)
+			}
+		}
+	})
+	if invalidKeys.Len() != 0 {
+		return builtins.NewOperandErr(2, "invalid values for required AWS config parameters(s): %v", invalidKeys)
+	}
+
+	return nil
+}
+
+func builtinAWSSigV4SignReq(ctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	// Request object.
+	reqObj, err := builtins.ObjectOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	// AWS SigV4 config info object.
+	awsConfigObj, err := builtins.ObjectOperand(operands[1].Value, 1)
+	if err != nil {
+		return err
+	}
+	// Make sure our required keys exist!
+	err = validateAWSAuthParameters(awsConfigObj)
+	if err != nil {
+		return err
+	}
+	service := stringFromTerm(awsConfigObj.Get(ast.StringTerm("aws_service")))
+	awsCreds := aws.CredentialsFromObject(awsConfigObj)
+
+	// Timestamp for signing.
+	var signingTimestamp time.Time
+	timestamp, err := builtins.NumberOperand(operands[2].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	ts, ok := timestamp.Int64()
+	if !ok {
+		return builtins.NewOperandErr(3, "could not convert time_ns value into a unix timestamp")
+	}
+
+	signingTimestamp = time.Unix(0, ts)
+	if err != nil {
+		return err
+	}
+
+	// Make sure our required keys exist!
+	// This check is stricter than required, but better to break here than downstream.
+	_, err = validateHTTPRequestOperand(operands[0], 1)
+	if err != nil {
+		return err
+	}
+
+	// Prepare required fields from the HTTP request object.
+	var theURL *url.URL
+	var method string
+	reqURL := reqObj.Get(ast.StringTerm("url"))
+	reqMethod := reqObj.Get(ast.StringTerm("method"))
+
+	headers := ast.NewObject()
+	headersTerm := reqObj.Get(ast.StringTerm("headers"))
+	if headersTerm != nil {
+		var ok bool
+		headers, ok = headersTerm.Value.(ast.Object)
+		if !ok {
+			return builtins.NewOperandTypeErr(0, headersTerm.Value, "object")
+		}
+	}
+
+	// Check types on the request parameters.
+	invalidParameters := ast.NewSet()
+	if _, ok := reqURL.Value.(ast.String); !ok {
+		invalidParameters.Add(ast.StringTerm("url"))
+	}
+	if _, ok := reqMethod.Value.(ast.String); !ok {
+		invalidParameters.Add(ast.StringTerm("method"))
+	}
+	if invalidParameters.Len() > 0 {
+		return builtins.NewOperandErr(1, "invalid values for required request parameters(s): %v", invalidParameters)
+	}
+
+	theURL, err = url.Parse(stringFromTerm(reqURL))
+	if err != nil {
+		return err
+	}
+	method = stringFromTerm(reqMethod)
+
+	bodyTerm := reqObj.Get(ast.StringTerm("body"))
+	rawBodyTerm := reqObj.Get(ast.StringTerm("raw_body"))
+	body, err := getReqBodyBytes(bodyTerm, rawBodyTerm)
+	if err != nil {
+		return err
+	}
+
+	// Sign the request object's headers, and reconstruct the headers map.
+	authHeader, signedHeadersMap := aws.SignV4(objectToMap(headers), method, theURL, body, service, awsCreds, signingTimestamp)
+	signedHeadersObj := ast.NewObject()
+	signedHeadersObj.Insert(ast.StringTerm("Authorization"), ast.StringTerm(authHeader))
+	for k, v := range signedHeadersMap {
+		signedHeadersObj.Insert(ast.StringTerm(k), ast.StringTerm(v))
+	}
+
+	// Create new request object with updated headers.
+	out := reqObj.Copy()
+	out.Insert(ast.StringTerm("headers"), ast.NewTerm(signedHeadersObj))
+
+	return iter(ast.NewTerm(out))
+}
+
+func init() {
+	RegisterBuiltinFunc(ast.ProvidersAWSSignReqObj.Name, builtinAWSSigV4SignReq)
+}
diff --git a/topdown/query.go b/topdown/query.go
index 73d5e2583a..6d5bb4b197 100644
--- a/topdown/query.go
+++ b/topdown/query.go
@@ -7,15 +7,15 @@ import (
 	"sort"
 	"time"
 
-	"github.com/open-policy-agent/opa/resolver"
-	"github.com/open-policy-agent/opa/topdown/cache"
-	"github.com/open-policy-agent/opa/topdown/print"
-
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/metrics"
+	"github.com/open-policy-agent/opa/resolver"
 	"github.com/open-policy-agent/opa/storage"
 	"github.com/open-policy-agent/opa/topdown/builtins"
+	"github.com/open-policy-agent/opa/topdown/cache"
 	"github.com/open-policy-agent/opa/topdown/copypropagation"
+	"github.com/open-policy-agent/opa/topdown/print"
+	"github.com/open-policy-agent/opa/tracing"
 )
 
 // QueryResultSet represents a collection of results returned by a query.
@@ -52,8 +52,12 @@ type Query struct {
 	indexing               bool
 	earlyExit              bool
 	interQueryBuiltinCache cache.InterQueryCache
+	ndBuiltinCache         builtins.NDBCache
 	strictBuiltinErrors    bool
+	builtinErrorList       *[]Error
+	strictObjects          bool
 	printHook              print.Hook
+	tracingOpts            tracing.Options
 }
 
 // Builtin represents a built-in function that queries can call.
@@ -241,12 +245,26 @@ func (q *Query) WithInterQueryBuiltinCache(c cache.InterQueryCache) *Query {
 	return q
 }
 
+// WithNDBuiltinCache sets the non-deterministic builtin cache.
+func (q *Query) WithNDBuiltinCache(c builtins.NDBCache) *Query {
+	q.ndBuiltinCache = c
+	return q
+}
+
 // WithStrictBuiltinErrors tells the evaluator to treat all built-in function errors as fatal errors.
 func (q *Query) WithStrictBuiltinErrors(yes bool) *Query {
 	q.strictBuiltinErrors = yes
 	return q
 }
 
+// WithBuiltinErrorList supplies a pointer to an Error slice to store built-in function errors
+// encountered during evaluation. This error slice can be inspected after evaluation to determine
+// which built-in function errors occurred.
+func (q *Query) WithBuiltinErrorList(list *[]Error) *Query {
+	q.builtinErrorList = list
+	return q
+}
+
 // WithResolver configures an external resolver to use for the given ref.
 func (q *Query) WithResolver(ref ast.Ref, r resolver.Resolver) *Query {
 	q.external.Put(ref, r)
@@ -258,6 +276,21 @@ func (q *Query) WithPrintHook(h print.Hook) *Query {
 	return q
 }
 
+// WithDistributedTracingOpts sets the options to be used by distributed tracing.
+func (q *Query) WithDistributedTracingOpts(tr tracing.Options) *Query {
+	q.tracingOpts = tr
+	return q
+}
+
+// WithStrictObjects tells the evaluator to avoid the "lazy object" optimization
+// applied when reading objects from the store. It will result in higher memory
+// usage and should only be used temporarily while adjusting code that breaks
+// because of the optimization.
+func (q *Query) WithStrictObjects(yes bool) *Query {
+	q.strictObjects = yes
+	return q
+}
+
 // PartialRun executes partial evaluation on the query with respect to unknown
 // values. Partial evaluation attempts to evaluate as much of the query as
 // possible without requiring values for the unknowns set on the query. The
@@ -304,7 +337,9 @@ func (q *Query) PartialRun(ctx context.Context) (partials []ast.Body, support []
 		instr:                  q.instr,
 		builtins:               q.builtins,
 		builtinCache:           builtins.Cache{},
+		functionMocks:          newFunctionMocksStack(),
 		interQueryBuiltinCache: q.interQueryBuiltinCache,
+		ndBuiltinCache:         q.ndBuiltinCache,
 		virtualCache:           newVirtualCache(),
 		comprehensionCache:     newComprehensionCache(),
 		saveSet:                newSaveSet(q.unknowns, b, q.instr),
@@ -321,6 +356,7 @@ func (q *Query) PartialRun(ctx context.Context) (partials []ast.Body, support []
 		earlyExit:     q.earlyExit,
 		builtinErrors: &builtinErrors{},
 		printHook:     q.printHook,
+		strictObjects: q.strictObjects,
 	}
 
 	if len(q.disableInlining) > 0 {
@@ -332,6 +368,14 @@ func (q *Query) PartialRun(ctx context.Context) (partials []ast.Body, support []
 	defer q.metrics.Timer(metrics.RegoPartialEval).Stop()
 
 	livevars := ast.NewVarSet()
+	for _, t := range q.unknowns {
+		switch v := t.Value.(type) {
+		case ast.Var:
+			livevars.Add(v)
+		case ast.Ref:
+			livevars.Add(v[0].Value.(ast.Var))
+		}
+	}
 
 	ast.WalkVars(q.query, func(x ast.Var) bool {
 		if !x.IsGenerated() {
@@ -384,8 +428,25 @@ func (q *Query) PartialRun(ctx context.Context) (partials []ast.Body, support []
 
 	support = e.saveSupport.List()
 
-	if q.strictBuiltinErrors && len(e.builtinErrors.errs) > 0 {
-		err = e.builtinErrors.errs[0]
+	if len(e.builtinErrors.errs) > 0 {
+		if q.strictBuiltinErrors {
+			err = e.builtinErrors.errs[0]
+		} else if q.builtinErrorList != nil {
+			// If a builtinErrorList has been supplied, we must use pointer indirection
+			// to append to it. builtinErrorList is a slice pointer so that errors can be
+			// appended to it without returning a new slice and changing the interface
+			// of PartialRun.
+			for _, err := range e.builtinErrors.errs {
+				if tdError, ok := err.(*Error); ok {
+					*(q.builtinErrorList) = append(*(q.builtinErrorList), *tdError)
+				} else {
+					*(q.builtinErrorList) = append(*(q.builtinErrorList), Error{
+						Code:    BuiltinErr,
+						Message: err.Error(),
+					})
+				}
+			}
+		}
 	}
 
 	for i := range support {
@@ -444,7 +505,9 @@ func (q *Query) Iter(ctx context.Context, iter func(QueryResult) error) error {
 		instr:                  q.instr,
 		builtins:               q.builtins,
 		builtinCache:           builtins.Cache{},
+		functionMocks:          newFunctionMocksStack(),
 		interQueryBuiltinCache: q.interQueryBuiltinCache,
+		ndBuiltinCache:         q.ndBuiltinCache,
 		virtualCache:           newVirtualCache(),
 		comprehensionCache:     newComprehensionCache(),
 		genvarprefix:           q.genvarprefix,
@@ -453,6 +516,8 @@ func (q *Query) Iter(ctx context.Context, iter func(QueryResult) error) error {
 		earlyExit:              q.earlyExit,
 		builtinErrors:          &builtinErrors{},
 		printHook:              q.printHook,
+		tracingOpts:            q.tracingOpts,
+		strictObjects:          q.strictObjects,
 	}
 	e.caller = e
 	q.metrics.Timer(metrics.RegoQueryEval).Start()
@@ -465,8 +530,25 @@ func (q *Query) Iter(ctx context.Context, iter func(QueryResult) error) error {
 		return iter(qr)
 	})
 
-	if q.strictBuiltinErrors && err == nil && len(e.builtinErrors.errs) > 0 {
-		err = e.builtinErrors.errs[0]
+	if len(e.builtinErrors.errs) > 0 {
+		if q.strictBuiltinErrors {
+			err = e.builtinErrors.errs[0]
+		} else if q.builtinErrorList != nil {
+			// If a builtinErrorList has been supplied, we must use pointer indirection
+			// to append to it. builtinErrorList is a slice pointer so that errors can be
+			// appended to it without returning a new slice and changing the interface
+			// of Iter.
+			for _, err := range e.builtinErrors.errs {
+				if tdError, ok := err.(*Error); ok {
+					*(q.builtinErrorList) = append(*(q.builtinErrorList), *tdError)
+				} else {
+					*(q.builtinErrorList) = append(*(q.builtinErrorList), Error{
+						Code:    BuiltinErr,
+						Message: err.Error(),
+					})
+				}
+			}
+		}
 	}
 
 	q.metrics.Timer(metrics.RegoQueryEval).Stop()
diff --git a/topdown/query_test.go b/topdown/query_test.go
index 70175c38c4..9e8760b362 100644
--- a/topdown/query_test.go
+++ b/topdown/query_test.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 )
 
 func TestQueryTracerDontPlugLocalVars(t *testing.T) {
@@ -178,6 +178,42 @@ func TestDisabledTracer(t *testing.T) {
 	}
 }
 
+func TestRegoMetadataBuiltinCall(t *testing.T) {
+	tests := []struct {
+		note          string
+		query         string
+		expectedError string
+	}{
+		{
+			note:          "rego.metadata.chain() call",
+			query:         "rego.metadata.chain()",
+			expectedError: "rego.metadata.chain(): eval_builtin_error: rego.metadata.chain: the rego.metadata.chain function must only be called within the scope of a rule",
+		},
+		{
+			note:          "rego.metadata.rule() call",
+			query:         "rego.metadata.rule()",
+			expectedError: "rego.metadata.rule(): eval_builtin_error: rego.metadata.rule: the rego.metadata.rule function must only be called within the scope of a rule",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			c := ast.NewCompiler()
+			q := NewQuery(ast.MustParseBody(tc.query)).WithCompiler(c).
+				WithStrictBuiltinErrors(true)
+			_, err := q.Run(context.Background())
+
+			if err == nil {
+				t.Fatalf("expected error")
+			}
+
+			if tc.expectedError != err.Error() {
+				t.Fatalf("expected error:\n\n%s\n\ngot:\n\n%s", tc.expectedError, err.Error())
+			}
+		})
+	}
+}
+
 func initTracerTestQuery() *Query {
 	ctx := context.Background()
 	store := inmem.New()
diff --git a/topdown/reachable.go b/topdown/reachable.go
index 6b73fa2c29..9cb15d51e3 100644
--- a/topdown/reachable.go
+++ b/topdown/reachable.go
@@ -6,6 +6,7 @@ package topdown
 
 import (
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
 // Helper: sets of vertices can be represented as Arrays or Sets.
@@ -18,19 +19,34 @@ func foreachVertex(collection *ast.Term, f func(*ast.Term)) {
 	}
 }
 
-func builtinReachable(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	// Return the empty set if the first argument is not an object.
-	graph, ok := args[0].Value.(ast.Object)
-	if !ok {
-		return iter(ast.NewTerm(ast.NewSet()))
+// numberOfEdges returns the number of elements of an array or a set (of edges)
+func numberOfEdges(collection *ast.Term) int {
+	switch v := collection.Value.(type) {
+	case ast.Set:
+		return v.Len()
+	case *ast.Array:
+		return v.Len()
 	}
 
-	// This is a queue that holds all nodes we still need to visit.  It is
-	// initialised to the initial set of nodes we start out with.
-	queue := []*ast.Term{}
-	foreachVertex(args[1], func(t *ast.Term) {
-		queue = append(queue, t)
-	})
+	return 0
+}
+
+func builtinReachable(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	// Error on wrong types for args.
+	graph, err := builtins.ObjectOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	var queue []*ast.Term
+	switch initial := operands[1].Value.(type) {
+	case *ast.Array, ast.Set:
+		foreachVertex(ast.NewTerm(initial), func(t *ast.Term) {
+			queue = append(queue, t)
+		})
+	default:
+		return builtins.NewOperandTypeErr(2, initial, "{array, set}")
+	}
 
 	// This is the set of nodes we have reached.
 	reached := ast.NewSet()
@@ -56,6 +72,80 @@ func builtinReachable(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term
 	return iter(ast.NewTerm(reached))
 }
 
+// pathBuilder is called recursively to build a Set of paths that are reachable from the root
+func pathBuilder(graph ast.Object, root *ast.Term, path []*ast.Term, edgeRslt ast.Set, reached ast.Set) {
+	paths := []*ast.Term{}
+
+	if edges := graph.Get(root); edges != nil {
+		path = append(path, root)
+
+		if numberOfEdges(edges) >= 1 {
+
+			foreachVertex(edges, func(neighbor *ast.Term) {
+
+				if reached.Contains(neighbor) {
+					// If we've already reached this node, return current path (avoid infinite recursion)
+					paths = append(paths, path...)
+					edgeRslt.Add(ast.ArrayTerm(paths...))
+				} else {
+					reached.Add(root)
+					pathBuilder(graph, neighbor, path, edgeRslt, reached)
+
+				}
+
+			})
+
+		} else {
+			paths = append(paths, path...)
+			edgeRslt.Add(ast.ArrayTerm(paths...))
+
+		}
+	} else {
+		// Node is nonexistent (not in graph). Commit the current path (without adding this root)
+		paths = append(paths, path...)
+		edgeRslt.Add(ast.ArrayTerm(paths...))
+
+	}
+
+}
+
+func builtinReachablePaths(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	var traceResult = ast.NewSet()
+	// Error on wrong types for args.
+	graph, err := builtins.ObjectOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	// This is a queue that holds all nodes we still need to visit.  It is
+	// initialised to the initial set of nodes we start out with.
+	var queue []*ast.Term
+	switch initial := operands[1].Value.(type) {
+	case *ast.Array, ast.Set:
+		foreachVertex(ast.NewTerm(initial), func(t *ast.Term) {
+			queue = append(queue, t)
+		})
+	default:
+		return builtins.NewOperandTypeErr(2, initial, "{array, set}")
+	}
+
+	for _, node := range queue {
+		// Find reachable paths from edges in root node in queue and append arrays to the results set
+		if edges := graph.Get(node); edges != nil {
+			if numberOfEdges(edges) >= 1 {
+				foreachVertex(edges, func(neighbor *ast.Term) {
+					pathBuilder(graph, neighbor, []*ast.Term{node}, traceResult, ast.NewSet(node))
+				})
+			} else {
+				traceResult.Add(ast.ArrayTerm(node))
+			}
+		}
+	}
+
+	return iter(ast.NewTerm(traceResult))
+}
+
 func init() {
 	RegisterBuiltinFunc(ast.ReachableBuiltin.Name, builtinReachable)
+	RegisterBuiltinFunc(ast.ReachablePathsBuiltin.Name, builtinReachablePaths)
 }
diff --git a/topdown/regex.go b/topdown/regex.go
index 7e29db7912..b1902a5e7b 100644
--- a/topdown/regex.go
+++ b/topdown/regex.go
@@ -33,64 +33,64 @@ func builtinRegexIsValid(_ BuiltinContext, operands []*ast.Term, iter func(*ast.
 	return iter(ast.BooleanTerm(true))
 }
 
-func builtinRegexMatch(a, b ast.Value) (ast.Value, error) {
-	s1, err := builtins.StringOperand(a, 1)
+func builtinRegexMatch(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s1, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	s2, err := builtins.StringOperand(b, 2)
+	s2, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	re, err := getRegexp(string(s1))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.Boolean(re.Match([]byte(s2))), nil
+	return iter(ast.BooleanTerm(re.Match([]byte(s2))))
 }
 
-func builtinRegexMatchTemplate(a, b, c, d ast.Value) (ast.Value, error) {
-	pattern, err := builtins.StringOperand(a, 1)
+func builtinRegexMatchTemplate(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	pattern, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	match, err := builtins.StringOperand(b, 2)
+	match, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	start, err := builtins.StringOperand(c, 3)
+	start, err := builtins.StringOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	end, err := builtins.StringOperand(d, 4)
+	end, err := builtins.StringOperand(operands[3].Value, 4)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	if len(start) != 1 {
-		return nil, fmt.Errorf("start delimiter has to be exactly one character long but is %d long", len(start))
+		return fmt.Errorf("start delimiter has to be exactly one character long but is %d long", len(start))
 	}
 	if len(end) != 1 {
-		return nil, fmt.Errorf("end delimiter has to be exactly one character long but is %d long", len(start))
+		return fmt.Errorf("end delimiter has to be exactly one character long but is %d long", len(start))
 	}
 	re, err := getRegexpTemplate(string(pattern), string(start)[0], string(end)[0])
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.Boolean(re.MatchString(string(match))), nil
+	return iter(ast.BooleanTerm(re.MatchString(string(match))))
 }
 
-func builtinRegexSplit(a, b ast.Value) (ast.Value, error) {
-	s1, err := builtins.StringOperand(a, 1)
+func builtinRegexSplit(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s1, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	s2, err := builtins.StringOperand(b, 2)
+	s2, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	re, err := getRegexp(string(s1))
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	elems := re.Split(string(s2), -1)
@@ -98,7 +98,7 @@ func builtinRegexSplit(a, b ast.Value) (ast.Value, error) {
 	for i := range elems {
 		arr[i] = ast.StringTerm(elems[i])
 	}
-	return ast.NewArray(arr...), nil
+	return iter(ast.NewTerm(ast.NewArray(arr...)))
 }
 
 func getRegexp(pat string) (*regexp.Regexp, error) {
@@ -107,7 +107,7 @@ func getRegexp(pat string) (*regexp.Regexp, error) {
 	re, ok := regexpCache[pat]
 	if !ok {
 		var err error
-		re, err = regexp.Compile(string(pat))
+		re, err = regexp.Compile(pat)
 		if err != nil {
 			return nil, err
 		}
@@ -122,7 +122,7 @@ func getRegexpTemplate(pat string, delimStart, delimEnd byte) (*regexp.Regexp, e
 	re, ok := regexpCache[pat]
 	if !ok {
 		var err error
-		re, err = compileRegexTemplate(string(pat), delimStart, delimEnd)
+		re, err = compileRegexTemplate(pat, delimStart, delimEnd)
 		if err != nil {
 			return nil, err
 		}
@@ -131,38 +131,38 @@ func getRegexpTemplate(pat string, delimStart, delimEnd byte) (*regexp.Regexp, e
 	return re, nil
 }
 
-func builtinGlobsMatch(a, b ast.Value) (ast.Value, error) {
-	s1, err := builtins.StringOperand(a, 1)
+func builtinGlobsMatch(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s1, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	s2, err := builtins.StringOperand(b, 2)
+	s2, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	ne, err := gintersect.NonEmpty(string(s1), string(s2))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.Boolean(ne), nil
+	return iter(ast.BooleanTerm(ne))
 }
 
-func builtinRegexFind(a, b, c ast.Value) (ast.Value, error) {
-	s1, err := builtins.StringOperand(a, 1)
+func builtinRegexFind(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s1, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	s2, err := builtins.StringOperand(b, 2)
+	s2, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	n, err := builtins.IntOperand(c, 3)
+	n, err := builtins.IntOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	re, err := getRegexp(string(s1))
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	elems := re.FindAllString(string(s2), n)
@@ -170,26 +170,26 @@ func builtinRegexFind(a, b, c ast.Value) (ast.Value, error) {
 	for i := range elems {
 		arr[i] = ast.StringTerm(elems[i])
 	}
-	return ast.NewArray(arr...), nil
+	return iter(ast.NewTerm(ast.NewArray(arr...)))
 }
 
-func builtinRegexFindAllStringSubmatch(a, b, c ast.Value) (ast.Value, error) {
-	s1, err := builtins.StringOperand(a, 1)
+func builtinRegexFindAllStringSubmatch(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s1, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	s2, err := builtins.StringOperand(b, 2)
+	s2, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	n, err := builtins.IntOperand(c, 3)
+	n, err := builtins.IntOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	re, err := getRegexp(string(s1))
 	if err != nil {
-		return nil, err
+		return err
 	}
 	matches := re.FindAllStringSubmatch(string(s2), n)
 
@@ -202,17 +202,44 @@ func builtinRegexFindAllStringSubmatch(a, b, c ast.Value) (ast.Value, error) {
 		outer[i] = ast.NewTerm(ast.NewArray(inner...))
 	}
 
-	return ast.NewArray(outer...), nil
+	return iter(ast.NewTerm(ast.NewArray(outer...)))
+}
+
+func builtinRegexReplace(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	base, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	pattern, err := builtins.StringOperand(operands[1].Value, 2)
+	if err != nil {
+		return err
+	}
+
+	value, err := builtins.StringOperand(operands[2].Value, 3)
+	if err != nil {
+		return err
+	}
+
+	re, err := getRegexp(string(pattern))
+	if err != nil {
+		return err
+	}
+
+	res := re.ReplaceAllString(string(base), string(value))
+
+	return iter(ast.StringTerm(res))
 }
 
 func init() {
 	regexpCache = map[string]*regexp.Regexp{}
 	RegisterBuiltinFunc(ast.RegexIsValid.Name, builtinRegexIsValid)
-	RegisterFunctionalBuiltin2(ast.RegexMatch.Name, builtinRegexMatch)
-	RegisterFunctionalBuiltin2(ast.RegexMatchDeprecated.Name, builtinRegexMatch)
-	RegisterFunctionalBuiltin2(ast.RegexSplit.Name, builtinRegexSplit)
-	RegisterFunctionalBuiltin2(ast.GlobsMatch.Name, builtinGlobsMatch)
-	RegisterFunctionalBuiltin4(ast.RegexTemplateMatch.Name, builtinRegexMatchTemplate)
-	RegisterFunctionalBuiltin3(ast.RegexFind.Name, builtinRegexFind)
-	RegisterFunctionalBuiltin3(ast.RegexFindAllStringSubmatch.Name, builtinRegexFindAllStringSubmatch)
+	RegisterBuiltinFunc(ast.RegexMatch.Name, builtinRegexMatch)
+	RegisterBuiltinFunc(ast.RegexMatchDeprecated.Name, builtinRegexMatch)
+	RegisterBuiltinFunc(ast.RegexSplit.Name, builtinRegexSplit)
+	RegisterBuiltinFunc(ast.GlobsMatch.Name, builtinGlobsMatch)
+	RegisterBuiltinFunc(ast.RegexTemplateMatch.Name, builtinRegexMatchTemplate)
+	RegisterBuiltinFunc(ast.RegexFind.Name, builtinRegexFind)
+	RegisterBuiltinFunc(ast.RegexFindAllStringSubmatch.Name, builtinRegexFindAllStringSubmatch)
+	RegisterBuiltinFunc(ast.RegexReplace.Name, builtinRegexReplace)
 }
diff --git a/topdown/regex_template.go b/topdown/regex_template.go
index 39f92346ff..4bcddc060b 100644
--- a/topdown/regex_template.go
+++ b/topdown/regex_template.go
@@ -72,9 +72,9 @@ func delimiterIndices(s string, delimiterStart, delimiterEnd byte) ([]int, error
 // You can define your own delimiters. It is e.g. common to use curly braces {} but I recommend using characters
 // which have no special meaning in Regex, e.g.: <, >
 //
-//  reg, err := compiler.CompileRegex("foo:bar.baz:<[0-9]{2,10}>", '<', '>')
-//  // if err != nil ...
-//  reg.MatchString("foo:bar.baz:123")
+//	reg, err := compiler.CompileRegex("foo:bar.baz:<[0-9]{2,10}>", '<', '>')
+//	// if err != nil ...
+//	reg.MatchString("foo:bar.baz:123")
 func compileRegexTemplate(tpl string, delimiterStart, delimiterEnd byte) (*regexp.Regexp, error) {
 	// Check if it is well-formed.
 	idxs, errBraces := delimiterIndices(tpl, delimiterStart, delimiterEnd)
diff --git a/topdown/runtime.go b/topdown/runtime.go
index 67e183d01d..7d512f7c00 100644
--- a/topdown/runtime.go
+++ b/topdown/runtime.go
@@ -4,7 +4,11 @@
 
 package topdown
 
-import "github.com/open-policy-agent/opa/ast"
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/ast"
+)
 
 func builtinOPARuntime(bctx BuiltinContext, _ []*ast.Term, iter func(*ast.Term) error) error {
 
@@ -12,9 +16,112 @@ func builtinOPARuntime(bctx BuiltinContext, _ []*ast.Term, iter func(*ast.Term)
 		return iter(ast.ObjectTerm())
 	}
 
+	if bctx.Runtime.Get(ast.StringTerm("config")) != nil {
+		iface, err := ast.ValueToInterface(bctx.Runtime.Value, illegalResolver{})
+		if err != nil {
+			return err
+		}
+		if object, ok := iface.(map[string]interface{}); ok {
+			if cfgRaw, ok := object["config"]; ok {
+				if config, ok := cfgRaw.(map[string]interface{}); ok {
+					configPurged, err := activeConfig(config)
+					if err != nil {
+						return err
+					}
+					object["config"] = configPurged
+					value, err := ast.InterfaceToValue(object)
+					if err != nil {
+						return err
+					}
+					return iter(ast.NewTerm(value))
+				}
+			}
+		}
+	}
+
 	return iter(bctx.Runtime)
 }
 
 func init() {
 	RegisterBuiltinFunc(ast.OPARuntime.Name, builtinOPARuntime)
 }
+
+func activeConfig(config map[string]interface{}) (interface{}, error) {
+
+	if config["services"] != nil {
+		err := removeServiceCredentials(config["services"])
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if config["keys"] != nil {
+		err := removeCryptoKeys(config["keys"])
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return config, nil
+}
+
+func removeServiceCredentials(x interface{}) error {
+
+	switch x := x.(type) {
+	case []interface{}:
+		for _, v := range x {
+			err := removeKey(v, "credentials")
+			if err != nil {
+				return err
+			}
+		}
+
+	case map[string]interface{}:
+		for _, v := range x {
+			err := removeKey(v, "credentials")
+			if err != nil {
+				return err
+			}
+		}
+	default:
+		return fmt.Errorf("illegal service config type: %T", x)
+	}
+
+	return nil
+}
+
+func removeCryptoKeys(x interface{}) error {
+
+	switch x := x.(type) {
+	case map[string]interface{}:
+		for _, v := range x {
+			err := removeKey(v, "key", "private_key")
+			if err != nil {
+				return err
+			}
+		}
+	default:
+		return fmt.Errorf("illegal keys config type: %T", x)
+	}
+
+	return nil
+}
+
+func removeKey(x interface{}, keys ...string) error {
+	val, ok := x.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("type assertion error")
+	}
+
+	for _, key := range keys {
+		delete(val, key)
+	}
+
+	return nil
+}
+
+type illegalResolver struct{}
+
+func (illegalResolver) Resolve(ref ast.Ref) (interface{}, error) {
+	return nil, fmt.Errorf("illegal value: %v", ref)
+}
diff --git a/topdown/runtime_test.go b/topdown/runtime_test.go
index 13f32da351..bd6f671d53 100644
--- a/topdown/runtime_test.go
+++ b/topdown/runtime_test.go
@@ -44,3 +44,42 @@ func TestOPARuntime(t *testing.T) {
 	}
 
 }
+
+func TestOPARuntimeConfigMasking(t *testing.T) {
+
+	ctx := context.Background()
+	q := NewQuery(ast.MustParseBody("opa.runtime(x)")).WithRuntime(ast.MustParseTerm(`{"config": {
+		"labels": {"foo": "bar"},
+		"services": {
+			"foo": {
+				"url": "https://remote.example.com",
+				"credentials": {
+					"oauth2": {
+						"client_id": "opa_client",
+						"client_secret": "sup3rs3cr3t"
+					}
+				}
+			}
+		}
+	}}`))
+	rs, err := q.Run(ctx)
+	if err != nil {
+		t.Fatal(err)
+	} else if len(rs) != 1 {
+		t.Fatal("Expected result set to contain exactly one result")
+	}
+
+	term := rs[0][ast.Var("x")]
+	exp := ast.MustParseTerm(`{"config": {
+		"labels": {"foo": "bar"},
+		"services": {
+			"foo": {
+				"url": "https://remote.example.com"
+			}
+		}
+	}}`)
+
+	if ast.Compare(term, exp) != 0 {
+		t.Fatalf("Expected %v but got %v", exp, term)
+	}
+}
diff --git a/topdown/save.go b/topdown/save.go
index 4ea644f0b8..85b9aea5bc 100644
--- a/topdown/save.go
+++ b/topdown/save.go
@@ -279,7 +279,7 @@ func newSaveSupport() *saveSupport {
 }
 
 func (s *saveSupport) List() []*ast.Module {
-	result := []*ast.Module{}
+	result := make([]*ast.Module, 0, len(s.modules))
 	for _, module := range s.modules {
 		result = append(result, module)
 	}
@@ -375,12 +375,16 @@ func ignoreExprDuringPartial(expr *ast.Expr) bool {
 }
 
 func ignoreDuringPartial(bi *ast.Builtin) bool {
+	// Note(philipc): We keep this legacy check around to avoid breaking
+	// existing library users.
+	//nolint:staticcheck // We specifically ignore our own linter warning here.
 	for _, ignore := range ast.IgnoreDuringPartialEval {
 		if bi == ignore {
 			return true
 		}
 	}
-	return false
+	// Otherwise, ensure all non-deterministic builtins are thrown out.
+	return bi.Nondeterministic
 }
 
 type inliningControl struct {
diff --git a/topdown/semver.go b/topdown/semver.go
index b91a5a9997..ab5aed3eec 100644
--- a/topdown/semver.go
+++ b/topdown/semver.go
@@ -12,13 +12,13 @@ import (
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinSemVerCompare(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	versionStringA, err := builtins.StringOperand(args[0].Value, 1)
+func builtinSemVerCompare(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	versionStringA, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return err
 	}
 
-	versionStringB, err := builtins.StringOperand(args[1].Value, 2)
+	versionStringB, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -37,11 +37,10 @@ func builtinSemVerCompare(bctx BuiltinContext, args []*ast.Term, iter func(*ast.
 	return iter(ast.IntNumberTerm(result))
 }
 
-func builtinSemVerIsValid(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	versionString, err := builtins.StringOperand(args[0].Value, 1)
+func builtinSemVerIsValid(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	versionString, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		result := ast.BooleanTerm(false)
-		return iter(result)
+		return iter(ast.BooleanTerm(false))
 	}
 
 	result := true
diff --git a/topdown/sets.go b/topdown/sets.go
index a9c5ad86c1..a973404f3f 100644
--- a/topdown/sets.go
+++ b/topdown/sets.go
@@ -10,32 +10,32 @@ import (
 )
 
 // Deprecated in v0.4.2 in favour of minus/infix "-" operation.
-func builtinSetDiff(a, b ast.Value) (ast.Value, error) {
+func builtinSetDiff(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	s1, err := builtins.SetOperand(a, 1)
+	s1, err := builtins.SetOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	s2, err := builtins.SetOperand(b, 2)
+	s2, err := builtins.SetOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return s1.Diff(s2), nil
+	return iter(ast.NewTerm(s1.Diff(s2)))
 }
 
 // builtinSetIntersection returns the intersection of the given input sets
-func builtinSetIntersection(a ast.Value) (ast.Value, error) {
+func builtinSetIntersection(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	inputSet, err := builtins.SetOperand(a, 1)
+	inputSet, err := builtins.SetOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// empty input set
 	if inputSet.Len() == 0 {
-		return ast.NewSet(), nil
+		return iter(ast.NewTerm(ast.NewSet()))
 	}
 
 	var result ast.Set
@@ -53,32 +53,42 @@ func builtinSetIntersection(a ast.Value) (ast.Value, error) {
 		}
 		return nil
 	})
-	return result, err
+	if err != nil {
+		return err
+	}
+	return iter(ast.NewTerm(result))
 }
 
 // builtinSetUnion returns the union of the given input sets
-func builtinSetUnion(a ast.Value) (ast.Value, error) {
+func builtinSetUnion(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	// The set union logic here is duplicated and manually inlined on
+	// purpose. By lifting this logic up a level, and not doing pairwise
+	// set unions, we avoid a number of heap allocations. This improves
+	// performance dramatically over the naive approach.
+	result := ast.NewSet()
 
-	inputSet, err := builtins.SetOperand(a, 1)
+	inputSet, err := builtins.SetOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	result := ast.NewSet()
-
 	err = inputSet.Iter(func(x *ast.Term) error {
-		n, err := builtins.SetOperand(x.Value, 1)
+		item, err := builtins.SetOperand(x.Value, 1)
 		if err != nil {
 			return err
 		}
-		result = result.Union(n)
+		item.Foreach(result.Add)
 		return nil
 	})
-	return result, err
+	if err != nil {
+		return err
+	}
+
+	return iter(ast.NewTerm(result))
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.SetDiff.Name, builtinSetDiff)
-	RegisterFunctionalBuiltin1(ast.Intersection.Name, builtinSetIntersection)
-	RegisterFunctionalBuiltin1(ast.Union.Name, builtinSetUnion)
+	RegisterBuiltinFunc(ast.SetDiff.Name, builtinSetDiff)
+	RegisterBuiltinFunc(ast.Intersection.Name, builtinSetIntersection)
+	RegisterBuiltinFunc(ast.Union.Name, builtinSetUnion)
 }
diff --git a/topdown/sets_bench_test.go b/topdown/sets_bench_test.go
new file mode 100644
index 0000000000..7a9bb887a3
--- /dev/null
+++ b/topdown/sets_bench_test.go
@@ -0,0 +1,231 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/storage"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
+)
+
+func genNxMSetBenchmarkData(n, m int) ast.Value {
+	setOfSets := ast.NewSet()
+	for i := 0; i < n; i++ {
+		v := ast.NewSet()
+		for j := 0; j < m; j++ {
+			v.Add(ast.StringTerm(fmt.Sprintf("%d,%d", i, j)))
+		}
+		setOfSets.Add(ast.NewTerm(v))
+	}
+	return setOfSets
+}
+
+func BenchmarkSetIntersection(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			b.Run(fmt.Sprintf("%dx%d", n, m), func(b *testing.B) {
+				store := inmem.NewFromObject(map[string]interface{}{"sets": genNxMSetBenchmarkData(n, m)})
+
+				module := `package test
+
+				combined := intersection({s | s := data.sets[_]})`
+
+				query := ast.MustParseBody("data.test.combined")
+				compiler := ast.MustCompileModules(map[string]string{
+					"test.rego": module,
+				})
+
+				b.ResetTimer()
+
+				for i := 0; i < b.N; i++ {
+
+					err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+						q := NewQuery(query).
+							WithCompiler(compiler).
+							WithStore(store).
+							WithTransaction(txn)
+
+						_, err := q.Run(ctx)
+						if err != nil {
+							return err
+						}
+
+						return nil
+					})
+
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		}
+	}
+}
+
+func BenchmarkSetIntersectionSlow(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 50, 100}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			b.Run(fmt.Sprintf("%dx%d", n, m), func(b *testing.B) {
+				store := inmem.NewFromObject(map[string]interface{}{"sets": genNxMSetBenchmarkData(n, m)})
+
+				module := `package test
+				import future.keywords.every
+				import future.keywords.in
+
+				combined[z] {
+					data.sets[m][z]
+					every ss in data.sets {
+						ss[z]
+					}
+				}`
+
+				query := ast.MustParseBody("data.test.combined")
+				compiler := ast.MustCompileModules(map[string]string{
+					"test.rego": module,
+				})
+
+				b.ResetTimer()
+
+				for i := 0; i < b.N; i++ {
+
+					err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+						q := NewQuery(query).
+							WithCompiler(compiler).
+							WithStore(store).
+							WithTransaction(txn)
+
+						_, err := q.Run(ctx)
+						if err != nil {
+							return err
+						}
+
+						return nil
+					})
+
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		}
+	}
+}
+
+func BenchmarkSetUnion(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 250}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			b.Run(fmt.Sprintf("%dx%d", n, m), func(b *testing.B) {
+				store := inmem.NewFromObject(map[string]interface{}{"sets": genNxMSetBenchmarkData(n, m)})
+
+				// Code is lifted from here:
+				// https://github.com/open-policy-agent/opa/issues/4979#issue-1332019382
+
+				module := `package test
+
+				combined := union({s | s := data.sets[_]})`
+
+				query := ast.MustParseBody("data.test.combined")
+				compiler := ast.MustCompileModules(map[string]string{
+					"test.rego": module,
+				})
+
+				b.ResetTimer()
+
+				for i := 0; i < b.N; i++ {
+
+					err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+						q := NewQuery(query).
+							WithCompiler(compiler).
+							WithStore(store).
+							WithTransaction(txn)
+
+						_, err := q.Run(ctx)
+						if err != nil {
+							return err
+						}
+
+						return nil
+					})
+
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		}
+	}
+}
+
+func BenchmarkSetUnionSlow(b *testing.B) {
+	// This benchmarks the suggested means to implement union
+	// without using the builtin, to give us an idea of whether or not
+	// the builtin is actually making things any faster.
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 250}
+
+	for _, n := range sizes {
+		for _, m := range sizes {
+			b.Run(fmt.Sprintf("%dx%d", n, m), func(b *testing.B) {
+				store := inmem.NewFromObject(map[string]interface{}{"sets": genNxMSetBenchmarkData(n, m)})
+
+				// Code is lifted from here:
+				// https://github.com/open-policy-agent/opa/issues/4979#issue-1332019382
+
+				module := `package test
+
+				combined := {t | s := data.sets[_]; s[t]}`
+
+				query := ast.MustParseBody("data.test.combined")
+				compiler := ast.MustCompileModules(map[string]string{
+					"test.rego": module,
+				})
+
+				b.ResetTimer()
+
+				for i := 0; i < b.N; i++ {
+
+					err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+						q := NewQuery(query).
+							WithCompiler(compiler).
+							WithStore(store).
+							WithTransaction(txn)
+
+						_, err := q.Run(ctx)
+						if err != nil {
+							return err
+						}
+
+						return nil
+					})
+
+					if err != nil {
+						b.Fatal(err)
+					}
+				}
+			})
+		}
+	}
+}
diff --git a/topdown/sets_test.go b/topdown/sets_test.go
new file mode 100644
index 0000000000..c999bb004a
--- /dev/null
+++ b/topdown/sets_test.go
@@ -0,0 +1,61 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+)
+
+func TestSetUnionBuiltin(t *testing.T) {
+	tests := []struct {
+		note     string
+		query    string
+		input    string
+		expected string
+	}{
+		// NOTE(philipc): These tests assume that erroneous types are
+		// checked elsewhere, and focus only on functional correctness.
+		{
+			note:     "Empty",
+			input:    `{set()}`,
+			expected: `set()`,
+		},
+		{
+			note:     "Singletons",
+			input:    `{{1}, {2}, {3}, {4}, {5}}`,
+			expected: `{1, 2, 3, 4, 5}`,
+		},
+		{
+			note:     "One set",
+			input:    `{{1, 2, 3, 4, 5}}`,
+			expected: `{1, 2, 3, 4, 5}`,
+		},
+		{
+			note:     "One set + empty",
+			input:    `{{1, 2, 3, 4, 5}, set()}`,
+			expected: `{1, 2, 3, 4, 5}`,
+		},
+		{
+			note:     "Multiple sets, with duplicates",
+			input:    `{{1, 2, 3}, {1, 2}, {3}, {4, 5}}`,
+			expected: `{1, 2, 3, 4, 5}`,
+		},
+	}
+
+	for _, tc := range tests {
+		inputs := ast.MustParseTerm(tc.input)
+		result, err := getResult(builtinSetUnion, inputs)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		expected := ast.MustParseTerm(tc.expected)
+		if !result.Equal(expected) {
+			t.Fatalf("Expected %v but got %v", expected, result)
+		}
+	}
+}
diff --git a/topdown/strings.go b/topdown/strings.go
index 1fe2806c1b..d5baa31972 100644
--- a/topdown/strings.go
+++ b/topdown/strings.go
@@ -10,20 +10,118 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/tchap/go-patricia/v2/patricia"
+
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/topdown/builtins"
 )
 
-func builtinFormatInt(a, b ast.Value) (ast.Value, error) {
+func builtinAnyPrefixMatch(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	a, b := operands[0].Value, operands[1].Value
+
+	var strs []string
+	switch a := a.(type) {
+	case ast.String:
+		strs = []string{string(a)}
+	case *ast.Array, ast.Set:
+		var err error
+		strs, err = builtins.StringSliceOperand(a, 1)
+		if err != nil {
+			return err
+		}
+	default:
+		return builtins.NewOperandTypeErr(1, a, "string", "set", "array")
+	}
+
+	var prefixes []string
+	switch b := b.(type) {
+	case ast.String:
+		prefixes = []string{string(b)}
+	case *ast.Array, ast.Set:
+		var err error
+		prefixes, err = builtins.StringSliceOperand(b, 2)
+		if err != nil {
+			return err
+		}
+	default:
+		return builtins.NewOperandTypeErr(2, b, "string", "set", "array")
+	}
+
+	return iter(ast.BooleanTerm(anyStartsWithAny(strs, prefixes)))
+}
+
+func builtinAnySuffixMatch(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	a, b := operands[0].Value, operands[1].Value
+
+	var strsReversed []string
+	switch a := a.(type) {
+	case ast.String:
+		strsReversed = []string{reverseString(string(a))}
+	case *ast.Array, ast.Set:
+		strs, err := builtins.StringSliceOperand(a, 1)
+		if err != nil {
+			return err
+		}
+		strsReversed = make([]string, len(strs))
+		for i := range strs {
+			strsReversed[i] = reverseString(strs[i])
+		}
+	default:
+		return builtins.NewOperandTypeErr(1, a, "string", "set", "array")
+	}
+
+	var suffixesReversed []string
+	switch b := b.(type) {
+	case ast.String:
+		suffixesReversed = []string{reverseString(string(b))}
+	case *ast.Array, ast.Set:
+		suffixes, err := builtins.StringSliceOperand(b, 2)
+		if err != nil {
+			return err
+		}
+		suffixesReversed = make([]string, len(suffixes))
+		for i := range suffixes {
+			suffixesReversed[i] = reverseString(suffixes[i])
+		}
+	default:
+		return builtins.NewOperandTypeErr(2, b, "string", "set", "array")
+	}
+
+	return iter(ast.BooleanTerm(anyStartsWithAny(strsReversed, suffixesReversed)))
+}
 
-	input, err := builtins.NumberOperand(a, 1)
+func anyStartsWithAny(strs []string, prefixes []string) bool {
+	if len(strs) == 0 || len(prefixes) == 0 {
+		return false
+	}
+	if len(strs) == 1 && len(prefixes) == 1 {
+		return strings.HasPrefix(strs[0], prefixes[0])
+	}
+
+	trie := patricia.NewTrie()
+	for i := 0; i < len(strs); i++ {
+		trie.Insert([]byte(strs[i]), true)
+	}
+
+	for i := 0; i < len(prefixes); i++ {
+		if trie.MatchSubtree([]byte(prefixes[i])) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func builtinFormatInt(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+
+	input, err := builtins.NumberOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	base, err := builtins.NumberOperand(b, 2)
+	base, err := builtins.NumberOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	var format string
@@ -37,119 +135,151 @@ func builtinFormatInt(a, b ast.Value) (ast.Value, error) {
 	case ast.Number("16"):
 		format = "%x"
 	default:
-		return nil, builtins.NewOperandEnumErr(2, "2", "8", "10", "16")
+		return builtins.NewOperandEnumErr(2, "2", "8", "10", "16")
 	}
 
 	f := builtins.NumberToFloat(input)
 	i, _ := f.Int(nil)
 
-	return ast.String(fmt.Sprintf(format, i)), nil
+	return iter(ast.StringTerm(fmt.Sprintf(format, i)))
 }
 
-func builtinConcat(a, b ast.Value) (ast.Value, error) {
+func builtinConcat(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	join, err := builtins.StringOperand(a, 1)
+	join, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	strs := []string{}
 
-	switch b := b.(type) {
+	switch b := operands[1].Value.(type) {
 	case *ast.Array:
 		err := b.Iter(func(x *ast.Term) error {
 			s, ok := x.Value.(ast.String)
 			if !ok {
-				return builtins.NewOperandElementErr(2, b, x.Value, "string")
+				return builtins.NewOperandElementErr(2, operands[1].Value, x.Value, "string")
 			}
 			strs = append(strs, string(s))
 			return nil
 		})
 		if err != nil {
-			return nil, err
+			return err
 		}
 	case ast.Set:
 		err := b.Iter(func(x *ast.Term) error {
 			s, ok := x.Value.(ast.String)
 			if !ok {
-				return builtins.NewOperandElementErr(2, b, x.Value, "string")
+				return builtins.NewOperandElementErr(2, operands[1].Value, x.Value, "string")
 			}
 			strs = append(strs, string(s))
 			return nil
 		})
 		if err != nil {
-			return nil, err
+			return err
 		}
 	default:
-		return nil, builtins.NewOperandTypeErr(2, b, "set", "array")
+		return builtins.NewOperandTypeErr(2, operands[1].Value, "set", "array")
 	}
 
-	return ast.String(strings.Join(strs, string(join))), nil
+	return iter(ast.StringTerm(strings.Join(strs, string(join))))
 }
 
-func builtinIndexOf(a, b ast.Value) (ast.Value, error) {
-	runesEqual := func(a, b []rune) bool {
-		if len(a) != len(b) {
+func runesEqual(a, b []rune) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i, v := range a {
+		if v != b[i] {
 			return false
 		}
-		for i, v := range a {
-			if v != b[i] {
-				return false
+	}
+	return true
+}
+
+func builtinIndexOf(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	base, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	search, err := builtins.StringOperand(operands[1].Value, 2)
+	if err != nil {
+		return err
+	}
+	if len(string(search)) == 0 {
+		return fmt.Errorf("empty search character")
+	}
+
+	baseRunes := []rune(string(base))
+	searchRunes := []rune(string(search))
+	searchLen := len(searchRunes)
+
+	for i, r := range baseRunes {
+		if len(baseRunes) >= i+searchLen {
+			if r == searchRunes[0] && runesEqual(baseRunes[i:i+searchLen], searchRunes) {
+				return iter(ast.IntNumberTerm(i))
 			}
+		} else {
+			break
 		}
-		return true
 	}
 
-	base, err := builtins.StringOperand(a, 1)
+	return iter(ast.IntNumberTerm(-1))
+}
+
+func builtinIndexOfN(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	base, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	search, err := builtins.StringOperand(b, 2)
+	search, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	if len(string(search)) == 0 {
-		return nil, fmt.Errorf("empty search character")
+		return fmt.Errorf("empty search character")
 	}
 
 	baseRunes := []rune(string(base))
 	searchRunes := []rune(string(search))
 	searchLen := len(searchRunes)
 
+	var arr []*ast.Term
 	for i, r := range baseRunes {
-		if r == searchRunes[0] {
-			if len(baseRunes) >= i+searchLen {
-				if runesEqual(baseRunes[i:i+searchLen], searchRunes) {
-					return ast.IntNumberTerm(i).Value, nil
-				}
+		if len(baseRunes) >= i+searchLen {
+			if r == searchRunes[0] && runesEqual(baseRunes[i:i+searchLen], searchRunes) {
+				arr = append(arr, ast.IntNumberTerm(i))
 			}
+		} else {
+			break
 		}
 	}
 
-	return ast.IntNumberTerm(-1).Value, nil
+	return iter(ast.ArrayTerm(arr...))
 }
 
-func builtinSubstring(a, b, c ast.Value) (ast.Value, error) {
+func builtinSubstring(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	base, err := builtins.StringOperand(a, 1)
+	base, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	runes := []rune(base)
 
-	startIndex, err := builtins.IntOperand(b, 2)
+	startIndex, err := builtins.IntOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	} else if startIndex >= len(runes) {
-		return ast.String(""), nil
+		return iter(ast.StringTerm(""))
 	} else if startIndex < 0 {
-		return nil, fmt.Errorf("negative offset")
+		return fmt.Errorf("negative offset")
 	}
 
-	length, err := builtins.IntOperand(c, 3)
+	length, err := builtins.IntOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	var s ast.String
@@ -163,229 +293,229 @@ func builtinSubstring(a, b, c ast.Value) (ast.Value, error) {
 		s = ast.String(runes[startIndex:upto])
 	}
 
-	return s, nil
+	return iter(ast.NewTerm(s))
 }
 
-func builtinContains(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinContains(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	substr, err := builtins.StringOperand(b, 2)
+	substr, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.Boolean(strings.Contains(string(s), string(substr))), nil
+	return iter(ast.BooleanTerm(strings.Contains(string(s), string(substr))))
 }
 
-func builtinStartsWith(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinStartsWith(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	prefix, err := builtins.StringOperand(b, 2)
+	prefix, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.Boolean(strings.HasPrefix(string(s), string(prefix))), nil
+	return iter(ast.BooleanTerm(strings.HasPrefix(string(s), string(prefix))))
 }
 
-func builtinEndsWith(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinEndsWith(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	suffix, err := builtins.StringOperand(b, 2)
+	suffix, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.Boolean(strings.HasSuffix(string(s), string(suffix))), nil
+	return iter(ast.BooleanTerm(strings.HasSuffix(string(s), string(suffix))))
 }
 
-func builtinLower(a ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinLower(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.ToLower(string(s))), nil
+	return iter(ast.StringTerm(strings.ToLower(string(s))))
 }
 
-func builtinUpper(a ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinUpper(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.ToUpper(string(s))), nil
+	return iter(ast.StringTerm(strings.ToUpper(string(s))))
 }
 
-func builtinSplit(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinSplit(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	d, err := builtins.StringOperand(b, 2)
+	d, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	elems := strings.Split(string(s), string(d))
 	arr := make([]*ast.Term, len(elems))
 	for i := range elems {
 		arr[i] = ast.StringTerm(elems[i])
 	}
-	return ast.NewArray(arr...), nil
+	return iter(ast.ArrayTerm(arr...))
 }
 
-func builtinReplace(a, b, c ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinReplace(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	old, err := builtins.StringOperand(b, 2)
+	old, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	new, err := builtins.StringOperand(c, 3)
+	new, err := builtins.StringOperand(operands[2].Value, 3)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.Replace(string(s), string(old), string(new), -1)), nil
+	return iter(ast.StringTerm(strings.Replace(string(s), string(old), string(new), -1)))
 }
 
-func builtinReplaceN(a, b ast.Value) (ast.Value, error) {
-	patterns, err := builtins.ObjectOperand(a, 1)
+func builtinReplaceN(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	patterns, err := builtins.ObjectOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	keys := patterns.Keys()
 	sort.Slice(keys, func(i, j int) bool { return ast.Compare(keys[i].Value, keys[j].Value) < 0 })
 
-	s, err := builtins.StringOperand(b, 2)
+	s, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	var oldnewArr []string
+	oldnewArr := make([]string, 0, len(keys)*2)
 	for _, k := range keys {
 		keyVal, ok := k.Value.(ast.String)
 		if !ok {
-			return nil, builtins.NewOperandErr(1, "non-string key found in pattern object")
+			return builtins.NewOperandErr(1, "non-string key found in pattern object")
 		}
 		val := patterns.Get(k) // cannot be nil
 		strVal, ok := val.Value.(ast.String)
 		if !ok {
-			return nil, builtins.NewOperandErr(1, "non-string value found in pattern object")
+			return builtins.NewOperandErr(1, "non-string value found in pattern object")
 		}
 		oldnewArr = append(oldnewArr, string(keyVal), string(strVal))
 	}
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	r := strings.NewReplacer(oldnewArr...)
 	replaced := r.Replace(string(s))
 
-	return ast.String(replaced), nil
+	return iter(ast.StringTerm(replaced))
 }
 
-func builtinTrim(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinTrim(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	c, err := builtins.StringOperand(b, 2)
+	c, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.Trim(string(s), string(c))), nil
+	return iter(ast.StringTerm(strings.Trim(string(s), string(c))))
 }
 
-func builtinTrimLeft(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinTrimLeft(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	c, err := builtins.StringOperand(b, 2)
+	c, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.TrimLeft(string(s), string(c))), nil
+	return iter(ast.StringTerm(strings.TrimLeft(string(s), string(c))))
 }
 
-func builtinTrimPrefix(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinTrimPrefix(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	pre, err := builtins.StringOperand(b, 2)
+	pre, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.TrimPrefix(string(s), string(pre))), nil
+	return iter(ast.StringTerm(strings.TrimPrefix(string(s), string(pre))))
 }
 
-func builtinTrimRight(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinTrimRight(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	c, err := builtins.StringOperand(b, 2)
+	c, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.TrimRight(string(s), string(c))), nil
+	return iter(ast.StringTerm(strings.TrimRight(string(s), string(c))))
 }
 
-func builtinTrimSuffix(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinTrimSuffix(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	suf, err := builtins.StringOperand(b, 2)
+	suf, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.TrimSuffix(string(s), string(suf))), nil
+	return iter(ast.StringTerm(strings.TrimSuffix(string(s), string(suf))))
 }
 
-func builtinTrimSpace(a ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinTrimSpace(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	return ast.String(strings.TrimSpace(string(s))), nil
+	return iter(ast.StringTerm(strings.TrimSpace(string(s))))
 }
 
-func builtinSprintf(a, b ast.Value) (ast.Value, error) {
-	s, err := builtins.StringOperand(a, 1)
+func builtinSprintf(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	astArr, ok := b.(*ast.Array)
+	astArr, ok := operands[1].Value.(*ast.Array)
 	if !ok {
-		return nil, builtins.NewOperandTypeErr(2, b, "array")
+		return builtins.NewOperandTypeErr(2, operands[1].Value, "array")
 	}
 
 	args := make([]interface{}, astArr.Len())
@@ -409,27 +539,52 @@ func builtinSprintf(a, b ast.Value) (ast.Value, error) {
 		}
 	}
 
-	return ast.String(fmt.Sprintf(string(s), args...)), nil
+	return iter(ast.StringTerm(fmt.Sprintf(string(s), args...)))
+}
+
+func builtinReverse(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	s, err := builtins.StringOperand(operands[0].Value, 1)
+	if err != nil {
+		return err
+	}
+
+	return iter(ast.StringTerm(reverseString(string(s))))
+}
+
+func reverseString(str string) string {
+	sRunes := []rune(str)
+	length := len(sRunes)
+	reversedRunes := make([]rune, length)
+
+	for index, r := range sRunes {
+		reversedRunes[length-index-1] = r
+	}
+
+	return string(reversedRunes)
 }
 
 func init() {
-	RegisterFunctionalBuiltin2(ast.FormatInt.Name, builtinFormatInt)
-	RegisterFunctionalBuiltin2(ast.Concat.Name, builtinConcat)
-	RegisterFunctionalBuiltin2(ast.IndexOf.Name, builtinIndexOf)
-	RegisterFunctionalBuiltin3(ast.Substring.Name, builtinSubstring)
-	RegisterFunctionalBuiltin2(ast.Contains.Name, builtinContains)
-	RegisterFunctionalBuiltin2(ast.StartsWith.Name, builtinStartsWith)
-	RegisterFunctionalBuiltin2(ast.EndsWith.Name, builtinEndsWith)
-	RegisterFunctionalBuiltin1(ast.Upper.Name, builtinUpper)
-	RegisterFunctionalBuiltin1(ast.Lower.Name, builtinLower)
-	RegisterFunctionalBuiltin2(ast.Split.Name, builtinSplit)
-	RegisterFunctionalBuiltin3(ast.Replace.Name, builtinReplace)
-	RegisterFunctionalBuiltin2(ast.ReplaceN.Name, builtinReplaceN)
-	RegisterFunctionalBuiltin2(ast.Trim.Name, builtinTrim)
-	RegisterFunctionalBuiltin2(ast.TrimLeft.Name, builtinTrimLeft)
-	RegisterFunctionalBuiltin2(ast.TrimPrefix.Name, builtinTrimPrefix)
-	RegisterFunctionalBuiltin2(ast.TrimRight.Name, builtinTrimRight)
-	RegisterFunctionalBuiltin2(ast.TrimSuffix.Name, builtinTrimSuffix)
-	RegisterFunctionalBuiltin1(ast.TrimSpace.Name, builtinTrimSpace)
-	RegisterFunctionalBuiltin2(ast.Sprintf.Name, builtinSprintf)
+	RegisterBuiltinFunc(ast.FormatInt.Name, builtinFormatInt)
+	RegisterBuiltinFunc(ast.Concat.Name, builtinConcat)
+	RegisterBuiltinFunc(ast.IndexOf.Name, builtinIndexOf)
+	RegisterBuiltinFunc(ast.IndexOfN.Name, builtinIndexOfN)
+	RegisterBuiltinFunc(ast.Substring.Name, builtinSubstring)
+	RegisterBuiltinFunc(ast.Contains.Name, builtinContains)
+	RegisterBuiltinFunc(ast.StartsWith.Name, builtinStartsWith)
+	RegisterBuiltinFunc(ast.EndsWith.Name, builtinEndsWith)
+	RegisterBuiltinFunc(ast.Upper.Name, builtinUpper)
+	RegisterBuiltinFunc(ast.Lower.Name, builtinLower)
+	RegisterBuiltinFunc(ast.Split.Name, builtinSplit)
+	RegisterBuiltinFunc(ast.Replace.Name, builtinReplace)
+	RegisterBuiltinFunc(ast.ReplaceN.Name, builtinReplaceN)
+	RegisterBuiltinFunc(ast.Trim.Name, builtinTrim)
+	RegisterBuiltinFunc(ast.TrimLeft.Name, builtinTrimLeft)
+	RegisterBuiltinFunc(ast.TrimPrefix.Name, builtinTrimPrefix)
+	RegisterBuiltinFunc(ast.TrimRight.Name, builtinTrimRight)
+	RegisterBuiltinFunc(ast.TrimSuffix.Name, builtinTrimSuffix)
+	RegisterBuiltinFunc(ast.TrimSpace.Name, builtinTrimSpace)
+	RegisterBuiltinFunc(ast.Sprintf.Name, builtinSprintf)
+	RegisterBuiltinFunc(ast.AnyPrefixMatch.Name, builtinAnyPrefixMatch)
+	RegisterBuiltinFunc(ast.AnySuffixMatch.Name, builtinAnySuffixMatch)
+	RegisterBuiltinFunc(ast.StringReverse.Name, builtinReverse)
 }
diff --git a/topdown/strings_bench_test.go b/topdown/strings_bench_test.go
new file mode 100644
index 0000000000..4b791b25f9
--- /dev/null
+++ b/topdown/strings_bench_test.go
@@ -0,0 +1,115 @@
+package topdown
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/inmem"
+)
+
+func BenchmarkBulkStartsWithNaive(b *testing.B) {
+	data := generateBulkStartsWithInput()
+	ctx := context.Background()
+	store := inmem.NewFromObject(data)
+
+	compiler := ast.MustCompileModules(map[string]string{
+		"test.rego": `
+package test
+
+result {
+  startswith(data.strings[_], data.prefixes[_])
+}
+`,
+	})
+
+	query, err := compiler.QueryCompiler().Compile(ast.MustParseBody("data.test.result"))
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+
+		err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+			q := NewQuery(query).
+				WithCompiler(compiler).
+				WithStore(store).
+				WithTransaction(txn)
+
+			_, err := q.Run(ctx)
+			if err != nil {
+				return err
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkBulkStartsWithOptimized(b *testing.B) {
+	data := generateBulkStartsWithInput()
+	ctx := context.Background()
+	store := inmem.NewFromObject(data)
+
+	compiler := ast.MustCompileModules(map[string]string{
+		"test.rego": `
+package test
+
+result {
+  strings.any_prefix_match(data.strings, data.prefixes)
+}
+`,
+	})
+
+	query, err := compiler.QueryCompiler().Compile(ast.MustParseBody("data.test.result"))
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+
+		err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+			q := NewQuery(query).
+				WithCompiler(compiler).
+				WithStore(store).
+				WithTransaction(txn)
+
+			_, err := q.Run(ctx)
+			if err != nil {
+				return err
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func generateBulkStartsWithInput() map[string]interface{} {
+	var strs, prefixes []string
+	for i := 0; i < 1000; i++ {
+		strs = append(strs, fmt.Sprintf("aabbccddeeffgghhiijjkkllmmnnoopp_%d", i))
+	}
+	for i := 0; i < 100; i++ {
+		prefixes = append(prefixes, fmt.Sprintf("aabbccddeeffgghhiijjkkllmmnnoorr_%d", i))
+	}
+	return map[string]interface{}{
+		"strings":  strs,
+		"prefixes": prefixes,
+	}
+}
diff --git a/topdown/subset.go b/topdown/subset.go
new file mode 100644
index 0000000000..19c6571c02
--- /dev/null
+++ b/topdown/subset.go
@@ -0,0 +1,263 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package topdown
+
+import (
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/topdown/builtins"
+)
+
+func bothObjects(t1, t2 *ast.Term) (bool, ast.Object, ast.Object) {
+	if (t1 == nil) || (t2 == nil) {
+		return false, nil, nil
+	}
+
+	obj1, ok := t1.Value.(ast.Object)
+	if !ok {
+		return false, nil, nil
+	}
+
+	obj2, ok := t2.Value.(ast.Object)
+	if !ok {
+		return false, nil, nil
+	}
+
+	return true, obj1, obj2
+}
+
+func bothSets(t1, t2 *ast.Term) (bool, ast.Set, ast.Set) {
+	if (t1 == nil) || (t2 == nil) {
+		return false, nil, nil
+	}
+
+	set1, ok := t1.Value.(ast.Set)
+	if !ok {
+		return false, nil, nil
+	}
+
+	set2, ok := t2.Value.(ast.Set)
+	if !ok {
+		return false, nil, nil
+	}
+
+	return true, set1, set2
+}
+
+func bothArrays(t1, t2 *ast.Term) (bool, *ast.Array, *ast.Array) {
+	if (t1 == nil) || (t2 == nil) {
+		return false, nil, nil
+	}
+
+	array1, ok := t1.Value.(*ast.Array)
+	if !ok {
+		return false, nil, nil
+	}
+
+	array2, ok := t2.Value.(*ast.Array)
+	if !ok {
+		return false, nil, nil
+	}
+
+	return true, array1, array2
+}
+
+func arraySet(t1, t2 *ast.Term) (bool, *ast.Array, ast.Set) {
+	if (t1 == nil) || (t2 == nil) {
+		return false, nil, nil
+	}
+
+	array, ok := t1.Value.(*ast.Array)
+	if !ok {
+		return false, nil, nil
+	}
+
+	set, ok := t2.Value.(ast.Set)
+	if !ok {
+		return false, nil, nil
+	}
+
+	return true, array, set
+}
+
+// objectSubset implements the subset operation on a pair of objects.
+//
+// This function will try to recursively apply the subset operation where it
+// can, such as if both super and sub have an object or set as the value
+// associated with a key.
+func objectSubset(super ast.Object, sub ast.Object) bool {
+	var superTerm *ast.Term
+	isSubset := true
+
+	sub.Until(func(key, subTerm *ast.Term) bool {
+		// This really wants to be a for loop, hence the somewhat
+		// weird internal structure. However, using Until() in this
+		// was is a performance optimization, as it avoids performing
+		// any key hashing on the sub-object.
+
+		superTerm = super.Get(key)
+
+		// subTerm is can't be nil because we got it from Until(), so
+		// we only need to verify that super is non-nil.
+		if superTerm == nil {
+			isSubset = false
+			return true // break, not a subset
+		}
+
+		if subTerm.Equal(superTerm) {
+			return false // continue
+		}
+
+		// If both of the terms are objects then we want to apply
+		// the subset operation recursively, otherwise we just compare
+		// them normally. If only one term is an object, then we
+		// do a normal comparison which will come up false.
+		if ok, superObj, subObj := bothObjects(superTerm, subTerm); ok {
+			if !objectSubset(superObj, subObj) {
+				isSubset = false
+				return true // break, not a subset
+			}
+
+			return false // continue
+		}
+
+		if ok, superSet, subSet := bothSets(superTerm, subTerm); ok {
+			if !setSubset(superSet, subSet) {
+				isSubset = false
+				return true // break, not a subset
+			}
+
+			return false // continue
+		}
+
+		if ok, superArray, subArray := bothArrays(superTerm, subTerm); ok {
+			if !arraySubset(superArray, subArray) {
+				isSubset = false
+				return true // break, not a subset
+			}
+
+			return false // continue
+		}
+
+		// We have already checked for exact equality, as well as for
+		// all of the types of nested subsets we care about, so if we
+		// get here it means this isn't a subset.
+		isSubset = false
+		return true // break, not a subset
+	})
+
+	return isSubset
+}
+
+// setSubset implements the subset operation on sets.
+//
+// Unlike in the object case, this is not recursive, we just compare values
+// using ast.Set.Contains() because we have no well defined way to "match up"
+// objects that are in different sets.
+func setSubset(super ast.Set, sub ast.Set) bool {
+	isSubset := true
+	sub.Until(func(t *ast.Term) bool {
+		if !super.Contains(t) {
+			isSubset = false
+			return true
+		}
+		return false
+	})
+
+	return isSubset
+}
+
+// arraySubset implements the subset operation on arrays.
+//
+// This is defined to mean that the entire "sub" array must appear in
+// the "super" array. For the same rationale as setSubset(), we do not attempt
+// to recurse into values.
+func arraySubset(super, sub *ast.Array) bool {
+	// Notice that this is essentially string search. The naive approach
+	// used here is O(n^2). This should probably be rewritten later to use
+	// Boyer-Moore or something.
+
+	if sub.Len() > super.Len() {
+		return false
+	}
+
+	if sub.Equal(super) {
+		return true
+	}
+
+	superCursor := 0
+	subCursor := 0
+	for {
+		if subCursor == sub.Len() {
+			return true
+		}
+
+		if superCursor == super.Len() {
+			return false
+		}
+
+		subElem := sub.Elem(subCursor)
+		superElem := sub.Elem(superCursor + subCursor)
+		if superElem == nil {
+			return false
+		}
+
+		if superElem.Value.Compare(subElem.Value) == 0 {
+			subCursor++
+		} else {
+			superCursor++
+			subCursor = 0
+		}
+	}
+}
+
+// arraySetSubset implements the subset operation on array and set.
+//
+// This is defined to mean that the entire "sub" set must appear in
+// the "super" array with no consideration of ordering.
+// For the same rationale as setSubset(), we do not attempt
+// to recurse into values.
+func arraySetSubset(super *ast.Array, sub ast.Set) bool {
+	unmatched := sub.Len()
+	return super.Until(func(t *ast.Term) bool {
+		if sub.Contains(t) {
+			unmatched--
+		}
+		if unmatched == 0 {
+			return true
+		}
+		return false
+	})
+}
+
+func builtinObjectSubset(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	superTerm := operands[0]
+	subTerm := operands[1]
+
+	if ok, superObj, subObj := bothObjects(superTerm, subTerm); ok {
+		// Both operands are objects.
+		return iter(ast.BooleanTerm(objectSubset(superObj, subObj)))
+	}
+
+	if ok, superSet, subSet := bothSets(superTerm, subTerm); ok {
+		// Both operands are sets.
+		return iter(ast.BooleanTerm(setSubset(superSet, subSet)))
+	}
+
+	if ok, superArray, subArray := bothArrays(superTerm, subTerm); ok {
+		// Both operands are sets.
+		return iter(ast.BooleanTerm(arraySubset(superArray, subArray)))
+	}
+
+	if ok, superArray, subSet := arraySet(superTerm, subTerm); ok {
+		// Super operand is array and sub operand is set
+		return iter(ast.BooleanTerm(arraySetSubset(superArray, subSet)))
+	}
+
+	return builtins.ErrOperand("both arguments object.subset must be of the same type or array and set")
+}
+
+func init() {
+	RegisterBuiltinFunc(ast.ObjectSubset.Name, builtinObjectSubset)
+}
diff --git a/topdown/time.go b/topdown/time.go
index 481326dade..f881ab94b2 100644
--- a/topdown/time.go
+++ b/topdown/time.go
@@ -39,14 +39,12 @@ func builtinTimeNowNanos(bctx BuiltinContext, _ []*ast.Term, iter func(*ast.Term
 }
 
 func builtinTimeParseNanos(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-	a := operands[0].Value
-	format, err := builtins.StringOperand(a, 1)
+	format, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return err
 	}
 
-	b := operands[1].Value
-	value, err := builtins.StringOperand(b, 2)
+	value, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -60,8 +58,7 @@ func builtinTimeParseNanos(_ BuiltinContext, operands []*ast.Term, iter func(*as
 }
 
 func builtinTimeParseRFC3339Nanos(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-	a := operands[0].Value
-	value, err := builtins.StringOperand(a, 1)
+	value, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return err
 	}
@@ -73,50 +70,62 @@ func builtinTimeParseRFC3339Nanos(_ BuiltinContext, operands []*ast.Term, iter f
 
 	return toSafeUnixNano(result, iter)
 }
-func builtinParseDurationNanos(a ast.Value) (ast.Value, error) {
-
-	duration, err := builtins.StringOperand(a, 1)
+func builtinParseDurationNanos(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	duration, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	value, err := time.ParseDuration(string(duration))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return ast.Number(int64ToJSONNumber(int64(value))), nil
+	return iter(ast.NumberTerm(int64ToJSONNumber(int64(value))))
 }
 
-func builtinDate(a ast.Value) (ast.Value, error) {
-	t, err := tzTime(a)
+func builtinFormat(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	t, layout, err := tzTime(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
+	}
+	// Using RFC3339Nano time formatting as default
+	if layout == "" {
+		layout = time.RFC3339Nano
+	}
+	timestamp := t.Format(layout)
+	return iter(ast.StringTerm(timestamp))
+}
+
+func builtinDate(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	t, _, err := tzTime(operands[0].Value)
+	if err != nil {
+		return err
 	}
 	year, month, day := t.Date()
 	result := ast.NewArray(ast.IntNumberTerm(year), ast.IntNumberTerm(int(month)), ast.IntNumberTerm(day))
-	return result, nil
+	return iter(ast.NewTerm(result))
 }
 
-func builtinClock(a ast.Value) (ast.Value, error) {
-	t, err := tzTime(a)
+func builtinClock(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	t, _, err := tzTime(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	hour, minute, second := t.Clock()
 	result := ast.NewArray(ast.IntNumberTerm(hour), ast.IntNumberTerm(minute), ast.IntNumberTerm(second))
-	return result, nil
+	return iter(ast.NewTerm(result))
 }
 
-func builtinWeekday(a ast.Value) (ast.Value, error) {
-	t, err := tzTime(a)
+func builtinWeekday(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	t, _, err := tzTime(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	weekday := t.Weekday().String()
-	return ast.String(weekday), nil
+	return iter(ast.StringTerm(weekday))
 }
 
 func builtinAddDate(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-	t, err := tzTime(operands[0].Value)
+	t, _, err := tzTime(operands[0].Value)
 	if err != nil {
 		return err
 	}
@@ -142,11 +151,11 @@ func builtinAddDate(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term)
 }
 
 func builtinDiff(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
-	t1, err := tzTime(operands[0].Value)
+	t1, _, err := tzTime(operands[0].Value)
 	if err != nil {
 		return err
 	}
-	t2, err := tzTime(operands[1].Value)
+	t2, _, err := tzTime(operands[1].Value)
 	if err != nil {
 		return err
 	}
@@ -207,25 +216,25 @@ func builtinDiff(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) er
 		ast.IntNumberTerm(hour), ast.IntNumberTerm(min), ast.IntNumberTerm(sec)))
 }
 
-func tzTime(a ast.Value) (t time.Time, err error) {
+func tzTime(a ast.Value) (t time.Time, lay string, err error) {
 	var nVal ast.Value
 	loc := time.UTC
-
+	layout := ""
 	switch va := a.(type) {
 	case *ast.Array:
 		if va.Len() == 0 {
-			return time.Time{}, builtins.NewOperandTypeErr(1, a, "either number (ns) or [number (ns), string (tz)]")
+			return time.Time{}, layout, builtins.NewOperandTypeErr(1, a, "either number (ns) or [number (ns), string (tz)]")
 		}
 
 		nVal, err = builtins.NumberOperand(va.Elem(0).Value, 1)
 		if err != nil {
-			return time.Time{}, err
+			return time.Time{}, layout, err
 		}
 
 		if va.Len() > 1 {
 			tzVal, err := builtins.StringOperand(va.Elem(1).Value, 1)
 			if err != nil {
-				return time.Time{}, err
+				return time.Time{}, layout, err
 			}
 
 			tzName := string(tzVal)
@@ -247,7 +256,7 @@ func tzTime(a ast.Value) (t time.Time, err error) {
 					loc, err = time.LoadLocation(tzName)
 					if err != nil {
 						tzCacheMutex.Unlock()
-						return time.Time{}, err
+						return time.Time{}, layout, err
 					}
 					tzCache[tzName] = loc
 				}
@@ -255,27 +264,35 @@ func tzTime(a ast.Value) (t time.Time, err error) {
 			}
 		}
 
+		if va.Len() > 2 {
+			lay, err := builtins.StringOperand(va.Elem(2).Value, 1)
+			if err != nil {
+				return time.Time{}, layout, err
+			}
+			layout = string(lay)
+		}
+
 	case ast.Number:
 		nVal = a
 
 	default:
-		return time.Time{}, builtins.NewOperandTypeErr(1, a, "either number (ns) or [number (ns), string (tz)]")
+		return time.Time{}, layout, builtins.NewOperandTypeErr(1, a, "either number (ns) or [number (ns), string (tz)]")
 	}
 
 	value, err := builtins.NumberOperand(nVal, 1)
 	if err != nil {
-		return time.Time{}, err
+		return time.Time{}, layout, err
 	}
 
 	f := builtins.NumberToFloat(value)
 	i64, acc := f.Int64()
 	if acc != big.Exact {
-		return time.Time{}, fmt.Errorf("timestamp too big")
+		return time.Time{}, layout, fmt.Errorf("timestamp too big")
 	}
 
 	t = time.Unix(0, i64).In(loc)
 
-	return t, nil
+	return t, layout, nil
 }
 
 func int64ToJSONNumber(i int64) json.Number {
@@ -286,10 +303,11 @@ func init() {
 	RegisterBuiltinFunc(ast.NowNanos.Name, builtinTimeNowNanos)
 	RegisterBuiltinFunc(ast.ParseRFC3339Nanos.Name, builtinTimeParseRFC3339Nanos)
 	RegisterBuiltinFunc(ast.ParseNanos.Name, builtinTimeParseNanos)
-	RegisterFunctionalBuiltin1(ast.ParseDurationNanos.Name, builtinParseDurationNanos)
-	RegisterFunctionalBuiltin1(ast.Date.Name, builtinDate)
-	RegisterFunctionalBuiltin1(ast.Clock.Name, builtinClock)
-	RegisterFunctionalBuiltin1(ast.Weekday.Name, builtinWeekday)
+	RegisterBuiltinFunc(ast.ParseDurationNanos.Name, builtinParseDurationNanos)
+	RegisterBuiltinFunc(ast.Format.Name, builtinFormat)
+	RegisterBuiltinFunc(ast.Date.Name, builtinDate)
+	RegisterBuiltinFunc(ast.Clock.Name, builtinClock)
+	RegisterBuiltinFunc(ast.Weekday.Name, builtinWeekday)
 	RegisterBuiltinFunc(ast.AddDate.Name, builtinAddDate)
 	RegisterBuiltinFunc(ast.Diff.Name, builtinDiff)
 	tzCacheMutex = &sync.Mutex{}
diff --git a/topdown/tokens.go b/topdown/tokens.go
index 64828831fd..0134e82075 100644
--- a/topdown/tokens.go
+++ b/topdown/tokens.go
@@ -15,14 +15,14 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"hash"
 	"math/big"
 	"strings"
 
-	"github.com/pkg/errors"
-
 	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/internal/jwx/jwa"
 	"github.com/open-policy-agent/opa/internal/jwx/jwk"
 	"github.com/open-policy-agent/opa/internal/jwx/jws"
 	"github.com/open-policy-agent/opa/topdown/builtins"
@@ -42,7 +42,8 @@ const (
 )
 
 // JSONWebToken represent the 3 parts (header, payload & signature) of
-//              a JWT in Base64.
+//
+//	a JWT in Base64.
 type JSONWebToken struct {
 	header        string
 	payload       string
@@ -52,11 +53,11 @@ type JSONWebToken struct {
 
 // decodeHeader populates the decodedHeader field.
 func (token *JSONWebToken) decodeHeader() error {
-	h, err := builtinBase64UrlDecode(ast.String(token.header))
+	result, err := getResult(builtinBase64UrlDecode, ast.StringTerm(token.header))
 	if err != nil {
 		return fmt.Errorf("JWT header had invalid encoding: %w", err)
 	}
-	decodedHeader, err := validateJWTHeader(string(h.(ast.String)))
+	decodedHeader, err := validateJWTHeader(string(result.Value.(ast.String)))
 	if err != nil {
 		return err
 	}
@@ -69,19 +70,19 @@ func (token *JSONWebToken) decodeHeader() error {
 // It does no data validation, it merely checks that the given string
 // represents a structurally valid JWT. It supports JWTs using JWS compact
 // serialization.
-func builtinJWTDecode(a ast.Value) (ast.Value, error) {
-	token, err := decodeJWT(a)
+func builtinJWTDecode(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	token, err := decodeJWT(operands[0].Value)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	if err = token.decodeHeader(); err != nil {
-		return nil, err
+		return err
 	}
 
-	p, err := builtinBase64UrlDecode(ast.String(token.payload))
+	p, err := getResult(builtinBase64UrlDecode, ast.StringTerm(token.payload))
 	if err != nil {
-		return nil, fmt.Errorf("JWT payload had invalid encoding: %v", err)
+		return fmt.Errorf("JWT payload had invalid encoding: %v", err)
 	}
 
 	if cty := token.decodedHeader.Get(jwtCtyKey); cty != nil {
@@ -95,24 +96,28 @@ func builtinJWTDecode(a ast.Value) (ast.Value, error) {
 		// contents are quoted (behavior of https://jwt.io/). To fix
 		// this, remove leading and trailing quotes.
 		if ctyVal == headerJwt {
-			p, err = builtinTrim(p, ast.String(`"'`))
+			p, err = getResult(builtinTrim, p, ast.StringTerm(`"'`))
 			if err != nil {
 				panic("not reached")
 			}
-			return builtinJWTDecode(p)
+			result, err := getResult(builtinJWTDecode, p)
+			if err != nil {
+				return err
+			}
+			return iter(result)
 		}
 	}
 
-	payload, err := extractJSONObject(string(p.(ast.String)))
+	payload, err := extractJSONObject(string(p.Value.(ast.String)))
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	s, err := builtinBase64UrlDecode(ast.String(token.signature))
+	s, err := getResult(builtinBase64UrlDecode, ast.StringTerm(token.signature))
 	if err != nil {
-		return nil, fmt.Errorf("JWT signature had invalid encoding: %v", err)
+		return fmt.Errorf("JWT signature had invalid encoding: %v", err)
 	}
-	sign := hex.EncodeToString([]byte(s.(ast.String)))
+	sign := hex.EncodeToString([]byte(s.Value.(ast.String)))
 
 	arr := []*ast.Term{
 		ast.NewTerm(token.decodedHeader),
@@ -120,12 +125,12 @@ func builtinJWTDecode(a ast.Value) (ast.Value, error) {
 		ast.StringTerm(sign),
 	}
 
-	return ast.NewArray(arr...), nil
+	return iter(ast.ArrayTerm(arr...))
 }
 
 // Implements RS256 JWT signature verification
-func builtinJWTVerifyRS256(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerifyRSA(args[0].Value, args[1].Value, sha256.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
+func builtinJWTVerifyRS256(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerifyRSA(operands[0].Value, operands[1].Value, sha256.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
 		return rsa.VerifyPKCS1v15(
 			publicKey,
 			crypto.SHA256,
@@ -139,8 +144,8 @@ func builtinJWTVerifyRS256(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements RS384 JWT signature verification
-func builtinJWTVerifyRS384(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerifyRSA(args[0].Value, args[1].Value, sha512.New384, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
+func builtinJWTVerifyRS384(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerifyRSA(operands[0].Value, operands[1].Value, sha512.New384, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
 		return rsa.VerifyPKCS1v15(
 			publicKey,
 			crypto.SHA384,
@@ -154,8 +159,8 @@ func builtinJWTVerifyRS384(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements RS512 JWT signature verification
-func builtinJWTVerifyRS512(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerifyRSA(args[0].Value, args[1].Value, sha512.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
+func builtinJWTVerifyRS512(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerifyRSA(operands[0].Value, operands[1].Value, sha512.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
 		return rsa.VerifyPKCS1v15(
 			publicKey,
 			crypto.SHA512,
@@ -169,8 +174,8 @@ func builtinJWTVerifyRS512(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements PS256 JWT signature verification
-func builtinJWTVerifyPS256(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerifyRSA(args[0].Value, args[1].Value, sha256.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
+func builtinJWTVerifyPS256(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerifyRSA(operands[0].Value, operands[1].Value, sha256.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
 		return rsa.VerifyPSS(
 			publicKey,
 			crypto.SHA256,
@@ -185,8 +190,8 @@ func builtinJWTVerifyPS256(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements PS384 JWT signature verification
-func builtinJWTVerifyPS384(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerifyRSA(args[0].Value, args[1].Value, sha512.New384, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
+func builtinJWTVerifyPS384(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerifyRSA(operands[0].Value, operands[1].Value, sha512.New384, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
 		return rsa.VerifyPSS(
 			publicKey,
 			crypto.SHA384,
@@ -201,8 +206,8 @@ func builtinJWTVerifyPS384(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements PS512 JWT signature verification
-func builtinJWTVerifyPS512(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerifyRSA(args[0].Value, args[1].Value, sha512.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
+func builtinJWTVerifyPS512(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerifyRSA(operands[0].Value, operands[1].Value, sha512.New, func(publicKey *rsa.PublicKey, digest []byte, signature []byte) error {
 		return rsa.VerifyPSS(
 			publicKey,
 			crypto.SHA512,
@@ -228,8 +233,8 @@ func builtinJWTVerifyRSA(a ast.Value, b ast.Value, hasher func() hash.Hash, veri
 }
 
 // Implements ES256 JWT signature verification.
-func builtinJWTVerifyES256(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerify(args[0].Value, args[1].Value, sha256.New, verifyES)
+func builtinJWTVerifyES256(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerify(operands[0].Value, operands[1].Value, sha256.New, verifyES)
 	if err == nil {
 		return iter(ast.NewTerm(result))
 	}
@@ -237,8 +242,8 @@ func builtinJWTVerifyES256(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements ES384 JWT signature verification
-func builtinJWTVerifyES384(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerify(args[0].Value, args[1].Value, sha512.New384, verifyES)
+func builtinJWTVerifyES384(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerify(operands[0].Value, operands[1].Value, sha512.New384, verifyES)
 	if err == nil {
 		return iter(ast.NewTerm(result))
 	}
@@ -246,15 +251,20 @@ func builtinJWTVerifyES384(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements ES512 JWT signature verification
-func builtinJWTVerifyES512(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	result, err := builtinJWTVerify(args[0].Value, args[1].Value, sha512.New, verifyES)
+func builtinJWTVerifyES512(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	result, err := builtinJWTVerify(operands[0].Value, operands[1].Value, sha512.New, verifyES)
 	if err == nil {
 		return iter(ast.NewTerm(result))
 	}
 	return err
 }
 
-func verifyES(publicKey interface{}, digest []byte, signature []byte) error {
+func verifyES(publicKey interface{}, digest []byte, signature []byte) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("ECDSA signature verification error: %v", r)
+		}
+	}()
 	publicKeyEcdsa, ok := publicKey.(*ecdsa.PublicKey)
 	if !ok {
 		return fmt.Errorf("incorrect public key type")
@@ -269,9 +279,16 @@ func verifyES(publicKey interface{}, digest []byte, signature []byte) error {
 	return fmt.Errorf("ECDSA signature verification error")
 }
 
-// getKeyFromCertOrJWK returns the public key found in a X.509 certificate or JWK key(s).
+type verificationKey struct {
+	alg string
+	kid string
+	key interface{}
+}
+
+// getKeysFromCertOrJWK returns the public key found in a X.509 certificate or JWK key(s).
 // A valid PEM block is never valid JSON (and vice versa), hence can try parsing both.
-func getKeyFromCertOrJWK(certificate string) ([]interface{}, error) {
+// When provided a JWKS, each key additionally likely contains a key ID and the key algorithm.
+func getKeysFromCertOrJWK(certificate string) ([]verificationKey, error) {
 	if block, rest := pem.Decode([]byte(certificate)); block != nil {
 		if len(rest) > 0 {
 			return nil, fmt.Errorf("extra data after a PEM certificate block")
@@ -280,19 +297,18 @@ func getKeyFromCertOrJWK(certificate string) ([]interface{}, error) {
 		if block.Type == blockTypeCertificate {
 			cert, err := x509.ParseCertificate(block.Bytes)
 			if err != nil {
-				return nil, errors.Wrap(err, "failed to parse a PEM certificate")
+				return nil, fmt.Errorf("failed to parse a PEM certificate: %w", err)
 			}
-
-			return []interface{}{cert.PublicKey}, nil
+			return []verificationKey{{key: cert.PublicKey}}, nil
 		}
 
 		if block.Type == "PUBLIC KEY" {
 			key, err := x509.ParsePKIXPublicKey(block.Bytes)
 			if err != nil {
-				return nil, errors.Wrap(err, "failed to parse a PEM public key")
+				return nil, fmt.Errorf("failed to parse a PEM public key: %w", err)
 			}
 
-			return []interface{}{key}, nil
+			return []verificationKey{{key: key}}, nil
 		}
 
 		return nil, fmt.Errorf("failed to extract a Key from the PEM certificate")
@@ -300,21 +316,34 @@ func getKeyFromCertOrJWK(certificate string) ([]interface{}, error) {
 
 	jwks, err := jwk.ParseString(certificate)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to parse a JWK key (set)")
+		return nil, fmt.Errorf("failed to parse a JWK key (set): %w", err)
 	}
 
-	var keys []interface{}
+	keys := make([]verificationKey, 0, len(jwks.Keys))
 	for _, k := range jwks.Keys {
 		key, err := k.Materialize()
 		if err != nil {
 			return nil, err
 		}
-		keys = append(keys, key)
+		keys = append(keys, verificationKey{
+			alg: k.GetAlgorithm().String(),
+			kid: k.GetKeyID(),
+			key: key,
+		})
 	}
 
 	return keys, nil
 }
 
+func getKeyByKid(kid string, keys []verificationKey) *verificationKey {
+	for _, key := range keys {
+		if key.kid == kid {
+			return &key
+		}
+	}
+	return nil
+}
+
 // Implements JWT signature verification.
 func builtinJWTVerify(a ast.Value, b ast.Value, hasher func() hash.Hash, verify func(publicKey interface{}, digest []byte, signature []byte) error) (ast.Value, error) {
 	token, err := decodeJWT(a)
@@ -327,7 +356,7 @@ func builtinJWTVerify(a ast.Value, b ast.Value, hasher func() hash.Hash, verify
 		return nil, err
 	}
 
-	keys, err := getKeyFromCertOrJWK(string(s))
+	keys, err := getKeysFromCertOrJWK(string(s))
 	if err != nil {
 		return nil, err
 	}
@@ -337,14 +366,45 @@ func builtinJWTVerify(a ast.Value, b ast.Value, hasher func() hash.Hash, verify
 		return nil, err
 	}
 
+	err = token.decodeHeader()
+	if err != nil {
+		return nil, err
+	}
+	header, err := parseTokenHeader(token)
+	if err != nil {
+		return nil, err
+	}
+
 	// Validate the JWT signature
-	for _, key := range keys {
-		err = verify(key,
-			getInputSHA([]byte(token.header+"."+token.payload), hasher),
-			[]byte(signature))
 
-		if err == nil {
-			return ast.Boolean(true), nil
+	// First, check if there's a matching key ID (`kid`) in both token header and key(s).
+	// If a match is found, verify using only that key. Only applicable when a JWKS was provided.
+	if header.kid != "" {
+		if key := getKeyByKid(header.kid, keys); key != nil {
+			err = verify(key.key, getInputSHA([]byte(token.header+"."+token.payload), hasher), []byte(signature))
+
+			return ast.Boolean(err == nil), nil
+		}
+	}
+
+	// If no key ID matched, try to verify using any key in the set
+	// If an alg is present in both the JWT header and the key, skip verification unless they match
+	for _, key := range keys {
+		if key.alg == "" {
+			// No algorithm provided for the key - this is likely a certificate and not a JWKS, so
+			// we'll need to verify to find out
+			err = verify(key.key, getInputSHA([]byte(token.header+"."+token.payload), hasher), []byte(signature))
+			if err == nil {
+				return ast.Boolean(true), nil
+			}
+		} else {
+			if header.alg != key.alg {
+				continue
+			}
+			err = verify(key.key, getInputSHA([]byte(token.header+"."+token.payload), hasher), []byte(signature))
+			if err == nil {
+				return ast.Boolean(true), nil
+			}
 		}
 	}
 
@@ -353,15 +413,15 @@ func builtinJWTVerify(a ast.Value, b ast.Value, hasher func() hash.Hash, verify
 }
 
 // Implements HS256 (secret) JWT signature verification
-func builtinJWTVerifyHS256(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinJWTVerifyHS256(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	// Decode the JSON Web Token
-	token, err := decodeJWT(args[0].Value)
+	token, err := decodeJWT(operands[0].Value)
 	if err != nil {
 		return err
 	}
 
 	// Process Secret input
-	astSecret, err := builtins.StringOperand(args[1].Value, 2)
+	astSecret, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -382,15 +442,15 @@ func builtinJWTVerifyHS256(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements HS384 JWT signature verification
-func builtinJWTVerifyHS384(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinJWTVerifyHS384(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	// Decode the JSON Web Token
-	token, err := decodeJWT(args[0].Value)
+	token, err := decodeJWT(operands[0].Value)
 	if err != nil {
 		return err
 	}
 
 	// Process Secret input
-	astSecret, err := builtins.StringOperand(args[1].Value, 2)
+	astSecret, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -411,15 +471,15 @@ func builtinJWTVerifyHS384(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 }
 
 // Implements HS512 JWT signature verification
-func builtinJWTVerifyHS512(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinJWTVerifyHS512(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	// Decode the JSON Web Token
-	token, err := decodeJWT(args[0].Value)
+	token, err := decodeJWT(operands[0].Value)
 	if err != nil {
 		return err
 	}
 
 	// Process Secret input
-	astSecret, err := builtins.StringOperand(args[1].Value, 2)
+	astSecret, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -446,7 +506,7 @@ func builtinJWTVerifyHS512(bctx BuiltinContext, args []*ast.Term, iter func(*ast
 // tokenConstraints holds decoded JWT verification constraints.
 type tokenConstraints struct {
 	// The set of asymmetric keys we can verify with.
-	keys []interface{}
+	keys []verificationKey
 
 	// The single symmetric key we will verify with.
 	secret string
@@ -496,10 +556,11 @@ func tokenConstraintCert(value ast.Value, constraints *tokenConstraints) error {
 		return fmt.Errorf("cert constraint: must be a string")
 	}
 
-	keys, err := getKeyFromCertOrJWK(string(s))
+	keys, err := getKeysFromCertOrJWK(string(s))
 	if err != nil {
 		return err
 	}
+
 	constraints.keys = keys
 	return nil
 }
@@ -596,14 +657,36 @@ func (constraints *tokenConstraints) verify(kid, alg, header, payload, signature
 	}
 	// If we're configured with asymmetric key(s) then only trust that
 	if constraints.keys != nil {
+		if kid != "" {
+			if key := getKeyByKid(kid, constraints.keys); key != nil {
+				err := a.verify(key.key, a.hash, plaintext, []byte(signature))
+				if err != nil {
+					return errSignatureNotVerified
+				}
+				return nil
+			}
+		}
+
 		verified := false
 		for _, key := range constraints.keys {
-			err := a.verify(key, a.hash, plaintext, []byte(signature))
-			if err == nil {
-				verified = true
-				break
+			if key.alg == "" {
+				err := a.verify(key.key, a.hash, plaintext, []byte(signature))
+				if err == nil {
+					verified = true
+					break
+				}
+			} else {
+				if alg != key.alg {
+					continue
+				}
+				err := a.verify(key.key, a.hash, plaintext, []byte(signature))
+				if err == nil {
+					verified = true
+					break
+				}
 			}
 		}
+
 		if !verified {
 			return errSignatureNotVerified
 		}
@@ -671,7 +754,7 @@ func verifyHMAC(key interface{}, hash crypto.Hash, payload []byte, signature []b
 		return fmt.Errorf("incorrect symmetric key type")
 	}
 	mac := hmac.New(hash.New, macKey)
-	if _, err := mac.Write([]byte(payload)); err != nil {
+	if _, err := mac.Write(payload); err != nil {
 		return err
 	}
 	if !hmac.Equal(signature, mac.Sum([]byte{})) {
@@ -710,7 +793,12 @@ func verifyRSAPSS(key interface{}, hash crypto.Hash, digest []byte, signature []
 	return nil
 }
 
-func verifyECDSA(key interface{}, hash crypto.Hash, digest []byte, signature []byte) error {
+func verifyECDSA(key interface{}, hash crypto.Hash, digest []byte, signature []byte) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("ECDSA signature verification error: %v", r)
+		}
+	}()
 	publicKeyEcdsa, ok := key.(*ecdsa.PublicKey)
 	if !ok {
 		return fmt.Errorf("incorrect public key type")
@@ -844,6 +932,9 @@ func commonBuiltinJWTEncodeSign(bctx BuiltinContext, inputHeaders, jwsPayload, j
 		return err
 	}
 	alg := standardHeaders.GetAlgorithm()
+	if alg == jwa.Unsupported {
+		return fmt.Errorf("unknown signature algorithm")
+	}
 
 	if (standardHeaders.Type == "" || standardHeaders.Type == headerJwt) && !json.Valid([]byte(jwsPayload)) {
 		return fmt.Errorf("type is JWT but payload is not JSON")
@@ -859,26 +950,26 @@ func commonBuiltinJWTEncodeSign(bctx BuiltinContext, inputHeaders, jwsPayload, j
 
 }
 
-func builtinJWTEncodeSign(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinJWTEncodeSign(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	inputHeaders := args[0].String()
-	jwsPayload := args[1].String()
-	jwkSrc := args[2].String()
+	inputHeaders := operands[0].String()
+	jwsPayload := operands[1].String()
+	jwkSrc := operands[2].String()
 	return commonBuiltinJWTEncodeSign(bctx, inputHeaders, jwsPayload, jwkSrc, iter)
 
 }
 
-func builtinJWTEncodeSignRaw(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinJWTEncodeSignRaw(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	jwkSrc, err := builtins.StringOperand(args[2].Value, 3)
+	jwkSrc, err := builtins.StringOperand(operands[2].Value, 3)
 	if err != nil {
 		return err
 	}
-	inputHeaders, err := builtins.StringOperand(args[0].Value, 1)
+	inputHeaders, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return err
 	}
-	jwsPayload, err := builtins.StringOperand(args[1].Value, 2)
+	jwsPayload, err := builtins.StringOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -886,7 +977,7 @@ func builtinJWTEncodeSignRaw(bctx BuiltinContext, args []*ast.Term, iter func(*a
 }
 
 // Implements full JWT decoding, validation and verification.
-func builtinJWTDecodeVerify(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinJWTDecodeVerify(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 	// io.jwt.decode_verify(string, constraints, [valid, header, payload])
 	//
 	// If valid is true then the signature verifies and all constraints are met.
@@ -894,9 +985,9 @@ func builtinJWTDecodeVerify(bctx BuiltinContext, args []*ast.Term, iter func(*as
 	// was not met.
 	//
 	// Decoding errors etc are returned as errors.
-	a := args[0].Value
+	a := operands[0].Value
 
-	b, err := builtins.ObjectOperand(args[1].Value, 2)
+	b, err := builtins.ObjectOperand(operands[1].Value, 2)
 	if err != nil {
 		return err
 	}
@@ -914,7 +1005,7 @@ func builtinJWTDecodeVerify(bctx BuiltinContext, args []*ast.Term, iter func(*as
 		return err
 	}
 	var token *JSONWebToken
-	var p ast.Value
+	var p *ast.Term
 	for {
 		// RFC7519 7.2 #1-2 split into parts
 		if token, err = decodeJWT(a); err != nil {
@@ -948,21 +1039,21 @@ func builtinJWTDecodeVerify(bctx BuiltinContext, args []*ast.Term, iter func(*as
 			return err
 		}
 		// RFC7159 7.2 #9-10 decode the payload
-		p, err = builtinBase64UrlDecode(ast.String(token.payload))
+		p, err = getResult(builtinBase64UrlDecode, ast.StringTerm(token.payload))
 		if err != nil {
 			return fmt.Errorf("JWT payload had invalid encoding: %v", err)
 		}
 		// RFC7159 7.2 #8 and 5.2 cty
 		if strings.ToUpper(header.cty) == headerJwt {
 			// Nested JWT, go round again with payload as first argument
-			a = p
+			a = p.Value
 			continue
 		} else {
 			// Non-nested JWT (or we've reached the bottom of the nesting).
 			break
 		}
 	}
-	payload, err := extractJSONObject(string(p.(ast.String)))
+	payload, err := extractJSONObject(string(p.Value.(ast.String)))
 	if err != nil {
 		return err
 	}
@@ -988,18 +1079,28 @@ func builtinJWTDecodeVerify(bctx BuiltinContext, args []*ast.Term, iter func(*as
 	}
 	// RFC7159 4.1.4 exp
 	if exp := payload.Get(jwtExpKey); exp != nil {
-		// constraints.time is in nanoseconds but exp Value is in seconds
-		compareTime := ast.FloatNumberTerm(float64(constraints.time) / 1000000000)
-		if ast.Compare(compareTime, exp.Value.(ast.Number)) != -1 {
-			return iter(unverified)
+		switch exp.Value.(type) {
+		case ast.Number:
+			// constraints.time is in nanoseconds but exp Value is in seconds
+			compareTime := ast.FloatNumberTerm(constraints.time / 1000000000)
+			if ast.Compare(compareTime, exp.Value.(ast.Number)) != -1 {
+				return iter(unverified)
+			}
+		default:
+			return fmt.Errorf("exp value must be a number")
 		}
 	}
 	// RFC7159 4.1.5 nbf
 	if nbf := payload.Get(jwtNbfKey); nbf != nil {
-		// constraints.time is in nanoseconds but nbf Value is in seconds
-		compareTime := ast.FloatNumberTerm(float64(constraints.time) / 1000000000)
-		if ast.Compare(compareTime, nbf.Value.(ast.Number)) == -1 {
-			return iter(unverified)
+		switch nbf.Value.(type) {
+		case ast.Number:
+			// constraints.time is in nanoseconds but nbf Value is in seconds
+			compareTime := ast.FloatNumberTerm(constraints.time / 1000000000)
+			if ast.Compare(compareTime, nbf.Value.(ast.Number)) == -1 {
+				return iter(unverified)
+			}
+		default:
+			return fmt.Errorf("nbf value must be a number")
 		}
 	}
 
@@ -1034,12 +1135,12 @@ func decodeJWT(a ast.Value) (*JSONWebToken, error) {
 }
 
 func (token *JSONWebToken) decodeSignature() (string, error) {
-	decodedSignature, err := builtinBase64UrlDecode(ast.String(token.signature))
+	decodedSignature, err := getResult(builtinBase64UrlDecode, ast.StringTerm(token.signature))
 	if err != nil {
 		return "", err
 	}
 
-	signatureAst, err := builtins.StringOperand(decodedSignature, 1)
+	signatureAst, err := builtins.StringOperand(decodedSignature.Value, 1)
 	if err != nil {
 		return "", err
 	}
@@ -1073,12 +1174,12 @@ func extractJSONObject(s string) (ast.Object, error) {
 	// to parsing it ourselves, we're relying on the Go implementation
 	// using the last occurring instance of the key, which is the behavior
 	// as of Go 1.8.1.
-	v, err := builtinJSONUnmarshal(ast.String(s))
+	v, err := getResult(builtinJSONUnmarshal, ast.StringTerm(s))
 	if err != nil {
 		return nil, fmt.Errorf("invalid JSON: %v", err)
 	}
 
-	o, ok := v.(ast.Object)
+	o, ok := v.Value.(ast.Object)
 	if !ok {
 		return nil, errors.New("decoded JSON type was not an Object")
 	}
@@ -1094,7 +1195,7 @@ func getInputSHA(input []byte, h func() hash.Hash) []byte {
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.JWTDecode.Name, builtinJWTDecode)
+	RegisterBuiltinFunc(ast.JWTDecode.Name, builtinJWTDecode)
 	RegisterBuiltinFunc(ast.JWTVerifyRS256.Name, builtinJWTVerifyRS256)
 	RegisterBuiltinFunc(ast.JWTVerifyRS384.Name, builtinJWTVerifyRS384)
 	RegisterBuiltinFunc(ast.JWTVerifyRS512.Name, builtinJWTVerifyRS512)
diff --git a/topdown/tokens_test.go b/topdown/tokens_test.go
index 48c2d08e8f..5f8031b43c 100644
--- a/topdown/tokens_test.go
+++ b/topdown/tokens_test.go
@@ -5,10 +5,12 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rsa"
+	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"os"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
@@ -17,7 +19,7 @@ import (
 	"github.com/open-policy-agent/opa/internal/jwx/jwk"
 	"github.com/open-policy-agent/opa/internal/jwx/jws"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 )
 
 func TestParseTokenConstraints(t *testing.T) {
@@ -62,7 +64,7 @@ OHoCIHmNX37JOqTcTzGn2u9+c8NlnvZ0uDvsd1BmKPaUmjmm
 		if err != nil {
 			t.Fatalf("parseTokenConstraints: %v", err)
 		}
-		pubKey := constraints.keys[0].(*ecdsa.PublicKey)
+		pubKey := constraints.keys[0].key.(*ecdsa.PublicKey)
 		if pubKey.Curve != elliptic.P256() {
 			t.Errorf("curve: %v", pubKey.Curve)
 		}
@@ -101,12 +103,12 @@ OHoCIHmNX37JOqTcTzGn2u9+c8NlnvZ0uDvsd1BmKPaUmjmm
 		if err != nil {
 			t.Fatalf("parseTokenConstraints: %v", err)
 		}
-		elPubKey := constraints.keys[0].(*ecdsa.PublicKey)
+		elPubKey := constraints.keys[0].key.(*ecdsa.PublicKey)
 		if elPubKey.Curve != elliptic.P256() {
 			t.Errorf("curve: %v", elPubKey.Curve)
 		}
 
-		rsaPubKey := constraints.keys[1].(*rsa.PublicKey)
+		rsaPubKey := constraints.keys[1].key.(*rsa.PublicKey)
 		if rsaPubKey.Size() != 256 {
 			t.Errorf("expected size 256 found %d", rsaPubKey.Size())
 		}
@@ -469,7 +471,10 @@ func TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature(t *testing.T) {
 	   "y":"x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0",
 	   "d":"jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI"
 	  }, x)`
-	encodedSigned := "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.-LoHxtbT8t_TnqlLyONI4BtjvfkySO8TcoCFENqTTH2AKxvn29nAjxOdlbY-0EKVM2nJ4ukCx4IGtZtuwXr0VQ"
+	encodedSigned := "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.05wmHY3NomU1jr7yvusBvKwhthRklPuJhUPOkoeIn5e5n_GXvE25EfRs9AJK2wOy6NoY2ljhj07M9BMtV0dfyA"
+	if strings.HasPrefix(runtime.Version(), "go1.20") {
+		encodedSigned = "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.GRp6wIqDZuYnvQH50hnIy559LdrjUux76v1ynxX6lH0XtlgwreyR16x2JMnuElo79X3zUbqlWrZITICv86arew"
+	}
 
 	for i := 0; i < 10; i++ {
 		q := NewQuery(ast.MustParseBody(query)).
@@ -487,8 +492,211 @@ func TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature(t *testing.T) {
 		if exp, act := 1, len(qrs); exp != act {
 			t.Fatalf("expected %d results, got %d", exp, act)
 		}
+
 		if exp, act := ast.String(encodedSigned), qrs[0][ast.Var("x")].Value; !exp.Equal(act) {
 			t.Fatalf("unexpected result: want %v, got %v", exp, act)
 		}
 	}
 }
+
+func TestTopdownJWTUnknownAlgTypesDiscardedFromJWKS(t *testing.T) {
+	cert := `{
+    "keys": [
+	    {
+          "kty": "RSA",
+          "e": "AQAB",
+          "use": "enc",
+          "kid": "k3",
+          "alg": "RS256",
+          "n": "sGu-fYVE2nq2dPxJlqAMI0Z8G3FD0XcWDnD8mkfO1ddKRGuUQZmfj4gWeZGyIk3cnuoy7KJCEqa3daXc08QHuFZyfn0rH33t8_AFsvb0q0i7R2FK-Gdqs_E0-sGpYMsRJdZWfCioLkYjIHEuVnRbi3DEsWqe484rEGbKF60jNRgGC4b-8pz-E538ZkssWxcqHrYIj5bjGEU36onjS3M_yrTuNvzv_8wRioK4fbcwmGne9bDxu8LcoSReWpPn0CnUkWnfqroRcMJnC87ZuJagDW1ZWCmU3psdsVanmFFh0DP6z0fsA4h8G2n9-qp-LEKFaWwo3IWlOsIzU3MHdcEiGw"
+        },
+	    {
+		  "kid": "encryption algorithm",
+		  "kty": "RSA",
+		  "alg": "RSA-OAEP",
+		  "use": "enc",
+		  "n": "onlqv4UZx5ZabJ3TCq-IO0s0xaOwo6fWl9o4SzLXPbGtvxonQhoYOeMlS0XkdEdLzB-eqh_hkQ",
+		  "e": "AQAB",
+		  "x5c": [
+			"MIICnTCCAYUCBgGAmcG0xjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQ2YVaQn47Eew=="
+		  ],
+		  "x5t": "WKfdwdQkg",
+		  "x5t#S256": "2_FidAwjlCQl20"
+		}
+	]
+}
+`
+	keys, err := getKeysFromCertOrJWK(cert)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(keys) != 1 {
+		t.Errorf("expected only one key as inavlid one should have been discarded")
+	}
+
+	if keys[0].alg != "RS256" {
+		t.Errorf("expected key with RS256 alg")
+	}
+}
+
+func TestTopdownJWTVerifyOnlyVerifiesUsingApplicableKeys(t *testing.T) {
+	cert := ast.MustInterfaceToValue(`{
+    "keys": [
+        {
+          "kty": "EC",
+          "use": "sig",
+          "crv": "P-256",
+          "kid": "k1",
+          "x": "9Qq5S5VqMQoH-FOI4atcH6V3bua03C-5ZMZMG1rszwA",
+          "y": "LLbFxWkGBEBrTm1GMYZJy1OXCH1KLweJMCgIEPIsibU",
+          "alg": "ES256"
+        },
+        {
+          "kty": "RSA",
+          "e": "AQAB",
+          "use": "enc",
+          "kid": "k2",
+          "alg": "RS256",
+          "n": "sGu-fYVE2nq2dPxJlqAMI0Z8G3FD0XcWDnD8mkfO1ddKRGuUQZmfj4gWeZGyIk3cnuoy7KJCEqa3daXc08QHuFZyfn0rH33t8_AFsvb0q0i7R2FK-Gdqs_E0-sGpYMsRJdZWfCioLkYjIHEuVnRbi3DEsWqe484rEGbKF60jNRgGC4b-8pz-E538ZkssWxcqHrYIj5bjGEU36onjS3M_yrTuNvzv_8wRioK4fbcwmGne9bDxu8LcoSReWpPn0CnUkWnfqroRcMJnC87ZuJagDW1ZWCmU3psdsVanmFFh0DP6z0fsA4h8G2n9-qp-LEKFaWwo3IWlOsIzU3MHdcEiGw"
+        },
+	    {
+          "kty": "RSA",
+          "e": "AQAB",
+          "use": "enc",
+          "kid": "k3",
+          "alg": "RS256",
+          "n": "sGu-fYVE2nq2dPxJlqAMI0Z8G3FD0XcWDnD8mkfO1ddKRGuUQZmfj4gWeZGyIk3cnuoy7KJCEqa3daXc08QHuFZyfn0rH33t8_AFsvb0q0i7R2FK-Gdqs_E0-sGpYMsRJdZWfCioLkYjIHEuVnRbi3DEsWqe484rEGbKF60jNRgGC4b-8pz-E538ZkssWxcqHrYIj5bjGEU36onjS3M_yrTuNvzv_8wRioK4fbcwmGne9bDxu8LcoSReWpPn0CnUkWnfqroRcMJnC87ZuJagDW1ZWCmU3psdsVanmFFh0DP6z0fsA4h8G2n9-qp-LEKFaWwo3IWlOsIzU3MHdcEiGw"
+        },
+	    {
+		  "kid": "unknown algorithm",
+		  "kty": "RSA",
+		  "alg": "RSA-OAEP",
+		  "use": "enc",
+		  "n": "onlqv4UZx5ZabJ3TCq-IO0s0xaOwo6fWl9o4SzLXPbGtvxonQhoYOeMlS0XkdEdLzB-eqh_hkQ",
+		  "e": "AQAB",
+		  "x5c": [
+			"MIICnTCCAYUCBgGAmcG0xjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQ2YVaQn47Eew=="
+		  ],
+		  "x5t": "WKfdwdQkg",
+		  "x5t#S256": "2_FidAw.....jlCQl20"
+		}
+	]
+}
+`)
+
+	cases := []struct {
+		note              string
+		header            string
+		expectVerifyCalls int
+	}{
+		{
+			note:              "verification considers only key with matching kid, if present",
+			header:            `{"alg":"RS256", "kid": "k2"}`,
+			expectVerifyCalls: 1,
+		},
+		{
+			note:              "verification considers any key with matching alg, if no kid matches",
+			header:            `{"alg":"RS256", "kid": "not-in-jwks"}`,
+			expectVerifyCalls: 2,
+		},
+		{
+			note:              "verification without kid considers only keys with alg matched from header",
+			header:            `{"alg":"RS256"}`,
+			expectVerifyCalls: 2,
+		},
+		{
+			note:              "verification is is skipped if alg unknown",
+			header:            `{"alg":"xyz"}`,
+			expectVerifyCalls: 0,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.note, func(t *testing.T) {
+			header := base64.RawURLEncoding.EncodeToString([]byte(tc.header))
+			payload := base64.RawURLEncoding.EncodeToString([]byte("{}"))
+			signature := base64.RawURLEncoding.EncodeToString([]byte("ignored"))
+
+			token := ast.MustInterfaceToValue(fmt.Sprintf("%s.%s.%s", header, payload, signature))
+
+			verifyCalls := 0
+			verifier := func(publicKey interface{}, digest []byte, signature []byte) error {
+				verifyCalls++
+				return fmt.Errorf("fail")
+			}
+
+			_, err := builtinJWTVerify(token, cert, sha256.New, verifier)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if verifyCalls != tc.expectVerifyCalls {
+				t.Errorf("expected %d calls to verify token, got %d", tc.expectVerifyCalls, verifyCalls)
+			}
+		})
+	}
+}
+
+func TestTopdownJWTDecodeVerifyIgnoresKeysOfUnknownAlgInJWKS(t *testing.T) {
+	c := ast.NewObject()
+	c.Insert(ast.StringTerm("cert"), ast.StringTerm(`{
+    "keys": [
+        {
+          "kty": "EC",
+          "use": "sig",
+          "crv": "P-256",
+          "kid": "k1",
+          "x": "9Qq5S5VqMQoH-FOI4atcH6V3bua03C-5ZMZMG1rszwA",
+          "y": "LLbFxWkGBEBrTm1GMYZJy1OXCH1KLweJMCgIEPIsibU",
+          "alg": "ES256"
+        },
+        {
+          "kty": "RSA",
+          "e": "AQAB",
+          "use": "enc",
+          "kid": "k2",
+          "alg": "RS256",
+          "n": "sGu-fYVE2nq2dPxJlqAMI0Z8G3FD0XcWDnD8mkfO1ddKRGuUQZmfj4gWeZGyIk3cnuoy7KJCEqa3daXc08QHuFZyfn0rH33t8_AFsvb0q0i7R2FK-Gdqs_E0-sGpYMsRJdZWfCioLkYjIHEuVnRbi3DEsWqe484rEGbKF60jNRgGC4b-8pz-E538ZkssWxcqHrYIj5bjGEU36onjS3M_yrTuNvzv_8wRioK4fbcwmGne9bDxu8LcoSReWpPn0CnUkWnfqroRcMJnC87ZuJagDW1ZWCmU3psdsVanmFFh0DP6z0fsA4h8G2n9-qp-LEKFaWwo3IWlOsIzU3MHdcEiGw"
+        },
+	    {
+          "kty": "RSA",
+          "e": "AQAB",
+          "use": "enc",
+          "kid": "k3",
+          "alg": "RS256",
+          "n": "sGu-fYVE2nq2dPxJlqAMI0Z8G3FD0XcWDnD8mkfO1ddKRGuUQZmfj4gWeZGyIk3cnuoy7KJCEqa3daXc08QHuFZyfn0rH33t8_AFsvb0q0i7R2FK-Gdqs_E0-sGpYMsRJdZWfCioLkYjIHEuVnRbi3DEsWqe484rEGbKF60jNRgGC4b-8pz-E538ZkssWxcqHrYIj5bjGEU36onjS3M_yrTuNvzv_8wRioK4fbcwmGne9bDxu8LcoSReWpPn0CnUkWnfqroRcMJnC87ZuJagDW1ZWCmU3psdsVanmFFh0DP6z0fsA4h8G2n9-qp-LEKFaWwo3IWlOsIzU3MHdcEiGw"
+        },
+	    {
+		  "kid": "unknown algorithm",
+		  "kty": "RSA",
+		  "alg": "RSA-OAEP",
+		  "use": "enc",
+		  "n": "onlqv4UZx5ZabJ3TCq-IO0s0xaOwo6fWl9o4SzLXPbGtvxonQhoYOeMlS0XkdEdLzB-eqh_hkQ",
+		  "e": "AQAB",
+		  "x5c": [
+			"MIICnTCCAYUCBgGAmcG0xjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQ2YVaQn47Eew=="
+		  ],
+		  "x5t": "WKfdwdQkg",
+		  "x5t#S256": "2_FidAw.....jlCQl20"
+		}
+	]
+}
+`))
+
+	wallclock := ast.NumberTerm(int64ToJSONNumber(time.Now().UnixNano()))
+	constraints, err := parseTokenConstraints(c, wallclock)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(constraints.keys) != 3 {
+		t.Errorf("expected 3 keys in JWKS, got %d", len(constraints.keys))
+	}
+
+	for _, key := range constraints.keys {
+		if key.alg == "RSA-OAEP" {
+			t.Errorf("expected alg: RSA-OAEP to be removed from key set")
+		}
+	}
+}
diff --git a/topdown/topdown_bench_test.go b/topdown/topdown_bench_test.go
index d18e465a8d..cb36961d29 100644
--- a/topdown/topdown_bench_test.go
+++ b/topdown/topdown_bench_test.go
@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"math/rand"
 	"strings"
 	"sync"
 	"testing"
@@ -16,7 +17,7 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/metrics"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util/test"
 )
 
@@ -29,6 +30,54 @@ func BenchmarkArrayIteration(b *testing.B) {
 	}
 }
 
+func BenchmarkArrayPlugging(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000, 10000}
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			data := make([]interface{}, n)
+			for i := 0; i < n; i++ {
+				data[i] = fmt.Sprintf("whatever%d", i)
+			}
+			store := inmem.NewFromObject(map[string]interface{}{"fixture": data})
+			module := `package test
+			fixture := data.fixture
+			main { x := fixture }`
+
+			query := ast.MustParseBody("data.test.main")
+			compiler := ast.MustCompileModules(map[string]string{
+				"test.rego": module,
+			})
+
+			b.ResetTimer()
+
+			for i := 0; i < b.N; i++ {
+
+				err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+					q := NewQuery(query).
+						WithCompiler(compiler).
+						WithStore(store).
+						WithTransaction(txn)
+
+					_, err := q.Run(ctx)
+					if err != nil {
+						return err
+					}
+
+					return nil
+				})
+
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
 func BenchmarkSetIteration(b *testing.B) {
 	sizes := []int{10, 100, 1000, 10000}
 	for _, n := range sizes {
@@ -681,3 +730,265 @@ func genComprehensionIndexingData(n int) map[string]interface{} {
 	}
 	return map[string]interface{}{"items": items}
 }
+
+func BenchmarkObjectSubset(b *testing.B) {
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000, 10000}
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			all := make(map[string]string)
+			evens := make(map[string]string)
+
+			for i := 0; i < n; i++ {
+				all[fmt.Sprint(i)] = fmt.Sprint(i * 2)
+				if i%2 == 0 {
+					evens[fmt.Sprint(i)] = fmt.Sprint(i * 2)
+				}
+			}
+
+			store := inmem.NewFromObject(map[string]interface{}{"all": all, "evens": evens})
+
+			module := `package test
+			main {object.subset(data.all, data.evens)}`
+
+			query := ast.MustParseBody("data.test.main")
+			compiler := ast.MustCompileModules(map[string]string{
+				"test.rego": module,
+			})
+
+			b.ResetTimer()
+
+			for i := 0; i < b.N; i++ {
+
+				err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+					q := NewQuery(query).
+						WithCompiler(compiler).
+						WithStore(store).
+						WithTransaction(txn)
+
+					_, err := q.Run(ctx)
+					if err != nil {
+						return err
+					}
+
+					return nil
+				})
+
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+func BenchmarkObjectSubsetSlow(b *testing.B) {
+	// This benchmarks the suggested means to implement object.subset
+	// without using the builtin, to give us an idea of whether or not
+	// the builtin is actually making things any faster.
+	ctx := context.Background()
+
+	sizes := []int{10, 100, 1000, 10000}
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			all := make(map[string]string)
+			evens := make(map[string]string)
+
+			for i := 0; i < n; i++ {
+				all[fmt.Sprint(i)] = fmt.Sprint(i * 2)
+				if i%2 == 0 {
+					evens[fmt.Sprint(i)] = fmt.Sprint(i * 2)
+				}
+			}
+
+			store := inmem.NewFromObject(map[string]interface{}{"all": all, "evens": evens})
+
+			// Code is lifted from here:
+			// https://github.com/open-policy-agent/opa/issues/4358#issue-1141145857
+
+			module := `package test
+			path_matches[match] {
+			    [path, value] := walk(data.evens)
+			    not is_object(value)
+
+			    match := object.get(data.all, path, null) == value
+			}
+
+			main { path_matches == {true} }`
+
+			query := ast.MustParseBody("data.test.main")
+			compiler := ast.MustCompileModules(map[string]string{
+				"test.rego": module,
+			})
+
+			b.ResetTimer()
+
+			for i := 0; i < b.N; i++ {
+
+				err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+					q := NewQuery(query).
+						WithCompiler(compiler).
+						WithStore(store).
+						WithTransaction(txn)
+
+					_, err := q.Run(ctx)
+					if err != nil {
+						return err
+					}
+
+					return nil
+				})
+
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+// randomString constructs and returns a string of the specified length
+// containing a random assortment of characters from the given symbols list.
+func randomString(symbols []rune, length int) string {
+	builder := strings.Builder{}
+	for i := 0; i < length; i++ {
+		builder.WriteRune(symbols[rand.Intn(len(symbols))])
+	}
+	return builder.String()
+}
+
+func BenchmarkGlob(b *testing.B) {
+	ctx := context.Background()
+
+	// Benchmark Strategy:
+	//
+	// We want to test both matching and non-matching, in case one is
+	// slower than the other. We also want to test a variety of different
+	// patterns, since (at time of writing), there is a pattern cache, so
+	// we want to exercise it but not rely on it excessively.
+	//
+	// For each individual test case, we generate size/2 random strings
+	// from the letters a,b,c,d as well as size/2 with those letters plus
+	// x. We test matching with the following globs:
+	//
+	// * "*x*"  (should always have matches)
+	// * "*y*"  (should never have matches)
+	// * the first half of a randomly chosen test case, followed by *
+
+	sizes := []int{10, 100, 1000}
+	length := 32
+
+	for _, n := range sizes {
+		b.Run(fmt.Sprint(n), func(b *testing.B) {
+			haystack := make([]string, n)
+			for i := 0; i < n; i++ {
+				if i%2 == 0 {
+					haystack[i] = randomString([]rune{'a', 'b', 'c', 'd'}, length)
+				} else {
+					haystack[i] = randomString([]rune{'a', 'b', 'c', 'd', 'x'}, length)
+				}
+			}
+
+			needleIndex := rand.Intn(len(haystack))
+			needle := haystack[needleIndex]
+			needleGlob := needle[0:length/2] + "*"
+
+			store := inmem.NewFromObject(map[string]interface{}{
+				"haystack":   haystack,
+				"needleGlob": needleGlob,
+			})
+
+			module := `package test
+			main {
+				needleMatches := {h | h := data.haystack[_]; glob.match(data.needleGlob, [], h)}
+				xMatches := {h | h := data.haystack[_]; glob.match("*x*", [], h)}
+				yMtches := {h | h := data.haystack[_]; glob.match("*y*", [], h)}
+			}`
+
+			query := ast.MustParseBody("data.test.main")
+			compiler := ast.MustCompileModules(map[string]string{
+				"test.rego": module,
+			})
+
+			b.ResetTimer()
+
+			for i := 0; i < b.N; i++ {
+
+				err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+
+					q := NewQuery(query).
+						WithCompiler(compiler).
+						WithStore(store).
+						WithTransaction(txn)
+
+					_, err := q.Run(ctx)
+					if err != nil {
+						return err
+					}
+
+					return nil
+				})
+
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
+func BenchmarkMemberWithKeyFromBaseDoc(b *testing.B) {
+	store := inmem.NewFromObject(test.GenerateLargeJSONBenchmarkData())
+	mod := `package test
+	import future.keywords.in
+	main { "key99", "value99" in data.values }
+	`
+
+	ctx := context.Background()
+	query := ast.MustParseBody("data.test.main")
+	compiler := ast.MustCompileModules(map[string]string{
+		"test.rego": mod,
+	})
+
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+			_, err := NewQuery(query).WithCompiler(compiler).WithStore(store).WithTransaction(txn).Run(ctx)
+			return err
+		})
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkObjectGetFromBaseDoc(b *testing.B) {
+	store := inmem.NewFromObject(test.GenerateLargeJSONBenchmarkData())
+	mod := `package test
+	main { object.get(data.values, "key99", false) == "value99" }
+	`
+
+	ctx := context.Background()
+	query := ast.MustParseBody("data.test.main")
+	compiler := ast.MustCompileModules(map[string]string{
+		"test.rego": mod,
+	})
+
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		err := storage.Txn(ctx, store, storage.TransactionParams{}, func(txn storage.Transaction) error {
+			_, err := NewQuery(query).WithCompiler(compiler).WithStore(store).WithTransaction(txn).Run(ctx)
+			return err
+		})
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/topdown/topdown_partial_bench_test.go b/topdown/topdown_partial_bench_test.go
index f845e6db39..71fa974790 100644
--- a/topdown/topdown_partial_bench_test.go
+++ b/topdown/topdown_partial_bench_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 )
 
 func BenchmarkInliningFullScan(b *testing.B) {
diff --git a/topdown/topdown_partial_test.go b/topdown/topdown_partial_test.go
index 735ec6090f..99c6d62a4f 100644
--- a/topdown/topdown_partial_test.go
+++ b/topdown/topdown_partial_test.go
@@ -13,7 +13,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
 )
 
@@ -27,11 +27,13 @@ func TestTopDownPartialEval(t *testing.T) {
 		skipPartialNamespace bool
 		query                string
 		modules              []string
+		moduleASTs           []*ast.Module
 		data                 string
 		input                string
 		wantQueries          []string
 		wantQueryASTs        []ast.Body
 		wantSupport          []string
+		wantSupportASTs      []*ast.Module
 		ignoreOrder          bool
 	}{
 		{
@@ -757,6 +759,348 @@ func TestTopDownPartialEval(t *testing.T) {
 			},
 			wantQueries: []string{`{} = a`},
 		},
+		{
+			note:  "with+builtin: no unknowns",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+
+				mock_concat(_, _) = "foo/bar"
+				p { q with concat as mock_concat }
+				q { concat("/", ["a", "b"], "foo/bar") }`,
+			},
+			wantQueries: []string{`a = true`},
+		},
+		{
+			note:  "with+builtin: value replacement",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+
+				p { q with concat as "foo/bar" }
+				q { concat("/", ["a", "b"], "foo/bar") }`,
+			},
+			wantQueries: []string{`a = true`},
+		},
+		{
+			note:  "with+function: no unknowns",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+				f(_, _) = "x"
+				mock_f(_, _) = "foo/bar"
+				p { q with f as mock_f }
+				q { f("/", ["a", "b"], "foo/bar") }`,
+			},
+			wantQueries: []string{`a = true`},
+		},
+		{
+			note:  "with+function: value replacement",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+				f(_, _) = "x"
+				p { q with f as "foo/bar" }
+				q { f("/", ["a", "b"], "foo/bar") }`,
+			},
+			wantQueries: []string{`a = true`},
+		},
+		{
+			note:  "with+builtin: unknowns in replacement function",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+
+				mock_concat(x, _) = concat(x, input)
+				p { q with concat as mock_concat}
+				q { concat("/", ["a", "b"], "foo/bar") }`,
+			},
+			wantQueries: []string{`data.partial.test.mock_concat("/", ["a", "b"], "foo/bar"); a = true`},
+			wantSupport: []string{
+				`package partial.test
+
+				mock_concat(__local0__3, __local1__3) = __local2__3 {
+					__local3__3 = input
+					concat(__local0__3, __local3__3, __local2__3)
+				}`,
+			},
+		},
+		{
+			note:  "with+function: unknowns in replacement function",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+				f(_) = "x/y"
+				mock_f(_) = "foo/bar" { input.y }
+				p { q with f as mock_f}
+				q { f("/", "foo/bar") }`,
+			},
+			wantQueries: []string{`data.partial.test.mock_f("/", "foo/bar"); a = true`},
+			wantSupport: []string{
+				`package partial.test
+
+				mock_f(__local1__3) = "foo/bar" {
+					input.y = x_term_3_03
+					x_term_3_03
+				}`,
+			},
+		},
+		{
+			note:  "with+builtin: unknowns in replaced function's args",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+
+				mock_concat(_, _) = ["foo", "bar"]
+				p {
+					q with array.concat as mock_concat
+				}
+				q {
+					array.concat(["foo"], input, ["foo", "bar"])
+				}`,
+			},
+			wantQueries: []string{`
+				data.partial.test.q
+				a = true
+			`},
+			wantSupport: []string{`package partial.test
+
+				q {
+					data.partial.test.mock_concat(["foo"], input, ["foo", "bar"])
+				}
+				mock_concat(__local0__3, __local1__3) = ["foo", "bar"]
+			`},
+		},
+		{
+			note:  "with+function: unknowns in replaced function's args",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+				my_concat(x, y) = concat(x, y)
+				mock_concat(_, _) = "foo,bar"
+				p {
+					q with my_concat as mock_concat
+				}
+				q {
+					my_concat("/", input, "foo,bar")
+				}`,
+			},
+			wantQueries: []string{`
+				data.partial.test.q
+				a = true
+			`},
+			wantSupport: []string{`package partial.test
+
+				q {
+					data.partial.test.mock_concat("/", input, "foo,bar")
+				}
+				mock_concat(__local2__3, __local3__3) = "foo,bar"
+			`},
+		},
+		{
+			note:  "with+builtin: unknowns in replacement function's bodies",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+
+				mock_concat(_, _) = ["foo", "bar"] { input.foo }
+				mock_concat(_, _) = ["bar", "baz"] { input.bar }
+
+				p { q with array.concat as mock_concat }
+				q { x := array.concat(["foo"], input) }`,
+			},
+			wantQueries: []string{`
+				data.partial.test.q
+				a = true
+			`},
+			wantSupport: []string{`package partial.test
+
+			q {
+				__local6__2 = input
+				data.partial.test.mock_concat(["foo"], __local6__2, __local5__2)
+				__local4__2 = __local5__2
+			}
+			mock_concat(__local0__3, __local1__3) = ["foo", "bar"] {
+				input.foo = x_term_3_03
+				x_term_3_03
+			}
+			mock_concat(__local2__4, __local3__4) = ["bar", "baz"] {
+				input.bar = x_term_4_04
+				x_term_4_04
+			}`},
+		},
+		{
+			note:  "with+function: unknowns in replacement function's bodies",
+			query: "data.test.p = a",
+			modules: []string{
+				`package test
+				my_concat(x, y) = concat(x, y)
+				mock_concat(_, _) = "foo,bar" { input.foo }
+				mock_concat(_, _) = "bar,baz" { input.bar }
+
+				p { q with my_concat as mock_concat }
+				q { x := my_concat(",", input) }`,
+			},
+			wantQueries: []string{`
+				data.partial.test.q
+				a = true
+			`},
+			wantSupport: []string{`package partial.test
+
+			q {
+				__local9__2 = input
+				data.partial.test.mock_concat(",", __local9__2, __local8__2)
+				__local6__2 = __local8__2
+			}
+			mock_concat(__local2__3, __local3__3) = "foo,bar" {
+				input.foo = x_term_3_03
+				x_term_3_03
+			}
+			mock_concat(__local4__4, __local5__4) = "bar,baz" {
+				input.bar = x_term_4_04
+				x_term_4_04
+			}`},
+		},
+		{
+			note:  "with+builtin+negation: when replacement has no unknowns (args, defs), save negated expr without replacement",
+			query: "data.test.p = true",
+			modules: []string{`
+				package test
+
+				mock_count(_) = 100
+				p {
+					not q with input.x as 1 with count as mock_count
+				}
+
+				q {
+					count([1,2,3]) = input.x
+				}
+			`},
+			wantQueries: []string{"not data.partial.test.q with input.x as 1"},
+			wantSupport: []string{`
+				package partial.test
+
+				q { 100 = input.x }
+			`},
+		},
+		{
+			note:  "with+function+negation: when replacement has no unknowns (args, defs), save negated expr without replacement",
+			query: "data.test.p = true",
+			modules: []string{`
+				package test
+				my_count(x) = count(x)
+				mock_count(_) = 100
+				p {
+					not q with input.x as 1 with my_count as mock_count
+				}
+
+				q {
+					my_count([1,2,3]) = input.x
+				}
+			`},
+			wantQueries: []string{"not data.partial.test.q with input.x as 1"},
+			wantSupport: []string{`
+				package partial.test
+
+				q { 100 = input.x }
+			`},
+		},
+		{
+			note:  "with+builtin+negation: when replacement args have unknowns, save negated expr with replacement",
+			query: "data.test.p = true",
+			modules: []string{`
+				package test
+
+				mock_count(_) = 100
+				p {
+					not q with input.x as 1 with count as mock_count
+				}
+
+				q {
+					count(input.y) = input.x # unknown arg for mocked func
+				}
+			`},
+			wantQueries: []string{"not data.partial.test.q with input.x as 1"},
+			wantSupport: []string{`
+				package partial.test
+
+				q { data.partial.test.mock_count(input.y, __local1__3); __local1__3 = input.x }
+				mock_count(__local0__4) = 100 
+			`},
+		},
+		{
+			note:  "with+function+negation: when replacement args have unknowns, save negated expr with replacement",
+			query: "data.test.p = true",
+			modules: []string{`
+				package test
+				my_count(x) = count(x)
+				mock_count(_) = 100
+				p {
+					not q with input.x as 1 with my_count as mock_count
+				}
+
+				q {
+					my_count(input.y) = input.x # unknown arg for mocked func
+				}
+			`},
+			wantQueries: []string{`not data.partial.test.q with input.x as 1`},
+			wantSupport: []string{`
+				package partial.test
+
+				q { data.partial.test.mock_count(input.y, __local3__3); __local3__3 = input.x }
+				mock_count(__local1__4) = 100
+			`},
+		},
+		{
+			note:  "with+builtin+negation: when replacement defs have unknowns, save negated expr with replacement",
+			query: "data.test.p = true",
+			modules: []string{`
+				package test
+
+				mock_count(_) = 100 { input.y }
+				mock_count(_) = 101 { input.z }
+				p {
+					not q with input.x as 1 with count as mock_count
+				}
+
+				q {
+					count([1]) = input.x # unknown arg for mocked func
+				}
+			`},
+			wantQueries: []string{"not data.partial.test.q with input.x as 1"},
+			wantSupport: []string{`
+				package partial.test
+
+				q { data.partial.test.mock_count([1], __local2__3); __local2__3 = input.x }
+				mock_count(__local0__4) = 100 { input.y = x_term_4_04; x_term_4_04 }
+				mock_count(__local1__5) = 101 { input.z = x_term_5_05; x_term_5_05 }
+			`},
+		},
+		{
+			note:  "with+function+negation: when replacement defs have unknowns, save negated expr with replacement",
+			query: "data.test.p = true",
+			modules: []string{`
+				package test
+				my_count(x) = count(x)
+				mock_count(_) = 100 { input.y }
+				mock_count(_) = 101 { input.z }
+				p {
+					not q with input.x as 1 with my_count as mock_count
+				}
+
+				q {
+					my_count([1]) = input.x # unknown arg for mocked func
+				}
+			`},
+			wantQueries: []string{"not data.partial.test.q with input.x as 1"},
+			wantSupport: []string{`
+				package partial.test
+
+				q { data.partial.test.mock_count([1], __local4__3); __local4__3 = input.x }
+				mock_count(__local1__4) = 100 { input.y = x_term_4_04; x_term_4_04 }
+				mock_count(__local2__5) = 101 { input.z = x_term_5_05; x_term_5_05 }
+			`},
+		},
 		{
 			note:  "save: sub path",
 			query: "input.x = 1; input.y = 2; input.z.a = 3; input.z.b = x",
@@ -1482,6 +1826,100 @@ func TestTopDownPartialEval(t *testing.T) {
 				),
 			},
 		},
+		{
+			note:  "copy propagation: circular reference (bug 3559)",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					q[_]
+				}
+				q[x] {
+					x = input[x]
+				}`,
+			},
+			wantQueries: []string{`x_term_1_01; x_term_1_01 = input[x_term_1_01]`},
+		},
+		{
+			note:  "copy propagation: circular reference (bug 3071)",
+			query: "data.test.p",
+			modules: []string{`package test
+				p[y] {
+					s := { i | input[i] }
+					s & set() != s
+					y := sprintf("%v", [s])
+				}`,
+			},
+			wantQueries: []string{`data.partial.test.p`},
+			wantSupport: []string{`package partial.test
+				p[__local1__1] { __local0__1 = {i1 | input[i1]}; neq(and(__local0__1, set()), __local0__1); sprintf("%v", [__local0__1], __local1__1) }
+			`},
+		},
+		{
+			note:        "copy propagation: tautology in query, input ref",
+			query:       "input.a == input.a",
+			wantQueries: []string{`__localq1__ = input.a`},
+		},
+		{
+			note:        "copy propagation: tautology in query, var ref, var is input",
+			query:       "x := input; x.a == x.a",
+			wantQueries: []string{`__localq2__ = input.a`},
+		},
+		{
+			note:  "copy propagation: tautology, input ref",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					input.a == input.a
+				}`,
+			},
+			wantQueries: []string{`__localcp0__ = input.a`},
+		},
+		{
+			note:  "copy propagation: tautology, var ref, ref is input",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					x := input
+					x.a == x.a
+				}`,
+			},
+			wantQueries: []string{`__localcp0__ = input.a`},
+		},
+		{
+			note:     "copy propagation: tautology, var ref, ref is unknown data",
+			query:    "data.test.p",
+			unknowns: []string{"data.bar.foo"},
+			modules: []string{`package test
+				p {
+					data.bar.foo.a == data.bar.foo.a
+				}`,
+			},
+			wantQueries: []string{`__localcp0__ = data.bar.foo.a`},
+		},
+		{
+			note: "copy propagation: tautology, var ref, ref is input, via unknown",
+			// NOTE(sr): If we were having unkowns: [input.foo] and the rule body was
+			// input.a == input.a, we'd never reach copy-propagation -- partial eval would
+			// have failed before.
+			query:    "data.test.p",
+			unknowns: []string{"input"},
+			modules: []string{`package test
+				p {
+					input.foo.a == input.foo.a
+				}`,
+			},
+			wantQueries: []string{`__localcp0__ = input.foo.a`},
+		},
+		{
+			note:  "copy propagation: tautology, var ref, ref is head var",
+			query: "data.test.p(input)",
+			modules: []string{`package test
+				p(x) {
+					x.a == x.a
+				}`,
+			},
+			wantQueries: []string{`__localcp1__ = input.a`},
+		},
 		{
 			note:  "save set vars are namespaced",
 			query: "input = x; data.test.f(1)",
@@ -2641,7 +3079,12 @@ func TestTopDownPartialEval(t *testing.T) {
 					x = true
 				}`,
 			},
-			wantQueries: []string{"a1 = input.foo1; b1 = input.foo2; c1 = input.foo3; d1 = input.foo4; e1 = input.foo5"},
+			wantQueries: []string{`
+				e1 = input.foo5
+				d1 = input.foo4
+				c1 = input.foo3
+				b1 = input.foo2
+				a1 = input.foo1`},
 		},
 		{
 			note:  "partial object rules not memoized",
@@ -2711,32 +3154,171 @@ func TestTopDownPartialEval(t *testing.T) {
 			skipPartialNamespace: true,
 		},
 		{
-			note:  "copypropagation: circular reference (bug 3559)",
+			note:  "every: empty domain, no unknowns",
 			query: "data.test.p",
 			modules: []string{`package test
 				p {
-					q[_]
+					every x in [] { x }
+				}`},
+			wantQueries: []string{``},
+		},
+		{
+			note:  "every: no unknowns",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in [1, 2, 3] { x != 4 }
+				}`},
+			wantQueries: []string{``},
+		},
+		{
+			note:  "every: empty domain, unknowns in body",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in [] { x > input }
+				}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in [] {
+				__local3__1 = input
+				__local1__1 > __local3__1
+			}`},
+		},
+		{
+			note:  "every: known domain, unknowns in body",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in [1, 2, 3] { x > input }
+				}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in [1, 2, 3] {
+				__local3__1 = input
+				__local1__1 > __local3__1
+			}`},
+		},
+		{
+			note:  "every: known domain, unknowns in body (with call+assignment)",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in [1, 2, 3] { y := x+10; y > input }
+				}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in [1, 2, 3] {
+				plus(__local1__1, 10, __local4__1)
+				__local2__1 = __local4__1
+				__local5__1 = input
+				__local2__1 > __local5__1
+			}`},
+		},
+		{
+			note:  "every: known domain, unknowns in body, body impossible",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in [1, 2, 3] { false; x > input }
+				}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in [1, 2, 3] {
+				false
+				__local3__1 = input
+				__local1__1 > __local3__1
+			}`},
+		},
+		{
+			note:  "every: unknown domain",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in input { x > 1 }
+				}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in input { __local1__1 > 1 }`},
+		},
+		{
+			note:  "every: in-scope var in body",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					y := 3
+					every x in [1, 2] { x != 0; input > y }
+				}`},
+			wantQueries: []string{`every __local1__1, __local2__1 in [1, 2] { __local2__1 != 0; __local4__1 = input; __local4__1 > 3 }`},
+		},
+		{
+			note:  "every: unknown domain, call in body",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					every x in input {
+						y = concat(",", [x])
+					}
+				}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in input { concat(",", [__local1__1], __local3__1); y1 = __local3__1 }`},
+		},
+		{
+			note:  "every: closing over function args",
+			query: "data.test.p",
+			modules: []string{`package test
+				p {
+					f(input)
 				}
-				q[x] {
-					x = input[x]
-				}`,
-			},
-			wantQueries: []string{`x_term_1_01; x_term_1_01 = input[x_term_1_01]`},
+				f(x) {
+					every y in [1] {
+						a = x
+						1 == y
+					}
+				}`},
+			wantQueries: []string{`every __local1__2, __local2__2 in [1] { a2 = input; 1 = __local2__2 }`},
 		},
 		{
-			note:  "copypropagation: circular reference (bug 3071)",
+			note:  "every: nested and closing over function args",
 			query: "data.test.p",
 			modules: []string{`package test
-				p[y] {
-					s := { i | input[i] }
-					s & set() != s
-					y := sprintf("%v", [s])
-				}`,
-			},
-			wantQueries: []string{`data.partial.test.p`},
-			wantSupport: []string{`package partial.test
-				p[__local1__1] { __local0__1 = {i1 | input[i1]}; neq(and(__local0__1, set()), __local0__1); sprintf("%v", [__local0__1], __local1__1) }
-			`},
+				p {
+					f(input)
+				}
+				f(x) {
+					every y in [1] {
+						every z in [2] {
+							a = x
+							z > y
+						}
+					}
+				}`},
+			wantQueries: []string{`every __local1__2, __local2__2 in [1] {
+				__local6__2 = [2]
+				every __local3__2, __local4__2 in __local6__2 {
+					a2 = input; __local4__2 > __local2__2 }
+				}`},
+		},
+		{ // https://github.com/open-policy-agent/opa/issues/5367
+			note:  "copypropagation: keep equations that are only found in comprehensions, inlined function call",
+			query: "data.test.p",
+			modules: []string{`package test
+			key_exists(obj, k) { x = obj[k] }
+			
+			p {
+				key_exists(input, "foo")
+				{ true | input.foo }
+			}`},
+			wantQueries: []string{`{true | input.foo} = x_term_1_21; x_term_1_21; x2 = input.foo`},
+		},
+		{ // condensed form of the test above
+			note:  "copypropagation: keep equations that are only found in comprehensions",
+			query: "data.test.p",
+			modules: []string{`package test
+			p {
+				x = input.foo
+				{ true | input.foo }
+			}`},
+			wantQueries: []string{`{true | input.foo} = x_term_1_11; x_term_1_11; x1 = input.foo`},
+		},
+		{
+			note:  "copypropagation: keep equations that are only found in 'every' body",
+			query: "data.test.p",
+			modules: []string{`package test
+			p {
+				x = input.foo
+				every y in input.ys { y = input.foo }
+			}`},
+			wantQueries: []string{`every __local0__1, __local1__1 in input.ys { __local1__1 = input.foo }; x1 = input.foo`},
 		},
 	}
 
@@ -2744,11 +3326,12 @@ func TestTopDownPartialEval(t *testing.T) {
 
 	for _, tc := range tests {
 		params := fixtureParams{
-			note:    tc.note,
-			query:   tc.query,
-			modules: tc.modules,
-			data:    tc.data,
-			input:   tc.input,
+			note:       tc.note,
+			query:      tc.query,
+			modules:    tc.modules,
+			moduleASTs: tc.moduleASTs,
+			data:       tc.data,
+			input:      tc.input,
 		}
 		prepareTest(ctx, t, params, func(ctx context.Context, t *testing.T, f fixture) {
 
@@ -2798,12 +3381,13 @@ func TestTopDownPartialEval(t *testing.T) {
 
 			var expectedQueries []ast.Body
 
+			opts := ast.ParserOptions{AllFutureKeywords: true}
 			if len(tc.wantQueryASTs) > 0 {
 				expectedQueries = tc.wantQueryASTs
 			} else {
 				expectedQueries = make([]ast.Body, len(tc.wantQueries))
 				for i := range tc.wantQueries {
-					expectedQueries[i] = ast.MustParseBody(tc.wantQueries[i])
+					expectedQueries[i] = ast.MustParseBodyWithOpts(tc.wantQueries[i], opts)
 				}
 			}
 
@@ -2814,9 +3398,13 @@ func TestTopDownPartialEval(t *testing.T) {
 				t.Errorf("Partial evaluation results differ. Expected %d queries but got %d queries:\nMissing:\n%v\nExtra:\n%v", len(queriesB), len(queriesA), missing, extra)
 			}
 
-			expectedSupport := make([]*ast.Module, len(tc.wantSupport))
-			for i := range tc.wantSupport {
-				expectedSupport[i] = ast.MustParseModule(tc.wantSupport[i])
+			var expectedSupport []*ast.Module
+			if len(tc.wantSupportASTs) > 0 {
+				expectedSupport = tc.wantSupportASTs
+			} else {
+				for i := range tc.wantSupport {
+					expectedSupport = append(expectedSupport, ast.MustParseModule(tc.wantSupport[i]))
+				}
 			}
 			supportA, supportB := moduleSet(support), moduleSet(expectedSupport)
 			if !supportA.Equal(supportB) {
@@ -2829,11 +3417,12 @@ func TestTopDownPartialEval(t *testing.T) {
 }
 
 type fixtureParams struct {
-	note    string
-	data    string
-	modules []string
-	query   string
-	input   string
+	note       string
+	data       string
+	modules    []string
+	moduleASTs []*ast.Module
+	query      string
+	input      string
 }
 
 type fixture struct {
@@ -2861,9 +3450,16 @@ func prepareTest(ctx context.Context, t *testing.T, params fixtureParams, f func
 
 			compiler := ast.NewCompiler()
 			modules := map[string]*ast.Module{}
+			opts := ast.ParserOptions{AllFutureKeywords: true}
 
+			if len(params.moduleASTs) > 0 {
+				for i, module := range params.moduleASTs {
+					modules[fmt.Sprint(i)] = module
+				}
+			}
 			for i, module := range params.modules {
-				modules[fmt.Sprint(i)] = ast.MustParseModule(module)
+				j := len(params.moduleASTs) + i
+				modules[fmt.Sprint(j)] = ast.MustParseModuleWithOpts(module, opts)
 			}
 
 			if compiler.Compile(modules); compiler.Failed() {
diff --git a/topdown/topdown_test.go b/topdown/topdown_test.go
index 4617f09164..0ea8ac9ae8 100644
--- a/topdown/topdown_test.go
+++ b/topdown/topdown_test.go
@@ -8,7 +8,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"path/filepath"
@@ -29,7 +28,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/types"
 	"github.com/open-policy-agent/opa/util"
 )
@@ -171,6 +170,7 @@ func TestTopDownUnsupportedBuiltin(t *testing.T) {
 	compiler := ast.NewCompiler()
 	store := inmem.New()
 	txn := storage.NewTransactionOrDie(ctx, store)
+	defer store.Abort(ctx, txn)
 	q := NewQuery(body).WithCompiler(compiler).WithStore(store).WithTransaction(txn)
 	_, err := q.Run(ctx)
 
@@ -220,13 +220,108 @@ func TestTopDownQueryCancellation(t *testing.T) {
 		cancel.Cancel()
 		close(done)
 	}()
-	<-done
 
 	qrs, err := query.Run(ctx)
 	if err == nil || err.(*Error).Code != CancelErr {
 		t.Errorf("Expected cancel error but got: %v (err: %v)", qrs, err)
 		PrettyTrace(os.Stdout, []*Event(*buf))
 	}
+
+	<-done
+}
+
+func TestTopDownQueryCancellationEvery(t *testing.T) {
+	ctx := context.Background()
+
+	module := func(ev ast.Every, extra ...interface{}) *ast.Module {
+		t.Helper()
+		m := ast.MustParseModule(`package test
+	p { true }`)
+		m.Rules[0].Body = ast.NewBody(ast.NewExpr(&ev))
+		return m
+	}
+
+	tests := []struct {
+		note   string
+		module *ast.Module
+	}{
+		{
+			note: "large domain, simple body",
+			module: module(ast.Every{ // every x in data.arr { ... }
+				Value:  ast.VarTerm("x"),
+				Domain: ast.RefTerm(ast.VarTerm("data"), ast.StringTerm("arr")),
+				Body:   ast.MustParseBody(`print(x); test.sleep("10ms")`),
+			}),
+		},
+		{
+			note: "simple domain, long evaluation time in body",
+			module: module(ast.Every{ // every x in [999] { ... }
+				Value:  ast.VarTerm("x"),
+				Domain: ast.MustParseTerm(`[999]`),
+				Body:   ast.MustParseBody(`data.arr[_] = y; test.sleep("10ms"); print(y); x == y`),
+			}),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			compiler := ast.NewCompiler().WithEnablePrintStatements(true)
+			compiler.Compile(map[string]*ast.Module{"test.rego": tc.module})
+			if compiler.Failed() {
+				t.Fatalf("compiler: %v", compiler.Errors)
+			}
+
+			arr := make([]interface{}, 1000)
+			for i := 0; i < 1000; i++ {
+				arr[i] = i
+			}
+			data := map[string]interface{}{
+				"arr": arr,
+			}
+
+			store := inmem.NewFromObject(data)
+			txn := storage.NewTransactionOrDie(ctx, store)
+			cancel := NewCancel()
+			buf := bytes.Buffer{}
+			tr := NewBufferTracer()
+			ph := NewPrintHook(&buf)
+			query := NewQuery(ast.MustParseBody("data.test.p")).
+				WithCompiler(compiler).
+				WithStore(store).
+				WithTransaction(txn).
+				WithCancel(cancel).
+				WithTracer(tr).
+				WithPrintHook(ph)
+
+			done := make(chan struct{})
+			go func() {
+				time.Sleep(time.Millisecond * 500)
+				cancel.Cancel()
+				close(done)
+			}()
+
+			qrs, err := query.Run(ctx)
+			if err == nil || err.(*Error).Code != CancelErr {
+				t.Errorf("Expected cancel error but got: %v (err: %v)", qrs, err)
+			}
+
+			notes := strings.Split(buf.String(), "\n")
+			notes = notes[:len(notes)-1] // last one is empty-string because each line ends in "\n"
+			if len(notes) == 0 {
+				t.Errorf("expected prints, got nothing")
+			}
+			if len(notes) == len(arr) {
+				t.Errorf("expected less than %d prints, got %d", len(arr), len(notes))
+			}
+			t.Logf("got %d notes", len(notes))
+
+			if t.Failed() && testing.Verbose() {
+				PrettyTrace(os.Stdout, []*Event(*tr))
+			}
+
+			<-done
+		})
+	}
 }
 
 func TestTopDownEarlyExit(t *testing.T) {
@@ -494,6 +589,163 @@ func TestTopDownEarlyExit(t *testing.T) {
 	}
 }
 
+func TestTopDownEvery(t *testing.T) {
+	n := func(ns ...string) []string { return ns }
+
+	tests := []struct {
+		note   string
+		module string
+		notes  []string // expected note events, let's see if these are useful
+		fail   bool
+	}{
+		{
+			note: "domain empty",
+			module: `package test
+				p { every x in [] { print(x) } }
+			`,
+			notes: n(),
+		},
+		{
+			note: "domain undefined",
+			module: `package test
+				p { every x in input { print(x) } }
+			`,
+			fail: true,
+		},
+		{
+			note: "domain is call",
+			module: `package test
+				p {
+					d := numbers.range(1, 5)
+					every x in d { x >= 1; print(x) }
+				}`,
+			notes: n("1", "2", "3", "4", "5"),
+		},
+		{
+			note: "simple value",
+			module: `package test
+				p {
+					every x in [1, 2] { print(x) }
+				}`,
+			notes: n("1", "2"),
+		},
+		{
+			note: "simple key+value",
+			module: `package test
+				p {
+					every k, v in [1, 2] { k < v; print(v) }
+				}`,
+			notes: n("1", "2"),
+		},
+		{
+			note: "outer bindings",
+			module: `package test
+				p {
+					i = "outer"
+					every x in [1, 2] { print(x); print(i) }
+				}`,
+			notes: n("1", "outer", "2", "outer"),
+		},
+		{
+			note: "simple failure, last",
+			module: `package test
+				p {
+					every x in [1, 2] { x < 2; print(x) }
+				}`,
+			notes: n("1"),
+			fail:  true,
+		},
+		{
+			note: "simple failure, first",
+			module: `package test
+				p {
+					every x in [1, 2] { x > 1; print(x) }
+				}`,
+			notes: n(),
+			fail:  true,
+		},
+		{
+			note: "early exit in body eval on success",
+			module: `package test
+				p {
+					every x in [1, 2] { y := [false, true, true][_]; print(x); y }
+				}`,
+			notes: n("1", "1", "2", "2"), // Would be triples if EE in the body didn't work
+		},
+		{
+			note: "early exit suppressed in body eval",
+			module: `package test
+				q { print("q") }
+				p {
+					every x in [1, 2] { q; print(x) }
+				}`,
+			notes: n("q", "1", "2"), // Would be only "1" if the EE of q wasn't surppressed
+		},
+		{
+			note: "with: domain",
+			module: `package test
+				p {
+					every x in input { print(x) } with input as [1]
+				}`,
+			notes: n("1"),
+		},
+		{
+			note: "with: body",
+			module: `package test
+				p {
+					every x in [1, 2] { print(x); print(input) } with input as "input"
+				}`,
+			notes: n("1", "input", "2", "input"),
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			ctx := context.Background()
+			c := ast.NewCompiler().WithEnablePrintStatements(true)
+			mod := ast.MustParseModuleWithOpts(tc.module, ast.ParserOptions{FutureKeywords: []string{"every"}})
+			if c.Compile(map[string]*ast.Module{"test": mod}); c.Failed() {
+				t.Fatal(c.Errors)
+			}
+			if testing.Verbose() {
+				t.Log(c.Modules)
+			}
+			buf := bytes.Buffer{}
+			tr := NewBufferTracer()
+			ph := NewPrintHook(&buf)
+			query := NewQuery(ast.MustParseBody("data.test.p = x")).
+				WithCompiler(c).
+				WithPrintHook(ph).
+				WithTracer(tr)
+
+			res, err := query.Run(ctx)
+			if err != nil {
+				t.Fatalf("Unexpected error: %v", err)
+			}
+			if !tc.fail {
+				if len(res) == 0 {
+					t.Errorf("unexpected failure, empty query result set")
+				}
+			} else {
+				if len(res) > 0 {
+					t.Errorf("unexpected results: %v, expected empty query result set", res)
+				}
+			}
+
+			notes := strings.Split(buf.String(), "\n")
+			notes = notes[:len(notes)-1] // last one is empty-string because each line ends in "\n"
+			if len(tc.notes) != 0 || len(tc.notes) == 0 && len(notes) != 0 {
+				if !reflect.DeepEqual(notes, tc.notes) {
+					t.Errorf("unexpected prints, expected %q, got %q", tc.notes, notes)
+				}
+			}
+
+			if t.Failed() || testing.Verbose() {
+				PrettyTrace(os.Stderr, *tr)
+			}
+		})
+	}
+}
+
 type contextPropagationMock struct{}
 
 // contextPropagationStore will accumulate values from the contexts provided to
@@ -506,15 +758,19 @@ type contextPropagationStore struct {
 	calls []interface{}
 }
 
-func (m *contextPropagationStore) NewTransaction(context.Context, ...storage.TransactionParams) (storage.Transaction, error) {
+func (*contextPropagationStore) NewTransaction(context.Context, ...storage.TransactionParams) (storage.Transaction, error) {
 	return nil, nil
 }
 
-func (m *contextPropagationStore) Commit(context.Context, storage.Transaction) error {
+func (*contextPropagationStore) Commit(context.Context, storage.Transaction) error {
 	return nil
 }
 
-func (m *contextPropagationStore) Abort(context.Context, storage.Transaction) {
+func (*contextPropagationStore) Abort(context.Context, storage.Transaction) {
+}
+
+func (*contextPropagationStore) Truncate(context.Context, storage.Transaction, storage.TransactionParams, storage.Iterator) error {
+	return nil
 }
 
 func (m *contextPropagationStore) Read(ctx context.Context, txn storage.Transaction, path storage.Path) (interface{}, error) {
@@ -573,6 +829,10 @@ func (*astStore) Commit(context.Context, storage.Transaction) error {
 
 func (*astStore) Abort(context.Context, storage.Transaction) {}
 
+func (*astStore) Truncate(context.Context, storage.Transaction, storage.TransactionParams, storage.Iterator) error {
+	return nil
+}
+
 func (a *astStore) Read(ctx context.Context, txn storage.Transaction, path storage.Path) (interface{}, error) {
 	if path.String() == a.path {
 		return a.value, nil
@@ -608,6 +868,68 @@ func TestTopdownStoreAST(t *testing.T) {
 	}
 }
 
+func TestTopdownLazyObj(t *testing.T) {
+	body := ast.MustParseBody(`data.stored = x`)
+	ctx := context.Background()
+	compiler := ast.NewCompiler()
+	foo := map[string]interface{}{
+		"foo": "bar",
+	}
+	store := inmem.NewFromObject(map[string]interface{}{
+		"stored": foo,
+	})
+	txn := storage.NewTransactionOrDie(ctx, store)
+	defer store.Abort(ctx, txn)
+
+	q := NewQuery(body).WithCompiler(compiler).WithStore(store).WithTransaction(txn)
+	qrs, err := q.Run(ctx)
+	if err != nil {
+		t.Fatalf("expected no error got %v", err)
+	}
+	act, ok := qrs[0]["x"].Value.(ast.Object)
+	if !ok {
+		t.Errorf("expected obj, got %T: %[1]v", qrs[0]["x"].Value)
+	}
+	// NOTE(sr): we're using DeepEqual here because we want to assert that the structs
+	// match -- as far as the interface `ast.Object` is concerned `*lazyObj` and `*object`
+	// should be indistinguishable.
+	if exp := ast.LazyObject(foo); !reflect.DeepEqual(act, exp) {
+		t.Errorf("expected %T, got %T", exp, act)
+	}
+}
+
+func TestTopdownLazyObjOptOut(t *testing.T) {
+	body := ast.MustParseBody(`data.stored = x`)
+	ctx := context.Background()
+	compiler := ast.NewCompiler()
+	foo := map[string]interface{}{
+		"foo": "bar",
+	}
+	store := inmem.NewFromObject(map[string]interface{}{
+		"stored": foo,
+	})
+	txn := storage.NewTransactionOrDie(ctx, store)
+	defer store.Abort(ctx, txn)
+
+	q := NewQuery(body).WithCompiler(compiler).WithStore(store).WithTransaction(txn).WithStrictObjects(true)
+	qrs, err := q.Run(ctx)
+	if err != nil {
+		t.Fatalf("expected no error got %v", err)
+	}
+	act, ok := qrs[0]["x"].Value.(ast.Object)
+	if !ok {
+		t.Errorf("expected %T, got %T: %[2]v", act, qrs[0]["x"].Value)
+	}
+	// NOTE(sr): We can't type-assert *ast.lazyObj because it's not exported -- but we can retry
+	// the assertion that we've done in the not-opt-out case, and see that it no longer holds:
+	if exp := ast.LazyObject(foo); reflect.DeepEqual(act, exp) {
+		t.Errorf("expected %T, got %T", exp, act)
+	}
+	if exp := ast.NewObject(ast.Item(ast.StringTerm("foo"), ast.StringTerm("bar"))); exp.Compare(act) != 0 {
+		t.Errorf("expected %v to be equal to %v", exp, act)
+	}
+}
+
 func compileModules(input []string) *ast.Compiler {
 
 	mods := map[string]*ast.Module{}
@@ -671,7 +993,6 @@ func compileRules(imports []string, input []string, modules []string) (*ast.Comp
 //
 // Avoid the following top-level keys: i, j, k, p, q, r, v, x, y, z.
 // These are used for rule names, local variables, etc.
-//
 func loadSmallTestData() map[string]interface{} {
 	var data map[string]interface{}
 	err := util.UnmarshalJSON([]byte(`{
@@ -740,6 +1061,20 @@ func setTime(t time.Time) func(*Query) *Query {
 	}
 }
 
+func setInterQueryCache(c iCache.InterQueryCache) func(*Query) *Query {
+	return func(q *Query) *Query {
+		return q.WithInterQueryBuiltinCache(c)
+	}
+}
+
+func setAllowNet(a []string) func(*Query) *Query {
+	return func(q *Query) *Query {
+		c := q.compiler.Capabilities()
+		c.AllowNet = a
+		return q.WithCompiler(q.compiler.WithCapabilities(c))
+	}
+}
+
 func runTopDownTestCase(t *testing.T, data map[string]interface{}, note string, rules []string, expected interface{}, options ...func(*Query) *Query) {
 	t.Helper()
 
@@ -1005,10 +1340,10 @@ func init() {
 		),
 	})
 
-	RegisterFunctionalBuiltin1("test.sleep", func(a ast.Value) (ast.Value, error) {
-		d, _ := time.ParseDuration(string(a.(ast.String)))
+	RegisterBuiltinFunc("test.sleep", func(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+		d, _ := time.ParseDuration(string(operands[0].Value.(ast.String)))
 		time.Sleep(d)
-		return ast.Null{}, nil
+		return iter(ast.NullTerm())
 	})
 
 }
@@ -1092,7 +1427,7 @@ func dump(note string, modules map[string]*ast.Module, data interface{}, docpath
 
 	filename := fmt.Sprintf("test-%v-%04d.yaml", namespace, c)
 
-	if err := ioutil.WriteFile(filepath.Join(dir, filename), bs, 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, filename), bs, 0644); err != nil {
 		panic(err)
 	}
 
diff --git a/topdown/trace.go b/topdown/trace.go
index 49aa5aff6a..727938d9c6 100644
--- a/topdown/trace.go
+++ b/topdown/trace.go
@@ -58,6 +58,11 @@ const (
 	// WasmOp is emitted when resolving a ref using an external
 	// Resolver.
 	WasmOp Op = "Wasm"
+
+	// UnifyOp is emitted when two terms are unified.  Node will be set to an
+	// equality expression with the two terms.  This Node will not have location
+	// info.
+	UnifyOp Op = "Unify"
 )
 
 // VarMetadata provides some user facing information about
@@ -78,6 +83,9 @@ type Event struct {
 	LocalMetadata map[ast.Var]VarMetadata // Contains metadata for the local variable bindings. Nil if variables were not included in the trace event.
 	Message       string                  // Contains message for Note events.
 	Ref           *ast.Ref                // Identifies the subject ref for the event. Only applies to Index and Wasm operations.
+
+	input    *ast.Term
+	bindings *bindings
 }
 
 // HasRule returns true if the Event contains an ast.Rule.
@@ -119,6 +127,17 @@ func (evt *Event) String() string {
 	return fmt.Sprintf("%v %v %v (qid=%v, pqid=%v)", evt.Op, evt.Node, evt.Locals, evt.QueryID, evt.ParentID)
 }
 
+// Input returns the input object as it was at the event.
+func (evt *Event) Input() *ast.Term {
+	return evt.input
+}
+
+// Plug plugs event bindings into the provided ast.Term. Because bindings are mutable, this only makes sense to do when
+// the event is emitted rather than on recorded trace events as the bindings are going to be different by then.
+func (evt *Event) Plug(term *ast.Term) *ast.Term {
+	return evt.bindings.Plug(term)
+}
+
 func (evt *Event) equalNodes(other *Event) bool {
 	switch a := evt.Node.(type) {
 	case ast.Body:
@@ -217,15 +236,15 @@ func (b *BufferTracer) Config() TraceConfig {
 
 // PrettyTrace pretty prints the trace to the writer.
 func PrettyTrace(w io.Writer, trace []*Event) {
-	depths := depths{}
-	for _, event := range trace {
-		depth := depths.GetOrSet(event.QueryID, event.ParentID)
-		fmt.Fprintln(w, formatEvent(event, depth))
-	}
+	prettyTraceWith(w, trace, false)
 }
 
 // PrettyTraceWithLocation prints the trace to the writer and includes location information
 func PrettyTraceWithLocation(w io.Writer, trace []*Event) {
+	prettyTraceWith(w, trace, true)
+}
+
+func prettyTraceWith(w io.Writer, trace []*Event, locations bool) {
 	depths := depths{}
 
 	filePathAliases, longest := getShortenedFileNames(trace)
@@ -235,8 +254,12 @@ func PrettyTraceWithLocation(w io.Writer, trace []*Event) {
 
 	for _, event := range trace {
 		depth := depths.GetOrSet(event.QueryID, event.ParentID)
-		location := formatLocation(event, filePathAliases)
-		fmt.Fprintf(w, "%-*s %s\n", locationWidth, location, formatEvent(event, depth))
+		if locations {
+			location := formatLocation(event, filePathAliases)
+			fmt.Fprintf(w, "%-*s %s\n", locationWidth, location, formatEvent(event, depth))
+		} else {
+			fmt.Fprintln(w, formatEvent(event, depth))
+		}
 	}
 }
 
@@ -268,11 +291,10 @@ func formatEvent(event *Event, depth int) string {
 
 func formatEventPadding(event *Event, depth int) string {
 	spaces := formatEventSpaces(event, depth)
-	padding := ""
 	if spaces > 1 {
-		padding += strings.Repeat("| ", spaces-1)
+		return strings.Repeat("| ", spaces-1)
 	}
-	return padding
+	return ""
 }
 
 func formatEventSpaces(event *Event, depth int) int {
@@ -365,9 +387,9 @@ func (ds depths) GetOrSet(qid uint64, pqid uint64) int {
 	return depth
 }
 
-func builtinTrace(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinTrace(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	str, err := builtins.StringOperand(args[0].Value, 1)
+	str, err := builtins.StringOperand(operands[0].Value, 1)
 	if err != nil {
 		return handleBuiltinErr(ast.Trace.Name, bctx.Location, err)
 	}
@@ -399,7 +421,18 @@ func rewrite(event *Event) *Event {
 
 	switch v := event.Node.(type) {
 	case *ast.Expr:
-		node = v.Copy()
+		expr := v.Copy()
+
+		// Hide generated local vars in 'key' position that have not been
+		// rewritten.
+		if ev, ok := v.Terms.(*ast.Every); ok {
+			if kv, ok := ev.Key.Value.(ast.Var); ok {
+				if rw, ok := cpy.LocalMetadata[kv]; !ok || rw.Name.IsGenerated() {
+					expr.Terms.(*ast.Every).Key = nil
+				}
+			}
+		}
+		node = expr
 	case ast.Body:
 		node = v.Copy()
 	case *ast.Rule:
diff --git a/topdown/trace_test.go b/topdown/trace_test.go
index f20c8748f0..ac4d9db159 100644
--- a/topdown/trace_test.go
+++ b/topdown/trace_test.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/storage"
-	"github.com/open-policy-agent/opa/storage/inmem"
+	inmem "github.com/open-policy-agent/opa/storage/inmem/test"
 	"github.com/open-policy-agent/opa/util"
 )
 
@@ -108,27 +108,9 @@ Redo data.test.p = _
 | | Redo data.test.q[x]
 `
 
-	a := strings.Split(expected, "\n")
 	var buf bytes.Buffer
-	PrettyTrace(&buf, *tracer)
-	b := strings.Split(buf.String(), "\n")
-
-	min := len(a)
-	if min > len(b) {
-		min = len(b)
-	}
-
-	for i := 0; i < min; i++ {
-		if a[i] != b[i] {
-			t.Errorf("Line %v in trace is incorrect. Expected %v but got: %v", i+1, a[i], b[i])
-		}
-	}
-
-	if len(a) < len(b) {
-		t.Fatalf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
-	} else if len(b) < len(a) {
-		t.Fatalf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
-	}
+	PrettyTrace(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
 }
 
 func TestPrettyTraceWithLocation(t *testing.T) {
@@ -186,27 +168,9 @@ query:3     | | Redo plus(x, 1, n)
 query:3     | | Redo data.test.q[x]
 `
 
-	a := strings.Split(expected, "\n")
 	var buf bytes.Buffer
-	PrettyTraceWithLocation(&buf, *tracer)
-	b := strings.Split(buf.String(), "\n")
-
-	min := len(a)
-	if min > len(b) {
-		min = len(b)
-	}
-
-	for i := 0; i < min; i++ {
-		if a[i] != b[i] {
-			t.Errorf("Line %v in trace is incorrect. Expected %v but got: %v", i+1, a[i], b[i])
-		}
-	}
-
-	if len(a) < len(b) {
-		t.Fatalf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
-	} else if len(b) < len(a) {
-		t.Fatalf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
-	}
+	PrettyTraceWithLocation(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
 }
 
 func TestPrettyTraceWithLocationTruncatedPaths(t *testing.T) {
@@ -271,27 +235,9 @@ authz_bundle/...ternal/authz/policies/abac/v1/beta/policy.rego:5     | | Redo pl
 authz_bundle/...ternal/authz/policies/abac/v1/beta/policy.rego:5     | | Redo data.utils.q[x]
 `
 
-	a := strings.Split(expected, "\n")
 	var buf bytes.Buffer
-	PrettyTraceWithLocation(&buf, *tracer)
-	b := strings.Split(buf.String(), "\n")
-
-	min := len(a)
-	if min > len(b) {
-		min = len(b)
-	}
-
-	for i := 0; i < min; i++ {
-		if a[i] != b[i] {
-			t.Errorf("Line %v in trace is incorrect. Expected %v but got: %v", i+1, a[i], b[i])
-		}
-	}
-
-	if len(a) < len(b) {
-		t.Fatalf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
-	} else if len(b) < len(a) {
-		t.Fatalf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
-	}
+	PrettyTraceWithLocation(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
 }
 
 func TestPrettyTracePartialWithLocationTruncatedPaths(t *testing.T) {
@@ -454,32 +400,9 @@ query:1                                                              Redo data.e
 query:1                                                              | Fail data.example_rbac.allow
 `
 
-	a := strings.Split(expected, "\n")
 	var buf bytes.Buffer
-	PrettyTraceWithLocation(&buf, *tracer)
-	b := strings.Split(buf.String(), "\n")
-
-	min := len(a)
-	if min > len(b) {
-		min = len(b)
-	}
-
-	for i := 0; i < min; i++ {
-		if a[i] != b[i] {
-			t.Errorf("Line %v in trace is incorrect. Expected %v but got: %v", i+1, a[i], b[i])
-		}
-	}
-
-	if len(a) < len(b) {
-		t.Errorf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
-	} else if len(b) < len(a) {
-		t.Errorf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
-	}
-
-	if t.Failed() {
-		fmt.Println("Trace output:")
-		fmt.Println(buf.String())
-	}
+	PrettyTraceWithLocation(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
 }
 
 func TestTraceDuplicate(t *testing.T) {
@@ -587,27 +510,9 @@ Redo data.test.p = _
 | | Redo data.test.q[x]
 `
 
-	a := strings.Split(expected, "\n")
 	var buf bytes.Buffer
-	PrettyTrace(&buf, *tracer)
-	b := strings.Split(buf.String(), "\n")
-
-	min := len(a)
-	if min > len(b) {
-		min = len(b)
-	}
-
-	for i := 0; i < min; i++ {
-		if a[i] != b[i] {
-			t.Errorf("Line %v in trace is incorrect. Expected %v but got: %v", i+1, a[i], b[i])
-		}
-	}
-
-	if len(a) < len(b) {
-		t.Fatalf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
-	} else if len(b) < len(a) {
-		t.Fatalf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
-	}
+	PrettyTrace(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
 }
 
 func TestTraceNoteWithLocation(t *testing.T) {
@@ -670,26 +575,9 @@ query:3     | | Redo plus(x, 1, n)
 query:3     | | Redo data.test.q[x]
 `
 
-	a := strings.Split(expected, "\n")
 	var buf bytes.Buffer
-	PrettyTraceWithLocation(&buf, *tracer)
-	b := strings.Split(buf.String(), "\n")
-	min := len(a)
-	if min > len(b) {
-		min = len(b)
-	}
-
-	for i := 0; i < min; i++ {
-		if a[i] != b[i] {
-			t.Errorf("Line %v in trace is incorrect. Expected %v but got: %v", i+1, a[i], b[i])
-		}
-	}
-
-	if len(a) < len(b) {
-		t.Fatalf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
-	} else if len(b) < len(a) {
-		t.Fatalf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
-	}
+	PrettyTraceWithLocation(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
 }
 
 func TestMultipleTracers(t *testing.T) {
@@ -777,23 +665,194 @@ func TestTraceRewrittenQueryVars(t *testing.T) {
 	}
 }
 
-func TestTraceRewrittenVarsIssue2022(t *testing.T) {
+func TestTraceRewrittenVars(t *testing.T) {
+
+	mustParse := func(s string) *ast.Expr {
+		return ast.MustParseBodyWithOpts(s, ast.ParserOptions{FutureKeywords: []string{"every"}})[0]
+	}
+	everyCheck := func(stmt string) func(*testing.T, *Event, *Event) {
+		return func(t *testing.T, _ *Event, output *Event) {
+			exp := mustParse(stmt)
+			if !exp.Equal(output.Node.(*ast.Expr)) {
+				t.Errorf("expected %v to equal %v", output, exp)
+			}
+		}
+	}
 
-	input := &Event{
-		Node: &ast.Expr{
-			Terms: ast.VarTerm("foo"),
+	tests := []struct {
+		note string
+		evt  *Event
+		exp  func(*testing.T, *Event, *Event)
+	}{
+		{
+			note: "issue 2022",
+			evt: &Event{
+				Node: ast.NewExpr(ast.VarTerm("foo")),
+				LocalMetadata: map[ast.Var]VarMetadata{
+					ast.Var("foo"): {Name: ast.Var("bar")},
+				},
+			},
+			exp: func(t *testing.T, input *Event, output *Event) {
+				if input.Node == output.Node {
+					t.Fatal("expected node to have been copied")
+				} else if !output.Node.(*ast.Expr).Equal(ast.NewExpr(ast.VarTerm("bar"))) {
+					t.Fatal("expected copy to contain rewritten var")
+				}
+			},
 		},
-		LocalMetadata: map[ast.Var]VarMetadata{
-			ast.Var("foo"): {Name: ast.Var("bar")},
+		{
+			note: "every: key/val rewritten",
+			evt: &Event{
+				Node: mustParse(`every __local0__, __local1__ in __local2__ { __local1__ == __local0__ }`),
+				LocalMetadata: map[ast.Var]VarMetadata{
+					ast.Var("__local0__"): {Name: ast.Var("k")},
+					ast.Var("__local1__"): {Name: ast.Var("v")},
+				},
+			},
+			exp: everyCheck(`every k, v in __local2__ { v == k }`),
+		},
+		{
+			note: "every: key hidden if not rewritten",
+			evt: &Event{
+				Node: mustParse(`every __local0__, __local1__ in __local2__ { __local1__ == 1 }`),
+				LocalMetadata: map[ast.Var]VarMetadata{
+					ast.Var("__local1__"): {Name: ast.Var("v")},
+				},
+			},
+			exp: everyCheck(`every v in __local2__ { v == 1 }`),
+		},
+		{
+			note: "every: key hidden if rewritten to generated key", // NOTE(sr): this would happen for traceRedo
+			evt: &Event{
+				Node: mustParse(`every __local0__, __local1__ in __local2__ { __local1__ == 1 }`),
+				LocalMetadata: map[ast.Var]VarMetadata{
+					ast.Var("__local1__"): {Name: ast.Var("v")},
+					ast.Var("__local0__"): {Name: ast.Var("__local0__")},
+				},
+			},
+			exp: everyCheck(`every v in __local2__ { v == 1 }`),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.note, func(t *testing.T) {
+			output := rewrite(tc.evt)
+			tc.exp(t, tc.evt, output)
+		})
+	}
+}
+
+func TestTraceEveryEvaluation(t *testing.T) {
+	ctx := context.Background()
+
+	events := func(es ...string) []string {
+		return es
+	}
+
+	// NOTE(sr): String() on an *Event isn't stable, because iterating the underlying ast.ValueMap isn't.
+	// So we're stubbing out all captured events' value maps to be able to compare these as strings.
+	tests := []struct {
+		note   string
+		query  string
+		module string
+		exp    []string // these need to be found, extra events captured are ignored
+	}{
+		{
+			note:  "empty domain",
+			query: "data.test.p = x",
+			module: `package test
+			p { every k, v in [] { k != v } }`,
+			exp: events(
+				`Enter every __local0__, __local1__ in __local2__ { neq(__local0__, __local1__) } {} (qid=2, pqid=1)`,
+				`Exit every __local0__, __local1__ in __local2__ { neq(__local0__, __local1__) } {} (qid=2, pqid=1)`,
+			),
+		},
+		{
+			note:  "successful eval",
+			query: "data.test.p = x",
+			module: `package test
+			p { every k, v in [1] { k != v } }`,
+			exp: events(
+				`Enter every __local0__, __local1__ in __local2__ { neq(__local0__, __local1__) } {} (qid=2, pqid=1)`,
+				`Enter neq(__local0__, __local1__) {} (qid=3, pqid=2)`,
+				`Exit neq(__local0__, __local1__) {} (qid=3, pqid=2)`,
+				`Redo every __local0__, __local1__ in __local2__ { neq(__local0__, __local1__) } {} (qid=2, pqid=1)`,
+				`Exit every __local0__, __local1__ in __local2__ { neq(__local0__, __local1__) } {} (qid=2, pqid=1)`,
+			),
+		},
+		{
+			note:  "failure in first body query",
+			query: "data.test.p = x",
+			module: `package test
+			p { every v in [1, 2] { 1 != v } }`,
+			exp: events(
+				`Enter every __local0__, __local1__ in __local2__ { neq(1, __local1__) } {} (qid=2, pqid=1)`,
+				`Enter neq(1, __local1__) {} (qid=3, pqid=2)`,
+				`Fail neq(1, __local1__) {} (qid=3, pqid=2)`,
+				`Fail every __local0__, __local1__ in __local2__ { neq(1, __local1__) } {} (qid=2, pqid=1)`,
+				`Redo every __local0__, __local1__ in __local2__ { neq(1, __local1__) } {} (qid=2, pqid=1)`,
+			),
+		},
+		{
+			note:  "failure in last body query",
+			query: "data.test.p = x",
+			module: `package test
+			p { every v in [0, 1] { 1 != v } }`,
+			exp: events(
+				`Enter every __local0__, __local1__ in __local2__ { neq(1, __local1__) } {} (qid=2, pqid=1)`,
+				`Enter neq(1, __local1__) {} (qid=3, pqid=2)`,
+				`Exit neq(1, __local1__) {} (qid=3, pqid=2)`,
+				`Enter neq(1, __local1__) {} (qid=4, pqid=2)`,
+				`Fail neq(1, __local1__) {} (qid=4, pqid=2)`,
+				`Fail every __local0__, __local1__ in __local2__ { neq(1, __local1__) } {} (qid=2, pqid=1)`,
+				`Redo every __local0__, __local1__ in __local2__ { neq(1, __local1__) } {} (qid=2, pqid=1)`,
+			),
 		},
 	}
 
-	output := rewrite(input)
+	for _, tc := range tests {
+
+		opts := ast.CompileOpts{ParserOptions: ast.ParserOptions{FutureKeywords: []string{"every"}}}
+		compiler, err := ast.CompileModulesWithOpt(map[string]string{"test.rego": tc.module}, opts)
+		if err != nil {
+			t.Fatal(err)
+		}
+		queryCompiler := compiler.QueryCompiler()
+
+		compiledQuery, err := queryCompiler.Compile(ast.MustParseBody(tc.query))
+		if err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
+
+		buf := NewBufferTracer()
+		query := NewQuery(compiledQuery).
+			WithQueryCompiler(queryCompiler).
+			WithCompiler(compiler).
+			WithStore(inmem.New()).
+			WithQueryTracer(buf)
+
+		if _, err := query.Run(ctx); err != nil {
+			t.Fatalf("unexpected error: %s", err)
+		}
 
-	if input.Node == output.Node {
-		t.Fatal("expected node to have been copied")
-	} else if !output.Node.(*ast.Expr).Equal(ast.NewExpr(ast.VarTerm("bar"))) {
-		t.Fatal("expected copy to contain rewritten var")
+		for _, exp := range tc.exp {
+			found := false
+			for _, act := range *buf {
+				act.Locals = nil
+				if act.String() == exp {
+					found = true
+				}
+			}
+			if !found {
+				t.Errorf("expected event %v, found none", exp)
+			}
+		}
+		if t.Failed() {
+			t.Log("captured events:")
+			for _, ev := range *buf {
+				t.Log(ev.String())
+			}
+		}
 	}
 }
 
@@ -961,3 +1020,282 @@ func TestBufferTracerTraceConfig(t *testing.T) {
 		t.Fatalf("Expected config: %+v, got %+v", expected, conf)
 	}
 }
+
+func TestTraceInput(t *testing.T) {
+	ctx := context.Background()
+	module := `
+		package test
+
+		rule = x {
+			x = input.v
+		}
+	`
+
+	compiler := compileModules([]string{module})
+	queryCompiler := compiler.QueryCompiler()
+
+	compiledQuery, err := queryCompiler.Compile(ast.MustParseBody("{x | v = [1, 2, 3][_];  x = data.test.rule with input.v as v}"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	tracer := NewBufferTracer()
+	query := NewQuery(compiledQuery).
+		WithQueryCompiler(queryCompiler).
+		WithCompiler(compiler).
+		WithStore(inmem.New()).
+		WithQueryTracer(tracer)
+
+	if _, err := query.Run(ctx); err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	num := 1
+	for i, evt := range *tracer {
+		if evt.Op == ExitOp && evt.HasRule() {
+			input := evt.Input().Value
+			expected := ast.NewObject([2]*ast.Term{ast.StringTerm("v"), ast.IntNumberTerm(num)})
+			if input.Compare(expected) != 0 {
+				t.Errorf("%v != %v at index %d", input, expected, i)
+			}
+			num++
+		}
+	}
+}
+
+func TestTracePlug(t *testing.T) {
+	ctx := context.Background()
+	module := `
+		package test
+
+		rule[[a, b]] {
+			a = [1, 2][_]
+			b = [2, 1][_]
+		}
+	`
+
+	compiler := compileModules([]string{module})
+	queryCompiler := compiler.QueryCompiler()
+
+	compiledQuery, err := queryCompiler.Compile(ast.MustParseBody("data.test.rule"))
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	tracer := plugRuleHeadKeyRecorder{}
+	query := NewQuery(compiledQuery).
+		WithQueryCompiler(queryCompiler).
+		WithCompiler(compiler).
+		WithStore(inmem.New()).
+		WithQueryTracer(&tracer)
+
+	if _, err := query.Run(ctx); err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	expected := []ast.Value{
+		ast.NewArray(ast.NumberTerm("1"), ast.NumberTerm("2")),
+		ast.NewArray(ast.NumberTerm("1"), ast.NumberTerm("1")),
+		ast.NewArray(ast.NumberTerm("2"), ast.NumberTerm("2")),
+		ast.NewArray(ast.NumberTerm("2"), ast.NumberTerm("1")),
+	}
+
+	if len(tracer) != len(expected) {
+		t.Fatalf("unexpected result length %d", len(tracer))
+	}
+
+	for i, value := range tracer {
+		if value.Compare(expected[i]) != 0 {
+			t.Errorf("%v != %v at index %d", value, expected[i], i)
+		}
+	}
+}
+
+type plugRuleHeadKeyRecorder []ast.Value
+
+func (plugRuleHeadKeyRecorder) Enabled() bool {
+	return true
+}
+
+func (pr *plugRuleHeadKeyRecorder) TraceEvent(evt Event) {
+	if evt.Op == ExitOp && evt.HasRule() {
+		*pr = append(*pr, evt.Plug(evt.Node.(*ast.Rule).Head.Key).Value)
+	}
+}
+
+func (plugRuleHeadKeyRecorder) Config() TraceConfig {
+	return TraceConfig{PlugLocalVars: false}
+}
+
+func compareBuffers(t *testing.T, expected, actual string) {
+	t.Helper()
+	a := strings.Split(expected, "\n")
+	b := strings.Split(actual, "\n")
+	min := len(a)
+	if min > len(b) {
+		min = len(b)
+	}
+
+	for i := 0; i < min; i++ {
+		if a[i] != b[i] {
+			t.Errorf("Line %v in trace is incorrect. Expected %q but got: %q", i+1, a[i], b[i])
+		}
+	}
+
+	if len(a) < len(b) {
+		t.Errorf("Extra lines in trace:\n%v", strings.Join(b[min:], "\n"))
+	} else if len(b) < len(a) {
+		t.Errorf("Missing lines in trace:\n%v", strings.Join(a[min:], "\n"))
+	}
+
+	if t.Failed() {
+		fmt.Println("Trace output:")
+		fmt.Println(actual)
+	}
+}
+
+func TestPrettyTraceWithLocationForMetadataCall(t *testing.T) {
+	module := `package test
+rule_no_output_var := rego.metadata.rule()
+
+rule_with_output_var {
+	foo := rego.metadata.rule()
+	foo == {}
+}
+
+chain_no_output_var := rego.metadata.chain()
+
+chain_with_output_var {
+	foo := rego.metadata.chain()
+	foo == []
+}`
+
+	ctx := context.Background()
+	compiler := compileModules([]string{module})
+	data := loadSmallTestData()
+	store := inmem.NewFromObject(data)
+	txn := storage.NewTransactionOrDie(ctx, store)
+	defer store.Abort(ctx, txn)
+
+	tracer := NewBufferTracer()
+	query := NewQuery(ast.MustParseBody("data.test = _")).
+		WithCompiler(compiler).
+		WithStore(store).
+		WithTransaction(txn).
+		WithTracer(tracer)
+
+	_, err := query.Run(ctx)
+	if err != nil {
+		panic(err)
+	}
+
+	expected := `query:1      Enter data.test = _
+query:1      | Eval data.test = _
+query:1      | Index data.test.chain_no_output_var (matched 1 rule)
+query:9      | Enter data.test.chain_no_output_var
+query:9      | | Eval __local8__ = [{"path": ["test", "chain_no_output_var"]}]
+query:9      | | Eval true
+query:9      | | Eval __local4__ = __local8__
+query:9      | | Exit data.test.chain_no_output_var
+query:9      | Redo data.test.chain_no_output_var
+query:9      | | Redo __local4__ = __local8__
+query:9      | | Redo true
+query:9      | | Redo __local8__ = [{"path": ["test", "chain_no_output_var"]}]
+query:1      | Index data.test.chain_with_output_var (matched 1 rule, early exit)
+query:11     | Enter data.test.chain_with_output_var
+query:12     | | Eval __local9__ = [{"path": ["test", "chain_with_output_var"]}]
+query:12     | | Eval __local5__ = __local9__
+query:12     | | Eval foo = __local5__
+query:13     | | Eval foo = []
+query:13     | | Fail foo = []
+query:12     | | Redo foo = __local5__
+query:12     | | Redo __local5__ = __local9__
+query:12     | | Redo __local9__ = [{"path": ["test", "chain_with_output_var"]}]
+query:1      | Index data.test.rule_no_output_var (matched 1 rule)
+query:2      | Enter data.test.rule_no_output_var
+query:2      | | Eval __local6__ = {}
+query:2      | | Eval true
+query:2      | | Eval __local2__ = __local6__
+query:2      | | Exit data.test.rule_no_output_var
+query:2      | Redo data.test.rule_no_output_var
+query:2      | | Redo __local2__ = __local6__
+query:2      | | Redo true
+query:2      | | Redo __local6__ = {}
+query:1      | Index data.test.rule_with_output_var (matched 1 rule, early exit)
+query:4      | Enter data.test.rule_with_output_var
+query:5      | | Eval __local7__ = {}
+query:5      | | Eval __local3__ = __local7__
+query:5      | | Eval foo = __local3__
+query:6      | | Eval foo = {}
+query:4      | | Exit data.test.rule_with_output_var early
+query:4      | Redo data.test.rule_with_output_var
+query:6      | | Redo foo = {}
+query:5      | | Redo foo = __local3__
+query:5      | | Redo __local3__ = __local7__
+query:5      | | Redo __local7__ = {}
+query:1      | Exit data.test = _
+query:1      Redo data.test = _
+query:1      | Redo data.test = _
+`
+
+	var buf bytes.Buffer
+	PrettyTraceWithLocation(&buf, removeUnifyOps(*tracer))
+	compareBuffers(t, expected, buf.String())
+}
+
+func TestPrettyTraceWithUnifyOps(t *testing.T) {
+	module := `package test
+
+	p[x] {
+		x = 1
+	}`
+
+	ctx := context.Background()
+	compiler := compileModules([]string{module})
+	store := inmem.NewFromObject(nil)
+	txn := storage.NewTransactionOrDie(ctx, store)
+	defer store.Abort(ctx, txn)
+
+	tracer := NewBufferTracer()
+	query := NewQuery(ast.MustParseBody("data.test.p")).
+		WithCompiler(compiler).
+		WithStore(store).
+		WithTransaction(txn).
+		WithTracer(tracer)
+
+	_, err := query.Run(ctx)
+	if err != nil {
+		panic(err)
+	}
+
+	expected := `query:1     Enter data.test.p
+query:1     | Eval data.test.p
+query:1     | Unify data.test.p = _
+query:1     | Index data.test.p (matched 1 rule)
+query:3     | Enter data.test.p
+query:4     | | Eval x = 1
+query:4     | | Unify x = 1
+query:3     | | Exit data.test.p
+query:3     | Redo data.test.p
+query:4     | | Redo x = 1
+query:1     | Unify {1} = _
+query:1     | Exit data.test.p
+query:1     Redo data.test.p
+query:1     | Redo data.test.p
+`
+
+	var buf bytes.Buffer
+	PrettyTraceWithLocation(&buf, *tracer)
+	compareBuffers(t, expected, buf.String())
+}
+
+// removeUnifyOps removes all UnifyOp events from a trace, since this is
+// too verbose to test everywhere.
+func removeUnifyOps(trace []*Event) (result []*Event) {
+	for _, event := range trace {
+		if event.Op != UnifyOp {
+			result = append(result, event)
+		}
+	}
+	return
+}
diff --git a/topdown/type.go b/topdown/type.go
index 2fe7a39a95..dab5c853cd 100644
--- a/topdown/type.go
+++ b/topdown/type.go
@@ -1,4 +1,4 @@
-// Copyright 2018 The OPA Authors.  All rights reserved.
+// Copyright 2022 The OPA Authors.  All rights reserved.
 // Use of this source code is governed by an Apache2
 // license that can be found in the LICENSE file.
 
@@ -8,75 +8,75 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 )
 
-func builtinIsNumber(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsNumber(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.Number:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
-func builtinIsString(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsString(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.String:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
-func builtinIsBoolean(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsBoolean(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.Boolean:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
-func builtinIsArray(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsArray(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case *ast.Array:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
-func builtinIsSet(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsSet(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.Set:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
-func builtinIsObject(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsObject(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.Object:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
-func builtinIsNull(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinIsNull(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.Null:
-		return ast.Boolean(true), nil
+		return iter(ast.BooleanTerm(true))
 	default:
-		return nil, BuiltinEmpty{}
+		return iter(ast.BooleanTerm(false))
 	}
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.IsNumber.Name, builtinIsNumber)
-	RegisterFunctionalBuiltin1(ast.IsString.Name, builtinIsString)
-	RegisterFunctionalBuiltin1(ast.IsBoolean.Name, builtinIsBoolean)
-	RegisterFunctionalBuiltin1(ast.IsArray.Name, builtinIsArray)
-	RegisterFunctionalBuiltin1(ast.IsSet.Name, builtinIsSet)
-	RegisterFunctionalBuiltin1(ast.IsObject.Name, builtinIsObject)
-	RegisterFunctionalBuiltin1(ast.IsNull.Name, builtinIsNull)
+	RegisterBuiltinFunc(ast.IsNumber.Name, builtinIsNumber)
+	RegisterBuiltinFunc(ast.IsString.Name, builtinIsString)
+	RegisterBuiltinFunc(ast.IsBoolean.Name, builtinIsBoolean)
+	RegisterBuiltinFunc(ast.IsArray.Name, builtinIsArray)
+	RegisterBuiltinFunc(ast.IsSet.Name, builtinIsSet)
+	RegisterBuiltinFunc(ast.IsObject.Name, builtinIsObject)
+	RegisterBuiltinFunc(ast.IsNull.Name, builtinIsNull)
 }
diff --git a/topdown/type_name.go b/topdown/type_name.go
index 2154abb5c2..0a8b44aed3 100644
--- a/topdown/type_name.go
+++ b/topdown/type_name.go
@@ -10,27 +10,27 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 )
 
-func builtinTypeName(a ast.Value) (ast.Value, error) {
-	switch a.(type) {
+func builtinTypeName(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	switch operands[0].Value.(type) {
 	case ast.Null:
-		return ast.String("null"), nil
+		return iter(ast.StringTerm("null"))
 	case ast.Boolean:
-		return ast.String("boolean"), nil
+		return iter(ast.StringTerm("boolean"))
 	case ast.Number:
-		return ast.String("number"), nil
+		return iter(ast.StringTerm("number"))
 	case ast.String:
-		return ast.String("string"), nil
+		return iter(ast.StringTerm("string"))
 	case *ast.Array:
-		return ast.String("array"), nil
+		return iter(ast.StringTerm("array"))
 	case ast.Object:
-		return ast.String("object"), nil
+		return iter(ast.StringTerm("object"))
 	case ast.Set:
-		return ast.String("set"), nil
+		return iter(ast.StringTerm("set"))
 	}
 
-	return nil, fmt.Errorf("illegal value")
+	return fmt.Errorf("illegal value")
 }
 
 func init() {
-	RegisterFunctionalBuiltin1(ast.TypeNameBuiltin.Name, builtinTypeName)
+	RegisterBuiltinFunc(ast.TypeNameBuiltin.Name, builtinTypeName)
 }
diff --git a/topdown/uuid.go b/topdown/uuid.go
index d08adb0ac3..2fdbd36983 100644
--- a/topdown/uuid.go
+++ b/topdown/uuid.go
@@ -11,9 +11,9 @@ import (
 
 type uuidCachingKey string
 
-func builtinUUIDRFC4122(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
+func builtinUUIDRFC4122(bctx BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
 
-	var key = uuidCachingKey(args[0].Value.String())
+	var key = uuidCachingKey(operands[0].Value.String())
 
 	val, ok := bctx.Cache.Get(key)
 	if ok {
diff --git a/topdown/walk.go b/topdown/walk.go
index 520098f855..8e0a346f24 100644
--- a/topdown/walk.go
+++ b/topdown/walk.go
@@ -8,9 +8,9 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 )
 
-func evalWalk(bctx BuiltinContext, args []*ast.Term, iter func(*ast.Term) error) error {
-	input := args[0]
-	filter := getOutputPath(args)
+func evalWalk(_ BuiltinContext, operands []*ast.Term, iter func(*ast.Term) error) error {
+	input := operands[0]
+	filter := getOutputPath(operands)
 	return walk(filter, nil, input, iter)
 }
 
@@ -21,7 +21,7 @@ func walk(filter, path *ast.Array, input *ast.Term, iter func(*ast.Term) error)
 			path = ast.NewArray()
 		}
 
-		if err := iter(ast.ArrayTerm(ast.NewTerm(path), input)); err != nil {
+		if err := iter(ast.ArrayTerm(ast.NewTerm(path.Copy()), input)); err != nil {
 			return err
 		}
 	}
@@ -78,9 +78,9 @@ func pathAppend(path *ast.Array, key *ast.Term) *ast.Array {
 	return path.Append(key)
 }
 
-func getOutputPath(args []*ast.Term) *ast.Array {
-	if len(args) == 2 {
-		if arr, ok := args[1].Value.(*ast.Array); ok {
+func getOutputPath(operands []*ast.Term) *ast.Array {
+	if len(operands) == 2 {
+		if arr, ok := operands[1].Value.(*ast.Array); ok {
 			if arr.Len() == 2 {
 				if path, ok := arr.Elem(0).Value.(*ast.Array); ok {
 					return path
diff --git a/tracing/tracing.go b/tracing/tracing.go
new file mode 100644
index 0000000000..2708b78e29
--- /dev/null
+++ b/tracing/tracing.go
@@ -0,0 +1,55 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package tracing enables dependency-injection at runtime. When used
+// together with an underscore-import of `github.com/open-policy-agent/opa/features/tracing`,
+// the server and its runtime will emit OpenTelemetry spans to the
+// configured sink.
+package tracing
+
+import "net/http"
+
+// Options are options for the HTTPTracingService, passed along as-is.
+type Options []interface{}
+
+// NewOptions is a helper method for constructing `tracing.Options`
+func NewOptions(opts ...interface{}) Options {
+	return opts
+}
+
+// HTTPTracingService defines how distributed tracing comes in, server- and client-side
+type HTTPTracingService interface {
+	// NewTransport is used when setting up an HTTP client
+	NewTransport(http.RoundTripper, Options) http.RoundTripper
+
+	// NewHandler is used to wrap an http.Handler in the server
+	NewHandler(http.Handler, string, Options) http.Handler
+}
+
+var tracing HTTPTracingService
+
+// RegisterHTTPTracing enables a HTTPTracingService for further use.
+func RegisterHTTPTracing(ht HTTPTracingService) {
+	tracing = ht
+}
+
+// NewTransport returns another http.RoundTripper, instrumented to emit tracing
+// spans according to Options. Provided by the HTTPTracingService registered with
+// this package via RegisterHTTPTracing.
+func NewTransport(tr http.RoundTripper, opts Options) http.RoundTripper {
+	if tracing == nil {
+		return tr
+	}
+	return tracing.NewTransport(tr, opts)
+}
+
+// NewHandler returns another http.Handler, instrumented to emit tracing spans
+// according to Options. Provided by the HTTPTracingService registered with
+// this package via RegisterHTTPTracing.
+func NewHandler(f http.Handler, label string, opts Options) http.Handler {
+	if tracing == nil {
+		return f
+	}
+	return tracing.NewHandler(f, label, opts)
+}
diff --git a/types/types.go b/types/types.go
index 9b5cc66c45..24b1d1248f 100644
--- a/types/types.go
+++ b/types/types.go
@@ -48,6 +48,47 @@ func NewNull() Null {
 	return Null{}
 }
 
+// NamedType represents a type alias with an arbitrary name and description.
+// This is useful for generating documentation for built-in functions.
+type NamedType struct {
+	Name, Descr string
+	Type        Type
+}
+
+func (n *NamedType) typeMarker() string { return n.Type.typeMarker() }
+func (n *NamedType) String() string     { return n.Name + ": " + n.Type.String() }
+func (n *NamedType) MarshalJSON() ([]byte, error) {
+	var obj map[string]interface{}
+	switch x := n.Type.(type) {
+	case interface{ toMap() map[string]interface{} }:
+		obj = x.toMap()
+	default:
+		obj = map[string]interface{}{
+			"type": n.Type.typeMarker(),
+		}
+	}
+	obj["name"] = n.Name
+	if n.Descr != "" {
+		obj["description"] = n.Descr
+	}
+	return json.Marshal(obj)
+}
+
+func (n *NamedType) Description(d string) *NamedType {
+	n.Descr = d
+	return n
+}
+
+// Named returns the passed type as a named type.
+// Named types are only valid at the top level of built-in functions.
+// Note that nested named types cause panic.
+func Named(name string, t Type) *NamedType {
+	return &NamedType{
+		Type: t,
+		Name: name,
+	}
+}
+
 // MarshalJSON returns the JSON encoding of t.
 func (t Null) MarshalJSON() ([]byte, error) {
 	return json.Marshal(map[string]interface{}{
@@ -55,6 +96,15 @@ func (t Null) MarshalJSON() ([]byte, error) {
 	})
 }
 
+func unwrap(t Type) Type {
+	switch t := t.(type) {
+	case *NamedType:
+		return t.Type
+	default:
+		return t
+	}
+}
+
 func (t Null) String() string {
 	return typeNull
 }
@@ -100,7 +150,7 @@ func (t String) MarshalJSON() ([]byte, error) {
 	})
 }
 
-func (t String) String() string {
+func (String) String() string {
 	return typeString
 }
 
@@ -142,6 +192,10 @@ func NewArray(static []Type, dynamic Type) *Array {
 
 // MarshalJSON returns the JSON encoding of t.
 func (t *Array) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.toMap())
+}
+
+func (t *Array) toMap() map[string]interface{} {
 	repr := map[string]interface{}{
 		"type": t.typeMarker(),
 	}
@@ -151,7 +205,7 @@ func (t *Array) MarshalJSON() ([]byte, error) {
 	if t.dynamic != nil {
 		repr["dynamic"] = t.dynamic
 	}
-	return json.Marshal(repr)
+	return repr
 }
 
 func (t *Array) String() string {
@@ -207,13 +261,17 @@ func NewSet(of Type) *Set {
 
 // MarshalJSON returns the JSON encoding of t.
 func (t *Set) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.toMap())
+}
+
+func (t *Set) toMap() map[string]interface{} {
 	repr := map[string]interface{}{
 		"type": t.typeMarker(),
 	}
 	if t.of != nil {
 		repr["of"] = t.of
 	}
-	return json.Marshal(repr)
+	return repr
 }
 
 func (t *Set) String() string {
@@ -332,6 +390,10 @@ func (t *Object) Keys() []interface{} {
 
 // MarshalJSON returns the JSON encoding of t.
 func (t *Object) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.toMap())
+}
+
+func (t *Object) toMap() map[string]interface{} {
 	repr := map[string]interface{}{
 		"type": t.typeMarker(),
 	}
@@ -341,7 +403,7 @@ func (t *Object) MarshalJSON() ([]byte, error) {
 	if t.dynamic != nil {
 		repr["dynamic"] = t.dynamic
 	}
-	return json.Marshal(repr)
+	return repr
 }
 
 // Select returns the type of the named property.
@@ -373,9 +435,7 @@ var A = NewAny()
 // NewAny returns a new Any type.
 func NewAny(of ...Type) Any {
 	sl := make(Any, len(of))
-	for i := range sl {
-		sl[i] = of[i]
-	}
+	copy(sl, of)
 	sort.Sort(typeSlice(sl))
 	return sl
 }
@@ -385,23 +445,31 @@ func (t Any) Contains(other Type) bool {
 	if _, ok := other.(*Function); ok {
 		return false
 	}
-	for i := range t {
-		if Compare(t[i], other) == 0 {
-			return true
-		}
+	// Note(philipc): We used to do this as a linear search.
+	// Since this is always sorted, we can use a binary search instead.
+	i := sort.Search(len(t), func(i int) bool {
+		return Compare(t[i], other) >= 0
+	})
+	if i < len(t) && Compare(t[i], other) == 0 {
+		// x is present at t[i]
+		return true
 	}
 	return len(t) == 0
 }
 
 // MarshalJSON returns the JSON encoding of t.
 func (t Any) MarshalJSON() ([]byte, error) {
-	data := map[string]interface{}{
+	return json.Marshal(t.toMap())
+}
+
+func (t Any) toMap() map[string]interface{} {
+	repr := map[string]interface{}{
 		"type": t.typeMarker(),
 	}
 	if len(t) != 0 {
-		data["of"] = []Type(t)
+		repr["of"] = []Type(t)
 	}
-	return json.Marshal(data)
+	return repr
 }
 
 // Merge return a new Any type that is the superset of t and other.
@@ -431,9 +499,7 @@ func (t Any) Union(other Any) Any {
 		return other
 	}
 	cpy := make(Any, len(t))
-	for i := range cpy {
-		cpy[i] = t[i]
-	}
+	copy(cpy, t)
 	for i := range other {
 		if !cpy.Contains(other[i]) {
 			cpy = append(cpy, other[i])
@@ -487,8 +553,7 @@ func Arity(x Type) int {
 	return len(f.FuncArgs().Args)
 }
 
-// NewFunction returns a new Function object where xs[:len(xs)-1] are arguments
-// and xs[len(xs)-1] is the result type.
+// NewFunction returns a new Function object of the given argument and result types.
 func NewFunction(args []Type, result Type) *Function {
 	return &Function{
 		args:   args,
@@ -512,19 +577,34 @@ func NewVariadicFunction(args []Type, varargs Type, result Type) *Function {
 
 // FuncArgs returns the function's arguments.
 func (t *Function) FuncArgs() FuncArgs {
-	return FuncArgs{Args: t.Args(), Variadic: t.variadic}
+	return FuncArgs{Args: t.Args(), Variadic: unwrap(t.variadic)}
+}
+
+// NamedFuncArgs returns the function's arguments, with a name and
+// description if available.
+func (t *Function) NamedFuncArgs() FuncArgs {
+	args := make([]Type, len(t.args))
+	copy(args, t.args)
+	return FuncArgs{Args: args, Variadic: t.variadic}
 }
 
 // Args returns the function's arguments as a slice, ignoring variadic arguments.
 // Deprecated: Use FuncArgs instead.
 func (t *Function) Args() []Type {
 	cpy := make([]Type, len(t.args))
-	copy(cpy, t.args)
+	for i := range t.args {
+		cpy[i] = unwrap(t.args[i])
+	}
 	return cpy
 }
 
 // Result returns the function's result type.
 func (t *Function) Result() Type {
+	return unwrap(t.result)
+}
+
+// Result returns the function's result type, without stripping name and description.
+func (t *Function) NamedResult() Type {
 	return t.result
 }
 
@@ -566,12 +646,13 @@ func (t *Function) UnmarshalJSON(bs []byte) error {
 	return nil
 }
 
-// Union returns a new function represnting the union of t and other. Functions
+// Union returns a new function representing the union of t and other. Functions
 // must have the same arity to be unioned.
 func (t *Function) Union(other *Function) *Function {
 	if other == nil {
 		return t
-	} else if t == nil {
+	}
+	if t == nil {
 		return other
 	}
 
@@ -608,7 +689,7 @@ type FuncArgs struct {
 }
 
 func (a FuncArgs) String() string {
-	var buf []string
+	buf := make([]string, 0, len(a.Args)+1)
 	for i := range a.Args {
 		buf = append(buf, Sprint(a.Args[i]))
 	}
@@ -618,6 +699,7 @@ func (a FuncArgs) String() string {
 	return "(" + strings.Join(buf, ", ") + ")"
 }
 
+// Arg returns the nth argument's type.
 func (a FuncArgs) Arg(x int) Type {
 	if x < len(a.Args) {
 		return a.Args[x]
@@ -627,6 +709,7 @@ func (a FuncArgs) Arg(x int) Type {
 
 // Compare returns -1, 0, 1 based on comparison between a and b.
 func Compare(a, b Type) int {
+	a, b = unwrap(a), unwrap(b)
 	x := typeOrder(a)
 	y := typeOrder(b)
 	if x > y {
@@ -731,7 +814,7 @@ func Compare(a, b Type) int {
 
 // Contains returns true if a is a superset or equal to b.
 func Contains(a, b Type) bool {
-	if any, ok := a.(Any); ok {
+	if any, ok := unwrap(a).(Any); ok {
 		return any.Contains(b)
 	}
 	return Compare(a, b) == 0
@@ -740,6 +823,7 @@ func Contains(a, b Type) bool {
 // Or returns a type that represents the union of a and b. If one type is a
 // superset of the other, the superset is returned unchanged.
 func Or(a, b Type) Type {
+	a, b = unwrap(a), unwrap(b)
 	if a == nil {
 		return b
 	} else if b == nil {
@@ -768,7 +852,7 @@ func Or(a, b Type) Type {
 
 // Select returns a property or item of a.
 func Select(a Type, x interface{}) Type {
-	switch a := a.(type) {
+	switch a := unwrap(a).(type) {
 	case *Array:
 		n, ok := x.(json.Number)
 		if !ok {
@@ -811,7 +895,7 @@ func Select(a Type, x interface{}) Type {
 // keys are always number types, for objects the keys are always string types,
 // and for sets the keys are always the type of the set element.
 func Keys(a Type) Type {
-	switch a := a.(type) {
+	switch a := unwrap(a).(type) {
 	case *Array:
 		return N
 	case *Object:
@@ -841,7 +925,7 @@ func Keys(a Type) Type {
 
 // Values returns the type of values that can be enumerated for a.
 func Values(a Type) Type {
-	switch a := a.(type) {
+	switch a := unwrap(a).(type) {
 	case *Array:
 		var tpe Type
 		for i := range a.static {
@@ -850,8 +934,8 @@ func Values(a Type) Type {
 		return Or(tpe, a.dynamic)
 	case *Object:
 		var tpe Type
-		for _, v := range a.static {
-			tpe = Or(tpe, v.Value)
+		for i := range a.static {
+			tpe = Or(tpe, a.static[i].Value)
 		}
 		if a.dynamic != nil {
 			tpe = Or(tpe, a.dynamic.Value)
@@ -874,7 +958,7 @@ func Values(a Type) Type {
 
 // Nil returns true if a's type is unknown.
 func Nil(a Type) bool {
-	switch a := a.(type) {
+	switch a := unwrap(a).(type) {
 	case nil:
 		return true
 	case *Function:
@@ -969,7 +1053,7 @@ func typeSliceCompare(a, b []Type) int {
 }
 
 func typeOrder(x Type) int {
-	switch x.(type) {
+	switch unwrap(x).(type) {
 	case Null:
 		return 0
 	case Boolean:
diff --git a/util/backoff.go b/util/backoff.go
index 1b126fbee4..6fbf63ef77 100644
--- a/util/backoff.go
+++ b/util/backoff.go
@@ -9,6 +9,17 @@ import (
 	"time"
 )
 
+func init() {
+	// NOTE(sr): We don't need good random numbers here; it's used for jittering
+	// the backup timing a bit. But anyways, let's make it random enough; without
+	// a call to rand.Seed() we'd get the same stream of numbers for each program
+	// run. (Or not, if some other packages happens to seed the global randomness
+	// source.)
+	// Note(philipc): rand.Seed() was deprecated in Go 1.20, so we've switched to
+	// using the recommended rand.New(rand.NewSource(seed)) style.
+	rand.New(rand.NewSource(time.Now().UnixNano()))
+}
+
 // DefaultBackoff returns a delay with an exponential backoff based on the
 // number of retries.
 func DefaultBackoff(base, max float64, retries int) time.Duration {
diff --git a/util/close.go b/util/close.go
index 97c9177311..c3c177557b 100644
--- a/util/close.go
+++ b/util/close.go
@@ -6,7 +6,6 @@ package util
 
 import (
 	"io"
-	"io/ioutil"
 	"net/http"
 )
 
@@ -15,7 +14,7 @@ import (
 // leak can occur.
 func Close(resp *http.Response) {
 	if resp != nil && resp.Body != nil {
-		if _, err := io.Copy(ioutil.Discard, resp.Body); err != nil {
+		if _, err := io.Copy(io.Discard, resp.Body); err != nil {
 			return
 		}
 		resp.Body.Close()
diff --git a/util/compare.go b/util/compare.go
index dd187590ba..8ae7753690 100644
--- a/util/compare.go
+++ b/util/compare.go
@@ -14,10 +14,9 @@ import (
 // Compare returns 0 if a equals b, -1 if a is less than b, and 1 if b is than a.
 //
 // For comparison between values of different types, the following ordering is used:
-// nil < bool < float64 < string < []interface{} < map[string]interface{}. Slices and maps
+// nil < bool < int, float64 < string < []interface{} < map[string]interface{}. Slices and maps
 // are compared recursively. If one slice or map is a subset of the other slice or map
 // it is considered "less than". Nil is always equal to nil.
-//
 func Compare(a, b interface{}) int {
 	aSortOrder := sortOrder(a)
 	bSortOrder := sortOrder(b)
@@ -45,6 +44,26 @@ func Compare(a, b interface{}) int {
 		case json.Number:
 			return compareJSONNumber(a, b)
 		}
+	case int:
+		switch b := b.(type) {
+		case int:
+			if a == b {
+				return 0
+			} else if a < b {
+				return -1
+			}
+			return 1
+		}
+	case float64:
+		switch b := b.(type) {
+		case float64:
+			if a == b {
+				return 0
+			} else if a < b {
+				return -1
+			}
+			return 1
+		}
 	case string:
 		switch b := b.(type) {
 		case string:
@@ -150,6 +169,10 @@ func sortOrder(v interface{}) int {
 		return boolSort
 	case json.Number:
 		return numberSort
+	case int:
+		return numberSort
+	case float64:
+		return numberSort
 	case string:
 		return stringSort
 	case []interface{}:
diff --git a/util/json.go b/util/json.go
index cfc94e0648..283c496973 100644
--- a/util/json.go
+++ b/util/json.go
@@ -105,6 +105,9 @@ func Reference(x interface{}) *interface{} {
 
 // Unmarshal decodes a YAML or JSON value into the specified type.
 func Unmarshal(bs []byte, v interface{}) error {
+	if json.Valid(bs) {
+		return UnmarshalJSON(bs, v)
+	}
 	bs, err := yaml.YAMLToJSON(bs)
 	if err != nil {
 		return err
diff --git a/util/json_test.go b/util/json_test.go
index c0996d3d23..62e39b70b4 100644
--- a/util/json_test.go
+++ b/util/json_test.go
@@ -112,3 +112,13 @@ func TestReference(t *testing.T) {
 		})
 	}
 }
+
+// There's valid JSON that doesn't pass through yaml.YAMLToJSON.
+// See https://github.com/open-policy-agent/opa/issues/4673
+func TestInvalidYAMLValidJSON(t *testing.T) {
+	x := []byte{0x22, 0x3a, 0xc2, 0x9a, 0x22}
+	y := ""
+	if err := util.Unmarshal(x, &y); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/util/test/benchmark.go b/util/test/benchmark.go
index c232f7562f..1af3eaa2d0 100644
--- a/util/test/benchmark.go
+++ b/util/test/benchmark.go
@@ -11,6 +11,73 @@ import (
 	"text/template"
 )
 
+// PartialObjectBenchmarkCrossModule returns a module with n "bench_test_" prefixed rules
+// that each refer to another "cond_bench_" prefixed rule
+func PartialObjectBenchmarkCrossModule(n int) []string {
+	fooMod := `package test.foo
+    import data.test.bar
+	import data.test.baz
+
+	output[key] := value {
+		value := bar[key]
+		startswith("bench_test_", key)
+	}`
+	barMod := "package test.bar\n"
+	barMod += `
+	cond_bench_0 {
+		contains(lower(input.test_input_0), lower("input_01"))
+	}
+	cond_bench_1 {
+		contains(lower(input.test_input_1), lower("input"))
+	}
+	cond_bench_2 {
+		contains(lower(input.test_input_2), lower("input_10"))
+	}
+    bench_test_out_result := load_tests(test_collector)
+
+    load_tests(in) := out {
+		out := in
+	}
+    `
+
+	bazMod := "package test.baz\nimport data.test.bar\n"
+	ruleBuilder := ""
+
+	for idx := 1; idx <= n; idx++ {
+		barMod += fmt.Sprintf(`
+		bench_test_%[1]d := result {
+            input.bench_test_collector_mambo_number_%[3]d
+			result := input.bench_test_collector_mambo_number_%[3]d
+        } else := result {
+			is_null(bench_test_out_result.mambo_number_%[3]d.error)
+			result := bench_test_out_result.mambo_number_%[3]d.result
+		}
+
+        test_collector["mambo_number_%[3]d"] := result {
+			cond_bench_%[2]d
+			not %[3]d == 2
+			not %[3]d == 3
+			not input.bench_test_collector_mambo_number_%[3]d
+			result := { "result": %[3]d, "error": null }
+		}
+		`, idx, idx%3, idx%5)
+		ruleBuilder += fmt.Sprintf("    bar.bench_test_%[1]d == %[1]d\n", idx)
+		if idx%10 == 0 {
+			bazMod += fmt.Sprintf(`rule_%d {
+				%s
+			}`, idx, ruleBuilder)
+			fooMod += fmt.Sprintf(`
+			final_decision = "allow" {
+				baz.rule_%d
+			}
+			`, idx)
+			ruleBuilder = ""
+		}
+	}
+
+	return []string{fooMod, barMod, bazMod}
+}
+
 // ArrayIterationBenchmarkModule returns a module that iterates an array
 // with `n` elements
 func ArrayIterationBenchmarkModule(n int) string {
diff --git a/util/test/ci_skip.go b/util/test/ci_skip.go
new file mode 100644
index 0000000000..3380c15925
--- /dev/null
+++ b/util/test/ci_skip.go
@@ -0,0 +1,10 @@
+//go:build !darwin
+// +build !darwin
+
+package test
+
+import "testing"
+
+// Skip will skip this test on pull request CI runs.
+// Used for slow test runners on GHA's darwin machines.
+func Skip(*testing.T) {}
diff --git a/util/test/ci_skip_darwin.go b/util/test/ci_skip_darwin.go
new file mode 100644
index 0000000000..ae440dfb39
--- /dev/null
+++ b/util/test/ci_skip_darwin.go
@@ -0,0 +1,15 @@
+package test
+
+import (
+	"os"
+	"testing"
+)
+
+// Skip will skip this test on pull request CI runs.
+// Used for slow test runners on GHA's darwin machines.
+func Skip(t *testing.T) {
+	if os.Getenv("GITHUB_ACTIONS") == "" {
+		return
+	}
+	t.Skip("skipped on Darwin, test runner is slow")
+}
diff --git a/util/test/tempfs.go b/util/test/tempfs.go
index 33957602bc..3975640899 100644
--- a/util/test/tempfs.go
+++ b/util/test/tempfs.go
@@ -5,9 +5,10 @@
 package test
 
 import (
-	"io/ioutil"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"testing/fstest"
 )
 
 // WithTempFS creates a temporary directory structure and invokes f with the
@@ -27,7 +28,7 @@ func WithTempFS(files map[string]string, f func(string)) {
 // creation succeeds, the caller should invoke cleanup when they are done.
 func MakeTempFS(root, prefix string, files map[string]string) (rootDir string, cleanup func(), err error) {
 
-	rootDir, err = ioutil.TempDir(root, prefix)
+	rootDir, err = os.MkdirTemp(root, prefix)
 
 	if err != nil {
 		return "", nil, err
@@ -67,3 +68,23 @@ func MakeTempFS(root, prefix string, files map[string]string) (rootDir string, c
 
 	return rootDir, cleanup, nil
 }
+
+// WithTestFS creates a temporary file system of `files` in memory
+// if `inMemoryFS` is true and invokes `f“ with that filesystem
+func WithTestFS(files map[string]string, inMemoryFS bool, f func(string, fs.FS)) {
+	if inMemoryFS {
+		fsys := make(fstest.MapFS)
+		rootDir := "."
+		for k, v := range files {
+			fsys[filepath.Join(rootDir, k)] = &fstest.MapFile{Data: []byte(v)}
+		}
+		f(rootDir, fsys)
+	} else {
+		rootDir, cleanup, err := MakeTempFS("", "opa_test", files)
+		if err != nil {
+			panic(err)
+		}
+		defer cleanup()
+		f(rootDir, nil)
+	}
+}
diff --git a/vendor/github.com/OneOfOne/xxhash/go.mod b/vendor/github.com/OneOfOne/xxhash/go.mod
deleted file mode 100644
index c6da85e0af..0000000000
--- a/vendor/github.com/OneOfOne/xxhash/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/OneOfOne/xxhash
-
-go 1.11
diff --git a/vendor/github.com/agnivade/levenshtein/.gitignore b/vendor/github.com/agnivade/levenshtein/.gitignore
new file mode 100644
index 0000000000..345780a444
--- /dev/null
+++ b/vendor/github.com/agnivade/levenshtein/.gitignore
@@ -0,0 +1,5 @@
+coverage.txt
+fuzz/fuzz-fuzz.zip
+fuzz/corpus/corpus/*
+fuzz/corpus/suppressions/*
+fuzz/corpus/crashes/*
diff --git a/vendor/github.com/agnivade/levenshtein/.travis.yml b/vendor/github.com/agnivade/levenshtein/.travis.yml
new file mode 100644
index 0000000000..0873fa983f
--- /dev/null
+++ b/vendor/github.com/agnivade/levenshtein/.travis.yml
@@ -0,0 +1,23 @@
+language: go
+
+# See https://travis-ci.community/t/goos-js-goarch-wasm-go-run-fails-panic-newosproc-not-implemented/1651
+#addons:
+#  chrome: stable
+
+before_install:
+- export GO111MODULE=on
+
+#install:
+#- go get github.com/agnivade/wasmbrowsertest
+#- mv $GOPATH/bin/wasmbrowsertest $GOPATH/bin/go_js_wasm_exec
+#- export PATH=$GOPATH/bin:$PATH
+
+go:
+- 1.13.x
+- 1.14.x
+- 1.15.x
+- tip
+
+script:
+#- GOOS=js GOARCH=wasm go test -v
+- go test -v
diff --git a/vendor/github.com/agnivade/levenshtein/License.txt b/vendor/github.com/agnivade/levenshtein/License.txt
new file mode 100644
index 0000000000..54b51f4993
--- /dev/null
+++ b/vendor/github.com/agnivade/levenshtein/License.txt
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Agniva De Sarker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/agnivade/levenshtein/Makefile b/vendor/github.com/agnivade/levenshtein/Makefile
new file mode 100644
index 0000000000..5f6890d613
--- /dev/null
+++ b/vendor/github.com/agnivade/levenshtein/Makefile
@@ -0,0 +1,15 @@
+all: test install
+
+install:
+	go install
+
+lint:
+	gofmt -l -s -w . && go vet . && golint -set_exit_status=1 .
+
+test: # The first 2 go gets are to support older Go versions
+	go get github.com/arbovm/levenshtein
+	go get github.com/dgryski/trifles/leven
+	GO111MODULE=on go test -race -v -coverprofile=coverage.txt -covermode=atomic
+
+bench:
+	go test -run=XXX -bench=. -benchmem -count=5
diff --git a/vendor/github.com/agnivade/levenshtein/README.md b/vendor/github.com/agnivade/levenshtein/README.md
new file mode 100644
index 0000000000..13c52a2101
--- /dev/null
+++ b/vendor/github.com/agnivade/levenshtein/README.md
@@ -0,0 +1,80 @@
+levenshtein [![Build Status](https://travis-ci.org/agnivade/levenshtein.svg?branch=master)](https://travis-ci.org/agnivade/levenshtein) [![Go Report Card](https://goreportcard.com/badge/github.com/agnivade/levenshtein)](https://goreportcard.com/report/github.com/agnivade/levenshtein) [![PkgGoDev](https://pkg.go.dev/badge/github.com/agnivade/levenshtein)](https://pkg.go.dev/github.com/agnivade/levenshtein)
+===========
+
+[Go](http://golang.org) package to calculate the [Levenshtein Distance](http://en.wikipedia.org/wiki/Levenshtein_distance)
+
+The library is fully capable of working with non-ascii strings. But the strings are not normalized. That is left as a user-dependant use case. Please normalize the strings before passing it to the library if you have such a requirement.
+- https://blog.golang.org/normalization
+
+#### Limitation
+
+As a performance optimization, the library can handle strings only up to 65536 characters (runes). If you need to handle strings larger than that, please pin to version 1.0.3.
+
+Install
+-------
+
+    go get github.com/agnivade/levenshtein
+
+Example
+-------
+
+```go
+package main
+
+import (
+	"fmt"
+	"github.com/agnivade/levenshtein"
+)
+
+func main() {
+	s1 := "kitten"
+	s2 := "sitting"
+	distance := levenshtein.ComputeDistance(s1, s2)
+	fmt.Printf("The distance between %s and %s is %d.\n", s1, s2, distance)
+	// Output:
+	// The distance between kitten and sitting is 3.
+}
+
+```
+
+Benchmarks
+----------
+
+```
+name              time/op
+Simple/ASCII-4     330ns ± 2%
+Simple/French-4    617ns ± 2%
+Simple/Nordic-4   1.16µs ± 4%
+Simple/Tibetan-4  1.05µs ± 1%
+
+name              alloc/op
+Simple/ASCII-4     96.0B ± 0%
+Simple/French-4     128B ± 0%
+Simple/Nordic-4     192B ± 0%
+Simple/Tibetan-4    144B ± 0%
+
+name              allocs/op
+Simple/ASCII-4      1.00 ± 0%
+Simple/French-4     1.00 ± 0%
+Simple/Nordic-4     1.00 ± 0%
+Simple/Tibetan-4    1.00 ± 0%
+```
+
+Comparisons with other libraries
+--------------------------------
+
+```
+name                     time/op
+Leven/ASCII/agniva-4      353ns ± 1%
+Leven/ASCII/arbovm-4      485ns ± 1%
+Leven/ASCII/dgryski-4     395ns ± 0%
+Leven/French/agniva-4     648ns ± 1%
+Leven/French/arbovm-4     791ns ± 0%
+Leven/French/dgryski-4    682ns ± 0%
+Leven/Nordic/agniva-4    1.28µs ± 1%
+Leven/Nordic/arbovm-4    1.52µs ± 1%
+Leven/Nordic/dgryski-4   1.32µs ± 1%
+Leven/Tibetan/agniva-4   1.12µs ± 1%
+Leven/Tibetan/arbovm-4   1.31µs ± 0%
+Leven/Tibetan/dgryski-4  1.16µs ± 0%
+```
diff --git a/vendor/github.com/agnivade/levenshtein/levenshtein.go b/vendor/github.com/agnivade/levenshtein/levenshtein.go
new file mode 100644
index 0000000000..f727a66fe7
--- /dev/null
+++ b/vendor/github.com/agnivade/levenshtein/levenshtein.go
@@ -0,0 +1,89 @@
+// Package levenshtein is a Go implementation to calculate Levenshtein Distance.
+//
+// Implementation taken from
+// https://gist.github.com/andrei-m/982927#gistcomment-1931258
+package levenshtein
+
+import "unicode/utf8"
+
+// minLengthThreshold is the length of the string beyond which
+// an allocation will be made. Strings smaller than this will be
+// zero alloc.
+const minLengthThreshold = 32
+
+// ComputeDistance computes the levenshtein distance between the two
+// strings passed as an argument. The return value is the levenshtein distance
+//
+// Works on runes (Unicode code points) but does not normalize
+// the input strings. See https://blog.golang.org/normalization
+// and the golang.org/x/text/unicode/norm package.
+func ComputeDistance(a, b string) int {
+	if len(a) == 0 {
+		return utf8.RuneCountInString(b)
+	}
+
+	if len(b) == 0 {
+		return utf8.RuneCountInString(a)
+	}
+
+	if a == b {
+		return 0
+	}
+
+	// We need to convert to []rune if the strings are non-ASCII.
+	// This could be avoided by using utf8.RuneCountInString
+	// and then doing some juggling with rune indices,
+	// but leads to far more bounds checks. It is a reasonable trade-off.
+	s1 := []rune(a)
+	s2 := []rune(b)
+
+	// swap to save some memory O(min(a,b)) instead of O(a)
+	if len(s1) > len(s2) {
+		s1, s2 = s2, s1
+	}
+	lenS1 := len(s1)
+	lenS2 := len(s2)
+
+	// Init the row.
+	var x []uint16
+	if lenS1+1 > minLengthThreshold {
+		x = make([]uint16, lenS1+1)
+	} else {
+		// We make a small optimization here for small strings.
+		// Because a slice of constant length is effectively an array,
+		// it does not allocate. So we can re-slice it to the right length
+		// as long as it is below a desired threshold.
+		x = make([]uint16, minLengthThreshold)
+		x = x[:lenS1+1]
+	}
+
+	// we start from 1 because index 0 is already 0.
+	for i := 1; i < len(x); i++ {
+		x[i] = uint16(i)
+	}
+
+	// make a dummy bounds check to prevent the 2 bounds check down below.
+	// The one inside the loop is particularly costly.
+	_ = x[lenS1]
+	// fill in the rest
+	for i := 1; i <= lenS2; i++ {
+		prev := uint16(i)
+		for j := 1; j <= lenS1; j++ {
+			current := x[j-1] // match
+			if s2[i-1] != s1[j-1] {
+				current = min(min(x[j-1]+1, prev+1), x[j]+1)
+			}
+			x[j-1] = prev
+			prev = current
+		}
+		x[lenS1] = prev
+	}
+	return int(x[lenS1])
+}
+
+func min(a, b uint16) uint16 {
+	if a < b {
+		return a
+	}
+	return b
+}
diff --git a/vendor/github.com/andreyvit/diff/.gitignore b/vendor/github.com/andreyvit/diff/.gitignore
new file mode 100644
index 0000000000..daf913b1b3
--- /dev/null
+++ b/vendor/github.com/andreyvit/diff/.gitignore
@@ -0,0 +1,24 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
diff --git a/vendor/github.com/andreyvit/diff/LICENSE b/vendor/github.com/andreyvit/diff/LICENSE
new file mode 100644
index 0000000000..05b98e1f78
--- /dev/null
+++ b/vendor/github.com/andreyvit/diff/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Andrey Tarantsov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/andreyvit/diff/README.md b/vendor/github.com/andreyvit/diff/README.md
new file mode 100644
index 0000000000..5b52fea8af
--- /dev/null
+++ b/vendor/github.com/andreyvit/diff/README.md
@@ -0,0 +1,28 @@
+# diff
+
+Quick'n'easy string diffing functions for Golang based on [github.com/sergi/go-diff](https://github.com/sergi/go-diff). Mainly for diffing strings in tests.
+
+See [the docs on GoDoc](https://godoc.org/github.com/andreyvit/diff).
+
+Get it:
+
+    go get -u github.com/andreyvit/diff
+
+Example:
+
+    import (
+        "strings"
+        "testing"
+        "github.com/andreyvit/diff"
+    )
+
+    const expected = `
+    ...
+    `
+
+    func TestFoo(t *testing.T) {
+        actual := Foo(...)
+        if a, e := strings.TrimSpace(actual), strings.TrimSpace(expected); a != e {
+            t.Errorf("Result not as expected:\n%v", diff.LineDiff(e, a))
+        }
+    }
diff --git a/vendor/github.com/andreyvit/diff/diff.go b/vendor/github.com/andreyvit/diff/diff.go
new file mode 100644
index 0000000000..12953c83a3
--- /dev/null
+++ b/vendor/github.com/andreyvit/diff/diff.go
@@ -0,0 +1,128 @@
+package diff
+
+import (
+	"bytes"
+	"strings"
+
+	"github.com/sergi/go-diff/diffmatchpatch"
+)
+
+func diff(a, b string) []diffmatchpatch.Diff {
+	dmp := diffmatchpatch.New()
+	diffs := dmp.DiffMain(a, b, true)
+	if len(diffs) > 2 {
+		diffs = dmp.DiffCleanupSemantic(diffs)
+		diffs = dmp.DiffCleanupEfficiency(diffs)
+	}
+	return diffs
+}
+
+// CharacterDiff returns an inline diff between the two strings, using (++added++) and (~~deleted~~) markup.
+func CharacterDiff(a, b string) string {
+	return diffsToString(diff(a, b))
+}
+
+func diffsToString(diffs []diffmatchpatch.Diff) string {
+	var buff bytes.Buffer
+	for _, diff := range diffs {
+		text := diff.Text
+		switch diff.Type {
+		case diffmatchpatch.DiffInsert:
+			buff.WriteString("(++")
+			buff.WriteString(text)
+			buff.WriteString("++)")
+		case diffmatchpatch.DiffDelete:
+			buff.WriteString("(~~")
+			buff.WriteString(text)
+			buff.WriteString("~~)")
+		case diffmatchpatch.DiffEqual:
+			buff.WriteString(text)
+		}
+	}
+	return buff.String()
+}
+
+// LineDiff returns a normal linewise diff between the two given strings.
+func LineDiff(a, b string) string {
+	return strings.Join(LineDiffAsLines(a, b), "\n")
+}
+
+// LineDiffAsLines returns the lines of a linewise diff between the two given strings.
+func LineDiffAsLines(a, b string) []string {
+	return diffsToPatchLines(diff(a, b))
+}
+
+type patchBuilder struct {
+	output        []string
+	oldLines      []string
+	newLines      []string
+	newLineBuffer bytes.Buffer
+	oldLineBuffer bytes.Buffer
+}
+
+func (b *patchBuilder) AddCharacters(text string, op diffmatchpatch.Operation) {
+	if op == diffmatchpatch.DiffInsert || op == diffmatchpatch.DiffEqual {
+		b.newLineBuffer.WriteString(text)
+	}
+	if op == diffmatchpatch.DiffDelete || op == diffmatchpatch.DiffEqual {
+		b.oldLineBuffer.WriteString(text)
+	}
+}
+func (b *patchBuilder) AddNewline(op diffmatchpatch.Operation) {
+	oldLine := b.oldLineBuffer.String()
+	newLine := b.newLineBuffer.String()
+
+	if op == diffmatchpatch.DiffEqual && (oldLine == newLine) {
+		b.FlushChunk()
+		b.output = append(b.output, " "+newLine)
+		b.oldLineBuffer.Reset()
+		b.newLineBuffer.Reset()
+	} else {
+		if op == diffmatchpatch.DiffDelete || op == diffmatchpatch.DiffEqual {
+			b.oldLines = append(b.oldLines, "-"+oldLine)
+			b.oldLineBuffer.Reset()
+		}
+		if op == diffmatchpatch.DiffInsert || op == diffmatchpatch.DiffEqual {
+			b.newLines = append(b.newLines, "+"+newLine)
+			b.newLineBuffer.Reset()
+		}
+	}
+}
+func (b *patchBuilder) FlushChunk() {
+	if b.oldLines != nil {
+		b.output = append(b.output, b.oldLines...)
+		b.oldLines = nil
+	}
+	if b.newLines != nil {
+		b.output = append(b.output, b.newLines...)
+		b.newLines = nil
+	}
+}
+func (b *patchBuilder) Flush() {
+	if b.oldLineBuffer.Len() > 0 && b.newLineBuffer.Len() > 0 {
+		b.AddNewline(diffmatchpatch.DiffEqual)
+	} else if b.oldLineBuffer.Len() > 0 {
+		b.AddNewline(diffmatchpatch.DiffDelete)
+	} else if b.newLineBuffer.Len() > 0 {
+		b.AddNewline(diffmatchpatch.DiffInsert)
+	}
+	b.FlushChunk()
+}
+
+func diffsToPatchLines(diffs []diffmatchpatch.Diff) []string {
+	b := new(patchBuilder)
+	b.output = make([]string, 0, len(diffs))
+
+	for _, diff := range diffs {
+		lines := strings.Split(diff.Text, "\n")
+		for idx, line := range lines {
+			if idx > 0 {
+				b.AddNewline(diff.Type)
+			}
+			b.AddCharacters(line, diff.Type)
+		}
+	}
+
+	b.Flush()
+	return b.output
+}
diff --git a/vendor/github.com/andreyvit/diff/doc.go b/vendor/github.com/andreyvit/diff/doc.go
new file mode 100644
index 0000000000..98e2470833
--- /dev/null
+++ b/vendor/github.com/andreyvit/diff/doc.go
@@ -0,0 +1,2 @@
+// diff provides quick and easy string diffing functions based on github.com/sergi/go-diff, mainly for diffing strings in tests
+package diff
diff --git a/vendor/github.com/andreyvit/diff/trim.go b/vendor/github.com/andreyvit/diff/trim.go
new file mode 100644
index 0000000000..87871f99a1
--- /dev/null
+++ b/vendor/github.com/andreyvit/diff/trim.go
@@ -0,0 +1,19 @@
+package diff
+
+import (
+	"strings"
+)
+
+// TrimLines applies TrimSpace to each string in the given array.
+func TrimLines(input []string) []string {
+	result := make([]string, 0, len(input))
+	for _, el := range input {
+		result = append(result, strings.TrimSpace(el))
+	}
+	return result
+}
+
+// TrimLinesInString applies TrimSpace to each line in the given string, and returns the new trimmed string. Empty lines are not removed.
+func TrimLinesInString(input string) string {
+	return strings.Join(TrimLines(strings.Split(strings.TrimSpace(input), "\n")), "\n")
+}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/BUILD.bazel b/vendor/github.com/bytecodealliance/wasmtime-go/BUILD.bazel
deleted file mode 100644
index 90f8f158f3..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/BUILD.bazel
+++ /dev/null
@@ -1,99 +0,0 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-
-cc_library(
-    name = "wasmtime",
-    srcs = select({
-        "@io_bazel_rules_go//go/platform:darwin_amd64": ["build/macos-x86_64/libwasmtime.a"],
-        "@io_bazel_rules_go//go/platform:linux_amd64": ["build/linux-x86_64/libwasmtime.a"],
-        "@io_bazel_rules_go//go/platform:windows_amd64": ["build/windows-x86_64/libwasmtime.a"],
-    }),
-    hdrs = glob(["build/include/**/*.h"]),
-    includes = ["build/include"],
-    visibility = ["//visibility:public"],
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "config.go",
-        "doc.go",
-        "engine.go",
-        "error.go",
-        "exporttype.go",
-        "extern.go",
-        "externtype.go",
-        "ffi.go",
-        "func.go",
-        "functype.go",
-        "global.go",
-        "globaltype.go",
-        "importtype.go",
-        "instance.go",
-        "instancetype.go",
-        "linker.go",
-        "maybe_gc_no.go",
-        "memory.go",
-        "memorytype.go",
-        "module.go",
-        "moduletype.go",
-        "shims.c",
-        "shims.h",
-        "slab.go",
-        "store.go",
-        "table.go",
-        "tabletype.go",
-        "trap.go",
-        "val.go",
-        "valtype.go",
-        "wasi.go",
-        "wat2wasm.go",
-    ],
-    cdeps = [":wasmtime"],  # add wasmtime dep
-    cgo = True,
-    clinkopts = select({
-        "@io_bazel_rules_go//go/platform:windows": [
-            "-luserenv -lole32 -lntdll -lws2_32 -lkernel32 -lbcrypt",
-        ],
-        "//conditions:default": ["-lm -ldl"],
-    }),
-    copts = [
-        "-Ibuild/include",
-    ] + select({
-        "@io_bazel_rules_go//go/platform:windows": [
-            "-DWASM_API_EXTERN= -DWASI_API_EXTERN=",
-        ],
-        "//conditions:default": [],
-    }),
-    importpath = "github.com/bytecodealliance/wasmtime-go",
-    visibility = ["//visibility:public"],
-)
-
-go_test(
-    name = "go_default_test",
-    srcs = [
-        "config_test.go",
-        "doc_test.go",
-        "engine_test.go",
-        "exporttype_test.go",
-        "func_test.go",
-        "functype_test.go",
-        "global_test.go",
-        "globaltype_test.go",
-        "importtype_test.go",
-        "instance_test.go",
-        "linker_test.go",
-        "memorytype_test.go",
-        "module_linking_test.go",
-        "module_test.go",
-        "reftypes_test.go",
-        "slab_test.go",
-        "store_test.go",
-        "table_test.go",
-        "tabletype_test.go",
-        "trap_test.go",
-        "valtype_test.go",
-        "wasi_test.go",
-        "wasm2wat_test.go",
-    ],
-    embed = [":go_default_library"],
-)
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/README.md b/vendor/github.com/bytecodealliance/wasmtime-go/README.md
deleted file mode 100644
index 15818ff2e8..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/README.md
+++ /dev/null
@@ -1,153 +0,0 @@
-<div align="center">
-  <h1><code>wasmtime-go</code></h1>
-
-  <p>
-    <strong>Go embedding of
-    <a href="https://github.com/bytecodealliance/wasmtime">Wasmtime</a></strong>
-  </p>
-
-  <strong>A <a href="https://bytecodealliance.org/">Bytecode Alliance</a> project</strong>
-
-  <p>
-    <a href="https://github.com/bytecodealliance/wasmtime-go/actions?query=workflow%3ACI">
-      <img src="https://github.com/bytecodealliance/wasmtime-go/workflows/CI/badge.svg" alt="CI status"/>
-    </a>
-    <a href="https://pkg.go.dev/github.com/bytecodealliance/wasmtime-go">
-      <img src="https://godoc.org/github.com/bytecodealliance/wasmtime-go?status.svg" alt="Documentation"/>
-    </a>
-    <a href="https://bytecodealliance.github.io/wasmtime-go/coverage.html">
-      <img src="https://img.shields.io/badge/coverage-main-green" alt="Code Coverage"/>
-    </a>
-  </p>
-
-</div>
-
-## Installation
-
-```sh
-go get -u github.com/bytecodealliance/wasmtime-go@v0.31.0
-```
-
-Be sure to check out the [API documentation][api]!
-
-This Go library uses CGO to consume the C API of the [Wasmtime
-project][wasmtime] which is written in Rust. Precompiled binaries of Wasmtime
-are checked into this repository on tagged releases so you won't have to install
-Wasmtime locally, but it means that this project only works on Linux x86\_64,
-macOS x86\_64 , and Windows x86\_64 currently. Building on other platforms will
-need to arrange to build Wasmtime and use `CGO_*` env vars to compile correctly.
-
-This project has been tested with Go 1.13 or later. It is not recommended to
-use Go 1.14 earlier than Go 1.14.11 on macOS due to a [bug in the Go runtime][bug].
-
-[api]: https://pkg.go.dev/github.com/bytecodealliance/wasmtime-go
-[wasmtime]: https://github.com/bytecodealliance/wasmtime
-[bug]: https://github.com/golang/go/issues/39079
-
-
-If you are a bazel user, add following to your WORKSPACE file:
-
-```
-go_repository(
-    name = "com_github_bytecodealliance_wasmtime_go",
-    importpath = "github.com/bytecodealliance/wasmtime-go",
-    version = "v0.31.0",
-)
-```
-
-## Usage
-
-A "Hello, world!" example of using this package looks like:
-
-```go
-package main
-
-import (
-    "fmt"
-    "github.com/bytecodealliance/wasmtime-go"
-)
-
-func main() {
-    // Almost all operations in wasmtime require a contextual `store`
-    // argument to share, so create that first
-    store := wasmtime.NewStore(wasmtime.NewEngine())
-
-    // Compiling modules requires WebAssembly binary input, but the wasmtime
-    // package also supports converting the WebAssembly text format to the
-    // binary format.
-    wasm, err := wasmtime.Wat2Wasm(`
-      (module
-        (import "" "hello" (func $hello))
-        (func (export "run")
-          (call $hello))
-      )
-    `)
-    check(err)
-
-    // Once we have our binary `wasm` we can compile that into a `*Module`
-    // which represents compiled JIT code.
-    module, err := wasmtime.NewModule(store.Engine, wasm)
-    check(err)
-
-    // Our `hello.wat` file imports one item, so we create that function
-    // here.
-    item := wasmtime.WrapFunc(store, func() {
-        fmt.Println("Hello from Go!")
-    })
-
-    // Next up we instantiate a module which is where we link in all our
-    // imports. We've got one import so we pass that in here.
-    instance, err := wasmtime.NewInstance(store, module, []wasmtime.AsExtern{item})
-    check(err)
-
-    // After we've instantiated we can lookup our `run` function and call
-    // it.
-    run := instance.GetExport(store, "run").Func()
-    _, err = run.Call(store)
-    check(err)
-}
-
-func check(e error) {
-    if e != nil {
-        panic(e)
-    }
-}
-```
-
-## Contributing
-
-So far this extension has been written by folks who are primarily Rust
-programmers, so it's highly likely that there's some faux pas in terms of Go
-idioms. Feel free to send a PR to help make things more idiomatic if you see
-something!
-
-To work on this extension locally you'll first want to clone the project:
-
-```sh
-$ git clone https://github.com/bytecodealliance/wasmtime-go
-```
-
-Next up you'll want to have a [local Wasmtime build
-available](https://bytecodealliance.github.io/wasmtime/contributing-building.html).
-
-You'll need to build at least the `wasmtime-c-api` crate, which, at the time of
-this writing, would be:
-
-```sh
-$ cargo build -p wasmtime-c-api
-```
-
-Once you've got that you can set up the environment of this library with:
-
-```sh
-$ ./ci/local.sh /path/to/wasmtime
-```
-
-This will create a `build` directory which has the compiled libraries and header
-files. Next up you can run normal commands such as:
-
-```sh
-$ go test
-```
-
-And after that you should be good to go!
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/WORKSPACE b/vendor/github.com/bytecodealliance/wasmtime-go/WORKSPACE
deleted file mode 100644
index f2dcd75d15..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/WORKSPACE
+++ /dev/null
@@ -1,16 +0,0 @@
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-http_archive(
-    name = "io_bazel_rules_go",
-    sha256 = "7904dbecbaffd068651916dce77ff3437679f9d20e1a7956bff43826e7645fcc",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.25.1/rules_go-v0.25.1.tar.gz",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.25.1/rules_go-v0.25.1.tar.gz",
-    ],
-)
-
-load("@io_bazel_rules_go//go:deps.bzl", "go_rules_dependencies", "go_register_toolchains")
-
-go_rules_dependencies()
-
-go_register_toolchains(version = "1.16")
\ No newline at end of file
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/error.h b/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/error.h
deleted file mode 100644
index 2ffee72bed..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/error.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * \file wasmtime/error.h
- *
- * \brief Definition and accessors of #wasmtime_error_t
- */
-
-#ifndef WASMTIME_ERROR_H
-#define WASMTIME_ERROR_H
-
-#include <wasm.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * \typedef wasmtime_error_t
- * \brief Convenience alias for #wasmtime_error
- *
- * \struct wasmtime_error
- * \brief Errors generated by Wasmtime.
- * \headerfile wasmtime/error.h
- *
- * This opaque type represents an error that happened as part of one of the
- * functions below. Errors primarily have an error message associated with them
- * at this time, which you can acquire by calling #wasmtime_error_message.
- *
- * Errors are safe to share across threads and must be deleted with
- * #wasmtime_error_delete.
- */
-typedef struct wasmtime_error wasmtime_error_t;
-
-/**
- * \brief Deletes an error.
- */
-WASM_API_EXTERN void wasmtime_error_delete(wasmtime_error_t *error);
-
-/**
- * \brief Returns the string description of this error.
- *
- * This will "render" the error to a string and then return the string
- * representation of the error to the caller. The `message` argument should be
- * uninitialized before this function is called and the caller is responsible
- * for deallocating it with #wasm_byte_vec_delete afterwards.
- */
-WASM_API_EXTERN void wasmtime_error_message(
-    const wasmtime_error_t *error,
-    wasm_name_t *message
-);
-
-#ifdef __cplusplus
-}  // extern "C"
-#endif
-
-#endif // WASMTIME_ERROR_H
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/instance.h b/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/instance.h
deleted file mode 100644
index 6058d21701..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/instance.h
+++ /dev/null
@@ -1,158 +0,0 @@
-/**
- * \file wasmtime/instance.h
- *
- * Wasmtime APIs for interacting with wasm instances.
- */
-
-#ifndef WASMTIME_INSTANCE_H
-#define WASMTIME_INSTANCE_H
-
-#include <wasm.h>
-#include <wasmtime/extern.h>
-#include <wasmtime/module.h>
-#include <wasmtime/store.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * \brief An opaque object representing the type of an instance.
- */
-typedef struct wasmtime_instancetype wasmtime_instancetype_t;
-
-/// \brief Deletes an instance type
-WASM_API_EXTERN void wasmtime_instancetype_delete(wasmtime_instancetype_t *ty);
-
-/**
- * \brief Returns the list of exports that this instance type provides.
- *
- * This function does not take ownership of the provided instance type but
- * ownership of `out` is passed to the caller. Note that `out` is treated as
- * uninitialized when passed to this function.
- */
-WASM_API_EXTERN void wasmtime_instancetype_exports(const wasmtime_instancetype_t*, wasm_exporttype_vec_t* out);
-
-/**
- * \brief Converts a #wasmtime_instancetype_t to a #wasm_externtype_t
- *
- * The returned value is owned by the #wasmtime_instancetype_t argument and should not
- * be deleted.
- */
-WASM_API_EXTERN wasm_externtype_t* wasmtime_instancetype_as_externtype(wasmtime_instancetype_t*);
-
-/**
- * \brief Attempts to convert a #wasm_externtype_t to a #wasmtime_instancetype_t
- *
- * The returned value is owned by the #wasmtime_instancetype_t argument and should not
- * be deleted. Returns `NULL` if the provided argument is not a
- * #wasmtime_instancetype_t.
- */
-WASM_API_EXTERN wasmtime_instancetype_t* wasmtime_externtype_as_instancetype(wasm_externtype_t*);
-
-/**
- * \brief Instantiate a wasm module.
- *
- * This function will instantiate a WebAssembly module with the provided
- * imports, creating a WebAssembly instance. The returned instance can then
- * afterwards be inspected for exports.
- *
- * \param store the store in which to create the instance
- * \param module the module that's being instantiated
- * \param imports the imports provided to the module
- * \param nimports the size of `imports`
- * \param instance where to store the returned instance
- * \param trap where to store the returned trap
- *
- * This function requires that `imports` is the same size as the imports that
- * `module` has. Additionally the `imports` array must be 1:1 lined up with the
- * imports of the `module` specified. This is intended to be relatively low
- * level, and #wasmtime_linker_instantiate is provided for a more ergonomic
- * name-based resolution API.
- *
- * The states of return values from this function are similar to
- * #wasmtime_func_call where an error can be returned meaning something like a
- * link error in this context. A trap can be returned (meaning no error or
- * instance is returned), or an instance can be returned (meaning no error or
- * trap is returned).
- *
- * Note that this function requires that all `imports` specified must be owned
- * by the `store` provided as well.
- *
- * This function does not take ownership of any of its arguments, but all return
- * values are owned by the caller.
- */
-WASM_API_EXTERN wasmtime_error_t *wasmtime_instance_new(
-    wasmtime_context_t *store,
-    const wasmtime_module_t *module,
-    const wasmtime_extern_t* imports,
-    size_t nimports,
-    wasmtime_instance_t *instance,
-    wasm_trap_t **trap
-);
-
-/**
- * \brief Returns the type of the specified instance.
- *
- * The returned type is owned by the caller.
- */
-WASM_API_EXTERN wasmtime_instancetype_t *wasmtime_instance_type(
-    const wasmtime_context_t *store,
-    const wasmtime_instance_t *instance
-);
-
-/**
- * \brief Get an export by name from an instance.
- *
- * \param store the store that owns `instance`
- * \param instance the instance to lookup within
- * \param name the export name to lookup
- * \param name_len the byte length of `name`
- * \param item where to store the returned value
- *
- * Returns nonzero if the export was found, and `item` is filled in. Otherwise
- * returns 0.
- *
- * Doesn't take ownership of any arguments but does return ownership of the
- * #wasmtime_extern_t.
- */
-WASM_API_EXTERN bool wasmtime_instance_export_get(
-    wasmtime_context_t *store,
-    const wasmtime_instance_t *instance,
-    const char *name,
-    size_t name_len,
-    wasmtime_extern_t *item
-);
-
-/**
- * \brief Get an export by index from an instance.
- *
- * \param store the store that owns `instance`
- * \param instance the instance to lookup within
- * \param index the index to lookup
- * \param name where to store the name of the export
- * \param name_len where to store the byte length of the name
- * \param item where to store the export itself
- *
- * Returns nonzero if the export was found, and `name`, `name_len`, and `item`
- * are filled in. Otherwise returns 0.
- *
- * Doesn't take ownership of any arguments but does return ownership of the
- * #wasmtime_extern_t. The `name` pointer return value is owned by the `store`
- * and must be immediately used before calling any other APIs on
- * #wasmtime_context_t.
- */
-WASM_API_EXTERN bool wasmtime_instance_export_nth(
-    wasmtime_context_t *store,
-    const wasmtime_instance_t *instance,
-    size_t index,
-    char **name,
-    size_t *name_len,
-    wasmtime_extern_t *item
-);
-
-#ifdef __cplusplus
-}  // extern "C"
-#endif
-
-#endif // WASMTIME_INSTANCE_H
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/module.h b/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/module.h
deleted file mode 100644
index 326463b87c..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/module.h
+++ /dev/null
@@ -1,192 +0,0 @@
-/**
- * \file wasmtime/module.h
- *
- * APIs for interacting with modules in Wasmtime
- */
-
-#ifndef WASMTIME_MODULE_H
-#define WASMTIME_MODULE_H
-
-#include <wasm.h>
-#include <wasmtime/error.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * \brief An opaque object representing the type of a module.
- */
-typedef struct wasmtime_moduletype wasmtime_moduletype_t;
-
-/**
- * \brief Deletes a module type.
- */
-WASM_API_EXTERN void wasmtime_moduletype_delete(wasmtime_moduletype_t *ty);
-
-/**
- * \brief Returns the list of imports that this module type requires.
- *
- * This function does not take ownership of the provided module type but
- * ownership of `out` is passed to the caller. Note that `out` is treated as
- * uninitialized when passed to this function.
- */
-WASM_API_EXTERN void wasmtime_moduletype_imports(const wasmtime_moduletype_t*, wasm_importtype_vec_t* out);
-
-/**
- * \brief Returns the list of exports that this module type provides.
- *
- * This function does not take ownership of the provided module type but
- * ownership of `out` is passed to the caller. Note that `out` is treated as
- * uninitialized when passed to this function.
- */
-WASM_API_EXTERN void wasmtime_moduletype_exports(const wasmtime_moduletype_t*, wasm_exporttype_vec_t* out);
-
-/**
- * \brief Converts a #wasmtime_moduletype_t to a #wasm_externtype_t
- *
- * The returned value is owned by the #wasmtime_moduletype_t argument and should not
- * be deleted.
- */
-WASM_API_EXTERN wasm_externtype_t* wasmtime_moduletype_as_externtype(wasmtime_moduletype_t*);
-
-/**
- * \brief Attempts to convert a #wasm_externtype_t to a #wasmtime_moduletype_t
- *
- * The returned value is owned by the #wasmtime_moduletype_t argument and
- * should not be deleted. Returns `NULL` if the provided argument is not a
- * #wasmtime_moduletype_t.
- */
-WASM_API_EXTERN wasmtime_moduletype_t* wasmtime_externtype_as_moduletype(wasm_externtype_t*);
-
-/**
- * \typedef wasmtime_module_t
- * \brief Convenience alias for #wasmtime_module
- *
- * \struct wasmtime_module
- * \brief A compiled Wasmtime module.
- *
- * This type represents a compiled WebAssembly module. The compiled module is
- * ready to be instantiated and can be inspected for imports/exports. It is safe
- * to use a module across multiple threads simultaneously.
- */
-typedef struct wasmtime_module wasmtime_module_t;
-
-/**
- * \brief Compiles a WebAssembly binary into a #wasmtime_module_t
- *
- * This function will compile a WebAssembly binary into an owned #wasm_module_t.
- * This performs the same as #wasm_module_new except that it returns a
- * #wasmtime_error_t type to get richer error information.
- *
- * On success the returned #wasmtime_error_t is `NULL` and the `ret` pointer is
- * filled in with a #wasm_module_t. On failure the #wasmtime_error_t is
- * non-`NULL` and the `ret` pointer is unmodified.
- *
- * This function does not take ownership of any of its arguments, but the
- * returned error and module are owned by the caller.
- */
-WASM_API_EXTERN wasmtime_error_t *wasmtime_module_new(
-    wasm_engine_t *engine,
-    const uint8_t *wasm,
-    size_t wasm_len,
-    wasmtime_module_t **ret
-);
-
-/**
- * \brief Deletes a module.
- */
-WASM_API_EXTERN void wasmtime_module_delete(wasmtime_module_t *m);
-
-/**
- * \brief Creates a shallow clone of the specified module, increasing the
- * internal reference count.
- */
-WASM_API_EXTERN wasmtime_module_t *wasmtime_module_clone(wasmtime_module_t *m);
-
-/**
- * \brief Validate a WebAssembly binary.
- *
- * This function will validate the provided byte sequence to determine if it is
- * a valid WebAssembly binary within the context of the engine provided.
- *
- * This function does not take ownership of its arguments but the caller is
- * expected to deallocate the returned error if it is non-`NULL`.
- *
- * If the binary validates then `NULL` is returned, otherwise the error returned
- * describes why the binary did not validate.
- */
-WASM_API_EXTERN wasmtime_error_t *wasmtime_module_validate(
-    wasm_engine_t *engine,
-    const uint8_t *wasm,
-    size_t wasm_len
-);
-
-/**
- * \brief Returns the type of this module.
- *
- * The returned #wasmtime_moduletype_t is expected to be deallocated by the
- * caller.
- */
-WASM_API_EXTERN wasmtime_moduletype_t* wasmtime_module_type(const wasmtime_module_t*);
-
-/**
- * \brief This function serializes compiled module artifacts as blob data.
- *
- * \param module the module
- * \param ret if the conversion is successful, this byte vector is filled in with
- *   the serialized compiled module.
- *
- * \return a non-null error if parsing fails, or returns `NULL`. If parsing
- * fails then `ret` isn't touched.
- *
- * This function does not take ownership of `module`, and the caller is
- * expected to deallocate the returned #wasmtime_error_t and #wasm_byte_vec_t.
- */
-WASM_API_EXTERN wasmtime_error_t* wasmtime_module_serialize(
-    wasmtime_module_t* module,
-    wasm_byte_vec_t *ret
-);
-
-/**
- * \brief Build a module from serialized data.
- *
- * This function does not take ownership of any of its arguments, but the
- * returned error and module are owned by the caller.
- *
- * This function is not safe to receive arbitrary user input. See the Rust
- * documentation for more information on what inputs are safe to pass in here
- * (e.g. only that of #wasmtime_module_serialize)
- */
-WASM_API_EXTERN wasmtime_error_t *wasmtime_module_deserialize(
-    wasm_engine_t *engine,
-    const uint8_t *bytes,
-    size_t bytes_len,
-    wasmtime_module_t **ret
-);
-
-/**
- * \brief Deserialize a module from an on-disk file.
- *
- * This function is the same as #wasmtime_module_deserialize except that it
- * reads the data for the serialized module from the path on disk. This can be
- * faster than the alternative which may require copying the data around.
- *
- * This function does not take ownership of any of its arguments, but the
- * returned error and module are owned by the caller.
- *
- * This function is not safe to receive arbitrary user input. See the Rust
- * documentation for more information on what inputs are safe to pass in here
- * (e.g. only that of #wasmtime_module_serialize)
- */
-WASM_API_EXTERN wasmtime_error_t *wasmtime_module_deserialize_file(
-    wasm_engine_t *engine,
-    const char *path,
-    wasmtime_module_t **ret
-);
-
-#ifdef __cplusplus
-}  // extern "C"
-#endif
-
-#endif // WASMTIME_MODULE_H
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-aarch64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-aarch64/libwasmtime.a
deleted file mode 100644
index 5ad2c54f77..0000000000
Binary files a/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-aarch64/libwasmtime.a and /dev/null differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-x86_64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-x86_64/libwasmtime.a
deleted file mode 100644
index 625543bbd3..0000000000
Binary files a/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-x86_64/libwasmtime.a and /dev/null differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/macos-x86_64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/build/macos-x86_64/libwasmtime.a
deleted file mode 100644
index 25b84631bd..0000000000
Binary files a/vendor/github.com/bytecodealliance/wasmtime-go/build/macos-x86_64/libwasmtime.a and /dev/null differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/windows-x86_64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/build/windows-x86_64/libwasmtime.a
deleted file mode 100644
index 56cedda27c..0000000000
Binary files a/vendor/github.com/bytecodealliance/wasmtime-go/build/windows-x86_64/libwasmtime.a and /dev/null differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/config.go b/vendor/github.com/bytecodealliance/wasmtime-go/config.go
deleted file mode 100644
index 69859f6409..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/config.go
+++ /dev/null
@@ -1,191 +0,0 @@
-package wasmtime
-
-// #include <wasm.h>
-// #include <wasmtime.h>
-// #include <stdlib.h>
-import "C"
-import (
-	"runtime"
-	"unsafe"
-)
-
-// Strategy is the compilation strategies for wasmtime
-type Strategy C.wasmtime_strategy_t
-
-const (
-	// StrategyAuto will let wasmtime automatically pick an appropriate compilation strategy
-	StrategyAuto Strategy = C.WASMTIME_STRATEGY_AUTO
-	// StrategyCranelift will force wasmtime to use the Cranelift backend
-	StrategyCranelift Strategy = C.WASMTIME_STRATEGY_CRANELIFT
-)
-
-// OptLevel decides what degree of optimization wasmtime will perform on generated machine code
-type OptLevel C.wasmtime_opt_level_t
-
-const (
-	// OptLevelNone will perform no optimizations
-	OptLevelNone OptLevel = C.WASMTIME_OPT_LEVEL_NONE
-	// OptLevelSpeed will optimize machine code to be as fast as possible
-	OptLevelSpeed OptLevel = C.WASMTIME_OPT_LEVEL_SPEED
-	// OptLevelSpeedAndSize will optimize machine code for speed, but also optimize
-	// to be small, sometimes at the cost of speed.
-	OptLevelSpeedAndSize OptLevel = C.WASMTIME_OPT_LEVEL_SPEED_AND_SIZE
-)
-
-// ProfilingStrategy decides what sort of profiling to enable, if any.
-type ProfilingStrategy C.wasmtime_profiling_strategy_t
-
-const (
-	// ProfilingStrategyNone means no profiler will be used
-	ProfilingStrategyNone ProfilingStrategy = C.WASMTIME_PROFILING_STRATEGY_NONE
-	// ProfilingStrategyJitdump will use the "jitdump" linux support
-	ProfilingStrategyJitdump ProfilingStrategy = C.WASMTIME_PROFILING_STRATEGY_JITDUMP
-)
-
-// Config holds options used to create an Engine and customize its behavior.
-type Config struct {
-	_ptr *C.wasm_config_t
-}
-
-// NewConfig creates a new `Config` with all default options configured.
-func NewConfig() *Config {
-	config := &Config{_ptr: C.wasm_config_new()}
-	runtime.SetFinalizer(config, func(config *Config) {
-		C.wasm_config_delete(config._ptr)
-	})
-	return config
-}
-
-// SetDebugInfo configures whether dwarf debug information for JIT code is enabled
-func (cfg *Config) SetDebugInfo(enabled bool) {
-	C.wasmtime_config_debug_info_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmThreads configures whether the wasm threads proposal is enabled
-func (cfg *Config) SetWasmThreads(enabled bool) {
-	C.wasmtime_config_wasm_threads_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmReferenceTypes configures whether the wasm reference types proposal is enabled
-func (cfg *Config) SetWasmReferenceTypes(enabled bool) {
-	C.wasmtime_config_wasm_reference_types_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmSIMD configures whether the wasm SIMD proposal is enabled
-func (cfg *Config) SetWasmSIMD(enabled bool) {
-	C.wasmtime_config_wasm_simd_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmBulkMemory configures whether the wasm bulk memory proposal is enabled
-func (cfg *Config) SetWasmBulkMemory(enabled bool) {
-	C.wasmtime_config_wasm_bulk_memory_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmMultiValue configures whether the wasm multi value proposal is enabled
-func (cfg *Config) SetWasmMultiValue(enabled bool) {
-	C.wasmtime_config_wasm_multi_value_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmModuleLinking configures whether the wasm module linking proposal is enabled
-func (cfg *Config) SetWasmModuleLinking(enabled bool) {
-	C.wasmtime_config_wasm_module_linking_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmMultiMemory configures whether the wasm multi memory proposal is enabled
-func (cfg *Config) SetWasmMultiMemory(enabled bool) {
-	C.wasmtime_config_wasm_multi_memory_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetWasmMemory64 configures whether the wasm memory64 proposal is enabled
-func (cfg *Config) SetWasmMemory64(enabled bool) {
-	C.wasmtime_config_wasm_memory64_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetStrategy configures what compilation strategy is used to compile wasm code
-func (cfg *Config) SetStrategy(strat Strategy) error {
-	err := C.wasmtime_config_strategy_set(cfg.ptr(), C.wasmtime_strategy_t(strat))
-	runtime.KeepAlive(cfg)
-	if err != nil {
-		return mkError(err)
-	}
-	return nil
-}
-
-// SetCraneliftDebugVerifier configures whether the cranelift debug verifier will be active when
-// cranelift is used to compile wasm code.
-func (cfg *Config) SetCraneliftDebugVerifier(enabled bool) {
-	C.wasmtime_config_cranelift_debug_verifier_set(cfg.ptr(), C.bool(enabled))
-	runtime.KeepAlive(cfg)
-}
-
-// SetCraneliftOptLevel configures the cranelift optimization level for generated code
-func (cfg *Config) SetCraneliftOptLevel(level OptLevel) {
-	C.wasmtime_config_cranelift_opt_level_set(cfg.ptr(), C.wasmtime_opt_level_t(level))
-	runtime.KeepAlive(cfg)
-}
-
-// SetProfiler configures what profiler strategy to use for generated code
-func (cfg *Config) SetProfiler(profiler ProfilingStrategy) error {
-	err := C.wasmtime_config_profiler_set(cfg.ptr(), C.wasmtime_profiling_strategy_t(profiler))
-	runtime.KeepAlive(cfg)
-	if err != nil {
-		return mkError(err)
-	}
-	return nil
-}
-
-// CacheConfigLoadDefault enables compiled code caching for this `Config` using the default settings
-// configuration can be found.
-//
-// For more information about caching see
-// https://bytecodealliance.github.io/wasmtime/cli-cache.html
-func (cfg *Config) CacheConfigLoadDefault() error {
-	err := C.wasmtime_config_cache_config_load(cfg.ptr(), nil)
-	runtime.KeepAlive(cfg)
-	if err != nil {
-		return mkError(err)
-	}
-	return nil
-}
-
-// CacheConfigLoad enables compiled code caching for this `Config` using the settings specified
-// in the configuration file `path`.
-//
-// For more information about caching and configuration options see
-// https://bytecodealliance.github.io/wasmtime/cli-cache.html
-func (cfg *Config) CacheConfigLoad(path string) error {
-	cstr := C.CString(path)
-	err := C.wasmtime_config_cache_config_load(cfg.ptr(), cstr)
-	C.free(unsafe.Pointer(cstr))
-	runtime.KeepAlive(cfg)
-	if err != nil {
-		return mkError(err)
-	}
-	return nil
-}
-
-// SetInterruptable configures whether generated wasm code can be interrupted via interrupt
-// handles.
-func (cfg *Config) SetInterruptable(interruptable bool) {
-	C.wasmtime_config_interruptable_set(cfg.ptr(), C.bool(interruptable))
-	runtime.KeepAlive(cfg)
-}
-
-// See comments in `ffi.go` for what's going on here
-func (cfg *Config) ptr() *C.wasm_config_t {
-	ret := cfg._ptr
-	maybeGC()
-	if ret == nil {
-		panic("Config has already been used up")
-	}
-	return ret
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/engine.go b/vendor/github.com/bytecodealliance/wasmtime-go/engine.go
deleted file mode 100644
index e84c2d1891..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/engine.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package wasmtime
-
-// #include <wasm.h>
-import "C"
-import (
-	"runtime"
-)
-
-// Engine is an instance of a wasmtime engine which is used to create a `Store`.
-//
-// Engines are a form of global configuration for wasm compilations and modules
-// and such.
-type Engine struct {
-	_ptr *C.wasm_engine_t
-}
-
-// NewEngine creates a new `Engine` with default configuration.
-func NewEngine() *Engine {
-	engine := &Engine{_ptr: C.wasm_engine_new()}
-	runtime.SetFinalizer(engine, func(engine *Engine) {
-		C.wasm_engine_delete(engine._ptr)
-	})
-	return engine
-}
-
-// NewEngineWithConfig creates a new `Engine` with the `Config` provided
-//
-// Note that once a `Config` is passed to this method it cannot be used again.
-func NewEngineWithConfig(config *Config) *Engine {
-	if config.ptr() == nil {
-		panic("config already used")
-	}
-	engine := &Engine{_ptr: C.wasm_engine_new_with_config(config.ptr())}
-	runtime.SetFinalizer(config, nil)
-	config._ptr = nil
-	runtime.SetFinalizer(engine, func(engine *Engine) {
-		C.wasm_engine_delete(engine._ptr)
-	})
-	return engine
-}
-
-func (engine *Engine) ptr() *C.wasm_engine_t {
-	ret := engine._ptr
-	maybeGC()
-	return ret
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/error.go b/vendor/github.com/bytecodealliance/wasmtime-go/error.go
deleted file mode 100644
index 026b9410eb..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/error.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package wasmtime
-
-// #include <wasmtime.h>
-import "C"
-import "runtime"
-
-type Error struct {
-	_ptr *C.wasmtime_error_t
-}
-
-func mkError(ptr *C.wasmtime_error_t) *Error {
-	err := &Error{_ptr: ptr}
-	runtime.SetFinalizer(err, func(err *Error) {
-		C.wasmtime_error_delete(err._ptr)
-	})
-	return err
-}
-
-func (e *Error) ptr() *C.wasmtime_error_t {
-	ret := e._ptr
-	maybeGC()
-	return ret
-}
-
-func (e *Error) Error() string {
-	message := C.wasm_byte_vec_t{}
-	C.wasmtime_error_message(e.ptr(), &message)
-	ret := C.GoStringN(message.data, C.int(message.size))
-	runtime.KeepAlive(e)
-	C.wasm_byte_vec_delete(&message)
-	return ret
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/go.mod b/vendor/github.com/bytecodealliance/wasmtime-go/go.mod
deleted file mode 100644
index 7f140bb0b0..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/bytecodealliance/wasmtime-go
-
-go 1.14
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/includebuild.go b/vendor/github.com/bytecodealliance/wasmtime-go/includebuild.go
deleted file mode 100644
index 1e0dcc7009..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/includebuild.go
+++ /dev/null
@@ -1,22 +0,0 @@
-//go:build includebuild
-// +build includebuild
-
-package wasmtime
-
-// This file is not built and not included in BUILD.bazel;
-// it is only used to prevent "go mod vendor" to prune the
-// build directory.
-
-import (
-	// Import these build directories in order to have them
-	// included in vendored dependencies.
-	// Cf. https://github.com/golang/go/issues/26366
-
-	_ "github.com/bytecodealliance/wasmtime-go/build/include"
-	_ "github.com/bytecodealliance/wasmtime-go/build/include/wasmtime"
-	_ "github.com/bytecodealliance/wasmtime-go/build/linux-aarch64"
-	_ "github.com/bytecodealliance/wasmtime-go/build/linux-x86_64"
-	_ "github.com/bytecodealliance/wasmtime-go/build/macos-aarch64"
-	_ "github.com/bytecodealliance/wasmtime-go/build/macos-x86_64"
-	_ "github.com/bytecodealliance/wasmtime-go/build/windows-x86_64"
-)
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/instancetype.go b/vendor/github.com/bytecodealliance/wasmtime-go/instancetype.go
deleted file mode 100644
index 2e7651e4b0..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/instancetype.go
+++ /dev/null
@@ -1,49 +0,0 @@
-package wasmtime
-
-// #include <wasmtime.h>
-import "C"
-import "runtime"
-
-// InstanceType describes the exports of an instance.
-type InstanceType struct {
-	_ptr   *C.wasmtime_instancetype_t
-	_owner interface{}
-}
-
-func mkInstanceType(ptr *C.wasmtime_instancetype_t, owner interface{}) *InstanceType {
-	instancetype := &InstanceType{_ptr: ptr, _owner: owner}
-	if owner == nil {
-		runtime.SetFinalizer(instancetype, func(instancetype *InstanceType) {
-			C.wasmtime_instancetype_delete(instancetype._ptr)
-		})
-	}
-	return instancetype
-}
-
-func (ty *InstanceType) ptr() *C.wasmtime_instancetype_t {
-	ret := ty._ptr
-	maybeGC()
-	return ret
-}
-
-func (ty *InstanceType) owner() interface{} {
-	if ty._owner != nil {
-		return ty._owner
-	}
-	return ty
-}
-
-// AsExternType converts this type to an instance of `ExternType`
-func (ty *InstanceType) AsExternType() *ExternType {
-	ptr := C.wasmtime_instancetype_as_externtype(ty.ptr())
-	return mkExternType(ptr, ty.owner())
-}
-
-// Exports returns a list of `ExportType` items which are the items that will
-// be exported by this instance after instantiation.
-func (ty *InstanceType) Exports() []*ExportType {
-	exports := &exportTypeList{}
-	C.wasmtime_instancetype_exports(ty.ptr(), &exports.vec)
-	runtime.KeepAlive(ty)
-	return exports.mkGoList()
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/moduletype.go b/vendor/github.com/bytecodealliance/wasmtime-go/moduletype.go
deleted file mode 100644
index c348e15de2..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/moduletype.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package wasmtime
-
-// #include <wasmtime.h>
-import "C"
-import "runtime"
-
-// ModuleType describes the imports/exports of a module.
-type ModuleType struct {
-	_ptr   *C.wasmtime_moduletype_t
-	_owner interface{}
-}
-
-func mkModuleType(ptr *C.wasmtime_moduletype_t, owner interface{}) *ModuleType {
-	moduletype := &ModuleType{_ptr: ptr, _owner: owner}
-	if owner == nil {
-		runtime.SetFinalizer(moduletype, func(moduletype *ModuleType) {
-			C.wasmtime_moduletype_delete(moduletype._ptr)
-		})
-	}
-	return moduletype
-}
-
-func (ty *ModuleType) ptr() *C.wasmtime_moduletype_t {
-	ret := ty._ptr
-	maybeGC()
-	return ret
-}
-
-func (ty *ModuleType) owner() interface{} {
-	if ty._owner != nil {
-		return ty._owner
-	}
-	return ty
-}
-
-// AsExternType converts this type to an instance of `ExternType`
-func (ty *ModuleType) AsExternType() *ExternType {
-	ptr := C.wasmtime_moduletype_as_externtype(ty.ptr())
-	return mkExternType(ptr, ty.owner())
-}
-
-// Imports returns a list of `ImportType` items which are the items imported by
-// this module and are required for instantiation.
-func (m *ModuleType) Imports() []*ImportType {
-	imports := &importTypeList{}
-	C.wasmtime_moduletype_imports(m.ptr(), &imports.vec)
-	runtime.KeepAlive(m)
-	return imports.mkGoList()
-}
-
-// Exports returns a list of `ExportType` items which are the items that will
-// be exported by this module after instantiation.
-func (m *ModuleType) Exports() []*ExportType {
-	exports := &exportTypeList{}
-	C.wasmtime_moduletype_exports(m.ptr(), &exports.vec)
-	runtime.KeepAlive(m)
-	return exports.mkGoList()
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/store.go b/vendor/github.com/bytecodealliance/wasmtime-go/store.go
deleted file mode 100644
index 69fd0c1da9..0000000000
--- a/vendor/github.com/bytecodealliance/wasmtime-go/store.go
+++ /dev/null
@@ -1,266 +0,0 @@
-package wasmtime
-
-// #include <wasmtime.h>
-// #include "shims.h"
-import "C"
-import (
-	"errors"
-	"reflect"
-	"runtime"
-	"sync"
-	"unsafe"
-)
-
-// Store is a general group of wasm instances, and many objects
-// must all be created with and reference the same `Store`
-type Store struct {
-	_ptr *C.wasmtime_store_t
-
-	// The `Engine` that this store uses for compilation and environment
-	// settings.
-	Engine *Engine
-}
-
-// Storelike represents types that can be used to contextually reference a
-// `Store`.
-//
-// This interface is implemented by `*Store` and `*Caller` and is pervasively
-// used throughout this library. You'll want to pass one of those two objects
-// into functions that take a `Storelike`.
-type Storelike interface {
-	// Returns the wasmtime context pointer this store is attached to.
-	Context() *C.wasmtime_context_t
-}
-
-var gStoreLock sync.Mutex
-var gStoreMap = make(map[int]*storeData)
-var gStoreSlab slab
-
-// State associated with a `Store`, currently used to propagate panic
-// information through invocations as well as store Go closures that have been
-// added to the store.
-type storeData struct {
-	engine    *Engine
-	funcNew   []funcNewEntry
-	funcWrap  []funcWrapEntry
-	lastPanic interface{}
-}
-
-type funcNewEntry struct {
-	callback func(*Caller, []Val) ([]Val, *Trap)
-	results  []*ValType
-}
-
-type funcWrapEntry struct {
-	callback reflect.Value
-}
-
-// NewStore creates a new `Store` from the configuration provided in `engine`
-func NewStore(engine *Engine) *Store {
-	// Allocate an index for this store and allocate some internal data to go with
-	// the store.
-	gStoreLock.Lock()
-	idx := gStoreSlab.allocate()
-	gStoreMap[idx] = &storeData{engine: engine}
-	gStoreLock.Unlock()
-
-	ptr := C.go_store_new(engine.ptr(), C.size_t(idx))
-	store := &Store{
-		_ptr:   ptr,
-		Engine: engine,
-	}
-	runtime.SetFinalizer(store, func(store *Store) {
-		C.wasmtime_store_delete(store._ptr)
-	})
-	return store
-}
-
-//export goFinalizeStore
-func goFinalizeStore(env unsafe.Pointer) {
-	// When a store is finalized this is used as the finalization callback for the
-	// custom data within the store, and our finalization here will delete the
-	// store's data from the global map and deallocate its index to get reused by
-	// a future store.
-	idx := int(uintptr(env))
-	gStoreLock.Lock()
-	defer gStoreLock.Unlock()
-	delete(gStoreMap, idx)
-	gStoreSlab.deallocate(idx)
-}
-
-// InterruptHandle returns a handle, if enabled, which can be used to interrupt
-// execution of WebAssembly within this `Store` from any goroutine.
-//
-// This requires that `SetInterruptable` is set to `true` on the `Config`
-// associated with this `Store`. Returns an error if interrupts aren't enabled.
-func (store *Store) InterruptHandle() (*InterruptHandle, error) {
-	ptr := C.wasmtime_interrupt_handle_new(store.Context())
-	runtime.KeepAlive(store)
-	if ptr == nil {
-		return nil, errors.New("interrupts not enabled in `Config`")
-	}
-
-	handle := &InterruptHandle{_ptr: ptr}
-	runtime.SetFinalizer(handle, func(handle *InterruptHandle) {
-		C.wasmtime_interrupt_handle_delete(handle._ptr)
-	})
-	return handle, nil
-}
-
-// GC will clean up any `externref` values that are no longer actually
-// referenced.
-//
-// This function is not required to be called for correctness, it's only an
-// optimization if desired to clean out any extra `externref` values.
-func (store *Store) GC() {
-	C.wasmtime_context_gc(store.Context())
-	runtime.KeepAlive(store)
-}
-
-// SetWasi will configure the WASI state to use for instances within this
-// `Store`.
-//
-// The `wasi` argument cannot be reused for another `Store`, it's consumed by
-// this function.
-func (store *Store) SetWasi(wasi *WasiConfig) {
-	runtime.SetFinalizer(wasi, nil)
-	ptr := wasi.ptr()
-	wasi._ptr = nil
-	if ptr == nil {
-		panic("reuse of already-consumed WasiConfig")
-	}
-	C.wasmtime_context_set_wasi(store.Context(), ptr)
-	runtime.KeepAlive(store)
-}
-
-// Implementation of the `Storelike` interface
-func (store *Store) Context() *C.wasmtime_context_t {
-	ret := C.wasmtime_store_context(store._ptr)
-	maybeGC()
-	return ret
-}
-
-// Returns the underlying `*storeData` that this store references in Go, used
-// for inserting functions or storing panic data.
-func getDataInStore(store Storelike) *storeData {
-	data := uintptr(C.wasmtime_context_get_data(store.Context()))
-	gStoreLock.Lock()
-	defer gStoreLock.Unlock()
-	return gStoreMap[int(data)]
-}
-
-// InterruptHandle is used to interrupt the execution of currently running
-// wasm code.
-//
-// For more information see
-// https://bytecodealliance.github.io/wasmtime/api/wasmtime/struct.Store.html#method.interrupt_handle
-type InterruptHandle struct {
-	_ptr *C.wasmtime_interrupt_handle_t
-}
-
-// Interrupt interrupts currently executing WebAssembly code, if it's currently running,
-// or interrupts wasm the next time it starts running.
-//
-// For more information see
-// https://bytecodealliance.github.io/wasmtime/api/wasmtime/struct.Store.html#method.interrupt_handle
-func (i *InterruptHandle) Interrupt() {
-	C.wasmtime_interrupt_handle_interrupt(i.ptr())
-	runtime.KeepAlive(i)
-}
-
-func (i *InterruptHandle) ptr() *C.wasmtime_interrupt_handle_t {
-	ret := i._ptr
-	maybeGC()
-	return ret
-}
-
-var gEngineFuncLock sync.Mutex
-var gEngineFuncNew = make(map[int]*funcNewEntry)
-var gEngineFuncNewSlab slab
-var gEngineFuncWrap = make(map[int]*funcWrapEntry)
-var gEngineFuncWrapSlab slab
-
-func insertFuncNew(data *storeData, ty *FuncType, callback func(*Caller, []Val) ([]Val, *Trap)) int {
-	var idx int
-	entry := funcNewEntry{
-		callback: callback,
-		results:  ty.Results(),
-	}
-	if data == nil {
-		gEngineFuncLock.Lock()
-		defer gEngineFuncLock.Unlock()
-		idx = gEngineFuncNewSlab.allocate()
-		gEngineFuncNew[idx] = &entry
-		idx = (idx << 1) | 0
-	} else {
-		idx = len(data.funcNew)
-		data.funcNew = append(data.funcNew, entry)
-		idx = (idx << 1) | 1
-	}
-	return idx
-}
-
-func (data *storeData) getFuncNew(idx int) *funcNewEntry {
-	if idx&1 == 0 {
-		gEngineFuncLock.Lock()
-		defer gEngineFuncLock.Unlock()
-		return gEngineFuncNew[idx>>1]
-	} else {
-		return &data.funcNew[idx>>1]
-	}
-}
-
-func insertFuncWrap(data *storeData, callback reflect.Value) int {
-	var idx int
-	entry := funcWrapEntry{callback}
-	if data == nil {
-		gEngineFuncLock.Lock()
-		defer gEngineFuncLock.Unlock()
-		idx = gEngineFuncWrapSlab.allocate()
-		gEngineFuncWrap[idx] = &entry
-		idx = (idx << 1) | 0
-	} else {
-		idx = len(data.funcWrap)
-		data.funcWrap = append(data.funcWrap, entry)
-		idx = (idx << 1) | 1
-	}
-	return idx
-
-}
-
-func (data *storeData) getFuncWrap(idx int) *funcWrapEntry {
-	if idx&1 == 0 {
-		gEngineFuncLock.Lock()
-		defer gEngineFuncLock.Unlock()
-		return gEngineFuncWrap[idx>>1]
-	} else {
-		return &data.funcWrap[idx>>1]
-	}
-}
-
-//export goFinalizeFuncNew
-func goFinalizeFuncNew(env unsafe.Pointer) {
-	idx := int(uintptr(env))
-	if idx&1 != 0 {
-		panic("shouldn't finalize a store-local index")
-	}
-	idx = idx >> 1
-	gEngineFuncLock.Lock()
-	defer gEngineFuncLock.Unlock()
-	delete(gEngineFuncNew, idx)
-	gEngineFuncNewSlab.deallocate(idx)
-
-}
-
-//export goFinalizeFuncWrap
-func goFinalizeFuncWrap(env unsafe.Pointer) {
-	idx := int(uintptr(env))
-	if idx&1 != 0 {
-		panic("shouldn't finalize a store-local index")
-	}
-	idx = idx >> 1
-	gEngineFuncLock.Lock()
-	defer gEngineFuncLock.Unlock()
-	delete(gEngineFuncWrap, idx)
-	gEngineFuncWrapSlab.deallocate(idx)
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/BUILD.bazel b/vendor/github.com/bytecodealliance/wasmtime-go/v3/BUILD.bazel
new file mode 100644
index 0000000000..58a2c5019d
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/BUILD.bazel
@@ -0,0 +1,76 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+cc_library(
+    name = "wasmtime",
+    srcs = select({
+        "@io_bazel_rules_go//go/platform:darwin_amd64": ["build/macos-x86_64/libwasmtime.a"],
+        "@io_bazel_rules_go//go/platform:linux_amd64": ["build/linux-x86_64/libwasmtime.a"],
+        "@io_bazel_rules_go//go/platform:windows_amd64": ["build/windows-x86_64/libwasmtime.a"],
+    }),
+    hdrs = glob(["build/include/**/*.h"]),
+    includes = ["build/include"],
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "config.go",
+        "doc.go",
+        "engine.go",
+        "error.go",
+        "exporttype.go",
+        "extern.go",
+        "externtype.go",
+        "ffi.go",
+        "func.go",
+        "functype.go",
+        "global.go",
+        "globaltype.go",
+        "importtype.go",
+        "instance.go",
+        "linker.go",
+        "maybe_gc_no.go",
+        "memory.go",
+        "memorytype.go",
+        "module.go",
+        "shims.c",
+        "shims.h",
+        "slab.go",
+        "store.go",
+        "table.go",
+        "tabletype.go",
+        "trap.go",
+        "val.go",
+        "valtype.go",
+        "wasi.go",
+        "wat2wasm.go",
+    ],
+    cdeps = [":wasmtime"],  # add wasmtime dep
+    cgo = True,
+    clinkopts = select({
+        "@io_bazel_rules_go//go/platform:windows": [
+            "-luserenv -lole32 -lntdll -lws2_32 -lkernel32 -lbcrypt",
+        ],
+        "//conditions:default": ["-lm -ldl"],
+    }),
+    copts = [
+        "-Ibuild/include",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:windows": [
+            "-DWASM_API_EXTERN= -DWASI_API_EXTERN=",
+        ],
+        "//conditions:default": [],
+    }),
+    importpath = "github.com/bytecodealliance/wasmtime-go/v3",
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = glob(["**/*_test.go"]),
+    embed = [":go_default_library"],
+    deps = [
+        "@com_github_stretchr_testify//require:go_default_library",
+    ]
+)
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/LICENSE b/vendor/github.com/bytecodealliance/wasmtime-go/v3/LICENSE
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/LICENSE
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/LICENSE
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/README.md b/vendor/github.com/bytecodealliance/wasmtime-go/v3/README.md
new file mode 100644
index 0000000000..38fe65713c
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/README.md
@@ -0,0 +1,153 @@
+<div align="center">
+  <h1><code>wasmtime-go</code></h1>
+
+  <p>
+    <strong>Go embedding of
+    <a href="https://github.com/bytecodealliance/wasmtime">Wasmtime</a></strong>
+  </p>
+
+  <strong>A <a href="https://bytecodealliance.org/">Bytecode Alliance</a> project</strong>
+
+  <p>
+    <a href="https://github.com/bytecodealliance/wasmtime-go/actions?query=workflow%3ACI">
+      <img src="https://github.com/bytecodealliance/wasmtime-go/workflows/CI/badge.svg" alt="CI status"/>
+    </a>
+    <a href="https://pkg.go.dev/github.com/bytecodealliance/wasmtime-go/v3">
+      <img src="https://godoc.org/github.com/bytecodealliance/wasmtime-go/v3?status.svg" alt="Documentation"/>
+    </a>
+    <a href="https://bytecodealliance.github.io/wasmtime-go/coverage.html">
+      <img src="https://img.shields.io/badge/coverage-main-green" alt="Code Coverage"/>
+    </a>
+  </p>
+
+</div>
+
+## Installation
+
+```sh
+go get -u github.com/bytecodealliance/wasmtime-go/v3@v3.0.2
+```
+
+Be sure to check out the [API documentation][api]!
+
+This Go library uses CGO to consume the C API of the [Wasmtime
+project][wasmtime] which is written in Rust. Precompiled binaries of Wasmtime
+are checked into this repository on tagged releases so you won't have to install
+Wasmtime locally, but it means that this project only works on Linux x86\_64,
+macOS x86\_64 , and Windows x86\_64 currently. Building on other platforms will
+need to arrange to build Wasmtime and use `CGO_*` env vars to compile correctly.
+
+This project has been tested with Go 1.13 or later.
+
+[api]: https://pkg.go.dev/github.com/bytecodealliance/wasmtime-go/v3
+[wasmtime]: https://github.com/bytecodealliance/wasmtime
+
+If you are a bazel user, add following to your WORKSPACE file:
+
+```
+go_repository(
+    name = "com_github_bytecodealliance_wasmtime_go",
+    importpath = "github.com/bytecodealliance/wasmtime-go/v3",
+    version = "v3.0.2",
+)
+```
+
+## Usage
+
+A "Hello, world!" example of using this package looks like:
+
+```go
+package main
+
+import (
+    "fmt"
+    "github.com/bytecodealliance/wasmtime-go/v3"
+)
+
+func main() {
+    // Almost all operations in wasmtime require a contextual `store`
+    // argument to share, so create that first
+    store := wasmtime.NewStore(wasmtime.NewEngine())
+
+    // Compiling modules requires WebAssembly binary input, but the wasmtime
+    // package also supports converting the WebAssembly text format to the
+    // binary format.
+    wasm, err := wasmtime.Wat2Wasm(`
+      (module
+        (import "" "hello" (func $hello))
+        (func (export "run")
+          (call $hello))
+      )
+    `)
+    check(err)
+
+    // Once we have our binary `wasm` we can compile that into a `*Module`
+    // which represents compiled JIT code.
+    module, err := wasmtime.NewModule(store.Engine, wasm)
+    check(err)
+
+    // Our `hello.wat` file imports one item, so we create that function
+    // here.
+    item := wasmtime.WrapFunc(store, func() {
+        fmt.Println("Hello from Go!")
+    })
+
+    // Next up we instantiate a module which is where we link in all our
+    // imports. We've got one import so we pass that in here.
+    instance, err := wasmtime.NewInstance(store, module, []wasmtime.AsExtern{item})
+    check(err)
+
+    // After we've instantiated we can lookup our `run` function and call
+    // it.
+    run := instance.GetFunc(store, "run")
+    if run == nil {
+        panic("not a function")
+    }
+    _, err = run.Call(store)
+    check(err)
+}
+
+func check(e error) {
+    if e != nil {
+        panic(e)
+    }
+}
+```
+
+## Contributing
+
+So far this extension has been written by folks who are primarily Rust
+programmers, so it's highly likely that there's some faux pas in terms of Go
+idioms. Feel free to send a PR to help make things more idiomatic if you see
+something!
+
+To work on this extension locally you'll first want to clone the project:
+
+```sh
+$ git clone https://github.com/bytecodealliance/wasmtime-go
+```
+
+Next up you'll want to have a [local Wasmtime build
+available](https://bytecodealliance.github.io/wasmtime/contributing-building.html).
+
+You'll need to build at least the `wasmtime-c-api` crate, which, at the time of
+this writing, would be:
+
+```sh
+$ cargo build -p wasmtime-c-api
+```
+
+Once you've got that you can set up the environment of this library with:
+
+```sh
+$ ./ci/local.sh /path/to/wasmtime
+```
+
+This will create a `build` directory which has the compiled libraries and header
+files. Next up you can run normal commands such as:
+
+```sh
+$ go test
+```
+
+And after that you should be good to go!
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/WORKSPACE b/vendor/github.com/bytecodealliance/wasmtime-go/v3/WORKSPACE
new file mode 100644
index 0000000000..361778a490
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/WORKSPACE
@@ -0,0 +1,68 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "685052b498b6ddfe562ca7a97736741d87916fe536623afb7da2824c0211c369",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.33.0/rules_go-v0.33.0.zip",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.33.0/rules_go-v0.33.0.zip",
+    ],
+)
+
+http_archive(
+    name = "bazel_gazelle",
+    sha256 = "5982e5463f171da99e3bdaeff8c0f48283a7a5f396ec5282910b9e8a49c0dd7e",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.25.0/bazel-gazelle-v0.25.0.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.25.0/bazel-gazelle-v0.25.0.tar.gz",
+    ],
+)
+
+load("@io_bazel_rules_go//go:deps.bzl", "go_rules_dependencies", "go_register_toolchains")
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
+
+go_repository(
+    name = "com_github_davecgh_go_spew",
+    build_file_proto_mode = "disable_global",
+    importpath = "github.com/davecgh/go-spew",
+    sum = "h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=",
+    version = "v1.1.1",
+)
+
+go_repository(
+    name = "com_github_pmezard_go_difflib",
+    build_file_proto_mode = "disable_global",
+    importpath = "github.com/pmezard/go-difflib",
+    sum = "h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=",
+    version = "v1.0.0",
+)
+
+go_repository(
+    name = "com_github_stretchr_testify",
+    build_file_proto_mode = "disable_global",
+    importpath = "github.com/stretchr/testify",
+    sum = "h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=",
+    version = "v1.8.0",
+)
+
+go_repository(
+    name = "in_gopkg_yaml_v3",
+    build_file_proto_mode = "disable_global",
+    importpath = "gopkg.in/yaml.v3",
+    sum = "h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=",
+    version = "v3.0.0-20200313102051-9f266ea9e77c",
+)
+
+go_repository(
+    name = "com_github_stretchr_objx",
+    build_file_proto_mode = "disable_global",
+    importpath = "github.com/stretchr/objx",
+    sum = "h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=",
+    version = "v0.4.0",
+)
+
+go_rules_dependencies()
+
+go_register_toolchains(version = "1.16")
+
+gazelle_dependencies()
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/doc-wasm.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/doc-wasm.h
similarity index 99%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/doc-wasm.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/doc-wasm.h
index 3be860342e..6bad15c744 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/doc-wasm.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/doc-wasm.h
@@ -359,6 +359,8 @@
  * \brief Creates a new function type with the provided parameter and result
  * types.
  *
+ * This function takes ownership of the `params` and `results` arguments.
+ *
  * The caller is responsible for deleting the returned value.
  *
  * \fn const wasm_valtype_vec_t* wasm_functype_params(const wasm_functype_t *);
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasi.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasi.h
similarity index 92%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasi.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasi.h
index 994c66b226..f3d1dfd452 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasi.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasi.h
@@ -94,6 +94,16 @@ WASI_API_EXTERN void wasi_config_inherit_env(wasi_config_t* config);
  */
 WASI_API_EXTERN bool wasi_config_set_stdin_file(wasi_config_t* config, const char* path);
 
+/**
+ * \brief Configures standard input to be taken from the specified #wasm_byte_vec_t.
+ *
+ * By default WASI programs have no stdin, but this configures the specified
+ * bytes to be used as stdin for this configuration.
+ *
+ * This function takes ownership of the `binary` argument.
+ */
+WASI_API_EXTERN void wasi_config_set_stdin_bytes(wasi_config_t* config, wasm_byte_vec_t* binary);
+
 /**
  * \brief Configures this process's own stdin stream to be used as stdin for
  * this WASI configuration.
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasm.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasm.h
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasm.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasm.h
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime.h
similarity index 92%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime.h
index 9d1f7219eb..c70fd8b713 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime.h
@@ -28,6 +28,22 @@
  * as a `lib` directory with both a static archive and a dynamic library of
  * Wasmtime. You can link to either of them as you see fit.
  *
+ * ## Installing the C API through CMake
+ *
+ * CMake can be used to make the process of linking and compiling easier. An
+ * example of this if you have wasmtime as a git submodule at
+ * `third_party/wasmtime`:
+ * ```
+ * add_subdirectory(${CMAKE_CURRENT_SOURCE_DIR}/third_party/wasmtime/crates/c-api
+ * ${CMAKE_CURRENT_BINARY_DIR}/wasmtime)
+ * ...
+ * target_include_directories(YourProject PUBLIC wasmtime)
+ * target_link_libraries(YourProject PUBLIC wasmtime)
+ * ```
+ * `BUILD_SHARED_LIBS` is provided as a define if you would like to build a
+ * shared library instead. You must distribute the appropriate shared library
+ * for your platform if you do this.
+ *
  * ## Linking against the C API
  *
  * You'll want to arrange the `include` directory of the C API to be in your
@@ -41,7 +57,7 @@
  *
  * * Linux - `-lpthread -ldl -lm`
  * * macOS - no extra flags needed
- * * Windows - `ws2_32.lib advapi32.lib userenv.lib ntdll.lib shell32.lib ole32.lib`
+ * * Windows - `ws2_32.lib advapi32.lib userenv.lib ntdll.lib shell32.lib ole32.lib bcrypt.lib`
  *
  * ## Building from Source
  *
@@ -166,6 +182,7 @@
 
 #include <wasi.h>
 #include <wasmtime/config.h>
+#include <wasmtime/engine.h>
 #include <wasmtime/error.h>
 #include <wasmtime/extern.h>
 #include <wasmtime/func.h>
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/config.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/config.h
similarity index 86%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/config.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/config.h
index 9f90059b09..77c1193632 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/config.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/config.h
@@ -96,15 +96,6 @@ enum wasmtime_profiling_strategy_enum { // ProfilingStrategy
  */
 WASMTIME_CONFIG_PROP(void, debug_info, bool)
 
-/**
- * \brief Enables WebAssembly code to be interrupted.
- *
- * This setting is `false` by default. When enabled it will enable getting an
- * interrupt handle via #wasmtime_interrupt_handle_new which can be used to
- * interrupt currently-executing WebAssembly code.
- */
-WASMTIME_CONFIG_PROP(void, interruptable, bool)
-
 /**
  * \brief Whether or not fuel is enabled for generated code.
  *
@@ -114,6 +105,22 @@ WASMTIME_CONFIG_PROP(void, interruptable, bool)
  */
 WASMTIME_CONFIG_PROP(void, consume_fuel, bool)
 
+/**
+ * \brief Whether or not epoch-based interruption is enabled for generated code.
+ *
+ * This setting is `false` by default. When enabled wasm code will check the
+ * current epoch periodically and abort if the current epoch is beyond a
+ * store-configured limit.
+ *
+ * Note that when this setting is enabled all stores will immediately trap and
+ * need to have their epoch deadline otherwise configured with
+ * #wasmtime_context_set_epoch_deadline.
+ *
+ * Note that the current epoch is engine-local and can be incremented with
+ * #wasmtime_engine_increment_epoch.
+ */
+WASMTIME_CONFIG_PROP(void, epoch_interruption, bool)
+
 /**
  * \brief Configures the maximum stack size, in bytes, that JIT code can use.
  *
@@ -178,14 +185,6 @@ WASMTIME_CONFIG_PROP(void, wasm_multi_value, bool)
  */
 WASMTIME_CONFIG_PROP(void, wasm_multi_memory, bool)
 
-/**
- * \brief Configures whether the WebAssembly module linking proposal is
- * enabled.
- *
- * This setting is `false` by default.
- */
-WASMTIME_CONFIG_PROP(void, wasm_module_linking, bool)
-
 /**
  * \brief Configures whether the WebAssembly memory64 proposal is
  * enabled.
@@ -198,11 +197,8 @@ WASMTIME_CONFIG_PROP(void, wasm_memory64, bool)
  * \brief Configures how JIT code will be compiled.
  *
  * This setting is #WASMTIME_STRATEGY_AUTO by default.
- *
- * If the compilation strategy selected could not be enabled then an error is
- * returned.
  */
-WASMTIME_CONFIG_PROP(wasmtime_error_t*, strategy, wasmtime_strategy_t)
+WASMTIME_CONFIG_PROP(void, strategy, wasmtime_strategy_t)
 
 /**
  * \brief Configures whether Cranelift's debug verifier is enabled.
@@ -214,6 +210,19 @@ WASMTIME_CONFIG_PROP(wasmtime_error_t*, strategy, wasmtime_strategy_t)
  */
 WASMTIME_CONFIG_PROP(void, cranelift_debug_verifier, bool)
 
+/**
+ * \brief Configures whether Cranelift should perform a NaN-canonicalization pass.
+ *
+ * When Cranelift is used as a code generation backend this will configure
+ * it to replace NaNs with a single canonical value. This is useful for users
+ * requiring entirely deterministic WebAssembly computation.
+ * 
+ * This is not required by the WebAssembly spec, so it is not enabled by default.
+ * 
+ * The default value for this is `false`
+ */
+WASMTIME_CONFIG_PROP(void, cranelift_nan_canonicalization, bool)
+  
 /**
  * \brief Configures Cranelift's optimization level for JIT code.
  *
@@ -226,7 +235,7 @@ WASMTIME_CONFIG_PROP(void, cranelift_opt_level, wasmtime_opt_level_t)
  *
  * This setting in #WASMTIME_PROFILING_STRATEGY_NONE by default.
  */
-WASMTIME_CONFIG_PROP(wasmtime_error_t*, profiler, wasmtime_profiling_strategy_t)
+WASMTIME_CONFIG_PROP(void, profiler, wasmtime_profiling_strategy_t)
 
 /**
  * \brief Configures the maximum size for memory to be considered "static"
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/engine.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/engine.h
new file mode 100644
index 0000000000..1b8336f460
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/engine.h
@@ -0,0 +1,36 @@
+/**
+ * \file wasmtime/engine.h
+ *
+ * Wasmtime-specific extensions to #wasm_engine_t.
+ */
+
+#ifndef WASMTIME_ENGINE_H
+#define WASMTIME_ENGINE_H
+
+#include <wasm.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \brief Increments the engine-local epoch variable.
+ *
+ * This function will increment the engine's current epoch which can be used to
+ * force WebAssembly code to trap if the current epoch goes beyond the
+ * #wasmtime_store_t configured epoch deadline.
+ *
+ * This function is safe to call from any thread, and it is also
+ * async-signal-safe.
+ *
+ * See also #wasmtime_config_epoch_interruption_set.
+ */
+WASM_API_EXTERN void wasmtime_engine_increment_epoch(wasm_engine_t *engine);
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif
+
+#endif // WASMTIME_ENGINE_H
+
+
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/error.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/error.h
new file mode 100644
index 0000000000..cfa0c9690e
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/error.h
@@ -0,0 +1,73 @@
+/**
+ * \file wasmtime/error.h
+ *
+ * \brief Definition and accessors of #wasmtime_error_t
+ */
+
+#ifndef WASMTIME_ERROR_H
+#define WASMTIME_ERROR_H
+
+#include <wasm.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \typedef wasmtime_error_t
+ * \brief Convenience alias for #wasmtime_error
+ *
+ * \struct wasmtime_error
+ * \brief Errors generated by Wasmtime.
+ * \headerfile wasmtime/error.h
+ *
+ * This opaque type represents an error that happened as part of one of the
+ * functions below. Errors primarily have an error message associated with them
+ * at this time, which you can acquire by calling #wasmtime_error_message.
+ *
+ * Errors are safe to share across threads and must be deleted with
+ * #wasmtime_error_delete.
+ */
+typedef struct wasmtime_error wasmtime_error_t;
+
+/**
+ * \brief Deletes an error.
+ */
+WASM_API_EXTERN void wasmtime_error_delete(wasmtime_error_t *error);
+
+/**
+ * \brief Returns the string description of this error.
+ *
+ * This will "render" the error to a string and then return the string
+ * representation of the error to the caller. The `message` argument should be
+ * uninitialized before this function is called and the caller is responsible
+ * for deallocating it with #wasm_byte_vec_delete afterwards.
+ */
+WASM_API_EXTERN void wasmtime_error_message(
+    const wasmtime_error_t *error,
+    wasm_name_t *message
+);
+
+/**
+ * \brief Attempts to extract a WASI-specific exit status from this error.
+ *
+ * Returns `true` if the error is a WASI "exit" trap and has a return status.
+ * If `true` is returned then the exit status is returned through the `status`
+ * pointer. If `false` is returned then this is not a wasi exit trap.
+ */
+WASM_API_EXTERN bool wasmtime_error_exit_status(const wasmtime_error_t*, int *status);
+
+/**
+ * \brief Attempts to extract a WebAssembly trace from this error.
+ *
+ * This is similar to #wasm_trap_trace except that it takes a #wasmtime_error_t
+ * as input. The `out` argument will be filled in with the wasm trace, if
+ * present.
+ */
+WASM_API_EXTERN void wasmtime_error_wasm_trace(const wasmtime_error_t*, wasm_frame_vec_t *out);
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif
+
+#endif // WASMTIME_ERROR_H
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/extern.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/extern.h
similarity index 81%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/extern.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/extern.h
index 77d66c8656..29dcb217fe 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/extern.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/extern.h
@@ -56,20 +56,6 @@ typedef struct wasmtime_memory {
   size_t index;
 } wasmtime_memory_t;
 
-/// \brief Representation of a instance in Wasmtime.
-///
-/// Instances are represented with a 64-bit identifying integer in Wasmtime.
-/// They do not have any destructor associated with them. Instances cannot
-/// interoperate between #wasmtime_store_t instances and if the wrong instance
-/// is passed to the wrong store then it may trigger an assertion to abort the
-/// process.
-typedef struct wasmtime_instance {
-  /// Internal identifier of what store this belongs to, never zero.
-  uint64_t store_id;
-  /// Internal index within the store.
-  size_t index;
-} wasmtime_instance_t;
-
 /// \brief Representation of a global in Wasmtime.
 ///
 /// Globals are represented with a 64-bit identifying integer in Wasmtime.
@@ -99,12 +85,6 @@ typedef uint8_t wasmtime_extern_kind_t;
 /// \brief Value of #wasmtime_extern_kind_t meaning that #wasmtime_extern_t is a
 /// memory
 #define WASMTIME_EXTERN_MEMORY 3
-/// \brief Value of #wasmtime_extern_kind_t meaning that #wasmtime_extern_t is
-/// an instance
-#define WASMTIME_EXTERN_INSTANCE 4
-/// \brief Value of #wasmtime_extern_kind_t meaning that #wasmtime_extern_t is
-/// a module
-#define WASMTIME_EXTERN_MODULE 5
 
 /**
  * \typedef wasmtime_extern_union_t
@@ -125,13 +105,6 @@ typedef union wasmtime_extern_union {
     wasmtime_table_t table;
     /// Field used if #wasmtime_extern_t::kind is #WASMTIME_EXTERN_MEMORY
     wasmtime_memory_t memory;
-    /// Field used if #wasmtime_extern_t::kind is #WASMTIME_EXTERN_INSTANCE
-    wasmtime_instance_t instance;
-    /// Field used if #wasmtime_extern_t::kind is #WASMTIME_EXTERN_MODULE
-    ///
-    /// Note that this may be an owned pointer depending on the ownership of the
-    /// #wasmtime_extern_t container value.
-    wasmtime_module_t *module;
 } wasmtime_extern_union_t;
 
 /**
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/func.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/func.h
similarity index 97%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/func.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/func.h
index 83339e8b2b..e65d002c66 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/func.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/func.h
@@ -101,6 +101,8 @@ WASM_API_EXTERN void wasmtime_func_new(
  *        array depends on the function type that the host function is created
  *        with, but it will be the maximum of the number of parameters and
  *        number of results.
+ * \param num_args_and_results the size of the `args_and_results` parameter in
+ *        units of #wasmtime_val_raw_t.
  *
  * This callback can optionally return a #wasm_trap_t indicating that a trap
  * should be raised in WebAssembly. It's expected that in this case the caller
@@ -121,7 +123,8 @@ WASM_API_EXTERN void wasmtime_func_new(
 typedef wasm_trap_t* (*wasmtime_func_unchecked_callback_t)(
     void *env,
     wasmtime_caller_t* caller,
-    wasmtime_val_raw_t *args_and_results);
+    wasmtime_val_raw_t *args_and_results,
+    size_t num_args_and_results);
 
 /**
  * \brief Creates a new host function in the same manner of #wasmtime_func_new,
@@ -238,10 +241,11 @@ WASM_API_EXTERN wasmtime_error_t *wasmtime_func_call(
  * faster than that function, but the tradeoff is that embeddings must uphold
  * more invariants rather than relying on Wasmtime to check them for you.
  */
-WASM_API_EXTERN wasm_trap_t *wasmtime_func_call_unchecked(
+WASM_API_EXTERN wasmtime_error_t *wasmtime_func_call_unchecked(
     wasmtime_context_t *store,
     const wasmtime_func_t *func,
-    wasmtime_val_raw_t *args_and_results
+    wasmtime_val_raw_t *args_and_results,
+    wasm_trap_t **trap
 );
 
 /**
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/global.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/global.h
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/global.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/global.h
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/instance.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/instance.h
new file mode 100644
index 0000000000..544661f9d8
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/instance.h
@@ -0,0 +1,128 @@
+/**
+ * \file wasmtime/instance.h
+ *
+ * Wasmtime APIs for interacting with wasm instances.
+ */
+
+#ifndef WASMTIME_INSTANCE_H
+#define WASMTIME_INSTANCE_H
+
+#include <wasm.h>
+#include <wasmtime/extern.h>
+#include <wasmtime/module.h>
+#include <wasmtime/store.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/// \brief Representation of a instance in Wasmtime.
+///
+/// Instances are represented with a 64-bit identifying integer in Wasmtime.
+/// They do not have any destructor associated with them. Instances cannot
+/// interoperate between #wasmtime_store_t instances and if the wrong instance
+/// is passed to the wrong store then it may trigger an assertion to abort the
+/// process.
+typedef struct wasmtime_instance {
+  /// Internal identifier of what store this belongs to, never zero.
+  uint64_t store_id;
+  /// Internal index within the store.
+  size_t index;
+} wasmtime_instance_t;
+
+/**
+ * \brief Instantiate a wasm module.
+ *
+ * This function will instantiate a WebAssembly module with the provided
+ * imports, creating a WebAssembly instance. The returned instance can then
+ * afterwards be inspected for exports.
+ *
+ * \param store the store in which to create the instance
+ * \param module the module that's being instantiated
+ * \param imports the imports provided to the module
+ * \param nimports the size of `imports`
+ * \param instance where to store the returned instance
+ * \param trap where to store the returned trap
+ *
+ * This function requires that `imports` is the same size as the imports that
+ * `module` has. Additionally the `imports` array must be 1:1 lined up with the
+ * imports of the `module` specified. This is intended to be relatively low
+ * level, and #wasmtime_linker_instantiate is provided for a more ergonomic
+ * name-based resolution API.
+ *
+ * The states of return values from this function are similar to
+ * #wasmtime_func_call where an error can be returned meaning something like a
+ * link error in this context. A trap can be returned (meaning no error or
+ * instance is returned), or an instance can be returned (meaning no error or
+ * trap is returned).
+ *
+ * Note that this function requires that all `imports` specified must be owned
+ * by the `store` provided as well.
+ *
+ * This function does not take ownership of any of its arguments, but all return
+ * values are owned by the caller.
+ */
+WASM_API_EXTERN wasmtime_error_t *wasmtime_instance_new(
+    wasmtime_context_t *store,
+    const wasmtime_module_t *module,
+    const wasmtime_extern_t* imports,
+    size_t nimports,
+    wasmtime_instance_t *instance,
+    wasm_trap_t **trap
+);
+
+/**
+ * \brief Get an export by name from an instance.
+ *
+ * \param store the store that owns `instance`
+ * \param instance the instance to lookup within
+ * \param name the export name to lookup
+ * \param name_len the byte length of `name`
+ * \param item where to store the returned value
+ *
+ * Returns nonzero if the export was found, and `item` is filled in. Otherwise
+ * returns 0.
+ *
+ * Doesn't take ownership of any arguments but does return ownership of the
+ * #wasmtime_extern_t.
+ */
+WASM_API_EXTERN bool wasmtime_instance_export_get(
+    wasmtime_context_t *store,
+    const wasmtime_instance_t *instance,
+    const char *name,
+    size_t name_len,
+    wasmtime_extern_t *item
+);
+
+/**
+ * \brief Get an export by index from an instance.
+ *
+ * \param store the store that owns `instance`
+ * \param instance the instance to lookup within
+ * \param index the index to lookup
+ * \param name where to store the name of the export
+ * \param name_len where to store the byte length of the name
+ * \param item where to store the export itself
+ *
+ * Returns nonzero if the export was found, and `name`, `name_len`, and `item`
+ * are filled in. Otherwise returns 0.
+ *
+ * Doesn't take ownership of any arguments but does return ownership of the
+ * #wasmtime_extern_t. The `name` pointer return value is owned by the `store`
+ * and must be immediately used before calling any other APIs on
+ * #wasmtime_context_t.
+ */
+WASM_API_EXTERN bool wasmtime_instance_export_nth(
+    wasmtime_context_t *store,
+    const wasmtime_instance_t *instance,
+    size_t index,
+    char **name,
+    size_t *name_len,
+    wasmtime_extern_t *item
+);
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif
+
+#endif // WASMTIME_INSTANCE_H
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/linker.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/linker.h
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/linker.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/linker.h
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/memory.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/memory.h
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/memory.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/memory.h
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/module.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/module.h
new file mode 100644
index 0000000000..deb6bcec1e
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/module.h
@@ -0,0 +1,155 @@
+/**
+ * \file wasmtime/module.h
+ *
+ * APIs for interacting with modules in Wasmtime
+ */
+
+#ifndef WASMTIME_MODULE_H
+#define WASMTIME_MODULE_H
+
+#include <wasm.h>
+#include <wasmtime/error.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \typedef wasmtime_module_t
+ * \brief Convenience alias for #wasmtime_module
+ *
+ * \struct wasmtime_module
+ * \brief A compiled Wasmtime module.
+ *
+ * This type represents a compiled WebAssembly module. The compiled module is
+ * ready to be instantiated and can be inspected for imports/exports. It is safe
+ * to use a module across multiple threads simultaneously.
+ */
+typedef struct wasmtime_module wasmtime_module_t;
+
+/**
+ * \brief Compiles a WebAssembly binary into a #wasmtime_module_t
+ *
+ * This function will compile a WebAssembly binary into an owned #wasm_module_t.
+ * This performs the same as #wasm_module_new except that it returns a
+ * #wasmtime_error_t type to get richer error information.
+ *
+ * On success the returned #wasmtime_error_t is `NULL` and the `ret` pointer is
+ * filled in with a #wasm_module_t. On failure the #wasmtime_error_t is
+ * non-`NULL` and the `ret` pointer is unmodified.
+ *
+ * This function does not take ownership of any of its arguments, but the
+ * returned error and module are owned by the caller.
+ */
+WASM_API_EXTERN wasmtime_error_t *wasmtime_module_new(
+    wasm_engine_t *engine,
+    const uint8_t *wasm,
+    size_t wasm_len,
+    wasmtime_module_t **ret
+);
+
+/**
+ * \brief Deletes a module.
+ */
+WASM_API_EXTERN void wasmtime_module_delete(wasmtime_module_t *m);
+
+/**
+ * \brief Creates a shallow clone of the specified module, increasing the
+ * internal reference count.
+ */
+WASM_API_EXTERN wasmtime_module_t *wasmtime_module_clone(wasmtime_module_t *m);
+
+/**
+ * \brief Same as #wasm_module_imports, but for #wasmtime_module_t.
+ */
+WASM_API_EXTERN void wasmtime_module_imports(
+    const wasmtime_module_t *module,
+    wasm_importtype_vec_t *out
+);
+
+/**
+ * \brief Same as #wasm_module_exports, but for #wasmtime_module_t.
+ */
+WASM_API_EXTERN void wasmtime_module_exports(
+    const wasmtime_module_t *module,
+    wasm_exporttype_vec_t *out
+);
+
+/**
+ * \brief Validate a WebAssembly binary.
+ *
+ * This function will validate the provided byte sequence to determine if it is
+ * a valid WebAssembly binary within the context of the engine provided.
+ *
+ * This function does not take ownership of its arguments but the caller is
+ * expected to deallocate the returned error if it is non-`NULL`.
+ *
+ * If the binary validates then `NULL` is returned, otherwise the error returned
+ * describes why the binary did not validate.
+ */
+WASM_API_EXTERN wasmtime_error_t *wasmtime_module_validate(
+    wasm_engine_t *engine,
+    const uint8_t *wasm,
+    size_t wasm_len
+);
+
+/**
+ * \brief This function serializes compiled module artifacts as blob data.
+ *
+ * \param module the module
+ * \param ret if the conversion is successful, this byte vector is filled in with
+ *   the serialized compiled module.
+ *
+ * \return a non-null error if parsing fails, or returns `NULL`. If parsing
+ * fails then `ret` isn't touched.
+ *
+ * This function does not take ownership of `module`, and the caller is
+ * expected to deallocate the returned #wasmtime_error_t and #wasm_byte_vec_t.
+ */
+WASM_API_EXTERN wasmtime_error_t* wasmtime_module_serialize(
+    wasmtime_module_t* module,
+    wasm_byte_vec_t *ret
+);
+
+/**
+ * \brief Build a module from serialized data.
+ *
+ * This function does not take ownership of any of its arguments, but the
+ * returned error and module are owned by the caller.
+ *
+ * This function is not safe to receive arbitrary user input. See the Rust
+ * documentation for more information on what inputs are safe to pass in here
+ * (e.g. only that of #wasmtime_module_serialize)
+ */
+WASM_API_EXTERN wasmtime_error_t *wasmtime_module_deserialize(
+    wasm_engine_t *engine,
+    const uint8_t *bytes,
+    size_t bytes_len,
+    wasmtime_module_t **ret
+);
+
+/**
+ * \brief Deserialize a module from an on-disk file.
+ *
+ * This function is the same as #wasmtime_module_deserialize except that it
+ * reads the data for the serialized module from the path on disk. This can be
+ * faster than the alternative which may require copying the data around.
+ *
+ * This function does not take ownership of any of its arguments, but the
+ * returned error and module are owned by the caller.
+ *
+ * This function is not safe to receive arbitrary user input. See the Rust
+ * documentation for more information on what inputs are safe to pass in here
+ * (e.g. only that of #wasmtime_module_serialize)
+ */
+WASM_API_EXTERN wasmtime_error_t *wasmtime_module_deserialize_file(
+    wasm_engine_t *engine,
+    const char *path,
+    wasmtime_module_t **ret
+);
+
+#ifdef __cplusplus
+}  // extern "C"
+#endif
+
+#endif // WASMTIME_MODULE_H
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/store.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/store.h
similarity index 79%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/store.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/store.h
index f8298c10fa..55c9f680bd 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/store.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/store.h
@@ -154,7 +154,7 @@ WASM_API_EXTERN bool wasmtime_context_fuel_consumed(const wasmtime_context_t *co
 WASM_API_EXTERN wasmtime_error_t *wasmtime_context_consume_fuel(wasmtime_context_t *context, uint64_t fuel, uint64_t *remaining);
 
 /**
- * \brief Configres WASI state within the specified store.
+ * \brief Configures WASI state within the specified store.
  *
  * This function is required if #wasmtime_linker_define_wasi is called. This
  * will configure the WASI state for instances defined within this store to the
@@ -167,47 +167,15 @@ WASM_API_EXTERN wasmtime_error_t *wasmtime_context_consume_fuel(wasmtime_context
 WASM_API_EXTERN wasmtime_error_t *wasmtime_context_set_wasi(wasmtime_context_t *context, wasi_config_t *wasi);
 
 /**
- * \typedef wasmtime_interrupt_handle_t
- * \brief Convenience alias for #wasmtime_interrupt_handle_t
+ * \brief Configures the relative deadline at which point WebAssembly code will
+ * trap.
  *
- * \struct wasmtime_interrupt_handle_t
- * \brief A handle used to interrupt executing WebAssembly code.
+ * This function configures the store-local epoch deadline after which point
+ * WebAssembly code will trap.
  *
- * This structure is an opaque handle that represents a handle to a store. This
- * handle can be used to remotely (from another thread) interrupt currently
- * executing WebAssembly code.
- *
- * This structure is safe to share from multiple threads.
- */
-typedef struct wasmtime_interrupt_handle wasmtime_interrupt_handle_t;
-
-/**
- * \brief Creates a new interrupt handle to interrupt executing WebAssembly from
- * the provided store.
- *
- * There are a number of caveats about how interrupt is handled in Wasmtime. For
- * more information see the [Rust
- * documentation](https://bytecodealliance.github.io/wasmtime/api/wasmtime/struct.Store.html#method.interrupt_handle).
- *
- * This function returns `NULL` if the store's configuration does not have
- * interrupts enabled. See #wasmtime_config_interruptable_set.
- */
-WASM_API_EXTERN wasmtime_interrupt_handle_t *wasmtime_interrupt_handle_new(wasmtime_context_t *context);
-
-/**
- * \brief Requests that WebAssembly code running in the store attached to this
- * interrupt handle is interrupted.
- *
- * For more information about interrupts see #wasmtime_interrupt_handle_new.
- *
- * Note that this is safe to call from any thread.
- */
-WASM_API_EXTERN void wasmtime_interrupt_handle_interrupt(wasmtime_interrupt_handle_t *handle);
-
-/**
- * \brief Deletes an interrupt handle.
+ * See also #wasmtime_config_epoch_interruption_set.
  */
-WASM_API_EXTERN void wasmtime_interrupt_handle_delete(wasmtime_interrupt_handle_t *handle);
+WASM_API_EXTERN void wasmtime_context_set_epoch_deadline(wasmtime_context_t *context, uint64_t ticks_beyond_current);
 
 #ifdef __cplusplus
 }  // extern "C"
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/table.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/table.h
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/table.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/table.h
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/trap.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/trap.h
similarity index 88%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/trap.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/trap.h
index 909a4801f0..6346cf443b 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/trap.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/trap.h
@@ -69,15 +69,6 @@ WASM_API_EXTERN wasm_trap_t *wasmtime_trap_new(const char *msg, size_t msg_len);
  */
 WASM_API_EXTERN bool wasmtime_trap_code(const wasm_trap_t*, wasmtime_trap_code_t *code);
 
-/**
- * \brief Attempts to extract a WASI-specific exit status from this trap.
- *
- * Returns `true` if the trap is a WASI "exit" trap and has a return status. If
- * `true` is returned then the exit status is returned through the `status`
- * pointer. If `false` is returned then this is not a wasi exit trap.
- */
-WASM_API_EXTERN bool wasmtime_trap_exit_status(const wasm_trap_t*, int *status);
-
 /**
  * \brief Returns a human-readable name for this frame's function.
  *
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/val.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/val.h
similarity index 93%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/val.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/val.h
index c17f605cd8..ae0a1961ce 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/build/include/wasmtime/val.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime/val.h
@@ -119,24 +119,38 @@ typedef uint8_t wasmtime_v128[16];
  */
 typedef union wasmtime_valunion {
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_I32
+  ///
+  /// Note that this field is always stored in a little-endian format.
   int32_t i32;
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_I64
+  ///
+  /// Note that this field is always stored in a little-endian format.
   int64_t i64;
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_F32
+  ///
+  /// Note that this field is always stored in a little-endian format.
   float32_t f32;
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_F64
+  ///
+  /// Note that this field is always stored in a little-endian format.
   float64_t f64;
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_FUNCREF
   ///
   /// If this value represents a `ref.null func` value then the `store_id` field
   /// is set to zero.
+  ///
+  /// Note that this field is always stored in a little-endian format.
   wasmtime_func_t funcref;
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_EXTERNREF
   ///
   /// If this value represents a `ref.null extern` value then this pointer will
   /// be `NULL`.
+  ///
+  /// Note that this field is always stored in a little-endian format.
   wasmtime_externref_t *externref;
   /// Field used if #wasmtime_val_t::kind is #WASMTIME_V128
+  ///
+  /// Note that this field is always stored in a little-endian format.
   wasmtime_v128 v128;
 } wasmtime_valunion_t;
 
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-aarch64/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/linux-aarch64/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64/libwasmtime.a
new file mode 100644
index 0000000000..ae507a6b72
Binary files /dev/null and b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64/libwasmtime.a differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/linux-x86_64/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/linux-x86_64/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64/libwasmtime.a
new file mode 100644
index 0000000000..b76b5d9aca
Binary files /dev/null and b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64/libwasmtime.a differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/macos-aarch64/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/macos-aarch64/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64/libwasmtime.a
new file mode 100644
index 0000000000..e3a8a1dc6c
Binary files /dev/null and b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64/libwasmtime.a differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/macos-x86_64/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/macos-x86_64/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64/libwasmtime.a
new file mode 100644
index 0000000000..d017a269f3
Binary files /dev/null and b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64/libwasmtime.a differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/build/windows-x86_64/empty.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64/empty.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/build/windows-x86_64/empty.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64/empty.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64/libwasmtime.a b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64/libwasmtime.a
new file mode 100644
index 0000000000..b5b3046fdb
Binary files /dev/null and b/vendor/github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64/libwasmtime.a differ
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/config.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/config.go
new file mode 100644
index 0000000000..1290708846
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/config.go
@@ -0,0 +1,184 @@
+package wasmtime
+
+// #include <wasm.h>
+// #include <wasmtime.h>
+// #include <stdlib.h>
+import "C"
+import (
+	"runtime"
+	"unsafe"
+)
+
+// Strategy is the compilation strategies for wasmtime
+type Strategy C.wasmtime_strategy_t
+
+const (
+	// StrategyAuto will let wasmtime automatically pick an appropriate compilation strategy
+	StrategyAuto Strategy = C.WASMTIME_STRATEGY_AUTO
+	// StrategyCranelift will force wasmtime to use the Cranelift backend
+	StrategyCranelift Strategy = C.WASMTIME_STRATEGY_CRANELIFT
+)
+
+// OptLevel decides what degree of optimization wasmtime will perform on generated machine code
+type OptLevel C.wasmtime_opt_level_t
+
+const (
+	// OptLevelNone will perform no optimizations
+	OptLevelNone OptLevel = C.WASMTIME_OPT_LEVEL_NONE
+	// OptLevelSpeed will optimize machine code to be as fast as possible
+	OptLevelSpeed OptLevel = C.WASMTIME_OPT_LEVEL_SPEED
+	// OptLevelSpeedAndSize will optimize machine code for speed, but also optimize
+	// to be small, sometimes at the cost of speed.
+	OptLevelSpeedAndSize OptLevel = C.WASMTIME_OPT_LEVEL_SPEED_AND_SIZE
+)
+
+// ProfilingStrategy decides what sort of profiling to enable, if any.
+type ProfilingStrategy C.wasmtime_profiling_strategy_t
+
+const (
+	// ProfilingStrategyNone means no profiler will be used
+	ProfilingStrategyNone ProfilingStrategy = C.WASMTIME_PROFILING_STRATEGY_NONE
+	// ProfilingStrategyJitdump will use the "jitdump" linux support
+	ProfilingStrategyJitdump ProfilingStrategy = C.WASMTIME_PROFILING_STRATEGY_JITDUMP
+)
+
+// Config holds options used to create an Engine and customize its behavior.
+type Config struct {
+	_ptr *C.wasm_config_t
+}
+
+// NewConfig creates a new `Config` with all default options configured.
+func NewConfig() *Config {
+	config := &Config{_ptr: C.wasm_config_new()}
+	runtime.SetFinalizer(config, func(config *Config) {
+		C.wasm_config_delete(config._ptr)
+	})
+	return config
+}
+
+// SetDebugInfo configures whether dwarf debug information for JIT code is enabled
+func (cfg *Config) SetDebugInfo(enabled bool) {
+	C.wasmtime_config_debug_info_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmThreads configures whether the wasm threads proposal is enabled
+func (cfg *Config) SetWasmThreads(enabled bool) {
+	C.wasmtime_config_wasm_threads_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmReferenceTypes configures whether the wasm reference types proposal is enabled
+func (cfg *Config) SetWasmReferenceTypes(enabled bool) {
+	C.wasmtime_config_wasm_reference_types_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmSIMD configures whether the wasm SIMD proposal is enabled
+func (cfg *Config) SetWasmSIMD(enabled bool) {
+	C.wasmtime_config_wasm_simd_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmBulkMemory configures whether the wasm bulk memory proposal is enabled
+func (cfg *Config) SetWasmBulkMemory(enabled bool) {
+	C.wasmtime_config_wasm_bulk_memory_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmMultiValue configures whether the wasm multi value proposal is enabled
+func (cfg *Config) SetWasmMultiValue(enabled bool) {
+	C.wasmtime_config_wasm_multi_value_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmMultiMemory configures whether the wasm multi memory proposal is enabled
+func (cfg *Config) SetWasmMultiMemory(enabled bool) {
+	C.wasmtime_config_wasm_multi_memory_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetWasmMemory64 configures whether the wasm memory64 proposal is enabled
+func (cfg *Config) SetWasmMemory64(enabled bool) {
+	C.wasmtime_config_wasm_memory64_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetConsumFuel configures whether fuel is enabled
+func (cfg *Config) SetConsumeFuel(enabled bool) {
+	C.wasmtime_config_consume_fuel_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetStrategy configures what compilation strategy is used to compile wasm code
+func (cfg *Config) SetStrategy(strat Strategy) {
+	C.wasmtime_config_strategy_set(cfg.ptr(), C.wasmtime_strategy_t(strat))
+	runtime.KeepAlive(cfg)
+}
+
+// SetCraneliftDebugVerifier configures whether the cranelift debug verifier will be active when
+// cranelift is used to compile wasm code.
+func (cfg *Config) SetCraneliftDebugVerifier(enabled bool) {
+	C.wasmtime_config_cranelift_debug_verifier_set(cfg.ptr(), C.bool(enabled))
+	runtime.KeepAlive(cfg)
+}
+
+// SetCraneliftOptLevel configures the cranelift optimization level for generated code
+func (cfg *Config) SetCraneliftOptLevel(level OptLevel) {
+	C.wasmtime_config_cranelift_opt_level_set(cfg.ptr(), C.wasmtime_opt_level_t(level))
+	runtime.KeepAlive(cfg)
+}
+
+// SetProfiler configures what profiler strategy to use for generated code
+func (cfg *Config) SetProfiler(profiler ProfilingStrategy) {
+	C.wasmtime_config_profiler_set(cfg.ptr(), C.wasmtime_profiling_strategy_t(profiler))
+	runtime.KeepAlive(cfg)
+}
+
+// CacheConfigLoadDefault enables compiled code caching for this `Config` using the default settings
+// configuration can be found.
+//
+// For more information about caching see
+// https://bytecodealliance.github.io/wasmtime/cli-cache.html
+func (cfg *Config) CacheConfigLoadDefault() error {
+	err := C.wasmtime_config_cache_config_load(cfg.ptr(), nil)
+	runtime.KeepAlive(cfg)
+	if err != nil {
+		return mkError(err)
+	}
+	return nil
+}
+
+// CacheConfigLoad enables compiled code caching for this `Config` using the settings specified
+// in the configuration file `path`.
+//
+// For more information about caching and configuration options see
+// https://bytecodealliance.github.io/wasmtime/cli-cache.html
+func (cfg *Config) CacheConfigLoad(path string) error {
+	cstr := C.CString(path)
+	err := C.wasmtime_config_cache_config_load(cfg.ptr(), cstr)
+	C.free(unsafe.Pointer(cstr))
+	runtime.KeepAlive(cfg)
+	if err != nil {
+		return mkError(err)
+	}
+	return nil
+}
+
+// SetEpochInterruption enables epoch-based instrumentation of generated code to
+// interrupt WebAssembly execution when the current engine epoch exceeds a
+// defined threshold.
+func (cfg *Config) SetEpochInterruption(enable bool) {
+	C.wasmtime_config_epoch_interruption_set(cfg.ptr(), C.bool(enable))
+	runtime.KeepAlive(cfg)
+}
+
+// See comments in `ffi.go` for what's going on here
+func (cfg *Config) ptr() *C.wasm_config_t {
+	ret := cfg._ptr
+	maybeGC()
+	if ret == nil {
+		panic("Config has already been used up")
+	}
+	return ret
+}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/doc.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/doc.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/doc.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/doc.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/engine.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/engine.go
new file mode 100644
index 0000000000..f3e5c1c50d
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/engine.go
@@ -0,0 +1,56 @@
+package wasmtime
+
+// #include <wasmtime.h>
+import "C"
+import (
+	"runtime"
+)
+
+// Engine is an instance of a wasmtime engine which is used to create a `Store`.
+//
+// Engines are a form of global configuration for wasm compilations and modules
+// and such.
+type Engine struct {
+	_ptr *C.wasm_engine_t
+}
+
+// NewEngine creates a new `Engine` with default configuration.
+func NewEngine() *Engine {
+	engine := &Engine{_ptr: C.wasm_engine_new()}
+	runtime.SetFinalizer(engine, func(engine *Engine) {
+		C.wasm_engine_delete(engine._ptr)
+	})
+	return engine
+}
+
+// NewEngineWithConfig creates a new `Engine` with the `Config` provided
+//
+// Note that once a `Config` is passed to this method it cannot be used again.
+func NewEngineWithConfig(config *Config) *Engine {
+	if config.ptr() == nil {
+		panic("config already used")
+	}
+	engine := &Engine{_ptr: C.wasm_engine_new_with_config(config.ptr())}
+	runtime.SetFinalizer(config, nil)
+	config._ptr = nil
+	runtime.SetFinalizer(engine, func(engine *Engine) {
+		C.wasm_engine_delete(engine._ptr)
+	})
+	return engine
+}
+
+func (engine *Engine) ptr() *C.wasm_engine_t {
+	ret := engine._ptr
+	maybeGC()
+	return ret
+}
+
+// IncrementEpoch will increase the current epoch number by 1 within the
+// current engine which will cause any connected stores with their epoch
+// deadline exceeded to now be interrupted.
+//
+// This method is safe to call from any goroutine.
+func (engine *Engine) IncrementEpoch() {
+	C.wasmtime_engine_increment_epoch(engine.ptr())
+	runtime.KeepAlive(engine)
+}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/error.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/error.go
new file mode 100644
index 0000000000..4f7d66669c
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/error.go
@@ -0,0 +1,42 @@
+package wasmtime
+
+// #include <wasmtime.h>
+import "C"
+import "runtime"
+
+type Error struct {
+	_ptr *C.wasmtime_error_t
+}
+
+func mkError(ptr *C.wasmtime_error_t) *Error {
+	err := &Error{_ptr: ptr}
+	runtime.SetFinalizer(err, func(err *Error) {
+		C.wasmtime_error_delete(err._ptr)
+	})
+	return err
+}
+
+func (e *Error) ptr() *C.wasmtime_error_t {
+	ret := e._ptr
+	maybeGC()
+	return ret
+}
+
+func (e *Error) Error() string {
+	message := C.wasm_byte_vec_t{}
+	C.wasmtime_error_message(e.ptr(), &message)
+	ret := C.GoStringN(message.data, C.int(message.size))
+	runtime.KeepAlive(e)
+	C.wasm_byte_vec_delete(&message)
+	return ret
+}
+
+// ExitStatus returns an `int32` exit status if this was a WASI-defined exit
+// code. The `bool` returned indicates whether it was a WASI-defined exit or
+// not.
+func (e *Error) ExitStatus() (int32, bool) {
+	status := C.int(0)
+	ok := C.wasmtime_error_exit_status(e.ptr(), &status)
+	runtime.KeepAlive(e)
+	return int32(status), bool(ok)
+}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/exporttype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/exporttype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/exporttype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/exporttype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/extern.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/extern.go
similarity index 78%
rename from vendor/github.com/bytecodealliance/wasmtime-go/extern.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/extern.go
index 96a73bf202..77166d5ea6 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/extern.go
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/extern.go
@@ -83,29 +83,6 @@ func (e *Extern) Table() *Table {
 	return ret
 }
 
-// Module returns a Module if this export is a module or nil otherwise
-func (e *Extern) Module() *Module {
-	ptr := e.ptr()
-	if ptr.kind != C.WASMTIME_EXTERN_MODULE {
-		return nil
-	}
-	module := C.go_wasmtime_extern_module_get(ptr)
-	ret := mkModule(C.wasmtime_module_clone(module))
-	runtime.KeepAlive(e)
-	return ret
-}
-
-// Instance returns a Instance if this export is a module or nil otherwise
-func (e *Extern) Instance() *Instance {
-	ptr := e.ptr()
-	if ptr.kind != C.WASMTIME_EXTERN_INSTANCE {
-		return nil
-	}
-	ret := mkInstance(C.go_wasmtime_extern_instance_get(ptr))
-	runtime.KeepAlive(e)
-	return ret
-}
-
 func (e *Extern) AsExtern() C.wasmtime_extern_t {
 	return *e.ptr()
 }
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/externtype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/externtype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/externtype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/externtype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/ffi.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/ffi.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/ffi.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/ffi.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/func.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/func.go
similarity index 98%
rename from vendor/github.com/bytecodealliance/wasmtime-go/func.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/func.go
index 5a874fa83a..9759ec0089 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/func.go
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/func.go
@@ -112,7 +112,9 @@ func goTrampolineNew(
 	}()
 	if trap == nil && lastPanic != nil {
 		data.lastPanic = lastPanic
-		return nil
+		trap := NewTrap("go panicked")
+		runtime.SetFinalizer(trap, nil)
+		return trap.ptr()
 	}
 	if trap != nil {
 		runtime.SetFinalizer(trap, nil)
@@ -276,7 +278,9 @@ func goTrampolineWrap(
 	}()
 	if lastPanic != nil {
 		data.lastPanic = lastPanic
-		return nil
+		trap := NewTrap("go panicked")
+		runtime.SetFinalizer(trap, nil)
+		return trap.ptr()
 	}
 
 	// And now we write all the results into memory depending on the type
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/functype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/functype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/functype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/functype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/global.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/global.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/global.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/global.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/globaltype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/globaltype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/globaltype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/globaltype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/importtype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/importtype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/importtype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/importtype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/includebuild.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/includebuild.go
new file mode 100644
index 0000000000..6b234afcd4
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/includebuild.go
@@ -0,0 +1,22 @@
+//go:build includebuild
+// +build includebuild
+
+package wasmtime
+
+// This file is not built and not included in BUILD.bazel;
+// it is only used to prevent "go mod vendor" to prune the
+// build directory.
+
+import (
+	// Import these build directories in order to have them
+	// included in vendored dependencies.
+	// Cf. https://github.com/golang/go/issues/26366
+
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/include"
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime"
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64"
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64"
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64"
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64"
+	_ "github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64"
+)
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/instance.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/instance.go
similarity index 84%
rename from vendor/github.com/bytecodealliance/wasmtime-go/instance.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/instance.go
index 7cb03a18e8..2c4be1c064 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/instance.go
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/instance.go
@@ -22,7 +22,7 @@ type Instance struct {
 // This will also run the `start` function of the instance, returning an error
 // if it traps.
 func NewInstance(store Storelike, module *Module, imports []AsExtern) (*Instance, error) {
-	importsRaw := make([]C.wasmtime_extern_t, len(imports), len(imports))
+	importsRaw := make([]C.wasmtime_extern_t, len(imports))
 	for i, imp := range imports {
 		importsRaw[i] = imp.AsExtern()
 	}
@@ -55,13 +55,6 @@ func mkInstance(val C.wasmtime_instance_t) *Instance {
 	return &Instance{val}
 }
 
-// Type returns an `InstanceType` that corresponds for this instance.
-func (i *Instance) Type(store Storelike) *InstanceType {
-	ptr := C.wasmtime_instance_type(store.Context(), &i.val)
-	runtime.KeepAlive(store)
-	return mkInstanceType(ptr, nil)
-}
-
 type externList struct {
 	vec C.wasm_extern_vec_t
 }
@@ -113,7 +106,7 @@ func (i *Instance) GetExport(store Storelike, name string) *Extern {
 	return nil
 }
 
-// GetFunc attemps to find a function on this instance by `name`.
+// GetFunc attempts to find a function on this instance by `name`.
 //
 // May return `nil` if this instance has no function named `name`,
 // it is not a function, etc.
@@ -124,9 +117,3 @@ func (i *Instance) GetFunc(store Storelike, name string) *Func {
 	}
 	return f.Func()
 }
-
-func (i *Instance) AsExtern() C.wasmtime_extern_t {
-	ret := C.wasmtime_extern_t{kind: C.WASMTIME_EXTERN_INSTANCE}
-	C.go_wasmtime_extern_instance_set(&ret, i.val)
-	return ret
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/linker.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/linker.go
similarity index 98%
rename from vendor/github.com/bytecodealliance/wasmtime-go/linker.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/linker.go
index e0ee18a6af..df2f068965 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/linker.go
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/linker.go
@@ -193,7 +193,7 @@ func (l *Linker) DefineWasi() error {
 	return mkError(err)
 }
 
-// Instantiate instantates a module with all imports defined in this linker.
+// Instantiate instantiates a module with all imports defined in this linker.
 //
 // Returns an error if the instance's imports couldn't be satisfied, had the
 // wrong types, or if a trap happened executing the start function.
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/maybe_gc_actual.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/maybe_gc_actual.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/maybe_gc_actual.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/maybe_gc_actual.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/maybe_gc_no.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/maybe_gc_no.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/maybe_gc_no.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/maybe_gc_no.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/memory.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/memory.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/memory.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/memory.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/memorytype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/memorytype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/memorytype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/memorytype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/module.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/module.go
similarity index 89%
rename from vendor/github.com/bytecodealliance/wasmtime-go/module.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/module.go
index 94f84449df..c2ea718e08 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/module.go
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/module.go
@@ -3,8 +3,9 @@ package wasmtime
 // #include "shims.h"
 // #include <stdlib.h>
 import "C"
+
 import (
-	"io/ioutil"
+	"os"
 	"runtime"
 	"unsafe"
 )
@@ -45,7 +46,7 @@ func NewModule(engine *Engine, wasm []byte) (*Module, error) {
 //
 // Afterwards delegates to the `NewModule` constructor with the contents read.
 func NewModuleFromFile(engine *Engine, file string) (*Module, error) {
-	wasm, err := ioutil.ReadFile(file)
+	wasm, err := os.ReadFile(file)
 	if err != nil {
 		return nil, err
 	}
@@ -58,7 +59,6 @@ func NewModuleFromFile(engine *Engine, file string) (*Module, error) {
 		}
 	}
 	return NewModule(engine, wasm)
-
 }
 
 // ModuleValidate validates whether `wasm` would be a valid wasm module according to the
@@ -92,11 +92,22 @@ func (m *Module) ptr() *C.wasmtime_module_t {
 	return ret
 }
 
-// Type returns a `ModuleType` that corresponds for this module.
-func (m *Module) Type() *ModuleType {
-	ptr := C.wasmtime_module_type(m.ptr())
+// Imports returns a list of `ImportType` which are the items imported by
+// this module and are required for instantiation
+func (m *Module) Imports() []*ImportType {
+	imports := &importTypeList{}
+	C.wasmtime_module_imports(m.ptr(), &imports.vec)
+	runtime.KeepAlive(m)
+	return imports.mkGoList()
+}
+
+// Exports returns a list of `ExportType` which are the items that will be
+// exported by this module after instantiation.
+func (m *Module) Exports() []*ExportType {
+	exports := &exportTypeList{}
+	C.wasmtime_module_exports(m.ptr(), &exports.vec)
 	runtime.KeepAlive(m)
-	return mkModuleType(ptr, nil)
+	return exports.mkGoList()
 }
 
 type importTypeList struct {
@@ -149,8 +160,8 @@ func (list *exportTypeList) mkGoList() []*ExportType {
 // If deserialization is successful then a compiled module is returned,
 // otherwise nil and an error are returned.
 //
-// Note that to deserialize successfully the bytes provided must have beeen
-// produced with an `Engine` that has the same commpilation options as the
+// Note that to deserialize successfully the bytes provided must have been
+// produced with an `Engine` that has the same compilation options as the
 // provided engine, and from the same version of this library.
 func NewModuleDeserialize(engine *Engine, encoded []byte) (*Module, error) {
 	var encodedPtr *C.uint8_t
@@ -209,9 +220,3 @@ func (m *Module) Serialize() ([]byte, error) {
 	C.wasm_byte_vec_delete(&retVec)
 	return ret, nil
 }
-
-func (m *Module) AsExtern() C.wasmtime_extern_t {
-	ret := C.wasmtime_extern_t{kind: C.WASMTIME_EXTERN_MODULE}
-	C.go_wasmtime_extern_module_set(&ret, m.ptr())
-	return ret
-}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/shims.c b/vendor/github.com/bytecodealliance/wasmtime-go/v3/shims.c
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/shims.c
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/shims.c
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/shims.h b/vendor/github.com/bytecodealliance/wasmtime-go/v3/shims.h
similarity index 86%
rename from vendor/github.com/bytecodealliance/wasmtime-go/shims.h
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/shims.h
index b9a91d19f8..3b42c48e72 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/shims.h
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/shims.h
@@ -25,10 +25,8 @@ wasmtime_externref_t *go_externref_new(size_t env);
   \
   UNION_ACCESSOR(wasmtime_extern, func, wasmtime_func_t) \
   UNION_ACCESSOR(wasmtime_extern, memory, wasmtime_memory_t) \
-  UNION_ACCESSOR(wasmtime_extern, instance, wasmtime_instance_t) \
   UNION_ACCESSOR(wasmtime_extern, table, wasmtime_table_t) \
-  UNION_ACCESSOR(wasmtime_extern, global, wasmtime_global_t) \
-  UNION_ACCESSOR(wasmtime_extern, module, wasmtime_module_t*)
+  UNION_ACCESSOR(wasmtime_extern, global, wasmtime_global_t)
 
 #define UNION_ACCESSOR(name, field, ty) \
   ty go_##name##_##field##_get(const name##_t *val); \
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/slab.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/slab.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/slab.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/slab.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/v3/store.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/store.go
new file mode 100644
index 0000000000..7dc8c59fae
--- /dev/null
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/store.go
@@ -0,0 +1,288 @@
+package wasmtime
+
+// #include <wasmtime.h>
+// #include "shims.h"
+import "C"
+import (
+	"reflect"
+	"runtime"
+	"sync"
+	"unsafe"
+)
+
+// Store is a general group of wasm instances, and many objects
+// must all be created with and reference the same `Store`
+type Store struct {
+	_ptr *C.wasmtime_store_t
+
+	// The `Engine` that this store uses for compilation and environment
+	// settings.
+	Engine *Engine
+}
+
+// Storelike represents types that can be used to contextually reference a
+// `Store`.
+//
+// This interface is implemented by `*Store` and `*Caller` and is pervasively
+// used throughout this library. You'll want to pass one of those two objects
+// into functions that take a `Storelike`.
+type Storelike interface {
+	// Returns the wasmtime context pointer this store is attached to.
+	Context() *C.wasmtime_context_t
+}
+
+var gStoreLock sync.Mutex
+var gStoreMap = make(map[int]*storeData)
+var gStoreSlab slab
+
+// State associated with a `Store`, currently used to propagate panic
+// information through invocations as well as store Go closures that have been
+// added to the store.
+type storeData struct {
+	engine    *Engine
+	funcNew   []funcNewEntry
+	funcWrap  []funcWrapEntry
+	lastPanic interface{}
+}
+
+type funcNewEntry struct {
+	callback func(*Caller, []Val) ([]Val, *Trap)
+	results  []*ValType
+}
+
+type funcWrapEntry struct {
+	callback reflect.Value
+}
+
+// NewStore creates a new `Store` from the configuration provided in `engine`
+func NewStore(engine *Engine) *Store {
+	// Allocate an index for this store and allocate some internal data to go with
+	// the store.
+	gStoreLock.Lock()
+	idx := gStoreSlab.allocate()
+	gStoreMap[idx] = &storeData{engine: engine}
+	gStoreLock.Unlock()
+
+	ptr := C.go_store_new(engine.ptr(), C.size_t(idx))
+	store := &Store{
+		_ptr:   ptr,
+		Engine: engine,
+	}
+	runtime.SetFinalizer(store, func(store *Store) {
+		C.wasmtime_store_delete(store._ptr)
+	})
+	return store
+}
+
+//export goFinalizeStore
+func goFinalizeStore(env unsafe.Pointer) {
+	// When a store is finalized this is used as the finalization callback for the
+	// custom data within the store, and our finalization here will delete the
+	// store's data from the global map and deallocate its index to get reused by
+	// a future store.
+	idx := int(uintptr(env))
+	gStoreLock.Lock()
+	defer gStoreLock.Unlock()
+	delete(gStoreMap, idx)
+	gStoreSlab.deallocate(idx)
+}
+
+// GC will clean up any `externref` values that are no longer actually
+// referenced.
+//
+// This function is not required to be called for correctness, it's only an
+// optimization if desired to clean out any extra `externref` values.
+func (store *Store) GC() {
+	C.wasmtime_context_gc(store.Context())
+	runtime.KeepAlive(store)
+}
+
+// SetWasi will configure the WASI state to use for instances within this
+// `Store`.
+//
+// The `wasi` argument cannot be reused for another `Store`, it's consumed by
+// this function.
+func (store *Store) SetWasi(wasi *WasiConfig) {
+	runtime.SetFinalizer(wasi, nil)
+	ptr := wasi.ptr()
+	wasi._ptr = nil
+	if ptr == nil {
+		panic("reuse of already-consumed WasiConfig")
+	}
+	C.wasmtime_context_set_wasi(store.Context(), ptr)
+	runtime.KeepAlive(store)
+}
+
+// Implementation of the `Storelike` interface
+func (store *Store) Context() *C.wasmtime_context_t {
+	ret := C.wasmtime_store_context(store._ptr)
+	maybeGC()
+	return ret
+}
+
+// SetEpochDeadline will configure the relative deadline, from the current
+// engine's epoch number, after which wasm code will be interrupted.
+func (store *Store) SetEpochDeadline(deadline uint64) {
+	C.wasmtime_context_set_epoch_deadline(store.Context(), C.uint64_t(deadline))
+	runtime.KeepAlive(store)
+}
+
+// Returns the underlying `*storeData` that this store references in Go, used
+// for inserting functions or storing panic data.
+func getDataInStore(store Storelike) *storeData {
+	data := uintptr(C.wasmtime_context_get_data(store.Context()))
+	gStoreLock.Lock()
+	defer gStoreLock.Unlock()
+	return gStoreMap[int(data)]
+}
+
+var gEngineFuncLock sync.Mutex
+var gEngineFuncNew = make(map[int]*funcNewEntry)
+var gEngineFuncNewSlab slab
+var gEngineFuncWrap = make(map[int]*funcWrapEntry)
+var gEngineFuncWrapSlab slab
+
+func insertFuncNew(data *storeData, ty *FuncType, callback func(*Caller, []Val) ([]Val, *Trap)) int {
+	var idx int
+	entry := funcNewEntry{
+		callback: callback,
+		results:  ty.Results(),
+	}
+	if data == nil {
+		gEngineFuncLock.Lock()
+		defer gEngineFuncLock.Unlock()
+		idx = gEngineFuncNewSlab.allocate()
+		gEngineFuncNew[idx] = &entry
+		idx = (idx << 1)
+	} else {
+		idx = len(data.funcNew)
+		data.funcNew = append(data.funcNew, entry)
+		idx = (idx << 1) | 1
+	}
+	return idx
+}
+
+func (data *storeData) getFuncNew(idx int) *funcNewEntry {
+	if idx&1 == 0 {
+		gEngineFuncLock.Lock()
+		defer gEngineFuncLock.Unlock()
+		return gEngineFuncNew[idx>>1]
+	} else {
+		return &data.funcNew[idx>>1]
+	}
+}
+
+func insertFuncWrap(data *storeData, callback reflect.Value) int {
+	var idx int
+	entry := funcWrapEntry{callback}
+	if data == nil {
+		gEngineFuncLock.Lock()
+		defer gEngineFuncLock.Unlock()
+		idx = gEngineFuncWrapSlab.allocate()
+		gEngineFuncWrap[idx] = &entry
+		idx = (idx << 1)
+	} else {
+		idx = len(data.funcWrap)
+		data.funcWrap = append(data.funcWrap, entry)
+		idx = (idx << 1) | 1
+	}
+	return idx
+
+}
+
+func (data *storeData) getFuncWrap(idx int) *funcWrapEntry {
+	if idx&1 == 0 {
+		gEngineFuncLock.Lock()
+		defer gEngineFuncLock.Unlock()
+		return gEngineFuncWrap[idx>>1]
+	} else {
+		return &data.funcWrap[idx>>1]
+	}
+}
+
+//export goFinalizeFuncNew
+func goFinalizeFuncNew(env unsafe.Pointer) {
+	idx := int(uintptr(env))
+	if idx&1 != 0 {
+		panic("shouldn't finalize a store-local index")
+	}
+	idx = idx >> 1
+	gEngineFuncLock.Lock()
+	defer gEngineFuncLock.Unlock()
+	delete(gEngineFuncNew, idx)
+	gEngineFuncNewSlab.deallocate(idx)
+
+}
+
+//export goFinalizeFuncWrap
+func goFinalizeFuncWrap(env unsafe.Pointer) {
+	idx := int(uintptr(env))
+	if idx&1 != 0 {
+		panic("shouldn't finalize a store-local index")
+	}
+	idx = idx >> 1
+	gEngineFuncLock.Lock()
+	defer gEngineFuncLock.Unlock()
+	delete(gEngineFuncWrap, idx)
+	gEngineFuncWrapSlab.deallocate(idx)
+}
+
+// FuelConsumed returns the amount of fuel consumed by this context's store
+// execution so far.
+//
+// If fuel consumption is not enabled via `Config.SetConsumeFuel` then this function
+// will return false. Otherwise true is returned and the fuel parameter is
+// filled in with fuel consumed so far.
+//
+// Also note that fuel, if enabled, must be originally configured via `Store.AddFuel`.
+func (store *Store) FuelConsumed() (uint64, bool) {
+	fuel := C.uint64_t(0)
+	enable := C.wasmtime_context_fuel_consumed(store.Context(), &fuel)
+	runtime.KeepAlive(store)
+
+	return uint64(fuel), bool(enable)
+}
+
+// AddFuel adds fuel to this context's store for wasm to consume while executing.
+//
+// For this method to work fuel consumption must be enabled via
+// `Config.SetConsumeFuel`. By default a store starts with 0 fuel
+// for wasm to execute with (meaning it will immediately trap).
+// This function must be called for the store to have
+// some fuel to allow WebAssembly to execute.
+//
+// Note that at this time when fuel is entirely consumed it will cause
+// wasm to trap. More usages of fuel are planned for the future.
+//
+// If fuel is not enabled within this store then an error is returned.
+func (store *Store) AddFuel(fuel uint64) error {
+	err := C.wasmtime_context_add_fuel(store.Context(), C.uint64_t(fuel))
+	runtime.KeepAlive(store)
+	if err != nil {
+		return mkError(err)
+	}
+
+	return nil
+}
+
+// ConsumeFuel attempts to manually consume fuel from the store.
+//
+// If fuel consumption is not enabled via `Config.SetConsumeFuel` then
+// this function will return an error. Otherwise this will attempt to consume
+// the specified amount of `fuel` from the store. If successful the remaining
+// amount of fuel is returned. If `fuel` couldn't be consumed
+// then an error is returned.
+//
+// Also note that fuel, if enabled, must be originally configured via
+// `Store.AddFuel`.
+func (store *Store) ConsumeFuel(fuel uint64) (uint64, error) {
+	var remaining uint64
+	c_remaining := C.uint64_t(remaining)
+	err := C.wasmtime_context_consume_fuel(store.Context(), C.uint64_t(fuel), &c_remaining)
+	runtime.KeepAlive(store)
+	if err != nil {
+		return 0, mkError(err)
+	}
+
+	return uint64(c_remaining), nil
+}
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/table.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/table.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/table.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/table.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/tabletype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/tabletype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/tabletype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/tabletype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/trap.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/trap.go
similarity index 98%
rename from vendor/github.com/bytecodealliance/wasmtime-go/trap.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/trap.go
index 55c0a42778..3860e3d1c7 100644
--- a/vendor/github.com/bytecodealliance/wasmtime-go/trap.go
+++ b/vendor/github.com/bytecodealliance/wasmtime-go/v3/trap.go
@@ -108,12 +108,13 @@ func unwrapStrOr(s *string, other string) string {
 }
 
 type frameList struct {
-	vec C.wasm_frame_vec_t
+	vec   C.wasm_frame_vec_t
+	owner interface{}
 }
 
 // Frames returns the wasm function frames that make up this trap
 func (t *Trap) Frames() []*Frame {
-	frames := &frameList{}
+	frames := &frameList{owner: t}
 	C.wasm_trap_trace(t.ptr(), &frames.vec)
 	runtime.KeepAlive(t)
 	runtime.SetFinalizer(frames, func(frames *frameList) {
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/val.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/val.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/val.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/val.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/valtype.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/valtype.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/valtype.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/valtype.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/wasi.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/wasi.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/wasi.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/wasi.go
diff --git a/vendor/github.com/bytecodealliance/wasmtime-go/wat2wasm.go b/vendor/github.com/bytecodealliance/wasmtime-go/v3/wat2wasm.go
similarity index 100%
rename from vendor/github.com/bytecodealliance/wasmtime-go/wat2wasm.go
rename to vendor/github.com/bytecodealliance/wasmtime-go/v3/wat2wasm.go
diff --git a/vendor/github.com/cenkalti/backoff/v4/.gitignore b/vendor/github.com/cenkalti/backoff/v4/.gitignore
new file mode 100644
index 0000000000..50d95c548b
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/.gitignore
@@ -0,0 +1,25 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+
+# IDEs
+.idea/
diff --git a/vendor/github.com/cenkalti/backoff/v4/LICENSE b/vendor/github.com/cenkalti/backoff/v4/LICENSE
new file mode 100644
index 0000000000..89b8179965
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/LICENSE
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Cenk Altı
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/cenkalti/backoff/v4/README.md b/vendor/github.com/cenkalti/backoff/v4/README.md
new file mode 100644
index 0000000000..16abdfc084
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/README.md
@@ -0,0 +1,32 @@
+# Exponential Backoff [![GoDoc][godoc image]][godoc] [![Build Status][travis image]][travis] [![Coverage Status][coveralls image]][coveralls]
+
+This is a Go port of the exponential backoff algorithm from [Google's HTTP Client Library for Java][google-http-java-client].
+
+[Exponential backoff][exponential backoff wiki]
+is an algorithm that uses feedback to multiplicatively decrease the rate of some process,
+in order to gradually find an acceptable rate.
+The retries exponentially increase and stop increasing when a certain threshold is met.
+
+## Usage
+
+Import path is `github.com/cenkalti/backoff/v4`. Please note the version part at the end.
+
+Use https://pkg.go.dev/github.com/cenkalti/backoff/v4 to view the documentation.
+
+## Contributing
+
+* I would like to keep this library as small as possible.
+* Please don't send a PR without opening an issue and discussing it first.
+* If proposed change is not a common use case, I will probably not accept it.
+
+[godoc]: https://pkg.go.dev/github.com/cenkalti/backoff/v4
+[godoc image]: https://godoc.org/github.com/cenkalti/backoff?status.png
+[travis]: https://travis-ci.org/cenkalti/backoff
+[travis image]: https://travis-ci.org/cenkalti/backoff.png?branch=master
+[coveralls]: https://coveralls.io/github/cenkalti/backoff?branch=master
+[coveralls image]: https://coveralls.io/repos/github/cenkalti/backoff/badge.svg?branch=master
+
+[google-http-java-client]: https://github.com/google/google-http-java-client/blob/da1aa993e90285ec18579f1553339b00e19b3ab5/google-http-client/src/main/java/com/google/api/client/util/ExponentialBackOff.java
+[exponential backoff wiki]: http://en.wikipedia.org/wiki/Exponential_backoff
+
+[advanced example]: https://pkg.go.dev/github.com/cenkalti/backoff/v4?tab=doc#pkg-examples
diff --git a/vendor/github.com/cenkalti/backoff/v4/backoff.go b/vendor/github.com/cenkalti/backoff/v4/backoff.go
new file mode 100644
index 0000000000..3676ee405d
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/backoff.go
@@ -0,0 +1,66 @@
+// Package backoff implements backoff algorithms for retrying operations.
+//
+// Use Retry function for retrying operations that may fail.
+// If Retry does not meet your needs,
+// copy/paste the function into your project and modify as you wish.
+//
+// There is also Ticker type similar to time.Ticker.
+// You can use it if you need to work with channels.
+//
+// See Examples section below for usage examples.
+package backoff
+
+import "time"
+
+// BackOff is a backoff policy for retrying an operation.
+type BackOff interface {
+	// NextBackOff returns the duration to wait before retrying the operation,
+	// or backoff. Stop to indicate that no more retries should be made.
+	//
+	// Example usage:
+	//
+	// 	duration := backoff.NextBackOff();
+	// 	if (duration == backoff.Stop) {
+	// 		// Do not retry operation.
+	// 	} else {
+	// 		// Sleep for duration and retry operation.
+	// 	}
+	//
+	NextBackOff() time.Duration
+
+	// Reset to initial state.
+	Reset()
+}
+
+// Stop indicates that no more retries should be made for use in NextBackOff().
+const Stop time.Duration = -1
+
+// ZeroBackOff is a fixed backoff policy whose backoff time is always zero,
+// meaning that the operation is retried immediately without waiting, indefinitely.
+type ZeroBackOff struct{}
+
+func (b *ZeroBackOff) Reset() {}
+
+func (b *ZeroBackOff) NextBackOff() time.Duration { return 0 }
+
+// StopBackOff is a fixed backoff policy that always returns backoff.Stop for
+// NextBackOff(), meaning that the operation should never be retried.
+type StopBackOff struct{}
+
+func (b *StopBackOff) Reset() {}
+
+func (b *StopBackOff) NextBackOff() time.Duration { return Stop }
+
+// ConstantBackOff is a backoff policy that always returns the same backoff delay.
+// This is in contrast to an exponential backoff policy,
+// which returns a delay that grows longer as you call NextBackOff() over and over again.
+type ConstantBackOff struct {
+	Interval time.Duration
+}
+
+func (b *ConstantBackOff) Reset()                     {}
+func (b *ConstantBackOff) NextBackOff() time.Duration { return b.Interval }
+
+func NewConstantBackOff(d time.Duration) *ConstantBackOff {
+	return &ConstantBackOff{Interval: d}
+}
diff --git a/vendor/github.com/cenkalti/backoff/v4/context.go b/vendor/github.com/cenkalti/backoff/v4/context.go
new file mode 100644
index 0000000000..48482330eb
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/context.go
@@ -0,0 +1,62 @@
+package backoff
+
+import (
+	"context"
+	"time"
+)
+
+// BackOffContext is a backoff policy that stops retrying after the context
+// is canceled.
+type BackOffContext interface { // nolint: golint
+	BackOff
+	Context() context.Context
+}
+
+type backOffContext struct {
+	BackOff
+	ctx context.Context
+}
+
+// WithContext returns a BackOffContext with context ctx
+//
+// ctx must not be nil
+func WithContext(b BackOff, ctx context.Context) BackOffContext { // nolint: golint
+	if ctx == nil {
+		panic("nil context")
+	}
+
+	if b, ok := b.(*backOffContext); ok {
+		return &backOffContext{
+			BackOff: b.BackOff,
+			ctx:     ctx,
+		}
+	}
+
+	return &backOffContext{
+		BackOff: b,
+		ctx:     ctx,
+	}
+}
+
+func getContext(b BackOff) context.Context {
+	if cb, ok := b.(BackOffContext); ok {
+		return cb.Context()
+	}
+	if tb, ok := b.(*backOffTries); ok {
+		return getContext(tb.delegate)
+	}
+	return context.Background()
+}
+
+func (b *backOffContext) Context() context.Context {
+	return b.ctx
+}
+
+func (b *backOffContext) NextBackOff() time.Duration {
+	select {
+	case <-b.ctx.Done():
+		return Stop
+	default:
+		return b.BackOff.NextBackOff()
+	}
+}
diff --git a/vendor/github.com/cenkalti/backoff/v4/exponential.go b/vendor/github.com/cenkalti/backoff/v4/exponential.go
new file mode 100644
index 0000000000..2c56c1e718
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/exponential.go
@@ -0,0 +1,161 @@
+package backoff
+
+import (
+	"math/rand"
+	"time"
+)
+
+/*
+ExponentialBackOff is a backoff implementation that increases the backoff
+period for each retry attempt using a randomization function that grows exponentially.
+
+NextBackOff() is calculated using the following formula:
+
+ randomized interval =
+     RetryInterval * (random value in range [1 - RandomizationFactor, 1 + RandomizationFactor])
+
+In other words NextBackOff() will range between the randomization factor
+percentage below and above the retry interval.
+
+For example, given the following parameters:
+
+ RetryInterval = 2
+ RandomizationFactor = 0.5
+ Multiplier = 2
+
+the actual backoff period used in the next retry attempt will range between 1 and 3 seconds,
+multiplied by the exponential, that is, between 2 and 6 seconds.
+
+Note: MaxInterval caps the RetryInterval and not the randomized interval.
+
+If the time elapsed since an ExponentialBackOff instance is created goes past the
+MaxElapsedTime, then the method NextBackOff() starts returning backoff.Stop.
+
+The elapsed time can be reset by calling Reset().
+
+Example: Given the following default arguments, for 10 tries the sequence will be,
+and assuming we go over the MaxElapsedTime on the 10th try:
+
+ Request #  RetryInterval (seconds)  Randomized Interval (seconds)
+
+  1          0.5                     [0.25,   0.75]
+  2          0.75                    [0.375,  1.125]
+  3          1.125                   [0.562,  1.687]
+  4          1.687                   [0.8435, 2.53]
+  5          2.53                    [1.265,  3.795]
+  6          3.795                   [1.897,  5.692]
+  7          5.692                   [2.846,  8.538]
+  8          8.538                   [4.269, 12.807]
+  9         12.807                   [6.403, 19.210]
+ 10         19.210                   backoff.Stop
+
+Note: Implementation is not thread-safe.
+*/
+type ExponentialBackOff struct {
+	InitialInterval     time.Duration
+	RandomizationFactor float64
+	Multiplier          float64
+	MaxInterval         time.Duration
+	// After MaxElapsedTime the ExponentialBackOff returns Stop.
+	// It never stops if MaxElapsedTime == 0.
+	MaxElapsedTime time.Duration
+	Stop           time.Duration
+	Clock          Clock
+
+	currentInterval time.Duration
+	startTime       time.Time
+}
+
+// Clock is an interface that returns current time for BackOff.
+type Clock interface {
+	Now() time.Time
+}
+
+// Default values for ExponentialBackOff.
+const (
+	DefaultInitialInterval     = 500 * time.Millisecond
+	DefaultRandomizationFactor = 0.5
+	DefaultMultiplier          = 1.5
+	DefaultMaxInterval         = 60 * time.Second
+	DefaultMaxElapsedTime      = 15 * time.Minute
+)
+
+// NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
+func NewExponentialBackOff() *ExponentialBackOff {
+	b := &ExponentialBackOff{
+		InitialInterval:     DefaultInitialInterval,
+		RandomizationFactor: DefaultRandomizationFactor,
+		Multiplier:          DefaultMultiplier,
+		MaxInterval:         DefaultMaxInterval,
+		MaxElapsedTime:      DefaultMaxElapsedTime,
+		Stop:                Stop,
+		Clock:               SystemClock,
+	}
+	b.Reset()
+	return b
+}
+
+type systemClock struct{}
+
+func (t systemClock) Now() time.Time {
+	return time.Now()
+}
+
+// SystemClock implements Clock interface that uses time.Now().
+var SystemClock = systemClock{}
+
+// Reset the interval back to the initial retry interval and restarts the timer.
+// Reset must be called before using b.
+func (b *ExponentialBackOff) Reset() {
+	b.currentInterval = b.InitialInterval
+	b.startTime = b.Clock.Now()
+}
+
+// NextBackOff calculates the next backoff interval using the formula:
+// 	Randomized interval = RetryInterval * (1 ± RandomizationFactor)
+func (b *ExponentialBackOff) NextBackOff() time.Duration {
+	// Make sure we have not gone over the maximum elapsed time.
+	elapsed := b.GetElapsedTime()
+	next := getRandomValueFromInterval(b.RandomizationFactor, rand.Float64(), b.currentInterval)
+	b.incrementCurrentInterval()
+	if b.MaxElapsedTime != 0 && elapsed+next > b.MaxElapsedTime {
+		return b.Stop
+	}
+	return next
+}
+
+// GetElapsedTime returns the elapsed time since an ExponentialBackOff instance
+// is created and is reset when Reset() is called.
+//
+// The elapsed time is computed using time.Now().UnixNano(). It is
+// safe to call even while the backoff policy is used by a running
+// ticker.
+func (b *ExponentialBackOff) GetElapsedTime() time.Duration {
+	return b.Clock.Now().Sub(b.startTime)
+}
+
+// Increments the current interval by multiplying it with the multiplier.
+func (b *ExponentialBackOff) incrementCurrentInterval() {
+	// Check for overflow, if overflow is detected set the current interval to the max interval.
+	if float64(b.currentInterval) >= float64(b.MaxInterval)/b.Multiplier {
+		b.currentInterval = b.MaxInterval
+	} else {
+		b.currentInterval = time.Duration(float64(b.currentInterval) * b.Multiplier)
+	}
+}
+
+// Returns a random value from the following interval:
+// 	[currentInterval - randomizationFactor * currentInterval, currentInterval + randomizationFactor * currentInterval].
+func getRandomValueFromInterval(randomizationFactor, random float64, currentInterval time.Duration) time.Duration {
+	if randomizationFactor == 0 {
+		return currentInterval // make sure no randomness is used when randomizationFactor is 0.
+	}
+	var delta = randomizationFactor * float64(currentInterval)
+	var minInterval = float64(currentInterval) - delta
+	var maxInterval = float64(currentInterval) + delta
+
+	// Get a random value from the range [minInterval, maxInterval].
+	// The formula used below has a +1 because if the minInterval is 1 and the maxInterval is 3 then
+	// we want a 33% chance for selecting either 1, 2 or 3.
+	return time.Duration(minInterval + (random * (maxInterval - minInterval + 1)))
+}
diff --git a/vendor/github.com/cenkalti/backoff/v4/retry.go b/vendor/github.com/cenkalti/backoff/v4/retry.go
new file mode 100644
index 0000000000..b9c0c51cd7
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/retry.go
@@ -0,0 +1,146 @@
+package backoff
+
+import (
+	"errors"
+	"time"
+)
+
+// An OperationWithData is executing by RetryWithData() or RetryNotifyWithData().
+// The operation will be retried using a backoff policy if it returns an error.
+type OperationWithData[T any] func() (T, error)
+
+// An Operation is executing by Retry() or RetryNotify().
+// The operation will be retried using a backoff policy if it returns an error.
+type Operation func() error
+
+func (o Operation) withEmptyData() OperationWithData[struct{}] {
+	return func() (struct{}, error) {
+		return struct{}{}, o()
+	}
+}
+
+// Notify is a notify-on-error function. It receives an operation error and
+// backoff delay if the operation failed (with an error).
+//
+// NOTE that if the backoff policy stated to stop retrying,
+// the notify function isn't called.
+type Notify func(error, time.Duration)
+
+// Retry the operation o until it does not return error or BackOff stops.
+// o is guaranteed to be run at least once.
+//
+// If o returns a *PermanentError, the operation is not retried, and the
+// wrapped error is returned.
+//
+// Retry sleeps the goroutine for the duration returned by BackOff after a
+// failed operation returns.
+func Retry(o Operation, b BackOff) error {
+	return RetryNotify(o, b, nil)
+}
+
+// RetryWithData is like Retry but returns data in the response too.
+func RetryWithData[T any](o OperationWithData[T], b BackOff) (T, error) {
+	return RetryNotifyWithData(o, b, nil)
+}
+
+// RetryNotify calls notify function with the error and wait duration
+// for each failed attempt before sleep.
+func RetryNotify(operation Operation, b BackOff, notify Notify) error {
+	return RetryNotifyWithTimer(operation, b, notify, nil)
+}
+
+// RetryNotifyWithData is like RetryNotify but returns data in the response too.
+func RetryNotifyWithData[T any](operation OperationWithData[T], b BackOff, notify Notify) (T, error) {
+	return doRetryNotify(operation, b, notify, nil)
+}
+
+// RetryNotifyWithTimer calls notify function with the error and wait duration using the given Timer
+// for each failed attempt before sleep.
+// A default timer that uses system timer is used when nil is passed.
+func RetryNotifyWithTimer(operation Operation, b BackOff, notify Notify, t Timer) error {
+	_, err := doRetryNotify(operation.withEmptyData(), b, notify, t)
+	return err
+}
+
+// RetryNotifyWithTimerAndData is like RetryNotifyWithTimer but returns data in the response too.
+func RetryNotifyWithTimerAndData[T any](operation OperationWithData[T], b BackOff, notify Notify, t Timer) (T, error) {
+	return doRetryNotify(operation, b, notify, t)
+}
+
+func doRetryNotify[T any](operation OperationWithData[T], b BackOff, notify Notify, t Timer) (T, error) {
+	var (
+		err  error
+		next time.Duration
+		res  T
+	)
+	if t == nil {
+		t = &defaultTimer{}
+	}
+
+	defer func() {
+		t.Stop()
+	}()
+
+	ctx := getContext(b)
+
+	b.Reset()
+	for {
+		res, err = operation()
+		if err == nil {
+			return res, nil
+		}
+
+		var permanent *PermanentError
+		if errors.As(err, &permanent) {
+			return res, permanent.Err
+		}
+
+		if next = b.NextBackOff(); next == Stop {
+			if cerr := ctx.Err(); cerr != nil {
+				return res, cerr
+			}
+
+			return res, err
+		}
+
+		if notify != nil {
+			notify(err, next)
+		}
+
+		t.Start(next)
+
+		select {
+		case <-ctx.Done():
+			return res, ctx.Err()
+		case <-t.C():
+		}
+	}
+}
+
+// PermanentError signals that the operation should not be retried.
+type PermanentError struct {
+	Err error
+}
+
+func (e *PermanentError) Error() string {
+	return e.Err.Error()
+}
+
+func (e *PermanentError) Unwrap() error {
+	return e.Err
+}
+
+func (e *PermanentError) Is(target error) bool {
+	_, ok := target.(*PermanentError)
+	return ok
+}
+
+// Permanent wraps the given err in a *PermanentError.
+func Permanent(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &PermanentError{
+		Err: err,
+	}
+}
diff --git a/vendor/github.com/cenkalti/backoff/v4/ticker.go b/vendor/github.com/cenkalti/backoff/v4/ticker.go
new file mode 100644
index 0000000000..df9d68bce5
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/ticker.go
@@ -0,0 +1,97 @@
+package backoff
+
+import (
+	"context"
+	"sync"
+	"time"
+)
+
+// Ticker holds a channel that delivers `ticks' of a clock at times reported by a BackOff.
+//
+// Ticks will continue to arrive when the previous operation is still running,
+// so operations that take a while to fail could run in quick succession.
+type Ticker struct {
+	C        <-chan time.Time
+	c        chan time.Time
+	b        BackOff
+	ctx      context.Context
+	timer    Timer
+	stop     chan struct{}
+	stopOnce sync.Once
+}
+
+// NewTicker returns a new Ticker containing a channel that will send
+// the time at times specified by the BackOff argument. Ticker is
+// guaranteed to tick at least once.  The channel is closed when Stop
+// method is called or BackOff stops. It is not safe to manipulate the
+// provided backoff policy (notably calling NextBackOff or Reset)
+// while the ticker is running.
+func NewTicker(b BackOff) *Ticker {
+	return NewTickerWithTimer(b, &defaultTimer{})
+}
+
+// NewTickerWithTimer returns a new Ticker with a custom timer.
+// A default timer that uses system timer is used when nil is passed.
+func NewTickerWithTimer(b BackOff, timer Timer) *Ticker {
+	if timer == nil {
+		timer = &defaultTimer{}
+	}
+	c := make(chan time.Time)
+	t := &Ticker{
+		C:     c,
+		c:     c,
+		b:     b,
+		ctx:   getContext(b),
+		timer: timer,
+		stop:  make(chan struct{}),
+	}
+	t.b.Reset()
+	go t.run()
+	return t
+}
+
+// Stop turns off a ticker. After Stop, no more ticks will be sent.
+func (t *Ticker) Stop() {
+	t.stopOnce.Do(func() { close(t.stop) })
+}
+
+func (t *Ticker) run() {
+	c := t.c
+	defer close(c)
+
+	// Ticker is guaranteed to tick at least once.
+	afterC := t.send(time.Now())
+
+	for {
+		if afterC == nil {
+			return
+		}
+
+		select {
+		case tick := <-afterC:
+			afterC = t.send(tick)
+		case <-t.stop:
+			t.c = nil // Prevent future ticks from being sent to the channel.
+			return
+		case <-t.ctx.Done():
+			return
+		}
+	}
+}
+
+func (t *Ticker) send(tick time.Time) <-chan time.Time {
+	select {
+	case t.c <- tick:
+	case <-t.stop:
+		return nil
+	}
+
+	next := t.b.NextBackOff()
+	if next == Stop {
+		t.Stop()
+		return nil
+	}
+
+	t.timer.Start(next)
+	return t.timer.C()
+}
diff --git a/vendor/github.com/cenkalti/backoff/v4/timer.go b/vendor/github.com/cenkalti/backoff/v4/timer.go
new file mode 100644
index 0000000000..8120d0213c
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/timer.go
@@ -0,0 +1,35 @@
+package backoff
+
+import "time"
+
+type Timer interface {
+	Start(duration time.Duration)
+	Stop()
+	C() <-chan time.Time
+}
+
+// defaultTimer implements Timer interface using time.Timer
+type defaultTimer struct {
+	timer *time.Timer
+}
+
+// C returns the timers channel which receives the current time when the timer fires.
+func (t *defaultTimer) C() <-chan time.Time {
+	return t.timer.C
+}
+
+// Start starts the timer to fire after the given duration
+func (t *defaultTimer) Start(duration time.Duration) {
+	if t.timer == nil {
+		t.timer = time.NewTimer(duration)
+	} else {
+		t.timer.Reset(duration)
+	}
+}
+
+// Stop is called when the timer is not used anymore and resources may be freed.
+func (t *defaultTimer) Stop() {
+	if t.timer != nil {
+		t.timer.Stop()
+	}
+}
diff --git a/vendor/github.com/cenkalti/backoff/v4/tries.go b/vendor/github.com/cenkalti/backoff/v4/tries.go
new file mode 100644
index 0000000000..28d58ca37c
--- /dev/null
+++ b/vendor/github.com/cenkalti/backoff/v4/tries.go
@@ -0,0 +1,38 @@
+package backoff
+
+import "time"
+
+/*
+WithMaxRetries creates a wrapper around another BackOff, which will
+return Stop if NextBackOff() has been called too many times since
+the last time Reset() was called
+
+Note: Implementation is not thread-safe.
+*/
+func WithMaxRetries(b BackOff, max uint64) BackOff {
+	return &backOffTries{delegate: b, maxTries: max}
+}
+
+type backOffTries struct {
+	delegate BackOff
+	maxTries uint64
+	numTries uint64
+}
+
+func (b *backOffTries) NextBackOff() time.Duration {
+	if b.maxTries == 0 {
+		return Stop
+	}
+	if b.maxTries > 0 {
+		if b.maxTries <= b.numTries {
+			return Stop
+		}
+		b.numTries++
+	}
+	return b.delegate.NextBackOff()
+}
+
+func (b *backOffTries) Reset() {
+	b.numTries = 0
+	b.delegate.Reset()
+}
diff --git a/vendor/github.com/cespare/xxhash/go.mod b/vendor/github.com/cespare/xxhash/go.mod
deleted file mode 100644
index 10605a6a5e..0000000000
--- a/vendor/github.com/cespare/xxhash/go.mod
+++ /dev/null
@@ -1,6 +0,0 @@
-module github.com/cespare/xxhash
-
-require (
-	github.com/OneOfOne/xxhash v1.2.2
-	github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72
-)
diff --git a/vendor/github.com/cespare/xxhash/go.sum b/vendor/github.com/cespare/xxhash/go.sum
deleted file mode 100644
index f6b5542617..0000000000
--- a/vendor/github.com/cespare/xxhash/go.sum
+++ /dev/null
@@ -1,4 +0,0 @@
-github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72 h1:qLC7fQah7D6K1B0ujays3HV9gkFtllcxhzImRR7ArPQ=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
diff --git a/vendor/github.com/cespare/xxhash/v2/README.md b/vendor/github.com/cespare/xxhash/v2/README.md
index 792b4a60b3..8bf0e5b781 100644
--- a/vendor/github.com/cespare/xxhash/v2/README.md
+++ b/vendor/github.com/cespare/xxhash/v2/README.md
@@ -3,8 +3,7 @@
 [![Go Reference](https://pkg.go.dev/badge/github.com/cespare/xxhash/v2.svg)](https://pkg.go.dev/github.com/cespare/xxhash/v2)
 [![Test](https://github.com/cespare/xxhash/actions/workflows/test.yml/badge.svg)](https://github.com/cespare/xxhash/actions/workflows/test.yml)
 
-xxhash is a Go implementation of the 64-bit
-[xxHash](http://cyan4973.github.io/xxHash/) algorithm, XXH64. This is a
+xxhash is a Go implementation of the 64-bit [xxHash] algorithm, XXH64. This is a
 high-quality hashing algorithm that is much faster than anything in the Go
 standard library.
 
@@ -25,8 +24,11 @@ func (*Digest) WriteString(string) (int, error)
 func (*Digest) Sum64() uint64
 ```
 
-This implementation provides a fast pure-Go implementation and an even faster
-assembly implementation for amd64.
+The package is written with optimized pure Go and also contains even faster
+assembly implementations for amd64 and arm64. If desired, the `purego` build tag
+opts into using the Go code even on those architectures.
+
+[xxHash]: http://cyan4973.github.io/xxHash/
 
 ## Compatibility
 
@@ -45,19 +47,20 @@ I recommend using the latest release of Go.
 Here are some quick benchmarks comparing the pure-Go and assembly
 implementations of Sum64.
 
-| input size | purego | asm |
-| --- | --- | --- |
-| 5 B   |  979.66 MB/s |  1291.17 MB/s  |
-| 100 B | 7475.26 MB/s | 7973.40 MB/s  |
-| 4 KB  | 17573.46 MB/s | 17602.65 MB/s |
-| 10 MB | 17131.46 MB/s | 17142.16 MB/s |
+| input size | purego    | asm       |
+| ---------- | --------- | --------- |
+| 4 B        |  1.3 GB/s |  1.2 GB/s |
+| 16 B       |  2.9 GB/s |  3.5 GB/s |
+| 100 B      |  6.9 GB/s |  8.1 GB/s |
+| 4 KB       | 11.7 GB/s | 16.7 GB/s |
+| 10 MB      | 12.0 GB/s | 17.3 GB/s |
 
-These numbers were generated on Ubuntu 18.04 with an Intel i7-8700K CPU using
-the following commands under Go 1.11.2:
+These numbers were generated on Ubuntu 20.04 with an Intel Xeon Platinum 8252C
+CPU using the following commands under Go 1.19.2:
 
 ```
-$ go test -tags purego -benchtime 10s -bench '/xxhash,direct,bytes'
-$ go test -benchtime 10s -bench '/xxhash,direct,bytes'
+benchstat <(go test -tags purego -benchtime 500ms -count 15 -bench 'Sum64$')
+benchstat <(go test -benchtime 500ms -count 15 -bench 'Sum64$')
 ```
 
 ## Projects using this package
diff --git a/vendor/github.com/cespare/xxhash/v2/go.mod b/vendor/github.com/cespare/xxhash/v2/go.mod
deleted file mode 100644
index 49f67608bf..0000000000
--- a/vendor/github.com/cespare/xxhash/v2/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/cespare/xxhash/v2
-
-go 1.11
diff --git a/vendor/github.com/cespare/xxhash/v2/go.sum b/vendor/github.com/cespare/xxhash/v2/go.sum
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/vendor/github.com/cespare/xxhash/v2/testall.sh b/vendor/github.com/cespare/xxhash/v2/testall.sh
new file mode 100644
index 0000000000..94b9c44398
--- /dev/null
+++ b/vendor/github.com/cespare/xxhash/v2/testall.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+set -eu -o pipefail
+
+# Small convenience script for running the tests with various combinations of
+# arch/tags. This assumes we're running on amd64 and have qemu available.
+
+go test ./...
+go test -tags purego ./...
+GOARCH=arm64 go test
+GOARCH=arm64 go test -tags purego
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash.go b/vendor/github.com/cespare/xxhash/v2/xxhash.go
index 15c835d541..a9e0d45c9d 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash.go
@@ -16,19 +16,11 @@ const (
 	prime5 uint64 = 2870177450012600261
 )
 
-// NOTE(caleb): I'm using both consts and vars of the primes. Using consts where
-// possible in the Go code is worth a small (but measurable) performance boost
-// by avoiding some MOVQs. Vars are needed for the asm and also are useful for
-// convenience in the Go code in a few places where we need to intentionally
-// avoid constant arithmetic (e.g., v1 := prime1 + prime2 fails because the
-// result overflows a uint64).
-var (
-	prime1v = prime1
-	prime2v = prime2
-	prime3v = prime3
-	prime4v = prime4
-	prime5v = prime5
-)
+// Store the primes in an array as well.
+//
+// The consts are used when possible in Go code to avoid MOVs but we need a
+// contiguous array of the assembly code.
+var primes = [...]uint64{prime1, prime2, prime3, prime4, prime5}
 
 // Digest implements hash.Hash64.
 type Digest struct {
@@ -50,10 +42,10 @@ func New() *Digest {
 
 // Reset clears the Digest's state so that it can be reused.
 func (d *Digest) Reset() {
-	d.v1 = prime1v + prime2
+	d.v1 = primes[0] + prime2
 	d.v2 = prime2
 	d.v3 = 0
-	d.v4 = -prime1v
+	d.v4 = -primes[0]
 	d.total = 0
 	d.n = 0
 }
@@ -69,21 +61,23 @@ func (d *Digest) Write(b []byte) (n int, err error) {
 	n = len(b)
 	d.total += uint64(n)
 
+	memleft := d.mem[d.n&(len(d.mem)-1):]
+
 	if d.n+n < 32 {
 		// This new data doesn't even fill the current block.
-		copy(d.mem[d.n:], b)
+		copy(memleft, b)
 		d.n += n
 		return
 	}
 
 	if d.n > 0 {
 		// Finish off the partial block.
-		copy(d.mem[d.n:], b)
+		c := copy(memleft, b)
 		d.v1 = round(d.v1, u64(d.mem[0:8]))
 		d.v2 = round(d.v2, u64(d.mem[8:16]))
 		d.v3 = round(d.v3, u64(d.mem[16:24]))
 		d.v4 = round(d.v4, u64(d.mem[24:32]))
-		b = b[32-d.n:]
+		b = b[c:]
 		d.n = 0
 	}
 
@@ -133,21 +127,20 @@ func (d *Digest) Sum64() uint64 {
 
 	h += d.total
 
-	i, end := 0, d.n
-	for ; i+8 <= end; i += 8 {
-		k1 := round(0, u64(d.mem[i:i+8]))
+	b := d.mem[:d.n&(len(d.mem)-1)]
+	for ; len(b) >= 8; b = b[8:] {
+		k1 := round(0, u64(b[:8]))
 		h ^= k1
 		h = rol27(h)*prime1 + prime4
 	}
-	if i+4 <= end {
-		h ^= uint64(u32(d.mem[i:i+4])) * prime1
+	if len(b) >= 4 {
+		h ^= uint64(u32(b[:4])) * prime1
 		h = rol23(h)*prime2 + prime3
-		i += 4
+		b = b[4:]
 	}
-	for i < end {
-		h ^= uint64(d.mem[i]) * prime5
+	for ; len(b) > 0; b = b[1:] {
+		h ^= uint64(b[0]) * prime5
 		h = rol11(h) * prime1
-		i++
 	}
 
 	h ^= h >> 33
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.go b/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.go
deleted file mode 100644
index ad14b807f4..0000000000
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// +build !appengine
-// +build gc
-// +build !purego
-
-package xxhash
-
-// Sum64 computes the 64-bit xxHash digest of b.
-//
-//go:noescape
-func Sum64(b []byte) uint64
-
-//go:noescape
-func writeBlocks(d *Digest, b []byte) int
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s b/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s
index be8db5bf79..3e8b132579 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_amd64.s
@@ -1,215 +1,209 @@
+//go:build !appengine && gc && !purego
 // +build !appengine
 // +build gc
 // +build !purego
 
 #include "textflag.h"
 
-// Register allocation:
-// AX	h
-// SI	pointer to advance through b
-// DX	n
-// BX	loop end
-// R8	v1, k1
-// R9	v2
-// R10	v3
-// R11	v4
-// R12	tmp
-// R13	prime1v
-// R14	prime2v
-// DI	prime4v
-
-// round reads from and advances the buffer pointer in SI.
-// It assumes that R13 has prime1v and R14 has prime2v.
-#define round(r) \
-	MOVQ  (SI), R12 \
-	ADDQ  $8, SI    \
-	IMULQ R14, R12  \
-	ADDQ  R12, r    \
-	ROLQ  $31, r    \
-	IMULQ R13, r
-
-// mergeRound applies a merge round on the two registers acc and val.
-// It assumes that R13 has prime1v, R14 has prime2v, and DI has prime4v.
-#define mergeRound(acc, val) \
-	IMULQ R14, val \
-	ROLQ  $31, val \
-	IMULQ R13, val \
-	XORQ  val, acc \
-	IMULQ R13, acc \
-	ADDQ  DI, acc
+// Registers:
+#define h      AX
+#define d      AX
+#define p      SI // pointer to advance through b
+#define n      DX
+#define end    BX // loop end
+#define v1     R8
+#define v2     R9
+#define v3     R10
+#define v4     R11
+#define x      R12
+#define prime1 R13
+#define prime2 R14
+#define prime4 DI
+
+#define round(acc, x) \
+	IMULQ prime2, x   \
+	ADDQ  x, acc      \
+	ROLQ  $31, acc    \
+	IMULQ prime1, acc
+
+// round0 performs the operation x = round(0, x).
+#define round0(x) \
+	IMULQ prime2, x \
+	ROLQ  $31, x    \
+	IMULQ prime1, x
+
+// mergeRound applies a merge round on the two registers acc and x.
+// It assumes that prime1, prime2, and prime4 have been loaded.
+#define mergeRound(acc, x) \
+	round0(x)         \
+	XORQ  x, acc      \
+	IMULQ prime1, acc \
+	ADDQ  prime4, acc
+
+// blockLoop processes as many 32-byte blocks as possible,
+// updating v1, v2, v3, and v4. It assumes that there is at least one block
+// to process.
+#define blockLoop() \
+loop:  \
+	MOVQ +0(p), x  \
+	round(v1, x)   \
+	MOVQ +8(p), x  \
+	round(v2, x)   \
+	MOVQ +16(p), x \
+	round(v3, x)   \
+	MOVQ +24(p), x \
+	round(v4, x)   \
+	ADDQ $32, p    \
+	CMPQ p, end    \
+	JLE  loop
 
 // func Sum64(b []byte) uint64
-TEXT ·Sum64(SB), NOSPLIT, $0-32
+TEXT ·Sum64(SB), NOSPLIT|NOFRAME, $0-32
 	// Load fixed primes.
-	MOVQ ·prime1v(SB), R13
-	MOVQ ·prime2v(SB), R14
-	MOVQ ·prime4v(SB), DI
+	MOVQ ·primes+0(SB), prime1
+	MOVQ ·primes+8(SB), prime2
+	MOVQ ·primes+24(SB), prime4
 
 	// Load slice.
-	MOVQ b_base+0(FP), SI
-	MOVQ b_len+8(FP), DX
-	LEAQ (SI)(DX*1), BX
+	MOVQ b_base+0(FP), p
+	MOVQ b_len+8(FP), n
+	LEAQ (p)(n*1), end
 
 	// The first loop limit will be len(b)-32.
-	SUBQ $32, BX
+	SUBQ $32, end
 
 	// Check whether we have at least one block.
-	CMPQ DX, $32
+	CMPQ n, $32
 	JLT  noBlocks
 
 	// Set up initial state (v1, v2, v3, v4).
-	MOVQ R13, R8
-	ADDQ R14, R8
-	MOVQ R14, R9
-	XORQ R10, R10
-	XORQ R11, R11
-	SUBQ R13, R11
-
-	// Loop until SI > BX.
-blockLoop:
-	round(R8)
-	round(R9)
-	round(R10)
-	round(R11)
-
-	CMPQ SI, BX
-	JLE  blockLoop
-
-	MOVQ R8, AX
-	ROLQ $1, AX
-	MOVQ R9, R12
-	ROLQ $7, R12
-	ADDQ R12, AX
-	MOVQ R10, R12
-	ROLQ $12, R12
-	ADDQ R12, AX
-	MOVQ R11, R12
-	ROLQ $18, R12
-	ADDQ R12, AX
-
-	mergeRound(AX, R8)
-	mergeRound(AX, R9)
-	mergeRound(AX, R10)
-	mergeRound(AX, R11)
+	MOVQ prime1, v1
+	ADDQ prime2, v1
+	MOVQ prime2, v2
+	XORQ v3, v3
+	XORQ v4, v4
+	SUBQ prime1, v4
+
+	blockLoop()
+
+	MOVQ v1, h
+	ROLQ $1, h
+	MOVQ v2, x
+	ROLQ $7, x
+	ADDQ x, h
+	MOVQ v3, x
+	ROLQ $12, x
+	ADDQ x, h
+	MOVQ v4, x
+	ROLQ $18, x
+	ADDQ x, h
+
+	mergeRound(h, v1)
+	mergeRound(h, v2)
+	mergeRound(h, v3)
+	mergeRound(h, v4)
 
 	JMP afterBlocks
 
 noBlocks:
-	MOVQ ·prime5v(SB), AX
+	MOVQ ·primes+32(SB), h
 
 afterBlocks:
-	ADDQ DX, AX
-
-	// Right now BX has len(b)-32, and we want to loop until SI > len(b)-8.
-	ADDQ $24, BX
-
-	CMPQ SI, BX
-	JG   fourByte
-
-wordLoop:
-	// Calculate k1.
-	MOVQ  (SI), R8
-	ADDQ  $8, SI
-	IMULQ R14, R8
-	ROLQ  $31, R8
-	IMULQ R13, R8
-
-	XORQ  R8, AX
-	ROLQ  $27, AX
-	IMULQ R13, AX
-	ADDQ  DI, AX
-
-	CMPQ SI, BX
-	JLE  wordLoop
-
-fourByte:
-	ADDQ $4, BX
-	CMPQ SI, BX
-	JG   singles
-
-	MOVL  (SI), R8
-	ADDQ  $4, SI
-	IMULQ R13, R8
-	XORQ  R8, AX
-
-	ROLQ  $23, AX
-	IMULQ R14, AX
-	ADDQ  ·prime3v(SB), AX
-
-singles:
-	ADDQ $4, BX
-	CMPQ SI, BX
+	ADDQ n, h
+
+	ADDQ $24, end
+	CMPQ p, end
+	JG   try4
+
+loop8:
+	MOVQ  (p), x
+	ADDQ  $8, p
+	round0(x)
+	XORQ  x, h
+	ROLQ  $27, h
+	IMULQ prime1, h
+	ADDQ  prime4, h
+
+	CMPQ p, end
+	JLE  loop8
+
+try4:
+	ADDQ $4, end
+	CMPQ p, end
+	JG   try1
+
+	MOVL  (p), x
+	ADDQ  $4, p
+	IMULQ prime1, x
+	XORQ  x, h
+
+	ROLQ  $23, h
+	IMULQ prime2, h
+	ADDQ  ·primes+16(SB), h
+
+try1:
+	ADDQ $4, end
+	CMPQ p, end
 	JGE  finalize
 
-singlesLoop:
-	MOVBQZX (SI), R12
-	ADDQ    $1, SI
-	IMULQ   ·prime5v(SB), R12
-	XORQ    R12, AX
+loop1:
+	MOVBQZX (p), x
+	ADDQ    $1, p
+	IMULQ   ·primes+32(SB), x
+	XORQ    x, h
+	ROLQ    $11, h
+	IMULQ   prime1, h
 
-	ROLQ  $11, AX
-	IMULQ R13, AX
-
-	CMPQ SI, BX
-	JL   singlesLoop
+	CMPQ p, end
+	JL   loop1
 
 finalize:
-	MOVQ  AX, R12
-	SHRQ  $33, R12
-	XORQ  R12, AX
-	IMULQ R14, AX
-	MOVQ  AX, R12
-	SHRQ  $29, R12
-	XORQ  R12, AX
-	IMULQ ·prime3v(SB), AX
-	MOVQ  AX, R12
-	SHRQ  $32, R12
-	XORQ  R12, AX
-
-	MOVQ AX, ret+24(FP)
+	MOVQ  h, x
+	SHRQ  $33, x
+	XORQ  x, h
+	IMULQ prime2, h
+	MOVQ  h, x
+	SHRQ  $29, x
+	XORQ  x, h
+	IMULQ ·primes+16(SB), h
+	MOVQ  h, x
+	SHRQ  $32, x
+	XORQ  x, h
+
+	MOVQ h, ret+24(FP)
 	RET
 
-// writeBlocks uses the same registers as above except that it uses AX to store
-// the d pointer.
-
 // func writeBlocks(d *Digest, b []byte) int
-TEXT ·writeBlocks(SB), NOSPLIT, $0-40
+TEXT ·writeBlocks(SB), NOSPLIT|NOFRAME, $0-40
 	// Load fixed primes needed for round.
-	MOVQ ·prime1v(SB), R13
-	MOVQ ·prime2v(SB), R14
+	MOVQ ·primes+0(SB), prime1
+	MOVQ ·primes+8(SB), prime2
 
 	// Load slice.
-	MOVQ b_base+8(FP), SI
-	MOVQ b_len+16(FP), DX
-	LEAQ (SI)(DX*1), BX
-	SUBQ $32, BX
+	MOVQ b_base+8(FP), p
+	MOVQ b_len+16(FP), n
+	LEAQ (p)(n*1), end
+	SUBQ $32, end
 
 	// Load vN from d.
-	MOVQ d+0(FP), AX
-	MOVQ 0(AX), R8   // v1
-	MOVQ 8(AX), R9   // v2
-	MOVQ 16(AX), R10 // v3
-	MOVQ 24(AX), R11 // v4
+	MOVQ s+0(FP), d
+	MOVQ 0(d), v1
+	MOVQ 8(d), v2
+	MOVQ 16(d), v3
+	MOVQ 24(d), v4
 
 	// We don't need to check the loop condition here; this function is
 	// always called with at least one block of data to process.
-blockLoop:
-	round(R8)
-	round(R9)
-	round(R10)
-	round(R11)
-
-	CMPQ SI, BX
-	JLE  blockLoop
+	blockLoop()
 
 	// Copy vN back to d.
-	MOVQ R8, 0(AX)
-	MOVQ R9, 8(AX)
-	MOVQ R10, 16(AX)
-	MOVQ R11, 24(AX)
-
-	// The number of bytes written is SI minus the old base pointer.
-	SUBQ b_base+8(FP), SI
-	MOVQ SI, ret+32(FP)
+	MOVQ v1, 0(d)
+	MOVQ v2, 8(d)
+	MOVQ v3, 16(d)
+	MOVQ v4, 24(d)
+
+	// The number of bytes written is p minus the old base pointer.
+	SUBQ b_base+8(FP), p
+	MOVQ p, ret+32(FP)
 
 	RET
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_arm64.s b/vendor/github.com/cespare/xxhash/v2/xxhash_arm64.s
new file mode 100644
index 0000000000..7e3145a221
--- /dev/null
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_arm64.s
@@ -0,0 +1,183 @@
+//go:build !appengine && gc && !purego
+// +build !appengine
+// +build gc
+// +build !purego
+
+#include "textflag.h"
+
+// Registers:
+#define digest	R1
+#define h	R2 // return value
+#define p	R3 // input pointer
+#define n	R4 // input length
+#define nblocks	R5 // n / 32
+#define prime1	R7
+#define prime2	R8
+#define prime3	R9
+#define prime4	R10
+#define prime5	R11
+#define v1	R12
+#define v2	R13
+#define v3	R14
+#define v4	R15
+#define x1	R20
+#define x2	R21
+#define x3	R22
+#define x4	R23
+
+#define round(acc, x) \
+	MADD prime2, acc, x, acc \
+	ROR  $64-31, acc         \
+	MUL  prime1, acc
+
+// round0 performs the operation x = round(0, x).
+#define round0(x) \
+	MUL prime2, x \
+	ROR $64-31, x \
+	MUL prime1, x
+
+#define mergeRound(acc, x) \
+	round0(x)                     \
+	EOR  x, acc                   \
+	MADD acc, prime4, prime1, acc
+
+// blockLoop processes as many 32-byte blocks as possible,
+// updating v1, v2, v3, and v4. It assumes that n >= 32.
+#define blockLoop() \
+	LSR     $5, n, nblocks  \
+	PCALIGN $16             \
+	loop:                   \
+	LDP.P   16(p), (x1, x2) \
+	LDP.P   16(p), (x3, x4) \
+	round(v1, x1)           \
+	round(v2, x2)           \
+	round(v3, x3)           \
+	round(v4, x4)           \
+	SUB     $1, nblocks     \
+	CBNZ    nblocks, loop
+
+// func Sum64(b []byte) uint64
+TEXT ·Sum64(SB), NOSPLIT|NOFRAME, $0-32
+	LDP b_base+0(FP), (p, n)
+
+	LDP  ·primes+0(SB), (prime1, prime2)
+	LDP  ·primes+16(SB), (prime3, prime4)
+	MOVD ·primes+32(SB), prime5
+
+	CMP  $32, n
+	CSEL LT, prime5, ZR, h // if n < 32 { h = prime5 } else { h = 0 }
+	BLT  afterLoop
+
+	ADD  prime1, prime2, v1
+	MOVD prime2, v2
+	MOVD $0, v3
+	NEG  prime1, v4
+
+	blockLoop()
+
+	ROR $64-1, v1, x1
+	ROR $64-7, v2, x2
+	ADD x1, x2
+	ROR $64-12, v3, x3
+	ROR $64-18, v4, x4
+	ADD x3, x4
+	ADD x2, x4, h
+
+	mergeRound(h, v1)
+	mergeRound(h, v2)
+	mergeRound(h, v3)
+	mergeRound(h, v4)
+
+afterLoop:
+	ADD n, h
+
+	TBZ   $4, n, try8
+	LDP.P 16(p), (x1, x2)
+
+	round0(x1)
+
+	// NOTE: here and below, sequencing the EOR after the ROR (using a
+	// rotated register) is worth a small but measurable speedup for small
+	// inputs.
+	ROR  $64-27, h
+	EOR  x1 @> 64-27, h, h
+	MADD h, prime4, prime1, h
+
+	round0(x2)
+	ROR  $64-27, h
+	EOR  x2 @> 64-27, h, h
+	MADD h, prime4, prime1, h
+
+try8:
+	TBZ    $3, n, try4
+	MOVD.P 8(p), x1
+
+	round0(x1)
+	ROR  $64-27, h
+	EOR  x1 @> 64-27, h, h
+	MADD h, prime4, prime1, h
+
+try4:
+	TBZ     $2, n, try2
+	MOVWU.P 4(p), x2
+
+	MUL  prime1, x2
+	ROR  $64-23, h
+	EOR  x2 @> 64-23, h, h
+	MADD h, prime3, prime2, h
+
+try2:
+	TBZ     $1, n, try1
+	MOVHU.P 2(p), x3
+	AND     $255, x3, x1
+	LSR     $8, x3, x2
+
+	MUL prime5, x1
+	ROR $64-11, h
+	EOR x1 @> 64-11, h, h
+	MUL prime1, h
+
+	MUL prime5, x2
+	ROR $64-11, h
+	EOR x2 @> 64-11, h, h
+	MUL prime1, h
+
+try1:
+	TBZ   $0, n, finalize
+	MOVBU (p), x4
+
+	MUL prime5, x4
+	ROR $64-11, h
+	EOR x4 @> 64-11, h, h
+	MUL prime1, h
+
+finalize:
+	EOR h >> 33, h
+	MUL prime2, h
+	EOR h >> 29, h
+	MUL prime3, h
+	EOR h >> 32, h
+
+	MOVD h, ret+24(FP)
+	RET
+
+// func writeBlocks(d *Digest, b []byte) int
+TEXT ·writeBlocks(SB), NOSPLIT|NOFRAME, $0-40
+	LDP ·primes+0(SB), (prime1, prime2)
+
+	// Load state. Assume v[1-4] are stored contiguously.
+	MOVD d+0(FP), digest
+	LDP  0(digest), (v1, v2)
+	LDP  16(digest), (v3, v4)
+
+	LDP b_base+8(FP), (p, n)
+
+	blockLoop()
+
+	// Store updated state.
+	STP (v1, v2), 0(digest)
+	STP (v3, v4), 16(digest)
+
+	BIC  $31, n
+	MOVD n, ret+32(FP)
+	RET
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_asm.go b/vendor/github.com/cespare/xxhash/v2/xxhash_asm.go
new file mode 100644
index 0000000000..9216e0a40c
--- /dev/null
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_asm.go
@@ -0,0 +1,15 @@
+//go:build (amd64 || arm64) && !appengine && gc && !purego
+// +build amd64 arm64
+// +build !appengine
+// +build gc
+// +build !purego
+
+package xxhash
+
+// Sum64 computes the 64-bit xxHash digest of b.
+//
+//go:noescape
+func Sum64(b []byte) uint64
+
+//go:noescape
+func writeBlocks(d *Digest, b []byte) int
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_other.go b/vendor/github.com/cespare/xxhash/v2/xxhash_other.go
index 4a5a821603..26df13bba4 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_other.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_other.go
@@ -1,4 +1,5 @@
-// +build !amd64 appengine !gc purego
+//go:build (!amd64 && !arm64) || appengine || !gc || purego
+// +build !amd64,!arm64 appengine !gc purego
 
 package xxhash
 
@@ -14,10 +15,10 @@ func Sum64(b []byte) uint64 {
 	var h uint64
 
 	if n >= 32 {
-		v1 := prime1v + prime2
+		v1 := primes[0] + prime2
 		v2 := prime2
 		v3 := uint64(0)
-		v4 := -prime1v
+		v4 := -primes[0]
 		for len(b) >= 32 {
 			v1 = round(v1, u64(b[0:8:len(b)]))
 			v2 = round(v2, u64(b[8:16:len(b)]))
@@ -36,19 +37,18 @@ func Sum64(b []byte) uint64 {
 
 	h += uint64(n)
 
-	i, end := 0, len(b)
-	for ; i+8 <= end; i += 8 {
-		k1 := round(0, u64(b[i:i+8:len(b)]))
+	for ; len(b) >= 8; b = b[8:] {
+		k1 := round(0, u64(b[:8]))
 		h ^= k1
 		h = rol27(h)*prime1 + prime4
 	}
-	if i+4 <= end {
-		h ^= uint64(u32(b[i:i+4:len(b)])) * prime1
+	if len(b) >= 4 {
+		h ^= uint64(u32(b[:4])) * prime1
 		h = rol23(h)*prime2 + prime3
-		i += 4
+		b = b[4:]
 	}
-	for ; i < end; i++ {
-		h ^= uint64(b[i]) * prime5
+	for ; len(b) > 0; b = b[1:] {
+		h ^= uint64(b[0]) * prime5
 		h = rol11(h) * prime1
 	}
 
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go b/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go
index fc9bea7a31..e86f1b5fd8 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_safe.go
@@ -1,3 +1,4 @@
+//go:build appengine
 // +build appengine
 
 // This file contains the safe implementations of otherwise unsafe-using code.
diff --git a/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go b/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go
index 376e0ca2e4..1c1638fd88 100644
--- a/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go
+++ b/vendor/github.com/cespare/xxhash/v2/xxhash_unsafe.go
@@ -1,3 +1,4 @@
+//go:build !appengine
 // +build !appengine
 
 // This file encapsulates usage of unsafe.
@@ -11,7 +12,7 @@ import (
 
 // In the future it's possible that compiler optimizations will make these
 // XxxString functions unnecessary by realizing that calls such as
-// Sum64([]byte(s)) don't need to copy s. See https://golang.org/issue/2205.
+// Sum64([]byte(s)) don't need to copy s. See https://go.dev/issue/2205.
 // If that happens, even if we keep these functions they can be replaced with
 // the trivial safe code.
 
diff --git a/vendor/github.com/containerd/containerd/LICENSE b/vendor/github.com/containerd/containerd/LICENSE
new file mode 100644
index 0000000000..584149b6ee
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/containerd/containerd/NOTICE b/vendor/github.com/containerd/containerd/NOTICE
new file mode 100644
index 0000000000..8915f02773
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/NOTICE
@@ -0,0 +1,16 @@
+Docker
+Copyright 2012-2015 Docker, Inc.
+
+This product includes software developed at Docker, Inc. (https://www.docker.com).
+
+The following is courtesy of our legal counsel:
+
+
+Use and transfer of Docker may be subject to certain restrictions by the
+United States and other governments.
+It is your responsibility to ensure that your use and/or transfer does not
+violate applicable laws.
+
+For more information, please see https://www.bis.doc.gov
+
+See also https://www.apache.org/dev/crypto.html and/or seek legal counsel.
diff --git a/vendor/github.com/containerd/containerd/archive/compression/compression.go b/vendor/github.com/containerd/containerd/archive/compression/compression.go
new file mode 100644
index 0000000000..ceceb21f56
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/archive/compression/compression.go
@@ -0,0 +1,323 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package compression
+
+import (
+	"bufio"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"sync"
+
+	"github.com/containerd/containerd/log"
+	"github.com/klauspost/compress/zstd"
+	exec "golang.org/x/sys/execabs"
+)
+
+type (
+	// Compression is the state represents if compressed or not.
+	Compression int
+)
+
+const (
+	// Uncompressed represents the uncompressed.
+	Uncompressed Compression = iota
+	// Gzip is gzip compression algorithm.
+	Gzip
+	// Zstd is zstd compression algorithm.
+	Zstd
+)
+
+const disablePigzEnv = "CONTAINERD_DISABLE_PIGZ"
+
+var (
+	initPigz   sync.Once
+	unpigzPath string
+)
+
+var (
+	bufioReader32KPool = &sync.Pool{
+		New: func() interface{} { return bufio.NewReaderSize(nil, 32*1024) },
+	}
+)
+
+// DecompressReadCloser include the stream after decompress and the compress method detected.
+type DecompressReadCloser interface {
+	io.ReadCloser
+	// GetCompression returns the compress method which is used before decompressing
+	GetCompression() Compression
+}
+
+type readCloserWrapper struct {
+	io.Reader
+	compression Compression
+	closer      func() error
+}
+
+func (r *readCloserWrapper) Close() error {
+	if r.closer != nil {
+		return r.closer()
+	}
+	return nil
+}
+
+func (r *readCloserWrapper) GetCompression() Compression {
+	return r.compression
+}
+
+type writeCloserWrapper struct {
+	io.Writer
+	closer func() error
+}
+
+func (w *writeCloserWrapper) Close() error {
+	if w.closer != nil {
+		w.closer()
+	}
+	return nil
+}
+
+type bufferedReader struct {
+	buf *bufio.Reader
+}
+
+func newBufferedReader(r io.Reader) *bufferedReader {
+	buf := bufioReader32KPool.Get().(*bufio.Reader)
+	buf.Reset(r)
+	return &bufferedReader{buf}
+}
+
+func (r *bufferedReader) Read(p []byte) (n int, err error) {
+	if r.buf == nil {
+		return 0, io.EOF
+	}
+	n, err = r.buf.Read(p)
+	if err == io.EOF {
+		r.buf.Reset(nil)
+		bufioReader32KPool.Put(r.buf)
+		r.buf = nil
+	}
+	return
+}
+
+func (r *bufferedReader) Peek(n int) ([]byte, error) {
+	if r.buf == nil {
+		return nil, io.EOF
+	}
+	return r.buf.Peek(n)
+}
+
+const (
+	zstdMagicSkippableStart = 0x184D2A50
+	zstdMagicSkippableMask  = 0xFFFFFFF0
+)
+
+var (
+	gzipMagic = []byte{0x1F, 0x8B, 0x08}
+	zstdMagic = []byte{0x28, 0xb5, 0x2f, 0xfd}
+)
+
+type matcher = func([]byte) bool
+
+func magicNumberMatcher(m []byte) matcher {
+	return func(source []byte) bool {
+		return bytes.HasPrefix(source, m)
+	}
+}
+
+// zstdMatcher detects zstd compression algorithm.
+// There are two frame formats defined by Zstandard: Zstandard frames and Skippable frames.
+// See https://tools.ietf.org/id/draft-kucherawy-dispatch-zstd-00.html#rfc.section.2 for more details.
+func zstdMatcher() matcher {
+	return func(source []byte) bool {
+		if bytes.HasPrefix(source, zstdMagic) {
+			// Zstandard frame
+			return true
+		}
+		// skippable frame
+		if len(source) < 8 {
+			return false
+		}
+		// magic number from 0x184D2A50 to 0x184D2A5F.
+		if binary.LittleEndian.Uint32(source[:4])&zstdMagicSkippableMask == zstdMagicSkippableStart {
+			return true
+		}
+		return false
+	}
+}
+
+// DetectCompression detects the compression algorithm of the source.
+func DetectCompression(source []byte) Compression {
+	for compression, fn := range map[Compression]matcher{
+		Gzip: magicNumberMatcher(gzipMagic),
+		Zstd: zstdMatcher(),
+	} {
+		if fn(source) {
+			return compression
+		}
+	}
+	return Uncompressed
+}
+
+// DecompressStream decompresses the archive and returns a ReaderCloser with the decompressed archive.
+func DecompressStream(archive io.Reader) (DecompressReadCloser, error) {
+	buf := newBufferedReader(archive)
+	bs, err := buf.Peek(10)
+	if err != nil && err != io.EOF {
+		// Note: we'll ignore any io.EOF error because there are some odd
+		// cases where the layer.tar file will be empty (zero bytes) and
+		// that results in an io.EOF from the Peek() call. So, in those
+		// cases we'll just treat it as a non-compressed stream and
+		// that means just create an empty layer.
+		// See Issue docker/docker#18170
+		return nil, err
+	}
+
+	switch compression := DetectCompression(bs); compression {
+	case Uncompressed:
+		return &readCloserWrapper{
+			Reader:      buf,
+			compression: compression,
+		}, nil
+	case Gzip:
+		ctx, cancel := context.WithCancel(context.Background())
+		gzReader, err := gzipDecompress(ctx, buf)
+		if err != nil {
+			cancel()
+			return nil, err
+		}
+
+		return &readCloserWrapper{
+			Reader:      gzReader,
+			compression: compression,
+			closer: func() error {
+				cancel()
+				return gzReader.Close()
+			},
+		}, nil
+	case Zstd:
+		zstdReader, err := zstd.NewReader(buf)
+		if err != nil {
+			return nil, err
+		}
+		return &readCloserWrapper{
+			Reader:      zstdReader,
+			compression: compression,
+			closer: func() error {
+				zstdReader.Close()
+				return nil
+			},
+		}, nil
+
+	default:
+		return nil, fmt.Errorf("unsupported compression format %s", (&compression).Extension())
+	}
+}
+
+// CompressStream compresses the dest with specified compression algorithm.
+func CompressStream(dest io.Writer, compression Compression) (io.WriteCloser, error) {
+	switch compression {
+	case Uncompressed:
+		return &writeCloserWrapper{dest, nil}, nil
+	case Gzip:
+		return gzip.NewWriter(dest), nil
+	case Zstd:
+		return zstd.NewWriter(dest)
+	default:
+		return nil, fmt.Errorf("unsupported compression format %s", (&compression).Extension())
+	}
+}
+
+// Extension returns the extension of a file that uses the specified compression algorithm.
+func (compression *Compression) Extension() string {
+	switch *compression {
+	case Gzip:
+		return "gz"
+	case Zstd:
+		return "zst"
+	}
+	return ""
+}
+
+func gzipDecompress(ctx context.Context, buf io.Reader) (io.ReadCloser, error) {
+	initPigz.Do(func() {
+		if unpigzPath = detectPigz(); unpigzPath != "" {
+			log.L.Debug("using pigz for decompression")
+		}
+	})
+
+	if unpigzPath == "" {
+		return gzip.NewReader(buf)
+	}
+
+	return cmdStream(exec.CommandContext(ctx, unpigzPath, "-d", "-c"), buf)
+}
+
+func cmdStream(cmd *exec.Cmd, in io.Reader) (io.ReadCloser, error) {
+	reader, writer := io.Pipe()
+
+	cmd.Stdin = in
+	cmd.Stdout = writer
+
+	var errBuf bytes.Buffer
+	cmd.Stderr = &errBuf
+
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+
+	go func() {
+		if err := cmd.Wait(); err != nil {
+			writer.CloseWithError(fmt.Errorf("%s: %s", err, errBuf.String()))
+		} else {
+			writer.Close()
+		}
+	}()
+
+	return reader, nil
+}
+
+func detectPigz() string {
+	path, err := exec.LookPath("unpigz")
+	if err != nil {
+		log.L.WithError(err).Debug("unpigz not found, falling back to go gzip")
+		return ""
+	}
+
+	// Check if pigz disabled via CONTAINERD_DISABLE_PIGZ env variable
+	value := os.Getenv(disablePigzEnv)
+	if value == "" {
+		return path
+	}
+
+	disable, err := strconv.ParseBool(value)
+	if err != nil {
+		log.L.WithError(err).Warnf("could not parse %s: %s", disablePigzEnv, value)
+		return path
+	}
+
+	if disable {
+		return ""
+	}
+
+	return path
+}
diff --git a/vendor/github.com/containerd/containerd/content/adaptor.go b/vendor/github.com/containerd/containerd/content/adaptor.go
new file mode 100644
index 0000000000..88bad2610e
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/content/adaptor.go
@@ -0,0 +1,52 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package content
+
+import (
+	"strings"
+
+	"github.com/containerd/containerd/filters"
+)
+
+// AdaptInfo returns `filters.Adaptor` that handles `content.Info`.
+func AdaptInfo(info Info) filters.Adaptor {
+	return filters.AdapterFunc(func(fieldpath []string) (string, bool) {
+		if len(fieldpath) == 0 {
+			return "", false
+		}
+
+		switch fieldpath[0] {
+		case "digest":
+			return info.Digest.String(), true
+		case "size":
+			// TODO: support size based filtering
+		case "labels":
+			return checkMap(fieldpath[1:], info.Labels)
+		}
+
+		return "", false
+	})
+}
+
+func checkMap(fieldpath []string, m map[string]string) (string, bool) {
+	if len(m) == 0 {
+		return "", false
+	}
+
+	value, ok := m[strings.Join(fieldpath, ".")]
+	return value, ok
+}
diff --git a/vendor/github.com/containerd/containerd/content/content.go b/vendor/github.com/containerd/containerd/content/content.go
new file mode 100644
index 0000000000..ff17a8417b
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/content/content.go
@@ -0,0 +1,182 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package content
+
+import (
+	"context"
+	"io"
+	"time"
+
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// ReaderAt extends the standard io.ReaderAt interface with reporting of Size and io.Closer
+type ReaderAt interface {
+	io.ReaderAt
+	io.Closer
+	Size() int64
+}
+
+// Provider provides a reader interface for specific content
+type Provider interface {
+	// ReaderAt only requires desc.Digest to be set.
+	// Other fields in the descriptor may be used internally for resolving
+	// the location of the actual data.
+	ReaderAt(ctx context.Context, desc ocispec.Descriptor) (ReaderAt, error)
+}
+
+// Ingester writes content
+type Ingester interface {
+	// Some implementations require WithRef to be included in opts.
+	Writer(ctx context.Context, opts ...WriterOpt) (Writer, error)
+}
+
+// Info holds content specific information
+//
+// TODO(stevvooe): Consider a very different name for this struct. Info is way
+// to general. It also reads very weird in certain context, like pluralization.
+type Info struct {
+	Digest    digest.Digest
+	Size      int64
+	CreatedAt time.Time
+	UpdatedAt time.Time
+	Labels    map[string]string
+}
+
+// Status of a content operation
+type Status struct {
+	Ref       string
+	Offset    int64
+	Total     int64
+	Expected  digest.Digest
+	StartedAt time.Time
+	UpdatedAt time.Time
+}
+
+// WalkFunc defines the callback for a blob walk.
+type WalkFunc func(Info) error
+
+// Manager provides methods for inspecting, listing and removing content.
+type Manager interface {
+	// Info will return metadata about content available in the content store.
+	//
+	// If the content is not present, ErrNotFound will be returned.
+	Info(ctx context.Context, dgst digest.Digest) (Info, error)
+
+	// Update updates mutable information related to content.
+	// If one or more fieldpaths are provided, only those
+	// fields will be updated.
+	// Mutable fields:
+	//  labels.*
+	Update(ctx context.Context, info Info, fieldpaths ...string) (Info, error)
+
+	// Walk will call fn for each item in the content store which
+	// match the provided filters. If no filters are given all
+	// items will be walked.
+	Walk(ctx context.Context, fn WalkFunc, filters ...string) error
+
+	// Delete removes the content from the store.
+	Delete(ctx context.Context, dgst digest.Digest) error
+}
+
+// IngestManager provides methods for managing ingests.
+type IngestManager interface {
+	// Status returns the status of the provided ref.
+	Status(ctx context.Context, ref string) (Status, error)
+
+	// ListStatuses returns the status of any active ingestions whose ref match the
+	// provided regular expression. If empty, all active ingestions will be
+	// returned.
+	ListStatuses(ctx context.Context, filters ...string) ([]Status, error)
+
+	// Abort completely cancels the ingest operation targeted by ref.
+	Abort(ctx context.Context, ref string) error
+}
+
+// Writer handles the write of content into a content store
+type Writer interface {
+	// Close closes the writer, if the writer has not been
+	// committed this allows resuming or aborting.
+	// Calling Close on a closed writer will not error.
+	io.WriteCloser
+
+	// Digest may return empty digest or panics until committed.
+	Digest() digest.Digest
+
+	// Commit commits the blob (but no roll-back is guaranteed on an error).
+	// size and expected can be zero-value when unknown.
+	// Commit always closes the writer, even on error.
+	// ErrAlreadyExists aborts the writer.
+	Commit(ctx context.Context, size int64, expected digest.Digest, opts ...Opt) error
+
+	// Status returns the current state of write
+	Status() (Status, error)
+
+	// Truncate updates the size of the target blob
+	Truncate(size int64) error
+}
+
+// Store combines the methods of content-oriented interfaces into a set that
+// are commonly provided by complete implementations.
+type Store interface {
+	Manager
+	Provider
+	IngestManager
+	Ingester
+}
+
+// Opt is used to alter the mutable properties of content
+type Opt func(*Info) error
+
+// WithLabels allows labels to be set on content
+func WithLabels(labels map[string]string) Opt {
+	return func(info *Info) error {
+		info.Labels = labels
+		return nil
+	}
+}
+
+// WriterOpts is internally used by WriterOpt.
+type WriterOpts struct {
+	Ref  string
+	Desc ocispec.Descriptor
+}
+
+// WriterOpt is used for passing options to Ingester.Writer.
+type WriterOpt func(*WriterOpts) error
+
+// WithDescriptor specifies an OCI descriptor.
+// Writer may optionally use the descriptor internally for resolving
+// the location of the actual data.
+// Write does not require any field of desc to be set.
+// If the data size is unknown, desc.Size should be set to 0.
+// Some implementations may also accept negative values as "unknown".
+func WithDescriptor(desc ocispec.Descriptor) WriterOpt {
+	return func(opts *WriterOpts) error {
+		opts.Desc = desc
+		return nil
+	}
+}
+
+// WithRef specifies a ref string.
+func WithRef(ref string) WriterOpt {
+	return func(opts *WriterOpts) error {
+		opts.Ref = ref
+		return nil
+	}
+}
diff --git a/vendor/github.com/containerd/containerd/content/helpers.go b/vendor/github.com/containerd/containerd/content/helpers.go
new file mode 100644
index 0000000000..723c313917
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/content/helpers.go
@@ -0,0 +1,324 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package content
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math/rand"
+	"sync"
+	"time"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/log"
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// maxResets is the no.of times the Copy() method can tolerate a reset of the body
+const maxResets = 5
+
+var ErrReset = errors.New("writer has been reset")
+
+var bufPool = sync.Pool{
+	New: func() interface{} {
+		buffer := make([]byte, 1<<20)
+		return &buffer
+	},
+}
+
+// NewReader returns a io.Reader from a ReaderAt
+func NewReader(ra ReaderAt) io.Reader {
+	rd := io.NewSectionReader(ra, 0, ra.Size())
+	return rd
+}
+
+// ReadBlob retrieves the entire contents of the blob from the provider.
+//
+// Avoid using this for large blobs, such as layers.
+func ReadBlob(ctx context.Context, provider Provider, desc ocispec.Descriptor) ([]byte, error) {
+	ra, err := provider.ReaderAt(ctx, desc)
+	if err != nil {
+		return nil, err
+	}
+	defer ra.Close()
+
+	p := make([]byte, ra.Size())
+
+	n, err := ra.ReadAt(p, 0)
+	if err == io.EOF {
+		if int64(n) != ra.Size() {
+			err = io.ErrUnexpectedEOF
+		} else {
+			err = nil
+		}
+	}
+	return p, err
+}
+
+// WriteBlob writes data with the expected digest into the content store. If
+// expected already exists, the method returns immediately and the reader will
+// not be consumed.
+//
+// This is useful when the digest and size are known beforehand.
+//
+// Copy is buffered, so no need to wrap reader in buffered io.
+func WriteBlob(ctx context.Context, cs Ingester, ref string, r io.Reader, desc ocispec.Descriptor, opts ...Opt) error {
+	cw, err := OpenWriter(ctx, cs, WithRef(ref), WithDescriptor(desc))
+	if err != nil {
+		if !errdefs.IsAlreadyExists(err) {
+			return fmt.Errorf("failed to open writer: %w", err)
+		}
+
+		return nil // already present
+	}
+	defer cw.Close()
+
+	return Copy(ctx, cw, r, desc.Size, desc.Digest, opts...)
+}
+
+// OpenWriter opens a new writer for the given reference, retrying if the writer
+// is locked until the reference is available or returns an error.
+func OpenWriter(ctx context.Context, cs Ingester, opts ...WriterOpt) (Writer, error) {
+	var (
+		cw    Writer
+		err   error
+		retry = 16
+	)
+	for {
+		cw, err = cs.Writer(ctx, opts...)
+		if err != nil {
+			if !errdefs.IsUnavailable(err) {
+				return nil, err
+			}
+
+			// TODO: Check status to determine if the writer is active,
+			// continue waiting while active, otherwise return lock
+			// error or abort. Requires asserting for an ingest manager
+
+			select {
+			case <-time.After(time.Millisecond * time.Duration(rand.Intn(retry))):
+				if retry < 2048 {
+					retry = retry << 1
+				}
+				continue
+			case <-ctx.Done():
+				// Propagate lock error
+				return nil, err
+			}
+
+		}
+		break
+	}
+
+	return cw, err
+}
+
+// Copy copies data with the expected digest from the reader into the
+// provided content store writer. This copy commits the writer.
+//
+// This is useful when the digest and size are known beforehand. When
+// the size or digest is unknown, these values may be empty.
+//
+// Copy is buffered, so no need to wrap reader in buffered io.
+func Copy(ctx context.Context, cw Writer, or io.Reader, size int64, expected digest.Digest, opts ...Opt) error {
+	ws, err := cw.Status()
+	if err != nil {
+		return fmt.Errorf("failed to get status: %w", err)
+	}
+	r := or
+	if ws.Offset > 0 {
+		r, err = seekReader(or, ws.Offset, size)
+		if err != nil {
+			return fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err)
+		}
+	}
+
+	for i := 0; i < maxResets; i++ {
+		if i >= 1 {
+			log.G(ctx).WithField("digest", expected).Debugf("retrying copy due to reset")
+		}
+		copied, err := copyWithBuffer(cw, r)
+		if errors.Is(err, ErrReset) {
+			ws, err := cw.Status()
+			if err != nil {
+				return fmt.Errorf("failed to get status: %w", err)
+			}
+			r, err = seekReader(or, ws.Offset, size)
+			if err != nil {
+				return fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err)
+			}
+			continue
+		}
+		if err != nil {
+			return fmt.Errorf("failed to copy: %w", err)
+		}
+		if size != 0 && copied < size-ws.Offset {
+			// Short writes would return its own error, this indicates a read failure
+			return fmt.Errorf("failed to read expected number of bytes: %w", io.ErrUnexpectedEOF)
+		}
+		if err := cw.Commit(ctx, size, expected, opts...); err != nil {
+			if errors.Is(err, ErrReset) {
+				ws, err := cw.Status()
+				if err != nil {
+					return fmt.Errorf("failed to get status: %w", err)
+				}
+				r, err = seekReader(or, ws.Offset, size)
+				if err != nil {
+					return fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err)
+				}
+				continue
+			}
+			if !errdefs.IsAlreadyExists(err) {
+				return fmt.Errorf("failed commit on ref %q: %w", ws.Ref, err)
+			}
+		}
+		return nil
+	}
+
+	log.G(ctx).WithField("digest", expected).Errorf("failed to copy after %d retries", maxResets)
+	return fmt.Errorf("failed to copy after %d retries", maxResets)
+}
+
+// CopyReaderAt copies to a writer from a given reader at for the given
+// number of bytes. This copy does not commit the writer.
+func CopyReaderAt(cw Writer, ra ReaderAt, n int64) error {
+	ws, err := cw.Status()
+	if err != nil {
+		return err
+	}
+
+	copied, err := copyWithBuffer(cw, io.NewSectionReader(ra, ws.Offset, n))
+	if err != nil {
+		return fmt.Errorf("failed to copy: %w", err)
+	}
+	if copied < n {
+		// Short writes would return its own error, this indicates a read failure
+		return fmt.Errorf("failed to read expected number of bytes: %w", io.ErrUnexpectedEOF)
+	}
+	return nil
+}
+
+// CopyReader copies to a writer from a given reader, returning
+// the number of bytes copied.
+// Note: if the writer has a non-zero offset, the total number
+// of bytes read may be greater than those copied if the reader
+// is not an io.Seeker.
+// This copy does not commit the writer.
+func CopyReader(cw Writer, r io.Reader) (int64, error) {
+	ws, err := cw.Status()
+	if err != nil {
+		return 0, fmt.Errorf("failed to get status: %w", err)
+	}
+
+	if ws.Offset > 0 {
+		r, err = seekReader(r, ws.Offset, 0)
+		if err != nil {
+			return 0, fmt.Errorf("unable to resume write to %v: %w", ws.Ref, err)
+		}
+	}
+
+	return copyWithBuffer(cw, r)
+}
+
+// seekReader attempts to seek the reader to the given offset, either by
+// resolving `io.Seeker`, by detecting `io.ReaderAt`, or discarding
+// up to the given offset.
+func seekReader(r io.Reader, offset, size int64) (io.Reader, error) {
+	// attempt to resolve r as a seeker and setup the offset.
+	seeker, ok := r.(io.Seeker)
+	if ok {
+		nn, err := seeker.Seek(offset, io.SeekStart)
+		if nn != offset {
+			if err == nil {
+				err = fmt.Errorf("unexpected seek location without seek error")
+			}
+			return nil, fmt.Errorf("failed to seek to offset %v: %w", offset, err)
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		return r, nil
+	}
+
+	// ok, let's try io.ReaderAt!
+	readerAt, ok := r.(io.ReaderAt)
+	if ok && size > offset {
+		sr := io.NewSectionReader(readerAt, offset, size)
+		return sr, nil
+	}
+
+	// well then, let's just discard up to the offset
+	n, err := copyWithBuffer(io.Discard, io.LimitReader(r, offset))
+	if err != nil {
+		return nil, fmt.Errorf("failed to discard to offset: %w", err)
+	}
+	if n != offset {
+		return nil, errors.New("unable to discard to offset")
+	}
+
+	return r, nil
+}
+
+// copyWithBuffer is very similar to  io.CopyBuffer https://golang.org/pkg/io/#CopyBuffer
+// but instead of using Read to read from the src, we use ReadAtLeast to make sure we have
+// a full buffer before we do a write operation to dst to reduce overheads associated
+// with the write operations of small buffers.
+func copyWithBuffer(dst io.Writer, src io.Reader) (written int64, err error) {
+	// If the reader has a WriteTo method, use it to do the copy.
+	// Avoids an allocation and a copy.
+	if wt, ok := src.(io.WriterTo); ok {
+		return wt.WriteTo(dst)
+	}
+	// Similarly, if the writer has a ReadFrom method, use it to do the copy.
+	if rt, ok := dst.(io.ReaderFrom); ok {
+		return rt.ReadFrom(src)
+	}
+	bufRef := bufPool.Get().(*[]byte)
+	defer bufPool.Put(bufRef)
+	buf := *bufRef
+	for {
+		nr, er := io.ReadAtLeast(src, buf, len(buf))
+		if nr > 0 {
+			nw, ew := dst.Write(buf[0:nr])
+			if nw > 0 {
+				written += int64(nw)
+			}
+			if ew != nil {
+				err = ew
+				break
+			}
+			if nr != nw {
+				err = io.ErrShortWrite
+				break
+			}
+		}
+		if er != nil {
+			// If an EOF happens after reading fewer than the requested bytes,
+			// ReadAtLeast returns ErrUnexpectedEOF.
+			if er != io.EOF && er != io.ErrUnexpectedEOF {
+				err = er
+			}
+			break
+		}
+	}
+	return
+}
diff --git a/vendor/github.com/containerd/containerd/errdefs/errors.go b/vendor/github.com/containerd/containerd/errdefs/errors.go
new file mode 100644
index 0000000000..8762255970
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/errdefs/errors.go
@@ -0,0 +1,92 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package errdefs defines the common errors used throughout containerd
+// packages.
+//
+// Use with fmt.Errorf to add context to an error.
+//
+// To detect an error class, use the IsXXX functions to tell whether an error
+// is of a certain type.
+//
+// The functions ToGRPC and FromGRPC can be used to map server-side and
+// client-side errors to the correct types.
+package errdefs
+
+import (
+	"context"
+	"errors"
+)
+
+// Definitions of common error types used throughout containerd. All containerd
+// errors returned by most packages will map into one of these errors classes.
+// Packages should return errors of these types when they want to instruct a
+// client to take a particular action.
+//
+// For the most part, we just try to provide local grpc errors. Most conditions
+// map very well to those defined by grpc.
+var (
+	ErrUnknown            = errors.New("unknown") // used internally to represent a missed mapping.
+	ErrInvalidArgument    = errors.New("invalid argument")
+	ErrNotFound           = errors.New("not found")
+	ErrAlreadyExists      = errors.New("already exists")
+	ErrFailedPrecondition = errors.New("failed precondition")
+	ErrUnavailable        = errors.New("unavailable")
+	ErrNotImplemented     = errors.New("not implemented") // represents not supported and unimplemented
+)
+
+// IsInvalidArgument returns true if the error is due to an invalid argument
+func IsInvalidArgument(err error) bool {
+	return errors.Is(err, ErrInvalidArgument)
+}
+
+// IsNotFound returns true if the error is due to a missing object
+func IsNotFound(err error) bool {
+	return errors.Is(err, ErrNotFound)
+}
+
+// IsAlreadyExists returns true if the error is due to an already existing
+// metadata item
+func IsAlreadyExists(err error) bool {
+	return errors.Is(err, ErrAlreadyExists)
+}
+
+// IsFailedPrecondition returns true if an operation could not proceed to the
+// lack of a particular condition
+func IsFailedPrecondition(err error) bool {
+	return errors.Is(err, ErrFailedPrecondition)
+}
+
+// IsUnavailable returns true if the error is due to a resource being unavailable
+func IsUnavailable(err error) bool {
+	return errors.Is(err, ErrUnavailable)
+}
+
+// IsNotImplemented returns true if the error is due to not being implemented
+func IsNotImplemented(err error) bool {
+	return errors.Is(err, ErrNotImplemented)
+}
+
+// IsCanceled returns true if the error is due to `context.Canceled`.
+func IsCanceled(err error) bool {
+	return errors.Is(err, context.Canceled)
+}
+
+// IsDeadlineExceeded returns true if the error is due to
+// `context.DeadlineExceeded`.
+func IsDeadlineExceeded(err error) bool {
+	return errors.Is(err, context.DeadlineExceeded)
+}
diff --git a/vendor/github.com/containerd/containerd/errdefs/grpc.go b/vendor/github.com/containerd/containerd/errdefs/grpc.go
new file mode 100644
index 0000000000..7a9b33e05a
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/errdefs/grpc.go
@@ -0,0 +1,147 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package errdefs
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// ToGRPC will attempt to map the backend containerd error into a grpc error,
+// using the original error message as a description.
+//
+// Further information may be extracted from certain errors depending on their
+// type.
+//
+// If the error is unmapped, the original error will be returned to be handled
+// by the regular grpc error handling stack.
+func ToGRPC(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	if isGRPCError(err) {
+		// error has already been mapped to grpc
+		return err
+	}
+
+	switch {
+	case IsInvalidArgument(err):
+		return status.Errorf(codes.InvalidArgument, err.Error())
+	case IsNotFound(err):
+		return status.Errorf(codes.NotFound, err.Error())
+	case IsAlreadyExists(err):
+		return status.Errorf(codes.AlreadyExists, err.Error())
+	case IsFailedPrecondition(err):
+		return status.Errorf(codes.FailedPrecondition, err.Error())
+	case IsUnavailable(err):
+		return status.Errorf(codes.Unavailable, err.Error())
+	case IsNotImplemented(err):
+		return status.Errorf(codes.Unimplemented, err.Error())
+	case IsCanceled(err):
+		return status.Errorf(codes.Canceled, err.Error())
+	case IsDeadlineExceeded(err):
+		return status.Errorf(codes.DeadlineExceeded, err.Error())
+	}
+
+	return err
+}
+
+// ToGRPCf maps the error to grpc error codes, assembling the formatting string
+// and combining it with the target error string.
+//
+// This is equivalent to errdefs.ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err))
+func ToGRPCf(err error, format string, args ...interface{}) error {
+	return ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err))
+}
+
+// FromGRPC returns the underlying error from a grpc service based on the grpc error code
+func FromGRPC(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var cls error // divide these into error classes, becomes the cause
+
+	switch code(err) {
+	case codes.InvalidArgument:
+		cls = ErrInvalidArgument
+	case codes.AlreadyExists:
+		cls = ErrAlreadyExists
+	case codes.NotFound:
+		cls = ErrNotFound
+	case codes.Unavailable:
+		cls = ErrUnavailable
+	case codes.FailedPrecondition:
+		cls = ErrFailedPrecondition
+	case codes.Unimplemented:
+		cls = ErrNotImplemented
+	case codes.Canceled:
+		cls = context.Canceled
+	case codes.DeadlineExceeded:
+		cls = context.DeadlineExceeded
+	default:
+		cls = ErrUnknown
+	}
+
+	msg := rebaseMessage(cls, err)
+	if msg != "" {
+		err = fmt.Errorf("%s: %w", msg, cls)
+	} else {
+		err = cls
+	}
+
+	return err
+}
+
+// rebaseMessage removes the repeats for an error at the end of an error
+// string. This will happen when taking an error over grpc then remapping it.
+//
+// Effectively, we just remove the string of cls from the end of err if it
+// appears there.
+func rebaseMessage(cls error, err error) string {
+	desc := errDesc(err)
+	clss := cls.Error()
+	if desc == clss {
+		return ""
+	}
+
+	return strings.TrimSuffix(desc, ": "+clss)
+}
+
+func isGRPCError(err error) bool {
+	_, ok := status.FromError(err)
+	return ok
+}
+
+func code(err error) codes.Code {
+	if s, ok := status.FromError(err); ok {
+		return s.Code()
+	}
+	return codes.Unknown
+}
+
+func errDesc(err error) string {
+	if s, ok := status.FromError(err); ok {
+		return s.Message()
+	}
+	return err.Error()
+}
diff --git a/vendor/github.com/containerd/containerd/filters/adaptor.go b/vendor/github.com/containerd/containerd/filters/adaptor.go
new file mode 100644
index 0000000000..5a9c559c1e
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/filters/adaptor.go
@@ -0,0 +1,33 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filters
+
+// Adaptor specifies the mapping of fieldpaths to a type. For the given field
+// path, the value and whether it is present should be returned. The mapping of
+// the fieldpath to a field is deferred to the adaptor implementation, but
+// should generally follow protobuf field path/mask semantics.
+type Adaptor interface {
+	Field(fieldpath []string) (value string, present bool)
+}
+
+// AdapterFunc allows implementation specific matching of fieldpaths
+type AdapterFunc func(fieldpath []string) (string, bool)
+
+// Field returns the field name and true if it exists
+func (fn AdapterFunc) Field(fieldpath []string) (string, bool) {
+	return fn(fieldpath)
+}
diff --git a/vendor/github.com/containerd/containerd/filters/filter.go b/vendor/github.com/containerd/containerd/filters/filter.go
new file mode 100644
index 0000000000..e13f2625c7
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/filters/filter.go
@@ -0,0 +1,178 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package filters defines a syntax and parser that can be used for the
+// filtration of items across the containerd API. The core is built on the
+// concept of protobuf field paths, with quoting.  Several operators allow the
+// user to flexibly select items based on field presence, equality, inequality
+// and regular expressions. Flexible adaptors support working with any type.
+//
+// The syntax is fairly familiar, if you've used container ecosystem
+// projects.  At the core, we base it on the concept of protobuf field
+// paths, augmenting with the ability to quote portions of the field path
+// to match arbitrary labels. These "selectors" come in the following
+// syntax:
+//
+// ```
+// <fieldpath>[<operator><value>]
+// ```
+//
+// A basic example is as follows:
+//
+// ```
+// name==foo
+// ```
+//
+// This would match all objects that have a field `name` with the value
+// `foo`. If we only want to test if the field is present, we can omit the
+// operator. This is most useful for matching labels in containerd. The
+// following will match objects that have the field "labels" and have the
+// label "foo" defined:
+//
+// ```
+// labels.foo
+// ```
+//
+// We also allow for quoting of parts of the field path to allow matching
+// of arbitrary items:
+//
+// ```
+// labels."very complex label"==something
+// ```
+//
+// We also define `!=` and `~=` as operators. The `!=` will match all
+// objects that don't match the value for a field and `~=` will compile the
+// target value as a regular expression and match the field value against that.
+//
+// Selectors can be combined using a comma, such that the resulting
+// selector will require all selectors are matched for the object to match.
+// The following example will match objects that are named `foo` and have
+// the label `bar`:
+//
+// ```
+// name==foo,labels.bar
+// ```
+package filters
+
+import (
+	"regexp"
+
+	"github.com/containerd/containerd/log"
+)
+
+// Filter matches specific resources based the provided filter
+type Filter interface {
+	Match(adaptor Adaptor) bool
+}
+
+// FilterFunc is a function that handles matching with an adaptor
+type FilterFunc func(Adaptor) bool
+
+// Match matches the FilterFunc returning true if the object matches the filter
+func (fn FilterFunc) Match(adaptor Adaptor) bool {
+	return fn(adaptor)
+}
+
+// Always is a filter that always returns true for any type of object
+var Always FilterFunc = func(adaptor Adaptor) bool {
+	return true
+}
+
+// Any allows multiple filters to be matched against the object
+type Any []Filter
+
+// Match returns true if any of the provided filters are true
+func (m Any) Match(adaptor Adaptor) bool {
+	for _, m := range m {
+		if m.Match(adaptor) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// All allows multiple filters to be matched against the object
+type All []Filter
+
+// Match only returns true if all filters match the object
+func (m All) Match(adaptor Adaptor) bool {
+	for _, m := range m {
+		if !m.Match(adaptor) {
+			return false
+		}
+	}
+
+	return true
+}
+
+type operator int
+
+const (
+	operatorPresent = iota
+	operatorEqual
+	operatorNotEqual
+	operatorMatches
+)
+
+func (op operator) String() string {
+	switch op {
+	case operatorPresent:
+		return "?"
+	case operatorEqual:
+		return "=="
+	case operatorNotEqual:
+		return "!="
+	case operatorMatches:
+		return "~="
+	}
+
+	return "unknown"
+}
+
+type selector struct {
+	fieldpath []string
+	operator  operator
+	value     string
+	re        *regexp.Regexp
+}
+
+func (m selector) Match(adaptor Adaptor) bool {
+	value, present := adaptor.Field(m.fieldpath)
+
+	switch m.operator {
+	case operatorPresent:
+		return present
+	case operatorEqual:
+		return present && value == m.value
+	case operatorNotEqual:
+		return value != m.value
+	case operatorMatches:
+		if m.re == nil {
+			r, err := regexp.Compile(m.value)
+			if err != nil {
+				log.L.Errorf("error compiling regexp %q", m.value)
+				return false
+			}
+
+			m.re = r
+		}
+
+		return m.re.MatchString(value)
+	default:
+		return false
+	}
+}
diff --git a/vendor/github.com/containerd/containerd/filters/parser.go b/vendor/github.com/containerd/containerd/filters/parser.go
new file mode 100644
index 0000000000..32767909b1
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/filters/parser.go
@@ -0,0 +1,290 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filters
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/containerd/containerd/errdefs"
+)
+
+/*
+Parse the strings into a filter that may be used with an adaptor.
+
+The filter is made up of zero or more selectors.
+
+The format is a comma separated list of expressions, in the form of
+`<fieldpath><op><value>`, known as selectors. All selectors must match the
+target object for the filter to be true.
+
+We define the operators "==" for equality, "!=" for not equal and "~=" for a
+regular expression. If the operator and value are not present, the matcher will
+test for the presence of a value, as defined by the target object.
+
+The formal grammar is as follows:
+
+selectors := selector ("," selector)*
+selector  := fieldpath (operator value)
+fieldpath := field ('.' field)*
+field     := quoted | [A-Za-z] [A-Za-z0-9_]+
+operator  := "==" | "!=" | "~="
+value     := quoted | [^\s,]+
+quoted    := <go string syntax>
+*/
+func Parse(s string) (Filter, error) {
+	// special case empty to match all
+	if s == "" {
+		return Always, nil
+	}
+
+	p := parser{input: s}
+	return p.parse()
+}
+
+// ParseAll parses each filter in ss and returns a filter that will return true
+// if any filter matches the expression.
+//
+// If no filters are provided, the filter will match anything.
+func ParseAll(ss ...string) (Filter, error) {
+	if len(ss) == 0 {
+		return Always, nil
+	}
+
+	var fs []Filter
+	for _, s := range ss {
+		f, err := Parse(s)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", err.Error(), errdefs.ErrInvalidArgument)
+		}
+
+		fs = append(fs, f)
+	}
+
+	return Any(fs), nil
+}
+
+type parser struct {
+	input   string
+	scanner scanner
+}
+
+func (p *parser) parse() (Filter, error) {
+	p.scanner.init(p.input)
+
+	ss, err := p.selectors()
+	if err != nil {
+		return nil, fmt.Errorf("filters: %w", err)
+	}
+
+	return ss, nil
+}
+
+func (p *parser) selectors() (Filter, error) {
+	s, err := p.selector()
+	if err != nil {
+		return nil, err
+	}
+
+	ss := All{s}
+
+loop:
+	for {
+		tok := p.scanner.peek()
+		switch tok {
+		case ',':
+			pos, tok, _ := p.scanner.scan()
+			if tok != tokenSeparator {
+				return nil, p.mkerr(pos, "expected a separator")
+			}
+
+			s, err := p.selector()
+			if err != nil {
+				return nil, err
+			}
+
+			ss = append(ss, s)
+		case tokenEOF:
+			break loop
+		default:
+			return nil, p.mkerr(p.scanner.ppos, "unexpected input: %v", string(tok))
+		}
+	}
+
+	return ss, nil
+}
+
+func (p *parser) selector() (selector, error) {
+	fieldpath, err := p.fieldpath()
+	if err != nil {
+		return selector{}, err
+	}
+
+	switch p.scanner.peek() {
+	case ',', tokenSeparator, tokenEOF:
+		return selector{
+			fieldpath: fieldpath,
+			operator:  operatorPresent,
+		}, nil
+	}
+
+	op, err := p.operator()
+	if err != nil {
+		return selector{}, err
+	}
+
+	var allowAltQuotes bool
+	if op == operatorMatches {
+		allowAltQuotes = true
+	}
+
+	value, err := p.value(allowAltQuotes)
+	if err != nil {
+		if err == io.EOF {
+			return selector{}, io.ErrUnexpectedEOF
+		}
+		return selector{}, err
+	}
+
+	return selector{
+		fieldpath: fieldpath,
+		value:     value,
+		operator:  op,
+	}, nil
+}
+
+func (p *parser) fieldpath() ([]string, error) {
+	f, err := p.field()
+	if err != nil {
+		return nil, err
+	}
+
+	fs := []string{f}
+loop:
+	for {
+		tok := p.scanner.peek() // lookahead to consume field separator
+
+		switch tok {
+		case '.':
+			pos, tok, _ := p.scanner.scan() // consume separator
+			if tok != tokenSeparator {
+				return nil, p.mkerr(pos, "expected a field separator (`.`)")
+			}
+
+			f, err := p.field()
+			if err != nil {
+				return nil, err
+			}
+
+			fs = append(fs, f)
+		default:
+			// let the layer above handle the other bad cases.
+			break loop
+		}
+	}
+
+	return fs, nil
+}
+
+func (p *parser) field() (string, error) {
+	pos, tok, s := p.scanner.scan()
+	switch tok {
+	case tokenField:
+		return s, nil
+	case tokenQuoted:
+		return p.unquote(pos, s, false)
+	case tokenIllegal:
+		return "", p.mkerr(pos, p.scanner.err)
+	}
+
+	return "", p.mkerr(pos, "expected field or quoted")
+}
+
+func (p *parser) operator() (operator, error) {
+	pos, tok, s := p.scanner.scan()
+	switch tok {
+	case tokenOperator:
+		switch s {
+		case "==":
+			return operatorEqual, nil
+		case "!=":
+			return operatorNotEqual, nil
+		case "~=":
+			return operatorMatches, nil
+		default:
+			return 0, p.mkerr(pos, "unsupported operator %q", s)
+		}
+	case tokenIllegal:
+		return 0, p.mkerr(pos, p.scanner.err)
+	}
+
+	return 0, p.mkerr(pos, `expected an operator ("=="|"!="|"~=")`)
+}
+
+func (p *parser) value(allowAltQuotes bool) (string, error) {
+	pos, tok, s := p.scanner.scan()
+
+	switch tok {
+	case tokenValue, tokenField:
+		return s, nil
+	case tokenQuoted:
+		return p.unquote(pos, s, allowAltQuotes)
+	case tokenIllegal:
+		return "", p.mkerr(pos, p.scanner.err)
+	}
+
+	return "", p.mkerr(pos, "expected value or quoted")
+}
+
+func (p *parser) unquote(pos int, s string, allowAlts bool) (string, error) {
+	if !allowAlts && s[0] != '\'' && s[0] != '"' {
+		return "", p.mkerr(pos, "invalid quote encountered")
+	}
+
+	uq, err := unquote(s)
+	if err != nil {
+		return "", p.mkerr(pos, "unquoting failed: %v", err)
+	}
+
+	return uq, nil
+}
+
+type parseError struct {
+	input string
+	pos   int
+	msg   string
+}
+
+func (pe parseError) Error() string {
+	if pe.pos < len(pe.input) {
+		before := pe.input[:pe.pos]
+		location := pe.input[pe.pos : pe.pos+1] // need to handle end
+		after := pe.input[pe.pos+1:]
+
+		return fmt.Sprintf("[%s >|%s|< %s]: %v", before, location, after, pe.msg)
+	}
+
+	return fmt.Sprintf("[%s]: %v", pe.input, pe.msg)
+}
+
+func (p *parser) mkerr(pos int, format string, args ...interface{}) error {
+	return fmt.Errorf("parse error: %w", parseError{
+		input: p.input,
+		pos:   pos,
+		msg:   fmt.Sprintf(format, args...),
+	})
+}
diff --git a/vendor/github.com/containerd/containerd/filters/quote.go b/vendor/github.com/containerd/containerd/filters/quote.go
new file mode 100644
index 0000000000..5c800ef846
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/filters/quote.go
@@ -0,0 +1,252 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filters
+
+import (
+	"errors"
+	"unicode/utf8"
+)
+
+// NOTE(stevvooe): Most of this code in this file is copied from the stdlib
+// strconv package and modified to be able to handle quoting with `/` and `|`
+// as delimiters.  The copyright is held by the Go authors.
+
+var errQuoteSyntax = errors.New("quote syntax error")
+
+// UnquoteChar decodes the first character or byte in the escaped string
+// or character literal represented by the string s.
+// It returns four values:
+//
+//  1. value, the decoded Unicode code point or byte value;
+//  2. multibyte, a boolean indicating whether the decoded character requires a multibyte UTF-8 representation;
+//  3. tail, the remainder of the string after the character; and
+//  4. an error that will be nil if the character is syntactically valid.
+//
+// The second argument, quote, specifies the type of literal being parsed
+// and therefore which escaped quote character is permitted.
+// If set to a single quote, it permits the sequence \' and disallows unescaped '.
+// If set to a double quote, it permits \" and disallows unescaped ".
+// If set to zero, it does not permit either escape and allows both quote characters to appear unescaped.
+//
+// This is from Go strconv package, modified to support `|` and `/` as double
+// quotes for use with regular expressions.
+func unquoteChar(s string, quote byte) (value rune, multibyte bool, tail string, err error) {
+	// easy cases
+	switch c := s[0]; {
+	case c == quote && (quote == '\'' || quote == '"' || quote == '/' || quote == '|'):
+		err = errQuoteSyntax
+		return
+	case c >= utf8.RuneSelf:
+		r, size := utf8.DecodeRuneInString(s)
+		return r, true, s[size:], nil
+	case c != '\\':
+		return rune(s[0]), false, s[1:], nil
+	}
+
+	// hard case: c is backslash
+	if len(s) <= 1 {
+		err = errQuoteSyntax
+		return
+	}
+	c := s[1]
+	s = s[2:]
+
+	switch c {
+	case 'a':
+		value = '\a'
+	case 'b':
+		value = '\b'
+	case 'f':
+		value = '\f'
+	case 'n':
+		value = '\n'
+	case 'r':
+		value = '\r'
+	case 't':
+		value = '\t'
+	case 'v':
+		value = '\v'
+	case 'x', 'u', 'U':
+		n := 0
+		switch c {
+		case 'x':
+			n = 2
+		case 'u':
+			n = 4
+		case 'U':
+			n = 8
+		}
+		var v rune
+		if len(s) < n {
+			err = errQuoteSyntax
+			return
+		}
+		for j := 0; j < n; j++ {
+			x, ok := unhex(s[j])
+			if !ok {
+				err = errQuoteSyntax
+				return
+			}
+			v = v<<4 | x
+		}
+		s = s[n:]
+		if c == 'x' {
+			// single-byte string, possibly not UTF-8
+			value = v
+			break
+		}
+		if v > utf8.MaxRune {
+			err = errQuoteSyntax
+			return
+		}
+		value = v
+		multibyte = true
+	case '0', '1', '2', '3', '4', '5', '6', '7':
+		v := rune(c) - '0'
+		if len(s) < 2 {
+			err = errQuoteSyntax
+			return
+		}
+		for j := 0; j < 2; j++ { // one digit already; two more
+			x := rune(s[j]) - '0'
+			if x < 0 || x > 7 {
+				err = errQuoteSyntax
+				return
+			}
+			v = (v << 3) | x
+		}
+		s = s[2:]
+		if v > 255 {
+			err = errQuoteSyntax
+			return
+		}
+		value = v
+	case '\\':
+		value = '\\'
+	case '\'', '"', '|', '/':
+		if c != quote {
+			err = errQuoteSyntax
+			return
+		}
+		value = rune(c)
+	default:
+		err = errQuoteSyntax
+		return
+	}
+	tail = s
+	return
+}
+
+// unquote interprets s as a single-quoted, double-quoted,
+// or backquoted Go string literal, returning the string value
+// that s quotes.  (If s is single-quoted, it would be a Go
+// character literal; Unquote returns the corresponding
+// one-character string.)
+//
+// This is modified from the standard library to support `|` and `/` as quote
+// characters for use with regular expressions.
+func unquote(s string) (string, error) {
+	n := len(s)
+	if n < 2 {
+		return "", errQuoteSyntax
+	}
+	quote := s[0]
+	if quote != s[n-1] {
+		return "", errQuoteSyntax
+	}
+	s = s[1 : n-1]
+
+	if quote == '`' {
+		if contains(s, '`') {
+			return "", errQuoteSyntax
+		}
+		if contains(s, '\r') {
+			// -1 because we know there is at least one \r to remove.
+			buf := make([]byte, 0, len(s)-1)
+			for i := 0; i < len(s); i++ {
+				if s[i] != '\r' {
+					buf = append(buf, s[i])
+				}
+			}
+			return string(buf), nil
+		}
+		return s, nil
+	}
+	if quote != '"' && quote != '\'' && quote != '|' && quote != '/' {
+		return "", errQuoteSyntax
+	}
+	if contains(s, '\n') {
+		return "", errQuoteSyntax
+	}
+
+	// Is it trivial?  Avoid allocation.
+	if !contains(s, '\\') && !contains(s, quote) {
+		switch quote {
+		case '"', '/', '|': // pipe and slash are treated like double quote
+			return s, nil
+		case '\'':
+			r, size := utf8.DecodeRuneInString(s)
+			if size == len(s) && (r != utf8.RuneError || size != 1) {
+				return s, nil
+			}
+		}
+	}
+
+	var runeTmp [utf8.UTFMax]byte
+	buf := make([]byte, 0, 3*len(s)/2) // Try to avoid more allocations.
+	for len(s) > 0 {
+		c, multibyte, ss, err := unquoteChar(s, quote)
+		if err != nil {
+			return "", err
+		}
+		s = ss
+		if c < utf8.RuneSelf || !multibyte {
+			buf = append(buf, byte(c))
+		} else {
+			n := utf8.EncodeRune(runeTmp[:], c)
+			buf = append(buf, runeTmp[:n]...)
+		}
+		if quote == '\'' && len(s) != 0 {
+			// single-quoted must be single character
+			return "", errQuoteSyntax
+		}
+	}
+	return string(buf), nil
+}
+
+// contains reports whether the string contains the byte c.
+func contains(s string, c byte) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] == c {
+			return true
+		}
+	}
+	return false
+}
+
+func unhex(b byte) (v rune, ok bool) {
+	c := rune(b)
+	switch {
+	case '0' <= c && c <= '9':
+		return c - '0', true
+	case 'a' <= c && c <= 'f':
+		return c - 'a' + 10, true
+	case 'A' <= c && c <= 'F':
+		return c - 'A' + 10, true
+	}
+	return
+}
diff --git a/vendor/github.com/containerd/containerd/filters/scanner.go b/vendor/github.com/containerd/containerd/filters/scanner.go
new file mode 100644
index 0000000000..6a485467b8
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/filters/scanner.go
@@ -0,0 +1,297 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package filters
+
+import (
+	"unicode"
+	"unicode/utf8"
+)
+
+const (
+	tokenEOF = -(iota + 1)
+	tokenQuoted
+	tokenValue
+	tokenField
+	tokenSeparator
+	tokenOperator
+	tokenIllegal
+)
+
+type token rune
+
+func (t token) String() string {
+	switch t {
+	case tokenEOF:
+		return "EOF"
+	case tokenQuoted:
+		return "Quoted"
+	case tokenValue:
+		return "Value"
+	case tokenField:
+		return "Field"
+	case tokenSeparator:
+		return "Separator"
+	case tokenOperator:
+		return "Operator"
+	case tokenIllegal:
+		return "Illegal"
+	}
+
+	return string(t)
+}
+
+func (t token) GoString() string {
+	return "token" + t.String()
+}
+
+type scanner struct {
+	input string
+	pos   int
+	ppos  int // bounds the current rune in the string
+	value bool
+	err   string
+}
+
+func (s *scanner) init(input string) {
+	s.input = input
+	s.pos = 0
+	s.ppos = 0
+}
+
+func (s *scanner) next() rune {
+	if s.pos >= len(s.input) {
+		return tokenEOF
+	}
+	s.pos = s.ppos
+
+	r, w := utf8.DecodeRuneInString(s.input[s.ppos:])
+	s.ppos += w
+	if r == utf8.RuneError {
+		if w > 0 {
+			s.error("rune error")
+			return tokenIllegal
+		}
+		return tokenEOF
+	}
+
+	if r == 0 {
+		s.error("unexpected null")
+		return tokenIllegal
+	}
+
+	return r
+}
+
+func (s *scanner) peek() rune {
+	pos := s.pos
+	ppos := s.ppos
+	ch := s.next()
+	s.pos = pos
+	s.ppos = ppos
+	return ch
+}
+
+func (s *scanner) scan() (nextp int, tk token, text string) {
+	var (
+		ch  = s.next()
+		pos = s.pos
+	)
+
+chomp:
+	switch {
+	case ch == tokenEOF:
+	case ch == tokenIllegal:
+	case isQuoteRune(ch):
+		if !s.scanQuoted(ch) {
+			return pos, tokenIllegal, s.input[pos:s.ppos]
+		}
+		return pos, tokenQuoted, s.input[pos:s.ppos]
+	case isSeparatorRune(ch):
+		s.value = false
+		return pos, tokenSeparator, s.input[pos:s.ppos]
+	case isOperatorRune(ch):
+		s.scanOperator()
+		s.value = true
+		return pos, tokenOperator, s.input[pos:s.ppos]
+	case unicode.IsSpace(ch):
+		// chomp
+		ch = s.next()
+		pos = s.pos
+		goto chomp
+	case s.value:
+		s.scanValue()
+		s.value = false
+		return pos, tokenValue, s.input[pos:s.ppos]
+	case isFieldRune(ch):
+		s.scanField()
+		return pos, tokenField, s.input[pos:s.ppos]
+	}
+
+	return s.pos, token(ch), ""
+}
+
+func (s *scanner) scanField() {
+	for {
+		ch := s.peek()
+		if !isFieldRune(ch) {
+			break
+		}
+		s.next()
+	}
+}
+
+func (s *scanner) scanOperator() {
+	for {
+		ch := s.peek()
+		switch ch {
+		case '=', '!', '~':
+			s.next()
+		default:
+			return
+		}
+	}
+}
+
+func (s *scanner) scanValue() {
+	for {
+		ch := s.peek()
+		if !isValueRune(ch) {
+			break
+		}
+		s.next()
+	}
+}
+
+func (s *scanner) scanQuoted(quote rune) bool {
+	var illegal bool
+	ch := s.next() // read character after quote
+	for ch != quote {
+		if ch == '\n' || ch < 0 {
+			s.error("quoted literal not terminated")
+			return false
+		}
+		if ch == '\\' {
+			var legal bool
+			ch, legal = s.scanEscape(quote)
+			if !legal {
+				illegal = true
+			}
+		} else {
+			ch = s.next()
+		}
+	}
+	return !illegal
+}
+
+func (s *scanner) scanEscape(quote rune) (ch rune, legal bool) {
+	ch = s.next() // read character after '/'
+	switch ch {
+	case 'a', 'b', 'f', 'n', 'r', 't', 'v', '\\', quote:
+		// nothing to do
+		ch = s.next()
+		legal = true
+	case '0', '1', '2', '3', '4', '5', '6', '7':
+		ch, legal = s.scanDigits(ch, 8, 3)
+	case 'x':
+		ch, legal = s.scanDigits(s.next(), 16, 2)
+	case 'u':
+		ch, legal = s.scanDigits(s.next(), 16, 4)
+	case 'U':
+		ch, legal = s.scanDigits(s.next(), 16, 8)
+	default:
+		s.error("illegal escape sequence")
+	}
+	return
+}
+
+func (s *scanner) scanDigits(ch rune, base, n int) (rune, bool) {
+	for n > 0 && digitVal(ch) < base {
+		ch = s.next()
+		n--
+	}
+	if n > 0 {
+		s.error("illegal numeric escape sequence")
+		return ch, false
+	}
+	return ch, true
+}
+
+func (s *scanner) error(msg string) {
+	if s.err == "" {
+		s.err = msg
+	}
+}
+
+func digitVal(ch rune) int {
+	switch {
+	case '0' <= ch && ch <= '9':
+		return int(ch - '0')
+	case 'a' <= ch && ch <= 'f':
+		return int(ch - 'a' + 10)
+	case 'A' <= ch && ch <= 'F':
+		return int(ch - 'A' + 10)
+	}
+	return 16 // larger than any legal digit val
+}
+
+func isFieldRune(r rune) bool {
+	return (r == '_' || isAlphaRune(r) || isDigitRune(r))
+}
+
+func isAlphaRune(r rune) bool {
+	return r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z'
+}
+
+func isDigitRune(r rune) bool {
+	return r >= '0' && r <= '9'
+}
+
+func isOperatorRune(r rune) bool {
+	switch r {
+	case '=', '!', '~':
+		return true
+	}
+
+	return false
+}
+
+func isQuoteRune(r rune) bool {
+	switch r {
+	case '/', '|', '"': // maybe add single quoting?
+		return true
+	}
+
+	return false
+}
+
+func isSeparatorRune(r rune) bool {
+	switch r {
+	case ',', '.':
+		return true
+	}
+
+	return false
+}
+
+func isValueRune(r rune) bool {
+	return r != ',' && !unicode.IsSpace(r) &&
+		(unicode.IsLetter(r) ||
+			unicode.IsDigit(r) ||
+			unicode.IsNumber(r) ||
+			unicode.IsGraphic(r) ||
+			unicode.IsPunct(r))
+}
diff --git a/vendor/github.com/containerd/containerd/images/annotations.go b/vendor/github.com/containerd/containerd/images/annotations.go
new file mode 100644
index 0000000000..47d92104cd
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/images/annotations.go
@@ -0,0 +1,23 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package images
+
+const (
+	// AnnotationImageName is an annotation on a Descriptor in an index.json
+	// containing the `Name` value as used by an `Image` struct
+	AnnotationImageName = "io.containerd.image.name"
+)
diff --git a/vendor/github.com/containerd/containerd/images/diffid.go b/vendor/github.com/containerd/containerd/images/diffid.go
new file mode 100644
index 0000000000..56193cc289
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/images/diffid.go
@@ -0,0 +1,81 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package images
+
+import (
+	"context"
+	"io"
+
+	"github.com/containerd/containerd/archive/compression"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/labels"
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/sirupsen/logrus"
+)
+
+// GetDiffID gets the diff ID of the layer blob descriptor.
+func GetDiffID(ctx context.Context, cs content.Store, desc ocispec.Descriptor) (digest.Digest, error) {
+	switch desc.MediaType {
+	case
+		// If the layer is already uncompressed, we can just return its digest
+		MediaTypeDockerSchema2Layer,
+		ocispec.MediaTypeImageLayer,
+		MediaTypeDockerSchema2LayerForeign,
+		ocispec.MediaTypeImageLayerNonDistributable:
+		return desc.Digest, nil
+	}
+	info, err := cs.Info(ctx, desc.Digest)
+	if err != nil {
+		return "", err
+	}
+	v, ok := info.Labels[labels.LabelUncompressed]
+	if ok {
+		// Fast path: if the image is already unpacked, we can use the label value
+		return digest.Parse(v)
+	}
+	// if the image is not unpacked, we may not have the label
+	ra, err := cs.ReaderAt(ctx, desc)
+	if err != nil {
+		return "", err
+	}
+	defer ra.Close()
+	r := content.NewReader(ra)
+	uR, err := compression.DecompressStream(r)
+	if err != nil {
+		return "", err
+	}
+	defer uR.Close()
+	digester := digest.Canonical.Digester()
+	hashW := digester.Hash()
+	if _, err := io.Copy(hashW, uR); err != nil {
+		return "", err
+	}
+	if err := ra.Close(); err != nil {
+		return "", err
+	}
+	digest := digester.Digest()
+	// memorize the computed value
+	if info.Labels == nil {
+		info.Labels = make(map[string]string)
+	}
+	info.Labels[labels.LabelUncompressed] = digest.String()
+	if _, err := cs.Update(ctx, info, "labels"); err != nil {
+		logrus.WithError(err).Warnf("failed to set %s label for %s", labels.LabelUncompressed, desc.Digest)
+	}
+	return digest, nil
+}
diff --git a/vendor/github.com/containerd/containerd/images/handlers.go b/vendor/github.com/containerd/containerd/images/handlers.go
new file mode 100644
index 0000000000..077d88e787
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/images/handlers.go
@@ -0,0 +1,322 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package images
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/platforms"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/sync/semaphore"
+)
+
+var (
+	// ErrSkipDesc is used to skip processing of a descriptor and
+	// its descendants.
+	ErrSkipDesc = errors.New("skip descriptor")
+
+	// ErrStopHandler is used to signify that the descriptor
+	// has been handled and should not be handled further.
+	// This applies only to a single descriptor in a handler
+	// chain and does not apply to descendant descriptors.
+	ErrStopHandler = errors.New("stop handler")
+
+	// ErrEmptyWalk is used when the WalkNotEmpty handlers return no
+	// children (e.g.: they were filtered out).
+	ErrEmptyWalk = errors.New("image might be filtered out")
+)
+
+// Handler handles image manifests
+type Handler interface {
+	Handle(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error)
+}
+
+// HandlerFunc function implementing the Handler interface
+type HandlerFunc func(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error)
+
+// Handle image manifests
+func (fn HandlerFunc) Handle(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) {
+	return fn(ctx, desc)
+}
+
+// Handlers returns a handler that will run the handlers in sequence.
+//
+// A handler may return `ErrStopHandler` to stop calling additional handlers
+func Handlers(handlers ...Handler) HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) {
+		var children []ocispec.Descriptor
+		for _, handler := range handlers {
+			ch, err := handler.Handle(ctx, desc)
+			if err != nil {
+				if errors.Is(err, ErrStopHandler) {
+					break
+				}
+				return nil, err
+			}
+
+			children = append(children, ch...)
+		}
+
+		return children, nil
+	}
+}
+
+// Walk the resources of an image and call the handler for each. If the handler
+// decodes the sub-resources for each image,
+//
+// This differs from dispatch in that each sibling resource is considered
+// synchronously.
+func Walk(ctx context.Context, handler Handler, descs ...ocispec.Descriptor) error {
+	for _, desc := range descs {
+
+		children, err := handler.Handle(ctx, desc)
+		if err != nil {
+			if errors.Is(err, ErrSkipDesc) {
+				continue // don't traverse the children.
+			}
+			return err
+		}
+
+		if len(children) > 0 {
+			if err := Walk(ctx, handler, children...); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// WalkNotEmpty works the same way Walk does, with the exception that it ensures that
+// some children are still found by Walking the descriptors (for example, not all of
+// them have been filtered out by one of the handlers). If there are no children,
+// then an ErrEmptyWalk error is returned.
+func WalkNotEmpty(ctx context.Context, handler Handler, descs ...ocispec.Descriptor) error {
+	isEmpty := true
+	var notEmptyHandler HandlerFunc = func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		children, err := handler.Handle(ctx, desc)
+		if err != nil {
+			return children, err
+		}
+
+		if len(children) > 0 {
+			isEmpty = false
+		}
+
+		return children, nil
+	}
+
+	err := Walk(ctx, notEmptyHandler, descs...)
+	if err != nil {
+		return err
+	}
+
+	if isEmpty {
+		return ErrEmptyWalk
+	}
+
+	return nil
+}
+
+// Dispatch runs the provided handler for content specified by the descriptors.
+// If the handler decode subresources, they will be visited, as well.
+//
+// Handlers for siblings are run in parallel on the provided descriptors. A
+// handler may return `ErrSkipDesc` to signal to the dispatcher to not traverse
+// any children.
+//
+// A concurrency limiter can be passed in to limit the number of concurrent
+// handlers running. When limiter is nil, there is no limit.
+//
+// Typically, this function will be used with `FetchHandler`, often composed
+// with other handlers.
+//
+// If any handler returns an error, the dispatch session will be canceled.
+func Dispatch(ctx context.Context, handler Handler, limiter *semaphore.Weighted, descs ...ocispec.Descriptor) error {
+	eg, ctx2 := errgroup.WithContext(ctx)
+	for _, desc := range descs {
+		desc := desc
+
+		if limiter != nil {
+			if err := limiter.Acquire(ctx, 1); err != nil {
+				return err
+			}
+		}
+
+		eg.Go(func() error {
+			desc := desc
+
+			children, err := handler.Handle(ctx2, desc)
+			if limiter != nil {
+				limiter.Release(1)
+			}
+			if err != nil {
+				if errors.Is(err, ErrSkipDesc) {
+					return nil // don't traverse the children.
+				}
+				return err
+			}
+
+			if len(children) > 0 {
+				return Dispatch(ctx2, handler, limiter, children...)
+			}
+
+			return nil
+		})
+	}
+
+	return eg.Wait()
+}
+
+// ChildrenHandler decodes well-known manifest types and returns their children.
+//
+// This is useful for supporting recursive fetch and other use cases where you
+// want to do a full walk of resources.
+//
+// One can also replace this with another implementation to allow descending of
+// arbitrary types.
+func ChildrenHandler(provider content.Provider) HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		return Children(ctx, provider, desc)
+	}
+}
+
+// SetChildrenLabels is a handler wrapper which sets labels for the content on
+// the children returned by the handler and passes through the children.
+// Must follow a handler that returns the children to be labeled.
+func SetChildrenLabels(manager content.Manager, f HandlerFunc) HandlerFunc {
+	return SetChildrenMappedLabels(manager, f, nil)
+}
+
+// SetChildrenMappedLabels is a handler wrapper which sets labels for the content on
+// the children returned by the handler and passes through the children.
+// Must follow a handler that returns the children to be labeled.
+// The label map allows the caller to control the labels per child descriptor.
+// For returned labels, the index of the child will be appended to the end
+// except for the first index when the returned label does not end with '.'.
+func SetChildrenMappedLabels(manager content.Manager, f HandlerFunc, labelMap func(ocispec.Descriptor) []string) HandlerFunc {
+	if labelMap == nil {
+		labelMap = ChildGCLabels
+	}
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		children, err := f(ctx, desc)
+		if err != nil {
+			return children, err
+		}
+
+		if len(children) > 0 {
+			var (
+				info = content.Info{
+					Digest: desc.Digest,
+					Labels: map[string]string{},
+				}
+				fields = []string{}
+				keys   = map[string]uint{}
+			)
+			for _, ch := range children {
+				labelKeys := labelMap(ch)
+				for _, key := range labelKeys {
+					idx := keys[key]
+					keys[key] = idx + 1
+					if idx > 0 || key[len(key)-1] == '.' {
+						key = fmt.Sprintf("%s%d", key, idx)
+					}
+
+					info.Labels[key] = ch.Digest.String()
+					fields = append(fields, "labels."+key)
+				}
+			}
+
+			_, err := manager.Update(ctx, info, fields...)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		return children, err
+	}
+}
+
+// FilterPlatforms is a handler wrapper which limits the descriptors returned
+// based on matching the specified platform matcher.
+func FilterPlatforms(f HandlerFunc, m platforms.Matcher) HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		children, err := f(ctx, desc)
+		if err != nil {
+			return children, err
+		}
+
+		var descs []ocispec.Descriptor
+
+		if m == nil {
+			descs = children
+		} else {
+			for _, d := range children {
+				if d.Platform == nil || m.Match(*d.Platform) {
+					descs = append(descs, d)
+				}
+			}
+		}
+
+		return descs, nil
+	}
+}
+
+// LimitManifests is a handler wrapper which filters the manifest descriptors
+// returned using the provided platform.
+// The results will be ordered according to the comparison operator and
+// use the ordering in the manifests for equal matches.
+// A limit of 0 or less is considered no limit.
+// A not found error is returned if no manifest is matched.
+func LimitManifests(f HandlerFunc, m platforms.MatchComparer, n int) HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		children, err := f(ctx, desc)
+		if err != nil {
+			return children, err
+		}
+
+		switch desc.MediaType {
+		case ocispec.MediaTypeImageIndex, MediaTypeDockerSchema2ManifestList:
+			sort.SliceStable(children, func(i, j int) bool {
+				if children[i].Platform == nil {
+					return false
+				}
+				if children[j].Platform == nil {
+					return true
+				}
+				return m.Less(*children[i].Platform, *children[j].Platform)
+			})
+
+			if n > 0 {
+				if len(children) == 0 {
+					return children, fmt.Errorf("no match for platform in manifest: %w", errdefs.ErrNotFound)
+				}
+				if len(children) > n {
+					children = children[:n]
+				}
+			}
+		default:
+			// only limit manifests from an index
+		}
+		return children, nil
+	}
+}
diff --git a/vendor/github.com/containerd/containerd/images/image.go b/vendor/github.com/containerd/containerd/images/image.go
new file mode 100644
index 0000000000..d45afe482c
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/images/image.go
@@ -0,0 +1,440 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package images
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/platforms"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// Image provides the model for how containerd views container images.
+type Image struct {
+	// Name of the image.
+	//
+	// To be pulled, it must be a reference compatible with resolvers.
+	//
+	// This field is required.
+	Name string
+
+	// Labels provide runtime decoration for the image record.
+	//
+	// There is no default behavior for how these labels are propagated. They
+	// only decorate the static metadata object.
+	//
+	// This field is optional.
+	Labels map[string]string
+
+	// Target describes the root content for this image. Typically, this is
+	// a manifest, index or manifest list.
+	Target ocispec.Descriptor
+
+	CreatedAt, UpdatedAt time.Time
+}
+
+// DeleteOptions provide options on image delete
+type DeleteOptions struct {
+	Synchronous bool
+}
+
+// DeleteOpt allows configuring a delete operation
+type DeleteOpt func(context.Context, *DeleteOptions) error
+
+// SynchronousDelete is used to indicate that an image deletion and removal of
+// the image resources should occur synchronously before returning a result.
+func SynchronousDelete() DeleteOpt {
+	return func(ctx context.Context, o *DeleteOptions) error {
+		o.Synchronous = true
+		return nil
+	}
+}
+
+// Store and interact with images
+type Store interface {
+	Get(ctx context.Context, name string) (Image, error)
+	List(ctx context.Context, filters ...string) ([]Image, error)
+	Create(ctx context.Context, image Image) (Image, error)
+
+	// Update will replace the data in the store with the provided image. If
+	// one or more fieldpaths are provided, only those fields will be updated.
+	Update(ctx context.Context, image Image, fieldpaths ...string) (Image, error)
+
+	Delete(ctx context.Context, name string, opts ...DeleteOpt) error
+}
+
+// TODO(stevvooe): Many of these functions make strong platform assumptions,
+// which are untrue in a lot of cases. More refactoring must be done here to
+// make this work in all cases.
+
+// Config resolves the image configuration descriptor.
+//
+// The caller can then use the descriptor to resolve and process the
+// configuration of the image.
+func (image *Image) Config(ctx context.Context, provider content.Provider, platform platforms.MatchComparer) (ocispec.Descriptor, error) {
+	return Config(ctx, provider, image.Target, platform)
+}
+
+// RootFS returns the unpacked diffids that make up and images rootfs.
+//
+// These are used to verify that a set of layers unpacked to the expected
+// values.
+func (image *Image) RootFS(ctx context.Context, provider content.Provider, platform platforms.MatchComparer) ([]digest.Digest, error) {
+	desc, err := image.Config(ctx, provider, platform)
+	if err != nil {
+		return nil, err
+	}
+	return RootFS(ctx, provider, desc)
+}
+
+// Size returns the total size of an image's packed resources.
+func (image *Image) Size(ctx context.Context, provider content.Provider, platform platforms.MatchComparer) (int64, error) {
+	var size int64
+	return size, Walk(ctx, Handlers(HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		if desc.Size < 0 {
+			return nil, fmt.Errorf("invalid size %v in %v (%v)", desc.Size, desc.Digest, desc.MediaType)
+		}
+		size += desc.Size
+		return nil, nil
+	}), LimitManifests(FilterPlatforms(ChildrenHandler(provider), platform), platform, 1)), image.Target)
+}
+
+type platformManifest struct {
+	p *ocispec.Platform
+	m *ocispec.Manifest
+}
+
+// Manifest resolves a manifest from the image for the given platform.
+//
+// When a manifest descriptor inside of a manifest index does not have
+// a platform defined, the platform from the image config is considered.
+//
+// If the descriptor points to a non-index manifest, then the manifest is
+// unmarshalled and returned without considering the platform inside of the
+// config.
+//
+// TODO(stevvooe): This violates the current platform agnostic approach to this
+// package by returning a specific manifest type. We'll need to refactor this
+// to return a manifest descriptor or decide that we want to bring the API in
+// this direction because this abstraction is not needed.`
+func Manifest(ctx context.Context, provider content.Provider, image ocispec.Descriptor, platform platforms.MatchComparer) (ocispec.Manifest, error) {
+	var (
+		limit    = 1
+		m        []platformManifest
+		wasIndex bool
+	)
+
+	if err := Walk(ctx, HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		switch desc.MediaType {
+		case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest:
+			p, err := content.ReadBlob(ctx, provider, desc)
+			if err != nil {
+				return nil, err
+			}
+
+			if err := validateMediaType(p, desc.MediaType); err != nil {
+				return nil, fmt.Errorf("manifest: invalid desc %s: %w", desc.Digest, err)
+			}
+
+			var manifest ocispec.Manifest
+			if err := json.Unmarshal(p, &manifest); err != nil {
+				return nil, err
+			}
+
+			if desc.Digest != image.Digest && platform != nil {
+				if desc.Platform != nil && !platform.Match(*desc.Platform) {
+					return nil, nil
+				}
+
+				if desc.Platform == nil {
+					p, err := content.ReadBlob(ctx, provider, manifest.Config)
+					if err != nil {
+						return nil, err
+					}
+
+					var image ocispec.Image
+					if err := json.Unmarshal(p, &image); err != nil {
+						return nil, err
+					}
+
+					if !platform.Match(platforms.Normalize(ocispec.Platform{OS: image.OS, Architecture: image.Architecture})) {
+						return nil, nil
+					}
+
+				}
+			}
+
+			m = append(m, platformManifest{
+				p: desc.Platform,
+				m: &manifest,
+			})
+
+			return nil, nil
+		case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex:
+			p, err := content.ReadBlob(ctx, provider, desc)
+			if err != nil {
+				return nil, err
+			}
+
+			if err := validateMediaType(p, desc.MediaType); err != nil {
+				return nil, fmt.Errorf("manifest: invalid desc %s: %w", desc.Digest, err)
+			}
+
+			var idx ocispec.Index
+			if err := json.Unmarshal(p, &idx); err != nil {
+				return nil, err
+			}
+
+			if platform == nil {
+				return idx.Manifests, nil
+			}
+
+			var descs []ocispec.Descriptor
+			for _, d := range idx.Manifests {
+				if d.Platform == nil || platform.Match(*d.Platform) {
+					descs = append(descs, d)
+				}
+			}
+
+			sort.SliceStable(descs, func(i, j int) bool {
+				if descs[i].Platform == nil {
+					return false
+				}
+				if descs[j].Platform == nil {
+					return true
+				}
+				return platform.Less(*descs[i].Platform, *descs[j].Platform)
+			})
+
+			wasIndex = true
+
+			if len(descs) > limit {
+				return descs[:limit], nil
+			}
+			return descs, nil
+		}
+		return nil, fmt.Errorf("unexpected media type %v for %v: %w", desc.MediaType, desc.Digest, errdefs.ErrNotFound)
+	}), image); err != nil {
+		return ocispec.Manifest{}, err
+	}
+
+	if len(m) == 0 {
+		err := fmt.Errorf("manifest %v: %w", image.Digest, errdefs.ErrNotFound)
+		if wasIndex {
+			err = fmt.Errorf("no match for platform in manifest %v: %w", image.Digest, errdefs.ErrNotFound)
+		}
+		return ocispec.Manifest{}, err
+	}
+	return *m[0].m, nil
+}
+
+// Config resolves the image configuration descriptor using a content provided
+// to resolve child resources on the image.
+//
+// The caller can then use the descriptor to resolve and process the
+// configuration of the image.
+func Config(ctx context.Context, provider content.Provider, image ocispec.Descriptor, platform platforms.MatchComparer) (ocispec.Descriptor, error) {
+	manifest, err := Manifest(ctx, provider, image, platform)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	return manifest.Config, err
+}
+
+// Platforms returns one or more platforms supported by the image.
+func Platforms(ctx context.Context, provider content.Provider, image ocispec.Descriptor) ([]ocispec.Platform, error) {
+	var platformSpecs []ocispec.Platform
+	return platformSpecs, Walk(ctx, Handlers(HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		if desc.Platform != nil {
+			platformSpecs = append(platformSpecs, *desc.Platform)
+			return nil, ErrSkipDesc
+		}
+
+		switch desc.MediaType {
+		case MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig:
+			p, err := content.ReadBlob(ctx, provider, desc)
+			if err != nil {
+				return nil, err
+			}
+
+			var image ocispec.Image
+			if err := json.Unmarshal(p, &image); err != nil {
+				return nil, err
+			}
+
+			platformSpecs = append(platformSpecs,
+				platforms.Normalize(ocispec.Platform{OS: image.OS, Architecture: image.Architecture}))
+		}
+		return nil, nil
+	}), ChildrenHandler(provider)), image)
+}
+
+// Check returns nil if the all components of an image are available in the
+// provider for the specified platform.
+//
+// If available is true, the caller can assume that required represents the
+// complete set of content required for the image.
+//
+// missing will have the components that are part of required but not available
+// in the provider.
+//
+// If there is a problem resolving content, an error will be returned.
+func Check(ctx context.Context, provider content.Provider, image ocispec.Descriptor, platform platforms.MatchComparer) (available bool, required, present, missing []ocispec.Descriptor, err error) {
+	mfst, err := Manifest(ctx, provider, image, platform)
+	if err != nil {
+		if errdefs.IsNotFound(err) {
+			return false, []ocispec.Descriptor{image}, nil, []ocispec.Descriptor{image}, nil
+		}
+
+		return false, nil, nil, nil, fmt.Errorf("failed to check image %v: %w", image.Digest, err)
+	}
+
+	// TODO(stevvooe): It is possible that referenced conponents could have
+	// children, but this is rare. For now, we ignore this and only verify
+	// that manifest components are present.
+	required = append([]ocispec.Descriptor{mfst.Config}, mfst.Layers...)
+
+	for _, desc := range required {
+		ra, err := provider.ReaderAt(ctx, desc)
+		if err != nil {
+			if errdefs.IsNotFound(err) {
+				missing = append(missing, desc)
+				continue
+			} else {
+				return false, nil, nil, nil, fmt.Errorf("failed to check image %v: %w", desc.Digest, err)
+			}
+		}
+		ra.Close()
+		present = append(present, desc)
+
+	}
+
+	return true, required, present, missing, nil
+}
+
+// Children returns the immediate children of content described by the descriptor.
+func Children(ctx context.Context, provider content.Provider, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+	var descs []ocispec.Descriptor
+	switch desc.MediaType {
+	case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest:
+		p, err := content.ReadBlob(ctx, provider, desc)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := validateMediaType(p, desc.MediaType); err != nil {
+			return nil, fmt.Errorf("children: invalid desc %s: %w", desc.Digest, err)
+		}
+
+		// TODO(stevvooe): We just assume oci manifest, for now. There may be
+		// subtle differences from the docker version.
+		var manifest ocispec.Manifest
+		if err := json.Unmarshal(p, &manifest); err != nil {
+			return nil, err
+		}
+
+		descs = append(descs, manifest.Config)
+		descs = append(descs, manifest.Layers...)
+	case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex:
+		p, err := content.ReadBlob(ctx, provider, desc)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := validateMediaType(p, desc.MediaType); err != nil {
+			return nil, fmt.Errorf("children: invalid desc %s: %w", desc.Digest, err)
+		}
+
+		var index ocispec.Index
+		if err := json.Unmarshal(p, &index); err != nil {
+			return nil, err
+		}
+
+		descs = append(descs, index.Manifests...)
+	default:
+		if IsLayerType(desc.MediaType) || IsKnownConfig(desc.MediaType) {
+			// childless data types.
+			return nil, nil
+		}
+		log.G(ctx).Debugf("encountered unknown type %v; children may not be fetched", desc.MediaType)
+	}
+
+	return descs, nil
+}
+
+// unknownDocument represents a manifest, manifest list, or index that has not
+// yet been validated.
+type unknownDocument struct {
+	MediaType string          `json:"mediaType,omitempty"`
+	Config    json.RawMessage `json:"config,omitempty"`
+	Layers    json.RawMessage `json:"layers,omitempty"`
+	Manifests json.RawMessage `json:"manifests,omitempty"`
+	FSLayers  json.RawMessage `json:"fsLayers,omitempty"` // schema 1
+}
+
+// validateMediaType returns an error if the byte slice is invalid JSON or if
+// the media type identifies the blob as one format but it contains elements of
+// another format.
+func validateMediaType(b []byte, mt string) error {
+	var doc unknownDocument
+	if err := json.Unmarshal(b, &doc); err != nil {
+		return err
+	}
+	if len(doc.FSLayers) != 0 {
+		return fmt.Errorf("media-type: schema 1 not supported")
+	}
+	switch mt {
+	case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest:
+		if len(doc.Manifests) != 0 ||
+			doc.MediaType == MediaTypeDockerSchema2ManifestList ||
+			doc.MediaType == ocispec.MediaTypeImageIndex {
+			return fmt.Errorf("media-type: expected manifest but found index (%s)", mt)
+		}
+	case MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex:
+		if len(doc.Config) != 0 || len(doc.Layers) != 0 ||
+			doc.MediaType == MediaTypeDockerSchema2Manifest ||
+			doc.MediaType == ocispec.MediaTypeImageManifest {
+			return fmt.Errorf("media-type: expected index but found manifest (%s)", mt)
+		}
+	}
+	return nil
+}
+
+// RootFS returns the unpacked diffids that make up and images rootfs.
+//
+// These are used to verify that a set of layers unpacked to the expected
+// values.
+func RootFS(ctx context.Context, provider content.Provider, configDesc ocispec.Descriptor) ([]digest.Digest, error) {
+	p, err := content.ReadBlob(ctx, provider, configDesc)
+	if err != nil {
+		return nil, err
+	}
+
+	var config ocispec.Image
+	if err := json.Unmarshal(p, &config); err != nil {
+		return nil, err
+	}
+	return config.RootFS.DiffIDs, nil
+}
diff --git a/vendor/github.com/containerd/containerd/images/importexport.go b/vendor/github.com/containerd/containerd/images/importexport.go
new file mode 100644
index 0000000000..843adcadc7
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/images/importexport.go
@@ -0,0 +1,37 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package images
+
+import (
+	"context"
+	"io"
+
+	"github.com/containerd/containerd/content"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// Importer is the interface for image importer.
+type Importer interface {
+	// Import imports an image from a tar stream.
+	Import(ctx context.Context, store content.Store, reader io.Reader) (ocispec.Descriptor, error)
+}
+
+// Exporter is the interface for image exporter.
+type Exporter interface {
+	// Export exports an image to a tar stream.
+	Export(ctx context.Context, store content.Provider, desc ocispec.Descriptor, writer io.Writer) error
+}
diff --git a/vendor/github.com/containerd/containerd/images/mediatypes.go b/vendor/github.com/containerd/containerd/images/mediatypes.go
new file mode 100644
index 0000000000..671e160e15
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/images/mediatypes.go
@@ -0,0 +1,204 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package images
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/containerd/containerd/errdefs"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// mediatype definitions for image components handled in containerd.
+//
+// oci components are generally referenced directly, although we may centralize
+// here for clarity.
+const (
+	MediaTypeDockerSchema2Layer            = "application/vnd.docker.image.rootfs.diff.tar"
+	MediaTypeDockerSchema2LayerForeign     = "application/vnd.docker.image.rootfs.foreign.diff.tar"
+	MediaTypeDockerSchema2LayerGzip        = "application/vnd.docker.image.rootfs.diff.tar.gzip"
+	MediaTypeDockerSchema2LayerForeignGzip = "application/vnd.docker.image.rootfs.foreign.diff.tar.gzip"
+	MediaTypeDockerSchema2Config           = "application/vnd.docker.container.image.v1+json"
+	MediaTypeDockerSchema2Manifest         = "application/vnd.docker.distribution.manifest.v2+json"
+	MediaTypeDockerSchema2ManifestList     = "application/vnd.docker.distribution.manifest.list.v2+json"
+	// Checkpoint/Restore Media Types
+	MediaTypeContainerd1Checkpoint               = "application/vnd.containerd.container.criu.checkpoint.criu.tar"
+	MediaTypeContainerd1CheckpointPreDump        = "application/vnd.containerd.container.criu.checkpoint.predump.tar"
+	MediaTypeContainerd1Resource                 = "application/vnd.containerd.container.resource.tar"
+	MediaTypeContainerd1RW                       = "application/vnd.containerd.container.rw.tar"
+	MediaTypeContainerd1CheckpointConfig         = "application/vnd.containerd.container.checkpoint.config.v1+proto"
+	MediaTypeContainerd1CheckpointOptions        = "application/vnd.containerd.container.checkpoint.options.v1+proto"
+	MediaTypeContainerd1CheckpointRuntimeName    = "application/vnd.containerd.container.checkpoint.runtime.name"
+	MediaTypeContainerd1CheckpointRuntimeOptions = "application/vnd.containerd.container.checkpoint.runtime.options+proto"
+	// Legacy Docker schema1 manifest
+	MediaTypeDockerSchema1Manifest = "application/vnd.docker.distribution.manifest.v1+prettyjws"
+	// Encypted media types
+	MediaTypeImageLayerEncrypted     = ocispec.MediaTypeImageLayer + "+encrypted"
+	MediaTypeImageLayerGzipEncrypted = ocispec.MediaTypeImageLayerGzip + "+encrypted"
+)
+
+// DiffCompression returns the compression as defined by the layer diff media
+// type. For Docker media types without compression, "unknown" is returned to
+// indicate that the media type may be compressed. If the media type is not
+// recognized as a layer diff, then it returns errdefs.ErrNotImplemented
+func DiffCompression(ctx context.Context, mediaType string) (string, error) {
+	base, ext := parseMediaTypes(mediaType)
+	switch base {
+	case MediaTypeDockerSchema2Layer, MediaTypeDockerSchema2LayerForeign:
+		if len(ext) > 0 {
+			// Type is wrapped
+			return "", nil
+		}
+		// These media types may have been compressed but failed to
+		// use the correct media type. The decompression function
+		// should detect and handle this case.
+		return "unknown", nil
+	case MediaTypeDockerSchema2LayerGzip, MediaTypeDockerSchema2LayerForeignGzip:
+		if len(ext) > 0 {
+			// Type is wrapped
+			return "", nil
+		}
+		return "gzip", nil
+	case ocispec.MediaTypeImageLayer, ocispec.MediaTypeImageLayerNonDistributable:
+		if len(ext) > 0 {
+			switch ext[len(ext)-1] {
+			case "gzip":
+				return "gzip", nil
+			case "zstd":
+				return "zstd", nil
+			}
+		}
+		return "", nil
+	default:
+		return "", fmt.Errorf("unrecognised mediatype %s: %w", mediaType, errdefs.ErrNotImplemented)
+	}
+}
+
+// parseMediaTypes splits the media type into the base type and
+// an array of sorted extensions
+func parseMediaTypes(mt string) (string, []string) {
+	if mt == "" {
+		return "", []string{}
+	}
+
+	s := strings.Split(mt, "+")
+	ext := s[1:]
+	sort.Strings(ext)
+
+	return s[0], ext
+}
+
+// IsNonDistributable returns true if the media type is non-distributable.
+func IsNonDistributable(mt string) bool {
+	return strings.HasPrefix(mt, "application/vnd.oci.image.layer.nondistributable.") ||
+		strings.HasPrefix(mt, "application/vnd.docker.image.rootfs.foreign.")
+}
+
+// IsLayerType returns true if the media type is a layer
+func IsLayerType(mt string) bool {
+	if strings.HasPrefix(mt, "application/vnd.oci.image.layer.") {
+		return true
+	}
+
+	// Parse Docker media types, strip off any + suffixes first
+	base, _ := parseMediaTypes(mt)
+	switch base {
+	case MediaTypeDockerSchema2Layer, MediaTypeDockerSchema2LayerGzip,
+		MediaTypeDockerSchema2LayerForeign, MediaTypeDockerSchema2LayerForeignGzip:
+		return true
+	}
+	return false
+}
+
+// IsDockerType returns true if the media type has "application/vnd.docker." prefix
+func IsDockerType(mt string) bool {
+	return strings.HasPrefix(mt, "application/vnd.docker.")
+}
+
+// IsManifestType returns true if the media type is an OCI-compatible manifest.
+// No support for schema1 manifest.
+func IsManifestType(mt string) bool {
+	switch mt {
+	case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsIndexType returns true if the media type is an OCI-compatible index.
+func IsIndexType(mt string) bool {
+	switch mt {
+	case ocispec.MediaTypeImageIndex, MediaTypeDockerSchema2ManifestList:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsConfigType returns true if the media type is an OCI-compatible image config.
+// No support for containerd checkpoint configs.
+func IsConfigType(mt string) bool {
+	switch mt {
+	case MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsKnownConfig returns true if the media type is a known config type,
+// including containerd checkpoint configs
+func IsKnownConfig(mt string) bool {
+	switch mt {
+	case MediaTypeDockerSchema2Config, ocispec.MediaTypeImageConfig,
+		MediaTypeContainerd1Checkpoint, MediaTypeContainerd1CheckpointConfig:
+		return true
+	}
+	return false
+}
+
+// ChildGCLabels returns the label for a given descriptor to reference it
+func ChildGCLabels(desc ocispec.Descriptor) []string {
+	mt := desc.MediaType
+	if IsKnownConfig(mt) {
+		return []string{"containerd.io/gc.ref.content.config"}
+	}
+
+	switch mt {
+	case MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest:
+		return []string{"containerd.io/gc.ref.content.m."}
+	}
+
+	if IsLayerType(mt) {
+		return []string{"containerd.io/gc.ref.content.l."}
+	}
+
+	return []string{"containerd.io/gc.ref.content."}
+}
+
+// ChildGCLabelsFilterLayers returns the labels for a given descriptor to
+// reference it, skipping layer media types
+func ChildGCLabelsFilterLayers(desc ocispec.Descriptor) []string {
+	if IsLayerType(desc.MediaType) {
+		return nil
+	}
+	return ChildGCLabels(desc)
+}
diff --git a/vendor/github.com/containerd/containerd/labels/labels.go b/vendor/github.com/containerd/containerd/labels/labels.go
new file mode 100644
index 0000000000..d76ff2cf9c
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/labels/labels.go
@@ -0,0 +1,21 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package labels
+
+// LabelUncompressed is added to compressed layer contents.
+// The value is digest of the uncompressed content.
+const LabelUncompressed = "containerd.io/uncompressed"
diff --git a/vendor/github.com/containerd/containerd/labels/validate.go b/vendor/github.com/containerd/containerd/labels/validate.go
new file mode 100644
index 0000000000..1fd527adb3
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/labels/validate.go
@@ -0,0 +1,38 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package labels
+
+import (
+	"fmt"
+
+	"github.com/containerd/containerd/errdefs"
+)
+
+const (
+	maxSize = 4096
+)
+
+// Validate a label's key and value are under 4096 bytes
+func Validate(k, v string) error {
+	if (len(k) + len(v)) > maxSize {
+		if len(k) > 10 {
+			k = k[:10]
+		}
+		return fmt.Errorf("label key and value greater than maximum size (%d bytes), key: %s: %w", maxSize, k, errdefs.ErrInvalidArgument)
+	}
+	return nil
+}
diff --git a/vendor/github.com/containerd/containerd/log/context.go b/vendor/github.com/containerd/containerd/log/context.go
new file mode 100644
index 0000000000..0db9562b82
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/log/context.go
@@ -0,0 +1,69 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package log
+
+import (
+	"context"
+
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	// G is an alias for GetLogger.
+	//
+	// We may want to define this locally to a package to get package tagged log
+	// messages.
+	G = GetLogger
+
+	// L is an alias for the standard logger.
+	L = logrus.NewEntry(logrus.StandardLogger())
+)
+
+type (
+	loggerKey struct{}
+)
+
+const (
+	// RFC3339NanoFixed is time.RFC3339Nano with nanoseconds padded using zeros to
+	// ensure the formatted time is always the same number of characters.
+	RFC3339NanoFixed = "2006-01-02T15:04:05.000000000Z07:00"
+
+	// TextFormat represents the text logging format
+	TextFormat = "text"
+
+	// JSONFormat represents the JSON logging format
+	JSONFormat = "json"
+)
+
+// WithLogger returns a new context with the provided logger. Use in
+// combination with logger.WithField(s) for great effect.
+func WithLogger(ctx context.Context, logger *logrus.Entry) context.Context {
+	e := logger.WithContext(ctx)
+	return context.WithValue(ctx, loggerKey{}, e)
+}
+
+// GetLogger retrieves the current logger from the context. If no logger is
+// available, the default logger is returned.
+func GetLogger(ctx context.Context) *logrus.Entry {
+	logger := ctx.Value(loggerKey{})
+
+	if logger == nil {
+		return L.WithContext(ctx)
+	}
+
+	return logger.(*logrus.Entry)
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/compare.go b/vendor/github.com/containerd/containerd/platforms/compare.go
new file mode 100644
index 0000000000..3913ef6637
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/compare.go
@@ -0,0 +1,203 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"strconv"
+	"strings"
+
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// MatchComparer is able to match and compare platforms to
+// filter and sort platforms.
+type MatchComparer interface {
+	Matcher
+
+	Less(specs.Platform, specs.Platform) bool
+}
+
+// platformVector returns an (ordered) vector of appropriate specs.Platform
+// objects to try matching for the given platform object (see platforms.Only).
+func platformVector(platform specs.Platform) []specs.Platform {
+	vector := []specs.Platform{platform}
+
+	switch platform.Architecture {
+	case "amd64":
+		if amd64Version, err := strconv.Atoi(strings.TrimPrefix(platform.Variant, "v")); err == nil && amd64Version > 1 {
+			for amd64Version--; amd64Version >= 1; amd64Version-- {
+				vector = append(vector, specs.Platform{
+					Architecture: platform.Architecture,
+					OS:           platform.OS,
+					OSVersion:    platform.OSVersion,
+					OSFeatures:   platform.OSFeatures,
+					Variant:      "v" + strconv.Itoa(amd64Version),
+				})
+			}
+		}
+		vector = append(vector, specs.Platform{
+			Architecture: "386",
+			OS:           platform.OS,
+			OSVersion:    platform.OSVersion,
+			OSFeatures:   platform.OSFeatures,
+		})
+	case "arm":
+		if armVersion, err := strconv.Atoi(strings.TrimPrefix(platform.Variant, "v")); err == nil && armVersion > 5 {
+			for armVersion--; armVersion >= 5; armVersion-- {
+				vector = append(vector, specs.Platform{
+					Architecture: platform.Architecture,
+					OS:           platform.OS,
+					OSVersion:    platform.OSVersion,
+					OSFeatures:   platform.OSFeatures,
+					Variant:      "v" + strconv.Itoa(armVersion),
+				})
+			}
+		}
+	case "arm64":
+		variant := platform.Variant
+		if variant == "" {
+			variant = "v8"
+		}
+		vector = append(vector, platformVector(specs.Platform{
+			Architecture: "arm",
+			OS:           platform.OS,
+			OSVersion:    platform.OSVersion,
+			OSFeatures:   platform.OSFeatures,
+			Variant:      variant,
+		})...)
+	}
+
+	return vector
+}
+
+// Only returns a match comparer for a single platform
+// using default resolution logic for the platform.
+//
+// For arm/v8, will also match arm/v7, arm/v6 and arm/v5
+// For arm/v7, will also match arm/v6 and arm/v5
+// For arm/v6, will also match arm/v5
+// For amd64, will also match 386
+func Only(platform specs.Platform) MatchComparer {
+	return Ordered(platformVector(Normalize(platform))...)
+}
+
+// OnlyStrict returns a match comparer for a single platform.
+//
+// Unlike Only, OnlyStrict does not match sub platforms.
+// So, "arm/vN" will not match "arm/vM" where M < N,
+// and "amd64" will not also match "386".
+//
+// OnlyStrict matches non-canonical forms.
+// So, "arm64" matches "arm/64/v8".
+func OnlyStrict(platform specs.Platform) MatchComparer {
+	return Ordered(Normalize(platform))
+}
+
+// Ordered returns a platform MatchComparer which matches any of the platforms
+// but orders them in order they are provided.
+func Ordered(platforms ...specs.Platform) MatchComparer {
+	matchers := make([]Matcher, len(platforms))
+	for i := range platforms {
+		matchers[i] = NewMatcher(platforms[i])
+	}
+	return orderedPlatformComparer{
+		matchers: matchers,
+	}
+}
+
+// Any returns a platform MatchComparer which matches any of the platforms
+// with no preference for ordering.
+func Any(platforms ...specs.Platform) MatchComparer {
+	matchers := make([]Matcher, len(platforms))
+	for i := range platforms {
+		matchers[i] = NewMatcher(platforms[i])
+	}
+	return anyPlatformComparer{
+		matchers: matchers,
+	}
+}
+
+// All is a platform MatchComparer which matches all platforms
+// with preference for ordering.
+var All MatchComparer = allPlatformComparer{}
+
+type orderedPlatformComparer struct {
+	matchers []Matcher
+}
+
+func (c orderedPlatformComparer) Match(platform specs.Platform) bool {
+	for _, m := range c.matchers {
+		if m.Match(platform) {
+			return true
+		}
+	}
+	return false
+}
+
+func (c orderedPlatformComparer) Less(p1 specs.Platform, p2 specs.Platform) bool {
+	for _, m := range c.matchers {
+		p1m := m.Match(p1)
+		p2m := m.Match(p2)
+		if p1m && !p2m {
+			return true
+		}
+		if p1m || p2m {
+			return false
+		}
+	}
+	return false
+}
+
+type anyPlatformComparer struct {
+	matchers []Matcher
+}
+
+func (c anyPlatformComparer) Match(platform specs.Platform) bool {
+	for _, m := range c.matchers {
+		if m.Match(platform) {
+			return true
+		}
+	}
+	return false
+}
+
+func (c anyPlatformComparer) Less(p1, p2 specs.Platform) bool {
+	var p1m, p2m bool
+	for _, m := range c.matchers {
+		if !p1m && m.Match(p1) {
+			p1m = true
+		}
+		if !p2m && m.Match(p2) {
+			p2m = true
+		}
+		if p1m && p2m {
+			return false
+		}
+	}
+	// If one matches, and the other does, sort match first
+	return p1m && !p2m
+}
+
+type allPlatformComparer struct{}
+
+func (allPlatformComparer) Match(specs.Platform) bool {
+	return true
+}
+
+func (allPlatformComparer) Less(specs.Platform, specs.Platform) bool {
+	return false
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/cpuinfo.go b/vendor/github.com/containerd/containerd/platforms/cpuinfo.go
new file mode 100644
index 0000000000..046e0356d1
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/cpuinfo.go
@@ -0,0 +1,131 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+	"sync"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/log"
+)
+
+// Present the ARM instruction set architecture, eg: v7, v8
+// Don't use this value directly; call cpuVariant() instead.
+var cpuVariantValue string
+
+var cpuVariantOnce sync.Once
+
+func cpuVariant() string {
+	cpuVariantOnce.Do(func() {
+		if isArmArch(runtime.GOARCH) {
+			cpuVariantValue = getCPUVariant()
+		}
+	})
+	return cpuVariantValue
+}
+
+// For Linux, the kernel has already detected the ABI, ISA and Features.
+// So we don't need to access the ARM registers to detect platform information
+// by ourselves. We can just parse these information from /proc/cpuinfo
+func getCPUInfo(pattern string) (info string, err error) {
+	if !isLinuxOS(runtime.GOOS) {
+		return "", fmt.Errorf("getCPUInfo for OS %s: %w", runtime.GOOS, errdefs.ErrNotImplemented)
+	}
+
+	cpuinfo, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return "", err
+	}
+	defer cpuinfo.Close()
+
+	// Start to Parse the Cpuinfo line by line. For SMP SoC, we parse
+	// the first core is enough.
+	scanner := bufio.NewScanner(cpuinfo)
+	for scanner.Scan() {
+		newline := scanner.Text()
+		list := strings.Split(newline, ":")
+
+		if len(list) > 1 && strings.EqualFold(strings.TrimSpace(list[0]), pattern) {
+			return strings.TrimSpace(list[1]), nil
+		}
+	}
+
+	// Check whether the scanner encountered errors
+	err = scanner.Err()
+	if err != nil {
+		return "", err
+	}
+
+	return "", fmt.Errorf("getCPUInfo for pattern: %s: %w", pattern, errdefs.ErrNotFound)
+}
+
+func getCPUVariant() string {
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
+		// Windows/Darwin only supports v7 for ARM32 and v8 for ARM64 and so we can use
+		// runtime.GOARCH to determine the variants
+		var variant string
+		switch runtime.GOARCH {
+		case "arm64":
+			variant = "v8"
+		case "arm":
+			variant = "v7"
+		default:
+			variant = "unknown"
+		}
+
+		return variant
+	}
+
+	variant, err := getCPUInfo("Cpu architecture")
+	if err != nil {
+		log.L.WithError(err).Error("failure getting variant")
+		return ""
+	}
+
+	// handle edge case for Raspberry Pi ARMv6 devices (which due to a kernel quirk, report "CPU architecture: 7")
+	// https://www.raspberrypi.org/forums/viewtopic.php?t=12614
+	if runtime.GOARCH == "arm" && variant == "7" {
+		model, err := getCPUInfo("model name")
+		if err == nil && strings.HasPrefix(strings.ToLower(model), "armv6-compatible") {
+			variant = "6"
+		}
+	}
+
+	switch strings.ToLower(variant) {
+	case "8", "aarch64":
+		variant = "v8"
+	case "7", "7m", "?(12)", "?(13)", "?(14)", "?(15)", "?(16)", "?(17)":
+		variant = "v7"
+	case "6", "6tej":
+		variant = "v6"
+	case "5", "5t", "5te", "5tej":
+		variant = "v5"
+	case "4", "4t":
+		variant = "v4"
+	case "3":
+		variant = "v3"
+	default:
+		variant = "unknown"
+	}
+
+	return variant
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/database.go b/vendor/github.com/containerd/containerd/platforms/database.go
new file mode 100644
index 0000000000..dbe9957ca9
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/database.go
@@ -0,0 +1,116 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"runtime"
+	"strings"
+)
+
+// isLinuxOS returns true if the operating system is Linux.
+//
+// The OS value should be normalized before calling this function.
+func isLinuxOS(os string) bool {
+	return os == "linux"
+}
+
+// These function are generated from https://golang.org/src/go/build/syslist.go.
+//
+// We use switch statements because they are slightly faster than map lookups
+// and use a little less memory.
+
+// isKnownOS returns true if we know about the operating system.
+//
+// The OS value should be normalized before calling this function.
+func isKnownOS(os string) bool {
+	switch os {
+	case "aix", "android", "darwin", "dragonfly", "freebsd", "hurd", "illumos", "ios", "js", "linux", "nacl", "netbsd", "openbsd", "plan9", "solaris", "windows", "zos":
+		return true
+	}
+	return false
+}
+
+// isArmArch returns true if the architecture is ARM.
+//
+// The arch value should be normalized before being passed to this function.
+func isArmArch(arch string) bool {
+	switch arch {
+	case "arm", "arm64":
+		return true
+	}
+	return false
+}
+
+// isKnownArch returns true if we know about the architecture.
+//
+// The arch value should be normalized before being passed to this function.
+func isKnownArch(arch string) bool {
+	switch arch {
+	case "386", "amd64", "amd64p32", "arm", "armbe", "arm64", "arm64be", "ppc64", "ppc64le", "loong64", "mips", "mipsle", "mips64", "mips64le", "mips64p32", "mips64p32le", "ppc", "riscv", "riscv64", "s390", "s390x", "sparc", "sparc64", "wasm":
+		return true
+	}
+	return false
+}
+
+func normalizeOS(os string) string {
+	if os == "" {
+		return runtime.GOOS
+	}
+	os = strings.ToLower(os)
+
+	switch os {
+	case "macos":
+		os = "darwin"
+	}
+	return os
+}
+
+// normalizeArch normalizes the architecture.
+func normalizeArch(arch, variant string) (string, string) {
+	arch, variant = strings.ToLower(arch), strings.ToLower(variant)
+	switch arch {
+	case "i386":
+		arch = "386"
+		variant = ""
+	case "x86_64", "x86-64", "amd64":
+		arch = "amd64"
+		if variant == "v1" {
+			variant = ""
+		}
+	case "aarch64", "arm64":
+		arch = "arm64"
+		switch variant {
+		case "8", "v8":
+			variant = ""
+		}
+	case "armhf":
+		arch = "arm"
+		variant = "v7"
+	case "armel":
+		arch = "arm"
+		variant = "v6"
+	case "arm":
+		switch variant {
+		case "", "7":
+			variant = "v7"
+		case "5", "6", "8":
+			variant = "v" + variant
+		}
+	}
+
+	return arch, variant
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/defaults.go b/vendor/github.com/containerd/containerd/platforms/defaults.go
new file mode 100644
index 0000000000..cfa3ff34a1
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/defaults.go
@@ -0,0 +1,27 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+// DefaultString returns the default string specifier for the platform.
+func DefaultString() string {
+	return Format(DefaultSpec())
+}
+
+// DefaultStrict returns strict form of Default.
+func DefaultStrict() MatchComparer {
+	return OnlyStrict(DefaultSpec())
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/defaults_darwin.go b/vendor/github.com/containerd/containerd/platforms/defaults_darwin.go
new file mode 100644
index 0000000000..e249fe48d3
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_darwin.go
@@ -0,0 +1,45 @@
+//go:build darwin
+// +build darwin
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"runtime"
+
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// DefaultSpec returns the current platform's default platform specification.
+func DefaultSpec() specs.Platform {
+	return specs.Platform{
+		OS:           runtime.GOOS,
+		Architecture: runtime.GOARCH,
+		// The Variant field will be empty if arch != ARM.
+		Variant: cpuVariant(),
+	}
+}
+
+// Default returns the default matcher for the platform.
+func Default() MatchComparer {
+	return Ordered(DefaultSpec(), specs.Platform{
+		// darwin runtime also supports Linux binary via runu/LKL
+		OS:           "linux",
+		Architecture: runtime.GOARCH,
+	})
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/defaults_unix.go b/vendor/github.com/containerd/containerd/platforms/defaults_unix.go
new file mode 100644
index 0000000000..49690f1b3e
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_unix.go
@@ -0,0 +1,41 @@
+//go:build !windows && !darwin
+// +build !windows,!darwin
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"runtime"
+
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// DefaultSpec returns the current platform's default platform specification.
+func DefaultSpec() specs.Platform {
+	return specs.Platform{
+		OS:           runtime.GOOS,
+		Architecture: runtime.GOARCH,
+		// The Variant field will be empty if arch != ARM.
+		Variant: cpuVariant(),
+	}
+}
+
+// Default returns the default matcher for the platform.
+func Default() MatchComparer {
+	return Only(DefaultSpec())
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/defaults_windows.go b/vendor/github.com/containerd/containerd/platforms/defaults_windows.go
new file mode 100644
index 0000000000..ff9771a600
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_windows.go
@@ -0,0 +1,95 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package platforms
+
+import (
+	"fmt"
+	"runtime"
+	"strconv"
+	"strings"
+
+	imagespec "github.com/opencontainers/image-spec/specs-go/v1"
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	"golang.org/x/sys/windows"
+)
+
+// DefaultSpec returns the current platform's default platform specification.
+func DefaultSpec() specs.Platform {
+	major, minor, build := windows.RtlGetNtVersionNumbers()
+	return specs.Platform{
+		OS:           runtime.GOOS,
+		Architecture: runtime.GOARCH,
+		OSVersion:    fmt.Sprintf("%d.%d.%d", major, minor, build),
+		// The Variant field will be empty if arch != ARM.
+		Variant: cpuVariant(),
+	}
+}
+
+type matchComparer struct {
+	defaults        Matcher
+	osVersionPrefix string
+}
+
+// Match matches platform with the same windows major, minor
+// and build version.
+func (m matchComparer) Match(p specs.Platform) bool {
+	match := m.defaults.Match(p)
+
+	if match && p.OS == "windows" {
+		if strings.HasPrefix(p.OSVersion, m.osVersionPrefix) {
+			return true
+		}
+		return p.OSVersion == ""
+	}
+	return false
+}
+
+// Less sorts matched platforms in front of other platforms.
+// For matched platforms, it puts platforms with larger revision
+// number in front.
+func (m matchComparer) Less(p1, p2 imagespec.Platform) bool {
+	m1, m2 := m.Match(p1), m.Match(p2)
+	if m1 && m2 {
+		r1, r2 := revision(p1.OSVersion), revision(p2.OSVersion)
+		return r1 > r2
+	}
+	return m1 && !m2
+}
+
+func revision(v string) int {
+	parts := strings.Split(v, ".")
+	if len(parts) < 4 {
+		return 0
+	}
+	r, err := strconv.Atoi(parts[3])
+	if err != nil {
+		return 0
+	}
+	return r
+}
+
+// Default returns the current platform's default platform specification.
+func Default() MatchComparer {
+	major, minor, build := windows.RtlGetNtVersionNumbers()
+	return matchComparer{
+		defaults: Ordered(DefaultSpec(), specs.Platform{
+			OS:           "linux",
+			Architecture: runtime.GOARCH,
+		}),
+		osVersionPrefix: fmt.Sprintf("%d.%d.%d", major, minor, build),
+	}
+}
diff --git a/vendor/github.com/containerd/containerd/platforms/platforms.go b/vendor/github.com/containerd/containerd/platforms/platforms.go
new file mode 100644
index 0000000000..2343099418
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/platforms/platforms.go
@@ -0,0 +1,261 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package platforms provides a toolkit for normalizing, matching and
+// specifying container platforms.
+//
+// Centered around OCI platform specifications, we define a string-based
+// specifier syntax that can be used for user input. With a specifier, users
+// only need to specify the parts of the platform that are relevant to their
+// context, providing an operating system or architecture or both.
+//
+// How do I use this package?
+//
+// The vast majority of use cases should simply use the match function with
+// user input. The first step is to parse a specifier into a matcher:
+//
+//	m, err := Parse("linux")
+//	if err != nil { ... }
+//
+// Once you have a matcher, use it to match against the platform declared by a
+// component, typically from an image or runtime. Since extracting an images
+// platform is a little more involved, we'll use an example against the
+// platform default:
+//
+//	if ok := m.Match(Default()); !ok { /* doesn't match */ }
+//
+// This can be composed in loops for resolving runtimes or used as a filter for
+// fetch and select images.
+//
+// More details of the specifier syntax and platform spec follow.
+//
+// # Declaring Platform Support
+//
+// Components that have strict platform requirements should use the OCI
+// platform specification to declare their support. Typically, this will be
+// images and runtimes that should make these declaring which platform they
+// support specifically. This looks roughly as follows:
+//
+//	  type Platform struct {
+//		   Architecture string
+//		   OS           string
+//		   Variant      string
+//	  }
+//
+// Most images and runtimes should at least set Architecture and OS, according
+// to their GOARCH and GOOS values, respectively (follow the OCI image
+// specification when in doubt). ARM should set variant under certain
+// discussions, which are outlined below.
+//
+// # Platform Specifiers
+//
+// While the OCI platform specifications provide a tool for components to
+// specify structured information, user input typically doesn't need the full
+// context and much can be inferred. To solve this problem, we introduced
+// "specifiers". A specifier has the format
+// `<os>|<arch>|<os>/<arch>[/<variant>]`.  The user can provide either the
+// operating system or the architecture or both.
+//
+// An example of a common specifier is `linux/amd64`. If the host has a default
+// of runtime that matches this, the user can simply provide the component that
+// matters. For example, if a image provides amd64 and arm64 support, the
+// operating system, `linux` can be inferred, so they only have to provide
+// `arm64` or `amd64`. Similar behavior is implemented for operating systems,
+// where the architecture may be known but a runtime may support images from
+// different operating systems.
+//
+// # Normalization
+//
+// Because not all users are familiar with the way the Go runtime represents
+// platforms, several normalizations have been provided to make this package
+// easier to user.
+//
+// The following are performed for architectures:
+//
+//	Value    Normalized
+//	aarch64  arm64
+//	armhf    arm
+//	armel    arm/v6
+//	i386     386
+//	x86_64   amd64
+//	x86-64   amd64
+//
+// We also normalize the operating system `macos` to `darwin`.
+//
+// # ARM Support
+//
+// To qualify ARM architecture, the Variant field is used to qualify the arm
+// version. The most common arm version, v7, is represented without the variant
+// unless it is explicitly provided. This is treated as equivalent to armhf. A
+// previous architecture, armel, will be normalized to arm/v6.
+//
+// While these normalizations are provided, their support on arm platforms has
+// not yet been fully implemented and tested.
+package platforms
+
+import (
+	"fmt"
+	"path"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/containerd/containerd/errdefs"
+	specs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+var (
+	specifierRe = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
+)
+
+// Matcher matches platforms specifications, provided by an image or runtime.
+type Matcher interface {
+	Match(platform specs.Platform) bool
+}
+
+// NewMatcher returns a simple matcher based on the provided platform
+// specification. The returned matcher only looks for equality based on os,
+// architecture and variant.
+//
+// One may implement their own matcher if this doesn't provide the required
+// functionality.
+//
+// Applications should opt to use `Match` over directly parsing specifiers.
+func NewMatcher(platform specs.Platform) Matcher {
+	return &matcher{
+		Platform: Normalize(platform),
+	}
+}
+
+type matcher struct {
+	specs.Platform
+}
+
+func (m *matcher) Match(platform specs.Platform) bool {
+	normalized := Normalize(platform)
+	return m.OS == normalized.OS &&
+		m.Architecture == normalized.Architecture &&
+		m.Variant == normalized.Variant
+}
+
+func (m *matcher) String() string {
+	return Format(m.Platform)
+}
+
+// Parse parses the platform specifier syntax into a platform declaration.
+//
+// Platform specifiers are in the format `<os>|<arch>|<os>/<arch>[/<variant>]`.
+// The minimum required information for a platform specifier is the operating
+// system or architecture. If there is only a single string (no slashes), the
+// value will be matched against the known set of operating systems, then fall
+// back to the known set of architectures. The missing component will be
+// inferred based on the local environment.
+func Parse(specifier string) (specs.Platform, error) {
+	if strings.Contains(specifier, "*") {
+		// TODO(stevvooe): need to work out exact wildcard handling
+		return specs.Platform{}, fmt.Errorf("%q: wildcards not yet supported: %w", specifier, errdefs.ErrInvalidArgument)
+	}
+
+	parts := strings.Split(specifier, "/")
+
+	for _, part := range parts {
+		if !specifierRe.MatchString(part) {
+			return specs.Platform{}, fmt.Errorf("%q is an invalid component of %q: platform specifier component must match %q: %w", part, specifier, specifierRe.String(), errdefs.ErrInvalidArgument)
+		}
+	}
+
+	var p specs.Platform
+	switch len(parts) {
+	case 1:
+		// in this case, we will test that the value might be an OS, then look
+		// it up. If it is not known, we'll treat it as an architecture. Since
+		// we have very little information about the platform here, we are
+		// going to be a little more strict if we don't know about the argument
+		// value.
+		p.OS = normalizeOS(parts[0])
+		if isKnownOS(p.OS) {
+			// picks a default architecture
+			p.Architecture = runtime.GOARCH
+			if p.Architecture == "arm" && cpuVariant() != "v7" {
+				p.Variant = cpuVariant()
+			}
+
+			return p, nil
+		}
+
+		p.Architecture, p.Variant = normalizeArch(parts[0], "")
+		if p.Architecture == "arm" && p.Variant == "v7" {
+			p.Variant = ""
+		}
+		if isKnownArch(p.Architecture) {
+			p.OS = runtime.GOOS
+			return p, nil
+		}
+
+		return specs.Platform{}, fmt.Errorf("%q: unknown operating system or architecture: %w", specifier, errdefs.ErrInvalidArgument)
+	case 2:
+		// In this case, we treat as a regular os/arch pair. We don't care
+		// about whether or not we know of the platform.
+		p.OS = normalizeOS(parts[0])
+		p.Architecture, p.Variant = normalizeArch(parts[1], "")
+		if p.Architecture == "arm" && p.Variant == "v7" {
+			p.Variant = ""
+		}
+
+		return p, nil
+	case 3:
+		// we have a fully specified variant, this is rare
+		p.OS = normalizeOS(parts[0])
+		p.Architecture, p.Variant = normalizeArch(parts[1], parts[2])
+		if p.Architecture == "arm64" && p.Variant == "" {
+			p.Variant = "v8"
+		}
+
+		return p, nil
+	}
+
+	return specs.Platform{}, fmt.Errorf("%q: cannot parse platform specifier: %w", specifier, errdefs.ErrInvalidArgument)
+}
+
+// MustParse is like Parses but panics if the specifier cannot be parsed.
+// Simplifies initialization of global variables.
+func MustParse(specifier string) specs.Platform {
+	p, err := Parse(specifier)
+	if err != nil {
+		panic("platform: Parse(" + strconv.Quote(specifier) + "): " + err.Error())
+	}
+	return p
+}
+
+// Format returns a string specifier from the provided platform specification.
+func Format(platform specs.Platform) string {
+	if platform.OS == "" {
+		return "unknown"
+	}
+
+	return path.Join(platform.OS, platform.Architecture, platform.Variant)
+}
+
+// Normalize validates and translate the platform to the canonical value.
+//
+// For example, if "Aarch64" is encountered, we change it to "arm64" or if
+// "x86_64" is encountered, it becomes "amd64".
+func Normalize(platform specs.Platform) specs.Platform {
+	platform.OS = normalizeOS(platform.OS)
+	platform.Architecture, platform.Variant = normalizeArch(platform.Architecture, platform.Variant)
+	return platform
+}
diff --git a/vendor/github.com/containerd/containerd/reference/reference.go b/vendor/github.com/containerd/containerd/reference/reference.go
new file mode 100644
index 0000000000..a4bf6da601
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/reference/reference.go
@@ -0,0 +1,166 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package reference
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"path"
+	"regexp"
+	"strings"
+
+	digest "github.com/opencontainers/go-digest"
+)
+
+var (
+	// ErrInvalid is returned when there is an invalid reference
+	ErrInvalid = errors.New("invalid reference")
+	// ErrObjectRequired is returned when the object is required
+	ErrObjectRequired = errors.New("object required")
+	// ErrHostnameRequired is returned when the hostname is required
+	ErrHostnameRequired = errors.New("hostname required")
+)
+
+// Spec defines the main components of a reference specification.
+//
+// A reference specification is a schema-less URI parsed into common
+// components. The two main components, locator and object, are required to be
+// supported by remotes. It represents a superset of the naming define in
+// docker's reference schema. It aims to be compatible but not prescriptive.
+//
+// While the interpretation of the components, locator and object, are up to
+// the remote, we define a few common parts, accessible via helper methods.
+//
+// The first is the hostname, which is part of the locator. This doesn't need
+// to map to a physical resource, but it must parse as a hostname. We refer to
+// this as the namespace.
+//
+// The other component made accessible by helper method is the digest. This is
+// part of the object identifier, always prefixed with an '@'. If present, the
+// remote may use the digest portion directly or resolve it against a prefix.
+// If the object does not include the `@` symbol, the return value for `Digest`
+// will be empty.
+type Spec struct {
+	// Locator is the host and path portion of the specification. The host
+	// portion may refer to an actual host or just a namespace of related
+	// images.
+	//
+	// Typically, the locator may used to resolve the remote to fetch specific
+	// resources.
+	Locator string
+
+	// Object contains the identifier for the remote resource. Classically,
+	// this is a tag but can refer to anything in a remote. By convention, any
+	// portion that may be a partial or whole digest will be preceded by an
+	// `@`. Anything preceding the `@` will be referred to as the "tag".
+	//
+	// In practice, we will see this broken down into the following formats:
+	//
+	// 1. <tag>
+	// 2. <tag>@<digest spec>
+	// 3. @<digest spec>
+	//
+	// We define the tag to be anything except '@' and ':'. <digest spec> may
+	// be a full valid digest or shortened version, possibly with elided
+	// algorithm.
+	Object string
+}
+
+var splitRe = regexp.MustCompile(`[:@]`)
+
+// Parse parses the string into a structured ref.
+func Parse(s string) (Spec, error) {
+	if strings.Contains(s, "://") {
+		return Spec{}, ErrInvalid
+	}
+
+	u, err := url.Parse("dummy://" + s)
+	if err != nil {
+		return Spec{}, err
+	}
+
+	if u.Scheme != "dummy" {
+		return Spec{}, ErrInvalid
+	}
+
+	if u.Host == "" {
+		return Spec{}, ErrHostnameRequired
+	}
+
+	var object string
+
+	if idx := splitRe.FindStringIndex(u.Path); idx != nil {
+		// This allows us to retain the @ to signify digests or shortened digests in
+		// the object.
+		object = u.Path[idx[0]:]
+		if object[:1] == ":" {
+			object = object[1:]
+		}
+		u.Path = u.Path[:idx[0]]
+	}
+
+	return Spec{
+		Locator: path.Join(u.Host, u.Path),
+		Object:  object,
+	}, nil
+}
+
+// Hostname returns the hostname portion of the locator.
+//
+// Remotes are not required to directly access the resources at this host. This
+// method is provided for convenience.
+func (r Spec) Hostname() string {
+	i := strings.Index(r.Locator, "/")
+
+	if i < 0 {
+		return r.Locator
+	}
+	return r.Locator[:i]
+}
+
+// Digest returns the digest portion of the reference spec. This may be a
+// partial or invalid digest, which may be used to lookup a complete digest.
+func (r Spec) Digest() digest.Digest {
+	_, dgst := SplitObject(r.Object)
+	return dgst
+}
+
+// String returns the normalized string for the ref.
+func (r Spec) String() string {
+	if r.Object == "" {
+		return r.Locator
+	}
+	if r.Object[:1] == "@" {
+		return fmt.Sprintf("%v%v", r.Locator, r.Object)
+	}
+
+	return fmt.Sprintf("%v:%v", r.Locator, r.Object)
+}
+
+// SplitObject provides two parts of the object spec, delimited by an `@`
+// symbol.
+//
+// Either may be empty and it is the callers job to validate them
+// appropriately.
+func SplitObject(obj string) (tag string, dgst digest.Digest) {
+	parts := strings.SplitAfterN(obj, "@", 2)
+	if len(parts) < 2 {
+		return parts[0], ""
+	}
+	return parts[0], digest.Digest(parts[1])
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/auth/fetch.go b/vendor/github.com/containerd/containerd/remotes/docker/auth/fetch.go
new file mode 100644
index 0000000000..c259873d2a
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/auth/fetch.go
@@ -0,0 +1,226 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/containerd/containerd/log"
+	remoteserrors "github.com/containerd/containerd/remotes/errors"
+	"github.com/containerd/containerd/version"
+	"golang.org/x/net/context/ctxhttp"
+)
+
+var (
+	// ErrNoToken is returned if a request is successful but the body does not
+	// contain an authorization token.
+	ErrNoToken = errors.New("authorization server did not include a token in the response")
+)
+
+// GenerateTokenOptions generates options for fetching a token based on a challenge
+func GenerateTokenOptions(ctx context.Context, host, username, secret string, c Challenge) (TokenOptions, error) {
+	realm, ok := c.Parameters["realm"]
+	if !ok {
+		return TokenOptions{}, errors.New("no realm specified for token auth challenge")
+	}
+
+	realmURL, err := url.Parse(realm)
+	if err != nil {
+		return TokenOptions{}, fmt.Errorf("invalid token auth challenge realm: %w", err)
+	}
+
+	to := TokenOptions{
+		Realm:    realmURL.String(),
+		Service:  c.Parameters["service"],
+		Username: username,
+		Secret:   secret,
+	}
+
+	scope, ok := c.Parameters["scope"]
+	if ok {
+		to.Scopes = append(to.Scopes, strings.Split(scope, " ")...)
+	} else {
+		log.G(ctx).WithField("host", host).Debug("no scope specified for token auth challenge")
+	}
+
+	return to, nil
+}
+
+// TokenOptions are options for requesting a token
+type TokenOptions struct {
+	Realm    string
+	Service  string
+	Scopes   []string
+	Username string
+	Secret   string
+
+	// FetchRefreshToken enables fetching a refresh token (aka "identity token", "offline token") along with the bearer token.
+	//
+	// For HTTP GET mode (FetchToken), FetchRefreshToken sets `offline_token=true` in the request.
+	// https://docs.docker.com/registry/spec/auth/token/#requesting-a-token
+	//
+	// For HTTP POST mode (FetchTokenWithOAuth), FetchRefreshToken sets `access_type=offline` in the request.
+	// https://docs.docker.com/registry/spec/auth/oauth/#getting-a-token
+	FetchRefreshToken bool
+}
+
+// OAuthTokenResponse is response from fetching token with a OAuth POST request
+type OAuthTokenResponse struct {
+	AccessToken  string    `json:"access_token"`
+	RefreshToken string    `json:"refresh_token"`
+	ExpiresIn    int       `json:"expires_in"`
+	IssuedAt     time.Time `json:"issued_at"`
+	Scope        string    `json:"scope"`
+}
+
+// FetchTokenWithOAuth fetches a token using a POST request
+func FetchTokenWithOAuth(ctx context.Context, client *http.Client, headers http.Header, clientID string, to TokenOptions) (*OAuthTokenResponse, error) {
+	form := url.Values{}
+	if len(to.Scopes) > 0 {
+		form.Set("scope", strings.Join(to.Scopes, " "))
+	}
+	form.Set("service", to.Service)
+	form.Set("client_id", clientID)
+
+	if to.Username == "" {
+		form.Set("grant_type", "refresh_token")
+		form.Set("refresh_token", to.Secret)
+	} else {
+		form.Set("grant_type", "password")
+		form.Set("username", to.Username)
+		form.Set("password", to.Secret)
+	}
+	if to.FetchRefreshToken {
+		form.Set("access_type", "offline")
+	}
+
+	req, err := http.NewRequest("POST", to.Realm, strings.NewReader(form.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded; charset=utf-8")
+	for k, v := range headers {
+		req.Header[k] = append(req.Header[k], v...)
+	}
+	if len(req.Header.Get("User-Agent")) == 0 {
+		req.Header.Set("User-Agent", "containerd/"+version.Version)
+	}
+
+	resp, err := ctxhttp.Do(ctx, client, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 400 {
+		return nil, remoteserrors.NewUnexpectedStatusErr(resp)
+	}
+
+	decoder := json.NewDecoder(resp.Body)
+
+	var tr OAuthTokenResponse
+	if err = decoder.Decode(&tr); err != nil {
+		return nil, fmt.Errorf("unable to decode token response: %w", err)
+	}
+
+	if tr.AccessToken == "" {
+		return nil, ErrNoToken
+	}
+
+	return &tr, nil
+}
+
+// FetchTokenResponse is response from fetching token with GET request
+type FetchTokenResponse struct {
+	Token        string    `json:"token"`
+	AccessToken  string    `json:"access_token"`
+	ExpiresIn    int       `json:"expires_in"`
+	IssuedAt     time.Time `json:"issued_at"`
+	RefreshToken string    `json:"refresh_token"`
+}
+
+// FetchToken fetches a token using a GET request
+func FetchToken(ctx context.Context, client *http.Client, headers http.Header, to TokenOptions) (*FetchTokenResponse, error) {
+	req, err := http.NewRequest("GET", to.Realm, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	for k, v := range headers {
+		req.Header[k] = append(req.Header[k], v...)
+	}
+	if len(req.Header.Get("User-Agent")) == 0 {
+		req.Header.Set("User-Agent", "containerd/"+version.Version)
+	}
+
+	reqParams := req.URL.Query()
+
+	if to.Service != "" {
+		reqParams.Add("service", to.Service)
+	}
+
+	for _, scope := range to.Scopes {
+		reqParams.Add("scope", scope)
+	}
+
+	if to.Secret != "" {
+		req.SetBasicAuth(to.Username, to.Secret)
+	}
+
+	if to.FetchRefreshToken {
+		reqParams.Add("offline_token", "true")
+	}
+
+	req.URL.RawQuery = reqParams.Encode()
+
+	resp, err := ctxhttp.Do(ctx, client, req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 400 {
+		return nil, remoteserrors.NewUnexpectedStatusErr(resp)
+	}
+
+	decoder := json.NewDecoder(resp.Body)
+
+	var tr FetchTokenResponse
+	if err = decoder.Decode(&tr); err != nil {
+		return nil, fmt.Errorf("unable to decode token response: %w", err)
+	}
+
+	// `access_token` is equivalent to `token` and if both are specified
+	// the choice is undefined.  Canonicalize `access_token` by sticking
+	// things in `token`.
+	if tr.AccessToken != "" {
+		tr.Token = tr.AccessToken
+	}
+
+	if tr.Token == "" {
+		return nil, ErrNoToken
+	}
+
+	return &tr, nil
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/auth/parse.go b/vendor/github.com/containerd/containerd/remotes/docker/auth/parse.go
new file mode 100644
index 0000000000..e4529a7761
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/auth/parse.go
@@ -0,0 +1,200 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package auth
+
+import (
+	"net/http"
+	"sort"
+	"strings"
+)
+
+// AuthenticationScheme defines scheme of the authentication method
+type AuthenticationScheme byte
+
+const (
+	// BasicAuth is scheme for Basic HTTP Authentication RFC 7617
+	BasicAuth AuthenticationScheme = 1 << iota
+	// DigestAuth is scheme for HTTP Digest Access Authentication RFC 7616
+	DigestAuth
+	// BearerAuth is scheme for OAuth 2.0 Bearer Tokens RFC 6750
+	BearerAuth
+)
+
+// Challenge carries information from a WWW-Authenticate response header.
+// See RFC 2617.
+type Challenge struct {
+	// scheme is the auth-scheme according to RFC 2617
+	Scheme AuthenticationScheme
+
+	// parameters are the auth-params according to RFC 2617
+	Parameters map[string]string
+}
+
+type byScheme []Challenge
+
+func (bs byScheme) Len() int      { return len(bs) }
+func (bs byScheme) Swap(i, j int) { bs[i], bs[j] = bs[j], bs[i] }
+
+// Sort in priority order: token > digest > basic
+func (bs byScheme) Less(i, j int) bool { return bs[i].Scheme > bs[j].Scheme }
+
+// Octet types from RFC 2616.
+type octetType byte
+
+var octetTypes [256]octetType
+
+const (
+	isToken octetType = 1 << iota
+	isSpace
+)
+
+func init() {
+	// OCTET      = <any 8-bit sequence of data>
+	// CHAR       = <any US-ASCII character (octets 0 - 127)>
+	// CTL        = <any US-ASCII control character (octets 0 - 31) and DEL (127)>
+	// CR         = <US-ASCII CR, carriage return (13)>
+	// LF         = <US-ASCII LF, linefeed (10)>
+	// SP         = <US-ASCII SP, space (32)>
+	// HT         = <US-ASCII HT, horizontal-tab (9)>
+	// <">        = <US-ASCII double-quote mark (34)>
+	// CRLF       = CR LF
+	// LWS        = [CRLF] 1*( SP | HT )
+	// TEXT       = <any OCTET except CTLs, but including LWS>
+	// separators = "(" | ")" | "<" | ">" | "@" | "," | ";" | ":" | "\" | <">
+	//              | "/" | "[" | "]" | "?" | "=" | "{" | "}" | SP | HT
+	// token      = 1*<any CHAR except CTLs or separators>
+	// qdtext     = <any TEXT except <">>
+
+	for c := 0; c < 256; c++ {
+		var t octetType
+		isCtl := c <= 31 || c == 127
+		isChar := 0 <= c && c <= 127
+		isSeparator := strings.ContainsRune(" \t\"(),/:;<=>?@[]\\{}", rune(c))
+		if strings.ContainsRune(" \t\r\n", rune(c)) {
+			t |= isSpace
+		}
+		if isChar && !isCtl && !isSeparator {
+			t |= isToken
+		}
+		octetTypes[c] = t
+	}
+}
+
+// ParseAuthHeader parses challenges from WWW-Authenticate header
+func ParseAuthHeader(header http.Header) []Challenge {
+	challenges := []Challenge{}
+	for _, h := range header[http.CanonicalHeaderKey("WWW-Authenticate")] {
+		v, p := parseValueAndParams(h)
+		var s AuthenticationScheme
+		switch v {
+		case "basic":
+			s = BasicAuth
+		case "digest":
+			s = DigestAuth
+		case "bearer":
+			s = BearerAuth
+		default:
+			continue
+		}
+		challenges = append(challenges, Challenge{Scheme: s, Parameters: p})
+	}
+	sort.Stable(byScheme(challenges))
+	return challenges
+}
+
+func parseValueAndParams(header string) (value string, params map[string]string) {
+	params = make(map[string]string)
+	value, s := expectToken(header)
+	if value == "" {
+		return
+	}
+	value = strings.ToLower(value)
+	for {
+		var pkey string
+		pkey, s = expectToken(skipSpace(s))
+		if pkey == "" {
+			return
+		}
+		if !strings.HasPrefix(s, "=") {
+			return
+		}
+		var pvalue string
+		pvalue, s = expectTokenOrQuoted(s[1:])
+		pkey = strings.ToLower(pkey)
+		params[pkey] = pvalue
+		s = skipSpace(s)
+		if !strings.HasPrefix(s, ",") {
+			return
+		}
+		s = s[1:]
+	}
+}
+
+func skipSpace(s string) (rest string) {
+	i := 0
+	for ; i < len(s); i++ {
+		if octetTypes[s[i]]&isSpace == 0 {
+			break
+		}
+	}
+	return s[i:]
+}
+
+func expectToken(s string) (token, rest string) {
+	i := 0
+	for ; i < len(s); i++ {
+		if octetTypes[s[i]]&isToken == 0 {
+			break
+		}
+	}
+	return s[:i], s[i:]
+}
+
+func expectTokenOrQuoted(s string) (value string, rest string) {
+	if !strings.HasPrefix(s, "\"") {
+		return expectToken(s)
+	}
+	s = s[1:]
+	for i := 0; i < len(s); i++ {
+		switch s[i] {
+		case '"':
+			return s[:i], s[i+1:]
+		case '\\':
+			p := make([]byte, len(s)-1)
+			j := copy(p, s[:i])
+			escape := true
+			for i = i + 1; i < len(s); i++ {
+				b := s[i]
+				switch {
+				case escape:
+					escape = false
+					p[j] = b
+					j++
+				case b == '\\':
+					escape = true
+				case b == '"':
+					return string(p[:j]), s[i+1:]
+				default:
+					p[j] = b
+					j++
+				}
+			}
+			return "", ""
+		}
+	}
+	return "", ""
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/authorizer.go b/vendor/github.com/containerd/containerd/remotes/docker/authorizer.go
new file mode 100644
index 0000000000..eaa0e5dbdb
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/authorizer.go
@@ -0,0 +1,361 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/remotes/docker/auth"
+	remoteerrors "github.com/containerd/containerd/remotes/errors"
+	"github.com/sirupsen/logrus"
+)
+
+type dockerAuthorizer struct {
+	credentials func(string) (string, string, error)
+
+	client *http.Client
+	header http.Header
+	mu     sync.RWMutex
+
+	// indexed by host name
+	handlers map[string]*authHandler
+
+	onFetchRefreshToken OnFetchRefreshToken
+}
+
+// NewAuthorizer creates a Docker authorizer using the provided function to
+// get credentials for the token server or basic auth.
+// Deprecated: Use NewDockerAuthorizer
+func NewAuthorizer(client *http.Client, f func(string) (string, string, error)) Authorizer {
+	return NewDockerAuthorizer(WithAuthClient(client), WithAuthCreds(f))
+}
+
+type authorizerConfig struct {
+	credentials         func(string) (string, string, error)
+	client              *http.Client
+	header              http.Header
+	onFetchRefreshToken OnFetchRefreshToken
+}
+
+// AuthorizerOpt configures an authorizer
+type AuthorizerOpt func(*authorizerConfig)
+
+// WithAuthClient provides the HTTP client for the authorizer
+func WithAuthClient(client *http.Client) AuthorizerOpt {
+	return func(opt *authorizerConfig) {
+		opt.client = client
+	}
+}
+
+// WithAuthCreds provides a credential function to the authorizer
+func WithAuthCreds(creds func(string) (string, string, error)) AuthorizerOpt {
+	return func(opt *authorizerConfig) {
+		opt.credentials = creds
+	}
+}
+
+// WithAuthHeader provides HTTP headers for authorization
+func WithAuthHeader(hdr http.Header) AuthorizerOpt {
+	return func(opt *authorizerConfig) {
+		opt.header = hdr
+	}
+}
+
+// OnFetchRefreshToken is called on fetching request token.
+type OnFetchRefreshToken func(ctx context.Context, refreshToken string, req *http.Request)
+
+// WithFetchRefreshToken enables fetching "refresh token" (aka "identity token", "offline token").
+func WithFetchRefreshToken(f OnFetchRefreshToken) AuthorizerOpt {
+	return func(opt *authorizerConfig) {
+		opt.onFetchRefreshToken = f
+	}
+}
+
+// NewDockerAuthorizer creates an authorizer using Docker's registry
+// authentication spec.
+// See https://docs.docker.com/registry/spec/auth/
+func NewDockerAuthorizer(opts ...AuthorizerOpt) Authorizer {
+	var ao authorizerConfig
+	for _, opt := range opts {
+		opt(&ao)
+	}
+
+	if ao.client == nil {
+		ao.client = http.DefaultClient
+	}
+
+	return &dockerAuthorizer{
+		credentials:         ao.credentials,
+		client:              ao.client,
+		header:              ao.header,
+		handlers:            make(map[string]*authHandler),
+		onFetchRefreshToken: ao.onFetchRefreshToken,
+	}
+}
+
+// Authorize handles auth request.
+func (a *dockerAuthorizer) Authorize(ctx context.Context, req *http.Request) error {
+	// skip if there is no auth handler
+	ah := a.getAuthHandler(req.URL.Host)
+	if ah == nil {
+		return nil
+	}
+
+	auth, refreshToken, err := ah.authorize(ctx)
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Authorization", auth)
+
+	if refreshToken != "" {
+		a.mu.RLock()
+		onFetchRefreshToken := a.onFetchRefreshToken
+		a.mu.RUnlock()
+		if onFetchRefreshToken != nil {
+			onFetchRefreshToken(ctx, refreshToken, req)
+		}
+	}
+	return nil
+}
+
+func (a *dockerAuthorizer) getAuthHandler(host string) *authHandler {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	return a.handlers[host]
+}
+
+func (a *dockerAuthorizer) AddResponses(ctx context.Context, responses []*http.Response) error {
+	last := responses[len(responses)-1]
+	host := last.Request.URL.Host
+
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for _, c := range auth.ParseAuthHeader(last.Header) {
+		if c.Scheme == auth.BearerAuth {
+			if err := invalidAuthorization(c, responses); err != nil {
+				delete(a.handlers, host)
+				return err
+			}
+
+			// reuse existing handler
+			//
+			// assume that one registry will return the common
+			// challenge information, including realm and service.
+			// and the resource scope is only different part
+			// which can be provided by each request.
+			if _, ok := a.handlers[host]; ok {
+				return nil
+			}
+
+			var username, secret string
+			if a.credentials != nil {
+				var err error
+				username, secret, err = a.credentials(host)
+				if err != nil {
+					return err
+				}
+			}
+
+			common, err := auth.GenerateTokenOptions(ctx, host, username, secret, c)
+			if err != nil {
+				return err
+			}
+			common.FetchRefreshToken = a.onFetchRefreshToken != nil
+
+			a.handlers[host] = newAuthHandler(a.client, a.header, c.Scheme, common)
+			return nil
+		} else if c.Scheme == auth.BasicAuth && a.credentials != nil {
+			username, secret, err := a.credentials(host)
+			if err != nil {
+				return err
+			}
+
+			if username != "" && secret != "" {
+				common := auth.TokenOptions{
+					Username: username,
+					Secret:   secret,
+				}
+
+				a.handlers[host] = newAuthHandler(a.client, a.header, c.Scheme, common)
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("failed to find supported auth scheme: %w", errdefs.ErrNotImplemented)
+}
+
+// authResult is used to control limit rate.
+type authResult struct {
+	sync.WaitGroup
+	token        string
+	refreshToken string
+	err          error
+}
+
+// authHandler is used to handle auth request per registry server.
+type authHandler struct {
+	sync.Mutex
+
+	header http.Header
+
+	client *http.Client
+
+	// only support basic and bearer schemes
+	scheme auth.AuthenticationScheme
+
+	// common contains common challenge answer
+	common auth.TokenOptions
+
+	// scopedTokens caches token indexed by scopes, which used in
+	// bearer auth case
+	scopedTokens map[string]*authResult
+}
+
+func newAuthHandler(client *http.Client, hdr http.Header, scheme auth.AuthenticationScheme, opts auth.TokenOptions) *authHandler {
+	return &authHandler{
+		header:       hdr,
+		client:       client,
+		scheme:       scheme,
+		common:       opts,
+		scopedTokens: map[string]*authResult{},
+	}
+}
+
+func (ah *authHandler) authorize(ctx context.Context) (string, string, error) {
+	switch ah.scheme {
+	case auth.BasicAuth:
+		return ah.doBasicAuth(ctx)
+	case auth.BearerAuth:
+		return ah.doBearerAuth(ctx)
+	default:
+		return "", "", fmt.Errorf("failed to find supported auth scheme: %s: %w", string(ah.scheme), errdefs.ErrNotImplemented)
+	}
+}
+
+func (ah *authHandler) doBasicAuth(ctx context.Context) (string, string, error) {
+	username, secret := ah.common.Username, ah.common.Secret
+
+	if username == "" || secret == "" {
+		return "", "", fmt.Errorf("failed to handle basic auth because missing username or secret")
+	}
+
+	auth := base64.StdEncoding.EncodeToString([]byte(username + ":" + secret))
+	return fmt.Sprintf("Basic %s", auth), "", nil
+}
+
+func (ah *authHandler) doBearerAuth(ctx context.Context) (token, refreshToken string, err error) {
+	// copy common tokenOptions
+	to := ah.common
+
+	to.Scopes = GetTokenScopes(ctx, to.Scopes)
+
+	// Docs: https://docs.docker.com/registry/spec/auth/scope
+	scoped := strings.Join(to.Scopes, " ")
+
+	ah.Lock()
+	if r, exist := ah.scopedTokens[scoped]; exist {
+		ah.Unlock()
+		r.Wait()
+		return r.token, r.refreshToken, r.err
+	}
+
+	// only one fetch token job
+	r := new(authResult)
+	r.Add(1)
+	ah.scopedTokens[scoped] = r
+	ah.Unlock()
+
+	defer func() {
+		token = fmt.Sprintf("Bearer %s", token)
+		r.token, r.refreshToken, r.err = token, refreshToken, err
+		r.Done()
+	}()
+
+	// fetch token for the resource scope
+	if to.Secret != "" {
+		defer func() {
+			if err != nil {
+				err = fmt.Errorf("failed to fetch oauth token: %w", err)
+			}
+		}()
+		// credential information is provided, use oauth POST endpoint
+		// TODO: Allow setting client_id
+		resp, err := auth.FetchTokenWithOAuth(ctx, ah.client, ah.header, "containerd-client", to)
+		if err != nil {
+			var errStatus remoteerrors.ErrUnexpectedStatus
+			if errors.As(err, &errStatus) {
+				// Registries without support for POST may return 404 for POST /v2/token.
+				// As of September 2017, GCR is known to return 404.
+				// As of February 2018, JFrog Artifactory is known to return 401.
+				// As of January 2022, ACR is known to return 400.
+				if (errStatus.StatusCode == 405 && to.Username != "") || errStatus.StatusCode == 404 || errStatus.StatusCode == 401 || errStatus.StatusCode == 400 {
+					resp, err := auth.FetchToken(ctx, ah.client, ah.header, to)
+					if err != nil {
+						return "", "", err
+					}
+					return resp.Token, resp.RefreshToken, nil
+				}
+				log.G(ctx).WithFields(logrus.Fields{
+					"status": errStatus.Status,
+					"body":   string(errStatus.Body),
+				}).Debugf("token request failed")
+			}
+			return "", "", err
+		}
+		return resp.AccessToken, resp.RefreshToken, nil
+	}
+	// do request anonymously
+	resp, err := auth.FetchToken(ctx, ah.client, ah.header, to)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to fetch anonymous token: %w", err)
+	}
+	return resp.Token, resp.RefreshToken, nil
+}
+
+func invalidAuthorization(c auth.Challenge, responses []*http.Response) error {
+	errStr := c.Parameters["error"]
+	if errStr == "" {
+		return nil
+	}
+
+	n := len(responses)
+	if n == 1 || (n > 1 && !sameRequest(responses[n-2].Request, responses[n-1].Request)) {
+		return nil
+	}
+
+	return fmt.Errorf("server message: %s: %w", errStr, ErrInvalidAuthorization)
+}
+
+func sameRequest(r1, r2 *http.Request) bool {
+	if r1.Method != r2.Method {
+		return false
+	}
+	if *r1.URL != *r2.URL {
+		return false
+	}
+	return true
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/converter.go b/vendor/github.com/containerd/containerd/remotes/docker/converter.go
new file mode 100644
index 0000000000..d7dca0d364
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/converter.go
@@ -0,0 +1,87 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/remotes"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// LegacyConfigMediaType should be replaced by OCI image spec.
+//
+// More detail: docker/distribution#1622
+const LegacyConfigMediaType = "application/octet-stream"
+
+// ConvertManifest changes application/octet-stream to schema2 config media type if need.
+//
+// NOTE:
+// 1. original manifest will be deleted by next gc round.
+// 2. don't cover manifest list.
+func ConvertManifest(ctx context.Context, store content.Store, desc ocispec.Descriptor) (ocispec.Descriptor, error) {
+	if !(desc.MediaType == images.MediaTypeDockerSchema2Manifest ||
+		desc.MediaType == ocispec.MediaTypeImageManifest) {
+
+		log.G(ctx).Warnf("do nothing for media type: %s", desc.MediaType)
+		return desc, nil
+	}
+
+	// read manifest data
+	mb, err := content.ReadBlob(ctx, store, desc)
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to read index data: %w", err)
+	}
+
+	var manifest ocispec.Manifest
+	if err := json.Unmarshal(mb, &manifest); err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to unmarshal data into manifest: %w", err)
+	}
+
+	// check config media type
+	if manifest.Config.MediaType != LegacyConfigMediaType {
+		return desc, nil
+	}
+
+	manifest.Config.MediaType = images.MediaTypeDockerSchema2Config
+	data, err := json.MarshalIndent(manifest, "", "   ")
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to marshal manifest: %w", err)
+	}
+
+	// update manifest with gc labels
+	desc.Digest = digest.Canonical.FromBytes(data)
+	desc.Size = int64(len(data))
+
+	labels := map[string]string{}
+	for i, c := range append([]ocispec.Descriptor{manifest.Config}, manifest.Layers...) {
+		labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i)] = c.Digest.String()
+	}
+
+	ref := remotes.MakeRefKey(ctx, desc)
+	if err := content.WriteBlob(ctx, store, ref, bytes.NewReader(data), desc, content.WithLabels(labels)); err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to update content: %w", err)
+	}
+	return desc, nil
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/errcode.go b/vendor/github.com/containerd/containerd/remotes/docker/errcode.go
new file mode 100644
index 0000000000..8c623bcbef
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/errcode.go
@@ -0,0 +1,283 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// ErrorCoder is the base interface for ErrorCode and Error allowing
+// users of each to just call ErrorCode to get the real ID of each
+type ErrorCoder interface {
+	ErrorCode() ErrorCode
+}
+
+// ErrorCode represents the error type. The errors are serialized via strings
+// and the integer format may change and should *never* be exported.
+type ErrorCode int
+
+var _ error = ErrorCode(0)
+
+// ErrorCode just returns itself
+func (ec ErrorCode) ErrorCode() ErrorCode {
+	return ec
+}
+
+// Error returns the ID/Value
+func (ec ErrorCode) Error() string {
+	// NOTE(stevvooe): Cannot use message here since it may have unpopulated args.
+	return strings.ToLower(strings.Replace(ec.String(), "_", " ", -1))
+}
+
+// Descriptor returns the descriptor for the error code.
+func (ec ErrorCode) Descriptor() ErrorDescriptor {
+	d, ok := errorCodeToDescriptors[ec]
+
+	if !ok {
+		return ErrorCodeUnknown.Descriptor()
+	}
+
+	return d
+}
+
+// String returns the canonical identifier for this error code.
+func (ec ErrorCode) String() string {
+	return ec.Descriptor().Value
+}
+
+// Message returned the human-readable error message for this error code.
+func (ec ErrorCode) Message() string {
+	return ec.Descriptor().Message
+}
+
+// MarshalText encodes the receiver into UTF-8-encoded text and returns the
+// result.
+func (ec ErrorCode) MarshalText() (text []byte, err error) {
+	return []byte(ec.String()), nil
+}
+
+// UnmarshalText decodes the form generated by MarshalText.
+func (ec *ErrorCode) UnmarshalText(text []byte) error {
+	desc, ok := idToDescriptors[string(text)]
+
+	if !ok {
+		desc = ErrorCodeUnknown.Descriptor()
+	}
+
+	*ec = desc.Code
+
+	return nil
+}
+
+// WithMessage creates a new Error struct based on the passed-in info and
+// overrides the Message property.
+func (ec ErrorCode) WithMessage(message string) Error {
+	return Error{
+		Code:    ec,
+		Message: message,
+	}
+}
+
+// WithDetail creates a new Error struct based on the passed-in info and
+// set the Detail property appropriately
+func (ec ErrorCode) WithDetail(detail interface{}) Error {
+	return Error{
+		Code:    ec,
+		Message: ec.Message(),
+	}.WithDetail(detail)
+}
+
+// WithArgs creates a new Error struct and sets the Args slice
+func (ec ErrorCode) WithArgs(args ...interface{}) Error {
+	return Error{
+		Code:    ec,
+		Message: ec.Message(),
+	}.WithArgs(args...)
+}
+
+// Error provides a wrapper around ErrorCode with extra Details provided.
+type Error struct {
+	Code    ErrorCode   `json:"code"`
+	Message string      `json:"message"`
+	Detail  interface{} `json:"detail,omitempty"`
+
+	// TODO(duglin): See if we need an "args" property so we can do the
+	// variable substitution right before showing the message to the user
+}
+
+var _ error = Error{}
+
+// ErrorCode returns the ID/Value of this Error
+func (e Error) ErrorCode() ErrorCode {
+	return e.Code
+}
+
+// Error returns a human readable representation of the error.
+func (e Error) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code.Error(), e.Message)
+}
+
+// WithDetail will return a new Error, based on the current one, but with
+// some Detail info added
+func (e Error) WithDetail(detail interface{}) Error {
+	return Error{
+		Code:    e.Code,
+		Message: e.Message,
+		Detail:  detail,
+	}
+}
+
+// WithArgs uses the passed-in list of interface{} as the substitution
+// variables in the Error's Message string, but returns a new Error
+func (e Error) WithArgs(args ...interface{}) Error {
+	return Error{
+		Code:    e.Code,
+		Message: fmt.Sprintf(e.Code.Message(), args...),
+		Detail:  e.Detail,
+	}
+}
+
+// ErrorDescriptor provides relevant information about a given error code.
+type ErrorDescriptor struct {
+	// Code is the error code that this descriptor describes.
+	Code ErrorCode
+
+	// Value provides a unique, string key, often captilized with
+	// underscores, to identify the error code. This value is used as the
+	// keyed value when serializing api errors.
+	Value string
+
+	// Message is a short, human readable description of the error condition
+	// included in API responses.
+	Message string
+
+	// Description provides a complete account of the errors purpose, suitable
+	// for use in documentation.
+	Description string
+
+	// HTTPStatusCode provides the http status code that is associated with
+	// this error condition.
+	HTTPStatusCode int
+}
+
+// ParseErrorCode returns the value by the string error code.
+// `ErrorCodeUnknown` will be returned if the error is not known.
+func ParseErrorCode(value string) ErrorCode {
+	ed, ok := idToDescriptors[value]
+	if ok {
+		return ed.Code
+	}
+
+	return ErrorCodeUnknown
+}
+
+// Errors provides the envelope for multiple errors and a few sugar methods
+// for use within the application.
+type Errors []error
+
+var _ error = Errors{}
+
+func (errs Errors) Error() string {
+	switch len(errs) {
+	case 0:
+		return "<nil>"
+	case 1:
+		return errs[0].Error()
+	default:
+		msg := "errors:\n"
+		for _, err := range errs {
+			msg += err.Error() + "\n"
+		}
+		return msg
+	}
+}
+
+// Len returns the current number of errors.
+func (errs Errors) Len() int {
+	return len(errs)
+}
+
+// MarshalJSON converts slice of error, ErrorCode or Error into a
+// slice of Error - then serializes
+func (errs Errors) MarshalJSON() ([]byte, error) {
+	var tmpErrs struct {
+		Errors []Error `json:"errors,omitempty"`
+	}
+
+	for _, daErr := range errs {
+		var err Error
+
+		switch daErr := daErr.(type) {
+		case ErrorCode:
+			err = daErr.WithDetail(nil)
+		case Error:
+			err = daErr
+		default:
+			err = ErrorCodeUnknown.WithDetail(daErr)
+
+		}
+
+		// If the Error struct was setup and they forgot to set the
+		// Message field (meaning its "") then grab it from the ErrCode
+		msg := err.Message
+		if msg == "" {
+			msg = err.Code.Message()
+		}
+
+		tmpErrs.Errors = append(tmpErrs.Errors, Error{
+			Code:    err.Code,
+			Message: msg,
+			Detail:  err.Detail,
+		})
+	}
+
+	return json.Marshal(tmpErrs)
+}
+
+// UnmarshalJSON deserializes []Error and then converts it into slice of
+// Error or ErrorCode
+func (errs *Errors) UnmarshalJSON(data []byte) error {
+	var tmpErrs struct {
+		Errors []Error
+	}
+
+	if err := json.Unmarshal(data, &tmpErrs); err != nil {
+		return err
+	}
+
+	var newErrs Errors
+	for _, daErr := range tmpErrs.Errors {
+		// If Message is empty or exactly matches the Code's message string
+		// then just use the Code, no need for a full Error struct
+		if daErr.Detail == nil && (daErr.Message == "" || daErr.Message == daErr.Code.Message()) {
+			// Error's w/o details get converted to ErrorCode
+			newErrs = append(newErrs, daErr.Code)
+		} else {
+			// Error's w/ details are untouched
+			newErrs = append(newErrs, Error{
+				Code:    daErr.Code,
+				Message: daErr.Message,
+				Detail:  daErr.Detail,
+			})
+		}
+	}
+
+	*errs = newErrs
+	return nil
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/errdesc.go b/vendor/github.com/containerd/containerd/remotes/docker/errdesc.go
new file mode 100644
index 0000000000..b2bd4d82bd
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/errdesc.go
@@ -0,0 +1,154 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"fmt"
+	"net/http"
+	"sort"
+	"sync"
+)
+
+var (
+	errorCodeToDescriptors = map[ErrorCode]ErrorDescriptor{}
+	idToDescriptors        = map[string]ErrorDescriptor{}
+	groupToDescriptors     = map[string][]ErrorDescriptor{}
+)
+
+var (
+	// ErrorCodeUnknown is a generic error that can be used as a last
+	// resort if there is no situation-specific error message that can be used
+	ErrorCodeUnknown = Register("errcode", ErrorDescriptor{
+		Value:   "UNKNOWN",
+		Message: "unknown error",
+		Description: `Generic error returned when the error does not have an
+			                                            API classification.`,
+		HTTPStatusCode: http.StatusInternalServerError,
+	})
+
+	// ErrorCodeUnsupported is returned when an operation is not supported.
+	ErrorCodeUnsupported = Register("errcode", ErrorDescriptor{
+		Value:   "UNSUPPORTED",
+		Message: "The operation is unsupported.",
+		Description: `The operation was unsupported due to a missing
+		implementation or invalid set of parameters.`,
+		HTTPStatusCode: http.StatusMethodNotAllowed,
+	})
+
+	// ErrorCodeUnauthorized is returned if a request requires
+	// authentication.
+	ErrorCodeUnauthorized = Register("errcode", ErrorDescriptor{
+		Value:   "UNAUTHORIZED",
+		Message: "authentication required",
+		Description: `The access controller was unable to authenticate
+		the client. Often this will be accompanied by a
+		Www-Authenticate HTTP response header indicating how to
+		authenticate.`,
+		HTTPStatusCode: http.StatusUnauthorized,
+	})
+
+	// ErrorCodeDenied is returned if a client does not have sufficient
+	// permission to perform an action.
+	ErrorCodeDenied = Register("errcode", ErrorDescriptor{
+		Value:   "DENIED",
+		Message: "requested access to the resource is denied",
+		Description: `The access controller denied access for the
+		operation on a resource.`,
+		HTTPStatusCode: http.StatusForbidden,
+	})
+
+	// ErrorCodeUnavailable provides a common error to report unavailability
+	// of a service or endpoint.
+	ErrorCodeUnavailable = Register("errcode", ErrorDescriptor{
+		Value:          "UNAVAILABLE",
+		Message:        "service unavailable",
+		Description:    "Returned when a service is not available",
+		HTTPStatusCode: http.StatusServiceUnavailable,
+	})
+
+	// ErrorCodeTooManyRequests is returned if a client attempts too many
+	// times to contact a service endpoint.
+	ErrorCodeTooManyRequests = Register("errcode", ErrorDescriptor{
+		Value:   "TOOMANYREQUESTS",
+		Message: "too many requests",
+		Description: `Returned when a client attempts to contact a
+		service too many times`,
+		HTTPStatusCode: http.StatusTooManyRequests,
+	})
+)
+
+var nextCode = 1000
+var registerLock sync.Mutex
+
+// Register will make the passed-in error known to the environment and
+// return a new ErrorCode
+func Register(group string, descriptor ErrorDescriptor) ErrorCode {
+	registerLock.Lock()
+	defer registerLock.Unlock()
+
+	descriptor.Code = ErrorCode(nextCode)
+
+	if _, ok := idToDescriptors[descriptor.Value]; ok {
+		panic(fmt.Sprintf("ErrorValue %q is already registered", descriptor.Value))
+	}
+	if _, ok := errorCodeToDescriptors[descriptor.Code]; ok {
+		panic(fmt.Sprintf("ErrorCode %v is already registered", descriptor.Code))
+	}
+
+	groupToDescriptors[group] = append(groupToDescriptors[group], descriptor)
+	errorCodeToDescriptors[descriptor.Code] = descriptor
+	idToDescriptors[descriptor.Value] = descriptor
+
+	nextCode++
+	return descriptor.Code
+}
+
+type byValue []ErrorDescriptor
+
+func (a byValue) Len() int           { return len(a) }
+func (a byValue) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+func (a byValue) Less(i, j int) bool { return a[i].Value < a[j].Value }
+
+// GetGroupNames returns the list of Error group names that are registered
+func GetGroupNames() []string {
+	keys := []string{}
+
+	for k := range groupToDescriptors {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// GetErrorCodeGroup returns the named group of error descriptors
+func GetErrorCodeGroup(name string) []ErrorDescriptor {
+	desc := groupToDescriptors[name]
+	sort.Sort(byValue(desc))
+	return desc
+}
+
+// GetErrorAllDescriptors returns a slice of all ErrorDescriptors that are
+// registered, irrespective of what group they're in
+func GetErrorAllDescriptors() []ErrorDescriptor {
+	result := []ErrorDescriptor{}
+
+	for _, group := range GetGroupNames() {
+		result = append(result, GetErrorCodeGroup(group)...)
+	}
+	sort.Sort(byValue(result))
+	return result
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go b/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go
new file mode 100644
index 0000000000..11a75356e8
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/fetcher.go
@@ -0,0 +1,215 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+type dockerFetcher struct {
+	*dockerBase
+}
+
+func (r dockerFetcher) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error) {
+	ctx = log.WithLogger(ctx, log.G(ctx).WithField("digest", desc.Digest))
+
+	hosts := r.filterHosts(HostCapabilityPull)
+	if len(hosts) == 0 {
+		return nil, fmt.Errorf("no pull hosts: %w", errdefs.ErrNotFound)
+	}
+
+	ctx, err := ContextWithRepositoryScope(ctx, r.refspec, false)
+	if err != nil {
+		return nil, err
+	}
+
+	return newHTTPReadSeeker(desc.Size, func(offset int64) (io.ReadCloser, error) {
+		// firstly try fetch via external urls
+		for _, us := range desc.URLs {
+			ctx = log.WithLogger(ctx, log.G(ctx).WithField("url", us))
+
+			u, err := url.Parse(us)
+			if err != nil {
+				log.G(ctx).WithError(err).Debug("failed to parse")
+				continue
+			}
+			if u.Scheme != "http" && u.Scheme != "https" {
+				log.G(ctx).Debug("non-http(s) alternative url is unsupported")
+				continue
+			}
+			log.G(ctx).Debug("trying alternative url")
+
+			// Try this first, parse it
+			host := RegistryHost{
+				Client:       http.DefaultClient,
+				Host:         u.Host,
+				Scheme:       u.Scheme,
+				Path:         u.Path,
+				Capabilities: HostCapabilityPull,
+			}
+			req := r.request(host, http.MethodGet)
+			// Strip namespace from base
+			req.path = u.Path
+			if u.RawQuery != "" {
+				req.path = req.path + "?" + u.RawQuery
+			}
+
+			rc, err := r.open(ctx, req, desc.MediaType, offset)
+			if err != nil {
+				if errdefs.IsNotFound(err) {
+					continue // try one of the other urls.
+				}
+
+				return nil, err
+			}
+
+			return rc, nil
+		}
+
+		// Try manifests endpoints for manifests types
+		switch desc.MediaType {
+		case images.MediaTypeDockerSchema2Manifest, images.MediaTypeDockerSchema2ManifestList,
+			images.MediaTypeDockerSchema1Manifest,
+			ocispec.MediaTypeImageManifest, ocispec.MediaTypeImageIndex:
+
+			var firstErr error
+			for _, host := range r.hosts {
+				req := r.request(host, http.MethodGet, "manifests", desc.Digest.String())
+				if err := req.addNamespace(r.refspec.Hostname()); err != nil {
+					return nil, err
+				}
+
+				rc, err := r.open(ctx, req, desc.MediaType, offset)
+				if err != nil {
+					// Store the error for referencing later
+					if firstErr == nil {
+						firstErr = err
+					}
+					continue // try another host
+				}
+
+				return rc, nil
+			}
+
+			return nil, firstErr
+		}
+
+		// Finally use blobs endpoints
+		var firstErr error
+		for _, host := range r.hosts {
+			req := r.request(host, http.MethodGet, "blobs", desc.Digest.String())
+			if err := req.addNamespace(r.refspec.Hostname()); err != nil {
+				return nil, err
+			}
+
+			rc, err := r.open(ctx, req, desc.MediaType, offset)
+			if err != nil {
+				// Store the error for referencing later
+				if firstErr == nil {
+					firstErr = err
+				}
+				continue // try another host
+			}
+
+			return rc, nil
+		}
+
+		if errdefs.IsNotFound(firstErr) {
+			firstErr = fmt.Errorf("could not fetch content descriptor %v (%v) from remote: %w",
+				desc.Digest, desc.MediaType, errdefs.ErrNotFound,
+			)
+		}
+
+		return nil, firstErr
+
+	})
+}
+
+func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string, offset int64) (_ io.ReadCloser, retErr error) {
+	req.header.Set("Accept", strings.Join([]string{mediatype, `*/*`}, ", "))
+
+	if offset > 0 {
+		// Note: "Accept-Ranges: bytes" cannot be trusted as some endpoints
+		// will return the header without supporting the range. The content
+		// range must always be checked.
+		req.header.Set("Range", fmt.Sprintf("bytes=%d-", offset))
+	}
+
+	resp, err := req.doWithRetries(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if retErr != nil {
+			resp.Body.Close()
+		}
+	}()
+
+	if resp.StatusCode > 299 {
+		// TODO(stevvooe): When doing a offset specific request, we should
+		// really distinguish between a 206 and a 200. In the case of 200, we
+		// can discard the bytes, hiding the seek behavior from the
+		// implementation.
+
+		if resp.StatusCode == http.StatusNotFound {
+			return nil, fmt.Errorf("content at %v not found: %w", req.String(), errdefs.ErrNotFound)
+		}
+		var registryErr Errors
+		if err := json.NewDecoder(resp.Body).Decode(&registryErr); err != nil || registryErr.Len() < 1 {
+			return nil, fmt.Errorf("unexpected status code %v: %v", req.String(), resp.Status)
+		}
+		return nil, fmt.Errorf("unexpected status code %v: %s - Server message: %s", req.String(), resp.Status, registryErr.Error())
+	}
+	if offset > 0 {
+		cr := resp.Header.Get("content-range")
+		if cr != "" {
+			if !strings.HasPrefix(cr, fmt.Sprintf("bytes %d-", offset)) {
+				return nil, fmt.Errorf("unhandled content range in response: %v", cr)
+
+			}
+		} else {
+			// TODO: Should any cases where use of content range
+			// without the proper header be considered?
+			// 206 responses?
+
+			// Discard up to offset
+			// Could use buffer pool here but this case should be rare
+			n, err := io.Copy(io.Discard, io.LimitReader(resp.Body, offset))
+			if err != nil {
+				return nil, fmt.Errorf("failed to discard to offset: %w", err)
+			}
+			if n != offset {
+				return nil, errors.New("unable to discard to offset")
+			}
+
+		}
+	}
+
+	return resp.Body, nil
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/handler.go b/vendor/github.com/containerd/containerd/remotes/docker/handler.go
new file mode 100644
index 0000000000..529cfbc274
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/handler.go
@@ -0,0 +1,154 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/labels"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/reference"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+var (
+	// labelDistributionSource describes the source blob comes from.
+	labelDistributionSource = "containerd.io/distribution.source"
+)
+
+// AppendDistributionSourceLabel updates the label of blob with distribution source.
+func AppendDistributionSourceLabel(manager content.Manager, ref string) (images.HandlerFunc, error) {
+	refspec, err := reference.Parse(ref)
+	if err != nil {
+		return nil, err
+	}
+
+	u, err := url.Parse("dummy://" + refspec.Locator)
+	if err != nil {
+		return nil, err
+	}
+
+	source, repo := u.Hostname(), strings.TrimPrefix(u.Path, "/")
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		info, err := manager.Info(ctx, desc.Digest)
+		if err != nil {
+			return nil, err
+		}
+
+		key := distributionSourceLabelKey(source)
+
+		originLabel := ""
+		if info.Labels != nil {
+			originLabel = info.Labels[key]
+		}
+		value := appendDistributionSourceLabel(originLabel, repo)
+
+		// The repo name has been limited under 256 and the distribution
+		// label might hit the limitation of label size, when blob data
+		// is used as the very, very common layer.
+		if err := labels.Validate(key, value); err != nil {
+			log.G(ctx).Warnf("skip to append distribution label: %s", err)
+			return nil, nil
+		}
+
+		info = content.Info{
+			Digest: desc.Digest,
+			Labels: map[string]string{
+				key: value,
+			},
+		}
+		_, err = manager.Update(ctx, info, fmt.Sprintf("labels.%s", key))
+		return nil, err
+	}, nil
+}
+
+func appendDistributionSourceLabel(originLabel, repo string) string {
+	repos := []string{}
+	if originLabel != "" {
+		repos = strings.Split(originLabel, ",")
+	}
+	repos = append(repos, repo)
+
+	// use empty string to present duplicate items
+	for i := 1; i < len(repos); i++ {
+		tmp, j := repos[i], i-1
+		for ; j >= 0 && repos[j] >= tmp; j-- {
+			if repos[j] == tmp {
+				tmp = ""
+			}
+			repos[j+1] = repos[j]
+		}
+		repos[j+1] = tmp
+	}
+
+	i := 0
+	for ; i < len(repos) && repos[i] == ""; i++ {
+	}
+
+	return strings.Join(repos[i:], ",")
+}
+
+func distributionSourceLabelKey(source string) string {
+	return fmt.Sprintf("%s.%s", labelDistributionSource, source)
+}
+
+// selectRepositoryMountCandidate will select the repo which has longest
+// common prefix components as the candidate.
+func selectRepositoryMountCandidate(refspec reference.Spec, sources map[string]string) string {
+	u, err := url.Parse("dummy://" + refspec.Locator)
+	if err != nil {
+		// NOTE: basically, it won't be error here
+		return ""
+	}
+
+	source, target := u.Hostname(), strings.TrimPrefix(u.Path, "/")
+	repoLabel, ok := sources[distributionSourceLabelKey(source)]
+	if !ok || repoLabel == "" {
+		return ""
+	}
+
+	n, match := 0, ""
+	components := strings.Split(target, "/")
+	for _, repo := range strings.Split(repoLabel, ",") {
+		// the target repo is not a candidate
+		if repo == target {
+			continue
+		}
+
+		if l := commonPrefixComponents(components, repo); l >= n {
+			n, match = l, repo
+		}
+	}
+	return match
+}
+
+func commonPrefixComponents(components []string, target string) int {
+	targetComponents := strings.Split(target, "/")
+
+	i := 0
+	for ; i < len(components) && i < len(targetComponents); i++ {
+		if components[i] != targetComponents[i] {
+			break
+		}
+	}
+	return i
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/httpreadseeker.go b/vendor/github.com/containerd/containerd/remotes/docker/httpreadseeker.go
new file mode 100644
index 0000000000..9a827ef04c
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/httpreadseeker.go
@@ -0,0 +1,168 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/log"
+)
+
+const maxRetry = 3
+
+type httpReadSeeker struct {
+	size   int64
+	offset int64
+	rc     io.ReadCloser
+	open   func(offset int64) (io.ReadCloser, error)
+	closed bool
+
+	errsWithNoProgress int
+}
+
+func newHTTPReadSeeker(size int64, open func(offset int64) (io.ReadCloser, error)) (io.ReadCloser, error) {
+	return &httpReadSeeker{
+		size: size,
+		open: open,
+	}, nil
+}
+
+func (hrs *httpReadSeeker) Read(p []byte) (n int, err error) {
+	if hrs.closed {
+		return 0, io.EOF
+	}
+
+	rd, err := hrs.reader()
+	if err != nil {
+		return 0, err
+	}
+
+	n, err = rd.Read(p)
+	hrs.offset += int64(n)
+	if n > 0 || err == nil {
+		hrs.errsWithNoProgress = 0
+	}
+	if err == io.ErrUnexpectedEOF {
+		// connection closed unexpectedly. try reconnecting.
+		if n == 0 {
+			hrs.errsWithNoProgress++
+			if hrs.errsWithNoProgress > maxRetry {
+				return // too many retries for this offset with no progress
+			}
+		}
+		if hrs.rc != nil {
+			if clsErr := hrs.rc.Close(); clsErr != nil {
+				log.L.WithError(clsErr).Error("httpReadSeeker: failed to close ReadCloser")
+			}
+			hrs.rc = nil
+		}
+		if _, err2 := hrs.reader(); err2 == nil {
+			return n, nil
+		}
+	}
+	return
+}
+
+func (hrs *httpReadSeeker) Close() error {
+	if hrs.closed {
+		return nil
+	}
+	hrs.closed = true
+	if hrs.rc != nil {
+		return hrs.rc.Close()
+	}
+
+	return nil
+}
+
+func (hrs *httpReadSeeker) Seek(offset int64, whence int) (int64, error) {
+	if hrs.closed {
+		return 0, fmt.Errorf("Fetcher.Seek: closed: %w", errdefs.ErrUnavailable)
+	}
+
+	abs := hrs.offset
+	switch whence {
+	case io.SeekStart:
+		abs = offset
+	case io.SeekCurrent:
+		abs += offset
+	case io.SeekEnd:
+		if hrs.size == -1 {
+			return 0, fmt.Errorf("Fetcher.Seek: unknown size, cannot seek from end: %w", errdefs.ErrUnavailable)
+		}
+		abs = hrs.size + offset
+	default:
+		return 0, fmt.Errorf("Fetcher.Seek: invalid whence: %w", errdefs.ErrInvalidArgument)
+	}
+
+	if abs < 0 {
+		return 0, fmt.Errorf("Fetcher.Seek: negative offset: %w", errdefs.ErrInvalidArgument)
+	}
+
+	if abs != hrs.offset {
+		if hrs.rc != nil {
+			if err := hrs.rc.Close(); err != nil {
+				log.L.WithError(err).Error("Fetcher.Seek: failed to close ReadCloser")
+			}
+
+			hrs.rc = nil
+		}
+
+		hrs.offset = abs
+	}
+
+	return hrs.offset, nil
+}
+
+func (hrs *httpReadSeeker) reader() (io.Reader, error) {
+	if hrs.rc != nil {
+		return hrs.rc, nil
+	}
+
+	if hrs.size == -1 || hrs.offset < hrs.size {
+		// only try to reopen the body request if we are seeking to a value
+		// less than the actual size.
+		if hrs.open == nil {
+			return nil, fmt.Errorf("cannot open: %w", errdefs.ErrNotImplemented)
+		}
+
+		rc, err := hrs.open(hrs.offset)
+		if err != nil {
+			return nil, fmt.Errorf("httpReadSeeker: failed open: %w", err)
+		}
+
+		if hrs.rc != nil {
+			if err := hrs.rc.Close(); err != nil {
+				log.L.WithError(err).Error("httpReadSeeker: failed to close ReadCloser")
+			}
+		}
+		hrs.rc = rc
+	} else {
+		// There is an edge case here where offset == size of the content. If
+		// we seek, we will probably get an error for content that cannot be
+		// sought (?). In that case, we should err on committing the content,
+		// as the length is already satisfied but we just return the empty
+		// reader instead.
+
+		hrs.rc = io.NopCloser(bytes.NewReader([]byte{}))
+	}
+
+	return hrs.rc, nil
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/pusher.go b/vendor/github.com/containerd/containerd/remotes/docker/pusher.go
new file mode 100644
index 0000000000..bef77fa61d
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/pusher.go
@@ -0,0 +1,528 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/remotes"
+	remoteserrors "github.com/containerd/containerd/remotes/errors"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+type dockerPusher struct {
+	*dockerBase
+	object string
+
+	// TODO: namespace tracker
+	tracker StatusTracker
+}
+
+// Writer implements Ingester API of content store. This allows the client
+// to receive ErrUnavailable when there is already an on-going upload.
+// Note that the tracker MUST implement StatusTrackLocker interface to avoid
+// race condition on StatusTracker.
+func (p dockerPusher) Writer(ctx context.Context, opts ...content.WriterOpt) (content.Writer, error) {
+	var wOpts content.WriterOpts
+	for _, opt := range opts {
+		if err := opt(&wOpts); err != nil {
+			return nil, err
+		}
+	}
+	if wOpts.Ref == "" {
+		return nil, fmt.Errorf("ref must not be empty: %w", errdefs.ErrInvalidArgument)
+	}
+	return p.push(ctx, wOpts.Desc, wOpts.Ref, true)
+}
+
+func (p dockerPusher) Push(ctx context.Context, desc ocispec.Descriptor) (content.Writer, error) {
+	return p.push(ctx, desc, remotes.MakeRefKey(ctx, desc), false)
+}
+
+func (p dockerPusher) push(ctx context.Context, desc ocispec.Descriptor, ref string, unavailableOnFail bool) (content.Writer, error) {
+	if l, ok := p.tracker.(StatusTrackLocker); ok {
+		l.Lock(ref)
+		defer l.Unlock(ref)
+	}
+	ctx, err := ContextWithRepositoryScope(ctx, p.refspec, true)
+	if err != nil {
+		return nil, err
+	}
+	status, err := p.tracker.GetStatus(ref)
+	if err == nil {
+		if status.Committed && status.Offset == status.Total {
+			return nil, fmt.Errorf("ref %v: %w", ref, errdefs.ErrAlreadyExists)
+		}
+		if unavailableOnFail && status.ErrClosed == nil {
+			// Another push of this ref is happening elsewhere. The rest of function
+			// will continue only when `errdefs.IsNotFound(err) == true` (i.e. there
+			// is no actively-tracked ref already).
+			return nil, fmt.Errorf("push is on-going: %w", errdefs.ErrUnavailable)
+		}
+		// TODO: Handle incomplete status
+	} else if !errdefs.IsNotFound(err) {
+		return nil, fmt.Errorf("failed to get status: %w", err)
+	}
+
+	hosts := p.filterHosts(HostCapabilityPush)
+	if len(hosts) == 0 {
+		return nil, fmt.Errorf("no push hosts: %w", errdefs.ErrNotFound)
+	}
+
+	var (
+		isManifest bool
+		existCheck []string
+		host       = hosts[0]
+	)
+
+	switch desc.MediaType {
+	case images.MediaTypeDockerSchema2Manifest, images.MediaTypeDockerSchema2ManifestList,
+		ocispec.MediaTypeImageManifest, ocispec.MediaTypeImageIndex:
+		isManifest = true
+		existCheck = getManifestPath(p.object, desc.Digest)
+	default:
+		existCheck = []string{"blobs", desc.Digest.String()}
+	}
+
+	req := p.request(host, http.MethodHead, existCheck...)
+	req.header.Set("Accept", strings.Join([]string{desc.MediaType, `*/*`}, ", "))
+
+	log.G(ctx).WithField("url", req.String()).Debugf("checking and pushing to")
+
+	resp, err := req.doWithRetries(ctx, nil)
+	if err != nil {
+		if !errors.Is(err, ErrInvalidAuthorization) {
+			return nil, err
+		}
+		log.G(ctx).WithError(err).Debugf("Unable to check existence, continuing with push")
+	} else {
+		if resp.StatusCode == http.StatusOK {
+			var exists bool
+			if isManifest && existCheck[1] != desc.Digest.String() {
+				dgstHeader := digest.Digest(resp.Header.Get("Docker-Content-Digest"))
+				if dgstHeader == desc.Digest {
+					exists = true
+				}
+			} else {
+				exists = true
+			}
+
+			if exists {
+				p.tracker.SetStatus(ref, Status{
+					Committed: true,
+					Status: content.Status{
+						Ref:    ref,
+						Total:  desc.Size,
+						Offset: desc.Size,
+						// TODO: Set updated time?
+					},
+				})
+				resp.Body.Close()
+				return nil, fmt.Errorf("content %v on remote: %w", desc.Digest, errdefs.ErrAlreadyExists)
+			}
+		} else if resp.StatusCode != http.StatusNotFound {
+			err := remoteserrors.NewUnexpectedStatusErr(resp)
+			log.G(ctx).WithField("resp", resp).WithField("body", string(err.(remoteserrors.ErrUnexpectedStatus).Body)).Debug("unexpected response")
+			resp.Body.Close()
+			return nil, err
+		}
+		resp.Body.Close()
+	}
+
+	if isManifest {
+		putPath := getManifestPath(p.object, desc.Digest)
+		req = p.request(host, http.MethodPut, putPath...)
+		req.header.Add("Content-Type", desc.MediaType)
+	} else {
+		// Start upload request
+		req = p.request(host, http.MethodPost, "blobs", "uploads/")
+
+		var resp *http.Response
+		if fromRepo := selectRepositoryMountCandidate(p.refspec, desc.Annotations); fromRepo != "" {
+			preq := requestWithMountFrom(req, desc.Digest.String(), fromRepo)
+			pctx := ContextWithAppendPullRepositoryScope(ctx, fromRepo)
+
+			// NOTE: the fromRepo might be private repo and
+			// auth service still can grant token without error.
+			// but the post request will fail because of 401.
+			//
+			// for the private repo, we should remove mount-from
+			// query and send the request again.
+			resp, err = preq.doWithRetries(pctx, nil)
+			if err != nil {
+				return nil, err
+			}
+
+			if resp.StatusCode == http.StatusUnauthorized {
+				log.G(ctx).Debugf("failed to mount from repository %s", fromRepo)
+
+				resp.Body.Close()
+				resp = nil
+			}
+		}
+
+		if resp == nil {
+			resp, err = req.doWithRetries(ctx, nil)
+			if err != nil {
+				return nil, err
+			}
+		}
+		defer resp.Body.Close()
+
+		switch resp.StatusCode {
+		case http.StatusOK, http.StatusAccepted, http.StatusNoContent:
+		case http.StatusCreated:
+			p.tracker.SetStatus(ref, Status{
+				Committed: true,
+				Status: content.Status{
+					Ref:    ref,
+					Total:  desc.Size,
+					Offset: desc.Size,
+				},
+			})
+			return nil, fmt.Errorf("content %v on remote: %w", desc.Digest, errdefs.ErrAlreadyExists)
+		default:
+			err := remoteserrors.NewUnexpectedStatusErr(resp)
+			log.G(ctx).WithField("resp", resp).WithField("body", string(err.(remoteserrors.ErrUnexpectedStatus).Body)).Debug("unexpected response")
+			return nil, err
+		}
+
+		var (
+			location = resp.Header.Get("Location")
+			lurl     *url.URL
+			lhost    = host
+		)
+		// Support paths without host in location
+		if strings.HasPrefix(location, "/") {
+			lurl, err = url.Parse(lhost.Scheme + "://" + lhost.Host + location)
+			if err != nil {
+				return nil, fmt.Errorf("unable to parse location %v: %w", location, err)
+			}
+		} else {
+			if !strings.Contains(location, "://") {
+				location = lhost.Scheme + "://" + location
+			}
+			lurl, err = url.Parse(location)
+			if err != nil {
+				return nil, fmt.Errorf("unable to parse location %v: %w", location, err)
+			}
+
+			if lurl.Host != lhost.Host || lhost.Scheme != lurl.Scheme {
+
+				lhost.Scheme = lurl.Scheme
+				lhost.Host = lurl.Host
+				log.G(ctx).WithField("host", lhost.Host).WithField("scheme", lhost.Scheme).Debug("upload changed destination")
+
+				// Strip authorizer if change to host or scheme
+				lhost.Authorizer = nil
+			}
+		}
+		q := lurl.Query()
+		q.Add("digest", desc.Digest.String())
+
+		req = p.request(lhost, http.MethodPut)
+		req.header.Set("Content-Type", "application/octet-stream")
+		req.path = lurl.Path + "?" + q.Encode()
+	}
+	p.tracker.SetStatus(ref, Status{
+		Status: content.Status{
+			Ref:       ref,
+			Total:     desc.Size,
+			Expected:  desc.Digest,
+			StartedAt: time.Now(),
+		},
+	})
+
+	// TODO: Support chunked upload
+
+	pushw := newPushWriter(p.dockerBase, ref, desc.Digest, p.tracker, isManifest)
+
+	req.body = func() (io.ReadCloser, error) {
+		pr, pw := io.Pipe()
+		pushw.setPipe(pw)
+		return io.NopCloser(pr), nil
+	}
+	req.size = desc.Size
+
+	go func() {
+		resp, err := req.doWithRetries(ctx, nil)
+		if err != nil {
+			pushw.setError(err)
+			pushw.Close()
+			return
+		}
+
+		switch resp.StatusCode {
+		case http.StatusOK, http.StatusCreated, http.StatusNoContent:
+		default:
+			err := remoteserrors.NewUnexpectedStatusErr(resp)
+			log.G(ctx).WithField("resp", resp).WithField("body", string(err.(remoteserrors.ErrUnexpectedStatus).Body)).Debug("unexpected response")
+			pushw.setError(err)
+			pushw.Close()
+		}
+		pushw.setResponse(resp)
+	}()
+
+	return pushw, nil
+}
+
+func getManifestPath(object string, dgst digest.Digest) []string {
+	if i := strings.IndexByte(object, '@'); i >= 0 {
+		if object[i+1:] != dgst.String() {
+			// use digest, not tag
+			object = ""
+		} else {
+			// strip @<digest> for registry path to make tag
+			object = object[:i]
+		}
+
+	}
+
+	if object == "" {
+		return []string{"manifests", dgst.String()}
+	}
+
+	return []string{"manifests", object}
+}
+
+type pushWriter struct {
+	base *dockerBase
+	ref  string
+
+	pipe *io.PipeWriter
+
+	pipeC     chan *io.PipeWriter
+	respC     chan *http.Response
+	closeOnce sync.Once
+	errC      chan error
+
+	isManifest bool
+
+	expected digest.Digest
+	tracker  StatusTracker
+}
+
+func newPushWriter(db *dockerBase, ref string, expected digest.Digest, tracker StatusTracker, isManifest bool) *pushWriter {
+	// Initialize and create response
+	return &pushWriter{
+		base:       db,
+		ref:        ref,
+		expected:   expected,
+		tracker:    tracker,
+		pipeC:      make(chan *io.PipeWriter, 1),
+		respC:      make(chan *http.Response, 1),
+		errC:       make(chan error, 1),
+		isManifest: isManifest,
+	}
+}
+
+func (pw *pushWriter) setPipe(p *io.PipeWriter) {
+	pw.pipeC <- p
+}
+
+func (pw *pushWriter) setError(err error) {
+	pw.errC <- err
+}
+func (pw *pushWriter) setResponse(resp *http.Response) {
+	pw.respC <- resp
+}
+
+func (pw *pushWriter) Write(p []byte) (n int, err error) {
+	status, err := pw.tracker.GetStatus(pw.ref)
+	if err != nil {
+		return n, err
+	}
+
+	if pw.pipe == nil {
+		p, ok := <-pw.pipeC
+		if !ok {
+			return 0, io.ErrClosedPipe
+		}
+		pw.pipe = p
+	} else {
+		select {
+		case p, ok := <-pw.pipeC:
+			if !ok {
+				return 0, io.ErrClosedPipe
+			}
+			pw.pipe.CloseWithError(content.ErrReset)
+			pw.pipe = p
+
+			// If content has already been written, the bytes
+			// cannot be written and the caller must reset
+			status.Offset = 0
+			status.UpdatedAt = time.Now()
+			pw.tracker.SetStatus(pw.ref, status)
+			return 0, content.ErrReset
+		default:
+		}
+	}
+
+	n, err = pw.pipe.Write(p)
+	if errors.Is(err, io.ErrClosedPipe) {
+		// if the pipe is closed, we might have the original error on the error
+		// channel - so we should try and get it
+		select {
+		case err2 := <-pw.errC:
+			err = err2
+		default:
+		}
+	}
+	status.Offset += int64(n)
+	status.UpdatedAt = time.Now()
+	pw.tracker.SetStatus(pw.ref, status)
+	return
+}
+
+func (pw *pushWriter) Close() error {
+	// Ensure pipeC is closed but handle `Close()` being
+	// called multiple times without panicking
+	pw.closeOnce.Do(func() {
+		close(pw.pipeC)
+	})
+	if pw.pipe != nil {
+		status, err := pw.tracker.GetStatus(pw.ref)
+		if err == nil && !status.Committed {
+			// Closing an incomplete writer. Record this as an error so that following write can retry it.
+			status.ErrClosed = errors.New("closed incomplete writer")
+			pw.tracker.SetStatus(pw.ref, status)
+		}
+		return pw.pipe.Close()
+	}
+	return nil
+}
+
+func (pw *pushWriter) Status() (content.Status, error) {
+	status, err := pw.tracker.GetStatus(pw.ref)
+	if err != nil {
+		return content.Status{}, err
+	}
+	return status.Status, nil
+
+}
+
+func (pw *pushWriter) Digest() digest.Digest {
+	// TODO: Get rid of this function?
+	return pw.expected
+}
+
+func (pw *pushWriter) Commit(ctx context.Context, size int64, expected digest.Digest, opts ...content.Opt) error {
+	// Check whether read has already thrown an error
+	if _, err := pw.pipe.Write([]byte{}); err != nil && !errors.Is(err, io.ErrClosedPipe) {
+		return fmt.Errorf("pipe error before commit: %w", err)
+	}
+
+	if err := pw.pipe.Close(); err != nil {
+		return err
+	}
+	// TODO: timeout waiting for response
+	var resp *http.Response
+	select {
+	case err := <-pw.errC:
+		return err
+	case resp = <-pw.respC:
+		defer resp.Body.Close()
+	case p, ok := <-pw.pipeC:
+		// check whether the pipe has changed in the commit, because sometimes Write
+		// can complete successfully, but the pipe may have changed. In that case, the
+		// content needs to be reset.
+		if !ok {
+			return io.ErrClosedPipe
+		}
+		pw.pipe.CloseWithError(content.ErrReset)
+		pw.pipe = p
+
+		// If content has already been written, the bytes
+		// cannot be written again and the caller must reset
+		status, err := pw.tracker.GetStatus(pw.ref)
+		if err != nil {
+			return err
+		}
+		status.Offset = 0
+		status.UpdatedAt = time.Now()
+		pw.tracker.SetStatus(pw.ref, status)
+		return content.ErrReset
+	}
+
+	// 201 is specified return status, some registries return
+	// 200, 202 or 204.
+	switch resp.StatusCode {
+	case http.StatusOK, http.StatusCreated, http.StatusNoContent, http.StatusAccepted:
+	default:
+		return remoteserrors.NewUnexpectedStatusErr(resp)
+	}
+
+	status, err := pw.tracker.GetStatus(pw.ref)
+	if err != nil {
+		return fmt.Errorf("failed to get status: %w", err)
+	}
+
+	if size > 0 && size != status.Offset {
+		return fmt.Errorf("unexpected size %d, expected %d", status.Offset, size)
+	}
+
+	if expected == "" {
+		expected = status.Expected
+	}
+
+	actual, err := digest.Parse(resp.Header.Get("Docker-Content-Digest"))
+	if err != nil {
+		return fmt.Errorf("invalid content digest in response: %w", err)
+	}
+
+	if actual != expected {
+		return fmt.Errorf("got digest %s, expected %s", actual, expected)
+	}
+
+	status.Committed = true
+	status.UpdatedAt = time.Now()
+	pw.tracker.SetStatus(pw.ref, status)
+
+	return nil
+}
+
+func (pw *pushWriter) Truncate(size int64) error {
+	// TODO: if blob close request and start new request at offset
+	// TODO: always error on manifest
+	return errors.New("cannot truncate remote upload")
+}
+
+func requestWithMountFrom(req *request, mount, from string) *request {
+	creq := *req
+
+	sep := "?"
+	if strings.Contains(creq.path, sep) {
+		sep = "&"
+	}
+
+	creq.path = creq.path + sep + "mount=" + mount + "&from=" + from
+
+	return &creq
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/registry.go b/vendor/github.com/containerd/containerd/remotes/docker/registry.go
new file mode 100644
index 0000000000..98cafcd069
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/registry.go
@@ -0,0 +1,244 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"errors"
+	"net"
+	"net/http"
+)
+
+// HostCapabilities represent the capabilities of the registry
+// host. This also represents the set of operations for which
+// the registry host may be trusted to perform.
+//
+// For example pushing is a capability which should only be
+// performed on an upstream source, not a mirror.
+// Resolving (the process of converting a name into a digest)
+// must be considered a trusted operation and only done by
+// a host which is trusted (or more preferably by secure process
+// which can prove the provenance of the mapping). A public
+// mirror should never be trusted to do a resolve action.
+//
+// | Registry Type    | Pull | Resolve | Push |
+// |------------------|------|---------|------|
+// | Public Registry  | yes  | yes     | yes  |
+// | Private Registry | yes  | yes     | yes  |
+// | Public Mirror    | yes  | no      | no   |
+// | Private Mirror   | yes  | yes     | no   |
+type HostCapabilities uint8
+
+const (
+	// HostCapabilityPull represents the capability to fetch manifests
+	// and blobs by digest
+	HostCapabilityPull HostCapabilities = 1 << iota
+
+	// HostCapabilityResolve represents the capability to fetch manifests
+	// by name
+	HostCapabilityResolve
+
+	// HostCapabilityPush represents the capability to push blobs and
+	// manifests
+	HostCapabilityPush
+
+	// Reserved for future capabilities (i.e. search, catalog, remove)
+)
+
+// Has checks whether the capabilities list has the provide capability
+func (c HostCapabilities) Has(t HostCapabilities) bool {
+	return c&t == t
+}
+
+// RegistryHost represents a complete configuration for a registry
+// host, representing the capabilities, authorizations, connection
+// configuration, and location.
+type RegistryHost struct {
+	Client       *http.Client
+	Authorizer   Authorizer
+	Host         string
+	Scheme       string
+	Path         string
+	Capabilities HostCapabilities
+	Header       http.Header
+}
+
+func (h RegistryHost) isProxy(refhost string) bool {
+	if refhost != h.Host {
+		if refhost != "docker.io" || h.Host != "registry-1.docker.io" {
+			return true
+		}
+	}
+	return false
+}
+
+// RegistryHosts fetches the registry hosts for a given namespace,
+// provided by the host component of an distribution image reference.
+type RegistryHosts func(string) ([]RegistryHost, error)
+
+// Registries joins multiple registry configuration functions, using the same
+// order as provided within the arguments. When an empty registry configuration
+// is returned with a nil error, the next function will be called.
+// NOTE: This function will not join configurations, as soon as a non-empty
+// configuration is returned from a configuration function, it will be returned
+// to the caller.
+func Registries(registries ...RegistryHosts) RegistryHosts {
+	return func(host string) ([]RegistryHost, error) {
+		for _, registry := range registries {
+			config, err := registry(host)
+			if err != nil {
+				return config, err
+			}
+			if len(config) > 0 {
+				return config, nil
+			}
+		}
+		return nil, nil
+	}
+}
+
+type registryOpts struct {
+	authorizer Authorizer
+	plainHTTP  func(string) (bool, error)
+	host       func(string) (string, error)
+	client     *http.Client
+}
+
+// RegistryOpt defines a registry default option
+type RegistryOpt func(*registryOpts)
+
+// WithPlainHTTP configures registries to use plaintext http scheme
+// for the provided host match function.
+func WithPlainHTTP(f func(string) (bool, error)) RegistryOpt {
+	return func(opts *registryOpts) {
+		opts.plainHTTP = f
+	}
+}
+
+// WithAuthorizer configures the default authorizer for a registry
+func WithAuthorizer(a Authorizer) RegistryOpt {
+	return func(opts *registryOpts) {
+		opts.authorizer = a
+	}
+}
+
+// WithHostTranslator defines the default translator to use for registry hosts
+func WithHostTranslator(h func(string) (string, error)) RegistryOpt {
+	return func(opts *registryOpts) {
+		opts.host = h
+	}
+}
+
+// WithClient configures the default http client for a registry
+func WithClient(c *http.Client) RegistryOpt {
+	return func(opts *registryOpts) {
+		opts.client = c
+	}
+}
+
+// ConfigureDefaultRegistries is used to create a default configuration for
+// registries. For more advanced configurations or per-domain setups,
+// the RegistryHosts interface should be used directly.
+// NOTE: This function will always return a non-empty value or error
+func ConfigureDefaultRegistries(ropts ...RegistryOpt) RegistryHosts {
+	var opts registryOpts
+	for _, opt := range ropts {
+		opt(&opts)
+	}
+
+	return func(host string) ([]RegistryHost, error) {
+		config := RegistryHost{
+			Client:       opts.client,
+			Authorizer:   opts.authorizer,
+			Host:         host,
+			Scheme:       "https",
+			Path:         "/v2",
+			Capabilities: HostCapabilityPull | HostCapabilityResolve | HostCapabilityPush,
+		}
+
+		if config.Client == nil {
+			config.Client = http.DefaultClient
+		}
+
+		if opts.plainHTTP != nil {
+			match, err := opts.plainHTTP(host)
+			if err != nil {
+				return nil, err
+			}
+			if match {
+				config.Scheme = "http"
+			}
+		}
+
+		if opts.host != nil {
+			var err error
+			config.Host, err = opts.host(config.Host)
+			if err != nil {
+				return nil, err
+			}
+		} else if host == "docker.io" {
+			config.Host = "registry-1.docker.io"
+		}
+
+		return []RegistryHost{config}, nil
+	}
+}
+
+// MatchAllHosts is a host match function which is always true.
+func MatchAllHosts(string) (bool, error) {
+	return true, nil
+}
+
+// MatchLocalhost is a host match function which returns true for
+// localhost.
+//
+// Note: this does not handle matching of ip addresses in octal,
+// decimal or hex form.
+func MatchLocalhost(host string) (bool, error) {
+	switch {
+	case host == "::1":
+		return true, nil
+	case host == "[::1]":
+		return true, nil
+	}
+	h, p, err := net.SplitHostPort(host)
+
+	// addrError helps distinguish between errors of form
+	// "no colon in address" and "too many colons in address".
+	// The former is fine as the host string need not have a
+	// port. Latter needs to be handled.
+	addrError := &net.AddrError{
+		Err:  "missing port in address",
+		Addr: host,
+	}
+	if err != nil {
+		if err.Error() != addrError.Error() {
+			return false, err
+		}
+		// host string without any port specified
+		h = host
+	} else if len(p) == 0 {
+		return false, errors.New("invalid host name format")
+	}
+
+	// use ipv4 dotted decimal for further checking
+	if h == "localhost" {
+		h = "127.0.0.1"
+	}
+	ip := net.ParseIP(h)
+
+	return ip.IsLoopback(), nil
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/resolver.go b/vendor/github.com/containerd/containerd/remotes/docker/resolver.go
new file mode 100644
index 0000000000..709fa028de
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/resolver.go
@@ -0,0 +1,684 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/reference"
+	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/remotes/docker/schema1"
+	"github.com/containerd/containerd/version"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/net/context/ctxhttp"
+)
+
+var (
+	// ErrInvalidAuthorization is used when credentials are passed to a server but
+	// those credentials are rejected.
+	ErrInvalidAuthorization = errors.New("authorization failed")
+
+	// MaxManifestSize represents the largest size accepted from a registry
+	// during resolution. Larger manifests may be accepted using a
+	// resolution method other than the registry.
+	//
+	// NOTE: The max supported layers by some runtimes is 128 and individual
+	// layers will not contribute more than 256 bytes, making a
+	// reasonable limit for a large image manifests of 32K bytes.
+	// 4M bytes represents a much larger upper bound for images which may
+	// contain large annotations or be non-images. A proper manifest
+	// design puts large metadata in subobjects, as is consistent the
+	// intent of the manifest design.
+	MaxManifestSize int64 = 4 * 1048 * 1048
+)
+
+// Authorizer is used to authorize HTTP requests based on 401 HTTP responses.
+// An Authorizer is responsible for caching tokens or credentials used by
+// requests.
+type Authorizer interface {
+	// Authorize sets the appropriate `Authorization` header on the given
+	// request.
+	//
+	// If no authorization is found for the request, the request remains
+	// unmodified. It may also add an `Authorization` header as
+	//  "bearer <some bearer token>"
+	//  "basic <base64 encoded credentials>"
+	Authorize(context.Context, *http.Request) error
+
+	// AddResponses adds a 401 response for the authorizer to consider when
+	// authorizing requests. The last response should be unauthorized and
+	// the previous requests are used to consider redirects and retries
+	// that may have led to the 401.
+	//
+	// If response is not handled, returns `ErrNotImplemented`
+	AddResponses(context.Context, []*http.Response) error
+}
+
+// ResolverOptions are used to configured a new Docker register resolver
+type ResolverOptions struct {
+	// Hosts returns registry host configurations for a namespace.
+	Hosts RegistryHosts
+
+	// Headers are the HTTP request header fields sent by the resolver
+	Headers http.Header
+
+	// Tracker is used to track uploads to the registry. This is used
+	// since the registry does not have upload tracking and the existing
+	// mechanism for getting blob upload status is expensive.
+	Tracker StatusTracker
+
+	// Authorizer is used to authorize registry requests
+	// Deprecated: use Hosts
+	Authorizer Authorizer
+
+	// Credentials provides username and secret given a host.
+	// If username is empty but a secret is given, that secret
+	// is interpreted as a long lived token.
+	// Deprecated: use Hosts
+	Credentials func(string) (string, string, error)
+
+	// Host provides the hostname given a namespace.
+	// Deprecated: use Hosts
+	Host func(string) (string, error)
+
+	// PlainHTTP specifies to use plain http and not https
+	// Deprecated: use Hosts
+	PlainHTTP bool
+
+	// Client is the http client to used when making registry requests
+	// Deprecated: use Hosts
+	Client *http.Client
+}
+
+// DefaultHost is the default host function.
+func DefaultHost(ns string) (string, error) {
+	if ns == "docker.io" {
+		return "registry-1.docker.io", nil
+	}
+	return ns, nil
+}
+
+type dockerResolver struct {
+	hosts         RegistryHosts
+	header        http.Header
+	resolveHeader http.Header
+	tracker       StatusTracker
+}
+
+// NewResolver returns a new resolver to a Docker registry
+func NewResolver(options ResolverOptions) remotes.Resolver {
+	if options.Tracker == nil {
+		options.Tracker = NewInMemoryTracker()
+	}
+
+	if options.Headers == nil {
+		options.Headers = make(http.Header)
+	}
+	if _, ok := options.Headers["User-Agent"]; !ok {
+		options.Headers.Set("User-Agent", "containerd/"+version.Version)
+	}
+
+	resolveHeader := http.Header{}
+	if _, ok := options.Headers["Accept"]; !ok {
+		// set headers for all the types we support for resolution.
+		resolveHeader.Set("Accept", strings.Join([]string{
+			images.MediaTypeDockerSchema2Manifest,
+			images.MediaTypeDockerSchema2ManifestList,
+			ocispec.MediaTypeImageManifest,
+			ocispec.MediaTypeImageIndex, "*/*"}, ", "))
+	} else {
+		resolveHeader["Accept"] = options.Headers["Accept"]
+		delete(options.Headers, "Accept")
+	}
+
+	if options.Hosts == nil {
+		opts := []RegistryOpt{}
+		if options.Host != nil {
+			opts = append(opts, WithHostTranslator(options.Host))
+		}
+
+		if options.Authorizer == nil {
+			options.Authorizer = NewDockerAuthorizer(
+				WithAuthClient(options.Client),
+				WithAuthHeader(options.Headers),
+				WithAuthCreds(options.Credentials))
+		}
+		opts = append(opts, WithAuthorizer(options.Authorizer))
+
+		if options.Client != nil {
+			opts = append(opts, WithClient(options.Client))
+		}
+		if options.PlainHTTP {
+			opts = append(opts, WithPlainHTTP(MatchAllHosts))
+		} else {
+			opts = append(opts, WithPlainHTTP(MatchLocalhost))
+		}
+		options.Hosts = ConfigureDefaultRegistries(opts...)
+	}
+	return &dockerResolver{
+		hosts:         options.Hosts,
+		header:        options.Headers,
+		resolveHeader: resolveHeader,
+		tracker:       options.Tracker,
+	}
+}
+
+func getManifestMediaType(resp *http.Response) string {
+	// Strip encoding data (manifests should always be ascii JSON)
+	contentType := resp.Header.Get("Content-Type")
+	if sp := strings.IndexByte(contentType, ';'); sp != -1 {
+		contentType = contentType[0:sp]
+	}
+
+	// As of Apr 30 2019 the registry.access.redhat.com registry does not specify
+	// the content type of any data but uses schema1 manifests.
+	if contentType == "text/plain" {
+		contentType = images.MediaTypeDockerSchema1Manifest
+	}
+	return contentType
+}
+
+type countingReader struct {
+	reader    io.Reader
+	bytesRead int64
+}
+
+func (r *countingReader) Read(p []byte) (int, error) {
+	n, err := r.reader.Read(p)
+	r.bytesRead += int64(n)
+	return n, err
+}
+
+var _ remotes.Resolver = &dockerResolver{}
+
+func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocispec.Descriptor, error) {
+	base, err := r.resolveDockerBase(ref)
+	if err != nil {
+		return "", ocispec.Descriptor{}, err
+	}
+	refspec := base.refspec
+	if refspec.Object == "" {
+		return "", ocispec.Descriptor{}, reference.ErrObjectRequired
+	}
+
+	var (
+		firstErr error
+		paths    [][]string
+		dgst     = refspec.Digest()
+		caps     = HostCapabilityPull
+	)
+
+	if dgst != "" {
+		if err := dgst.Validate(); err != nil {
+			// need to fail here, since we can't actually resolve the invalid
+			// digest.
+			return "", ocispec.Descriptor{}, err
+		}
+
+		// turns out, we have a valid digest, make a url.
+		paths = append(paths, []string{"manifests", dgst.String()})
+
+		// fallback to blobs on not found.
+		paths = append(paths, []string{"blobs", dgst.String()})
+	} else {
+		// Add
+		paths = append(paths, []string{"manifests", refspec.Object})
+		caps |= HostCapabilityResolve
+	}
+
+	hosts := base.filterHosts(caps)
+	if len(hosts) == 0 {
+		return "", ocispec.Descriptor{}, fmt.Errorf("no resolve hosts: %w", errdefs.ErrNotFound)
+	}
+
+	ctx, err = ContextWithRepositoryScope(ctx, refspec, false)
+	if err != nil {
+		return "", ocispec.Descriptor{}, err
+	}
+
+	for _, u := range paths {
+		for _, host := range hosts {
+			ctx := log.WithLogger(ctx, log.G(ctx).WithField("host", host.Host))
+
+			req := base.request(host, http.MethodHead, u...)
+			if err := req.addNamespace(base.refspec.Hostname()); err != nil {
+				return "", ocispec.Descriptor{}, err
+			}
+
+			for key, value := range r.resolveHeader {
+				req.header[key] = append(req.header[key], value...)
+			}
+
+			log.G(ctx).Debug("resolving")
+			resp, err := req.doWithRetries(ctx, nil)
+			if err != nil {
+				if errors.Is(err, ErrInvalidAuthorization) {
+					err = fmt.Errorf("pull access denied, repository does not exist or may require authorization: %w", err)
+				}
+				// Store the error for referencing later
+				if firstErr == nil {
+					firstErr = err
+				}
+				log.G(ctx).WithError(err).Info("trying next host")
+				continue // try another host
+			}
+			resp.Body.Close() // don't care about body contents.
+
+			if resp.StatusCode > 299 {
+				if resp.StatusCode == http.StatusNotFound {
+					log.G(ctx).Info("trying next host - response was http.StatusNotFound")
+					continue
+				}
+				if resp.StatusCode > 399 {
+					// Set firstErr when encountering the first non-404 status code.
+					if firstErr == nil {
+						firstErr = fmt.Errorf("pulling from host %s failed with status code %v: %v", host.Host, u, resp.Status)
+					}
+					continue // try another host
+				}
+				return "", ocispec.Descriptor{}, fmt.Errorf("pulling from host %s failed with unexpected status code %v: %v", host.Host, u, resp.Status)
+			}
+			size := resp.ContentLength
+			contentType := getManifestMediaType(resp)
+
+			// if no digest was provided, then only a resolve
+			// trusted registry was contacted, in this case use
+			// the digest header (or content from GET)
+			if dgst == "" {
+				// this is the only point at which we trust the registry. we use the
+				// content headers to assemble a descriptor for the name. when this becomes
+				// more robust, we mostly get this information from a secure trust store.
+				dgstHeader := digest.Digest(resp.Header.Get("Docker-Content-Digest"))
+
+				if dgstHeader != "" && size != -1 {
+					if err := dgstHeader.Validate(); err != nil {
+						return "", ocispec.Descriptor{}, fmt.Errorf("%q in header not a valid digest: %w", dgstHeader, err)
+					}
+					dgst = dgstHeader
+				}
+			}
+			if dgst == "" || size == -1 {
+				log.G(ctx).Debug("no Docker-Content-Digest header, fetching manifest instead")
+
+				req = base.request(host, http.MethodGet, u...)
+				if err := req.addNamespace(base.refspec.Hostname()); err != nil {
+					return "", ocispec.Descriptor{}, err
+				}
+
+				for key, value := range r.resolveHeader {
+					req.header[key] = append(req.header[key], value...)
+				}
+
+				resp, err := req.doWithRetries(ctx, nil)
+				if err != nil {
+					return "", ocispec.Descriptor{}, err
+				}
+				defer resp.Body.Close()
+
+				bodyReader := countingReader{reader: resp.Body}
+
+				contentType = getManifestMediaType(resp)
+				if dgst == "" {
+					if contentType == images.MediaTypeDockerSchema1Manifest {
+						b, err := schema1.ReadStripSignature(&bodyReader)
+						if err != nil {
+							return "", ocispec.Descriptor{}, err
+						}
+
+						dgst = digest.FromBytes(b)
+					} else {
+						dgst, err = digest.FromReader(&bodyReader)
+						if err != nil {
+							return "", ocispec.Descriptor{}, err
+						}
+					}
+				} else if _, err := io.Copy(io.Discard, &bodyReader); err != nil {
+					return "", ocispec.Descriptor{}, err
+				}
+				size = bodyReader.bytesRead
+			}
+			// Prevent resolving to excessively large manifests
+			if size > MaxManifestSize {
+				if firstErr == nil {
+					firstErr = fmt.Errorf("rejecting %d byte manifest for %s: %w", size, ref, errdefs.ErrNotFound)
+				}
+				continue
+			}
+
+			desc := ocispec.Descriptor{
+				Digest:    dgst,
+				MediaType: contentType,
+				Size:      size,
+			}
+
+			log.G(ctx).WithField("desc.digest", desc.Digest).Debug("resolved")
+			return ref, desc, nil
+		}
+	}
+
+	// If above loop terminates without return, then there was an error.
+	// "firstErr" contains the first non-404 error. That is, "firstErr == nil"
+	// means that either no registries were given or each registry returned 404.
+
+	if firstErr == nil {
+		firstErr = fmt.Errorf("%s: %w", ref, errdefs.ErrNotFound)
+	}
+
+	return "", ocispec.Descriptor{}, firstErr
+}
+
+func (r *dockerResolver) Fetcher(ctx context.Context, ref string) (remotes.Fetcher, error) {
+	base, err := r.resolveDockerBase(ref)
+	if err != nil {
+		return nil, err
+	}
+
+	return dockerFetcher{
+		dockerBase: base,
+	}, nil
+}
+
+func (r *dockerResolver) Pusher(ctx context.Context, ref string) (remotes.Pusher, error) {
+	base, err := r.resolveDockerBase(ref)
+	if err != nil {
+		return nil, err
+	}
+
+	return dockerPusher{
+		dockerBase: base,
+		object:     base.refspec.Object,
+		tracker:    r.tracker,
+	}, nil
+}
+
+func (r *dockerResolver) resolveDockerBase(ref string) (*dockerBase, error) {
+	refspec, err := reference.Parse(ref)
+	if err != nil {
+		return nil, err
+	}
+
+	return r.base(refspec)
+}
+
+type dockerBase struct {
+	refspec    reference.Spec
+	repository string
+	hosts      []RegistryHost
+	header     http.Header
+}
+
+func (r *dockerResolver) base(refspec reference.Spec) (*dockerBase, error) {
+	host := refspec.Hostname()
+	hosts, err := r.hosts(host)
+	if err != nil {
+		return nil, err
+	}
+	return &dockerBase{
+		refspec:    refspec,
+		repository: strings.TrimPrefix(refspec.Locator, host+"/"),
+		hosts:      hosts,
+		header:     r.header,
+	}, nil
+}
+
+func (r *dockerBase) filterHosts(caps HostCapabilities) (hosts []RegistryHost) {
+	for _, host := range r.hosts {
+		if host.Capabilities.Has(caps) {
+			hosts = append(hosts, host)
+		}
+	}
+	return
+}
+
+func (r *dockerBase) request(host RegistryHost, method string, ps ...string) *request {
+	header := r.header.Clone()
+	if header == nil {
+		header = http.Header{}
+	}
+
+	for key, value := range host.Header {
+		header[key] = append(header[key], value...)
+	}
+	parts := append([]string{"/", host.Path, r.repository}, ps...)
+	p := path.Join(parts...)
+	// Join strips trailing slash, re-add ending "/" if included
+	if len(parts) > 0 && strings.HasSuffix(parts[len(parts)-1], "/") {
+		p = p + "/"
+	}
+	return &request{
+		method: method,
+		path:   p,
+		header: header,
+		host:   host,
+	}
+}
+
+func (r *request) authorize(ctx context.Context, req *http.Request) error {
+	// Check if has header for host
+	if r.host.Authorizer != nil {
+		if err := r.host.Authorizer.Authorize(ctx, req); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (r *request) addNamespace(ns string) (err error) {
+	if !r.host.isProxy(ns) {
+		return nil
+	}
+	var q url.Values
+	// Parse query
+	if i := strings.IndexByte(r.path, '?'); i > 0 {
+		r.path = r.path[:i+1]
+		q, err = url.ParseQuery(r.path[i+1:])
+		if err != nil {
+			return
+		}
+	} else {
+		r.path = r.path + "?"
+		q = url.Values{}
+	}
+	q.Add("ns", ns)
+
+	r.path = r.path + q.Encode()
+
+	return
+}
+
+type request struct {
+	method string
+	path   string
+	header http.Header
+	host   RegistryHost
+	body   func() (io.ReadCloser, error)
+	size   int64
+}
+
+func (r *request) do(ctx context.Context) (*http.Response, error) {
+	u := r.host.Scheme + "://" + r.host.Host + r.path
+	req, err := http.NewRequest(r.method, u, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header = http.Header{} // headers need to be copied to avoid concurrent map access
+	for k, v := range r.header {
+		req.Header[k] = v
+	}
+	if r.body != nil {
+		body, err := r.body()
+		if err != nil {
+			return nil, err
+		}
+		req.Body = body
+		req.GetBody = r.body
+		if r.size > 0 {
+			req.ContentLength = r.size
+		}
+	}
+
+	ctx = log.WithLogger(ctx, log.G(ctx).WithField("url", u))
+	log.G(ctx).WithFields(requestFields(req)).Debug("do request")
+	if err := r.authorize(ctx, req); err != nil {
+		return nil, fmt.Errorf("failed to authorize: %w", err)
+	}
+
+	var client = &http.Client{}
+	if r.host.Client != nil {
+		*client = *r.host.Client
+	}
+	if client.CheckRedirect == nil {
+		client.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+			if len(via) >= 10 {
+				return errors.New("stopped after 10 redirects")
+			}
+			if err := r.authorize(ctx, req); err != nil {
+				return fmt.Errorf("failed to authorize redirect: %w", err)
+			}
+			return nil
+		}
+	}
+
+	resp, err := ctxhttp.Do(ctx, client, req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to do request: %w", err)
+	}
+	log.G(ctx).WithFields(responseFields(resp)).Debug("fetch response received")
+	return resp, nil
+}
+
+func (r *request) doWithRetries(ctx context.Context, responses []*http.Response) (*http.Response, error) {
+	resp, err := r.do(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	responses = append(responses, resp)
+	retry, err := r.retryRequest(ctx, responses)
+	if err != nil {
+		resp.Body.Close()
+		return nil, err
+	}
+	if retry {
+		resp.Body.Close()
+		return r.doWithRetries(ctx, responses)
+	}
+	return resp, err
+}
+
+func (r *request) retryRequest(ctx context.Context, responses []*http.Response) (bool, error) {
+	if len(responses) > 5 {
+		return false, nil
+	}
+	last := responses[len(responses)-1]
+	switch last.StatusCode {
+	case http.StatusUnauthorized:
+		log.G(ctx).WithField("header", last.Header.Get("WWW-Authenticate")).Debug("Unauthorized")
+		if r.host.Authorizer != nil {
+			if err := r.host.Authorizer.AddResponses(ctx, responses); err == nil {
+				return true, nil
+			} else if !errdefs.IsNotImplemented(err) {
+				return false, err
+			}
+		}
+
+		return false, nil
+	case http.StatusMethodNotAllowed:
+		// Support registries which have not properly implemented the HEAD method for
+		// manifests endpoint
+		if r.method == http.MethodHead && strings.Contains(r.path, "/manifests/") {
+			r.method = http.MethodGet
+			return true, nil
+		}
+	case http.StatusRequestTimeout, http.StatusTooManyRequests:
+		return true, nil
+	}
+
+	// TODO: Handle 50x errors accounting for attempt history
+	return false, nil
+}
+
+func (r *request) String() string {
+	return r.host.Scheme + "://" + r.host.Host + r.path
+}
+
+func requestFields(req *http.Request) logrus.Fields {
+	fields := map[string]interface{}{
+		"request.method": req.Method,
+	}
+	for k, vals := range req.Header {
+		k = strings.ToLower(k)
+		if k == "authorization" {
+			continue
+		}
+		for i, v := range vals {
+			field := "request.header." + k
+			if i > 0 {
+				field = fmt.Sprintf("%s.%d", field, i)
+			}
+			fields[field] = v
+		}
+	}
+
+	return logrus.Fields(fields)
+}
+
+func responseFields(resp *http.Response) logrus.Fields {
+	fields := map[string]interface{}{
+		"response.status": resp.Status,
+	}
+	for k, vals := range resp.Header {
+		k = strings.ToLower(k)
+		for i, v := range vals {
+			field := "response.header." + k
+			if i > 0 {
+				field = fmt.Sprintf("%s.%d", field, i)
+			}
+			fields[field] = v
+		}
+	}
+
+	return logrus.Fields(fields)
+}
+
+// IsLocalhost checks if the registry host is local.
+func IsLocalhost(host string) bool {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		host = h
+	}
+
+	if host == "localhost" {
+		return true
+	}
+
+	ip := net.ParseIP(host)
+	return ip.IsLoopback()
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/schema1/converter.go b/vendor/github.com/containerd/containerd/remotes/docker/schema1/converter.go
new file mode 100644
index 0000000000..efa4e8d6ee
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/schema1/converter.go
@@ -0,0 +1,604 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package schema1
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/containerd/containerd/archive/compression"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/remotes"
+	digest "github.com/opencontainers/go-digest"
+	specs "github.com/opencontainers/image-spec/specs-go"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	manifestSizeLimit            = 8e6 // 8MB
+	labelDockerSchema1EmptyLayer = "containerd.io/docker.schema1.empty-layer"
+)
+
+type blobState struct {
+	diffID digest.Digest
+	empty  bool
+}
+
+// Converter converts schema1 manifests to schema2 on fetch
+type Converter struct {
+	contentStore content.Store
+	fetcher      remotes.Fetcher
+
+	pulledManifest *manifest
+
+	mu         sync.Mutex
+	blobMap    map[digest.Digest]blobState
+	layerBlobs map[digest.Digest]ocispec.Descriptor
+}
+
+// NewConverter returns a new converter
+func NewConverter(contentStore content.Store, fetcher remotes.Fetcher) *Converter {
+	return &Converter{
+		contentStore: contentStore,
+		fetcher:      fetcher,
+		blobMap:      map[digest.Digest]blobState{},
+		layerBlobs:   map[digest.Digest]ocispec.Descriptor{},
+	}
+}
+
+// Handle fetching descriptors for a docker media type
+func (c *Converter) Handle(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+	switch desc.MediaType {
+	case images.MediaTypeDockerSchema1Manifest:
+		if err := c.fetchManifest(ctx, desc); err != nil {
+			return nil, err
+		}
+
+		m := c.pulledManifest
+		if len(m.FSLayers) != len(m.History) {
+			return nil, errors.New("invalid schema 1 manifest, history and layer mismatch")
+		}
+		descs := make([]ocispec.Descriptor, 0, len(c.pulledManifest.FSLayers))
+
+		for i := range m.FSLayers {
+			if _, ok := c.blobMap[c.pulledManifest.FSLayers[i].BlobSum]; !ok {
+				empty, err := isEmptyLayer([]byte(m.History[i].V1Compatibility))
+				if err != nil {
+					return nil, err
+				}
+
+				// Do no attempt to download a known empty blob
+				if !empty {
+					descs = append([]ocispec.Descriptor{
+						{
+							MediaType: images.MediaTypeDockerSchema2LayerGzip,
+							Digest:    c.pulledManifest.FSLayers[i].BlobSum,
+							Size:      -1,
+						},
+					}, descs...)
+				}
+				c.blobMap[c.pulledManifest.FSLayers[i].BlobSum] = blobState{
+					empty: empty,
+				}
+			}
+		}
+		return descs, nil
+	case images.MediaTypeDockerSchema2LayerGzip:
+		if c.pulledManifest == nil {
+			return nil, errors.New("manifest required for schema 1 blob pull")
+		}
+		return nil, c.fetchBlob(ctx, desc)
+	default:
+		return nil, fmt.Errorf("%v not support for schema 1 manifests", desc.MediaType)
+	}
+}
+
+// ConvertOptions provides options on converting a docker schema1 manifest.
+type ConvertOptions struct {
+	// ManifestMediaType specifies the media type of the manifest OCI descriptor.
+	ManifestMediaType string
+
+	// ConfigMediaType specifies the media type of the manifest config OCI
+	// descriptor.
+	ConfigMediaType string
+}
+
+// ConvertOpt allows configuring a convert operation.
+type ConvertOpt func(context.Context, *ConvertOptions) error
+
+// UseDockerSchema2 is used to indicate that a schema1 manifest should be
+// converted into the media types for a docker schema2 manifest.
+func UseDockerSchema2() ConvertOpt {
+	return func(ctx context.Context, o *ConvertOptions) error {
+		o.ManifestMediaType = images.MediaTypeDockerSchema2Manifest
+		o.ConfigMediaType = images.MediaTypeDockerSchema2Config
+		return nil
+	}
+}
+
+// Convert a docker manifest to an OCI descriptor
+func (c *Converter) Convert(ctx context.Context, opts ...ConvertOpt) (ocispec.Descriptor, error) {
+	co := ConvertOptions{
+		ManifestMediaType: ocispec.MediaTypeImageManifest,
+		ConfigMediaType:   ocispec.MediaTypeImageConfig,
+	}
+	for _, opt := range opts {
+		if err := opt(ctx, &co); err != nil {
+			return ocispec.Descriptor{}, err
+		}
+	}
+
+	history, diffIDs, err := c.schema1ManifestHistory()
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("schema 1 conversion failed: %w", err)
+	}
+
+	var img ocispec.Image
+	if err := json.Unmarshal([]byte(c.pulledManifest.History[0].V1Compatibility), &img); err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to unmarshal image from schema 1 history: %w", err)
+	}
+
+	img.History = history
+	img.RootFS = ocispec.RootFS{
+		Type:    "layers",
+		DiffIDs: diffIDs,
+	}
+
+	b, err := json.MarshalIndent(img, "", "   ")
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to marshal image: %w", err)
+	}
+
+	config := ocispec.Descriptor{
+		MediaType: co.ConfigMediaType,
+		Digest:    digest.Canonical.FromBytes(b),
+		Size:      int64(len(b)),
+	}
+
+	layers := make([]ocispec.Descriptor, len(diffIDs))
+	for i, diffID := range diffIDs {
+		layers[i] = c.layerBlobs[diffID]
+	}
+
+	manifest := ocispec.Manifest{
+		Versioned: specs.Versioned{
+			SchemaVersion: 2,
+		},
+		Config: config,
+		Layers: layers,
+	}
+
+	mb, err := json.MarshalIndent(manifest, "", "   ")
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to marshal image: %w", err)
+	}
+
+	desc := ocispec.Descriptor{
+		MediaType: co.ManifestMediaType,
+		Digest:    digest.Canonical.FromBytes(mb),
+		Size:      int64(len(mb)),
+	}
+
+	labels := map[string]string{}
+	labels["containerd.io/gc.ref.content.0"] = manifest.Config.Digest.String()
+	for i, ch := range manifest.Layers {
+		labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i+1)] = ch.Digest.String()
+	}
+
+	ref := remotes.MakeRefKey(ctx, desc)
+	if err := content.WriteBlob(ctx, c.contentStore, ref, bytes.NewReader(mb), desc, content.WithLabels(labels)); err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to write image manifest: %w", err)
+	}
+
+	ref = remotes.MakeRefKey(ctx, config)
+	if err := content.WriteBlob(ctx, c.contentStore, ref, bytes.NewReader(b), config); err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to write image config: %w", err)
+	}
+
+	return desc, nil
+}
+
+// ReadStripSignature reads in a schema1 manifest and returns a byte array
+// with the "signatures" field stripped
+func ReadStripSignature(schema1Blob io.Reader) ([]byte, error) {
+	b, err := io.ReadAll(io.LimitReader(schema1Blob, manifestSizeLimit)) // limit to 8MB
+	if err != nil {
+		return nil, err
+	}
+
+	return stripSignature(b)
+}
+
+func (c *Converter) fetchManifest(ctx context.Context, desc ocispec.Descriptor) error {
+	log.G(ctx).Debug("fetch schema 1")
+
+	rc, err := c.fetcher.Fetch(ctx, desc)
+	if err != nil {
+		return err
+	}
+
+	b, err := ReadStripSignature(rc)
+	rc.Close()
+	if err != nil {
+		return err
+	}
+
+	var m manifest
+	if err := json.Unmarshal(b, &m); err != nil {
+		return err
+	}
+	if len(m.Manifests) != 0 || len(m.Layers) != 0 {
+		return errors.New("converter: expected schema1 document but found extra keys")
+	}
+	c.pulledManifest = &m
+
+	return nil
+}
+
+func (c *Converter) fetchBlob(ctx context.Context, desc ocispec.Descriptor) error {
+	log.G(ctx).Debug("fetch blob")
+
+	var (
+		ref            = remotes.MakeRefKey(ctx, desc)
+		calc           = newBlobStateCalculator()
+		compressMethod = compression.Gzip
+	)
+
+	// size may be unknown, set to zero for content ingest
+	ingestDesc := desc
+	if ingestDesc.Size == -1 {
+		ingestDesc.Size = 0
+	}
+
+	cw, err := content.OpenWriter(ctx, c.contentStore, content.WithRef(ref), content.WithDescriptor(ingestDesc))
+	if err != nil {
+		if !errdefs.IsAlreadyExists(err) {
+			return err
+		}
+
+		reuse, err := c.reuseLabelBlobState(ctx, desc)
+		if err != nil {
+			return err
+		}
+
+		if reuse {
+			return nil
+		}
+
+		ra, err := c.contentStore.ReaderAt(ctx, desc)
+		if err != nil {
+			return err
+		}
+		defer ra.Close()
+
+		r, err := compression.DecompressStream(content.NewReader(ra))
+		if err != nil {
+			return err
+		}
+
+		compressMethod = r.GetCompression()
+		_, err = io.Copy(calc, r)
+		r.Close()
+		if err != nil {
+			return err
+		}
+	} else {
+		defer cw.Close()
+
+		rc, err := c.fetcher.Fetch(ctx, desc)
+		if err != nil {
+			return err
+		}
+		defer rc.Close()
+
+		eg, _ := errgroup.WithContext(ctx)
+		pr, pw := io.Pipe()
+
+		eg.Go(func() error {
+			r, err := compression.DecompressStream(pr)
+			if err != nil {
+				return err
+			}
+
+			compressMethod = r.GetCompression()
+			_, err = io.Copy(calc, r)
+			r.Close()
+			pr.CloseWithError(err)
+			return err
+		})
+
+		eg.Go(func() error {
+			defer pw.Close()
+
+			return content.Copy(ctx, cw, io.TeeReader(rc, pw), ingestDesc.Size, ingestDesc.Digest)
+		})
+
+		if err := eg.Wait(); err != nil {
+			return err
+		}
+	}
+
+	if desc.Size == -1 {
+		info, err := c.contentStore.Info(ctx, desc.Digest)
+		if err != nil {
+			return fmt.Errorf("failed to get blob info: %w", err)
+		}
+		desc.Size = info.Size
+	}
+
+	if compressMethod == compression.Uncompressed {
+		log.G(ctx).WithField("id", desc.Digest).Debugf("changed media type for uncompressed schema1 layer blob")
+		desc.MediaType = images.MediaTypeDockerSchema2Layer
+	}
+
+	state := calc.State()
+
+	cinfo := content.Info{
+		Digest: desc.Digest,
+		Labels: map[string]string{
+			"containerd.io/uncompressed": state.diffID.String(),
+			labelDockerSchema1EmptyLayer: strconv.FormatBool(state.empty),
+		},
+	}
+
+	if _, err := c.contentStore.Update(ctx, cinfo, "labels.containerd.io/uncompressed", fmt.Sprintf("labels.%s", labelDockerSchema1EmptyLayer)); err != nil {
+		return fmt.Errorf("failed to update uncompressed label: %w", err)
+	}
+
+	c.mu.Lock()
+	c.blobMap[desc.Digest] = state
+	c.layerBlobs[state.diffID] = desc
+	c.mu.Unlock()
+
+	return nil
+}
+
+func (c *Converter) reuseLabelBlobState(ctx context.Context, desc ocispec.Descriptor) (bool, error) {
+	cinfo, err := c.contentStore.Info(ctx, desc.Digest)
+	if err != nil {
+		return false, fmt.Errorf("failed to get blob info: %w", err)
+	}
+	desc.Size = cinfo.Size
+
+	diffID, ok := cinfo.Labels["containerd.io/uncompressed"]
+	if !ok {
+		return false, nil
+	}
+
+	emptyVal, ok := cinfo.Labels[labelDockerSchema1EmptyLayer]
+	if !ok {
+		return false, nil
+	}
+
+	isEmpty, err := strconv.ParseBool(emptyVal)
+	if err != nil {
+		log.G(ctx).WithField("id", desc.Digest).Warnf("failed to parse bool from label %s: %v", labelDockerSchema1EmptyLayer, isEmpty)
+		return false, nil
+	}
+
+	bState := blobState{empty: isEmpty}
+
+	if bState.diffID, err = digest.Parse(diffID); err != nil {
+		log.G(ctx).WithField("id", desc.Digest).Warnf("failed to parse digest from label containerd.io/uncompressed: %v", diffID)
+		return false, nil
+	}
+
+	// NOTE: there is no need to read header to get compression method
+	// because there are only two kinds of methods.
+	if bState.diffID == desc.Digest {
+		desc.MediaType = images.MediaTypeDockerSchema2Layer
+	} else {
+		desc.MediaType = images.MediaTypeDockerSchema2LayerGzip
+	}
+
+	c.mu.Lock()
+	c.blobMap[desc.Digest] = bState
+	c.layerBlobs[bState.diffID] = desc
+	c.mu.Unlock()
+	return true, nil
+}
+
+func (c *Converter) schema1ManifestHistory() ([]ocispec.History, []digest.Digest, error) {
+	if c.pulledManifest == nil {
+		return nil, nil, errors.New("missing schema 1 manifest for conversion")
+	}
+	m := *c.pulledManifest
+
+	if len(m.History) == 0 {
+		return nil, nil, errors.New("no history")
+	}
+
+	history := make([]ocispec.History, len(m.History))
+	diffIDs := []digest.Digest{}
+	for i := range m.History {
+		var h v1History
+		if err := json.Unmarshal([]byte(m.History[i].V1Compatibility), &h); err != nil {
+			return nil, nil, fmt.Errorf("failed to unmarshal history: %w", err)
+		}
+
+		blobSum := m.FSLayers[i].BlobSum
+
+		state := c.blobMap[blobSum]
+
+		history[len(history)-i-1] = ocispec.History{
+			Author:     h.Author,
+			Comment:    h.Comment,
+			Created:    &h.Created,
+			CreatedBy:  strings.Join(h.ContainerConfig.Cmd, " "),
+			EmptyLayer: state.empty,
+		}
+
+		if !state.empty {
+			diffIDs = append([]digest.Digest{state.diffID}, diffIDs...)
+
+		}
+	}
+
+	return history, diffIDs, nil
+}
+
+type fsLayer struct {
+	BlobSum digest.Digest `json:"blobSum"`
+}
+
+type history struct {
+	V1Compatibility string `json:"v1Compatibility"`
+}
+
+type manifest struct {
+	FSLayers  []fsLayer       `json:"fsLayers"`
+	History   []history       `json:"history"`
+	Layers    json.RawMessage `json:"layers,omitempty"`    // OCI manifest
+	Manifests json.RawMessage `json:"manifests,omitempty"` // OCI index
+}
+
+type v1History struct {
+	Author          string    `json:"author,omitempty"`
+	Created         time.Time `json:"created"`
+	Comment         string    `json:"comment,omitempty"`
+	ThrowAway       *bool     `json:"throwaway,omitempty"`
+	Size            *int      `json:"Size,omitempty"` // used before ThrowAway field
+	ContainerConfig struct {
+		Cmd []string `json:"Cmd,omitempty"`
+	} `json:"container_config,omitempty"`
+}
+
+// isEmptyLayer returns whether the v1 compatibility history describes an
+// empty layer. A return value of true indicates the layer is empty,
+// however false does not indicate non-empty.
+func isEmptyLayer(compatHistory []byte) (bool, error) {
+	var h v1History
+	if err := json.Unmarshal(compatHistory, &h); err != nil {
+		return false, err
+	}
+
+	if h.ThrowAway != nil {
+		return *h.ThrowAway, nil
+	}
+	if h.Size != nil {
+		return *h.Size == 0, nil
+	}
+
+	// If no `Size` or `throwaway` field is given, then
+	// it cannot be determined whether the layer is empty
+	// from the history, return false
+	return false, nil
+}
+
+type signature struct {
+	Signatures []jsParsedSignature `json:"signatures"`
+}
+
+type jsParsedSignature struct {
+	Protected string `json:"protected"`
+}
+
+type protectedBlock struct {
+	Length int    `json:"formatLength"`
+	Tail   string `json:"formatTail"`
+}
+
+// joseBase64UrlDecode decodes the given string using the standard base64 url
+// decoder but first adds the appropriate number of trailing '=' characters in
+// accordance with the jose specification.
+// http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-31#section-2
+func joseBase64UrlDecode(s string) ([]byte, error) {
+	switch len(s) % 4 {
+	case 0:
+	case 2:
+		s += "=="
+	case 3:
+		s += "="
+	default:
+		return nil, errors.New("illegal base64url string")
+	}
+	return base64.URLEncoding.DecodeString(s)
+}
+
+func stripSignature(b []byte) ([]byte, error) {
+	var sig signature
+	if err := json.Unmarshal(b, &sig); err != nil {
+		return nil, err
+	}
+	if len(sig.Signatures) == 0 {
+		return nil, errors.New("no signatures")
+	}
+	pb, err := joseBase64UrlDecode(sig.Signatures[0].Protected)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode %s: %w", sig.Signatures[0].Protected, err)
+	}
+
+	var protected protectedBlock
+	if err := json.Unmarshal(pb, &protected); err != nil {
+		return nil, err
+	}
+
+	if protected.Length > len(b) {
+		return nil, errors.New("invalid protected length block")
+	}
+
+	tail, err := joseBase64UrlDecode(protected.Tail)
+	if err != nil {
+		return nil, fmt.Errorf("invalid tail base 64 value: %w", err)
+	}
+
+	return append(b[:protected.Length], tail...), nil
+}
+
+type blobStateCalculator struct {
+	empty    bool
+	digester digest.Digester
+}
+
+func newBlobStateCalculator() *blobStateCalculator {
+	return &blobStateCalculator{
+		empty:    true,
+		digester: digest.Canonical.Digester(),
+	}
+}
+
+func (c *blobStateCalculator) Write(p []byte) (int, error) {
+	if c.empty {
+		for _, b := range p {
+			if b != 0x00 {
+				c.empty = false
+				break
+			}
+		}
+	}
+	return c.digester.Hash().Write(p)
+}
+
+func (c *blobStateCalculator) State() blobState {
+	return blobState{
+		empty:  c.empty,
+		diffID: c.digester.Digest(),
+	}
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/scope.go b/vendor/github.com/containerd/containerd/remotes/docker/scope.go
new file mode 100644
index 0000000000..95b4810ab9
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/scope.go
@@ -0,0 +1,101 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+
+	"github.com/containerd/containerd/reference"
+)
+
+// RepositoryScope returns a repository scope string such as "repository:foo/bar:pull"
+// for "host/foo/bar:baz".
+// When push is true, both pull and push are added to the scope.
+func RepositoryScope(refspec reference.Spec, push bool) (string, error) {
+	u, err := url.Parse("dummy://" + refspec.Locator)
+	if err != nil {
+		return "", err
+	}
+	s := "repository:" + strings.TrimPrefix(u.Path, "/") + ":pull"
+	if push {
+		s += ",push"
+	}
+	return s, nil
+}
+
+// tokenScopesKey is used for the key for context.WithValue().
+// value: []string (e.g. {"registry:foo/bar:pull"})
+type tokenScopesKey struct{}
+
+// ContextWithRepositoryScope returns a context with tokenScopesKey{} and the repository scope value.
+func ContextWithRepositoryScope(ctx context.Context, refspec reference.Spec, push bool) (context.Context, error) {
+	s, err := RepositoryScope(refspec, push)
+	if err != nil {
+		return nil, err
+	}
+	return WithScope(ctx, s), nil
+}
+
+// WithScope appends a custom registry auth scope to the context.
+func WithScope(ctx context.Context, scope string) context.Context {
+	var scopes []string
+	if v := ctx.Value(tokenScopesKey{}); v != nil {
+		scopes = v.([]string)
+		scopes = append(scopes, scope)
+	} else {
+		scopes = []string{scope}
+	}
+	return context.WithValue(ctx, tokenScopesKey{}, scopes)
+}
+
+// ContextWithAppendPullRepositoryScope is used to append repository pull
+// scope into existing scopes indexed by the tokenScopesKey{}.
+func ContextWithAppendPullRepositoryScope(ctx context.Context, repo string) context.Context {
+	return WithScope(ctx, fmt.Sprintf("repository:%s:pull", repo))
+}
+
+// GetTokenScopes returns deduplicated and sorted scopes from ctx.Value(tokenScopesKey{}) and common scopes.
+func GetTokenScopes(ctx context.Context, common []string) []string {
+	scopes := []string{}
+	if x := ctx.Value(tokenScopesKey{}); x != nil {
+		scopes = append(scopes, x.([]string)...)
+	}
+
+	scopes = append(scopes, common...)
+	sort.Strings(scopes)
+
+	if len(scopes) == 0 {
+		return scopes
+	}
+
+	l := 0
+	for idx := 1; idx < len(scopes); idx++ {
+		// Note: this comparison is unaware of the scope grammar (https://docs.docker.com/registry/spec/auth/scope/)
+		// So, "repository:foo/bar:pull,push" != "repository:foo/bar:push,pull", although semantically they are equal.
+		if scopes[l] == scopes[idx] {
+			continue
+		}
+
+		l++
+		scopes[l] = scopes[idx]
+	}
+	return scopes[:l+1]
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/docker/status.go b/vendor/github.com/containerd/containerd/remotes/docker/status.go
new file mode 100644
index 0000000000..1f7b278aef
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/docker/status.go
@@ -0,0 +1,90 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package docker
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/moby/locker"
+)
+
+// Status of a content operation
+type Status struct {
+	content.Status
+
+	Committed bool
+
+	// ErrClosed contains error encountered on close.
+	ErrClosed error
+
+	// UploadUUID is used by the Docker registry to reference blob uploads
+	UploadUUID string
+}
+
+// StatusTracker to track status of operations
+type StatusTracker interface {
+	GetStatus(string) (Status, error)
+	SetStatus(string, Status)
+}
+
+// StatusTrackLocker to track status of operations with lock
+type StatusTrackLocker interface {
+	StatusTracker
+	Lock(string)
+	Unlock(string)
+}
+
+type memoryStatusTracker struct {
+	statuses map[string]Status
+	m        sync.Mutex
+	locker   *locker.Locker
+}
+
+// NewInMemoryTracker returns a StatusTracker that tracks content status in-memory
+func NewInMemoryTracker() StatusTrackLocker {
+	return &memoryStatusTracker{
+		statuses: map[string]Status{},
+		locker:   locker.New(),
+	}
+}
+
+func (t *memoryStatusTracker) GetStatus(ref string) (Status, error) {
+	t.m.Lock()
+	defer t.m.Unlock()
+	status, ok := t.statuses[ref]
+	if !ok {
+		return Status{}, fmt.Errorf("status for ref %v: %w", ref, errdefs.ErrNotFound)
+	}
+	return status, nil
+}
+
+func (t *memoryStatusTracker) SetStatus(ref string, status Status) {
+	t.m.Lock()
+	t.statuses[ref] = status
+	t.m.Unlock()
+}
+
+func (t *memoryStatusTracker) Lock(ref string) {
+	t.locker.Lock(ref)
+}
+
+func (t *memoryStatusTracker) Unlock(ref string) {
+	t.locker.Unlock(ref)
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/errors/errors.go b/vendor/github.com/containerd/containerd/remotes/errors/errors.go
new file mode 100644
index 0000000000..67ccb23df6
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/errors/errors.go
@@ -0,0 +1,55 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package errors
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+)
+
+var _ error = ErrUnexpectedStatus{}
+
+// ErrUnexpectedStatus is returned if a registry API request returned with unexpected HTTP status
+type ErrUnexpectedStatus struct {
+	Status                    string
+	StatusCode                int
+	Body                      []byte
+	RequestURL, RequestMethod string
+}
+
+func (e ErrUnexpectedStatus) Error() string {
+	return fmt.Sprintf("unexpected status: %s", e.Status)
+}
+
+// NewUnexpectedStatusErr creates an ErrUnexpectedStatus from HTTP response
+func NewUnexpectedStatusErr(resp *http.Response) error {
+	var b []byte
+	if resp.Body != nil {
+		b, _ = io.ReadAll(io.LimitReader(resp.Body, 64000)) // 64KB
+	}
+	err := ErrUnexpectedStatus{
+		Body:          b,
+		Status:        resp.Status,
+		StatusCode:    resp.StatusCode,
+		RequestMethod: resp.Request.Method,
+	}
+	if resp.Request.URL != nil {
+		err.RequestURL = resp.Request.URL.String()
+	}
+	return err
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/handlers.go b/vendor/github.com/containerd/containerd/remotes/handlers.go
new file mode 100644
index 0000000000..4d91ed2e54
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/handlers.go
@@ -0,0 +1,368 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package remotes
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/platforms"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/sync/semaphore"
+)
+
+type refKeyPrefix struct{}
+
+// WithMediaTypeKeyPrefix adds a custom key prefix for a media type which is used when storing
+// data in the content store from the FetchHandler.
+//
+// Used in `MakeRefKey` to determine what the key prefix should be.
+func WithMediaTypeKeyPrefix(ctx context.Context, mediaType, prefix string) context.Context {
+	var values map[string]string
+	if v := ctx.Value(refKeyPrefix{}); v != nil {
+		values = v.(map[string]string)
+	} else {
+		values = make(map[string]string)
+	}
+
+	values[mediaType] = prefix
+	return context.WithValue(ctx, refKeyPrefix{}, values)
+}
+
+// MakeRefKey returns a unique reference for the descriptor. This reference can be
+// used to lookup ongoing processes related to the descriptor. This function
+// may look to the context to namespace the reference appropriately.
+func MakeRefKey(ctx context.Context, desc ocispec.Descriptor) string {
+	key := desc.Digest.String()
+	if desc.Annotations != nil {
+		if name, ok := desc.Annotations[ocispec.AnnotationRefName]; ok {
+			key = fmt.Sprintf("%s@%s", name, desc.Digest.String())
+		}
+	}
+
+	if v := ctx.Value(refKeyPrefix{}); v != nil {
+		values := v.(map[string]string)
+		if prefix := values[desc.MediaType]; prefix != "" {
+			return prefix + "-" + key
+		}
+	}
+
+	switch mt := desc.MediaType; {
+	case mt == images.MediaTypeDockerSchema2Manifest || mt == ocispec.MediaTypeImageManifest:
+		return "manifest-" + key
+	case mt == images.MediaTypeDockerSchema2ManifestList || mt == ocispec.MediaTypeImageIndex:
+		return "index-" + key
+	case images.IsLayerType(mt):
+		return "layer-" + key
+	case images.IsKnownConfig(mt):
+		return "config-" + key
+	default:
+		log.G(ctx).Warnf("reference for unknown type: %s", mt)
+		return "unknown-" + key
+	}
+}
+
+// FetchHandler returns a handler that will fetch all content into the ingester
+// discovered in a call to Dispatch. Use with ChildrenHandler to do a full
+// recursive fetch.
+func FetchHandler(ingester content.Ingester, fetcher Fetcher) images.HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) (subdescs []ocispec.Descriptor, err error) {
+		ctx = log.WithLogger(ctx, log.G(ctx).WithFields(logrus.Fields{
+			"digest":    desc.Digest,
+			"mediatype": desc.MediaType,
+			"size":      desc.Size,
+		}))
+
+		switch desc.MediaType {
+		case images.MediaTypeDockerSchema1Manifest:
+			return nil, fmt.Errorf("%v not supported", desc.MediaType)
+		default:
+			err := fetch(ctx, ingester, fetcher, desc)
+			return nil, err
+		}
+	}
+}
+
+func fetch(ctx context.Context, ingester content.Ingester, fetcher Fetcher, desc ocispec.Descriptor) error {
+	log.G(ctx).Debug("fetch")
+
+	cw, err := content.OpenWriter(ctx, ingester, content.WithRef(MakeRefKey(ctx, desc)), content.WithDescriptor(desc))
+	if err != nil {
+		if errdefs.IsAlreadyExists(err) {
+			return nil
+		}
+		return err
+	}
+	defer cw.Close()
+
+	ws, err := cw.Status()
+	if err != nil {
+		return err
+	}
+
+	if desc.Size == 0 {
+		// most likely a poorly configured registry/web front end which responded with no
+		// Content-Length header; unable (not to mention useless) to commit a 0-length entry
+		// into the content store. Error out here otherwise the error sent back is confusing
+		return fmt.Errorf("unable to fetch descriptor (%s) which reports content size of zero: %w", desc.Digest, errdefs.ErrInvalidArgument)
+	}
+	if ws.Offset == desc.Size {
+		// If writer is already complete, commit and return
+		err := cw.Commit(ctx, desc.Size, desc.Digest)
+		if err != nil && !errdefs.IsAlreadyExists(err) {
+			return fmt.Errorf("failed commit on ref %q: %w", ws.Ref, err)
+		}
+		return nil
+	}
+
+	rc, err := fetcher.Fetch(ctx, desc)
+	if err != nil {
+		return err
+	}
+	defer rc.Close()
+
+	return content.Copy(ctx, cw, rc, desc.Size, desc.Digest)
+}
+
+// PushHandler returns a handler that will push all content from the provider
+// using a writer from the pusher.
+func PushHandler(pusher Pusher, provider content.Provider) images.HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		ctx = log.WithLogger(ctx, log.G(ctx).WithFields(logrus.Fields{
+			"digest":    desc.Digest,
+			"mediatype": desc.MediaType,
+			"size":      desc.Size,
+		}))
+
+		err := push(ctx, provider, pusher, desc)
+		return nil, err
+	}
+}
+
+func push(ctx context.Context, provider content.Provider, pusher Pusher, desc ocispec.Descriptor) error {
+	log.G(ctx).Debug("push")
+
+	var (
+		cw  content.Writer
+		err error
+	)
+	if cs, ok := pusher.(content.Ingester); ok {
+		cw, err = content.OpenWriter(ctx, cs, content.WithRef(MakeRefKey(ctx, desc)), content.WithDescriptor(desc))
+	} else {
+		cw, err = pusher.Push(ctx, desc)
+	}
+	if err != nil {
+		if !errdefs.IsAlreadyExists(err) {
+			return err
+		}
+
+		return nil
+	}
+	defer cw.Close()
+
+	ra, err := provider.ReaderAt(ctx, desc)
+	if err != nil {
+		return err
+	}
+	defer ra.Close()
+
+	rd := io.NewSectionReader(ra, 0, desc.Size)
+	return content.Copy(ctx, cw, rd, desc.Size, desc.Digest)
+}
+
+// PushContent pushes content specified by the descriptor from the provider.
+//
+// Base handlers can be provided which will be called before any push specific
+// handlers.
+func PushContent(ctx context.Context, pusher Pusher, desc ocispec.Descriptor, store content.Store, limiter *semaphore.Weighted, platform platforms.MatchComparer, wrapper func(h images.Handler) images.Handler) error {
+
+	var m sync.Mutex
+	manifestStack := []ocispec.Descriptor{}
+
+	filterHandler := images.HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		switch desc.MediaType {
+		case images.MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest,
+			images.MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex:
+			m.Lock()
+			manifestStack = append(manifestStack, desc)
+			m.Unlock()
+			return nil, images.ErrStopHandler
+		default:
+			return nil, nil
+		}
+	})
+
+	pushHandler := PushHandler(pusher, store)
+
+	platformFilterhandler := images.FilterPlatforms(images.ChildrenHandler(store), platform)
+
+	annotateHandler := annotateDistributionSourceHandler(platformFilterhandler, store)
+
+	var handler images.Handler = images.Handlers(
+		annotateHandler,
+		filterHandler,
+		pushHandler,
+	)
+	if wrapper != nil {
+		handler = wrapper(handler)
+	}
+
+	if err := images.Dispatch(ctx, handler, limiter, desc); err != nil {
+		return err
+	}
+
+	// Iterate in reverse order as seen, parent always uploaded after child
+	for i := len(manifestStack) - 1; i >= 0; i-- {
+		_, err := pushHandler(ctx, manifestStack[i])
+		if err != nil {
+			// TODO(estesp): until we have a more complete method for index push, we need to report
+			// missing dependencies in an index/manifest list by sensing the "400 Bad Request"
+			// as a marker for this problem
+			if (manifestStack[i].MediaType == ocispec.MediaTypeImageIndex ||
+				manifestStack[i].MediaType == images.MediaTypeDockerSchema2ManifestList) &&
+				errors.Unwrap(err) != nil && strings.Contains(errors.Unwrap(err).Error(), "400 Bad Request") {
+				return fmt.Errorf("manifest list/index references to blobs and/or manifests are missing in your target registry: %w", err)
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// SkipNonDistributableBlobs returns a handler that skips blobs that have a media type that is "non-distributeable".
+// An example of this kind of content would be a Windows base layer, which is not supposed to be redistributed.
+//
+// This is based on the media type of the content:
+//   - application/vnd.oci.image.layer.nondistributable
+//   - application/vnd.docker.image.rootfs.foreign
+func SkipNonDistributableBlobs(f images.HandlerFunc) images.HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		if images.IsNonDistributable(desc.MediaType) {
+			log.G(ctx).WithField("digest", desc.Digest).WithField("mediatype", desc.MediaType).Debug("Skipping non-distributable blob")
+			return nil, images.ErrSkipDesc
+		}
+
+		if images.IsLayerType(desc.MediaType) {
+			return nil, nil
+		}
+
+		children, err := f(ctx, desc)
+		if err != nil {
+			return nil, err
+		}
+		if len(children) == 0 {
+			return nil, nil
+		}
+
+		out := make([]ocispec.Descriptor, 0, len(children))
+		for _, child := range children {
+			if !images.IsNonDistributable(child.MediaType) {
+				out = append(out, child)
+			} else {
+				log.G(ctx).WithField("digest", child.Digest).WithField("mediatype", child.MediaType).Debug("Skipping non-distributable blob")
+			}
+		}
+		return out, nil
+	}
+}
+
+// FilterManifestByPlatformHandler allows Handler to handle non-target
+// platform's manifest and configuration data.
+func FilterManifestByPlatformHandler(f images.HandlerFunc, m platforms.Matcher) images.HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		children, err := f(ctx, desc)
+		if err != nil {
+			return nil, err
+		}
+
+		// no platform information
+		if desc.Platform == nil || m == nil {
+			return children, nil
+		}
+
+		var descs []ocispec.Descriptor
+		switch desc.MediaType {
+		case images.MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest:
+			if m.Match(*desc.Platform) {
+				descs = children
+			} else {
+				for _, child := range children {
+					if child.MediaType == images.MediaTypeDockerSchema2Config ||
+						child.MediaType == ocispec.MediaTypeImageConfig {
+
+						descs = append(descs, child)
+					}
+				}
+			}
+		default:
+			descs = children
+		}
+		return descs, nil
+	}
+}
+
+// annotateDistributionSourceHandler add distribution source label into
+// annotation of config or blob descriptor.
+func annotateDistributionSourceHandler(f images.HandlerFunc, manager content.Manager) images.HandlerFunc {
+	return func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		children, err := f(ctx, desc)
+		if err != nil {
+			return nil, err
+		}
+
+		// only add distribution source for the config or blob data descriptor
+		switch desc.MediaType {
+		case images.MediaTypeDockerSchema2Manifest, ocispec.MediaTypeImageManifest,
+			images.MediaTypeDockerSchema2ManifestList, ocispec.MediaTypeImageIndex:
+		default:
+			return children, nil
+		}
+
+		for i := range children {
+			child := children[i]
+
+			info, err := manager.Info(ctx, child.Digest)
+			if err != nil {
+				return nil, err
+			}
+
+			for k, v := range info.Labels {
+				if !strings.HasPrefix(k, "containerd.io/distribution.source.") {
+					continue
+				}
+
+				if child.Annotations == nil {
+					child.Annotations = map[string]string{}
+				}
+				child.Annotations[k] = v
+			}
+
+			children[i] = child
+		}
+		return children, nil
+	}
+}
diff --git a/vendor/github.com/containerd/containerd/remotes/resolver.go b/vendor/github.com/containerd/containerd/remotes/resolver.go
new file mode 100644
index 0000000000..624b14f05d
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/remotes/resolver.go
@@ -0,0 +1,82 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package remotes
+
+import (
+	"context"
+	"io"
+
+	"github.com/containerd/containerd/content"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// Resolver provides remotes based on a locator.
+type Resolver interface {
+	// Resolve attempts to resolve the reference into a name and descriptor.
+	//
+	// The argument `ref` should be a scheme-less URI representing the remote.
+	// Structurally, it has a host and path. The "host" can be used to directly
+	// reference a specific host or be matched against a specific handler.
+	//
+	// The returned name should be used to identify the referenced entity.
+	// Dependending on the remote namespace, this may be immutable or mutable.
+	// While the name may differ from ref, it should itself be a valid ref.
+	//
+	// If the resolution fails, an error will be returned.
+	Resolve(ctx context.Context, ref string) (name string, desc ocispec.Descriptor, err error)
+
+	// Fetcher returns a new fetcher for the provided reference.
+	// All content fetched from the returned fetcher will be
+	// from the namespace referred to by ref.
+	Fetcher(ctx context.Context, ref string) (Fetcher, error)
+
+	// Pusher returns a new pusher for the provided reference
+	// The returned Pusher should satisfy content.Ingester and concurrent attempts
+	// to push the same blob using the Ingester API should result in ErrUnavailable.
+	Pusher(ctx context.Context, ref string) (Pusher, error)
+}
+
+// Fetcher fetches content
+type Fetcher interface {
+	// Fetch the resource identified by the descriptor.
+	Fetch(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error)
+}
+
+// Pusher pushes content
+type Pusher interface {
+	// Push returns a content writer for the given resource identified
+	// by the descriptor.
+	Push(ctx context.Context, d ocispec.Descriptor) (content.Writer, error)
+}
+
+// FetcherFunc allows package users to implement a Fetcher with just a
+// function.
+type FetcherFunc func(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error)
+
+// Fetch content
+func (fn FetcherFunc) Fetch(ctx context.Context, desc ocispec.Descriptor) (io.ReadCloser, error) {
+	return fn(ctx, desc)
+}
+
+// PusherFunc allows package users to implement a Pusher with just a
+// function.
+type PusherFunc func(ctx context.Context, desc ocispec.Descriptor) (content.Writer, error)
+
+// Push content
+func (fn PusherFunc) Push(ctx context.Context, desc ocispec.Descriptor) (content.Writer, error) {
+	return fn(ctx, desc)
+}
diff --git a/vendor/github.com/containerd/containerd/version/version.go b/vendor/github.com/containerd/containerd/version/version.go
new file mode 100644
index 0000000000..6bc3ed178a
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/version/version.go
@@ -0,0 +1,34 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package version
+
+import "runtime"
+
+var (
+	// Package is filled at linking time
+	Package = "github.com/containerd/containerd"
+
+	// Version holds the complete version number. Filled in at linking time.
+	Version = "1.6.19+unknown"
+
+	// Revision is filled with the VCS (e.g. git) revision being used to build
+	// the program at linking time.
+	Revision = ""
+
+	// GoVersion is Go tree's version.
+	GoVersion = runtime.Version()
+)
diff --git a/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go b/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go
index 0668a66cf7..be2b343606 100644
--- a/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go
+++ b/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go
@@ -15,7 +15,7 @@ type roffRenderer struct {
 	extensions   blackfriday.Extensions
 	listCounters []int
 	firstHeader  bool
-	defineTerm   bool
+	firstDD      bool
 	listDepth    int
 }
 
@@ -42,7 +42,8 @@ const (
 	quoteCloseTag    = "\n.RE\n"
 	listTag          = "\n.RS\n"
 	listCloseTag     = "\n.RE\n"
-	arglistTag       = "\n.TP\n"
+	dtTag            = "\n.TP\n"
+	dd2Tag           = "\n"
 	tableStart       = "\n.TS\nallbox;\n"
 	tableEnd         = ".TE\n"
 	tableCellStart   = "T{\n"
@@ -90,7 +91,7 @@ func (r *roffRenderer) RenderNode(w io.Writer, node *blackfriday.Node, entering
 
 	switch node.Type {
 	case blackfriday.Text:
-		r.handleText(w, node, entering)
+		escapeSpecialChars(w, node.Literal)
 	case blackfriday.Softbreak:
 		out(w, crTag)
 	case blackfriday.Hardbreak:
@@ -150,40 +151,21 @@ func (r *roffRenderer) RenderNode(w io.Writer, node *blackfriday.Node, entering
 		out(w, codeCloseTag)
 	case blackfriday.Table:
 		r.handleTable(w, node, entering)
-	case blackfriday.TableCell:
-		r.handleTableCell(w, node, entering)
 	case blackfriday.TableHead:
 	case blackfriday.TableBody:
 	case blackfriday.TableRow:
 		// no action as cell entries do all the nroff formatting
 		return blackfriday.GoToNext
+	case blackfriday.TableCell:
+		r.handleTableCell(w, node, entering)
+	case blackfriday.HTMLSpan:
+		// ignore other HTML tags
 	default:
 		fmt.Fprintln(os.Stderr, "WARNING: go-md2man does not handle node type "+node.Type.String())
 	}
 	return walkAction
 }
 
-func (r *roffRenderer) handleText(w io.Writer, node *blackfriday.Node, entering bool) {
-	var (
-		start, end string
-	)
-	// handle special roff table cell text encapsulation
-	if node.Parent.Type == blackfriday.TableCell {
-		if len(node.Literal) > 30 {
-			start = tableCellStart
-			end = tableCellEnd
-		} else {
-			// end rows that aren't terminated by "tableCellEnd" with a cr if end of row
-			if node.Parent.Next == nil && !node.Parent.IsHeader {
-				end = crTag
-			}
-		}
-	}
-	out(w, start)
-	escapeSpecialChars(w, node.Literal)
-	out(w, end)
-}
-
 func (r *roffRenderer) handleHeading(w io.Writer, node *blackfriday.Node, entering bool) {
 	if entering {
 		switch node.Level {
@@ -230,15 +212,20 @@ func (r *roffRenderer) handleItem(w io.Writer, node *blackfriday.Node, entering
 		if node.ListFlags&blackfriday.ListTypeOrdered != 0 {
 			out(w, fmt.Sprintf(".IP \"%3d.\" 5\n", r.listCounters[len(r.listCounters)-1]))
 			r.listCounters[len(r.listCounters)-1]++
+		} else if node.ListFlags&blackfriday.ListTypeTerm != 0 {
+			// DT (definition term): line just before DD (see below).
+			out(w, dtTag)
+			r.firstDD = true
 		} else if node.ListFlags&blackfriday.ListTypeDefinition != 0 {
-			// state machine for handling terms and following definitions
-			// since blackfriday does not distinguish them properly, nor
-			// does it seperate them into separate lists as it should
-			if !r.defineTerm {
-				out(w, arglistTag)
-				r.defineTerm = true
+			// DD (definition description): line that starts with ": ".
+			//
+			// We have to distinguish between the first DD and the
+			// subsequent ones, as there should be no vertical
+			// whitespace between the DT and the first DD.
+			if r.firstDD {
+				r.firstDD = false
 			} else {
-				r.defineTerm = false
+				out(w, dd2Tag)
 			}
 		} else {
 			out(w, ".IP \\(bu 2\n")
@@ -251,7 +238,7 @@ func (r *roffRenderer) handleItem(w io.Writer, node *blackfriday.Node, entering
 func (r *roffRenderer) handleTable(w io.Writer, node *blackfriday.Node, entering bool) {
 	if entering {
 		out(w, tableStart)
-		//call walker to count cells (and rows?) so format section can be produced
+		// call walker to count cells (and rows?) so format section can be produced
 		columns := countColumns(node)
 		out(w, strings.Repeat("l ", columns)+"\n")
 		out(w, strings.Repeat("l ", columns)+".\n")
@@ -261,28 +248,41 @@ func (r *roffRenderer) handleTable(w io.Writer, node *blackfriday.Node, entering
 }
 
 func (r *roffRenderer) handleTableCell(w io.Writer, node *blackfriday.Node, entering bool) {
-	var (
-		start, end string
-	)
-	if node.IsHeader {
-		start = codespanTag
-		end = codespanCloseTag
-	}
 	if entering {
+		var start string
 		if node.Prev != nil && node.Prev.Type == blackfriday.TableCell {
-			out(w, "\t"+start)
-		} else {
-			out(w, start)
+			start = "\t"
+		}
+		if node.IsHeader {
+			start += codespanTag
+		} else if nodeLiteralSize(node) > 30 {
+			start += tableCellStart
 		}
+		out(w, start)
 	} else {
-		// need to carriage return if we are at the end of the header row
-		if node.IsHeader && node.Next == nil {
-			end = end + crTag
+		var end string
+		if node.IsHeader {
+			end = codespanCloseTag
+		} else if nodeLiteralSize(node) > 30 {
+			end = tableCellEnd
+		}
+		if node.Next == nil && end != tableCellEnd {
+			// Last cell: need to carriage return if we are at the end of the
+			// header row and content isn't wrapped in a "tablecell"
+			end += crTag
 		}
 		out(w, end)
 	}
 }
 
+func nodeLiteralSize(node *blackfriday.Node) int {
+	total := 0
+	for n := node.FirstChild; n != nil; n = n.FirstChild {
+		total += len(n.Literal)
+	}
+	return total
+}
+
 // because roff format requires knowing the column count before outputting any table
 // data we need to walk a table tree and count the columns
 func countColumns(node *blackfriday.Node) int {
@@ -309,15 +309,6 @@ func out(w io.Writer, output string) {
 	io.WriteString(w, output) // nolint: errcheck
 }
 
-func needsBackslash(c byte) bool {
-	for _, r := range []byte("-_&\\~") {
-		if c == r {
-			return true
-		}
-	}
-	return false
-}
-
 func escapeSpecialChars(w io.Writer, text []byte) {
 	for i := 0; i < len(text); i++ {
 		// escape initial apostrophe or period
@@ -328,7 +319,7 @@ func escapeSpecialChars(w io.Writer, text []byte) {
 		// directly copy normal characters
 		org := i
 
-		for i < len(text) && !needsBackslash(text[i]) {
+		for i < len(text) && text[i] != '\\' {
 			i++
 		}
 		if i > org {
diff --git a/vendor/github.com/dgraph-io/badger/v3/.go-version b/vendor/github.com/dgraph-io/badger/v3/.go-version
new file mode 100644
index 0000000000..adc97d8e22
--- /dev/null
+++ b/vendor/github.com/dgraph-io/badger/v3/.go-version
@@ -0,0 +1 @@
+1.18
diff --git a/vendor/github.com/dgraph-io/badger/v3/.golangci.yml b/vendor/github.com/dgraph-io/badger/v3/.golangci.yml
index fecb8644b8..81060fb1c1 100644
--- a/vendor/github.com/dgraph-io/badger/v3/.golangci.yml
+++ b/vendor/github.com/dgraph-io/badger/v3/.golangci.yml
@@ -3,25 +3,19 @@ run:
 
 linters-settings:
   lll:
-    line-length: 100
+    line-length: 120
 
 linters:
   disable-all: true
   enable:
-    - errcheck
-    - ineffassign
-    - gas
+#   - errcheck
+#   - ineffassign
+#   - gas
     - gofmt
-    - golint
+#   - golint
     - gosimple
     - govet
     - lll
-    - varcheck
-    - unused
-
-issues:
-  exclude-rules:
-    - linters:
-        - gosec
-      text: "G404: "
-      
\ No newline at end of file
+#   - varcheck
+#   - unused
+#   - gosec
diff --git a/vendor/github.com/dgraph-io/badger/v3/.travis.yml b/vendor/github.com/dgraph-io/badger/v3/.travis.yml
deleted file mode 100644
index b671868f3c..0000000000
--- a/vendor/github.com/dgraph-io/badger/v3/.travis.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-language: go
-
-go:
-  - "1.12"
-  - "1.13"
-  - tip
-os:
-  - osx
-env:
-  jobs:
-  - GOARCH=386
-  - GOARCH=amd64
-  global:
-  - secure: CRkV2+/jlO0gXzzS50XGxfMS117FNwiVjxNY/LeWq06RKD+dDCPxTJl3JCNe3l0cYEPAglV2uMMYukDiTqJ7e+HI4nh4N4mv6lwx39N8dAvJe1x5ITS2T4qk4kTjuQb1Q1vw/ZOxoQqmvNKj2uRmBdJ/HHmysbRJ1OzCWML3OXdUwJf0AYlJzTjpMfkOKr7sTtE4rwyyQtd4tKH1fGdurgI9ZuFd9qvYxK2qcJhsQ6CNqMXt+7FkVkN1rIPmofjjBTNryzUr4COFXuWH95aDAif19DeBW4lbNgo1+FpDsrgmqtuhl6NAuptI8q/imow2KXBYJ8JPXsxW8DVFj0IIp0RCd3GjaEnwBEbxAyiIHLfW7AudyTS/dJOvZffPqXnuJ8xj3OPIdNe4xY0hWl8Ju2HhKfLOAHq7VadHZWd3IHLil70EiL4/JLD1rNbMImUZisFaA8pyrcIvYYebjOnk4TscwKFLedClRSX1XsMjWWd0oykQtrdkHM2IxknnBpaLu7mFnfE07f6dkG0nlpyu4SCLey7hr5FdcEmljA0nIxTSYDg6035fQkBEAbe7hlESOekkVNT9IZPwG+lmt3vU4ofi6NqNbJecOuSB+h36IiZ9s4YQtxYNnLgW14zjuFGGyT5smc3IjBT7qngDjKIgyrSVoRkY/8udy9qbUgvBeW8=
-
-
-jobs:
-  allow_failures:
-    - go: tip
-  exclude:
-    # Exclude builds for 386 architecture on go 1.12 and tip
-    # Since we don't want it to run for 32 bit
-    - go: "1.12"
-      env: GOARCH=386
-    - go: tip
-      env: GOARCH=386
-  include:
-    # Define one extra linux build, which we use to run cross
-    # compiled 32 bit tests
-    - os: linux
-      arch: arm64
-      go: "1.14"
-      env: go_32=yes
-
-notifications:
-  email: false
-  slack:
-    secure: X7uBLWYbuUhf8QFE16CoS5z7WvFR8EN9j6cEectMW6mKZ3vwXGwVXRIPsgUq/606DsQdCCx34MR8MRWYGlu6TBolbSe9y0EP0i46yipPz22YtuT7umcVUbGEyx8MZKgG0v1u/zA0O4aCsOBpGAA3gxz8h3JlEHDt+hv6U8xRsSllVLzLSNb5lwxDtcfEDxVVqP47GMEgjLPM28Pyt5qwjk7o5a4YSVzkfdxBXxd3gWzFUWzJ5E3cTacli50dK4GVfiLcQY2aQYoYO7AAvDnvP+TPfjDkBlUEE4MUz5CDIN51Xb+WW33sX7g+r3Bj7V5IRcF973RiYkpEh+3eoiPnyWyxhDZBYilty3b+Hysp6d4Ov/3I3ll7Bcny5+cYjakjkMH3l9w3gs6Y82GlpSLSJshKWS8vPRsxFe0Pstj6QSJXTd9EBaFr+l1ScXjJv/Sya9j8N9FfTuOTESWuaL1auX4Y7zEEVHlA8SCNOO8K0eTfxGZnC/YcIHsR8rePEAcFxfOYQppkyLF/XvAtnb/LMUuu0g4y2qNdme6Oelvyar1tFEMRtbl4mRCdu/krXBFtkrsfUaVY6WTPdvXAGotsFJ0wuA53zGVhlcd3+xAlSlR3c1QX95HIMeivJKb5L4nTjP+xnrmQNtnVk+tG4LSH2ltuwcZSSczModtcBmRefrk=
-
-script: >-
-    if [ $TRAVIS_OS_NAME = "linux" ] && [ $go_32 ]; then
-      uname -a
-      GOOS=linux GOARCH=arm go test -v ./...
-    else
-      go test -v ./...
-      # Cross-compile for Plan 9
-      GOOS=plan9 go build ./...
-    fi
diff --git a/vendor/github.com/dgraph-io/badger/v3/CHANGELOG.md b/vendor/github.com/dgraph-io/badger/v3/CHANGELOG.md
index aae5f0f9b5..28648bbea9 100644
--- a/vendor/github.com/dgraph-io/badger/v3/CHANGELOG.md
+++ b/vendor/github.com/dgraph-io/badger/v3/CHANGELOG.md
@@ -3,6 +3,16 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
+## [3.2103.3] - 2022-10-14
+
+### Remarks
+
+  - This is a minor patch release that fixes arm64 related issues.  The issues in the `z` package in Ristretto were resolved in Ristretto v0.1.1.
+
+### Fixed
+
+  -  fix(arm64): bump ristretto v0.1.0 --> v0.1.1 (#1806)
+
 ## [3.2103.2] - 2021-10-07
 
 ### Fixed
diff --git a/vendor/github.com/dgraph-io/badger/v3/Makefile b/vendor/github.com/dgraph-io/badger/v3/Makefile
new file mode 100644
index 0000000000..b3e2ac1222
--- /dev/null
+++ b/vendor/github.com/dgraph-io/badger/v3/Makefile
@@ -0,0 +1,60 @@
+#
+# Copyright 2022 Dgraph Labs, Inc. and Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+USER_ID      = $(shell id -u)
+HAS_JEMALLOC = $(shell test -f /usr/local/lib/libjemalloc.a && echo "jemalloc")
+JEMALLOC_URL = "https://github.com/jemalloc/jemalloc/releases/download/5.2.1/jemalloc-5.2.1.tar.bz2"
+
+
+.PHONY: all badger test jemalloc dependency
+
+badger: jemalloc
+	@echo "Compiling Badger binary..."
+	@$(MAKE) -C badger badger
+	@echo "Badger binary located in badger directory."
+
+test: jemalloc
+	@echo "Running Badger tests..."
+	@./test.sh
+
+jemalloc:
+	@if [ -z "$(HAS_JEMALLOC)" ] ; then \
+		mkdir -p /tmp/jemalloc-temp && cd /tmp/jemalloc-temp ; \
+		echo "Downloading jemalloc..." ; \
+		curl -s -L ${JEMALLOC_URL} -o jemalloc.tar.bz2 ; \
+		tar xjf ./jemalloc.tar.bz2 ; \
+		cd jemalloc-5.2.1 ; \
+		./configure --with-jemalloc-prefix='je_' --with-malloc-conf='background_thread:true,metadata_thp:auto'; \
+		make ; \
+		if [ "$(USER_ID)" -eq "0" ]; then \
+			make install ; \
+		else \
+			echo "==== Need sudo access to install jemalloc" ; \
+			sudo make install ; \
+		fi \
+	fi
+
+dependency:
+	@echo "Installing dependencies..."
+	@sudo apt-get update
+	@sudo apt-get -y upgrade
+	@sudo apt-get -y install \
+    	ca-certificates \
+    	curl \
+    	gnupg \
+    	lsb-release \
+    	build-essential \
+    	protobuf-compiler \
diff --git a/vendor/github.com/dgraph-io/badger/v3/README.md b/vendor/github.com/dgraph-io/badger/v3/README.md
index aef00efc05..e6a7cf4cbc 100644
--- a/vendor/github.com/dgraph-io/badger/v3/README.md
+++ b/vendor/github.com/dgraph-io/badger/v3/README.md
@@ -1,4 +1,12 @@
-# BadgerDB [![Go Reference](https://pkg.go.dev/badge/github.com/dgraph-io/badger/v3.svg)](https://pkg.go.dev/github.com/dgraph-io/badger/v3) [![Go Report Card](https://goreportcard.com/badge/github.com/dgraph-io/badger)](https://goreportcard.com/report/github.com/dgraph-io/badger) [![Sourcegraph](https://sourcegraph.com/github.com/dgraph-io/badger/-/badge.svg)](https://sourcegraph.com/github.com/dgraph-io/badger?badge) [![Build Status](https://teamcity.dgraph.io/guestAuth/app/rest/builds/buildType:(id:Badger_UnitTests)/statusIcon.svg)](https://teamcity.dgraph.io/viewLog.html?buildTypeId=Badger_UnitTests&buildId=lastFinished&guest=1) ![Appveyor](https://ci.appveyor.com/api/projects/status/github/dgraph-io/badger?branch=master&svg=true) [![Coverage Status](https://coveralls.io/repos/github/dgraph-io/badger/badge.svg?branch=master)](https://coveralls.io/github/dgraph-io/badger?branch=master)
+# BadgerDB 
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/dgraph-io/badger/v3.svg)](https://pkg.go.dev/github.com/dgraph-io/badger/v3) 
+[![Go Report Card](https://goreportcard.com/badge/github.com/dgraph-io/badger/v3)](https://goreportcard.com/report/github.com/dgraph-io/badger/v3) 
+[![Sourcegraph](https://sourcegraph.com/github.com/dgraph-io/badger/-/badge.svg)](https://sourcegraph.com/github.com/dgraph-io/badger?badge)
+[![ci-badger-tests](https://github.com/dgraph-io/badger/actions/workflows/ci-badger-tests.yml/badge.svg)](https://github.com/dgraph-io/badger/actions/workflows/ci-badger-tests.yml)
+[![ci-badger-bank-tests](https://github.com/dgraph-io/badger/actions/workflows/ci-badger-bank-tests.yml/badge.svg)](https://github.com/dgraph-io/badger/actions/workflows/ci-badger-bank-tests.yml)
+[![ci-golang-lint](https://github.com/dgraph-io/badger/actions/workflows/ci-golang-lint.yml/badge.svg)](https://github.com/dgraph-io/badger/actions/workflows/ci-golang-lint.yml)
+
 
 ![Badger mascot](images/diggy-shadow.png)
 
@@ -7,9 +15,7 @@ in pure Go. It is the underlying database for [Dgraph](https://dgraph.io), a
 fast, distributed graph database. It's meant to be a performant alternative to
 non-Go-based key-value stores like RocksDB.
 
-**Use [Discuss Issues](https://discuss.dgraph.io/c/issues/badger/37) for reporting issues about this repository.**
-
-## Project Status [March 24, 2020]
+## Project Status
 
 Badger is stable and is being used to serve data sets worth hundreds of
 terabytes. Badger supports concurrent ACID transactions with serializable
@@ -27,7 +33,9 @@ with v1.0 is v1.6.0.
 Badger v2.0 was released in Nov 2019 with a new storage format which won't
 be compatible with all of the v1.x. Badger v2.0 supports compression, encryption and uses a cache to speed up lookup.
 
-The [Changelog] is kept fairly up-to-date.
+Badger v3.0 was released in January 2021.  This release improves compaction performance.
+
+Please consult the [Changelog] for more detailed information on releases.
 
 For more details on our version naming schema please read [Choosing a version](#choosing-a-version).
 
@@ -51,7 +59,7 @@ For more details on our version naming schema please read [Choosing a version](#
 ## Getting Started
 
 ### Installing
-To start using Badger, install Go 1.12 or above. Badger v2 needs go modules. Run the following command to retrieve the library.
+To start using Badger, install Go 1.12 or above. Badger v3 needs go modules. From your project, run the following command
 
 ```sh
 $ go get github.com/dgraph-io/badger/v3
@@ -60,13 +68,14 @@ This will retrieve the library.
 
 #### Installing Badger Command Line Tool
 
-Download and extract the latest Badger DB release from https://github.com/dgraph-io/badger/releases and then run the following commands.
+Badger provides a CLI tool which can perform certain operations like offline backup/restore.  To install the Badger CLI, 
+retrieve the repository and checkout the desired version.  Then run
 
 ```sh
-$ cd badger-<version>/badger
-$ go install
+$ cd badger
+$ go install .
 ```
-This will install the badger command line utility into your $GOBIN path.
+This will install the badger command line utility into your $GOBIN path. 
 
 #### Choosing a version
 
@@ -86,9 +95,12 @@ Following these rules:
  version is the same, therefore the data format on disk is compatible.
 - v1.6.0 and v2.0.0 are data incompatible as their major version implies, so files created with
  v1.6.0 will need to be converted into the new format before they can be used by v2.0.0.
+ - v2.x.x and v3.x.x are data incompatible as their major version implies, so files created with
+ v2.x.x will need to be converted into the new format before they can be used by v3.0.0.
+
 
 For a longer explanation on the reasons behind using a new versioning naming schema, you can read
-[VERSIONING.md](VERSIONING.md).
+[VERSIONING](VERSIONING.md).
 
 ## Badger Documentation
 
@@ -99,9 +111,9 @@ Badger Documentation is available at https://dgraph.io/docs/badger
 ### Blog Posts
 1. [Introducing Badger: A fast key-value store written natively in
 Go](https://open.dgraph.io/post/badger/)
-2. [Make Badger crash resilient with ALICE](https://blog.dgraph.io/post/alice/)
-3. [Badger vs LMDB vs BoltDB: Benchmarking key-value databases in Go](https://blog.dgraph.io/post/badger-lmdb-boltdb/)
-4. [Concurrent ACID Transactions in Badger](https://blog.dgraph.io/post/badger-txn/)
+2. [Make Badger crash resilient with ALICE](https://open.dgraph.io/post/alice/)
+3. [Badger vs LMDB vs BoltDB: Benchmarking key-value databases in Go](https://open.dgraph.io/post/badger-lmdb-boltdb/)
+4. [Concurrent ACID Transactions in Badger](https://open.dgraph.io/post/badger-txn/)
 
 ## Design
 Badger was written with these design goals in mind:
@@ -167,6 +179,7 @@ Below is a list of known projects that use Badger:
 * [Immudb](https://github.com/codenotary/immudb) - Lightweight, high-speed immutable database for systems and applications.
 * [Usenet Express](https://usenetexpress.com/) - Serving over 300TB of data with Badger.
 * [gorush](https://github.com/appleboy/gorush) - A push notification server written in Go.
+* [0-stor](https://github.com/zero-os/0-stor) - Single device object store.
 * [Dispatch Protocol](https://github.com/dispatchlabs/disgo) - Blockchain protocol for distributed application data analytics.
 * [GarageMQ](https://github.com/valinurovam/garagemq) - AMQP server written in Go.
 * [RedixDB](https://alash3al.github.io/redix/) - A real-time persistent key-value store with the same redis protocol.
@@ -189,15 +202,23 @@ Below is a list of known projects that use Badger:
 * [Terminotes](https://gitlab.com/asad-awadia/terminotes) - Self hosted notes storage and search server - storage powered by BadgerDB
 * [Pyroscope](https://github.com/pyroscope-io/pyroscope) - Open source confinuous profiling platform built with BadgerDB
 * [Veri](https://github.com/bgokden/veri) - A distributed feature store optimized for Search and Recommendation tasks.
+* [bIter](https://github.com/MikkelHJuul/bIter) - A library and Iterator interface for working with the `badger.Iterator`, simplifying from-to, and prefix mechanics.
+* [ld](https://github.com/MikkelHJuul/ld) - (Lean Database) A very simple gRPC-only key-value database, exposing BadgerDB with key-range scanning semantics.
+* [Souin](https://github.com/darkweak/Souin) - A RFC compliant HTTP cache with lot of other features based on Badger for the storage. Compatible with all existing reverse-proxies.
+* [Xuperchain](https://github.com/xuperchain/xupercore) - A highly flexible blockchain architecture with great transaction performance.
+* [m2](https://github.com/qichengzx/m2) - A simple http key/value store based on the raft protocol.
+* [chaindb](https://github.com/ChainSafe/chaindb) - A blockchain storage layer used by [Gossamer](https://chainsafe.github.io/gossamer/), a Go client for the [Polkadot Network](https://polkadot.network/).
+* [vxdb](https://github.com/vitalvas/vxdb) - Simple schema-less Key-Value NoSQL database with simplest API interface.
+* [Opacity](https://github.com/opacity/storage-node) - Backend implementation for the Opacity storage project
+* [Vephar](https://github.com/vaccovecrana/vephar) - A minimal key/value store using hashicorp-raft for cluster coordination and Badger for data storage.
 
 If you are using Badger in a project please send a pull request to add it to the list.
 
 ## Contributing
 
-If you're interested in contributing to Badger see [CONTRIBUTING.md](./CONTRIBUTING.md).
+If you're interested in contributing to Badger see [CONTRIBUTING](./CONTRIBUTING.md).
 
 ## Contact
 - Please use [discuss.dgraph.io](https://discuss.dgraph.io) for questions, feature requests and discussions.
-- Please use [Github issue tracker](https://github.com/dgraph-io/badger/issues) for filing bugs or feature requests.
-- Follow us on Twitter [@dgraphlabs](https://twitter.com/dgraphlabs).
-
+- Please use [discuss.dgraph.io](https://discuss.dgraph.io) for filing bugs or feature requests.
+- Follow us on Twitter [@dgraphlabs](https://twitter.com/dgraphlabs).
\ No newline at end of file
diff --git a/vendor/github.com/dgraph-io/badger/v3/go.mod b/vendor/github.com/dgraph-io/badger/v3/go.mod
deleted file mode 100644
index 28da3cc366..0000000000
--- a/vendor/github.com/dgraph-io/badger/v3/go.mod
+++ /dev/null
@@ -1,26 +0,0 @@
-module github.com/dgraph-io/badger/v3
-
-go 1.12
-
-// replace github.com/dgraph-io/ristretto => /home/amanbansal/go/src/github.com/dgraph-io/ristretto
-
-require (
-	github.com/cespare/xxhash v1.1.0
-	github.com/dgraph-io/ristretto v0.1.0
-	github.com/dustin/go-humanize v1.0.0
-	github.com/gogo/protobuf v1.3.2
-	github.com/golang/protobuf v1.3.1
-	github.com/golang/snappy v0.0.3
-	github.com/google/flatbuffers v1.12.1
-	github.com/google/go-cmp v0.5.4 // indirect
-	github.com/klauspost/compress v1.12.3
-	github.com/kr/pretty v0.1.0 // indirect
-	github.com/pkg/errors v0.9.1
-	github.com/spaolacci/murmur3 v1.1.0 // indirect
-	github.com/spf13/cobra v0.0.5
-	github.com/stretchr/testify v1.4.0
-	go.opencensus.io v0.22.5
-	golang.org/x/net v0.0.0-20201021035429-f5854403a974
-	golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
-)
diff --git a/vendor/github.com/dgraph-io/badger/v3/go.sum b/vendor/github.com/dgraph-io/badger/v3/go.sum
deleted file mode 100644
index cdeb960ea4..0000000000
--- a/vendor/github.com/dgraph-io/badger/v3/go.sum
+++ /dev/null
@@ -1,146 +0,0 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/OneOfOne/xxhash v1.2.2 h1:KMrpdQIwFcEqXDklaen+P1axHaj9BSKzvpUUfnHldSE=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgraph-io/ristretto v0.1.0 h1:Jv3CGQHp9OjuMBSne1485aDpUkTKEcUqF+jm/LuerPI=
-github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6 h1:ZgQEtGgCBiWRM39fZuwSd1LwSqqSW0hOdXCYYDX0R3I=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/snappy v0.0.3 h1:fHPg5GQYlCeLIPB9BZqMVR5nR9A+IM5zcgeTdjMYmLA=
-github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/flatbuffers v1.12.1 h1:MVlul7pQNoDzWRLTw5imwYsl+usrS1TXG2H4jg6ImGw=
-github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.5.4 h1:L8R9j+yAqZuZjsqh/z+F1NCffTKKLShY6zXTItVIZ8M=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.12.3 h1:G5AfA94pHPysR56qqrkO2pxEexdDzrpFJ6yt/VqWxVU=
-github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
-github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.5 h1:f0B+LkLX6DtmRH1isoNA9VTtNUK9K8xYd28JNNfOv/s=
-github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
-github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.22.5 h1:dntmOdLpSpHlVqbW5Eay97DelsZHe+55D+xC6i0dDS0=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974 h1:IX6qOQeG5uLjB/hjjwjedwfjND0hgjPMMyO1RoIXQNI=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c h1:VwygUrnw9jn88c4u8GD3rZQbqrP/tgas88tPUbBxQrk=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb h1:i1Ppqkc3WQXikh8bXiwHqAN5Rv3/qDCcRk0/Otx73BY=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1 h1:Hz2g2wirWK7H0qIIhGIqRGTuMwTE8HEKFnDZZ7lm9NU=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/vendor/github.com/dgraph-io/badger/v3/manifest.go b/vendor/github.com/dgraph-io/badger/v3/manifest.go
index bb27fb2477..7face8b476 100644
--- a/vendor/github.com/dgraph-io/badger/v3/manifest.go
+++ b/vendor/github.com/dgraph-io/badger/v3/manifest.go
@@ -208,15 +208,14 @@ func (mf *manifestFile) addChanges(changesParam []*pb.ManifestChange) error {
 
 	// Maybe we could use O_APPEND instead (on certain file systems)
 	mf.appendLock.Lock()
+	defer mf.appendLock.Unlock()
 	if err := applyChangeSet(&mf.manifest, &changes); err != nil {
-		mf.appendLock.Unlock()
 		return err
 	}
 	// Rewrite manifest if it'd shrink by 1/10 and it's big enough to care
 	if mf.manifest.Deletions > mf.deletionsRewriteThreshold &&
 		mf.manifest.Deletions > manifestDeletionsRatio*(mf.manifest.Creations-mf.manifest.Deletions) {
 		if err := mf.rewrite(); err != nil {
-			mf.appendLock.Unlock()
 			return err
 		}
 	} else {
@@ -225,15 +224,16 @@ func (mf *manifestFile) addChanges(changesParam []*pb.ManifestChange) error {
 		binary.BigEndian.PutUint32(lenCrcBuf[4:8], crc32.Checksum(buf, y.CastagnoliCrcTable))
 		buf = append(lenCrcBuf[:], buf...)
 		if _, err := mf.fp.Write(buf); err != nil {
-			mf.appendLock.Unlock()
 			return err
 		}
 	}
 
-	mf.appendLock.Unlock()
-	return mf.fp.Sync()
+	return syncFunc(mf.fp)
 }
 
+// this function is saved here to allow injection of fake filesystem latency at test time.
+var syncFunc = func(f *os.File) error { return f.Sync() }
+
 // Has to be 4 bytes.  The value can never change, ever, anyway.
 var magicText = [4]byte{'B', 'd', 'g', 'r'}
 
diff --git a/vendor/github.com/dgraph-io/badger/v3/test.sh b/vendor/github.com/dgraph-io/badger/v3/test.sh
index 6922eed0bf..15122767e3 100644
--- a/vendor/github.com/dgraph-io/badger/v3/test.sh
+++ b/vendor/github.com/dgraph-io/badger/v3/test.sh
@@ -4,48 +4,27 @@ set -eo pipefail
 
 go version
 
+# Check if Github Actions is running
+if [ $CI = "true" ]; then
+  # Enable code coverage
+  # export because tests run in a subprocess
+  export covermode="-covermode=atomic"
+  export coverprofile="-coverprofile=cover_tmp.out"
+  echo "mode: atomic" >> cover.out
+fi
+
 # Run `go list` BEFORE setting GOFLAGS so that the output is in the right
 # format for grep.
 # export packages because the test will run in a sub process.
 export packages=$(go list ./... | grep "github.com/dgraph-io/badger/v3/")
 
-if [[ ! -z "$TEAMCITY_VERSION" ]]; then
-  export GOFLAGS="-json"
-fi
-
-function InstallJemalloc() {
-  pushd .
-  if [ ! -f /usr/local/lib/libjemalloc.a ]; then
-		USER_ID=`id -u`
-    	JEMALLOC_URL="https://github.com/jemalloc/jemalloc/releases/download/5.2.1/jemalloc-5.2.1.tar.bz2"
-
-		mkdir -p /tmp/jemalloc-temp && cd /tmp/jemalloc-temp ;
-		echo "Downloading jemalloc" ;
-		curl -s -L ${JEMALLOC_URL} -o jemalloc.tar.bz2 ;
-		tar xjf ./jemalloc.tar.bz2 ;
-		cd jemalloc-5.2.1 ;
-		./configure --with-jemalloc-prefix='je_' ;
-		make ;
-		if [ "$USER_ID" -eq "0" ]; then
-			make install ;
-		else
-			echo "==== Need sudo access to install jemalloc" ;
-			sudo make install ;
-		fi
-	fi
-  popd
-}
-
 tags="-tags=jemalloc"
 
-# Ensure that we can compile the binary.
+# Compile the Badger binary
 pushd badger
 go build -v $tags .
 popd
 
-# tags=""
-InstallJemalloc
-
 # Run the memory intensive tests first.
 manual() {
   timeout="-timeout 2m"
@@ -53,7 +32,7 @@ manual() {
   set -e
   for pkg in $packages; do
     echo "===> Testing $pkg"
-    go test $tags -timeout=25m -race $pkg -parallel 16
+    go test $tags -timeout=25m $covermode $coverprofile -race -parallel 16 $pkg && write_coverage
   done
   echo "==> DONE package tests"
 
@@ -61,10 +40,10 @@ manual() {
   # Run the special Truncate test.
   rm -rf p
   set -e
-  go test $tags $timeout -run='TestTruncateVlogNoClose$' --manual=true
+  go test $tags $timeout $covermode $coverprofile -run='TestTruncateVlogNoClose$' --manual=true && write_coverage
   truncate --size=4096 p/000000.vlog
-  go test $tags $timeout -run='TestTruncateVlogNoClose2$' --manual=true
-  go test $tags $timeout -run='TestTruncateVlogNoClose3$' --manual=true
+  go test $tags $timeout $covermode $coverprofile -run='TestTruncateVlogNoClose2$' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestTruncateVlogNoClose3$' --manual=true && write_coverage
   rm -rf p
 
   # TODO(ibrahim): Let's make these tests have Manual prefix.
@@ -73,14 +52,14 @@ manual() {
   # TestValueGCManaged
   # TestDropPrefix
   # TestDropAllManaged
-  go test $tags $timeout -run='TestBigKeyValuePairs$' --manual=true
-  go test $tags $timeout -run='TestPushValueLogLimit' --manual=true
-  go test $tags $timeout -run='TestKeyCount' --manual=true
-  go test $tags $timeout -run='TestIteratePrefix' --manual=true
-  go test $tags $timeout -run='TestIterateParallel' --manual=true
-  go test $tags $timeout -run='TestBigStream' --manual=true
-  go test $tags $timeout -run='TestGoroutineLeak' --manual=true
-  go test $tags $timeout -run='TestGetMore' --manual=true
+  go test $tags $timeout $covermode $coverprofile -run='TestBigKeyValuePairs$' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestPushValueLogLimit' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestKeyCount' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestIteratePrefix' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestIterateParallel' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestBigStream' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestGoroutineLeak' --manual=true && write_coverage
+  go test $tags $timeout $covermode $coverprofile -run='TestGetMore' --manual=true && write_coverage
 
   echo "==> DONE manual tests"
 }
@@ -91,7 +70,7 @@ root() {
 
   echo "==> Running root level tests."
   set -e
-  go test $tags -timeout=25m . -v -race -parallel 16
+  go test $tags -v -race -parallel=16 -timeout=25m $covermode $coverprofile . && write_coverage
   echo "==> DONE root level tests"
 }
 
@@ -110,11 +89,23 @@ stream() {
     return 1
   fi
   echo "==> DONE stream test"
+  popd
   return 0
 }
 
-export -f stream
-export -f manual
-export -f root
+write_coverage() {
+  if [ $CI = "true" ]; then
+    if [ -f cover_tmp.out ]; then
+      sed -i '1d' cover_tmp.out
+      cat cover_tmp.out >> cover.out && rm cover_tmp.out
+    fi
+  fi
+  
+}
 
-parallel --halt now,fail=1 --progress --line-buffer ::: stream manual root
+# parallel tests currently not working
+# parallel --halt now,fail=1 --progress --line-buffer ::: stream manual root
+# run tests in sequence
+root
+stream
+manual
diff --git a/vendor/github.com/dgraph-io/ristretto/.go-version b/vendor/github.com/dgraph-io/ristretto/.go-version
new file mode 100644
index 0000000000..b8f1e3fd3e
--- /dev/null
+++ b/vendor/github.com/dgraph-io/ristretto/.go-version
@@ -0,0 +1 @@
+1.17.11
diff --git a/vendor/github.com/dgraph-io/ristretto/.golangci.yml b/vendor/github.com/dgraph-io/ristretto/.golangci.yml
new file mode 100644
index 0000000000..7318e9a3b6
--- /dev/null
+++ b/vendor/github.com/dgraph-io/ristretto/.golangci.yml
@@ -0,0 +1,23 @@
+run:
+  tests: false
+  skip-dirs:
+    - contrib
+    - sim
+
+linters-settings:
+  lll:
+    line-length: 120
+
+linters:
+  disable-all: true
+  enable:
+    #- errcheck
+    #- ineffassign
+    - gas
+    #- gofmt
+    #- golint
+    #- gosimple
+    #- govet
+    - lll
+    #- varcheck
+    #- unused
diff --git a/vendor/github.com/dgraph-io/ristretto/CHANGELOG.md b/vendor/github.com/dgraph-io/ristretto/CHANGELOG.md
index da964bc0c8..3d18e39ed6 100644
--- a/vendor/github.com/dgraph-io/ristretto/CHANGELOG.md
+++ b/vendor/github.com/dgraph-io/ristretto/CHANGELOG.md
@@ -4,11 +4,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project will adhere to [Semantic Versioning](http://semver.org/spec/v2.0.0.html) starting v1.0.0.
 
-## Unreleased
+## [0.1.1] - 2022-10-12
+
+[0.1.1]: https://github.com/dgraph-io/ristretto/compare/v0.1.0..v0.1.1
+This release fixes certain arm64 build issues in the z package.  It also
+incorporates CI steps in our repository.
+
+### Changed
+- [chore(docs): Include SpiceDB in the list of projects using Ristretto (#285)](https://github.com/dgraph-io/ristretto/pull/311)
+
+### Added
+- [Run CI Jobs via Github Actions #304](https://github.com/dgraph-io/ristretto/pull/304)
+
+### Fixed
+- [fix(build): update x/sys dependency](https://github.com/dgraph-io/ristretto/pull/308)
+- [fix(z): Address inconsistent mremap return arguments with arm64](https://github.com/dgraph-io/ristretto/pull/309)
+- [fix(z): runtime error: index out of range for !amd64 env #287](https://github.com/dgraph-io/ristretto/pull/307)
 
 ## [0.1.0] - 2021-06-03
 
-[0.1.0]: https://github.com/dgraph-io/ristretto/compare/v0.1.0..v0.0.3
+[0.1.0]: https://github.com/dgraph-io/ristretto/compare/v0.0.3..v0.1.0
 This release contains bug fixes and improvements to Ristretto. It also contains
 major updates to the z package. The z package contains types such as Tree (B+
 tree), Buffer, Mmap file, etc. All these types are used in Badger and Dgraph to
diff --git a/vendor/github.com/dgraph-io/ristretto/README.md b/vendor/github.com/dgraph-io/ristretto/README.md
index f4bb28cd75..e71ae3df9e 100644
--- a/vendor/github.com/dgraph-io/ristretto/README.md
+++ b/vendor/github.com/dgraph-io/ristretto/README.md
@@ -1,16 +1,15 @@
 # Ristretto
 [![Go Doc](https://img.shields.io/badge/godoc-reference-blue.svg)](http://godoc.org/github.com/dgraph-io/ristretto)
+[![ci-ristretto-tests](https://github.com/dgraph-io/ristretto/actions/workflows/ci-ristretto-tests.yml/badge.svg)](https://github.com/dgraph-io/ristretto/actions/workflows/ci-ristretto-tests.yml)
+[![ci-ristretto-lint](https://github.com/dgraph-io/ristretto/actions/workflows/ci-ristretto-lint.yml/badge.svg)](https://github.com/dgraph-io/ristretto/actions/workflows/ci-ristretto-lint.yml)
+[![Coverage Status](https://coveralls.io/repos/github/dgraph-io/ristretto/badge.svg?branch=main)](https://coveralls.io/github/dgraph-io/ristretto?branch=main)
 [![Go Report Card](https://img.shields.io/badge/go%20report-A%2B-brightgreen)](https://goreportcard.com/report/github.com/dgraph-io/ristretto)
-[![Coverage](https://gocover.io/_badge/github.com/dgraph-io/ristretto)](https://gocover.io/github.com/dgraph-io/ristretto)
-![Tests](https://github.com/dgraph-io/ristretto/workflows/tests/badge.svg)
 
 Ristretto is a fast, concurrent cache library built with a focus on performance and correctness.
 
 The motivation to build Ristretto comes from the need for a contention-free
 cache in [Dgraph][].
 
-**Use [Discuss Issues](https://discuss.dgraph.io/tags/c/issues/35/ristretto/40) for reporting issues about this repository.**
-
 [Dgraph]: https://github.com/dgraph-io/dgraph
 
 ## Features
@@ -205,7 +204,8 @@ Below is a list of known projects that use Ristretto:
 
 - [Badger](https://github.com/dgraph-io/badger) - Embeddable key-value DB in Go
 - [Dgraph](https://github.com/dgraph-io/dgraph) - Horizontally scalable and distributed GraphQL database with a graph backend
-- [Vitess](https://github.com/vitessio/vitess) - database clustering system for horizontal scaling of MySQL
+- [Vitess](https://github.com/vitessio/vitess) - Database clustering system for horizontal scaling of MySQL
+- [SpiceDB](https://github.com/authzed/spicedb) - Horizontally scalable permissions database
 
 ## FAQ
 
diff --git a/vendor/github.com/dgraph-io/ristretto/go.mod b/vendor/github.com/dgraph-io/ristretto/go.mod
deleted file mode 100644
index f7a620c57e..0000000000
--- a/vendor/github.com/dgraph-io/ristretto/go.mod
+++ /dev/null
@@ -1,14 +0,0 @@
-module github.com/dgraph-io/ristretto
-
-go 1.12
-
-require (
-	github.com/cespare/xxhash/v2 v2.1.1
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2
-	github.com/dustin/go-humanize v1.0.0
-	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
-	github.com/pkg/errors v0.9.1
-	github.com/stretchr/testify v1.4.0
-	golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f
-)
diff --git a/vendor/github.com/dgraph-io/ristretto/go.sum b/vendor/github.com/dgraph-io/ristretto/go.sum
deleted file mode 100644
index 6e3d790326..0000000000
--- a/vendor/github.com/dgraph-io/ristretto/go.sum
+++ /dev/null
@@ -1,24 +0,0 @@
-github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/vendor/github.com/dgraph-io/ristretto/sketch.go b/vendor/github.com/dgraph-io/ristretto/sketch.go
index 10f414689a..6368d2bde0 100644
--- a/vendor/github.com/dgraph-io/ristretto/sketch.go
+++ b/vendor/github.com/dgraph-io/ristretto/sketch.go
@@ -53,7 +53,8 @@ func newCmSketch(numCounters int64) *cmSketch {
 	numCounters = next2Power(numCounters)
 	sketch := &cmSketch{mask: uint64(numCounters - 1)}
 	// Initialize rows of counters and seeds.
-	source := rand.New(rand.NewSource(time.Now().UnixNano()))
+	// Cryptographic precision not needed
+	source := rand.New(rand.NewSource(time.Now().UnixNano())) //nolint:gosec
 	for i := 0; i < cmDepth; i++ {
 		sketch.seed[i] = source.Uint64()
 		sketch.rows[i] = newCmRow(numCounters)
diff --git a/vendor/github.com/dgraph-io/ristretto/test.sh b/vendor/github.com/dgraph-io/ristretto/test.sh
deleted file mode 100644
index d53b32d42a..0000000000
--- a/vendor/github.com/dgraph-io/ristretto/test.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#! /bin/sh
-
-starttest() {
-	set -e
-	GO111MODULE=on go test -race ./...
-}
-
-if [ -z "${TEAMCITY_VERSION}" ]; then
-	# running locally, so start test in a container
-	# TEAMCITY_VERSION=local will avoid recursive calls, when it would be running in container
-	docker run --rm --name ristretto-test -ti \
-  		-v `pwd`:/go/src/github.com/dgraph-io/ristretto \
-  		--workdir /go/src/github.com/dgraph-io/ristretto \
-		--env TEAMCITY_VERSION=local \
-  		golang:1.13 \
-  		sh test.sh
-else
-	# running in teamcity, since teamcity itself run this in container, let's simply run this
-	starttest
-fi
diff --git a/vendor/github.com/dgraph-io/ristretto/z/allocator.go b/vendor/github.com/dgraph-io/ristretto/z/allocator.go
index db00ff5eca..eae0f83449 100644
--- a/vendor/github.com/dgraph-io/ristretto/z/allocator.go
+++ b/vendor/github.com/dgraph-io/ristretto/z/allocator.go
@@ -57,7 +57,7 @@ func init() {
 
 	// Set up a unique Ref per process.
 	rand.Seed(time.Now().UnixNano())
-	allocRef = uint64(rand.Int63n(1<<16)) << 48
+	allocRef = uint64(rand.Int63n(1<<16)) << 48 //nolint:gosec // cryptographic precision not needed
 
 	calculatedLog2 = make([]int, 1025)
 	for i := 1; i <= 1024; i++ {
diff --git a/vendor/github.com/dgraph-io/ristretto/z/mmap_linux.go b/vendor/github.com/dgraph-io/ristretto/z/mmap_linux.go
index 9cc3497a16..331330cff9 100644
--- a/vendor/github.com/dgraph-io/ristretto/z/mmap_linux.go
+++ b/vendor/github.com/dgraph-io/ristretto/z/mmap_linux.go
@@ -17,9 +17,7 @@
 package z
 
 import (
-	"fmt"
 	"os"
-	"reflect"
 	"unsafe"
 
 	"golang.org/x/sys/unix"
@@ -35,34 +33,6 @@ func mmap(fd *os.File, writable bool, size int64) ([]byte, error) {
 	return unix.Mmap(int(fd.Fd()), 0, int(size), mtype, unix.MAP_SHARED)
 }
 
-// mremap is a Linux-specific system call to remap pages in memory. This can be used in place of munmap + mmap.
-func mremap(data []byte, size int) ([]byte, error) {
-	// taken from <https://github.com/torvalds/linux/blob/f8394f232b1eab649ce2df5c5f15b0e528c92091/include/uapi/linux/mman.h#L8>
-	const MREMAP_MAYMOVE = 0x1
-
-	header := (*reflect.SliceHeader)(unsafe.Pointer(&data))
-	mmapAddr, mmapSize, errno := unix.Syscall6(
-		unix.SYS_MREMAP,
-		header.Data,
-		uintptr(header.Len),
-		uintptr(size),
-		uintptr(MREMAP_MAYMOVE),
-		0,
-		0,
-	)
-	if errno != 0 {
-		return nil, errno
-	}
-	if mmapSize != uintptr(size) {
-		return nil, fmt.Errorf("mremap size mismatch: requested: %d got: %d", size, mmapSize)
-	}
-
-	header.Data = mmapAddr
-	header.Cap = size
-	header.Len = size
-	return data, nil
-}
-
 // munmap unmaps a previously mapped slice.
 //
 // unix.Munmap maintains an internal list of mmapped addresses, and only calls munmap
diff --git a/vendor/github.com/dgraph-io/ristretto/z/mremap_linux.go b/vendor/github.com/dgraph-io/ristretto/z/mremap_linux.go
new file mode 100644
index 0000000000..225678658d
--- /dev/null
+++ b/vendor/github.com/dgraph-io/ristretto/z/mremap_linux.go
@@ -0,0 +1,56 @@
+// +build !arm64
+
+/*
+ * Copyright 2020 Dgraph Labs, Inc. and Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package z
+
+import (
+	"fmt"
+	"reflect"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// mremap is a Linux-specific system call to remap pages in memory. This can be used in place of munmap + mmap.
+func mremap(data []byte, size int) ([]byte, error) {
+	//nolint:lll
+	// taken from <https://github.com/torvalds/linux/blob/f8394f232b1eab649ce2df5c5f15b0e528c92091/include/uapi/linux/mman.h#L8>
+	const MREMAP_MAYMOVE = 0x1
+
+	header := (*reflect.SliceHeader)(unsafe.Pointer(&data))
+	mmapAddr, mmapSize, errno := unix.Syscall6(
+		unix.SYS_MREMAP,
+		header.Data,
+		uintptr(header.Len),
+		uintptr(size),
+		uintptr(MREMAP_MAYMOVE),
+		0,
+		0,
+	)
+	if errno != 0 {
+		return nil, errno
+	}
+	if mmapSize != uintptr(size) {
+		return nil, fmt.Errorf("mremap size mismatch: requested: %d got: %d", size, mmapSize)
+	}
+
+	header.Data = mmapAddr
+	header.Cap = size
+	header.Len = size
+	return data, nil
+}
diff --git a/vendor/github.com/dgraph-io/ristretto/z/mremap_linux_arm64.go b/vendor/github.com/dgraph-io/ristretto/z/mremap_linux_arm64.go
new file mode 100644
index 0000000000..09683cdfeb
--- /dev/null
+++ b/vendor/github.com/dgraph-io/ristretto/z/mremap_linux_arm64.go
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2020 Dgraph Labs, Inc. and Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package z
+
+import (
+	"reflect"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// mremap is a Linux-specific system call to remap pages in memory. This can be used in place of munmap + mmap.
+func mremap(data []byte, size int) ([]byte, error) {
+	//nolint:lll
+	// taken from <https://github.com/torvalds/linux/blob/f8394f232b1eab649ce2df5c5f15b0e528c92091/include/uapi/linux/mman.h#L8>
+	const MREMAP_MAYMOVE = 0x1
+
+	header := (*reflect.SliceHeader)(unsafe.Pointer(&data))
+	// For ARM64, the second return argument for SYS_MREMAP is inconsistent (prior allocated size) with
+	// other architectures, which return the size allocated
+	mmapAddr, _, errno := unix.Syscall6(
+		unix.SYS_MREMAP,
+		header.Data,
+		uintptr(header.Len),
+		uintptr(size),
+		uintptr(MREMAP_MAYMOVE),
+		0,
+		0,
+	)
+	if errno != 0 {
+		return nil, errno
+	}
+
+	header.Data = mmapAddr
+	header.Cap = size
+	header.Len = size
+	return data, nil
+}
diff --git a/vendor/github.com/dgraph-io/ristretto/z/simd/search.go b/vendor/github.com/dgraph-io/ristretto/z/simd/search.go
index 0d001ee0c4..b1e639225a 100644
--- a/vendor/github.com/dgraph-io/ristretto/z/simd/search.go
+++ b/vendor/github.com/dgraph-io/ristretto/z/simd/search.go
@@ -20,7 +20,7 @@ package simd
 
 // Search uses the Clever search to find the correct key.
 func Search(xs []uint64, k uint64) int16 {
-	if len(xs) < 8 {
+	if len(xs) < 8 || (len(xs) % 8 != 0) {
 		return Naive(xs, k)
 	}
 	var twos, pk [4]uint64
diff --git a/build/fuzzer/corpus/00098.stmt b/vendor/github.com/felixge/httpsnoop/.gitignore
similarity index 100%
rename from build/fuzzer/corpus/00098.stmt
rename to vendor/github.com/felixge/httpsnoop/.gitignore
diff --git a/vendor/github.com/felixge/httpsnoop/.travis.yml b/vendor/github.com/felixge/httpsnoop/.travis.yml
new file mode 100644
index 0000000000..bfc421200d
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/.travis.yml
@@ -0,0 +1,6 @@
+language: go
+
+go:
+  - 1.6
+  - 1.7
+  - 1.8
diff --git a/vendor/github.com/felixge/httpsnoop/LICENSE.txt b/vendor/github.com/felixge/httpsnoop/LICENSE.txt
new file mode 100644
index 0000000000..e028b46a9b
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/LICENSE.txt
@@ -0,0 +1,19 @@
+Copyright (c) 2016 Felix Geisendörfer (felix@debuggable.com)
+
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
diff --git a/vendor/github.com/felixge/httpsnoop/Makefile b/vendor/github.com/felixge/httpsnoop/Makefile
new file mode 100644
index 0000000000..2d84889aed
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/Makefile
@@ -0,0 +1,10 @@
+.PHONY: ci generate clean
+
+ci: clean generate
+	go test -v ./...
+
+generate:
+	go generate .
+
+clean:
+	rm -rf *_generated*.go
diff --git a/vendor/github.com/felixge/httpsnoop/README.md b/vendor/github.com/felixge/httpsnoop/README.md
new file mode 100644
index 0000000000..ddcecd13e7
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/README.md
@@ -0,0 +1,95 @@
+# httpsnoop
+
+Package httpsnoop provides an easy way to capture http related metrics (i.e.
+response time, bytes written, and http status code) from your application's
+http.Handlers.
+
+Doing this requires non-trivial wrapping of the http.ResponseWriter interface,
+which is also exposed for users interested in a more low-level API.
+
+[![GoDoc](https://godoc.org/github.com/felixge/httpsnoop?status.svg)](https://godoc.org/github.com/felixge/httpsnoop)
+[![Build Status](https://travis-ci.org/felixge/httpsnoop.svg?branch=master)](https://travis-ci.org/felixge/httpsnoop)
+
+## Usage Example
+
+```go
+// myH is your app's http handler, perhaps a http.ServeMux or similar.
+var myH http.Handler
+// wrappedH wraps myH in order to log every request.
+wrappedH := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	m := httpsnoop.CaptureMetrics(myH, w, r)
+	log.Printf(
+		"%s %s (code=%d dt=%s written=%d)",
+		r.Method,
+		r.URL,
+		m.Code,
+		m.Duration,
+		m.Written,
+	)
+})
+http.ListenAndServe(":8080", wrappedH)
+```
+
+## Why this package exists
+
+Instrumenting an application's http.Handler is surprisingly difficult.
+
+However if you google for e.g. "capture ResponseWriter status code" you'll find
+lots of advise and code examples that suggest it to be a fairly trivial
+undertaking. Unfortunately everything I've seen so far has a high chance of
+breaking your application.
+
+The main problem is that a `http.ResponseWriter` often implements additional
+interfaces such as `http.Flusher`, `http.CloseNotifier`, `http.Hijacker`, `http.Pusher`, and
+`io.ReaderFrom`. So the naive approach of just wrapping `http.ResponseWriter`
+in your own struct that also implements the `http.ResponseWriter` interface
+will hide the additional interfaces mentioned above. This has a high change of
+introducing subtle bugs into any non-trivial application.
+
+Another approach I've seen people take is to return a struct that implements
+all of the interfaces above. However, that's also problematic, because it's
+difficult to fake some of these interfaces behaviors when the underlying
+`http.ResponseWriter` doesn't have an implementation. It's also dangerous,
+because an application may choose to operate differently, merely because it
+detects the presence of these additional interfaces.
+
+This package solves this problem by checking which additional interfaces a
+`http.ResponseWriter` implements, returning a wrapped version implementing the
+exact same set of interfaces.
+
+Additionally this package properly handles edge cases such as `WriteHeader` not
+being called, or called more than once, as well as concurrent calls to
+`http.ResponseWriter` methods, and even calls happening after the wrapped
+`ServeHTTP` has already returned.
+
+Unfortunately this package is not perfect either. It's possible that it is
+still missing some interfaces provided by the go core (let me know if you find
+one), and it won't work for applications adding their own interfaces into the
+mix. You can however use `httpsnoop.Unwrap(w)` to access the underlying
+`http.ResponseWriter` and type-assert the result to its other interfaces.
+
+However, hopefully the explanation above has sufficiently scared you of rolling
+your own solution to this problem. httpsnoop may still break your application,
+but at least it tries to avoid it as much as possible.
+
+Anyway, the real problem here is that smuggling additional interfaces inside
+`http.ResponseWriter` is a problematic design choice, but it probably goes as
+deep as the Go language specification itself. But that's okay, I still prefer
+Go over the alternatives ;).
+
+## Performance
+
+```
+BenchmarkBaseline-8      	   20000	     94912 ns/op
+BenchmarkCaptureMetrics-8	   20000	     95461 ns/op
+```
+
+As you can see, using `CaptureMetrics` on a vanilla http.Handler introduces an
+overhead of ~500 ns per http request on my machine. However, the margin of
+error appears to be larger than that, therefor it should be reasonable to
+assume that the overhead introduced by `CaptureMetrics` is absolutely
+negligible.
+
+## License
+
+MIT
diff --git a/vendor/github.com/felixge/httpsnoop/capture_metrics.go b/vendor/github.com/felixge/httpsnoop/capture_metrics.go
new file mode 100644
index 0000000000..b77cc7c009
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/capture_metrics.go
@@ -0,0 +1,86 @@
+package httpsnoop
+
+import (
+	"io"
+	"net/http"
+	"time"
+)
+
+// Metrics holds metrics captured from CaptureMetrics.
+type Metrics struct {
+	// Code is the first http response code passed to the WriteHeader func of
+	// the ResponseWriter. If no such call is made, a default code of 200 is
+	// assumed instead.
+	Code int
+	// Duration is the time it took to execute the handler.
+	Duration time.Duration
+	// Written is the number of bytes successfully written by the Write or
+	// ReadFrom function of the ResponseWriter. ResponseWriters may also write
+	// data to their underlaying connection directly (e.g. headers), but those
+	// are not tracked. Therefor the number of Written bytes will usually match
+	// the size of the response body.
+	Written int64
+}
+
+// CaptureMetrics wraps the given hnd, executes it with the given w and r, and
+// returns the metrics it captured from it.
+func CaptureMetrics(hnd http.Handler, w http.ResponseWriter, r *http.Request) Metrics {
+	return CaptureMetricsFn(w, func(ww http.ResponseWriter) {
+		hnd.ServeHTTP(ww, r)
+	})
+}
+
+// CaptureMetricsFn wraps w and calls fn with the wrapped w and returns the
+// resulting metrics. This is very similar to CaptureMetrics (which is just
+// sugar on top of this func), but is a more usable interface if your
+// application doesn't use the Go http.Handler interface.
+func CaptureMetricsFn(w http.ResponseWriter, fn func(http.ResponseWriter)) Metrics {
+	m := Metrics{Code: http.StatusOK}
+	m.CaptureMetrics(w, fn)
+	return m
+}
+
+// CaptureMetrics wraps w and calls fn with the wrapped w and updates
+// Metrics m with the resulting metrics. This is similar to CaptureMetricsFn,
+// but allows one to customize starting Metrics object.
+func (m *Metrics) CaptureMetrics(w http.ResponseWriter, fn func(http.ResponseWriter)) {
+	var (
+		start         = time.Now()
+		headerWritten bool
+		hooks         = Hooks{
+			WriteHeader: func(next WriteHeaderFunc) WriteHeaderFunc {
+				return func(code int) {
+					next(code)
+
+					if !headerWritten {
+						m.Code = code
+						headerWritten = true
+					}
+				}
+			},
+
+			Write: func(next WriteFunc) WriteFunc {
+				return func(p []byte) (int, error) {
+					n, err := next(p)
+
+					m.Written += int64(n)
+					headerWritten = true
+					return n, err
+				}
+			},
+
+			ReadFrom: func(next ReadFromFunc) ReadFromFunc {
+				return func(src io.Reader) (int64, error) {
+					n, err := next(src)
+
+					headerWritten = true
+					m.Written += n
+					return n, err
+				}
+			},
+		}
+	)
+
+	fn(Wrap(w, hooks))
+	m.Duration += time.Since(start)
+}
diff --git a/vendor/github.com/felixge/httpsnoop/docs.go b/vendor/github.com/felixge/httpsnoop/docs.go
new file mode 100644
index 0000000000..203c35b3c6
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/docs.go
@@ -0,0 +1,10 @@
+// Package httpsnoop provides an easy way to capture http related metrics (i.e.
+// response time, bytes written, and http status code) from your application's
+// http.Handlers.
+//
+// Doing this requires non-trivial wrapping of the http.ResponseWriter
+// interface, which is also exposed for users interested in a more low-level
+// API.
+package httpsnoop
+
+//go:generate go run codegen/main.go
diff --git a/vendor/github.com/felixge/httpsnoop/wrap_generated_gteq_1.8.go b/vendor/github.com/felixge/httpsnoop/wrap_generated_gteq_1.8.go
new file mode 100644
index 0000000000..31cbdfb8ef
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/wrap_generated_gteq_1.8.go
@@ -0,0 +1,436 @@
+// +build go1.8
+// Code generated by "httpsnoop/codegen"; DO NOT EDIT
+
+package httpsnoop
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+)
+
+// HeaderFunc is part of the http.ResponseWriter interface.
+type HeaderFunc func() http.Header
+
+// WriteHeaderFunc is part of the http.ResponseWriter interface.
+type WriteHeaderFunc func(code int)
+
+// WriteFunc is part of the http.ResponseWriter interface.
+type WriteFunc func(b []byte) (int, error)
+
+// FlushFunc is part of the http.Flusher interface.
+type FlushFunc func()
+
+// CloseNotifyFunc is part of the http.CloseNotifier interface.
+type CloseNotifyFunc func() <-chan bool
+
+// HijackFunc is part of the http.Hijacker interface.
+type HijackFunc func() (net.Conn, *bufio.ReadWriter, error)
+
+// ReadFromFunc is part of the io.ReaderFrom interface.
+type ReadFromFunc func(src io.Reader) (int64, error)
+
+// PushFunc is part of the http.Pusher interface.
+type PushFunc func(target string, opts *http.PushOptions) error
+
+// Hooks defines a set of method interceptors for methods included in
+// http.ResponseWriter as well as some others. You can think of them as
+// middleware for the function calls they target. See Wrap for more details.
+type Hooks struct {
+	Header      func(HeaderFunc) HeaderFunc
+	WriteHeader func(WriteHeaderFunc) WriteHeaderFunc
+	Write       func(WriteFunc) WriteFunc
+	Flush       func(FlushFunc) FlushFunc
+	CloseNotify func(CloseNotifyFunc) CloseNotifyFunc
+	Hijack      func(HijackFunc) HijackFunc
+	ReadFrom    func(ReadFromFunc) ReadFromFunc
+	Push        func(PushFunc) PushFunc
+}
+
+// Wrap returns a wrapped version of w that provides the exact same interface
+// as w. Specifically if w implements any combination of:
+//
+// - http.Flusher
+// - http.CloseNotifier
+// - http.Hijacker
+// - io.ReaderFrom
+// - http.Pusher
+//
+// The wrapped version will implement the exact same combination. If no hooks
+// are set, the wrapped version also behaves exactly as w. Hooks targeting
+// methods not supported by w are ignored. Any other hooks will intercept the
+// method they target and may modify the call's arguments and/or return values.
+// The CaptureMetrics implementation serves as a working example for how the
+// hooks can be used.
+func Wrap(w http.ResponseWriter, hooks Hooks) http.ResponseWriter {
+	rw := &rw{w: w, h: hooks}
+	_, i0 := w.(http.Flusher)
+	_, i1 := w.(http.CloseNotifier)
+	_, i2 := w.(http.Hijacker)
+	_, i3 := w.(io.ReaderFrom)
+	_, i4 := w.(http.Pusher)
+	switch {
+	// combination 1/32
+	case !i0 && !i1 && !i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+		}{rw, rw}
+	// combination 2/32
+	case !i0 && !i1 && !i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Pusher
+		}{rw, rw, rw}
+	// combination 3/32
+	case !i0 && !i1 && !i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			io.ReaderFrom
+		}{rw, rw, rw}
+	// combination 4/32
+	case !i0 && !i1 && !i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw}
+	// combination 5/32
+	case !i0 && !i1 && i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Hijacker
+		}{rw, rw, rw}
+	// combination 6/32
+	case !i0 && !i1 && i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Hijacker
+			http.Pusher
+		}{rw, rw, rw, rw}
+	// combination 7/32
+	case !i0 && !i1 && i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw}
+	// combination 8/32
+	case !i0 && !i1 && i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Hijacker
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw}
+	// combination 9/32
+	case !i0 && i1 && !i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+		}{rw, rw, rw}
+	// combination 10/32
+	case !i0 && i1 && !i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Pusher
+		}{rw, rw, rw, rw}
+	// combination 11/32
+	case !i0 && i1 && !i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			io.ReaderFrom
+		}{rw, rw, rw, rw}
+	// combination 12/32
+	case !i0 && i1 && !i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw}
+	// combination 13/32
+	case !i0 && i1 && i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Hijacker
+		}{rw, rw, rw, rw}
+	// combination 14/32
+	case !i0 && i1 && i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Hijacker
+			http.Pusher
+		}{rw, rw, rw, rw, rw}
+	// combination 15/32
+	case !i0 && i1 && i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw}
+	// combination 16/32
+	case !i0 && i1 && i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Hijacker
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw, rw}
+	// combination 17/32
+	case i0 && !i1 && !i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+		}{rw, rw, rw}
+	// combination 18/32
+	case i0 && !i1 && !i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Pusher
+		}{rw, rw, rw, rw}
+	// combination 19/32
+	case i0 && !i1 && !i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			io.ReaderFrom
+		}{rw, rw, rw, rw}
+	// combination 20/32
+	case i0 && !i1 && !i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw}
+	// combination 21/32
+	case i0 && !i1 && i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Hijacker
+		}{rw, rw, rw, rw}
+	// combination 22/32
+	case i0 && !i1 && i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Hijacker
+			http.Pusher
+		}{rw, rw, rw, rw, rw}
+	// combination 23/32
+	case i0 && !i1 && i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw}
+	// combination 24/32
+	case i0 && !i1 && i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Hijacker
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw, rw}
+	// combination 25/32
+	case i0 && i1 && !i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+		}{rw, rw, rw, rw}
+	// combination 26/32
+	case i0 && i1 && !i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Pusher
+		}{rw, rw, rw, rw, rw}
+	// combination 27/32
+	case i0 && i1 && !i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw}
+	// combination 28/32
+	case i0 && i1 && !i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw, rw}
+	// combination 29/32
+	case i0 && i1 && i2 && !i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Hijacker
+		}{rw, rw, rw, rw, rw}
+	// combination 30/32
+	case i0 && i1 && i2 && !i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Hijacker
+			http.Pusher
+		}{rw, rw, rw, rw, rw, rw}
+	// combination 31/32
+	case i0 && i1 && i2 && i3 && !i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw, rw}
+	// combination 32/32
+	case i0 && i1 && i2 && i3 && i4:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Hijacker
+			io.ReaderFrom
+			http.Pusher
+		}{rw, rw, rw, rw, rw, rw, rw}
+	}
+	panic("unreachable")
+}
+
+type rw struct {
+	w http.ResponseWriter
+	h Hooks
+}
+
+func (w *rw) Unwrap() http.ResponseWriter {
+	return w.w
+}
+
+func (w *rw) Header() http.Header {
+	f := w.w.(http.ResponseWriter).Header
+	if w.h.Header != nil {
+		f = w.h.Header(f)
+	}
+	return f()
+}
+
+func (w *rw) WriteHeader(code int) {
+	f := w.w.(http.ResponseWriter).WriteHeader
+	if w.h.WriteHeader != nil {
+		f = w.h.WriteHeader(f)
+	}
+	f(code)
+}
+
+func (w *rw) Write(b []byte) (int, error) {
+	f := w.w.(http.ResponseWriter).Write
+	if w.h.Write != nil {
+		f = w.h.Write(f)
+	}
+	return f(b)
+}
+
+func (w *rw) Flush() {
+	f := w.w.(http.Flusher).Flush
+	if w.h.Flush != nil {
+		f = w.h.Flush(f)
+	}
+	f()
+}
+
+func (w *rw) CloseNotify() <-chan bool {
+	f := w.w.(http.CloseNotifier).CloseNotify
+	if w.h.CloseNotify != nil {
+		f = w.h.CloseNotify(f)
+	}
+	return f()
+}
+
+func (w *rw) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	f := w.w.(http.Hijacker).Hijack
+	if w.h.Hijack != nil {
+		f = w.h.Hijack(f)
+	}
+	return f()
+}
+
+func (w *rw) ReadFrom(src io.Reader) (int64, error) {
+	f := w.w.(io.ReaderFrom).ReadFrom
+	if w.h.ReadFrom != nil {
+		f = w.h.ReadFrom(f)
+	}
+	return f(src)
+}
+
+func (w *rw) Push(target string, opts *http.PushOptions) error {
+	f := w.w.(http.Pusher).Push
+	if w.h.Push != nil {
+		f = w.h.Push(f)
+	}
+	return f(target, opts)
+}
+
+type Unwrapper interface {
+	Unwrap() http.ResponseWriter
+}
+
+// Unwrap returns the underlying http.ResponseWriter from within zero or more
+// layers of httpsnoop wrappers.
+func Unwrap(w http.ResponseWriter) http.ResponseWriter {
+	if rw, ok := w.(Unwrapper); ok {
+		// recurse until rw.Unwrap() returns a non-Unwrapper
+		return Unwrap(rw.Unwrap())
+	} else {
+		return w
+	}
+}
diff --git a/vendor/github.com/felixge/httpsnoop/wrap_generated_lt_1.8.go b/vendor/github.com/felixge/httpsnoop/wrap_generated_lt_1.8.go
new file mode 100644
index 0000000000..ab99c07c7a
--- /dev/null
+++ b/vendor/github.com/felixge/httpsnoop/wrap_generated_lt_1.8.go
@@ -0,0 +1,278 @@
+// +build !go1.8
+// Code generated by "httpsnoop/codegen"; DO NOT EDIT
+
+package httpsnoop
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+)
+
+// HeaderFunc is part of the http.ResponseWriter interface.
+type HeaderFunc func() http.Header
+
+// WriteHeaderFunc is part of the http.ResponseWriter interface.
+type WriteHeaderFunc func(code int)
+
+// WriteFunc is part of the http.ResponseWriter interface.
+type WriteFunc func(b []byte) (int, error)
+
+// FlushFunc is part of the http.Flusher interface.
+type FlushFunc func()
+
+// CloseNotifyFunc is part of the http.CloseNotifier interface.
+type CloseNotifyFunc func() <-chan bool
+
+// HijackFunc is part of the http.Hijacker interface.
+type HijackFunc func() (net.Conn, *bufio.ReadWriter, error)
+
+// ReadFromFunc is part of the io.ReaderFrom interface.
+type ReadFromFunc func(src io.Reader) (int64, error)
+
+// Hooks defines a set of method interceptors for methods included in
+// http.ResponseWriter as well as some others. You can think of them as
+// middleware for the function calls they target. See Wrap for more details.
+type Hooks struct {
+	Header      func(HeaderFunc) HeaderFunc
+	WriteHeader func(WriteHeaderFunc) WriteHeaderFunc
+	Write       func(WriteFunc) WriteFunc
+	Flush       func(FlushFunc) FlushFunc
+	CloseNotify func(CloseNotifyFunc) CloseNotifyFunc
+	Hijack      func(HijackFunc) HijackFunc
+	ReadFrom    func(ReadFromFunc) ReadFromFunc
+}
+
+// Wrap returns a wrapped version of w that provides the exact same interface
+// as w. Specifically if w implements any combination of:
+//
+// - http.Flusher
+// - http.CloseNotifier
+// - http.Hijacker
+// - io.ReaderFrom
+//
+// The wrapped version will implement the exact same combination. If no hooks
+// are set, the wrapped version also behaves exactly as w. Hooks targeting
+// methods not supported by w are ignored. Any other hooks will intercept the
+// method they target and may modify the call's arguments and/or return values.
+// The CaptureMetrics implementation serves as a working example for how the
+// hooks can be used.
+func Wrap(w http.ResponseWriter, hooks Hooks) http.ResponseWriter {
+	rw := &rw{w: w, h: hooks}
+	_, i0 := w.(http.Flusher)
+	_, i1 := w.(http.CloseNotifier)
+	_, i2 := w.(http.Hijacker)
+	_, i3 := w.(io.ReaderFrom)
+	switch {
+	// combination 1/16
+	case !i0 && !i1 && !i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+		}{rw, rw}
+	// combination 2/16
+	case !i0 && !i1 && !i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			io.ReaderFrom
+		}{rw, rw, rw}
+	// combination 3/16
+	case !i0 && !i1 && i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Hijacker
+		}{rw, rw, rw}
+	// combination 4/16
+	case !i0 && !i1 && i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw}
+	// combination 5/16
+	case !i0 && i1 && !i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+		}{rw, rw, rw}
+	// combination 6/16
+	case !i0 && i1 && !i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			io.ReaderFrom
+		}{rw, rw, rw, rw}
+	// combination 7/16
+	case !i0 && i1 && i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Hijacker
+		}{rw, rw, rw, rw}
+	// combination 8/16
+	case !i0 && i1 && i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.CloseNotifier
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw}
+	// combination 9/16
+	case i0 && !i1 && !i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+		}{rw, rw, rw}
+	// combination 10/16
+	case i0 && !i1 && !i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			io.ReaderFrom
+		}{rw, rw, rw, rw}
+	// combination 11/16
+	case i0 && !i1 && i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Hijacker
+		}{rw, rw, rw, rw}
+	// combination 12/16
+	case i0 && !i1 && i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw}
+	// combination 13/16
+	case i0 && i1 && !i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+		}{rw, rw, rw, rw}
+	// combination 14/16
+	case i0 && i1 && !i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw}
+	// combination 15/16
+	case i0 && i1 && i2 && !i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Hijacker
+		}{rw, rw, rw, rw, rw}
+	// combination 16/16
+	case i0 && i1 && i2 && i3:
+		return struct {
+			Unwrapper
+			http.ResponseWriter
+			http.Flusher
+			http.CloseNotifier
+			http.Hijacker
+			io.ReaderFrom
+		}{rw, rw, rw, rw, rw, rw}
+	}
+	panic("unreachable")
+}
+
+type rw struct {
+	w http.ResponseWriter
+	h Hooks
+}
+
+func (w *rw) Unwrap() http.ResponseWriter {
+	return w.w
+}
+
+func (w *rw) Header() http.Header {
+	f := w.w.(http.ResponseWriter).Header
+	if w.h.Header != nil {
+		f = w.h.Header(f)
+	}
+	return f()
+}
+
+func (w *rw) WriteHeader(code int) {
+	f := w.w.(http.ResponseWriter).WriteHeader
+	if w.h.WriteHeader != nil {
+		f = w.h.WriteHeader(f)
+	}
+	f(code)
+}
+
+func (w *rw) Write(b []byte) (int, error) {
+	f := w.w.(http.ResponseWriter).Write
+	if w.h.Write != nil {
+		f = w.h.Write(f)
+	}
+	return f(b)
+}
+
+func (w *rw) Flush() {
+	f := w.w.(http.Flusher).Flush
+	if w.h.Flush != nil {
+		f = w.h.Flush(f)
+	}
+	f()
+}
+
+func (w *rw) CloseNotify() <-chan bool {
+	f := w.w.(http.CloseNotifier).CloseNotify
+	if w.h.CloseNotify != nil {
+		f = w.h.CloseNotify(f)
+	}
+	return f()
+}
+
+func (w *rw) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	f := w.w.(http.Hijacker).Hijack
+	if w.h.Hijack != nil {
+		f = w.h.Hijack(f)
+	}
+	return f()
+}
+
+func (w *rw) ReadFrom(src io.Reader) (int64, error) {
+	f := w.w.(io.ReaderFrom).ReadFrom
+	if w.h.ReadFrom != nil {
+		f = w.h.ReadFrom(f)
+	}
+	return f(src)
+}
+
+type Unwrapper interface {
+	Unwrap() http.ResponseWriter
+}
+
+// Unwrap returns the underlying http.ResponseWriter from within zero or more
+// layers of httpsnoop wrappers.
+func Unwrap(w http.ResponseWriter) http.ResponseWriter {
+	if rw, ok := w.(Unwrapper); ok {
+		// recurse until rw.Unwrap() returns a non-Unwrapper
+		return Unwrap(rw.Unwrap())
+	} else {
+		return w
+	}
+}
diff --git a/vendor/github.com/foxcpp/go-mockdns/go.mod b/vendor/github.com/foxcpp/go-mockdns/go.mod
deleted file mode 100644
index 71c5c34274..0000000000
--- a/vendor/github.com/foxcpp/go-mockdns/go.mod
+++ /dev/null
@@ -1,5 +0,0 @@
-module github.com/foxcpp/go-mockdns
-
-go 1.13
-
-require github.com/miekg/dns v1.1.25
diff --git a/vendor/github.com/foxcpp/go-mockdns/go.sum b/vendor/github.com/foxcpp/go-mockdns/go.sum
deleted file mode 100644
index a58faf563e..0000000000
--- a/vendor/github.com/foxcpp/go-mockdns/go.sum
+++ /dev/null
@@ -1,20 +0,0 @@
-github.com/miekg/dns v1.1.25 h1:dFwPR6SfLtrSwgDcIq2bcU/gVutB4sNApq2HBdqcakg=
-github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392 h1:ACG4HJsFiNMf47Y4PeRoebLNy/2lXT9EtprMuTFWt1M=
-golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478 h1:l5EDrHhldLYb3ZRHDUhXF7Om7MvYXnkV9/iQNo1lX6g=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58 h1:8gQV6CLnAEikrhgkHFbMAEhagSSnXWGV915qUMm9mrU=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe h1:6fAMxZRR6sl1Uq8U61gxU+kPTs2tR8uOySCbBP7BN/M=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/vendor/github.com/fsnotify/fsnotify/.gitignore b/vendor/github.com/fsnotify/fsnotify/.gitignore
index 4cd0cbaf43..1d89d85ce4 100644
--- a/vendor/github.com/fsnotify/fsnotify/.gitignore
+++ b/vendor/github.com/fsnotify/fsnotify/.gitignore
@@ -1,6 +1,6 @@
-# Setup a Global .gitignore for OS and editor generated files:
-# https://help.github.com/articles/ignoring-files
-# git config --global core.excludesfile ~/.gitignore_global
+# go test -c output
+*.test
+*.test.exe
 
-.vagrant
-*.sublime-project
+# Output of go build ./cmd/fsnotify
+/fsnotify
diff --git a/vendor/github.com/fsnotify/fsnotify/AUTHORS b/vendor/github.com/fsnotify/fsnotify/AUTHORS
deleted file mode 100644
index 6cbabe5ef5..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/AUTHORS
+++ /dev/null
@@ -1,62 +0,0 @@
-# Names should be added to this file as
-#	Name or Organization <email address>
-# The email address is not required for organizations.
-
-# You can update this list using the following command:
-#
-#   $ (head -n10 AUTHORS && git shortlog -se | sed -E 's/^\s+[0-9]+\t//') | tee AUTHORS
-
-# Please keep the list sorted.
-
-Aaron L <aaron@bettercoder.net>
-Adrien Bustany <adrien@bustany.org>
-Alexey Kazakov <alkazako@redhat.com>
-Amit Krishnan <amit.krishnan@oracle.com>
-Anmol Sethi <me@anmol.io>
-Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com>
-Brian Goff <cpuguy83@gmail.com>
-Bruno Bigras <bigras.bruno@gmail.com>
-Caleb Spare <cespare@gmail.com>
-Case Nelson <case@teammating.com>
-Chris Howey <howeyc@gmail.com>
-Christoffer Buchholz <christoffer.buchholz@gmail.com>
-Daniel Wagner-Hall <dawagner@gmail.com>
-Dave Cheney <dave@cheney.net>
-Eric Lin <linxiulei@gmail.com>
-Evan Phoenix <evan@fallingsnow.net>
-Francisco Souza <f@souza.cc>
-Gautam Dey <gautam.dey77@gmail.com>
-Hari haran <hariharan.uno@gmail.com>
-Ichinose Shogo <shogo82148@gmail.com>
-Johannes Ebke <johannes@ebke.org>
-John C Barstow <jbowtie@amathaine.com>
-Kelvin Fo <vmirage@gmail.com>
-Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
-Matt Layher <mdlayher@gmail.com>
-Matthias Stone <matthias@bellstone.ca>
-Nathan Youngman <git@nathany.com>
-Nickolai Zeldovich <nickolai@csail.mit.edu>
-Oliver Bristow <evilumbrella+github@gmail.com>
-Patrick <patrick@dropbox.com>
-Paul Hammond <paul@paulhammond.org>
-Pawel Knap <pawelknap88@gmail.com>
-Pieter Droogendijk <pieter@binky.org.uk>
-Pratik Shinde <pratikshinde320@gmail.com>
-Pursuit92 <JoshChase@techpursuit.net>
-Riku Voipio <riku.voipio@linaro.org>
-Rob Figueiredo <robfig@gmail.com>
-Rodrigo Chiossi <rodrigochiossi@gmail.com>
-Slawek Ligus <root@ooz.ie>
-Soge Zhang <zhssoge@gmail.com>
-Tiffany Jernigan <tiffany.jernigan@intel.com>
-Tilak Sharma <tilaks@google.com>
-Tobias Klauser <tobias.klauser@gmail.com>
-Tom Payne <twpayne@gmail.com>
-Travis Cline <travis.cline@gmail.com>
-Tudor Golubenco <tudor.g@gmail.com>
-Vahe Khachikyan <vahe@live.ca>
-Yukang <moorekang@gmail.com>
-bronze1man <bronze1man@gmail.com>
-debrando <denis.brandolini@gmail.com>
-henrikedwards <henrik.edwards@gmail.com>
-铁哥 <guotie.9@gmail.com>
diff --git a/vendor/github.com/fsnotify/fsnotify/CHANGELOG.md b/vendor/github.com/fsnotify/fsnotify/CHANGELOG.md
index a438fe4b4a..77f9593bd5 100644
--- a/vendor/github.com/fsnotify/fsnotify/CHANGELOG.md
+++ b/vendor/github.com/fsnotify/fsnotify/CHANGELOG.md
@@ -7,9 +7,116 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Nothing yet.
+
+## [1.6.0] - 2022-10-13
+
+This version of fsnotify needs Go 1.16 (this was already the case since 1.5.1,
+but not documented). It also increases the minimum Linux version to 2.6.32.
+
+### Additions
+
+- all: add `Event.Has()` and `Op.Has()` ([#477])
+
+  This makes checking events a lot easier; for example:
+
+	    if event.Op&Write == Write && !(event.Op&Remove == Remove) {
+	    }
+
+	Becomes:
+
+	    if event.Has(Write) && !event.Has(Remove) {
+	    }
+
+- all: add cmd/fsnotify ([#463])
+
+  A command-line utility for testing and some examples.
+
+### Changes and fixes
+
+- inotify: don't ignore events for files that don't exist ([#260], [#470])
+
+  Previously the inotify watcher would call `os.Lstat()` to check if a file
+  still exists before emitting events.
+
+  This was inconsistent with other platforms and resulted in inconsistent event
+  reporting (e.g. when a file is quickly removed and re-created), and generally
+  a source of confusion. It was added in 2013 to fix a memory leak that no
+  longer exists.
+
+- all: return `ErrNonExistentWatch` when `Remove()` is called on a path that's
+  not watched ([#460])
+
+- inotify: replace epoll() with non-blocking inotify ([#434])
+
+  Non-blocking inotify was not generally available at the time this library was
+  written in 2014, but now it is. As a result, the minimum Linux version is
+  bumped from 2.6.27 to 2.6.32. This hugely simplifies the code and is faster.
+
+- kqueue: don't check for events every 100ms ([#480])
+
+  The watcher would wake up every 100ms, even when there was nothing to do. Now
+  it waits until there is something to do.
+
+- macos: retry opening files on EINTR ([#475])
+
+- kqueue: skip unreadable files ([#479])
+
+  kqueue requires a file descriptor for every file in a directory; this would
+  fail if a file was unreadable by the current user. Now these files are simply
+  skipped.
+
+- windows: fix renaming a watched directory if the parent is also watched ([#370])
+
+- windows: increase buffer size from 4K to 64K ([#485])
+
+- windows: close file handle on Remove() ([#288])
+
+- kqueue: put pathname in the error if watching a file fails ([#471])
+
+- inotify, windows: calling Close() more than once could race ([#465])
+
+- kqueue: improve Close() performance ([#233])
+
+- all: various documentation additions and clarifications.
+
+[#233]: https://github.com/fsnotify/fsnotify/pull/233
+[#260]: https://github.com/fsnotify/fsnotify/pull/260
+[#288]: https://github.com/fsnotify/fsnotify/pull/288
+[#370]: https://github.com/fsnotify/fsnotify/pull/370
+[#434]: https://github.com/fsnotify/fsnotify/pull/434
+[#460]: https://github.com/fsnotify/fsnotify/pull/460
+[#463]: https://github.com/fsnotify/fsnotify/pull/463
+[#465]: https://github.com/fsnotify/fsnotify/pull/465
+[#470]: https://github.com/fsnotify/fsnotify/pull/470
+[#471]: https://github.com/fsnotify/fsnotify/pull/471
+[#475]: https://github.com/fsnotify/fsnotify/pull/475
+[#477]: https://github.com/fsnotify/fsnotify/pull/477
+[#479]: https://github.com/fsnotify/fsnotify/pull/479
+[#480]: https://github.com/fsnotify/fsnotify/pull/480
+[#485]: https://github.com/fsnotify/fsnotify/pull/485
+
+## [1.5.4] - 2022-04-25
+
+* Windows: add missing defer to `Watcher.WatchList` [#447](https://github.com/fsnotify/fsnotify/pull/447)
+* go.mod: use latest x/sys [#444](https://github.com/fsnotify/fsnotify/pull/444)
+* Fix compilation for OpenBSD [#443](https://github.com/fsnotify/fsnotify/pull/443)
+
+## [1.5.3] - 2022-04-22
+
+* This version is retracted. An incorrect branch is published accidentally [#445](https://github.com/fsnotify/fsnotify/issues/445)
+
+## [1.5.2] - 2022-04-21
+
+* Add a feature to return the directories and files that are being monitored [#374](https://github.com/fsnotify/fsnotify/pull/374)
+* Fix potential crash on windows if `raw.FileNameLength` exceeds `syscall.MAX_PATH` [#361](https://github.com/fsnotify/fsnotify/pull/361)
+* Allow build on unsupported GOOS [#424](https://github.com/fsnotify/fsnotify/pull/424)
+* Don't set `poller.fd` twice in `newFdPoller` [#406](https://github.com/fsnotify/fsnotify/pull/406)
+* fix go vet warnings: call to `(*T).Fatalf` from a non-test goroutine [#416](https://github.com/fsnotify/fsnotify/pull/416)
+
 ## [1.5.1] - 2021-08-24
 
-* Revert Add AddRaw to not follow symlinks
+* Revert Add AddRaw to not follow symlinks [#394](https://github.com/fsnotify/fsnotify/pull/394)
 
 ## [1.5.0] - 2021-08-20
 
@@ -22,6 +129,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
    [#385](https://github.com/fsnotify/fsnotify/pull/385)
 * Go 1.14+: Fix unsafe pointer conversion [#325](https://github.com/fsnotify/fsnotify/pull/325)
 
+## [1.4.9] - 2020-03-11
+
+* Move example usage to the readme #329. This may resolve #328.
+
+## [1.4.8] - 2020-03-10
+
+* CI: test more go versions (@nathany 1d13583d846ea9d66dcabbfefbfb9d8e6fb05216)
+* Tests: Queued inotify events could have been read by the test before max_queued_events was hit (@matthias-stone #265)
+* Tests:  t.Fatalf -> t.Errorf in go routines (@gdey #266)
+* CI: Less verbosity (@nathany #267)
+* Tests: Darwin: Exchangedata is deprecated on 10.13 (@nathany #267)
+* Tests: Check if channels are closed in the example (@alexeykazakov #244)
+* CI: Only run golint on latest version of go and fix issues (@cpuguy83 #284)
+* CI: Add windows to travis matrix (@cpuguy83 #284)
+* Docs: Remover appveyor badge (@nathany 11844c0959f6fff69ba325d097fce35bd85a8e93)
+* Linux: create epoll and pipe fds with close-on-exec (@JohannesEbke #219)
+* Linux: open files with close-on-exec (@linxiulei #273)
+* Docs: Plan to support fanotify (@nathany ab058b44498e8b7566a799372a39d150d9ea0119 )
+* Project: Add go.mod (@nathany #309)
+* Project: Revise editor config (@nathany #309)
+* Project: Update copyright for 2019 (@nathany #309)
+* CI: Drop go1.8 from CI matrix (@nathany #309)
+* Docs: Updating the FAQ section for supportability with NFS & FUSE filesystems (@Pratik32 4bf2d1fec78374803a39307bfb8d340688f4f28e )
+
 ## [1.4.7] - 2018-01-09
 
 * BSD/macOS: Fix possible deadlock on closing the watcher on kqueue (thanks @nhooyr and @glycerine)
diff --git a/vendor/github.com/fsnotify/fsnotify/CONTRIBUTING.md b/vendor/github.com/fsnotify/fsnotify/CONTRIBUTING.md
index 828a60b24b..ea379759d5 100644
--- a/vendor/github.com/fsnotify/fsnotify/CONTRIBUTING.md
+++ b/vendor/github.com/fsnotify/fsnotify/CONTRIBUTING.md
@@ -1,77 +1,26 @@
-# Contributing
+Thank you for your interest in contributing to fsnotify! We try to review and
+merge PRs in a reasonable timeframe, but please be aware that:
 
-## Issues
+- To avoid "wasted" work, please discus changes on the issue tracker first. You
+  can just send PRs, but they may end up being rejected for one reason or the
+  other.
 
-* Request features and report bugs using the [GitHub Issue Tracker](https://github.com/fsnotify/fsnotify/issues).
-* Please indicate the platform you are using fsnotify on.
-* A code example to reproduce the problem is appreciated.
+- fsnotify is a cross-platform library, and changes must work reasonably well on
+  all supported platforms.
 
-## Pull Requests
+- Changes will need to be compatible; old code should still compile, and the
+  runtime behaviour can't change in ways that are likely to lead to problems for
+  users.
 
-### Contributor License Agreement
+Testing
+-------
+Just `go test ./...` runs all the tests; the CI runs this on all supported
+platforms. Testing different platforms locally can be done with something like
+[goon] or [Vagrant], but this isn't super-easy to set up at the moment.
 
-fsnotify is derived from code in the [golang.org/x/exp](https://godoc.org/golang.org/x/exp) package and it may be included [in the standard library](https://github.com/fsnotify/fsnotify/issues/1) in the future. Therefore fsnotify carries the same [LICENSE](https://github.com/fsnotify/fsnotify/blob/master/LICENSE) as Go. Contributors retain their copyright, so you need to fill out a short form before we can accept your contribution: [Google Individual Contributor License Agreement](https://developers.google.com/open-source/cla/individual).
+Use the `-short` flag to make the "stress test" run faster.
 
-Please indicate that you have signed the CLA in your pull request.
 
-### How fsnotify is Developed
-
-* Development is done on feature branches.
-* Tests are run on BSD, Linux, macOS and Windows.
-* Pull requests are reviewed and [applied to master][am] using [hub][].
-  * Maintainers may modify or squash commits rather than asking contributors to.
-* To issue a new release, the maintainers will:
-  * Update the CHANGELOG
-  * Tag a version, which will become available through gopkg.in.
- 
-### How to Fork
-
-For smooth sailing, always use the original import path. Installing with `go get` makes this easy. 
-
-1. Install from GitHub (`go get -u github.com/fsnotify/fsnotify`)
-2. Create your feature branch (`git checkout -b my-new-feature`)
-3. Ensure everything works and the tests pass (see below)
-4. Commit your changes (`git commit -am 'Add some feature'`)
-
-Contribute upstream:
-
-1. Fork fsnotify on GitHub
-2. Add your remote (`git remote add fork git@github.com:mycompany/repo.git`)
-3. Push to the branch (`git push fork my-new-feature`)
-4. Create a new Pull Request on GitHub
-
-This workflow is [thoroughly explained by Katrina Owen](https://splice.com/blog/contributing-open-source-git-repositories-go/).
-
-### Testing
-
-fsnotify uses build tags to compile different code on Linux, BSD, macOS, and Windows.
-
-Before doing a pull request, please do your best to test your changes on multiple platforms, and list which platforms you were able/unable to test on.
-
-To aid in cross-platform testing there is a Vagrantfile for Linux and BSD.
-
-* Install [Vagrant](http://www.vagrantup.com/) and [VirtualBox](https://www.virtualbox.org/)
-* Setup [Vagrant Gopher](https://github.com/nathany/vagrant-gopher) in your `src` folder.
-* Run `vagrant up` from the project folder. You can also setup just one box with `vagrant up linux` or `vagrant up bsd` (note: the BSD box doesn't support Windows hosts at this time, and NFS may prompt for your host OS password)
-* Once setup, you can run the test suite on a given OS with a single command `vagrant ssh linux -c 'cd fsnotify/fsnotify; go test'`.
-* When you're done, you will want to halt or destroy the Vagrant boxes.
-
-Notice: fsnotify file system events won't trigger in shared folders. The tests get around this limitation by using the /tmp directory.
-
-Right now there is no equivalent solution for Windows and macOS, but there are Windows VMs [freely available from Microsoft](http://www.modern.ie/en-us/virtualization-tools#downloads).
-
-### Maintainers
-
-Help maintaining fsnotify is welcome. To be a maintainer:
-
-* Submit a pull request and sign the CLA as above.
-* You must be able to run the test suite on Mac, Windows, Linux and BSD.
-
-To keep master clean, the fsnotify project uses the "apply mail" workflow outlined in Nathaniel Talbott's post ["Merge pull request" Considered Harmful][am]. This requires installing [hub][].
-
-All code changes should be internal pull requests.
-
-Releases are tagged using [Semantic Versioning](http://semver.org/).
-
-[hub]: https://github.com/github/hub
-[am]: http://blog.spreedly.com/2014/06/24/merge-pull-request-considered-harmful/#.VGa5yZPF_Zs
+[goon]: https://github.com/arp242/goon
+[Vagrant]: https://www.vagrantup.com/
+[integration_test.go]: /integration_test.go
diff --git a/vendor/github.com/fsnotify/fsnotify/LICENSE b/vendor/github.com/fsnotify/fsnotify/LICENSE
index e180c8fb05..fb03ade750 100644
--- a/vendor/github.com/fsnotify/fsnotify/LICENSE
+++ b/vendor/github.com/fsnotify/fsnotify/LICENSE
@@ -1,28 +1,25 @@
-Copyright (c) 2012 The Go Authors. All rights reserved.
-Copyright (c) 2012-2019 fsnotify Authors. All rights reserved.
+Copyright © 2012 The Go Authors. All rights reserved.
+Copyright © fsnotify Authors. All rights reserved.
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
 
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this
+  list of conditions and the following disclaimer in the documentation and/or
+  other materials provided with the distribution.
+* Neither the name of Google Inc. nor the names of its contributors may be used
+  to endorse or promote products derived from this software without specific
+  prior written permission.
 
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/fsnotify/fsnotify/README.md b/vendor/github.com/fsnotify/fsnotify/README.md
index df57b1b282..d4e6080feb 100644
--- a/vendor/github.com/fsnotify/fsnotify/README.md
+++ b/vendor/github.com/fsnotify/fsnotify/README.md
@@ -1,130 +1,161 @@
-# File system notifications for Go
+fsnotify is a Go library to provide cross-platform filesystem notifications on
+Windows, Linux, macOS, and BSD systems.
 
-[![GoDoc](https://godoc.org/github.com/fsnotify/fsnotify?status.svg)](https://godoc.org/github.com/fsnotify/fsnotify) [![Go Report Card](https://goreportcard.com/badge/github.com/fsnotify/fsnotify)](https://goreportcard.com/report/github.com/fsnotify/fsnotify)
+Go 1.16 or newer is required; the full documentation is at
+https://pkg.go.dev/github.com/fsnotify/fsnotify
 
-fsnotify utilizes [golang.org/x/sys](https://godoc.org/golang.org/x/sys) rather than `syscall` from the standard library. Ensure you have the latest version installed by running:
+**It's best to read the documentation at pkg.go.dev, as it's pinned to the last
+released version, whereas this README is for the last development version which
+may include additions/changes.**
 
-```console
-go get -u golang.org/x/sys/...
-```
-
-Cross platform: Windows, Linux, BSD and macOS.
-
-| Adapter               | OS                               | Status                                                                                                                          |
-| --------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| inotify               | Linux 2.6.27 or later, Android\* | Supported |
-| kqueue                | BSD, macOS, iOS\*                | Supported |
-| ReadDirectoryChangesW | Windows                          | Supported |
-| FSEvents              | macOS                            | [Planned](https://github.com/fsnotify/fsnotify/issues/11)                                                                       |
-| FEN                   | Solaris 11                       | [In Progress](https://github.com/fsnotify/fsnotify/issues/12)                                                                   |
-| fanotify              | Linux 2.6.37+                    | [Planned](https://github.com/fsnotify/fsnotify/issues/114)                                                                      |
-| USN Journals          | Windows                          | [Maybe](https://github.com/fsnotify/fsnotify/issues/53)                                                                         |
-| Polling               | *All*                            | [Maybe](https://github.com/fsnotify/fsnotify/issues/9)                                                                          |
-
-\* Android and iOS are untested.
-
-Please see [the documentation](https://godoc.org/github.com/fsnotify/fsnotify) and consult the [FAQ](#faq) for usage information.
-
-## API stability
+---
 
-fsnotify is a fork of [howeyc/fsnotify](https://godoc.org/github.com/howeyc/fsnotify) with a new API as of v1.0. The API is based on [this design document](http://goo.gl/MrYxyA). 
+Platform support:
 
-All [releases](https://github.com/fsnotify/fsnotify/releases) are tagged based on [Semantic Versioning](http://semver.org/). Further API changes are [planned](https://github.com/fsnotify/fsnotify/milestones), and will be tagged with a new major revision number.
+| Adapter               | OS             | Status                                                       |
+| --------------------- | ---------------| -------------------------------------------------------------|
+| inotify               | Linux 2.6.32+  | Supported                                                    |
+| kqueue                | BSD, macOS     | Supported                                                    |
+| ReadDirectoryChangesW | Windows        | Supported                                                    |
+| FSEvents              | macOS          | [Planned](https://github.com/fsnotify/fsnotify/issues/11)    |
+| FEN                   | Solaris 11     | [In Progress](https://github.com/fsnotify/fsnotify/pull/371) |
+| fanotify              | Linux 5.9+     | [Maybe](https://github.com/fsnotify/fsnotify/issues/114)     |
+| USN Journals          | Windows        | [Maybe](https://github.com/fsnotify/fsnotify/issues/53)      |
+| Polling               | *All*          | [Maybe](https://github.com/fsnotify/fsnotify/issues/9)       |
 
-Go 1.6 supports dependencies located in the `vendor/` folder. Unless you are creating a library, it is recommended that you copy fsnotify into `vendor/github.com/fsnotify/fsnotify` within your project, and likewise for `golang.org/x/sys`.
+Linux and macOS should include Android and iOS, but these are currently untested.
 
-## Usage
+Usage
+-----
+A basic example:
 
 ```go
 package main
 
 import (
-	"log"
+    "log"
 
-	"github.com/fsnotify/fsnotify"
+    "github.com/fsnotify/fsnotify"
 )
 
 func main() {
-	watcher, err := fsnotify.NewWatcher()
-	if err != nil {
-		log.Fatal(err)
-	}
-	defer watcher.Close()
-
-	done := make(chan bool)
-	go func() {
-		for {
-			select {
-			case event, ok := <-watcher.Events:
-				if !ok {
-					return
-				}
-				log.Println("event:", event)
-				if event.Op&fsnotify.Write == fsnotify.Write {
-					log.Println("modified file:", event.Name)
-				}
-			case err, ok := <-watcher.Errors:
-				if !ok {
-					return
-				}
-				log.Println("error:", err)
-			}
-		}
-	}()
-
-	err = watcher.Add("/tmp/foo")
-	if err != nil {
-		log.Fatal(err)
-	}
-	<-done
+    // Create new watcher.
+    watcher, err := fsnotify.NewWatcher()
+    if err != nil {
+        log.Fatal(err)
+    }
+    defer watcher.Close()
+
+    // Start listening for events.
+    go func() {
+        for {
+            select {
+            case event, ok := <-watcher.Events:
+                if !ok {
+                    return
+                }
+                log.Println("event:", event)
+                if event.Has(fsnotify.Write) {
+                    log.Println("modified file:", event.Name)
+                }
+            case err, ok := <-watcher.Errors:
+                if !ok {
+                    return
+                }
+                log.Println("error:", err)
+            }
+        }
+    }()
+
+    // Add a path.
+    err = watcher.Add("/tmp")
+    if err != nil {
+        log.Fatal(err)
+    }
+
+    // Block main goroutine forever.
+    <-make(chan struct{})
 }
 ```
 
-## Contributing
+Some more examples can be found in [cmd/fsnotify](cmd/fsnotify), which can be
+run with:
 
-Please refer to [CONTRIBUTING][] before opening an issue or pull request.
+    % go run ./cmd/fsnotify
 
-## Example
+FAQ
+---
+### Will a file still be watched when it's moved to another directory?
+No, not unless you are watching the location it was moved to.
 
-See [example_test.go](https://github.com/fsnotify/fsnotify/blob/master/example_test.go).
+### Are subdirectories watched too?
+No, you must add watches for any directory you want to watch (a recursive
+watcher is on the roadmap: [#18]).
 
-## FAQ
+[#18]: https://github.com/fsnotify/fsnotify/issues/18
 
-**When a file is moved to another directory is it still being watched?**
+### Do I have to watch the Error and Event channels in a goroutine?
+As of now, yes (you can read both channels in the same goroutine using `select`,
+you don't need a separate goroutine for both channels; see the example).
 
-No (it shouldn't be, unless you are watching where it was moved to).
+### Why don't notifications work with NFS, SMB, FUSE, /proc, or /sys?
+fsnotify requires support from underlying OS to work. The current NFS and SMB
+protocols does not provide network level support for file notifications, and
+neither do the /proc and /sys virtual filesystems.
 
-**When I watch a directory, are all subdirectories watched as well?**
+This could be fixed with a polling watcher ([#9]), but it's not yet implemented.
 
-No, you must add watches for any directory you want to watch (a recursive watcher is on the roadmap [#18][]).
+[#9]: https://github.com/fsnotify/fsnotify/issues/9
 
-**Do I have to watch the Error and Event channels in a separate goroutine?**
+Platform-specific notes
+-----------------------
+### Linux
+When a file is removed a REMOVE event won't be emitted until all file
+descriptors are closed; it will emit a CHMOD instead:
 
-As of now, yes. Looking into making this single-thread friendly (see [howeyc #7][#7])
+    fp := os.Open("file")
+    os.Remove("file")        // CHMOD
+    fp.Close()               // REMOVE
 
-**Why am I receiving multiple events for the same file on OS X?**
+This is the event that inotify sends, so not much can be changed about this.
 
-Spotlight indexing on OS X can result in multiple events (see [howeyc #62][#62]). A temporary workaround is to add your folder(s) to the *Spotlight Privacy settings* until we have a native FSEvents implementation (see [#11][]).
+The `fs.inotify.max_user_watches` sysctl variable specifies the upper limit for
+the number of watches per user, and `fs.inotify.max_user_instances` specifies
+the maximum number of inotify instances per user. Every Watcher you create is an
+"instance", and every path you add is a "watch".
 
-**How many files can be watched at once?**
+These are also exposed in `/proc` as `/proc/sys/fs/inotify/max_user_watches` and
+`/proc/sys/fs/inotify/max_user_instances`
 
-There are OS-specific limits as to how many watches can be created:
-* Linux: /proc/sys/fs/inotify/max_user_watches contains the limit, reaching this limit results in a "no space left on device" error.
-* BSD / OSX: sysctl variables "kern.maxfiles" and "kern.maxfilesperproc", reaching these limits results in a "too many open files" error.
+To increase them you can use `sysctl` or write the value to proc file:
 
-**Why don't notifications work with NFS filesystems or filesystem in userspace (FUSE)?**
+    # The default values on Linux 5.18
+    sysctl fs.inotify.max_user_watches=124983
+    sysctl fs.inotify.max_user_instances=128
 
-fsnotify requires support from underlying OS to work. The current NFS protocol does not provide network level support for file notifications.
+To make the changes persist on reboot edit `/etc/sysctl.conf` or
+`/usr/lib/sysctl.d/50-default.conf` (details differ per Linux distro; check your
+distro's documentation):
 
-[#62]: https://github.com/howeyc/fsnotify/issues/62
-[#18]: https://github.com/fsnotify/fsnotify/issues/18
-[#11]: https://github.com/fsnotify/fsnotify/issues/11
-[#7]: https://github.com/howeyc/fsnotify/issues/7
+    fs.inotify.max_user_watches=124983
+    fs.inotify.max_user_instances=128
 
-[contributing]: https://github.com/fsnotify/fsnotify/blob/master/CONTRIBUTING.md
+Reaching the limit will result in a "no space left on device" or "too many open
+files" error.
 
-## Related Projects
+### kqueue (macOS, all BSD systems)
+kqueue requires opening a file descriptor for every file that's being watched;
+so if you're watching a directory with five files then that's six file
+descriptors. You will run in to your system's "max open files" limit faster on
+these platforms.
 
-* [notify](https://github.com/rjeczalik/notify)
-* [fsevents](https://github.com/fsnotify/fsevents)
+The sysctl variables `kern.maxfiles` and `kern.maxfilesperproc` can be used to
+control the maximum number of open files.
 
+### macOS
+Spotlight indexing on macOS can result in multiple events (see [#15]). A temporary
+workaround is to add your folder(s) to the *Spotlight Privacy settings* until we
+have a native FSEvents implementation (see [#11]).
+
+[#11]: https://github.com/fsnotify/fsnotify/issues/11
+[#15]: https://github.com/fsnotify/fsnotify/issues/15
diff --git a/vendor/github.com/fsnotify/fsnotify/backend_fen.go b/vendor/github.com/fsnotify/fsnotify/backend_fen.go
new file mode 100644
index 0000000000..1a95ad8e7c
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/backend_fen.go
@@ -0,0 +1,162 @@
+//go:build solaris
+// +build solaris
+
+package fsnotify
+
+import (
+	"errors"
+)
+
+// Watcher watches a set of paths, delivering events on a channel.
+//
+// A watcher should not be copied (e.g. pass it by pointer, rather than by
+// value).
+//
+// # Linux notes
+//
+// When a file is removed a Remove event won't be emitted until all file
+// descriptors are closed, and deletes will always emit a Chmod. For example:
+//
+//     fp := os.Open("file")
+//     os.Remove("file")        // Triggers Chmod
+//     fp.Close()               // Triggers Remove
+//
+// This is the event that inotify sends, so not much can be changed about this.
+//
+// The fs.inotify.max_user_watches sysctl variable specifies the upper limit
+// for the number of watches per user, and fs.inotify.max_user_instances
+// specifies the maximum number of inotify instances per user. Every Watcher you
+// create is an "instance", and every path you add is a "watch".
+//
+// These are also exposed in /proc as /proc/sys/fs/inotify/max_user_watches and
+// /proc/sys/fs/inotify/max_user_instances
+//
+// To increase them you can use sysctl or write the value to the /proc file:
+//
+//     # Default values on Linux 5.18
+//     sysctl fs.inotify.max_user_watches=124983
+//     sysctl fs.inotify.max_user_instances=128
+//
+// To make the changes persist on reboot edit /etc/sysctl.conf or
+// /usr/lib/sysctl.d/50-default.conf (details differ per Linux distro; check
+// your distro's documentation):
+//
+//     fs.inotify.max_user_watches=124983
+//     fs.inotify.max_user_instances=128
+//
+// Reaching the limit will result in a "no space left on device" or "too many open
+// files" error.
+//
+// # kqueue notes (macOS, BSD)
+//
+// kqueue requires opening a file descriptor for every file that's being watched;
+// so if you're watching a directory with five files then that's six file
+// descriptors. You will run in to your system's "max open files" limit faster on
+// these platforms.
+//
+// The sysctl variables kern.maxfiles and kern.maxfilesperproc can be used to
+// control the maximum number of open files, as well as /etc/login.conf on BSD
+// systems.
+//
+// # macOS notes
+//
+// Spotlight indexing on macOS can result in multiple events (see [#15]). A
+// temporary workaround is to add your folder(s) to the "Spotlight Privacy
+// Settings" until we have a native FSEvents implementation (see [#11]).
+//
+// [#11]: https://github.com/fsnotify/fsnotify/issues/11
+// [#15]: https://github.com/fsnotify/fsnotify/issues/15
+type Watcher struct {
+	// Events sends the filesystem change events.
+	//
+	// fsnotify can send the following events; a "path" here can refer to a
+	// file, directory, symbolic link, or special file like a FIFO.
+	//
+	//   fsnotify.Create    A new path was created; this may be followed by one
+	//                      or more Write events if data also gets written to a
+	//                      file.
+	//
+	//   fsnotify.Remove    A path was removed.
+	//
+	//   fsnotify.Rename    A path was renamed. A rename is always sent with the
+	//                      old path as Event.Name, and a Create event will be
+	//                      sent with the new name. Renames are only sent for
+	//                      paths that are currently watched; e.g. moving an
+	//                      unmonitored file into a monitored directory will
+	//                      show up as just a Create. Similarly, renaming a file
+	//                      to outside a monitored directory will show up as
+	//                      only a Rename.
+	//
+	//   fsnotify.Write     A file or named pipe was written to. A Truncate will
+	//                      also trigger a Write. A single "write action"
+	//                      initiated by the user may show up as one or multiple
+	//                      writes, depending on when the system syncs things to
+	//                      disk. For example when compiling a large Go program
+	//                      you may get hundreds of Write events, so you
+	//                      probably want to wait until you've stopped receiving
+	//                      them (see the dedup example in cmd/fsnotify).
+	//
+	//   fsnotify.Chmod     Attributes were changed. On Linux this is also sent
+	//                      when a file is removed (or more accurately, when a
+	//                      link to an inode is removed). On kqueue it's sent
+	//                      and on kqueue when a file is truncated. On Windows
+	//                      it's never sent.
+	Events chan Event
+
+	// Errors sends any errors.
+	Errors chan error
+}
+
+// NewWatcher creates a new Watcher.
+func NewWatcher() (*Watcher, error) {
+	return nil, errors.New("FEN based watcher not yet supported for fsnotify\n")
+}
+
+// Close removes all watches and closes the events channel.
+func (w *Watcher) Close() error {
+	return nil
+}
+
+// Add starts monitoring the path for changes.
+//
+// A path can only be watched once; attempting to watch it more than once will
+// return an error. Paths that do not yet exist on the filesystem cannot be
+// added. A watch will be automatically removed if the path is deleted.
+//
+// A path will remain watched if it gets renamed to somewhere else on the same
+// filesystem, but the monitor will get removed if the path gets deleted and
+// re-created, or if it's moved to a different filesystem.
+//
+// Notifications on network filesystems (NFS, SMB, FUSE, etc.) or special
+// filesystems (/proc, /sys, etc.) generally don't work.
+//
+// # Watching directories
+//
+// All files in a directory are monitored, including new files that are created
+// after the watcher is started. Subdirectories are not watched (i.e. it's
+// non-recursive).
+//
+// # Watching files
+//
+// Watching individual files (rather than directories) is generally not
+// recommended as many tools update files atomically. Instead of "just" writing
+// to the file a temporary file will be written to first, and if successful the
+// temporary file is moved to to destination removing the original, or some
+// variant thereof. The watcher on the original file is now lost, as it no
+// longer exists.
+//
+// Instead, watch the parent directory and use Event.Name to filter out files
+// you're not interested in. There is an example of this in [cmd/fsnotify/file.go].
+func (w *Watcher) Add(name string) error {
+	return nil
+}
+
+// Remove stops monitoring the path for changes.
+//
+// Directories are always removed non-recursively. For example, if you added
+// /tmp/dir and /tmp/dir/subdir then you will need to remove both.
+//
+// Removing a path that has not yet been added returns [ErrNonExistentWatch].
+func (w *Watcher) Remove(name string) error {
+	return nil
+}
diff --git a/vendor/github.com/fsnotify/fsnotify/backend_inotify.go b/vendor/github.com/fsnotify/fsnotify/backend_inotify.go
new file mode 100644
index 0000000000..54c77fbb0e
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/backend_inotify.go
@@ -0,0 +1,459 @@
+//go:build linux
+// +build linux
+
+package fsnotify
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// Watcher watches a set of paths, delivering events on a channel.
+//
+// A watcher should not be copied (e.g. pass it by pointer, rather than by
+// value).
+//
+// # Linux notes
+//
+// When a file is removed a Remove event won't be emitted until all file
+// descriptors are closed, and deletes will always emit a Chmod. For example:
+//
+//     fp := os.Open("file")
+//     os.Remove("file")        // Triggers Chmod
+//     fp.Close()               // Triggers Remove
+//
+// This is the event that inotify sends, so not much can be changed about this.
+//
+// The fs.inotify.max_user_watches sysctl variable specifies the upper limit
+// for the number of watches per user, and fs.inotify.max_user_instances
+// specifies the maximum number of inotify instances per user. Every Watcher you
+// create is an "instance", and every path you add is a "watch".
+//
+// These are also exposed in /proc as /proc/sys/fs/inotify/max_user_watches and
+// /proc/sys/fs/inotify/max_user_instances
+//
+// To increase them you can use sysctl or write the value to the /proc file:
+//
+//     # Default values on Linux 5.18
+//     sysctl fs.inotify.max_user_watches=124983
+//     sysctl fs.inotify.max_user_instances=128
+//
+// To make the changes persist on reboot edit /etc/sysctl.conf or
+// /usr/lib/sysctl.d/50-default.conf (details differ per Linux distro; check
+// your distro's documentation):
+//
+//     fs.inotify.max_user_watches=124983
+//     fs.inotify.max_user_instances=128
+//
+// Reaching the limit will result in a "no space left on device" or "too many open
+// files" error.
+//
+// # kqueue notes (macOS, BSD)
+//
+// kqueue requires opening a file descriptor for every file that's being watched;
+// so if you're watching a directory with five files then that's six file
+// descriptors. You will run in to your system's "max open files" limit faster on
+// these platforms.
+//
+// The sysctl variables kern.maxfiles and kern.maxfilesperproc can be used to
+// control the maximum number of open files, as well as /etc/login.conf on BSD
+// systems.
+//
+// # macOS notes
+//
+// Spotlight indexing on macOS can result in multiple events (see [#15]). A
+// temporary workaround is to add your folder(s) to the "Spotlight Privacy
+// Settings" until we have a native FSEvents implementation (see [#11]).
+//
+// [#11]: https://github.com/fsnotify/fsnotify/issues/11
+// [#15]: https://github.com/fsnotify/fsnotify/issues/15
+type Watcher struct {
+	// Events sends the filesystem change events.
+	//
+	// fsnotify can send the following events; a "path" here can refer to a
+	// file, directory, symbolic link, or special file like a FIFO.
+	//
+	//   fsnotify.Create    A new path was created; this may be followed by one
+	//                      or more Write events if data also gets written to a
+	//                      file.
+	//
+	//   fsnotify.Remove    A path was removed.
+	//
+	//   fsnotify.Rename    A path was renamed. A rename is always sent with the
+	//                      old path as Event.Name, and a Create event will be
+	//                      sent with the new name. Renames are only sent for
+	//                      paths that are currently watched; e.g. moving an
+	//                      unmonitored file into a monitored directory will
+	//                      show up as just a Create. Similarly, renaming a file
+	//                      to outside a monitored directory will show up as
+	//                      only a Rename.
+	//
+	//   fsnotify.Write     A file or named pipe was written to. A Truncate will
+	//                      also trigger a Write. A single "write action"
+	//                      initiated by the user may show up as one or multiple
+	//                      writes, depending on when the system syncs things to
+	//                      disk. For example when compiling a large Go program
+	//                      you may get hundreds of Write events, so you
+	//                      probably want to wait until you've stopped receiving
+	//                      them (see the dedup example in cmd/fsnotify).
+	//
+	//   fsnotify.Chmod     Attributes were changed. On Linux this is also sent
+	//                      when a file is removed (or more accurately, when a
+	//                      link to an inode is removed). On kqueue it's sent
+	//                      and on kqueue when a file is truncated. On Windows
+	//                      it's never sent.
+	Events chan Event
+
+	// Errors sends any errors.
+	Errors chan error
+
+	// Store fd here as os.File.Read() will no longer return on close after
+	// calling Fd(). See: https://github.com/golang/go/issues/26439
+	fd          int
+	mu          sync.Mutex // Map access
+	inotifyFile *os.File
+	watches     map[string]*watch // Map of inotify watches (key: path)
+	paths       map[int]string    // Map of watched paths (key: watch descriptor)
+	done        chan struct{}     // Channel for sending a "quit message" to the reader goroutine
+	doneResp    chan struct{}     // Channel to respond to Close
+}
+
+// NewWatcher creates a new Watcher.
+func NewWatcher() (*Watcher, error) {
+	// Create inotify fd
+	// Need to set the FD to nonblocking mode in order for SetDeadline methods to work
+	// Otherwise, blocking i/o operations won't terminate on close
+	fd, errno := unix.InotifyInit1(unix.IN_CLOEXEC | unix.IN_NONBLOCK)
+	if fd == -1 {
+		return nil, errno
+	}
+
+	w := &Watcher{
+		fd:          fd,
+		inotifyFile: os.NewFile(uintptr(fd), ""),
+		watches:     make(map[string]*watch),
+		paths:       make(map[int]string),
+		Events:      make(chan Event),
+		Errors:      make(chan error),
+		done:        make(chan struct{}),
+		doneResp:    make(chan struct{}),
+	}
+
+	go w.readEvents()
+	return w, nil
+}
+
+// Returns true if the event was sent, or false if watcher is closed.
+func (w *Watcher) sendEvent(e Event) bool {
+	select {
+	case w.Events <- e:
+		return true
+	case <-w.done:
+	}
+	return false
+}
+
+// Returns true if the error was sent, or false if watcher is closed.
+func (w *Watcher) sendError(err error) bool {
+	select {
+	case w.Errors <- err:
+		return true
+	case <-w.done:
+		return false
+	}
+}
+
+func (w *Watcher) isClosed() bool {
+	select {
+	case <-w.done:
+		return true
+	default:
+		return false
+	}
+}
+
+// Close removes all watches and closes the events channel.
+func (w *Watcher) Close() error {
+	w.mu.Lock()
+	if w.isClosed() {
+		w.mu.Unlock()
+		return nil
+	}
+
+	// Send 'close' signal to goroutine, and set the Watcher to closed.
+	close(w.done)
+	w.mu.Unlock()
+
+	// Causes any blocking reads to return with an error, provided the file
+	// still supports deadline operations.
+	err := w.inotifyFile.Close()
+	if err != nil {
+		return err
+	}
+
+	// Wait for goroutine to close
+	<-w.doneResp
+
+	return nil
+}
+
+// Add starts monitoring the path for changes.
+//
+// A path can only be watched once; attempting to watch it more than once will
+// return an error. Paths that do not yet exist on the filesystem cannot be
+// added. A watch will be automatically removed if the path is deleted.
+//
+// A path will remain watched if it gets renamed to somewhere else on the same
+// filesystem, but the monitor will get removed if the path gets deleted and
+// re-created, or if it's moved to a different filesystem.
+//
+// Notifications on network filesystems (NFS, SMB, FUSE, etc.) or special
+// filesystems (/proc, /sys, etc.) generally don't work.
+//
+// # Watching directories
+//
+// All files in a directory are monitored, including new files that are created
+// after the watcher is started. Subdirectories are not watched (i.e. it's
+// non-recursive).
+//
+// # Watching files
+//
+// Watching individual files (rather than directories) is generally not
+// recommended as many tools update files atomically. Instead of "just" writing
+// to the file a temporary file will be written to first, and if successful the
+// temporary file is moved to to destination removing the original, or some
+// variant thereof. The watcher on the original file is now lost, as it no
+// longer exists.
+//
+// Instead, watch the parent directory and use Event.Name to filter out files
+// you're not interested in. There is an example of this in [cmd/fsnotify/file.go].
+func (w *Watcher) Add(name string) error {
+	name = filepath.Clean(name)
+	if w.isClosed() {
+		return errors.New("inotify instance already closed")
+	}
+
+	var flags uint32 = unix.IN_MOVED_TO | unix.IN_MOVED_FROM |
+		unix.IN_CREATE | unix.IN_ATTRIB | unix.IN_MODIFY |
+		unix.IN_MOVE_SELF | unix.IN_DELETE | unix.IN_DELETE_SELF
+
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	watchEntry := w.watches[name]
+	if watchEntry != nil {
+		flags |= watchEntry.flags | unix.IN_MASK_ADD
+	}
+	wd, errno := unix.InotifyAddWatch(w.fd, name, flags)
+	if wd == -1 {
+		return errno
+	}
+
+	if watchEntry == nil {
+		w.watches[name] = &watch{wd: uint32(wd), flags: flags}
+		w.paths[wd] = name
+	} else {
+		watchEntry.wd = uint32(wd)
+		watchEntry.flags = flags
+	}
+
+	return nil
+}
+
+// Remove stops monitoring the path for changes.
+//
+// Directories are always removed non-recursively. For example, if you added
+// /tmp/dir and /tmp/dir/subdir then you will need to remove both.
+//
+// Removing a path that has not yet been added returns [ErrNonExistentWatch].
+func (w *Watcher) Remove(name string) error {
+	name = filepath.Clean(name)
+
+	// Fetch the watch.
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	watch, ok := w.watches[name]
+
+	// Remove it from inotify.
+	if !ok {
+		return fmt.Errorf("%w: %s", ErrNonExistentWatch, name)
+	}
+
+	// We successfully removed the watch if InotifyRmWatch doesn't return an
+	// error, we need to clean up our internal state to ensure it matches
+	// inotify's kernel state.
+	delete(w.paths, int(watch.wd))
+	delete(w.watches, name)
+
+	// inotify_rm_watch will return EINVAL if the file has been deleted;
+	// the inotify will already have been removed.
+	// watches and pathes are deleted in ignoreLinux() implicitly and asynchronously
+	// by calling inotify_rm_watch() below. e.g. readEvents() goroutine receives IN_IGNORE
+	// so that EINVAL means that the wd is being rm_watch()ed or its file removed
+	// by another thread and we have not received IN_IGNORE event.
+	success, errno := unix.InotifyRmWatch(w.fd, watch.wd)
+	if success == -1 {
+		// TODO: Perhaps it's not helpful to return an error here in every case;
+		//       The only two possible errors are:
+		//
+		//       - EBADF, which happens when w.fd is not a valid file descriptor
+		//         of any kind.
+		//       - EINVAL, which is when fd is not an inotify descriptor or wd
+		//         is not a valid watch descriptor. Watch descriptors are
+		//         invalidated when they are removed explicitly or implicitly;
+		//         explicitly by inotify_rm_watch, implicitly when the file they
+		//         are watching is deleted.
+		return errno
+	}
+
+	return nil
+}
+
+// WatchList returns all paths added with [Add] (and are not yet removed).
+func (w *Watcher) WatchList() []string {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	entries := make([]string, 0, len(w.watches))
+	for pathname := range w.watches {
+		entries = append(entries, pathname)
+	}
+
+	return entries
+}
+
+type watch struct {
+	wd    uint32 // Watch descriptor (as returned by the inotify_add_watch() syscall)
+	flags uint32 // inotify flags of this watch (see inotify(7) for the list of valid flags)
+}
+
+// readEvents reads from the inotify file descriptor, converts the
+// received events into Event objects and sends them via the Events channel
+func (w *Watcher) readEvents() {
+	defer func() {
+		close(w.doneResp)
+		close(w.Errors)
+		close(w.Events)
+	}()
+
+	var (
+		buf   [unix.SizeofInotifyEvent * 4096]byte // Buffer for a maximum of 4096 raw events
+		errno error                                // Syscall errno
+	)
+	for {
+		// See if we have been closed.
+		if w.isClosed() {
+			return
+		}
+
+		n, err := w.inotifyFile.Read(buf[:])
+		switch {
+		case errors.Unwrap(err) == os.ErrClosed:
+			return
+		case err != nil:
+			if !w.sendError(err) {
+				return
+			}
+			continue
+		}
+
+		if n < unix.SizeofInotifyEvent {
+			var err error
+			if n == 0 {
+				// If EOF is received. This should really never happen.
+				err = io.EOF
+			} else if n < 0 {
+				// If an error occurred while reading.
+				err = errno
+			} else {
+				// Read was too short.
+				err = errors.New("notify: short read in readEvents()")
+			}
+			if !w.sendError(err) {
+				return
+			}
+			continue
+		}
+
+		var offset uint32
+		// We don't know how many events we just read into the buffer
+		// While the offset points to at least one whole event...
+		for offset <= uint32(n-unix.SizeofInotifyEvent) {
+			var (
+				// Point "raw" to the event in the buffer
+				raw     = (*unix.InotifyEvent)(unsafe.Pointer(&buf[offset]))
+				mask    = uint32(raw.Mask)
+				nameLen = uint32(raw.Len)
+			)
+
+			if mask&unix.IN_Q_OVERFLOW != 0 {
+				if !w.sendError(ErrEventOverflow) {
+					return
+				}
+			}
+
+			// If the event happened to the watched directory or the watched file, the kernel
+			// doesn't append the filename to the event, but we would like to always fill the
+			// the "Name" field with a valid filename. We retrieve the path of the watch from
+			// the "paths" map.
+			w.mu.Lock()
+			name, ok := w.paths[int(raw.Wd)]
+			// IN_DELETE_SELF occurs when the file/directory being watched is removed.
+			// This is a sign to clean up the maps, otherwise we are no longer in sync
+			// with the inotify kernel state which has already deleted the watch
+			// automatically.
+			if ok && mask&unix.IN_DELETE_SELF == unix.IN_DELETE_SELF {
+				delete(w.paths, int(raw.Wd))
+				delete(w.watches, name)
+			}
+			w.mu.Unlock()
+
+			if nameLen > 0 {
+				// Point "bytes" at the first byte of the filename
+				bytes := (*[unix.PathMax]byte)(unsafe.Pointer(&buf[offset+unix.SizeofInotifyEvent]))[:nameLen:nameLen]
+				// The filename is padded with NULL bytes. TrimRight() gets rid of those.
+				name += "/" + strings.TrimRight(string(bytes[0:nameLen]), "\000")
+			}
+
+			event := w.newEvent(name, mask)
+
+			// Send the events that are not ignored on the events channel
+			if mask&unix.IN_IGNORED == 0 {
+				if !w.sendEvent(event) {
+					return
+				}
+			}
+
+			// Move to the next event in the buffer
+			offset += unix.SizeofInotifyEvent + nameLen
+		}
+	}
+}
+
+// newEvent returns an platform-independent Event based on an inotify mask.
+func (w *Watcher) newEvent(name string, mask uint32) Event {
+	e := Event{Name: name}
+	if mask&unix.IN_CREATE == unix.IN_CREATE || mask&unix.IN_MOVED_TO == unix.IN_MOVED_TO {
+		e.Op |= Create
+	}
+	if mask&unix.IN_DELETE_SELF == unix.IN_DELETE_SELF || mask&unix.IN_DELETE == unix.IN_DELETE {
+		e.Op |= Remove
+	}
+	if mask&unix.IN_MODIFY == unix.IN_MODIFY {
+		e.Op |= Write
+	}
+	if mask&unix.IN_MOVE_SELF == unix.IN_MOVE_SELF || mask&unix.IN_MOVED_FROM == unix.IN_MOVED_FROM {
+		e.Op |= Rename
+	}
+	if mask&unix.IN_ATTRIB == unix.IN_ATTRIB {
+		e.Op |= Chmod
+	}
+	return e
+}
diff --git a/vendor/github.com/fsnotify/fsnotify/backend_kqueue.go b/vendor/github.com/fsnotify/fsnotify/backend_kqueue.go
new file mode 100644
index 0000000000..29087469bf
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/backend_kqueue.go
@@ -0,0 +1,707 @@
+//go:build freebsd || openbsd || netbsd || dragonfly || darwin
+// +build freebsd openbsd netbsd dragonfly darwin
+
+package fsnotify
+
+import (
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"golang.org/x/sys/unix"
+)
+
+// Watcher watches a set of paths, delivering events on a channel.
+//
+// A watcher should not be copied (e.g. pass it by pointer, rather than by
+// value).
+//
+// # Linux notes
+//
+// When a file is removed a Remove event won't be emitted until all file
+// descriptors are closed, and deletes will always emit a Chmod. For example:
+//
+//     fp := os.Open("file")
+//     os.Remove("file")        // Triggers Chmod
+//     fp.Close()               // Triggers Remove
+//
+// This is the event that inotify sends, so not much can be changed about this.
+//
+// The fs.inotify.max_user_watches sysctl variable specifies the upper limit
+// for the number of watches per user, and fs.inotify.max_user_instances
+// specifies the maximum number of inotify instances per user. Every Watcher you
+// create is an "instance", and every path you add is a "watch".
+//
+// These are also exposed in /proc as /proc/sys/fs/inotify/max_user_watches and
+// /proc/sys/fs/inotify/max_user_instances
+//
+// To increase them you can use sysctl or write the value to the /proc file:
+//
+//     # Default values on Linux 5.18
+//     sysctl fs.inotify.max_user_watches=124983
+//     sysctl fs.inotify.max_user_instances=128
+//
+// To make the changes persist on reboot edit /etc/sysctl.conf or
+// /usr/lib/sysctl.d/50-default.conf (details differ per Linux distro; check
+// your distro's documentation):
+//
+//     fs.inotify.max_user_watches=124983
+//     fs.inotify.max_user_instances=128
+//
+// Reaching the limit will result in a "no space left on device" or "too many open
+// files" error.
+//
+// # kqueue notes (macOS, BSD)
+//
+// kqueue requires opening a file descriptor for every file that's being watched;
+// so if you're watching a directory with five files then that's six file
+// descriptors. You will run in to your system's "max open files" limit faster on
+// these platforms.
+//
+// The sysctl variables kern.maxfiles and kern.maxfilesperproc can be used to
+// control the maximum number of open files, as well as /etc/login.conf on BSD
+// systems.
+//
+// # macOS notes
+//
+// Spotlight indexing on macOS can result in multiple events (see [#15]). A
+// temporary workaround is to add your folder(s) to the "Spotlight Privacy
+// Settings" until we have a native FSEvents implementation (see [#11]).
+//
+// [#11]: https://github.com/fsnotify/fsnotify/issues/11
+// [#15]: https://github.com/fsnotify/fsnotify/issues/15
+type Watcher struct {
+	// Events sends the filesystem change events.
+	//
+	// fsnotify can send the following events; a "path" here can refer to a
+	// file, directory, symbolic link, or special file like a FIFO.
+	//
+	//   fsnotify.Create    A new path was created; this may be followed by one
+	//                      or more Write events if data also gets written to a
+	//                      file.
+	//
+	//   fsnotify.Remove    A path was removed.
+	//
+	//   fsnotify.Rename    A path was renamed. A rename is always sent with the
+	//                      old path as Event.Name, and a Create event will be
+	//                      sent with the new name. Renames are only sent for
+	//                      paths that are currently watched; e.g. moving an
+	//                      unmonitored file into a monitored directory will
+	//                      show up as just a Create. Similarly, renaming a file
+	//                      to outside a monitored directory will show up as
+	//                      only a Rename.
+	//
+	//   fsnotify.Write     A file or named pipe was written to. A Truncate will
+	//                      also trigger a Write. A single "write action"
+	//                      initiated by the user may show up as one or multiple
+	//                      writes, depending on when the system syncs things to
+	//                      disk. For example when compiling a large Go program
+	//                      you may get hundreds of Write events, so you
+	//                      probably want to wait until you've stopped receiving
+	//                      them (see the dedup example in cmd/fsnotify).
+	//
+	//   fsnotify.Chmod     Attributes were changed. On Linux this is also sent
+	//                      when a file is removed (or more accurately, when a
+	//                      link to an inode is removed). On kqueue it's sent
+	//                      and on kqueue when a file is truncated. On Windows
+	//                      it's never sent.
+	Events chan Event
+
+	// Errors sends any errors.
+	Errors chan error
+
+	done         chan struct{}
+	kq           int                         // File descriptor (as returned by the kqueue() syscall).
+	closepipe    [2]int                      // Pipe used for closing.
+	mu           sync.Mutex                  // Protects access to watcher data
+	watches      map[string]int              // Watched file descriptors (key: path).
+	watchesByDir map[string]map[int]struct{} // Watched file descriptors indexed by the parent directory (key: dirname(path)).
+	userWatches  map[string]struct{}         // Watches added with Watcher.Add()
+	dirFlags     map[string]uint32           // Watched directories to fflags used in kqueue.
+	paths        map[int]pathInfo            // File descriptors to path names for processing kqueue events.
+	fileExists   map[string]struct{}         // Keep track of if we know this file exists (to stop duplicate create events).
+	isClosed     bool                        // Set to true when Close() is first called
+}
+
+type pathInfo struct {
+	name  string
+	isDir bool
+}
+
+// NewWatcher creates a new Watcher.
+func NewWatcher() (*Watcher, error) {
+	kq, closepipe, err := newKqueue()
+	if err != nil {
+		return nil, err
+	}
+
+	w := &Watcher{
+		kq:           kq,
+		closepipe:    closepipe,
+		watches:      make(map[string]int),
+		watchesByDir: make(map[string]map[int]struct{}),
+		dirFlags:     make(map[string]uint32),
+		paths:        make(map[int]pathInfo),
+		fileExists:   make(map[string]struct{}),
+		userWatches:  make(map[string]struct{}),
+		Events:       make(chan Event),
+		Errors:       make(chan error),
+		done:         make(chan struct{}),
+	}
+
+	go w.readEvents()
+	return w, nil
+}
+
+// newKqueue creates a new kernel event queue and returns a descriptor.
+//
+// This registers a new event on closepipe, which will trigger an event when
+// it's closed. This way we can use kevent() without timeout/polling; without
+// the closepipe, it would block forever and we wouldn't be able to stop it at
+// all.
+func newKqueue() (kq int, closepipe [2]int, err error) {
+	kq, err = unix.Kqueue()
+	if kq == -1 {
+		return kq, closepipe, err
+	}
+
+	// Register the close pipe.
+	err = unix.Pipe(closepipe[:])
+	if err != nil {
+		unix.Close(kq)
+		return kq, closepipe, err
+	}
+
+	// Register changes to listen on the closepipe.
+	changes := make([]unix.Kevent_t, 1)
+	// SetKevent converts int to the platform-specific types.
+	unix.SetKevent(&changes[0], closepipe[0], unix.EVFILT_READ,
+		unix.EV_ADD|unix.EV_ENABLE|unix.EV_ONESHOT)
+
+	ok, err := unix.Kevent(kq, changes, nil, nil)
+	if ok == -1 {
+		unix.Close(kq)
+		unix.Close(closepipe[0])
+		unix.Close(closepipe[1])
+		return kq, closepipe, err
+	}
+	return kq, closepipe, nil
+}
+
+// Returns true if the event was sent, or false if watcher is closed.
+func (w *Watcher) sendEvent(e Event) bool {
+	select {
+	case w.Events <- e:
+		return true
+	case <-w.done:
+	}
+	return false
+}
+
+// Returns true if the error was sent, or false if watcher is closed.
+func (w *Watcher) sendError(err error) bool {
+	select {
+	case w.Errors <- err:
+		return true
+	case <-w.done:
+	}
+	return false
+}
+
+// Close removes all watches and closes the events channel.
+func (w *Watcher) Close() error {
+	w.mu.Lock()
+	if w.isClosed {
+		w.mu.Unlock()
+		return nil
+	}
+	w.isClosed = true
+
+	// copy paths to remove while locked
+	pathsToRemove := make([]string, 0, len(w.watches))
+	for name := range w.watches {
+		pathsToRemove = append(pathsToRemove, name)
+	}
+	w.mu.Unlock() // Unlock before calling Remove, which also locks
+	for _, name := range pathsToRemove {
+		w.Remove(name)
+	}
+
+	// Send "quit" message to the reader goroutine.
+	unix.Close(w.closepipe[1])
+	close(w.done)
+
+	return nil
+}
+
+// Add starts monitoring the path for changes.
+//
+// A path can only be watched once; attempting to watch it more than once will
+// return an error. Paths that do not yet exist on the filesystem cannot be
+// added. A watch will be automatically removed if the path is deleted.
+//
+// A path will remain watched if it gets renamed to somewhere else on the same
+// filesystem, but the monitor will get removed if the path gets deleted and
+// re-created, or if it's moved to a different filesystem.
+//
+// Notifications on network filesystems (NFS, SMB, FUSE, etc.) or special
+// filesystems (/proc, /sys, etc.) generally don't work.
+//
+// # Watching directories
+//
+// All files in a directory are monitored, including new files that are created
+// after the watcher is started. Subdirectories are not watched (i.e. it's
+// non-recursive).
+//
+// # Watching files
+//
+// Watching individual files (rather than directories) is generally not
+// recommended as many tools update files atomically. Instead of "just" writing
+// to the file a temporary file will be written to first, and if successful the
+// temporary file is moved to to destination removing the original, or some
+// variant thereof. The watcher on the original file is now lost, as it no
+// longer exists.
+//
+// Instead, watch the parent directory and use Event.Name to filter out files
+// you're not interested in. There is an example of this in [cmd/fsnotify/file.go].
+func (w *Watcher) Add(name string) error {
+	w.mu.Lock()
+	w.userWatches[name] = struct{}{}
+	w.mu.Unlock()
+	_, err := w.addWatch(name, noteAllEvents)
+	return err
+}
+
+// Remove stops monitoring the path for changes.
+//
+// Directories are always removed non-recursively. For example, if you added
+// /tmp/dir and /tmp/dir/subdir then you will need to remove both.
+//
+// Removing a path that has not yet been added returns [ErrNonExistentWatch].
+func (w *Watcher) Remove(name string) error {
+	name = filepath.Clean(name)
+	w.mu.Lock()
+	watchfd, ok := w.watches[name]
+	w.mu.Unlock()
+	if !ok {
+		return fmt.Errorf("%w: %s", ErrNonExistentWatch, name)
+	}
+
+	err := w.register([]int{watchfd}, unix.EV_DELETE, 0)
+	if err != nil {
+		return err
+	}
+
+	unix.Close(watchfd)
+
+	w.mu.Lock()
+	isDir := w.paths[watchfd].isDir
+	delete(w.watches, name)
+	delete(w.userWatches, name)
+
+	parentName := filepath.Dir(name)
+	delete(w.watchesByDir[parentName], watchfd)
+
+	if len(w.watchesByDir[parentName]) == 0 {
+		delete(w.watchesByDir, parentName)
+	}
+
+	delete(w.paths, watchfd)
+	delete(w.dirFlags, name)
+	delete(w.fileExists, name)
+	w.mu.Unlock()
+
+	// Find all watched paths that are in this directory that are not external.
+	if isDir {
+		var pathsToRemove []string
+		w.mu.Lock()
+		for fd := range w.watchesByDir[name] {
+			path := w.paths[fd]
+			if _, ok := w.userWatches[path.name]; !ok {
+				pathsToRemove = append(pathsToRemove, path.name)
+			}
+		}
+		w.mu.Unlock()
+		for _, name := range pathsToRemove {
+			// Since these are internal, not much sense in propagating error
+			// to the user, as that will just confuse them with an error about
+			// a path they did not explicitly watch themselves.
+			w.Remove(name)
+		}
+	}
+
+	return nil
+}
+
+// WatchList returns all paths added with [Add] (and are not yet removed).
+func (w *Watcher) WatchList() []string {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	entries := make([]string, 0, len(w.userWatches))
+	for pathname := range w.userWatches {
+		entries = append(entries, pathname)
+	}
+
+	return entries
+}
+
+// Watch all events (except NOTE_EXTEND, NOTE_LINK, NOTE_REVOKE)
+const noteAllEvents = unix.NOTE_DELETE | unix.NOTE_WRITE | unix.NOTE_ATTRIB | unix.NOTE_RENAME
+
+// addWatch adds name to the watched file set.
+// The flags are interpreted as described in kevent(2).
+// Returns the real path to the file which was added, if any, which may be different from the one passed in the case of symlinks.
+func (w *Watcher) addWatch(name string, flags uint32) (string, error) {
+	var isDir bool
+	// Make ./name and name equivalent
+	name = filepath.Clean(name)
+
+	w.mu.Lock()
+	if w.isClosed {
+		w.mu.Unlock()
+		return "", errors.New("kevent instance already closed")
+	}
+	watchfd, alreadyWatching := w.watches[name]
+	// We already have a watch, but we can still override flags.
+	if alreadyWatching {
+		isDir = w.paths[watchfd].isDir
+	}
+	w.mu.Unlock()
+
+	if !alreadyWatching {
+		fi, err := os.Lstat(name)
+		if err != nil {
+			return "", err
+		}
+
+		// Don't watch sockets or named pipes
+		if (fi.Mode()&os.ModeSocket == os.ModeSocket) || (fi.Mode()&os.ModeNamedPipe == os.ModeNamedPipe) {
+			return "", nil
+		}
+
+		// Follow Symlinks
+		//
+		// Linux can add unresolvable symlinks to the watch list without issue,
+		// and Windows can't do symlinks period. To maintain consistency, we
+		// will act like everything is fine if the link can't be resolved.
+		// There will simply be no file events for broken symlinks. Hence the
+		// returns of nil on errors.
+		if fi.Mode()&os.ModeSymlink == os.ModeSymlink {
+			name, err = filepath.EvalSymlinks(name)
+			if err != nil {
+				return "", nil
+			}
+
+			w.mu.Lock()
+			_, alreadyWatching = w.watches[name]
+			w.mu.Unlock()
+
+			if alreadyWatching {
+				return name, nil
+			}
+
+			fi, err = os.Lstat(name)
+			if err != nil {
+				return "", nil
+			}
+		}
+
+		// Retry on EINTR; open() can return EINTR in practice on macOS.
+		// See #354, and go issues 11180 and 39237.
+		for {
+			watchfd, err = unix.Open(name, openMode, 0)
+			if err == nil {
+				break
+			}
+			if errors.Is(err, unix.EINTR) {
+				continue
+			}
+
+			return "", err
+		}
+
+		isDir = fi.IsDir()
+	}
+
+	err := w.register([]int{watchfd}, unix.EV_ADD|unix.EV_CLEAR|unix.EV_ENABLE, flags)
+	if err != nil {
+		unix.Close(watchfd)
+		return "", err
+	}
+
+	if !alreadyWatching {
+		w.mu.Lock()
+		parentName := filepath.Dir(name)
+		w.watches[name] = watchfd
+
+		watchesByDir, ok := w.watchesByDir[parentName]
+		if !ok {
+			watchesByDir = make(map[int]struct{}, 1)
+			w.watchesByDir[parentName] = watchesByDir
+		}
+		watchesByDir[watchfd] = struct{}{}
+
+		w.paths[watchfd] = pathInfo{name: name, isDir: isDir}
+		w.mu.Unlock()
+	}
+
+	if isDir {
+		// Watch the directory if it has not been watched before,
+		// or if it was watched before, but perhaps only a NOTE_DELETE (watchDirectoryFiles)
+		w.mu.Lock()
+
+		watchDir := (flags&unix.NOTE_WRITE) == unix.NOTE_WRITE &&
+			(!alreadyWatching || (w.dirFlags[name]&unix.NOTE_WRITE) != unix.NOTE_WRITE)
+		// Store flags so this watch can be updated later
+		w.dirFlags[name] = flags
+		w.mu.Unlock()
+
+		if watchDir {
+			if err := w.watchDirectoryFiles(name); err != nil {
+				return "", err
+			}
+		}
+	}
+	return name, nil
+}
+
+// readEvents reads from kqueue and converts the received kevents into
+// Event values that it sends down the Events channel.
+func (w *Watcher) readEvents() {
+	defer func() {
+		err := unix.Close(w.kq)
+		if err != nil {
+			w.Errors <- err
+		}
+		unix.Close(w.closepipe[0])
+		close(w.Events)
+		close(w.Errors)
+	}()
+
+	eventBuffer := make([]unix.Kevent_t, 10)
+	for closed := false; !closed; {
+		kevents, err := w.read(eventBuffer)
+		// EINTR is okay, the syscall was interrupted before timeout expired.
+		if err != nil && err != unix.EINTR {
+			if !w.sendError(fmt.Errorf("fsnotify.readEvents: %w", err)) {
+				closed = true
+			}
+			continue
+		}
+
+		// Flush the events we received to the Events channel
+		for _, kevent := range kevents {
+			var (
+				watchfd = int(kevent.Ident)
+				mask    = uint32(kevent.Fflags)
+			)
+
+			// Shut down the loop when the pipe is closed, but only after all
+			// other events have been processed.
+			if watchfd == w.closepipe[0] {
+				closed = true
+				continue
+			}
+
+			w.mu.Lock()
+			path := w.paths[watchfd]
+			w.mu.Unlock()
+
+			event := w.newEvent(path.name, mask)
+
+			if path.isDir && !event.Has(Remove) {
+				// Double check to make sure the directory exists. This can
+				// happen when we do a rm -fr on a recursively watched folders
+				// and we receive a modification event first but the folder has
+				// been deleted and later receive the delete event.
+				if _, err := os.Lstat(event.Name); os.IsNotExist(err) {
+					event.Op |= Remove
+				}
+			}
+
+			if event.Has(Rename) || event.Has(Remove) {
+				w.Remove(event.Name)
+				w.mu.Lock()
+				delete(w.fileExists, event.Name)
+				w.mu.Unlock()
+			}
+
+			if path.isDir && event.Has(Write) && !event.Has(Remove) {
+				w.sendDirectoryChangeEvents(event.Name)
+			} else {
+				if !w.sendEvent(event) {
+					closed = true
+					continue
+				}
+			}
+
+			if event.Has(Remove) {
+				// Look for a file that may have overwritten this.
+				// For example, mv f1 f2 will delete f2, then create f2.
+				if path.isDir {
+					fileDir := filepath.Clean(event.Name)
+					w.mu.Lock()
+					_, found := w.watches[fileDir]
+					w.mu.Unlock()
+					if found {
+						// make sure the directory exists before we watch for changes. When we
+						// do a recursive watch and perform rm -fr, the parent directory might
+						// have gone missing, ignore the missing directory and let the
+						// upcoming delete event remove the watch from the parent directory.
+						if _, err := os.Lstat(fileDir); err == nil {
+							w.sendDirectoryChangeEvents(fileDir)
+						}
+					}
+				} else {
+					filePath := filepath.Clean(event.Name)
+					if fileInfo, err := os.Lstat(filePath); err == nil {
+						w.sendFileCreatedEventIfNew(filePath, fileInfo)
+					}
+				}
+			}
+		}
+	}
+}
+
+// newEvent returns an platform-independent Event based on kqueue Fflags.
+func (w *Watcher) newEvent(name string, mask uint32) Event {
+	e := Event{Name: name}
+	if mask&unix.NOTE_DELETE == unix.NOTE_DELETE {
+		e.Op |= Remove
+	}
+	if mask&unix.NOTE_WRITE == unix.NOTE_WRITE {
+		e.Op |= Write
+	}
+	if mask&unix.NOTE_RENAME == unix.NOTE_RENAME {
+		e.Op |= Rename
+	}
+	if mask&unix.NOTE_ATTRIB == unix.NOTE_ATTRIB {
+		e.Op |= Chmod
+	}
+	return e
+}
+
+// watchDirectoryFiles to mimic inotify when adding a watch on a directory
+func (w *Watcher) watchDirectoryFiles(dirPath string) error {
+	// Get all files
+	files, err := ioutil.ReadDir(dirPath)
+	if err != nil {
+		return err
+	}
+
+	for _, fileInfo := range files {
+		path := filepath.Join(dirPath, fileInfo.Name())
+
+		cleanPath, err := w.internalWatch(path, fileInfo)
+		if err != nil {
+			// No permission to read the file; that's not a problem: just skip.
+			// But do add it to w.fileExists to prevent it from being picked up
+			// as a "new" file later (it still shows up in the directory
+			// listing).
+			switch {
+			case errors.Is(err, unix.EACCES) || errors.Is(err, unix.EPERM):
+				cleanPath = filepath.Clean(path)
+			default:
+				return fmt.Errorf("%q: %w", filepath.Join(dirPath, fileInfo.Name()), err)
+			}
+		}
+
+		w.mu.Lock()
+		w.fileExists[cleanPath] = struct{}{}
+		w.mu.Unlock()
+	}
+
+	return nil
+}
+
+// Search the directory for new files and send an event for them.
+//
+// This functionality is to have the BSD watcher match the inotify, which sends
+// a create event for files created in a watched directory.
+func (w *Watcher) sendDirectoryChangeEvents(dir string) {
+	// Get all files
+	files, err := ioutil.ReadDir(dir)
+	if err != nil {
+		if !w.sendError(fmt.Errorf("fsnotify.sendDirectoryChangeEvents: %w", err)) {
+			return
+		}
+	}
+
+	// Search for new files
+	for _, fi := range files {
+		err := w.sendFileCreatedEventIfNew(filepath.Join(dir, fi.Name()), fi)
+		if err != nil {
+			return
+		}
+	}
+}
+
+// sendFileCreatedEvent sends a create event if the file isn't already being tracked.
+func (w *Watcher) sendFileCreatedEventIfNew(filePath string, fileInfo os.FileInfo) (err error) {
+	w.mu.Lock()
+	_, doesExist := w.fileExists[filePath]
+	w.mu.Unlock()
+	if !doesExist {
+		if !w.sendEvent(Event{Name: filePath, Op: Create}) {
+			return
+		}
+	}
+
+	// like watchDirectoryFiles (but without doing another ReadDir)
+	filePath, err = w.internalWatch(filePath, fileInfo)
+	if err != nil {
+		return err
+	}
+
+	w.mu.Lock()
+	w.fileExists[filePath] = struct{}{}
+	w.mu.Unlock()
+
+	return nil
+}
+
+func (w *Watcher) internalWatch(name string, fileInfo os.FileInfo) (string, error) {
+	if fileInfo.IsDir() {
+		// mimic Linux providing delete events for subdirectories
+		// but preserve the flags used if currently watching subdirectory
+		w.mu.Lock()
+		flags := w.dirFlags[name]
+		w.mu.Unlock()
+
+		flags |= unix.NOTE_DELETE | unix.NOTE_RENAME
+		return w.addWatch(name, flags)
+	}
+
+	// watch file to mimic Linux inotify
+	return w.addWatch(name, noteAllEvents)
+}
+
+// Register events with the queue.
+func (w *Watcher) register(fds []int, flags int, fflags uint32) error {
+	changes := make([]unix.Kevent_t, len(fds))
+	for i, fd := range fds {
+		// SetKevent converts int to the platform-specific types.
+		unix.SetKevent(&changes[i], fd, unix.EVFILT_VNODE, flags)
+		changes[i].Fflags = fflags
+	}
+
+	// Register the events.
+	success, err := unix.Kevent(w.kq, changes, nil, nil)
+	if success == -1 {
+		return err
+	}
+	return nil
+}
+
+// read retrieves pending events, or waits until an event occurs.
+func (w *Watcher) read(events []unix.Kevent_t) ([]unix.Kevent_t, error) {
+	n, err := unix.Kevent(w.kq, nil, events, nil)
+	if err != nil {
+		return nil, err
+	}
+	return events[0:n], nil
+}
diff --git a/vendor/github.com/fsnotify/fsnotify/backend_other.go b/vendor/github.com/fsnotify/fsnotify/backend_other.go
new file mode 100644
index 0000000000..a9bb1c3c4d
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/backend_other.go
@@ -0,0 +1,66 @@
+//go:build !darwin && !dragonfly && !freebsd && !openbsd && !linux && !netbsd && !solaris && !windows
+// +build !darwin,!dragonfly,!freebsd,!openbsd,!linux,!netbsd,!solaris,!windows
+
+package fsnotify
+
+import (
+	"fmt"
+	"runtime"
+)
+
+// Watcher watches a set of files, delivering events to a channel.
+type Watcher struct{}
+
+// NewWatcher creates a new Watcher.
+func NewWatcher() (*Watcher, error) {
+	return nil, fmt.Errorf("fsnotify not supported on %s", runtime.GOOS)
+}
+
+// Close removes all watches and closes the events channel.
+func (w *Watcher) Close() error {
+	return nil
+}
+
+// Add starts monitoring the path for changes.
+//
+// A path can only be watched once; attempting to watch it more than once will
+// return an error. Paths that do not yet exist on the filesystem cannot be
+// added. A watch will be automatically removed if the path is deleted.
+//
+// A path will remain watched if it gets renamed to somewhere else on the same
+// filesystem, but the monitor will get removed if the path gets deleted and
+// re-created, or if it's moved to a different filesystem.
+//
+// Notifications on network filesystems (NFS, SMB, FUSE, etc.) or special
+// filesystems (/proc, /sys, etc.) generally don't work.
+//
+// # Watching directories
+//
+// All files in a directory are monitored, including new files that are created
+// after the watcher is started. Subdirectories are not watched (i.e. it's
+// non-recursive).
+//
+// # Watching files
+//
+// Watching individual files (rather than directories) is generally not
+// recommended as many tools update files atomically. Instead of "just" writing
+// to the file a temporary file will be written to first, and if successful the
+// temporary file is moved to to destination removing the original, or some
+// variant thereof. The watcher on the original file is now lost, as it no
+// longer exists.
+//
+// Instead, watch the parent directory and use Event.Name to filter out files
+// you're not interested in. There is an example of this in [cmd/fsnotify/file.go].
+func (w *Watcher) Add(name string) error {
+	return nil
+}
+
+// Remove stops monitoring the path for changes.
+//
+// Directories are always removed non-recursively. For example, if you added
+// /tmp/dir and /tmp/dir/subdir then you will need to remove both.
+//
+// Removing a path that has not yet been added returns [ErrNonExistentWatch].
+func (w *Watcher) Remove(name string) error {
+	return nil
+}
diff --git a/vendor/github.com/fsnotify/fsnotify/backend_windows.go b/vendor/github.com/fsnotify/fsnotify/backend_windows.go
new file mode 100644
index 0000000000..ae392867c0
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/backend_windows.go
@@ -0,0 +1,746 @@
+//go:build windows
+// +build windows
+
+package fsnotify
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strings"
+	"sync"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// Watcher watches a set of paths, delivering events on a channel.
+//
+// A watcher should not be copied (e.g. pass it by pointer, rather than by
+// value).
+//
+// # Linux notes
+//
+// When a file is removed a Remove event won't be emitted until all file
+// descriptors are closed, and deletes will always emit a Chmod. For example:
+//
+//     fp := os.Open("file")
+//     os.Remove("file")        // Triggers Chmod
+//     fp.Close()               // Triggers Remove
+//
+// This is the event that inotify sends, so not much can be changed about this.
+//
+// The fs.inotify.max_user_watches sysctl variable specifies the upper limit
+// for the number of watches per user, and fs.inotify.max_user_instances
+// specifies the maximum number of inotify instances per user. Every Watcher you
+// create is an "instance", and every path you add is a "watch".
+//
+// These are also exposed in /proc as /proc/sys/fs/inotify/max_user_watches and
+// /proc/sys/fs/inotify/max_user_instances
+//
+// To increase them you can use sysctl or write the value to the /proc file:
+//
+//     # Default values on Linux 5.18
+//     sysctl fs.inotify.max_user_watches=124983
+//     sysctl fs.inotify.max_user_instances=128
+//
+// To make the changes persist on reboot edit /etc/sysctl.conf or
+// /usr/lib/sysctl.d/50-default.conf (details differ per Linux distro; check
+// your distro's documentation):
+//
+//     fs.inotify.max_user_watches=124983
+//     fs.inotify.max_user_instances=128
+//
+// Reaching the limit will result in a "no space left on device" or "too many open
+// files" error.
+//
+// # kqueue notes (macOS, BSD)
+//
+// kqueue requires opening a file descriptor for every file that's being watched;
+// so if you're watching a directory with five files then that's six file
+// descriptors. You will run in to your system's "max open files" limit faster on
+// these platforms.
+//
+// The sysctl variables kern.maxfiles and kern.maxfilesperproc can be used to
+// control the maximum number of open files, as well as /etc/login.conf on BSD
+// systems.
+//
+// # macOS notes
+//
+// Spotlight indexing on macOS can result in multiple events (see [#15]). A
+// temporary workaround is to add your folder(s) to the "Spotlight Privacy
+// Settings" until we have a native FSEvents implementation (see [#11]).
+//
+// [#11]: https://github.com/fsnotify/fsnotify/issues/11
+// [#15]: https://github.com/fsnotify/fsnotify/issues/15
+type Watcher struct {
+	// Events sends the filesystem change events.
+	//
+	// fsnotify can send the following events; a "path" here can refer to a
+	// file, directory, symbolic link, or special file like a FIFO.
+	//
+	//   fsnotify.Create    A new path was created; this may be followed by one
+	//                      or more Write events if data also gets written to a
+	//                      file.
+	//
+	//   fsnotify.Remove    A path was removed.
+	//
+	//   fsnotify.Rename    A path was renamed. A rename is always sent with the
+	//                      old path as Event.Name, and a Create event will be
+	//                      sent with the new name. Renames are only sent for
+	//                      paths that are currently watched; e.g. moving an
+	//                      unmonitored file into a monitored directory will
+	//                      show up as just a Create. Similarly, renaming a file
+	//                      to outside a monitored directory will show up as
+	//                      only a Rename.
+	//
+	//   fsnotify.Write     A file or named pipe was written to. A Truncate will
+	//                      also trigger a Write. A single "write action"
+	//                      initiated by the user may show up as one or multiple
+	//                      writes, depending on when the system syncs things to
+	//                      disk. For example when compiling a large Go program
+	//                      you may get hundreds of Write events, so you
+	//                      probably want to wait until you've stopped receiving
+	//                      them (see the dedup example in cmd/fsnotify).
+	//
+	//   fsnotify.Chmod     Attributes were changed. On Linux this is also sent
+	//                      when a file is removed (or more accurately, when a
+	//                      link to an inode is removed). On kqueue it's sent
+	//                      and on kqueue when a file is truncated. On Windows
+	//                      it's never sent.
+	Events chan Event
+
+	// Errors sends any errors.
+	Errors chan error
+
+	port  windows.Handle // Handle to completion port
+	input chan *input    // Inputs to the reader are sent on this channel
+	quit  chan chan<- error
+
+	mu       sync.Mutex // Protects access to watches, isClosed
+	watches  watchMap   // Map of watches (key: i-number)
+	isClosed bool       // Set to true when Close() is first called
+}
+
+// NewWatcher creates a new Watcher.
+func NewWatcher() (*Watcher, error) {
+	port, err := windows.CreateIoCompletionPort(windows.InvalidHandle, 0, 0, 0)
+	if err != nil {
+		return nil, os.NewSyscallError("CreateIoCompletionPort", err)
+	}
+	w := &Watcher{
+		port:    port,
+		watches: make(watchMap),
+		input:   make(chan *input, 1),
+		Events:  make(chan Event, 50),
+		Errors:  make(chan error),
+		quit:    make(chan chan<- error, 1),
+	}
+	go w.readEvents()
+	return w, nil
+}
+
+func (w *Watcher) sendEvent(name string, mask uint64) bool {
+	if mask == 0 {
+		return false
+	}
+
+	event := w.newEvent(name, uint32(mask))
+	select {
+	case ch := <-w.quit:
+		w.quit <- ch
+	case w.Events <- event:
+	}
+	return true
+}
+
+// Returns true if the error was sent, or false if watcher is closed.
+func (w *Watcher) sendError(err error) bool {
+	select {
+	case w.Errors <- err:
+		return true
+	case <-w.quit:
+	}
+	return false
+}
+
+// Close removes all watches and closes the events channel.
+func (w *Watcher) Close() error {
+	w.mu.Lock()
+	if w.isClosed {
+		w.mu.Unlock()
+		return nil
+	}
+	w.isClosed = true
+	w.mu.Unlock()
+
+	// Send "quit" message to the reader goroutine
+	ch := make(chan error)
+	w.quit <- ch
+	if err := w.wakeupReader(); err != nil {
+		return err
+	}
+	return <-ch
+}
+
+// Add starts monitoring the path for changes.
+//
+// A path can only be watched once; attempting to watch it more than once will
+// return an error. Paths that do not yet exist on the filesystem cannot be
+// added. A watch will be automatically removed if the path is deleted.
+//
+// A path will remain watched if it gets renamed to somewhere else on the same
+// filesystem, but the monitor will get removed if the path gets deleted and
+// re-created, or if it's moved to a different filesystem.
+//
+// Notifications on network filesystems (NFS, SMB, FUSE, etc.) or special
+// filesystems (/proc, /sys, etc.) generally don't work.
+//
+// # Watching directories
+//
+// All files in a directory are monitored, including new files that are created
+// after the watcher is started. Subdirectories are not watched (i.e. it's
+// non-recursive).
+//
+// # Watching files
+//
+// Watching individual files (rather than directories) is generally not
+// recommended as many tools update files atomically. Instead of "just" writing
+// to the file a temporary file will be written to first, and if successful the
+// temporary file is moved to to destination removing the original, or some
+// variant thereof. The watcher on the original file is now lost, as it no
+// longer exists.
+//
+// Instead, watch the parent directory and use Event.Name to filter out files
+// you're not interested in. There is an example of this in [cmd/fsnotify/file.go].
+func (w *Watcher) Add(name string) error {
+	w.mu.Lock()
+	if w.isClosed {
+		w.mu.Unlock()
+		return errors.New("watcher already closed")
+	}
+	w.mu.Unlock()
+
+	in := &input{
+		op:    opAddWatch,
+		path:  filepath.Clean(name),
+		flags: sysFSALLEVENTS,
+		reply: make(chan error),
+	}
+	w.input <- in
+	if err := w.wakeupReader(); err != nil {
+		return err
+	}
+	return <-in.reply
+}
+
+// Remove stops monitoring the path for changes.
+//
+// Directories are always removed non-recursively. For example, if you added
+// /tmp/dir and /tmp/dir/subdir then you will need to remove both.
+//
+// Removing a path that has not yet been added returns [ErrNonExistentWatch].
+func (w *Watcher) Remove(name string) error {
+	in := &input{
+		op:    opRemoveWatch,
+		path:  filepath.Clean(name),
+		reply: make(chan error),
+	}
+	w.input <- in
+	if err := w.wakeupReader(); err != nil {
+		return err
+	}
+	return <-in.reply
+}
+
+// WatchList returns all paths added with [Add] (and are not yet removed).
+func (w *Watcher) WatchList() []string {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	entries := make([]string, 0, len(w.watches))
+	for _, entry := range w.watches {
+		for _, watchEntry := range entry {
+			entries = append(entries, watchEntry.path)
+		}
+	}
+
+	return entries
+}
+
+// These options are from the old golang.org/x/exp/winfsnotify, where you could
+// add various options to the watch. This has long since been removed.
+//
+// The "sys" in the name is misleading as they're not part of any "system".
+//
+// This should all be removed at some point, and just use windows.FILE_NOTIFY_*
+const (
+	sysFSALLEVENTS  = 0xfff
+	sysFSATTRIB     = 0x4
+	sysFSCREATE     = 0x100
+	sysFSDELETE     = 0x200
+	sysFSDELETESELF = 0x400
+	sysFSMODIFY     = 0x2
+	sysFSMOVE       = 0xc0
+	sysFSMOVEDFROM  = 0x40
+	sysFSMOVEDTO    = 0x80
+	sysFSMOVESELF   = 0x800
+	sysFSIGNORED    = 0x8000
+)
+
+func (w *Watcher) newEvent(name string, mask uint32) Event {
+	e := Event{Name: name}
+	if mask&sysFSCREATE == sysFSCREATE || mask&sysFSMOVEDTO == sysFSMOVEDTO {
+		e.Op |= Create
+	}
+	if mask&sysFSDELETE == sysFSDELETE || mask&sysFSDELETESELF == sysFSDELETESELF {
+		e.Op |= Remove
+	}
+	if mask&sysFSMODIFY == sysFSMODIFY {
+		e.Op |= Write
+	}
+	if mask&sysFSMOVE == sysFSMOVE || mask&sysFSMOVESELF == sysFSMOVESELF || mask&sysFSMOVEDFROM == sysFSMOVEDFROM {
+		e.Op |= Rename
+	}
+	if mask&sysFSATTRIB == sysFSATTRIB {
+		e.Op |= Chmod
+	}
+	return e
+}
+
+const (
+	opAddWatch = iota
+	opRemoveWatch
+)
+
+const (
+	provisional uint64 = 1 << (32 + iota)
+)
+
+type input struct {
+	op    int
+	path  string
+	flags uint32
+	reply chan error
+}
+
+type inode struct {
+	handle windows.Handle
+	volume uint32
+	index  uint64
+}
+
+type watch struct {
+	ov     windows.Overlapped
+	ino    *inode            // i-number
+	path   string            // Directory path
+	mask   uint64            // Directory itself is being watched with these notify flags
+	names  map[string]uint64 // Map of names being watched and their notify flags
+	rename string            // Remembers the old name while renaming a file
+	buf    [65536]byte       // 64K buffer
+}
+
+type (
+	indexMap map[uint64]*watch
+	watchMap map[uint32]indexMap
+)
+
+func (w *Watcher) wakeupReader() error {
+	err := windows.PostQueuedCompletionStatus(w.port, 0, 0, nil)
+	if err != nil {
+		return os.NewSyscallError("PostQueuedCompletionStatus", err)
+	}
+	return nil
+}
+
+func (w *Watcher) getDir(pathname string) (dir string, err error) {
+	attr, err := windows.GetFileAttributes(windows.StringToUTF16Ptr(pathname))
+	if err != nil {
+		return "", os.NewSyscallError("GetFileAttributes", err)
+	}
+	if attr&windows.FILE_ATTRIBUTE_DIRECTORY != 0 {
+		dir = pathname
+	} else {
+		dir, _ = filepath.Split(pathname)
+		dir = filepath.Clean(dir)
+	}
+	return
+}
+
+func (w *Watcher) getIno(path string) (ino *inode, err error) {
+	h, err := windows.CreateFile(windows.StringToUTF16Ptr(path),
+		windows.FILE_LIST_DIRECTORY,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		nil, windows.OPEN_EXISTING,
+		windows.FILE_FLAG_BACKUP_SEMANTICS|windows.FILE_FLAG_OVERLAPPED, 0)
+	if err != nil {
+		return nil, os.NewSyscallError("CreateFile", err)
+	}
+
+	var fi windows.ByHandleFileInformation
+	err = windows.GetFileInformationByHandle(h, &fi)
+	if err != nil {
+		windows.CloseHandle(h)
+		return nil, os.NewSyscallError("GetFileInformationByHandle", err)
+	}
+	ino = &inode{
+		handle: h,
+		volume: fi.VolumeSerialNumber,
+		index:  uint64(fi.FileIndexHigh)<<32 | uint64(fi.FileIndexLow),
+	}
+	return ino, nil
+}
+
+// Must run within the I/O thread.
+func (m watchMap) get(ino *inode) *watch {
+	if i := m[ino.volume]; i != nil {
+		return i[ino.index]
+	}
+	return nil
+}
+
+// Must run within the I/O thread.
+func (m watchMap) set(ino *inode, watch *watch) {
+	i := m[ino.volume]
+	if i == nil {
+		i = make(indexMap)
+		m[ino.volume] = i
+	}
+	i[ino.index] = watch
+}
+
+// Must run within the I/O thread.
+func (w *Watcher) addWatch(pathname string, flags uint64) error {
+	dir, err := w.getDir(pathname)
+	if err != nil {
+		return err
+	}
+
+	ino, err := w.getIno(dir)
+	if err != nil {
+		return err
+	}
+	w.mu.Lock()
+	watchEntry := w.watches.get(ino)
+	w.mu.Unlock()
+	if watchEntry == nil {
+		_, err := windows.CreateIoCompletionPort(ino.handle, w.port, 0, 0)
+		if err != nil {
+			windows.CloseHandle(ino.handle)
+			return os.NewSyscallError("CreateIoCompletionPort", err)
+		}
+		watchEntry = &watch{
+			ino:   ino,
+			path:  dir,
+			names: make(map[string]uint64),
+		}
+		w.mu.Lock()
+		w.watches.set(ino, watchEntry)
+		w.mu.Unlock()
+		flags |= provisional
+	} else {
+		windows.CloseHandle(ino.handle)
+	}
+	if pathname == dir {
+		watchEntry.mask |= flags
+	} else {
+		watchEntry.names[filepath.Base(pathname)] |= flags
+	}
+
+	err = w.startRead(watchEntry)
+	if err != nil {
+		return err
+	}
+
+	if pathname == dir {
+		watchEntry.mask &= ^provisional
+	} else {
+		watchEntry.names[filepath.Base(pathname)] &= ^provisional
+	}
+	return nil
+}
+
+// Must run within the I/O thread.
+func (w *Watcher) remWatch(pathname string) error {
+	dir, err := w.getDir(pathname)
+	if err != nil {
+		return err
+	}
+	ino, err := w.getIno(dir)
+	if err != nil {
+		return err
+	}
+
+	w.mu.Lock()
+	watch := w.watches.get(ino)
+	w.mu.Unlock()
+
+	err = windows.CloseHandle(ino.handle)
+	if err != nil {
+		w.sendError(os.NewSyscallError("CloseHandle", err))
+	}
+	if watch == nil {
+		return fmt.Errorf("%w: %s", ErrNonExistentWatch, pathname)
+	}
+	if pathname == dir {
+		w.sendEvent(watch.path, watch.mask&sysFSIGNORED)
+		watch.mask = 0
+	} else {
+		name := filepath.Base(pathname)
+		w.sendEvent(filepath.Join(watch.path, name), watch.names[name]&sysFSIGNORED)
+		delete(watch.names, name)
+	}
+
+	return w.startRead(watch)
+}
+
+// Must run within the I/O thread.
+func (w *Watcher) deleteWatch(watch *watch) {
+	for name, mask := range watch.names {
+		if mask&provisional == 0 {
+			w.sendEvent(filepath.Join(watch.path, name), mask&sysFSIGNORED)
+		}
+		delete(watch.names, name)
+	}
+	if watch.mask != 0 {
+		if watch.mask&provisional == 0 {
+			w.sendEvent(watch.path, watch.mask&sysFSIGNORED)
+		}
+		watch.mask = 0
+	}
+}
+
+// Must run within the I/O thread.
+func (w *Watcher) startRead(watch *watch) error {
+	err := windows.CancelIo(watch.ino.handle)
+	if err != nil {
+		w.sendError(os.NewSyscallError("CancelIo", err))
+		w.deleteWatch(watch)
+	}
+	mask := w.toWindowsFlags(watch.mask)
+	for _, m := range watch.names {
+		mask |= w.toWindowsFlags(m)
+	}
+	if mask == 0 {
+		err := windows.CloseHandle(watch.ino.handle)
+		if err != nil {
+			w.sendError(os.NewSyscallError("CloseHandle", err))
+		}
+		w.mu.Lock()
+		delete(w.watches[watch.ino.volume], watch.ino.index)
+		w.mu.Unlock()
+		return nil
+	}
+
+	rdErr := windows.ReadDirectoryChanges(watch.ino.handle, &watch.buf[0],
+		uint32(unsafe.Sizeof(watch.buf)), false, mask, nil, &watch.ov, 0)
+	if rdErr != nil {
+		err := os.NewSyscallError("ReadDirectoryChanges", rdErr)
+		if rdErr == windows.ERROR_ACCESS_DENIED && watch.mask&provisional == 0 {
+			// Watched directory was probably removed
+			w.sendEvent(watch.path, watch.mask&sysFSDELETESELF)
+			err = nil
+		}
+		w.deleteWatch(watch)
+		w.startRead(watch)
+		return err
+	}
+	return nil
+}
+
+// readEvents reads from the I/O completion port, converts the
+// received events into Event objects and sends them via the Events channel.
+// Entry point to the I/O thread.
+func (w *Watcher) readEvents() {
+	var (
+		n   uint32
+		key uintptr
+		ov  *windows.Overlapped
+	)
+	runtime.LockOSThread()
+
+	for {
+		qErr := windows.GetQueuedCompletionStatus(w.port, &n, &key, &ov, windows.INFINITE)
+		// This error is handled after the watch == nil check below. NOTE: this
+		// seems odd, note sure if it's correct.
+
+		watch := (*watch)(unsafe.Pointer(ov))
+		if watch == nil {
+			select {
+			case ch := <-w.quit:
+				w.mu.Lock()
+				var indexes []indexMap
+				for _, index := range w.watches {
+					indexes = append(indexes, index)
+				}
+				w.mu.Unlock()
+				for _, index := range indexes {
+					for _, watch := range index {
+						w.deleteWatch(watch)
+						w.startRead(watch)
+					}
+				}
+
+				err := windows.CloseHandle(w.port)
+				if err != nil {
+					err = os.NewSyscallError("CloseHandle", err)
+				}
+				close(w.Events)
+				close(w.Errors)
+				ch <- err
+				return
+			case in := <-w.input:
+				switch in.op {
+				case opAddWatch:
+					in.reply <- w.addWatch(in.path, uint64(in.flags))
+				case opRemoveWatch:
+					in.reply <- w.remWatch(in.path)
+				}
+			default:
+			}
+			continue
+		}
+
+		switch qErr {
+		case windows.ERROR_MORE_DATA:
+			if watch == nil {
+				w.sendError(errors.New("ERROR_MORE_DATA has unexpectedly null lpOverlapped buffer"))
+			} else {
+				// The i/o succeeded but the buffer is full.
+				// In theory we should be building up a full packet.
+				// In practice we can get away with just carrying on.
+				n = uint32(unsafe.Sizeof(watch.buf))
+			}
+		case windows.ERROR_ACCESS_DENIED:
+			// Watched directory was probably removed
+			w.sendEvent(watch.path, watch.mask&sysFSDELETESELF)
+			w.deleteWatch(watch)
+			w.startRead(watch)
+			continue
+		case windows.ERROR_OPERATION_ABORTED:
+			// CancelIo was called on this handle
+			continue
+		default:
+			w.sendError(os.NewSyscallError("GetQueuedCompletionPort", qErr))
+			continue
+		case nil:
+		}
+
+		var offset uint32
+		for {
+			if n == 0 {
+				w.sendError(errors.New("short read in readEvents()"))
+				break
+			}
+
+			// Point "raw" to the event in the buffer
+			raw := (*windows.FileNotifyInformation)(unsafe.Pointer(&watch.buf[offset]))
+
+			// Create a buf that is the size of the path name
+			size := int(raw.FileNameLength / 2)
+			var buf []uint16
+			// TODO: Use unsafe.Slice in Go 1.17; https://stackoverflow.com/questions/51187973
+			sh := (*reflect.SliceHeader)(unsafe.Pointer(&buf))
+			sh.Data = uintptr(unsafe.Pointer(&raw.FileName))
+			sh.Len = size
+			sh.Cap = size
+			name := windows.UTF16ToString(buf)
+			fullname := filepath.Join(watch.path, name)
+
+			var mask uint64
+			switch raw.Action {
+			case windows.FILE_ACTION_REMOVED:
+				mask = sysFSDELETESELF
+			case windows.FILE_ACTION_MODIFIED:
+				mask = sysFSMODIFY
+			case windows.FILE_ACTION_RENAMED_OLD_NAME:
+				watch.rename = name
+			case windows.FILE_ACTION_RENAMED_NEW_NAME:
+				// Update saved path of all sub-watches.
+				old := filepath.Join(watch.path, watch.rename)
+				w.mu.Lock()
+				for _, watchMap := range w.watches {
+					for _, ww := range watchMap {
+						if strings.HasPrefix(ww.path, old) {
+							ww.path = filepath.Join(fullname, strings.TrimPrefix(ww.path, old))
+						}
+					}
+				}
+				w.mu.Unlock()
+
+				if watch.names[watch.rename] != 0 {
+					watch.names[name] |= watch.names[watch.rename]
+					delete(watch.names, watch.rename)
+					mask = sysFSMOVESELF
+				}
+			}
+
+			sendNameEvent := func() {
+				w.sendEvent(fullname, watch.names[name]&mask)
+			}
+			if raw.Action != windows.FILE_ACTION_RENAMED_NEW_NAME {
+				sendNameEvent()
+			}
+			if raw.Action == windows.FILE_ACTION_REMOVED {
+				w.sendEvent(fullname, watch.names[name]&sysFSIGNORED)
+				delete(watch.names, name)
+			}
+
+			w.sendEvent(fullname, watch.mask&w.toFSnotifyFlags(raw.Action))
+			if raw.Action == windows.FILE_ACTION_RENAMED_NEW_NAME {
+				fullname = filepath.Join(watch.path, watch.rename)
+				sendNameEvent()
+			}
+
+			// Move to the next event in the buffer
+			if raw.NextEntryOffset == 0 {
+				break
+			}
+			offset += raw.NextEntryOffset
+
+			// Error!
+			if offset >= n {
+				w.sendError(errors.New(
+					"Windows system assumed buffer larger than it is, events have likely been missed."))
+				break
+			}
+		}
+
+		if err := w.startRead(watch); err != nil {
+			w.sendError(err)
+		}
+	}
+}
+
+func (w *Watcher) toWindowsFlags(mask uint64) uint32 {
+	var m uint32
+	if mask&sysFSMODIFY != 0 {
+		m |= windows.FILE_NOTIFY_CHANGE_LAST_WRITE
+	}
+	if mask&sysFSATTRIB != 0 {
+		m |= windows.FILE_NOTIFY_CHANGE_ATTRIBUTES
+	}
+	if mask&(sysFSMOVE|sysFSCREATE|sysFSDELETE) != 0 {
+		m |= windows.FILE_NOTIFY_CHANGE_FILE_NAME | windows.FILE_NOTIFY_CHANGE_DIR_NAME
+	}
+	return m
+}
+
+func (w *Watcher) toFSnotifyFlags(action uint32) uint64 {
+	switch action {
+	case windows.FILE_ACTION_ADDED:
+		return sysFSCREATE
+	case windows.FILE_ACTION_REMOVED:
+		return sysFSDELETE
+	case windows.FILE_ACTION_MODIFIED:
+		return sysFSMODIFY
+	case windows.FILE_ACTION_RENAMED_OLD_NAME:
+		return sysFSMOVEDFROM
+	case windows.FILE_ACTION_RENAMED_NEW_NAME:
+		return sysFSMOVEDTO
+	}
+	return 0
+}
diff --git a/vendor/github.com/fsnotify/fsnotify/fen.go b/vendor/github.com/fsnotify/fsnotify/fen.go
deleted file mode 100644
index b3ac3d8f55..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/fen.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build solaris
-// +build solaris
-
-package fsnotify
-
-import (
-	"errors"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events chan Event
-	Errors chan error
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	return nil, errors.New("FEN based watcher not yet supported for fsnotify\n")
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	return nil
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	return nil
-}
-
-// Remove stops watching the the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	return nil
-}
diff --git a/vendor/github.com/fsnotify/fsnotify/fsnotify.go b/vendor/github.com/fsnotify/fsnotify/fsnotify.go
index 0f4ee52e8a..30a5bf0f07 100644
--- a/vendor/github.com/fsnotify/fsnotify/fsnotify.go
+++ b/vendor/github.com/fsnotify/fsnotify/fsnotify.go
@@ -1,29 +1,37 @@
-// Copyright 2012 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
 //go:build !plan9
 // +build !plan9
 
-// Package fsnotify provides a platform-independent interface for file system notifications.
+// Package fsnotify provides a cross-platform interface for file system
+// notifications.
 package fsnotify
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
+	"strings"
 )
 
-// Event represents a single file system notification.
+// Event represents a file system notification.
 type Event struct {
-	Name string // Relative path to the file or directory.
-	Op   Op     // File operation that triggered the event.
+	// Path to the file or directory.
+	//
+	// Paths are relative to the input; for example with Add("dir") the Name
+	// will be set to "dir/file" if you create that file, but if you use
+	// Add("/path/to/dir") it will be "/path/to/dir/file".
+	Name string
+
+	// File operation that triggered the event.
+	//
+	// This is a bitmask and some systems may send multiple operations at once.
+	// Use the Event.Has() method instead of comparing with ==.
+	Op Op
 }
 
 // Op describes a set of file operations.
 type Op uint32
 
-// These are the generalized file operations that can trigger a notification.
+// The operations fsnotify can trigger; see the documentation on [Watcher] for a
+// full description, and check them with [Event.Has].
 const (
 	Create Op = 1 << iota
 	Write
@@ -32,38 +40,42 @@ const (
 	Chmod
 )
 
-func (op Op) String() string {
-	// Use a buffer for efficient string concatenation
-	var buffer bytes.Buffer
+// Common errors that can be reported by a watcher
+var (
+	ErrNonExistentWatch = errors.New("can't remove non-existent watcher")
+	ErrEventOverflow    = errors.New("fsnotify queue overflow")
+)
 
-	if op&Create == Create {
-		buffer.WriteString("|CREATE")
+func (op Op) String() string {
+	var b strings.Builder
+	if op.Has(Create) {
+		b.WriteString("|CREATE")
 	}
-	if op&Remove == Remove {
-		buffer.WriteString("|REMOVE")
+	if op.Has(Remove) {
+		b.WriteString("|REMOVE")
 	}
-	if op&Write == Write {
-		buffer.WriteString("|WRITE")
+	if op.Has(Write) {
+		b.WriteString("|WRITE")
 	}
-	if op&Rename == Rename {
-		buffer.WriteString("|RENAME")
+	if op.Has(Rename) {
+		b.WriteString("|RENAME")
 	}
-	if op&Chmod == Chmod {
-		buffer.WriteString("|CHMOD")
+	if op.Has(Chmod) {
+		b.WriteString("|CHMOD")
 	}
-	if buffer.Len() == 0 {
-		return ""
+	if b.Len() == 0 {
+		return "[no events]"
 	}
-	return buffer.String()[1:] // Strip leading pipe
+	return b.String()[1:]
 }
 
-// String returns a string representation of the event in the form
-// "file: REMOVE|WRITE|..."
+// Has reports if this operation has the given operation.
+func (o Op) Has(h Op) bool { return o&h == h }
+
+// Has reports if this event has the given operation.
+func (e Event) Has(op Op) bool { return e.Op.Has(op) }
+
+// String returns a string representation of the event with their path.
 func (e Event) String() string {
-	return fmt.Sprintf("%q: %s", e.Name, e.Op.String())
+	return fmt.Sprintf("%-13s %q", e.Op.String(), e.Name)
 }
-
-// Common errors that can be reported by a watcher
-var (
-	ErrEventOverflow = errors.New("fsnotify queue overflow")
-)
diff --git a/vendor/github.com/fsnotify/fsnotify/go.mod b/vendor/github.com/fsnotify/fsnotify/go.mod
deleted file mode 100644
index 54089e48b7..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/go.mod
+++ /dev/null
@@ -1,7 +0,0 @@
-module github.com/fsnotify/fsnotify
-
-go 1.13
-
-require golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c
-
-retract v1.5.0
diff --git a/vendor/github.com/fsnotify/fsnotify/go.sum b/vendor/github.com/fsnotify/fsnotify/go.sum
deleted file mode 100644
index 0f478630ca..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/go.sum
+++ /dev/null
@@ -1,2 +0,0 @@
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/vendor/github.com/fsnotify/fsnotify/inotify.go b/vendor/github.com/fsnotify/fsnotify/inotify.go
deleted file mode 100644
index eb87699b5b..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/inotify.go
+++ /dev/null
@@ -1,338 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build linux
-// +build linux
-
-package fsnotify
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"unsafe"
-
-	"golang.org/x/sys/unix"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events   chan Event
-	Errors   chan error
-	mu       sync.Mutex // Map access
-	fd       int
-	poller   *fdPoller
-	watches  map[string]*watch // Map of inotify watches (key: path)
-	paths    map[int]string    // Map of watched paths (key: watch descriptor)
-	done     chan struct{}     // Channel for sending a "quit message" to the reader goroutine
-	doneResp chan struct{}     // Channel to respond to Close
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	// Create inotify fd
-	fd, errno := unix.InotifyInit1(unix.IN_CLOEXEC)
-	if fd == -1 {
-		return nil, errno
-	}
-	// Create epoll
-	poller, err := newFdPoller(fd)
-	if err != nil {
-		unix.Close(fd)
-		return nil, err
-	}
-	w := &Watcher{
-		fd:       fd,
-		poller:   poller,
-		watches:  make(map[string]*watch),
-		paths:    make(map[int]string),
-		Events:   make(chan Event),
-		Errors:   make(chan error),
-		done:     make(chan struct{}),
-		doneResp: make(chan struct{}),
-	}
-
-	go w.readEvents()
-	return w, nil
-}
-
-func (w *Watcher) isClosed() bool {
-	select {
-	case <-w.done:
-		return true
-	default:
-		return false
-	}
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	if w.isClosed() {
-		return nil
-	}
-
-	// Send 'close' signal to goroutine, and set the Watcher to closed.
-	close(w.done)
-
-	// Wake up goroutine
-	w.poller.wake()
-
-	// Wait for goroutine to close
-	<-w.doneResp
-
-	return nil
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	name = filepath.Clean(name)
-	if w.isClosed() {
-		return errors.New("inotify instance already closed")
-	}
-
-	const agnosticEvents = unix.IN_MOVED_TO | unix.IN_MOVED_FROM |
-		unix.IN_CREATE | unix.IN_ATTRIB | unix.IN_MODIFY |
-		unix.IN_MOVE_SELF | unix.IN_DELETE | unix.IN_DELETE_SELF
-
-	var flags uint32 = agnosticEvents
-
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	watchEntry := w.watches[name]
-	if watchEntry != nil {
-		flags |= watchEntry.flags | unix.IN_MASK_ADD
-	}
-	wd, errno := unix.InotifyAddWatch(w.fd, name, flags)
-	if wd == -1 {
-		return errno
-	}
-
-	if watchEntry == nil {
-		w.watches[name] = &watch{wd: uint32(wd), flags: flags}
-		w.paths[wd] = name
-	} else {
-		watchEntry.wd = uint32(wd)
-		watchEntry.flags = flags
-	}
-
-	return nil
-}
-
-// Remove stops watching the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	name = filepath.Clean(name)
-
-	// Fetch the watch.
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	watch, ok := w.watches[name]
-
-	// Remove it from inotify.
-	if !ok {
-		return fmt.Errorf("can't remove non-existent inotify watch for: %s", name)
-	}
-
-	// We successfully removed the watch if InotifyRmWatch doesn't return an
-	// error, we need to clean up our internal state to ensure it matches
-	// inotify's kernel state.
-	delete(w.paths, int(watch.wd))
-	delete(w.watches, name)
-
-	// inotify_rm_watch will return EINVAL if the file has been deleted;
-	// the inotify will already have been removed.
-	// watches and pathes are deleted in ignoreLinux() implicitly and asynchronously
-	// by calling inotify_rm_watch() below. e.g. readEvents() goroutine receives IN_IGNORE
-	// so that EINVAL means that the wd is being rm_watch()ed or its file removed
-	// by another thread and we have not received IN_IGNORE event.
-	success, errno := unix.InotifyRmWatch(w.fd, watch.wd)
-	if success == -1 {
-		// TODO: Perhaps it's not helpful to return an error here in every case.
-		// the only two possible errors are:
-		// EBADF, which happens when w.fd is not a valid file descriptor of any kind.
-		// EINVAL, which is when fd is not an inotify descriptor or wd is not a valid watch descriptor.
-		// Watch descriptors are invalidated when they are removed explicitly or implicitly;
-		// explicitly by inotify_rm_watch, implicitly when the file they are watching is deleted.
-		return errno
-	}
-
-	return nil
-}
-
-type watch struct {
-	wd    uint32 // Watch descriptor (as returned by the inotify_add_watch() syscall)
-	flags uint32 // inotify flags of this watch (see inotify(7) for the list of valid flags)
-}
-
-// readEvents reads from the inotify file descriptor, converts the
-// received events into Event objects and sends them via the Events channel
-func (w *Watcher) readEvents() {
-	var (
-		buf   [unix.SizeofInotifyEvent * 4096]byte // Buffer for a maximum of 4096 raw events
-		n     int                                  // Number of bytes read with read()
-		errno error                                // Syscall errno
-		ok    bool                                 // For poller.wait
-	)
-
-	defer close(w.doneResp)
-	defer close(w.Errors)
-	defer close(w.Events)
-	defer unix.Close(w.fd)
-	defer w.poller.close()
-
-	for {
-		// See if we have been closed.
-		if w.isClosed() {
-			return
-		}
-
-		ok, errno = w.poller.wait()
-		if errno != nil {
-			select {
-			case w.Errors <- errno:
-			case <-w.done:
-				return
-			}
-			continue
-		}
-
-		if !ok {
-			continue
-		}
-
-		n, errno = unix.Read(w.fd, buf[:])
-		// If a signal interrupted execution, see if we've been asked to close, and try again.
-		// http://man7.org/linux/man-pages/man7/signal.7.html :
-		// "Before Linux 3.8, reads from an inotify(7) file descriptor were not restartable"
-		if errno == unix.EINTR {
-			continue
-		}
-
-		// unix.Read might have been woken up by Close. If so, we're done.
-		if w.isClosed() {
-			return
-		}
-
-		if n < unix.SizeofInotifyEvent {
-			var err error
-			if n == 0 {
-				// If EOF is received. This should really never happen.
-				err = io.EOF
-			} else if n < 0 {
-				// If an error occurred while reading.
-				err = errno
-			} else {
-				// Read was too short.
-				err = errors.New("notify: short read in readEvents()")
-			}
-			select {
-			case w.Errors <- err:
-			case <-w.done:
-				return
-			}
-			continue
-		}
-
-		var offset uint32
-		// We don't know how many events we just read into the buffer
-		// While the offset points to at least one whole event...
-		for offset <= uint32(n-unix.SizeofInotifyEvent) {
-			// Point "raw" to the event in the buffer
-			raw := (*unix.InotifyEvent)(unsafe.Pointer(&buf[offset]))
-
-			mask := uint32(raw.Mask)
-			nameLen := uint32(raw.Len)
-
-			if mask&unix.IN_Q_OVERFLOW != 0 {
-				select {
-				case w.Errors <- ErrEventOverflow:
-				case <-w.done:
-					return
-				}
-			}
-
-			// If the event happened to the watched directory or the watched file, the kernel
-			// doesn't append the filename to the event, but we would like to always fill the
-			// the "Name" field with a valid filename. We retrieve the path of the watch from
-			// the "paths" map.
-			w.mu.Lock()
-			name, ok := w.paths[int(raw.Wd)]
-			// IN_DELETE_SELF occurs when the file/directory being watched is removed.
-			// This is a sign to clean up the maps, otherwise we are no longer in sync
-			// with the inotify kernel state which has already deleted the watch
-			// automatically.
-			if ok && mask&unix.IN_DELETE_SELF == unix.IN_DELETE_SELF {
-				delete(w.paths, int(raw.Wd))
-				delete(w.watches, name)
-			}
-			w.mu.Unlock()
-
-			if nameLen > 0 {
-				// Point "bytes" at the first byte of the filename
-				bytes := (*[unix.PathMax]byte)(unsafe.Pointer(&buf[offset+unix.SizeofInotifyEvent]))[:nameLen:nameLen]
-				// The filename is padded with NULL bytes. TrimRight() gets rid of those.
-				name += "/" + strings.TrimRight(string(bytes[0:nameLen]), "\000")
-			}
-
-			event := newEvent(name, mask)
-
-			// Send the events that are not ignored on the events channel
-			if !event.ignoreLinux(mask) {
-				select {
-				case w.Events <- event:
-				case <-w.done:
-					return
-				}
-			}
-
-			// Move to the next event in the buffer
-			offset += unix.SizeofInotifyEvent + nameLen
-		}
-	}
-}
-
-// Certain types of events can be "ignored" and not sent over the Events
-// channel. Such as events marked ignore by the kernel, or MODIFY events
-// against files that do not exist.
-func (e *Event) ignoreLinux(mask uint32) bool {
-	// Ignore anything the inotify API says to ignore
-	if mask&unix.IN_IGNORED == unix.IN_IGNORED {
-		return true
-	}
-
-	// If the event is not a DELETE or RENAME, the file must exist.
-	// Otherwise the event is ignored.
-	// *Note*: this was put in place because it was seen that a MODIFY
-	// event was sent after the DELETE. This ignores that MODIFY and
-	// assumes a DELETE will come or has come if the file doesn't exist.
-	if !(e.Op&Remove == Remove || e.Op&Rename == Rename) {
-		_, statErr := os.Lstat(e.Name)
-		return os.IsNotExist(statErr)
-	}
-	return false
-}
-
-// newEvent returns an platform-independent Event based on an inotify mask.
-func newEvent(name string, mask uint32) Event {
-	e := Event{Name: name}
-	if mask&unix.IN_CREATE == unix.IN_CREATE || mask&unix.IN_MOVED_TO == unix.IN_MOVED_TO {
-		e.Op |= Create
-	}
-	if mask&unix.IN_DELETE_SELF == unix.IN_DELETE_SELF || mask&unix.IN_DELETE == unix.IN_DELETE {
-		e.Op |= Remove
-	}
-	if mask&unix.IN_MODIFY == unix.IN_MODIFY {
-		e.Op |= Write
-	}
-	if mask&unix.IN_MOVE_SELF == unix.IN_MOVE_SELF || mask&unix.IN_MOVED_FROM == unix.IN_MOVED_FROM {
-		e.Op |= Rename
-	}
-	if mask&unix.IN_ATTRIB == unix.IN_ATTRIB {
-		e.Op |= Chmod
-	}
-	return e
-}
diff --git a/vendor/github.com/fsnotify/fsnotify/inotify_poller.go b/vendor/github.com/fsnotify/fsnotify/inotify_poller.go
deleted file mode 100644
index e9ff9439f7..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/inotify_poller.go
+++ /dev/null
@@ -1,188 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build linux
-// +build linux
-
-package fsnotify
-
-import (
-	"errors"
-
-	"golang.org/x/sys/unix"
-)
-
-type fdPoller struct {
-	fd   int    // File descriptor (as returned by the inotify_init() syscall)
-	epfd int    // Epoll file descriptor
-	pipe [2]int // Pipe for waking up
-}
-
-func emptyPoller(fd int) *fdPoller {
-	poller := new(fdPoller)
-	poller.fd = fd
-	poller.epfd = -1
-	poller.pipe[0] = -1
-	poller.pipe[1] = -1
-	return poller
-}
-
-// Create a new inotify poller.
-// This creates an inotify handler, and an epoll handler.
-func newFdPoller(fd int) (*fdPoller, error) {
-	var errno error
-	poller := emptyPoller(fd)
-	defer func() {
-		if errno != nil {
-			poller.close()
-		}
-	}()
-	poller.fd = fd
-
-	// Create epoll fd
-	poller.epfd, errno = unix.EpollCreate1(unix.EPOLL_CLOEXEC)
-	if poller.epfd == -1 {
-		return nil, errno
-	}
-	// Create pipe; pipe[0] is the read end, pipe[1] the write end.
-	errno = unix.Pipe2(poller.pipe[:], unix.O_NONBLOCK|unix.O_CLOEXEC)
-	if errno != nil {
-		return nil, errno
-	}
-
-	// Register inotify fd with epoll
-	event := unix.EpollEvent{
-		Fd:     int32(poller.fd),
-		Events: unix.EPOLLIN,
-	}
-	errno = unix.EpollCtl(poller.epfd, unix.EPOLL_CTL_ADD, poller.fd, &event)
-	if errno != nil {
-		return nil, errno
-	}
-
-	// Register pipe fd with epoll
-	event = unix.EpollEvent{
-		Fd:     int32(poller.pipe[0]),
-		Events: unix.EPOLLIN,
-	}
-	errno = unix.EpollCtl(poller.epfd, unix.EPOLL_CTL_ADD, poller.pipe[0], &event)
-	if errno != nil {
-		return nil, errno
-	}
-
-	return poller, nil
-}
-
-// Wait using epoll.
-// Returns true if something is ready to be read,
-// false if there is not.
-func (poller *fdPoller) wait() (bool, error) {
-	// 3 possible events per fd, and 2 fds, makes a maximum of 6 events.
-	// I don't know whether epoll_wait returns the number of events returned,
-	// or the total number of events ready.
-	// I decided to catch both by making the buffer one larger than the maximum.
-	events := make([]unix.EpollEvent, 7)
-	for {
-		n, errno := unix.EpollWait(poller.epfd, events, -1)
-		if n == -1 {
-			if errno == unix.EINTR {
-				continue
-			}
-			return false, errno
-		}
-		if n == 0 {
-			// If there are no events, try again.
-			continue
-		}
-		if n > 6 {
-			// This should never happen. More events were returned than should be possible.
-			return false, errors.New("epoll_wait returned more events than I know what to do with")
-		}
-		ready := events[:n]
-		epollhup := false
-		epollerr := false
-		epollin := false
-		for _, event := range ready {
-			if event.Fd == int32(poller.fd) {
-				if event.Events&unix.EPOLLHUP != 0 {
-					// This should not happen, but if it does, treat it as a wakeup.
-					epollhup = true
-				}
-				if event.Events&unix.EPOLLERR != 0 {
-					// If an error is waiting on the file descriptor, we should pretend
-					// something is ready to read, and let unix.Read pick up the error.
-					epollerr = true
-				}
-				if event.Events&unix.EPOLLIN != 0 {
-					// There is data to read.
-					epollin = true
-				}
-			}
-			if event.Fd == int32(poller.pipe[0]) {
-				if event.Events&unix.EPOLLHUP != 0 {
-					// Write pipe descriptor was closed, by us. This means we're closing down the
-					// watcher, and we should wake up.
-				}
-				if event.Events&unix.EPOLLERR != 0 {
-					// If an error is waiting on the pipe file descriptor.
-					// This is an absolute mystery, and should never ever happen.
-					return false, errors.New("Error on the pipe descriptor.")
-				}
-				if event.Events&unix.EPOLLIN != 0 {
-					// This is a regular wakeup, so we have to clear the buffer.
-					err := poller.clearWake()
-					if err != nil {
-						return false, err
-					}
-				}
-			}
-		}
-
-		if epollhup || epollerr || epollin {
-			return true, nil
-		}
-		return false, nil
-	}
-}
-
-// Close the write end of the poller.
-func (poller *fdPoller) wake() error {
-	buf := make([]byte, 1)
-	n, errno := unix.Write(poller.pipe[1], buf)
-	if n == -1 {
-		if errno == unix.EAGAIN {
-			// Buffer is full, poller will wake.
-			return nil
-		}
-		return errno
-	}
-	return nil
-}
-
-func (poller *fdPoller) clearWake() error {
-	// You have to be woken up a LOT in order to get to 100!
-	buf := make([]byte, 100)
-	n, errno := unix.Read(poller.pipe[0], buf)
-	if n == -1 {
-		if errno == unix.EAGAIN {
-			// Buffer is empty, someone else cleared our wake.
-			return nil
-		}
-		return errno
-	}
-	return nil
-}
-
-// Close all poller file descriptors, but not the one passed to it.
-func (poller *fdPoller) close() {
-	if poller.pipe[1] != -1 {
-		unix.Close(poller.pipe[1])
-	}
-	if poller.pipe[0] != -1 {
-		unix.Close(poller.pipe[0])
-	}
-	if poller.epfd != -1 {
-		unix.Close(poller.epfd)
-	}
-}
diff --git a/vendor/github.com/fsnotify/fsnotify/kqueue.go b/vendor/github.com/fsnotify/fsnotify/kqueue.go
deleted file mode 100644
index 368f5b790d..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/kqueue.go
+++ /dev/null
@@ -1,522 +0,0 @@
-// Copyright 2010 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build freebsd || openbsd || netbsd || dragonfly || darwin
-// +build freebsd openbsd netbsd dragonfly darwin
-
-package fsnotify
-
-import (
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events chan Event
-	Errors chan error
-	done   chan struct{} // Channel for sending a "quit message" to the reader goroutine
-
-	kq int // File descriptor (as returned by the kqueue() syscall).
-
-	mu              sync.Mutex        // Protects access to watcher data
-	watches         map[string]int    // Map of watched file descriptors (key: path).
-	externalWatches map[string]bool   // Map of watches added by user of the library.
-	dirFlags        map[string]uint32 // Map of watched directories to fflags used in kqueue.
-	paths           map[int]pathInfo  // Map file descriptors to path names for processing kqueue events.
-	fileExists      map[string]bool   // Keep track of if we know this file exists (to stop duplicate create events).
-	isClosed        bool              // Set to true when Close() is first called
-}
-
-type pathInfo struct {
-	name  string
-	isDir bool
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	kq, err := kqueue()
-	if err != nil {
-		return nil, err
-	}
-
-	w := &Watcher{
-		kq:              kq,
-		watches:         make(map[string]int),
-		dirFlags:        make(map[string]uint32),
-		paths:           make(map[int]pathInfo),
-		fileExists:      make(map[string]bool),
-		externalWatches: make(map[string]bool),
-		Events:          make(chan Event),
-		Errors:          make(chan error),
-		done:            make(chan struct{}),
-	}
-
-	go w.readEvents()
-	return w, nil
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	w.mu.Lock()
-	if w.isClosed {
-		w.mu.Unlock()
-		return nil
-	}
-	w.isClosed = true
-
-	// copy paths to remove while locked
-	var pathsToRemove = make([]string, 0, len(w.watches))
-	for name := range w.watches {
-		pathsToRemove = append(pathsToRemove, name)
-	}
-	w.mu.Unlock()
-	// unlock before calling Remove, which also locks
-
-	for _, name := range pathsToRemove {
-		w.Remove(name)
-	}
-
-	// send a "quit" message to the reader goroutine
-	close(w.done)
-
-	return nil
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	w.mu.Lock()
-	w.externalWatches[name] = true
-	w.mu.Unlock()
-	_, err := w.addWatch(name, noteAllEvents)
-	return err
-}
-
-// Remove stops watching the the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	name = filepath.Clean(name)
-	w.mu.Lock()
-	watchfd, ok := w.watches[name]
-	w.mu.Unlock()
-	if !ok {
-		return fmt.Errorf("can't remove non-existent kevent watch for: %s", name)
-	}
-
-	const registerRemove = unix.EV_DELETE
-	if err := register(w.kq, []int{watchfd}, registerRemove, 0); err != nil {
-		return err
-	}
-
-	unix.Close(watchfd)
-
-	w.mu.Lock()
-	isDir := w.paths[watchfd].isDir
-	delete(w.watches, name)
-	delete(w.paths, watchfd)
-	delete(w.dirFlags, name)
-	w.mu.Unlock()
-
-	// Find all watched paths that are in this directory that are not external.
-	if isDir {
-		var pathsToRemove []string
-		w.mu.Lock()
-		for _, path := range w.paths {
-			wdir, _ := filepath.Split(path.name)
-			if filepath.Clean(wdir) == name {
-				if !w.externalWatches[path.name] {
-					pathsToRemove = append(pathsToRemove, path.name)
-				}
-			}
-		}
-		w.mu.Unlock()
-		for _, name := range pathsToRemove {
-			// Since these are internal, not much sense in propagating error
-			// to the user, as that will just confuse them with an error about
-			// a path they did not explicitly watch themselves.
-			w.Remove(name)
-		}
-	}
-
-	return nil
-}
-
-// Watch all events (except NOTE_EXTEND, NOTE_LINK, NOTE_REVOKE)
-const noteAllEvents = unix.NOTE_DELETE | unix.NOTE_WRITE | unix.NOTE_ATTRIB | unix.NOTE_RENAME
-
-// keventWaitTime to block on each read from kevent
-var keventWaitTime = durationToTimespec(100 * time.Millisecond)
-
-// addWatch adds name to the watched file set.
-// The flags are interpreted as described in kevent(2).
-// Returns the real path to the file which was added, if any, which may be different from the one passed in the case of symlinks.
-func (w *Watcher) addWatch(name string, flags uint32) (string, error) {
-	var isDir bool
-	// Make ./name and name equivalent
-	name = filepath.Clean(name)
-
-	w.mu.Lock()
-	if w.isClosed {
-		w.mu.Unlock()
-		return "", errors.New("kevent instance already closed")
-	}
-	watchfd, alreadyWatching := w.watches[name]
-	// We already have a watch, but we can still override flags.
-	if alreadyWatching {
-		isDir = w.paths[watchfd].isDir
-	}
-	w.mu.Unlock()
-
-	if !alreadyWatching {
-		fi, err := os.Lstat(name)
-		if err != nil {
-			return "", err
-		}
-
-		// Don't watch sockets.
-		if fi.Mode()&os.ModeSocket == os.ModeSocket {
-			return "", nil
-		}
-
-		// Don't watch named pipes.
-		if fi.Mode()&os.ModeNamedPipe == os.ModeNamedPipe {
-			return "", nil
-		}
-
-		// Follow Symlinks
-		// Unfortunately, Linux can add bogus symlinks to watch list without
-		// issue, and Windows can't do symlinks period (AFAIK). To  maintain
-		// consistency, we will act like everything is fine. There will simply
-		// be no file events for broken symlinks.
-		// Hence the returns of nil on errors.
-		if fi.Mode()&os.ModeSymlink == os.ModeSymlink {
-			name, err = filepath.EvalSymlinks(name)
-			if err != nil {
-				return "", nil
-			}
-
-			w.mu.Lock()
-			_, alreadyWatching = w.watches[name]
-			w.mu.Unlock()
-
-			if alreadyWatching {
-				return name, nil
-			}
-
-			fi, err = os.Lstat(name)
-			if err != nil {
-				return "", nil
-			}
-		}
-
-		watchfd, err = unix.Open(name, openMode, 0700)
-		if watchfd == -1 {
-			return "", err
-		}
-
-		isDir = fi.IsDir()
-	}
-
-	const registerAdd = unix.EV_ADD | unix.EV_CLEAR | unix.EV_ENABLE
-	if err := register(w.kq, []int{watchfd}, registerAdd, flags); err != nil {
-		unix.Close(watchfd)
-		return "", err
-	}
-
-	if !alreadyWatching {
-		w.mu.Lock()
-		w.watches[name] = watchfd
-		w.paths[watchfd] = pathInfo{name: name, isDir: isDir}
-		w.mu.Unlock()
-	}
-
-	if isDir {
-		// Watch the directory if it has not been watched before,
-		// or if it was watched before, but perhaps only a NOTE_DELETE (watchDirectoryFiles)
-		w.mu.Lock()
-
-		watchDir := (flags&unix.NOTE_WRITE) == unix.NOTE_WRITE &&
-			(!alreadyWatching || (w.dirFlags[name]&unix.NOTE_WRITE) != unix.NOTE_WRITE)
-		// Store flags so this watch can be updated later
-		w.dirFlags[name] = flags
-		w.mu.Unlock()
-
-		if watchDir {
-			if err := w.watchDirectoryFiles(name); err != nil {
-				return "", err
-			}
-		}
-	}
-	return name, nil
-}
-
-// readEvents reads from kqueue and converts the received kevents into
-// Event values that it sends down the Events channel.
-func (w *Watcher) readEvents() {
-	eventBuffer := make([]unix.Kevent_t, 10)
-
-loop:
-	for {
-		// See if there is a message on the "done" channel
-		select {
-		case <-w.done:
-			break loop
-		default:
-		}
-
-		// Get new events
-		kevents, err := read(w.kq, eventBuffer, &keventWaitTime)
-		// EINTR is okay, the syscall was interrupted before timeout expired.
-		if err != nil && err != unix.EINTR {
-			select {
-			case w.Errors <- err:
-			case <-w.done:
-				break loop
-			}
-			continue
-		}
-
-		// Flush the events we received to the Events channel
-		for len(kevents) > 0 {
-			kevent := &kevents[0]
-			watchfd := int(kevent.Ident)
-			mask := uint32(kevent.Fflags)
-			w.mu.Lock()
-			path := w.paths[watchfd]
-			w.mu.Unlock()
-			event := newEvent(path.name, mask)
-
-			if path.isDir && !(event.Op&Remove == Remove) {
-				// Double check to make sure the directory exists. This can happen when
-				// we do a rm -fr on a recursively watched folders and we receive a
-				// modification event first but the folder has been deleted and later
-				// receive the delete event
-				if _, err := os.Lstat(event.Name); os.IsNotExist(err) {
-					// mark is as delete event
-					event.Op |= Remove
-				}
-			}
-
-			if event.Op&Rename == Rename || event.Op&Remove == Remove {
-				w.Remove(event.Name)
-				w.mu.Lock()
-				delete(w.fileExists, event.Name)
-				w.mu.Unlock()
-			}
-
-			if path.isDir && event.Op&Write == Write && !(event.Op&Remove == Remove) {
-				w.sendDirectoryChangeEvents(event.Name)
-			} else {
-				// Send the event on the Events channel.
-				select {
-				case w.Events <- event:
-				case <-w.done:
-					break loop
-				}
-			}
-
-			if event.Op&Remove == Remove {
-				// Look for a file that may have overwritten this.
-				// For example, mv f1 f2 will delete f2, then create f2.
-				if path.isDir {
-					fileDir := filepath.Clean(event.Name)
-					w.mu.Lock()
-					_, found := w.watches[fileDir]
-					w.mu.Unlock()
-					if found {
-						// make sure the directory exists before we watch for changes. When we
-						// do a recursive watch and perform rm -fr, the parent directory might
-						// have gone missing, ignore the missing directory and let the
-						// upcoming delete event remove the watch from the parent directory.
-						if _, err := os.Lstat(fileDir); err == nil {
-							w.sendDirectoryChangeEvents(fileDir)
-						}
-					}
-				} else {
-					filePath := filepath.Clean(event.Name)
-					if fileInfo, err := os.Lstat(filePath); err == nil {
-						w.sendFileCreatedEventIfNew(filePath, fileInfo)
-					}
-				}
-			}
-
-			// Move to next event
-			kevents = kevents[1:]
-		}
-	}
-
-	// cleanup
-	err := unix.Close(w.kq)
-	if err != nil {
-		// only way the previous loop breaks is if w.done was closed so we need to async send to w.Errors.
-		select {
-		case w.Errors <- err:
-		default:
-		}
-	}
-	close(w.Events)
-	close(w.Errors)
-}
-
-// newEvent returns an platform-independent Event based on kqueue Fflags.
-func newEvent(name string, mask uint32) Event {
-	e := Event{Name: name}
-	if mask&unix.NOTE_DELETE == unix.NOTE_DELETE {
-		e.Op |= Remove
-	}
-	if mask&unix.NOTE_WRITE == unix.NOTE_WRITE {
-		e.Op |= Write
-	}
-	if mask&unix.NOTE_RENAME == unix.NOTE_RENAME {
-		e.Op |= Rename
-	}
-	if mask&unix.NOTE_ATTRIB == unix.NOTE_ATTRIB {
-		e.Op |= Chmod
-	}
-	return e
-}
-
-func newCreateEvent(name string) Event {
-	return Event{Name: name, Op: Create}
-}
-
-// watchDirectoryFiles to mimic inotify when adding a watch on a directory
-func (w *Watcher) watchDirectoryFiles(dirPath string) error {
-	// Get all files
-	files, err := ioutil.ReadDir(dirPath)
-	if err != nil {
-		return err
-	}
-
-	for _, fileInfo := range files {
-		filePath := filepath.Join(dirPath, fileInfo.Name())
-		filePath, err = w.internalWatch(filePath, fileInfo)
-		if err != nil {
-			return err
-		}
-
-		w.mu.Lock()
-		w.fileExists[filePath] = true
-		w.mu.Unlock()
-	}
-
-	return nil
-}
-
-// sendDirectoryEvents searches the directory for newly created files
-// and sends them over the event channel. This functionality is to have
-// the BSD version of fsnotify match Linux inotify which provides a
-// create event for files created in a watched directory.
-func (w *Watcher) sendDirectoryChangeEvents(dirPath string) {
-	// Get all files
-	files, err := ioutil.ReadDir(dirPath)
-	if err != nil {
-		select {
-		case w.Errors <- err:
-		case <-w.done:
-			return
-		}
-	}
-
-	// Search for new files
-	for _, fileInfo := range files {
-		filePath := filepath.Join(dirPath, fileInfo.Name())
-		err := w.sendFileCreatedEventIfNew(filePath, fileInfo)
-
-		if err != nil {
-			return
-		}
-	}
-}
-
-// sendFileCreatedEvent sends a create event if the file isn't already being tracked.
-func (w *Watcher) sendFileCreatedEventIfNew(filePath string, fileInfo os.FileInfo) (err error) {
-	w.mu.Lock()
-	_, doesExist := w.fileExists[filePath]
-	w.mu.Unlock()
-	if !doesExist {
-		// Send create event
-		select {
-		case w.Events <- newCreateEvent(filePath):
-		case <-w.done:
-			return
-		}
-	}
-
-	// like watchDirectoryFiles (but without doing another ReadDir)
-	filePath, err = w.internalWatch(filePath, fileInfo)
-	if err != nil {
-		return err
-	}
-
-	w.mu.Lock()
-	w.fileExists[filePath] = true
-	w.mu.Unlock()
-
-	return nil
-}
-
-func (w *Watcher) internalWatch(name string, fileInfo os.FileInfo) (string, error) {
-	if fileInfo.IsDir() {
-		// mimic Linux providing delete events for subdirectories
-		// but preserve the flags used if currently watching subdirectory
-		w.mu.Lock()
-		flags := w.dirFlags[name]
-		w.mu.Unlock()
-
-		flags |= unix.NOTE_DELETE | unix.NOTE_RENAME
-		return w.addWatch(name, flags)
-	}
-
-	// watch file to mimic Linux inotify
-	return w.addWatch(name, noteAllEvents)
-}
-
-// kqueue creates a new kernel event queue and returns a descriptor.
-func kqueue() (kq int, err error) {
-	kq, err = unix.Kqueue()
-	if kq == -1 {
-		return kq, err
-	}
-	return kq, nil
-}
-
-// register events with the queue
-func register(kq int, fds []int, flags int, fflags uint32) error {
-	changes := make([]unix.Kevent_t, len(fds))
-
-	for i, fd := range fds {
-		// SetKevent converts int to the platform-specific types:
-		unix.SetKevent(&changes[i], fd, unix.EVFILT_VNODE, flags)
-		changes[i].Fflags = fflags
-	}
-
-	// register the events
-	success, err := unix.Kevent(kq, changes, nil, nil)
-	if success == -1 {
-		return err
-	}
-	return nil
-}
-
-// read retrieves pending events, or waits until an event occurs.
-// A timeout of nil blocks indefinitely, while 0 polls the queue.
-func read(kq int, events []unix.Kevent_t, timeout *unix.Timespec) ([]unix.Kevent_t, error) {
-	n, err := unix.Kevent(kq, nil, events, timeout)
-	if err != nil {
-		return nil, err
-	}
-	return events[0:n], nil
-}
-
-// durationToTimespec prepares a timeout value
-func durationToTimespec(d time.Duration) unix.Timespec {
-	return unix.NsecToTimespec(d.Nanoseconds())
-}
diff --git a/vendor/github.com/fsnotify/fsnotify/mkdoc.zsh b/vendor/github.com/fsnotify/fsnotify/mkdoc.zsh
new file mode 100644
index 0000000000..b09ef76834
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/mkdoc.zsh
@@ -0,0 +1,208 @@
+#!/usr/bin/env zsh
+[ "${ZSH_VERSION:-}" = "" ] && echo >&2 "Only works with zsh" && exit 1
+setopt err_exit no_unset pipefail extended_glob
+
+# Simple script to update the godoc comments on all watchers. Probably took me
+# more time to write this than doing it manually, but ah well 🙃
+
+watcher=$(<<EOF
+// Watcher watches a set of paths, delivering events on a channel.
+//
+// A watcher should not be copied (e.g. pass it by pointer, rather than by
+// value).
+//
+// # Linux notes
+//
+// When a file is removed a Remove event won't be emitted until all file
+// descriptors are closed, and deletes will always emit a Chmod. For example:
+//
+//     fp := os.Open("file")
+//     os.Remove("file")        // Triggers Chmod
+//     fp.Close()               // Triggers Remove
+//
+// This is the event that inotify sends, so not much can be changed about this.
+//
+// The fs.inotify.max_user_watches sysctl variable specifies the upper limit
+// for the number of watches per user, and fs.inotify.max_user_instances
+// specifies the maximum number of inotify instances per user. Every Watcher you
+// create is an "instance", and every path you add is a "watch".
+//
+// These are also exposed in /proc as /proc/sys/fs/inotify/max_user_watches and
+// /proc/sys/fs/inotify/max_user_instances
+//
+// To increase them you can use sysctl or write the value to the /proc file:
+//
+//     # Default values on Linux 5.18
+//     sysctl fs.inotify.max_user_watches=124983
+//     sysctl fs.inotify.max_user_instances=128
+//
+// To make the changes persist on reboot edit /etc/sysctl.conf or
+// /usr/lib/sysctl.d/50-default.conf (details differ per Linux distro; check
+// your distro's documentation):
+//
+//     fs.inotify.max_user_watches=124983
+//     fs.inotify.max_user_instances=128
+//
+// Reaching the limit will result in a "no space left on device" or "too many open
+// files" error.
+//
+// # kqueue notes (macOS, BSD)
+//
+// kqueue requires opening a file descriptor for every file that's being watched;
+// so if you're watching a directory with five files then that's six file
+// descriptors. You will run in to your system's "max open files" limit faster on
+// these platforms.
+//
+// The sysctl variables kern.maxfiles and kern.maxfilesperproc can be used to
+// control the maximum number of open files, as well as /etc/login.conf on BSD
+// systems.
+//
+// # macOS notes
+//
+// Spotlight indexing on macOS can result in multiple events (see [#15]). A
+// temporary workaround is to add your folder(s) to the "Spotlight Privacy
+// Settings" until we have a native FSEvents implementation (see [#11]).
+//
+// [#11]: https://github.com/fsnotify/fsnotify/issues/11
+// [#15]: https://github.com/fsnotify/fsnotify/issues/15
+EOF
+)
+
+new=$(<<EOF
+// NewWatcher creates a new Watcher.
+EOF
+)
+
+add=$(<<EOF
+// Add starts monitoring the path for changes.
+//
+// A path can only be watched once; attempting to watch it more than once will
+// return an error. Paths that do not yet exist on the filesystem cannot be
+// added. A watch will be automatically removed if the path is deleted.
+//
+// A path will remain watched if it gets renamed to somewhere else on the same
+// filesystem, but the monitor will get removed if the path gets deleted and
+// re-created, or if it's moved to a different filesystem.
+//
+// Notifications on network filesystems (NFS, SMB, FUSE, etc.) or special
+// filesystems (/proc, /sys, etc.) generally don't work.
+//
+// # Watching directories
+//
+// All files in a directory are monitored, including new files that are created
+// after the watcher is started. Subdirectories are not watched (i.e. it's
+// non-recursive).
+//
+// # Watching files
+//
+// Watching individual files (rather than directories) is generally not
+// recommended as many tools update files atomically. Instead of "just" writing
+// to the file a temporary file will be written to first, and if successful the
+// temporary file is moved to to destination removing the original, or some
+// variant thereof. The watcher on the original file is now lost, as it no
+// longer exists.
+//
+// Instead, watch the parent directory and use Event.Name to filter out files
+// you're not interested in. There is an example of this in [cmd/fsnotify/file.go].
+EOF
+)
+
+remove=$(<<EOF
+// Remove stops monitoring the path for changes.
+//
+// Directories are always removed non-recursively. For example, if you added
+// /tmp/dir and /tmp/dir/subdir then you will need to remove both.
+//
+// Removing a path that has not yet been added returns [ErrNonExistentWatch].
+EOF
+)
+
+close=$(<<EOF
+// Close removes all watches and closes the events channel.
+EOF
+)
+
+watchlist=$(<<EOF
+// WatchList returns all paths added with [Add] (and are not yet removed).
+EOF
+)
+
+events=$(<<EOF
+	// Events sends the filesystem change events.
+	//
+	// fsnotify can send the following events; a "path" here can refer to a
+	// file, directory, symbolic link, or special file like a FIFO.
+	//
+	//   fsnotify.Create    A new path was created; this may be followed by one
+	//                      or more Write events if data also gets written to a
+	//                      file.
+	//
+	//   fsnotify.Remove    A path was removed.
+	//
+	//   fsnotify.Rename    A path was renamed. A rename is always sent with the
+	//                      old path as Event.Name, and a Create event will be
+	//                      sent with the new name. Renames are only sent for
+	//                      paths that are currently watched; e.g. moving an
+	//                      unmonitored file into a monitored directory will
+	//                      show up as just a Create. Similarly, renaming a file
+	//                      to outside a monitored directory will show up as
+	//                      only a Rename.
+	//
+	//   fsnotify.Write     A file or named pipe was written to. A Truncate will
+	//                      also trigger a Write. A single "write action"
+	//                      initiated by the user may show up as one or multiple
+	//                      writes, depending on when the system syncs things to
+	//                      disk. For example when compiling a large Go program
+	//                      you may get hundreds of Write events, so you
+	//                      probably want to wait until you've stopped receiving
+	//                      them (see the dedup example in cmd/fsnotify).
+	//
+	//   fsnotify.Chmod     Attributes were changed. On Linux this is also sent
+	//                      when a file is removed (or more accurately, when a
+	//                      link to an inode is removed). On kqueue it's sent
+	//                      and on kqueue when a file is truncated. On Windows
+	//                      it's never sent.
+EOF
+)
+
+errors=$(<<EOF
+	// Errors sends any errors.
+EOF
+)
+
+set-cmt() {
+	local pat=$1
+	local cmt=$2
+
+	IFS=$'\n' local files=($(grep -n $pat backend_*~*_test.go))
+	for f in $files; do
+		IFS=':' local fields=($=f)
+		local file=$fields[1]
+		local end=$(( $fields[2] - 1 ))
+
+		# Find start of comment.
+		local start=0
+		IFS=$'\n' local lines=($(head -n$end $file))
+		for (( i = 1; i <= $#lines; i++ )); do
+			local line=$lines[-$i]
+			if ! grep -q '^[[:space:]]*//' <<<$line; then
+				start=$(( end - (i - 2) ))
+				break
+			fi
+		done
+
+		head -n $(( start - 1 )) $file  >/tmp/x
+		print -r -- $cmt                >>/tmp/x
+		tail -n+$(( end + 1 ))   $file  >>/tmp/x
+		mv /tmp/x $file
+	done
+}
+
+set-cmt '^type Watcher struct '             $watcher
+set-cmt '^func NewWatcher('                 $new
+set-cmt '^func (w \*Watcher) Add('          $add
+set-cmt '^func (w \*Watcher) Remove('       $remove
+set-cmt '^func (w \*Watcher) Close('        $close
+set-cmt '^func (w \*Watcher) WatchList('    $watchlist
+set-cmt '^[[:space:]]*Events *chan Event$'  $events
+set-cmt '^[[:space:]]*Errors *chan error$'  $errors
diff --git a/vendor/github.com/fsnotify/fsnotify/open_mode_bsd.go b/vendor/github.com/fsnotify/fsnotify/open_mode_bsd.go
deleted file mode 100644
index 36cc3845b6..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/open_mode_bsd.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build freebsd || openbsd || netbsd || dragonfly
-// +build freebsd openbsd netbsd dragonfly
-
-package fsnotify
-
-import "golang.org/x/sys/unix"
-
-const openMode = unix.O_NONBLOCK | unix.O_RDONLY | unix.O_CLOEXEC
diff --git a/vendor/github.com/fsnotify/fsnotify/open_mode_darwin.go b/vendor/github.com/fsnotify/fsnotify/open_mode_darwin.go
deleted file mode 100644
index 98cd8476ff..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/open_mode_darwin.go
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build darwin
-// +build darwin
-
-package fsnotify
-
-import "golang.org/x/sys/unix"
-
-// note: this constant is not defined on BSD
-const openMode = unix.O_EVTONLY | unix.O_CLOEXEC
diff --git a/vendor/github.com/fsnotify/fsnotify/system_bsd.go b/vendor/github.com/fsnotify/fsnotify/system_bsd.go
new file mode 100644
index 0000000000..4322b0b885
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/system_bsd.go
@@ -0,0 +1,8 @@
+//go:build freebsd || openbsd || netbsd || dragonfly
+// +build freebsd openbsd netbsd dragonfly
+
+package fsnotify
+
+import "golang.org/x/sys/unix"
+
+const openMode = unix.O_NONBLOCK | unix.O_RDONLY | unix.O_CLOEXEC
diff --git a/vendor/github.com/fsnotify/fsnotify/system_darwin.go b/vendor/github.com/fsnotify/fsnotify/system_darwin.go
new file mode 100644
index 0000000000..5da5ffa78f
--- /dev/null
+++ b/vendor/github.com/fsnotify/fsnotify/system_darwin.go
@@ -0,0 +1,9 @@
+//go:build darwin
+// +build darwin
+
+package fsnotify
+
+import "golang.org/x/sys/unix"
+
+// note: this constant is not defined on BSD
+const openMode = unix.O_EVTONLY | unix.O_CLOEXEC
diff --git a/vendor/github.com/fsnotify/fsnotify/windows.go b/vendor/github.com/fsnotify/fsnotify/windows.go
deleted file mode 100644
index c02b75f7c3..0000000000
--- a/vendor/github.com/fsnotify/fsnotify/windows.go
+++ /dev/null
@@ -1,562 +0,0 @@
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build windows
-// +build windows
-
-package fsnotify
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync"
-	"syscall"
-	"unsafe"
-)
-
-// Watcher watches a set of files, delivering events to a channel.
-type Watcher struct {
-	Events   chan Event
-	Errors   chan error
-	isClosed bool           // Set to true when Close() is first called
-	mu       sync.Mutex     // Map access
-	port     syscall.Handle // Handle to completion port
-	watches  watchMap       // Map of watches (key: i-number)
-	input    chan *input    // Inputs to the reader are sent on this channel
-	quit     chan chan<- error
-}
-
-// NewWatcher establishes a new watcher with the underlying OS and begins waiting for events.
-func NewWatcher() (*Watcher, error) {
-	port, e := syscall.CreateIoCompletionPort(syscall.InvalidHandle, 0, 0, 0)
-	if e != nil {
-		return nil, os.NewSyscallError("CreateIoCompletionPort", e)
-	}
-	w := &Watcher{
-		port:    port,
-		watches: make(watchMap),
-		input:   make(chan *input, 1),
-		Events:  make(chan Event, 50),
-		Errors:  make(chan error),
-		quit:    make(chan chan<- error, 1),
-	}
-	go w.readEvents()
-	return w, nil
-}
-
-// Close removes all watches and closes the events channel.
-func (w *Watcher) Close() error {
-	if w.isClosed {
-		return nil
-	}
-	w.isClosed = true
-
-	// Send "quit" message to the reader goroutine
-	ch := make(chan error)
-	w.quit <- ch
-	if err := w.wakeupReader(); err != nil {
-		return err
-	}
-	return <-ch
-}
-
-// Add starts watching the named file or directory (non-recursively).
-func (w *Watcher) Add(name string) error {
-	if w.isClosed {
-		return errors.New("watcher already closed")
-	}
-	in := &input{
-		op:    opAddWatch,
-		path:  filepath.Clean(name),
-		flags: sysFSALLEVENTS,
-		reply: make(chan error),
-	}
-	w.input <- in
-	if err := w.wakeupReader(); err != nil {
-		return err
-	}
-	return <-in.reply
-}
-
-// Remove stops watching the the named file or directory (non-recursively).
-func (w *Watcher) Remove(name string) error {
-	in := &input{
-		op:    opRemoveWatch,
-		path:  filepath.Clean(name),
-		reply: make(chan error),
-	}
-	w.input <- in
-	if err := w.wakeupReader(); err != nil {
-		return err
-	}
-	return <-in.reply
-}
-
-const (
-	// Options for AddWatch
-	sysFSONESHOT = 0x80000000
-	sysFSONLYDIR = 0x1000000
-
-	// Events
-	sysFSACCESS     = 0x1
-	sysFSALLEVENTS  = 0xfff
-	sysFSATTRIB     = 0x4
-	sysFSCLOSE      = 0x18
-	sysFSCREATE     = 0x100
-	sysFSDELETE     = 0x200
-	sysFSDELETESELF = 0x400
-	sysFSMODIFY     = 0x2
-	sysFSMOVE       = 0xc0
-	sysFSMOVEDFROM  = 0x40
-	sysFSMOVEDTO    = 0x80
-	sysFSMOVESELF   = 0x800
-
-	// Special events
-	sysFSIGNORED   = 0x8000
-	sysFSQOVERFLOW = 0x4000
-)
-
-func newEvent(name string, mask uint32) Event {
-	e := Event{Name: name}
-	if mask&sysFSCREATE == sysFSCREATE || mask&sysFSMOVEDTO == sysFSMOVEDTO {
-		e.Op |= Create
-	}
-	if mask&sysFSDELETE == sysFSDELETE || mask&sysFSDELETESELF == sysFSDELETESELF {
-		e.Op |= Remove
-	}
-	if mask&sysFSMODIFY == sysFSMODIFY {
-		e.Op |= Write
-	}
-	if mask&sysFSMOVE == sysFSMOVE || mask&sysFSMOVESELF == sysFSMOVESELF || mask&sysFSMOVEDFROM == sysFSMOVEDFROM {
-		e.Op |= Rename
-	}
-	if mask&sysFSATTRIB == sysFSATTRIB {
-		e.Op |= Chmod
-	}
-	return e
-}
-
-const (
-	opAddWatch = iota
-	opRemoveWatch
-)
-
-const (
-	provisional uint64 = 1 << (32 + iota)
-)
-
-type input struct {
-	op    int
-	path  string
-	flags uint32
-	reply chan error
-}
-
-type inode struct {
-	handle syscall.Handle
-	volume uint32
-	index  uint64
-}
-
-type watch struct {
-	ov     syscall.Overlapped
-	ino    *inode            // i-number
-	path   string            // Directory path
-	mask   uint64            // Directory itself is being watched with these notify flags
-	names  map[string]uint64 // Map of names being watched and their notify flags
-	rename string            // Remembers the old name while renaming a file
-	buf    [4096]byte
-}
-
-type indexMap map[uint64]*watch
-type watchMap map[uint32]indexMap
-
-func (w *Watcher) wakeupReader() error {
-	e := syscall.PostQueuedCompletionStatus(w.port, 0, 0, nil)
-	if e != nil {
-		return os.NewSyscallError("PostQueuedCompletionStatus", e)
-	}
-	return nil
-}
-
-func getDir(pathname string) (dir string, err error) {
-	attr, e := syscall.GetFileAttributes(syscall.StringToUTF16Ptr(pathname))
-	if e != nil {
-		return "", os.NewSyscallError("GetFileAttributes", e)
-	}
-	if attr&syscall.FILE_ATTRIBUTE_DIRECTORY != 0 {
-		dir = pathname
-	} else {
-		dir, _ = filepath.Split(pathname)
-		dir = filepath.Clean(dir)
-	}
-	return
-}
-
-func getIno(path string) (ino *inode, err error) {
-	h, e := syscall.CreateFile(syscall.StringToUTF16Ptr(path),
-		syscall.FILE_LIST_DIRECTORY,
-		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
-		nil, syscall.OPEN_EXISTING,
-		syscall.FILE_FLAG_BACKUP_SEMANTICS|syscall.FILE_FLAG_OVERLAPPED, 0)
-	if e != nil {
-		return nil, os.NewSyscallError("CreateFile", e)
-	}
-	var fi syscall.ByHandleFileInformation
-	if e = syscall.GetFileInformationByHandle(h, &fi); e != nil {
-		syscall.CloseHandle(h)
-		return nil, os.NewSyscallError("GetFileInformationByHandle", e)
-	}
-	ino = &inode{
-		handle: h,
-		volume: fi.VolumeSerialNumber,
-		index:  uint64(fi.FileIndexHigh)<<32 | uint64(fi.FileIndexLow),
-	}
-	return ino, nil
-}
-
-// Must run within the I/O thread.
-func (m watchMap) get(ino *inode) *watch {
-	if i := m[ino.volume]; i != nil {
-		return i[ino.index]
-	}
-	return nil
-}
-
-// Must run within the I/O thread.
-func (m watchMap) set(ino *inode, watch *watch) {
-	i := m[ino.volume]
-	if i == nil {
-		i = make(indexMap)
-		m[ino.volume] = i
-	}
-	i[ino.index] = watch
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) addWatch(pathname string, flags uint64) error {
-	dir, err := getDir(pathname)
-	if err != nil {
-		return err
-	}
-	if flags&sysFSONLYDIR != 0 && pathname != dir {
-		return nil
-	}
-	ino, err := getIno(dir)
-	if err != nil {
-		return err
-	}
-	w.mu.Lock()
-	watchEntry := w.watches.get(ino)
-	w.mu.Unlock()
-	if watchEntry == nil {
-		if _, e := syscall.CreateIoCompletionPort(ino.handle, w.port, 0, 0); e != nil {
-			syscall.CloseHandle(ino.handle)
-			return os.NewSyscallError("CreateIoCompletionPort", e)
-		}
-		watchEntry = &watch{
-			ino:   ino,
-			path:  dir,
-			names: make(map[string]uint64),
-		}
-		w.mu.Lock()
-		w.watches.set(ino, watchEntry)
-		w.mu.Unlock()
-		flags |= provisional
-	} else {
-		syscall.CloseHandle(ino.handle)
-	}
-	if pathname == dir {
-		watchEntry.mask |= flags
-	} else {
-		watchEntry.names[filepath.Base(pathname)] |= flags
-	}
-	if err = w.startRead(watchEntry); err != nil {
-		return err
-	}
-	if pathname == dir {
-		watchEntry.mask &= ^provisional
-	} else {
-		watchEntry.names[filepath.Base(pathname)] &= ^provisional
-	}
-	return nil
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) remWatch(pathname string) error {
-	dir, err := getDir(pathname)
-	if err != nil {
-		return err
-	}
-	ino, err := getIno(dir)
-	if err != nil {
-		return err
-	}
-	w.mu.Lock()
-	watch := w.watches.get(ino)
-	w.mu.Unlock()
-	if watch == nil {
-		return fmt.Errorf("can't remove non-existent watch for: %s", pathname)
-	}
-	if pathname == dir {
-		w.sendEvent(watch.path, watch.mask&sysFSIGNORED)
-		watch.mask = 0
-	} else {
-		name := filepath.Base(pathname)
-		w.sendEvent(filepath.Join(watch.path, name), watch.names[name]&sysFSIGNORED)
-		delete(watch.names, name)
-	}
-	return w.startRead(watch)
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) deleteWatch(watch *watch) {
-	for name, mask := range watch.names {
-		if mask&provisional == 0 {
-			w.sendEvent(filepath.Join(watch.path, name), mask&sysFSIGNORED)
-		}
-		delete(watch.names, name)
-	}
-	if watch.mask != 0 {
-		if watch.mask&provisional == 0 {
-			w.sendEvent(watch.path, watch.mask&sysFSIGNORED)
-		}
-		watch.mask = 0
-	}
-}
-
-// Must run within the I/O thread.
-func (w *Watcher) startRead(watch *watch) error {
-	if e := syscall.CancelIo(watch.ino.handle); e != nil {
-		w.Errors <- os.NewSyscallError("CancelIo", e)
-		w.deleteWatch(watch)
-	}
-	mask := toWindowsFlags(watch.mask)
-	for _, m := range watch.names {
-		mask |= toWindowsFlags(m)
-	}
-	if mask == 0 {
-		if e := syscall.CloseHandle(watch.ino.handle); e != nil {
-			w.Errors <- os.NewSyscallError("CloseHandle", e)
-		}
-		w.mu.Lock()
-		delete(w.watches[watch.ino.volume], watch.ino.index)
-		w.mu.Unlock()
-		return nil
-	}
-	e := syscall.ReadDirectoryChanges(watch.ino.handle, &watch.buf[0],
-		uint32(unsafe.Sizeof(watch.buf)), false, mask, nil, &watch.ov, 0)
-	if e != nil {
-		err := os.NewSyscallError("ReadDirectoryChanges", e)
-		if e == syscall.ERROR_ACCESS_DENIED && watch.mask&provisional == 0 {
-			// Watched directory was probably removed
-			if w.sendEvent(watch.path, watch.mask&sysFSDELETESELF) {
-				if watch.mask&sysFSONESHOT != 0 {
-					watch.mask = 0
-				}
-			}
-			err = nil
-		}
-		w.deleteWatch(watch)
-		w.startRead(watch)
-		return err
-	}
-	return nil
-}
-
-// readEvents reads from the I/O completion port, converts the
-// received events into Event objects and sends them via the Events channel.
-// Entry point to the I/O thread.
-func (w *Watcher) readEvents() {
-	var (
-		n, key uint32
-		ov     *syscall.Overlapped
-	)
-	runtime.LockOSThread()
-
-	for {
-		e := syscall.GetQueuedCompletionStatus(w.port, &n, &key, &ov, syscall.INFINITE)
-		watch := (*watch)(unsafe.Pointer(ov))
-
-		if watch == nil {
-			select {
-			case ch := <-w.quit:
-				w.mu.Lock()
-				var indexes []indexMap
-				for _, index := range w.watches {
-					indexes = append(indexes, index)
-				}
-				w.mu.Unlock()
-				for _, index := range indexes {
-					for _, watch := range index {
-						w.deleteWatch(watch)
-						w.startRead(watch)
-					}
-				}
-				var err error
-				if e := syscall.CloseHandle(w.port); e != nil {
-					err = os.NewSyscallError("CloseHandle", e)
-				}
-				close(w.Events)
-				close(w.Errors)
-				ch <- err
-				return
-			case in := <-w.input:
-				switch in.op {
-				case opAddWatch:
-					in.reply <- w.addWatch(in.path, uint64(in.flags))
-				case opRemoveWatch:
-					in.reply <- w.remWatch(in.path)
-				}
-			default:
-			}
-			continue
-		}
-
-		switch e {
-		case syscall.ERROR_MORE_DATA:
-			if watch == nil {
-				w.Errors <- errors.New("ERROR_MORE_DATA has unexpectedly null lpOverlapped buffer")
-			} else {
-				// The i/o succeeded but the buffer is full.
-				// In theory we should be building up a full packet.
-				// In practice we can get away with just carrying on.
-				n = uint32(unsafe.Sizeof(watch.buf))
-			}
-		case syscall.ERROR_ACCESS_DENIED:
-			// Watched directory was probably removed
-			w.sendEvent(watch.path, watch.mask&sysFSDELETESELF)
-			w.deleteWatch(watch)
-			w.startRead(watch)
-			continue
-		case syscall.ERROR_OPERATION_ABORTED:
-			// CancelIo was called on this handle
-			continue
-		default:
-			w.Errors <- os.NewSyscallError("GetQueuedCompletionPort", e)
-			continue
-		case nil:
-		}
-
-		var offset uint32
-		for {
-			if n == 0 {
-				w.Events <- newEvent("", sysFSQOVERFLOW)
-				w.Errors <- errors.New("short read in readEvents()")
-				break
-			}
-
-			// Point "raw" to the event in the buffer
-			raw := (*syscall.FileNotifyInformation)(unsafe.Pointer(&watch.buf[offset]))
-			buf := (*[syscall.MAX_PATH]uint16)(unsafe.Pointer(&raw.FileName))
-			name := syscall.UTF16ToString(buf[:raw.FileNameLength/2])
-			fullname := filepath.Join(watch.path, name)
-
-			var mask uint64
-			switch raw.Action {
-			case syscall.FILE_ACTION_REMOVED:
-				mask = sysFSDELETESELF
-			case syscall.FILE_ACTION_MODIFIED:
-				mask = sysFSMODIFY
-			case syscall.FILE_ACTION_RENAMED_OLD_NAME:
-				watch.rename = name
-			case syscall.FILE_ACTION_RENAMED_NEW_NAME:
-				if watch.names[watch.rename] != 0 {
-					watch.names[name] |= watch.names[watch.rename]
-					delete(watch.names, watch.rename)
-					mask = sysFSMOVESELF
-				}
-			}
-
-			sendNameEvent := func() {
-				if w.sendEvent(fullname, watch.names[name]&mask) {
-					if watch.names[name]&sysFSONESHOT != 0 {
-						delete(watch.names, name)
-					}
-				}
-			}
-			if raw.Action != syscall.FILE_ACTION_RENAMED_NEW_NAME {
-				sendNameEvent()
-			}
-			if raw.Action == syscall.FILE_ACTION_REMOVED {
-				w.sendEvent(fullname, watch.names[name]&sysFSIGNORED)
-				delete(watch.names, name)
-			}
-			if w.sendEvent(fullname, watch.mask&toFSnotifyFlags(raw.Action)) {
-				if watch.mask&sysFSONESHOT != 0 {
-					watch.mask = 0
-				}
-			}
-			if raw.Action == syscall.FILE_ACTION_RENAMED_NEW_NAME {
-				fullname = filepath.Join(watch.path, watch.rename)
-				sendNameEvent()
-			}
-
-			// Move to the next event in the buffer
-			if raw.NextEntryOffset == 0 {
-				break
-			}
-			offset += raw.NextEntryOffset
-
-			// Error!
-			if offset >= n {
-				w.Errors <- errors.New("Windows system assumed buffer larger than it is, events have likely been missed.")
-				break
-			}
-		}
-
-		if err := w.startRead(watch); err != nil {
-			w.Errors <- err
-		}
-	}
-}
-
-func (w *Watcher) sendEvent(name string, mask uint64) bool {
-	if mask == 0 {
-		return false
-	}
-	event := newEvent(name, uint32(mask))
-	select {
-	case ch := <-w.quit:
-		w.quit <- ch
-	case w.Events <- event:
-	}
-	return true
-}
-
-func toWindowsFlags(mask uint64) uint32 {
-	var m uint32
-	if mask&sysFSACCESS != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_LAST_ACCESS
-	}
-	if mask&sysFSMODIFY != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_LAST_WRITE
-	}
-	if mask&sysFSATTRIB != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_ATTRIBUTES
-	}
-	if mask&(sysFSMOVE|sysFSCREATE|sysFSDELETE) != 0 {
-		m |= syscall.FILE_NOTIFY_CHANGE_FILE_NAME | syscall.FILE_NOTIFY_CHANGE_DIR_NAME
-	}
-	return m
-}
-
-func toFSnotifyFlags(action uint32) uint64 {
-	switch action {
-	case syscall.FILE_ACTION_ADDED:
-		return sysFSCREATE
-	case syscall.FILE_ACTION_REMOVED:
-		return sysFSDELETE
-	case syscall.FILE_ACTION_MODIFIED:
-		return sysFSMODIFY
-	case syscall.FILE_ACTION_RENAMED_OLD_NAME:
-		return sysFSMOVEDFROM
-	case syscall.FILE_ACTION_RENAMED_NEW_NAME:
-		return sysFSMOVEDTO
-	}
-	return 0
-}
diff --git a/vendor/github.com/go-ini/ini/.editorconfig b/vendor/github.com/go-ini/ini/.editorconfig
new file mode 100644
index 0000000000..4a2d9180f9
--- /dev/null
+++ b/vendor/github.com/go-ini/ini/.editorconfig
@@ -0,0 +1,12 @@
+# http://editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*_test.go]
+trim_trailing_whitespace = false
diff --git a/vendor/github.com/go-ini/ini/.gitignore b/vendor/github.com/go-ini/ini/.gitignore
index 12411127b3..588388bda2 100644
--- a/vendor/github.com/go-ini/ini/.gitignore
+++ b/vendor/github.com/go-ini/ini/.gitignore
@@ -4,3 +4,4 @@ ini.sublime-workspace
 testdata/conf_reflect.ini
 .idea
 /.vscode
+.DS_Store
diff --git a/vendor/github.com/go-ini/ini/.golangci.yml b/vendor/github.com/go-ini/ini/.golangci.yml
index b7256bae13..631e369254 100644
--- a/vendor/github.com/go-ini/ini/.golangci.yml
+++ b/vendor/github.com/go-ini/ini/.golangci.yml
@@ -1,4 +1,9 @@
 linters-settings:
+  staticcheck:
+    checks: [
+      "all",
+      "-SA1019" # There are valid use cases of strings.Title
+    ]
   nakedret:
     max-func-lines: 0 # Disallow any unnamed return statement
 
@@ -19,3 +24,4 @@ linters:
     - rowserrcheck
     - unconvert
     - goimports
+    - unparam
diff --git a/vendor/github.com/go-ini/ini/README.md b/vendor/github.com/go-ini/ini/README.md
index 1e42944524..30606d9700 100644
--- a/vendor/github.com/go-ini/ini/README.md
+++ b/vendor/github.com/go-ini/ini/README.md
@@ -1,6 +1,6 @@
 # INI
 
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/go-ini/ini/Go?logo=github&style=for-the-badge)](https://github.com/go-ini/ini/actions?query=workflow%3AGo)
+[![GitHub Workflow Status](https://img.shields.io/github/checks-status/go-ini/ini/main?logo=github&style=for-the-badge)](https://github.com/go-ini/ini/actions?query=branch%3Amain)
 [![codecov](https://img.shields.io/codecov/c/github/go-ini/ini/master?logo=codecov&style=for-the-badge)](https://codecov.io/gh/go-ini/ini)
 [![GoDoc](https://img.shields.io/badge/GoDoc-Reference-blue?style=for-the-badge&logo=go)](https://pkg.go.dev/github.com/go-ini/ini?tab=doc)
 [![Sourcegraph](https://img.shields.io/badge/view%20on-Sourcegraph-brightgreen.svg?style=for-the-badge&logo=sourcegraph)](https://sourcegraph.com/github.com/go-ini/ini)
@@ -24,7 +24,7 @@ Package ini provides INI file read and write functionality in Go.
 
 ## Installation
 
-The minimum requirement of Go is **1.12**.
+The minimum requirement of Go is **1.13**.
 
 ```sh
 $ go get gopkg.in/ini.v1
diff --git a/vendor/github.com/go-ini/ini/codecov.yml b/vendor/github.com/go-ini/ini/codecov.yml
index 31f646ee06..e02ec84bc0 100644
--- a/vendor/github.com/go-ini/ini/codecov.yml
+++ b/vendor/github.com/go-ini/ini/codecov.yml
@@ -4,6 +4,13 @@ coverage:
     project:
       default:
         threshold: 1%
+        informational: true
+    patch:
+      defualt:
+        only_pulls: true
+        informational: true
 
 comment:
   layout: 'diff'
+
+github_checks: false
diff --git a/vendor/github.com/go-ini/ini/deprecated.go b/vendor/github.com/go-ini/ini/deprecated.go
index e8bda06e6f..48b8e66d6d 100644
--- a/vendor/github.com/go-ini/ini/deprecated.go
+++ b/vendor/github.com/go-ini/ini/deprecated.go
@@ -14,12 +14,9 @@
 
 package ini
 
-const (
+var (
 	// Deprecated: Use "DefaultSection" instead.
 	DEFAULT_SECTION = DefaultSection
-)
-
-var (
 	// Deprecated: AllCapsUnderscore converts to format ALL_CAPS_UNDERSCORE.
 	AllCapsUnderscore = SnackCase
 )
diff --git a/vendor/github.com/go-ini/ini/error.go b/vendor/github.com/go-ini/ini/error.go
index d88347c54b..f66bc94b8b 100644
--- a/vendor/github.com/go-ini/ini/error.go
+++ b/vendor/github.com/go-ini/ini/error.go
@@ -32,3 +32,18 @@ func IsErrDelimiterNotFound(err error) bool {
 func (err ErrDelimiterNotFound) Error() string {
 	return fmt.Sprintf("key-value delimiter not found: %s", err.Line)
 }
+
+// ErrEmptyKeyName indicates the error type of no key name is found which there should be one.
+type ErrEmptyKeyName struct {
+	Line string
+}
+
+// IsErrEmptyKeyName returns true if the given error is an instance of ErrEmptyKeyName.
+func IsErrEmptyKeyName(err error) bool {
+	_, ok := err.(ErrEmptyKeyName)
+	return ok
+}
+
+func (err ErrEmptyKeyName) Error() string {
+	return fmt.Sprintf("empty key name: %s", err.Line)
+}
diff --git a/vendor/github.com/go-ini/ini/file.go b/vendor/github.com/go-ini/ini/file.go
index 7b4e560d1b..f8b22408be 100644
--- a/vendor/github.com/go-ini/ini/file.go
+++ b/vendor/github.com/go-ini/ini/file.go
@@ -342,6 +342,7 @@ func (f *File) writeToBuffer(indent string) (*bytes.Buffer, error) {
 
 	// Use buffer to make sure target is safe until finish encoding.
 	buf := bytes.NewBuffer(nil)
+	lastSectionIdx := len(f.sectionList) - 1
 	for i, sname := range f.sectionList {
 		sec := f.SectionWithIndex(sname, f.sectionIndexes[i])
 		if len(sec.Comment) > 0 {
@@ -371,12 +372,13 @@ func (f *File) writeToBuffer(indent string) (*bytes.Buffer, error) {
 			}
 		}
 
+		isLastSection := i == lastSectionIdx
 		if sec.isRawSection {
 			if _, err := buf.WriteString(sec.rawBody); err != nil {
 				return nil, err
 			}
 
-			if PrettySection {
+			if PrettySection && !isLastSection {
 				// Put a line between sections
 				if _, err := buf.WriteString(LineBreak); err != nil {
 					return nil, err
@@ -442,16 +444,14 @@ func (f *File) writeToBuffer(indent string) (*bytes.Buffer, error) {
 				kname = `"""` + kname + `"""`
 			}
 
-			for _, val := range key.ValueWithShadows() {
+			writeKeyValue := func(val string) (bool, error) {
 				if _, err := buf.WriteString(kname); err != nil {
-					return nil, err
+					return false, err
 				}
 
 				if key.isBooleanType {
-					if kname != sec.keyList[len(sec.keyList)-1] {
-						buf.WriteString(LineBreak)
-					}
-					continue KeyList
+					buf.WriteString(LineBreak)
+					return true, nil
 				}
 
 				// Write out alignment spaces before "=" sign
@@ -468,10 +468,27 @@ func (f *File) writeToBuffer(indent string) (*bytes.Buffer, error) {
 					val = `"` + val + `"`
 				}
 				if _, err := buf.WriteString(equalSign + val + LineBreak); err != nil {
+					return false, err
+				}
+				return false, nil
+			}
+
+			shadows := key.ValueWithShadows()
+			if len(shadows) == 0 {
+				if _, err := writeKeyValue(""); err != nil {
 					return nil, err
 				}
 			}
 
+			for _, val := range shadows {
+				exitLoop, err := writeKeyValue(val)
+				if err != nil {
+					return nil, err
+				} else if exitLoop {
+					continue KeyList
+				}
+			}
+
 			for _, val := range key.nestedValues {
 				if _, err := buf.WriteString(indent + "  " + val + LineBreak); err != nil {
 					return nil, err
@@ -479,7 +496,7 @@ func (f *File) writeToBuffer(indent string) (*bytes.Buffer, error) {
 			}
 		}
 
-		if PrettySection {
+		if PrettySection && !isLastSection {
 			// Put a line between sections
 			if _, err := buf.WriteString(LineBreak); err != nil {
 				return nil, err
diff --git a/vendor/github.com/go-ini/ini/ini.go b/vendor/github.com/go-ini/ini/ini.go
index ac2a93a5b3..99e7f86511 100644
--- a/vendor/github.com/go-ini/ini/ini.go
+++ b/vendor/github.com/go-ini/ini/ini.go
@@ -23,15 +23,15 @@ import (
 )
 
 const (
-	// DefaultSection is the name of default section. You can use this constant or the string literal.
-	// In most of cases, an empty string is all you need to access the section.
-	DefaultSection = "DEFAULT"
-
 	// Maximum allowed depth when recursively substituing variable names.
 	depthValues = 99
 )
 
 var (
+	// DefaultSection is the name of default section. You can use this var or the string literal.
+	// In most of cases, an empty string is all you need to access the section.
+	DefaultSection = "DEFAULT"
+
 	// LineBreak is the delimiter to determine or compose a new line.
 	// This variable will be changed to "\r\n" automatically on Windows at package init time.
 	LineBreak = "\n"
diff --git a/vendor/github.com/go-ini/ini/key.go b/vendor/github.com/go-ini/ini/key.go
index 0302c291bf..a19d9f38ef 100644
--- a/vendor/github.com/go-ini/ini/key.go
+++ b/vendor/github.com/go-ini/ini/key.go
@@ -110,15 +110,24 @@ func (k *Key) Value() string {
 	return k.value
 }
 
-// ValueWithShadows returns raw values of key and its shadows if any.
+// ValueWithShadows returns raw values of key and its shadows if any. Shadow
+// keys with empty values are ignored from the returned list.
 func (k *Key) ValueWithShadows() []string {
 	if len(k.shadows) == 0 {
+		if k.value == "" {
+			return []string{}
+		}
 		return []string{k.value}
 	}
-	vals := make([]string, len(k.shadows)+1)
-	vals[0] = k.value
-	for i := range k.shadows {
-		vals[i+1] = k.shadows[i].value
+
+	vals := make([]string, 0, len(k.shadows)+1)
+	if k.value != "" {
+		vals = append(vals, k.value)
+	}
+	for _, s := range k.shadows {
+		if s.value != "" {
+			vals = append(vals, s.value)
+		}
 	}
 	return vals
 }
diff --git a/vendor/github.com/go-ini/ini/parser.go b/vendor/github.com/go-ini/ini/parser.go
index ac1c980ab5..44fc526c2c 100644
--- a/vendor/github.com/go-ini/ini/parser.go
+++ b/vendor/github.com/go-ini/ini/parser.go
@@ -164,6 +164,10 @@ func readKeyName(delimiters string, in []byte) (string, int, error) {
 	if endIdx < 0 {
 		return "", -1, ErrDelimiterNotFound{line}
 	}
+	if endIdx == 0 {
+		return "", -1, ErrEmptyKeyName{line}
+	}
+
 	return strings.TrimSpace(line[0:endIdx]), endIdx + 1, nil
 }
 
@@ -463,8 +467,9 @@ func (f *File) parse(reader io.Reader) (err error) {
 
 		kname, offset, err := readKeyName(f.options.KeyValueDelimiters, line)
 		if err != nil {
+			switch {
 			// Treat as boolean key when desired, and whole line is key name.
-			if IsErrDelimiterNotFound(err) {
+			case IsErrDelimiterNotFound(err):
 				switch {
 				case f.options.AllowBooleanKeys:
 					kname, err := p.readValue(line, parserBufferSize)
@@ -482,6 +487,8 @@ func (f *File) parse(reader io.Reader) (err error) {
 				case f.options.SkipUnrecognizableLines:
 					continue
 				}
+			case IsErrEmptyKeyName(err) && f.options.SkipUnrecognizableLines:
+				continue
 			}
 			return err
 		}
diff --git a/vendor/github.com/go-logr/logr/.golangci.yaml b/vendor/github.com/go-logr/logr/.golangci.yaml
new file mode 100644
index 0000000000..0cffafa7bf
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/.golangci.yaml
@@ -0,0 +1,26 @@
+run:
+  timeout: 1m
+  tests: true
+
+linters:
+  disable-all: true
+  enable:
+    - asciicheck
+    - errcheck
+    - forcetypeassert
+    - gocritic
+    - gofmt
+    - goimports
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - revive
+    - staticcheck
+    - typecheck
+    - unused
+
+issues:
+  exclude-use-default: false
+  max-issues-per-linter: 0
+  max-same-issues: 10
diff --git a/vendor/github.com/go-logr/logr/CHANGELOG.md b/vendor/github.com/go-logr/logr/CHANGELOG.md
new file mode 100644
index 0000000000..c356960046
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/CHANGELOG.md
@@ -0,0 +1,6 @@
+# CHANGELOG
+
+## v1.0.0-rc1
+
+This is the first logged release.  Major changes (including breaking changes)
+have occurred since earlier tags.
diff --git a/vendor/github.com/go-logr/logr/CONTRIBUTING.md b/vendor/github.com/go-logr/logr/CONTRIBUTING.md
new file mode 100644
index 0000000000..5d37e294c5
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/CONTRIBUTING.md
@@ -0,0 +1,17 @@
+# Contributing
+
+Logr is open to pull-requests, provided they fit within the intended scope of
+the project.  Specifically, this library aims to be VERY small and minimalist,
+with no external dependencies.
+
+## Compatibility
+
+This project intends to follow [semantic versioning](http://semver.org) and
+is very strict about compatibility.  Any proposed changes MUST follow those
+rules.
+
+## Performance
+
+As a logging library, logr must be as light-weight as possible.  Any proposed
+code change must include results of running the [benchmark](./benchmark)
+before and after the change.
diff --git a/vendor/github.com/go-logr/logr/LICENSE b/vendor/github.com/go-logr/logr/LICENSE
new file mode 100644
index 0000000000..8dada3edaf
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/go-logr/logr/README.md b/vendor/github.com/go-logr/logr/README.md
new file mode 100644
index 0000000000..ab59311813
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/README.md
@@ -0,0 +1,282 @@
+# A minimal logging API for Go
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/go-logr/logr.svg)](https://pkg.go.dev/github.com/go-logr/logr)
+
+logr offers an(other) opinion on how Go programs and libraries can do logging
+without becoming coupled to a particular logging implementation.  This is not
+an implementation of logging - it is an API.  In fact it is two APIs with two
+different sets of users.
+
+The `Logger` type is intended for application and library authors.  It provides
+a relatively small API which can be used everywhere you want to emit logs.  It
+defers the actual act of writing logs (to files, to stdout, or whatever) to the
+`LogSink` interface.
+
+The `LogSink` interface is intended for logging library implementers.  It is a
+pure interface which can be implemented by logging frameworks to provide the actual logging
+functionality.
+
+This decoupling allows application and library developers to write code in
+terms of `logr.Logger` (which has very low dependency fan-out) while the
+implementation of logging is managed "up stack" (e.g. in or near `main()`.)
+Application developers can then switch out implementations as necessary.
+
+Many people assert that libraries should not be logging, and as such efforts
+like this are pointless.  Those people are welcome to convince the authors of
+the tens-of-thousands of libraries that *DO* write logs that they are all
+wrong.  In the meantime, logr takes a more practical approach.
+
+## Typical usage
+
+Somewhere, early in an application's life, it will make a decision about which
+logging library (implementation) it actually wants to use.  Something like:
+
+```
+    func main() {
+        // ... other setup code ...
+
+        // Create the "root" logger.  We have chosen the "logimpl" implementation,
+        // which takes some initial parameters and returns a logr.Logger.
+        logger := logimpl.New(param1, param2)
+
+        // ... other setup code ...
+```
+
+Most apps will call into other libraries, create structures to govern the flow,
+etc.  The `logr.Logger` object can be passed to these other libraries, stored
+in structs, or even used as a package-global variable, if needed.  For example:
+
+```
+    app := createTheAppObject(logger)
+    app.Run()
+```
+
+Outside of this early setup, no other packages need to know about the choice of
+implementation.  They write logs in terms of the `logr.Logger` that they
+received:
+
+```
+    type appObject struct {
+        // ... other fields ...
+        logger logr.Logger
+        // ... other fields ...
+    }
+
+    func (app *appObject) Run() {
+        app.logger.Info("starting up", "timestamp", time.Now())
+
+        // ... app code ...
+```
+
+## Background
+
+If the Go standard library had defined an interface for logging, this project
+probably would not be needed.  Alas, here we are.
+
+### Inspiration
+
+Before you consider this package, please read [this blog post by the
+inimitable Dave Cheney][warning-makes-no-sense].  We really appreciate what
+he has to say, and it largely aligns with our own experiences.
+
+### Differences from Dave's ideas
+
+The main differences are:
+
+1. Dave basically proposes doing away with the notion of a logging API in favor
+of `fmt.Printf()`.  We disagree, especially when you consider things like output
+locations, timestamps, file and line decorations, and structured logging.  This
+package restricts the logging API to just 2 types of logs: info and error.
+
+Info logs are things you want to tell the user which are not errors.  Error
+logs are, well, errors.  If your code receives an `error` from a subordinate
+function call and is logging that `error` *and not returning it*, use error
+logs.
+
+2. Verbosity-levels on info logs.  This gives developers a chance to indicate
+arbitrary grades of importance for info logs, without assigning names with
+semantic meaning such as "warning", "trace", and "debug."  Superficially this
+may feel very similar, but the primary difference is the lack of semantics.
+Because verbosity is a numerical value, it's safe to assume that an app running
+with higher verbosity means more (and less important) logs will be generated.
+
+## Implementations (non-exhaustive)
+
+There are implementations for the following logging libraries:
+
+- **a function** (can bridge to non-structured libraries): [funcr](https://github.com/go-logr/logr/tree/master/funcr)
+- **a testing.T** (for use in Go tests, with JSON-like output): [testr](https://github.com/go-logr/logr/tree/master/testr)
+- **github.com/google/glog**: [glogr](https://github.com/go-logr/glogr)
+- **k8s.io/klog** (for Kubernetes): [klogr](https://git.k8s.io/klog/klogr)
+- **a testing.T** (with klog-like text output): [ktesting](https://git.k8s.io/klog/ktesting)
+- **go.uber.org/zap**: [zapr](https://github.com/go-logr/zapr)
+- **log** (the Go standard library logger): [stdr](https://github.com/go-logr/stdr)
+- **github.com/sirupsen/logrus**: [logrusr](https://github.com/bombsimon/logrusr)
+- **github.com/wojas/genericr**: [genericr](https://github.com/wojas/genericr) (makes it easy to implement your own backend)
+- **logfmt** (Heroku style [logging](https://www.brandur.org/logfmt)): [logfmtr](https://github.com/iand/logfmtr)
+- **github.com/rs/zerolog**: [zerologr](https://github.com/go-logr/zerologr)
+- **github.com/go-kit/log**: [gokitlogr](https://github.com/tonglil/gokitlogr) (also compatible with github.com/go-kit/kit/log since v0.12.0)
+- **bytes.Buffer** (writing to a buffer): [bufrlogr](https://github.com/tonglil/buflogr) (useful for ensuring values were logged, like during testing)
+
+## FAQ
+
+### Conceptual
+
+#### Why structured logging?
+
+- **Structured logs are more easily queryable**: Since you've got
+  key-value pairs, it's much easier to query your structured logs for
+  particular values by filtering on the contents of a particular key --
+  think searching request logs for error codes, Kubernetes reconcilers for
+  the name and namespace of the reconciled object, etc.
+
+- **Structured logging makes it easier to have cross-referenceable logs**:
+  Similarly to searchability, if you maintain conventions around your
+  keys, it becomes easy to gather all log lines related to a particular
+  concept.
+
+- **Structured logs allow better dimensions of filtering**: if you have
+  structure to your logs, you've got more precise control over how much
+  information is logged -- you might choose in a particular configuration
+  to log certain keys but not others, only log lines where a certain key
+  matches a certain value, etc., instead of just having v-levels and names
+  to key off of.
+
+- **Structured logs better represent structured data**: sometimes, the
+  data that you want to log is inherently structured (think tuple-link
+  objects.)  Structured logs allow you to preserve that structure when
+  outputting.
+
+#### Why V-levels?
+
+**V-levels give operators an easy way to control the chattiness of log
+operations**.  V-levels provide a way for a given package to distinguish
+the relative importance or verbosity of a given log message.  Then, if
+a particular logger or package is logging too many messages, the user
+of the package can simply change the v-levels for that library.
+
+#### Why not named levels, like Info/Warning/Error?
+
+Read [Dave Cheney's post][warning-makes-no-sense].  Then read [Differences
+from Dave's ideas](#differences-from-daves-ideas).
+
+#### Why not allow format strings, too?
+
+**Format strings negate many of the benefits of structured logs**:
+
+- They're not easily searchable without resorting to fuzzy searching,
+  regular expressions, etc.
+
+- They don't store structured data well, since contents are flattened into
+  a string.
+
+- They're not cross-referenceable.
+
+- They don't compress easily, since the message is not constant.
+
+(Unless you turn positional parameters into key-value pairs with numerical
+keys, at which point you've gotten key-value logging with meaningless
+keys.)
+
+### Practical
+
+#### Why key-value pairs, and not a map?
+
+Key-value pairs are *much* easier to optimize, especially around
+allocations.  Zap (a structured logger that inspired logr's interface) has
+[performance measurements](https://github.com/uber-go/zap#performance)
+that show this quite nicely.
+
+While the interface ends up being a little less obvious, you get
+potentially better performance, plus avoid making users type
+`map[string]string{}` every time they want to log.
+
+#### What if my V-levels differ between libraries?
+
+That's fine.  Control your V-levels on a per-logger basis, and use the
+`WithName` method to pass different loggers to different libraries.
+
+Generally, you should take care to ensure that you have relatively
+consistent V-levels within a given logger, however, as this makes deciding
+on what verbosity of logs to request easier.
+
+#### But I really want to use a format string!
+
+That's not actually a question.  Assuming your question is "how do
+I convert my mental model of logging with format strings to logging with
+constant messages":
+
+1. Figure out what the error actually is, as you'd write in a TL;DR style,
+   and use that as a message.
+
+2. For every place you'd write a format specifier, look to the word before
+   it, and add that as a key value pair.
+
+For instance, consider the following examples (all taken from spots in the
+Kubernetes codebase):
+
+- `klog.V(4).Infof("Client is returning errors: code %v, error %v",
+  responseCode, err)` becomes `logger.Error(err, "client returned an
+  error", "code", responseCode)`
+
+- `klog.V(4).Infof("Got a Retry-After %ds response for attempt %d to %v",
+  seconds, retries, url)` becomes `logger.V(4).Info("got a retry-after
+  response when requesting url", "attempt", retries, "after
+  seconds", seconds, "url", url)`
+
+If you *really* must use a format string, use it in a key's value, and
+call `fmt.Sprintf` yourself.  For instance: `log.Printf("unable to
+reflect over type %T")` becomes `logger.Info("unable to reflect over
+type", "type", fmt.Sprintf("%T"))`.  In general though, the cases where
+this is necessary should be few and far between.
+
+#### How do I choose my V-levels?
+
+This is basically the only hard constraint: increase V-levels to denote
+more verbose or more debug-y logs.
+
+Otherwise, you can start out with `0` as "you always want to see this",
+`1` as "common logging that you might *possibly* want to turn off", and
+`10` as "I would like to performance-test your log collection stack."
+
+Then gradually choose levels in between as you need them, working your way
+down from 10 (for debug and trace style logs) and up from 1 (for chattier
+info-type logs.)
+
+#### How do I choose my keys?
+
+Keys are fairly flexible, and can hold more or less any string
+value. For best compatibility with implementations and consistency
+with existing code in other projects, there are a few conventions you
+should consider.
+
+- Make your keys human-readable.
+- Constant keys are generally a good idea.
+- Be consistent across your codebase.
+- Keys should naturally match parts of the message string.
+- Use lower case for simple keys and
+  [lowerCamelCase](https://en.wiktionary.org/wiki/lowerCamelCase) for
+  more complex ones. Kubernetes is one example of a project that has
+  [adopted that
+  convention](https://github.com/kubernetes/community/blob/HEAD/contributors/devel/sig-instrumentation/migration-to-structured-logging.md#name-arguments).
+
+While key names are mostly unrestricted (and spaces are acceptable),
+it's generally a good idea to stick to printable ascii characters, or at
+least match the general character set of your log lines.
+
+#### Why should keys be constant values?
+
+The point of structured logging is to make later log processing easier.  Your
+keys are, effectively, the schema of each log message.  If you use different
+keys across instances of the same log line, you will make your structured logs
+much harder to use.  `Sprintf()` is for values, not for keys!
+
+#### Why is this not a pure interface?
+
+The Logger type is implemented as a struct in order to allow the Go compiler to
+optimize things like high-V `Info` logs that are not triggered.  Not all of
+these implementations are implemented yet, but this structure was suggested as
+a way to ensure they *can* be implemented.  All of the real work is behind the
+`LogSink` interface.
+
+[warning-makes-no-sense]: http://dave.cheney.net/2015/11/05/lets-talk-about-logging
diff --git a/vendor/github.com/go-logr/logr/discard.go b/vendor/github.com/go-logr/logr/discard.go
new file mode 100644
index 0000000000..99fe8be93c
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/discard.go
@@ -0,0 +1,24 @@
+/*
+Copyright 2020 The logr Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package logr
+
+// Discard returns a Logger that discards all messages logged to it.  It can be
+// used whenever the caller is not interested in the logs.  Logger instances
+// produced by this function always compare as equal.
+func Discard() Logger {
+	return New(nil)
+}
diff --git a/vendor/github.com/go-logr/logr/funcr/funcr.go b/vendor/github.com/go-logr/logr/funcr/funcr.go
new file mode 100644
index 0000000000..e52f0cd01e
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/funcr/funcr.go
@@ -0,0 +1,804 @@
+/*
+Copyright 2021 The logr Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package funcr implements formatting of structured log messages and
+// optionally captures the call site and timestamp.
+//
+// The simplest way to use it is via its implementation of a
+// github.com/go-logr/logr.LogSink with output through an arbitrary
+// "write" function.  See New and NewJSON for details.
+//
+// # Custom LogSinks
+//
+// For users who need more control, a funcr.Formatter can be embedded inside
+// your own custom LogSink implementation. This is useful when the LogSink
+// needs to implement additional methods, for example.
+//
+// # Formatting
+//
+// This will respect logr.Marshaler, fmt.Stringer, and error interfaces for
+// values which are being logged.  When rendering a struct, funcr will use Go's
+// standard JSON tags (all except "string").
+package funcr
+
+import (
+	"bytes"
+	"encoding"
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-logr/logr"
+)
+
+// New returns a logr.Logger which is implemented by an arbitrary function.
+func New(fn func(prefix, args string), opts Options) logr.Logger {
+	return logr.New(newSink(fn, NewFormatter(opts)))
+}
+
+// NewJSON returns a logr.Logger which is implemented by an arbitrary function
+// and produces JSON output.
+func NewJSON(fn func(obj string), opts Options) logr.Logger {
+	fnWrapper := func(_, obj string) {
+		fn(obj)
+	}
+	return logr.New(newSink(fnWrapper, NewFormatterJSON(opts)))
+}
+
+// Underlier exposes access to the underlying logging function. Since
+// callers only have a logr.Logger, they have to know which
+// implementation is in use, so this interface is less of an
+// abstraction and more of a way to test type conversion.
+type Underlier interface {
+	GetUnderlying() func(prefix, args string)
+}
+
+func newSink(fn func(prefix, args string), formatter Formatter) logr.LogSink {
+	l := &fnlogger{
+		Formatter: formatter,
+		write:     fn,
+	}
+	// For skipping fnlogger.Info and fnlogger.Error.
+	l.Formatter.AddCallDepth(1)
+	return l
+}
+
+// Options carries parameters which influence the way logs are generated.
+type Options struct {
+	// LogCaller tells funcr to add a "caller" key to some or all log lines.
+	// This has some overhead, so some users might not want it.
+	LogCaller MessageClass
+
+	// LogCallerFunc tells funcr to also log the calling function name.  This
+	// has no effect if caller logging is not enabled (see Options.LogCaller).
+	LogCallerFunc bool
+
+	// LogTimestamp tells funcr to add a "ts" key to log lines.  This has some
+	// overhead, so some users might not want it.
+	LogTimestamp bool
+
+	// TimestampFormat tells funcr how to render timestamps when LogTimestamp
+	// is enabled.  If not specified, a default format will be used.  For more
+	// details, see docs for Go's time.Layout.
+	TimestampFormat string
+
+	// Verbosity tells funcr which V logs to produce.  Higher values enable
+	// more logs.  Info logs at or below this level will be written, while logs
+	// above this level will be discarded.
+	Verbosity int
+
+	// RenderBuiltinsHook allows users to mutate the list of key-value pairs
+	// while a log line is being rendered.  The kvList argument follows logr
+	// conventions - each pair of slice elements is comprised of a string key
+	// and an arbitrary value (verified and sanitized before calling this
+	// hook).  The value returned must follow the same conventions.  This hook
+	// can be used to audit or modify logged data.  For example, you might want
+	// to prefix all of funcr's built-in keys with some string.  This hook is
+	// only called for built-in (provided by funcr itself) key-value pairs.
+	// Equivalent hooks are offered for key-value pairs saved via
+	// logr.Logger.WithValues or Formatter.AddValues (see RenderValuesHook) and
+	// for user-provided pairs (see RenderArgsHook).
+	RenderBuiltinsHook func(kvList []interface{}) []interface{}
+
+	// RenderValuesHook is the same as RenderBuiltinsHook, except that it is
+	// only called for key-value pairs saved via logr.Logger.WithValues.  See
+	// RenderBuiltinsHook for more details.
+	RenderValuesHook func(kvList []interface{}) []interface{}
+
+	// RenderArgsHook is the same as RenderBuiltinsHook, except that it is only
+	// called for key-value pairs passed directly to Info and Error.  See
+	// RenderBuiltinsHook for more details.
+	RenderArgsHook func(kvList []interface{}) []interface{}
+
+	// MaxLogDepth tells funcr how many levels of nested fields (e.g. a struct
+	// that contains a struct, etc.) it may log.  Every time it finds a struct,
+	// slice, array, or map the depth is increased by one.  When the maximum is
+	// reached, the value will be converted to a string indicating that the max
+	// depth has been exceeded.  If this field is not specified, a default
+	// value will be used.
+	MaxLogDepth int
+}
+
+// MessageClass indicates which category or categories of messages to consider.
+type MessageClass int
+
+const (
+	// None ignores all message classes.
+	None MessageClass = iota
+	// All considers all message classes.
+	All
+	// Info only considers info messages.
+	Info
+	// Error only considers error messages.
+	Error
+)
+
+// fnlogger inherits some of its LogSink implementation from Formatter
+// and just needs to add some glue code.
+type fnlogger struct {
+	Formatter
+	write func(prefix, args string)
+}
+
+func (l fnlogger) WithName(name string) logr.LogSink {
+	l.Formatter.AddName(name)
+	return &l
+}
+
+func (l fnlogger) WithValues(kvList ...interface{}) logr.LogSink {
+	l.Formatter.AddValues(kvList)
+	return &l
+}
+
+func (l fnlogger) WithCallDepth(depth int) logr.LogSink {
+	l.Formatter.AddCallDepth(depth)
+	return &l
+}
+
+func (l fnlogger) Info(level int, msg string, kvList ...interface{}) {
+	prefix, args := l.FormatInfo(level, msg, kvList)
+	l.write(prefix, args)
+}
+
+func (l fnlogger) Error(err error, msg string, kvList ...interface{}) {
+	prefix, args := l.FormatError(err, msg, kvList)
+	l.write(prefix, args)
+}
+
+func (l fnlogger) GetUnderlying() func(prefix, args string) {
+	return l.write
+}
+
+// Assert conformance to the interfaces.
+var _ logr.LogSink = &fnlogger{}
+var _ logr.CallDepthLogSink = &fnlogger{}
+var _ Underlier = &fnlogger{}
+
+// NewFormatter constructs a Formatter which emits a JSON-like key=value format.
+func NewFormatter(opts Options) Formatter {
+	return newFormatter(opts, outputKeyValue)
+}
+
+// NewFormatterJSON constructs a Formatter which emits strict JSON.
+func NewFormatterJSON(opts Options) Formatter {
+	return newFormatter(opts, outputJSON)
+}
+
+// Defaults for Options.
+const defaultTimestampFormat = "2006-01-02 15:04:05.000000"
+const defaultMaxLogDepth = 16
+
+func newFormatter(opts Options, outfmt outputFormat) Formatter {
+	if opts.TimestampFormat == "" {
+		opts.TimestampFormat = defaultTimestampFormat
+	}
+	if opts.MaxLogDepth == 0 {
+		opts.MaxLogDepth = defaultMaxLogDepth
+	}
+	f := Formatter{
+		outputFormat: outfmt,
+		prefix:       "",
+		values:       nil,
+		depth:        0,
+		opts:         &opts,
+	}
+	return f
+}
+
+// Formatter is an opaque struct which can be embedded in a LogSink
+// implementation. It should be constructed with NewFormatter. Some of
+// its methods directly implement logr.LogSink.
+type Formatter struct {
+	outputFormat outputFormat
+	prefix       string
+	values       []interface{}
+	valuesStr    string
+	depth        int
+	opts         *Options
+}
+
+// outputFormat indicates which outputFormat to use.
+type outputFormat int
+
+const (
+	// outputKeyValue emits a JSON-like key=value format, but not strict JSON.
+	outputKeyValue outputFormat = iota
+	// outputJSON emits strict JSON.
+	outputJSON
+)
+
+// PseudoStruct is a list of key-value pairs that gets logged as a struct.
+type PseudoStruct []interface{}
+
+// render produces a log line, ready to use.
+func (f Formatter) render(builtins, args []interface{}) string {
+	// Empirically bytes.Buffer is faster than strings.Builder for this.
+	buf := bytes.NewBuffer(make([]byte, 0, 1024))
+	if f.outputFormat == outputJSON {
+		buf.WriteByte('{')
+	}
+	vals := builtins
+	if hook := f.opts.RenderBuiltinsHook; hook != nil {
+		vals = hook(f.sanitize(vals))
+	}
+	f.flatten(buf, vals, false, false) // keys are ours, no need to escape
+	continuing := len(builtins) > 0
+	if len(f.valuesStr) > 0 {
+		if continuing {
+			if f.outputFormat == outputJSON {
+				buf.WriteByte(',')
+			} else {
+				buf.WriteByte(' ')
+			}
+		}
+		continuing = true
+		buf.WriteString(f.valuesStr)
+	}
+	vals = args
+	if hook := f.opts.RenderArgsHook; hook != nil {
+		vals = hook(f.sanitize(vals))
+	}
+	f.flatten(buf, vals, continuing, true) // escape user-provided keys
+	if f.outputFormat == outputJSON {
+		buf.WriteByte('}')
+	}
+	return buf.String()
+}
+
+// flatten renders a list of key-value pairs into a buffer.  If continuing is
+// true, it assumes that the buffer has previous values and will emit a
+// separator (which depends on the output format) before the first pair it
+// writes.  If escapeKeys is true, the keys are assumed to have
+// non-JSON-compatible characters in them and must be evaluated for escapes.
+//
+// This function returns a potentially modified version of kvList, which
+// ensures that there is a value for every key (adding a value if needed) and
+// that each key is a string (substituting a key if needed).
+func (f Formatter) flatten(buf *bytes.Buffer, kvList []interface{}, continuing bool, escapeKeys bool) []interface{} {
+	// This logic overlaps with sanitize() but saves one type-cast per key,
+	// which can be measurable.
+	if len(kvList)%2 != 0 {
+		kvList = append(kvList, noValue)
+	}
+	for i := 0; i < len(kvList); i += 2 {
+		k, ok := kvList[i].(string)
+		if !ok {
+			k = f.nonStringKey(kvList[i])
+			kvList[i] = k
+		}
+		v := kvList[i+1]
+
+		if i > 0 || continuing {
+			if f.outputFormat == outputJSON {
+				buf.WriteByte(',')
+			} else {
+				// In theory the format could be something we don't understand.  In
+				// practice, we control it, so it won't be.
+				buf.WriteByte(' ')
+			}
+		}
+
+		if escapeKeys {
+			buf.WriteString(prettyString(k))
+		} else {
+			// this is faster
+			buf.WriteByte('"')
+			buf.WriteString(k)
+			buf.WriteByte('"')
+		}
+		if f.outputFormat == outputJSON {
+			buf.WriteByte(':')
+		} else {
+			buf.WriteByte('=')
+		}
+		buf.WriteString(f.pretty(v))
+	}
+	return kvList
+}
+
+func (f Formatter) pretty(value interface{}) string {
+	return f.prettyWithFlags(value, 0, 0)
+}
+
+const (
+	flagRawStruct = 0x1 // do not print braces on structs
+)
+
+// TODO: This is not fast. Most of the overhead goes here.
+func (f Formatter) prettyWithFlags(value interface{}, flags uint32, depth int) string {
+	if depth > f.opts.MaxLogDepth {
+		return `"<max-log-depth-exceeded>"`
+	}
+
+	// Handle types that take full control of logging.
+	if v, ok := value.(logr.Marshaler); ok {
+		// Replace the value with what the type wants to get logged.
+		// That then gets handled below via reflection.
+		value = invokeMarshaler(v)
+	}
+
+	// Handle types that want to format themselves.
+	switch v := value.(type) {
+	case fmt.Stringer:
+		value = invokeStringer(v)
+	case error:
+		value = invokeError(v)
+	}
+
+	// Handling the most common types without reflect is a small perf win.
+	switch v := value.(type) {
+	case bool:
+		return strconv.FormatBool(v)
+	case string:
+		return prettyString(v)
+	case int:
+		return strconv.FormatInt(int64(v), 10)
+	case int8:
+		return strconv.FormatInt(int64(v), 10)
+	case int16:
+		return strconv.FormatInt(int64(v), 10)
+	case int32:
+		return strconv.FormatInt(int64(v), 10)
+	case int64:
+		return strconv.FormatInt(int64(v), 10)
+	case uint:
+		return strconv.FormatUint(uint64(v), 10)
+	case uint8:
+		return strconv.FormatUint(uint64(v), 10)
+	case uint16:
+		return strconv.FormatUint(uint64(v), 10)
+	case uint32:
+		return strconv.FormatUint(uint64(v), 10)
+	case uint64:
+		return strconv.FormatUint(v, 10)
+	case uintptr:
+		return strconv.FormatUint(uint64(v), 10)
+	case float32:
+		return strconv.FormatFloat(float64(v), 'f', -1, 32)
+	case float64:
+		return strconv.FormatFloat(v, 'f', -1, 64)
+	case complex64:
+		return `"` + strconv.FormatComplex(complex128(v), 'f', -1, 64) + `"`
+	case complex128:
+		return `"` + strconv.FormatComplex(v, 'f', -1, 128) + `"`
+	case PseudoStruct:
+		buf := bytes.NewBuffer(make([]byte, 0, 1024))
+		v = f.sanitize(v)
+		if flags&flagRawStruct == 0 {
+			buf.WriteByte('{')
+		}
+		for i := 0; i < len(v); i += 2 {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			k, _ := v[i].(string) // sanitize() above means no need to check success
+			// arbitrary keys might need escaping
+			buf.WriteString(prettyString(k))
+			buf.WriteByte(':')
+			buf.WriteString(f.prettyWithFlags(v[i+1], 0, depth+1))
+		}
+		if flags&flagRawStruct == 0 {
+			buf.WriteByte('}')
+		}
+		return buf.String()
+	}
+
+	buf := bytes.NewBuffer(make([]byte, 0, 256))
+	t := reflect.TypeOf(value)
+	if t == nil {
+		return "null"
+	}
+	v := reflect.ValueOf(value)
+	switch t.Kind() {
+	case reflect.Bool:
+		return strconv.FormatBool(v.Bool())
+	case reflect.String:
+		return prettyString(v.String())
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return strconv.FormatInt(int64(v.Int()), 10)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return strconv.FormatUint(uint64(v.Uint()), 10)
+	case reflect.Float32:
+		return strconv.FormatFloat(float64(v.Float()), 'f', -1, 32)
+	case reflect.Float64:
+		return strconv.FormatFloat(v.Float(), 'f', -1, 64)
+	case reflect.Complex64:
+		return `"` + strconv.FormatComplex(complex128(v.Complex()), 'f', -1, 64) + `"`
+	case reflect.Complex128:
+		return `"` + strconv.FormatComplex(v.Complex(), 'f', -1, 128) + `"`
+	case reflect.Struct:
+		if flags&flagRawStruct == 0 {
+			buf.WriteByte('{')
+		}
+		printComma := false // testing i>0 is not enough because of JSON omitted fields
+		for i := 0; i < t.NumField(); i++ {
+			fld := t.Field(i)
+			if fld.PkgPath != "" {
+				// reflect says this field is only defined for non-exported fields.
+				continue
+			}
+			if !v.Field(i).CanInterface() {
+				// reflect isn't clear exactly what this means, but we can't use it.
+				continue
+			}
+			name := ""
+			omitempty := false
+			if tag, found := fld.Tag.Lookup("json"); found {
+				if tag == "-" {
+					continue
+				}
+				if comma := strings.Index(tag, ","); comma != -1 {
+					if n := tag[:comma]; n != "" {
+						name = n
+					}
+					rest := tag[comma:]
+					if strings.Contains(rest, ",omitempty,") || strings.HasSuffix(rest, ",omitempty") {
+						omitempty = true
+					}
+				} else {
+					name = tag
+				}
+			}
+			if omitempty && isEmpty(v.Field(i)) {
+				continue
+			}
+			if printComma {
+				buf.WriteByte(',')
+			}
+			printComma = true // if we got here, we are rendering a field
+			if fld.Anonymous && fld.Type.Kind() == reflect.Struct && name == "" {
+				buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), flags|flagRawStruct, depth+1))
+				continue
+			}
+			if name == "" {
+				name = fld.Name
+			}
+			// field names can't contain characters which need escaping
+			buf.WriteByte('"')
+			buf.WriteString(name)
+			buf.WriteByte('"')
+			buf.WriteByte(':')
+			buf.WriteString(f.prettyWithFlags(v.Field(i).Interface(), 0, depth+1))
+		}
+		if flags&flagRawStruct == 0 {
+			buf.WriteByte('}')
+		}
+		return buf.String()
+	case reflect.Slice, reflect.Array:
+		// If this is outputing as JSON make sure this isn't really a json.RawMessage.
+		// If so just emit "as-is" and don't pretty it as that will just print
+		// it as [X,Y,Z,...] which isn't terribly useful vs the string form you really want.
+		if f.outputFormat == outputJSON {
+			if rm, ok := value.(json.RawMessage); ok {
+				// If it's empty make sure we emit an empty value as the array style would below.
+				if len(rm) > 0 {
+					buf.Write(rm)
+				} else {
+					buf.WriteString("null")
+				}
+				return buf.String()
+			}
+		}
+		buf.WriteByte('[')
+		for i := 0; i < v.Len(); i++ {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			e := v.Index(i)
+			buf.WriteString(f.prettyWithFlags(e.Interface(), 0, depth+1))
+		}
+		buf.WriteByte(']')
+		return buf.String()
+	case reflect.Map:
+		buf.WriteByte('{')
+		// This does not sort the map keys, for best perf.
+		it := v.MapRange()
+		i := 0
+		for it.Next() {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			// If a map key supports TextMarshaler, use it.
+			keystr := ""
+			if m, ok := it.Key().Interface().(encoding.TextMarshaler); ok {
+				txt, err := m.MarshalText()
+				if err != nil {
+					keystr = fmt.Sprintf("<error-MarshalText: %s>", err.Error())
+				} else {
+					keystr = string(txt)
+				}
+				keystr = prettyString(keystr)
+			} else {
+				// prettyWithFlags will produce already-escaped values
+				keystr = f.prettyWithFlags(it.Key().Interface(), 0, depth+1)
+				if t.Key().Kind() != reflect.String {
+					// JSON only does string keys.  Unlike Go's standard JSON, we'll
+					// convert just about anything to a string.
+					keystr = prettyString(keystr)
+				}
+			}
+			buf.WriteString(keystr)
+			buf.WriteByte(':')
+			buf.WriteString(f.prettyWithFlags(it.Value().Interface(), 0, depth+1))
+			i++
+		}
+		buf.WriteByte('}')
+		return buf.String()
+	case reflect.Ptr, reflect.Interface:
+		if v.IsNil() {
+			return "null"
+		}
+		return f.prettyWithFlags(v.Elem().Interface(), 0, depth)
+	}
+	return fmt.Sprintf(`"<unhandled-%s>"`, t.Kind().String())
+}
+
+func prettyString(s string) string {
+	// Avoid escaping (which does allocations) if we can.
+	if needsEscape(s) {
+		return strconv.Quote(s)
+	}
+	b := bytes.NewBuffer(make([]byte, 0, 1024))
+	b.WriteByte('"')
+	b.WriteString(s)
+	b.WriteByte('"')
+	return b.String()
+}
+
+// needsEscape determines whether the input string needs to be escaped or not,
+// without doing any allocations.
+func needsEscape(s string) bool {
+	for _, r := range s {
+		if !strconv.IsPrint(r) || r == '\\' || r == '"' {
+			return true
+		}
+	}
+	return false
+}
+
+func isEmpty(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Array, reflect.Map, reflect.Slice, reflect.String:
+		return v.Len() == 0
+	case reflect.Bool:
+		return !v.Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return v.Uint() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.Complex64, reflect.Complex128:
+		return v.Complex() == 0
+	case reflect.Interface, reflect.Ptr:
+		return v.IsNil()
+	}
+	return false
+}
+
+func invokeMarshaler(m logr.Marshaler) (ret interface{}) {
+	defer func() {
+		if r := recover(); r != nil {
+			ret = fmt.Sprintf("<panic: %s>", r)
+		}
+	}()
+	return m.MarshalLog()
+}
+
+func invokeStringer(s fmt.Stringer) (ret string) {
+	defer func() {
+		if r := recover(); r != nil {
+			ret = fmt.Sprintf("<panic: %s>", r)
+		}
+	}()
+	return s.String()
+}
+
+func invokeError(e error) (ret string) {
+	defer func() {
+		if r := recover(); r != nil {
+			ret = fmt.Sprintf("<panic: %s>", r)
+		}
+	}()
+	return e.Error()
+}
+
+// Caller represents the original call site for a log line, after considering
+// logr.Logger.WithCallDepth and logr.Logger.WithCallStackHelper.  The File and
+// Line fields will always be provided, while the Func field is optional.
+// Users can set the render hook fields in Options to examine logged key-value
+// pairs, one of which will be {"caller", Caller} if the Options.LogCaller
+// field is enabled for the given MessageClass.
+type Caller struct {
+	// File is the basename of the file for this call site.
+	File string `json:"file"`
+	// Line is the line number in the file for this call site.
+	Line int `json:"line"`
+	// Func is the function name for this call site, or empty if
+	// Options.LogCallerFunc is not enabled.
+	Func string `json:"function,omitempty"`
+}
+
+func (f Formatter) caller() Caller {
+	// +1 for this frame, +1 for Info/Error.
+	pc, file, line, ok := runtime.Caller(f.depth + 2)
+	if !ok {
+		return Caller{"<unknown>", 0, ""}
+	}
+	fn := ""
+	if f.opts.LogCallerFunc {
+		if fp := runtime.FuncForPC(pc); fp != nil {
+			fn = fp.Name()
+		}
+	}
+
+	return Caller{filepath.Base(file), line, fn}
+}
+
+const noValue = "<no-value>"
+
+func (f Formatter) nonStringKey(v interface{}) string {
+	return fmt.Sprintf("<non-string-key: %s>", f.snippet(v))
+}
+
+// snippet produces a short snippet string of an arbitrary value.
+func (f Formatter) snippet(v interface{}) string {
+	const snipLen = 16
+
+	snip := f.pretty(v)
+	if len(snip) > snipLen {
+		snip = snip[:snipLen]
+	}
+	return snip
+}
+
+// sanitize ensures that a list of key-value pairs has a value for every key
+// (adding a value if needed) and that each key is a string (substituting a key
+// if needed).
+func (f Formatter) sanitize(kvList []interface{}) []interface{} {
+	if len(kvList)%2 != 0 {
+		kvList = append(kvList, noValue)
+	}
+	for i := 0; i < len(kvList); i += 2 {
+		_, ok := kvList[i].(string)
+		if !ok {
+			kvList[i] = f.nonStringKey(kvList[i])
+		}
+	}
+	return kvList
+}
+
+// Init configures this Formatter from runtime info, such as the call depth
+// imposed by logr itself.
+// Note that this receiver is a pointer, so depth can be saved.
+func (f *Formatter) Init(info logr.RuntimeInfo) {
+	f.depth += info.CallDepth
+}
+
+// Enabled checks whether an info message at the given level should be logged.
+func (f Formatter) Enabled(level int) bool {
+	return level <= f.opts.Verbosity
+}
+
+// GetDepth returns the current depth of this Formatter.  This is useful for
+// implementations which do their own caller attribution.
+func (f Formatter) GetDepth() int {
+	return f.depth
+}
+
+// FormatInfo renders an Info log message into strings.  The prefix will be
+// empty when no names were set (via AddNames), or when the output is
+// configured for JSON.
+func (f Formatter) FormatInfo(level int, msg string, kvList []interface{}) (prefix, argsStr string) {
+	args := make([]interface{}, 0, 64) // using a constant here impacts perf
+	prefix = f.prefix
+	if f.outputFormat == outputJSON {
+		args = append(args, "logger", prefix)
+		prefix = ""
+	}
+	if f.opts.LogTimestamp {
+		args = append(args, "ts", time.Now().Format(f.opts.TimestampFormat))
+	}
+	if policy := f.opts.LogCaller; policy == All || policy == Info {
+		args = append(args, "caller", f.caller())
+	}
+	args = append(args, "level", level, "msg", msg)
+	return prefix, f.render(args, kvList)
+}
+
+// FormatError renders an Error log message into strings.  The prefix will be
+// empty when no names were set (via AddNames),  or when the output is
+// configured for JSON.
+func (f Formatter) FormatError(err error, msg string, kvList []interface{}) (prefix, argsStr string) {
+	args := make([]interface{}, 0, 64) // using a constant here impacts perf
+	prefix = f.prefix
+	if f.outputFormat == outputJSON {
+		args = append(args, "logger", prefix)
+		prefix = ""
+	}
+	if f.opts.LogTimestamp {
+		args = append(args, "ts", time.Now().Format(f.opts.TimestampFormat))
+	}
+	if policy := f.opts.LogCaller; policy == All || policy == Error {
+		args = append(args, "caller", f.caller())
+	}
+	args = append(args, "msg", msg)
+	var loggableErr interface{}
+	if err != nil {
+		loggableErr = err.Error()
+	}
+	args = append(args, "error", loggableErr)
+	return f.prefix, f.render(args, kvList)
+}
+
+// AddName appends the specified name.  funcr uses '/' characters to separate
+// name elements.  Callers should not pass '/' in the provided name string, but
+// this library does not actually enforce that.
+func (f *Formatter) AddName(name string) {
+	if len(f.prefix) > 0 {
+		f.prefix += "/"
+	}
+	f.prefix += name
+}
+
+// AddValues adds key-value pairs to the set of saved values to be logged with
+// each log line.
+func (f *Formatter) AddValues(kvList []interface{}) {
+	// Three slice args forces a copy.
+	n := len(f.values)
+	f.values = append(f.values[:n:n], kvList...)
+
+	vals := f.values
+	if hook := f.opts.RenderValuesHook; hook != nil {
+		vals = hook(f.sanitize(vals))
+	}
+
+	// Pre-render values, so we don't have to do it on each Info/Error call.
+	buf := bytes.NewBuffer(make([]byte, 0, 1024))
+	f.flatten(buf, vals, false, true) // escape user-provided keys
+	f.valuesStr = buf.String()
+}
+
+// AddCallDepth increases the number of stack-frames to skip when attributing
+// the log line to a file and line.
+func (f *Formatter) AddCallDepth(depth int) {
+	f.depth += depth
+}
diff --git a/vendor/github.com/go-logr/logr/logr.go b/vendor/github.com/go-logr/logr/logr.go
new file mode 100644
index 0000000000..e027aea3fd
--- /dev/null
+++ b/vendor/github.com/go-logr/logr/logr.go
@@ -0,0 +1,550 @@
+/*
+Copyright 2019 The logr Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// This design derives from Dave Cheney's blog:
+//     http://dave.cheney.net/2015/11/05/lets-talk-about-logging
+
+// Package logr defines a general-purpose logging API and abstract interfaces
+// to back that API.  Packages in the Go ecosystem can depend on this package,
+// while callers can implement logging with whatever backend is appropriate.
+//
+// # Usage
+//
+// Logging is done using a Logger instance.  Logger is a concrete type with
+// methods, which defers the actual logging to a LogSink interface.  The main
+// methods of Logger are Info() and Error().  Arguments to Info() and Error()
+// are key/value pairs rather than printf-style formatted strings, emphasizing
+// "structured logging".
+//
+// With Go's standard log package, we might write:
+//
+//	log.Printf("setting target value %s", targetValue)
+//
+// With logr's structured logging, we'd write:
+//
+//	logger.Info("setting target", "value", targetValue)
+//
+// Errors are much the same.  Instead of:
+//
+//	log.Printf("failed to open the pod bay door for user %s: %v", user, err)
+//
+// We'd write:
+//
+//	logger.Error(err, "failed to open the pod bay door", "user", user)
+//
+// Info() and Error() are very similar, but they are separate methods so that
+// LogSink implementations can choose to do things like attach additional
+// information (such as stack traces) on calls to Error(). Error() messages are
+// always logged, regardless of the current verbosity.  If there is no error
+// instance available, passing nil is valid.
+//
+// # Verbosity
+//
+// Often we want to log information only when the application in "verbose
+// mode".  To write log lines that are more verbose, Logger has a V() method.
+// The higher the V-level of a log line, the less critical it is considered.
+// Log-lines with V-levels that are not enabled (as per the LogSink) will not
+// be written.  Level V(0) is the default, and logger.V(0).Info() has the same
+// meaning as logger.Info().  Negative V-levels have the same meaning as V(0).
+// Error messages do not have a verbosity level and are always logged.
+//
+// Where we might have written:
+//
+//	if flVerbose >= 2 {
+//	    log.Printf("an unusual thing happened")
+//	}
+//
+// We can write:
+//
+//	logger.V(2).Info("an unusual thing happened")
+//
+// # Logger Names
+//
+// Logger instances can have name strings so that all messages logged through
+// that instance have additional context.  For example, you might want to add
+// a subsystem name:
+//
+//	logger.WithName("compactor").Info("started", "time", time.Now())
+//
+// The WithName() method returns a new Logger, which can be passed to
+// constructors or other functions for further use.  Repeated use of WithName()
+// will accumulate name "segments".  These name segments will be joined in some
+// way by the LogSink implementation.  It is strongly recommended that name
+// segments contain simple identifiers (letters, digits, and hyphen), and do
+// not contain characters that could muddle the log output or confuse the
+// joining operation (e.g. whitespace, commas, periods, slashes, brackets,
+// quotes, etc).
+//
+// # Saved Values
+//
+// Logger instances can store any number of key/value pairs, which will be
+// logged alongside all messages logged through that instance.  For example,
+// you might want to create a Logger instance per managed object:
+//
+// With the standard log package, we might write:
+//
+//	log.Printf("decided to set field foo to value %q for object %s/%s",
+//	    targetValue, object.Namespace, object.Name)
+//
+// With logr we'd write:
+//
+//	// Elsewhere: set up the logger to log the object name.
+//	obj.logger = mainLogger.WithValues(
+//	    "name", obj.name, "namespace", obj.namespace)
+//
+//	// later on...
+//	obj.logger.Info("setting foo", "value", targetValue)
+//
+// # Best Practices
+//
+// Logger has very few hard rules, with the goal that LogSink implementations
+// might have a lot of freedom to differentiate.  There are, however, some
+// things to consider.
+//
+// The log message consists of a constant message attached to the log line.
+// This should generally be a simple description of what's occurring, and should
+// never be a format string.  Variable information can then be attached using
+// named values.
+//
+// Keys are arbitrary strings, but should generally be constant values.  Values
+// may be any Go value, but how the value is formatted is determined by the
+// LogSink implementation.
+//
+// Logger instances are meant to be passed around by value. Code that receives
+// such a value can call its methods without having to check whether the
+// instance is ready for use.
+//
+// Calling methods with the null logger (Logger{}) as instance will crash
+// because it has no LogSink. Therefore this null logger should never be passed
+// around. For cases where passing a logger is optional, a pointer to Logger
+// should be used.
+//
+// # Key Naming Conventions
+//
+// Keys are not strictly required to conform to any specification or regex, but
+// it is recommended that they:
+//   - be human-readable and meaningful (not auto-generated or simple ordinals)
+//   - be constant (not dependent on input data)
+//   - contain only printable characters
+//   - not contain whitespace or punctuation
+//   - use lower case for simple keys and lowerCamelCase for more complex ones
+//
+// These guidelines help ensure that log data is processed properly regardless
+// of the log implementation.  For example, log implementations will try to
+// output JSON data or will store data for later database (e.g. SQL) queries.
+//
+// While users are generally free to use key names of their choice, it's
+// generally best to avoid using the following keys, as they're frequently used
+// by implementations:
+//   - "caller": the calling information (file/line) of a particular log line
+//   - "error": the underlying error value in the `Error` method
+//   - "level": the log level
+//   - "logger": the name of the associated logger
+//   - "msg": the log message
+//   - "stacktrace": the stack trace associated with a particular log line or
+//     error (often from the `Error` message)
+//   - "ts": the timestamp for a log line
+//
+// Implementations are encouraged to make use of these keys to represent the
+// above concepts, when necessary (for example, in a pure-JSON output form, it
+// would be necessary to represent at least message and timestamp as ordinary
+// named values).
+//
+// # Break Glass
+//
+// Implementations may choose to give callers access to the underlying
+// logging implementation.  The recommended pattern for this is:
+//
+//	// Underlier exposes access to the underlying logging implementation.
+//	// Since callers only have a logr.Logger, they have to know which
+//	// implementation is in use, so this interface is less of an abstraction
+//	// and more of way to test type conversion.
+//	type Underlier interface {
+//	    GetUnderlying() <underlying-type>
+//	}
+//
+// Logger grants access to the sink to enable type assertions like this:
+//
+//	func DoSomethingWithImpl(log logr.Logger) {
+//	    if underlier, ok := log.GetSink().(impl.Underlier); ok {
+//	       implLogger := underlier.GetUnderlying()
+//	       ...
+//	    }
+//	}
+//
+// Custom `With*` functions can be implemented by copying the complete
+// Logger struct and replacing the sink in the copy:
+//
+//	// WithFooBar changes the foobar parameter in the log sink and returns a
+//	// new logger with that modified sink.  It does nothing for loggers where
+//	// the sink doesn't support that parameter.
+//	func WithFoobar(log logr.Logger, foobar int) logr.Logger {
+//	   if foobarLogSink, ok := log.GetSink().(FoobarSink); ok {
+//	      log = log.WithSink(foobarLogSink.WithFooBar(foobar))
+//	   }
+//	   return log
+//	}
+//
+// Don't use New to construct a new Logger with a LogSink retrieved from an
+// existing Logger. Source code attribution might not work correctly and
+// unexported fields in Logger get lost.
+//
+// Beware that the same LogSink instance may be shared by different logger
+// instances. Calling functions that modify the LogSink will affect all of
+// those.
+package logr
+
+import (
+	"context"
+)
+
+// New returns a new Logger instance.  This is primarily used by libraries
+// implementing LogSink, rather than end users.  Passing a nil sink will create
+// a Logger which discards all log lines.
+func New(sink LogSink) Logger {
+	logger := Logger{}
+	logger.setSink(sink)
+	if sink != nil {
+		sink.Init(runtimeInfo)
+	}
+	return logger
+}
+
+// setSink stores the sink and updates any related fields. It mutates the
+// logger and thus is only safe to use for loggers that are not currently being
+// used concurrently.
+func (l *Logger) setSink(sink LogSink) {
+	l.sink = sink
+}
+
+// GetSink returns the stored sink.
+func (l Logger) GetSink() LogSink {
+	return l.sink
+}
+
+// WithSink returns a copy of the logger with the new sink.
+func (l Logger) WithSink(sink LogSink) Logger {
+	l.setSink(sink)
+	return l
+}
+
+// Logger is an interface to an abstract logging implementation.  This is a
+// concrete type for performance reasons, but all the real work is passed on to
+// a LogSink.  Implementations of LogSink should provide their own constructors
+// that return Logger, not LogSink.
+//
+// The underlying sink can be accessed through GetSink and be modified through
+// WithSink. This enables the implementation of custom extensions (see "Break
+// Glass" in the package documentation). Normally the sink should be used only
+// indirectly.
+type Logger struct {
+	sink  LogSink
+	level int
+}
+
+// Enabled tests whether this Logger is enabled.  For example, commandline
+// flags might be used to set the logging verbosity and disable some info logs.
+func (l Logger) Enabled() bool {
+	return l.sink != nil && l.sink.Enabled(l.level)
+}
+
+// Info logs a non-error message with the given key/value pairs as context.
+//
+// The msg argument should be used to add some constant description to the log
+// line.  The key/value pairs can then be used to add additional variable
+// information.  The key/value pairs must alternate string keys and arbitrary
+// values.
+func (l Logger) Info(msg string, keysAndValues ...interface{}) {
+	if l.sink == nil {
+		return
+	}
+	if l.Enabled() {
+		if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
+			withHelper.GetCallStackHelper()()
+		}
+		l.sink.Info(l.level, msg, keysAndValues...)
+	}
+}
+
+// Error logs an error, with the given message and key/value pairs as context.
+// It functions similarly to Info, but may have unique behavior, and should be
+// preferred for logging errors (see the package documentations for more
+// information). The log message will always be emitted, regardless of
+// verbosity level.
+//
+// The msg argument should be used to add context to any underlying error,
+// while the err argument should be used to attach the actual error that
+// triggered this log line, if present. The err parameter is optional
+// and nil may be passed instead of an error instance.
+func (l Logger) Error(err error, msg string, keysAndValues ...interface{}) {
+	if l.sink == nil {
+		return
+	}
+	if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
+		withHelper.GetCallStackHelper()()
+	}
+	l.sink.Error(err, msg, keysAndValues...)
+}
+
+// V returns a new Logger instance for a specific verbosity level, relative to
+// this Logger.  In other words, V-levels are additive.  A higher verbosity
+// level means a log message is less important.  Negative V-levels are treated
+// as 0.
+func (l Logger) V(level int) Logger {
+	if l.sink == nil {
+		return l
+	}
+	if level < 0 {
+		level = 0
+	}
+	l.level += level
+	return l
+}
+
+// WithValues returns a new Logger instance with additional key/value pairs.
+// See Info for documentation on how key/value pairs work.
+func (l Logger) WithValues(keysAndValues ...interface{}) Logger {
+	if l.sink == nil {
+		return l
+	}
+	l.setSink(l.sink.WithValues(keysAndValues...))
+	return l
+}
+
+// WithName returns a new Logger instance with the specified name element added
+// to the Logger's name.  Successive calls with WithName append additional
+// suffixes to the Logger's name.  It's strongly recommended that name segments
+// contain only letters, digits, and hyphens (see the package documentation for
+// more information).
+func (l Logger) WithName(name string) Logger {
+	if l.sink == nil {
+		return l
+	}
+	l.setSink(l.sink.WithName(name))
+	return l
+}
+
+// WithCallDepth returns a Logger instance that offsets the call stack by the
+// specified number of frames when logging call site information, if possible.
+// This is useful for users who have helper functions between the "real" call
+// site and the actual calls to Logger methods.  If depth is 0 the attribution
+// should be to the direct caller of this function.  If depth is 1 the
+// attribution should skip 1 call frame, and so on.  Successive calls to this
+// are additive.
+//
+// If the underlying log implementation supports a WithCallDepth(int) method,
+// it will be called and the result returned.  If the implementation does not
+// support CallDepthLogSink, the original Logger will be returned.
+//
+// To skip one level, WithCallStackHelper() should be used instead of
+// WithCallDepth(1) because it works with implementions that support the
+// CallDepthLogSink and/or CallStackHelperLogSink interfaces.
+func (l Logger) WithCallDepth(depth int) Logger {
+	if l.sink == nil {
+		return l
+	}
+	if withCallDepth, ok := l.sink.(CallDepthLogSink); ok {
+		l.setSink(withCallDepth.WithCallDepth(depth))
+	}
+	return l
+}
+
+// WithCallStackHelper returns a new Logger instance that skips the direct
+// caller when logging call site information, if possible.  This is useful for
+// users who have helper functions between the "real" call site and the actual
+// calls to Logger methods and want to support loggers which depend on marking
+// each individual helper function, like loggers based on testing.T.
+//
+// In addition to using that new logger instance, callers also must call the
+// returned function.
+//
+// If the underlying log implementation supports a WithCallDepth(int) method,
+// WithCallDepth(1) will be called to produce a new logger. If it supports a
+// WithCallStackHelper() method, that will be also called. If the
+// implementation does not support either of these, the original Logger will be
+// returned.
+func (l Logger) WithCallStackHelper() (func(), Logger) {
+	if l.sink == nil {
+		return func() {}, l
+	}
+	var helper func()
+	if withCallDepth, ok := l.sink.(CallDepthLogSink); ok {
+		l.setSink(withCallDepth.WithCallDepth(1))
+	}
+	if withHelper, ok := l.sink.(CallStackHelperLogSink); ok {
+		helper = withHelper.GetCallStackHelper()
+	} else {
+		helper = func() {}
+	}
+	return helper, l
+}
+
+// IsZero returns true if this logger is an uninitialized zero value
+func (l Logger) IsZero() bool {
+	return l.sink == nil
+}
+
+// contextKey is how we find Loggers in a context.Context.
+type contextKey struct{}
+
+// FromContext returns a Logger from ctx or an error if no Logger is found.
+func FromContext(ctx context.Context) (Logger, error) {
+	if v, ok := ctx.Value(contextKey{}).(Logger); ok {
+		return v, nil
+	}
+
+	return Logger{}, notFoundError{}
+}
+
+// notFoundError exists to carry an IsNotFound method.
+type notFoundError struct{}
+
+func (notFoundError) Error() string {
+	return "no logr.Logger was present"
+}
+
+func (notFoundError) IsNotFound() bool {
+	return true
+}
+
+// FromContextOrDiscard returns a Logger from ctx.  If no Logger is found, this
+// returns a Logger that discards all log messages.
+func FromContextOrDiscard(ctx context.Context) Logger {
+	if v, ok := ctx.Value(contextKey{}).(Logger); ok {
+		return v
+	}
+
+	return Discard()
+}
+
+// NewContext returns a new Context, derived from ctx, which carries the
+// provided Logger.
+func NewContext(ctx context.Context, logger Logger) context.Context {
+	return context.WithValue(ctx, contextKey{}, logger)
+}
+
+// RuntimeInfo holds information that the logr "core" library knows which
+// LogSinks might want to know.
+type RuntimeInfo struct {
+	// CallDepth is the number of call frames the logr library adds between the
+	// end-user and the LogSink.  LogSink implementations which choose to print
+	// the original logging site (e.g. file & line) should climb this many
+	// additional frames to find it.
+	CallDepth int
+}
+
+// runtimeInfo is a static global.  It must not be changed at run time.
+var runtimeInfo = RuntimeInfo{
+	CallDepth: 1,
+}
+
+// LogSink represents a logging implementation.  End-users will generally not
+// interact with this type.
+type LogSink interface {
+	// Init receives optional information about the logr library for LogSink
+	// implementations that need it.
+	Init(info RuntimeInfo)
+
+	// Enabled tests whether this LogSink is enabled at the specified V-level.
+	// For example, commandline flags might be used to set the logging
+	// verbosity and disable some info logs.
+	Enabled(level int) bool
+
+	// Info logs a non-error message with the given key/value pairs as context.
+	// The level argument is provided for optional logging.  This method will
+	// only be called when Enabled(level) is true. See Logger.Info for more
+	// details.
+	Info(level int, msg string, keysAndValues ...interface{})
+
+	// Error logs an error, with the given message and key/value pairs as
+	// context.  See Logger.Error for more details.
+	Error(err error, msg string, keysAndValues ...interface{})
+
+	// WithValues returns a new LogSink with additional key/value pairs.  See
+	// Logger.WithValues for more details.
+	WithValues(keysAndValues ...interface{}) LogSink
+
+	// WithName returns a new LogSink with the specified name appended.  See
+	// Logger.WithName for more details.
+	WithName(name string) LogSink
+}
+
+// CallDepthLogSink represents a LogSink that knows how to climb the call stack
+// to identify the original call site and can offset the depth by a specified
+// number of frames.  This is useful for users who have helper functions
+// between the "real" call site and the actual calls to Logger methods.
+// Implementations that log information about the call site (such as file,
+// function, or line) would otherwise log information about the intermediate
+// helper functions.
+//
+// This is an optional interface and implementations are not required to
+// support it.
+type CallDepthLogSink interface {
+	// WithCallDepth returns a LogSink that will offset the call
+	// stack by the specified number of frames when logging call
+	// site information.
+	//
+	// If depth is 0, the LogSink should skip exactly the number
+	// of call frames defined in RuntimeInfo.CallDepth when Info
+	// or Error are called, i.e. the attribution should be to the
+	// direct caller of Logger.Info or Logger.Error.
+	//
+	// If depth is 1 the attribution should skip 1 call frame, and so on.
+	// Successive calls to this are additive.
+	WithCallDepth(depth int) LogSink
+}
+
+// CallStackHelperLogSink represents a LogSink that knows how to climb
+// the call stack to identify the original call site and can skip
+// intermediate helper functions if they mark themselves as
+// helper. Go's testing package uses that approach.
+//
+// This is useful for users who have helper functions between the
+// "real" call site and the actual calls to Logger methods.
+// Implementations that log information about the call site (such as
+// file, function, or line) would otherwise log information about the
+// intermediate helper functions.
+//
+// This is an optional interface and implementations are not required
+// to support it. Implementations that choose to support this must not
+// simply implement it as WithCallDepth(1), because
+// Logger.WithCallStackHelper will call both methods if they are
+// present. This should only be implemented for LogSinks that actually
+// need it, as with testing.T.
+type CallStackHelperLogSink interface {
+	// GetCallStackHelper returns a function that must be called
+	// to mark the direct caller as helper function when logging
+	// call site information.
+	GetCallStackHelper() func()
+}
+
+// Marshaler is an optional interface that logged values may choose to
+// implement. Loggers with structured output, such as JSON, should
+// log the object return by the MarshalLog method instead of the
+// original value.
+type Marshaler interface {
+	// MarshalLog can be used to:
+	//   - ensure that structs are not logged as strings when the original
+	//     value has a String method: return a different type without a
+	//     String method
+	//   - select which fields of a complex type should get logged:
+	//     return a simpler struct with fewer fields
+	//   - log unexported fields: return a different struct
+	//     with exported fields
+	//
+	// It may return any value of any type.
+	MarshalLog() interface{}
+}
diff --git a/vendor/github.com/go-logr/stdr/LICENSE b/vendor/github.com/go-logr/stdr/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/github.com/go-logr/stdr/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/go-logr/stdr/README.md b/vendor/github.com/go-logr/stdr/README.md
new file mode 100644
index 0000000000..5158667890
--- /dev/null
+++ b/vendor/github.com/go-logr/stdr/README.md
@@ -0,0 +1,6 @@
+# Minimal Go logging using logr and Go's standard library
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/go-logr/stdr.svg)](https://pkg.go.dev/github.com/go-logr/stdr)
+
+This package implements the [logr interface](https://github.com/go-logr/logr)
+in terms of Go's standard log package(https://pkg.go.dev/log).
diff --git a/vendor/github.com/go-logr/stdr/stdr.go b/vendor/github.com/go-logr/stdr/stdr.go
new file mode 100644
index 0000000000..93a8aab51b
--- /dev/null
+++ b/vendor/github.com/go-logr/stdr/stdr.go
@@ -0,0 +1,170 @@
+/*
+Copyright 2019 The logr Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package stdr implements github.com/go-logr/logr.Logger in terms of
+// Go's standard log package.
+package stdr
+
+import (
+	"log"
+	"os"
+
+	"github.com/go-logr/logr"
+	"github.com/go-logr/logr/funcr"
+)
+
+// The global verbosity level.  See SetVerbosity().
+var globalVerbosity int
+
+// SetVerbosity sets the global level against which all info logs will be
+// compared.  If this is greater than or equal to the "V" of the logger, the
+// message will be logged.  A higher value here means more logs will be written.
+// The previous verbosity value is returned.  This is not concurrent-safe -
+// callers must be sure to call it from only one goroutine.
+func SetVerbosity(v int) int {
+	old := globalVerbosity
+	globalVerbosity = v
+	return old
+}
+
+// New returns a logr.Logger which is implemented by Go's standard log package,
+// or something like it.  If std is nil, this will use a default logger
+// instead.
+//
+// Example: stdr.New(log.New(os.Stderr, "", log.LstdFlags|log.Lshortfile)))
+func New(std StdLogger) logr.Logger {
+	return NewWithOptions(std, Options{})
+}
+
+// NewWithOptions returns a logr.Logger which is implemented by Go's standard
+// log package, or something like it.  See New for details.
+func NewWithOptions(std StdLogger, opts Options) logr.Logger {
+	if std == nil {
+		// Go's log.Default() is only available in 1.16 and higher.
+		std = log.New(os.Stderr, "", log.LstdFlags)
+	}
+
+	if opts.Depth < 0 {
+		opts.Depth = 0
+	}
+
+	fopts := funcr.Options{
+		LogCaller: funcr.MessageClass(opts.LogCaller),
+	}
+
+	sl := &logger{
+		Formatter: funcr.NewFormatter(fopts),
+		std:       std,
+	}
+
+	// For skipping our own logger.Info/Error.
+	sl.Formatter.AddCallDepth(1 + opts.Depth)
+
+	return logr.New(sl)
+}
+
+// Options carries parameters which influence the way logs are generated.
+type Options struct {
+	// Depth biases the assumed number of call frames to the "true" caller.
+	// This is useful when the calling code calls a function which then calls
+	// stdr (e.g. a logging shim to another API).  Values less than zero will
+	// be treated as zero.
+	Depth int
+
+	// LogCaller tells stdr to add a "caller" key to some or all log lines.
+	// Go's log package has options to log this natively, too.
+	LogCaller MessageClass
+
+	// TODO: add an option to log the date/time
+}
+
+// MessageClass indicates which category or categories of messages to consider.
+type MessageClass int
+
+const (
+	// None ignores all message classes.
+	None MessageClass = iota
+	// All considers all message classes.
+	All
+	// Info only considers info messages.
+	Info
+	// Error only considers error messages.
+	Error
+)
+
+// StdLogger is the subset of the Go stdlib log.Logger API that is needed for
+// this adapter.
+type StdLogger interface {
+	// Output is the same as log.Output and log.Logger.Output.
+	Output(calldepth int, logline string) error
+}
+
+type logger struct {
+	funcr.Formatter
+	std StdLogger
+}
+
+var _ logr.LogSink = &logger{}
+var _ logr.CallDepthLogSink = &logger{}
+
+func (l logger) Enabled(level int) bool {
+	return globalVerbosity >= level
+}
+
+func (l logger) Info(level int, msg string, kvList ...interface{}) {
+	prefix, args := l.FormatInfo(level, msg, kvList)
+	if prefix != "" {
+		args = prefix + ": " + args
+	}
+	_ = l.std.Output(l.Formatter.GetDepth()+1, args)
+}
+
+func (l logger) Error(err error, msg string, kvList ...interface{}) {
+	prefix, args := l.FormatError(err, msg, kvList)
+	if prefix != "" {
+		args = prefix + ": " + args
+	}
+	_ = l.std.Output(l.Formatter.GetDepth()+1, args)
+}
+
+func (l logger) WithName(name string) logr.LogSink {
+	l.Formatter.AddName(name)
+	return &l
+}
+
+func (l logger) WithValues(kvList ...interface{}) logr.LogSink {
+	l.Formatter.AddValues(kvList)
+	return &l
+}
+
+func (l logger) WithCallDepth(depth int) logr.LogSink {
+	l.Formatter.AddCallDepth(depth)
+	return &l
+}
+
+// Underlier exposes access to the underlying logging implementation.  Since
+// callers only have a logr.Logger, they have to know which implementation is
+// in use, so this interface is less of an abstraction and more of way to test
+// type conversion.
+type Underlier interface {
+	GetUnderlying() StdLogger
+}
+
+// GetUnderlying returns the StdLogger underneath this logger.  Since StdLogger
+// is itself an interface, the result may or may not be a Go log.Logger.
+func (l logger) GetUnderlying() StdLogger {
+	return l.std
+}
diff --git a/vendor/github.com/golang/glog/LICENSE b/vendor/github.com/golang/glog/LICENSE
deleted file mode 100644
index 37ec93a14f..0000000000
--- a/vendor/github.com/golang/glog/LICENSE
+++ /dev/null
@@ -1,191 +0,0 @@
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction, and
-distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by the copyright
-owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all other entities
-that control, are controlled by, or are under common control with that entity.
-For the purposes of this definition, "control" means (i) the power, direct or
-indirect, to cause the direction or management of such entity, whether by
-contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising
-permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications, including
-but not limited to software source code, documentation source, and configuration
-files.
-
-"Object" form shall mean any form resulting from mechanical transformation or
-translation of a Source form, including but not limited to compiled object code,
-generated documentation, and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object form, made
-available under the License, as indicated by a copyright notice that is included
-in or attached to the work (an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object form, that
-is based on (or derived from) the Work and for which the editorial revisions,
-annotations, elaborations, or other modifications represent, as a whole, an
-original work of authorship. For the purposes of this License, Derivative Works
-shall not include works that remain separable from, or merely link (or bind by
-name) to the interfaces of, the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including the original version
-of the Work and any modifications or additions to that Work or Derivative Works
-thereof, that is intentionally submitted to Licensor for inclusion in the Work
-by the copyright owner or by an individual or Legal Entity authorized to submit
-on behalf of the copyright owner. For the purposes of this definition,
-"submitted" means any form of electronic, verbal, or written communication sent
-to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems, and
-issue tracking systems that are managed by, or on behalf of, the Licensor for
-the purpose of discussing and improving the Work, but excluding communication
-that is conspicuously marked or otherwise designated in writing by the copyright
-owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
-of whom a Contribution has been received by Licensor and subsequently
-incorporated within the Work.
-
-2. Grant of Copyright License.
-
-Subject to the terms and conditions of this License, each Contributor hereby
-grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
-irrevocable copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the Work and such
-Derivative Works in Source or Object form.
-
-3. Grant of Patent License.
-
-Subject to the terms and conditions of this License, each Contributor hereby
-grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
-irrevocable (except as stated in this section) patent license to make, have
-made, use, offer to sell, sell, import, and otherwise transfer the Work, where
-such license applies only to those patent claims licensable by such Contributor
-that are necessarily infringed by their Contribution(s) alone or by combination
-of their Contribution(s) with the Work to which such Contribution(s) was
-submitted. If You institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work or a
-Contribution incorporated within the Work constitutes direct or contributory
-patent infringement, then any patent licenses granted to You under this License
-for that Work shall terminate as of the date such litigation is filed.
-
-4. Redistribution.
-
-You may reproduce and distribute copies of the Work or Derivative Works thereof
-in any medium, with or without modifications, and in Source or Object form,
-provided that You meet the following conditions:
-
-You must give any other recipients of the Work or Derivative Works a copy of
-this License; and
-You must cause any modified files to carry prominent notices stating that You
-changed the files; and
-You must retain, in the Source form of any Derivative Works that You distribute,
-all copyright, patent, trademark, and attribution notices from the Source form
-of the Work, excluding those notices that do not pertain to any part of the
-Derivative Works; and
-If the Work includes a "NOTICE" text file as part of its distribution, then any
-Derivative Works that You distribute must include a readable copy of the
-attribution notices contained within such NOTICE file, excluding those notices
-that do not pertain to any part of the Derivative Works, in at least one of the
-following places: within a NOTICE text file distributed as part of the
-Derivative Works; within the Source form or documentation, if provided along
-with the Derivative Works; or, within a display generated by the Derivative
-Works, if and wherever such third-party notices normally appear. The contents of
-the NOTICE file are for informational purposes only and do not modify the
-License. You may add Your own attribution notices within Derivative Works that
-You distribute, alongside or as an addendum to the NOTICE text from the Work,
-provided that such additional attribution notices cannot be construed as
-modifying the License.
-You may add Your own copyright statement to Your modifications and may provide
-additional or different license terms and conditions for use, reproduction, or
-distribution of Your modifications, or for any such Derivative Works as a whole,
-provided Your use, reproduction, and distribution of the Work otherwise complies
-with the conditions stated in this License.
-
-5. Submission of Contributions.
-
-Unless You explicitly state otherwise, any Contribution intentionally submitted
-for inclusion in the Work by You to the Licensor shall be under the terms and
-conditions of this License, without any additional terms or conditions.
-Notwithstanding the above, nothing herein shall supersede or modify the terms of
-any separate license agreement you may have executed with Licensor regarding
-such Contributions.
-
-6. Trademarks.
-
-This License does not grant permission to use the trade names, trademarks,
-service marks, or product names of the Licensor, except as required for
-reasonable and customary use in describing the origin of the Work and
-reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty.
-
-Unless required by applicable law or agreed to in writing, Licensor provides the
-Work (and each Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
-including, without limitation, any warranties or conditions of TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are
-solely responsible for determining the appropriateness of using or
-redistributing the Work and assume any risks associated with Your exercise of
-permissions under this License.
-
-8. Limitation of Liability.
-
-In no event and under no legal theory, whether in tort (including negligence),
-contract, or otherwise, unless required by applicable law (such as deliberate
-and grossly negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special, incidental,
-or consequential damages of any character arising as a result of this License or
-out of the use or inability to use the Work (including but not limited to
-damages for loss of goodwill, work stoppage, computer failure or malfunction, or
-any and all other commercial damages or losses), even if such Contributor has
-been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability.
-
-While redistributing the Work or Derivative Works thereof, You may choose to
-offer, and charge a fee for, acceptance of support, warranty, indemnity, or
-other liability obligations and/or rights consistent with this License. However,
-in accepting such obligations, You may act only on Your own behalf and on Your
-sole responsibility, not on behalf of any other Contributor, and only if You
-agree to indemnify, defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason of your
-accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work
-
-To apply the Apache License to your work, attach the following boilerplate
-notice, with the fields enclosed by brackets "[]" replaced with your own
-identifying information. (Don't include the brackets!) The text should be
-enclosed in the appropriate comment syntax for the file format. We also
-recommend that a file or class name and description of purpose be included on
-the same "printed page" as the copyright notice for easier identification within
-third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/vendor/github.com/golang/glog/README.md b/vendor/github.com/golang/glog/README.md
deleted file mode 100644
index a4f73883b2..0000000000
--- a/vendor/github.com/golang/glog/README.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# glog
-
-[![PkgGoDev](https://pkg.go.dev/badge/github.com/golang/glog)](https://pkg.go.dev/github.com/golang/glog)
-
-Leveled execution logs for Go.
-
-This is an efficient pure Go implementation of leveled logs in the
-manner of the open source C++ package [_glog_](https://github.com/google/glog).
-
-By binding methods to booleans it is possible to use the log package without paying the expense of evaluating the arguments to the log. Through the `-vmodule` flag, the package also provides fine-grained
-control over logging at the file level.
-
-The comment from `glog.go` introduces the ideas:
-
-Package _glog_ implements logging analogous to the Google-internal C++ INFO/ERROR/V setup.  It provides the functions Info, Warning, Error, Fatal, plus formatting variants such as Infof. It also provides V-style loggingcontrolled by the `-v` and `-vmodule=file=2` flags.
-	
-Basic examples:
-
-```go
-glog.Info("Prepare to repel boarders")
-	
-glog.Fatalf("Initialization failed: %s", err)
-```
-	
-See the documentation for the V function for an explanation of these examples:
-
-```go
-if glog.V(2) {
-	glog.Info("Starting transaction...")
-}
-glog.V(2).Infoln("Processed", nItems, "elements")
-```
-
-The repository contains an open source version of the log package used inside Google. The master copy of the source lives inside Google, not here. The code in this repo is for export only and is not itself under development. Feature requests will be ignored.
-
-Send bug reports to golang-nuts@googlegroups.com.
diff --git a/vendor/github.com/golang/glog/glog.go b/vendor/github.com/golang/glog/glog.go
index 718c34f886..2d258ce66c 100644
--- a/vendor/github.com/golang/glog/glog.go
+++ b/vendor/github.com/golang/glog/glog.go
@@ -1,1180 +1,21 @@
-// Go support for leveled logs, analogous to https://code.google.com/p/google-glog/
-//
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package glog implements logging analogous to the Google-internal C++ INFO/ERROR/V setup.
-// It provides functions Info, Warning, Error, Fatal, plus formatting variants such as
-// Infof. It also provides V-style logging controlled by the -v and -vmodule=file=2 flags.
-//
-// Basic examples:
-//
-//	glog.Info("Prepare to repel boarders")
-//
-//	glog.Fatalf("Initialization failed: %s", err)
-//
-// See the documentation for the V function for an explanation of these examples:
-//
-//	if glog.V(2) {
-//		glog.Info("Starting transaction...")
-//	}
-//
-//	glog.V(2).Infoln("Processed", nItems, "elements")
-//
-// Log output is buffered and written periodically using Flush. Programs
-// should call Flush before exiting to guarantee all log output is written.
-//
-// By default, all log statements write to files in a temporary directory.
-// This package provides several flags that modify this behavior.
-// As a result, flag.Parse must be called before any logging is done.
-//
-//	-logtostderr=false
-//		Logs are written to standard error instead of to files.
-//	-alsologtostderr=false
-//		Logs are written to standard error as well as to files.
-//	-stderrthreshold=ERROR
-//		Log events at or above this severity are logged to standard
-//		error as well as to files.
-//	-log_dir=""
-//		Log files will be written to this directory instead of the
-//		default temporary directory.
-//
-//	Other flags provide aids to debugging.
-//
-//	-log_backtrace_at=""
-//		When set to a file and line number holding a logging statement,
-//		such as
-//			-log_backtrace_at=gopherflakes.go:234
-//		a stack trace will be written to the Info log whenever execution
-//		hits that statement. (Unlike with -vmodule, the ".go" must be
-//		present.)
-//	-v=0
-//		Enable V-leveled logging at the specified level.
-//	-vmodule=""
-//		The syntax of the argument is a comma-separated list of pattern=N,
-//		where pattern is a literal file name (minus the ".go" suffix) or
-//		"glob" pattern and N is a V level. For instance,
-//			-vmodule=gopher*=3
-//		sets the V level to 3 in all Go files whose names begin "gopher".
-//
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package glog is used as a replacement for github.com/golang/glog. The latter
+// is used only through badger (ristretto), and comes with costly current user
+// lookups that we don't need: it's only used for printing fatal errors before
+// giving up.
 package glog
 
-import (
-	"bufio"
-	"bytes"
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	stdLog "log"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-// severity identifies the sort of log: info, warning etc. It also implements
-// the flag.Value interface. The -stderrthreshold flag is of type severity and
-// should be modified only through the flag.Value interface. The values match
-// the corresponding constants in C++.
-type severity int32 // sync/atomic int32
-
-// These constants identify the log levels in order of increasing severity.
-// A message written to a high-severity log file is also written to each
-// lower-severity log file.
-const (
-	infoLog severity = iota
-	warningLog
-	errorLog
-	fatalLog
-	numSeverity = 4
-)
-
-const severityChar = "IWEF"
-
-var severityName = []string{
-	infoLog:    "INFO",
-	warningLog: "WARNING",
-	errorLog:   "ERROR",
-	fatalLog:   "FATAL",
-}
-
-// get returns the value of the severity.
-func (s *severity) get() severity {
-	return severity(atomic.LoadInt32((*int32)(s)))
-}
-
-// set sets the value of the severity.
-func (s *severity) set(val severity) {
-	atomic.StoreInt32((*int32)(s), int32(val))
-}
-
-// String is part of the flag.Value interface.
-func (s *severity) String() string {
-	return strconv.FormatInt(int64(*s), 10)
-}
-
-// Get is part of the flag.Value interface.
-func (s *severity) Get() interface{} {
-	return *s
-}
-
-// Set is part of the flag.Value interface.
-func (s *severity) Set(value string) error {
-	var threshold severity
-	// Is it a known name?
-	if v, ok := severityByName(value); ok {
-		threshold = v
-	} else {
-		v, err := strconv.Atoi(value)
-		if err != nil {
-			return err
-		}
-		threshold = severity(v)
-	}
-	logging.stderrThreshold.set(threshold)
-	return nil
-}
-
-func severityByName(s string) (severity, bool) {
-	s = strings.ToUpper(s)
-	for i, name := range severityName {
-		if name == s {
-			return severity(i), true
-		}
-	}
-	return 0, false
-}
-
-// OutputStats tracks the number of output lines and bytes written.
-type OutputStats struct {
-	lines int64
-	bytes int64
-}
-
-// Lines returns the number of lines written.
-func (s *OutputStats) Lines() int64 {
-	return atomic.LoadInt64(&s.lines)
-}
-
-// Bytes returns the number of bytes written.
-func (s *OutputStats) Bytes() int64 {
-	return atomic.LoadInt64(&s.bytes)
-}
-
-// Stats tracks the number of lines of output and number of bytes
-// per severity level. Values must be read with atomic.LoadInt64.
-var Stats struct {
-	Info, Warning, Error OutputStats
-}
-
-var severityStats = [numSeverity]*OutputStats{
-	infoLog:    &Stats.Info,
-	warningLog: &Stats.Warning,
-	errorLog:   &Stats.Error,
-}
-
-// Level is exported because it appears in the arguments to V and is
-// the type of the v flag, which can be set programmatically.
-// It's a distinct type because we want to discriminate it from logType.
-// Variables of type level are only changed under logging.mu.
-// The -v flag is read only with atomic ops, so the state of the logging
-// module is consistent.
-
-// Level is treated as a sync/atomic int32.
-
-// Level specifies a level of verbosity for V logs. *Level implements
-// flag.Value; the -v flag is of type Level and should be modified
-// only through the flag.Value interface.
-type Level int32
-
-// get returns the value of the Level.
-func (l *Level) get() Level {
-	return Level(atomic.LoadInt32((*int32)(l)))
-}
-
-// set sets the value of the Level.
-func (l *Level) set(val Level) {
-	atomic.StoreInt32((*int32)(l), int32(val))
-}
-
-// String is part of the flag.Value interface.
-func (l *Level) String() string {
-	return strconv.FormatInt(int64(*l), 10)
-}
-
-// Get is part of the flag.Value interface.
-func (l *Level) Get() interface{} {
-	return *l
-}
-
-// Set is part of the flag.Value interface.
-func (l *Level) Set(value string) error {
-	v, err := strconv.Atoi(value)
-	if err != nil {
-		return err
-	}
-	logging.mu.Lock()
-	defer logging.mu.Unlock()
-	logging.setVState(Level(v), logging.vmodule.filter, false)
-	return nil
-}
-
-// moduleSpec represents the setting of the -vmodule flag.
-type moduleSpec struct {
-	filter []modulePat
-}
-
-// modulePat contains a filter for the -vmodule flag.
-// It holds a verbosity level and a file pattern to match.
-type modulePat struct {
-	pattern string
-	literal bool // The pattern is a literal string
-	level   Level
-}
-
-// match reports whether the file matches the pattern. It uses a string
-// comparison if the pattern contains no metacharacters.
-func (m *modulePat) match(file string) bool {
-	if m.literal {
-		return file == m.pattern
-	}
-	match, _ := filepath.Match(m.pattern, file)
-	return match
-}
-
-func (m *moduleSpec) String() string {
-	// Lock because the type is not atomic. TODO: clean this up.
-	logging.mu.Lock()
-	defer logging.mu.Unlock()
-	var b bytes.Buffer
-	for i, f := range m.filter {
-		if i > 0 {
-			b.WriteRune(',')
-		}
-		fmt.Fprintf(&b, "%s=%d", f.pattern, f.level)
-	}
-	return b.String()
-}
-
-// Get is part of the (Go 1.2)  flag.Getter interface. It always returns nil for this flag type since the
-// struct is not exported.
-func (m *moduleSpec) Get() interface{} {
-	return nil
-}
-
-var errVmoduleSyntax = errors.New("syntax error: expect comma-separated list of filename=N")
-
-// Syntax: -vmodule=recordio=2,file=1,gfs*=3
-func (m *moduleSpec) Set(value string) error {
-	var filter []modulePat
-	for _, pat := range strings.Split(value, ",") {
-		if len(pat) == 0 {
-			// Empty strings such as from a trailing comma can be ignored.
-			continue
-		}
-		patLev := strings.Split(pat, "=")
-		if len(patLev) != 2 || len(patLev[0]) == 0 || len(patLev[1]) == 0 {
-			return errVmoduleSyntax
-		}
-		pattern := patLev[0]
-		v, err := strconv.Atoi(patLev[1])
-		if err != nil {
-			return errors.New("syntax error: expect comma-separated list of filename=N")
-		}
-		if v < 0 {
-			return errors.New("negative value for vmodule level")
-		}
-		if v == 0 {
-			continue // Ignore. It's harmless but no point in paying the overhead.
-		}
-		// TODO: check syntax of filter?
-		filter = append(filter, modulePat{pattern, isLiteral(pattern), Level(v)})
-	}
-	logging.mu.Lock()
-	defer logging.mu.Unlock()
-	logging.setVState(logging.verbosity, filter, true)
-	return nil
-}
-
-// isLiteral reports whether the pattern is a literal string, that is, has no metacharacters
-// that require filepath.Match to be called to match the pattern.
-func isLiteral(pattern string) bool {
-	return !strings.ContainsAny(pattern, `\*?[]`)
-}
-
-// traceLocation represents the setting of the -log_backtrace_at flag.
-type traceLocation struct {
-	file string
-	line int
-}
-
-// isSet reports whether the trace location has been specified.
-// logging.mu is held.
-func (t *traceLocation) isSet() bool {
-	return t.line > 0
-}
-
-// match reports whether the specified file and line matches the trace location.
-// The argument file name is the full path, not the basename specified in the flag.
-// logging.mu is held.
-func (t *traceLocation) match(file string, line int) bool {
-	if t.line != line {
-		return false
-	}
-	if i := strings.LastIndex(file, "/"); i >= 0 {
-		file = file[i+1:]
-	}
-	return t.file == file
-}
-
-func (t *traceLocation) String() string {
-	// Lock because the type is not atomic. TODO: clean this up.
-	logging.mu.Lock()
-	defer logging.mu.Unlock()
-	return fmt.Sprintf("%s:%d", t.file, t.line)
-}
-
-// Get is part of the (Go 1.2) flag.Getter interface. It always returns nil for this flag type since the
-// struct is not exported
-func (t *traceLocation) Get() interface{} {
-	return nil
-}
-
-var errTraceSyntax = errors.New("syntax error: expect file.go:234")
-
-// Syntax: -log_backtrace_at=gopherflakes.go:234
-// Note that unlike vmodule the file extension is included here.
-func (t *traceLocation) Set(value string) error {
-	if value == "" {
-		// Unset.
-		t.line = 0
-		t.file = ""
-	}
-	fields := strings.Split(value, ":")
-	if len(fields) != 2 {
-		return errTraceSyntax
-	}
-	file, line := fields[0], fields[1]
-	if !strings.Contains(file, ".") {
-		return errTraceSyntax
-	}
-	v, err := strconv.Atoi(line)
-	if err != nil {
-		return errTraceSyntax
-	}
-	if v <= 0 {
-		return errors.New("negative or zero value for level")
-	}
-	logging.mu.Lock()
-	defer logging.mu.Unlock()
-	t.line = v
-	t.file = file
-	return nil
-}
-
-// flushSyncWriter is the interface satisfied by logging destinations.
-type flushSyncWriter interface {
-	Flush() error
-	Sync() error
-	io.Writer
-}
-
-func init() {
-	flag.BoolVar(&logging.toStderr, "logtostderr", false, "log to standard error instead of files")
-	flag.BoolVar(&logging.alsoToStderr, "alsologtostderr", false, "log to standard error as well as files")
-	flag.Var(&logging.verbosity, "v", "log level for V logs")
-	flag.Var(&logging.stderrThreshold, "stderrthreshold", "logs at or above this threshold go to stderr")
-	flag.Var(&logging.vmodule, "vmodule", "comma-separated list of pattern=N settings for file-filtered logging")
-	flag.Var(&logging.traceLocation, "log_backtrace_at", "when logging hits line file:N, emit a stack trace")
-
-	// Default stderrThreshold is ERROR.
-	logging.stderrThreshold = errorLog
-
-	logging.setVState(0, nil, false)
-	go logging.flushDaemon()
-}
-
-// Flush flushes all pending log I/O.
-func Flush() {
-	logging.lockAndFlushAll()
-}
-
-// loggingT collects all the global state of the logging setup.
-type loggingT struct {
-	// Boolean flags. Not handled atomically because the flag.Value interface
-	// does not let us avoid the =true, and that shorthand is necessary for
-	// compatibility. TODO: does this matter enough to fix? Seems unlikely.
-	toStderr     bool // The -logtostderr flag.
-	alsoToStderr bool // The -alsologtostderr flag.
-
-	// Level flag. Handled atomically.
-	stderrThreshold severity // The -stderrthreshold flag.
-
-	// freeList is a list of byte buffers, maintained under freeListMu.
-	freeList *buffer
-	// freeListMu maintains the free list. It is separate from the main mutex
-	// so buffers can be grabbed and printed to without holding the main lock,
-	// for better parallelization.
-	freeListMu sync.Mutex
-
-	// mu protects the remaining elements of this structure and is
-	// used to synchronize logging.
-	mu sync.Mutex
-	// file holds writer for each of the log types.
-	file [numSeverity]flushSyncWriter
-	// pcs is used in V to avoid an allocation when computing the caller's PC.
-	pcs [1]uintptr
-	// vmap is a cache of the V Level for each V() call site, identified by PC.
-	// It is wiped whenever the vmodule flag changes state.
-	vmap map[uintptr]Level
-	// filterLength stores the length of the vmodule filter chain. If greater
-	// than zero, it means vmodule is enabled. It may be read safely
-	// using sync.LoadInt32, but is only modified under mu.
-	filterLength int32
-	// traceLocation is the state of the -log_backtrace_at flag.
-	traceLocation traceLocation
-	// These flags are modified only under lock, although verbosity may be fetched
-	// safely using atomic.LoadInt32.
-	vmodule   moduleSpec // The state of the -vmodule flag.
-	verbosity Level      // V logging level, the value of the -v flag/
-}
-
-// buffer holds a byte Buffer for reuse. The zero value is ready for use.
-type buffer struct {
-	bytes.Buffer
-	tmp  [64]byte // temporary byte array for creating headers.
-	next *buffer
-}
-
-var logging loggingT
-
-// setVState sets a consistent state for V logging.
-// l.mu is held.
-func (l *loggingT) setVState(verbosity Level, filter []modulePat, setFilter bool) {
-	// Turn verbosity off so V will not fire while we are in transition.
-	logging.verbosity.set(0)
-	// Ditto for filter length.
-	atomic.StoreInt32(&logging.filterLength, 0)
-
-	// Set the new filters and wipe the pc->Level map if the filter has changed.
-	if setFilter {
-		logging.vmodule.filter = filter
-		logging.vmap = make(map[uintptr]Level)
-	}
-
-	// Things are consistent now, so enable filtering and verbosity.
-	// They are enabled in order opposite to that in V.
-	atomic.StoreInt32(&logging.filterLength, int32(len(filter)))
-	logging.verbosity.set(verbosity)
-}
-
-// getBuffer returns a new, ready-to-use buffer.
-func (l *loggingT) getBuffer() *buffer {
-	l.freeListMu.Lock()
-	b := l.freeList
-	if b != nil {
-		l.freeList = b.next
-	}
-	l.freeListMu.Unlock()
-	if b == nil {
-		b = new(buffer)
-	} else {
-		b.next = nil
-		b.Reset()
-	}
-	return b
-}
-
-// putBuffer returns a buffer to the free list.
-func (l *loggingT) putBuffer(b *buffer) {
-	if b.Len() >= 256 {
-		// Let big buffers die a natural death.
-		return
-	}
-	l.freeListMu.Lock()
-	b.next = l.freeList
-	l.freeList = b
-	l.freeListMu.Unlock()
-}
-
-var timeNow = time.Now // Stubbed out for testing.
-
-/*
-header formats a log header as defined by the C++ implementation.
-It returns a buffer containing the formatted header and the user's file and line number.
-The depth specifies how many stack frames above lives the source line to be identified in the log message.
-
-Log lines have this form:
-	Lmmdd hh:mm:ss.uuuuuu threadid file:line] msg...
-where the fields are defined as follows:
-	L                A single character, representing the log level (eg 'I' for INFO)
-	mm               The month (zero padded; ie May is '05')
-	dd               The day (zero padded)
-	hh:mm:ss.uuuuuu  Time in hours, minutes and fractional seconds
-	threadid         The space-padded thread ID as returned by GetTID()
-	file             The file name
-	line             The line number
-	msg              The user-supplied message
-*/
-func (l *loggingT) header(s severity, depth int) (*buffer, string, int) {
-	_, file, line, ok := runtime.Caller(3 + depth)
-	if !ok {
-		file = "???"
-		line = 1
-	} else {
-		slash := strings.LastIndex(file, "/")
-		if slash >= 0 {
-			file = file[slash+1:]
-		}
-	}
-	return l.formatHeader(s, file, line), file, line
-}
-
-// formatHeader formats a log header using the provided file name and line number.
-func (l *loggingT) formatHeader(s severity, file string, line int) *buffer {
-	now := timeNow()
-	if line < 0 {
-		line = 0 // not a real line number, but acceptable to someDigits
-	}
-	if s > fatalLog {
-		s = infoLog // for safety.
-	}
-	buf := l.getBuffer()
-
-	// Avoid Fprintf, for speed. The format is so simple that we can do it quickly by hand.
-	// It's worth about 3X. Fprintf is hard.
-	_, month, day := now.Date()
-	hour, minute, second := now.Clock()
-	// Lmmdd hh:mm:ss.uuuuuu threadid file:line]
-	buf.tmp[0] = severityChar[s]
-	buf.twoDigits(1, int(month))
-	buf.twoDigits(3, day)
-	buf.tmp[5] = ' '
-	buf.twoDigits(6, hour)
-	buf.tmp[8] = ':'
-	buf.twoDigits(9, minute)
-	buf.tmp[11] = ':'
-	buf.twoDigits(12, second)
-	buf.tmp[14] = '.'
-	buf.nDigits(6, 15, now.Nanosecond()/1000, '0')
-	buf.tmp[21] = ' '
-	buf.nDigits(7, 22, pid, ' ') // TODO: should be TID
-	buf.tmp[29] = ' '
-	buf.Write(buf.tmp[:30])
-	buf.WriteString(file)
-	buf.tmp[0] = ':'
-	n := buf.someDigits(1, line)
-	buf.tmp[n+1] = ']'
-	buf.tmp[n+2] = ' '
-	buf.Write(buf.tmp[:n+3])
-	return buf
-}
-
-// Some custom tiny helper functions to print the log header efficiently.
+import "log"
 
-const digits = "0123456789"
-
-// twoDigits formats a zero-prefixed two-digit integer at buf.tmp[i].
-func (buf *buffer) twoDigits(i, d int) {
-	buf.tmp[i+1] = digits[d%10]
-	d /= 10
-	buf.tmp[i] = digits[d%10]
-}
-
-// nDigits formats an n-digit integer at buf.tmp[i],
-// padding with pad on the left.
-// It assumes d >= 0.
-func (buf *buffer) nDigits(n, i, d int, pad byte) {
-	j := n - 1
-	for ; j >= 0 && d > 0; j-- {
-		buf.tmp[i+j] = digits[d%10]
-		d /= 10
-	}
-	for ; j >= 0; j-- {
-		buf.tmp[i+j] = pad
-	}
-}
-
-// someDigits formats a zero-prefixed variable-width integer at buf.tmp[i].
-func (buf *buffer) someDigits(i, d int) int {
-	// Print into the top, then copy down. We know there's space for at least
-	// a 10-digit number.
-	j := len(buf.tmp)
-	for {
-		j--
-		buf.tmp[j] = digits[d%10]
-		d /= 10
-		if d == 0 {
-			break
-		}
-	}
-	return copy(buf.tmp[i:], buf.tmp[j:])
-}
-
-func (l *loggingT) println(s severity, args ...interface{}) {
-	buf, file, line := l.header(s, 0)
-	fmt.Fprintln(buf, args...)
-	l.output(s, buf, file, line, false)
-}
-
-func (l *loggingT) print(s severity, args ...interface{}) {
-	l.printDepth(s, 1, args...)
-}
-
-func (l *loggingT) printDepth(s severity, depth int, args ...interface{}) {
-	buf, file, line := l.header(s, depth)
-	fmt.Fprint(buf, args...)
-	if buf.Bytes()[buf.Len()-1] != '\n' {
-		buf.WriteByte('\n')
-	}
-	l.output(s, buf, file, line, false)
-}
-
-func (l *loggingT) printf(s severity, format string, args ...interface{}) {
-	buf, file, line := l.header(s, 0)
-	fmt.Fprintf(buf, format, args...)
-	if buf.Bytes()[buf.Len()-1] != '\n' {
-		buf.WriteByte('\n')
-	}
-	l.output(s, buf, file, line, false)
-}
-
-// printWithFileLine behaves like print but uses the provided file and line number.  If
-// alsoLogToStderr is true, the log message always appears on standard error; it
-// will also appear in the log file unless --logtostderr is set.
-func (l *loggingT) printWithFileLine(s severity, file string, line int, alsoToStderr bool, args ...interface{}) {
-	buf := l.formatHeader(s, file, line)
-	fmt.Fprint(buf, args...)
-	if buf.Bytes()[buf.Len()-1] != '\n' {
-		buf.WriteByte('\n')
-	}
-	l.output(s, buf, file, line, alsoToStderr)
-}
-
-// output writes the data to the log files and releases the buffer.
-func (l *loggingT) output(s severity, buf *buffer, file string, line int, alsoToStderr bool) {
-	l.mu.Lock()
-	if l.traceLocation.isSet() {
-		if l.traceLocation.match(file, line) {
-			buf.Write(stacks(false))
-		}
-	}
-	data := buf.Bytes()
-	if !flag.Parsed() {
-		os.Stderr.Write([]byte("ERROR: logging before flag.Parse: "))
-		os.Stderr.Write(data)
-	} else if l.toStderr {
-		os.Stderr.Write(data)
-	} else {
-		if alsoToStderr || l.alsoToStderr || s >= l.stderrThreshold.get() {
-			os.Stderr.Write(data)
-		}
-		if l.file[s] == nil {
-			if err := l.createFiles(s); err != nil {
-				os.Stderr.Write(data) // Make sure the message appears somewhere.
-				l.exit(err)
-			}
-		}
-		switch s {
-		case fatalLog:
-			l.file[fatalLog].Write(data)
-			fallthrough
-		case errorLog:
-			l.file[errorLog].Write(data)
-			fallthrough
-		case warningLog:
-			l.file[warningLog].Write(data)
-			fallthrough
-		case infoLog:
-			l.file[infoLog].Write(data)
-		}
-	}
-	if s == fatalLog {
-		// If we got here via Exit rather than Fatal, print no stacks.
-		if atomic.LoadUint32(&fatalNoStacks) > 0 {
-			l.mu.Unlock()
-			timeoutFlush(10 * time.Second)
-			os.Exit(1)
-		}
-		// Dump all goroutine stacks before exiting.
-		// First, make sure we see the trace for the current goroutine on standard error.
-		// If -logtostderr has been specified, the loop below will do that anyway
-		// as the first stack in the full dump.
-		if !l.toStderr {
-			os.Stderr.Write(stacks(false))
-		}
-		// Write the stack trace for all goroutines to the files.
-		trace := stacks(true)
-		logExitFunc = func(error) {} // If we get a write error, we'll still exit below.
-		for log := fatalLog; log >= infoLog; log-- {
-			if f := l.file[log]; f != nil { // Can be nil if -logtostderr is set.
-				f.Write(trace)
-			}
-		}
-		l.mu.Unlock()
-		timeoutFlush(10 * time.Second)
-		os.Exit(255) // C++ uses -1, which is silly because it's anded with 255 anyway.
-	}
-	l.putBuffer(buf)
-	l.mu.Unlock()
-	if stats := severityStats[s]; stats != nil {
-		atomic.AddInt64(&stats.lines, 1)
-		atomic.AddInt64(&stats.bytes, int64(len(data)))
-	}
-}
-
-// timeoutFlush calls Flush and returns when it completes or after timeout
-// elapses, whichever happens first.  This is needed because the hooks invoked
-// by Flush may deadlock when glog.Fatal is called from a hook that holds
-// a lock.
-func timeoutFlush(timeout time.Duration) {
-	done := make(chan bool, 1)
-	go func() {
-		Flush() // calls logging.lockAndFlushAll()
-		done <- true
-	}()
-	select {
-	case <-done:
-	case <-time.After(timeout):
-		fmt.Fprintln(os.Stderr, "glog: Flush took longer than", timeout)
-	}
-}
-
-// stacks is a wrapper for runtime.Stack that attempts to recover the data for all goroutines.
-func stacks(all bool) []byte {
-	// We don't know how big the traces are, so grow a few times if they don't fit. Start large, though.
-	n := 10000
-	if all {
-		n = 100000
-	}
-	var trace []byte
-	for i := 0; i < 5; i++ {
-		trace = make([]byte, n)
-		nbytes := runtime.Stack(trace, all)
-		if nbytes < len(trace) {
-			return trace[:nbytes]
-		}
-		n *= 2
-	}
-	return trace
-}
-
-// logExitFunc provides a simple mechanism to override the default behavior
-// of exiting on error. Used in testing and to guarantee we reach a required exit
-// for fatal logs. Instead, exit could be a function rather than a method but that
-// would make its use clumsier.
-var logExitFunc func(error)
-
-// exit is called if there is trouble creating or writing log files.
-// It flushes the logs and exits the program; there's no point in hanging around.
-// l.mu is held.
-func (l *loggingT) exit(err error) {
-	fmt.Fprintf(os.Stderr, "log: exiting because of error: %s\n", err)
-	// If logExitFunc is set, we do that instead of exiting.
-	if logExitFunc != nil {
-		logExitFunc(err)
-		return
-	}
-	l.flushAll()
-	os.Exit(2)
-}
-
-// syncBuffer joins a bufio.Writer to its underlying file, providing access to the
-// file's Sync method and providing a wrapper for the Write method that provides log
-// file rotation. There are conflicting methods, so the file cannot be embedded.
-// l.mu is held for all its methods.
-type syncBuffer struct {
-	logger *loggingT
-	*bufio.Writer
-	file   *os.File
-	sev    severity
-	nbytes uint64 // The number of bytes written to this file
-}
-
-func (sb *syncBuffer) Sync() error {
-	return sb.file.Sync()
-}
-
-func (sb *syncBuffer) Write(p []byte) (n int, err error) {
-	if sb.nbytes+uint64(len(p)) >= MaxSize {
-		if err := sb.rotateFile(time.Now()); err != nil {
-			sb.logger.exit(err)
-		}
-	}
-	n, err = sb.Writer.Write(p)
-	sb.nbytes += uint64(n)
-	if err != nil {
-		sb.logger.exit(err)
-	}
-	return
-}
-
-// rotateFile closes the syncBuffer's file and starts a new one.
-func (sb *syncBuffer) rotateFile(now time.Time) error {
-	if sb.file != nil {
-		sb.Flush()
-		sb.file.Close()
-	}
-	var err error
-	sb.file, _, err = create(severityName[sb.sev], now)
-	sb.nbytes = 0
-	if err != nil {
-		return err
-	}
-
-	sb.Writer = bufio.NewWriterSize(sb.file, bufferSize)
-
-	// Write header.
-	var buf bytes.Buffer
-	fmt.Fprintf(&buf, "Log file created at: %s\n", now.Format("2006/01/02 15:04:05"))
-	fmt.Fprintf(&buf, "Running on machine: %s\n", host)
-	fmt.Fprintf(&buf, "Binary: Built with %s %s for %s/%s\n", runtime.Compiler, runtime.Version(), runtime.GOOS, runtime.GOARCH)
-	fmt.Fprintf(&buf, "Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg\n")
-	n, err := sb.file.Write(buf.Bytes())
-	sb.nbytes += uint64(n)
-	return err
-}
-
-// bufferSize sizes the buffer associated with each log file. It's large
-// so that log records can accumulate without the logging thread blocking
-// on disk I/O. The flushDaemon will block instead.
-const bufferSize = 256 * 1024
-
-// createFiles creates all the log files for severity from sev down to infoLog.
-// l.mu is held.
-func (l *loggingT) createFiles(sev severity) error {
-	now := time.Now()
-	// Files are created in decreasing severity order, so as soon as we find one
-	// has already been created, we can stop.
-	for s := sev; s >= infoLog && l.file[s] == nil; s-- {
-		sb := &syncBuffer{
-			logger: l,
-			sev:    s,
-		}
-		if err := sb.rotateFile(now); err != nil {
-			return err
-		}
-		l.file[s] = sb
-	}
-	return nil
-}
-
-const flushInterval = 30 * time.Second
-
-// flushDaemon periodically flushes the log file buffers.
-func (l *loggingT) flushDaemon() {
-	for range time.NewTicker(flushInterval).C {
-		l.lockAndFlushAll()
-	}
-}
-
-// lockAndFlushAll is like flushAll but locks l.mu first.
-func (l *loggingT) lockAndFlushAll() {
-	l.mu.Lock()
-	l.flushAll()
-	l.mu.Unlock()
-}
-
-// flushAll flushes all the logs and attempts to "sync" their data to disk.
-// l.mu is held.
-func (l *loggingT) flushAll() {
-	// Flush from fatal down, in case there's trouble flushing.
-	for s := fatalLog; s >= infoLog; s-- {
-		file := l.file[s]
-		if file != nil {
-			file.Flush() // ignore error
-			file.Sync()  // ignore error
-		}
-	}
-}
-
-// CopyStandardLogTo arranges for messages written to the Go "log" package's
-// default logs to also appear in the Google logs for the named and lower
-// severities.  Subsequent changes to the standard log's default output location
-// or format may break this behavior.
-//
-// Valid names are "INFO", "WARNING", "ERROR", and "FATAL".  If the name is not
-// recognized, CopyStandardLogTo panics.
-func CopyStandardLogTo(name string) {
-	sev, ok := severityByName(name)
-	if !ok {
-		panic(fmt.Sprintf("log.CopyStandardLogTo(%q): unrecognized severity name", name))
-	}
-	// Set a log format that captures the user's file and line:
-	//   d.go:23: message
-	stdLog.SetFlags(stdLog.Lshortfile)
-	stdLog.SetOutput(logBridge(sev))
-}
-
-// logBridge provides the Write method that enables CopyStandardLogTo to connect
-// Go's standard logs to the logs provided by this package.
-type logBridge severity
-
-// Write parses the standard logging line and passes its components to the
-// logger for severity(lb).
-func (lb logBridge) Write(b []byte) (n int, err error) {
-	var (
-		file = "???"
-		line = 1
-		text string
-	)
-	// Split "d.go:23: message" into "d.go", "23", and "message".
-	if parts := bytes.SplitN(b, []byte{':'}, 3); len(parts) != 3 || len(parts[0]) < 1 || len(parts[2]) < 1 {
-		text = fmt.Sprintf("bad log format: %s", b)
-	} else {
-		file = string(parts[0])
-		text = string(parts[2][1:]) // skip leading space
-		line, err = strconv.Atoi(string(parts[1]))
-		if err != nil {
-			text = fmt.Sprintf("bad line number: %s", b)
-			line = 1
-		}
-	}
-	// printWithFileLine with alsoToStderr=true, so standard log messages
-	// always appear on standard error.
-	logging.printWithFileLine(severity(lb), file, line, true, text)
-	return len(b), nil
-}
-
-// setV computes and remembers the V level for a given PC
-// when vmodule is enabled.
-// File pattern matching takes the basename of the file, stripped
-// of its .go suffix, and uses filepath.Match, which is a little more
-// general than the *? matching used in C++.
-// l.mu is held.
-func (l *loggingT) setV(pc uintptr) Level {
-	fn := runtime.FuncForPC(pc)
-	file, _ := fn.FileLine(pc)
-	// The file is something like /a/b/c/d.go. We want just the d.
-	if strings.HasSuffix(file, ".go") {
-		file = file[:len(file)-3]
-	}
-	if slash := strings.LastIndex(file, "/"); slash >= 0 {
-		file = file[slash+1:]
-	}
-	for _, filter := range l.vmodule.filter {
-		if filter.match(file) {
-			l.vmap[pc] = filter.level
-			return filter.level
-		}
-	}
-	l.vmap[pc] = 0
-	return 0
-}
-
-// Verbose is a boolean type that implements Infof (like Printf) etc.
-// See the documentation of V for more information.
-type Verbose bool
-
-// V reports whether verbosity at the call site is at least the requested level.
-// The returned value is a boolean of type Verbose, which implements Info, Infoln
-// and Infof. These methods will write to the Info log if called.
-// Thus, one may write either
-//	if glog.V(2) { glog.Info("log this") }
-// or
-//	glog.V(2).Info("log this")
-// The second form is shorter but the first is cheaper if logging is off because it does
-// not evaluate its arguments.
-//
-// Whether an individual call to V generates a log record depends on the setting of
-// the -v and --vmodule flags; both are off by default. If the level in the call to
-// V is at most the value of -v, or of -vmodule for the source file containing the
-// call, the V call will log.
-func V(level Level) Verbose {
-	// This function tries hard to be cheap unless there's work to do.
-	// The fast path is two atomic loads and compares.
-
-	// Here is a cheap but safe test to see if V logging is enabled globally.
-	if logging.verbosity.get() >= level {
-		return Verbose(true)
-	}
-
-	// It's off globally but it vmodule may still be set.
-	// Here is another cheap but safe test to see if vmodule is enabled.
-	if atomic.LoadInt32(&logging.filterLength) > 0 {
-		// Now we need a proper lock to use the logging structure. The pcs field
-		// is shared so we must lock before accessing it. This is fairly expensive,
-		// but if V logging is enabled we're slow anyway.
-		logging.mu.Lock()
-		defer logging.mu.Unlock()
-		if runtime.Callers(2, logging.pcs[:]) == 0 {
-			return Verbose(false)
-		}
-		v, ok := logging.vmap[logging.pcs[0]]
-		if !ok {
-			v = logging.setV(logging.pcs[0])
-		}
-		return Verbose(v >= level)
-	}
-	return Verbose(false)
-}
-
-// Info is equivalent to the global Info function, guarded by the value of v.
-// See the documentation of V for usage.
-func (v Verbose) Info(args ...interface{}) {
-	if v {
-		logging.print(infoLog, args...)
-	}
-}
-
-// Infoln is equivalent to the global Infoln function, guarded by the value of v.
-// See the documentation of V for usage.
-func (v Verbose) Infoln(args ...interface{}) {
-	if v {
-		logging.println(infoLog, args...)
-	}
-}
-
-// Infof is equivalent to the global Infof function, guarded by the value of v.
-// See the documentation of V for usage.
-func (v Verbose) Infof(format string, args ...interface{}) {
-	if v {
-		logging.printf(infoLog, format, args...)
-	}
-}
-
-// Info logs to the INFO log.
-// Arguments are handled in the manner of fmt.Print; a newline is appended if missing.
-func Info(args ...interface{}) {
-	logging.print(infoLog, args...)
-}
-
-// InfoDepth acts as Info but uses depth to determine which call frame to log.
-// InfoDepth(0, "msg") is the same as Info("msg").
-func InfoDepth(depth int, args ...interface{}) {
-	logging.printDepth(infoLog, depth, args...)
-}
-
-// Infoln logs to the INFO log.
-// Arguments are handled in the manner of fmt.Println; a newline is appended if missing.
-func Infoln(args ...interface{}) {
-	logging.println(infoLog, args...)
-}
-
-// Infof logs to the INFO log.
-// Arguments are handled in the manner of fmt.Printf; a newline is appended if missing.
-func Infof(format string, args ...interface{}) {
-	logging.printf(infoLog, format, args...)
-}
-
-// Warning logs to the WARNING and INFO logs.
-// Arguments are handled in the manner of fmt.Print; a newline is appended if missing.
-func Warning(args ...interface{}) {
-	logging.print(warningLog, args...)
-}
-
-// WarningDepth acts as Warning but uses depth to determine which call frame to log.
-// WarningDepth(0, "msg") is the same as Warning("msg").
-func WarningDepth(depth int, args ...interface{}) {
-	logging.printDepth(warningLog, depth, args...)
-}
-
-// Warningln logs to the WARNING and INFO logs.
-// Arguments are handled in the manner of fmt.Println; a newline is appended if missing.
-func Warningln(args ...interface{}) {
-	logging.println(warningLog, args...)
-}
-
-// Warningf logs to the WARNING and INFO logs.
-// Arguments are handled in the manner of fmt.Printf; a newline is appended if missing.
-func Warningf(format string, args ...interface{}) {
-	logging.printf(warningLog, format, args...)
-}
-
-// Error logs to the ERROR, WARNING, and INFO logs.
-// Arguments are handled in the manner of fmt.Print; a newline is appended if missing.
-func Error(args ...interface{}) {
-	logging.print(errorLog, args...)
-}
-
-// ErrorDepth acts as Error but uses depth to determine which call frame to log.
-// ErrorDepth(0, "msg") is the same as Error("msg").
-func ErrorDepth(depth int, args ...interface{}) {
-	logging.printDepth(errorLog, depth, args...)
-}
-
-// Errorln logs to the ERROR, WARNING, and INFO logs.
-// Arguments are handled in the manner of fmt.Println; a newline is appended if missing.
-func Errorln(args ...interface{}) {
-	logging.println(errorLog, args...)
-}
-
-// Errorf logs to the ERROR, WARNING, and INFO logs.
-// Arguments are handled in the manner of fmt.Printf; a newline is appended if missing.
-func Errorf(format string, args ...interface{}) {
-	logging.printf(errorLog, format, args...)
-}
-
-// Fatal logs to the FATAL, ERROR, WARNING, and INFO logs,
-// including a stack trace of all running goroutines, then calls os.Exit(255).
-// Arguments are handled in the manner of fmt.Print; a newline is appended if missing.
+// Fatal outputs its arguments and does an os.Exit(1)
 func Fatal(args ...interface{}) {
-	logging.print(fatalLog, args...)
+	log.Fatal(args...)
 }
 
-// FatalDepth acts as Fatal but uses depth to determine which call frame to log.
-// FatalDepth(0, "msg") is the same as Fatal("msg").
-func FatalDepth(depth int, args ...interface{}) {
-	logging.printDepth(fatalLog, depth, args...)
-}
-
-// Fatalln logs to the FATAL, ERROR, WARNING, and INFO logs,
-// including a stack trace of all running goroutines, then calls os.Exit(255).
-// Arguments are handled in the manner of fmt.Println; a newline is appended if missing.
-func Fatalln(args ...interface{}) {
-	logging.println(fatalLog, args...)
-}
-
-// Fatalf logs to the FATAL, ERROR, WARNING, and INFO logs,
-// including a stack trace of all running goroutines, then calls os.Exit(255).
-// Arguments are handled in the manner of fmt.Printf; a newline is appended if missing.
+// Fatalf formats and outputs its arguments and does an os.Exit(1)
 func Fatalf(format string, args ...interface{}) {
-	logging.printf(fatalLog, format, args...)
-}
-
-// fatalNoStacks is non-zero if we are to exit without dumping goroutine stacks.
-// It allows Exit and relatives to use the Fatal logs.
-var fatalNoStacks uint32
-
-// Exit logs to the FATAL, ERROR, WARNING, and INFO logs, then calls os.Exit(1).
-// Arguments are handled in the manner of fmt.Print; a newline is appended if missing.
-func Exit(args ...interface{}) {
-	atomic.StoreUint32(&fatalNoStacks, 1)
-	logging.print(fatalLog, args...)
-}
-
-// ExitDepth acts as Exit but uses depth to determine which call frame to log.
-// ExitDepth(0, "msg") is the same as Exit("msg").
-func ExitDepth(depth int, args ...interface{}) {
-	atomic.StoreUint32(&fatalNoStacks, 1)
-	logging.printDepth(fatalLog, depth, args...)
-}
-
-// Exitln logs to the FATAL, ERROR, WARNING, and INFO logs, then calls os.Exit(1).
-func Exitln(args ...interface{}) {
-	atomic.StoreUint32(&fatalNoStacks, 1)
-	logging.println(fatalLog, args...)
-}
-
-// Exitf logs to the FATAL, ERROR, WARNING, and INFO logs, then calls os.Exit(1).
-// Arguments are handled in the manner of fmt.Printf; a newline is appended if missing.
-func Exitf(format string, args ...interface{}) {
-	atomic.StoreUint32(&fatalNoStacks, 1)
-	logging.printf(fatalLog, format, args...)
+	log.Fatal(append([]interface{}{format}, args...))
 }
diff --git a/vendor/github.com/golang/glog/glog_file.go b/vendor/github.com/golang/glog/glog_file.go
deleted file mode 100644
index 65075d2811..0000000000
--- a/vendor/github.com/golang/glog/glog_file.go
+++ /dev/null
@@ -1,124 +0,0 @@
-// Go support for leveled logs, analogous to https://code.google.com/p/google-glog/
-//
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// File I/O for logs.
-
-package glog
-
-import (
-	"errors"
-	"flag"
-	"fmt"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strings"
-	"sync"
-	"time"
-)
-
-// MaxSize is the maximum size of a log file in bytes.
-var MaxSize uint64 = 1024 * 1024 * 1800
-
-// logDirs lists the candidate directories for new log files.
-var logDirs []string
-
-// If non-empty, overrides the choice of directory in which to write logs.
-// See createLogDirs for the full list of possible destinations.
-var logDir = flag.String("log_dir", "", "If non-empty, write log files in this directory")
-
-func createLogDirs() {
-	if *logDir != "" {
-		logDirs = append(logDirs, *logDir)
-	}
-	logDirs = append(logDirs, os.TempDir())
-}
-
-var (
-	pid      = os.Getpid()
-	program  = filepath.Base(os.Args[0])
-	host     = "unknownhost"
-	userName = "unknownuser"
-)
-
-func init() {
-	h, err := os.Hostname()
-	if err == nil {
-		host = shortHostname(h)
-	}
-
-	current, err := user.Current()
-	if err == nil {
-		userName = current.Username
-	}
-
-	// Sanitize userName since it may contain filepath separators on Windows.
-	userName = strings.Replace(userName, `\`, "_", -1)
-}
-
-// shortHostname returns its argument, truncating at the first period.
-// For instance, given "www.google.com" it returns "www".
-func shortHostname(hostname string) string {
-	if i := strings.Index(hostname, "."); i >= 0 {
-		return hostname[:i]
-	}
-	return hostname
-}
-
-// logName returns a new log file name containing tag, with start time t, and
-// the name for the symlink for tag.
-func logName(tag string, t time.Time) (name, link string) {
-	name = fmt.Sprintf("%s.%s.%s.log.%s.%04d%02d%02d-%02d%02d%02d.%d",
-		program,
-		host,
-		userName,
-		tag,
-		t.Year(),
-		t.Month(),
-		t.Day(),
-		t.Hour(),
-		t.Minute(),
-		t.Second(),
-		pid)
-	return name, program + "." + tag
-}
-
-var onceLogDirs sync.Once
-
-// create creates a new log file and returns the file and its filename, which
-// contains tag ("INFO", "FATAL", etc.) and t.  If the file is created
-// successfully, create also attempts to update the symlink for that tag, ignoring
-// errors.
-func create(tag string, t time.Time) (f *os.File, filename string, err error) {
-	onceLogDirs.Do(createLogDirs)
-	if len(logDirs) == 0 {
-		return nil, "", errors.New("log: no log dirs")
-	}
-	name, link := logName(tag, t)
-	var lastErr error
-	for _, dir := range logDirs {
-		fname := filepath.Join(dir, name)
-		f, err := os.Create(fname)
-		if err == nil {
-			symlink := filepath.Join(dir, link)
-			os.Remove(symlink)        // ignore err
-			os.Symlink(name, symlink) // ignore err
-			return f, fname, nil
-		}
-		lastErr = err
-	}
-	return nil, "", fmt.Errorf("log: cannot create log: %v", lastErr)
-}
diff --git a/vendor/github.com/golang/glog/go.mod b/vendor/github.com/golang/glog/go.mod
deleted file mode 100644
index 376dc05b9e..0000000000
--- a/vendor/github.com/golang/glog/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/golang/glog
-
-go 1.11
diff --git a/vendor/github.com/golang/protobuf/jsonpb/decode.go b/vendor/github.com/golang/protobuf/jsonpb/decode.go
new file mode 100644
index 0000000000..6c16c255ff
--- /dev/null
+++ b/vendor/github.com/golang/protobuf/jsonpb/decode.go
@@ -0,0 +1,530 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsonpb
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/encoding/protojson"
+	protoV2 "google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+)
+
+const wrapJSONUnmarshalV2 = false
+
+// UnmarshalNext unmarshals the next JSON object from d into m.
+func UnmarshalNext(d *json.Decoder, m proto.Message) error {
+	return new(Unmarshaler).UnmarshalNext(d, m)
+}
+
+// Unmarshal unmarshals a JSON object from r into m.
+func Unmarshal(r io.Reader, m proto.Message) error {
+	return new(Unmarshaler).Unmarshal(r, m)
+}
+
+// UnmarshalString unmarshals a JSON object from s into m.
+func UnmarshalString(s string, m proto.Message) error {
+	return new(Unmarshaler).Unmarshal(strings.NewReader(s), m)
+}
+
+// Unmarshaler is a configurable object for converting from a JSON
+// representation to a protocol buffer object.
+type Unmarshaler struct {
+	// AllowUnknownFields specifies whether to allow messages to contain
+	// unknown JSON fields, as opposed to failing to unmarshal.
+	AllowUnknownFields bool
+
+	// AnyResolver is used to resolve the google.protobuf.Any well-known type.
+	// If unset, the global registry is used by default.
+	AnyResolver AnyResolver
+}
+
+// JSONPBUnmarshaler is implemented by protobuf messages that customize the way
+// they are unmarshaled from JSON. Messages that implement this should also
+// implement JSONPBMarshaler so that the custom format can be produced.
+//
+// The JSON unmarshaling must follow the JSON to proto specification:
+//	https://developers.google.com/protocol-buffers/docs/proto3#json
+//
+// Deprecated: Custom types should implement protobuf reflection instead.
+type JSONPBUnmarshaler interface {
+	UnmarshalJSONPB(*Unmarshaler, []byte) error
+}
+
+// Unmarshal unmarshals a JSON object from r into m.
+func (u *Unmarshaler) Unmarshal(r io.Reader, m proto.Message) error {
+	return u.UnmarshalNext(json.NewDecoder(r), m)
+}
+
+// UnmarshalNext unmarshals the next JSON object from d into m.
+func (u *Unmarshaler) UnmarshalNext(d *json.Decoder, m proto.Message) error {
+	if m == nil {
+		return errors.New("invalid nil message")
+	}
+
+	// Parse the next JSON object from the stream.
+	raw := json.RawMessage{}
+	if err := d.Decode(&raw); err != nil {
+		return err
+	}
+
+	// Check for custom unmarshalers first since they may not properly
+	// implement protobuf reflection that the logic below relies on.
+	if jsu, ok := m.(JSONPBUnmarshaler); ok {
+		return jsu.UnmarshalJSONPB(u, raw)
+	}
+
+	mr := proto.MessageReflect(m)
+
+	// NOTE: For historical reasons, a top-level null is treated as a noop.
+	// This is incorrect, but kept for compatibility.
+	if string(raw) == "null" && mr.Descriptor().FullName() != "google.protobuf.Value" {
+		return nil
+	}
+
+	if wrapJSONUnmarshalV2 {
+		// NOTE: If input message is non-empty, we need to preserve merge semantics
+		// of the old jsonpb implementation. These semantics are not supported by
+		// the protobuf JSON specification.
+		isEmpty := true
+		mr.Range(func(protoreflect.FieldDescriptor, protoreflect.Value) bool {
+			isEmpty = false // at least one iteration implies non-empty
+			return false
+		})
+		if !isEmpty {
+			// Perform unmarshaling into a newly allocated, empty message.
+			mr = mr.New()
+
+			// Use a defer to copy all unmarshaled fields into the original message.
+			dst := proto.MessageReflect(m)
+			defer mr.Range(func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool {
+				dst.Set(fd, v)
+				return true
+			})
+		}
+
+		// Unmarshal using the v2 JSON unmarshaler.
+		opts := protojson.UnmarshalOptions{
+			DiscardUnknown: u.AllowUnknownFields,
+		}
+		if u.AnyResolver != nil {
+			opts.Resolver = anyResolver{u.AnyResolver}
+		}
+		return opts.Unmarshal(raw, mr.Interface())
+	} else {
+		if err := u.unmarshalMessage(mr, raw); err != nil {
+			return err
+		}
+		return protoV2.CheckInitialized(mr.Interface())
+	}
+}
+
+func (u *Unmarshaler) unmarshalMessage(m protoreflect.Message, in []byte) error {
+	md := m.Descriptor()
+	fds := md.Fields()
+
+	if jsu, ok := proto.MessageV1(m.Interface()).(JSONPBUnmarshaler); ok {
+		return jsu.UnmarshalJSONPB(u, in)
+	}
+
+	if string(in) == "null" && md.FullName() != "google.protobuf.Value" {
+		return nil
+	}
+
+	switch wellKnownType(md.FullName()) {
+	case "Any":
+		var jsonObject map[string]json.RawMessage
+		if err := json.Unmarshal(in, &jsonObject); err != nil {
+			return err
+		}
+
+		rawTypeURL, ok := jsonObject["@type"]
+		if !ok {
+			return errors.New("Any JSON doesn't have '@type'")
+		}
+		typeURL, err := unquoteString(string(rawTypeURL))
+		if err != nil {
+			return fmt.Errorf("can't unmarshal Any's '@type': %q", rawTypeURL)
+		}
+		m.Set(fds.ByNumber(1), protoreflect.ValueOfString(typeURL))
+
+		var m2 protoreflect.Message
+		if u.AnyResolver != nil {
+			mi, err := u.AnyResolver.Resolve(typeURL)
+			if err != nil {
+				return err
+			}
+			m2 = proto.MessageReflect(mi)
+		} else {
+			mt, err := protoregistry.GlobalTypes.FindMessageByURL(typeURL)
+			if err != nil {
+				if err == protoregistry.NotFound {
+					return fmt.Errorf("could not resolve Any message type: %v", typeURL)
+				}
+				return err
+			}
+			m2 = mt.New()
+		}
+
+		if wellKnownType(m2.Descriptor().FullName()) != "" {
+			rawValue, ok := jsonObject["value"]
+			if !ok {
+				return errors.New("Any JSON doesn't have 'value'")
+			}
+			if err := u.unmarshalMessage(m2, rawValue); err != nil {
+				return fmt.Errorf("can't unmarshal Any nested proto %v: %v", typeURL, err)
+			}
+		} else {
+			delete(jsonObject, "@type")
+			rawJSON, err := json.Marshal(jsonObject)
+			if err != nil {
+				return fmt.Errorf("can't generate JSON for Any's nested proto to be unmarshaled: %v", err)
+			}
+			if err = u.unmarshalMessage(m2, rawJSON); err != nil {
+				return fmt.Errorf("can't unmarshal Any nested proto %v: %v", typeURL, err)
+			}
+		}
+
+		rawWire, err := protoV2.Marshal(m2.Interface())
+		if err != nil {
+			return fmt.Errorf("can't marshal proto %v into Any.Value: %v", typeURL, err)
+		}
+		m.Set(fds.ByNumber(2), protoreflect.ValueOfBytes(rawWire))
+		return nil
+	case "BoolValue", "BytesValue", "StringValue",
+		"Int32Value", "UInt32Value", "FloatValue",
+		"Int64Value", "UInt64Value", "DoubleValue":
+		fd := fds.ByNumber(1)
+		v, err := u.unmarshalValue(m.NewField(fd), in, fd)
+		if err != nil {
+			return err
+		}
+		m.Set(fd, v)
+		return nil
+	case "Duration":
+		v, err := unquoteString(string(in))
+		if err != nil {
+			return err
+		}
+		d, err := time.ParseDuration(v)
+		if err != nil {
+			return fmt.Errorf("bad Duration: %v", err)
+		}
+
+		sec := d.Nanoseconds() / 1e9
+		nsec := d.Nanoseconds() % 1e9
+		m.Set(fds.ByNumber(1), protoreflect.ValueOfInt64(int64(sec)))
+		m.Set(fds.ByNumber(2), protoreflect.ValueOfInt32(int32(nsec)))
+		return nil
+	case "Timestamp":
+		v, err := unquoteString(string(in))
+		if err != nil {
+			return err
+		}
+		t, err := time.Parse(time.RFC3339Nano, v)
+		if err != nil {
+			return fmt.Errorf("bad Timestamp: %v", err)
+		}
+
+		sec := t.Unix()
+		nsec := t.Nanosecond()
+		m.Set(fds.ByNumber(1), protoreflect.ValueOfInt64(int64(sec)))
+		m.Set(fds.ByNumber(2), protoreflect.ValueOfInt32(int32(nsec)))
+		return nil
+	case "Value":
+		switch {
+		case string(in) == "null":
+			m.Set(fds.ByNumber(1), protoreflect.ValueOfEnum(0))
+		case string(in) == "true":
+			m.Set(fds.ByNumber(4), protoreflect.ValueOfBool(true))
+		case string(in) == "false":
+			m.Set(fds.ByNumber(4), protoreflect.ValueOfBool(false))
+		case hasPrefixAndSuffix('"', in, '"'):
+			s, err := unquoteString(string(in))
+			if err != nil {
+				return fmt.Errorf("unrecognized type for Value %q", in)
+			}
+			m.Set(fds.ByNumber(3), protoreflect.ValueOfString(s))
+		case hasPrefixAndSuffix('[', in, ']'):
+			v := m.Mutable(fds.ByNumber(6))
+			return u.unmarshalMessage(v.Message(), in)
+		case hasPrefixAndSuffix('{', in, '}'):
+			v := m.Mutable(fds.ByNumber(5))
+			return u.unmarshalMessage(v.Message(), in)
+		default:
+			f, err := strconv.ParseFloat(string(in), 0)
+			if err != nil {
+				return fmt.Errorf("unrecognized type for Value %q", in)
+			}
+			m.Set(fds.ByNumber(2), protoreflect.ValueOfFloat64(f))
+		}
+		return nil
+	case "ListValue":
+		var jsonArray []json.RawMessage
+		if err := json.Unmarshal(in, &jsonArray); err != nil {
+			return fmt.Errorf("bad ListValue: %v", err)
+		}
+
+		lv := m.Mutable(fds.ByNumber(1)).List()
+		for _, raw := range jsonArray {
+			ve := lv.NewElement()
+			if err := u.unmarshalMessage(ve.Message(), raw); err != nil {
+				return err
+			}
+			lv.Append(ve)
+		}
+		return nil
+	case "Struct":
+		var jsonObject map[string]json.RawMessage
+		if err := json.Unmarshal(in, &jsonObject); err != nil {
+			return fmt.Errorf("bad StructValue: %v", err)
+		}
+
+		mv := m.Mutable(fds.ByNumber(1)).Map()
+		for key, raw := range jsonObject {
+			kv := protoreflect.ValueOf(key).MapKey()
+			vv := mv.NewValue()
+			if err := u.unmarshalMessage(vv.Message(), raw); err != nil {
+				return fmt.Errorf("bad value in StructValue for key %q: %v", key, err)
+			}
+			mv.Set(kv, vv)
+		}
+		return nil
+	}
+
+	var jsonObject map[string]json.RawMessage
+	if err := json.Unmarshal(in, &jsonObject); err != nil {
+		return err
+	}
+
+	// Handle known fields.
+	for i := 0; i < fds.Len(); i++ {
+		fd := fds.Get(i)
+		if fd.IsWeak() && fd.Message().IsPlaceholder() {
+			continue //  weak reference is not linked in
+		}
+
+		// Search for any raw JSON value associated with this field.
+		var raw json.RawMessage
+		name := string(fd.Name())
+		if fd.Kind() == protoreflect.GroupKind {
+			name = string(fd.Message().Name())
+		}
+		if v, ok := jsonObject[name]; ok {
+			delete(jsonObject, name)
+			raw = v
+		}
+		name = string(fd.JSONName())
+		if v, ok := jsonObject[name]; ok {
+			delete(jsonObject, name)
+			raw = v
+		}
+
+		field := m.NewField(fd)
+		// Unmarshal the field value.
+		if raw == nil || (string(raw) == "null" && !isSingularWellKnownValue(fd) && !isSingularJSONPBUnmarshaler(field, fd)) {
+			continue
+		}
+		v, err := u.unmarshalValue(field, raw, fd)
+		if err != nil {
+			return err
+		}
+		m.Set(fd, v)
+	}
+
+	// Handle extension fields.
+	for name, raw := range jsonObject {
+		if !strings.HasPrefix(name, "[") || !strings.HasSuffix(name, "]") {
+			continue
+		}
+
+		// Resolve the extension field by name.
+		xname := protoreflect.FullName(name[len("[") : len(name)-len("]")])
+		xt, _ := protoregistry.GlobalTypes.FindExtensionByName(xname)
+		if xt == nil && isMessageSet(md) {
+			xt, _ = protoregistry.GlobalTypes.FindExtensionByName(xname.Append("message_set_extension"))
+		}
+		if xt == nil {
+			continue
+		}
+		delete(jsonObject, name)
+		fd := xt.TypeDescriptor()
+		if fd.ContainingMessage().FullName() != m.Descriptor().FullName() {
+			return fmt.Errorf("extension field %q does not extend message %q", xname, m.Descriptor().FullName())
+		}
+
+		field := m.NewField(fd)
+		// Unmarshal the field value.
+		if raw == nil || (string(raw) == "null" && !isSingularWellKnownValue(fd) && !isSingularJSONPBUnmarshaler(field, fd)) {
+			continue
+		}
+		v, err := u.unmarshalValue(field, raw, fd)
+		if err != nil {
+			return err
+		}
+		m.Set(fd, v)
+	}
+
+	if !u.AllowUnknownFields && len(jsonObject) > 0 {
+		for name := range jsonObject {
+			return fmt.Errorf("unknown field %q in %v", name, md.FullName())
+		}
+	}
+	return nil
+}
+
+func isSingularWellKnownValue(fd protoreflect.FieldDescriptor) bool {
+	if fd.Cardinality() == protoreflect.Repeated {
+		return false
+	}
+	if md := fd.Message(); md != nil {
+		return md.FullName() == "google.protobuf.Value"
+	}
+	if ed := fd.Enum(); ed != nil {
+		return ed.FullName() == "google.protobuf.NullValue"
+	}
+	return false
+}
+
+func isSingularJSONPBUnmarshaler(v protoreflect.Value, fd protoreflect.FieldDescriptor) bool {
+	if fd.Message() != nil && fd.Cardinality() != protoreflect.Repeated {
+		_, ok := proto.MessageV1(v.Interface()).(JSONPBUnmarshaler)
+		return ok
+	}
+	return false
+}
+
+func (u *Unmarshaler) unmarshalValue(v protoreflect.Value, in []byte, fd protoreflect.FieldDescriptor) (protoreflect.Value, error) {
+	switch {
+	case fd.IsList():
+		var jsonArray []json.RawMessage
+		if err := json.Unmarshal(in, &jsonArray); err != nil {
+			return v, err
+		}
+		lv := v.List()
+		for _, raw := range jsonArray {
+			ve, err := u.unmarshalSingularValue(lv.NewElement(), raw, fd)
+			if err != nil {
+				return v, err
+			}
+			lv.Append(ve)
+		}
+		return v, nil
+	case fd.IsMap():
+		var jsonObject map[string]json.RawMessage
+		if err := json.Unmarshal(in, &jsonObject); err != nil {
+			return v, err
+		}
+		kfd := fd.MapKey()
+		vfd := fd.MapValue()
+		mv := v.Map()
+		for key, raw := range jsonObject {
+			var kv protoreflect.MapKey
+			if kfd.Kind() == protoreflect.StringKind {
+				kv = protoreflect.ValueOf(key).MapKey()
+			} else {
+				v, err := u.unmarshalSingularValue(kfd.Default(), []byte(key), kfd)
+				if err != nil {
+					return v, err
+				}
+				kv = v.MapKey()
+			}
+
+			vv, err := u.unmarshalSingularValue(mv.NewValue(), raw, vfd)
+			if err != nil {
+				return v, err
+			}
+			mv.Set(kv, vv)
+		}
+		return v, nil
+	default:
+		return u.unmarshalSingularValue(v, in, fd)
+	}
+}
+
+var nonFinite = map[string]float64{
+	`"NaN"`:       math.NaN(),
+	`"Infinity"`:  math.Inf(+1),
+	`"-Infinity"`: math.Inf(-1),
+}
+
+func (u *Unmarshaler) unmarshalSingularValue(v protoreflect.Value, in []byte, fd protoreflect.FieldDescriptor) (protoreflect.Value, error) {
+	switch fd.Kind() {
+	case protoreflect.BoolKind:
+		return unmarshalValue(in, new(bool))
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		return unmarshalValue(trimQuote(in), new(int32))
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+		return unmarshalValue(trimQuote(in), new(int64))
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
+		return unmarshalValue(trimQuote(in), new(uint32))
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
+		return unmarshalValue(trimQuote(in), new(uint64))
+	case protoreflect.FloatKind:
+		if f, ok := nonFinite[string(in)]; ok {
+			return protoreflect.ValueOfFloat32(float32(f)), nil
+		}
+		return unmarshalValue(trimQuote(in), new(float32))
+	case protoreflect.DoubleKind:
+		if f, ok := nonFinite[string(in)]; ok {
+			return protoreflect.ValueOfFloat64(float64(f)), nil
+		}
+		return unmarshalValue(trimQuote(in), new(float64))
+	case protoreflect.StringKind:
+		return unmarshalValue(in, new(string))
+	case protoreflect.BytesKind:
+		return unmarshalValue(in, new([]byte))
+	case protoreflect.EnumKind:
+		if hasPrefixAndSuffix('"', in, '"') {
+			vd := fd.Enum().Values().ByName(protoreflect.Name(trimQuote(in)))
+			if vd == nil {
+				return v, fmt.Errorf("unknown value %q for enum %s", in, fd.Enum().FullName())
+			}
+			return protoreflect.ValueOfEnum(vd.Number()), nil
+		}
+		return unmarshalValue(in, new(protoreflect.EnumNumber))
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		err := u.unmarshalMessage(v.Message(), in)
+		return v, err
+	default:
+		panic(fmt.Sprintf("invalid kind %v", fd.Kind()))
+	}
+}
+
+func unmarshalValue(in []byte, v interface{}) (protoreflect.Value, error) {
+	err := json.Unmarshal(in, v)
+	return protoreflect.ValueOf(reflect.ValueOf(v).Elem().Interface()), err
+}
+
+func unquoteString(in string) (out string, err error) {
+	err = json.Unmarshal([]byte(in), &out)
+	return out, err
+}
+
+func hasPrefixAndSuffix(prefix byte, in []byte, suffix byte) bool {
+	if len(in) >= 2 && in[0] == prefix && in[len(in)-1] == suffix {
+		return true
+	}
+	return false
+}
+
+// trimQuote is like unquoteString but simply strips surrounding quotes.
+// This is incorrect, but is behavior done by the legacy implementation.
+func trimQuote(in []byte) []byte {
+	if len(in) >= 2 && in[0] == '"' && in[len(in)-1] == '"' {
+		in = in[1 : len(in)-1]
+	}
+	return in
+}
diff --git a/vendor/github.com/golang/protobuf/jsonpb/encode.go b/vendor/github.com/golang/protobuf/jsonpb/encode.go
new file mode 100644
index 0000000000..685c80a62b
--- /dev/null
+++ b/vendor/github.com/golang/protobuf/jsonpb/encode.go
@@ -0,0 +1,559 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package jsonpb
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/encoding/protojson"
+	protoV2 "google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+)
+
+const wrapJSONMarshalV2 = false
+
+// Marshaler is a configurable object for marshaling protocol buffer messages
+// to the specified JSON representation.
+type Marshaler struct {
+	// OrigName specifies whether to use the original protobuf name for fields.
+	OrigName bool
+
+	// EnumsAsInts specifies whether to render enum values as integers,
+	// as opposed to string values.
+	EnumsAsInts bool
+
+	// EmitDefaults specifies whether to render fields with zero values.
+	EmitDefaults bool
+
+	// Indent controls whether the output is compact or not.
+	// If empty, the output is compact JSON. Otherwise, every JSON object
+	// entry and JSON array value will be on its own line.
+	// Each line will be preceded by repeated copies of Indent, where the
+	// number of copies is the current indentation depth.
+	Indent string
+
+	// AnyResolver is used to resolve the google.protobuf.Any well-known type.
+	// If unset, the global registry is used by default.
+	AnyResolver AnyResolver
+}
+
+// JSONPBMarshaler is implemented by protobuf messages that customize the
+// way they are marshaled to JSON. Messages that implement this should also
+// implement JSONPBUnmarshaler so that the custom format can be parsed.
+//
+// The JSON marshaling must follow the proto to JSON specification:
+//	https://developers.google.com/protocol-buffers/docs/proto3#json
+//
+// Deprecated: Custom types should implement protobuf reflection instead.
+type JSONPBMarshaler interface {
+	MarshalJSONPB(*Marshaler) ([]byte, error)
+}
+
+// Marshal serializes a protobuf message as JSON into w.
+func (jm *Marshaler) Marshal(w io.Writer, m proto.Message) error {
+	b, err := jm.marshal(m)
+	if len(b) > 0 {
+		if _, err := w.Write(b); err != nil {
+			return err
+		}
+	}
+	return err
+}
+
+// MarshalToString serializes a protobuf message as JSON in string form.
+func (jm *Marshaler) MarshalToString(m proto.Message) (string, error) {
+	b, err := jm.marshal(m)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+func (jm *Marshaler) marshal(m proto.Message) ([]byte, error) {
+	v := reflect.ValueOf(m)
+	if m == nil || (v.Kind() == reflect.Ptr && v.IsNil()) {
+		return nil, errors.New("Marshal called with nil")
+	}
+
+	// Check for custom marshalers first since they may not properly
+	// implement protobuf reflection that the logic below relies on.
+	if jsm, ok := m.(JSONPBMarshaler); ok {
+		return jsm.MarshalJSONPB(jm)
+	}
+
+	if wrapJSONMarshalV2 {
+		opts := protojson.MarshalOptions{
+			UseProtoNames:   jm.OrigName,
+			UseEnumNumbers:  jm.EnumsAsInts,
+			EmitUnpopulated: jm.EmitDefaults,
+			Indent:          jm.Indent,
+		}
+		if jm.AnyResolver != nil {
+			opts.Resolver = anyResolver{jm.AnyResolver}
+		}
+		return opts.Marshal(proto.MessageReflect(m).Interface())
+	} else {
+		// Check for unpopulated required fields first.
+		m2 := proto.MessageReflect(m)
+		if err := protoV2.CheckInitialized(m2.Interface()); err != nil {
+			return nil, err
+		}
+
+		w := jsonWriter{Marshaler: jm}
+		err := w.marshalMessage(m2, "", "")
+		return w.buf, err
+	}
+}
+
+type jsonWriter struct {
+	*Marshaler
+	buf []byte
+}
+
+func (w *jsonWriter) write(s string) {
+	w.buf = append(w.buf, s...)
+}
+
+func (w *jsonWriter) marshalMessage(m protoreflect.Message, indent, typeURL string) error {
+	if jsm, ok := proto.MessageV1(m.Interface()).(JSONPBMarshaler); ok {
+		b, err := jsm.MarshalJSONPB(w.Marshaler)
+		if err != nil {
+			return err
+		}
+		if typeURL != "" {
+			// we are marshaling this object to an Any type
+			var js map[string]*json.RawMessage
+			if err = json.Unmarshal(b, &js); err != nil {
+				return fmt.Errorf("type %T produced invalid JSON: %v", m.Interface(), err)
+			}
+			turl, err := json.Marshal(typeURL)
+			if err != nil {
+				return fmt.Errorf("failed to marshal type URL %q to JSON: %v", typeURL, err)
+			}
+			js["@type"] = (*json.RawMessage)(&turl)
+			if b, err = json.Marshal(js); err != nil {
+				return err
+			}
+		}
+		w.write(string(b))
+		return nil
+	}
+
+	md := m.Descriptor()
+	fds := md.Fields()
+
+	// Handle well-known types.
+	const secondInNanos = int64(time.Second / time.Nanosecond)
+	switch wellKnownType(md.FullName()) {
+	case "Any":
+		return w.marshalAny(m, indent)
+	case "BoolValue", "BytesValue", "StringValue",
+		"Int32Value", "UInt32Value", "FloatValue",
+		"Int64Value", "UInt64Value", "DoubleValue":
+		fd := fds.ByNumber(1)
+		return w.marshalValue(fd, m.Get(fd), indent)
+	case "Duration":
+		const maxSecondsInDuration = 315576000000
+		// "Generated output always contains 0, 3, 6, or 9 fractional digits,
+		//  depending on required precision."
+		s := m.Get(fds.ByNumber(1)).Int()
+		ns := m.Get(fds.ByNumber(2)).Int()
+		if s < -maxSecondsInDuration || s > maxSecondsInDuration {
+			return fmt.Errorf("seconds out of range %v", s)
+		}
+		if ns <= -secondInNanos || ns >= secondInNanos {
+			return fmt.Errorf("ns out of range (%v, %v)", -secondInNanos, secondInNanos)
+		}
+		if (s > 0 && ns < 0) || (s < 0 && ns > 0) {
+			return errors.New("signs of seconds and nanos do not match")
+		}
+		var sign string
+		if s < 0 || ns < 0 {
+			sign, s, ns = "-", -1*s, -1*ns
+		}
+		x := fmt.Sprintf("%s%d.%09d", sign, s, ns)
+		x = strings.TrimSuffix(x, "000")
+		x = strings.TrimSuffix(x, "000")
+		x = strings.TrimSuffix(x, ".000")
+		w.write(fmt.Sprintf(`"%vs"`, x))
+		return nil
+	case "Timestamp":
+		// "RFC 3339, where generated output will always be Z-normalized
+		//  and uses 0, 3, 6 or 9 fractional digits."
+		s := m.Get(fds.ByNumber(1)).Int()
+		ns := m.Get(fds.ByNumber(2)).Int()
+		if ns < 0 || ns >= secondInNanos {
+			return fmt.Errorf("ns out of range [0, %v)", secondInNanos)
+		}
+		t := time.Unix(s, ns).UTC()
+		// time.RFC3339Nano isn't exactly right (we need to get 3/6/9 fractional digits).
+		x := t.Format("2006-01-02T15:04:05.000000000")
+		x = strings.TrimSuffix(x, "000")
+		x = strings.TrimSuffix(x, "000")
+		x = strings.TrimSuffix(x, ".000")
+		w.write(fmt.Sprintf(`"%vZ"`, x))
+		return nil
+	case "Value":
+		// JSON value; which is a null, number, string, bool, object, or array.
+		od := md.Oneofs().Get(0)
+		fd := m.WhichOneof(od)
+		if fd == nil {
+			return errors.New("nil Value")
+		}
+		return w.marshalValue(fd, m.Get(fd), indent)
+	case "Struct", "ListValue":
+		// JSON object or array.
+		fd := fds.ByNumber(1)
+		return w.marshalValue(fd, m.Get(fd), indent)
+	}
+
+	w.write("{")
+	if w.Indent != "" {
+		w.write("\n")
+	}
+
+	firstField := true
+	if typeURL != "" {
+		if err := w.marshalTypeURL(indent, typeURL); err != nil {
+			return err
+		}
+		firstField = false
+	}
+
+	for i := 0; i < fds.Len(); {
+		fd := fds.Get(i)
+		if od := fd.ContainingOneof(); od != nil {
+			fd = m.WhichOneof(od)
+			i += od.Fields().Len()
+			if fd == nil {
+				continue
+			}
+		} else {
+			i++
+		}
+
+		v := m.Get(fd)
+
+		if !m.Has(fd) {
+			if !w.EmitDefaults || fd.ContainingOneof() != nil {
+				continue
+			}
+			if fd.Cardinality() != protoreflect.Repeated && (fd.Message() != nil || fd.Syntax() == protoreflect.Proto2) {
+				v = protoreflect.Value{} // use "null" for singular messages or proto2 scalars
+			}
+		}
+
+		if !firstField {
+			w.writeComma()
+		}
+		if err := w.marshalField(fd, v, indent); err != nil {
+			return err
+		}
+		firstField = false
+	}
+
+	// Handle proto2 extensions.
+	if md.ExtensionRanges().Len() > 0 {
+		// Collect a sorted list of all extension descriptor and values.
+		type ext struct {
+			desc protoreflect.FieldDescriptor
+			val  protoreflect.Value
+		}
+		var exts []ext
+		m.Range(func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool {
+			if fd.IsExtension() {
+				exts = append(exts, ext{fd, v})
+			}
+			return true
+		})
+		sort.Slice(exts, func(i, j int) bool {
+			return exts[i].desc.Number() < exts[j].desc.Number()
+		})
+
+		for _, ext := range exts {
+			if !firstField {
+				w.writeComma()
+			}
+			if err := w.marshalField(ext.desc, ext.val, indent); err != nil {
+				return err
+			}
+			firstField = false
+		}
+	}
+
+	if w.Indent != "" {
+		w.write("\n")
+		w.write(indent)
+	}
+	w.write("}")
+	return nil
+}
+
+func (w *jsonWriter) writeComma() {
+	if w.Indent != "" {
+		w.write(",\n")
+	} else {
+		w.write(",")
+	}
+}
+
+func (w *jsonWriter) marshalAny(m protoreflect.Message, indent string) error {
+	// "If the Any contains a value that has a special JSON mapping,
+	//  it will be converted as follows: {"@type": xxx, "value": yyy}.
+	//  Otherwise, the value will be converted into a JSON object,
+	//  and the "@type" field will be inserted to indicate the actual data type."
+	md := m.Descriptor()
+	typeURL := m.Get(md.Fields().ByNumber(1)).String()
+	rawVal := m.Get(md.Fields().ByNumber(2)).Bytes()
+
+	var m2 protoreflect.Message
+	if w.AnyResolver != nil {
+		mi, err := w.AnyResolver.Resolve(typeURL)
+		if err != nil {
+			return err
+		}
+		m2 = proto.MessageReflect(mi)
+	} else {
+		mt, err := protoregistry.GlobalTypes.FindMessageByURL(typeURL)
+		if err != nil {
+			return err
+		}
+		m2 = mt.New()
+	}
+
+	if err := protoV2.Unmarshal(rawVal, m2.Interface()); err != nil {
+		return err
+	}
+
+	if wellKnownType(m2.Descriptor().FullName()) == "" {
+		return w.marshalMessage(m2, indent, typeURL)
+	}
+
+	w.write("{")
+	if w.Indent != "" {
+		w.write("\n")
+	}
+	if err := w.marshalTypeURL(indent, typeURL); err != nil {
+		return err
+	}
+	w.writeComma()
+	if w.Indent != "" {
+		w.write(indent)
+		w.write(w.Indent)
+		w.write(`"value": `)
+	} else {
+		w.write(`"value":`)
+	}
+	if err := w.marshalMessage(m2, indent+w.Indent, ""); err != nil {
+		return err
+	}
+	if w.Indent != "" {
+		w.write("\n")
+		w.write(indent)
+	}
+	w.write("}")
+	return nil
+}
+
+func (w *jsonWriter) marshalTypeURL(indent, typeURL string) error {
+	if w.Indent != "" {
+		w.write(indent)
+		w.write(w.Indent)
+	}
+	w.write(`"@type":`)
+	if w.Indent != "" {
+		w.write(" ")
+	}
+	b, err := json.Marshal(typeURL)
+	if err != nil {
+		return err
+	}
+	w.write(string(b))
+	return nil
+}
+
+// marshalField writes field description and value to the Writer.
+func (w *jsonWriter) marshalField(fd protoreflect.FieldDescriptor, v protoreflect.Value, indent string) error {
+	if w.Indent != "" {
+		w.write(indent)
+		w.write(w.Indent)
+	}
+	w.write(`"`)
+	switch {
+	case fd.IsExtension():
+		// For message set, use the fname of the message as the extension name.
+		name := string(fd.FullName())
+		if isMessageSet(fd.ContainingMessage()) {
+			name = strings.TrimSuffix(name, ".message_set_extension")
+		}
+
+		w.write("[" + name + "]")
+	case w.OrigName:
+		name := string(fd.Name())
+		if fd.Kind() == protoreflect.GroupKind {
+			name = string(fd.Message().Name())
+		}
+		w.write(name)
+	default:
+		w.write(string(fd.JSONName()))
+	}
+	w.write(`":`)
+	if w.Indent != "" {
+		w.write(" ")
+	}
+	return w.marshalValue(fd, v, indent)
+}
+
+func (w *jsonWriter) marshalValue(fd protoreflect.FieldDescriptor, v protoreflect.Value, indent string) error {
+	switch {
+	case fd.IsList():
+		w.write("[")
+		comma := ""
+		lv := v.List()
+		for i := 0; i < lv.Len(); i++ {
+			w.write(comma)
+			if w.Indent != "" {
+				w.write("\n")
+				w.write(indent)
+				w.write(w.Indent)
+				w.write(w.Indent)
+			}
+			if err := w.marshalSingularValue(fd, lv.Get(i), indent+w.Indent); err != nil {
+				return err
+			}
+			comma = ","
+		}
+		if w.Indent != "" {
+			w.write("\n")
+			w.write(indent)
+			w.write(w.Indent)
+		}
+		w.write("]")
+		return nil
+	case fd.IsMap():
+		kfd := fd.MapKey()
+		vfd := fd.MapValue()
+		mv := v.Map()
+
+		// Collect a sorted list of all map keys and values.
+		type entry struct{ key, val protoreflect.Value }
+		var entries []entry
+		mv.Range(func(k protoreflect.MapKey, v protoreflect.Value) bool {
+			entries = append(entries, entry{k.Value(), v})
+			return true
+		})
+		sort.Slice(entries, func(i, j int) bool {
+			switch kfd.Kind() {
+			case protoreflect.BoolKind:
+				return !entries[i].key.Bool() && entries[j].key.Bool()
+			case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind, protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+				return entries[i].key.Int() < entries[j].key.Int()
+			case protoreflect.Uint32Kind, protoreflect.Fixed32Kind, protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
+				return entries[i].key.Uint() < entries[j].key.Uint()
+			case protoreflect.StringKind:
+				return entries[i].key.String() < entries[j].key.String()
+			default:
+				panic("invalid kind")
+			}
+		})
+
+		w.write(`{`)
+		comma := ""
+		for _, entry := range entries {
+			w.write(comma)
+			if w.Indent != "" {
+				w.write("\n")
+				w.write(indent)
+				w.write(w.Indent)
+				w.write(w.Indent)
+			}
+
+			s := fmt.Sprint(entry.key.Interface())
+			b, err := json.Marshal(s)
+			if err != nil {
+				return err
+			}
+			w.write(string(b))
+
+			w.write(`:`)
+			if w.Indent != "" {
+				w.write(` `)
+			}
+
+			if err := w.marshalSingularValue(vfd, entry.val, indent+w.Indent); err != nil {
+				return err
+			}
+			comma = ","
+		}
+		if w.Indent != "" {
+			w.write("\n")
+			w.write(indent)
+			w.write(w.Indent)
+		}
+		w.write(`}`)
+		return nil
+	default:
+		return w.marshalSingularValue(fd, v, indent)
+	}
+}
+
+func (w *jsonWriter) marshalSingularValue(fd protoreflect.FieldDescriptor, v protoreflect.Value, indent string) error {
+	switch {
+	case !v.IsValid():
+		w.write("null")
+		return nil
+	case fd.Message() != nil:
+		return w.marshalMessage(v.Message(), indent+w.Indent, "")
+	case fd.Enum() != nil:
+		if fd.Enum().FullName() == "google.protobuf.NullValue" {
+			w.write("null")
+			return nil
+		}
+
+		vd := fd.Enum().Values().ByNumber(v.Enum())
+		if vd == nil || w.EnumsAsInts {
+			w.write(strconv.Itoa(int(v.Enum())))
+		} else {
+			w.write(`"` + string(vd.Name()) + `"`)
+		}
+		return nil
+	default:
+		switch v.Interface().(type) {
+		case float32, float64:
+			switch {
+			case math.IsInf(v.Float(), +1):
+				w.write(`"Infinity"`)
+				return nil
+			case math.IsInf(v.Float(), -1):
+				w.write(`"-Infinity"`)
+				return nil
+			case math.IsNaN(v.Float()):
+				w.write(`"NaN"`)
+				return nil
+			}
+		case int64, uint64:
+			w.write(fmt.Sprintf(`"%d"`, v.Interface()))
+			return nil
+		}
+
+		b, err := json.Marshal(v.Interface())
+		if err != nil {
+			return err
+		}
+		w.write(string(b))
+		return nil
+	}
+}
diff --git a/vendor/github.com/golang/protobuf/jsonpb/json.go b/vendor/github.com/golang/protobuf/jsonpb/json.go
new file mode 100644
index 0000000000..480e2448de
--- /dev/null
+++ b/vendor/github.com/golang/protobuf/jsonpb/json.go
@@ -0,0 +1,69 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package jsonpb provides functionality to marshal and unmarshal between a
+// protocol buffer message and JSON. It follows the specification at
+// https://developers.google.com/protocol-buffers/docs/proto3#json.
+//
+// Do not rely on the default behavior of the standard encoding/json package
+// when called on generated message types as it does not operate correctly.
+//
+// Deprecated: Use the "google.golang.org/protobuf/encoding/protojson"
+// package instead.
+package jsonpb
+
+import (
+	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/runtime/protoimpl"
+)
+
+// AnyResolver takes a type URL, present in an Any message,
+// and resolves it into an instance of the associated message.
+type AnyResolver interface {
+	Resolve(typeURL string) (proto.Message, error)
+}
+
+type anyResolver struct{ AnyResolver }
+
+func (r anyResolver) FindMessageByName(message protoreflect.FullName) (protoreflect.MessageType, error) {
+	return r.FindMessageByURL(string(message))
+}
+
+func (r anyResolver) FindMessageByURL(url string) (protoreflect.MessageType, error) {
+	m, err := r.Resolve(url)
+	if err != nil {
+		return nil, err
+	}
+	return protoimpl.X.MessageTypeOf(m), nil
+}
+
+func (r anyResolver) FindExtensionByName(field protoreflect.FullName) (protoreflect.ExtensionType, error) {
+	return protoregistry.GlobalTypes.FindExtensionByName(field)
+}
+
+func (r anyResolver) FindExtensionByNumber(message protoreflect.FullName, field protoreflect.FieldNumber) (protoreflect.ExtensionType, error) {
+	return protoregistry.GlobalTypes.FindExtensionByNumber(message, field)
+}
+
+func wellKnownType(s protoreflect.FullName) string {
+	if s.Parent() == "google.protobuf" {
+		switch s.Name() {
+		case "Empty", "Any",
+			"BoolValue", "BytesValue", "StringValue",
+			"Int32Value", "UInt32Value", "FloatValue",
+			"Int64Value", "UInt64Value", "DoubleValue",
+			"Duration", "Timestamp",
+			"NullValue", "Struct", "Value", "ListValue":
+			return string(s.Name())
+		}
+	}
+	return ""
+}
+
+func isMessageSet(md protoreflect.MessageDescriptor) bool {
+	ms, ok := md.(interface{ IsMessageSet() bool })
+	return ok && ms.IsMessageSet()
+}
diff --git a/vendor/github.com/golang/snappy/go.mod b/vendor/github.com/golang/snappy/go.mod
deleted file mode 100644
index f6406bb2c7..0000000000
--- a/vendor/github.com/golang/snappy/go.mod
+++ /dev/null
@@ -1 +0,0 @@
-module github.com/golang/snappy
diff --git a/vendor/github.com/gorilla/mux/go.mod b/vendor/github.com/gorilla/mux/go.mod
deleted file mode 100644
index df170a3994..0000000000
--- a/vendor/github.com/gorilla/mux/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/gorilla/mux
-
-go 1.12
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSE.txt b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSE.txt
new file mode 100644
index 0000000000..364516251b
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSE.txt
@@ -0,0 +1,27 @@
+Copyright (c) 2015, Gengo, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright notice,
+      this list of conditions and the following disclaimer in the documentation
+      and/or other materials provided with the distribution.
+
+    * Neither the name of Gengo, Inc. nor the names of its
+      contributors may be used to endorse or promote products derived from this
+      software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/BUILD.bazel b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/BUILD.bazel
new file mode 100644
index 0000000000..f694f3c0d0
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/BUILD.bazel
@@ -0,0 +1,35 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(default_visibility = ["//visibility:public"])
+
+go_library(
+    name = "httprule",
+    srcs = [
+        "compile.go",
+        "parse.go",
+        "types.go",
+    ],
+    importpath = "github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule",
+    deps = ["//utilities"],
+)
+
+go_test(
+    name = "httprule_test",
+    size = "small",
+    srcs = [
+        "compile_test.go",
+        "parse_test.go",
+        "types_test.go",
+    ],
+    embed = [":httprule"],
+    deps = [
+        "//utilities",
+        "@com_github_golang_glog//:glog",
+    ],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":httprule",
+    visibility = ["//:__subpackages__"],
+)
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/compile.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/compile.go
new file mode 100644
index 0000000000..3cd9372959
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/compile.go
@@ -0,0 +1,121 @@
+package httprule
+
+import (
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+)
+
+const (
+	opcodeVersion = 1
+)
+
+// Template is a compiled representation of path templates.
+type Template struct {
+	// Version is the version number of the format.
+	Version int
+	// OpCodes is a sequence of operations.
+	OpCodes []int
+	// Pool is a constant pool
+	Pool []string
+	// Verb is a VERB part in the template.
+	Verb string
+	// Fields is a list of field paths bound in this template.
+	Fields []string
+	// Original template (example: /v1/a_bit_of_everything)
+	Template string
+}
+
+// Compiler compiles utilities representation of path templates into marshallable operations.
+// They can be unmarshalled by runtime.NewPattern.
+type Compiler interface {
+	Compile() Template
+}
+
+type op struct {
+	// code is the opcode of the operation
+	code utilities.OpCode
+
+	// str is a string operand of the code.
+	// num is ignored if str is not empty.
+	str string
+
+	// num is a numeric operand of the code.
+	num int
+}
+
+func (w wildcard) compile() []op {
+	return []op{
+		{code: utilities.OpPush},
+	}
+}
+
+func (w deepWildcard) compile() []op {
+	return []op{
+		{code: utilities.OpPushM},
+	}
+}
+
+func (l literal) compile() []op {
+	return []op{
+		{
+			code: utilities.OpLitPush,
+			str:  string(l),
+		},
+	}
+}
+
+func (v variable) compile() []op {
+	var ops []op
+	for _, s := range v.segments {
+		ops = append(ops, s.compile()...)
+	}
+	ops = append(ops, op{
+		code: utilities.OpConcatN,
+		num:  len(v.segments),
+	}, op{
+		code: utilities.OpCapture,
+		str:  v.path,
+	})
+
+	return ops
+}
+
+func (t template) Compile() Template {
+	var rawOps []op
+	for _, s := range t.segments {
+		rawOps = append(rawOps, s.compile()...)
+	}
+
+	var (
+		ops    []int
+		pool   []string
+		fields []string
+	)
+	consts := make(map[string]int)
+	for _, op := range rawOps {
+		ops = append(ops, int(op.code))
+		if op.str == "" {
+			ops = append(ops, op.num)
+		} else {
+			// eof segment literal represents the "/" path pattern
+			if op.str == eof {
+				op.str = ""
+			}
+			if _, ok := consts[op.str]; !ok {
+				consts[op.str] = len(pool)
+				pool = append(pool, op.str)
+			}
+			ops = append(ops, consts[op.str])
+		}
+		if op.code == utilities.OpCapture {
+			fields = append(fields, op.str)
+		}
+	}
+	return Template{
+		Version:  opcodeVersion,
+		OpCodes:  ops,
+		Pool:     pool,
+		Verb:     t.verb,
+		Fields:   fields,
+		Template: t.template,
+	}
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/fuzz.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/fuzz.go
new file mode 100644
index 0000000000..138f7c12f0
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/fuzz.go
@@ -0,0 +1,11 @@
+// +build gofuzz
+
+package httprule
+
+func Fuzz(data []byte) int {
+	_, err := Parse(string(data))
+	if err != nil {
+		return 0
+	}
+	return 0
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/parse.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/parse.go
new file mode 100644
index 0000000000..5edd784e62
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/parse.go
@@ -0,0 +1,368 @@
+package httprule
+
+import (
+	"fmt"
+	"strings"
+)
+
+// InvalidTemplateError indicates that the path template is not valid.
+type InvalidTemplateError struct {
+	tmpl string
+	msg  string
+}
+
+func (e InvalidTemplateError) Error() string {
+	return fmt.Sprintf("%s: %s", e.msg, e.tmpl)
+}
+
+// Parse parses the string representation of path template
+func Parse(tmpl string) (Compiler, error) {
+	if !strings.HasPrefix(tmpl, "/") {
+		return template{}, InvalidTemplateError{tmpl: tmpl, msg: "no leading /"}
+	}
+	tokens, verb := tokenize(tmpl[1:])
+
+	p := parser{tokens: tokens}
+	segs, err := p.topLevelSegments()
+	if err != nil {
+		return template{}, InvalidTemplateError{tmpl: tmpl, msg: err.Error()}
+	}
+
+	return template{
+		segments: segs,
+		verb:     verb,
+		template: tmpl,
+	}, nil
+}
+
+func tokenize(path string) (tokens []string, verb string) {
+	if path == "" {
+		return []string{eof}, ""
+	}
+
+	const (
+		init = iota
+		field
+		nested
+	)
+	st := init
+	for path != "" {
+		var idx int
+		switch st {
+		case init:
+			idx = strings.IndexAny(path, "/{")
+		case field:
+			idx = strings.IndexAny(path, ".=}")
+		case nested:
+			idx = strings.IndexAny(path, "/}")
+		}
+		if idx < 0 {
+			tokens = append(tokens, path)
+			break
+		}
+		switch r := path[idx]; r {
+		case '/', '.':
+		case '{':
+			st = field
+		case '=':
+			st = nested
+		case '}':
+			st = init
+		}
+		if idx == 0 {
+			tokens = append(tokens, path[idx:idx+1])
+		} else {
+			tokens = append(tokens, path[:idx], path[idx:idx+1])
+		}
+		path = path[idx+1:]
+	}
+
+	l := len(tokens)
+	// See
+	// https://github.com/grpc-ecosystem/grpc-gateway/pull/1947#issuecomment-774523693 ;
+	// although normal and backwards-compat logic here is to use the last index
+	// of a colon, if the final segment is a variable followed by a colon, the
+	// part following the colon must be a verb. Hence if the previous token is
+	// an end var marker, we switch the index we're looking for to Index instead
+	// of LastIndex, so that we correctly grab the remaining part of the path as
+	// the verb.
+	var penultimateTokenIsEndVar bool
+	switch l {
+	case 0, 1:
+		// Not enough to be variable so skip this logic and don't result in an
+		// invalid index
+	default:
+		penultimateTokenIsEndVar = tokens[l-2] == "}"
+	}
+	t := tokens[l-1]
+	var idx int
+	if penultimateTokenIsEndVar {
+		idx = strings.Index(t, ":")
+	} else {
+		idx = strings.LastIndex(t, ":")
+	}
+	if idx == 0 {
+		tokens, verb = tokens[:l-1], t[1:]
+	} else if idx > 0 {
+		tokens[l-1], verb = t[:idx], t[idx+1:]
+	}
+	tokens = append(tokens, eof)
+	return tokens, verb
+}
+
+// parser is a parser of the template syntax defined in github.com/googleapis/googleapis/google/api/http.proto.
+type parser struct {
+	tokens   []string
+	accepted []string
+}
+
+// topLevelSegments is the target of this parser.
+func (p *parser) topLevelSegments() ([]segment, error) {
+	if _, err := p.accept(typeEOF); err == nil {
+		p.tokens = p.tokens[:0]
+		return []segment{literal(eof)}, nil
+	}
+	segs, err := p.segments()
+	if err != nil {
+		return nil, err
+	}
+	if _, err := p.accept(typeEOF); err != nil {
+		return nil, fmt.Errorf("unexpected token %q after segments %q", p.tokens[0], strings.Join(p.accepted, ""))
+	}
+	return segs, nil
+}
+
+func (p *parser) segments() ([]segment, error) {
+	s, err := p.segment()
+	if err != nil {
+		return nil, err
+	}
+
+	segs := []segment{s}
+	for {
+		if _, err := p.accept("/"); err != nil {
+			return segs, nil
+		}
+		s, err := p.segment()
+		if err != nil {
+			return segs, err
+		}
+		segs = append(segs, s)
+	}
+}
+
+func (p *parser) segment() (segment, error) {
+	if _, err := p.accept("*"); err == nil {
+		return wildcard{}, nil
+	}
+	if _, err := p.accept("**"); err == nil {
+		return deepWildcard{}, nil
+	}
+	if l, err := p.literal(); err == nil {
+		return l, nil
+	}
+
+	v, err := p.variable()
+	if err != nil {
+		return nil, fmt.Errorf("segment neither wildcards, literal or variable: %v", err)
+	}
+	return v, err
+}
+
+func (p *parser) literal() (segment, error) {
+	lit, err := p.accept(typeLiteral)
+	if err != nil {
+		return nil, err
+	}
+	return literal(lit), nil
+}
+
+func (p *parser) variable() (segment, error) {
+	if _, err := p.accept("{"); err != nil {
+		return nil, err
+	}
+
+	path, err := p.fieldPath()
+	if err != nil {
+		return nil, err
+	}
+
+	var segs []segment
+	if _, err := p.accept("="); err == nil {
+		segs, err = p.segments()
+		if err != nil {
+			return nil, fmt.Errorf("invalid segment in variable %q: %v", path, err)
+		}
+	} else {
+		segs = []segment{wildcard{}}
+	}
+
+	if _, err := p.accept("}"); err != nil {
+		return nil, fmt.Errorf("unterminated variable segment: %s", path)
+	}
+	return variable{
+		path:     path,
+		segments: segs,
+	}, nil
+}
+
+func (p *parser) fieldPath() (string, error) {
+	c, err := p.accept(typeIdent)
+	if err != nil {
+		return "", err
+	}
+	components := []string{c}
+	for {
+		if _, err = p.accept("."); err != nil {
+			return strings.Join(components, "."), nil
+		}
+		c, err := p.accept(typeIdent)
+		if err != nil {
+			return "", fmt.Errorf("invalid field path component: %v", err)
+		}
+		components = append(components, c)
+	}
+}
+
+// A termType is a type of terminal symbols.
+type termType string
+
+// These constants define some of valid values of termType.
+// They improve readability of parse functions.
+//
+// You can also use "/", "*", "**", "." or "=" as valid values.
+const (
+	typeIdent   = termType("ident")
+	typeLiteral = termType("literal")
+	typeEOF     = termType("$")
+)
+
+const (
+	// eof is the terminal symbol which always appears at the end of token sequence.
+	eof = "\u0000"
+)
+
+// accept tries to accept a token in "p".
+// This function consumes a token and returns it if it matches to the specified "term".
+// If it doesn't match, the function does not consume any tokens and return an error.
+func (p *parser) accept(term termType) (string, error) {
+	t := p.tokens[0]
+	switch term {
+	case "/", "*", "**", ".", "=", "{", "}":
+		if t != string(term) && t != "/" {
+			return "", fmt.Errorf("expected %q but got %q", term, t)
+		}
+	case typeEOF:
+		if t != eof {
+			return "", fmt.Errorf("expected EOF but got %q", t)
+		}
+	case typeIdent:
+		if err := expectIdent(t); err != nil {
+			return "", err
+		}
+	case typeLiteral:
+		if err := expectPChars(t); err != nil {
+			return "", err
+		}
+	default:
+		return "", fmt.Errorf("unknown termType %q", term)
+	}
+	p.tokens = p.tokens[1:]
+	p.accepted = append(p.accepted, t)
+	return t, nil
+}
+
+// expectPChars determines if "t" consists of only pchars defined in RFC3986.
+//
+// https://www.ietf.org/rfc/rfc3986.txt, P.49
+//   pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
+//   unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
+//   sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
+//                 / "*" / "+" / "," / ";" / "="
+//   pct-encoded   = "%" HEXDIG HEXDIG
+func expectPChars(t string) error {
+	const (
+		init = iota
+		pct1
+		pct2
+	)
+	st := init
+	for _, r := range t {
+		if st != init {
+			if !isHexDigit(r) {
+				return fmt.Errorf("invalid hexdigit: %c(%U)", r, r)
+			}
+			switch st {
+			case pct1:
+				st = pct2
+			case pct2:
+				st = init
+			}
+			continue
+		}
+
+		// unreserved
+		switch {
+		case 'A' <= r && r <= 'Z':
+			continue
+		case 'a' <= r && r <= 'z':
+			continue
+		case '0' <= r && r <= '9':
+			continue
+		}
+		switch r {
+		case '-', '.', '_', '~':
+			// unreserved
+		case '!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=':
+			// sub-delims
+		case ':', '@':
+			// rest of pchar
+		case '%':
+			// pct-encoded
+			st = pct1
+		default:
+			return fmt.Errorf("invalid character in path segment: %q(%U)", r, r)
+		}
+	}
+	if st != init {
+		return fmt.Errorf("invalid percent-encoding in %q", t)
+	}
+	return nil
+}
+
+// expectIdent determines if "ident" is a valid identifier in .proto schema ([[:alpha:]_][[:alphanum:]_]*).
+func expectIdent(ident string) error {
+	if ident == "" {
+		return fmt.Errorf("empty identifier")
+	}
+	for pos, r := range ident {
+		switch {
+		case '0' <= r && r <= '9':
+			if pos == 0 {
+				return fmt.Errorf("identifier starting with digit: %s", ident)
+			}
+			continue
+		case 'A' <= r && r <= 'Z':
+			continue
+		case 'a' <= r && r <= 'z':
+			continue
+		case r == '_':
+			continue
+		default:
+			return fmt.Errorf("invalid character %q(%U) in identifier: %s", r, r, ident)
+		}
+	}
+	return nil
+}
+
+func isHexDigit(r rune) bool {
+	switch {
+	case '0' <= r && r <= '9':
+		return true
+	case 'A' <= r && r <= 'F':
+		return true
+	case 'a' <= r && r <= 'f':
+		return true
+	}
+	return false
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/types.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/types.go
new file mode 100644
index 0000000000..5a814a0004
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/types.go
@@ -0,0 +1,60 @@
+package httprule
+
+import (
+	"fmt"
+	"strings"
+)
+
+type template struct {
+	segments []segment
+	verb     string
+	template string
+}
+
+type segment interface {
+	fmt.Stringer
+	compile() (ops []op)
+}
+
+type wildcard struct{}
+
+type deepWildcard struct{}
+
+type literal string
+
+type variable struct {
+	path     string
+	segments []segment
+}
+
+func (wildcard) String() string {
+	return "*"
+}
+
+func (deepWildcard) String() string {
+	return "**"
+}
+
+func (l literal) String() string {
+	return string(l)
+}
+
+func (v variable) String() string {
+	var segs []string
+	for _, s := range v.segments {
+		segs = append(segs, s.String())
+	}
+	return fmt.Sprintf("{%s=%s}", v.path, strings.Join(segs, "/"))
+}
+
+func (t template) String() string {
+	var segs []string
+	for _, s := range t.segments {
+		segs = append(segs, s.String())
+	}
+	str := strings.Join(segs, "/")
+	if t.verb != "" {
+		str = fmt.Sprintf("%s:%s", str, t.verb)
+	}
+	return "/" + str
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel
new file mode 100644
index 0000000000..95f867a528
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/BUILD.bazel
@@ -0,0 +1,91 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(default_visibility = ["//visibility:public"])
+
+go_library(
+    name = "runtime",
+    srcs = [
+        "context.go",
+        "convert.go",
+        "doc.go",
+        "errors.go",
+        "fieldmask.go",
+        "handler.go",
+        "marshal_httpbodyproto.go",
+        "marshal_json.go",
+        "marshal_jsonpb.go",
+        "marshal_proto.go",
+        "marshaler.go",
+        "marshaler_registry.go",
+        "mux.go",
+        "pattern.go",
+        "proto2_convert.go",
+        "query.go",
+    ],
+    importpath = "github.com/grpc-ecosystem/grpc-gateway/v2/runtime",
+    deps = [
+        "//internal/httprule",
+        "//utilities",
+        "@go_googleapis//google/api:httpbody_go_proto",
+        "@io_bazel_rules_go//proto/wkt:field_mask_go_proto",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//grpclog",
+        "@org_golang_google_grpc//metadata",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//encoding/protojson",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_google_protobuf//reflect/protoreflect",
+        "@org_golang_google_protobuf//reflect/protoregistry",
+        "@org_golang_google_protobuf//types/known/durationpb",
+        "@org_golang_google_protobuf//types/known/timestamppb",
+        "@org_golang_google_protobuf//types/known/wrapperspb",
+    ],
+)
+
+go_test(
+    name = "runtime_test",
+    size = "small",
+    srcs = [
+        "context_test.go",
+        "convert_test.go",
+        "errors_test.go",
+        "fieldmask_test.go",
+        "handler_test.go",
+        "marshal_httpbodyproto_test.go",
+        "marshal_json_test.go",
+        "marshal_jsonpb_test.go",
+        "marshal_proto_test.go",
+        "marshaler_registry_test.go",
+        "mux_test.go",
+        "pattern_test.go",
+        "query_test.go",
+    ],
+    embed = [":runtime"],
+    deps = [
+        "//runtime/internal/examplepb",
+        "//utilities",
+        "@com_github_google_go_cmp//cmp",
+        "@com_github_google_go_cmp//cmp/cmpopts",
+        "@go_googleapis//google/api:httpbody_go_proto",
+        "@go_googleapis//google/rpc:errdetails_go_proto",
+        "@go_googleapis//google/rpc:status_go_proto",
+        "@io_bazel_rules_go//proto/wkt:field_mask_go_proto",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//metadata",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//encoding/protojson",
+        "@org_golang_google_protobuf//proto",
+        "@org_golang_google_protobuf//testing/protocmp",
+        "@org_golang_google_protobuf//types/known/durationpb",
+        "@org_golang_google_protobuf//types/known/emptypb",
+        "@org_golang_google_protobuf//types/known/structpb",
+        "@org_golang_google_protobuf//types/known/timestamppb",
+        "@org_golang_google_protobuf//types/known/wrapperspb",
+    ],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":runtime",
+    visibility = ["//visibility:public"],
+)
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go
new file mode 100644
index 0000000000..fb57b9366e
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/context.go
@@ -0,0 +1,345 @@
+package runtime
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/http"
+	"net/textproto"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+// MetadataHeaderPrefix is the http prefix that represents custom metadata
+// parameters to or from a gRPC call.
+const MetadataHeaderPrefix = "Grpc-Metadata-"
+
+// MetadataPrefix is prepended to permanent HTTP header keys (as specified
+// by the IANA) when added to the gRPC context.
+const MetadataPrefix = "grpcgateway-"
+
+// MetadataTrailerPrefix is prepended to gRPC metadata as it is converted to
+// HTTP headers in a response handled by grpc-gateway
+const MetadataTrailerPrefix = "Grpc-Trailer-"
+
+const metadataGrpcTimeout = "Grpc-Timeout"
+const metadataHeaderBinarySuffix = "-Bin"
+
+const xForwardedFor = "X-Forwarded-For"
+const xForwardedHost = "X-Forwarded-Host"
+
+var (
+	// DefaultContextTimeout is used for gRPC call context.WithTimeout whenever a Grpc-Timeout inbound
+	// header isn't present. If the value is 0 the sent `context` will not have a timeout.
+	DefaultContextTimeout = 0 * time.Second
+)
+
+type (
+	rpcMethodKey       struct{}
+	httpPathPatternKey struct{}
+
+	AnnotateContextOption func(ctx context.Context) context.Context
+)
+
+func WithHTTPPathPattern(pattern string) AnnotateContextOption {
+	return func(ctx context.Context) context.Context {
+		return withHTTPPathPattern(ctx, pattern)
+	}
+}
+
+func decodeBinHeader(v string) ([]byte, error) {
+	if len(v)%4 == 0 {
+		// Input was padded, or padding was not necessary.
+		return base64.StdEncoding.DecodeString(v)
+	}
+	return base64.RawStdEncoding.DecodeString(v)
+}
+
+/*
+AnnotateContext adds context information such as metadata from the request.
+
+At a minimum, the RemoteAddr is included in the fashion of "X-Forwarded-For",
+except that the forwarded destination is not another HTTP service but rather
+a gRPC service.
+*/
+func AnnotateContext(ctx context.Context, mux *ServeMux, req *http.Request, rpcMethodName string, options ...AnnotateContextOption) (context.Context, error) {
+	ctx, md, err := annotateContext(ctx, mux, req, rpcMethodName, options...)
+	if err != nil {
+		return nil, err
+	}
+	if md == nil {
+		return ctx, nil
+	}
+
+	return metadata.NewOutgoingContext(ctx, md), nil
+}
+
+// AnnotateIncomingContext adds context information such as metadata from the request.
+// Attach metadata as incoming context.
+func AnnotateIncomingContext(ctx context.Context, mux *ServeMux, req *http.Request, rpcMethodName string, options ...AnnotateContextOption) (context.Context, error) {
+	ctx, md, err := annotateContext(ctx, mux, req, rpcMethodName, options...)
+	if err != nil {
+		return nil, err
+	}
+	if md == nil {
+		return ctx, nil
+	}
+
+	return metadata.NewIncomingContext(ctx, md), nil
+}
+
+func annotateContext(ctx context.Context, mux *ServeMux, req *http.Request, rpcMethodName string, options ...AnnotateContextOption) (context.Context, metadata.MD, error) {
+	ctx = withRPCMethod(ctx, rpcMethodName)
+	for _, o := range options {
+		ctx = o(ctx)
+	}
+	var pairs []string
+	timeout := DefaultContextTimeout
+	if tm := req.Header.Get(metadataGrpcTimeout); tm != "" {
+		var err error
+		timeout, err = timeoutDecode(tm)
+		if err != nil {
+			return nil, nil, status.Errorf(codes.InvalidArgument, "invalid grpc-timeout: %s", tm)
+		}
+	}
+
+	for key, vals := range req.Header {
+		key = textproto.CanonicalMIMEHeaderKey(key)
+		for _, val := range vals {
+			// For backwards-compatibility, pass through 'authorization' header with no prefix.
+			if key == "Authorization" {
+				pairs = append(pairs, "authorization", val)
+			}
+			if h, ok := mux.incomingHeaderMatcher(key); ok {
+				// Handles "-bin" metadata in grpc, since grpc will do another base64
+				// encode before sending to server, we need to decode it first.
+				if strings.HasSuffix(key, metadataHeaderBinarySuffix) {
+					b, err := decodeBinHeader(val)
+					if err != nil {
+						return nil, nil, status.Errorf(codes.InvalidArgument, "invalid binary header %s: %s", key, err)
+					}
+
+					val = string(b)
+				}
+				pairs = append(pairs, h, val)
+			}
+		}
+	}
+	if host := req.Header.Get(xForwardedHost); host != "" {
+		pairs = append(pairs, strings.ToLower(xForwardedHost), host)
+	} else if req.Host != "" {
+		pairs = append(pairs, strings.ToLower(xForwardedHost), req.Host)
+	}
+
+	if addr := req.RemoteAddr; addr != "" {
+		if remoteIP, _, err := net.SplitHostPort(addr); err == nil {
+			if fwd := req.Header.Get(xForwardedFor); fwd == "" {
+				pairs = append(pairs, strings.ToLower(xForwardedFor), remoteIP)
+			} else {
+				pairs = append(pairs, strings.ToLower(xForwardedFor), fmt.Sprintf("%s, %s", fwd, remoteIP))
+			}
+		}
+	}
+
+	if timeout != 0 {
+		//nolint:govet  // The context outlives this function
+		ctx, _ = context.WithTimeout(ctx, timeout)
+	}
+	if len(pairs) == 0 {
+		return ctx, nil, nil
+	}
+	md := metadata.Pairs(pairs...)
+	for _, mda := range mux.metadataAnnotators {
+		md = metadata.Join(md, mda(ctx, req))
+	}
+	return ctx, md, nil
+}
+
+// ServerMetadata consists of metadata sent from gRPC server.
+type ServerMetadata struct {
+	HeaderMD  metadata.MD
+	TrailerMD metadata.MD
+}
+
+type serverMetadataKey struct{}
+
+// NewServerMetadataContext creates a new context with ServerMetadata
+func NewServerMetadataContext(ctx context.Context, md ServerMetadata) context.Context {
+	return context.WithValue(ctx, serverMetadataKey{}, md)
+}
+
+// ServerMetadataFromContext returns the ServerMetadata in ctx
+func ServerMetadataFromContext(ctx context.Context) (md ServerMetadata, ok bool) {
+	md, ok = ctx.Value(serverMetadataKey{}).(ServerMetadata)
+	return
+}
+
+// ServerTransportStream implements grpc.ServerTransportStream.
+// It should only be used by the generated files to support grpc.SendHeader
+// outside of gRPC server use.
+type ServerTransportStream struct {
+	mu      sync.Mutex
+	header  metadata.MD
+	trailer metadata.MD
+}
+
+// Method returns the method for the stream.
+func (s *ServerTransportStream) Method() string {
+	return ""
+}
+
+// Header returns the header metadata of the stream.
+func (s *ServerTransportStream) Header() metadata.MD {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.header.Copy()
+}
+
+// SetHeader sets the header metadata.
+func (s *ServerTransportStream) SetHeader(md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+
+	s.mu.Lock()
+	s.header = metadata.Join(s.header, md)
+	s.mu.Unlock()
+	return nil
+}
+
+// SendHeader sets the header metadata.
+func (s *ServerTransportStream) SendHeader(md metadata.MD) error {
+	return s.SetHeader(md)
+}
+
+// Trailer returns the cached trailer metadata.
+func (s *ServerTransportStream) Trailer() metadata.MD {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.trailer.Copy()
+}
+
+// SetTrailer sets the trailer metadata.
+func (s *ServerTransportStream) SetTrailer(md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+
+	s.mu.Lock()
+	s.trailer = metadata.Join(s.trailer, md)
+	s.mu.Unlock()
+	return nil
+}
+
+func timeoutDecode(s string) (time.Duration, error) {
+	size := len(s)
+	if size < 2 {
+		return 0, fmt.Errorf("timeout string is too short: %q", s)
+	}
+	d, ok := timeoutUnitToDuration(s[size-1])
+	if !ok {
+		return 0, fmt.Errorf("timeout unit is not recognized: %q", s)
+	}
+	t, err := strconv.ParseInt(s[:size-1], 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	return d * time.Duration(t), nil
+}
+
+func timeoutUnitToDuration(u uint8) (d time.Duration, ok bool) {
+	switch u {
+	case 'H':
+		return time.Hour, true
+	case 'M':
+		return time.Minute, true
+	case 'S':
+		return time.Second, true
+	case 'm':
+		return time.Millisecond, true
+	case 'u':
+		return time.Microsecond, true
+	case 'n':
+		return time.Nanosecond, true
+	default:
+	}
+	return
+}
+
+// isPermanentHTTPHeader checks whether hdr belongs to the list of
+// permanent request headers maintained by IANA.
+// http://www.iana.org/assignments/message-headers/message-headers.xml
+func isPermanentHTTPHeader(hdr string) bool {
+	switch hdr {
+	case
+		"Accept",
+		"Accept-Charset",
+		"Accept-Language",
+		"Accept-Ranges",
+		"Authorization",
+		"Cache-Control",
+		"Content-Type",
+		"Cookie",
+		"Date",
+		"Expect",
+		"From",
+		"Host",
+		"If-Match",
+		"If-Modified-Since",
+		"If-None-Match",
+		"If-Schedule-Tag-Match",
+		"If-Unmodified-Since",
+		"Max-Forwards",
+		"Origin",
+		"Pragma",
+		"Referer",
+		"User-Agent",
+		"Via",
+		"Warning":
+		return true
+	}
+	return false
+}
+
+// RPCMethod returns the method string for the server context. The returned
+// string is in the format of "/package.service/method".
+func RPCMethod(ctx context.Context) (string, bool) {
+	m := ctx.Value(rpcMethodKey{})
+	if m == nil {
+		return "", false
+	}
+	ms, ok := m.(string)
+	if !ok {
+		return "", false
+	}
+	return ms, true
+}
+
+func withRPCMethod(ctx context.Context, rpcMethodName string) context.Context {
+	return context.WithValue(ctx, rpcMethodKey{}, rpcMethodName)
+}
+
+// HTTPPathPattern returns the HTTP path pattern string relating to the HTTP handler, if one exists.
+// The format of the returned string is defined by the google.api.http path template type.
+func HTTPPathPattern(ctx context.Context) (string, bool) {
+	m := ctx.Value(httpPathPatternKey{})
+	if m == nil {
+		return "", false
+	}
+	ms, ok := m.(string)
+	if !ok {
+		return "", false
+	}
+	return ms, true
+}
+
+func withHTTPPathPattern(ctx context.Context, httpPathPattern string) context.Context {
+	return context.WithValue(ctx, httpPathPatternKey{}, httpPathPattern)
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/convert.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/convert.go
new file mode 100644
index 0000000000..e6bc4e6cee
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/convert.go
@@ -0,0 +1,322 @@
+package runtime
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+// String just returns the given string.
+// It is just for compatibility to other types.
+func String(val string) (string, error) {
+	return val, nil
+}
+
+// StringSlice converts 'val' where individual strings are separated by
+// 'sep' into a string slice.
+func StringSlice(val, sep string) ([]string, error) {
+	return strings.Split(val, sep), nil
+}
+
+// Bool converts the given string representation of a boolean value into bool.
+func Bool(val string) (bool, error) {
+	return strconv.ParseBool(val)
+}
+
+// BoolSlice converts 'val' where individual booleans are separated by
+// 'sep' into a bool slice.
+func BoolSlice(val, sep string) ([]bool, error) {
+	s := strings.Split(val, sep)
+	values := make([]bool, len(s))
+	for i, v := range s {
+		value, err := Bool(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Float64 converts the given string representation into representation of a floating point number into float64.
+func Float64(val string) (float64, error) {
+	return strconv.ParseFloat(val, 64)
+}
+
+// Float64Slice converts 'val' where individual floating point numbers are separated by
+// 'sep' into a float64 slice.
+func Float64Slice(val, sep string) ([]float64, error) {
+	s := strings.Split(val, sep)
+	values := make([]float64, len(s))
+	for i, v := range s {
+		value, err := Float64(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Float32 converts the given string representation of a floating point number into float32.
+func Float32(val string) (float32, error) {
+	f, err := strconv.ParseFloat(val, 32)
+	if err != nil {
+		return 0, err
+	}
+	return float32(f), nil
+}
+
+// Float32Slice converts 'val' where individual floating point numbers are separated by
+// 'sep' into a float32 slice.
+func Float32Slice(val, sep string) ([]float32, error) {
+	s := strings.Split(val, sep)
+	values := make([]float32, len(s))
+	for i, v := range s {
+		value, err := Float32(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Int64 converts the given string representation of an integer into int64.
+func Int64(val string) (int64, error) {
+	return strconv.ParseInt(val, 0, 64)
+}
+
+// Int64Slice converts 'val' where individual integers are separated by
+// 'sep' into a int64 slice.
+func Int64Slice(val, sep string) ([]int64, error) {
+	s := strings.Split(val, sep)
+	values := make([]int64, len(s))
+	for i, v := range s {
+		value, err := Int64(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Int32 converts the given string representation of an integer into int32.
+func Int32(val string) (int32, error) {
+	i, err := strconv.ParseInt(val, 0, 32)
+	if err != nil {
+		return 0, err
+	}
+	return int32(i), nil
+}
+
+// Int32Slice converts 'val' where individual integers are separated by
+// 'sep' into a int32 slice.
+func Int32Slice(val, sep string) ([]int32, error) {
+	s := strings.Split(val, sep)
+	values := make([]int32, len(s))
+	for i, v := range s {
+		value, err := Int32(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Uint64 converts the given string representation of an integer into uint64.
+func Uint64(val string) (uint64, error) {
+	return strconv.ParseUint(val, 0, 64)
+}
+
+// Uint64Slice converts 'val' where individual integers are separated by
+// 'sep' into a uint64 slice.
+func Uint64Slice(val, sep string) ([]uint64, error) {
+	s := strings.Split(val, sep)
+	values := make([]uint64, len(s))
+	for i, v := range s {
+		value, err := Uint64(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Uint32 converts the given string representation of an integer into uint32.
+func Uint32(val string) (uint32, error) {
+	i, err := strconv.ParseUint(val, 0, 32)
+	if err != nil {
+		return 0, err
+	}
+	return uint32(i), nil
+}
+
+// Uint32Slice converts 'val' where individual integers are separated by
+// 'sep' into a uint32 slice.
+func Uint32Slice(val, sep string) ([]uint32, error) {
+	s := strings.Split(val, sep)
+	values := make([]uint32, len(s))
+	for i, v := range s {
+		value, err := Uint32(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Bytes converts the given string representation of a byte sequence into a slice of bytes
+// A bytes sequence is encoded in URL-safe base64 without padding
+func Bytes(val string) ([]byte, error) {
+	b, err := base64.StdEncoding.DecodeString(val)
+	if err != nil {
+		b, err = base64.URLEncoding.DecodeString(val)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return b, nil
+}
+
+// BytesSlice converts 'val' where individual bytes sequences, encoded in URL-safe
+// base64 without padding, are separated by 'sep' into a slice of bytes slices slice.
+func BytesSlice(val, sep string) ([][]byte, error) {
+	s := strings.Split(val, sep)
+	values := make([][]byte, len(s))
+	for i, v := range s {
+		value, err := Bytes(v)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+// Timestamp converts the given RFC3339 formatted string into a timestamp.Timestamp.
+func Timestamp(val string) (*timestamppb.Timestamp, error) {
+	var r timestamppb.Timestamp
+	val = strconv.Quote(strings.Trim(val, `"`))
+	unmarshaler := &protojson.UnmarshalOptions{}
+	err := unmarshaler.Unmarshal([]byte(val), &r)
+	if err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+// Duration converts the given string into a timestamp.Duration.
+func Duration(val string) (*durationpb.Duration, error) {
+	var r durationpb.Duration
+	val = strconv.Quote(strings.Trim(val, `"`))
+	unmarshaler := &protojson.UnmarshalOptions{}
+	err := unmarshaler.Unmarshal([]byte(val), &r)
+	if err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+// Enum converts the given string into an int32 that should be type casted into the
+// correct enum proto type.
+func Enum(val string, enumValMap map[string]int32) (int32, error) {
+	e, ok := enumValMap[val]
+	if ok {
+		return e, nil
+	}
+
+	i, err := Int32(val)
+	if err != nil {
+		return 0, fmt.Errorf("%s is not valid", val)
+	}
+	for _, v := range enumValMap {
+		if v == i {
+			return i, nil
+		}
+	}
+	return 0, fmt.Errorf("%s is not valid", val)
+}
+
+// EnumSlice converts 'val' where individual enums are separated by 'sep'
+// into a int32 slice. Each individual int32 should be type casted into the
+// correct enum proto type.
+func EnumSlice(val, sep string, enumValMap map[string]int32) ([]int32, error) {
+	s := strings.Split(val, sep)
+	values := make([]int32, len(s))
+	for i, v := range s {
+		value, err := Enum(v, enumValMap)
+		if err != nil {
+			return values, err
+		}
+		values[i] = value
+	}
+	return values, nil
+}
+
+/*
+	Support fot google.protobuf.wrappers on top of primitive types
+*/
+
+// StringValue well-known type support as wrapper around string type
+func StringValue(val string) (*wrapperspb.StringValue, error) {
+	return &wrapperspb.StringValue{Value: val}, nil
+}
+
+// FloatValue well-known type support as wrapper around float32 type
+func FloatValue(val string) (*wrapperspb.FloatValue, error) {
+	parsedVal, err := Float32(val)
+	return &wrapperspb.FloatValue{Value: parsedVal}, err
+}
+
+// DoubleValue well-known type support as wrapper around float64 type
+func DoubleValue(val string) (*wrapperspb.DoubleValue, error) {
+	parsedVal, err := Float64(val)
+	return &wrapperspb.DoubleValue{Value: parsedVal}, err
+}
+
+// BoolValue well-known type support as wrapper around bool type
+func BoolValue(val string) (*wrapperspb.BoolValue, error) {
+	parsedVal, err := Bool(val)
+	return &wrapperspb.BoolValue{Value: parsedVal}, err
+}
+
+// Int32Value well-known type support as wrapper around int32 type
+func Int32Value(val string) (*wrapperspb.Int32Value, error) {
+	parsedVal, err := Int32(val)
+	return &wrapperspb.Int32Value{Value: parsedVal}, err
+}
+
+// UInt32Value well-known type support as wrapper around uint32 type
+func UInt32Value(val string) (*wrapperspb.UInt32Value, error) {
+	parsedVal, err := Uint32(val)
+	return &wrapperspb.UInt32Value{Value: parsedVal}, err
+}
+
+// Int64Value well-known type support as wrapper around int64 type
+func Int64Value(val string) (*wrapperspb.Int64Value, error) {
+	parsedVal, err := Int64(val)
+	return &wrapperspb.Int64Value{Value: parsedVal}, err
+}
+
+// UInt64Value well-known type support as wrapper around uint64 type
+func UInt64Value(val string) (*wrapperspb.UInt64Value, error) {
+	parsedVal, err := Uint64(val)
+	return &wrapperspb.UInt64Value{Value: parsedVal}, err
+}
+
+// BytesValue well-known type support as wrapper around bytes[] type
+func BytesValue(val string) (*wrapperspb.BytesValue, error) {
+	parsedVal, err := Bytes(val)
+	return &wrapperspb.BytesValue{Value: parsedVal}, err
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/doc.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/doc.go
new file mode 100644
index 0000000000..b6e5ddf7a9
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/doc.go
@@ -0,0 +1,5 @@
+/*
+Package runtime contains runtime helper functions used by
+servers which protoc-gen-grpc-gateway generates.
+*/
+package runtime
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/errors.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/errors.go
new file mode 100644
index 0000000000..d9e0013c43
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/errors.go
@@ -0,0 +1,180 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/status"
+)
+
+// ErrorHandlerFunc is the signature used to configure error handling.
+type ErrorHandlerFunc func(context.Context, *ServeMux, Marshaler, http.ResponseWriter, *http.Request, error)
+
+// StreamErrorHandlerFunc is the signature used to configure stream error handling.
+type StreamErrorHandlerFunc func(context.Context, error) *status.Status
+
+// RoutingErrorHandlerFunc is the signature used to configure error handling for routing errors.
+type RoutingErrorHandlerFunc func(context.Context, *ServeMux, Marshaler, http.ResponseWriter, *http.Request, int)
+
+// HTTPStatusError is the error to use when needing to provide a different HTTP status code for an error
+// passed to the DefaultRoutingErrorHandler.
+type HTTPStatusError struct {
+	HTTPStatus int
+	Err        error
+}
+
+func (e *HTTPStatusError) Error() string {
+	return e.Err.Error()
+}
+
+// HTTPStatusFromCode converts a gRPC error code into the corresponding HTTP response status.
+// See: https://github.com/googleapis/googleapis/blob/master/google/rpc/code.proto
+func HTTPStatusFromCode(code codes.Code) int {
+	switch code {
+	case codes.OK:
+		return http.StatusOK
+	case codes.Canceled:
+		return http.StatusRequestTimeout
+	case codes.Unknown:
+		return http.StatusInternalServerError
+	case codes.InvalidArgument:
+		return http.StatusBadRequest
+	case codes.DeadlineExceeded:
+		return http.StatusGatewayTimeout
+	case codes.NotFound:
+		return http.StatusNotFound
+	case codes.AlreadyExists:
+		return http.StatusConflict
+	case codes.PermissionDenied:
+		return http.StatusForbidden
+	case codes.Unauthenticated:
+		return http.StatusUnauthorized
+	case codes.ResourceExhausted:
+		return http.StatusTooManyRequests
+	case codes.FailedPrecondition:
+		// Note, this deliberately doesn't translate to the similarly named '412 Precondition Failed' HTTP response status.
+		return http.StatusBadRequest
+	case codes.Aborted:
+		return http.StatusConflict
+	case codes.OutOfRange:
+		return http.StatusBadRequest
+	case codes.Unimplemented:
+		return http.StatusNotImplemented
+	case codes.Internal:
+		return http.StatusInternalServerError
+	case codes.Unavailable:
+		return http.StatusServiceUnavailable
+	case codes.DataLoss:
+		return http.StatusInternalServerError
+	}
+
+	grpclog.Infof("Unknown gRPC error code: %v", code)
+	return http.StatusInternalServerError
+}
+
+// HTTPError uses the mux-configured error handler.
+func HTTPError(ctx context.Context, mux *ServeMux, marshaler Marshaler, w http.ResponseWriter, r *http.Request, err error) {
+	mux.errorHandler(ctx, mux, marshaler, w, r, err)
+}
+
+// DefaultHTTPErrorHandler is the default error handler.
+// If "err" is a gRPC Status, the function replies with the status code mapped by HTTPStatusFromCode.
+// If "err" is a HTTPStatusError, the function replies with the status code provide by that struct. This is
+// intended to allow passing through of specific statuses via the function set via WithRoutingErrorHandler
+// for the ServeMux constructor to handle edge cases which the standard mappings in HTTPStatusFromCode
+// are insufficient for.
+// If otherwise, it replies with http.StatusInternalServerError.
+//
+// The response body written by this function is a Status message marshaled by the Marshaler.
+func DefaultHTTPErrorHandler(ctx context.Context, mux *ServeMux, marshaler Marshaler, w http.ResponseWriter, r *http.Request, err error) {
+	// return Internal when Marshal failed
+	const fallback = `{"code": 13, "message": "failed to marshal error message"}`
+
+	var customStatus *HTTPStatusError
+	if errors.As(err, &customStatus) {
+		err = customStatus.Err
+	}
+
+	s := status.Convert(err)
+	pb := s.Proto()
+
+	w.Header().Del("Trailer")
+	w.Header().Del("Transfer-Encoding")
+
+	contentType := marshaler.ContentType(pb)
+	w.Header().Set("Content-Type", contentType)
+
+	if s.Code() == codes.Unauthenticated {
+		w.Header().Set("WWW-Authenticate", s.Message())
+	}
+
+	buf, merr := marshaler.Marshal(pb)
+	if merr != nil {
+		grpclog.Infof("Failed to marshal error message %q: %v", s, merr)
+		w.WriteHeader(http.StatusInternalServerError)
+		if _, err := io.WriteString(w, fallback); err != nil {
+			grpclog.Infof("Failed to write response: %v", err)
+		}
+		return
+	}
+
+	md, ok := ServerMetadataFromContext(ctx)
+	if !ok {
+		grpclog.Infof("Failed to extract ServerMetadata from context")
+	}
+
+	handleForwardResponseServerMetadata(w, mux, md)
+
+	// RFC 7230 https://tools.ietf.org/html/rfc7230#section-4.1.2
+	// Unless the request includes a TE header field indicating "trailers"
+	// is acceptable, as described in Section 4.3, a server SHOULD NOT
+	// generate trailer fields that it believes are necessary for the user
+	// agent to receive.
+	doForwardTrailers := requestAcceptsTrailers(r)
+
+	if doForwardTrailers {
+		handleForwardResponseTrailerHeader(w, md)
+		w.Header().Set("Transfer-Encoding", "chunked")
+	}
+
+	st := HTTPStatusFromCode(s.Code())
+	if customStatus != nil {
+		st = customStatus.HTTPStatus
+	}
+
+	w.WriteHeader(st)
+	if _, err := w.Write(buf); err != nil {
+		grpclog.Infof("Failed to write response: %v", err)
+	}
+
+	if doForwardTrailers {
+		handleForwardResponseTrailer(w, md)
+	}
+}
+
+func DefaultStreamErrorHandler(_ context.Context, err error) *status.Status {
+	return status.Convert(err)
+}
+
+// DefaultRoutingErrorHandler is our default handler for routing errors.
+// By default http error codes mapped on the following error codes:
+//   NotFound -> grpc.NotFound
+//   StatusBadRequest -> grpc.InvalidArgument
+//   MethodNotAllowed -> grpc.Unimplemented
+//   Other -> grpc.Internal, method is not expecting to be called for anything else
+func DefaultRoutingErrorHandler(ctx context.Context, mux *ServeMux, marshaler Marshaler, w http.ResponseWriter, r *http.Request, httpStatus int) {
+	sterr := status.Error(codes.Internal, "Unexpected routing error")
+	switch httpStatus {
+	case http.StatusBadRequest:
+		sterr = status.Error(codes.InvalidArgument, http.StatusText(httpStatus))
+	case http.StatusMethodNotAllowed:
+		sterr = status.Error(codes.Unimplemented, http.StatusText(httpStatus))
+	case http.StatusNotFound:
+		sterr = status.Error(codes.NotFound, http.StatusText(httpStatus))
+	}
+	mux.errorHandler(ctx, mux, marshaler, w, r, sterr)
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/fieldmask.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/fieldmask.go
new file mode 100644
index 0000000000..0138ed2f76
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/fieldmask.go
@@ -0,0 +1,165 @@
+package runtime
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+
+	"google.golang.org/genproto/protobuf/field_mask"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+)
+
+func getFieldByName(fields protoreflect.FieldDescriptors, name string) protoreflect.FieldDescriptor {
+	fd := fields.ByName(protoreflect.Name(name))
+	if fd != nil {
+		return fd
+	}
+
+	return fields.ByJSONName(name)
+}
+
+// FieldMaskFromRequestBody creates a FieldMask printing all complete paths from the JSON body.
+func FieldMaskFromRequestBody(r io.Reader, msg proto.Message) (*field_mask.FieldMask, error) {
+	fm := &field_mask.FieldMask{}
+	var root interface{}
+
+	if err := json.NewDecoder(r).Decode(&root); err != nil {
+		if err == io.EOF {
+			return fm, nil
+		}
+		return nil, err
+	}
+
+	queue := []fieldMaskPathItem{{node: root, msg: msg.ProtoReflect()}}
+	for len(queue) > 0 {
+		// dequeue an item
+		item := queue[0]
+		queue = queue[1:]
+
+		m, ok := item.node.(map[string]interface{})
+		switch {
+		case ok:
+			// if the item is an object, then enqueue all of its children
+			for k, v := range m {
+				if item.msg == nil {
+					return nil, fmt.Errorf("JSON structure did not match request type")
+				}
+
+				fd := getFieldByName(item.msg.Descriptor().Fields(), k)
+				if fd == nil {
+					return nil, fmt.Errorf("could not find field %q in %q", k, item.msg.Descriptor().FullName())
+				}
+
+				if isDynamicProtoMessage(fd.Message()) {
+					for _, p := range buildPathsBlindly(k, v) {
+						newPath := p
+						if item.path != "" {
+							newPath = item.path + "." + newPath
+						}
+						queue = append(queue, fieldMaskPathItem{path: newPath})
+					}
+					continue
+				}
+
+				if isProtobufAnyMessage(fd.Message()) {
+					_, hasTypeField := v.(map[string]interface{})["@type"]
+					if hasTypeField {
+						queue = append(queue, fieldMaskPathItem{path: k})
+						continue
+					} else {
+						return nil, fmt.Errorf("could not find field @type in %q in message %q", k, item.msg.Descriptor().FullName())
+					}
+
+				}
+
+				child := fieldMaskPathItem{
+					node: v,
+				}
+				if item.path == "" {
+					child.path = string(fd.FullName().Name())
+				} else {
+					child.path = item.path + "." + string(fd.FullName().Name())
+				}
+
+				switch {
+				case fd.IsList(), fd.IsMap():
+					// As per: https://github.com/protocolbuffers/protobuf/blob/master/src/google/protobuf/field_mask.proto#L85-L86
+					// Do not recurse into repeated fields. The repeated field goes on the end of the path and we stop.
+					fm.Paths = append(fm.Paths, child.path)
+				case fd.Message() != nil:
+					child.msg = item.msg.Get(fd).Message()
+					fallthrough
+				default:
+					queue = append(queue, child)
+				}
+			}
+		case len(item.path) > 0:
+			// otherwise, it's a leaf node so print its path
+			fm.Paths = append(fm.Paths, item.path)
+		}
+	}
+
+	// Sort for deterministic output in the presence
+	// of repeated fields.
+	sort.Strings(fm.Paths)
+
+	return fm, nil
+}
+
+func isProtobufAnyMessage(md protoreflect.MessageDescriptor) bool {
+	return md != nil && (md.FullName() == "google.protobuf.Any")
+}
+
+func isDynamicProtoMessage(md protoreflect.MessageDescriptor) bool {
+	return md != nil && (md.FullName() == "google.protobuf.Struct" || md.FullName() == "google.protobuf.Value")
+}
+
+// buildPathsBlindly does not attempt to match proto field names to the
+// json value keys.  Instead it relies completely on the structure of
+// the unmarshalled json contained within in.
+// Returns a slice containing all subpaths with the root at the
+// passed in name and json value.
+func buildPathsBlindly(name string, in interface{}) []string {
+	m, ok := in.(map[string]interface{})
+	if !ok {
+		return []string{name}
+	}
+
+	var paths []string
+	queue := []fieldMaskPathItem{{path: name, node: m}}
+	for len(queue) > 0 {
+		cur := queue[0]
+		queue = queue[1:]
+
+		m, ok := cur.node.(map[string]interface{})
+		if !ok {
+			// This should never happen since we should always check that we only add
+			// nodes of type map[string]interface{} to the queue.
+			continue
+		}
+		for k, v := range m {
+			if mi, ok := v.(map[string]interface{}); ok {
+				queue = append(queue, fieldMaskPathItem{path: cur.path + "." + k, node: mi})
+			} else {
+				// This is not a struct, so there are no more levels to descend.
+				curPath := cur.path + "." + k
+				paths = append(paths, curPath)
+			}
+		}
+	}
+	return paths
+}
+
+// fieldMaskPathItem stores a in-progress deconstruction of a path for a fieldmask
+type fieldMaskPathItem struct {
+	// the list of prior fields leading up to node connected by dots
+	path string
+
+	// a generic decoded json object the current item to inspect for further path extraction
+	node interface{}
+
+	// parent message
+	msg protoreflect.Message
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go
new file mode 100644
index 0000000000..d1e21df481
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/handler.go
@@ -0,0 +1,223 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/textproto"
+	"strings"
+
+	"google.golang.org/genproto/googleapis/api/httpbody"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// ForwardResponseStream forwards the stream from gRPC server to REST client.
+func ForwardResponseStream(ctx context.Context, mux *ServeMux, marshaler Marshaler, w http.ResponseWriter, req *http.Request, recv func() (proto.Message, error), opts ...func(context.Context, http.ResponseWriter, proto.Message) error) {
+	f, ok := w.(http.Flusher)
+	if !ok {
+		grpclog.Infof("Flush not supported in %T", w)
+		http.Error(w, "unexpected type of web server", http.StatusInternalServerError)
+		return
+	}
+
+	md, ok := ServerMetadataFromContext(ctx)
+	if !ok {
+		grpclog.Infof("Failed to extract ServerMetadata from context")
+		http.Error(w, "unexpected error", http.StatusInternalServerError)
+		return
+	}
+	handleForwardResponseServerMetadata(w, mux, md)
+
+	w.Header().Set("Transfer-Encoding", "chunked")
+	if err := handleForwardResponseOptions(ctx, w, nil, opts); err != nil {
+		HTTPError(ctx, mux, marshaler, w, req, err)
+		return
+	}
+
+	var delimiter []byte
+	if d, ok := marshaler.(Delimited); ok {
+		delimiter = d.Delimiter()
+	} else {
+		delimiter = []byte("\n")
+	}
+
+	var wroteHeader bool
+	for {
+		resp, err := recv()
+		if err == io.EOF {
+			return
+		}
+		if err != nil {
+			handleForwardResponseStreamError(ctx, wroteHeader, marshaler, w, req, mux, err)
+			return
+		}
+		if err := handleForwardResponseOptions(ctx, w, resp, opts); err != nil {
+			handleForwardResponseStreamError(ctx, wroteHeader, marshaler, w, req, mux, err)
+			return
+		}
+
+		if !wroteHeader {
+			w.Header().Set("Content-Type", marshaler.ContentType(resp))
+		}
+
+		var buf []byte
+		httpBody, isHTTPBody := resp.(*httpbody.HttpBody)
+		switch {
+		case resp == nil:
+			buf, err = marshaler.Marshal(errorChunk(status.New(codes.Internal, "empty response")))
+		case isHTTPBody:
+			buf = httpBody.GetData()
+		default:
+			result := map[string]interface{}{"result": resp}
+			if rb, ok := resp.(responseBody); ok {
+				result["result"] = rb.XXX_ResponseBody()
+			}
+
+			buf, err = marshaler.Marshal(result)
+		}
+
+		if err != nil {
+			grpclog.Infof("Failed to marshal response chunk: %v", err)
+			handleForwardResponseStreamError(ctx, wroteHeader, marshaler, w, req, mux, err)
+			return
+		}
+		if _, err = w.Write(buf); err != nil {
+			grpclog.Infof("Failed to send response chunk: %v", err)
+			return
+		}
+		wroteHeader = true
+		if _, err = w.Write(delimiter); err != nil {
+			grpclog.Infof("Failed to send delimiter chunk: %v", err)
+			return
+		}
+		f.Flush()
+	}
+}
+
+func handleForwardResponseServerMetadata(w http.ResponseWriter, mux *ServeMux, md ServerMetadata) {
+	for k, vs := range md.HeaderMD {
+		if h, ok := mux.outgoingHeaderMatcher(k); ok {
+			for _, v := range vs {
+				w.Header().Add(h, v)
+			}
+		}
+	}
+}
+
+func handleForwardResponseTrailerHeader(w http.ResponseWriter, md ServerMetadata) {
+	for k := range md.TrailerMD {
+		tKey := textproto.CanonicalMIMEHeaderKey(fmt.Sprintf("%s%s", MetadataTrailerPrefix, k))
+		w.Header().Add("Trailer", tKey)
+	}
+}
+
+func handleForwardResponseTrailer(w http.ResponseWriter, md ServerMetadata) {
+	for k, vs := range md.TrailerMD {
+		tKey := fmt.Sprintf("%s%s", MetadataTrailerPrefix, k)
+		for _, v := range vs {
+			w.Header().Add(tKey, v)
+		}
+	}
+}
+
+// responseBody interface contains method for getting field for marshaling to the response body
+// this method is generated for response struct from the value of `response_body` in the `google.api.HttpRule`
+type responseBody interface {
+	XXX_ResponseBody() interface{}
+}
+
+// ForwardResponseMessage forwards the message "resp" from gRPC server to REST client.
+func ForwardResponseMessage(ctx context.Context, mux *ServeMux, marshaler Marshaler, w http.ResponseWriter, req *http.Request, resp proto.Message, opts ...func(context.Context, http.ResponseWriter, proto.Message) error) {
+	md, ok := ServerMetadataFromContext(ctx)
+	if !ok {
+		grpclog.Infof("Failed to extract ServerMetadata from context")
+	}
+
+	handleForwardResponseServerMetadata(w, mux, md)
+
+	// RFC 7230 https://tools.ietf.org/html/rfc7230#section-4.1.2
+	// Unless the request includes a TE header field indicating "trailers"
+	// is acceptable, as described in Section 4.3, a server SHOULD NOT
+	// generate trailer fields that it believes are necessary for the user
+	// agent to receive.
+	doForwardTrailers := requestAcceptsTrailers(req)
+
+	if doForwardTrailers {
+		handleForwardResponseTrailerHeader(w, md)
+		w.Header().Set("Transfer-Encoding", "chunked")
+	}
+
+	handleForwardResponseTrailerHeader(w, md)
+
+	contentType := marshaler.ContentType(resp)
+	w.Header().Set("Content-Type", contentType)
+
+	if err := handleForwardResponseOptions(ctx, w, resp, opts); err != nil {
+		HTTPError(ctx, mux, marshaler, w, req, err)
+		return
+	}
+	var buf []byte
+	var err error
+	if rb, ok := resp.(responseBody); ok {
+		buf, err = marshaler.Marshal(rb.XXX_ResponseBody())
+	} else {
+		buf, err = marshaler.Marshal(resp)
+	}
+	if err != nil {
+		grpclog.Infof("Marshal error: %v", err)
+		HTTPError(ctx, mux, marshaler, w, req, err)
+		return
+	}
+
+	if _, err = w.Write(buf); err != nil {
+		grpclog.Infof("Failed to write response: %v", err)
+	}
+
+	if doForwardTrailers {
+		handleForwardResponseTrailer(w, md)
+	}
+}
+
+func requestAcceptsTrailers(req *http.Request) bool {
+	te := req.Header.Get("TE")
+	return strings.Contains(strings.ToLower(te), "trailers")
+}
+
+func handleForwardResponseOptions(ctx context.Context, w http.ResponseWriter, resp proto.Message, opts []func(context.Context, http.ResponseWriter, proto.Message) error) error {
+	if len(opts) == 0 {
+		return nil
+	}
+	for _, opt := range opts {
+		if err := opt(ctx, w, resp); err != nil {
+			grpclog.Infof("Error handling ForwardResponseOptions: %v", err)
+			return err
+		}
+	}
+	return nil
+}
+
+func handleForwardResponseStreamError(ctx context.Context, wroteHeader bool, marshaler Marshaler, w http.ResponseWriter, req *http.Request, mux *ServeMux, err error) {
+	st := mux.streamErrorHandler(ctx, err)
+	msg := errorChunk(st)
+	if !wroteHeader {
+		w.Header().Set("Content-Type", marshaler.ContentType(msg))
+		w.WriteHeader(HTTPStatusFromCode(st.Code()))
+	}
+	buf, merr := marshaler.Marshal(msg)
+	if merr != nil {
+		grpclog.Infof("Failed to marshal an error: %v", merr)
+		return
+	}
+	if _, werr := w.Write(buf); werr != nil {
+		grpclog.Infof("Failed to notify error to client: %v", werr)
+		return
+	}
+}
+
+func errorChunk(st *status.Status) map[string]proto.Message {
+	return map[string]proto.Message{"error": st.Proto()}
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_httpbodyproto.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_httpbodyproto.go
new file mode 100644
index 0000000000..b86135c889
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_httpbodyproto.go
@@ -0,0 +1,32 @@
+package runtime
+
+import (
+	"google.golang.org/genproto/googleapis/api/httpbody"
+)
+
+// HTTPBodyMarshaler is a Marshaler which supports marshaling of a
+// google.api.HttpBody message as the full response body if it is
+// the actual message used as the response. If not, then this will
+// simply fallback to the Marshaler specified as its default Marshaler.
+type HTTPBodyMarshaler struct {
+	Marshaler
+}
+
+// ContentType returns its specified content type in case v is a
+// google.api.HttpBody message, otherwise it will fall back to the default Marshalers
+// content type.
+func (h *HTTPBodyMarshaler) ContentType(v interface{}) string {
+	if httpBody, ok := v.(*httpbody.HttpBody); ok {
+		return httpBody.GetContentType()
+	}
+	return h.Marshaler.ContentType(v)
+}
+
+// Marshal marshals "v" by returning the body bytes if v is a
+// google.api.HttpBody message, otherwise it falls back to the default Marshaler.
+func (h *HTTPBodyMarshaler) Marshal(v interface{}) ([]byte, error) {
+	if httpBody, ok := v.(*httpbody.HttpBody); ok {
+		return httpBody.Data, nil
+	}
+	return h.Marshaler.Marshal(v)
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_json.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_json.go
new file mode 100644
index 0000000000..d6aa825783
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_json.go
@@ -0,0 +1,45 @@
+package runtime
+
+import (
+	"encoding/json"
+	"io"
+)
+
+// JSONBuiltin is a Marshaler which marshals/unmarshals into/from JSON
+// with the standard "encoding/json" package of Golang.
+// Although it is generally faster for simple proto messages than JSONPb,
+// it does not support advanced features of protobuf, e.g. map, oneof, ....
+//
+// The NewEncoder and NewDecoder types return *json.Encoder and
+// *json.Decoder respectively.
+type JSONBuiltin struct{}
+
+// ContentType always Returns "application/json".
+func (*JSONBuiltin) ContentType(_ interface{}) string {
+	return "application/json"
+}
+
+// Marshal marshals "v" into JSON
+func (j *JSONBuiltin) Marshal(v interface{}) ([]byte, error) {
+	return json.Marshal(v)
+}
+
+// Unmarshal unmarshals JSON data into "v".
+func (j *JSONBuiltin) Unmarshal(data []byte, v interface{}) error {
+	return json.Unmarshal(data, v)
+}
+
+// NewDecoder returns a Decoder which reads JSON stream from "r".
+func (j *JSONBuiltin) NewDecoder(r io.Reader) Decoder {
+	return json.NewDecoder(r)
+}
+
+// NewEncoder returns an Encoder which writes JSON stream into "w".
+func (j *JSONBuiltin) NewEncoder(w io.Writer) Encoder {
+	return json.NewEncoder(w)
+}
+
+// Delimiter for newline encoded JSON streams.
+func (j *JSONBuiltin) Delimiter() []byte {
+	return []byte("\n")
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go
new file mode 100644
index 0000000000..7387c8e397
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_jsonpb.go
@@ -0,0 +1,344 @@
+package runtime
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"reflect"
+	"strconv"
+
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+)
+
+// JSONPb is a Marshaler which marshals/unmarshals into/from JSON
+// with the "google.golang.org/protobuf/encoding/protojson" marshaler.
+// It supports the full functionality of protobuf unlike JSONBuiltin.
+//
+// The NewDecoder method returns a DecoderWrapper, so the underlying
+// *json.Decoder methods can be used.
+type JSONPb struct {
+	protojson.MarshalOptions
+	protojson.UnmarshalOptions
+}
+
+// ContentType always returns "application/json".
+func (*JSONPb) ContentType(_ interface{}) string {
+	return "application/json"
+}
+
+// Marshal marshals "v" into JSON.
+func (j *JSONPb) Marshal(v interface{}) ([]byte, error) {
+	if _, ok := v.(proto.Message); !ok {
+		return j.marshalNonProtoField(v)
+	}
+
+	var buf bytes.Buffer
+	if err := j.marshalTo(&buf, v); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+func (j *JSONPb) marshalTo(w io.Writer, v interface{}) error {
+	p, ok := v.(proto.Message)
+	if !ok {
+		buf, err := j.marshalNonProtoField(v)
+		if err != nil {
+			return err
+		}
+		_, err = w.Write(buf)
+		return err
+	}
+	b, err := j.MarshalOptions.Marshal(p)
+	if err != nil {
+		return err
+	}
+
+	_, err = w.Write(b)
+	return err
+}
+
+var (
+	// protoMessageType is stored to prevent constant lookup of the same type at runtime.
+	protoMessageType = reflect.TypeOf((*proto.Message)(nil)).Elem()
+)
+
+// marshalNonProto marshals a non-message field of a protobuf message.
+// This function does not correctly marshal arbitrary data structures into JSON,
+// it is only capable of marshaling non-message field values of protobuf,
+// i.e. primitive types, enums; pointers to primitives or enums; maps from
+// integer/string types to primitives/enums/pointers to messages.
+func (j *JSONPb) marshalNonProtoField(v interface{}) ([]byte, error) {
+	if v == nil {
+		return []byte("null"), nil
+	}
+	rv := reflect.ValueOf(v)
+	for rv.Kind() == reflect.Ptr {
+		if rv.IsNil() {
+			return []byte("null"), nil
+		}
+		rv = rv.Elem()
+	}
+
+	if rv.Kind() == reflect.Slice {
+		if rv.IsNil() {
+			if j.EmitUnpopulated {
+				return []byte("[]"), nil
+			}
+			return []byte("null"), nil
+		}
+
+		if rv.Type().Elem().Implements(protoMessageType) {
+			var buf bytes.Buffer
+			err := buf.WriteByte('[')
+			if err != nil {
+				return nil, err
+			}
+			for i := 0; i < rv.Len(); i++ {
+				if i != 0 {
+					err = buf.WriteByte(',')
+					if err != nil {
+						return nil, err
+					}
+				}
+				if err = j.marshalTo(&buf, rv.Index(i).Interface().(proto.Message)); err != nil {
+					return nil, err
+				}
+			}
+			err = buf.WriteByte(']')
+			if err != nil {
+				return nil, err
+			}
+
+			return buf.Bytes(), nil
+		}
+
+		if rv.Type().Elem().Implements(typeProtoEnum) {
+			var buf bytes.Buffer
+			err := buf.WriteByte('[')
+			if err != nil {
+				return nil, err
+			}
+			for i := 0; i < rv.Len(); i++ {
+				if i != 0 {
+					err = buf.WriteByte(',')
+					if err != nil {
+						return nil, err
+					}
+				}
+				if j.UseEnumNumbers {
+					_, err = buf.WriteString(strconv.FormatInt(rv.Index(i).Int(), 10))
+				} else {
+					_, err = buf.WriteString("\"" + rv.Index(i).Interface().(protoEnum).String() + "\"")
+				}
+				if err != nil {
+					return nil, err
+				}
+			}
+			err = buf.WriteByte(']')
+			if err != nil {
+				return nil, err
+			}
+
+			return buf.Bytes(), nil
+		}
+	}
+
+	if rv.Kind() == reflect.Map {
+		m := make(map[string]*json.RawMessage)
+		for _, k := range rv.MapKeys() {
+			buf, err := j.Marshal(rv.MapIndex(k).Interface())
+			if err != nil {
+				return nil, err
+			}
+			m[fmt.Sprintf("%v", k.Interface())] = (*json.RawMessage)(&buf)
+		}
+		if j.Indent != "" {
+			return json.MarshalIndent(m, "", j.Indent)
+		}
+		return json.Marshal(m)
+	}
+	if enum, ok := rv.Interface().(protoEnum); ok && !j.UseEnumNumbers {
+		return json.Marshal(enum.String())
+	}
+	return json.Marshal(rv.Interface())
+}
+
+// Unmarshal unmarshals JSON "data" into "v"
+func (j *JSONPb) Unmarshal(data []byte, v interface{}) error {
+	return unmarshalJSONPb(data, j.UnmarshalOptions, v)
+}
+
+// NewDecoder returns a Decoder which reads JSON stream from "r".
+func (j *JSONPb) NewDecoder(r io.Reader) Decoder {
+	d := json.NewDecoder(r)
+	return DecoderWrapper{
+		Decoder:          d,
+		UnmarshalOptions: j.UnmarshalOptions,
+	}
+}
+
+// DecoderWrapper is a wrapper around a *json.Decoder that adds
+// support for protos to the Decode method.
+type DecoderWrapper struct {
+	*json.Decoder
+	protojson.UnmarshalOptions
+}
+
+// Decode wraps the embedded decoder's Decode method to support
+// protos using a jsonpb.Unmarshaler.
+func (d DecoderWrapper) Decode(v interface{}) error {
+	return decodeJSONPb(d.Decoder, d.UnmarshalOptions, v)
+}
+
+// NewEncoder returns an Encoder which writes JSON stream into "w".
+func (j *JSONPb) NewEncoder(w io.Writer) Encoder {
+	return EncoderFunc(func(v interface{}) error {
+		if err := j.marshalTo(w, v); err != nil {
+			return err
+		}
+		// mimic json.Encoder by adding a newline (makes output
+		// easier to read when it contains multiple encoded items)
+		_, err := w.Write(j.Delimiter())
+		return err
+	})
+}
+
+func unmarshalJSONPb(data []byte, unmarshaler protojson.UnmarshalOptions, v interface{}) error {
+	d := json.NewDecoder(bytes.NewReader(data))
+	return decodeJSONPb(d, unmarshaler, v)
+}
+
+func decodeJSONPb(d *json.Decoder, unmarshaler protojson.UnmarshalOptions, v interface{}) error {
+	p, ok := v.(proto.Message)
+	if !ok {
+		return decodeNonProtoField(d, unmarshaler, v)
+	}
+
+	// Decode into bytes for marshalling
+	var b json.RawMessage
+	err := d.Decode(&b)
+	if err != nil {
+		return err
+	}
+
+	return unmarshaler.Unmarshal([]byte(b), p)
+}
+
+func decodeNonProtoField(d *json.Decoder, unmarshaler protojson.UnmarshalOptions, v interface{}) error {
+	rv := reflect.ValueOf(v)
+	if rv.Kind() != reflect.Ptr {
+		return fmt.Errorf("%T is not a pointer", v)
+	}
+	for rv.Kind() == reflect.Ptr {
+		if rv.IsNil() {
+			rv.Set(reflect.New(rv.Type().Elem()))
+		}
+		if rv.Type().ConvertibleTo(typeProtoMessage) {
+			// Decode into bytes for marshalling
+			var b json.RawMessage
+			err := d.Decode(&b)
+			if err != nil {
+				return err
+			}
+
+			return unmarshaler.Unmarshal([]byte(b), rv.Interface().(proto.Message))
+		}
+		rv = rv.Elem()
+	}
+	if rv.Kind() == reflect.Map {
+		if rv.IsNil() {
+			rv.Set(reflect.MakeMap(rv.Type()))
+		}
+		conv, ok := convFromType[rv.Type().Key().Kind()]
+		if !ok {
+			return fmt.Errorf("unsupported type of map field key: %v", rv.Type().Key())
+		}
+
+		m := make(map[string]*json.RawMessage)
+		if err := d.Decode(&m); err != nil {
+			return err
+		}
+		for k, v := range m {
+			result := conv.Call([]reflect.Value{reflect.ValueOf(k)})
+			if err := result[1].Interface(); err != nil {
+				return err.(error)
+			}
+			bk := result[0]
+			bv := reflect.New(rv.Type().Elem())
+			if v == nil {
+				null := json.RawMessage("null")
+				v = &null
+			}
+			if err := unmarshalJSONPb([]byte(*v), unmarshaler, bv.Interface()); err != nil {
+				return err
+			}
+			rv.SetMapIndex(bk, bv.Elem())
+		}
+		return nil
+	}
+	if rv.Kind() == reflect.Slice {
+		var sl []json.RawMessage
+		if err := d.Decode(&sl); err != nil {
+			return err
+		}
+		if sl != nil {
+			rv.Set(reflect.MakeSlice(rv.Type(), 0, 0))
+		}
+		for _, item := range sl {
+			bv := reflect.New(rv.Type().Elem())
+			if err := unmarshalJSONPb([]byte(item), unmarshaler, bv.Interface()); err != nil {
+				return err
+			}
+			rv.Set(reflect.Append(rv, bv.Elem()))
+		}
+		return nil
+	}
+	if _, ok := rv.Interface().(protoEnum); ok {
+		var repr interface{}
+		if err := d.Decode(&repr); err != nil {
+			return err
+		}
+		switch v := repr.(type) {
+		case string:
+			// TODO(yugui) Should use proto.StructProperties?
+			return fmt.Errorf("unmarshaling of symbolic enum %q not supported: %T", repr, rv.Interface())
+		case float64:
+			rv.Set(reflect.ValueOf(int32(v)).Convert(rv.Type()))
+			return nil
+		default:
+			return fmt.Errorf("cannot assign %#v into Go type %T", repr, rv.Interface())
+		}
+	}
+	return d.Decode(v)
+}
+
+type protoEnum interface {
+	fmt.Stringer
+	EnumDescriptor() ([]byte, []int)
+}
+
+var typeProtoEnum = reflect.TypeOf((*protoEnum)(nil)).Elem()
+
+var typeProtoMessage = reflect.TypeOf((*proto.Message)(nil)).Elem()
+
+// Delimiter for newline encoded JSON streams.
+func (j *JSONPb) Delimiter() []byte {
+	return []byte("\n")
+}
+
+var (
+	convFromType = map[reflect.Kind]reflect.Value{
+		reflect.String:  reflect.ValueOf(String),
+		reflect.Bool:    reflect.ValueOf(Bool),
+		reflect.Float64: reflect.ValueOf(Float64),
+		reflect.Float32: reflect.ValueOf(Float32),
+		reflect.Int64:   reflect.ValueOf(Int64),
+		reflect.Int32:   reflect.ValueOf(Int32),
+		reflect.Uint64:  reflect.ValueOf(Uint64),
+		reflect.Uint32:  reflect.ValueOf(Uint32),
+		reflect.Slice:   reflect.ValueOf(Bytes),
+	}
+)
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_proto.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_proto.go
new file mode 100644
index 0000000000..007f8f1a2c
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshal_proto.go
@@ -0,0 +1,63 @@
+package runtime
+
+import (
+	"io"
+
+	"errors"
+	"io/ioutil"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// ProtoMarshaller is a Marshaller which marshals/unmarshals into/from serialize proto bytes
+type ProtoMarshaller struct{}
+
+// ContentType always returns "application/octet-stream".
+func (*ProtoMarshaller) ContentType(_ interface{}) string {
+	return "application/octet-stream"
+}
+
+// Marshal marshals "value" into Proto
+func (*ProtoMarshaller) Marshal(value interface{}) ([]byte, error) {
+	message, ok := value.(proto.Message)
+	if !ok {
+		return nil, errors.New("unable to marshal non proto field")
+	}
+	return proto.Marshal(message)
+}
+
+// Unmarshal unmarshals proto "data" into "value"
+func (*ProtoMarshaller) Unmarshal(data []byte, value interface{}) error {
+	message, ok := value.(proto.Message)
+	if !ok {
+		return errors.New("unable to unmarshal non proto field")
+	}
+	return proto.Unmarshal(data, message)
+}
+
+// NewDecoder returns a Decoder which reads proto stream from "reader".
+func (marshaller *ProtoMarshaller) NewDecoder(reader io.Reader) Decoder {
+	return DecoderFunc(func(value interface{}) error {
+		buffer, err := ioutil.ReadAll(reader)
+		if err != nil {
+			return err
+		}
+		return marshaller.Unmarshal(buffer, value)
+	})
+}
+
+// NewEncoder returns an Encoder which writes proto stream into "writer".
+func (marshaller *ProtoMarshaller) NewEncoder(writer io.Writer) Encoder {
+	return EncoderFunc(func(value interface{}) error {
+		buffer, err := marshaller.Marshal(value)
+		if err != nil {
+			return err
+		}
+		_, err = writer.Write(buffer)
+		if err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler.go
new file mode 100644
index 0000000000..2c0d25ff49
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler.go
@@ -0,0 +1,50 @@
+package runtime
+
+import (
+	"io"
+)
+
+// Marshaler defines a conversion between byte sequence and gRPC payloads / fields.
+type Marshaler interface {
+	// Marshal marshals "v" into byte sequence.
+	Marshal(v interface{}) ([]byte, error)
+	// Unmarshal unmarshals "data" into "v".
+	// "v" must be a pointer value.
+	Unmarshal(data []byte, v interface{}) error
+	// NewDecoder returns a Decoder which reads byte sequence from "r".
+	NewDecoder(r io.Reader) Decoder
+	// NewEncoder returns an Encoder which writes bytes sequence into "w".
+	NewEncoder(w io.Writer) Encoder
+	// ContentType returns the Content-Type which this marshaler is responsible for.
+	// The parameter describes the type which is being marshalled, which can sometimes
+	// affect the content type returned.
+	ContentType(v interface{}) string
+}
+
+// Decoder decodes a byte sequence
+type Decoder interface {
+	Decode(v interface{}) error
+}
+
+// Encoder encodes gRPC payloads / fields into byte sequence.
+type Encoder interface {
+	Encode(v interface{}) error
+}
+
+// DecoderFunc adapts an decoder function into Decoder.
+type DecoderFunc func(v interface{}) error
+
+// Decode delegates invocations to the underlying function itself.
+func (f DecoderFunc) Decode(v interface{}) error { return f(v) }
+
+// EncoderFunc adapts an encoder function into Encoder
+type EncoderFunc func(v interface{}) error
+
+// Encode delegates invocations to the underlying function itself.
+func (f EncoderFunc) Encode(v interface{}) error { return f(v) }
+
+// Delimited defines the streaming delimiter.
+type Delimited interface {
+	// Delimiter returns the record separator for the stream.
+	Delimiter() []byte
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler_registry.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler_registry.go
new file mode 100644
index 0000000000..a714de0240
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/marshaler_registry.go
@@ -0,0 +1,109 @@
+package runtime
+
+import (
+	"errors"
+	"mime"
+	"net/http"
+
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+// MIMEWildcard is the fallback MIME type used for requests which do not match
+// a registered MIME type.
+const MIMEWildcard = "*"
+
+var (
+	acceptHeader      = http.CanonicalHeaderKey("Accept")
+	contentTypeHeader = http.CanonicalHeaderKey("Content-Type")
+
+	defaultMarshaler = &HTTPBodyMarshaler{
+		Marshaler: &JSONPb{
+			MarshalOptions: protojson.MarshalOptions{
+				EmitUnpopulated: true,
+			},
+			UnmarshalOptions: protojson.UnmarshalOptions{
+				DiscardUnknown: true,
+			},
+		},
+	}
+)
+
+// MarshalerForRequest returns the inbound/outbound marshalers for this request.
+// It checks the registry on the ServeMux for the MIME type set by the Content-Type header.
+// If it isn't set (or the request Content-Type is empty), checks for "*".
+// If there are multiple Content-Type headers set, choose the first one that it can
+// exactly match in the registry.
+// Otherwise, it follows the above logic for "*"/InboundMarshaler/OutboundMarshaler.
+func MarshalerForRequest(mux *ServeMux, r *http.Request) (inbound Marshaler, outbound Marshaler) {
+	for _, acceptVal := range r.Header[acceptHeader] {
+		if m, ok := mux.marshalers.mimeMap[acceptVal]; ok {
+			outbound = m
+			break
+		}
+	}
+
+	for _, contentTypeVal := range r.Header[contentTypeHeader] {
+		contentType, _, err := mime.ParseMediaType(contentTypeVal)
+		if err != nil {
+			grpclog.Infof("Failed to parse Content-Type %s: %v", contentTypeVal, err)
+			continue
+		}
+		if m, ok := mux.marshalers.mimeMap[contentType]; ok {
+			inbound = m
+			break
+		}
+	}
+
+	if inbound == nil {
+		inbound = mux.marshalers.mimeMap[MIMEWildcard]
+	}
+	if outbound == nil {
+		outbound = inbound
+	}
+
+	return inbound, outbound
+}
+
+// marshalerRegistry is a mapping from MIME types to Marshalers.
+type marshalerRegistry struct {
+	mimeMap map[string]Marshaler
+}
+
+// add adds a marshaler for a case-sensitive MIME type string ("*" to match any
+// MIME type).
+func (m marshalerRegistry) add(mime string, marshaler Marshaler) error {
+	if len(mime) == 0 {
+		return errors.New("empty MIME type")
+	}
+
+	m.mimeMap[mime] = marshaler
+
+	return nil
+}
+
+// makeMarshalerMIMERegistry returns a new registry of marshalers.
+// It allows for a mapping of case-sensitive Content-Type MIME type string to runtime.Marshaler interfaces.
+//
+// For example, you could allow the client to specify the use of the runtime.JSONPb marshaler
+// with a "application/jsonpb" Content-Type and the use of the runtime.JSONBuiltin marshaler
+// with a "application/json" Content-Type.
+// "*" can be used to match any Content-Type.
+// This can be attached to a ServerMux with the marshaler option.
+func makeMarshalerMIMERegistry() marshalerRegistry {
+	return marshalerRegistry{
+		mimeMap: map[string]Marshaler{
+			MIMEWildcard: defaultMarshaler,
+		},
+	}
+}
+
+// WithMarshalerOption returns a ServeMuxOption which associates inbound and outbound
+// Marshalers to a MIME type in mux.
+func WithMarshalerOption(mime string, marshaler Marshaler) ServeMuxOption {
+	return func(mux *ServeMux) {
+		if err := mux.marshalers.add(mime, marshaler); err != nil {
+			panic(err)
+		}
+	}
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
new file mode 100644
index 0000000000..46a4aabaf9
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
@@ -0,0 +1,356 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/textproto"
+	"strings"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// UnescapingMode defines the behavior of ServeMux when unescaping path parameters.
+type UnescapingMode int
+
+const (
+	// UnescapingModeLegacy is the default V2 behavior, which escapes the entire
+	// path string before doing any routing.
+	UnescapingModeLegacy UnescapingMode = iota
+
+	// EscapingTypeExceptReserved unescapes all path parameters except RFC 6570
+	// reserved characters.
+	UnescapingModeAllExceptReserved
+
+	// EscapingTypeExceptSlash unescapes URL path parameters except path
+	// seperators, which will be left as "%2F".
+	UnescapingModeAllExceptSlash
+
+	// URL path parameters will be fully decoded.
+	UnescapingModeAllCharacters
+
+	// UnescapingModeDefault is the default escaping type.
+	// TODO(v3): default this to UnescapingModeAllExceptReserved per grpc-httpjson-transcoding's
+	// reference implementation
+	UnescapingModeDefault = UnescapingModeLegacy
+)
+
+// A HandlerFunc handles a specific pair of path pattern and HTTP method.
+type HandlerFunc func(w http.ResponseWriter, r *http.Request, pathParams map[string]string)
+
+// ServeMux is a request multiplexer for grpc-gateway.
+// It matches http requests to patterns and invokes the corresponding handler.
+type ServeMux struct {
+	// handlers maps HTTP method to a list of handlers.
+	handlers                  map[string][]handler
+	forwardResponseOptions    []func(context.Context, http.ResponseWriter, proto.Message) error
+	marshalers                marshalerRegistry
+	incomingHeaderMatcher     HeaderMatcherFunc
+	outgoingHeaderMatcher     HeaderMatcherFunc
+	metadataAnnotators        []func(context.Context, *http.Request) metadata.MD
+	errorHandler              ErrorHandlerFunc
+	streamErrorHandler        StreamErrorHandlerFunc
+	routingErrorHandler       RoutingErrorHandlerFunc
+	disablePathLengthFallback bool
+	unescapingMode            UnescapingMode
+}
+
+// ServeMuxOption is an option that can be given to a ServeMux on construction.
+type ServeMuxOption func(*ServeMux)
+
+// WithForwardResponseOption returns a ServeMuxOption representing the forwardResponseOption.
+//
+// forwardResponseOption is an option that will be called on the relevant context.Context,
+// http.ResponseWriter, and proto.Message before every forwarded response.
+//
+// The message may be nil in the case where just a header is being sent.
+func WithForwardResponseOption(forwardResponseOption func(context.Context, http.ResponseWriter, proto.Message) error) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.forwardResponseOptions = append(serveMux.forwardResponseOptions, forwardResponseOption)
+	}
+}
+
+// WithEscapingType sets the escaping type. See the definitions of UnescapingMode
+// for more information.
+func WithUnescapingMode(mode UnescapingMode) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.unescapingMode = mode
+	}
+}
+
+// SetQueryParameterParser sets the query parameter parser, used to populate message from query parameters.
+// Configuring this will mean the generated OpenAPI output is no longer correct, and it should be
+// done with careful consideration.
+func SetQueryParameterParser(queryParameterParser QueryParameterParser) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		currentQueryParser = queryParameterParser
+	}
+}
+
+// HeaderMatcherFunc checks whether a header key should be forwarded to/from gRPC context.
+type HeaderMatcherFunc func(string) (string, bool)
+
+// DefaultHeaderMatcher is used to pass http request headers to/from gRPC context. This adds permanent HTTP header
+// keys (as specified by the IANA) to gRPC context with grpcgateway- prefix. HTTP headers that start with
+// 'Grpc-Metadata-' are mapped to gRPC metadata after removing prefix 'Grpc-Metadata-'.
+func DefaultHeaderMatcher(key string) (string, bool) {
+	key = textproto.CanonicalMIMEHeaderKey(key)
+	if isPermanentHTTPHeader(key) {
+		return MetadataPrefix + key, true
+	} else if strings.HasPrefix(key, MetadataHeaderPrefix) {
+		return key[len(MetadataHeaderPrefix):], true
+	}
+	return "", false
+}
+
+// WithIncomingHeaderMatcher returns a ServeMuxOption representing a headerMatcher for incoming request to gateway.
+//
+// This matcher will be called with each header in http.Request. If matcher returns true, that header will be
+// passed to gRPC context. To transform the header before passing to gRPC context, matcher should return modified header.
+func WithIncomingHeaderMatcher(fn HeaderMatcherFunc) ServeMuxOption {
+	return func(mux *ServeMux) {
+		mux.incomingHeaderMatcher = fn
+	}
+}
+
+// WithOutgoingHeaderMatcher returns a ServeMuxOption representing a headerMatcher for outgoing response from gateway.
+//
+// This matcher will be called with each header in response header metadata. If matcher returns true, that header will be
+// passed to http response returned from gateway. To transform the header before passing to response,
+// matcher should return modified header.
+func WithOutgoingHeaderMatcher(fn HeaderMatcherFunc) ServeMuxOption {
+	return func(mux *ServeMux) {
+		mux.outgoingHeaderMatcher = fn
+	}
+}
+
+// WithMetadata returns a ServeMuxOption for passing metadata to a gRPC context.
+//
+// This can be used by services that need to read from http.Request and modify gRPC context. A common use case
+// is reading token from cookie and adding it in gRPC context.
+func WithMetadata(annotator func(context.Context, *http.Request) metadata.MD) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.metadataAnnotators = append(serveMux.metadataAnnotators, annotator)
+	}
+}
+
+// WithErrorHandler returns a ServeMuxOption for configuring a custom error handler.
+//
+// This can be used to configure a custom error response.
+func WithErrorHandler(fn ErrorHandlerFunc) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.errorHandler = fn
+	}
+}
+
+// WithStreamErrorHandler returns a ServeMuxOption that will use the given custom stream
+// error handler, which allows for customizing the error trailer for server-streaming
+// calls.
+//
+// For stream errors that occur before any response has been written, the mux's
+// ErrorHandler will be invoked. However, once data has been written, the errors must
+// be handled differently: they must be included in the response body. The response body's
+// final message will include the error details returned by the stream error handler.
+func WithStreamErrorHandler(fn StreamErrorHandlerFunc) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.streamErrorHandler = fn
+	}
+}
+
+// WithRoutingErrorHandler returns a ServeMuxOption for configuring a custom error handler to  handle http routing errors.
+//
+// Method called for errors which can happen before gRPC route selected or executed.
+// The following error codes: StatusMethodNotAllowed StatusNotFound StatusBadRequest
+func WithRoutingErrorHandler(fn RoutingErrorHandlerFunc) ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.routingErrorHandler = fn
+	}
+}
+
+// WithDisablePathLengthFallback returns a ServeMuxOption for disable path length fallback.
+func WithDisablePathLengthFallback() ServeMuxOption {
+	return func(serveMux *ServeMux) {
+		serveMux.disablePathLengthFallback = true
+	}
+}
+
+// NewServeMux returns a new ServeMux whose internal mapping is empty.
+func NewServeMux(opts ...ServeMuxOption) *ServeMux {
+	serveMux := &ServeMux{
+		handlers:               make(map[string][]handler),
+		forwardResponseOptions: make([]func(context.Context, http.ResponseWriter, proto.Message) error, 0),
+		marshalers:             makeMarshalerMIMERegistry(),
+		errorHandler:           DefaultHTTPErrorHandler,
+		streamErrorHandler:     DefaultStreamErrorHandler,
+		routingErrorHandler:    DefaultRoutingErrorHandler,
+		unescapingMode:         UnescapingModeDefault,
+	}
+
+	for _, opt := range opts {
+		opt(serveMux)
+	}
+
+	if serveMux.incomingHeaderMatcher == nil {
+		serveMux.incomingHeaderMatcher = DefaultHeaderMatcher
+	}
+
+	if serveMux.outgoingHeaderMatcher == nil {
+		serveMux.outgoingHeaderMatcher = func(key string) (string, bool) {
+			return fmt.Sprintf("%s%s", MetadataHeaderPrefix, key), true
+		}
+	}
+
+	return serveMux
+}
+
+// Handle associates "h" to the pair of HTTP method and path pattern.
+func (s *ServeMux) Handle(meth string, pat Pattern, h HandlerFunc) {
+	s.handlers[meth] = append([]handler{{pat: pat, h: h}}, s.handlers[meth]...)
+}
+
+// HandlePath allows users to configure custom path handlers.
+// refer: https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/inject_router/
+func (s *ServeMux) HandlePath(meth string, pathPattern string, h HandlerFunc) error {
+	compiler, err := httprule.Parse(pathPattern)
+	if err != nil {
+		return fmt.Errorf("parsing path pattern: %w", err)
+	}
+	tp := compiler.Compile()
+	pattern, err := NewPattern(tp.Version, tp.OpCodes, tp.Pool, tp.Verb)
+	if err != nil {
+		return fmt.Errorf("creating new pattern: %w", err)
+	}
+	s.Handle(meth, pattern, h)
+	return nil
+}
+
+// ServeHTTP dispatches the request to the first handler whose pattern matches to r.Method and r.Path.
+func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	path := r.URL.Path
+	if !strings.HasPrefix(path, "/") {
+		_, outboundMarshaler := MarshalerForRequest(s, r)
+		s.routingErrorHandler(ctx, s, outboundMarshaler, w, r, http.StatusBadRequest)
+		return
+	}
+
+	// TODO(v3): remove UnescapingModeLegacy
+	if s.unescapingMode != UnescapingModeLegacy && r.URL.RawPath != "" {
+		path = r.URL.RawPath
+	}
+
+	components := strings.Split(path[1:], "/")
+
+	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && s.isPathLengthFallback(r) {
+		r.Method = strings.ToUpper(override)
+		if err := r.ParseForm(); err != nil {
+			_, outboundMarshaler := MarshalerForRequest(s, r)
+			sterr := status.Error(codes.InvalidArgument, err.Error())
+			s.errorHandler(ctx, s, outboundMarshaler, w, r, sterr)
+			return
+		}
+	}
+
+	// Verb out here is to memoize for the fallback case below
+	var verb string
+
+	for _, h := range s.handlers[r.Method] {
+		// If the pattern has a verb, explicitly look for a suffix in the last
+		// component that matches a colon plus the verb. This allows us to
+		// handle some cases that otherwise can't be correctly handled by the
+		// former LastIndex case, such as when the verb literal itself contains
+		// a colon. This should work for all cases that have run through the
+		// parser because we know what verb we're looking for, however, there
+		// are still some cases that the parser itself cannot disambiguate. See
+		// the comment there if interested.
+		patVerb := h.pat.Verb()
+		l := len(components)
+		lastComponent := components[l-1]
+		var idx int = -1
+		if patVerb != "" && strings.HasSuffix(lastComponent, ":"+patVerb) {
+			idx = len(lastComponent) - len(patVerb) - 1
+		}
+		if idx == 0 {
+			_, outboundMarshaler := MarshalerForRequest(s, r)
+			s.routingErrorHandler(ctx, s, outboundMarshaler, w, r, http.StatusNotFound)
+			return
+		}
+		if idx > 0 {
+			components[l-1], verb = lastComponent[:idx], lastComponent[idx+1:]
+		}
+
+		pathParams, err := h.pat.MatchAndEscape(components, verb, s.unescapingMode)
+		if err != nil {
+			var mse MalformedSequenceError
+			if ok := errors.As(err, &mse); ok {
+				_, outboundMarshaler := MarshalerForRequest(s, r)
+				s.errorHandler(ctx, s, outboundMarshaler, w, r, &HTTPStatusError{
+					HTTPStatus: http.StatusBadRequest,
+					Err:        mse,
+				})
+			}
+			continue
+		}
+		h.h(w, r, pathParams)
+		return
+	}
+
+	// lookup other methods to handle fallback from GET to POST and
+	// to determine if it is NotImplemented or NotFound.
+	for m, handlers := range s.handlers {
+		if m == r.Method {
+			continue
+		}
+		for _, h := range handlers {
+			pathParams, err := h.pat.MatchAndEscape(components, verb, s.unescapingMode)
+			if err != nil {
+				var mse MalformedSequenceError
+				if ok := errors.As(err, &mse); ok {
+					_, outboundMarshaler := MarshalerForRequest(s, r)
+					s.errorHandler(ctx, s, outboundMarshaler, w, r, &HTTPStatusError{
+						HTTPStatus: http.StatusBadRequest,
+						Err:        mse,
+					})
+				}
+				continue
+			}
+			// X-HTTP-Method-Override is optional. Always allow fallback to POST.
+			if s.isPathLengthFallback(r) {
+				if err := r.ParseForm(); err != nil {
+					_, outboundMarshaler := MarshalerForRequest(s, r)
+					sterr := status.Error(codes.InvalidArgument, err.Error())
+					s.errorHandler(ctx, s, outboundMarshaler, w, r, sterr)
+					return
+				}
+				h.h(w, r, pathParams)
+				return
+			}
+			_, outboundMarshaler := MarshalerForRequest(s, r)
+			s.routingErrorHandler(ctx, s, outboundMarshaler, w, r, http.StatusMethodNotAllowed)
+			return
+		}
+	}
+
+	_, outboundMarshaler := MarshalerForRequest(s, r)
+	s.routingErrorHandler(ctx, s, outboundMarshaler, w, r, http.StatusNotFound)
+}
+
+// GetForwardResponseOptions returns the ForwardResponseOptions associated with this ServeMux.
+func (s *ServeMux) GetForwardResponseOptions() []func(context.Context, http.ResponseWriter, proto.Message) error {
+	return s.forwardResponseOptions
+}
+
+func (s *ServeMux) isPathLengthFallback(r *http.Request) bool {
+	return !s.disablePathLengthFallback && r.Method == "POST" && r.Header.Get("Content-Type") == "application/x-www-form-urlencoded"
+}
+
+type handler struct {
+	pat Pattern
+	h   HandlerFunc
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/pattern.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/pattern.go
new file mode 100644
index 0000000000..df7cb81426
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/pattern.go
@@ -0,0 +1,383 @@
+package runtime
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc/grpclog"
+)
+
+var (
+	// ErrNotMatch indicates that the given HTTP request path does not match to the pattern.
+	ErrNotMatch = errors.New("not match to the path pattern")
+	// ErrInvalidPattern indicates that the given definition of Pattern is not valid.
+	ErrInvalidPattern = errors.New("invalid pattern")
+	// ErrMalformedSequence indicates that an escape sequence was malformed.
+	ErrMalformedSequence = errors.New("malformed escape sequence")
+)
+
+type MalformedSequenceError string
+
+func (e MalformedSequenceError) Error() string {
+	return "malformed path escape " + strconv.Quote(string(e))
+}
+
+type op struct {
+	code    utilities.OpCode
+	operand int
+}
+
+// Pattern is a template pattern of http request paths defined in
+// https://github.com/googleapis/googleapis/blob/master/google/api/http.proto
+type Pattern struct {
+	// ops is a list of operations
+	ops []op
+	// pool is a constant pool indexed by the operands or vars.
+	pool []string
+	// vars is a list of variables names to be bound by this pattern
+	vars []string
+	// stacksize is the max depth of the stack
+	stacksize int
+	// tailLen is the length of the fixed-size segments after a deep wildcard
+	tailLen int
+	// verb is the VERB part of the path pattern. It is empty if the pattern does not have VERB part.
+	verb string
+}
+
+// NewPattern returns a new Pattern from the given definition values.
+// "ops" is a sequence of op codes. "pool" is a constant pool.
+// "verb" is the verb part of the pattern. It is empty if the pattern does not have the part.
+// "version" must be 1 for now.
+// It returns an error if the given definition is invalid.
+func NewPattern(version int, ops []int, pool []string, verb string) (Pattern, error) {
+	if version != 1 {
+		grpclog.Infof("unsupported version: %d", version)
+		return Pattern{}, ErrInvalidPattern
+	}
+
+	l := len(ops)
+	if l%2 != 0 {
+		grpclog.Infof("odd number of ops codes: %d", l)
+		return Pattern{}, ErrInvalidPattern
+	}
+
+	var (
+		typedOps        []op
+		stack, maxstack int
+		tailLen         int
+		pushMSeen       bool
+		vars            []string
+	)
+	for i := 0; i < l; i += 2 {
+		op := op{code: utilities.OpCode(ops[i]), operand: ops[i+1]}
+		switch op.code {
+		case utilities.OpNop:
+			continue
+		case utilities.OpPush:
+			if pushMSeen {
+				tailLen++
+			}
+			stack++
+		case utilities.OpPushM:
+			if pushMSeen {
+				grpclog.Infof("pushM appears twice")
+				return Pattern{}, ErrInvalidPattern
+			}
+			pushMSeen = true
+			stack++
+		case utilities.OpLitPush:
+			if op.operand < 0 || len(pool) <= op.operand {
+				grpclog.Infof("negative literal index: %d", op.operand)
+				return Pattern{}, ErrInvalidPattern
+			}
+			if pushMSeen {
+				tailLen++
+			}
+			stack++
+		case utilities.OpConcatN:
+			if op.operand <= 0 {
+				grpclog.Infof("negative concat size: %d", op.operand)
+				return Pattern{}, ErrInvalidPattern
+			}
+			stack -= op.operand
+			if stack < 0 {
+				grpclog.Info("stack underflow")
+				return Pattern{}, ErrInvalidPattern
+			}
+			stack++
+		case utilities.OpCapture:
+			if op.operand < 0 || len(pool) <= op.operand {
+				grpclog.Infof("variable name index out of bound: %d", op.operand)
+				return Pattern{}, ErrInvalidPattern
+			}
+			v := pool[op.operand]
+			op.operand = len(vars)
+			vars = append(vars, v)
+			stack--
+			if stack < 0 {
+				grpclog.Infof("stack underflow")
+				return Pattern{}, ErrInvalidPattern
+			}
+		default:
+			grpclog.Infof("invalid opcode: %d", op.code)
+			return Pattern{}, ErrInvalidPattern
+		}
+
+		if maxstack < stack {
+			maxstack = stack
+		}
+		typedOps = append(typedOps, op)
+	}
+	return Pattern{
+		ops:       typedOps,
+		pool:      pool,
+		vars:      vars,
+		stacksize: maxstack,
+		tailLen:   tailLen,
+		verb:      verb,
+	}, nil
+}
+
+// MustPattern is a helper function which makes it easier to call NewPattern in variable initialization.
+func MustPattern(p Pattern, err error) Pattern {
+	if err != nil {
+		grpclog.Fatalf("Pattern initialization failed: %v", err)
+	}
+	return p
+}
+
+// MatchAndEscape examines components to determine if they match to a Pattern.
+// MatchAndEscape will return an error if no Patterns matched or if a pattern
+// matched but contained malformed escape sequences. If successful, the function
+// returns a mapping from field paths to their captured values.
+func (p Pattern) MatchAndEscape(components []string, verb string, unescapingMode UnescapingMode) (map[string]string, error) {
+	if p.verb != verb {
+		if p.verb != "" {
+			return nil, ErrNotMatch
+		}
+		if len(components) == 0 {
+			components = []string{":" + verb}
+		} else {
+			components = append([]string{}, components...)
+			components[len(components)-1] += ":" + verb
+		}
+	}
+
+	var pos int
+	stack := make([]string, 0, p.stacksize)
+	captured := make([]string, len(p.vars))
+	l := len(components)
+	for _, op := range p.ops {
+		var err error
+
+		switch op.code {
+		case utilities.OpNop:
+			continue
+		case utilities.OpPush, utilities.OpLitPush:
+			if pos >= l {
+				return nil, ErrNotMatch
+			}
+			c := components[pos]
+			if op.code == utilities.OpLitPush {
+				if lit := p.pool[op.operand]; c != lit {
+					return nil, ErrNotMatch
+				}
+			} else if op.code == utilities.OpPush {
+				if c, err = unescape(c, unescapingMode, false); err != nil {
+					return nil, err
+				}
+			}
+			stack = append(stack, c)
+			pos++
+		case utilities.OpPushM:
+			end := len(components)
+			if end < pos+p.tailLen {
+				return nil, ErrNotMatch
+			}
+			end -= p.tailLen
+			c := strings.Join(components[pos:end], "/")
+			if c, err = unescape(c, unescapingMode, true); err != nil {
+				return nil, err
+			}
+			stack = append(stack, c)
+			pos = end
+		case utilities.OpConcatN:
+			n := op.operand
+			l := len(stack) - n
+			stack = append(stack[:l], strings.Join(stack[l:], "/"))
+		case utilities.OpCapture:
+			n := len(stack) - 1
+			captured[op.operand] = stack[n]
+			stack = stack[:n]
+		}
+	}
+	if pos < l {
+		return nil, ErrNotMatch
+	}
+	bindings := make(map[string]string)
+	for i, val := range captured {
+		bindings[p.vars[i]] = val
+	}
+	return bindings, nil
+}
+
+// MatchAndEscape examines components to determine if they match to a Pattern.
+// It will never perform per-component unescaping (see: UnescapingModeLegacy).
+// MatchAndEscape will return an error if no Patterns matched. If successful,
+// the function returns a mapping from field paths to their captured values.
+//
+// Deprecated: Use MatchAndEscape.
+func (p Pattern) Match(components []string, verb string) (map[string]string, error) {
+	return p.MatchAndEscape(components, verb, UnescapingModeDefault)
+}
+
+// Verb returns the verb part of the Pattern.
+func (p Pattern) Verb() string { return p.verb }
+
+func (p Pattern) String() string {
+	var stack []string
+	for _, op := range p.ops {
+		switch op.code {
+		case utilities.OpNop:
+			continue
+		case utilities.OpPush:
+			stack = append(stack, "*")
+		case utilities.OpLitPush:
+			stack = append(stack, p.pool[op.operand])
+		case utilities.OpPushM:
+			stack = append(stack, "**")
+		case utilities.OpConcatN:
+			n := op.operand
+			l := len(stack) - n
+			stack = append(stack[:l], strings.Join(stack[l:], "/"))
+		case utilities.OpCapture:
+			n := len(stack) - 1
+			stack[n] = fmt.Sprintf("{%s=%s}", p.vars[op.operand], stack[n])
+		}
+	}
+	segs := strings.Join(stack, "/")
+	if p.verb != "" {
+		return fmt.Sprintf("/%s:%s", segs, p.verb)
+	}
+	return "/" + segs
+}
+
+/*
+ * The following code is adopted and modified from Go's standard library
+ * and carries the attached license.
+ *
+ *     Copyright 2009 The Go Authors. All rights reserved.
+ *     Use of this source code is governed by a BSD-style
+ *     license that can be found in the LICENSE file.
+ */
+
+// ishex returns whether or not the given byte is a valid hex character
+func ishex(c byte) bool {
+	switch {
+	case '0' <= c && c <= '9':
+		return true
+	case 'a' <= c && c <= 'f':
+		return true
+	case 'A' <= c && c <= 'F':
+		return true
+	}
+	return false
+}
+
+func isRFC6570Reserved(c byte) bool {
+	switch c {
+	case '!', '#', '$', '&', '\'', '(', ')', '*',
+		'+', ',', '/', ':', ';', '=', '?', '@', '[', ']':
+		return true
+	default:
+		return false
+	}
+}
+
+// unhex converts a hex point to the bit representation
+func unhex(c byte) byte {
+	switch {
+	case '0' <= c && c <= '9':
+		return c - '0'
+	case 'a' <= c && c <= 'f':
+		return c - 'a' + 10
+	case 'A' <= c && c <= 'F':
+		return c - 'A' + 10
+	}
+	return 0
+}
+
+// shouldUnescapeWithMode returns true if the character is escapable with the
+// given mode
+func shouldUnescapeWithMode(c byte, mode UnescapingMode) bool {
+	switch mode {
+	case UnescapingModeAllExceptReserved:
+		if isRFC6570Reserved(c) {
+			return false
+		}
+	case UnescapingModeAllExceptSlash:
+		if c == '/' {
+			return false
+		}
+	case UnescapingModeAllCharacters:
+		return true
+	}
+	return true
+}
+
+// unescape unescapes a path string using the provided mode
+func unescape(s string, mode UnescapingMode, multisegment bool) (string, error) {
+	// TODO(v3): remove UnescapingModeLegacy
+	if mode == UnescapingModeLegacy {
+		return s, nil
+	}
+
+	if !multisegment {
+		mode = UnescapingModeAllCharacters
+	}
+
+	// Count %, check that they're well-formed.
+	n := 0
+	for i := 0; i < len(s); {
+		if s[i] == '%' {
+			n++
+			if i+2 >= len(s) || !ishex(s[i+1]) || !ishex(s[i+2]) {
+				s = s[i:]
+				if len(s) > 3 {
+					s = s[:3]
+				}
+
+				return "", MalformedSequenceError(s)
+			}
+			i += 3
+		} else {
+			i++
+		}
+	}
+
+	if n == 0 {
+		return s, nil
+	}
+
+	var t strings.Builder
+	t.Grow(len(s))
+	for i := 0; i < len(s); i++ {
+		switch s[i] {
+		case '%':
+			c := unhex(s[i+1])<<4 | unhex(s[i+2])
+			if shouldUnescapeWithMode(c, mode) {
+				t.WriteByte(c)
+				i += 2
+				continue
+			}
+			fallthrough
+		default:
+			t.WriteByte(s[i])
+		}
+	}
+
+	return t.String(), nil
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/proto2_convert.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/proto2_convert.go
new file mode 100644
index 0000000000..d549407f20
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/proto2_convert.go
@@ -0,0 +1,80 @@
+package runtime
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// StringP returns a pointer to a string whose pointee is same as the given string value.
+func StringP(val string) (*string, error) {
+	return proto.String(val), nil
+}
+
+// BoolP parses the given string representation of a boolean value,
+// and returns a pointer to a bool whose value is same as the parsed value.
+func BoolP(val string) (*bool, error) {
+	b, err := Bool(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Bool(b), nil
+}
+
+// Float64P parses the given string representation of a floating point number,
+// and returns a pointer to a float64 whose value is same as the parsed number.
+func Float64P(val string) (*float64, error) {
+	f, err := Float64(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Float64(f), nil
+}
+
+// Float32P parses the given string representation of a floating point number,
+// and returns a pointer to a float32 whose value is same as the parsed number.
+func Float32P(val string) (*float32, error) {
+	f, err := Float32(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Float32(f), nil
+}
+
+// Int64P parses the given string representation of an integer
+// and returns a pointer to a int64 whose value is same as the parsed integer.
+func Int64P(val string) (*int64, error) {
+	i, err := Int64(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Int64(i), nil
+}
+
+// Int32P parses the given string representation of an integer
+// and returns a pointer to a int32 whose value is same as the parsed integer.
+func Int32P(val string) (*int32, error) {
+	i, err := Int32(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Int32(i), err
+}
+
+// Uint64P parses the given string representation of an integer
+// and returns a pointer to a uint64 whose value is same as the parsed integer.
+func Uint64P(val string) (*uint64, error) {
+	i, err := Uint64(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Uint64(i), err
+}
+
+// Uint32P parses the given string representation of an integer
+// and returns a pointer to a uint32 whose value is same as the parsed integer.
+func Uint32P(val string) (*uint32, error) {
+	i, err := Uint32(val)
+	if err != nil {
+		return nil, err
+	}
+	return proto.Uint32(i), err
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/query.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/query.go
new file mode 100644
index 0000000000..fb0c84ef0c
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/query.go
@@ -0,0 +1,329 @@
+package runtime
+
+import (
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/genproto/protobuf/field_mask"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+var valuesKeyRegexp = regexp.MustCompile(`^(.*)\[(.*)\]$`)
+
+var currentQueryParser QueryParameterParser = &defaultQueryParser{}
+
+// QueryParameterParser defines interface for all query parameter parsers
+type QueryParameterParser interface {
+	Parse(msg proto.Message, values url.Values, filter *utilities.DoubleArray) error
+}
+
+// PopulateQueryParameters parses query parameters
+// into "msg" using current query parser
+func PopulateQueryParameters(msg proto.Message, values url.Values, filter *utilities.DoubleArray) error {
+	return currentQueryParser.Parse(msg, values, filter)
+}
+
+type defaultQueryParser struct{}
+
+// Parse populates "values" into "msg".
+// A value is ignored if its key starts with one of the elements in "filter".
+func (*defaultQueryParser) Parse(msg proto.Message, values url.Values, filter *utilities.DoubleArray) error {
+	for key, values := range values {
+		match := valuesKeyRegexp.FindStringSubmatch(key)
+		if len(match) == 3 {
+			key = match[1]
+			values = append([]string{match[2]}, values...)
+		}
+		fieldPath := strings.Split(key, ".")
+		if filter.HasCommonPrefix(fieldPath) {
+			continue
+		}
+		if err := populateFieldValueFromPath(msg.ProtoReflect(), fieldPath, values); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// PopulateFieldFromPath sets a value in a nested Protobuf structure.
+func PopulateFieldFromPath(msg proto.Message, fieldPathString string, value string) error {
+	fieldPath := strings.Split(fieldPathString, ".")
+	return populateFieldValueFromPath(msg.ProtoReflect(), fieldPath, []string{value})
+}
+
+func populateFieldValueFromPath(msgValue protoreflect.Message, fieldPath []string, values []string) error {
+	if len(fieldPath) < 1 {
+		return errors.New("no field path")
+	}
+	if len(values) < 1 {
+		return errors.New("no value provided")
+	}
+
+	var fieldDescriptor protoreflect.FieldDescriptor
+	for i, fieldName := range fieldPath {
+		fields := msgValue.Descriptor().Fields()
+
+		// Get field by name
+		fieldDescriptor = fields.ByName(protoreflect.Name(fieldName))
+		if fieldDescriptor == nil {
+			fieldDescriptor = fields.ByJSONName(fieldName)
+			if fieldDescriptor == nil {
+				// We're not returning an error here because this could just be
+				// an extra query parameter that isn't part of the request.
+				grpclog.Infof("field not found in %q: %q", msgValue.Descriptor().FullName(), strings.Join(fieldPath, "."))
+				return nil
+			}
+		}
+
+		// If this is the last element, we're done
+		if i == len(fieldPath)-1 {
+			break
+		}
+
+		// Only singular message fields are allowed
+		if fieldDescriptor.Message() == nil || fieldDescriptor.Cardinality() == protoreflect.Repeated {
+			return fmt.Errorf("invalid path: %q is not a message", fieldName)
+		}
+
+		// Get the nested message
+		msgValue = msgValue.Mutable(fieldDescriptor).Message()
+	}
+
+	// Check if oneof already set
+	if of := fieldDescriptor.ContainingOneof(); of != nil {
+		if f := msgValue.WhichOneof(of); f != nil {
+			return fmt.Errorf("field already set for oneof %q", of.FullName().Name())
+		}
+	}
+
+	switch {
+	case fieldDescriptor.IsList():
+		return populateRepeatedField(fieldDescriptor, msgValue.Mutable(fieldDescriptor).List(), values)
+	case fieldDescriptor.IsMap():
+		return populateMapField(fieldDescriptor, msgValue.Mutable(fieldDescriptor).Map(), values)
+	}
+
+	if len(values) > 1 {
+		return fmt.Errorf("too many values for field %q: %s", fieldDescriptor.FullName().Name(), strings.Join(values, ", "))
+	}
+
+	return populateField(fieldDescriptor, msgValue, values[0])
+}
+
+func populateField(fieldDescriptor protoreflect.FieldDescriptor, msgValue protoreflect.Message, value string) error {
+	v, err := parseField(fieldDescriptor, value)
+	if err != nil {
+		return fmt.Errorf("parsing field %q: %w", fieldDescriptor.FullName().Name(), err)
+	}
+
+	msgValue.Set(fieldDescriptor, v)
+	return nil
+}
+
+func populateRepeatedField(fieldDescriptor protoreflect.FieldDescriptor, list protoreflect.List, values []string) error {
+	for _, value := range values {
+		v, err := parseField(fieldDescriptor, value)
+		if err != nil {
+			return fmt.Errorf("parsing list %q: %w", fieldDescriptor.FullName().Name(), err)
+		}
+		list.Append(v)
+	}
+
+	return nil
+}
+
+func populateMapField(fieldDescriptor protoreflect.FieldDescriptor, mp protoreflect.Map, values []string) error {
+	if len(values) != 2 {
+		return fmt.Errorf("more than one value provided for key %q in map %q", values[0], fieldDescriptor.FullName())
+	}
+
+	key, err := parseField(fieldDescriptor.MapKey(), values[0])
+	if err != nil {
+		return fmt.Errorf("parsing map key %q: %w", fieldDescriptor.FullName().Name(), err)
+	}
+
+	value, err := parseField(fieldDescriptor.MapValue(), values[1])
+	if err != nil {
+		return fmt.Errorf("parsing map value %q: %w", fieldDescriptor.FullName().Name(), err)
+	}
+
+	mp.Set(key.MapKey(), value)
+
+	return nil
+}
+
+func parseField(fieldDescriptor protoreflect.FieldDescriptor, value string) (protoreflect.Value, error) {
+	switch fieldDescriptor.Kind() {
+	case protoreflect.BoolKind:
+		v, err := strconv.ParseBool(value)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfBool(v), nil
+	case protoreflect.EnumKind:
+		enum, err := protoregistry.GlobalTypes.FindEnumByName(fieldDescriptor.Enum().FullName())
+		switch {
+		case errors.Is(err, protoregistry.NotFound):
+			return protoreflect.Value{}, fmt.Errorf("enum %q is not registered", fieldDescriptor.Enum().FullName())
+		case err != nil:
+			return protoreflect.Value{}, fmt.Errorf("failed to look up enum: %w", err)
+		}
+		// Look for enum by name
+		v := enum.Descriptor().Values().ByName(protoreflect.Name(value))
+		if v == nil {
+			i, err := strconv.Atoi(value)
+			if err != nil {
+				return protoreflect.Value{}, fmt.Errorf("%q is not a valid value", value)
+			}
+			// Look for enum by number
+			v = enum.Descriptor().Values().ByNumber(protoreflect.EnumNumber(i))
+			if v == nil {
+				return protoreflect.Value{}, fmt.Errorf("%q is not a valid value", value)
+			}
+		}
+		return protoreflect.ValueOfEnum(v.Number()), nil
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		v, err := strconv.ParseInt(value, 10, 32)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfInt32(int32(v)), nil
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+		v, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfInt64(v), nil
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
+		v, err := strconv.ParseUint(value, 10, 32)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfUint32(uint32(v)), nil
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
+		v, err := strconv.ParseUint(value, 10, 64)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfUint64(v), nil
+	case protoreflect.FloatKind:
+		v, err := strconv.ParseFloat(value, 32)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfFloat32(float32(v)), nil
+	case protoreflect.DoubleKind:
+		v, err := strconv.ParseFloat(value, 64)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfFloat64(v), nil
+	case protoreflect.StringKind:
+		return protoreflect.ValueOfString(value), nil
+	case protoreflect.BytesKind:
+		v, err := base64.URLEncoding.DecodeString(value)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		return protoreflect.ValueOfBytes(v), nil
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		return parseMessage(fieldDescriptor.Message(), value)
+	default:
+		panic(fmt.Sprintf("unknown field kind: %v", fieldDescriptor.Kind()))
+	}
+}
+
+func parseMessage(msgDescriptor protoreflect.MessageDescriptor, value string) (protoreflect.Value, error) {
+	var msg proto.Message
+	switch msgDescriptor.FullName() {
+	case "google.protobuf.Timestamp":
+		if value == "null" {
+			break
+		}
+		t, err := time.Parse(time.RFC3339Nano, value)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = timestamppb.New(t)
+	case "google.protobuf.Duration":
+		if value == "null" {
+			break
+		}
+		d, err := time.ParseDuration(value)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = durationpb.New(d)
+	case "google.protobuf.DoubleValue":
+		v, err := strconv.ParseFloat(value, 64)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.DoubleValue{Value: v}
+	case "google.protobuf.FloatValue":
+		v, err := strconv.ParseFloat(value, 32)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.FloatValue{Value: float32(v)}
+	case "google.protobuf.Int64Value":
+		v, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.Int64Value{Value: v}
+	case "google.protobuf.Int32Value":
+		v, err := strconv.ParseInt(value, 10, 32)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.Int32Value{Value: int32(v)}
+	case "google.protobuf.UInt64Value":
+		v, err := strconv.ParseUint(value, 10, 64)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.UInt64Value{Value: v}
+	case "google.protobuf.UInt32Value":
+		v, err := strconv.ParseUint(value, 10, 32)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.UInt32Value{Value: uint32(v)}
+	case "google.protobuf.BoolValue":
+		v, err := strconv.ParseBool(value)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.BoolValue{Value: v}
+	case "google.protobuf.StringValue":
+		msg = &wrapperspb.StringValue{Value: value}
+	case "google.protobuf.BytesValue":
+		v, err := base64.URLEncoding.DecodeString(value)
+		if err != nil {
+			return protoreflect.Value{}, err
+		}
+		msg = &wrapperspb.BytesValue{Value: v}
+	case "google.protobuf.FieldMask":
+		fm := &field_mask.FieldMask{}
+		fm.Paths = append(fm.Paths, strings.Split(value, ",")...)
+		msg = fm
+	default:
+		return protoreflect.Value{}, fmt.Errorf("unsupported message type: %q", string(msgDescriptor.FullName()))
+	}
+
+	return protoreflect.ValueOfMessage(msg.ProtoReflect()), nil
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/BUILD.bazel b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/BUILD.bazel
new file mode 100644
index 0000000000..5d8d12bc42
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/BUILD.bazel
@@ -0,0 +1,27 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(default_visibility = ["//visibility:public"])
+
+go_library(
+    name = "utilities",
+    srcs = [
+        "doc.go",
+        "pattern.go",
+        "readerfactory.go",
+        "trie.go",
+    ],
+    importpath = "github.com/grpc-ecosystem/grpc-gateway/v2/utilities",
+)
+
+go_test(
+    name = "utilities_test",
+    size = "small",
+    srcs = ["trie_test.go"],
+    deps = [":utilities"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":utilities",
+    visibility = ["//visibility:public"],
+)
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/doc.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/doc.go
new file mode 100644
index 0000000000..cf79a4d588
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/doc.go
@@ -0,0 +1,2 @@
+// Package utilities provides members for internal use in grpc-gateway.
+package utilities
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/pattern.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/pattern.go
new file mode 100644
index 0000000000..dfe7de4864
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/pattern.go
@@ -0,0 +1,22 @@
+package utilities
+
+// An OpCode is a opcode of compiled path patterns.
+type OpCode int
+
+// These constants are the valid values of OpCode.
+const (
+	// OpNop does nothing
+	OpNop = OpCode(iota)
+	// OpPush pushes a component to stack
+	OpPush
+	// OpLitPush pushes a component to stack if it matches to the literal
+	OpLitPush
+	// OpPushM concatenates the remaining components and pushes it to stack
+	OpPushM
+	// OpConcatN pops N items from stack, concatenates them and pushes it back to stack
+	OpConcatN
+	// OpCapture pops an item and binds it to the variable
+	OpCapture
+	// OpEnd is the least positive invalid opcode.
+	OpEnd
+)
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/readerfactory.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/readerfactory.go
new file mode 100644
index 0000000000..6dd3854665
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/readerfactory.go
@@ -0,0 +1,20 @@
+package utilities
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+)
+
+// IOReaderFactory takes in an io.Reader and returns a function that will allow you to create a new reader that begins
+// at the start of the stream
+func IOReaderFactory(r io.Reader) (func() io.Reader, error) {
+	b, err := ioutil.ReadAll(r)
+	if err != nil {
+		return nil, err
+	}
+
+	return func() io.Reader {
+		return bytes.NewReader(b)
+	}, nil
+}
diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/trie.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/trie.go
new file mode 100644
index 0000000000..af3b703d50
--- /dev/null
+++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/trie.go
@@ -0,0 +1,174 @@
+package utilities
+
+import (
+	"sort"
+)
+
+// DoubleArray is a Double Array implementation of trie on sequences of strings.
+type DoubleArray struct {
+	// Encoding keeps an encoding from string to int
+	Encoding map[string]int
+	// Base is the base array of Double Array
+	Base []int
+	// Check is the check array of Double Array
+	Check []int
+}
+
+// NewDoubleArray builds a DoubleArray from a set of sequences of strings.
+func NewDoubleArray(seqs [][]string) *DoubleArray {
+	da := &DoubleArray{Encoding: make(map[string]int)}
+	if len(seqs) == 0 {
+		return da
+	}
+
+	encoded := registerTokens(da, seqs)
+	sort.Sort(byLex(encoded))
+
+	root := node{row: -1, col: -1, left: 0, right: len(encoded)}
+	addSeqs(da, encoded, 0, root)
+
+	for i := len(da.Base); i > 0; i-- {
+		if da.Check[i-1] != 0 {
+			da.Base = da.Base[:i]
+			da.Check = da.Check[:i]
+			break
+		}
+	}
+	return da
+}
+
+func registerTokens(da *DoubleArray, seqs [][]string) [][]int {
+	var result [][]int
+	for _, seq := range seqs {
+		var encoded []int
+		for _, token := range seq {
+			if _, ok := da.Encoding[token]; !ok {
+				da.Encoding[token] = len(da.Encoding)
+			}
+			encoded = append(encoded, da.Encoding[token])
+		}
+		result = append(result, encoded)
+	}
+	for i := range result {
+		result[i] = append(result[i], len(da.Encoding))
+	}
+	return result
+}
+
+type node struct {
+	row, col    int
+	left, right int
+}
+
+func (n node) value(seqs [][]int) int {
+	return seqs[n.row][n.col]
+}
+
+func (n node) children(seqs [][]int) []*node {
+	var result []*node
+	lastVal := int(-1)
+	last := new(node)
+	for i := n.left; i < n.right; i++ {
+		if lastVal == seqs[i][n.col+1] {
+			continue
+		}
+		last.right = i
+		last = &node{
+			row:  i,
+			col:  n.col + 1,
+			left: i,
+		}
+		result = append(result, last)
+	}
+	last.right = n.right
+	return result
+}
+
+func addSeqs(da *DoubleArray, seqs [][]int, pos int, n node) {
+	ensureSize(da, pos)
+
+	children := n.children(seqs)
+	var i int
+	for i = 1; ; i++ {
+		ok := func() bool {
+			for _, child := range children {
+				code := child.value(seqs)
+				j := i + code
+				ensureSize(da, j)
+				if da.Check[j] != 0 {
+					return false
+				}
+			}
+			return true
+		}()
+		if ok {
+			break
+		}
+	}
+	da.Base[pos] = i
+	for _, child := range children {
+		code := child.value(seqs)
+		j := i + code
+		da.Check[j] = pos + 1
+	}
+	terminator := len(da.Encoding)
+	for _, child := range children {
+		code := child.value(seqs)
+		if code == terminator {
+			continue
+		}
+		j := i + code
+		addSeqs(da, seqs, j, *child)
+	}
+}
+
+func ensureSize(da *DoubleArray, i int) {
+	for i >= len(da.Base) {
+		da.Base = append(da.Base, make([]int, len(da.Base)+1)...)
+		da.Check = append(da.Check, make([]int, len(da.Check)+1)...)
+	}
+}
+
+type byLex [][]int
+
+func (l byLex) Len() int      { return len(l) }
+func (l byLex) Swap(i, j int) { l[i], l[j] = l[j], l[i] }
+func (l byLex) Less(i, j int) bool {
+	si := l[i]
+	sj := l[j]
+	var k int
+	for k = 0; k < len(si) && k < len(sj); k++ {
+		if si[k] < sj[k] {
+			return true
+		}
+		if si[k] > sj[k] {
+			return false
+		}
+	}
+	return k < len(sj)
+}
+
+// HasCommonPrefix determines if any sequence in the DoubleArray is a prefix of the given sequence.
+func (da *DoubleArray) HasCommonPrefix(seq []string) bool {
+	if len(da.Base) == 0 {
+		return false
+	}
+
+	var i int
+	for _, t := range seq {
+		code, ok := da.Encoding[t]
+		if !ok {
+			break
+		}
+		j := da.Base[i] + code
+		if len(da.Check) <= j || da.Check[j] != i+1 {
+			break
+		}
+		i = j
+	}
+	j := da.Base[i] + len(da.Encoding)
+	if len(da.Check) <= j || da.Check[j] != i+1 {
+		return false
+	}
+	return true
+}
diff --git a/vendor/github.com/inconshreveable/mousetrap/LICENSE b/vendor/github.com/inconshreveable/mousetrap/LICENSE
index 5f0d1fb6a7..5f920e9732 100644
--- a/vendor/github.com/inconshreveable/mousetrap/LICENSE
+++ b/vendor/github.com/inconshreveable/mousetrap/LICENSE
@@ -1,13 +1,201 @@
-Copyright 2014 Alan Shreve
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-   http://www.apache.org/licenses/LICENSE-2.0
+   1. Definitions.
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2022 Alan Shreve (@inconshreveable)
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/inconshreveable/mousetrap/trap_others.go b/vendor/github.com/inconshreveable/mousetrap/trap_others.go
index 9d2d8a4bab..06a91f0868 100644
--- a/vendor/github.com/inconshreveable/mousetrap/trap_others.go
+++ b/vendor/github.com/inconshreveable/mousetrap/trap_others.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package mousetrap
diff --git a/vendor/github.com/inconshreveable/mousetrap/trap_windows.go b/vendor/github.com/inconshreveable/mousetrap/trap_windows.go
index 336142a5e3..0c56880216 100644
--- a/vendor/github.com/inconshreveable/mousetrap/trap_windows.go
+++ b/vendor/github.com/inconshreveable/mousetrap/trap_windows.go
@@ -1,81 +1,32 @@
-// +build windows
-// +build !go1.4
-
 package mousetrap
 
 import (
-	"fmt"
-	"os"
 	"syscall"
 	"unsafe"
 )
 
-const (
-	// defined by the Win32 API
-	th32cs_snapprocess uintptr = 0x2
-)
-
-var (
-	kernel                   = syscall.MustLoadDLL("kernel32.dll")
-	CreateToolhelp32Snapshot = kernel.MustFindProc("CreateToolhelp32Snapshot")
-	Process32First           = kernel.MustFindProc("Process32FirstW")
-	Process32Next            = kernel.MustFindProc("Process32NextW")
-)
-
-// ProcessEntry32 structure defined by the Win32 API
-type processEntry32 struct {
-	dwSize              uint32
-	cntUsage            uint32
-	th32ProcessID       uint32
-	th32DefaultHeapID   int
-	th32ModuleID        uint32
-	cntThreads          uint32
-	th32ParentProcessID uint32
-	pcPriClassBase      int32
-	dwFlags             uint32
-	szExeFile           [syscall.MAX_PATH]uint16
-}
-
-func getProcessEntry(pid int) (pe *processEntry32, err error) {
-	snapshot, _, e1 := CreateToolhelp32Snapshot.Call(th32cs_snapprocess, uintptr(0))
-	if snapshot == uintptr(syscall.InvalidHandle) {
-		err = fmt.Errorf("CreateToolhelp32Snapshot: %v", e1)
-		return
+func getProcessEntry(pid int) (*syscall.ProcessEntry32, error) {
+	snapshot, err := syscall.CreateToolhelp32Snapshot(syscall.TH32CS_SNAPPROCESS, 0)
+	if err != nil {
+		return nil, err
 	}
-	defer syscall.CloseHandle(syscall.Handle(snapshot))
-
-	var processEntry processEntry32
-	processEntry.dwSize = uint32(unsafe.Sizeof(processEntry))
-	ok, _, e1 := Process32First.Call(snapshot, uintptr(unsafe.Pointer(&processEntry)))
-	if ok == 0 {
-		err = fmt.Errorf("Process32First: %v", e1)
-		return
+	defer syscall.CloseHandle(snapshot)
+	var procEntry syscall.ProcessEntry32
+	procEntry.Size = uint32(unsafe.Sizeof(procEntry))
+	if err = syscall.Process32First(snapshot, &procEntry); err != nil {
+		return nil, err
 	}
-
 	for {
-		if processEntry.th32ProcessID == uint32(pid) {
-			pe = &processEntry
-			return
+		if procEntry.ProcessID == uint32(pid) {
+			return &procEntry, nil
 		}
-
-		ok, _, e1 = Process32Next.Call(snapshot, uintptr(unsafe.Pointer(&processEntry)))
-		if ok == 0 {
-			err = fmt.Errorf("Process32Next: %v", e1)
-			return
+		err = syscall.Process32Next(snapshot, &procEntry)
+		if err != nil {
+			return nil, err
 		}
 	}
 }
 
-func getppid() (pid int, err error) {
-	pe, err := getProcessEntry(os.Getpid())
-	if err != nil {
-		return
-	}
-
-	pid = int(pe.th32ParentProcessID)
-	return
-}
-
 // StartedByExplorer returns true if the program was invoked by the user double-clicking
 // on the executable from explorer.exe
 //
@@ -83,16 +34,9 @@ func getppid() (pid int, err error) {
 // It does not guarantee that the program was run from a terminal. It only can tell you
 // whether it was launched from explorer.exe
 func StartedByExplorer() bool {
-	ppid, err := getppid()
+	pe, err := getProcessEntry(syscall.Getppid())
 	if err != nil {
 		return false
 	}
-
-	pe, err := getProcessEntry(ppid)
-	if err != nil {
-		return false
-	}
-
-	name := syscall.UTF16ToString(pe.szExeFile[:])
-	return name == "explorer.exe"
+	return "explorer.exe" == syscall.UTF16ToString(pe.ExeFile[:])
 }
diff --git a/vendor/github.com/inconshreveable/mousetrap/trap_windows_1.4.go b/vendor/github.com/inconshreveable/mousetrap/trap_windows_1.4.go
deleted file mode 100644
index 9a28e57c3c..0000000000
--- a/vendor/github.com/inconshreveable/mousetrap/trap_windows_1.4.go
+++ /dev/null
@@ -1,46 +0,0 @@
-// +build windows
-// +build go1.4
-
-package mousetrap
-
-import (
-	"os"
-	"syscall"
-	"unsafe"
-)
-
-func getProcessEntry(pid int) (*syscall.ProcessEntry32, error) {
-	snapshot, err := syscall.CreateToolhelp32Snapshot(syscall.TH32CS_SNAPPROCESS, 0)
-	if err != nil {
-		return nil, err
-	}
-	defer syscall.CloseHandle(snapshot)
-	var procEntry syscall.ProcessEntry32
-	procEntry.Size = uint32(unsafe.Sizeof(procEntry))
-	if err = syscall.Process32First(snapshot, &procEntry); err != nil {
-		return nil, err
-	}
-	for {
-		if procEntry.ProcessID == uint32(pid) {
-			return &procEntry, nil
-		}
-		err = syscall.Process32Next(snapshot, &procEntry)
-		if err != nil {
-			return nil, err
-		}
-	}
-}
-
-// StartedByExplorer returns true if the program was invoked by the user double-clicking
-// on the executable from explorer.exe
-//
-// It is conservative and returns false if any of the internal calls fail.
-// It does not guarantee that the program was run from a terminal. It only can tell you
-// whether it was launched from explorer.exe
-func StartedByExplorer() bool {
-	pe, err := getProcessEntry(os.Getppid())
-	if err != nil {
-		return false
-	}
-	return "explorer.exe" == syscall.UTF16ToString(pe.ExeFile[:])
-}
diff --git a/vendor/github.com/klauspost/compress/LICENSE b/vendor/github.com/klauspost/compress/LICENSE
index 6cd1e96276..87d5574777 100644
--- a/vendor/github.com/klauspost/compress/LICENSE
+++ b/vendor/github.com/klauspost/compress/LICENSE
@@ -290,3 +290,15 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+-----------------
+
+Files: s2/cmd/internal/filepathx/*
+
+Copyright 2016 The filepathx Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/klauspost/compress/README.md b/vendor/github.com/klauspost/compress/README.md
index 235dc7cc68..3429879eb6 100644
--- a/vendor/github.com/klauspost/compress/README.md
+++ b/vendor/github.com/klauspost/compress/README.md
@@ -17,12 +17,17 @@ This package provides various compression algorithms.
 
 # changelog
 
+* Aug 30, 2021 (v1.13.5)
+	* gz/zlib/flate: Alias stdlib errors [#425](https://github.com/klauspost/compress/pull/425)
+	* s2: Add block support to commandline tools [#413](https://github.com/klauspost/compress/pull/413)
+	* zstd: pooledZipWriter should return Writers to the same pool [#426](https://github.com/klauspost/compress/pull/426)
+	* Removed golang/snappy as external dependency for tests [#421](https://github.com/klauspost/compress/pull/421)
+
 * Aug 12, 2021 (v1.13.4)
 	* Add [snappy replacement package](https://github.com/klauspost/compress/tree/master/snappy).
 	* zstd: Fix incorrect encoding in "best" mode [#415](https://github.com/klauspost/compress/pull/415)
 
 * Aug 3, 2021 (v1.13.3) 
-
 	* zstd: Improve Best compression [#404](https://github.com/klauspost/compress/pull/404)
 	* zstd: Fix WriteTo error forwarding [#411](https://github.com/klauspost/compress/pull/411)
 	* gzhttp: Return http.HandlerFunc instead of http.Handler. Unlikely breaking change. [#406](https://github.com/klauspost/compress/pull/406)
@@ -31,7 +36,6 @@ This package provides various compression algorithms.
 	* zstd: use SpeedBestCompression for level >= 10 [#410](https://github.com/klauspost/compress/pull/410)
 
 * Jun 14, 2021 (v1.13.1)
-
 	* s2: Add full Snappy output support  [#396](https://github.com/klauspost/compress/pull/396)
 	* zstd: Add configurable [Decoder window](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithDecoderMaxWindow) size [#394](https://github.com/klauspost/compress/pull/394)
 	* gzhttp: Add header to skip compression  [#389](https://github.com/klauspost/compress/pull/389)
@@ -64,6 +68,9 @@ This package provides various compression algorithms.
 	* zstd: Reduce memory usage further when using [WithLowerEncoderMem](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithLowerEncoderMem) [#346](https://github.com/klauspost/compress/pull/346)
 	* s2: Fix potential problem with amd64 assembly and profilers [#349](https://github.com/klauspost/compress/pull/349)
 
+<details>
+	<summary>See changes prior to v1.12.1</summary>
+	
 * Mar 26, 2021 (v1.11.13)
 	* zstd: Big speedup on small dictionary encodes [#344](https://github.com/klauspost/compress/pull/344) [#345](https://github.com/klauspost/compress/pull/345)
 	* zstd: Add [WithLowerEncoderMem](https://pkg.go.dev/github.com/klauspost/compress/zstd#WithLowerEncoderMem) encoder option [#336](https://github.com/klauspost/compress/pull/336)
@@ -118,6 +125,7 @@ This package provides various compression algorithms.
 	* zstd: Add experimental compression [dictionaries](https://github.com/klauspost/compress/tree/master/zstd#dictionaries) [#281](https://github.com/klauspost/compress/pull/281)
 	* zstd: Fix mixed Write and ReadFrom calls [#282](https://github.com/klauspost/compress/pull/282)
 	* inflate/gz: Limit variable shifts, ~5% faster decompression [#274](https://github.com/klauspost/compress/pull/274)
+</details>
 
 <details>
 	<summary>See changes prior to v1.11.0</summary>
diff --git a/vendor/github.com/klauspost/compress/go.mod b/vendor/github.com/klauspost/compress/go.mod
deleted file mode 100644
index 5aa64a436a..0000000000
--- a/vendor/github.com/klauspost/compress/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/klauspost/compress
-
-go 1.15
diff --git a/vendor/github.com/klauspost/compress/go.sum b/vendor/github.com/klauspost/compress/go.sum
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/vendor/github.com/klauspost/compress/huff0/decompress.go b/vendor/github.com/klauspost/compress/huff0/decompress.go
index 41703bba4d..9b7cc8e97b 100644
--- a/vendor/github.com/klauspost/compress/huff0/decompress.go
+++ b/vendor/github.com/klauspost/compress/huff0/decompress.go
@@ -344,35 +344,241 @@ func (d *Decoder) decompress1X8Bit(dst, src []byte) ([]byte, error) {
 	var buf [256]byte
 	var off uint8
 
-	shift := (8 - d.actualTableLog) & 7
-
-	//fmt.Printf("mask: %b, tl:%d\n", mask, d.actualTableLog)
-	for br.off >= 4 {
-		br.fillFast()
-		v := dt[br.peekByteFast()>>shift]
-		br.advance(uint8(v.entry))
-		buf[off+0] = uint8(v.entry >> 8)
-
-		v = dt[br.peekByteFast()>>shift]
-		br.advance(uint8(v.entry))
-		buf[off+1] = uint8(v.entry >> 8)
-
-		v = dt[br.peekByteFast()>>shift]
-		br.advance(uint8(v.entry))
-		buf[off+2] = uint8(v.entry >> 8)
-
-		v = dt[br.peekByteFast()>>shift]
-		br.advance(uint8(v.entry))
-		buf[off+3] = uint8(v.entry >> 8)
-
-		off += 4
-		if off == 0 {
-			if len(dst)+256 > maxDecodedSize {
-				br.close()
-				return nil, ErrMaxDecodedSizeExceeded
+	switch d.actualTableLog {
+	case 8:
+		const shift = 8 - 8
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 7:
+		const shift = 8 - 7
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 6:
+		const shift = 8 - 6
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 5:
+		const shift = 8 - 5
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 4:
+		const shift = 8 - 4
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 3:
+		const shift = 8 - 3
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 2:
+		const shift = 8 - 2
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
+			}
+		}
+	case 1:
+		const shift = 8 - 1
+		for br.off >= 4 {
+			br.fillFast()
+			v := dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+0] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+1] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+2] = uint8(v.entry >> 8)
+
+			v = dt[uint8(br.value>>(56+shift))]
+			br.advance(uint8(v.entry))
+			buf[off+3] = uint8(v.entry >> 8)
+
+			off += 4
+			if off == 0 {
+				if len(dst)+256 > maxDecodedSize {
+					br.close()
+					return nil, ErrMaxDecodedSizeExceeded
+				}
+				dst = append(dst, buf[:]...)
 			}
-			dst = append(dst, buf[:]...)
 		}
+	default:
+		return nil, fmt.Errorf("invalid tablelog: %d", d.actualTableLog)
 	}
 
 	if len(dst)+int(off) > maxDecodedSize {
@@ -383,6 +589,8 @@ func (d *Decoder) decompress1X8Bit(dst, src []byte) ([]byte, error) {
 
 	// br < 4, so uint8 is fine
 	bitsLeft := int8(uint8(br.off)*8 + (64 - br.bitsRead))
+	shift := (8 - d.actualTableLog) & 7
+
 	for bitsLeft > 0 {
 		if br.bitsRead >= 64-8 {
 			for br.off > 0 {
@@ -423,24 +631,24 @@ func (d *Decoder) decompress1X8BitExactly(dst, src []byte) ([]byte, error) {
 	var buf [256]byte
 	var off uint8
 
-	const shift = 0
+	const shift = 56
 
 	//fmt.Printf("mask: %b, tl:%d\n", mask, d.actualTableLog)
 	for br.off >= 4 {
 		br.fillFast()
-		v := dt[br.peekByteFast()>>shift]
+		v := dt[uint8(br.value>>shift)]
 		br.advance(uint8(v.entry))
 		buf[off+0] = uint8(v.entry >> 8)
 
-		v = dt[br.peekByteFast()>>shift]
+		v = dt[uint8(br.value>>shift)]
 		br.advance(uint8(v.entry))
 		buf[off+1] = uint8(v.entry >> 8)
 
-		v = dt[br.peekByteFast()>>shift]
+		v = dt[uint8(br.value>>shift)]
 		br.advance(uint8(v.entry))
 		buf[off+2] = uint8(v.entry >> 8)
 
-		v = dt[br.peekByteFast()>>shift]
+		v = dt[uint8(br.value>>shift)]
 		br.advance(uint8(v.entry))
 		buf[off+3] = uint8(v.entry >> 8)
 
@@ -474,7 +682,7 @@ func (d *Decoder) decompress1X8BitExactly(dst, src []byte) ([]byte, error) {
 			br.close()
 			return nil, ErrMaxDecodedSizeExceeded
 		}
-		v := dt[br.peekByteFast()>>shift]
+		v := dt[br.peekByteFast()]
 		nBits := uint8(v.entry)
 		br.advance(nBits)
 		bitsLeft -= int8(nBits)
@@ -709,7 +917,6 @@ func (d *Decoder) decompress4X8bit(dst, src []byte) ([]byte, error) {
 	shift := (8 - d.actualTableLog) & 7
 
 	const tlSize = 1 << 8
-	const tlMask = tlSize - 1
 	single := d.dt.single[:tlSize]
 
 	// Use temp table to avoid bound checks/append penalty.
diff --git a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash.go b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash.go
index 426b9cac78..2c112a0ab1 100644
--- a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash.go
+++ b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash.go
@@ -195,7 +195,6 @@ func (d *Digest) UnmarshalBinary(b []byte) error {
 	b, d.v4 = consumeUint64(b)
 	b, d.total = consumeUint64(b)
 	copy(d.mem[:], b)
-	b = b[len(d.mem):]
 	d.n = int(d.total % uint64(len(d.mem)))
 	return nil
 }
diff --git a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.go b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.go
index 3ddbd5c0b0..0ae847f75b 100644
--- a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.go
+++ b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.go
@@ -9,4 +9,4 @@ package xxhash
 func Sum64(b []byte) uint64
 
 //go:noescape
-func writeBlocks(*Digest, []byte) int
+func writeBlocks(d *Digest, b []byte) int
diff --git a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.s b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.s
index 2c9c5357a1..be8db5bf79 100644
--- a/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.s
+++ b/vendor/github.com/klauspost/compress/zstd/internal/xxhash/xxhash_amd64.s
@@ -6,7 +6,7 @@
 
 // Register allocation:
 // AX	h
-// CX	pointer to advance through b
+// SI	pointer to advance through b
 // DX	n
 // BX	loop end
 // R8	v1, k1
@@ -16,39 +16,39 @@
 // R12	tmp
 // R13	prime1v
 // R14	prime2v
-// R15	prime4v
+// DI	prime4v
 
-// round reads from and advances the buffer pointer in CX.
+// round reads from and advances the buffer pointer in SI.
 // It assumes that R13 has prime1v and R14 has prime2v.
 #define round(r) \
-	MOVQ  (CX), R12 \
-	ADDQ  $8, CX    \
+	MOVQ  (SI), R12 \
+	ADDQ  $8, SI    \
 	IMULQ R14, R12  \
 	ADDQ  R12, r    \
 	ROLQ  $31, r    \
 	IMULQ R13, r
 
 // mergeRound applies a merge round on the two registers acc and val.
-// It assumes that R13 has prime1v, R14 has prime2v, and R15 has prime4v.
+// It assumes that R13 has prime1v, R14 has prime2v, and DI has prime4v.
 #define mergeRound(acc, val) \
 	IMULQ R14, val \
 	ROLQ  $31, val \
 	IMULQ R13, val \
 	XORQ  val, acc \
 	IMULQ R13, acc \
-	ADDQ  R15, acc
+	ADDQ  DI, acc
 
 // func Sum64(b []byte) uint64
 TEXT ·Sum64(SB), NOSPLIT, $0-32
 	// Load fixed primes.
 	MOVQ ·prime1v(SB), R13
 	MOVQ ·prime2v(SB), R14
-	MOVQ ·prime4v(SB), R15
+	MOVQ ·prime4v(SB), DI
 
 	// Load slice.
-	MOVQ b_base+0(FP), CX
+	MOVQ b_base+0(FP), SI
 	MOVQ b_len+8(FP), DX
-	LEAQ (CX)(DX*1), BX
+	LEAQ (SI)(DX*1), BX
 
 	// The first loop limit will be len(b)-32.
 	SUBQ $32, BX
@@ -65,14 +65,14 @@ TEXT ·Sum64(SB), NOSPLIT, $0-32
 	XORQ R11, R11
 	SUBQ R13, R11
 
-	// Loop until CX > BX.
+	// Loop until SI > BX.
 blockLoop:
 	round(R8)
 	round(R9)
 	round(R10)
 	round(R11)
 
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JLE  blockLoop
 
 	MOVQ R8, AX
@@ -100,16 +100,16 @@ noBlocks:
 afterBlocks:
 	ADDQ DX, AX
 
-	// Right now BX has len(b)-32, and we want to loop until CX > len(b)-8.
+	// Right now BX has len(b)-32, and we want to loop until SI > len(b)-8.
 	ADDQ $24, BX
 
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JG   fourByte
 
 wordLoop:
 	// Calculate k1.
-	MOVQ  (CX), R8
-	ADDQ  $8, CX
+	MOVQ  (SI), R8
+	ADDQ  $8, SI
 	IMULQ R14, R8
 	ROLQ  $31, R8
 	IMULQ R13, R8
@@ -117,18 +117,18 @@ wordLoop:
 	XORQ  R8, AX
 	ROLQ  $27, AX
 	IMULQ R13, AX
-	ADDQ  R15, AX
+	ADDQ  DI, AX
 
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JLE  wordLoop
 
 fourByte:
 	ADDQ $4, BX
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JG   singles
 
-	MOVL  (CX), R8
-	ADDQ  $4, CX
+	MOVL  (SI), R8
+	ADDQ  $4, SI
 	IMULQ R13, R8
 	XORQ  R8, AX
 
@@ -138,19 +138,19 @@ fourByte:
 
 singles:
 	ADDQ $4, BX
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JGE  finalize
 
 singlesLoop:
-	MOVBQZX (CX), R12
-	ADDQ    $1, CX
+	MOVBQZX (SI), R12
+	ADDQ    $1, SI
 	IMULQ   ·prime5v(SB), R12
 	XORQ    R12, AX
 
 	ROLQ  $11, AX
 	IMULQ R13, AX
 
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JL   singlesLoop
 
 finalize:
@@ -179,13 +179,13 @@ TEXT ·writeBlocks(SB), NOSPLIT, $0-40
 	MOVQ ·prime2v(SB), R14
 
 	// Load slice.
-	MOVQ arg1_base+8(FP), CX
-	MOVQ arg1_len+16(FP), DX
-	LEAQ (CX)(DX*1), BX
+	MOVQ b_base+8(FP), SI
+	MOVQ b_len+16(FP), DX
+	LEAQ (SI)(DX*1), BX
 	SUBQ $32, BX
 
 	// Load vN from d.
-	MOVQ arg+0(FP), AX
+	MOVQ d+0(FP), AX
 	MOVQ 0(AX), R8   // v1
 	MOVQ 8(AX), R9   // v2
 	MOVQ 16(AX), R10 // v3
@@ -199,7 +199,7 @@ blockLoop:
 	round(R10)
 	round(R11)
 
-	CMPQ CX, BX
+	CMPQ SI, BX
 	JLE  blockLoop
 
 	// Copy vN back to d.
@@ -208,8 +208,8 @@ blockLoop:
 	MOVQ R10, 16(AX)
 	MOVQ R11, 24(AX)
 
-	// The number of bytes written is CX minus the old base pointer.
-	SUBQ arg1_base+8(FP), CX
-	MOVQ CX, ret+32(FP)
+	// The number of bytes written is SI minus the old base pointer.
+	SUBQ b_base+8(FP), SI
+	MOVQ SI, ret+32(FP)
 
 	RET
diff --git a/vendor/github.com/kr/pretty/.gitignore b/vendor/github.com/kr/pretty/.gitignore
new file mode 100644
index 0000000000..b2d47811f7
--- /dev/null
+++ b/vendor/github.com/kr/pretty/.gitignore
@@ -0,0 +1,5 @@
+[568].out
+_go*
+_test*
+_obj
+/.idea
diff --git a/vendor/github.com/kr/pretty/License b/vendor/github.com/kr/pretty/License
new file mode 100644
index 0000000000..480a328059
--- /dev/null
+++ b/vendor/github.com/kr/pretty/License
@@ -0,0 +1,19 @@
+Copyright 2012 Keith Rarick
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/vendor/github.com/kr/pretty/Readme b/vendor/github.com/kr/pretty/Readme
new file mode 100644
index 0000000000..c589fc622b
--- /dev/null
+++ b/vendor/github.com/kr/pretty/Readme
@@ -0,0 +1,9 @@
+package pretty
+
+    import "github.com/kr/pretty"
+
+    Package pretty provides pretty-printing for Go values.
+
+Documentation
+
+    http://godoc.org/github.com/kr/pretty
diff --git a/vendor/github.com/kr/pretty/diff.go b/vendor/github.com/kr/pretty/diff.go
new file mode 100644
index 0000000000..40a09dc648
--- /dev/null
+++ b/vendor/github.com/kr/pretty/diff.go
@@ -0,0 +1,295 @@
+package pretty
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+)
+
+type sbuf []string
+
+func (p *sbuf) Printf(format string, a ...interface{}) {
+	s := fmt.Sprintf(format, a...)
+	*p = append(*p, s)
+}
+
+// Diff returns a slice where each element describes
+// a difference between a and b.
+func Diff(a, b interface{}) (desc []string) {
+	Pdiff((*sbuf)(&desc), a, b)
+	return desc
+}
+
+// wprintfer calls Fprintf on w for each Printf call
+// with a trailing newline.
+type wprintfer struct{ w io.Writer }
+
+func (p *wprintfer) Printf(format string, a ...interface{}) {
+	fmt.Fprintf(p.w, format+"\n", a...)
+}
+
+// Fdiff writes to w a description of the differences between a and b.
+func Fdiff(w io.Writer, a, b interface{}) {
+	Pdiff(&wprintfer{w}, a, b)
+}
+
+type Printfer interface {
+	Printf(format string, a ...interface{})
+}
+
+// Pdiff prints to p a description of the differences between a and b.
+// It calls Printf once for each difference, with no trailing newline.
+// The standard library log.Logger is a Printfer.
+func Pdiff(p Printfer, a, b interface{}) {
+	d := diffPrinter{
+		w:        p,
+		aVisited: make(map[visit]visit),
+		bVisited: make(map[visit]visit),
+	}
+	d.diff(reflect.ValueOf(a), reflect.ValueOf(b))
+}
+
+type Logfer interface {
+	Logf(format string, a ...interface{})
+}
+
+// logprintfer calls Fprintf on w for each Printf call
+// with a trailing newline.
+type logprintfer struct{ l Logfer }
+
+func (p *logprintfer) Printf(format string, a ...interface{}) {
+	p.l.Logf(format, a...)
+}
+
+// Ldiff prints to l a description of the differences between a and b.
+// It calls Logf once for each difference, with no trailing newline.
+// The standard library testing.T and testing.B are Logfers.
+func Ldiff(l Logfer, a, b interface{}) {
+	Pdiff(&logprintfer{l}, a, b)
+}
+
+type diffPrinter struct {
+	w Printfer
+	l string // label
+
+	aVisited map[visit]visit
+	bVisited map[visit]visit
+}
+
+func (w diffPrinter) printf(f string, a ...interface{}) {
+	var l string
+	if w.l != "" {
+		l = w.l + ": "
+	}
+	w.w.Printf(l+f, a...)
+}
+
+func (w diffPrinter) diff(av, bv reflect.Value) {
+	if !av.IsValid() && bv.IsValid() {
+		w.printf("nil != %# v", formatter{v: bv, quote: true})
+		return
+	}
+	if av.IsValid() && !bv.IsValid() {
+		w.printf("%# v != nil", formatter{v: av, quote: true})
+		return
+	}
+	if !av.IsValid() && !bv.IsValid() {
+		return
+	}
+
+	at := av.Type()
+	bt := bv.Type()
+	if at != bt {
+		w.printf("%v != %v", at, bt)
+		return
+	}
+
+	if av.CanAddr() && bv.CanAddr() {
+		avis := visit{av.UnsafeAddr(), at}
+		bvis := visit{bv.UnsafeAddr(), bt}
+		var cycle bool
+
+		// Have we seen this value before?
+		if vis, ok := w.aVisited[avis]; ok {
+			cycle = true
+			if vis != bvis {
+				w.printf("%# v (previously visited) != %# v", formatter{v: av, quote: true}, formatter{v: bv, quote: true})
+			}
+		} else if _, ok := w.bVisited[bvis]; ok {
+			cycle = true
+			w.printf("%# v != %# v (previously visited)", formatter{v: av, quote: true}, formatter{v: bv, quote: true})
+		}
+		w.aVisited[avis] = bvis
+		w.bVisited[bvis] = avis
+		if cycle {
+			return
+		}
+	}
+
+	switch kind := at.Kind(); kind {
+	case reflect.Bool:
+		if a, b := av.Bool(), bv.Bool(); a != b {
+			w.printf("%v != %v", a, b)
+		}
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		if a, b := av.Int(), bv.Int(); a != b {
+			w.printf("%d != %d", a, b)
+		}
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		if a, b := av.Uint(), bv.Uint(); a != b {
+			w.printf("%d != %d", a, b)
+		}
+	case reflect.Float32, reflect.Float64:
+		if a, b := av.Float(), bv.Float(); a != b {
+			w.printf("%v != %v", a, b)
+		}
+	case reflect.Complex64, reflect.Complex128:
+		if a, b := av.Complex(), bv.Complex(); a != b {
+			w.printf("%v != %v", a, b)
+		}
+	case reflect.Array:
+		n := av.Len()
+		for i := 0; i < n; i++ {
+			w.relabel(fmt.Sprintf("[%d]", i)).diff(av.Index(i), bv.Index(i))
+		}
+	case reflect.Chan, reflect.Func, reflect.UnsafePointer:
+		if a, b := av.Pointer(), bv.Pointer(); a != b {
+			w.printf("%#x != %#x", a, b)
+		}
+	case reflect.Interface:
+		w.diff(av.Elem(), bv.Elem())
+	case reflect.Map:
+		ak, both, bk := keyDiff(av.MapKeys(), bv.MapKeys())
+		for _, k := range ak {
+			w := w.relabel(fmt.Sprintf("[%#v]", k))
+			w.printf("%q != (missing)", av.MapIndex(k))
+		}
+		for _, k := range both {
+			w := w.relabel(fmt.Sprintf("[%#v]", k))
+			w.diff(av.MapIndex(k), bv.MapIndex(k))
+		}
+		for _, k := range bk {
+			w := w.relabel(fmt.Sprintf("[%#v]", k))
+			w.printf("(missing) != %q", bv.MapIndex(k))
+		}
+	case reflect.Ptr:
+		switch {
+		case av.IsNil() && !bv.IsNil():
+			w.printf("nil != %# v", formatter{v: bv, quote: true})
+		case !av.IsNil() && bv.IsNil():
+			w.printf("%# v != nil", formatter{v: av, quote: true})
+		case !av.IsNil() && !bv.IsNil():
+			w.diff(av.Elem(), bv.Elem())
+		}
+	case reflect.Slice:
+		lenA := av.Len()
+		lenB := bv.Len()
+		if lenA != lenB {
+			w.printf("%s[%d] != %s[%d]", av.Type(), lenA, bv.Type(), lenB)
+			break
+		}
+		for i := 0; i < lenA; i++ {
+			w.relabel(fmt.Sprintf("[%d]", i)).diff(av.Index(i), bv.Index(i))
+		}
+	case reflect.String:
+		if a, b := av.String(), bv.String(); a != b {
+			w.printf("%q != %q", a, b)
+		}
+	case reflect.Struct:
+		for i := 0; i < av.NumField(); i++ {
+			w.relabel(at.Field(i).Name).diff(av.Field(i), bv.Field(i))
+		}
+	default:
+		panic("unknown reflect Kind: " + kind.String())
+	}
+}
+
+func (d diffPrinter) relabel(name string) (d1 diffPrinter) {
+	d1 = d
+	if d.l != "" && name[0] != '[' {
+		d1.l += "."
+	}
+	d1.l += name
+	return d1
+}
+
+// keyEqual compares a and b for equality.
+// Both a and b must be valid map keys.
+func keyEqual(av, bv reflect.Value) bool {
+	if !av.IsValid() && !bv.IsValid() {
+		return true
+	}
+	if !av.IsValid() || !bv.IsValid() || av.Type() != bv.Type() {
+		return false
+	}
+	switch kind := av.Kind(); kind {
+	case reflect.Bool:
+		a, b := av.Bool(), bv.Bool()
+		return a == b
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		a, b := av.Int(), bv.Int()
+		return a == b
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		a, b := av.Uint(), bv.Uint()
+		return a == b
+	case reflect.Float32, reflect.Float64:
+		a, b := av.Float(), bv.Float()
+		return a == b
+	case reflect.Complex64, reflect.Complex128:
+		a, b := av.Complex(), bv.Complex()
+		return a == b
+	case reflect.Array:
+		for i := 0; i < av.Len(); i++ {
+			if !keyEqual(av.Index(i), bv.Index(i)) {
+				return false
+			}
+		}
+		return true
+	case reflect.Chan, reflect.UnsafePointer, reflect.Ptr:
+		a, b := av.Pointer(), bv.Pointer()
+		return a == b
+	case reflect.Interface:
+		return keyEqual(av.Elem(), bv.Elem())
+	case reflect.String:
+		a, b := av.String(), bv.String()
+		return a == b
+	case reflect.Struct:
+		for i := 0; i < av.NumField(); i++ {
+			if !keyEqual(av.Field(i), bv.Field(i)) {
+				return false
+			}
+		}
+		return true
+	default:
+		panic("invalid map key type " + av.Type().String())
+	}
+}
+
+func keyDiff(a, b []reflect.Value) (ak, both, bk []reflect.Value) {
+	for _, av := range a {
+		inBoth := false
+		for _, bv := range b {
+			if keyEqual(av, bv) {
+				inBoth = true
+				both = append(both, av)
+				break
+			}
+		}
+		if !inBoth {
+			ak = append(ak, av)
+		}
+	}
+	for _, bv := range b {
+		inBoth := false
+		for _, av := range a {
+			if keyEqual(av, bv) {
+				inBoth = true
+				break
+			}
+		}
+		if !inBoth {
+			bk = append(bk, bv)
+		}
+	}
+	return
+}
diff --git a/vendor/github.com/kr/pretty/formatter.go b/vendor/github.com/kr/pretty/formatter.go
new file mode 100644
index 0000000000..8e6969c590
--- /dev/null
+++ b/vendor/github.com/kr/pretty/formatter.go
@@ -0,0 +1,355 @@
+package pretty
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+	"strconv"
+	"text/tabwriter"
+
+	"github.com/kr/text"
+	"github.com/rogpeppe/go-internal/fmtsort"
+)
+
+type formatter struct {
+	v     reflect.Value
+	force bool
+	quote bool
+}
+
+// Formatter makes a wrapper, f, that will format x as go source with line
+// breaks and tabs. Object f responds to the "%v" formatting verb when both the
+// "#" and " " (space) flags are set, for example:
+//
+//     fmt.Sprintf("%# v", Formatter(x))
+//
+// If one of these two flags is not set, or any other verb is used, f will
+// format x according to the usual rules of package fmt.
+// In particular, if x satisfies fmt.Formatter, then x.Format will be called.
+func Formatter(x interface{}) (f fmt.Formatter) {
+	return formatter{v: reflect.ValueOf(x), quote: true}
+}
+
+func (fo formatter) String() string {
+	return fmt.Sprint(fo.v.Interface()) // unwrap it
+}
+
+func (fo formatter) passThrough(f fmt.State, c rune) {
+	s := "%"
+	for i := 0; i < 128; i++ {
+		if f.Flag(i) {
+			s += string(rune(i))
+		}
+	}
+	if w, ok := f.Width(); ok {
+		s += fmt.Sprintf("%d", w)
+	}
+	if p, ok := f.Precision(); ok {
+		s += fmt.Sprintf(".%d", p)
+	}
+	s += string(c)
+	fmt.Fprintf(f, s, fo.v.Interface())
+}
+
+func (fo formatter) Format(f fmt.State, c rune) {
+	if fo.force || c == 'v' && f.Flag('#') && f.Flag(' ') {
+		w := tabwriter.NewWriter(f, 4, 4, 1, ' ', 0)
+		p := &printer{tw: w, Writer: w, visited: make(map[visit]int)}
+		p.printValue(fo.v, true, fo.quote)
+		w.Flush()
+		return
+	}
+	fo.passThrough(f, c)
+}
+
+type printer struct {
+	io.Writer
+	tw      *tabwriter.Writer
+	visited map[visit]int
+	depth   int
+}
+
+func (p *printer) indent() *printer {
+	q := *p
+	q.tw = tabwriter.NewWriter(p.Writer, 4, 4, 1, ' ', 0)
+	q.Writer = text.NewIndentWriter(q.tw, []byte{'\t'})
+	return &q
+}
+
+func (p *printer) printInline(v reflect.Value, x interface{}, showType bool) {
+	if showType {
+		io.WriteString(p, v.Type().String())
+		fmt.Fprintf(p, "(%#v)", x)
+	} else {
+		fmt.Fprintf(p, "%#v", x)
+	}
+}
+
+// printValue must keep track of already-printed pointer values to avoid
+// infinite recursion.
+type visit struct {
+	v   uintptr
+	typ reflect.Type
+}
+
+func (p *printer) catchPanic(v reflect.Value, method string) {
+	if r := recover(); r != nil {
+		if v.Kind() == reflect.Ptr && v.IsNil() {
+			writeByte(p, '(')
+			io.WriteString(p, v.Type().String())
+			io.WriteString(p, ")(nil)")
+			return
+		}
+		writeByte(p, '(')
+		io.WriteString(p, v.Type().String())
+		io.WriteString(p, ")(PANIC=calling method ")
+		io.WriteString(p, strconv.Quote(method))
+		io.WriteString(p, ": ")
+		fmt.Fprint(p, r)
+		writeByte(p, ')')
+	}
+}
+
+func (p *printer) printValue(v reflect.Value, showType, quote bool) {
+	if p.depth > 10 {
+		io.WriteString(p, "!%v(DEPTH EXCEEDED)")
+		return
+	}
+
+	if v.IsValid() && v.CanInterface() {
+		i := v.Interface()
+		if goStringer, ok := i.(fmt.GoStringer); ok {
+			defer p.catchPanic(v, "GoString")
+			io.WriteString(p, goStringer.GoString())
+			return
+		}
+	}
+
+	switch v.Kind() {
+	case reflect.Bool:
+		p.printInline(v, v.Bool(), showType)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		p.printInline(v, v.Int(), showType)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		p.printInline(v, v.Uint(), showType)
+	case reflect.Float32, reflect.Float64:
+		p.printInline(v, v.Float(), showType)
+	case reflect.Complex64, reflect.Complex128:
+		fmt.Fprintf(p, "%#v", v.Complex())
+	case reflect.String:
+		p.fmtString(v.String(), quote)
+	case reflect.Map:
+		t := v.Type()
+		if showType {
+			io.WriteString(p, t.String())
+		}
+		writeByte(p, '{')
+		if nonzero(v) {
+			expand := !canInline(v.Type())
+			pp := p
+			if expand {
+				writeByte(p, '\n')
+				pp = p.indent()
+			}
+			sm := fmtsort.Sort(v)
+			for i := 0; i < v.Len(); i++ {
+				k := sm.Key[i]
+				mv := sm.Value[i]
+				pp.printValue(k, false, true)
+				writeByte(pp, ':')
+				if expand {
+					writeByte(pp, '\t')
+				}
+				showTypeInStruct := t.Elem().Kind() == reflect.Interface
+				pp.printValue(mv, showTypeInStruct, true)
+				if expand {
+					io.WriteString(pp, ",\n")
+				} else if i < v.Len()-1 {
+					io.WriteString(pp, ", ")
+				}
+			}
+			if expand {
+				pp.tw.Flush()
+			}
+		}
+		writeByte(p, '}')
+	case reflect.Struct:
+		t := v.Type()
+		if v.CanAddr() {
+			addr := v.UnsafeAddr()
+			vis := visit{addr, t}
+			if vd, ok := p.visited[vis]; ok && vd < p.depth {
+				p.fmtString(t.String()+"{(CYCLIC REFERENCE)}", false)
+				break // don't print v again
+			}
+			p.visited[vis] = p.depth
+		}
+
+		if showType {
+			io.WriteString(p, t.String())
+		}
+		writeByte(p, '{')
+		if nonzero(v) {
+			expand := !canInline(v.Type())
+			pp := p
+			if expand {
+				writeByte(p, '\n')
+				pp = p.indent()
+			}
+			for i := 0; i < v.NumField(); i++ {
+				showTypeInStruct := true
+				if f := t.Field(i); f.Name != "" {
+					io.WriteString(pp, f.Name)
+					writeByte(pp, ':')
+					if expand {
+						writeByte(pp, '\t')
+					}
+					showTypeInStruct = labelType(f.Type)
+				}
+				pp.printValue(getField(v, i), showTypeInStruct, true)
+				if expand {
+					io.WriteString(pp, ",\n")
+				} else if i < v.NumField()-1 {
+					io.WriteString(pp, ", ")
+				}
+			}
+			if expand {
+				pp.tw.Flush()
+			}
+		}
+		writeByte(p, '}')
+	case reflect.Interface:
+		switch e := v.Elem(); {
+		case e.Kind() == reflect.Invalid:
+			io.WriteString(p, "nil")
+		case e.IsValid():
+			pp := *p
+			pp.depth++
+			pp.printValue(e, showType, true)
+		default:
+			io.WriteString(p, v.Type().String())
+			io.WriteString(p, "(nil)")
+		}
+	case reflect.Array, reflect.Slice:
+		t := v.Type()
+		if showType {
+			io.WriteString(p, t.String())
+		}
+		if v.Kind() == reflect.Slice && v.IsNil() && showType {
+			io.WriteString(p, "(nil)")
+			break
+		}
+		if v.Kind() == reflect.Slice && v.IsNil() {
+			io.WriteString(p, "nil")
+			break
+		}
+		writeByte(p, '{')
+		expand := !canInline(v.Type())
+		pp := p
+		if expand {
+			writeByte(p, '\n')
+			pp = p.indent()
+		}
+		for i := 0; i < v.Len(); i++ {
+			showTypeInSlice := t.Elem().Kind() == reflect.Interface
+			pp.printValue(v.Index(i), showTypeInSlice, true)
+			if expand {
+				io.WriteString(pp, ",\n")
+			} else if i < v.Len()-1 {
+				io.WriteString(pp, ", ")
+			}
+		}
+		if expand {
+			pp.tw.Flush()
+		}
+		writeByte(p, '}')
+	case reflect.Ptr:
+		e := v.Elem()
+		if !e.IsValid() {
+			writeByte(p, '(')
+			io.WriteString(p, v.Type().String())
+			io.WriteString(p, ")(nil)")
+		} else {
+			pp := *p
+			pp.depth++
+			writeByte(pp, '&')
+			pp.printValue(e, true, true)
+		}
+	case reflect.Chan:
+		x := v.Pointer()
+		if showType {
+			writeByte(p, '(')
+			io.WriteString(p, v.Type().String())
+			fmt.Fprintf(p, ")(%#v)", x)
+		} else {
+			fmt.Fprintf(p, "%#v", x)
+		}
+	case reflect.Func:
+		io.WriteString(p, v.Type().String())
+		io.WriteString(p, " {...}")
+	case reflect.UnsafePointer:
+		p.printInline(v, v.Pointer(), showType)
+	case reflect.Invalid:
+		io.WriteString(p, "nil")
+	}
+}
+
+func canInline(t reflect.Type) bool {
+	switch t.Kind() {
+	case reflect.Map:
+		return !canExpand(t.Elem())
+	case reflect.Struct:
+		for i := 0; i < t.NumField(); i++ {
+			if canExpand(t.Field(i).Type) {
+				return false
+			}
+		}
+		return true
+	case reflect.Interface:
+		return false
+	case reflect.Array, reflect.Slice:
+		return !canExpand(t.Elem())
+	case reflect.Ptr:
+		return false
+	case reflect.Chan, reflect.Func, reflect.UnsafePointer:
+		return false
+	}
+	return true
+}
+
+func canExpand(t reflect.Type) bool {
+	switch t.Kind() {
+	case reflect.Map, reflect.Struct,
+		reflect.Interface, reflect.Array, reflect.Slice,
+		reflect.Ptr:
+		return true
+	}
+	return false
+}
+
+func labelType(t reflect.Type) bool {
+	switch t.Kind() {
+	case reflect.Interface, reflect.Struct:
+		return true
+	}
+	return false
+}
+
+func (p *printer) fmtString(s string, quote bool) {
+	if quote {
+		s = strconv.Quote(s)
+	}
+	io.WriteString(p, s)
+}
+
+func writeByte(w io.Writer, b byte) {
+	w.Write([]byte{b})
+}
+
+func getField(v reflect.Value, i int) reflect.Value {
+	val := v.Field(i)
+	if val.Kind() == reflect.Interface && !val.IsNil() {
+		val = val.Elem()
+	}
+	return val
+}
diff --git a/vendor/github.com/kr/pretty/pretty.go b/vendor/github.com/kr/pretty/pretty.go
new file mode 100644
index 0000000000..b4ca583c02
--- /dev/null
+++ b/vendor/github.com/kr/pretty/pretty.go
@@ -0,0 +1,108 @@
+// Package pretty provides pretty-printing for Go values. This is
+// useful during debugging, to avoid wrapping long output lines in
+// the terminal.
+//
+// It provides a function, Formatter, that can be used with any
+// function that accepts a format string. It also provides
+// convenience wrappers for functions in packages fmt and log.
+package pretty
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"reflect"
+)
+
+// Errorf is a convenience wrapper for fmt.Errorf.
+//
+// Calling Errorf(f, x, y) is equivalent to
+// fmt.Errorf(f, Formatter(x), Formatter(y)).
+func Errorf(format string, a ...interface{}) error {
+	return fmt.Errorf(format, wrap(a, false)...)
+}
+
+// Fprintf is a convenience wrapper for fmt.Fprintf.
+//
+// Calling Fprintf(w, f, x, y) is equivalent to
+// fmt.Fprintf(w, f, Formatter(x), Formatter(y)).
+func Fprintf(w io.Writer, format string, a ...interface{}) (n int, error error) {
+	return fmt.Fprintf(w, format, wrap(a, false)...)
+}
+
+// Log is a convenience wrapper for log.Printf.
+//
+// Calling Log(x, y) is equivalent to
+// log.Print(Formatter(x), Formatter(y)), but each operand is
+// formatted with "%# v".
+func Log(a ...interface{}) {
+	log.Print(wrap(a, true)...)
+}
+
+// Logf is a convenience wrapper for log.Printf.
+//
+// Calling Logf(f, x, y) is equivalent to
+// log.Printf(f, Formatter(x), Formatter(y)).
+func Logf(format string, a ...interface{}) {
+	log.Printf(format, wrap(a, false)...)
+}
+
+// Logln is a convenience wrapper for log.Printf.
+//
+// Calling Logln(x, y) is equivalent to
+// log.Println(Formatter(x), Formatter(y)), but each operand is
+// formatted with "%# v".
+func Logln(a ...interface{}) {
+	log.Println(wrap(a, true)...)
+}
+
+// Print pretty-prints its operands and writes to standard output.
+//
+// Calling Print(x, y) is equivalent to
+// fmt.Print(Formatter(x), Formatter(y)), but each operand is
+// formatted with "%# v".
+func Print(a ...interface{}) (n int, errno error) {
+	return fmt.Print(wrap(a, true)...)
+}
+
+// Printf is a convenience wrapper for fmt.Printf.
+//
+// Calling Printf(f, x, y) is equivalent to
+// fmt.Printf(f, Formatter(x), Formatter(y)).
+func Printf(format string, a ...interface{}) (n int, errno error) {
+	return fmt.Printf(format, wrap(a, false)...)
+}
+
+// Println pretty-prints its operands and writes to standard output.
+//
+// Calling Println(x, y) is equivalent to
+// fmt.Println(Formatter(x), Formatter(y)), but each operand is
+// formatted with "%# v".
+func Println(a ...interface{}) (n int, errno error) {
+	return fmt.Println(wrap(a, true)...)
+}
+
+// Sprint is a convenience wrapper for fmt.Sprintf.
+//
+// Calling Sprint(x, y) is equivalent to
+// fmt.Sprint(Formatter(x), Formatter(y)), but each operand is
+// formatted with "%# v".
+func Sprint(a ...interface{}) string {
+	return fmt.Sprint(wrap(a, true)...)
+}
+
+// Sprintf is a convenience wrapper for fmt.Sprintf.
+//
+// Calling Sprintf(f, x, y) is equivalent to
+// fmt.Sprintf(f, Formatter(x), Formatter(y)).
+func Sprintf(format string, a ...interface{}) string {
+	return fmt.Sprintf(format, wrap(a, false)...)
+}
+
+func wrap(a []interface{}, force bool) []interface{} {
+	w := make([]interface{}, len(a))
+	for i, x := range a {
+		w[i] = formatter{v: reflect.ValueOf(x), force: force}
+	}
+	return w
+}
diff --git a/vendor/github.com/kr/pretty/zero.go b/vendor/github.com/kr/pretty/zero.go
new file mode 100644
index 0000000000..abb5b6fc14
--- /dev/null
+++ b/vendor/github.com/kr/pretty/zero.go
@@ -0,0 +1,41 @@
+package pretty
+
+import (
+	"reflect"
+)
+
+func nonzero(v reflect.Value) bool {
+	switch v.Kind() {
+	case reflect.Bool:
+		return v.Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() != 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return v.Uint() != 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() != 0
+	case reflect.Complex64, reflect.Complex128:
+		return v.Complex() != complex(0, 0)
+	case reflect.String:
+		return v.String() != ""
+	case reflect.Struct:
+		for i := 0; i < v.NumField(); i++ {
+			if nonzero(getField(v, i)) {
+				return true
+			}
+		}
+		return false
+	case reflect.Array:
+		for i := 0; i < v.Len(); i++ {
+			if nonzero(v.Index(i)) {
+				return true
+			}
+		}
+		return false
+	case reflect.Map, reflect.Interface, reflect.Slice, reflect.Ptr, reflect.Chan, reflect.Func:
+		return !v.IsNil()
+	case reflect.UnsafePointer:
+		return v.Pointer() != 0
+	}
+	return true
+}
diff --git a/vendor/github.com/kr/text/License b/vendor/github.com/kr/text/License
new file mode 100644
index 0000000000..480a328059
--- /dev/null
+++ b/vendor/github.com/kr/text/License
@@ -0,0 +1,19 @@
+Copyright 2012 Keith Rarick
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/vendor/github.com/kr/text/Readme b/vendor/github.com/kr/text/Readme
new file mode 100644
index 0000000000..7e6e7c0687
--- /dev/null
+++ b/vendor/github.com/kr/text/Readme
@@ -0,0 +1,3 @@
+This is a Go package for manipulating paragraphs of text.
+
+See http://go.pkgdoc.org/github.com/kr/text for full documentation.
diff --git a/vendor/github.com/kr/text/doc.go b/vendor/github.com/kr/text/doc.go
new file mode 100644
index 0000000000..cf4c198f95
--- /dev/null
+++ b/vendor/github.com/kr/text/doc.go
@@ -0,0 +1,3 @@
+// Package text provides rudimentary functions for manipulating text in
+// paragraphs.
+package text
diff --git a/vendor/github.com/kr/text/indent.go b/vendor/github.com/kr/text/indent.go
new file mode 100644
index 0000000000..4ebac45c09
--- /dev/null
+++ b/vendor/github.com/kr/text/indent.go
@@ -0,0 +1,74 @@
+package text
+
+import (
+	"io"
+)
+
+// Indent inserts prefix at the beginning of each non-empty line of s. The
+// end-of-line marker is NL.
+func Indent(s, prefix string) string {
+	return string(IndentBytes([]byte(s), []byte(prefix)))
+}
+
+// IndentBytes inserts prefix at the beginning of each non-empty line of b.
+// The end-of-line marker is NL.
+func IndentBytes(b, prefix []byte) []byte {
+	var res []byte
+	bol := true
+	for _, c := range b {
+		if bol && c != '\n' {
+			res = append(res, prefix...)
+		}
+		res = append(res, c)
+		bol = c == '\n'
+	}
+	return res
+}
+
+// Writer indents each line of its input.
+type indentWriter struct {
+	w   io.Writer
+	bol bool
+	pre [][]byte
+	sel int
+	off int
+}
+
+// NewIndentWriter makes a new write filter that indents the input
+// lines. Each line is prefixed in order with the corresponding
+// element of pre. If there are more lines than elements, the last
+// element of pre is repeated for each subsequent line.
+func NewIndentWriter(w io.Writer, pre ...[]byte) io.Writer {
+	return &indentWriter{
+		w:   w,
+		pre: pre,
+		bol: true,
+	}
+}
+
+// The only errors returned are from the underlying indentWriter.
+func (w *indentWriter) Write(p []byte) (n int, err error) {
+	for _, c := range p {
+		if w.bol {
+			var i int
+			i, err = w.w.Write(w.pre[w.sel][w.off:])
+			w.off += i
+			if err != nil {
+				return n, err
+			}
+		}
+		_, err = w.w.Write([]byte{c})
+		if err != nil {
+			return n, err
+		}
+		n++
+		w.bol = c == '\n'
+		if w.bol {
+			w.off = 0
+			if w.sel < len(w.pre)-1 {
+				w.sel++
+			}
+		}
+	}
+	return n, nil
+}
diff --git a/vendor/github.com/kr/text/wrap.go b/vendor/github.com/kr/text/wrap.go
new file mode 100644
index 0000000000..b09bb03736
--- /dev/null
+++ b/vendor/github.com/kr/text/wrap.go
@@ -0,0 +1,86 @@
+package text
+
+import (
+	"bytes"
+	"math"
+)
+
+var (
+	nl = []byte{'\n'}
+	sp = []byte{' '}
+)
+
+const defaultPenalty = 1e5
+
+// Wrap wraps s into a paragraph of lines of length lim, with minimal
+// raggedness.
+func Wrap(s string, lim int) string {
+	return string(WrapBytes([]byte(s), lim))
+}
+
+// WrapBytes wraps b into a paragraph of lines of length lim, with minimal
+// raggedness.
+func WrapBytes(b []byte, lim int) []byte {
+	words := bytes.Split(bytes.Replace(bytes.TrimSpace(b), nl, sp, -1), sp)
+	var lines [][]byte
+	for _, line := range WrapWords(words, 1, lim, defaultPenalty) {
+		lines = append(lines, bytes.Join(line, sp))
+	}
+	return bytes.Join(lines, nl)
+}
+
+// WrapWords is the low-level line-breaking algorithm, useful if you need more
+// control over the details of the text wrapping process. For most uses, either
+// Wrap or WrapBytes will be sufficient and more convenient.
+//
+// WrapWords splits a list of words into lines with minimal "raggedness",
+// treating each byte as one unit, accounting for spc units between adjacent
+// words on each line, and attempting to limit lines to lim units. Raggedness
+// is the total error over all lines, where error is the square of the
+// difference of the length of the line and lim. Too-long lines (which only
+// happen when a single word is longer than lim units) have pen penalty units
+// added to the error.
+func WrapWords(words [][]byte, spc, lim, pen int) [][][]byte {
+	n := len(words)
+
+	length := make([][]int, n)
+	for i := 0; i < n; i++ {
+		length[i] = make([]int, n)
+		length[i][i] = len(words[i])
+		for j := i + 1; j < n; j++ {
+			length[i][j] = length[i][j-1] + spc + len(words[j])
+		}
+	}
+
+	nbrk := make([]int, n)
+	cost := make([]int, n)
+	for i := range cost {
+		cost[i] = math.MaxInt32
+	}
+	for i := n - 1; i >= 0; i-- {
+		if length[i][n-1] <= lim || i == n-1 {
+			cost[i] = 0
+			nbrk[i] = n
+		} else {
+			for j := i + 1; j < n; j++ {
+				d := lim - length[i][j-1]
+				c := d*d + cost[j]
+				if length[i][j-1] > lim {
+					c += pen // too-long lines get a worse penalty
+				}
+				if c < cost[i] {
+					cost[i] = c
+					nbrk[i] = j
+				}
+			}
+		}
+	}
+
+	var lines [][][]byte
+	i := 0
+	for i < n {
+		lines = append(lines, words[i:nbrk[i]])
+		i = nbrk[i]
+	}
+	return lines
+}
diff --git a/vendor/github.com/mattn/go-runewidth/go.mod b/vendor/github.com/mattn/go-runewidth/go.mod
deleted file mode 100644
index fa7f4d864e..0000000000
--- a/vendor/github.com/mattn/go-runewidth/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/mattn/go-runewidth
-
-go 1.9
diff --git a/vendor/github.com/miekg/dns/go.mod b/vendor/github.com/miekg/dns/go.mod
deleted file mode 100644
index aff65114de..0000000000
--- a/vendor/github.com/miekg/dns/go.mod
+++ /dev/null
@@ -1,9 +0,0 @@
-module github.com/miekg/dns
-
-go 1.14
-
-require (
-	golang.org/x/net v0.0.0-20210226172049-e18ecbb05110
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
-	golang.org/x/sys v0.0.0-20210303074136-134d130e1a04
-)
diff --git a/vendor/github.com/miekg/dns/go.sum b/vendor/github.com/miekg/dns/go.sum
deleted file mode 100644
index 3359ebea4e..0000000000
--- a/vendor/github.com/miekg/dns/go.sum
+++ /dev/null
@@ -1,10 +0,0 @@
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04 h1:cEhElsAv9LUt9ZUUocxzWe05oFLVd+AA2nstydTeI8g=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
diff --git a/vendor/github.com/moby/locker/LICENSE b/vendor/github.com/moby/locker/LICENSE
new file mode 100644
index 0000000000..2e0ec1dcf1
--- /dev/null
+++ b/vendor/github.com/moby/locker/LICENSE
@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2013-2018 Docker, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/moby/locker/README.md b/vendor/github.com/moby/locker/README.md
new file mode 100644
index 0000000000..a0852f0f8e
--- /dev/null
+++ b/vendor/github.com/moby/locker/README.md
@@ -0,0 +1,65 @@
+Locker
+=====
+
+locker provides a mechanism for creating finer-grained locking to help
+free up more global locks to handle other tasks.
+
+The implementation looks close to a sync.Mutex, however, the user must provide a
+reference to use to refer to the underlying lock when locking and unlocking,
+and unlock may generate an error.
+
+If a lock with a given name does not exist when `Lock` is called, one is
+created.
+Lock references are automatically cleaned up on `Unlock` if nothing else is
+waiting for the lock.
+
+
+## Usage
+
+```go
+package important
+
+import (
+	"sync"
+	"time"
+
+	"github.com/moby/locker"
+)
+
+type important struct {
+	locks *locker.Locker
+	data  map[string]interface{}
+	mu    sync.Mutex
+}
+
+func (i *important) Get(name string) interface{} {
+	i.locks.Lock(name)
+	defer i.locks.Unlock(name)
+	return i.data[name]
+}
+
+func (i *important) Create(name string, data interface{}) {
+	i.locks.Lock(name)
+	defer i.locks.Unlock(name)
+
+	i.createImportant(data)
+
+	i.mu.Lock()
+	i.data[name] = data
+	i.mu.Unlock()
+}
+
+func (i *important) createImportant(data interface{}) {
+	time.Sleep(10 * time.Second)
+}
+```
+
+For functions dealing with a given name, always lock at the beginning of the
+function (or before doing anything with the underlying state), this ensures any
+other function that is dealing with the same name will block.
+
+When needing to modify the underlying data, use the global lock to ensure nothing
+else is modifying it at the same time.
+Since name lock is already in place, no reads will occur while the modification
+is being performed.
+
diff --git a/vendor/github.com/moby/locker/locker.go b/vendor/github.com/moby/locker/locker.go
new file mode 100644
index 0000000000..0b22ddfab8
--- /dev/null
+++ b/vendor/github.com/moby/locker/locker.go
@@ -0,0 +1,112 @@
+/*
+Package locker provides a mechanism for creating finer-grained locking to help
+free up more global locks to handle other tasks.
+
+The implementation looks close to a sync.Mutex, however the user must provide a
+reference to use to refer to the underlying lock when locking and unlocking,
+and unlock may generate an error.
+
+If a lock with a given name does not exist when `Lock` is called, one is
+created.
+Lock references are automatically cleaned up on `Unlock` if nothing else is
+waiting for the lock.
+*/
+package locker
+
+import (
+	"errors"
+	"sync"
+	"sync/atomic"
+)
+
+// ErrNoSuchLock is returned when the requested lock does not exist
+var ErrNoSuchLock = errors.New("no such lock")
+
+// Locker provides a locking mechanism based on the passed in reference name
+type Locker struct {
+	mu    sync.Mutex
+	locks map[string]*lockCtr
+}
+
+// lockCtr is used by Locker to represent a lock with a given name.
+type lockCtr struct {
+	mu sync.Mutex
+	// waiters is the number of waiters waiting to acquire the lock
+	// this is int32 instead of uint32 so we can add `-1` in `dec()`
+	waiters int32
+}
+
+// inc increments the number of waiters waiting for the lock
+func (l *lockCtr) inc() {
+	atomic.AddInt32(&l.waiters, 1)
+}
+
+// dec decrements the number of waiters waiting on the lock
+func (l *lockCtr) dec() {
+	atomic.AddInt32(&l.waiters, -1)
+}
+
+// count gets the current number of waiters
+func (l *lockCtr) count() int32 {
+	return atomic.LoadInt32(&l.waiters)
+}
+
+// Lock locks the mutex
+func (l *lockCtr) Lock() {
+	l.mu.Lock()
+}
+
+// Unlock unlocks the mutex
+func (l *lockCtr) Unlock() {
+	l.mu.Unlock()
+}
+
+// New creates a new Locker
+func New() *Locker {
+	return &Locker{
+		locks: make(map[string]*lockCtr),
+	}
+}
+
+// Lock locks a mutex with the given name. If it doesn't exist, one is created
+func (l *Locker) Lock(name string) {
+	l.mu.Lock()
+	if l.locks == nil {
+		l.locks = make(map[string]*lockCtr)
+	}
+
+	nameLock, exists := l.locks[name]
+	if !exists {
+		nameLock = &lockCtr{}
+		l.locks[name] = nameLock
+	}
+
+	// increment the nameLock waiters while inside the main mutex
+	// this makes sure that the lock isn't deleted if `Lock` and `Unlock` are called concurrently
+	nameLock.inc()
+	l.mu.Unlock()
+
+	// Lock the nameLock outside the main mutex so we don't block other operations
+	// once locked then we can decrement the number of waiters for this lock
+	nameLock.Lock()
+	nameLock.dec()
+}
+
+// Unlock unlocks the mutex with the given name
+// If the given lock is not being waited on by any other callers, it is deleted
+func (l *Locker) Unlock(name string) error {
+	l.mu.Lock()
+	nameLock, exists := l.locks[name]
+	if !exists {
+		l.mu.Unlock()
+		return ErrNoSuchLock
+	}
+
+	if nameLock.count() == 0 {
+		delete(l.locks, name)
+	}
+	nameLock.Unlock()
+
+	l.mu.Unlock()
+	return nil
+}
diff --git a/vendor/github.com/olekukonko/tablewriter/go.mod b/vendor/github.com/olekukonko/tablewriter/go.mod
deleted file mode 100644
index 484ab01f11..0000000000
--- a/vendor/github.com/olekukonko/tablewriter/go.mod
+++ /dev/null
@@ -1,5 +0,0 @@
-module github.com/olekukonko/tablewriter
-
-go 1.12
-
-require github.com/mattn/go-runewidth v0.0.9
diff --git a/vendor/github.com/olekukonko/tablewriter/go.sum b/vendor/github.com/olekukonko/tablewriter/go.sum
deleted file mode 100644
index 4a94bf58b4..0000000000
--- a/vendor/github.com/olekukonko/tablewriter/go.sum
+++ /dev/null
@@ -1,2 +0,0 @@
-github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
diff --git a/vendor/github.com/opencontainers/go-digest/.mailmap b/vendor/github.com/opencontainers/go-digest/.mailmap
new file mode 100644
index 0000000000..eaf8b2f9e6
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/.mailmap
@@ -0,0 +1,4 @@
+Aaron Lehmann <aaronl@vitelus.com> <aaron.lehmann@docker.com>
+Derek McGowan <derek@mcg.dev> <derek@mcgstyle.net>
+Stephen J Day <stephen.day@docker.com> <stevvooe@users.noreply.github.com>
+Haibing Zhou <zhouhaibing089@gmail.com>
diff --git a/vendor/github.com/opencontainers/go-digest/.pullapprove.yml b/vendor/github.com/opencontainers/go-digest/.pullapprove.yml
new file mode 100644
index 0000000000..b6165f83ca
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/.pullapprove.yml
@@ -0,0 +1,28 @@
+version: 2
+
+requirements:
+  signed_off_by:
+    required: true
+
+always_pending:
+  title_regex: '^WIP'
+  explanation: 'Work in progress...'
+
+group_defaults:
+  required: 2
+  approve_by_comment:
+    enabled: true
+    approve_regex: '^LGTM'
+    reject_regex: '^Rejected'
+  reset_on_push:
+    enabled: true
+  author_approval:
+    ignored: true
+  conditions:
+    branches:
+      - master
+
+groups:
+  go-digest:
+    teams:
+      - go-digest-maintainers
diff --git a/vendor/github.com/opencontainers/go-digest/.travis.yml b/vendor/github.com/opencontainers/go-digest/.travis.yml
new file mode 100644
index 0000000000..5775f885c1
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/.travis.yml
@@ -0,0 +1,5 @@
+language: go
+go:
+  - 1.12.x
+  - 1.13.x
+  - master
diff --git a/vendor/github.com/opencontainers/go-digest/CONTRIBUTING.md b/vendor/github.com/opencontainers/go-digest/CONTRIBUTING.md
new file mode 100644
index 0000000000..e4d962ac16
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/CONTRIBUTING.md
@@ -0,0 +1,72 @@
+# Contributing to Docker open source projects
+
+Want to hack on this project? Awesome! Here are instructions to get you started.
+
+This project is a part of the [Docker](https://www.docker.com) project, and follows
+the same rules and principles. If you're already familiar with the way
+Docker does things, you'll feel right at home.
+
+Otherwise, go read Docker's
+[contributions guidelines](https://github.com/docker/docker/blob/master/CONTRIBUTING.md),
+[issue triaging](https://github.com/docker/docker/blob/master/project/ISSUE-TRIAGE.md),
+[review process](https://github.com/docker/docker/blob/master/project/REVIEWING.md) and
+[branches and tags](https://github.com/docker/docker/blob/master/project/BRANCHES-AND-TAGS.md).
+
+For an in-depth description of our contribution process, visit the
+contributors guide: [Understand how to contribute](https://docs.docker.com/opensource/workflow/make-a-contribution/)
+
+### Sign your work
+
+The sign-off is a simple line at the end of the explanation for the patch. Your
+signature certifies that you wrote the patch or otherwise have the right to pass
+it on as an open-source patch. The rules are pretty simple: if you can certify
+the below (from [developercertificate.org](http://developercertificate.org/)):
+
+```
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+1 Letterman Drive
+Suite D4700
+San Francisco, CA, 94129
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
+```
+
+Then you just add a line to every git commit message:
+
+    Signed-off-by: Joe Smith <joe.smith@email.com>
+
+Use your real name (sorry, no pseudonyms or anonymous contributions.)
+
+If you set your `user.name` and `user.email` git configs, you can sign your
+commit automatically with `git commit -s`.
diff --git a/vendor/github.com/opencontainers/go-digest/LICENSE b/vendor/github.com/opencontainers/go-digest/LICENSE
new file mode 100644
index 0000000000..3ac8ab6487
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/LICENSE
@@ -0,0 +1,192 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2019, 2020 OCI Contributors
+   Copyright 2016 Docker, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/opencontainers/go-digest/LICENSE.docs b/vendor/github.com/opencontainers/go-digest/LICENSE.docs
new file mode 100644
index 0000000000..e26cd4fc8e
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/LICENSE.docs
@@ -0,0 +1,425 @@
+Attribution-ShareAlike 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+	wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More_considerations
+     for the public:
+	wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution-ShareAlike 4.0 International Public
+License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution-ShareAlike 4.0 International Public License ("Public
+License"). To the extent this Public License may be interpreted as a
+contract, You are granted the Licensed Rights in consideration of Your
+acceptance of these terms and conditions, and the Licensor grants You
+such rights in consideration of benefits the Licensor receives from
+making the Licensed Material available under these terms and
+conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. BY-SA Compatible License means a license listed at
+     creativecommons.org/compatiblelicenses, approved by Creative
+     Commons as essentially the equivalent of this Public License.
+
+  d. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  e. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  g. License Elements means the license attributes listed in the name
+     of a Creative Commons Public License. The License Elements of this
+     Public License are Attribution and ShareAlike.
+
+  h. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  i. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  j. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  k. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  l. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  m. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. Additional offer from the Licensor -- Adapted Material.
+               Every recipient of Adapted Material from You
+               automatically receives an offer from the Licensor to
+               exercise the Licensed Rights in the Adapted Material
+               under the conditions of the Adapter's License You apply.
+
+            c. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+  b. ShareAlike.
+
+     In addition to the conditions in Section 3(a), if You Share
+     Adapted Material You produce, the following conditions also apply.
+
+       1. The Adapter's License You apply must be a Creative Commons
+          license with the same License Elements, this version or
+          later, or a BY-SA Compatible License.
+
+       2. You must include the text of, or the URI or hyperlink to, the
+          Adapter's License You apply. You may satisfy this condition
+          in any reasonable manner based on the medium, means, and
+          context in which You Share Adapted Material.
+
+       3. You may not offer or impose any additional or different terms
+          or conditions on, or apply any Effective Technological
+          Measures to, Adapted Material that restrict exercise of the
+          rights granted under the Adapter's License You apply.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material,
+
+     including for purposes of Section 3(b); and
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public licenses.
+Notwithstanding, Creative Commons may elect to apply one of its public
+licenses to material it publishes and in those instances will be
+considered the "Licensor." Except for the limited purpose of indicating
+that material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the public
+licenses.
+
+Creative Commons may be contacted at creativecommons.org.
diff --git a/vendor/github.com/opencontainers/go-digest/MAINTAINERS b/vendor/github.com/opencontainers/go-digest/MAINTAINERS
new file mode 100644
index 0000000000..843b1b2061
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/MAINTAINERS
@@ -0,0 +1,5 @@
+Derek McGowan <derek@mcgstyle.net> (@dmcgowan)
+Stephen Day <stevvooe@gmail.com> (@stevvooe)
+Vincent Batts <vbatts@hashbangbash.com> (@vbatts)
+Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> (@AkihiroSuda)
+Sebastiaan van Stijn <github@gone.nl> (@thaJeztah)
diff --git a/vendor/github.com/opencontainers/go-digest/README.md b/vendor/github.com/opencontainers/go-digest/README.md
new file mode 100644
index 0000000000..a11287207e
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/README.md
@@ -0,0 +1,96 @@
+# go-digest
+
+[![GoDoc](https://godoc.org/github.com/opencontainers/go-digest?status.svg)](https://godoc.org/github.com/opencontainers/go-digest) [![Go Report Card](https://goreportcard.com/badge/github.com/opencontainers/go-digest)](https://goreportcard.com/report/github.com/opencontainers/go-digest) [![Build Status](https://travis-ci.org/opencontainers/go-digest.svg?branch=master)](https://travis-ci.org/opencontainers/go-digest)
+
+Common digest package used across the container ecosystem.
+
+Please see the [godoc](https://godoc.org/github.com/opencontainers/go-digest) for more information.
+
+# What is a digest?
+
+A digest is just a [hash](https://en.wikipedia.org/wiki/Hash_function).
+
+The most common use case for a digest is to create a content identifier for use in [Content Addressable Storage](https://en.wikipedia.org/wiki/Content-addressable_storage) systems:
+
+```go
+id := digest.FromBytes([]byte("my content"))
+```
+
+In the example above, the id can be used to uniquely identify the byte slice "my content".
+This allows two disparate applications to agree on a verifiable identifier without having to trust one another.
+
+An identifying digest can be verified, as follows:
+
+```go
+if id != digest.FromBytes([]byte("my content")) {
+  return errors.New("the content has changed!")
+}
+```
+
+A `Verifier` type can be used to handle cases where an `io.Reader` makes more sense:
+
+```go
+rd := getContent()
+verifier := id.Verifier()
+io.Copy(verifier, rd)
+
+if !verifier.Verified() {
+  return errors.New("the content has changed!")
+}
+```
+
+Using [Merkle DAGs](https://en.wikipedia.org/wiki/Merkle_tree), this can power a rich, safe, content distribution system.
+
+# Usage
+
+While the [godoc](https://godoc.org/github.com/opencontainers/go-digest) is considered the best resource, a few important items need to be called out when using this package.
+
+1. Make sure to import the hash implementations into your application or the package will panic.
+    You should have something like the following in the main (or other entrypoint) of your application:
+   
+    ```go
+    import (
+        _ "crypto/sha256"
+        _ "crypto/sha512"
+    )
+    ```
+    This may seem inconvenient but it allows you replace the hash 
+    implementations with others, such as https://github.com/stevvooe/resumable.
+ 
+2. Even though `digest.Digest` may be assemblable as a string, _always_ verify your input with `digest.Parse` or use `Digest.Validate` when accepting untrusted input.
+    While there are measures to avoid common problems, this will ensure you have valid digests in the rest of your application.
+
+3. While alternative encodings of hash values (digests) are possible (for example, base64), this package deals exclusively with hex-encoded digests.
+
+# Stability
+
+The Go API, at this stage, is considered stable, unless otherwise noted.
+
+As always, before using a package export, read the [godoc](https://godoc.org/github.com/opencontainers/go-digest).
+
+# Contributing
+
+This package is considered fairly complete.
+It has been in production in thousands (millions?) of deployments and is fairly battle-hardened.
+New additions will be met with skepticism.
+If you think there is a missing feature, please file a bug clearly describing the problem and the alternatives you tried before submitting a PR.
+
+## Code of Conduct
+
+Participation in the OpenContainers community is governed by [OpenContainer's Code of Conduct][code-of-conduct].
+
+## Security
+
+If you find an issue, please follow the [security][security] protocol to report it.
+
+# Copyright and license
+
+Copyright © 2019, 2020 OCI Contributors
+Copyright © 2016 Docker, Inc.
+All rights reserved, except as follows.
+Code is released under the [Apache 2.0 license](LICENSE).
+This `README.md` file and the [`CONTRIBUTING.md`](CONTRIBUTING.md) file are licensed under the Creative Commons Attribution 4.0 International License under the terms and conditions set forth in the file [`LICENSE.docs`](LICENSE.docs).
+You may obtain a duplicate copy of the same license, titled CC BY-SA 4.0, at http://creativecommons.org/licenses/by-sa/4.0/.
+
+[security]: https://github.com/opencontainers/org/blob/master/security
+[code-of-conduct]: https://github.com/opencontainers/org/blob/master/CODE_OF_CONDUCT.md
diff --git a/vendor/github.com/opencontainers/go-digest/algorithm.go b/vendor/github.com/opencontainers/go-digest/algorithm.go
new file mode 100644
index 0000000000..490951dc3f
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/algorithm.go
@@ -0,0 +1,193 @@
+// Copyright 2019, 2020 OCI Contributors
+// Copyright 2017 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package digest
+
+import (
+	"crypto"
+	"fmt"
+	"hash"
+	"io"
+	"regexp"
+)
+
+// Algorithm identifies and implementation of a digester by an identifier.
+// Note the that this defines both the hash algorithm used and the string
+// encoding.
+type Algorithm string
+
+// supported digest types
+const (
+	SHA256 Algorithm = "sha256" // sha256 with hex encoding (lower case only)
+	SHA384 Algorithm = "sha384" // sha384 with hex encoding (lower case only)
+	SHA512 Algorithm = "sha512" // sha512 with hex encoding (lower case only)
+
+	// Canonical is the primary digest algorithm used with the distribution
+	// project. Other digests may be used but this one is the primary storage
+	// digest.
+	Canonical = SHA256
+)
+
+var (
+	// TODO(stevvooe): Follow the pattern of the standard crypto package for
+	// registration of digests. Effectively, we are a registerable set and
+	// common symbol access.
+
+	// algorithms maps values to hash.Hash implementations. Other algorithms
+	// may be available but they cannot be calculated by the digest package.
+	algorithms = map[Algorithm]crypto.Hash{
+		SHA256: crypto.SHA256,
+		SHA384: crypto.SHA384,
+		SHA512: crypto.SHA512,
+	}
+
+	// anchoredEncodedRegexps contains anchored regular expressions for hex-encoded digests.
+	// Note that /A-F/ disallowed.
+	anchoredEncodedRegexps = map[Algorithm]*regexp.Regexp{
+		SHA256: regexp.MustCompile(`^[a-f0-9]{64}$`),
+		SHA384: regexp.MustCompile(`^[a-f0-9]{96}$`),
+		SHA512: regexp.MustCompile(`^[a-f0-9]{128}$`),
+	}
+)
+
+// Available returns true if the digest type is available for use. If this
+// returns false, Digester and Hash will return nil.
+func (a Algorithm) Available() bool {
+	h, ok := algorithms[a]
+	if !ok {
+		return false
+	}
+
+	// check availability of the hash, as well
+	return h.Available()
+}
+
+func (a Algorithm) String() string {
+	return string(a)
+}
+
+// Size returns number of bytes returned by the hash.
+func (a Algorithm) Size() int {
+	h, ok := algorithms[a]
+	if !ok {
+		return 0
+	}
+	return h.Size()
+}
+
+// Set implemented to allow use of Algorithm as a command line flag.
+func (a *Algorithm) Set(value string) error {
+	if value == "" {
+		*a = Canonical
+	} else {
+		// just do a type conversion, support is queried with Available.
+		*a = Algorithm(value)
+	}
+
+	if !a.Available() {
+		return ErrDigestUnsupported
+	}
+
+	return nil
+}
+
+// Digester returns a new digester for the specified algorithm. If the algorithm
+// does not have a digester implementation, nil will be returned. This can be
+// checked by calling Available before calling Digester.
+func (a Algorithm) Digester() Digester {
+	return &digester{
+		alg:  a,
+		hash: a.Hash(),
+	}
+}
+
+// Hash returns a new hash as used by the algorithm. If not available, the
+// method will panic. Check Algorithm.Available() before calling.
+func (a Algorithm) Hash() hash.Hash {
+	if !a.Available() {
+		// Empty algorithm string is invalid
+		if a == "" {
+			panic(fmt.Sprintf("empty digest algorithm, validate before calling Algorithm.Hash()"))
+		}
+
+		// NOTE(stevvooe): A missing hash is usually a programming error that
+		// must be resolved at compile time. We don't import in the digest
+		// package to allow users to choose their hash implementation (such as
+		// when using stevvooe/resumable or a hardware accelerated package).
+		//
+		// Applications that may want to resolve the hash at runtime should
+		// call Algorithm.Available before call Algorithm.Hash().
+		panic(fmt.Sprintf("%v not available (make sure it is imported)", a))
+	}
+
+	return algorithms[a].New()
+}
+
+// Encode encodes the raw bytes of a digest, typically from a hash.Hash, into
+// the encoded portion of the digest.
+func (a Algorithm) Encode(d []byte) string {
+	// TODO(stevvooe): Currently, all algorithms use a hex encoding. When we
+	// add support for back registration, we can modify this accordingly.
+	return fmt.Sprintf("%x", d)
+}
+
+// FromReader returns the digest of the reader using the algorithm.
+func (a Algorithm) FromReader(rd io.Reader) (Digest, error) {
+	digester := a.Digester()
+
+	if _, err := io.Copy(digester.Hash(), rd); err != nil {
+		return "", err
+	}
+
+	return digester.Digest(), nil
+}
+
+// FromBytes digests the input and returns a Digest.
+func (a Algorithm) FromBytes(p []byte) Digest {
+	digester := a.Digester()
+
+	if _, err := digester.Hash().Write(p); err != nil {
+		// Writes to a Hash should never fail. None of the existing
+		// hash implementations in the stdlib or hashes vendored
+		// here can return errors from Write. Having a panic in this
+		// condition instead of having FromBytes return an error value
+		// avoids unnecessary error handling paths in all callers.
+		panic("write to hash function returned error: " + err.Error())
+	}
+
+	return digester.Digest()
+}
+
+// FromString digests the string input and returns a Digest.
+func (a Algorithm) FromString(s string) Digest {
+	return a.FromBytes([]byte(s))
+}
+
+// Validate validates the encoded portion string
+func (a Algorithm) Validate(encoded string) error {
+	r, ok := anchoredEncodedRegexps[a]
+	if !ok {
+		return ErrDigestUnsupported
+	}
+	// Digests much always be hex-encoded, ensuring that their hex portion will
+	// always be size*2
+	if a.Size()*2 != len(encoded) {
+		return ErrDigestInvalidLength
+	}
+	if r.MatchString(encoded) {
+		return nil
+	}
+	return ErrDigestInvalidFormat
+}
diff --git a/vendor/github.com/opencontainers/go-digest/digest.go b/vendor/github.com/opencontainers/go-digest/digest.go
new file mode 100644
index 0000000000..518b5e7154
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/digest.go
@@ -0,0 +1,157 @@
+// Copyright 2019, 2020 OCI Contributors
+// Copyright 2017 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package digest
+
+import (
+	"fmt"
+	"hash"
+	"io"
+	"regexp"
+	"strings"
+)
+
+// Digest allows simple protection of hex formatted digest strings, prefixed
+// by their algorithm. Strings of type Digest have some guarantee of being in
+// the correct format and it provides quick access to the components of a
+// digest string.
+//
+// The following is an example of the contents of Digest types:
+//
+// 	sha256:7173b809ca12ec5dee4506cd86be934c4596dd234ee82c0662eac04a8c2c71dc
+//
+// This allows to abstract the digest behind this type and work only in those
+// terms.
+type Digest string
+
+// NewDigest returns a Digest from alg and a hash.Hash object.
+func NewDigest(alg Algorithm, h hash.Hash) Digest {
+	return NewDigestFromBytes(alg, h.Sum(nil))
+}
+
+// NewDigestFromBytes returns a new digest from the byte contents of p.
+// Typically, this can come from hash.Hash.Sum(...) or xxx.SumXXX(...)
+// functions. This is also useful for rebuilding digests from binary
+// serializations.
+func NewDigestFromBytes(alg Algorithm, p []byte) Digest {
+	return NewDigestFromEncoded(alg, alg.Encode(p))
+}
+
+// NewDigestFromHex is deprecated. Please use NewDigestFromEncoded.
+func NewDigestFromHex(alg, hex string) Digest {
+	return NewDigestFromEncoded(Algorithm(alg), hex)
+}
+
+// NewDigestFromEncoded returns a Digest from alg and the encoded digest.
+func NewDigestFromEncoded(alg Algorithm, encoded string) Digest {
+	return Digest(fmt.Sprintf("%s:%s", alg, encoded))
+}
+
+// DigestRegexp matches valid digest types.
+var DigestRegexp = regexp.MustCompile(`[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+`)
+
+// DigestRegexpAnchored matches valid digest types, anchored to the start and end of the match.
+var DigestRegexpAnchored = regexp.MustCompile(`^` + DigestRegexp.String() + `$`)
+
+var (
+	// ErrDigestInvalidFormat returned when digest format invalid.
+	ErrDigestInvalidFormat = fmt.Errorf("invalid checksum digest format")
+
+	// ErrDigestInvalidLength returned when digest has invalid length.
+	ErrDigestInvalidLength = fmt.Errorf("invalid checksum digest length")
+
+	// ErrDigestUnsupported returned when the digest algorithm is unsupported.
+	ErrDigestUnsupported = fmt.Errorf("unsupported digest algorithm")
+)
+
+// Parse parses s and returns the validated digest object. An error will
+// be returned if the format is invalid.
+func Parse(s string) (Digest, error) {
+	d := Digest(s)
+	return d, d.Validate()
+}
+
+// FromReader consumes the content of rd until io.EOF, returning canonical digest.
+func FromReader(rd io.Reader) (Digest, error) {
+	return Canonical.FromReader(rd)
+}
+
+// FromBytes digests the input and returns a Digest.
+func FromBytes(p []byte) Digest {
+	return Canonical.FromBytes(p)
+}
+
+// FromString digests the input and returns a Digest.
+func FromString(s string) Digest {
+	return Canonical.FromString(s)
+}
+
+// Validate checks that the contents of d is a valid digest, returning an
+// error if not.
+func (d Digest) Validate() error {
+	s := string(d)
+	i := strings.Index(s, ":")
+	if i <= 0 || i+1 == len(s) {
+		return ErrDigestInvalidFormat
+	}
+	algorithm, encoded := Algorithm(s[:i]), s[i+1:]
+	if !algorithm.Available() {
+		if !DigestRegexpAnchored.MatchString(s) {
+			return ErrDigestInvalidFormat
+		}
+		return ErrDigestUnsupported
+	}
+	return algorithm.Validate(encoded)
+}
+
+// Algorithm returns the algorithm portion of the digest. This will panic if
+// the underlying digest is not in a valid format.
+func (d Digest) Algorithm() Algorithm {
+	return Algorithm(d[:d.sepIndex()])
+}
+
+// Verifier returns a writer object that can be used to verify a stream of
+// content against the digest. If the digest is invalid, the method will panic.
+func (d Digest) Verifier() Verifier {
+	return hashVerifier{
+		hash:   d.Algorithm().Hash(),
+		digest: d,
+	}
+}
+
+// Encoded returns the encoded portion of the digest. This will panic if the
+// underlying digest is not in a valid format.
+func (d Digest) Encoded() string {
+	return string(d[d.sepIndex()+1:])
+}
+
+// Hex is deprecated. Please use Digest.Encoded.
+func (d Digest) Hex() string {
+	return d.Encoded()
+}
+
+func (d Digest) String() string {
+	return string(d)
+}
+
+func (d Digest) sepIndex() int {
+	i := strings.Index(string(d), ":")
+
+	if i < 0 {
+		panic(fmt.Sprintf("no ':' separator in digest %q", d))
+	}
+
+	return i
+}
diff --git a/vendor/github.com/opencontainers/go-digest/digester.go b/vendor/github.com/opencontainers/go-digest/digester.go
new file mode 100644
index 0000000000..ede9077571
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/digester.go
@@ -0,0 +1,40 @@
+// Copyright 2019, 2020 OCI Contributors
+// Copyright 2017 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package digest
+
+import "hash"
+
+// Digester calculates the digest of written data. Writes should go directly
+// to the return value of Hash, while calling Digest will return the current
+// value of the digest.
+type Digester interface {
+	Hash() hash.Hash // provides direct access to underlying hash instance.
+	Digest() Digest
+}
+
+// digester provides a simple digester definition that embeds a hasher.
+type digester struct {
+	alg  Algorithm
+	hash hash.Hash
+}
+
+func (d *digester) Hash() hash.Hash {
+	return d.hash
+}
+
+func (d *digester) Digest() Digest {
+	return NewDigest(d.alg, d.hash)
+}
diff --git a/vendor/github.com/opencontainers/go-digest/doc.go b/vendor/github.com/opencontainers/go-digest/doc.go
new file mode 100644
index 0000000000..83d3a936ca
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/doc.go
@@ -0,0 +1,62 @@
+// Copyright 2019, 2020 OCI Contributors
+// Copyright 2017 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package digest provides a generalized type to opaquely represent message
+// digests and their operations within the registry. The Digest type is
+// designed to serve as a flexible identifier in a content-addressable system.
+// More importantly, it provides tools and wrappers to work with
+// hash.Hash-based digests with little effort.
+//
+// Basics
+//
+// The format of a digest is simply a string with two parts, dubbed the
+// "algorithm" and the "digest", separated by a colon:
+//
+// 	<algorithm>:<digest>
+//
+// An example of a sha256 digest representation follows:
+//
+// 	sha256:7173b809ca12ec5dee4506cd86be934c4596dd234ee82c0662eac04a8c2c71dc
+//
+// The "algorithm" portion defines both the hashing algorithm used to calculate
+// the digest and the encoding of the resulting digest, which defaults to "hex"
+// if not otherwise specified. Currently, all supported algorithms have their
+// digests encoded in hex strings.
+//
+// In the example above, the string "sha256" is the algorithm and the hex bytes
+// are the "digest".
+//
+// Because the Digest type is simply a string, once a valid Digest is
+// obtained, comparisons are cheap, quick and simple to express with the
+// standard equality operator.
+//
+// Verification
+//
+// The main benefit of using the Digest type is simple verification against a
+// given digest. The Verifier interface, modeled after the stdlib hash.Hash
+// interface, provides a common write sink for digest verification. After
+// writing is complete, calling the Verifier.Verified method will indicate
+// whether or not the stream of bytes matches the target digest.
+//
+// Missing Features
+//
+// In addition to the above, we intend to add the following features to this
+// package:
+//
+// 1. A Digester type that supports write sink digest calculation.
+//
+// 2. Suspend and resume of ongoing digest calculations to support efficient digest verification in the registry.
+//
+package digest
diff --git a/vendor/github.com/opencontainers/go-digest/verifiers.go b/vendor/github.com/opencontainers/go-digest/verifiers.go
new file mode 100644
index 0000000000..afef506f46
--- /dev/null
+++ b/vendor/github.com/opencontainers/go-digest/verifiers.go
@@ -0,0 +1,46 @@
+// Copyright 2019, 2020 OCI Contributors
+// Copyright 2017 Docker, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package digest
+
+import (
+	"hash"
+	"io"
+)
+
+// Verifier presents a general verification interface to be used with message
+// digests and other byte stream verifications. Users instantiate a Verifier
+// from one of the various methods, write the data under test to it then check
+// the result with the Verified method.
+type Verifier interface {
+	io.Writer
+
+	// Verified will return true if the content written to Verifier matches
+	// the digest.
+	Verified() bool
+}
+
+type hashVerifier struct {
+	digest Digest
+	hash   hash.Hash
+}
+
+func (hv hashVerifier) Write(p []byte) (n int, err error) {
+	return hv.hash.Write(p)
+}
+
+func (hv hashVerifier) Verified() bool {
+	return hv.digest == NewDigest(hv.digest.Algorithm(), hv.hash)
+}
diff --git a/vendor/github.com/opencontainers/image-spec/LICENSE b/vendor/github.com/opencontainers/image-spec/LICENSE
new file mode 100644
index 0000000000..9fdc20fdb6
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2016 The Linux Foundation.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/annotations.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/annotations.go
new file mode 100644
index 0000000000..6f9e6fd3ab
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/annotations.go
@@ -0,0 +1,71 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+const (
+	// AnnotationCreated is the annotation key for the date and time on which the image was built (date-time string as defined by RFC 3339).
+	AnnotationCreated = "org.opencontainers.image.created"
+
+	// AnnotationAuthors is the annotation key for the contact details of the people or organization responsible for the image (freeform string).
+	AnnotationAuthors = "org.opencontainers.image.authors"
+
+	// AnnotationURL is the annotation key for the URL to find more information on the image.
+	AnnotationURL = "org.opencontainers.image.url"
+
+	// AnnotationDocumentation is the annotation key for the URL to get documentation on the image.
+	AnnotationDocumentation = "org.opencontainers.image.documentation"
+
+	// AnnotationSource is the annotation key for the URL to get source code for building the image.
+	AnnotationSource = "org.opencontainers.image.source"
+
+	// AnnotationVersion is the annotation key for the version of the packaged software.
+	// The version MAY match a label or tag in the source code repository.
+	// The version MAY be Semantic versioning-compatible.
+	AnnotationVersion = "org.opencontainers.image.version"
+
+	// AnnotationRevision is the annotation key for the source control revision identifier for the packaged software.
+	AnnotationRevision = "org.opencontainers.image.revision"
+
+	// AnnotationVendor is the annotation key for the name of the distributing entity, organization or individual.
+	AnnotationVendor = "org.opencontainers.image.vendor"
+
+	// AnnotationLicenses is the annotation key for the license(s) under which contained software is distributed as an SPDX License Expression.
+	AnnotationLicenses = "org.opencontainers.image.licenses"
+
+	// AnnotationRefName is the annotation key for the name of the reference for a target.
+	// SHOULD only be considered valid when on descriptors on `index.json` within image layout.
+	AnnotationRefName = "org.opencontainers.image.ref.name"
+
+	// AnnotationTitle is the annotation key for the human-readable title of the image.
+	AnnotationTitle = "org.opencontainers.image.title"
+
+	// AnnotationDescription is the annotation key for the human-readable description of the software packaged in the image.
+	AnnotationDescription = "org.opencontainers.image.description"
+
+	// AnnotationBaseImageDigest is the annotation key for the digest of the image's base image.
+	AnnotationBaseImageDigest = "org.opencontainers.image.base.digest"
+
+	// AnnotationBaseImageName is the annotation key for the image reference of the image's base image.
+	AnnotationBaseImageName = "org.opencontainers.image.base.name"
+
+	// AnnotationArtifactCreated is the annotation key for the date and time on which the artifact was built, conforming to RFC 3339.
+	AnnotationArtifactCreated = "org.opencontainers.artifact.created"
+
+	// AnnotationArtifactDescription is the annotation key for the human readable description for the artifact.
+	AnnotationArtifactDescription = "org.opencontainers.artifact.description"
+
+	// AnnotationReferrersFiltersApplied is the annotation key for the comma separated list of filters applied by the registry in the referrers listing.
+	AnnotationReferrersFiltersApplied = "org.opencontainers.referrers.filtersApplied"
+)
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/artifact.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/artifact.go
new file mode 100644
index 0000000000..03d76ce437
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/artifact.go
@@ -0,0 +1,34 @@
+// Copyright 2022 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+// Artifact describes an artifact manifest.
+// This structure provides `application/vnd.oci.artifact.manifest.v1+json` mediatype when marshalled to JSON.
+type Artifact struct {
+	// MediaType is the media type of the object this schema refers to.
+	MediaType string `json:"mediaType"`
+
+	// ArtifactType is the IANA media type of the artifact this schema refers to.
+	ArtifactType string `json:"artifactType"`
+
+	// Blobs is a collection of blobs referenced by this manifest.
+	Blobs []Descriptor `json:"blobs,omitempty"`
+
+	// Subject (reference) is an optional link from the artifact to another manifest forming an association between the artifact and the other manifest.
+	Subject *Descriptor `json:"subject,omitempty"`
+
+	// Annotations contains arbitrary metadata for the artifact manifest.
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/config.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/config.go
new file mode 100644
index 0000000000..ffff4b6d18
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/config.go
@@ -0,0 +1,114 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import (
+	"time"
+
+	digest "github.com/opencontainers/go-digest"
+)
+
+// ImageConfig defines the execution parameters which should be used as a base when running a container using an image.
+type ImageConfig struct {
+	// User defines the username or UID which the process in the container should run as.
+	User string `json:"User,omitempty"`
+
+	// ExposedPorts a set of ports to expose from a container running this image.
+	ExposedPorts map[string]struct{} `json:"ExposedPorts,omitempty"`
+
+	// Env is a list of environment variables to be used in a container.
+	Env []string `json:"Env,omitempty"`
+
+	// Entrypoint defines a list of arguments to use as the command to execute when the container starts.
+	Entrypoint []string `json:"Entrypoint,omitempty"`
+
+	// Cmd defines the default arguments to the entrypoint of the container.
+	Cmd []string `json:"Cmd,omitempty"`
+
+	// Volumes is a set of directories describing where the process is likely write data specific to a container instance.
+	Volumes map[string]struct{} `json:"Volumes,omitempty"`
+
+	// WorkingDir sets the current working directory of the entrypoint process in the container.
+	WorkingDir string `json:"WorkingDir,omitempty"`
+
+	// Labels contains arbitrary metadata for the container.
+	Labels map[string]string `json:"Labels,omitempty"`
+
+	// StopSignal contains the system call signal that will be sent to the container to exit.
+	StopSignal string `json:"StopSignal,omitempty"`
+}
+
+// RootFS describes a layer content addresses
+type RootFS struct {
+	// Type is the type of the rootfs.
+	Type string `json:"type"`
+
+	// DiffIDs is an array of layer content hashes (DiffIDs), in order from bottom-most to top-most.
+	DiffIDs []digest.Digest `json:"diff_ids"`
+}
+
+// History describes the history of a layer.
+type History struct {
+	// Created is the combined date and time at which the layer was created, formatted as defined by RFC 3339, section 5.6.
+	Created *time.Time `json:"created,omitempty"`
+
+	// CreatedBy is the command which created the layer.
+	CreatedBy string `json:"created_by,omitempty"`
+
+	// Author is the author of the build point.
+	Author string `json:"author,omitempty"`
+
+	// Comment is a custom message set when creating the layer.
+	Comment string `json:"comment,omitempty"`
+
+	// EmptyLayer is used to mark if the history item created a filesystem diff.
+	EmptyLayer bool `json:"empty_layer,omitempty"`
+}
+
+// Image is the JSON structure which describes some basic information about the image.
+// This provides the `application/vnd.oci.image.config.v1+json` mediatype when marshalled to JSON.
+type Image struct {
+	// Created is the combined date and time at which the image was created, formatted as defined by RFC 3339, section 5.6.
+	Created *time.Time `json:"created,omitempty"`
+
+	// Author defines the name and/or email address of the person or entity which created and is responsible for maintaining the image.
+	Author string `json:"author,omitempty"`
+
+	// Architecture is the CPU architecture which the binaries in this image are built to run on.
+	Architecture string `json:"architecture"`
+
+	// Variant is the variant of the specified CPU architecture which image binaries are intended to run on.
+	Variant string `json:"variant,omitempty"`
+
+	// OS is the name of the operating system which the image is built to run on.
+	OS string `json:"os"`
+
+	// OSVersion is an optional field specifying the operating system
+	// version, for example on Windows `10.0.14393.1066`.
+	OSVersion string `json:"os.version,omitempty"`
+
+	// OSFeatures is an optional field specifying an array of strings,
+	// each listing a required OS feature (for example on Windows `win32k`).
+	OSFeatures []string `json:"os.features,omitempty"`
+
+	// Config defines the execution parameters which should be used as a base when running a container using the image.
+	Config ImageConfig `json:"config,omitempty"`
+
+	// RootFS references the layer content addresses used by the image.
+	RootFS RootFS `json:"rootfs"`
+
+	// History describes the history of each layer.
+	History []History `json:"history,omitempty"`
+}
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/descriptor.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/descriptor.go
new file mode 100644
index 0000000000..9654aa5af6
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/descriptor.go
@@ -0,0 +1,72 @@
+// Copyright 2016-2022 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import digest "github.com/opencontainers/go-digest"
+
+// Descriptor describes the disposition of targeted content.
+// This structure provides `application/vnd.oci.descriptor.v1+json` mediatype
+// when marshalled to JSON.
+type Descriptor struct {
+	// MediaType is the media type of the object this schema refers to.
+	MediaType string `json:"mediaType,omitempty"`
+
+	// Digest is the digest of the targeted content.
+	Digest digest.Digest `json:"digest"`
+
+	// Size specifies the size in bytes of the blob.
+	Size int64 `json:"size"`
+
+	// URLs specifies a list of URLs from which this object MAY be downloaded
+	URLs []string `json:"urls,omitempty"`
+
+	// Annotations contains arbitrary metadata relating to the targeted content.
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Data is an embedding of the targeted content. This is encoded as a base64
+	// string when marshalled to JSON (automatically, by encoding/json). If
+	// present, Data can be used directly to avoid fetching the targeted content.
+	Data []byte `json:"data,omitempty"`
+
+	// Platform describes the platform which the image in the manifest runs on.
+	//
+	// This should only be used when referring to a manifest.
+	Platform *Platform `json:"platform,omitempty"`
+
+	// ArtifactType is the IANA media type of this artifact.
+	ArtifactType string `json:"artifactType,omitempty"`
+}
+
+// Platform describes the platform which the image in the manifest runs on.
+type Platform struct {
+	// Architecture field specifies the CPU architecture, for example
+	// `amd64` or `ppc64`.
+	Architecture string `json:"architecture"`
+
+	// OS specifies the operating system, for example `linux` or `windows`.
+	OS string `json:"os"`
+
+	// OSVersion is an optional field specifying the operating system
+	// version, for example on Windows `10.0.14393.1066`.
+	OSVersion string `json:"os.version,omitempty"`
+
+	// OSFeatures is an optional field specifying an array of strings,
+	// each listing a required OS feature (for example on Windows `win32k`).
+	OSFeatures []string `json:"os.features,omitempty"`
+
+	// Variant is an optional field specifying a variant of the CPU, for
+	// example `v7` to specify ARMv7 when architecture is `arm`.
+	Variant string `json:"variant,omitempty"`
+}
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/index.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/index.go
new file mode 100644
index 0000000000..ed4a56e59e
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/index.go
@@ -0,0 +1,32 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import "github.com/opencontainers/image-spec/specs-go"
+
+// Index references manifests for various platforms.
+// This structure provides `application/vnd.oci.image.index.v1+json` mediatype when marshalled to JSON.
+type Index struct {
+	specs.Versioned
+
+	// MediaType specifies the type of this document data structure e.g. `application/vnd.oci.image.index.v1+json`
+	MediaType string `json:"mediaType,omitempty"`
+
+	// Manifests references platform specific manifests.
+	Manifests []Descriptor `json:"manifests"`
+
+	// Annotations contains arbitrary metadata for the image index.
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/layout.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/layout.go
new file mode 100644
index 0000000000..fc79e9e0d1
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/layout.go
@@ -0,0 +1,28 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+const (
+	// ImageLayoutFile is the file name of oci image layout file
+	ImageLayoutFile = "oci-layout"
+	// ImageLayoutVersion is the version of ImageLayout
+	ImageLayoutVersion = "1.0.0"
+)
+
+// ImageLayout is the structure in the "oci-layout" file, found in the root
+// of an OCI Image-layout directory.
+type ImageLayout struct {
+	Version string `json:"imageLayoutVersion"`
+}
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/manifest.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/manifest.go
new file mode 100644
index 0000000000..730a09359b
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/manifest.go
@@ -0,0 +1,38 @@
+// Copyright 2016-2022 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import "github.com/opencontainers/image-spec/specs-go"
+
+// Manifest provides `application/vnd.oci.image.manifest.v1+json` mediatype structure when marshalled to JSON.
+type Manifest struct {
+	specs.Versioned
+
+	// MediaType specifies the type of this document data structure e.g. `application/vnd.oci.image.manifest.v1+json`
+	MediaType string `json:"mediaType,omitempty"`
+
+	// Config references a configuration object for a container, by digest.
+	// The referenced configuration object is a JSON blob that the runtime uses to set up the container.
+	Config Descriptor `json:"config"`
+
+	// Layers is an indexed list of layers referenced by the manifest.
+	Layers []Descriptor `json:"layers"`
+
+	// Subject is an optional link from the image manifest to another manifest forming an association between the image manifest and the other manifest.
+	Subject *Descriptor `json:"subject,omitempty"`
+
+	// Annotations contains arbitrary metadata for the image manifest.
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/v1/mediatype.go b/vendor/github.com/opencontainers/image-spec/specs-go/v1/mediatype.go
new file mode 100644
index 0000000000..935b481e3e
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/v1/mediatype.go
@@ -0,0 +1,60 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+const (
+	// MediaTypeDescriptor specifies the media type for a content descriptor.
+	MediaTypeDescriptor = "application/vnd.oci.descriptor.v1+json"
+
+	// MediaTypeLayoutHeader specifies the media type for the oci-layout.
+	MediaTypeLayoutHeader = "application/vnd.oci.layout.header.v1+json"
+
+	// MediaTypeImageManifest specifies the media type for an image manifest.
+	MediaTypeImageManifest = "application/vnd.oci.image.manifest.v1+json"
+
+	// MediaTypeImageIndex specifies the media type for an image index.
+	MediaTypeImageIndex = "application/vnd.oci.image.index.v1+json"
+
+	// MediaTypeImageLayer is the media type used for layers referenced by the manifest.
+	MediaTypeImageLayer = "application/vnd.oci.image.layer.v1.tar"
+
+	// MediaTypeImageLayerGzip is the media type used for gzipped layers
+	// referenced by the manifest.
+	MediaTypeImageLayerGzip = "application/vnd.oci.image.layer.v1.tar+gzip"
+
+	// MediaTypeImageLayerZstd is the media type used for zstd compressed
+	// layers referenced by the manifest.
+	MediaTypeImageLayerZstd = "application/vnd.oci.image.layer.v1.tar+zstd"
+
+	// MediaTypeImageLayerNonDistributable is the media type for layers referenced by
+	// the manifest but with distribution restrictions.
+	MediaTypeImageLayerNonDistributable = "application/vnd.oci.image.layer.nondistributable.v1.tar"
+
+	// MediaTypeImageLayerNonDistributableGzip is the media type for
+	// gzipped layers referenced by the manifest but with distribution
+	// restrictions.
+	MediaTypeImageLayerNonDistributableGzip = "application/vnd.oci.image.layer.nondistributable.v1.tar+gzip"
+
+	// MediaTypeImageLayerNonDistributableZstd is the media type for zstd
+	// compressed layers referenced by the manifest but with distribution
+	// restrictions.
+	MediaTypeImageLayerNonDistributableZstd = "application/vnd.oci.image.layer.nondistributable.v1.tar+zstd"
+
+	// MediaTypeImageConfig specifies the media type for the image configuration.
+	MediaTypeImageConfig = "application/vnd.oci.image.config.v1+json"
+
+	// MediaTypeArtifactManifest specifies the media type for a content descriptor.
+	MediaTypeArtifactManifest = "application/vnd.oci.artifact.manifest.v1+json"
+)
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/version.go b/vendor/github.com/opencontainers/image-spec/specs-go/version.go
new file mode 100644
index 0000000000..d279035796
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/version.go
@@ -0,0 +1,32 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package specs
+
+import "fmt"
+
+const (
+	// VersionMajor is for an API incompatible changes
+	VersionMajor = 1
+	// VersionMinor is for functionality in a backwards-compatible manner
+	VersionMinor = 1
+	// VersionPatch is for backwards-compatible bug fixes
+	VersionPatch = 0
+
+	// VersionDev indicates development branch. Releases will be empty string.
+	VersionDev = "-rc2"
+)
+
+// Version is the specification version that the package types support.
+var Version = fmt.Sprintf("%d.%d.%d%s", VersionMajor, VersionMinor, VersionPatch, VersionDev)
diff --git a/vendor/github.com/opencontainers/image-spec/specs-go/versioned.go b/vendor/github.com/opencontainers/image-spec/specs-go/versioned.go
new file mode 100644
index 0000000000..58a1510f33
--- /dev/null
+++ b/vendor/github.com/opencontainers/image-spec/specs-go/versioned.go
@@ -0,0 +1,23 @@
+// Copyright 2016 The Linux Foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package specs
+
+// Versioned provides a struct with the manifest schemaVersion and mediaType.
+// Incoming content with unknown schema version can be decoded against this
+// struct to check the version.
+type Versioned struct {
+	// SchemaVersion is the image manifest schema that this image follows
+	SchemaVersion int `json:"schemaVersion"`
+}
diff --git a/vendor/github.com/peterh/liner/README.md b/vendor/github.com/peterh/liner/README.md
index 9148b24929..04f5bbe7cc 100644
--- a/vendor/github.com/peterh/liner/README.md
+++ b/vendor/github.com/peterh/liner/README.md
@@ -6,6 +6,13 @@ everything Unix-like is a VT100 (or is trying very hard to be). If your
 terminal is not pretending to be a VT100, change it. Liner also support
 Windows.
 
+Liner is intended for use by cross-platform applications. Therefore, the
+decision was made to write it in pure Go, avoiding cgo, for ease of cross
+compilation. Furthermore, features only supported on some platforms have
+been intentionally omitted. For example, Ctrl-Z is "suspend" on Unix, but
+"EOF" on Windows. In the interest of making an application behave the same
+way on every supported platform, Ctrl-Z is ignored by Liner.
+
 Liner is released under the X11 license (which is similar to the new BSD
 license).
 
@@ -29,7 +36,8 @@ Ctrl-C       | Reset input (create new empty prompt)
 Ctrl-L       | Clear screen (line is unmodified)
 Ctrl-T       | Transpose previous character with current character
 Ctrl-H, BackSpace | Delete character before cursor
-Ctrl-W       | Delete word leading up to cursor
+Ctrl-W, Alt-BackSpace | Delete word leading up to cursor
+Alt-D        | Delete word following cursor
 Ctrl-K       | Delete from cursor to end of line
 Ctrl-U       | Delete from start of line to cursor
 Ctrl-P, Up   | Previous match from history
@@ -39,6 +47,12 @@ Ctrl-Y       | Paste from Yank buffer (Alt-Y to paste next yank instead)
 Tab          | Next completion
 Shift-Tab    | (after Tab) Previous completion
 
+Note that "Previous" and "Next match from history" will retain the part of
+the line that the user has already typed, similar to zsh's
+"up-line-or-beginning-search" (which is the default on some systems) or
+bash's "history-search-backward" (which is my preferred behaviour, but does
+not appear to be the default `Up` keybinding on any system).
+
 Getting started
 -----------------
 
diff --git a/vendor/github.com/peterh/liner/bsdinput.go b/vendor/github.com/peterh/liner/bsdinput.go
index 35933982f1..0a2abfb546 100644
--- a/vendor/github.com/peterh/liner/bsdinput.go
+++ b/vendor/github.com/peterh/liner/bsdinput.go
@@ -1,3 +1,4 @@
+//go:build openbsd || freebsd || netbsd
 // +build openbsd freebsd netbsd
 
 package liner
diff --git a/vendor/github.com/peterh/liner/common.go b/vendor/github.com/peterh/liner/common.go
index e5b8fc2807..a85b025b4f 100644
--- a/vendor/github.com/peterh/liner/common.go
+++ b/vendor/github.com/peterh/liner/common.go
@@ -32,6 +32,7 @@ type commonState struct {
 	cursorRows        int
 	maxRows           int
 	shouldRestart     ShouldRestart
+	noBeep            bool
 	needRefresh       bool
 }
 
@@ -64,6 +65,11 @@ var ErrNotTerminalOutput = errors.New("standard output is not a terminal")
 // be colour codes on some platforms).
 var ErrInvalidPrompt = errors.New("invalid prompt")
 
+// ErrInternal is returned when liner experiences an error that it cannot
+// handle. For example, if the number of colums becomes zero during an
+// active call to Prompt
+var ErrInternal = errors.New("liner: internal error")
+
 // KillRingMax is the max number of elements to save on the killring.
 const KillRingMax = 60
 
@@ -139,7 +145,7 @@ func (s *State) AppendHistory(item string) {
 	}
 }
 
-// ClearHistory clears the scroollback history.
+// ClearHistory clears the scrollback history.
 func (s *State) ClearHistory() {
 	s.historyMutex.Lock()
 	defer s.historyMutex.Unlock()
@@ -156,7 +162,7 @@ func (s *State) getHistoryByPrefix(prefix string) (ph []string) {
 	return
 }
 
-// Returns the history lines matching the inteligent search
+// Returns the history lines matching the intelligent search
 func (s *State) getHistoryByPattern(pattern string) (ph []string, pos []int) {
 	if pattern == "" {
 		return
@@ -238,6 +244,12 @@ func (s *State) SetShouldRestart(f ShouldRestart) {
 	s.shouldRestart = f
 }
 
+// SetBeep sets whether liner should beep the terminal at various times (output
+// ASCII BEL, 0x07). Default is true (will beep).
+func (s *State) SetBeep(beep bool) {
+	s.noBeep = !beep
+}
+
 func (s *State) promptUnsupported(p string) (string, error) {
 	if !s.inputRedirected || !s.terminalSupported {
 		fmt.Print(p)
diff --git a/vendor/github.com/peterh/liner/fallbackinput.go b/vendor/github.com/peterh/liner/fallbackinput.go
index d9eb79d9e0..81a10a4378 100644
--- a/vendor/github.com/peterh/liner/fallbackinput.go
+++ b/vendor/github.com/peterh/liner/fallbackinput.go
@@ -1,4 +1,5 @@
-// +build !windows,!linux,!darwin,!openbsd,!freebsd,!netbsd
+//go:build !windows && !linux && !darwin && !openbsd && !freebsd && !netbsd && !solaris
+// +build !windows,!linux,!darwin,!openbsd,!freebsd,!netbsd,!solaris
 
 package liner
 
@@ -55,3 +56,5 @@ func (n noopMode) ApplyMode() error {
 func TerminalMode() (ModeApplier, error) {
 	return noopMode{}, nil
 }
+
+const cursorColumn = true
diff --git a/vendor/github.com/peterh/liner/input.go b/vendor/github.com/peterh/liner/input.go
index 904fbf6638..be8a61e15a 100644
--- a/vendor/github.com/peterh/liner/input.go
+++ b/vendor/github.com/peterh/liner/input.go
@@ -1,4 +1,5 @@
-// +build linux darwin openbsd freebsd netbsd
+//go:build linux || darwin || openbsd || freebsd || netbsd || solaris
+// +build linux darwin openbsd freebsd netbsd solaris
 
 package liner
 
@@ -41,7 +42,7 @@ func NewLiner() *State {
 	} else {
 		s.inputRedirected = true
 	}
-	if _, err := getMode(syscall.Stdout); err != 0 {
+	if _, err := getMode(syscall.Stdout); err != nil {
 		s.outputRedirected = true
 	}
 	if s.inputRedirected && s.outputRedirected {
@@ -52,6 +53,8 @@ func NewLiner() *State {
 		mode.Iflag &^= icrnl | inpck | istrip | ixon
 		mode.Cflag |= cs8
 		mode.Lflag &^= syscall.ECHO | icanon | iexten
+		mode.Cc[syscall.VMIN] = 1
+		mode.Cc[syscall.VTIME] = 0
 		mode.ApplyMode()
 
 		winch := make(chan os.Signal, 1)
@@ -113,7 +116,7 @@ func (s *State) nextPending(timeout <-chan time.Time) (rune, error) {
 	select {
 	case thing, ok := <-s.next:
 		if !ok {
-			return 0, errors.New("liner: internal error")
+			return 0, ErrInternal
 		}
 		if thing.err != nil {
 			return 0, thing.err
@@ -137,7 +140,7 @@ func (s *State) readNext() (interface{}, error) {
 	select {
 	case thing, ok := <-s.next:
 		if !ok {
-			return 0, errors.New("liner: internal error")
+			return 0, ErrInternal
 		}
 		if thing.err != nil {
 			return nil, thing.err
@@ -264,9 +267,9 @@ func (s *State) readNext() (interface{}, error) {
 						return pageUp, nil
 					case 6:
 						return pageDown, nil
-					case 7:
+					case 1, 7:
 						return home, nil
-					case 8:
+					case 4, 8:
 						return end, nil
 					case 15:
 						return f5, nil
@@ -328,6 +331,12 @@ func (s *State) readNext() (interface{}, error) {
 	case 'b':
 		s.pending = s.pending[:0] // escape code complete
 		return altB, nil
+	case 'd':
+		s.pending = s.pending[:0] // escape code complete
+		return altD, nil
+	case bs:
+		s.pending = s.pending[:0] // escape code complete
+		return altBs, nil
 	case 'f':
 		s.pending = s.pending[:0] // escape code complete
 		return altF, nil
diff --git a/vendor/github.com/peterh/liner/input_darwin.go b/vendor/github.com/peterh/liner/input_darwin.go
index e98ab4a49f..a91dc01497 100644
--- a/vendor/github.com/peterh/liner/input_darwin.go
+++ b/vendor/github.com/peterh/liner/input_darwin.go
@@ -1,3 +1,4 @@
+//go:build darwin
 // +build darwin
 
 package liner
diff --git a/vendor/github.com/peterh/liner/input_linux.go b/vendor/github.com/peterh/liner/input_linux.go
index 56ed185fad..95dab81848 100644
--- a/vendor/github.com/peterh/liner/input_linux.go
+++ b/vendor/github.com/peterh/liner/input_linux.go
@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 package liner
diff --git a/vendor/github.com/peterh/liner/input_solaris.go b/vendor/github.com/peterh/liner/input_solaris.go
new file mode 100644
index 0000000000..34c72aee9f
--- /dev/null
+++ b/vendor/github.com/peterh/liner/input_solaris.go
@@ -0,0 +1,26 @@
+package liner
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+const (
+	getTermios = unix.TCGETS
+	setTermios = unix.TCSETS
+)
+
+const (
+	icrnl  = unix.ICRNL
+	inpck  = unix.INPCK
+	istrip = unix.ISTRIP
+	ixon   = unix.IXON
+	opost  = unix.OPOST
+	cs8    = unix.CS8
+	isig   = unix.ISIG
+	icanon = unix.ICANON
+	iexten = unix.IEXTEN
+)
+
+type termios unix.Termios
+
+const cursorColumn = false
diff --git a/vendor/github.com/peterh/liner/input_windows.go b/vendor/github.com/peterh/liner/input_windows.go
index a48eb0f1d2..2f308b34f8 100644
--- a/vendor/github.com/peterh/liner/input_windows.go
+++ b/vendor/github.com/peterh/liner/input_windows.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"os"
 	"syscall"
+	"unicode/utf16"
 	"unsafe"
 )
 
@@ -103,14 +104,16 @@ type key_event_record struct {
 	RepeatCount     uint16
 	VirtualKeyCode  uint16
 	VirtualScanCode uint16
-	Char            int16
+	Char            uint16
 	ControlKeyState uint32
 }
 
 // These names are from the Win32 api, so they use underscores (contrary to
 // what golint suggests)
 const (
+	vk_back   = 0x08
 	vk_tab    = 0x09
+	vk_menu   = 0x12 // ALT key
 	vk_prior  = 0x21
 	vk_next   = 0x22
 	vk_end    = 0x23
@@ -134,6 +137,7 @@ const (
 	vk_f11    = 0x7a
 	vk_f12    = 0x7b
 	bKey      = 0x42
+	dKey      = 0x44
 	fKey      = 0x46
 	yKey      = 0x59
 )
@@ -170,12 +174,13 @@ func (s *State) readNext() (interface{}, error) {
 	}
 
 	var input input_record
-	pbuf := uintptr(unsafe.Pointer(&input))
 	var rv uint32
-	prv := uintptr(unsafe.Pointer(&rv))
+
+	var surrogate uint16
 
 	for {
-		ok, _, err := procReadConsoleInput.Call(uintptr(s.handle), pbuf, 1, prv)
+		ok, _, err := procReadConsoleInput.Call(uintptr(s.handle),
+			uintptr(unsafe.Pointer(&input)), 1, uintptr(unsafe.Pointer(&rv)))
 
 		if ok == 0 {
 			return nil, err
@@ -184,9 +189,6 @@ func (s *State) readNext() (interface{}, error) {
 		if input.eventType == window_buffer_size_event {
 			xy := (*coord)(unsafe.Pointer(&input.blob[0]))
 			s.columns = int(xy.x)
-			if s.columns > 1 {
-				s.columns--
-			}
 			return winch, nil
 		}
 		if input.eventType != key_event {
@@ -194,14 +196,31 @@ func (s *State) readNext() (interface{}, error) {
 		}
 		ke := (*key_event_record)(unsafe.Pointer(&input.blob[0]))
 		if ke.KeyDown == 0 {
+			if ke.VirtualKeyCode == vk_menu && ke.Char > 0 {
+				// paste of unicode (eg. via ALT-numpad)
+				if surrogate > 0 {
+					return utf16.DecodeRune(rune(surrogate), rune(ke.Char)), nil
+				} else if utf16.IsSurrogate(rune(ke.Char)) {
+					surrogate = ke.Char
+					continue
+				} else {
+					return rune(ke.Char), nil
+				}
+			}
 			continue
 		}
 
 		if ke.VirtualKeyCode == vk_tab && ke.ControlKeyState&modKeys == shiftPressed {
 			s.key = shiftTab
+		} else if ke.VirtualKeyCode == vk_back && (ke.ControlKeyState&modKeys == leftAltPressed ||
+			ke.ControlKeyState&modKeys == rightAltPressed) {
+			s.key = altBs
 		} else if ke.VirtualKeyCode == bKey && (ke.ControlKeyState&modKeys == leftAltPressed ||
 			ke.ControlKeyState&modKeys == rightAltPressed) {
 			s.key = altB
+		} else if ke.VirtualKeyCode == dKey && (ke.ControlKeyState&modKeys == leftAltPressed ||
+			ke.ControlKeyState&modKeys == rightAltPressed) {
+			s.key = altD
 		} else if ke.VirtualKeyCode == fKey && (ke.ControlKeyState&modKeys == leftAltPressed ||
 			ke.ControlKeyState&modKeys == rightAltPressed) {
 			s.key = altF
@@ -209,7 +228,14 @@ func (s *State) readNext() (interface{}, error) {
 			ke.ControlKeyState&modKeys == rightAltPressed) {
 			s.key = altY
 		} else if ke.Char > 0 {
-			s.key = rune(ke.Char)
+			if surrogate > 0 {
+				s.key = utf16.DecodeRune(rune(surrogate), rune(ke.Char))
+			} else if utf16.IsSurrogate(rune(ke.Char)) {
+				surrogate = ke.Char
+				continue
+			} else {
+				s.key = rune(ke.Char)
+			}
 		} else {
 			switch ke.VirtualKeyCode {
 			case vk_prior:
@@ -337,3 +363,5 @@ func TerminalMode() (ModeApplier, error) {
 	}
 	return mode, err
 }
+
+const cursorColumn = true
diff --git a/vendor/github.com/peterh/liner/line.go b/vendor/github.com/peterh/liner/line.go
index cc147d608a..417bb90e02 100644
--- a/vendor/github.com/peterh/liner/line.go
+++ b/vendor/github.com/peterh/liner/line.go
@@ -1,12 +1,15 @@
-// +build windows linux darwin openbsd freebsd netbsd
+//go:build windows || linux || darwin || openbsd || freebsd || netbsd || solaris
+// +build windows linux darwin openbsd freebsd netbsd solaris
 
 package liner
 
 import (
+	"bufio"
 	"container/ring"
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"strings"
 	"unicode"
 	"unicode/utf8"
@@ -38,6 +41,8 @@ const (
 	f11
 	f12
 	altB
+	altBs // Alt+Backspace
+	altD
 	altF
 	altY
 	shiftTab
@@ -90,6 +95,10 @@ const (
 )
 
 func (s *State) refresh(prompt []rune, buf []rune, pos int) error {
+	if s.columns == 0 {
+		return ErrInternal
+	}
+
 	s.needRefresh = false
 	if s.multiLineMode {
 		return s.refreshMultiLine(prompt, buf, pos)
@@ -106,6 +115,10 @@ func (s *State) refreshSingleLine(prompt []rune, buf []rune, pos int) error {
 
 	pLen := countGlyphs(prompt)
 	bLen := countGlyphs(buf)
+	// on some OS / terminals extra column is needed to place the cursor char
+	if cursorColumn {
+		bLen++
+	}
 	pos = countGlyphs(buf[:pos])
 	if pLen+bLen < s.columns {
 		_, err = fmt.Print(string(buf))
@@ -156,6 +169,14 @@ func (s *State) refreshSingleLine(prompt []rune, buf []rune, pos int) error {
 func (s *State) refreshMultiLine(prompt []rune, buf []rune, pos int) error {
 	promptColumns := countMultiLineGlyphs(prompt, s.columns, 0)
 	totalColumns := countMultiLineGlyphs(buf, s.columns, promptColumns)
+	// on some OS / terminals extra column is needed to place the cursor char
+	// if cursorColumn {
+	//	totalColumns++
+	// }
+
+	// it looks like Multiline mode always assume that a cursor need an extra column,
+	// and always emit a newline if we are at the screen end, so no worarounds needed there
+
 	totalRows := (totalColumns + s.columns - 1) / s.columns
 	maxRows := s.maxRows
 	if totalRows > s.maxRows {
@@ -351,8 +372,8 @@ func (s *State) tabComplete(p []rune, line []rune, pos int) ([]rune, int, interf
 	}
 	hl := utf8.RuneCountInString(head)
 	if len(list) == 1 {
-		s.refresh(p, []rune(head+list[0]+tail), hl+utf8.RuneCountInString(list[0]))
-		return []rune(head + list[0] + tail), hl + utf8.RuneCountInString(list[0]), rune(esc), nil
+		err := s.refresh(p, []rune(head+list[0]+tail), hl+utf8.RuneCountInString(list[0]))
+		return []rune(head + list[0] + tail), hl + utf8.RuneCountInString(list[0]), rune(esc), err
 	}
 
 	direction := tabForward
@@ -366,7 +387,10 @@ func (s *State) tabComplete(p []rune, line []rune, pos int) ([]rune, int, interf
 		if err != nil {
 			return line, pos, rune(esc), err
 		}
-		s.refresh(p, []rune(head+pick+tail), hl+utf8.RuneCountInString(pick))
+		err = s.refresh(p, []rune(head+pick+tail), hl+utf8.RuneCountInString(pick))
+		if err != nil {
+			return line, pos, rune(esc), err
+		}
 
 		next, err := s.readNext()
 		if err != nil {
@@ -392,7 +416,10 @@ func (s *State) tabComplete(p []rune, line []rune, pos int) ([]rune, int, interf
 // reverse intelligent search, implements a bash-like history search.
 func (s *State) reverseISearch(origLine []rune, origPos int) ([]rune, int, interface{}, error) {
 	p := "(reverse-i-search)`': "
-	s.refresh([]rune(p), origLine, origPos)
+	err := s.refresh([]rune(p), origLine, origPos)
+	if err != nil {
+		return origLine, origPos, rune(esc), err
+	}
 
 	line := []rune{}
 	pos := 0
@@ -423,7 +450,7 @@ func (s *State) reverseISearch(origLine []rune, origPos int) ([]rune, int, inter
 					foundLine = history[historyPos]
 					foundPos = positions[historyPos]
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case ctrlS: // Search forward
 				if historyPos < len(history)-1 && historyPos >= 0 {
@@ -431,11 +458,11 @@ func (s *State) reverseISearch(origLine []rune, origPos int) ([]rune, int, inter
 					foundLine = history[historyPos]
 					foundPos = positions[historyPos]
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case ctrlH, bs: // Backspace
 				if pos <= 0 {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					n := len(getSuffixGlyphs(line[:pos], 1))
 					line = append(line[:pos-n], line[pos:]...)
@@ -478,7 +505,10 @@ func (s *State) reverseISearch(origLine []rune, origPos int) ([]rune, int, inter
 		case action:
 			return []rune(foundLine), foundPos, next, err
 		}
-		s.refresh(getLine())
+		err = s.refresh(getLine())
+		if err != nil {
+			return []rune(foundLine), foundPos, rune(esc), err
+		}
 	}
 }
 
@@ -535,7 +565,10 @@ func (s *State) yank(p []rune, text []rune, pos int) ([]rune, int, interface{},
 		line = append(line, lineEnd...)
 
 		pos = len(lineStart) + len(value)
-		s.refresh(p, line, pos)
+		err := s.refresh(p, line, pos)
+		if err != nil {
+			return line, pos, 0, err
+		}
 
 		next, err := s.readNext()
 		if err != nil {
@@ -565,7 +598,7 @@ func (s *State) Prompt(prompt string) (string, error) {
 
 // PromptWithSuggestion displays prompt and an editable text with cursor at
 // given position. The cursor will be set to the end of the line if given position
-// is negative or greater than length of text. Returns a line of user input, not
+// is negative or greater than length of text (in runes). Returns a line of user input, not
 // including a trailing newline character. An io.EOF error is returned if the user
 // signals end-of-file by pressing Ctrl-D.
 func (s *State) PromptWithSuggestion(prompt string, text string, pos int) (string, error) {
@@ -577,6 +610,11 @@ func (s *State) PromptWithSuggestion(prompt string, text string, pos int) (strin
 	if s.inputRedirected || !s.terminalSupported {
 		return s.promptUnsupported(prompt)
 	}
+	p := []rune(prompt)
+	const minWorkingSpace = 10
+	if s.columns < countGlyphs(p)+minWorkingSpace {
+		return s.tooNarrow(prompt)
+	}
 	if s.outputRedirected {
 		return "", ErrNotTerminalOutput
 	}
@@ -585,7 +623,6 @@ func (s *State) PromptWithSuggestion(prompt string, text string, pos int) (strin
 	defer s.historyMutex.RUnlock()
 
 	fmt.Print(prompt)
-	p := []rune(prompt)
 	var line = []rune(text)
 	historyEnd := ""
 	var historyPrefix []string
@@ -596,11 +633,14 @@ func (s *State) PromptWithSuggestion(prompt string, text string, pos int) (strin
 
 	defer s.stopPrompt()
 
-	if pos < 0 || len(text) < pos {
-		pos = len(text)
+	if pos < 0 || len(line) < pos {
+		pos = len(line)
 	}
 	if len(line) > 0 {
-		s.refresh(p, line, pos)
+		err := s.refresh(p, line, pos)
+		if err != nil {
+			return "", err
+		}
 	}
 
 restart:
@@ -624,7 +664,10 @@ mainLoop:
 			switch v {
 			case cr, lf:
 				if s.needRefresh {
-					s.refresh(p, line, pos)
+					err := s.refresh(p, line, pos)
+					if err != nil {
+						return "", err
+					}
 				}
 				if s.multiLineMode {
 					s.resetMultiLine(p, line, pos)
@@ -642,14 +685,14 @@ mainLoop:
 					pos -= len(getSuffixGlyphs(line[:pos], 1))
 					s.needRefresh = true
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case ctrlF: // right
 				if pos < len(line) {
 					pos += len(getPrefixGlyphs(line[pos:], 1))
 					s.needRefresh = true
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case ctrlD: // del
 				if pos == 0 && len(line) == 0 {
@@ -662,7 +705,7 @@ mainLoop:
 				s.restartPrompt()
 
 				if pos >= len(line) {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					n := len(getPrefixGlyphs(line[pos:], 1))
 					line = append(line[:pos], line[pos+n:]...)
@@ -670,7 +713,7 @@ mainLoop:
 				}
 			case ctrlK: // delete remainder of line
 				if pos >= len(line) {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					if killAction > 0 {
 						s.addToKillRing(line[pos:], 1) // Add in apend mode
@@ -698,7 +741,7 @@ mainLoop:
 					pos = len(line)
 					s.needRefresh = true
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case ctrlN: // down
 				historyAction = true
@@ -717,11 +760,11 @@ mainLoop:
 					pos = len(line)
 					s.needRefresh = true
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case ctrlT: // transpose prev glyph with glyph under cursor
 				if len(line) < 2 || pos < 1 {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					if pos == len(line) {
 						pos -= len(getSuffixGlyphs(line, 1))
@@ -752,7 +795,7 @@ mainLoop:
 				s.restartPrompt()
 			case ctrlH, bs: // Backspace
 				if pos <= 0 {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					n := len(getSuffixGlyphs(line[:pos], 1))
 					line = append(line[:pos-n], line[pos:]...)
@@ -771,42 +814,7 @@ mainLoop:
 				pos = 0
 				s.needRefresh = true
 			case ctrlW: // Erase word
-				if pos == 0 {
-					fmt.Print(beep)
-					break
-				}
-				// Remove whitespace to the left
-				var buf []rune // Store the deleted chars in a buffer
-				for {
-					if pos == 0 || !unicode.IsSpace(line[pos-1]) {
-						break
-					}
-					buf = append(buf, line[pos-1])
-					line = append(line[:pos-1], line[pos:]...)
-					pos--
-				}
-				// Remove non-whitespace to the left
-				for {
-					if pos == 0 || unicode.IsSpace(line[pos-1]) {
-						break
-					}
-					buf = append(buf, line[pos-1])
-					line = append(line[:pos-1], line[pos:]...)
-					pos--
-				}
-				// Invert the buffer and save the result on the killRing
-				var newBuf []rune
-				for i := len(buf) - 1; i >= 0; i-- {
-					newBuf = append(newBuf, buf[i])
-				}
-				if killAction > 0 {
-					s.addToKillRing(newBuf, 2) // Add in prepend mode
-				} else {
-					s.addToKillRing(newBuf, 0) // Add in normal mode
-				}
-				killAction = 2 // Mark that there was some killing
-
-				s.needRefresh = true
+				pos, line, killAction = s.eraseWord(pos, line, killAction)
 			case ctrlY: // Paste from Yank buffer
 				line, pos, next, err = s.yank(p, line, pos)
 				goto haveNext
@@ -825,7 +833,7 @@ mainLoop:
 				fallthrough
 			// Catch unhandled control codes (anything <= 31)
 			case 0, 28, 29, 30, 31:
-				fmt.Print(beep)
+				s.doBeep()
 			default:
 				if pos == len(line) && !s.multiLineMode &&
 					len(p)+len(line) < s.columns*4 && // Avoid countGlyphs on large lines
@@ -843,7 +851,7 @@ mainLoop:
 			switch v {
 			case del:
 				if pos >= len(line) {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					n := len(getPrefixGlyphs(line[pos:], 1))
 					line = append(line[:pos], line[pos+n:]...)
@@ -852,7 +860,7 @@ mainLoop:
 				if pos > 0 {
 					pos -= len(getSuffixGlyphs(line[:pos], 1))
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case wordLeft, altB:
 				if pos > 0 {
@@ -873,13 +881,13 @@ mainLoop:
 						}
 					}
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case right:
 				if pos < len(line) {
 					pos += len(getPrefixGlyphs(line[pos:], 1))
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case wordRight, altF:
 				if pos < len(line) {
@@ -900,7 +908,7 @@ mainLoop:
 						}
 					}
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case up:
 				historyAction = true
@@ -917,7 +925,7 @@ mainLoop:
 					line = []rune(historyPrefix[historyPos])
 					pos = len(line)
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case down:
 				historyAction = true
@@ -935,12 +943,43 @@ mainLoop:
 					}
 					pos = len(line)
 				} else {
-					fmt.Print(beep)
+					s.doBeep()
 				}
 			case home: // Start of line
 				pos = 0
 			case end: // End of line
 				pos = len(line)
+			case altD: // Delete next word
+				if pos == len(line) {
+					s.doBeep()
+					break
+				}
+				// Remove whitespace to the right
+				var buf []rune // Store the deleted chars in a buffer
+				for {
+					if pos == len(line) || !unicode.IsSpace(line[pos]) {
+						break
+					}
+					buf = append(buf, line[pos])
+					line = append(line[:pos], line[pos+1:]...)
+				}
+				// Remove non-whitespace to the right
+				for {
+					if pos == len(line) || unicode.IsSpace(line[pos]) {
+						break
+					}
+					buf = append(buf, line[pos])
+					line = append(line[:pos], line[pos+1:]...)
+				}
+				// Save the result on the killRing
+				if killAction > 0 {
+					s.addToKillRing(buf, 2) // Add in prepend mode
+				} else {
+					s.addToKillRing(buf, 0) // Add in normal mode
+				}
+				killAction = 2 // Mark that there was some killing
+			case altBs: // Erase word
+				pos, line, killAction = s.eraseWord(pos, line, killAction)
 			case winch: // Window change
 				if s.multiLineMode {
 					if s.maxRows-s.cursorRows > 0 {
@@ -958,7 +997,10 @@ mainLoop:
 			s.needRefresh = true
 		}
 		if s.needRefresh && !s.inputWaiting() {
-			s.refresh(p, line, pos)
+			err := s.refresh(p, line, pos)
+			if err != nil {
+				return "", err
+			}
 		}
 		if !historyAction {
 			historyStale = true
@@ -978,7 +1020,7 @@ func (s *State) PasswordPrompt(prompt string) (string, error) {
 			return "", ErrInvalidPrompt
 		}
 	}
-	if !s.terminalSupported {
+	if !s.terminalSupported || s.columns == 0 {
 		return "", errors.New("liner: function not supported in this terminal")
 	}
 	if s.inputRedirected {
@@ -988,6 +1030,8 @@ func (s *State) PasswordPrompt(prompt string) (string, error) {
 		return "", ErrNotTerminalOutput
 	}
 
+	p := []rune(prompt)
+
 	defer s.stopPrompt()
 
 restart:
@@ -995,7 +1039,6 @@ restart:
 	s.getColumns()
 
 	fmt.Print(prompt)
-	p := []rune(prompt)
 	var line []rune
 	pos := 0
 
@@ -1013,12 +1056,6 @@ mainLoop:
 		case rune:
 			switch v {
 			case cr, lf:
-				if s.needRefresh {
-					s.refresh(p, line, pos)
-				}
-				if s.multiLineMode {
-					s.resetMultiLine(p, line, pos)
-				}
 				fmt.Println()
 				break mainLoop
 			case ctrlD: // del
@@ -1032,10 +1069,13 @@ mainLoop:
 				s.restartPrompt()
 			case ctrlL: // clear screen
 				s.eraseScreen()
-				s.refresh(p, []rune{}, 0)
+				err := s.refresh(p, []rune{}, 0)
+				if err != nil {
+					return "", err
+				}
 			case ctrlH, bs: // Backspace
 				if pos <= 0 {
-					fmt.Print(beep)
+					s.doBeep()
 				} else {
 					n := len(getSuffixGlyphs(line[:pos], 1))
 					line = append(line[:pos-n], line[pos:]...)
@@ -1043,9 +1083,6 @@ mainLoop:
 				}
 			case ctrlC:
 				fmt.Println("^C")
-				if s.multiLineMode {
-					s.resetMultiLine(p, line, pos)
-				}
 				if s.ctrlCAborts {
 					return "", ErrPromptAborted
 				}
@@ -1059,7 +1096,7 @@ mainLoop:
 				fallthrough
 			// Catch unhandled control codes (anything <= 31)
 			case 0, 28, 29, 30, 31:
-				fmt.Print(beep)
+				s.doBeep()
 			default:
 				line = append(line[:pos], append([]rune{v}, line[pos:]...)...)
 				pos++
@@ -1068,3 +1105,66 @@ mainLoop:
 	}
 	return string(line), nil
 }
+
+func (s *State) tooNarrow(prompt string) (string, error) {
+	// Docker and OpenWRT and etc sometimes return 0 column width
+	// Reset mode temporarily. Restore baked mode in case the terminal
+	// is wide enough for the next Prompt attempt.
+	m, merr := TerminalMode()
+	s.origMode.ApplyMode()
+	if merr == nil {
+		defer m.ApplyMode()
+	}
+	if s.r == nil {
+		// Windows does not always set s.r
+		s.r = bufio.NewReader(os.Stdin)
+		defer func() { s.r = nil }()
+	}
+	return s.promptUnsupported(prompt)
+}
+
+func (s *State) eraseWord(pos int, line []rune, killAction int) (int, []rune, int) {
+	if pos == 0 {
+		s.doBeep()
+		return pos, line, killAction
+	}
+	// Remove whitespace to the left
+	var buf []rune // Store the deleted chars in a buffer
+	for {
+		if pos == 0 || !unicode.IsSpace(line[pos-1]) {
+			break
+		}
+		buf = append(buf, line[pos-1])
+		line = append(line[:pos-1], line[pos:]...)
+		pos--
+	}
+	// Remove non-whitespace to the left
+	for {
+		if pos == 0 || unicode.IsSpace(line[pos-1]) {
+			break
+		}
+		buf = append(buf, line[pos-1])
+		line = append(line[:pos-1], line[pos:]...)
+		pos--
+	}
+	// Invert the buffer and save the result on the killRing
+	var newBuf []rune
+	for i := len(buf) - 1; i >= 0; i-- {
+		newBuf = append(newBuf, buf[i])
+	}
+	if killAction > 0 {
+		s.addToKillRing(newBuf, 2) // Add in prepend mode
+	} else {
+		s.addToKillRing(newBuf, 0) // Add in normal mode
+	}
+	killAction = 2 // Mark that there was some killing
+
+	s.needRefresh = true
+	return pos, line, killAction
+}
+
+func (s *State) doBeep() {
+	if !s.noBeep {
+		fmt.Print(beep)
+	}
+}
diff --git a/vendor/github.com/peterh/liner/output.go b/vendor/github.com/peterh/liner/output.go
index 6d83d4ebfd..f1ac510e6a 100644
--- a/vendor/github.com/peterh/liner/output.go
+++ b/vendor/github.com/peterh/liner/output.go
@@ -1,4 +1,5 @@
-// +build linux darwin openbsd freebsd netbsd
+//go:build linux || darwin || openbsd || freebsd || netbsd || solaris
+// +build linux darwin openbsd freebsd netbsd solaris
 
 package liner
 
@@ -6,8 +7,6 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"syscall"
-	"unsafe"
 )
 
 func (s *State) cursorPos(x int) {
@@ -48,20 +47,6 @@ type winSize struct {
 	xpixel, ypixel uint16
 }
 
-func (s *State) getColumns() bool {
-	var ws winSize
-	ok, _, _ := syscall.Syscall(syscall.SYS_IOCTL, uintptr(syscall.Stdout),
-		syscall.TIOCGWINSZ, uintptr(unsafe.Pointer(&ws)))
-	if int(ok) < 0 {
-		return false
-	}
-	s.columns = int(ws.col)
-	if cursorColumn && s.columns > 1 {
-		s.columns--
-	}
-	return true
-}
-
 func (s *State) checkOutput() {
 	// xterm is known to support CHA
 	if strings.Contains(strings.ToLower(os.Getenv("TERM")), "xterm") {
diff --git a/vendor/github.com/peterh/liner/output_solaris.go b/vendor/github.com/peterh/liner/output_solaris.go
new file mode 100644
index 0000000000..2b8adf2ad0
--- /dev/null
+++ b/vendor/github.com/peterh/liner/output_solaris.go
@@ -0,0 +1,14 @@
+package liner
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+func (s *State) getColumns() bool {
+	ws, err := unix.IoctlGetWinsize(unix.Stdout, unix.TIOCGWINSZ)
+	if err != nil {
+		return false
+	}
+	s.columns = int(ws.Col)
+	return true
+}
diff --git a/vendor/github.com/peterh/liner/output_unix.go b/vendor/github.com/peterh/liner/output_unix.go
new file mode 100644
index 0000000000..8f0ba7191e
--- /dev/null
+++ b/vendor/github.com/peterh/liner/output_unix.go
@@ -0,0 +1,20 @@
+//go:build linux || darwin || openbsd || freebsd || netbsd
+// +build linux darwin openbsd freebsd netbsd
+
+package liner
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+func (s *State) getColumns() bool {
+	var ws winSize
+	ok, _, _ := syscall.Syscall(syscall.SYS_IOCTL, uintptr(syscall.Stdout),
+		syscall.TIOCGWINSZ, uintptr(unsafe.Pointer(&ws)))
+	if int(ok) < 0 {
+		return false
+	}
+	s.columns = int(ws.col)
+	return true
+}
diff --git a/vendor/github.com/peterh/liner/output_windows.go b/vendor/github.com/peterh/liner/output_windows.go
index 63c9c5d757..45cd978c96 100644
--- a/vendor/github.com/peterh/liner/output_windows.go
+++ b/vendor/github.com/peterh/liner/output_windows.go
@@ -69,8 +69,4 @@ func (s *State) getColumns() {
 	var sbi consoleScreenBufferInfo
 	procGetConsoleScreenBufferInfo.Call(uintptr(s.hOut), uintptr(unsafe.Pointer(&sbi)))
 	s.columns = int(sbi.dwSize.x)
-	if s.columns > 1 {
-		// Windows 10 needs a spare column for the cursor
-		s.columns--
-	}
 }
diff --git a/vendor/github.com/peterh/liner/unixmode.go b/vendor/github.com/peterh/liner/unixmode.go
index 9838923f5d..59b3d4681e 100644
--- a/vendor/github.com/peterh/liner/unixmode.go
+++ b/vendor/github.com/peterh/liner/unixmode.go
@@ -1,3 +1,4 @@
+//go:build linux || darwin || freebsd || openbsd || netbsd
 // +build linux darwin freebsd openbsd netbsd
 
 package liner
@@ -21,17 +22,16 @@ func (mode *termios) ApplyMode() error {
 // This function is provided for convenience, and should
 // not be necessary for most users of liner.
 func TerminalMode() (ModeApplier, error) {
-	mode, errno := getMode(syscall.Stdin)
-
-	if errno != 0 {
-		return nil, errno
-	}
-	return mode, nil
+	return getMode(syscall.Stdin)
 }
 
-func getMode(handle int) (*termios, syscall.Errno) {
+func getMode(handle int) (*termios, error) {
 	var mode termios
+	var err error
 	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(handle), getTermios, uintptr(unsafe.Pointer(&mode)))
+	if errno != 0 {
+		err = errno
+	}
 
-	return &mode, errno
+	return &mode, err
 }
diff --git a/vendor/github.com/peterh/liner/unixmode_solaris.go b/vendor/github.com/peterh/liner/unixmode_solaris.go
new file mode 100644
index 0000000000..4926d0b5a6
--- /dev/null
+++ b/vendor/github.com/peterh/liner/unixmode_solaris.go
@@ -0,0 +1,22 @@
+package liner
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+func (mode *termios) ApplyMode() error {
+	return unix.IoctlSetTermios(unix.Stdin, setTermios, (*unix.Termios)(mode))
+}
+
+// TerminalMode returns the current terminal input mode as an InputModeSetter.
+//
+// This function is provided for convenience, and should
+// not be necessary for most users of liner.
+func TerminalMode() (ModeApplier, error) {
+	return getMode(unix.Stdin)
+}
+
+func getMode(handle int) (*termios, error) {
+	tos, err := unix.IoctlGetTermios(handle, getTermios)
+	return (*termios)(tos), err
+}
diff --git a/vendor/github.com/peterh/liner/width.go b/vendor/github.com/peterh/liner/width.go
index 42e8999834..0395f3a8be 100644
--- a/vendor/github.com/peterh/liner/width.go
+++ b/vendor/github.com/peterh/liner/width.go
@@ -1,6 +1,10 @@
 package liner
 
-import "unicode"
+import (
+	"unicode"
+
+	"github.com/mattn/go-runewidth"
+)
 
 // These character classes are mostly zero width (when combined).
 // A few might not be, depending on the user's font. Fixing this
@@ -13,13 +17,6 @@ var zeroWidth = []*unicode.RangeTable{
 	unicode.Cf,
 }
 
-var doubleWidth = []*unicode.RangeTable{
-	unicode.Han,
-	unicode.Hangul,
-	unicode.Hiragana,
-	unicode.Katakana,
-}
-
 // countGlyphs considers zero-width characters to be zero glyphs wide,
 // and members of Chinese, Japanese, and Korean scripts to be 2 glyphs wide.
 func countGlyphs(s []rune) int {
@@ -31,13 +28,7 @@ func countGlyphs(s []rune) int {
 			continue
 		}
 
-		switch {
-		case unicode.IsOneOf(zeroWidth, r):
-		case unicode.IsOneOf(doubleWidth, r):
-			n += 2
-		default:
-			n++
-		}
+		n += runewidth.RuneWidth(r)
 	}
 	return n
 }
@@ -49,17 +40,17 @@ func countMultiLineGlyphs(s []rune, columns int, start int) int {
 			n++
 			continue
 		}
-		switch {
-		case unicode.IsOneOf(zeroWidth, r):
-		case unicode.IsOneOf(doubleWidth, r):
+		switch runewidth.RuneWidth(r) {
+		case 0:
+		case 1:
+			n++
+		case 2:
 			n += 2
 			// no room for a 2-glyphs-wide char in the ending
 			// so skip a column and display it at the beginning
 			if n%columns == 1 {
 				n++
 			}
-		default:
-			n++
 		}
 	}
 	return n
diff --git a/vendor/github.com/pmezard/go-difflib/LICENSE b/vendor/github.com/pmezard/go-difflib/LICENSE
deleted file mode 100644
index c67dad612a..0000000000
--- a/vendor/github.com/pmezard/go-difflib/LICENSE
+++ /dev/null
@@ -1,27 +0,0 @@
-Copyright (c) 2013, Patrick Mezard
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-    Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-    Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.
-    The names of its contributors may not be used to endorse or promote
-products derived from this software without specific prior written
-permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
-IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
-TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
-TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/README.md b/vendor/github.com/prometheus/client_golang/prometheus/README.md
index 44986bff06..c67ff1b7fa 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/README.md
+++ b/vendor/github.com/prometheus/client_golang/prometheus/README.md
@@ -1 +1 @@
-See [![go-doc](https://godoc.org/github.com/prometheus/client_golang/prometheus?status.svg)](https://godoc.org/github.com/prometheus/client_golang/prometheus).
+See [![Go Reference](https://pkg.go.dev/badge/github.com/prometheus/client_golang/prometheus.svg)](https://pkg.go.dev/github.com/prometheus/client_golang/prometheus).
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/build_info_collector.go b/vendor/github.com/prometheus/client_golang/prometheus/build_info_collector.go
new file mode 100644
index 0000000000..450189f35e
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/build_info_collector.go
@@ -0,0 +1,38 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package prometheus
+
+import "runtime/debug"
+
+// NewBuildInfoCollector is the obsolete version of collectors.NewBuildInfoCollector.
+// See there for documentation.
+//
+// Deprecated: Use collectors.NewBuildInfoCollector instead.
+func NewBuildInfoCollector() Collector {
+	path, version, sum := "unknown", "unknown", "unknown"
+	if bi, ok := debug.ReadBuildInfo(); ok {
+		path = bi.Main.Path
+		version = bi.Main.Version
+		sum = bi.Main.Sum
+	}
+	c := &selfCollector{MustNewConstMetric(
+		NewDesc(
+			"go_build_info",
+			"Build information about the main Go module.",
+			nil, Labels{"path": path, "version": version, "checksum": sum},
+		),
+		GaugeValue, 1)}
+	c.init(c.self)
+	return c
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collector.go b/vendor/github.com/prometheus/client_golang/prometheus/collector.go
index 1e839650d4..cf05079fb8 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/collector.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/collector.go
@@ -69,9 +69,9 @@ type Collector interface {
 // If a Collector collects the same metrics throughout its lifetime, its
 // Describe method can simply be implemented as:
 //
-//   func (c customCollector) Describe(ch chan<- *Desc) {
-//   	DescribeByCollect(c, ch)
-//   }
+//	func (c customCollector) Describe(ch chan<- *Desc) {
+//		DescribeByCollect(c, ch)
+//	}
 //
 // However, this will not work if the metrics collected change dynamically over
 // the lifetime of the Collector in a way that their combined set of descriptors
@@ -118,3 +118,11 @@ func (c *selfCollector) Describe(ch chan<- *Desc) {
 func (c *selfCollector) Collect(ch chan<- Metric) {
 	ch <- c.self
 }
+
+// collectorMetric is a metric that is also a collector.
+// Because of selfCollector, most (if not all) Metrics in
+// this package are also collectors.
+type collectorMetric interface {
+	Metric
+	Collector
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/collectors.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/collectors.go
index c4d0f5c35b..f4c92913a5 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/collectors/collectors.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/collectors/collectors.go
@@ -14,3 +14,27 @@
 // Package collectors provides implementations of prometheus.Collector to
 // conveniently collect process and Go-related metrics.
 package collectors
+
+import "github.com/prometheus/client_golang/prometheus"
+
+// NewBuildInfoCollector returns a collector collecting a single metric
+// "go_build_info" with the constant value 1 and three labels "path", "version",
+// and "checksum". Their label values contain the main module path, version, and
+// checksum, respectively. The labels will only have meaningful values if the
+// binary is built with Go module support and from source code retrieved from
+// the source repository (rather than the local file system). This is usually
+// accomplished by building from outside of GOPATH, specifying the full address
+// of the main package, e.g. "GO111MODULE=on go run
+// github.com/prometheus/client_golang/examples/random". If built without Go
+// module support, all label values will be "unknown". If built with Go module
+// support but using the source code from the local file system, the "path" will
+// be set appropriately, but "checksum" will be empty and "version" will be
+// "(devel)".
+//
+// This collector uses only the build information for the main module. See
+// https://github.com/povilasv/prommod for an example of a collector for the
+// module dependencies.
+func NewBuildInfoCollector() prometheus.Collector {
+	//nolint:staticcheck // Ignore SA1019 until v2.
+	return prometheus.NewBuildInfoCollector()
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector.go
index e09f149d76..d5a7279fb9 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector.go
@@ -101,7 +101,7 @@ func (c *dbStatsCollector) Describe(ch chan<- *prometheus.Desc) {
 	ch <- c.waitDuration
 	ch <- c.maxIdleClosed
 	ch <- c.maxLifetimeClosed
-	c.describeNewInGo115(ch)
+	ch <- c.maxIdleTimeClosed
 }
 
 // Collect implements Collector.
@@ -115,5 +115,5 @@ func (c *dbStatsCollector) Collect(ch chan<- prometheus.Metric) {
 	ch <- prometheus.MustNewConstMetric(c.waitDuration, prometheus.CounterValue, stats.WaitDuration.Seconds())
 	ch <- prometheus.MustNewConstMetric(c.maxIdleClosed, prometheus.CounterValue, float64(stats.MaxIdleClosed))
 	ch <- prometheus.MustNewConstMetric(c.maxLifetimeClosed, prometheus.CounterValue, float64(stats.MaxLifetimeClosed))
-	c.collectNewInGo115(ch, stats)
+	ch <- prometheus.MustNewConstMetric(c.maxIdleTimeClosed, prometheus.CounterValue, float64(stats.MaxIdleTimeClosed))
 }
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector_go115.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector_go115.go
deleted file mode 100644
index a6e6268ce3..0000000000
--- a/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector_go115.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2021 The Prometheus Authors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build go1.15
-
-package collectors
-
-import (
-	"database/sql"
-
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-func (c *dbStatsCollector) describeNewInGo115(ch chan<- *prometheus.Desc) {
-	ch <- c.maxIdleTimeClosed
-}
-
-func (c *dbStatsCollector) collectNewInGo115(ch chan<- prometheus.Metric, stats sql.DBStats) {
-	ch <- prometheus.MustNewConstMetric(c.maxIdleTimeClosed, prometheus.CounterValue, float64(stats.MaxIdleTimeClosed))
-}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector_pre_go115.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector_pre_go115.go
deleted file mode 100644
index 0568affe29..0000000000
--- a/vendor/github.com/prometheus/client_golang/prometheus/collectors/dbstats_collector_pre_go115.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2021 The Prometheus Authors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build !go1.15
-
-package collectors
-
-import (
-	"database/sql"
-
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-func (c *dbStatsCollector) describeNewInGo115(ch chan<- *prometheus.Desc) {}
-
-func (c *dbStatsCollector) collectNewInGo115(ch chan<- prometheus.Metric, stats sql.DBStats) {}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector.go
deleted file mode 100644
index edaa4e50b7..0000000000
--- a/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector.go
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright 2021 The Prometheus Authors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package collectors
-
-import "github.com/prometheus/client_golang/prometheus"
-
-// NewGoCollector returns a collector that exports metrics about the current Go
-// process. This includes memory stats. To collect those, runtime.ReadMemStats
-// is called. This requires to “stop the world”, which usually only happens for
-// garbage collection (GC). Take the following implications into account when
-// deciding whether to use the Go collector:
-//
-// 1. The performance impact of stopping the world is the more relevant the more
-// frequently metrics are collected. However, with Go1.9 or later the
-// stop-the-world time per metrics collection is very short (~25µs) so that the
-// performance impact will only matter in rare cases. However, with older Go
-// versions, the stop-the-world duration depends on the heap size and can be
-// quite significant (~1.7 ms/GiB as per
-// https://go-review.googlesource.com/c/go/+/34937).
-//
-// 2. During an ongoing GC, nothing else can stop the world. Therefore, if the
-// metrics collection happens to coincide with GC, it will only complete after
-// GC has finished. Usually, GC is fast enough to not cause problems. However,
-// with a very large heap, GC might take multiple seconds, which is enough to
-// cause scrape timeouts in common setups. To avoid this problem, the Go
-// collector will use the memstats from a previous collection if
-// runtime.ReadMemStats takes more than 1s. However, if there are no previously
-// collected memstats, or their collection is more than 5m ago, the collection
-// will block until runtime.ReadMemStats succeeds.
-//
-// NOTE: The problem is solved in Go 1.15, see
-// https://github.com/golang/go/issues/19812 for the related Go issue.
-func NewGoCollector() prometheus.Collector {
-	//nolint:staticcheck // Ignore SA1019 until v2.
-	return prometheus.NewGoCollector()
-}
-
-// NewBuildInfoCollector returns a collector collecting a single metric
-// "go_build_info" with the constant value 1 and three labels "path", "version",
-// and "checksum". Their label values contain the main module path, version, and
-// checksum, respectively. The labels will only have meaningful values if the
-// binary is built with Go module support and from source code retrieved from
-// the source repository (rather than the local file system). This is usually
-// accomplished by building from outside of GOPATH, specifying the full address
-// of the main package, e.g. "GO111MODULE=on go run
-// github.com/prometheus/client_golang/examples/random". If built without Go
-// module support, all label values will be "unknown". If built with Go module
-// support but using the source code from the local file system, the "path" will
-// be set appropriately, but "checksum" will be empty and "version" will be
-// "(devel)".
-//
-// This collector uses only the build information for the main module. See
-// https://github.com/povilasv/prommod for an example of a collector for the
-// module dependencies.
-func NewBuildInfoCollector() prometheus.Collector {
-	//nolint:staticcheck // Ignore SA1019 until v2.
-	return prometheus.NewBuildInfoCollector()
-}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector_go116.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector_go116.go
new file mode 100644
index 0000000000..effc57840a
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector_go116.go
@@ -0,0 +1,49 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !go1.17
+// +build !go1.17
+
+package collectors
+
+import "github.com/prometheus/client_golang/prometheus"
+
+// NewGoCollector returns a collector that exports metrics about the current Go
+// process. This includes memory stats. To collect those, runtime.ReadMemStats
+// is called. This requires to “stop the world”, which usually only happens for
+// garbage collection (GC). Take the following implications into account when
+// deciding whether to use the Go collector:
+//
+// 1. The performance impact of stopping the world is the more relevant the more
+// frequently metrics are collected. However, with Go1.9 or later the
+// stop-the-world time per metrics collection is very short (~25µs) so that the
+// performance impact will only matter in rare cases. However, with older Go
+// versions, the stop-the-world duration depends on the heap size and can be
+// quite significant (~1.7 ms/GiB as per
+// https://go-review.googlesource.com/c/go/+/34937).
+//
+// 2. During an ongoing GC, nothing else can stop the world. Therefore, if the
+// metrics collection happens to coincide with GC, it will only complete after
+// GC has finished. Usually, GC is fast enough to not cause problems. However,
+// with a very large heap, GC might take multiple seconds, which is enough to
+// cause scrape timeouts in common setups. To avoid this problem, the Go
+// collector will use the memstats from a previous collection if
+// runtime.ReadMemStats takes more than 1s. However, if there are no previously
+// collected memstats, or their collection is more than 5m ago, the collection
+// will block until runtime.ReadMemStats succeeds.
+//
+// NOTE: The problem is solved in Go 1.15, see
+// https://github.com/golang/go/issues/19812 for the related Go issue.
+func NewGoCollector() prometheus.Collector {
+	return prometheus.NewGoCollector()
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector_latest.go b/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector_latest.go
new file mode 100644
index 0000000000..2f5616894e
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/collectors/go_collector_latest.go
@@ -0,0 +1,162 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build go1.17
+// +build go1.17
+
+package collectors
+
+import (
+	"regexp"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/internal"
+)
+
+var (
+	// MetricsAll allows all the metrics to be collected from Go runtime.
+	MetricsAll = GoRuntimeMetricsRule{regexp.MustCompile("/.*")}
+	// MetricsGC allows only GC metrics to be collected from Go runtime.
+	// e.g. go_gc_cycles_automatic_gc_cycles_total
+	// NOTE: This does not include new class of "/cpu/classes/gc/..." metrics.
+	// Use custom metric rule to access those.
+	MetricsGC = GoRuntimeMetricsRule{regexp.MustCompile(`^/gc/.*`)}
+	// MetricsMemory allows only memory metrics to be collected from Go runtime.
+	// e.g. go_memory_classes_heap_free_bytes
+	MetricsMemory = GoRuntimeMetricsRule{regexp.MustCompile(`^/memory/.*`)}
+	// MetricsScheduler allows only scheduler metrics to be collected from Go runtime.
+	// e.g. go_sched_goroutines_goroutines
+	MetricsScheduler = GoRuntimeMetricsRule{regexp.MustCompile(`^/sched/.*`)}
+)
+
+// WithGoCollectorMemStatsMetricsDisabled disables metrics that is gathered in runtime.MemStats structure such as:
+//
+// go_memstats_alloc_bytes
+// go_memstats_alloc_bytes_total
+// go_memstats_sys_bytes
+// go_memstats_lookups_total
+// go_memstats_mallocs_total
+// go_memstats_frees_total
+// go_memstats_heap_alloc_bytes
+// go_memstats_heap_sys_bytes
+// go_memstats_heap_idle_bytes
+// go_memstats_heap_inuse_bytes
+// go_memstats_heap_released_bytes
+// go_memstats_heap_objects
+// go_memstats_stack_inuse_bytes
+// go_memstats_stack_sys_bytes
+// go_memstats_mspan_inuse_bytes
+// go_memstats_mspan_sys_bytes
+// go_memstats_mcache_inuse_bytes
+// go_memstats_mcache_sys_bytes
+// go_memstats_buck_hash_sys_bytes
+// go_memstats_gc_sys_bytes
+// go_memstats_other_sys_bytes
+// go_memstats_next_gc_bytes
+//
+// so the metrics known from pre client_golang v1.12.0,
+//
+// NOTE(bwplotka): The above represents runtime.MemStats statistics, but they are
+// actually implemented using new runtime/metrics package. (except skipped go_memstats_gc_cpu_fraction
+// -- see  https://github.com/prometheus/client_golang/issues/842#issuecomment-861812034 for explanation).
+//
+// Some users might want to disable this on collector level (although you can use scrape relabelling on Prometheus),
+// because similar metrics can be now obtained using WithGoCollectorRuntimeMetrics. Note that the semantics of new
+// metrics might be different, plus the names can be change over time with different Go version.
+//
+// NOTE(bwplotka): Changing metric names can be tedious at times as the alerts, recording rules and dashboards have to be adjusted.
+// The old metrics are also very useful, with many guides and books written about how to interpret them.
+//
+// As a result our recommendation would be to stick with MemStats like metrics and enable other runtime/metrics if you are interested
+// in advanced insights Go provides. See ExampleGoCollector_WithAdvancedGoMetrics.
+func WithGoCollectorMemStatsMetricsDisabled() func(options *internal.GoCollectorOptions) {
+	return func(o *internal.GoCollectorOptions) {
+		o.DisableMemStatsLikeMetrics = true
+	}
+}
+
+// GoRuntimeMetricsRule allow enabling and configuring particular group of runtime/metrics.
+// TODO(bwplotka): Consider adding ability to adjust buckets.
+type GoRuntimeMetricsRule struct {
+	// Matcher represents RE2 expression will match the runtime/metrics from https://golang.bg/src/runtime/metrics/description.go
+	// Use `regexp.MustCompile` or `regexp.Compile` to create this field.
+	Matcher *regexp.Regexp
+}
+
+// WithGoCollectorRuntimeMetrics allows enabling and configuring particular group of runtime/metrics.
+// See the list of metrics https://golang.bg/src/runtime/metrics/description.go (pick the Go version you use there!).
+// You can use this option in repeated manner, which will add new rules. The order of rules is important, the last rule
+// that matches particular metrics is applied.
+func WithGoCollectorRuntimeMetrics(rules ...GoRuntimeMetricsRule) func(options *internal.GoCollectorOptions) {
+	rs := make([]internal.GoCollectorRule, len(rules))
+	for i, r := range rules {
+		rs[i] = internal.GoCollectorRule{
+			Matcher: r.Matcher,
+		}
+	}
+
+	return func(o *internal.GoCollectorOptions) {
+		o.RuntimeMetricRules = append(o.RuntimeMetricRules, rs...)
+	}
+}
+
+// WithoutGoCollectorRuntimeMetrics allows disabling group of runtime/metrics that you might have added in WithGoCollectorRuntimeMetrics.
+// It behaves similarly to WithGoCollectorRuntimeMetrics just with deny-list semantics.
+func WithoutGoCollectorRuntimeMetrics(matchers ...*regexp.Regexp) func(options *internal.GoCollectorOptions) {
+	rs := make([]internal.GoCollectorRule, len(matchers))
+	for i, m := range matchers {
+		rs[i] = internal.GoCollectorRule{
+			Matcher: m,
+			Deny:    true,
+		}
+	}
+
+	return func(o *internal.GoCollectorOptions) {
+		o.RuntimeMetricRules = append(o.RuntimeMetricRules, rs...)
+	}
+}
+
+// GoCollectionOption represents Go collection option flag.
+// Deprecated.
+type GoCollectionOption uint32
+
+const (
+	// GoRuntimeMemStatsCollection represents the metrics represented by runtime.MemStats structure.
+	// Deprecated. Use WithGoCollectorMemStatsMetricsDisabled() function to disable those metrics in the collector.
+	GoRuntimeMemStatsCollection GoCollectionOption = 1 << iota
+	// GoRuntimeMetricsCollection is the new set of metrics represented by runtime/metrics package.
+	// Deprecated. Use WithGoCollectorRuntimeMetrics(GoRuntimeMetricsRule{Matcher: regexp.MustCompile("/.*")})
+	// function to enable those metrics in the collector.
+	GoRuntimeMetricsCollection
+)
+
+// WithGoCollections allows enabling different collections for Go collector on top of base metrics.
+// Deprecated. Use WithGoCollectorRuntimeMetrics() and WithGoCollectorMemStatsMetricsDisabled() instead to control metrics.
+func WithGoCollections(flags GoCollectionOption) func(options *internal.GoCollectorOptions) {
+	return func(options *internal.GoCollectorOptions) {
+		if flags&GoRuntimeMemStatsCollection == 0 {
+			WithGoCollectorMemStatsMetricsDisabled()(options)
+		}
+
+		if flags&GoRuntimeMetricsCollection != 0 {
+			WithGoCollectorRuntimeMetrics(GoRuntimeMetricsRule{Matcher: regexp.MustCompile("/.*")})(options)
+		}
+	}
+}
+
+// NewGoCollector returns a collector that exports metrics about the current Go
+// process using debug.GCStats (base metrics) and runtime/metrics (both in MemStats style and new ones).
+func NewGoCollector(opts ...func(o *internal.GoCollectorOptions)) prometheus.Collector {
+	//nolint:staticcheck // Ignore SA1019 until v2.
+	return prometheus.NewGoCollector(opts...)
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/counter.go b/vendor/github.com/prometheus/client_golang/prometheus/counter.go
index 3f8fd790d6..62de4dc59a 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/counter.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/counter.go
@@ -51,7 +51,7 @@ type Counter interface {
 // will lead to a valid (label-less) exemplar. But if Labels is nil, the current
 // exemplar is left in place. AddWithExemplar panics if the value is < 0, if any
 // of the provided labels are invalid, or if the provided labels contain more
-// than 64 runes in total.
+// than 128 runes in total.
 type ExemplarAdder interface {
 	AddWithExemplar(value float64, exemplar Labels)
 }
@@ -59,6 +59,18 @@ type ExemplarAdder interface {
 // CounterOpts is an alias for Opts. See there for doc comments.
 type CounterOpts Opts
 
+// CounterVecOpts bundles the options to create a CounterVec metric.
+// It is mandatory to set CounterOpts, see there for mandatory fields. VariableLabels
+// is optional and can safely be left to its default value.
+type CounterVecOpts struct {
+	CounterOpts
+
+	// VariableLabels are used to partition the metric vector by the given set
+	// of labels. Each label value will be constrained with the optional Contraint
+	// function, if provided.
+	VariableLabels ConstrainableLabels
+}
+
 // NewCounter creates a new Counter based on the provided CounterOpts.
 //
 // The returned implementation also implements ExemplarAdder. It is safe to
@@ -133,15 +145,20 @@ func (c *counter) Inc() {
 	atomic.AddUint64(&c.valInt, 1)
 }
 
-func (c *counter) Write(out *dto.Metric) error {
+func (c *counter) get() float64 {
 	fval := math.Float64frombits(atomic.LoadUint64(&c.valBits))
 	ival := atomic.LoadUint64(&c.valInt)
-	val := fval + float64(ival)
+	return fval + float64(ival)
+}
 
+func (c *counter) Write(out *dto.Metric) error {
+	// Read the Exemplar first and the value second. This is to avoid a race condition
+	// where users see an exemplar for a not-yet-existing observation.
 	var exemplar *dto.Exemplar
 	if e := c.exemplar.Load(); e != nil {
 		exemplar = e.(*dto.Exemplar)
 	}
+	val := c.get()
 
 	return populateMetric(CounterValue, val, c.labelPairs, exemplar, out)
 }
@@ -169,16 +186,24 @@ type CounterVec struct {
 // NewCounterVec creates a new CounterVec based on the provided CounterOpts and
 // partitioned by the given label names.
 func NewCounterVec(opts CounterOpts, labelNames []string) *CounterVec {
-	desc := NewDesc(
+	return V2.NewCounterVec(CounterVecOpts{
+		CounterOpts:    opts,
+		VariableLabels: UnconstrainedLabels(labelNames),
+	})
+}
+
+// NewCounterVec creates a new CounterVec based on the provided CounterVecOpts.
+func (v2) NewCounterVec(opts CounterVecOpts) *CounterVec {
+	desc := V2.NewDesc(
 		BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
 		opts.Help,
-		labelNames,
+		opts.VariableLabels,
 		opts.ConstLabels,
 	)
 	return &CounterVec{
 		MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
 			if len(lvs) != len(desc.variableLabels) {
-				panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, lvs))
+				panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), lvs))
 			}
 			result := &counter{desc: desc, labelPairs: MakeLabelPairs(desc, lvs), now: time.Now}
 			result.init(result) // Init self-collection.
@@ -241,7 +266,8 @@ func (v *CounterVec) GetMetricWith(labels Labels) (Counter, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Add(42)
+//
+//	myVec.WithLabelValues("404", "GET").Add(42)
 func (v *CounterVec) WithLabelValues(lvs ...string) Counter {
 	c, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -252,7 +278,8 @@ func (v *CounterVec) WithLabelValues(lvs ...string) Counter {
 
 // With works as GetMetricWith, but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
 func (v *CounterVec) With(labels Labels) Counter {
 	c, err := v.GetMetricWith(labels)
 	if err != nil {
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/desc.go b/vendor/github.com/prometheus/client_golang/prometheus/desc.go
index 4bb816ab75..12331542dd 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/desc.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/desc.go
@@ -14,17 +14,16 @@
 package prometheus
 
 import (
-	"errors"
 	"fmt"
 	"sort"
 	"strings"
 
-	"github.com/cespare/xxhash/v2"
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
-	"github.com/prometheus/common/model"
+	"github.com/prometheus/client_golang/prometheus/internal"
 
+	"github.com/cespare/xxhash/v2"
 	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/model"
+	"google.golang.org/protobuf/proto"
 )
 
 // Desc is the descriptor used by every Prometheus Metric. It is essentially
@@ -51,9 +50,9 @@ type Desc struct {
 	// constLabelPairs contains precalculated DTO label pairs based on
 	// the constant labels.
 	constLabelPairs []*dto.LabelPair
-	// variableLabels contains names of labels for which the metric
-	// maintains variable values.
-	variableLabels []string
+	// variableLabels contains names of labels and normalization function for
+	// which the metric maintains variable values.
+	variableLabels ConstrainedLabels
 	// id is a hash of the values of the ConstLabels and fqName. This
 	// must be unique among all registered descriptors and can therefore be
 	// used as an identifier of the descriptor.
@@ -77,10 +76,24 @@ type Desc struct {
 // For constLabels, the label values are constant. Therefore, they are fully
 // specified in the Desc. See the Collector example for a usage pattern.
 func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *Desc {
+	return V2.NewDesc(fqName, help, UnconstrainedLabels(variableLabels), constLabels)
+}
+
+// NewDesc allocates and initializes a new Desc. Errors are recorded in the Desc
+// and will be reported on registration time. variableLabels and constLabels can
+// be nil if no such labels should be set. fqName must not be empty.
+//
+// variableLabels only contain the label names and normalization functions. Their
+// label values are variable and therefore not part of the Desc. (They are managed
+// within the Metric.)
+//
+// For constLabels, the label values are constant. Therefore, they are fully
+// specified in the Desc. See the Collector example for a usage pattern.
+func (v2) NewDesc(fqName, help string, variableLabels ConstrainableLabels, constLabels Labels) *Desc {
 	d := &Desc{
 		fqName:         fqName,
 		help:           help,
-		variableLabels: variableLabels,
+		variableLabels: variableLabels.constrainedLabels(),
 	}
 	if !model.IsValidMetricName(model.LabelValue(fqName)) {
 		d.err = fmt.Errorf("%q is not a valid metric name", fqName)
@@ -90,7 +103,7 @@ func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *
 	// their sorted label names) plus the fqName (at position 0).
 	labelValues := make([]string, 1, len(constLabels)+1)
 	labelValues[0] = fqName
-	labelNames := make([]string, 0, len(constLabels)+len(variableLabels))
+	labelNames := make([]string, 0, len(constLabels)+len(d.variableLabels))
 	labelNameSet := map[string]struct{}{}
 	// First add only the const label names and sort them...
 	for labelName := range constLabels {
@@ -115,16 +128,16 @@ func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *
 	// Now add the variable label names, but prefix them with something that
 	// cannot be in a regular label name. That prevents matching the label
 	// dimension with a different mix between preset and variable labels.
-	for _, labelName := range variableLabels {
-		if !checkLabelName(labelName) {
-			d.err = fmt.Errorf("%q is not a valid label name for metric %q", labelName, fqName)
+	for _, label := range d.variableLabels {
+		if !checkLabelName(label.Name) {
+			d.err = fmt.Errorf("%q is not a valid label name for metric %q", label.Name, fqName)
 			return d
 		}
-		labelNames = append(labelNames, "$"+labelName)
-		labelNameSet[labelName] = struct{}{}
+		labelNames = append(labelNames, "$"+label.Name)
+		labelNameSet[label.Name] = struct{}{}
 	}
 	if len(labelNames) != len(labelNameSet) {
-		d.err = errors.New("duplicate label names")
+		d.err = fmt.Errorf("duplicate label names in constant and variable labels for metric %q", fqName)
 		return d
 	}
 
@@ -154,7 +167,7 @@ func NewDesc(fqName, help string, variableLabels []string, constLabels Labels) *
 			Value: proto.String(v),
 		})
 	}
-	sort.Sort(labelPairSorter(d.constLabelPairs))
+	sort.Sort(internal.LabelPairSorter(d.constLabelPairs))
 	return d
 }
 
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/doc.go b/vendor/github.com/prometheus/client_golang/prometheus/doc.go
index 98450125d6..962608f02c 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/doc.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/doc.go
@@ -21,55 +21,66 @@
 // All exported functions and methods are safe to be used concurrently unless
 // specified otherwise.
 //
-// A Basic Example
+// # A Basic Example
 //
 // As a starting point, a very basic usage example:
 //
-//    package main
-//
-//    import (
-//    	"log"
-//    	"net/http"
-//
-//    	"github.com/prometheus/client_golang/prometheus"
-//    	"github.com/prometheus/client_golang/prometheus/promhttp"
-//    )
-//
-//    var (
-//    	cpuTemp = prometheus.NewGauge(prometheus.GaugeOpts{
-//    		Name: "cpu_temperature_celsius",
-//    		Help: "Current temperature of the CPU.",
-//    	})
-//    	hdFailures = prometheus.NewCounterVec(
-//    		prometheus.CounterOpts{
-//    			Name: "hd_errors_total",
-//    			Help: "Number of hard-disk errors.",
-//    		},
-//    		[]string{"device"},
-//    	)
-//    )
-//
-//    func init() {
-//    	// Metrics have to be registered to be exposed:
-//    	prometheus.MustRegister(cpuTemp)
-//    	prometheus.MustRegister(hdFailures)
-//    }
-//
-//    func main() {
-//    	cpuTemp.Set(65.3)
-//    	hdFailures.With(prometheus.Labels{"device":"/dev/sda"}).Inc()
-//
-//    	// The Handler function provides a default handler to expose metrics
-//    	// via an HTTP server. "/metrics" is the usual endpoint for that.
-//    	http.Handle("/metrics", promhttp.Handler())
-//    	log.Fatal(http.ListenAndServe(":8080", nil))
-//    }
-//
+//	package main
+//
+//	import (
+//		"log"
+//		"net/http"
+//
+//		"github.com/prometheus/client_golang/prometheus"
+//		"github.com/prometheus/client_golang/prometheus/promhttp"
+//	)
+//
+//	type metrics struct {
+//		cpuTemp  prometheus.Gauge
+//		hdFailures *prometheus.CounterVec
+//	}
+//
+//	func NewMetrics(reg prometheus.Registerer) *metrics {
+//		m := &metrics{
+//			cpuTemp: prometheus.NewGauge(prometheus.GaugeOpts{
+//				Name: "cpu_temperature_celsius",
+//				Help: "Current temperature of the CPU.",
+//			}),
+//			hdFailures: prometheus.NewCounterVec(
+//				prometheus.CounterOpts{
+//					Name: "hd_errors_total",
+//					Help: "Number of hard-disk errors.",
+//				},
+//				[]string{"device"},
+//			),
+//		}
+//		reg.MustRegister(m.cpuTemp)
+//		reg.MustRegister(m.hdFailures)
+//		return m
+//	}
+//
+//	func main() {
+//		// Create a non-global registry.
+//		reg := prometheus.NewRegistry()
+//
+//		// Create new metrics and register them using the custom registry.
+//		m := NewMetrics(reg)
+//		// Set values for the new created metrics.
+//		m.cpuTemp.Set(65.3)
+//		m.hdFailures.With(prometheus.Labels{"device":"/dev/sda"}).Inc()
+//
+//		// Expose metrics and custom registry via an HTTP server
+//		// using the HandleFor function. "/metrics" is the usual endpoint for that.
+//		http.Handle("/metrics", promhttp.HandlerFor(reg, promhttp.HandlerOpts{Registry: reg}))
+//		log.Fatal(http.ListenAndServe(":8080", nil))
+//	}
 //
 // This is a complete program that exports two metrics, a Gauge and a Counter,
 // the latter with a label attached to turn it into a (one-dimensional) vector.
+// It register the metrics using a custom registry and exposes them via an HTTP server
+// on the /metrics endpoint.
 //
-// Metrics
+// # Metrics
 //
 // The number of exported identifiers in this package might appear a bit
 // overwhelming. However, in addition to the basic plumbing shown in the example
@@ -100,7 +111,7 @@
 // To create instances of Metrics and their vector versions, you need a suitable
 // …Opts struct, i.e. GaugeOpts, CounterOpts, SummaryOpts, or HistogramOpts.
 //
-// Custom Collectors and constant Metrics
+// # Custom Collectors and constant Metrics
 //
 // While you could create your own implementations of Metric, most likely you
 // will only ever implement the Collector interface on your own. At a first
@@ -141,7 +152,7 @@
 // a metric, GaugeFunc, CounterFunc, or UntypedFunc might be interesting
 // shortcuts.
 //
-// Advanced Uses of the Registry
+// # Advanced Uses of the Registry
 //
 // While MustRegister is the by far most common way of registering a Collector,
 // sometimes you might want to handle the errors the registration might cause.
@@ -176,23 +187,23 @@
 // NewProcessCollector). With a custom registry, you are in control and decide
 // yourself about the Collectors to register.
 //
-// HTTP Exposition
+// # HTTP Exposition
 //
 // The Registry implements the Gatherer interface. The caller of the Gather
 // method can then expose the gathered metrics in some way. Usually, the metrics
 // are served via HTTP on the /metrics endpoint. That's happening in the example
 // above. The tools to expose metrics via HTTP are in the promhttp sub-package.
 //
-// Pushing to the Pushgateway
+// # Pushing to the Pushgateway
 //
 // Function for pushing to the Pushgateway can be found in the push sub-package.
 //
-// Graphite Bridge
+// # Graphite Bridge
 //
 // Functions and examples to push metrics from a Gatherer to Graphite can be
 // found in the graphite sub-package.
 //
-// Other Means of Exposition
+// # Other Means of Exposition
 //
 // More ways of exposing metrics can easily be added by following the approaches
 // of the existing implementations.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/gauge.go b/vendor/github.com/prometheus/client_golang/prometheus/gauge.go
index bd0733d6a7..f1ea6c76f7 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/gauge.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/gauge.go
@@ -55,6 +55,18 @@ type Gauge interface {
 // GaugeOpts is an alias for Opts. See there for doc comments.
 type GaugeOpts Opts
 
+// GaugeVecOpts bundles the options to create a GaugeVec metric.
+// It is mandatory to set GaugeOpts, see there for mandatory fields. VariableLabels
+// is optional and can safely be left to its default value.
+type GaugeVecOpts struct {
+	GaugeOpts
+
+	// VariableLabels are used to partition the metric vector by the given set
+	// of labels. Each label value will be constrained with the optional Contraint
+	// function, if provided.
+	VariableLabels ConstrainableLabels
+}
+
 // NewGauge creates a new Gauge based on the provided GaugeOpts.
 //
 // The returned implementation is optimized for a fast Set method. If you have a
@@ -138,16 +150,24 @@ type GaugeVec struct {
 // NewGaugeVec creates a new GaugeVec based on the provided GaugeOpts and
 // partitioned by the given label names.
 func NewGaugeVec(opts GaugeOpts, labelNames []string) *GaugeVec {
-	desc := NewDesc(
+	return V2.NewGaugeVec(GaugeVecOpts{
+		GaugeOpts:      opts,
+		VariableLabels: UnconstrainedLabels(labelNames),
+	})
+}
+
+// NewGaugeVec creates a new GaugeVec based on the provided GaugeVecOpts.
+func (v2) NewGaugeVec(opts GaugeVecOpts) *GaugeVec {
+	desc := V2.NewDesc(
 		BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
 		opts.Help,
-		labelNames,
+		opts.VariableLabels,
 		opts.ConstLabels,
 	)
 	return &GaugeVec{
 		MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
 			if len(lvs) != len(desc.variableLabels) {
-				panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, lvs))
+				panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), lvs))
 			}
 			result := &gauge{desc: desc, labelPairs: MakeLabelPairs(desc, lvs)}
 			result.init(result) // Init self-collection.
@@ -210,7 +230,8 @@ func (v *GaugeVec) GetMetricWith(labels Labels) (Gauge, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Add(42)
+//
+//	myVec.WithLabelValues("404", "GET").Add(42)
 func (v *GaugeVec) WithLabelValues(lvs ...string) Gauge {
 	g, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -221,7 +242,8 @@ func (v *GaugeVec) WithLabelValues(lvs ...string) Gauge {
 
 // With works as GetMetricWith, but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Add(42)
 func (v *GaugeVec) With(labels Labels) Gauge {
 	g, err := v.GetMetricWith(labels)
 	if err != nil {
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/get_pid.go b/vendor/github.com/prometheus/client_golang/prometheus/get_pid.go
new file mode 100644
index 0000000000..614fd61be9
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/get_pid.go
@@ -0,0 +1,26 @@
+// Copyright 2015 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !js || wasm
+// +build !js wasm
+
+package prometheus
+
+import "os"
+
+func getPIDFn() func() (int, error) {
+	pid := os.Getpid()
+	return func() (int, error) {
+		return pid, nil
+	}
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/get_pid_gopherjs.go b/vendor/github.com/prometheus/client_golang/prometheus/get_pid_gopherjs.go
new file mode 100644
index 0000000000..eaf8059ee1
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/get_pid_gopherjs.go
@@ -0,0 +1,23 @@
+// Copyright 2015 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build js && !wasm
+// +build js,!wasm
+
+package prometheus
+
+func getPIDFn() func() (int, error) {
+	return func() (int, error) {
+		return 1, nil
+	}
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/go_collector.go b/vendor/github.com/prometheus/client_golang/prometheus/go_collector.go
index a96ed1cee8..ad9a71a5e0 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/go_collector.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/go_collector.go
@@ -16,32 +16,205 @@ package prometheus
 import (
 	"runtime"
 	"runtime/debug"
-	"sync"
 	"time"
 )
 
-type goCollector struct {
+// goRuntimeMemStats provides the metrics initially provided by runtime.ReadMemStats.
+// From Go 1.17 those similar (and better) statistics are provided by runtime/metrics, so
+// while eval closure works on runtime.MemStats, the struct from Go 1.17+ is
+// populated using runtime/metrics.
+func goRuntimeMemStats() memStatsMetrics {
+	return memStatsMetrics{
+		{
+			desc: NewDesc(
+				memstatNamespace("alloc_bytes"),
+				"Number of bytes allocated and still in use.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Alloc) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("alloc_bytes_total"),
+				"Total number of bytes allocated, even if freed.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.TotalAlloc) },
+			valType: CounterValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("sys_bytes"),
+				"Number of bytes obtained from system.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Sys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("lookups_total"),
+				"Total number of pointer lookups.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Lookups) },
+			valType: CounterValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("mallocs_total"),
+				"Total number of mallocs.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Mallocs) },
+			valType: CounterValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("frees_total"),
+				"Total number of frees.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Frees) },
+			valType: CounterValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("heap_alloc_bytes"),
+				"Number of heap bytes allocated and still in use.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapAlloc) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("heap_sys_bytes"),
+				"Number of heap bytes obtained from system.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("heap_idle_bytes"),
+				"Number of heap bytes waiting to be used.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapIdle) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("heap_inuse_bytes"),
+				"Number of heap bytes that are in use.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapInuse) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("heap_released_bytes"),
+				"Number of heap bytes released to OS.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapReleased) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("heap_objects"),
+				"Number of allocated objects.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapObjects) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("stack_inuse_bytes"),
+				"Number of bytes in use by the stack allocator.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.StackInuse) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("stack_sys_bytes"),
+				"Number of bytes obtained from system for stack allocator.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.StackSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("mspan_inuse_bytes"),
+				"Number of bytes in use by mspan structures.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MSpanInuse) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("mspan_sys_bytes"),
+				"Number of bytes used for mspan structures obtained from system.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MSpanSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("mcache_inuse_bytes"),
+				"Number of bytes in use by mcache structures.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MCacheInuse) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("mcache_sys_bytes"),
+				"Number of bytes used for mcache structures obtained from system.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MCacheSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("buck_hash_sys_bytes"),
+				"Number of bytes used by the profiling bucket hash table.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.BuckHashSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("gc_sys_bytes"),
+				"Number of bytes used for garbage collection system metadata.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.GCSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("other_sys_bytes"),
+				"Number of bytes used for other system allocations.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.OtherSys) },
+			valType: GaugeValue,
+		}, {
+			desc: NewDesc(
+				memstatNamespace("next_gc_bytes"),
+				"Number of heap bytes when next garbage collection will take place.",
+				nil, nil,
+			),
+			eval:    func(ms *runtime.MemStats) float64 { return float64(ms.NextGC) },
+			valType: GaugeValue,
+		},
+	}
+}
+
+type baseGoCollector struct {
 	goroutinesDesc *Desc
 	threadsDesc    *Desc
 	gcDesc         *Desc
+	gcLastTimeDesc *Desc
 	goInfoDesc     *Desc
-
-	// ms... are memstats related.
-	msLast          *runtime.MemStats // Previously collected memstats.
-	msLastTimestamp time.Time
-	msMtx           sync.Mutex // Protects msLast and msLastTimestamp.
-	msMetrics       memStatsMetrics
-	msRead          func(*runtime.MemStats) // For mocking in tests.
-	msMaxWait       time.Duration           // Wait time for fresh memstats.
-	msMaxAge        time.Duration           // Maximum allowed age of old memstats.
 }
 
-// NewGoCollector is the obsolete version of collectors.NewGoCollector.
-// See there for documentation.
-//
-// Deprecated: Use collectors.NewGoCollector instead.
-func NewGoCollector() Collector {
-	return &goCollector{
+func newBaseGoCollector() baseGoCollector {
+	return baseGoCollector{
 		goroutinesDesc: NewDesc(
 			"go_goroutines",
 			"Number of goroutines that currently exist.",
@@ -54,246 +227,32 @@ func NewGoCollector() Collector {
 			"go_gc_duration_seconds",
 			"A summary of the pause duration of garbage collection cycles.",
 			nil, nil),
+		gcLastTimeDesc: NewDesc(
+			"go_memstats_last_gc_time_seconds",
+			"Number of seconds since 1970 of last garbage collection.",
+			nil, nil),
 		goInfoDesc: NewDesc(
 			"go_info",
 			"Information about the Go environment.",
 			nil, Labels{"version": runtime.Version()}),
-		msLast:    &runtime.MemStats{},
-		msRead:    runtime.ReadMemStats,
-		msMaxWait: time.Second,
-		msMaxAge:  5 * time.Minute,
-		msMetrics: memStatsMetrics{
-			{
-				desc: NewDesc(
-					memstatNamespace("alloc_bytes"),
-					"Number of bytes allocated and still in use.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Alloc) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("alloc_bytes_total"),
-					"Total number of bytes allocated, even if freed.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.TotalAlloc) },
-				valType: CounterValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("sys_bytes"),
-					"Number of bytes obtained from system.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Sys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("lookups_total"),
-					"Total number of pointer lookups.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Lookups) },
-				valType: CounterValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("mallocs_total"),
-					"Total number of mallocs.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Mallocs) },
-				valType: CounterValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("frees_total"),
-					"Total number of frees.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.Frees) },
-				valType: CounterValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("heap_alloc_bytes"),
-					"Number of heap bytes allocated and still in use.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapAlloc) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("heap_sys_bytes"),
-					"Number of heap bytes obtained from system.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("heap_idle_bytes"),
-					"Number of heap bytes waiting to be used.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapIdle) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("heap_inuse_bytes"),
-					"Number of heap bytes that are in use.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapInuse) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("heap_released_bytes"),
-					"Number of heap bytes released to OS.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapReleased) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("heap_objects"),
-					"Number of allocated objects.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.HeapObjects) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("stack_inuse_bytes"),
-					"Number of bytes in use by the stack allocator.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.StackInuse) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("stack_sys_bytes"),
-					"Number of bytes obtained from system for stack allocator.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.StackSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("mspan_inuse_bytes"),
-					"Number of bytes in use by mspan structures.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MSpanInuse) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("mspan_sys_bytes"),
-					"Number of bytes used for mspan structures obtained from system.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MSpanSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("mcache_inuse_bytes"),
-					"Number of bytes in use by mcache structures.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MCacheInuse) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("mcache_sys_bytes"),
-					"Number of bytes used for mcache structures obtained from system.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.MCacheSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("buck_hash_sys_bytes"),
-					"Number of bytes used by the profiling bucket hash table.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.BuckHashSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("gc_sys_bytes"),
-					"Number of bytes used for garbage collection system metadata.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.GCSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("other_sys_bytes"),
-					"Number of bytes used for other system allocations.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.OtherSys) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("next_gc_bytes"),
-					"Number of heap bytes when next garbage collection will take place.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.NextGC) },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("last_gc_time_seconds"),
-					"Number of seconds since 1970 of last garbage collection.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return float64(ms.LastGC) / 1e9 },
-				valType: GaugeValue,
-			}, {
-				desc: NewDesc(
-					memstatNamespace("gc_cpu_fraction"),
-					"The fraction of this program's available CPU time used by the GC since the program started.",
-					nil, nil,
-				),
-				eval:    func(ms *runtime.MemStats) float64 { return ms.GCCPUFraction },
-				valType: GaugeValue,
-			},
-		},
 	}
 }
 
-func memstatNamespace(s string) string {
-	return "go_memstats_" + s
-}
-
 // Describe returns all descriptions of the collector.
-func (c *goCollector) Describe(ch chan<- *Desc) {
+func (c *baseGoCollector) Describe(ch chan<- *Desc) {
 	ch <- c.goroutinesDesc
 	ch <- c.threadsDesc
 	ch <- c.gcDesc
+	ch <- c.gcLastTimeDesc
 	ch <- c.goInfoDesc
-	for _, i := range c.msMetrics {
-		ch <- i.desc
-	}
 }
 
 // Collect returns the current state of all metrics of the collector.
-func (c *goCollector) Collect(ch chan<- Metric) {
-	var (
-		ms   = &runtime.MemStats{}
-		done = make(chan struct{})
-	)
-	// Start reading memstats first as it might take a while.
-	go func() {
-		c.msRead(ms)
-		c.msMtx.Lock()
-		c.msLast = ms
-		c.msLastTimestamp = time.Now()
-		c.msMtx.Unlock()
-		close(done)
-	}()
-
+func (c *baseGoCollector) Collect(ch chan<- Metric) {
 	ch <- MustNewConstMetric(c.goroutinesDesc, GaugeValue, float64(runtime.NumGoroutine()))
-	n, _ := runtime.ThreadCreateProfile(nil)
-	ch <- MustNewConstMetric(c.threadsDesc, GaugeValue, float64(n))
+
+	n := getRuntimeNumThreads()
+	ch <- MustNewConstMetric(c.threadsDesc, GaugeValue, n)
 
 	var stats debug.GCStats
 	stats.PauseQuantiles = make([]time.Duration, 5)
@@ -305,63 +264,18 @@ func (c *goCollector) Collect(ch chan<- Metric) {
 	}
 	quantiles[0.0] = stats.PauseQuantiles[0].Seconds()
 	ch <- MustNewConstSummary(c.gcDesc, uint64(stats.NumGC), stats.PauseTotal.Seconds(), quantiles)
-
+	ch <- MustNewConstMetric(c.gcLastTimeDesc, GaugeValue, float64(stats.LastGC.UnixNano())/1e9)
 	ch <- MustNewConstMetric(c.goInfoDesc, GaugeValue, 1)
-
-	timer := time.NewTimer(c.msMaxWait)
-	select {
-	case <-done: // Our own ReadMemStats succeeded in time. Use it.
-		timer.Stop() // Important for high collection frequencies to not pile up timers.
-		c.msCollect(ch, ms)
-		return
-	case <-timer.C: // Time out, use last memstats if possible. Continue below.
-	}
-	c.msMtx.Lock()
-	if time.Since(c.msLastTimestamp) < c.msMaxAge {
-		// Last memstats are recent enough. Collect from them under the lock.
-		c.msCollect(ch, c.msLast)
-		c.msMtx.Unlock()
-		return
-	}
-	// If we are here, the last memstats are too old or don't exist. We have
-	// to wait until our own ReadMemStats finally completes. For that to
-	// happen, we have to release the lock.
-	c.msMtx.Unlock()
-	<-done
-	c.msCollect(ch, ms)
 }
 
-func (c *goCollector) msCollect(ch chan<- Metric, ms *runtime.MemStats) {
-	for _, i := range c.msMetrics {
-		ch <- MustNewConstMetric(i.desc, i.valType, i.eval(ms))
-	}
+func memstatNamespace(s string) string {
+	return "go_memstats_" + s
 }
 
-// memStatsMetrics provide description, value, and value type for memstat metrics.
+// memStatsMetrics provide description, evaluator, runtime/metrics name, and
+// value type for memstat metrics.
 type memStatsMetrics []struct {
 	desc    *Desc
 	eval    func(*runtime.MemStats) float64
 	valType ValueType
 }
-
-// NewBuildInfoCollector is the obsolete version of collectors.NewBuildInfoCollector.
-// See there for documentation.
-//
-// Deprecated: Use collectors.NewBuildInfoCollector instead.
-func NewBuildInfoCollector() Collector {
-	path, version, sum := "unknown", "unknown", "unknown"
-	if bi, ok := debug.ReadBuildInfo(); ok {
-		path = bi.Main.Path
-		version = bi.Main.Version
-		sum = bi.Main.Sum
-	}
-	c := &selfCollector{MustNewConstMetric(
-		NewDesc(
-			"go_build_info",
-			"Build information about the main Go module.",
-			nil, Labels{"path": path, "version": version, "checksum": sum},
-		),
-		GaugeValue, 1)}
-	c.init(c.self)
-	return c
-}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/go_collector_go116.go b/vendor/github.com/prometheus/client_golang/prometheus/go_collector_go116.go
new file mode 100644
index 0000000000..897a6e906b
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/go_collector_go116.go
@@ -0,0 +1,122 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !go1.17
+// +build !go1.17
+
+package prometheus
+
+import (
+	"runtime"
+	"sync"
+	"time"
+)
+
+type goCollector struct {
+	base baseGoCollector
+
+	// ms... are memstats related.
+	msLast          *runtime.MemStats // Previously collected memstats.
+	msLastTimestamp time.Time
+	msMtx           sync.Mutex // Protects msLast and msLastTimestamp.
+	msMetrics       memStatsMetrics
+	msRead          func(*runtime.MemStats) // For mocking in tests.
+	msMaxWait       time.Duration           // Wait time for fresh memstats.
+	msMaxAge        time.Duration           // Maximum allowed age of old memstats.
+}
+
+// NewGoCollector is the obsolete version of collectors.NewGoCollector.
+// See there for documentation.
+//
+// Deprecated: Use collectors.NewGoCollector instead.
+func NewGoCollector() Collector {
+	msMetrics := goRuntimeMemStats()
+	msMetrics = append(msMetrics, struct {
+		desc    *Desc
+		eval    func(*runtime.MemStats) float64
+		valType ValueType
+	}{
+		// This metric is omitted in Go1.17+, see https://github.com/prometheus/client_golang/issues/842#issuecomment-861812034
+		desc: NewDesc(
+			memstatNamespace("gc_cpu_fraction"),
+			"The fraction of this program's available CPU time used by the GC since the program started.",
+			nil, nil,
+		),
+		eval:    func(ms *runtime.MemStats) float64 { return ms.GCCPUFraction },
+		valType: GaugeValue,
+	})
+	return &goCollector{
+		base:      newBaseGoCollector(),
+		msLast:    &runtime.MemStats{},
+		msRead:    runtime.ReadMemStats,
+		msMaxWait: time.Second,
+		msMaxAge:  5 * time.Minute,
+		msMetrics: msMetrics,
+	}
+}
+
+// Describe returns all descriptions of the collector.
+func (c *goCollector) Describe(ch chan<- *Desc) {
+	c.base.Describe(ch)
+	for _, i := range c.msMetrics {
+		ch <- i.desc
+	}
+}
+
+// Collect returns the current state of all metrics of the collector.
+func (c *goCollector) Collect(ch chan<- Metric) {
+	var (
+		ms   = &runtime.MemStats{}
+		done = make(chan struct{})
+	)
+	// Start reading memstats first as it might take a while.
+	go func() {
+		c.msRead(ms)
+		c.msMtx.Lock()
+		c.msLast = ms
+		c.msLastTimestamp = time.Now()
+		c.msMtx.Unlock()
+		close(done)
+	}()
+
+	// Collect base non-memory metrics.
+	c.base.Collect(ch)
+
+	timer := time.NewTimer(c.msMaxWait)
+	select {
+	case <-done: // Our own ReadMemStats succeeded in time. Use it.
+		timer.Stop() // Important for high collection frequencies to not pile up timers.
+		c.msCollect(ch, ms)
+		return
+	case <-timer.C: // Time out, use last memstats if possible. Continue below.
+	}
+	c.msMtx.Lock()
+	if time.Since(c.msLastTimestamp) < c.msMaxAge {
+		// Last memstats are recent enough. Collect from them under the lock.
+		c.msCollect(ch, c.msLast)
+		c.msMtx.Unlock()
+		return
+	}
+	// If we are here, the last memstats are too old or don't exist. We have
+	// to wait until our own ReadMemStats finally completes. For that to
+	// happen, we have to release the lock.
+	c.msMtx.Unlock()
+	<-done
+	c.msCollect(ch, ms)
+}
+
+func (c *goCollector) msCollect(ch chan<- Metric, ms *runtime.MemStats) {
+	for _, i := range c.msMetrics {
+		ch <- MustNewConstMetric(i.desc, i.valType, i.eval(ms))
+	}
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/go_collector_latest.go b/vendor/github.com/prometheus/client_golang/prometheus/go_collector_latest.go
new file mode 100644
index 0000000000..2d8d9f64f4
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/go_collector_latest.go
@@ -0,0 +1,567 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build go1.17
+// +build go1.17
+
+package prometheus
+
+import (
+	"math"
+	"runtime"
+	"runtime/metrics"
+	"strings"
+	"sync"
+
+	"github.com/prometheus/client_golang/prometheus/internal"
+
+	dto "github.com/prometheus/client_model/go"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	// constants for strings referenced more than once.
+	goGCHeapTinyAllocsObjects               = "/gc/heap/tiny/allocs:objects"
+	goGCHeapAllocsObjects                   = "/gc/heap/allocs:objects"
+	goGCHeapFreesObjects                    = "/gc/heap/frees:objects"
+	goGCHeapFreesBytes                      = "/gc/heap/frees:bytes"
+	goGCHeapAllocsBytes                     = "/gc/heap/allocs:bytes"
+	goGCHeapObjects                         = "/gc/heap/objects:objects"
+	goGCHeapGoalBytes                       = "/gc/heap/goal:bytes"
+	goMemoryClassesTotalBytes               = "/memory/classes/total:bytes"
+	goMemoryClassesHeapObjectsBytes         = "/memory/classes/heap/objects:bytes"
+	goMemoryClassesHeapUnusedBytes          = "/memory/classes/heap/unused:bytes"
+	goMemoryClassesHeapReleasedBytes        = "/memory/classes/heap/released:bytes"
+	goMemoryClassesHeapFreeBytes            = "/memory/classes/heap/free:bytes"
+	goMemoryClassesHeapStacksBytes          = "/memory/classes/heap/stacks:bytes"
+	goMemoryClassesOSStacksBytes            = "/memory/classes/os-stacks:bytes"
+	goMemoryClassesMetadataMSpanInuseBytes  = "/memory/classes/metadata/mspan/inuse:bytes"
+	goMemoryClassesMetadataMSPanFreeBytes   = "/memory/classes/metadata/mspan/free:bytes"
+	goMemoryClassesMetadataMCacheInuseBytes = "/memory/classes/metadata/mcache/inuse:bytes"
+	goMemoryClassesMetadataMCacheFreeBytes  = "/memory/classes/metadata/mcache/free:bytes"
+	goMemoryClassesProfilingBucketsBytes    = "/memory/classes/profiling/buckets:bytes"
+	goMemoryClassesMetadataOtherBytes       = "/memory/classes/metadata/other:bytes"
+	goMemoryClassesOtherBytes               = "/memory/classes/other:bytes"
+)
+
+// rmNamesForMemStatsMetrics represents runtime/metrics names required to populate goRuntimeMemStats from like logic.
+var rmNamesForMemStatsMetrics = []string{
+	goGCHeapTinyAllocsObjects,
+	goGCHeapAllocsObjects,
+	goGCHeapFreesObjects,
+	goGCHeapAllocsBytes,
+	goGCHeapObjects,
+	goGCHeapGoalBytes,
+	goMemoryClassesTotalBytes,
+	goMemoryClassesHeapObjectsBytes,
+	goMemoryClassesHeapUnusedBytes,
+	goMemoryClassesHeapReleasedBytes,
+	goMemoryClassesHeapFreeBytes,
+	goMemoryClassesHeapStacksBytes,
+	goMemoryClassesOSStacksBytes,
+	goMemoryClassesMetadataMSpanInuseBytes,
+	goMemoryClassesMetadataMSPanFreeBytes,
+	goMemoryClassesMetadataMCacheInuseBytes,
+	goMemoryClassesMetadataMCacheFreeBytes,
+	goMemoryClassesProfilingBucketsBytes,
+	goMemoryClassesMetadataOtherBytes,
+	goMemoryClassesOtherBytes,
+}
+
+func bestEffortLookupRM(lookup []string) []metrics.Description {
+	ret := make([]metrics.Description, 0, len(lookup))
+	for _, rm := range metrics.All() {
+		for _, m := range lookup {
+			if m == rm.Name {
+				ret = append(ret, rm)
+			}
+		}
+	}
+	return ret
+}
+
+type goCollector struct {
+	base baseGoCollector
+
+	// mu protects updates to all fields ensuring a consistent
+	// snapshot is always produced by Collect.
+	mu sync.Mutex
+
+	// Contains all samples that has to retrieved from runtime/metrics (not all of them will be exposed).
+	sampleBuf []metrics.Sample
+	// sampleMap allows lookup for MemStats metrics and runtime/metrics histograms for exact sums.
+	sampleMap map[string]*metrics.Sample
+
+	// rmExposedMetrics represents all runtime/metrics package metrics
+	// that were configured to be exposed.
+	rmExposedMetrics     []collectorMetric
+	rmExactSumMapForHist map[string]string
+
+	// With Go 1.17, the runtime/metrics package was introduced.
+	// From that point on, metric names produced by the runtime/metrics
+	// package could be generated from runtime/metrics names. However,
+	// these differ from the old names for the same values.
+	//
+	// This field exists to export the same values under the old names
+	// as well.
+	msMetrics        memStatsMetrics
+	msMetricsEnabled bool
+}
+
+type rmMetricDesc struct {
+	metrics.Description
+}
+
+func matchRuntimeMetricsRules(rules []internal.GoCollectorRule) []rmMetricDesc {
+	var descs []rmMetricDesc
+	for _, d := range metrics.All() {
+		var (
+			deny = true
+			desc rmMetricDesc
+		)
+
+		for _, r := range rules {
+			if !r.Matcher.MatchString(d.Name) {
+				continue
+			}
+			deny = r.Deny
+		}
+		if deny {
+			continue
+		}
+
+		desc.Description = d
+		descs = append(descs, desc)
+	}
+	return descs
+}
+
+func defaultGoCollectorOptions() internal.GoCollectorOptions {
+	return internal.GoCollectorOptions{
+		RuntimeMetricSumForHist: map[string]string{
+			"/gc/heap/allocs-by-size:bytes": goGCHeapAllocsBytes,
+			"/gc/heap/frees-by-size:bytes":  goGCHeapFreesBytes,
+		},
+		RuntimeMetricRules: []internal.GoCollectorRule{
+			//{Matcher: regexp.MustCompile("")},
+		},
+	}
+}
+
+// NewGoCollector is the obsolete version of collectors.NewGoCollector.
+// See there for documentation.
+//
+// Deprecated: Use collectors.NewGoCollector instead.
+func NewGoCollector(opts ...func(o *internal.GoCollectorOptions)) Collector {
+	opt := defaultGoCollectorOptions()
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	exposedDescriptions := matchRuntimeMetricsRules(opt.RuntimeMetricRules)
+
+	// Collect all histogram samples so that we can get their buckets.
+	// The API guarantees that the buckets are always fixed for the lifetime
+	// of the process.
+	var histograms []metrics.Sample
+	for _, d := range exposedDescriptions {
+		if d.Kind == metrics.KindFloat64Histogram {
+			histograms = append(histograms, metrics.Sample{Name: d.Name})
+		}
+	}
+
+	if len(histograms) > 0 {
+		metrics.Read(histograms)
+	}
+
+	bucketsMap := make(map[string][]float64)
+	for i := range histograms {
+		bucketsMap[histograms[i].Name] = histograms[i].Value.Float64Histogram().Buckets
+	}
+
+	// Generate a collector for each exposed runtime/metrics metric.
+	metricSet := make([]collectorMetric, 0, len(exposedDescriptions))
+	// SampleBuf is used for reading from runtime/metrics.
+	// We are assuming the largest case to have stable pointers for sampleMap purposes.
+	sampleBuf := make([]metrics.Sample, 0, len(exposedDescriptions)+len(opt.RuntimeMetricSumForHist)+len(rmNamesForMemStatsMetrics))
+	sampleMap := make(map[string]*metrics.Sample, len(exposedDescriptions))
+	for _, d := range exposedDescriptions {
+		namespace, subsystem, name, ok := internal.RuntimeMetricsToProm(&d.Description)
+		if !ok {
+			// Just ignore this metric; we can't do anything with it here.
+			// If a user decides to use the latest version of Go, we don't want
+			// to fail here. This condition is tested in TestExpectedRuntimeMetrics.
+			continue
+		}
+
+		sampleBuf = append(sampleBuf, metrics.Sample{Name: d.Name})
+		sampleMap[d.Name] = &sampleBuf[len(sampleBuf)-1]
+
+		var m collectorMetric
+		if d.Kind == metrics.KindFloat64Histogram {
+			_, hasSum := opt.RuntimeMetricSumForHist[d.Name]
+			unit := d.Name[strings.IndexRune(d.Name, ':')+1:]
+			m = newBatchHistogram(
+				NewDesc(
+					BuildFQName(namespace, subsystem, name),
+					d.Description.Description,
+					nil,
+					nil,
+				),
+				internal.RuntimeMetricsBucketsForUnit(bucketsMap[d.Name], unit),
+				hasSum,
+			)
+		} else if d.Cumulative {
+			m = NewCounter(CounterOpts{
+				Namespace: namespace,
+				Subsystem: subsystem,
+				Name:      name,
+				Help:      d.Description.Description,
+			},
+			)
+		} else {
+			m = NewGauge(GaugeOpts{
+				Namespace: namespace,
+				Subsystem: subsystem,
+				Name:      name,
+				Help:      d.Description.Description,
+			})
+		}
+		metricSet = append(metricSet, m)
+	}
+
+	// Add exact sum metrics to sampleBuf if not added before.
+	for _, h := range histograms {
+		sumMetric, ok := opt.RuntimeMetricSumForHist[h.Name]
+		if !ok {
+			continue
+		}
+
+		if _, ok := sampleMap[sumMetric]; ok {
+			continue
+		}
+		sampleBuf = append(sampleBuf, metrics.Sample{Name: sumMetric})
+		sampleMap[sumMetric] = &sampleBuf[len(sampleBuf)-1]
+	}
+
+	var (
+		msMetrics      memStatsMetrics
+		msDescriptions []metrics.Description
+	)
+
+	if !opt.DisableMemStatsLikeMetrics {
+		msMetrics = goRuntimeMemStats()
+		msDescriptions = bestEffortLookupRM(rmNamesForMemStatsMetrics)
+
+		// Check if metric was not exposed before and if not, add to sampleBuf.
+		for _, mdDesc := range msDescriptions {
+			if _, ok := sampleMap[mdDesc.Name]; ok {
+				continue
+			}
+			sampleBuf = append(sampleBuf, metrics.Sample{Name: mdDesc.Name})
+			sampleMap[mdDesc.Name] = &sampleBuf[len(sampleBuf)-1]
+		}
+	}
+
+	return &goCollector{
+		base:                 newBaseGoCollector(),
+		sampleBuf:            sampleBuf,
+		sampleMap:            sampleMap,
+		rmExposedMetrics:     metricSet,
+		rmExactSumMapForHist: opt.RuntimeMetricSumForHist,
+		msMetrics:            msMetrics,
+		msMetricsEnabled:     !opt.DisableMemStatsLikeMetrics,
+	}
+}
+
+// Describe returns all descriptions of the collector.
+func (c *goCollector) Describe(ch chan<- *Desc) {
+	c.base.Describe(ch)
+	for _, i := range c.msMetrics {
+		ch <- i.desc
+	}
+	for _, m := range c.rmExposedMetrics {
+		ch <- m.Desc()
+	}
+}
+
+// Collect returns the current state of all metrics of the collector.
+func (c *goCollector) Collect(ch chan<- Metric) {
+	// Collect base non-memory metrics.
+	c.base.Collect(ch)
+
+	if len(c.sampleBuf) == 0 {
+		return
+	}
+
+	// Collect must be thread-safe, so prevent concurrent use of
+	// sampleBuf elements. Just read into sampleBuf but write all the data
+	// we get into our Metrics or MemStats.
+	//
+	// This lock also ensures that the Metrics we send out are all from
+	// the same updates, ensuring their mutual consistency insofar as
+	// is guaranteed by the runtime/metrics package.
+	//
+	// N.B. This locking is heavy-handed, but Collect is expected to be called
+	// relatively infrequently. Also the core operation here, metrics.Read,
+	// is fast (O(tens of microseconds)) so contention should certainly be
+	// low, though channel operations and any allocations may add to that.
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	// Populate runtime/metrics sample buffer.
+	metrics.Read(c.sampleBuf)
+
+	// Collect all our runtime/metrics user chose to expose from sampleBuf (if any).
+	for i, metric := range c.rmExposedMetrics {
+		// We created samples for exposed metrics first in order, so indexes match.
+		sample := c.sampleBuf[i]
+
+		// N.B. switch on concrete type because it's significantly more efficient
+		// than checking for the Counter and Gauge interface implementations. In
+		// this case, we control all the types here.
+		switch m := metric.(type) {
+		case *counter:
+			// Guard against decreases. This should never happen, but a failure
+			// to do so will result in a panic, which is a harsh consequence for
+			// a metrics collection bug.
+			v0, v1 := m.get(), unwrapScalarRMValue(sample.Value)
+			if v1 > v0 {
+				m.Add(unwrapScalarRMValue(sample.Value) - m.get())
+			}
+			m.Collect(ch)
+		case *gauge:
+			m.Set(unwrapScalarRMValue(sample.Value))
+			m.Collect(ch)
+		case *batchHistogram:
+			m.update(sample.Value.Float64Histogram(), c.exactSumFor(sample.Name))
+			m.Collect(ch)
+		default:
+			panic("unexpected metric type")
+		}
+	}
+
+	if c.msMetricsEnabled {
+		// ms is a dummy MemStats that we populate ourselves so that we can
+		// populate the old metrics from it if goMemStatsCollection is enabled.
+		var ms runtime.MemStats
+		memStatsFromRM(&ms, c.sampleMap)
+		for _, i := range c.msMetrics {
+			ch <- MustNewConstMetric(i.desc, i.valType, i.eval(&ms))
+		}
+	}
+}
+
+// unwrapScalarRMValue unwraps a runtime/metrics value that is assumed
+// to be scalar and returns the equivalent float64 value. Panics if the
+// value is not scalar.
+func unwrapScalarRMValue(v metrics.Value) float64 {
+	switch v.Kind() {
+	case metrics.KindUint64:
+		return float64(v.Uint64())
+	case metrics.KindFloat64:
+		return v.Float64()
+	case metrics.KindBad:
+		// Unsupported metric.
+		//
+		// This should never happen because we always populate our metric
+		// set from the runtime/metrics package.
+		panic("unexpected unsupported metric")
+	default:
+		// Unsupported metric kind.
+		//
+		// This should never happen because we check for this during initialization
+		// and flag and filter metrics whose kinds we don't understand.
+		panic("unexpected unsupported metric kind")
+	}
+}
+
+// exactSumFor takes a runtime/metrics metric name (that is assumed to
+// be of kind KindFloat64Histogram) and returns its exact sum and whether
+// its exact sum exists.
+//
+// The runtime/metrics API for histograms doesn't currently expose exact
+// sums, but some of the other metrics are in fact exact sums of histograms.
+func (c *goCollector) exactSumFor(rmName string) float64 {
+	sumName, ok := c.rmExactSumMapForHist[rmName]
+	if !ok {
+		return 0
+	}
+	s, ok := c.sampleMap[sumName]
+	if !ok {
+		return 0
+	}
+	return unwrapScalarRMValue(s.Value)
+}
+
+func memStatsFromRM(ms *runtime.MemStats, rm map[string]*metrics.Sample) {
+	lookupOrZero := func(name string) uint64 {
+		if s, ok := rm[name]; ok {
+			return s.Value.Uint64()
+		}
+		return 0
+	}
+
+	// Currently, MemStats adds tiny alloc count to both Mallocs AND Frees.
+	// The reason for this is because MemStats couldn't be extended at the time
+	// but there was a desire to have Mallocs at least be a little more representative,
+	// while having Mallocs - Frees still represent a live object count.
+	// Unfortunately, MemStats doesn't actually export a large allocation count,
+	// so it's impossible to pull this number out directly.
+	tinyAllocs := lookupOrZero(goGCHeapTinyAllocsObjects)
+	ms.Mallocs = lookupOrZero(goGCHeapAllocsObjects) + tinyAllocs
+	ms.Frees = lookupOrZero(goGCHeapFreesObjects) + tinyAllocs
+
+	ms.TotalAlloc = lookupOrZero(goGCHeapAllocsBytes)
+	ms.Sys = lookupOrZero(goMemoryClassesTotalBytes)
+	ms.Lookups = 0 // Already always zero.
+	ms.HeapAlloc = lookupOrZero(goMemoryClassesHeapObjectsBytes)
+	ms.Alloc = ms.HeapAlloc
+	ms.HeapInuse = ms.HeapAlloc + lookupOrZero(goMemoryClassesHeapUnusedBytes)
+	ms.HeapReleased = lookupOrZero(goMemoryClassesHeapReleasedBytes)
+	ms.HeapIdle = ms.HeapReleased + lookupOrZero(goMemoryClassesHeapFreeBytes)
+	ms.HeapSys = ms.HeapInuse + ms.HeapIdle
+	ms.HeapObjects = lookupOrZero(goGCHeapObjects)
+	ms.StackInuse = lookupOrZero(goMemoryClassesHeapStacksBytes)
+	ms.StackSys = ms.StackInuse + lookupOrZero(goMemoryClassesOSStacksBytes)
+	ms.MSpanInuse = lookupOrZero(goMemoryClassesMetadataMSpanInuseBytes)
+	ms.MSpanSys = ms.MSpanInuse + lookupOrZero(goMemoryClassesMetadataMSPanFreeBytes)
+	ms.MCacheInuse = lookupOrZero(goMemoryClassesMetadataMCacheInuseBytes)
+	ms.MCacheSys = ms.MCacheInuse + lookupOrZero(goMemoryClassesMetadataMCacheFreeBytes)
+	ms.BuckHashSys = lookupOrZero(goMemoryClassesProfilingBucketsBytes)
+	ms.GCSys = lookupOrZero(goMemoryClassesMetadataOtherBytes)
+	ms.OtherSys = lookupOrZero(goMemoryClassesOtherBytes)
+	ms.NextGC = lookupOrZero(goGCHeapGoalBytes)
+
+	// N.B. GCCPUFraction is intentionally omitted. This metric is not useful,
+	// and often misleading due to the fact that it's an average over the lifetime
+	// of the process.
+	// See https://github.com/prometheus/client_golang/issues/842#issuecomment-861812034
+	// for more details.
+	ms.GCCPUFraction = 0
+}
+
+// batchHistogram is a mutable histogram that is updated
+// in batches.
+type batchHistogram struct {
+	selfCollector
+
+	// Static fields updated only once.
+	desc   *Desc
+	hasSum bool
+
+	// Because this histogram operates in batches, it just uses a
+	// single mutex for everything. updates are always serialized
+	// but Write calls may operate concurrently with updates.
+	// Contention between these two sources should be rare.
+	mu      sync.Mutex
+	buckets []float64 // Inclusive lower bounds, like runtime/metrics.
+	counts  []uint64
+	sum     float64 // Used if hasSum is true.
+}
+
+// newBatchHistogram creates a new batch histogram value with the given
+// Desc, buckets, and whether or not it has an exact sum available.
+//
+// buckets must always be from the runtime/metrics package, following
+// the same conventions.
+func newBatchHistogram(desc *Desc, buckets []float64, hasSum bool) *batchHistogram {
+	// We need to remove -Inf values. runtime/metrics keeps them around.
+	// But -Inf bucket should not be allowed for prometheus histograms.
+	if buckets[0] == math.Inf(-1) {
+		buckets = buckets[1:]
+	}
+	h := &batchHistogram{
+		desc:    desc,
+		buckets: buckets,
+		// Because buckets follows runtime/metrics conventions, there's
+		// 1 more value in the buckets list than there are buckets represented,
+		// because in runtime/metrics, the bucket values represent *boundaries*,
+		// and non-Inf boundaries are inclusive lower bounds for that bucket.
+		counts: make([]uint64, len(buckets)-1),
+		hasSum: hasSum,
+	}
+	h.init(h)
+	return h
+}
+
+// update updates the batchHistogram from a runtime/metrics histogram.
+//
+// sum must be provided if the batchHistogram was created to have an exact sum.
+// h.buckets must be a strict subset of his.Buckets.
+func (h *batchHistogram) update(his *metrics.Float64Histogram, sum float64) {
+	counts, buckets := his.Counts, his.Buckets
+
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	// Clear buckets.
+	for i := range h.counts {
+		h.counts[i] = 0
+	}
+	// Copy and reduce buckets.
+	var j int
+	for i, count := range counts {
+		h.counts[j] += count
+		if buckets[i+1] == h.buckets[j+1] {
+			j++
+		}
+	}
+	if h.hasSum {
+		h.sum = sum
+	}
+}
+
+func (h *batchHistogram) Desc() *Desc {
+	return h.desc
+}
+
+func (h *batchHistogram) Write(out *dto.Metric) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	sum := float64(0)
+	if h.hasSum {
+		sum = h.sum
+	}
+	dtoBuckets := make([]*dto.Bucket, 0, len(h.counts))
+	totalCount := uint64(0)
+	for i, count := range h.counts {
+		totalCount += count
+		if !h.hasSum {
+			if count != 0 {
+				// N.B. This computed sum is an underestimate.
+				sum += h.buckets[i] * float64(count)
+			}
+		}
+
+		// Skip the +Inf bucket, but only for the bucket list.
+		// It must still count for sum and totalCount.
+		if math.IsInf(h.buckets[i+1], 1) {
+			break
+		}
+		// Float64Histogram's upper bound is exclusive, so make it inclusive
+		// by obtaining the next float64 value down, in order.
+		upperBound := math.Nextafter(h.buckets[i+1], h.buckets[i])
+		dtoBuckets = append(dtoBuckets, &dto.Bucket{
+			CumulativeCount: proto.Uint64(totalCount),
+			UpperBound:      proto.Float64(upperBound),
+		})
+	}
+	out.Histogram = &dto.Histogram{
+		Bucket:      dtoBuckets,
+		SampleCount: proto.Uint64(totalCount),
+		SampleSum:   proto.Float64(sum),
+	}
+	return nil
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/histogram.go b/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
index 8425640b39..5b69965b25 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
@@ -22,25 +22,221 @@ import (
 	"sync/atomic"
 	"time"
 
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
-
 	dto "github.com/prometheus/client_model/go"
+
+	"google.golang.org/protobuf/proto"
 )
 
+// nativeHistogramBounds for the frac of observed values. Only relevant for
+// schema > 0. The position in the slice is the schema. (0 is never used, just
+// here for convenience of using the schema directly as the index.)
+//
+// TODO(beorn7): Currently, we do a binary search into these slices. There are
+// ways to turn it into a small number of simple array lookups. It probably only
+// matters for schema 5 and beyond, but should be investigated. See this comment
+// as a starting point:
+// https://github.com/open-telemetry/opentelemetry-specification/issues/1776#issuecomment-870164310
+var nativeHistogramBounds = [][]float64{
+	// Schema "0":
+	{0.5},
+	// Schema 1:
+	{0.5, 0.7071067811865475},
+	// Schema 2:
+	{0.5, 0.5946035575013605, 0.7071067811865475, 0.8408964152537144},
+	// Schema 3:
+	{
+		0.5, 0.5452538663326288, 0.5946035575013605, 0.6484197773255048,
+		0.7071067811865475, 0.7711054127039704, 0.8408964152537144, 0.9170040432046711,
+	},
+	// Schema 4:
+	{
+		0.5, 0.5221368912137069, 0.5452538663326288, 0.5693943173783458,
+		0.5946035575013605, 0.620928906036742, 0.6484197773255048, 0.6771277734684463,
+		0.7071067811865475, 0.7384130729697496, 0.7711054127039704, 0.805245165974627,
+		0.8408964152537144, 0.8781260801866495, 0.9170040432046711, 0.9576032806985735,
+	},
+	// Schema 5:
+	{
+		0.5, 0.5109485743270583, 0.5221368912137069, 0.5335702003384117,
+		0.5452538663326288, 0.5571933712979462, 0.5693943173783458, 0.5818624293887887,
+		0.5946035575013605, 0.6076236799902344, 0.620928906036742, 0.6345254785958666,
+		0.6484197773255048, 0.6626183215798706, 0.6771277734684463, 0.6919549409819159,
+		0.7071067811865475, 0.7225904034885232, 0.7384130729697496, 0.7545822137967112,
+		0.7711054127039704, 0.7879904225539431, 0.805245165974627, 0.8228777390769823,
+		0.8408964152537144, 0.8593096490612387, 0.8781260801866495, 0.8973545375015533,
+		0.9170040432046711, 0.9370838170551498, 0.9576032806985735, 0.9785720620876999,
+	},
+	// Schema 6:
+	{
+		0.5, 0.5054446430258502, 0.5109485743270583, 0.5165124395106142,
+		0.5221368912137069, 0.5278225891802786, 0.5335702003384117, 0.5393803988785598,
+		0.5452538663326288, 0.5511912916539204, 0.5571933712979462, 0.5632608093041209,
+		0.5693943173783458, 0.5755946149764913, 0.5818624293887887, 0.5881984958251406,
+		0.5946035575013605, 0.6010783657263515, 0.6076236799902344, 0.6142402680534349,
+		0.620928906036742, 0.6276903785123455, 0.6345254785958666, 0.6414350080393891,
+		0.6484197773255048, 0.6554806057623822, 0.6626183215798706, 0.6698337620266515,
+		0.6771277734684463, 0.6845012114872953, 0.6919549409819159, 0.6994898362691555,
+		0.7071067811865475, 0.7148066691959849, 0.7225904034885232, 0.7304588970903234,
+		0.7384130729697496, 0.7464538641456323, 0.7545822137967112, 0.762799075372269,
+		0.7711054127039704, 0.7795022001189185, 0.7879904225539431, 0.7965710756711334,
+		0.805245165974627, 0.8140137109286738, 0.8228777390769823, 0.8318382901633681,
+		0.8408964152537144, 0.8500531768592616, 0.8593096490612387, 0.8686669176368529,
+		0.8781260801866495, 0.8876882462632604, 0.8973545375015533, 0.9071260877501991,
+		0.9170040432046711, 0.9269895625416926, 0.9370838170551498, 0.9472879907934827,
+		0.9576032806985735, 0.9680308967461471, 0.9785720620876999, 0.9892280131939752,
+	},
+	// Schema 7:
+	{
+		0.5, 0.5027149505564014, 0.5054446430258502, 0.5081891574554764,
+		0.5109485743270583, 0.5137229745593818, 0.5165124395106142, 0.5193170509806894,
+		0.5221368912137069, 0.5249720429003435, 0.5278225891802786, 0.5306886136446309,
+		0.5335702003384117, 0.5364674337629877, 0.5393803988785598, 0.5423091811066545,
+		0.5452538663326288, 0.5482145409081883, 0.5511912916539204, 0.5541842058618393,
+		0.5571933712979462, 0.5602188762048033, 0.5632608093041209, 0.5663192597993595,
+		0.5693943173783458, 0.572486072215902, 0.5755946149764913, 0.5787200368168754,
+		0.5818624293887887, 0.585021884841625, 0.5881984958251406, 0.5913923554921704,
+		0.5946035575013605, 0.5978321960199137, 0.6010783657263515, 0.6043421618132907,
+		0.6076236799902344, 0.6109230164863786, 0.6142402680534349, 0.6175755319684665,
+		0.620928906036742, 0.6243004885946023, 0.6276903785123455, 0.6310986751971253,
+		0.6345254785958666, 0.637970889198196, 0.6414350080393891, 0.6449179367033329,
+		0.6484197773255048, 0.6519406325959679, 0.6554806057623822, 0.659039800633032,
+		0.6626183215798706, 0.6662162735415805, 0.6698337620266515, 0.6734708931164728,
+		0.6771277734684463, 0.6808045103191123, 0.6845012114872953, 0.688217985377265,
+		0.6919549409819159, 0.6957121878859629, 0.6994898362691555, 0.7032879969095076,
+		0.7071067811865475, 0.7109463010845827, 0.7148066691959849, 0.718687998724491,
+		0.7225904034885232, 0.7265139979245261, 0.7304588970903234, 0.7344252166684908,
+		0.7384130729697496, 0.7424225829363761, 0.7464538641456323, 0.7505070348132126,
+		0.7545822137967112, 0.7586795205991071, 0.762799075372269, 0.7669409989204777,
+		0.7711054127039704, 0.7752924388424999, 0.7795022001189185, 0.7837348199827764,
+		0.7879904225539431, 0.7922691326262467, 0.7965710756711334, 0.8008963778413465,
+		0.805245165974627, 0.8096175675974316, 0.8140137109286738, 0.8184337248834821,
+		0.8228777390769823, 0.8273458838280969, 0.8318382901633681, 0.8363550898207981,
+		0.8408964152537144, 0.8454623996346523, 0.8500531768592616, 0.8546688815502312,
+		0.8593096490612387, 0.8639756154809185, 0.8686669176368529, 0.8733836930995842,
+		0.8781260801866495, 0.8828942179666361, 0.8876882462632604, 0.8925083056594671,
+		0.8973545375015533, 0.9022270839033115, 0.9071260877501991, 0.9120516927035263,
+		0.9170040432046711, 0.9219832844793128, 0.9269895625416926, 0.9320230241988943,
+		0.9370838170551498, 0.9421720895161669, 0.9472879907934827, 0.9524316709088368,
+		0.9576032806985735, 0.9628029718180622, 0.9680308967461471, 0.9732872087896164,
+		0.9785720620876999, 0.9838856116165875, 0.9892280131939752, 0.9945994234836328,
+	},
+	// Schema 8:
+	{
+		0.5, 0.5013556375251013, 0.5027149505564014, 0.5040779490592088,
+		0.5054446430258502, 0.5068150424757447, 0.5081891574554764, 0.509566998038869,
+		0.5109485743270583, 0.5123338964485679, 0.5137229745593818, 0.5151158188430205,
+		0.5165124395106142, 0.5179128468009786, 0.5193170509806894, 0.520725062344158,
+		0.5221368912137069, 0.5235525479396449, 0.5249720429003435, 0.526395386502313,
+		0.5278225891802786, 0.5292536613972564, 0.5306886136446309, 0.5321274564422321,
+		0.5335702003384117, 0.5350168559101208, 0.5364674337629877, 0.5379219445313954,
+		0.5393803988785598, 0.5408428074966075, 0.5423091811066545, 0.5437795304588847,
+		0.5452538663326288, 0.5467321995364429, 0.5482145409081883, 0.549700901315111,
+		0.5511912916539204, 0.5526857228508706, 0.5541842058618393, 0.5556867516724088,
+		0.5571933712979462, 0.5587040757836845, 0.5602188762048033, 0.5617377836665098,
+		0.5632608093041209, 0.564787964283144, 0.5663192597993595, 0.5678547070789026,
+		0.5693943173783458, 0.5709381019847808, 0.572486072215902, 0.5740382394200894,
+		0.5755946149764913, 0.5771552102951081, 0.5787200368168754, 0.5802891060137493,
+		0.5818624293887887, 0.5834400184762408, 0.585021884841625, 0.5866080400818185,
+		0.5881984958251406, 0.5897932637314379, 0.5913923554921704, 0.5929957828304968,
+		0.5946035575013605, 0.5962156912915756, 0.5978321960199137, 0.5994530835371903,
+		0.6010783657263515, 0.6027080545025619, 0.6043421618132907, 0.6059806996384005,
+		0.6076236799902344, 0.6092711149137041, 0.6109230164863786, 0.6125793968185725,
+		0.6142402680534349, 0.6159056423670379, 0.6175755319684665, 0.6192499490999082,
+		0.620928906036742, 0.622612415087629, 0.6243004885946023, 0.6259931389331581,
+		0.6276903785123455, 0.6293922197748583, 0.6310986751971253, 0.6328097572894031,
+		0.6345254785958666, 0.6362458516947014, 0.637970889198196, 0.6397006037528346,
+		0.6414350080393891, 0.6431741147730128, 0.6449179367033329, 0.6466664866145447,
+		0.6484197773255048, 0.6501778216898253, 0.6519406325959679, 0.6537082229673385,
+		0.6554806057623822, 0.6572577939746774, 0.659039800633032, 0.6608266388015788,
+		0.6626183215798706, 0.6644148621029772, 0.6662162735415805, 0.6680225691020727,
+		0.6698337620266515, 0.6716498655934177, 0.6734708931164728, 0.6752968579460171,
+		0.6771277734684463, 0.6789636531064505, 0.6808045103191123, 0.6826503586020058,
+		0.6845012114872953, 0.6863570825438342, 0.688217985377265, 0.690083933630119,
+		0.6919549409819159, 0.6938310211492645, 0.6957121878859629, 0.6975984549830999,
+		0.6994898362691555, 0.7013863456101023, 0.7032879969095076, 0.7051948041086352,
+		0.7071067811865475, 0.7090239421602076, 0.7109463010845827, 0.7128738720527471,
+		0.7148066691959849, 0.7167447066838943, 0.718687998724491, 0.7206365595643126,
+		0.7225904034885232, 0.7245495448210174, 0.7265139979245261, 0.7284837772007218,
+		0.7304588970903234, 0.7324393720732029, 0.7344252166684908, 0.7364164454346837,
+		0.7384130729697496, 0.7404151139112358, 0.7424225829363761, 0.7444354947621984,
+		0.7464538641456323, 0.7484777058836176, 0.7505070348132126, 0.7525418658117031,
+		0.7545822137967112, 0.7566280937263048, 0.7586795205991071, 0.7607365094544071,
+		0.762799075372269, 0.7648672334736434, 0.7669409989204777, 0.7690203869158282,
+		0.7711054127039704, 0.7731960915705107, 0.7752924388424999, 0.7773944698885442,
+		0.7795022001189185, 0.7816156449856788, 0.7837348199827764, 0.7858597406461707,
+		0.7879904225539431, 0.7901268813264122, 0.7922691326262467, 0.7944171921585818,
+		0.7965710756711334, 0.7987307989543135, 0.8008963778413465, 0.8030678282083853,
+		0.805245165974627, 0.8074284071024302, 0.8096175675974316, 0.8118126635086642,
+		0.8140137109286738, 0.8162207259936375, 0.8184337248834821, 0.820652723822003,
+		0.8228777390769823, 0.8251087869603088, 0.8273458838280969, 0.8295890460808079,
+		0.8318382901633681, 0.8340936325652911, 0.8363550898207981, 0.8386226785089391,
+		0.8408964152537144, 0.8431763167241966, 0.8454623996346523, 0.8477546807446661,
+		0.8500531768592616, 0.8523579048290255, 0.8546688815502312, 0.8569861239649629,
+		0.8593096490612387, 0.8616394738731368, 0.8639756154809185, 0.8663180910111553,
+		0.8686669176368529, 0.871022112577578, 0.8733836930995842, 0.8757516765159389,
+		0.8781260801866495, 0.8805069215187917, 0.8828942179666361, 0.8852879870317771,
+		0.8876882462632604, 0.890095013257712, 0.8925083056594671, 0.8949281411607002,
+		0.8973545375015533, 0.8997875124702672, 0.9022270839033115, 0.9046732696855155,
+		0.9071260877501991, 0.909585556079304, 0.9120516927035263, 0.9145245157024483,
+		0.9170040432046711, 0.9194902933879467, 0.9219832844793128, 0.9244830347552253,
+		0.9269895625416926, 0.92950288621441, 0.9320230241988943, 0.9345499949706191,
+		0.9370838170551498, 0.93962450902828, 0.9421720895161669, 0.9447265771954693,
+		0.9472879907934827, 0.9498563490882775, 0.9524316709088368, 0.9550139751351947,
+		0.9576032806985735, 0.9601996065815236, 0.9628029718180622, 0.9654133954938133,
+		0.9680308967461471, 0.9706554947643201, 0.9732872087896164, 0.9759260581154889,
+		0.9785720620876999, 0.9812252401044634, 0.9838856116165875, 0.9865531961276168,
+		0.9892280131939752, 0.9919100824251095, 0.9945994234836328, 0.9972960560854698,
+	},
+}
+
+// The nativeHistogramBounds above can be generated with the code below.
+//
+// TODO(beorn7): It's tempting to actually use `go generate` to generate the
+// code above. However, this could lead to slightly different numbers on
+// different architectures. We still need to come to terms if we are fine with
+// that, or if we might prefer to specify precise numbers in the standard.
+//
+// var nativeHistogramBounds [][]float64 = make([][]float64, 9)
+//
+// func init() {
+// 	// Populate nativeHistogramBounds.
+// 	numBuckets := 1
+// 	for i := range nativeHistogramBounds {
+// 		bounds := []float64{0.5}
+// 		factor := math.Exp2(math.Exp2(float64(-i)))
+// 		for j := 0; j < numBuckets-1; j++ {
+// 			var bound float64
+// 			if (j+1)%2 == 0 {
+// 				// Use previously calculated value for increased precision.
+// 				bound = nativeHistogramBounds[i-1][j/2+1]
+// 			} else {
+// 				bound = bounds[j] * factor
+// 			}
+// 			bounds = append(bounds, bound)
+// 		}
+// 		numBuckets *= 2
+// 		nativeHistogramBounds[i] = bounds
+// 	}
+// }
+
 // A Histogram counts individual observations from an event or sample stream in
-// configurable buckets. Similar to a summary, it also provides a sum of
-// observations and an observation count.
+// configurable static buckets (or in dynamic sparse buckets as part of the
+// experimental Native Histograms, see below for more details). Similar to a
+// Summary, it also provides a sum of observations and an observation count.
 //
 // On the Prometheus server, quantiles can be calculated from a Histogram using
-// the histogram_quantile function in the query language.
+// the histogram_quantile PromQL function.
 //
-// Note that Histograms, in contrast to Summaries, can be aggregated with the
-// Prometheus query language (see the documentation for detailed
-// procedures). However, Histograms require the user to pre-define suitable
-// buckets, and they are in general less accurate. The Observe method of a
-// Histogram has a very low performance overhead in comparison with the Observe
-// method of a Summary.
+// Note that Histograms, in contrast to Summaries, can be aggregated in PromQL
+// (see the documentation for detailed procedures). However, Histograms require
+// the user to pre-define suitable buckets, and they are in general less
+// accurate. (Both problems are addressed by the experimental Native
+// Histograms. To use them, configure a NativeHistogramBucketFactor in the
+// HistogramOpts. They also require a Prometheus server v2.40+ with the
+// corresponding feature flag enabled.)
+//
+// The Observe method of a Histogram has a very low performance overhead in
+// comparison with the Observe method of a Summary.
 //
 // To create Histogram instances, use NewHistogram.
 type Histogram interface {
@@ -50,7 +246,8 @@ type Histogram interface {
 	// Observe adds a single observation to the histogram. Observations are
 	// usually positive or zero. Negative observations are accepted but
 	// prevent current versions of Prometheus from properly detecting
-	// counter resets in the sum of observations. See
+	// counter resets in the sum of observations. (The experimental Native
+	// Histograms handle negative observations properly.) See
 	// https://prometheus.io/docs/practices/histograms/#count-and-sum-of-observations
 	// for details.
 	Observe(float64)
@@ -64,18 +261,28 @@ const bucketLabel = "le"
 // tailored to broadly measure the response time (in seconds) of a network
 // service. Most likely, however, you will be required to define buckets
 // customized to your use case.
-var (
-	DefBuckets = []float64{.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10}
+var DefBuckets = []float64{.005, .01, .025, .05, .1, .25, .5, 1, 2.5, 5, 10}
 
-	errBucketLabelNotAllowed = fmt.Errorf(
-		"%q is not allowed as label name in histograms", bucketLabel,
-	)
+// DefNativeHistogramZeroThreshold is the default value for
+// NativeHistogramZeroThreshold in the HistogramOpts.
+//
+// The value is 2^-128 (or 0.5*2^-127 in the actual IEEE 754 representation),
+// which is a bucket boundary at all possible resolutions.
+const DefNativeHistogramZeroThreshold = 2.938735877055719e-39
+
+// NativeHistogramZeroThresholdZero can be used as NativeHistogramZeroThreshold
+// in the HistogramOpts to create a zero bucket of width zero, i.e. a zero
+// bucket that only receives observations of precisely zero.
+const NativeHistogramZeroThresholdZero = -1
+
+var errBucketLabelNotAllowed = fmt.Errorf(
+	"%q is not allowed as label name in histograms", bucketLabel,
 )
 
-// LinearBuckets creates 'count' buckets, each 'width' wide, where the lowest
-// bucket has an upper bound of 'start'. The final +Inf bucket is not counted
-// and not included in the returned slice. The returned slice is meant to be
-// used for the Buckets field of HistogramOpts.
+// LinearBuckets creates 'count' regular buckets, each 'width' wide, where the
+// lowest bucket has an upper bound of 'start'. The final +Inf bucket is not
+// counted and not included in the returned slice. The returned slice is meant
+// to be used for the Buckets field of HistogramOpts.
 //
 // The function panics if 'count' is zero or negative.
 func LinearBuckets(start, width float64, count int) []float64 {
@@ -90,11 +297,11 @@ func LinearBuckets(start, width float64, count int) []float64 {
 	return buckets
 }
 
-// ExponentialBuckets creates 'count' buckets, where the lowest bucket has an
-// upper bound of 'start' and each following bucket's upper bound is 'factor'
-// times the previous bucket's upper bound. The final +Inf bucket is not counted
-// and not included in the returned slice. The returned slice is meant to be
-// used for the Buckets field of HistogramOpts.
+// ExponentialBuckets creates 'count' regular buckets, where the lowest bucket
+// has an upper bound of 'start' and each following bucket's upper bound is
+// 'factor' times the previous bucket's upper bound. The final +Inf bucket is
+// not counted and not included in the returned slice. The returned slice is
+// meant to be used for the Buckets field of HistogramOpts.
 //
 // The function panics if 'count' is 0 or negative, if 'start' is 0 or negative,
 // or if 'factor' is less than or equal 1.
@@ -116,6 +323,34 @@ func ExponentialBuckets(start, factor float64, count int) []float64 {
 	return buckets
 }
 
+// ExponentialBucketsRange creates 'count' buckets, where the lowest bucket is
+// 'min' and the highest bucket is 'max'. The final +Inf bucket is not counted
+// and not included in the returned slice. The returned slice is meant to be
+// used for the Buckets field of HistogramOpts.
+//
+// The function panics if 'count' is 0 or negative, if 'min' is 0 or negative.
+func ExponentialBucketsRange(min, max float64, count int) []float64 {
+	if count < 1 {
+		panic("ExponentialBucketsRange count needs a positive count")
+	}
+	if min <= 0 {
+		panic("ExponentialBucketsRange min needs to be greater than 0")
+	}
+
+	// Formula for exponential buckets.
+	// max = min*growthFactor^(bucketCount-1)
+
+	// We know max/min and highest bucket. Solve for growthFactor.
+	growthFactor := math.Pow(max/min, 1.0/float64(count-1))
+
+	// Now that we know growthFactor, solve for each bucket.
+	buckets := make([]float64, count)
+	for i := 1; i <= count; i++ {
+		buckets[i-1] = min * math.Pow(growthFactor, float64(i-1))
+	}
+	return buckets
+}
+
 // HistogramOpts bundles the options for creating a Histogram metric. It is
 // mandatory to set Name to a non-empty string. All other fields are optional
 // and can safely be left at their zero value, although it is strongly
@@ -152,8 +387,97 @@ type HistogramOpts struct {
 	// element in the slice is the upper inclusive bound of a bucket. The
 	// values must be sorted in strictly increasing order. There is no need
 	// to add a highest bucket with +Inf bound, it will be added
-	// implicitly. The default value is DefBuckets.
+	// implicitly. If Buckets is left as nil or set to a slice of length
+	// zero, it is replaced by default buckets. The default buckets are
+	// DefBuckets if no buckets for a native histogram (see below) are used,
+	// otherwise the default is no buckets. (In other words, if you want to
+	// use both reguler buckets and buckets for a native histogram, you have
+	// to define the regular buckets here explicitly.)
 	Buckets []float64
+
+	// If NativeHistogramBucketFactor is greater than one, so-called sparse
+	// buckets are used (in addition to the regular buckets, if defined
+	// above). A Histogram with sparse buckets will be ingested as a Native
+	// Histogram by a Prometheus server with that feature enabled (requires
+	// Prometheus v2.40+). Sparse buckets are exponential buckets covering
+	// the whole float64 range (with the exception of the “zero” bucket, see
+	// SparseBucketsZeroThreshold below). From any one bucket to the next,
+	// the width of the bucket grows by a constant
+	// factor. NativeHistogramBucketFactor provides an upper bound for this
+	// factor (exception see below). The smaller
+	// NativeHistogramBucketFactor, the more buckets will be used and thus
+	// the more costly the histogram will become. A generally good trade-off
+	// between cost and accuracy is a value of 1.1 (each bucket is at most
+	// 10% wider than the previous one), which will result in each power of
+	// two divided into 8 buckets (e.g. there will be 8 buckets between 1
+	// and 2, same as between 2 and 4, and 4 and 8, etc.).
+	//
+	// Details about the actually used factor: The factor is calculated as
+	// 2^(2^n), where n is an integer number between (and including) -8 and
+	// 4. n is chosen so that the resulting factor is the largest that is
+	// still smaller or equal to NativeHistogramBucketFactor. Note that the
+	// smallest possible factor is therefore approx. 1.00271 (i.e. 2^(2^-8)
+	// ). If NativeHistogramBucketFactor is greater than 1 but smaller than
+	// 2^(2^-8), then the actually used factor is still 2^(2^-8) even though
+	// it is larger than the provided NativeHistogramBucketFactor.
+	//
+	// NOTE: Native Histograms are still an experimental feature. Their
+	// behavior might still change without a major version
+	// bump. Subsequently, all NativeHistogram... options here might still
+	// change their behavior or name (or might completely disappear) without
+	// a major version bump.
+	NativeHistogramBucketFactor float64
+	// All observations with an absolute value of less or equal
+	// NativeHistogramZeroThreshold are accumulated into a “zero”
+	// bucket. For best results, this should be close to a bucket
+	// boundary. This is usually the case if picking a power of two. If
+	// NativeHistogramZeroThreshold is left at zero,
+	// DefSparseBucketsZeroThreshold is used as the threshold. To configure
+	// a zero bucket with an actual threshold of zero (i.e. only
+	// observations of precisely zero will go into the zero bucket), set
+	// NativeHistogramZeroThreshold to the NativeHistogramZeroThresholdZero
+	// constant (or any negative float value).
+	NativeHistogramZeroThreshold float64
+
+	// The remaining fields define a strategy to limit the number of
+	// populated sparse buckets. If NativeHistogramMaxBucketNumber is left
+	// at zero, the number of buckets is not limited. (Note that this might
+	// lead to unbounded memory consumption if the values observed by the
+	// Histogram are sufficiently wide-spread. In particular, this could be
+	// used as a DoS attack vector. Where the observed values depend on
+	// external inputs, it is highly recommended to set a
+	// NativeHistogramMaxBucketNumber.)  Once the set
+	// NativeHistogramMaxBucketNumber is exceeded, the following strategy is
+	// enacted: First, if the last reset (or the creation) of the histogram
+	// is at least NativeHistogramMinResetDuration ago, then the whole
+	// histogram is reset to its initial state (including regular
+	// buckets). If less time has passed, or if
+	// NativeHistogramMinResetDuration is zero, no reset is
+	// performed. Instead, the zero threshold is increased sufficiently to
+	// reduce the number of buckets to or below
+	// NativeHistogramMaxBucketNumber, but not to more than
+	// NativeHistogramMaxZeroThreshold. Thus, if
+	// NativeHistogramMaxZeroThreshold is already at or below the current
+	// zero threshold, nothing happens at this step. After that, if the
+	// number of buckets still exceeds NativeHistogramMaxBucketNumber, the
+	// resolution of the histogram is reduced by doubling the width of the
+	// sparse buckets (up to a growth factor between one bucket to the next
+	// of 2^(2^4) = 65536, see above).
+	NativeHistogramMaxBucketNumber  uint32
+	NativeHistogramMinResetDuration time.Duration
+	NativeHistogramMaxZeroThreshold float64
+}
+
+// HistogramVecOpts bundles the options to create a HistogramVec metric.
+// It is mandatory to set HistogramOpts, see there for mandatory fields. VariableLabels
+// is optional and can safely be left to its default value.
+type HistogramVecOpts struct {
+	HistogramOpts
+
+	// VariableLabels are used to partition the metric vector by the given set
+	// of labels. Each label value will be constrained with the optional Contraint
+	// function, if provided.
+	VariableLabels ConstrainableLabels
 }
 
 // NewHistogram creates a new Histogram based on the provided HistogramOpts. It
@@ -176,11 +500,11 @@ func NewHistogram(opts HistogramOpts) Histogram {
 
 func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogram {
 	if len(desc.variableLabels) != len(labelValues) {
-		panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, labelValues))
+		panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), labelValues))
 	}
 
 	for _, n := range desc.variableLabels {
-		if n == bucketLabel {
+		if n.Name == bucketLabel {
 			panic(errBucketLabelNotAllowed)
 		}
 	}
@@ -190,16 +514,29 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
 		}
 	}
 
-	if len(opts.Buckets) == 0 {
-		opts.Buckets = DefBuckets
-	}
-
 	h := &histogram{
-		desc:        desc,
-		upperBounds: opts.Buckets,
-		labelPairs:  MakeLabelPairs(desc, labelValues),
-		counts:      [2]*histogramCounts{{}, {}},
-		now:         time.Now,
+		desc:                            desc,
+		upperBounds:                     opts.Buckets,
+		labelPairs:                      MakeLabelPairs(desc, labelValues),
+		nativeHistogramMaxBuckets:       opts.NativeHistogramMaxBucketNumber,
+		nativeHistogramMaxZeroThreshold: opts.NativeHistogramMaxZeroThreshold,
+		nativeHistogramMinResetDuration: opts.NativeHistogramMinResetDuration,
+		lastResetTime:                   time.Now(),
+		now:                             time.Now,
+	}
+	if len(h.upperBounds) == 0 && opts.NativeHistogramBucketFactor <= 1 {
+		h.upperBounds = DefBuckets
+	}
+	if opts.NativeHistogramBucketFactor <= 1 {
+		h.nativeHistogramSchema = math.MinInt32 // To mark that there are no sparse buckets.
+	} else {
+		switch {
+		case opts.NativeHistogramZeroThreshold > 0:
+			h.nativeHistogramZeroThreshold = opts.NativeHistogramZeroThreshold
+		case opts.NativeHistogramZeroThreshold == 0:
+			h.nativeHistogramZeroThreshold = DefNativeHistogramZeroThreshold
+		} // Leave h.nativeHistogramZeroThreshold at 0 otherwise.
+		h.nativeHistogramSchema = pickSchema(opts.NativeHistogramBucketFactor)
 	}
 	for i, upperBound := range h.upperBounds {
 		if i < len(h.upperBounds)-1 {
@@ -218,8 +555,12 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
 	}
 	// Finally we know the final length of h.upperBounds and can make buckets
 	// for both counts as well as exemplars:
-	h.counts[0].buckets = make([]uint64, len(h.upperBounds))
-	h.counts[1].buckets = make([]uint64, len(h.upperBounds))
+	h.counts[0] = &histogramCounts{buckets: make([]uint64, len(h.upperBounds))}
+	atomic.StoreUint64(&h.counts[0].nativeHistogramZeroThresholdBits, math.Float64bits(h.nativeHistogramZeroThreshold))
+	atomic.StoreInt32(&h.counts[0].nativeHistogramSchema, h.nativeHistogramSchema)
+	h.counts[1] = &histogramCounts{buckets: make([]uint64, len(h.upperBounds))}
+	atomic.StoreUint64(&h.counts[1].nativeHistogramZeroThresholdBits, math.Float64bits(h.nativeHistogramZeroThreshold))
+	atomic.StoreInt32(&h.counts[1].nativeHistogramSchema, h.nativeHistogramSchema)
 	h.exemplars = make([]atomic.Value, len(h.upperBounds)+1)
 
 	h.init(h) // Init self-collection.
@@ -227,13 +568,98 @@ func newHistogram(desc *Desc, opts HistogramOpts, labelValues ...string) Histogr
 }
 
 type histogramCounts struct {
+	// Order in this struct matters for the alignment required by atomic
+	// operations, see http://golang.org/pkg/sync/atomic/#pkg-note-BUG
+
 	// sumBits contains the bits of the float64 representing the sum of all
-	// observations. sumBits and count have to go first in the struct to
-	// guarantee alignment for atomic operations.
-	// http://golang.org/pkg/sync/atomic/#pkg-note-BUG
+	// observations.
 	sumBits uint64
 	count   uint64
+
+	// nativeHistogramZeroBucket counts all (positive and negative)
+	// observations in the zero bucket (with an absolute value less or equal
+	// the current threshold, see next field.
+	nativeHistogramZeroBucket uint64
+	// nativeHistogramZeroThresholdBits is the bit pattern of the current
+	// threshold for the zero bucket. It's initially equal to
+	// nativeHistogramZeroThreshold but may change according to the bucket
+	// count limitation strategy.
+	nativeHistogramZeroThresholdBits uint64
+	// nativeHistogramSchema may change over time according to the bucket
+	// count limitation strategy and therefore has to be saved here.
+	nativeHistogramSchema int32
+	// Number of (positive and negative) sparse buckets.
+	nativeHistogramBucketsNumber uint32
+
+	// Regular buckets.
 	buckets []uint64
+
+	// The sparse buckets for native histograms are implemented with a
+	// sync.Map for now. A dedicated data structure will likely be more
+	// efficient. There are separate maps for negative and positive
+	// observations. The map's value is an *int64, counting observations in
+	// that bucket. (Note that we don't use uint64 as an int64 won't
+	// overflow in practice, and working with signed numbers from the
+	// beginning simplifies the handling of deltas.) The map's key is the
+	// index of the bucket according to the used
+	// nativeHistogramSchema. Index 0 is for an upper bound of 1.
+	nativeHistogramBucketsPositive, nativeHistogramBucketsNegative sync.Map
+}
+
+// observe manages the parts of observe that only affects
+// histogramCounts. doSparse is true if sparse buckets should be done,
+// too.
+func (hc *histogramCounts) observe(v float64, bucket int, doSparse bool) {
+	if bucket < len(hc.buckets) {
+		atomic.AddUint64(&hc.buckets[bucket], 1)
+	}
+	atomicAddFloat(&hc.sumBits, v)
+	if doSparse && !math.IsNaN(v) {
+		var (
+			key                  int
+			schema               = atomic.LoadInt32(&hc.nativeHistogramSchema)
+			zeroThreshold        = math.Float64frombits(atomic.LoadUint64(&hc.nativeHistogramZeroThresholdBits))
+			bucketCreated, isInf bool
+		)
+		if math.IsInf(v, 0) {
+			// Pretend v is MaxFloat64 but later increment key by one.
+			if math.IsInf(v, +1) {
+				v = math.MaxFloat64
+			} else {
+				v = -math.MaxFloat64
+			}
+			isInf = true
+		}
+		frac, exp := math.Frexp(math.Abs(v))
+		if schema > 0 {
+			bounds := nativeHistogramBounds[schema]
+			key = sort.SearchFloat64s(bounds, frac) + (exp-1)*len(bounds)
+		} else {
+			key = exp
+			if frac == 0.5 {
+				key--
+			}
+			div := 1 << -schema
+			key = (key + div - 1) / div
+		}
+		if isInf {
+			key++
+		}
+		switch {
+		case v > zeroThreshold:
+			bucketCreated = addToBucket(&hc.nativeHistogramBucketsPositive, key, 1)
+		case v < -zeroThreshold:
+			bucketCreated = addToBucket(&hc.nativeHistogramBucketsNegative, key, 1)
+		default:
+			atomic.AddUint64(&hc.nativeHistogramZeroBucket, 1)
+		}
+		if bucketCreated {
+			atomic.AddUint32(&hc.nativeHistogramBucketsNumber, 1)
+		}
+	}
+	// Increment count last as we take it as a signal that the observation
+	// is complete.
+	atomic.AddUint64(&hc.count, 1)
 }
 
 type histogram struct {
@@ -248,7 +674,7 @@ type histogram struct {
 	// perspective of the histogram) swap the hot–cold under the writeMtx
 	// lock. A cooldown is awaited (while locked) by comparing the number of
 	// observations with the initiation count. Once they match, then the
-	// last observation on the now cool one has completed. All cool fields must
+	// last observation on the now cool one has completed. All cold fields must
 	// be merged into the new hot before releasing writeMtx.
 	//
 	// Fields with atomic access first! See alignment constraint:
@@ -256,8 +682,10 @@ type histogram struct {
 	countAndHotIdx uint64
 
 	selfCollector
-	desc     *Desc
-	writeMtx sync.Mutex // Only used in the Write method.
+	desc *Desc
+
+	// Only used in the Write method and for sparse bucket management.
+	mtx sync.Mutex
 
 	// Two counts, one is "hot" for lock-free observations, the other is
 	// "cold" for writing out a dto.Metric. It has to be an array of
@@ -265,9 +693,15 @@ type histogram struct {
 	// http://golang.org/pkg/sync/atomic/#pkg-note-BUG.
 	counts [2]*histogramCounts
 
-	upperBounds []float64
-	labelPairs  []*dto.LabelPair
-	exemplars   []atomic.Value // One more than buckets (to include +Inf), each a *dto.Exemplar.
+	upperBounds                     []float64
+	labelPairs                      []*dto.LabelPair
+	exemplars                       []atomic.Value // One more than buckets (to include +Inf), each a *dto.Exemplar.
+	nativeHistogramSchema           int32          // The initial schema. Set to math.MinInt32 if no sparse buckets are used.
+	nativeHistogramZeroThreshold    float64        // The initial zero threshold.
+	nativeHistogramMaxZeroThreshold float64
+	nativeHistogramMaxBuckets       uint32
+	nativeHistogramMinResetDuration time.Duration
+	lastResetTime                   time.Time // Protected by mtx.
 
 	now func() time.Time // To mock out time.Now() for testing.
 }
@@ -291,8 +725,8 @@ func (h *histogram) Write(out *dto.Metric) error {
 	// the hot path, i.e. Observe is called much more often than Write. The
 	// complication of making Write lock-free isn't worth it, if possible at
 	// all.
-	h.writeMtx.Lock()
-	defer h.writeMtx.Unlock()
+	h.mtx.Lock()
+	defer h.mtx.Unlock()
 
 	// Adding 1<<63 switches the hot index (from 0 to 1 or from 1 to 0)
 	// without touching the count bits. See the struct comments for a full
@@ -305,16 +739,16 @@ func (h *histogram) Write(out *dto.Metric) error {
 	hotCounts := h.counts[n>>63]
 	coldCounts := h.counts[(^n)>>63]
 
-	// Await cooldown.
-	for count != atomic.LoadUint64(&coldCounts.count) {
-		runtime.Gosched() // Let observations get work done.
-	}
+	waitForCooldown(count, coldCounts)
 
 	his := &dto.Histogram{
 		Bucket:      make([]*dto.Bucket, len(h.upperBounds)),
 		SampleCount: proto.Uint64(count),
 		SampleSum:   proto.Float64(math.Float64frombits(atomic.LoadUint64(&coldCounts.sumBits))),
 	}
+	out.Histogram = his
+	out.Label = h.labelPairs
+
 	var cumCount uint64
 	for i, upperBound := range h.upperBounds {
 		cumCount += atomic.LoadUint64(&coldCounts.buckets[i])
@@ -335,25 +769,21 @@ func (h *histogram) Write(out *dto.Metric) error {
 		}
 		his.Bucket = append(his.Bucket, b)
 	}
+	if h.nativeHistogramSchema > math.MinInt32 {
+		his.ZeroThreshold = proto.Float64(math.Float64frombits(atomic.LoadUint64(&coldCounts.nativeHistogramZeroThresholdBits)))
+		his.Schema = proto.Int32(atomic.LoadInt32(&coldCounts.nativeHistogramSchema))
+		zeroBucket := atomic.LoadUint64(&coldCounts.nativeHistogramZeroBucket)
 
-	out.Histogram = his
-	out.Label = h.labelPairs
+		defer func() {
+			coldCounts.nativeHistogramBucketsPositive.Range(addAndReset(&hotCounts.nativeHistogramBucketsPositive, &hotCounts.nativeHistogramBucketsNumber))
+			coldCounts.nativeHistogramBucketsNegative.Range(addAndReset(&hotCounts.nativeHistogramBucketsNegative, &hotCounts.nativeHistogramBucketsNumber))
+		}()
 
-	// Finally add all the cold counts to the new hot counts and reset the cold counts.
-	atomic.AddUint64(&hotCounts.count, count)
-	atomic.StoreUint64(&coldCounts.count, 0)
-	for {
-		oldBits := atomic.LoadUint64(&hotCounts.sumBits)
-		newBits := math.Float64bits(math.Float64frombits(oldBits) + his.GetSampleSum())
-		if atomic.CompareAndSwapUint64(&hotCounts.sumBits, oldBits, newBits) {
-			atomic.StoreUint64(&coldCounts.sumBits, 0)
-			break
-		}
-	}
-	for i := range h.upperBounds {
-		atomic.AddUint64(&hotCounts.buckets[i], atomic.LoadUint64(&coldCounts.buckets[i]))
-		atomic.StoreUint64(&coldCounts.buckets[i], 0)
+		his.ZeroCount = proto.Uint64(zeroBucket)
+		his.NegativeSpan, his.NegativeDelta = makeBuckets(&coldCounts.nativeHistogramBucketsNegative)
+		his.PositiveSpan, his.PositiveDelta = makeBuckets(&coldCounts.nativeHistogramBucketsPositive)
 	}
+	addAndResetCounts(hotCounts, coldCounts)
 	return nil
 }
 
@@ -374,25 +804,216 @@ func (h *histogram) findBucket(v float64) int {
 
 // observe is the implementation for Observe without the findBucket part.
 func (h *histogram) observe(v float64, bucket int) {
+	// Do not add to sparse buckets for NaN observations.
+	doSparse := h.nativeHistogramSchema > math.MinInt32 && !math.IsNaN(v)
 	// We increment h.countAndHotIdx so that the counter in the lower
 	// 63 bits gets incremented. At the same time, we get the new value
 	// back, which we can use to find the currently-hot counts.
 	n := atomic.AddUint64(&h.countAndHotIdx, 1)
 	hotCounts := h.counts[n>>63]
+	hotCounts.observe(v, bucket, doSparse)
+	if doSparse {
+		h.limitBuckets(hotCounts, v, bucket)
+	}
+}
 
-	if bucket < len(h.upperBounds) {
-		atomic.AddUint64(&hotCounts.buckets[bucket], 1)
+// limitSparsebuckets applies a strategy to limit the number of populated sparse
+// buckets. It's generally best effort, and there are situations where the
+// number can go higher (if even the lowest resolution isn't enough to reduce
+// the number sufficiently, or if the provided counts aren't fully updated yet
+// by a concurrently happening Write call).
+func (h *histogram) limitBuckets(counts *histogramCounts, value float64, bucket int) {
+	if h.nativeHistogramMaxBuckets == 0 {
+		return // No limit configured.
 	}
-	for {
-		oldBits := atomic.LoadUint64(&hotCounts.sumBits)
-		newBits := math.Float64bits(math.Float64frombits(oldBits) + v)
-		if atomic.CompareAndSwapUint64(&hotCounts.sumBits, oldBits, newBits) {
-			break
+	if h.nativeHistogramMaxBuckets >= atomic.LoadUint32(&counts.nativeHistogramBucketsNumber) {
+		return // Bucket limit not exceeded yet.
+	}
+
+	h.mtx.Lock()
+	defer h.mtx.Unlock()
+
+	// The hot counts might have been swapped just before we acquired the
+	// lock. Re-fetch the hot counts first...
+	n := atomic.LoadUint64(&h.countAndHotIdx)
+	hotIdx := n >> 63
+	coldIdx := (^n) >> 63
+	hotCounts := h.counts[hotIdx]
+	coldCounts := h.counts[coldIdx]
+	// ...and then check again if we really have to reduce the bucket count.
+	if h.nativeHistogramMaxBuckets >= atomic.LoadUint32(&hotCounts.nativeHistogramBucketsNumber) {
+		return // Bucket limit not exceeded after all.
+	}
+	// Try the various strategies in order.
+	if h.maybeReset(hotCounts, coldCounts, coldIdx, value, bucket) {
+		return
+	}
+	if h.maybeWidenZeroBucket(hotCounts, coldCounts) {
+		return
+	}
+	h.doubleBucketWidth(hotCounts, coldCounts)
+}
+
+// maybeReset resests the whole histogram if at least h.nativeHistogramMinResetDuration
+// has been passed. It returns true if the histogram has been reset. The caller
+// must have locked h.mtx.
+func (h *histogram) maybeReset(hot, cold *histogramCounts, coldIdx uint64, value float64, bucket int) bool {
+	// We are using the possibly mocked h.now() rather than
+	// time.Since(h.lastResetTime) to enable testing.
+	if h.nativeHistogramMinResetDuration == 0 || h.now().Sub(h.lastResetTime) < h.nativeHistogramMinResetDuration {
+		return false
+	}
+	// Completely reset coldCounts.
+	h.resetCounts(cold)
+	// Repeat the latest observation to not lose it completely.
+	cold.observe(value, bucket, true)
+	// Make coldCounts the new hot counts while ressetting countAndHotIdx.
+	n := atomic.SwapUint64(&h.countAndHotIdx, (coldIdx<<63)+1)
+	count := n & ((1 << 63) - 1)
+	waitForCooldown(count, hot)
+	// Finally, reset the formerly hot counts, too.
+	h.resetCounts(hot)
+	h.lastResetTime = h.now()
+	return true
+}
+
+// maybeWidenZeroBucket widens the zero bucket until it includes the existing
+// buckets closest to the zero bucket (which could be two, if an equidistant
+// negative and a positive bucket exists, but usually it's only one bucket to be
+// merged into the new wider zero bucket). h.nativeHistogramMaxZeroThreshold
+// limits how far the zero bucket can be extended, and if that's not enough to
+// include an existing bucket, the method returns false. The caller must have
+// locked h.mtx.
+func (h *histogram) maybeWidenZeroBucket(hot, cold *histogramCounts) bool {
+	currentZeroThreshold := math.Float64frombits(atomic.LoadUint64(&hot.nativeHistogramZeroThresholdBits))
+	if currentZeroThreshold >= h.nativeHistogramMaxZeroThreshold {
+		return false
+	}
+	// Find the key of the bucket closest to zero.
+	smallestKey := findSmallestKey(&hot.nativeHistogramBucketsPositive)
+	smallestNegativeKey := findSmallestKey(&hot.nativeHistogramBucketsNegative)
+	if smallestNegativeKey < smallestKey {
+		smallestKey = smallestNegativeKey
+	}
+	if smallestKey == math.MaxInt32 {
+		return false
+	}
+	newZeroThreshold := getLe(smallestKey, atomic.LoadInt32(&hot.nativeHistogramSchema))
+	if newZeroThreshold > h.nativeHistogramMaxZeroThreshold {
+		return false // New threshold would exceed the max threshold.
+	}
+	atomic.StoreUint64(&cold.nativeHistogramZeroThresholdBits, math.Float64bits(newZeroThreshold))
+	// Remove applicable buckets.
+	if _, loaded := cold.nativeHistogramBucketsNegative.LoadAndDelete(smallestKey); loaded {
+		atomicDecUint32(&cold.nativeHistogramBucketsNumber)
+	}
+	if _, loaded := cold.nativeHistogramBucketsPositive.LoadAndDelete(smallestKey); loaded {
+		atomicDecUint32(&cold.nativeHistogramBucketsNumber)
+	}
+	// Make cold counts the new hot counts.
+	n := atomic.AddUint64(&h.countAndHotIdx, 1<<63)
+	count := n & ((1 << 63) - 1)
+	// Swap the pointer names to represent the new roles and make
+	// the rest less confusing.
+	hot, cold = cold, hot
+	waitForCooldown(count, cold)
+	// Add all the now cold counts to the new hot counts...
+	addAndResetCounts(hot, cold)
+	// ...adjust the new zero threshold in the cold counts, too...
+	atomic.StoreUint64(&cold.nativeHistogramZeroThresholdBits, math.Float64bits(newZeroThreshold))
+	// ...and then merge the newly deleted buckets into the wider zero
+	// bucket.
+	mergeAndDeleteOrAddAndReset := func(hotBuckets, coldBuckets *sync.Map) func(k, v interface{}) bool {
+		return func(k, v interface{}) bool {
+			key := k.(int)
+			bucket := v.(*int64)
+			if key == smallestKey {
+				// Merge into hot zero bucket...
+				atomic.AddUint64(&hot.nativeHistogramZeroBucket, uint64(atomic.LoadInt64(bucket)))
+				// ...and delete from cold counts.
+				coldBuckets.Delete(key)
+				atomicDecUint32(&cold.nativeHistogramBucketsNumber)
+			} else {
+				// Add to corresponding hot bucket...
+				if addToBucket(hotBuckets, key, atomic.LoadInt64(bucket)) {
+					atomic.AddUint32(&hot.nativeHistogramBucketsNumber, 1)
+				}
+				// ...and reset cold bucket.
+				atomic.StoreInt64(bucket, 0)
+			}
+			return true
 		}
 	}
-	// Increment count last as we take it as a signal that the observation
-	// is complete.
-	atomic.AddUint64(&hotCounts.count, 1)
+
+	cold.nativeHistogramBucketsPositive.Range(mergeAndDeleteOrAddAndReset(&hot.nativeHistogramBucketsPositive, &cold.nativeHistogramBucketsPositive))
+	cold.nativeHistogramBucketsNegative.Range(mergeAndDeleteOrAddAndReset(&hot.nativeHistogramBucketsNegative, &cold.nativeHistogramBucketsNegative))
+	return true
+}
+
+// doubleBucketWidth doubles the bucket width (by decrementing the schema
+// number). Note that very sparse buckets could lead to a low reduction of the
+// bucket count (or even no reduction at all). The method does nothing if the
+// schema is already -4.
+func (h *histogram) doubleBucketWidth(hot, cold *histogramCounts) {
+	coldSchema := atomic.LoadInt32(&cold.nativeHistogramSchema)
+	if coldSchema == -4 {
+		return // Already at lowest resolution.
+	}
+	coldSchema--
+	atomic.StoreInt32(&cold.nativeHistogramSchema, coldSchema)
+	// Play it simple and just delete all cold buckets.
+	atomic.StoreUint32(&cold.nativeHistogramBucketsNumber, 0)
+	deleteSyncMap(&cold.nativeHistogramBucketsNegative)
+	deleteSyncMap(&cold.nativeHistogramBucketsPositive)
+	// Make coldCounts the new hot counts.
+	n := atomic.AddUint64(&h.countAndHotIdx, 1<<63)
+	count := n & ((1 << 63) - 1)
+	// Swap the pointer names to represent the new roles and make
+	// the rest less confusing.
+	hot, cold = cold, hot
+	waitForCooldown(count, cold)
+	// Add all the now cold counts to the new hot counts...
+	addAndResetCounts(hot, cold)
+	// ...adjust the schema in the cold counts, too...
+	atomic.StoreInt32(&cold.nativeHistogramSchema, coldSchema)
+	// ...and then merge the cold buckets into the wider hot buckets.
+	merge := func(hotBuckets *sync.Map) func(k, v interface{}) bool {
+		return func(k, v interface{}) bool {
+			key := k.(int)
+			bucket := v.(*int64)
+			// Adjust key to match the bucket to merge into.
+			if key > 0 {
+				key++
+			}
+			key /= 2
+			// Add to corresponding hot bucket.
+			if addToBucket(hotBuckets, key, atomic.LoadInt64(bucket)) {
+				atomic.AddUint32(&hot.nativeHistogramBucketsNumber, 1)
+			}
+			return true
+		}
+	}
+
+	cold.nativeHistogramBucketsPositive.Range(merge(&hot.nativeHistogramBucketsPositive))
+	cold.nativeHistogramBucketsNegative.Range(merge(&hot.nativeHistogramBucketsNegative))
+	// Play it simple again and just delete all cold buckets.
+	atomic.StoreUint32(&cold.nativeHistogramBucketsNumber, 0)
+	deleteSyncMap(&cold.nativeHistogramBucketsNegative)
+	deleteSyncMap(&cold.nativeHistogramBucketsPositive)
+}
+
+func (h *histogram) resetCounts(counts *histogramCounts) {
+	atomic.StoreUint64(&counts.sumBits, 0)
+	atomic.StoreUint64(&counts.count, 0)
+	atomic.StoreUint64(&counts.nativeHistogramZeroBucket, 0)
+	atomic.StoreUint64(&counts.nativeHistogramZeroThresholdBits, math.Float64bits(h.nativeHistogramZeroThreshold))
+	atomic.StoreInt32(&counts.nativeHistogramSchema, h.nativeHistogramSchema)
+	atomic.StoreUint32(&counts.nativeHistogramBucketsNumber, 0)
+	for i := range h.upperBounds {
+		atomic.StoreUint64(&counts.buckets[i], 0)
+	}
+	deleteSyncMap(&counts.nativeHistogramBucketsNegative)
+	deleteSyncMap(&counts.nativeHistogramBucketsPositive)
 }
 
 // updateExemplar replaces the exemplar for the provided bucket. With empty
@@ -420,15 +1041,23 @@ type HistogramVec struct {
 // NewHistogramVec creates a new HistogramVec based on the provided HistogramOpts and
 // partitioned by the given label names.
 func NewHistogramVec(opts HistogramOpts, labelNames []string) *HistogramVec {
-	desc := NewDesc(
+	return V2.NewHistogramVec(HistogramVecOpts{
+		HistogramOpts:  opts,
+		VariableLabels: UnconstrainedLabels(labelNames),
+	})
+}
+
+// NewHistogramVec creates a new HistogramVec based on the provided HistogramVecOpts.
+func (v2) NewHistogramVec(opts HistogramVecOpts) *HistogramVec {
+	desc := V2.NewDesc(
 		BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
 		opts.Help,
-		labelNames,
+		opts.VariableLabels,
 		opts.ConstLabels,
 	)
 	return &HistogramVec{
 		MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
-			return newHistogram(desc, opts, lvs...)
+			return newHistogram(desc, opts.HistogramOpts, lvs...)
 		}),
 	}
 }
@@ -488,7 +1117,8 @@ func (v *HistogramVec) GetMetricWith(labels Labels) (Observer, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Observe(42.21)
+//
+//	myVec.WithLabelValues("404", "GET").Observe(42.21)
 func (v *HistogramVec) WithLabelValues(lvs ...string) Observer {
 	h, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -499,7 +1129,8 @@ func (v *HistogramVec) WithLabelValues(lvs ...string) Observer {
 
 // With works as GetMetricWith but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
 func (v *HistogramVec) With(labels Labels) Observer {
 	h, err := v.GetMetricWith(labels)
 	if err != nil {
@@ -553,11 +1184,11 @@ func (h *constHistogram) Desc() *Desc {
 
 func (h *constHistogram) Write(out *dto.Metric) error {
 	his := &dto.Histogram{}
+
 	buckets := make([]*dto.Bucket, 0, len(h.buckets))
 
 	his.SampleCount = proto.Uint64(h.count)
 	his.SampleSum = proto.Float64(h.sum)
-
 	for upperBound, count := range h.buckets {
 		buckets = append(buckets, &dto.Bucket{
 			CumulativeCount: proto.Uint64(count),
@@ -585,7 +1216,7 @@ func (h *constHistogram) Write(out *dto.Metric) error {
 // to send it to Prometheus in the Collect method.
 //
 // buckets is a map of upper bounds to cumulative counts, excluding the +Inf
-// bucket.
+// bucket. The +Inf bucket is implicit, and its value is equal to the provided count.
 //
 // NewConstHistogram returns an error if the length of labelValues is not
 // consistent with the variable labels in Desc or if Desc is invalid.
@@ -640,3 +1271,229 @@ func (s buckSort) Swap(i, j int) {
 func (s buckSort) Less(i, j int) bool {
 	return s[i].GetUpperBound() < s[j].GetUpperBound()
 }
+
+// pickSchema returns the largest number n between -4 and 8 such that
+// 2^(2^-n) is less or equal the provided bucketFactor.
+//
+// Special cases:
+//   - bucketFactor <= 1: panics.
+//   - bucketFactor < 2^(2^-8) (but > 1): still returns 8.
+func pickSchema(bucketFactor float64) int32 {
+	if bucketFactor <= 1 {
+		panic(fmt.Errorf("bucketFactor %f is <=1", bucketFactor))
+	}
+	floor := math.Floor(math.Log2(math.Log2(bucketFactor)))
+	switch {
+	case floor <= -8:
+		return 8
+	case floor >= 4:
+		return -4
+	default:
+		return -int32(floor)
+	}
+}
+
+func makeBuckets(buckets *sync.Map) ([]*dto.BucketSpan, []int64) {
+	var ii []int
+	buckets.Range(func(k, v interface{}) bool {
+		ii = append(ii, k.(int))
+		return true
+	})
+	sort.Ints(ii)
+
+	if len(ii) == 0 {
+		return nil, nil
+	}
+
+	var (
+		spans     []*dto.BucketSpan
+		deltas    []int64
+		prevCount int64
+		nextI     int
+	)
+
+	appendDelta := func(count int64) {
+		*spans[len(spans)-1].Length++
+		deltas = append(deltas, count-prevCount)
+		prevCount = count
+	}
+
+	for n, i := range ii {
+		v, _ := buckets.Load(i)
+		count := atomic.LoadInt64(v.(*int64))
+		// Multiple spans with only small gaps in between are probably
+		// encoded more efficiently as one larger span with a few empty
+		// buckets. Needs some research to find the sweet spot. For now,
+		// we assume that gaps of one ore two buckets should not create
+		// a new span.
+		iDelta := int32(i - nextI)
+		if n == 0 || iDelta > 2 {
+			// We have to create a new span, either because we are
+			// at the very beginning, or because we have found a gap
+			// of more than two buckets.
+			spans = append(spans, &dto.BucketSpan{
+				Offset: proto.Int32(iDelta),
+				Length: proto.Uint32(0),
+			})
+		} else {
+			// We have found a small gap (or no gap at all).
+			// Insert empty buckets as needed.
+			for j := int32(0); j < iDelta; j++ {
+				appendDelta(0)
+			}
+		}
+		appendDelta(count)
+		nextI = i + 1
+	}
+	return spans, deltas
+}
+
+// addToBucket increments the sparse bucket at key by the provided amount. It
+// returns true if a new sparse bucket had to be created for that.
+func addToBucket(buckets *sync.Map, key int, increment int64) bool {
+	if existingBucket, ok := buckets.Load(key); ok {
+		// Fast path without allocation.
+		atomic.AddInt64(existingBucket.(*int64), increment)
+		return false
+	}
+	// Bucket doesn't exist yet. Slow path allocating new counter.
+	newBucket := increment // TODO(beorn7): Check if this is sufficient to not let increment escape.
+	if actualBucket, loaded := buckets.LoadOrStore(key, &newBucket); loaded {
+		// The bucket was created concurrently in another goroutine.
+		// Have to increment after all.
+		atomic.AddInt64(actualBucket.(*int64), increment)
+		return false
+	}
+	return true
+}
+
+// addAndReset returns a function to be used with sync.Map.Range of spare
+// buckets in coldCounts. It increments the buckets in the provided hotBuckets
+// according to the buckets ranged through. It then resets all buckets ranged
+// through to 0 (but leaves them in place so that they don't need to get
+// recreated on the next scrape).
+func addAndReset(hotBuckets *sync.Map, bucketNumber *uint32) func(k, v interface{}) bool {
+	return func(k, v interface{}) bool {
+		bucket := v.(*int64)
+		if addToBucket(hotBuckets, k.(int), atomic.LoadInt64(bucket)) {
+			atomic.AddUint32(bucketNumber, 1)
+		}
+		atomic.StoreInt64(bucket, 0)
+		return true
+	}
+}
+
+func deleteSyncMap(m *sync.Map) {
+	m.Range(func(k, v interface{}) bool {
+		m.Delete(k)
+		return true
+	})
+}
+
+func findSmallestKey(m *sync.Map) int {
+	result := math.MaxInt32
+	m.Range(func(k, v interface{}) bool {
+		key := k.(int)
+		if key < result {
+			result = key
+		}
+		return true
+	})
+	return result
+}
+
+func getLe(key int, schema int32) float64 {
+	// Here a bit of context about the behavior for the last bucket counting
+	// regular numbers (called simply "last bucket" below) and the bucket
+	// counting observations of ±Inf (called "inf bucket" below, with a key
+	// one higher than that of the "last bucket"):
+	//
+	// If we apply the usual formula to the last bucket, its upper bound
+	// would be calculated as +Inf. The reason is that the max possible
+	// regular float64 number (math.MaxFloat64) doesn't coincide with one of
+	// the calculated bucket boundaries. So the calculated boundary has to
+	// be larger than math.MaxFloat64, and the only float64 larger than
+	// math.MaxFloat64 is +Inf. However, we want to count actual
+	// observations of ±Inf in the inf bucket. Therefore, we have to treat
+	// the upper bound of the last bucket specially and set it to
+	// math.MaxFloat64. (The upper bound of the inf bucket, with its key
+	// being one higher than that of the last bucket, naturally comes out as
+	// +Inf by the usual formula. So that's fine.)
+	//
+	// math.MaxFloat64 has a frac of 0.9999999999999999 and an exp of
+	// 1024. If there were a float64 number following math.MaxFloat64, it
+	// would have a frac of 1.0 and an exp of 1024, or equivalently a frac
+	// of 0.5 and an exp of 1025. However, since frac must be smaller than
+	// 1, and exp must be smaller than 1025, either representation overflows
+	// a float64. (Which, in turn, is the reason that math.MaxFloat64 is the
+	// largest possible float64. Q.E.D.) However, the formula for
+	// calculating the upper bound from the idx and schema of the last
+	// bucket results in precisely that. It is either frac=1.0 & exp=1024
+	// (for schema < 0) or frac=0.5 & exp=1025 (for schema >=0). (This is,
+	// by the way, a power of two where the exponent itself is a power of
+	// two, 2¹⁰ in fact, which coinicides with a bucket boundary in all
+	// schemas.) So these are the special cases we have to catch below.
+	if schema < 0 {
+		exp := key << -schema
+		if exp == 1024 {
+			// This is the last bucket before the overflow bucket
+			// (for ±Inf observations). Return math.MaxFloat64 as
+			// explained above.
+			return math.MaxFloat64
+		}
+		return math.Ldexp(1, exp)
+	}
+
+	fracIdx := key & ((1 << schema) - 1)
+	frac := nativeHistogramBounds[schema][fracIdx]
+	exp := (key >> schema) + 1
+	if frac == 0.5 && exp == 1025 {
+		// This is the last bucket before the overflow bucket (for ±Inf
+		// observations). Return math.MaxFloat64 as explained above.
+		return math.MaxFloat64
+	}
+	return math.Ldexp(frac, exp)
+}
+
+// waitForCooldown returns after the count field in the provided histogramCounts
+// has reached the provided count value.
+func waitForCooldown(count uint64, counts *histogramCounts) {
+	for count != atomic.LoadUint64(&counts.count) {
+		runtime.Gosched() // Let observations get work done.
+	}
+}
+
+// atomicAddFloat adds the provided float atomically to another float
+// represented by the bit pattern the bits pointer is pointing to.
+func atomicAddFloat(bits *uint64, v float64) {
+	for {
+		loadedBits := atomic.LoadUint64(bits)
+		newBits := math.Float64bits(math.Float64frombits(loadedBits) + v)
+		if atomic.CompareAndSwapUint64(bits, loadedBits, newBits) {
+			break
+		}
+	}
+}
+
+// atomicDecUint32 atomically decrements the uint32 p points to.  See
+// https://pkg.go.dev/sync/atomic#AddUint32 to understand how this is done.
+func atomicDecUint32(p *uint32) {
+	atomic.AddUint32(p, ^uint32(0))
+}
+
+// addAndResetCounts adds certain fields (count, sum, conventional buckets, zero
+// bucket) from the cold counts to the corresponding fields in the hot
+// counts. Those fields are then reset to 0 in the cold counts.
+func addAndResetCounts(hot, cold *histogramCounts) {
+	atomic.AddUint64(&hot.count, atomic.LoadUint64(&cold.count))
+	atomic.StoreUint64(&cold.count, 0)
+	coldSum := math.Float64frombits(atomic.LoadUint64(&cold.sumBits))
+	atomicAddFloat(&hot.sumBits, coldSum)
+	atomic.StoreUint64(&cold.sumBits, 0)
+	for i := range hot.buckets {
+		atomic.AddUint64(&hot.buckets[i], atomic.LoadUint64(&cold.buckets[i]))
+		atomic.StoreUint64(&cold.buckets[i], 0)
+	}
+	atomic.AddUint64(&hot.nativeHistogramZeroBucket, atomic.LoadUint64(&cold.nativeHistogramZeroBucket))
+	atomic.StoreUint64(&cold.nativeHistogramZeroBucket, 0)
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/internal/almost_equal.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/almost_equal.go
new file mode 100644
index 0000000000..1ed5abe74c
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/almost_equal.go
@@ -0,0 +1,60 @@
+// Copyright (c) 2015 Björn Rabenstein
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+//
+// The code in this package is copy/paste to avoid a dependency. Hence this file
+// carries the copyright of the original repo.
+// https://github.com/beorn7/floats
+package internal
+
+import (
+	"math"
+)
+
+// minNormalFloat64 is the smallest positive normal value of type float64.
+var minNormalFloat64 = math.Float64frombits(0x0010000000000000)
+
+// AlmostEqualFloat64 returns true if a and b are equal within a relative error
+// of epsilon. See http://floating-point-gui.de/errors/comparison/ for the
+// details of the applied method.
+func AlmostEqualFloat64(a, b, epsilon float64) bool {
+	if a == b {
+		return true
+	}
+	absA := math.Abs(a)
+	absB := math.Abs(b)
+	diff := math.Abs(a - b)
+	if a == 0 || b == 0 || absA+absB < minNormalFloat64 {
+		return diff < epsilon*minNormalFloat64
+	}
+	return diff/math.Min(absA+absB, math.MaxFloat64) < epsilon
+}
+
+// AlmostEqualFloat64s is the slice form of AlmostEqualFloat64.
+func AlmostEqualFloat64s(a, b []float64, epsilon float64) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if !AlmostEqualFloat64(a[i], b[i], epsilon) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/vendor/github.com/pmezard/go-difflib/difflib/difflib.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go
similarity index 81%
rename from vendor/github.com/pmezard/go-difflib/difflib/difflib.go
rename to vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go
index 003e99fadb..fd0750f2cf 100644
--- a/vendor/github.com/pmezard/go-difflib/difflib/difflib.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.go
@@ -1,19 +1,21 @@
-// Package difflib is a partial port of Python difflib module.
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
 //
-// It provides tools to compare sequences of strings and generate textual diffs.
-//
-// The following class and functions have been ported:
-//
-// - SequenceMatcher
+// http://www.apache.org/licenses/LICENSE-2.0
 //
-// - unified_diff
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 //
-// - context_diff
+// It provides tools to compare sequences of strings and generate textual diffs.
 //
-// Getting unified diffs was the main goal of the port. Keep in mind this code
-// is mostly suitable to output text differences in a human friendly way, there
-// are no guarantees generated diffs are consumable by patch(1).
-package difflib
+// Maintaining `GetUnifiedDiffString` here because original repository
+// (https://github.com/pmezard/go-difflib) is no loger maintained.
+package internal
 
 import (
 	"bufio"
@@ -104,8 +106,8 @@ func NewMatcher(a, b []string) *SequenceMatcher {
 }
 
 func NewMatcherWithJunk(a, b []string, autoJunk bool,
-	isJunk func(string) bool) *SequenceMatcher {
-
+	isJunk func(string) bool,
+) *SequenceMatcher {
 	m := SequenceMatcher{IsJunk: isJunk, autoJunk: autoJunk}
 	m.SetSeqs(a, b)
 	return &m
@@ -161,12 +163,12 @@ func (m *SequenceMatcher) chainB() {
 	m.bJunk = map[string]struct{}{}
 	if m.IsJunk != nil {
 		junk := m.bJunk
-		for s, _ := range b2j {
+		for s := range b2j {
 			if m.IsJunk(s) {
 				junk[s] = struct{}{}
 			}
 		}
-		for s, _ := range junk {
+		for s := range junk {
 			delete(b2j, s)
 		}
 	}
@@ -181,7 +183,7 @@ func (m *SequenceMatcher) chainB() {
 				popular[s] = struct{}{}
 			}
 		}
-		for s, _ := range popular {
+		for s := range popular {
 			delete(b2j, s)
 		}
 	}
@@ -199,12 +201,15 @@ func (m *SequenceMatcher) isBJunk(s string) bool {
 // If IsJunk is not defined:
 //
 // Return (i,j,k) such that a[i:i+k] is equal to b[j:j+k], where
-//     alo <= i <= i+k <= ahi
-//     blo <= j <= j+k <= bhi
+//
+//	alo <= i <= i+k <= ahi
+//	blo <= j <= j+k <= bhi
+//
 // and for all (i',j',k') meeting those conditions,
-//     k >= k'
-//     i <= i'
-//     and if i == i', j <= j'
+//
+//	k >= k'
+//	i <= i'
+//	and if i == i', j <= j'
 //
 // In other words, of all maximal matching blocks, return one that
 // starts earliest in a, and of all those maximal matching blocks that
@@ -268,7 +273,7 @@ func (m *SequenceMatcher) findLongestMatch(alo, ahi, blo, bhi int) Match {
 	for besti+bestsize < ahi && bestj+bestsize < bhi &&
 		!m.isBJunk(m.b[bestj+bestsize]) &&
 		m.a[besti+bestsize] == m.b[bestj+bestsize] {
-		bestsize += 1
+		bestsize++
 	}
 
 	// Now that we have a wholly interesting match (albeit possibly
@@ -285,7 +290,7 @@ func (m *SequenceMatcher) findLongestMatch(alo, ahi, blo, bhi int) Match {
 	for besti+bestsize < ahi && bestj+bestsize < bhi &&
 		m.isBJunk(m.b[bestj+bestsize]) &&
 		m.a[besti+bestsize] == m.b[bestj+bestsize] {
-		bestsize += 1
+		bestsize++
 	}
 
 	return Match{A: besti, B: bestj, Size: bestsize}
@@ -416,7 +421,7 @@ func (m *SequenceMatcher) GetGroupedOpCodes(n int) [][]OpCode {
 	}
 	codes := m.GetOpCodes()
 	if len(codes) == 0 {
-		codes = []OpCode{OpCode{'e', 0, 1, 0, 1}}
+		codes = []OpCode{{'e', 0, 1, 0, 1}}
 	}
 	// Fixup leading and trailing groups if they show no changes.
 	if codes[0].Tag == 'e' {
@@ -437,8 +442,10 @@ func (m *SequenceMatcher) GetGroupedOpCodes(n int) [][]OpCode {
 		// End the current group and start a new one whenever
 		// there is a large range with no changes.
 		if c.Tag == 'e' && i2-i1 > nn {
-			group = append(group, OpCode{c.Tag, i1, min(i2, i1+n),
-				j1, min(j2, j1+n)})
+			group = append(group, OpCode{
+				c.Tag, i1, min(i2, i1+n),
+				j1, min(j2, j1+n),
+			})
 			groups = append(groups, group)
 			group = []OpCode{}
 			i1, j1 = max(i1, i2-n), max(j1, j2-n)
@@ -481,7 +488,7 @@ func (m *SequenceMatcher) QuickRatio() float64 {
 	if m.fullBCount == nil {
 		m.fullBCount = map[string]int{}
 		for _, s := range m.b {
-			m.fullBCount[s] = m.fullBCount[s] + 1
+			m.fullBCount[s]++
 		}
 	}
 
@@ -496,7 +503,7 @@ func (m *SequenceMatcher) QuickRatio() float64 {
 		}
 		avail[s] = n - 1
 		if n > 0 {
-			matches += 1
+			matches++
 		}
 	}
 	return calculateRatio(matches, len(m.a)+len(m.b))
@@ -520,7 +527,7 @@ func formatRangeUnified(start, stop int) string {
 		return fmt.Sprintf("%d", beginning)
 	}
 	if length == 0 {
-		beginning -= 1 // empty ranges begin at line just before the range
+		beginning-- // empty ranges begin at line just before the range
 	}
 	return fmt.Sprintf("%d,%d", beginning, length)
 }
@@ -635,132 +642,7 @@ func WriteUnifiedDiff(writer io.Writer, diff UnifiedDiff) error {
 func GetUnifiedDiffString(diff UnifiedDiff) (string, error) {
 	w := &bytes.Buffer{}
 	err := WriteUnifiedDiff(w, diff)
-	return string(w.Bytes()), err
-}
-
-// Convert range to the "ed" format.
-func formatRangeContext(start, stop int) string {
-	// Per the diff spec at http://www.unix.org/single_unix_specification/
-	beginning := start + 1 // lines start numbering with one
-	length := stop - start
-	if length == 0 {
-		beginning -= 1 // empty ranges begin at line just before the range
-	}
-	if length <= 1 {
-		return fmt.Sprintf("%d", beginning)
-	}
-	return fmt.Sprintf("%d,%d", beginning, beginning+length-1)
-}
-
-type ContextDiff UnifiedDiff
-
-// Compare two sequences of lines; generate the delta as a context diff.
-//
-// Context diffs are a compact way of showing line changes and a few
-// lines of context. The number of context lines is set by diff.Context
-// which defaults to three.
-//
-// By default, the diff control lines (those with *** or ---) are
-// created with a trailing newline.
-//
-// For inputs that do not have trailing newlines, set the diff.Eol
-// argument to "" so that the output will be uniformly newline free.
-//
-// The context diff format normally has a header for filenames and
-// modification times.  Any or all of these may be specified using
-// strings for diff.FromFile, diff.ToFile, diff.FromDate, diff.ToDate.
-// The modification times are normally expressed in the ISO 8601 format.
-// If not specified, the strings default to blanks.
-func WriteContextDiff(writer io.Writer, diff ContextDiff) error {
-	buf := bufio.NewWriter(writer)
-	defer buf.Flush()
-	var diffErr error
-	wf := func(format string, args ...interface{}) {
-		_, err := buf.WriteString(fmt.Sprintf(format, args...))
-		if diffErr == nil && err != nil {
-			diffErr = err
-		}
-	}
-	ws := func(s string) {
-		_, err := buf.WriteString(s)
-		if diffErr == nil && err != nil {
-			diffErr = err
-		}
-	}
-
-	if len(diff.Eol) == 0 {
-		diff.Eol = "\n"
-	}
-
-	prefix := map[byte]string{
-		'i': "+ ",
-		'd': "- ",
-		'r': "! ",
-		'e': "  ",
-	}
-
-	started := false
-	m := NewMatcher(diff.A, diff.B)
-	for _, g := range m.GetGroupedOpCodes(diff.Context) {
-		if !started {
-			started = true
-			fromDate := ""
-			if len(diff.FromDate) > 0 {
-				fromDate = "\t" + diff.FromDate
-			}
-			toDate := ""
-			if len(diff.ToDate) > 0 {
-				toDate = "\t" + diff.ToDate
-			}
-			if diff.FromFile != "" || diff.ToFile != "" {
-				wf("*** %s%s%s", diff.FromFile, fromDate, diff.Eol)
-				wf("--- %s%s%s", diff.ToFile, toDate, diff.Eol)
-			}
-		}
-
-		first, last := g[0], g[len(g)-1]
-		ws("***************" + diff.Eol)
-
-		range1 := formatRangeContext(first.I1, last.I2)
-		wf("*** %s ****%s", range1, diff.Eol)
-		for _, c := range g {
-			if c.Tag == 'r' || c.Tag == 'd' {
-				for _, cc := range g {
-					if cc.Tag == 'i' {
-						continue
-					}
-					for _, line := range diff.A[cc.I1:cc.I2] {
-						ws(prefix[cc.Tag] + line)
-					}
-				}
-				break
-			}
-		}
-
-		range2 := formatRangeContext(first.J1, last.J2)
-		wf("--- %s ----%s", range2, diff.Eol)
-		for _, c := range g {
-			if c.Tag == 'r' || c.Tag == 'i' {
-				for _, cc := range g {
-					if cc.Tag == 'd' {
-						continue
-					}
-					for _, line := range diff.B[cc.J1:cc.J2] {
-						ws(prefix[cc.Tag] + line)
-					}
-				}
-				break
-			}
-		}
-	}
-	return diffErr
-}
-
-// Like WriteContextDiff but returns the diff a string.
-func GetContextDiffString(diff ContextDiff) (string, error) {
-	w := &bytes.Buffer{}
-	err := WriteContextDiff(w, diff)
-	return string(w.Bytes()), err
+	return w.String(), err
 }
 
 // Split a string on "\n" while preserving them. The output can be used
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/internal/go_collector_options.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/go_collector_options.go
new file mode 100644
index 0000000000..723b45d644
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/go_collector_options.go
@@ -0,0 +1,32 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package internal
+
+import "regexp"
+
+type GoCollectorRule struct {
+	Matcher *regexp.Regexp
+	Deny    bool
+}
+
+// GoCollectorOptions should not be used be directly by anything, except `collectors` package.
+// Use it via collectors package instead. See issue
+// https://github.com/prometheus/client_golang/issues/1030.
+//
+// This is internal, so external users only can use it via `collector.WithGoCollector*` methods
+type GoCollectorOptions struct {
+	DisableMemStatsLikeMetrics bool
+	RuntimeMetricSumForHist    map[string]string
+	RuntimeMetricRules         []GoCollectorRule
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/internal/go_runtime_metrics.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/go_runtime_metrics.go
new file mode 100644
index 0000000000..97d17d6cb6
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/go_runtime_metrics.go
@@ -0,0 +1,142 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build go1.17
+// +build go1.17
+
+package internal
+
+import (
+	"math"
+	"path"
+	"runtime/metrics"
+	"strings"
+
+	"github.com/prometheus/common/model"
+)
+
+// RuntimeMetricsToProm produces a Prometheus metric name from a runtime/metrics
+// metric description and validates whether the metric is suitable for integration
+// with Prometheus.
+//
+// Returns false if a name could not be produced, or if Prometheus does not understand
+// the runtime/metrics Kind.
+//
+// Note that the main reason a name couldn't be produced is if the runtime/metrics
+// package exports a name with characters outside the valid Prometheus metric name
+// character set. This is theoretically possible, but should never happen in practice.
+// Still, don't rely on it.
+func RuntimeMetricsToProm(d *metrics.Description) (string, string, string, bool) {
+	namespace := "go"
+
+	comp := strings.SplitN(d.Name, ":", 2)
+	key := comp[0]
+	unit := comp[1]
+
+	// The last path element in the key is the name,
+	// the rest is the subsystem.
+	subsystem := path.Dir(key[1:] /* remove leading / */)
+	name := path.Base(key)
+
+	// subsystem is translated by replacing all / and - with _.
+	subsystem = strings.ReplaceAll(subsystem, "/", "_")
+	subsystem = strings.ReplaceAll(subsystem, "-", "_")
+
+	// unit is translated assuming that the unit contains no
+	// non-ASCII characters.
+	unit = strings.ReplaceAll(unit, "-", "_")
+	unit = strings.ReplaceAll(unit, "*", "_")
+	unit = strings.ReplaceAll(unit, "/", "_per_")
+
+	// name has - replaced with _ and is concatenated with the unit and
+	// other data.
+	name = strings.ReplaceAll(name, "-", "_")
+	name += "_" + unit
+	if d.Cumulative && d.Kind != metrics.KindFloat64Histogram {
+		name += "_total"
+	}
+
+	valid := model.IsValidMetricName(model.LabelValue(namespace + "_" + subsystem + "_" + name))
+	switch d.Kind {
+	case metrics.KindUint64:
+	case metrics.KindFloat64:
+	case metrics.KindFloat64Histogram:
+	default:
+		valid = false
+	}
+	return namespace, subsystem, name, valid
+}
+
+// RuntimeMetricsBucketsForUnit takes a set of buckets obtained for a runtime/metrics histogram
+// type (so, lower-bound inclusive) and a unit from a runtime/metrics name, and produces
+// a reduced set of buckets. This function always removes any -Inf bucket as it's represented
+// as the bottom-most upper-bound inclusive bucket in Prometheus.
+func RuntimeMetricsBucketsForUnit(buckets []float64, unit string) []float64 {
+	switch unit {
+	case "bytes":
+		// Re-bucket as powers of 2.
+		return reBucketExp(buckets, 2)
+	case "seconds":
+		// Re-bucket as powers of 10 and then merge all buckets greater
+		// than 1 second into the +Inf bucket.
+		b := reBucketExp(buckets, 10)
+		for i := range b {
+			if b[i] <= 1 {
+				continue
+			}
+			b[i] = math.Inf(1)
+			b = b[:i+1]
+			break
+		}
+		return b
+	}
+	return buckets
+}
+
+// reBucketExp takes a list of bucket boundaries (lower bound inclusive) and
+// downsamples the buckets to those a multiple of base apart. The end result
+// is a roughly exponential (in many cases, perfectly exponential) bucketing
+// scheme.
+func reBucketExp(buckets []float64, base float64) []float64 {
+	bucket := buckets[0]
+	var newBuckets []float64
+	// We may see a -Inf here, in which case, add it and skip it
+	// since we risk producing NaNs otherwise.
+	//
+	// We need to preserve -Inf values to maintain runtime/metrics
+	// conventions. We'll strip it out later.
+	if bucket == math.Inf(-1) {
+		newBuckets = append(newBuckets, bucket)
+		buckets = buckets[1:]
+		bucket = buckets[0]
+	}
+	// From now on, bucket should always have a non-Inf value because
+	// Infs are only ever at the ends of the bucket lists, so
+	// arithmetic operations on it are non-NaN.
+	for i := 1; i < len(buckets); i++ {
+		if bucket >= 0 && buckets[i] < bucket*base {
+			// The next bucket we want to include is at least bucket*base.
+			continue
+		} else if bucket < 0 && buckets[i] < bucket/base {
+			// In this case the bucket we're targeting is negative, and since
+			// we're ascending through buckets here, we need to divide to get
+			// closer to zero exponentially.
+			continue
+		}
+		// The +Inf bucket will always be the last one, and we'll always
+		// end up including it here because bucket
+		newBuckets = append(newBuckets, bucket)
+		bucket = buckets[i]
+	}
+	return append(newBuckets, bucket)
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/internal/metric.go b/vendor/github.com/prometheus/client_golang/prometheus/internal/metric.go
index 351c26e1ae..6515c11480 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/internal/metric.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/internal/metric.go
@@ -19,18 +19,34 @@ import (
 	dto "github.com/prometheus/client_model/go"
 )
 
-// metricSorter is a sortable slice of *dto.Metric.
-type metricSorter []*dto.Metric
+// LabelPairSorter implements sort.Interface. It is used to sort a slice of
+// dto.LabelPair pointers.
+type LabelPairSorter []*dto.LabelPair
 
-func (s metricSorter) Len() int {
+func (s LabelPairSorter) Len() int {
 	return len(s)
 }
 
-func (s metricSorter) Swap(i, j int) {
+func (s LabelPairSorter) Swap(i, j int) {
 	s[i], s[j] = s[j], s[i]
 }
 
-func (s metricSorter) Less(i, j int) bool {
+func (s LabelPairSorter) Less(i, j int) bool {
+	return s[i].GetName() < s[j].GetName()
+}
+
+// MetricSorter is a sortable slice of *dto.Metric.
+type MetricSorter []*dto.Metric
+
+func (s MetricSorter) Len() int {
+	return len(s)
+}
+
+func (s MetricSorter) Swap(i, j int) {
+	s[i], s[j] = s[j], s[i]
+}
+
+func (s MetricSorter) Less(i, j int) bool {
 	if len(s[i].Label) != len(s[j].Label) {
 		// This should not happen. The metrics are
 		// inconsistent. However, we have to deal with the fact, as
@@ -68,7 +84,7 @@ func (s metricSorter) Less(i, j int) bool {
 // the slice, with the contained Metrics sorted within each MetricFamily.
 func NormalizeMetricFamilies(metricFamiliesByName map[string]*dto.MetricFamily) []*dto.MetricFamily {
 	for _, mf := range metricFamiliesByName {
-		sort.Sort(metricSorter(mf.Metric))
+		sort.Sort(MetricSorter(mf.Metric))
 	}
 	names := make([]string, 0, len(metricFamiliesByName))
 	for name, mf := range metricFamiliesByName {
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/labels.go b/vendor/github.com/prometheus/client_golang/prometheus/labels.go
index 2744443ac2..63ff8683ce 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/labels.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/labels.go
@@ -25,12 +25,85 @@ import (
 // Labels represents a collection of label name -> value mappings. This type is
 // commonly used with the With(Labels) and GetMetricWith(Labels) methods of
 // metric vector Collectors, e.g.:
-//     myVec.With(Labels{"code": "404", "method": "GET"}).Add(42)
+//
+//	myVec.With(Labels{"code": "404", "method": "GET"}).Add(42)
 //
 // The other use-case is the specification of constant label pairs in Opts or to
 // create a Desc.
 type Labels map[string]string
 
+// ConstrainedLabels represents a label name and its constrain function
+// to normalize label values. This type is commonly used when constructing
+// metric vector Collectors.
+type ConstrainedLabel struct {
+	Name       string
+	Constraint func(string) string
+}
+
+func (cl ConstrainedLabel) Constrain(v string) string {
+	if cl.Constraint == nil {
+		return v
+	}
+	return cl.Constraint(v)
+}
+
+// ConstrainableLabels is an interface that allows creating of labels that can
+// be optionally constrained.
+//
+//	prometheus.V2().NewCounterVec(CounterVecOpts{
+//	  CounterOpts: {...}, // Usual CounterOpts fields
+//	  VariableLabels: []ConstrainedLabels{
+//	    {Name: "A"},
+//	    {Name: "B", Constraint: func(v string) string { ... }},
+//	  },
+//	})
+type ConstrainableLabels interface {
+	constrainedLabels() ConstrainedLabels
+	labelNames() []string
+}
+
+// ConstrainedLabels represents a collection of label name -> constrain function
+// to normalize label values. This type is commonly used when constructing
+// metric vector Collectors.
+type ConstrainedLabels []ConstrainedLabel
+
+func (cls ConstrainedLabels) constrainedLabels() ConstrainedLabels {
+	return cls
+}
+
+func (cls ConstrainedLabels) labelNames() []string {
+	names := make([]string, len(cls))
+	for i, label := range cls {
+		names[i] = label.Name
+	}
+	return names
+}
+
+// UnconstrainedLabels represents collection of label without any constraint on
+// their value. Thus, it is simply a collection of label names.
+//
+//	UnconstrainedLabels([]string{ "A", "B" })
+//
+// is equivalent to
+//
+//	ConstrainedLabels {
+//	  { Name: "A" },
+//	  { Name: "B" },
+//	}
+type UnconstrainedLabels []string
+
+func (uls UnconstrainedLabels) constrainedLabels() ConstrainedLabels {
+	constrainedLabels := make([]ConstrainedLabel, len(uls))
+	for i, l := range uls {
+		constrainedLabels[i] = ConstrainedLabel{Name: l}
+	}
+	return constrainedLabels
+}
+
+func (uls UnconstrainedLabels) labelNames() []string {
+	return uls
+}
+
 // reservedLabelPrefix is a prefix which is not legal in user-supplied
 // label names.
 const reservedLabelPrefix = "__"
@@ -39,7 +112,7 @@ var errInconsistentCardinality = errors.New("inconsistent label cardinality")
 
 func makeInconsistentCardinalityError(fqName string, labels, labelValues []string) error {
 	return fmt.Errorf(
-		"%s: %q has %d variable labels named %q but %d values %q were provided",
+		"%w: %q has %d variable labels named %q but %d values %q were provided",
 		errInconsistentCardinality, fqName,
 		len(labels), labels,
 		len(labelValues), labelValues,
@@ -49,7 +122,7 @@ func makeInconsistentCardinalityError(fqName string, labels, labelValues []strin
 func validateValuesInLabels(labels Labels, expectedNumberOfValues int) error {
 	if len(labels) != expectedNumberOfValues {
 		return fmt.Errorf(
-			"%s: expected %d label values but got %d in %#v",
+			"%w: expected %d label values but got %d in %#v",
 			errInconsistentCardinality, expectedNumberOfValues,
 			len(labels), labels,
 		)
@@ -67,7 +140,7 @@ func validateValuesInLabels(labels Labels, expectedNumberOfValues int) error {
 func validateLabelValues(vals []string, expectedNumberOfValues int) error {
 	if len(vals) != expectedNumberOfValues {
 		return fmt.Errorf(
-			"%s: expected %d label values but got %d in %#v",
+			"%w: expected %d label values but got %d in %#v",
 			errInconsistentCardinality, expectedNumberOfValues,
 			len(vals), vals,
 		)
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/metric.go b/vendor/github.com/prometheus/client_golang/prometheus/metric.go
index dc121910a5..07bbc9d768 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/metric.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/metric.go
@@ -14,14 +14,15 @@
 package prometheus
 
 import (
+	"errors"
+	"math"
+	"sort"
 	"strings"
 	"time"
 
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
-	"github.com/prometheus/common/model"
-
 	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/model"
+	"google.golang.org/protobuf/proto"
 )
 
 var separatorByteSlice = []byte{model.SeparatorByte} // For convenient use with xxhash.
@@ -115,22 +116,6 @@ func BuildFQName(namespace, subsystem, name string) string {
 	return name
 }
 
-// labelPairSorter implements sort.Interface. It is used to sort a slice of
-// dto.LabelPair pointers.
-type labelPairSorter []*dto.LabelPair
-
-func (s labelPairSorter) Len() int {
-	return len(s)
-}
-
-func (s labelPairSorter) Swap(i, j int) {
-	s[i], s[j] = s[j], s[i]
-}
-
-func (s labelPairSorter) Less(i, j int) bool {
-	return s[i].GetName() < s[j].GetName()
-}
-
 type invalidMetric struct {
 	desc *Desc
 	err  error
@@ -174,3 +159,96 @@ func (m timestampedMetric) Write(pb *dto.Metric) error {
 func NewMetricWithTimestamp(t time.Time, m Metric) Metric {
 	return timestampedMetric{Metric: m, t: t}
 }
+
+type withExemplarsMetric struct {
+	Metric
+
+	exemplars []*dto.Exemplar
+}
+
+func (m *withExemplarsMetric) Write(pb *dto.Metric) error {
+	if err := m.Metric.Write(pb); err != nil {
+		return err
+	}
+
+	switch {
+	case pb.Counter != nil:
+		pb.Counter.Exemplar = m.exemplars[len(m.exemplars)-1]
+	case pb.Histogram != nil:
+		for _, e := range m.exemplars {
+			// pb.Histogram.Bucket are sorted by UpperBound.
+			i := sort.Search(len(pb.Histogram.Bucket), func(i int) bool {
+				return pb.Histogram.Bucket[i].GetUpperBound() >= e.GetValue()
+			})
+			if i < len(pb.Histogram.Bucket) {
+				pb.Histogram.Bucket[i].Exemplar = e
+			} else {
+				// The +Inf bucket should be explicitly added if there is an exemplar for it, similar to non-const histogram logic in https://github.com/prometheus/client_golang/blob/main/prometheus/histogram.go#L357-L365.
+				b := &dto.Bucket{
+					CumulativeCount: proto.Uint64(pb.Histogram.GetSampleCount()),
+					UpperBound:      proto.Float64(math.Inf(1)),
+					Exemplar:        e,
+				}
+				pb.Histogram.Bucket = append(pb.Histogram.Bucket, b)
+			}
+		}
+	default:
+		// TODO(bwplotka): Implement Gauge?
+		return errors.New("cannot inject exemplar into Gauge, Summary or Untyped")
+	}
+
+	return nil
+}
+
+// Exemplar is easier to use, user-facing representation of *dto.Exemplar.
+type Exemplar struct {
+	Value  float64
+	Labels Labels
+	// Optional.
+	// Default value (time.Time{}) indicates its empty, which should be
+	// understood as time.Now() time at the moment of creation of metric.
+	Timestamp time.Time
+}
+
+// NewMetricWithExemplars returns a new Metric wrapping the provided Metric with given
+// exemplars. Exemplars are validated.
+//
+// Only last applicable exemplar is injected from the list.
+// For example for Counter it means last exemplar is injected.
+// For Histogram, it means last applicable exemplar for each bucket is injected.
+//
+// NewMetricWithExemplars works best with MustNewConstMetric and
+// MustNewConstHistogram, see example.
+func NewMetricWithExemplars(m Metric, exemplars ...Exemplar) (Metric, error) {
+	if len(exemplars) == 0 {
+		return nil, errors.New("no exemplar was passed for NewMetricWithExemplars")
+	}
+
+	var (
+		now = time.Now()
+		exs = make([]*dto.Exemplar, len(exemplars))
+		err error
+	)
+	for i, e := range exemplars {
+		ts := e.Timestamp
+		if ts == (time.Time{}) {
+			ts = now
+		}
+		exs[i], err = newExemplar(e.Value, ts, e.Labels)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return &withExemplarsMetric{Metric: m, exemplars: exs}, nil
+}
+
+// MustNewMetricWithExemplars is a version of NewMetricWithExemplars that panics where
+// NewMetricWithExemplars would have returned an error.
+func MustNewMetricWithExemplars(m Metric, exemplars ...Exemplar) Metric {
+	ret, err := NewMetricWithExemplars(m, exemplars...)
+	if err != nil {
+		panic(err)
+	}
+	return ret
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/num_threads.go b/vendor/github.com/prometheus/client_golang/prometheus/num_threads.go
new file mode 100644
index 0000000000..7c12b21087
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/num_threads.go
@@ -0,0 +1,25 @@
+// Copyright 2018 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !js || wasm
+// +build !js wasm
+
+package prometheus
+
+import "runtime"
+
+// getRuntimeNumThreads returns the number of open OS threads.
+func getRuntimeNumThreads() float64 {
+	n, _ := runtime.ThreadCreateProfile(nil)
+	return float64(n)
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/num_threads_gopherjs.go b/vendor/github.com/prometheus/client_golang/prometheus/num_threads_gopherjs.go
new file mode 100644
index 0000000000..7348df01df
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/num_threads_gopherjs.go
@@ -0,0 +1,22 @@
+// Copyright 2018 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build js && !wasm
+// +build js,!wasm
+
+package prometheus
+
+// getRuntimeNumThreads returns the number of open OS threads.
+func getRuntimeNumThreads() float64 {
+	return 1
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/observer.go b/vendor/github.com/prometheus/client_golang/prometheus/observer.go
index 44128016fd..03773b21f7 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/observer.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/observer.go
@@ -58,7 +58,7 @@ type ObserverVec interface {
 // current time as timestamp, and the provided Labels. Empty Labels will lead to
 // a valid (label-less) exemplar. But if Labels is nil, the current exemplar is
 // left in place. ObserveWithExemplar panics if any of the provided labels are
-// invalid or if the provided labels contain more than 64 runes in total.
+// invalid or if the provided labels contain more than 128 runes in total.
 type ExemplarObserver interface {
 	ObserveWithExemplar(value float64, exemplar Labels)
 }
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/process_collector.go b/vendor/github.com/prometheus/client_golang/prometheus/process_collector.go
index 5bfe0ff5bb..8548dd18ed 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/process_collector.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/process_collector.go
@@ -16,7 +16,6 @@ package prometheus
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strconv"
 	"strings"
@@ -104,8 +103,7 @@ func NewProcessCollector(opts ProcessCollectorOpts) Collector {
 	}
 
 	if opts.PidFn == nil {
-		pid := os.Getpid()
-		c.pidFn = func() (int, error) { return pid, nil }
+		c.pidFn = getPIDFn()
 	} else {
 		c.pidFn = opts.PidFn
 	}
@@ -152,13 +150,13 @@ func (c *processCollector) reportError(ch chan<- Metric, desc *Desc, err error)
 // It is meant to be used for the PidFn field in ProcessCollectorOpts.
 func NewPidFileFn(pidFilePath string) func() (int, error) {
 	return func() (int, error) {
-		content, err := ioutil.ReadFile(pidFilePath)
+		content, err := os.ReadFile(pidFilePath)
 		if err != nil {
-			return 0, fmt.Errorf("can't read pid file %q: %+v", pidFilePath, err)
+			return 0, fmt.Errorf("can't read pid file %q: %w", pidFilePath, err)
 		}
 		pid, err := strconv.Atoi(strings.TrimSpace(string(content)))
 		if err != nil {
-			return 0, fmt.Errorf("can't parse pid file %q: %+v", pidFilePath, err)
+			return 0, fmt.Errorf("can't parse pid file %q: %w", pidFilePath, err)
 		}
 
 		return pid, nil
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/process_collector_js.go b/vendor/github.com/prometheus/client_golang/prometheus/process_collector_js.go
new file mode 100644
index 0000000000..b1e363d6cf
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/process_collector_js.go
@@ -0,0 +1,26 @@
+// Copyright 2019 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build js
+// +build js
+
+package prometheus
+
+func canCollectProcess() bool {
+	return false
+}
+
+func (c *processCollector) processCollect(ch chan<- Metric) {
+	// noop on this platform
+	return
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/process_collector_other.go b/vendor/github.com/prometheus/client_golang/prometheus/process_collector_other.go
index 3117461cde..c0152cdb61 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/process_collector_other.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/process_collector_other.go
@@ -11,7 +11,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// +build !windows
+//go:build !windows && !js
+// +build !windows,!js
 
 package prometheus
 
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/delegator.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/delegator.go
index e7c0d05464..9819917b83 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/delegator.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/delegator.go
@@ -76,16 +76,19 @@ func (r *responseWriterDelegator) Write(b []byte) (int, error) {
 	return n, err
 }
 
-type closeNotifierDelegator struct{ *responseWriterDelegator }
-type flusherDelegator struct{ *responseWriterDelegator }
-type hijackerDelegator struct{ *responseWriterDelegator }
-type readerFromDelegator struct{ *responseWriterDelegator }
-type pusherDelegator struct{ *responseWriterDelegator }
+type (
+	closeNotifierDelegator struct{ *responseWriterDelegator }
+	flusherDelegator       struct{ *responseWriterDelegator }
+	hijackerDelegator      struct{ *responseWriterDelegator }
+	readerFromDelegator    struct{ *responseWriterDelegator }
+	pusherDelegator        struct{ *responseWriterDelegator }
+)
 
 func (d closeNotifierDelegator) CloseNotify() <-chan bool {
 	//nolint:staticcheck // Ignore SA1019. http.CloseNotifier is deprecated but we keep it here to not break existing users.
 	return d.ResponseWriter.(http.CloseNotifier).CloseNotify()
 }
+
 func (d flusherDelegator) Flush() {
 	// If applicable, call WriteHeader here so that observeWriteHeader is
 	// handled appropriately.
@@ -94,9 +97,11 @@ func (d flusherDelegator) Flush() {
 	}
 	d.ResponseWriter.(http.Flusher).Flush()
 }
+
 func (d hijackerDelegator) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 	return d.ResponseWriter.(http.Hijacker).Hijack()
 }
+
 func (d readerFromDelegator) ReadFrom(re io.Reader) (int64, error) {
 	// If applicable, call WriteHeader here so that observeWriteHeader is
 	// handled appropriately.
@@ -107,6 +112,7 @@ func (d readerFromDelegator) ReadFrom(re io.Reader) (int64, error) {
 	d.written += n
 	return n, err
 }
+
 func (d pusherDelegator) Push(target string, opts *http.PushOptions) error {
 	return d.ResponseWriter.(http.Pusher).Push(target, opts)
 }
@@ -261,7 +267,7 @@ func init() {
 			http.Flusher
 		}{d, pusherDelegator{d}, hijackerDelegator{d}, flusherDelegator{d}}
 	}
-	pickDelegator[pusher+hijacker+flusher+closeNotifier] = func(d *responseWriterDelegator) delegator { //23
+	pickDelegator[pusher+hijacker+flusher+closeNotifier] = func(d *responseWriterDelegator) delegator { // 23
 		return struct {
 			*responseWriterDelegator
 			http.Pusher
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/http.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/http.go
index d86d0cf4b0..a4cc9810b0 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/http.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/http.go
@@ -33,6 +33,7 @@ package promhttp
 
 import (
 	"compress/gzip"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -84,6 +85,13 @@ func Handler() http.Handler {
 // instrumentation. Use the InstrumentMetricHandler function to apply the same
 // kind of instrumentation as it is used by the Handler function.
 func HandlerFor(reg prometheus.Gatherer, opts HandlerOpts) http.Handler {
+	return HandlerForTransactional(prometheus.ToTransactionalGatherer(reg), opts)
+}
+
+// HandlerForTransactional is like HandlerFor, but it uses transactional gather, which
+// can safely change in-place returned *dto.MetricFamily before call to `Gather` and after
+// call to `done` of that `Gather`.
+func HandlerForTransactional(reg prometheus.TransactionalGatherer, opts HandlerOpts) http.Handler {
 	var (
 		inFlightSem chan struct{}
 		errCnt      = prometheus.NewCounterVec(
@@ -103,7 +111,8 @@ func HandlerFor(reg prometheus.Gatherer, opts HandlerOpts) http.Handler {
 		errCnt.WithLabelValues("gathering")
 		errCnt.WithLabelValues("encoding")
 		if err := opts.Registry.Register(errCnt); err != nil {
-			if are, ok := err.(prometheus.AlreadyRegisteredError); ok {
+			are := &prometheus.AlreadyRegisteredError{}
+			if errors.As(err, are) {
 				errCnt = are.ExistingCollector.(*prometheus.CounterVec)
 			} else {
 				panic(err)
@@ -123,7 +132,8 @@ func HandlerFor(reg prometheus.Gatherer, opts HandlerOpts) http.Handler {
 				return
 			}
 		}
-		mfs, err := reg.Gather()
+		mfs, done, err := reg.Gather()
+		defer done()
 		if err != nil {
 			if opts.ErrorLog != nil {
 				opts.ErrorLog.Println("error gathering metrics:", err)
@@ -242,7 +252,8 @@ func InstrumentMetricHandler(reg prometheus.Registerer, handler http.Handler) ht
 	cnt.WithLabelValues("500")
 	cnt.WithLabelValues("503")
 	if err := reg.Register(cnt); err != nil {
-		if are, ok := err.(prometheus.AlreadyRegisteredError); ok {
+		are := &prometheus.AlreadyRegisteredError{}
+		if errors.As(err, are) {
 			cnt = are.ExistingCollector.(*prometheus.CounterVec)
 		} else {
 			panic(err)
@@ -254,7 +265,8 @@ func InstrumentMetricHandler(reg prometheus.Registerer, handler http.Handler) ht
 		Help: "Current number of scrapes being served.",
 	})
 	if err := reg.Register(gge); err != nil {
-		if are, ok := err.(prometheus.AlreadyRegisteredError); ok {
+		are := &prometheus.AlreadyRegisteredError{}
+		if errors.As(err, are) {
 			gge = are.ExistingCollector.(prometheus.Gauge)
 		} else {
 			panic(err)
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go
index 83c49b66a8..d3482c40ca 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_client.go
@@ -38,42 +38,60 @@ func (rt RoundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) {
 //
 // See the example for ExampleInstrumentRoundTripperDuration for example usage.
 func InstrumentRoundTripperInFlight(gauge prometheus.Gauge, next http.RoundTripper) RoundTripperFunc {
-	return RoundTripperFunc(func(r *http.Request) (*http.Response, error) {
+	return func(r *http.Request) (*http.Response, error) {
 		gauge.Inc()
 		defer gauge.Dec()
 		return next.RoundTrip(r)
-	})
+	}
 }
 
 // InstrumentRoundTripperCounter is a middleware that wraps the provided
 // http.RoundTripper to observe the request result with the provided CounterVec.
 // The CounterVec must have zero, one, or two non-const non-curried labels. For
 // those, the only allowed label names are "code" and "method". The function
-// panics otherwise. Partitioning of the CounterVec happens by HTTP status code
+// panics otherwise. For the "method" label a predefined default label value set
+// is used to filter given values. Values besides predefined values will count
+// as `unknown` method.`WithExtraMethods` can be used to add more
+// methods to the set. Partitioning of the CounterVec happens by HTTP status code
 // and/or HTTP method if the respective instance label names are present in the
 // CounterVec. For unpartitioned counting, use a CounterVec with zero labels.
 //
 // If the wrapped RoundTripper panics or returns a non-nil error, the Counter
 // is not incremented.
 //
+// Use with WithExemplarFromContext to instrument the exemplars on the counter of requests.
+//
 // See the example for ExampleInstrumentRoundTripperDuration for example usage.
-func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper) RoundTripperFunc {
-	code, method := checkLabels(counter)
+func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.RoundTripper, opts ...Option) RoundTripperFunc {
+	rtOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(rtOpts)
+	}
+
+	// Curry the counter with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(counter.MustCurryWith(rtOpts.emptyDynamicLabels()))
 
-	return RoundTripperFunc(func(r *http.Request) (*http.Response, error) {
+	return func(r *http.Request) (*http.Response, error) {
 		resp, err := next.RoundTrip(r)
 		if err == nil {
-			counter.With(labels(code, method, r.Method, resp.StatusCode)).Inc()
+			l := labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)
+			for label, resolve := range rtOpts.extraLabelsFromCtx {
+				l[label] = resolve(resp.Request.Context())
+			}
+			addWithExemplar(counter.With(l), 1, rtOpts.getExemplarFn(r.Context()))
 		}
 		return resp, err
-	})
+	}
 }
 
 // InstrumentRoundTripperDuration is a middleware that wraps the provided
 // http.RoundTripper to observe the request duration with the provided
 // ObserverVec.  The ObserverVec must have zero, one, or two non-const
 // non-curried labels. For those, the only allowed label names are "code" and
-// "method". The function panics otherwise. The Observe method of the Observer
+// "method". The function panics otherwise. For the "method" label a predefined
+// default label value set is used to filter given values. Values besides
+// predefined values will count as `unknown` method. `WithExtraMethods`
+// can be used to add more methods to the set. The Observe method of the Observer
 // in the ObserverVec is called with the request duration in
 // seconds. Partitioning happens by HTTP status code and/or HTTP method if the
 // respective instance label names are present in the ObserverVec. For
@@ -83,19 +101,31 @@ func InstrumentRoundTripperCounter(counter *prometheus.CounterVec, next http.Rou
 // If the wrapped RoundTripper panics or returns a non-nil error, no values are
 // reported.
 //
+// Use with WithExemplarFromContext to instrument the exemplars on the duration histograms.
+//
 // Note that this method is only guaranteed to never observe negative durations
 // if used with Go1.9+.
-func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper) RoundTripperFunc {
-	code, method := checkLabels(obs)
+func InstrumentRoundTripperDuration(obs prometheus.ObserverVec, next http.RoundTripper, opts ...Option) RoundTripperFunc {
+	rtOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(rtOpts)
+	}
+
+	// Curry the observer with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(obs.MustCurryWith(rtOpts.emptyDynamicLabels()))
 
-	return RoundTripperFunc(func(r *http.Request) (*http.Response, error) {
+	return func(r *http.Request) (*http.Response, error) {
 		start := time.Now()
 		resp, err := next.RoundTrip(r)
 		if err == nil {
-			obs.With(labels(code, method, r.Method, resp.StatusCode)).Observe(time.Since(start).Seconds())
+			l := labels(code, method, r.Method, resp.StatusCode, rtOpts.extraMethods...)
+			for label, resolve := range rtOpts.extraLabelsFromCtx {
+				l[label] = resolve(resp.Request.Context())
+			}
+			observeWithExemplar(obs.With(l), time.Since(start).Seconds(), rtOpts.getExemplarFn(r.Context()))
 		}
 		return resp, err
-	})
+	}
 }
 
 // InstrumentTrace is used to offer flexibility in instrumenting the available
@@ -133,7 +163,7 @@ type InstrumentTrace struct {
 //
 // See the example for ExampleInstrumentRoundTripperDuration for example usage.
 func InstrumentRoundTripperTrace(it *InstrumentTrace, next http.RoundTripper) RoundTripperFunc {
-	return RoundTripperFunc(func(r *http.Request) (*http.Response, error) {
+	return func(r *http.Request) (*http.Response, error) {
 		start := time.Now()
 
 		trace := &httptrace.ClientTrace{
@@ -215,5 +245,5 @@ func InstrumentRoundTripperTrace(it *InstrumentTrace, next http.RoundTripper) Ro
 		r = r.WithContext(httptrace.WithClientTrace(r.Context(), trace))
 
 		return next.RoundTrip(r)
-	})
+	}
 }
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go
index ab037db861..3793036ad0 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go
@@ -28,6 +28,26 @@ import (
 // magicString is used for the hacky label test in checkLabels. Remove once fixed.
 const magicString = "zZgWfBxLqvG8kc8IMv3POi2Bb0tZI3vAnBx+gBaFi9FyPzB/CzKUer1yufDa"
 
+// observeWithExemplar is a wrapper for [prometheus.ExemplarAdder.ExemplarObserver],
+// which falls back to [prometheus.Observer.Observe] if no labels are provided.
+func observeWithExemplar(obs prometheus.Observer, val float64, labels map[string]string) {
+	if labels == nil {
+		obs.Observe(val)
+		return
+	}
+	obs.(prometheus.ExemplarObserver).ObserveWithExemplar(val, labels)
+}
+
+// addWithExemplar is a wrapper for [prometheus.ExemplarAdder.AddWithExemplar],
+// which falls back to [prometheus.Counter.Add] if no labels are provided.
+func addWithExemplar(obs prometheus.Counter, val float64, labels map[string]string) {
+	if labels == nil {
+		obs.Add(val)
+		return
+	}
+	obs.(prometheus.ExemplarAdder).AddWithExemplar(val, labels)
+}
+
 // InstrumentHandlerInFlight is a middleware that wraps the provided
 // http.Handler. It sets the provided prometheus.Gauge to the number of
 // requests currently handled by the wrapped http.Handler.
@@ -45,7 +65,10 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl
 // http.Handler to observe the request duration with the provided ObserverVec.
 // The ObserverVec must have valid metric and label names and must have zero,
 // one, or two non-const non-curried labels. For those, the only allowed label
-// names are "code" and "method". The function panics otherwise. The Observe
+// names are "code" and "method". The function panics otherwise. For the "method"
+// label a predefined default label value set is used to filter given values.
+// Values besides predefined values will count as `unknown` method.
+// `WithExtraMethods` can be used to add more methods to the set. The Observe
 // method of the Observer in the ObserverVec is called with the request duration
 // in seconds. Partitioning happens by HTTP status code and/or HTTP method if
 // the respective instance label names are present in the ObserverVec. For
@@ -58,31 +81,48 @@ func InstrumentHandlerInFlight(g prometheus.Gauge, next http.Handler) http.Handl
 //
 // Note that this method is only guaranteed to never observe negative durations
 // if used with Go1.9+.
-func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc {
-	code, method := checkLabels(obs)
+func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc {
+	hOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(hOpts)
+	}
+
+	// Curry the observer with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(obs.MustCurryWith(hOpts.emptyDynamicLabels()))
 
 	if code {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return func(w http.ResponseWriter, r *http.Request) {
 			now := time.Now()
 			d := newDelegator(w, nil)
 			next.ServeHTTP(d, r)
 
-			obs.With(labels(code, method, r.Method, d.Status())).Observe(time.Since(now).Seconds())
-		})
+			l := labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)
+			for label, resolve := range hOpts.extraLabelsFromCtx {
+				l[label] = resolve(r.Context())
+			}
+			observeWithExemplar(obs.With(l), time.Since(now).Seconds(), hOpts.getExemplarFn(r.Context()))
+		}
 	}
 
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
 		now := time.Now()
 		next.ServeHTTP(w, r)
-		obs.With(labels(code, method, r.Method, 0)).Observe(time.Since(now).Seconds())
-	})
+		l := labels(code, method, r.Method, 0, hOpts.extraMethods...)
+		for label, resolve := range hOpts.extraLabelsFromCtx {
+			l[label] = resolve(r.Context())
+		}
+		observeWithExemplar(obs.With(l), time.Since(now).Seconds(), hOpts.getExemplarFn(r.Context()))
+	}
 }
 
 // InstrumentHandlerCounter is a middleware that wraps the provided http.Handler
 // to observe the request result with the provided CounterVec. The CounterVec
 // must have valid metric and label names and must have zero, one, or two
 // non-const non-curried labels. For those, the only allowed label names are
-// "code" and "method". The function panics otherwise. Partitioning of the
+// "code" and "method". The function panics otherwise. For the "method"
+// label a predefined default label value set is used to filter given values.
+// Values besides predefined values will count as `unknown` method.
+// `WithExtraMethods` can be used to add more methods to the set. Partitioning of the
 // CounterVec happens by HTTP status code and/or HTTP method if the respective
 // instance label names are present in the CounterVec. For unpartitioned
 // counting, use a CounterVec with zero labels.
@@ -92,21 +132,37 @@ func InstrumentHandlerDuration(obs prometheus.ObserverVec, next http.Handler) ht
 // If the wrapped Handler panics, the Counter is not incremented.
 //
 // See the example for InstrumentHandlerDuration for example usage.
-func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler) http.HandlerFunc {
-	code, method := checkLabels(counter)
+func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler, opts ...Option) http.HandlerFunc {
+	hOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(hOpts)
+	}
+
+	// Curry the counter with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(counter.MustCurryWith(hOpts.emptyDynamicLabels()))
 
 	if code {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return func(w http.ResponseWriter, r *http.Request) {
 			d := newDelegator(w, nil)
 			next.ServeHTTP(d, r)
-			counter.With(labels(code, method, r.Method, d.Status())).Inc()
-		})
+
+			l := labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)
+			for label, resolve := range hOpts.extraLabelsFromCtx {
+				l[label] = resolve(r.Context())
+			}
+			addWithExemplar(counter.With(l), 1, hOpts.getExemplarFn(r.Context()))
+		}
 	}
 
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
 		next.ServeHTTP(w, r)
-		counter.With(labels(code, method, r.Method, 0)).Inc()
-	})
+
+		l := labels(code, method, r.Method, 0, hOpts.extraMethods...)
+		for label, resolve := range hOpts.extraLabelsFromCtx {
+			l[label] = resolve(r.Context())
+		}
+		addWithExemplar(counter.With(l), 1, hOpts.getExemplarFn(r.Context()))
+	}
 }
 
 // InstrumentHandlerTimeToWriteHeader is a middleware that wraps the provided
@@ -114,7 +170,10 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler)
 // until the response headers are written. The ObserverVec must have valid
 // metric and label names and must have zero, one, or two non-const non-curried
 // labels. For those, the only allowed label names are "code" and "method". The
-// function panics otherwise. The Observe method of the Observer in the
+// function panics otherwise. For the "method" label a predefined default label
+// value set is used to filter given values. Values besides predefined values
+// will count as `unknown` method.`WithExtraMethods` can be used to add more
+// methods to the set. The Observe method of the Observer in the
 // ObserverVec is called with the request duration in seconds. Partitioning
 // happens by HTTP status code and/or HTTP method if the respective instance
 // label names are present in the ObserverVec. For unpartitioned observations,
@@ -128,24 +187,37 @@ func InstrumentHandlerCounter(counter *prometheus.CounterVec, next http.Handler)
 // if used with Go1.9+.
 //
 // See the example for InstrumentHandlerDuration for example usage.
-func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc {
-	code, method := checkLabels(obs)
+func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc {
+	hOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(hOpts)
+	}
 
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	// Curry the observer with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(obs.MustCurryWith(hOpts.emptyDynamicLabels()))
+
+	return func(w http.ResponseWriter, r *http.Request) {
 		now := time.Now()
 		d := newDelegator(w, func(status int) {
-			obs.With(labels(code, method, r.Method, status)).Observe(time.Since(now).Seconds())
+			l := labels(code, method, r.Method, status, hOpts.extraMethods...)
+			for label, resolve := range hOpts.extraLabelsFromCtx {
+				l[label] = resolve(r.Context())
+			}
+			observeWithExemplar(obs.With(l), time.Since(now).Seconds(), hOpts.getExemplarFn(r.Context()))
 		})
 		next.ServeHTTP(d, r)
-	})
+	}
 }
 
 // InstrumentHandlerRequestSize is a middleware that wraps the provided
 // http.Handler to observe the request size with the provided ObserverVec. The
 // ObserverVec must have valid metric and label names and must have zero, one,
 // or two non-const non-curried labels. For those, the only allowed label names
-// are "code" and "method". The function panics otherwise. The Observe method of
-// the Observer in the ObserverVec is called with the request size in
+// are "code" and "method". The function panics otherwise. For the "method"
+// label a predefined default label value set is used to filter given values.
+// Values besides predefined values will count as `unknown` method.
+// `WithExtraMethods` can be used to add more methods to the set. The Observe
+// method of the Observer in the ObserverVec is called with the request size in
 // bytes. Partitioning happens by HTTP status code and/or HTTP method if the
 // respective instance label names are present in the ObserverVec. For
 // unpartitioned observations, use an ObserverVec with zero labels. Note that
@@ -156,31 +228,50 @@ func InstrumentHandlerTimeToWriteHeader(obs prometheus.ObserverVec, next http.Ha
 // If the wrapped Handler panics, no values are reported.
 //
 // See the example for InstrumentHandlerDuration for example usage.
-func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler) http.HandlerFunc {
-	code, method := checkLabels(obs)
+func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.HandlerFunc {
+	hOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(hOpts)
+	}
+
+	// Curry the observer with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(obs.MustCurryWith(hOpts.emptyDynamicLabels()))
 
 	if code {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		return func(w http.ResponseWriter, r *http.Request) {
 			d := newDelegator(w, nil)
 			next.ServeHTTP(d, r)
 			size := computeApproximateRequestSize(r)
-			obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(size))
-		})
+
+			l := labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)
+			for label, resolve := range hOpts.extraLabelsFromCtx {
+				l[label] = resolve(r.Context())
+			}
+			observeWithExemplar(obs.With(l), float64(size), hOpts.getExemplarFn(r.Context()))
+		}
 	}
 
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
 		next.ServeHTTP(w, r)
 		size := computeApproximateRequestSize(r)
-		obs.With(labels(code, method, r.Method, 0)).Observe(float64(size))
-	})
+
+		l := labels(code, method, r.Method, 0, hOpts.extraMethods...)
+		for label, resolve := range hOpts.extraLabelsFromCtx {
+			l[label] = resolve(r.Context())
+		}
+		observeWithExemplar(obs.With(l), float64(size), hOpts.getExemplarFn(r.Context()))
+	}
 }
 
 // InstrumentHandlerResponseSize is a middleware that wraps the provided
 // http.Handler to observe the response size with the provided ObserverVec. The
 // ObserverVec must have valid metric and label names and must have zero, one,
 // or two non-const non-curried labels. For those, the only allowed label names
-// are "code" and "method". The function panics otherwise. The Observe method of
-// the Observer in the ObserverVec is called with the response size in
+// are "code" and "method". The function panics otherwise. For the "method"
+// label a predefined default label value set is used to filter given values.
+// Values besides predefined values will count as `unknown` method.
+// `WithExtraMethods` can be used to add more methods to the set. The Observe
+// method of the Observer in the ObserverVec is called with the response size in
 // bytes. Partitioning happens by HTTP status code and/or HTTP method if the
 // respective instance label names are present in the ObserverVec. For
 // unpartitioned observations, use an ObserverVec with zero labels. Note that
@@ -191,12 +282,24 @@ func InstrumentHandlerRequestSize(obs prometheus.ObserverVec, next http.Handler)
 // If the wrapped Handler panics, no values are reported.
 //
 // See the example for InstrumentHandlerDuration for example usage.
-func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler) http.Handler {
-	code, method := checkLabels(obs)
+func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler, opts ...Option) http.Handler {
+	hOpts := defaultOptions()
+	for _, o := range opts {
+		o.apply(hOpts)
+	}
+
+	// Curry the observer with dynamic labels before checking the remaining labels.
+	code, method := checkLabels(obs.MustCurryWith(hOpts.emptyDynamicLabels()))
+
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		d := newDelegator(w, nil)
 		next.ServeHTTP(d, r)
-		obs.With(labels(code, method, r.Method, d.Status())).Observe(float64(d.Written()))
+
+		l := labels(code, method, r.Method, d.Status(), hOpts.extraMethods...)
+		for label, resolve := range hOpts.extraLabelsFromCtx {
+			l[label] = resolve(r.Context())
+		}
+		observeWithExemplar(obs.With(l), float64(d.Written()), hOpts.getExemplarFn(r.Context()))
 	})
 }
 
@@ -205,7 +308,7 @@ func InstrumentHandlerResponseSize(obs prometheus.ObserverVec, next http.Handler
 // Collector does not have a Desc or has more than one Desc or its Desc is
 // invalid. It also panics if the Collector has any non-const, non-curried
 // labels that are not named "code" or "method".
-func checkLabels(c prometheus.Collector) (code bool, method bool) {
+func checkLabels(c prometheus.Collector) (code, method bool) {
 	// TODO(beorn7): Remove this hacky way to check for instance labels
 	// once Descriptors can have their dimensionality queried.
 	var (
@@ -290,7 +393,7 @@ func isLabelCurried(c prometheus.Collector, label string) bool {
 // unnecessary allocations on each request.
 var emptyLabels = prometheus.Labels{}
 
-func labels(code, method bool, reqMethod string, status int) prometheus.Labels {
+func labels(code, method bool, reqMethod string, status int, extraMethods ...string) prometheus.Labels {
 	if !(code || method) {
 		return emptyLabels
 	}
@@ -300,7 +403,7 @@ func labels(code, method bool, reqMethod string, status int) prometheus.Labels {
 		labels["code"] = sanitizeCode(status)
 	}
 	if method {
-		labels["method"] = sanitizeMethod(reqMethod)
+		labels["method"] = sanitizeMethod(reqMethod, extraMethods...)
 	}
 
 	return labels
@@ -330,7 +433,12 @@ func computeApproximateRequestSize(r *http.Request) int {
 	return s
 }
 
-func sanitizeMethod(m string) string {
+// If the wrapped http.Handler has a known method, it will be sanitized and returned.
+// Otherwise, "unknown" will be returned. The known method list can be extended
+// as needed by using extraMethods parameter.
+func sanitizeMethod(m string, extraMethods ...string) string {
+	// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for
+	// the methods chosen as default.
 	switch m {
 	case "GET", "get":
 		return "get"
@@ -348,15 +456,25 @@ func sanitizeMethod(m string) string {
 		return "options"
 	case "NOTIFY", "notify":
 		return "notify"
+	case "TRACE", "trace":
+		return "trace"
+	case "PATCH", "patch":
+		return "patch"
 	default:
-		return strings.ToLower(m)
+		for _, method := range extraMethods {
+			if strings.EqualFold(m, method) {
+				return strings.ToLower(m)
+			}
+		}
+		return "unknown"
 	}
 }
 
 // If the wrapped http.Handler has not set a status code, i.e. the value is
-// currently 0, santizeCode will return 200, for consistency with behavior in
+// currently 0, sanitizeCode will return 200, for consistency with behavior in
 // the stdlib.
 func sanitizeCode(s int) string {
+	// See for accepted codes https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
 	switch s {
 	case 100:
 		return "100"
@@ -453,6 +571,9 @@ func sanitizeCode(s int) string {
 		return "511"
 
 	default:
-		return strconv.Itoa(s)
+		if s >= 100 && s <= 599 {
+			return strconv.Itoa(s)
+		}
+		return "unknown"
 	}
 }
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go
new file mode 100644
index 0000000000..5d4383aa14
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/promhttp/option.go
@@ -0,0 +1,84 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package promhttp
+
+import (
+	"context"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// Option are used to configure both handler (middleware) or round tripper.
+type Option interface {
+	apply(*options)
+}
+
+// LabelValueFromCtx are used to compute the label value from request context.
+// Context can be filled with values from request through middleware.
+type LabelValueFromCtx func(ctx context.Context) string
+
+// options store options for both a handler or round tripper.
+type options struct {
+	extraMethods       []string
+	getExemplarFn      func(requestCtx context.Context) prometheus.Labels
+	extraLabelsFromCtx map[string]LabelValueFromCtx
+}
+
+func defaultOptions() *options {
+	return &options{
+		getExemplarFn:      func(ctx context.Context) prometheus.Labels { return nil },
+		extraLabelsFromCtx: map[string]LabelValueFromCtx{},
+	}
+}
+
+func (o *options) emptyDynamicLabels() prometheus.Labels {
+	labels := prometheus.Labels{}
+
+	for label := range o.extraLabelsFromCtx {
+		labels[label] = ""
+	}
+
+	return labels
+}
+
+type optionApplyFunc func(*options)
+
+func (o optionApplyFunc) apply(opt *options) { o(opt) }
+
+// WithExtraMethods adds additional HTTP methods to the list of allowed methods.
+// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods for the default list.
+//
+// See the example for ExampleInstrumentHandlerWithExtraMethods for example usage.
+func WithExtraMethods(methods ...string) Option {
+	return optionApplyFunc(func(o *options) {
+		o.extraMethods = methods
+	})
+}
+
+// WithExemplarFromContext allows to inject function that will get exemplar from context that will be put to counter and histogram metrics.
+// If the function returns nil labels or the metric does not support exemplars, no exemplar will be added (noop), but
+// metric will continue to observe/increment.
+func WithExemplarFromContext(getExemplarFn func(requestCtx context.Context) prometheus.Labels) Option {
+	return optionApplyFunc(func(o *options) {
+		o.getExemplarFn = getExemplarFn
+	})
+}
+
+// WithLabelFromCtx registers a label for dynamic resolution with access to context.
+// See the example for ExampleInstrumentHandlerWithLabelResolver for example usage
+func WithLabelFromCtx(name string, valueFn LabelValueFromCtx) Option {
+	return optionApplyFunc(func(o *options) {
+		o.extraLabelsFromCtx[name] = valueFn
+	})
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/registry.go b/vendor/github.com/prometheus/client_golang/prometheus/registry.go
index 383a7f5941..44da9433be 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/registry.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/registry.go
@@ -15,24 +15,23 @@ package prometheus
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"unicode/utf8"
 
-	"github.com/cespare/xxhash/v2"
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
-	"github.com/prometheus/common/expfmt"
+	"github.com/prometheus/client_golang/prometheus/internal"
 
+	"github.com/cespare/xxhash/v2"
 	dto "github.com/prometheus/client_model/go"
-
-	"github.com/prometheus/client_golang/prometheus/internal"
+	"github.com/prometheus/common/expfmt"
+	"google.golang.org/protobuf/proto"
 )
 
 const (
@@ -252,9 +251,12 @@ func (errs MultiError) MaybeUnwrap() error {
 }
 
 // Registry registers Prometheus collectors, collects their metrics, and gathers
-// them into MetricFamilies for exposition. It implements both Registerer and
-// Gatherer. The zero value is not usable. Create instances with NewRegistry or
-// NewPedanticRegistry.
+// them into MetricFamilies for exposition. It implements Registerer, Gatherer,
+// and Collector. The zero value is not usable. Create instances with
+// NewRegistry or NewPedanticRegistry.
+//
+// Registry implements Collector to allow it to be used for creating groups of
+// metrics. See the Grouping example for how this can be done.
 type Registry struct {
 	mtx                   sync.RWMutex
 	collectorsByID        map[uint64]Collector // ID is a hash of the descIDs.
@@ -289,7 +291,7 @@ func (r *Registry) Register(c Collector) error {
 
 		// Is the descriptor valid at all?
 		if desc.err != nil {
-			return fmt.Errorf("descriptor %s is invalid: %s", desc, desc.err)
+			return fmt.Errorf("descriptor %s is invalid: %w", desc, desc.err)
 		}
 
 		// Is the descID unique?
@@ -407,6 +409,14 @@ func (r *Registry) MustRegister(cs ...Collector) {
 
 // Gather implements Gatherer.
 func (r *Registry) Gather() ([]*dto.MetricFamily, error) {
+	r.mtx.RLock()
+
+	if len(r.collectorsByID) == 0 && len(r.uncheckedCollectors) == 0 {
+		// Fast path.
+		r.mtx.RUnlock()
+		return nil, nil
+	}
+
 	var (
 		checkedMetricChan   = make(chan Metric, capMetricChan)
 		uncheckedMetricChan = make(chan Metric, capMetricChan)
@@ -416,7 +426,6 @@ func (r *Registry) Gather() ([]*dto.MetricFamily, error) {
 		registeredDescIDs   map[uint64]struct{} // Only used for pedantic checks
 	)
 
-	r.mtx.RLock()
 	goroutineBudget := len(r.collectorsByID) + len(r.uncheckedCollectors)
 	metricFamiliesByName := make(map[string]*dto.MetricFamily, len(r.dimHashesByName))
 	checkedCollectors := make(chan Collector, len(r.collectorsByID))
@@ -549,6 +558,31 @@ func (r *Registry) Gather() ([]*dto.MetricFamily, error) {
 	return internal.NormalizeMetricFamilies(metricFamiliesByName), errs.MaybeUnwrap()
 }
 
+// Describe implements Collector.
+func (r *Registry) Describe(ch chan<- *Desc) {
+	r.mtx.RLock()
+	defer r.mtx.RUnlock()
+
+	// Only report the checked Collectors; unchecked collectors don't report any
+	// Desc.
+	for _, c := range r.collectorsByID {
+		c.Describe(ch)
+	}
+}
+
+// Collect implements Collector.
+func (r *Registry) Collect(ch chan<- Metric) {
+	r.mtx.RLock()
+	defer r.mtx.RUnlock()
+
+	for _, c := range r.collectorsByID {
+		c.Collect(ch)
+	}
+	for _, c := range r.uncheckedCollectors {
+		c.Collect(ch)
+	}
+}
+
 // WriteToTextfile calls Gather on the provided Gatherer, encodes the result in the
 // Prometheus text format, and writes it to a temporary file. Upon success, the
 // temporary file is renamed to the provided filename.
@@ -556,7 +590,7 @@ func (r *Registry) Gather() ([]*dto.MetricFamily, error) {
 // This is intended for use with the textfile collector of the node exporter.
 // Note that the node exporter expects the filename to be suffixed with ".prom".
 func WriteToTextfile(filename string, g Gatherer) error {
-	tmp, err := ioutil.TempFile(filepath.Dir(filename), filepath.Base(filename))
+	tmp, err := os.CreateTemp(filepath.Dir(filename), filepath.Base(filename))
 	if err != nil {
 		return err
 	}
@@ -575,7 +609,7 @@ func WriteToTextfile(filename string, g Gatherer) error {
 		return err
 	}
 
-	if err := os.Chmod(tmp.Name(), 0644); err != nil {
+	if err := os.Chmod(tmp.Name(), 0o644); err != nil {
 		return err
 	}
 	return os.Rename(tmp.Name(), filename)
@@ -596,7 +630,7 @@ func processMetric(
 	}
 	dtoMetric := &dto.Metric{}
 	if err := metric.Write(dtoMetric); err != nil {
-		return fmt.Errorf("error collecting metric %v: %s", desc, err)
+		return fmt.Errorf("error collecting metric %v: %w", desc, err)
 	}
 	metricFamily, ok := metricFamiliesByName[desc.fqName]
 	if ok { // Existing name.
@@ -718,12 +752,13 @@ func (gs Gatherers) Gather() ([]*dto.MetricFamily, error) {
 	for i, g := range gs {
 		mfs, err := g.Gather()
 		if err != nil {
-			if multiErr, ok := err.(MultiError); ok {
+			multiErr := MultiError{}
+			if errors.As(err, &multiErr) {
 				for _, err := range multiErr {
-					errs = append(errs, fmt.Errorf("[from Gatherer #%d] %s", i+1, err))
+					errs = append(errs, fmt.Errorf("[from Gatherer #%d] %w", i+1, err))
 				}
 			} else {
-				errs = append(errs, fmt.Errorf("[from Gatherer #%d] %s", i+1, err))
+				errs = append(errs, fmt.Errorf("[from Gatherer #%d] %w", i+1, err))
 			}
 		}
 		for _, mf := range mfs {
@@ -884,11 +919,11 @@ func checkMetricConsistency(
 	h.Write(separatorByteSlice)
 	// Make sure label pairs are sorted. We depend on it for the consistency
 	// check.
-	if !sort.IsSorted(labelPairSorter(dtoMetric.Label)) {
+	if !sort.IsSorted(internal.LabelPairSorter(dtoMetric.Label)) {
 		// We cannot sort dtoMetric.Label in place as it is immutable by contract.
 		copiedLabels := make([]*dto.LabelPair, len(dtoMetric.Label))
 		copy(copiedLabels, dtoMetric.Label)
-		sort.Sort(labelPairSorter(copiedLabels))
+		sort.Sort(internal.LabelPairSorter(copiedLabels))
 		dtoMetric.Label = copiedLabels
 	}
 	for _, lp := range dtoMetric.Label {
@@ -897,6 +932,10 @@ func checkMetricConsistency(
 		h.WriteString(lp.GetValue())
 		h.Write(separatorByteSlice)
 	}
+	if dtoMetric.TimestampMs != nil {
+		h.WriteString(strconv.FormatInt(*(dtoMetric.TimestampMs), 10))
+		h.Write(separatorByteSlice)
+	}
 	hSum := h.Sum64()
 	if _, exists := metricHashes[hSum]; exists {
 		return fmt.Errorf(
@@ -926,7 +965,7 @@ func checkDescConsistency(
 	copy(lpsFromDesc, desc.constLabelPairs)
 	for _, l := range desc.variableLabels {
 		lpsFromDesc = append(lpsFromDesc, &dto.LabelPair{
-			Name: proto.String(l),
+			Name: proto.String(l.Name),
 		})
 	}
 	if len(lpsFromDesc) != len(dtoMetric.Label) {
@@ -935,7 +974,7 @@ func checkDescConsistency(
 			metricFamily.GetName(), dtoMetric, desc,
 		)
 	}
-	sort.Sort(labelPairSorter(lpsFromDesc))
+	sort.Sort(internal.LabelPairSorter(lpsFromDesc))
 	for i, lpFromDesc := range lpsFromDesc {
 		lpFromMetric := dtoMetric.Label[i]
 		if lpFromDesc.GetName() != lpFromMetric.GetName() ||
@@ -948,3 +987,89 @@ func checkDescConsistency(
 	}
 	return nil
 }
+
+var _ TransactionalGatherer = &MultiTRegistry{}
+
+// MultiTRegistry is a TransactionalGatherer that joins gathered metrics from multiple
+// transactional gatherers.
+//
+// It is caller responsibility to ensure two registries have mutually exclusive metric families,
+// no deduplication will happen.
+type MultiTRegistry struct {
+	tGatherers []TransactionalGatherer
+}
+
+// NewMultiTRegistry creates MultiTRegistry.
+func NewMultiTRegistry(tGatherers ...TransactionalGatherer) *MultiTRegistry {
+	return &MultiTRegistry{
+		tGatherers: tGatherers,
+	}
+}
+
+// Gather implements TransactionalGatherer interface.
+func (r *MultiTRegistry) Gather() (mfs []*dto.MetricFamily, done func(), err error) {
+	errs := MultiError{}
+
+	dFns := make([]func(), 0, len(r.tGatherers))
+	// TODO(bwplotka): Implement concurrency for those?
+	for _, g := range r.tGatherers {
+		// TODO(bwplotka): Check for duplicates?
+		m, d, err := g.Gather()
+		errs.Append(err)
+
+		mfs = append(mfs, m...)
+		dFns = append(dFns, d)
+	}
+
+	// TODO(bwplotka): Consider sort in place, given metric family in gather is sorted already.
+	sort.Slice(mfs, func(i, j int) bool {
+		return *mfs[i].Name < *mfs[j].Name
+	})
+	return mfs, func() {
+		for _, d := range dFns {
+			d()
+		}
+	}, errs.MaybeUnwrap()
+}
+
+// TransactionalGatherer represents transactional gatherer that can be triggered to notify gatherer that memory
+// used by metric family is no longer used by a caller. This allows implementations with cache.
+type TransactionalGatherer interface {
+	// Gather returns metrics in a lexicographically sorted slice
+	// of uniquely named MetricFamily protobufs. Gather ensures that the
+	// returned slice is valid and self-consistent so that it can be used
+	// for valid exposition. As an exception to the strict consistency
+	// requirements described for metric.Desc, Gather will tolerate
+	// different sets of label names for metrics of the same metric family.
+	//
+	// Even if an error occurs, Gather attempts to gather as many metrics as
+	// possible. Hence, if a non-nil error is returned, the returned
+	// MetricFamily slice could be nil (in case of a fatal error that
+	// prevented any meaningful metric collection) or contain a number of
+	// MetricFamily protobufs, some of which might be incomplete, and some
+	// might be missing altogether. The returned error (which might be a
+	// MultiError) explains the details. Note that this is mostly useful for
+	// debugging purposes. If the gathered protobufs are to be used for
+	// exposition in actual monitoring, it is almost always better to not
+	// expose an incomplete result and instead disregard the returned
+	// MetricFamily protobufs in case the returned error is non-nil.
+	//
+	// Important: done is expected to be triggered (even if the error occurs!)
+	// once caller does not need returned slice of dto.MetricFamily.
+	Gather() (_ []*dto.MetricFamily, done func(), err error)
+}
+
+// ToTransactionalGatherer transforms Gatherer to transactional one with noop as done function.
+func ToTransactionalGatherer(g Gatherer) TransactionalGatherer {
+	return &noTransactionGatherer{g: g}
+}
+
+type noTransactionGatherer struct {
+	g Gatherer
+}
+
+// Gather implements TransactionalGatherer interface.
+func (g *noTransactionGatherer) Gather() (_ []*dto.MetricFamily, done func(), err error) {
+	mfs, err := g.g.Gather()
+	return mfs, func() {}, err
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/summary.go b/vendor/github.com/prometheus/client_golang/prometheus/summary.go
index c5fa8ed7c7..dd359264e5 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/summary.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/summary.go
@@ -22,11 +22,10 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/beorn7/perks/quantile"
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
-
 	dto "github.com/prometheus/client_model/go"
+
+	"github.com/beorn7/perks/quantile"
+	"google.golang.org/protobuf/proto"
 )
 
 // quantileLabel is used for the label that defines the quantile in a
@@ -148,6 +147,18 @@ type SummaryOpts struct {
 	BufCap uint32
 }
 
+// SummaryVecOpts bundles the options to create a SummaryVec metric.
+// It is mandatory to set SummaryOpts, see there for mandatory fields. VariableLabels
+// is optional and can safely be left to its default value.
+type SummaryVecOpts struct {
+	SummaryOpts
+
+	// VariableLabels are used to partition the metric vector by the given set
+	// of labels. Each label value will be constrained with the optional Contraint
+	// function, if provided.
+	VariableLabels ConstrainableLabels
+}
+
 // Problem with the sliding-window decay algorithm... The Merge method of
 // perk/quantile is actually not working as advertised - and it might be
 // unfixable, as the underlying algorithm is apparently not capable of merging
@@ -178,11 +189,11 @@ func NewSummary(opts SummaryOpts) Summary {
 
 func newSummary(desc *Desc, opts SummaryOpts, labelValues ...string) Summary {
 	if len(desc.variableLabels) != len(labelValues) {
-		panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels, labelValues))
+		panic(makeInconsistentCardinalityError(desc.fqName, desc.variableLabels.labelNames(), labelValues))
 	}
 
 	for _, n := range desc.variableLabels {
-		if n == quantileLabel {
+		if n.Name == quantileLabel {
 			panic(errQuantileLabelNotAllowed)
 		}
 	}
@@ -530,20 +541,28 @@ type SummaryVec struct {
 // it is handled by the Prometheus server internally, “quantile” is an illegal
 // label name. NewSummaryVec will panic if this label name is used.
 func NewSummaryVec(opts SummaryOpts, labelNames []string) *SummaryVec {
-	for _, ln := range labelNames {
+	return V2.NewSummaryVec(SummaryVecOpts{
+		SummaryOpts:    opts,
+		VariableLabels: UnconstrainedLabels(labelNames),
+	})
+}
+
+// NewSummaryVec creates a new SummaryVec based on the provided SummaryVecOpts.
+func (v2) NewSummaryVec(opts SummaryVecOpts) *SummaryVec {
+	for _, ln := range opts.VariableLabels.labelNames() {
 		if ln == quantileLabel {
 			panic(errQuantileLabelNotAllowed)
 		}
 	}
-	desc := NewDesc(
+	desc := V2.NewDesc(
 		BuildFQName(opts.Namespace, opts.Subsystem, opts.Name),
 		opts.Help,
-		labelNames,
+		opts.VariableLabels,
 		opts.ConstLabels,
 	)
 	return &SummaryVec{
 		MetricVec: NewMetricVec(desc, func(lvs ...string) Metric {
-			return newSummary(desc, opts, lvs...)
+			return newSummary(desc, opts.SummaryOpts, lvs...)
 		}),
 	}
 }
@@ -603,7 +622,8 @@ func (v *SummaryVec) GetMetricWith(labels Labels) (Observer, error) {
 // WithLabelValues works as GetMetricWithLabelValues, but panics where
 // GetMetricWithLabelValues would have returned an error. Not returning an
 // error allows shortcuts like
-//     myVec.WithLabelValues("404", "GET").Observe(42.21)
+//
+//	myVec.WithLabelValues("404", "GET").Observe(42.21)
 func (v *SummaryVec) WithLabelValues(lvs ...string) Observer {
 	s, err := v.GetMetricWithLabelValues(lvs...)
 	if err != nil {
@@ -614,7 +634,8 @@ func (v *SummaryVec) WithLabelValues(lvs ...string) Observer {
 
 // With works as GetMetricWith, but panics where GetMetricWithLabels would have
 // returned an error. Not returning an error allows shortcuts like
-//     myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
+//
+//	myVec.With(prometheus.Labels{"code": "404", "method": "GET"}).Observe(42.21)
 func (v *SummaryVec) With(labels Labels) Observer {
 	s, err := v.GetMetricWith(labels)
 	if err != nil {
@@ -701,7 +722,8 @@ func (s *constSummary) Write(out *dto.Metric) error {
 //
 // quantiles maps ranks to quantile values. For example, a median latency of
 // 0.23s and a 99th percentile latency of 0.56s would be expressed as:
-//     map[float64]float64{0.5: 0.23, 0.99: 0.56}
+//
+//	map[float64]float64{0.5: 0.23, 0.99: 0.56}
 //
 // NewConstSummary returns an error if the length of labelValues is not
 // consistent with the variable labels in Desc or if Desc is invalid.
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/testutil/lint.go b/vendor/github.com/prometheus/client_golang/prometheus/testutil/lint.go
new file mode 100644
index 0000000000..8d2f05500b
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/testutil/lint.go
@@ -0,0 +1,46 @@
+// Copyright 2020 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package testutil
+
+import (
+	"fmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/testutil/promlint"
+)
+
+// CollectAndLint registers the provided Collector with a newly created pedantic
+// Registry. It then calls GatherAndLint with that Registry and with the
+// provided metricNames.
+func CollectAndLint(c prometheus.Collector, metricNames ...string) ([]promlint.Problem, error) {
+	reg := prometheus.NewPedanticRegistry()
+	if err := reg.Register(c); err != nil {
+		return nil, fmt.Errorf("registering collector failed: %w", err)
+	}
+	return GatherAndLint(reg, metricNames...)
+}
+
+// GatherAndLint gathers all metrics from the provided Gatherer and checks them
+// with the linter in the promlint package. If any metricNames are provided,
+// only metrics with those names are checked.
+func GatherAndLint(g prometheus.Gatherer, metricNames ...string) ([]promlint.Problem, error) {
+	got, err := g.Gather()
+	if err != nil {
+		return nil, fmt.Errorf("gathering metrics failed: %w", err)
+	}
+	if metricNames != nil {
+		got = filterMetrics(got, metricNames)
+	}
+	return promlint.NewWithMetricFamilies(got).Lint()
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/testutil/promlint/promlint.go b/vendor/github.com/prometheus/client_golang/prometheus/testutil/promlint/promlint.go
new file mode 100644
index 0000000000..a20f159b78
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/testutil/promlint/promlint.go
@@ -0,0 +1,387 @@
+// Copyright 2020 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package promlint provides a linter for Prometheus metrics.
+package promlint
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/prometheus/common/expfmt"
+
+	dto "github.com/prometheus/client_model/go"
+)
+
+// A Linter is a Prometheus metrics linter.  It identifies issues with metric
+// names, types, and metadata, and reports them to the caller.
+type Linter struct {
+	// The linter will read metrics in the Prometheus text format from r and
+	// then lint it, _and_ it will lint the metrics provided directly as
+	// MetricFamily proto messages in mfs. Note, however, that the current
+	// constructor functions New and NewWithMetricFamilies only ever set one
+	// of them.
+	r   io.Reader
+	mfs []*dto.MetricFamily
+}
+
+// A Problem is an issue detected by a Linter.
+type Problem struct {
+	// The name of the metric indicated by this Problem.
+	Metric string
+
+	// A description of the issue for this Problem.
+	Text string
+}
+
+// newProblem is helper function to create a Problem.
+func newProblem(mf *dto.MetricFamily, text string) Problem {
+	return Problem{
+		Metric: mf.GetName(),
+		Text:   text,
+	}
+}
+
+// New creates a new Linter that reads an input stream of Prometheus metrics in
+// the Prometheus text exposition format.
+func New(r io.Reader) *Linter {
+	return &Linter{
+		r: r,
+	}
+}
+
+// NewWithMetricFamilies creates a new Linter that reads from a slice of
+// MetricFamily protobuf messages.
+func NewWithMetricFamilies(mfs []*dto.MetricFamily) *Linter {
+	return &Linter{
+		mfs: mfs,
+	}
+}
+
+// Lint performs a linting pass, returning a slice of Problems indicating any
+// issues found in the metrics stream. The slice is sorted by metric name
+// and issue description.
+func (l *Linter) Lint() ([]Problem, error) {
+	var problems []Problem
+
+	if l.r != nil {
+		d := expfmt.NewDecoder(l.r, expfmt.FmtText)
+
+		mf := &dto.MetricFamily{}
+		for {
+			if err := d.Decode(mf); err != nil {
+				if errors.Is(err, io.EOF) {
+					break
+				}
+
+				return nil, err
+			}
+
+			problems = append(problems, lint(mf)...)
+		}
+	}
+	for _, mf := range l.mfs {
+		problems = append(problems, lint(mf)...)
+	}
+
+	// Ensure deterministic output.
+	sort.SliceStable(problems, func(i, j int) bool {
+		if problems[i].Metric == problems[j].Metric {
+			return problems[i].Text < problems[j].Text
+		}
+		return problems[i].Metric < problems[j].Metric
+	})
+
+	return problems, nil
+}
+
+// lint is the entry point for linting a single metric.
+func lint(mf *dto.MetricFamily) []Problem {
+	fns := []func(mf *dto.MetricFamily) []Problem{
+		lintHelp,
+		lintMetricUnits,
+		lintCounter,
+		lintHistogramSummaryReserved,
+		lintMetricTypeInName,
+		lintReservedChars,
+		lintCamelCase,
+		lintUnitAbbreviations,
+	}
+
+	var problems []Problem
+	for _, fn := range fns {
+		problems = append(problems, fn(mf)...)
+	}
+
+	// TODO(mdlayher): lint rules for specific metrics types.
+	return problems
+}
+
+// lintHelp detects issues related to the help text for a metric.
+func lintHelp(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+
+	// Expect all metrics to have help text available.
+	if mf.Help == nil {
+		problems = append(problems, newProblem(mf, "no help text"))
+	}
+
+	return problems
+}
+
+// lintMetricUnits detects issues with metric unit names.
+func lintMetricUnits(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+
+	unit, base, ok := metricUnits(*mf.Name)
+	if !ok {
+		// No known units detected.
+		return nil
+	}
+
+	// Unit is already a base unit.
+	if unit == base {
+		return nil
+	}
+
+	problems = append(problems, newProblem(mf, fmt.Sprintf("use base unit %q instead of %q", base, unit)))
+
+	return problems
+}
+
+// lintCounter detects issues specific to counters, as well as patterns that should
+// only be used with counters.
+func lintCounter(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+
+	isCounter := mf.GetType() == dto.MetricType_COUNTER
+	isUntyped := mf.GetType() == dto.MetricType_UNTYPED
+	hasTotalSuffix := strings.HasSuffix(mf.GetName(), "_total")
+
+	switch {
+	case isCounter && !hasTotalSuffix:
+		problems = append(problems, newProblem(mf, `counter metrics should have "_total" suffix`))
+	case !isUntyped && !isCounter && hasTotalSuffix:
+		problems = append(problems, newProblem(mf, `non-counter metrics should not have "_total" suffix`))
+	}
+
+	return problems
+}
+
+// lintHistogramSummaryReserved detects when other types of metrics use names or labels
+// reserved for use by histograms and/or summaries.
+func lintHistogramSummaryReserved(mf *dto.MetricFamily) []Problem {
+	// These rules do not apply to untyped metrics.
+	t := mf.GetType()
+	if t == dto.MetricType_UNTYPED {
+		return nil
+	}
+
+	var problems []Problem
+
+	isHistogram := t == dto.MetricType_HISTOGRAM
+	isSummary := t == dto.MetricType_SUMMARY
+
+	n := mf.GetName()
+
+	if !isHistogram && strings.HasSuffix(n, "_bucket") {
+		problems = append(problems, newProblem(mf, `non-histogram metrics should not have "_bucket" suffix`))
+	}
+	if !isHistogram && !isSummary && strings.HasSuffix(n, "_count") {
+		problems = append(problems, newProblem(mf, `non-histogram and non-summary metrics should not have "_count" suffix`))
+	}
+	if !isHistogram && !isSummary && strings.HasSuffix(n, "_sum") {
+		problems = append(problems, newProblem(mf, `non-histogram and non-summary metrics should not have "_sum" suffix`))
+	}
+
+	for _, m := range mf.GetMetric() {
+		for _, l := range m.GetLabel() {
+			ln := l.GetName()
+
+			if !isHistogram && ln == "le" {
+				problems = append(problems, newProblem(mf, `non-histogram metrics should not have "le" label`))
+			}
+			if !isSummary && ln == "quantile" {
+				problems = append(problems, newProblem(mf, `non-summary metrics should not have "quantile" label`))
+			}
+		}
+	}
+
+	return problems
+}
+
+// lintMetricTypeInName detects when metric types are included in the metric name.
+func lintMetricTypeInName(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+	n := strings.ToLower(mf.GetName())
+
+	for i, t := range dto.MetricType_name {
+		if i == int32(dto.MetricType_UNTYPED) {
+			continue
+		}
+
+		typename := strings.ToLower(t)
+		if strings.Contains(n, "_"+typename+"_") || strings.HasSuffix(n, "_"+typename) {
+			problems = append(problems, newProblem(mf, fmt.Sprintf(`metric name should not include type '%s'`, typename)))
+		}
+	}
+	return problems
+}
+
+// lintReservedChars detects colons in metric names.
+func lintReservedChars(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+	if strings.Contains(mf.GetName(), ":") {
+		problems = append(problems, newProblem(mf, "metric names should not contain ':'"))
+	}
+	return problems
+}
+
+var camelCase = regexp.MustCompile(`[a-z][A-Z]`)
+
+// lintCamelCase detects metric names and label names written in camelCase.
+func lintCamelCase(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+	if camelCase.FindString(mf.GetName()) != "" {
+		problems = append(problems, newProblem(mf, "metric names should be written in 'snake_case' not 'camelCase'"))
+	}
+
+	for _, m := range mf.GetMetric() {
+		for _, l := range m.GetLabel() {
+			if camelCase.FindString(l.GetName()) != "" {
+				problems = append(problems, newProblem(mf, "label names should be written in 'snake_case' not 'camelCase'"))
+			}
+		}
+	}
+	return problems
+}
+
+// lintUnitAbbreviations detects abbreviated units in the metric name.
+func lintUnitAbbreviations(mf *dto.MetricFamily) []Problem {
+	var problems []Problem
+	n := strings.ToLower(mf.GetName())
+	for _, s := range unitAbbreviations {
+		if strings.Contains(n, "_"+s+"_") || strings.HasSuffix(n, "_"+s) {
+			problems = append(problems, newProblem(mf, "metric names should not contain abbreviated units"))
+		}
+	}
+	return problems
+}
+
+// metricUnits attempts to detect known unit types used as part of a metric name,
+// e.g. "foo_bytes_total" or "bar_baz_milligrams".
+func metricUnits(m string) (unit, base string, ok bool) {
+	ss := strings.Split(m, "_")
+
+	for unit, base := range units {
+		// Also check for "no prefix".
+		for _, p := range append(unitPrefixes, "") {
+			for _, s := range ss {
+				// Attempt to explicitly match a known unit with a known prefix,
+				// as some words may look like "units" when matching suffix.
+				//
+				// As an example, "thermometers" should not match "meters", but
+				// "kilometers" should.
+				if s == p+unit {
+					return p + unit, base, true
+				}
+			}
+		}
+	}
+
+	return "", "", false
+}
+
+// Units and their possible prefixes recognized by this library.  More can be
+// added over time as needed.
+var (
+	// map a unit to the appropriate base unit.
+	units = map[string]string{
+		// Base units.
+		"amperes": "amperes",
+		"bytes":   "bytes",
+		"celsius": "celsius", // Also allow Celsius because it is common in typical Prometheus use cases.
+		"grams":   "grams",
+		"joules":  "joules",
+		"kelvin":  "kelvin", // SI base unit, used in special cases (e.g. color temperature, scientific measurements).
+		"meters":  "meters", // Both American and international spelling permitted.
+		"metres":  "metres",
+		"seconds": "seconds",
+		"volts":   "volts",
+
+		// Non base units.
+		// Time.
+		"minutes": "seconds",
+		"hours":   "seconds",
+		"days":    "seconds",
+		"weeks":   "seconds",
+		// Temperature.
+		"kelvins":    "kelvin",
+		"fahrenheit": "celsius",
+		"rankine":    "celsius",
+		// Length.
+		"inches": "meters",
+		"yards":  "meters",
+		"miles":  "meters",
+		// Bytes.
+		"bits": "bytes",
+		// Energy.
+		"calories": "joules",
+		// Mass.
+		"pounds": "grams",
+		"ounces": "grams",
+	}
+
+	unitPrefixes = []string{
+		"pico",
+		"nano",
+		"micro",
+		"milli",
+		"centi",
+		"deci",
+		"deca",
+		"hecto",
+		"kilo",
+		"kibi",
+		"mega",
+		"mibi",
+		"giga",
+		"gibi",
+		"tera",
+		"tebi",
+		"peta",
+		"pebi",
+	}
+
+	// Common abbreviations that we'd like to discourage.
+	unitAbbreviations = []string{
+		"s",
+		"ms",
+		"us",
+		"ns",
+		"sec",
+		"b",
+		"kb",
+		"mb",
+		"gb",
+		"tb",
+		"pb",
+		"m",
+		"h",
+		"d",
+	}
+)
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/testutil/testutil.go b/vendor/github.com/prometheus/client_golang/prometheus/testutil/testutil.go
new file mode 100644
index 0000000000..82d4a5436b
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/testutil/testutil.go
@@ -0,0 +1,343 @@
+// Copyright 2018 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package testutil provides helpers to test code using the prometheus package
+// of client_golang.
+//
+// While writing unit tests to verify correct instrumentation of your code, it's
+// a common mistake to mostly test the instrumentation library instead of your
+// own code. Rather than verifying that a prometheus.Counter's value has changed
+// as expected or that it shows up in the exposition after registration, it is
+// in general more robust and more faithful to the concept of unit tests to use
+// mock implementations of the prometheus.Counter and prometheus.Registerer
+// interfaces that simply assert that the Add or Register methods have been
+// called with the expected arguments. However, this might be overkill in simple
+// scenarios. The ToFloat64 function is provided for simple inspection of a
+// single-value metric, but it has to be used with caution.
+//
+// End-to-end tests to verify all or larger parts of the metrics exposition can
+// be implemented with the CollectAndCompare or GatherAndCompare functions. The
+// most appropriate use is not so much testing instrumentation of your code, but
+// testing custom prometheus.Collector implementations and in particular whole
+// exporters, i.e. programs that retrieve telemetry data from a 3rd party source
+// and convert it into Prometheus metrics.
+//
+// In a similar pattern, CollectAndLint and GatherAndLint can be used to detect
+// metrics that have issues with their name, type, or metadata without being
+// necessarily invalid, e.g. a counter with a name missing the “_total” suffix.
+package testutil
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"reflect"
+
+	"github.com/davecgh/go-spew/spew"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/prometheus/common/expfmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/internal"
+)
+
+// ToFloat64 collects all Metrics from the provided Collector. It expects that
+// this results in exactly one Metric being collected, which must be a Gauge,
+// Counter, or Untyped. In all other cases, ToFloat64 panics. ToFloat64 returns
+// the value of the collected Metric.
+//
+// The Collector provided is typically a simple instance of Gauge or Counter, or
+// – less commonly – a GaugeVec or CounterVec with exactly one element. But any
+// Collector fulfilling the prerequisites described above will do.
+//
+// Use this function with caution. It is computationally very expensive and thus
+// not suited at all to read values from Metrics in regular code. This is really
+// only for testing purposes, and even for testing, other approaches are often
+// more appropriate (see this package's documentation).
+//
+// A clear anti-pattern would be to use a metric type from the prometheus
+// package to track values that are also needed for something else than the
+// exposition of Prometheus metrics. For example, you would like to track the
+// number of items in a queue because your code should reject queuing further
+// items if a certain limit is reached. It is tempting to track the number of
+// items in a prometheus.Gauge, as it is then easily available as a metric for
+// exposition, too. However, then you would need to call ToFloat64 in your
+// regular code, potentially quite often. The recommended way is to track the
+// number of items conventionally (in the way you would have done it without
+// considering Prometheus metrics) and then expose the number with a
+// prometheus.GaugeFunc.
+func ToFloat64(c prometheus.Collector) float64 {
+	var (
+		m      prometheus.Metric
+		mCount int
+		mChan  = make(chan prometheus.Metric)
+		done   = make(chan struct{})
+	)
+
+	go func() {
+		for m = range mChan {
+			mCount++
+		}
+		close(done)
+	}()
+
+	c.Collect(mChan)
+	close(mChan)
+	<-done
+
+	if mCount != 1 {
+		panic(fmt.Errorf("collected %d metrics instead of exactly 1", mCount))
+	}
+
+	pb := &dto.Metric{}
+	if err := m.Write(pb); err != nil {
+		panic(fmt.Errorf("error happened while collecting metrics: %w", err))
+	}
+	if pb.Gauge != nil {
+		return pb.Gauge.GetValue()
+	}
+	if pb.Counter != nil {
+		return pb.Counter.GetValue()
+	}
+	if pb.Untyped != nil {
+		return pb.Untyped.GetValue()
+	}
+	panic(fmt.Errorf("collected a non-gauge/counter/untyped metric: %s", pb))
+}
+
+// CollectAndCount registers the provided Collector with a newly created
+// pedantic Registry. It then calls GatherAndCount with that Registry and with
+// the provided metricNames. In the unlikely case that the registration or the
+// gathering fails, this function panics. (This is inconsistent with the other
+// CollectAnd… functions in this package and has historical reasons. Changing
+// the function signature would be a breaking change and will therefore only
+// happen with the next major version bump.)
+func CollectAndCount(c prometheus.Collector, metricNames ...string) int {
+	reg := prometheus.NewPedanticRegistry()
+	if err := reg.Register(c); err != nil {
+		panic(fmt.Errorf("registering collector failed: %w", err))
+	}
+	result, err := GatherAndCount(reg, metricNames...)
+	if err != nil {
+		panic(err)
+	}
+	return result
+}
+
+// GatherAndCount gathers all metrics from the provided Gatherer and counts
+// them. It returns the number of metric children in all gathered metric
+// families together. If any metricNames are provided, only metrics with those
+// names are counted.
+func GatherAndCount(g prometheus.Gatherer, metricNames ...string) (int, error) {
+	got, err := g.Gather()
+	if err != nil {
+		return 0, fmt.Errorf("gathering metrics failed: %w", err)
+	}
+	if metricNames != nil {
+		got = filterMetrics(got, metricNames)
+	}
+
+	result := 0
+	for _, mf := range got {
+		result += len(mf.GetMetric())
+	}
+	return result, nil
+}
+
+// ScrapeAndCompare calls a remote exporter's endpoint which is expected to return some metrics in
+// plain text format. Then it compares it with the results that the `expected` would return.
+// If the `metricNames` is not empty it would filter the comparison only to the given metric names.
+func ScrapeAndCompare(url string, expected io.Reader, metricNames ...string) error {
+	resp, err := http.Get(url)
+	if err != nil {
+		return fmt.Errorf("scraping metrics failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("the scraping target returned a status code other than 200: %d",
+			resp.StatusCode)
+	}
+
+	scraped, err := convertReaderToMetricFamily(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	wanted, err := convertReaderToMetricFamily(expected)
+	if err != nil {
+		return err
+	}
+
+	return compareMetricFamilies(scraped, wanted, metricNames...)
+}
+
+// CollectAndCompare registers the provided Collector with a newly created
+// pedantic Registry. It then calls GatherAndCompare with that Registry and with
+// the provided metricNames.
+func CollectAndCompare(c prometheus.Collector, expected io.Reader, metricNames ...string) error {
+	reg := prometheus.NewPedanticRegistry()
+	if err := reg.Register(c); err != nil {
+		return fmt.Errorf("registering collector failed: %w", err)
+	}
+	return GatherAndCompare(reg, expected, metricNames...)
+}
+
+// GatherAndCompare gathers all metrics from the provided Gatherer and compares
+// it to an expected output read from the provided Reader in the Prometheus text
+// exposition format. If any metricNames are provided, only metrics with those
+// names are compared.
+func GatherAndCompare(g prometheus.Gatherer, expected io.Reader, metricNames ...string) error {
+	return TransactionalGatherAndCompare(prometheus.ToTransactionalGatherer(g), expected, metricNames...)
+}
+
+// TransactionalGatherAndCompare gathers all metrics from the provided Gatherer and compares
+// it to an expected output read from the provided Reader in the Prometheus text
+// exposition format. If any metricNames are provided, only metrics with those
+// names are compared.
+func TransactionalGatherAndCompare(g prometheus.TransactionalGatherer, expected io.Reader, metricNames ...string) error {
+	got, done, err := g.Gather()
+	defer done()
+	if err != nil {
+		return fmt.Errorf("gathering metrics failed: %w", err)
+	}
+
+	wanted, err := convertReaderToMetricFamily(expected)
+	if err != nil {
+		return err
+	}
+
+	return compareMetricFamilies(got, wanted, metricNames...)
+}
+
+// convertReaderToMetricFamily would read from a io.Reader object and convert it to a slice of
+// dto.MetricFamily.
+func convertReaderToMetricFamily(reader io.Reader) ([]*dto.MetricFamily, error) {
+	var tp expfmt.TextParser
+	notNormalized, err := tp.TextToMetricFamilies(reader)
+	if err != nil {
+		return nil, fmt.Errorf("converting reader to metric families failed: %w", err)
+	}
+
+	return internal.NormalizeMetricFamilies(notNormalized), nil
+}
+
+// compareMetricFamilies would compare 2 slices of metric families, and optionally filters both of
+// them to the `metricNames` provided.
+func compareMetricFamilies(got, expected []*dto.MetricFamily, metricNames ...string) error {
+	if metricNames != nil {
+		got = filterMetrics(got, metricNames)
+		expected = filterMetrics(expected, metricNames)
+	}
+
+	return compare(got, expected)
+}
+
+// compare encodes both provided slices of metric families into the text format,
+// compares their string message, and returns an error if they do not match.
+// The error contains the encoded text of both the desired and the actual
+// result.
+func compare(got, want []*dto.MetricFamily) error {
+	var gotBuf, wantBuf bytes.Buffer
+	enc := expfmt.NewEncoder(&gotBuf, expfmt.FmtText)
+	for _, mf := range got {
+		if err := enc.Encode(mf); err != nil {
+			return fmt.Errorf("encoding gathered metrics failed: %w", err)
+		}
+	}
+	enc = expfmt.NewEncoder(&wantBuf, expfmt.FmtText)
+	for _, mf := range want {
+		if err := enc.Encode(mf); err != nil {
+			return fmt.Errorf("encoding expected metrics failed: %w", err)
+		}
+	}
+	if diffErr := diff(wantBuf, gotBuf); diffErr != "" {
+		return fmt.Errorf(diffErr)
+	}
+	return nil
+}
+
+// diff returns a diff of both values as long as both are of the same type and
+// are a struct, map, slice, array or string. Otherwise it returns an empty string.
+func diff(expected, actual interface{}) string {
+	if expected == nil || actual == nil {
+		return ""
+	}
+
+	et, ek := typeAndKind(expected)
+	at, _ := typeAndKind(actual)
+	if et != at {
+		return ""
+	}
+
+	if ek != reflect.Struct && ek != reflect.Map && ek != reflect.Slice && ek != reflect.Array && ek != reflect.String {
+		return ""
+	}
+
+	var e, a string
+	c := spew.ConfigState{
+		Indent:                  " ",
+		DisablePointerAddresses: true,
+		DisableCapacities:       true,
+		SortKeys:                true,
+	}
+	if et != reflect.TypeOf("") {
+		e = c.Sdump(expected)
+		a = c.Sdump(actual)
+	} else {
+		e = reflect.ValueOf(expected).String()
+		a = reflect.ValueOf(actual).String()
+	}
+
+	diff, _ := internal.GetUnifiedDiffString(internal.UnifiedDiff{
+		A:        internal.SplitLines(e),
+		B:        internal.SplitLines(a),
+		FromFile: "metric output does not match expectation; want",
+		FromDate: "",
+		ToFile:   "got:",
+		ToDate:   "",
+		Context:  1,
+	})
+
+	if diff == "" {
+		return ""
+	}
+
+	return "\n\nDiff:\n" + diff
+}
+
+// typeAndKind returns the type and kind of the given interface{}
+func typeAndKind(v interface{}) (reflect.Type, reflect.Kind) {
+	t := reflect.TypeOf(v)
+	k := t.Kind()
+
+	if k == reflect.Ptr {
+		t = t.Elem()
+		k = t.Kind()
+	}
+	return t, k
+}
+
+func filterMetrics(metrics []*dto.MetricFamily, names []string) []*dto.MetricFamily {
+	var filtered []*dto.MetricFamily
+	for _, m := range metrics {
+		for _, name := range names {
+			if m.GetName() == name {
+				filtered = append(filtered, m)
+				break
+			}
+		}
+	}
+	return filtered
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/timer.go b/vendor/github.com/prometheus/client_golang/prometheus/timer.go
index 8d5f105233..52344fef53 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/timer.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/timer.go
@@ -23,13 +23,24 @@ type Timer struct {
 }
 
 // NewTimer creates a new Timer. The provided Observer is used to observe a
-// duration in seconds. Timer is usually used to time a function call in the
+// duration in seconds. If the Observer implements ExemplarObserver, passing exemplar
+// later on will be also supported.
+// Timer is usually used to time a function call in the
 // following way:
-//    func TimeMe() {
-//        timer := NewTimer(myHistogram)
-//        defer timer.ObserveDuration()
-//        // Do actual work.
-//    }
+//
+//	func TimeMe() {
+//	    timer := NewTimer(myHistogram)
+//	    defer timer.ObserveDuration()
+//	    // Do actual work.
+//	}
+//
+// or
+//
+//	func TimeMeWithExemplar() {
+//		    timer := NewTimer(myHistogram)
+//		    defer timer.ObserveDurationWithExemplar(exemplar)
+//		    // Do actual work.
+//		}
 func NewTimer(o Observer) *Timer {
 	return &Timer{
 		begin:    time.Now(),
@@ -52,3 +63,19 @@ func (t *Timer) ObserveDuration() time.Duration {
 	}
 	return d
 }
+
+// ObserveDurationWithExemplar is like ObserveDuration, but it will also
+// observe exemplar with the duration unless exemplar is nil or provided Observer can't
+// be casted to ExemplarObserver.
+func (t *Timer) ObserveDurationWithExemplar(exemplar Labels) time.Duration {
+	d := time.Since(t.begin)
+	eo, ok := t.observer.(ExemplarObserver)
+	if ok && exemplar != nil {
+		eo.ObserveWithExemplar(d.Seconds(), exemplar)
+		return d
+	}
+	if t.observer != nil {
+		t.observer.Observe(d.Seconds())
+	}
+	return d
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/value.go b/vendor/github.com/prometheus/client_golang/prometheus/value.go
index c778711b8a..5f6bb80014 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/value.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/value.go
@@ -19,11 +19,11 @@ import (
 	"time"
 	"unicode/utf8"
 
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes"
+	"github.com/prometheus/client_golang/prometheus/internal"
 
 	dto "github.com/prometheus/client_model/go"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // ValueType is an enumeration of metric types that represent a simple value.
@@ -38,6 +38,23 @@ const (
 	UntypedValue
 )
 
+var (
+	CounterMetricTypePtr = func() *dto.MetricType { d := dto.MetricType_COUNTER; return &d }()
+	GaugeMetricTypePtr   = func() *dto.MetricType { d := dto.MetricType_GAUGE; return &d }()
+	UntypedMetricTypePtr = func() *dto.MetricType { d := dto.MetricType_UNTYPED; return &d }()
+)
+
+func (v ValueType) ToDTO() *dto.MetricType {
+	switch v {
+	case CounterValue:
+		return CounterMetricTypePtr
+	case GaugeValue:
+		return GaugeMetricTypePtr
+	default:
+		return UntypedMetricTypePtr
+	}
+}
+
 // valueFunc is a generic metric for simple values retrieved on collect time
 // from a function. It implements Metric and Collector. Its effective type is
 // determined by ValueType. This is a low-level building block used by the
@@ -91,11 +108,15 @@ func NewConstMetric(desc *Desc, valueType ValueType, value float64, labelValues
 	if err := validateLabelValues(labelValues, len(desc.variableLabels)); err != nil {
 		return nil, err
 	}
+
+	metric := &dto.Metric{}
+	if err := populateMetric(valueType, value, MakeLabelPairs(desc, labelValues), nil, metric); err != nil {
+		return nil, err
+	}
+
 	return &constMetric{
-		desc:       desc,
-		valType:    valueType,
-		val:        value,
-		labelPairs: MakeLabelPairs(desc, labelValues),
+		desc:   desc,
+		metric: metric,
 	}, nil
 }
 
@@ -110,10 +131,8 @@ func MustNewConstMetric(desc *Desc, valueType ValueType, value float64, labelVal
 }
 
 type constMetric struct {
-	desc       *Desc
-	valType    ValueType
-	val        float64
-	labelPairs []*dto.LabelPair
+	desc   *Desc
+	metric *dto.Metric
 }
 
 func (m *constMetric) Desc() *Desc {
@@ -121,7 +140,11 @@ func (m *constMetric) Desc() *Desc {
 }
 
 func (m *constMetric) Write(out *dto.Metric) error {
-	return populateMetric(m.valType, m.val, m.labelPairs, nil, out)
+	out.Label = m.metric.Label
+	out.Counter = m.metric.Counter
+	out.Gauge = m.metric.Gauge
+	out.Untyped = m.metric.Untyped
+	return nil
 }
 
 func populateMetric(
@@ -163,19 +186,19 @@ func MakeLabelPairs(desc *Desc, labelValues []string) []*dto.LabelPair {
 		return desc.constLabelPairs
 	}
 	labelPairs := make([]*dto.LabelPair, 0, totalLen)
-	for i, n := range desc.variableLabels {
+	for i, l := range desc.variableLabels {
 		labelPairs = append(labelPairs, &dto.LabelPair{
-			Name:  proto.String(n),
+			Name:  proto.String(l.Name),
 			Value: proto.String(labelValues[i]),
 		})
 	}
 	labelPairs = append(labelPairs, desc.constLabelPairs...)
-	sort.Sort(labelPairSorter(labelPairs))
+	sort.Sort(internal.LabelPairSorter(labelPairs))
 	return labelPairs
 }
 
 // ExemplarMaxRunes is the max total number of runes allowed in exemplar labels.
-const ExemplarMaxRunes = 64
+const ExemplarMaxRunes = 128
 
 // newExemplar creates a new dto.Exemplar from the provided values. An error is
 // returned if any of the label names or values are invalid or if the total
@@ -183,8 +206,8 @@ const ExemplarMaxRunes = 64
 func newExemplar(value float64, ts time.Time, l Labels) (*dto.Exemplar, error) {
 	e := &dto.Exemplar{}
 	e.Value = proto.Float64(value)
-	tsProto, err := ptypes.TimestampProto(ts)
-	if err != nil {
+	tsProto := timestamppb.New(ts)
+	if err := tsProto.CheckValid(); err != nil {
 		return nil, err
 	}
 	e.Timestamp = tsProto
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/vec.go b/vendor/github.com/prometheus/client_golang/prometheus/vec.go
index 4ababe6c98..386fb2d23e 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/vec.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/vec.go
@@ -72,6 +72,7 @@ func NewMetricVec(desc *Desc, newMetric func(lvs ...string) Metric) *MetricVec {
 // with a performance overhead (for creating and processing the Labels map).
 // See also the CounterVec example.
 func (m *MetricVec) DeleteLabelValues(lvs ...string) bool {
+	lvs = constrainLabelValues(m.desc, lvs, m.curry)
 	h, err := m.hashLabelValues(lvs)
 	if err != nil {
 		return false
@@ -91,6 +92,7 @@ func (m *MetricVec) DeleteLabelValues(lvs ...string) bool {
 // This method is used for the same purpose as DeleteLabelValues(...string). See
 // there for pros and cons of the two methods.
 func (m *MetricVec) Delete(labels Labels) bool {
+	labels = constrainLabels(m.desc, labels)
 	h, err := m.hashLabels(labels)
 	if err != nil {
 		return false
@@ -99,6 +101,17 @@ func (m *MetricVec) Delete(labels Labels) bool {
 	return m.metricMap.deleteByHashWithLabels(h, labels, m.curry)
 }
 
+// DeletePartialMatch deletes all metrics where the variable labels contain all of those
+// passed in as labels. The order of the labels does not matter.
+// It returns the number of metrics deleted.
+//
+// Note that curried labels will never be matched if deleting from the curried vector.
+// To match curried labels with DeletePartialMatch, it must be called on the base vector.
+func (m *MetricVec) DeletePartialMatch(labels Labels) int {
+	labels = constrainLabels(m.desc, labels)
+	return m.metricMap.deleteByLabels(labels, m.curry)
+}
+
 // Without explicit forwarding of Describe, Collect, Reset, those methods won't
 // show up in GoDoc.
 
@@ -135,10 +148,10 @@ func (m *MetricVec) CurryWith(labels Labels) (*MetricVec, error) {
 		iCurry   int
 	)
 	for i, label := range m.desc.variableLabels {
-		val, ok := labels[label]
+		val, ok := labels[label.Name]
 		if iCurry < len(oldCurry) && oldCurry[iCurry].index == i {
 			if ok {
-				return nil, fmt.Errorf("label name %q is already curried", label)
+				return nil, fmt.Errorf("label name %q is already curried", label.Name)
 			}
 			newCurry = append(newCurry, oldCurry[iCurry])
 			iCurry++
@@ -146,7 +159,7 @@ func (m *MetricVec) CurryWith(labels Labels) (*MetricVec, error) {
 			if !ok {
 				continue // Label stays uncurried.
 			}
-			newCurry = append(newCurry, curriedLabelValue{i, val})
+			newCurry = append(newCurry, curriedLabelValue{i, label.Constrain(val)})
 		}
 	}
 	if l := len(oldCurry) + len(labels) - len(newCurry); l > 0 {
@@ -189,6 +202,7 @@ func (m *MetricVec) CurryWith(labels Labels) (*MetricVec, error) {
 // a wrapper around MetricVec, implementing a vector for a specific Metric
 // implementation, for example GaugeVec.
 func (m *MetricVec) GetMetricWithLabelValues(lvs ...string) (Metric, error) {
+	lvs = constrainLabelValues(m.desc, lvs, m.curry)
 	h, err := m.hashLabelValues(lvs)
 	if err != nil {
 		return nil, err
@@ -214,6 +228,7 @@ func (m *MetricVec) GetMetricWithLabelValues(lvs ...string) (Metric, error) {
 // around MetricVec, implementing a vector for a specific Metric implementation,
 // for example GaugeVec.
 func (m *MetricVec) GetMetricWith(labels Labels) (Metric, error) {
+	labels = constrainLabels(m.desc, labels)
 	h, err := m.hashLabels(labels)
 	if err != nil {
 		return nil, err
@@ -256,16 +271,16 @@ func (m *MetricVec) hashLabels(labels Labels) (uint64, error) {
 		iCurry int
 	)
 	for i, label := range m.desc.variableLabels {
-		val, ok := labels[label]
+		val, ok := labels[label.Name]
 		if iCurry < len(curry) && curry[iCurry].index == i {
 			if ok {
-				return 0, fmt.Errorf("label name %q is already curried", label)
+				return 0, fmt.Errorf("label name %q is already curried", label.Name)
 			}
 			h = m.hashAdd(h, curry[iCurry].value)
 			iCurry++
 		} else {
 			if !ok {
-				return 0, fmt.Errorf("label name %q missing in label map", label)
+				return 0, fmt.Errorf("label name %q missing in label map", label.Name)
 			}
 			h = m.hashAdd(h, val)
 		}
@@ -381,6 +396,82 @@ func (m *metricMap) deleteByHashWithLabels(
 	return true
 }
 
+// deleteByLabels deletes a metric if the given labels are present in the metric.
+func (m *metricMap) deleteByLabels(labels Labels, curry []curriedLabelValue) int {
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+
+	var numDeleted int
+
+	for h, metrics := range m.metrics {
+		i := findMetricWithPartialLabels(m.desc, metrics, labels, curry)
+		if i >= len(metrics) {
+			// Didn't find matching labels in this metric slice.
+			continue
+		}
+		delete(m.metrics, h)
+		numDeleted++
+	}
+
+	return numDeleted
+}
+
+// findMetricWithPartialLabel returns the index of the matching metric or
+// len(metrics) if not found.
+func findMetricWithPartialLabels(
+	desc *Desc, metrics []metricWithLabelValues, labels Labels, curry []curriedLabelValue,
+) int {
+	for i, metric := range metrics {
+		if matchPartialLabels(desc, metric.values, labels, curry) {
+			return i
+		}
+	}
+	return len(metrics)
+}
+
+// indexOf searches the given slice of strings for the target string and returns
+// the index or len(items) as well as a boolean whether the search succeeded.
+func indexOf(target string, items []string) (int, bool) {
+	for i, l := range items {
+		if l == target {
+			return i, true
+		}
+	}
+	return len(items), false
+}
+
+// valueMatchesVariableOrCurriedValue determines if a value was previously curried,
+// and returns whether it matches either the "base" value or the curried value accordingly.
+// It also indicates whether the match is against a curried or uncurried value.
+func valueMatchesVariableOrCurriedValue(targetValue string, index int, values []string, curry []curriedLabelValue) (bool, bool) {
+	for _, curriedValue := range curry {
+		if curriedValue.index == index {
+			// This label was curried. See if the curried value matches our target.
+			return curriedValue.value == targetValue, true
+		}
+	}
+	// This label was not curried. See if the current value matches our target label.
+	return values[index] == targetValue, false
+}
+
+// matchPartialLabels searches the current metric and returns whether all of the target label:value pairs are present.
+func matchPartialLabels(desc *Desc, values []string, labels Labels, curry []curriedLabelValue) bool {
+	for l, v := range labels {
+		// Check if the target label exists in our metrics and get the index.
+		varLabelIndex, validLabel := indexOf(l, desc.variableLabels.labelNames())
+		if validLabel {
+			// Check the value of that label against the target value.
+			// We don't consider curried values in partial matches.
+			matches, curried := valueMatchesVariableOrCurriedValue(v, varLabelIndex, values, curry)
+			if matches && !curried {
+				continue
+			}
+		}
+		return false
+	}
+	return true
+}
+
 // getOrCreateMetricWithLabelValues retrieves the metric by hash and label value
 // or creates it and returns the new one.
 //
@@ -485,7 +576,7 @@ func findMetricWithLabels(
 	return len(metrics)
 }
 
-func matchLabelValues(values []string, lvs []string, curry []curriedLabelValue) bool {
+func matchLabelValues(values, lvs []string, curry []curriedLabelValue) bool {
 	if len(values) != len(lvs)+len(curry) {
 		return false
 	}
@@ -519,7 +610,7 @@ func matchLabels(desc *Desc, values []string, labels Labels, curry []curriedLabe
 			iCurry++
 			continue
 		}
-		if values[i] != labels[k] {
+		if values[i] != labels[k.Name] {
 			return false
 		}
 	}
@@ -535,7 +626,7 @@ func extractLabelValues(desc *Desc, labels Labels, curry []curriedLabelValue) []
 			iCurry++
 			continue
 		}
-		labelValues[i] = labels[k]
+		labelValues[i] = labels[k.Name]
 	}
 	return labelValues
 }
@@ -554,3 +645,34 @@ func inlineLabelValues(lvs []string, curry []curriedLabelValue) []string {
 	}
 	return labelValues
 }
+
+func constrainLabels(desc *Desc, labels Labels) Labels {
+	constrainedValues := make(Labels, len(labels))
+	for l, v := range labels {
+		if i, ok := indexOf(l, desc.variableLabels.labelNames()); ok {
+			constrainedValues[l] = desc.variableLabels[i].Constrain(v)
+			continue
+		}
+		constrainedValues[l] = v
+	}
+	return constrainedValues
+}
+
+func constrainLabelValues(desc *Desc, lvs []string, curry []curriedLabelValue) []string {
+	constrainedValues := make([]string, len(lvs))
+	var iCurry, iLVs int
+	for i := 0; i < len(lvs)+len(curry); i++ {
+		if iCurry < len(curry) && curry[iCurry].index == i {
+			iCurry++
+			continue
+		}
+
+		if i < len(desc.variableLabels) {
+			constrainedValues[iLVs] = desc.variableLabels[i].Constrain(lvs[iLVs])
+		} else {
+			constrainedValues[iLVs] = lvs[iLVs]
+		}
+		iLVs++
+	}
+	return constrainedValues
+}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/vnext.go b/vendor/github.com/prometheus/client_golang/prometheus/vnext.go
new file mode 100644
index 0000000000..42bc3a8f06
--- /dev/null
+++ b/vendor/github.com/prometheus/client_golang/prometheus/vnext.go
@@ -0,0 +1,23 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package prometheus
+
+type v2 struct{}
+
+// V2 is a struct that can be referenced to access experimental API that might
+// be present in v2 of client golang someday. It offers extended functionality
+// of v1 with slightly changed API. It is acceptable to use some pieces from v1
+// and e.g `prometheus.NewGauge` and some from v2 e.g. `prometheus.V2.NewDesc`
+// in the same codebase.
+var V2 = v2{}
diff --git a/vendor/github.com/prometheus/client_golang/prometheus/wrap.go b/vendor/github.com/prometheus/client_golang/prometheus/wrap.go
index 74ee93280f..25da157f15 100644
--- a/vendor/github.com/prometheus/client_golang/prometheus/wrap.go
+++ b/vendor/github.com/prometheus/client_golang/prometheus/wrap.go
@@ -17,10 +17,10 @@ import (
 	"fmt"
 	"sort"
 
-	//nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
-	"github.com/golang/protobuf/proto"
+	"github.com/prometheus/client_golang/prometheus/internal"
 
 	dto "github.com/prometheus/client_model/go"
+	"google.golang.org/protobuf/proto"
 )
 
 // WrapRegistererWith returns a Registerer wrapping the provided
@@ -182,7 +182,7 @@ func (m *wrappingMetric) Write(out *dto.Metric) error {
 			Value: proto.String(lv),
 		})
 	}
-	sort.Sort(labelPairSorter(out.Label))
+	sort.Sort(internal.LabelPairSorter(out.Label))
 	return nil
 }
 
@@ -204,7 +204,7 @@ func wrapDesc(desc *Desc, prefix string, labels Labels) *Desc {
 		constLabels[ln] = lv
 	}
 	// NewDesc will do remaining validations.
-	newDesc := NewDesc(prefix+desc.fqName, desc.help, desc.variableLabels, constLabels)
+	newDesc := V2.NewDesc(prefix+desc.fqName, desc.help, desc.variableLabels, constLabels)
 	// Propagate errors if there was any. This will override any errer
 	// created by NewDesc above, i.e. earlier errors get precedence.
 	if desc.err != nil {
diff --git a/vendor/github.com/prometheus/client_model/go/metrics.pb.go b/vendor/github.com/prometheus/client_model/go/metrics.pb.go
index 2f4930d9dd..35904ea198 100644
--- a/vendor/github.com/prometheus/client_model/go/metrics.pb.go
+++ b/vendor/github.com/prometheus/client_model/go/metrics.pb.go
@@ -1,5 +1,5 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
-// source: metrics.proto
+// source: io/prometheus/client/metrics.proto
 
 package io_prometheus_client
 
@@ -24,11 +24,18 @@ const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
 type MetricType int32
 
 const (
-	MetricType_COUNTER   MetricType = 0
-	MetricType_GAUGE     MetricType = 1
-	MetricType_SUMMARY   MetricType = 2
-	MetricType_UNTYPED   MetricType = 3
+	// COUNTER must use the Metric field "counter".
+	MetricType_COUNTER MetricType = 0
+	// GAUGE must use the Metric field "gauge".
+	MetricType_GAUGE MetricType = 1
+	// SUMMARY must use the Metric field "summary".
+	MetricType_SUMMARY MetricType = 2
+	// UNTYPED must use the Metric field "untyped".
+	MetricType_UNTYPED MetricType = 3
+	// HISTOGRAM must use the Metric field "histogram".
 	MetricType_HISTOGRAM MetricType = 4
+	// GAUGE_HISTOGRAM must use the Metric field "histogram".
+	MetricType_GAUGE_HISTOGRAM MetricType = 5
 )
 
 var MetricType_name = map[int32]string{
@@ -37,14 +44,16 @@ var MetricType_name = map[int32]string{
 	2: "SUMMARY",
 	3: "UNTYPED",
 	4: "HISTOGRAM",
+	5: "GAUGE_HISTOGRAM",
 }
 
 var MetricType_value = map[string]int32{
-	"COUNTER":   0,
-	"GAUGE":     1,
-	"SUMMARY":   2,
-	"UNTYPED":   3,
-	"HISTOGRAM": 4,
+	"COUNTER":         0,
+	"GAUGE":           1,
+	"SUMMARY":         2,
+	"UNTYPED":         3,
+	"HISTOGRAM":       4,
+	"GAUGE_HISTOGRAM": 5,
 }
 
 func (x MetricType) Enum() *MetricType {
@@ -67,7 +76,7 @@ func (x *MetricType) UnmarshalJSON(data []byte) error {
 }
 
 func (MetricType) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{0}
+	return fileDescriptor_d1e5ddb18987a258, []int{0}
 }
 
 type LabelPair struct {
@@ -82,7 +91,7 @@ func (m *LabelPair) Reset()         { *m = LabelPair{} }
 func (m *LabelPair) String() string { return proto.CompactTextString(m) }
 func (*LabelPair) ProtoMessage()    {}
 func (*LabelPair) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{0}
+	return fileDescriptor_d1e5ddb18987a258, []int{0}
 }
 
 func (m *LabelPair) XXX_Unmarshal(b []byte) error {
@@ -128,7 +137,7 @@ func (m *Gauge) Reset()         { *m = Gauge{} }
 func (m *Gauge) String() string { return proto.CompactTextString(m) }
 func (*Gauge) ProtoMessage()    {}
 func (*Gauge) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{1}
+	return fileDescriptor_d1e5ddb18987a258, []int{1}
 }
 
 func (m *Gauge) XXX_Unmarshal(b []byte) error {
@@ -168,7 +177,7 @@ func (m *Counter) Reset()         { *m = Counter{} }
 func (m *Counter) String() string { return proto.CompactTextString(m) }
 func (*Counter) ProtoMessage()    {}
 func (*Counter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{2}
+	return fileDescriptor_d1e5ddb18987a258, []int{2}
 }
 
 func (m *Counter) XXX_Unmarshal(b []byte) error {
@@ -215,7 +224,7 @@ func (m *Quantile) Reset()         { *m = Quantile{} }
 func (m *Quantile) String() string { return proto.CompactTextString(m) }
 func (*Quantile) ProtoMessage()    {}
 func (*Quantile) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{3}
+	return fileDescriptor_d1e5ddb18987a258, []int{3}
 }
 
 func (m *Quantile) XXX_Unmarshal(b []byte) error {
@@ -263,7 +272,7 @@ func (m *Summary) Reset()         { *m = Summary{} }
 func (m *Summary) String() string { return proto.CompactTextString(m) }
 func (*Summary) ProtoMessage()    {}
 func (*Summary) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{4}
+	return fileDescriptor_d1e5ddb18987a258, []int{4}
 }
 
 func (m *Summary) XXX_Unmarshal(b []byte) error {
@@ -316,7 +325,7 @@ func (m *Untyped) Reset()         { *m = Untyped{} }
 func (m *Untyped) String() string { return proto.CompactTextString(m) }
 func (*Untyped) ProtoMessage()    {}
 func (*Untyped) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{5}
+	return fileDescriptor_d1e5ddb18987a258, []int{5}
 }
 
 func (m *Untyped) XXX_Unmarshal(b []byte) error {
@@ -345,9 +354,34 @@ func (m *Untyped) GetValue() float64 {
 }
 
 type Histogram struct {
-	SampleCount          *uint64   `protobuf:"varint,1,opt,name=sample_count,json=sampleCount" json:"sample_count,omitempty"`
-	SampleSum            *float64  `protobuf:"fixed64,2,opt,name=sample_sum,json=sampleSum" json:"sample_sum,omitempty"`
-	Bucket               []*Bucket `protobuf:"bytes,3,rep,name=bucket" json:"bucket,omitempty"`
+	SampleCount      *uint64  `protobuf:"varint,1,opt,name=sample_count,json=sampleCount" json:"sample_count,omitempty"`
+	SampleCountFloat *float64 `protobuf:"fixed64,4,opt,name=sample_count_float,json=sampleCountFloat" json:"sample_count_float,omitempty"`
+	SampleSum        *float64 `protobuf:"fixed64,2,opt,name=sample_sum,json=sampleSum" json:"sample_sum,omitempty"`
+	// Buckets for the conventional histogram.
+	Bucket []*Bucket `protobuf:"bytes,3,rep,name=bucket" json:"bucket,omitempty"`
+	// schema defines the bucket schema. Currently, valid numbers are -4 <= n <= 8.
+	// They are all for base-2 bucket schemas, where 1 is a bucket boundary in each case, and
+	// then each power of two is divided into 2^n logarithmic buckets.
+	// Or in other words, each bucket boundary is the previous boundary times 2^(2^-n).
+	// In the future, more bucket schemas may be added using numbers < -4 or > 8.
+	Schema         *int32   `protobuf:"zigzag32,5,opt,name=schema" json:"schema,omitempty"`
+	ZeroThreshold  *float64 `protobuf:"fixed64,6,opt,name=zero_threshold,json=zeroThreshold" json:"zero_threshold,omitempty"`
+	ZeroCount      *uint64  `protobuf:"varint,7,opt,name=zero_count,json=zeroCount" json:"zero_count,omitempty"`
+	ZeroCountFloat *float64 `protobuf:"fixed64,8,opt,name=zero_count_float,json=zeroCountFloat" json:"zero_count_float,omitempty"`
+	// Negative buckets for the native histogram.
+	NegativeSpan []*BucketSpan `protobuf:"bytes,9,rep,name=negative_span,json=negativeSpan" json:"negative_span,omitempty"`
+	// Use either "negative_delta" or "negative_count", the former for
+	// regular histograms with integer counts, the latter for float
+	// histograms.
+	NegativeDelta []int64   `protobuf:"zigzag64,10,rep,name=negative_delta,json=negativeDelta" json:"negative_delta,omitempty"`
+	NegativeCount []float64 `protobuf:"fixed64,11,rep,name=negative_count,json=negativeCount" json:"negative_count,omitempty"`
+	// Positive buckets for the native histogram.
+	PositiveSpan []*BucketSpan `protobuf:"bytes,12,rep,name=positive_span,json=positiveSpan" json:"positive_span,omitempty"`
+	// Use either "positive_delta" or "positive_count", the former for
+	// regular histograms with integer counts, the latter for float
+	// histograms.
+	PositiveDelta        []int64   `protobuf:"zigzag64,13,rep,name=positive_delta,json=positiveDelta" json:"positive_delta,omitempty"`
+	PositiveCount        []float64 `protobuf:"fixed64,14,rep,name=positive_count,json=positiveCount" json:"positive_count,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}  `json:"-"`
 	XXX_unrecognized     []byte    `json:"-"`
 	XXX_sizecache        int32     `json:"-"`
@@ -357,7 +391,7 @@ func (m *Histogram) Reset()         { *m = Histogram{} }
 func (m *Histogram) String() string { return proto.CompactTextString(m) }
 func (*Histogram) ProtoMessage()    {}
 func (*Histogram) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{6}
+	return fileDescriptor_d1e5ddb18987a258, []int{6}
 }
 
 func (m *Histogram) XXX_Unmarshal(b []byte) error {
@@ -385,6 +419,13 @@ func (m *Histogram) GetSampleCount() uint64 {
 	return 0
 }
 
+func (m *Histogram) GetSampleCountFloat() float64 {
+	if m != nil && m.SampleCountFloat != nil {
+		return *m.SampleCountFloat
+	}
+	return 0
+}
+
 func (m *Histogram) GetSampleSum() float64 {
 	if m != nil && m.SampleSum != nil {
 		return *m.SampleSum
@@ -399,8 +440,81 @@ func (m *Histogram) GetBucket() []*Bucket {
 	return nil
 }
 
+func (m *Histogram) GetSchema() int32 {
+	if m != nil && m.Schema != nil {
+		return *m.Schema
+	}
+	return 0
+}
+
+func (m *Histogram) GetZeroThreshold() float64 {
+	if m != nil && m.ZeroThreshold != nil {
+		return *m.ZeroThreshold
+	}
+	return 0
+}
+
+func (m *Histogram) GetZeroCount() uint64 {
+	if m != nil && m.ZeroCount != nil {
+		return *m.ZeroCount
+	}
+	return 0
+}
+
+func (m *Histogram) GetZeroCountFloat() float64 {
+	if m != nil && m.ZeroCountFloat != nil {
+		return *m.ZeroCountFloat
+	}
+	return 0
+}
+
+func (m *Histogram) GetNegativeSpan() []*BucketSpan {
+	if m != nil {
+		return m.NegativeSpan
+	}
+	return nil
+}
+
+func (m *Histogram) GetNegativeDelta() []int64 {
+	if m != nil {
+		return m.NegativeDelta
+	}
+	return nil
+}
+
+func (m *Histogram) GetNegativeCount() []float64 {
+	if m != nil {
+		return m.NegativeCount
+	}
+	return nil
+}
+
+func (m *Histogram) GetPositiveSpan() []*BucketSpan {
+	if m != nil {
+		return m.PositiveSpan
+	}
+	return nil
+}
+
+func (m *Histogram) GetPositiveDelta() []int64 {
+	if m != nil {
+		return m.PositiveDelta
+	}
+	return nil
+}
+
+func (m *Histogram) GetPositiveCount() []float64 {
+	if m != nil {
+		return m.PositiveCount
+	}
+	return nil
+}
+
+// A Bucket of a conventional histogram, each of which is treated as
+// an individual counter-like time series by Prometheus.
 type Bucket struct {
 	CumulativeCount      *uint64   `protobuf:"varint,1,opt,name=cumulative_count,json=cumulativeCount" json:"cumulative_count,omitempty"`
+	CumulativeCountFloat *float64  `protobuf:"fixed64,4,opt,name=cumulative_count_float,json=cumulativeCountFloat" json:"cumulative_count_float,omitempty"`
 	UpperBound           *float64  `protobuf:"fixed64,2,opt,name=upper_bound,json=upperBound" json:"upper_bound,omitempty"`
 	Exemplar             *Exemplar `protobuf:"bytes,3,opt,name=exemplar" json:"exemplar,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}  `json:"-"`
@@ -412,7 +526,7 @@ func (m *Bucket) Reset()         { *m = Bucket{} }
 func (m *Bucket) String() string { return proto.CompactTextString(m) }
 func (*Bucket) ProtoMessage()    {}
 func (*Bucket) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{7}
+	return fileDescriptor_d1e5ddb18987a258, []int{7}
 }
 
 func (m *Bucket) XXX_Unmarshal(b []byte) error {
@@ -440,6 +554,13 @@ func (m *Bucket) GetCumulativeCount() uint64 {
 	return 0
 }
 
+func (m *Bucket) GetCumulativeCountFloat() float64 {
+	if m != nil && m.CumulativeCountFloat != nil {
+		return *m.CumulativeCountFloat
+	}
+	return 0
+}
+
 func (m *Bucket) GetUpperBound() float64 {
 	if m != nil && m.UpperBound != nil {
 		return *m.UpperBound
@@ -454,6 +575,59 @@ func (m *Bucket) GetExemplar() *Exemplar {
 	return nil
 }
 
+// A BucketSpan defines a number of consecutive buckets in a native
+// histogram with their offset. Logically, it would be more
+// straightforward to include the bucket counts in the Span. However,
+// the protobuf representation is more compact in the way the data is
+// structured here (with all the buckets in a single array separate
+// from the Spans).
+type BucketSpan struct {
+	Offset               *int32   `protobuf:"zigzag32,1,opt,name=offset" json:"offset,omitempty"`
+	Length               *uint32  `protobuf:"varint,2,opt,name=length" json:"length,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *BucketSpan) Reset()         { *m = BucketSpan{} }
+func (m *BucketSpan) String() string { return proto.CompactTextString(m) }
+func (*BucketSpan) ProtoMessage()    {}
+func (*BucketSpan) Descriptor() ([]byte, []int) {
+	return fileDescriptor_d1e5ddb18987a258, []int{8}
+}
+
+func (m *BucketSpan) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_BucketSpan.Unmarshal(m, b)
+}
+func (m *BucketSpan) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_BucketSpan.Marshal(b, m, deterministic)
+}
+func (m *BucketSpan) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_BucketSpan.Merge(m, src)
+}
+func (m *BucketSpan) XXX_Size() int {
+	return xxx_messageInfo_BucketSpan.Size(m)
+}
+func (m *BucketSpan) XXX_DiscardUnknown() {
+	xxx_messageInfo_BucketSpan.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_BucketSpan proto.InternalMessageInfo
+
+func (m *BucketSpan) GetOffset() int32 {
+	if m != nil && m.Offset != nil {
+		return *m.Offset
+	}
+	return 0
+}
+
+func (m *BucketSpan) GetLength() uint32 {
+	if m != nil && m.Length != nil {
+		return *m.Length
+	}
+	return 0
+}
+
 type Exemplar struct {
 	Label                []*LabelPair         `protobuf:"bytes,1,rep,name=label" json:"label,omitempty"`
 	Value                *float64             `protobuf:"fixed64,2,opt,name=value" json:"value,omitempty"`
@@ -467,7 +641,7 @@ func (m *Exemplar) Reset()         { *m = Exemplar{} }
 func (m *Exemplar) String() string { return proto.CompactTextString(m) }
 func (*Exemplar) ProtoMessage()    {}
 func (*Exemplar) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{8}
+	return fileDescriptor_d1e5ddb18987a258, []int{9}
 }
 
 func (m *Exemplar) XXX_Unmarshal(b []byte) error {
@@ -526,7 +700,7 @@ func (m *Metric) Reset()         { *m = Metric{} }
 func (m *Metric) String() string { return proto.CompactTextString(m) }
 func (*Metric) ProtoMessage()    {}
 func (*Metric) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{9}
+	return fileDescriptor_d1e5ddb18987a258, []int{10}
 }
 
 func (m *Metric) XXX_Unmarshal(b []byte) error {
@@ -610,7 +784,7 @@ func (m *MetricFamily) Reset()         { *m = MetricFamily{} }
 func (m *MetricFamily) String() string { return proto.CompactTextString(m) }
 func (*MetricFamily) ProtoMessage()    {}
 func (*MetricFamily) Descriptor() ([]byte, []int) {
-	return fileDescriptor_6039342a2ba47b72, []int{10}
+	return fileDescriptor_d1e5ddb18987a258, []int{11}
 }
 
 func (m *MetricFamily) XXX_Unmarshal(b []byte) error {
@@ -669,55 +843,72 @@ func init() {
 	proto.RegisterType((*Untyped)(nil), "io.prometheus.client.Untyped")
 	proto.RegisterType((*Histogram)(nil), "io.prometheus.client.Histogram")
 	proto.RegisterType((*Bucket)(nil), "io.prometheus.client.Bucket")
+	proto.RegisterType((*BucketSpan)(nil), "io.prometheus.client.BucketSpan")
 	proto.RegisterType((*Exemplar)(nil), "io.prometheus.client.Exemplar")
 	proto.RegisterType((*Metric)(nil), "io.prometheus.client.Metric")
 	proto.RegisterType((*MetricFamily)(nil), "io.prometheus.client.MetricFamily")
 }
 
-func init() { proto.RegisterFile("metrics.proto", fileDescriptor_6039342a2ba47b72) }
-
-var fileDescriptor_6039342a2ba47b72 = []byte{
-	// 665 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x54, 0xcd, 0x6e, 0xd3, 0x4c,
-	0x14, 0xfd, 0xdc, 0x38, 0x3f, 0xbe, 0x69, 0x3f, 0xa2, 0x51, 0x17, 0x56, 0xa1, 0x24, 0x78, 0x55,
-	0x58, 0x38, 0xa2, 0x6a, 0x05, 0x2a, 0xb0, 0x68, 0x4b, 0x48, 0x91, 0x48, 0x5b, 0x26, 0xc9, 0xa2,
-	0xb0, 0x88, 0x1c, 0x77, 0x70, 0x2c, 0x3c, 0xb1, 0xb1, 0x67, 0x2a, 0xb2, 0x66, 0xc1, 0x16, 0x5e,
-	0x81, 0x17, 0x05, 0xcd, 0x8f, 0x6d, 0x2a, 0xb9, 0x95, 0x40, 0xec, 0x66, 0xee, 0x3d, 0xe7, 0xfa,
-	0xcc, 0xf8, 0x9c, 0x81, 0x0d, 0x4a, 0x58, 0x1a, 0xfa, 0x99, 0x9b, 0xa4, 0x31, 0x8b, 0xd1, 0x66,
-	0x18, 0x8b, 0x15, 0x25, 0x6c, 0x41, 0x78, 0xe6, 0xfa, 0x51, 0x48, 0x96, 0x6c, 0xab, 0x1b, 0xc4,
-	0x71, 0x10, 0x91, 0xbe, 0xc4, 0xcc, 0xf9, 0x87, 0x3e, 0x0b, 0x29, 0xc9, 0x98, 0x47, 0x13, 0x45,
-	0x73, 0xf6, 0xc1, 0x7a, 0xe3, 0xcd, 0x49, 0x74, 0xee, 0x85, 0x29, 0x42, 0x60, 0x2e, 0x3d, 0x4a,
-	0x6c, 0xa3, 0x67, 0xec, 0x58, 0x58, 0xae, 0xd1, 0x26, 0xd4, 0xaf, 0xbc, 0x88, 0x13, 0x7b, 0x4d,
-	0x16, 0xd5, 0xc6, 0xd9, 0x86, 0xfa, 0xd0, 0xe3, 0xc1, 0x6f, 0x6d, 0xc1, 0x31, 0xf2, 0xf6, 0x7b,
-	0x68, 0x1e, 0xc7, 0x7c, 0xc9, 0x48, 0x5a, 0x0d, 0x40, 0x07, 0xd0, 0x22, 0x9f, 0x09, 0x4d, 0x22,
-	0x2f, 0x95, 0x83, 0xdb, 0xbb, 0xf7, 0xdd, 0xaa, 0x03, 0xb8, 0x03, 0x8d, 0xc2, 0x05, 0xde, 0x79,
-	0x0e, 0xad, 0xb7, 0xdc, 0x5b, 0xb2, 0x30, 0x22, 0x68, 0x0b, 0x5a, 0x9f, 0xf4, 0x5a, 0x7f, 0xa0,
-	0xd8, 0x5f, 0x57, 0x5e, 0x48, 0xfb, 0x6a, 0x40, 0x73, 0xcc, 0x29, 0xf5, 0xd2, 0x15, 0x7a, 0x00,
-	0xeb, 0x99, 0x47, 0x93, 0x88, 0xcc, 0x7c, 0xa1, 0x56, 0x4e, 0x30, 0x71, 0x5b, 0xd5, 0xe4, 0x01,
-	0xd0, 0x36, 0x80, 0x86, 0x64, 0x9c, 0xea, 0x49, 0x96, 0xaa, 0x8c, 0x39, 0x15, 0xe7, 0x28, 0xbe,
-	0x5f, 0xeb, 0xd5, 0x6e, 0x3e, 0x47, 0xae, 0xb8, 0xd4, 0xe7, 0x74, 0xa1, 0x39, 0x5d, 0xb2, 0x55,
-	0x42, 0x2e, 0x6f, 0xb8, 0xc5, 0x2f, 0x06, 0x58, 0x27, 0x61, 0xc6, 0xe2, 0x20, 0xf5, 0xe8, 0x3f,
-	0x10, 0xbb, 0x07, 0x8d, 0x39, 0xf7, 0x3f, 0x12, 0xa6, 0xa5, 0xde, 0xab, 0x96, 0x7a, 0x24, 0x31,
-	0x58, 0x63, 0x9d, 0x6f, 0x06, 0x34, 0x54, 0x09, 0x3d, 0x84, 0x8e, 0xcf, 0x29, 0x8f, 0x3c, 0x16,
-	0x5e, 0x5d, 0x97, 0x71, 0xa7, 0xac, 0x2b, 0x29, 0x5d, 0x68, 0xf3, 0x24, 0x21, 0xe9, 0x6c, 0x1e,
-	0xf3, 0xe5, 0xa5, 0xd6, 0x02, 0xb2, 0x74, 0x24, 0x2a, 0xd7, 0x1c, 0x50, 0xfb, 0x43, 0x07, 0x7c,
-	0x37, 0xa0, 0x95, 0x97, 0xd1, 0x3e, 0xd4, 0x23, 0xe1, 0x60, 0xdb, 0x90, 0x87, 0xea, 0x56, 0x4f,
-	0x29, 0x4c, 0x8e, 0x15, 0xba, 0xda, 0x1d, 0xe8, 0x29, 0x58, 0x45, 0x42, 0xb4, 0xac, 0x2d, 0x57,
-	0x65, 0xc8, 0xcd, 0x33, 0xe4, 0x4e, 0x72, 0x04, 0x2e, 0xc1, 0xce, 0xcf, 0x35, 0x68, 0x8c, 0x64,
-	0x22, 0xff, 0x56, 0xd1, 0x63, 0xa8, 0x07, 0x22, 0x53, 0x3a, 0x10, 0x77, 0xab, 0x69, 0x32, 0x76,
-	0x58, 0x21, 0xd1, 0x13, 0x68, 0xfa, 0x2a, 0x67, 0x5a, 0xec, 0x76, 0x35, 0x49, 0x87, 0x11, 0xe7,
-	0x68, 0x41, 0xcc, 0x54, 0x08, 0x6c, 0xf3, 0x36, 0xa2, 0x4e, 0x0a, 0xce, 0xd1, 0x82, 0xc8, 0x95,
-	0x69, 0xed, 0xfa, 0x6d, 0x44, 0xed, 0x6c, 0x9c, 0xa3, 0xd1, 0x0b, 0xb0, 0x16, 0xb9, 0x97, 0xed,
-	0xa6, 0xa4, 0xde, 0x70, 0x31, 0x85, 0xe5, 0x71, 0xc9, 0x10, 0xee, 0x2f, 0xee, 0x7a, 0x46, 0x33,
-	0xbb, 0xd1, 0x33, 0x76, 0x6a, 0xb8, 0x5d, 0xd4, 0x46, 0x99, 0xf3, 0xc3, 0x80, 0x75, 0xf5, 0x07,
-	0x5e, 0x79, 0x34, 0x8c, 0x56, 0x95, 0xcf, 0x19, 0x02, 0x73, 0x41, 0xa2, 0x44, 0xbf, 0x66, 0x72,
-	0x8d, 0xf6, 0xc0, 0x14, 0x1a, 0xe5, 0x15, 0xfe, 0xbf, 0xdb, 0xab, 0x56, 0xa5, 0x26, 0x4f, 0x56,
-	0x09, 0xc1, 0x12, 0x2d, 0xd2, 0xa4, 0x5e, 0x60, 0xdb, 0xbc, 0x2d, 0x4d, 0x8a, 0x87, 0x35, 0xf6,
-	0xd1, 0x08, 0xa0, 0x9c, 0x84, 0xda, 0xd0, 0x3c, 0x3e, 0x9b, 0x9e, 0x4e, 0x06, 0xb8, 0xf3, 0x1f,
-	0xb2, 0xa0, 0x3e, 0x3c, 0x9c, 0x0e, 0x07, 0x1d, 0x43, 0xd4, 0xc7, 0xd3, 0xd1, 0xe8, 0x10, 0x5f,
-	0x74, 0xd6, 0xc4, 0x66, 0x7a, 0x3a, 0xb9, 0x38, 0x1f, 0xbc, 0xec, 0xd4, 0xd0, 0x06, 0x58, 0x27,
-	0xaf, 0xc7, 0x93, 0xb3, 0x21, 0x3e, 0x1c, 0x75, 0xcc, 0x23, 0x0c, 0x95, 0xef, 0xfe, 0xbb, 0x83,
-	0x20, 0x64, 0x0b, 0x3e, 0x77, 0xfd, 0x98, 0xf6, 0xcb, 0x6e, 0x5f, 0x75, 0x67, 0x34, 0xbe, 0x24,
-	0x51, 0x3f, 0x88, 0x9f, 0x85, 0xf1, 0xac, 0xec, 0xce, 0x54, 0xf7, 0x57, 0x00, 0x00, 0x00, 0xff,
-	0xff, 0xd0, 0x84, 0x91, 0x73, 0x59, 0x06, 0x00, 0x00,
+func init() {
+	proto.RegisterFile("io/prometheus/client/metrics.proto", fileDescriptor_d1e5ddb18987a258)
+}
+
+var fileDescriptor_d1e5ddb18987a258 = []byte{
+	// 896 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xdd, 0x8e, 0xdb, 0x44,
+	0x18, 0xc5, 0x9b, 0x5f, 0x7f, 0xd9, 0x6c, 0xd3, 0x61, 0x55, 0x59, 0x0b, 0xcb, 0x06, 0x4b, 0x48,
+	0x0b, 0x42, 0x8e, 0x40, 0x5b, 0x81, 0x0a, 0x5c, 0xec, 0xb6, 0xe9, 0x16, 0x89, 0xb4, 0x65, 0x92,
+	0x5c, 0x14, 0x2e, 0xac, 0x49, 0x32, 0xeb, 0x58, 0x78, 0x3c, 0xc6, 0x1e, 0x57, 0x2c, 0x2f, 0xc0,
+	0x35, 0xaf, 0xc0, 0xc3, 0xf0, 0x22, 0x3c, 0x08, 0x68, 0xfe, 0xec, 0xdd, 0xe2, 0x94, 0xd2, 0x3b,
+	0x7f, 0x67, 0xce, 0xf7, 0xcd, 0x39, 0xe3, 0xc9, 0x71, 0xc0, 0x8f, 0xf9, 0x24, 0xcb, 0x39, 0xa3,
+	0x62, 0x4b, 0xcb, 0x62, 0xb2, 0x4e, 0x62, 0x9a, 0x8a, 0x09, 0xa3, 0x22, 0x8f, 0xd7, 0x45, 0x90,
+	0xe5, 0x5c, 0x70, 0x74, 0x18, 0xf3, 0xa0, 0xe6, 0x04, 0x9a, 0x73, 0x74, 0x12, 0x71, 0x1e, 0x25,
+	0x74, 0xa2, 0x38, 0xab, 0xf2, 0x6a, 0x22, 0x62, 0x46, 0x0b, 0x41, 0x58, 0xa6, 0xdb, 0xfc, 0xfb,
+	0xe0, 0x7e, 0x47, 0x56, 0x34, 0x79, 0x4e, 0xe2, 0x1c, 0x21, 0x68, 0xa7, 0x84, 0x51, 0xcf, 0x19,
+	0x3b, 0xa7, 0x2e, 0x56, 0xcf, 0xe8, 0x10, 0x3a, 0x2f, 0x49, 0x52, 0x52, 0x6f, 0x4f, 0x81, 0xba,
+	0xf0, 0x8f, 0xa1, 0x73, 0x49, 0xca, 0xe8, 0xc6, 0xb2, 0xec, 0x71, 0xec, 0xf2, 0x8f, 0xd0, 0x7b,
+	0xc8, 0xcb, 0x54, 0xd0, 0xbc, 0x99, 0x80, 0x1e, 0x40, 0x9f, 0xfe, 0x42, 0x59, 0x96, 0x90, 0x5c,
+	0x0d, 0x1e, 0x7c, 0xfe, 0x41, 0xd0, 0x64, 0x20, 0x98, 0x1a, 0x16, 0xae, 0xf8, 0xfe, 0xd7, 0xd0,
+	0xff, 0xbe, 0x24, 0xa9, 0x88, 0x13, 0x8a, 0x8e, 0xa0, 0xff, 0xb3, 0x79, 0x36, 0x1b, 0x54, 0xf5,
+	0x6d, 0xe5, 0x95, 0xb4, 0xdf, 0x1c, 0xe8, 0xcd, 0x4b, 0xc6, 0x48, 0x7e, 0x8d, 0x3e, 0x84, 0xfd,
+	0x82, 0xb0, 0x2c, 0xa1, 0xe1, 0x5a, 0xaa, 0x55, 0x13, 0xda, 0x78, 0xa0, 0x31, 0x65, 0x00, 0x1d,
+	0x03, 0x18, 0x4a, 0x51, 0x32, 0x33, 0xc9, 0xd5, 0xc8, 0xbc, 0x64, 0xd2, 0x47, 0xb5, 0x7f, 0x6b,
+	0xdc, 0xda, 0xed, 0xc3, 0x2a, 0xae, 0xf5, 0xf9, 0x27, 0xd0, 0x5b, 0xa6, 0xe2, 0x3a, 0xa3, 0x9b,
+	0x1d, 0xa7, 0xf8, 0x57, 0x1b, 0xdc, 0x27, 0x71, 0x21, 0x78, 0x94, 0x13, 0xf6, 0x26, 0x62, 0x3f,
+	0x05, 0x74, 0x93, 0x12, 0x5e, 0x25, 0x9c, 0x08, 0xaf, 0xad, 0x66, 0x8e, 0x6e, 0x10, 0x1f, 0x4b,
+	0xfc, 0xbf, 0xac, 0x9d, 0x41, 0x77, 0x55, 0xae, 0x7f, 0xa2, 0xc2, 0x18, 0x7b, 0xbf, 0xd9, 0xd8,
+	0x85, 0xe2, 0x60, 0xc3, 0x45, 0xf7, 0xa0, 0x5b, 0xac, 0xb7, 0x94, 0x11, 0xaf, 0x33, 0x76, 0x4e,
+	0xef, 0x62, 0x53, 0xa1, 0x8f, 0xe0, 0xe0, 0x57, 0x9a, 0xf3, 0x50, 0x6c, 0x73, 0x5a, 0x6c, 0x79,
+	0xb2, 0xf1, 0xba, 0x6a, 0xc3, 0xa1, 0x44, 0x17, 0x16, 0x94, 0x9a, 0x14, 0x4d, 0x5b, 0xec, 0x29,
+	0x8b, 0xae, 0x44, 0xb4, 0xc1, 0x53, 0x18, 0xd5, 0xcb, 0xc6, 0x5e, 0x5f, 0xcd, 0x39, 0xa8, 0x48,
+	0xda, 0xdc, 0x14, 0x86, 0x29, 0x8d, 0x88, 0x88, 0x5f, 0xd2, 0xb0, 0xc8, 0x48, 0xea, 0xb9, 0xca,
+	0xc4, 0xf8, 0x75, 0x26, 0xe6, 0x19, 0x49, 0xf1, 0xbe, 0x6d, 0x93, 0x95, 0x94, 0x5d, 0x8d, 0xd9,
+	0xd0, 0x44, 0x10, 0x0f, 0xc6, 0xad, 0x53, 0x84, 0xab, 0xe1, 0x8f, 0x24, 0x78, 0x8b, 0xa6, 0xa5,
+	0x0f, 0xc6, 0x2d, 0xe9, 0xce, 0xa2, 0x5a, 0xfe, 0x14, 0x86, 0x19, 0x2f, 0xe2, 0x5a, 0xd4, 0xfe,
+	0x9b, 0x8a, 0xb2, 0x6d, 0x56, 0x54, 0x35, 0x46, 0x8b, 0x1a, 0x6a, 0x51, 0x16, 0xad, 0x44, 0x55,
+	0x34, 0x2d, 0xea, 0x40, 0x8b, 0xb2, 0xa8, 0x12, 0xe5, 0xff, 0xe9, 0x40, 0x57, 0x6f, 0x85, 0x3e,
+	0x86, 0xd1, 0xba, 0x64, 0x65, 0x72, 0xd3, 0x88, 0xbe, 0x66, 0x77, 0x6a, 0x5c, 0x5b, 0x39, 0x83,
+	0x7b, 0xaf, 0x52, 0x6f, 0x5d, 0xb7, 0xc3, 0x57, 0x1a, 0xf4, 0x5b, 0x39, 0x81, 0x41, 0x99, 0x65,
+	0x34, 0x0f, 0x57, 0xbc, 0x4c, 0x37, 0xe6, 0xce, 0x81, 0x82, 0x2e, 0x24, 0x72, 0x2b, 0x17, 0x5a,
+	0xff, 0x3b, 0x17, 0xa0, 0x3e, 0x32, 0x79, 0x11, 0xf9, 0xd5, 0x55, 0x41, 0xb5, 0x83, 0xbb, 0xd8,
+	0x54, 0x12, 0x4f, 0x68, 0x1a, 0x89, 0xad, 0xda, 0x7d, 0x88, 0x4d, 0xe5, 0xff, 0xee, 0x40, 0xdf,
+	0x0e, 0x45, 0xf7, 0xa1, 0x93, 0xc8, 0x54, 0xf4, 0x1c, 0xf5, 0x82, 0x4e, 0x9a, 0x35, 0x54, 0xc1,
+	0x89, 0x35, 0xbb, 0x39, 0x71, 0xd0, 0x97, 0xe0, 0x56, 0xa9, 0x6b, 0x4c, 0x1d, 0x05, 0x3a, 0x97,
+	0x03, 0x9b, 0xcb, 0xc1, 0xc2, 0x32, 0x70, 0x4d, 0xf6, 0xff, 0xde, 0x83, 0xee, 0x4c, 0xa5, 0xfc,
+	0xdb, 0x2a, 0xfa, 0x0c, 0x3a, 0x91, 0xcc, 0x69, 0x13, 0xb2, 0xef, 0x35, 0xb7, 0xa9, 0x28, 0xc7,
+	0x9a, 0x89, 0xbe, 0x80, 0xde, 0x5a, 0x67, 0xb7, 0x11, 0x7b, 0xdc, 0xdc, 0x64, 0x02, 0x1e, 0x5b,
+	0xb6, 0x6c, 0x2c, 0x74, 0xb0, 0xaa, 0x3b, 0xb0, 0xb3, 0xd1, 0xa4, 0x2f, 0xb6, 0x6c, 0xd9, 0x58,
+	0xea, 0x20, 0x54, 0xa1, 0xb1, 0xb3, 0xd1, 0xa4, 0x25, 0xb6, 0x6c, 0xf4, 0x0d, 0xb8, 0x5b, 0x9b,
+	0x8f, 0x2a, 0x2c, 0x76, 0x1e, 0x4c, 0x15, 0xa3, 0xb8, 0xee, 0x90, 0x89, 0x5a, 0x9d, 0x75, 0xc8,
+	0x0a, 0x95, 0x48, 0x2d, 0x3c, 0xa8, 0xb0, 0x59, 0xe1, 0xff, 0xe1, 0xc0, 0xbe, 0x7e, 0x03, 0x8f,
+	0x09, 0x8b, 0x93, 0xeb, 0xc6, 0x4f, 0x24, 0x82, 0xf6, 0x96, 0x26, 0x99, 0xf9, 0x42, 0xaa, 0x67,
+	0x74, 0x06, 0x6d, 0xa9, 0x51, 0x1d, 0xe1, 0xc1, 0xae, 0x5f, 0xb8, 0x9e, 0xbc, 0xb8, 0xce, 0x28,
+	0x56, 0x6c, 0x99, 0xb9, 0xfa, 0xab, 0xee, 0xb5, 0x5f, 0x97, 0xb9, 0xba, 0x0f, 0x1b, 0xee, 0x27,
+	0x2b, 0x80, 0x7a, 0x12, 0x1a, 0x40, 0xef, 0xe1, 0xb3, 0xe5, 0xd3, 0xc5, 0x14, 0x8f, 0xde, 0x41,
+	0x2e, 0x74, 0x2e, 0xcf, 0x97, 0x97, 0xd3, 0x91, 0x23, 0xf1, 0xf9, 0x72, 0x36, 0x3b, 0xc7, 0x2f,
+	0x46, 0x7b, 0xb2, 0x58, 0x3e, 0x5d, 0xbc, 0x78, 0x3e, 0x7d, 0x34, 0x6a, 0xa1, 0x21, 0xb8, 0x4f,
+	0xbe, 0x9d, 0x2f, 0x9e, 0x5d, 0xe2, 0xf3, 0xd9, 0xa8, 0x8d, 0xde, 0x85, 0x3b, 0xaa, 0x27, 0xac,
+	0xc1, 0xce, 0x05, 0x86, 0xc6, 0x3f, 0x18, 0x3f, 0x3c, 0x88, 0x62, 0xb1, 0x2d, 0x57, 0xc1, 0x9a,
+	0xb3, 0x7f, 0xff, 0x45, 0x09, 0x19, 0xdf, 0xd0, 0x64, 0x12, 0xf1, 0xaf, 0x62, 0x1e, 0xd6, 0xab,
+	0xa1, 0x5e, 0xfd, 0x27, 0x00, 0x00, 0xff, 0xff, 0x16, 0x77, 0x81, 0x98, 0xd7, 0x08, 0x00, 0x00,
 }
diff --git a/vendor/github.com/prometheus/common/expfmt/decode.go b/vendor/github.com/prometheus/common/expfmt/decode.go
index 7657f841d6..f4fc884552 100644
--- a/vendor/github.com/prometheus/common/expfmt/decode.go
+++ b/vendor/github.com/prometheus/common/expfmt/decode.go
@@ -115,32 +115,28 @@ func (d *protoDecoder) Decode(v *dto.MetricFamily) error {
 // textDecoder implements the Decoder interface for the text protocol.
 type textDecoder struct {
 	r    io.Reader
-	p    TextParser
-	fams []*dto.MetricFamily
+	fams map[string]*dto.MetricFamily
+	err  error
 }
 
 // Decode implements the Decoder interface.
 func (d *textDecoder) Decode(v *dto.MetricFamily) error {
-	// TODO(fabxc): Wrap this as a line reader to make streaming safer.
-	if len(d.fams) == 0 {
-		// No cached metric families, read everything and parse metrics.
-		fams, err := d.p.TextToMetricFamilies(d.r)
-		if err != nil {
-			return err
-		}
-		if len(fams) == 0 {
-			return io.EOF
-		}
-		d.fams = make([]*dto.MetricFamily, 0, len(fams))
-		for _, f := range fams {
-			d.fams = append(d.fams, f)
+	if d.err == nil {
+		// Read all metrics in one shot.
+		var p TextParser
+		d.fams, d.err = p.TextToMetricFamilies(d.r)
+		// If we don't get an error, store io.EOF for the end.
+		if d.err == nil {
+			d.err = io.EOF
 		}
 	}
-
-	*v = *d.fams[0]
-	d.fams = d.fams[1:]
-
-	return nil
+	// Pick off one MetricFamily per Decode until there's nothing left.
+	for key, fam := range d.fams {
+		*v = *fam
+		delete(d.fams, key)
+		return nil
+	}
+	return d.err
 }
 
 // SampleDecoder wraps a Decoder to extract samples from the metric families
diff --git a/vendor/github.com/prometheus/common/expfmt/encode.go b/vendor/github.com/prometheus/common/expfmt/encode.go
index bd4e347454..64dc0eb40c 100644
--- a/vendor/github.com/prometheus/common/expfmt/encode.go
+++ b/vendor/github.com/prometheus/common/expfmt/encode.go
@@ -18,7 +18,7 @@ import (
 	"io"
 	"net/http"
 
-	"github.com/golang/protobuf/proto"
+	"github.com/golang/protobuf/proto" //nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
 	"github.com/matttproud/golang_protobuf_extensions/pbutil"
 	"github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg"
 
diff --git a/vendor/github.com/prometheus/common/expfmt/fuzz.go b/vendor/github.com/prometheus/common/expfmt/fuzz.go
index dc2eedeefc..dfac962a4e 100644
--- a/vendor/github.com/prometheus/common/expfmt/fuzz.go
+++ b/vendor/github.com/prometheus/common/expfmt/fuzz.go
@@ -12,6 +12,7 @@
 // limitations under the License.
 
 // Build only when actually fuzzing
+//go:build gofuzz
 // +build gofuzz
 
 package expfmt
@@ -20,8 +21,8 @@ import "bytes"
 
 // Fuzz text metric parser with with github.com/dvyukov/go-fuzz:
 //
-//     go-fuzz-build github.com/prometheus/common/expfmt
-//     go-fuzz -bin expfmt-fuzz.zip -workdir fuzz
+//	go-fuzz-build github.com/prometheus/common/expfmt
+//	go-fuzz -bin expfmt-fuzz.zip -workdir fuzz
 //
 // Further input samples should go in the folder fuzz/corpus.
 func Fuzz(in []byte) int {
diff --git a/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go b/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go
index 8a9313a3be..21cdddcf05 100644
--- a/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go
+++ b/vendor/github.com/prometheus/common/expfmt/openmetrics_create.go
@@ -22,7 +22,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/golang/protobuf/ptypes"
 	"github.com/prometheus/common/model"
 
 	dto "github.com/prometheus/client_model/go"
@@ -47,20 +46,20 @@ import (
 // missing features and peculiarities to avoid complications when switching from
 // Prometheus to OpenMetrics or vice versa:
 //
-// - Counters are expected to have the `_total` suffix in their metric name. In
-//   the output, the suffix will be truncated from the `# TYPE` and `# HELP`
-//   line. A counter with a missing `_total` suffix is not an error. However,
-//   its type will be set to `unknown` in that case to avoid invalid OpenMetrics
-//   output.
+//   - Counters are expected to have the `_total` suffix in their metric name. In
+//     the output, the suffix will be truncated from the `# TYPE` and `# HELP`
+//     line. A counter with a missing `_total` suffix is not an error. However,
+//     its type will be set to `unknown` in that case to avoid invalid OpenMetrics
+//     output.
 //
-// - No support for the following (optional) features: `# UNIT` line, `_created`
-//   line, info type, stateset type, gaugehistogram type.
+//   - No support for the following (optional) features: `# UNIT` line, `_created`
+//     line, info type, stateset type, gaugehistogram type.
 //
-// - The size of exemplar labels is not checked (i.e. it's possible to create
-//   exemplars that are larger than allowed by the OpenMetrics specification).
+//   - The size of exemplar labels is not checked (i.e. it's possible to create
+//     exemplars that are larger than allowed by the OpenMetrics specification).
 //
-// - The value of Counters is not checked. (OpenMetrics doesn't allow counters
-//   with a `NaN` value.)
+//   - The value of Counters is not checked. (OpenMetrics doesn't allow counters
+//     with a `NaN` value.)
 func MetricFamilyToOpenMetrics(out io.Writer, in *dto.MetricFamily) (written int, err error) {
 	name := in.GetName()
 	if name == "" {
@@ -473,10 +472,11 @@ func writeExemplar(w enhancedWriter, e *dto.Exemplar) (int, error) {
 		if err != nil {
 			return written, err
 		}
-		ts, err := ptypes.Timestamp((*e).Timestamp)
+		err = (*e).Timestamp.CheckValid()
 		if err != nil {
 			return written, err
 		}
+		ts := (*e).Timestamp.AsTime()
 		// TODO(beorn7): Format this directly from components of ts to
 		// avoid overflow/underflow and precision issues of the float
 		// conversion.
diff --git a/vendor/github.com/prometheus/common/expfmt/text_create.go b/vendor/github.com/prometheus/common/expfmt/text_create.go
index 5ba503b065..2946b8f1a6 100644
--- a/vendor/github.com/prometheus/common/expfmt/text_create.go
+++ b/vendor/github.com/prometheus/common/expfmt/text_create.go
@@ -17,7 +17,6 @@ import (
 	"bufio"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math"
 	"strconv"
 	"strings"
@@ -44,7 +43,7 @@ const (
 var (
 	bufPool = sync.Pool{
 		New: func() interface{} {
-			return bufio.NewWriter(ioutil.Discard)
+			return bufio.NewWriter(io.Discard)
 		},
 	}
 	numBufPool = sync.Pool{
diff --git a/vendor/github.com/prometheus/common/expfmt/text_parse.go b/vendor/github.com/prometheus/common/expfmt/text_parse.go
index b6079b31ee..ac2482782c 100644
--- a/vendor/github.com/prometheus/common/expfmt/text_parse.go
+++ b/vendor/github.com/prometheus/common/expfmt/text_parse.go
@@ -24,7 +24,7 @@ import (
 
 	dto "github.com/prometheus/client_model/go"
 
-	"github.com/golang/protobuf/proto"
+	"github.com/golang/protobuf/proto" //nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
 	"github.com/prometheus/common/model"
 )
 
@@ -142,9 +142,13 @@ func (p *TextParser) reset(in io.Reader) {
 func (p *TextParser) startOfLine() stateFn {
 	p.lineCount++
 	if p.skipBlankTab(); p.err != nil {
-		// End of input reached. This is the only case where
-		// that is not an error but a signal that we are done.
-		p.err = nil
+		// This is the only place that we expect to see io.EOF,
+		// which is not an error but the signal that we are done.
+		// Any other error that happens to align with the start of
+		// a line is still an error.
+		if p.err == io.EOF {
+			p.err = nil
+		}
 		return nil
 	}
 	switch p.currentByte {
diff --git a/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go b/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go
index 26e92288c7..a21b9d15dd 100644
--- a/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go
+++ b/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/autoneg.go
@@ -11,18 +11,18 @@ Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 
-    Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer.
+	Redistributions of source code must retain the above copyright
+	notice, this list of conditions and the following disclaimer.
 
-    Redistributions in binary form must reproduce the above copyright
-    notice, this list of conditions and the following disclaimer in
-    the documentation and/or other materials provided with the
-    distribution.
+	Redistributions in binary form must reproduce the above copyright
+	notice, this list of conditions and the following disclaimer in
+	the documentation and/or other materials provided with the
+	distribution.
 
-    Neither the name of the Open Knowledge Foundation Ltd. nor the
-    names of its contributors may be used to endorse or promote
-    products derived from this software without specific prior written
-    permission.
+	Neither the name of the Open Knowledge Foundation Ltd. nor the
+	names of its contributors may be used to endorse or promote
+	products derived from this software without specific prior written
+	permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
@@ -35,8 +35,6 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
 */
 package goautoneg
 
diff --git a/vendor/github.com/prometheus/common/model/time.go b/vendor/github.com/prometheus/common/model/time.go
index 7f67b16e42..5727452c1e 100644
--- a/vendor/github.com/prometheus/common/model/time.go
+++ b/vendor/github.com/prometheus/common/model/time.go
@@ -18,7 +18,6 @@ import (
 	"errors"
 	"fmt"
 	"math"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -183,54 +182,78 @@ func (d *Duration) Type() string {
 	return "duration"
 }
 
-var durationRE = regexp.MustCompile("^(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?$")
+func isdigit(c byte) bool { return c >= '0' && c <= '9' }
+
+// Units are required to go in order from biggest to smallest.
+// This guards against confusion from "1m1d" being 1 minute + 1 day, not 1 month + 1 day.
+var unitMap = map[string]struct {
+	pos  int
+	mult uint64
+}{
+	"ms": {7, uint64(time.Millisecond)},
+	"s":  {6, uint64(time.Second)},
+	"m":  {5, uint64(time.Minute)},
+	"h":  {4, uint64(time.Hour)},
+	"d":  {3, uint64(24 * time.Hour)},
+	"w":  {2, uint64(7 * 24 * time.Hour)},
+	"y":  {1, uint64(365 * 24 * time.Hour)},
+}
 
 // ParseDuration parses a string into a time.Duration, assuming that a year
 // always has 365d, a week always has 7d, and a day always has 24h.
-func ParseDuration(durationStr string) (Duration, error) {
-	switch durationStr {
+func ParseDuration(s string) (Duration, error) {
+	switch s {
 	case "0":
 		// Allow 0 without a unit.
 		return 0, nil
 	case "":
-		return 0, fmt.Errorf("empty duration string")
-	}
-	matches := durationRE.FindStringSubmatch(durationStr)
-	if matches == nil {
-		return 0, fmt.Errorf("not a valid duration string: %q", durationStr)
+		return 0, errors.New("empty duration string")
 	}
-	var dur time.Duration
 
-	// Parse the match at pos `pos` in the regex and use `mult` to turn that
-	// into ms, then add that value to the total parsed duration.
-	var overflowErr error
-	m := func(pos int, mult time.Duration) {
-		if matches[pos] == "" {
-			return
+	orig := s
+	var dur uint64
+	lastUnitPos := 0
+
+	for s != "" {
+		if !isdigit(s[0]) {
+			return 0, fmt.Errorf("not a valid duration string: %q", orig)
+		}
+		// Consume [0-9]*
+		i := 0
+		for ; i < len(s) && isdigit(s[i]); i++ {
+		}
+		v, err := strconv.ParseUint(s[:i], 10, 0)
+		if err != nil {
+			return 0, fmt.Errorf("not a valid duration string: %q", orig)
 		}
-		n, _ := strconv.Atoi(matches[pos])
+		s = s[i:]
 
+		// Consume unit.
+		for i = 0; i < len(s) && !isdigit(s[i]); i++ {
+		}
+		if i == 0 {
+			return 0, fmt.Errorf("not a valid duration string: %q", orig)
+		}
+		u := s[:i]
+		s = s[i:]
+		unit, ok := unitMap[u]
+		if !ok {
+			return 0, fmt.Errorf("unknown unit %q in duration %q", u, orig)
+		}
+		if unit.pos <= lastUnitPos { // Units must go in order from biggest to smallest.
+			return 0, fmt.Errorf("not a valid duration string: %q", orig)
+		}
+		lastUnitPos = unit.pos
 		// Check if the provided duration overflows time.Duration (> ~ 290years).
-		if n > int((1<<63-1)/mult/time.Millisecond) {
-			overflowErr = errors.New("duration out of range")
+		if v > 1<<63/unit.mult {
+			return 0, errors.New("duration out of range")
 		}
-		d := time.Duration(n) * time.Millisecond
-		dur += d * mult
-
-		if dur < 0 {
-			overflowErr = errors.New("duration out of range")
+		dur += v * unit.mult
+		if dur > 1<<63-1 {
+			return 0, errors.New("duration out of range")
 		}
 	}
-
-	m(2, 1000*60*60*24*365) // y
-	m(4, 1000*60*60*24*7)   // w
-	m(6, 1000*60*60*24)     // d
-	m(8, 1000*60*60)        // h
-	m(10, 1000*60)          // m
-	m(12, 1000)             // s
-	m(14, 1)                // ms
-
-	return Duration(dur), overflowErr
+	return Duration(dur), nil
 }
 
 func (d Duration) String() string {
diff --git a/vendor/github.com/prometheus/common/model/value.go b/vendor/github.com/prometheus/common/model/value.go
index c9d8fb1a28..9eb440413f 100644
--- a/vendor/github.com/prometheus/common/model/value.go
+++ b/vendor/github.com/prometheus/common/model/value.go
@@ -16,20 +16,12 @@ package model
 import (
 	"encoding/json"
 	"fmt"
-	"math"
 	"sort"
 	"strconv"
 	"strings"
 )
 
 var (
-	// ZeroSamplePair is the pseudo zero-value of SamplePair used to signal a
-	// non-existing sample pair. It is a SamplePair with timestamp Earliest and
-	// value 0.0. Note that the natural zero value of SamplePair has a timestamp
-	// of 0, which is possible to appear in a real SamplePair and thus not
-	// suitable to signal a non-existing SamplePair.
-	ZeroSamplePair = SamplePair{Timestamp: Earliest}
-
 	// ZeroSample is the pseudo zero-value of Sample used to signal a
 	// non-existing sample. It is a Sample with timestamp Earliest, value 0.0,
 	// and metric nil. Note that the natural zero value of Sample has a timestamp
@@ -38,82 +30,14 @@ var (
 	ZeroSample = Sample{Timestamp: Earliest}
 )
 
-// A SampleValue is a representation of a value for a given sample at a given
-// time.
-type SampleValue float64
-
-// MarshalJSON implements json.Marshaler.
-func (v SampleValue) MarshalJSON() ([]byte, error) {
-	return json.Marshal(v.String())
-}
-
-// UnmarshalJSON implements json.Unmarshaler.
-func (v *SampleValue) UnmarshalJSON(b []byte) error {
-	if len(b) < 2 || b[0] != '"' || b[len(b)-1] != '"' {
-		return fmt.Errorf("sample value must be a quoted string")
-	}
-	f, err := strconv.ParseFloat(string(b[1:len(b)-1]), 64)
-	if err != nil {
-		return err
-	}
-	*v = SampleValue(f)
-	return nil
-}
-
-// Equal returns true if the value of v and o is equal or if both are NaN. Note
-// that v==o is false if both are NaN. If you want the conventional float
-// behavior, use == to compare two SampleValues.
-func (v SampleValue) Equal(o SampleValue) bool {
-	if v == o {
-		return true
-	}
-	return math.IsNaN(float64(v)) && math.IsNaN(float64(o))
-}
-
-func (v SampleValue) String() string {
-	return strconv.FormatFloat(float64(v), 'f', -1, 64)
-}
-
-// SamplePair pairs a SampleValue with a Timestamp.
-type SamplePair struct {
-	Timestamp Time
-	Value     SampleValue
-}
-
-// MarshalJSON implements json.Marshaler.
-func (s SamplePair) MarshalJSON() ([]byte, error) {
-	t, err := json.Marshal(s.Timestamp)
-	if err != nil {
-		return nil, err
-	}
-	v, err := json.Marshal(s.Value)
-	if err != nil {
-		return nil, err
-	}
-	return []byte(fmt.Sprintf("[%s,%s]", t, v)), nil
-}
-
-// UnmarshalJSON implements json.Unmarshaler.
-func (s *SamplePair) UnmarshalJSON(b []byte) error {
-	v := [...]json.Unmarshaler{&s.Timestamp, &s.Value}
-	return json.Unmarshal(b, &v)
-}
-
-// Equal returns true if this SamplePair and o have equal Values and equal
-// Timestamps. The semantics of Value equality is defined by SampleValue.Equal.
-func (s *SamplePair) Equal(o *SamplePair) bool {
-	return s == o || (s.Value.Equal(o.Value) && s.Timestamp.Equal(o.Timestamp))
-}
-
-func (s SamplePair) String() string {
-	return fmt.Sprintf("%s @[%s]", s.Value, s.Timestamp)
-}
-
-// Sample is a sample pair associated with a metric.
+// Sample is a sample pair associated with a metric. A single sample must either
+// define Value or Histogram but not both. Histogram == nil implies the Value
+// field is used, otherwise it should be ignored.
 type Sample struct {
-	Metric    Metric      `json:"metric"`
-	Value     SampleValue `json:"value"`
-	Timestamp Time        `json:"timestamp"`
+	Metric    Metric           `json:"metric"`
+	Value     SampleValue      `json:"value"`
+	Timestamp Time             `json:"timestamp"`
+	Histogram *SampleHistogram `json:"histogram"`
 }
 
 // Equal compares first the metrics, then the timestamp, then the value. The
@@ -129,11 +53,19 @@ func (s *Sample) Equal(o *Sample) bool {
 	if !s.Timestamp.Equal(o.Timestamp) {
 		return false
 	}
-
+	if s.Histogram != nil {
+		return s.Histogram.Equal(o.Histogram)
+	}
 	return s.Value.Equal(o.Value)
 }
 
 func (s Sample) String() string {
+	if s.Histogram != nil {
+		return fmt.Sprintf("%s => %s", s.Metric, SampleHistogramPair{
+			Timestamp: s.Timestamp,
+			Histogram: s.Histogram,
+		})
+	}
 	return fmt.Sprintf("%s => %s", s.Metric, SamplePair{
 		Timestamp: s.Timestamp,
 		Value:     s.Value,
@@ -142,6 +74,19 @@ func (s Sample) String() string {
 
 // MarshalJSON implements json.Marshaler.
 func (s Sample) MarshalJSON() ([]byte, error) {
+	if s.Histogram != nil {
+		v := struct {
+			Metric    Metric              `json:"metric"`
+			Histogram SampleHistogramPair `json:"histogram"`
+		}{
+			Metric: s.Metric,
+			Histogram: SampleHistogramPair{
+				Timestamp: s.Timestamp,
+				Histogram: s.Histogram,
+			},
+		}
+		return json.Marshal(&v)
+	}
 	v := struct {
 		Metric Metric     `json:"metric"`
 		Value  SamplePair `json:"value"`
@@ -152,21 +97,25 @@ func (s Sample) MarshalJSON() ([]byte, error) {
 			Value:     s.Value,
 		},
 	}
-
 	return json.Marshal(&v)
 }
 
 // UnmarshalJSON implements json.Unmarshaler.
 func (s *Sample) UnmarshalJSON(b []byte) error {
 	v := struct {
-		Metric Metric     `json:"metric"`
-		Value  SamplePair `json:"value"`
+		Metric    Metric              `json:"metric"`
+		Value     SamplePair          `json:"value"`
+		Histogram SampleHistogramPair `json:"histogram"`
 	}{
 		Metric: s.Metric,
 		Value: SamplePair{
 			Timestamp: s.Timestamp,
 			Value:     s.Value,
 		},
+		Histogram: SampleHistogramPair{
+			Timestamp: s.Timestamp,
+			Histogram: s.Histogram,
+		},
 	}
 
 	if err := json.Unmarshal(b, &v); err != nil {
@@ -174,8 +123,13 @@ func (s *Sample) UnmarshalJSON(b []byte) error {
 	}
 
 	s.Metric = v.Metric
-	s.Timestamp = v.Value.Timestamp
-	s.Value = v.Value.Value
+	if v.Histogram.Histogram != nil {
+		s.Timestamp = v.Histogram.Timestamp
+		s.Histogram = v.Histogram.Histogram
+	} else {
+		s.Timestamp = v.Value.Timestamp
+		s.Value = v.Value.Value
+	}
 
 	return nil
 }
@@ -221,80 +175,76 @@ func (s Samples) Equal(o Samples) bool {
 
 // SampleStream is a stream of Values belonging to an attached COWMetric.
 type SampleStream struct {
-	Metric Metric       `json:"metric"`
-	Values []SamplePair `json:"values"`
+	Metric     Metric                `json:"metric"`
+	Values     []SamplePair          `json:"values"`
+	Histograms []SampleHistogramPair `json:"histograms"`
 }
 
 func (ss SampleStream) String() string {
-	vals := make([]string, len(ss.Values))
+	valuesLength := len(ss.Values)
+	vals := make([]string, valuesLength+len(ss.Histograms))
 	for i, v := range ss.Values {
 		vals[i] = v.String()
 	}
+	for i, v := range ss.Histograms {
+		vals[i+valuesLength] = v.String()
+	}
 	return fmt.Sprintf("%s =>\n%s", ss.Metric, strings.Join(vals, "\n"))
 }
 
-// Value is a generic interface for values resulting from a query evaluation.
-type Value interface {
-	Type() ValueType
-	String() string
+func (ss SampleStream) MarshalJSON() ([]byte, error) {
+	if len(ss.Histograms) > 0 && len(ss.Values) > 0 {
+		v := struct {
+			Metric     Metric                `json:"metric"`
+			Values     []SamplePair          `json:"values"`
+			Histograms []SampleHistogramPair `json:"histograms"`
+		}{
+			Metric:     ss.Metric,
+			Values:     ss.Values,
+			Histograms: ss.Histograms,
+		}
+		return json.Marshal(&v)
+	} else if len(ss.Histograms) > 0 {
+		v := struct {
+			Metric     Metric                `json:"metric"`
+			Histograms []SampleHistogramPair `json:"histograms"`
+		}{
+			Metric:     ss.Metric,
+			Histograms: ss.Histograms,
+		}
+		return json.Marshal(&v)
+	} else {
+		v := struct {
+			Metric Metric       `json:"metric"`
+			Values []SamplePair `json:"values"`
+		}{
+			Metric: ss.Metric,
+			Values: ss.Values,
+		}
+		return json.Marshal(&v)
+	}
 }
 
-func (Matrix) Type() ValueType  { return ValMatrix }
-func (Vector) Type() ValueType  { return ValVector }
-func (*Scalar) Type() ValueType { return ValScalar }
-func (*String) Type() ValueType { return ValString }
-
-type ValueType int
-
-const (
-	ValNone ValueType = iota
-	ValScalar
-	ValVector
-	ValMatrix
-	ValString
-)
-
-// MarshalJSON implements json.Marshaler.
-func (et ValueType) MarshalJSON() ([]byte, error) {
-	return json.Marshal(et.String())
-}
+func (ss *SampleStream) UnmarshalJSON(b []byte) error {
+	v := struct {
+		Metric     Metric                `json:"metric"`
+		Values     []SamplePair          `json:"values"`
+		Histograms []SampleHistogramPair `json:"histograms"`
+	}{
+		Metric:     ss.Metric,
+		Values:     ss.Values,
+		Histograms: ss.Histograms,
+	}
 
-func (et *ValueType) UnmarshalJSON(b []byte) error {
-	var s string
-	if err := json.Unmarshal(b, &s); err != nil {
+	if err := json.Unmarshal(b, &v); err != nil {
 		return err
 	}
-	switch s {
-	case "<ValNone>":
-		*et = ValNone
-	case "scalar":
-		*et = ValScalar
-	case "vector":
-		*et = ValVector
-	case "matrix":
-		*et = ValMatrix
-	case "string":
-		*et = ValString
-	default:
-		return fmt.Errorf("unknown value type %q", s)
-	}
-	return nil
-}
 
-func (e ValueType) String() string {
-	switch e {
-	case ValNone:
-		return "<ValNone>"
-	case ValScalar:
-		return "scalar"
-	case ValVector:
-		return "vector"
-	case ValMatrix:
-		return "matrix"
-	case ValString:
-		return "string"
-	}
-	panic("ValueType.String: unhandled value type")
+	ss.Metric = v.Metric
+	ss.Values = v.Values
+	ss.Histograms = v.Histograms
+
+	return nil
 }
 
 // Scalar is a scalar value evaluated at the set timestamp.
diff --git a/vendor/github.com/prometheus/common/model/value_float.go b/vendor/github.com/prometheus/common/model/value_float.go
new file mode 100644
index 0000000000..0f615a7053
--- /dev/null
+++ b/vendor/github.com/prometheus/common/model/value_float.go
@@ -0,0 +1,100 @@
+// Copyright 2013 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"strconv"
+)
+
+var (
+	// ZeroSamplePair is the pseudo zero-value of SamplePair used to signal a
+	// non-existing sample pair. It is a SamplePair with timestamp Earliest and
+	// value 0.0. Note that the natural zero value of SamplePair has a timestamp
+	// of 0, which is possible to appear in a real SamplePair and thus not
+	// suitable to signal a non-existing SamplePair.
+	ZeroSamplePair = SamplePair{Timestamp: Earliest}
+)
+
+// A SampleValue is a representation of a value for a given sample at a given
+// time.
+type SampleValue float64
+
+// MarshalJSON implements json.Marshaler.
+func (v SampleValue) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.String())
+}
+
+// UnmarshalJSON implements json.Unmarshaler.
+func (v *SampleValue) UnmarshalJSON(b []byte) error {
+	if len(b) < 2 || b[0] != '"' || b[len(b)-1] != '"' {
+		return fmt.Errorf("sample value must be a quoted string")
+	}
+	f, err := strconv.ParseFloat(string(b[1:len(b)-1]), 64)
+	if err != nil {
+		return err
+	}
+	*v = SampleValue(f)
+	return nil
+}
+
+// Equal returns true if the value of v and o is equal or if both are NaN. Note
+// that v==o is false if both are NaN. If you want the conventional float
+// behavior, use == to compare two SampleValues.
+func (v SampleValue) Equal(o SampleValue) bool {
+	if v == o {
+		return true
+	}
+	return math.IsNaN(float64(v)) && math.IsNaN(float64(o))
+}
+
+func (v SampleValue) String() string {
+	return strconv.FormatFloat(float64(v), 'f', -1, 64)
+}
+
+// SamplePair pairs a SampleValue with a Timestamp.
+type SamplePair struct {
+	Timestamp Time
+	Value     SampleValue
+}
+
+func (s SamplePair) MarshalJSON() ([]byte, error) {
+	t, err := json.Marshal(s.Timestamp)
+	if err != nil {
+		return nil, err
+	}
+	v, err := json.Marshal(s.Value)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(fmt.Sprintf("[%s,%s]", t, v)), nil
+}
+
+// UnmarshalJSON implements json.Unmarshaler.
+func (s *SamplePair) UnmarshalJSON(b []byte) error {
+	v := [...]json.Unmarshaler{&s.Timestamp, &s.Value}
+	return json.Unmarshal(b, &v)
+}
+
+// Equal returns true if this SamplePair and o have equal Values and equal
+// Timestamps. The semantics of Value equality is defined by SampleValue.Equal.
+func (s *SamplePair) Equal(o *SamplePair) bool {
+	return s == o || (s.Value.Equal(o.Value) && s.Timestamp.Equal(o.Timestamp))
+}
+
+func (s SamplePair) String() string {
+	return fmt.Sprintf("%s @[%s]", s.Value, s.Timestamp)
+}
diff --git a/vendor/github.com/prometheus/common/model/value_histogram.go b/vendor/github.com/prometheus/common/model/value_histogram.go
new file mode 100644
index 0000000000..54bb038cff
--- /dev/null
+++ b/vendor/github.com/prometheus/common/model/value_histogram.go
@@ -0,0 +1,178 @@
+// Copyright 2013 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type FloatString float64
+
+func (v FloatString) String() string {
+	return strconv.FormatFloat(float64(v), 'f', -1, 64)
+}
+
+func (v FloatString) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.String())
+}
+
+func (v *FloatString) UnmarshalJSON(b []byte) error {
+	if len(b) < 2 || b[0] != '"' || b[len(b)-1] != '"' {
+		return fmt.Errorf("float value must be a quoted string")
+	}
+	f, err := strconv.ParseFloat(string(b[1:len(b)-1]), 64)
+	if err != nil {
+		return err
+	}
+	*v = FloatString(f)
+	return nil
+}
+
+type HistogramBucket struct {
+	Boundaries int32
+	Lower      FloatString
+	Upper      FloatString
+	Count      FloatString
+}
+
+func (s HistogramBucket) MarshalJSON() ([]byte, error) {
+	b, err := json.Marshal(s.Boundaries)
+	if err != nil {
+		return nil, err
+	}
+	l, err := json.Marshal(s.Lower)
+	if err != nil {
+		return nil, err
+	}
+	u, err := json.Marshal(s.Upper)
+	if err != nil {
+		return nil, err
+	}
+	c, err := json.Marshal(s.Count)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(fmt.Sprintf("[%s,%s,%s,%s]", b, l, u, c)), nil
+}
+
+func (s *HistogramBucket) UnmarshalJSON(buf []byte) error {
+	tmp := []interface{}{&s.Boundaries, &s.Lower, &s.Upper, &s.Count}
+	wantLen := len(tmp)
+	if err := json.Unmarshal(buf, &tmp); err != nil {
+		return err
+	}
+	if gotLen := len(tmp); gotLen != wantLen {
+		return fmt.Errorf("wrong number of fields: %d != %d", gotLen, wantLen)
+	}
+	return nil
+}
+
+func (s *HistogramBucket) Equal(o *HistogramBucket) bool {
+	return s == o || (s.Boundaries == o.Boundaries && s.Lower == o.Lower && s.Upper == o.Upper && s.Count == o.Count)
+}
+
+func (b HistogramBucket) String() string {
+	var sb strings.Builder
+	lowerInclusive := b.Boundaries == 1 || b.Boundaries == 3
+	upperInclusive := b.Boundaries == 0 || b.Boundaries == 3
+	if lowerInclusive {
+		sb.WriteRune('[')
+	} else {
+		sb.WriteRune('(')
+	}
+	fmt.Fprintf(&sb, "%g,%g", b.Lower, b.Upper)
+	if upperInclusive {
+		sb.WriteRune(']')
+	} else {
+		sb.WriteRune(')')
+	}
+	fmt.Fprintf(&sb, ":%v", b.Count)
+	return sb.String()
+}
+
+type HistogramBuckets []*HistogramBucket
+
+func (s HistogramBuckets) Equal(o HistogramBuckets) bool {
+	if len(s) != len(o) {
+		return false
+	}
+
+	for i, bucket := range s {
+		if !bucket.Equal(o[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+type SampleHistogram struct {
+	Count   FloatString      `json:"count"`
+	Sum     FloatString      `json:"sum"`
+	Buckets HistogramBuckets `json:"buckets"`
+}
+
+func (s SampleHistogram) String() string {
+	return fmt.Sprintf("Count: %f, Sum: %f, Buckets: %v", s.Count, s.Sum, s.Buckets)
+}
+
+func (s *SampleHistogram) Equal(o *SampleHistogram) bool {
+	return s == o || (s.Count == o.Count && s.Sum == o.Sum && s.Buckets.Equal(o.Buckets))
+}
+
+type SampleHistogramPair struct {
+	Timestamp Time
+	// Histogram should never be nil, it's only stored as pointer for efficiency.
+	Histogram *SampleHistogram
+}
+
+func (s SampleHistogramPair) MarshalJSON() ([]byte, error) {
+	if s.Histogram == nil {
+		return nil, fmt.Errorf("histogram is nil")
+	}
+	t, err := json.Marshal(s.Timestamp)
+	if err != nil {
+		return nil, err
+	}
+	v, err := json.Marshal(s.Histogram)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(fmt.Sprintf("[%s,%s]", t, v)), nil
+}
+
+func (s *SampleHistogramPair) UnmarshalJSON(buf []byte) error {
+	tmp := []interface{}{&s.Timestamp, &s.Histogram}
+	wantLen := len(tmp)
+	if err := json.Unmarshal(buf, &tmp); err != nil {
+		return err
+	}
+	if gotLen := len(tmp); gotLen != wantLen {
+		return fmt.Errorf("wrong number of fields: %d != %d", gotLen, wantLen)
+	}
+	if s.Histogram == nil {
+		return fmt.Errorf("histogram is null")
+	}
+	return nil
+}
+
+func (s SampleHistogramPair) String() string {
+	return fmt.Sprintf("%s @[%s]", s.Histogram, s.Timestamp)
+}
+
+func (s *SampleHistogramPair) Equal(o *SampleHistogramPair) bool {
+	return s == o || (s.Histogram.Equal(o.Histogram) && s.Timestamp.Equal(o.Timestamp))
+}
diff --git a/vendor/github.com/prometheus/common/model/value_type.go b/vendor/github.com/prometheus/common/model/value_type.go
new file mode 100644
index 0000000000..726c50ee63
--- /dev/null
+++ b/vendor/github.com/prometheus/common/model/value_type.go
@@ -0,0 +1,83 @@
+// Copyright 2013 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// Value is a generic interface for values resulting from a query evaluation.
+type Value interface {
+	Type() ValueType
+	String() string
+}
+
+func (Matrix) Type() ValueType  { return ValMatrix }
+func (Vector) Type() ValueType  { return ValVector }
+func (*Scalar) Type() ValueType { return ValScalar }
+func (*String) Type() ValueType { return ValString }
+
+type ValueType int
+
+const (
+	ValNone ValueType = iota
+	ValScalar
+	ValVector
+	ValMatrix
+	ValString
+)
+
+// MarshalJSON implements json.Marshaler.
+func (et ValueType) MarshalJSON() ([]byte, error) {
+	return json.Marshal(et.String())
+}
+
+func (et *ValueType) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	switch s {
+	case "<ValNone>":
+		*et = ValNone
+	case "scalar":
+		*et = ValScalar
+	case "vector":
+		*et = ValVector
+	case "matrix":
+		*et = ValMatrix
+	case "string":
+		*et = ValString
+	default:
+		return fmt.Errorf("unknown value type %q", s)
+	}
+	return nil
+}
+
+func (e ValueType) String() string {
+	switch e {
+	case ValNone:
+		return "<ValNone>"
+	case ValScalar:
+		return "scalar"
+	case ValVector:
+		return "vector"
+	case ValMatrix:
+		return "matrix"
+	case ValString:
+		return "string"
+	}
+	panic("ValueType.String: unhandled value type")
+}
diff --git a/vendor/github.com/prometheus/procfs/.gitignore b/vendor/github.com/prometheus/procfs/.gitignore
index 25e3659ab2..7cc33ae4a7 100644
--- a/vendor/github.com/prometheus/procfs/.gitignore
+++ b/vendor/github.com/prometheus/procfs/.gitignore
@@ -1 +1,2 @@
-/fixtures/
+/testdata/fixtures/
+/fixtures
diff --git a/vendor/github.com/prometheus/procfs/.golangci.yml b/vendor/github.com/prometheus/procfs/.golangci.yml
index 0aa09edacb..a197699a1e 100644
--- a/vendor/github.com/prometheus/procfs/.golangci.yml
+++ b/vendor/github.com/prometheus/procfs/.golangci.yml
@@ -1,4 +1,12 @@
 ---
 linters:
   enable:
-  - golint
+  - godot
+  - revive
+
+linter-settings:
+  godot:
+    capital: true
+    exclude:
+    # Ignore "See: URL"
+    - 'See:'
diff --git a/vendor/github.com/prometheus/procfs/CODE_OF_CONDUCT.md b/vendor/github.com/prometheus/procfs/CODE_OF_CONDUCT.md
index 9a1aff4127..d325872bdf 100644
--- a/vendor/github.com/prometheus/procfs/CODE_OF_CONDUCT.md
+++ b/vendor/github.com/prometheus/procfs/CODE_OF_CONDUCT.md
@@ -1,3 +1,3 @@
-## Prometheus Community Code of Conduct
+# Prometheus Community Code of Conduct
 
-Prometheus follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+Prometheus follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
diff --git a/vendor/github.com/prometheus/procfs/CONTRIBUTING.md b/vendor/github.com/prometheus/procfs/CONTRIBUTING.md
index 943de7615e..853eb9d49b 100644
--- a/vendor/github.com/prometheus/procfs/CONTRIBUTING.md
+++ b/vendor/github.com/prometheus/procfs/CONTRIBUTING.md
@@ -97,7 +97,7 @@ Many of the files are changing continuously and the data being read can in some
 reads in the same file.  Also, most of the files are relatively small (less than a few KBs), and system calls
 to the `stat` function will often return the wrong size.  Therefore, for most files it's recommended to read the 
 full file in a single operation using an internal utility function called `util.ReadFileNoStat`.
-This function is similar to `ioutil.ReadFile`, but it avoids the system call to `stat` to get the current size of
+This function is similar to `os.ReadFile`, but it avoids the system call to `stat` to get the current size of
 the file.
 
 Note that parsing the file's contents can still be performed one line at a time.  This is done by first reading 
@@ -113,7 +113,7 @@ the full file, and then using a scanner on the `[]byte` or `string` containing t
 ```
 
 The `/sys` filesystem contains many very small files which contain only a single numeric or text value.  These files
-can be read using an internal function called `util.SysReadFile` which is similar to `ioutil.ReadFile` but does
+can be read using an internal function called `util.SysReadFile` which is similar to `os.ReadFile` but does
 not bother to check the size of the file before reading.
 ```
     data, err := util.SysReadFile("/sys/class/power_supply/BAT0/capacity")
diff --git a/vendor/github.com/prometheus/procfs/Makefile b/vendor/github.com/prometheus/procfs/Makefile
index 616a0d25eb..7edfe4d093 100644
--- a/vendor/github.com/prometheus/procfs/Makefile
+++ b/vendor/github.com/prometheus/procfs/Makefile
@@ -14,16 +14,18 @@
 include Makefile.common
 
 %/.unpacked: %.ttar
-	@echo ">> extracting fixtures"
+	@echo ">> extracting fixtures $*"
 	./ttar -C $(dir $*) -x -f $*.ttar
 	touch $@
 
+fixtures: testdata/fixtures/.unpacked
+
 update_fixtures:
-	rm -vf fixtures/.unpacked
-	./ttar -c -f fixtures.ttar fixtures/
+	rm -vf testdata/fixtures/.unpacked
+	./ttar -c -f testdata/fixtures.ttar -C testdata/ fixtures/
 
 .PHONY: build
 build:
 
 .PHONY: test
-test: fixtures/.unpacked common-test
+test: testdata/fixtures/.unpacked common-test
diff --git a/vendor/github.com/prometheus/procfs/Makefile.common b/vendor/github.com/prometheus/procfs/Makefile.common
index 3ac29c636c..e358db69c5 100644
--- a/vendor/github.com/prometheus/procfs/Makefile.common
+++ b/vendor/github.com/prometheus/procfs/Makefile.common
@@ -36,29 +36,6 @@ GO_VERSION        ?= $(shell $(GO) version)
 GO_VERSION_NUMBER ?= $(word 3, $(GO_VERSION))
 PRE_GO_111        ?= $(shell echo $(GO_VERSION_NUMBER) | grep -E 'go1\.(10|[0-9])\.')
 
-GOVENDOR :=
-GO111MODULE :=
-ifeq (, $(PRE_GO_111))
-	ifneq (,$(wildcard go.mod))
-		# Enforce Go modules support just in case the directory is inside GOPATH (and for Travis CI).
-		GO111MODULE := on
-
-		ifneq (,$(wildcard vendor))
-			# Always use the local vendor/ directory to satisfy the dependencies.
-			GOOPTS := $(GOOPTS) -mod=vendor
-		endif
-	endif
-else
-	ifneq (,$(wildcard go.mod))
-		ifneq (,$(wildcard vendor))
-$(warning This repository requires Go >= 1.11 because of Go modules)
-$(warning Some recipes may not work as expected as the current Go runtime is '$(GO_VERSION_NUMBER)')
-		endif
-	else
-		# This repository isn't using Go modules (yet).
-		GOVENDOR := $(FIRST_GOPATH)/bin/govendor
-	endif
-endif
 PROMU        := $(FIRST_GOPATH)/bin/promu
 pkgs          = ./...
 
@@ -78,17 +55,26 @@ ifneq ($(shell which gotestsum),)
 endif
 endif
 
-PROMU_VERSION ?= 0.7.0
+PROMU_VERSION ?= 0.14.0
 PROMU_URL     := https://github.com/prometheus/promu/releases/download/v$(PROMU_VERSION)/promu-$(PROMU_VERSION).$(GO_BUILD_PLATFORM).tar.gz
 
+SKIP_GOLANGCI_LINT :=
 GOLANGCI_LINT :=
 GOLANGCI_LINT_OPTS ?=
-GOLANGCI_LINT_VERSION ?= v1.18.0
+GOLANGCI_LINT_VERSION ?= v1.49.0
 # golangci-lint only supports linux, darwin and windows platforms on i386/amd64.
 # windows isn't included here because of the path separator being different.
 ifeq ($(GOHOSTOS),$(filter $(GOHOSTOS),linux darwin))
 	ifeq ($(GOHOSTARCH),$(filter $(GOHOSTARCH),amd64 i386))
-		GOLANGCI_LINT := $(FIRST_GOPATH)/bin/golangci-lint
+		# If we're in CI and there is an Actions file, that means the linter
+		# is being run in Actions, so we don't need to run it here.
+		ifneq (,$(SKIP_GOLANGCI_LINT))
+			GOLANGCI_LINT :=
+		else ifeq (,$(CIRCLE_JOB))
+			GOLANGCI_LINT := $(FIRST_GOPATH)/bin/golangci-lint
+		else ifeq (,$(wildcard .github/workflows/golangci-lint.yml))
+			GOLANGCI_LINT := $(FIRST_GOPATH)/bin/golangci-lint
+		endif
 	endif
 endif
 
@@ -118,7 +104,7 @@ endif
 %: common-% ;
 
 .PHONY: common-all
-common-all: precheck style check_license lint unused build test
+common-all: precheck style check_license lint yamllint unused build test
 
 .PHONY: common-style
 common-style:
@@ -144,32 +130,25 @@ common-check_license:
 .PHONY: common-deps
 common-deps:
 	@echo ">> getting dependencies"
-ifdef GO111MODULE
-	GO111MODULE=$(GO111MODULE) $(GO) mod download
-else
-	$(GO) get $(GOOPTS) -t ./...
-endif
+	$(GO) mod download
 
 .PHONY: update-go-deps
 update-go-deps:
 	@echo ">> updating Go dependencies"
 	@for m in $$($(GO) list -mod=readonly -m -f '{{ if and (not .Indirect) (not .Main)}}{{.Path}}{{end}}' all); do \
-		$(GO) get $$m; \
+		$(GO) get -d $$m; \
 	done
-	GO111MODULE=$(GO111MODULE) $(GO) mod tidy
-ifneq (,$(wildcard vendor))
-	GO111MODULE=$(GO111MODULE) $(GO) mod vendor
-endif
+	$(GO) mod tidy
 
 .PHONY: common-test-short
 common-test-short: $(GOTEST_DIR)
 	@echo ">> running short tests"
-	GO111MODULE=$(GO111MODULE) $(GOTEST) -short $(GOOPTS) $(pkgs)
+	$(GOTEST) -short $(GOOPTS) $(pkgs)
 
 .PHONY: common-test
 common-test: $(GOTEST_DIR)
 	@echo ">> running all tests"
-	GO111MODULE=$(GO111MODULE) $(GOTEST) $(test-flags) $(GOOPTS) $(pkgs)
+	$(GOTEST) $(test-flags) $(GOOPTS) $(pkgs)
 
 $(GOTEST_DIR):
 	@mkdir -p $@
@@ -177,25 +156,30 @@ $(GOTEST_DIR):
 .PHONY: common-format
 common-format:
 	@echo ">> formatting code"
-	GO111MODULE=$(GO111MODULE) $(GO) fmt $(pkgs)
+	$(GO) fmt $(pkgs)
 
 .PHONY: common-vet
 common-vet:
 	@echo ">> vetting code"
-	GO111MODULE=$(GO111MODULE) $(GO) vet $(GOOPTS) $(pkgs)
+	$(GO) vet $(GOOPTS) $(pkgs)
 
 .PHONY: common-lint
 common-lint: $(GOLANGCI_LINT)
 ifdef GOLANGCI_LINT
 	@echo ">> running golangci-lint"
-ifdef GO111MODULE
 # 'go list' needs to be executed before staticcheck to prepopulate the modules cache.
 # Otherwise staticcheck might fail randomly for some reason not yet explained.
-	GO111MODULE=$(GO111MODULE) $(GO) list -e -compiled -test=true -export=false -deps=true -find=false -tags= -- ./... > /dev/null
-	GO111MODULE=$(GO111MODULE) $(GOLANGCI_LINT) run $(GOLANGCI_LINT_OPTS) $(pkgs)
-else
-	$(GOLANGCI_LINT) run $(pkgs)
+	$(GO) list -e -compiled -test=true -export=false -deps=true -find=false -tags= -- ./... > /dev/null
+	$(GOLANGCI_LINT) run $(GOLANGCI_LINT_OPTS) $(pkgs)
 endif
+
+.PHONY: common-yamllint
+common-yamllint:
+	@echo ">> running yamllint on all YAML files in the repository"
+ifeq (, $(shell which yamllint))
+	@echo "yamllint not installed so skipping"
+else
+	yamllint .
 endif
 
 # For backward-compatibility.
@@ -203,28 +187,15 @@ endif
 common-staticcheck: lint
 
 .PHONY: common-unused
-common-unused: $(GOVENDOR)
-ifdef GOVENDOR
-	@echo ">> running check for unused packages"
-	@$(GOVENDOR) list +unused | grep . && exit 1 || echo 'No unused packages'
-else
-ifdef GO111MODULE
+common-unused:
 	@echo ">> running check for unused/missing packages in go.mod"
-	GO111MODULE=$(GO111MODULE) $(GO) mod tidy
-ifeq (,$(wildcard vendor))
+	$(GO) mod tidy
 	@git diff --exit-code -- go.sum go.mod
-else
-	@echo ">> running check for unused packages in vendor/"
-	GO111MODULE=$(GO111MODULE) $(GO) mod vendor
-	@git diff --exit-code -- go.sum go.mod vendor/
-endif
-endif
-endif
 
 .PHONY: common-build
 common-build: promu
 	@echo ">> building binaries"
-	GO111MODULE=$(GO111MODULE) $(PROMU) build --prefix $(PREFIX) $(PROMU_BINARIES)
+	$(PROMU) build --prefix $(PREFIX) $(PROMU_BINARIES)
 
 .PHONY: common-tarball
 common-tarball: promu
@@ -280,12 +251,6 @@ $(GOLANGCI_LINT):
 		| sh -s -- -b $(FIRST_GOPATH)/bin $(GOLANGCI_LINT_VERSION)
 endif
 
-ifdef GOVENDOR
-.PHONY: $(GOVENDOR)
-$(GOVENDOR):
-	GOOS= GOARCH= $(GO) get -u github.com/kardianos/govendor
-endif
-
 .PHONY: precheck
 precheck::
 
diff --git a/vendor/github.com/prometheus/procfs/README.md b/vendor/github.com/prometheus/procfs/README.md
index 55d1e3261c..43c37735a7 100644
--- a/vendor/github.com/prometheus/procfs/README.md
+++ b/vendor/github.com/prometheus/procfs/README.md
@@ -6,8 +6,8 @@ metrics from the pseudo-filesystems /proc and /sys.
 *WARNING*: This package is a work in progress. Its API may still break in
 backwards-incompatible ways without warnings. Use it at your own risk.
 
-[![GoDoc](https://godoc.org/github.com/prometheus/procfs?status.png)](https://godoc.org/github.com/prometheus/procfs)
-[![Build Status](https://travis-ci.org/prometheus/procfs.svg?branch=master)](https://travis-ci.org/prometheus/procfs)
+[![Go Reference](https://pkg.go.dev/badge/github.com/prometheus/procfs.svg)](https://pkg.go.dev/github.com/prometheus/procfs)
+[![CircleCI](https://circleci.com/gh/prometheus/procfs/tree/master.svg?style=svg)](https://circleci.com/gh/prometheus/procfs/tree/master)
 [![Go Report Card](https://goreportcard.com/badge/github.com/prometheus/procfs)](https://goreportcard.com/report/github.com/prometheus/procfs)
 
 ## Usage
diff --git a/vendor/github.com/prometheus/procfs/SECURITY.md b/vendor/github.com/prometheus/procfs/SECURITY.md
index 67741f015a..fed02d85c7 100644
--- a/vendor/github.com/prometheus/procfs/SECURITY.md
+++ b/vendor/github.com/prometheus/procfs/SECURITY.md
@@ -3,4 +3,4 @@
 The Prometheus security policy, including how to report vulnerabilities, can be
 found here:
 
-https://prometheus.io/docs/operating/security/
+<https://prometheus.io/docs/operating/security/>
diff --git a/vendor/github.com/prometheus/procfs/arp.go b/vendor/github.com/prometheus/procfs/arp.go
index 4e47e61720..68f36e888f 100644
--- a/vendor/github.com/prometheus/procfs/arp.go
+++ b/vendor/github.com/prometheus/procfs/arp.go
@@ -15,11 +15,28 @@ package procfs
 
 import (
 	"fmt"
-	"io/ioutil"
 	"net"
+	"os"
+	"strconv"
 	"strings"
 )
 
+// Learned from include/uapi/linux/if_arp.h.
+const (
+	// completed entry (ha valid).
+	ATFComplete = 0x02
+	// permanent entry.
+	ATFPermanent = 0x04
+	// Publish entry.
+	ATFPublish = 0x08
+	// Has requested trailers.
+	ATFUseTrailers = 0x10
+	// Obsoleted: Want to use a netmask (only for proxy entries).
+	ATFNetmask = 0x20
+	// Don't answer this addresses.
+	ATFDontPublish = 0x40
+)
+
 // ARPEntry contains a single row of the columnar data represented in
 // /proc/net/arp.
 type ARPEntry struct {
@@ -29,12 +46,14 @@ type ARPEntry struct {
 	HWAddr net.HardwareAddr
 	// Name of the device
 	Device string
+	// Flags
+	Flags byte
 }
 
 // GatherARPEntries retrieves all the ARP entries, parse the relevant columns,
 // and then return a slice of ARPEntry's.
 func (fs FS) GatherARPEntries() ([]ARPEntry, error) {
-	data, err := ioutil.ReadFile(fs.proc.Path("net/arp"))
+	data, err := os.ReadFile(fs.proc.Path("net/arp"))
 	if err != nil {
 		return nil, fmt.Errorf("error reading arp %q: %w", fs.proc.Path("net/arp"), err)
 	}
@@ -72,14 +91,26 @@ func parseARPEntries(data []byte) ([]ARPEntry, error) {
 }
 
 func parseARPEntry(columns []string) (ARPEntry, error) {
+	entry := ARPEntry{Device: columns[5]}
 	ip := net.ParseIP(columns[0])
-	mac := net.HardwareAddr(columns[3])
+	entry.IPAddr = ip
+
+	if mac, err := net.ParseMAC(columns[3]); err == nil {
+		entry.HWAddr = mac
+	} else {
+		return ARPEntry{}, err
+	}
 
-	entry := ARPEntry{
-		IPAddr: ip,
-		HWAddr: mac,
-		Device: columns[5],
+	if flags, err := strconv.ParseUint(columns[2], 0, 8); err == nil {
+		entry.Flags = byte(flags)
+	} else {
+		return ARPEntry{}, err
 	}
 
 	return entry, nil
 }
+
+// IsComplete returns true if ARP entry is marked with complete flag.
+func (entry *ARPEntry) IsComplete() bool {
+	return entry.Flags&ATFComplete != 0
+}
diff --git a/vendor/github.com/prometheus/procfs/cmdline.go b/vendor/github.com/prometheus/procfs/cmdline.go
new file mode 100644
index 0000000000..bf4f3b48c0
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/cmdline.go
@@ -0,0 +1,30 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// CmdLine returns the command line of the kernel.
+func (fs FS) CmdLine() ([]string, error) {
+	data, err := util.ReadFileNoStat(fs.proc.Path("cmdline"))
+	if err != nil {
+		return nil, err
+	}
+
+	return strings.Fields(string(data)), nil
+}
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo.go b/vendor/github.com/prometheus/procfs/cpuinfo.go
index 5623b24a16..06968ca2ed 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux
 // +build linux
 
 package procfs
@@ -27,7 +28,7 @@ import (
 	"github.com/prometheus/procfs/internal/util"
 )
 
-// CPUInfo contains general information about a system CPU found in /proc/cpuinfo
+// CPUInfo contains general information about a system CPU found in /proc/cpuinfo.
 type CPUInfo struct {
 	Processor       uint
 	VendorID        string
@@ -379,6 +380,42 @@ func parseCPUInfoMips(info []byte) ([]CPUInfo, error) {
 	return cpuinfo, nil
 }
 
+func parseCPUInfoLoong(info []byte) ([]CPUInfo, error) {
+	scanner := bufio.NewScanner(bytes.NewReader(info))
+	// find the first "processor" line
+	firstLine := firstNonEmptyLine(scanner)
+	if !strings.HasPrefix(firstLine, "system type") || !strings.Contains(firstLine, ":") {
+		return nil, errors.New("invalid cpuinfo file: " + firstLine)
+	}
+	field := strings.SplitN(firstLine, ": ", 2)
+	cpuinfo := []CPUInfo{}
+	systemType := field[1]
+	i := 0
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !strings.Contains(line, ":") {
+			continue
+		}
+		field := strings.SplitN(line, ": ", 2)
+		switch strings.TrimSpace(field[0]) {
+		case "processor":
+			v, err := strconv.ParseUint(field[1], 0, 32)
+			if err != nil {
+				return nil, err
+			}
+			i = int(v)
+			cpuinfo = append(cpuinfo, CPUInfo{}) // start of the next processor
+			cpuinfo[i].Processor = uint(v)
+			cpuinfo[i].VendorID = systemType
+		case "CPU Family":
+			cpuinfo[i].CPUFamily = field[1]
+		case "Model Name":
+			cpuinfo[i].ModelName = field[1]
+		}
+	}
+	return cpuinfo, nil
+}
+
 func parseCPUInfoPPC(info []byte) ([]CPUInfo, error) {
 	scanner := bufio.NewScanner(bytes.NewReader(info))
 
@@ -469,7 +506,7 @@ func parseCPUInfoDummy(_ []byte) ([]CPUInfo, error) { // nolint:unused,deadcode
 }
 
 // firstNonEmptyLine advances the scanner to the first non-empty line
-// and returns the contents of that line
+// and returns the contents of that line.
 func firstNonEmptyLine(scanner *bufio.Scanner) string {
 	for scanner.Scan() {
 		line := scanner.Text()
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_armx.go b/vendor/github.com/prometheus/procfs/cpuinfo_armx.go
index 44b590ed38..64cfd534c1 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_armx.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_armx.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux && (arm || arm64)
 // +build linux
 // +build arm arm64
 
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_loong64.go b/vendor/github.com/prometheus/procfs/cpuinfo_loong64.go
new file mode 100644
index 0000000000..d88442f0ed
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_loong64.go
@@ -0,0 +1,19 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+// +build linux
+
+package procfs
+
+var parseCPUInfo = parseCPUInfoLoong
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_mipsx.go b/vendor/github.com/prometheus/procfs/cpuinfo_mipsx.go
index 91e272573a..c11207f3ab 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_mipsx.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_mipsx.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux && (mips || mipsle || mips64 || mips64le)
 // +build linux
 // +build mips mipsle mips64 mips64le
 
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_others.go b/vendor/github.com/prometheus/procfs/cpuinfo_others.go
index 95b5b4ec44..a6b2b3127c 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_others.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_others.go
@@ -11,8 +11,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// +build linux
-// +build !386,!amd64,!arm,!arm64,!mips,!mips64,!mips64le,!mipsle,!ppc64,!ppc64le,!riscv64,!s390x
+//go:build linux && !386 && !amd64 && !arm && !arm64 && !loong64 && !mips && !mips64 && !mips64le && !mipsle && !ppc64 && !ppc64le && !riscv64 && !s390x
+// +build linux,!386,!amd64,!arm,!arm64,!loong64,!mips,!mips64,!mips64le,!mipsle,!ppc64,!ppc64le,!riscv64,!s390x
 
 package procfs
 
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_ppcx.go b/vendor/github.com/prometheus/procfs/cpuinfo_ppcx.go
index 6068bd571c..003bc2ad4a 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_ppcx.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_ppcx.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux && (ppc64 || ppc64le)
 // +build linux
 // +build ppc64 ppc64le
 
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_riscvx.go b/vendor/github.com/prometheus/procfs/cpuinfo_riscvx.go
index e83c2e207c..1c9b7313b6 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_riscvx.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_riscvx.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux && (riscv || riscv64)
 // +build linux
 // +build riscv riscv64
 
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_s390x.go b/vendor/github.com/prometheus/procfs/cpuinfo_s390x.go
index 26814eebaa..fa3686bc00 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_s390x.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_s390x.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux
 // +build linux
 
 package procfs
diff --git a/vendor/github.com/prometheus/procfs/cpuinfo_x86.go b/vendor/github.com/prometheus/procfs/cpuinfo_x86.go
index d5bedf97f3..a0ef55562e 100644
--- a/vendor/github.com/prometheus/procfs/cpuinfo_x86.go
+++ b/vendor/github.com/prometheus/procfs/cpuinfo_x86.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build linux && (386 || amd64)
 // +build linux
 // +build 386 amd64
 
diff --git a/vendor/github.com/prometheus/procfs/doc.go b/vendor/github.com/prometheus/procfs/doc.go
index e2acd6d40a..f9d961e441 100644
--- a/vendor/github.com/prometheus/procfs/doc.go
+++ b/vendor/github.com/prometheus/procfs/doc.go
@@ -16,30 +16,29 @@
 //
 // Example:
 //
-//    package main
-//
-//    import (
-//    	"fmt"
-//    	"log"
-//
-//    	"github.com/prometheus/procfs"
-//    )
-//
-//    func main() {
-//    	p, err := procfs.Self()
-//    	if err != nil {
-//    		log.Fatalf("could not get process: %s", err)
-//    	}
-//
-//    	stat, err := p.NewStat()
-//    	if err != nil {
-//    		log.Fatalf("could not get process stat: %s", err)
-//    	}
-//
-//    	fmt.Printf("command:  %s\n", stat.Comm)
-//    	fmt.Printf("cpu time: %fs\n", stat.CPUTime())
-//    	fmt.Printf("vsize:    %dB\n", stat.VirtualMemory())
-//    	fmt.Printf("rss:      %dB\n", stat.ResidentMemory())
-//    }
-//
+//	package main
+//
+//	import (
+//		"fmt"
+//		"log"
+//
+//		"github.com/prometheus/procfs"
+//	)
+//
+//	func main() {
+//		p, err := procfs.Self()
+//		if err != nil {
+//			log.Fatalf("could not get process: %s", err)
+//		}
+//
+//		stat, err := p.Stat()
+//		if err != nil {
+//			log.Fatalf("could not get process stat: %s", err)
+//		}
+//
+//		fmt.Printf("command:  %s\n", stat.Comm)
+//		fmt.Printf("cpu time: %fs\n", stat.CPUTime())
+//		fmt.Printf("vsize:    %dB\n", stat.VirtualMemory())
+//		fmt.Printf("rss:      %dB\n", stat.ResidentMemory())
+//	}
 package procfs
diff --git a/vendor/github.com/prometheus/procfs/fixtures.ttar b/vendor/github.com/prometheus/procfs/fixtures.ttar
deleted file mode 100644
index 1e76173da0..0000000000
--- a/vendor/github.com/prometheus/procfs/fixtures.ttar
+++ /dev/null
@@ -1,6553 +0,0 @@
-# Archive created by ttar -c -f fixtures.ttar fixtures/
-Directory: fixtures
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26231
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/cmdline
-Lines: 1
-vimNULLBYTEtest.goNULLBYTE+10NULLBYTEEOF
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/comm
-Lines: 1
-vim
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/cwd
-SymlinkTo: /usr/bin
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/environ
-Lines: 1
-PATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binNULLBYTEHOSTNAME=cd24e11f73a5NULLBYTETERM=xtermNULLBYTEGOLANG_VERSION=1.12.5NULLBYTEGOPATH=/goNULLBYTEHOME=/rootNULLBYTEEOF
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/exe
-SymlinkTo: /usr/bin/vim
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26231/fd
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fd/0
-SymlinkTo: ../../symlinktargets/abc
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fd/1
-SymlinkTo: ../../symlinktargets/def
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fd/10
-SymlinkTo: ../../symlinktargets/xyz
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fd/2
-SymlinkTo: ../../symlinktargets/ghi
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fd/3
-SymlinkTo: ../../symlinktargets/uvw
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26231/fdinfo
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fdinfo/0
-Lines: 6
-pos:	0
-flags:	02004000
-mnt_id:	13
-inotify wd:3 ino:1 sdev:34 mask:fce ignored_mask:0 fhandle-bytes:c fhandle-type:81 f_handle:000000000100000000000000
-inotify wd:2 ino:1300016 sdev:fd00002 mask:fce ignored_mask:0 fhandle-bytes:8 fhandle-type:1 f_handle:16003001ed3f022a
-inotify wd:1 ino:2e0001 sdev:fd00000 mask:fce ignored_mask:0 fhandle-bytes:8 fhandle-type:1 f_handle:01002e00138e7c65
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fdinfo/1
-Lines: 4
-pos:	0
-flags:	02004002
-mnt_id:	13
-eventfd-count:                0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fdinfo/10
-Lines: 3
-pos:	0
-flags:	02004002
-mnt_id:	9
-Mode: 400
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fdinfo/2
-Lines: 3
-pos:	0
-flags:	02004002
-mnt_id:	9
-Mode: 400
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/fdinfo/3
-Lines: 3
-pos:	0
-flags:	02004002
-mnt_id:	9
-Mode: 400
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/io
-Lines: 7
-rchar: 750339
-wchar: 818609
-syscr: 7405
-syscw: 5245
-read_bytes: 1024
-write_bytes: 2048
-cancelled_write_bytes: -1024
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/limits
-Lines: 17
-Limit                     Soft Limit           Hard Limit           Units
-Max cpu time              unlimited            unlimited            seconds
-Max file size             unlimited            unlimited            bytes
-Max data size             unlimited            unlimited            bytes
-Max stack size            8388608              unlimited            bytes
-Max core file size        0                    unlimited            bytes
-Max resident set          unlimited            unlimited            bytes
-Max processes             62898                62898                processes
-Max open files            2048                 4096                 files
-Max locked memory         18446744073708503040 18446744073708503040 bytes
-Max address space         8589934592           unlimited            bytes
-Max file locks            unlimited            unlimited            locks
-Max pending signals       62898                62898                signals
-Max msgqueue size         819200               819200               bytes
-Max nice priority         0                    0
-Max realtime priority     0                    0
-Max realtime timeout      unlimited            unlimited            us
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/mountstats
-Lines: 20
-device rootfs mounted on / with fstype rootfs
-device sysfs mounted on /sys with fstype sysfs
-device proc mounted on /proc with fstype proc
-device /dev/sda1 mounted on / with fstype ext4
-device 192.168.1.1:/srv/test mounted on /mnt/nfs/test with fstype nfs4 statvers=1.1
-	opts:	rw,vers=4.0,rsize=1048576,wsize=1048576,namlen=255,acregmin=3,acregmax=60,acdirmin=30,acdirmax=60,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.1,clientaddr=192.168.1.5,local_lock=none
-	age:	13968
-	caps:	caps=0xfff7,wtmult=512,dtsize=32768,bsize=0,namlen=255
-	nfsv4:	bm0=0xfdffafff,bm1=0xf9be3e,bm2=0x0,acl=0x0,pnfs=not configured
-	sec:	flavor=1,pseudoflavor=1
-	events:	52 226 0 0 1 13 398 0 0 331 0 47 0 0 77 0 0 77 0 0 0 0 0 0 0 0 0
-	bytes:	1207640230 0 0 0 1210214218 0 295483 0
-	RPC iostats version: 1.0  p/v: 100003/4 (nfs)
-	xprt:	tcp 832 0 1 0 11 6428 6428 0 12154 0 24 26 5726
-	per-op statistics
-	        NULL: 0 0 0 0 0 0 0 0
-	        READ: 1298 1298 0 207680 1210292152 6 79386 79407
-	       WRITE: 0 0 0 0 0 0 0 0
-	      ACCESS: 2927395007 2927394995 0 526931094212 362996810236 18446743919241604546 1667369447 1953587717
-
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26231/net
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/net/dev
-Lines: 4
-Inter-|   Receive                                                |  Transmit
- face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-    lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
-  eth0:     438       5    0    0    0     0          0         0      648       8    0    0    0     0       0          0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26231/ns
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/ns/mnt
-SymlinkTo: mnt:[4026531840]
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/ns/net
-SymlinkTo: net:[4026531993]
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/root
-SymlinkTo: /
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/schedstat
-Lines: 1
-411605849 93680043 79
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/smaps
-Lines: 252
-00400000-00cb1000 r-xp 00000000 fd:01 952273                             /bin/alertmanager
-Size:               8900 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                2952 kB
-Pss:                2952 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:      2952 kB
-Private_Dirty:         0 kB
-Referenced:         2864 kB
-Anonymous:             0 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd ex mr mw me dw sd 
-00cb1000-016b0000 r--p 008b1000 fd:01 952273                             /bin/alertmanager
-Size:              10236 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                6152 kB
-Pss:                6152 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:      6152 kB
-Private_Dirty:         0 kB
-Referenced:         5308 kB
-Anonymous:             0 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd mr mw me dw sd 
-016b0000-0171a000 rw-p 012b0000 fd:01 952273                             /bin/alertmanager
-Size:                424 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                 176 kB
-Pss:                 176 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:        84 kB
-Private_Dirty:        92 kB
-Referenced:          176 kB
-Anonymous:            92 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                 12 kB
-SwapPss:              12 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me dw ac sd 
-0171a000-0173f000 rw-p 00000000 00:00 0 
-Size:                148 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                  76 kB
-Pss:                  76 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:         0 kB
-Private_Dirty:        76 kB
-Referenced:           76 kB
-Anonymous:            76 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me ac sd 
-c000000000-c000400000 rw-p 00000000 00:00 0 
-Size:               4096 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                2564 kB
-Pss:                2564 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:        20 kB
-Private_Dirty:      2544 kB
-Referenced:         2544 kB
-Anonymous:          2564 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:               1100 kB
-SwapPss:            1100 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me ac sd 
-c000400000-c001600000 rw-p 00000000 00:00 0 
-Size:              18432 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:               16024 kB
-Pss:               16024 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:      5864 kB
-Private_Dirty:     10160 kB
-Referenced:        11944 kB
-Anonymous:         16024 kB
-LazyFree:           5848 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                440 kB
-SwapPss:             440 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me ac sd nh 
-c001600000-c004000000 rw-p 00000000 00:00 0 
-Size:              43008 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                   0 kB
-Pss:                   0 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:         0 kB
-Private_Dirty:         0 kB
-Referenced:            0 kB
-Anonymous:             0 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me ac sd 
-7f0ab95ca000-7f0abbb7b000 rw-p 00000000 00:00 0 
-Size:              38596 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                1992 kB
-Pss:                1992 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:       476 kB
-Private_Dirty:      1516 kB
-Referenced:         1828 kB
-Anonymous:          1992 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                384 kB
-SwapPss:             384 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me ac sd 
-7ffc07ecf000-7ffc07ef0000 rw-p 00000000 00:00 0                          [stack]
-Size:                132 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                   8 kB
-Pss:                   8 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:         0 kB
-Private_Dirty:         8 kB
-Referenced:            8 kB
-Anonymous:             8 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  4 kB
-SwapPss:               4 kB
-Locked:                0 kB
-VmFlags: rd wr mr mw me gd ac 
-7ffc07f9e000-7ffc07fa1000 r--p 00000000 00:00 0                          [vvar]
-Size:                 12 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                   0 kB
-Pss:                   0 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:         0 kB
-Private_Dirty:         0 kB
-Referenced:            0 kB
-Anonymous:             0 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd mr pf io de dd sd 
-7ffc07fa1000-7ffc07fa3000 r-xp 00000000 00:00 0                          [vdso]
-Size:                  8 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                   4 kB
-Pss:                   0 kB
-Shared_Clean:          4 kB
-Shared_Dirty:          0 kB
-Private_Clean:         0 kB
-Private_Dirty:         0 kB
-Referenced:            4 kB
-Anonymous:             0 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd ex mr mw me de sd 
-ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
-Size:                  4 kB
-KernelPageSize:        4 kB
-MMUPageSize:           4 kB
-Rss:                   0 kB
-Pss:                   0 kB
-Shared_Clean:          0 kB
-Shared_Dirty:          0 kB
-Private_Clean:         0 kB
-Private_Dirty:         0 kB
-Referenced:            0 kB
-Anonymous:             0 kB
-LazyFree:              0 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:                  0 kB
-SwapPss:               0 kB
-Locked:                0 kB
-VmFlags: rd ex 
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/smaps_rollup
-Lines: 17
-00400000-ffffffffff601000 ---p 00000000 00:00 0                          [rollup]
-Rss:               29948 kB
-Pss:               29944 kB
-Shared_Clean:          4 kB
-Shared_Dirty:          0 kB
-Private_Clean:     15548 kB
-Private_Dirty:     14396 kB
-Referenced:        24752 kB
-Anonymous:         20756 kB
-LazyFree:           5848 kB
-AnonHugePages:         0 kB
-ShmemPmdMapped:        0 kB
-Shared_Hugetlb:        0 kB
-Private_Hugetlb:       0 kB
-Swap:               1940 kB
-SwapPss:            1940 kB
-Locked:                0 kB
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/stat
-Lines: 1
-26231 (vim) R 5392 7446 5392 34835 7446 4218880 32533 309516 26 82 1677 44 158 99 20 0 1 0 82375 56274944 1981 18446744073709551615 4194304 6294284 140736914091744 140736914087944 139965136429984 0 0 12288 1870679807 0 0 0 17 0 0 0 31 0 0 8391624 8481048 16420864 140736914093252 140736914093279 140736914093279 140736914096107 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/status
-Lines: 53
-
-Name:	prometheus
-Umask:	0022
-State:	S (sleeping)
-Tgid:	26231
-Ngid:	0
-Pid:	26231
-PPid:	1
-TracerPid:	0
-Uid:	1000	1000	1000	0
-Gid:	1001	1001	1001	0
-FDSize:	128
-Groups:
-NStgid:	1
-NSpid:	1
-NSpgid:	1
-NSsid:	1
-VmPeak:	   58472 kB
-VmSize:	   58440 kB
-VmLck:	       0 kB
-VmPin:	       0 kB
-VmHWM:	    8028 kB
-VmRSS:	    6716 kB
-RssAnon:	    2092 kB
-RssFile:	    4624 kB
-RssShmem:	       0 kB
-VmData:	    2580 kB
-VmStk:	     136 kB
-VmExe:	     948 kB
-VmLib:	    6816 kB
-VmPTE:	     128 kB
-VmPMD:	      12 kB
-VmSwap:	     660 kB
-HugetlbPages:	       0 kB
-Threads:	1
-SigQ:	8/63965
-SigPnd:	0000000000000000
-ShdPnd:	0000000000000000
-SigBlk:	7be3c0fe28014a03
-SigIgn:	0000000000001000
-SigCgt:	00000001800004ec
-CapInh:	0000000000000000
-CapPrm:	0000003fffffffff
-CapEff:	0000003fffffffff
-CapBnd:	0000003fffffffff
-CapAmb:	0000000000000000
-Seccomp:	0
-Cpus_allowed:	ff
-Cpus_allowed_list:	0-7
-Mems_allowed:	00000000,00000001
-Mems_allowed_list:	0
-voluntary_ctxt_switches:	4742839
-nonvoluntary_ctxt_switches:	1727500
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26231/wchan
-Lines: 1
-poll_schedule_timeoutEOF
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26232
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/cmdline
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/comm
-Lines: 1
-ata_sff
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/cwd
-SymlinkTo: /does/not/exist
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26232/fd
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/fd/0
-SymlinkTo: ../../symlinktargets/abc
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/fd/1
-SymlinkTo: ../../symlinktargets/def
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/fd/2
-SymlinkTo: ../../symlinktargets/ghi
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/fd/3
-SymlinkTo: ../../symlinktargets/uvw
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/fd/4
-SymlinkTo: ../../symlinktargets/xyz
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/limits
-Lines: 17
-Limit                     Soft Limit           Hard Limit           Units
-Max cpu time              unlimited            unlimited            seconds
-Max file size             unlimited            unlimited            bytes
-Max data size             unlimited            unlimited            bytes
-Max stack size            8388608              unlimited            bytes
-Max core file size        0                    unlimited            bytes
-Max resident set          unlimited            unlimited            bytes
-Max processes             29436                29436                processes
-Max open files            1024                 4096                 files
-Max locked memory         65536                65536                bytes
-Max address space         unlimited            unlimited            bytes
-Max file locks            unlimited            unlimited            locks
-Max pending signals       29436                29436                signals
-Max msgqueue size         819200               819200               bytes
-Max nice priority         0                    0
-Max realtime priority     0                    0
-Max realtime timeout      unlimited            unlimited            us
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/maps
-Lines: 9
-55680ae1e000-55680ae20000 r--p 00000000 fd:01 47316994                   /bin/cat
-55680ae29000-55680ae2a000 rwxs 0000a000 fd:01 47316994                   /bin/cat
-55680bed6000-55680bef7000 rw-p 00000000 00:00 0                          [heap]
-7fdf964fc000-7fdf973f2000 r--p 00000000 fd:01 17432624                   /usr/lib/locale/locale-archive
-7fdf973f2000-7fdf97417000 r--p 00000000 fd:01 60571062                   /lib/x86_64-linux-gnu/libc-2.29.so
-7ffe9215c000-7ffe9217f000 rw-p 00000000 00:00 0                          [stack]
-7ffe921da000-7ffe921dd000 r--p 00000000 00:00 0                          [vvar]
-7ffe921dd000-7ffe921de000 r-xp 00000000 00:00 0                          [vdso]
-ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/root
-SymlinkTo: /does/not/exist
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/stat
-Lines: 1
-33 (ata_sff) S 2 0 0 0 -1 69238880 0 0 0 0 0 0 0 0 0 -20 1 0 5 0 0 18446744073709551615 0 0 0 0 0 0 0 2147483647 0 18446744073709551615 0 0 17 1 0 0 0 0 0 0 0 0 0 0 0 0 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26232/wchan
-Lines: 1
-0EOF
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26233
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26233/cmdline
-Lines: 1
-com.github.uiautomatorNULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTENULLBYTEEOF
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26233/schedstat
-Lines: 8
- ____________________________________
-< this is a malformed schedstat file >
- ------------------------------------
-        \   ^__^
-         \  (oo)\_______
-            (__)\       )\/\
-                ||----w |
-                ||     ||
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/26234
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/26234/maps
-Lines: 4
-08048000-08089000 r-xp 00000000 03:01 104219 /bin/tcsh
-08089000-0808c000 rw-p 00041000 03:01 104219 /bin/tcsh
-0808c000-08146000 rwxp 00000000 00:00 0
-40000000-40015000 r-xp 00000000 03:01 61874 /lib/ld-2.3.2.so
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/584
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/584/stat
-Lines: 2
-1020 ((a b ) ( c d) ) R 28378 1020 28378 34842 1020 4218880 286 0 0 0 0 0 0 0 20 0 1 0 10839175 10395648 155 18446744073709551615 4194304 4238788 140736466511168 140736466511168 140609271124624 0 0 0 0 0 0 0 17 5 0 0 0 0 0 6336016 6337300 25579520 140736466515030 140736466515061 140736466515061 140736466518002 0
-#!/bin/cat /proc/self/stat
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/buddyinfo
-Lines: 3
-Node 0, zone      DMA      1      0      1      0      2      1      1      0      1      1      3
-Node 0, zone    DMA32    759    572    791    475    194     45     12      0      0      0      0
-Node 0, zone   Normal   4381   1093    185   1530    567    102      4      0      0      0      0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/cpuinfo
-Lines: 216
-processor	: 0
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 799.998
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 0
-cpu cores	: 4
-apicid		: 0
-initial apicid	: 0
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 1
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 800.037
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 1
-cpu cores	: 4
-apicid		: 2
-initial apicid	: 2
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 2
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 800.010
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 2
-cpu cores	: 4
-apicid		: 4
-initial apicid	: 4
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 3
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 800.028
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 3
-cpu cores	: 4
-apicid		: 6
-initial apicid	: 6
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 4
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 799.989
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 0
-cpu cores	: 4
-apicid		: 1
-initial apicid	: 1
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 5
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 800.083
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 1
-cpu cores	: 4
-apicid		: 3
-initial apicid	: 3
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 6
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 800.017
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 2
-cpu cores	: 4
-apicid		: 5
-initial apicid	: 5
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-processor	: 7
-vendor_id	: GenuineIntel
-cpu family	: 6
-model		: 142
-model name	: Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz
-stepping	: 10
-microcode	: 0xb4
-cpu MHz		: 800.030
-cache size	: 8192 KB
-physical id	: 0
-siblings	: 8
-core id		: 3
-cpu cores	: 4
-apicid		: 7
-initial apicid	: 7
-fpu		: yes
-fpu_exception	: yes
-cpuid level	: 22
-wp		: yes
-flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d
-bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs
-bogomips	: 4224.00
-clflush size	: 64
-cache_alignment	: 64
-address sizes	: 39 bits physical, 48 bits virtual
-power management:
-
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/crypto
-Lines: 972
-name         : ccm(aes)
-driver       : ccm_base(ctr(aes-aesni),cbcmac(aes-aesni))
-module       : ccm
-priority     : 300
-refcnt       : 4
-selftest     : passed
-internal     : no
-type         : aead
-async        : no
-blocksize    : 1
-ivsize       : 16
-maxauthsize  : 16
-geniv        : <none>
-
-name         : cbcmac(aes)
-driver       : cbcmac(aes-aesni)
-module       : ccm
-priority     : 300
-refcnt       : 7
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 16
-
-name         : ecdh
-driver       : ecdh-generic
-module       : ecdh_generic
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : kpp
-async        : yes
-
-name         : ecb(arc4)
-driver       : ecb(arc4)-generic
-module       : arc4
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : no
-blocksize    : 1
-min keysize  : 1
-max keysize  : 256
-ivsize       : 0
-chunksize    : 1
-walksize     : 1
-
-name         : arc4
-driver       : arc4-generic
-module       : arc4
-priority     : 0
-refcnt       : 3
-selftest     : passed
-internal     : no
-type         : cipher
-blocksize    : 1
-min keysize  : 1
-max keysize  : 256
-
-name         : crct10dif
-driver       : crct10dif-pclmul
-module       : crct10dif_pclmul
-priority     : 200
-refcnt       : 2
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 2
-
-name         : crc32
-driver       : crc32-pclmul
-module       : crc32_pclmul
-priority     : 200
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 4
-
-name         : __ghash
-driver       : cryptd(__ghash-pclmulqdqni)
-module       : kernel
-priority     : 50
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : ahash
-async        : yes
-blocksize    : 16
-digestsize   : 16
-
-name         : ghash
-driver       : ghash-clmulni
-module       : ghash_clmulni_intel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : ahash
-async        : yes
-blocksize    : 16
-digestsize   : 16
-
-name         : __ghash
-driver       : __ghash-pclmulqdqni
-module       : ghash_clmulni_intel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : shash
-blocksize    : 16
-digestsize   : 16
-
-name         : crc32c
-driver       : crc32c-intel
-module       : crc32c_intel
-priority     : 200
-refcnt       : 5
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 4
-
-name         : cbc(aes)
-driver       : cbc(aes-aesni)
-module       : kernel
-priority     : 300
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : no
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : ctr(aes)
-driver       : ctr(aes-aesni)
-module       : kernel
-priority     : 300
-refcnt       : 5
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : no
-blocksize    : 1
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : pkcs1pad(rsa,sha256)
-driver       : pkcs1pad(rsa-generic,sha256)
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : akcipher
-
-name         : __xts(aes)
-driver       : cryptd(__xts-aes-aesni)
-module       : kernel
-priority     : 451
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : yes
-blocksize    : 16
-min keysize  : 32
-max keysize  : 64
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : xts(aes)
-driver       : xts-aes-aesni
-module       : kernel
-priority     : 401
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : yes
-blocksize    : 16
-min keysize  : 32
-max keysize  : 64
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : __ctr(aes)
-driver       : cryptd(__ctr-aes-aesni)
-module       : kernel
-priority     : 450
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : yes
-blocksize    : 1
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : ctr(aes)
-driver       : ctr-aes-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : yes
-blocksize    : 1
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : __cbc(aes)
-driver       : cryptd(__cbc-aes-aesni)
-module       : kernel
-priority     : 450
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : yes
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : cbc(aes)
-driver       : cbc-aes-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : yes
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : __ecb(aes)
-driver       : cryptd(__ecb-aes-aesni)
-module       : kernel
-priority     : 450
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : yes
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 0
-chunksize    : 16
-walksize     : 16
-
-name         : ecb(aes)
-driver       : ecb-aes-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : yes
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 0
-chunksize    : 16
-walksize     : 16
-
-name         : __generic-gcm-aes-aesni
-driver       : cryptd(__driver-generic-gcm-aes-aesni)
-module       : kernel
-priority     : 50
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : aead
-async        : yes
-blocksize    : 1
-ivsize       : 12
-maxauthsize  : 16
-geniv        : <none>
-
-name         : gcm(aes)
-driver       : generic-gcm-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : aead
-async        : yes
-blocksize    : 1
-ivsize       : 12
-maxauthsize  : 16
-geniv        : <none>
-
-name         : __generic-gcm-aes-aesni
-driver       : __driver-generic-gcm-aes-aesni
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : aead
-async        : no
-blocksize    : 1
-ivsize       : 12
-maxauthsize  : 16
-geniv        : <none>
-
-name         : __gcm-aes-aesni
-driver       : cryptd(__driver-gcm-aes-aesni)
-module       : kernel
-priority     : 50
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : aead
-async        : yes
-blocksize    : 1
-ivsize       : 8
-maxauthsize  : 16
-geniv        : <none>
-
-name         : rfc4106(gcm(aes))
-driver       : rfc4106-gcm-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : aead
-async        : yes
-blocksize    : 1
-ivsize       : 8
-maxauthsize  : 16
-geniv        : <none>
-
-name         : __gcm-aes-aesni
-driver       : __driver-gcm-aes-aesni
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : aead
-async        : no
-blocksize    : 1
-ivsize       : 8
-maxauthsize  : 16
-geniv        : <none>
-
-name         : __xts(aes)
-driver       : __xts-aes-aesni
-module       : kernel
-priority     : 401
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : no
-blocksize    : 16
-min keysize  : 32
-max keysize  : 64
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : __ctr(aes)
-driver       : __ctr-aes-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : no
-blocksize    : 1
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : __cbc(aes)
-driver       : __cbc-aes-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : no
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 16
-chunksize    : 16
-walksize     : 16
-
-name         : __ecb(aes)
-driver       : __ecb-aes-aesni
-module       : kernel
-priority     : 400
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : skcipher
-async        : no
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-ivsize       : 0
-chunksize    : 16
-walksize     : 16
-
-name         : __aes
-driver       : __aes-aesni
-module       : kernel
-priority     : 300
-refcnt       : 1
-selftest     : passed
-internal     : yes
-type         : cipher
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-
-name         : aes
-driver       : aes-aesni
-module       : kernel
-priority     : 300
-refcnt       : 8
-selftest     : passed
-internal     : no
-type         : cipher
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-
-name         : hmac(sha1)
-driver       : hmac(sha1-generic)
-module       : kernel
-priority     : 100
-refcnt       : 9
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 64
-digestsize   : 20
-
-name         : ghash
-driver       : ghash-generic
-module       : kernel
-priority     : 100
-refcnt       : 3
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 16
-digestsize   : 16
-
-name         : jitterentropy_rng
-driver       : jitterentropy_rng
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_hmac_sha256
-module       : kernel
-priority     : 221
-refcnt       : 2
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_hmac_sha512
-module       : kernel
-priority     : 220
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_hmac_sha384
-module       : kernel
-priority     : 219
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_hmac_sha1
-module       : kernel
-priority     : 218
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_sha256
-module       : kernel
-priority     : 217
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_sha512
-module       : kernel
-priority     : 216
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_sha384
-module       : kernel
-priority     : 215
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_sha1
-module       : kernel
-priority     : 214
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_ctr_aes256
-module       : kernel
-priority     : 213
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_ctr_aes192
-module       : kernel
-priority     : 212
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_nopr_ctr_aes128
-module       : kernel
-priority     : 211
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : hmac(sha256)
-driver       : hmac(sha256-generic)
-module       : kernel
-priority     : 100
-refcnt       : 10
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 64
-digestsize   : 32
-
-name         : stdrng
-driver       : drbg_pr_hmac_sha256
-module       : kernel
-priority     : 210
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_hmac_sha512
-module       : kernel
-priority     : 209
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_hmac_sha384
-module       : kernel
-priority     : 208
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_hmac_sha1
-module       : kernel
-priority     : 207
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_sha256
-module       : kernel
-priority     : 206
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_sha512
-module       : kernel
-priority     : 205
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_sha384
-module       : kernel
-priority     : 204
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_sha1
-module       : kernel
-priority     : 203
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_ctr_aes256
-module       : kernel
-priority     : 202
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_ctr_aes192
-module       : kernel
-priority     : 201
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : stdrng
-driver       : drbg_pr_ctr_aes128
-module       : kernel
-priority     : 200
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : rng
-seedsize     : 0
-
-name         : 842
-driver       : 842-scomp
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : scomp
-
-name         : 842
-driver       : 842-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : compression
-
-name         : lzo-rle
-driver       : lzo-rle-scomp
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : scomp
-
-name         : lzo-rle
-driver       : lzo-rle-generic
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : compression
-
-name         : lzo
-driver       : lzo-scomp
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : scomp
-
-name         : lzo
-driver       : lzo-generic
-module       : kernel
-priority     : 0
-refcnt       : 9
-selftest     : passed
-internal     : no
-type         : compression
-
-name         : crct10dif
-driver       : crct10dif-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 2
-
-name         : crc32c
-driver       : crc32c-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 4
-
-name         : zlib-deflate
-driver       : zlib-deflate-scomp
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : scomp
-
-name         : deflate
-driver       : deflate-scomp
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : scomp
-
-name         : deflate
-driver       : deflate-generic
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : compression
-
-name         : aes
-driver       : aes-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : cipher
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-
-name         : sha224
-driver       : sha224-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 64
-digestsize   : 28
-
-name         : sha256
-driver       : sha256-generic
-module       : kernel
-priority     : 100
-refcnt       : 11
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 64
-digestsize   : 32
-
-name         : sha1
-driver       : sha1-generic
-module       : kernel
-priority     : 100
-refcnt       : 11
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 64
-digestsize   : 20
-
-name         : md5
-driver       : md5-generic
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 64
-digestsize   : 16
-
-name         : ecb(cipher_null)
-driver       : ecb-cipher_null
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : skcipher
-async        : no
-blocksize    : 1
-min keysize  : 0
-max keysize  : 0
-ivsize       : 0
-chunksize    : 1
-walksize     : 1
-
-name         : digest_null
-driver       : digest_null-generic
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : shash
-blocksize    : 1
-digestsize   : 0
-
-name         : compress_null
-driver       : compress_null-generic
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : compression
-
-name         : cipher_null
-driver       : cipher_null-generic
-module       : kernel
-priority     : 0
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : cipher
-blocksize    : 1
-min keysize  : 0
-max keysize  : 0
-
-name         : rsa
-driver       : rsa-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : akcipher
-
-name         : dh
-driver       : dh-generic
-module       : kernel
-priority     : 100
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : kpp
-
-name         : aes
-driver       : aes-asm
-module       : kernel
-priority     : 200
-refcnt       : 1
-selftest     : passed
-internal     : no
-type         : cipher
-blocksize    : 16
-min keysize  : 16
-max keysize  : 32
-
-Mode: 444
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/diskstats
-Lines: 52
-   1       0 ram0 0 0 0 0 0 0 0 0 0 0 0
-   1       1 ram1 0 0 0 0 0 0 0 0 0 0 0
-   1       2 ram2 0 0 0 0 0 0 0 0 0 0 0
-   1       3 ram3 0 0 0 0 0 0 0 0 0 0 0
-   1       4 ram4 0 0 0 0 0 0 0 0 0 0 0
-   1       5 ram5 0 0 0 0 0 0 0 0 0 0 0
-   1       6 ram6 0 0 0 0 0 0 0 0 0 0 0
-   1       7 ram7 0 0 0 0 0 0 0 0 0 0 0
-   1       8 ram8 0 0 0 0 0 0 0 0 0 0 0
-   1       9 ram9 0 0 0 0 0 0 0 0 0 0 0
-   1      10 ram10 0 0 0 0 0 0 0 0 0 0 0
-   1      11 ram11 0 0 0 0 0 0 0 0 0 0 0
-   1      12 ram12 0 0 0 0 0 0 0 0 0 0 0
-   1      13 ram13 0 0 0 0 0 0 0 0 0 0 0
-   1      14 ram14 0 0 0 0 0 0 0 0 0 0 0
-   1      15 ram15 0 0 0 0 0 0 0 0 0 0 0
-   7       0 loop0 0 0 0 0 0 0 0 0 0 0 0
-   7       1 loop1 0 0 0 0 0 0 0 0 0 0 0
-   7       2 loop2 0 0 0 0 0 0 0 0 0 0 0
-   7       3 loop3 0 0 0 0 0 0 0 0 0 0 0
-   7       4 loop4 0 0 0 0 0 0 0 0 0 0 0
-   7       5 loop5 0 0 0 0 0 0 0 0 0 0 0
-   7       6 loop6 0 0 0 0 0 0 0 0 0 0 0
-   7       7 loop7 0 0 0 0 0 0 0 0 0 0 0
-   8       0 sda 25354637 34367663 1003346126 18492372 28444756 11134226 505697032 63877960 0 9653880 82621804
-   8       1 sda1 250 0 2000 36 0 0 0 0 0 36 36
-   8       2 sda2 246 0 1968 32 0 0 0 0 0 32 32
-   8       3 sda3 340 13 2818 52 11 8 152 8 0 56 60
-   8       4 sda4 25353629 34367650 1003337964 18492232 27448755 11134218 505696880 61593380 0 7576432 80332428
- 252       0 dm-0 59910002 0 1003337218 46229572 39231014 0 505696880 1158557800 0 11325968 1206301256
- 252       1 dm-1 388 0 3104 84 74 0 592 0 0 76 84
- 252       2 dm-2 11571 0 308350 6536 153522 0 5093416 122884 0 65400 129416
- 252       3 dm-3 3870 0 3870 104 0 0 0 0 0 16 104
- 252       4 dm-4 392 0 1034 28 38 0 137 16 0 24 44
- 252       5 dm-5 3729 0 84279 924 98918 0 1151688 104684 0 58848 105632
- 179       0 mmcblk0 192 3 1560 156 0 0 0 0 0 136 156
- 179       1 mmcblk0p1 17 3 160 24 0 0 0 0 0 24 24
- 179       2 mmcblk0p2 95 0 760 68 0 0 0 0 0 68 68
-   2       0 fd0 2 0 16 80 0 0 0 0 0 80 80
- 254       0 vda 1775784 15386 32670882 8655768 6038856 20711856 213637440 2069221364 0 41614592 2077872228
- 254       1 vda1 668 85 5984 956 207 4266 35784 32772 0 8808 33720
- 254       2 vda2 1774936 15266 32663262 8654692 5991028 20707590 213601656 2069152216 0 41607628 2077801992
-  11       0 sr0 0 0 0 0 0 0 0 0 0 0 0
- 259       0 nvme0n1 47114 4 4643973 21650 1078320 43950 39451633 1011053 0 222766 1032546
- 259       1 nvme0n1p1 1140 0 9370 16 1 0 1 0 0 16 16
- 259       2 nvme0n1p2 45914 4 4631243 21626 1036885 43950 39451632 919480 0 131580 940970
-   8       0 sdb 326552 841 9657779 84 41822 2895 1972905 5007 0 60730 67070 68851 0 1925173784 11130
-   8       1 sdb1 231 3 34466 4 24 23 106 0 0 64 64 0 0 0 0
-   8       2 sdb2 326310 838 9622281 67 40726 2872 1972799 4924 0 58250 64567 68851 0 1925173784 11130
-   8       0 sdc 14202 71 579164 21861 2995 1589 180500 40875 0 11628 55200 0 0 0 0 127 182
-   8       1 sdc1 1027 0 13795 5021 2 0 4096 3 0 690 4579 0 0 0 0 0 0
-   8       2 sdc2 13126 71 561749 16802 2830 1589 176404 40620 0 10931 50449 0 0 0 0 0 0
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/fs
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/fs/fscache
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/fs/fscache/stats
-Lines: 24
-FS-Cache statistics
-Cookies: idx=3 dat=67877 spc=0
-Objects: alc=67473 nal=0 avl=67473 ded=388
-ChkAux : non=12 ok=33 upd=44 obs=55
-Pages  : mrk=547164 unc=364577
-Acquire: n=67880 nul=98 noc=25 ok=67780 nbf=39 oom=26
-Lookups: n=67473 neg=67470 pos=58 crt=67473 tmo=85
-Invals : n=14 run=13
-Updates: n=7 nul=3 run=8
-Relinqs: n=394 nul=1 wcr=2 rtr=3
-AttrChg: n=6 ok=5 nbf=4 oom=3 run=2
-Allocs : n=20 ok=19 wt=18 nbf=17 int=16
-Allocs : ops=15 owt=14 abt=13
-Retrvls: n=151959 ok=82823 wt=23467 nod=69136 nbf=15 int=69 oom=43
-Retrvls: ops=151959 owt=42747 abt=44
-Stores : n=225565 ok=225565 agn=12 nbf=13 oom=14
-Stores : ops=69156 run=294721 pgs=225565 rxd=225565 olm=43
-VmScan : nos=364512 gon=2 bsy=43 can=12 wt=66
-Ops    : pend=42753 run=221129 enq=628798 can=11 rej=88
-Ops    : ini=377538 dfr=27 rel=377538 gc=37
-CacheOp: alo=1 luo=2 luc=3 gro=4
-CacheOp: inv=5 upo=6 dro=7 pto=8 atc=9 syn=10
-CacheOp: rap=11 ras=12 alp=13 als=14 wrp=15 ucp=16 dsp=17
-CacheEv: nsp=18 stl=19 rtr=20 cul=21EOF
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/fs/xfs
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/fs/xfs/stat
-Lines: 23
-extent_alloc 92447 97589 92448 93751
-abt 0 0 0 0
-blk_map 1767055 188820 184891 92447 92448 2140766 0
-bmbt 0 0 0 0
-dir 185039 92447 92444 136422
-trans 706 944304 0
-ig 185045 58807 0 126238 0 33637 22
-log 2883 113448 9 17360 739
-push_ail 945014 0 134260 15483 0 3940 464 159985 0 40
-xstrat 92447 0
-rw 107739 94045
-attr 4 0 0 0
-icluster 8677 7849 135802
-vnodes 92601 0 0 0 92444 92444 92444 0
-buf 2666287 7122 2659202 3599 2 7085 0 10297 7085
-abtb2 184941 1277345 13257 13278 0 0 0 0 0 0 0 0 0 0 2746147
-abtc2 345295 2416764 172637 172658 0 0 0 0 0 0 0 0 0 0 21406023
-bmbt2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-ibt2 343004 1358467 0 0 0 0 0 0 0 0 0 0 0 0 0
-fibt2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-qm 0 0 0 0 0 0 0 0
-xpc 399724544 92823103 86219234
-debug 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/loadavg
-Lines: 1
-0.02 0.04 0.05 1/497 11947
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/mdstat
-Lines: 60
-Personalities : [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
-
-md3 : active raid6 sda1[8] sdh1[7] sdg1[6] sdf1[5] sde1[11] sdd1[3] sdc1[10] sdb1[9] sdd1[10](S) sdd2[11](S)
-      5853468288 blocks super 1.2 level 6, 64k chunk, algorithm 2 [8/8] [UUUUUUUU]
-
-md127 : active raid1 sdi2[0] sdj2[1]
-      312319552 blocks [2/2] [UU]
-
-md0 : active raid1 sdi1[0] sdj1[1]
-      248896 blocks [2/2] [UU]
-
-md4 : inactive raid1 sda3[0](F) sdb3[1](S)
-      4883648 blocks [2/2] [UU]
-
-md6 : active raid1 sdb2[2](F) sdc[1](S) sda2[0]
-      195310144 blocks [2/1] [U_]
-      [=>...................]  recovery =  8.5% (16775552/195310144) finish=17.0min speed=259783K/sec
-
-md8 : active raid1 sdb1[1] sda1[0] sdc[2](S) sde[3](S)
-      195310144 blocks [2/2] [UU]
-      [=>...................]  resync =  8.5% (16775552/195310144) finish=17.0min speed=259783K/sec
-
-md201 : active raid1 sda3[0] sdb3[1]
-      1993728 blocks super 1.2 [2/2] [UU]
-      [=>...................]  check =  5.7% (114176/1993728) finish=0.2min speed=114176K/sec
-
-md7 : active raid6 sdb1[0] sde1[3] sdd1[2] sdc1[1](F)
-      7813735424 blocks super 1.2 level 6, 512k chunk, algorithm 2 [4/3] [U_UU]
-      bitmap: 0/30 pages [0KB], 65536KB chunk
-
-md9 : active raid1 sdc2[2] sdd2[3] sdb2[1] sda2[0] sde[4](F) sdf[5](F) sdg[6](S)
-      523968 blocks super 1.2 [4/4] [UUUU]
-      resync=DELAYED
-
-md10 : active raid0 sda1[0] sdb1[1]
-       314159265 blocks 64k chunks
-
-md11 : active (auto-read-only) raid1 sdb2[0] sdc2[1] sdc3[2](F) hda[4](S) ssdc2[3](S)
-      4190208 blocks super 1.2 [2/2] [UU]
-      resync=PENDING
-
-md12 : active raid0 sdc2[0] sdd2[1]
-      3886394368 blocks super 1.2 512k chunks
-
-md126 : active raid0 sdb[1] sdc[0]
-      1855870976 blocks super external:/md127/0 128k chunks
-
-md219 : inactive sdb[2](S) sdc[1](S) sda[0](S)
-        7932 blocks super external:imsm
-
-md00 : active raid0 xvdb[0]
-      4186624 blocks super 1.2 256k chunks
-
-md120 : active linear sda1[1] sdb1[0]
-        2095104 blocks super 1.2 0k rounding
-
-md101 : active (read-only) raid0 sdb[2] sdd[1] sdc[0]
-      322560 blocks super 1.2 512k chunks
-
-unused devices: <none>
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/meminfo
-Lines: 42
-MemTotal:       15666184 kB
-MemFree:          440324 kB
-Buffers:         1020128 kB
-Cached:         12007640 kB
-SwapCached:            0 kB
-Active:          6761276 kB
-Inactive:        6532708 kB
-Active(anon):     267256 kB
-Inactive(anon):      268 kB
-Active(file):    6494020 kB
-Inactive(file):  6532440 kB
-Unevictable:           0 kB
-Mlocked:               0 kB
-SwapTotal:             0 kB
-SwapFree:              0 kB
-Dirty:               768 kB
-Writeback:             0 kB
-AnonPages:        266216 kB
-Mapped:            44204 kB
-Shmem:              1308 kB
-Slab:            1807264 kB
-SReclaimable:    1738124 kB
-SUnreclaim:        69140 kB
-KernelStack:        1616 kB
-PageTables:         5288 kB
-NFS_Unstable:          0 kB
-Bounce:                0 kB
-WritebackTmp:          0 kB
-CommitLimit:     7833092 kB
-Committed_AS:     530844 kB
-VmallocTotal:   34359738367 kB
-VmallocUsed:       36596 kB
-VmallocChunk:   34359637840 kB
-HardwareCorrupted:     0 kB
-AnonHugePages:     12288 kB
-HugePages_Total:       0
-HugePages_Free:        0
-HugePages_Rsvd:        0
-HugePages_Surp:        0
-Hugepagesize:       2048 kB
-DirectMap4k:       91136 kB
-DirectMap2M:    16039936 kB
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/net
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/arp
-Lines: 2
-IP address       HW type     Flags       HW address            Mask     Device
-192.168.224.1    0x1         0x2         00:50:56:c0:00:08     *        ens33
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/dev
-Lines: 6
-Inter-|   Receive                                                |  Transmit
- face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
-vethf345468:     648       8    0    0    0     0          0         0      438       5    0    0    0     0       0          0
-    lo: 1664039048 1566805    0    0    0     0          0         0 1664039048 1566805    0    0    0     0       0          0
-docker0:    2568      38    0    0    0     0          0         0      438       5    0    0    0     0       0          0
-  eth0: 874354587 1036395    0    0    0     0          0         0 563352563  732147    0    0    0     0       0          0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/ip_vs
-Lines: 21
-IP Virtual Server version 1.2.1 (size=4096)
-Prot LocalAddress:Port Scheduler Flags
-  -> RemoteAddress:Port Forward Weight ActiveConn InActConn
-TCP  C0A80016:0CEA wlc
-  -> C0A85216:0CEA      Tunnel  100    248        2
-  -> C0A85318:0CEA      Tunnel  100    248        2
-  -> C0A85315:0CEA      Tunnel  100    248        1
-TCP  C0A80039:0CEA wlc
-  -> C0A85416:0CEA      Tunnel  0      0          0
-  -> C0A85215:0CEA      Tunnel  100    1499       0
-  -> C0A83215:0CEA      Tunnel  100    1498       0
-TCP  C0A80037:0CEA wlc
-  -> C0A8321A:0CEA      Tunnel  0      0          0
-  -> C0A83120:0CEA      Tunnel  100    0          0
-TCP  [2620:0000:0000:0000:0000:0000:0000:0001]:0050 sh
-  -> [2620:0000:0000:0000:0000:0000:0000:0002]:0050      Route   1      0          0
-  -> [2620:0000:0000:0000:0000:0000:0000:0003]:0050      Route   1      0          0
-  -> [2620:0000:0000:0000:0000:0000:0000:0004]:0050      Route   1      1          1
-FWM  10001000 wlc
-  -> C0A8321A:0CEA      Route   0      0          1
-  -> C0A83215:0CEA      Route   0      0          2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/ip_vs_stats
-Lines: 6
-   Total Incoming Outgoing         Incoming         Outgoing
-   Conns  Packets  Packets            Bytes            Bytes
- 16AA370 E33656E5        0     51D8C8883AB3                0
-
- Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s
-       4    1FB3C        0          1282A8F                0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/protocols
-Lines: 14
-protocol  size sockets  memory press maxhdr  slab module     cl co di ac io in de sh ss gs se re sp bi br ha uh gp em
-PACKET    1344      2      -1   NI       0   no   kernel      n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n
-PINGv6    1112      0      -1   NI       0   yes  kernel      y  y  y  n  n  y  n  n  y  y  y  y  n  y  y  y  y  y  n
-RAWv6     1112      1      -1   NI       0   yes  kernel      y  y  y  n  y  y  y  n  y  y  y  y  n  y  y  y  y  n  n
-UDPLITEv6 1216      0      57   NI       0   yes  kernel      y  y  y  n  y  y  y  n  y  y  y  y  n  n  n  y  y  y  n
-UDPv6     1216     10      57   NI       0   yes  kernel      y  y  y  n  y  y  y  n  y  y  y  y  n  n  n  y  y  y  n
-TCPv6     2144   1937  1225378   no     320   yes  kernel      y  y  y  y  y  y  y  y  y  y  y  y  y  n  y  y  y  y  y
-UNIX      1024    120      -1   NI       0   yes  kernel      n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n
-UDP-Lite  1024      0      57   NI       0   yes  kernel      y  y  y  n  y  y  y  n  y  y  y  y  y  n  n  y  y  y  n
-PING       904      0      -1   NI       0   yes  kernel      y  y  y  n  n  y  n  n  y  y  y  y  n  y  y  y  y  y  n
-RAW        912      0      -1   NI       0   yes  kernel      y  y  y  n  y  y  y  n  y  y  y  y  n  y  y  y  y  n  n
-UDP       1024     73      57   NI       0   yes  kernel      y  y  y  n  y  y  y  n  y  y  y  y  y  n  n  y  y  y  n
-TCP       1984  93064  1225378   yes     320   yes  kernel      y  y  y  y  y  y  y  y  y  y  y  y  y  n  y  y  y  y  y
-NETLINK   1040     16      -1   NI       0   no   kernel      n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n  n
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/net/rpc
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/rpc/nfs
-Lines: 5
-net 18628 0 18628 6
-rpc 4329785 0 4338291
-proc2 18 2 69 0 0 4410 0 0 0 0 0 0 0 0 0 0 0 99 2
-proc3 22 1 4084749 29200 94754 32580 186 47747 7981 8639 0 6356 0 6962 0 7958 0 0 241 4 4 2 39
-proc4 61 1 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/rpc/nfsd
-Lines: 11
-rc 0 6 18622
-fh 0 0 0 0 0
-io 157286400 0
-th 8 0 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000
-ra 32 0 0 0 0 0 0 0 0 0 0 0
-net 18628 0 18628 6
-rpc 18628 0 0 0 0
-proc2 18 2 69 0 0 4410 0 0 0 0 0 0 0 0 0 0 0 99 2
-proc3 22 2 112 0 2719 111 0 0 0 0 0 0 0 0 0 0 0 27 216 0 2 1 0
-proc4 2 2 10853
-proc4ops 72 0 0 0 1098 2 0 0 0 0 8179 5896 0 0 0 0 5900 0 0 2 0 2 0 9609 0 2 150 1272 0 0 0 1236 0 0 0 0 3 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/sockstat
-Lines: 6
-sockets: used 1602
-TCP: inuse 35 orphan 0 tw 4 alloc 59 mem 22
-UDP: inuse 12 mem 62
-UDPLITE: inuse 0
-RAW: inuse 0
-FRAG: inuse 0 memory 0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/sockstat6
-Lines: 5
-TCP6: inuse 17
-UDP6: inuse 9
-UDPLITE6: inuse 0
-RAW6: inuse 1
-FRAG6: inuse 0 memory 0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/softnet_stat
-Lines: 2
-00015c73 00020e76 F0000769 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
-01663fb2 00000000 000109a4 00000000 00000000 00000000 00000000 00000000 00000000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/softnet_stat.broken
-Lines: 1
-00015c73 00020e76 F0000769 00000000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/tcp
-Lines: 4
-  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
-   0: 0500000A:0016 00000000:0000 0A 00000000:00000001 00:00000000 00000000     0        0 2740 1 ffff88003d3af3c0 100 0 0 10 0
-   1: 00000000:0016 00000000:0000 0A 00000001:00000000 00:00000000 00000000     0        0 2740 1 ffff88003d3af3c0 100 0 0 10 0
-   2: 00000000:0016 00000000:0000 0A 00000001:00000001 00:00000000 00000000     0        0 2740 1 ffff88003d3af3c0 100 0 0 10 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/tcp6
-Lines: 3
-  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops
- 1315: 00000000000000000000000000000000:14EB 00000000000000000000000000000000:0000 07 00000000:00000000 00:00000000 00000000   981        0 21040 2 0000000013726323 0
- 6073: 000080FE00000000FFADE15609667CFE:C781 00000000000000000000000000000000:0000 07 00000000:00000000 00:00000000 00000000  1000        0 11337031 2 00000000b9256fdd 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/udp
-Lines: 4
-  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
-   0: 0500000A:0016 00000000:0000 0A 00000000:00000001 00:00000000 00000000     0        0 2740 1 ffff88003d3af3c0 100 0 0 10 0
-   1: 00000000:0016 00000000:0000 0A 00000001:00000000 00:00000000 00000000     0        0 2740 1 ffff88003d3af3c0 100 0 0 10 0
-   2: 00000000:0016 00000000:0000 0A 00000001:00000001 00:00000000 00000000     0        0 2740 1 ffff88003d3af3c0 100 0 0 10 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/udp6
-Lines: 3
-  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops
- 1315: 00000000000000000000000000000000:14EB 00000000000000000000000000000000:0000 07 00000000:00000000 00:00000000 00000000   981        0 21040 2 0000000013726323 0
- 6073: 000080FE00000000FFADE15609667CFE:C781 00000000000000000000000000000000:0000 07 00000000:00000000 00:00000000 00000000  1000        0 11337031 2 00000000b9256fdd 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/udp_broken
-Lines: 2
-  sl  local_address rem_address   st
-   1: 00000000:0016 00000000:0000 0A
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/unix
-Lines: 6
-Num       RefCount Protocol Flags    Type St Inode Path
-0000000000000000: 00000002 00000000 00010000 0001 01 3442596 /var/run/postgresql/.s.PGSQL.5432
-0000000000000000: 0000000a 00000000 00010000 0005 01 10061 /run/udev/control
-0000000000000000: 00000007 00000000 00000000 0002 01 12392 /dev/log
-0000000000000000: 00000003 00000000 00000000 0001 03 4787297 /var/run/postgresql/.s.PGSQL.5432
-0000000000000000: 00000003 00000000 00000000 0001 03 5091797
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/unix_without_inode
-Lines: 6
-Num       RefCount Protocol Flags    Type St Path
-0000000000000000: 00000002 00000000 00010000 0001 01 /var/run/postgresql/.s.PGSQL.5432
-0000000000000000: 0000000a 00000000 00010000 0005 01 /run/udev/control
-0000000000000000: 00000007 00000000 00000000 0002 01 /dev/log
-0000000000000000: 00000003 00000000 00000000 0001 03 /var/run/postgresql/.s.PGSQL.5432
-0000000000000000: 00000003 00000000 00000000 0001 03
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/net/xfrm_stat
-Lines: 28
-XfrmInError                     1
-XfrmInBufferError               2
-XfrmInHdrError                  4
-XfrmInNoStates                  3
-XfrmInStateProtoError           40
-XfrmInStateModeError            100
-XfrmInStateSeqError             6000
-XfrmInStateExpired              4
-XfrmInStateMismatch             23451
-XfrmInStateInvalid              55555
-XfrmInTmplMismatch              51
-XfrmInNoPols                    65432
-XfrmInPolBlock                  100
-XfrmInPolError                  10000
-XfrmOutError                    1000000
-XfrmOutBundleGenError           43321
-XfrmOutBundleCheckError         555
-XfrmOutNoStates                 869
-XfrmOutStateProtoError          4542
-XfrmOutStateModeError           4
-XfrmOutStateSeqError            543
-XfrmOutStateExpired             565
-XfrmOutPolBlock                 43456
-XfrmOutPolDead                  7656
-XfrmOutPolError                 1454
-XfrmFwdHdrError                 6654
-XfrmOutStateInvalid             28765
-XfrmAcquireError                24532
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/pressure
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/pressure/cpu
-Lines: 1
-some avg10=0.10 avg60=2.00 avg300=3.85 total=15
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/pressure/io
-Lines: 2
-some avg10=0.10 avg60=2.00 avg300=3.85 total=15
-full avg10=0.20 avg60=3.00 avg300=4.95 total=25
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/pressure/memory
-Lines: 2
-some avg10=0.10 avg60=2.00 avg300=3.85 total=15
-full avg10=0.20 avg60=3.00 avg300=4.95 total=25
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/schedstat
-Lines: 6
-version 15
-timestamp 15819019232
-cpu0 498494191 0 3533438552 2553969831 3853684107 2465731542 2045936778163039 343796328169361 4767485306
-domain0 00000000,00000003 212499247 210112015 1861015 1860405436 536440 369895 32599 210079416 25368550 24241256 384652 927363878 807233 6366 1647 24239609 2122447165 1886868564 121112060 2848625533 125678146 241025 1032026 1885836538 2545 12 2533 0 0 0 0 0 0 1387952561 21076581 0
-cpu1 518377256 0 4155211005 2778589869 10466382 2867629021 1904686152592476 364107263788241 5145567945
-domain0 00000000,00000003 217653037 215526982 1577949 1580427380 557469 393576 28538 215498444 28721913 27662819 371153 870843407 745912 5523 1639 27661180 2331056874 2107732788 111442342 652402556 123615235 196159 1045245 2106687543 2400 3 2397 0 0 0 0 0 0 1437804657 26220076 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/self
-SymlinkTo: 26231
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/slabinfo
-Lines: 302
-slabinfo - version: 2.1
-# name            <active_objs> <num_objs> <objsize> <objperslab> <pagesperslab> : tunables <limit> <batchcount> <sharedfactor> : slabdata <active_slabs> <num_slabs> <sharedavail>
-pid_3                375    532    576   28    4 : tunables    0    0    0 : slabdata     19     19      0
-pid_2                  3     28    576   28    4 : tunables    0    0    0 : slabdata      1      1      0
-nvidia_p2p_page_cache      0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-nvidia_pte_cache    9022   9152    368   22    2 : tunables    0    0    0 : slabdata    416    416      0
-nvidia_stack_cache    321    326  12624    2    8 : tunables    0    0    0 : slabdata    163    163      0
-kvm_async_pf           0      0    472   34    4 : tunables    0    0    0 : slabdata      0      0      0
-kvm_vcpu               0      0  15552    2    8 : tunables    0    0    0 : slabdata      0      0      0
-kvm_mmu_page_header      0      0    504   32    4 : tunables    0    0    0 : slabdata      0      0      0
-pte_list_desc          0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-x86_emulator           0      0   3024   10    8 : tunables    0    0    0 : slabdata      0      0      0
-x86_fpu                0      0   4608    7    8 : tunables    0    0    0 : slabdata      0      0      0
-iwl_cmd_pool:0000:04:00.0      0    128    512   32    4 : tunables    0    0    0 : slabdata      4      4      0
-ext4_groupinfo_4k   3719   3740    480   34    4 : tunables    0    0    0 : slabdata    110    110      0
-bio-6                 32     75    640   25    4 : tunables    0    0    0 : slabdata      3      3      0
-bio-5                 16     48   1344   24    8 : tunables    0    0    0 : slabdata      2      2      0
-bio-4                 17     92   1408   23    8 : tunables    0    0    0 : slabdata      4      4      0
-fat_inode_cache        0      0   1056   31    8 : tunables    0    0    0 : slabdata      0      0      0
-fat_cache              0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-ovl_aio_req            0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-ovl_inode              0      0   1000   32    8 : tunables    0    0    0 : slabdata      0      0      0
-squashfs_inode_cache      0      0   1088   30    8 : tunables    0    0    0 : slabdata      0      0      0
-fuse_request           0      0    472   34    4 : tunables    0    0    0 : slabdata      0      0      0
-fuse_inode             0      0   1152   28    8 : tunables    0    0    0 : slabdata      0      0      0
-xfs_dqtrx              0      0    864   37    8 : tunables    0    0    0 : slabdata      0      0      0
-xfs_dquot              0      0    832   39    8 : tunables    0    0    0 : slabdata      0      0      0
-xfs_buf                0      0    768   21    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_bui_item           0      0    544   30    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_bud_item           0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_cui_item           0      0    768   21    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_cud_item           0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_rui_item           0      0   1024   32    8 : tunables    0    0    0 : slabdata      0      0      0
-xfs_rud_item           0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_icr                0      0    520   31    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_ili                0      0    528   31    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_inode              0      0   1344   24    8 : tunables    0    0    0 : slabdata      0      0      0
-xfs_efi_item           0      0    768   21    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_efd_item           0      0    776   21    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_buf_item           0      0    608   26    4 : tunables    0    0    0 : slabdata      0      0      0
-xf_trans               0      0    568   28    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_ifork              0      0    376   21    2 : tunables    0    0    0 : slabdata      0      0      0
-xfs_da_state           0      0    816   20    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_btree_cur          0      0    560   29    4 : tunables    0    0    0 : slabdata      0      0      0
-xfs_bmap_free_item      0      0    400   20    2 : tunables    0    0    0 : slabdata      0      0      0
-xfs_log_ticket         0      0    520   31    4 : tunables    0    0    0 : slabdata      0      0      0
-nfs_direct_cache       0      0    560   29    4 : tunables    0    0    0 : slabdata      0      0      0
-nfs_commit_data        4     28   1152   28    8 : tunables    0    0    0 : slabdata      1      1      0
-nfs_write_data        32     50   1280   25    8 : tunables    0    0    0 : slabdata      2      2      0
-nfs_read_data          0      0   1280   25    8 : tunables    0    0    0 : slabdata      0      0      0
-nfs_inode_cache        0      0   1408   23    8 : tunables    0    0    0 : slabdata      0      0      0
-nfs_page               0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-rpc_inode_cache        0      0   1024   32    8 : tunables    0    0    0 : slabdata      0      0      0
-rpc_buffers            8     13   2496   13    8 : tunables    0    0    0 : slabdata      1      1      0
-rpc_tasks              8     25    640   25    4 : tunables    0    0    0 : slabdata      1      1      0
-fscache_cookie_jar      1     35    464   35    4 : tunables    0    0    0 : slabdata      1      1      0
-jfs_mp                32     35    464   35    4 : tunables    0    0    0 : slabdata      1      1      0
-jfs_ip                 0      0   1592   20    8 : tunables    0    0    0 : slabdata      0      0      0
-reiser_inode_cache      0      0   1096   29    8 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_end_io_wq        0      0    464   35    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_prelim_ref       0      0    424   38    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_delayed_extent_op      0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_delayed_data_ref      0      0    448   36    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_delayed_tree_ref      0      0    440   37    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_delayed_ref_head      0      0    480   34    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_inode_defrag      0      0    400   20    2 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_delayed_node      0      0    648   25    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_ordered_extent      0      0    752   21    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_extent_map       0      0    480   34    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_extent_state      0      0    416   39    4 : tunables    0    0    0 : slabdata      0      0      0
-bio-3                 35     92    704   23    4 : tunables    0    0    0 : slabdata      4      4      0
-btrfs_extent_buffer      0      0    600   27    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_free_space_bitmap      0      0  12288    2    8 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_free_space       0      0    416   39    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_path             0      0    448   36    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_trans_handle      0      0    440   37    4 : tunables    0    0    0 : slabdata      0      0      0
-btrfs_inode            0      0   1496   21    8 : tunables    0    0    0 : slabdata      0      0      0
-ext4_inode_cache   84136  84755   1400   23    8 : tunables    0    0    0 : slabdata   3685   3685      0
-ext4_free_data        22     80    392   20    2 : tunables    0    0    0 : slabdata      4      4      0
-ext4_allocation_context      0     70    464   35    4 : tunables    0    0    0 : slabdata      2      2      0
-ext4_prealloc_space     24     74    440   37    4 : tunables    0    0    0 : slabdata      2      2      0
-ext4_system_zone     267    273    376   21    2 : tunables    0    0    0 : slabdata     13     13      0
-ext4_io_end_vec        0     88    368   22    2 : tunables    0    0    0 : slabdata      4      4      0
-ext4_io_end            0     80    400   20    2 : tunables    0    0    0 : slabdata      4      4      0
-ext4_bio_post_read_ctx    128    147    384   21    2 : tunables    0    0    0 : slabdata      7      7      0
-ext4_pending_reservation      0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-ext4_extent_status  79351  79422    376   21    2 : tunables    0    0    0 : slabdata   3782   3782      0
-jbd2_transaction_s     44    100    640   25    4 : tunables    0    0    0 : slabdata      4      4      0
-jbd2_inode          6785   6840    400   20    2 : tunables    0    0    0 : slabdata    342    342      0
-jbd2_journal_handle      0     80    392   20    2 : tunables    0    0    0 : slabdata      4      4      0
-jbd2_journal_head    824   1944    448   36    4 : tunables    0    0    0 : slabdata     54     54      0
-jbd2_revoke_table_s      4     23    352   23    2 : tunables    0    0    0 : slabdata      1      1      0
-jbd2_revoke_record_s      0    156    416   39    4 : tunables    0    0    0 : slabdata      4      4      0
-ext2_inode_cache       0      0   1144   28    8 : tunables    0    0    0 : slabdata      0      0      0
-mbcache                0      0    392   20    2 : tunables    0    0    0 : slabdata      0      0      0
-dm_thin_new_mapping      0    152    424   38    4 : tunables    0    0    0 : slabdata      4      4      0
-dm_snap_pending_exception      0      0    464   35    4 : tunables    0    0    0 : slabdata      0      0      0
-dm_exception           0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-dm_dirty_log_flush_entry      0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-dm_bio_prison_cell_v2      0      0    432   37    4 : tunables    0    0    0 : slabdata      0      0      0
-dm_bio_prison_cell      0    148    432   37    4 : tunables    0    0    0 : slabdata      4      4      0
-kcopyd_job             0      8   3648    8    8 : tunables    0    0    0 : slabdata      1      1      0
-io                     0     32    512   32    4 : tunables    0    0    0 : slabdata      1      1      0
-dm_uevent              0      0   3224   10    8 : tunables    0    0    0 : slabdata      0      0      0
-dax_cache              1     28   1152   28    8 : tunables    0    0    0 : slabdata      1      1      0
-aic94xx_ascb           0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-aic94xx_dma_token      0      0    384   21    2 : tunables    0    0    0 : slabdata      0      0      0
-asd_sas_event          0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-sas_task               0      0    704   23    4 : tunables    0    0    0 : slabdata      0      0      0
-qla2xxx_srbs           0      0    832   39    8 : tunables    0    0    0 : slabdata      0      0      0
-sd_ext_cdb             2     22    368   22    2 : tunables    0    0    0 : slabdata      1      1      0
-scsi_sense_cache     258    288    512   32    4 : tunables    0    0    0 : slabdata      9      9      0
-virtio_scsi_cmd       64     75    640   25    4 : tunables    0    0    0 : slabdata      3      3      0
-L2TP/IPv6              0      0   1536   21    8 : tunables    0    0    0 : slabdata      0      0      0
-L2TP/IP                0      0   1408   23    8 : tunables    0    0    0 : slabdata      0      0      0
-ip6-frags              0      0    520   31    4 : tunables    0    0    0 : slabdata      0      0      0
-fib6_nodes             5     32    512   32    4 : tunables    0    0    0 : slabdata      1      1      0
-ip6_dst_cache          4     25    640   25    4 : tunables    0    0    0 : slabdata      1      1      0
-ip6_mrt_cache          0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-PINGv6                 0      0   1600   20    8 : tunables    0    0    0 : slabdata      0      0      0
-RAWv6                 25     40   1600   20    8 : tunables    0    0    0 : slabdata      2      2      0
-UDPLITEv6              0      0   1728   18    8 : tunables    0    0    0 : slabdata      0      0      0
-UDPv6                  3     54   1728   18    8 : tunables    0    0    0 : slabdata      3      3      0
-tw_sock_TCPv6          0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-request_sock_TCPv6      0      0    632   25    4 : tunables    0    0    0 : slabdata      0      0      0
-TCPv6                  0     33   2752   11    8 : tunables    0    0    0 : slabdata      3      3      0
-uhci_urb_priv          0      0    392   20    2 : tunables    0    0    0 : slabdata      0      0      0
-sgpool-128             2     14   4544    7    8 : tunables    0    0    0 : slabdata      2      2      0
-sgpool-64              2     13   2496   13    8 : tunables    0    0    0 : slabdata      1      1      0
-sgpool-32              2     44   1472   22    8 : tunables    0    0    0 : slabdata      2      2      0
-sgpool-16              2     68    960   34    8 : tunables    0    0    0 : slabdata      2      2      0
-sgpool-8               2     46    704   23    4 : tunables    0    0    0 : slabdata      2      2      0
-btree_node             0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-bfq_io_cq              0      0    488   33    4 : tunables    0    0    0 : slabdata      0      0      0
-bfq_queue              0      0    848   38    8 : tunables    0    0    0 : slabdata      0      0      0
-mqueue_inode_cache      1     24   1344   24    8 : tunables    0    0    0 : slabdata      1      1      0
-isofs_inode_cache      0      0    968   33    8 : tunables    0    0    0 : slabdata      0      0      0
-io_kiocb               0      0    640   25    4 : tunables    0    0    0 : slabdata      0      0      0
-kioctx                 0     30   1088   30    8 : tunables    0    0    0 : slabdata      1      1      0
-aio_kiocb              0     28    576   28    4 : tunables    0    0    0 : slabdata      1      1      0
-userfaultfd_ctx_cache      0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-fanotify_path_event      0      0    392   20    2 : tunables    0    0    0 : slabdata      0      0      0
-fanotify_fid_event      0      0    400   20    2 : tunables    0    0    0 : slabdata      0      0      0
-fsnotify_mark          0      0    408   20    2 : tunables    0    0    0 : slabdata      0      0      0
-dnotify_mark           0      0    416   39    4 : tunables    0    0    0 : slabdata      0      0      0
-dnotify_struct         0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-dio                    0      0   1088   30    8 : tunables    0    0    0 : slabdata      0      0      0
-bio-2                  4     25    640   25    4 : tunables    0    0    0 : slabdata      1      1      0
-fasync_cache           0      0    384   21    2 : tunables    0    0    0 : slabdata      0      0      0
-audit_tree_mark        0      0    416   39    4 : tunables    0    0    0 : slabdata      0      0      0
-pid_namespace         30     34    480   34    4 : tunables    0    0    0 : slabdata      1      1      0
-posix_timers_cache      0     27    592   27    4 : tunables    0    0    0 : slabdata      1      1      0
-iommu_devinfo         24     32    512   32    4 : tunables    0    0    0 : slabdata      1      1      0
-iommu_domain          10     10   3264   10    8 : tunables    0    0    0 : slabdata      1      1      0
-iommu_iova          8682   8748    448   36    4 : tunables    0    0    0 : slabdata    243    243      0
-UNIX                 529    814   1472   22    8 : tunables    0    0    0 : slabdata     37     37      0
-ip4-frags              0      0    536   30    4 : tunables    0    0    0 : slabdata      0      0      0
-ip_mrt_cache           0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-UDP-Lite               0      0   1536   21    8 : tunables    0    0    0 : slabdata      0      0      0
-tcp_bind_bucket        7    128    512   32    4 : tunables    0    0    0 : slabdata      4      4      0
-inet_peer_cache        0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-xfrm_dst_cache         0      0    704   23    4 : tunables    0    0    0 : slabdata      0      0      0
-xfrm_state             0      0   1152   28    8 : tunables    0    0    0 : slabdata      0      0      0
-ip_fib_trie            7     21    384   21    2 : tunables    0    0    0 : slabdata      1      1      0
-ip_fib_alias           9     20    392   20    2 : tunables    0    0    0 : slabdata      1      1      0
-ip_dst_cache          27     84    576   28    4 : tunables    0    0    0 : slabdata      3      3      0
-PING                   0      0   1408   23    8 : tunables    0    0    0 : slabdata      0      0      0
-RAW                   32     46   1408   23    8 : tunables    0    0    0 : slabdata      2      2      0
-UDP                   11    168   1536   21    8 : tunables    0    0    0 : slabdata      8      8      0
-tw_sock_TCP            1     56    576   28    4 : tunables    0    0    0 : slabdata      2      2      0
-request_sock_TCP       0     25    632   25    4 : tunables    0    0    0 : slabdata      1      1      0
-TCP                   10     60   2624   12    8 : tunables    0    0    0 : slabdata      5      5      0
-hugetlbfs_inode_cache      2     35    928   35    8 : tunables    0    0    0 : slabdata      1      1      0
-dquot                  0      0    640   25    4 : tunables    0    0    0 : slabdata      0      0      0
-bio-1                 32     46    704   23    4 : tunables    0    0    0 : slabdata      2      2      0
-eventpoll_pwq        409    600    408   20    2 : tunables    0    0    0 : slabdata     30     30      0
-eventpoll_epi        408    672    576   28    4 : tunables    0    0    0 : slabdata     24     24      0
-inotify_inode_mark     58    195    416   39    4 : tunables    0    0    0 : slabdata      5      5      0
-scsi_data_buffer       0      0    360   22    2 : tunables    0    0    0 : slabdata      0      0      0
-bio_crypt_ctx        128    147    376   21    2 : tunables    0    0    0 : slabdata      7      7      0
-request_queue         29     39   2408   13    8 : tunables    0    0    0 : slabdata      3      3      0
-blkdev_ioc            81    148    440   37    4 : tunables    0    0    0 : slabdata      4      4      0
-bio-0                125    200    640   25    4 : tunables    0    0    0 : slabdata      8      8      0
-biovec-max           166    196   4544    7    8 : tunables    0    0    0 : slabdata     28     28      0
-biovec-128             0     52   2496   13    8 : tunables    0    0    0 : slabdata      4      4      0
-biovec-64              0     88   1472   22    8 : tunables    0    0    0 : slabdata      4      4      0
-biovec-16              0     92    704   23    4 : tunables    0    0    0 : slabdata      4      4      0
-bio_integrity_payload      4     28    576   28    4 : tunables    0    0    0 : slabdata      1      1      0
-khugepaged_mm_slot     59    180    448   36    4 : tunables    0    0    0 : slabdata      5      5      0
-ksm_mm_slot            0      0    384   21    2 : tunables    0    0    0 : slabdata      0      0      0
-ksm_stable_node        0      0    400   20    2 : tunables    0    0    0 : slabdata      0      0      0
-ksm_rmap_item          0      0    400   20    2 : tunables    0    0    0 : slabdata      0      0      0
-user_namespace         2     37    864   37    8 : tunables    0    0    0 : slabdata      1      1      0
-uid_cache              5     28    576   28    4 : tunables    0    0    0 : slabdata      1      1      0
-dmaengine-unmap-256      1     13   2496   13    8 : tunables    0    0    0 : slabdata      1      1      0
-dmaengine-unmap-128      1     22   1472   22    8 : tunables    0    0    0 : slabdata      1      1      0
-dmaengine-unmap-16      1     28    576   28    4 : tunables    0    0    0 : slabdata      1      1      0
-dmaengine-unmap-2      1     36    448   36    4 : tunables    0    0    0 : slabdata      1      1      0
-audit_buffer           0     22    360   22    2 : tunables    0    0    0 : slabdata      1      1      0
-sock_inode_cache     663   1170   1216   26    8 : tunables    0    0    0 : slabdata     45     45      0
-skbuff_ext_cache       0      0    576   28    4 : tunables    0    0    0 : slabdata      0      0      0
-skbuff_fclone_cache      1     72    896   36    8 : tunables    0    0    0 : slabdata      2      2      0
-skbuff_head_cache      3    650    640   25    4 : tunables    0    0    0 : slabdata     26     26      0
-configfs_dir_cache      7     38    424   38    4 : tunables    0    0    0 : slabdata      1      1      0
-file_lock_cache       27    116    552   29    4 : tunables    0    0    0 : slabdata      4      4      0
-file_lock_ctx        106    120    392   20    2 : tunables    0    0    0 : slabdata      6      6      0
-fsnotify_mark_connector     52     66    368   22    2 : tunables    0    0    0 : slabdata      3      3      0
-net_namespace          1      6   5312    6    8 : tunables    0    0    0 : slabdata      1      1      0
-task_delay_info      784   1560    416   39    4 : tunables    0    0    0 : slabdata     40     40      0
-taskstats             45     92    688   23    4 : tunables    0    0    0 : slabdata      4      4      0
-proc_dir_entry       678    682    528   31    4 : tunables    0    0    0 : slabdata     22     22      0
-pde_opener             0    189    376   21    2 : tunables    0    0    0 : slabdata      9      9      0
-proc_inode_cache    7150   8250    992   33    8 : tunables    0    0    0 : slabdata    250    250      0
-seq_file              60    735    456   35    4 : tunables    0    0    0 : slabdata     21     21      0
-sigqueue               0    156    416   39    4 : tunables    0    0    0 : slabdata      4      4      0
-bdev_cache            36     78   1216   26    8 : tunables    0    0    0 : slabdata      3      3      0
-shmem_inode_cache   1599   2208   1016   32    8 : tunables    0    0    0 : slabdata     69     69      0
-kernfs_iattrs_cache   1251   1254    424   38    4 : tunables    0    0    0 : slabdata     33     33      0
-kernfs_node_cache  52898  52920    464   35    4 : tunables    0    0    0 : slabdata   1512   1512      0
-mnt_cache             42     46    704   23    4 : tunables    0    0    0 : slabdata      2      2      0
-filp                4314   6371    704   23    4 : tunables    0    0    0 : slabdata    277    277      0
-inode_cache        28695  29505    920   35    8 : tunables    0    0    0 : slabdata    843    843      0
-dentry            166069 169074    528   31    4 : tunables    0    0    0 : slabdata   5454   5454      0
-names_cache            0     35   4544    7    8 : tunables    0    0    0 : slabdata      5      5      0
-hashtab_node           0      0    360   22    2 : tunables    0    0    0 : slabdata      0      0      0
-ebitmap_node           0      0    400   20    2 : tunables    0    0    0 : slabdata      0      0      0
-avtab_extended_perms      0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-avtab_node             0      0    360   22    2 : tunables    0    0    0 : slabdata      0      0      0
-avc_xperms_data        0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-avc_xperms_decision_node      0      0    384   21    2 : tunables    0    0    0 : slabdata      0      0      0
-avc_xperms_node        0      0    392   20    2 : tunables    0    0    0 : slabdata      0      0      0
-avc_node              37     40    408   20    2 : tunables    0    0    0 : slabdata      2      2      0
-iint_cache             0      0    448   36    4 : tunables    0    0    0 : slabdata      0      0      0
-lsm_inode_cache   122284 122340    392   20    2 : tunables    0    0    0 : slabdata   6117   6117      0
-lsm_file_cache      4266   4485    352   23    2 : tunables    0    0    0 : slabdata    195    195      0
-key_jar                8     25    640   25    4 : tunables    0    0    0 : slabdata      1      1      0
-buffer_head       255622 257076    440   37    4 : tunables    0    0    0 : slabdata   6948   6948      0
-uts_namespace          0      0    776   21    4 : tunables    0    0    0 : slabdata      0      0      0
-nsproxy               31     40    408   20    2 : tunables    0    0    0 : slabdata      2      2      0
-vm_area_struct     39115  43214    528   31    4 : tunables    0    0    0 : slabdata   1394   1394      0
-mm_struct             96    529   1408   23    8 : tunables    0    0    0 : slabdata     23     23      0
-fs_cache             102    756    448   36    4 : tunables    0    0    0 : slabdata     21     21      0
-files_cache          102    588   1152   28    8 : tunables    0    0    0 : slabdata     21     21      0
-signal_cache         266    672   1536   21    8 : tunables    0    0    0 : slabdata     32     32      0
-sighand_cache        266    507   2496   13    8 : tunables    0    0    0 : slabdata     39     39      0
-task_struct          783    963  10240    3    8 : tunables    0    0    0 : slabdata    321    321      0
-cred_jar             364    952    576   28    4 : tunables    0    0    0 : slabdata     34     34      0
-anon_vma_chain     63907  67821    416   39    4 : tunables    0    0    0 : slabdata   1739   1739      0
-anon_vma           25891  28899    416   39    4 : tunables    0    0    0 : slabdata    741    741      0
-pid                  408    992    512   32    4 : tunables    0    0    0 : slabdata     31     31      0
-Acpi-Operand        6682   6740    408   20    2 : tunables    0    0    0 : slabdata    337    337      0
-Acpi-ParseExt          0     39    416   39    4 : tunables    0    0    0 : slabdata      1      1      0
-Acpi-Parse             0     80    392   20    2 : tunables    0    0    0 : slabdata      4      4      0
-Acpi-State             0     78    416   39    4 : tunables    0    0    0 : slabdata      2      2      0
-Acpi-Namespace      3911   3948    384   21    2 : tunables    0    0    0 : slabdata    188    188      0
-trace_event_file    2638   2660    424   38    4 : tunables    0    0    0 : slabdata     70     70      0
-ftrace_event_field   6592   6594    384   21    2 : tunables    0    0    0 : slabdata    314    314      0
-pool_workqueue        41     64   1024   32    8 : tunables    0    0    0 : slabdata      2      2      0
-radix_tree_node    21638  24045    912   35    8 : tunables    0    0    0 : slabdata    687    687      0
-task_group            48     78   1216   26    8 : tunables    0    0    0 : slabdata      3      3      0
-vmap_area           4411   4680    400   20    2 : tunables    0    0    0 : slabdata    234    234      0
-dma-kmalloc-8k         0      0  24576    1    8 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-4k         0      0  12288    2    8 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-2k         0      0   6144    5    8 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-1k         0      0   3072   10    8 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-512        0      0   1536   21    8 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-256        0      0   1024   32    8 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-128        0      0    640   25    4 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-64         0      0    512   32    4 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-32         0      0    416   39    4 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-16         0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-8          0      0    344   23    2 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-192        0      0    528   31    4 : tunables    0    0    0 : slabdata      0      0      0
-dma-kmalloc-96         0      0    432   37    4 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-8k         0      0  24576    1    8 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-4k         0      0  12288    2    8 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-2k         0      0   6144    5    8 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-1k         0      0   3072   10    8 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-512        0      0   1536   21    8 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-256        0      0   1024   32    8 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-192        0      0    528   31    4 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-128       31     75    640   25    4 : tunables    0    0    0 : slabdata      3      3      0
-kmalloc-rcl-96      3371   3626    432   37    4 : tunables    0    0    0 : slabdata     98     98      0
-kmalloc-rcl-64      2080   2272    512   32    4 : tunables    0    0    0 : slabdata     71     71      0
-kmalloc-rcl-32         0      0    416   39    4 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-16         0      0    368   22    2 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-rcl-8          0      0    344   23    2 : tunables    0    0    0 : slabdata      0      0      0
-kmalloc-8k           133    140  24576    1    8 : tunables    0    0    0 : slabdata    140    140      0
-kmalloc-4k           403    444  12288    2    8 : tunables    0    0    0 : slabdata    222    222      0
-kmalloc-2k          2391   2585   6144    5    8 : tunables    0    0    0 : slabdata    517    517      0
-kmalloc-1k          2163   2420   3072   10    8 : tunables    0    0    0 : slabdata    242    242      0
-kmalloc-512         2972   3633   1536   21    8 : tunables    0    0    0 : slabdata    173    173      0
-kmalloc-256         1841   1856   1024   32    8 : tunables    0    0    0 : slabdata     58     58      0
-kmalloc-192         2165   2914    528   31    4 : tunables    0    0    0 : slabdata     94     94      0
-kmalloc-128         1137   1175    640   25    4 : tunables    0    0    0 : slabdata     47     47      0
-kmalloc-96          1925   2590    432   37    4 : tunables    0    0    0 : slabdata     70     70      0
-kmalloc-64          9433  10688    512   32    4 : tunables    0    0    0 : slabdata    334    334      0
-kmalloc-32          9098  10062    416   39    4 : tunables    0    0    0 : slabdata    258    258      0
-kmalloc-16         10914  10956    368   22    2 : tunables    0    0    0 : slabdata    498    498      0
-kmalloc-8           7576   7705    344   23    2 : tunables    0    0    0 : slabdata    335    335      0
-kmem_cache_node      904    928    512   32    4 : tunables    0    0    0 : slabdata     29     29      0
-kmem_cache           904    936    832   39    8 : tunables    0    0    0 : slabdata     24     24      0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/stat
-Lines: 16
-cpu  301854 612 111922 8979004 3552 2 3944 0 0 0
-cpu0 44490 19 21045 1087069 220 1 3410 0 0 0
-cpu1 47869 23 16474 1110787 591 0 46 0 0 0
-cpu2 46504 36 15916 1112321 441 0 326 0 0 0
-cpu3 47054 102 15683 1113230 533 0 60 0 0 0
-cpu4 28413 25 10776 1140321 217 0 8 0 0 0
-cpu5 29271 101 11586 1136270 672 0 30 0 0 0
-cpu6 29152 36 10276 1139721 319 0 29 0 0 0
-cpu7 29098 268 10164 1139282 555 0 31 0 0 0
-intr 8885917 17 0 0 0 0 0 0 0 1 79281 0 0 0 0 0 0 0 231237 0 0 0 0 250586 103 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 223424 190745 13 906 1283803 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
-ctxt 38014093
-btime 1418183276
-processes 26442
-procs_running 2
-procs_blocked 1
-softirq 5057579 250191 1481983 1647 211099 186066 0 1783454 622196 12499 508444
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/swaps
-Lines: 2
-Filename				Type		Size	Used	Priority
-/dev/dm-2                               partition	131068	176	-2
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/symlinktargets
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/symlinktargets/README
-Lines: 2
-This directory contains some empty files that are the symlinks the files in the "fd" directory point to.
-They are otherwise ignored by the tests
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/symlinktargets/abc
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/symlinktargets/def
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/symlinktargets/ghi
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/symlinktargets/uvw
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/symlinktargets/xyz
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/sys
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/sys/kernel
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/sys/kernel/random
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/kernel/random/entropy_avail
-Lines: 1
-3943
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/kernel/random/poolsize
-Lines: 1
-4096
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/kernel/random/urandom_min_reseed_secs
-Lines: 1
-60
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/kernel/random/write_wakeup_threshold
-Lines: 1
-3072
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/proc/sys/vm
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/admin_reserve_kbytes
-Lines: 1
-8192
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/block_dump
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/compact_unevictable_allowed
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirty_background_bytes
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirty_background_ratio
-Lines: 1
-10
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirty_bytes
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirty_expire_centisecs
-Lines: 1
-3000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirty_ratio
-Lines: 1
-20
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirty_writeback_centisecs
-Lines: 1
-500
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/dirtytime_expire_seconds
-Lines: 1
-43200
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/drop_caches
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/extfrag_threshold
-Lines: 1
-500
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/hugetlb_shm_group
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/laptop_mode
-Lines: 1
-5
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/legacy_va_layout
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/lowmem_reserve_ratio
-Lines: 1
-256	256	32	0	0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/max_map_count
-Lines: 1
-65530
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/memory_failure_early_kill
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/memory_failure_recovery
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/min_free_kbytes
-Lines: 1
-67584
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/min_slab_ratio
-Lines: 1
-5
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/min_unmapped_ratio
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/mmap_min_addr
-Lines: 1
-65536
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/nr_hugepages
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/nr_hugepages_mempolicy
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/nr_overcommit_hugepages
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/numa_stat
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/numa_zonelist_order
-Lines: 1
-Node
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/oom_dump_tasks
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/oom_kill_allocating_task
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/overcommit_kbytes
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/overcommit_memory
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/overcommit_ratio
-Lines: 1
-50
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/page-cluster
-Lines: 1
-3
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/panic_on_oom
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/percpu_pagelist_fraction
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/stat_interval
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/swappiness
-Lines: 1
-60
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/user_reserve_kbytes
-Lines: 1
-131072
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/vfs_cache_pressure
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/watermark_boost_factor
-Lines: 1
-15000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/watermark_scale_factor
-Lines: 1
-10
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/sys/vm/zone_reclaim_mode
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/proc/zoneinfo
-Lines: 262
-Node 0, zone      DMA
-  per-node stats
-      nr_inactive_anon 230981
-      nr_active_anon 547580
-      nr_inactive_file 316904
-      nr_active_file 346282
-      nr_unevictable 115467
-      nr_slab_reclaimable 131220
-      nr_slab_unreclaimable 47320
-      nr_isolated_anon 0
-      nr_isolated_file 0
-      workingset_nodes 11627
-      workingset_refault 466886
-      workingset_activate 276925
-      workingset_restore 84055
-      workingset_nodereclaim 487
-      nr_anon_pages 795576
-      nr_mapped    215483
-      nr_file_pages 761874
-      nr_dirty     908
-      nr_writeback 0
-      nr_writeback_temp 0
-      nr_shmem     224925
-      nr_shmem_hugepages 0
-      nr_shmem_pmdmapped 0
-      nr_anon_transparent_hugepages 0
-      nr_unstable  0
-      nr_vmscan_write 12950
-      nr_vmscan_immediate_reclaim 3033
-      nr_dirtied   8007423
-      nr_written   7752121
-      nr_kernel_misc_reclaimable 0
-  pages free     3952
-        min      33
-        low      41
-        high     49
-        spanned  4095
-        present  3975
-        managed  3956
-        protection: (0, 2877, 7826, 7826, 7826)
-      nr_free_pages 3952
-      nr_zone_inactive_anon 0
-      nr_zone_active_anon 0
-      nr_zone_inactive_file 0
-      nr_zone_active_file 0
-      nr_zone_unevictable 0
-      nr_zone_write_pending 0
-      nr_mlock     0
-      nr_page_table_pages 0
-      nr_kernel_stack 0
-      nr_bounce    0
-      nr_zspages   0
-      nr_free_cma  0
-      numa_hit     1
-      numa_miss    0
-      numa_foreign 0
-      numa_interleave 0
-      numa_local   1
-      numa_other   0
-  pagesets
-    cpu: 0
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 1
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 2
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 3
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 4
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 5
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 6
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-    cpu: 7
-              count: 0
-              high:  0
-              batch: 1
-  vm stats threshold: 8
-  node_unreclaimable:  0
-  start_pfn:           1
-Node 0, zone    DMA32
-  pages free     204252
-        min      19510
-        low      21059
-        high     22608
-        spanned  1044480
-        present  759231
-        managed  742806
-        protection: (0, 0, 4949, 4949, 4949)
-      nr_free_pages 204252
-      nr_zone_inactive_anon 118558
-      nr_zone_active_anon 106598
-      nr_zone_inactive_file 75475
-      nr_zone_active_file 70293
-      nr_zone_unevictable 66195
-      nr_zone_write_pending 64
-      nr_mlock     4
-      nr_page_table_pages 1756
-      nr_kernel_stack 2208
-      nr_bounce    0
-      nr_zspages   0
-      nr_free_cma  0
-      numa_hit     113952967
-      numa_miss    0
-      numa_foreign 0
-      numa_interleave 0
-      numa_local   113952967
-      numa_other   0
-  pagesets
-    cpu: 0
-              count: 345
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 1
-              count: 356
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 2
-              count: 325
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 3
-              count: 346
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 4
-              count: 321
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 5
-              count: 316
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 6
-              count: 373
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-    cpu: 7
-              count: 339
-              high:  378
-              batch: 63
-  vm stats threshold: 48
-  node_unreclaimable:  0
-  start_pfn:           4096
-Node 0, zone   Normal
-  pages free     18553
-        min      11176
-        low      13842
-        high     16508
-        spanned  1308160
-        present  1308160
-        managed  1268711
-        protection: (0, 0, 0, 0, 0)
-      nr_free_pages 18553
-      nr_zone_inactive_anon 112423
-      nr_zone_active_anon 440982
-      nr_zone_inactive_file 241429
-      nr_zone_active_file 275989
-      nr_zone_unevictable 49272
-      nr_zone_write_pending 844
-      nr_mlock     154
-      nr_page_table_pages 9750
-      nr_kernel_stack 15136
-      nr_bounce    0
-      nr_zspages   0
-      nr_free_cma  0
-      numa_hit     162718019
-      numa_miss    0
-      numa_foreign 0
-      numa_interleave 26812
-      numa_local   162718019
-      numa_other   0
-  pagesets
-    cpu: 0
-              count: 316
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 1
-              count: 366
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 2
-              count: 60
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 3
-              count: 256
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 4
-              count: 253
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 5
-              count: 159
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 6
-              count: 311
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-    cpu: 7
-              count: 264
-              high:  378
-              batch: 63
-  vm stats threshold: 56
-  node_unreclaimable:  0
-  start_pfn:           1048576
-Node 0, zone  Movable
-  pages free     0
-        min      0
-        low      0
-        high     0
-        spanned  0
-        present  0
-        managed  0
-        protection: (0, 0, 0, 0, 0)
-Node 0, zone   Device
-  pages free     0
-        min      0
-        low      0
-        high     0
-        spanned  0
-        present  0
-        managed  0
-        protection: (0, 0, 0, 0, 0)
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/block
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/block/dm-0
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/dm-0/stat
-Lines: 1
-6447303        0 710266738  1529043   953216        0 31201176  4557464        0   796160  6088971
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/block/sda
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/block/sda/queue
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/add_random
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/chunk_sectors
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/dax
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/discard_granularity
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/discard_max_bytes
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/discard_max_hw_bytes
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/discard_zeroes_data
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/fua
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/hw_sector_size
-Lines: 1
-512
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/io_poll
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/io_poll_delay
-Lines: 1
--1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/io_timeout
-Lines: 1
-30000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/block/sda/queue/iosched
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/back_seek_max
-Lines: 1
-16384
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/back_seek_penalty
-Lines: 1
-2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/fifo_expire_async
-Lines: 1
-250
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/fifo_expire_sync
-Lines: 1
-125
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/low_latency
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/max_budget
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/slice_idle
-Lines: 1
-8
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/slice_idle_us
-Lines: 1
-8000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/strict_guarantees
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iosched/timeout_sync
-Lines: 1
-125
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/iostats
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/logical_block_size
-Lines: 1
-512
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/max_discard_segments
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/max_hw_sectors_kb
-Lines: 1
-32767
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/max_integrity_segments
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/max_sectors_kb
-Lines: 1
-1280
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/max_segment_size
-Lines: 1
-65536
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/max_segments
-Lines: 1
-168
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/minimum_io_size
-Lines: 1
-512
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/nomerges
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/nr_requests
-Lines: 1
-64
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/nr_zones
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/optimal_io_size
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/physical_block_size
-Lines: 1
-512
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/read_ahead_kb
-Lines: 1
-128
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/rotational
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/rq_affinity
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/scheduler
-Lines: 1
-mq-deadline kyber [bfq] none
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/wbt_lat_usec
-Lines: 1
-75000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/write_cache
-Lines: 1
-write back
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/write_same_max_bytes
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/write_zeroes_max_bytes
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/queue/zoned
-Lines: 1
-none
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/block/sda/stat
-Lines: 1
-9652963   396792 759304206   412943  8422549  6731723 286915323 13947418        0  5658367 19174573 1 2 3 12
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/fc_host
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/fc_host/host0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/dev_loss_tmo
-Lines: 1
-30
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/fabric_name
-Lines: 1
-0x0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/node_name
-Lines: 1
-0x2000e0071bce95f2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/port_id
-Lines: 1
-0x000002
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/port_name
-Lines: 1
-0x1000e0071bce95f2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/port_state
-Lines: 1
-Online
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/port_type
-Lines: 1
-Point-To-Point (direct nport connection)
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/speed
-Lines: 1
-16 Gbit
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/fc_host/host0/statistics
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/dumped_frames
-Lines: 1
-0xffffffffffffffff
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/error_frames
-Lines: 1
-0x0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/fcp_packet_aborts
-Lines: 1
-0x13
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/invalid_crc_count
-Lines: 1
-0x2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/invalid_tx_word_count
-Lines: 1
-0x8
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/link_failure_count
-Lines: 1
-0x9
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/loss_of_signal_count
-Lines: 1
-0x11
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/loss_of_sync_count
-Lines: 1
-0x10
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/nos_count
-Lines: 1
-0x12
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/rx_frames
-Lines: 1
-0x3
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/rx_words
-Lines: 1
-0x4
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/seconds_since_last_reset
-Lines: 1
-0x7
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/tx_frames
-Lines: 1
-0x5
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/statistics/tx_words
-Lines: 1
-0x6
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/supported_classes
-Lines: 1
-Class 3
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/supported_speeds
-Lines: 1
-4 Gbit, 8 Gbit, 16 Gbit
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/fc_host/host0/symbolic_name
-Lines: 1
-Emulex SN1100E2P FV12.4.270.3 DV12.4.0.0. HN:gotest. OS:Linux
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband/mlx4_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/board_id
-Lines: 1
-SM_1141000001000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/fw_ver
-Lines: 1
-2.31.5050
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/hca_type
-Lines: 1
-MT4099
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband/mlx4_0/ports
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband/mlx4_0/ports/1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/VL15_dropped
-Lines: 1
-0
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/excessive_buffer_overrun_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/link_downed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/link_error_recovery
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/local_link_integrity_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_rcv_constraint_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_rcv_data
-Lines: 1
-2221223609
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_rcv_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_rcv_packets
-Lines: 1
-87169372
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_rcv_remote_physical_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_rcv_switch_relay_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_xmit_constraint_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_xmit_data
-Lines: 1
-26509113295
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_xmit_discards
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_xmit_packets
-Lines: 1
-85734114
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/port_xmit_wait
-Lines: 1
-3599
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/counters/symbol_error
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/phys_state
-Lines: 1
-5: LinkUp
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/rate
-Lines: 1
-40 Gb/sec (4X QDR)
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/1/state
-Lines: 1
-4: ACTIVE
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband/mlx4_0/ports/2
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/VL15_dropped
-Lines: 1
-0
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/excessive_buffer_overrun_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/link_downed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/link_error_recovery
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/local_link_integrity_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_rcv_constraint_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_rcv_data
-Lines: 1
-2460436784
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_rcv_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_rcv_packets
-Lines: 1
-89332064
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_rcv_remote_physical_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_rcv_switch_relay_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_xmit_constraint_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_xmit_data
-Lines: 1
-26540356890
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_xmit_discards
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_xmit_packets
-Lines: 1
-88622850
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/port_xmit_wait
-Lines: 1
-3846
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/counters/symbol_error
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/phys_state
-Lines: 1
-5: LinkUp
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/rate
-Lines: 1
-40 Gb/sec (4X QDR)
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/infiniband/mlx4_0/ports/2/state
-Lines: 1
-4: ACTIVE
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/net
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/net/eth0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/addr_assign_type
-Lines: 1
-3
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/addr_len
-Lines: 1
-6
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/address
-Lines: 1
-01:01:01:01:01:01
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/broadcast
-Lines: 1
-ff:ff:ff:ff:ff:ff
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/carrier
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/carrier_changes
-Lines: 1
-2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/carrier_down_count
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/carrier_up_count
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/dev_id
-Lines: 1
-0x20
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/device
-SymlinkTo: ../../../devices/pci0000:00/0000:00:1f.6/
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/dormant
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/duplex
-Lines: 1
-full
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/flags
-Lines: 1
-0x1303
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/ifalias
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/ifindex
-Lines: 1
-2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/iflink
-Lines: 1
-2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/link_mode
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/mtu
-Lines: 1
-1500
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/name_assign_type
-Lines: 1
-2
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/netdev_group
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/operstate
-Lines: 1
-up
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/phys_port_id
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/phys_port_name
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/phys_switch_id
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/speed
-Lines: 1
-1000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/tx_queue_len
-Lines: 1
-1000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/net/eth0/type
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/power_supply
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/power_supply/AC
-SymlinkTo: ../../devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/power_supply/BAT0
-SymlinkTo: ../../devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/powercap
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/powercap/intel-rapl
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl/enabled
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl/uevent
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/powercap/intel-rapl:0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_0_max_power_uw
-Lines: 1
-95000000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_0_name
-Lines: 1
-long_term
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_0_power_limit_uw
-Lines: 1
-4090000000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_0_time_window_us
-Lines: 1
-999424
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_1_max_power_uw
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_1_name
-Lines: 1
-short_term
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_1_power_limit_uw
-Lines: 1
-4090000000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/constraint_1_time_window_us
-Lines: 1
-2440
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/enabled
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/energy_uj
-Lines: 1
-240422366267
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/max_energy_range_uj
-Lines: 1
-262143328850
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/name
-Lines: 1
-package-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0/uevent
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/powercap/intel-rapl:0:0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/constraint_0_max_power_uw
-Lines: 0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/constraint_0_name
-Lines: 1
-long_term
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/constraint_0_power_limit_uw
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/constraint_0_time_window_us
-Lines: 1
-976
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/enabled
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/energy_uj
-Lines: 1
-118821284256
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/max_energy_range_uj
-Lines: 1
-262143328850
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/name
-Lines: 1
-core
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:0:0/uevent
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/powercap/intel-rapl:a
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_0_max_power_uw
-Lines: 1
-95000000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_0_name
-Lines: 1
-long_term
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_0_power_limit_uw
-Lines: 1
-4090000000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_0_time_window_us
-Lines: 1
-999424
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_1_max_power_uw
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_1_name
-Lines: 1
-short_term
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_1_power_limit_uw
-Lines: 1
-4090000000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/constraint_1_time_window_us
-Lines: 1
-2440
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/enabled
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/energy_uj
-Lines: 1
-240422366267
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/max_energy_range_uj
-Lines: 1
-262143328850
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/name
-Lines: 1
-package-10
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/powercap/intel-rapl:a/uevent
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/thermal
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/thermal/cooling_device0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/cooling_device0/cur_state
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/cooling_device0/max_state
-Lines: 1
-50
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/cooling_device0/type
-Lines: 1
-Processor
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/thermal/cooling_device1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/cooling_device1/cur_state
-Lines: 1
--1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/cooling_device1/max_state
-Lines: 1
-27
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/cooling_device1/type
-Lines: 1
-intel_powerclamp
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/thermal/thermal_zone0
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone0/policy
-Lines: 1
-step_wise
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone0/temp
-Lines: 1
-49925
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone0/type
-Lines: 1
-bcm2835_thermal
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/class/thermal/thermal_zone1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone1/mode
-Lines: 1
-enabled
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone1/passive
-Lines: 1
-0
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone1/policy
-Lines: 1
-step_wise
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone1/temp
-Lines: 1
--44000
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/class/thermal/thermal_zone1/type
-Lines: 1
-acpitz
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/device
-SymlinkTo: ../../../ACPI0003:00
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/online
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/async
-Lines: 1
-disabled
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/autosuspend_delay_ms
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/control
-Lines: 1
-auto
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/runtime_active_kids
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/runtime_active_time
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/runtime_enabled
-Lines: 1
-disabled
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/runtime_status
-Lines: 1
-unsupported
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/runtime_suspended_time
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/runtime_usage
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup
-Lines: 1
-enabled
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_abort_count
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_active
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_active_count
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_count
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_expire_count
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_last_time_ms
-Lines: 1
-10598
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_max_time_ms
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_prevent_sleep_time_ms
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/power/wakeup_total_time_ms
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/subsystem
-SymlinkTo: ../../../../../../../../../class/power_supply
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/type
-Lines: 1
-Mains
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/ACPI0003:00/power_supply/AC/uevent
-Lines: 2
-POWER_SUPPLY_NAME=AC
-POWER_SUPPLY_ONLINE=0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/alarm
-Lines: 1
-2369000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/capacity
-Lines: 1
-98
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/capacity_level
-Lines: 1
-Normal
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/charge_start_threshold
-Lines: 1
-95
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/charge_stop_threshold
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/cycle_count
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/device
-SymlinkTo: ../../../PNP0C0A:00
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/energy_full
-Lines: 1
-50060000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/energy_full_design
-Lines: 1
-47520000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/energy_now
-Lines: 1
-49450000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/manufacturer
-Lines: 1
-LGC
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/model_name
-Lines: 1
-LNV-45N1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/async
-Lines: 1
-disabled
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/autosuspend_delay_ms
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/control
-Lines: 1
-auto
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/runtime_active_kids
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/runtime_active_time
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/runtime_enabled
-Lines: 1
-disabled
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/runtime_status
-Lines: 1
-unsupported
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/runtime_suspended_time
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power/runtime_usage
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/power_now
-Lines: 1
-4830000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/present
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/serial_number
-Lines: 1
-38109
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/status
-Lines: 1
-Discharging
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/subsystem
-SymlinkTo: ../../../../../../../../../class/power_supply
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/technology
-Lines: 1
-Li-ion
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/type
-Lines: 1
-Battery
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/uevent
-Lines: 16
-POWER_SUPPLY_NAME=BAT0
-POWER_SUPPLY_STATUS=Discharging
-POWER_SUPPLY_PRESENT=1
-POWER_SUPPLY_TECHNOLOGY=Li-ion
-POWER_SUPPLY_CYCLE_COUNT=0
-POWER_SUPPLY_VOLTAGE_MIN_DESIGN=10800000
-POWER_SUPPLY_VOLTAGE_NOW=11750000
-POWER_SUPPLY_POWER_NOW=5064000
-POWER_SUPPLY_ENERGY_FULL_DESIGN=47520000
-POWER_SUPPLY_ENERGY_FULL=47390000
-POWER_SUPPLY_ENERGY_NOW=40730000
-POWER_SUPPLY_CAPACITY=85
-POWER_SUPPLY_CAPACITY_LEVEL=Normal
-POWER_SUPPLY_MODEL_NAME=LNV-45N1
-POWER_SUPPLY_MANUFACTURER=LGC
-POWER_SUPPLY_SERIAL_NUMBER=38109
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/voltage_min_design
-Lines: 1
-10800000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/device:00/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/voltage_now
-Lines: 1
-12229000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/dirty_data
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_hit_ratio
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_hits
-Lines: 1
-289
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_day/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_hit_ratio
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_five_minute/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_hit_ratio
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_hour/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_hit_ratio
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_hits
-Lines: 1
-546
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata4/host3/target3:0:0/3:0:0:0/block/sdb/bcache/stats_total/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block/sdc
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block/sdc/bcache
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block/sdc/bcache/io_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block/sdc/bcache/metadata_written
-Lines: 1
-512
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block/sdc/bcache/priority_stats
-Lines: 5
-Unused:		99%
-Metadata:	0%
-Average:	10473
-Sectors per Q:	64
-Quantiles:	[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946]
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:0d.0/ata5/host4/target4:0:0/4:0:0:0/block/sdc/bcache/written
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/pci0000:00/0000:00:1f.6
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/ari_enabled
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/broken_parity_status
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/class
-Lines: 1
-0x020000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/consistent_dma_mask_bits
-Lines: 1
-64
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/d3cold_allowed
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/device
-Lines: 1
-0x15d7
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/dma_mask_bits
-Lines: 1
-64
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/driver_override
-Lines: 1
-(null)
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/irq
-Lines: 1
-140
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/local_cpulist
-Lines: 1
-0-7
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/local_cpus
-Lines: 1
-ff
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/modalias
-Lines: 1
-pci:v00008086d000015D7sv000017AAsd0000225Abc02sc00i00
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/msi_bus
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/numa_node
-Lines: 1
--1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/resource
-Lines: 13
-0x00000000ec200000 0x00000000ec21ffff 0x0000000000040200
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-0x0000000000000000 0x0000000000000000 0x0000000000000000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/revision
-Lines: 1
-0x21
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/subsystem_device
-Lines: 1
-0x225a
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/subsystem_vendor
-Lines: 1
-0x17aa
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/uevent
-Lines: 6
-DRIVER=e1000e
-PCI_CLASS=20000
-PCI_ID=8086:15D7
-PCI_SUBSYS_ID=17AA:225A
-PCI_SLOT_NAME=0000:00:1f.6
-MODALIAS=pci:v00008086d000015D7sv000017AAsd0000225Abc02sc00i00
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/pci0000:00/0000:00:1f.6/vendor
-Lines: 1
-0x8086
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/rbd
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/rbd/0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/rbd/0/name
-Lines: 1
-demo
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/rbd/0/pool
-Lines: 1
-iscsi-images
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/rbd/1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/rbd/1/name
-Lines: 1
-wrong
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/rbd/1/pool
-Lines: 1
-wrong-images
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/node
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/node/node1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/node/node1/vmstat
-Lines: 6
-nr_free_pages 1
-nr_zone_inactive_anon 2
-nr_zone_active_anon 3
-nr_zone_inactive_file 4
-nr_zone_active_file 5
-nr_zone_unevictable 6
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/node/node2
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/node/node2/vmstat
-Lines: 6
-nr_free_pages 7
-nr_zone_inactive_anon 8
-nr_zone_active_anon 9
-nr_zone_inactive_file 10
-nr_zone_active_file 11
-nr_zone_unevictable 12
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/clocksource
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/clocksource/clocksource0
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/clocksource/clocksource0/available_clocksource
-Lines: 1
-tsc hpet acpi_pm 
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/clocksource/clocksource0/current_clocksource
-Lines: 1
-tsc
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu0
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/cpufreq
-SymlinkTo: ../cpufreq/policy0
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu0/thermal_throttle
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/thermal_throttle/core_throttle_count
-Lines: 1
-10084
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/thermal_throttle/package_throttle_count
-Lines: 1
-34818
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu0/topology
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/topology/core_id
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/topology/core_siblings
-Lines: 1
-ff
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/topology/core_siblings_list
-Lines: 1
-0-7
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/topology/physical_package_id
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/topology/thread_siblings
-Lines: 1
-11
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu0/topology/thread_siblings_list
-Lines: 1
-0,4
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu1
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu1/cpufreq
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_cur_freq
-Lines: 1
-1200195
-Mode: 400
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_max_freq
-Lines: 1
-3300000
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_min_freq
-Lines: 1
-1200000
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/cpuinfo_transition_latency
-Lines: 1
-4294967295
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/related_cpus
-Lines: 1
-1
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/scaling_available_governors
-Lines: 1
-performance powersave
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/scaling_driver
-Lines: 1
-intel_pstate
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/scaling_governor
-Lines: 1
-powersave
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/scaling_max_freq
-Lines: 1
-3300000
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/scaling_min_freq
-Lines: 1
-1200000
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/cpufreq/scaling_setspeed
-Lines: 1
-<unsupported>
-Mode: 664
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu1/thermal_throttle
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/thermal_throttle/core_throttle_count
-Lines: 1
-523
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/thermal_throttle/package_throttle_count
-Lines: 1
-34818
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpu1/topology
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/topology/core_id
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/topology/core_siblings
-Lines: 1
-ff
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/topology/core_siblings_list
-Lines: 1
-0-7
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/topology/physical_package_id
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/topology/thread_siblings
-Lines: 1
-22
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpu1/topology/thread_siblings_list
-Lines: 1
-1,5
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpufreq
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpufreq/policy0
-Mode: 775
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/affected_cpus
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/cpuinfo_max_freq
-Lines: 1
-2400000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/cpuinfo_min_freq
-Lines: 1
-800000
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/cpuinfo_transition_latency
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/related_cpus
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_available_governors
-Lines: 1
-performance powersave
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_cur_freq
-Lines: 1
-1219917
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_driver
-Lines: 1
-intel_pstate
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_governor
-Lines: 1
-powersave
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_max_freq
-Lines: 1
-2400000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_min_freq
-Lines: 1
-800000
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/devices/system/cpu/cpufreq/policy0/scaling_setspeed
-Lines: 1
-<unsupported>
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/devices/system/cpu/cpufreq/policy1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/average_key_size
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0
-Mode: 777
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/dirty_data
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_hit_ratio
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_hits
-Lines: 1
-289
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_day/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_hit_ratio
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_five_minute/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_hit_ratio
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_hour/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_hit_ratio
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_hits
-Lines: 1
-546
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/stats_total/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/bdev0/writeback_rate_debug
-Lines: 7
-rate:           1.1M/sec
-dirty:          20.4G
-target:         20.4G
-proportional:   427.5k
-integral:       790.0k
-change:         321.5k/sec
-next io:        17ms
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/btree_cache_size
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/cache0
-Mode: 777
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/cache0/io_errors
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/cache0/metadata_written
-Lines: 1
-512
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/cache0/priority_stats
-Lines: 5
-Unused:		99%
-Metadata:	0%
-Average:	10473
-Sectors per Q:	64
-Quantiles:	[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946 20946]
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/cache0/written
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/cache_available_percent
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/congested
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/internal
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/internal/active_journal_entries
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/internal/btree_nodes
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/internal/btree_read_average_duration_us
-Lines: 1
-1305
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/internal/cache_read_races
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/root_usage_percent
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_hit_ratio
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_hits
-Lines: 1
-289
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_day/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_hit_ratio
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_five_minute/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_hit_ratio
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_hour/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/bypassed
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_bypass_hits
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_bypass_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_hit_ratio
-Lines: 1
-100
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_hits
-Lines: 1
-546
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_miss_collisions
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_misses
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/stats_total/cache_readaheads
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/bcache/deaddd54-c735-46d5-868e-f331c5fd7c74/tree_depth
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/bytes_may_use
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/bytes_readonly
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/bytes_reserved
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/bytes_used
-Lines: 1
-808189952
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/disk_total
-Lines: 1
-2147483648
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/disk_used
-Lines: 1
-808189952
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/flags
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/raid0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/raid0/total_bytes
-Lines: 1
-2147483648
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/raid0/used_bytes
-Lines: 1
-808189952
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/total_bytes
-Lines: 1
-2147483648
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/data/total_bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/global_rsv_reserved
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/global_rsv_size
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/bytes_may_use
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/bytes_readonly
-Lines: 1
-131072
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/bytes_reserved
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/bytes_used
-Lines: 1
-933888
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/disk_total
-Lines: 1
-2147483648
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/disk_used
-Lines: 1
-1867776
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/flags
-Lines: 1
-4
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/raid1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/raid1/total_bytes
-Lines: 1
-1073741824
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/raid1/used_bytes
-Lines: 1
-933888
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/total_bytes
-Lines: 1
-1073741824
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/metadata/total_bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/bytes_may_use
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/bytes_readonly
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/bytes_reserved
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/bytes_used
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/disk_total
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/disk_used
-Lines: 1
-32768
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/flags
-Lines: 1
-2
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/raid1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/raid1/total_bytes
-Lines: 1
-8388608
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/raid1/used_bytes
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/total_bytes
-Lines: 1
-8388608
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/allocation/system/total_bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/clone_alignment
-Lines: 1
-4096
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/devices
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/devices/loop25
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/devices/loop25/size
-Lines: 1
-20971520
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/devices/loop26
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/devices/loop26/size
-Lines: 1
-20971520
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/features
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/features/big_metadata
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/features/extended_iref
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/features/mixed_backref
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/features/skinny_metadata
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/label
-Lines: 1
-fixture
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/metadata_uuid
-Lines: 1
-0abb23a9-579b-43e6-ad30-227ef47fcb9d
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/nodesize
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/quota_override
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/0abb23a9-579b-43e6-ad30-227ef47fcb9d/sectorsize
-Lines: 1
-4096
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/bytes_may_use
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/bytes_readonly
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/bytes_reserved
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/bytes_used
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/disk_total
-Lines: 1
-644087808
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/disk_used
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/flags
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/raid5
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/raid5/total_bytes
-Lines: 1
-644087808
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/raid5/used_bytes
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/total_bytes
-Lines: 1
-644087808
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/data/total_bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/global_rsv_reserved
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/global_rsv_size
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/bytes_may_use
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/bytes_readonly
-Lines: 1
-262144
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/bytes_reserved
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/bytes_used
-Lines: 1
-114688
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/disk_total
-Lines: 1
-429391872
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/disk_used
-Lines: 1
-114688
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/flags
-Lines: 1
-4
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/raid6
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/raid6/total_bytes
-Lines: 1
-429391872
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/raid6/used_bytes
-Lines: 1
-114688
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/total_bytes
-Lines: 1
-429391872
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/metadata/total_bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/bytes_may_use
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/bytes_readonly
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/bytes_reserved
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/bytes_used
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/disk_total
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/disk_used
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/flags
-Lines: 1
-2
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/raid6
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/raid6/total_bytes
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/raid6/used_bytes
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/total_bytes
-Lines: 1
-16777216
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/allocation/system/total_bytes_pinned
-Lines: 1
-0
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/clone_alignment
-Lines: 1
-4096
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/devices
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/devices/loop22
-SymlinkTo: ../../../../devices/virtual/block/loop22
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/devices/loop23
-SymlinkTo: ../../../../devices/virtual/block/loop23
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/devices/loop24
-SymlinkTo: ../../../../devices/virtual/block/loop24
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/devices/loop25
-SymlinkTo: ../../../../devices/virtual/block/loop25
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/features
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/features/big_metadata
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/features/extended_iref
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/features/mixed_backref
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/features/raid56
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/features/skinny_metadata
-Lines: 1
-1
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/label
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/metadata_uuid
-Lines: 1
-7f07c59f-6136-449c-ab87-e1cf2328731b
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/nodesize
-Lines: 1
-16384
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/quota_override
-Lines: 1
-0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/btrfs/7f07c59f-6136-449c-ab87-e1cf2328731b/sectorsize
-Lines: 1
-4096
-Mode: 444
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/xfs
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/xfs/sda1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/xfs/sda1/stats
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/xfs/sda1/stats/stats
-Lines: 1
-extent_alloc 1 0 0 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/xfs/sdb1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/fs/xfs/sdb1/stats
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/fs/xfs/sdb1/stats/stats
-Lines: 1
-extent_alloc 2 0 0 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/fileio_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/fileio_1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/fileio_1/file_lio_1G
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/fileio_1/file_lio_1G/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/fileio_1/file_lio_1G/udev_path
-Lines: 1
-/home/iscsi/file_back_1G
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/iblock_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/iblock_0/block_lio_rbd1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/iblock_0/block_lio_rbd1/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/iblock_0/block_lio_rbd1/udev_path
-Lines: 1
-/dev/rbd1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/rbd_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/rbd_0/iscsi-images-demo
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/rbd_0/iscsi-images-demo/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/rbd_0/iscsi-images-demo/udev_path
-Lines: 1
-/dev/rbd/iscsi-images/demo
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/rd_mcp_119
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/core/rd_mcp_119/ramdisk_lio_1G
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/rd_mcp_119/ramdisk_lio_1G/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/core/rd_mcp_119/ramdisk_lio_1G/udev_path
-Lines: 0
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0/7f4a4eb56d
-SymlinkTo: ../../../../../../target/core/rd_mcp_119/ramdisk_lio_1G
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0/statistics
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/in_cmds
-Lines: 1
-204950
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/read_mbytes
-Lines: 1
-10325
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.8888bbbbddd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/write_mbytes
-Lines: 1
-40325
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0/795b7c7026
-SymlinkTo: ../../../../../../target/core/iblock_0/block_lio_rbd1
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0/statistics
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0/statistics/scsi_tgt_port
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/in_cmds
-Lines: 1
-104950
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/read_mbytes
-Lines: 1
-20095
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2003-01.org.linux-iscsi.osd1.x8664:sn.abcd1abcd2ab/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/write_mbytes
-Lines: 1
-71235
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0/fff5e16686
-SymlinkTo: ../../../../../../target/core/fileio_1/file_lio_1G
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0/statistics
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/in_cmds
-Lines: 1
-301950
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/read_mbytes
-Lines: 1
-10195
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:dev.rbd0/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/write_mbytes
-Lines: 1
-30195
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/enable
-Lines: 1
-1
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0/eba1edf893
-SymlinkTo: ../../../../../../target/core/rbd_0/iscsi-images-demo
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0/statistics
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Directory: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0/statistics/scsi_tgt_port
-Mode: 755
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/in_cmds
-Lines: 1
-1234
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/read_mbytes
-Lines: 1
-1504
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Path: fixtures/sys/kernel/config/target/iscsi/iqn.2016-11.org.linux-iscsi.igw.x86:sn.ramdemo/tpgt_1/lun/lun_0/statistics/scsi_tgt_port/write_mbytes
-Lines: 1
-4733
-Mode: 644
-# ttar - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
diff --git a/vendor/github.com/prometheus/procfs/go.mod b/vendor/github.com/prometheus/procfs/go.mod
deleted file mode 100644
index ba6681f521..0000000000
--- a/vendor/github.com/prometheus/procfs/go.mod
+++ /dev/null
@@ -1,9 +0,0 @@
-module github.com/prometheus/procfs
-
-go 1.13
-
-require (
-	github.com/google/go-cmp v0.5.4
-	golang.org/x/sync v0.0.0-20201207232520-09787c993a3a
-	golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c
-)
diff --git a/vendor/github.com/prometheus/procfs/go.sum b/vendor/github.com/prometheus/procfs/go.sum
deleted file mode 100644
index 7ceaf56b7d..0000000000
--- a/vendor/github.com/prometheus/procfs/go.sum
+++ /dev/null
@@ -1,8 +0,0 @@
-github.com/google/go-cmp v0.5.4 h1:L8R9j+yAqZuZjsqh/z+F1NCffTKKLShY6zXTItVIZ8M=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a h1:DcqTD9SDLc+1P/r1EmRBwnVsrOwW+kk2vWf9n+1sGhs=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c h1:VwygUrnw9jn88c4u8GD3rZQbqrP/tgas88tPUbBxQrk=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/vendor/github.com/prometheus/procfs/internal/fs/fs.go b/vendor/github.com/prometheus/procfs/internal/fs/fs.go
index 0040753b1c..3c18c7610e 100644
--- a/vendor/github.com/prometheus/procfs/internal/fs/fs.go
+++ b/vendor/github.com/prometheus/procfs/internal/fs/fs.go
@@ -26,7 +26,7 @@ const (
 	// DefaultSysMountPoint is the common mount point of the sys filesystem.
 	DefaultSysMountPoint = "/sys"
 
-	// DefaultConfigfsMountPoint is the common mount point of the configfs
+	// DefaultConfigfsMountPoint is the common mount point of the configfs.
 	DefaultConfigfsMountPoint = "/sys/kernel/config"
 )
 
diff --git a/vendor/github.com/prometheus/procfs/internal/util/parse.go b/vendor/github.com/prometheus/procfs/internal/util/parse.go
index 22cb07a6bb..b030951faf 100644
--- a/vendor/github.com/prometheus/procfs/internal/util/parse.go
+++ b/vendor/github.com/prometheus/procfs/internal/util/parse.go
@@ -14,7 +14,7 @@
 package util
 
 import (
-	"io/ioutil"
+	"os"
 	"strconv"
 	"strings"
 )
@@ -66,7 +66,7 @@ func ParsePInt64s(ss []string) ([]*int64, error) {
 
 // ReadUintFromFile reads a file and attempts to parse a uint64 from it.
 func ReadUintFromFile(path string) (uint64, error) {
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return 0, err
 	}
@@ -75,7 +75,7 @@ func ReadUintFromFile(path string) (uint64, error) {
 
 // ReadIntFromFile reads a file and attempts to parse a int64 from it.
 func ReadIntFromFile(path string) (int64, error) {
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return 0, err
 	}
diff --git a/vendor/github.com/prometheus/procfs/internal/util/readfile.go b/vendor/github.com/prometheus/procfs/internal/util/readfile.go
index 8051161b2a..71b7a70ebd 100644
--- a/vendor/github.com/prometheus/procfs/internal/util/readfile.go
+++ b/vendor/github.com/prometheus/procfs/internal/util/readfile.go
@@ -15,17 +15,16 @@ package util
 
 import (
 	"io"
-	"io/ioutil"
 	"os"
 )
 
-// ReadFileNoStat uses ioutil.ReadAll to read contents of entire file.
-// This is similar to ioutil.ReadFile but without the call to os.Stat, because
+// ReadFileNoStat uses io.ReadAll to read contents of entire file.
+// This is similar to os.ReadFile but without the call to os.Stat, because
 // many files in /proc and /sys report incorrect file sizes (either 0 or 4096).
-// Reads a max file size of 512kB.  For files larger than this, a scanner
+// Reads a max file size of 1024kB.  For files larger than this, a scanner
 // should be used.
 func ReadFileNoStat(filename string) ([]byte, error) {
-	const maxBufferSize = 1024 * 512
+	const maxBufferSize = 1024 * 1024
 
 	f, err := os.Open(filename)
 	if err != nil {
@@ -34,5 +33,5 @@ func ReadFileNoStat(filename string) ([]byte, error) {
 	defer f.Close()
 
 	reader := io.LimitReader(f, maxBufferSize)
-	return ioutil.ReadAll(reader)
+	return io.ReadAll(reader)
 }
diff --git a/vendor/github.com/prometheus/procfs/internal/util/sysreadfile.go b/vendor/github.com/prometheus/procfs/internal/util/sysreadfile.go
index c07de0b6c9..1ab875ceec 100644
--- a/vendor/github.com/prometheus/procfs/internal/util/sysreadfile.go
+++ b/vendor/github.com/prometheus/procfs/internal/util/sysreadfile.go
@@ -11,7 +11,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// +build linux,!appengine
+//go:build (linux || darwin) && !appengine
+// +build linux darwin
+// +build !appengine
 
 package util
 
@@ -21,7 +23,7 @@ import (
 	"syscall"
 )
 
-// SysReadFile is a simplified ioutil.ReadFile that invokes syscall.Read directly.
+// SysReadFile is a simplified os.ReadFile that invokes syscall.Read directly.
 // https://github.com/prometheus/node_exporter/pull/728/files
 //
 // Note that this function will not read files larger than 128 bytes.
@@ -33,7 +35,7 @@ func SysReadFile(file string) (string, error) {
 	defer f.Close()
 
 	// On some machines, hwmon drivers are broken and return EAGAIN.  This causes
-	// Go's ioutil.ReadFile implementation to poll forever.
+	// Go's os.ReadFile implementation to poll forever.
 	//
 	// Since we either want to read data or bail immediately, do the simplest
 	// possible read using syscall directly.
diff --git a/vendor/github.com/prometheus/procfs/internal/util/sysreadfile_compat.go b/vendor/github.com/prometheus/procfs/internal/util/sysreadfile_compat.go
index bd55b45377..1d86f5e63f 100644
--- a/vendor/github.com/prometheus/procfs/internal/util/sysreadfile_compat.go
+++ b/vendor/github.com/prometheus/procfs/internal/util/sysreadfile_compat.go
@@ -11,7 +11,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// +build linux,appengine !linux
+//go:build (linux && appengine) || (!linux && !darwin)
+// +build linux,appengine !linux,!darwin
 
 package util
 
diff --git a/vendor/github.com/prometheus/procfs/ipvs.go b/vendor/github.com/prometheus/procfs/ipvs.go
index 89e447746c..391c07957e 100644
--- a/vendor/github.com/prometheus/procfs/ipvs.go
+++ b/vendor/github.com/prometheus/procfs/ipvs.go
@@ -20,7 +20,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"strconv"
@@ -84,7 +83,7 @@ func parseIPVSStats(r io.Reader) (IPVSStats, error) {
 		stats       IPVSStats
 	)
 
-	statContent, err := ioutil.ReadAll(r)
+	statContent, err := io.ReadAll(r)
 	if err != nil {
 		return IPVSStats{}, err
 	}
diff --git a/vendor/github.com/prometheus/procfs/kernel_random.go b/vendor/github.com/prometheus/procfs/kernel_random.go
index da3a941d60..db88566bdf 100644
--- a/vendor/github.com/prometheus/procfs/kernel_random.go
+++ b/vendor/github.com/prometheus/procfs/kernel_random.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build !windows
 // +build !windows
 
 package procfs
diff --git a/vendor/github.com/prometheus/procfs/loadavg.go b/vendor/github.com/prometheus/procfs/loadavg.go
index 0cce190ec2..0096cafbdf 100644
--- a/vendor/github.com/prometheus/procfs/loadavg.go
+++ b/vendor/github.com/prometheus/procfs/loadavg.go
@@ -21,7 +21,7 @@ import (
 	"github.com/prometheus/procfs/internal/util"
 )
 
-// LoadAvg represents an entry in /proc/loadavg
+// LoadAvg represents an entry in /proc/loadavg.
 type LoadAvg struct {
 	Load1  float64
 	Load5  float64
diff --git a/vendor/github.com/prometheus/procfs/mdstat.go b/vendor/github.com/prometheus/procfs/mdstat.go
index 4c4493bfa5..a95c889cb9 100644
--- a/vendor/github.com/prometheus/procfs/mdstat.go
+++ b/vendor/github.com/prometheus/procfs/mdstat.go
@@ -15,16 +15,19 @@ package procfs
 
 import (
 	"fmt"
-	"io/ioutil"
+	"os"
 	"regexp"
 	"strconv"
 	"strings"
 )
 
 var (
-	statusLineRE      = regexp.MustCompile(`(\d+) blocks .*\[(\d+)/(\d+)\] \[[U_]+\]`)
-	recoveryLineRE    = regexp.MustCompile(`\((\d+)/\d+\)`)
-	componentDeviceRE = regexp.MustCompile(`(.*)\[\d+\]`)
+	statusLineRE         = regexp.MustCompile(`(\d+) blocks .*\[(\d+)/(\d+)\] \[([U_]+)\]`)
+	recoveryLineBlocksRE = regexp.MustCompile(`\((\d+)/\d+\)`)
+	recoveryLinePctRE    = regexp.MustCompile(`= (.+)%`)
+	recoveryLineFinishRE = regexp.MustCompile(`finish=(.+)min`)
+	recoveryLineSpeedRE  = regexp.MustCompile(`speed=(.+)[A-Z]`)
+	componentDeviceRE    = regexp.MustCompile(`(.*)\[\d+\]`)
 )
 
 // MDStat holds info parsed from /proc/mdstat.
@@ -39,12 +42,20 @@ type MDStat struct {
 	DisksTotal int64
 	// Number of failed disks.
 	DisksFailed int64
+	// Number of "down" disks. (the _ indicator in the status line)
+	DisksDown int64
 	// Spare disks in the device.
 	DisksSpare int64
 	// Number of blocks the device holds.
 	BlocksTotal int64
 	// Number of blocks on the device that are in sync.
 	BlocksSynced int64
+	// progress percentage of current sync
+	BlocksSyncedPct float64
+	// estimated finishing time for current sync (in minutes)
+	BlocksSyncedFinishTime float64
+	// current sync speed (in Kilobytes/sec)
+	BlocksSyncedSpeed float64
 	// Name of md component devices
 	Devices []string
 }
@@ -53,7 +64,7 @@ type MDStat struct {
 // structs containing the relevant info.  More information available here:
 // https://raid.wiki.kernel.org/index.php/Mdstat
 func (fs FS) MDStat() ([]MDStat, error) {
-	data, err := ioutil.ReadFile(fs.proc.Path("mdstat"))
+	data, err := os.ReadFile(fs.proc.Path("mdstat"))
 	if err != nil {
 		return nil, err
 	}
@@ -91,7 +102,7 @@ func parseMDStat(mdStatData []byte) ([]MDStat, error) {
 		// Failed disks have the suffix (F) & Spare disks have the suffix (S).
 		fail := int64(strings.Count(line, "(F)"))
 		spare := int64(strings.Count(line, "(S)"))
-		active, total, size, err := evalStatusLine(lines[i], lines[i+1])
+		active, total, down, size, err := evalStatusLine(lines[i], lines[i+1])
 
 		if err != nil {
 			return nil, fmt.Errorf("error parsing md device lines: %w", err)
@@ -105,6 +116,9 @@ func parseMDStat(mdStatData []byte) ([]MDStat, error) {
 		// If device is syncing at the moment, get the number of currently
 		// synced bytes, otherwise that number equals the size of the device.
 		syncedBlocks := size
+		speed := float64(0)
+		finish := float64(0)
+		pct := float64(0)
 		recovering := strings.Contains(lines[syncLineIdx], "recovery")
 		resyncing := strings.Contains(lines[syncLineIdx], "resync")
 		checking := strings.Contains(lines[syncLineIdx], "check")
@@ -124,7 +138,7 @@ func parseMDStat(mdStatData []byte) ([]MDStat, error) {
 				strings.Contains(lines[syncLineIdx], "DELAYED") {
 				syncedBlocks = 0
 			} else {
-				syncedBlocks, err = evalRecoveryLine(lines[syncLineIdx])
+				syncedBlocks, pct, finish, speed, err = evalRecoveryLine(lines[syncLineIdx])
 				if err != nil {
 					return nil, fmt.Errorf("error parsing sync line in md device %q: %w", mdName, err)
 				}
@@ -132,69 +146,108 @@ func parseMDStat(mdStatData []byte) ([]MDStat, error) {
 		}
 
 		mdStats = append(mdStats, MDStat{
-			Name:          mdName,
-			ActivityState: state,
-			DisksActive:   active,
-			DisksFailed:   fail,
-			DisksSpare:    spare,
-			DisksTotal:    total,
-			BlocksTotal:   size,
-			BlocksSynced:  syncedBlocks,
-			Devices:       evalComponentDevices(deviceFields),
+			Name:                   mdName,
+			ActivityState:          state,
+			DisksActive:            active,
+			DisksFailed:            fail,
+			DisksDown:              down,
+			DisksSpare:             spare,
+			DisksTotal:             total,
+			BlocksTotal:            size,
+			BlocksSynced:           syncedBlocks,
+			BlocksSyncedPct:        pct,
+			BlocksSyncedFinishTime: finish,
+			BlocksSyncedSpeed:      speed,
+			Devices:                evalComponentDevices(deviceFields),
 		})
 	}
 
 	return mdStats, nil
 }
 
-func evalStatusLine(deviceLine, statusLine string) (active, total, size int64, err error) {
+func evalStatusLine(deviceLine, statusLine string) (active, total, down, size int64, err error) {
+	statusFields := strings.Fields(statusLine)
+	if len(statusFields) < 1 {
+		return 0, 0, 0, 0, fmt.Errorf("unexpected statusLine %q", statusLine)
+	}
 
-	sizeStr := strings.Fields(statusLine)[0]
+	sizeStr := statusFields[0]
 	size, err = strconv.ParseInt(sizeStr, 10, 64)
 	if err != nil {
-		return 0, 0, 0, fmt.Errorf("unexpected statusLine %q: %w", statusLine, err)
+		return 0, 0, 0, 0, fmt.Errorf("unexpected statusLine %q: %w", statusLine, err)
 	}
 
 	if strings.Contains(deviceLine, "raid0") || strings.Contains(deviceLine, "linear") {
 		// In the device deviceLine, only disks have a number associated with them in [].
 		total = int64(strings.Count(deviceLine, "["))
-		return total, total, size, nil
+		return total, total, 0, size, nil
 	}
 
 	if strings.Contains(deviceLine, "inactive") {
-		return 0, 0, size, nil
+		return 0, 0, 0, size, nil
 	}
 
 	matches := statusLineRE.FindStringSubmatch(statusLine)
-	if len(matches) != 4 {
-		return 0, 0, 0, fmt.Errorf("couldn't find all the substring matches: %s", statusLine)
+	if len(matches) != 5 {
+		return 0, 0, 0, 0, fmt.Errorf("couldn't find all the substring matches: %s", statusLine)
 	}
 
 	total, err = strconv.ParseInt(matches[2], 10, 64)
 	if err != nil {
-		return 0, 0, 0, fmt.Errorf("unexpected statusLine %q: %w", statusLine, err)
+		return 0, 0, 0, 0, fmt.Errorf("unexpected statusLine %q: %w", statusLine, err)
 	}
 
 	active, err = strconv.ParseInt(matches[3], 10, 64)
 	if err != nil {
-		return 0, 0, 0, fmt.Errorf("unexpected statusLine %q: %w", statusLine, err)
+		return 0, 0, 0, 0, fmt.Errorf("unexpected statusLine %q: %w", statusLine, err)
 	}
+	down = int64(strings.Count(matches[4], "_"))
 
-	return active, total, size, nil
+	return active, total, down, size, nil
 }
 
-func evalRecoveryLine(recoveryLine string) (syncedBlocks int64, err error) {
-	matches := recoveryLineRE.FindStringSubmatch(recoveryLine)
+func evalRecoveryLine(recoveryLine string) (syncedBlocks int64, pct float64, finish float64, speed float64, err error) {
+	matches := recoveryLineBlocksRE.FindStringSubmatch(recoveryLine)
 	if len(matches) != 2 {
-		return 0, fmt.Errorf("unexpected recoveryLine: %s", recoveryLine)
+		return 0, 0, 0, 0, fmt.Errorf("unexpected recoveryLine: %s", recoveryLine)
 	}
 
 	syncedBlocks, err = strconv.ParseInt(matches[1], 10, 64)
 	if err != nil {
-		return 0, fmt.Errorf("error parsing int from recoveryLine %q: %w", recoveryLine, err)
+		return 0, 0, 0, 0, fmt.Errorf("error parsing int from recoveryLine %q: %w", recoveryLine, err)
+	}
+
+	// Get percentage complete
+	matches = recoveryLinePctRE.FindStringSubmatch(recoveryLine)
+	if len(matches) != 2 {
+		return syncedBlocks, 0, 0, 0, fmt.Errorf("unexpected recoveryLine matching percentage: %s", recoveryLine)
+	}
+	pct, err = strconv.ParseFloat(strings.TrimSpace(matches[1]), 64)
+	if err != nil {
+		return syncedBlocks, 0, 0, 0, fmt.Errorf("error parsing float from recoveryLine %q: %w", recoveryLine, err)
+	}
+
+	// Get time expected left to complete
+	matches = recoveryLineFinishRE.FindStringSubmatch(recoveryLine)
+	if len(matches) != 2 {
+		return syncedBlocks, pct, 0, 0, fmt.Errorf("unexpected recoveryLine matching est. finish time: %s", recoveryLine)
+	}
+	finish, err = strconv.ParseFloat(matches[1], 64)
+	if err != nil {
+		return syncedBlocks, pct, 0, 0, fmt.Errorf("error parsing float from recoveryLine %q: %w", recoveryLine, err)
+	}
+
+	// Get recovery speed
+	matches = recoveryLineSpeedRE.FindStringSubmatch(recoveryLine)
+	if len(matches) != 2 {
+		return syncedBlocks, pct, finish, 0, fmt.Errorf("unexpected recoveryLine matching speed: %s", recoveryLine)
+	}
+	speed, err = strconv.ParseFloat(matches[1], 64)
+	if err != nil {
+		return syncedBlocks, pct, finish, 0, fmt.Errorf("error parsing float from recoveryLine %q: %w", recoveryLine, err)
 	}
 
-	return syncedBlocks, nil
+	return syncedBlocks, pct, finish, speed, nil
 }
 
 func evalComponentDevices(deviceFields []string) []string {
diff --git a/vendor/github.com/prometheus/procfs/mountstats.go b/vendor/github.com/prometheus/procfs/mountstats.go
index f7a828bb1d..0c482c18cc 100644
--- a/vendor/github.com/prometheus/procfs/mountstats.go
+++ b/vendor/github.com/prometheus/procfs/mountstats.go
@@ -284,7 +284,8 @@ func parseMountStats(r io.Reader) ([]*Mount, error) {
 }
 
 // parseMount parses an entry in /proc/[pid]/mountstats in the format:
-//   device [device] mounted on [mount] with fstype [type]
+//
+//	device [device] mounted on [mount] with fstype [type]
 func parseMount(ss []string) (*Mount, error) {
 	if len(ss) < deviceEntryLen {
 		return nil, fmt.Errorf("invalid device entry: %v", ss)
diff --git a/vendor/github.com/prometheus/procfs/net_conntrackstat.go b/vendor/github.com/prometheus/procfs/net_conntrackstat.go
index 9964a3600b..8300daca05 100644
--- a/vendor/github.com/prometheus/procfs/net_conntrackstat.go
+++ b/vendor/github.com/prometheus/procfs/net_conntrackstat.go
@@ -25,7 +25,7 @@ import (
 )
 
 // A ConntrackStatEntry represents one line from net/stat/nf_conntrack
-// and contains netfilter conntrack statistics at one CPU core
+// and contains netfilter conntrack statistics at one CPU core.
 type ConntrackStatEntry struct {
 	Entries       uint64
 	Found         uint64
@@ -38,12 +38,12 @@ type ConntrackStatEntry struct {
 	SearchRestart uint64
 }
 
-// ConntrackStat retrieves netfilter's conntrack statistics, split by CPU cores
+// ConntrackStat retrieves netfilter's conntrack statistics, split by CPU cores.
 func (fs FS) ConntrackStat() ([]ConntrackStatEntry, error) {
 	return readConntrackStat(fs.proc.Path("net", "stat", "nf_conntrack"))
 }
 
-// Parses a slice of ConntrackStatEntries from the given filepath
+// Parses a slice of ConntrackStatEntries from the given filepath.
 func readConntrackStat(path string) ([]ConntrackStatEntry, error) {
 	// This file is small and can be read with one syscall.
 	b, err := util.ReadFileNoStat(path)
@@ -61,7 +61,7 @@ func readConntrackStat(path string) ([]ConntrackStatEntry, error) {
 	return stat, nil
 }
 
-// Reads the contents of a conntrack statistics file and parses a slice of ConntrackStatEntries
+// Reads the contents of a conntrack statistics file and parses a slice of ConntrackStatEntries.
 func parseConntrackStat(r io.Reader) ([]ConntrackStatEntry, error) {
 	var entries []ConntrackStatEntry
 
@@ -79,7 +79,7 @@ func parseConntrackStat(r io.Reader) ([]ConntrackStatEntry, error) {
 	return entries, nil
 }
 
-// Parses a ConntrackStatEntry from given array of fields
+// Parses a ConntrackStatEntry from given array of fields.
 func parseConntrackStatEntry(fields []string) (*ConntrackStatEntry, error) {
 	if len(fields) != 17 {
 		return nil, fmt.Errorf("invalid conntrackstat entry, missing fields")
@@ -143,7 +143,7 @@ func parseConntrackStatEntry(fields []string) (*ConntrackStatEntry, error) {
 	return entry, nil
 }
 
-// Parses a uint64 from given hex in string
+// Parses a uint64 from given hex in string.
 func parseConntrackStatField(field string) (uint64, error) {
 	val, err := strconv.ParseUint(field, 16, 64)
 	if err != nil {
diff --git a/vendor/github.com/prometheus/procfs/net_dev.go b/vendor/github.com/prometheus/procfs/net_dev.go
index 47a710befb..e66208aa05 100644
--- a/vendor/github.com/prometheus/procfs/net_dev.go
+++ b/vendor/github.com/prometheus/procfs/net_dev.go
@@ -87,17 +87,17 @@ func newNetDev(file string) (NetDev, error) {
 // parseLine parses a single line from the /proc/net/dev file. Header lines
 // must be filtered prior to calling this method.
 func (netDev NetDev) parseLine(rawLine string) (*NetDevLine, error) {
-	parts := strings.SplitN(rawLine, ":", 2)
-	if len(parts) != 2 {
+	idx := strings.LastIndex(rawLine, ":")
+	if idx == -1 {
 		return nil, errors.New("invalid net/dev line, missing colon")
 	}
-	fields := strings.Fields(strings.TrimSpace(parts[1]))
+	fields := strings.Fields(strings.TrimSpace(rawLine[idx+1:]))
 
 	var err error
 	line := &NetDevLine{}
 
 	// Interface Name
-	line.Name = strings.TrimSpace(parts[0])
+	line.Name = strings.TrimSpace(rawLine[:idx])
 	if line.Name == "" {
 		return nil, errors.New("invalid net/dev line, empty interface name")
 	}
diff --git a/vendor/github.com/prometheus/procfs/net_ip_socket.go b/vendor/github.com/prometheus/procfs/net_ip_socket.go
index ac01dd8475..7fd57d7f46 100644
--- a/vendor/github.com/prometheus/procfs/net_ip_socket.go
+++ b/vendor/github.com/prometheus/procfs/net_ip_socket.go
@@ -34,7 +34,7 @@ const (
 	readLimit = 4294967296 // Byte -> 4 GiB
 )
 
-// this contains generic data structures for both udp and tcp sockets
+// This contains generic data structures for both udp and tcp sockets.
 type (
 	// NetIPSocket represents the contents of /proc/net/{t,u}dp{,6} file without the header.
 	NetIPSocket []*netIPSocketLine
@@ -65,6 +65,7 @@ type (
 		TxQueue   uint64
 		RxQueue   uint64
 		UID       uint64
+		Inode     uint64
 	}
 )
 
@@ -150,9 +151,9 @@ func parseIP(hexIP string) (net.IP, error) {
 // parseNetIPSocketLine parses a single line, represented by a list of fields.
 func parseNetIPSocketLine(fields []string) (*netIPSocketLine, error) {
 	line := &netIPSocketLine{}
-	if len(fields) < 8 {
+	if len(fields) < 10 {
 		return nil, fmt.Errorf(
-			"cannot parse net socket line as it has less then 8 columns %q",
+			"cannot parse net socket line as it has less then 10 columns %q",
 			strings.Join(fields, " "),
 		)
 	}
@@ -216,5 +217,10 @@ func parseNetIPSocketLine(fields []string) (*netIPSocketLine, error) {
 		return nil, fmt.Errorf("cannot parse uid value in socket line: %w", err)
 	}
 
+	// inode
+	if line.Inode, err = strconv.ParseUint(fields[9], 0, 64); err != nil {
+		return nil, fmt.Errorf("cannot parse inode value in socket line: %w", err)
+	}
+
 	return line, nil
 }
diff --git a/vendor/github.com/prometheus/procfs/net_protocols.go b/vendor/github.com/prometheus/procfs/net_protocols.go
index 8c6de3791b..374b6f73f8 100644
--- a/vendor/github.com/prometheus/procfs/net_protocols.go
+++ b/vendor/github.com/prometheus/procfs/net_protocols.go
@@ -23,7 +23,7 @@ import (
 	"github.com/prometheus/procfs/internal/util"
 )
 
-// NetProtocolStats stores the contents from /proc/net/protocols
+// NetProtocolStats stores the contents from /proc/net/protocols.
 type NetProtocolStats map[string]NetProtocolStatLine
 
 // NetProtocolStatLine contains a single line parsed from /proc/net/protocols. We
@@ -41,7 +41,7 @@ type NetProtocolStatLine struct {
 	Capabilities NetProtocolCapabilities
 }
 
-// NetProtocolCapabilities contains a list of capabilities for each protocol
+// NetProtocolCapabilities contains a list of capabilities for each protocol.
 type NetProtocolCapabilities struct {
 	Close               bool // 8
 	Connect             bool // 9
diff --git a/vendor/github.com/prometheus/procfs/net_softnet.go b/vendor/github.com/prometheus/procfs/net_softnet.go
index 46f12c61d3..06b7b8f216 100644
--- a/vendor/github.com/prometheus/procfs/net_softnet.go
+++ b/vendor/github.com/prometheus/procfs/net_softnet.go
@@ -27,17 +27,30 @@ import (
 // For the proc file format details,
 // See:
 // * Linux 2.6.23 https://elixir.bootlin.com/linux/v2.6.23/source/net/core/dev.c#L2343
-// * Linux 4.17 https://elixir.bootlin.com/linux/v4.17/source/net/core/net-procfs.c#L162
-// and https://elixir.bootlin.com/linux/v4.17/source/include/linux/netdevice.h#L2810.
+// * Linux 2.6.39 https://elixir.bootlin.com/linux/v2.6.39/source/net/core/dev.c#L4086
+// * Linux 4.18 https://elixir.bootlin.com/linux/v4.18/source/net/core/net-procfs.c#L162
+// * Linux 5.14 https://elixir.bootlin.com/linux/v5.14/source/net/core/net-procfs.c#L169
 
-// SoftnetStat contains a single row of data from /proc/net/softnet_stat
+// SoftnetStat contains a single row of data from /proc/net/softnet_stat.
 type SoftnetStat struct {
-	// Number of processed packets
+	// Number of processed packets.
 	Processed uint32
-	// Number of dropped packets
+	// Number of dropped packets.
 	Dropped uint32
-	// Number of times processing packets ran out of quota
+	// Number of times processing packets ran out of quota.
 	TimeSqueezed uint32
+	// Number of collision occur while obtaining device lock while transmitting.
+	CPUCollision uint32
+	// Number of times cpu woken up received_rps.
+	ReceivedRps uint32
+	// number of times flow limit has been reached.
+	FlowLimitCount uint32
+	// Softnet backlog status.
+	SoftnetBacklogLen uint32
+	// CPU id owning this softnet_data.
+	Index uint32
+	// softnet_data's Width.
+	Width int
 }
 
 var softNetProcFile = "net/softnet_stat"
@@ -66,22 +79,57 @@ func parseSoftnet(r io.Reader) ([]SoftnetStat, error) {
 	for s.Scan() {
 		columns := strings.Fields(s.Text())
 		width := len(columns)
+		softnetStat := SoftnetStat{}
 
 		if width < minColumns {
 			return nil, fmt.Errorf("%d columns were detected, but at least %d were expected", width, minColumns)
 		}
 
-		// We only parse the first three columns at the moment.
-		us, err := parseHexUint32s(columns[0:3])
-		if err != nil {
-			return nil, err
+		// Linux 2.6.23 https://elixir.bootlin.com/linux/v2.6.23/source/net/core/dev.c#L2347
+		if width >= minColumns {
+			us, err := parseHexUint32s(columns[0:9])
+			if err != nil {
+				return nil, err
+			}
+
+			softnetStat.Processed = us[0]
+			softnetStat.Dropped = us[1]
+			softnetStat.TimeSqueezed = us[2]
+			softnetStat.CPUCollision = us[8]
+		}
+
+		// Linux 2.6.39 https://elixir.bootlin.com/linux/v2.6.39/source/net/core/dev.c#L4086
+		if width >= 10 {
+			us, err := parseHexUint32s(columns[9:10])
+			if err != nil {
+				return nil, err
+			}
+
+			softnetStat.ReceivedRps = us[0]
 		}
 
-		stats = append(stats, SoftnetStat{
-			Processed:    us[0],
-			Dropped:      us[1],
-			TimeSqueezed: us[2],
-		})
+		// Linux 4.18 https://elixir.bootlin.com/linux/v4.18/source/net/core/net-procfs.c#L162
+		if width >= 11 {
+			us, err := parseHexUint32s(columns[10:11])
+			if err != nil {
+				return nil, err
+			}
+
+			softnetStat.FlowLimitCount = us[0]
+		}
+
+		// Linux 5.14 https://elixir.bootlin.com/linux/v5.14/source/net/core/net-procfs.c#L169
+		if width >= 13 {
+			us, err := parseHexUint32s(columns[11:13])
+			if err != nil {
+				return nil, err
+			}
+
+			softnetStat.SoftnetBacklogLen = us[0]
+			softnetStat.Index = us[1]
+		}
+		softnetStat.Width = width
+		stats = append(stats, softnetStat)
 	}
 
 	return stats, nil
diff --git a/vendor/github.com/prometheus/procfs/net_xfrm.go b/vendor/github.com/prometheus/procfs/net_xfrm.go
new file mode 100644
index 0000000000..f9d9d243db
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/net_xfrm.go
@@ -0,0 +1,189 @@
+// Copyright 2017 Prometheus Team
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// XfrmStat models the contents of /proc/net/xfrm_stat.
+type XfrmStat struct {
+	// All errors which are not matched by other
+	XfrmInError int
+	// No buffer is left
+	XfrmInBufferError int
+	// Header Error
+	XfrmInHdrError int
+	// No state found
+	// i.e. either inbound SPI, address, or IPSEC protocol at SA is wrong
+	XfrmInNoStates int
+	// Transformation protocol specific error
+	// e.g. SA Key is wrong
+	XfrmInStateProtoError int
+	// Transformation mode specific error
+	XfrmInStateModeError int
+	// Sequence error
+	// e.g. sequence number is out of window
+	XfrmInStateSeqError int
+	// State is expired
+	XfrmInStateExpired int
+	// State has mismatch option
+	// e.g. UDP encapsulation type is mismatched
+	XfrmInStateMismatch int
+	// State is invalid
+	XfrmInStateInvalid int
+	// No matching template for states
+	// e.g. Inbound SAs are correct but SP rule is wrong
+	XfrmInTmplMismatch int
+	// No policy is found for states
+	// e.g. Inbound SAs are correct but no SP is found
+	XfrmInNoPols int
+	// Policy discards
+	XfrmInPolBlock int
+	// Policy error
+	XfrmInPolError int
+	// All errors which are not matched by others
+	XfrmOutError int
+	// Bundle generation error
+	XfrmOutBundleGenError int
+	// Bundle check error
+	XfrmOutBundleCheckError int
+	// No state was found
+	XfrmOutNoStates int
+	// Transformation protocol specific error
+	XfrmOutStateProtoError int
+	// Transportation mode specific error
+	XfrmOutStateModeError int
+	// Sequence error
+	// i.e sequence number overflow
+	XfrmOutStateSeqError int
+	// State is expired
+	XfrmOutStateExpired int
+	// Policy discads
+	XfrmOutPolBlock int
+	// Policy is dead
+	XfrmOutPolDead int
+	// Policy Error
+	XfrmOutPolError int
+	// Forward routing of a packet is not allowed
+	XfrmFwdHdrError int
+	// State is invalid, perhaps expired
+	XfrmOutStateInvalid int
+	// State hasn’t been fully acquired before use
+	XfrmAcquireError int
+}
+
+// NewXfrmStat reads the xfrm_stat statistics.
+func NewXfrmStat() (XfrmStat, error) {
+	fs, err := NewFS(DefaultMountPoint)
+	if err != nil {
+		return XfrmStat{}, err
+	}
+
+	return fs.NewXfrmStat()
+}
+
+// NewXfrmStat reads the xfrm_stat statistics from the 'proc' filesystem.
+func (fs FS) NewXfrmStat() (XfrmStat, error) {
+	file, err := os.Open(fs.proc.Path("net/xfrm_stat"))
+	if err != nil {
+		return XfrmStat{}, err
+	}
+	defer file.Close()
+
+	var (
+		x = XfrmStat{}
+		s = bufio.NewScanner(file)
+	)
+
+	for s.Scan() {
+		fields := strings.Fields(s.Text())
+
+		if len(fields) != 2 {
+			return XfrmStat{}, fmt.Errorf("couldn't parse %q line %q", file.Name(), s.Text())
+		}
+
+		name := fields[0]
+		value, err := strconv.Atoi(fields[1])
+		if err != nil {
+			return XfrmStat{}, err
+		}
+
+		switch name {
+		case "XfrmInError":
+			x.XfrmInError = value
+		case "XfrmInBufferError":
+			x.XfrmInBufferError = value
+		case "XfrmInHdrError":
+			x.XfrmInHdrError = value
+		case "XfrmInNoStates":
+			x.XfrmInNoStates = value
+		case "XfrmInStateProtoError":
+			x.XfrmInStateProtoError = value
+		case "XfrmInStateModeError":
+			x.XfrmInStateModeError = value
+		case "XfrmInStateSeqError":
+			x.XfrmInStateSeqError = value
+		case "XfrmInStateExpired":
+			x.XfrmInStateExpired = value
+		case "XfrmInStateInvalid":
+			x.XfrmInStateInvalid = value
+		case "XfrmInTmplMismatch":
+			x.XfrmInTmplMismatch = value
+		case "XfrmInNoPols":
+			x.XfrmInNoPols = value
+		case "XfrmInPolBlock":
+			x.XfrmInPolBlock = value
+		case "XfrmInPolError":
+			x.XfrmInPolError = value
+		case "XfrmOutError":
+			x.XfrmOutError = value
+		case "XfrmInStateMismatch":
+			x.XfrmInStateMismatch = value
+		case "XfrmOutBundleGenError":
+			x.XfrmOutBundleGenError = value
+		case "XfrmOutBundleCheckError":
+			x.XfrmOutBundleCheckError = value
+		case "XfrmOutNoStates":
+			x.XfrmOutNoStates = value
+		case "XfrmOutStateProtoError":
+			x.XfrmOutStateProtoError = value
+		case "XfrmOutStateModeError":
+			x.XfrmOutStateModeError = value
+		case "XfrmOutStateSeqError":
+			x.XfrmOutStateSeqError = value
+		case "XfrmOutStateExpired":
+			x.XfrmOutStateExpired = value
+		case "XfrmOutPolBlock":
+			x.XfrmOutPolBlock = value
+		case "XfrmOutPolDead":
+			x.XfrmOutPolDead = value
+		case "XfrmOutPolError":
+			x.XfrmOutPolError = value
+		case "XfrmFwdHdrError":
+			x.XfrmFwdHdrError = value
+		case "XfrmOutStateInvalid":
+			x.XfrmOutStateInvalid = value
+		case "XfrmAcquireError":
+			x.XfrmAcquireError = value
+		}
+
+	}
+
+	return x, s.Err()
+}
diff --git a/vendor/github.com/prometheus/procfs/netstat.go b/vendor/github.com/prometheus/procfs/netstat.go
new file mode 100644
index 0000000000..5cc40aef55
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/netstat.go
@@ -0,0 +1,85 @@
+// Copyright 2020 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+// NetStat contains statistics for all the counters from one file.
+type NetStat struct {
+	Stats    map[string][]uint64
+	Filename string
+}
+
+// NetStat retrieves stats from `/proc/net/stat/`.
+func (fs FS) NetStat() ([]NetStat, error) {
+	statFiles, err := filepath.Glob(fs.proc.Path("net/stat/*"))
+	if err != nil {
+		return nil, err
+	}
+
+	var netStatsTotal []NetStat
+
+	for _, filePath := range statFiles {
+		file, err := os.Open(filePath)
+		if err != nil {
+			return nil, err
+		}
+
+		procNetstat, err := parseNetstat(file)
+		if err != nil {
+			return nil, err
+		}
+		procNetstat.Filename = filepath.Base(filePath)
+
+		netStatsTotal = append(netStatsTotal, procNetstat)
+	}
+	return netStatsTotal, nil
+}
+
+// parseNetstat parses the metrics from `/proc/net/stat/` file
+// and returns a NetStat structure.
+func parseNetstat(r io.Reader) (NetStat, error) {
+	var (
+		scanner = bufio.NewScanner(r)
+		netStat = NetStat{
+			Stats: make(map[string][]uint64),
+		}
+	)
+
+	scanner.Scan()
+
+	// First string is always a header for stats
+	var headers []string
+	headers = append(headers, strings.Fields(scanner.Text())...)
+
+	// Other strings represent per-CPU counters
+	for scanner.Scan() {
+		for num, counter := range strings.Fields(scanner.Text()) {
+			value, err := strconv.ParseUint(counter, 16, 64)
+			if err != nil {
+				return NetStat{}, err
+			}
+			netStat.Stats[headers[num]] = append(netStat.Stats[headers[num]], value)
+		}
+	}
+
+	return netStat, nil
+}
diff --git a/vendor/github.com/prometheus/procfs/proc.go b/vendor/github.com/prometheus/procfs/proc.go
index 28f696803f..c30223af72 100644
--- a/vendor/github.com/prometheus/procfs/proc.go
+++ b/vendor/github.com/prometheus/procfs/proc.go
@@ -16,7 +16,7 @@ package procfs
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"strconv"
 	"strings"
@@ -82,7 +82,7 @@ func (fs FS) Self() (Proc, error) {
 
 // NewProc returns a process for the given pid.
 //
-// Deprecated: use fs.Proc() instead
+// Deprecated: Use fs.Proc() instead.
 func (fs FS) NewProc(pid int) (Proc, error) {
 	return fs.Proc(pid)
 }
@@ -142,7 +142,7 @@ func (p Proc) Wchan() (string, error) {
 	}
 	defer f.Close()
 
-	data, err := ioutil.ReadAll(f)
+	data, err := io.ReadAll(f)
 	if err != nil {
 		return "", err
 	}
@@ -185,7 +185,7 @@ func (p Proc) Cwd() (string, error) {
 	return wd, err
 }
 
-// RootDir returns the absolute path to the process's root directory (as set by chroot)
+// RootDir returns the absolute path to the process's root directory (as set by chroot).
 func (p Proc) RootDir() (string, error) {
 	rdir, err := os.Readlink(p.path("root"))
 	if os.IsNotExist(err) {
@@ -311,7 +311,7 @@ func (p Proc) FileDescriptorsInfo() (ProcFDInfos, error) {
 
 // Schedstat returns task scheduling information for the process.
 func (p Proc) Schedstat() (ProcSchedstat, error) {
-	contents, err := ioutil.ReadFile(p.path("schedstat"))
+	contents, err := os.ReadFile(p.path("schedstat"))
 	if err != nil {
 		return ProcSchedstat{}, err
 	}
diff --git a/vendor/github.com/prometheus/procfs/proc_cgroup.go b/vendor/github.com/prometheus/procfs/proc_cgroup.go
index 0094a13c05..ea83a75ffc 100644
--- a/vendor/github.com/prometheus/procfs/proc_cgroup.go
+++ b/vendor/github.com/prometheus/procfs/proc_cgroup.go
@@ -23,7 +23,7 @@ import (
 	"github.com/prometheus/procfs/internal/util"
 )
 
-// Cgroup models one line from /proc/[pid]/cgroup. Each Cgroup struct describes the the placement of a PID inside a
+// Cgroup models one line from /proc/[pid]/cgroup. Each Cgroup struct describes the placement of a PID inside a
 // specific control hierarchy. The kernel has two cgroup APIs, v1 and v2. v1 has one hierarchy per available resource
 // controller, while v2 has one unified hierarchy shared by all controllers. Regardless of v1 or v2, all hierarchies
 // contain all running processes, so the question answerable with a Cgroup struct is 'where is this process in
@@ -45,7 +45,7 @@ type Cgroup struct {
 }
 
 // parseCgroupString parses each line of the /proc/[pid]/cgroup file
-// Line format is hierarchyID:[controller1,controller2]:path
+// Line format is hierarchyID:[controller1,controller2]:path.
 func parseCgroupString(cgroupStr string) (*Cgroup, error) {
 	var err error
 
@@ -69,7 +69,7 @@ func parseCgroupString(cgroupStr string) (*Cgroup, error) {
 	return cgroup, nil
 }
 
-// parseCgroups reads each line of the /proc/[pid]/cgroup file
+// parseCgroups reads each line of the /proc/[pid]/cgroup file.
 func parseCgroups(data []byte) ([]Cgroup, error) {
 	var cgroups []Cgroup
 	scanner := bufio.NewScanner(bytes.NewReader(data))
@@ -88,9 +88,9 @@ func parseCgroups(data []byte) ([]Cgroup, error) {
 
 // Cgroups reads from /proc/<pid>/cgroups and returns a []*Cgroup struct locating this PID in each process
 // control hierarchy running on this system. On every system (v1 and v2), all hierarchies contain all processes,
-// so the len of the returned struct is equal to the number of active hierarchies on this system
+// so the len of the returned struct is equal to the number of active hierarchies on this system.
 func (p Proc) Cgroups() ([]Cgroup, error) {
-	data, err := util.ReadFileNoStat(fmt.Sprintf("/proc/%d/cgroup", p.PID))
+	data, err := util.ReadFileNoStat(p.path("cgroup"))
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/prometheus/procfs/proc_cgroups.go b/vendor/github.com/prometheus/procfs/proc_cgroups.go
new file mode 100644
index 0000000000..24d4dce9cf
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/proc_cgroups.go
@@ -0,0 +1,98 @@
+// Copyright 2021 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// CgroupSummary models one line from /proc/cgroups.
+// This file contains information about the controllers that are compiled into the kernel.
+//
+// Also see http://man7.org/linux/man-pages/man7/cgroups.7.html
+type CgroupSummary struct {
+	// The name of the controller. controller is also known as subsystem.
+	SubsysName string
+	// The unique ID of the cgroup hierarchy on which this controller is mounted.
+	Hierarchy int
+	// The number of control groups in this hierarchy using this controller.
+	Cgroups int
+	// This field contains the value 1 if this controller is enabled, or 0 if it has been disabled
+	Enabled int
+}
+
+// parseCgroupSummary parses each line of the /proc/cgroup file
+// Line format is `subsys_name	hierarchy	num_cgroups	enabled`.
+func parseCgroupSummaryString(CgroupSummaryStr string) (*CgroupSummary, error) {
+	var err error
+
+	fields := strings.Fields(CgroupSummaryStr)
+	// require at least 4 fields
+	if len(fields) < 4 {
+		return nil, fmt.Errorf("at least 4 fields required, found %d fields in cgroup info string: %s", len(fields), CgroupSummaryStr)
+	}
+
+	CgroupSummary := &CgroupSummary{
+		SubsysName: fields[0],
+	}
+	CgroupSummary.Hierarchy, err = strconv.Atoi(fields[1])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse hierarchy ID")
+	}
+	CgroupSummary.Cgroups, err = strconv.Atoi(fields[2])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse Cgroup Num")
+	}
+	CgroupSummary.Enabled, err = strconv.Atoi(fields[3])
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse Enabled")
+	}
+	return CgroupSummary, nil
+}
+
+// parseCgroupSummary reads each line of the /proc/cgroup file.
+func parseCgroupSummary(data []byte) ([]CgroupSummary, error) {
+	var CgroupSummarys []CgroupSummary
+	scanner := bufio.NewScanner(bytes.NewReader(data))
+	for scanner.Scan() {
+		CgroupSummaryString := scanner.Text()
+		// ignore comment lines
+		if strings.HasPrefix(CgroupSummaryString, "#") {
+			continue
+		}
+		CgroupSummary, err := parseCgroupSummaryString(CgroupSummaryString)
+		if err != nil {
+			return nil, err
+		}
+		CgroupSummarys = append(CgroupSummarys, *CgroupSummary)
+	}
+
+	err := scanner.Err()
+	return CgroupSummarys, err
+}
+
+// CgroupSummarys returns information about current /proc/cgroups.
+func (fs FS) CgroupSummarys() ([]CgroupSummary, error) {
+	data, err := util.ReadFileNoStat(fs.proc.Path("cgroups"))
+	if err != nil {
+		return nil, err
+	}
+	return parseCgroupSummary(data)
+}
diff --git a/vendor/github.com/prometheus/procfs/proc_environ.go b/vendor/github.com/prometheus/procfs/proc_environ.go
index 6134b3580c..57a89895d6 100644
--- a/vendor/github.com/prometheus/procfs/proc_environ.go
+++ b/vendor/github.com/prometheus/procfs/proc_environ.go
@@ -19,7 +19,7 @@ import (
 	"github.com/prometheus/procfs/internal/util"
 )
 
-// Environ reads process environments from /proc/<pid>/environ
+// Environ reads process environments from `/proc/<pid>/environ`.
 func (p Proc) Environ() ([]string, error) {
 	environments := make([]string, 0)
 
diff --git a/vendor/github.com/prometheus/procfs/proc_fdinfo.go b/vendor/github.com/prometheus/procfs/proc_fdinfo.go
index cf63227f06..1bbdd4a8e9 100644
--- a/vendor/github.com/prometheus/procfs/proc_fdinfo.go
+++ b/vendor/github.com/prometheus/procfs/proc_fdinfo.go
@@ -22,7 +22,6 @@ import (
 	"github.com/prometheus/procfs/internal/util"
 )
 
-// Regexp variables
 var (
 	rPos          = regexp.MustCompile(`^pos:\s+(\d+)$`)
 	rFlags        = regexp.MustCompile(`^flags:\s+(\d+)$`)
@@ -122,7 +121,7 @@ func (p ProcFDInfos) Len() int           { return len(p) }
 func (p ProcFDInfos) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }
 func (p ProcFDInfos) Less(i, j int) bool { return p[i].FD < p[j].FD }
 
-// InotifyWatchLen returns the total number of inotify watches
+// InotifyWatchLen returns the total number of inotify watches.
 func (p ProcFDInfos) InotifyWatchLen() (int, error) {
 	length := 0
 	for _, f := range p {
diff --git a/vendor/github.com/prometheus/procfs/proc_interrupts.go b/vendor/github.com/prometheus/procfs/proc_interrupts.go
new file mode 100644
index 0000000000..9df79c2379
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/proc_interrupts.go
@@ -0,0 +1,98 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// Interrupt represents a single interrupt line.
+type Interrupt struct {
+	// Info is the type of interrupt.
+	Info string
+	// Devices is the name of the device that is located at that IRQ
+	Devices string
+	// Values is the number of interrupts per CPU.
+	Values []string
+}
+
+// Interrupts models the content of /proc/interrupts. Key is the IRQ number.
+// - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/s2-proc-interrupts
+// - https://raspberrypi.stackexchange.com/questions/105802/explanation-of-proc-interrupts-output
+type Interrupts map[string]Interrupt
+
+// Interrupts creates a new instance from a given Proc instance.
+func (p Proc) Interrupts() (Interrupts, error) {
+	data, err := util.ReadFileNoStat(p.path("interrupts"))
+	if err != nil {
+		return nil, err
+	}
+	return parseInterrupts(bytes.NewReader(data))
+}
+
+func parseInterrupts(r io.Reader) (Interrupts, error) {
+	var (
+		interrupts = Interrupts{}
+		scanner    = bufio.NewScanner(r)
+	)
+
+	if !scanner.Scan() {
+		return nil, errors.New("interrupts empty")
+	}
+	cpuNum := len(strings.Fields(scanner.Text())) // one header per cpu
+
+	for scanner.Scan() {
+		parts := strings.Fields(scanner.Text())
+		if len(parts) == 0 { // skip empty lines
+			continue
+		}
+		if len(parts) < 2 {
+			return nil, fmt.Errorf("not enough fields in interrupts (expected at least 2 fields but got %d): %s", len(parts), parts)
+		}
+		intName := parts[0][:len(parts[0])-1] // remove trailing :
+
+		if len(parts) == 2 {
+			interrupts[intName] = Interrupt{
+				Info:    "",
+				Devices: "",
+				Values: []string{
+					parts[1],
+				},
+			}
+			continue
+		}
+
+		intr := Interrupt{
+			Values: parts[1 : cpuNum+1],
+		}
+
+		if _, err := strconv.Atoi(intName); err == nil { // numeral interrupt
+			intr.Info = parts[cpuNum+1]
+			intr.Devices = strings.Join(parts[cpuNum+2:], " ")
+		} else {
+			intr.Info = strings.Join(parts[cpuNum+1:], " ")
+		}
+		interrupts[intName] = intr
+	}
+
+	return interrupts, scanner.Err()
+}
diff --git a/vendor/github.com/prometheus/procfs/proc_limits.go b/vendor/github.com/prometheus/procfs/proc_limits.go
index dd20f198a3..7a1388185a 100644
--- a/vendor/github.com/prometheus/procfs/proc_limits.go
+++ b/vendor/github.com/prometheus/procfs/proc_limits.go
@@ -79,7 +79,7 @@ var (
 
 // NewLimits returns the current soft limits of the process.
 //
-// Deprecated: use p.Limits() instead
+// Deprecated: Use p.Limits() instead.
 func (p Proc) NewLimits() (ProcLimits, error) {
 	return p.Limits()
 }
diff --git a/vendor/github.com/prometheus/procfs/proc_maps.go b/vendor/github.com/prometheus/procfs/proc_maps.go
index 1d7772d516..f1bcbf32bb 100644
--- a/vendor/github.com/prometheus/procfs/proc_maps.go
+++ b/vendor/github.com/prometheus/procfs/proc_maps.go
@@ -11,7 +11,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build (aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris) && !js
 // +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+// +build !js
 
 package procfs
 
@@ -25,7 +27,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// ProcMapPermissions contains permission settings read from /proc/[pid]/maps
+// ProcMapPermissions contains permission settings read from `/proc/[pid]/maps`.
 type ProcMapPermissions struct {
 	// mapping has the [R]ead flag set
 	Read bool
@@ -39,8 +41,8 @@ type ProcMapPermissions struct {
 	Private bool
 }
 
-// ProcMap contains the process memory-mappings of the process,
-// read from /proc/[pid]/maps
+// ProcMap contains the process memory-mappings of the process
+// read from `/proc/[pid]/maps`.
 type ProcMap struct {
 	// The start address of current mapping.
 	StartAddr uintptr
@@ -79,7 +81,7 @@ func parseDevice(s string) (uint64, error) {
 	return unix.Mkdev(uint32(major), uint32(minor)), nil
 }
 
-// parseAddress just converts a hex-string to a uintptr
+// parseAddress converts a hex-string to a uintptr.
 func parseAddress(s string) (uintptr, error) {
 	a, err := strconv.ParseUint(s, 16, 0)
 	if err != nil {
@@ -89,7 +91,7 @@ func parseAddress(s string) (uintptr, error) {
 	return uintptr(a), nil
 }
 
-// parseAddresses parses the start-end address
+// parseAddresses parses the start-end address.
 func parseAddresses(s string) (uintptr, uintptr, error) {
 	toks := strings.Split(s, "-")
 	if len(toks) < 2 {
diff --git a/vendor/github.com/prometheus/procfs/proc_netstat.go b/vendor/github.com/prometheus/procfs/proc_netstat.go
new file mode 100644
index 0000000000..6a43bb2459
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/proc_netstat.go
@@ -0,0 +1,443 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// ProcNetstat models the content of /proc/<pid>/net/netstat.
+type ProcNetstat struct {
+	// The process ID.
+	PID int
+	TcpExt
+	IpExt
+}
+
+type TcpExt struct { // nolint:revive
+	SyncookiesSent            *float64
+	SyncookiesRecv            *float64
+	SyncookiesFailed          *float64
+	EmbryonicRsts             *float64
+	PruneCalled               *float64
+	RcvPruned                 *float64
+	OfoPruned                 *float64
+	OutOfWindowIcmps          *float64
+	LockDroppedIcmps          *float64
+	ArpFilter                 *float64
+	TW                        *float64
+	TWRecycled                *float64
+	TWKilled                  *float64
+	PAWSActive                *float64
+	PAWSEstab                 *float64
+	DelayedACKs               *float64
+	DelayedACKLocked          *float64
+	DelayedACKLost            *float64
+	ListenOverflows           *float64
+	ListenDrops               *float64
+	TCPHPHits                 *float64
+	TCPPureAcks               *float64
+	TCPHPAcks                 *float64
+	TCPRenoRecovery           *float64
+	TCPSackRecovery           *float64
+	TCPSACKReneging           *float64
+	TCPSACKReorder            *float64
+	TCPRenoReorder            *float64
+	TCPTSReorder              *float64
+	TCPFullUndo               *float64
+	TCPPartialUndo            *float64
+	TCPDSACKUndo              *float64
+	TCPLossUndo               *float64
+	TCPLostRetransmit         *float64
+	TCPRenoFailures           *float64
+	TCPSackFailures           *float64
+	TCPLossFailures           *float64
+	TCPFastRetrans            *float64
+	TCPSlowStartRetrans       *float64
+	TCPTimeouts               *float64
+	TCPLossProbes             *float64
+	TCPLossProbeRecovery      *float64
+	TCPRenoRecoveryFail       *float64
+	TCPSackRecoveryFail       *float64
+	TCPRcvCollapsed           *float64
+	TCPDSACKOldSent           *float64
+	TCPDSACKOfoSent           *float64
+	TCPDSACKRecv              *float64
+	TCPDSACKOfoRecv           *float64
+	TCPAbortOnData            *float64
+	TCPAbortOnClose           *float64
+	TCPAbortOnMemory          *float64
+	TCPAbortOnTimeout         *float64
+	TCPAbortOnLinger          *float64
+	TCPAbortFailed            *float64
+	TCPMemoryPressures        *float64
+	TCPMemoryPressuresChrono  *float64
+	TCPSACKDiscard            *float64
+	TCPDSACKIgnoredOld        *float64
+	TCPDSACKIgnoredNoUndo     *float64
+	TCPSpuriousRTOs           *float64
+	TCPMD5NotFound            *float64
+	TCPMD5Unexpected          *float64
+	TCPMD5Failure             *float64
+	TCPSackShifted            *float64
+	TCPSackMerged             *float64
+	TCPSackShiftFallback      *float64
+	TCPBacklogDrop            *float64
+	PFMemallocDrop            *float64
+	TCPMinTTLDrop             *float64
+	TCPDeferAcceptDrop        *float64
+	IPReversePathFilter       *float64
+	TCPTimeWaitOverflow       *float64
+	TCPReqQFullDoCookies      *float64
+	TCPReqQFullDrop           *float64
+	TCPRetransFail            *float64
+	TCPRcvCoalesce            *float64
+	TCPRcvQDrop               *float64
+	TCPOFOQueue               *float64
+	TCPOFODrop                *float64
+	TCPOFOMerge               *float64
+	TCPChallengeACK           *float64
+	TCPSYNChallenge           *float64
+	TCPFastOpenActive         *float64
+	TCPFastOpenActiveFail     *float64
+	TCPFastOpenPassive        *float64
+	TCPFastOpenPassiveFail    *float64
+	TCPFastOpenListenOverflow *float64
+	TCPFastOpenCookieReqd     *float64
+	TCPFastOpenBlackhole      *float64
+	TCPSpuriousRtxHostQueues  *float64
+	BusyPollRxPackets         *float64
+	TCPAutoCorking            *float64
+	TCPFromZeroWindowAdv      *float64
+	TCPToZeroWindowAdv        *float64
+	TCPWantZeroWindowAdv      *float64
+	TCPSynRetrans             *float64
+	TCPOrigDataSent           *float64
+	TCPHystartTrainDetect     *float64
+	TCPHystartTrainCwnd       *float64
+	TCPHystartDelayDetect     *float64
+	TCPHystartDelayCwnd       *float64
+	TCPACKSkippedSynRecv      *float64
+	TCPACKSkippedPAWS         *float64
+	TCPACKSkippedSeq          *float64
+	TCPACKSkippedFinWait2     *float64
+	TCPACKSkippedTimeWait     *float64
+	TCPACKSkippedChallenge    *float64
+	TCPWinProbe               *float64
+	TCPKeepAlive              *float64
+	TCPMTUPFail               *float64
+	TCPMTUPSuccess            *float64
+	TCPWqueueTooBig           *float64
+}
+
+type IpExt struct { // nolint:revive
+	InNoRoutes      *float64
+	InTruncatedPkts *float64
+	InMcastPkts     *float64
+	OutMcastPkts    *float64
+	InBcastPkts     *float64
+	OutBcastPkts    *float64
+	InOctets        *float64
+	OutOctets       *float64
+	InMcastOctets   *float64
+	OutMcastOctets  *float64
+	InBcastOctets   *float64
+	OutBcastOctets  *float64
+	InCsumErrors    *float64
+	InNoECTPkts     *float64
+	InECT1Pkts      *float64
+	InECT0Pkts      *float64
+	InCEPkts        *float64
+	ReasmOverlaps   *float64
+}
+
+func (p Proc) Netstat() (ProcNetstat, error) {
+	filename := p.path("net/netstat")
+	data, err := util.ReadFileNoStat(filename)
+	if err != nil {
+		return ProcNetstat{PID: p.PID}, err
+	}
+	procNetstat, err := parseProcNetstat(bytes.NewReader(data), filename)
+	procNetstat.PID = p.PID
+	return procNetstat, err
+}
+
+// parseProcNetstat parses the metrics from proc/<pid>/net/netstat file
+// and returns a ProcNetstat structure.
+func parseProcNetstat(r io.Reader, fileName string) (ProcNetstat, error) {
+	var (
+		scanner     = bufio.NewScanner(r)
+		procNetstat = ProcNetstat{}
+	)
+
+	for scanner.Scan() {
+		nameParts := strings.Split(scanner.Text(), " ")
+		scanner.Scan()
+		valueParts := strings.Split(scanner.Text(), " ")
+		// Remove trailing :.
+		protocol := strings.TrimSuffix(nameParts[0], ":")
+		if len(nameParts) != len(valueParts) {
+			return procNetstat, fmt.Errorf("mismatch field count mismatch in %s: %s",
+				fileName, protocol)
+		}
+		for i := 1; i < len(nameParts); i++ {
+			value, err := strconv.ParseFloat(valueParts[i], 64)
+			if err != nil {
+				return procNetstat, err
+			}
+			key := nameParts[i]
+
+			switch protocol {
+			case "TcpExt":
+				switch key {
+				case "SyncookiesSent":
+					procNetstat.TcpExt.SyncookiesSent = &value
+				case "SyncookiesRecv":
+					procNetstat.TcpExt.SyncookiesRecv = &value
+				case "SyncookiesFailed":
+					procNetstat.TcpExt.SyncookiesFailed = &value
+				case "EmbryonicRsts":
+					procNetstat.TcpExt.EmbryonicRsts = &value
+				case "PruneCalled":
+					procNetstat.TcpExt.PruneCalled = &value
+				case "RcvPruned":
+					procNetstat.TcpExt.RcvPruned = &value
+				case "OfoPruned":
+					procNetstat.TcpExt.OfoPruned = &value
+				case "OutOfWindowIcmps":
+					procNetstat.TcpExt.OutOfWindowIcmps = &value
+				case "LockDroppedIcmps":
+					procNetstat.TcpExt.LockDroppedIcmps = &value
+				case "ArpFilter":
+					procNetstat.TcpExt.ArpFilter = &value
+				case "TW":
+					procNetstat.TcpExt.TW = &value
+				case "TWRecycled":
+					procNetstat.TcpExt.TWRecycled = &value
+				case "TWKilled":
+					procNetstat.TcpExt.TWKilled = &value
+				case "PAWSActive":
+					procNetstat.TcpExt.PAWSActive = &value
+				case "PAWSEstab":
+					procNetstat.TcpExt.PAWSEstab = &value
+				case "DelayedACKs":
+					procNetstat.TcpExt.DelayedACKs = &value
+				case "DelayedACKLocked":
+					procNetstat.TcpExt.DelayedACKLocked = &value
+				case "DelayedACKLost":
+					procNetstat.TcpExt.DelayedACKLost = &value
+				case "ListenOverflows":
+					procNetstat.TcpExt.ListenOverflows = &value
+				case "ListenDrops":
+					procNetstat.TcpExt.ListenDrops = &value
+				case "TCPHPHits":
+					procNetstat.TcpExt.TCPHPHits = &value
+				case "TCPPureAcks":
+					procNetstat.TcpExt.TCPPureAcks = &value
+				case "TCPHPAcks":
+					procNetstat.TcpExt.TCPHPAcks = &value
+				case "TCPRenoRecovery":
+					procNetstat.TcpExt.TCPRenoRecovery = &value
+				case "TCPSackRecovery":
+					procNetstat.TcpExt.TCPSackRecovery = &value
+				case "TCPSACKReneging":
+					procNetstat.TcpExt.TCPSACKReneging = &value
+				case "TCPSACKReorder":
+					procNetstat.TcpExt.TCPSACKReorder = &value
+				case "TCPRenoReorder":
+					procNetstat.TcpExt.TCPRenoReorder = &value
+				case "TCPTSReorder":
+					procNetstat.TcpExt.TCPTSReorder = &value
+				case "TCPFullUndo":
+					procNetstat.TcpExt.TCPFullUndo = &value
+				case "TCPPartialUndo":
+					procNetstat.TcpExt.TCPPartialUndo = &value
+				case "TCPDSACKUndo":
+					procNetstat.TcpExt.TCPDSACKUndo = &value
+				case "TCPLossUndo":
+					procNetstat.TcpExt.TCPLossUndo = &value
+				case "TCPLostRetransmit":
+					procNetstat.TcpExt.TCPLostRetransmit = &value
+				case "TCPRenoFailures":
+					procNetstat.TcpExt.TCPRenoFailures = &value
+				case "TCPSackFailures":
+					procNetstat.TcpExt.TCPSackFailures = &value
+				case "TCPLossFailures":
+					procNetstat.TcpExt.TCPLossFailures = &value
+				case "TCPFastRetrans":
+					procNetstat.TcpExt.TCPFastRetrans = &value
+				case "TCPSlowStartRetrans":
+					procNetstat.TcpExt.TCPSlowStartRetrans = &value
+				case "TCPTimeouts":
+					procNetstat.TcpExt.TCPTimeouts = &value
+				case "TCPLossProbes":
+					procNetstat.TcpExt.TCPLossProbes = &value
+				case "TCPLossProbeRecovery":
+					procNetstat.TcpExt.TCPLossProbeRecovery = &value
+				case "TCPRenoRecoveryFail":
+					procNetstat.TcpExt.TCPRenoRecoveryFail = &value
+				case "TCPSackRecoveryFail":
+					procNetstat.TcpExt.TCPSackRecoveryFail = &value
+				case "TCPRcvCollapsed":
+					procNetstat.TcpExt.TCPRcvCollapsed = &value
+				case "TCPDSACKOldSent":
+					procNetstat.TcpExt.TCPDSACKOldSent = &value
+				case "TCPDSACKOfoSent":
+					procNetstat.TcpExt.TCPDSACKOfoSent = &value
+				case "TCPDSACKRecv":
+					procNetstat.TcpExt.TCPDSACKRecv = &value
+				case "TCPDSACKOfoRecv":
+					procNetstat.TcpExt.TCPDSACKOfoRecv = &value
+				case "TCPAbortOnData":
+					procNetstat.TcpExt.TCPAbortOnData = &value
+				case "TCPAbortOnClose":
+					procNetstat.TcpExt.TCPAbortOnClose = &value
+				case "TCPDeferAcceptDrop":
+					procNetstat.TcpExt.TCPDeferAcceptDrop = &value
+				case "IPReversePathFilter":
+					procNetstat.TcpExt.IPReversePathFilter = &value
+				case "TCPTimeWaitOverflow":
+					procNetstat.TcpExt.TCPTimeWaitOverflow = &value
+				case "TCPReqQFullDoCookies":
+					procNetstat.TcpExt.TCPReqQFullDoCookies = &value
+				case "TCPReqQFullDrop":
+					procNetstat.TcpExt.TCPReqQFullDrop = &value
+				case "TCPRetransFail":
+					procNetstat.TcpExt.TCPRetransFail = &value
+				case "TCPRcvCoalesce":
+					procNetstat.TcpExt.TCPRcvCoalesce = &value
+				case "TCPRcvQDrop":
+					procNetstat.TcpExt.TCPRcvQDrop = &value
+				case "TCPOFOQueue":
+					procNetstat.TcpExt.TCPOFOQueue = &value
+				case "TCPOFODrop":
+					procNetstat.TcpExt.TCPOFODrop = &value
+				case "TCPOFOMerge":
+					procNetstat.TcpExt.TCPOFOMerge = &value
+				case "TCPChallengeACK":
+					procNetstat.TcpExt.TCPChallengeACK = &value
+				case "TCPSYNChallenge":
+					procNetstat.TcpExt.TCPSYNChallenge = &value
+				case "TCPFastOpenActive":
+					procNetstat.TcpExt.TCPFastOpenActive = &value
+				case "TCPFastOpenActiveFail":
+					procNetstat.TcpExt.TCPFastOpenActiveFail = &value
+				case "TCPFastOpenPassive":
+					procNetstat.TcpExt.TCPFastOpenPassive = &value
+				case "TCPFastOpenPassiveFail":
+					procNetstat.TcpExt.TCPFastOpenPassiveFail = &value
+				case "TCPFastOpenListenOverflow":
+					procNetstat.TcpExt.TCPFastOpenListenOverflow = &value
+				case "TCPFastOpenCookieReqd":
+					procNetstat.TcpExt.TCPFastOpenCookieReqd = &value
+				case "TCPFastOpenBlackhole":
+					procNetstat.TcpExt.TCPFastOpenBlackhole = &value
+				case "TCPSpuriousRtxHostQueues":
+					procNetstat.TcpExt.TCPSpuriousRtxHostQueues = &value
+				case "BusyPollRxPackets":
+					procNetstat.TcpExt.BusyPollRxPackets = &value
+				case "TCPAutoCorking":
+					procNetstat.TcpExt.TCPAutoCorking = &value
+				case "TCPFromZeroWindowAdv":
+					procNetstat.TcpExt.TCPFromZeroWindowAdv = &value
+				case "TCPToZeroWindowAdv":
+					procNetstat.TcpExt.TCPToZeroWindowAdv = &value
+				case "TCPWantZeroWindowAdv":
+					procNetstat.TcpExt.TCPWantZeroWindowAdv = &value
+				case "TCPSynRetrans":
+					procNetstat.TcpExt.TCPSynRetrans = &value
+				case "TCPOrigDataSent":
+					procNetstat.TcpExt.TCPOrigDataSent = &value
+				case "TCPHystartTrainDetect":
+					procNetstat.TcpExt.TCPHystartTrainDetect = &value
+				case "TCPHystartTrainCwnd":
+					procNetstat.TcpExt.TCPHystartTrainCwnd = &value
+				case "TCPHystartDelayDetect":
+					procNetstat.TcpExt.TCPHystartDelayDetect = &value
+				case "TCPHystartDelayCwnd":
+					procNetstat.TcpExt.TCPHystartDelayCwnd = &value
+				case "TCPACKSkippedSynRecv":
+					procNetstat.TcpExt.TCPACKSkippedSynRecv = &value
+				case "TCPACKSkippedPAWS":
+					procNetstat.TcpExt.TCPACKSkippedPAWS = &value
+				case "TCPACKSkippedSeq":
+					procNetstat.TcpExt.TCPACKSkippedSeq = &value
+				case "TCPACKSkippedFinWait2":
+					procNetstat.TcpExt.TCPACKSkippedFinWait2 = &value
+				case "TCPACKSkippedTimeWait":
+					procNetstat.TcpExt.TCPACKSkippedTimeWait = &value
+				case "TCPACKSkippedChallenge":
+					procNetstat.TcpExt.TCPACKSkippedChallenge = &value
+				case "TCPWinProbe":
+					procNetstat.TcpExt.TCPWinProbe = &value
+				case "TCPKeepAlive":
+					procNetstat.TcpExt.TCPKeepAlive = &value
+				case "TCPMTUPFail":
+					procNetstat.TcpExt.TCPMTUPFail = &value
+				case "TCPMTUPSuccess":
+					procNetstat.TcpExt.TCPMTUPSuccess = &value
+				case "TCPWqueueTooBig":
+					procNetstat.TcpExt.TCPWqueueTooBig = &value
+				}
+			case "IpExt":
+				switch key {
+				case "InNoRoutes":
+					procNetstat.IpExt.InNoRoutes = &value
+				case "InTruncatedPkts":
+					procNetstat.IpExt.InTruncatedPkts = &value
+				case "InMcastPkts":
+					procNetstat.IpExt.InMcastPkts = &value
+				case "OutMcastPkts":
+					procNetstat.IpExt.OutMcastPkts = &value
+				case "InBcastPkts":
+					procNetstat.IpExt.InBcastPkts = &value
+				case "OutBcastPkts":
+					procNetstat.IpExt.OutBcastPkts = &value
+				case "InOctets":
+					procNetstat.IpExt.InOctets = &value
+				case "OutOctets":
+					procNetstat.IpExt.OutOctets = &value
+				case "InMcastOctets":
+					procNetstat.IpExt.InMcastOctets = &value
+				case "OutMcastOctets":
+					procNetstat.IpExt.OutMcastOctets = &value
+				case "InBcastOctets":
+					procNetstat.IpExt.InBcastOctets = &value
+				case "OutBcastOctets":
+					procNetstat.IpExt.OutBcastOctets = &value
+				case "InCsumErrors":
+					procNetstat.IpExt.InCsumErrors = &value
+				case "InNoECTPkts":
+					procNetstat.IpExt.InNoECTPkts = &value
+				case "InECT1Pkts":
+					procNetstat.IpExt.InECT1Pkts = &value
+				case "InECT0Pkts":
+					procNetstat.IpExt.InECT0Pkts = &value
+				case "InCEPkts":
+					procNetstat.IpExt.InCEPkts = &value
+				case "ReasmOverlaps":
+					procNetstat.IpExt.ReasmOverlaps = &value
+				}
+			}
+		}
+	}
+	return procNetstat, scanner.Err()
+}
diff --git a/vendor/github.com/prometheus/procfs/proc_psi.go b/vendor/github.com/prometheus/procfs/proc_psi.go
index dc6c14f0a4..a68fe15290 100644
--- a/vendor/github.com/prometheus/procfs/proc_psi.go
+++ b/vendor/github.com/prometheus/procfs/proc_psi.go
@@ -35,9 +35,10 @@ import (
 
 const lineFormat = "avg10=%f avg60=%f avg300=%f total=%d"
 
-// PSILine is a single line of values as returned by /proc/pressure/*
-// The Avg entries are averages over n seconds, as a percentage
-// The Total line is in microseconds
+// PSILine is a single line of values as returned by `/proc/pressure/*`.
+//
+// The Avg entries are averages over n seconds, as a percentage.
+// The Total line is in microseconds.
 type PSILine struct {
 	Avg10  float64
 	Avg60  float64
@@ -46,8 +47,9 @@ type PSILine struct {
 }
 
 // PSIStats represent pressure stall information from /proc/pressure/*
-// Some indicates the share of time in which at least some tasks are stalled
-// Full indicates the share of time in which all non-idle tasks are stalled simultaneously
+//
+// "Some" indicates the share of time in which at least some tasks are stalled.
+// "Full" indicates the share of time in which all non-idle tasks are stalled simultaneously.
 type PSIStats struct {
 	Some *PSILine
 	Full *PSILine
@@ -65,7 +67,7 @@ func (fs FS) PSIStatsForResource(resource string) (PSIStats, error) {
 	return parsePSIStats(resource, bytes.NewReader(data))
 }
 
-// parsePSIStats parses the specified file for pressure stall information
+// parsePSIStats parses the specified file for pressure stall information.
 func parsePSIStats(resource string, r io.Reader) (PSIStats, error) {
 	psiStats := PSIStats{}
 
diff --git a/vendor/github.com/prometheus/procfs/proc_smaps.go b/vendor/github.com/prometheus/procfs/proc_smaps.go
index a576a720a4..0e97d99575 100644
--- a/vendor/github.com/prometheus/procfs/proc_smaps.go
+++ b/vendor/github.com/prometheus/procfs/proc_smaps.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build !windows
 // +build !windows
 
 package procfs
@@ -28,30 +29,30 @@ import (
 )
 
 var (
-	// match the header line before each mapped zone in /proc/pid/smaps
+	// match the header line before each mapped zone in `/proc/pid/smaps`.
 	procSMapsHeaderLine = regexp.MustCompile(`^[a-f0-9].*$`)
 )
 
 type ProcSMapsRollup struct {
-	// Amount of the mapping that is currently resident in RAM
+	// Amount of the mapping that is currently resident in RAM.
 	Rss uint64
-	// Process's proportional share of this mapping
+	// Process's proportional share of this mapping.
 	Pss uint64
-	// Size in bytes of clean shared pages
+	// Size in bytes of clean shared pages.
 	SharedClean uint64
-	// Size in bytes of dirty shared pages
+	// Size in bytes of dirty shared pages.
 	SharedDirty uint64
-	// Size in bytes of clean private pages
+	// Size in bytes of clean private pages.
 	PrivateClean uint64
-	// Size in bytes of dirty private pages
+	// Size in bytes of dirty private pages.
 	PrivateDirty uint64
-	// Amount of memory currently marked as referenced or accessed
+	// Amount of memory currently marked as referenced or accessed.
 	Referenced uint64
-	// Amount of memory that does not belong to any file
+	// Amount of memory that does not belong to any file.
 	Anonymous uint64
-	// Amount would-be-anonymous memory currently on swap
+	// Amount would-be-anonymous memory currently on swap.
 	Swap uint64
-	// Process's proportional memory on swap
+	// Process's proportional memory on swap.
 	SwapPss uint64
 }
 
diff --git a/vendor/github.com/prometheus/procfs/proc_snmp.go b/vendor/github.com/prometheus/procfs/proc_snmp.go
new file mode 100644
index 0000000000..6c46b71884
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/proc_snmp.go
@@ -0,0 +1,353 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// ProcSnmp models the content of /proc/<pid>/net/snmp.
+type ProcSnmp struct {
+	// The process ID.
+	PID int
+	Ip
+	Icmp
+	IcmpMsg
+	Tcp
+	Udp
+	UdpLite
+}
+
+type Ip struct { // nolint:revive
+	Forwarding      *float64
+	DefaultTTL      *float64
+	InReceives      *float64
+	InHdrErrors     *float64
+	InAddrErrors    *float64
+	ForwDatagrams   *float64
+	InUnknownProtos *float64
+	InDiscards      *float64
+	InDelivers      *float64
+	OutRequests     *float64
+	OutDiscards     *float64
+	OutNoRoutes     *float64
+	ReasmTimeout    *float64
+	ReasmReqds      *float64
+	ReasmOKs        *float64
+	ReasmFails      *float64
+	FragOKs         *float64
+	FragFails       *float64
+	FragCreates     *float64
+}
+
+type Icmp struct { // nolint:revive
+	InMsgs           *float64
+	InErrors         *float64
+	InCsumErrors     *float64
+	InDestUnreachs   *float64
+	InTimeExcds      *float64
+	InParmProbs      *float64
+	InSrcQuenchs     *float64
+	InRedirects      *float64
+	InEchos          *float64
+	InEchoReps       *float64
+	InTimestamps     *float64
+	InTimestampReps  *float64
+	InAddrMasks      *float64
+	InAddrMaskReps   *float64
+	OutMsgs          *float64
+	OutErrors        *float64
+	OutDestUnreachs  *float64
+	OutTimeExcds     *float64
+	OutParmProbs     *float64
+	OutSrcQuenchs    *float64
+	OutRedirects     *float64
+	OutEchos         *float64
+	OutEchoReps      *float64
+	OutTimestamps    *float64
+	OutTimestampReps *float64
+	OutAddrMasks     *float64
+	OutAddrMaskReps  *float64
+}
+
+type IcmpMsg struct {
+	InType3  *float64
+	OutType3 *float64
+}
+
+type Tcp struct { // nolint:revive
+	RtoAlgorithm *float64
+	RtoMin       *float64
+	RtoMax       *float64
+	MaxConn      *float64
+	ActiveOpens  *float64
+	PassiveOpens *float64
+	AttemptFails *float64
+	EstabResets  *float64
+	CurrEstab    *float64
+	InSegs       *float64
+	OutSegs      *float64
+	RetransSegs  *float64
+	InErrs       *float64
+	OutRsts      *float64
+	InCsumErrors *float64
+}
+
+type Udp struct { // nolint:revive
+	InDatagrams  *float64
+	NoPorts      *float64
+	InErrors     *float64
+	OutDatagrams *float64
+	RcvbufErrors *float64
+	SndbufErrors *float64
+	InCsumErrors *float64
+	IgnoredMulti *float64
+}
+
+type UdpLite struct { // nolint:revive
+	InDatagrams  *float64
+	NoPorts      *float64
+	InErrors     *float64
+	OutDatagrams *float64
+	RcvbufErrors *float64
+	SndbufErrors *float64
+	InCsumErrors *float64
+	IgnoredMulti *float64
+}
+
+func (p Proc) Snmp() (ProcSnmp, error) {
+	filename := p.path("net/snmp")
+	data, err := util.ReadFileNoStat(filename)
+	if err != nil {
+		return ProcSnmp{PID: p.PID}, err
+	}
+	procSnmp, err := parseSnmp(bytes.NewReader(data), filename)
+	procSnmp.PID = p.PID
+	return procSnmp, err
+}
+
+// parseSnmp parses the metrics from proc/<pid>/net/snmp file
+// and returns a map contains those metrics (e.g. {"Ip": {"Forwarding": 2}}).
+func parseSnmp(r io.Reader, fileName string) (ProcSnmp, error) {
+	var (
+		scanner  = bufio.NewScanner(r)
+		procSnmp = ProcSnmp{}
+	)
+
+	for scanner.Scan() {
+		nameParts := strings.Split(scanner.Text(), " ")
+		scanner.Scan()
+		valueParts := strings.Split(scanner.Text(), " ")
+		// Remove trailing :.
+		protocol := strings.TrimSuffix(nameParts[0], ":")
+		if len(nameParts) != len(valueParts) {
+			return procSnmp, fmt.Errorf("mismatch field count mismatch in %s: %s",
+				fileName, protocol)
+		}
+		for i := 1; i < len(nameParts); i++ {
+			value, err := strconv.ParseFloat(valueParts[i], 64)
+			if err != nil {
+				return procSnmp, err
+			}
+			key := nameParts[i]
+
+			switch protocol {
+			case "Ip":
+				switch key {
+				case "Forwarding":
+					procSnmp.Ip.Forwarding = &value
+				case "DefaultTTL":
+					procSnmp.Ip.DefaultTTL = &value
+				case "InReceives":
+					procSnmp.Ip.InReceives = &value
+				case "InHdrErrors":
+					procSnmp.Ip.InHdrErrors = &value
+				case "InAddrErrors":
+					procSnmp.Ip.InAddrErrors = &value
+				case "ForwDatagrams":
+					procSnmp.Ip.ForwDatagrams = &value
+				case "InUnknownProtos":
+					procSnmp.Ip.InUnknownProtos = &value
+				case "InDiscards":
+					procSnmp.Ip.InDiscards = &value
+				case "InDelivers":
+					procSnmp.Ip.InDelivers = &value
+				case "OutRequests":
+					procSnmp.Ip.OutRequests = &value
+				case "OutDiscards":
+					procSnmp.Ip.OutDiscards = &value
+				case "OutNoRoutes":
+					procSnmp.Ip.OutNoRoutes = &value
+				case "ReasmTimeout":
+					procSnmp.Ip.ReasmTimeout = &value
+				case "ReasmReqds":
+					procSnmp.Ip.ReasmReqds = &value
+				case "ReasmOKs":
+					procSnmp.Ip.ReasmOKs = &value
+				case "ReasmFails":
+					procSnmp.Ip.ReasmFails = &value
+				case "FragOKs":
+					procSnmp.Ip.FragOKs = &value
+				case "FragFails":
+					procSnmp.Ip.FragFails = &value
+				case "FragCreates":
+					procSnmp.Ip.FragCreates = &value
+				}
+			case "Icmp":
+				switch key {
+				case "InMsgs":
+					procSnmp.Icmp.InMsgs = &value
+				case "InErrors":
+					procSnmp.Icmp.InErrors = &value
+				case "InCsumErrors":
+					procSnmp.Icmp.InCsumErrors = &value
+				case "InDestUnreachs":
+					procSnmp.Icmp.InDestUnreachs = &value
+				case "InTimeExcds":
+					procSnmp.Icmp.InTimeExcds = &value
+				case "InParmProbs":
+					procSnmp.Icmp.InParmProbs = &value
+				case "InSrcQuenchs":
+					procSnmp.Icmp.InSrcQuenchs = &value
+				case "InRedirects":
+					procSnmp.Icmp.InRedirects = &value
+				case "InEchos":
+					procSnmp.Icmp.InEchos = &value
+				case "InEchoReps":
+					procSnmp.Icmp.InEchoReps = &value
+				case "InTimestamps":
+					procSnmp.Icmp.InTimestamps = &value
+				case "InTimestampReps":
+					procSnmp.Icmp.InTimestampReps = &value
+				case "InAddrMasks":
+					procSnmp.Icmp.InAddrMasks = &value
+				case "InAddrMaskReps":
+					procSnmp.Icmp.InAddrMaskReps = &value
+				case "OutMsgs":
+					procSnmp.Icmp.OutMsgs = &value
+				case "OutErrors":
+					procSnmp.Icmp.OutErrors = &value
+				case "OutDestUnreachs":
+					procSnmp.Icmp.OutDestUnreachs = &value
+				case "OutTimeExcds":
+					procSnmp.Icmp.OutTimeExcds = &value
+				case "OutParmProbs":
+					procSnmp.Icmp.OutParmProbs = &value
+				case "OutSrcQuenchs":
+					procSnmp.Icmp.OutSrcQuenchs = &value
+				case "OutRedirects":
+					procSnmp.Icmp.OutRedirects = &value
+				case "OutEchos":
+					procSnmp.Icmp.OutEchos = &value
+				case "OutEchoReps":
+					procSnmp.Icmp.OutEchoReps = &value
+				case "OutTimestamps":
+					procSnmp.Icmp.OutTimestamps = &value
+				case "OutTimestampReps":
+					procSnmp.Icmp.OutTimestampReps = &value
+				case "OutAddrMasks":
+					procSnmp.Icmp.OutAddrMasks = &value
+				case "OutAddrMaskReps":
+					procSnmp.Icmp.OutAddrMaskReps = &value
+				}
+			case "IcmpMsg":
+				switch key {
+				case "InType3":
+					procSnmp.IcmpMsg.InType3 = &value
+				case "OutType3":
+					procSnmp.IcmpMsg.OutType3 = &value
+				}
+			case "Tcp":
+				switch key {
+				case "RtoAlgorithm":
+					procSnmp.Tcp.RtoAlgorithm = &value
+				case "RtoMin":
+					procSnmp.Tcp.RtoMin = &value
+				case "RtoMax":
+					procSnmp.Tcp.RtoMax = &value
+				case "MaxConn":
+					procSnmp.Tcp.MaxConn = &value
+				case "ActiveOpens":
+					procSnmp.Tcp.ActiveOpens = &value
+				case "PassiveOpens":
+					procSnmp.Tcp.PassiveOpens = &value
+				case "AttemptFails":
+					procSnmp.Tcp.AttemptFails = &value
+				case "EstabResets":
+					procSnmp.Tcp.EstabResets = &value
+				case "CurrEstab":
+					procSnmp.Tcp.CurrEstab = &value
+				case "InSegs":
+					procSnmp.Tcp.InSegs = &value
+				case "OutSegs":
+					procSnmp.Tcp.OutSegs = &value
+				case "RetransSegs":
+					procSnmp.Tcp.RetransSegs = &value
+				case "InErrs":
+					procSnmp.Tcp.InErrs = &value
+				case "OutRsts":
+					procSnmp.Tcp.OutRsts = &value
+				case "InCsumErrors":
+					procSnmp.Tcp.InCsumErrors = &value
+				}
+			case "Udp":
+				switch key {
+				case "InDatagrams":
+					procSnmp.Udp.InDatagrams = &value
+				case "NoPorts":
+					procSnmp.Udp.NoPorts = &value
+				case "InErrors":
+					procSnmp.Udp.InErrors = &value
+				case "OutDatagrams":
+					procSnmp.Udp.OutDatagrams = &value
+				case "RcvbufErrors":
+					procSnmp.Udp.RcvbufErrors = &value
+				case "SndbufErrors":
+					procSnmp.Udp.SndbufErrors = &value
+				case "InCsumErrors":
+					procSnmp.Udp.InCsumErrors = &value
+				case "IgnoredMulti":
+					procSnmp.Udp.IgnoredMulti = &value
+				}
+			case "UdpLite":
+				switch key {
+				case "InDatagrams":
+					procSnmp.UdpLite.InDatagrams = &value
+				case "NoPorts":
+					procSnmp.UdpLite.NoPorts = &value
+				case "InErrors":
+					procSnmp.UdpLite.InErrors = &value
+				case "OutDatagrams":
+					procSnmp.UdpLite.OutDatagrams = &value
+				case "RcvbufErrors":
+					procSnmp.UdpLite.RcvbufErrors = &value
+				case "SndbufErrors":
+					procSnmp.UdpLite.SndbufErrors = &value
+				case "InCsumErrors":
+					procSnmp.UdpLite.InCsumErrors = &value
+				case "IgnoredMulti":
+					procSnmp.UdpLite.IgnoredMulti = &value
+				}
+			}
+		}
+	}
+	return procSnmp, scanner.Err()
+}
diff --git a/vendor/github.com/prometheus/procfs/proc_snmp6.go b/vendor/github.com/prometheus/procfs/proc_snmp6.go
new file mode 100644
index 0000000000..3059cc6a13
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/proc_snmp6.go
@@ -0,0 +1,381 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// ProcSnmp6 models the content of /proc/<pid>/net/snmp6.
+type ProcSnmp6 struct {
+	// The process ID.
+	PID int
+	Ip6
+	Icmp6
+	Udp6
+	UdpLite6
+}
+
+type Ip6 struct { // nolint:revive
+	InReceives       *float64
+	InHdrErrors      *float64
+	InTooBigErrors   *float64
+	InNoRoutes       *float64
+	InAddrErrors     *float64
+	InUnknownProtos  *float64
+	InTruncatedPkts  *float64
+	InDiscards       *float64
+	InDelivers       *float64
+	OutForwDatagrams *float64
+	OutRequests      *float64
+	OutDiscards      *float64
+	OutNoRoutes      *float64
+	ReasmTimeout     *float64
+	ReasmReqds       *float64
+	ReasmOKs         *float64
+	ReasmFails       *float64
+	FragOKs          *float64
+	FragFails        *float64
+	FragCreates      *float64
+	InMcastPkts      *float64
+	OutMcastPkts     *float64
+	InOctets         *float64
+	OutOctets        *float64
+	InMcastOctets    *float64
+	OutMcastOctets   *float64
+	InBcastOctets    *float64
+	OutBcastOctets   *float64
+	InNoECTPkts      *float64
+	InECT1Pkts       *float64
+	InECT0Pkts       *float64
+	InCEPkts         *float64
+}
+
+type Icmp6 struct {
+	InMsgs                    *float64
+	InErrors                  *float64
+	OutMsgs                   *float64
+	OutErrors                 *float64
+	InCsumErrors              *float64
+	InDestUnreachs            *float64
+	InPktTooBigs              *float64
+	InTimeExcds               *float64
+	InParmProblems            *float64
+	InEchos                   *float64
+	InEchoReplies             *float64
+	InGroupMembQueries        *float64
+	InGroupMembResponses      *float64
+	InGroupMembReductions     *float64
+	InRouterSolicits          *float64
+	InRouterAdvertisements    *float64
+	InNeighborSolicits        *float64
+	InNeighborAdvertisements  *float64
+	InRedirects               *float64
+	InMLDv2Reports            *float64
+	OutDestUnreachs           *float64
+	OutPktTooBigs             *float64
+	OutTimeExcds              *float64
+	OutParmProblems           *float64
+	OutEchos                  *float64
+	OutEchoReplies            *float64
+	OutGroupMembQueries       *float64
+	OutGroupMembResponses     *float64
+	OutGroupMembReductions    *float64
+	OutRouterSolicits         *float64
+	OutRouterAdvertisements   *float64
+	OutNeighborSolicits       *float64
+	OutNeighborAdvertisements *float64
+	OutRedirects              *float64
+	OutMLDv2Reports           *float64
+	InType1                   *float64
+	InType134                 *float64
+	InType135                 *float64
+	InType136                 *float64
+	InType143                 *float64
+	OutType133                *float64
+	OutType135                *float64
+	OutType136                *float64
+	OutType143                *float64
+}
+
+type Udp6 struct { // nolint:revive
+	InDatagrams  *float64
+	NoPorts      *float64
+	InErrors     *float64
+	OutDatagrams *float64
+	RcvbufErrors *float64
+	SndbufErrors *float64
+	InCsumErrors *float64
+	IgnoredMulti *float64
+}
+
+type UdpLite6 struct { // nolint:revive
+	InDatagrams  *float64
+	NoPorts      *float64
+	InErrors     *float64
+	OutDatagrams *float64
+	RcvbufErrors *float64
+	SndbufErrors *float64
+	InCsumErrors *float64
+}
+
+func (p Proc) Snmp6() (ProcSnmp6, error) {
+	filename := p.path("net/snmp6")
+	data, err := util.ReadFileNoStat(filename)
+	if err != nil {
+		// On systems with IPv6 disabled, this file won't exist.
+		// Do nothing.
+		if errors.Is(err, os.ErrNotExist) {
+			return ProcSnmp6{PID: p.PID}, nil
+		}
+
+		return ProcSnmp6{PID: p.PID}, err
+	}
+
+	procSnmp6, err := parseSNMP6Stats(bytes.NewReader(data))
+	procSnmp6.PID = p.PID
+	return procSnmp6, err
+}
+
+// parseSnmp6 parses the metrics from proc/<pid>/net/snmp6 file
+// and returns a map contains those metrics.
+func parseSNMP6Stats(r io.Reader) (ProcSnmp6, error) {
+	var (
+		scanner   = bufio.NewScanner(r)
+		procSnmp6 = ProcSnmp6{}
+	)
+
+	for scanner.Scan() {
+		stat := strings.Fields(scanner.Text())
+		if len(stat) < 2 {
+			continue
+		}
+		// Expect to have "6" in metric name, skip line otherwise
+		if sixIndex := strings.Index(stat[0], "6"); sixIndex != -1 {
+			protocol := stat[0][:sixIndex+1]
+			key := stat[0][sixIndex+1:]
+			value, err := strconv.ParseFloat(stat[1], 64)
+			if err != nil {
+				return procSnmp6, err
+			}
+
+			switch protocol {
+			case "Ip6":
+				switch key {
+				case "InReceives":
+					procSnmp6.Ip6.InReceives = &value
+				case "InHdrErrors":
+					procSnmp6.Ip6.InHdrErrors = &value
+				case "InTooBigErrors":
+					procSnmp6.Ip6.InTooBigErrors = &value
+				case "InNoRoutes":
+					procSnmp6.Ip6.InNoRoutes = &value
+				case "InAddrErrors":
+					procSnmp6.Ip6.InAddrErrors = &value
+				case "InUnknownProtos":
+					procSnmp6.Ip6.InUnknownProtos = &value
+				case "InTruncatedPkts":
+					procSnmp6.Ip6.InTruncatedPkts = &value
+				case "InDiscards":
+					procSnmp6.Ip6.InDiscards = &value
+				case "InDelivers":
+					procSnmp6.Ip6.InDelivers = &value
+				case "OutForwDatagrams":
+					procSnmp6.Ip6.OutForwDatagrams = &value
+				case "OutRequests":
+					procSnmp6.Ip6.OutRequests = &value
+				case "OutDiscards":
+					procSnmp6.Ip6.OutDiscards = &value
+				case "OutNoRoutes":
+					procSnmp6.Ip6.OutNoRoutes = &value
+				case "ReasmTimeout":
+					procSnmp6.Ip6.ReasmTimeout = &value
+				case "ReasmReqds":
+					procSnmp6.Ip6.ReasmReqds = &value
+				case "ReasmOKs":
+					procSnmp6.Ip6.ReasmOKs = &value
+				case "ReasmFails":
+					procSnmp6.Ip6.ReasmFails = &value
+				case "FragOKs":
+					procSnmp6.Ip6.FragOKs = &value
+				case "FragFails":
+					procSnmp6.Ip6.FragFails = &value
+				case "FragCreates":
+					procSnmp6.Ip6.FragCreates = &value
+				case "InMcastPkts":
+					procSnmp6.Ip6.InMcastPkts = &value
+				case "OutMcastPkts":
+					procSnmp6.Ip6.OutMcastPkts = &value
+				case "InOctets":
+					procSnmp6.Ip6.InOctets = &value
+				case "OutOctets":
+					procSnmp6.Ip6.OutOctets = &value
+				case "InMcastOctets":
+					procSnmp6.Ip6.InMcastOctets = &value
+				case "OutMcastOctets":
+					procSnmp6.Ip6.OutMcastOctets = &value
+				case "InBcastOctets":
+					procSnmp6.Ip6.InBcastOctets = &value
+				case "OutBcastOctets":
+					procSnmp6.Ip6.OutBcastOctets = &value
+				case "InNoECTPkts":
+					procSnmp6.Ip6.InNoECTPkts = &value
+				case "InECT1Pkts":
+					procSnmp6.Ip6.InECT1Pkts = &value
+				case "InECT0Pkts":
+					procSnmp6.Ip6.InECT0Pkts = &value
+				case "InCEPkts":
+					procSnmp6.Ip6.InCEPkts = &value
+
+				}
+			case "Icmp6":
+				switch key {
+				case "InMsgs":
+					procSnmp6.Icmp6.InMsgs = &value
+				case "InErrors":
+					procSnmp6.Icmp6.InErrors = &value
+				case "OutMsgs":
+					procSnmp6.Icmp6.OutMsgs = &value
+				case "OutErrors":
+					procSnmp6.Icmp6.OutErrors = &value
+				case "InCsumErrors":
+					procSnmp6.Icmp6.InCsumErrors = &value
+				case "InDestUnreachs":
+					procSnmp6.Icmp6.InDestUnreachs = &value
+				case "InPktTooBigs":
+					procSnmp6.Icmp6.InPktTooBigs = &value
+				case "InTimeExcds":
+					procSnmp6.Icmp6.InTimeExcds = &value
+				case "InParmProblems":
+					procSnmp6.Icmp6.InParmProblems = &value
+				case "InEchos":
+					procSnmp6.Icmp6.InEchos = &value
+				case "InEchoReplies":
+					procSnmp6.Icmp6.InEchoReplies = &value
+				case "InGroupMembQueries":
+					procSnmp6.Icmp6.InGroupMembQueries = &value
+				case "InGroupMembResponses":
+					procSnmp6.Icmp6.InGroupMembResponses = &value
+				case "InGroupMembReductions":
+					procSnmp6.Icmp6.InGroupMembReductions = &value
+				case "InRouterSolicits":
+					procSnmp6.Icmp6.InRouterSolicits = &value
+				case "InRouterAdvertisements":
+					procSnmp6.Icmp6.InRouterAdvertisements = &value
+				case "InNeighborSolicits":
+					procSnmp6.Icmp6.InNeighborSolicits = &value
+				case "InNeighborAdvertisements":
+					procSnmp6.Icmp6.InNeighborAdvertisements = &value
+				case "InRedirects":
+					procSnmp6.Icmp6.InRedirects = &value
+				case "InMLDv2Reports":
+					procSnmp6.Icmp6.InMLDv2Reports = &value
+				case "OutDestUnreachs":
+					procSnmp6.Icmp6.OutDestUnreachs = &value
+				case "OutPktTooBigs":
+					procSnmp6.Icmp6.OutPktTooBigs = &value
+				case "OutTimeExcds":
+					procSnmp6.Icmp6.OutTimeExcds = &value
+				case "OutParmProblems":
+					procSnmp6.Icmp6.OutParmProblems = &value
+				case "OutEchos":
+					procSnmp6.Icmp6.OutEchos = &value
+				case "OutEchoReplies":
+					procSnmp6.Icmp6.OutEchoReplies = &value
+				case "OutGroupMembQueries":
+					procSnmp6.Icmp6.OutGroupMembQueries = &value
+				case "OutGroupMembResponses":
+					procSnmp6.Icmp6.OutGroupMembResponses = &value
+				case "OutGroupMembReductions":
+					procSnmp6.Icmp6.OutGroupMembReductions = &value
+				case "OutRouterSolicits":
+					procSnmp6.Icmp6.OutRouterSolicits = &value
+				case "OutRouterAdvertisements":
+					procSnmp6.Icmp6.OutRouterAdvertisements = &value
+				case "OutNeighborSolicits":
+					procSnmp6.Icmp6.OutNeighborSolicits = &value
+				case "OutNeighborAdvertisements":
+					procSnmp6.Icmp6.OutNeighborAdvertisements = &value
+				case "OutRedirects":
+					procSnmp6.Icmp6.OutRedirects = &value
+				case "OutMLDv2Reports":
+					procSnmp6.Icmp6.OutMLDv2Reports = &value
+				case "InType1":
+					procSnmp6.Icmp6.InType1 = &value
+				case "InType134":
+					procSnmp6.Icmp6.InType134 = &value
+				case "InType135":
+					procSnmp6.Icmp6.InType135 = &value
+				case "InType136":
+					procSnmp6.Icmp6.InType136 = &value
+				case "InType143":
+					procSnmp6.Icmp6.InType143 = &value
+				case "OutType133":
+					procSnmp6.Icmp6.OutType133 = &value
+				case "OutType135":
+					procSnmp6.Icmp6.OutType135 = &value
+				case "OutType136":
+					procSnmp6.Icmp6.OutType136 = &value
+				case "OutType143":
+					procSnmp6.Icmp6.OutType143 = &value
+				}
+			case "Udp6":
+				switch key {
+				case "InDatagrams":
+					procSnmp6.Udp6.InDatagrams = &value
+				case "NoPorts":
+					procSnmp6.Udp6.NoPorts = &value
+				case "InErrors":
+					procSnmp6.Udp6.InErrors = &value
+				case "OutDatagrams":
+					procSnmp6.Udp6.OutDatagrams = &value
+				case "RcvbufErrors":
+					procSnmp6.Udp6.RcvbufErrors = &value
+				case "SndbufErrors":
+					procSnmp6.Udp6.SndbufErrors = &value
+				case "InCsumErrors":
+					procSnmp6.Udp6.InCsumErrors = &value
+				case "IgnoredMulti":
+					procSnmp6.Udp6.IgnoredMulti = &value
+				}
+			case "UdpLite6":
+				switch key {
+				case "InDatagrams":
+					procSnmp6.UdpLite6.InDatagrams = &value
+				case "NoPorts":
+					procSnmp6.UdpLite6.NoPorts = &value
+				case "InErrors":
+					procSnmp6.UdpLite6.InErrors = &value
+				case "OutDatagrams":
+					procSnmp6.UdpLite6.OutDatagrams = &value
+				case "RcvbufErrors":
+					procSnmp6.UdpLite6.RcvbufErrors = &value
+				case "SndbufErrors":
+					procSnmp6.UdpLite6.SndbufErrors = &value
+				case "InCsumErrors":
+					procSnmp6.UdpLite6.InCsumErrors = &value
+				}
+			}
+		}
+	}
+	return procSnmp6, scanner.Err()
+}
diff --git a/vendor/github.com/prometheus/procfs/proc_stat.go b/vendor/github.com/prometheus/procfs/proc_stat.go
index 67ca0e9fbc..b278eb2c2d 100644
--- a/vendor/github.com/prometheus/procfs/proc_stat.go
+++ b/vendor/github.com/prometheus/procfs/proc_stat.go
@@ -81,10 +81,10 @@ type ProcStat struct {
 	STime uint
 	// Amount of time that this process's waited-for children have been
 	// scheduled in user mode, measured in clock ticks.
-	CUTime uint
+	CUTime int
 	// Amount of time that this process's waited-for children have been
 	// scheduled in kernel mode, measured in clock ticks.
-	CSTime uint
+	CSTime int
 	// For processes running a real-time scheduling policy, this is the negated
 	// scheduling priority, minus one.
 	Priority int
@@ -100,13 +100,24 @@ type ProcStat struct {
 	VSize uint
 	// Resident set size in pages.
 	RSS int
+	// Soft limit in bytes on the rss of the process.
+	RSSLimit uint64
+	// CPU number last executed on.
+	Processor uint
+	// Real-time scheduling priority, a number in the range 1 to 99 for processes
+	// scheduled under a real-time policy, or 0, for non-real-time processes.
+	RTPriority uint
+	// Scheduling policy.
+	Policy uint
+	// Aggregated block I/O delays, measured in clock ticks (centiseconds).
+	DelayAcctBlkIOTicks uint64
 
 	proc fs.FS
 }
 
 // NewStat returns the current status information of the process.
 //
-// Deprecated: use p.Stat() instead
+// Deprecated: Use p.Stat() instead.
 func (p Proc) NewStat() (ProcStat, error) {
 	return p.Stat()
 }
@@ -119,7 +130,8 @@ func (p Proc) Stat() (ProcStat, error) {
 	}
 
 	var (
-		ignore int
+		ignoreInt64  int64
+		ignoreUint64 uint64
 
 		s = ProcStat{PID: p.PID, proc: p.fs}
 		l = bytes.Index(data, []byte("("))
@@ -131,6 +143,11 @@ func (p Proc) Stat() (ProcStat, error) {
 	}
 
 	s.Comm = string(data[l+1 : r])
+
+	// Check the following resources for the details about the particular stat
+	// fields and their data types:
+	// * https://man7.org/linux/man-pages/man5/proc.5.html
+	// * https://man7.org/linux/man-pages/man3/scanf.3.html
 	_, err = fmt.Fscan(
 		bytes.NewBuffer(data[r+2:]),
 		&s.State,
@@ -151,10 +168,28 @@ func (p Proc) Stat() (ProcStat, error) {
 		&s.Priority,
 		&s.Nice,
 		&s.NumThreads,
-		&ignore,
+		&ignoreInt64,
 		&s.Starttime,
 		&s.VSize,
 		&s.RSS,
+		&s.RSSLimit,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreUint64,
+		&ignoreInt64,
+		&s.Processor,
+		&s.RTPriority,
+		&s.Policy,
+		&s.DelayAcctBlkIOTicks,
 	)
 	if err != nil {
 		return ProcStat{}, err
diff --git a/vendor/github.com/prometheus/procfs/proc_status.go b/vendor/github.com/prometheus/procfs/proc_status.go
index 6edd8333b3..3d8c06439a 100644
--- a/vendor/github.com/prometheus/procfs/proc_status.go
+++ b/vendor/github.com/prometheus/procfs/proc_status.go
@@ -33,37 +33,37 @@ type ProcStatus struct {
 	TGID int
 
 	// Peak virtual memory size.
-	VmPeak uint64 // nolint:golint
+	VmPeak uint64 // nolint:revive
 	// Virtual memory size.
-	VmSize uint64 // nolint:golint
+	VmSize uint64 // nolint:revive
 	// Locked memory size.
-	VmLck uint64 // nolint:golint
+	VmLck uint64 // nolint:revive
 	// Pinned memory size.
-	VmPin uint64 // nolint:golint
+	VmPin uint64 // nolint:revive
 	// Peak resident set size.
-	VmHWM uint64 // nolint:golint
+	VmHWM uint64 // nolint:revive
 	// Resident set size (sum of RssAnnon RssFile and RssShmem).
-	VmRSS uint64 // nolint:golint
+	VmRSS uint64 // nolint:revive
 	// Size of resident anonymous memory.
-	RssAnon uint64 // nolint:golint
+	RssAnon uint64 // nolint:revive
 	// Size of resident file mappings.
-	RssFile uint64 // nolint:golint
+	RssFile uint64 // nolint:revive
 	// Size of resident shared memory.
-	RssShmem uint64 // nolint:golint
+	RssShmem uint64 // nolint:revive
 	// Size of data segments.
-	VmData uint64 // nolint:golint
+	VmData uint64 // nolint:revive
 	// Size of stack segments.
-	VmStk uint64 // nolint:golint
+	VmStk uint64 // nolint:revive
 	// Size of text segments.
-	VmExe uint64 // nolint:golint
+	VmExe uint64 // nolint:revive
 	// Shared library code size.
-	VmLib uint64 // nolint:golint
+	VmLib uint64 // nolint:revive
 	// Page table entries size.
-	VmPTE uint64 // nolint:golint
+	VmPTE uint64 // nolint:revive
 	// Size of second-level page tables.
-	VmPMD uint64 // nolint:golint
+	VmPMD uint64 // nolint:revive
 	// Swapped-out virtual memory size by anonymous private.
-	VmSwap uint64 // nolint:golint
+	VmSwap uint64 // nolint:revive
 	// Size of hugetlb memory portions
 	HugetlbPages uint64
 
@@ -96,10 +96,10 @@ func (p Proc) NewStatus() (ProcStatus, error) {
 		kv := strings.SplitN(line, ":", 2)
 
 		// removes spaces
-		k := string(strings.TrimSpace(kv[0]))
-		v := string(strings.TrimSpace(kv[1]))
+		k := strings.TrimSpace(kv[0])
+		v := strings.TrimSpace(kv[1])
 		// removes "kB"
-		v = string(bytes.Trim([]byte(v), " kB"))
+		v = strings.TrimSuffix(v, " kB")
 
 		// value to int when possible
 		// we can skip error check here, 'cause vKBytes is not used when value is a string
diff --git a/vendor/github.com/prometheus/procfs/proc_sys.go b/vendor/github.com/prometheus/procfs/proc_sys.go
new file mode 100644
index 0000000000..d46533ebf4
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/proc_sys.go
@@ -0,0 +1,51 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+func sysctlToPath(sysctl string) string {
+	return strings.Replace(sysctl, ".", "/", -1)
+}
+
+func (fs FS) SysctlStrings(sysctl string) ([]string, error) {
+	value, err := util.SysReadFile(fs.proc.Path("sys", sysctlToPath(sysctl)))
+	if err != nil {
+		return nil, err
+	}
+	return strings.Fields(value), nil
+
+}
+
+func (fs FS) SysctlInts(sysctl string) ([]int, error) {
+	fields, err := fs.SysctlStrings(sysctl)
+	if err != nil {
+		return nil, err
+	}
+
+	values := make([]int, len(fields))
+	for i, f := range fields {
+		vp := util.NewValueParser(f)
+		values[i] = vp.Int()
+		if err := vp.Err(); err != nil {
+			return nil, fmt.Errorf("field %d in sysctl %s is not a valid int: %w", i, sysctl, err)
+		}
+	}
+	return values, nil
+}
diff --git a/vendor/github.com/prometheus/procfs/schedstat.go b/vendor/github.com/prometheus/procfs/schedstat.go
index 28228164ef..5f7f32dc83 100644
--- a/vendor/github.com/prometheus/procfs/schedstat.go
+++ b/vendor/github.com/prometheus/procfs/schedstat.go
@@ -40,7 +40,7 @@ type Schedstat struct {
 	CPUs []*SchedstatCPU
 }
 
-// SchedstatCPU contains the values from one "cpu<N>" line
+// SchedstatCPU contains the values from one "cpu<N>" line.
 type SchedstatCPU struct {
 	CPUNum string
 
@@ -49,14 +49,14 @@ type SchedstatCPU struct {
 	RunTimeslices      uint64
 }
 
-// ProcSchedstat contains the values from /proc/<pid>/schedstat
+// ProcSchedstat contains the values from `/proc/<pid>/schedstat`.
 type ProcSchedstat struct {
 	RunningNanoseconds uint64
 	WaitingNanoseconds uint64
 	RunTimeslices      uint64
 }
 
-// Schedstat reads data from /proc/schedstat
+// Schedstat reads data from `/proc/schedstat`.
 func (fs FS) Schedstat() (*Schedstat, error) {
 	file, err := os.Open(fs.proc.Path("schedstat"))
 	if err != nil {
diff --git a/vendor/github.com/prometheus/procfs/slab.go b/vendor/github.com/prometheus/procfs/slab.go
index 7896fd7242..bc9aaf5c28 100644
--- a/vendor/github.com/prometheus/procfs/slab.go
+++ b/vendor/github.com/prometheus/procfs/slab.go
@@ -137,7 +137,7 @@ func parseSlabInfo21(r *bytes.Reader) (SlabInfo, error) {
 	return s, nil
 }
 
-// SlabInfo reads data from /proc/slabinfo
+// SlabInfo reads data from `/proc/slabinfo`.
 func (fs FS) SlabInfo() (SlabInfo, error) {
 	// TODO: Consider passing options to allow for parsing different
 	// slabinfo versions. However, slabinfo 2.1 has been stable since
diff --git a/vendor/github.com/prometheus/procfs/softirqs.go b/vendor/github.com/prometheus/procfs/softirqs.go
new file mode 100644
index 0000000000..559129cbca
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/softirqs.go
@@ -0,0 +1,160 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+
+	"github.com/prometheus/procfs/internal/util"
+)
+
+// Softirqs represents the softirq statistics.
+type Softirqs struct {
+	Hi      []uint64
+	Timer   []uint64
+	NetTx   []uint64
+	NetRx   []uint64
+	Block   []uint64
+	IRQPoll []uint64
+	Tasklet []uint64
+	Sched   []uint64
+	HRTimer []uint64
+	RCU     []uint64
+}
+
+func (fs FS) Softirqs() (Softirqs, error) {
+	fileName := fs.proc.Path("softirqs")
+	data, err := util.ReadFileNoStat(fileName)
+	if err != nil {
+		return Softirqs{}, err
+	}
+
+	reader := bytes.NewReader(data)
+
+	return parseSoftirqs(reader)
+}
+
+func parseSoftirqs(r io.Reader) (Softirqs, error) {
+	var (
+		softirqs = Softirqs{}
+		scanner  = bufio.NewScanner(r)
+	)
+
+	if !scanner.Scan() {
+		return Softirqs{}, fmt.Errorf("softirqs empty")
+	}
+
+	for scanner.Scan() {
+		parts := strings.Fields(scanner.Text())
+		var err error
+
+		// require at least one cpu
+		if len(parts) < 2 {
+			continue
+		}
+		switch {
+		case parts[0] == "HI:":
+			perCPU := parts[1:]
+			softirqs.Hi = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.Hi[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (HI%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "TIMER:":
+			perCPU := parts[1:]
+			softirqs.Timer = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.Timer[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (TIMER%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "NET_TX:":
+			perCPU := parts[1:]
+			softirqs.NetTx = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.NetTx[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (NET_TX%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "NET_RX:":
+			perCPU := parts[1:]
+			softirqs.NetRx = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.NetRx[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (NET_RX%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "BLOCK:":
+			perCPU := parts[1:]
+			softirqs.Block = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.Block[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (BLOCK%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "IRQ_POLL:":
+			perCPU := parts[1:]
+			softirqs.IRQPoll = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.IRQPoll[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (IRQ_POLL%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "TASKLET:":
+			perCPU := parts[1:]
+			softirqs.Tasklet = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.Tasklet[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (TASKLET%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "SCHED:":
+			perCPU := parts[1:]
+			softirqs.Sched = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.Sched[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (SCHED%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "HRTIMER:":
+			perCPU := parts[1:]
+			softirqs.HRTimer = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.HRTimer[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (HRTIMER%d): %w", count, i, err)
+				}
+			}
+		case parts[0] == "RCU:":
+			perCPU := parts[1:]
+			softirqs.RCU = make([]uint64, len(perCPU))
+			for i, count := range perCPU {
+				if softirqs.RCU[i], err = strconv.ParseUint(count, 10, 64); err != nil {
+					return Softirqs{}, fmt.Errorf("couldn't parse %q (RCU%d): %w", count, i, err)
+				}
+			}
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return Softirqs{}, fmt.Errorf("couldn't parse softirqs: %w", err)
+	}
+
+	return softirqs, scanner.Err()
+}
diff --git a/vendor/github.com/prometheus/procfs/stat.go b/vendor/github.com/prometheus/procfs/stat.go
index 6d8727541e..586af48af9 100644
--- a/vendor/github.com/prometheus/procfs/stat.go
+++ b/vendor/github.com/prometheus/procfs/stat.go
@@ -41,7 +41,7 @@ type CPUStat struct {
 
 // SoftIRQStat represent the softirq statistics as exported in the procfs stat file.
 // A nice introduction can be found at https://0xax.gitbooks.io/linux-insides/content/interrupts/interrupts-9.html
-// It is possible to get per-cpu stats by reading /proc/softirqs
+// It is possible to get per-cpu stats by reading `/proc/softirqs`.
 type SoftIRQStat struct {
 	Hi          uint64
 	Timer       uint64
@@ -62,7 +62,7 @@ type Stat struct {
 	// Summed up cpu statistics.
 	CPUTotal CPUStat
 	// Per-CPU statistics.
-	CPU []CPUStat
+	CPU map[int64]CPUStat
 	// Number of times interrupts were handled, which contains numbered and unnumbered IRQs.
 	IRQTotal uint64
 	// Number of times a numbered IRQ was triggered.
@@ -145,7 +145,7 @@ func parseSoftIRQStat(line string) (SoftIRQStat, uint64, error) {
 // NewStat returns information about current cpu/process statistics.
 // See https://www.kernel.org/doc/Documentation/filesystems/proc.txt
 //
-// Deprecated: use fs.Stat() instead
+// Deprecated: Use fs.Stat() instead.
 func NewStat() (Stat, error) {
 	fs, err := NewFS(fs.DefaultProcMountPoint)
 	if err != nil {
@@ -155,25 +155,38 @@ func NewStat() (Stat, error) {
 }
 
 // NewStat returns information about current cpu/process statistics.
-// See https://www.kernel.org/doc/Documentation/filesystems/proc.txt
+// See: https://www.kernel.org/doc/Documentation/filesystems/proc.txt
 //
-// Deprecated: use fs.Stat() instead
+// Deprecated: Use fs.Stat() instead.
 func (fs FS) NewStat() (Stat, error) {
 	return fs.Stat()
 }
 
 // Stat returns information about current cpu/process statistics.
-// See https://www.kernel.org/doc/Documentation/filesystems/proc.txt
+// See: https://www.kernel.org/doc/Documentation/filesystems/proc.txt
 func (fs FS) Stat() (Stat, error) {
 	fileName := fs.proc.Path("stat")
 	data, err := util.ReadFileNoStat(fileName)
 	if err != nil {
 		return Stat{}, err
 	}
+	procStat, err := parseStat(bytes.NewReader(data), fileName)
+	if err != nil {
+		return Stat{}, err
+	}
+	return procStat, nil
+}
 
-	stat := Stat{}
+// parseStat parses the metrics from /proc/[pid]/stat.
+func parseStat(r io.Reader, fileName string) (Stat, error) {
+	var (
+		scanner = bufio.NewScanner(r)
+		stat    = Stat{
+			CPU: make(map[int64]CPUStat),
+		}
+		err error
+	)
 
-	scanner := bufio.NewScanner(bytes.NewReader(data))
 	for scanner.Scan() {
 		line := scanner.Text()
 		parts := strings.Fields(scanner.Text())
@@ -228,9 +241,6 @@ func (fs FS) Stat() (Stat, error) {
 			if cpuID == -1 {
 				stat.CPUTotal = cpuStat
 			} else {
-				for int64(len(stat.CPU)) <= cpuID {
-					stat.CPU = append(stat.CPU, CPUStat{})
-				}
 				stat.CPU[cpuID] = cpuStat
 			}
 		}
diff --git a/vendor/github.com/prometheus/procfs/thread.go b/vendor/github.com/prometheus/procfs/thread.go
new file mode 100644
index 0000000000..f08bfc769d
--- /dev/null
+++ b/vendor/github.com/prometheus/procfs/thread.go
@@ -0,0 +1,79 @@
+// Copyright 2022 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package procfs
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+
+	fsi "github.com/prometheus/procfs/internal/fs"
+)
+
+// Provide access to /proc/PID/task/TID files, for thread specific values. Since
+// such files have the same structure as /proc/PID/ ones, the data structures
+// and the parsers for the latter may be reused.
+
+// AllThreads returns a list of all currently available threads under /proc/PID.
+func AllThreads(pid int) (Procs, error) {
+	fs, err := NewFS(DefaultMountPoint)
+	if err != nil {
+		return Procs{}, err
+	}
+	return fs.AllThreads(pid)
+}
+
+// AllThreads returns a list of all currently available threads for PID.
+func (fs FS) AllThreads(pid int) (Procs, error) {
+	taskPath := fs.proc.Path(strconv.Itoa(pid), "task")
+	d, err := os.Open(taskPath)
+	if err != nil {
+		return Procs{}, err
+	}
+	defer d.Close()
+
+	names, err := d.Readdirnames(-1)
+	if err != nil {
+		return Procs{}, fmt.Errorf("could not read %q: %w", d.Name(), err)
+	}
+
+	t := Procs{}
+	for _, n := range names {
+		tid, err := strconv.ParseInt(n, 10, 64)
+		if err != nil {
+			continue
+		}
+		t = append(t, Proc{PID: int(tid), fs: fsi.FS(taskPath)})
+	}
+
+	return t, nil
+}
+
+// Thread returns a process for a given PID, TID.
+func (fs FS) Thread(pid, tid int) (Proc, error) {
+	taskPath := fs.proc.Path(strconv.Itoa(pid), "task")
+	if _, err := os.Stat(taskPath); err != nil {
+		return Proc{}, err
+	}
+	return Proc{PID: tid, fs: fsi.FS(taskPath)}, nil
+}
+
+// Thread returns a process for a given TID of Proc.
+func (proc Proc) Thread(tid int) (Proc, error) {
+	tfs := fsi.FS(proc.path("task"))
+	if _, err := os.Stat(tfs.Path(strconv.Itoa(tid))); err != nil {
+		return Proc{}, err
+	}
+	return Proc{PID: tid, fs: tfs}, nil
+}
diff --git a/vendor/github.com/prometheus/procfs/vm.go b/vendor/github.com/prometheus/procfs/vm.go
index cb13891414..cdedcae996 100644
--- a/vendor/github.com/prometheus/procfs/vm.go
+++ b/vendor/github.com/prometheus/procfs/vm.go
@@ -11,13 +11,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build !windows
 // +build !windows
 
 package procfs
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -26,10 +26,12 @@ import (
 )
 
 // The VM interface is described at
-//   https://www.kernel.org/doc/Documentation/sysctl/vm.txt
+//
+//	https://www.kernel.org/doc/Documentation/sysctl/vm.txt
+//
 // Each setting is exposed as a single file.
 // Each file contains one line with a single numerical value, except lowmem_reserve_ratio which holds an array
-// and numa_zonelist_order (deprecated) which is a string
+// and numa_zonelist_order (deprecated) which is a string.
 type VM struct {
 	AdminReserveKbytes        *int64   // /proc/sys/vm/admin_reserve_kbytes
 	BlockDump                 *int64   // /proc/sys/vm/block_dump
@@ -87,7 +89,7 @@ func (fs FS) VM() (*VM, error) {
 		return nil, fmt.Errorf("%s is not a directory", path)
 	}
 
-	files, err := ioutil.ReadDir(path)
+	files, err := os.ReadDir(path)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/prometheus/procfs/xfrm.go b/vendor/github.com/prometheus/procfs/xfrm.go
deleted file mode 100644
index eed07c7d77..0000000000
--- a/vendor/github.com/prometheus/procfs/xfrm.go
+++ /dev/null
@@ -1,186 +0,0 @@
-// Copyright 2017 Prometheus Team
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package procfs
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-)
-
-// XfrmStat models the contents of /proc/net/xfrm_stat.
-type XfrmStat struct {
-	// All errors which are not matched by other
-	XfrmInError int
-	// No buffer is left
-	XfrmInBufferError int
-	// Header Error
-	XfrmInHdrError int
-	// No state found
-	// i.e. either inbound SPI, address, or IPSEC protocol at SA is wrong
-	XfrmInNoStates int
-	// Transformation protocol specific error
-	// e.g. SA Key is wrong
-	XfrmInStateProtoError int
-	// Transformation mode specific error
-	XfrmInStateModeError int
-	// Sequence error
-	// e.g. sequence number is out of window
-	XfrmInStateSeqError int
-	// State is expired
-	XfrmInStateExpired int
-	// State has mismatch option
-	// e.g. UDP encapsulation type is mismatched
-	XfrmInStateMismatch int
-	// State is invalid
-	XfrmInStateInvalid int
-	// No matching template for states
-	// e.g. Inbound SAs are correct but SP rule is wrong
-	XfrmInTmplMismatch int
-	// No policy is found for states
-	// e.g. Inbound SAs are correct but no SP is found
-	XfrmInNoPols int
-	// Policy discards
-	XfrmInPolBlock int
-	// Policy error
-	XfrmInPolError int
-	// All errors which are not matched by others
-	XfrmOutError int
-	// Bundle generation error
-	XfrmOutBundleGenError int
-	// Bundle check error
-	XfrmOutBundleCheckError int
-	// No state was found
-	XfrmOutNoStates int
-	// Transformation protocol specific error
-	XfrmOutStateProtoError int
-	// Transportation mode specific error
-	XfrmOutStateModeError int
-	// Sequence error
-	// i.e sequence number overflow
-	XfrmOutStateSeqError int
-	// State is expired
-	XfrmOutStateExpired int
-	// Policy discads
-	XfrmOutPolBlock int
-	// Policy is dead
-	XfrmOutPolDead int
-	// Policy Error
-	XfrmOutPolError     int
-	XfrmFwdHdrError     int
-	XfrmOutStateInvalid int
-	XfrmAcquireError    int
-}
-
-// NewXfrmStat reads the xfrm_stat statistics.
-func NewXfrmStat() (XfrmStat, error) {
-	fs, err := NewFS(DefaultMountPoint)
-	if err != nil {
-		return XfrmStat{}, err
-	}
-
-	return fs.NewXfrmStat()
-}
-
-// NewXfrmStat reads the xfrm_stat statistics from the 'proc' filesystem.
-func (fs FS) NewXfrmStat() (XfrmStat, error) {
-	file, err := os.Open(fs.proc.Path("net/xfrm_stat"))
-	if err != nil {
-		return XfrmStat{}, err
-	}
-	defer file.Close()
-
-	var (
-		x = XfrmStat{}
-		s = bufio.NewScanner(file)
-	)
-
-	for s.Scan() {
-		fields := strings.Fields(s.Text())
-
-		if len(fields) != 2 {
-			return XfrmStat{}, fmt.Errorf("couldn't parse %q line %q", file.Name(), s.Text())
-		}
-
-		name := fields[0]
-		value, err := strconv.Atoi(fields[1])
-		if err != nil {
-			return XfrmStat{}, err
-		}
-
-		switch name {
-		case "XfrmInError":
-			x.XfrmInError = value
-		case "XfrmInBufferError":
-			x.XfrmInBufferError = value
-		case "XfrmInHdrError":
-			x.XfrmInHdrError = value
-		case "XfrmInNoStates":
-			x.XfrmInNoStates = value
-		case "XfrmInStateProtoError":
-			x.XfrmInStateProtoError = value
-		case "XfrmInStateModeError":
-			x.XfrmInStateModeError = value
-		case "XfrmInStateSeqError":
-			x.XfrmInStateSeqError = value
-		case "XfrmInStateExpired":
-			x.XfrmInStateExpired = value
-		case "XfrmInStateInvalid":
-			x.XfrmInStateInvalid = value
-		case "XfrmInTmplMismatch":
-			x.XfrmInTmplMismatch = value
-		case "XfrmInNoPols":
-			x.XfrmInNoPols = value
-		case "XfrmInPolBlock":
-			x.XfrmInPolBlock = value
-		case "XfrmInPolError":
-			x.XfrmInPolError = value
-		case "XfrmOutError":
-			x.XfrmOutError = value
-		case "XfrmInStateMismatch":
-			x.XfrmInStateMismatch = value
-		case "XfrmOutBundleGenError":
-			x.XfrmOutBundleGenError = value
-		case "XfrmOutBundleCheckError":
-			x.XfrmOutBundleCheckError = value
-		case "XfrmOutNoStates":
-			x.XfrmOutNoStates = value
-		case "XfrmOutStateProtoError":
-			x.XfrmOutStateProtoError = value
-		case "XfrmOutStateModeError":
-			x.XfrmOutStateModeError = value
-		case "XfrmOutStateSeqError":
-			x.XfrmOutStateSeqError = value
-		case "XfrmOutStateExpired":
-			x.XfrmOutStateExpired = value
-		case "XfrmOutPolBlock":
-			x.XfrmOutPolBlock = value
-		case "XfrmOutPolDead":
-			x.XfrmOutPolDead = value
-		case "XfrmOutPolError":
-			x.XfrmOutPolError = value
-		case "XfrmFwdHdrError":
-			x.XfrmFwdHdrError = value
-		case "XfrmOutStateInvalid":
-			x.XfrmOutStateInvalid = value
-		case "XfrmAcquireError":
-			x.XfrmAcquireError = value
-		}
-
-	}
-
-	return x, s.Err()
-}
diff --git a/vendor/github.com/prometheus/procfs/zoneinfo.go b/vendor/github.com/prometheus/procfs/zoneinfo.go
index 0b9bb6796b..c745a4c04f 100644
--- a/vendor/github.com/prometheus/procfs/zoneinfo.go
+++ b/vendor/github.com/prometheus/procfs/zoneinfo.go
@@ -11,6 +11,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+//go:build !windows
 // +build !windows
 
 package procfs
@@ -18,7 +19,7 @@ package procfs
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"regexp"
 	"strings"
 
@@ -72,7 +73,7 @@ var nodeZoneRE = regexp.MustCompile(`(\d+), zone\s+(\w+)`)
 // structs containing the relevant info.  More information available here:
 // https://www.kernel.org/doc/Documentation/sysctl/vm.txt
 func (fs FS) Zoneinfo() ([]Zoneinfo, error) {
-	data, err := ioutil.ReadFile(fs.proc.Path("zoneinfo"))
+	data, err := os.ReadFile(fs.proc.Path("zoneinfo"))
 	if err != nil {
 		return nil, fmt.Errorf("error reading zoneinfo %q: %w", fs.proc.Path("zoneinfo"), err)
 	}
@@ -99,7 +100,6 @@ func parseZoneinfo(zoneinfoData []byte) ([]Zoneinfo, error) {
 				continue
 			}
 			if strings.HasPrefix(strings.TrimSpace(line), "per-node stats") {
-				zoneinfoElement.Zone = ""
 				continue
 			}
 			parts := strings.Fields(strings.TrimSpace(line))
diff --git a/vendor/github.com/rogpeppe/go-internal/LICENSE b/vendor/github.com/rogpeppe/go-internal/LICENSE
new file mode 100644
index 0000000000..49ea0f9288
--- /dev/null
+++ b/vendor/github.com/rogpeppe/go-internal/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2018 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/rogpeppe/go-internal/fmtsort/mapelem.go b/vendor/github.com/rogpeppe/go-internal/fmtsort/mapelem.go
new file mode 100644
index 0000000000..4e4c29459e
--- /dev/null
+++ b/vendor/github.com/rogpeppe/go-internal/fmtsort/mapelem.go
@@ -0,0 +1,23 @@
+//go:build go1.12
+// +build go1.12
+
+package fmtsort
+
+import "reflect"
+
+const brokenNaNs = false
+
+func mapElems(mapValue reflect.Value) ([]reflect.Value, []reflect.Value) {
+	// Note: this code is arranged to not panic even in the presence
+	// of a concurrent map update. The runtime is responsible for
+	// yelling loudly if that happens. See issue 33275.
+	n := mapValue.Len()
+	key := make([]reflect.Value, 0, n)
+	value := make([]reflect.Value, 0, n)
+	iter := mapValue.MapRange()
+	for iter.Next() {
+		key = append(key, iter.Key())
+		value = append(value, iter.Value())
+	}
+	return key, value
+}
diff --git a/vendor/github.com/rogpeppe/go-internal/fmtsort/mapelem_1.11.go b/vendor/github.com/rogpeppe/go-internal/fmtsort/mapelem_1.11.go
new file mode 100644
index 0000000000..873bf7f5e8
--- /dev/null
+++ b/vendor/github.com/rogpeppe/go-internal/fmtsort/mapelem_1.11.go
@@ -0,0 +1,24 @@
+//go:build !go1.12
+// +build !go1.12
+
+package fmtsort
+
+import "reflect"
+
+const brokenNaNs = true
+
+func mapElems(mapValue reflect.Value) ([]reflect.Value, []reflect.Value) {
+	key := mapValue.MapKeys()
+	value := make([]reflect.Value, 0, len(key))
+	for _, k := range key {
+		v := mapValue.MapIndex(k)
+		if !v.IsValid() {
+			// Note: we can't retrieve the value, probably because
+			// the key is NaN, so just do the best we can and
+			// add a zero value of the correct type in that case.
+			v = reflect.Zero(mapValue.Type().Elem())
+		}
+		value = append(value, v)
+	}
+	return key, value
+}
diff --git a/vendor/github.com/rogpeppe/go-internal/fmtsort/sort.go b/vendor/github.com/rogpeppe/go-internal/fmtsort/sort.go
new file mode 100644
index 0000000000..0fb5187dd8
--- /dev/null
+++ b/vendor/github.com/rogpeppe/go-internal/fmtsort/sort.go
@@ -0,0 +1,210 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package fmtsort provides a general stable ordering mechanism
+// for maps, on behalf of the fmt and text/template packages.
+// It is not guaranteed to be efficient and works only for types
+// that are valid map keys.
+package fmtsort
+
+import (
+	"reflect"
+	"sort"
+)
+
+// Note: Throughout this package we avoid calling reflect.Value.Interface as
+// it is not always legal to do so and it's easier to avoid the issue than to face it.
+
+// SortedMap represents a map's keys and values. The keys and values are
+// aligned in index order: Value[i] is the value in the map corresponding to Key[i].
+type SortedMap struct {
+	Key   []reflect.Value
+	Value []reflect.Value
+}
+
+func (o *SortedMap) Len() int           { return len(o.Key) }
+func (o *SortedMap) Less(i, j int) bool { return compare(o.Key[i], o.Key[j]) < 0 }
+func (o *SortedMap) Swap(i, j int) {
+	o.Key[i], o.Key[j] = o.Key[j], o.Key[i]
+	o.Value[i], o.Value[j] = o.Value[j], o.Value[i]
+}
+
+// Sort accepts a map and returns a SortedMap that has the same keys and
+// values but in a stable sorted order according to the keys, modulo issues
+// raised by unorderable key values such as NaNs.
+//
+// The ordering rules are more general than with Go's < operator:
+//
+//  - when applicable, nil compares low
+//  - ints, floats, and strings order by <
+//  - NaN compares less than non-NaN floats
+//  - bool compares false before true
+//  - complex compares real, then imag
+//  - pointers compare by machine address
+//  - channel values compare by machine address
+//  - structs compare each field in turn
+//  - arrays compare each element in turn.
+//    Otherwise identical arrays compare by length.
+//  - interface values compare first by reflect.Type describing the concrete type
+//    and then by concrete value as described in the previous rules.
+//
+func Sort(mapValue reflect.Value) *SortedMap {
+	if mapValue.Type().Kind() != reflect.Map {
+		return nil
+	}
+	key, value := mapElems(mapValue)
+	sorted := &SortedMap{
+		Key:   key,
+		Value: value,
+	}
+	sort.Stable(sorted)
+	return sorted
+}
+
+// compare compares two values of the same type. It returns -1, 0, 1
+// according to whether a > b (1), a == b (0), or a < b (-1).
+// If the types differ, it returns -1.
+// See the comment on Sort for the comparison rules.
+func compare(aVal, bVal reflect.Value) int {
+	aType, bType := aVal.Type(), bVal.Type()
+	if aType != bType {
+		return -1 // No good answer possible, but don't return 0: they're not equal.
+	}
+	switch aVal.Kind() {
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		a, b := aVal.Int(), bVal.Int()
+		switch {
+		case a < b:
+			return -1
+		case a > b:
+			return 1
+		default:
+			return 0
+		}
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		a, b := aVal.Uint(), bVal.Uint()
+		switch {
+		case a < b:
+			return -1
+		case a > b:
+			return 1
+		default:
+			return 0
+		}
+	case reflect.String:
+		a, b := aVal.String(), bVal.String()
+		switch {
+		case a < b:
+			return -1
+		case a > b:
+			return 1
+		default:
+			return 0
+		}
+	case reflect.Float32, reflect.Float64:
+		return floatCompare(aVal.Float(), bVal.Float())
+	case reflect.Complex64, reflect.Complex128:
+		a, b := aVal.Complex(), bVal.Complex()
+		if c := floatCompare(real(a), real(b)); c != 0 {
+			return c
+		}
+		return floatCompare(imag(a), imag(b))
+	case reflect.Bool:
+		a, b := aVal.Bool(), bVal.Bool()
+		switch {
+		case a == b:
+			return 0
+		case a:
+			return 1
+		default:
+			return -1
+		}
+	case reflect.Ptr:
+		a, b := aVal.Pointer(), bVal.Pointer()
+		switch {
+		case a < b:
+			return -1
+		case a > b:
+			return 1
+		default:
+			return 0
+		}
+	case reflect.Chan:
+		if c, ok := nilCompare(aVal, bVal); ok {
+			return c
+		}
+		ap, bp := aVal.Pointer(), bVal.Pointer()
+		switch {
+		case ap < bp:
+			return -1
+		case ap > bp:
+			return 1
+		default:
+			return 0
+		}
+	case reflect.Struct:
+		for i := 0; i < aVal.NumField(); i++ {
+			if c := compare(aVal.Field(i), bVal.Field(i)); c != 0 {
+				return c
+			}
+		}
+		return 0
+	case reflect.Array:
+		for i := 0; i < aVal.Len(); i++ {
+			if c := compare(aVal.Index(i), bVal.Index(i)); c != 0 {
+				return c
+			}
+		}
+		return 0
+	case reflect.Interface:
+		if c, ok := nilCompare(aVal, bVal); ok {
+			return c
+		}
+		c := compare(reflect.ValueOf(aVal.Elem().Type()), reflect.ValueOf(bVal.Elem().Type()))
+		if c != 0 {
+			return c
+		}
+		return compare(aVal.Elem(), bVal.Elem())
+	default:
+		// Certain types cannot appear as keys (maps, funcs, slices), but be explicit.
+		panic("bad type in compare: " + aType.String())
+	}
+}
+
+// nilCompare checks whether either value is nil. If not, the boolean is false.
+// If either value is nil, the boolean is true and the integer is the comparison
+// value. The comparison is defined to be 0 if both are nil, otherwise the one
+// nil value compares low. Both arguments must represent a chan, func,
+// interface, map, pointer, or slice.
+func nilCompare(aVal, bVal reflect.Value) (int, bool) {
+	if aVal.IsNil() {
+		if bVal.IsNil() {
+			return 0, true
+		}
+		return -1, true
+	}
+	if bVal.IsNil() {
+		return 1, true
+	}
+	return 0, false
+}
+
+// floatCompare compares two floating-point values. NaNs compare low.
+func floatCompare(a, b float64) int {
+	switch {
+	case isNaN(a):
+		return -1 // No good answer if b is a NaN so don't bother checking.
+	case isNaN(b):
+		return 1
+	case a < b:
+		return -1
+	case a > b:
+		return 1
+	}
+	return 0
+}
+
+func isNaN(a float64) bool {
+	return a != a
+}
diff --git a/vendor/github.com/russross/blackfriday/v2/README.md b/vendor/github.com/russross/blackfriday/v2/README.md
index d5a8649bd5..d9c08a22fc 100644
--- a/vendor/github.com/russross/blackfriday/v2/README.md
+++ b/vendor/github.com/russross/blackfriday/v2/README.md
@@ -1,4 +1,6 @@
-Blackfriday [![Build Status](https://travis-ci.org/russross/blackfriday.svg?branch=master)](https://travis-ci.org/russross/blackfriday)
+Blackfriday
+[![Build Status][BuildV2SVG]][BuildV2URL]
+[![PkgGoDev][PkgGoDevV2SVG]][PkgGoDevV2URL]
 ===========
 
 Blackfriday is a [Markdown][1] processor implemented in [Go][2]. It
@@ -16,19 +18,21 @@ It started as a translation from C of [Sundown][3].
 Installation
 ------------
 
-Blackfriday is compatible with any modern Go release. With Go 1.7 and git
-installed:
+Blackfriday is compatible with modern Go releases in module mode.
+With Go installed:
 
-    go get gopkg.in/russross/blackfriday.v2
+    go get github.com/russross/blackfriday/v2
 
-will download, compile, and install the package into your `$GOPATH`
-directory hierarchy. Alternatively, you can achieve the same if you
-import it into a project:
+will resolve and add the package to the current development module,
+then build and install it. Alternatively, you can achieve the same
+if you import it in a package:
 
-    import "gopkg.in/russross/blackfriday.v2"
+    import "github.com/russross/blackfriday/v2"
 
 and `go get` without parameters.
 
+Legacy GOPATH mode is unsupported.
+
 
 Versions
 --------
@@ -36,13 +40,9 @@ Versions
 Currently maintained and recommended version of Blackfriday is `v2`. It's being
 developed on its own branch: https://github.com/russross/blackfriday/tree/v2 and the
 documentation is available at
-https://godoc.org/gopkg.in/russross/blackfriday.v2.
+https://pkg.go.dev/github.com/russross/blackfriday/v2.
 
-It is `go get`-able via via [gopkg.in][6] at `gopkg.in/russross/blackfriday.v2`,
-but we highly recommend using package management tool like [dep][7] or
-[Glide][8] and make use of semantic versioning. With package management you
-should import `github.com/russross/blackfriday` and specify that you're using
-version 2.0.0.
+It is `go get`-able in module mode at `github.com/russross/blackfriday/v2`.
 
 Version 2 offers a number of improvements over v1:
 
@@ -62,6 +62,11 @@ Potential drawbacks:
   v2. See issue [#348](https://github.com/russross/blackfriday/issues/348) for
   tracking.
 
+If you are still interested in the legacy `v1`, you can import it from
+`github.com/russross/blackfriday`. Documentation for the legacy v1 can be found
+here: https://pkg.go.dev/github.com/russross/blackfriday.
+
+
 Usage
 -----
 
@@ -91,7 +96,7 @@ Here's an example of simple usage of Blackfriday together with Bluemonday:
 ```go
 import (
     "github.com/microcosm-cc/bluemonday"
-    "github.com/russross/blackfriday"
+    "github.com/russross/blackfriday/v2"
 )
 
 // ...
@@ -104,6 +109,8 @@ html := bluemonday.UGCPolicy().SanitizeBytes(unsafe)
 If you want to customize the set of options, use `blackfriday.WithExtensions`,
 `blackfriday.WithRenderer` and `blackfriday.WithRefOverride`.
 
+### `blackfriday-tool`
+
 You can also check out `blackfriday-tool` for a more complete example
 of how to use it. Download and install it using:
 
@@ -114,7 +121,7 @@ markdown file using a standalone program.  You can also browse the
 source directly on github if you are just looking for some example
 code:
 
-* <http://github.com/russross/blackfriday-tool>
+* <https://github.com/russross/blackfriday-tool>
 
 Note that if you have not already done so, installing
 `blackfriday-tool` will be sufficient to download and install
@@ -123,6 +130,22 @@ installed in `$GOPATH/bin`.  This is a statically-linked binary that
 can be copied to wherever you need it without worrying about
 dependencies and library versions.
 
+### Sanitized anchor names
+
+Blackfriday includes an algorithm for creating sanitized anchor names
+corresponding to a given input text. This algorithm is used to create
+anchors for headings when `AutoHeadingIDs` extension is enabled. The
+algorithm has a specification, so that other packages can create
+compatible anchor names and links to those anchors.
+
+The specification is located at https://pkg.go.dev/github.com/russross/blackfriday/v2#hdr-Sanitized_Anchor_Names.
+
+[`SanitizedAnchorName`](https://pkg.go.dev/github.com/russross/blackfriday/v2#SanitizedAnchorName) exposes this functionality, and can be used to
+create compatible links to the anchor names generated by blackfriday.
+This algorithm is also implemented in a small standalone package at
+[`github.com/shurcooL/sanitized_anchor_name`](https://pkg.go.dev/github.com/shurcooL/sanitized_anchor_name). It can be useful for clients
+that want a small package and don't need full functionality of blackfriday.
+
 
 Features
 --------
@@ -199,6 +222,15 @@ implements the following extensions:
     You can use 3 or more backticks to mark the beginning of the
     block, and the same number to mark the end of the block.
 
+    To preserve classes of fenced code blocks while using the bluemonday
+    HTML sanitizer, use the following policy:
+
+    ```go
+    p := bluemonday.UGCPolicy()
+    p.AllowAttrs("class").Matching(regexp.MustCompile("^language-[a-zA-Z0-9]+$")).OnElements("code")
+    html := p.SanitizeBytes(unsafe)
+    ```
+
 *   **Definition lists**. A simple definition list is made of a single-line
     term followed by a colon and the definition for that term.
 
@@ -250,7 +282,7 @@ Other renderers
 Blackfriday is structured to allow alternative rendering engines. Here
 are a few of note:
 
-*   [github_flavored_markdown](https://godoc.org/github.com/shurcooL/github_flavored_markdown):
+*   [github_flavored_markdown](https://pkg.go.dev/github.com/shurcooL/github_flavored_markdown):
     provides a GitHub Flavored Markdown renderer with fenced code block
     highlighting, clickable heading anchor links.
 
@@ -261,20 +293,28 @@ are a few of note:
 *   [markdownfmt](https://github.com/shurcooL/markdownfmt): like gofmt,
     but for markdown.
 
-*   [LaTeX output](https://github.com/Ambrevar/Blackfriday-LaTeX):
+*   [LaTeX output](https://gitlab.com/ambrevar/blackfriday-latex):
     renders output as LaTeX.
 
+*   [bfchroma](https://github.com/Depado/bfchroma/): provides convenience
+    integration with the [Chroma](https://github.com/alecthomas/chroma) code
+    highlighting library. bfchroma is only compatible with v2 of Blackfriday and
+    provides a drop-in renderer ready to use with Blackfriday, as well as
+    options and means for further customization.
+
 *   [Blackfriday-Confluence](https://github.com/kentaro-m/blackfriday-confluence): provides a [Confluence Wiki Markup](https://confluence.atlassian.com/doc/confluence-wiki-markup-251003035.html) renderer.
 
+*   [Blackfriday-Slack](https://github.com/karriereat/blackfriday-slack): converts markdown to slack message style
+
 
-Todo
+TODO
 ----
 
 *   More unit testing
-*   Improve unicode support. It does not understand all unicode
+*   Improve Unicode support. It does not understand all Unicode
     rules (about what constitutes a letter, a punctuation symbol,
     etc.), so it may fail to detect word boundaries correctly in
-    some instances. It is safe on all utf-8 input.
+    some instances. It is safe on all UTF-8 input.
 
 
 License
@@ -286,6 +326,10 @@ License
    [1]: https://daringfireball.net/projects/markdown/ "Markdown"
    [2]: https://golang.org/ "Go Language"
    [3]: https://github.com/vmg/sundown "Sundown"
-   [4]: https://godoc.org/gopkg.in/russross/blackfriday.v2#Parse "Parse func"
+   [4]: https://pkg.go.dev/github.com/russross/blackfriday/v2#Parse "Parse func"
    [5]: https://github.com/microcosm-cc/bluemonday "Bluemonday"
-   [6]: https://labix.org/gopkg.in "gopkg.in"
+
+   [BuildV2SVG]: https://travis-ci.org/russross/blackfriday.svg?branch=v2
+   [BuildV2URL]: https://travis-ci.org/russross/blackfriday
+   [PkgGoDevV2SVG]: https://pkg.go.dev/badge/github.com/russross/blackfriday/v2
+   [PkgGoDevV2URL]: https://pkg.go.dev/github.com/russross/blackfriday/v2
diff --git a/vendor/github.com/russross/blackfriday/v2/block.go b/vendor/github.com/russross/blackfriday/v2/block.go
index b8607474e5..dcd61e6e35 100644
--- a/vendor/github.com/russross/blackfriday/v2/block.go
+++ b/vendor/github.com/russross/blackfriday/v2/block.go
@@ -18,8 +18,7 @@ import (
 	"html"
 	"regexp"
 	"strings"
-
-	"github.com/shurcooL/sanitized_anchor_name"
+	"unicode"
 )
 
 const (
@@ -259,7 +258,7 @@ func (p *Markdown) prefixHeading(data []byte) int {
 	}
 	if end > i {
 		if id == "" && p.extensions&AutoHeadingIDs != 0 {
-			id = sanitized_anchor_name.Create(string(data[i:end]))
+			id = SanitizedAnchorName(string(data[i:end]))
 		}
 		block := p.addBlock(Heading, data[i:end])
 		block.HeadingID = id
@@ -673,6 +672,7 @@ func (p *Markdown) fencedCodeBlock(data []byte, doRender bool) int {
 	if beg == 0 || beg >= len(data) {
 		return 0
 	}
+	fenceLength := beg - 1
 
 	var work bytes.Buffer
 	work.Write([]byte(info))
@@ -706,6 +706,7 @@ func (p *Markdown) fencedCodeBlock(data []byte, doRender bool) int {
 	if doRender {
 		block := p.addBlock(CodeBlock, work.Bytes()) // TODO: get rid of temp buffer
 		block.IsFenced = true
+		block.FenceLength = fenceLength
 		finalizeCodeBlock(block)
 	}
 
@@ -1503,7 +1504,7 @@ func (p *Markdown) paragraph(data []byte) int {
 
 				id := ""
 				if p.extensions&AutoHeadingIDs != 0 {
-					id = sanitized_anchor_name.Create(string(data[prev:eol]))
+					id = SanitizedAnchorName(string(data[prev:eol]))
 				}
 
 				block := p.addBlock(Heading, data[prev:eol])
@@ -1588,3 +1589,24 @@ func skipUntilChar(text []byte, start int, char byte) int {
 	}
 	return i
 }
+
+// SanitizedAnchorName returns a sanitized anchor name for the given text.
+//
+// It implements the algorithm specified in the package comment.
+func SanitizedAnchorName(text string) string {
+	var anchorName []rune
+	futureDash := false
+	for _, r := range text {
+		switch {
+		case unicode.IsLetter(r) || unicode.IsNumber(r):
+			if futureDash && len(anchorName) > 0 {
+				anchorName = append(anchorName, '-')
+			}
+			futureDash = false
+			anchorName = append(anchorName, unicode.ToLower(r))
+		default:
+			futureDash = true
+		}
+	}
+	return string(anchorName)
+}
diff --git a/vendor/github.com/russross/blackfriday/v2/doc.go b/vendor/github.com/russross/blackfriday/v2/doc.go
index 5b3fa9876a..57ff152a05 100644
--- a/vendor/github.com/russross/blackfriday/v2/doc.go
+++ b/vendor/github.com/russross/blackfriday/v2/doc.go
@@ -15,4 +15,32 @@
 //
 // If you're interested in calling Blackfriday from command line, see
 // https://github.com/russross/blackfriday-tool.
+//
+// Sanitized Anchor Names
+//
+// Blackfriday includes an algorithm for creating sanitized anchor names
+// corresponding to a given input text. This algorithm is used to create
+// anchors for headings when AutoHeadingIDs extension is enabled. The
+// algorithm is specified below, so that other packages can create
+// compatible anchor names and links to those anchors.
+//
+// The algorithm iterates over the input text, interpreted as UTF-8,
+// one Unicode code point (rune) at a time. All runes that are letters (category L)
+// or numbers (category N) are considered valid characters. They are mapped to
+// lower case, and included in the output. All other runes are considered
+// invalid characters. Invalid characters that precede the first valid character,
+// as well as invalid character that follow the last valid character
+// are dropped completely. All other sequences of invalid characters
+// between two valid characters are replaced with a single dash character '-'.
+//
+// SanitizedAnchorName exposes this functionality, and can be used to
+// create compatible links to the anchor names generated by blackfriday.
+// This algorithm is also implemented in a small standalone package at
+// github.com/shurcooL/sanitized_anchor_name. It can be useful for clients
+// that want a small package and don't need full functionality of blackfriday.
 package blackfriday
+
+// NOTE: Keep Sanitized Anchor Name algorithm in sync with package
+//       github.com/shurcooL/sanitized_anchor_name.
+//       Otherwise, users of sanitized_anchor_name will get anchor names
+//       that are incompatible with those generated by blackfriday.
diff --git a/vendor/github.com/russross/blackfriday/v2/entities.go b/vendor/github.com/russross/blackfriday/v2/entities.go
new file mode 100644
index 0000000000..a2c3edb691
--- /dev/null
+++ b/vendor/github.com/russross/blackfriday/v2/entities.go
@@ -0,0 +1,2236 @@
+package blackfriday
+
+// Extracted from https://html.spec.whatwg.org/multipage/entities.json
+var entities = map[string]bool{
+	"&AElig":                            true,
+	"&AElig;":                           true,
+	"&AMP":                              true,
+	"&AMP;":                             true,
+	"&Aacute":                           true,
+	"&Aacute;":                          true,
+	"&Abreve;":                          true,
+	"&Acirc":                            true,
+	"&Acirc;":                           true,
+	"&Acy;":                             true,
+	"&Afr;":                             true,
+	"&Agrave":                           true,
+	"&Agrave;":                          true,
+	"&Alpha;":                           true,
+	"&Amacr;":                           true,
+	"&And;":                             true,
+	"&Aogon;":                           true,
+	"&Aopf;":                            true,
+	"&ApplyFunction;":                   true,
+	"&Aring":                            true,
+	"&Aring;":                           true,
+	"&Ascr;":                            true,
+	"&Assign;":                          true,
+	"&Atilde":                           true,
+	"&Atilde;":                          true,
+	"&Auml":                             true,
+	"&Auml;":                            true,
+	"&Backslash;":                       true,
+	"&Barv;":                            true,
+	"&Barwed;":                          true,
+	"&Bcy;":                             true,
+	"&Because;":                         true,
+	"&Bernoullis;":                      true,
+	"&Beta;":                            true,
+	"&Bfr;":                             true,
+	"&Bopf;":                            true,
+	"&Breve;":                           true,
+	"&Bscr;":                            true,
+	"&Bumpeq;":                          true,
+	"&CHcy;":                            true,
+	"&COPY":                             true,
+	"&COPY;":                            true,
+	"&Cacute;":                          true,
+	"&Cap;":                             true,
+	"&CapitalDifferentialD;":            true,
+	"&Cayleys;":                         true,
+	"&Ccaron;":                          true,
+	"&Ccedil":                           true,
+	"&Ccedil;":                          true,
+	"&Ccirc;":                           true,
+	"&Cconint;":                         true,
+	"&Cdot;":                            true,
+	"&Cedilla;":                         true,
+	"&CenterDot;":                       true,
+	"&Cfr;":                             true,
+	"&Chi;":                             true,
+	"&CircleDot;":                       true,
+	"&CircleMinus;":                     true,
+	"&CirclePlus;":                      true,
+	"&CircleTimes;":                     true,
+	"&ClockwiseContourIntegral;":        true,
+	"&CloseCurlyDoubleQuote;":           true,
+	"&CloseCurlyQuote;":                 true,
+	"&Colon;":                           true,
+	"&Colone;":                          true,
+	"&Congruent;":                       true,
+	"&Conint;":                          true,
+	"&ContourIntegral;":                 true,
+	"&Copf;":                            true,
+	"&Coproduct;":                       true,
+	"&CounterClockwiseContourIntegral;": true,
+	"&Cross;":                           true,
+	"&Cscr;":                            true,
+	"&Cup;":                             true,
+	"&CupCap;":                          true,
+	"&DD;":                              true,
+	"&DDotrahd;":                        true,
+	"&DJcy;":                            true,
+	"&DScy;":                            true,
+	"&DZcy;":                            true,
+	"&Dagger;":                          true,
+	"&Darr;":                            true,
+	"&Dashv;":                           true,
+	"&Dcaron;":                          true,
+	"&Dcy;":                             true,
+	"&Del;":                             true,
+	"&Delta;":                           true,
+	"&Dfr;":                             true,
+	"&DiacriticalAcute;":                true,
+	"&DiacriticalDot;":                  true,
+	"&DiacriticalDoubleAcute;":          true,
+	"&DiacriticalGrave;":                true,
+	"&DiacriticalTilde;":                true,
+	"&Diamond;":                         true,
+	"&DifferentialD;":                   true,
+	"&Dopf;":                            true,
+	"&Dot;":                             true,
+	"&DotDot;":                          true,
+	"&DotEqual;":                        true,
+	"&DoubleContourIntegral;":           true,
+	"&DoubleDot;":                       true,
+	"&DoubleDownArrow;":                 true,
+	"&DoubleLeftArrow;":                 true,
+	"&DoubleLeftRightArrow;":            true,
+	"&DoubleLeftTee;":                   true,
+	"&DoubleLongLeftArrow;":             true,
+	"&DoubleLongLeftRightArrow;":        true,
+	"&DoubleLongRightArrow;":            true,
+	"&DoubleRightArrow;":                true,
+	"&DoubleRightTee;":                  true,
+	"&DoubleUpArrow;":                   true,
+	"&DoubleUpDownArrow;":               true,
+	"&DoubleVerticalBar;":               true,
+	"&DownArrow;":                       true,
+	"&DownArrowBar;":                    true,
+	"&DownArrowUpArrow;":                true,
+	"&DownBreve;":                       true,
+	"&DownLeftRightVector;":             true,
+	"&DownLeftTeeVector;":               true,
+	"&DownLeftVector;":                  true,
+	"&DownLeftVectorBar;":               true,
+	"&DownRightTeeVector;":              true,
+	"&DownRightVector;":                 true,
+	"&DownRightVectorBar;":              true,
+	"&DownTee;":                         true,
+	"&DownTeeArrow;":                    true,
+	"&Downarrow;":                       true,
+	"&Dscr;":                            true,
+	"&Dstrok;":                          true,
+	"&ENG;":                             true,
+	"&ETH":                              true,
+	"&ETH;":                             true,
+	"&Eacute":                           true,
+	"&Eacute;":                          true,
+	"&Ecaron;":                          true,
+	"&Ecirc":                            true,
+	"&Ecirc;":                           true,
+	"&Ecy;":                             true,
+	"&Edot;":                            true,
+	"&Efr;":                             true,
+	"&Egrave":                           true,
+	"&Egrave;":                          true,
+	"&Element;":                         true,
+	"&Emacr;":                           true,
+	"&EmptySmallSquare;":                true,
+	"&EmptyVerySmallSquare;":            true,
+	"&Eogon;":                           true,
+	"&Eopf;":                            true,
+	"&Epsilon;":                         true,
+	"&Equal;":                           true,
+	"&EqualTilde;":                      true,
+	"&Equilibrium;":                     true,
+	"&Escr;":                            true,
+	"&Esim;":                            true,
+	"&Eta;":                             true,
+	"&Euml":                             true,
+	"&Euml;":                            true,
+	"&Exists;":                          true,
+	"&ExponentialE;":                    true,
+	"&Fcy;":                             true,
+	"&Ffr;":                             true,
+	"&FilledSmallSquare;":               true,
+	"&FilledVerySmallSquare;":           true,
+	"&Fopf;":                            true,
+	"&ForAll;":                          true,
+	"&Fouriertrf;":                      true,
+	"&Fscr;":                            true,
+	"&GJcy;":                            true,
+	"&GT":                               true,
+	"&GT;":                              true,
+	"&Gamma;":                           true,
+	"&Gammad;":                          true,
+	"&Gbreve;":                          true,
+	"&Gcedil;":                          true,
+	"&Gcirc;":                           true,
+	"&Gcy;":                             true,
+	"&Gdot;":                            true,
+	"&Gfr;":                             true,
+	"&Gg;":                              true,
+	"&Gopf;":                            true,
+	"&GreaterEqual;":                    true,
+	"&GreaterEqualLess;":                true,
+	"&GreaterFullEqual;":                true,
+	"&GreaterGreater;":                  true,
+	"&GreaterLess;":                     true,
+	"&GreaterSlantEqual;":               true,
+	"&GreaterTilde;":                    true,
+	"&Gscr;":                            true,
+	"&Gt;":                              true,
+	"&HARDcy;":                          true,
+	"&Hacek;":                           true,
+	"&Hat;":                             true,
+	"&Hcirc;":                           true,
+	"&Hfr;":                             true,
+	"&HilbertSpace;":                    true,
+	"&Hopf;":                            true,
+	"&HorizontalLine;":                  true,
+	"&Hscr;":                            true,
+	"&Hstrok;":                          true,
+	"&HumpDownHump;":                    true,
+	"&HumpEqual;":                       true,
+	"&IEcy;":                            true,
+	"&IJlig;":                           true,
+	"&IOcy;":                            true,
+	"&Iacute":                           true,
+	"&Iacute;":                          true,
+	"&Icirc":                            true,
+	"&Icirc;":                           true,
+	"&Icy;":                             true,
+	"&Idot;":                            true,
+	"&Ifr;":                             true,
+	"&Igrave":                           true,
+	"&Igrave;":                          true,
+	"&Im;":                              true,
+	"&Imacr;":                           true,
+	"&ImaginaryI;":                      true,
+	"&Implies;":                         true,
+	"&Int;":                             true,
+	"&Integral;":                        true,
+	"&Intersection;":                    true,
+	"&InvisibleComma;":                  true,
+	"&InvisibleTimes;":                  true,
+	"&Iogon;":                           true,
+	"&Iopf;":                            true,
+	"&Iota;":                            true,
+	"&Iscr;":                            true,
+	"&Itilde;":                          true,
+	"&Iukcy;":                           true,
+	"&Iuml":                             true,
+	"&Iuml;":                            true,
+	"&Jcirc;":                           true,
+	"&Jcy;":                             true,
+	"&Jfr;":                             true,
+	"&Jopf;":                            true,
+	"&Jscr;":                            true,
+	"&Jsercy;":                          true,
+	"&Jukcy;":                           true,
+	"&KHcy;":                            true,
+	"&KJcy;":                            true,
+	"&Kappa;":                           true,
+	"&Kcedil;":                          true,
+	"&Kcy;":                             true,
+	"&Kfr;":                             true,
+	"&Kopf;":                            true,
+	"&Kscr;":                            true,
+	"&LJcy;":                            true,
+	"&LT":                               true,
+	"&LT;":                              true,
+	"&Lacute;":                          true,
+	"&Lambda;":                          true,
+	"&Lang;":                            true,
+	"&Laplacetrf;":                      true,
+	"&Larr;":                            true,
+	"&Lcaron;":                          true,
+	"&Lcedil;":                          true,
+	"&Lcy;":                             true,
+	"&LeftAngleBracket;":                true,
+	"&LeftArrow;":                       true,
+	"&LeftArrowBar;":                    true,
+	"&LeftArrowRightArrow;":             true,
+	"&LeftCeiling;":                     true,
+	"&LeftDoubleBracket;":               true,
+	"&LeftDownTeeVector;":               true,
+	"&LeftDownVector;":                  true,
+	"&LeftDownVectorBar;":               true,
+	"&LeftFloor;":                       true,
+	"&LeftRightArrow;":                  true,
+	"&LeftRightVector;":                 true,
+	"&LeftTee;":                         true,
+	"&LeftTeeArrow;":                    true,
+	"&LeftTeeVector;":                   true,
+	"&LeftTriangle;":                    true,
+	"&LeftTriangleBar;":                 true,
+	"&LeftTriangleEqual;":               true,
+	"&LeftUpDownVector;":                true,
+	"&LeftUpTeeVector;":                 true,
+	"&LeftUpVector;":                    true,
+	"&LeftUpVectorBar;":                 true,
+	"&LeftVector;":                      true,
+	"&LeftVectorBar;":                   true,
+	"&Leftarrow;":                       true,
+	"&Leftrightarrow;":                  true,
+	"&LessEqualGreater;":                true,
+	"&LessFullEqual;":                   true,
+	"&LessGreater;":                     true,
+	"&LessLess;":                        true,
+	"&LessSlantEqual;":                  true,
+	"&LessTilde;":                       true,
+	"&Lfr;":                             true,
+	"&Ll;":                              true,
+	"&Lleftarrow;":                      true,
+	"&Lmidot;":                          true,
+	"&LongLeftArrow;":                   true,
+	"&LongLeftRightArrow;":              true,
+	"&LongRightArrow;":                  true,
+	"&Longleftarrow;":                   true,
+	"&Longleftrightarrow;":              true,
+	"&Longrightarrow;":                  true,
+	"&Lopf;":                            true,
+	"&LowerLeftArrow;":                  true,
+	"&LowerRightArrow;":                 true,
+	"&Lscr;":                            true,
+	"&Lsh;":                             true,
+	"&Lstrok;":                          true,
+	"&Lt;":                              true,
+	"&Map;":                             true,
+	"&Mcy;":                             true,
+	"&MediumSpace;":                     true,
+	"&Mellintrf;":                       true,
+	"&Mfr;":                             true,
+	"&MinusPlus;":                       true,
+	"&Mopf;":                            true,
+	"&Mscr;":                            true,
+	"&Mu;":                              true,
+	"&NJcy;":                            true,
+	"&Nacute;":                          true,
+	"&Ncaron;":                          true,
+	"&Ncedil;":                          true,
+	"&Ncy;":                             true,
+	"&NegativeMediumSpace;":             true,
+	"&NegativeThickSpace;":              true,
+	"&NegativeThinSpace;":               true,
+	"&NegativeVeryThinSpace;":           true,
+	"&NestedGreaterGreater;":            true,
+	"&NestedLessLess;":                  true,
+	"&NewLine;":                         true,
+	"&Nfr;":                             true,
+	"&NoBreak;":                         true,
+	"&NonBreakingSpace;":                true,
+	"&Nopf;":                            true,
+	"&Not;":                             true,
+	"&NotCongruent;":                    true,
+	"&NotCupCap;":                       true,
+	"&NotDoubleVerticalBar;":            true,
+	"&NotElement;":                      true,
+	"&NotEqual;":                        true,
+	"&NotEqualTilde;":                   true,
+	"&NotExists;":                       true,
+	"&NotGreater;":                      true,
+	"&NotGreaterEqual;":                 true,
+	"&NotGreaterFullEqual;":             true,
+	"&NotGreaterGreater;":               true,
+	"&NotGreaterLess;":                  true,
+	"&NotGreaterSlantEqual;":            true,
+	"&NotGreaterTilde;":                 true,
+	"&NotHumpDownHump;":                 true,
+	"&NotHumpEqual;":                    true,
+	"&NotLeftTriangle;":                 true,
+	"&NotLeftTriangleBar;":              true,
+	"&NotLeftTriangleEqual;":            true,
+	"&NotLess;":                         true,
+	"&NotLessEqual;":                    true,
+	"&NotLessGreater;":                  true,
+	"&NotLessLess;":                     true,
+	"&NotLessSlantEqual;":               true,
+	"&NotLessTilde;":                    true,
+	"&NotNestedGreaterGreater;":         true,
+	"&NotNestedLessLess;":               true,
+	"&NotPrecedes;":                     true,
+	"&NotPrecedesEqual;":                true,
+	"&NotPrecedesSlantEqual;":           true,
+	"&NotReverseElement;":               true,
+	"&NotRightTriangle;":                true,
+	"&NotRightTriangleBar;":             true,
+	"&NotRightTriangleEqual;":           true,
+	"&NotSquareSubset;":                 true,
+	"&NotSquareSubsetEqual;":            true,
+	"&NotSquareSuperset;":               true,
+	"&NotSquareSupersetEqual;":          true,
+	"&NotSubset;":                       true,
+	"&NotSubsetEqual;":                  true,
+	"&NotSucceeds;":                     true,
+	"&NotSucceedsEqual;":                true,
+	"&NotSucceedsSlantEqual;":           true,
+	"&NotSucceedsTilde;":                true,
+	"&NotSuperset;":                     true,
+	"&NotSupersetEqual;":                true,
+	"&NotTilde;":                        true,
+	"&NotTildeEqual;":                   true,
+	"&NotTildeFullEqual;":               true,
+	"&NotTildeTilde;":                   true,
+	"&NotVerticalBar;":                  true,
+	"&Nscr;":                            true,
+	"&Ntilde":                           true,
+	"&Ntilde;":                          true,
+	"&Nu;":                              true,
+	"&OElig;":                           true,
+	"&Oacute":                           true,
+	"&Oacute;":                          true,
+	"&Ocirc":                            true,
+	"&Ocirc;":                           true,
+	"&Ocy;":                             true,
+	"&Odblac;":                          true,
+	"&Ofr;":                             true,
+	"&Ograve":                           true,
+	"&Ograve;":                          true,
+	"&Omacr;":                           true,
+	"&Omega;":                           true,
+	"&Omicron;":                         true,
+	"&Oopf;":                            true,
+	"&OpenCurlyDoubleQuote;":            true,
+	"&OpenCurlyQuote;":                  true,
+	"&Or;":                              true,
+	"&Oscr;":                            true,
+	"&Oslash":                           true,
+	"&Oslash;":                          true,
+	"&Otilde":                           true,
+	"&Otilde;":                          true,
+	"&Otimes;":                          true,
+	"&Ouml":                             true,
+	"&Ouml;":                            true,
+	"&OverBar;":                         true,
+	"&OverBrace;":                       true,
+	"&OverBracket;":                     true,
+	"&OverParenthesis;":                 true,
+	"&PartialD;":                        true,
+	"&Pcy;":                             true,
+	"&Pfr;":                             true,
+	"&Phi;":                             true,
+	"&Pi;":                              true,
+	"&PlusMinus;":                       true,
+	"&Poincareplane;":                   true,
+	"&Popf;":                            true,
+	"&Pr;":                              true,
+	"&Precedes;":                        true,
+	"&PrecedesEqual;":                   true,
+	"&PrecedesSlantEqual;":              true,
+	"&PrecedesTilde;":                   true,
+	"&Prime;":                           true,
+	"&Product;":                         true,
+	"&Proportion;":                      true,
+	"&Proportional;":                    true,
+	"&Pscr;":                            true,
+	"&Psi;":                             true,
+	"&QUOT":                             true,
+	"&QUOT;":                            true,
+	"&Qfr;":                             true,
+	"&Qopf;":                            true,
+	"&Qscr;":                            true,
+	"&RBarr;":                           true,
+	"&REG":                              true,
+	"&REG;":                             true,
+	"&Racute;":                          true,
+	"&Rang;":                            true,
+	"&Rarr;":                            true,
+	"&Rarrtl;":                          true,
+	"&Rcaron;":                          true,
+	"&Rcedil;":                          true,
+	"&Rcy;":                             true,
+	"&Re;":                              true,
+	"&ReverseElement;":                  true,
+	"&ReverseEquilibrium;":              true,
+	"&ReverseUpEquilibrium;":            true,
+	"&Rfr;":                             true,
+	"&Rho;":                             true,
+	"&RightAngleBracket;":               true,
+	"&RightArrow;":                      true,
+	"&RightArrowBar;":                   true,
+	"&RightArrowLeftArrow;":             true,
+	"&RightCeiling;":                    true,
+	"&RightDoubleBracket;":              true,
+	"&RightDownTeeVector;":              true,
+	"&RightDownVector;":                 true,
+	"&RightDownVectorBar;":              true,
+	"&RightFloor;":                      true,
+	"&RightTee;":                        true,
+	"&RightTeeArrow;":                   true,
+	"&RightTeeVector;":                  true,
+	"&RightTriangle;":                   true,
+	"&RightTriangleBar;":                true,
+	"&RightTriangleEqual;":              true,
+	"&RightUpDownVector;":               true,
+	"&RightUpTeeVector;":                true,
+	"&RightUpVector;":                   true,
+	"&RightUpVectorBar;":                true,
+	"&RightVector;":                     true,
+	"&RightVectorBar;":                  true,
+	"&Rightarrow;":                      true,
+	"&Ropf;":                            true,
+	"&RoundImplies;":                    true,
+	"&Rrightarrow;":                     true,
+	"&Rscr;":                            true,
+	"&Rsh;":                             true,
+	"&RuleDelayed;":                     true,
+	"&SHCHcy;":                          true,
+	"&SHcy;":                            true,
+	"&SOFTcy;":                          true,
+	"&Sacute;":                          true,
+	"&Sc;":                              true,
+	"&Scaron;":                          true,
+	"&Scedil;":                          true,
+	"&Scirc;":                           true,
+	"&Scy;":                             true,
+	"&Sfr;":                             true,
+	"&ShortDownArrow;":                  true,
+	"&ShortLeftArrow;":                  true,
+	"&ShortRightArrow;":                 true,
+	"&ShortUpArrow;":                    true,
+	"&Sigma;":                           true,
+	"&SmallCircle;":                     true,
+	"&Sopf;":                            true,
+	"&Sqrt;":                            true,
+	"&Square;":                          true,
+	"&SquareIntersection;":              true,
+	"&SquareSubset;":                    true,
+	"&SquareSubsetEqual;":               true,
+	"&SquareSuperset;":                  true,
+	"&SquareSupersetEqual;":             true,
+	"&SquareUnion;":                     true,
+	"&Sscr;":                            true,
+	"&Star;":                            true,
+	"&Sub;":                             true,
+	"&Subset;":                          true,
+	"&SubsetEqual;":                     true,
+	"&Succeeds;":                        true,
+	"&SucceedsEqual;":                   true,
+	"&SucceedsSlantEqual;":              true,
+	"&SucceedsTilde;":                   true,
+	"&SuchThat;":                        true,
+	"&Sum;":                             true,
+	"&Sup;":                             true,
+	"&Superset;":                        true,
+	"&SupersetEqual;":                   true,
+	"&Supset;":                          true,
+	"&THORN":                            true,
+	"&THORN;":                           true,
+	"&TRADE;":                           true,
+	"&TSHcy;":                           true,
+	"&TScy;":                            true,
+	"&Tab;":                             true,
+	"&Tau;":                             true,
+	"&Tcaron;":                          true,
+	"&Tcedil;":                          true,
+	"&Tcy;":                             true,
+	"&Tfr;":                             true,
+	"&Therefore;":                       true,
+	"&Theta;":                           true,
+	"&ThickSpace;":                      true,
+	"&ThinSpace;":                       true,
+	"&Tilde;":                           true,
+	"&TildeEqual;":                      true,
+	"&TildeFullEqual;":                  true,
+	"&TildeTilde;":                      true,
+	"&Topf;":                            true,
+	"&TripleDot;":                       true,
+	"&Tscr;":                            true,
+	"&Tstrok;":                          true,
+	"&Uacute":                           true,
+	"&Uacute;":                          true,
+	"&Uarr;":                            true,
+	"&Uarrocir;":                        true,
+	"&Ubrcy;":                           true,
+	"&Ubreve;":                          true,
+	"&Ucirc":                            true,
+	"&Ucirc;":                           true,
+	"&Ucy;":                             true,
+	"&Udblac;":                          true,
+	"&Ufr;":                             true,
+	"&Ugrave":                           true,
+	"&Ugrave;":                          true,
+	"&Umacr;":                           true,
+	"&UnderBar;":                        true,
+	"&UnderBrace;":                      true,
+	"&UnderBracket;":                    true,
+	"&UnderParenthesis;":                true,
+	"&Union;":                           true,
+	"&UnionPlus;":                       true,
+	"&Uogon;":                           true,
+	"&Uopf;":                            true,
+	"&UpArrow;":                         true,
+	"&UpArrowBar;":                      true,
+	"&UpArrowDownArrow;":                true,
+	"&UpDownArrow;":                     true,
+	"&UpEquilibrium;":                   true,
+	"&UpTee;":                           true,
+	"&UpTeeArrow;":                      true,
+	"&Uparrow;":                         true,
+	"&Updownarrow;":                     true,
+	"&UpperLeftArrow;":                  true,
+	"&UpperRightArrow;":                 true,
+	"&Upsi;":                            true,
+	"&Upsilon;":                         true,
+	"&Uring;":                           true,
+	"&Uscr;":                            true,
+	"&Utilde;":                          true,
+	"&Uuml":                             true,
+	"&Uuml;":                            true,
+	"&VDash;":                           true,
+	"&Vbar;":                            true,
+	"&Vcy;":                             true,
+	"&Vdash;":                           true,
+	"&Vdashl;":                          true,
+	"&Vee;":                             true,
+	"&Verbar;":                          true,
+	"&Vert;":                            true,
+	"&VerticalBar;":                     true,
+	"&VerticalLine;":                    true,
+	"&VerticalSeparator;":               true,
+	"&VerticalTilde;":                   true,
+	"&VeryThinSpace;":                   true,
+	"&Vfr;":                             true,
+	"&Vopf;":                            true,
+	"&Vscr;":                            true,
+	"&Vvdash;":                          true,
+	"&Wcirc;":                           true,
+	"&Wedge;":                           true,
+	"&Wfr;":                             true,
+	"&Wopf;":                            true,
+	"&Wscr;":                            true,
+	"&Xfr;":                             true,
+	"&Xi;":                              true,
+	"&Xopf;":                            true,
+	"&Xscr;":                            true,
+	"&YAcy;":                            true,
+	"&YIcy;":                            true,
+	"&YUcy;":                            true,
+	"&Yacute":                           true,
+	"&Yacute;":                          true,
+	"&Ycirc;":                           true,
+	"&Ycy;":                             true,
+	"&Yfr;":                             true,
+	"&Yopf;":                            true,
+	"&Yscr;":                            true,
+	"&Yuml;":                            true,
+	"&ZHcy;":                            true,
+	"&Zacute;":                          true,
+	"&Zcaron;":                          true,
+	"&Zcy;":                             true,
+	"&Zdot;":                            true,
+	"&ZeroWidthSpace;":                  true,
+	"&Zeta;":                            true,
+	"&Zfr;":                             true,
+	"&Zopf;":                            true,
+	"&Zscr;":                            true,
+	"&aacute":                           true,
+	"&aacute;":                          true,
+	"&abreve;":                          true,
+	"&ac;":                              true,
+	"&acE;":                             true,
+	"&acd;":                             true,
+	"&acirc":                            true,
+	"&acirc;":                           true,
+	"&acute":                            true,
+	"&acute;":                           true,
+	"&acy;":                             true,
+	"&aelig":                            true,
+	"&aelig;":                           true,
+	"&af;":                              true,
+	"&afr;":                             true,
+	"&agrave":                           true,
+	"&agrave;":                          true,
+	"&alefsym;":                         true,
+	"&aleph;":                           true,
+	"&alpha;":                           true,
+	"&amacr;":                           true,
+	"&amalg;":                           true,
+	"&amp":                              true,
+	"&amp;":                             true,
+	"&and;":                             true,
+	"&andand;":                          true,
+	"&andd;":                            true,
+	"&andslope;":                        true,
+	"&andv;":                            true,
+	"&ang;":                             true,
+	"&ange;":                            true,
+	"&angle;":                           true,
+	"&angmsd;":                          true,
+	"&angmsdaa;":                        true,
+	"&angmsdab;":                        true,
+	"&angmsdac;":                        true,
+	"&angmsdad;":                        true,
+	"&angmsdae;":                        true,
+	"&angmsdaf;":                        true,
+	"&angmsdag;":                        true,
+	"&angmsdah;":                        true,
+	"&angrt;":                           true,
+	"&angrtvb;":                         true,
+	"&angrtvbd;":                        true,
+	"&angsph;":                          true,
+	"&angst;":                           true,
+	"&angzarr;":                         true,
+	"&aogon;":                           true,
+	"&aopf;":                            true,
+	"&ap;":                              true,
+	"&apE;":                             true,
+	"&apacir;":                          true,
+	"&ape;":                             true,
+	"&apid;":                            true,
+	"&apos;":                            true,
+	"&approx;":                          true,
+	"&approxeq;":                        true,
+	"&aring":                            true,
+	"&aring;":                           true,
+	"&ascr;":                            true,
+	"&ast;":                             true,
+	"&asymp;":                           true,
+	"&asympeq;":                         true,
+	"&atilde":                           true,
+	"&atilde;":                          true,
+	"&auml":                             true,
+	"&auml;":                            true,
+	"&awconint;":                        true,
+	"&awint;":                           true,
+	"&bNot;":                            true,
+	"&backcong;":                        true,
+	"&backepsilon;":                     true,
+	"&backprime;":                       true,
+	"&backsim;":                         true,
+	"&backsimeq;":                       true,
+	"&barvee;":                          true,
+	"&barwed;":                          true,
+	"&barwedge;":                        true,
+	"&bbrk;":                            true,
+	"&bbrktbrk;":                        true,
+	"&bcong;":                           true,
+	"&bcy;":                             true,
+	"&bdquo;":                           true,
+	"&becaus;":                          true,
+	"&because;":                         true,
+	"&bemptyv;":                         true,
+	"&bepsi;":                           true,
+	"&bernou;":                          true,
+	"&beta;":                            true,
+	"&beth;":                            true,
+	"&between;":                         true,
+	"&bfr;":                             true,
+	"&bigcap;":                          true,
+	"&bigcirc;":                         true,
+	"&bigcup;":                          true,
+	"&bigodot;":                         true,
+	"&bigoplus;":                        true,
+	"&bigotimes;":                       true,
+	"&bigsqcup;":                        true,
+	"&bigstar;":                         true,
+	"&bigtriangledown;":                 true,
+	"&bigtriangleup;":                   true,
+	"&biguplus;":                        true,
+	"&bigvee;":                          true,
+	"&bigwedge;":                        true,
+	"&bkarow;":                          true,
+	"&blacklozenge;":                    true,
+	"&blacksquare;":                     true,
+	"&blacktriangle;":                   true,
+	"&blacktriangledown;":               true,
+	"&blacktriangleleft;":               true,
+	"&blacktriangleright;":              true,
+	"&blank;":                           true,
+	"&blk12;":                           true,
+	"&blk14;":                           true,
+	"&blk34;":                           true,
+	"&block;":                           true,
+	"&bne;":                             true,
+	"&bnequiv;":                         true,
+	"&bnot;":                            true,
+	"&bopf;":                            true,
+	"&bot;":                             true,
+	"&bottom;":                          true,
+	"&bowtie;":                          true,
+	"&boxDL;":                           true,
+	"&boxDR;":                           true,
+	"&boxDl;":                           true,
+	"&boxDr;":                           true,
+	"&boxH;":                            true,
+	"&boxHD;":                           true,
+	"&boxHU;":                           true,
+	"&boxHd;":                           true,
+	"&boxHu;":                           true,
+	"&boxUL;":                           true,
+	"&boxUR;":                           true,
+	"&boxUl;":                           true,
+	"&boxUr;":                           true,
+	"&boxV;":                            true,
+	"&boxVH;":                           true,
+	"&boxVL;":                           true,
+	"&boxVR;":                           true,
+	"&boxVh;":                           true,
+	"&boxVl;":                           true,
+	"&boxVr;":                           true,
+	"&boxbox;":                          true,
+	"&boxdL;":                           true,
+	"&boxdR;":                           true,
+	"&boxdl;":                           true,
+	"&boxdr;":                           true,
+	"&boxh;":                            true,
+	"&boxhD;":                           true,
+	"&boxhU;":                           true,
+	"&boxhd;":                           true,
+	"&boxhu;":                           true,
+	"&boxminus;":                        true,
+	"&boxplus;":                         true,
+	"&boxtimes;":                        true,
+	"&boxuL;":                           true,
+	"&boxuR;":                           true,
+	"&boxul;":                           true,
+	"&boxur;":                           true,
+	"&boxv;":                            true,
+	"&boxvH;":                           true,
+	"&boxvL;":                           true,
+	"&boxvR;":                           true,
+	"&boxvh;":                           true,
+	"&boxvl;":                           true,
+	"&boxvr;":                           true,
+	"&bprime;":                          true,
+	"&breve;":                           true,
+	"&brvbar":                           true,
+	"&brvbar;":                          true,
+	"&bscr;":                            true,
+	"&bsemi;":                           true,
+	"&bsim;":                            true,
+	"&bsime;":                           true,
+	"&bsol;":                            true,
+	"&bsolb;":                           true,
+	"&bsolhsub;":                        true,
+	"&bull;":                            true,
+	"&bullet;":                          true,
+	"&bump;":                            true,
+	"&bumpE;":                           true,
+	"&bumpe;":                           true,
+	"&bumpeq;":                          true,
+	"&cacute;":                          true,
+	"&cap;":                             true,
+	"&capand;":                          true,
+	"&capbrcup;":                        true,
+	"&capcap;":                          true,
+	"&capcup;":                          true,
+	"&capdot;":                          true,
+	"&caps;":                            true,
+	"&caret;":                           true,
+	"&caron;":                           true,
+	"&ccaps;":                           true,
+	"&ccaron;":                          true,
+	"&ccedil":                           true,
+	"&ccedil;":                          true,
+	"&ccirc;":                           true,
+	"&ccups;":                           true,
+	"&ccupssm;":                         true,
+	"&cdot;":                            true,
+	"&cedil":                            true,
+	"&cedil;":                           true,
+	"&cemptyv;":                         true,
+	"&cent":                             true,
+	"&cent;":                            true,
+	"&centerdot;":                       true,
+	"&cfr;":                             true,
+	"&chcy;":                            true,
+	"&check;":                           true,
+	"&checkmark;":                       true,
+	"&chi;":                             true,
+	"&cir;":                             true,
+	"&cirE;":                            true,
+	"&circ;":                            true,
+	"&circeq;":                          true,
+	"&circlearrowleft;":                 true,
+	"&circlearrowright;":                true,
+	"&circledR;":                        true,
+	"&circledS;":                        true,
+	"&circledast;":                      true,
+	"&circledcirc;":                     true,
+	"&circleddash;":                     true,
+	"&cire;":                            true,
+	"&cirfnint;":                        true,
+	"&cirmid;":                          true,
+	"&cirscir;":                         true,
+	"&clubs;":                           true,
+	"&clubsuit;":                        true,
+	"&colon;":                           true,
+	"&colone;":                          true,
+	"&coloneq;":                         true,
+	"&comma;":                           true,
+	"&commat;":                          true,
+	"&comp;":                            true,
+	"&compfn;":                          true,
+	"&complement;":                      true,
+	"&complexes;":                       true,
+	"&cong;":                            true,
+	"&congdot;":                         true,
+	"&conint;":                          true,
+	"&copf;":                            true,
+	"&coprod;":                          true,
+	"&copy":                             true,
+	"&copy;":                            true,
+	"&copysr;":                          true,
+	"&crarr;":                           true,
+	"&cross;":                           true,
+	"&cscr;":                            true,
+	"&csub;":                            true,
+	"&csube;":                           true,
+	"&csup;":                            true,
+	"&csupe;":                           true,
+	"&ctdot;":                           true,
+	"&cudarrl;":                         true,
+	"&cudarrr;":                         true,
+	"&cuepr;":                           true,
+	"&cuesc;":                           true,
+	"&cularr;":                          true,
+	"&cularrp;":                         true,
+	"&cup;":                             true,
+	"&cupbrcap;":                        true,
+	"&cupcap;":                          true,
+	"&cupcup;":                          true,
+	"&cupdot;":                          true,
+	"&cupor;":                           true,
+	"&cups;":                            true,
+	"&curarr;":                          true,
+	"&curarrm;":                         true,
+	"&curlyeqprec;":                     true,
+	"&curlyeqsucc;":                     true,
+	"&curlyvee;":                        true,
+	"&curlywedge;":                      true,
+	"&curren":                           true,
+	"&curren;":                          true,
+	"&curvearrowleft;":                  true,
+	"&curvearrowright;":                 true,
+	"&cuvee;":                           true,
+	"&cuwed;":                           true,
+	"&cwconint;":                        true,
+	"&cwint;":                           true,
+	"&cylcty;":                          true,
+	"&dArr;":                            true,
+	"&dHar;":                            true,
+	"&dagger;":                          true,
+	"&daleth;":                          true,
+	"&darr;":                            true,
+	"&dash;":                            true,
+	"&dashv;":                           true,
+	"&dbkarow;":                         true,
+	"&dblac;":                           true,
+	"&dcaron;":                          true,
+	"&dcy;":                             true,
+	"&dd;":                              true,
+	"&ddagger;":                         true,
+	"&ddarr;":                           true,
+	"&ddotseq;":                         true,
+	"&deg":                              true,
+	"&deg;":                             true,
+	"&delta;":                           true,
+	"&demptyv;":                         true,
+	"&dfisht;":                          true,
+	"&dfr;":                             true,
+	"&dharl;":                           true,
+	"&dharr;":                           true,
+	"&diam;":                            true,
+	"&diamond;":                         true,
+	"&diamondsuit;":                     true,
+	"&diams;":                           true,
+	"&die;":                             true,
+	"&digamma;":                         true,
+	"&disin;":                           true,
+	"&div;":                             true,
+	"&divide":                           true,
+	"&divide;":                          true,
+	"&divideontimes;":                   true,
+	"&divonx;":                          true,
+	"&djcy;":                            true,
+	"&dlcorn;":                          true,
+	"&dlcrop;":                          true,
+	"&dollar;":                          true,
+	"&dopf;":                            true,
+	"&dot;":                             true,
+	"&doteq;":                           true,
+	"&doteqdot;":                        true,
+	"&dotminus;":                        true,
+	"&dotplus;":                         true,
+	"&dotsquare;":                       true,
+	"&doublebarwedge;":                  true,
+	"&downarrow;":                       true,
+	"&downdownarrows;":                  true,
+	"&downharpoonleft;":                 true,
+	"&downharpoonright;":                true,
+	"&drbkarow;":                        true,
+	"&drcorn;":                          true,
+	"&drcrop;":                          true,
+	"&dscr;":                            true,
+	"&dscy;":                            true,
+	"&dsol;":                            true,
+	"&dstrok;":                          true,
+	"&dtdot;":                           true,
+	"&dtri;":                            true,
+	"&dtrif;":                           true,
+	"&duarr;":                           true,
+	"&duhar;":                           true,
+	"&dwangle;":                         true,
+	"&dzcy;":                            true,
+	"&dzigrarr;":                        true,
+	"&eDDot;":                           true,
+	"&eDot;":                            true,
+	"&eacute":                           true,
+	"&eacute;":                          true,
+	"&easter;":                          true,
+	"&ecaron;":                          true,
+	"&ecir;":                            true,
+	"&ecirc":                            true,
+	"&ecirc;":                           true,
+	"&ecolon;":                          true,
+	"&ecy;":                             true,
+	"&edot;":                            true,
+	"&ee;":                              true,
+	"&efDot;":                           true,
+	"&efr;":                             true,
+	"&eg;":                              true,
+	"&egrave":                           true,
+	"&egrave;":                          true,
+	"&egs;":                             true,
+	"&egsdot;":                          true,
+	"&el;":                              true,
+	"&elinters;":                        true,
+	"&ell;":                             true,
+	"&els;":                             true,
+	"&elsdot;":                          true,
+	"&emacr;":                           true,
+	"&empty;":                           true,
+	"&emptyset;":                        true,
+	"&emptyv;":                          true,
+	"&emsp13;":                          true,
+	"&emsp14;":                          true,
+	"&emsp;":                            true,
+	"&eng;":                             true,
+	"&ensp;":                            true,
+	"&eogon;":                           true,
+	"&eopf;":                            true,
+	"&epar;":                            true,
+	"&eparsl;":                          true,
+	"&eplus;":                           true,
+	"&epsi;":                            true,
+	"&epsilon;":                         true,
+	"&epsiv;":                           true,
+	"&eqcirc;":                          true,
+	"&eqcolon;":                         true,
+	"&eqsim;":                           true,
+	"&eqslantgtr;":                      true,
+	"&eqslantless;":                     true,
+	"&equals;":                          true,
+	"&equest;":                          true,
+	"&equiv;":                           true,
+	"&equivDD;":                         true,
+	"&eqvparsl;":                        true,
+	"&erDot;":                           true,
+	"&erarr;":                           true,
+	"&escr;":                            true,
+	"&esdot;":                           true,
+	"&esim;":                            true,
+	"&eta;":                             true,
+	"&eth":                              true,
+	"&eth;":                             true,
+	"&euml":                             true,
+	"&euml;":                            true,
+	"&euro;":                            true,
+	"&excl;":                            true,
+	"&exist;":                           true,
+	"&expectation;":                     true,
+	"&exponentiale;":                    true,
+	"&fallingdotseq;":                   true,
+	"&fcy;":                             true,
+	"&female;":                          true,
+	"&ffilig;":                          true,
+	"&fflig;":                           true,
+	"&ffllig;":                          true,
+	"&ffr;":                             true,
+	"&filig;":                           true,
+	"&fjlig;":                           true,
+	"&flat;":                            true,
+	"&fllig;":                           true,
+	"&fltns;":                           true,
+	"&fnof;":                            true,
+	"&fopf;":                            true,
+	"&forall;":                          true,
+	"&fork;":                            true,
+	"&forkv;":                           true,
+	"&fpartint;":                        true,
+	"&frac12":                           true,
+	"&frac12;":                          true,
+	"&frac13;":                          true,
+	"&frac14":                           true,
+	"&frac14;":                          true,
+	"&frac15;":                          true,
+	"&frac16;":                          true,
+	"&frac18;":                          true,
+	"&frac23;":                          true,
+	"&frac25;":                          true,
+	"&frac34":                           true,
+	"&frac34;":                          true,
+	"&frac35;":                          true,
+	"&frac38;":                          true,
+	"&frac45;":                          true,
+	"&frac56;":                          true,
+	"&frac58;":                          true,
+	"&frac78;":                          true,
+	"&frasl;":                           true,
+	"&frown;":                           true,
+	"&fscr;":                            true,
+	"&gE;":                              true,
+	"&gEl;":                             true,
+	"&gacute;":                          true,
+	"&gamma;":                           true,
+	"&gammad;":                          true,
+	"&gap;":                             true,
+	"&gbreve;":                          true,
+	"&gcirc;":                           true,
+	"&gcy;":                             true,
+	"&gdot;":                            true,
+	"&ge;":                              true,
+	"&gel;":                             true,
+	"&geq;":                             true,
+	"&geqq;":                            true,
+	"&geqslant;":                        true,
+	"&ges;":                             true,
+	"&gescc;":                           true,
+	"&gesdot;":                          true,
+	"&gesdoto;":                         true,
+	"&gesdotol;":                        true,
+	"&gesl;":                            true,
+	"&gesles;":                          true,
+	"&gfr;":                             true,
+	"&gg;":                              true,
+	"&ggg;":                             true,
+	"&gimel;":                           true,
+	"&gjcy;":                            true,
+	"&gl;":                              true,
+	"&glE;":                             true,
+	"&gla;":                             true,
+	"&glj;":                             true,
+	"&gnE;":                             true,
+	"&gnap;":                            true,
+	"&gnapprox;":                        true,
+	"&gne;":                             true,
+	"&gneq;":                            true,
+	"&gneqq;":                           true,
+	"&gnsim;":                           true,
+	"&gopf;":                            true,
+	"&grave;":                           true,
+	"&gscr;":                            true,
+	"&gsim;":                            true,
+	"&gsime;":                           true,
+	"&gsiml;":                           true,
+	"&gt":                               true,
+	"&gt;":                              true,
+	"&gtcc;":                            true,
+	"&gtcir;":                           true,
+	"&gtdot;":                           true,
+	"&gtlPar;":                          true,
+	"&gtquest;":                         true,
+	"&gtrapprox;":                       true,
+	"&gtrarr;":                          true,
+	"&gtrdot;":                          true,
+	"&gtreqless;":                       true,
+	"&gtreqqless;":                      true,
+	"&gtrless;":                         true,
+	"&gtrsim;":                          true,
+	"&gvertneqq;":                       true,
+	"&gvnE;":                            true,
+	"&hArr;":                            true,
+	"&hairsp;":                          true,
+	"&half;":                            true,
+	"&hamilt;":                          true,
+	"&hardcy;":                          true,
+	"&harr;":                            true,
+	"&harrcir;":                         true,
+	"&harrw;":                           true,
+	"&hbar;":                            true,
+	"&hcirc;":                           true,
+	"&hearts;":                          true,
+	"&heartsuit;":                       true,
+	"&hellip;":                          true,
+	"&hercon;":                          true,
+	"&hfr;":                             true,
+	"&hksearow;":                        true,
+	"&hkswarow;":                        true,
+	"&hoarr;":                           true,
+	"&homtht;":                          true,
+	"&hookleftarrow;":                   true,
+	"&hookrightarrow;":                  true,
+	"&hopf;":                            true,
+	"&horbar;":                          true,
+	"&hscr;":                            true,
+	"&hslash;":                          true,
+	"&hstrok;":                          true,
+	"&hybull;":                          true,
+	"&hyphen;":                          true,
+	"&iacute":                           true,
+	"&iacute;":                          true,
+	"&ic;":                              true,
+	"&icirc":                            true,
+	"&icirc;":                           true,
+	"&icy;":                             true,
+	"&iecy;":                            true,
+	"&iexcl":                            true,
+	"&iexcl;":                           true,
+	"&iff;":                             true,
+	"&ifr;":                             true,
+	"&igrave":                           true,
+	"&igrave;":                          true,
+	"&ii;":                              true,
+	"&iiiint;":                          true,
+	"&iiint;":                           true,
+	"&iinfin;":                          true,
+	"&iiota;":                           true,
+	"&ijlig;":                           true,
+	"&imacr;":                           true,
+	"&image;":                           true,
+	"&imagline;":                        true,
+	"&imagpart;":                        true,
+	"&imath;":                           true,
+	"&imof;":                            true,
+	"&imped;":                           true,
+	"&in;":                              true,
+	"&incare;":                          true,
+	"&infin;":                           true,
+	"&infintie;":                        true,
+	"&inodot;":                          true,
+	"&int;":                             true,
+	"&intcal;":                          true,
+	"&integers;":                        true,
+	"&intercal;":                        true,
+	"&intlarhk;":                        true,
+	"&intprod;":                         true,
+	"&iocy;":                            true,
+	"&iogon;":                           true,
+	"&iopf;":                            true,
+	"&iota;":                            true,
+	"&iprod;":                           true,
+	"&iquest":                           true,
+	"&iquest;":                          true,
+	"&iscr;":                            true,
+	"&isin;":                            true,
+	"&isinE;":                           true,
+	"&isindot;":                         true,
+	"&isins;":                           true,
+	"&isinsv;":                          true,
+	"&isinv;":                           true,
+	"&it;":                              true,
+	"&itilde;":                          true,
+	"&iukcy;":                           true,
+	"&iuml":                             true,
+	"&iuml;":                            true,
+	"&jcirc;":                           true,
+	"&jcy;":                             true,
+	"&jfr;":                             true,
+	"&jmath;":                           true,
+	"&jopf;":                            true,
+	"&jscr;":                            true,
+	"&jsercy;":                          true,
+	"&jukcy;":                           true,
+	"&kappa;":                           true,
+	"&kappav;":                          true,
+	"&kcedil;":                          true,
+	"&kcy;":                             true,
+	"&kfr;":                             true,
+	"&kgreen;":                          true,
+	"&khcy;":                            true,
+	"&kjcy;":                            true,
+	"&kopf;":                            true,
+	"&kscr;":                            true,
+	"&lAarr;":                           true,
+	"&lArr;":                            true,
+	"&lAtail;":                          true,
+	"&lBarr;":                           true,
+	"&lE;":                              true,
+	"&lEg;":                             true,
+	"&lHar;":                            true,
+	"&lacute;":                          true,
+	"&laemptyv;":                        true,
+	"&lagran;":                          true,
+	"&lambda;":                          true,
+	"&lang;":                            true,
+	"&langd;":                           true,
+	"&langle;":                          true,
+	"&lap;":                             true,
+	"&laquo":                            true,
+	"&laquo;":                           true,
+	"&larr;":                            true,
+	"&larrb;":                           true,
+	"&larrbfs;":                         true,
+	"&larrfs;":                          true,
+	"&larrhk;":                          true,
+	"&larrlp;":                          true,
+	"&larrpl;":                          true,
+	"&larrsim;":                         true,
+	"&larrtl;":                          true,
+	"&lat;":                             true,
+	"&latail;":                          true,
+	"&late;":                            true,
+	"&lates;":                           true,
+	"&lbarr;":                           true,
+	"&lbbrk;":                           true,
+	"&lbrace;":                          true,
+	"&lbrack;":                          true,
+	"&lbrke;":                           true,
+	"&lbrksld;":                         true,
+	"&lbrkslu;":                         true,
+	"&lcaron;":                          true,
+	"&lcedil;":                          true,
+	"&lceil;":                           true,
+	"&lcub;":                            true,
+	"&lcy;":                             true,
+	"&ldca;":                            true,
+	"&ldquo;":                           true,
+	"&ldquor;":                          true,
+	"&ldrdhar;":                         true,
+	"&ldrushar;":                        true,
+	"&ldsh;":                            true,
+	"&le;":                              true,
+	"&leftarrow;":                       true,
+	"&leftarrowtail;":                   true,
+	"&leftharpoondown;":                 true,
+	"&leftharpoonup;":                   true,
+	"&leftleftarrows;":                  true,
+	"&leftrightarrow;":                  true,
+	"&leftrightarrows;":                 true,
+	"&leftrightharpoons;":               true,
+	"&leftrightsquigarrow;":             true,
+	"&leftthreetimes;":                  true,
+	"&leg;":                             true,
+	"&leq;":                             true,
+	"&leqq;":                            true,
+	"&leqslant;":                        true,
+	"&les;":                             true,
+	"&lescc;":                           true,
+	"&lesdot;":                          true,
+	"&lesdoto;":                         true,
+	"&lesdotor;":                        true,
+	"&lesg;":                            true,
+	"&lesges;":                          true,
+	"&lessapprox;":                      true,
+	"&lessdot;":                         true,
+	"&lesseqgtr;":                       true,
+	"&lesseqqgtr;":                      true,
+	"&lessgtr;":                         true,
+	"&lesssim;":                         true,
+	"&lfisht;":                          true,
+	"&lfloor;":                          true,
+	"&lfr;":                             true,
+	"&lg;":                              true,
+	"&lgE;":                             true,
+	"&lhard;":                           true,
+	"&lharu;":                           true,
+	"&lharul;":                          true,
+	"&lhblk;":                           true,
+	"&ljcy;":                            true,
+	"&ll;":                              true,
+	"&llarr;":                           true,
+	"&llcorner;":                        true,
+	"&llhard;":                          true,
+	"&lltri;":                           true,
+	"&lmidot;":                          true,
+	"&lmoust;":                          true,
+	"&lmoustache;":                      true,
+	"&lnE;":                             true,
+	"&lnap;":                            true,
+	"&lnapprox;":                        true,
+	"&lne;":                             true,
+	"&lneq;":                            true,
+	"&lneqq;":                           true,
+	"&lnsim;":                           true,
+	"&loang;":                           true,
+	"&loarr;":                           true,
+	"&lobrk;":                           true,
+	"&longleftarrow;":                   true,
+	"&longleftrightarrow;":              true,
+	"&longmapsto;":                      true,
+	"&longrightarrow;":                  true,
+	"&looparrowleft;":                   true,
+	"&looparrowright;":                  true,
+	"&lopar;":                           true,
+	"&lopf;":                            true,
+	"&loplus;":                          true,
+	"&lotimes;":                         true,
+	"&lowast;":                          true,
+	"&lowbar;":                          true,
+	"&loz;":                             true,
+	"&lozenge;":                         true,
+	"&lozf;":                            true,
+	"&lpar;":                            true,
+	"&lparlt;":                          true,
+	"&lrarr;":                           true,
+	"&lrcorner;":                        true,
+	"&lrhar;":                           true,
+	"&lrhard;":                          true,
+	"&lrm;":                             true,
+	"&lrtri;":                           true,
+	"&lsaquo;":                          true,
+	"&lscr;":                            true,
+	"&lsh;":                             true,
+	"&lsim;":                            true,
+	"&lsime;":                           true,
+	"&lsimg;":                           true,
+	"&lsqb;":                            true,
+	"&lsquo;":                           true,
+	"&lsquor;":                          true,
+	"&lstrok;":                          true,
+	"&lt":                               true,
+	"&lt;":                              true,
+	"&ltcc;":                            true,
+	"&ltcir;":                           true,
+	"&ltdot;":                           true,
+	"&lthree;":                          true,
+	"&ltimes;":                          true,
+	"&ltlarr;":                          true,
+	"&ltquest;":                         true,
+	"&ltrPar;":                          true,
+	"&ltri;":                            true,
+	"&ltrie;":                           true,
+	"&ltrif;":                           true,
+	"&lurdshar;":                        true,
+	"&luruhar;":                         true,
+	"&lvertneqq;":                       true,
+	"&lvnE;":                            true,
+	"&mDDot;":                           true,
+	"&macr":                             true,
+	"&macr;":                            true,
+	"&male;":                            true,
+	"&malt;":                            true,
+	"&maltese;":                         true,
+	"&map;":                             true,
+	"&mapsto;":                          true,
+	"&mapstodown;":                      true,
+	"&mapstoleft;":                      true,
+	"&mapstoup;":                        true,
+	"&marker;":                          true,
+	"&mcomma;":                          true,
+	"&mcy;":                             true,
+	"&mdash;":                           true,
+	"&measuredangle;":                   true,
+	"&mfr;":                             true,
+	"&mho;":                             true,
+	"&micro":                            true,
+	"&micro;":                           true,
+	"&mid;":                             true,
+	"&midast;":                          true,
+	"&midcir;":                          true,
+	"&middot":                           true,
+	"&middot;":                          true,
+	"&minus;":                           true,
+	"&minusb;":                          true,
+	"&minusd;":                          true,
+	"&minusdu;":                         true,
+	"&mlcp;":                            true,
+	"&mldr;":                            true,
+	"&mnplus;":                          true,
+	"&models;":                          true,
+	"&mopf;":                            true,
+	"&mp;":                              true,
+	"&mscr;":                            true,
+	"&mstpos;":                          true,
+	"&mu;":                              true,
+	"&multimap;":                        true,
+	"&mumap;":                           true,
+	"&nGg;":                             true,
+	"&nGt;":                             true,
+	"&nGtv;":                            true,
+	"&nLeftarrow;":                      true,
+	"&nLeftrightarrow;":                 true,
+	"&nLl;":                             true,
+	"&nLt;":                             true,
+	"&nLtv;":                            true,
+	"&nRightarrow;":                     true,
+	"&nVDash;":                          true,
+	"&nVdash;":                          true,
+	"&nabla;":                           true,
+	"&nacute;":                          true,
+	"&nang;":                            true,
+	"&nap;":                             true,
+	"&napE;":                            true,
+	"&napid;":                           true,
+	"&napos;":                           true,
+	"&napprox;":                         true,
+	"&natur;":                           true,
+	"&natural;":                         true,
+	"&naturals;":                        true,
+	"&nbsp":                             true,
+	"&nbsp;":                            true,
+	"&nbump;":                           true,
+	"&nbumpe;":                          true,
+	"&ncap;":                            true,
+	"&ncaron;":                          true,
+	"&ncedil;":                          true,
+	"&ncong;":                           true,
+	"&ncongdot;":                        true,
+	"&ncup;":                            true,
+	"&ncy;":                             true,
+	"&ndash;":                           true,
+	"&ne;":                              true,
+	"&neArr;":                           true,
+	"&nearhk;":                          true,
+	"&nearr;":                           true,
+	"&nearrow;":                         true,
+	"&nedot;":                           true,
+	"&nequiv;":                          true,
+	"&nesear;":                          true,
+	"&nesim;":                           true,
+	"&nexist;":                          true,
+	"&nexists;":                         true,
+	"&nfr;":                             true,
+	"&ngE;":                             true,
+	"&nge;":                             true,
+	"&ngeq;":                            true,
+	"&ngeqq;":                           true,
+	"&ngeqslant;":                       true,
+	"&nges;":                            true,
+	"&ngsim;":                           true,
+	"&ngt;":                             true,
+	"&ngtr;":                            true,
+	"&nhArr;":                           true,
+	"&nharr;":                           true,
+	"&nhpar;":                           true,
+	"&ni;":                              true,
+	"&nis;":                             true,
+	"&nisd;":                            true,
+	"&niv;":                             true,
+	"&njcy;":                            true,
+	"&nlArr;":                           true,
+	"&nlE;":                             true,
+	"&nlarr;":                           true,
+	"&nldr;":                            true,
+	"&nle;":                             true,
+	"&nleftarrow;":                      true,
+	"&nleftrightarrow;":                 true,
+	"&nleq;":                            true,
+	"&nleqq;":                           true,
+	"&nleqslant;":                       true,
+	"&nles;":                            true,
+	"&nless;":                           true,
+	"&nlsim;":                           true,
+	"&nlt;":                             true,
+	"&nltri;":                           true,
+	"&nltrie;":                          true,
+	"&nmid;":                            true,
+	"&nopf;":                            true,
+	"&not":                              true,
+	"&not;":                             true,
+	"&notin;":                           true,
+	"&notinE;":                          true,
+	"&notindot;":                        true,
+	"&notinva;":                         true,
+	"&notinvb;":                         true,
+	"&notinvc;":                         true,
+	"&notni;":                           true,
+	"&notniva;":                         true,
+	"&notnivb;":                         true,
+	"&notnivc;":                         true,
+	"&npar;":                            true,
+	"&nparallel;":                       true,
+	"&nparsl;":                          true,
+	"&npart;":                           true,
+	"&npolint;":                         true,
+	"&npr;":                             true,
+	"&nprcue;":                          true,
+	"&npre;":                            true,
+	"&nprec;":                           true,
+	"&npreceq;":                         true,
+	"&nrArr;":                           true,
+	"&nrarr;":                           true,
+	"&nrarrc;":                          true,
+	"&nrarrw;":                          true,
+	"&nrightarrow;":                     true,
+	"&nrtri;":                           true,
+	"&nrtrie;":                          true,
+	"&nsc;":                             true,
+	"&nsccue;":                          true,
+	"&nsce;":                            true,
+	"&nscr;":                            true,
+	"&nshortmid;":                       true,
+	"&nshortparallel;":                  true,
+	"&nsim;":                            true,
+	"&nsime;":                           true,
+	"&nsimeq;":                          true,
+	"&nsmid;":                           true,
+	"&nspar;":                           true,
+	"&nsqsube;":                         true,
+	"&nsqsupe;":                         true,
+	"&nsub;":                            true,
+	"&nsubE;":                           true,
+	"&nsube;":                           true,
+	"&nsubset;":                         true,
+	"&nsubseteq;":                       true,
+	"&nsubseteqq;":                      true,
+	"&nsucc;":                           true,
+	"&nsucceq;":                         true,
+	"&nsup;":                            true,
+	"&nsupE;":                           true,
+	"&nsupe;":                           true,
+	"&nsupset;":                         true,
+	"&nsupseteq;":                       true,
+	"&nsupseteqq;":                      true,
+	"&ntgl;":                            true,
+	"&ntilde":                           true,
+	"&ntilde;":                          true,
+	"&ntlg;":                            true,
+	"&ntriangleleft;":                   true,
+	"&ntrianglelefteq;":                 true,
+	"&ntriangleright;":                  true,
+	"&ntrianglerighteq;":                true,
+	"&nu;":                              true,
+	"&num;":                             true,
+	"&numero;":                          true,
+	"&numsp;":                           true,
+	"&nvDash;":                          true,
+	"&nvHarr;":                          true,
+	"&nvap;":                            true,
+	"&nvdash;":                          true,
+	"&nvge;":                            true,
+	"&nvgt;":                            true,
+	"&nvinfin;":                         true,
+	"&nvlArr;":                          true,
+	"&nvle;":                            true,
+	"&nvlt;":                            true,
+	"&nvltrie;":                         true,
+	"&nvrArr;":                          true,
+	"&nvrtrie;":                         true,
+	"&nvsim;":                           true,
+	"&nwArr;":                           true,
+	"&nwarhk;":                          true,
+	"&nwarr;":                           true,
+	"&nwarrow;":                         true,
+	"&nwnear;":                          true,
+	"&oS;":                              true,
+	"&oacute":                           true,
+	"&oacute;":                          true,
+	"&oast;":                            true,
+	"&ocir;":                            true,
+	"&ocirc":                            true,
+	"&ocirc;":                           true,
+	"&ocy;":                             true,
+	"&odash;":                           true,
+	"&odblac;":                          true,
+	"&odiv;":                            true,
+	"&odot;":                            true,
+	"&odsold;":                          true,
+	"&oelig;":                           true,
+	"&ofcir;":                           true,
+	"&ofr;":                             true,
+	"&ogon;":                            true,
+	"&ograve":                           true,
+	"&ograve;":                          true,
+	"&ogt;":                             true,
+	"&ohbar;":                           true,
+	"&ohm;":                             true,
+	"&oint;":                            true,
+	"&olarr;":                           true,
+	"&olcir;":                           true,
+	"&olcross;":                         true,
+	"&oline;":                           true,
+	"&olt;":                             true,
+	"&omacr;":                           true,
+	"&omega;":                           true,
+	"&omicron;":                         true,
+	"&omid;":                            true,
+	"&ominus;":                          true,
+	"&oopf;":                            true,
+	"&opar;":                            true,
+	"&operp;":                           true,
+	"&oplus;":                           true,
+	"&or;":                              true,
+	"&orarr;":                           true,
+	"&ord;":                             true,
+	"&order;":                           true,
+	"&orderof;":                         true,
+	"&ordf":                             true,
+	"&ordf;":                            true,
+	"&ordm":                             true,
+	"&ordm;":                            true,
+	"&origof;":                          true,
+	"&oror;":                            true,
+	"&orslope;":                         true,
+	"&orv;":                             true,
+	"&oscr;":                            true,
+	"&oslash":                           true,
+	"&oslash;":                          true,
+	"&osol;":                            true,
+	"&otilde":                           true,
+	"&otilde;":                          true,
+	"&otimes;":                          true,
+	"&otimesas;":                        true,
+	"&ouml":                             true,
+	"&ouml;":                            true,
+	"&ovbar;":                           true,
+	"&par;":                             true,
+	"&para":                             true,
+	"&para;":                            true,
+	"&parallel;":                        true,
+	"&parsim;":                          true,
+	"&parsl;":                           true,
+	"&part;":                            true,
+	"&pcy;":                             true,
+	"&percnt;":                          true,
+	"&period;":                          true,
+	"&permil;":                          true,
+	"&perp;":                            true,
+	"&pertenk;":                         true,
+	"&pfr;":                             true,
+	"&phi;":                             true,
+	"&phiv;":                            true,
+	"&phmmat;":                          true,
+	"&phone;":                           true,
+	"&pi;":                              true,
+	"&pitchfork;":                       true,
+	"&piv;":                             true,
+	"&planck;":                          true,
+	"&planckh;":                         true,
+	"&plankv;":                          true,
+	"&plus;":                            true,
+	"&plusacir;":                        true,
+	"&plusb;":                           true,
+	"&pluscir;":                         true,
+	"&plusdo;":                          true,
+	"&plusdu;":                          true,
+	"&pluse;":                           true,
+	"&plusmn":                           true,
+	"&plusmn;":                          true,
+	"&plussim;":                         true,
+	"&plustwo;":                         true,
+	"&pm;":                              true,
+	"&pointint;":                        true,
+	"&popf;":                            true,
+	"&pound":                            true,
+	"&pound;":                           true,
+	"&pr;":                              true,
+	"&prE;":                             true,
+	"&prap;":                            true,
+	"&prcue;":                           true,
+	"&pre;":                             true,
+	"&prec;":                            true,
+	"&precapprox;":                      true,
+	"&preccurlyeq;":                     true,
+	"&preceq;":                          true,
+	"&precnapprox;":                     true,
+	"&precneqq;":                        true,
+	"&precnsim;":                        true,
+	"&precsim;":                         true,
+	"&prime;":                           true,
+	"&primes;":                          true,
+	"&prnE;":                            true,
+	"&prnap;":                           true,
+	"&prnsim;":                          true,
+	"&prod;":                            true,
+	"&profalar;":                        true,
+	"&profline;":                        true,
+	"&profsurf;":                        true,
+	"&prop;":                            true,
+	"&propto;":                          true,
+	"&prsim;":                           true,
+	"&prurel;":                          true,
+	"&pscr;":                            true,
+	"&psi;":                             true,
+	"&puncsp;":                          true,
+	"&qfr;":                             true,
+	"&qint;":                            true,
+	"&qopf;":                            true,
+	"&qprime;":                          true,
+	"&qscr;":                            true,
+	"&quaternions;":                     true,
+	"&quatint;":                         true,
+	"&quest;":                           true,
+	"&questeq;":                         true,
+	"&quot":                             true,
+	"&quot;":                            true,
+	"&rAarr;":                           true,
+	"&rArr;":                            true,
+	"&rAtail;":                          true,
+	"&rBarr;":                           true,
+	"&rHar;":                            true,
+	"&race;":                            true,
+	"&racute;":                          true,
+	"&radic;":                           true,
+	"&raemptyv;":                        true,
+	"&rang;":                            true,
+	"&rangd;":                           true,
+	"&range;":                           true,
+	"&rangle;":                          true,
+	"&raquo":                            true,
+	"&raquo;":                           true,
+	"&rarr;":                            true,
+	"&rarrap;":                          true,
+	"&rarrb;":                           true,
+	"&rarrbfs;":                         true,
+	"&rarrc;":                           true,
+	"&rarrfs;":                          true,
+	"&rarrhk;":                          true,
+	"&rarrlp;":                          true,
+	"&rarrpl;":                          true,
+	"&rarrsim;":                         true,
+	"&rarrtl;":                          true,
+	"&rarrw;":                           true,
+	"&ratail;":                          true,
+	"&ratio;":                           true,
+	"&rationals;":                       true,
+	"&rbarr;":                           true,
+	"&rbbrk;":                           true,
+	"&rbrace;":                          true,
+	"&rbrack;":                          true,
+	"&rbrke;":                           true,
+	"&rbrksld;":                         true,
+	"&rbrkslu;":                         true,
+	"&rcaron;":                          true,
+	"&rcedil;":                          true,
+	"&rceil;":                           true,
+	"&rcub;":                            true,
+	"&rcy;":                             true,
+	"&rdca;":                            true,
+	"&rdldhar;":                         true,
+	"&rdquo;":                           true,
+	"&rdquor;":                          true,
+	"&rdsh;":                            true,
+	"&real;":                            true,
+	"&realine;":                         true,
+	"&realpart;":                        true,
+	"&reals;":                           true,
+	"&rect;":                            true,
+	"&reg":                              true,
+	"&reg;":                             true,
+	"&rfisht;":                          true,
+	"&rfloor;":                          true,
+	"&rfr;":                             true,
+	"&rhard;":                           true,
+	"&rharu;":                           true,
+	"&rharul;":                          true,
+	"&rho;":                             true,
+	"&rhov;":                            true,
+	"&rightarrow;":                      true,
+	"&rightarrowtail;":                  true,
+	"&rightharpoondown;":                true,
+	"&rightharpoonup;":                  true,
+	"&rightleftarrows;":                 true,
+	"&rightleftharpoons;":               true,
+	"&rightrightarrows;":                true,
+	"&rightsquigarrow;":                 true,
+	"&rightthreetimes;":                 true,
+	"&ring;":                            true,
+	"&risingdotseq;":                    true,
+	"&rlarr;":                           true,
+	"&rlhar;":                           true,
+	"&rlm;":                             true,
+	"&rmoust;":                          true,
+	"&rmoustache;":                      true,
+	"&rnmid;":                           true,
+	"&roang;":                           true,
+	"&roarr;":                           true,
+	"&robrk;":                           true,
+	"&ropar;":                           true,
+	"&ropf;":                            true,
+	"&roplus;":                          true,
+	"&rotimes;":                         true,
+	"&rpar;":                            true,
+	"&rpargt;":                          true,
+	"&rppolint;":                        true,
+	"&rrarr;":                           true,
+	"&rsaquo;":                          true,
+	"&rscr;":                            true,
+	"&rsh;":                             true,
+	"&rsqb;":                            true,
+	"&rsquo;":                           true,
+	"&rsquor;":                          true,
+	"&rthree;":                          true,
+	"&rtimes;":                          true,
+	"&rtri;":                            true,
+	"&rtrie;":                           true,
+	"&rtrif;":                           true,
+	"&rtriltri;":                        true,
+	"&ruluhar;":                         true,
+	"&rx;":                              true,
+	"&sacute;":                          true,
+	"&sbquo;":                           true,
+	"&sc;":                              true,
+	"&scE;":                             true,
+	"&scap;":                            true,
+	"&scaron;":                          true,
+	"&sccue;":                           true,
+	"&sce;":                             true,
+	"&scedil;":                          true,
+	"&scirc;":                           true,
+	"&scnE;":                            true,
+	"&scnap;":                           true,
+	"&scnsim;":                          true,
+	"&scpolint;":                        true,
+	"&scsim;":                           true,
+	"&scy;":                             true,
+	"&sdot;":                            true,
+	"&sdotb;":                           true,
+	"&sdote;":                           true,
+	"&seArr;":                           true,
+	"&searhk;":                          true,
+	"&searr;":                           true,
+	"&searrow;":                         true,
+	"&sect":                             true,
+	"&sect;":                            true,
+	"&semi;":                            true,
+	"&seswar;":                          true,
+	"&setminus;":                        true,
+	"&setmn;":                           true,
+	"&sext;":                            true,
+	"&sfr;":                             true,
+	"&sfrown;":                          true,
+	"&sharp;":                           true,
+	"&shchcy;":                          true,
+	"&shcy;":                            true,
+	"&shortmid;":                        true,
+	"&shortparallel;":                   true,
+	"&shy":                              true,
+	"&shy;":                             true,
+	"&sigma;":                           true,
+	"&sigmaf;":                          true,
+	"&sigmav;":                          true,
+	"&sim;":                             true,
+	"&simdot;":                          true,
+	"&sime;":                            true,
+	"&simeq;":                           true,
+	"&simg;":                            true,
+	"&simgE;":                           true,
+	"&siml;":                            true,
+	"&simlE;":                           true,
+	"&simne;":                           true,
+	"&simplus;":                         true,
+	"&simrarr;":                         true,
+	"&slarr;":                           true,
+	"&smallsetminus;":                   true,
+	"&smashp;":                          true,
+	"&smeparsl;":                        true,
+	"&smid;":                            true,
+	"&smile;":                           true,
+	"&smt;":                             true,
+	"&smte;":                            true,
+	"&smtes;":                           true,
+	"&softcy;":                          true,
+	"&sol;":                             true,
+	"&solb;":                            true,
+	"&solbar;":                          true,
+	"&sopf;":                            true,
+	"&spades;":                          true,
+	"&spadesuit;":                       true,
+	"&spar;":                            true,
+	"&sqcap;":                           true,
+	"&sqcaps;":                          true,
+	"&sqcup;":                           true,
+	"&sqcups;":                          true,
+	"&sqsub;":                           true,
+	"&sqsube;":                          true,
+	"&sqsubset;":                        true,
+	"&sqsubseteq;":                      true,
+	"&sqsup;":                           true,
+	"&sqsupe;":                          true,
+	"&sqsupset;":                        true,
+	"&sqsupseteq;":                      true,
+	"&squ;":                             true,
+	"&square;":                          true,
+	"&squarf;":                          true,
+	"&squf;":                            true,
+	"&srarr;":                           true,
+	"&sscr;":                            true,
+	"&ssetmn;":                          true,
+	"&ssmile;":                          true,
+	"&sstarf;":                          true,
+	"&star;":                            true,
+	"&starf;":                           true,
+	"&straightepsilon;":                 true,
+	"&straightphi;":                     true,
+	"&strns;":                           true,
+	"&sub;":                             true,
+	"&subE;":                            true,
+	"&subdot;":                          true,
+	"&sube;":                            true,
+	"&subedot;":                         true,
+	"&submult;":                         true,
+	"&subnE;":                           true,
+	"&subne;":                           true,
+	"&subplus;":                         true,
+	"&subrarr;":                         true,
+	"&subset;":                          true,
+	"&subseteq;":                        true,
+	"&subseteqq;":                       true,
+	"&subsetneq;":                       true,
+	"&subsetneqq;":                      true,
+	"&subsim;":                          true,
+	"&subsub;":                          true,
+	"&subsup;":                          true,
+	"&succ;":                            true,
+	"&succapprox;":                      true,
+	"&succcurlyeq;":                     true,
+	"&succeq;":                          true,
+	"&succnapprox;":                     true,
+	"&succneqq;":                        true,
+	"&succnsim;":                        true,
+	"&succsim;":                         true,
+	"&sum;":                             true,
+	"&sung;":                            true,
+	"&sup1":                             true,
+	"&sup1;":                            true,
+	"&sup2":                             true,
+	"&sup2;":                            true,
+	"&sup3":                             true,
+	"&sup3;":                            true,
+	"&sup;":                             true,
+	"&supE;":                            true,
+	"&supdot;":                          true,
+	"&supdsub;":                         true,
+	"&supe;":                            true,
+	"&supedot;":                         true,
+	"&suphsol;":                         true,
+	"&suphsub;":                         true,
+	"&suplarr;":                         true,
+	"&supmult;":                         true,
+	"&supnE;":                           true,
+	"&supne;":                           true,
+	"&supplus;":                         true,
+	"&supset;":                          true,
+	"&supseteq;":                        true,
+	"&supseteqq;":                       true,
+	"&supsetneq;":                       true,
+	"&supsetneqq;":                      true,
+	"&supsim;":                          true,
+	"&supsub;":                          true,
+	"&supsup;":                          true,
+	"&swArr;":                           true,
+	"&swarhk;":                          true,
+	"&swarr;":                           true,
+	"&swarrow;":                         true,
+	"&swnwar;":                          true,
+	"&szlig":                            true,
+	"&szlig;":                           true,
+	"&target;":                          true,
+	"&tau;":                             true,
+	"&tbrk;":                            true,
+	"&tcaron;":                          true,
+	"&tcedil;":                          true,
+	"&tcy;":                             true,
+	"&tdot;":                            true,
+	"&telrec;":                          true,
+	"&tfr;":                             true,
+	"&there4;":                          true,
+	"&therefore;":                       true,
+	"&theta;":                           true,
+	"&thetasym;":                        true,
+	"&thetav;":                          true,
+	"&thickapprox;":                     true,
+	"&thicksim;":                        true,
+	"&thinsp;":                          true,
+	"&thkap;":                           true,
+	"&thksim;":                          true,
+	"&thorn":                            true,
+	"&thorn;":                           true,
+	"&tilde;":                           true,
+	"&times":                            true,
+	"&times;":                           true,
+	"&timesb;":                          true,
+	"&timesbar;":                        true,
+	"&timesd;":                          true,
+	"&tint;":                            true,
+	"&toea;":                            true,
+	"&top;":                             true,
+	"&topbot;":                          true,
+	"&topcir;":                          true,
+	"&topf;":                            true,
+	"&topfork;":                         true,
+	"&tosa;":                            true,
+	"&tprime;":                          true,
+	"&trade;":                           true,
+	"&triangle;":                        true,
+	"&triangledown;":                    true,
+	"&triangleleft;":                    true,
+	"&trianglelefteq;":                  true,
+	"&triangleq;":                       true,
+	"&triangleright;":                   true,
+	"&trianglerighteq;":                 true,
+	"&tridot;":                          true,
+	"&trie;":                            true,
+	"&triminus;":                        true,
+	"&triplus;":                         true,
+	"&trisb;":                           true,
+	"&tritime;":                         true,
+	"&trpezium;":                        true,
+	"&tscr;":                            true,
+	"&tscy;":                            true,
+	"&tshcy;":                           true,
+	"&tstrok;":                          true,
+	"&twixt;":                           true,
+	"&twoheadleftarrow;":                true,
+	"&twoheadrightarrow;":               true,
+	"&uArr;":                            true,
+	"&uHar;":                            true,
+	"&uacute":                           true,
+	"&uacute;":                          true,
+	"&uarr;":                            true,
+	"&ubrcy;":                           true,
+	"&ubreve;":                          true,
+	"&ucirc":                            true,
+	"&ucirc;":                           true,
+	"&ucy;":                             true,
+	"&udarr;":                           true,
+	"&udblac;":                          true,
+	"&udhar;":                           true,
+	"&ufisht;":                          true,
+	"&ufr;":                             true,
+	"&ugrave":                           true,
+	"&ugrave;":                          true,
+	"&uharl;":                           true,
+	"&uharr;":                           true,
+	"&uhblk;":                           true,
+	"&ulcorn;":                          true,
+	"&ulcorner;":                        true,
+	"&ulcrop;":                          true,
+	"&ultri;":                           true,
+	"&umacr;":                           true,
+	"&uml":                              true,
+	"&uml;":                             true,
+	"&uogon;":                           true,
+	"&uopf;":                            true,
+	"&uparrow;":                         true,
+	"&updownarrow;":                     true,
+	"&upharpoonleft;":                   true,
+	"&upharpoonright;":                  true,
+	"&uplus;":                           true,
+	"&upsi;":                            true,
+	"&upsih;":                           true,
+	"&upsilon;":                         true,
+	"&upuparrows;":                      true,
+	"&urcorn;":                          true,
+	"&urcorner;":                        true,
+	"&urcrop;":                          true,
+	"&uring;":                           true,
+	"&urtri;":                           true,
+	"&uscr;":                            true,
+	"&utdot;":                           true,
+	"&utilde;":                          true,
+	"&utri;":                            true,
+	"&utrif;":                           true,
+	"&uuarr;":                           true,
+	"&uuml":                             true,
+	"&uuml;":                            true,
+	"&uwangle;":                         true,
+	"&vArr;":                            true,
+	"&vBar;":                            true,
+	"&vBarv;":                           true,
+	"&vDash;":                           true,
+	"&vangrt;":                          true,
+	"&varepsilon;":                      true,
+	"&varkappa;":                        true,
+	"&varnothing;":                      true,
+	"&varphi;":                          true,
+	"&varpi;":                           true,
+	"&varpropto;":                       true,
+	"&varr;":                            true,
+	"&varrho;":                          true,
+	"&varsigma;":                        true,
+	"&varsubsetneq;":                    true,
+	"&varsubsetneqq;":                   true,
+	"&varsupsetneq;":                    true,
+	"&varsupsetneqq;":                   true,
+	"&vartheta;":                        true,
+	"&vartriangleleft;":                 true,
+	"&vartriangleright;":                true,
+	"&vcy;":                             true,
+	"&vdash;":                           true,
+	"&vee;":                             true,
+	"&veebar;":                          true,
+	"&veeeq;":                           true,
+	"&vellip;":                          true,
+	"&verbar;":                          true,
+	"&vert;":                            true,
+	"&vfr;":                             true,
+	"&vltri;":                           true,
+	"&vnsub;":                           true,
+	"&vnsup;":                           true,
+	"&vopf;":                            true,
+	"&vprop;":                           true,
+	"&vrtri;":                           true,
+	"&vscr;":                            true,
+	"&vsubnE;":                          true,
+	"&vsubne;":                          true,
+	"&vsupnE;":                          true,
+	"&vsupne;":                          true,
+	"&vzigzag;":                         true,
+	"&wcirc;":                           true,
+	"&wedbar;":                          true,
+	"&wedge;":                           true,
+	"&wedgeq;":                          true,
+	"&weierp;":                          true,
+	"&wfr;":                             true,
+	"&wopf;":                            true,
+	"&wp;":                              true,
+	"&wr;":                              true,
+	"&wreath;":                          true,
+	"&wscr;":                            true,
+	"&xcap;":                            true,
+	"&xcirc;":                           true,
+	"&xcup;":                            true,
+	"&xdtri;":                           true,
+	"&xfr;":                             true,
+	"&xhArr;":                           true,
+	"&xharr;":                           true,
+	"&xi;":                              true,
+	"&xlArr;":                           true,
+	"&xlarr;":                           true,
+	"&xmap;":                            true,
+	"&xnis;":                            true,
+	"&xodot;":                           true,
+	"&xopf;":                            true,
+	"&xoplus;":                          true,
+	"&xotime;":                          true,
+	"&xrArr;":                           true,
+	"&xrarr;":                           true,
+	"&xscr;":                            true,
+	"&xsqcup;":                          true,
+	"&xuplus;":                          true,
+	"&xutri;":                           true,
+	"&xvee;":                            true,
+	"&xwedge;":                          true,
+	"&yacute":                           true,
+	"&yacute;":                          true,
+	"&yacy;":                            true,
+	"&ycirc;":                           true,
+	"&ycy;":                             true,
+	"&yen":                              true,
+	"&yen;":                             true,
+	"&yfr;":                             true,
+	"&yicy;":                            true,
+	"&yopf;":                            true,
+	"&yscr;":                            true,
+	"&yucy;":                            true,
+	"&yuml":                             true,
+	"&yuml;":                            true,
+	"&zacute;":                          true,
+	"&zcaron;":                          true,
+	"&zcy;":                             true,
+	"&zdot;":                            true,
+	"&zeetrf;":                          true,
+	"&zeta;":                            true,
+	"&zfr;":                             true,
+	"&zhcy;":                            true,
+	"&zigrarr;":                         true,
+	"&zopf;":                            true,
+	"&zscr;":                            true,
+	"&zwj;":                             true,
+	"&zwnj;":                            true,
+}
diff --git a/vendor/github.com/russross/blackfriday/v2/esc.go b/vendor/github.com/russross/blackfriday/v2/esc.go
index 6385f27cb6..6ab60102c9 100644
--- a/vendor/github.com/russross/blackfriday/v2/esc.go
+++ b/vendor/github.com/russross/blackfriday/v2/esc.go
@@ -13,13 +13,27 @@ var htmlEscaper = [256][]byte{
 }
 
 func escapeHTML(w io.Writer, s []byte) {
+	escapeEntities(w, s, false)
+}
+
+func escapeAllHTML(w io.Writer, s []byte) {
+	escapeEntities(w, s, true)
+}
+
+func escapeEntities(w io.Writer, s []byte, escapeValidEntities bool) {
 	var start, end int
 	for end < len(s) {
 		escSeq := htmlEscaper[s[end]]
 		if escSeq != nil {
-			w.Write(s[start:end])
-			w.Write(escSeq)
-			start = end + 1
+			isEntity, entityEnd := nodeIsEntity(s, end)
+			if isEntity && !escapeValidEntities {
+				w.Write(s[start : entityEnd+1])
+				start = entityEnd + 1
+			} else {
+				w.Write(s[start:end])
+				w.Write(escSeq)
+				start = end + 1
+			}
 		}
 		end++
 	}
@@ -28,6 +42,28 @@ func escapeHTML(w io.Writer, s []byte) {
 	}
 }
 
+func nodeIsEntity(s []byte, end int) (isEntity bool, endEntityPos int) {
+	isEntity = false
+	endEntityPos = end + 1
+
+	if s[end] == '&' {
+		for endEntityPos < len(s) {
+			if s[endEntityPos] == ';' {
+				if entities[string(s[end:endEntityPos+1])] {
+					isEntity = true
+					break
+				}
+			}
+			if !isalnum(s[endEntityPos]) && s[endEntityPos] != '&' && s[endEntityPos] != '#' {
+				break
+			}
+			endEntityPos++
+		}
+	}
+
+	return isEntity, endEntityPos
+}
+
 func escLink(w io.Writer, text []byte) {
 	unesc := html.UnescapeString(string(text))
 	escapeHTML(w, []byte(unesc))
diff --git a/vendor/github.com/russross/blackfriday/v2/go.mod b/vendor/github.com/russross/blackfriday/v2/go.mod
deleted file mode 100644
index 620b74e0ac..0000000000
--- a/vendor/github.com/russross/blackfriday/v2/go.mod
+++ /dev/null
@@ -1 +0,0 @@
-module github.com/russross/blackfriday/v2
diff --git a/vendor/github.com/russross/blackfriday/v2/html.go b/vendor/github.com/russross/blackfriday/v2/html.go
index 284c87184f..cb4f26e30f 100644
--- a/vendor/github.com/russross/blackfriday/v2/html.go
+++ b/vendor/github.com/russross/blackfriday/v2/html.go
@@ -132,7 +132,10 @@ func NewHTMLRenderer(params HTMLRendererParameters) *HTMLRenderer {
 	}
 
 	if params.FootnoteReturnLinkContents == "" {
-		params.FootnoteReturnLinkContents = `<sup>[return]</sup>`
+		// U+FE0E is VARIATION SELECTOR-15.
+		// It suppresses automatic emoji presentation of the preceding
+		// U+21A9 LEFTWARDS ARROW WITH HOOK on iOS and iPadOS.
+		params.FootnoteReturnLinkContents = "<span aria-label='Return'>↩\ufe0e</span>"
 	}
 
 	return &HTMLRenderer{
@@ -616,7 +619,7 @@ func (r *HTMLRenderer) RenderNode(w io.Writer, node *Node, entering bool) WalkSt
 		}
 	case Code:
 		r.out(w, codeTag)
-		escapeHTML(w, node.Literal)
+		escapeAllHTML(w, node.Literal)
 		r.out(w, codeCloseTag)
 	case Document:
 		break
@@ -762,7 +765,7 @@ func (r *HTMLRenderer) RenderNode(w io.Writer, node *Node, entering bool) WalkSt
 		r.cr(w)
 		r.out(w, preTag)
 		r.tag(w, codeTag[:len(codeTag)-1], attrs)
-		escapeHTML(w, node.Literal)
+		escapeAllHTML(w, node.Literal)
 		r.out(w, codeCloseTag)
 		r.out(w, preCloseTag)
 		if node.Parent.Type != Item {
diff --git a/vendor/github.com/russross/blackfriday/v2/inline.go b/vendor/github.com/russross/blackfriday/v2/inline.go
index 4ed2907921..d45bd94172 100644
--- a/vendor/github.com/russross/blackfriday/v2/inline.go
+++ b/vendor/github.com/russross/blackfriday/v2/inline.go
@@ -278,7 +278,7 @@ func link(p *Markdown, data []byte, offset int) (int, *Node) {
 		case data[i] == '\n':
 			textHasNl = true
 
-		case data[i-1] == '\\':
+		case isBackslashEscaped(data, i):
 			continue
 
 		case data[i] == '[':
diff --git a/vendor/github.com/russross/blackfriday/v2/node.go b/vendor/github.com/russross/blackfriday/v2/node.go
index 51b9e8c1b5..04e6050cee 100644
--- a/vendor/github.com/russross/blackfriday/v2/node.go
+++ b/vendor/github.com/russross/blackfriday/v2/node.go
@@ -199,7 +199,8 @@ func (n *Node) InsertBefore(sibling *Node) {
 	}
 }
 
-func (n *Node) isContainer() bool {
+// IsContainer returns true if 'n' can contain children.
+func (n *Node) IsContainer() bool {
 	switch n.Type {
 	case Document:
 		fallthrough
@@ -238,6 +239,11 @@ func (n *Node) isContainer() bool {
 	}
 }
 
+// IsLeaf returns true if 'n' is a leaf node.
+func (n *Node) IsLeaf() bool {
+	return !n.IsContainer()
+}
+
 func (n *Node) canContain(t NodeType) bool {
 	if n.Type == List {
 		return t == Item
@@ -309,11 +315,11 @@ func newNodeWalker(root *Node) *nodeWalker {
 }
 
 func (nw *nodeWalker) next() {
-	if (!nw.current.isContainer() || !nw.entering) && nw.current == nw.root {
+	if (!nw.current.IsContainer() || !nw.entering) && nw.current == nw.root {
 		nw.current = nil
 		return
 	}
-	if nw.entering && nw.current.isContainer() {
+	if nw.entering && nw.current.IsContainer() {
 		if nw.current.FirstChild != nil {
 			nw.current = nw.current.FirstChild
 			nw.entering = true
diff --git a/vendor/github.com/sergi/go-diff/AUTHORS b/vendor/github.com/sergi/go-diff/AUTHORS
new file mode 100644
index 0000000000..2d7bb2bf57
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/AUTHORS
@@ -0,0 +1,25 @@
+# This is the official list of go-diff authors for copyright purposes.
+# This file is distinct from the CONTRIBUTORS files.
+# See the latter for an explanation.
+
+# Names should be added to this file as
+#	Name or Organization <email address>
+# The email address is not required for organizations.
+
+# Please keep the list sorted.
+
+Danny Yoo <dannyyoo@google.com>
+James Kolb <jkolb@google.com>
+Jonathan Amsterdam <jba@google.com>
+Markus Zimmermann <markus.zimmermann@nethead.at> <markus.zimmermann@symflower.com> <zimmski@gmail.com>
+Matt Kovars <akaskik@gmail.com>
+Örjan Persson <orjan@spotify.com>
+Osman Masood <oamasood@gmail.com>
+Robert Carlsen <rwcarlsen@gmail.com>
+Rory Flynn <roryflynn@users.noreply.github.com>
+Sergi Mansilla <sergi.mansilla@gmail.com>
+Shatrugna Sadhu <ssadhu@apcera.com>
+Shawn Smith <shawnpsmith@gmail.com>
+Stas Maksimov <maksimov@gmail.com>
+Tor Arvid Lund <torarvid@gmail.com>
+Zac Bergquist <zbergquist99@gmail.com>
diff --git a/vendor/github.com/sergi/go-diff/CONTRIBUTORS b/vendor/github.com/sergi/go-diff/CONTRIBUTORS
new file mode 100644
index 0000000000..369e3d5519
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/CONTRIBUTORS
@@ -0,0 +1,32 @@
+# This is the official list of people who can contribute
+# (and typically have contributed) code to the go-diff
+# repository.
+#
+# The AUTHORS file lists the copyright holders; this file
+# lists people.  For example, ACME Inc. employees would be listed here
+# but not in AUTHORS, because ACME Inc. would hold the copyright.
+#
+# When adding J Random Contributor's name to this file,
+# either J's name or J's organization's name should be
+# added to the AUTHORS file.
+#
+# Names should be added to this file like so:
+#     Name <email address>
+#
+# Please keep the list sorted.
+
+Danny Yoo <dannyyoo@google.com>
+James Kolb <jkolb@google.com>
+Jonathan Amsterdam <jba@google.com>
+Markus Zimmermann <markus.zimmermann@nethead.at> <markus.zimmermann@symflower.com> <zimmski@gmail.com>
+Matt Kovars <akaskik@gmail.com>
+Örjan Persson <orjan@spotify.com>
+Osman Masood <oamasood@gmail.com>
+Robert Carlsen <rwcarlsen@gmail.com>
+Rory Flynn <roryflynn@users.noreply.github.com>
+Sergi Mansilla <sergi.mansilla@gmail.com>
+Shatrugna Sadhu <ssadhu@apcera.com>
+Shawn Smith <shawnpsmith@gmail.com>
+Stas Maksimov <maksimov@gmail.com>
+Tor Arvid Lund <torarvid@gmail.com>
+Zac Bergquist <zbergquist99@gmail.com>
diff --git a/vendor/github.com/sergi/go-diff/LICENSE b/vendor/github.com/sergi/go-diff/LICENSE
new file mode 100644
index 0000000000..937942c2b2
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/LICENSE
@@ -0,0 +1,20 @@
+Copyright (c) 2012-2016 The go-diff Authors. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go
new file mode 100644
index 0000000000..cb25b43757
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/diff.go
@@ -0,0 +1,1345 @@
+// Copyright (c) 2012-2016 The go-diff authors. All rights reserved.
+// https://github.com/sergi/go-diff
+// See the included LICENSE file for license details.
+//
+// go-diff is a Go implementation of Google's Diff, Match, and Patch library
+// Original library is Copyright (c) 2006 Google Inc.
+// http://code.google.com/p/google-diff-match-patch/
+
+package diffmatchpatch
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"html"
+	"math"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+// Operation defines the operation of a diff item.
+type Operation int8
+
+//go:generate stringer -type=Operation -trimprefix=Diff
+
+const (
+	// DiffDelete item represents a delete diff.
+	DiffDelete Operation = -1
+	// DiffInsert item represents an insert diff.
+	DiffInsert Operation = 1
+	// DiffEqual item represents an equal diff.
+	DiffEqual Operation = 0
+)
+
+// Diff represents one diff operation
+type Diff struct {
+	Type Operation
+	Text string
+}
+
+// splice removes amount elements from slice at index index, replacing them with elements.
+func splice(slice []Diff, index int, amount int, elements ...Diff) []Diff {
+	if len(elements) == amount {
+		// Easy case: overwrite the relevant items.
+		copy(slice[index:], elements)
+		return slice
+	}
+	if len(elements) < amount {
+		// Fewer new items than old.
+		// Copy in the new items.
+		copy(slice[index:], elements)
+		// Shift the remaining items left.
+		copy(slice[index+len(elements):], slice[index+amount:])
+		// Calculate the new end of the slice.
+		end := len(slice) - amount + len(elements)
+		// Zero stranded elements at end so that they can be garbage collected.
+		tail := slice[end:]
+		for i := range tail {
+			tail[i] = Diff{}
+		}
+		return slice[:end]
+	}
+	// More new items than old.
+	// Make room in slice for new elements.
+	// There's probably an even more efficient way to do this,
+	// but this is simple and clear.
+	need := len(slice) - amount + len(elements)
+	for len(slice) < need {
+		slice = append(slice, Diff{})
+	}
+	// Shift slice elements right to make room for new elements.
+	copy(slice[index+len(elements):], slice[index+amount:])
+	// Copy in new elements.
+	copy(slice[index:], elements)
+	return slice
+}
+
+// DiffMain finds the differences between two texts.
+// If an invalid UTF-8 sequence is encountered, it will be replaced by the Unicode replacement character.
+func (dmp *DiffMatchPatch) DiffMain(text1, text2 string, checklines bool) []Diff {
+	return dmp.DiffMainRunes([]rune(text1), []rune(text2), checklines)
+}
+
+// DiffMainRunes finds the differences between two rune sequences.
+// If an invalid UTF-8 sequence is encountered, it will be replaced by the Unicode replacement character.
+func (dmp *DiffMatchPatch) DiffMainRunes(text1, text2 []rune, checklines bool) []Diff {
+	var deadline time.Time
+	if dmp.DiffTimeout > 0 {
+		deadline = time.Now().Add(dmp.DiffTimeout)
+	}
+	return dmp.diffMainRunes(text1, text2, checklines, deadline)
+}
+
+func (dmp *DiffMatchPatch) diffMainRunes(text1, text2 []rune, checklines bool, deadline time.Time) []Diff {
+	if runesEqual(text1, text2) {
+		var diffs []Diff
+		if len(text1) > 0 {
+			diffs = append(diffs, Diff{DiffEqual, string(text1)})
+		}
+		return diffs
+	}
+	// Trim off common prefix (speedup).
+	commonlength := commonPrefixLength(text1, text2)
+	commonprefix := text1[:commonlength]
+	text1 = text1[commonlength:]
+	text2 = text2[commonlength:]
+
+	// Trim off common suffix (speedup).
+	commonlength = commonSuffixLength(text1, text2)
+	commonsuffix := text1[len(text1)-commonlength:]
+	text1 = text1[:len(text1)-commonlength]
+	text2 = text2[:len(text2)-commonlength]
+
+	// Compute the diff on the middle block.
+	diffs := dmp.diffCompute(text1, text2, checklines, deadline)
+
+	// Restore the prefix and suffix.
+	if len(commonprefix) != 0 {
+		diffs = append([]Diff{Diff{DiffEqual, string(commonprefix)}}, diffs...)
+	}
+	if len(commonsuffix) != 0 {
+		diffs = append(diffs, Diff{DiffEqual, string(commonsuffix)})
+	}
+
+	return dmp.DiffCleanupMerge(diffs)
+}
+
+// diffCompute finds the differences between two rune slices.  Assumes that the texts do not have any common prefix or suffix.
+func (dmp *DiffMatchPatch) diffCompute(text1, text2 []rune, checklines bool, deadline time.Time) []Diff {
+	diffs := []Diff{}
+	if len(text1) == 0 {
+		// Just add some text (speedup).
+		return append(diffs, Diff{DiffInsert, string(text2)})
+	} else if len(text2) == 0 {
+		// Just delete some text (speedup).
+		return append(diffs, Diff{DiffDelete, string(text1)})
+	}
+
+	var longtext, shorttext []rune
+	if len(text1) > len(text2) {
+		longtext = text1
+		shorttext = text2
+	} else {
+		longtext = text2
+		shorttext = text1
+	}
+
+	if i := runesIndex(longtext, shorttext); i != -1 {
+		op := DiffInsert
+		// Swap insertions for deletions if diff is reversed.
+		if len(text1) > len(text2) {
+			op = DiffDelete
+		}
+		// Shorter text is inside the longer text (speedup).
+		return []Diff{
+			Diff{op, string(longtext[:i])},
+			Diff{DiffEqual, string(shorttext)},
+			Diff{op, string(longtext[i+len(shorttext):])},
+		}
+	} else if len(shorttext) == 1 {
+		// Single character string.
+		// After the previous speedup, the character can't be an equality.
+		return []Diff{
+			Diff{DiffDelete, string(text1)},
+			Diff{DiffInsert, string(text2)},
+		}
+		// Check to see if the problem can be split in two.
+	} else if hm := dmp.diffHalfMatch(text1, text2); hm != nil {
+		// A half-match was found, sort out the return data.
+		text1A := hm[0]
+		text1B := hm[1]
+		text2A := hm[2]
+		text2B := hm[3]
+		midCommon := hm[4]
+		// Send both pairs off for separate processing.
+		diffsA := dmp.diffMainRunes(text1A, text2A, checklines, deadline)
+		diffsB := dmp.diffMainRunes(text1B, text2B, checklines, deadline)
+		// Merge the results.
+		diffs := diffsA
+		diffs = append(diffs, Diff{DiffEqual, string(midCommon)})
+		diffs = append(diffs, diffsB...)
+		return diffs
+	} else if checklines && len(text1) > 100 && len(text2) > 100 {
+		return dmp.diffLineMode(text1, text2, deadline)
+	}
+	return dmp.diffBisect(text1, text2, deadline)
+}
+
+// diffLineMode does a quick line-level diff on both []runes, then rediff the parts for greater accuracy. This speedup can produce non-minimal diffs.
+func (dmp *DiffMatchPatch) diffLineMode(text1, text2 []rune, deadline time.Time) []Diff {
+	// Scan the text on a line-by-line basis first.
+	text1, text2, linearray := dmp.diffLinesToRunes(text1, text2)
+
+	diffs := dmp.diffMainRunes(text1, text2, false, deadline)
+
+	// Convert the diff back to original text.
+	diffs = dmp.DiffCharsToLines(diffs, linearray)
+	// Eliminate freak matches (e.g. blank lines)
+	diffs = dmp.DiffCleanupSemantic(diffs)
+
+	// Rediff any replacement blocks, this time character-by-character.
+	// Add a dummy entry at the end.
+	diffs = append(diffs, Diff{DiffEqual, ""})
+
+	pointer := 0
+	countDelete := 0
+	countInsert := 0
+
+	// NOTE: Rune slices are slower than using strings in this case.
+	textDelete := ""
+	textInsert := ""
+
+	for pointer < len(diffs) {
+		switch diffs[pointer].Type {
+		case DiffInsert:
+			countInsert++
+			textInsert += diffs[pointer].Text
+		case DiffDelete:
+			countDelete++
+			textDelete += diffs[pointer].Text
+		case DiffEqual:
+			// Upon reaching an equality, check for prior redundancies.
+			if countDelete >= 1 && countInsert >= 1 {
+				// Delete the offending records and add the merged ones.
+				diffs = splice(diffs, pointer-countDelete-countInsert,
+					countDelete+countInsert)
+
+				pointer = pointer - countDelete - countInsert
+				a := dmp.diffMainRunes([]rune(textDelete), []rune(textInsert), false, deadline)
+				for j := len(a) - 1; j >= 0; j-- {
+					diffs = splice(diffs, pointer, 0, a[j])
+				}
+				pointer = pointer + len(a)
+			}
+
+			countInsert = 0
+			countDelete = 0
+			textDelete = ""
+			textInsert = ""
+		}
+		pointer++
+	}
+
+	return diffs[:len(diffs)-1] // Remove the dummy entry at the end.
+}
+
+// DiffBisect finds the 'middle snake' of a diff, split the problem in two and return the recursively constructed diff.
+// If an invalid UTF-8 sequence is encountered, it will be replaced by the Unicode replacement character.
+// See Myers 1986 paper: An O(ND) Difference Algorithm and Its Variations.
+func (dmp *DiffMatchPatch) DiffBisect(text1, text2 string, deadline time.Time) []Diff {
+	// Unused in this code, but retained for interface compatibility.
+	return dmp.diffBisect([]rune(text1), []rune(text2), deadline)
+}
+
+// diffBisect finds the 'middle snake' of a diff, splits the problem in two and returns the recursively constructed diff.
+// See Myers's 1986 paper: An O(ND) Difference Algorithm and Its Variations.
+func (dmp *DiffMatchPatch) diffBisect(runes1, runes2 []rune, deadline time.Time) []Diff {
+	// Cache the text lengths to prevent multiple calls.
+	runes1Len, runes2Len := len(runes1), len(runes2)
+
+	maxD := (runes1Len + runes2Len + 1) / 2
+	vOffset := maxD
+	vLength := 2 * maxD
+
+	v1 := make([]int, vLength)
+	v2 := make([]int, vLength)
+	for i := range v1 {
+		v1[i] = -1
+		v2[i] = -1
+	}
+	v1[vOffset+1] = 0
+	v2[vOffset+1] = 0
+
+	delta := runes1Len - runes2Len
+	// If the total number of characters is odd, then the front path will collide with the reverse path.
+	front := (delta%2 != 0)
+	// Offsets for start and end of k loop. Prevents mapping of space beyond the grid.
+	k1start := 0
+	k1end := 0
+	k2start := 0
+	k2end := 0
+	for d := 0; d < maxD; d++ {
+		// Bail out if deadline is reached.
+		if !deadline.IsZero() && d%16 == 0 && time.Now().After(deadline) {
+			break
+		}
+
+		// Walk the front path one step.
+		for k1 := -d + k1start; k1 <= d-k1end; k1 += 2 {
+			k1Offset := vOffset + k1
+			var x1 int
+
+			if k1 == -d || (k1 != d && v1[k1Offset-1] < v1[k1Offset+1]) {
+				x1 = v1[k1Offset+1]
+			} else {
+				x1 = v1[k1Offset-1] + 1
+			}
+
+			y1 := x1 - k1
+			for x1 < runes1Len && y1 < runes2Len {
+				if runes1[x1] != runes2[y1] {
+					break
+				}
+				x1++
+				y1++
+			}
+			v1[k1Offset] = x1
+			if x1 > runes1Len {
+				// Ran off the right of the graph.
+				k1end += 2
+			} else if y1 > runes2Len {
+				// Ran off the bottom of the graph.
+				k1start += 2
+			} else if front {
+				k2Offset := vOffset + delta - k1
+				if k2Offset >= 0 && k2Offset < vLength && v2[k2Offset] != -1 {
+					// Mirror x2 onto top-left coordinate system.
+					x2 := runes1Len - v2[k2Offset]
+					if x1 >= x2 {
+						// Overlap detected.
+						return dmp.diffBisectSplit(runes1, runes2, x1, y1, deadline)
+					}
+				}
+			}
+		}
+		// Walk the reverse path one step.
+		for k2 := -d + k2start; k2 <= d-k2end; k2 += 2 {
+			k2Offset := vOffset + k2
+			var x2 int
+			if k2 == -d || (k2 != d && v2[k2Offset-1] < v2[k2Offset+1]) {
+				x2 = v2[k2Offset+1]
+			} else {
+				x2 = v2[k2Offset-1] + 1
+			}
+			var y2 = x2 - k2
+			for x2 < runes1Len && y2 < runes2Len {
+				if runes1[runes1Len-x2-1] != runes2[runes2Len-y2-1] {
+					break
+				}
+				x2++
+				y2++
+			}
+			v2[k2Offset] = x2
+			if x2 > runes1Len {
+				// Ran off the left of the graph.
+				k2end += 2
+			} else if y2 > runes2Len {
+				// Ran off the top of the graph.
+				k2start += 2
+			} else if !front {
+				k1Offset := vOffset + delta - k2
+				if k1Offset >= 0 && k1Offset < vLength && v1[k1Offset] != -1 {
+					x1 := v1[k1Offset]
+					y1 := vOffset + x1 - k1Offset
+					// Mirror x2 onto top-left coordinate system.
+					x2 = runes1Len - x2
+					if x1 >= x2 {
+						// Overlap detected.
+						return dmp.diffBisectSplit(runes1, runes2, x1, y1, deadline)
+					}
+				}
+			}
+		}
+	}
+	// Diff took too long and hit the deadline or number of diffs equals number of characters, no commonality at all.
+	return []Diff{
+		Diff{DiffDelete, string(runes1)},
+		Diff{DiffInsert, string(runes2)},
+	}
+}
+
+func (dmp *DiffMatchPatch) diffBisectSplit(runes1, runes2 []rune, x, y int,
+	deadline time.Time) []Diff {
+	runes1a := runes1[:x]
+	runes2a := runes2[:y]
+	runes1b := runes1[x:]
+	runes2b := runes2[y:]
+
+	// Compute both diffs serially.
+	diffs := dmp.diffMainRunes(runes1a, runes2a, false, deadline)
+	diffsb := dmp.diffMainRunes(runes1b, runes2b, false, deadline)
+
+	return append(diffs, diffsb...)
+}
+
+// DiffLinesToChars splits two texts into a list of strings, and educes the texts to a string of hashes where each Unicode character represents one line.
+// It's slightly faster to call DiffLinesToRunes first, followed by DiffMainRunes.
+func (dmp *DiffMatchPatch) DiffLinesToChars(text1, text2 string) (string, string, []string) {
+	chars1, chars2, lineArray := dmp.DiffLinesToRunes(text1, text2)
+	return string(chars1), string(chars2), lineArray
+}
+
+// DiffLinesToRunes splits two texts into a list of runes. Each rune represents one line.
+func (dmp *DiffMatchPatch) DiffLinesToRunes(text1, text2 string) ([]rune, []rune, []string) {
+	// '\x00' is a valid character, but various debuggers don't like it. So we'll insert a junk entry to avoid generating a null character.
+	lineArray := []string{""}    // e.g. lineArray[4] == 'Hello\n'
+	lineHash := map[string]int{} // e.g. lineHash['Hello\n'] == 4
+
+	chars1 := dmp.diffLinesToRunesMunge(text1, &lineArray, lineHash)
+	chars2 := dmp.diffLinesToRunesMunge(text2, &lineArray, lineHash)
+
+	return chars1, chars2, lineArray
+}
+
+func (dmp *DiffMatchPatch) diffLinesToRunes(text1, text2 []rune) ([]rune, []rune, []string) {
+	return dmp.DiffLinesToRunes(string(text1), string(text2))
+}
+
+// diffLinesToRunesMunge splits a text into an array of strings, and reduces the texts to a []rune where each Unicode character represents one line.
+// We use strings instead of []runes as input mainly because you can't use []rune as a map key.
+func (dmp *DiffMatchPatch) diffLinesToRunesMunge(text string, lineArray *[]string, lineHash map[string]int) []rune {
+	// Walk the text, pulling out a substring for each line. text.split('\n') would would temporarily double our memory footprint. Modifying text would create many large strings to garbage collect.
+	lineStart := 0
+	lineEnd := -1
+	runes := []rune{}
+
+	for lineEnd < len(text)-1 {
+		lineEnd = indexOf(text, "\n", lineStart)
+
+		if lineEnd == -1 {
+			lineEnd = len(text) - 1
+		}
+
+		line := text[lineStart : lineEnd+1]
+		lineStart = lineEnd + 1
+		lineValue, ok := lineHash[line]
+
+		if ok {
+			runes = append(runes, rune(lineValue))
+		} else {
+			*lineArray = append(*lineArray, line)
+			lineHash[line] = len(*lineArray) - 1
+			runes = append(runes, rune(len(*lineArray)-1))
+		}
+	}
+
+	return runes
+}
+
+// DiffCharsToLines rehydrates the text in a diff from a string of line hashes to real lines of text.
+func (dmp *DiffMatchPatch) DiffCharsToLines(diffs []Diff, lineArray []string) []Diff {
+	hydrated := make([]Diff, 0, len(diffs))
+	for _, aDiff := range diffs {
+		chars := aDiff.Text
+		text := make([]string, len(chars))
+
+		for i, r := range chars {
+			text[i] = lineArray[r]
+		}
+
+		aDiff.Text = strings.Join(text, "")
+		hydrated = append(hydrated, aDiff)
+	}
+	return hydrated
+}
+
+// DiffCommonPrefix determines the common prefix length of two strings.
+func (dmp *DiffMatchPatch) DiffCommonPrefix(text1, text2 string) int {
+	// Unused in this code, but retained for interface compatibility.
+	return commonPrefixLength([]rune(text1), []rune(text2))
+}
+
+// DiffCommonSuffix determines the common suffix length of two strings.
+func (dmp *DiffMatchPatch) DiffCommonSuffix(text1, text2 string) int {
+	// Unused in this code, but retained for interface compatibility.
+	return commonSuffixLength([]rune(text1), []rune(text2))
+}
+
+// commonPrefixLength returns the length of the common prefix of two rune slices.
+func commonPrefixLength(text1, text2 []rune) int {
+	// Linear search. See comment in commonSuffixLength.
+	n := 0
+	for ; n < len(text1) && n < len(text2); n++ {
+		if text1[n] != text2[n] {
+			return n
+		}
+	}
+	return n
+}
+
+// commonSuffixLength returns the length of the common suffix of two rune slices.
+func commonSuffixLength(text1, text2 []rune) int {
+	// Use linear search rather than the binary search discussed at https://neil.fraser.name/news/2007/10/09/.
+	// See discussion at https://github.com/sergi/go-diff/issues/54.
+	i1 := len(text1)
+	i2 := len(text2)
+	for n := 0; ; n++ {
+		i1--
+		i2--
+		if i1 < 0 || i2 < 0 || text1[i1] != text2[i2] {
+			return n
+		}
+	}
+}
+
+// DiffCommonOverlap determines if the suffix of one string is the prefix of another.
+func (dmp *DiffMatchPatch) DiffCommonOverlap(text1 string, text2 string) int {
+	// Cache the text lengths to prevent multiple calls.
+	text1Length := len(text1)
+	text2Length := len(text2)
+	// Eliminate the null case.
+	if text1Length == 0 || text2Length == 0 {
+		return 0
+	}
+	// Truncate the longer string.
+	if text1Length > text2Length {
+		text1 = text1[text1Length-text2Length:]
+	} else if text1Length < text2Length {
+		text2 = text2[0:text1Length]
+	}
+	textLength := int(math.Min(float64(text1Length), float64(text2Length)))
+	// Quick check for the worst case.
+	if text1 == text2 {
+		return textLength
+	}
+
+	// Start by looking for a single character match and increase length until no match is found. Performance analysis: http://neil.fraser.name/news/2010/11/04/
+	best := 0
+	length := 1
+	for {
+		pattern := text1[textLength-length:]
+		found := strings.Index(text2, pattern)
+		if found == -1 {
+			break
+		}
+		length += found
+		if found == 0 || text1[textLength-length:] == text2[0:length] {
+			best = length
+			length++
+		}
+	}
+
+	return best
+}
+
+// DiffHalfMatch checks whether the two texts share a substring which is at least half the length of the longer text. This speedup can produce non-minimal diffs.
+func (dmp *DiffMatchPatch) DiffHalfMatch(text1, text2 string) []string {
+	// Unused in this code, but retained for interface compatibility.
+	runeSlices := dmp.diffHalfMatch([]rune(text1), []rune(text2))
+	if runeSlices == nil {
+		return nil
+	}
+
+	result := make([]string, len(runeSlices))
+	for i, r := range runeSlices {
+		result[i] = string(r)
+	}
+	return result
+}
+
+func (dmp *DiffMatchPatch) diffHalfMatch(text1, text2 []rune) [][]rune {
+	if dmp.DiffTimeout <= 0 {
+		// Don't risk returning a non-optimal diff if we have unlimited time.
+		return nil
+	}
+
+	var longtext, shorttext []rune
+	if len(text1) > len(text2) {
+		longtext = text1
+		shorttext = text2
+	} else {
+		longtext = text2
+		shorttext = text1
+	}
+
+	if len(longtext) < 4 || len(shorttext)*2 < len(longtext) {
+		return nil // Pointless.
+	}
+
+	// First check if the second quarter is the seed for a half-match.
+	hm1 := dmp.diffHalfMatchI(longtext, shorttext, int(float64(len(longtext)+3)/4))
+
+	// Check again based on the third quarter.
+	hm2 := dmp.diffHalfMatchI(longtext, shorttext, int(float64(len(longtext)+1)/2))
+
+	hm := [][]rune{}
+	if hm1 == nil && hm2 == nil {
+		return nil
+	} else if hm2 == nil {
+		hm = hm1
+	} else if hm1 == nil {
+		hm = hm2
+	} else {
+		// Both matched.  Select the longest.
+		if len(hm1[4]) > len(hm2[4]) {
+			hm = hm1
+		} else {
+			hm = hm2
+		}
+	}
+
+	// A half-match was found, sort out the return data.
+	if len(text1) > len(text2) {
+		return hm
+	}
+
+	return [][]rune{hm[2], hm[3], hm[0], hm[1], hm[4]}
+}
+
+// diffHalfMatchI checks if a substring of shorttext exist within longtext such that the substring is at least half the length of longtext?
+// Returns a slice containing the prefix of longtext, the suffix of longtext, the prefix of shorttext, the suffix of shorttext and the common middle, or null if there was no match.
+func (dmp *DiffMatchPatch) diffHalfMatchI(l, s []rune, i int) [][]rune {
+	var bestCommonA []rune
+	var bestCommonB []rune
+	var bestCommonLen int
+	var bestLongtextA []rune
+	var bestLongtextB []rune
+	var bestShorttextA []rune
+	var bestShorttextB []rune
+
+	// Start with a 1/4 length substring at position i as a seed.
+	seed := l[i : i+len(l)/4]
+
+	for j := runesIndexOf(s, seed, 0); j != -1; j = runesIndexOf(s, seed, j+1) {
+		prefixLength := commonPrefixLength(l[i:], s[j:])
+		suffixLength := commonSuffixLength(l[:i], s[:j])
+
+		if bestCommonLen < suffixLength+prefixLength {
+			bestCommonA = s[j-suffixLength : j]
+			bestCommonB = s[j : j+prefixLength]
+			bestCommonLen = len(bestCommonA) + len(bestCommonB)
+			bestLongtextA = l[:i-suffixLength]
+			bestLongtextB = l[i+prefixLength:]
+			bestShorttextA = s[:j-suffixLength]
+			bestShorttextB = s[j+prefixLength:]
+		}
+	}
+
+	if bestCommonLen*2 < len(l) {
+		return nil
+	}
+
+	return [][]rune{
+		bestLongtextA,
+		bestLongtextB,
+		bestShorttextA,
+		bestShorttextB,
+		append(bestCommonA, bestCommonB...),
+	}
+}
+
+// DiffCleanupSemantic reduces the number of edits by eliminating semantically trivial equalities.
+func (dmp *DiffMatchPatch) DiffCleanupSemantic(diffs []Diff) []Diff {
+	changes := false
+	// Stack of indices where equalities are found.
+	equalities := make([]int, 0, len(diffs))
+
+	var lastequality string
+	// Always equal to diffs[equalities[equalitiesLength - 1]][1]
+	var pointer int // Index of current position.
+	// Number of characters that changed prior to the equality.
+	var lengthInsertions1, lengthDeletions1 int
+	// Number of characters that changed after the equality.
+	var lengthInsertions2, lengthDeletions2 int
+
+	for pointer < len(diffs) {
+		if diffs[pointer].Type == DiffEqual {
+			// Equality found.
+			equalities = append(equalities, pointer)
+			lengthInsertions1 = lengthInsertions2
+			lengthDeletions1 = lengthDeletions2
+			lengthInsertions2 = 0
+			lengthDeletions2 = 0
+			lastequality = diffs[pointer].Text
+		} else {
+			// An insertion or deletion.
+
+			if diffs[pointer].Type == DiffInsert {
+				lengthInsertions2 += len(diffs[pointer].Text)
+			} else {
+				lengthDeletions2 += len(diffs[pointer].Text)
+			}
+			// Eliminate an equality that is smaller or equal to the edits on both sides of it.
+			difference1 := int(math.Max(float64(lengthInsertions1), float64(lengthDeletions1)))
+			difference2 := int(math.Max(float64(lengthInsertions2), float64(lengthDeletions2)))
+			if len(lastequality) > 0 &&
+				(len(lastequality) <= difference1) &&
+				(len(lastequality) <= difference2) {
+				// Duplicate record.
+				insPoint := equalities[len(equalities)-1]
+				diffs = splice(diffs, insPoint, 0, Diff{DiffDelete, lastequality})
+
+				// Change second copy to insert.
+				diffs[insPoint+1].Type = DiffInsert
+				// Throw away the equality we just deleted.
+				equalities = equalities[:len(equalities)-1]
+
+				if len(equalities) > 0 {
+					equalities = equalities[:len(equalities)-1]
+				}
+				pointer = -1
+				if len(equalities) > 0 {
+					pointer = equalities[len(equalities)-1]
+				}
+
+				lengthInsertions1 = 0 // Reset the counters.
+				lengthDeletions1 = 0
+				lengthInsertions2 = 0
+				lengthDeletions2 = 0
+				lastequality = ""
+				changes = true
+			}
+		}
+		pointer++
+	}
+
+	// Normalize the diff.
+	if changes {
+		diffs = dmp.DiffCleanupMerge(diffs)
+	}
+	diffs = dmp.DiffCleanupSemanticLossless(diffs)
+	// Find any overlaps between deletions and insertions.
+	// e.g: <del>abcxxx</del><ins>xxxdef</ins>
+	//   -> <del>abc</del>xxx<ins>def</ins>
+	// e.g: <del>xxxabc</del><ins>defxxx</ins>
+	//   -> <ins>def</ins>xxx<del>abc</del>
+	// Only extract an overlap if it is as big as the edit ahead or behind it.
+	pointer = 1
+	for pointer < len(diffs) {
+		if diffs[pointer-1].Type == DiffDelete &&
+			diffs[pointer].Type == DiffInsert {
+			deletion := diffs[pointer-1].Text
+			insertion := diffs[pointer].Text
+			overlapLength1 := dmp.DiffCommonOverlap(deletion, insertion)
+			overlapLength2 := dmp.DiffCommonOverlap(insertion, deletion)
+			if overlapLength1 >= overlapLength2 {
+				if float64(overlapLength1) >= float64(len(deletion))/2 ||
+					float64(overlapLength1) >= float64(len(insertion))/2 {
+
+					// Overlap found. Insert an equality and trim the surrounding edits.
+					diffs = splice(diffs, pointer, 0, Diff{DiffEqual, insertion[:overlapLength1]})
+					diffs[pointer-1].Text =
+						deletion[0 : len(deletion)-overlapLength1]
+					diffs[pointer+1].Text = insertion[overlapLength1:]
+					pointer++
+				}
+			} else {
+				if float64(overlapLength2) >= float64(len(deletion))/2 ||
+					float64(overlapLength2) >= float64(len(insertion))/2 {
+					// Reverse overlap found. Insert an equality and swap and trim the surrounding edits.
+					overlap := Diff{DiffEqual, deletion[:overlapLength2]}
+					diffs = splice(diffs, pointer, 0, overlap)
+					diffs[pointer-1].Type = DiffInsert
+					diffs[pointer-1].Text = insertion[0 : len(insertion)-overlapLength2]
+					diffs[pointer+1].Type = DiffDelete
+					diffs[pointer+1].Text = deletion[overlapLength2:]
+					pointer++
+				}
+			}
+			pointer++
+		}
+		pointer++
+	}
+
+	return diffs
+}
+
+// Define some regex patterns for matching boundaries.
+var (
+	nonAlphaNumericRegex = regexp.MustCompile(`[^a-zA-Z0-9]`)
+	whitespaceRegex      = regexp.MustCompile(`\s`)
+	linebreakRegex       = regexp.MustCompile(`[\r\n]`)
+	blanklineEndRegex    = regexp.MustCompile(`\n\r?\n$`)
+	blanklineStartRegex  = regexp.MustCompile(`^\r?\n\r?\n`)
+)
+
+// diffCleanupSemanticScore computes a score representing whether the internal boundary falls on logical boundaries.
+// Scores range from 6 (best) to 0 (worst). Closure, but does not reference any external variables.
+func diffCleanupSemanticScore(one, two string) int {
+	if len(one) == 0 || len(two) == 0 {
+		// Edges are the best.
+		return 6
+	}
+
+	// Each port of this function behaves slightly differently due to subtle differences in each language's definition of things like 'whitespace'.  Since this function's purpose is largely cosmetic, the choice has been made to use each language's native features rather than force total conformity.
+	rune1, _ := utf8.DecodeLastRuneInString(one)
+	rune2, _ := utf8.DecodeRuneInString(two)
+	char1 := string(rune1)
+	char2 := string(rune2)
+
+	nonAlphaNumeric1 := nonAlphaNumericRegex.MatchString(char1)
+	nonAlphaNumeric2 := nonAlphaNumericRegex.MatchString(char2)
+	whitespace1 := nonAlphaNumeric1 && whitespaceRegex.MatchString(char1)
+	whitespace2 := nonAlphaNumeric2 && whitespaceRegex.MatchString(char2)
+	lineBreak1 := whitespace1 && linebreakRegex.MatchString(char1)
+	lineBreak2 := whitespace2 && linebreakRegex.MatchString(char2)
+	blankLine1 := lineBreak1 && blanklineEndRegex.MatchString(one)
+	blankLine2 := lineBreak2 && blanklineEndRegex.MatchString(two)
+
+	if blankLine1 || blankLine2 {
+		// Five points for blank lines.
+		return 5
+	} else if lineBreak1 || lineBreak2 {
+		// Four points for line breaks.
+		return 4
+	} else if nonAlphaNumeric1 && !whitespace1 && whitespace2 {
+		// Three points for end of sentences.
+		return 3
+	} else if whitespace1 || whitespace2 {
+		// Two points for whitespace.
+		return 2
+	} else if nonAlphaNumeric1 || nonAlphaNumeric2 {
+		// One point for non-alphanumeric.
+		return 1
+	}
+	return 0
+}
+
+// DiffCleanupSemanticLossless looks for single edits surrounded on both sides by equalities which can be shifted sideways to align the edit to a word boundary.
+// E.g: The c<ins>at c</ins>ame. -> The <ins>cat </ins>came.
+func (dmp *DiffMatchPatch) DiffCleanupSemanticLossless(diffs []Diff) []Diff {
+	pointer := 1
+
+	// Intentionally ignore the first and last element (don't need checking).
+	for pointer < len(diffs)-1 {
+		if diffs[pointer-1].Type == DiffEqual &&
+			diffs[pointer+1].Type == DiffEqual {
+
+			// This is a single edit surrounded by equalities.
+			equality1 := diffs[pointer-1].Text
+			edit := diffs[pointer].Text
+			equality2 := diffs[pointer+1].Text
+
+			// First, shift the edit as far left as possible.
+			commonOffset := dmp.DiffCommonSuffix(equality1, edit)
+			if commonOffset > 0 {
+				commonString := edit[len(edit)-commonOffset:]
+				equality1 = equality1[0 : len(equality1)-commonOffset]
+				edit = commonString + edit[:len(edit)-commonOffset]
+				equality2 = commonString + equality2
+			}
+
+			// Second, step character by character right, looking for the best fit.
+			bestEquality1 := equality1
+			bestEdit := edit
+			bestEquality2 := equality2
+			bestScore := diffCleanupSemanticScore(equality1, edit) +
+				diffCleanupSemanticScore(edit, equality2)
+
+			for len(edit) != 0 && len(equality2) != 0 {
+				_, sz := utf8.DecodeRuneInString(edit)
+				if len(equality2) < sz || edit[:sz] != equality2[:sz] {
+					break
+				}
+				equality1 += edit[:sz]
+				edit = edit[sz:] + equality2[:sz]
+				equality2 = equality2[sz:]
+				score := diffCleanupSemanticScore(equality1, edit) +
+					diffCleanupSemanticScore(edit, equality2)
+				// The >= encourages trailing rather than leading whitespace on edits.
+				if score >= bestScore {
+					bestScore = score
+					bestEquality1 = equality1
+					bestEdit = edit
+					bestEquality2 = equality2
+				}
+			}
+
+			if diffs[pointer-1].Text != bestEquality1 {
+				// We have an improvement, save it back to the diff.
+				if len(bestEquality1) != 0 {
+					diffs[pointer-1].Text = bestEquality1
+				} else {
+					diffs = splice(diffs, pointer-1, 1)
+					pointer--
+				}
+
+				diffs[pointer].Text = bestEdit
+				if len(bestEquality2) != 0 {
+					diffs[pointer+1].Text = bestEquality2
+				} else {
+					diffs = append(diffs[:pointer+1], diffs[pointer+2:]...)
+					pointer--
+				}
+			}
+		}
+		pointer++
+	}
+
+	return diffs
+}
+
+// DiffCleanupEfficiency reduces the number of edits by eliminating operationally trivial equalities.
+func (dmp *DiffMatchPatch) DiffCleanupEfficiency(diffs []Diff) []Diff {
+	changes := false
+	// Stack of indices where equalities are found.
+	type equality struct {
+		data int
+		next *equality
+	}
+	var equalities *equality
+	// Always equal to equalities[equalitiesLength-1][1]
+	lastequality := ""
+	pointer := 0 // Index of current position.
+	// Is there an insertion operation before the last equality.
+	preIns := false
+	// Is there a deletion operation before the last equality.
+	preDel := false
+	// Is there an insertion operation after the last equality.
+	postIns := false
+	// Is there a deletion operation after the last equality.
+	postDel := false
+	for pointer < len(diffs) {
+		if diffs[pointer].Type == DiffEqual { // Equality found.
+			if len(diffs[pointer].Text) < dmp.DiffEditCost &&
+				(postIns || postDel) {
+				// Candidate found.
+				equalities = &equality{
+					data: pointer,
+					next: equalities,
+				}
+				preIns = postIns
+				preDel = postDel
+				lastequality = diffs[pointer].Text
+			} else {
+				// Not a candidate, and can never become one.
+				equalities = nil
+				lastequality = ""
+			}
+			postIns = false
+			postDel = false
+		} else { // An insertion or deletion.
+			if diffs[pointer].Type == DiffDelete {
+				postDel = true
+			} else {
+				postIns = true
+			}
+
+			// Five types to be split:
+			// <ins>A</ins><del>B</del>XY<ins>C</ins><del>D</del>
+			// <ins>A</ins>X<ins>C</ins><del>D</del>
+			// <ins>A</ins><del>B</del>X<ins>C</ins>
+			// <ins>A</del>X<ins>C</ins><del>D</del>
+			// <ins>A</ins><del>B</del>X<del>C</del>
+			var sumPres int
+			if preIns {
+				sumPres++
+			}
+			if preDel {
+				sumPres++
+			}
+			if postIns {
+				sumPres++
+			}
+			if postDel {
+				sumPres++
+			}
+			if len(lastequality) > 0 &&
+				((preIns && preDel && postIns && postDel) ||
+					((len(lastequality) < dmp.DiffEditCost/2) && sumPres == 3)) {
+
+				insPoint := equalities.data
+
+				// Duplicate record.
+				diffs = splice(diffs, insPoint, 0, Diff{DiffDelete, lastequality})
+
+				// Change second copy to insert.
+				diffs[insPoint+1].Type = DiffInsert
+				// Throw away the equality we just deleted.
+				equalities = equalities.next
+				lastequality = ""
+
+				if preIns && preDel {
+					// No changes made which could affect previous entry, keep going.
+					postIns = true
+					postDel = true
+					equalities = nil
+				} else {
+					if equalities != nil {
+						equalities = equalities.next
+					}
+					if equalities != nil {
+						pointer = equalities.data
+					} else {
+						pointer = -1
+					}
+					postIns = false
+					postDel = false
+				}
+				changes = true
+			}
+		}
+		pointer++
+	}
+
+	if changes {
+		diffs = dmp.DiffCleanupMerge(diffs)
+	}
+
+	return diffs
+}
+
+// DiffCleanupMerge reorders and merges like edit sections. Merge equalities.
+// Any edit section can move as long as it doesn't cross an equality.
+func (dmp *DiffMatchPatch) DiffCleanupMerge(diffs []Diff) []Diff {
+	// Add a dummy entry at the end.
+	diffs = append(diffs, Diff{DiffEqual, ""})
+	pointer := 0
+	countDelete := 0
+	countInsert := 0
+	commonlength := 0
+	textDelete := []rune(nil)
+	textInsert := []rune(nil)
+
+	for pointer < len(diffs) {
+		switch diffs[pointer].Type {
+		case DiffInsert:
+			countInsert++
+			textInsert = append(textInsert, []rune(diffs[pointer].Text)...)
+			pointer++
+			break
+		case DiffDelete:
+			countDelete++
+			textDelete = append(textDelete, []rune(diffs[pointer].Text)...)
+			pointer++
+			break
+		case DiffEqual:
+			// Upon reaching an equality, check for prior redundancies.
+			if countDelete+countInsert > 1 {
+				if countDelete != 0 && countInsert != 0 {
+					// Factor out any common prefixies.
+					commonlength = commonPrefixLength(textInsert, textDelete)
+					if commonlength != 0 {
+						x := pointer - countDelete - countInsert
+						if x > 0 && diffs[x-1].Type == DiffEqual {
+							diffs[x-1].Text += string(textInsert[:commonlength])
+						} else {
+							diffs = append([]Diff{Diff{DiffEqual, string(textInsert[:commonlength])}}, diffs...)
+							pointer++
+						}
+						textInsert = textInsert[commonlength:]
+						textDelete = textDelete[commonlength:]
+					}
+					// Factor out any common suffixies.
+					commonlength = commonSuffixLength(textInsert, textDelete)
+					if commonlength != 0 {
+						insertIndex := len(textInsert) - commonlength
+						deleteIndex := len(textDelete) - commonlength
+						diffs[pointer].Text = string(textInsert[insertIndex:]) + diffs[pointer].Text
+						textInsert = textInsert[:insertIndex]
+						textDelete = textDelete[:deleteIndex]
+					}
+				}
+				// Delete the offending records and add the merged ones.
+				if countDelete == 0 {
+					diffs = splice(diffs, pointer-countInsert,
+						countDelete+countInsert,
+						Diff{DiffInsert, string(textInsert)})
+				} else if countInsert == 0 {
+					diffs = splice(diffs, pointer-countDelete,
+						countDelete+countInsert,
+						Diff{DiffDelete, string(textDelete)})
+				} else {
+					diffs = splice(diffs, pointer-countDelete-countInsert,
+						countDelete+countInsert,
+						Diff{DiffDelete, string(textDelete)},
+						Diff{DiffInsert, string(textInsert)})
+				}
+
+				pointer = pointer - countDelete - countInsert + 1
+				if countDelete != 0 {
+					pointer++
+				}
+				if countInsert != 0 {
+					pointer++
+				}
+			} else if pointer != 0 && diffs[pointer-1].Type == DiffEqual {
+				// Merge this equality with the previous one.
+				diffs[pointer-1].Text += diffs[pointer].Text
+				diffs = append(diffs[:pointer], diffs[pointer+1:]...)
+			} else {
+				pointer++
+			}
+			countInsert = 0
+			countDelete = 0
+			textDelete = nil
+			textInsert = nil
+			break
+		}
+	}
+
+	if len(diffs[len(diffs)-1].Text) == 0 {
+		diffs = diffs[0 : len(diffs)-1] // Remove the dummy entry at the end.
+	}
+
+	// Second pass: look for single edits surrounded on both sides by equalities which can be shifted sideways to eliminate an equality. E.g: A<ins>BA</ins>C -> <ins>AB</ins>AC
+	changes := false
+	pointer = 1
+	// Intentionally ignore the first and last element (don't need checking).
+	for pointer < (len(diffs) - 1) {
+		if diffs[pointer-1].Type == DiffEqual &&
+			diffs[pointer+1].Type == DiffEqual {
+			// This is a single edit surrounded by equalities.
+			if strings.HasSuffix(diffs[pointer].Text, diffs[pointer-1].Text) {
+				// Shift the edit over the previous equality.
+				diffs[pointer].Text = diffs[pointer-1].Text +
+					diffs[pointer].Text[:len(diffs[pointer].Text)-len(diffs[pointer-1].Text)]
+				diffs[pointer+1].Text = diffs[pointer-1].Text + diffs[pointer+1].Text
+				diffs = splice(diffs, pointer-1, 1)
+				changes = true
+			} else if strings.HasPrefix(diffs[pointer].Text, diffs[pointer+1].Text) {
+				// Shift the edit over the next equality.
+				diffs[pointer-1].Text += diffs[pointer+1].Text
+				diffs[pointer].Text =
+					diffs[pointer].Text[len(diffs[pointer+1].Text):] + diffs[pointer+1].Text
+				diffs = splice(diffs, pointer+1, 1)
+				changes = true
+			}
+		}
+		pointer++
+	}
+
+	// If shifts were made, the diff needs reordering and another shift sweep.
+	if changes {
+		diffs = dmp.DiffCleanupMerge(diffs)
+	}
+
+	return diffs
+}
+
+// DiffXIndex returns the equivalent location in s2.
+func (dmp *DiffMatchPatch) DiffXIndex(diffs []Diff, loc int) int {
+	chars1 := 0
+	chars2 := 0
+	lastChars1 := 0
+	lastChars2 := 0
+	lastDiff := Diff{}
+	for i := 0; i < len(diffs); i++ {
+		aDiff := diffs[i]
+		if aDiff.Type != DiffInsert {
+			// Equality or deletion.
+			chars1 += len(aDiff.Text)
+		}
+		if aDiff.Type != DiffDelete {
+			// Equality or insertion.
+			chars2 += len(aDiff.Text)
+		}
+		if chars1 > loc {
+			// Overshot the location.
+			lastDiff = aDiff
+			break
+		}
+		lastChars1 = chars1
+		lastChars2 = chars2
+	}
+	if lastDiff.Type == DiffDelete {
+		// The location was deleted.
+		return lastChars2
+	}
+	// Add the remaining character length.
+	return lastChars2 + (loc - lastChars1)
+}
+
+// DiffPrettyHtml converts a []Diff into a pretty HTML report.
+// It is intended as an example from which to write one's own display functions.
+func (dmp *DiffMatchPatch) DiffPrettyHtml(diffs []Diff) string {
+	var buff bytes.Buffer
+	for _, diff := range diffs {
+		text := strings.Replace(html.EscapeString(diff.Text), "\n", "&para;<br>", -1)
+		switch diff.Type {
+		case DiffInsert:
+			_, _ = buff.WriteString("<ins style=\"background:#e6ffe6;\">")
+			_, _ = buff.WriteString(text)
+			_, _ = buff.WriteString("</ins>")
+		case DiffDelete:
+			_, _ = buff.WriteString("<del style=\"background:#ffe6e6;\">")
+			_, _ = buff.WriteString(text)
+			_, _ = buff.WriteString("</del>")
+		case DiffEqual:
+			_, _ = buff.WriteString("<span>")
+			_, _ = buff.WriteString(text)
+			_, _ = buff.WriteString("</span>")
+		}
+	}
+	return buff.String()
+}
+
+// DiffPrettyText converts a []Diff into a colored text report.
+func (dmp *DiffMatchPatch) DiffPrettyText(diffs []Diff) string {
+	var buff bytes.Buffer
+	for _, diff := range diffs {
+		text := diff.Text
+
+		switch diff.Type {
+		case DiffInsert:
+			_, _ = buff.WriteString("\x1b[32m")
+			_, _ = buff.WriteString(text)
+			_, _ = buff.WriteString("\x1b[0m")
+		case DiffDelete:
+			_, _ = buff.WriteString("\x1b[31m")
+			_, _ = buff.WriteString(text)
+			_, _ = buff.WriteString("\x1b[0m")
+		case DiffEqual:
+			_, _ = buff.WriteString(text)
+		}
+	}
+
+	return buff.String()
+}
+
+// DiffText1 computes and returns the source text (all equalities and deletions).
+func (dmp *DiffMatchPatch) DiffText1(diffs []Diff) string {
+	//StringBuilder text = new StringBuilder()
+	var text bytes.Buffer
+
+	for _, aDiff := range diffs {
+		if aDiff.Type != DiffInsert {
+			_, _ = text.WriteString(aDiff.Text)
+		}
+	}
+	return text.String()
+}
+
+// DiffText2 computes and returns the destination text (all equalities and insertions).
+func (dmp *DiffMatchPatch) DiffText2(diffs []Diff) string {
+	var text bytes.Buffer
+
+	for _, aDiff := range diffs {
+		if aDiff.Type != DiffDelete {
+			_, _ = text.WriteString(aDiff.Text)
+		}
+	}
+	return text.String()
+}
+
+// DiffLevenshtein computes the Levenshtein distance that is the number of inserted, deleted or substituted characters.
+func (dmp *DiffMatchPatch) DiffLevenshtein(diffs []Diff) int {
+	levenshtein := 0
+	insertions := 0
+	deletions := 0
+
+	for _, aDiff := range diffs {
+		switch aDiff.Type {
+		case DiffInsert:
+			insertions += utf8.RuneCountInString(aDiff.Text)
+		case DiffDelete:
+			deletions += utf8.RuneCountInString(aDiff.Text)
+		case DiffEqual:
+			// A deletion and an insertion is one substitution.
+			levenshtein += max(insertions, deletions)
+			insertions = 0
+			deletions = 0
+		}
+	}
+
+	levenshtein += max(insertions, deletions)
+	return levenshtein
+}
+
+// DiffToDelta crushes the diff into an encoded string which describes the operations required to transform text1 into text2.
+// E.g. =3\t-2\t+ing  -> Keep 3 chars, delete 2 chars, insert 'ing'. Operations are tab-separated.  Inserted text is escaped using %xx notation.
+func (dmp *DiffMatchPatch) DiffToDelta(diffs []Diff) string {
+	var text bytes.Buffer
+	for _, aDiff := range diffs {
+		switch aDiff.Type {
+		case DiffInsert:
+			_, _ = text.WriteString("+")
+			_, _ = text.WriteString(strings.Replace(url.QueryEscape(aDiff.Text), "+", " ", -1))
+			_, _ = text.WriteString("\t")
+			break
+		case DiffDelete:
+			_, _ = text.WriteString("-")
+			_, _ = text.WriteString(strconv.Itoa(utf8.RuneCountInString(aDiff.Text)))
+			_, _ = text.WriteString("\t")
+			break
+		case DiffEqual:
+			_, _ = text.WriteString("=")
+			_, _ = text.WriteString(strconv.Itoa(utf8.RuneCountInString(aDiff.Text)))
+			_, _ = text.WriteString("\t")
+			break
+		}
+	}
+	delta := text.String()
+	if len(delta) != 0 {
+		// Strip off trailing tab character.
+		delta = delta[0 : utf8.RuneCountInString(delta)-1]
+		delta = unescaper.Replace(delta)
+	}
+	return delta
+}
+
+// DiffFromDelta given the original text1, and an encoded string which describes the operations required to transform text1 into text2, comAdde the full diff.
+func (dmp *DiffMatchPatch) DiffFromDelta(text1 string, delta string) (diffs []Diff, err error) {
+	i := 0
+	runes := []rune(text1)
+
+	for _, token := range strings.Split(delta, "\t") {
+		if len(token) == 0 {
+			// Blank tokens are ok (from a trailing \t).
+			continue
+		}
+
+		// Each token begins with a one character parameter which specifies the operation of this token (delete, insert, equality).
+		param := token[1:]
+
+		switch op := token[0]; op {
+		case '+':
+			// Decode would Diff all "+" to " "
+			param = strings.Replace(param, "+", "%2b", -1)
+			param, err = url.QueryUnescape(param)
+			if err != nil {
+				return nil, err
+			}
+			if !utf8.ValidString(param) {
+				return nil, fmt.Errorf("invalid UTF-8 token: %q", param)
+			}
+
+			diffs = append(diffs, Diff{DiffInsert, param})
+		case '=', '-':
+			n, err := strconv.ParseInt(param, 10, 0)
+			if err != nil {
+				return nil, err
+			} else if n < 0 {
+				return nil, errors.New("Negative number in DiffFromDelta: " + param)
+			}
+
+			i += int(n)
+			// Break out if we are out of bounds, go1.6 can't handle this very well
+			if i > len(runes) {
+				break
+			}
+			// Remember that string slicing is by byte - we want by rune here.
+			text := string(runes[i-int(n) : i])
+
+			if op == '=' {
+				diffs = append(diffs, Diff{DiffEqual, text})
+			} else {
+				diffs = append(diffs, Diff{DiffDelete, text})
+			}
+		default:
+			// Anything else is an error.
+			return nil, errors.New("Invalid diff operation in DiffFromDelta: " + string(token[0]))
+		}
+	}
+
+	if i != len(runes) {
+		return nil, fmt.Errorf("Delta length (%v) is different from source text length (%v)", i, len(text1))
+	}
+
+	return diffs, nil
+}
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go
new file mode 100644
index 0000000000..d3acc32ce1
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/diffmatchpatch.go
@@ -0,0 +1,46 @@
+// Copyright (c) 2012-2016 The go-diff authors. All rights reserved.
+// https://github.com/sergi/go-diff
+// See the included LICENSE file for license details.
+//
+// go-diff is a Go implementation of Google's Diff, Match, and Patch library
+// Original library is Copyright (c) 2006 Google Inc.
+// http://code.google.com/p/google-diff-match-patch/
+
+// Package diffmatchpatch offers robust algorithms to perform the operations required for synchronizing plain text.
+package diffmatchpatch
+
+import (
+	"time"
+)
+
+// DiffMatchPatch holds the configuration for diff-match-patch operations.
+type DiffMatchPatch struct {
+	// Number of seconds to map a diff before giving up (0 for infinity).
+	DiffTimeout time.Duration
+	// Cost of an empty edit operation in terms of edit characters.
+	DiffEditCost int
+	// How far to search for a match (0 = exact location, 1000+ = broad match). A match this many characters away from the expected location will add 1.0 to the score (0.0 is a perfect match).
+	MatchDistance int
+	// When deleting a large block of text (over ~64 characters), how close do the contents have to be to match the expected contents. (0.0 = perfection, 1.0 = very loose).  Note that MatchThreshold controls how closely the end points of a delete need to match.
+	PatchDeleteThreshold float64
+	// Chunk size for context length.
+	PatchMargin int
+	// The number of bits in an int.
+	MatchMaxBits int
+	// At what point is no match declared (0.0 = perfection, 1.0 = very loose).
+	MatchThreshold float64
+}
+
+// New creates a new DiffMatchPatch object with default parameters.
+func New() *DiffMatchPatch {
+	// Defaults.
+	return &DiffMatchPatch{
+		DiffTimeout:          time.Second,
+		DiffEditCost:         4,
+		MatchThreshold:       0.5,
+		MatchDistance:        1000,
+		PatchDeleteThreshold: 0.5,
+		PatchMargin:          4,
+		MatchMaxBits:         32,
+	}
+}
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/match.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/match.go
new file mode 100644
index 0000000000..17374e109f
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/match.go
@@ -0,0 +1,160 @@
+// Copyright (c) 2012-2016 The go-diff authors. All rights reserved.
+// https://github.com/sergi/go-diff
+// See the included LICENSE file for license details.
+//
+// go-diff is a Go implementation of Google's Diff, Match, and Patch library
+// Original library is Copyright (c) 2006 Google Inc.
+// http://code.google.com/p/google-diff-match-patch/
+
+package diffmatchpatch
+
+import (
+	"math"
+)
+
+// MatchMain locates the best instance of 'pattern' in 'text' near 'loc'.
+// Returns -1 if no match found.
+func (dmp *DiffMatchPatch) MatchMain(text, pattern string, loc int) int {
+	// Check for null inputs not needed since null can't be passed in C#.
+
+	loc = int(math.Max(0, math.Min(float64(loc), float64(len(text)))))
+	if text == pattern {
+		// Shortcut (potentially not guaranteed by the algorithm)
+		return 0
+	} else if len(text) == 0 {
+		// Nothing to match.
+		return -1
+	} else if loc+len(pattern) <= len(text) && text[loc:loc+len(pattern)] == pattern {
+		// Perfect match at the perfect spot!  (Includes case of null pattern)
+		return loc
+	}
+	// Do a fuzzy compare.
+	return dmp.MatchBitap(text, pattern, loc)
+}
+
+// MatchBitap locates the best instance of 'pattern' in 'text' near 'loc' using the Bitap algorithm.
+// Returns -1 if no match was found.
+func (dmp *DiffMatchPatch) MatchBitap(text, pattern string, loc int) int {
+	// Initialise the alphabet.
+	s := dmp.MatchAlphabet(pattern)
+
+	// Highest score beyond which we give up.
+	scoreThreshold := dmp.MatchThreshold
+	// Is there a nearby exact match? (speedup)
+	bestLoc := indexOf(text, pattern, loc)
+	if bestLoc != -1 {
+		scoreThreshold = math.Min(dmp.matchBitapScore(0, bestLoc, loc,
+			pattern), scoreThreshold)
+		// What about in the other direction? (speedup)
+		bestLoc = lastIndexOf(text, pattern, loc+len(pattern))
+		if bestLoc != -1 {
+			scoreThreshold = math.Min(dmp.matchBitapScore(0, bestLoc, loc,
+				pattern), scoreThreshold)
+		}
+	}
+
+	// Initialise the bit arrays.
+	matchmask := 1 << uint((len(pattern) - 1))
+	bestLoc = -1
+
+	var binMin, binMid int
+	binMax := len(pattern) + len(text)
+	lastRd := []int{}
+	for d := 0; d < len(pattern); d++ {
+		// Scan for the best match; each iteration allows for one more error. Run a binary search to determine how far from 'loc' we can stray at this error level.
+		binMin = 0
+		binMid = binMax
+		for binMin < binMid {
+			if dmp.matchBitapScore(d, loc+binMid, loc, pattern) <= scoreThreshold {
+				binMin = binMid
+			} else {
+				binMax = binMid
+			}
+			binMid = (binMax-binMin)/2 + binMin
+		}
+		// Use the result from this iteration as the maximum for the next.
+		binMax = binMid
+		start := int(math.Max(1, float64(loc-binMid+1)))
+		finish := int(math.Min(float64(loc+binMid), float64(len(text))) + float64(len(pattern)))
+
+		rd := make([]int, finish+2)
+		rd[finish+1] = (1 << uint(d)) - 1
+
+		for j := finish; j >= start; j-- {
+			var charMatch int
+			if len(text) <= j-1 {
+				// Out of range.
+				charMatch = 0
+			} else if _, ok := s[text[j-1]]; !ok {
+				charMatch = 0
+			} else {
+				charMatch = s[text[j-1]]
+			}
+
+			if d == 0 {
+				// First pass: exact match.
+				rd[j] = ((rd[j+1] << 1) | 1) & charMatch
+			} else {
+				// Subsequent passes: fuzzy match.
+				rd[j] = ((rd[j+1]<<1)|1)&charMatch | (((lastRd[j+1] | lastRd[j]) << 1) | 1) | lastRd[j+1]
+			}
+			if (rd[j] & matchmask) != 0 {
+				score := dmp.matchBitapScore(d, j-1, loc, pattern)
+				// This match will almost certainly be better than any existing match.  But check anyway.
+				if score <= scoreThreshold {
+					// Told you so.
+					scoreThreshold = score
+					bestLoc = j - 1
+					if bestLoc > loc {
+						// When passing loc, don't exceed our current distance from loc.
+						start = int(math.Max(1, float64(2*loc-bestLoc)))
+					} else {
+						// Already passed loc, downhill from here on in.
+						break
+					}
+				}
+			}
+		}
+		if dmp.matchBitapScore(d+1, loc, loc, pattern) > scoreThreshold {
+			// No hope for a (better) match at greater error levels.
+			break
+		}
+		lastRd = rd
+	}
+	return bestLoc
+}
+
+// matchBitapScore computes and returns the score for a match with e errors and x location.
+func (dmp *DiffMatchPatch) matchBitapScore(e, x, loc int, pattern string) float64 {
+	accuracy := float64(e) / float64(len(pattern))
+	proximity := math.Abs(float64(loc - x))
+	if dmp.MatchDistance == 0 {
+		// Dodge divide by zero error.
+		if proximity == 0 {
+			return accuracy
+		}
+
+		return 1.0
+	}
+	return accuracy + (proximity / float64(dmp.MatchDistance))
+}
+
+// MatchAlphabet initialises the alphabet for the Bitap algorithm.
+func (dmp *DiffMatchPatch) MatchAlphabet(pattern string) map[byte]int {
+	s := map[byte]int{}
+	charPattern := []byte(pattern)
+	for _, c := range charPattern {
+		_, ok := s[c]
+		if !ok {
+			s[c] = 0
+		}
+	}
+	i := 0
+
+	for _, c := range charPattern {
+		value := s[c] | int(uint(1)<<uint((len(pattern)-i-1)))
+		s[c] = value
+		i++
+	}
+	return s
+}
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go
new file mode 100644
index 0000000000..aed242bc6e
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/mathutil.go
@@ -0,0 +1,23 @@
+// Copyright (c) 2012-2016 The go-diff authors. All rights reserved.
+// https://github.com/sergi/go-diff
+// See the included LICENSE file for license details.
+//
+// go-diff is a Go implementation of Google's Diff, Match, and Patch library
+// Original library is Copyright (c) 2006 Google Inc.
+// http://code.google.com/p/google-diff-match-patch/
+
+package diffmatchpatch
+
+func min(x, y int) int {
+	if x < y {
+		return x
+	}
+	return y
+}
+
+func max(x, y int) int {
+	if x > y {
+		return x
+	}
+	return y
+}
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go
new file mode 100644
index 0000000000..533ec0da7b
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/operation_string.go
@@ -0,0 +1,17 @@
+// Code generated by "stringer -type=Operation -trimprefix=Diff"; DO NOT EDIT.
+
+package diffmatchpatch
+
+import "fmt"
+
+const _Operation_name = "DeleteEqualInsert"
+
+var _Operation_index = [...]uint8{0, 6, 11, 17}
+
+func (i Operation) String() string {
+	i -= -1
+	if i < 0 || i >= Operation(len(_Operation_index)-1) {
+		return fmt.Sprintf("Operation(%d)", i+-1)
+	}
+	return _Operation_name[_Operation_index[i]:_Operation_index[i+1]]
+}
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go
new file mode 100644
index 0000000000..223c43c426
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/patch.go
@@ -0,0 +1,556 @@
+// Copyright (c) 2012-2016 The go-diff authors. All rights reserved.
+// https://github.com/sergi/go-diff
+// See the included LICENSE file for license details.
+//
+// go-diff is a Go implementation of Google's Diff, Match, and Patch library
+// Original library is Copyright (c) 2006 Google Inc.
+// http://code.google.com/p/google-diff-match-patch/
+
+package diffmatchpatch
+
+import (
+	"bytes"
+	"errors"
+	"math"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// Patch represents one patch operation.
+type Patch struct {
+	diffs   []Diff
+	Start1  int
+	Start2  int
+	Length1 int
+	Length2 int
+}
+
+// String emulates GNU diff's format.
+// Header: @@ -382,8 +481,9 @@
+// Indices are printed as 1-based, not 0-based.
+func (p *Patch) String() string {
+	var coords1, coords2 string
+
+	if p.Length1 == 0 {
+		coords1 = strconv.Itoa(p.Start1) + ",0"
+	} else if p.Length1 == 1 {
+		coords1 = strconv.Itoa(p.Start1 + 1)
+	} else {
+		coords1 = strconv.Itoa(p.Start1+1) + "," + strconv.Itoa(p.Length1)
+	}
+
+	if p.Length2 == 0 {
+		coords2 = strconv.Itoa(p.Start2) + ",0"
+	} else if p.Length2 == 1 {
+		coords2 = strconv.Itoa(p.Start2 + 1)
+	} else {
+		coords2 = strconv.Itoa(p.Start2+1) + "," + strconv.Itoa(p.Length2)
+	}
+
+	var text bytes.Buffer
+	_, _ = text.WriteString("@@ -" + coords1 + " +" + coords2 + " @@\n")
+
+	// Escape the body of the patch with %xx notation.
+	for _, aDiff := range p.diffs {
+		switch aDiff.Type {
+		case DiffInsert:
+			_, _ = text.WriteString("+")
+		case DiffDelete:
+			_, _ = text.WriteString("-")
+		case DiffEqual:
+			_, _ = text.WriteString(" ")
+		}
+
+		_, _ = text.WriteString(strings.Replace(url.QueryEscape(aDiff.Text), "+", " ", -1))
+		_, _ = text.WriteString("\n")
+	}
+
+	return unescaper.Replace(text.String())
+}
+
+// PatchAddContext increases the context until it is unique, but doesn't let the pattern expand beyond MatchMaxBits.
+func (dmp *DiffMatchPatch) PatchAddContext(patch Patch, text string) Patch {
+	if len(text) == 0 {
+		return patch
+	}
+
+	pattern := text[patch.Start2 : patch.Start2+patch.Length1]
+	padding := 0
+
+	// Look for the first and last matches of pattern in text.  If two different matches are found, increase the pattern length.
+	for strings.Index(text, pattern) != strings.LastIndex(text, pattern) &&
+		len(pattern) < dmp.MatchMaxBits-2*dmp.PatchMargin {
+		padding += dmp.PatchMargin
+		maxStart := max(0, patch.Start2-padding)
+		minEnd := min(len(text), patch.Start2+patch.Length1+padding)
+		pattern = text[maxStart:minEnd]
+	}
+	// Add one chunk for good luck.
+	padding += dmp.PatchMargin
+
+	// Add the prefix.
+	prefix := text[max(0, patch.Start2-padding):patch.Start2]
+	if len(prefix) != 0 {
+		patch.diffs = append([]Diff{Diff{DiffEqual, prefix}}, patch.diffs...)
+	}
+	// Add the suffix.
+	suffix := text[patch.Start2+patch.Length1 : min(len(text), patch.Start2+patch.Length1+padding)]
+	if len(suffix) != 0 {
+		patch.diffs = append(patch.diffs, Diff{DiffEqual, suffix})
+	}
+
+	// Roll back the start points.
+	patch.Start1 -= len(prefix)
+	patch.Start2 -= len(prefix)
+	// Extend the lengths.
+	patch.Length1 += len(prefix) + len(suffix)
+	patch.Length2 += len(prefix) + len(suffix)
+
+	return patch
+}
+
+// PatchMake computes a list of patches.
+func (dmp *DiffMatchPatch) PatchMake(opt ...interface{}) []Patch {
+	if len(opt) == 1 {
+		diffs, _ := opt[0].([]Diff)
+		text1 := dmp.DiffText1(diffs)
+		return dmp.PatchMake(text1, diffs)
+	} else if len(opt) == 2 {
+		text1 := opt[0].(string)
+		switch t := opt[1].(type) {
+		case string:
+			diffs := dmp.DiffMain(text1, t, true)
+			if len(diffs) > 2 {
+				diffs = dmp.DiffCleanupSemantic(diffs)
+				diffs = dmp.DiffCleanupEfficiency(diffs)
+			}
+			return dmp.PatchMake(text1, diffs)
+		case []Diff:
+			return dmp.patchMake2(text1, t)
+		}
+	} else if len(opt) == 3 {
+		return dmp.PatchMake(opt[0], opt[2])
+	}
+	return []Patch{}
+}
+
+// patchMake2 computes a list of patches to turn text1 into text2.
+// text2 is not provided, diffs are the delta between text1 and text2.
+func (dmp *DiffMatchPatch) patchMake2(text1 string, diffs []Diff) []Patch {
+	// Check for null inputs not needed since null can't be passed in C#.
+	patches := []Patch{}
+	if len(diffs) == 0 {
+		return patches // Get rid of the null case.
+	}
+
+	patch := Patch{}
+	charCount1 := 0 // Number of characters into the text1 string.
+	charCount2 := 0 // Number of characters into the text2 string.
+	// Start with text1 (prepatchText) and apply the diffs until we arrive at text2 (postpatchText). We recreate the patches one by one to determine context info.
+	prepatchText := text1
+	postpatchText := text1
+
+	for i, aDiff := range diffs {
+		if len(patch.diffs) == 0 && aDiff.Type != DiffEqual {
+			// A new patch starts here.
+			patch.Start1 = charCount1
+			patch.Start2 = charCount2
+		}
+
+		switch aDiff.Type {
+		case DiffInsert:
+			patch.diffs = append(patch.diffs, aDiff)
+			patch.Length2 += len(aDiff.Text)
+			postpatchText = postpatchText[:charCount2] +
+				aDiff.Text + postpatchText[charCount2:]
+		case DiffDelete:
+			patch.Length1 += len(aDiff.Text)
+			patch.diffs = append(patch.diffs, aDiff)
+			postpatchText = postpatchText[:charCount2] + postpatchText[charCount2+len(aDiff.Text):]
+		case DiffEqual:
+			if len(aDiff.Text) <= 2*dmp.PatchMargin &&
+				len(patch.diffs) != 0 && i != len(diffs)-1 {
+				// Small equality inside a patch.
+				patch.diffs = append(patch.diffs, aDiff)
+				patch.Length1 += len(aDiff.Text)
+				patch.Length2 += len(aDiff.Text)
+			}
+			if len(aDiff.Text) >= 2*dmp.PatchMargin {
+				// Time for a new patch.
+				if len(patch.diffs) != 0 {
+					patch = dmp.PatchAddContext(patch, prepatchText)
+					patches = append(patches, patch)
+					patch = Patch{}
+					// Unlike Unidiff, our patch lists have a rolling context. http://code.google.com/p/google-diff-match-patch/wiki/Unidiff Update prepatch text & pos to reflect the application of the just completed patch.
+					prepatchText = postpatchText
+					charCount1 = charCount2
+				}
+			}
+		}
+
+		// Update the current character count.
+		if aDiff.Type != DiffInsert {
+			charCount1 += len(aDiff.Text)
+		}
+		if aDiff.Type != DiffDelete {
+			charCount2 += len(aDiff.Text)
+		}
+	}
+
+	// Pick up the leftover patch if not empty.
+	if len(patch.diffs) != 0 {
+		patch = dmp.PatchAddContext(patch, prepatchText)
+		patches = append(patches, patch)
+	}
+
+	return patches
+}
+
+// PatchDeepCopy returns an array that is identical to a given an array of patches.
+func (dmp *DiffMatchPatch) PatchDeepCopy(patches []Patch) []Patch {
+	patchesCopy := []Patch{}
+	for _, aPatch := range patches {
+		patchCopy := Patch{}
+		for _, aDiff := range aPatch.diffs {
+			patchCopy.diffs = append(patchCopy.diffs, Diff{
+				aDiff.Type,
+				aDiff.Text,
+			})
+		}
+		patchCopy.Start1 = aPatch.Start1
+		patchCopy.Start2 = aPatch.Start2
+		patchCopy.Length1 = aPatch.Length1
+		patchCopy.Length2 = aPatch.Length2
+		patchesCopy = append(patchesCopy, patchCopy)
+	}
+	return patchesCopy
+}
+
+// PatchApply merges a set of patches onto the text.  Returns a patched text, as well as an array of true/false values indicating which patches were applied.
+func (dmp *DiffMatchPatch) PatchApply(patches []Patch, text string) (string, []bool) {
+	if len(patches) == 0 {
+		return text, []bool{}
+	}
+
+	// Deep copy the patches so that no changes are made to originals.
+	patches = dmp.PatchDeepCopy(patches)
+
+	nullPadding := dmp.PatchAddPadding(patches)
+	text = nullPadding + text + nullPadding
+	patches = dmp.PatchSplitMax(patches)
+
+	x := 0
+	// delta keeps track of the offset between the expected and actual location of the previous patch.  If there are patches expected at positions 10 and 20, but the first patch was found at 12, delta is 2 and the second patch has an effective expected position of 22.
+	delta := 0
+	results := make([]bool, len(patches))
+	for _, aPatch := range patches {
+		expectedLoc := aPatch.Start2 + delta
+		text1 := dmp.DiffText1(aPatch.diffs)
+		var startLoc int
+		endLoc := -1
+		if len(text1) > dmp.MatchMaxBits {
+			// PatchSplitMax will only provide an oversized pattern in the case of a monster delete.
+			startLoc = dmp.MatchMain(text, text1[:dmp.MatchMaxBits], expectedLoc)
+			if startLoc != -1 {
+				endLoc = dmp.MatchMain(text,
+					text1[len(text1)-dmp.MatchMaxBits:], expectedLoc+len(text1)-dmp.MatchMaxBits)
+				if endLoc == -1 || startLoc >= endLoc {
+					// Can't find valid trailing context.  Drop this patch.
+					startLoc = -1
+				}
+			}
+		} else {
+			startLoc = dmp.MatchMain(text, text1, expectedLoc)
+		}
+		if startLoc == -1 {
+			// No match found.  :(
+			results[x] = false
+			// Subtract the delta for this failed patch from subsequent patches.
+			delta -= aPatch.Length2 - aPatch.Length1
+		} else {
+			// Found a match.  :)
+			results[x] = true
+			delta = startLoc - expectedLoc
+			var text2 string
+			if endLoc == -1 {
+				text2 = text[startLoc:int(math.Min(float64(startLoc+len(text1)), float64(len(text))))]
+			} else {
+				text2 = text[startLoc:int(math.Min(float64(endLoc+dmp.MatchMaxBits), float64(len(text))))]
+			}
+			if text1 == text2 {
+				// Perfect match, just shove the Replacement text in.
+				text = text[:startLoc] + dmp.DiffText2(aPatch.diffs) + text[startLoc+len(text1):]
+			} else {
+				// Imperfect match.  Run a diff to get a framework of equivalent indices.
+				diffs := dmp.DiffMain(text1, text2, false)
+				if len(text1) > dmp.MatchMaxBits && float64(dmp.DiffLevenshtein(diffs))/float64(len(text1)) > dmp.PatchDeleteThreshold {
+					// The end points match, but the content is unacceptably bad.
+					results[x] = false
+				} else {
+					diffs = dmp.DiffCleanupSemanticLossless(diffs)
+					index1 := 0
+					for _, aDiff := range aPatch.diffs {
+						if aDiff.Type != DiffEqual {
+							index2 := dmp.DiffXIndex(diffs, index1)
+							if aDiff.Type == DiffInsert {
+								// Insertion
+								text = text[:startLoc+index2] + aDiff.Text + text[startLoc+index2:]
+							} else if aDiff.Type == DiffDelete {
+								// Deletion
+								startIndex := startLoc + index2
+								text = text[:startIndex] +
+									text[startIndex+dmp.DiffXIndex(diffs, index1+len(aDiff.Text))-index2:]
+							}
+						}
+						if aDiff.Type != DiffDelete {
+							index1 += len(aDiff.Text)
+						}
+					}
+				}
+			}
+		}
+		x++
+	}
+	// Strip the padding off.
+	text = text[len(nullPadding) : len(nullPadding)+(len(text)-2*len(nullPadding))]
+	return text, results
+}
+
+// PatchAddPadding adds some padding on text start and end so that edges can match something.
+// Intended to be called only from within patchApply.
+func (dmp *DiffMatchPatch) PatchAddPadding(patches []Patch) string {
+	paddingLength := dmp.PatchMargin
+	nullPadding := ""
+	for x := 1; x <= paddingLength; x++ {
+		nullPadding += string(x)
+	}
+
+	// Bump all the patches forward.
+	for i := range patches {
+		patches[i].Start1 += paddingLength
+		patches[i].Start2 += paddingLength
+	}
+
+	// Add some padding on start of first diff.
+	if len(patches[0].diffs) == 0 || patches[0].diffs[0].Type != DiffEqual {
+		// Add nullPadding equality.
+		patches[0].diffs = append([]Diff{Diff{DiffEqual, nullPadding}}, patches[0].diffs...)
+		patches[0].Start1 -= paddingLength // Should be 0.
+		patches[0].Start2 -= paddingLength // Should be 0.
+		patches[0].Length1 += paddingLength
+		patches[0].Length2 += paddingLength
+	} else if paddingLength > len(patches[0].diffs[0].Text) {
+		// Grow first equality.
+		extraLength := paddingLength - len(patches[0].diffs[0].Text)
+		patches[0].diffs[0].Text = nullPadding[len(patches[0].diffs[0].Text):] + patches[0].diffs[0].Text
+		patches[0].Start1 -= extraLength
+		patches[0].Start2 -= extraLength
+		patches[0].Length1 += extraLength
+		patches[0].Length2 += extraLength
+	}
+
+	// Add some padding on end of last diff.
+	last := len(patches) - 1
+	if len(patches[last].diffs) == 0 || patches[last].diffs[len(patches[last].diffs)-1].Type != DiffEqual {
+		// Add nullPadding equality.
+		patches[last].diffs = append(patches[last].diffs, Diff{DiffEqual, nullPadding})
+		patches[last].Length1 += paddingLength
+		patches[last].Length2 += paddingLength
+	} else if paddingLength > len(patches[last].diffs[len(patches[last].diffs)-1].Text) {
+		// Grow last equality.
+		lastDiff := patches[last].diffs[len(patches[last].diffs)-1]
+		extraLength := paddingLength - len(lastDiff.Text)
+		patches[last].diffs[len(patches[last].diffs)-1].Text += nullPadding[:extraLength]
+		patches[last].Length1 += extraLength
+		patches[last].Length2 += extraLength
+	}
+
+	return nullPadding
+}
+
+// PatchSplitMax looks through the patches and breaks up any which are longer than the maximum limit of the match algorithm.
+// Intended to be called only from within patchApply.
+func (dmp *DiffMatchPatch) PatchSplitMax(patches []Patch) []Patch {
+	patchSize := dmp.MatchMaxBits
+	for x := 0; x < len(patches); x++ {
+		if patches[x].Length1 <= patchSize {
+			continue
+		}
+		bigpatch := patches[x]
+		// Remove the big old patch.
+		patches = append(patches[:x], patches[x+1:]...)
+		x--
+
+		Start1 := bigpatch.Start1
+		Start2 := bigpatch.Start2
+		precontext := ""
+		for len(bigpatch.diffs) != 0 {
+			// Create one of several smaller patches.
+			patch := Patch{}
+			empty := true
+			patch.Start1 = Start1 - len(precontext)
+			patch.Start2 = Start2 - len(precontext)
+			if len(precontext) != 0 {
+				patch.Length1 = len(precontext)
+				patch.Length2 = len(precontext)
+				patch.diffs = append(patch.diffs, Diff{DiffEqual, precontext})
+			}
+			for len(bigpatch.diffs) != 0 && patch.Length1 < patchSize-dmp.PatchMargin {
+				diffType := bigpatch.diffs[0].Type
+				diffText := bigpatch.diffs[0].Text
+				if diffType == DiffInsert {
+					// Insertions are harmless.
+					patch.Length2 += len(diffText)
+					Start2 += len(diffText)
+					patch.diffs = append(patch.diffs, bigpatch.diffs[0])
+					bigpatch.diffs = bigpatch.diffs[1:]
+					empty = false
+				} else if diffType == DiffDelete && len(patch.diffs) == 1 && patch.diffs[0].Type == DiffEqual && len(diffText) > 2*patchSize {
+					// This is a large deletion.  Let it pass in one chunk.
+					patch.Length1 += len(diffText)
+					Start1 += len(diffText)
+					empty = false
+					patch.diffs = append(patch.diffs, Diff{diffType, diffText})
+					bigpatch.diffs = bigpatch.diffs[1:]
+				} else {
+					// Deletion or equality.  Only take as much as we can stomach.
+					diffText = diffText[:min(len(diffText), patchSize-patch.Length1-dmp.PatchMargin)]
+
+					patch.Length1 += len(diffText)
+					Start1 += len(diffText)
+					if diffType == DiffEqual {
+						patch.Length2 += len(diffText)
+						Start2 += len(diffText)
+					} else {
+						empty = false
+					}
+					patch.diffs = append(patch.diffs, Diff{diffType, diffText})
+					if diffText == bigpatch.diffs[0].Text {
+						bigpatch.diffs = bigpatch.diffs[1:]
+					} else {
+						bigpatch.diffs[0].Text =
+							bigpatch.diffs[0].Text[len(diffText):]
+					}
+				}
+			}
+			// Compute the head context for the next patch.
+			precontext = dmp.DiffText2(patch.diffs)
+			precontext = precontext[max(0, len(precontext)-dmp.PatchMargin):]
+
+			postcontext := ""
+			// Append the end context for this patch.
+			if len(dmp.DiffText1(bigpatch.diffs)) > dmp.PatchMargin {
+				postcontext = dmp.DiffText1(bigpatch.diffs)[:dmp.PatchMargin]
+			} else {
+				postcontext = dmp.DiffText1(bigpatch.diffs)
+			}
+
+			if len(postcontext) != 0 {
+				patch.Length1 += len(postcontext)
+				patch.Length2 += len(postcontext)
+				if len(patch.diffs) != 0 && patch.diffs[len(patch.diffs)-1].Type == DiffEqual {
+					patch.diffs[len(patch.diffs)-1].Text += postcontext
+				} else {
+					patch.diffs = append(patch.diffs, Diff{DiffEqual, postcontext})
+				}
+			}
+			if !empty {
+				x++
+				patches = append(patches[:x], append([]Patch{patch}, patches[x:]...)...)
+			}
+		}
+	}
+	return patches
+}
+
+// PatchToText takes a list of patches and returns a textual representation.
+func (dmp *DiffMatchPatch) PatchToText(patches []Patch) string {
+	var text bytes.Buffer
+	for _, aPatch := range patches {
+		_, _ = text.WriteString(aPatch.String())
+	}
+	return text.String()
+}
+
+// PatchFromText parses a textual representation of patches and returns a List of Patch objects.
+func (dmp *DiffMatchPatch) PatchFromText(textline string) ([]Patch, error) {
+	patches := []Patch{}
+	if len(textline) == 0 {
+		return patches, nil
+	}
+	text := strings.Split(textline, "\n")
+	textPointer := 0
+	patchHeader := regexp.MustCompile("^@@ -(\\d+),?(\\d*) \\+(\\d+),?(\\d*) @@$")
+
+	var patch Patch
+	var sign uint8
+	var line string
+	for textPointer < len(text) {
+
+		if !patchHeader.MatchString(text[textPointer]) {
+			return patches, errors.New("Invalid patch string: " + text[textPointer])
+		}
+
+		patch = Patch{}
+		m := patchHeader.FindStringSubmatch(text[textPointer])
+
+		patch.Start1, _ = strconv.Atoi(m[1])
+		if len(m[2]) == 0 {
+			patch.Start1--
+			patch.Length1 = 1
+		} else if m[2] == "0" {
+			patch.Length1 = 0
+		} else {
+			patch.Start1--
+			patch.Length1, _ = strconv.Atoi(m[2])
+		}
+
+		patch.Start2, _ = strconv.Atoi(m[3])
+
+		if len(m[4]) == 0 {
+			patch.Start2--
+			patch.Length2 = 1
+		} else if m[4] == "0" {
+			patch.Length2 = 0
+		} else {
+			patch.Start2--
+			patch.Length2, _ = strconv.Atoi(m[4])
+		}
+		textPointer++
+
+		for textPointer < len(text) {
+			if len(text[textPointer]) > 0 {
+				sign = text[textPointer][0]
+			} else {
+				textPointer++
+				continue
+			}
+
+			line = text[textPointer][1:]
+			line = strings.Replace(line, "+", "%2b", -1)
+			line, _ = url.QueryUnescape(line)
+			if sign == '-' {
+				// Deletion.
+				patch.diffs = append(patch.diffs, Diff{DiffDelete, line})
+			} else if sign == '+' {
+				// Insertion.
+				patch.diffs = append(patch.diffs, Diff{DiffInsert, line})
+			} else if sign == ' ' {
+				// Minor equality.
+				patch.diffs = append(patch.diffs, Diff{DiffEqual, line})
+			} else if sign == '@' {
+				// Start of next patch.
+				break
+			} else {
+				// WTF?
+				return patches, errors.New("Invalid patch mode '" + string(sign) + "' in: " + string(line))
+			}
+			textPointer++
+		}
+
+		patches = append(patches, patch)
+	}
+	return patches, nil
+}
diff --git a/vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go b/vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go
new file mode 100644
index 0000000000..265f29cc7e
--- /dev/null
+++ b/vendor/github.com/sergi/go-diff/diffmatchpatch/stringutil.go
@@ -0,0 +1,88 @@
+// Copyright (c) 2012-2016 The go-diff authors. All rights reserved.
+// https://github.com/sergi/go-diff
+// See the included LICENSE file for license details.
+//
+// go-diff is a Go implementation of Google's Diff, Match, and Patch library
+// Original library is Copyright (c) 2006 Google Inc.
+// http://code.google.com/p/google-diff-match-patch/
+
+package diffmatchpatch
+
+import (
+	"strings"
+	"unicode/utf8"
+)
+
+// unescaper unescapes selected chars for compatibility with JavaScript's encodeURI.
+// In speed critical applications this could be dropped since the receiving application will certainly decode these fine. Note that this function is case-sensitive.  Thus "%3F" would not be unescaped.  But this is ok because it is only called with the output of HttpUtility.UrlEncode which returns lowercase hex. Example: "%3f" -> "?", "%24" -> "$", etc.
+var unescaper = strings.NewReplacer(
+	"%21", "!", "%7E", "~", "%27", "'",
+	"%28", "(", "%29", ")", "%3B", ";",
+	"%2F", "/", "%3F", "?", "%3A", ":",
+	"%40", "@", "%26", "&", "%3D", "=",
+	"%2B", "+", "%24", "$", "%2C", ",", "%23", "#", "%2A", "*")
+
+// indexOf returns the first index of pattern in str, starting at str[i].
+func indexOf(str string, pattern string, i int) int {
+	if i > len(str)-1 {
+		return -1
+	}
+	if i <= 0 {
+		return strings.Index(str, pattern)
+	}
+	ind := strings.Index(str[i:], pattern)
+	if ind == -1 {
+		return -1
+	}
+	return ind + i
+}
+
+// lastIndexOf returns the last index of pattern in str, starting at str[i].
+func lastIndexOf(str string, pattern string, i int) int {
+	if i < 0 {
+		return -1
+	}
+	if i >= len(str) {
+		return strings.LastIndex(str, pattern)
+	}
+	_, size := utf8.DecodeRuneInString(str[i:])
+	return strings.LastIndex(str[:i+size], pattern)
+}
+
+// runesIndexOf returns the index of pattern in target, starting at target[i].
+func runesIndexOf(target, pattern []rune, i int) int {
+	if i > len(target)-1 {
+		return -1
+	}
+	if i <= 0 {
+		return runesIndex(target, pattern)
+	}
+	ind := runesIndex(target[i:], pattern)
+	if ind == -1 {
+		return -1
+	}
+	return ind + i
+}
+
+func runesEqual(r1, r2 []rune) bool {
+	if len(r1) != len(r2) {
+		return false
+	}
+	for i, c := range r1 {
+		if c != r2[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// runesIndex is the equivalent of strings.Index for rune slices.
+func runesIndex(r1, r2 []rune) int {
+	last := len(r1) - len(r2)
+	for i := 0; i <= last; i++ {
+		if runesEqual(r1[i:i+len(r2)], r2) {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/vendor/github.com/shurcooL/sanitized_anchor_name/.travis.yml b/vendor/github.com/shurcooL/sanitized_anchor_name/.travis.yml
deleted file mode 100644
index 93b1fcdb31..0000000000
--- a/vendor/github.com/shurcooL/sanitized_anchor_name/.travis.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-sudo: false
-language: go
-go:
-  - 1.x
-  - master
-matrix:
-  allow_failures:
-    - go: master
-  fast_finish: true
-install:
-  - # Do nothing. This is needed to prevent default install action "go get -t -v ./..." from happening here (we want it to happen inside script step).
-script:
-  - go get -t -v ./...
-  - diff -u <(echo -n) <(gofmt -d -s .)
-  - go tool vet .
-  - go test -v -race ./...
diff --git a/vendor/github.com/shurcooL/sanitized_anchor_name/LICENSE b/vendor/github.com/shurcooL/sanitized_anchor_name/LICENSE
deleted file mode 100644
index c35c17af98..0000000000
--- a/vendor/github.com/shurcooL/sanitized_anchor_name/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2015 Dmitri Shuralyov
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/vendor/github.com/shurcooL/sanitized_anchor_name/README.md b/vendor/github.com/shurcooL/sanitized_anchor_name/README.md
deleted file mode 100644
index 670bf0fe6c..0000000000
--- a/vendor/github.com/shurcooL/sanitized_anchor_name/README.md
+++ /dev/null
@@ -1,36 +0,0 @@
-sanitized_anchor_name
-=====================
-
-[![Build Status](https://travis-ci.org/shurcooL/sanitized_anchor_name.svg?branch=master)](https://travis-ci.org/shurcooL/sanitized_anchor_name) [![GoDoc](https://godoc.org/github.com/shurcooL/sanitized_anchor_name?status.svg)](https://godoc.org/github.com/shurcooL/sanitized_anchor_name)
-
-Package sanitized_anchor_name provides a func to create sanitized anchor names.
-
-Its logic can be reused by multiple packages to create interoperable anchor names
-and links to those anchors.
-
-At this time, it does not try to ensure that generated anchor names
-are unique, that responsibility falls on the caller.
-
-Installation
-------------
-
-```bash
-go get -u github.com/shurcooL/sanitized_anchor_name
-```
-
-Example
--------
-
-```Go
-anchorName := sanitized_anchor_name.Create("This is a header")
-
-fmt.Println(anchorName)
-
-// Output:
-// this-is-a-header
-```
-
-License
--------
-
--	[MIT License](LICENSE)
diff --git a/vendor/github.com/shurcooL/sanitized_anchor_name/go.mod b/vendor/github.com/shurcooL/sanitized_anchor_name/go.mod
deleted file mode 100644
index 1e25534759..0000000000
--- a/vendor/github.com/shurcooL/sanitized_anchor_name/go.mod
+++ /dev/null
@@ -1 +0,0 @@
-module github.com/shurcooL/sanitized_anchor_name
diff --git a/vendor/github.com/shurcooL/sanitized_anchor_name/main.go b/vendor/github.com/shurcooL/sanitized_anchor_name/main.go
deleted file mode 100644
index 6a77d12431..0000000000
--- a/vendor/github.com/shurcooL/sanitized_anchor_name/main.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Package sanitized_anchor_name provides a func to create sanitized anchor names.
-//
-// Its logic can be reused by multiple packages to create interoperable anchor names
-// and links to those anchors.
-//
-// At this time, it does not try to ensure that generated anchor names
-// are unique, that responsibility falls on the caller.
-package sanitized_anchor_name // import "github.com/shurcooL/sanitized_anchor_name"
-
-import "unicode"
-
-// Create returns a sanitized anchor name for the given text.
-func Create(text string) string {
-	var anchorName []rune
-	var futureDash = false
-	for _, r := range text {
-		switch {
-		case unicode.IsLetter(r) || unicode.IsNumber(r):
-			if futureDash && len(anchorName) > 0 {
-				anchorName = append(anchorName, '-')
-			}
-			futureDash = false
-			anchorName = append(anchorName, unicode.ToLower(r))
-		default:
-			futureDash = true
-		}
-	}
-	return string(anchorName)
-}
diff --git a/vendor/github.com/sirupsen/logrus/README.md b/vendor/github.com/sirupsen/logrus/README.md
index 5152b6aa40..b042c896f2 100644
--- a/vendor/github.com/sirupsen/logrus/README.md
+++ b/vendor/github.com/sirupsen/logrus/README.md
@@ -1,4 +1,4 @@
-# Logrus <img src="http://i.imgur.com/hTeVwmJ.png" width="40" height="40" alt=":walrus:" class="emoji" title=":walrus:"/> [![Build Status](https://travis-ci.org/sirupsen/logrus.svg?branch=master)](https://travis-ci.org/sirupsen/logrus) [![GoDoc](https://godoc.org/github.com/sirupsen/logrus?status.svg)](https://godoc.org/github.com/sirupsen/logrus)
+# Logrus <img src="http://i.imgur.com/hTeVwmJ.png" width="40" height="40" alt=":walrus:" class="emoji" title=":walrus:"/> [![Build Status](https://github.com/sirupsen/logrus/workflows/CI/badge.svg)](https://github.com/sirupsen/logrus/actions?query=workflow%3ACI) [![Build Status](https://travis-ci.org/sirupsen/logrus.svg?branch=master)](https://travis-ci.org/sirupsen/logrus) [![Go Reference](https://pkg.go.dev/badge/github.com/sirupsen/logrus.svg)](https://pkg.go.dev/github.com/sirupsen/logrus)
 
 Logrus is a structured logger for Go (golang), completely API compatible with
 the standard library logger.
@@ -341,7 +341,7 @@ import (
   log "github.com/sirupsen/logrus"
 )
 
-init() {
+func init() {
   // do something here to set environment depending on an environment variable
   // or command-line flag
   if Environment == "production" {
diff --git a/vendor/github.com/sirupsen/logrus/buffer_pool.go b/vendor/github.com/sirupsen/logrus/buffer_pool.go
index 4545dec07d..c7787f77cb 100644
--- a/vendor/github.com/sirupsen/logrus/buffer_pool.go
+++ b/vendor/github.com/sirupsen/logrus/buffer_pool.go
@@ -26,15 +26,6 @@ func (p *defaultPool) Get() *bytes.Buffer {
 	return p.pool.Get().(*bytes.Buffer)
 }
 
-func getBuffer() *bytes.Buffer {
-	return bufferPool.Get()
-}
-
-func putBuffer(buf *bytes.Buffer) {
-	buf.Reset()
-	bufferPool.Put(buf)
-}
-
 // SetBufferPool allows to replace the default logrus buffer pool
 // to better meets the specific needs of an application.
 func SetBufferPool(bp BufferPool) {
diff --git a/vendor/github.com/sirupsen/logrus/entry.go b/vendor/github.com/sirupsen/logrus/entry.go
index 07a1e5fa72..71cdbbc35d 100644
--- a/vendor/github.com/sirupsen/logrus/entry.go
+++ b/vendor/github.com/sirupsen/logrus/entry.go
@@ -232,6 +232,7 @@ func (entry *Entry) log(level Level, msg string) {
 
 	newEntry.Logger.mu.Lock()
 	reportCaller := newEntry.Logger.ReportCaller
+	bufPool := newEntry.getBufferPool()
 	newEntry.Logger.mu.Unlock()
 
 	if reportCaller {
@@ -239,11 +240,11 @@ func (entry *Entry) log(level Level, msg string) {
 	}
 
 	newEntry.fireHooks()
-
-	buffer = getBuffer()
+	buffer = bufPool.Get()
 	defer func() {
 		newEntry.Buffer = nil
-		putBuffer(buffer)
+		buffer.Reset()
+		bufPool.Put(buffer)
 	}()
 	buffer.Reset()
 	newEntry.Buffer = buffer
@@ -260,6 +261,13 @@ func (entry *Entry) log(level Level, msg string) {
 	}
 }
 
+func (entry *Entry) getBufferPool() (pool BufferPool) {
+	if entry.Logger.BufferPool != nil {
+		return entry.Logger.BufferPool
+	}
+	return bufferPool
+}
+
 func (entry *Entry) fireHooks() {
 	var tmpHooks LevelHooks
 	entry.Logger.mu.Lock()
@@ -276,18 +284,21 @@ func (entry *Entry) fireHooks() {
 }
 
 func (entry *Entry) write() {
+	entry.Logger.mu.Lock()
+	defer entry.Logger.mu.Unlock()
 	serialized, err := entry.Logger.Formatter.Format(entry)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Failed to obtain reader, %v\n", err)
 		return
 	}
-	entry.Logger.mu.Lock()
-	defer entry.Logger.mu.Unlock()
 	if _, err := entry.Logger.Out.Write(serialized); err != nil {
 		fmt.Fprintf(os.Stderr, "Failed to write to log, %v\n", err)
 	}
 }
 
+// Log will log a message at the level given as parameter.
+// Warning: using Log at Panic or Fatal level will not respectively Panic nor Exit.
+// For this behaviour Entry.Panic or Entry.Fatal should be used instead.
 func (entry *Entry) Log(level Level, args ...interface{}) {
 	if entry.Logger.IsLevelEnabled(level) {
 		entry.log(level, fmt.Sprint(args...))
diff --git a/vendor/github.com/sirupsen/logrus/go.mod b/vendor/github.com/sirupsen/logrus/go.mod
deleted file mode 100644
index b3919d5eab..0000000000
--- a/vendor/github.com/sirupsen/logrus/go.mod
+++ /dev/null
@@ -1,10 +0,0 @@
-module github.com/sirupsen/logrus
-
-require (
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/stretchr/testify v1.2.2
-	golang.org/x/sys v0.0.0-20191026070338-33540a1f6037
-)
-
-go 1.13
diff --git a/vendor/github.com/sirupsen/logrus/go.sum b/vendor/github.com/sirupsen/logrus/go.sum
deleted file mode 100644
index 694c18b845..0000000000
--- a/vendor/github.com/sirupsen/logrus/go.sum
+++ /dev/null
@@ -1,8 +0,0 @@
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/vendor/github.com/sirupsen/logrus/logger.go b/vendor/github.com/sirupsen/logrus/logger.go
index 337704457a..5ff0aef6d3 100644
--- a/vendor/github.com/sirupsen/logrus/logger.go
+++ b/vendor/github.com/sirupsen/logrus/logger.go
@@ -44,6 +44,9 @@ type Logger struct {
 	entryPool sync.Pool
 	// Function to exit the application, defaults to `os.Exit()`
 	ExitFunc exitFunc
+	// The buffer pool used to format the log. If it is nil, the default global
+	// buffer pool will be used.
+	BufferPool BufferPool
 }
 
 type exitFunc func(int)
@@ -192,6 +195,9 @@ func (logger *Logger) Panicf(format string, args ...interface{}) {
 	logger.Logf(PanicLevel, format, args...)
 }
 
+// Log will log a message at the level given as parameter.
+// Warning: using Log at Panic or Fatal level will not respectively Panic nor Exit.
+// For this behaviour Logger.Panic or Logger.Fatal should be used instead.
 func (logger *Logger) Log(level Level, args ...interface{}) {
 	if logger.IsLevelEnabled(level) {
 		entry := logger.newEntry()
@@ -402,3 +408,10 @@ func (logger *Logger) ReplaceHooks(hooks LevelHooks) LevelHooks {
 	logger.mu.Unlock()
 	return oldHooks
 }
+
+// SetBufferPool sets the logger buffer pool.
+func (logger *Logger) SetBufferPool(pool BufferPool) {
+	logger.mu.Lock()
+	defer logger.mu.Unlock()
+	logger.BufferPool = pool
+}
diff --git a/vendor/github.com/spf13/cobra/.golangci.yml b/vendor/github.com/spf13/cobra/.golangci.yml
index 0d6e61793a..2578d94b5e 100644
--- a/vendor/github.com/spf13/cobra/.golangci.yml
+++ b/vendor/github.com/spf13/cobra/.golangci.yml
@@ -1,3 +1,17 @@
+# Copyright 2013-2023 The Cobra Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 run:
   deadline: 5m
 
diff --git a/vendor/github.com/spf13/cobra/CHANGELOG.md b/vendor/github.com/spf13/cobra/CHANGELOG.md
deleted file mode 100644
index 8a23b4f851..0000000000
--- a/vendor/github.com/spf13/cobra/CHANGELOG.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Cobra Changelog
-
-## v1.1.3
-
-* **Fix:** release-branch.cobra1.1 only: Revert "Deprecate Go < 1.14" to maintain backward compatibility
-
-## v1.1.2
-
-### Notable Changes
-
-* Bump license year to 2021 in golden files (#1309) @Bowbaq
-* Enhance PowerShell completion with custom comp (#1208) @Luap99
-* Update gopkg.in/yaml.v2 to v2.4.0: The previous breaking change in yaml.v2 v2.3.0 has been reverted, see go-yaml/yaml#670
-* Documentation readability improvements (#1228 etc.) @zaataylor etc.
-* Use golangci-lint: Repair warnings and errors resulting from linting (#1044) @umarcor
-
-## v1.1.1
-
-* **Fix:** yaml.v2 2.3.0 contained a unintended breaking change. This release reverts to yaml.v2 v2.2.8 which has recent critical CVE fixes, but does not have the breaking changes. See https://github.com/spf13/cobra/pull/1259 for context.
-* **Fix:** correct internal formatting for go-md2man v2 (which caused man page generation to be broken). See https://github.com/spf13/cobra/issues/1049 for context.
-
-## v1.1.0
-
-### Notable Changes
-
-* Extend Go completions and revamp zsh comp (#1070)
-* Fix man page doc generation - no auto generated tag when `cmd.DisableAutoGenTag = true` (#1104) @jpmcb
-* Add completion for help command (#1136)
-* Complete subcommands when TraverseChildren is set (#1171)
-* Fix stderr printing functions (#894)
-* fix: fish output redirection (#1247)
-
-## v1.0.0
-
-Announcing v1.0.0 of Cobra. 🎉
-
-### Notable Changes
-* Fish completion (including support for Go custom completion) @marckhouzam
-* API (urgent): Rename BashCompDirectives to ShellCompDirectives @marckhouzam
-* Remove/replace SetOutput on Command - deprecated @jpmcb
-* add support for autolabel stale PR @xchapter7x
-* Add Labeler Actions @xchapter7x
-* Custom completions coded in Go (instead of Bash) @marckhouzam
-* Partial Revert of #922 @jharshman
-* Add Makefile to project @jharshman
-* Correct documentation for InOrStdin @desponda
-* Apply formatting to templates @jharshman
-* Revert change so help is printed on stdout again @marckhouzam
-* Update md2man to v2.0.0 @pdf
-* update viper to v1.4.0 @umarcor
-* Update cmd/root.go example in README.md @jharshman
diff --git a/vendor/github.com/spf13/cobra/MAINTAINERS b/vendor/github.com/spf13/cobra/MAINTAINERS
new file mode 100644
index 0000000000..4c5ac3dd99
--- /dev/null
+++ b/vendor/github.com/spf13/cobra/MAINTAINERS
@@ -0,0 +1,13 @@
+maintainers:
+- spf13
+- johnSchnake
+- jpmcb
+- marckhouzam
+inactive:
+- anthonyfok
+- bep
+- bogem
+- broady
+- eparis
+- jharshman
+- wfernandes
diff --git a/vendor/github.com/spf13/cobra/Makefile b/vendor/github.com/spf13/cobra/Makefile
index 472c73bf16..0da8d7aa08 100644
--- a/vendor/github.com/spf13/cobra/Makefile
+++ b/vendor/github.com/spf13/cobra/Makefile
@@ -5,15 +5,11 @@ ifeq (, $(shell which golangci-lint))
 $(warning "could not find golangci-lint in $(PATH), run: curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh")
 endif
 
-ifeq (, $(shell which richgo))
-$(warning "could not find richgo in $(PATH), run: go get github.com/kyoh86/richgo")
-endif
-
-.PHONY: fmt lint test cobra_generator install_deps clean
+.PHONY: fmt lint test install_deps clean
 
 default: all
 
-all: fmt test cobra_generator
+all: fmt test
 
 fmt:
 	$(info ******************** checking formatting ********************)
@@ -23,14 +19,13 @@ lint:
 	$(info ******************** running lint tools ********************)
 	golangci-lint run -v
 
-test: install_deps lint
+test: install_deps
 	$(info ******************** running tests ********************)
-	richgo test -v ./...
+	go test -v ./...
 
-cobra_generator: install_deps
-	$(info ******************** building generator ********************)
-	mkdir -p $(BIN)
-	make -C cobra all
+richtest: install_deps
+	$(info ******************** running tests with kyoh86/richgo ********************)
+	richgo test -v ./...
 
 install_deps:
 	$(info ******************** downloading dependencies ********************)
diff --git a/vendor/github.com/spf13/cobra/README.md b/vendor/github.com/spf13/cobra/README.md
index 074e3979f8..592c0b8ab0 100644
--- a/vendor/github.com/spf13/cobra/README.md
+++ b/vendor/github.com/spf13/cobra/README.md
@@ -1,60 +1,35 @@
-![cobra logo](https://cloud.githubusercontent.com/assets/173412/10886352/ad566232-814f-11e5-9cd0-aa101788c117.png)
+![cobra logo](assets/CobraMain.png)
 
-Cobra is both a library for creating powerful modern CLI applications as well as a program to generate applications and command files.
+Cobra is a library for creating powerful modern CLI applications.
 
-Cobra is used in many Go projects such as [Kubernetes](http://kubernetes.io/),
-[Hugo](https://gohugo.io), and [Github CLI](https://github.com/cli/cli) to
+Cobra is used in many Go projects such as [Kubernetes](https://kubernetes.io/),
+[Hugo](https://gohugo.io), and [GitHub CLI](https://github.com/cli/cli) to
 name a few. [This list](./projects_using_cobra.md) contains a more extensive list of projects using Cobra.
 
-[![](https://img.shields.io/github/workflow/status/spf13/cobra/Test?longCache=tru&label=Test&logo=github%20actions&logoColor=fff)](https://github.com/spf13/cobra/actions?query=workflow%3ATest)
-[![GoDoc](https://godoc.org/github.com/spf13/cobra?status.svg)](https://godoc.org/github.com/spf13/cobra)
+[![](https://img.shields.io/github/actions/workflow/status/spf13/cobra/test.yml?branch=main&longCache=true&label=Test&logo=github%20actions&logoColor=fff)](https://github.com/spf13/cobra/actions?query=workflow%3ATest)
+[![Go Reference](https://pkg.go.dev/badge/github.com/spf13/cobra.svg)](https://pkg.go.dev/github.com/spf13/cobra)
 [![Go Report Card](https://goreportcard.com/badge/github.com/spf13/cobra)](https://goreportcard.com/report/github.com/spf13/cobra)
 [![Slack](https://img.shields.io/badge/Slack-cobra-brightgreen)](https://gophers.slack.com/archives/CD3LP1199)
 
-# Table of Contents
-
-- [Overview](#overview)
-- [Concepts](#concepts)
-  * [Commands](#commands)
-  * [Flags](#flags)
-- [Installing](#installing)
-- [Usage](#usage)
-  * [Using the Cobra Generator](user_guide.md#using-the-cobra-generator)
-  * [Using the Cobra Library](user_guide.md#using-the-cobra-library)
-  * [Working with Flags](user_guide.md#working-with-flags)
-  * [Positional and Custom Arguments](user_guide.md#positional-and-custom-arguments)
-  * [Example](user_guide.md#example)
-  * [Help Command](user_guide.md#help-command)
-  * [Usage Message](user_guide.md#usage-message)
-  * [PreRun and PostRun Hooks](user_guide.md#prerun-and-postrun-hooks)
-  * [Suggestions when "unknown command" happens](user_guide.md#suggestions-when-unknown-command-happens)
-  * [Generating documentation for your command](user_guide.md#generating-documentation-for-your-command)
-  * [Generating shell completions](user_guide.md#generating-shell-completions)
-- [Contributing](CONTRIBUTING.md)
-- [License](#license)
-
 # Overview
 
 Cobra is a library providing a simple interface to create powerful modern CLI
 interfaces similar to git & go tools.
 
-Cobra is also an application that will generate your application scaffolding to rapidly
-develop a Cobra-based application.
-
 Cobra provides:
 * Easy subcommand-based CLIs: `app server`, `app fetch`, etc.
 * Fully POSIX-compliant flags (including short & long versions)
 * Nested subcommands
 * Global, local and cascading flags
-* Easy generation of applications & commands with `cobra init appname` & `cobra add cmdname`
 * Intelligent suggestions (`app srver`... did you mean `app server`?)
 * Automatic help generation for commands and flags
+* Grouping help for subcommands
 * Automatic help flag recognition of `-h`, `--help`, etc.
 * Automatically generated shell autocomplete for your application (bash, zsh, fish, powershell)
 * Automatically generated man pages for your application
 * Command aliases so you can change things without breaking them
 * The flexibility to define your own help, usage, etc.
-* Optional tight integration with [viper](http://github.com/spf13/viper) for 12-factor apps
+* Optional seamless integration with [viper](https://github.com/spf13/viper) for 12-factor apps
 
 # Concepts
 
@@ -66,9 +41,9 @@ The best applications read like sentences when used, and as a result, users
 intuitively know how to interact with them.
 
 The pattern to follow is
-`APPNAME VERB NOUN --ADJECTIVE.`
+`APPNAME VERB NOUN --ADJECTIVE`
     or
-`APPNAME COMMAND ARG --FLAG`
+`APPNAME COMMAND ARG --FLAG`.
 
 A few good real world examples may better illustrate this point.
 
@@ -88,7 +63,7 @@ have children commands and optionally run an action.
 
 In the example above, 'server' is the command.
 
-[More about cobra.Command](https://godoc.org/github.com/spf13/cobra#Command)
+[More about cobra.Command](https://pkg.go.dev/github.com/spf13/cobra#Command)
 
 ## Flags
 
@@ -105,10 +80,11 @@ which maintains the same interface while adding POSIX compliance.
 
 # Installing
 Using Cobra is easy. First, use `go get` to install the latest version
-of the library. This command will install the `cobra` generator executable
-along with the library and its dependencies:
+of the library.     
 
-    go get -u github.com/spf13/cobra
+```
+go get -u github.com/spf13/cobra@latest
+```
 
 Next, include Cobra in your application:
 
@@ -117,8 +93,19 @@ import "github.com/spf13/cobra"
 ```
 
 # Usage
+`cobra-cli` is a command line program to generate cobra applications and command files.
+It will bootstrap your application scaffolding to rapidly
+develop a Cobra-based application. It is the easiest way to incorporate Cobra into your application.
+
+It can be installed by running:
+
+```
+go install github.com/spf13/cobra-cli@latest
+```
+
+For complete details on using the Cobra-CLI generator, please read [The Cobra Generator README](https://github.com/spf13/cobra-cli/blob/main/README.md)
 
-See [User Guide](user_guide.md).
+For complete details on using the Cobra library, please read the [The Cobra User Guide](user_guide.md).
 
 # License
 
diff --git a/vendor/github.com/spf13/cobra/active_help.go b/vendor/github.com/spf13/cobra/active_help.go
new file mode 100644
index 0000000000..2d0239437a
--- /dev/null
+++ b/vendor/github.com/spf13/cobra/active_help.go
@@ -0,0 +1,63 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cobra
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+const (
+	activeHelpMarker = "_activeHelp_ "
+	// The below values should not be changed: programs will be using them explicitly
+	// in their user documentation, and users will be using them explicitly.
+	activeHelpEnvVarSuffix  = "_ACTIVE_HELP"
+	activeHelpGlobalEnvVar  = "COBRA_ACTIVE_HELP"
+	activeHelpGlobalDisable = "0"
+)
+
+// AppendActiveHelp adds the specified string to the specified array to be used as ActiveHelp.
+// Such strings will be processed by the completion script and will be shown as ActiveHelp
+// to the user.
+// The array parameter should be the array that will contain the completions.
+// This function can be called multiple times before and/or after completions are added to
+// the array.  Each time this function is called with the same array, the new
+// ActiveHelp line will be shown below the previous ones when completion is triggered.
+func AppendActiveHelp(compArray []string, activeHelpStr string) []string {
+	return append(compArray, fmt.Sprintf("%s%s", activeHelpMarker, activeHelpStr))
+}
+
+// GetActiveHelpConfig returns the value of the ActiveHelp environment variable
+// <PROGRAM>_ACTIVE_HELP where <PROGRAM> is the name of the root command in upper
+// case, with all - replaced by _.
+// It will always return "0" if the global environment variable COBRA_ACTIVE_HELP
+// is set to "0".
+func GetActiveHelpConfig(cmd *Command) string {
+	activeHelpCfg := os.Getenv(activeHelpGlobalEnvVar)
+	if activeHelpCfg != activeHelpGlobalDisable {
+		activeHelpCfg = os.Getenv(activeHelpEnvVar(cmd.Root().Name()))
+	}
+	return activeHelpCfg
+}
+
+// activeHelpEnvVar returns the name of the program-specific ActiveHelp environment
+// variable.  It has the format <PROGRAM>_ACTIVE_HELP where <PROGRAM> is the name of the
+// root command in upper case, with all - replaced by _.
+func activeHelpEnvVar(name string) string {
+	// This format should not be changed: users will be using it explicitly.
+	activeHelpEnvVar := strings.ToUpper(fmt.Sprintf("%s%s", name, activeHelpEnvVarSuffix))
+	return strings.ReplaceAll(activeHelpEnvVar, "-", "_")
+}
diff --git a/vendor/github.com/spf13/cobra/active_help.md b/vendor/github.com/spf13/cobra/active_help.md
new file mode 100644
index 0000000000..5e7f59af38
--- /dev/null
+++ b/vendor/github.com/spf13/cobra/active_help.md
@@ -0,0 +1,157 @@
+# Active Help
+
+Active Help is a framework provided by Cobra which allows a program to define messages (hints, warnings, etc) that will be printed during program usage.  It aims to make it easier for your users to learn how to use your program.  If configured by the program, Active Help is printed when the user triggers shell completion.
+
+For example, 
+```
+bash-5.1$ helm repo add [tab]
+You must choose a name for the repo you are adding.
+
+bash-5.1$ bin/helm package [tab]
+Please specify the path to the chart to package
+
+bash-5.1$ bin/helm package [tab][tab]
+bin/    internal/    scripts/    pkg/     testdata/
+```
+
+**Hint**: A good place to use Active Help messages is when the normal completion system does not provide any suggestions. In such cases, Active Help nicely supplements the normal shell completions to guide the user in knowing what is expected by the program.
+## Supported shells
+
+Active Help is currently only supported for the following shells:
+- Bash (using [bash completion V2](shell_completions.md#bash-completion-v2) only). Note that bash 4.4 or higher is required for the prompt to appear when an Active Help message is printed.
+- Zsh
+
+## Adding Active Help messages
+
+As Active Help uses the shell completion system, the implementation of Active Help messages is done by enhancing custom dynamic completions.  If you are not familiar with dynamic completions, please refer to [Shell Completions](shell_completions.md).
+
+Adding Active Help is done through the use of the `cobra.AppendActiveHelp(...)` function, where the program repeatedly adds Active Help messages to the list of completions.  Keep reading for details.
+
+### Active Help for nouns
+
+Adding Active Help when completing a noun is done within the `ValidArgsFunction(...)` of a command.  Please notice the use of `cobra.AppendActiveHelp(...)` in the following example:
+
+```go
+cmd := &cobra.Command{
+	Use:   "add [NAME] [URL]",
+	Short: "add a chart repository",
+	Args:  require.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return addRepo(args)
+	},
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		var comps []string
+		if len(args) == 0 {
+			comps = cobra.AppendActiveHelp(comps, "You must choose a name for the repo you are adding")
+		} else if len(args) == 1 {
+			comps = cobra.AppendActiveHelp(comps, "You must specify the URL for the repo you are adding")
+		} else {
+			comps = cobra.AppendActiveHelp(comps, "This command does not take any more arguments")
+		}
+		return comps, cobra.ShellCompDirectiveNoFileComp
+	},
+}
+```
+The example above defines the completions (none, in this specific example) as well as the Active Help messages for the `helm repo add` command.  It yields the following behavior:
+```
+bash-5.1$ helm repo add [tab]
+You must choose a name for the repo you are adding
+
+bash-5.1$ helm repo add grafana [tab]
+You must specify the URL for the repo you are adding
+
+bash-5.1$ helm repo add grafana https://grafana.github.io/helm-charts [tab]
+This command does not take any more arguments
+```
+**Hint**: As can be seen in the above example, a good place to use Active Help messages is when the normal completion system does not provide any suggestions. In such cases, Active Help nicely supplements the normal shell completions.
+
+### Active Help for flags
+
+Providing Active Help for flags is done in the same fashion as for nouns, but using the completion function registered for the flag.  For example:
+```go
+_ = cmd.RegisterFlagCompletionFunc("version", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		if len(args) != 2 {
+			return cobra.AppendActiveHelp(nil, "You must first specify the chart to install before the --version flag can be completed"), cobra.ShellCompDirectiveNoFileComp
+		}
+		return compVersionFlag(args[1], toComplete)
+	})
+```
+The example above prints an Active Help message when not enough information was given by the user to complete the `--version` flag.
+```
+bash-5.1$ bin/helm install myrelease --version 2.0.[tab]
+You must first specify the chart to install before the --version flag can be completed
+
+bash-5.1$ bin/helm install myrelease bitnami/solr --version 2.0.[tab][tab]
+2.0.1  2.0.2  2.0.3
+```
+
+## User control of Active Help
+
+You may want to allow your users to disable Active Help or choose between different levels of Active Help.  It is entirely up to the program to define the type of configurability of Active Help that it wants to offer, if any.
+Allowing to configure Active Help is entirely optional; you can use Active Help in your program without doing anything about Active Help configuration.
+
+The way to configure Active Help is to use the program's Active Help environment
+variable.  That variable is named `<PROGRAM>_ACTIVE_HELP` where `<PROGRAM>` is the name of your 
+program in uppercase with any `-` replaced by an `_`.  The variable should be set by the user to whatever
+Active Help configuration values are supported by the program.
+
+For example, say `helm` has chosen to support three levels for Active Help: `on`, `off`, `local`.  Then a user
+would set the desired behavior to `local` by doing `export HELM_ACTIVE_HELP=local` in their shell.
+
+For simplicity, when in `cmd.ValidArgsFunction(...)` or a flag's completion function, the program should read the
+Active Help configuration using the `cobra.GetActiveHelpConfig(cmd)` function and select what Active Help messages
+should or should not be added (instead of reading the environment variable directly).
+
+For example:
+```go
+ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	activeHelpLevel := cobra.GetActiveHelpConfig(cmd)
+
+	var comps []string
+	if len(args) == 0 {
+		if activeHelpLevel != "off"  {
+			comps = cobra.AppendActiveHelp(comps, "You must choose a name for the repo you are adding")
+		}
+	} else if len(args) == 1 {
+		if activeHelpLevel != "off" {
+			comps = cobra.AppendActiveHelp(comps, "You must specify the URL for the repo you are adding")
+		}
+	} else {
+		if activeHelpLevel == "local" {
+			comps = cobra.AppendActiveHelp(comps, "This command does not take any more arguments")
+		}
+	}
+	return comps, cobra.ShellCompDirectiveNoFileComp
+},
+```
+**Note 1**: If the `<PROGRAM>_ACTIVE_HELP` environment variable is set to the string "0", Cobra will automatically disable all Active Help output (even if some output was specified by the program using the `cobra.AppendActiveHelp(...)` function).  Using "0" can simplify your code in situations where you want to blindly disable Active Help without having to call `cobra.GetActiveHelpConfig(cmd)` explicitly.
+
+**Note 2**: If a user wants to disable Active Help for every single program based on Cobra, she can set the environment variable `COBRA_ACTIVE_HELP` to "0".  In this case `cobra.GetActiveHelpConfig(cmd)` will return "0" no matter what the variable `<PROGRAM>_ACTIVE_HELP` is set to.
+
+**Note 3**: If the user does not set `<PROGRAM>_ACTIVE_HELP` or `COBRA_ACTIVE_HELP` (which will be a common case), the default value for the Active Help configuration returned by `cobra.GetActiveHelpConfig(cmd)` will be the empty string. 
+## Active Help with Cobra's default completion command
+
+Cobra provides a default `completion` command for programs that wish to use it.
+When using the default `completion` command, Active Help is configurable in the same
+fashion as described above using environment variables.  You may wish to document this in more
+details for your users.
+
+## Debugging Active Help
+
+Debugging your Active Help code is done in the same way as debugging your dynamic completion code, which is with Cobra's hidden `__complete` command.  Please refer to [debugging shell completion](shell_completions.md#debugging) for details.
+
+When debugging with the `__complete` command, if you want to specify different Active Help configurations, you should use the active help environment variable.  That variable is named `<PROGRAM>_ACTIVE_HELP` where any `-` is replaced by an `_`.  For example, we can test deactivating some Active Help as shown below:
+```
+$ HELM_ACTIVE_HELP=1 bin/helm __complete install wordpress bitnami/h<ENTER>
+bitnami/haproxy
+bitnami/harbor
+_activeHelp_ WARNING: cannot re-use a name that is still in use
+:0
+Completion ended with directive: ShellCompDirectiveDefault
+
+$ HELM_ACTIVE_HELP=0 bin/helm __complete install wordpress bitnami/h<ENTER>
+bitnami/haproxy
+bitnami/harbor
+:0
+Completion ended with directive: ShellCompDirectiveDefault
+```
diff --git a/vendor/github.com/spf13/cobra/args.go b/vendor/github.com/spf13/cobra/args.go
index 70e9b26291..e79ec33a81 100644
--- a/vendor/github.com/spf13/cobra/args.go
+++ b/vendor/github.com/spf13/cobra/args.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
@@ -7,7 +21,7 @@ import (
 
 type PositionalArgs func(cmd *Command, args []string) error
 
-// Legacy arg validation has the following behaviour:
+// legacyArgs validation has the following behaviour:
 // - root commands with no subcommands can take arbitrary arguments
 // - root commands with subcommands will do subcommand validity checking
 // - subcommands will always accept arbitrary arguments
@@ -32,7 +46,8 @@ func NoArgs(cmd *Command, args []string) error {
 	return nil
 }
 
-// OnlyValidArgs returns an error if any args are not in the list of ValidArgs.
+// OnlyValidArgs returns an error if there are any positional args that are not in
+// the `ValidArgs` field of `Command`
 func OnlyValidArgs(cmd *Command, args []string) error {
 	if len(cmd.ValidArgs) > 0 {
 		// Remove any description that may be included in ValidArgs.
@@ -41,7 +56,6 @@ func OnlyValidArgs(cmd *Command, args []string) error {
 		for _, v := range cmd.ValidArgs {
 			validArgs = append(validArgs, strings.Split(v, "\t")[0])
 		}
-
 		for _, v := range args {
 			if !stringInSlice(v, validArgs) {
 				return fmt.Errorf("invalid argument %q for %q%s", v, cmd.CommandPath(), cmd.findSuggestions(args[0]))
@@ -86,24 +100,32 @@ func ExactArgs(n int) PositionalArgs {
 	}
 }
 
-// ExactValidArgs returns an error if
-// there are not exactly N positional args OR
-// there are any positional args that are not in the `ValidArgs` field of `Command`
-func ExactValidArgs(n int) PositionalArgs {
+// RangeArgs returns an error if the number of args is not within the expected range.
+func RangeArgs(min int, max int) PositionalArgs {
 	return func(cmd *Command, args []string) error {
-		if err := ExactArgs(n)(cmd, args); err != nil {
-			return err
+		if len(args) < min || len(args) > max {
+			return fmt.Errorf("accepts between %d and %d arg(s), received %d", min, max, len(args))
 		}
-		return OnlyValidArgs(cmd, args)
+		return nil
 	}
 }
 
-// RangeArgs returns an error if the number of args is not within the expected range.
-func RangeArgs(min int, max int) PositionalArgs {
+// MatchAll allows combining several PositionalArgs to work in concert.
+func MatchAll(pargs ...PositionalArgs) PositionalArgs {
 	return func(cmd *Command, args []string) error {
-		if len(args) < min || len(args) > max {
-			return fmt.Errorf("accepts between %d and %d arg(s), received %d", min, max, len(args))
+		for _, parg := range pargs {
+			if err := parg(cmd, args); err != nil {
+				return err
+			}
 		}
 		return nil
 	}
 }
+
+// ExactValidArgs returns an error if there are not exactly N positional args OR
+// there are any positional args that are not in the `ValidArgs` field of `Command`
+//
+// Deprecated: use MatchAll(ExactArgs(n), OnlyValidArgs) instead
+func ExactValidArgs(n int) PositionalArgs {
+	return MatchAll(ExactArgs(n), OnlyValidArgs)
+}
diff --git a/vendor/github.com/spf13/cobra/bash_completions.go b/vendor/github.com/spf13/cobra/bash_completions.go
index 733f4d1211..10c78847de 100644
--- a/vendor/github.com/spf13/cobra/bash_completions.go
+++ b/vendor/github.com/spf13/cobra/bash_completions.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
@@ -24,7 +38,7 @@ func writePreamble(buf io.StringWriter, name string) {
 	WriteStringAndCheck(buf, fmt.Sprintf(`
 __%[1]s_debug()
 {
-    if [[ -n ${BASH_COMP_DEBUG_FILE} ]]; then
+    if [[ -n ${BASH_COMP_DEBUG_FILE:-} ]]; then
         echo "$*" >> "${BASH_COMP_DEBUG_FILE}"
     fi
 }
@@ -73,7 +87,8 @@ __%[1]s_handle_go_custom_completion()
     # Prepare the command to request completions for the program.
     # Calling ${words[0]} instead of directly %[1]s allows to handle aliases
     args=("${words[@]:1}")
-    requestComp="${words[0]} %[2]s ${args[*]}"
+    # Disable ActiveHelp which is not supported for bash completion v1
+    requestComp="%[8]s=0 ${words[0]} %[2]s ${args[*]}"
 
     lastParam=${words[$((${#words[@]}-1))]}
     lastChar=${lastParam:$((${#lastParam}-1)):1}
@@ -99,7 +114,7 @@ __%[1]s_handle_go_custom_completion()
         directive=0
     fi
     __%[1]s_debug "${FUNCNAME[0]}: the completion directive is: ${directive}"
-    __%[1]s_debug "${FUNCNAME[0]}: the completions are: ${out[*]}"
+    __%[1]s_debug "${FUNCNAME[0]}: the completions are: ${out}"
 
     if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then
         # Error code.  No completion.
@@ -125,7 +140,7 @@ __%[1]s_handle_go_custom_completion()
         local fullFilter filter filteringCmd
         # Do not use quotes around the $out variable or else newline
         # characters will be kept.
-        for filter in ${out[*]}; do
+        for filter in ${out}; do
             fullFilter+="$filter|"
         done
 
@@ -134,9 +149,9 @@ __%[1]s_handle_go_custom_completion()
         $filteringCmd
     elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then
         # File completion for directories only
-        local subDir
+        local subdir
         # Use printf to strip any trailing newline
-        subdir=$(printf "%%s" "${out[0]}")
+        subdir=$(printf "%%s" "${out}")
         if [ -n "$subdir" ]; then
             __%[1]s_debug "Listing directories in $subdir"
             __%[1]s_handle_subdirs_in_dir_flag "$subdir"
@@ -147,7 +162,7 @@ __%[1]s_handle_go_custom_completion()
     else
         while IFS='' read -r comp; do
             COMPREPLY+=("$comp")
-        done < <(compgen -W "${out[*]}" -- "$cur")
+        done < <(compgen -W "${out}" -- "$cur")
     fi
 }
 
@@ -187,13 +202,19 @@ __%[1]s_handle_reply()
                     PREFIX=""
                     cur="${cur#*=}"
                     ${flags_completion[${index}]}
-                    if [ -n "${ZSH_VERSION}" ]; then
+                    if [ -n "${ZSH_VERSION:-}" ]; then
                         # zsh completion needs --flag= prefix
                         eval "COMPREPLY=( \"\${COMPREPLY[@]/#/${flag}=}\" )"
                     fi
                 fi
             fi
-            return 0;
+
+            if [[ -z "${flag_parsing_disabled}" ]]; then
+                # If flag parsing is enabled, we have completed the flags and can return.
+                # If flag parsing is disabled, we may not know all (or any) of the flags, so we fallthrough
+                # to possibly call handle_go_custom_completion.
+                return 0;
+            fi
             ;;
     esac
 
@@ -232,13 +253,13 @@ __%[1]s_handle_reply()
     fi
 
     if [[ ${#COMPREPLY[@]} -eq 0 ]]; then
-		if declare -F __%[1]s_custom_func >/dev/null; then
-			# try command name qualified custom func
-			__%[1]s_custom_func
-		else
-			# otherwise fall back to unqualified for compatibility
-			declare -F __custom_func >/dev/null && __custom_func
-		fi
+        if declare -F __%[1]s_custom_func >/dev/null; then
+            # try command name qualified custom func
+            __%[1]s_custom_func
+        else
+            # otherwise fall back to unqualified for compatibility
+            declare -F __custom_func >/dev/null && __custom_func
+        fi
     fi
 
     # available in bash-completion >= 2, not always present on macOS
@@ -272,7 +293,7 @@ __%[1]s_handle_flag()
 
     # if a command required a flag, and we found it, unset must_have_one_flag()
     local flagname=${words[c]}
-    local flagvalue
+    local flagvalue=""
     # if the word contained an =
     if [[ ${words[c]} == *"="* ]]; then
         flagvalue=${flagname#*=} # take in as flagvalue after the =
@@ -291,7 +312,7 @@ __%[1]s_handle_flag()
 
     # keep flag value with flagname as flaghash
     # flaghash variable is an associative array which is only supported in bash > 3.
-    if [[ -z "${BASH_VERSION}" || "${BASH_VERSINFO[0]}" -gt 3 ]]; then
+    if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then
         if [ -n "${flagvalue}" ] ; then
             flaghash[${flagname}]=${flagvalue}
         elif [ -n "${words[ $((c+1)) ]}" ] ; then
@@ -303,7 +324,7 @@ __%[1]s_handle_flag()
 
     # skip the argument to a two word flag
     if [[ ${words[c]} != *"="* ]] && __%[1]s_contains_word "${words[c]}" "${two_word_flags[@]}"; then
-			  __%[1]s_debug "${FUNCNAME[0]}: found a flag ${words[c]}, skip the next argument"
+        __%[1]s_debug "${FUNCNAME[0]}: found a flag ${words[c]}, skip the next argument"
         c=$((c+1))
         # if we are looking for a flags value, don't show commands
         if [[ $c -eq $cword ]]; then
@@ -363,7 +384,7 @@ __%[1]s_handle_word()
         __%[1]s_handle_command
     elif __%[1]s_contains_word "${words[c]}" "${command_aliases[@]}"; then
         # aliashash variable is an associative array which is only supported in bash > 3.
-        if [[ -z "${BASH_VERSION}" || "${BASH_VERSINFO[0]}" -gt 3 ]]; then
+        if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then
             words[c]=${aliashash[${words[c]}]}
             __%[1]s_handle_command
         else
@@ -377,11 +398,11 @@ __%[1]s_handle_word()
 
 `, name, ShellCompNoDescRequestCmd,
 		ShellCompDirectiveError, ShellCompDirectiveNoSpace, ShellCompDirectiveNoFileComp,
-		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs))
+		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs, activeHelpEnvVar(name)))
 }
 
 func writePostscript(buf io.StringWriter, name string) {
-	name = strings.Replace(name, ":", "__", -1)
+	name = strings.ReplaceAll(name, ":", "__")
 	WriteStringAndCheck(buf, fmt.Sprintf("__start_%s()\n", name))
 	WriteStringAndCheck(buf, fmt.Sprintf(`{
     local cur prev words cword split
@@ -394,6 +415,7 @@ func writePostscript(buf io.StringWriter, name string) {
     fi
 
     local c=0
+    local flag_parsing_disabled=
     local flags=()
     local two_word_flags=()
     local local_nonpersistent_flags=()
@@ -403,8 +425,8 @@ func writePostscript(buf io.StringWriter, name string) {
     local command_aliases=()
     local must_have_one_flag=()
     local must_have_one_noun=()
-    local has_completion_function
-    local last_command
+    local has_completion_function=""
+    local last_command=""
     local nouns=()
     local noun_aliases=()
 
@@ -510,7 +532,7 @@ func writeLocalNonPersistentFlag(buf io.StringWriter, flag *pflag.Flag) {
 	}
 }
 
-// Setup annotations for go completions for registered flags
+// prepareCustomAnnotationsForFlags setup annotations for go completions for registered flags
 func prepareCustomAnnotationsForFlags(cmd *Command) {
 	flagCompletionMutex.RLock()
 	defer flagCompletionMutex.RUnlock()
@@ -535,6 +557,11 @@ func writeFlags(buf io.StringWriter, cmd *Command) {
     flags_completion=()
 
 `)
+
+	if cmd.DisableFlagParsing {
+		WriteStringAndCheck(buf, "    flag_parsing_disabled=1\n")
+	}
+
 	localNonPersistentFlags := cmd.LocalNonPersistentFlags()
 	cmd.NonInheritedFlags().VisitAll(func(flag *pflag.Flag) {
 		if nonCompletableFlag(flag) {
@@ -609,7 +636,7 @@ func writeCmdAliases(buf io.StringWriter, cmd *Command) {
 
 	sort.Strings(cmd.Aliases)
 
-	WriteStringAndCheck(buf, fmt.Sprint(`    if [[ -z "${BASH_VERSION}" || "${BASH_VERSINFO[0]}" -gt 3 ]]; then`, "\n"))
+	WriteStringAndCheck(buf, fmt.Sprint(`    if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; then`, "\n"))
 	for _, value := range cmd.Aliases {
 		WriteStringAndCheck(buf, fmt.Sprintf("        command_aliases+=(%q)\n", value))
 		WriteStringAndCheck(buf, fmt.Sprintf("        aliashash[%q]=%q\n", value, cmd.Name()))
@@ -633,8 +660,8 @@ func gen(buf io.StringWriter, cmd *Command) {
 		gen(buf, c)
 	}
 	commandName := cmd.CommandPath()
-	commandName = strings.Replace(commandName, " ", "_", -1)
-	commandName = strings.Replace(commandName, ":", "__", -1)
+	commandName = strings.ReplaceAll(commandName, " ", "_")
+	commandName = strings.ReplaceAll(commandName, ":", "__")
 
 	if cmd.Root() == cmd {
 		WriteStringAndCheck(buf, fmt.Sprintf("_%s_root_command()\n{\n", commandName))
diff --git a/vendor/github.com/spf13/cobra/bash_completionsV2.go b/vendor/github.com/spf13/cobra/bash_completionsV2.go
index 8859b57c42..19b09560c1 100644
--- a/vendor/github.com/spf13/cobra/bash_completionsV2.go
+++ b/vendor/github.com/spf13/cobra/bash_completionsV2.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
@@ -24,7 +38,7 @@ func genBashComp(buf io.StringWriter, name string, includeDesc bool) {
 
 __%[1]s_debug()
 {
-    if [[ -n ${BASH_COMP_DEBUG_FILE:-} ]]; then
+    if [[ -n ${BASH_COMP_DEBUG_FILE-} ]]; then
         echo "$*" >> "${BASH_COMP_DEBUG_FILE}"
     fi
 }
@@ -51,7 +65,7 @@ __%[1]s_get_completion_results() {
     lastChar=${lastParam:$((${#lastParam}-1)):1}
     __%[1]s_debug "lastParam ${lastParam}, lastChar ${lastChar}"
 
-    if [ -z "${cur}" ] && [ "${lastChar}" != "=" ]; then
+    if [[ -z ${cur} && ${lastChar} != = ]]; then
         # If the last parameter is complete (there is a space following it)
         # We add an extra empty parameter so we can indicate this to the go method.
         __%[1]s_debug "Adding extra empty parameter"
@@ -61,7 +75,7 @@ __%[1]s_get_completion_results() {
     # When completing a flag with an = (e.g., %[1]s -n=<TAB>)
     # bash focuses on the part after the =, so we need to remove
     # the flag part from $cur
-    if [[ "${cur}" == -*=* ]]; then
+    if [[ ${cur} == -*=* ]]; then
         cur="${cur#*=}"
     fi
 
@@ -73,12 +87,12 @@ __%[1]s_get_completion_results() {
     directive=${out##*:}
     # Remove the directive
     out=${out%%:*}
-    if [ "${directive}" = "${out}" ]; then
+    if [[ ${directive} == "${out}" ]]; then
         # There is not directive specified
         directive=0
     fi
     __%[1]s_debug "The completion directive is: ${directive}"
-    __%[1]s_debug "The completions are: ${out[*]}"
+    __%[1]s_debug "The completions are: ${out}"
 }
 
 __%[1]s_process_completion_results() {
@@ -87,22 +101,36 @@ __%[1]s_process_completion_results() {
     local shellCompDirectiveNoFileComp=%[5]d
     local shellCompDirectiveFilterFileExt=%[6]d
     local shellCompDirectiveFilterDirs=%[7]d
+    local shellCompDirectiveKeepOrder=%[8]d
 
-    if [ $((directive & shellCompDirectiveError)) -ne 0 ]; then
+    if (((directive & shellCompDirectiveError) != 0)); then
         # Error code.  No completion.
         __%[1]s_debug "Received error from custom completion go code"
         return
     else
-        if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then
-            if [[ $(type -t compopt) = "builtin" ]]; then
+        if (((directive & shellCompDirectiveNoSpace) != 0)); then
+            if [[ $(type -t compopt) == builtin ]]; then
                 __%[1]s_debug "Activating no space"
                 compopt -o nospace
             else
                 __%[1]s_debug "No space directive not supported in this version of bash"
             fi
         fi
-        if [ $((directive & shellCompDirectiveNoFileComp)) -ne 0 ]; then
-            if [[ $(type -t compopt) = "builtin" ]]; then
+        if (((directive & shellCompDirectiveKeepOrder) != 0)); then
+            if [[ $(type -t compopt) == builtin ]]; then
+                # no sort isn't supported for bash less than < 4.4
+                if [[ ${BASH_VERSINFO[0]} -lt 4 || ( ${BASH_VERSINFO[0]} -eq 4 && ${BASH_VERSINFO[1]} -lt 4 ) ]]; then
+                    __%[1]s_debug "No sort directive not supported in this version of bash"
+                else
+                    __%[1]s_debug "Activating keep order"
+                    compopt -o nosort
+                fi
+            else
+                __%[1]s_debug "No sort directive not supported in this version of bash"
+            fi
+        fi
+        if (((directive & shellCompDirectiveNoFileComp) != 0)); then
+            if [[ $(type -t compopt) == builtin ]]; then
                 __%[1]s_debug "Activating no file completion"
                 compopt +o default
             else
@@ -111,26 +139,30 @@ __%[1]s_process_completion_results() {
         fi
     fi
 
-    if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then
+    # Separate activeHelp from normal completions
+    local completions=()
+    local activeHelp=()
+    __%[1]s_extract_activeHelp
+
+    if (((directive & shellCompDirectiveFilterFileExt) != 0)); then
         # File extension filtering
         local fullFilter filter filteringCmd
 
-        # Do not use quotes around the $out variable or else newline
+        # Do not use quotes around the $completions variable or else newline
         # characters will be kept.
-        for filter in ${out[*]}; do
+        for filter in ${completions[*]}; do
             fullFilter+="$filter|"
         done
 
         filteringCmd="_filedir $fullFilter"
         __%[1]s_debug "File filtering command: $filteringCmd"
         $filteringCmd
-    elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then
+    elif (((directive & shellCompDirectiveFilterDirs) != 0)); then
         # File completion for directories only
 
-        # Use printf to strip any trailing newline
         local subdir
-        subdir=$(printf "%%s" "${out[0]}")
-        if [ -n "$subdir" ]; then
+        subdir=${completions[0]}
+        if [[ -n $subdir ]]; then
             __%[1]s_debug "Listing directories in $subdir"
             pushd "$subdir" >/dev/null 2>&1 && _filedir -d && popd >/dev/null 2>&1 || return
         else
@@ -138,52 +170,110 @@ __%[1]s_process_completion_results() {
             _filedir -d
         fi
     else
-        __%[1]s_handle_standard_completion_case
+        __%[1]s_handle_completion_types
     fi
 
     __%[1]s_handle_special_char "$cur" :
     __%[1]s_handle_special_char "$cur" =
+
+    # Print the activeHelp statements before we finish
+    if ((${#activeHelp[*]} != 0)); then
+        printf "\n";
+        printf "%%s\n" "${activeHelp[@]}"
+        printf "\n"
+
+        # The prompt format is only available from bash 4.4.
+        # We test if it is available before using it.
+        if (x=${PS1@P}) 2> /dev/null; then
+            printf "%%s" "${PS1@P}${COMP_LINE[@]}"
+        else
+            # Can't print the prompt.  Just print the
+            # text the user had typed, it is workable enough.
+            printf "%%s" "${COMP_LINE[@]}"
+        fi
+    fi
+}
+
+# Separate activeHelp lines from real completions.
+# Fills the $activeHelp and $completions arrays.
+__%[1]s_extract_activeHelp() {
+    local activeHelpMarker="%[9]s"
+    local endIndex=${#activeHelpMarker}
+
+    while IFS='' read -r comp; do
+        if [[ ${comp:0:endIndex} == $activeHelpMarker ]]; then
+            comp=${comp:endIndex}
+            __%[1]s_debug "ActiveHelp found: $comp"
+            if [[ -n $comp ]]; then
+                activeHelp+=("$comp")
+            fi
+        else
+            # Not an activeHelp line but a normal completion
+            completions+=("$comp")
+        fi
+    done <<<"${out}"
+}
+
+__%[1]s_handle_completion_types() {
+    __%[1]s_debug "__%[1]s_handle_completion_types: COMP_TYPE is $COMP_TYPE"
+
+    case $COMP_TYPE in
+    37|42)
+        # Type: menu-complete/menu-complete-backward and insert-completions
+        # If the user requested inserting one completion at a time, or all
+        # completions at once on the command-line we must remove the descriptions.
+        # https://github.com/spf13/cobra/issues/1508
+        local tab=$'\t' comp
+        while IFS='' read -r comp; do
+            [[ -z $comp ]] && continue
+            # Strip any description
+            comp=${comp%%%%$tab*}
+            # Only consider the completions that match
+            if [[ $comp == "$cur"* ]]; then
+                COMPREPLY+=("$comp")
+            fi
+        done < <(printf "%%s\n" "${completions[@]}")
+        ;;
+
+    *)
+        # Type: complete (normal completion)
+        __%[1]s_handle_standard_completion_case
+        ;;
+    esac
 }
 
 __%[1]s_handle_standard_completion_case() {
-    local tab comp
-    tab=$(printf '\t')
+    local tab=$'\t' comp
+
+    # Short circuit to optimize if we don't have descriptions
+    if [[ "${completions[*]}" != *$tab* ]]; then
+        IFS=$'\n' read -ra COMPREPLY -d '' < <(compgen -W "${completions[*]}" -- "$cur")
+        return 0
+    fi
 
     local longest=0
+    local compline
     # Look for the longest completion so that we can format things nicely
-    while IFS='' read -r comp; do
+    while IFS='' read -r compline; do
+        [[ -z $compline ]] && continue
         # Strip any description before checking the length
-        comp=${comp%%%%$tab*}
+        comp=${compline%%%%$tab*}
         # Only consider the completions that match
-        comp=$(compgen -W "$comp" -- "$cur")
+        [[ $comp == "$cur"* ]] || continue
+        COMPREPLY+=("$compline")
         if ((${#comp}>longest)); then
             longest=${#comp}
         fi
-    done < <(printf "%%s\n" "${out[@]}")
-
-    local completions=()
-    while IFS='' read -r comp; do
-        if [ -z "$comp" ]; then
-            continue
-        fi
-
-        __%[1]s_debug "Original comp: $comp"
-        comp="$(__%[1]s_format_comp_descriptions "$comp" "$longest")"
-        __%[1]s_debug "Final comp: $comp"
-        completions+=("$comp")
-    done < <(printf "%%s\n" "${out[@]}")
-
-    while IFS='' read -r comp; do
-        COMPREPLY+=("$comp")
-    done < <(compgen -W "${completions[*]}" -- "$cur")
+    done < <(printf "%%s\n" "${completions[@]}")
 
     # If there is a single completion left, remove the description text
-    if [ ${#COMPREPLY[*]} -eq 1 ]; then
+    if ((${#COMPREPLY[*]} == 1)); then
         __%[1]s_debug "COMPREPLY[0]: ${COMPREPLY[0]}"
-        comp="${COMPREPLY[0]%%%% *}"
+        comp="${COMPREPLY[0]%%%%$tab*}"
         __%[1]s_debug "Removed description from single completion, which is now: ${comp}"
-        COMPREPLY=()
-        COMPREPLY+=("$comp")
+        COMPREPLY[0]=$comp
+    else # Format the descriptions
+        __%[1]s_format_comp_descriptions $longest
     fi
 }
 
@@ -194,53 +284,56 @@ __%[1]s_handle_special_char()
     if [[ "$comp" == *${char}* && "$COMP_WORDBREAKS" == *${char}* ]]; then
         local word=${comp%%"${comp##*${char}}"}
         local idx=${#COMPREPLY[*]}
-        while [[ $((--idx)) -ge 0 ]]; do
-            COMPREPLY[$idx]=${COMPREPLY[$idx]#"$word"}
+        while ((--idx >= 0)); do
+            COMPREPLY[idx]=${COMPREPLY[idx]#"$word"}
         done
     fi
 }
 
 __%[1]s_format_comp_descriptions()
 {
-    local tab
-    tab=$(printf '\t')
-    local comp="$1"
-    local longest=$2
-
-    # Properly format the description string which follows a tab character if there is one
-    if [[ "$comp" == *$tab* ]]; then
-        desc=${comp#*$tab}
-        comp=${comp%%%%$tab*}
-
-        # $COLUMNS stores the current shell width.
-        # Remove an extra 4 because we add 2 spaces and 2 parentheses.
-        maxdesclength=$(( COLUMNS - longest - 4 ))
-
-        # Make sure we can fit a description of at least 8 characters
-        # if we are to align the descriptions.
-        if [[ $maxdesclength -gt 8 ]]; then
-            # Add the proper number of spaces to align the descriptions
-            for ((i = ${#comp} ; i < longest ; i++)); do
-                comp+=" "
-            done
-        else
-            # Don't pad the descriptions so we can fit more text after the completion
-            maxdesclength=$(( COLUMNS - ${#comp} - 4 ))
-        fi
+    local tab=$'\t'
+    local comp desc maxdesclength
+    local longest=$1
+
+    local i ci
+    for ci in ${!COMPREPLY[*]}; do
+        comp=${COMPREPLY[ci]}
+        # Properly format the description string which follows a tab character if there is one
+        if [[ "$comp" == *$tab* ]]; then
+            __%[1]s_debug "Original comp: $comp"
+            desc=${comp#*$tab}
+            comp=${comp%%%%$tab*}
+
+            # $COLUMNS stores the current shell width.
+            # Remove an extra 4 because we add 2 spaces and 2 parentheses.
+            maxdesclength=$(( COLUMNS - longest - 4 ))
+
+            # Make sure we can fit a description of at least 8 characters
+            # if we are to align the descriptions.
+            if ((maxdesclength > 8)); then
+                # Add the proper number of spaces to align the descriptions
+                for ((i = ${#comp} ; i < longest ; i++)); do
+                    comp+=" "
+                done
+            else
+                # Don't pad the descriptions so we can fit more text after the completion
+                maxdesclength=$(( COLUMNS - ${#comp} - 4 ))
+            fi
 
-        # If there is enough space for any description text,
-        # truncate the descriptions that are too long for the shell width
-        if [ $maxdesclength -gt 0 ]; then
-            if [ ${#desc} -gt $maxdesclength ]; then
-                desc=${desc:0:$(( maxdesclength - 1 ))}
-                desc+="…"
+            # If there is enough space for any description text,
+            # truncate the descriptions that are too long for the shell width
+            if ((maxdesclength > 0)); then
+                if ((${#desc} > maxdesclength)); then
+                    desc=${desc:0:$(( maxdesclength - 1 ))}
+                    desc+="…"
+                fi
+                comp+="  ($desc)"
             fi
-            comp+="  ($desc)"
+            COMPREPLY[ci]=$comp
+            __%[1]s_debug "Final comp: $comp"
         fi
-    fi
-
-    # Must use printf to escape all special characters
-    printf "%%q" "${comp}"
+    done
 }
 
 __start_%[1]s()
@@ -252,9 +345,9 @@ __start_%[1]s()
     # Call _init_completion from the bash-completion package
     # to prepare the arguments properly
     if declare -F _init_completion >/dev/null 2>&1; then
-        _init_completion -n "=:" || return
+        _init_completion -n =: || return
     else
-        __%[1]s_init_completion -n "=:" || return
+        __%[1]s_init_completion -n =: || return
     fi
 
     __%[1]s_debug
@@ -281,7 +374,8 @@ fi
 # ex: ts=4 sw=4 et filetype=sh
 `, name, compCmd,
 		ShellCompDirectiveError, ShellCompDirectiveNoSpace, ShellCompDirectiveNoFileComp,
-		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs))
+		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs, ShellCompDirectiveKeepOrder,
+		activeHelpMarker))
 }
 
 // GenBashCompletionFileV2 generates Bash completion version 2.
diff --git a/vendor/github.com/spf13/cobra/cobra.go b/vendor/github.com/spf13/cobra/cobra.go
index d6cbfd7198..b07b44a0ce 100644
--- a/vendor/github.com/spf13/cobra/cobra.go
+++ b/vendor/github.com/spf13/cobra/cobra.go
@@ -1,9 +1,10 @@
-// Copyright © 2013 Steve Francia <spf@spf13.com>.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -39,15 +40,25 @@ var templateFuncs = template.FuncMap{
 }
 
 var initializers []func()
+var finalizers []func()
+
+const (
+	defaultPrefixMatching  = false
+	defaultCommandSorting  = true
+	defaultCaseInsensitive = false
+)
 
 // EnablePrefixMatching allows to set automatic prefix matching. Automatic prefix matching can be a dangerous thing
 // to automatically enable in CLI tools.
 // Set this to true to enable it.
-var EnablePrefixMatching = false
+var EnablePrefixMatching = defaultPrefixMatching
 
 // EnableCommandSorting controls sorting of the slice of commands, which is turned on by default.
 // To disable sorting, set it to false.
-var EnableCommandSorting = true
+var EnableCommandSorting = defaultCommandSorting
+
+// EnableCaseInsensitive allows case-insensitive commands names. (case sensitive by default)
+var EnableCaseInsensitive = defaultCaseInsensitive
 
 // MousetrapHelpText enables an information splash screen on Windows
 // if the CLI is started from explorer.exe.
@@ -84,6 +95,12 @@ func OnInitialize(y ...func()) {
 	initializers = append(initializers, y...)
 }
 
+// OnFinalize sets the passed functions to be run when each command's
+// Execute method is terminated.
+func OnFinalize(y ...func()) {
+	finalizers = append(finalizers, y...)
+}
+
 // FIXME Gt is unused by cobra and should be removed in a version 2. It exists only for compatibility with users of cobra.
 
 // Gt takes two types and checks whether the first type is greater than the second. In case of types Arrays, Chans,
@@ -150,8 +167,8 @@ func appendIfNotPresent(s, stringToAppend string) string {
 
 // rpad adds padding to the right of a string.
 func rpad(s string, padding int) string {
-	template := fmt.Sprintf("%%-%ds", padding)
-	return fmt.Sprintf(template, s)
+	formattedString := fmt.Sprintf("%%-%ds", padding)
+	return fmt.Sprintf(formattedString, s)
 }
 
 // tmpl executes the given template text on data, writing the result to w.
diff --git a/vendor/github.com/spf13/cobra/command.go b/vendor/github.com/spf13/cobra/command.go
index 2cc18891d7..01f7c6f1c5 100644
--- a/vendor/github.com/spf13/cobra/command.go
+++ b/vendor/github.com/spf13/cobra/command.go
@@ -1,9 +1,10 @@
-// Copyright © 2013 Steve Francia <spf@spf13.com>.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -18,6 +19,7 @@ package cobra
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -28,16 +30,24 @@ import (
 	flag "github.com/spf13/pflag"
 )
 
+const FlagSetByCobraAnnotation = "cobra_annotation_flag_set_by_cobra"
+
 // FParseErrWhitelist configures Flag parse errors to be ignored
 type FParseErrWhitelist flag.ParseErrorsWhitelist
 
+// Group Structure to manage groups for commands
+type Group struct {
+	ID    string
+	Title string
+}
+
 // Command is just that, a command for your application.
 // E.g.  'go run ...' - 'run' is the command. Cobra requires
 // you to define the usage and description as part of your command
 // definition to ensure usability.
 type Command struct {
 	// Use is the one-line usage message.
-	// Recommended syntax is as follow:
+	// Recommended syntax is as follows:
 	//   [ ] identifies an optional argument. Arguments that are not enclosed in brackets are required.
 	//   ... indicates that you can specify multiple values for the previous argument.
 	//   |   indicates mutually exclusive information. You can use the argument to the left of the separator or the
@@ -57,6 +67,9 @@ type Command struct {
 	// Short is the short description shown in the 'help' output.
 	Short string
 
+	// The group id under which this subcommand is grouped in the 'help' output of its parent.
+	GroupID string
+
 	// Long is the long message shown in the 'help <this-command>' output.
 	Long string
 
@@ -124,6 +137,9 @@ type Command struct {
 	// PersistentPostRunE: PersistentPostRun but returns an error.
 	PersistentPostRunE func(cmd *Command, args []string) error
 
+	// groups for subcommands
+	commandgroups []*Group
+
 	// args is actual args parsed from flags.
 	args []string
 	// flagErrorBuf contains all error messages from pflag.
@@ -156,6 +172,12 @@ type Command struct {
 	// helpCommand is command with usage 'help'. If it's not defined by user,
 	// cobra uses default help command.
 	helpCommand *Command
+	// helpCommandGroupID is the group id for the helpCommand
+	helpCommandGroupID string
+
+	// completionCommandGroupID is the group id for the completion command
+	completionCommandGroupID string
+
 	// versionTemplate is the version template defined by user.
 	versionTemplate string
 
@@ -166,7 +188,7 @@ type Command struct {
 	// errWriter is a writer defined by the user that replaces stderr
 	errWriter io.Writer
 
-	//FParseErrWhitelist flag parse errors to be ignored
+	// FParseErrWhitelist flag parse errors to be ignored
 	FParseErrWhitelist FParseErrWhitelist
 
 	// CompletionOptions is a set of options to control the handling of shell completion
@@ -224,12 +246,23 @@ type Command struct {
 	SuggestionsMinimumDistance int
 }
 
-// Context returns underlying command context. If command wasn't
-// executed with ExecuteContext Context returns Background context.
+// Context returns underlying command context. If command was executed
+// with ExecuteContext or the context was set with SetContext, the
+// previously set context will be returned. Otherwise, nil is returned.
+//
+// Notice that a call to Execute and ExecuteC will replace a nil context of
+// a command with a context.Background, so a background context will be
+// returned by Context after one of these functions has been called.
 func (c *Command) Context() context.Context {
 	return c.ctx
 }
 
+// SetContext sets context for the command. This context will be overwritten by
+// Command.ExecuteContext or Command.ExecuteContextC.
+func (c *Command) SetContext(ctx context.Context) {
+	c.ctx = ctx
+}
+
 // SetArgs sets arguments for the command. It is set to os.Args[1:] by default, if desired, can be overridden
 // particularly useful when testing.
 func (c *Command) SetArgs(a []string) {
@@ -288,6 +321,21 @@ func (c *Command) SetHelpCommand(cmd *Command) {
 	c.helpCommand = cmd
 }
 
+// SetHelpCommandGroupID sets the group id of the help command.
+func (c *Command) SetHelpCommandGroupID(groupID string) {
+	if c.helpCommand != nil {
+		c.helpCommand.GroupID = groupID
+	}
+	// helpCommandGroupID is used if no helpCommand is defined by the user
+	c.helpCommandGroupID = groupID
+}
+
+// SetCompletionCommandGroupID sets the group id of the completion command.
+func (c *Command) SetCompletionCommandGroupID(groupID string) {
+	// completionCommandGroupID is used if no completion command is defined by the user
+	c.Root().completionCommandGroupID = groupID
+}
+
 // SetHelpTemplate sets help template to be used. Application can use it to set custom template.
 func (c *Command) SetHelpTemplate(s string) {
 	c.helpTemplate = s
@@ -496,10 +544,16 @@ Aliases:
   {{.NameAndAliases}}{{end}}{{if .HasExample}}
 
 Examples:
-{{.Example}}{{end}}{{if .HasAvailableSubCommands}}
+{{.Example}}{{end}}{{if .HasAvailableSubCommands}}{{$cmds := .Commands}}{{if eq (len .Groups) 0}}
+
+Available Commands:{{range $cmds}}{{if (or .IsAvailableCommand (eq .Name "help"))}}
+  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{else}}{{range $group := .Groups}}
 
-Available Commands:{{range .Commands}}{{if (or .IsAvailableCommand (eq .Name "help"))}}
-  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableLocalFlags}}
+{{.Title}}{{range $cmds}}{{if (and (eq .GroupID $group.ID) (or .IsAvailableCommand (eq .Name "help")))}}
+  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if not .AllChildCommandsHaveGroup}}
+
+Additional Commands:{{range $cmds}}{{if (and (eq .GroupID "") (or .IsAvailableCommand (eq .Name "help")))}}
+  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{end}}{{end}}{{if .HasAvailableLocalFlags}}
 
 Flags:
 {{.LocalFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasAvailableInheritedFlags}}
@@ -601,20 +655,44 @@ Loop:
 
 // argsMinusFirstX removes only the first x from args.  Otherwise, commands that look like
 // openshift admin policy add-role-to-user admin my-user, lose the admin argument (arg[4]).
-func argsMinusFirstX(args []string, x string) []string {
-	for i, y := range args {
-		if x == y {
-			ret := []string{}
-			ret = append(ret, args[:i]...)
-			ret = append(ret, args[i+1:]...)
-			return ret
+// Special care needs to be taken not to remove a flag value.
+func (c *Command) argsMinusFirstX(args []string, x string) []string {
+	if len(args) == 0 {
+		return args
+	}
+	c.mergePersistentFlags()
+	flags := c.Flags()
+
+Loop:
+	for pos := 0; pos < len(args); pos++ {
+		s := args[pos]
+		switch {
+		case s == "--":
+			// -- means we have reached the end of the parseable args. Break out of the loop now.
+			break Loop
+		case strings.HasPrefix(s, "--") && !strings.Contains(s, "=") && !hasNoOptDefVal(s[2:], flags):
+			fallthrough
+		case strings.HasPrefix(s, "-") && !strings.Contains(s, "=") && len(s) == 2 && !shortHasNoOptDefVal(s[1:], flags):
+			// This is a flag without a default value, and an equal sign is not used. Increment pos in order to skip
+			// over the next arg, because that is the value of this flag.
+			pos++
+			continue
+		case !strings.HasPrefix(s, "-"):
+			// This is not a flag or a flag value. Check to see if it matches what we're looking for, and if so,
+			// return the args, excluding the one at this position.
+			if s == x {
+				ret := []string{}
+				ret = append(ret, args[:pos]...)
+				ret = append(ret, args[pos+1:]...)
+				return ret
+			}
 		}
 	}
 	return args
 }
 
 func isFlagArg(arg string) bool {
-	return ((len(arg) >= 3 && arg[1] == '-') ||
+	return ((len(arg) >= 3 && arg[0:2] == "--") ||
 		(len(arg) >= 2 && arg[0] == '-' && arg[1] != '-'))
 }
 
@@ -632,7 +710,7 @@ func (c *Command) Find(args []string) (*Command, []string, error) {
 
 		cmd := c.findNext(nextSubCmd)
 		if cmd != nil {
-			return innerfind(cmd, argsMinusFirstX(innerArgs, nextSubCmd))
+			return innerfind(cmd, c.argsMinusFirstX(innerArgs, nextSubCmd))
 		}
 		return c, innerArgs
 	}
@@ -664,7 +742,7 @@ func (c *Command) findSuggestions(arg string) string {
 func (c *Command) findNext(next string) *Command {
 	matches := make([]*Command, 0)
 	for _, cmd := range c.commands {
-		if cmd.Name() == next || cmd.HasAlias(next) {
+		if commandNameMatches(cmd.Name(), next) || cmd.HasAlias(next) {
 			cmd.commandCalledAs.name = next
 			return cmd
 		}
@@ -821,6 +899,8 @@ func (c *Command) execute(a []string) (err error) {
 
 	c.preRun()
 
+	defer c.postRun()
+
 	argWoFlags := c.Flags().Args()
 	if c.DisableFlagParsing {
 		argWoFlags = a
@@ -849,9 +929,13 @@ func (c *Command) execute(a []string) (err error) {
 		c.PreRun(c, argWoFlags)
 	}
 
-	if err := c.validateRequiredFlags(); err != nil {
+	if err := c.ValidateRequiredFlags(); err != nil {
+		return err
+	}
+	if err := c.ValidateFlagGroups(); err != nil {
 		return err
 	}
+
 	if c.RunE != nil {
 		if err := c.RunE(c, argWoFlags); err != nil {
 			return err
@@ -887,6 +971,12 @@ func (c *Command) preRun() {
 	}
 }
 
+func (c *Command) postRun() {
+	for _, x := range finalizers {
+		x()
+	}
+}
+
 // ExecuteContext is the same as Execute(), but sets the ctx on the command.
 // Retrieve ctx by calling cmd.Context() inside your *Run lifecycle or ValidArgs
 // functions.
@@ -930,7 +1020,11 @@ func (c *Command) ExecuteC() (cmd *Command, err error) {
 	// initialize help at the last point to allow for user overriding
 	c.InitDefaultHelpCmd()
 	// initialize completion at the last point to allow for user overriding
-	c.initDefaultCompletionCmd()
+	c.InitDefaultCompletionCmd()
+
+	// Now that all commands have been created, let's make sure all groups
+	// are properly created also
+	c.checkCommandGroups()
 
 	args := c.args
 
@@ -975,7 +1069,7 @@ func (c *Command) ExecuteC() (cmd *Command, err error) {
 	if err != nil {
 		// Always show help if requested, even if SilenceErrors is in
 		// effect
-		if err == flag.ErrHelp {
+		if errors.Is(err, flag.ErrHelp) {
 			cmd.HelpFunc()(cmd, args)
 			return cmd, nil
 		}
@@ -997,12 +1091,13 @@ func (c *Command) ExecuteC() (cmd *Command, err error) {
 
 func (c *Command) ValidateArgs(args []string) error {
 	if c.Args == nil {
-		return nil
+		return ArbitraryArgs(c, args)
 	}
 	return c.Args(c, args)
 }
 
-func (c *Command) validateRequiredFlags() error {
+// ValidateRequiredFlags validates all required flags are present and returns an error otherwise
+func (c *Command) ValidateRequiredFlags() error {
 	if c.DisableFlagParsing {
 		return nil
 	}
@@ -1025,6 +1120,19 @@ func (c *Command) validateRequiredFlags() error {
 	return nil
 }
 
+// checkCommandGroups checks if a command has been added to a group that does not exists.
+// If so, we panic because it indicates a coding error that should be corrected.
+func (c *Command) checkCommandGroups() {
+	for _, sub := range c.commands {
+		// if Group is not defined let the developer know right away
+		if sub.GroupID != "" && !c.ContainsGroup(sub.GroupID) {
+			panic(fmt.Sprintf("group id '%s' is not defined for subcommand '%s'", sub.GroupID, sub.CommandPath()))
+		}
+
+		sub.checkCommandGroups()
+	}
+}
+
 // InitDefaultHelpFlag adds default help flag to c.
 // It is called automatically by executing the c or by calling help and usage.
 // If c already has help flag, it will do nothing.
@@ -1038,6 +1146,7 @@ func (c *Command) InitDefaultHelpFlag() {
 			usage += c.Name()
 		}
 		c.Flags().BoolP("help", "h", false, usage)
+		_ = c.Flags().SetAnnotation("help", FlagSetByCobraAnnotation, []string{"true"})
 	}
 }
 
@@ -1063,6 +1172,7 @@ func (c *Command) InitDefaultVersionFlag() {
 		} else {
 			c.Flags().Bool("version", false, usage)
 		}
+		_ = c.Flags().SetAnnotation("version", FlagSetByCobraAnnotation, []string{"true"})
 	}
 }
 
@@ -1105,10 +1215,12 @@ Simply type ` + c.Name() + ` help [path to command] for full details.`,
 					c.Printf("Unknown help topic %#q\n", args)
 					CheckErr(c.Root().Usage())
 				} else {
-					cmd.InitDefaultHelpFlag() // make possible 'help' flag to be shown
+					cmd.InitDefaultHelpFlag()    // make possible 'help' flag to be shown
+					cmd.InitDefaultVersionFlag() // make possible 'version' flag to be shown
 					CheckErr(cmd.Help())
 				}
 			},
+			GroupID: c.helpCommandGroupID,
 		}
 	}
 	c.RemoveCommand(c.helpCommand)
@@ -1169,6 +1281,36 @@ func (c *Command) AddCommand(cmds ...*Command) {
 	}
 }
 
+// Groups returns a slice of child command groups.
+func (c *Command) Groups() []*Group {
+	return c.commandgroups
+}
+
+// AllChildCommandsHaveGroup returns if all subcommands are assigned to a group
+func (c *Command) AllChildCommandsHaveGroup() bool {
+	for _, sub := range c.commands {
+		if (sub.IsAvailableCommand() || sub == c.helpCommand) && sub.GroupID == "" {
+			return false
+		}
+	}
+	return true
+}
+
+// ContainsGroup return if groupID exists in the list of command groups.
+func (c *Command) ContainsGroup(groupID string) bool {
+	for _, x := range c.commandgroups {
+		if x.ID == groupID {
+			return true
+		}
+	}
+	return false
+}
+
+// AddGroup adds one or more command groups to this parent command.
+func (c *Command) AddGroup(groups ...*Group) {
+	c.commandgroups = append(c.commandgroups, groups...)
+}
+
 // RemoveCommand removes one or more commands from a parent command.
 func (c *Command) RemoveCommand(cmds ...*Command) {
 	commands := []*Command{}
@@ -1312,7 +1454,7 @@ func (c *Command) Name() string {
 // HasAlias determines if a given string is an alias of the command.
 func (c *Command) HasAlias(s string) bool {
 	for _, a := range c.Aliases {
-		if a == s {
+		if commandNameMatches(a, s) {
 			return true
 		}
 	}
@@ -1489,7 +1631,8 @@ func (c *Command) LocalFlags() *flag.FlagSet {
 	}
 
 	addToLocal := func(f *flag.Flag) {
-		if c.lflags.Lookup(f.Name) == nil && c.parentsPflags.Lookup(f.Name) == nil {
+		// Add the flag if it is not a parent PFlag, or it shadows a parent PFlag
+		if c.lflags.Lookup(f.Name) == nil && f != c.parentsPflags.Lookup(f.Name) {
 			c.lflags.AddFlag(f)
 		}
 	}
@@ -1678,3 +1821,14 @@ func (c *Command) updateParentsPflags() {
 		c.parentsPflags.AddFlagSet(parent.PersistentFlags())
 	})
 }
+
+// commandNameMatches checks if two command names are equal
+// taking into account case sensitivity according to
+// EnableCaseInsensitive global configuration.
+func commandNameMatches(s string, t string) bool {
+	if EnableCaseInsensitive {
+		return strings.EqualFold(s, t)
+	}
+
+	return s == t
+}
diff --git a/vendor/github.com/spf13/cobra/command_notwin.go b/vendor/github.com/spf13/cobra/command_notwin.go
index 6159c1cc19..307f0c127f 100644
--- a/vendor/github.com/spf13/cobra/command_notwin.go
+++ b/vendor/github.com/spf13/cobra/command_notwin.go
@@ -1,3 +1,18 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !windows
 // +build !windows
 
 package cobra
diff --git a/vendor/github.com/spf13/cobra/command_win.go b/vendor/github.com/spf13/cobra/command_win.go
index 8768b1736d..adbef395c2 100644
--- a/vendor/github.com/spf13/cobra/command_win.go
+++ b/vendor/github.com/spf13/cobra/command_win.go
@@ -1,3 +1,18 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build windows
 // +build windows
 
 package cobra
diff --git a/vendor/github.com/spf13/cobra/completions.go b/vendor/github.com/spf13/cobra/completions.go
index b849b9c844..ee38c4d0b8 100644
--- a/vendor/github.com/spf13/cobra/completions.go
+++ b/vendor/github.com/spf13/cobra/completions.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
@@ -63,6 +77,10 @@ const (
 	// obtain the same behavior but only for flags.
 	ShellCompDirectiveFilterDirs
 
+	// ShellCompDirectiveKeepOrder indicates that the shell should preserve the order
+	// in which the completions are provided
+	ShellCompDirectiveKeepOrder
+
 	// ===========================================================================
 
 	// All directives using iota should be above this one.
@@ -93,6 +111,8 @@ type CompletionOptions struct {
 	// DisableDescriptions turns off all completion descriptions for shells
 	// that support them
 	DisableDescriptions bool
+	// HiddenDefaultCmd makes the default 'completion' command hidden
+	HiddenDefaultCmd bool
 }
 
 // NoFileCompletions can be used to disable file completion for commands that should
@@ -101,6 +121,14 @@ func NoFileCompletions(cmd *Command, args []string, toComplete string) ([]string
 	return nil, ShellCompDirectiveNoFileComp
 }
 
+// FixedCompletions can be used to create a completion function which always
+// returns the same results.
+func FixedCompletions(choices []string, directive ShellCompDirective) func(cmd *Command, args []string, toComplete string) ([]string, ShellCompDirective) {
+	return func(cmd *Command, args []string, toComplete string) ([]string, ShellCompDirective) {
+		return choices, directive
+	}
+}
+
 // RegisterFlagCompletionFunc should be called to register a function to provide completion for a flag.
 func (c *Command) RegisterFlagCompletionFunc(flagName string, f func(cmd *Command, args []string, toComplete string) ([]string, ShellCompDirective)) error {
 	flag := c.Flag(flagName)
@@ -135,6 +163,9 @@ func (d ShellCompDirective) string() string {
 	if d&ShellCompDirectiveFilterDirs != 0 {
 		directives = append(directives, "ShellCompDirectiveFilterDirs")
 	}
+	if d&ShellCompDirectiveKeepOrder != 0 {
+		directives = append(directives, "ShellCompDirectiveKeepOrder")
+	}
 	if len(directives) == 0 {
 		directives = append(directives, "ShellCompDirectiveDefault")
 	}
@@ -145,7 +176,7 @@ func (d ShellCompDirective) string() string {
 	return strings.Join(directives, ", ")
 }
 
-// Adds a special hidden command that can be used to request custom completions.
+// initCompleteCmd adds a special hidden command that can be used to request custom completions.
 func (c *Command) initCompleteCmd(args []string) {
 	completeCmd := &Command{
 		Use:                   fmt.Sprintf("%s [command-line]", ShellCompRequestCmd),
@@ -168,6 +199,12 @@ func (c *Command) initCompleteCmd(args []string) {
 
 			noDescriptions := (cmd.CalledAs() == ShellCompNoDescRequestCmd)
 			for _, comp := range completions {
+				if GetActiveHelpConfig(finalCmd) == activeHelpGlobalDisable {
+					// Remove all activeHelp entries in this case
+					if strings.HasPrefix(comp, activeHelpMarker) {
+						continue
+					}
+				}
 				if noDescriptions {
 					// Remove any description that may be included following a tab character.
 					comp = strings.Split(comp, "\t")[0]
@@ -226,7 +263,17 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 	if c.Root().TraverseChildren {
 		finalCmd, finalArgs, err = c.Root().Traverse(trimmedArgs)
 	} else {
-		finalCmd, finalArgs, err = c.Root().Find(trimmedArgs)
+		// For Root commands that don't specify any value for their Args fields, when we call
+		// Find(), if those Root commands don't have any sub-commands, they will accept arguments.
+		// However, because we have added the __complete sub-command in the current code path, the
+		// call to Find() -> legacyArgs() will return an error if there are any arguments.
+		// To avoid this, we first remove the __complete command to get back to having no sub-commands.
+		rootCmd := c.Root()
+		if len(rootCmd.Commands()) == 1 {
+			rootCmd.RemoveCommand(c)
+		}
+
+		finalCmd, finalArgs, err = rootCmd.Find(trimmedArgs)
 	}
 	if err != nil {
 		// Unable to find the real command. E.g., <program> someInvalidCmd <TAB>
@@ -234,6 +281,12 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 	}
 	finalCmd.ctx = c.ctx
 
+	// These flags are normally added when `execute()` is called on `finalCmd`,
+	// however, when doing completion, we don't call `finalCmd.execute()`.
+	// Let's add the --help and --version flag ourselves.
+	finalCmd.InitDefaultHelpFlag()
+	finalCmd.InitDefaultVersionFlag()
+
 	// Check if we are doing flag value completion before parsing the flags.
 	// This is important because if we are completing a flag value, we need to also
 	// remove the flag name argument from the list of finalArgs or else the parsing
@@ -266,6 +319,18 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 		}
 	}
 
+	// Look for the --help or --version flags.  If they are present,
+	// there should be no further completions.
+	if helpOrVersionFlagPresent(finalCmd) {
+		return finalCmd, []string{}, ShellCompDirectiveNoFileComp, nil
+	}
+
+	// We only remove the flags from the arguments if DisableFlagParsing is not set.
+	// This is important for commands which have requested to do their own flag completion.
+	if !finalCmd.DisableFlagParsing {
+		finalArgs = finalCmd.Flags().Args()
+	}
+
 	if flag != nil && flagCompletion {
 		// Check if we are completing a flag value subject to annotations
 		if validExts, present := flag.Annotations[BashCompFilenameExt]; present {
@@ -290,12 +355,19 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 		}
 	}
 
+	var completions []string
+	var directive ShellCompDirective
+
+	// Enforce flag groups before doing flag completions
+	finalCmd.enforceFlagGroupsForCompletion()
+
+	// Note that we want to perform flagname completion even if finalCmd.DisableFlagParsing==true;
+	// doing this allows for completion of persistent flag names even for commands that disable flag parsing.
+	//
 	// When doing completion of a flag name, as soon as an argument starts with
 	// a '-' we know it is a flag.  We cannot use isFlagArg() here as it requires
 	// the flag name to be complete
 	if flag == nil && len(toComplete) > 0 && toComplete[0] == '-' && !strings.Contains(toComplete, "=") && flagCompletion {
-		var completions []string
-
 		// First check for required flags
 		completions = completeRequireFlags(finalCmd, toComplete)
 
@@ -322,86 +394,86 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 			})
 		}
 
-		directive := ShellCompDirectiveNoFileComp
+		directive = ShellCompDirectiveNoFileComp
 		if len(completions) == 1 && strings.HasSuffix(completions[0], "=") {
 			// If there is a single completion, the shell usually adds a space
 			// after the completion.  We don't want that if the flag ends with an =
 			directive = ShellCompDirectiveNoSpace
 		}
-		return finalCmd, completions, directive, nil
-	}
 
-	// We only remove the flags from the arguments if DisableFlagParsing is not set.
-	// This is important for commands which have requested to do their own flag completion.
-	if !finalCmd.DisableFlagParsing {
-		finalArgs = finalCmd.Flags().Args()
-	}
-
-	var completions []string
-	directive := ShellCompDirectiveDefault
-	if flag == nil {
-		foundLocalNonPersistentFlag := false
-		// If TraverseChildren is true on the root command we don't check for
-		// local flags because we can use a local flag on a parent command
-		if !finalCmd.Root().TraverseChildren {
-			// Check if there are any local, non-persistent flags on the command-line
-			localNonPersistentFlags := finalCmd.LocalNonPersistentFlags()
-			finalCmd.NonInheritedFlags().VisitAll(func(flag *pflag.Flag) {
-				if localNonPersistentFlags.Lookup(flag.Name) != nil && flag.Changed {
-					foundLocalNonPersistentFlag = true
-				}
-			})
+		if !finalCmd.DisableFlagParsing {
+			// If DisableFlagParsing==false, we have completed the flags as known by Cobra;
+			// we can return what we found.
+			// If DisableFlagParsing==true, Cobra may not be aware of all flags, so we
+			// let the logic continue to see if ValidArgsFunction needs to be called.
+			return finalCmd, completions, directive, nil
 		}
+	} else {
+		directive = ShellCompDirectiveDefault
+		if flag == nil {
+			foundLocalNonPersistentFlag := false
+			// If TraverseChildren is true on the root command we don't check for
+			// local flags because we can use a local flag on a parent command
+			if !finalCmd.Root().TraverseChildren {
+				// Check if there are any local, non-persistent flags on the command-line
+				localNonPersistentFlags := finalCmd.LocalNonPersistentFlags()
+				finalCmd.NonInheritedFlags().VisitAll(func(flag *pflag.Flag) {
+					if localNonPersistentFlags.Lookup(flag.Name) != nil && flag.Changed {
+						foundLocalNonPersistentFlag = true
+					}
+				})
+			}
 
-		// Complete subcommand names, including the help command
-		if len(finalArgs) == 0 && !foundLocalNonPersistentFlag {
-			// We only complete sub-commands if:
-			// - there are no arguments on the command-line and
-			// - there are no local, non-persistent flags on the command-line or TraverseChildren is true
-			for _, subCmd := range finalCmd.Commands() {
-				if subCmd.IsAvailableCommand() || subCmd == finalCmd.helpCommand {
-					if strings.HasPrefix(subCmd.Name(), toComplete) {
-						completions = append(completions, fmt.Sprintf("%s\t%s", subCmd.Name(), subCmd.Short))
+			// Complete subcommand names, including the help command
+			if len(finalArgs) == 0 && !foundLocalNonPersistentFlag {
+				// We only complete sub-commands if:
+				// - there are no arguments on the command-line and
+				// - there are no local, non-persistent flags on the command-line or TraverseChildren is true
+				for _, subCmd := range finalCmd.Commands() {
+					if subCmd.IsAvailableCommand() || subCmd == finalCmd.helpCommand {
+						if strings.HasPrefix(subCmd.Name(), toComplete) {
+							completions = append(completions, fmt.Sprintf("%s\t%s", subCmd.Name(), subCmd.Short))
+						}
+						directive = ShellCompDirectiveNoFileComp
 					}
-					directive = ShellCompDirectiveNoFileComp
 				}
 			}
-		}
 
-		// Complete required flags even without the '-' prefix
-		completions = append(completions, completeRequireFlags(finalCmd, toComplete)...)
-
-		// Always complete ValidArgs, even if we are completing a subcommand name.
-		// This is for commands that have both subcommands and ValidArgs.
-		if len(finalCmd.ValidArgs) > 0 {
-			if len(finalArgs) == 0 {
-				// ValidArgs are only for the first argument
-				for _, validArg := range finalCmd.ValidArgs {
-					if strings.HasPrefix(validArg, toComplete) {
-						completions = append(completions, validArg)
+			// Complete required flags even without the '-' prefix
+			completions = append(completions, completeRequireFlags(finalCmd, toComplete)...)
+
+			// Always complete ValidArgs, even if we are completing a subcommand name.
+			// This is for commands that have both subcommands and ValidArgs.
+			if len(finalCmd.ValidArgs) > 0 {
+				if len(finalArgs) == 0 {
+					// ValidArgs are only for the first argument
+					for _, validArg := range finalCmd.ValidArgs {
+						if strings.HasPrefix(validArg, toComplete) {
+							completions = append(completions, validArg)
+						}
 					}
-				}
-				directive = ShellCompDirectiveNoFileComp
-
-				// If no completions were found within commands or ValidArgs,
-				// see if there are any ArgAliases that should be completed.
-				if len(completions) == 0 {
-					for _, argAlias := range finalCmd.ArgAliases {
-						if strings.HasPrefix(argAlias, toComplete) {
-							completions = append(completions, argAlias)
+					directive = ShellCompDirectiveNoFileComp
+
+					// If no completions were found within commands or ValidArgs,
+					// see if there are any ArgAliases that should be completed.
+					if len(completions) == 0 {
+						for _, argAlias := range finalCmd.ArgAliases {
+							if strings.HasPrefix(argAlias, toComplete) {
+								completions = append(completions, argAlias)
+							}
 						}
 					}
 				}
+
+				// If there are ValidArgs specified (even if they don't match), we stop completion.
+				// Only one of ValidArgs or ValidArgsFunction can be used for a single command.
+				return finalCmd, completions, directive, nil
 			}
 
-			// If there are ValidArgs specified (even if they don't match), we stop completion.
-			// Only one of ValidArgs or ValidArgsFunction can be used for a single command.
-			return finalCmd, completions, directive, nil
+			// Let the logic continue so as to add any ValidArgsFunction completions,
+			// even if we already found sub-commands.
+			// This is for commands that have subcommands but also specify a ValidArgsFunction.
 		}
-
-		// Let the logic continue so as to add any ValidArgsFunction completions,
-		// even if we already found sub-commands.
-		// This is for commands that have subcommands but also specify a ValidArgsFunction.
 	}
 
 	// Find the completion function for the flag or command
@@ -424,6 +496,18 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 	return finalCmd, completions, directive, nil
 }
 
+func helpOrVersionFlagPresent(cmd *Command) bool {
+	if versionFlag := cmd.Flags().Lookup("version"); versionFlag != nil &&
+		len(versionFlag.Annotations[FlagSetByCobraAnnotation]) > 0 && versionFlag.Changed {
+		return true
+	}
+	if helpFlag := cmd.Flags().Lookup("help"); helpFlag != nil &&
+		len(helpFlag.Annotations[FlagSetByCobraAnnotation]) > 0 && helpFlag.Changed {
+		return true
+	}
+	return false
+}
+
 func getFlagNameCompletions(flag *pflag.Flag, toComplete string) []string {
 	if nonCompletableFlag(flag) {
 		return []string{}
@@ -568,12 +652,12 @@ func checkIfFlagCompletion(finalCmd *Command, args []string, lastArg string) (*p
 	return flag, trimmedArgs, lastArg, nil
 }
 
-// initDefaultCompletionCmd adds a default 'completion' command to c.
+// InitDefaultCompletionCmd adds a default 'completion' command to c.
 // This function will do nothing if any of the following is true:
 // 1- the feature has been explicitly disabled by the program,
 // 2- c has no subcommands (to avoid creating one),
 // 3- c already has a 'completion' command provided by the program.
-func (c *Command) initDefaultCompletionCmd() {
+func (c *Command) InitDefaultCompletionCmd() {
 	if c.CompletionOptions.DisableDefaultCmd || !c.HasSubCommands() {
 		return
 	}
@@ -589,39 +673,44 @@ func (c *Command) initDefaultCompletionCmd() {
 
 	completionCmd := &Command{
 		Use:   compCmdName,
-		Short: "generate the autocompletion script for the specified shell",
-		Long: fmt.Sprintf(`
-Generate the autocompletion script for %[1]s for the specified shell.
+		Short: "Generate the autocompletion script for the specified shell",
+		Long: fmt.Sprintf(`Generate the autocompletion script for %[1]s for the specified shell.
 See each sub-command's help for details on how to use the generated script.
 `, c.Root().Name()),
 		Args:              NoArgs,
 		ValidArgsFunction: NoFileCompletions,
+		Hidden:            c.CompletionOptions.HiddenDefaultCmd,
+		GroupID:           c.completionCommandGroupID,
 	}
 	c.AddCommand(completionCmd)
 
 	out := c.OutOrStdout()
 	noDesc := c.CompletionOptions.DisableDescriptions
-	shortDesc := "generate the autocompletion script for %s"
+	shortDesc := "Generate the autocompletion script for %s"
 	bash := &Command{
 		Use:   "bash",
 		Short: fmt.Sprintf(shortDesc, "bash"),
-		Long: fmt.Sprintf(`
-Generate the autocompletion script for the bash shell.
+		Long: fmt.Sprintf(`Generate the autocompletion script for the bash shell.
 
 This script depends on the 'bash-completion' package.
 If it is not installed already, you can install it via your OS's package manager.
 
 To load completions in your current shell session:
-$ source <(%[1]s completion bash)
+
+	source <(%[1]s completion bash)
 
 To load completions for every new session, execute once:
-Linux:
-  $ %[1]s completion bash > /etc/bash_completion.d/%[1]s
-MacOS:
-  $ %[1]s completion bash > /usr/local/etc/bash_completion.d/%[1]s
+
+#### Linux:
+
+	%[1]s completion bash > /etc/bash_completion.d/%[1]s
+
+#### macOS:
+
+	%[1]s completion bash > $(brew --prefix)/etc/bash_completion.d/%[1]s
 
 You will need to start a new shell for this setup to take effect.
-  `, c.Root().Name()),
+`, c.Root().Name()),
 		Args:                  NoArgs,
 		DisableFlagsInUseLine: true,
 		ValidArgsFunction:     NoFileCompletions,
@@ -636,19 +725,26 @@ You will need to start a new shell for this setup to take effect.
 	zsh := &Command{
 		Use:   "zsh",
 		Short: fmt.Sprintf(shortDesc, "zsh"),
-		Long: fmt.Sprintf(`
-Generate the autocompletion script for the zsh shell.
+		Long: fmt.Sprintf(`Generate the autocompletion script for the zsh shell.
 
 If shell completion is not already enabled in your environment you will need
 to enable it.  You can execute the following once:
 
-$ echo "autoload -U compinit; compinit" >> ~/.zshrc
+	echo "autoload -U compinit; compinit" >> ~/.zshrc
+
+To load completions in your current shell session:
+
+	source <(%[1]s completion zsh)
 
 To load completions for every new session, execute once:
-# Linux:
-$ %[1]s completion zsh > "${fpath[1]}/_%[1]s"
-# macOS:
-$ %[1]s completion zsh > /usr/local/share/zsh/site-functions/_%[1]s
+
+#### Linux:
+
+	%[1]s completion zsh > "${fpath[1]}/_%[1]s"
+
+#### macOS:
+
+	%[1]s completion zsh > $(brew --prefix)/share/zsh/site-functions/_%[1]s
 
 You will need to start a new shell for this setup to take effect.
 `, c.Root().Name()),
@@ -668,14 +764,15 @@ You will need to start a new shell for this setup to take effect.
 	fish := &Command{
 		Use:   "fish",
 		Short: fmt.Sprintf(shortDesc, "fish"),
-		Long: fmt.Sprintf(`
-Generate the autocompletion script for the fish shell.
+		Long: fmt.Sprintf(`Generate the autocompletion script for the fish shell.
 
 To load completions in your current shell session:
-$ %[1]s completion fish | source
+
+	%[1]s completion fish | source
 
 To load completions for every new session, execute once:
-$ %[1]s completion fish > ~/.config/fish/completions/%[1]s.fish
+
+	%[1]s completion fish > ~/.config/fish/completions/%[1]s.fish
 
 You will need to start a new shell for this setup to take effect.
 `, c.Root().Name()),
@@ -692,11 +789,11 @@ You will need to start a new shell for this setup to take effect.
 	powershell := &Command{
 		Use:   "powershell",
 		Short: fmt.Sprintf(shortDesc, "powershell"),
-		Long: fmt.Sprintf(`
-Generate the autocompletion script for powershell.
+		Long: fmt.Sprintf(`Generate the autocompletion script for powershell.
 
 To load completions in your current shell session:
-PS C:\> %[1]s completion powershell | Out-String | Invoke-Expression
+
+	%[1]s completion powershell | Out-String | Invoke-Expression
 
 To load completions for every new session, add the output of the above command
 to your powershell profile.
diff --git a/vendor/github.com/spf13/cobra/doc/README.md b/vendor/github.com/spf13/cobra/doc/README.md
index 6ea4eb6623..8e07baae33 100644
--- a/vendor/github.com/spf13/cobra/doc/README.md
+++ b/vendor/github.com/spf13/cobra/doc/README.md
@@ -7,6 +7,11 @@
 
 ## Options
 ### `DisableAutoGenTag`
+
 You may set `cmd.DisableAutoGenTag = true`
 to _entirely_ remove the auto generated string "Auto generated by spf13/cobra..."
 from any documentation source.
+
+### `InitDefaultCompletionCmd`
+
+You may call `cmd.InitDefaultCompletionCmd()` to document the default autocompletion command.
diff --git a/vendor/github.com/spf13/cobra/doc/man_docs.go b/vendor/github.com/spf13/cobra/doc/man_docs.go
index 916e36144d..b8c15ce885 100644
--- a/vendor/github.com/spf13/cobra/doc/man_docs.go
+++ b/vendor/github.com/spf13/cobra/doc/man_docs.go
@@ -1,9 +1,10 @@
-// Copyright 2015 Red Hat Inc. All rights reserved.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -66,7 +67,7 @@ func GenManTreeFromOpts(cmd *cobra.Command, opts GenManTreeOptions) error {
 	if opts.CommandSeparator != "" {
 		separator = opts.CommandSeparator
 	}
-	basename := strings.Replace(cmd.CommandPath(), " ", separator, -1)
+	basename := strings.ReplaceAll(cmd.CommandPath(), " ", separator)
 	filename := filepath.Join(opts.Path, basename+"."+section)
 	f, err := os.Create(filename)
 	if err != nil {
@@ -116,7 +117,7 @@ func GenMan(cmd *cobra.Command, header *GenManHeader, w io.Writer) error {
 
 func fillHeader(header *GenManHeader, name string, disableAutoGen bool) error {
 	if header.Title == "" {
-		header.Title = strings.ToUpper(strings.Replace(name, " ", "\\-", -1))
+		header.Title = strings.ToUpper(strings.ReplaceAll(name, " ", "\\-"))
 	}
 	if header.Section == "" {
 		header.Section = "1"
@@ -203,7 +204,7 @@ func genMan(cmd *cobra.Command, header *GenManHeader) []byte {
 	cmd.InitDefaultHelpFlag()
 
 	// something like `rootcmd-subcmd1-subcmd2`
-	dashCommandName := strings.Replace(cmd.CommandPath(), " ", "-", -1)
+	dashCommandName := strings.ReplaceAll(cmd.CommandPath(), " ", "-")
 
 	buf := new(bytes.Buffer)
 
@@ -218,7 +219,7 @@ func genMan(cmd *cobra.Command, header *GenManHeader) []byte {
 		seealsos := make([]string, 0)
 		if cmd.HasParent() {
 			parentPath := cmd.Parent().CommandPath()
-			dashParentPath := strings.Replace(parentPath, " ", "-", -1)
+			dashParentPath := strings.ReplaceAll(parentPath, " ", "-")
 			seealso := fmt.Sprintf("**%s(%s)**", dashParentPath, header.Section)
 			seealsos = append(seealsos, seealso)
 			cmd.VisitParents(func(c *cobra.Command) {
diff --git a/vendor/github.com/spf13/cobra/doc/md_docs.go b/vendor/github.com/spf13/cobra/doc/md_docs.go
index 5181af8dc2..c4a27c0093 100644
--- a/vendor/github.com/spf13/cobra/doc/md_docs.go
+++ b/vendor/github.com/spf13/cobra/doc/md_docs.go
@@ -1,9 +1,10 @@
-//Copyright 2015 Red Hat Inc. All rights reserved.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -83,7 +84,7 @@ func GenMarkdownCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string)
 			parent := cmd.Parent()
 			pname := parent.CommandPath()
 			link := pname + ".md"
-			link = strings.Replace(link, " ", "_", -1)
+			link = strings.ReplaceAll(link, " ", "_")
 			buf.WriteString(fmt.Sprintf("* [%s](%s)\t - %s\n", pname, linkHandler(link), parent.Short))
 			cmd.VisitParents(func(c *cobra.Command) {
 				if c.DisableAutoGenTag {
@@ -101,7 +102,7 @@ func GenMarkdownCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string)
 			}
 			cname := name + " " + child.Name()
 			link := cname + ".md"
-			link = strings.Replace(link, " ", "_", -1)
+			link = strings.ReplaceAll(link, " ", "_")
 			buf.WriteString(fmt.Sprintf("* [%s](%s)\t - %s\n", cname, linkHandler(link), child.Short))
 		}
 		buf.WriteString("\n")
@@ -137,7 +138,7 @@ func GenMarkdownTreeCustom(cmd *cobra.Command, dir string, filePrepender, linkHa
 		}
 	}
 
-	basename := strings.Replace(cmd.CommandPath(), " ", "_", -1) + ".md"
+	basename := strings.ReplaceAll(cmd.CommandPath(), " ", "_") + ".md"
 	filename := filepath.Join(dir, basename)
 	f, err := os.Create(filename)
 	if err != nil {
diff --git a/vendor/github.com/spf13/cobra/doc/md_docs.md b/vendor/github.com/spf13/cobra/doc/md_docs.md
index 5c870625f7..1659175cfd 100644
--- a/vendor/github.com/spf13/cobra/doc/md_docs.md
+++ b/vendor/github.com/spf13/cobra/doc/md_docs.md
@@ -85,7 +85,7 @@ func GenMarkdownCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string)
 }
 ```
 
-The `filePrepender` will prepend the return value given the full filepath to the rendered Markdown file. A common use case is to add front matter to use the generated documentation with [Hugo](http://gohugo.io/):
+The `filePrepender` will prepend the return value given the full filepath to the rendered Markdown file. A common use case is to add front matter to use the generated documentation with [Hugo](https://gohugo.io/):
 
 ```go
 const fmTemplate = `---
diff --git a/vendor/github.com/spf13/cobra/doc/rest_docs.go b/vendor/github.com/spf13/cobra/doc/rest_docs.go
index 051d8dc832..2cca6fd778 100644
--- a/vendor/github.com/spf13/cobra/doc/rest_docs.go
+++ b/vendor/github.com/spf13/cobra/doc/rest_docs.go
@@ -1,9 +1,10 @@
-//Copyright 2015 Red Hat Inc. All rights reserved.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -47,7 +48,7 @@ func printOptionsReST(buf *bytes.Buffer, cmd *cobra.Command, name string) error
 	return nil
 }
 
-// linkHandler for default ReST hyperlink markup
+// defaultLinkHandler for default ReST hyperlink markup
 func defaultLinkHandler(name, ref string) string {
 	return fmt.Sprintf("`%s <%s.rst>`_", name, ref)
 }
@@ -70,7 +71,7 @@ func GenReSTCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string, str
 	if len(long) == 0 {
 		long = short
 	}
-	ref := strings.Replace(name, " ", "_", -1)
+	ref := strings.ReplaceAll(name, " ", "_")
 
 	buf.WriteString(".. _" + ref + ":\n\n")
 	buf.WriteString(name + "\n")
@@ -99,7 +100,7 @@ func GenReSTCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string, str
 		if cmd.HasParent() {
 			parent := cmd.Parent()
 			pname := parent.CommandPath()
-			ref = strings.Replace(pname, " ", "_", -1)
+			ref = strings.ReplaceAll(pname, " ", "_")
 			buf.WriteString(fmt.Sprintf("* %s \t - %s\n", linkHandler(pname, ref), parent.Short))
 			cmd.VisitParents(func(c *cobra.Command) {
 				if c.DisableAutoGenTag {
@@ -116,7 +117,7 @@ func GenReSTCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string, str
 				continue
 			}
 			cname := name + " " + child.Name()
-			ref = strings.Replace(cname, " ", "_", -1)
+			ref = strings.ReplaceAll(cname, " ", "_")
 			buf.WriteString(fmt.Sprintf("* %s \t - %s\n", linkHandler(cname, ref), child.Short))
 		}
 		buf.WriteString("\n")
@@ -151,7 +152,7 @@ func GenReSTTreeCustom(cmd *cobra.Command, dir string, filePrepender func(string
 		}
 	}
 
-	basename := strings.Replace(cmd.CommandPath(), " ", "_", -1) + ".rst"
+	basename := strings.ReplaceAll(cmd.CommandPath(), " ", "_") + ".rst"
 	filename := filepath.Join(dir, basename)
 	f, err := os.Create(filename)
 	if err != nil {
@@ -168,7 +169,7 @@ func GenReSTTreeCustom(cmd *cobra.Command, dir string, filePrepender func(string
 	return nil
 }
 
-// adapted from: https://github.com/kr/text/blob/main/indent.go
+// indentString adapted from: https://github.com/kr/text/blob/main/indent.go
 func indentString(s, p string) string {
 	var res []byte
 	b := []byte(s)
diff --git a/vendor/github.com/spf13/cobra/doc/rest_docs.md b/vendor/github.com/spf13/cobra/doc/rest_docs.md
index 6098430eff..3041c573ab 100644
--- a/vendor/github.com/spf13/cobra/doc/rest_docs.md
+++ b/vendor/github.com/spf13/cobra/doc/rest_docs.md
@@ -85,7 +85,7 @@ func GenReSTCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string, str
 }
 ```
 
-The `filePrepender` will prepend the return value given the full filepath to the rendered ReST file. A common use case is to add front matter to use the generated documentation with [Hugo](http://gohugo.io/):
+The `filePrepender` will prepend the return value given the full filepath to the rendered ReST file. A common use case is to add front matter to use the generated documentation with [Hugo](https://gohugo.io/):
 
 ```go
 const fmTemplate = `---
diff --git a/vendor/github.com/spf13/cobra/doc/util.go b/vendor/github.com/spf13/cobra/doc/util.go
index bffde94d50..0aaa07a166 100644
--- a/vendor/github.com/spf13/cobra/doc/util.go
+++ b/vendor/github.com/spf13/cobra/doc/util.go
@@ -1,9 +1,10 @@
-// Copyright 2015 Red Hat Inc. All rights reserved.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/vendor/github.com/spf13/cobra/doc/yaml_docs.go b/vendor/github.com/spf13/cobra/doc/yaml_docs.go
index 96e6ad721e..2b26d6ec0f 100644
--- a/vendor/github.com/spf13/cobra/doc/yaml_docs.go
+++ b/vendor/github.com/spf13/cobra/doc/yaml_docs.go
@@ -1,9 +1,10 @@
-// Copyright 2016 French Ben. All rights reserved.
+// Copyright 2013-2023 The Cobra Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// http://www.apache.org/licenses/LICENSE-2.0
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,7 +24,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
-	"gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
 )
 
 type cmdOption struct {
@@ -66,7 +67,7 @@ func GenYamlTreeCustom(cmd *cobra.Command, dir string, filePrepender, linkHandle
 		}
 	}
 
-	basename := strings.Replace(cmd.CommandPath(), " ", "_", -1) + ".yaml"
+	basename := strings.ReplaceAll(cmd.CommandPath(), " ", "_") + ".yaml"
 	filename := filepath.Join(dir, basename)
 	f, err := os.Create(filename)
 	if err != nil {
@@ -128,7 +129,7 @@ func GenYamlCustom(cmd *cobra.Command, w io.Writer, linkHandler func(string) str
 			if !child.IsAvailableCommand() || child.IsAdditionalHelpTopicCommand() {
 				continue
 			}
-			result = append(result, child.Name()+" - "+child.Short)
+			result = append(result, child.CommandPath()+" - "+child.Short)
 		}
 		yamlDoc.SeeAlso = result
 	}
diff --git a/vendor/github.com/spf13/cobra/doc/yaml_docs.md b/vendor/github.com/spf13/cobra/doc/yaml_docs.md
index 1a9b7c6a3c..172e61d121 100644
--- a/vendor/github.com/spf13/cobra/doc/yaml_docs.md
+++ b/vendor/github.com/spf13/cobra/doc/yaml_docs.md
@@ -82,7 +82,7 @@ func GenYamlCustom(cmd *Command, out *bytes.Buffer, linkHandler func(string) str
 }
 ```
 
-The `filePrepender` will prepend the return value given the full filepath to the rendered Yaml file. A common use case is to add front matter to use the generated documentation with [Hugo](http://gohugo.io/):
+The `filePrepender` will prepend the return value given the full filepath to the rendered Yaml file. A common use case is to add front matter to use the generated documentation with [Hugo](https://gohugo.io/):
 
 ```go
 const fmTemplate = `---
diff --git a/vendor/github.com/spf13/cobra/fish_completions.go b/vendor/github.com/spf13/cobra/fish_completions.go
index bb57fd5685..12ca0d2b11 100644
--- a/vendor/github.com/spf13/cobra/fish_completions.go
+++ b/vendor/github.com/spf13/cobra/fish_completions.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
@@ -11,8 +25,8 @@ import (
 func genFishComp(buf io.StringWriter, name string, includeDesc bool) {
 	// Variables should not contain a '-' or ':' character
 	nameForVar := name
-	nameForVar = strings.Replace(nameForVar, "-", "_", -1)
-	nameForVar = strings.Replace(nameForVar, ":", "_", -1)
+	nameForVar = strings.ReplaceAll(nameForVar, "-", "_")
+	nameForVar = strings.ReplaceAll(nameForVar, ":", "_")
 
 	compCmd := ShellCompRequestCmd
 	if !includeDesc {
@@ -38,7 +52,8 @@ function __%[1]s_perform_completion
     __%[1]s_debug "args: $args"
     __%[1]s_debug "last arg: $lastArg"
 
-    set -l requestComp "$args[1] %[3]s $args[2..-1] $lastArg"
+    # Disable ActiveHelp which is not supported for fish shell
+    set -l requestComp "%[10]s=0 $args[1] %[3]s $args[2..-1] $lastArg"
 
     __%[1]s_debug "Calling $requestComp"
     set -l results (eval $requestComp 2> /dev/null)
@@ -74,6 +89,60 @@ function __%[1]s_perform_completion
     printf "%%s\n" "$directiveLine"
 end
 
+# this function limits calls to __%[1]s_perform_completion, by caching the result behind $__%[1]s_perform_completion_once_result
+function __%[1]s_perform_completion_once
+    __%[1]s_debug "Starting __%[1]s_perform_completion_once"
+
+    if test -n "$__%[1]s_perform_completion_once_result"
+        __%[1]s_debug "Seems like a valid result already exists, skipping __%[1]s_perform_completion"
+        return 0
+    end
+
+    set --global __%[1]s_perform_completion_once_result (__%[1]s_perform_completion)
+    if test -z "$__%[1]s_perform_completion_once_result"
+        __%[1]s_debug "No completions, probably due to a failure"
+        return 1
+    end
+
+    __%[1]s_debug "Performed completions and set __%[1]s_perform_completion_once_result"
+    return 0
+end
+
+# this function is used to clear the $__%[1]s_perform_completion_once_result variable after completions are run
+function __%[1]s_clear_perform_completion_once_result
+    __%[1]s_debug ""
+    __%[1]s_debug "========= clearing previously set __%[1]s_perform_completion_once_result variable =========="
+    set --erase __%[1]s_perform_completion_once_result
+    __%[1]s_debug "Succesfully erased the variable __%[1]s_perform_completion_once_result"
+end
+
+function __%[1]s_requires_order_preservation
+    __%[1]s_debug ""
+    __%[1]s_debug "========= checking if order preservation is required =========="
+
+    __%[1]s_perform_completion_once
+    if test -z "$__%[1]s_perform_completion_once_result"
+        __%[1]s_debug "Error determining if order preservation is required"
+        return 1
+    end
+
+    set -l directive (string sub --start 2 $__%[1]s_perform_completion_once_result[-1])
+    __%[1]s_debug "Directive is: $directive"
+
+    set -l shellCompDirectiveKeepOrder %[9]d
+    set -l keeporder (math (math --scale 0 $directive / $shellCompDirectiveKeepOrder) %% 2)
+    __%[1]s_debug "Keeporder is: $keeporder"
+
+    if test $keeporder -ne 0
+        __%[1]s_debug "This does require order preservation"
+        return 0
+    end
+
+    __%[1]s_debug "This doesn't require order preservation"
+    return 1
+end
+
+
 # This function does two things:
 # - Obtain the completions and store them in the global __%[1]s_comp_results
 # - Return false if file completion should be performed
@@ -84,17 +153,17 @@ function __%[1]s_prepare_completions
     # Start fresh
     set --erase __%[1]s_comp_results
 
-    set -l results (__%[1]s_perform_completion)
-    __%[1]s_debug "Completion results: $results"
+    __%[1]s_perform_completion_once
+    __%[1]s_debug "Completion results: $__%[1]s_perform_completion_once_result"
 
-    if test -z "$results"
+    if test -z "$__%[1]s_perform_completion_once_result"
         __%[1]s_debug "No completion, probably due to a failure"
         # Might as well do file completion, in case it helps
         return 1
     end
 
-    set -l directive (string sub --start 2 $results[-1])
-    set --global __%[1]s_comp_results $results[1..-2]
+    set -l directive (string sub --start 2 $__%[1]s_perform_completion_once_result[-1])
+    set --global __%[1]s_comp_results $__%[1]s_perform_completion_once_result[1..-2]
 
     __%[1]s_debug "Completions are: $__%[1]s_comp_results"
     __%[1]s_debug "Directive is: $directive"
@@ -190,13 +259,17 @@ end
 # Remove any pre-existing completions for the program since we will be handling all of them.
 complete -c %[2]s -e
 
+# this will get called after the two calls below and clear the $__%[1]s_perform_completion_once_result global
+complete -c %[2]s -n '__%[1]s_clear_perform_completion_once_result'
 # The call to __%[1]s_prepare_completions will setup __%[1]s_comp_results
 # which provides the program's completion choices.
-complete -c %[2]s -n '__%[1]s_prepare_completions' -f -a '$__%[1]s_comp_results'
-
+# If this doesn't require order preservation, we don't use the -k flag
+complete -c %[2]s -n 'not __%[1]s_requires_order_preservation && __%[1]s_prepare_completions' -f -a '$__%[1]s_comp_results'
+# otherwise we use the -k flag
+complete -k -c %[2]s -n '__%[1]s_requires_order_preservation && __%[1]s_prepare_completions' -f -a '$__%[1]s_comp_results'
 `, nameForVar, name, compCmd,
 		ShellCompDirectiveError, ShellCompDirectiveNoSpace, ShellCompDirectiveNoFileComp,
-		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs))
+		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs, ShellCompDirectiveKeepOrder, activeHelpEnvVar(name)))
 }
 
 // GenFishCompletion generates fish completion file and writes to the passed writer.
diff --git a/vendor/github.com/spf13/cobra/flag_groups.go b/vendor/github.com/spf13/cobra/flag_groups.go
new file mode 100644
index 0000000000..b35fde1554
--- /dev/null
+++ b/vendor/github.com/spf13/cobra/flag_groups.go
@@ -0,0 +1,224 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cobra
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	flag "github.com/spf13/pflag"
+)
+
+const (
+	requiredAsGroup   = "cobra_annotation_required_if_others_set"
+	mutuallyExclusive = "cobra_annotation_mutually_exclusive"
+)
+
+// MarkFlagsRequiredTogether marks the given flags with annotations so that Cobra errors
+// if the command is invoked with a subset (but not all) of the given flags.
+func (c *Command) MarkFlagsRequiredTogether(flagNames ...string) {
+	c.mergePersistentFlags()
+	for _, v := range flagNames {
+		f := c.Flags().Lookup(v)
+		if f == nil {
+			panic(fmt.Sprintf("Failed to find flag %q and mark it as being required in a flag group", v))
+		}
+		if err := c.Flags().SetAnnotation(v, requiredAsGroup, append(f.Annotations[requiredAsGroup], strings.Join(flagNames, " "))); err != nil {
+			// Only errs if the flag isn't found.
+			panic(err)
+		}
+	}
+}
+
+// MarkFlagsMutuallyExclusive marks the given flags with annotations so that Cobra errors
+// if the command is invoked with more than one flag from the given set of flags.
+func (c *Command) MarkFlagsMutuallyExclusive(flagNames ...string) {
+	c.mergePersistentFlags()
+	for _, v := range flagNames {
+		f := c.Flags().Lookup(v)
+		if f == nil {
+			panic(fmt.Sprintf("Failed to find flag %q and mark it as being in a mutually exclusive flag group", v))
+		}
+		// Each time this is called is a single new entry; this allows it to be a member of multiple groups if needed.
+		if err := c.Flags().SetAnnotation(v, mutuallyExclusive, append(f.Annotations[mutuallyExclusive], strings.Join(flagNames, " "))); err != nil {
+			panic(err)
+		}
+	}
+}
+
+// ValidateFlagGroups validates the mutuallyExclusive/requiredAsGroup logic and returns the
+// first error encountered.
+func (c *Command) ValidateFlagGroups() error {
+	if c.DisableFlagParsing {
+		return nil
+	}
+
+	flags := c.Flags()
+
+	// groupStatus format is the list of flags as a unique ID,
+	// then a map of each flag name and whether it is set or not.
+	groupStatus := map[string]map[string]bool{}
+	mutuallyExclusiveGroupStatus := map[string]map[string]bool{}
+	flags.VisitAll(func(pflag *flag.Flag) {
+		processFlagForGroupAnnotation(flags, pflag, requiredAsGroup, groupStatus)
+		processFlagForGroupAnnotation(flags, pflag, mutuallyExclusive, mutuallyExclusiveGroupStatus)
+	})
+
+	if err := validateRequiredFlagGroups(groupStatus); err != nil {
+		return err
+	}
+	if err := validateExclusiveFlagGroups(mutuallyExclusiveGroupStatus); err != nil {
+		return err
+	}
+	return nil
+}
+
+func hasAllFlags(fs *flag.FlagSet, flagnames ...string) bool {
+	for _, fname := range flagnames {
+		f := fs.Lookup(fname)
+		if f == nil {
+			return false
+		}
+	}
+	return true
+}
+
+func processFlagForGroupAnnotation(flags *flag.FlagSet, pflag *flag.Flag, annotation string, groupStatus map[string]map[string]bool) {
+	groupInfo, found := pflag.Annotations[annotation]
+	if found {
+		for _, group := range groupInfo {
+			if groupStatus[group] == nil {
+				flagnames := strings.Split(group, " ")
+
+				// Only consider this flag group at all if all the flags are defined.
+				if !hasAllFlags(flags, flagnames...) {
+					continue
+				}
+
+				groupStatus[group] = map[string]bool{}
+				for _, name := range flagnames {
+					groupStatus[group][name] = false
+				}
+			}
+
+			groupStatus[group][pflag.Name] = pflag.Changed
+		}
+	}
+}
+
+func validateRequiredFlagGroups(data map[string]map[string]bool) error {
+	keys := sortedKeys(data)
+	for _, flagList := range keys {
+		flagnameAndStatus := data[flagList]
+
+		unset := []string{}
+		for flagname, isSet := range flagnameAndStatus {
+			if !isSet {
+				unset = append(unset, flagname)
+			}
+		}
+		if len(unset) == len(flagnameAndStatus) || len(unset) == 0 {
+			continue
+		}
+
+		// Sort values, so they can be tested/scripted against consistently.
+		sort.Strings(unset)
+		return fmt.Errorf("if any flags in the group [%v] are set they must all be set; missing %v", flagList, unset)
+	}
+
+	return nil
+}
+
+func validateExclusiveFlagGroups(data map[string]map[string]bool) error {
+	keys := sortedKeys(data)
+	for _, flagList := range keys {
+		flagnameAndStatus := data[flagList]
+		var set []string
+		for flagname, isSet := range flagnameAndStatus {
+			if isSet {
+				set = append(set, flagname)
+			}
+		}
+		if len(set) == 0 || len(set) == 1 {
+			continue
+		}
+
+		// Sort values, so they can be tested/scripted against consistently.
+		sort.Strings(set)
+		return fmt.Errorf("if any flags in the group [%v] are set none of the others can be; %v were all set", flagList, set)
+	}
+	return nil
+}
+
+func sortedKeys(m map[string]map[string]bool) []string {
+	keys := make([]string, len(m))
+	i := 0
+	for k := range m {
+		keys[i] = k
+		i++
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// enforceFlagGroupsForCompletion will do the following:
+// - when a flag in a group is present, other flags in the group will be marked required
+// - when a flag in a mutually exclusive group is present, other flags in the group will be marked as hidden
+// This allows the standard completion logic to behave appropriately for flag groups
+func (c *Command) enforceFlagGroupsForCompletion() {
+	if c.DisableFlagParsing {
+		return
+	}
+
+	flags := c.Flags()
+	groupStatus := map[string]map[string]bool{}
+	mutuallyExclusiveGroupStatus := map[string]map[string]bool{}
+	c.Flags().VisitAll(func(pflag *flag.Flag) {
+		processFlagForGroupAnnotation(flags, pflag, requiredAsGroup, groupStatus)
+		processFlagForGroupAnnotation(flags, pflag, mutuallyExclusive, mutuallyExclusiveGroupStatus)
+	})
+
+	// If a flag that is part of a group is present, we make all the other flags
+	// of that group required so that the shell completion suggests them automatically
+	for flagList, flagnameAndStatus := range groupStatus {
+		for _, isSet := range flagnameAndStatus {
+			if isSet {
+				// One of the flags of the group is set, mark the other ones as required
+				for _, fName := range strings.Split(flagList, " ") {
+					_ = c.MarkFlagRequired(fName)
+				}
+			}
+		}
+	}
+
+	// If a flag that is mutually exclusive to others is present, we hide the other
+	// flags of that group so the shell completion does not suggest them
+	for flagList, flagnameAndStatus := range mutuallyExclusiveGroupStatus {
+		for flagName, isSet := range flagnameAndStatus {
+			if isSet {
+				// One of the flags of the mutually exclusive group is set, mark the other ones as hidden
+				// Don't mark the flag that is already set as hidden because it may be an
+				// array or slice flag and therefore must continue being suggested
+				for _, fName := range strings.Split(flagList, " ") {
+					if fName != flagName {
+						flag := c.Flags().Lookup(fName)
+						flag.Hidden = true
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/vendor/github.com/spf13/cobra/go.mod b/vendor/github.com/spf13/cobra/go.mod
deleted file mode 100644
index 1fb9439dd8..0000000000
--- a/vendor/github.com/spf13/cobra/go.mod
+++ /dev/null
@@ -1,11 +0,0 @@
-module github.com/spf13/cobra
-
-go 1.14
-
-require (
-	github.com/cpuguy83/go-md2man/v2 v2.0.0
-	github.com/inconshreveable/mousetrap v1.0.0
-	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.8.1
-	gopkg.in/yaml.v2 v2.4.0
-)
diff --git a/vendor/github.com/spf13/cobra/go.sum b/vendor/github.com/spf13/cobra/go.sum
deleted file mode 100644
index 3e22df29a3..0000000000
--- a/vendor/github.com/spf13/cobra/go.sum
+++ /dev/null
@@ -1,592 +0,0 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.0 h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng4PGlyM=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
-github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
-github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
-github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
-github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/magiconair/properties v1.8.5 h1:b6kJs+EmPFMYGkow9GiUyCyOvIwYetYJ3fSaWak/Gls=
-github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
-github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
-github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.4.1 h1:CpVNEelQCZBooIPDn+AR3NpivK/TIKU8bDxdASFVQag=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pelletier/go-toml v1.9.3 h1:zeC5b1GviRUyKYd6OJPvBU/mcVDVoL1OhT17FCt5dSQ=
-github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/spf13/afero v1.6.0 h1:xoax2sJ2DT8S8xA2paPFjDCScCNeWsg75VG0DLRreiY=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
-github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.8.1 h1:Kq1fyeebqsBfbjZj4EL7gj2IO0mMaiyjYUWcUsl2O44=
-github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
-github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
-go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5 h1:i6eZZ+zk0SOf0xgBpEpPD18qWcJda6q1sxt3S0kzyUQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.44.0/go.mod h1:EBOGZqzyhtvMDoxwS97ctnh0zUmYY6CxqXsc1AvkYD8=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/ini.v1 v1.62.0 h1:duBzk771uxoUuOlyRLkHsygud9+5lrlGjdFBb4mSKDU=
-gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/vendor/github.com/spf13/cobra/powershell_completions.go b/vendor/github.com/spf13/cobra/powershell_completions.go
index 59234c09f1..177d2755f2 100644
--- a/vendor/github.com/spf13/cobra/powershell_completions.go
+++ b/vendor/github.com/spf13/cobra/powershell_completions.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // The generated scripts require PowerShell v5.0+ (which comes Windows 10, but
 // can be downloaded separately for windows 7 or 8.1).
 
@@ -8,9 +22,15 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strings"
 )
 
 func genPowerShellComp(buf io.StringWriter, name string, includeDesc bool) {
+	// Variables should not contain a '-' or ':' character
+	nameForVar := name
+	nameForVar = strings.Replace(nameForVar, "-", "_", -1)
+	nameForVar = strings.Replace(nameForVar, ":", "_", -1)
+
 	compCmd := ShellCompRequestCmd
 	if !includeDesc {
 		compCmd = ShellCompNoDescRequestCmd
@@ -27,7 +47,7 @@ filter __%[1]s_escapeStringWithSpecialChars {
 `+"    $_ -replace '\\s|#|@|\\$|;|,|''|\\{|\\}|\\(|\\)|\"|`|\\||<|>|&','`$&'"+`
 }
 
-Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock {
+[scriptblock]$__%[2]sCompleterBlock = {
     param(
             $WordToComplete,
             $CommandAst,
@@ -50,18 +70,20 @@ Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock {
     if ($Command.Length -gt $CursorPosition) {
         $Command=$Command.Substring(0,$CursorPosition)
     }
-	__%[1]s_debug "Truncated command: $Command"
+    __%[1]s_debug "Truncated command: $Command"
 
-    $ShellCompDirectiveError=%[3]d
-    $ShellCompDirectiveNoSpace=%[4]d
-    $ShellCompDirectiveNoFileComp=%[5]d
-    $ShellCompDirectiveFilterFileExt=%[6]d
-    $ShellCompDirectiveFilterDirs=%[7]d
+    $ShellCompDirectiveError=%[4]d
+    $ShellCompDirectiveNoSpace=%[5]d
+    $ShellCompDirectiveNoFileComp=%[6]d
+    $ShellCompDirectiveFilterFileExt=%[7]d
+    $ShellCompDirectiveFilterDirs=%[8]d
+    $ShellCompDirectiveKeepOrder=%[9]d
 
-	# Prepare the command to request completions for the program.
+    # Prepare the command to request completions for the program.
     # Split the command at the first space to separate the program and arguments.
     $Program,$Arguments = $Command.Split(" ",2)
-    $RequestComp="$Program %[2]s $Arguments"
+
+    $RequestComp="$Program %[3]s $Arguments"
     __%[1]s_debug "RequestComp: $RequestComp"
 
     # we cannot use $WordToComplete because it
@@ -85,16 +107,27 @@ Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock {
         # If the last parameter is complete (there is a space following it)
         # We add an extra empty parameter so we can indicate this to the go method.
         __%[1]s_debug "Adding extra empty parameter"
-`+"        # We need to use `\"`\" to pass an empty argument a \"\" or '' does not work!!!"+`
-`+"        $RequestComp=\"$RequestComp\" + ' `\"`\"'"+`
+        # PowerShell 7.2+ changed the way how the arguments are passed to executables,
+        # so for pre-7.2 or when Legacy argument passing is enabled we need to use
+`+"        # `\"`\" to pass an empty argument, a \"\" or '' does not work!!!"+`
+        if ($PSVersionTable.PsVersion -lt [version]'7.2.0' -or
+            ($PSVersionTable.PsVersion -lt [version]'7.3.0' -and -not [ExperimentalFeature]::IsEnabled("PSNativeCommandArgumentPassing")) -or
+            (($PSVersionTable.PsVersion -ge [version]'7.3.0' -or [ExperimentalFeature]::IsEnabled("PSNativeCommandArgumentPassing")) -and
+              $PSNativeCommandArgumentPassing -eq 'Legacy')) {
+`+"             $RequestComp=\"$RequestComp\" + ' `\"`\"'"+`
+        } else {
+             $RequestComp="$RequestComp" + ' ""'
+        }
     }
 
     __%[1]s_debug "Calling $RequestComp"
+    # First disable ActiveHelp which is not supported for Powershell
+    $env:%[10]s=0
+
     #call the command store the output in $out and redirect stderr and stdout to null
     # $Out is an array contains each line per element
     Invoke-Expression -OutVariable out "$RequestComp" 2>&1 | Out-Null
 
-
     # get directive from last line
     [int]$Directive = $Out[-1].TrimStart(':')
     if ($Directive -eq "") {
@@ -114,7 +147,7 @@ Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock {
     }
 
     $Longest = 0
-    $Values = $Out | ForEach-Object {
+    [Array]$Values = $Out | ForEach-Object {
         #Split the output in name and description
 `+"        $Name, $Description = $_.Split(\"`t\",2)"+`
         __%[1]s_debug "Name: $Name Description: $Description"
@@ -159,6 +192,11 @@ Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock {
         }
     }
 
+    # we sort the values in ascending order by name if keep order isn't passed
+    if (($Directive -band $ShellCompDirectiveKeepOrder) -eq 0 ) {
+        $Values = $Values | Sort-Object -Property Name
+    }
+
     if (($Directive -band $ShellCompDirectiveNoFileComp) -ne 0 ) {
         __%[1]s_debug "ShellCompDirectiveNoFileComp is called"
 
@@ -233,16 +271,18 @@ Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock {
             Default {
                 # Like MenuComplete but we don't want to add a space here because
                 # the user need to press space anyway to get the completion.
-                # Description will not be shown because thats not possible with TabCompleteNext
+                # Description will not be shown because that's not possible with TabCompleteNext
                 [System.Management.Automation.CompletionResult]::new($($comp.Name | __%[1]s_escapeStringWithSpecialChars), "$($comp.Name)", 'ParameterValue', "$($comp.Description)")
             }
         }
 
     }
 }
-`, name, compCmd,
+
+Register-ArgumentCompleter -CommandName '%[1]s' -ScriptBlock $__%[2]sCompleterBlock
+`, name, nameForVar, compCmd,
 		ShellCompDirectiveError, ShellCompDirectiveNoSpace, ShellCompDirectiveNoFileComp,
-		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs))
+		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs, ShellCompDirectiveKeepOrder, activeHelpEnvVar(name)))
 }
 
 func (c *Command) genPowerShellCompletion(w io.Writer, includeDesc bool) error {
diff --git a/vendor/github.com/spf13/cobra/projects_using_cobra.md b/vendor/github.com/spf13/cobra/projects_using_cobra.md
index d98a71e36f..8a291eb20e 100644
--- a/vendor/github.com/spf13/cobra/projects_using_cobra.md
+++ b/vendor/github.com/spf13/cobra/projects_using_cobra.md
@@ -1,38 +1,64 @@
 ## Projects using Cobra
 
+- [Allero](https://github.com/allero-io/allero)
+- [Arewefastyet](https://benchmark.vitess.io)
 - [Arduino CLI](https://github.com/arduino/arduino-cli)
-- [Bleve](http://www.blevesearch.com/)
-- [CockroachDB](http://www.cockroachlabs.com/)
+- [Bleve](https://blevesearch.com/)
+- [Cilium](https://cilium.io/)
+- [CloudQuery](https://github.com/cloudquery/cloudquery)
+- [CockroachDB](https://www.cockroachlabs.com/)
+- [Constellation](https://github.com/edgelesssys/constellation)
 - [Cosmos SDK](https://github.com/cosmos/cosmos-sdk)
+- [Datree](https://github.com/datreeio/datree)
 - [Delve](https://github.com/derekparker/delve)
 - [Docker (distribution)](https://github.com/docker/distribution)
 - [Etcd](https://etcd.io/)
 - [Gardener](https://github.com/gardener/gardenctl)
 - [Giant Swarm's gsctl](https://github.com/giantswarm/gsctl)
 - [Git Bump](https://github.com/erdaltsksn/git-bump)
-- [Github CLI](https://github.com/cli/cli)
+- [GitHub CLI](https://github.com/cli/cli)
 - [GitHub Labeler](https://github.com/erdaltsksn/gh-label)
 - [Golangci-lint](https://golangci-lint.run)
-- [GopherJS](http://www.gopherjs.org/)
+- [GopherJS](https://github.com/gopherjs/gopherjs)
+- [GoReleaser](https://goreleaser.com)
 - [Helm](https://helm.sh)
 - [Hugo](https://gohugo.io)
+- [Infracost](https://github.com/infracost/infracost)
 - [Istio](https://istio.io)
 - [Kool](https://github.com/kool-dev/kool)
-- [Kubernetes](http://kubernetes.io/)
+- [Kubernetes](https://kubernetes.io/)
+- [Kubescape](https://github.com/kubescape/kubescape)
+- [KubeVirt](https://github.com/kubevirt/kubevirt)
 - [Linkerd](https://linkerd.io/)
 - [Mattermost-server](https://github.com/mattermost/mattermost-server)
+- [Mercure](https://mercure.rocks/)
+- [Meroxa CLI](https://github.com/meroxa/cli)
 - [Metal Stack CLI](https://github.com/metal-stack/metalctl)
 - [Moby (former Docker)](https://github.com/moby/moby)
+- [Moldy](https://github.com/Moldy-Community/moldy)
+- [Multi-gitter](https://github.com/lindell/multi-gitter)
 - [Nanobox](https://github.com/nanobox-io/nanobox)/[Nanopack](https://github.com/nanopack)
+- [nFPM](https://nfpm.goreleaser.com)
+- [Okteto](https://github.com/okteto/okteto)
 - [OpenShift](https://www.openshift.com/)
 - [Ory Hydra](https://github.com/ory/hydra)
 - [Ory Kratos](https://github.com/ory/kratos)
+- [Pixie](https://github.com/pixie-io/pixie)
+- [Polygon Edge](https://github.com/0xPolygon/polygon-edge)
 - [Pouch](https://github.com/alibaba/pouch)
-- [ProjectAtomic (enterprise)](http://www.projectatomic.io/)
+- [ProjectAtomic (enterprise)](https://www.projectatomic.io/)
 - [Prototool](https://github.com/uber/prototool)
+- [Pulumi](https://www.pulumi.com)
+- [QRcp](https://github.com/claudiodangelis/qrcp)
 - [Random](https://github.com/erdaltsksn/random)
 - [Rclone](https://rclone.org/)
+- [Scaleway CLI](https://github.com/scaleway/scaleway-cli)
+- [Sia](https://github.com/SiaFoundation/siad)
 - [Skaffold](https://skaffold.dev/)
 - [Tendermint](https://github.com/tendermint/tendermint)
 - [Twitch CLI](https://github.com/twitchdev/twitch-cli)
+- [UpCloud CLI (`upctl`)](https://github.com/UpCloudLtd/upcloud-cli)
+- [Vitess](https://vitess.io)
+- VMware's [Tanzu Community Edition](https://github.com/vmware-tanzu/community-edition) & [Tanzu Framework](https://github.com/vmware-tanzu/tanzu-framework)
 - [Werf](https://werf.io/)
+- [ZITADEL](https://github.com/zitadel/zitadel)
diff --git a/vendor/github.com/spf13/cobra/shell_completions.go b/vendor/github.com/spf13/cobra/shell_completions.go
index d99bf91e5f..b035742d39 100644
--- a/vendor/github.com/spf13/cobra/shell_completions.go
+++ b/vendor/github.com/spf13/cobra/shell_completions.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
diff --git a/vendor/github.com/spf13/cobra/shell_completions.md b/vendor/github.com/spf13/cobra/shell_completions.md
index 4ba06a11c0..065c0621d4 100644
--- a/vendor/github.com/spf13/cobra/shell_completions.md
+++ b/vendor/github.com/spf13/cobra/shell_completions.md
@@ -16,10 +16,12 @@ If you do not wish to use the default `completion` command, you can choose to
 provide your own, which will take precedence over the default one. (This also provides
 backwards-compatibility with programs that already have their own `completion` command.)
 
-If you are using the generator, you can create a completion command by running
+If you are using the `cobra-cli` generator,
+which can be found at [spf13/cobra-cli](https://github.com/spf13/cobra-cli),
+you can create a completion command by running
 
 ```bash
-cobra add completion
+cobra-cli add completion
 ```
 and then modifying the generated `cmd/completion.go` file to look something like this
 (writing the shell script to stdout allows the most flexible use):
@@ -28,17 +30,17 @@ and then modifying the generated `cmd/completion.go` file to look something like
 var completionCmd = &cobra.Command{
 	Use:   "completion [bash|zsh|fish|powershell]",
 	Short: "Generate completion script",
-	Long: `To load completions:
+	Long: fmt.Sprintf(`To load completions:
 
 Bash:
 
-  $ source <(yourprogram completion bash)
+  $ source <(%[1]s completion bash)
 
   # To load completions for each session, execute once:
   # Linux:
-  $ yourprogram completion bash > /etc/bash_completion.d/yourprogram
+  $ %[1]s completion bash > /etc/bash_completion.d/%[1]s
   # macOS:
-  $ yourprogram completion bash > /usr/local/etc/bash_completion.d/yourprogram
+  $ %[1]s completion bash > $(brew --prefix)/etc/bash_completion.d/%[1]s
 
 Zsh:
 
@@ -48,28 +50,28 @@ Zsh:
   $ echo "autoload -U compinit; compinit" >> ~/.zshrc
 
   # To load completions for each session, execute once:
-  $ yourprogram completion zsh > "${fpath[1]}/_yourprogram"
+  $ %[1]s completion zsh > "${fpath[1]}/_%[1]s"
 
   # You will need to start a new shell for this setup to take effect.
 
 fish:
 
-  $ yourprogram completion fish | source
+  $ %[1]s completion fish | source
 
   # To load completions for each session, execute once:
-  $ yourprogram completion fish > ~/.config/fish/completions/yourprogram.fish
+  $ %[1]s completion fish > ~/.config/fish/completions/%[1]s.fish
 
 PowerShell:
 
-  PS> yourprogram completion powershell | Out-String | Invoke-Expression
+  PS> %[1]s completion powershell | Out-String | Invoke-Expression
 
   # To load completions for every new session, run:
-  PS> yourprogram completion powershell > yourprogram.ps1
+  PS> %[1]s completion powershell > %[1]s.ps1
   # and source this file from your PowerShell profile.
-`,
+`,cmd.Root().Name()),
 	DisableFlagsInUseLine: true,
 	ValidArgs:             []string{"bash", "zsh", "fish", "powershell"},
-	Args:                  cobra.ExactValidArgs(1),
+	Args:                  cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
 	Run: func(cmd *cobra.Command, args []string) {
 		switch args[0] {
 		case "bash":
@@ -97,6 +99,11 @@ To tell Cobra *not* to provide the default `completion` command:
 rootCmd.CompletionOptions.DisableDefaultCmd = true
 ```
 
+To tell Cobra to mark the default `completion` command as *hidden*:
+```
+rootCmd.CompletionOptions.HiddenDefaultCmd = true
+```
+
 To tell Cobra *not* to provide the user with the `--no-descriptions` flag to the completion sub-commands:
 ```
 rootCmd.CompletionOptions.DisableNoDescFlag = true
@@ -120,7 +127,7 @@ For example, if you want `kubectl get [tab][tab]` to show a list of valid "nouns
 Some simplified code from `kubectl get` looks like:
 
 ```go
-validArgs []string = { "pod", "node", "service", "replicationcontroller" }
+validArgs = []string{ "pod", "node", "service", "replicationcontroller" }
 
 cmd := &cobra.Command{
 	Use:     "get [(-o|--output=)json|yaml|template|...] (RESOURCE [NAME] | RESOURCE/NAME ...)",
@@ -146,7 +153,7 @@ node   pod   replicationcontroller   service
 If your nouns have aliases, you can define them alongside `ValidArgs` using `ArgAliases`:
 
 ```go
-argAliases []string = { "pods", "nodes", "services", "svc", "replicationcontrollers", "rc" }
+argAliases = []string { "pods", "nodes", "services", "svc", "replicationcontrollers", "rc" }
 
 cmd := &cobra.Command{
     ...
@@ -155,16 +162,7 @@ cmd := &cobra.Command{
 }
 ```
 
-The aliases are not shown to the user on tab completion, but they are accepted as valid nouns by
-the completion algorithm if entered manually, e.g. in:
-
-```bash
-$ kubectl get rc [tab][tab]
-backend        frontend       database
-```
-
-Note that without declaring `rc` as an alias, the completion algorithm would not know to show the list of
-replication controllers following `rc`.
+The aliases are shown to the user on tab completion only if no completions were found within sub-commands or `ValidArgs`.
 
 ### Dynamic completion of nouns
 
@@ -230,6 +228,10 @@ ShellCompDirectiveFilterFileExt
 //    return []string{"themes"}, ShellCompDirectiveFilterDirs
 //
 ShellCompDirectiveFilterDirs
+
+// ShellCompDirectiveKeepOrder indicates that the shell should preserve the order
+// in which the completions are provided
+ShellCompDirectiveKeepOrder
 ```
 
 ***Note***: When using the `ValidArgsFunction`, Cobra will call your registered function after having parsed all flags and arguments provided in the command-line.  You therefore don't need to do this parsing yourself.  For example, when a user calls `helm status --namespace my-rook-ns [tab][tab]`, Cobra will call your registered `ValidArgsFunction` after having parsed the `--namespace` flag, as it would have done when calling the `RunE` function.
@@ -378,6 +380,19 @@ or
 ```go
 ValidArgs: []string{"bash\tCompletions for bash", "zsh\tCompletions for zsh"}
 ```
+
+If you don't want to show descriptions in the completions, you can add `--no-descriptions` to the default `completion` command to disable them, like:
+
+```bash
+$ source <(helm completion bash)
+$ helm completion [tab][tab]
+bash        (generate autocompletion script for bash)        powershell  (generate autocompletion script for powershell)
+fish        (generate autocompletion script for fish)        zsh         (generate autocompletion script for zsh)
+
+$ source <(helm completion bash --no-descriptions)
+$ helm completion [tab][tab]
+bash        fish        powershell  zsh
+```
 ## Bash completions
 
 ### Dependencies
@@ -528,6 +543,21 @@ search for a keyword in charts
 $ helm s[tab]
 search  show  status
 ```
+### Aliases
+
+You can also configure `powershell` aliases for your program and they will also support completions.
+
+```
+$ sal aliasname origcommand
+$ Register-ArgumentCompleter -CommandName 'aliasname' -ScriptBlock $__origcommandCompleterBlock
+
+# and now when you run `aliasname` completion will make
+# suggestions as it did for `origcommand`.
+
+$ aliasname <tab>
+completion     firstcommand   secondcommand
+```
+The name of the completer block variable is of the form `$__<programName>CompleterBlock` where every `-` and `:` in the program name have been replaced with `_`, to respect powershell naming syntax.
 
 ### Limitations
 
diff --git a/vendor/github.com/spf13/cobra/user_guide.md b/vendor/github.com/spf13/cobra/user_guide.md
index 311abce284..85201d840c 100644
--- a/vendor/github.com/spf13/cobra/user_guide.md
+++ b/vendor/github.com/spf13/cobra/user_guide.md
@@ -29,10 +29,10 @@ func main() {
 
 ## Using the Cobra Generator
 
-Cobra provides its own program that will create your application and add any
+Cobra-CLI is its own program that will create your application and add any
 commands you want. It's the easiest way to incorporate Cobra into your application.
 
-[Here](https://github.com/spf13/cobra/blob/master/cobra/README.md) you can find more information about it.
+For complete details on using the Cobra generator, please refer to [The Cobra-CLI Generator README](https://github.com/spf13/cobra-cli/blob/main/README.md)
 
 ## Using the Cobra Library
 
@@ -51,7 +51,7 @@ var rootCmd = &cobra.Command{
   Short: "Hugo is a very fast static site generator",
   Long: `A Fast and Flexible Static Site Generator built with
                 love by spf13 and friends in Go.
-                Complete documentation is available at http://hugo.spf13.com`,
+                Complete documentation is available at https://gohugo.io/documentation/`,
   Run: func(cmd *cobra.Command, args []string) {
     // Do Stuff Here
   },
@@ -86,7 +86,7 @@ var (
 	userLicense string
 
 	rootCmd = &cobra.Command{
-		Use:   "cobra",
+		Use:   "cobra-cli",
 		Short: "A generator for Cobra based Applications",
 		Long: `Cobra is a CLI library for Go that empowers applications.
 This application is a tool to generate the needed files
@@ -188,6 +188,37 @@ var versionCmd = &cobra.Command{
 }
 ```
 
+### Organizing subcommands
+
+A command may have subcommands which in turn may have other subcommands. This is achieved by using
+`AddCommand`. In some cases, especially in larger applications, each subcommand may be defined in
+its own go package.
+
+The suggested approach is for the parent command to use `AddCommand` to add its most immediate
+subcommands. For example, consider the following directory structure:
+
+```text
+├── cmd
+│   ├── root.go
+│   └── sub1
+│       ├── sub1.go
+│       └── sub2
+│           ├── leafA.go
+│           ├── leafB.go
+│           └── sub2.go
+└── main.go
+```
+
+In this case:
+
+* The `init` function of `root.go` adds the command defined in `sub1.go` to the root command.
+* The `init` function of `sub1.go` adds the command defined in `sub2.go` to the sub1 command.
+* The `init` function of `sub2.go` adds the commands defined in `leafA.go` and `leafB.go` to the
+  sub2 command.
+
+This approach ensures the subcommands are always included at compile time while avoiding cyclic
+references.
+
 ### Returning and handling errors
 
 If you wish to return an error to the caller of a command, `RunE` can be used.
@@ -281,7 +312,7 @@ func init() {
 
 In this example, the persistent flag `author` is bound with `viper`.
 **Note**: the variable `author` will not be set to the value from config,
-when the `--author` flag is not provided by user.
+when the `--author` flag is provided by user.
 
 More in [viper documentation](https://github.com/spf13/viper#working-with-flags).
 
@@ -300,31 +331,74 @@ rootCmd.PersistentFlags().StringVarP(&Region, "region", "r", "", "AWS region (re
 rootCmd.MarkPersistentFlagRequired("region")
 ```
 
-## Positional and Custom Arguments
+### Flag Groups
 
-Validation of positional arguments can be specified using the `Args` field
-of `Command`.
+If you have different flags that must be provided together (e.g. if they provide the `--username` flag they MUST provide the `--password` flag as well) then
+Cobra can enforce that requirement:
+```go
+rootCmd.Flags().StringVarP(&u, "username", "u", "", "Username (required if password is set)")
+rootCmd.Flags().StringVarP(&pw, "password", "p", "", "Password (required if username is set)")
+rootCmd.MarkFlagsRequiredTogether("username", "password")
+```
 
+You can also prevent different flags from being provided together if they represent mutually
+exclusive options such as specifying an output format as either `--json` or `--yaml` but never both:
+```go
+rootCmd.Flags().BoolVar(&ofJson, "json", false, "Output in JSON")
+rootCmd.Flags().BoolVar(&ofYaml, "yaml", false, "Output in YAML")
+rootCmd.MarkFlagsMutuallyExclusive("json", "yaml")
+```
+
+In both of these cases:
+  - both local and persistent flags can be used
+    - **NOTE:** the group is only enforced on commands where every flag is defined
+  - a flag may appear in multiple groups
+  - a group may contain any number of flags
+
+## Positional and Custom Arguments
+
+Validation of positional arguments can be specified using the `Args` field of `Command`.
 The following validators are built in:
 
-- `NoArgs` - the command will report an error if there are any positional args.
-- `ArbitraryArgs` - the command will accept any args.
-- `OnlyValidArgs` - the command will report an error if there are any positional args that are not in the `ValidArgs` field of `Command`.
-- `MinimumNArgs(int)` - the command will report an error if there are not at least N positional args.
-- `MaximumNArgs(int)` - the command will report an error if there are more than N positional args.
-- `ExactArgs(int)` - the command will report an error if there are not exactly N positional args.
-- `ExactValidArgs(int)` - the command will report an error if there are not exactly N positional args OR if there are any positional args that are not in the `ValidArgs` field of `Command`
-- `RangeArgs(min, max)` - the command will report an error if the number of args is not between the minimum and maximum number of expected args.
+- Number of arguments:
+  - `NoArgs` - report an error if there are any positional args.
+  - `ArbitraryArgs` - accept any number of args.
+  - `MinimumNArgs(int)` - report an error if less than N positional args are provided.
+  - `MaximumNArgs(int)` - report an error if more than N positional args are provided.
+  - `ExactArgs(int)` - report an error if there are not exactly N positional args.
+  - `RangeArgs(min, max)` - report an error if the number of args is not between `min` and `max`.
+- Content of the arguments:
+  - `OnlyValidArgs` - report an error if there are any positional args not specified in the `ValidArgs` field of `Command`, which can optionally be set to a list of valid values for positional args.
+
+If `Args` is undefined or `nil`, it defaults to `ArbitraryArgs`.
 
-An example of setting the custom validator:
+Moreover, `MatchAll(pargs ...PositionalArgs)` enables combining existing checks with arbitrary other checks.
+For instance, if you want to report an error if there are not exactly N positional args OR if there are any positional
+args that are not in the `ValidArgs` field of `Command`, you can call `MatchAll` on `ExactArgs` and `OnlyValidArgs`, as
+shown below:
+
+```go
+var cmd = &cobra.Command{
+  Short: "hello",
+  Args: cobra.MatchAll(cobra.ExactArgs(2), cobra.OnlyValidArgs),
+  Run: func(cmd *cobra.Command, args []string) {
+    fmt.Println("Hello, World!")
+  },
+}
+```
+
+It is possible to set any custom validator that satisfies `func(cmd *cobra.Command, args []string) error`.
+For example:
 
 ```go
 var cmd = &cobra.Command{
   Short: "hello",
   Args: func(cmd *cobra.Command, args []string) error {
-    if len(args) < 1 {
-      return errors.New("requires a color argument")
+    // Optionally run one of the validators provided by cobra
+    if err := cobra.MinimumNArgs(1)(cmd, args); err != nil {
+        return err
     }
+    // Run the custom validation logic
     if myapp.IsValidColor(args[0]) {
       return nil
     }
@@ -404,7 +478,7 @@ a count and a string.`,
 }
 ```
 
-For a more complete example of a larger application, please checkout [Hugo](http://gohugo.io/).
+For a more complete example of a larger application, please checkout [Hugo](https://gohugo.io/).
 
 ## Help Command
 
@@ -419,37 +493,46 @@ create' is called.  Every command will automatically have the '--help' flag adde
 The following output is automatically generated by Cobra. Nothing beyond the
 command and flag definitions are needed.
 
-    $ cobra help
+    $ cobra-cli help
 
     Cobra is a CLI library for Go that empowers applications.
     This application is a tool to generate the needed files
     to quickly create a Cobra application.
 
     Usage:
-      cobra [command]
+      cobra-cli [command]
 
     Available Commands:
       add         Add a command to a Cobra Application
+      completion  Generate the autocompletion script for the specified shell
       help        Help about any command
       init        Initialize a Cobra Application
 
     Flags:
       -a, --author string    author name for copyright attribution (default "YOUR NAME")
           --config string    config file (default is $HOME/.cobra.yaml)
-      -h, --help             help for cobra
+      -h, --help             help for cobra-cli
       -l, --license string   name of license for the project
-          --viper            use Viper for configuration (default true)
+          --viper            use Viper for configuration
 
-    Use "cobra [command] --help" for more information about a command.
+    Use "cobra-cli [command] --help" for more information about a command.
 
 
 Help is just a command like any other. There is no special logic or behavior
 around it. In fact, you can provide your own if you want.
 
+### Grouping commands in help
+
+Cobra supports grouping of available commands in the help output.  To group commands, each group must be explicitly
+defined using `AddGroup()` on the parent command.  Then a subcommand can be added to a group using the `GroupID` element
+of that subcommand. The groups will appear in the help output in the same order as they are defined using different
+calls to `AddGroup()`.  If you use the generated `help` or `completion` commands, you can set their group ids using
+`SetHelpCommandGroupId()` and `SetCompletionCommandGroupId()` on the root command, respectively.
+
 ### Defining your own help
 
 You can provide your own Help command or your own template for the default command to use
-with following functions:
+with the following functions:
 
 ```go
 cmd.SetHelpCommand(cmd *Command)
@@ -468,22 +551,23 @@ showing the user the 'usage'.
 You may recognize this from the help above. That's because the default help
 embeds the usage as part of its output.
 
-    $ cobra --invalid
+    $ cobra-cli --invalid
     Error: unknown flag: --invalid
     Usage:
-      cobra [command]
+      cobra-cli [command]
 
     Available Commands:
       add         Add a command to a Cobra Application
+      completion  Generate the autocompletion script for the specified shell
       help        Help about any command
       init        Initialize a Cobra Application
 
     Flags:
       -a, --author string    author name for copyright attribution (default "YOUR NAME")
           --config string    config file (default is $HOME/.cobra.yaml)
-      -h, --help             help for cobra
+      -h, --help             help for cobra-cli
       -l, --license string   name of license for the project
-          --viper            use Viper for configuration (default true)
+          --viper            use Viper for configuration
 
     Use "cobra [command] --help" for more information about a command.
 
@@ -602,7 +686,7 @@ Did you mean this?
 Run 'hugo --help' for usage.
 ```
 
-Suggestions are automatic based on every subcommand registered and use an implementation of [Levenshtein distance](http://en.wikipedia.org/wiki/Levenshtein_distance). Every registered command that matches a minimum distance of 2 (ignoring case) will be displayed as a suggestion.
+Suggestions are automatically generated based on existing subcommands and use an implementation of [Levenshtein distance](https://en.wikipedia.org/wiki/Levenshtein_distance). Every registered command that matches a minimum distance of 2 (ignoring case) will be displayed as a suggestion.
 
 If you need to disable suggestions or tweak the string distance in your command, use:
 
@@ -616,7 +700,8 @@ or
 command.SuggestionsMinimumDistance = 1
 ```
 
-You can also explicitly set names for which a given command will be suggested using the `SuggestFor` attribute. This allows suggestions for strings that are not close in terms of string distance, but makes sense in your set of commands and for some which you don't want aliases. Example:
+You can also explicitly set names for which a given command will be suggested using the `SuggestFor` attribute. This allows suggestions for strings that are not close in terms of string distance, but make sense in your set of commands but for which
+you don't want aliases. Example:
 
 ```
 $ kubectl remove
@@ -635,3 +720,7 @@ Cobra can generate documentation based on subcommands, flags, etc. Read more abo
 ## Generating shell completions
 
 Cobra can generate a shell-completion file for the following shells: bash, zsh, fish, PowerShell. If you add more information to your commands, these completions can be amazingly powerful and flexible.  Read more about it in [Shell Completions](shell_completions.md).
+
+## Providing Active Help
+
+Cobra makes use of the shell-completion system to define a framework allowing you to provide Active Help to your users.  Active Help are messages (hints, warnings, etc) printed as the program is being used.  Read more about it in [Active Help](active_help.md).
diff --git a/vendor/github.com/spf13/cobra/zsh_completions.go b/vendor/github.com/spf13/cobra/zsh_completions.go
index 1afec30ea9..1856e4c7f6 100644
--- a/vendor/github.com/spf13/cobra/zsh_completions.go
+++ b/vendor/github.com/spf13/cobra/zsh_completions.go
@@ -1,3 +1,17 @@
+// Copyright 2013-2023 The Cobra Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package cobra
 
 import (
@@ -75,7 +89,8 @@ func genZshComp(buf io.StringWriter, name string, includeDesc bool) {
 	if !includeDesc {
 		compCmd = ShellCompNoDescRequestCmd
 	}
-	WriteStringAndCheck(buf, fmt.Sprintf(`#compdef _%[1]s %[1]s
+	WriteStringAndCheck(buf, fmt.Sprintf(`#compdef %[1]s
+compdef _%[1]s %[1]s
 
 # zsh completion for %-36[1]s -*- shell-script -*-
 
@@ -94,8 +109,9 @@ _%[1]s()
     local shellCompDirectiveNoFileComp=%[5]d
     local shellCompDirectiveFilterFileExt=%[6]d
     local shellCompDirectiveFilterDirs=%[7]d
+    local shellCompDirectiveKeepOrder=%[8]d
 
-    local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace
+    local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace keepOrder
     local -a completions
 
     __%[1]s_debug "\n========= starting completion logic =========="
@@ -163,7 +179,24 @@ _%[1]s()
         return
     fi
 
+    local activeHelpMarker="%[9]s"
+    local endIndex=${#activeHelpMarker}
+    local startIndex=$((${#activeHelpMarker}+1))
+    local hasActiveHelp=0
     while IFS='\n' read -r comp; do
+        # Check if this is an activeHelp statement (i.e., prefixed with $activeHelpMarker)
+        if [ "${comp[1,$endIndex]}" = "$activeHelpMarker" ];then
+            __%[1]s_debug "ActiveHelp found: $comp"
+            comp="${comp[$startIndex,-1]}"
+            if [ -n "$comp" ]; then
+                compadd -x "${comp}"
+                __%[1]s_debug "ActiveHelp will need delimiter"
+                hasActiveHelp=1
+            fi
+
+            continue
+        fi
+
         if [ -n "$comp" ]; then
             # If requested, completions are returned with a description.
             # The description is preceded by a TAB character.
@@ -171,7 +204,7 @@ _%[1]s()
             # We first need to escape any : as part of the completion itself.
             comp=${comp//:/\\:}
 
-            local tab=$(printf '\t')
+            local tab="$(printf '\t')"
             comp=${comp//$tab/:}
 
             __%[1]s_debug "Adding completion: ${comp}"
@@ -180,11 +213,27 @@ _%[1]s()
         fi
     done < <(printf "%%s\n" "${out[@]}")
 
+    # Add a delimiter after the activeHelp statements, but only if:
+    # - there are completions following the activeHelp statements, or
+    # - file completion will be performed (so there will be choices after the activeHelp)
+    if [ $hasActiveHelp -eq 1 ]; then
+        if [ ${#completions} -ne 0 ] || [ $((directive & shellCompDirectiveNoFileComp)) -eq 0 ]; then
+            __%[1]s_debug "Adding activeHelp delimiter"
+            compadd -x "--"
+            hasActiveHelp=0
+        fi
+    fi
+
     if [ $((directive & shellCompDirectiveNoSpace)) -ne 0 ]; then
         __%[1]s_debug "Activating nospace."
         noSpace="-S ''"
     fi
 
+    if [ $((directive & shellCompDirectiveKeepOrder)) -ne 0 ]; then
+        __%[1]s_debug "Activating keep order."
+        keepOrder="-V"
+    fi
+
     if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then
         # File extension filtering
         local filteringCmd
@@ -202,7 +251,7 @@ _%[1]s()
         _arguments '*:filename:'"$filteringCmd"
     elif [ $((directive & shellCompDirectiveFilterDirs)) -ne 0 ]; then
         # File completion for directories only
-        local subDir
+        local subdir
         subdir="${completions[1]}"
         if [ -n "$subdir" ]; then
             __%[1]s_debug "Listing directories in $subdir"
@@ -220,7 +269,7 @@ _%[1]s()
         return $result
     else
         __%[1]s_debug "Calling _describe"
-        if eval _describe "completions" completions $flagPrefix $noSpace; then
+        if eval _describe $keepOrder "completions" completions $flagPrefix $noSpace; then
             __%[1]s_debug "_describe found some completions"
 
             # Return the success of having called _describe
@@ -250,9 +299,10 @@ _%[1]s()
 
 # don't run the completion function when being source-ed or eval-ed
 if [ "$funcstack[1]" = "_%[1]s" ]; then
-	_%[1]s
+    _%[1]s
 fi
 `, name, compCmd,
 		ShellCompDirectiveError, ShellCompDirectiveNoSpace, ShellCompDirectiveNoFileComp,
-		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs))
+		ShellCompDirectiveFilterFileExt, ShellCompDirectiveFilterDirs, ShellCompDirectiveKeepOrder,
+		activeHelpMarker))
 }
diff --git a/vendor/github.com/spf13/pflag/go.mod b/vendor/github.com/spf13/pflag/go.mod
deleted file mode 100644
index b2287eec13..0000000000
--- a/vendor/github.com/spf13/pflag/go.mod
+++ /dev/null
@@ -1,3 +0,0 @@
-module github.com/spf13/pflag
-
-go 1.12
diff --git a/vendor/github.com/spf13/pflag/go.sum b/vendor/github.com/spf13/pflag/go.sum
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/vendor/github.com/stretchr/testify/LICENSE b/vendor/github.com/stretchr/testify/LICENSE
deleted file mode 100644
index 4b0421cf9e..0000000000
--- a/vendor/github.com/stretchr/testify/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/vendor/github.com/stretchr/testify/assert/assertion_compare.go b/vendor/github.com/stretchr/testify/assert/assertion_compare.go
deleted file mode 100644
index 41649d2679..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertion_compare.go
+++ /dev/null
@@ -1,394 +0,0 @@
-package assert
-
-import (
-	"fmt"
-	"reflect"
-)
-
-type CompareType int
-
-const (
-	compareLess CompareType = iota - 1
-	compareEqual
-	compareGreater
-)
-
-var (
-	intType   = reflect.TypeOf(int(1))
-	int8Type  = reflect.TypeOf(int8(1))
-	int16Type = reflect.TypeOf(int16(1))
-	int32Type = reflect.TypeOf(int32(1))
-	int64Type = reflect.TypeOf(int64(1))
-
-	uintType   = reflect.TypeOf(uint(1))
-	uint8Type  = reflect.TypeOf(uint8(1))
-	uint16Type = reflect.TypeOf(uint16(1))
-	uint32Type = reflect.TypeOf(uint32(1))
-	uint64Type = reflect.TypeOf(uint64(1))
-
-	float32Type = reflect.TypeOf(float32(1))
-	float64Type = reflect.TypeOf(float64(1))
-
-	stringType = reflect.TypeOf("")
-)
-
-func compare(obj1, obj2 interface{}, kind reflect.Kind) (CompareType, bool) {
-	obj1Value := reflect.ValueOf(obj1)
-	obj2Value := reflect.ValueOf(obj2)
-
-	// throughout this switch we try and avoid calling .Convert() if possible,
-	// as this has a pretty big performance impact
-	switch kind {
-	case reflect.Int:
-		{
-			intobj1, ok := obj1.(int)
-			if !ok {
-				intobj1 = obj1Value.Convert(intType).Interface().(int)
-			}
-			intobj2, ok := obj2.(int)
-			if !ok {
-				intobj2 = obj2Value.Convert(intType).Interface().(int)
-			}
-			if intobj1 > intobj2 {
-				return compareGreater, true
-			}
-			if intobj1 == intobj2 {
-				return compareEqual, true
-			}
-			if intobj1 < intobj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Int8:
-		{
-			int8obj1, ok := obj1.(int8)
-			if !ok {
-				int8obj1 = obj1Value.Convert(int8Type).Interface().(int8)
-			}
-			int8obj2, ok := obj2.(int8)
-			if !ok {
-				int8obj2 = obj2Value.Convert(int8Type).Interface().(int8)
-			}
-			if int8obj1 > int8obj2 {
-				return compareGreater, true
-			}
-			if int8obj1 == int8obj2 {
-				return compareEqual, true
-			}
-			if int8obj1 < int8obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Int16:
-		{
-			int16obj1, ok := obj1.(int16)
-			if !ok {
-				int16obj1 = obj1Value.Convert(int16Type).Interface().(int16)
-			}
-			int16obj2, ok := obj2.(int16)
-			if !ok {
-				int16obj2 = obj2Value.Convert(int16Type).Interface().(int16)
-			}
-			if int16obj1 > int16obj2 {
-				return compareGreater, true
-			}
-			if int16obj1 == int16obj2 {
-				return compareEqual, true
-			}
-			if int16obj1 < int16obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Int32:
-		{
-			int32obj1, ok := obj1.(int32)
-			if !ok {
-				int32obj1 = obj1Value.Convert(int32Type).Interface().(int32)
-			}
-			int32obj2, ok := obj2.(int32)
-			if !ok {
-				int32obj2 = obj2Value.Convert(int32Type).Interface().(int32)
-			}
-			if int32obj1 > int32obj2 {
-				return compareGreater, true
-			}
-			if int32obj1 == int32obj2 {
-				return compareEqual, true
-			}
-			if int32obj1 < int32obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Int64:
-		{
-			int64obj1, ok := obj1.(int64)
-			if !ok {
-				int64obj1 = obj1Value.Convert(int64Type).Interface().(int64)
-			}
-			int64obj2, ok := obj2.(int64)
-			if !ok {
-				int64obj2 = obj2Value.Convert(int64Type).Interface().(int64)
-			}
-			if int64obj1 > int64obj2 {
-				return compareGreater, true
-			}
-			if int64obj1 == int64obj2 {
-				return compareEqual, true
-			}
-			if int64obj1 < int64obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Uint:
-		{
-			uintobj1, ok := obj1.(uint)
-			if !ok {
-				uintobj1 = obj1Value.Convert(uintType).Interface().(uint)
-			}
-			uintobj2, ok := obj2.(uint)
-			if !ok {
-				uintobj2 = obj2Value.Convert(uintType).Interface().(uint)
-			}
-			if uintobj1 > uintobj2 {
-				return compareGreater, true
-			}
-			if uintobj1 == uintobj2 {
-				return compareEqual, true
-			}
-			if uintobj1 < uintobj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Uint8:
-		{
-			uint8obj1, ok := obj1.(uint8)
-			if !ok {
-				uint8obj1 = obj1Value.Convert(uint8Type).Interface().(uint8)
-			}
-			uint8obj2, ok := obj2.(uint8)
-			if !ok {
-				uint8obj2 = obj2Value.Convert(uint8Type).Interface().(uint8)
-			}
-			if uint8obj1 > uint8obj2 {
-				return compareGreater, true
-			}
-			if uint8obj1 == uint8obj2 {
-				return compareEqual, true
-			}
-			if uint8obj1 < uint8obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Uint16:
-		{
-			uint16obj1, ok := obj1.(uint16)
-			if !ok {
-				uint16obj1 = obj1Value.Convert(uint16Type).Interface().(uint16)
-			}
-			uint16obj2, ok := obj2.(uint16)
-			if !ok {
-				uint16obj2 = obj2Value.Convert(uint16Type).Interface().(uint16)
-			}
-			if uint16obj1 > uint16obj2 {
-				return compareGreater, true
-			}
-			if uint16obj1 == uint16obj2 {
-				return compareEqual, true
-			}
-			if uint16obj1 < uint16obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Uint32:
-		{
-			uint32obj1, ok := obj1.(uint32)
-			if !ok {
-				uint32obj1 = obj1Value.Convert(uint32Type).Interface().(uint32)
-			}
-			uint32obj2, ok := obj2.(uint32)
-			if !ok {
-				uint32obj2 = obj2Value.Convert(uint32Type).Interface().(uint32)
-			}
-			if uint32obj1 > uint32obj2 {
-				return compareGreater, true
-			}
-			if uint32obj1 == uint32obj2 {
-				return compareEqual, true
-			}
-			if uint32obj1 < uint32obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Uint64:
-		{
-			uint64obj1, ok := obj1.(uint64)
-			if !ok {
-				uint64obj1 = obj1Value.Convert(uint64Type).Interface().(uint64)
-			}
-			uint64obj2, ok := obj2.(uint64)
-			if !ok {
-				uint64obj2 = obj2Value.Convert(uint64Type).Interface().(uint64)
-			}
-			if uint64obj1 > uint64obj2 {
-				return compareGreater, true
-			}
-			if uint64obj1 == uint64obj2 {
-				return compareEqual, true
-			}
-			if uint64obj1 < uint64obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Float32:
-		{
-			float32obj1, ok := obj1.(float32)
-			if !ok {
-				float32obj1 = obj1Value.Convert(float32Type).Interface().(float32)
-			}
-			float32obj2, ok := obj2.(float32)
-			if !ok {
-				float32obj2 = obj2Value.Convert(float32Type).Interface().(float32)
-			}
-			if float32obj1 > float32obj2 {
-				return compareGreater, true
-			}
-			if float32obj1 == float32obj2 {
-				return compareEqual, true
-			}
-			if float32obj1 < float32obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.Float64:
-		{
-			float64obj1, ok := obj1.(float64)
-			if !ok {
-				float64obj1 = obj1Value.Convert(float64Type).Interface().(float64)
-			}
-			float64obj2, ok := obj2.(float64)
-			if !ok {
-				float64obj2 = obj2Value.Convert(float64Type).Interface().(float64)
-			}
-			if float64obj1 > float64obj2 {
-				return compareGreater, true
-			}
-			if float64obj1 == float64obj2 {
-				return compareEqual, true
-			}
-			if float64obj1 < float64obj2 {
-				return compareLess, true
-			}
-		}
-	case reflect.String:
-		{
-			stringobj1, ok := obj1.(string)
-			if !ok {
-				stringobj1 = obj1Value.Convert(stringType).Interface().(string)
-			}
-			stringobj2, ok := obj2.(string)
-			if !ok {
-				stringobj2 = obj2Value.Convert(stringType).Interface().(string)
-			}
-			if stringobj1 > stringobj2 {
-				return compareGreater, true
-			}
-			if stringobj1 == stringobj2 {
-				return compareEqual, true
-			}
-			if stringobj1 < stringobj2 {
-				return compareLess, true
-			}
-		}
-	}
-
-	return compareEqual, false
-}
-
-// Greater asserts that the first element is greater than the second
-//
-//    assert.Greater(t, 2, 1)
-//    assert.Greater(t, float64(2), float64(1))
-//    assert.Greater(t, "b", "a")
-func Greater(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	return compareTwoValues(t, e1, e2, []CompareType{compareGreater}, "\"%v\" is not greater than \"%v\"", msgAndArgs)
-}
-
-// GreaterOrEqual asserts that the first element is greater than or equal to the second
-//
-//    assert.GreaterOrEqual(t, 2, 1)
-//    assert.GreaterOrEqual(t, 2, 2)
-//    assert.GreaterOrEqual(t, "b", "a")
-//    assert.GreaterOrEqual(t, "b", "b")
-func GreaterOrEqual(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	return compareTwoValues(t, e1, e2, []CompareType{compareGreater, compareEqual}, "\"%v\" is not greater than or equal to \"%v\"", msgAndArgs)
-}
-
-// Less asserts that the first element is less than the second
-//
-//    assert.Less(t, 1, 2)
-//    assert.Less(t, float64(1), float64(2))
-//    assert.Less(t, "a", "b")
-func Less(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	return compareTwoValues(t, e1, e2, []CompareType{compareLess}, "\"%v\" is not less than \"%v\"", msgAndArgs)
-}
-
-// LessOrEqual asserts that the first element is less than or equal to the second
-//
-//    assert.LessOrEqual(t, 1, 2)
-//    assert.LessOrEqual(t, 2, 2)
-//    assert.LessOrEqual(t, "a", "b")
-//    assert.LessOrEqual(t, "b", "b")
-func LessOrEqual(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	return compareTwoValues(t, e1, e2, []CompareType{compareLess, compareEqual}, "\"%v\" is not less than or equal to \"%v\"", msgAndArgs)
-}
-
-// Positive asserts that the specified element is positive
-//
-//    assert.Positive(t, 1)
-//    assert.Positive(t, 1.23)
-func Positive(t TestingT, e interface{}, msgAndArgs ...interface{}) bool {
-	zero := reflect.Zero(reflect.TypeOf(e))
-	return compareTwoValues(t, e, zero.Interface(), []CompareType{compareGreater}, "\"%v\" is not positive", msgAndArgs)
-}
-
-// Negative asserts that the specified element is negative
-//
-//    assert.Negative(t, -1)
-//    assert.Negative(t, -1.23)
-func Negative(t TestingT, e interface{}, msgAndArgs ...interface{}) bool {
-	zero := reflect.Zero(reflect.TypeOf(e))
-	return compareTwoValues(t, e, zero.Interface(), []CompareType{compareLess}, "\"%v\" is not negative", msgAndArgs)
-}
-
-func compareTwoValues(t TestingT, e1 interface{}, e2 interface{}, allowedComparesResults []CompareType, failMessage string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	e1Kind := reflect.ValueOf(e1).Kind()
-	e2Kind := reflect.ValueOf(e2).Kind()
-	if e1Kind != e2Kind {
-		return Fail(t, "Elements should be the same type", msgAndArgs...)
-	}
-
-	compareResult, isComparable := compare(e1, e2, e1Kind)
-	if !isComparable {
-		return Fail(t, fmt.Sprintf("Can not compare type \"%s\"", reflect.TypeOf(e1)), msgAndArgs...)
-	}
-
-	if !containsValue(allowedComparesResults, compareResult) {
-		return Fail(t, fmt.Sprintf(failMessage, e1, e2), msgAndArgs...)
-	}
-
-	return true
-}
-
-func containsValue(values []CompareType, value CompareType) bool {
-	for _, v := range values {
-		if v == value {
-			return true
-		}
-	}
-
-	return false
-}
diff --git a/vendor/github.com/stretchr/testify/assert/assertion_format.go b/vendor/github.com/stretchr/testify/assert/assertion_format.go
deleted file mode 100644
index 4dfd1229a8..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertion_format.go
+++ /dev/null
@@ -1,741 +0,0 @@
-/*
-* CODE GENERATED AUTOMATICALLY WITH github.com/stretchr/testify/_codegen
-* THIS FILE MUST NOT BE EDITED BY HAND
- */
-
-package assert
-
-import (
-	http "net/http"
-	url "net/url"
-	time "time"
-)
-
-// Conditionf uses a Comparison to assert a complex condition.
-func Conditionf(t TestingT, comp Comparison, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Condition(t, comp, append([]interface{}{msg}, args...)...)
-}
-
-// Containsf asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    assert.Containsf(t, "Hello World", "World", "error message %s", "formatted")
-//    assert.Containsf(t, ["Hello", "World"], "World", "error message %s", "formatted")
-//    assert.Containsf(t, {"Hello": "World"}, "Hello", "error message %s", "formatted")
-func Containsf(t TestingT, s interface{}, contains interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Contains(t, s, contains, append([]interface{}{msg}, args...)...)
-}
-
-// DirExistsf checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func DirExistsf(t TestingT, path string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return DirExists(t, path, append([]interface{}{msg}, args...)...)
-}
-
-// ElementsMatchf asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// assert.ElementsMatchf(t, [1, 3, 2, 3], [1, 3, 3, 2], "error message %s", "formatted")
-func ElementsMatchf(t TestingT, listA interface{}, listB interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return ElementsMatch(t, listA, listB, append([]interface{}{msg}, args...)...)
-}
-
-// Emptyf asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  assert.Emptyf(t, obj, "error message %s", "formatted")
-func Emptyf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Empty(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// Equalf asserts that two objects are equal.
-//
-//    assert.Equalf(t, 123, 123, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func Equalf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Equal(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// EqualErrorf asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   assert.EqualErrorf(t, err,  expectedErrorString, "error message %s", "formatted")
-func EqualErrorf(t TestingT, theError error, errString string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return EqualError(t, theError, errString, append([]interface{}{msg}, args...)...)
-}
-
-// EqualValuesf asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    assert.EqualValuesf(t, uint32(123), int32(123), "error message %s", "formatted")
-func EqualValuesf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return EqualValues(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// Errorf asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.Errorf(t, err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedErrorf, err)
-//   }
-func Errorf(t TestingT, err error, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Error(t, err, append([]interface{}{msg}, args...)...)
-}
-
-// ErrorAsf asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func ErrorAsf(t TestingT, err error, target interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return ErrorAs(t, err, target, append([]interface{}{msg}, args...)...)
-}
-
-// ErrorIsf asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func ErrorIsf(t TestingT, err error, target error, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return ErrorIs(t, err, target, append([]interface{}{msg}, args...)...)
-}
-
-// Eventuallyf asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    assert.Eventuallyf(t, func() bool { return true; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func Eventuallyf(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Eventually(t, condition, waitFor, tick, append([]interface{}{msg}, args...)...)
-}
-
-// Exactlyf asserts that two objects are equal in value and type.
-//
-//    assert.Exactlyf(t, int32(123), int64(123), "error message %s", "formatted")
-func Exactlyf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Exactly(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// Failf reports a failure through
-func Failf(t TestingT, failureMessage string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Fail(t, failureMessage, append([]interface{}{msg}, args...)...)
-}
-
-// FailNowf fails test
-func FailNowf(t TestingT, failureMessage string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return FailNow(t, failureMessage, append([]interface{}{msg}, args...)...)
-}
-
-// Falsef asserts that the specified value is false.
-//
-//    assert.Falsef(t, myBool, "error message %s", "formatted")
-func Falsef(t TestingT, value bool, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return False(t, value, append([]interface{}{msg}, args...)...)
-}
-
-// FileExistsf checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func FileExistsf(t TestingT, path string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return FileExists(t, path, append([]interface{}{msg}, args...)...)
-}
-
-// Greaterf asserts that the first element is greater than the second
-//
-//    assert.Greaterf(t, 2, 1, "error message %s", "formatted")
-//    assert.Greaterf(t, float64(2), float64(1), "error message %s", "formatted")
-//    assert.Greaterf(t, "b", "a", "error message %s", "formatted")
-func Greaterf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Greater(t, e1, e2, append([]interface{}{msg}, args...)...)
-}
-
-// GreaterOrEqualf asserts that the first element is greater than or equal to the second
-//
-//    assert.GreaterOrEqualf(t, 2, 1, "error message %s", "formatted")
-//    assert.GreaterOrEqualf(t, 2, 2, "error message %s", "formatted")
-//    assert.GreaterOrEqualf(t, "b", "a", "error message %s", "formatted")
-//    assert.GreaterOrEqualf(t, "b", "b", "error message %s", "formatted")
-func GreaterOrEqualf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return GreaterOrEqual(t, e1, e2, append([]interface{}{msg}, args...)...)
-}
-
-// HTTPBodyContainsf asserts that a specified handler returns a
-// body that contains a string.
-//
-//  assert.HTTPBodyContainsf(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyContainsf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPBodyContains(t, handler, method, url, values, str, append([]interface{}{msg}, args...)...)
-}
-
-// HTTPBodyNotContainsf asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  assert.HTTPBodyNotContainsf(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyNotContainsf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPBodyNotContains(t, handler, method, url, values, str, append([]interface{}{msg}, args...)...)
-}
-
-// HTTPErrorf asserts that a specified handler returns an error status code.
-//
-//  assert.HTTPErrorf(t, myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPErrorf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPError(t, handler, method, url, values, append([]interface{}{msg}, args...)...)
-}
-
-// HTTPRedirectf asserts that a specified handler returns a redirect status code.
-//
-//  assert.HTTPRedirectf(t, myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPRedirectf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPRedirect(t, handler, method, url, values, append([]interface{}{msg}, args...)...)
-}
-
-// HTTPStatusCodef asserts that a specified handler returns a specified status code.
-//
-//  assert.HTTPStatusCodef(t, myHandler, "GET", "/notImplemented", nil, 501, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPStatusCodef(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPStatusCode(t, handler, method, url, values, statuscode, append([]interface{}{msg}, args...)...)
-}
-
-// HTTPSuccessf asserts that a specified handler returns a success status code.
-//
-//  assert.HTTPSuccessf(t, myHandler, "POST", "http://www.google.com", nil, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPSuccessf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPSuccess(t, handler, method, url, values, append([]interface{}{msg}, args...)...)
-}
-
-// Implementsf asserts that an object is implemented by the specified interface.
-//
-//    assert.Implementsf(t, (*MyInterface)(nil), new(MyObject), "error message %s", "formatted")
-func Implementsf(t TestingT, interfaceObject interface{}, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Implements(t, interfaceObject, object, append([]interface{}{msg}, args...)...)
-}
-
-// InDeltaf asserts that the two numerals are within delta of each other.
-//
-// 	 assert.InDeltaf(t, math.Pi, 22/7.0, 0.01, "error message %s", "formatted")
-func InDeltaf(t TestingT, expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDelta(t, expected, actual, delta, append([]interface{}{msg}, args...)...)
-}
-
-// InDeltaMapValuesf is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func InDeltaMapValuesf(t TestingT, expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaMapValues(t, expected, actual, delta, append([]interface{}{msg}, args...)...)
-}
-
-// InDeltaSlicef is the same as InDelta, except it compares two slices.
-func InDeltaSlicef(t TestingT, expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaSlice(t, expected, actual, delta, append([]interface{}{msg}, args...)...)
-}
-
-// InEpsilonf asserts that expected and actual have a relative error less than epsilon
-func InEpsilonf(t TestingT, expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return InEpsilon(t, expected, actual, epsilon, append([]interface{}{msg}, args...)...)
-}
-
-// InEpsilonSlicef is the same as InEpsilon, except it compares each value from two slices.
-func InEpsilonSlicef(t TestingT, expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return InEpsilonSlice(t, expected, actual, epsilon, append([]interface{}{msg}, args...)...)
-}
-
-// IsDecreasingf asserts that the collection is decreasing
-//
-//    assert.IsDecreasingf(t, []int{2, 1, 0}, "error message %s", "formatted")
-//    assert.IsDecreasingf(t, []float{2, 1}, "error message %s", "formatted")
-//    assert.IsDecreasingf(t, []string{"b", "a"}, "error message %s", "formatted")
-func IsDecreasingf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsDecreasing(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// IsIncreasingf asserts that the collection is increasing
-//
-//    assert.IsIncreasingf(t, []int{1, 2, 3}, "error message %s", "formatted")
-//    assert.IsIncreasingf(t, []float{1, 2}, "error message %s", "formatted")
-//    assert.IsIncreasingf(t, []string{"a", "b"}, "error message %s", "formatted")
-func IsIncreasingf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsIncreasing(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// IsNonDecreasingf asserts that the collection is not decreasing
-//
-//    assert.IsNonDecreasingf(t, []int{1, 1, 2}, "error message %s", "formatted")
-//    assert.IsNonDecreasingf(t, []float{1, 2}, "error message %s", "formatted")
-//    assert.IsNonDecreasingf(t, []string{"a", "b"}, "error message %s", "formatted")
-func IsNonDecreasingf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsNonDecreasing(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// IsNonIncreasingf asserts that the collection is not increasing
-//
-//    assert.IsNonIncreasingf(t, []int{2, 1, 1}, "error message %s", "formatted")
-//    assert.IsNonIncreasingf(t, []float{2, 1}, "error message %s", "formatted")
-//    assert.IsNonIncreasingf(t, []string{"b", "a"}, "error message %s", "formatted")
-func IsNonIncreasingf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsNonIncreasing(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// IsTypef asserts that the specified objects are of the same type.
-func IsTypef(t TestingT, expectedType interface{}, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsType(t, expectedType, object, append([]interface{}{msg}, args...)...)
-}
-
-// JSONEqf asserts that two JSON strings are equivalent.
-//
-//  assert.JSONEqf(t, `{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`, "error message %s", "formatted")
-func JSONEqf(t TestingT, expected string, actual string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return JSONEq(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// Lenf asserts that the specified object has specific length.
-// Lenf also fails if the object has a type that len() not accept.
-//
-//    assert.Lenf(t, mySlice, 3, "error message %s", "formatted")
-func Lenf(t TestingT, object interface{}, length int, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Len(t, object, length, append([]interface{}{msg}, args...)...)
-}
-
-// Lessf asserts that the first element is less than the second
-//
-//    assert.Lessf(t, 1, 2, "error message %s", "formatted")
-//    assert.Lessf(t, float64(1), float64(2), "error message %s", "formatted")
-//    assert.Lessf(t, "a", "b", "error message %s", "formatted")
-func Lessf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Less(t, e1, e2, append([]interface{}{msg}, args...)...)
-}
-
-// LessOrEqualf asserts that the first element is less than or equal to the second
-//
-//    assert.LessOrEqualf(t, 1, 2, "error message %s", "formatted")
-//    assert.LessOrEqualf(t, 2, 2, "error message %s", "formatted")
-//    assert.LessOrEqualf(t, "a", "b", "error message %s", "formatted")
-//    assert.LessOrEqualf(t, "b", "b", "error message %s", "formatted")
-func LessOrEqualf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return LessOrEqual(t, e1, e2, append([]interface{}{msg}, args...)...)
-}
-
-// Negativef asserts that the specified element is negative
-//
-//    assert.Negativef(t, -1, "error message %s", "formatted")
-//    assert.Negativef(t, -1.23, "error message %s", "formatted")
-func Negativef(t TestingT, e interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Negative(t, e, append([]interface{}{msg}, args...)...)
-}
-
-// Neverf asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    assert.Neverf(t, func() bool { return false; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func Neverf(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Never(t, condition, waitFor, tick, append([]interface{}{msg}, args...)...)
-}
-
-// Nilf asserts that the specified object is nil.
-//
-//    assert.Nilf(t, err, "error message %s", "formatted")
-func Nilf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Nil(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// NoDirExistsf checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func NoDirExistsf(t TestingT, path string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoDirExists(t, path, append([]interface{}{msg}, args...)...)
-}
-
-// NoErrorf asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.NoErrorf(t, err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func NoErrorf(t TestingT, err error, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoError(t, err, append([]interface{}{msg}, args...)...)
-}
-
-// NoFileExistsf checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func NoFileExistsf(t TestingT, path string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoFileExists(t, path, append([]interface{}{msg}, args...)...)
-}
-
-// NotContainsf asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    assert.NotContainsf(t, "Hello World", "Earth", "error message %s", "formatted")
-//    assert.NotContainsf(t, ["Hello", "World"], "Earth", "error message %s", "formatted")
-//    assert.NotContainsf(t, {"Hello": "World"}, "Earth", "error message %s", "formatted")
-func NotContainsf(t TestingT, s interface{}, contains interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotContains(t, s, contains, append([]interface{}{msg}, args...)...)
-}
-
-// NotEmptyf asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if assert.NotEmptyf(t, obj, "error message %s", "formatted") {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func NotEmptyf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEmpty(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// NotEqualf asserts that the specified values are NOT equal.
-//
-//    assert.NotEqualf(t, obj1, obj2, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func NotEqualf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEqual(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// NotEqualValuesf asserts that two objects are not equal even when converted to the same type
-//
-//    assert.NotEqualValuesf(t, obj1, obj2, "error message %s", "formatted")
-func NotEqualValuesf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEqualValues(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// NotErrorIsf asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func NotErrorIsf(t TestingT, err error, target error, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotErrorIs(t, err, target, append([]interface{}{msg}, args...)...)
-}
-
-// NotNilf asserts that the specified object is not nil.
-//
-//    assert.NotNilf(t, err, "error message %s", "formatted")
-func NotNilf(t TestingT, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotNil(t, object, append([]interface{}{msg}, args...)...)
-}
-
-// NotPanicsf asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   assert.NotPanicsf(t, func(){ RemainCalm() }, "error message %s", "formatted")
-func NotPanicsf(t TestingT, f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotPanics(t, f, append([]interface{}{msg}, args...)...)
-}
-
-// NotRegexpf asserts that a specified regexp does not match a string.
-//
-//  assert.NotRegexpf(t, regexp.MustCompile("starts"), "it's starting", "error message %s", "formatted")
-//  assert.NotRegexpf(t, "^start", "it's not starting", "error message %s", "formatted")
-func NotRegexpf(t TestingT, rx interface{}, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotRegexp(t, rx, str, append([]interface{}{msg}, args...)...)
-}
-
-// NotSamef asserts that two pointers do not reference the same object.
-//
-//    assert.NotSamef(t, ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func NotSamef(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotSame(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// NotSubsetf asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.NotSubsetf(t, [1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]", "error message %s", "formatted")
-func NotSubsetf(t TestingT, list interface{}, subset interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotSubset(t, list, subset, append([]interface{}{msg}, args...)...)
-}
-
-// NotZerof asserts that i is not the zero value for its type.
-func NotZerof(t TestingT, i interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotZero(t, i, append([]interface{}{msg}, args...)...)
-}
-
-// Panicsf asserts that the code inside the specified PanicTestFunc panics.
-//
-//   assert.Panicsf(t, func(){ GoCrazy() }, "error message %s", "formatted")
-func Panicsf(t TestingT, f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Panics(t, f, append([]interface{}{msg}, args...)...)
-}
-
-// PanicsWithErrorf asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   assert.PanicsWithErrorf(t, "crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func PanicsWithErrorf(t TestingT, errString string, f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return PanicsWithError(t, errString, f, append([]interface{}{msg}, args...)...)
-}
-
-// PanicsWithValuef asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   assert.PanicsWithValuef(t, "crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func PanicsWithValuef(t TestingT, expected interface{}, f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return PanicsWithValue(t, expected, f, append([]interface{}{msg}, args...)...)
-}
-
-// Positivef asserts that the specified element is positive
-//
-//    assert.Positivef(t, 1, "error message %s", "formatted")
-//    assert.Positivef(t, 1.23, "error message %s", "formatted")
-func Positivef(t TestingT, e interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Positive(t, e, append([]interface{}{msg}, args...)...)
-}
-
-// Regexpf asserts that a specified regexp matches a string.
-//
-//  assert.Regexpf(t, regexp.MustCompile("start"), "it's starting", "error message %s", "formatted")
-//  assert.Regexpf(t, "start...$", "it's not starting", "error message %s", "formatted")
-func Regexpf(t TestingT, rx interface{}, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Regexp(t, rx, str, append([]interface{}{msg}, args...)...)
-}
-
-// Samef asserts that two pointers reference the same object.
-//
-//    assert.Samef(t, ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func Samef(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Same(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// Subsetf asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.Subsetf(t, [1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]", "error message %s", "formatted")
-func Subsetf(t TestingT, list interface{}, subset interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Subset(t, list, subset, append([]interface{}{msg}, args...)...)
-}
-
-// Truef asserts that the specified value is true.
-//
-//    assert.Truef(t, myBool, "error message %s", "formatted")
-func Truef(t TestingT, value bool, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return True(t, value, append([]interface{}{msg}, args...)...)
-}
-
-// WithinDurationf asserts that the two times are within duration delta of each other.
-//
-//   assert.WithinDurationf(t, time.Now(), time.Now(), 10*time.Second, "error message %s", "formatted")
-func WithinDurationf(t TestingT, expected time.Time, actual time.Time, delta time.Duration, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return WithinDuration(t, expected, actual, delta, append([]interface{}{msg}, args...)...)
-}
-
-// YAMLEqf asserts that two YAML strings are equivalent.
-func YAMLEqf(t TestingT, expected string, actual string, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return YAMLEq(t, expected, actual, append([]interface{}{msg}, args...)...)
-}
-
-// Zerof asserts that i is the zero value for its type.
-func Zerof(t TestingT, i interface{}, msg string, args ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Zero(t, i, append([]interface{}{msg}, args...)...)
-}
diff --git a/vendor/github.com/stretchr/testify/assert/assertion_format.go.tmpl b/vendor/github.com/stretchr/testify/assert/assertion_format.go.tmpl
deleted file mode 100644
index d2bb0b8177..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertion_format.go.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-{{.CommentFormat}}
-func {{.DocInfo.Name}}f(t TestingT, {{.ParamsFormat}}) bool {
-	if h, ok := t.(tHelper); ok { h.Helper() }
-	return {{.DocInfo.Name}}(t, {{.ForwardedParamsFormat}})
-}
diff --git a/vendor/github.com/stretchr/testify/assert/assertion_forward.go b/vendor/github.com/stretchr/testify/assert/assertion_forward.go
deleted file mode 100644
index 25337a6f07..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertion_forward.go
+++ /dev/null
@@ -1,1470 +0,0 @@
-/*
-* CODE GENERATED AUTOMATICALLY WITH github.com/stretchr/testify/_codegen
-* THIS FILE MUST NOT BE EDITED BY HAND
- */
-
-package assert
-
-import (
-	http "net/http"
-	url "net/url"
-	time "time"
-)
-
-// Condition uses a Comparison to assert a complex condition.
-func (a *Assertions) Condition(comp Comparison, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Condition(a.t, comp, msgAndArgs...)
-}
-
-// Conditionf uses a Comparison to assert a complex condition.
-func (a *Assertions) Conditionf(comp Comparison, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Conditionf(a.t, comp, msg, args...)
-}
-
-// Contains asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    a.Contains("Hello World", "World")
-//    a.Contains(["Hello", "World"], "World")
-//    a.Contains({"Hello": "World"}, "Hello")
-func (a *Assertions) Contains(s interface{}, contains interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Contains(a.t, s, contains, msgAndArgs...)
-}
-
-// Containsf asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    a.Containsf("Hello World", "World", "error message %s", "formatted")
-//    a.Containsf(["Hello", "World"], "World", "error message %s", "formatted")
-//    a.Containsf({"Hello": "World"}, "Hello", "error message %s", "formatted")
-func (a *Assertions) Containsf(s interface{}, contains interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Containsf(a.t, s, contains, msg, args...)
-}
-
-// DirExists checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func (a *Assertions) DirExists(path string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return DirExists(a.t, path, msgAndArgs...)
-}
-
-// DirExistsf checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func (a *Assertions) DirExistsf(path string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return DirExistsf(a.t, path, msg, args...)
-}
-
-// ElementsMatch asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// a.ElementsMatch([1, 3, 2, 3], [1, 3, 3, 2])
-func (a *Assertions) ElementsMatch(listA interface{}, listB interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return ElementsMatch(a.t, listA, listB, msgAndArgs...)
-}
-
-// ElementsMatchf asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// a.ElementsMatchf([1, 3, 2, 3], [1, 3, 3, 2], "error message %s", "formatted")
-func (a *Assertions) ElementsMatchf(listA interface{}, listB interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return ElementsMatchf(a.t, listA, listB, msg, args...)
-}
-
-// Empty asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  a.Empty(obj)
-func (a *Assertions) Empty(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Empty(a.t, object, msgAndArgs...)
-}
-
-// Emptyf asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  a.Emptyf(obj, "error message %s", "formatted")
-func (a *Assertions) Emptyf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Emptyf(a.t, object, msg, args...)
-}
-
-// Equal asserts that two objects are equal.
-//
-//    a.Equal(123, 123)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func (a *Assertions) Equal(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Equal(a.t, expected, actual, msgAndArgs...)
-}
-
-// EqualError asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   a.EqualError(err,  expectedErrorString)
-func (a *Assertions) EqualError(theError error, errString string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return EqualError(a.t, theError, errString, msgAndArgs...)
-}
-
-// EqualErrorf asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   a.EqualErrorf(err,  expectedErrorString, "error message %s", "formatted")
-func (a *Assertions) EqualErrorf(theError error, errString string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return EqualErrorf(a.t, theError, errString, msg, args...)
-}
-
-// EqualValues asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    a.EqualValues(uint32(123), int32(123))
-func (a *Assertions) EqualValues(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return EqualValues(a.t, expected, actual, msgAndArgs...)
-}
-
-// EqualValuesf asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    a.EqualValuesf(uint32(123), int32(123), "error message %s", "formatted")
-func (a *Assertions) EqualValuesf(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return EqualValuesf(a.t, expected, actual, msg, args...)
-}
-
-// Equalf asserts that two objects are equal.
-//
-//    a.Equalf(123, 123, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func (a *Assertions) Equalf(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Equalf(a.t, expected, actual, msg, args...)
-}
-
-// Error asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.Error(err) {
-// 	   assert.Equal(t, expectedError, err)
-//   }
-func (a *Assertions) Error(err error, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Error(a.t, err, msgAndArgs...)
-}
-
-// ErrorAs asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func (a *Assertions) ErrorAs(err error, target interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return ErrorAs(a.t, err, target, msgAndArgs...)
-}
-
-// ErrorAsf asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func (a *Assertions) ErrorAsf(err error, target interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return ErrorAsf(a.t, err, target, msg, args...)
-}
-
-// ErrorIs asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) ErrorIs(err error, target error, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return ErrorIs(a.t, err, target, msgAndArgs...)
-}
-
-// ErrorIsf asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) ErrorIsf(err error, target error, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return ErrorIsf(a.t, err, target, msg, args...)
-}
-
-// Errorf asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.Errorf(err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedErrorf, err)
-//   }
-func (a *Assertions) Errorf(err error, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Errorf(a.t, err, msg, args...)
-}
-
-// Eventually asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    a.Eventually(func() bool { return true; }, time.Second, 10*time.Millisecond)
-func (a *Assertions) Eventually(condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Eventually(a.t, condition, waitFor, tick, msgAndArgs...)
-}
-
-// Eventuallyf asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    a.Eventuallyf(func() bool { return true; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func (a *Assertions) Eventuallyf(condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Eventuallyf(a.t, condition, waitFor, tick, msg, args...)
-}
-
-// Exactly asserts that two objects are equal in value and type.
-//
-//    a.Exactly(int32(123), int64(123))
-func (a *Assertions) Exactly(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Exactly(a.t, expected, actual, msgAndArgs...)
-}
-
-// Exactlyf asserts that two objects are equal in value and type.
-//
-//    a.Exactlyf(int32(123), int64(123), "error message %s", "formatted")
-func (a *Assertions) Exactlyf(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Exactlyf(a.t, expected, actual, msg, args...)
-}
-
-// Fail reports a failure through
-func (a *Assertions) Fail(failureMessage string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Fail(a.t, failureMessage, msgAndArgs...)
-}
-
-// FailNow fails test
-func (a *Assertions) FailNow(failureMessage string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return FailNow(a.t, failureMessage, msgAndArgs...)
-}
-
-// FailNowf fails test
-func (a *Assertions) FailNowf(failureMessage string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return FailNowf(a.t, failureMessage, msg, args...)
-}
-
-// Failf reports a failure through
-func (a *Assertions) Failf(failureMessage string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Failf(a.t, failureMessage, msg, args...)
-}
-
-// False asserts that the specified value is false.
-//
-//    a.False(myBool)
-func (a *Assertions) False(value bool, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return False(a.t, value, msgAndArgs...)
-}
-
-// Falsef asserts that the specified value is false.
-//
-//    a.Falsef(myBool, "error message %s", "formatted")
-func (a *Assertions) Falsef(value bool, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Falsef(a.t, value, msg, args...)
-}
-
-// FileExists checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func (a *Assertions) FileExists(path string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return FileExists(a.t, path, msgAndArgs...)
-}
-
-// FileExistsf checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func (a *Assertions) FileExistsf(path string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return FileExistsf(a.t, path, msg, args...)
-}
-
-// Greater asserts that the first element is greater than the second
-//
-//    a.Greater(2, 1)
-//    a.Greater(float64(2), float64(1))
-//    a.Greater("b", "a")
-func (a *Assertions) Greater(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Greater(a.t, e1, e2, msgAndArgs...)
-}
-
-// GreaterOrEqual asserts that the first element is greater than or equal to the second
-//
-//    a.GreaterOrEqual(2, 1)
-//    a.GreaterOrEqual(2, 2)
-//    a.GreaterOrEqual("b", "a")
-//    a.GreaterOrEqual("b", "b")
-func (a *Assertions) GreaterOrEqual(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return GreaterOrEqual(a.t, e1, e2, msgAndArgs...)
-}
-
-// GreaterOrEqualf asserts that the first element is greater than or equal to the second
-//
-//    a.GreaterOrEqualf(2, 1, "error message %s", "formatted")
-//    a.GreaterOrEqualf(2, 2, "error message %s", "formatted")
-//    a.GreaterOrEqualf("b", "a", "error message %s", "formatted")
-//    a.GreaterOrEqualf("b", "b", "error message %s", "formatted")
-func (a *Assertions) GreaterOrEqualf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return GreaterOrEqualf(a.t, e1, e2, msg, args...)
-}
-
-// Greaterf asserts that the first element is greater than the second
-//
-//    a.Greaterf(2, 1, "error message %s", "formatted")
-//    a.Greaterf(float64(2), float64(1), "error message %s", "formatted")
-//    a.Greaterf("b", "a", "error message %s", "formatted")
-func (a *Assertions) Greaterf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Greaterf(a.t, e1, e2, msg, args...)
-}
-
-// HTTPBodyContains asserts that a specified handler returns a
-// body that contains a string.
-//
-//  a.HTTPBodyContains(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyContains(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPBodyContains(a.t, handler, method, url, values, str, msgAndArgs...)
-}
-
-// HTTPBodyContainsf asserts that a specified handler returns a
-// body that contains a string.
-//
-//  a.HTTPBodyContainsf(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyContainsf(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPBodyContainsf(a.t, handler, method, url, values, str, msg, args...)
-}
-
-// HTTPBodyNotContains asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  a.HTTPBodyNotContains(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyNotContains(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPBodyNotContains(a.t, handler, method, url, values, str, msgAndArgs...)
-}
-
-// HTTPBodyNotContainsf asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  a.HTTPBodyNotContainsf(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyNotContainsf(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPBodyNotContainsf(a.t, handler, method, url, values, str, msg, args...)
-}
-
-// HTTPError asserts that a specified handler returns an error status code.
-//
-//  a.HTTPError(myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPError(handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPError(a.t, handler, method, url, values, msgAndArgs...)
-}
-
-// HTTPErrorf asserts that a specified handler returns an error status code.
-//
-//  a.HTTPErrorf(myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPErrorf(handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPErrorf(a.t, handler, method, url, values, msg, args...)
-}
-
-// HTTPRedirect asserts that a specified handler returns a redirect status code.
-//
-//  a.HTTPRedirect(myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPRedirect(handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPRedirect(a.t, handler, method, url, values, msgAndArgs...)
-}
-
-// HTTPRedirectf asserts that a specified handler returns a redirect status code.
-//
-//  a.HTTPRedirectf(myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPRedirectf(handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPRedirectf(a.t, handler, method, url, values, msg, args...)
-}
-
-// HTTPStatusCode asserts that a specified handler returns a specified status code.
-//
-//  a.HTTPStatusCode(myHandler, "GET", "/notImplemented", nil, 501)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPStatusCode(handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPStatusCode(a.t, handler, method, url, values, statuscode, msgAndArgs...)
-}
-
-// HTTPStatusCodef asserts that a specified handler returns a specified status code.
-//
-//  a.HTTPStatusCodef(myHandler, "GET", "/notImplemented", nil, 501, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPStatusCodef(handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPStatusCodef(a.t, handler, method, url, values, statuscode, msg, args...)
-}
-
-// HTTPSuccess asserts that a specified handler returns a success status code.
-//
-//  a.HTTPSuccess(myHandler, "POST", "http://www.google.com", nil)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPSuccess(handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPSuccess(a.t, handler, method, url, values, msgAndArgs...)
-}
-
-// HTTPSuccessf asserts that a specified handler returns a success status code.
-//
-//  a.HTTPSuccessf(myHandler, "POST", "http://www.google.com", nil, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPSuccessf(handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return HTTPSuccessf(a.t, handler, method, url, values, msg, args...)
-}
-
-// Implements asserts that an object is implemented by the specified interface.
-//
-//    a.Implements((*MyInterface)(nil), new(MyObject))
-func (a *Assertions) Implements(interfaceObject interface{}, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Implements(a.t, interfaceObject, object, msgAndArgs...)
-}
-
-// Implementsf asserts that an object is implemented by the specified interface.
-//
-//    a.Implementsf((*MyInterface)(nil), new(MyObject), "error message %s", "formatted")
-func (a *Assertions) Implementsf(interfaceObject interface{}, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Implementsf(a.t, interfaceObject, object, msg, args...)
-}
-
-// InDelta asserts that the two numerals are within delta of each other.
-//
-// 	 a.InDelta(math.Pi, 22/7.0, 0.01)
-func (a *Assertions) InDelta(expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDelta(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// InDeltaMapValues is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func (a *Assertions) InDeltaMapValues(expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaMapValues(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// InDeltaMapValuesf is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func (a *Assertions) InDeltaMapValuesf(expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaMapValuesf(a.t, expected, actual, delta, msg, args...)
-}
-
-// InDeltaSlice is the same as InDelta, except it compares two slices.
-func (a *Assertions) InDeltaSlice(expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaSlice(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// InDeltaSlicef is the same as InDelta, except it compares two slices.
-func (a *Assertions) InDeltaSlicef(expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaSlicef(a.t, expected, actual, delta, msg, args...)
-}
-
-// InDeltaf asserts that the two numerals are within delta of each other.
-//
-// 	 a.InDeltaf(math.Pi, 22/7.0, 0.01, "error message %s", "formatted")
-func (a *Assertions) InDeltaf(expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InDeltaf(a.t, expected, actual, delta, msg, args...)
-}
-
-// InEpsilon asserts that expected and actual have a relative error less than epsilon
-func (a *Assertions) InEpsilon(expected interface{}, actual interface{}, epsilon float64, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InEpsilon(a.t, expected, actual, epsilon, msgAndArgs...)
-}
-
-// InEpsilonSlice is the same as InEpsilon, except it compares each value from two slices.
-func (a *Assertions) InEpsilonSlice(expected interface{}, actual interface{}, epsilon float64, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InEpsilonSlice(a.t, expected, actual, epsilon, msgAndArgs...)
-}
-
-// InEpsilonSlicef is the same as InEpsilon, except it compares each value from two slices.
-func (a *Assertions) InEpsilonSlicef(expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InEpsilonSlicef(a.t, expected, actual, epsilon, msg, args...)
-}
-
-// InEpsilonf asserts that expected and actual have a relative error less than epsilon
-func (a *Assertions) InEpsilonf(expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return InEpsilonf(a.t, expected, actual, epsilon, msg, args...)
-}
-
-// IsDecreasing asserts that the collection is decreasing
-//
-//    a.IsDecreasing([]int{2, 1, 0})
-//    a.IsDecreasing([]float{2, 1})
-//    a.IsDecreasing([]string{"b", "a"})
-func (a *Assertions) IsDecreasing(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsDecreasing(a.t, object, msgAndArgs...)
-}
-
-// IsDecreasingf asserts that the collection is decreasing
-//
-//    a.IsDecreasingf([]int{2, 1, 0}, "error message %s", "formatted")
-//    a.IsDecreasingf([]float{2, 1}, "error message %s", "formatted")
-//    a.IsDecreasingf([]string{"b", "a"}, "error message %s", "formatted")
-func (a *Assertions) IsDecreasingf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsDecreasingf(a.t, object, msg, args...)
-}
-
-// IsIncreasing asserts that the collection is increasing
-//
-//    a.IsIncreasing([]int{1, 2, 3})
-//    a.IsIncreasing([]float{1, 2})
-//    a.IsIncreasing([]string{"a", "b"})
-func (a *Assertions) IsIncreasing(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsIncreasing(a.t, object, msgAndArgs...)
-}
-
-// IsIncreasingf asserts that the collection is increasing
-//
-//    a.IsIncreasingf([]int{1, 2, 3}, "error message %s", "formatted")
-//    a.IsIncreasingf([]float{1, 2}, "error message %s", "formatted")
-//    a.IsIncreasingf([]string{"a", "b"}, "error message %s", "formatted")
-func (a *Assertions) IsIncreasingf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsIncreasingf(a.t, object, msg, args...)
-}
-
-// IsNonDecreasing asserts that the collection is not decreasing
-//
-//    a.IsNonDecreasing([]int{1, 1, 2})
-//    a.IsNonDecreasing([]float{1, 2})
-//    a.IsNonDecreasing([]string{"a", "b"})
-func (a *Assertions) IsNonDecreasing(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsNonDecreasing(a.t, object, msgAndArgs...)
-}
-
-// IsNonDecreasingf asserts that the collection is not decreasing
-//
-//    a.IsNonDecreasingf([]int{1, 1, 2}, "error message %s", "formatted")
-//    a.IsNonDecreasingf([]float{1, 2}, "error message %s", "formatted")
-//    a.IsNonDecreasingf([]string{"a", "b"}, "error message %s", "formatted")
-func (a *Assertions) IsNonDecreasingf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsNonDecreasingf(a.t, object, msg, args...)
-}
-
-// IsNonIncreasing asserts that the collection is not increasing
-//
-//    a.IsNonIncreasing([]int{2, 1, 1})
-//    a.IsNonIncreasing([]float{2, 1})
-//    a.IsNonIncreasing([]string{"b", "a"})
-func (a *Assertions) IsNonIncreasing(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsNonIncreasing(a.t, object, msgAndArgs...)
-}
-
-// IsNonIncreasingf asserts that the collection is not increasing
-//
-//    a.IsNonIncreasingf([]int{2, 1, 1}, "error message %s", "formatted")
-//    a.IsNonIncreasingf([]float{2, 1}, "error message %s", "formatted")
-//    a.IsNonIncreasingf([]string{"b", "a"}, "error message %s", "formatted")
-func (a *Assertions) IsNonIncreasingf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsNonIncreasingf(a.t, object, msg, args...)
-}
-
-// IsType asserts that the specified objects are of the same type.
-func (a *Assertions) IsType(expectedType interface{}, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsType(a.t, expectedType, object, msgAndArgs...)
-}
-
-// IsTypef asserts that the specified objects are of the same type.
-func (a *Assertions) IsTypef(expectedType interface{}, object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return IsTypef(a.t, expectedType, object, msg, args...)
-}
-
-// JSONEq asserts that two JSON strings are equivalent.
-//
-//  a.JSONEq(`{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`)
-func (a *Assertions) JSONEq(expected string, actual string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return JSONEq(a.t, expected, actual, msgAndArgs...)
-}
-
-// JSONEqf asserts that two JSON strings are equivalent.
-//
-//  a.JSONEqf(`{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`, "error message %s", "formatted")
-func (a *Assertions) JSONEqf(expected string, actual string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return JSONEqf(a.t, expected, actual, msg, args...)
-}
-
-// Len asserts that the specified object has specific length.
-// Len also fails if the object has a type that len() not accept.
-//
-//    a.Len(mySlice, 3)
-func (a *Assertions) Len(object interface{}, length int, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Len(a.t, object, length, msgAndArgs...)
-}
-
-// Lenf asserts that the specified object has specific length.
-// Lenf also fails if the object has a type that len() not accept.
-//
-//    a.Lenf(mySlice, 3, "error message %s", "formatted")
-func (a *Assertions) Lenf(object interface{}, length int, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Lenf(a.t, object, length, msg, args...)
-}
-
-// Less asserts that the first element is less than the second
-//
-//    a.Less(1, 2)
-//    a.Less(float64(1), float64(2))
-//    a.Less("a", "b")
-func (a *Assertions) Less(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Less(a.t, e1, e2, msgAndArgs...)
-}
-
-// LessOrEqual asserts that the first element is less than or equal to the second
-//
-//    a.LessOrEqual(1, 2)
-//    a.LessOrEqual(2, 2)
-//    a.LessOrEqual("a", "b")
-//    a.LessOrEqual("b", "b")
-func (a *Assertions) LessOrEqual(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return LessOrEqual(a.t, e1, e2, msgAndArgs...)
-}
-
-// LessOrEqualf asserts that the first element is less than or equal to the second
-//
-//    a.LessOrEqualf(1, 2, "error message %s", "formatted")
-//    a.LessOrEqualf(2, 2, "error message %s", "formatted")
-//    a.LessOrEqualf("a", "b", "error message %s", "formatted")
-//    a.LessOrEqualf("b", "b", "error message %s", "formatted")
-func (a *Assertions) LessOrEqualf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return LessOrEqualf(a.t, e1, e2, msg, args...)
-}
-
-// Lessf asserts that the first element is less than the second
-//
-//    a.Lessf(1, 2, "error message %s", "formatted")
-//    a.Lessf(float64(1), float64(2), "error message %s", "formatted")
-//    a.Lessf("a", "b", "error message %s", "formatted")
-func (a *Assertions) Lessf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Lessf(a.t, e1, e2, msg, args...)
-}
-
-// Negative asserts that the specified element is negative
-//
-//    a.Negative(-1)
-//    a.Negative(-1.23)
-func (a *Assertions) Negative(e interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Negative(a.t, e, msgAndArgs...)
-}
-
-// Negativef asserts that the specified element is negative
-//
-//    a.Negativef(-1, "error message %s", "formatted")
-//    a.Negativef(-1.23, "error message %s", "formatted")
-func (a *Assertions) Negativef(e interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Negativef(a.t, e, msg, args...)
-}
-
-// Never asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    a.Never(func() bool { return false; }, time.Second, 10*time.Millisecond)
-func (a *Assertions) Never(condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Never(a.t, condition, waitFor, tick, msgAndArgs...)
-}
-
-// Neverf asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    a.Neverf(func() bool { return false; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func (a *Assertions) Neverf(condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Neverf(a.t, condition, waitFor, tick, msg, args...)
-}
-
-// Nil asserts that the specified object is nil.
-//
-//    a.Nil(err)
-func (a *Assertions) Nil(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Nil(a.t, object, msgAndArgs...)
-}
-
-// Nilf asserts that the specified object is nil.
-//
-//    a.Nilf(err, "error message %s", "formatted")
-func (a *Assertions) Nilf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Nilf(a.t, object, msg, args...)
-}
-
-// NoDirExists checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func (a *Assertions) NoDirExists(path string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoDirExists(a.t, path, msgAndArgs...)
-}
-
-// NoDirExistsf checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func (a *Assertions) NoDirExistsf(path string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoDirExistsf(a.t, path, msg, args...)
-}
-
-// NoError asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.NoError(err) {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func (a *Assertions) NoError(err error, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoError(a.t, err, msgAndArgs...)
-}
-
-// NoErrorf asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.NoErrorf(err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func (a *Assertions) NoErrorf(err error, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoErrorf(a.t, err, msg, args...)
-}
-
-// NoFileExists checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func (a *Assertions) NoFileExists(path string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoFileExists(a.t, path, msgAndArgs...)
-}
-
-// NoFileExistsf checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func (a *Assertions) NoFileExistsf(path string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NoFileExistsf(a.t, path, msg, args...)
-}
-
-// NotContains asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    a.NotContains("Hello World", "Earth")
-//    a.NotContains(["Hello", "World"], "Earth")
-//    a.NotContains({"Hello": "World"}, "Earth")
-func (a *Assertions) NotContains(s interface{}, contains interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotContains(a.t, s, contains, msgAndArgs...)
-}
-
-// NotContainsf asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    a.NotContainsf("Hello World", "Earth", "error message %s", "formatted")
-//    a.NotContainsf(["Hello", "World"], "Earth", "error message %s", "formatted")
-//    a.NotContainsf({"Hello": "World"}, "Earth", "error message %s", "formatted")
-func (a *Assertions) NotContainsf(s interface{}, contains interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotContainsf(a.t, s, contains, msg, args...)
-}
-
-// NotEmpty asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if a.NotEmpty(obj) {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func (a *Assertions) NotEmpty(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEmpty(a.t, object, msgAndArgs...)
-}
-
-// NotEmptyf asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if a.NotEmptyf(obj, "error message %s", "formatted") {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func (a *Assertions) NotEmptyf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEmptyf(a.t, object, msg, args...)
-}
-
-// NotEqual asserts that the specified values are NOT equal.
-//
-//    a.NotEqual(obj1, obj2)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func (a *Assertions) NotEqual(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEqual(a.t, expected, actual, msgAndArgs...)
-}
-
-// NotEqualValues asserts that two objects are not equal even when converted to the same type
-//
-//    a.NotEqualValues(obj1, obj2)
-func (a *Assertions) NotEqualValues(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEqualValues(a.t, expected, actual, msgAndArgs...)
-}
-
-// NotEqualValuesf asserts that two objects are not equal even when converted to the same type
-//
-//    a.NotEqualValuesf(obj1, obj2, "error message %s", "formatted")
-func (a *Assertions) NotEqualValuesf(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEqualValuesf(a.t, expected, actual, msg, args...)
-}
-
-// NotEqualf asserts that the specified values are NOT equal.
-//
-//    a.NotEqualf(obj1, obj2, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func (a *Assertions) NotEqualf(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotEqualf(a.t, expected, actual, msg, args...)
-}
-
-// NotErrorIs asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) NotErrorIs(err error, target error, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotErrorIs(a.t, err, target, msgAndArgs...)
-}
-
-// NotErrorIsf asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) NotErrorIsf(err error, target error, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotErrorIsf(a.t, err, target, msg, args...)
-}
-
-// NotNil asserts that the specified object is not nil.
-//
-//    a.NotNil(err)
-func (a *Assertions) NotNil(object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotNil(a.t, object, msgAndArgs...)
-}
-
-// NotNilf asserts that the specified object is not nil.
-//
-//    a.NotNilf(err, "error message %s", "formatted")
-func (a *Assertions) NotNilf(object interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotNilf(a.t, object, msg, args...)
-}
-
-// NotPanics asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   a.NotPanics(func(){ RemainCalm() })
-func (a *Assertions) NotPanics(f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotPanics(a.t, f, msgAndArgs...)
-}
-
-// NotPanicsf asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   a.NotPanicsf(func(){ RemainCalm() }, "error message %s", "formatted")
-func (a *Assertions) NotPanicsf(f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotPanicsf(a.t, f, msg, args...)
-}
-
-// NotRegexp asserts that a specified regexp does not match a string.
-//
-//  a.NotRegexp(regexp.MustCompile("starts"), "it's starting")
-//  a.NotRegexp("^start", "it's not starting")
-func (a *Assertions) NotRegexp(rx interface{}, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotRegexp(a.t, rx, str, msgAndArgs...)
-}
-
-// NotRegexpf asserts that a specified regexp does not match a string.
-//
-//  a.NotRegexpf(regexp.MustCompile("starts"), "it's starting", "error message %s", "formatted")
-//  a.NotRegexpf("^start", "it's not starting", "error message %s", "formatted")
-func (a *Assertions) NotRegexpf(rx interface{}, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotRegexpf(a.t, rx, str, msg, args...)
-}
-
-// NotSame asserts that two pointers do not reference the same object.
-//
-//    a.NotSame(ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) NotSame(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotSame(a.t, expected, actual, msgAndArgs...)
-}
-
-// NotSamef asserts that two pointers do not reference the same object.
-//
-//    a.NotSamef(ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) NotSamef(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotSamef(a.t, expected, actual, msg, args...)
-}
-
-// NotSubset asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    a.NotSubset([1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]")
-func (a *Assertions) NotSubset(list interface{}, subset interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotSubset(a.t, list, subset, msgAndArgs...)
-}
-
-// NotSubsetf asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    a.NotSubsetf([1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]", "error message %s", "formatted")
-func (a *Assertions) NotSubsetf(list interface{}, subset interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotSubsetf(a.t, list, subset, msg, args...)
-}
-
-// NotZero asserts that i is not the zero value for its type.
-func (a *Assertions) NotZero(i interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotZero(a.t, i, msgAndArgs...)
-}
-
-// NotZerof asserts that i is not the zero value for its type.
-func (a *Assertions) NotZerof(i interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return NotZerof(a.t, i, msg, args...)
-}
-
-// Panics asserts that the code inside the specified PanicTestFunc panics.
-//
-//   a.Panics(func(){ GoCrazy() })
-func (a *Assertions) Panics(f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Panics(a.t, f, msgAndArgs...)
-}
-
-// PanicsWithError asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   a.PanicsWithError("crazy error", func(){ GoCrazy() })
-func (a *Assertions) PanicsWithError(errString string, f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return PanicsWithError(a.t, errString, f, msgAndArgs...)
-}
-
-// PanicsWithErrorf asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   a.PanicsWithErrorf("crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func (a *Assertions) PanicsWithErrorf(errString string, f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return PanicsWithErrorf(a.t, errString, f, msg, args...)
-}
-
-// PanicsWithValue asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   a.PanicsWithValue("crazy error", func(){ GoCrazy() })
-func (a *Assertions) PanicsWithValue(expected interface{}, f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return PanicsWithValue(a.t, expected, f, msgAndArgs...)
-}
-
-// PanicsWithValuef asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   a.PanicsWithValuef("crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func (a *Assertions) PanicsWithValuef(expected interface{}, f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return PanicsWithValuef(a.t, expected, f, msg, args...)
-}
-
-// Panicsf asserts that the code inside the specified PanicTestFunc panics.
-//
-//   a.Panicsf(func(){ GoCrazy() }, "error message %s", "formatted")
-func (a *Assertions) Panicsf(f PanicTestFunc, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Panicsf(a.t, f, msg, args...)
-}
-
-// Positive asserts that the specified element is positive
-//
-//    a.Positive(1)
-//    a.Positive(1.23)
-func (a *Assertions) Positive(e interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Positive(a.t, e, msgAndArgs...)
-}
-
-// Positivef asserts that the specified element is positive
-//
-//    a.Positivef(1, "error message %s", "formatted")
-//    a.Positivef(1.23, "error message %s", "formatted")
-func (a *Assertions) Positivef(e interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Positivef(a.t, e, msg, args...)
-}
-
-// Regexp asserts that a specified regexp matches a string.
-//
-//  a.Regexp(regexp.MustCompile("start"), "it's starting")
-//  a.Regexp("start...$", "it's not starting")
-func (a *Assertions) Regexp(rx interface{}, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Regexp(a.t, rx, str, msgAndArgs...)
-}
-
-// Regexpf asserts that a specified regexp matches a string.
-//
-//  a.Regexpf(regexp.MustCompile("start"), "it's starting", "error message %s", "formatted")
-//  a.Regexpf("start...$", "it's not starting", "error message %s", "formatted")
-func (a *Assertions) Regexpf(rx interface{}, str interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Regexpf(a.t, rx, str, msg, args...)
-}
-
-// Same asserts that two pointers reference the same object.
-//
-//    a.Same(ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) Same(expected interface{}, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Same(a.t, expected, actual, msgAndArgs...)
-}
-
-// Samef asserts that two pointers reference the same object.
-//
-//    a.Samef(ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) Samef(expected interface{}, actual interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Samef(a.t, expected, actual, msg, args...)
-}
-
-// Subset asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    a.Subset([1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]")
-func (a *Assertions) Subset(list interface{}, subset interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Subset(a.t, list, subset, msgAndArgs...)
-}
-
-// Subsetf asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    a.Subsetf([1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]", "error message %s", "formatted")
-func (a *Assertions) Subsetf(list interface{}, subset interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Subsetf(a.t, list, subset, msg, args...)
-}
-
-// True asserts that the specified value is true.
-//
-//    a.True(myBool)
-func (a *Assertions) True(value bool, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return True(a.t, value, msgAndArgs...)
-}
-
-// Truef asserts that the specified value is true.
-//
-//    a.Truef(myBool, "error message %s", "formatted")
-func (a *Assertions) Truef(value bool, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Truef(a.t, value, msg, args...)
-}
-
-// WithinDuration asserts that the two times are within duration delta of each other.
-//
-//   a.WithinDuration(time.Now(), time.Now(), 10*time.Second)
-func (a *Assertions) WithinDuration(expected time.Time, actual time.Time, delta time.Duration, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return WithinDuration(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// WithinDurationf asserts that the two times are within duration delta of each other.
-//
-//   a.WithinDurationf(time.Now(), time.Now(), 10*time.Second, "error message %s", "formatted")
-func (a *Assertions) WithinDurationf(expected time.Time, actual time.Time, delta time.Duration, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return WithinDurationf(a.t, expected, actual, delta, msg, args...)
-}
-
-// YAMLEq asserts that two YAML strings are equivalent.
-func (a *Assertions) YAMLEq(expected string, actual string, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return YAMLEq(a.t, expected, actual, msgAndArgs...)
-}
-
-// YAMLEqf asserts that two YAML strings are equivalent.
-func (a *Assertions) YAMLEqf(expected string, actual string, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return YAMLEqf(a.t, expected, actual, msg, args...)
-}
-
-// Zero asserts that i is the zero value for its type.
-func (a *Assertions) Zero(i interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Zero(a.t, i, msgAndArgs...)
-}
-
-// Zerof asserts that i is the zero value for its type.
-func (a *Assertions) Zerof(i interface{}, msg string, args ...interface{}) bool {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	return Zerof(a.t, i, msg, args...)
-}
diff --git a/vendor/github.com/stretchr/testify/assert/assertion_forward.go.tmpl b/vendor/github.com/stretchr/testify/assert/assertion_forward.go.tmpl
deleted file mode 100644
index 188bb9e174..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertion_forward.go.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-{{.CommentWithoutT "a"}}
-func (a *Assertions) {{.DocInfo.Name}}({{.Params}}) bool {
-	if h, ok := a.t.(tHelper); ok { h.Helper() }
-	return {{.DocInfo.Name}}(a.t, {{.ForwardedParams}})
-}
diff --git a/vendor/github.com/stretchr/testify/assert/assertion_order.go b/vendor/github.com/stretchr/testify/assert/assertion_order.go
deleted file mode 100644
index 1c3b47182a..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertion_order.go
+++ /dev/null
@@ -1,81 +0,0 @@
-package assert
-
-import (
-	"fmt"
-	"reflect"
-)
-
-// isOrdered checks that collection contains orderable elements.
-func isOrdered(t TestingT, object interface{}, allowedComparesResults []CompareType, failMessage string, msgAndArgs ...interface{}) bool {
-	objKind := reflect.TypeOf(object).Kind()
-	if objKind != reflect.Slice && objKind != reflect.Array {
-		return false
-	}
-
-	objValue := reflect.ValueOf(object)
-	objLen := objValue.Len()
-
-	if objLen <= 1 {
-		return true
-	}
-
-	value := objValue.Index(0)
-	valueInterface := value.Interface()
-	firstValueKind := value.Kind()
-
-	for i := 1; i < objLen; i++ {
-		prevValue := value
-		prevValueInterface := valueInterface
-
-		value = objValue.Index(i)
-		valueInterface = value.Interface()
-
-		compareResult, isComparable := compare(prevValueInterface, valueInterface, firstValueKind)
-
-		if !isComparable {
-			return Fail(t, fmt.Sprintf("Can not compare type \"%s\" and \"%s\"", reflect.TypeOf(value), reflect.TypeOf(prevValue)), msgAndArgs...)
-		}
-
-		if !containsValue(allowedComparesResults, compareResult) {
-			return Fail(t, fmt.Sprintf(failMessage, prevValue, value), msgAndArgs...)
-		}
-	}
-
-	return true
-}
-
-// IsIncreasing asserts that the collection is increasing
-//
-//    assert.IsIncreasing(t, []int{1, 2, 3})
-//    assert.IsIncreasing(t, []float{1, 2})
-//    assert.IsIncreasing(t, []string{"a", "b"})
-func IsIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	return isOrdered(t, object, []CompareType{compareLess}, "\"%v\" is not less than \"%v\"", msgAndArgs)
-}
-
-// IsNonIncreasing asserts that the collection is not increasing
-//
-//    assert.IsNonIncreasing(t, []int{2, 1, 1})
-//    assert.IsNonIncreasing(t, []float{2, 1})
-//    assert.IsNonIncreasing(t, []string{"b", "a"})
-func IsNonIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	return isOrdered(t, object, []CompareType{compareEqual, compareGreater}, "\"%v\" is not greater than or equal to \"%v\"", msgAndArgs)
-}
-
-// IsDecreasing asserts that the collection is decreasing
-//
-//    assert.IsDecreasing(t, []int{2, 1, 0})
-//    assert.IsDecreasing(t, []float{2, 1})
-//    assert.IsDecreasing(t, []string{"b", "a"})
-func IsDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	return isOrdered(t, object, []CompareType{compareGreater}, "\"%v\" is not greater than \"%v\"", msgAndArgs)
-}
-
-// IsNonDecreasing asserts that the collection is not decreasing
-//
-//    assert.IsNonDecreasing(t, []int{1, 1, 2})
-//    assert.IsNonDecreasing(t, []float{1, 2})
-//    assert.IsNonDecreasing(t, []string{"a", "b"})
-func IsNonDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	return isOrdered(t, object, []CompareType{compareLess, compareEqual}, "\"%v\" is not less than or equal to \"%v\"", msgAndArgs)
-}
diff --git a/vendor/github.com/stretchr/testify/assert/assertions.go b/vendor/github.com/stretchr/testify/assert/assertions.go
deleted file mode 100644
index bcac4401f5..0000000000
--- a/vendor/github.com/stretchr/testify/assert/assertions.go
+++ /dev/null
@@ -1,1774 +0,0 @@
-package assert
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"math"
-	"os"
-	"reflect"
-	"regexp"
-	"runtime"
-	"runtime/debug"
-	"strings"
-	"time"
-	"unicode"
-	"unicode/utf8"
-
-	"github.com/davecgh/go-spew/spew"
-	"github.com/pmezard/go-difflib/difflib"
-	yaml "gopkg.in/yaml.v3"
-)
-
-//go:generate sh -c "cd ../_codegen && go build && cd - && ../_codegen/_codegen -output-package=assert -template=assertion_format.go.tmpl"
-
-// TestingT is an interface wrapper around *testing.T
-type TestingT interface {
-	Errorf(format string, args ...interface{})
-}
-
-// ComparisonAssertionFunc is a common function prototype when comparing two values.  Can be useful
-// for table driven tests.
-type ComparisonAssertionFunc func(TestingT, interface{}, interface{}, ...interface{}) bool
-
-// ValueAssertionFunc is a common function prototype when validating a single value.  Can be useful
-// for table driven tests.
-type ValueAssertionFunc func(TestingT, interface{}, ...interface{}) bool
-
-// BoolAssertionFunc is a common function prototype when validating a bool value.  Can be useful
-// for table driven tests.
-type BoolAssertionFunc func(TestingT, bool, ...interface{}) bool
-
-// ErrorAssertionFunc is a common function prototype when validating an error value.  Can be useful
-// for table driven tests.
-type ErrorAssertionFunc func(TestingT, error, ...interface{}) bool
-
-// Comparison is a custom function that returns true on success and false on failure
-type Comparison func() (success bool)
-
-/*
-	Helper functions
-*/
-
-// ObjectsAreEqual determines if two objects are considered equal.
-//
-// This function does no assertion of any kind.
-func ObjectsAreEqual(expected, actual interface{}) bool {
-	if expected == nil || actual == nil {
-		return expected == actual
-	}
-
-	exp, ok := expected.([]byte)
-	if !ok {
-		return reflect.DeepEqual(expected, actual)
-	}
-
-	act, ok := actual.([]byte)
-	if !ok {
-		return false
-	}
-	if exp == nil || act == nil {
-		return exp == nil && act == nil
-	}
-	return bytes.Equal(exp, act)
-}
-
-// ObjectsAreEqualValues gets whether two objects are equal, or if their
-// values are equal.
-func ObjectsAreEqualValues(expected, actual interface{}) bool {
-	if ObjectsAreEqual(expected, actual) {
-		return true
-	}
-
-	actualType := reflect.TypeOf(actual)
-	if actualType == nil {
-		return false
-	}
-	expectedValue := reflect.ValueOf(expected)
-	if expectedValue.IsValid() && expectedValue.Type().ConvertibleTo(actualType) {
-		// Attempt comparison after type conversion
-		return reflect.DeepEqual(expectedValue.Convert(actualType).Interface(), actual)
-	}
-
-	return false
-}
-
-/* CallerInfo is necessary because the assert functions use the testing object
-internally, causing it to print the file:line of the assert method, rather than where
-the problem actually occurred in calling code.*/
-
-// CallerInfo returns an array of strings containing the file and line number
-// of each stack frame leading from the current test to the assert call that
-// failed.
-func CallerInfo() []string {
-
-	var pc uintptr
-	var ok bool
-	var file string
-	var line int
-	var name string
-
-	callers := []string{}
-	for i := 0; ; i++ {
-		pc, file, line, ok = runtime.Caller(i)
-		if !ok {
-			// The breaks below failed to terminate the loop, and we ran off the
-			// end of the call stack.
-			break
-		}
-
-		// This is a huge edge case, but it will panic if this is the case, see #180
-		if file == "<autogenerated>" {
-			break
-		}
-
-		f := runtime.FuncForPC(pc)
-		if f == nil {
-			break
-		}
-		name = f.Name()
-
-		// testing.tRunner is the standard library function that calls
-		// tests. Subtests are called directly by tRunner, without going through
-		// the Test/Benchmark/Example function that contains the t.Run calls, so
-		// with subtests we should break when we hit tRunner, without adding it
-		// to the list of callers.
-		if name == "testing.tRunner" {
-			break
-		}
-
-		parts := strings.Split(file, "/")
-		file = parts[len(parts)-1]
-		if len(parts) > 1 {
-			dir := parts[len(parts)-2]
-			if (dir != "assert" && dir != "mock" && dir != "require") || file == "mock_test.go" {
-				callers = append(callers, fmt.Sprintf("%s:%d", file, line))
-			}
-		}
-
-		// Drop the package
-		segments := strings.Split(name, ".")
-		name = segments[len(segments)-1]
-		if isTest(name, "Test") ||
-			isTest(name, "Benchmark") ||
-			isTest(name, "Example") {
-			break
-		}
-	}
-
-	return callers
-}
-
-// Stolen from the `go test` tool.
-// isTest tells whether name looks like a test (or benchmark, according to prefix).
-// It is a Test (say) if there is a character after Test that is not a lower-case letter.
-// We don't want TesticularCancer.
-func isTest(name, prefix string) bool {
-	if !strings.HasPrefix(name, prefix) {
-		return false
-	}
-	if len(name) == len(prefix) { // "Test" is ok
-		return true
-	}
-	r, _ := utf8.DecodeRuneInString(name[len(prefix):])
-	return !unicode.IsLower(r)
-}
-
-func messageFromMsgAndArgs(msgAndArgs ...interface{}) string {
-	if len(msgAndArgs) == 0 || msgAndArgs == nil {
-		return ""
-	}
-	if len(msgAndArgs) == 1 {
-		msg := msgAndArgs[0]
-		if msgAsStr, ok := msg.(string); ok {
-			return msgAsStr
-		}
-		return fmt.Sprintf("%+v", msg)
-	}
-	if len(msgAndArgs) > 1 {
-		return fmt.Sprintf(msgAndArgs[0].(string), msgAndArgs[1:]...)
-	}
-	return ""
-}
-
-// Aligns the provided message so that all lines after the first line start at the same location as the first line.
-// Assumes that the first line starts at the correct location (after carriage return, tab, label, spacer and tab).
-// The longestLabelLen parameter specifies the length of the longest label in the output (required becaues this is the
-// basis on which the alignment occurs).
-func indentMessageLines(message string, longestLabelLen int) string {
-	outBuf := new(bytes.Buffer)
-
-	for i, scanner := 0, bufio.NewScanner(strings.NewReader(message)); scanner.Scan(); i++ {
-		// no need to align first line because it starts at the correct location (after the label)
-		if i != 0 {
-			// append alignLen+1 spaces to align with "{{longestLabel}}:" before adding tab
-			outBuf.WriteString("\n\t" + strings.Repeat(" ", longestLabelLen+1) + "\t")
-		}
-		outBuf.WriteString(scanner.Text())
-	}
-
-	return outBuf.String()
-}
-
-type failNower interface {
-	FailNow()
-}
-
-// FailNow fails test
-func FailNow(t TestingT, failureMessage string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	Fail(t, failureMessage, msgAndArgs...)
-
-	// We cannot extend TestingT with FailNow() and
-	// maintain backwards compatibility, so we fallback
-	// to panicking when FailNow is not available in
-	// TestingT.
-	// See issue #263
-
-	if t, ok := t.(failNower); ok {
-		t.FailNow()
-	} else {
-		panic("test failed and t is missing `FailNow()`")
-	}
-	return false
-}
-
-// Fail reports a failure through
-func Fail(t TestingT, failureMessage string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	content := []labeledContent{
-		{"Error Trace", strings.Join(CallerInfo(), "\n\t\t\t")},
-		{"Error", failureMessage},
-	}
-
-	// Add test name if the Go version supports it
-	if n, ok := t.(interface {
-		Name() string
-	}); ok {
-		content = append(content, labeledContent{"Test", n.Name()})
-	}
-
-	message := messageFromMsgAndArgs(msgAndArgs...)
-	if len(message) > 0 {
-		content = append(content, labeledContent{"Messages", message})
-	}
-
-	t.Errorf("\n%s", ""+labeledOutput(content...))
-
-	return false
-}
-
-type labeledContent struct {
-	label   string
-	content string
-}
-
-// labeledOutput returns a string consisting of the provided labeledContent. Each labeled output is appended in the following manner:
-//
-//   \t{{label}}:{{align_spaces}}\t{{content}}\n
-//
-// The initial carriage return is required to undo/erase any padding added by testing.T.Errorf. The "\t{{label}}:" is for the label.
-// If a label is shorter than the longest label provided, padding spaces are added to make all the labels match in length. Once this
-// alignment is achieved, "\t{{content}}\n" is added for the output.
-//
-// If the content of the labeledOutput contains line breaks, the subsequent lines are aligned so that they start at the same location as the first line.
-func labeledOutput(content ...labeledContent) string {
-	longestLabel := 0
-	for _, v := range content {
-		if len(v.label) > longestLabel {
-			longestLabel = len(v.label)
-		}
-	}
-	var output string
-	for _, v := range content {
-		output += "\t" + v.label + ":" + strings.Repeat(" ", longestLabel-len(v.label)) + "\t" + indentMessageLines(v.content, longestLabel) + "\n"
-	}
-	return output
-}
-
-// Implements asserts that an object is implemented by the specified interface.
-//
-//    assert.Implements(t, (*MyInterface)(nil), new(MyObject))
-func Implements(t TestingT, interfaceObject interface{}, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	interfaceType := reflect.TypeOf(interfaceObject).Elem()
-
-	if object == nil {
-		return Fail(t, fmt.Sprintf("Cannot check if nil implements %v", interfaceType), msgAndArgs...)
-	}
-	if !reflect.TypeOf(object).Implements(interfaceType) {
-		return Fail(t, fmt.Sprintf("%T must implement %v", object, interfaceType), msgAndArgs...)
-	}
-
-	return true
-}
-
-// IsType asserts that the specified objects are of the same type.
-func IsType(t TestingT, expectedType interface{}, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if !ObjectsAreEqual(reflect.TypeOf(object), reflect.TypeOf(expectedType)) {
-		return Fail(t, fmt.Sprintf("Object expected to be of type %v, but was %v", reflect.TypeOf(expectedType), reflect.TypeOf(object)), msgAndArgs...)
-	}
-
-	return true
-}
-
-// Equal asserts that two objects are equal.
-//
-//    assert.Equal(t, 123, 123)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func Equal(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if err := validateEqualArgs(expected, actual); err != nil {
-		return Fail(t, fmt.Sprintf("Invalid operation: %#v == %#v (%s)",
-			expected, actual, err), msgAndArgs...)
-	}
-
-	if !ObjectsAreEqual(expected, actual) {
-		diff := diff(expected, actual)
-		expected, actual = formatUnequalValues(expected, actual)
-		return Fail(t, fmt.Sprintf("Not equal: \n"+
-			"expected: %s\n"+
-			"actual  : %s%s", expected, actual, diff), msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// validateEqualArgs checks whether provided arguments can be safely used in the
-// Equal/NotEqual functions.
-func validateEqualArgs(expected, actual interface{}) error {
-	if expected == nil && actual == nil {
-		return nil
-	}
-
-	if isFunction(expected) || isFunction(actual) {
-		return errors.New("cannot take func type as argument")
-	}
-	return nil
-}
-
-// Same asserts that two pointers reference the same object.
-//
-//    assert.Same(t, ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func Same(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if !samePointers(expected, actual) {
-		return Fail(t, fmt.Sprintf("Not same: \n"+
-			"expected: %p %#v\n"+
-			"actual  : %p %#v", expected, expected, actual, actual), msgAndArgs...)
-	}
-
-	return true
-}
-
-// NotSame asserts that two pointers do not reference the same object.
-//
-//    assert.NotSame(t, ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func NotSame(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if samePointers(expected, actual) {
-		return Fail(t, fmt.Sprintf(
-			"Expected and actual point to the same object: %p %#v",
-			expected, expected), msgAndArgs...)
-	}
-	return true
-}
-
-// samePointers compares two generic interface objects and returns whether
-// they point to the same object
-func samePointers(first, second interface{}) bool {
-	firstPtr, secondPtr := reflect.ValueOf(first), reflect.ValueOf(second)
-	if firstPtr.Kind() != reflect.Ptr || secondPtr.Kind() != reflect.Ptr {
-		return false
-	}
-
-	firstType, secondType := reflect.TypeOf(first), reflect.TypeOf(second)
-	if firstType != secondType {
-		return false
-	}
-
-	// compare pointer addresses
-	return first == second
-}
-
-// formatUnequalValues takes two values of arbitrary types and returns string
-// representations appropriate to be presented to the user.
-//
-// If the values are not of like type, the returned strings will be prefixed
-// with the type name, and the value will be enclosed in parenthesis similar
-// to a type conversion in the Go grammar.
-func formatUnequalValues(expected, actual interface{}) (e string, a string) {
-	if reflect.TypeOf(expected) != reflect.TypeOf(actual) {
-		return fmt.Sprintf("%T(%s)", expected, truncatingFormat(expected)),
-			fmt.Sprintf("%T(%s)", actual, truncatingFormat(actual))
-	}
-	switch expected.(type) {
-	case time.Duration:
-		return fmt.Sprintf("%v", expected), fmt.Sprintf("%v", actual)
-	}
-	return truncatingFormat(expected), truncatingFormat(actual)
-}
-
-// truncatingFormat formats the data and truncates it if it's too long.
-//
-// This helps keep formatted error messages lines from exceeding the
-// bufio.MaxScanTokenSize max line length that the go testing framework imposes.
-func truncatingFormat(data interface{}) string {
-	value := fmt.Sprintf("%#v", data)
-	max := bufio.MaxScanTokenSize - 100 // Give us some space the type info too if needed.
-	if len(value) > max {
-		value = value[0:max] + "<... truncated>"
-	}
-	return value
-}
-
-// EqualValues asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    assert.EqualValues(t, uint32(123), int32(123))
-func EqualValues(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if !ObjectsAreEqualValues(expected, actual) {
-		diff := diff(expected, actual)
-		expected, actual = formatUnequalValues(expected, actual)
-		return Fail(t, fmt.Sprintf("Not equal: \n"+
-			"expected: %s\n"+
-			"actual  : %s%s", expected, actual, diff), msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// Exactly asserts that two objects are equal in value and type.
-//
-//    assert.Exactly(t, int32(123), int64(123))
-func Exactly(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	aType := reflect.TypeOf(expected)
-	bType := reflect.TypeOf(actual)
-
-	if aType != bType {
-		return Fail(t, fmt.Sprintf("Types expected to match exactly\n\t%v != %v", aType, bType), msgAndArgs...)
-	}
-
-	return Equal(t, expected, actual, msgAndArgs...)
-
-}
-
-// NotNil asserts that the specified object is not nil.
-//
-//    assert.NotNil(t, err)
-func NotNil(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	if !isNil(object) {
-		return true
-	}
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Fail(t, "Expected value not to be nil.", msgAndArgs...)
-}
-
-// containsKind checks if a specified kind in the slice of kinds.
-func containsKind(kinds []reflect.Kind, kind reflect.Kind) bool {
-	for i := 0; i < len(kinds); i++ {
-		if kind == kinds[i] {
-			return true
-		}
-	}
-
-	return false
-}
-
-// isNil checks if a specified object is nil or not, without Failing.
-func isNil(object interface{}) bool {
-	if object == nil {
-		return true
-	}
-
-	value := reflect.ValueOf(object)
-	kind := value.Kind()
-	isNilableKind := containsKind(
-		[]reflect.Kind{
-			reflect.Chan, reflect.Func,
-			reflect.Interface, reflect.Map,
-			reflect.Ptr, reflect.Slice},
-		kind)
-
-	if isNilableKind && value.IsNil() {
-		return true
-	}
-
-	return false
-}
-
-// Nil asserts that the specified object is nil.
-//
-//    assert.Nil(t, err)
-func Nil(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	if isNil(object) {
-		return true
-	}
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	return Fail(t, fmt.Sprintf("Expected nil, but got: %#v", object), msgAndArgs...)
-}
-
-// isEmpty gets whether the specified object is considered empty or not.
-func isEmpty(object interface{}) bool {
-
-	// get nil case out of the way
-	if object == nil {
-		return true
-	}
-
-	objValue := reflect.ValueOf(object)
-
-	switch objValue.Kind() {
-	// collection types are empty when they have no element
-	case reflect.Array, reflect.Chan, reflect.Map, reflect.Slice:
-		return objValue.Len() == 0
-		// pointers are empty if nil or if the value they point to is empty
-	case reflect.Ptr:
-		if objValue.IsNil() {
-			return true
-		}
-		deref := objValue.Elem().Interface()
-		return isEmpty(deref)
-		// for all other types, compare against the zero value
-	default:
-		zero := reflect.Zero(objValue.Type())
-		return reflect.DeepEqual(object, zero.Interface())
-	}
-}
-
-// Empty asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  assert.Empty(t, obj)
-func Empty(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	pass := isEmpty(object)
-	if !pass {
-		if h, ok := t.(tHelper); ok {
-			h.Helper()
-		}
-		Fail(t, fmt.Sprintf("Should be empty, but was %v", object), msgAndArgs...)
-	}
-
-	return pass
-
-}
-
-// NotEmpty asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if assert.NotEmpty(t, obj) {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func NotEmpty(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	pass := !isEmpty(object)
-	if !pass {
-		if h, ok := t.(tHelper); ok {
-			h.Helper()
-		}
-		Fail(t, fmt.Sprintf("Should NOT be empty, but was %v", object), msgAndArgs...)
-	}
-
-	return pass
-
-}
-
-// getLen try to get length of object.
-// return (false, 0) if impossible.
-func getLen(x interface{}) (ok bool, length int) {
-	v := reflect.ValueOf(x)
-	defer func() {
-		if e := recover(); e != nil {
-			ok = false
-		}
-	}()
-	return true, v.Len()
-}
-
-// Len asserts that the specified object has specific length.
-// Len also fails if the object has a type that len() not accept.
-//
-//    assert.Len(t, mySlice, 3)
-func Len(t TestingT, object interface{}, length int, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	ok, l := getLen(object)
-	if !ok {
-		return Fail(t, fmt.Sprintf("\"%s\" could not be applied builtin len()", object), msgAndArgs...)
-	}
-
-	if l != length {
-		return Fail(t, fmt.Sprintf("\"%s\" should have %d item(s), but has %d", object, length, l), msgAndArgs...)
-	}
-	return true
-}
-
-// True asserts that the specified value is true.
-//
-//    assert.True(t, myBool)
-func True(t TestingT, value bool, msgAndArgs ...interface{}) bool {
-	if !value {
-		if h, ok := t.(tHelper); ok {
-			h.Helper()
-		}
-		return Fail(t, "Should be true", msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// False asserts that the specified value is false.
-//
-//    assert.False(t, myBool)
-func False(t TestingT, value bool, msgAndArgs ...interface{}) bool {
-	if value {
-		if h, ok := t.(tHelper); ok {
-			h.Helper()
-		}
-		return Fail(t, "Should be false", msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// NotEqual asserts that the specified values are NOT equal.
-//
-//    assert.NotEqual(t, obj1, obj2)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func NotEqual(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if err := validateEqualArgs(expected, actual); err != nil {
-		return Fail(t, fmt.Sprintf("Invalid operation: %#v != %#v (%s)",
-			expected, actual, err), msgAndArgs...)
-	}
-
-	if ObjectsAreEqual(expected, actual) {
-		return Fail(t, fmt.Sprintf("Should not be: %#v\n", actual), msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// NotEqualValues asserts that two objects are not equal even when converted to the same type
-//
-//    assert.NotEqualValues(t, obj1, obj2)
-func NotEqualValues(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if ObjectsAreEqualValues(expected, actual) {
-		return Fail(t, fmt.Sprintf("Should not be: %#v\n", actual), msgAndArgs...)
-	}
-
-	return true
-}
-
-// containsElement try loop over the list check if the list includes the element.
-// return (false, false) if impossible.
-// return (true, false) if element was not found.
-// return (true, true) if element was found.
-func includeElement(list interface{}, element interface{}) (ok, found bool) {
-
-	listValue := reflect.ValueOf(list)
-	listKind := reflect.TypeOf(list).Kind()
-	defer func() {
-		if e := recover(); e != nil {
-			ok = false
-			found = false
-		}
-	}()
-
-	if listKind == reflect.String {
-		elementValue := reflect.ValueOf(element)
-		return true, strings.Contains(listValue.String(), elementValue.String())
-	}
-
-	if listKind == reflect.Map {
-		mapKeys := listValue.MapKeys()
-		for i := 0; i < len(mapKeys); i++ {
-			if ObjectsAreEqual(mapKeys[i].Interface(), element) {
-				return true, true
-			}
-		}
-		return true, false
-	}
-
-	for i := 0; i < listValue.Len(); i++ {
-		if ObjectsAreEqual(listValue.Index(i).Interface(), element) {
-			return true, true
-		}
-	}
-	return true, false
-
-}
-
-// Contains asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    assert.Contains(t, "Hello World", "World")
-//    assert.Contains(t, ["Hello", "World"], "World")
-//    assert.Contains(t, {"Hello": "World"}, "Hello")
-func Contains(t TestingT, s, contains interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	ok, found := includeElement(s, contains)
-	if !ok {
-		return Fail(t, fmt.Sprintf("%#v could not be applied builtin len()", s), msgAndArgs...)
-	}
-	if !found {
-		return Fail(t, fmt.Sprintf("%#v does not contain %#v", s, contains), msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// NotContains asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    assert.NotContains(t, "Hello World", "Earth")
-//    assert.NotContains(t, ["Hello", "World"], "Earth")
-//    assert.NotContains(t, {"Hello": "World"}, "Earth")
-func NotContains(t TestingT, s, contains interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	ok, found := includeElement(s, contains)
-	if !ok {
-		return Fail(t, fmt.Sprintf("\"%s\" could not be applied builtin len()", s), msgAndArgs...)
-	}
-	if found {
-		return Fail(t, fmt.Sprintf("\"%s\" should not contain \"%s\"", s, contains), msgAndArgs...)
-	}
-
-	return true
-
-}
-
-// Subset asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.Subset(t, [1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]")
-func Subset(t TestingT, list, subset interface{}, msgAndArgs ...interface{}) (ok bool) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if subset == nil {
-		return true // we consider nil to be equal to the nil set
-	}
-
-	subsetValue := reflect.ValueOf(subset)
-	defer func() {
-		if e := recover(); e != nil {
-			ok = false
-		}
-	}()
-
-	listKind := reflect.TypeOf(list).Kind()
-	subsetKind := reflect.TypeOf(subset).Kind()
-
-	if listKind != reflect.Array && listKind != reflect.Slice {
-		return Fail(t, fmt.Sprintf("%q has an unsupported type %s", list, listKind), msgAndArgs...)
-	}
-
-	if subsetKind != reflect.Array && subsetKind != reflect.Slice {
-		return Fail(t, fmt.Sprintf("%q has an unsupported type %s", subset, subsetKind), msgAndArgs...)
-	}
-
-	for i := 0; i < subsetValue.Len(); i++ {
-		element := subsetValue.Index(i).Interface()
-		ok, found := includeElement(list, element)
-		if !ok {
-			return Fail(t, fmt.Sprintf("\"%s\" could not be applied builtin len()", list), msgAndArgs...)
-		}
-		if !found {
-			return Fail(t, fmt.Sprintf("\"%s\" does not contain \"%s\"", list, element), msgAndArgs...)
-		}
-	}
-
-	return true
-}
-
-// NotSubset asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.NotSubset(t, [1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]")
-func NotSubset(t TestingT, list, subset interface{}, msgAndArgs ...interface{}) (ok bool) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if subset == nil {
-		return Fail(t, fmt.Sprintf("nil is the empty set which is a subset of every set"), msgAndArgs...)
-	}
-
-	subsetValue := reflect.ValueOf(subset)
-	defer func() {
-		if e := recover(); e != nil {
-			ok = false
-		}
-	}()
-
-	listKind := reflect.TypeOf(list).Kind()
-	subsetKind := reflect.TypeOf(subset).Kind()
-
-	if listKind != reflect.Array && listKind != reflect.Slice {
-		return Fail(t, fmt.Sprintf("%q has an unsupported type %s", list, listKind), msgAndArgs...)
-	}
-
-	if subsetKind != reflect.Array && subsetKind != reflect.Slice {
-		return Fail(t, fmt.Sprintf("%q has an unsupported type %s", subset, subsetKind), msgAndArgs...)
-	}
-
-	for i := 0; i < subsetValue.Len(); i++ {
-		element := subsetValue.Index(i).Interface()
-		ok, found := includeElement(list, element)
-		if !ok {
-			return Fail(t, fmt.Sprintf("\"%s\" could not be applied builtin len()", list), msgAndArgs...)
-		}
-		if !found {
-			return true
-		}
-	}
-
-	return Fail(t, fmt.Sprintf("%q is a subset of %q", subset, list), msgAndArgs...)
-}
-
-// ElementsMatch asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// assert.ElementsMatch(t, [1, 3, 2, 3], [1, 3, 3, 2])
-func ElementsMatch(t TestingT, listA, listB interface{}, msgAndArgs ...interface{}) (ok bool) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if isEmpty(listA) && isEmpty(listB) {
-		return true
-	}
-
-	if !isList(t, listA, msgAndArgs...) || !isList(t, listB, msgAndArgs...) {
-		return false
-	}
-
-	extraA, extraB := diffLists(listA, listB)
-
-	if len(extraA) == 0 && len(extraB) == 0 {
-		return true
-	}
-
-	return Fail(t, formatListDiff(listA, listB, extraA, extraB), msgAndArgs...)
-}
-
-// isList checks that the provided value is array or slice.
-func isList(t TestingT, list interface{}, msgAndArgs ...interface{}) (ok bool) {
-	kind := reflect.TypeOf(list).Kind()
-	if kind != reflect.Array && kind != reflect.Slice {
-		return Fail(t, fmt.Sprintf("%q has an unsupported type %s, expecting array or slice", list, kind),
-			msgAndArgs...)
-	}
-	return true
-}
-
-// diffLists diffs two arrays/slices and returns slices of elements that are only in A and only in B.
-// If some element is present multiple times, each instance is counted separately (e.g. if something is 2x in A and
-// 5x in B, it will be 0x in extraA and 3x in extraB). The order of items in both lists is ignored.
-func diffLists(listA, listB interface{}) (extraA, extraB []interface{}) {
-	aValue := reflect.ValueOf(listA)
-	bValue := reflect.ValueOf(listB)
-
-	aLen := aValue.Len()
-	bLen := bValue.Len()
-
-	// Mark indexes in bValue that we already used
-	visited := make([]bool, bLen)
-	for i := 0; i < aLen; i++ {
-		element := aValue.Index(i).Interface()
-		found := false
-		for j := 0; j < bLen; j++ {
-			if visited[j] {
-				continue
-			}
-			if ObjectsAreEqual(bValue.Index(j).Interface(), element) {
-				visited[j] = true
-				found = true
-				break
-			}
-		}
-		if !found {
-			extraA = append(extraA, element)
-		}
-	}
-
-	for j := 0; j < bLen; j++ {
-		if visited[j] {
-			continue
-		}
-		extraB = append(extraB, bValue.Index(j).Interface())
-	}
-
-	return
-}
-
-func formatListDiff(listA, listB interface{}, extraA, extraB []interface{}) string {
-	var msg bytes.Buffer
-
-	msg.WriteString("elements differ")
-	if len(extraA) > 0 {
-		msg.WriteString("\n\nextra elements in list A:\n")
-		msg.WriteString(spewConfig.Sdump(extraA))
-	}
-	if len(extraB) > 0 {
-		msg.WriteString("\n\nextra elements in list B:\n")
-		msg.WriteString(spewConfig.Sdump(extraB))
-	}
-	msg.WriteString("\n\nlistA:\n")
-	msg.WriteString(spewConfig.Sdump(listA))
-	msg.WriteString("\n\nlistB:\n")
-	msg.WriteString(spewConfig.Sdump(listB))
-
-	return msg.String()
-}
-
-// Condition uses a Comparison to assert a complex condition.
-func Condition(t TestingT, comp Comparison, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	result := comp()
-	if !result {
-		Fail(t, "Condition failed!", msgAndArgs...)
-	}
-	return result
-}
-
-// PanicTestFunc defines a func that should be passed to the assert.Panics and assert.NotPanics
-// methods, and represents a simple func that takes no arguments, and returns nothing.
-type PanicTestFunc func()
-
-// didPanic returns true if the function passed to it panics. Otherwise, it returns false.
-func didPanic(f PanicTestFunc) (bool, interface{}, string) {
-
-	didPanic := false
-	var message interface{}
-	var stack string
-	func() {
-
-		defer func() {
-			if message = recover(); message != nil {
-				didPanic = true
-				stack = string(debug.Stack())
-			}
-		}()
-
-		// call the target function
-		f()
-
-	}()
-
-	return didPanic, message, stack
-
-}
-
-// Panics asserts that the code inside the specified PanicTestFunc panics.
-//
-//   assert.Panics(t, func(){ GoCrazy() })
-func Panics(t TestingT, f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if funcDidPanic, panicValue, _ := didPanic(f); !funcDidPanic {
-		return Fail(t, fmt.Sprintf("func %#v should panic\n\tPanic value:\t%#v", f, panicValue), msgAndArgs...)
-	}
-
-	return true
-}
-
-// PanicsWithValue asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   assert.PanicsWithValue(t, "crazy error", func(){ GoCrazy() })
-func PanicsWithValue(t TestingT, expected interface{}, f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	funcDidPanic, panicValue, panickedStack := didPanic(f)
-	if !funcDidPanic {
-		return Fail(t, fmt.Sprintf("func %#v should panic\n\tPanic value:\t%#v", f, panicValue), msgAndArgs...)
-	}
-	if panicValue != expected {
-		return Fail(t, fmt.Sprintf("func %#v should panic with value:\t%#v\n\tPanic value:\t%#v\n\tPanic stack:\t%s", f, expected, panicValue, panickedStack), msgAndArgs...)
-	}
-
-	return true
-}
-
-// PanicsWithError asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   assert.PanicsWithError(t, "crazy error", func(){ GoCrazy() })
-func PanicsWithError(t TestingT, errString string, f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	funcDidPanic, panicValue, panickedStack := didPanic(f)
-	if !funcDidPanic {
-		return Fail(t, fmt.Sprintf("func %#v should panic\n\tPanic value:\t%#v", f, panicValue), msgAndArgs...)
-	}
-	panicErr, ok := panicValue.(error)
-	if !ok || panicErr.Error() != errString {
-		return Fail(t, fmt.Sprintf("func %#v should panic with error message:\t%#v\n\tPanic value:\t%#v\n\tPanic stack:\t%s", f, errString, panicValue, panickedStack), msgAndArgs...)
-	}
-
-	return true
-}
-
-// NotPanics asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   assert.NotPanics(t, func(){ RemainCalm() })
-func NotPanics(t TestingT, f PanicTestFunc, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	if funcDidPanic, panicValue, panickedStack := didPanic(f); funcDidPanic {
-		return Fail(t, fmt.Sprintf("func %#v should not panic\n\tPanic value:\t%v\n\tPanic stack:\t%s", f, panicValue, panickedStack), msgAndArgs...)
-	}
-
-	return true
-}
-
-// WithinDuration asserts that the two times are within duration delta of each other.
-//
-//   assert.WithinDuration(t, time.Now(), time.Now(), 10*time.Second)
-func WithinDuration(t TestingT, expected, actual time.Time, delta time.Duration, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	dt := expected.Sub(actual)
-	if dt < -delta || dt > delta {
-		return Fail(t, fmt.Sprintf("Max difference between %v and %v allowed is %v, but difference was %v", expected, actual, delta, dt), msgAndArgs...)
-	}
-
-	return true
-}
-
-func toFloat(x interface{}) (float64, bool) {
-	var xf float64
-	xok := true
-
-	switch xn := x.(type) {
-	case uint:
-		xf = float64(xn)
-	case uint8:
-		xf = float64(xn)
-	case uint16:
-		xf = float64(xn)
-	case uint32:
-		xf = float64(xn)
-	case uint64:
-		xf = float64(xn)
-	case int:
-		xf = float64(xn)
-	case int8:
-		xf = float64(xn)
-	case int16:
-		xf = float64(xn)
-	case int32:
-		xf = float64(xn)
-	case int64:
-		xf = float64(xn)
-	case float32:
-		xf = float64(xn)
-	case float64:
-		xf = xn
-	case time.Duration:
-		xf = float64(xn)
-	default:
-		xok = false
-	}
-
-	return xf, xok
-}
-
-// InDelta asserts that the two numerals are within delta of each other.
-//
-// 	 assert.InDelta(t, math.Pi, 22/7.0, 0.01)
-func InDelta(t TestingT, expected, actual interface{}, delta float64, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	af, aok := toFloat(expected)
-	bf, bok := toFloat(actual)
-
-	if !aok || !bok {
-		return Fail(t, fmt.Sprintf("Parameters must be numerical"), msgAndArgs...)
-	}
-
-	if math.IsNaN(af) {
-		return Fail(t, fmt.Sprintf("Expected must not be NaN"), msgAndArgs...)
-	}
-
-	if math.IsNaN(bf) {
-		return Fail(t, fmt.Sprintf("Expected %v with delta %v, but was NaN", expected, delta), msgAndArgs...)
-	}
-
-	dt := af - bf
-	if dt < -delta || dt > delta {
-		return Fail(t, fmt.Sprintf("Max difference between %v and %v allowed is %v, but difference was %v", expected, actual, delta, dt), msgAndArgs...)
-	}
-
-	return true
-}
-
-// InDeltaSlice is the same as InDelta, except it compares two slices.
-func InDeltaSlice(t TestingT, expected, actual interface{}, delta float64, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if expected == nil || actual == nil ||
-		reflect.TypeOf(actual).Kind() != reflect.Slice ||
-		reflect.TypeOf(expected).Kind() != reflect.Slice {
-		return Fail(t, fmt.Sprintf("Parameters must be slice"), msgAndArgs...)
-	}
-
-	actualSlice := reflect.ValueOf(actual)
-	expectedSlice := reflect.ValueOf(expected)
-
-	for i := 0; i < actualSlice.Len(); i++ {
-		result := InDelta(t, actualSlice.Index(i).Interface(), expectedSlice.Index(i).Interface(), delta, msgAndArgs...)
-		if !result {
-			return result
-		}
-	}
-
-	return true
-}
-
-// InDeltaMapValues is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func InDeltaMapValues(t TestingT, expected, actual interface{}, delta float64, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if expected == nil || actual == nil ||
-		reflect.TypeOf(actual).Kind() != reflect.Map ||
-		reflect.TypeOf(expected).Kind() != reflect.Map {
-		return Fail(t, "Arguments must be maps", msgAndArgs...)
-	}
-
-	expectedMap := reflect.ValueOf(expected)
-	actualMap := reflect.ValueOf(actual)
-
-	if expectedMap.Len() != actualMap.Len() {
-		return Fail(t, "Arguments must have the same number of keys", msgAndArgs...)
-	}
-
-	for _, k := range expectedMap.MapKeys() {
-		ev := expectedMap.MapIndex(k)
-		av := actualMap.MapIndex(k)
-
-		if !ev.IsValid() {
-			return Fail(t, fmt.Sprintf("missing key %q in expected map", k), msgAndArgs...)
-		}
-
-		if !av.IsValid() {
-			return Fail(t, fmt.Sprintf("missing key %q in actual map", k), msgAndArgs...)
-		}
-
-		if !InDelta(
-			t,
-			ev.Interface(),
-			av.Interface(),
-			delta,
-			msgAndArgs...,
-		) {
-			return false
-		}
-	}
-
-	return true
-}
-
-func calcRelativeError(expected, actual interface{}) (float64, error) {
-	af, aok := toFloat(expected)
-	if !aok {
-		return 0, fmt.Errorf("expected value %q cannot be converted to float", expected)
-	}
-	if math.IsNaN(af) {
-		return 0, errors.New("expected value must not be NaN")
-	}
-	if af == 0 {
-		return 0, fmt.Errorf("expected value must have a value other than zero to calculate the relative error")
-	}
-	bf, bok := toFloat(actual)
-	if !bok {
-		return 0, fmt.Errorf("actual value %q cannot be converted to float", actual)
-	}
-	if math.IsNaN(bf) {
-		return 0, errors.New("actual value must not be NaN")
-	}
-
-	return math.Abs(af-bf) / math.Abs(af), nil
-}
-
-// InEpsilon asserts that expected and actual have a relative error less than epsilon
-func InEpsilon(t TestingT, expected, actual interface{}, epsilon float64, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if math.IsNaN(epsilon) {
-		return Fail(t, "epsilon must not be NaN")
-	}
-	actualEpsilon, err := calcRelativeError(expected, actual)
-	if err != nil {
-		return Fail(t, err.Error(), msgAndArgs...)
-	}
-	if actualEpsilon > epsilon {
-		return Fail(t, fmt.Sprintf("Relative error is too high: %#v (expected)\n"+
-			"        < %#v (actual)", epsilon, actualEpsilon), msgAndArgs...)
-	}
-
-	return true
-}
-
-// InEpsilonSlice is the same as InEpsilon, except it compares each value from two slices.
-func InEpsilonSlice(t TestingT, expected, actual interface{}, epsilon float64, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if expected == nil || actual == nil ||
-		reflect.TypeOf(actual).Kind() != reflect.Slice ||
-		reflect.TypeOf(expected).Kind() != reflect.Slice {
-		return Fail(t, fmt.Sprintf("Parameters must be slice"), msgAndArgs...)
-	}
-
-	actualSlice := reflect.ValueOf(actual)
-	expectedSlice := reflect.ValueOf(expected)
-
-	for i := 0; i < actualSlice.Len(); i++ {
-		result := InEpsilon(t, actualSlice.Index(i).Interface(), expectedSlice.Index(i).Interface(), epsilon)
-		if !result {
-			return result
-		}
-	}
-
-	return true
-}
-
-/*
-	Errors
-*/
-
-// NoError asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.NoError(t, err) {
-//	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func NoError(t TestingT, err error, msgAndArgs ...interface{}) bool {
-	if err != nil {
-		if h, ok := t.(tHelper); ok {
-			h.Helper()
-		}
-		return Fail(t, fmt.Sprintf("Received unexpected error:\n%+v", err), msgAndArgs...)
-	}
-
-	return true
-}
-
-// Error asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.Error(t, err) {
-//	   assert.Equal(t, expectedError, err)
-//   }
-func Error(t TestingT, err error, msgAndArgs ...interface{}) bool {
-	if err == nil {
-		if h, ok := t.(tHelper); ok {
-			h.Helper()
-		}
-		return Fail(t, "An error is expected but got nil.", msgAndArgs...)
-	}
-
-	return true
-}
-
-// EqualError asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   assert.EqualError(t, err,  expectedErrorString)
-func EqualError(t TestingT, theError error, errString string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if !Error(t, theError, msgAndArgs...) {
-		return false
-	}
-	expected := errString
-	actual := theError.Error()
-	// don't need to use deep equals here, we know they are both strings
-	if expected != actual {
-		return Fail(t, fmt.Sprintf("Error message not equal:\n"+
-			"expected: %q\n"+
-			"actual  : %q", expected, actual), msgAndArgs...)
-	}
-	return true
-}
-
-// matchRegexp return true if a specified regexp matches a string.
-func matchRegexp(rx interface{}, str interface{}) bool {
-
-	var r *regexp.Regexp
-	if rr, ok := rx.(*regexp.Regexp); ok {
-		r = rr
-	} else {
-		r = regexp.MustCompile(fmt.Sprint(rx))
-	}
-
-	return (r.FindStringIndex(fmt.Sprint(str)) != nil)
-
-}
-
-// Regexp asserts that a specified regexp matches a string.
-//
-//  assert.Regexp(t, regexp.MustCompile("start"), "it's starting")
-//  assert.Regexp(t, "start...$", "it's not starting")
-func Regexp(t TestingT, rx interface{}, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	match := matchRegexp(rx, str)
-
-	if !match {
-		Fail(t, fmt.Sprintf("Expect \"%v\" to match \"%v\"", str, rx), msgAndArgs...)
-	}
-
-	return match
-}
-
-// NotRegexp asserts that a specified regexp does not match a string.
-//
-//  assert.NotRegexp(t, regexp.MustCompile("starts"), "it's starting")
-//  assert.NotRegexp(t, "^start", "it's not starting")
-func NotRegexp(t TestingT, rx interface{}, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	match := matchRegexp(rx, str)
-
-	if match {
-		Fail(t, fmt.Sprintf("Expect \"%v\" to NOT match \"%v\"", str, rx), msgAndArgs...)
-	}
-
-	return !match
-
-}
-
-// Zero asserts that i is the zero value for its type.
-func Zero(t TestingT, i interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if i != nil && !reflect.DeepEqual(i, reflect.Zero(reflect.TypeOf(i)).Interface()) {
-		return Fail(t, fmt.Sprintf("Should be zero, but was %v", i), msgAndArgs...)
-	}
-	return true
-}
-
-// NotZero asserts that i is not the zero value for its type.
-func NotZero(t TestingT, i interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if i == nil || reflect.DeepEqual(i, reflect.Zero(reflect.TypeOf(i)).Interface()) {
-		return Fail(t, fmt.Sprintf("Should not be zero, but was %v", i), msgAndArgs...)
-	}
-	return true
-}
-
-// FileExists checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func FileExists(t TestingT, path string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	info, err := os.Lstat(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return Fail(t, fmt.Sprintf("unable to find file %q", path), msgAndArgs...)
-		}
-		return Fail(t, fmt.Sprintf("error when running os.Lstat(%q): %s", path, err), msgAndArgs...)
-	}
-	if info.IsDir() {
-		return Fail(t, fmt.Sprintf("%q is a directory", path), msgAndArgs...)
-	}
-	return true
-}
-
-// NoFileExists checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func NoFileExists(t TestingT, path string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	info, err := os.Lstat(path)
-	if err != nil {
-		return true
-	}
-	if info.IsDir() {
-		return true
-	}
-	return Fail(t, fmt.Sprintf("file %q exists", path), msgAndArgs...)
-}
-
-// DirExists checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func DirExists(t TestingT, path string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	info, err := os.Lstat(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return Fail(t, fmt.Sprintf("unable to find file %q", path), msgAndArgs...)
-		}
-		return Fail(t, fmt.Sprintf("error when running os.Lstat(%q): %s", path, err), msgAndArgs...)
-	}
-	if !info.IsDir() {
-		return Fail(t, fmt.Sprintf("%q is a file", path), msgAndArgs...)
-	}
-	return true
-}
-
-// NoDirExists checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func NoDirExists(t TestingT, path string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	info, err := os.Lstat(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return true
-		}
-		return true
-	}
-	if !info.IsDir() {
-		return true
-	}
-	return Fail(t, fmt.Sprintf("directory %q exists", path), msgAndArgs...)
-}
-
-// JSONEq asserts that two JSON strings are equivalent.
-//
-//  assert.JSONEq(t, `{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`)
-func JSONEq(t TestingT, expected string, actual string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	var expectedJSONAsInterface, actualJSONAsInterface interface{}
-
-	if err := json.Unmarshal([]byte(expected), &expectedJSONAsInterface); err != nil {
-		return Fail(t, fmt.Sprintf("Expected value ('%s') is not valid json.\nJSON parsing error: '%s'", expected, err.Error()), msgAndArgs...)
-	}
-
-	if err := json.Unmarshal([]byte(actual), &actualJSONAsInterface); err != nil {
-		return Fail(t, fmt.Sprintf("Input ('%s') needs to be valid json.\nJSON parsing error: '%s'", actual, err.Error()), msgAndArgs...)
-	}
-
-	return Equal(t, expectedJSONAsInterface, actualJSONAsInterface, msgAndArgs...)
-}
-
-// YAMLEq asserts that two YAML strings are equivalent.
-func YAMLEq(t TestingT, expected string, actual string, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	var expectedYAMLAsInterface, actualYAMLAsInterface interface{}
-
-	if err := yaml.Unmarshal([]byte(expected), &expectedYAMLAsInterface); err != nil {
-		return Fail(t, fmt.Sprintf("Expected value ('%s') is not valid yaml.\nYAML parsing error: '%s'", expected, err.Error()), msgAndArgs...)
-	}
-
-	if err := yaml.Unmarshal([]byte(actual), &actualYAMLAsInterface); err != nil {
-		return Fail(t, fmt.Sprintf("Input ('%s') needs to be valid yaml.\nYAML error: '%s'", actual, err.Error()), msgAndArgs...)
-	}
-
-	return Equal(t, expectedYAMLAsInterface, actualYAMLAsInterface, msgAndArgs...)
-}
-
-func typeAndKind(v interface{}) (reflect.Type, reflect.Kind) {
-	t := reflect.TypeOf(v)
-	k := t.Kind()
-
-	if k == reflect.Ptr {
-		t = t.Elem()
-		k = t.Kind()
-	}
-	return t, k
-}
-
-// diff returns a diff of both values as long as both are of the same type and
-// are a struct, map, slice, array or string. Otherwise it returns an empty string.
-func diff(expected interface{}, actual interface{}) string {
-	if expected == nil || actual == nil {
-		return ""
-	}
-
-	et, ek := typeAndKind(expected)
-	at, _ := typeAndKind(actual)
-
-	if et != at {
-		return ""
-	}
-
-	if ek != reflect.Struct && ek != reflect.Map && ek != reflect.Slice && ek != reflect.Array && ek != reflect.String {
-		return ""
-	}
-
-	var e, a string
-	if et != reflect.TypeOf("") {
-		e = spewConfig.Sdump(expected)
-		a = spewConfig.Sdump(actual)
-	} else {
-		e = reflect.ValueOf(expected).String()
-		a = reflect.ValueOf(actual).String()
-	}
-
-	diff, _ := difflib.GetUnifiedDiffString(difflib.UnifiedDiff{
-		A:        difflib.SplitLines(e),
-		B:        difflib.SplitLines(a),
-		FromFile: "Expected",
-		FromDate: "",
-		ToFile:   "Actual",
-		ToDate:   "",
-		Context:  1,
-	})
-
-	return "\n\nDiff:\n" + diff
-}
-
-func isFunction(arg interface{}) bool {
-	if arg == nil {
-		return false
-	}
-	return reflect.TypeOf(arg).Kind() == reflect.Func
-}
-
-var spewConfig = spew.ConfigState{
-	Indent:                  " ",
-	DisablePointerAddresses: true,
-	DisableCapacities:       true,
-	SortKeys:                true,
-	DisableMethods:          true,
-	MaxDepth:                10,
-}
-
-type tHelper interface {
-	Helper()
-}
-
-// Eventually asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    assert.Eventually(t, func() bool { return true; }, time.Second, 10*time.Millisecond)
-func Eventually(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	ch := make(chan bool, 1)
-
-	timer := time.NewTimer(waitFor)
-	defer timer.Stop()
-
-	ticker := time.NewTicker(tick)
-	defer ticker.Stop()
-
-	for tick := ticker.C; ; {
-		select {
-		case <-timer.C:
-			return Fail(t, "Condition never satisfied", msgAndArgs...)
-		case <-tick:
-			tick = nil
-			go func() { ch <- condition() }()
-		case v := <-ch:
-			if v {
-				return true
-			}
-			tick = ticker.C
-		}
-	}
-}
-
-// Never asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    assert.Never(t, func() bool { return false; }, time.Second, 10*time.Millisecond)
-func Never(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-
-	ch := make(chan bool, 1)
-
-	timer := time.NewTimer(waitFor)
-	defer timer.Stop()
-
-	ticker := time.NewTicker(tick)
-	defer ticker.Stop()
-
-	for tick := ticker.C; ; {
-		select {
-		case <-timer.C:
-			return true
-		case <-tick:
-			tick = nil
-			go func() { ch <- condition() }()
-		case v := <-ch:
-			if v {
-				return Fail(t, "Condition satisfied", msgAndArgs...)
-			}
-			tick = ticker.C
-		}
-	}
-}
-
-// ErrorIs asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func ErrorIs(t TestingT, err, target error, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if errors.Is(err, target) {
-		return true
-	}
-
-	var expectedText string
-	if target != nil {
-		expectedText = target.Error()
-	}
-
-	chain := buildErrorChainString(err)
-
-	return Fail(t, fmt.Sprintf("Target error should be in err chain:\n"+
-		"expected: %q\n"+
-		"in chain: %s", expectedText, chain,
-	), msgAndArgs...)
-}
-
-// NotErrorIs asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func NotErrorIs(t TestingT, err, target error, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if !errors.Is(err, target) {
-		return true
-	}
-
-	var expectedText string
-	if target != nil {
-		expectedText = target.Error()
-	}
-
-	chain := buildErrorChainString(err)
-
-	return Fail(t, fmt.Sprintf("Target error should not be in err chain:\n"+
-		"found: %q\n"+
-		"in chain: %s", expectedText, chain,
-	), msgAndArgs...)
-}
-
-// ErrorAs asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func ErrorAs(t TestingT, err error, target interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if errors.As(err, target) {
-		return true
-	}
-
-	chain := buildErrorChainString(err)
-
-	return Fail(t, fmt.Sprintf("Should be in error chain:\n"+
-		"expected: %q\n"+
-		"in chain: %s", target, chain,
-	), msgAndArgs...)
-}
-
-func buildErrorChainString(err error) string {
-	if err == nil {
-		return ""
-	}
-
-	e := errors.Unwrap(err)
-	chain := fmt.Sprintf("%q", err.Error())
-	for e != nil {
-		chain += fmt.Sprintf("\n\t%q", e.Error())
-		e = errors.Unwrap(e)
-	}
-	return chain
-}
diff --git a/vendor/github.com/stretchr/testify/assert/doc.go b/vendor/github.com/stretchr/testify/assert/doc.go
deleted file mode 100644
index c9dccc4d6c..0000000000
--- a/vendor/github.com/stretchr/testify/assert/doc.go
+++ /dev/null
@@ -1,45 +0,0 @@
-// Package assert provides a set of comprehensive testing tools for use with the normal Go testing system.
-//
-// Example Usage
-//
-// The following is a complete example using assert in a standard test function:
-//    import (
-//      "testing"
-//      "github.com/stretchr/testify/assert"
-//    )
-//
-//    func TestSomething(t *testing.T) {
-//
-//      var a string = "Hello"
-//      var b string = "Hello"
-//
-//      assert.Equal(t, a, b, "The two words should be the same.")
-//
-//    }
-//
-// if you assert many times, use the format below:
-//
-//    import (
-//      "testing"
-//      "github.com/stretchr/testify/assert"
-//    )
-//
-//    func TestSomething(t *testing.T) {
-//      assert := assert.New(t)
-//
-//      var a string = "Hello"
-//      var b string = "Hello"
-//
-//      assert.Equal(a, b, "The two words should be the same.")
-//    }
-//
-// Assertions
-//
-// Assertions allow you to easily write test code, and are global funcs in the `assert` package.
-// All assertion functions take, as the first argument, the `*testing.T` object provided by the
-// testing framework. This allows the assertion funcs to write the failings and other details to
-// the correct place.
-//
-// Every assertion function also takes an optional string message as the final argument,
-// allowing custom error messages to be appended to the message the assertion method outputs.
-package assert
diff --git a/vendor/github.com/stretchr/testify/assert/errors.go b/vendor/github.com/stretchr/testify/assert/errors.go
deleted file mode 100644
index ac9dc9d1d6..0000000000
--- a/vendor/github.com/stretchr/testify/assert/errors.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package assert
-
-import (
-	"errors"
-)
-
-// AnError is an error instance useful for testing.  If the code does not care
-// about error specifics, and only needs to return the error for example, this
-// error should be used to make the test code more readable.
-var AnError = errors.New("assert.AnError general error for testing")
diff --git a/vendor/github.com/stretchr/testify/assert/forward_assertions.go b/vendor/github.com/stretchr/testify/assert/forward_assertions.go
deleted file mode 100644
index df189d2348..0000000000
--- a/vendor/github.com/stretchr/testify/assert/forward_assertions.go
+++ /dev/null
@@ -1,16 +0,0 @@
-package assert
-
-// Assertions provides assertion methods around the
-// TestingT interface.
-type Assertions struct {
-	t TestingT
-}
-
-// New makes a new Assertions object for the specified TestingT.
-func New(t TestingT) *Assertions {
-	return &Assertions{
-		t: t,
-	}
-}
-
-//go:generate sh -c "cd ../_codegen && go build && cd - && ../_codegen/_codegen -output-package=assert -template=assertion_forward.go.tmpl -include-format-funcs"
diff --git a/vendor/github.com/stretchr/testify/assert/http_assertions.go b/vendor/github.com/stretchr/testify/assert/http_assertions.go
deleted file mode 100644
index 4ed341dd28..0000000000
--- a/vendor/github.com/stretchr/testify/assert/http_assertions.go
+++ /dev/null
@@ -1,162 +0,0 @@
-package assert
-
-import (
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-)
-
-// httpCode is a helper that returns HTTP code of the response. It returns -1 and
-// an error if building a new request fails.
-func httpCode(handler http.HandlerFunc, method, url string, values url.Values) (int, error) {
-	w := httptest.NewRecorder()
-	req, err := http.NewRequest(method, url, nil)
-	if err != nil {
-		return -1, err
-	}
-	req.URL.RawQuery = values.Encode()
-	handler(w, req)
-	return w.Code, nil
-}
-
-// HTTPSuccess asserts that a specified handler returns a success status code.
-//
-//  assert.HTTPSuccess(t, myHandler, "POST", "http://www.google.com", nil)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPSuccess(t TestingT, handler http.HandlerFunc, method, url string, values url.Values, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	code, err := httpCode(handler, method, url, values)
-	if err != nil {
-		Fail(t, fmt.Sprintf("Failed to build test request, got error: %s", err))
-	}
-
-	isSuccessCode := code >= http.StatusOK && code <= http.StatusPartialContent
-	if !isSuccessCode {
-		Fail(t, fmt.Sprintf("Expected HTTP success status code for %q but received %d", url+"?"+values.Encode(), code))
-	}
-
-	return isSuccessCode
-}
-
-// HTTPRedirect asserts that a specified handler returns a redirect status code.
-//
-//  assert.HTTPRedirect(t, myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPRedirect(t TestingT, handler http.HandlerFunc, method, url string, values url.Values, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	code, err := httpCode(handler, method, url, values)
-	if err != nil {
-		Fail(t, fmt.Sprintf("Failed to build test request, got error: %s", err))
-	}
-
-	isRedirectCode := code >= http.StatusMultipleChoices && code <= http.StatusTemporaryRedirect
-	if !isRedirectCode {
-		Fail(t, fmt.Sprintf("Expected HTTP redirect status code for %q but received %d", url+"?"+values.Encode(), code))
-	}
-
-	return isRedirectCode
-}
-
-// HTTPError asserts that a specified handler returns an error status code.
-//
-//  assert.HTTPError(t, myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPError(t TestingT, handler http.HandlerFunc, method, url string, values url.Values, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	code, err := httpCode(handler, method, url, values)
-	if err != nil {
-		Fail(t, fmt.Sprintf("Failed to build test request, got error: %s", err))
-	}
-
-	isErrorCode := code >= http.StatusBadRequest
-	if !isErrorCode {
-		Fail(t, fmt.Sprintf("Expected HTTP error status code for %q but received %d", url+"?"+values.Encode(), code))
-	}
-
-	return isErrorCode
-}
-
-// HTTPStatusCode asserts that a specified handler returns a specified status code.
-//
-//  assert.HTTPStatusCode(t, myHandler, "GET", "/notImplemented", nil, 501)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPStatusCode(t TestingT, handler http.HandlerFunc, method, url string, values url.Values, statuscode int, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	code, err := httpCode(handler, method, url, values)
-	if err != nil {
-		Fail(t, fmt.Sprintf("Failed to build test request, got error: %s", err))
-	}
-
-	successful := code == statuscode
-	if !successful {
-		Fail(t, fmt.Sprintf("Expected HTTP status code %d for %q but received %d", statuscode, url+"?"+values.Encode(), code))
-	}
-
-	return successful
-}
-
-// HTTPBody is a helper that returns HTTP body of the response. It returns
-// empty string if building a new request fails.
-func HTTPBody(handler http.HandlerFunc, method, url string, values url.Values) string {
-	w := httptest.NewRecorder()
-	req, err := http.NewRequest(method, url+"?"+values.Encode(), nil)
-	if err != nil {
-		return ""
-	}
-	handler(w, req)
-	return w.Body.String()
-}
-
-// HTTPBodyContains asserts that a specified handler returns a
-// body that contains a string.
-//
-//  assert.HTTPBodyContains(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyContains(t TestingT, handler http.HandlerFunc, method, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	body := HTTPBody(handler, method, url, values)
-
-	contains := strings.Contains(body, fmt.Sprint(str))
-	if !contains {
-		Fail(t, fmt.Sprintf("Expected response body for \"%s\" to contain \"%s\" but found \"%s\"", url+"?"+values.Encode(), str, body))
-	}
-
-	return contains
-}
-
-// HTTPBodyNotContains asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  assert.HTTPBodyNotContains(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyNotContains(t TestingT, handler http.HandlerFunc, method, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	body := HTTPBody(handler, method, url, values)
-
-	contains := strings.Contains(body, fmt.Sprint(str))
-	if contains {
-		Fail(t, fmt.Sprintf("Expected response body for \"%s\" to NOT contain \"%s\" but found \"%s\"", url+"?"+values.Encode(), str, body))
-	}
-
-	return !contains
-}
diff --git a/vendor/github.com/stretchr/testify/require/doc.go b/vendor/github.com/stretchr/testify/require/doc.go
deleted file mode 100644
index 169de39221..0000000000
--- a/vendor/github.com/stretchr/testify/require/doc.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Package require implements the same assertions as the `assert` package but
-// stops test execution when a test fails.
-//
-// Example Usage
-//
-// The following is a complete example using require in a standard test function:
-//    import (
-//      "testing"
-//      "github.com/stretchr/testify/require"
-//    )
-//
-//    func TestSomething(t *testing.T) {
-//
-//      var a string = "Hello"
-//      var b string = "Hello"
-//
-//      require.Equal(t, a, b, "The two words should be the same.")
-//
-//    }
-//
-// Assertions
-//
-// The `require` package have same global functions as in the `assert` package,
-// but instead of returning a boolean result they call `t.FailNow()`.
-//
-// Every assertion function also takes an optional string message as the final argument,
-// allowing custom error messages to be appended to the message the assertion method outputs.
-package require
diff --git a/vendor/github.com/stretchr/testify/require/forward_requirements.go b/vendor/github.com/stretchr/testify/require/forward_requirements.go
deleted file mode 100644
index 1dcb2338c4..0000000000
--- a/vendor/github.com/stretchr/testify/require/forward_requirements.go
+++ /dev/null
@@ -1,16 +0,0 @@
-package require
-
-// Assertions provides assertion methods around the
-// TestingT interface.
-type Assertions struct {
-	t TestingT
-}
-
-// New makes a new Assertions object for the specified TestingT.
-func New(t TestingT) *Assertions {
-	return &Assertions{
-		t: t,
-	}
-}
-
-//go:generate sh -c "cd ../_codegen && go build && cd - && ../_codegen/_codegen -output-package=require -template=require_forward.go.tmpl -include-format-funcs"
diff --git a/vendor/github.com/stretchr/testify/require/require.go b/vendor/github.com/stretchr/testify/require/require.go
deleted file mode 100644
index 51820df2e6..0000000000
--- a/vendor/github.com/stretchr/testify/require/require.go
+++ /dev/null
@@ -1,1879 +0,0 @@
-/*
-* CODE GENERATED AUTOMATICALLY WITH github.com/stretchr/testify/_codegen
-* THIS FILE MUST NOT BE EDITED BY HAND
- */
-
-package require
-
-import (
-	assert "github.com/stretchr/testify/assert"
-	http "net/http"
-	url "net/url"
-	time "time"
-)
-
-// Condition uses a Comparison to assert a complex condition.
-func Condition(t TestingT, comp assert.Comparison, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Condition(t, comp, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Conditionf uses a Comparison to assert a complex condition.
-func Conditionf(t TestingT, comp assert.Comparison, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Conditionf(t, comp, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Contains asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    assert.Contains(t, "Hello World", "World")
-//    assert.Contains(t, ["Hello", "World"], "World")
-//    assert.Contains(t, {"Hello": "World"}, "Hello")
-func Contains(t TestingT, s interface{}, contains interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Contains(t, s, contains, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Containsf asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    assert.Containsf(t, "Hello World", "World", "error message %s", "formatted")
-//    assert.Containsf(t, ["Hello", "World"], "World", "error message %s", "formatted")
-//    assert.Containsf(t, {"Hello": "World"}, "Hello", "error message %s", "formatted")
-func Containsf(t TestingT, s interface{}, contains interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Containsf(t, s, contains, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// DirExists checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func DirExists(t TestingT, path string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.DirExists(t, path, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// DirExistsf checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func DirExistsf(t TestingT, path string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.DirExistsf(t, path, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// ElementsMatch asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// assert.ElementsMatch(t, [1, 3, 2, 3], [1, 3, 3, 2])
-func ElementsMatch(t TestingT, listA interface{}, listB interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.ElementsMatch(t, listA, listB, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// ElementsMatchf asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// assert.ElementsMatchf(t, [1, 3, 2, 3], [1, 3, 3, 2], "error message %s", "formatted")
-func ElementsMatchf(t TestingT, listA interface{}, listB interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.ElementsMatchf(t, listA, listB, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Empty asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  assert.Empty(t, obj)
-func Empty(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Empty(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Emptyf asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  assert.Emptyf(t, obj, "error message %s", "formatted")
-func Emptyf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Emptyf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Equal asserts that two objects are equal.
-//
-//    assert.Equal(t, 123, 123)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func Equal(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Equal(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// EqualError asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   assert.EqualError(t, err,  expectedErrorString)
-func EqualError(t TestingT, theError error, errString string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.EqualError(t, theError, errString, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// EqualErrorf asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   assert.EqualErrorf(t, err,  expectedErrorString, "error message %s", "formatted")
-func EqualErrorf(t TestingT, theError error, errString string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.EqualErrorf(t, theError, errString, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// EqualValues asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    assert.EqualValues(t, uint32(123), int32(123))
-func EqualValues(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.EqualValues(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// EqualValuesf asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    assert.EqualValuesf(t, uint32(123), int32(123), "error message %s", "formatted")
-func EqualValuesf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.EqualValuesf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Equalf asserts that two objects are equal.
-//
-//    assert.Equalf(t, 123, 123, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func Equalf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Equalf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Error asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.Error(t, err) {
-// 	   assert.Equal(t, expectedError, err)
-//   }
-func Error(t TestingT, err error, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Error(t, err, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// ErrorAs asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func ErrorAs(t TestingT, err error, target interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.ErrorAs(t, err, target, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// ErrorAsf asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func ErrorAsf(t TestingT, err error, target interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.ErrorAsf(t, err, target, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// ErrorIs asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func ErrorIs(t TestingT, err error, target error, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.ErrorIs(t, err, target, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// ErrorIsf asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func ErrorIsf(t TestingT, err error, target error, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.ErrorIsf(t, err, target, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Errorf asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.Errorf(t, err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedErrorf, err)
-//   }
-func Errorf(t TestingT, err error, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Errorf(t, err, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Eventually asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    assert.Eventually(t, func() bool { return true; }, time.Second, 10*time.Millisecond)
-func Eventually(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Eventually(t, condition, waitFor, tick, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Eventuallyf asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    assert.Eventuallyf(t, func() bool { return true; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func Eventuallyf(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Eventuallyf(t, condition, waitFor, tick, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Exactly asserts that two objects are equal in value and type.
-//
-//    assert.Exactly(t, int32(123), int64(123))
-func Exactly(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Exactly(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Exactlyf asserts that two objects are equal in value and type.
-//
-//    assert.Exactlyf(t, int32(123), int64(123), "error message %s", "formatted")
-func Exactlyf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Exactlyf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Fail reports a failure through
-func Fail(t TestingT, failureMessage string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Fail(t, failureMessage, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// FailNow fails test
-func FailNow(t TestingT, failureMessage string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.FailNow(t, failureMessage, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// FailNowf fails test
-func FailNowf(t TestingT, failureMessage string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.FailNowf(t, failureMessage, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Failf reports a failure through
-func Failf(t TestingT, failureMessage string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Failf(t, failureMessage, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// False asserts that the specified value is false.
-//
-//    assert.False(t, myBool)
-func False(t TestingT, value bool, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.False(t, value, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Falsef asserts that the specified value is false.
-//
-//    assert.Falsef(t, myBool, "error message %s", "formatted")
-func Falsef(t TestingT, value bool, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Falsef(t, value, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// FileExists checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func FileExists(t TestingT, path string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.FileExists(t, path, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// FileExistsf checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func FileExistsf(t TestingT, path string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.FileExistsf(t, path, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Greater asserts that the first element is greater than the second
-//
-//    assert.Greater(t, 2, 1)
-//    assert.Greater(t, float64(2), float64(1))
-//    assert.Greater(t, "b", "a")
-func Greater(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Greater(t, e1, e2, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// GreaterOrEqual asserts that the first element is greater than or equal to the second
-//
-//    assert.GreaterOrEqual(t, 2, 1)
-//    assert.GreaterOrEqual(t, 2, 2)
-//    assert.GreaterOrEqual(t, "b", "a")
-//    assert.GreaterOrEqual(t, "b", "b")
-func GreaterOrEqual(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.GreaterOrEqual(t, e1, e2, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// GreaterOrEqualf asserts that the first element is greater than or equal to the second
-//
-//    assert.GreaterOrEqualf(t, 2, 1, "error message %s", "formatted")
-//    assert.GreaterOrEqualf(t, 2, 2, "error message %s", "formatted")
-//    assert.GreaterOrEqualf(t, "b", "a", "error message %s", "formatted")
-//    assert.GreaterOrEqualf(t, "b", "b", "error message %s", "formatted")
-func GreaterOrEqualf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.GreaterOrEqualf(t, e1, e2, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Greaterf asserts that the first element is greater than the second
-//
-//    assert.Greaterf(t, 2, 1, "error message %s", "formatted")
-//    assert.Greaterf(t, float64(2), float64(1), "error message %s", "formatted")
-//    assert.Greaterf(t, "b", "a", "error message %s", "formatted")
-func Greaterf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Greaterf(t, e1, e2, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPBodyContains asserts that a specified handler returns a
-// body that contains a string.
-//
-//  assert.HTTPBodyContains(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyContains(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPBodyContains(t, handler, method, url, values, str, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPBodyContainsf asserts that a specified handler returns a
-// body that contains a string.
-//
-//  assert.HTTPBodyContainsf(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyContainsf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPBodyContainsf(t, handler, method, url, values, str, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPBodyNotContains asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  assert.HTTPBodyNotContains(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyNotContains(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPBodyNotContains(t, handler, method, url, values, str, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPBodyNotContainsf asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  assert.HTTPBodyNotContainsf(t, myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPBodyNotContainsf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPBodyNotContainsf(t, handler, method, url, values, str, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPError asserts that a specified handler returns an error status code.
-//
-//  assert.HTTPError(t, myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPError(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPError(t, handler, method, url, values, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPErrorf asserts that a specified handler returns an error status code.
-//
-//  assert.HTTPErrorf(t, myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPErrorf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPErrorf(t, handler, method, url, values, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPRedirect asserts that a specified handler returns a redirect status code.
-//
-//  assert.HTTPRedirect(t, myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPRedirect(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPRedirect(t, handler, method, url, values, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPRedirectf asserts that a specified handler returns a redirect status code.
-//
-//  assert.HTTPRedirectf(t, myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPRedirectf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPRedirectf(t, handler, method, url, values, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPStatusCode asserts that a specified handler returns a specified status code.
-//
-//  assert.HTTPStatusCode(t, myHandler, "GET", "/notImplemented", nil, 501)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPStatusCode(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPStatusCode(t, handler, method, url, values, statuscode, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPStatusCodef asserts that a specified handler returns a specified status code.
-//
-//  assert.HTTPStatusCodef(t, myHandler, "GET", "/notImplemented", nil, 501, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPStatusCodef(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPStatusCodef(t, handler, method, url, values, statuscode, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPSuccess asserts that a specified handler returns a success status code.
-//
-//  assert.HTTPSuccess(t, myHandler, "POST", "http://www.google.com", nil)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPSuccess(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPSuccess(t, handler, method, url, values, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// HTTPSuccessf asserts that a specified handler returns a success status code.
-//
-//  assert.HTTPSuccessf(t, myHandler, "POST", "http://www.google.com", nil, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func HTTPSuccessf(t TestingT, handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.HTTPSuccessf(t, handler, method, url, values, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Implements asserts that an object is implemented by the specified interface.
-//
-//    assert.Implements(t, (*MyInterface)(nil), new(MyObject))
-func Implements(t TestingT, interfaceObject interface{}, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Implements(t, interfaceObject, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Implementsf asserts that an object is implemented by the specified interface.
-//
-//    assert.Implementsf(t, (*MyInterface)(nil), new(MyObject), "error message %s", "formatted")
-func Implementsf(t TestingT, interfaceObject interface{}, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Implementsf(t, interfaceObject, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InDelta asserts that the two numerals are within delta of each other.
-//
-// 	 assert.InDelta(t, math.Pi, 22/7.0, 0.01)
-func InDelta(t TestingT, expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InDelta(t, expected, actual, delta, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InDeltaMapValues is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func InDeltaMapValues(t TestingT, expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InDeltaMapValues(t, expected, actual, delta, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InDeltaMapValuesf is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func InDeltaMapValuesf(t TestingT, expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InDeltaMapValuesf(t, expected, actual, delta, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InDeltaSlice is the same as InDelta, except it compares two slices.
-func InDeltaSlice(t TestingT, expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InDeltaSlice(t, expected, actual, delta, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InDeltaSlicef is the same as InDelta, except it compares two slices.
-func InDeltaSlicef(t TestingT, expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InDeltaSlicef(t, expected, actual, delta, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InDeltaf asserts that the two numerals are within delta of each other.
-//
-// 	 assert.InDeltaf(t, math.Pi, 22/7.0, 0.01, "error message %s", "formatted")
-func InDeltaf(t TestingT, expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InDeltaf(t, expected, actual, delta, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InEpsilon asserts that expected and actual have a relative error less than epsilon
-func InEpsilon(t TestingT, expected interface{}, actual interface{}, epsilon float64, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InEpsilon(t, expected, actual, epsilon, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InEpsilonSlice is the same as InEpsilon, except it compares each value from two slices.
-func InEpsilonSlice(t TestingT, expected interface{}, actual interface{}, epsilon float64, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InEpsilonSlice(t, expected, actual, epsilon, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InEpsilonSlicef is the same as InEpsilon, except it compares each value from two slices.
-func InEpsilonSlicef(t TestingT, expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InEpsilonSlicef(t, expected, actual, epsilon, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// InEpsilonf asserts that expected and actual have a relative error less than epsilon
-func InEpsilonf(t TestingT, expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.InEpsilonf(t, expected, actual, epsilon, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsDecreasing asserts that the collection is decreasing
-//
-//    assert.IsDecreasing(t, []int{2, 1, 0})
-//    assert.IsDecreasing(t, []float{2, 1})
-//    assert.IsDecreasing(t, []string{"b", "a"})
-func IsDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsDecreasing(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsDecreasingf asserts that the collection is decreasing
-//
-//    assert.IsDecreasingf(t, []int{2, 1, 0}, "error message %s", "formatted")
-//    assert.IsDecreasingf(t, []float{2, 1}, "error message %s", "formatted")
-//    assert.IsDecreasingf(t, []string{"b", "a"}, "error message %s", "formatted")
-func IsDecreasingf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsDecreasingf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsIncreasing asserts that the collection is increasing
-//
-//    assert.IsIncreasing(t, []int{1, 2, 3})
-//    assert.IsIncreasing(t, []float{1, 2})
-//    assert.IsIncreasing(t, []string{"a", "b"})
-func IsIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsIncreasing(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsIncreasingf asserts that the collection is increasing
-//
-//    assert.IsIncreasingf(t, []int{1, 2, 3}, "error message %s", "formatted")
-//    assert.IsIncreasingf(t, []float{1, 2}, "error message %s", "formatted")
-//    assert.IsIncreasingf(t, []string{"a", "b"}, "error message %s", "formatted")
-func IsIncreasingf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsIncreasingf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsNonDecreasing asserts that the collection is not decreasing
-//
-//    assert.IsNonDecreasing(t, []int{1, 1, 2})
-//    assert.IsNonDecreasing(t, []float{1, 2})
-//    assert.IsNonDecreasing(t, []string{"a", "b"})
-func IsNonDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsNonDecreasing(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsNonDecreasingf asserts that the collection is not decreasing
-//
-//    assert.IsNonDecreasingf(t, []int{1, 1, 2}, "error message %s", "formatted")
-//    assert.IsNonDecreasingf(t, []float{1, 2}, "error message %s", "formatted")
-//    assert.IsNonDecreasingf(t, []string{"a", "b"}, "error message %s", "formatted")
-func IsNonDecreasingf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsNonDecreasingf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsNonIncreasing asserts that the collection is not increasing
-//
-//    assert.IsNonIncreasing(t, []int{2, 1, 1})
-//    assert.IsNonIncreasing(t, []float{2, 1})
-//    assert.IsNonIncreasing(t, []string{"b", "a"})
-func IsNonIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsNonIncreasing(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsNonIncreasingf asserts that the collection is not increasing
-//
-//    assert.IsNonIncreasingf(t, []int{2, 1, 1}, "error message %s", "formatted")
-//    assert.IsNonIncreasingf(t, []float{2, 1}, "error message %s", "formatted")
-//    assert.IsNonIncreasingf(t, []string{"b", "a"}, "error message %s", "formatted")
-func IsNonIncreasingf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsNonIncreasingf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsType asserts that the specified objects are of the same type.
-func IsType(t TestingT, expectedType interface{}, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsType(t, expectedType, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// IsTypef asserts that the specified objects are of the same type.
-func IsTypef(t TestingT, expectedType interface{}, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.IsTypef(t, expectedType, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// JSONEq asserts that two JSON strings are equivalent.
-//
-//  assert.JSONEq(t, `{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`)
-func JSONEq(t TestingT, expected string, actual string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.JSONEq(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// JSONEqf asserts that two JSON strings are equivalent.
-//
-//  assert.JSONEqf(t, `{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`, "error message %s", "formatted")
-func JSONEqf(t TestingT, expected string, actual string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.JSONEqf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Len asserts that the specified object has specific length.
-// Len also fails if the object has a type that len() not accept.
-//
-//    assert.Len(t, mySlice, 3)
-func Len(t TestingT, object interface{}, length int, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Len(t, object, length, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Lenf asserts that the specified object has specific length.
-// Lenf also fails if the object has a type that len() not accept.
-//
-//    assert.Lenf(t, mySlice, 3, "error message %s", "formatted")
-func Lenf(t TestingT, object interface{}, length int, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Lenf(t, object, length, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Less asserts that the first element is less than the second
-//
-//    assert.Less(t, 1, 2)
-//    assert.Less(t, float64(1), float64(2))
-//    assert.Less(t, "a", "b")
-func Less(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Less(t, e1, e2, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// LessOrEqual asserts that the first element is less than or equal to the second
-//
-//    assert.LessOrEqual(t, 1, 2)
-//    assert.LessOrEqual(t, 2, 2)
-//    assert.LessOrEqual(t, "a", "b")
-//    assert.LessOrEqual(t, "b", "b")
-func LessOrEqual(t TestingT, e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.LessOrEqual(t, e1, e2, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// LessOrEqualf asserts that the first element is less than or equal to the second
-//
-//    assert.LessOrEqualf(t, 1, 2, "error message %s", "formatted")
-//    assert.LessOrEqualf(t, 2, 2, "error message %s", "formatted")
-//    assert.LessOrEqualf(t, "a", "b", "error message %s", "formatted")
-//    assert.LessOrEqualf(t, "b", "b", "error message %s", "formatted")
-func LessOrEqualf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.LessOrEqualf(t, e1, e2, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Lessf asserts that the first element is less than the second
-//
-//    assert.Lessf(t, 1, 2, "error message %s", "formatted")
-//    assert.Lessf(t, float64(1), float64(2), "error message %s", "formatted")
-//    assert.Lessf(t, "a", "b", "error message %s", "formatted")
-func Lessf(t TestingT, e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Lessf(t, e1, e2, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Negative asserts that the specified element is negative
-//
-//    assert.Negative(t, -1)
-//    assert.Negative(t, -1.23)
-func Negative(t TestingT, e interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Negative(t, e, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Negativef asserts that the specified element is negative
-//
-//    assert.Negativef(t, -1, "error message %s", "formatted")
-//    assert.Negativef(t, -1.23, "error message %s", "formatted")
-func Negativef(t TestingT, e interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Negativef(t, e, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Never asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    assert.Never(t, func() bool { return false; }, time.Second, 10*time.Millisecond)
-func Never(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Never(t, condition, waitFor, tick, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Neverf asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    assert.Neverf(t, func() bool { return false; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func Neverf(t TestingT, condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Neverf(t, condition, waitFor, tick, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Nil asserts that the specified object is nil.
-//
-//    assert.Nil(t, err)
-func Nil(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Nil(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Nilf asserts that the specified object is nil.
-//
-//    assert.Nilf(t, err, "error message %s", "formatted")
-func Nilf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Nilf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NoDirExists checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func NoDirExists(t TestingT, path string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NoDirExists(t, path, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NoDirExistsf checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func NoDirExistsf(t TestingT, path string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NoDirExistsf(t, path, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NoError asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.NoError(t, err) {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func NoError(t TestingT, err error, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NoError(t, err, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NoErrorf asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if assert.NoErrorf(t, err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func NoErrorf(t TestingT, err error, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NoErrorf(t, err, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NoFileExists checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func NoFileExists(t TestingT, path string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NoFileExists(t, path, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NoFileExistsf checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func NoFileExistsf(t TestingT, path string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NoFileExistsf(t, path, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotContains asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    assert.NotContains(t, "Hello World", "Earth")
-//    assert.NotContains(t, ["Hello", "World"], "Earth")
-//    assert.NotContains(t, {"Hello": "World"}, "Earth")
-func NotContains(t TestingT, s interface{}, contains interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotContains(t, s, contains, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotContainsf asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    assert.NotContainsf(t, "Hello World", "Earth", "error message %s", "formatted")
-//    assert.NotContainsf(t, ["Hello", "World"], "Earth", "error message %s", "formatted")
-//    assert.NotContainsf(t, {"Hello": "World"}, "Earth", "error message %s", "formatted")
-func NotContainsf(t TestingT, s interface{}, contains interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotContainsf(t, s, contains, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotEmpty asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if assert.NotEmpty(t, obj) {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func NotEmpty(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotEmpty(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotEmptyf asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if assert.NotEmptyf(t, obj, "error message %s", "formatted") {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func NotEmptyf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotEmptyf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotEqual asserts that the specified values are NOT equal.
-//
-//    assert.NotEqual(t, obj1, obj2)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func NotEqual(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotEqual(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotEqualValues asserts that two objects are not equal even when converted to the same type
-//
-//    assert.NotEqualValues(t, obj1, obj2)
-func NotEqualValues(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotEqualValues(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotEqualValuesf asserts that two objects are not equal even when converted to the same type
-//
-//    assert.NotEqualValuesf(t, obj1, obj2, "error message %s", "formatted")
-func NotEqualValuesf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotEqualValuesf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotEqualf asserts that the specified values are NOT equal.
-//
-//    assert.NotEqualf(t, obj1, obj2, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func NotEqualf(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotEqualf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotErrorIs asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func NotErrorIs(t TestingT, err error, target error, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotErrorIs(t, err, target, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotErrorIsf asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func NotErrorIsf(t TestingT, err error, target error, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotErrorIsf(t, err, target, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotNil asserts that the specified object is not nil.
-//
-//    assert.NotNil(t, err)
-func NotNil(t TestingT, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotNil(t, object, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotNilf asserts that the specified object is not nil.
-//
-//    assert.NotNilf(t, err, "error message %s", "formatted")
-func NotNilf(t TestingT, object interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotNilf(t, object, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotPanics asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   assert.NotPanics(t, func(){ RemainCalm() })
-func NotPanics(t TestingT, f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotPanics(t, f, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotPanicsf asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   assert.NotPanicsf(t, func(){ RemainCalm() }, "error message %s", "formatted")
-func NotPanicsf(t TestingT, f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotPanicsf(t, f, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotRegexp asserts that a specified regexp does not match a string.
-//
-//  assert.NotRegexp(t, regexp.MustCompile("starts"), "it's starting")
-//  assert.NotRegexp(t, "^start", "it's not starting")
-func NotRegexp(t TestingT, rx interface{}, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotRegexp(t, rx, str, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotRegexpf asserts that a specified regexp does not match a string.
-//
-//  assert.NotRegexpf(t, regexp.MustCompile("starts"), "it's starting", "error message %s", "formatted")
-//  assert.NotRegexpf(t, "^start", "it's not starting", "error message %s", "formatted")
-func NotRegexpf(t TestingT, rx interface{}, str interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotRegexpf(t, rx, str, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotSame asserts that two pointers do not reference the same object.
-//
-//    assert.NotSame(t, ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func NotSame(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotSame(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotSamef asserts that two pointers do not reference the same object.
-//
-//    assert.NotSamef(t, ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func NotSamef(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotSamef(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotSubset asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.NotSubset(t, [1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]")
-func NotSubset(t TestingT, list interface{}, subset interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotSubset(t, list, subset, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotSubsetf asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.NotSubsetf(t, [1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]", "error message %s", "formatted")
-func NotSubsetf(t TestingT, list interface{}, subset interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotSubsetf(t, list, subset, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotZero asserts that i is not the zero value for its type.
-func NotZero(t TestingT, i interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotZero(t, i, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// NotZerof asserts that i is not the zero value for its type.
-func NotZerof(t TestingT, i interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.NotZerof(t, i, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Panics asserts that the code inside the specified PanicTestFunc panics.
-//
-//   assert.Panics(t, func(){ GoCrazy() })
-func Panics(t TestingT, f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Panics(t, f, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// PanicsWithError asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   assert.PanicsWithError(t, "crazy error", func(){ GoCrazy() })
-func PanicsWithError(t TestingT, errString string, f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.PanicsWithError(t, errString, f, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// PanicsWithErrorf asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   assert.PanicsWithErrorf(t, "crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func PanicsWithErrorf(t TestingT, errString string, f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.PanicsWithErrorf(t, errString, f, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// PanicsWithValue asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   assert.PanicsWithValue(t, "crazy error", func(){ GoCrazy() })
-func PanicsWithValue(t TestingT, expected interface{}, f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.PanicsWithValue(t, expected, f, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// PanicsWithValuef asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   assert.PanicsWithValuef(t, "crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func PanicsWithValuef(t TestingT, expected interface{}, f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.PanicsWithValuef(t, expected, f, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Panicsf asserts that the code inside the specified PanicTestFunc panics.
-//
-//   assert.Panicsf(t, func(){ GoCrazy() }, "error message %s", "formatted")
-func Panicsf(t TestingT, f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Panicsf(t, f, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Positive asserts that the specified element is positive
-//
-//    assert.Positive(t, 1)
-//    assert.Positive(t, 1.23)
-func Positive(t TestingT, e interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Positive(t, e, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Positivef asserts that the specified element is positive
-//
-//    assert.Positivef(t, 1, "error message %s", "formatted")
-//    assert.Positivef(t, 1.23, "error message %s", "formatted")
-func Positivef(t TestingT, e interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Positivef(t, e, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Regexp asserts that a specified regexp matches a string.
-//
-//  assert.Regexp(t, regexp.MustCompile("start"), "it's starting")
-//  assert.Regexp(t, "start...$", "it's not starting")
-func Regexp(t TestingT, rx interface{}, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Regexp(t, rx, str, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Regexpf asserts that a specified regexp matches a string.
-//
-//  assert.Regexpf(t, regexp.MustCompile("start"), "it's starting", "error message %s", "formatted")
-//  assert.Regexpf(t, "start...$", "it's not starting", "error message %s", "formatted")
-func Regexpf(t TestingT, rx interface{}, str interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Regexpf(t, rx, str, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Same asserts that two pointers reference the same object.
-//
-//    assert.Same(t, ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func Same(t TestingT, expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Same(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Samef asserts that two pointers reference the same object.
-//
-//    assert.Samef(t, ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func Samef(t TestingT, expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Samef(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Subset asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.Subset(t, [1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]")
-func Subset(t TestingT, list interface{}, subset interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Subset(t, list, subset, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Subsetf asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    assert.Subsetf(t, [1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]", "error message %s", "formatted")
-func Subsetf(t TestingT, list interface{}, subset interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Subsetf(t, list, subset, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// True asserts that the specified value is true.
-//
-//    assert.True(t, myBool)
-func True(t TestingT, value bool, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.True(t, value, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Truef asserts that the specified value is true.
-//
-//    assert.Truef(t, myBool, "error message %s", "formatted")
-func Truef(t TestingT, value bool, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Truef(t, value, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// WithinDuration asserts that the two times are within duration delta of each other.
-//
-//   assert.WithinDuration(t, time.Now(), time.Now(), 10*time.Second)
-func WithinDuration(t TestingT, expected time.Time, actual time.Time, delta time.Duration, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.WithinDuration(t, expected, actual, delta, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// WithinDurationf asserts that the two times are within duration delta of each other.
-//
-//   assert.WithinDurationf(t, time.Now(), time.Now(), 10*time.Second, "error message %s", "formatted")
-func WithinDurationf(t TestingT, expected time.Time, actual time.Time, delta time.Duration, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.WithinDurationf(t, expected, actual, delta, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// YAMLEq asserts that two YAML strings are equivalent.
-func YAMLEq(t TestingT, expected string, actual string, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.YAMLEq(t, expected, actual, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// YAMLEqf asserts that two YAML strings are equivalent.
-func YAMLEqf(t TestingT, expected string, actual string, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.YAMLEqf(t, expected, actual, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Zero asserts that i is the zero value for its type.
-func Zero(t TestingT, i interface{}, msgAndArgs ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Zero(t, i, msgAndArgs...) {
-		return
-	}
-	t.FailNow()
-}
-
-// Zerof asserts that i is the zero value for its type.
-func Zerof(t TestingT, i interface{}, msg string, args ...interface{}) {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
-	if assert.Zerof(t, i, msg, args...) {
-		return
-	}
-	t.FailNow()
-}
diff --git a/vendor/github.com/stretchr/testify/require/require.go.tmpl b/vendor/github.com/stretchr/testify/require/require.go.tmpl
deleted file mode 100644
index 55e42ddebd..0000000000
--- a/vendor/github.com/stretchr/testify/require/require.go.tmpl
+++ /dev/null
@@ -1,6 +0,0 @@
-{{.Comment}}
-func {{.DocInfo.Name}}(t TestingT, {{.Params}}) {
-	if h, ok := t.(tHelper); ok { h.Helper() }
-	if assert.{{.DocInfo.Name}}(t, {{.ForwardedParams}}) { return }
-	t.FailNow()
-}
diff --git a/vendor/github.com/stretchr/testify/require/require_forward.go b/vendor/github.com/stretchr/testify/require/require_forward.go
deleted file mode 100644
index ed54a9d83f..0000000000
--- a/vendor/github.com/stretchr/testify/require/require_forward.go
+++ /dev/null
@@ -1,1471 +0,0 @@
-/*
-* CODE GENERATED AUTOMATICALLY WITH github.com/stretchr/testify/_codegen
-* THIS FILE MUST NOT BE EDITED BY HAND
- */
-
-package require
-
-import (
-	assert "github.com/stretchr/testify/assert"
-	http "net/http"
-	url "net/url"
-	time "time"
-)
-
-// Condition uses a Comparison to assert a complex condition.
-func (a *Assertions) Condition(comp assert.Comparison, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Condition(a.t, comp, msgAndArgs...)
-}
-
-// Conditionf uses a Comparison to assert a complex condition.
-func (a *Assertions) Conditionf(comp assert.Comparison, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Conditionf(a.t, comp, msg, args...)
-}
-
-// Contains asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    a.Contains("Hello World", "World")
-//    a.Contains(["Hello", "World"], "World")
-//    a.Contains({"Hello": "World"}, "Hello")
-func (a *Assertions) Contains(s interface{}, contains interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Contains(a.t, s, contains, msgAndArgs...)
-}
-
-// Containsf asserts that the specified string, list(array, slice...) or map contains the
-// specified substring or element.
-//
-//    a.Containsf("Hello World", "World", "error message %s", "formatted")
-//    a.Containsf(["Hello", "World"], "World", "error message %s", "formatted")
-//    a.Containsf({"Hello": "World"}, "Hello", "error message %s", "formatted")
-func (a *Assertions) Containsf(s interface{}, contains interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Containsf(a.t, s, contains, msg, args...)
-}
-
-// DirExists checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func (a *Assertions) DirExists(path string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	DirExists(a.t, path, msgAndArgs...)
-}
-
-// DirExistsf checks whether a directory exists in the given path. It also fails
-// if the path is a file rather a directory or there is an error checking whether it exists.
-func (a *Assertions) DirExistsf(path string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	DirExistsf(a.t, path, msg, args...)
-}
-
-// ElementsMatch asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// a.ElementsMatch([1, 3, 2, 3], [1, 3, 3, 2])
-func (a *Assertions) ElementsMatch(listA interface{}, listB interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	ElementsMatch(a.t, listA, listB, msgAndArgs...)
-}
-
-// ElementsMatchf asserts that the specified listA(array, slice...) is equal to specified
-// listB(array, slice...) ignoring the order of the elements. If there are duplicate elements,
-// the number of appearances of each of them in both lists should match.
-//
-// a.ElementsMatchf([1, 3, 2, 3], [1, 3, 3, 2], "error message %s", "formatted")
-func (a *Assertions) ElementsMatchf(listA interface{}, listB interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	ElementsMatchf(a.t, listA, listB, msg, args...)
-}
-
-// Empty asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  a.Empty(obj)
-func (a *Assertions) Empty(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Empty(a.t, object, msgAndArgs...)
-}
-
-// Emptyf asserts that the specified object is empty.  I.e. nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  a.Emptyf(obj, "error message %s", "formatted")
-func (a *Assertions) Emptyf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Emptyf(a.t, object, msg, args...)
-}
-
-// Equal asserts that two objects are equal.
-//
-//    a.Equal(123, 123)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func (a *Assertions) Equal(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Equal(a.t, expected, actual, msgAndArgs...)
-}
-
-// EqualError asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   a.EqualError(err,  expectedErrorString)
-func (a *Assertions) EqualError(theError error, errString string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	EqualError(a.t, theError, errString, msgAndArgs...)
-}
-
-// EqualErrorf asserts that a function returned an error (i.e. not `nil`)
-// and that it is equal to the provided error.
-//
-//   actualObj, err := SomeFunction()
-//   a.EqualErrorf(err,  expectedErrorString, "error message %s", "formatted")
-func (a *Assertions) EqualErrorf(theError error, errString string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	EqualErrorf(a.t, theError, errString, msg, args...)
-}
-
-// EqualValues asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    a.EqualValues(uint32(123), int32(123))
-func (a *Assertions) EqualValues(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	EqualValues(a.t, expected, actual, msgAndArgs...)
-}
-
-// EqualValuesf asserts that two objects are equal or convertable to the same types
-// and equal.
-//
-//    a.EqualValuesf(uint32(123), int32(123), "error message %s", "formatted")
-func (a *Assertions) EqualValuesf(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	EqualValuesf(a.t, expected, actual, msg, args...)
-}
-
-// Equalf asserts that two objects are equal.
-//
-//    a.Equalf(123, 123, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses). Function equality
-// cannot be determined and will always fail.
-func (a *Assertions) Equalf(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Equalf(a.t, expected, actual, msg, args...)
-}
-
-// Error asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.Error(err) {
-// 	   assert.Equal(t, expectedError, err)
-//   }
-func (a *Assertions) Error(err error, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Error(a.t, err, msgAndArgs...)
-}
-
-// ErrorAs asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func (a *Assertions) ErrorAs(err error, target interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	ErrorAs(a.t, err, target, msgAndArgs...)
-}
-
-// ErrorAsf asserts that at least one of the errors in err's chain matches target, and if so, sets target to that error value.
-// This is a wrapper for errors.As.
-func (a *Assertions) ErrorAsf(err error, target interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	ErrorAsf(a.t, err, target, msg, args...)
-}
-
-// ErrorIs asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) ErrorIs(err error, target error, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	ErrorIs(a.t, err, target, msgAndArgs...)
-}
-
-// ErrorIsf asserts that at least one of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) ErrorIsf(err error, target error, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	ErrorIsf(a.t, err, target, msg, args...)
-}
-
-// Errorf asserts that a function returned an error (i.e. not `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.Errorf(err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedErrorf, err)
-//   }
-func (a *Assertions) Errorf(err error, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Errorf(a.t, err, msg, args...)
-}
-
-// Eventually asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    a.Eventually(func() bool { return true; }, time.Second, 10*time.Millisecond)
-func (a *Assertions) Eventually(condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Eventually(a.t, condition, waitFor, tick, msgAndArgs...)
-}
-
-// Eventuallyf asserts that given condition will be met in waitFor time,
-// periodically checking target function each tick.
-//
-//    a.Eventuallyf(func() bool { return true; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func (a *Assertions) Eventuallyf(condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Eventuallyf(a.t, condition, waitFor, tick, msg, args...)
-}
-
-// Exactly asserts that two objects are equal in value and type.
-//
-//    a.Exactly(int32(123), int64(123))
-func (a *Assertions) Exactly(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Exactly(a.t, expected, actual, msgAndArgs...)
-}
-
-// Exactlyf asserts that two objects are equal in value and type.
-//
-//    a.Exactlyf(int32(123), int64(123), "error message %s", "formatted")
-func (a *Assertions) Exactlyf(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Exactlyf(a.t, expected, actual, msg, args...)
-}
-
-// Fail reports a failure through
-func (a *Assertions) Fail(failureMessage string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Fail(a.t, failureMessage, msgAndArgs...)
-}
-
-// FailNow fails test
-func (a *Assertions) FailNow(failureMessage string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	FailNow(a.t, failureMessage, msgAndArgs...)
-}
-
-// FailNowf fails test
-func (a *Assertions) FailNowf(failureMessage string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	FailNowf(a.t, failureMessage, msg, args...)
-}
-
-// Failf reports a failure through
-func (a *Assertions) Failf(failureMessage string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Failf(a.t, failureMessage, msg, args...)
-}
-
-// False asserts that the specified value is false.
-//
-//    a.False(myBool)
-func (a *Assertions) False(value bool, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	False(a.t, value, msgAndArgs...)
-}
-
-// Falsef asserts that the specified value is false.
-//
-//    a.Falsef(myBool, "error message %s", "formatted")
-func (a *Assertions) Falsef(value bool, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Falsef(a.t, value, msg, args...)
-}
-
-// FileExists checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func (a *Assertions) FileExists(path string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	FileExists(a.t, path, msgAndArgs...)
-}
-
-// FileExistsf checks whether a file exists in the given path. It also fails if
-// the path points to a directory or there is an error when trying to check the file.
-func (a *Assertions) FileExistsf(path string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	FileExistsf(a.t, path, msg, args...)
-}
-
-// Greater asserts that the first element is greater than the second
-//
-//    a.Greater(2, 1)
-//    a.Greater(float64(2), float64(1))
-//    a.Greater("b", "a")
-func (a *Assertions) Greater(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Greater(a.t, e1, e2, msgAndArgs...)
-}
-
-// GreaterOrEqual asserts that the first element is greater than or equal to the second
-//
-//    a.GreaterOrEqual(2, 1)
-//    a.GreaterOrEqual(2, 2)
-//    a.GreaterOrEqual("b", "a")
-//    a.GreaterOrEqual("b", "b")
-func (a *Assertions) GreaterOrEqual(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	GreaterOrEqual(a.t, e1, e2, msgAndArgs...)
-}
-
-// GreaterOrEqualf asserts that the first element is greater than or equal to the second
-//
-//    a.GreaterOrEqualf(2, 1, "error message %s", "formatted")
-//    a.GreaterOrEqualf(2, 2, "error message %s", "formatted")
-//    a.GreaterOrEqualf("b", "a", "error message %s", "formatted")
-//    a.GreaterOrEqualf("b", "b", "error message %s", "formatted")
-func (a *Assertions) GreaterOrEqualf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	GreaterOrEqualf(a.t, e1, e2, msg, args...)
-}
-
-// Greaterf asserts that the first element is greater than the second
-//
-//    a.Greaterf(2, 1, "error message %s", "formatted")
-//    a.Greaterf(float64(2), float64(1), "error message %s", "formatted")
-//    a.Greaterf("b", "a", "error message %s", "formatted")
-func (a *Assertions) Greaterf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Greaterf(a.t, e1, e2, msg, args...)
-}
-
-// HTTPBodyContains asserts that a specified handler returns a
-// body that contains a string.
-//
-//  a.HTTPBodyContains(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyContains(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPBodyContains(a.t, handler, method, url, values, str, msgAndArgs...)
-}
-
-// HTTPBodyContainsf asserts that a specified handler returns a
-// body that contains a string.
-//
-//  a.HTTPBodyContainsf(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyContainsf(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPBodyContainsf(a.t, handler, method, url, values, str, msg, args...)
-}
-
-// HTTPBodyNotContains asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  a.HTTPBodyNotContains(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyNotContains(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPBodyNotContains(a.t, handler, method, url, values, str, msgAndArgs...)
-}
-
-// HTTPBodyNotContainsf asserts that a specified handler returns a
-// body that does not contain a string.
-//
-//  a.HTTPBodyNotContainsf(myHandler, "GET", "www.google.com", nil, "I'm Feeling Lucky", "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPBodyNotContainsf(handler http.HandlerFunc, method string, url string, values url.Values, str interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPBodyNotContainsf(a.t, handler, method, url, values, str, msg, args...)
-}
-
-// HTTPError asserts that a specified handler returns an error status code.
-//
-//  a.HTTPError(myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPError(handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPError(a.t, handler, method, url, values, msgAndArgs...)
-}
-
-// HTTPErrorf asserts that a specified handler returns an error status code.
-//
-//  a.HTTPErrorf(myHandler, "POST", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPErrorf(handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPErrorf(a.t, handler, method, url, values, msg, args...)
-}
-
-// HTTPRedirect asserts that a specified handler returns a redirect status code.
-//
-//  a.HTTPRedirect(myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPRedirect(handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPRedirect(a.t, handler, method, url, values, msgAndArgs...)
-}
-
-// HTTPRedirectf asserts that a specified handler returns a redirect status code.
-//
-//  a.HTTPRedirectf(myHandler, "GET", "/a/b/c", url.Values{"a": []string{"b", "c"}}
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPRedirectf(handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPRedirectf(a.t, handler, method, url, values, msg, args...)
-}
-
-// HTTPStatusCode asserts that a specified handler returns a specified status code.
-//
-//  a.HTTPStatusCode(myHandler, "GET", "/notImplemented", nil, 501)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPStatusCode(handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPStatusCode(a.t, handler, method, url, values, statuscode, msgAndArgs...)
-}
-
-// HTTPStatusCodef asserts that a specified handler returns a specified status code.
-//
-//  a.HTTPStatusCodef(myHandler, "GET", "/notImplemented", nil, 501, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPStatusCodef(handler http.HandlerFunc, method string, url string, values url.Values, statuscode int, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPStatusCodef(a.t, handler, method, url, values, statuscode, msg, args...)
-}
-
-// HTTPSuccess asserts that a specified handler returns a success status code.
-//
-//  a.HTTPSuccess(myHandler, "POST", "http://www.google.com", nil)
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPSuccess(handler http.HandlerFunc, method string, url string, values url.Values, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPSuccess(a.t, handler, method, url, values, msgAndArgs...)
-}
-
-// HTTPSuccessf asserts that a specified handler returns a success status code.
-//
-//  a.HTTPSuccessf(myHandler, "POST", "http://www.google.com", nil, "error message %s", "formatted")
-//
-// Returns whether the assertion was successful (true) or not (false).
-func (a *Assertions) HTTPSuccessf(handler http.HandlerFunc, method string, url string, values url.Values, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	HTTPSuccessf(a.t, handler, method, url, values, msg, args...)
-}
-
-// Implements asserts that an object is implemented by the specified interface.
-//
-//    a.Implements((*MyInterface)(nil), new(MyObject))
-func (a *Assertions) Implements(interfaceObject interface{}, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Implements(a.t, interfaceObject, object, msgAndArgs...)
-}
-
-// Implementsf asserts that an object is implemented by the specified interface.
-//
-//    a.Implementsf((*MyInterface)(nil), new(MyObject), "error message %s", "formatted")
-func (a *Assertions) Implementsf(interfaceObject interface{}, object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Implementsf(a.t, interfaceObject, object, msg, args...)
-}
-
-// InDelta asserts that the two numerals are within delta of each other.
-//
-// 	 a.InDelta(math.Pi, 22/7.0, 0.01)
-func (a *Assertions) InDelta(expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InDelta(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// InDeltaMapValues is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func (a *Assertions) InDeltaMapValues(expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InDeltaMapValues(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// InDeltaMapValuesf is the same as InDelta, but it compares all values between two maps. Both maps must have exactly the same keys.
-func (a *Assertions) InDeltaMapValuesf(expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InDeltaMapValuesf(a.t, expected, actual, delta, msg, args...)
-}
-
-// InDeltaSlice is the same as InDelta, except it compares two slices.
-func (a *Assertions) InDeltaSlice(expected interface{}, actual interface{}, delta float64, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InDeltaSlice(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// InDeltaSlicef is the same as InDelta, except it compares two slices.
-func (a *Assertions) InDeltaSlicef(expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InDeltaSlicef(a.t, expected, actual, delta, msg, args...)
-}
-
-// InDeltaf asserts that the two numerals are within delta of each other.
-//
-// 	 a.InDeltaf(math.Pi, 22/7.0, 0.01, "error message %s", "formatted")
-func (a *Assertions) InDeltaf(expected interface{}, actual interface{}, delta float64, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InDeltaf(a.t, expected, actual, delta, msg, args...)
-}
-
-// InEpsilon asserts that expected and actual have a relative error less than epsilon
-func (a *Assertions) InEpsilon(expected interface{}, actual interface{}, epsilon float64, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InEpsilon(a.t, expected, actual, epsilon, msgAndArgs...)
-}
-
-// InEpsilonSlice is the same as InEpsilon, except it compares each value from two slices.
-func (a *Assertions) InEpsilonSlice(expected interface{}, actual interface{}, epsilon float64, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InEpsilonSlice(a.t, expected, actual, epsilon, msgAndArgs...)
-}
-
-// InEpsilonSlicef is the same as InEpsilon, except it compares each value from two slices.
-func (a *Assertions) InEpsilonSlicef(expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InEpsilonSlicef(a.t, expected, actual, epsilon, msg, args...)
-}
-
-// InEpsilonf asserts that expected and actual have a relative error less than epsilon
-func (a *Assertions) InEpsilonf(expected interface{}, actual interface{}, epsilon float64, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	InEpsilonf(a.t, expected, actual, epsilon, msg, args...)
-}
-
-// IsDecreasing asserts that the collection is decreasing
-//
-//    a.IsDecreasing([]int{2, 1, 0})
-//    a.IsDecreasing([]float{2, 1})
-//    a.IsDecreasing([]string{"b", "a"})
-func (a *Assertions) IsDecreasing(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsDecreasing(a.t, object, msgAndArgs...)
-}
-
-// IsDecreasingf asserts that the collection is decreasing
-//
-//    a.IsDecreasingf([]int{2, 1, 0}, "error message %s", "formatted")
-//    a.IsDecreasingf([]float{2, 1}, "error message %s", "formatted")
-//    a.IsDecreasingf([]string{"b", "a"}, "error message %s", "formatted")
-func (a *Assertions) IsDecreasingf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsDecreasingf(a.t, object, msg, args...)
-}
-
-// IsIncreasing asserts that the collection is increasing
-//
-//    a.IsIncreasing([]int{1, 2, 3})
-//    a.IsIncreasing([]float{1, 2})
-//    a.IsIncreasing([]string{"a", "b"})
-func (a *Assertions) IsIncreasing(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsIncreasing(a.t, object, msgAndArgs...)
-}
-
-// IsIncreasingf asserts that the collection is increasing
-//
-//    a.IsIncreasingf([]int{1, 2, 3}, "error message %s", "formatted")
-//    a.IsIncreasingf([]float{1, 2}, "error message %s", "formatted")
-//    a.IsIncreasingf([]string{"a", "b"}, "error message %s", "formatted")
-func (a *Assertions) IsIncreasingf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsIncreasingf(a.t, object, msg, args...)
-}
-
-// IsNonDecreasing asserts that the collection is not decreasing
-//
-//    a.IsNonDecreasing([]int{1, 1, 2})
-//    a.IsNonDecreasing([]float{1, 2})
-//    a.IsNonDecreasing([]string{"a", "b"})
-func (a *Assertions) IsNonDecreasing(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsNonDecreasing(a.t, object, msgAndArgs...)
-}
-
-// IsNonDecreasingf asserts that the collection is not decreasing
-//
-//    a.IsNonDecreasingf([]int{1, 1, 2}, "error message %s", "formatted")
-//    a.IsNonDecreasingf([]float{1, 2}, "error message %s", "formatted")
-//    a.IsNonDecreasingf([]string{"a", "b"}, "error message %s", "formatted")
-func (a *Assertions) IsNonDecreasingf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsNonDecreasingf(a.t, object, msg, args...)
-}
-
-// IsNonIncreasing asserts that the collection is not increasing
-//
-//    a.IsNonIncreasing([]int{2, 1, 1})
-//    a.IsNonIncreasing([]float{2, 1})
-//    a.IsNonIncreasing([]string{"b", "a"})
-func (a *Assertions) IsNonIncreasing(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsNonIncreasing(a.t, object, msgAndArgs...)
-}
-
-// IsNonIncreasingf asserts that the collection is not increasing
-//
-//    a.IsNonIncreasingf([]int{2, 1, 1}, "error message %s", "formatted")
-//    a.IsNonIncreasingf([]float{2, 1}, "error message %s", "formatted")
-//    a.IsNonIncreasingf([]string{"b", "a"}, "error message %s", "formatted")
-func (a *Assertions) IsNonIncreasingf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsNonIncreasingf(a.t, object, msg, args...)
-}
-
-// IsType asserts that the specified objects are of the same type.
-func (a *Assertions) IsType(expectedType interface{}, object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsType(a.t, expectedType, object, msgAndArgs...)
-}
-
-// IsTypef asserts that the specified objects are of the same type.
-func (a *Assertions) IsTypef(expectedType interface{}, object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	IsTypef(a.t, expectedType, object, msg, args...)
-}
-
-// JSONEq asserts that two JSON strings are equivalent.
-//
-//  a.JSONEq(`{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`)
-func (a *Assertions) JSONEq(expected string, actual string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	JSONEq(a.t, expected, actual, msgAndArgs...)
-}
-
-// JSONEqf asserts that two JSON strings are equivalent.
-//
-//  a.JSONEqf(`{"hello": "world", "foo": "bar"}`, `{"foo": "bar", "hello": "world"}`, "error message %s", "formatted")
-func (a *Assertions) JSONEqf(expected string, actual string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	JSONEqf(a.t, expected, actual, msg, args...)
-}
-
-// Len asserts that the specified object has specific length.
-// Len also fails if the object has a type that len() not accept.
-//
-//    a.Len(mySlice, 3)
-func (a *Assertions) Len(object interface{}, length int, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Len(a.t, object, length, msgAndArgs...)
-}
-
-// Lenf asserts that the specified object has specific length.
-// Lenf also fails if the object has a type that len() not accept.
-//
-//    a.Lenf(mySlice, 3, "error message %s", "formatted")
-func (a *Assertions) Lenf(object interface{}, length int, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Lenf(a.t, object, length, msg, args...)
-}
-
-// Less asserts that the first element is less than the second
-//
-//    a.Less(1, 2)
-//    a.Less(float64(1), float64(2))
-//    a.Less("a", "b")
-func (a *Assertions) Less(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Less(a.t, e1, e2, msgAndArgs...)
-}
-
-// LessOrEqual asserts that the first element is less than or equal to the second
-//
-//    a.LessOrEqual(1, 2)
-//    a.LessOrEqual(2, 2)
-//    a.LessOrEqual("a", "b")
-//    a.LessOrEqual("b", "b")
-func (a *Assertions) LessOrEqual(e1 interface{}, e2 interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	LessOrEqual(a.t, e1, e2, msgAndArgs...)
-}
-
-// LessOrEqualf asserts that the first element is less than or equal to the second
-//
-//    a.LessOrEqualf(1, 2, "error message %s", "formatted")
-//    a.LessOrEqualf(2, 2, "error message %s", "formatted")
-//    a.LessOrEqualf("a", "b", "error message %s", "formatted")
-//    a.LessOrEqualf("b", "b", "error message %s", "formatted")
-func (a *Assertions) LessOrEqualf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	LessOrEqualf(a.t, e1, e2, msg, args...)
-}
-
-// Lessf asserts that the first element is less than the second
-//
-//    a.Lessf(1, 2, "error message %s", "formatted")
-//    a.Lessf(float64(1), float64(2), "error message %s", "formatted")
-//    a.Lessf("a", "b", "error message %s", "formatted")
-func (a *Assertions) Lessf(e1 interface{}, e2 interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Lessf(a.t, e1, e2, msg, args...)
-}
-
-// Negative asserts that the specified element is negative
-//
-//    a.Negative(-1)
-//    a.Negative(-1.23)
-func (a *Assertions) Negative(e interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Negative(a.t, e, msgAndArgs...)
-}
-
-// Negativef asserts that the specified element is negative
-//
-//    a.Negativef(-1, "error message %s", "formatted")
-//    a.Negativef(-1.23, "error message %s", "formatted")
-func (a *Assertions) Negativef(e interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Negativef(a.t, e, msg, args...)
-}
-
-// Never asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    a.Never(func() bool { return false; }, time.Second, 10*time.Millisecond)
-func (a *Assertions) Never(condition func() bool, waitFor time.Duration, tick time.Duration, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Never(a.t, condition, waitFor, tick, msgAndArgs...)
-}
-
-// Neverf asserts that the given condition doesn't satisfy in waitFor time,
-// periodically checking the target function each tick.
-//
-//    a.Neverf(func() bool { return false; }, time.Second, 10*time.Millisecond, "error message %s", "formatted")
-func (a *Assertions) Neverf(condition func() bool, waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Neverf(a.t, condition, waitFor, tick, msg, args...)
-}
-
-// Nil asserts that the specified object is nil.
-//
-//    a.Nil(err)
-func (a *Assertions) Nil(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Nil(a.t, object, msgAndArgs...)
-}
-
-// Nilf asserts that the specified object is nil.
-//
-//    a.Nilf(err, "error message %s", "formatted")
-func (a *Assertions) Nilf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Nilf(a.t, object, msg, args...)
-}
-
-// NoDirExists checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func (a *Assertions) NoDirExists(path string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NoDirExists(a.t, path, msgAndArgs...)
-}
-
-// NoDirExistsf checks whether a directory does not exist in the given path.
-// It fails if the path points to an existing _directory_ only.
-func (a *Assertions) NoDirExistsf(path string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NoDirExistsf(a.t, path, msg, args...)
-}
-
-// NoError asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.NoError(err) {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func (a *Assertions) NoError(err error, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NoError(a.t, err, msgAndArgs...)
-}
-
-// NoErrorf asserts that a function returned no error (i.e. `nil`).
-//
-//   actualObj, err := SomeFunction()
-//   if a.NoErrorf(err, "error message %s", "formatted") {
-// 	   assert.Equal(t, expectedObj, actualObj)
-//   }
-func (a *Assertions) NoErrorf(err error, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NoErrorf(a.t, err, msg, args...)
-}
-
-// NoFileExists checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func (a *Assertions) NoFileExists(path string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NoFileExists(a.t, path, msgAndArgs...)
-}
-
-// NoFileExistsf checks whether a file does not exist in a given path. It fails
-// if the path points to an existing _file_ only.
-func (a *Assertions) NoFileExistsf(path string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NoFileExistsf(a.t, path, msg, args...)
-}
-
-// NotContains asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    a.NotContains("Hello World", "Earth")
-//    a.NotContains(["Hello", "World"], "Earth")
-//    a.NotContains({"Hello": "World"}, "Earth")
-func (a *Assertions) NotContains(s interface{}, contains interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotContains(a.t, s, contains, msgAndArgs...)
-}
-
-// NotContainsf asserts that the specified string, list(array, slice...) or map does NOT contain the
-// specified substring or element.
-//
-//    a.NotContainsf("Hello World", "Earth", "error message %s", "formatted")
-//    a.NotContainsf(["Hello", "World"], "Earth", "error message %s", "formatted")
-//    a.NotContainsf({"Hello": "World"}, "Earth", "error message %s", "formatted")
-func (a *Assertions) NotContainsf(s interface{}, contains interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotContainsf(a.t, s, contains, msg, args...)
-}
-
-// NotEmpty asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if a.NotEmpty(obj) {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func (a *Assertions) NotEmpty(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotEmpty(a.t, object, msgAndArgs...)
-}
-
-// NotEmptyf asserts that the specified object is NOT empty.  I.e. not nil, "", false, 0 or either
-// a slice or a channel with len == 0.
-//
-//  if a.NotEmptyf(obj, "error message %s", "formatted") {
-//    assert.Equal(t, "two", obj[1])
-//  }
-func (a *Assertions) NotEmptyf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotEmptyf(a.t, object, msg, args...)
-}
-
-// NotEqual asserts that the specified values are NOT equal.
-//
-//    a.NotEqual(obj1, obj2)
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func (a *Assertions) NotEqual(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotEqual(a.t, expected, actual, msgAndArgs...)
-}
-
-// NotEqualValues asserts that two objects are not equal even when converted to the same type
-//
-//    a.NotEqualValues(obj1, obj2)
-func (a *Assertions) NotEqualValues(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotEqualValues(a.t, expected, actual, msgAndArgs...)
-}
-
-// NotEqualValuesf asserts that two objects are not equal even when converted to the same type
-//
-//    a.NotEqualValuesf(obj1, obj2, "error message %s", "formatted")
-func (a *Assertions) NotEqualValuesf(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotEqualValuesf(a.t, expected, actual, msg, args...)
-}
-
-// NotEqualf asserts that the specified values are NOT equal.
-//
-//    a.NotEqualf(obj1, obj2, "error message %s", "formatted")
-//
-// Pointer variable equality is determined based on the equality of the
-// referenced values (as opposed to the memory addresses).
-func (a *Assertions) NotEqualf(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotEqualf(a.t, expected, actual, msg, args...)
-}
-
-// NotErrorIs asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) NotErrorIs(err error, target error, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotErrorIs(a.t, err, target, msgAndArgs...)
-}
-
-// NotErrorIsf asserts that at none of the errors in err's chain matches target.
-// This is a wrapper for errors.Is.
-func (a *Assertions) NotErrorIsf(err error, target error, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotErrorIsf(a.t, err, target, msg, args...)
-}
-
-// NotNil asserts that the specified object is not nil.
-//
-//    a.NotNil(err)
-func (a *Assertions) NotNil(object interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotNil(a.t, object, msgAndArgs...)
-}
-
-// NotNilf asserts that the specified object is not nil.
-//
-//    a.NotNilf(err, "error message %s", "formatted")
-func (a *Assertions) NotNilf(object interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotNilf(a.t, object, msg, args...)
-}
-
-// NotPanics asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   a.NotPanics(func(){ RemainCalm() })
-func (a *Assertions) NotPanics(f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotPanics(a.t, f, msgAndArgs...)
-}
-
-// NotPanicsf asserts that the code inside the specified PanicTestFunc does NOT panic.
-//
-//   a.NotPanicsf(func(){ RemainCalm() }, "error message %s", "formatted")
-func (a *Assertions) NotPanicsf(f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotPanicsf(a.t, f, msg, args...)
-}
-
-// NotRegexp asserts that a specified regexp does not match a string.
-//
-//  a.NotRegexp(regexp.MustCompile("starts"), "it's starting")
-//  a.NotRegexp("^start", "it's not starting")
-func (a *Assertions) NotRegexp(rx interface{}, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotRegexp(a.t, rx, str, msgAndArgs...)
-}
-
-// NotRegexpf asserts that a specified regexp does not match a string.
-//
-//  a.NotRegexpf(regexp.MustCompile("starts"), "it's starting", "error message %s", "formatted")
-//  a.NotRegexpf("^start", "it's not starting", "error message %s", "formatted")
-func (a *Assertions) NotRegexpf(rx interface{}, str interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotRegexpf(a.t, rx, str, msg, args...)
-}
-
-// NotSame asserts that two pointers do not reference the same object.
-//
-//    a.NotSame(ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) NotSame(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotSame(a.t, expected, actual, msgAndArgs...)
-}
-
-// NotSamef asserts that two pointers do not reference the same object.
-//
-//    a.NotSamef(ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) NotSamef(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotSamef(a.t, expected, actual, msg, args...)
-}
-
-// NotSubset asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    a.NotSubset([1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]")
-func (a *Assertions) NotSubset(list interface{}, subset interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotSubset(a.t, list, subset, msgAndArgs...)
-}
-
-// NotSubsetf asserts that the specified list(array, slice...) contains not all
-// elements given in the specified subset(array, slice...).
-//
-//    a.NotSubsetf([1, 3, 4], [1, 2], "But [1, 3, 4] does not contain [1, 2]", "error message %s", "formatted")
-func (a *Assertions) NotSubsetf(list interface{}, subset interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotSubsetf(a.t, list, subset, msg, args...)
-}
-
-// NotZero asserts that i is not the zero value for its type.
-func (a *Assertions) NotZero(i interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotZero(a.t, i, msgAndArgs...)
-}
-
-// NotZerof asserts that i is not the zero value for its type.
-func (a *Assertions) NotZerof(i interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	NotZerof(a.t, i, msg, args...)
-}
-
-// Panics asserts that the code inside the specified PanicTestFunc panics.
-//
-//   a.Panics(func(){ GoCrazy() })
-func (a *Assertions) Panics(f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Panics(a.t, f, msgAndArgs...)
-}
-
-// PanicsWithError asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   a.PanicsWithError("crazy error", func(){ GoCrazy() })
-func (a *Assertions) PanicsWithError(errString string, f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	PanicsWithError(a.t, errString, f, msgAndArgs...)
-}
-
-// PanicsWithErrorf asserts that the code inside the specified PanicTestFunc
-// panics, and that the recovered panic value is an error that satisfies the
-// EqualError comparison.
-//
-//   a.PanicsWithErrorf("crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func (a *Assertions) PanicsWithErrorf(errString string, f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	PanicsWithErrorf(a.t, errString, f, msg, args...)
-}
-
-// PanicsWithValue asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   a.PanicsWithValue("crazy error", func(){ GoCrazy() })
-func (a *Assertions) PanicsWithValue(expected interface{}, f assert.PanicTestFunc, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	PanicsWithValue(a.t, expected, f, msgAndArgs...)
-}
-
-// PanicsWithValuef asserts that the code inside the specified PanicTestFunc panics, and that
-// the recovered panic value equals the expected panic value.
-//
-//   a.PanicsWithValuef("crazy error", func(){ GoCrazy() }, "error message %s", "formatted")
-func (a *Assertions) PanicsWithValuef(expected interface{}, f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	PanicsWithValuef(a.t, expected, f, msg, args...)
-}
-
-// Panicsf asserts that the code inside the specified PanicTestFunc panics.
-//
-//   a.Panicsf(func(){ GoCrazy() }, "error message %s", "formatted")
-func (a *Assertions) Panicsf(f assert.PanicTestFunc, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Panicsf(a.t, f, msg, args...)
-}
-
-// Positive asserts that the specified element is positive
-//
-//    a.Positive(1)
-//    a.Positive(1.23)
-func (a *Assertions) Positive(e interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Positive(a.t, e, msgAndArgs...)
-}
-
-// Positivef asserts that the specified element is positive
-//
-//    a.Positivef(1, "error message %s", "formatted")
-//    a.Positivef(1.23, "error message %s", "formatted")
-func (a *Assertions) Positivef(e interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Positivef(a.t, e, msg, args...)
-}
-
-// Regexp asserts that a specified regexp matches a string.
-//
-//  a.Regexp(regexp.MustCompile("start"), "it's starting")
-//  a.Regexp("start...$", "it's not starting")
-func (a *Assertions) Regexp(rx interface{}, str interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Regexp(a.t, rx, str, msgAndArgs...)
-}
-
-// Regexpf asserts that a specified regexp matches a string.
-//
-//  a.Regexpf(regexp.MustCompile("start"), "it's starting", "error message %s", "formatted")
-//  a.Regexpf("start...$", "it's not starting", "error message %s", "formatted")
-func (a *Assertions) Regexpf(rx interface{}, str interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Regexpf(a.t, rx, str, msg, args...)
-}
-
-// Same asserts that two pointers reference the same object.
-//
-//    a.Same(ptr1, ptr2)
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) Same(expected interface{}, actual interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Same(a.t, expected, actual, msgAndArgs...)
-}
-
-// Samef asserts that two pointers reference the same object.
-//
-//    a.Samef(ptr1, ptr2, "error message %s", "formatted")
-//
-// Both arguments must be pointer variables. Pointer variable sameness is
-// determined based on the equality of both type and value.
-func (a *Assertions) Samef(expected interface{}, actual interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Samef(a.t, expected, actual, msg, args...)
-}
-
-// Subset asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    a.Subset([1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]")
-func (a *Assertions) Subset(list interface{}, subset interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Subset(a.t, list, subset, msgAndArgs...)
-}
-
-// Subsetf asserts that the specified list(array, slice...) contains all
-// elements given in the specified subset(array, slice...).
-//
-//    a.Subsetf([1, 2, 3], [1, 2], "But [1, 2, 3] does contain [1, 2]", "error message %s", "formatted")
-func (a *Assertions) Subsetf(list interface{}, subset interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Subsetf(a.t, list, subset, msg, args...)
-}
-
-// True asserts that the specified value is true.
-//
-//    a.True(myBool)
-func (a *Assertions) True(value bool, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	True(a.t, value, msgAndArgs...)
-}
-
-// Truef asserts that the specified value is true.
-//
-//    a.Truef(myBool, "error message %s", "formatted")
-func (a *Assertions) Truef(value bool, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Truef(a.t, value, msg, args...)
-}
-
-// WithinDuration asserts that the two times are within duration delta of each other.
-//
-//   a.WithinDuration(time.Now(), time.Now(), 10*time.Second)
-func (a *Assertions) WithinDuration(expected time.Time, actual time.Time, delta time.Duration, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	WithinDuration(a.t, expected, actual, delta, msgAndArgs...)
-}
-
-// WithinDurationf asserts that the two times are within duration delta of each other.
-//
-//   a.WithinDurationf(time.Now(), time.Now(), 10*time.Second, "error message %s", "formatted")
-func (a *Assertions) WithinDurationf(expected time.Time, actual time.Time, delta time.Duration, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	WithinDurationf(a.t, expected, actual, delta, msg, args...)
-}
-
-// YAMLEq asserts that two YAML strings are equivalent.
-func (a *Assertions) YAMLEq(expected string, actual string, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	YAMLEq(a.t, expected, actual, msgAndArgs...)
-}
-
-// YAMLEqf asserts that two YAML strings are equivalent.
-func (a *Assertions) YAMLEqf(expected string, actual string, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	YAMLEqf(a.t, expected, actual, msg, args...)
-}
-
-// Zero asserts that i is the zero value for its type.
-func (a *Assertions) Zero(i interface{}, msgAndArgs ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Zero(a.t, i, msgAndArgs...)
-}
-
-// Zerof asserts that i is the zero value for its type.
-func (a *Assertions) Zerof(i interface{}, msg string, args ...interface{}) {
-	if h, ok := a.t.(tHelper); ok {
-		h.Helper()
-	}
-	Zerof(a.t, i, msg, args...)
-}
diff --git a/vendor/github.com/stretchr/testify/require/require_forward.go.tmpl b/vendor/github.com/stretchr/testify/require/require_forward.go.tmpl
deleted file mode 100644
index 54124df1d3..0000000000
--- a/vendor/github.com/stretchr/testify/require/require_forward.go.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-{{.CommentWithoutT "a"}}
-func (a *Assertions) {{.DocInfo.Name}}({{.Params}}) {
-	if h, ok := a.t.(tHelper); ok { h.Helper() }
-	{{.DocInfo.Name}}(a.t, {{.ForwardedParams}})
-}
diff --git a/vendor/github.com/stretchr/testify/require/requirements.go b/vendor/github.com/stretchr/testify/require/requirements.go
deleted file mode 100644
index 91772dfeb9..0000000000
--- a/vendor/github.com/stretchr/testify/require/requirements.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package require
-
-// TestingT is an interface wrapper around *testing.T
-type TestingT interface {
-	Errorf(format string, args ...interface{})
-	FailNow()
-}
-
-type tHelper interface {
-	Helper()
-}
-
-// ComparisonAssertionFunc is a common function prototype when comparing two values.  Can be useful
-// for table driven tests.
-type ComparisonAssertionFunc func(TestingT, interface{}, interface{}, ...interface{})
-
-// ValueAssertionFunc is a common function prototype when validating a single value.  Can be useful
-// for table driven tests.
-type ValueAssertionFunc func(TestingT, interface{}, ...interface{})
-
-// BoolAssertionFunc is a common function prototype when validating a bool value.  Can be useful
-// for table driven tests.
-type BoolAssertionFunc func(TestingT, bool, ...interface{})
-
-// ErrorAssertionFunc is a common function prototype when validating an error value.  Can be useful
-// for table driven tests.
-type ErrorAssertionFunc func(TestingT, error, ...interface{})
-
-//go:generate sh -c "cd ../_codegen && go build && cd - && ../_codegen/_codegen -output-package=require -template=require.go.tmpl -include-format-funcs"
diff --git a/vendor/github.com/tchap/go-patricia/v2/AUTHORS b/vendor/github.com/tchap/go-patricia/v2/AUTHORS
new file mode 100644
index 0000000000..e640b0bf51
--- /dev/null
+++ b/vendor/github.com/tchap/go-patricia/v2/AUTHORS
@@ -0,0 +1,3 @@
+This is the complete list of go-patricia copyright holders:
+
+Ondřej Kupka <ondra.cap@gmail.com>
diff --git a/vendor/github.com/tchap/go-patricia/v2/LICENSE b/vendor/github.com/tchap/go-patricia/v2/LICENSE
new file mode 100644
index 0000000000..e50d398e98
--- /dev/null
+++ b/vendor/github.com/tchap/go-patricia/v2/LICENSE
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 The AUTHORS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/vendor/github.com/tchap/go-patricia/v2/patricia/children.go b/vendor/github.com/tchap/go-patricia/v2/patricia/children.go
new file mode 100644
index 0000000000..bcfd0a5dd0
--- /dev/null
+++ b/vendor/github.com/tchap/go-patricia/v2/patricia/children.go
@@ -0,0 +1,363 @@
+// Copyright (c) 2014 The go-patricia AUTHORS
+//
+// Use of this source code is governed by The MIT License
+// that can be found in the LICENSE file.
+
+package patricia
+
+import (
+	"fmt"
+	"io"
+	"sort"
+)
+
+type childList interface {
+	length() int
+	head() *Trie
+	add(child *Trie) childList
+	remove(b byte)
+	replace(b byte, child *Trie)
+	next(b byte) *Trie
+	walk(prefix *Prefix, visitor VisitorFunc) error
+	print(w io.Writer, indent int)
+	clone() childList
+	total() int
+}
+
+type tries []*Trie
+
+func (t tries) Len() int {
+	return len(t)
+}
+
+func (t tries) Less(i, j int) bool {
+	strings := sort.StringSlice{string(t[i].prefix), string(t[j].prefix)}
+	return strings.Less(0, 1)
+}
+
+func (t tries) Swap(i, j int) {
+	t[i], t[j] = t[j], t[i]
+}
+
+type sparseChildList struct {
+	children tries
+}
+
+func newSparseChildList(maxChildrenPerSparseNode int) childList {
+	return &sparseChildList{
+		children: make(tries, 0, maxChildrenPerSparseNode),
+	}
+}
+
+func (list *sparseChildList) length() int {
+	return len(list.children)
+}
+
+func (list *sparseChildList) head() *Trie {
+	return list.children[0]
+}
+
+func (list *sparseChildList) add(child *Trie) childList {
+	// Search for an empty spot and insert the child if possible.
+	if len(list.children) != cap(list.children) {
+		list.children = append(list.children, child)
+		return list
+	}
+
+	// Otherwise we have to transform to the dense list type.
+	return newDenseChildList(list, child)
+}
+
+func (list *sparseChildList) remove(b byte) {
+	for i, node := range list.children {
+		if node.prefix[0] == b {
+			list.children[i] = list.children[len(list.children)-1]
+			list.children[len(list.children)-1] = nil
+			list.children = list.children[:len(list.children)-1]
+			return
+		}
+	}
+
+	// This is not supposed to be reached.
+	panic("removing non-existent child")
+}
+
+func (list *sparseChildList) replace(b byte, child *Trie) {
+	// Make a consistency check.
+	if p0 := child.prefix[0]; p0 != b {
+		panic(fmt.Errorf("child prefix mismatch: %v != %v", p0, b))
+	}
+
+	// Seek the child and replace it.
+	for i, node := range list.children {
+		if node.prefix[0] == b {
+			list.children[i] = child
+			return
+		}
+	}
+}
+
+func (list *sparseChildList) next(b byte) *Trie {
+	for _, child := range list.children {
+		if child.prefix[0] == b {
+			return child
+		}
+	}
+	return nil
+}
+
+func (list *sparseChildList) walk(prefix *Prefix, visitor VisitorFunc) error {
+
+	sort.Sort(list.children)
+
+	for _, child := range list.children {
+		*prefix = append(*prefix, child.prefix...)
+		if child.item != nil {
+			err := visitor(*prefix, child.item)
+			if err != nil {
+				if err == SkipSubtree {
+					*prefix = (*prefix)[:len(*prefix)-len(child.prefix)]
+					continue
+				}
+				*prefix = (*prefix)[:len(*prefix)-len(child.prefix)]
+				return err
+			}
+		}
+
+		err := child.children.walk(prefix, visitor)
+		*prefix = (*prefix)[:len(*prefix)-len(child.prefix)]
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (list *sparseChildList) total() int {
+	tot := 0
+	for _, child := range list.children {
+		if child != nil {
+			tot = tot + child.total()
+		}
+	}
+	return tot
+}
+
+func (list *sparseChildList) clone() childList {
+	clones := make(tries, len(list.children), cap(list.children))
+	for i, child := range list.children {
+		clones[i] = child.Clone()
+	}
+
+	return &sparseChildList{
+		children: clones,
+	}
+}
+
+func (list *sparseChildList) print(w io.Writer, indent int) {
+	for _, child := range list.children {
+		if child != nil {
+			child.print(w, indent)
+		}
+	}
+}
+
+type denseChildList struct {
+	min         int
+	max         int
+	numChildren int
+	headIndex   int
+	children    []*Trie
+}
+
+func newDenseChildList(list *sparseChildList, child *Trie) childList {
+	var (
+		min int = 255
+		max int = 0
+	)
+	for _, child := range list.children {
+		b := int(child.prefix[0])
+		if b < min {
+			min = b
+		}
+		if b > max {
+			max = b
+		}
+	}
+
+	b := int(child.prefix[0])
+	if b < min {
+		min = b
+	}
+	if b > max {
+		max = b
+	}
+
+	children := make([]*Trie, max-min+1)
+	for _, child := range list.children {
+		children[int(child.prefix[0])-min] = child
+	}
+	children[int(child.prefix[0])-min] = child
+
+	return &denseChildList{
+		min:         min,
+		max:         max,
+		numChildren: list.length() + 1,
+		headIndex:   0,
+		children:    children,
+	}
+}
+
+func (list *denseChildList) length() int {
+	return list.numChildren
+}
+
+func (list *denseChildList) head() *Trie {
+	return list.children[list.headIndex]
+}
+
+func (list *denseChildList) add(child *Trie) childList {
+	b := int(child.prefix[0])
+	var i int
+
+	switch {
+	case list.min <= b && b <= list.max:
+		if list.children[b-list.min] != nil {
+			panic("dense child list collision detected")
+		}
+		i = b - list.min
+		list.children[i] = child
+
+	case b < list.min:
+		children := make([]*Trie, list.max-b+1)
+		i = 0
+		children[i] = child
+		copy(children[list.min-b:], list.children)
+		list.children = children
+		list.min = b
+
+	default: // b > list.max
+		children := make([]*Trie, b-list.min+1)
+		i = b - list.min
+		children[i] = child
+		copy(children, list.children)
+		list.children = children
+		list.max = b
+	}
+
+	list.numChildren++
+	if i < list.headIndex {
+		list.headIndex = i
+	}
+	return list
+}
+
+func (list *denseChildList) remove(b byte) {
+	i := int(b) - list.min
+	if list.children[i] == nil {
+		// This is not supposed to be reached.
+		panic("removing non-existent child")
+	}
+	list.numChildren--
+	list.children[i] = nil
+
+	// Update head index.
+	if i == list.headIndex {
+		for ; i < len(list.children); i++ {
+			if list.children[i] != nil {
+				list.headIndex = i
+				return
+			}
+		}
+	}
+}
+
+func (list *denseChildList) replace(b byte, child *Trie) {
+	// Make a consistency check.
+	if p0 := child.prefix[0]; p0 != b {
+		panic(fmt.Errorf("child prefix mismatch: %v != %v", p0, b))
+	}
+
+	// Replace the child.
+	list.children[int(b)-list.min] = child
+}
+
+func (list *denseChildList) next(b byte) *Trie {
+	i := int(b)
+	if i < list.min || list.max < i {
+		return nil
+	}
+	return list.children[i-list.min]
+}
+
+func (list *denseChildList) walk(prefix *Prefix, visitor VisitorFunc) error {
+	for _, child := range list.children {
+		if child == nil {
+			continue
+		}
+		*prefix = append(*prefix, child.prefix...)
+		if child.item != nil {
+			if err := visitor(*prefix, child.item); err != nil {
+				if err == SkipSubtree {
+					*prefix = (*prefix)[:len(*prefix)-len(child.prefix)]
+					continue
+				}
+				*prefix = (*prefix)[:len(*prefix)-len(child.prefix)]
+				return err
+			}
+		}
+
+		err := child.children.walk(prefix, visitor)
+		*prefix = (*prefix)[:len(*prefix)-len(child.prefix)]
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (list *denseChildList) print(w io.Writer, indent int) {
+	for _, child := range list.children {
+		if child != nil {
+			child.print(w, indent)
+		}
+	}
+}
+
+func (list *denseChildList) clone() childList {
+	clones := make(tries, cap(list.children))
+
+	if list.numChildren != 0 {
+		clonedCount := 0
+		for i := list.headIndex; i < len(list.children); i++ {
+			child := list.children[i]
+			if child != nil {
+				clones[i] = child.Clone()
+				clonedCount++
+				if clonedCount == list.numChildren {
+					break
+				}
+			}
+		}
+	}
+
+	return &denseChildList{
+		min:         list.min,
+		max:         list.max,
+		numChildren: list.numChildren,
+		headIndex:   list.headIndex,
+		children:    clones,
+	}
+}
+
+func (list *denseChildList) total() int {
+	tot := 0
+	for _, child := range list.children {
+		if child != nil {
+			tot = tot + child.total()
+		}
+	}
+	return tot
+}
diff --git a/vendor/github.com/tchap/go-patricia/v2/patricia/patricia.go b/vendor/github.com/tchap/go-patricia/v2/patricia/patricia.go
new file mode 100644
index 0000000000..7b9975e383
--- /dev/null
+++ b/vendor/github.com/tchap/go-patricia/v2/patricia/patricia.go
@@ -0,0 +1,606 @@
+// Copyright (c) 2014 The go-patricia AUTHORS
+//
+// Use of this source code is governed by The MIT License
+// that can be found in the LICENSE file.
+
+package patricia
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+//------------------------------------------------------------------------------
+// Trie
+//------------------------------------------------------------------------------
+
+const (
+	DefaultMaxPrefixPerNode         = 10
+	DefaultMaxChildrenPerSparseNode = 8
+)
+
+type (
+	Prefix      []byte
+	Item        interface{}
+	VisitorFunc func(prefix Prefix, item Item) error
+)
+
+// Trie is a generic patricia trie that allows fast retrieval of items by prefix.
+// and other funky stuff.
+//
+// Trie is not thread-safe.
+type Trie struct {
+	prefix Prefix
+	item   Item
+
+	maxPrefixPerNode         int
+	maxChildrenPerSparseNode int
+
+	children childList
+}
+
+// Public API ------------------------------------------------------------------
+
+type Option func(*Trie)
+
+// Trie constructor.
+func NewTrie(options ...Option) *Trie {
+	trie := &Trie{}
+
+	for _, opt := range options {
+		opt(trie)
+	}
+
+	if trie.maxPrefixPerNode <= 0 {
+		trie.maxPrefixPerNode = DefaultMaxPrefixPerNode
+	}
+	if trie.maxChildrenPerSparseNode <= 0 {
+		trie.maxChildrenPerSparseNode = DefaultMaxChildrenPerSparseNode
+	}
+
+	trie.children = newSparseChildList(trie.maxChildrenPerSparseNode)
+	return trie
+}
+
+func MaxPrefixPerNode(value int) Option {
+	return func(trie *Trie) {
+		trie.maxPrefixPerNode = value
+	}
+}
+
+func MaxChildrenPerSparseNode(value int) Option {
+	return func(trie *Trie) {
+		trie.maxChildrenPerSparseNode = value
+	}
+}
+
+// Clone makes a copy of an existing trie.
+// Items stored in both tries become shared, obviously.
+func (trie *Trie) Clone() *Trie {
+	return &Trie{
+		prefix:                   append(Prefix(nil), trie.prefix...),
+		item:                     trie.item,
+		maxPrefixPerNode:         trie.maxPrefixPerNode,
+		maxChildrenPerSparseNode: trie.maxChildrenPerSparseNode,
+		children:                 trie.children.clone(),
+	}
+}
+
+// Item returns the item stored in the root of this trie.
+func (trie *Trie) Item() Item {
+	return trie.item
+}
+
+// Insert inserts a new item into the trie using the given prefix. Insert does
+// not replace existing items. It returns false if an item was already in place.
+func (trie *Trie) Insert(key Prefix, item Item) (inserted bool) {
+	return trie.put(key, item, false)
+}
+
+// Set works much like Insert, but it always sets the item, possibly replacing
+// the item previously inserted.
+func (trie *Trie) Set(key Prefix, item Item) {
+	trie.put(key, item, true)
+}
+
+// Get returns the item located at key.
+//
+// This method is a bit dangerous, because Get can as well end up in an internal
+// node that is not really representing any user-defined value. So when nil is
+// a valid value being used, it is not possible to tell if the value was inserted
+// into the tree by the user or not. A possible workaround for this is not to use
+// nil interface as a valid value, even using zero value of any type is enough
+// to prevent this bad behaviour.
+func (trie *Trie) Get(key Prefix) (item Item) {
+	_, node, found, leftover := trie.findSubtree(key)
+	if !found || len(leftover) != 0 {
+		return nil
+	}
+	return node.item
+}
+
+// Match returns what Get(prefix) != nil would return. The same warning as for
+// Get applies here as well.
+func (trie *Trie) Match(prefix Prefix) (matchedExactly bool) {
+	return trie.Get(prefix) != nil
+}
+
+// MatchSubtree returns true when there is a subtree representing extensions
+// to key, that is if there are any keys in the tree which have key as prefix.
+func (trie *Trie) MatchSubtree(key Prefix) (matched bool) {
+	_, _, matched, _ = trie.findSubtree(key)
+	return
+}
+
+// Visit calls visitor on every node containing a non-nil item
+// in alphabetical order.
+//
+// If an error is returned from visitor, the function stops visiting the tree
+// and returns that error, unless it is a special error - SkipSubtree. In that
+// case Visit skips the subtree represented by the current node and continues
+// elsewhere.
+func (trie *Trie) Visit(visitor VisitorFunc) error {
+	return trie.walk(nil, visitor)
+}
+
+func (trie *Trie) size() int {
+	n := 0
+
+	trie.walk(nil, func(prefix Prefix, item Item) error {
+		n++
+		return nil
+	})
+
+	return n
+}
+
+func (trie *Trie) total() int {
+	return 1 + trie.children.total()
+}
+
+// VisitSubtree works much like Visit, but it only visits nodes matching prefix.
+func (trie *Trie) VisitSubtree(prefix Prefix, visitor VisitorFunc) error {
+	// Nil prefix not allowed.
+	if prefix == nil {
+		panic(ErrNilPrefix)
+	}
+
+	// Empty trie must be handled explicitly.
+	if trie.prefix == nil {
+		return nil
+	}
+
+	// Locate the relevant subtree.
+	_, root, found, leftover := trie.findSubtree(prefix)
+	if !found {
+		return nil
+	}
+	prefix = append(prefix, leftover...)
+
+	// Visit it.
+	return root.walk(prefix, visitor)
+}
+
+// VisitPrefixes visits only nodes that represent prefixes of key.
+// To say the obvious, returning SkipSubtree from visitor makes no sense here.
+func (trie *Trie) VisitPrefixes(key Prefix, visitor VisitorFunc) error {
+	// Nil key not allowed.
+	if key == nil {
+		panic(ErrNilPrefix)
+	}
+
+	// Empty trie must be handled explicitly.
+	if trie.prefix == nil {
+		return nil
+	}
+
+	// Walk the path matching key prefixes.
+	node := trie
+	prefix := key
+	offset := 0
+	for {
+		// Compute what part of prefix matches.
+		common := node.longestCommonPrefixLength(key)
+		key = key[common:]
+		offset += common
+
+		// Partial match means that there is no subtree matching prefix.
+		if common < len(node.prefix) {
+			return nil
+		}
+
+		// Call the visitor.
+		if item := node.item; item != nil {
+			if err := visitor(prefix[:offset], item); err != nil {
+				return err
+			}
+		}
+
+		if len(key) == 0 {
+			// This node represents key, we are finished.
+			return nil
+		}
+
+		// There is some key suffix left, move to the children.
+		child := node.children.next(key[0])
+		if child == nil {
+			// There is nowhere to continue, return.
+			return nil
+		}
+
+		node = child
+	}
+}
+
+// Delete deletes the item represented by the given prefix.
+//
+// True is returned if the matching node was found and deleted.
+func (trie *Trie) Delete(key Prefix) (deleted bool) {
+	// Nil prefix not allowed.
+	if key == nil {
+		panic(ErrNilPrefix)
+	}
+
+	// Empty trie must be handled explicitly.
+	if trie.prefix == nil {
+		return false
+	}
+
+	// Find the relevant node.
+	path, found, _ := trie.findSubtreePath(key)
+	if !found {
+		return false
+	}
+
+	node := path[len(path)-1]
+	var parent *Trie
+	if len(path) != 1 {
+		parent = path[len(path)-2]
+	}
+
+	// If the item is already set to nil, there is nothing to do.
+	if node.item == nil {
+		return false
+	}
+
+	// Delete the item.
+	node.item = nil
+
+	// Initialise i before goto.
+	// Will be used later in a loop.
+	i := len(path) - 1
+
+	// In case there are some child nodes, we cannot drop the whole subtree.
+	// We can try to compact nodes, though.
+	if node.children.length() != 0 {
+		goto Compact
+	}
+
+	// In case we are at the root, just reset it and we are done.
+	if parent == nil {
+		node.reset()
+		return true
+	}
+
+	// We can drop a subtree.
+	// Find the first ancestor that has its value set or it has 2 or more child nodes.
+	// That will be the node where to drop the subtree at.
+	for ; i >= 0; i-- {
+		if current := path[i]; current.item != nil || current.children.length() >= 2 {
+			break
+		}
+	}
+
+	// Handle the case when there is no such node.
+	// In other words, we can reset the whole tree.
+	if i == -1 {
+		path[0].reset()
+		return true
+	}
+
+	// We can just remove the subtree here.
+	node = path[i]
+	if i == 0 {
+		parent = nil
+	} else {
+		parent = path[i-1]
+	}
+	// i+1 is always a valid index since i is never pointing to the last node.
+	// The loop above skips at least the last node since we are sure that the item
+	// is set to nil and it has no children, othewise we would be compacting instead.
+	node.children.remove(path[i+1].prefix[0])
+
+Compact:
+	// The node is set to the first non-empty ancestor,
+	// so try to compact since that might be possible now.
+	if compacted := node.compact(); compacted != node {
+		if parent == nil {
+			*node = *compacted
+		} else {
+			parent.children.replace(node.prefix[0], compacted)
+			*parent = *parent.compact()
+		}
+	}
+
+	return true
+}
+
+// DeleteSubtree finds the subtree exactly matching prefix and deletes it.
+//
+// True is returned if the subtree was found and deleted.
+func (trie *Trie) DeleteSubtree(prefix Prefix) (deleted bool) {
+	// Nil prefix not allowed.
+	if prefix == nil {
+		panic(ErrNilPrefix)
+	}
+
+	// Empty trie must be handled explicitly.
+	if trie.prefix == nil {
+		return false
+	}
+
+	// Locate the relevant subtree.
+	parent, root, found, _ := trie.findSubtree(prefix)
+	if !found {
+		return false
+	}
+
+	// If we are in the root of the trie, reset the trie.
+	if parent == nil {
+		root.reset()
+		return true
+	}
+
+	// Otherwise remove the root node from its parent.
+	parent.children.remove(root.prefix[0])
+	return true
+}
+
+// Internal helper methods -----------------------------------------------------
+
+func (trie *Trie) empty() bool {
+	return trie.item == nil && trie.children.length() == 0
+}
+
+func (trie *Trie) reset() {
+	trie.prefix = nil
+	trie.children = newSparseChildList(trie.maxPrefixPerNode)
+}
+
+func (trie *Trie) put(key Prefix, item Item, replace bool) (inserted bool) {
+	// Nil prefix not allowed.
+	if key == nil {
+		panic(ErrNilPrefix)
+	}
+
+	var (
+		common int
+		node   *Trie = trie
+		child  *Trie
+	)
+
+	if node.prefix == nil {
+		if len(key) <= trie.maxPrefixPerNode {
+			node.prefix = key
+			goto InsertItem
+		}
+		node.prefix = key[:trie.maxPrefixPerNode]
+		key = key[trie.maxPrefixPerNode:]
+		goto AppendChild
+	}
+
+	for {
+		// Compute the longest common prefix length.
+		common = node.longestCommonPrefixLength(key)
+		key = key[common:]
+
+		// Only a part matches, split.
+		if common < len(node.prefix) {
+			goto SplitPrefix
+		}
+
+		// common == len(node.prefix) since never (common > len(node.prefix))
+		// common == len(former key) <-> 0 == len(key)
+		// -> former key == node.prefix
+		if len(key) == 0 {
+			goto InsertItem
+		}
+
+		// Check children for matching prefix.
+		child = node.children.next(key[0])
+		if child == nil {
+			goto AppendChild
+		}
+		node = child
+	}
+
+SplitPrefix:
+	// Split the prefix if necessary.
+	child = new(Trie)
+	*child = *node
+	*node = *NewTrie()
+	node.prefix = child.prefix[:common]
+	child.prefix = child.prefix[common:]
+	child = child.compact()
+	node.children = node.children.add(child)
+
+AppendChild:
+	// Keep appending children until whole prefix is inserted.
+	// This loop starts with empty node.prefix that needs to be filled.
+	for len(key) != 0 {
+		child := NewTrie()
+		if len(key) <= trie.maxPrefixPerNode {
+			child.prefix = key
+			node.children = node.children.add(child)
+			node = child
+			goto InsertItem
+		} else {
+			child.prefix = key[:trie.maxPrefixPerNode]
+			key = key[trie.maxPrefixPerNode:]
+			node.children = node.children.add(child)
+			node = child
+		}
+	}
+
+InsertItem:
+	// Try to insert the item if possible.
+	if replace || node.item == nil {
+		node.item = item
+		return true
+	}
+	return false
+}
+
+func (trie *Trie) compact() *Trie {
+	// Only a node with a single child can be compacted.
+	if trie.children.length() != 1 {
+		return trie
+	}
+
+	child := trie.children.head()
+
+	// If any item is set, we cannot compact since we want to retain
+	// the ability to do searching by key. This makes compaction less usable,
+	// but that simply cannot be avoided.
+	if trie.item != nil || child.item != nil {
+		return trie
+	}
+
+	// Make sure the combined prefixes fit into a single node.
+	if len(trie.prefix)+len(child.prefix) > trie.maxPrefixPerNode {
+		return trie
+	}
+
+	// Concatenate the prefixes, move the items.
+	child.prefix = append(trie.prefix, child.prefix...)
+	if trie.item != nil {
+		child.item = trie.item
+	}
+
+	return child
+}
+
+func (trie *Trie) findSubtree(prefix Prefix) (parent *Trie, root *Trie, found bool, leftover Prefix) {
+	// Find the subtree matching prefix.
+	root = trie
+	for {
+		// Compute what part of prefix matches.
+		common := root.longestCommonPrefixLength(prefix)
+		prefix = prefix[common:]
+
+		// We used up the whole prefix, subtree found.
+		if len(prefix) == 0 {
+			found = true
+			leftover = root.prefix[common:]
+			return
+		}
+
+		// Partial match means that there is no subtree matching prefix.
+		if common < len(root.prefix) {
+			leftover = root.prefix[common:]
+			return
+		}
+
+		// There is some prefix left, move to the children.
+		child := root.children.next(prefix[0])
+		if child == nil {
+			// There is nowhere to continue, there is no subtree matching prefix.
+			return
+		}
+
+		parent = root
+		root = child
+	}
+}
+
+func (trie *Trie) findSubtreePath(prefix Prefix) (path []*Trie, found bool, leftover Prefix) {
+	// Find the subtree matching prefix.
+	root := trie
+	var subtreePath []*Trie
+	for {
+		// Append the current root to the path.
+		subtreePath = append(subtreePath, root)
+
+		// Compute what part of prefix matches.
+		common := root.longestCommonPrefixLength(prefix)
+		prefix = prefix[common:]
+
+		// We used up the whole prefix, subtree found.
+		if len(prefix) == 0 {
+			path = subtreePath
+			found = true
+			leftover = root.prefix[common:]
+			return
+		}
+
+		// Partial match means that there is no subtree matching prefix.
+		if common < len(root.prefix) {
+			leftover = root.prefix[common:]
+			return
+		}
+
+		// There is some prefix left, move to the children.
+		child := root.children.next(prefix[0])
+		if child == nil {
+			// There is nowhere to continue, there is no subtree matching prefix.
+			return
+		}
+
+		root = child
+	}
+}
+
+func (trie *Trie) walk(actualRootPrefix Prefix, visitor VisitorFunc) error {
+	var prefix Prefix
+	// Allocate a bit more space for prefix at the beginning.
+	if actualRootPrefix == nil {
+		prefix = make(Prefix, 32+len(trie.prefix))
+		copy(prefix, trie.prefix)
+		prefix = prefix[:len(trie.prefix)]
+	} else {
+		prefix = make(Prefix, 32+len(actualRootPrefix))
+		copy(prefix, actualRootPrefix)
+		prefix = prefix[:len(actualRootPrefix)]
+	}
+
+	// Visit the root first. Not that this works for empty trie as well since
+	// in that case item == nil && len(children) == 0.
+	if trie.item != nil {
+		if err := visitor(prefix, trie.item); err != nil {
+			if err == SkipSubtree {
+				return nil
+			}
+			return err
+		}
+	}
+
+	// Then continue to the children.
+	return trie.children.walk(&prefix, visitor)
+}
+
+func (trie *Trie) longestCommonPrefixLength(prefix Prefix) (i int) {
+	for ; i < len(prefix) && i < len(trie.prefix) && prefix[i] == trie.prefix[i]; i++ {
+	}
+	return
+}
+
+func (trie *Trie) dump() string {
+	writer := &bytes.Buffer{}
+	trie.print(writer, 0)
+	return writer.String()
+}
+
+func (trie *Trie) print(writer io.Writer, indent int) {
+	fmt.Fprintf(writer, "%s%s %v\n", strings.Repeat(" ", indent), string(trie.prefix), trie.item)
+	trie.children.print(writer, indent+2)
+}
+
+// Errors ----------------------------------------------------------------------
+
+var (
+	SkipSubtree  = errors.New("Skip this subtree")
+	ErrNilPrefix = errors.New("Nil prefix passed into a method call")
+)
diff --git a/vendor/github.com/yashtewari/glob-intersection/match.go b/vendor/github.com/yashtewari/glob-intersection/match.go
index 45a988a854..63c75c8427 100644
--- a/vendor/github.com/yashtewari/glob-intersection/match.go
+++ b/vendor/github.com/yashtewari/glob-intersection/match.go
@@ -1,7 +1,7 @@
 package gintersect
 
 import (
-	"github.com/pkg/errors"
+	"errors"
 )
 
 var (
diff --git a/vendor/github.com/yashtewari/glob-intersection/tokenize.go b/vendor/github.com/yashtewari/glob-intersection/tokenize.go
index 0b67431650..df0efe5aed 100644
--- a/vendor/github.com/yashtewari/glob-intersection/tokenize.go
+++ b/vendor/github.com/yashtewari/glob-intersection/tokenize.go
@@ -3,7 +3,7 @@ package gintersect
 import (
 	"fmt"
 
-	"github.com/pkg/errors"
+	"errors"
 )
 
 // Modifier is a special character that affects lexical analysis.
@@ -65,7 +65,7 @@ func nextToken(index int, input []rune) (newIndex int, token Token, err error) {
 
 			case TTSet:
 				if r == ']' {
-					err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "set-close ']' with no preceding '['"))
+					err = invalidInputMessageErrorf(input, newIndex, "set-close ']' with no preceding '[': %w", ErrInvalidInput)
 					return
 				}
 
@@ -75,15 +75,15 @@ func nextToken(index int, input []rune) (newIndex int, token Token, err error) {
 				}
 
 			default:
-				panic(errors.Wrapf(errBadImplementation, "encountered unhandled token type: %v", ttype))
+				panic(fmt.Errorf("encountered unhandled token type %v: %w", ttype, errBadImplementation))
 			}
 
 		} else if _, ok := flagRunes[r]; ok {
-			err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "flag '%s' must be preceded by a non-flag", string(r)))
+			err = invalidInputMessageErrorf(input, newIndex, "flag '%s' must be preceded by a non-flag: %w", string(r), ErrInvalidInput)
 			return
 
 		} else if m, ok := modifierRunes[r]; ok {
-			panic(errors.Wrapf(errBadImplementation, "encountered unhandled modifier: %v", m))
+			panic(fmt.Errorf("encountered unhandled modifier %v: %w", m, errBadImplementation))
 		} else {
 			// Nothing special to do.
 			token = NewCharacter(r)
@@ -133,11 +133,11 @@ func nextTokenSet(index int, input []rune) (newIndex int, t Token, err error) {
 			switch r {
 			case '-':
 				if !prevExists {
-					err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "range character '-' must be preceded by a Unicode character"))
+					err = invalidInputMessageErrorf(input, newIndex, "range character '-' must be preceded by a Unicode character: %w", ErrInvalidInput)
 					return
 				}
 				if newIndex >= len(input)-1 {
-					err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "range character '-' must be followed by a Unicode character"))
+					err = invalidInputMessageErrorf(input, newIndex, "range character '-' must be followed by a Unicode character: %w", ErrInvalidInput)
 					return
 				}
 
@@ -146,12 +146,12 @@ func nextTokenSet(index int, input []rune) (newIndex int, t Token, err error) {
 
 				if !escaped {
 					if r == ']' || r == '-' {
-						err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "range character '-' cannot be followed by a special symbol"))
+						err = invalidInputMessageErrorf(input, newIndex, "range character '-' cannot be followed by a special symbol: %w", ErrInvalidInput)
 						return
 					}
 				}
 				if r < prev {
-					err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "range is out of order: '%s' comes before '%s' in Unicode", string(r), string(prev)))
+					err = invalidInputMessageErrorf(input, newIndex, "range is out of order: '%s' comes before '%s' in Unicode: %w", string(r), string(prev), ErrInvalidInput)
 					return
 				}
 
@@ -183,7 +183,7 @@ func nextTokenSet(index int, input []rune) (newIndex int, t Token, err error) {
 
 	// End of input is reached before the set completes.
 	if !complete {
-		err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, newIndex, "found [ without matching ]"))
+		err = invalidInputMessageErrorf(input, newIndex, "found [ without matching ]: %w", ErrInvalidInput)
 	} else {
 		t = NewSet(runes)
 	}
@@ -233,10 +233,10 @@ func nextRune(index int, input []rune) (newIndex int, r rune, escaped bool, err
 			if index < len(input)-1 {
 				newIndex, r, escaped = index+2, input[index+1], true
 			} else if index == len(input)-1 {
-				err = errors.Wrap(ErrInvalidInput, invalidInputMessage(input, index, "input ends with a \\ (escape) character"))
+				err = invalidInputMessageErrorf(input, index, "input ends with a \\ (escape) character: %w", ErrInvalidInput)
 			}
 		default:
-			panic(errors.Wrapf(errBadImplementation, "encountered unhandled modifier: %v", m))
+			panic(fmt.Errorf("encountered unhandled modifier %v: %w", m, errBadImplementation))
 		}
 	} else {
 		newIndex, r, escaped = index+1, input[index], false
@@ -245,7 +245,8 @@ func nextRune(index int, input []rune) (newIndex int, r rune, escaped bool, err
 	return
 }
 
-// invalidInputMessage wraps the message describing invalid input with the input itself and index at which it is invalid.
-func invalidInputMessage(input []rune, index int, message string, args ...interface{}) string {
-	return fmt.Sprintf("input:%s, pos:%d, %s", string(input), index, fmt.Sprintf(message, args...))
+// invalidInputMessageErrorf wraps the message describing invalid input with the input itself and index at which it is invalid.
+func invalidInputMessageErrorf(input []rune, index int, message string, args ...interface{}) error {
+	message = fmt.Sprintf("input:%s, pos:%d, %s", string(input), index, message)
+	return fmt.Errorf(message, args...)
 }
diff --git a/vendor/go.opencensus.io/go.mod b/vendor/go.opencensus.io/go.mod
deleted file mode 100644
index 95b2522a7f..0000000000
--- a/vendor/go.opencensus.io/go.mod
+++ /dev/null
@@ -1,12 +0,0 @@
-module go.opencensus.io
-
-require (
-	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e
-	github.com/golang/protobuf v1.4.3
-	github.com/google/go-cmp v0.5.3
-	github.com/stretchr/testify v1.6.1
-	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
-	google.golang.org/grpc v1.33.2
-)
-
-go 1.13
diff --git a/vendor/go.opencensus.io/go.sum b/vendor/go.opencensus.io/go.sum
deleted file mode 100644
index c97cd1b551..0000000000
--- a/vendor/go.opencensus.io/go.sum
+++ /dev/null
@@ -1,116 +0,0 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.3 h1:JjCZWpVbqXDqFVmTfYWEVTMIYrL/NPdPSCHPJ0T/raM=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3 h1:x95R7cp+rSeeqAMI2knLtQ0DKlaBhv2NrtrOvafPHRo=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3 h1:XQyxROzUlZH+WIQwySDgnISgOivlhjIEwaQaJEJrrN0=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f h1:wMNYb4v58l5UBM7MYRLPG6ZhfOqbKu7X5eyFl8ZhKvA=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f h1:Bl/8QSvNqXvPGPGXa2z5xUTmV7VDcZyvRZ+QQXkXTZQ=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd h1:/e+gpKk9r3dJobndpTytxS2gOy6m5uvpg+ISQoEcusQ=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 h1:+kGHl1aib/qcwaRi1CbqBZ1rk19r85MNUf8HaBghugY=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/grpc v1.19.0 h1:cfg4PD8YEdSFnm7qLV4++93WcmhH2nIUhMjhdCvl3j8=
-google.golang.org/grpc v1.19.0 h1:cfg4PD8YEdSFnm7qLV4++93WcmhH2nIUhMjhdCvl3j8=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.2 h1:EQyQC3sa8M+p6Ulc8yy9SWSS2GVwyRc83gAbG8lrl4o=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4c=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/LICENSE b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/client.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/client.go
new file mode 100644
index 0000000000..92b8cf73c9
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/client.go
@@ -0,0 +1,61 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+// DefaultClient is the default Client and is used by Get, Head, Post and PostForm.
+// Please be careful of intitialization order - for example, if you change
+// the global propagator, the DefaultClient might still be using the old one.
+var DefaultClient = &http.Client{Transport: NewTransport(http.DefaultTransport)}
+
+// Get is a convenient replacement for http.Get that adds a span around the request.
+func Get(ctx context.Context, targetURL string) (resp *http.Response, err error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", targetURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	return DefaultClient.Do(req)
+}
+
+// Head is a convenient replacement for http.Head that adds a span around the request.
+func Head(ctx context.Context, targetURL string) (resp *http.Response, err error) {
+	req, err := http.NewRequestWithContext(ctx, "HEAD", targetURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	return DefaultClient.Do(req)
+}
+
+// Post is a convenient replacement for http.Post that adds a span around the request.
+func Post(ctx context.Context, targetURL, contentType string, body io.Reader) (resp *http.Response, err error) {
+	req, err := http.NewRequestWithContext(ctx, "POST", targetURL, body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", contentType)
+	return DefaultClient.Do(req)
+}
+
+// PostForm is a convenient replacement for http.PostForm that adds a span around the request.
+func PostForm(ctx context.Context, targetURL string, data url.Values) (resp *http.Response, err error) {
+	return Post(ctx, targetURL, "application/x-www-form-urlencoded", strings.NewReader(data.Encode()))
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/common.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/common.go
new file mode 100644
index 0000000000..728be09d0e
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/common.go
@@ -0,0 +1,46 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"net/http"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Attribute keys that can be added to a span.
+const (
+	ReadBytesKey  = attribute.Key("http.read_bytes")  // if anything was read from the request body, the total number of bytes read
+	ReadErrorKey  = attribute.Key("http.read_error")  // If an error occurred while reading a request, the string of the error (io.EOF is not recorded)
+	WroteBytesKey = attribute.Key("http.wrote_bytes") // if anything was written to the response writer, the total number of bytes written
+	WriteErrorKey = attribute.Key("http.write_error") // if an error occurred while writing a reply, the string of the error (io.EOF is not recorded)
+)
+
+// Server HTTP metrics.
+const (
+	RequestCount          = "http.server.request_count"           // Incoming request count total
+	RequestContentLength  = "http.server.request_content_length"  // Incoming request bytes total
+	ResponseContentLength = "http.server.response_content_length" // Incoming response bytes total
+	ServerLatency         = "http.server.duration"                // Incoming end to end duration, microseconds
+)
+
+// Filter is a predicate used to determine whether a given http.request should
+// be traced. A Filter must return true if the request should be traced.
+type Filter func(*http.Request) bool
+
+func newTracer(tp trace.TracerProvider) trace.Tracer {
+	return tp.Tracer(instrumentationName, trace.WithInstrumentationVersion(SemVersion()))
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go
new file mode 100644
index 0000000000..d0337f3a5e
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/config.go
@@ -0,0 +1,200 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptrace"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/global"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
+)
+
+const (
+	instrumentationName = "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+)
+
+// config represents the configuration options available for the http.Handler
+// and http.Transport types.
+type config struct {
+	Tracer            trace.Tracer
+	Meter             metric.Meter
+	Propagators       propagation.TextMapPropagator
+	SpanStartOptions  []trace.SpanStartOption
+	PublicEndpoint    bool
+	PublicEndpointFn  func(*http.Request) bool
+	ReadEvent         bool
+	WriteEvent        bool
+	Filters           []Filter
+	SpanNameFormatter func(string, *http.Request) string
+	ClientTrace       func(context.Context) *httptrace.ClientTrace
+
+	TracerProvider trace.TracerProvider
+	MeterProvider  metric.MeterProvider
+}
+
+// Option interface used for setting optional config properties.
+type Option interface {
+	apply(*config)
+}
+
+type optionFunc func(*config)
+
+func (o optionFunc) apply(c *config) {
+	o(c)
+}
+
+// newConfig creates a new config struct and applies opts to it.
+func newConfig(opts ...Option) *config {
+	c := &config{
+		Propagators:   otel.GetTextMapPropagator(),
+		MeterProvider: global.MeterProvider(),
+	}
+	for _, opt := range opts {
+		opt.apply(c)
+	}
+
+	// Tracer is only initialized if manually specified. Otherwise, can be passed with the tracing context.
+	if c.TracerProvider != nil {
+		c.Tracer = newTracer(c.TracerProvider)
+	}
+
+	c.Meter = c.MeterProvider.Meter(
+		instrumentationName,
+		metric.WithInstrumentationVersion(SemVersion()),
+	)
+
+	return c
+}
+
+// WithTracerProvider specifies a tracer provider to use for creating a tracer.
+// If none is specified, the global provider is used.
+func WithTracerProvider(provider trace.TracerProvider) Option {
+	return optionFunc(func(cfg *config) {
+		if provider != nil {
+			cfg.TracerProvider = provider
+		}
+	})
+}
+
+// WithMeterProvider specifies a meter provider to use for creating a meter.
+// If none is specified, the global provider is used.
+func WithMeterProvider(provider metric.MeterProvider) Option {
+	return optionFunc(func(cfg *config) {
+		if provider != nil {
+			cfg.MeterProvider = provider
+		}
+	})
+}
+
+// WithPublicEndpoint configures the Handler to link the span with an incoming
+// span context. If this option is not provided, then the association is a child
+// association instead of a link.
+func WithPublicEndpoint() Option {
+	return optionFunc(func(c *config) {
+		c.PublicEndpoint = true
+	})
+}
+
+// WithPublicEndpointFn runs with every request, and allows conditionnally
+// configuring the Handler to link the span with an incoming span context. If
+// this option is not provided or returns false, then the association is a
+// child association instead of a link.
+// Note: WithPublicEndpoint takes precedence over WithPublicEndpointFn.
+func WithPublicEndpointFn(fn func(*http.Request) bool) Option {
+	return optionFunc(func(c *config) {
+		c.PublicEndpointFn = fn
+	})
+}
+
+// WithPropagators configures specific propagators. If this
+// option isn't specified, then the global TextMapPropagator is used.
+func WithPropagators(ps propagation.TextMapPropagator) Option {
+	return optionFunc(func(c *config) {
+		if ps != nil {
+			c.Propagators = ps
+		}
+	})
+}
+
+// WithSpanOptions configures an additional set of
+// trace.SpanOptions, which are applied to each new span.
+func WithSpanOptions(opts ...trace.SpanStartOption) Option {
+	return optionFunc(func(c *config) {
+		c.SpanStartOptions = append(c.SpanStartOptions, opts...)
+	})
+}
+
+// WithFilter adds a filter to the list of filters used by the handler.
+// If any filter indicates to exclude a request then the request will not be
+// traced. All filters must allow a request to be traced for a Span to be created.
+// If no filters are provided then all requests are traced.
+// Filters will be invoked for each processed request, it is advised to make them
+// simple and fast.
+func WithFilter(f Filter) Option {
+	return optionFunc(func(c *config) {
+		c.Filters = append(c.Filters, f)
+	})
+}
+
+type event int
+
+// Different types of events that can be recorded, see WithMessageEvents.
+const (
+	ReadEvents event = iota
+	WriteEvents
+)
+
+// WithMessageEvents configures the Handler to record the specified events
+// (span.AddEvent) on spans. By default only summary attributes are added at the
+// end of the request.
+//
+// Valid events are:
+//   - ReadEvents: Record the number of bytes read after every http.Request.Body.Read
+//     using the ReadBytesKey
+//   - WriteEvents: Record the number of bytes written after every http.ResponeWriter.Write
+//     using the WriteBytesKey
+func WithMessageEvents(events ...event) Option {
+	return optionFunc(func(c *config) {
+		for _, e := range events {
+			switch e {
+			case ReadEvents:
+				c.ReadEvent = true
+			case WriteEvents:
+				c.WriteEvent = true
+			}
+		}
+	})
+}
+
+// WithSpanNameFormatter takes a function that will be called on every
+// request and the returned string will become the Span Name.
+func WithSpanNameFormatter(f func(operation string, r *http.Request) string) Option {
+	return optionFunc(func(c *config) {
+		c.SpanNameFormatter = f
+	})
+}
+
+// WithClientTrace takes a function that returns client trace instance that will be
+// applied to the requests sent through the otelhttp Transport.
+func WithClientTrace(f func(context.Context) *httptrace.ClientTrace) Option {
+	return optionFunc(func(c *config) {
+		c.ClientTrace = f
+	})
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/doc.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/doc.go
new file mode 100644
index 0000000000..38c7f01c71
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/doc.go
@@ -0,0 +1,18 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package otelhttp provides an http.Handler and functions that are intended
+// to be used to add tracing by wrapping existing handlers (with Handler) and
+// routes WithRouteTag.
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go
new file mode 100644
index 0000000000..fd91e4162d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/handler.go
@@ -0,0 +1,256 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/felixge/httpsnoop"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/instrument/syncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/syncint64"
+	"go.opentelemetry.io/otel/propagation"
+	semconv "go.opentelemetry.io/otel/semconv/v1.12.0"
+	"go.opentelemetry.io/otel/trace"
+)
+
+var _ http.Handler = &Handler{}
+
+// Handler is http middleware that corresponds to the http.Handler interface and
+// is designed to wrap a http.Mux (or equivalent), while individual routes on
+// the mux are wrapped with WithRouteTag. A Handler will add various attributes
+// to the span using the attribute.Keys defined in this package.
+type Handler struct {
+	operation string
+	handler   http.Handler
+
+	tracer            trace.Tracer
+	meter             metric.Meter
+	propagators       propagation.TextMapPropagator
+	spanStartOptions  []trace.SpanStartOption
+	readEvent         bool
+	writeEvent        bool
+	filters           []Filter
+	spanNameFormatter func(string, *http.Request) string
+	counters          map[string]syncint64.Counter
+	valueRecorders    map[string]syncfloat64.Histogram
+	publicEndpoint    bool
+	publicEndpointFn  func(*http.Request) bool
+}
+
+func defaultHandlerFormatter(operation string, _ *http.Request) string {
+	return operation
+}
+
+// NewHandler wraps the passed handler, functioning like middleware, in a span
+// named after the operation and with any provided Options.
+func NewHandler(handler http.Handler, operation string, opts ...Option) http.Handler {
+	h := Handler{
+		handler:   handler,
+		operation: operation,
+	}
+
+	defaultOpts := []Option{
+		WithSpanOptions(trace.WithSpanKind(trace.SpanKindServer)),
+		WithSpanNameFormatter(defaultHandlerFormatter),
+	}
+
+	c := newConfig(append(defaultOpts, opts...)...)
+	h.configure(c)
+	h.createMeasures()
+
+	return &h
+}
+
+func (h *Handler) configure(c *config) {
+	h.tracer = c.Tracer
+	h.meter = c.Meter
+	h.propagators = c.Propagators
+	h.spanStartOptions = c.SpanStartOptions
+	h.readEvent = c.ReadEvent
+	h.writeEvent = c.WriteEvent
+	h.filters = c.Filters
+	h.spanNameFormatter = c.SpanNameFormatter
+	h.publicEndpoint = c.PublicEndpoint
+	h.publicEndpointFn = c.PublicEndpointFn
+}
+
+func handleErr(err error) {
+	if err != nil {
+		otel.Handle(err)
+	}
+}
+
+func (h *Handler) createMeasures() {
+	h.counters = make(map[string]syncint64.Counter)
+	h.valueRecorders = make(map[string]syncfloat64.Histogram)
+
+	requestBytesCounter, err := h.meter.SyncInt64().Counter(RequestContentLength)
+	handleErr(err)
+
+	responseBytesCounter, err := h.meter.SyncInt64().Counter(ResponseContentLength)
+	handleErr(err)
+
+	serverLatencyMeasure, err := h.meter.SyncFloat64().Histogram(ServerLatency)
+	handleErr(err)
+
+	h.counters[RequestContentLength] = requestBytesCounter
+	h.counters[ResponseContentLength] = responseBytesCounter
+	h.valueRecorders[ServerLatency] = serverLatencyMeasure
+}
+
+// ServeHTTP serves HTTP requests (http.Handler).
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	requestStartTime := time.Now()
+	for _, f := range h.filters {
+		if !f(r) {
+			// Simply pass through to the handler if a filter rejects the request
+			h.handler.ServeHTTP(w, r)
+			return
+		}
+	}
+
+	ctx := h.propagators.Extract(r.Context(), propagation.HeaderCarrier(r.Header))
+	opts := h.spanStartOptions
+	if h.publicEndpoint || (h.publicEndpointFn != nil && h.publicEndpointFn(r.WithContext(ctx))) {
+		opts = append(opts, trace.WithNewRoot())
+		// Linking incoming span context if any for public endpoint.
+		if s := trace.SpanContextFromContext(ctx); s.IsValid() && s.IsRemote() {
+			opts = append(opts, trace.WithLinks(trace.Link{SpanContext: s}))
+		}
+	}
+
+	opts = append([]trace.SpanStartOption{
+		trace.WithAttributes(semconv.NetAttributesFromHTTPRequest("tcp", r)...),
+		trace.WithAttributes(semconv.EndUserAttributesFromHTTPRequest(r)...),
+		trace.WithAttributes(semconv.HTTPServerAttributesFromHTTPRequest(h.operation, "", r)...),
+	}, opts...) // start with the configured options
+
+	tracer := h.tracer
+
+	if tracer == nil {
+		if span := trace.SpanFromContext(r.Context()); span.SpanContext().IsValid() {
+			tracer = newTracer(span.TracerProvider())
+		} else {
+			tracer = newTracer(otel.GetTracerProvider())
+		}
+	}
+
+	ctx, span := tracer.Start(ctx, h.spanNameFormatter(h.operation, r), opts...)
+	defer span.End()
+
+	readRecordFunc := func(int64) {}
+	if h.readEvent {
+		readRecordFunc = func(n int64) {
+			span.AddEvent("read", trace.WithAttributes(ReadBytesKey.Int64(n)))
+		}
+	}
+
+	var bw bodyWrapper
+	// if request body is nil or NoBody, we don't want to mutate the body as it
+	// will affect the identity of it in an unforeseeable way because we assert
+	// ReadCloser fulfills a certain interface and it is indeed nil or NoBody.
+	if r.Body != nil && r.Body != http.NoBody {
+		bw.ReadCloser = r.Body
+		bw.record = readRecordFunc
+		r.Body = &bw
+	}
+
+	writeRecordFunc := func(int64) {}
+	if h.writeEvent {
+		writeRecordFunc = func(n int64) {
+			span.AddEvent("write", trace.WithAttributes(WroteBytesKey.Int64(n)))
+		}
+	}
+
+	rww := &respWriterWrapper{
+		ResponseWriter: w,
+		record:         writeRecordFunc,
+		ctx:            ctx,
+		props:          h.propagators,
+		statusCode:     200, // default status code in case the Handler doesn't write anything
+	}
+
+	// Wrap w to use our ResponseWriter methods while also exposing
+	// other interfaces that w may implement (http.CloseNotifier,
+	// http.Flusher, http.Hijacker, http.Pusher, io.ReaderFrom).
+
+	w = httpsnoop.Wrap(w, httpsnoop.Hooks{
+		Header: func(httpsnoop.HeaderFunc) httpsnoop.HeaderFunc {
+			return rww.Header
+		},
+		Write: func(httpsnoop.WriteFunc) httpsnoop.WriteFunc {
+			return rww.Write
+		},
+		WriteHeader: func(httpsnoop.WriteHeaderFunc) httpsnoop.WriteHeaderFunc {
+			return rww.WriteHeader
+		},
+	})
+
+	labeler := &Labeler{}
+	ctx = injectLabeler(ctx, labeler)
+
+	h.handler.ServeHTTP(w, r.WithContext(ctx))
+
+	setAfterServeAttributes(span, bw.read, rww.written, rww.statusCode, bw.err, rww.err)
+
+	// Add metrics
+	attributes := append(labeler.Get(), semconv.HTTPServerMetricAttributesFromHTTPRequest(h.operation, r)...)
+	h.counters[RequestContentLength].Add(ctx, bw.read, attributes...)
+	h.counters[ResponseContentLength].Add(ctx, rww.written, attributes...)
+
+	// Use floating point division here for higher precision (instead of Millisecond method).
+	elapsedTime := float64(time.Since(requestStartTime)) / float64(time.Millisecond)
+
+	h.valueRecorders[ServerLatency].Record(ctx, elapsedTime, attributes...)
+}
+
+func setAfterServeAttributes(span trace.Span, read, wrote int64, statusCode int, rerr, werr error) {
+	attributes := []attribute.KeyValue{}
+
+	// TODO: Consider adding an event after each read and write, possibly as an
+	// option (defaulting to off), so as to not create needlessly verbose spans.
+	if read > 0 {
+		attributes = append(attributes, ReadBytesKey.Int64(read))
+	}
+	if rerr != nil && rerr != io.EOF {
+		attributes = append(attributes, ReadErrorKey.String(rerr.Error()))
+	}
+	if wrote > 0 {
+		attributes = append(attributes, WroteBytesKey.Int64(wrote))
+	}
+	attributes = append(attributes, semconv.HTTPAttributesFromHTTPStatusCode(statusCode)...)
+	span.SetStatus(semconv.SpanStatusFromHTTPStatusCodeAndSpanKind(statusCode, trace.SpanKindServer))
+
+	if werr != nil && werr != io.EOF {
+		attributes = append(attributes, WriteErrorKey.String(werr.Error()))
+	}
+	span.SetAttributes(attributes...)
+}
+
+// WithRouteTag annotates a span with the provided route name using the
+// RouteKey Tag.
+func WithRouteTag(route string, h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		span := trace.SpanFromContext(r.Context())
+		span.SetAttributes(semconv.HTTPRouteKey.String(route))
+		h.ServeHTTP(w, r)
+	})
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/labeler.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/labeler.go
new file mode 100644
index 0000000000..26a51a1805
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/labeler.go
@@ -0,0 +1,65 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"context"
+	"sync"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// Labeler is used to allow instrumented HTTP handlers to add custom attributes to
+// the metrics recorded by the net/http instrumentation.
+type Labeler struct {
+	mu         sync.Mutex
+	attributes []attribute.KeyValue
+}
+
+// Add attributes to a Labeler.
+func (l *Labeler) Add(ls ...attribute.KeyValue) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.attributes = append(l.attributes, ls...)
+}
+
+// Get returns a copy of the attributes added to the Labeler.
+func (l *Labeler) Get() []attribute.KeyValue {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	ret := make([]attribute.KeyValue, len(l.attributes))
+	copy(ret, l.attributes)
+	return ret
+}
+
+type labelerContextKeyType int
+
+const lablelerContextKey labelerContextKeyType = 0
+
+func injectLabeler(ctx context.Context, l *Labeler) context.Context {
+	return context.WithValue(ctx, lablelerContextKey, l)
+}
+
+// LabelerFromContext retrieves a Labeler instance from the provided context if
+// one is available.  If no Labeler was found in the provided context a new, empty
+// Labeler is returned and the second return value is false.  In this case it is
+// safe to use the Labeler but any attributes added to it will not be used.
+func LabelerFromContext(ctx context.Context) (*Labeler, bool) {
+	l, ok := ctx.Value(lablelerContextKey).(*Labeler)
+	if !ok {
+		l = &Labeler{}
+	}
+	return l, ok
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go
new file mode 100644
index 0000000000..fd5e1e9bc7
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/transport.go
@@ -0,0 +1,193 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/propagation"
+	semconv "go.opentelemetry.io/otel/semconv/v1.12.0"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Transport implements the http.RoundTripper interface and wraps
+// outbound HTTP(S) requests with a span.
+type Transport struct {
+	rt http.RoundTripper
+
+	tracer            trace.Tracer
+	propagators       propagation.TextMapPropagator
+	spanStartOptions  []trace.SpanStartOption
+	filters           []Filter
+	spanNameFormatter func(string, *http.Request) string
+	clientTrace       func(context.Context) *httptrace.ClientTrace
+}
+
+var _ http.RoundTripper = &Transport{}
+
+// NewTransport wraps the provided http.RoundTripper with one that
+// starts a span and injects the span context into the outbound request headers.
+//
+// If the provided http.RoundTripper is nil, http.DefaultTransport will be used
+// as the base http.RoundTripper.
+func NewTransport(base http.RoundTripper, opts ...Option) *Transport {
+	if base == nil {
+		base = http.DefaultTransport
+	}
+
+	t := Transport{
+		rt: base,
+	}
+
+	defaultOpts := []Option{
+		WithSpanOptions(trace.WithSpanKind(trace.SpanKindClient)),
+		WithSpanNameFormatter(defaultTransportFormatter),
+	}
+
+	c := newConfig(append(defaultOpts, opts...)...)
+	t.applyConfig(c)
+
+	return &t
+}
+
+func (t *Transport) applyConfig(c *config) {
+	t.tracer = c.Tracer
+	t.propagators = c.Propagators
+	t.spanStartOptions = c.SpanStartOptions
+	t.filters = c.Filters
+	t.spanNameFormatter = c.SpanNameFormatter
+	t.clientTrace = c.ClientTrace
+}
+
+func defaultTransportFormatter(_ string, r *http.Request) string {
+	return "HTTP " + r.Method
+}
+
+// RoundTrip creates a Span and propagates its context via the provided request's headers
+// before handing the request to the configured base RoundTripper. The created span will
+// end when the response body is closed or when a read from the body returns io.EOF.
+func (t *Transport) RoundTrip(r *http.Request) (*http.Response, error) {
+	for _, f := range t.filters {
+		if !f(r) {
+			// Simply pass through to the base RoundTripper if a filter rejects the request
+			return t.rt.RoundTrip(r)
+		}
+	}
+
+	tracer := t.tracer
+
+	if tracer == nil {
+		if span := trace.SpanFromContext(r.Context()); span.SpanContext().IsValid() {
+			tracer = newTracer(span.TracerProvider())
+		} else {
+			tracer = newTracer(otel.GetTracerProvider())
+		}
+	}
+
+	opts := append([]trace.SpanStartOption{}, t.spanStartOptions...) // start with the configured options
+
+	ctx, span := tracer.Start(r.Context(), t.spanNameFormatter("", r), opts...)
+
+	if t.clientTrace != nil {
+		ctx = httptrace.WithClientTrace(ctx, t.clientTrace(ctx))
+	}
+
+	r = r.WithContext(ctx)
+	span.SetAttributes(semconv.HTTPClientAttributesFromHTTPRequest(r)...)
+	t.propagators.Inject(ctx, propagation.HeaderCarrier(r.Header))
+
+	res, err := t.rt.RoundTrip(r)
+	if err != nil {
+		span.RecordError(err)
+		span.SetStatus(codes.Error, err.Error())
+		span.End()
+		return res, err
+	}
+
+	span.SetAttributes(semconv.HTTPAttributesFromHTTPStatusCode(res.StatusCode)...)
+	span.SetStatus(semconv.SpanStatusFromHTTPStatusCode(res.StatusCode))
+	res.Body = newWrappedBody(span, res.Body)
+
+	return res, err
+}
+
+// newWrappedBody returns a new and appropriately scoped *wrappedBody as an
+// io.ReadCloser. If the passed body implements io.Writer, the returned value
+// will implement io.ReadWriteCloser.
+func newWrappedBody(span trace.Span, body io.ReadCloser) io.ReadCloser {
+	// The successful protocol switch responses will have a body that
+	// implement an io.ReadWriteCloser. Ensure this interface type continues
+	// to be satisfied if that is the case.
+	if _, ok := body.(io.ReadWriteCloser); ok {
+		return &wrappedBody{span: span, body: body}
+	}
+
+	// Remove the implementation of the io.ReadWriteCloser and only implement
+	// the io.ReadCloser.
+	return struct{ io.ReadCloser }{&wrappedBody{span: span, body: body}}
+}
+
+// wrappedBody is the response body type returned by the transport
+// instrumentation to complete a span. Errors encountered when using the
+// response body are recorded in span tracking the response.
+//
+// The span tracking the response is ended when this body is closed.
+//
+// If the response body implements the io.Writer interface (i.e. for
+// successful protocol switches), the wrapped body also will.
+type wrappedBody struct {
+	span trace.Span
+	body io.ReadCloser
+}
+
+var _ io.ReadWriteCloser = &wrappedBody{}
+
+func (wb *wrappedBody) Write(p []byte) (int, error) {
+	// This will not panic given the guard in newWrappedBody.
+	n, err := wb.body.(io.Writer).Write(p)
+	if err != nil {
+		wb.span.RecordError(err)
+		wb.span.SetStatus(codes.Error, err.Error())
+	}
+	return n, err
+}
+
+func (wb *wrappedBody) Read(b []byte) (int, error) {
+	n, err := wb.body.Read(b)
+
+	switch err {
+	case nil:
+		// nothing to do here but fall through to the return
+	case io.EOF:
+		wb.span.End()
+	default:
+		wb.span.RecordError(err)
+		wb.span.SetStatus(codes.Error, err.Error())
+	}
+	return n, err
+}
+
+func (wb *wrappedBody) Close() error {
+	wb.span.End()
+	if wb.body != nil {
+		return wb.body.Close()
+	}
+	return nil
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go
new file mode 100644
index 0000000000..822491db06
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/version.go
@@ -0,0 +1,26 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+// Version is the current release version of the otelhttp instrumentation.
+func Version() string {
+	return "0.37.0"
+	// This string is updated by the pre_release.sh script during release
+}
+
+// SemVersion is the semantic version to be supplied to tracer/meter creation.
+func SemVersion() string {
+	return "semver:" + Version()
+}
diff --git a/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/wrap.go b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/wrap.go
new file mode 100644
index 0000000000..da6468c4e5
--- /dev/null
+++ b/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/wrap.go
@@ -0,0 +1,95 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otelhttp // import "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"go.opentelemetry.io/otel/propagation"
+)
+
+var _ io.ReadCloser = &bodyWrapper{}
+
+// bodyWrapper wraps a http.Request.Body (an io.ReadCloser) to track the number
+// of bytes read and the last error.
+type bodyWrapper struct {
+	io.ReadCloser
+	record func(n int64) // must not be nil
+
+	read int64
+	err  error
+}
+
+func (w *bodyWrapper) Read(b []byte) (int, error) {
+	n, err := w.ReadCloser.Read(b)
+	n1 := int64(n)
+	w.read += n1
+	w.err = err
+	w.record(n1)
+	return n, err
+}
+
+func (w *bodyWrapper) Close() error {
+	return w.ReadCloser.Close()
+}
+
+var _ http.ResponseWriter = &respWriterWrapper{}
+
+// respWriterWrapper wraps a http.ResponseWriter in order to track the number of
+// bytes written, the last error, and to catch the returned statusCode
+// TODO: The wrapped http.ResponseWriter doesn't implement any of the optional
+// types (http.Hijacker, http.Pusher, http.CloseNotifier, http.Flusher, etc)
+// that may be useful when using it in real life situations.
+type respWriterWrapper struct {
+	http.ResponseWriter
+	record func(n int64) // must not be nil
+
+	// used to inject the header
+	ctx context.Context
+
+	props propagation.TextMapPropagator
+
+	written     int64
+	statusCode  int
+	err         error
+	wroteHeader bool
+}
+
+func (w *respWriterWrapper) Header() http.Header {
+	return w.ResponseWriter.Header()
+}
+
+func (w *respWriterWrapper) Write(p []byte) (int, error) {
+	if !w.wroteHeader {
+		w.WriteHeader(http.StatusOK)
+	}
+	n, err := w.ResponseWriter.Write(p)
+	n1 := int64(n)
+	w.record(n1)
+	w.written += n1
+	w.err = err
+	return n, err
+}
+
+func (w *respWriterWrapper) WriteHeader(statusCode int) {
+	if w.wroteHeader {
+		return
+	}
+	w.wroteHeader = true
+	w.statusCode = statusCode
+	w.ResponseWriter.WriteHeader(statusCode)
+}
diff --git a/vendor/go.opentelemetry.io/otel/.gitattributes b/vendor/go.opentelemetry.io/otel/.gitattributes
new file mode 100644
index 0000000000..314766e91b
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/.gitattributes
@@ -0,0 +1,3 @@
+* text=auto eol=lf
+*.{cmd,[cC][mM][dD]} text eol=crlf
+*.{bat,[bB][aA][tT]} text eol=crlf
diff --git a/vendor/go.opentelemetry.io/otel/.gitignore b/vendor/go.opentelemetry.io/otel/.gitignore
new file mode 100644
index 0000000000..0b605b3d67
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/.gitignore
@@ -0,0 +1,21 @@
+.DS_Store
+Thumbs.db
+
+.tools/
+.idea/
+.vscode/
+*.iml
+*.so
+coverage.*
+
+gen/
+
+/example/fib/fib
+/example/fib/traces.txt
+/example/jaeger/jaeger
+/example/namedtracer/namedtracer
+/example/opencensus/opencensus
+/example/passthrough/passthrough
+/example/prometheus/prometheus
+/example/zipkin/zipkin
+/example/otel-collector/otel-collector
diff --git a/vendor/go.opentelemetry.io/otel/.gitmodules b/vendor/go.opentelemetry.io/otel/.gitmodules
new file mode 100644
index 0000000000..38a1f56982
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "opentelemetry-proto"]
+	path = exporters/otlp/internal/opentelemetry-proto
+	url = https://github.com/open-telemetry/opentelemetry-proto
diff --git a/vendor/go.opentelemetry.io/otel/.golangci.yml b/vendor/go.opentelemetry.io/otel/.golangci.yml
new file mode 100644
index 0000000000..0f099f5759
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/.golangci.yml
@@ -0,0 +1,244 @@
+# See https://github.com/golangci/golangci-lint#config-file
+run:
+  issues-exit-code: 1 #Default
+  tests: true #Default
+
+linters:
+  # Disable everything by default so upgrades to not include new "default
+  # enabled" linters.
+  disable-all: true
+  # Specifically enable linters we want to use.
+  enable:
+    - depguard
+    - errcheck
+    - godot
+    - gofmt
+    - goimports
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - revive
+    - staticcheck
+    - typecheck
+    - unused
+
+issues:
+  # Maximum issues count per one linter.
+  # Set to 0 to disable.
+  # Default: 50
+  # Setting to unlimited so the linter only is run once to debug all issues.
+  max-issues-per-linter: 0
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  # Setting to unlimited so the linter only is run once to debug all issues.
+  max-same-issues: 0
+  # Excluding configuration per-path, per-linter, per-text and per-source.
+  exclude-rules:
+    # TODO: Having appropriate comments for exported objects helps development,
+    # even for objects in internal packages. Appropriate comments for all
+    # exported objects should be added and this exclusion removed.
+    - path: '.*internal/.*'
+      text: "exported (method|function|type|const) (.+) should have comment or be unexported"
+      linters:
+        - revive
+    # Yes, they are, but it's okay in a test.
+    - path: _test\.go
+      text: "exported func.*returns unexported type.*which can be annoying to use"
+      linters:
+        - revive
+    # Example test functions should be treated like main.
+    - path: example.*_test\.go
+      text: "calls to (.+) only in main[(][)] or init[(][)] functions"
+      linters:
+        - revive
+  include:
+    # revive exported should have comment or be unexported.
+    - EXC0012
+    # revive package comment should be of the form ...
+    - EXC0013
+
+linters-settings:
+  depguard:
+    # Check the list against standard lib.
+    # Default: false
+    include-go-root: true
+    # A list of packages for the list type specified.
+    # Default: []
+    packages:
+      - "crypto/md5"
+      - "crypto/sha1"
+      - "crypto/**/pkix"
+    ignore-file-rules:
+      - "**/*_test.go"
+    additional-guards:
+      # Do not allow testing packages in non-test files.
+      - list-type: denylist
+        include-go-root: true
+        packages:
+          - testing
+          - github.com/stretchr/testify
+        ignore-file-rules:
+          - "**/*_test.go"
+          - "**/*test/*.go"
+          - "**/internal/matchers/*.go"
+  godot:
+    exclude:
+      # Exclude sentence fragments for lists.
+      - '^[ ]*[-•]'
+      # Exclude sentences prefixing a list.
+      - ':$'
+  goimports:
+    local-prefixes: go.opentelemetry.io
+  misspell:
+    locale: US
+    ignore-words:
+      - cancelled
+  revive:
+    # Sets the default failure confidence.
+    # This means that linting errors with less than 0.8 confidence will be ignored.
+    # Default: 0.8
+    confidence: 0.01
+    rules:
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#blank-imports
+      - name: blank-imports
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#bool-literal-in-expr
+      - name: bool-literal-in-expr
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#constant-logical-expr
+      - name: constant-logical-expr
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#context-as-argument
+      # TODO (#3372) reenable linter when it is compatible. https://github.com/golangci/golangci-lint/issues/3280
+      - name: context-as-argument
+        disabled: true
+        arguments:
+          allowTypesBefore: "*testing.T"
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#context-keys-type
+      - name: context-keys-type
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#deep-exit
+      - name: deep-exit
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#defer
+      - name: defer
+        disabled: false
+        arguments:
+          - ["call-chain", "loop"]
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#dot-imports
+      - name: dot-imports
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#duplicated-imports
+      - name: duplicated-imports
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#early-return
+      - name: early-return
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#empty-block
+      - name: empty-block
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#empty-lines
+      - name: empty-lines
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#error-naming
+      - name: error-naming
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#error-return
+      - name: error-return
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#error-strings
+      - name: error-strings
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#errorf
+      - name: errorf
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#exported
+      - name: exported
+        disabled: false
+        arguments:
+          - "sayRepetitiveInsteadOfStutters"
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#flag-parameter
+      - name: flag-parameter
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#identical-branches
+      - name: identical-branches
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#if-return
+      - name: if-return
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#increment-decrement
+      - name: increment-decrement
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#indent-error-flow
+      - name: indent-error-flow
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#import-shadowing
+      - name: import-shadowing
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#package-comments
+      - name: package-comments
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#range
+      - name: range
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#range-val-in-closure
+      - name: range-val-in-closure
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#range-val-address
+      - name: range-val-address
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#redefines-builtin-id
+      - name: redefines-builtin-id
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#string-format
+      - name: string-format
+        disabled: false
+        arguments:
+          - - panic
+            - '/^[^\n]*$/'
+            - must not contain line breaks
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#struct-tag
+      - name: struct-tag
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#superfluous-else
+      - name: superfluous-else
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#time-equal
+      - name: time-equal
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#var-naming
+      - name: var-naming
+        disabled: false
+        arguments:
+          - ["ID"] # AllowList
+          - ["Otel", "Aws", "Gcp"] # DenyList
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#var-declaration
+      - name: var-declaration
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unconditional-recursion
+      - name: unconditional-recursion
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unexported-return
+      - name: unexported-return
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unhandled-error
+      - name: unhandled-error
+        disabled: false
+        arguments:
+          - "fmt.Fprint"
+          - "fmt.Fprintf"
+          - "fmt.Fprintln"
+          - "fmt.Print"
+          - "fmt.Printf"
+          - "fmt.Println"
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unnecessary-stmt
+      - name: unnecessary-stmt
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#useless-break
+      - name: useless-break
+        disabled: false
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#waitgroup-by-value
+      - name: waitgroup-by-value
+        disabled: false
diff --git a/vendor/go.opentelemetry.io/otel/.lycheeignore b/vendor/go.opentelemetry.io/otel/.lycheeignore
new file mode 100644
index 0000000000..40d62fa2eb
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/.lycheeignore
@@ -0,0 +1,6 @@
+http://localhost
+http://jaeger-collector
+https://github.com/open-telemetry/opentelemetry-go/milestone/
+https://github.com/open-telemetry/opentelemetry-go/projects
+file:///home/runner/work/opentelemetry-go/opentelemetry-go/libraries
+file:///home/runner/work/opentelemetry-go/opentelemetry-go/manual
diff --git a/vendor/go.opentelemetry.io/otel/.markdownlint.yaml b/vendor/go.opentelemetry.io/otel/.markdownlint.yaml
new file mode 100644
index 0000000000..3202496c35
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/.markdownlint.yaml
@@ -0,0 +1,29 @@
+# Default state for all rules
+default: true
+
+# ul-style
+MD004: false
+
+# hard-tabs
+MD010: false
+
+# line-length
+MD013: false
+
+# no-duplicate-header
+MD024:
+  siblings_only: true
+
+#single-title
+MD025: false
+
+# ol-prefix
+MD029:
+  style: ordered
+
+# no-inline-html
+MD033: false
+
+# fenced-code-language
+MD040: false
+
diff --git a/vendor/go.opentelemetry.io/otel/CHANGELOG.md b/vendor/go.opentelemetry.io/otel/CHANGELOG.md
new file mode 100644
index 0000000000..1d9726f60b
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/CHANGELOG.md
@@ -0,0 +1,2369 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+
+This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.14.0/0.37.0/0.0.4] 2023-02-27
+
+This release is the last to support [Go 1.18].
+The next release will require at least [Go 1.19].
+
+### Added
+
+- The `event` type semantic conventions are added to `go.opentelemetry.io/otel/semconv/v1.17.0`. (#3697)
+- Support [Go 1.20]. (#3693)
+- The `go.opentelemetry.io/otel/semconv/v1.18.0` package.
+  The package contains semantic conventions from the `v1.18.0` version of the OpenTelemetry specification. (#3719)
+  - The following `const` renames from `go.opentelemetry.io/otel/semconv/v1.17.0` are included:
+    - `OtelScopeNameKey` -> `OTelScopeNameKey`
+    - `OtelScopeVersionKey` -> `OTelScopeVersionKey`
+    - `OtelLibraryNameKey` -> `OTelLibraryNameKey`
+    - `OtelLibraryVersionKey` -> `OTelLibraryVersionKey`
+    - `OtelStatusCodeKey` -> `OTelStatusCodeKey`
+    - `OtelStatusDescriptionKey` -> `OTelStatusDescriptionKey`
+    - `OtelStatusCodeOk` -> `OTelStatusCodeOk`
+    - `OtelStatusCodeError` -> `OTelStatusCodeError`
+  - The following `func` renames from `go.opentelemetry.io/otel/semconv/v1.17.0` are included:
+    - `OtelScopeName` -> `OTelScopeName`
+    - `OtelScopeVersion` -> `OTelScopeVersion`
+    - `OtelLibraryName` -> `OTelLibraryName`
+    - `OtelLibraryVersion` -> `OTelLibraryVersion`
+    - `OtelStatusDescription` -> `OTelStatusDescription`
+- A `IsSampled` method is added to the `SpanContext` implementation in `go.opentelemetry.io/otel/bridge/opentracing` to expose the span sampled state.
+  See the [README](./bridge/opentracing/README.md) for more information. (#3570)
+- The `WithInstrumentationAttributes` option to `go.opentelemetry.io/otel/metric`. (#3738)
+- The `WithInstrumentationAttributes` option to `go.opentelemetry.io/otel/trace`. (#3739)
+- The following environment variables are supported by the periodic `Reader` in `go.opentelemetry.io/otel/sdk/metric`. (#3763)
+  - `OTEL_METRIC_EXPORT_INTERVAL` sets the time between collections and exports.
+  - `OTEL_METRIC_EXPORT_TIMEOUT` sets the timeout an export is attempted.
+
+### Changed
+
+- Fall-back to `TextMapCarrier` when it's not `HttpHeader`s in `go.opentelemetry.io/otel/bridge/opentracing`. (#3679)
+- The `Collect` method of the `"go.opentelemetry.io/otel/sdk/metric".Reader` interface is updated to accept the `metricdata.ResourceMetrics` value the collection will be made into.
+  This change is made to enable memory reuse by SDK users. (#3732)
+- The `WithUnit` option in `go.opentelemetry.io/otel/sdk/metric/instrument` is updated to accept a `string` for the unit value. (#3776)
+
+### Fixed
+
+- Ensure `go.opentelemetry.io/otel` does not use generics. (#3723, #3725)
+- Multi-reader `MeterProvider`s now export metrics for all readers, instead of just the first reader. (#3720, #3724)
+- Remove use of deprecated `"math/rand".Seed` in `go.opentelemetry.io/otel/example/prometheus`. (#3733)
+- Do not silently drop unknown schema data with `Parse` in  `go.opentelemetry.io/otel/schema/v1.1`. (#3743)
+- Data race issue in OTLP exporter retry mechanism. (#3755, #3756)
+- Wrapping empty errors when exporting in `go.opentelemetry.io/otel/sdk/metric`. (#3698, #3772)
+- Incorrect "all" and "resource" definition for schema files in `go.opentelemetry.io/otel/schema/v1.1`. (#3777)
+
+### Deprecated
+
+- The `go.opentelemetry.io/otel/metric/unit` package is deprecated.
+  Use the equivalent unit string instead. (#3776)
+  - Use `"1"` instead of `unit.Dimensionless`
+  - Use `"By"` instead of `unit.Bytes`
+  - Use `"ms"` instead of `unit.Milliseconds`
+
+## [1.13.0/0.36.0] 2023-02-07
+
+### Added
+
+- Attribute `KeyValue` creations functions to `go.opentelemetry.io/otel/semconv/v1.17.0` for all non-enum semantic conventions.
+  These functions ensure semantic convention type correctness. (#3675)
+
+### Fixed
+
+- Removed the `http.target` attribute from being added by `ServerRequest` in the following packages. (#3687)
+  - `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`
+  - `go.opentelemetry.io/otel/semconv/v1.14.0/httpconv`
+  - `go.opentelemetry.io/otel/semconv/v1.15.0/httpconv`
+  - `go.opentelemetry.io/otel/semconv/v1.16.0/httpconv`
+  - `go.opentelemetry.io/otel/semconv/v1.17.0/httpconv`
+
+### Removed
+
+- The deprecated `go.opentelemetry.io/otel/metric/instrument/asyncfloat64` package is removed. (#3631)
+- The deprecated `go.opentelemetry.io/otel/metric/instrument/asyncint64` package is removed. (#3631)
+- The deprecated `go.opentelemetry.io/otel/metric/instrument/syncfloat64` package is removed. (#3631)
+- The deprecated `go.opentelemetry.io/otel/metric/instrument/syncint64` package is removed. (#3631)
+
+## [1.12.0/0.35.0] 2023-01-28
+
+### Added
+
+- The `WithInt64Callback` option to `go.opentelemetry.io/otel/metric/instrument`.
+  This options is used to configure `int64` Observer callbacks during their creation. (#3507)
+- The `WithFloat64Callback` option to `go.opentelemetry.io/otel/metric/instrument`.
+  This options is used to configure `float64` Observer callbacks during their creation. (#3507)
+- The `Producer` interface and `Reader.RegisterProducer(Producer)` to `go.opentelemetry.io/otel/sdk/metric`.
+  These additions are used to enable external metric Producers. (#3524)
+- The `Callback` function type to `go.opentelemetry.io/otel/metric`.
+  This new named function type is registered with a `Meter`. (#3564)
+- The `go.opentelemetry.io/otel/semconv/v1.13.0` package.
+  The package contains semantic conventions from the `v1.13.0` version of the OpenTelemetry specification. (#3499)
+  - The `EndUserAttributesFromHTTPRequest` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is merged into `ClientRequest` and `ServerRequest` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `HTTPAttributesFromHTTPStatusCode` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is merged into `ClientResponse` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `HTTPClientAttributesFromHTTPRequest` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is replaced by `ClientRequest` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `HTTPServerAttributesFromHTTPRequest` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is replaced by `ServerRequest` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `HTTPServerMetricAttributesFromHTTPRequest` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is replaced by `ServerRequest` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `NetAttributesFromHTTPRequest` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is split into `Transport` in `go.opentelemetry.io/otel/semconv/v1.13.0/netconv` and `ClientRequest` or `ServerRequest` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `SpanStatusFromHTTPStatusCode` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is replaced by `ClientStatus` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `SpanStatusFromHTTPStatusCodeAndSpanKind` function in `go.opentelemetry.io/otel/semconv/v1.12.0` is split into `ClientStatus` and `ServerStatus` in `go.opentelemetry.io/otel/semconv/v1.13.0/httpconv`.
+  - The `Client` function is included in `go.opentelemetry.io/otel/semconv/v1.13.0/netconv` to generate attributes for a `net.Conn`.
+  - The `Server` function is included in `go.opentelemetry.io/otel/semconv/v1.13.0/netconv` to generate attributes for a `net.Listener`.
+- The `go.opentelemetry.io/otel/semconv/v1.14.0` package.
+  The package contains semantic conventions from the `v1.14.0` version of the OpenTelemetry specification. (#3566)
+- The `go.opentelemetry.io/otel/semconv/v1.15.0` package.
+  The package contains semantic conventions from the `v1.15.0` version of the OpenTelemetry specification. (#3578)
+- The `go.opentelemetry.io/otel/semconv/v1.16.0` package.
+  The package contains semantic conventions from the `v1.16.0` version of the OpenTelemetry specification. (#3579)
+- Metric instruments to `go.opentelemetry.io/otel/metric/instrument`.
+  These instruments are use as replacements of the depreacted `go.opentelemetry.io/otel/metric/instrument/{asyncfloat64,asyncint64,syncfloat64,syncint64}` packages.(#3575, #3586)
+  - `Float64ObservableCounter` replaces the `asyncfloat64.Counter`
+  - `Float64ObservableUpDownCounter` replaces the `asyncfloat64.UpDownCounter`
+  - `Float64ObservableGauge` replaces the `asyncfloat64.Gauge`
+  - `Int64ObservableCounter` replaces the `asyncint64.Counter`
+  - `Int64ObservableUpDownCounter` replaces the `asyncint64.UpDownCounter`
+  - `Int64ObservableGauge` replaces the `asyncint64.Gauge`
+  - `Float64Counter` replaces the `syncfloat64.Counter`
+  - `Float64UpDownCounter` replaces the `syncfloat64.UpDownCounter`
+  - `Float64Histogram` replaces the `syncfloat64.Histogram`
+  - `Int64Counter` replaces the `syncint64.Counter`
+  - `Int64UpDownCounter` replaces the `syncint64.UpDownCounter`
+  - `Int64Histogram` replaces the `syncint64.Histogram`
+- `NewTracerProvider` to `go.opentelemetry.io/otel/bridge/opentracing`.
+  This is used to create `WrapperTracer` instances from a `TracerProvider`. (#3116)
+- The `Extrema` type to `go.opentelemetry.io/otel/sdk/metric/metricdata`.
+  This type is used to represent min/max values and still be able to distinguish unset and zero values. (#3487)
+- The `go.opentelemetry.io/otel/semconv/v1.17.0` package.
+  The package contains semantic conventions from the `v1.17.0` version of the OpenTelemetry specification. (#3599)
+
+### Changed
+
+- Jaeger and Zipkin exporter use `github.com/go-logr/logr` as the logging interface, and add the `WithLogr` option. (#3497, #3500)
+- Instrument configuration in `go.opentelemetry.io/otel/metric/instrument` is split into specific options and confguration based on the instrument type. (#3507)
+  - Use the added `Int64Option` type to configure instruments from `go.opentelemetry.io/otel/metric/instrument/syncint64`.
+  - Use the added `Float64Option` type to configure instruments from `go.opentelemetry.io/otel/metric/instrument/syncfloat64`.
+  - Use the added `Int64ObserverOption` type to configure instruments from `go.opentelemetry.io/otel/metric/instrument/asyncint64`.
+  - Use the added `Float64ObserverOption` type to configure instruments from `go.opentelemetry.io/otel/metric/instrument/asyncfloat64`.
+- Return a `Registration` from the `RegisterCallback` method of a `Meter` in the `go.opentelemetry.io/otel/metric` package.
+  This `Registration` can be used to unregister callbacks. (#3522)
+- Global error handler uses an atomic value instead of a mutex. (#3543)
+- Add `NewMetricProducer` to `go.opentelemetry.io/otel/bridge/opencensus`, which can be used to pass OpenCensus metrics to an OpenTelemetry Reader. (#3541)
+- Global logger uses an atomic value instead of a mutex. (#3545)
+- The `Shutdown` method of the `"go.opentelemetry.io/otel/sdk/trace".TracerProvider` releases all computational resources when called the first time. (#3551)
+- The `Sampler` returned from `TraceIDRatioBased` `go.opentelemetry.io/otel/sdk/trace` now uses the rightmost bits for sampling decisions.
+  This fixes random sampling when using ID generators like `xray.IDGenerator` and increasing parity with other language implementations. (#3557)
+- Errors from `go.opentelemetry.io/otel/exporters/otlp/otlptrace` exporters are wrapped in erros identifying their signal name.
+  Existing users of the exporters attempting to identify specific errors will need to use `errors.Unwrap()` to get the underlying error. (#3516)
+- Exporters from `go.opentelemetry.io/otel/exporters/otlp` will print the final retryable error message when attempts to retry time out. (#3514)
+- The instrument kind names in `go.opentelemetry.io/otel/sdk/metric` are updated to match the API. (#3562)
+  - `InstrumentKindSyncCounter` is renamed to `InstrumentKindCounter`
+  - `InstrumentKindSyncUpDownCounter` is renamed to `InstrumentKindUpDownCounter`
+  - `InstrumentKindSyncHistogram` is renamed to `InstrumentKindHistogram`
+  - `InstrumentKindAsyncCounter` is renamed to `InstrumentKindObservableCounter`
+  - `InstrumentKindAsyncUpDownCounter` is renamed to `InstrumentKindObservableUpDownCounter`
+  - `InstrumentKindAsyncGauge` is renamed to `InstrumentKindObservableGauge`
+- The `RegisterCallback` method of the `Meter` in `go.opentelemetry.io/otel/metric` changed.
+  - The named `Callback` replaces the inline function parameter. (#3564)
+  - `Callback` is required to return an error. (#3576)
+  - `Callback` accepts the added `Observer` parameter added.
+    This new parameter is used by `Callback` implementations to observe values for asynchronous instruments instead of calling the `Observe` method of the instrument directly. (#3584)
+  - The slice of `instrument.Asynchronous` is now passed as a variadic argument. (#3587)
+- The exporter from `go.opentelemetry.io/otel/exporters/zipkin` is updated to use the `v1.16.0` version of semantic conventions.
+  This means it no longer uses the removed `net.peer.ip` or `http.host` attributes to determine the remote endpoint.
+  Instead it uses the `net.sock.peer` attributes. (#3581)
+- The `Min` and `Max` fields of the `HistogramDataPoint` in `go.opentelemetry.io/otel/sdk/metric/metricdata` are now defined with the added `Extrema` type instead of a `*float64`. (#3487)
+
+### Fixed
+
+- Asynchronous instruments that use sum aggregators and attribute filters correctly add values from equivalent attribute sets that have been filtered. (#3439, #3549)
+- The `RegisterCallback` method of the `Meter` from `go.opentelemetry.io/otel/sdk/metric` only registers a callback for instruments created by that meter.
+  Trying to register a callback with instruments from a different meter will result in an error being returned. (#3584)
+
+### Deprecated
+
+- The `NewMetricExporter` in `go.opentelemetry.io/otel/bridge/opencensus` is deprecated.
+  Use `NewMetricProducer` instead. (#3541)
+- The `go.opentelemetry.io/otel/metric/instrument/asyncfloat64` package is deprecated.
+  Use the instruments from `go.opentelemetry.io/otel/metric/instrument` instead. (#3575)
+- The `go.opentelemetry.io/otel/metric/instrument/asyncint64` package is deprecated.
+  Use the instruments from `go.opentelemetry.io/otel/metric/instrument` instead. (#3575)
+- The `go.opentelemetry.io/otel/metric/instrument/syncfloat64` package is deprecated.
+  Use the instruments from `go.opentelemetry.io/otel/metric/instrument` instead. (#3575)
+- The `go.opentelemetry.io/otel/metric/instrument/syncint64` package is deprecated.
+  Use the instruments from `go.opentelemetry.io/otel/metric/instrument` instead. (#3575)
+- The `NewWrappedTracerProvider` in `go.opentelemetry.io/otel/bridge/opentracing` is now deprecated.
+  Use `NewTracerProvider` instead. (#3116)
+
+### Removed
+
+- The deprecated `go.opentelemetry.io/otel/sdk/metric/view` package is removed. (#3520)
+- The `InstrumentProvider` from `go.opentelemetry.io/otel/sdk/metric/asyncint64` is removed.
+  Use the new creation methods of the `Meter` in `go.opentelemetry.io/otel/sdk/metric` instead. (#3530)
+  - The `Counter` method is replaced by `Meter.Int64ObservableCounter`
+  - The `UpDownCounter` method is replaced by `Meter.Int64ObservableUpDownCounter`
+  - The `Gauge` method is replaced by `Meter.Int64ObservableGauge`
+- The `InstrumentProvider` from `go.opentelemetry.io/otel/sdk/metric/asyncfloat64` is removed.
+  Use the new creation methods of the `Meter` in `go.opentelemetry.io/otel/sdk/metric` instead. (#3530)
+  - The `Counter` method is replaced by `Meter.Float64ObservableCounter`
+  - The `UpDownCounter` method is replaced by `Meter.Float64ObservableUpDownCounter`
+  - The `Gauge` method is replaced by `Meter.Float64ObservableGauge`
+- The `InstrumentProvider` from `go.opentelemetry.io/otel/sdk/metric/syncint64` is removed.
+  Use the new creation methods of the `Meter` in `go.opentelemetry.io/otel/sdk/metric` instead. (#3530)
+  - The `Counter` method is replaced by `Meter.Int64Counter`
+  - The `UpDownCounter` method is replaced by `Meter.Int64UpDownCounter`
+  - The `Histogram` method is replaced by `Meter.Int64Histogram`
+- The `InstrumentProvider` from `go.opentelemetry.io/otel/sdk/metric/syncfloat64` is removed.
+  Use the new creation methods of the `Meter` in `go.opentelemetry.io/otel/sdk/metric` instead. (#3530)
+  - The `Counter` method is replaced by `Meter.Float64Counter`
+  - The `UpDownCounter` method is replaced by `Meter.Float64UpDownCounter`
+  - The `Histogram` method is replaced by `Meter.Float64Histogram`
+
+## [1.11.2/0.34.0] 2022-12-05
+
+### Added
+
+- The `WithView` `Option` is added to the `go.opentelemetry.io/otel/sdk/metric` package.
+   This option is used to configure the view(s) a `MeterProvider` will use for all `Reader`s that are registered with it. (#3387)
+- Add Instrumentation Scope and Version as info metric and label in Prometheus exporter.
+  This can be disabled using the `WithoutScopeInfo()` option added to that package.(#3273, #3357)
+- OTLP exporters now recognize: (#3363)
+  - `OTEL_EXPORTER_OTLP_INSECURE`
+  - `OTEL_EXPORTER_OTLP_TRACES_INSECURE`
+  - `OTEL_EXPORTER_OTLP_METRICS_INSECURE`
+  - `OTEL_EXPORTER_OTLP_CLIENT_KEY`
+  - `OTEL_EXPORTER_OTLP_TRACES_CLIENT_KEY`
+  - `OTEL_EXPORTER_OTLP_METRICS_CLIENT_KEY`
+  - `OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE`
+  - `OTEL_EXPORTER_OTLP_TRACES_CLIENT_CERTIFICATE`
+  - `OTEL_EXPORTER_OTLP_METRICS_CLIENT_CERTIFICATE`
+- The `View` type and related `NewView` function to create a view according to the OpenTelemetry specification are added to `go.opentelemetry.io/otel/sdk/metric`.
+  These additions are replacements for the `View` type and `New` function from `go.opentelemetry.io/otel/sdk/metric/view`. (#3459)
+- The `Instrument` and `InstrumentKind` type are added to `go.opentelemetry.io/otel/sdk/metric`.
+  These additions are replacements for the `Instrument` and `InstrumentKind` types from `go.opentelemetry.io/otel/sdk/metric/view`. (#3459)
+- The `Stream` type is added to `go.opentelemetry.io/otel/sdk/metric` to define a metric data stream a view will produce. (#3459)
+- The `AssertHasAttributes` allows instrument authors to test that datapoints returned have appropriate attributes. (#3487)
+
+### Changed
+
+- The `"go.opentelemetry.io/otel/sdk/metric".WithReader` option no longer accepts views to associate with the `Reader`.
+   Instead, views are now registered directly with the `MeterProvider` via the new `WithView` option.
+   The views registered with the `MeterProvider` apply to all `Reader`s. (#3387)
+- The `Temporality(view.InstrumentKind) metricdata.Temporality` and `Aggregation(view.InstrumentKind) aggregation.Aggregation` methods are added to the `"go.opentelemetry.io/otel/sdk/metric".Exporter` interface. (#3260)
+- The `Temporality(view.InstrumentKind) metricdata.Temporality` and `Aggregation(view.InstrumentKind) aggregation.Aggregation` methods are added to the `"go.opentelemetry.io/otel/exporters/otlp/otlpmetric".Client` interface. (#3260)
+- The `WithTemporalitySelector` and `WithAggregationSelector` `ReaderOption`s have been changed to `ManualReaderOption`s in the `go.opentelemetry.io/otel/sdk/metric` package. (#3260)
+- The periodic reader in the `go.opentelemetry.io/otel/sdk/metric` package now uses the temporality and aggregation selectors from its configured exporter instead of accepting them as options. (#3260)
+
+### Fixed
+
+- The `go.opentelemetry.io/otel/exporters/prometheus` exporter fixes duplicated `_total` suffixes. (#3369)
+- Remove comparable requirement for `Reader`s. (#3387)
+- Cumulative metrics from the OpenCensus bridge (`go.opentelemetry.io/otel/bridge/opencensus`) are defined as monotonic sums, instead of non-monotonic. (#3389)
+- Asynchronous counters (`Counter` and `UpDownCounter`) from the metric SDK now produce delta sums when configured with delta temporality. (#3398)
+- Exported `Status` codes in the `go.opentelemetry.io/otel/exporters/zipkin` exporter are now exported as all upper case values. (#3340)
+- `Aggregation`s from `go.opentelemetry.io/otel/sdk/metric` with no data are not exported. (#3394, #3436)
+- Reenabled Attribute Filters in the Metric SDK. (#3396)
+- Asynchronous callbacks are only called if they are registered with at least one instrument that does not use drop aggragation. (#3408)
+- Do not report empty partial-success responses in the `go.opentelemetry.io/otel/exporters/otlp` exporters. (#3438, #3432)
+- Handle partial success responses in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric` exporters. (#3162, #3440)
+- Prevent duplicate Prometheus description, unit, and type. (#3469)
+- Prevents panic when using incorrect `attribute.Value.As[Type]Slice()`. (#3489)
+
+### Removed
+
+- The `go.opentelemetry.io/otel/exporters/otlp/otlpmetric.Client` interface is removed. (#3486)
+- The `go.opentelemetry.io/otel/exporters/otlp/otlpmetric.New` function is removed. Use the `otlpmetric[http|grpc].New` directly. (#3486)
+
+### Deprecated
+
+- The `go.opentelemetry.io/otel/sdk/metric/view` package is deprecated.
+  Use `Instrument`, `InstrumentKind`, `View`, and `NewView` in `go.opentelemetry.io/otel/sdk/metric` instead. (#3476)
+
+## [1.11.1/0.33.0] 2022-10-19
+
+### Added
+
+- The Prometheus exporter in `go.opentelemetry.io/otel/exporters/prometheus` registers with a Prometheus registerer on creation.
+   By default, it will register with the default Prometheus registerer.
+   A non-default registerer can be used by passing the `WithRegisterer` option. (#3239)
+- Added the `WithAggregationSelector` option to the `go.opentelemetry.io/otel/exporters/prometheus` package to change the default `AggregationSelector` used. (#3341)
+- The Prometheus exporter in `go.opentelemetry.io/otel/exporters/prometheus` converts the `Resource` associated with metric exports into a `target_info` metric. (#3285)
+
+### Changed
+
+- The `"go.opentelemetry.io/otel/exporters/prometheus".New` function is updated to return an error.
+   It will return an error if the exporter fails to register with Prometheus. (#3239)
+
+### Fixed
+
+- The URL-encoded values from the `OTEL_RESOURCE_ATTRIBUTES` environment variable are decoded. (#2963)
+- The `baggage.NewMember` function decodes the `value` parameter instead of directly using it.
+   This fixes the implementation to be compliant with the W3C specification. (#3226)
+- Slice attributes of the `attribute` package are now comparable based on their value, not instance. (#3108 #3252)
+- The `Shutdown` and `ForceFlush` methods of the `"go.opentelemetry.io/otel/sdk/trace".TraceProvider` no longer return an error when no processor is registered. (#3268)
+- The Prometheus exporter in `go.opentelemetry.io/otel/exporters/prometheus` cumulatively sums histogram buckets. (#3281)
+- The sum of each histogram data point is now uniquely exported by the `go.opentelemetry.io/otel/exporters/otlpmetric` exporters. (#3284, #3293)
+- Recorded values for asynchronous counters (`Counter` and `UpDownCounter`) are interpreted as exact, not incremental, sum values by the metric SDK. (#3350, #3278)
+- `UpDownCounters` are now correctly output as Prometheus gauges in the `go.opentelemetry.io/otel/exporters/prometheus` exporter. (#3358)
+- The Prometheus exporter in `go.opentelemetry.io/otel/exporters/prometheus` no longer describes the metrics it will send to Prometheus on startup.
+   Instead the exporter is defined as an "unchecked" collector for Prometheus.
+   This fixes the `reader is not registered` warning currently emitted on startup. (#3291 #3342)
+- The `go.opentelemetry.io/otel/exporters/prometheus` exporter now correctly adds `_total` suffixes to counter metrics. (#3360)
+- The `go.opentelemetry.io/otel/exporters/prometheus` exporter now adds a unit suffix to metric names.
+   This can be disabled using the `WithoutUnits()` option added to that package. (#3352)
+
+## [1.11.0/0.32.3] 2022-10-12
+
+### Added
+
+- Add default User-Agent header to OTLP exporter requests (`go.opentelemetry.io/otel/exporters/otlptrace/otlptracegrpc` and `go.opentelemetry.io/otel/exporters/otlptrace/otlptracehttp`). (#3261)
+
+### Changed
+
+- `span.SetStatus` has been updated such that calls that lower the status are now no-ops. (#3214)
+- Upgrade `golang.org/x/sys/unix` from `v0.0.0-20210423185535-09eb48e85fd7` to `v0.0.0-20220919091848-fb04ddd9f9c8`.
+  This addresses [GO-2022-0493](https://pkg.go.dev/vuln/GO-2022-0493). (#3235)
+
+## [0.32.2] Metric SDK (Alpha) - 2022-10-11
+
+### Added
+
+- Added an example of using metric views to customize instruments. (#3177)
+- Add default User-Agent header to OTLP exporter requests (`go.opentelemetry.io/otel/exporters/otlpmetric/otlpmetricgrpc` and `go.opentelemetry.io/otel/exporters/otlpmetric/otlpmetrichttp`). (#3261)
+
+### Changed
+
+- Flush pending measurements with the `PeriodicReader` in the `go.opentelemetry.io/otel/sdk/metric` when `ForceFlush` or `Shutdown` are called. (#3220)
+- Update histogram default bounds to match the requirements of the latest specification. (#3222)
+- Encode the HTTP status code in the OpenTracing bridge (`go.opentelemetry.io/otel/bridge/opentracing`) as an integer.  (#3265)
+
+### Fixed
+
+- Use default view if instrument does not match any registered view of a reader. (#3224, #3237)
+- Return the same instrument every time a user makes the exact same instrument creation call. (#3229, #3251)
+- Return the existing instrument when a view transforms a creation call to match an existing instrument. (#3240, #3251)
+- Log a warning when a conflicting instrument (e.g. description, unit, data-type) is created instead of returning an error. (#3251)
+- The OpenCensus bridge no longer sends empty batches of metrics. (#3263)
+
+## [0.32.1] Metric SDK (Alpha) - 2022-09-22
+
+### Changed
+
+- The Prometheus exporter sanitizes OpenTelemetry instrument names when exporting.
+   Invalid characters are replaced with `_`. (#3212)
+
+### Added
+
+- The metric portion of the OpenCensus bridge (`go.opentelemetry.io/otel/bridge/opencensus`) has been reintroduced. (#3192)
+- The OpenCensus bridge example (`go.opentelemetry.io/otel/example/opencensus`) has been reintroduced. (#3206)
+
+### Fixed
+
+- Updated go.mods to point to valid versions of the sdk. (#3216)
+- Set the `MeterProvider` resource on all exported metric data. (#3218)
+
+## [0.32.0] Revised Metric SDK (Alpha) - 2022-09-18
+
+### Changed
+
+- The metric SDK in `go.opentelemetry.io/otel/sdk/metric` is completely refactored to comply with the OpenTelemetry specification.
+  Please see the package documentation for how the new SDK is initialized and configured. (#3175)
+- Update the minimum supported go version to go1.18. Removes support for go1.17 (#3179)
+
+### Removed
+
+- The metric portion of the OpenCensus bridge (`go.opentelemetry.io/otel/bridge/opencensus`) has been removed.
+  A new bridge compliant with the revised metric SDK will be added back in a future release. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/aggregator/aggregatortest` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/aggregator/histogram` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/aggregator/lastvalue` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/aggregator/sum` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/aggregator` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/controller/basic` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/controller/controllertest` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/controller/time` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/export/aggregation` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/export` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/metrictest` package is removed.
+  A replacement package that supports the new metric SDK will be added back in a future release. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/number` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/processor/basic` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/processor/processortest` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/processor/reducer` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/registry` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/sdkapi` package is removed, see the new metric SDK. (#3175)
+- The `go.opentelemetry.io/otel/sdk/metric/selector/simple` package is removed, see the new metric SDK. (#3175)
+- The `"go.opentelemetry.io/otel/sdk/metric".ErrUninitializedInstrument` variable was removed. (#3175)
+- The `"go.opentelemetry.io/otel/sdk/metric".ErrBadInstrument` variable was removed. (#3175)
+- The `"go.opentelemetry.io/otel/sdk/metric".Accumulator` type was removed, see the `MeterProvider`in the new metric SDK. (#3175)
+- The `"go.opentelemetry.io/otel/sdk/metric".NewAccumulator` function was removed, see `NewMeterProvider`in the new metric SDK. (#3175)
+- The deprecated `"go.opentelemetry.io/otel/sdk/metric".AtomicFieldOffsets` function was removed. (#3175)
+
+## [1.10.0] - 2022-09-09
+
+### Added
+
+- Support Go 1.19. (#3077)
+  Include compatibility testing and document support. (#3077)
+- Support the OTLP ExportTracePartialSuccess response; these are passed to the registered error handler. (#3106)
+- Upgrade go.opentelemetry.io/proto/otlp from v0.18.0 to v0.19.0 (#3107)
+
+### Changed
+
+- Fix misidentification of OpenTelemetry `SpanKind` in OpenTracing bridge (`go.opentelemetry.io/otel/bridge/opentracing`).  (#3096)
+- Attempting to start a span with a nil `context` will no longer cause a panic. (#3110)
+- All exporters will be shutdown even if one reports an error (#3091)
+- Ensure valid UTF-8 when truncating over-length attribute values. (#3156)
+
+## [1.9.0/0.0.3] - 2022-08-01
+
+### Added
+
+- Add support for Schema Files format 1.1.x (metric "split" transform) with the new `go.opentelemetry.io/otel/schema/v1.1` package. (#2999)
+- Add the `go.opentelemetry.io/otel/semconv/v1.11.0` package.
+  The package contains semantic conventions from the `v1.11.0` version of the OpenTelemetry specification. (#3009)
+- Add the `go.opentelemetry.io/otel/semconv/v1.12.0` package.
+  The package contains semantic conventions from the `v1.12.0` version of the OpenTelemetry specification. (#3010)
+- Add the `http.method` attribute to HTTP server metric from all `go.opentelemetry.io/otel/semconv/*` packages. (#3018)
+
+### Fixed
+
+- Invalid warning for context setup being deferred in `go.opentelemetry.io/otel/bridge/opentracing` package. (#3029)
+
+## [1.8.0/0.31.0] - 2022-07-08
+
+### Added
+
+- Add support for `opentracing.TextMap` format in the `Inject` and `Extract` methods
+of the `"go.opentelemetry.io/otel/bridge/opentracing".BridgeTracer` type. (#2911)
+
+### Changed
+
+- The `crosslink` make target has been updated to use the `go.opentelemetry.io/build-tools/crosslink` package. (#2886)
+- In the `go.opentelemetry.io/otel/sdk/instrumentation` package rename `Library` to `Scope` and alias `Library` as `Scope` (#2976)
+- Move metric no-op implementation form `nonrecording` to `metric` package. (#2866)
+
+### Removed
+
+- Support for go1.16. Support is now only for go1.17 and go1.18 (#2917)
+
+### Deprecated
+
+- The `Library` struct in the `go.opentelemetry.io/otel/sdk/instrumentation` package is deprecated.
+  Use the equivalent `Scope` struct instead. (#2977)
+- The `ReadOnlySpan.InstrumentationLibrary` method from the `go.opentelemetry.io/otel/sdk/trace` package is deprecated.
+  Use the equivalent `ReadOnlySpan.InstrumentationScope` method instead. (#2977)
+
+## [1.7.0/0.30.0] - 2022-04-28
+
+### Added
+
+- Add the `go.opentelemetry.io/otel/semconv/v1.8.0` package.
+  The package contains semantic conventions from the `v1.8.0` version of the OpenTelemetry specification. (#2763)
+- Add the `go.opentelemetry.io/otel/semconv/v1.9.0` package.
+  The package contains semantic conventions from the `v1.9.0` version of the OpenTelemetry specification. (#2792)
+- Add the `go.opentelemetry.io/otel/semconv/v1.10.0` package.
+  The package contains semantic conventions from the `v1.10.0` version of the OpenTelemetry specification. (#2842)
+- Added an in-memory exporter to metrictest to aid testing with a full SDK. (#2776)
+
+### Fixed
+
+- Globally delegated instruments are unwrapped before delegating asynchronous callbacks. (#2784)
+- Remove import of `testing` package in non-tests builds of the `go.opentelemetry.io/otel` package. (#2786)
+
+### Changed
+
+- The `WithLabelEncoder` option from the `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric` package is renamed to `WithAttributeEncoder`. (#2790)
+- The `LabelFilterSelector` interface from `go.opentelemetry.io/otel/sdk/metric/processor/reducer` is renamed to `AttributeFilterSelector`.
+  The method included in the renamed interface also changed from `LabelFilterFor` to `AttributeFilterFor`. (#2790)
+- The `Metadata.Labels` method from the `go.opentelemetry.io/otel/sdk/metric/export` package is renamed to `Metadata.Attributes`.
+  Consequentially, the `Record` type from the same package also has had the embedded method renamed. (#2790)
+
+### Deprecated
+
+- The `Iterator.Label` method in the `go.opentelemetry.io/otel/attribute` package is deprecated.
+  Use the equivalent `Iterator.Attribute` method instead. (#2790)
+- The `Iterator.IndexedLabel` method in the `go.opentelemetry.io/otel/attribute` package is deprecated.
+  Use the equivalent `Iterator.IndexedAttribute` method instead. (#2790)
+- The `MergeIterator.Label` method in the `go.opentelemetry.io/otel/attribute` package is deprecated.
+  Use the equivalent `MergeIterator.Attribute` method instead. (#2790)
+
+### Removed
+
+- Removed the `Batch` type from the `go.opentelemetry.io/otel/sdk/metric/metrictest` package. (#2864)
+- Removed the `Measurement` type from the `go.opentelemetry.io/otel/sdk/metric/metrictest` package. (#2864)
+
+## [0.29.0] - 2022-04-11
+
+### Added
+
+- The metrics global package was added back into several test files. (#2764)
+- The `Meter` function is added back to the `go.opentelemetry.io/otel/metric/global` package.
+  This function is a convenience function equivalent to calling `global.MeterProvider().Meter(...)`. (#2750)
+
+### Removed
+
+- Removed module the `go.opentelemetry.io/otel/sdk/export/metric`.
+  Use the `go.opentelemetry.io/otel/sdk/metric` module instead. (#2720)
+
+### Changed
+
+- Don't panic anymore when setting a global MeterProvider to itself. (#2749)
+- Upgrade `go.opentelemetry.io/proto/otlp` in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric` from `v0.12.1` to `v0.15.0`.
+  This replaces the use of the now deprecated `InstrumentationLibrary` and `InstrumentationLibraryMetrics` types and fields in the proto library with the equivalent `InstrumentationScope` and `ScopeMetrics`. (#2748)
+
+## [1.6.3] - 2022-04-07
+
+### Fixed
+
+- Allow non-comparable global `MeterProvider`, `TracerProvider`, and `TextMapPropagator` types to be set. (#2772, #2773)
+
+## [1.6.2] - 2022-04-06
+
+### Changed
+
+- Don't panic anymore when setting a global TracerProvider or TextMapPropagator to itself. (#2749)
+- Upgrade `go.opentelemetry.io/proto/otlp` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from `v0.12.1` to `v0.15.0`.
+  This replaces the use of the now deprecated `InstrumentationLibrary` and `InstrumentationLibrarySpans` types and fields in the proto library with the equivalent `InstrumentationScope` and `ScopeSpans`. (#2748)
+
+## [1.6.1] - 2022-03-28
+
+### Fixed
+
+- The `go.opentelemetry.io/otel/schema/*` packages now use the correct schema URL for their `SchemaURL` constant.
+  Instead of using `"https://opentelemetry.io/schemas/v<version>"` they now use the correct URL without a `v` prefix, `"https://opentelemetry.io/schemas/<version>"`. (#2743, #2744)
+
+### Security
+
+- Upgrade `go.opentelemetry.io/proto/otlp` from `v0.12.0` to `v0.12.1`.
+  This includes an indirect upgrade of `github.com/grpc-ecosystem/grpc-gateway` which resolves [a vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2019-11254) from `gopkg.in/yaml.v2` in version `v2.2.3`. (#2724, #2728)
+
+## [1.6.0/0.28.0] - 2022-03-23
+
+### ⚠️ Notice ⚠️
+
+This update is a breaking change of the unstable Metrics API.
+Code instrumented with the `go.opentelemetry.io/otel/metric` will need to be modified.
+
+### Added
+
+- Add metrics exponential histogram support.
+  New mapping functions have been made available in `sdk/metric/aggregator/exponential/mapping` for other OpenTelemetry projects to take dependencies on. (#2502)
+- Add Go 1.18 to our compatibility tests. (#2679)
+- Allow configuring the Sampler with the `OTEL_TRACES_SAMPLER` and `OTEL_TRACES_SAMPLER_ARG` environment variables. (#2305, #2517)
+- Add the `metric/global` for obtaining and setting the global `MeterProvider`. (#2660)
+
+### Changed
+
+- The metrics API has been significantly changed to match the revised OpenTelemetry specification.
+  High-level changes include:
+
+  - Synchronous and asynchronous instruments are now handled by independent `InstrumentProvider`s.
+    These `InstrumentProvider`s are managed with a `Meter`.
+  - Synchronous and asynchronous instruments are grouped into their own packages based on value types.
+  - Asynchronous callbacks can now be registered with a `Meter`.
+
+  Be sure to check out the metric module documentation for more information on how to use the revised API. (#2587, #2660)
+
+### Fixed
+
+- Fallback to general attribute limits when span specific ones are not set in the environment. (#2675, #2677)
+
+## [1.5.0] - 2022-03-16
+
+### Added
+
+- Log the Exporters configuration in the TracerProviders message. (#2578)
+- Added support to configure the span limits with environment variables.
+  The following environment variables are supported. (#2606, #2637)
+  - `OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT`
+  - `OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT`
+  - `OTEL_SPAN_EVENT_COUNT_LIMIT`
+  - `OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT`
+  - `OTEL_SPAN_LINK_COUNT_LIMIT`
+  - `OTEL_LINK_ATTRIBUTE_COUNT_LIMIT`
+
+  If the provided environment variables are invalid (negative), the default values would be used.
+- Rename the `gc` runtime name to `go` (#2560)
+- Add resource container ID detection. (#2418)
+- Add span attribute value length limit.
+  The new `AttributeValueLengthLimit` field is added to the `"go.opentelemetry.io/otel/sdk/trace".SpanLimits` type to configure this limit for a `TracerProvider`.
+  The default limit for this resource is "unlimited". (#2637)
+- Add the `WithRawSpanLimits` option to `go.opentelemetry.io/otel/sdk/trace`.
+  This option replaces the `WithSpanLimits` option.
+  Zero or negative values will not be changed to the default value like `WithSpanLimits` does.
+  Setting a limit to zero will effectively disable the related resource it limits and setting to a negative value will mean that resource is unlimited.
+  Consequentially, limits should be constructed using `NewSpanLimits` and updated accordingly. (#2637)
+
+### Changed
+
+- Drop oldest tracestate `Member` when capacity is reached. (#2592)
+- Add event and link drop counts to the exported data from the `oltptrace` exporter. (#2601)
+- Unify path cleaning functionally in the `otlpmetric` and `otlptrace` configuration. (#2639)
+- Change the debug message from the `sdk/trace.BatchSpanProcessor` to reflect the count is cumulative. (#2640)
+- Introduce new internal `envconfig` package for OTLP exporters. (#2608)
+- If `http.Request.Host` is empty, fall back to use `URL.Host` when populating `http.host` in the `semconv` packages. (#2661)
+
+### Fixed
+
+- Remove the OTLP trace exporter limit of SpanEvents when exporting. (#2616)
+- Default to port `4318` instead of `4317` for the `otlpmetrichttp` and `otlptracehttp` client. (#2614, #2625)
+- Unlimited span limits are now supported (negative values). (#2636, #2637)
+
+### Deprecated
+
+- Deprecated `"go.opentelemetry.io/otel/sdk/trace".WithSpanLimits`.
+  Use `WithRawSpanLimits` instead.
+  That option allows setting unlimited and zero limits, this option does not.
+  This option will be kept until the next major version incremented release. (#2637)
+
+## [1.4.1] - 2022-02-16
+
+### Fixed
+
+- Fix race condition in reading the dropped spans number for the `BatchSpanProcessor`. (#2615)
+
+## [1.4.0] - 2022-02-11
+
+### Added
+
+- Use `OTEL_EXPORTER_ZIPKIN_ENDPOINT` environment variable to specify zipkin collector endpoint. (#2490)
+- Log the configuration of `TracerProvider`s, and `Tracer`s for debugging.
+  To enable use a logger with Verbosity (V level) `>=1`. (#2500)
+- Added support to configure the batch span-processor with environment variables.
+  The following environment variables are used. (#2515)
+  - `OTEL_BSP_SCHEDULE_DELAY`
+  - `OTEL_BSP_EXPORT_TIMEOUT`
+  - `OTEL_BSP_MAX_QUEUE_SIZE`.
+  - `OTEL_BSP_MAX_EXPORT_BATCH_SIZE`
+
+### Changed
+
+- Zipkin exporter exports `Resource` attributes in the `Tags` field. (#2589)
+
+### Deprecated
+
+- Deprecate module the `go.opentelemetry.io/otel/sdk/export/metric`.
+  Use the `go.opentelemetry.io/otel/sdk/metric` module instead. (#2382)
+- Deprecate `"go.opentelemetry.io/otel/sdk/metric".AtomicFieldOffsets`. (#2445)
+
+### Fixed
+
+- Fixed the instrument kind for noop async instruments to correctly report an implementation. (#2461)
+- Fix UDP packets overflowing with Jaeger payloads. (#2489, #2512)
+- Change the `otlpmetric.Client` interface's `UploadMetrics` method to accept a single `ResourceMetrics` instead of a slice of them. (#2491)
+- Specify explicit buckets in Prometheus example, fixing issue where example only has `+inf` bucket. (#2419, #2493)
+- W3C baggage will now decode urlescaped values. (#2529)
+- Baggage members are now only validated once, when calling `NewMember` and not also when adding it to the baggage itself. (#2522)
+- The order attributes are dropped from spans in the `go.opentelemetry.io/otel/sdk/trace` package when capacity is reached is fixed to be in compliance with the OpenTelemetry specification.
+  Instead of dropping the least-recently-used attribute, the last added attribute is dropped.
+  This drop order still only applies to attributes with unique keys not already contained in the span.
+  If an attribute is added with a key already contained in the span, that attribute is updated to the new value being added. (#2576)
+
+### Removed
+
+- Updated `go.opentelemetry.io/proto/otlp` from `v0.11.0` to `v0.12.0`. This version removes a number of deprecated methods. (#2546)
+  - [`Metric.GetIntGauge()`](https://pkg.go.dev/go.opentelemetry.io/proto/otlp@v0.11.0/metrics/v1#Metric.GetIntGauge)
+  - [`Metric.GetIntHistogram()`](https://pkg.go.dev/go.opentelemetry.io/proto/otlp@v0.11.0/metrics/v1#Metric.GetIntHistogram)
+  - [`Metric.GetIntSum()`](https://pkg.go.dev/go.opentelemetry.io/proto/otlp@v0.11.0/metrics/v1#Metric.GetIntSum)
+
+## [1.3.0] - 2021-12-10
+
+### ⚠️ Notice ⚠️
+
+We have updated the project minimum supported Go version to 1.16
+
+### Added
+
+- Added an internal Logger.
+  This can be used by the SDK and API to provide users with feedback of the internal state.
+  To enable verbose logs configure the logger which will print V(1) logs. For debugging information configure to print V(5) logs. (#2343)
+- Add the `WithRetry` `Option` and the `RetryConfig` type to the `go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetrichttp` package to specify retry behavior consistently. (#2425)
+- Add `SpanStatusFromHTTPStatusCodeAndSpanKind` to all `semconv` packages to return a span status code similar to `SpanStatusFromHTTPStatusCode`, but exclude `4XX` HTTP errors as span errors if the span is of server kind. (#2296)
+
+### Changed
+
+- The `"go.opentelemetry.io/otel/exporter/otel/otlptrace/otlptracegrpc".Client` now uses the underlying gRPC `ClientConn` to handle name resolution, TCP connection establishment (with retries and backoff) and TLS handshakes, and handling errors on established connections by re-resolving the name and reconnecting. (#2329)
+- The `"go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetricgrpc".Client` now uses the underlying gRPC `ClientConn` to handle name resolution, TCP connection establishment (with retries and backoff) and TLS handshakes, and handling errors on established connections by re-resolving the name and reconnecting. (#2425)
+- The `"go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetricgrpc".RetrySettings` type is renamed to `RetryConfig`. (#2425)
+- The `go.opentelemetry.io/otel/exporter/otel/*` gRPC exporters now default to using the host's root CA set if none are provided by the user and `WithInsecure` is not specified. (#2432)
+- Change `resource.Default` to be evaluated the first time it is called, rather than on import. This allows the caller the option to update `OTEL_RESOURCE_ATTRIBUTES` first, such as with `os.Setenv`. (#2371)
+
+### Fixed
+
+- The `go.opentelemetry.io/otel/exporter/otel/*` exporters are updated to handle per-signal and universal endpoints according to the OpenTelemetry specification.
+  Any per-signal endpoint set via an `OTEL_EXPORTER_OTLP_<signal>_ENDPOINT` environment variable is now used without modification of the path.
+  When `OTEL_EXPORTER_OTLP_ENDPOINT` is set, if it contains a path, that path is used as a base path which per-signal paths are appended to. (#2433)
+- Basic metric controller updated to use sync.Map to avoid blocking calls (#2381)
+- The `go.opentelemetry.io/otel/exporter/jaeger` correctly sets the `otel.status_code` value to be a string of `ERROR` or `OK` instead of an integer code. (#2439, #2440)
+
+### Deprecated
+
+- Deprecated the `"go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetrichttp".WithMaxAttempts` `Option`, use the new `WithRetry` `Option` instead. (#2425)
+- Deprecated the `"go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetrichttp".WithBackoff` `Option`, use the new `WithRetry` `Option` instead. (#2425)
+
+### Removed
+
+- Remove the metric Processor's ability to convert cumulative to delta aggregation temporality. (#2350)
+- Remove the metric Bound Instruments interface and implementations. (#2399)
+- Remove the metric MinMaxSumCount kind aggregation and the corresponding OTLP export path. (#2423)
+- Metric SDK removes the "exact" aggregator for histogram instruments, as it performed a non-standard aggregation for OTLP export (creating repeated Gauge points) and worked its way into a number of confusing examples. (#2348)
+
+## [1.2.0] - 2021-11-12
+
+### Changed
+
+- Metric SDK `export.ExportKind`, `export.ExportKindSelector` types have been renamed to `aggregation.Temporality` and `aggregation.TemporalitySelector` respectively to keep in line with current specification and protocol along with built-in selectors (e.g., `aggregation.CumulativeTemporalitySelector`, ...). (#2274)
+- The Metric `Exporter` interface now requires a `TemporalitySelector` method instead of an `ExportKindSelector`. (#2274)
+- Metrics API cleanup. The `metric/sdkapi` package has been created to relocate the API-to-SDK interface:
+  - The following interface types simply moved from `metric` to `metric/sdkapi`: `Descriptor`, `MeterImpl`, `InstrumentImpl`, `SyncImpl`, `BoundSyncImpl`, `AsyncImpl`, `AsyncRunner`, `AsyncSingleRunner`, and `AsyncBatchRunner`
+  - The following struct types moved and are replaced with type aliases, since they are exposed to the user: `Observation`, `Measurement`.
+  - The No-op implementations of sync and async instruments are no longer exported, new functions `sdkapi.NewNoopAsyncInstrument()` and `sdkapi.NewNoopSyncInstrument()` are provided instead. (#2271)
+- Update the SDK `BatchSpanProcessor` to export all queued spans when `ForceFlush` is called. (#2080, #2335)
+
+### Added
+
+- Add the `"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc".WithGRPCConn` option so the exporter can reuse an existing gRPC connection. (#2002)
+- Added a new `schema` module to help parse Schema Files in OTEP 0152 format. (#2267)
+- Added a new `MapCarrier` to the `go.opentelemetry.io/otel/propagation` package to hold propagated cross-cutting concerns as a `map[string]string` held in memory. (#2334)
+
+## [1.1.0] - 2021-10-27
+
+### Added
+
+- Add the `"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc".WithGRPCConn` option so the exporter can reuse an existing gRPC connection. (#2002)
+- Add the `go.opentelemetry.io/otel/semconv/v1.7.0` package.
+  The package contains semantic conventions from the `v1.7.0` version of the OpenTelemetry specification. (#2320)
+- Add the `go.opentelemetry.io/otel/semconv/v1.6.1` package.
+  The package contains semantic conventions from the `v1.6.1` version of the OpenTelemetry specification. (#2321)
+- Add the `go.opentelemetry.io/otel/semconv/v1.5.0` package.
+  The package contains semantic conventions from the `v1.5.0` version of the OpenTelemetry specification. (#2322)
+  - When upgrading from the `semconv/v1.4.0` package note the following name changes:
+    - `K8SReplicasetUIDKey` -> `K8SReplicaSetUIDKey`
+    - `K8SReplicasetNameKey` -> `K8SReplicaSetNameKey`
+    - `K8SStatefulsetUIDKey` -> `K8SStatefulSetUIDKey`
+    - `k8SStatefulsetNameKey` -> `K8SStatefulSetNameKey`
+    - `K8SDaemonsetUIDKey` -> `K8SDaemonSetUIDKey`
+    - `K8SDaemonsetNameKey` -> `K8SDaemonSetNameKey`
+
+### Changed
+
+- Links added to a span will be dropped by the SDK if they contain an invalid span context (#2275).
+
+### Fixed
+
+- The `"go.opentelemetry.io/otel/semconv/v1.4.0".HTTPServerAttributesFromHTTPRequest` now correctly only sets the HTTP client IP attribute even if the connection was routed with proxies and there are multiple addresses in the `X-Forwarded-For` header. (#2282, #2284)
+- The `"go.opentelemetry.io/otel/semconv/v1.4.0".NetAttributesFromHTTPRequest` function correctly handles IPv6 addresses as IP addresses and sets the correct net peer IP instead of the net peer hostname attribute. (#2283, #2285)
+- The simple span processor shutdown method deterministically returns the exporter error status if it simultaneously finishes when the deadline is reached. (#2290, #2289)
+
+## [1.0.1] - 2021-10-01
+
+### Fixed
+
+- json stdout exporter no longer crashes due to concurrency bug. (#2265)
+
+## [Metrics 0.24.0] - 2021-10-01
+
+### Changed
+
+- NoopMeterProvider is now private and NewNoopMeterProvider must be used to obtain a noopMeterProvider. (#2237)
+- The Metric SDK `Export()` function takes a new two-level reader interface for iterating over results one instrumentation library at a time. (#2197)
+  - The former `"go.opentelemetry.io/otel/sdk/export/metric".CheckpointSet` is renamed `Reader`.
+  - The new interface is named `"go.opentelemetry.io/otel/sdk/export/metric".InstrumentationLibraryReader`.
+
+## [1.0.0] - 2021-09-20
+
+This is the first stable release for the project.
+This release includes an API and SDK for the tracing signal that will comply with the stability guarantees defined by the projects [versioning policy](./VERSIONING.md).
+
+### Added
+
+- OTLP trace exporter now sets the `SchemaURL` field in the exported telemetry if the Tracer has `WithSchemaURL` option. (#2242)
+
+### Fixed
+
+- Slice-valued attributes can correctly be used as map keys. (#2223)
+
+### Removed
+
+- Removed the `"go.opentelemetry.io/otel/exporters/zipkin".WithSDKOptions` function. (#2248)
+- Removed the deprecated package `go.opentelemetry.io/otel/oteltest`. (#2234)
+- Removed the deprecated package `go.opentelemetry.io/otel/bridge/opencensus/utils`. (#2233)
+- Removed deprecated functions, types, and methods from `go.opentelemetry.io/otel/attribute` package.
+  Use the typed functions and methods added to the package instead. (#2235)
+  - The `Key.Array` method is removed.
+  - The `Array` function is removed.
+  - The `Any` function is removed.
+  - The `ArrayValue` function is removed.
+  - The `AsArray` function is removed.
+
+## [1.0.0-RC3] - 2021-09-02
+
+### Added
+
+- Added `ErrorHandlerFunc` to use a function as an `"go.opentelemetry.io/otel".ErrorHandler`. (#2149)
+- Added `"go.opentelemetry.io/otel/trace".WithStackTrace` option to add a stack trace when using `span.RecordError` or when panic is handled in `span.End`. (#2163)
+- Added typed slice attribute types and functionality to the `go.opentelemetry.io/otel/attribute` package to replace the existing array type and functions. (#2162)
+  - `BoolSlice`, `IntSlice`, `Int64Slice`, `Float64Slice`, and `StringSlice` replace the use of the `Array` function in the package.
+- Added the `go.opentelemetry.io/otel/example/fib` example package.
+  Included is an example application that computes Fibonacci numbers. (#2203)
+
+### Changed
+
+- Metric instruments have been renamed to match the (feature-frozen) metric API specification:
+  - ValueRecorder becomes Histogram
+  - ValueObserver becomes Gauge
+  - SumObserver becomes CounterObserver
+  - UpDownSumObserver becomes UpDownCounterObserver
+  The API exported from this project is still considered experimental. (#2202)
+- Metric SDK/API implementation type `InstrumentKind` moves into `sdkapi` sub-package. (#2091)
+- The Metrics SDK export record no longer contains a Resource pointer, the SDK `"go.opentelemetry.io/otel/sdk/trace/export/metric".Exporter.Export()` function for push-based exporters now takes a single Resource argument, pull-based exporters use `"go.opentelemetry.io/otel/sdk/metric/controller/basic".Controller.Resource()`. (#2120)
+- The JSON output of the `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` is harmonized now such that the output is "plain" JSON objects after each other of the form `{ ... } { ... } { ... }`. Earlier the JSON objects describing a span were wrapped in a slice for each `Exporter.ExportSpans` call, like `[ { ... } ][ { ... } { ... } ]`. Outputting JSON object directly after each other is consistent with JSON loggers, and a bit easier to parse and read. (#2196)
+- Update the `NewTracerConfig`, `NewSpanStartConfig`, `NewSpanEndConfig`, and `NewEventConfig` function in the `go.opentelemetry.io/otel/trace` package to return their respective configurations as structs instead of pointers to the struct. (#2212)
+
+### Deprecated
+
+- The `go.opentelemetry.io/otel/bridge/opencensus/utils` package is deprecated.
+  All functionality from this package now exists in the `go.opentelemetry.io/otel/bridge/opencensus` package.
+  The functions from that package should be used instead. (#2166)
+- The `"go.opentelemetry.io/otel/attribute".Array` function and the related `ARRAY` value type is deprecated.
+  Use the typed `*Slice` functions and types added to the package instead. (#2162)
+- The `"go.opentelemetry.io/otel/attribute".Any` function is deprecated.
+  Use the typed functions instead. (#2181)
+- The `go.opentelemetry.io/otel/oteltest` package is deprecated.
+  The `"go.opentelemetry.io/otel/sdk/trace/tracetest".SpanRecorder` can be registered with the default SDK (`go.opentelemetry.io/otel/sdk/trace`) as a `SpanProcessor` and used as a replacement for this deprecated package. (#2188)
+
+### Removed
+
+- Removed metrics test package `go.opentelemetry.io/otel/sdk/export/metric/metrictest`. (#2105)
+
+### Fixed
+
+- The `fromEnv` detector no longer throws an error when `OTEL_RESOURCE_ATTRIBUTES` environment variable is not set or empty. (#2138)
+- Setting the global `ErrorHandler` with `"go.opentelemetry.io/otel".SetErrorHandler` multiple times is now supported. (#2160, #2140)
+- The `"go.opentelemetry.io/otel/attribute".Any` function now supports `int32` values. (#2169)
+- Multiple calls to `"go.opentelemetry.io/otel/sdk/metric/controller/basic".WithResource()` are handled correctly, and when no resources are provided `"go.opentelemetry.io/otel/sdk/resource".Default()` is used. (#2120)
+- The `WithoutTimestamps` option for the `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` exporter causes the exporter to correctly ommit timestamps. (#2195)
+- Fixed typos in resources.go. (#2201)
+
+## [1.0.0-RC2] - 2021-07-26
+
+### Added
+
+- Added `WithOSDescription` resource configuration option to set OS (Operating System) description resource attribute (`os.description`). (#1840)
+- Added `WithOS` resource configuration option to set all OS (Operating System) resource attributes at once. (#1840)
+- Added the `WithRetry` option to the `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` package.
+  This option is a replacement for the removed `WithMaxAttempts` and `WithBackoff` options. (#2095)
+- Added API `LinkFromContext` to return Link which encapsulates SpanContext from provided context and also encapsulates attributes. (#2115)
+- Added a new `Link` type under the SDK `otel/sdk/trace` package that counts the number of attributes that were dropped for surpassing the `AttributePerLinkCountLimit` configured in the Span's `SpanLimits`.
+  This new type replaces the equal-named API `Link` type found in the `otel/trace` package for most usages within the SDK.
+  For example, instances of this type are now returned by the `Links()` function of `ReadOnlySpan`s provided in places like the `OnEnd` function of `SpanProcessor` implementations. (#2118)
+- Added the `SpanRecorder` type to the `go.opentelemetry.io/otel/skd/trace/tracetest` package.
+  This type can be used with the default SDK as a `SpanProcessor` during testing. (#2132)
+
+### Changed
+
+- The `SpanModels` function is now exported from the `go.opentelemetry.io/otel/exporters/zipkin` package to convert OpenTelemetry spans into Zipkin model spans. (#2027)
+- Rename the `"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc".RetrySettings` to `RetryConfig`. (#2095)
+
+### Deprecated
+
+- The `TextMapCarrier` and `TextMapPropagator` from the `go.opentelemetry.io/otel/oteltest` package and their associated creation functions (`TextMapCarrier`, `NewTextMapPropagator`) are deprecated. (#2114)
+- The `Harness` type from the `go.opentelemetry.io/otel/oteltest` package and its associated creation function, `NewHarness` are deprecated and will be removed in the next release. (#2123)
+- The `TraceStateFromKeyValues` function from the `go.opentelemetry.io/otel/oteltest` package is deprecated.
+  Use the `trace.ParseTraceState` function instead. (#2122)
+
+### Removed
+
+- Removed the deprecated package `go.opentelemetry.io/otel/exporters/trace/jaeger`. (#2020)
+- Removed the deprecated package `go.opentelemetry.io/otel/exporters/trace/zipkin`. (#2020)
+- Removed the `"go.opentelemetry.io/otel/sdk/resource".WithBuiltinDetectors` function.
+  The explicit `With*` options for every built-in detector should be used instead. (#2026 #2097)
+- Removed the `WithMaxAttempts` and `WithBackoff` options from the `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` package.
+  The retry logic of the package has been updated to match the `otlptracegrpc` package and accordingly a `WithRetry` option is added that should be used instead. (#2095)
+- Removed `DroppedAttributeCount` field from `otel/trace.Link` struct. (#2118)
+
+### Fixed
+
+- When using WithNewRoot, don't use the parent context for making sampling decisions. (#2032)
+- `oteltest.Tracer` now creates a valid `SpanContext` when using `WithNewRoot`. (#2073)
+- OS type detector now sets the correct `dragonflybsd` value for DragonFly BSD. (#2092)
+- The OTel span status is correctly transformed into the OTLP status in the `go.opentelemetry.io/otel/exporters/otlp/otlptrace` package.
+  This fix will by default set the status to `Unset` if it is not explicitly set to `Ok` or `Error`. (#2099 #2102)
+- The `Inject` method for the `"go.opentelemetry.io/otel/propagation".TraceContext` type no longer injects empty `tracestate` values. (#2108)
+- Use `6831` as default Jaeger agent port instead of `6832`. (#2131)
+
+## [Experimental Metrics v0.22.0] - 2021-07-19
+
+### Added
+
+- Adds HTTP support for OTLP metrics exporter. (#2022)
+
+### Removed
+
+- Removed the deprecated package `go.opentelemetry.io/otel/exporters/metric/prometheus`. (#2020)
+
+## [1.0.0-RC1] / 0.21.0 - 2021-06-18
+
+With this release we are introducing a split in module versions.  The tracing API and SDK are entering the `v1.0.0` Release Candidate phase with `v1.0.0-RC1`
+while the experimental metrics API and SDK continue with `v0.x` releases at `v0.21.0`.  Modules at major version 1 or greater will not depend on modules
+with major version 0.
+
+### Added
+
+- Adds `otlpgrpc.WithRetry`option for configuring the retry policy for transient errors on the otlp/gRPC exporter. (#1832)
+  - The following status codes are defined as transient errors:
+      | gRPC Status Code | Description |
+      | ---------------- | ----------- |
+      | 1  | Cancelled |
+      | 4  | Deadline Exceeded |
+      | 8  | Resource Exhausted |
+      | 10 | Aborted |
+      | 10 | Out of Range |
+      | 14 | Unavailable |
+      | 15 | Data Loss |
+- Added `Status` type to the `go.opentelemetry.io/otel/sdk/trace` package to represent the status of a span. (#1874)
+- Added `SpanStub` type and its associated functions to the `go.opentelemetry.io/otel/sdk/trace/tracetest` package.
+  This type can be used as a testing replacement for the `SpanSnapshot` that was removed from the `go.opentelemetry.io/otel/sdk/trace` package. (#1873)
+- Adds support for scheme in `OTEL_EXPORTER_OTLP_ENDPOINT` according to the spec. (#1886)
+- Adds `trace.WithSchemaURL` option for configuring the tracer with a Schema URL. (#1889)
+- Added an example of using OpenTelemetry Go as a trace context forwarder. (#1912)
+- `ParseTraceState` is added to the `go.opentelemetry.io/otel/trace` package.
+  It can be used to decode a `TraceState` from a `tracestate` header string value. (#1937)
+- Added `Len` method to the `TraceState` type in the `go.opentelemetry.io/otel/trace` package.
+  This method returns the number of list-members the `TraceState` holds. (#1937)
+- Creates package `go.opentelemetry.io/otel/exporters/otlp/otlptrace` that defines a trace exporter that uses a `otlptrace.Client` to send data.
+  Creates package `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` implementing a gRPC `otlptrace.Client` and offers convenience functions, `NewExportPipeline` and `InstallNewPipeline`, to setup and install a `otlptrace.Exporter` in tracing .(#1922)
+- Added `Baggage`, `Member`, and `Property` types to the `go.opentelemetry.io/otel/baggage` package along with their related functions. (#1967)
+- Added `ContextWithBaggage`, `ContextWithoutBaggage`, and `FromContext` functions to the `go.opentelemetry.io/otel/baggage` package.
+  These functions replace the `Set`, `Value`, `ContextWithValue`, `ContextWithoutValue`, and `ContextWithEmpty` functions from that package and directly work with the new `Baggage` type. (#1967)
+- The `OTEL_SERVICE_NAME` environment variable is the preferred source for `service.name`, used by the environment resource detector if a service name is present both there and in `OTEL_RESOURCE_ATTRIBUTES`. (#1969)
+- Creates package `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` implementing an HTTP `otlptrace.Client` and offers convenience functions, `NewExportPipeline` and `InstallNewPipeline`, to setup and install a `otlptrace.Exporter` in tracing. (#1963)
+- Changes `go.opentelemetry.io/otel/sdk/resource.NewWithAttributes` to require a schema URL. The old function is still available as `resource.NewSchemaless`. This is a breaking change. (#1938)
+- Several builtin resource detectors now correctly populate the schema URL. (#1938)
+- Creates package `go.opentelemetry.io/otel/exporters/otlp/otlpmetric` that defines a metrics exporter that uses a `otlpmetric.Client` to send data.
+- Creates package `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` implementing a gRPC `otlpmetric.Client` and offers convenience functions, `New` and `NewUnstarted`, to create an `otlpmetric.Exporter`.(#1991)
+- Added `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` exporter. (#2005)
+- Added `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric` exporter. (#2005)
+- Added a `TracerProvider()` method to the `"go.opentelemetry.io/otel/trace".Span` interface. This can be used to obtain a `TracerProvider` from a given span that utilizes the same trace processing pipeline.  (#2009)
+
+### Changed
+
+- Make `NewSplitDriver` from `go.opentelemetry.io/otel/exporters/otlp` take variadic arguments instead of a `SplitConfig` item.
+  `NewSplitDriver` now automatically implements an internal `noopDriver` for `SplitConfig` fields that are not initialized. (#1798)
+- `resource.New()` now creates a Resource without builtin detectors. Previous behavior is now achieved by using `WithBuiltinDetectors` Option. (#1810)
+- Move the `Event` type from the `go.opentelemetry.io/otel` package to the `go.opentelemetry.io/otel/sdk/trace` package. (#1846)
+- CI builds validate against last two versions of Go, dropping 1.14 and adding 1.16. (#1865)
+- BatchSpanProcessor now report export failures when calling `ForceFlush()` method. (#1860)
+- `Set.Encoded(Encoder)` no longer caches the result of an encoding. (#1855)
+- Renamed `CloudZoneKey` to `CloudAvailabilityZoneKey` in Resource semantic conventions according to spec. (#1871)
+- The `StatusCode` and `StatusMessage` methods of the `ReadOnlySpan` interface and the `Span` produced by the `go.opentelemetry.io/otel/sdk/trace` package have been replaced with a single `Status` method.
+  This method returns the status of a span using the new `Status` type. (#1874)
+- Updated `ExportSpans` method of the`SpanExporter` interface type to accept `ReadOnlySpan`s instead of the removed `SpanSnapshot`.
+  This brings the export interface into compliance with the specification in that it now accepts an explicitly immutable type instead of just an implied one. (#1873)
+- Unembed `SpanContext` in `Link`. (#1877)
+- Generate Semantic conventions from the specification YAML. (#1891)
+- Spans created by the global `Tracer` obtained from `go.opentelemetry.io/otel`, prior to a functioning `TracerProvider` being set, now propagate the span context from their parent if one exists. (#1901)
+- The `"go.opentelemetry.io/otel".Tracer` function now accepts tracer options. (#1902)
+- Move the `go.opentelemetry.io/otel/unit` package to `go.opentelemetry.io/otel/metric/unit`. (#1903)
+- Changed `go.opentelemetry.io/otel/trace.TracerConfig` to conform to the [Contributing guidelines](CONTRIBUTING.md#config.) (#1921)
+- Changed `go.opentelemetry.io/otel/trace.SpanConfig` to conform to the [Contributing guidelines](CONTRIBUTING.md#config). (#1921)
+- Changed `span.End()` now only accepts Options that are allowed at `End()`. (#1921)
+- Changed `go.opentelemetry.io/otel/metric.InstrumentConfig` to conform to the [Contributing guidelines](CONTRIBUTING.md#config). (#1921)
+- Changed `go.opentelemetry.io/otel/metric.MeterConfig` to conform to the [Contributing guidelines](CONTRIBUTING.md#config). (#1921)
+- Refactored option types according to the contribution style guide. (#1882)
+- Move the `go.opentelemetry.io/otel/trace.TraceStateFromKeyValues` function to the `go.opentelemetry.io/otel/oteltest` package.
+  This function is preserved for testing purposes where it may be useful to create a `TraceState` from `attribute.KeyValue`s, but it is not intended for production use.
+  The new `ParseTraceState` function should be used to create a `TraceState`. (#1931)
+- Updated `MarshalJSON` method of the `go.opentelemetry.io/otel/trace.TraceState` type to marshal the type into the string representation of the `TraceState`. (#1931)
+- The `TraceState.Delete` method from the `go.opentelemetry.io/otel/trace` package no longer returns an error in addition to a `TraceState`. (#1931)
+- Updated `Get` method of the `TraceState` type from the `go.opentelemetry.io/otel/trace` package to accept a `string` instead of an `attribute.Key` type. (#1931)
+- Updated `Insert` method of the `TraceState` type from the `go.opentelemetry.io/otel/trace` package to accept a pair of `string`s instead of an `attribute.KeyValue` type. (#1931)
+- Updated `Delete` method of the `TraceState` type from the `go.opentelemetry.io/otel/trace` package to accept a `string` instead of an `attribute.Key` type. (#1931)
+- Renamed `NewExporter` to `New` in the `go.opentelemetry.io/otel/exporters/stdout` package. (#1985)
+- Renamed `NewExporter` to `New` in the `go.opentelemetry.io/otel/exporters/metric/prometheus` package. (#1985)
+- Renamed `NewExporter` to `New` in the `go.opentelemetry.io/otel/exporters/trace/jaeger` package. (#1985)
+- Renamed `NewExporter` to `New` in the `go.opentelemetry.io/otel/exporters/trace/zipkin` package. (#1985)
+- Renamed `NewExporter` to `New` in the `go.opentelemetry.io/otel/exporters/otlp` package. (#1985)
+- Renamed `NewUnstartedExporter` to `NewUnstarted` in the `go.opentelemetry.io/otel/exporters/otlp` package. (#1985)
+- The `go.opentelemetry.io/otel/semconv` package has been moved to `go.opentelemetry.io/otel/semconv/v1.4.0` to allow for multiple [telemetry schema](https://github.com/open-telemetry/oteps/blob/main/text/0152-telemetry-schemas.md) versions to be used concurrently. (#1987)
+- Metrics test helpers in `go.opentelemetry.io/otel/oteltest` have been moved to `go.opentelemetry.io/otel/metric/metrictest`. (#1988)
+
+### Deprecated
+
+- The `go.opentelemetry.io/otel/exporters/metric/prometheus` is deprecated, use `go.opentelemetry.io/otel/exporters/prometheus` instead. (#1993)
+- The `go.opentelemetry.io/otel/exporters/trace/jaeger` is deprecated, use `go.opentelemetry.io/otel/exporters/jaeger` instead. (#1993)
+- The `go.opentelemetry.io/otel/exporters/trace/zipkin` is deprecated, use `go.opentelemetry.io/otel/exporters/zipkin` instead. (#1993)
+
+### Removed
+
+- Removed `resource.WithoutBuiltin()`. Use `resource.New()`. (#1810)
+- Unexported types `resource.FromEnv`, `resource.Host`, and `resource.TelemetrySDK`, Use the corresponding `With*()` to use individually. (#1810)
+- Removed the `Tracer` and `IsRecording` method from the `ReadOnlySpan` in the `go.opentelemetry.io/otel/sdk/trace`.
+  The `Tracer` method is not a required to be included in this interface and given the mutable nature of the tracer that is associated with a span, this method is not appropriate.
+  The `IsRecording` method returns if the span is recording or not.
+  A read-only span value does not need to know if updates to it will be recorded or not.
+  By definition, it cannot be updated so there is no point in communicating if an update is recorded. (#1873)
+- Removed the `SpanSnapshot` type from the `go.opentelemetry.io/otel/sdk/trace` package.
+  The use of this type has been replaced with the use of the explicitly immutable `ReadOnlySpan` type.
+  When a concrete representation of a read-only span is needed for testing, the newly added `SpanStub` in the `go.opentelemetry.io/otel/sdk/trace/tracetest` package should be used. (#1873)
+- Removed the `Tracer` method from the `Span` interface in the `go.opentelemetry.io/otel/trace` package.
+  Using the same tracer that created a span introduces the error where an instrumentation library's `Tracer` is used by other code instead of their own.
+  The `"go.opentelemetry.io/otel".Tracer` function or a `TracerProvider` should be used to acquire a library specific `Tracer` instead. (#1900)
+  - The `TracerProvider()` method on the `Span` interface may also be used to obtain a `TracerProvider` using the same trace processing pipeline. (#2009)
+- The `http.url` attribute generated by `HTTPClientAttributesFromHTTPRequest` will no longer include username or password information. (#1919)
+- Removed `IsEmpty` method of the `TraceState` type in the `go.opentelemetry.io/otel/trace` package in favor of using the added `TraceState.Len` method. (#1931)
+- Removed `Set`, `Value`, `ContextWithValue`, `ContextWithoutValue`, and `ContextWithEmpty` functions in the `go.opentelemetry.io/otel/baggage` package.
+  Handling of baggage is now done using the added `Baggage` type and related context functions (`ContextWithBaggage`, `ContextWithoutBaggage`, and `FromContext`) in that package. (#1967)
+- The `InstallNewPipeline` and `NewExportPipeline` creation functions in all the exporters (prometheus, otlp, stdout, jaeger, and zipkin) have been removed.
+  These functions were deemed premature attempts to provide convenience that did not achieve this aim. (#1985)
+- The `go.opentelemetry.io/otel/exporters/otlp` exporter has been removed.  Use `go.opentelemetry.io/otel/exporters/otlp/otlptrace` instead. (#1990)
+- The `go.opentelemetry.io/otel/exporters/stdout` exporter has been removed.  Use `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` or `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric` instead. (#2005)
+
+### Fixed
+
+- Only report errors from the `"go.opentelemetry.io/otel/sdk/resource".Environment` function when they are not `nil`. (#1850, #1851)
+- The `Shutdown` method of the simple `SpanProcessor` in the `go.opentelemetry.io/otel/sdk/trace` package now honors the context deadline or cancellation. (#1616, #1856)
+- BatchSpanProcessor now drops span batches that failed to be exported. (#1860)
+- Use `http://localhost:14268/api/traces` as default Jaeger collector endpoint instead of `http://localhost:14250`. (#1898)
+- Allow trailing and leading whitespace in the parsing of a `tracestate` header. (#1931)
+- Add logic to determine if the channel is closed to fix Jaeger exporter test panic with close closed channel. (#1870, #1973)
+- Avoid transport security when OTLP endpoint is a Unix socket. (#2001)
+
+### Security
+
+## [0.20.0] - 2021-04-23
+
+### Added
+
+- The OTLP exporter now has two new convenience functions, `NewExportPipeline` and `InstallNewPipeline`, setup and install the exporter in tracing and metrics pipelines. (#1373)
+- Adds semantic conventions for exceptions. (#1492)
+- Added Jaeger Environment variables: `OTEL_EXPORTER_JAEGER_AGENT_HOST`, `OTEL_EXPORTER_JAEGER_AGENT_PORT`
+  These environment variables can be used to override Jaeger agent hostname and port (#1752)
+- Option `ExportTimeout` was added to batch span processor. (#1755)
+- `trace.TraceFlags` is now a defined type over `byte` and `WithSampled(bool) TraceFlags` and `IsSampled() bool` methods have been added to it. (#1770)
+- The `Event` and `Link` struct types from the `go.opentelemetry.io/otel` package now include a `DroppedAttributeCount` field to record the number of attributes that were not recorded due to configured limits being reached. (#1771)
+- The Jaeger exporter now reports dropped attributes for a Span event in the exported log. (#1771)
+- Adds test to check BatchSpanProcessor ignores `OnEnd` and `ForceFlush` post `Shutdown`. (#1772)
+- Extract resource attributes from the `OTEL_RESOURCE_ATTRIBUTES` environment variable and merge them with the `resource.Default` resource as well as resources provided to the `TracerProvider` and metric `Controller`. (#1785)
+- Added `WithOSType` resource configuration option to set OS (Operating System) type resource attribute (`os.type`). (#1788)
+- Added `WithProcess*` resource configuration options to set Process resource attributes. (#1788)
+  - `process.pid`
+  - `process.executable.name`
+  - `process.executable.path`
+  - `process.command_args`
+  - `process.owner`
+  - `process.runtime.name`
+  - `process.runtime.version`
+  - `process.runtime.description`
+- Adds `k8s.node.name` and `k8s.node.uid` attribute keys to the `semconv` package. (#1789)
+- Added support for configuring OTLP/HTTP and OTLP/gRPC Endpoints, TLS Certificates, Headers, Compression and Timeout via Environment Variables. (#1758, #1769 and #1811)
+  - `OTEL_EXPORTER_OTLP_ENDPOINT`
+  - `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`
+  - `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`
+  - `OTEL_EXPORTER_OTLP_HEADERS`
+  - `OTEL_EXPORTER_OTLP_TRACES_HEADERS`
+  - `OTEL_EXPORTER_OTLP_METRICS_HEADERS`
+  - `OTEL_EXPORTER_OTLP_COMPRESSION`
+  - `OTEL_EXPORTER_OTLP_TRACES_COMPRESSION`
+  - `OTEL_EXPORTER_OTLP_METRICS_COMPRESSION`
+  - `OTEL_EXPORTER_OTLP_TIMEOUT`
+  - `OTEL_EXPORTER_OTLP_TRACES_TIMEOUT`
+  - `OTEL_EXPORTER_OTLP_METRICS_TIMEOUT`
+  - `OTEL_EXPORTER_OTLP_CERTIFICATE`
+  - `OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE`
+  - `OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE`
+- Adds `otlpgrpc.WithTimeout` option for configuring timeout to the otlp/gRPC exporter. (#1821)
+- Adds `jaeger.WithMaxPacketSize` option for configuring maximum UDP packet size used when connecting to the Jaeger agent. (#1853)
+
+### Fixed
+
+- The `Span.IsRecording` implementation from `go.opentelemetry.io/otel/sdk/trace` always returns false when not being sampled. (#1750)
+- The Jaeger exporter now correctly sets tags for the Span status code and message.
+  This means it uses the correct tag keys (`"otel.status_code"`, `"otel.status_description"`) and does not set the status message as a tag unless it is set on the span. (#1761)
+- The Jaeger exporter now correctly records Span event's names using the `"event"` key for a tag.
+  Additionally, this tag is overridden, as specified in the OTel specification, if the event contains an attribute with that key. (#1768)
+- Zipkin Exporter: Ensure mapping between OTel and Zipkin span data complies with the specification. (#1688)
+- Fixed typo for default service name in Jaeger Exporter. (#1797)
+- Fix flaky OTLP for the reconnnection of the client connection. (#1527, #1814)
+- Fix Jaeger exporter dropping of span batches that exceed the UDP packet size limit.
+  Instead, the exporter now splits the batch into smaller sendable batches. (#1828)
+
+### Changed
+
+- Span `RecordError` now records an `exception` event to comply with the semantic convention specification. (#1492)
+- Jaeger exporter was updated to use thrift v0.14.1. (#1712)
+- Migrate from using internally built and maintained version of the OTLP to the one hosted at `go.opentelemetry.io/proto/otlp`. (#1713)
+- Migrate from using `github.com/gogo/protobuf` to `google.golang.org/protobuf` to match `go.opentelemetry.io/proto/otlp`. (#1713)
+- The storage of a local or remote Span in a `context.Context` using its SpanContext is unified to store just the current Span.
+  The Span's SpanContext can now self-identify as being remote or not.
+  This means that `"go.opentelemetry.io/otel/trace".ContextWithRemoteSpanContext` will now overwrite any existing current Span, not just existing remote Spans, and make it the current Span in a `context.Context`. (#1731)
+- Improve OTLP/gRPC exporter connection errors. (#1737)
+- Information about a parent span context in a `"go.opentelemetry.io/otel/export/trace".SpanSnapshot` is unified in a new `Parent` field.
+  The existing `ParentSpanID` and `HasRemoteParent` fields are removed in favor of this. (#1748)
+- The `ParentContext` field of the `"go.opentelemetry.io/otel/sdk/trace".SamplingParameters` is updated to hold a `context.Context` containing the parent span.
+  This changes it to make `SamplingParameters` conform with the OpenTelemetry specification. (#1749)
+- Updated Jaeger Environment Variables: `JAEGER_ENDPOINT`, `JAEGER_USER`, `JAEGER_PASSWORD`
+  to `OTEL_EXPORTER_JAEGER_ENDPOINT`, `OTEL_EXPORTER_JAEGER_USER`, `OTEL_EXPORTER_JAEGER_PASSWORD` in compliance with OTel specification. (#1752)
+- Modify `BatchSpanProcessor.ForceFlush` to abort after timeout/cancellation. (#1757)
+- The `DroppedAttributeCount` field of the `Span` in the `go.opentelemetry.io/otel` package now only represents the number of attributes dropped for the span itself.
+  It no longer is a conglomerate of itself, events, and link attributes that have been dropped. (#1771)
+- Make `ExportSpans` in Jaeger Exporter honor context deadline. (#1773)
+- Modify Zipkin Exporter default service name, use default resource's serviceName instead of empty. (#1777)
+- The `go.opentelemetry.io/otel/sdk/export/trace` package is merged into the `go.opentelemetry.io/otel/sdk/trace` package. (#1778)
+- The prometheus.InstallNewPipeline example is moved from comment to example test (#1796)
+- The convenience functions for the stdout exporter have been updated to return the `TracerProvider` implementation and enable the shutdown of the exporter. (#1800)
+- Replace the flush function returned from the Jaeger exporter's convenience creation functions (`InstallNewPipeline` and `NewExportPipeline`) with the `TracerProvider` implementation they create.
+  This enables the caller to shutdown and flush using the related `TracerProvider` methods. (#1822)
+- Updated the Jaeger exporter to have a default endpoint, `http://localhost:14250`, for the collector. (#1824)
+- Changed the function `WithCollectorEndpoint` in the Jaeger exporter to no longer accept an endpoint as an argument.
+  The endpoint can be passed with the `CollectorEndpointOption` using the `WithEndpoint` function or by setting the `OTEL_EXPORTER_JAEGER_ENDPOINT` environment variable value appropriately. (#1824)
+- The Jaeger exporter no longer batches exported spans itself, instead it relies on the SDK's `BatchSpanProcessor` for this functionality. (#1830)
+- The Jaeger exporter creation functions (`NewRawExporter`, `NewExportPipeline`, and `InstallNewPipeline`) no longer accept the removed `Option` type as a variadic argument. (#1830)
+
+### Removed
+
+- Removed Jaeger Environment variables: `JAEGER_SERVICE_NAME`, `JAEGER_DISABLED`, `JAEGER_TAGS`
+  These environment variables will no longer be used to override values of the Jaeger exporter (#1752)
+- No longer set the links for a `Span` in `go.opentelemetry.io/otel/sdk/trace` that is configured to be a new root.
+  This is unspecified behavior that the OpenTelemetry community plans to standardize in the future.
+  To prevent backwards incompatible changes when it is specified, these links are removed. (#1726)
+- Setting error status while recording error with Span from oteltest package. (#1729)
+- The concept of a remote and local Span stored in a context is unified to just the current Span.
+  Because of this `"go.opentelemetry.io/otel/trace".RemoteSpanContextFromContext` is removed as it is no longer needed.
+  Instead, `"go.opentelemetry.io/otel/trace".SpanContextFromContex` can be used to return the current Span.
+  If needed, that Span's `SpanContext.IsRemote()` can then be used to determine if it is remote or not. (#1731)
+- The `HasRemoteParent` field of the `"go.opentelemetry.io/otel/sdk/trace".SamplingParameters` is removed.
+  This field is redundant to the information returned from the `Remote` method of the `SpanContext` held in the `ParentContext` field. (#1749)
+- The `trace.FlagsDebug` and `trace.FlagsDeferred` constants have been removed and will be localized to the B3 propagator. (#1770)
+- Remove `Process` configuration, `WithProcessFromEnv` and `ProcessFromEnv`, and type from the Jaeger exporter package.
+  The information that could be configured in the `Process` struct should be configured in a `Resource` instead. (#1776, #1804)
+- Remove the `WithDisabled` option from the Jaeger exporter.
+  To disable the exporter unregister it from the `TracerProvider` or use a no-operation `TracerProvider`. (#1806)
+- Removed the functions `CollectorEndpointFromEnv` and `WithCollectorEndpointOptionFromEnv` from the Jaeger exporter.
+  These functions for retrieving specific environment variable values are redundant of other internal functions and
+  are not intended for end user use. (#1824)
+- Removed the Jaeger exporter `WithSDKOptions` `Option`.
+  This option was used to set SDK options for the exporter creation convenience functions.
+  These functions are provided as a way to easily setup or install the exporter with what are deemed reasonable SDK settings for common use cases.
+  If the SDK needs to be configured differently, the `NewRawExporter` function and direct setup of the SDK with the desired settings should be used. (#1825)
+- The `WithBufferMaxCount` and `WithBatchMaxCount` `Option`s from the Jaeger exporter are removed.
+  The exporter no longer batches exports, instead relying on the SDK's `BatchSpanProcessor` for this functionality. (#1830)
+- The Jaeger exporter `Option` type is removed.
+  The type is no longer used by the exporter to configure anything.
+  All the previous configurations these options provided were duplicates of SDK configuration.
+  They have been removed in favor of using the SDK configuration and focuses the exporter configuration to be only about the endpoints it will send telemetry to. (#1830)
+
+## [0.19.0] - 2021-03-18
+
+### Added
+
+- Added `Marshaler` config option to `otlphttp` to enable otlp over json or protobufs. (#1586)
+- A `ForceFlush` method to the `"go.opentelemetry.io/otel/sdk/trace".TracerProvider` to flush all registered `SpanProcessor`s. (#1608)
+- Added `WithSampler` and `WithSpanLimits` to tracer provider. (#1633, #1702)
+- `"go.opentelemetry.io/otel/trace".SpanContext` now has a `remote` property, and `IsRemote()` predicate, that is true when the `SpanContext` has been extracted from remote context data. (#1701)
+- A `Valid` method to the `"go.opentelemetry.io/otel/attribute".KeyValue` type. (#1703)
+
+### Changed
+
+- `trace.SpanContext` is now immutable and has no exported fields. (#1573)
+  - `trace.NewSpanContext()` can be used in conjunction with the `trace.SpanContextConfig` struct to initialize a new `SpanContext` where all values are known.
+- Update the `ForceFlush` method signature to the `"go.opentelemetry.io/otel/sdk/trace".SpanProcessor` to accept a `context.Context` and return an error. (#1608)
+- Update the `Shutdown` method to the `"go.opentelemetry.io/otel/sdk/trace".TracerProvider` return an error on shutdown failure. (#1608)
+- The SimpleSpanProcessor will now shut down the enclosed `SpanExporter` and gracefully ignore subsequent calls to `OnEnd` after `Shutdown` is called. (#1612)
+- `"go.opentelemetry.io/sdk/metric/controller.basic".WithPusher` is replaced with `WithExporter` to provide consistent naming across project. (#1656)
+- Added non-empty string check for trace `Attribute` keys. (#1659)
+- Add `description` to SpanStatus only when `StatusCode` is set to error. (#1662)
+- Jaeger exporter falls back to `resource.Default`'s `service.name` if the exported Span does not have one. (#1673)
+- Jaeger exporter populates Jaeger's Span Process from Resource. (#1673)
+- Renamed the `LabelSet` method of `"go.opentelemetry.io/otel/sdk/resource".Resource` to `Set`. (#1692)
+- Changed `WithSDK` to `WithSDKOptions` to accept variadic arguments of `TracerProviderOption` type in `go.opentelemetry.io/otel/exporters/trace/jaeger` package. (#1693)
+- Changed `WithSDK` to `WithSDKOptions` to accept variadic arguments of `TracerProviderOption` type in `go.opentelemetry.io/otel/exporters/trace/zipkin` package. (#1693)
+
+### Removed
+
+- Removed `serviceName` parameter from Zipkin exporter and uses resource instead. (#1549)
+- Removed `WithConfig` from tracer provider to avoid overriding configuration. (#1633)
+- Removed the exported `SimpleSpanProcessor` and `BatchSpanProcessor` structs.
+   These are now returned as a SpanProcessor interface from their respective constructors. (#1638)
+- Removed `WithRecord()` from `trace.SpanOption` when creating a span. (#1660)
+- Removed setting status to `Error` while recording an error as a span event in `RecordError`. (#1663)
+- Removed `jaeger.WithProcess` configuration option. (#1673)
+- Removed `ApplyConfig` method from `"go.opentelemetry.io/otel/sdk/trace".TracerProvider` and the now unneeded `Config` struct. (#1693)
+
+### Fixed
+
+- Jaeger Exporter: Ensure mapping between OTEL and Jaeger span data complies with the specification. (#1626)
+- `SamplingResult.TraceState` is correctly propagated to a newly created span's `SpanContext`. (#1655)
+- The `otel-collector` example now correctly flushes metric events prior to shutting down the exporter. (#1678)
+- Do not set span status message in `SpanStatusFromHTTPStatusCode` if it can be inferred from `http.status_code`. (#1681)
+- Synchronization issues in global trace delegate implementation. (#1686)
+- Reduced excess memory usage by global `TracerProvider`. (#1687)
+
+## [0.18.0] - 2021-03-03
+
+### Added
+
+- Added `resource.Default()` for use with meter and tracer providers. (#1507)
+- `AttributePerEventCountLimit` and `AttributePerLinkCountLimit` for `SpanLimits`. (#1535)
+- Added `Keys()` method to `propagation.TextMapCarrier` and `propagation.HeaderCarrier` to adapt `http.Header` to this interface. (#1544)
+- Added `code` attributes to `go.opentelemetry.io/otel/semconv` package. (#1558)
+- Compatibility testing suite in the CI system for the following systems. (#1567)
+   | OS      | Go Version | Architecture |
+   | ------- | ---------- | ------------ |
+   | Ubuntu  | 1.15       | amd64        |
+   | Ubuntu  | 1.14       | amd64        |
+   | Ubuntu  | 1.15       | 386          |
+   | Ubuntu  | 1.14       | 386          |
+   | MacOS   | 1.15       | amd64        |
+   | MacOS   | 1.14       | amd64        |
+   | Windows | 1.15       | amd64        |
+   | Windows | 1.14       | amd64        |
+   | Windows | 1.15       | 386          |
+   | Windows | 1.14       | 386          |
+
+### Changed
+
+- Replaced interface `oteltest.SpanRecorder` with its existing implementation
+  `StandardSpanRecorder`. (#1542)
+- Default span limit values to 128. (#1535)
+- Rename `MaxEventsPerSpan`, `MaxAttributesPerSpan` and `MaxLinksPerSpan` to `EventCountLimit`, `AttributeCountLimit` and `LinkCountLimit`, and move these fields into `SpanLimits`. (#1535)
+- Renamed the `otel/label` package to `otel/attribute`. (#1541)
+- Vendor the Jaeger exporter's dependency on Apache Thrift. (#1551)
+- Parallelize the CI linting and testing. (#1567)
+- Stagger timestamps in exact aggregator tests. (#1569)
+- Changed all examples to use `WithBatchTimeout(5 * time.Second)` rather than `WithBatchTimeout(5)`. (#1621)
+- Prevent end-users from implementing some interfaces (#1575)
+
+  ```
+      "otel/exporters/otlp/otlphttp".Option
+      "otel/exporters/stdout".Option
+      "otel/oteltest".Option
+      "otel/trace".TracerOption
+      "otel/trace".SpanOption
+      "otel/trace".EventOption
+      "otel/trace".LifeCycleOption
+      "otel/trace".InstrumentationOption
+      "otel/sdk/resource".Option
+      "otel/sdk/trace".ParentBasedSamplerOption
+      "otel/sdk/trace".ReadOnlySpan
+      "otel/sdk/trace".ReadWriteSpan
+  ```
+
+### Removed
+
+- Removed attempt to resample spans upon changing the span name with `span.SetName()`. (#1545)
+- The `test-benchmark` is no longer a dependency of the `precommit` make target. (#1567)
+- Removed the `test-386` make target.
+   This was replaced with a full compatibility testing suite (i.e. multi OS/arch) in the CI system. (#1567)
+
+### Fixed
+
+- The sequential timing check of timestamps in the stdout exporter are now setup explicitly to be sequential (#1571). (#1572)
+- Windows build of Jaeger tests now compiles with OS specific functions (#1576). (#1577)
+- The sequential timing check of timestamps of go.opentelemetry.io/otel/sdk/metric/aggregator/lastvalue are now setup explicitly to be sequential (#1578). (#1579)
+- Validate tracestate header keys with vendors according to the W3C TraceContext specification (#1475). (#1581)
+- The OTLP exporter includes related labels for translations of a GaugeArray (#1563). (#1570)
+
+## [0.17.0] - 2021-02-12
+
+### Changed
+
+- Rename project default branch from `master` to `main`. (#1505)
+- Reverse order in which `Resource` attributes are merged, per change in spec. (#1501)
+- Add tooling to maintain "replace" directives in go.mod files automatically. (#1528)
+- Create new modules: otel/metric, otel/trace, otel/oteltest, otel/sdk/export/metric, otel/sdk/metric (#1528)
+- Move metric-related public global APIs from otel to otel/metric/global. (#1528)
+
+## Fixed
+
+- Fixed otlpgrpc reconnection issue.
+- The example code in the README.md of `go.opentelemetry.io/otel/exporters/otlp` is moved to a compiled example test and used the new `WithAddress` instead of `WithEndpoint`. (#1513)
+- The otel-collector example now uses the default OTLP receiver port of the collector.
+
+## [0.16.0] - 2021-01-13
+
+### Added
+
+- Add the `ReadOnlySpan` and `ReadWriteSpan` interfaces to provide better control for accessing span data. (#1360)
+- `NewGRPCDriver` function returns a `ProtocolDriver` that maintains a single gRPC connection to the collector. (#1369)
+- Added documentation about the project's versioning policy. (#1388)
+- Added `NewSplitDriver` for OTLP exporter that allows sending traces and metrics to different endpoints. (#1418)
+- Added codeql worfklow to GitHub Actions (#1428)
+- Added Gosec workflow to GitHub Actions (#1429)
+- Add new HTTP driver for OTLP exporter in `exporters/otlp/otlphttp`. Currently it only supports the binary protobuf payloads. (#1420)
+- Add an OpenCensus exporter bridge. (#1444)
+
+### Changed
+
+- Rename `internal/testing` to `internal/internaltest`. (#1449)
+- Rename `export.SpanData` to `export.SpanSnapshot` and use it only for exporting spans. (#1360)
+- Store the parent's full `SpanContext` rather than just its span ID in the `span` struct. (#1360)
+- Improve span duration accuracy. (#1360)
+- Migrated CI/CD from CircleCI to GitHub Actions (#1382)
+- Remove duplicate checkout from GitHub Actions workflow (#1407)
+- Metric `array` aggregator renamed `exact` to match its `aggregation.Kind` (#1412)
+- Metric `exact` aggregator includes per-point timestamps (#1412)
+- Metric stdout exporter uses MinMaxSumCount aggregator for ValueRecorder instruments (#1412)
+- `NewExporter` from `exporters/otlp` now takes a `ProtocolDriver` as a parameter. (#1369)
+- Many OTLP Exporter options became gRPC ProtocolDriver options. (#1369)
+- Unify endpoint API that related to OTel exporter. (#1401)
+- Optimize metric histogram aggregator to re-use its slice of buckets. (#1435)
+- Metric aggregator Count() and histogram Bucket.Counts are consistently `uint64`. (1430)
+- Histogram aggregator accepts functional options, uses default boundaries if none given. (#1434)
+- `SamplingResult` now passed a `Tracestate` from the parent `SpanContext` (#1432)
+- Moved gRPC driver for OTLP exporter to `exporters/otlp/otlpgrpc`. (#1420)
+- The `TraceContext` propagator now correctly propagates `TraceState` through the `SpanContext`. (#1447)
+- Metric Push and Pull Controller components are combined into a single "basic" Controller:
+  - `WithExporter()` and `Start()` to configure Push behavior
+  - `Start()` is optional; use `Collect()` and `ForEach()` for Pull behavior
+  - `Start()` and `Stop()` accept Context. (#1378)
+- The `Event` type is moved from the `otel/sdk/export/trace` package to the `otel/trace` API package. (#1452)
+
+### Removed
+
+- Remove `errUninitializedSpan` as its only usage is now obsolete. (#1360)
+- Remove Metric export functionality related to quantiles and summary data points: this is not specified (#1412)
+- Remove DDSketch metric aggregator; our intention is to re-introduce this as an option of the histogram aggregator after [new OTLP histogram data types](https://github.com/open-telemetry/opentelemetry-proto/pull/226) are released (#1412)
+
+### Fixed
+
+- `BatchSpanProcessor.Shutdown()` will now shutdown underlying `export.SpanExporter`. (#1443)
+
+## [0.15.0] - 2020-12-10
+
+### Added
+
+- The `WithIDGenerator` `TracerProviderOption` is added to the `go.opentelemetry.io/otel/trace` package to configure an `IDGenerator` for the `TracerProvider`. (#1363)
+
+### Changed
+
+- The Zipkin exporter now uses the Span status code to determine. (#1328)
+- `NewExporter` and `Start` functions in `go.opentelemetry.io/otel/exporters/otlp` now receive `context.Context` as a first parameter. (#1357)
+- Move the OpenCensus example into `example` directory. (#1359)
+- Moved the SDK's `internal.IDGenerator` interface in to the `sdk/trace` package to enable support for externally-defined ID generators. (#1363)
+- Bump `github.com/google/go-cmp` from 0.5.3 to 0.5.4 (#1374)
+- Bump `github.com/golangci/golangci-lint` in `/internal/tools` (#1375)
+
+### Fixed
+
+- Metric SDK `SumObserver` and `UpDownSumObserver` instruments correctness fixes. (#1381)
+
+## [0.14.0] - 2020-11-19
+
+### Added
+
+- An `EventOption` and the related `NewEventConfig` function are added to the `go.opentelemetry.io/otel` package to configure Span events. (#1254)
+- A `TextMapPropagator` and associated `TextMapCarrier` are added to the `go.opentelemetry.io/otel/oteltest` package to test `TextMap` type propagators and their use. (#1259)
+- `SpanContextFromContext` returns `SpanContext` from context. (#1255)
+- `TraceState` has been added to `SpanContext`. (#1340)
+- `DeploymentEnvironmentKey` added to `go.opentelemetry.io/otel/semconv` package. (#1323)
+- Add an OpenCensus to OpenTelemetry tracing bridge. (#1305)
+- Add a parent context argument to `SpanProcessor.OnStart` to follow the specification. (#1333)
+- Add missing tests for `sdk/trace/attributes_map.go`. (#1337)
+
+### Changed
+
+- Move the `go.opentelemetry.io/otel/api/trace` package into `go.opentelemetry.io/otel/trace` with the following changes. (#1229) (#1307)
+  - `ID` has been renamed to `TraceID`.
+  - `IDFromHex` has been renamed to `TraceIDFromHex`.
+  - `EmptySpanContext` is removed.
+- Move the `go.opentelemetry.io/otel/api/trace/tracetest` package into `go.opentelemetry.io/otel/oteltest`. (#1229)
+- OTLP Exporter updates:
+  - supports OTLP v0.6.0 (#1230, #1354)
+  - supports configurable aggregation temporality (default: Cumulative, optional: Stateless). (#1296)
+- The Sampler is now called on local child spans. (#1233)
+- The `Kind` type from the `go.opentelemetry.io/otel/api/metric` package was renamed to `InstrumentKind` to more specifically describe what it is and avoid semantic ambiguity. (#1240)
+- The `MetricKind` method of the `Descriptor` type in the `go.opentelemetry.io/otel/api/metric` package was renamed to `Descriptor.InstrumentKind`.
+   This matches the returned type and fixes misuse of the term metric. (#1240)
+- Move test harness from the `go.opentelemetry.io/otel/api/apitest` package into `go.opentelemetry.io/otel/oteltest`. (#1241)
+- Move the `go.opentelemetry.io/otel/api/metric/metrictest` package into `go.opentelemetry.io/oteltest` as part of #964. (#1252)
+- Move the `go.opentelemetry.io/otel/api/metric` package into `go.opentelemetry.io/otel/metric` as part of #1303. (#1321)
+- Move the `go.opentelemetry.io/otel/api/metric/registry` package into `go.opentelemetry.io/otel/metric/registry` as a part of #1303. (#1316)
+- Move the `Number` type (together with related functions) from `go.opentelemetry.io/otel/api/metric` package into `go.opentelemetry.io/otel/metric/number` as a part of #1303. (#1316)
+- The function signature of the Span `AddEvent` method in `go.opentelemetry.io/otel` is updated to no longer take an unused context and instead take a required name and a variable number of `EventOption`s. (#1254)
+- The function signature of the Span `RecordError` method in `go.opentelemetry.io/otel` is updated to no longer take an unused context and instead take a required error value and a variable number of `EventOption`s. (#1254)
+- Move the `go.opentelemetry.io/otel/api/global` package to `go.opentelemetry.io/otel`. (#1262) (#1330)
+- Move the `Version` function from `go.opentelemetry.io/otel/sdk` to `go.opentelemetry.io/otel`. (#1330)
+- Rename correlation context header from `"otcorrelations"` to `"baggage"` to match the OpenTelemetry specification. (#1267)
+- Fix `Code.UnmarshalJSON` to work with valid JSON only. (#1276)
+- The `resource.New()` method changes signature to support builtin attributes and functional options, including `telemetry.sdk.*` and
+  `host.name` semantic conventions; the former method is renamed `resource.NewWithAttributes`. (#1235)
+- The Prometheus exporter now exports non-monotonic counters (i.e. `UpDownCounter`s) as gauges. (#1210)
+- Correct the `Span.End` method documentation in the `otel` API to state updates are not allowed on a span after it has ended. (#1310)
+- Updated span collection limits for attribute, event and link counts to 1000 (#1318)
+- Renamed `semconv.HTTPUrlKey` to `semconv.HTTPURLKey`. (#1338)
+
+### Removed
+
+- The `ErrInvalidHexID`, `ErrInvalidTraceIDLength`, `ErrInvalidSpanIDLength`, `ErrInvalidSpanIDLength`, or `ErrNilSpanID` from the `go.opentelemetry.io/otel` package are unexported now. (#1243)
+- The `AddEventWithTimestamp` method on the `Span` interface in `go.opentelemetry.io/otel` is removed due to its redundancy.
+   It is replaced by using the `AddEvent` method with a `WithTimestamp` option. (#1254)
+- The `MockSpan` and `MockTracer` types are removed from `go.opentelemetry.io/otel/oteltest`.
+   `Tracer` and `Span` from the same module should be used in their place instead. (#1306)
+- `WorkerCount` option is removed from `go.opentelemetry.io/otel/exporters/otlp`. (#1350)
+- Remove the following labels types: INT32, UINT32, UINT64 and FLOAT32. (#1314)
+
+### Fixed
+
+- Rename `MergeItererator` to `MergeIterator` in the `go.opentelemetry.io/otel/label` package. (#1244)
+- The `go.opentelemetry.io/otel/api/global` packages global TextMapPropagator now delegates functionality to a globally set delegate for all previously returned propagators. (#1258)
+- Fix condition in `label.Any`. (#1299)
+- Fix global `TracerProvider` to pass options to its configured provider. (#1329)
+- Fix missing handler for `ExactKind` aggregator in OTLP metrics transformer (#1309)
+
+## [0.13.0] - 2020-10-08
+
+### Added
+
+- OTLP Metric exporter supports Histogram aggregation. (#1209)
+- The `Code` struct from the `go.opentelemetry.io/otel/codes` package now supports JSON marshaling and unmarshaling as well as implements the `Stringer` interface. (#1214)
+- A Baggage API to implement the OpenTelemetry specification. (#1217)
+- Add Shutdown method to sdk/trace/provider, shutdown processors in the order they were registered. (#1227)
+
+### Changed
+
+- Set default propagator to no-op propagator. (#1184)
+- The `HTTPSupplier`, `HTTPExtractor`, `HTTPInjector`, and `HTTPPropagator` from the `go.opentelemetry.io/otel/api/propagation` package were replaced with unified `TextMapCarrier` and `TextMapPropagator` in the `go.opentelemetry.io/otel/propagation` package. (#1212) (#1325)
+- The `New` function from the `go.opentelemetry.io/otel/api/propagation` package was replaced with `NewCompositeTextMapPropagator` in the `go.opentelemetry.io/otel` package. (#1212)
+- The status codes of the `go.opentelemetry.io/otel/codes` package have been updated to match the latest OpenTelemetry specification.
+   They now are `Unset`, `Error`, and `Ok`.
+   They no longer track the gRPC codes. (#1214)
+- The `StatusCode` field of the `SpanData` struct in the `go.opentelemetry.io/otel/sdk/export/trace` package now uses the codes package from this package instead of the gRPC project. (#1214)
+- Move the `go.opentelemetry.io/otel/api/baggage` package into `go.opentelemetry.io/otel/baggage`. (#1217) (#1325)
+- A `Shutdown` method of `SpanProcessor` and all its implementations receives a context and returns an error. (#1264)
+
+### Fixed
+
+- Copies of data from arrays and slices passed to `go.opentelemetry.io/otel/label.ArrayValue()` are now used in the returned `Value` instead of using the mutable data itself. (#1226)
+
+### Removed
+
+- The `ExtractHTTP` and `InjectHTTP` functions from the `go.opentelemetry.io/otel/api/propagation` package were removed. (#1212)
+- The `Propagators` interface from the `go.opentelemetry.io/otel/api/propagation` package was removed to conform to the OpenTelemetry specification.
+   The explicit `TextMapPropagator` type can be used in its place as this is the `Propagator` type the specification defines. (#1212)
+- The `SetAttribute` method of the `Span` from the `go.opentelemetry.io/otel/api/trace` package was removed given its redundancy with the `SetAttributes` method. (#1216)
+- The internal implementation of Baggage storage is removed in favor of using the new Baggage API functionality. (#1217)
+- Remove duplicate hostname key `HostHostNameKey` in Resource semantic conventions. (#1219)
+- Nested array/slice support has been removed. (#1226)
+
+## [0.12.0] - 2020-09-24
+
+### Added
+
+- A `SpanConfigure` function in `go.opentelemetry.io/otel/api/trace` to create a new `SpanConfig` from `SpanOption`s. (#1108)
+- In the `go.opentelemetry.io/otel/api/trace` package, `NewTracerConfig` was added to construct new `TracerConfig`s.
+   This addition was made to conform with our project option conventions. (#1155)
+- Instrumentation library information was added to the Zipkin exporter. (#1119)
+- The `SpanProcessor` interface now has a `ForceFlush()` method. (#1166)
+- More semantic conventions for k8s as resource attributes. (#1167)
+
+### Changed
+
+- Add reconnecting udp connection type to Jaeger exporter.
+   This change adds a new optional implementation of the udp conn interface used to detect changes to an agent's host dns record.
+   It then adopts the new destination address to ensure the exporter doesn't get stuck. This change was ported from jaegertracing/jaeger-client-go#520. (#1063)
+- Replace `StartOption` and `EndOption` in `go.opentelemetry.io/otel/api/trace` with `SpanOption`.
+   This change is matched by replacing the `StartConfig` and `EndConfig` with a unified `SpanConfig`. (#1108)
+- Replace the `LinkedTo` span option in `go.opentelemetry.io/otel/api/trace` with `WithLinks`.
+   This is be more consistent with our other option patterns, i.e. passing the item to be configured directly instead of its component parts, and provides a cleaner function signature. (#1108)
+- The `go.opentelemetry.io/otel/api/trace` `TracerOption` was changed to an interface to conform to project option conventions. (#1109)
+- Move the `B3` and `TraceContext` from within the `go.opentelemetry.io/otel/api/trace` package to their own `go.opentelemetry.io/otel/propagators` package.
+    This removal of the propagators is reflective of the OpenTelemetry specification for these propagators as well as cleans up the `go.opentelemetry.io/otel/api/trace` API. (#1118)
+- Rename Jaeger tags used for instrumentation library information to reflect changes in OpenTelemetry specification. (#1119)
+- Rename `ProbabilitySampler` to `TraceIDRatioBased` and change semantics to ignore parent span sampling status. (#1115)
+- Move `tools` package under `internal`. (#1141)
+- Move `go.opentelemetry.io/otel/api/correlation` package to `go.opentelemetry.io/otel/api/baggage`. (#1142)
+   The `correlation.CorrelationContext` propagator has been renamed `baggage.Baggage`.  Other exported functions and types are unchanged.
+- Rename `ParentOrElse` sampler to `ParentBased` and allow setting samplers depending on parent span. (#1153)
+- In the `go.opentelemetry.io/otel/api/trace` package, `SpanConfigure` was renamed to `NewSpanConfig`. (#1155)
+- Change `dependabot.yml` to add a `Skip Changelog` label to dependabot-sourced PRs. (#1161)
+- The [configuration style guide](https://github.com/open-telemetry/opentelemetry-go/blob/master/CONTRIBUTING.md#config) has been updated to
+   recommend the use of `newConfig()` instead of `configure()`. (#1163)
+- The `otlp.Config` type has been unexported and changed to `otlp.config`, along with its initializer. (#1163)
+- Ensure exported interface types include parameter names and update the
+   Style Guide to reflect this styling rule. (#1172)
+- Don't consider unset environment variable for resource detection to be an error. (#1170)
+- Rename `go.opentelemetry.io/otel/api/metric.ConfigureInstrument` to `NewInstrumentConfig` and
+  `go.opentelemetry.io/otel/api/metric.ConfigureMeter` to `NewMeterConfig`.
+- ValueObserver instruments use LastValue aggregator by default. (#1165)
+- OTLP Metric exporter supports LastValue aggregation. (#1165)
+- Move the `go.opentelemetry.io/otel/api/unit` package to `go.opentelemetry.io/otel/unit`. (#1185)
+- Rename `Provider` to `MeterProvider` in the `go.opentelemetry.io/otel/api/metric` package. (#1190)
+- Rename `NoopProvider` to `NoopMeterProvider` in the `go.opentelemetry.io/otel/api/metric` package. (#1190)
+- Rename `NewProvider` to `NewMeterProvider` in the `go.opentelemetry.io/otel/api/metric/metrictest` package. (#1190)
+- Rename `Provider` to `MeterProvider` in the `go.opentelemetry.io/otel/api/metric/registry` package. (#1190)
+- Rename `NewProvider` to `NewMeterProvider` in the `go.opentelemetry.io/otel/api/metri/registryc` package. (#1190)
+- Rename `Provider` to `TracerProvider` in the `go.opentelemetry.io/otel/api/trace` package. (#1190)
+- Rename `NoopProvider` to `NoopTracerProvider` in the `go.opentelemetry.io/otel/api/trace` package. (#1190)
+- Rename `Provider` to `TracerProvider` in the `go.opentelemetry.io/otel/api/trace/tracetest` package. (#1190)
+- Rename `NewProvider` to `NewTracerProvider` in the `go.opentelemetry.io/otel/api/trace/tracetest` package. (#1190)
+- Rename `WrapperProvider` to `WrapperTracerProvider` in the `go.opentelemetry.io/otel/bridge/opentracing` package. (#1190)
+- Rename `NewWrapperProvider` to `NewWrapperTracerProvider` in the `go.opentelemetry.io/otel/bridge/opentracing` package. (#1190)
+- Rename `Provider` method of the pull controller to `MeterProvider` in the `go.opentelemetry.io/otel/sdk/metric/controller/pull` package. (#1190)
+- Rename `Provider` method of the push controller to `MeterProvider` in the `go.opentelemetry.io/otel/sdk/metric/controller/push` package. (#1190)
+- Rename `ProviderOptions` to `TracerProviderConfig` in the `go.opentelemetry.io/otel/sdk/trace` package. (#1190)
+- Rename `ProviderOption` to `TracerProviderOption` in the `go.opentelemetry.io/otel/sdk/trace` package. (#1190)
+- Rename `Provider` to `TracerProvider` in the `go.opentelemetry.io/otel/sdk/trace` package. (#1190)
+- Rename `NewProvider` to `NewTracerProvider` in the `go.opentelemetry.io/otel/sdk/trace` package. (#1190)
+- Renamed `SamplingDecision` values to comply with OpenTelemetry specification change. (#1192)
+- Renamed Zipkin attribute names from `ot.status_code & ot.status_description` to `otel.status_code & otel.status_description`. (#1201)
+- The default SDK now invokes registered `SpanProcessor`s in the order they were registered with the `TracerProvider`. (#1195)
+- Add test of spans being processed by the `SpanProcessor`s in the order they were registered. (#1203)
+
+### Removed
+
+- Remove the B3 propagator from `go.opentelemetry.io/otel/propagators`. It is now located in the
+   `go.opentelemetry.io/contrib/propagators/` module. (#1191)
+- Remove the semantic convention for HTTP status text, `HTTPStatusTextKey` from package `go.opentelemetry.io/otel/semconv`. (#1194)
+
+### Fixed
+
+- Zipkin example no longer mentions `ParentSampler`, corrected to `ParentBased`. (#1171)
+- Fix missing shutdown processor in otel-collector example. (#1186)
+- Fix missing shutdown processor in basic and namedtracer examples. (#1197)
+
+## [0.11.0] - 2020-08-24
+
+### Added
+
+- Support for exporting array-valued attributes via OTLP. (#992)
+- `Noop` and `InMemory` `SpanBatcher` implementations to help with testing integrations. (#994)
+- Support for filtering metric label sets. (#1047)
+- A dimensionality-reducing metric Processor. (#1057)
+- Integration tests for more OTel Collector Attribute types. (#1062)
+- A new `WithSpanProcessor` `ProviderOption` is added to the `go.opentelemetry.io/otel/sdk/trace` package to create a `Provider` and automatically register the `SpanProcessor`. (#1078)
+
+### Changed
+
+- Rename `sdk/metric/processor/test` to `sdk/metric/processor/processortest`. (#1049)
+- Rename `sdk/metric/controller/test` to `sdk/metric/controller/controllertest`. (#1049)
+- Rename `api/testharness` to `api/apitest`. (#1049)
+- Rename `api/trace/testtrace` to `api/trace/tracetest`. (#1049)
+- Change Metric Processor to merge multiple observations. (#1024)
+- The `go.opentelemetry.io/otel/bridge/opentracing` bridge package has been made into its own module.
+   This removes the package dependencies of this bridge from the rest of the OpenTelemetry based project. (#1038)
+- Renamed `go.opentelemetry.io/otel/api/standard` package to `go.opentelemetry.io/otel/semconv` to avoid the ambiguous and generic name `standard` and better describe the package as containing OpenTelemetry semantic conventions. (#1016)
+- The environment variable used for resource detection has been changed from `OTEL_RESOURCE_LABELS` to `OTEL_RESOURCE_ATTRIBUTES` (#1042)
+- Replace `WithSyncer` with `WithBatcher` in examples. (#1044)
+- Replace the `google.golang.org/grpc/codes` dependency in the API with an equivalent `go.opentelemetry.io/otel/codes` package. (#1046)
+- Merge the `go.opentelemetry.io/otel/api/label` and `go.opentelemetry.io/otel/api/kv` into the new `go.opentelemetry.io/otel/label` package. (#1060)
+- Unify Callback Function Naming.
+   Rename `*Callback` with `*Func`. (#1061)
+- CI builds validate against last two versions of Go, dropping 1.13 and adding 1.15. (#1064)
+- The `go.opentelemetry.io/otel/sdk/export/trace` interfaces `SpanSyncer` and `SpanBatcher` have been replaced with a specification compliant `Exporter` interface.
+   This interface still supports the export of `SpanData`, but only as a slice.
+   Implementation are also required now to return any error from `ExportSpans` if one occurs as well as implement a `Shutdown` method for exporter clean-up. (#1078)
+- The `go.opentelemetry.io/otel/sdk/trace` `NewBatchSpanProcessor` function no longer returns an error.
+   If a `nil` exporter is passed as an argument to this function, instead of it returning an error, it now returns a `BatchSpanProcessor` that handles the export of `SpanData` by not taking any action. (#1078)
+- The `go.opentelemetry.io/otel/sdk/trace` `NewProvider` function to create a `Provider` no longer returns an error, instead only a `*Provider`.
+   This change is related to `NewBatchSpanProcessor` not returning an error which was the only error this function would return. (#1078)
+
+### Removed
+
+- Duplicate, unused API sampler interface. (#999)
+   Use the [`Sampler` interface](https://github.com/open-telemetry/opentelemetry-go/blob/v0.11.0/sdk/trace/sampling.go) provided by the SDK instead.
+- The `grpctrace` instrumentation was moved to the `go.opentelemetry.io/contrib` repository and out of this repository.
+   This move includes moving the `grpc` example to the `go.opentelemetry.io/contrib` as well. (#1027)
+- The `WithSpan` method of the `Tracer` interface.
+   The functionality this method provided was limited compared to what a user can provide themselves.
+   It was removed with the understanding that if there is sufficient user need it can be added back based on actual user usage. (#1043)
+- The `RegisterSpanProcessor` and `UnregisterSpanProcessor` functions.
+   These were holdovers from an approach prior to the TracerProvider design. They were not used anymore. (#1077)
+- The `oterror` package. (#1026)
+- The `othttp` and `httptrace` instrumentations were moved to `go.opentelemetry.io/contrib`. (#1032)
+
+### Fixed
+
+- The `semconv.HTTPServerMetricAttributesFromHTTPRequest()` function no longer generates the high-cardinality `http.request.content.length` label. (#1031)
+- Correct instrumentation version tag in Jaeger exporter. (#1037)
+- The SDK span will now set an error event if the `End` method is called during a panic (i.e. it was deferred). (#1043)
+- Move internally generated protobuf code from the `go.opentelemetry.io/otel` to the OTLP exporter to reduce dependency overhead. (#1050)
+- The `otel-collector` example referenced outdated collector processors. (#1006)
+
+## [0.10.0] - 2020-07-29
+
+This release migrates the default OpenTelemetry SDK into its own Go module, decoupling the SDK from the API and reducing dependencies for instrumentation packages.
+
+### Added
+
+- The Zipkin exporter now has `NewExportPipeline` and `InstallNewPipeline` constructor functions to match the common pattern.
+    These function build a new exporter with default SDK options and register the exporter with the `global` package respectively. (#944)
+- Add propagator option for gRPC instrumentation. (#986)
+- The `testtrace` package now tracks the `trace.SpanKind` for each span. (#987)
+
+### Changed
+
+- Replace the `RegisterGlobal` `Option` in the Jaeger exporter with an `InstallNewPipeline` constructor function.
+   This matches the other exporter constructor patterns and will register a new exporter after building it with default configuration. (#944)
+- The trace (`go.opentelemetry.io/otel/exporters/trace/stdout`) and metric (`go.opentelemetry.io/otel/exporters/metric/stdout`) `stdout` exporters are now merged into a single exporter at `go.opentelemetry.io/otel/exporters/stdout`.
+   This new exporter was made into its own Go module to follow the pattern of all exporters and decouple it from the `go.opentelemetry.io/otel` module. (#956, #963)
+- Move the `go.opentelemetry.io/otel/exporters/test` test package to `go.opentelemetry.io/otel/sdk/export/metric/metrictest`. (#962)
+- The `go.opentelemetry.io/otel/api/kv/value` package was merged into the parent `go.opentelemetry.io/otel/api/kv` package. (#968)
+  - `value.Bool` was replaced with `kv.BoolValue`.
+  - `value.Int64` was replaced with `kv.Int64Value`.
+  - `value.Uint64` was replaced with `kv.Uint64Value`.
+  - `value.Float64` was replaced with `kv.Float64Value`.
+  - `value.Int32` was replaced with `kv.Int32Value`.
+  - `value.Uint32` was replaced with `kv.Uint32Value`.
+  - `value.Float32` was replaced with `kv.Float32Value`.
+  - `value.String` was replaced with `kv.StringValue`.
+  - `value.Int` was replaced with `kv.IntValue`.
+  - `value.Uint` was replaced with `kv.UintValue`.
+  - `value.Array` was replaced with `kv.ArrayValue`.
+- Rename `Infer` to `Any` in the `go.opentelemetry.io/otel/api/kv` package. (#972)
+- Change `othttp` to use the `httpsnoop` package to wrap the `ResponseWriter` so that optional interfaces (`http.Hijacker`, `http.Flusher`, etc.) that are implemented by the original `ResponseWriter`are also implemented by the wrapped `ResponseWriter`. (#979)
+- Rename `go.opentelemetry.io/otel/sdk/metric/aggregator/test` package to `go.opentelemetry.io/otel/sdk/metric/aggregator/aggregatortest`. (#980)
+- Make the SDK into its own Go module called `go.opentelemetry.io/otel/sdk`. (#985)
+- Changed the default trace `Sampler` from `AlwaysOn` to `ParentOrElse(AlwaysOn)`. (#989)
+
+### Removed
+
+- The `IndexedAttribute` function from the `go.opentelemetry.io/otel/api/label` package was removed in favor of `IndexedLabel` which it was synonymous with. (#970)
+
+### Fixed
+
+- Bump github.com/golangci/golangci-lint from 1.28.3 to 1.29.0 in /tools. (#953)
+- Bump github.com/google/go-cmp from 0.5.0 to 0.5.1. (#957)
+- Use `global.Handle` for span export errors in the OTLP exporter. (#946)
+- Correct Go language formatting in the README documentation. (#961)
+- Remove default SDK dependencies from the `go.opentelemetry.io/otel/api` package. (#977)
+- Remove default SDK dependencies from the `go.opentelemetry.io/otel/instrumentation` package. (#983)
+- Move documented examples for `go.opentelemetry.io/otel/instrumentation/grpctrace` interceptors into Go example tests. (#984)
+
+## [0.9.0] - 2020-07-20
+
+### Added
+
+- A new Resource Detector interface is included to allow resources to be automatically detected and included. (#939)
+- A Detector to automatically detect resources from an environment variable. (#939)
+- Github action to generate protobuf Go bindings locally in `internal/opentelemetry-proto-gen`. (#938)
+- OTLP .proto files from `open-telemetry/opentelemetry-proto` imported as a git submodule under `internal/opentelemetry-proto`.
+   References to `github.com/open-telemetry/opentelemetry-proto` changed to `go.opentelemetry.io/otel/internal/opentelemetry-proto-gen`. (#942)
+
+### Changed
+
+- Non-nil value `struct`s for key-value pairs will be marshalled using JSON rather than `Sprintf`. (#948)
+
+### Removed
+
+- Removed dependency on `github.com/open-telemetry/opentelemetry-collector`. (#943)
+
+## [0.8.0] - 2020-07-09
+
+### Added
+
+- The `B3Encoding` type to represent the B3 encoding(s) the B3 propagator can inject.
+   A value for HTTP supported encodings (Multiple Header: `MultipleHeader`, Single Header: `SingleHeader`) are included. (#882)
+- The `FlagsDeferred` trace flag to indicate if the trace sampling decision has been deferred. (#882)
+- The `FlagsDebug` trace flag to indicate if the trace is a debug trace. (#882)
+- Add `peer.service` semantic attribute. (#898)
+- Add database-specific semantic attributes. (#899)
+- Add semantic convention for `faas.coldstart` and `container.id`. (#909)
+- Add http content size semantic conventions. (#905)
+- Include `http.request_content_length` in HTTP request basic attributes. (#905)
+- Add semantic conventions for operating system process resource attribute keys. (#919)
+- The Jaeger exporter now has a `WithBatchMaxCount` option to specify the maximum number of spans sent in a batch. (#931)
+
+### Changed
+
+- Update `CONTRIBUTING.md` to ask for updates to `CHANGELOG.md` with each pull request. (#879)
+- Use lowercase header names for B3 Multiple Headers. (#881)
+- The B3 propagator `SingleHeader` field has been replaced with `InjectEncoding`.
+   This new field can be set to combinations of the `B3Encoding` bitmasks and will inject trace information in these encodings.
+   If no encoding is set, the propagator will default to `MultipleHeader` encoding. (#882)
+- The B3 propagator now extracts from either HTTP encoding of B3 (Single Header or Multiple Header) based on what is contained in the header.
+   Preference is given to Single Header encoding with Multiple Header being the fallback if Single Header is not found or is invalid.
+   This behavior change is made to dynamically support all correctly encoded traces received instead of having to guess the expected encoding prior to receiving. (#882)
+- Extend semantic conventions for RPC. (#900)
+- To match constant naming conventions in the `api/standard` package, the `FaaS*` key names are appended with a suffix of `Key`. (#920)
+  - `"api/standard".FaaSName` -> `FaaSNameKey`
+  - `"api/standard".FaaSID` -> `FaaSIDKey`
+  - `"api/standard".FaaSVersion` -> `FaaSVersionKey`
+  - `"api/standard".FaaSInstance` -> `FaaSInstanceKey`
+
+### Removed
+
+- The `FlagsUnused` trace flag is removed.
+   The purpose of this flag was to act as the inverse of `FlagsSampled`, the inverse of `FlagsSampled` is used instead. (#882)
+- The B3 header constants (`B3SingleHeader`, `B3DebugFlagHeader`, `B3TraceIDHeader`, `B3SpanIDHeader`, `B3SampledHeader`, `B3ParentSpanIDHeader`) are removed.
+   If B3 header keys are needed [the authoritative OpenZipkin package constants](https://pkg.go.dev/github.com/openzipkin/zipkin-go@v0.2.2/propagation/b3?tab=doc#pkg-constants) should be used instead. (#882)
+
+### Fixed
+
+- The B3 Single Header name is now correctly `b3` instead of the previous `X-B3`. (#881)
+- The B3 propagator now correctly supports sampling only values (`b3: 0`, `b3: 1`, or `b3: d`) for a Single B3 Header. (#882)
+- The B3 propagator now propagates the debug flag.
+   This removes the behavior of changing the debug flag into a set sampling bit.
+   Instead, this now follow the B3 specification and omits the `X-B3-Sampling` header. (#882)
+- The B3 propagator now tracks "unset" sampling state (meaning "defer the decision") and does not set the `X-B3-Sampling` header when injecting. (#882)
+- Bump github.com/itchyny/gojq from 0.10.3 to 0.10.4 in /tools. (#883)
+- Bump github.com/opentracing/opentracing-go from v1.1.1-0.20190913142402-a7454ce5950e to v1.2.0. (#885)
+- The tracing time conversion for OTLP spans is now correctly set to `UnixNano`. (#896)
+- Ensure span status is not set to `Unknown` when no HTTP status code is provided as it is assumed to be `200 OK`. (#908)
+- Ensure `httptrace.clientTracer` closes `http.headers` span. (#912)
+- Prometheus exporter will not apply stale updates or forget inactive metrics. (#903)
+- Add test for api.standard `HTTPClientAttributesFromHTTPRequest`. (#905)
+- Bump github.com/golangci/golangci-lint from 1.27.0 to 1.28.1 in /tools. (#901, #913)
+- Update otel-colector example to use the v0.5.0 collector. (#915)
+- The `grpctrace` instrumentation uses a span name conforming to the OpenTelemetry semantic conventions (does not contain a leading slash (`/`)). (#922)
+- The `grpctrace` instrumentation includes an `rpc.method` attribute now set to the gRPC method name. (#900, #922)
+- The `grpctrace` instrumentation `rpc.service` attribute now contains the package name if one exists.
+   This is in accordance with OpenTelemetry semantic conventions. (#922)
+- Correlation Context extractor will no longer insert an empty map into the returned context when no valid values are extracted. (#923)
+- Bump google.golang.org/api from 0.28.0 to 0.29.0 in /exporters/trace/jaeger. (#925)
+- Bump github.com/itchyny/gojq from 0.10.4 to 0.11.0 in /tools. (#926)
+- Bump github.com/golangci/golangci-lint from 1.28.1 to 1.28.2 in /tools. (#930)
+
+## [0.7.0] - 2020-06-26
+
+This release implements the v0.5.0 version of the OpenTelemetry specification.
+
+### Added
+
+- The othttp instrumentation now includes default metrics. (#861)
+- This CHANGELOG file to track all changes in the project going forward.
+- Support for array type attributes. (#798)
+- Apply transitive dependabot go.mod dependency updates as part of a new automatic Github workflow. (#844)
+- Timestamps are now passed to exporters for each export. (#835)
+- Add new `Accumulation` type to metric SDK to transport telemetry from `Accumulator`s to `Processor`s.
+   This replaces the prior `Record` `struct` use for this purpose. (#835)
+- New dependabot integration to automate package upgrades. (#814)
+- `Meter` and `Tracer` implementations accept instrumentation version version as an optional argument.
+   This instrumentation version is passed on to exporters. (#811) (#805) (#802)
+- The OTLP exporter includes the instrumentation version in telemetry it exports. (#811)
+- Environment variables for Jaeger exporter are supported. (#796)
+- New `aggregation.Kind` in the export metric API. (#808)
+- New example that uses OTLP and the collector. (#790)
+- Handle errors in the span `SetName` during span initialization. (#791)
+- Default service config to enable retries for retry-able failed requests in the OTLP exporter and an option to override this default. (#777)
+- New `go.opentelemetry.io/otel/api/oterror` package to uniformly support error handling and definitions for the project. (#778)
+- New `global` default implementation of the `go.opentelemetry.io/otel/api/oterror.Handler` interface to be used to handle errors prior to an user defined `Handler`.
+   There is also functionality for the user to register their `Handler` as well as a convenience function `Handle` to handle an error with this global `Handler`(#778)
+- Options to specify propagators for httptrace and grpctrace instrumentation. (#784)
+- The required `application/json` header for the Zipkin exporter is included in all exports. (#774)
+- Integrate HTTP semantics helpers from the contrib repository into the `api/standard` package. #769
+
+### Changed
+
+- Rename `Integrator` to `Processor` in the metric SDK. (#863)
+- Rename `AggregationSelector` to `AggregatorSelector`. (#859)
+- Rename `SynchronizedCopy` to `SynchronizedMove`. (#858)
+- Rename `simple` integrator to `basic` integrator. (#857)
+- Merge otlp collector examples. (#841)
+- Change the metric SDK to support cumulative, delta, and pass-through exporters directly.
+   With these changes, cumulative and delta specific exporters are able to request the correct kind of aggregation from the SDK. (#840)
+- The `Aggregator.Checkpoint` API is renamed to `SynchronizedCopy` and adds an argument, a different `Aggregator` into which the copy is stored. (#812)
+- The `export.Aggregator` contract is that `Update()` and `SynchronizedCopy()` are synchronized with each other.
+   All the aggregation interfaces (`Sum`, `LastValue`, ...) are not meant to be synchronized, as the caller is expected to synchronize aggregators at a higher level after the `Accumulator`.
+   Some of the `Aggregators` used unnecessary locking and that has been cleaned up. (#812)
+- Use of `metric.Number` was replaced by `int64` now that we use `sync.Mutex` in the `MinMaxSumCount` and `Histogram` `Aggregators`. (#812)
+- Replace `AlwaysParentSample` with `ParentSample(fallback)` to match the OpenTelemetry v0.5.0 specification. (#810)
+- Rename `sdk/export/metric/aggregator` to `sdk/export/metric/aggregation`. #808
+- Send configured headers with every request in the OTLP exporter, instead of just on connection creation. (#806)
+- Update error handling for any one off error handlers, replacing, instead, with the `global.Handle` function. (#791)
+- Rename `plugin` directory to `instrumentation` to match the OpenTelemetry specification. (#779)
+- Makes the argument order to Histogram and DDSketch `New()` consistent. (#781)
+
+### Removed
+
+- `Uint64NumberKind` and related functions from the API. (#864)
+- Context arguments from `Aggregator.Checkpoint` and `Integrator.Process` as they were unused. (#803)
+- `SpanID` is no longer included in parameters for sampling decision to match the OpenTelemetry specification. (#775)
+
+### Fixed
+
+- Upgrade OTLP exporter to opentelemetry-proto matching the opentelemetry-collector v0.4.0 release. (#866)
+- Allow changes to `go.sum` and `go.mod` when running dependabot tidy-up. (#871)
+- Bump github.com/stretchr/testify from 1.4.0 to 1.6.1. (#824)
+- Bump github.com/prometheus/client_golang from 1.7.0 to 1.7.1 in /exporters/metric/prometheus. (#867)
+- Bump google.golang.org/grpc from 1.29.1 to 1.30.0 in /exporters/trace/jaeger. (#853)
+- Bump google.golang.org/grpc from 1.29.1 to 1.30.0 in /exporters/trace/zipkin. (#854)
+- Bumps github.com/golang/protobuf from 1.3.2 to 1.4.2 (#848)
+- Bump github.com/stretchr/testify from 1.4.0 to 1.6.1 in /exporters/otlp (#817)
+- Bump github.com/golangci/golangci-lint from 1.25.1 to 1.27.0 in /tools (#828)
+- Bump github.com/prometheus/client_golang from 1.5.0 to 1.7.0 in /exporters/metric/prometheus (#838)
+- Bump github.com/stretchr/testify from 1.4.0 to 1.6.1 in /exporters/trace/jaeger (#829)
+- Bump github.com/benbjohnson/clock from 1.0.0 to 1.0.3 (#815)
+- Bump github.com/stretchr/testify from 1.4.0 to 1.6.1 in /exporters/trace/zipkin (#823)
+- Bump github.com/itchyny/gojq from 0.10.1 to 0.10.3 in /tools (#830)
+- Bump github.com/stretchr/testify from 1.4.0 to 1.6.1 in /exporters/metric/prometheus (#822)
+- Bump google.golang.org/grpc from 1.27.1 to 1.29.1 in /exporters/trace/zipkin (#820)
+- Bump google.golang.org/grpc from 1.27.1 to 1.29.1 in /exporters/trace/jaeger (#831)
+- Bump github.com/google/go-cmp from 0.4.0 to 0.5.0 (#836)
+- Bump github.com/google/go-cmp from 0.4.0 to 0.5.0 in /exporters/trace/jaeger (#837)
+- Bump github.com/google/go-cmp from 0.4.0 to 0.5.0 in /exporters/otlp (#839)
+- Bump google.golang.org/api from 0.20.0 to 0.28.0 in /exporters/trace/jaeger (#843)
+- Set span status from HTTP status code in the othttp instrumentation. (#832)
+- Fixed typo in push controller comment. (#834)
+- The `Aggregator` testing has been updated and cleaned. (#812)
+- `metric.Number(0)` expressions are replaced by `0` where possible. (#812)
+- Fixed `global` `handler_test.go` test failure. #804
+- Fixed `BatchSpanProcessor.Shutdown` to wait until all spans are processed. (#766)
+- Fixed OTLP example's accidental early close of exporter. (#807)
+- Ensure zipkin exporter reads and closes response body. (#788)
+- Update instrumentation to use `api/standard` keys instead of custom keys. (#782)
+- Clean up tools and RELEASING documentation. (#762)
+
+## [0.6.0] - 2020-05-21
+
+### Added
+
+- Support for `Resource`s in the prometheus exporter. (#757)
+- New pull controller. (#751)
+- New `UpDownSumObserver` instrument. (#750)
+- OpenTelemetry collector demo. (#711)
+- New `SumObserver` instrument. (#747)
+- New `UpDownCounter` instrument. (#745)
+- New timeout `Option` and configuration function `WithTimeout` to the push controller. (#742)
+- New `api/standards` package to implement semantic conventions and standard key-value generation. (#731)
+
+### Changed
+
+- Rename `Register*` functions in the metric API to `New*` for all `Observer` instruments. (#761)
+- Use `[]float64` for histogram boundaries, not `[]metric.Number`. (#758)
+- Change OTLP example to use exporter as a trace `Syncer` instead of as an unneeded `Batcher`. (#756)
+- Replace `WithResourceAttributes()` with `WithResource()` in the trace SDK. (#754)
+- The prometheus exporter now uses the new pull controller. (#751)
+- Rename `ScheduleDelayMillis` to `BatchTimeout` in the trace `BatchSpanProcessor`.(#752)
+- Support use of synchronous instruments in asynchronous callbacks (#725)
+- Move `Resource` from the `Export` method parameter into the metric export `Record`. (#739)
+- Rename `Observer` instrument to `ValueObserver`. (#734)
+- The push controller now has a method (`Provider()`) to return a `metric.Provider` instead of the old `Meter` method that acted as a `metric.Provider`. (#738)
+- Replace `Measure` instrument by `ValueRecorder` instrument. (#732)
+- Rename correlation context header from `"Correlation-Context"` to `"otcorrelations"` to match the OpenTelemetry specification. (#727)
+
+### Fixed
+
+- Ensure gRPC `ClientStream` override methods do not panic in grpctrace package. (#755)
+- Disable parts of `BatchSpanProcessor` test until a fix is found. (#743)
+- Fix `string` case in `kv` `Infer` function. (#746)
+- Fix panic in grpctrace client interceptors. (#740)
+- Refactor the `api/metrics` push controller and add `CheckpointSet` synchronization. (#737)
+- Rewrite span batch process queue batching logic. (#719)
+- Remove the push controller named Meter map. (#738)
+- Fix Histogram aggregator initial state (fix #735). (#736)
+- Ensure golang alpine image is running `golang-1.14` for examples. (#733)
+- Added test for grpctrace `UnaryInterceptorClient`. (#695)
+- Rearrange `api/metric` code layout. (#724)
+
+## [0.5.0] - 2020-05-13
+
+### Added
+
+- Batch `Observer` callback support. (#717)
+- Alias `api` types to root package of project. (#696)
+- Create basic `othttp.Transport` for simple client instrumentation. (#678)
+- `SetAttribute(string, interface{})` to the trace API. (#674)
+- Jaeger exporter option that allows user to specify custom http client. (#671)
+- `Stringer` and `Infer` methods to `key`s. (#662)
+
+### Changed
+
+- Rename `NewKey` in the `kv` package to just `Key`. (#721)
+- Move `core` and `key` to `kv` package. (#720)
+- Make the metric API `Meter` a `struct` so the abstract `MeterImpl` can be passed and simplify implementation. (#709)
+- Rename SDK `Batcher` to `Integrator` to match draft OpenTelemetry SDK specification. (#710)
+- Rename SDK `Ungrouped` integrator to `simple.Integrator` to match draft OpenTelemetry SDK specification. (#710)
+- Rename SDK `SDK` `struct` to `Accumulator` to match draft OpenTelemetry SDK specification. (#710)
+- Move `Number` from `core` to `api/metric` package. (#706)
+- Move `SpanContext` from `core` to `trace` package. (#692)
+- Change traceparent header from `Traceparent` to `traceparent` to implement the W3C specification. (#681)
+
+### Fixed
+
+- Update tooling to run generators in all submodules. (#705)
+- gRPC interceptor regexp to match methods without a service name. (#683)
+- Use a `const` for padding 64-bit B3 trace IDs. (#701)
+- Update `mockZipkin` listen address from `:0` to `127.0.0.1:0`. (#700)
+- Left-pad 64-bit B3 trace IDs with zero. (#698)
+- Propagate at least the first W3C tracestate header. (#694)
+- Remove internal `StateLocker` implementation. (#688)
+- Increase instance size CI system uses. (#690)
+- Add a `key` benchmark and use reflection in `key.Infer()`. (#679)
+- Fix internal `global` test by using `global.Meter` with `RecordBatch()`. (#680)
+- Reimplement histogram using mutex instead of `StateLocker`. (#669)
+- Switch `MinMaxSumCount` to a mutex lock implementation instead of `StateLocker`. (#667)
+- Update documentation to not include any references to `WithKeys`. (#672)
+- Correct misspelling. (#668)
+- Fix clobbering of the span context if extraction fails. (#656)
+- Bump `golangci-lint` and work around the corrupting bug. (#666) (#670)
+
+## [0.4.3] - 2020-04-24
+
+### Added
+
+- `Dockerfile` and `docker-compose.yml` to run example code. (#635)
+- New `grpctrace` package that provides gRPC client and server interceptors for both unary and stream connections. (#621)
+- New `api/label` package, providing common label set implementation. (#651)
+- Support for JSON marshaling of `Resources`. (#654)
+- `TraceID` and `SpanID` implementations for `Stringer` interface. (#642)
+- `RemoteAddrKey` in the othttp plugin to include the HTTP client address in top-level spans. (#627)
+- `WithSpanFormatter` option to the othttp plugin. (#617)
+- Updated README to include section for compatible libraries and include reference to the contrib repository. (#612)
+- The prometheus exporter now supports exporting histograms. (#601)
+- A `String` method to the `Resource` to return a hashable identifier for a now unique resource. (#613)
+- An `Iter` method to the `Resource` to return an array `AttributeIterator`. (#613)
+- An `Equal` method to the `Resource` test the equivalence of resources. (#613)
+- An iterable structure (`AttributeIterator`) for `Resource` attributes.
+
+### Changed
+
+- zipkin export's `NewExporter` now requires a `serviceName` argument to ensure this needed values is provided. (#644)
+- Pass `Resources` through the metrics export pipeline. (#659)
+
+### Removed
+
+- `WithKeys` option from the metric API. (#639)
+
+### Fixed
+
+- Use the `label.Set.Equivalent` value instead of an encoding in the batcher. (#658)
+- Correct typo `trace.Exporter` to `trace.SpanSyncer` in comments. (#653)
+- Use type names for return values in jaeger exporter. (#648)
+- Increase the visibility of the `api/key` package by updating comments and fixing usages locally. (#650)
+- `Checkpoint` only after `Update`; Keep records in the `sync.Map` longer. (#647)
+- Do not cache `reflect.ValueOf()` in metric Labels. (#649)
+- Batch metrics exported from the OTLP exporter based on `Resource` and labels. (#626)
+- Add error wrapping to the prometheus exporter. (#631)
+- Update the OTLP exporter batching of traces to use a unique `string` representation of an associated `Resource` as the batching key. (#623)
+- Update OTLP `SpanData` transform to only include the `ParentSpanID` if one exists. (#614)
+- Update `Resource` internal representation to uniquely and reliably identify resources. (#613)
+- Check return value from `CheckpointSet.ForEach` in prometheus exporter. (#622)
+- Ensure spans created by httptrace client tracer reflect operation structure. (#618)
+- Create a new recorder rather than reuse when multiple observations in same epoch for asynchronous instruments. #610
+- The default port the OTLP exporter uses to connect to the OpenTelemetry collector is updated to match the one the collector listens on by default. (#611)
+
+## [0.4.2] - 2020-03-31
+
+### Fixed
+
+- Fix `pre_release.sh` to update version in `sdk/opentelemetry.go`. (#607)
+- Fix time conversion from internal to OTLP in OTLP exporter. (#606)
+
+## [0.4.1] - 2020-03-31
+
+### Fixed
+
+- Update `tag.sh` to create signed tags. (#604)
+
+## [0.4.0] - 2020-03-30
+
+### Added
+
+- New API package `api/metric/registry` that exposes a `MeterImpl` wrapper for use by SDKs to generate unique instruments. (#580)
+- Script to verify examples after a new release. (#579)
+
+### Removed
+
+- The dogstatsd exporter due to lack of support.
+   This additionally removes support for statsd. (#591)
+- `LabelSet` from the metric API.
+   This is replaced by a `[]core.KeyValue` slice. (#595)
+- `Labels` from the metric API's `Meter` interface. (#595)
+
+### Changed
+
+- The metric `export.Labels` became an interface which the SDK implements and the `export` package provides a simple, immutable implementation of this interface intended for testing purposes. (#574)
+- Renamed `internal/metric.Meter` to `MeterImpl`. (#580)
+- Renamed `api/global/internal.obsImpl` to `asyncImpl`. (#580)
+
+### Fixed
+
+- Corrected missing return in mock span. (#582)
+- Update License header for all source files to match CNCF guidelines and include a test to ensure it is present. (#586) (#596)
+- Update to v0.3.0 of the OTLP in the OTLP exporter. (#588)
+- Update pre-release script to be compatible between GNU and BSD based systems. (#592)
+- Add a `RecordBatch` benchmark. (#594)
+- Moved span transforms of the OTLP exporter to the internal package. (#593)
+- Build both go-1.13 and go-1.14 in circleci to test for all supported versions of Go. (#569)
+- Removed unneeded allocation on empty labels in OLTP exporter. (#597)
+- Update `BatchedSpanProcessor` to process the queue until no data but respect max batch size. (#599)
+- Update project documentation godoc.org links to pkg.go.dev. (#602)
+
+## [0.3.0] - 2020-03-21
+
+This is a first official beta release, which provides almost fully complete metrics, tracing, and context propagation functionality.
+There is still a possibility of breaking changes.
+
+### Added
+
+- Add `Observer` metric instrument. (#474)
+- Add global `Propagators` functionality to enable deferred initialization for propagators registered before the first Meter SDK is installed. (#494)
+- Simplified export setup pipeline for the jaeger exporter to match other exporters. (#459)
+- The zipkin trace exporter. (#495)
+- The OTLP exporter to export metric and trace telemetry to the OpenTelemetry collector. (#497) (#544) (#545)
+- Add `StatusMessage` field to the trace `Span`. (#524)
+- Context propagation in OpenTracing bridge in terms of OpenTelemetry context propagation. (#525)
+- The `Resource` type was added to the SDK. (#528)
+- The global API now supports a `Tracer` and `Meter` function as shortcuts to getting a global `*Provider` and calling these methods directly. (#538)
+- The metric API now defines a generic `MeterImpl` interface to support general purpose `Meter` construction.
+   Additionally, `SyncImpl` and `AsyncImpl` are added to support general purpose instrument construction. (#560)
+- A metric `Kind` is added to represent the `MeasureKind`, `ObserverKind`, and `CounterKind`. (#560)
+- Scripts to better automate the release process. (#576)
+
+### Changed
+
+- Default to to use `AlwaysSampler` instead of `ProbabilitySampler` to match OpenTelemetry specification. (#506)
+- Renamed `AlwaysSampleSampler` to `AlwaysOnSampler` in the trace API. (#511)
+- Renamed `NeverSampleSampler` to `AlwaysOffSampler` in the trace API. (#511)
+- The `Status` field of the `Span` was changed to `StatusCode` to disambiguate with the added `StatusMessage`. (#524)
+- Updated the trace `Sampler` interface conform to the OpenTelemetry specification. (#531)
+- Rename metric API `Options` to `Config`. (#541)
+- Rename metric `Counter` aggregator to be `Sum`. (#541)
+- Unify metric options into `Option` from instrument specific options. (#541)
+- The trace API's `TraceProvider` now support `Resource`s. (#545)
+- Correct error in zipkin module name. (#548)
+- The jaeger trace exporter now supports `Resource`s. (#551)
+- Metric SDK now supports `Resource`s.
+   The `WithResource` option was added to configure a `Resource` on creation and the `Resource` method was added to the metric `Descriptor` to return the associated `Resource`. (#552)
+- Replace `ErrNoLastValue` and `ErrEmptyDataSet` by `ErrNoData` in the metric SDK. (#557)
+- The stdout trace exporter now supports `Resource`s. (#558)
+- The metric `Descriptor` is now included at the API instead of the SDK. (#560)
+- Replace `Ordered` with an iterator in `export.Labels`. (#567)
+
+### Removed
+
+- The vendor specific Stackdriver. It is now hosted on 3rd party vendor infrastructure. (#452)
+- The `Unregister` method for metric observers as it is not in the OpenTelemetry specification. (#560)
+- `GetDescriptor` from the metric SDK. (#575)
+- The `Gauge` instrument from the metric API. (#537)
+
+### Fixed
+
+- Make histogram aggregator checkpoint consistent. (#438)
+- Update README with import instructions and how to build and test. (#505)
+- The default label encoding was updated to be unique. (#508)
+- Use `NewRoot` in the othttp plugin for public endpoints. (#513)
+- Fix data race in `BatchedSpanProcessor`. (#518)
+- Skip test-386 for Mac OS 10.15.x (Catalina and upwards). #521
+- Use a variable-size array to represent ordered labels in maps. (#523)
+- Update the OTLP protobuf and update changed import path. (#532)
+- Use `StateLocker` implementation in `MinMaxSumCount`. (#546)
+- Eliminate goroutine leak in histogram stress test. (#547)
+- Update OTLP exporter with latest protobuf. (#550)
+- Add filters to the othttp plugin. (#556)
+- Provide an implementation of the `Header*` filters that do not depend on Go 1.14. (#565)
+- Encode labels once during checkpoint.
+   The checkpoint function is executed in a single thread so we can do the encoding lazily before passing the encoded version of labels to the exporter.
+   This is a cheap and quick way to avoid encoding the labels on every collection interval. (#572)
+- Run coverage over all packages in `COVERAGE_MOD_DIR`. (#573)
+
+## [0.2.3] - 2020-03-04
+
+### Added
+
+- `RecordError` method on `Span`s in the trace API to Simplify adding error events to spans. (#473)
+- Configurable push frequency for exporters setup pipeline. (#504)
+
+### Changed
+
+- Rename the `exporter` directory to `exporters`.
+   The `go.opentelemetry.io/otel/exporter/trace/jaeger` package was mistakenly released with a `v1.0.0` tag instead of `v0.1.0`.
+   This resulted in all subsequent releases not becoming the default latest.
+   A consequence of this was that all `go get`s pulled in the incompatible `v0.1.0` release of that package when pulling in more recent packages from other otel packages.
+   Renaming the `exporter` directory to `exporters` fixes this issue by renaming the package and therefore clearing any existing dependency tags.
+   Consequentially, this action also renames *all* exporter packages. (#502)
+
+### Removed
+
+- The `CorrelationContextHeader` constant in the `correlation` package is no longer exported. (#503)
+
+## [0.2.2] - 2020-02-27
+
+### Added
+
+- `HTTPSupplier` interface in the propagation API to specify methods to retrieve and store a single value for a key to be associated with a carrier. (#467)
+- `HTTPExtractor` interface in the propagation API to extract information from an `HTTPSupplier` into a context. (#467)
+- `HTTPInjector` interface in the propagation API to inject information into an `HTTPSupplier.` (#467)
+- `Config` and configuring `Option` to the propagator API. (#467)
+- `Propagators` interface in the propagation API to contain the set of injectors and extractors for all supported carrier formats. (#467)
+- `HTTPPropagator` interface in the propagation API to inject and extract from an `HTTPSupplier.` (#467)
+- `WithInjectors` and `WithExtractors` functions to the propagator API to configure injectors and extractors to use. (#467)
+- `ExtractHTTP` and `InjectHTTP` functions to apply configured HTTP extractors and injectors to a passed context. (#467)
+- Histogram aggregator. (#433)
+- `DefaultPropagator` function and have it return `trace.TraceContext` as the default context propagator. (#456)
+- `AlwaysParentSample` sampler to the trace API. (#455)
+- `WithNewRoot` option function to the trace API to specify the created span should be considered a root span. (#451)
+
+### Changed
+
+- Renamed `WithMap` to `ContextWithMap` in the correlation package. (#481)
+- Renamed `FromContext` to `MapFromContext` in the correlation package. (#481)
+- Move correlation context propagation to correlation package. (#479)
+- Do not default to putting remote span context into links. (#480)
+- `Tracer.WithSpan` updated to accept `StartOptions`. (#472)
+- Renamed `MetricKind` to `Kind` to not stutter in the type usage. (#432)
+- Renamed the `export` package to `metric` to match directory structure. (#432)
+- Rename the `api/distributedcontext` package to `api/correlation`. (#444)
+- Rename the `api/propagators` package to `api/propagation`. (#444)
+- Move the propagators from the `propagators` package into the `trace` API package. (#444)
+- Update `Float64Gauge`, `Int64Gauge`, `Float64Counter`, `Int64Counter`, `Float64Measure`, and `Int64Measure` metric methods to use value receivers instead of pointers. (#462)
+- Moved all dependencies of tools package to a tools directory. (#466)
+
+### Removed
+
+- Binary propagators. (#467)
+- NOOP propagator. (#467)
+
+### Fixed
+
+- Upgraded `github.com/golangci/golangci-lint` from `v1.21.0` to `v1.23.6` in `tools/`. (#492)
+- Fix a possible nil-dereference crash (#478)
+- Correct comments for `InstallNewPipeline` in the stdout exporter. (#483)
+- Correct comments for `InstallNewPipeline` in the dogstatsd exporter. (#484)
+- Correct comments for `InstallNewPipeline` in the prometheus exporter. (#482)
+- Initialize `onError` based on `Config` in prometheus exporter. (#486)
+- Correct module name in prometheus exporter README. (#475)
+- Removed tracer name prefix from span names. (#430)
+- Fix `aggregator_test.go` import package comment. (#431)
+- Improved detail in stdout exporter. (#436)
+- Fix a dependency issue (generate target should depend on stringer, not lint target) in Makefile. (#442)
+- Reorders the Makefile targets within `precommit` target so we generate files and build the code before doing linting, so we can get much nicer errors about syntax errors from the compiler. (#442)
+- Reword function documentation in gRPC plugin. (#446)
+- Send the `span.kind` tag to Jaeger from the jaeger exporter. (#441)
+- Fix `metadataSupplier` in the jaeger exporter to overwrite the header if existing instead of appending to it. (#441)
+- Upgraded to Go 1.13 in CI. (#465)
+- Correct opentelemetry.io URL in trace SDK documentation. (#464)
+- Refactored reference counting logic in SDK determination of stale records. (#468)
+- Add call to `runtime.Gosched` in instrument `acquireHandle` logic to not block the collector. (#469)
+
+## [0.2.1.1] - 2020-01-13
+
+### Fixed
+
+- Use stateful batcher on Prometheus exporter fixing regresion introduced in #395. (#428)
+
+## [0.2.1] - 2020-01-08
+
+### Added
+
+- Global meter forwarding implementation.
+   This enables deferred initialization for metric instruments registered before the first Meter SDK is installed. (#392)
+- Global trace forwarding implementation.
+   This enables deferred initialization for tracers registered before the first Trace SDK is installed. (#406)
+- Standardize export pipeline creation in all exporters. (#395)
+- A testing, organization, and comments for 64-bit field alignment. (#418)
+- Script to tag all modules in the project. (#414)
+
+### Changed
+
+- Renamed `propagation` package to `propagators`. (#362)
+- Renamed `B3Propagator` propagator to `B3`. (#362)
+- Renamed `TextFormatPropagator` propagator to `TextFormat`. (#362)
+- Renamed `BinaryPropagator` propagator to `Binary`. (#362)
+- Renamed `BinaryFormatPropagator` propagator to `BinaryFormat`. (#362)
+- Renamed `NoopTextFormatPropagator` propagator to `NoopTextFormat`. (#362)
+- Renamed `TraceContextPropagator` propagator to `TraceContext`. (#362)
+- Renamed `SpanOption` to `StartOption` in the trace API. (#369)
+- Renamed `StartOptions` to `StartConfig` in the trace API. (#369)
+- Renamed `EndOptions` to `EndConfig` in the trace API. (#369)
+- `Number` now has a pointer receiver for its methods. (#375)
+- Renamed `CurrentSpan` to `SpanFromContext` in the trace API. (#379)
+- Renamed `SetCurrentSpan` to `ContextWithSpan` in the trace API. (#379)
+- Renamed `Message` in Event to `Name` in the trace API. (#389)
+- Prometheus exporter no longer aggregates metrics, instead it only exports them. (#385)
+- Renamed `HandleImpl` to `BoundInstrumentImpl` in the metric API. (#400)
+- Renamed `Float64CounterHandle` to `Float64CounterBoundInstrument` in the metric API. (#400)
+- Renamed `Int64CounterHandle` to `Int64CounterBoundInstrument` in the metric API. (#400)
+- Renamed `Float64GaugeHandle` to `Float64GaugeBoundInstrument` in the metric API. (#400)
+- Renamed `Int64GaugeHandle` to `Int64GaugeBoundInstrument` in the metric API. (#400)
+- Renamed `Float64MeasureHandle` to `Float64MeasureBoundInstrument` in the metric API. (#400)
+- Renamed `Int64MeasureHandle` to `Int64MeasureBoundInstrument` in the metric API. (#400)
+- Renamed `Release` method for bound instruments in the metric API to `Unbind`. (#400)
+- Renamed `AcquireHandle` method for bound instruments in the metric API to `Bind`. (#400)
+- Renamed the `File` option in the stdout exporter to `Writer`. (#404)
+- Renamed all `Options` to `Config` for all metric exports where this wasn't already the case.
+
+### Fixed
+
+- Aggregator import path corrected. (#421)
+- Correct links in README. (#368)
+- The README was updated to match latest code changes in its examples. (#374)
+- Don't capitalize error statements. (#375)
+- Fix ignored errors. (#375)
+- Fix ambiguous variable naming. (#375)
+- Removed unnecessary type casting. (#375)
+- Use named parameters. (#375)
+- Updated release schedule. (#378)
+- Correct http-stackdriver example module name. (#394)
+- Removed the `http.request` span in `httptrace` package. (#397)
+- Add comments in the metrics SDK (#399)
+- Initialize checkpoint when creating ddsketch aggregator to prevent panic when merging into a empty one. (#402) (#403)
+- Add documentation of compatible exporters in the README. (#405)
+- Typo fix. (#408)
+- Simplify span check logic in SDK tracer implementation. (#419)
+
+## [0.2.0] - 2019-12-03
+
+### Added
+
+- Unary gRPC tracing example. (#351)
+- Prometheus exporter. (#334)
+- Dogstatsd metrics exporter. (#326)
+
+### Changed
+
+- Rename `MaxSumCount` aggregation to `MinMaxSumCount` and add the `Min` interface for this aggregation. (#352)
+- Rename `GetMeter` to `Meter`. (#357)
+- Rename `HTTPTraceContextPropagator` to `TraceContextPropagator`. (#355)
+- Rename `HTTPB3Propagator` to `B3Propagator`. (#355)
+- Rename `HTTPTraceContextPropagator` to `TraceContextPropagator`. (#355)
+- Move `/global` package to `/api/global`. (#356)
+- Rename `GetTracer` to `Tracer`. (#347)
+
+### Removed
+
+- `SetAttribute` from the `Span` interface in the trace API. (#361)
+- `AddLink` from the `Span` interface in the trace API. (#349)
+- `Link` from the `Span` interface in the trace API. (#349)
+
+### Fixed
+
+- Exclude example directories from coverage report. (#365)
+- Lint make target now implements automatic fixes with `golangci-lint` before a second run to report the remaining issues. (#360)
+- Drop `GO111MODULE` environment variable in Makefile as Go 1.13 is the project specified minimum version and this is environment variable is not needed for that version of Go. (#359)
+- Run the race checker for all test. (#354)
+- Redundant commands in the Makefile are removed. (#354)
+- Split the `generate` and `lint` targets of the Makefile. (#354)
+- Renames `circle-ci` target to more generic `ci` in Makefile. (#354)
+- Add example Prometheus binary to gitignore. (#358)
+- Support negative numbers with the `MaxSumCount`. (#335)
+- Resolve race conditions in `push_test.go` identified in #339. (#340)
+- Use `/usr/bin/env bash` as a shebang in scripts rather than `/bin/bash`. (#336)
+- Trace benchmark now tests both `AlwaysSample` and `NeverSample`.
+   Previously it was testing `AlwaysSample` twice. (#325)
+- Trace benchmark now uses a `[]byte` for `TraceID` to fix failing test. (#325)
+- Added a trace benchmark to test variadic functions in `setAttribute` vs `setAttributes` (#325)
+- The `defaultkeys` batcher was only using the encoded label set as its map key while building a checkpoint.
+   This allowed distinct label sets through, but any metrics sharing a label set could be overwritten or merged incorrectly.
+   This was corrected. (#333)
+
+## [0.1.2] - 2019-11-18
+
+### Fixed
+
+- Optimized the `simplelru` map for attributes to reduce the number of allocations. (#328)
+- Removed unnecessary unslicing of parameters that are already a slice. (#324)
+
+## [0.1.1] - 2019-11-18
+
+This release contains a Metrics SDK with stdout exporter and supports basic aggregations such as counter, gauges, array, maxsumcount, and ddsketch.
+
+### Added
+
+- Metrics stdout export pipeline. (#265)
+- Array aggregation for raw measure metrics. (#282)
+- The core.Value now have a `MarshalJSON` method. (#281)
+
+### Removed
+
+- `WithService`, `WithResources`, and `WithComponent` methods of tracers. (#314)
+- Prefix slash in `Tracer.Start()` for the Jaeger example. (#292)
+
+### Changed
+
+- Allocation in LabelSet construction to reduce GC overhead. (#318)
+- `trace.WithAttributes` to append values instead of replacing (#315)
+- Use a formula for tolerance in sampling tests. (#298)
+- Move export types into trace and metric-specific sub-directories. (#289)
+- `SpanKind` back to being based on an `int` type. (#288)
+
+### Fixed
+
+- URL to OpenTelemetry website in README. (#323)
+- Name of othttp default tracer. (#321)
+- `ExportSpans` for the stackdriver exporter now handles `nil` context. (#294)
+- CI modules cache to correctly restore/save from/to the cache. (#316)
+- Fix metric SDK race condition between `LoadOrStore` and the assignment `rec.recorder = i.meter.exporter.AggregatorFor(rec)`. (#293)
+- README now reflects the new code structure introduced with these changes. (#291)
+- Make the basic example work. (#279)
+
+## [0.1.0] - 2019-11-04
+
+This is the first release of open-telemetry go library.
+It contains api and sdk for trace and meter.
+
+### Added
+
+- Initial OpenTelemetry trace and metric API prototypes.
+- Initial OpenTelemetry trace, metric, and export SDK packages.
+- A wireframe bridge to support compatibility with OpenTracing.
+- Example code for a basic, http-stackdriver, http, jaeger, and named tracer setup.
+- Exporters for Jaeger, Stackdriver, and stdout.
+- Propagators for binary, B3, and trace-context protocols.
+- Project information and guidelines in the form of a README and CONTRIBUTING.
+- Tools to build the project and a Makefile to automate the process.
+- Apache-2.0 license.
+- CircleCI build CI manifest files.
+- CODEOWNERS file to track owners of this project.
+
+[Unreleased]: https://github.com/open-telemetry/opentelemetry-go/compare/v1.14.0...HEAD
+[1.14.0/0.37.0/0.0.4]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.14.0
+[1.13.0/0.36.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.13.0
+[1.12.0/0.35.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.12.0
+[1.11.2/0.34.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.11.2
+[1.11.1/0.33.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.11.1
+[1.11.0/0.32.3]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.11.0
+[0.32.2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/metric/v0.32.2
+[0.32.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/metric/v0.32.1
+[0.32.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/metric/v0.32.0
+[1.10.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.10.0
+[1.9.0/0.0.3]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.9.0
+[1.8.0/0.31.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.8.0
+[1.7.0/0.30.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.7.0
+[0.29.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/metric/v0.29.0
+[1.6.3]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.6.3
+[1.6.2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.6.2
+[1.6.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.6.1
+[1.6.0/0.28.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.6.0
+[1.5.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.5.0
+[1.4.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.4.1
+[1.4.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.4.0
+[1.3.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.3.0
+[1.2.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.2.0
+[1.1.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.1.0
+[1.0.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.0.1
+[Metrics 0.24.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/metric/v0.24.0
+[1.0.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.0.0
+[1.0.0-RC3]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.0.0-RC3
+[1.0.0-RC2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.0.0-RC2
+[Experimental Metrics v0.22.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/metric/v0.22.0
+[1.0.0-RC1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.0.0-RC1
+[0.20.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.20.0
+[0.19.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.19.0
+[0.18.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.18.0
+[0.17.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.17.0
+[0.16.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.16.0
+[0.15.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.15.0
+[0.14.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.14.0
+[0.13.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.13.0
+[0.12.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.12.0
+[0.11.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.11.0
+[0.10.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.10.0
+[0.9.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.9.0
+[0.8.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.8.0
+[0.7.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.7.0
+[0.6.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.6.0
+[0.5.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.5.0
+[0.4.3]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.4.3
+[0.4.2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.4.2
+[0.4.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.4.1
+[0.4.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.4.0
+[0.3.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.3.0
+[0.2.3]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.2.3
+[0.2.2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.2.2
+[0.2.1.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.2.1.1
+[0.2.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.2.1
+[0.2.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.2.0
+[0.1.2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.1.2
+[0.1.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.1.1
+[0.1.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v0.1.0
+
+[Go 1.20]: https://go.dev/doc/go1.20
+[Go 1.19]: https://go.dev/doc/go1.19
+[Go 1.18]: https://go.dev/doc/go1.18
diff --git a/vendor/go.opentelemetry.io/otel/CODEOWNERS b/vendor/go.opentelemetry.io/otel/CODEOWNERS
new file mode 100644
index 0000000000..c4012ed6ca
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/CODEOWNERS
@@ -0,0 +1,17 @@
+#####################################################
+#
+# List of approvers for this repository
+#
+#####################################################
+#
+# Learn about membership in OpenTelemetry community:
+#  https://github.com/open-telemetry/community/blob/main/community-membership.md
+#
+#
+# Learn about CODEOWNERS file format:
+#  https://help.github.com/en/articles/about-code-owners
+#
+
+* @jmacd @MrAlias @Aneurysm9 @evantorrie @XSAM @dashpole @MadVikingGod @pellared @hanyuancheung @dmathieu
+
+CODEOWNERS @MrAlias @Aneurysm9 @MadVikingGod
diff --git a/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md b/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
new file mode 100644
index 0000000000..a6928bfdff
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md
@@ -0,0 +1,526 @@
+# Contributing to opentelemetry-go
+
+The Go special interest group (SIG) meets regularly. See the
+OpenTelemetry
+[community](https://github.com/open-telemetry/community#golang-sdk)
+repo for information on this and other language SIGs.
+
+See the [public meeting
+notes](https://docs.google.com/document/d/1A63zSWX0x2CyCK_LoNhmQC4rqhLpYXJzXbEPDUQ2n6w/edit#heading=h.9tngw7jdwd6b)
+for a summary description of past meetings. To request edit access,
+join the meeting or get in touch on
+[Slack](https://cloud-native.slack.com/archives/C01NPAXACKT).
+
+## Development
+
+You can view and edit the source code by cloning this repository:
+
+```sh
+git clone https://github.com/open-telemetry/opentelemetry-go.git
+```
+
+Run `make test` to run the tests instead of `go test`.
+
+There are some generated files checked into the repo. To make sure
+that the generated files are up-to-date, run `make` (or `make
+precommit` - the `precommit` target is the default).
+
+The `precommit` target also fixes the formatting of the code and
+checks the status of the go module files.
+
+If after running `make precommit` the output of `git status` contains
+`nothing to commit, working tree clean` then it means that everything
+is up-to-date and properly formatted.
+
+## Pull Requests
+
+### How to Send Pull Requests
+
+Everyone is welcome to contribute code to `opentelemetry-go` via
+GitHub pull requests (PRs).
+
+To create a new PR, fork the project in GitHub and clone the upstream
+repo:
+
+```sh
+go get -d go.opentelemetry.io/otel
+```
+
+(This may print some warning about "build constraints exclude all Go
+files", just ignore it.)
+
+This will put the project in `${GOPATH}/src/go.opentelemetry.io/otel`. You
+can alternatively use `git` directly with:
+
+```sh
+git clone https://github.com/open-telemetry/opentelemetry-go
+```
+
+(Note that `git clone` is *not* using the `go.opentelemetry.io/otel` name -
+that name is a kind of a redirector to GitHub that `go get` can
+understand, but `git` does not.)
+
+This would put the project in the `opentelemetry-go` directory in
+current working directory.
+
+Enter the newly created directory and add your fork as a new remote:
+
+```sh
+git remote add <YOUR_FORK> git@github.com:<YOUR_GITHUB_USERNAME>/opentelemetry-go
+```
+
+Check out a new branch, make modifications, run linters and tests, update
+`CHANGELOG.md`, and push the branch to your fork:
+
+```sh
+git checkout -b <YOUR_BRANCH_NAME>
+# edit files
+# update changelog
+make precommit
+git add -p
+git commit
+git push <YOUR_FORK> <YOUR_BRANCH_NAME>
+```
+
+Open a pull request against the main `opentelemetry-go` repo. Be sure to add the pull
+request ID to the entry you added to `CHANGELOG.md`.
+
+### How to Receive Comments
+
+* If the PR is not ready for review, please put `[WIP]` in the title,
+  tag it as `work-in-progress`, or mark it as
+  [`draft`](https://github.blog/2019-02-14-introducing-draft-pull-requests/).
+* Make sure CLA is signed and CI is clear.
+
+### How to Get PRs Merged
+
+A PR is considered to be **ready to merge** when:
+
+* It has received two approvals from Collaborators/Maintainers (at
+  different companies). This is not enforced through technical means
+  and a PR may be **ready to merge** with a single approval if the change
+  and its approach have been discussed and consensus reached.
+* Feedback has been addressed.
+* Any substantive changes to your PR will require that you clear any prior
+  Approval reviews, this includes changes resulting from other feedback. Unless
+  the approver explicitly stated that their approval will persist across
+  changes it should be assumed that the PR needs their review again. Other
+  project members (e.g. approvers, maintainers) can help with this if there are
+  any questions or if you forget to clear reviews.
+* It has been open for review for at least one working day. This gives
+  people reasonable time to review.
+* Trivial changes (typo, cosmetic, doc, etc.) do not have to wait for
+  one day and may be merged with a single Maintainer's approval.
+* `CHANGELOG.md` has been updated to reflect what has been
+  added, changed, removed, or fixed.
+* `README.md` has been updated if necessary.
+* Urgent fix can take exception as long as it has been actively
+  communicated.
+
+Any Maintainer can merge the PR once it is **ready to merge**.
+
+## Design Choices
+
+As with other OpenTelemetry clients, opentelemetry-go follows the
+[opentelemetry-specification](https://github.com/open-telemetry/opentelemetry-specification).
+
+It's especially valuable to read through the [library
+guidelines](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/library-guidelines.md).
+
+### Focus on Capabilities, Not Structure Compliance
+
+OpenTelemetry is an evolving specification, one where the desires and
+use cases are clear, but the method to satisfy those uses cases are
+not.
+
+As such, Contributions should provide functionality and behavior that
+conforms to the specification, but the interface and structure is
+flexible.
+
+It is preferable to have contributions follow the idioms of the
+language rather than conform to specific API names or argument
+patterns in the spec.
+
+For a deeper discussion, see
+[this](https://github.com/open-telemetry/opentelemetry-specification/issues/165).
+
+## Documentation
+
+Each non-example Go Module should have its own `README.md` containing:
+
+- A pkg.go.dev badge which can be generated [here](https://pkg.go.dev/badge/).
+- Brief description.
+- Installation instructions (and requirements if applicable).
+- Hyperlink to an example. Depending on the component the example can be:
+  - An `example_test.go` like [here](exporters/stdout/stdouttrace/example_test.go).
+  - A sample Go application with its own `README.md`, like [here](example/zipkin).
+- Additional documentation sections such us:
+  - Configuration,
+  - Contributing,
+  - References.
+
+[Here](exporters/jaeger/README.md) is an example of a concise `README.md`.
+
+Moreover, it should be possible to navigate to any `README.md` from the
+root `README.md`.
+
+## Style Guide
+
+One of the primary goals of this project is that it is actually used by
+developers. With this goal in mind the project strives to build
+user-friendly and idiomatic Go code adhering to the Go community's best
+practices.
+
+For a non-comprehensive but foundational overview of these best practices
+the [Effective Go](https://golang.org/doc/effective_go.html) documentation
+is an excellent starting place.
+
+As a convenience for developers building this project the `make precommit`
+will format, lint, validate, and in some cases fix the changes you plan to
+submit. This check will need to pass for your changes to be able to be
+merged.
+
+In addition to idiomatic Go, the project has adopted certain standards for
+implementations of common patterns. These standards should be followed as a
+default, and if they are not followed documentation needs to be included as
+to the reasons why.
+
+### Configuration
+
+When creating an instantiation function for a complex `type T struct`, it is
+useful to allow variable number of options to be applied. However, the strong
+type system of Go restricts the function design options. There are a few ways
+to solve this problem, but we have landed on the following design.
+
+#### `config`
+
+Configuration should be held in a `struct` named `config`, or prefixed with
+specific type name this Configuration applies to if there are multiple
+`config` in the package. This type must contain configuration options.
+
+```go
+// config contains configuration options for a thing.
+type config struct {
+	// options ...
+}
+```
+
+In general the `config` type will not need to be used externally to the
+package and should be unexported. If, however, it is expected that the user
+will likely want to build custom options for the configuration, the `config`
+should be exported. Please, include in the documentation for the `config`
+how the user can extend the configuration.
+
+It is important that internal `config` are not shared across package boundaries.
+Meaning a `config` from one package should not be directly used by another. The
+one exception is the API packages.  The configs from the base API, eg.
+`go.opentelemetry.io/otel/trace.TracerConfig` and
+`go.opentelemetry.io/otel/metric.InstrumentConfig`, are intended to be consumed
+by the SDK therefor it is expected that these are exported.
+
+When a config is exported we want to maintain forward and backward
+compatibility, to achieve this no fields should be exported but should
+instead be accessed by methods.
+
+Optionally, it is common to include a `newConfig` function (with the same
+naming scheme). This function wraps any defaults setting and looping over
+all options to create a configured `config`.
+
+```go
+// newConfig returns an appropriately configured config.
+func newConfig(options ...Option) config {
+	// Set default values for config.
+	config := config{/* […] */}
+	for _, option := range options {
+		config = option.apply(config)
+	}
+	// Preform any validation here.
+	return config
+}
+```
+
+If validation of the `config` options is also preformed this can return an
+error as well that is expected to be handled by the instantiation function
+or propagated to the user.
+
+Given the design goal of not having the user need to work with the `config`,
+the `newConfig` function should also be unexported.
+
+#### `Option`
+
+To set the value of the options a `config` contains, a corresponding
+`Option` interface type should be used.
+
+```go
+type Option interface {
+	apply(config) config
+}
+```
+
+Having `apply` unexported makes sure that it will not be used externally.
+Moreover, the interface becomes sealed so the user cannot easily implement
+the interface on its own.
+
+The `apply` method should return a modified version of the passed config.
+This approach, instead of passing a pointer, is used to prevent the config from being allocated to the heap.
+
+The name of the interface should be prefixed in the same way the
+corresponding `config` is (if at all).
+
+#### Options
+
+All user configurable options for a `config` must have a related unexported
+implementation of the `Option` interface and an exported configuration
+function that wraps this implementation.
+
+The wrapping function name should be prefixed with `With*` (or in the
+special case of a boolean options `Without*`) and should have the following
+function signature.
+
+```go
+func With*(…) Option { … }
+```
+
+##### `bool` Options
+
+```go
+type defaultFalseOption bool
+
+func (o defaultFalseOption) apply(c config) config {
+	c.Bool = bool(o)
+    return c
+}
+
+// WithOption sets a T to have an option included.
+func WithOption() Option {
+	return defaultFalseOption(true)
+}
+```
+
+```go
+type defaultTrueOption bool
+
+func (o defaultTrueOption) apply(c config) config {
+	c.Bool = bool(o)
+    return c
+}
+
+// WithoutOption sets a T to have Bool option excluded.
+func WithoutOption() Option {
+	return defaultTrueOption(false)
+}
+```
+
+##### Declared Type Options
+
+```go
+type myTypeOption struct {
+	MyType MyType
+}
+
+func (o myTypeOption) apply(c config) config {
+	c.MyType = o.MyType
+    return c
+}
+
+// WithMyType sets T to have include MyType.
+func WithMyType(t MyType) Option {
+	return myTypeOption{t}
+}
+```
+
+##### Functional Options
+
+```go
+type optionFunc func(config) config
+
+func (fn optionFunc) apply(c config) config {
+	return fn(c)
+}
+
+// WithMyType sets t as MyType.
+func WithMyType(t MyType) Option {
+	return optionFunc(func(c config) config {
+		c.MyType = t
+        return c
+	})
+}
+```
+
+#### Instantiation
+
+Using this configuration pattern to configure instantiation with a `NewT`
+function.
+
+```go
+func NewT(options ...Option) T {…}
+```
+
+Any required parameters can be declared before the variadic `options`.
+
+#### Dealing with Overlap
+
+Sometimes there are multiple complex `struct` that share common
+configuration and also have distinct configuration. To avoid repeated
+portions of `config`s, a common `config` can be used with the union of
+options being handled with the `Option` interface.
+
+For example.
+
+```go
+// config holds options for all animals.
+type config struct {
+	Weight      float64
+	Color       string
+	MaxAltitude float64
+}
+
+// DogOption apply Dog specific options.
+type DogOption interface {
+	applyDog(config) config
+}
+
+// BirdOption apply Bird specific options.
+type BirdOption interface {
+	applyBird(config) config
+}
+
+// Option apply options for all animals.
+type Option interface {
+	BirdOption
+	DogOption
+}
+
+type weightOption float64
+
+func (o weightOption) applyDog(c config) config {
+	c.Weight = float64(o)
+	return c
+}
+
+func (o weightOption) applyBird(c config) config {
+	c.Weight = float64(o)
+	return c
+}
+
+func WithWeight(w float64) Option { return weightOption(w) }
+
+type furColorOption string
+
+func (o furColorOption) applyDog(c config) config {
+	c.Color = string(o)
+	return c
+}
+
+func WithFurColor(c string) DogOption { return furColorOption(c) }
+
+type maxAltitudeOption float64
+
+func (o maxAltitudeOption) applyBird(c config) config {
+	c.MaxAltitude = float64(o)
+	return c
+}
+
+func WithMaxAltitude(a float64) BirdOption { return maxAltitudeOption(a) }
+
+func NewDog(name string, o ...DogOption) Dog    {…}
+func NewBird(name string, o ...BirdOption) Bird {…}
+```
+
+### Interfaces
+
+To allow other developers to better comprehend the code, it is important
+to ensure it is sufficiently documented. One simple measure that contributes
+to this aim is self-documenting by naming method parameters. Therefore,
+where appropriate, methods of every exported interface type should have
+their parameters appropriately named.
+
+#### Interface Stability
+
+All exported stable interfaces that include the following warning in their
+doumentation are allowed to be extended with additional methods.
+
+> Warning: methods may be added to this interface in minor releases.
+
+Otherwise, stable interfaces MUST NOT be modified.
+
+If new functionality is needed for an interface that cannot be changed it MUST
+be added by including an additional interface. That added interface can be a
+simple interface for the specific functionality that you want to add or it can
+be a super-set of the original interface. For example, if you wanted to a
+`Close` method to the `Exporter` interface:
+
+```go
+type Exporter interface {
+	Export()
+}
+```
+
+A new interface, `Closer`, can be added:
+
+```go
+type Closer interface {
+	Close()
+}
+```
+
+Code that is passed the `Exporter` interface can now check to see if the passed
+value also satisfies the new interface. E.g.
+
+```go
+func caller(e Exporter) {
+	/* ... */
+	if c, ok := e.(Closer); ok {
+		c.Close()
+	}
+	/* ... */
+}
+```
+
+Alternatively, a new type that is the super-set of an `Exporter` can be created.
+
+```go
+type ClosingExporter struct {
+	Exporter
+	Close()
+}
+```
+
+This new type can be used similar to the simple interface above in that a
+passed `Exporter` type can be asserted to satisfy the `ClosingExporter` type
+and the `Close` method called.
+
+This super-set approach can be useful if there is explicit behavior that needs
+to be coupled with the original type and passed as a unified type to a new
+function, but, because of this coupling, it also limits the applicability of
+the added functionality. If there exist other interfaces where this
+functionality should be added, each one will need their own super-set
+interfaces and will duplicate the pattern. For this reason, the simple targeted
+interface that defines the specific functionality should be preferred.
+
+## Approvers and Maintainers
+
+Approvers:
+
+- [Evan Torrie](https://github.com/evantorrie), Verizon Media
+- [Josh MacDonald](https://github.com/jmacd), LightStep
+- [Sam Xie](https://github.com/XSAM), Cisco/AppDynamics
+- [David Ashpole](https://github.com/dashpole), Google
+- [Robert Pająk](https://github.com/pellared), Splunk
+- [Chester Cheung](https://github.com/hanyuancheung), Tencent
+- [Damien Mathieu](https://github.com/dmathieu), Elastic
+
+Maintainers:
+
+- [Aaron Clawson](https://github.com/MadVikingGod), LightStep
+- [Anthony Mirabella](https://github.com/Aneurysm9), AWS
+- [Tyler Yahn](https://github.com/MrAlias), Splunk
+
+Emeritus:
+
+- [Gustavo Silva Paiva](https://github.com/paivagustavo), LightStep
+
+### Become an Approver or a Maintainer
+
+See the [community membership document in OpenTelemetry community
+repo](https://github.com/open-telemetry/community/blob/main/community-membership.md).
diff --git a/vendor/go.opentelemetry.io/otel/LICENSE b/vendor/go.opentelemetry.io/otel/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/Makefile b/vendor/go.opentelemetry.io/otel/Makefile
new file mode 100644
index 0000000000..0e6ffa284e
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/Makefile
@@ -0,0 +1,227 @@
+# Copyright The OpenTelemetry Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+TOOLS_MOD_DIR := ./internal/tools
+
+ALL_DOCS := $(shell find . -name '*.md' -type f | sort)
+ALL_GO_MOD_DIRS := $(shell find . -type f -name 'go.mod' -exec dirname {} \; | sort)
+OTEL_GO_MOD_DIRS := $(filter-out $(TOOLS_MOD_DIR), $(ALL_GO_MOD_DIRS))
+ALL_COVERAGE_MOD_DIRS := $(shell find . -type f -name 'go.mod' -exec dirname {} \; | grep -E -v '^./example|^$(TOOLS_MOD_DIR)' | sort)
+
+GO = go
+TIMEOUT = 60
+
+.DEFAULT_GOAL := precommit
+
+.PHONY: precommit ci
+precommit: dependabot-generate license-check vanity-import-fix misspell go-mod-tidy golangci-lint-fix test-default
+ci: dependabot-check license-check lint vanity-import-check build test-default check-clean-work-tree test-coverage
+
+# Tools
+
+TOOLS = $(CURDIR)/.tools
+
+$(TOOLS):
+	@mkdir -p $@
+$(TOOLS)/%: | $(TOOLS)
+	cd $(TOOLS_MOD_DIR) && \
+	$(GO) build -o $@ $(PACKAGE)
+
+MULTIMOD = $(TOOLS)/multimod
+$(TOOLS)/multimod: PACKAGE=go.opentelemetry.io/build-tools/multimod
+
+SEMCONVGEN = $(TOOLS)/semconvgen
+$(TOOLS)/semconvgen: PACKAGE=go.opentelemetry.io/build-tools/semconvgen
+
+CROSSLINK = $(TOOLS)/crosslink
+$(TOOLS)/crosslink: PACKAGE=go.opentelemetry.io/build-tools/crosslink
+
+SEMCONVKIT = $(TOOLS)/semconvkit
+$(TOOLS)/semconvkit: PACKAGE=go.opentelemetry.io/otel/$(TOOLS_MOD_DIR)/semconvkit
+
+DBOTCONF = $(TOOLS)/dbotconf
+$(TOOLS)/dbotconf: PACKAGE=go.opentelemetry.io/build-tools/dbotconf
+
+GOLANGCI_LINT = $(TOOLS)/golangci-lint
+$(TOOLS)/golangci-lint: PACKAGE=github.com/golangci/golangci-lint/cmd/golangci-lint
+
+MISSPELL = $(TOOLS)/misspell
+$(TOOLS)/misspell: PACKAGE=github.com/client9/misspell/cmd/misspell
+
+GOCOVMERGE = $(TOOLS)/gocovmerge
+$(TOOLS)/gocovmerge: PACKAGE=github.com/wadey/gocovmerge
+
+STRINGER = $(TOOLS)/stringer
+$(TOOLS)/stringer: PACKAGE=golang.org/x/tools/cmd/stringer
+
+PORTO = $(TOOLS)/porto
+$(TOOLS)/porto: PACKAGE=github.com/jcchavezs/porto/cmd/porto
+
+GOJQ = $(TOOLS)/gojq
+$(TOOLS)/gojq: PACKAGE=github.com/itchyny/gojq/cmd/gojq
+
+.PHONY: tools
+tools: $(CROSSLINK) $(DBOTCONF) $(GOLANGCI_LINT) $(MISSPELL) $(GOCOVMERGE) $(STRINGER) $(PORTO) $(GOJQ) $(SEMCONVGEN) $(MULTIMOD) $(SEMCONVKIT)
+
+# Build
+
+.PHONY: generate build
+
+generate: $(OTEL_GO_MOD_DIRS:%=generate/%)
+generate/%: DIR=$*
+generate/%: | $(STRINGER) $(PORTO)
+	@echo "$(GO) generate $(DIR)/..." \
+		&& cd $(DIR) \
+		&& PATH="$(TOOLS):$${PATH}" $(GO) generate ./... && $(PORTO) -w .
+
+build: generate $(OTEL_GO_MOD_DIRS:%=build/%) $(OTEL_GO_MOD_DIRS:%=build-tests/%)
+build/%: DIR=$*
+build/%:
+	@echo "$(GO) build $(DIR)/..." \
+		&& cd $(DIR) \
+		&& $(GO) build ./...
+
+build-tests/%: DIR=$*
+build-tests/%:
+	@echo "$(GO) build tests $(DIR)/..." \
+		&& cd $(DIR) \
+		&& $(GO) list ./... \
+		| grep -v third_party \
+		| xargs $(GO) test -vet=off -run xxxxxMatchNothingxxxxx >/dev/null
+
+# Tests
+
+TEST_TARGETS := test-default test-bench test-short test-verbose test-race
+.PHONY: $(TEST_TARGETS) test
+test-default test-race: ARGS=-race
+test-bench:   ARGS=-run=xxxxxMatchNothingxxxxx -test.benchtime=1ms -bench=.
+test-short:   ARGS=-short
+test-verbose: ARGS=-v -race
+$(TEST_TARGETS): test
+test: $(OTEL_GO_MOD_DIRS:%=test/%)
+test/%: DIR=$*
+test/%:
+	@echo "$(GO) test -timeout $(TIMEOUT)s $(ARGS) $(DIR)/..." \
+		&& cd $(DIR) \
+		&& $(GO) list ./... \
+		| grep -v third_party \
+		| xargs $(GO) test -timeout $(TIMEOUT)s $(ARGS)
+
+COVERAGE_MODE    = atomic
+COVERAGE_PROFILE = coverage.out
+.PHONY: test-coverage
+test-coverage: | $(GOCOVMERGE)
+	@set -e; \
+	printf "" > coverage.txt; \
+	for dir in $(ALL_COVERAGE_MOD_DIRS); do \
+	  echo "$(GO) test -coverpkg=go.opentelemetry.io/otel/... -covermode=$(COVERAGE_MODE) -coverprofile="$(COVERAGE_PROFILE)" $${dir}/..."; \
+	  (cd "$${dir}" && \
+	    $(GO) list ./... \
+	    | grep -v third_party \
+	    | grep -v 'semconv/v.*' \
+	    | xargs $(GO) test -coverpkg=./... -covermode=$(COVERAGE_MODE) -coverprofile="$(COVERAGE_PROFILE)" && \
+	  $(GO) tool cover -html=coverage.out -o coverage.html); \
+	done; \
+	$(GOCOVMERGE) $$(find . -name coverage.out) > coverage.txt
+
+.PHONY: golangci-lint golangci-lint-fix
+golangci-lint-fix: ARGS=--fix
+golangci-lint-fix: golangci-lint
+golangci-lint: $(OTEL_GO_MOD_DIRS:%=golangci-lint/%)
+golangci-lint/%: DIR=$*
+golangci-lint/%: | $(GOLANGCI_LINT)
+	@echo 'golangci-lint $(if $(ARGS),$(ARGS) ,)$(DIR)' \
+		&& cd $(DIR) \
+		&& $(GOLANGCI_LINT) run --allow-serial-runners $(ARGS)
+
+.PHONY: crosslink
+crosslink: | $(CROSSLINK)
+	@echo "Updating intra-repository dependencies in all go modules" \
+		&& $(CROSSLINK) --root=$(shell pwd) --prune
+
+.PHONY: go-mod-tidy
+go-mod-tidy: $(ALL_GO_MOD_DIRS:%=go-mod-tidy/%)
+go-mod-tidy/%: DIR=$*
+go-mod-tidy/%: | crosslink
+	@echo "$(GO) mod tidy in $(DIR)" \
+		&& cd $(DIR) \
+		&& $(GO) mod tidy -compat=1.18
+
+.PHONY: lint-modules
+lint-modules: go-mod-tidy
+
+.PHONY: lint
+lint: misspell lint-modules golangci-lint
+
+.PHONY: vanity-import-check
+vanity-import-check: | $(PORTO)
+	@$(PORTO) --include-internal -l . || echo "(run: make vanity-import-fix)"
+
+.PHONY: vanity-import-fix
+vanity-import-fix: | $(PORTO)
+	@$(PORTO) --include-internal -w .
+
+.PHONY: misspell
+misspell: | $(MISSPELL)
+	@$(MISSPELL) -w $(ALL_DOCS)
+
+.PHONY: license-check
+license-check:
+	@licRes=$$(for f in $$(find . -type f \( -iname '*.go' -o -iname '*.sh' \) ! -path '**/third_party/*' ! -path './.git/*' ) ; do \
+	           awk '/Copyright The OpenTelemetry Authors|generated|GENERATED/ && NR<=3 { found=1; next } END { if (!found) print FILENAME }' $$f; \
+	   done); \
+	   if [ -n "$${licRes}" ]; then \
+	           echo "license header checking failed:"; echo "$${licRes}"; \
+	           exit 1; \
+	   fi
+
+DEPENDABOT_CONFIG = .github/dependabot.yml
+.PHONY: dependabot-check
+dependabot-check: | $(DBOTCONF)
+	@$(DBOTCONF) verify $(DEPENDABOT_CONFIG) || echo "(run: make dependabot-generate)"
+
+.PHONY: dependabot-generate
+dependabot-generate: | $(DBOTCONF)
+	@$(DBOTCONF) generate > $(DEPENDABOT_CONFIG)
+
+.PHONY: check-clean-work-tree
+check-clean-work-tree:
+	@if ! git diff --quiet; then \
+	  echo; \
+	  echo 'Working tree is not clean, did you forget to run "make precommit"?'; \
+	  echo; \
+	  git status; \
+	  exit 1; \
+	fi
+
+SEMCONVPKG ?= "semconv/"
+.PHONY: semconv-generate
+semconv-generate: | $(SEMCONVGEN) $(SEMCONVKIT)
+	[ "$(TAG)" ] || ( echo "TAG unset: missing opentelemetry specification tag"; exit 1 )
+	[ "$(OTEL_SPEC_REPO)" ] || ( echo "OTEL_SPEC_REPO unset: missing path to opentelemetry specification repo"; exit 1 )
+	$(SEMCONVGEN) -i "$(OTEL_SPEC_REPO)/semantic_conventions/." --only=span -p conventionType=trace -f trace.go -t "$(SEMCONVPKG)/template.j2" -s "$(TAG)"
+	$(SEMCONVGEN) -i "$(OTEL_SPEC_REPO)/semantic_conventions/." --only=event -p conventionType=event -f event.go -t "$(SEMCONVPKG)/template.j2" -s "$(TAG)"
+	$(SEMCONVGEN) -i "$(OTEL_SPEC_REPO)/semantic_conventions/." --only=resource -p conventionType=resource -f resource.go -t "$(SEMCONVPKG)/template.j2" -s "$(TAG)"
+	$(SEMCONVKIT) -output "$(SEMCONVPKG)/$(TAG)" -tag "$(TAG)"
+
+.PHONY: prerelease
+prerelease: | $(MULTIMOD)
+	@[ "${MODSET}" ] || ( echo ">> env var MODSET is not set"; exit 1 )
+	$(MULTIMOD) verify && $(MULTIMOD) prerelease -m ${MODSET}
+
+COMMIT ?= "HEAD"
+.PHONY: add-tags
+add-tags: | $(MULTIMOD)
+	@[ "${MODSET}" ] || ( echo ">> env var MODSET is not set"; exit 1 )
+	$(MULTIMOD) verify && $(MULTIMOD) tag -m ${MODSET} -c ${COMMIT}
diff --git a/vendor/go.opentelemetry.io/otel/README.md b/vendor/go.opentelemetry.io/otel/README.md
new file mode 100644
index 0000000000..878d87e58b
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/README.md
@@ -0,0 +1,114 @@
+# OpenTelemetry-Go
+
+[![CI](https://github.com/open-telemetry/opentelemetry-go/workflows/ci/badge.svg)](https://github.com/open-telemetry/opentelemetry-go/actions?query=workflow%3Aci+branch%3Amain)
+[![codecov.io](https://codecov.io/gh/open-telemetry/opentelemetry-go/coverage.svg?branch=main)](https://app.codecov.io/gh/open-telemetry/opentelemetry-go?branch=main)
+[![PkgGoDev](https://pkg.go.dev/badge/go.opentelemetry.io/otel)](https://pkg.go.dev/go.opentelemetry.io/otel)
+[![Go Report Card](https://goreportcard.com/badge/go.opentelemetry.io/otel)](https://goreportcard.com/report/go.opentelemetry.io/otel)
+[![Slack](https://img.shields.io/badge/slack-@cncf/otel--go-brightgreen.svg?logo=slack)](https://cloud-native.slack.com/archives/C01NPAXACKT)
+
+OpenTelemetry-Go is the [Go](https://golang.org/) implementation of [OpenTelemetry](https://opentelemetry.io/).
+It provides a set of APIs to directly measure performance and behavior of your software and send this data to observability platforms.
+
+## Project Status
+
+| Signal  | Status     | Project |
+| ------- | ---------- | ------- |
+| Traces  | Stable     | N/A     |
+| Metrics | Alpha      | N/A     |
+| Logs    | Frozen [1] | N/A     |
+
+- [1]: The Logs signal development is halted for this project while we develop both Traces and Metrics.
+   No Logs Pull Requests are currently being accepted.
+
+Progress and status specific to this repository is tracked in our local
+[project boards](https://github.com/open-telemetry/opentelemetry-go/projects)
+and
+[milestones](https://github.com/open-telemetry/opentelemetry-go/milestones).
+
+Project versioning information and stability guarantees can be found in the
+[versioning documentation](./VERSIONING.md).
+
+### Compatibility
+
+OpenTelemetry-Go ensures compatibility with the current supported versions of
+the [Go language](https://golang.org/doc/devel/release#policy):
+
+> Each major Go release is supported until there are two newer major releases.
+> For example, Go 1.5 was supported until the Go 1.7 release, and Go 1.6 was supported until the Go 1.8 release.
+
+For versions of Go that are no longer supported upstream, opentelemetry-go will
+stop ensuring compatibility with these versions in the following manner:
+
+- A minor release of opentelemetry-go will be made to add support for the new
+  supported release of Go.
+- The following minor release of opentelemetry-go will remove compatibility
+  testing for the oldest (now archived upstream) version of Go. This, and
+  future, releases of opentelemetry-go may include features only supported by
+  the currently supported versions of Go.
+
+Currently, this project supports the following environments.
+
+| OS      | Go Version | Architecture |
+| ------- | ---------- | ------------ |
+| Ubuntu  | 1.20       | amd64        |
+| Ubuntu  | 1.19       | amd64        |
+| Ubuntu  | 1.18       | amd64        |
+| Ubuntu  | 1.20       | 386          |
+| Ubuntu  | 1.19       | 386          |
+| Ubuntu  | 1.18       | 386          |
+| MacOS   | 1.20       | amd64        |
+| MacOS   | 1.19       | amd64        |
+| MacOS   | 1.18       | amd64        |
+| Windows | 1.20       | amd64        |
+| Windows | 1.19       | amd64        |
+| Windows | 1.18       | amd64        |
+| Windows | 1.20       | 386          |
+| Windows | 1.19       | 386          |
+| Windows | 1.18       | 386          |
+
+While this project should work for other systems, no compatibility guarantees
+are made for those systems currently.
+
+## Getting Started
+
+You can find a getting started guide on [opentelemetry.io](https://opentelemetry.io/docs/go/getting-started/).
+
+OpenTelemetry's goal is to provide a single set of APIs to capture distributed
+traces and metrics from your application and send them to an observability
+platform. This project allows you to do just that for applications written in
+Go. There are two steps to this process: instrument your application, and
+configure an exporter.
+
+### Instrumentation
+
+To start capturing distributed traces and metric events from your application
+it first needs to be instrumented. The easiest way to do this is by using an
+instrumentation library for your code. Be sure to check out [the officially
+supported instrumentation
+libraries](https://github.com/open-telemetry/opentelemetry-go-contrib/tree/main/instrumentation).
+
+If you need to extend the telemetry an instrumentation library provides or want
+to build your own instrumentation for your application directly you will need
+to use the
+[Go otel](https://pkg.go.dev/go.opentelemetry.io/otel)
+package. The included [examples](./example/) are a good way to see some
+practical uses of this process.
+
+### Export
+
+Now that your application is instrumented to collect telemetry, it needs an
+export pipeline to send that telemetry to an observability platform.
+
+All officially supported exporters for the OpenTelemetry project are contained in the [exporters directory](./exporters).
+
+| Exporter                              | Metrics | Traces |
+| :-----------------------------------: | :-----: | :----: |
+| [Jaeger](./exporters/jaeger/)         |         | ✓      |
+| [OTLP](./exporters/otlp/)             | ✓       | ✓      |
+| [Prometheus](./exporters/prometheus/) | ✓       |        |
+| [stdout](./exporters/stdout/)         | ✓       | ✓      |
+| [Zipkin](./exporters/zipkin/)         |         | ✓      |
+
+## Contributing
+
+See the [contributing documentation](CONTRIBUTING.md).
diff --git a/vendor/go.opentelemetry.io/otel/RELEASING.md b/vendor/go.opentelemetry.io/otel/RELEASING.md
new file mode 100644
index 0000000000..77d56c9365
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/RELEASING.md
@@ -0,0 +1,127 @@
+# Release Process
+
+## Semantic Convention Generation
+
+New versions of the [OpenTelemetry specification] mean new versions of the `semconv` package need to be generated.
+The `semconv-generate` make target is used for this.
+
+1. Checkout a local copy of the [OpenTelemetry specification] to the desired release tag.
+2. Pull the latest `otel/semconvgen` image: `docker pull otel/semconvgen:latest`
+3. Run the `make semconv-generate ...` target from this repository.
+
+For example,
+
+```sh
+export TAG="v1.13.0" # Change to the release version you are generating.
+export OTEL_SPEC_REPO="/absolute/path/to/opentelemetry-specification"
+git -C "$OTEL_SPEC_REPO" checkout "tags/$TAG" -b "$TAG"
+docker pull otel/semconvgen:latest
+make semconv-generate # Uses the exported TAG and OTEL_SPEC_REPO.
+```
+
+This should create a new sub-package of [`semconv`](./semconv).
+Ensure things look correct before submitting a pull request to include the addition.
+
+**Note**, the generation code was changed to generate versions >= 1.13.
+To generate versions prior to this, checkout the old release of this repository (i.e. [2fe8861](https://github.com/open-telemetry/opentelemetry-go/commit/2fe8861a24e20088c065b116089862caf9e3cd8b)).
+
+## Pre-Release
+
+First, decide which module sets will be released and update their versions
+in `versions.yaml`.  Commit this change to a new branch.
+
+Update go.mod for submodules to depend on the new release which will happen in the next step.
+
+1. Run the `prerelease` make target. It creates a branch
+    `prerelease_<module set>_<new tag>` that will contain all release changes.
+
+    ```
+    make prerelease MODSET=<module set>
+    ```
+
+2. Verify the changes.
+
+    ```
+    git diff ...prerelease_<module set>_<new tag>
+    ```
+
+    This should have changed the version for all modules to be `<new tag>`.
+    If these changes look correct, merge them into your pre-release branch:
+
+    ```go
+    git merge prerelease_<module set>_<new tag>
+    ```
+
+3. Update the [Changelog](./CHANGELOG.md).
+   - Make sure all relevant changes for this release are included and are in language that non-contributors to the project can understand.
+       To verify this, you can look directly at the commits since the `<last tag>`.
+
+       ```
+       git --no-pager log --pretty=oneline "<last tag>..HEAD"
+       ```
+
+   - Move all the `Unreleased` changes into a new section following the title scheme (`[<new tag>] - <date of release>`).
+   - Update all the appropriate links at the bottom.
+
+4. Push the changes to upstream and create a Pull Request on GitHub.
+    Be sure to include the curated changes from the [Changelog](./CHANGELOG.md) in the description.
+
+## Tag
+
+Once the Pull Request with all the version changes has been approved and merged it is time to tag the merged commit.
+
+***IMPORTANT***: It is critical you use the same tag that you used in the Pre-Release step!
+Failure to do so will leave things in a broken state. As long as you do not
+change `versions.yaml` between pre-release and this step, things should be fine.
+
+***IMPORTANT***: [There is currently no way to remove an incorrectly tagged version of a Go module](https://github.com/golang/go/issues/34189).
+It is critical you make sure the version you push upstream is correct.
+[Failure to do so will lead to minor emergencies and tough to work around](https://github.com/open-telemetry/opentelemetry-go/issues/331).
+
+1. For each module set that will be released, run the `add-tags` make target
+    using the `<commit-hash>` of the commit on the main branch for the merged Pull Request.
+
+    ```
+    make add-tags MODSET=<module set> COMMIT=<commit hash>
+    ```
+
+    It should only be necessary to provide an explicit `COMMIT` value if the
+    current `HEAD` of your working directory is not the correct commit.
+
+2. Push tags to the upstream remote (not your fork: `github.com/open-telemetry/opentelemetry-go.git`).
+    Make sure you push all sub-modules as well.
+
+    ```
+    git push upstream <new tag>
+    git push upstream <submodules-path/new tag>
+    ...
+    ```
+
+## Release
+
+Finally create a Release for the new `<new tag>` on GitHub.
+The release body should include all the release notes from the Changelog for this release.
+
+## Verify Examples
+
+After releasing verify that examples build outside of the repository.
+
+```
+./verify_examples.sh
+```
+
+The script copies examples into a different directory removes any `replace` declarations in `go.mod` and builds them.
+This ensures they build with the published release, not the local copy.
+
+## Post-Release
+
+### Contrib Repository
+
+Once verified be sure to [make a release for the `contrib` repository](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/RELEASING.md) that uses this release.
+
+### Website Documentation
+
+Update [the documentation](./website_docs) for [the OpenTelemetry website](https://opentelemetry.io/docs/go/).
+Importantly, bump any package versions referenced to be the latest one you just released and ensure all code examples still compile and are accurate.
+
+[OpenTelemetry specification]: https://github.com/open-telemetry/opentelemetry-specification
diff --git a/vendor/go.opentelemetry.io/otel/VERSIONING.md b/vendor/go.opentelemetry.io/otel/VERSIONING.md
new file mode 100644
index 0000000000..412f1e362b
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/VERSIONING.md
@@ -0,0 +1,224 @@
+# Versioning
+
+This document describes the versioning policy for this repository. This policy
+is designed so the following goals can be achieved.
+
+**Users are provided a codebase of value that is stable and secure.**
+
+## Policy
+
+* Versioning of this project will be idiomatic of a Go project using [Go
+  modules](https://github.com/golang/go/wiki/Modules).
+  * [Semantic import
+    versioning](https://github.com/golang/go/wiki/Modules#semantic-import-versioning)
+    will be used.
+    * Versions will comply with [semver
+      2.0](https://semver.org/spec/v2.0.0.html) with the following exceptions.
+      * New methods may be added to exported API interfaces. All exported
+        interfaces that fall within this exception will include the following
+        paragraph in their public documentation.
+
+        > Warning: methods may be added to this interface in minor releases.
+
+    * If a module is version `v2` or higher, the major version of the module
+      must be included as a `/vN` at the end of the module paths used in
+      `go.mod` files (e.g., `module go.opentelemetry.io/otel/v2`, `require
+      go.opentelemetry.io/otel/v2 v2.0.1`) and in the package import path
+      (e.g., `import "go.opentelemetry.io/otel/v2/trace"`). This includes the
+      paths used in `go get` commands (e.g., `go get
+      go.opentelemetry.io/otel/v2@v2.0.1`.  Note there is both a `/v2` and a
+      `@v2.0.1` in that example. One way to think about it is that the module
+      name now includes the `/v2`, so include `/v2` whenever you are using the
+      module name).
+    * If a module is version `v0` or `v1`, do not include the major version in
+      either the module path or the import path.
+  * Modules will be used to encapsulate signals and components.
+    * Experimental modules still under active development will be versioned at
+      `v0` to imply the stability guarantee defined by
+      [semver](https://semver.org/spec/v2.0.0.html#spec-item-4).
+
+      > Major version zero (0.y.z) is for initial development. Anything MAY
+      > change at any time. The public API SHOULD NOT be considered stable.
+
+    * Mature modules for which we guarantee a stable public API will be versioned
+      with a major version greater than `v0`.
+      * The decision to make a module stable will be made on a case-by-case
+        basis by the maintainers of this project.
+    * Experimental modules will start their versioning at `v0.0.0` and will
+      increment their minor version when backwards incompatible changes are
+      released and increment their patch version when backwards compatible
+      changes are released.
+    * All stable modules that use the same major version number will use the
+      same entire version number.
+      * Stable modules may be released with an incremented minor or patch
+        version even though that module has not been changed, but rather so
+        that it will remain at the same version as other stable modules that
+        did undergo change.
+      * When an experimental module becomes stable a new stable module version
+        will be released and will include this now stable module. The new
+        stable module version will be an increment of the minor version number
+        and will be applied to all existing stable modules as well as the newly
+        stable module being released.
+* Versioning of the associated [contrib
+  repository](https://github.com/open-telemetry/opentelemetry-go-contrib) of
+  this project will be idiomatic of a Go project using [Go
+  modules](https://github.com/golang/go/wiki/Modules).
+  * [Semantic import
+    versioning](https://github.com/golang/go/wiki/Modules#semantic-import-versioning)
+    will be used.
+    * Versions will comply with [semver 2.0](https://semver.org/spec/v2.0.0.html).
+    * If a module is version `v2` or higher, the
+      major version of the module must be included as a `/vN` at the end of the
+      module paths used in `go.mod` files (e.g., `module
+      go.opentelemetry.io/contrib/instrumentation/host/v2`, `require
+      go.opentelemetry.io/contrib/instrumentation/host/v2 v2.0.1`) and in the
+      package import path (e.g., `import
+      "go.opentelemetry.io/contrib/instrumentation/host/v2"`). This includes
+      the paths used in `go get` commands (e.g., `go get
+      go.opentelemetry.io/contrib/instrumentation/host/v2@v2.0.1`.  Note there
+      is both a `/v2` and a `@v2.0.1` in that example. One way to think about
+      it is that the module name now includes the `/v2`, so include `/v2`
+      whenever you are using the module name).
+    * If a module is version `v0` or `v1`, do not include the major version
+      in either the module path or the import path.
+  * In addition to public APIs, telemetry produced by stable instrumentation
+    will remain stable and backwards compatible. This is to avoid breaking
+    alerts and dashboard.
+  * Modules will be used to encapsulate instrumentation, detectors, exporters,
+    propagators, and any other independent sets of related components.
+    * Experimental modules still under active development will be versioned at
+      `v0` to imply the stability guarantee defined by
+      [semver](https://semver.org/spec/v2.0.0.html#spec-item-4).
+
+      > Major version zero (0.y.z) is for initial development. Anything MAY
+      > change at any time. The public API SHOULD NOT be considered stable.
+
+    * Mature modules for which we guarantee a stable public API and telemetry will
+      be versioned with a major version greater than `v0`.
+    * Experimental modules will start their versioning at `v0.0.0` and will
+      increment their minor version when backwards incompatible changes are
+      released and increment their patch version when backwards compatible
+      changes are released.
+    * Stable contrib modules cannot depend on experimental modules from this
+      project.
+    * All stable contrib modules of the same major version with this project
+      will use the same entire version as this project.
+      * Stable modules may be released with an incremented minor or patch
+        version even though that module's code has not been changed. Instead
+        the only change that will have been included is to have updated that
+        modules dependency on this project's stable APIs.
+      * When an experimental module in contrib becomes stable a new stable
+        module version will be released and will include this now stable
+        module. The new stable module version will be an increment of the minor
+        version number and will be applied to all existing stable contrib
+        modules, this project's modules, and the newly stable module being
+        released.
+  * Contrib modules will be kept up to date with this project's releases.
+    * Due to the dependency contrib modules will implicitly have on this
+      project's modules the release of stable contrib modules to match the
+      released version number will be staggered after this project's release.
+      There is no explicit time guarantee for how long after this projects
+      release the contrib release will be. Effort should be made to keep them
+      as close in time as possible.
+    * No additional stable release in this project can be made until the
+      contrib repository has a matching stable release.
+    * No release can be made in the contrib repository after this project's
+      stable release except for a stable release of the contrib repository.
+* GitHub releases will be made for all releases.
+* Go modules will be made available at Go package mirrors.
+
+## Example Versioning Lifecycle
+
+To better understand the implementation of the above policy the following
+example is provided. This project is simplified to include only the following
+modules and their versions:
+
+* `otel`: `v0.14.0`
+* `otel/trace`: `v0.14.0`
+* `otel/metric`: `v0.14.0`
+* `otel/baggage`: `v0.14.0`
+* `otel/sdk/trace`: `v0.14.0`
+* `otel/sdk/metric`: `v0.14.0`
+
+These modules have been developed to a point where the `otel/trace`,
+`otel/baggage`, and `otel/sdk/trace` modules have reached a point that they
+should be considered for a stable release. The `otel/metric` and
+`otel/sdk/metric` are still under active development and the `otel` module
+depends on both `otel/trace` and `otel/metric`.
+
+The `otel` package is refactored to remove its dependencies on `otel/metric` so
+it can be released as stable as well. With that done the following release
+candidates are made:
+
+* `otel`: `v1.0.0-RC1`
+* `otel/trace`: `v1.0.0-RC1`
+* `otel/baggage`: `v1.0.0-RC1`
+* `otel/sdk/trace`: `v1.0.0-RC1`
+
+The `otel/metric` and `otel/sdk/metric` modules remain at `v0.14.0`.
+
+A few minor issues are discovered in the `otel/trace` package. These issues are
+resolved with some minor, but backwards incompatible, changes and are released
+as a second release candidate:
+
+* `otel`: `v1.0.0-RC2`
+* `otel/trace`: `v1.0.0-RC2`
+* `otel/baggage`: `v1.0.0-RC2`
+* `otel/sdk/trace`: `v1.0.0-RC2`
+
+Notice that all module version numbers are incremented to adhere to our
+versioning policy.
+
+After these release candidates have been evaluated to satisfaction, they are
+released as version `v1.0.0`.
+
+* `otel`: `v1.0.0`
+* `otel/trace`: `v1.0.0`
+* `otel/baggage`: `v1.0.0`
+* `otel/sdk/trace`: `v1.0.0`
+
+Since both the `go` utility and the Go module system support [the semantic
+versioning definition of
+precedence](https://semver.org/spec/v2.0.0.html#spec-item-11), this release
+will correctly be interpreted as the successor to the previous release
+candidates.
+
+Active development of this project continues. The `otel/metric` module now has
+backwards incompatible changes to its API that need to be released and the
+`otel/baggage` module has a minor bug fix that needs to be released. The
+following release is made:
+
+* `otel`: `v1.0.1`
+* `otel/trace`: `v1.0.1`
+* `otel/metric`: `v0.15.0`
+* `otel/baggage`: `v1.0.1`
+* `otel/sdk/trace`: `v1.0.1`
+* `otel/sdk/metric`: `v0.15.0`
+
+Notice that, again, all stable module versions are incremented in unison and
+the `otel/sdk/metric` package, which depends on the `otel/metric` package, also
+bumped its version. This bump of the `otel/sdk/metric` package makes sense
+given their coupling, though it is not explicitly required by our versioning
+policy.
+
+As we progress, the `otel/metric` and `otel/sdk/metric` packages have reached a
+point where they should be evaluated for stability. The `otel` module is
+reintegrated with the `otel/metric` package and the following release is made:
+
+* `otel`: `v1.1.0-RC1`
+* `otel/trace`: `v1.1.0-RC1`
+* `otel/metric`: `v1.1.0-RC1`
+* `otel/baggage`: `v1.1.0-RC1`
+* `otel/sdk/trace`: `v1.1.0-RC1`
+* `otel/sdk/metric`: `v1.1.0-RC1`
+
+All the modules are evaluated and determined to a viable stable release. They
+are then released as version `v1.1.0` (the minor version is incremented to
+indicate the addition of new signal).
+
+* `otel`: `v1.1.0`
+* `otel/trace`: `v1.1.0`
+* `otel/metric`: `v1.1.0`
+* `otel/baggage`: `v1.1.0`
+* `otel/sdk/trace`: `v1.1.0`
+* `otel/sdk/metric`: `v1.1.0`
diff --git a/vendor/go.opentelemetry.io/otel/attribute/doc.go b/vendor/go.opentelemetry.io/otel/attribute/doc.go
new file mode 100644
index 0000000000..dafe7424df
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/doc.go
@@ -0,0 +1,16 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package attribute provides key and value attributes.
+package attribute // import "go.opentelemetry.io/otel/attribute"
diff --git a/vendor/go.opentelemetry.io/otel/attribute/encoder.go b/vendor/go.opentelemetry.io/otel/attribute/encoder.go
new file mode 100644
index 0000000000..fe2bc5766c
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/encoder.go
@@ -0,0 +1,146 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package attribute // import "go.opentelemetry.io/otel/attribute"
+
+import (
+	"bytes"
+	"sync"
+	"sync/atomic"
+)
+
+type (
+	// Encoder is a mechanism for serializing an attribute set into a specific
+	// string representation that supports caching, to avoid repeated
+	// serialization. An example could be an exporter encoding the attribute
+	// set into a wire representation.
+	Encoder interface {
+		// Encode returns the serialized encoding of the attribute set using
+		// its Iterator. This result may be cached by a attribute.Set.
+		Encode(iterator Iterator) string
+
+		// ID returns a value that is unique for each class of attribute
+		// encoder. Attribute encoders allocate these using `NewEncoderID`.
+		ID() EncoderID
+	}
+
+	// EncoderID is used to identify distinct Encoder
+	// implementations, for caching encoded results.
+	EncoderID struct {
+		value uint64
+	}
+
+	// defaultAttrEncoder uses a sync.Pool of buffers to reduce the number of
+	// allocations used in encoding attributes. This implementation encodes a
+	// comma-separated list of key=value, with '/'-escaping of '=', ',', and
+	// '\'.
+	defaultAttrEncoder struct {
+		// pool is a pool of attribute set builders. The buffers in this pool
+		// grow to a size that most attribute encodings will not allocate new
+		// memory.
+		pool sync.Pool // *bytes.Buffer
+	}
+)
+
+// escapeChar is used to ensure uniqueness of the attribute encoding where
+// keys or values contain either '=' or ','.  Since there is no parser needed
+// for this encoding and its only requirement is to be unique, this choice is
+// arbitrary.  Users will see these in some exporters (e.g., stdout), so the
+// backslash ('\') is used as a conventional choice.
+const escapeChar = '\\'
+
+var (
+	_ Encoder = &defaultAttrEncoder{}
+
+	// encoderIDCounter is for generating IDs for other attribute encoders.
+	encoderIDCounter uint64
+
+	defaultEncoderOnce     sync.Once
+	defaultEncoderID       = NewEncoderID()
+	defaultEncoderInstance *defaultAttrEncoder
+)
+
+// NewEncoderID returns a unique attribute encoder ID. It should be called
+// once per each type of attribute encoder. Preferably in init() or in var
+// definition.
+func NewEncoderID() EncoderID {
+	return EncoderID{value: atomic.AddUint64(&encoderIDCounter, 1)}
+}
+
+// DefaultEncoder returns an attribute encoder that encodes attributes in such
+// a way that each escaped attribute's key is followed by an equal sign and
+// then by an escaped attribute's value. All key-value pairs are separated by
+// a comma.
+//
+// Escaping is done by prepending a backslash before either a backslash, equal
+// sign or a comma.
+func DefaultEncoder() Encoder {
+	defaultEncoderOnce.Do(func() {
+		defaultEncoderInstance = &defaultAttrEncoder{
+			pool: sync.Pool{
+				New: func() interface{} {
+					return &bytes.Buffer{}
+				},
+			},
+		}
+	})
+	return defaultEncoderInstance
+}
+
+// Encode is a part of an implementation of the AttributeEncoder interface.
+func (d *defaultAttrEncoder) Encode(iter Iterator) string {
+	buf := d.pool.Get().(*bytes.Buffer)
+	defer d.pool.Put(buf)
+	buf.Reset()
+
+	for iter.Next() {
+		i, keyValue := iter.IndexedAttribute()
+		if i > 0 {
+			_, _ = buf.WriteRune(',')
+		}
+		copyAndEscape(buf, string(keyValue.Key))
+
+		_, _ = buf.WriteRune('=')
+
+		if keyValue.Value.Type() == STRING {
+			copyAndEscape(buf, keyValue.Value.AsString())
+		} else {
+			_, _ = buf.WriteString(keyValue.Value.Emit())
+		}
+	}
+	return buf.String()
+}
+
+// ID is a part of an implementation of the AttributeEncoder interface.
+func (*defaultAttrEncoder) ID() EncoderID {
+	return defaultEncoderID
+}
+
+// copyAndEscape escapes `=`, `,` and its own escape character (`\`),
+// making the default encoding unique.
+func copyAndEscape(buf *bytes.Buffer, val string) {
+	for _, ch := range val {
+		switch ch {
+		case '=', ',', escapeChar:
+			_, _ = buf.WriteRune(escapeChar)
+		}
+		_, _ = buf.WriteRune(ch)
+	}
+}
+
+// Valid returns true if this encoder ID was allocated by
+// `NewEncoderID`.  Invalid encoder IDs will not be cached.
+func (id EncoderID) Valid() bool {
+	return id.value != 0
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/iterator.go b/vendor/go.opentelemetry.io/otel/attribute/iterator.go
new file mode 100644
index 0000000000..841b271fb7
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/iterator.go
@@ -0,0 +1,161 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package attribute // import "go.opentelemetry.io/otel/attribute"
+
+// Iterator allows iterating over the set of attributes in order, sorted by
+// key.
+type Iterator struct {
+	storage *Set
+	idx     int
+}
+
+// MergeIterator supports iterating over two sets of attributes while
+// eliminating duplicate values from the combined set. The first iterator
+// value takes precedence.
+type MergeIterator struct {
+	one     oneIterator
+	two     oneIterator
+	current KeyValue
+}
+
+type oneIterator struct {
+	iter Iterator
+	done bool
+	attr KeyValue
+}
+
+// Next moves the iterator to the next position. Returns false if there are no
+// more attributes.
+func (i *Iterator) Next() bool {
+	i.idx++
+	return i.idx < i.Len()
+}
+
+// Label returns current KeyValue. Must be called only after Next returns
+// true.
+//
+// Deprecated: Use Attribute instead.
+func (i *Iterator) Label() KeyValue {
+	return i.Attribute()
+}
+
+// Attribute returns the current KeyValue of the Iterator. It must be called
+// only after Next returns true.
+func (i *Iterator) Attribute() KeyValue {
+	kv, _ := i.storage.Get(i.idx)
+	return kv
+}
+
+// IndexedLabel returns current index and attribute. Must be called only
+// after Next returns true.
+//
+// Deprecated: Use IndexedAttribute instead.
+func (i *Iterator) IndexedLabel() (int, KeyValue) {
+	return i.idx, i.Attribute()
+}
+
+// IndexedAttribute returns current index and attribute. Must be called only
+// after Next returns true.
+func (i *Iterator) IndexedAttribute() (int, KeyValue) {
+	return i.idx, i.Attribute()
+}
+
+// Len returns a number of attributes in the iterated set.
+func (i *Iterator) Len() int {
+	return i.storage.Len()
+}
+
+// ToSlice is a convenience function that creates a slice of attributes from
+// the passed iterator. The iterator is set up to start from the beginning
+// before creating the slice.
+func (i *Iterator) ToSlice() []KeyValue {
+	l := i.Len()
+	if l == 0 {
+		return nil
+	}
+	i.idx = -1
+	slice := make([]KeyValue, 0, l)
+	for i.Next() {
+		slice = append(slice, i.Attribute())
+	}
+	return slice
+}
+
+// NewMergeIterator returns a MergeIterator for merging two attribute sets.
+// Duplicates are resolved by taking the value from the first set.
+func NewMergeIterator(s1, s2 *Set) MergeIterator {
+	mi := MergeIterator{
+		one: makeOne(s1.Iter()),
+		two: makeOne(s2.Iter()),
+	}
+	return mi
+}
+
+func makeOne(iter Iterator) oneIterator {
+	oi := oneIterator{
+		iter: iter,
+	}
+	oi.advance()
+	return oi
+}
+
+func (oi *oneIterator) advance() {
+	if oi.done = !oi.iter.Next(); !oi.done {
+		oi.attr = oi.iter.Attribute()
+	}
+}
+
+// Next returns true if there is another attribute available.
+func (m *MergeIterator) Next() bool {
+	if m.one.done && m.two.done {
+		return false
+	}
+	if m.one.done {
+		m.current = m.two.attr
+		m.two.advance()
+		return true
+	}
+	if m.two.done {
+		m.current = m.one.attr
+		m.one.advance()
+		return true
+	}
+	if m.one.attr.Key == m.two.attr.Key {
+		m.current = m.one.attr // first iterator attribute value wins
+		m.one.advance()
+		m.two.advance()
+		return true
+	}
+	if m.one.attr.Key < m.two.attr.Key {
+		m.current = m.one.attr
+		m.one.advance()
+		return true
+	}
+	m.current = m.two.attr
+	m.two.advance()
+	return true
+}
+
+// Label returns the current value after Next() returns true.
+//
+// Deprecated: Use Attribute instead.
+func (m *MergeIterator) Label() KeyValue {
+	return m.current
+}
+
+// Attribute returns the current value after Next() returns true.
+func (m *MergeIterator) Attribute() KeyValue {
+	return m.current
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/key.go b/vendor/go.opentelemetry.io/otel/attribute/key.go
new file mode 100644
index 0000000000..0656a04e43
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/key.go
@@ -0,0 +1,134 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package attribute // import "go.opentelemetry.io/otel/attribute"
+
+// Key represents the key part in key-value pairs. It's a string. The
+// allowed character set in the key depends on the use of the key.
+type Key string
+
+// Bool creates a KeyValue instance with a BOOL Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Bool(name, value).
+func (k Key) Bool(v bool) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: BoolValue(v),
+	}
+}
+
+// BoolSlice creates a KeyValue instance with a BOOLSLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- BoolSlice(name, value).
+func (k Key) BoolSlice(v []bool) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: BoolSliceValue(v),
+	}
+}
+
+// Int creates a KeyValue instance with an INT64 Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Int(name, value).
+func (k Key) Int(v int) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: IntValue(v),
+	}
+}
+
+// IntSlice creates a KeyValue instance with an INT64SLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- IntSlice(name, value).
+func (k Key) IntSlice(v []int) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: IntSliceValue(v),
+	}
+}
+
+// Int64 creates a KeyValue instance with an INT64 Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Int64(name, value).
+func (k Key) Int64(v int64) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: Int64Value(v),
+	}
+}
+
+// Int64Slice creates a KeyValue instance with an INT64SLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Int64Slice(name, value).
+func (k Key) Int64Slice(v []int64) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: Int64SliceValue(v),
+	}
+}
+
+// Float64 creates a KeyValue instance with a FLOAT64 Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Float64(name, value).
+func (k Key) Float64(v float64) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: Float64Value(v),
+	}
+}
+
+// Float64Slice creates a KeyValue instance with a FLOAT64SLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- Float64(name, value).
+func (k Key) Float64Slice(v []float64) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: Float64SliceValue(v),
+	}
+}
+
+// String creates a KeyValue instance with a STRING Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- String(name, value).
+func (k Key) String(v string) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: StringValue(v),
+	}
+}
+
+// StringSlice creates a KeyValue instance with a STRINGSLICE Value.
+//
+// If creating both a key and value at the same time, use the provided
+// convenience function instead -- StringSlice(name, value).
+func (k Key) StringSlice(v []string) KeyValue {
+	return KeyValue{
+		Key:   k,
+		Value: StringSliceValue(v),
+	}
+}
+
+// Defined returns true for non-empty keys.
+func (k Key) Defined() bool {
+	return len(k) != 0
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/kv.go b/vendor/go.opentelemetry.io/otel/attribute/kv.go
new file mode 100644
index 0000000000..1ddf3ce058
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/kv.go
@@ -0,0 +1,86 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package attribute // import "go.opentelemetry.io/otel/attribute"
+
+import (
+	"fmt"
+)
+
+// KeyValue holds a key and value pair.
+type KeyValue struct {
+	Key   Key
+	Value Value
+}
+
+// Valid returns if kv is a valid OpenTelemetry attribute.
+func (kv KeyValue) Valid() bool {
+	return kv.Key.Defined() && kv.Value.Type() != INVALID
+}
+
+// Bool creates a KeyValue with a BOOL Value type.
+func Bool(k string, v bool) KeyValue {
+	return Key(k).Bool(v)
+}
+
+// BoolSlice creates a KeyValue with a BOOLSLICE Value type.
+func BoolSlice(k string, v []bool) KeyValue {
+	return Key(k).BoolSlice(v)
+}
+
+// Int creates a KeyValue with an INT64 Value type.
+func Int(k string, v int) KeyValue {
+	return Key(k).Int(v)
+}
+
+// IntSlice creates a KeyValue with an INT64SLICE Value type.
+func IntSlice(k string, v []int) KeyValue {
+	return Key(k).IntSlice(v)
+}
+
+// Int64 creates a KeyValue with an INT64 Value type.
+func Int64(k string, v int64) KeyValue {
+	return Key(k).Int64(v)
+}
+
+// Int64Slice creates a KeyValue with an INT64SLICE Value type.
+func Int64Slice(k string, v []int64) KeyValue {
+	return Key(k).Int64Slice(v)
+}
+
+// Float64 creates a KeyValue with a FLOAT64 Value type.
+func Float64(k string, v float64) KeyValue {
+	return Key(k).Float64(v)
+}
+
+// Float64Slice creates a KeyValue with a FLOAT64SLICE Value type.
+func Float64Slice(k string, v []float64) KeyValue {
+	return Key(k).Float64Slice(v)
+}
+
+// String creates a KeyValue with a STRING Value type.
+func String(k, v string) KeyValue {
+	return Key(k).String(v)
+}
+
+// StringSlice creates a KeyValue with a STRINGSLICE Value type.
+func StringSlice(k string, v []string) KeyValue {
+	return Key(k).StringSlice(v)
+}
+
+// Stringer creates a new key-value pair with a passed name and a string
+// value generated by the passed Stringer interface.
+func Stringer(k string, v fmt.Stringer) KeyValue {
+	return Key(k).String(v.String())
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/set.go b/vendor/go.opentelemetry.io/otel/attribute/set.go
new file mode 100644
index 0000000000..26be598322
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/set.go
@@ -0,0 +1,424 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package attribute // import "go.opentelemetry.io/otel/attribute"
+
+import (
+	"encoding/json"
+	"reflect"
+	"sort"
+)
+
+type (
+	// Set is the representation for a distinct attribute set. It manages an
+	// immutable set of attributes, with an internal cache for storing
+	// attribute encodings.
+	//
+	// This type supports the Equivalent method of comparison using values of
+	// type Distinct.
+	Set struct {
+		equivalent Distinct
+	}
+
+	// Distinct wraps a variable-size array of KeyValue, constructed with keys
+	// in sorted order. This can be used as a map key or for equality checking
+	// between Sets.
+	Distinct struct {
+		iface interface{}
+	}
+
+	// Filter supports removing certain attributes from attribute sets. When
+	// the filter returns true, the attribute will be kept in the filtered
+	// attribute set. When the filter returns false, the attribute is excluded
+	// from the filtered attribute set, and the attribute instead appears in
+	// the removed list of excluded attributes.
+	Filter func(KeyValue) bool
+
+	// Sortable implements sort.Interface, used for sorting KeyValue. This is
+	// an exported type to support a memory optimization. A pointer to one of
+	// these is needed for the call to sort.Stable(), which the caller may
+	// provide in order to avoid an allocation. See NewSetWithSortable().
+	Sortable []KeyValue
+)
+
+var (
+	// keyValueType is used in computeDistinctReflect.
+	keyValueType = reflect.TypeOf(KeyValue{})
+
+	// emptySet is returned for empty attribute sets.
+	emptySet = &Set{
+		equivalent: Distinct{
+			iface: [0]KeyValue{},
+		},
+	}
+)
+
+// EmptySet returns a reference to a Set with no elements.
+//
+// This is a convenience provided for optimized calling utility.
+func EmptySet() *Set {
+	return emptySet
+}
+
+// reflectValue abbreviates reflect.ValueOf(d).
+func (d Distinct) reflectValue() reflect.Value {
+	return reflect.ValueOf(d.iface)
+}
+
+// Valid returns true if this value refers to a valid Set.
+func (d Distinct) Valid() bool {
+	return d.iface != nil
+}
+
+// Len returns the number of attributes in this set.
+func (l *Set) Len() int {
+	if l == nil || !l.equivalent.Valid() {
+		return 0
+	}
+	return l.equivalent.reflectValue().Len()
+}
+
+// Get returns the KeyValue at ordered position idx in this set.
+func (l *Set) Get(idx int) (KeyValue, bool) {
+	if l == nil {
+		return KeyValue{}, false
+	}
+	value := l.equivalent.reflectValue()
+
+	if idx >= 0 && idx < value.Len() {
+		// Note: The Go compiler successfully avoids an allocation for
+		// the interface{} conversion here:
+		return value.Index(idx).Interface().(KeyValue), true
+	}
+
+	return KeyValue{}, false
+}
+
+// Value returns the value of a specified key in this set.
+func (l *Set) Value(k Key) (Value, bool) {
+	if l == nil {
+		return Value{}, false
+	}
+	rValue := l.equivalent.reflectValue()
+	vlen := rValue.Len()
+
+	idx := sort.Search(vlen, func(idx int) bool {
+		return rValue.Index(idx).Interface().(KeyValue).Key >= k
+	})
+	if idx >= vlen {
+		return Value{}, false
+	}
+	keyValue := rValue.Index(idx).Interface().(KeyValue)
+	if k == keyValue.Key {
+		return keyValue.Value, true
+	}
+	return Value{}, false
+}
+
+// HasValue tests whether a key is defined in this set.
+func (l *Set) HasValue(k Key) bool {
+	if l == nil {
+		return false
+	}
+	_, ok := l.Value(k)
+	return ok
+}
+
+// Iter returns an iterator for visiting the attributes in this set.
+func (l *Set) Iter() Iterator {
+	return Iterator{
+		storage: l,
+		idx:     -1,
+	}
+}
+
+// ToSlice returns the set of attributes belonging to this set, sorted, where
+// keys appear no more than once.
+func (l *Set) ToSlice() []KeyValue {
+	iter := l.Iter()
+	return iter.ToSlice()
+}
+
+// Equivalent returns a value that may be used as a map key. The Distinct type
+// guarantees that the result will equal the equivalent. Distinct value of any
+// attribute set with the same elements as this, where sets are made unique by
+// choosing the last value in the input for any given key.
+func (l *Set) Equivalent() Distinct {
+	if l == nil || !l.equivalent.Valid() {
+		return emptySet.equivalent
+	}
+	return l.equivalent
+}
+
+// Equals returns true if the argument set is equivalent to this set.
+func (l *Set) Equals(o *Set) bool {
+	return l.Equivalent() == o.Equivalent()
+}
+
+// Encoded returns the encoded form of this set, according to encoder.
+func (l *Set) Encoded(encoder Encoder) string {
+	if l == nil || encoder == nil {
+		return ""
+	}
+
+	return encoder.Encode(l.Iter())
+}
+
+func empty() Set {
+	return Set{
+		equivalent: emptySet.equivalent,
+	}
+}
+
+// NewSet returns a new Set. See the documentation for
+// NewSetWithSortableFiltered for more details.
+//
+// Except for empty sets, this method adds an additional allocation compared
+// with calls that include a Sortable.
+func NewSet(kvs ...KeyValue) Set {
+	// Check for empty set.
+	if len(kvs) == 0 {
+		return empty()
+	}
+	s, _ := NewSetWithSortableFiltered(kvs, new(Sortable), nil)
+	return s
+}
+
+// NewSetWithSortable returns a new Set. See the documentation for
+// NewSetWithSortableFiltered for more details.
+//
+// This call includes a Sortable option as a memory optimization.
+func NewSetWithSortable(kvs []KeyValue, tmp *Sortable) Set {
+	// Check for empty set.
+	if len(kvs) == 0 {
+		return empty()
+	}
+	s, _ := NewSetWithSortableFiltered(kvs, tmp, nil)
+	return s
+}
+
+// NewSetWithFiltered returns a new Set. See the documentation for
+// NewSetWithSortableFiltered for more details.
+//
+// This call includes a Filter to include/exclude attribute keys from the
+// return value. Excluded keys are returned as a slice of attribute values.
+func NewSetWithFiltered(kvs []KeyValue, filter Filter) (Set, []KeyValue) {
+	// Check for empty set.
+	if len(kvs) == 0 {
+		return empty(), nil
+	}
+	return NewSetWithSortableFiltered(kvs, new(Sortable), filter)
+}
+
+// NewSetWithSortableFiltered returns a new Set.
+//
+// Duplicate keys are eliminated by taking the last value.  This
+// re-orders the input slice so that unique last-values are contiguous
+// at the end of the slice.
+//
+// This ensures the following:
+//
+// - Last-value-wins semantics
+// - Caller sees the reordering, but doesn't lose values
+// - Repeated call preserve last-value wins.
+//
+// Note that methods are defined on Set, although this returns Set. Callers
+// can avoid memory allocations by:
+//
+// - allocating a Sortable for use as a temporary in this method
+// - allocating a Set for storing the return value of this constructor.
+//
+// The result maintains a cache of encoded attributes, by attribute.EncoderID.
+// This value should not be copied after its first use.
+//
+// The second []KeyValue return value is a list of attributes that were
+// excluded by the Filter (if non-nil).
+func NewSetWithSortableFiltered(kvs []KeyValue, tmp *Sortable, filter Filter) (Set, []KeyValue) {
+	// Check for empty set.
+	if len(kvs) == 0 {
+		return empty(), nil
+	}
+
+	*tmp = kvs
+
+	// Stable sort so the following de-duplication can implement
+	// last-value-wins semantics.
+	sort.Stable(tmp)
+
+	*tmp = nil
+
+	position := len(kvs) - 1
+	offset := position - 1
+
+	// The requirements stated above require that the stable
+	// result be placed in the end of the input slice, while
+	// overwritten values are swapped to the beginning.
+	//
+	// De-duplicate with last-value-wins semantics.  Preserve
+	// duplicate values at the beginning of the input slice.
+	for ; offset >= 0; offset-- {
+		if kvs[offset].Key == kvs[position].Key {
+			continue
+		}
+		position--
+		kvs[offset], kvs[position] = kvs[position], kvs[offset]
+	}
+	if filter != nil {
+		return filterSet(kvs[position:], filter)
+	}
+	return Set{
+		equivalent: computeDistinct(kvs[position:]),
+	}, nil
+}
+
+// filterSet reorders kvs so that included keys are contiguous at the end of
+// the slice, while excluded keys precede the included keys.
+func filterSet(kvs []KeyValue, filter Filter) (Set, []KeyValue) {
+	var excluded []KeyValue
+
+	// Move attributes that do not match the filter so they're adjacent before
+	// calling computeDistinct().
+	distinctPosition := len(kvs)
+
+	// Swap indistinct keys forward and distinct keys toward the
+	// end of the slice.
+	offset := len(kvs) - 1
+	for ; offset >= 0; offset-- {
+		if filter(kvs[offset]) {
+			distinctPosition--
+			kvs[offset], kvs[distinctPosition] = kvs[distinctPosition], kvs[offset]
+			continue
+		}
+	}
+	excluded = kvs[:distinctPosition]
+
+	return Set{
+		equivalent: computeDistinct(kvs[distinctPosition:]),
+	}, excluded
+}
+
+// Filter returns a filtered copy of this Set. See the documentation for
+// NewSetWithSortableFiltered for more details.
+func (l *Set) Filter(re Filter) (Set, []KeyValue) {
+	if re == nil {
+		return Set{
+			equivalent: l.equivalent,
+		}, nil
+	}
+
+	// Note: This could be refactored to avoid the temporary slice
+	// allocation, if it proves to be expensive.
+	return filterSet(l.ToSlice(), re)
+}
+
+// computeDistinct returns a Distinct using either the fixed- or
+// reflect-oriented code path, depending on the size of the input. The input
+// slice is assumed to already be sorted and de-duplicated.
+func computeDistinct(kvs []KeyValue) Distinct {
+	iface := computeDistinctFixed(kvs)
+	if iface == nil {
+		iface = computeDistinctReflect(kvs)
+	}
+	return Distinct{
+		iface: iface,
+	}
+}
+
+// computeDistinctFixed computes a Distinct for small slices. It returns nil
+// if the input is too large for this code path.
+func computeDistinctFixed(kvs []KeyValue) interface{} {
+	switch len(kvs) {
+	case 1:
+		ptr := new([1]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 2:
+		ptr := new([2]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 3:
+		ptr := new([3]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 4:
+		ptr := new([4]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 5:
+		ptr := new([5]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 6:
+		ptr := new([6]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 7:
+		ptr := new([7]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 8:
+		ptr := new([8]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 9:
+		ptr := new([9]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	case 10:
+		ptr := new([10]KeyValue)
+		copy((*ptr)[:], kvs)
+		return *ptr
+	default:
+		return nil
+	}
+}
+
+// computeDistinctReflect computes a Distinct using reflection, works for any
+// size input.
+func computeDistinctReflect(kvs []KeyValue) interface{} {
+	at := reflect.New(reflect.ArrayOf(len(kvs), keyValueType)).Elem()
+	for i, keyValue := range kvs {
+		*(at.Index(i).Addr().Interface().(*KeyValue)) = keyValue
+	}
+	return at.Interface()
+}
+
+// MarshalJSON returns the JSON encoding of the Set.
+func (l *Set) MarshalJSON() ([]byte, error) {
+	return json.Marshal(l.equivalent.iface)
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this exporter.
+func (l Set) MarshalLog() interface{} {
+	kvs := make(map[string]string)
+	for _, kv := range l.ToSlice() {
+		kvs[string(kv.Key)] = kv.Value.Emit()
+	}
+	return kvs
+}
+
+// Len implements sort.Interface.
+func (l *Sortable) Len() int {
+	return len(*l)
+}
+
+// Swap implements sort.Interface.
+func (l *Sortable) Swap(i, j int) {
+	(*l)[i], (*l)[j] = (*l)[j], (*l)[i]
+}
+
+// Less implements sort.Interface.
+func (l *Sortable) Less(i, j int) bool {
+	return (*l)[i].Key < (*l)[j].Key
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/type_string.go b/vendor/go.opentelemetry.io/otel/attribute/type_string.go
new file mode 100644
index 0000000000..e584b24776
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/type_string.go
@@ -0,0 +1,31 @@
+// Code generated by "stringer -type=Type"; DO NOT EDIT.
+
+package attribute
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[INVALID-0]
+	_ = x[BOOL-1]
+	_ = x[INT64-2]
+	_ = x[FLOAT64-3]
+	_ = x[STRING-4]
+	_ = x[BOOLSLICE-5]
+	_ = x[INT64SLICE-6]
+	_ = x[FLOAT64SLICE-7]
+	_ = x[STRINGSLICE-8]
+}
+
+const _Type_name = "INVALIDBOOLINT64FLOAT64STRINGBOOLSLICEINT64SLICEFLOAT64SLICESTRINGSLICE"
+
+var _Type_index = [...]uint8{0, 7, 11, 16, 23, 29, 38, 48, 60, 71}
+
+func (i Type) String() string {
+	if i < 0 || i >= Type(len(_Type_index)-1) {
+		return "Type(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Type_name[_Type_index[i]:_Type_index[i+1]]
+}
diff --git a/vendor/go.opentelemetry.io/otel/attribute/value.go b/vendor/go.opentelemetry.io/otel/attribute/value.go
new file mode 100644
index 0000000000..cb21dd5c09
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/attribute/value.go
@@ -0,0 +1,270 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package attribute // import "go.opentelemetry.io/otel/attribute"
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strconv"
+
+	"go.opentelemetry.io/otel/internal"
+	"go.opentelemetry.io/otel/internal/attribute"
+)
+
+//go:generate stringer -type=Type
+
+// Type describes the type of the data Value holds.
+type Type int // nolint: revive  // redefines builtin Type.
+
+// Value represents the value part in key-value pairs.
+type Value struct {
+	vtype    Type
+	numeric  uint64
+	stringly string
+	slice    interface{}
+}
+
+const (
+	// INVALID is used for a Value with no value set.
+	INVALID Type = iota
+	// BOOL is a boolean Type Value.
+	BOOL
+	// INT64 is a 64-bit signed integral Type Value.
+	INT64
+	// FLOAT64 is a 64-bit floating point Type Value.
+	FLOAT64
+	// STRING is a string Type Value.
+	STRING
+	// BOOLSLICE is a slice of booleans Type Value.
+	BOOLSLICE
+	// INT64SLICE is a slice of 64-bit signed integral numbers Type Value.
+	INT64SLICE
+	// FLOAT64SLICE is a slice of 64-bit floating point numbers Type Value.
+	FLOAT64SLICE
+	// STRINGSLICE is a slice of strings Type Value.
+	STRINGSLICE
+)
+
+// BoolValue creates a BOOL Value.
+func BoolValue(v bool) Value {
+	return Value{
+		vtype:   BOOL,
+		numeric: internal.BoolToRaw(v),
+	}
+}
+
+// BoolSliceValue creates a BOOLSLICE Value.
+func BoolSliceValue(v []bool) Value {
+	return Value{vtype: BOOLSLICE, slice: attribute.BoolSliceValue(v)}
+}
+
+// IntValue creates an INT64 Value.
+func IntValue(v int) Value {
+	return Int64Value(int64(v))
+}
+
+// IntSliceValue creates an INTSLICE Value.
+func IntSliceValue(v []int) Value {
+	var int64Val int64
+	cp := reflect.New(reflect.ArrayOf(len(v), reflect.TypeOf(int64Val)))
+	for i, val := range v {
+		cp.Elem().Index(i).SetInt(int64(val))
+	}
+	return Value{
+		vtype: INT64SLICE,
+		slice: cp.Elem().Interface(),
+	}
+}
+
+// Int64Value creates an INT64 Value.
+func Int64Value(v int64) Value {
+	return Value{
+		vtype:   INT64,
+		numeric: internal.Int64ToRaw(v),
+	}
+}
+
+// Int64SliceValue creates an INT64SLICE Value.
+func Int64SliceValue(v []int64) Value {
+	return Value{vtype: INT64SLICE, slice: attribute.Int64SliceValue(v)}
+}
+
+// Float64Value creates a FLOAT64 Value.
+func Float64Value(v float64) Value {
+	return Value{
+		vtype:   FLOAT64,
+		numeric: internal.Float64ToRaw(v),
+	}
+}
+
+// Float64SliceValue creates a FLOAT64SLICE Value.
+func Float64SliceValue(v []float64) Value {
+	return Value{vtype: FLOAT64SLICE, slice: attribute.Float64SliceValue(v)}
+}
+
+// StringValue creates a STRING Value.
+func StringValue(v string) Value {
+	return Value{
+		vtype:    STRING,
+		stringly: v,
+	}
+}
+
+// StringSliceValue creates a STRINGSLICE Value.
+func StringSliceValue(v []string) Value {
+	return Value{vtype: STRINGSLICE, slice: attribute.StringSliceValue(v)}
+}
+
+// Type returns a type of the Value.
+func (v Value) Type() Type {
+	return v.vtype
+}
+
+// AsBool returns the bool value. Make sure that the Value's type is
+// BOOL.
+func (v Value) AsBool() bool {
+	return internal.RawToBool(v.numeric)
+}
+
+// AsBoolSlice returns the []bool value. Make sure that the Value's type is
+// BOOLSLICE.
+func (v Value) AsBoolSlice() []bool {
+	if v.vtype != BOOLSLICE {
+		return nil
+	}
+	return v.asBoolSlice()
+}
+
+func (v Value) asBoolSlice() []bool {
+	return attribute.AsBoolSlice(v.slice)
+}
+
+// AsInt64 returns the int64 value. Make sure that the Value's type is
+// INT64.
+func (v Value) AsInt64() int64 {
+	return internal.RawToInt64(v.numeric)
+}
+
+// AsInt64Slice returns the []int64 value. Make sure that the Value's type is
+// INT64SLICE.
+func (v Value) AsInt64Slice() []int64 {
+	if v.vtype != INT64SLICE {
+		return nil
+	}
+	return v.asInt64Slice()
+}
+
+func (v Value) asInt64Slice() []int64 {
+	return attribute.AsInt64Slice(v.slice)
+}
+
+// AsFloat64 returns the float64 value. Make sure that the Value's
+// type is FLOAT64.
+func (v Value) AsFloat64() float64 {
+	return internal.RawToFloat64(v.numeric)
+}
+
+// AsFloat64Slice returns the []float64 value. Make sure that the Value's type is
+// FLOAT64SLICE.
+func (v Value) AsFloat64Slice() []float64 {
+	if v.vtype != FLOAT64SLICE {
+		return nil
+	}
+	return v.asFloat64Slice()
+}
+
+func (v Value) asFloat64Slice() []float64 {
+	return attribute.AsFloat64Slice(v.slice)
+}
+
+// AsString returns the string value. Make sure that the Value's type
+// is STRING.
+func (v Value) AsString() string {
+	return v.stringly
+}
+
+// AsStringSlice returns the []string value. Make sure that the Value's type is
+// STRINGSLICE.
+func (v Value) AsStringSlice() []string {
+	if v.vtype != STRINGSLICE {
+		return nil
+	}
+	return v.asStringSlice()
+}
+
+func (v Value) asStringSlice() []string {
+	return attribute.AsStringSlice(v.slice)
+}
+
+type unknownValueType struct{}
+
+// AsInterface returns Value's data as interface{}.
+func (v Value) AsInterface() interface{} {
+	switch v.Type() {
+	case BOOL:
+		return v.AsBool()
+	case BOOLSLICE:
+		return v.asBoolSlice()
+	case INT64:
+		return v.AsInt64()
+	case INT64SLICE:
+		return v.asInt64Slice()
+	case FLOAT64:
+		return v.AsFloat64()
+	case FLOAT64SLICE:
+		return v.asFloat64Slice()
+	case STRING:
+		return v.stringly
+	case STRINGSLICE:
+		return v.asStringSlice()
+	}
+	return unknownValueType{}
+}
+
+// Emit returns a string representation of Value's data.
+func (v Value) Emit() string {
+	switch v.Type() {
+	case BOOLSLICE:
+		return fmt.Sprint(v.asBoolSlice())
+	case BOOL:
+		return strconv.FormatBool(v.AsBool())
+	case INT64SLICE:
+		return fmt.Sprint(v.asInt64Slice())
+	case INT64:
+		return strconv.FormatInt(v.AsInt64(), 10)
+	case FLOAT64SLICE:
+		return fmt.Sprint(v.asFloat64Slice())
+	case FLOAT64:
+		return fmt.Sprint(v.AsFloat64())
+	case STRINGSLICE:
+		return fmt.Sprint(v.asStringSlice())
+	case STRING:
+		return v.stringly
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON returns the JSON encoding of the Value.
+func (v Value) MarshalJSON() ([]byte, error) {
+	var jsonVal struct {
+		Type  string
+		Value interface{}
+	}
+	jsonVal.Type = v.Type().String()
+	jsonVal.Value = v.AsInterface()
+	return json.Marshal(jsonVal)
+}
diff --git a/vendor/go.opentelemetry.io/otel/baggage/baggage.go b/vendor/go.opentelemetry.io/otel/baggage/baggage.go
new file mode 100644
index 0000000000..a36db8f8d8
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/baggage/baggage.go
@@ -0,0 +1,570 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package baggage // import "go.opentelemetry.io/otel/baggage"
+
+import (
+	"errors"
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+
+	"go.opentelemetry.io/otel/internal/baggage"
+)
+
+const (
+	maxMembers               = 180
+	maxBytesPerMembers       = 4096
+	maxBytesPerBaggageString = 8192
+
+	listDelimiter     = ","
+	keyValueDelimiter = "="
+	propertyDelimiter = ";"
+
+	keyDef      = `([\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5a\x5e-\x7a\x7c\x7e]+)`
+	valueDef    = `([\x21\x23-\x2b\x2d-\x3a\x3c-\x5B\x5D-\x7e]*)`
+	keyValueDef = `\s*` + keyDef + `\s*` + keyValueDelimiter + `\s*` + valueDef + `\s*`
+)
+
+var (
+	keyRe      = regexp.MustCompile(`^` + keyDef + `$`)
+	valueRe    = regexp.MustCompile(`^` + valueDef + `$`)
+	propertyRe = regexp.MustCompile(`^(?:\s*` + keyDef + `\s*|` + keyValueDef + `)$`)
+)
+
+var (
+	errInvalidKey      = errors.New("invalid key")
+	errInvalidValue    = errors.New("invalid value")
+	errInvalidProperty = errors.New("invalid baggage list-member property")
+	errInvalidMember   = errors.New("invalid baggage list-member")
+	errMemberNumber    = errors.New("too many list-members in baggage-string")
+	errMemberBytes     = errors.New("list-member too large")
+	errBaggageBytes    = errors.New("baggage-string too large")
+)
+
+// Property is an additional metadata entry for a baggage list-member.
+type Property struct {
+	key, value string
+
+	// hasValue indicates if a zero-value value means the property does not
+	// have a value or if it was the zero-value.
+	hasValue bool
+
+	// hasData indicates whether the created property contains data or not.
+	// Properties that do not contain data are invalid with no other check
+	// required.
+	hasData bool
+}
+
+// NewKeyProperty returns a new Property for key.
+//
+// If key is invalid, an error will be returned.
+func NewKeyProperty(key string) (Property, error) {
+	if !keyRe.MatchString(key) {
+		return newInvalidProperty(), fmt.Errorf("%w: %q", errInvalidKey, key)
+	}
+
+	p := Property{key: key, hasData: true}
+	return p, nil
+}
+
+// NewKeyValueProperty returns a new Property for key with value.
+//
+// If key or value are invalid, an error will be returned.
+func NewKeyValueProperty(key, value string) (Property, error) {
+	if !keyRe.MatchString(key) {
+		return newInvalidProperty(), fmt.Errorf("%w: %q", errInvalidKey, key)
+	}
+	if !valueRe.MatchString(value) {
+		return newInvalidProperty(), fmt.Errorf("%w: %q", errInvalidValue, value)
+	}
+
+	p := Property{
+		key:      key,
+		value:    value,
+		hasValue: true,
+		hasData:  true,
+	}
+	return p, nil
+}
+
+func newInvalidProperty() Property {
+	return Property{}
+}
+
+// parseProperty attempts to decode a Property from the passed string. It
+// returns an error if the input is invalid according to the W3C Baggage
+// specification.
+func parseProperty(property string) (Property, error) {
+	if property == "" {
+		return newInvalidProperty(), nil
+	}
+
+	match := propertyRe.FindStringSubmatch(property)
+	if len(match) != 4 {
+		return newInvalidProperty(), fmt.Errorf("%w: %q", errInvalidProperty, property)
+	}
+
+	p := Property{hasData: true}
+	if match[1] != "" {
+		p.key = match[1]
+	} else {
+		p.key = match[2]
+		p.value = match[3]
+		p.hasValue = true
+	}
+
+	return p, nil
+}
+
+// validate ensures p conforms to the W3C Baggage specification, returning an
+// error otherwise.
+func (p Property) validate() error {
+	errFunc := func(err error) error {
+		return fmt.Errorf("invalid property: %w", err)
+	}
+
+	if !p.hasData {
+		return errFunc(fmt.Errorf("%w: %q", errInvalidProperty, p))
+	}
+
+	if !keyRe.MatchString(p.key) {
+		return errFunc(fmt.Errorf("%w: %q", errInvalidKey, p.key))
+	}
+	if p.hasValue && !valueRe.MatchString(p.value) {
+		return errFunc(fmt.Errorf("%w: %q", errInvalidValue, p.value))
+	}
+	if !p.hasValue && p.value != "" {
+		return errFunc(errors.New("inconsistent value"))
+	}
+	return nil
+}
+
+// Key returns the Property key.
+func (p Property) Key() string {
+	return p.key
+}
+
+// Value returns the Property value. Additionally, a boolean value is returned
+// indicating if the returned value is the empty if the Property has a value
+// that is empty or if the value is not set.
+func (p Property) Value() (string, bool) {
+	return p.value, p.hasValue
+}
+
+// String encodes Property into a string compliant with the W3C Baggage
+// specification.
+func (p Property) String() string {
+	if p.hasValue {
+		return fmt.Sprintf("%s%s%v", p.key, keyValueDelimiter, p.value)
+	}
+	return p.key
+}
+
+type properties []Property
+
+func fromInternalProperties(iProps []baggage.Property) properties {
+	if len(iProps) == 0 {
+		return nil
+	}
+
+	props := make(properties, len(iProps))
+	for i, p := range iProps {
+		props[i] = Property{
+			key:      p.Key,
+			value:    p.Value,
+			hasValue: p.HasValue,
+		}
+	}
+	return props
+}
+
+func (p properties) asInternal() []baggage.Property {
+	if len(p) == 0 {
+		return nil
+	}
+
+	iProps := make([]baggage.Property, len(p))
+	for i, prop := range p {
+		iProps[i] = baggage.Property{
+			Key:      prop.key,
+			Value:    prop.value,
+			HasValue: prop.hasValue,
+		}
+	}
+	return iProps
+}
+
+func (p properties) Copy() properties {
+	if len(p) == 0 {
+		return nil
+	}
+
+	props := make(properties, len(p))
+	copy(props, p)
+	return props
+}
+
+// validate ensures each Property in p conforms to the W3C Baggage
+// specification, returning an error otherwise.
+func (p properties) validate() error {
+	for _, prop := range p {
+		if err := prop.validate(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// String encodes properties into a string compliant with the W3C Baggage
+// specification.
+func (p properties) String() string {
+	props := make([]string, len(p))
+	for i, prop := range p {
+		props[i] = prop.String()
+	}
+	return strings.Join(props, propertyDelimiter)
+}
+
+// Member is a list-member of a baggage-string as defined by the W3C Baggage
+// specification.
+type Member struct {
+	key, value string
+	properties properties
+
+	// hasData indicates whether the created property contains data or not.
+	// Properties that do not contain data are invalid with no other check
+	// required.
+	hasData bool
+}
+
+// NewMember returns a new Member from the passed arguments. The key will be
+// used directly while the value will be url decoded after validation. An error
+// is returned if the created Member would be invalid according to the W3C
+// Baggage specification.
+func NewMember(key, value string, props ...Property) (Member, error) {
+	m := Member{
+		key:        key,
+		value:      value,
+		properties: properties(props).Copy(),
+		hasData:    true,
+	}
+	if err := m.validate(); err != nil {
+		return newInvalidMember(), err
+	}
+	decodedValue, err := url.QueryUnescape(value)
+	if err != nil {
+		return newInvalidMember(), fmt.Errorf("%w: %q", errInvalidValue, value)
+	}
+	m.value = decodedValue
+	return m, nil
+}
+
+func newInvalidMember() Member {
+	return Member{}
+}
+
+// parseMember attempts to decode a Member from the passed string. It returns
+// an error if the input is invalid according to the W3C Baggage
+// specification.
+func parseMember(member string) (Member, error) {
+	if n := len(member); n > maxBytesPerMembers {
+		return newInvalidMember(), fmt.Errorf("%w: %d", errMemberBytes, n)
+	}
+
+	var (
+		key, value string
+		props      properties
+	)
+
+	parts := strings.SplitN(member, propertyDelimiter, 2)
+	switch len(parts) {
+	case 2:
+		// Parse the member properties.
+		for _, pStr := range strings.Split(parts[1], propertyDelimiter) {
+			p, err := parseProperty(pStr)
+			if err != nil {
+				return newInvalidMember(), err
+			}
+			props = append(props, p)
+		}
+		fallthrough
+	case 1:
+		// Parse the member key/value pair.
+
+		// Take into account a value can contain equal signs (=).
+		kv := strings.SplitN(parts[0], keyValueDelimiter, 2)
+		if len(kv) != 2 {
+			return newInvalidMember(), fmt.Errorf("%w: %q", errInvalidMember, member)
+		}
+		// "Leading and trailing whitespaces are allowed but MUST be trimmed
+		// when converting the header into a data structure."
+		key = strings.TrimSpace(kv[0])
+		var err error
+		value, err = url.QueryUnescape(strings.TrimSpace(kv[1]))
+		if err != nil {
+			return newInvalidMember(), fmt.Errorf("%w: %q", err, value)
+		}
+		if !keyRe.MatchString(key) {
+			return newInvalidMember(), fmt.Errorf("%w: %q", errInvalidKey, key)
+		}
+		if !valueRe.MatchString(value) {
+			return newInvalidMember(), fmt.Errorf("%w: %q", errInvalidValue, value)
+		}
+	default:
+		// This should never happen unless a developer has changed the string
+		// splitting somehow. Panic instead of failing silently and allowing
+		// the bug to slip past the CI checks.
+		panic("failed to parse baggage member")
+	}
+
+	return Member{key: key, value: value, properties: props, hasData: true}, nil
+}
+
+// validate ensures m conforms to the W3C Baggage specification.
+// A key is just an ASCII string, but a value must be URL encoded UTF-8,
+// returning an error otherwise.
+func (m Member) validate() error {
+	if !m.hasData {
+		return fmt.Errorf("%w: %q", errInvalidMember, m)
+	}
+
+	if !keyRe.MatchString(m.key) {
+		return fmt.Errorf("%w: %q", errInvalidKey, m.key)
+	}
+	if !valueRe.MatchString(m.value) {
+		return fmt.Errorf("%w: %q", errInvalidValue, m.value)
+	}
+	return m.properties.validate()
+}
+
+// Key returns the Member key.
+func (m Member) Key() string { return m.key }
+
+// Value returns the Member value.
+func (m Member) Value() string { return m.value }
+
+// Properties returns a copy of the Member properties.
+func (m Member) Properties() []Property { return m.properties.Copy() }
+
+// String encodes Member into a string compliant with the W3C Baggage
+// specification.
+func (m Member) String() string {
+	// A key is just an ASCII string, but a value is URL encoded UTF-8.
+	s := fmt.Sprintf("%s%s%s", m.key, keyValueDelimiter, url.QueryEscape(m.value))
+	if len(m.properties) > 0 {
+		s = fmt.Sprintf("%s%s%s", s, propertyDelimiter, m.properties.String())
+	}
+	return s
+}
+
+// Baggage is a list of baggage members representing the baggage-string as
+// defined by the W3C Baggage specification.
+type Baggage struct { //nolint:golint
+	list baggage.List
+}
+
+// New returns a new valid Baggage. It returns an error if it results in a
+// Baggage exceeding limits set in that specification.
+//
+// It expects all the provided members to have already been validated.
+func New(members ...Member) (Baggage, error) {
+	if len(members) == 0 {
+		return Baggage{}, nil
+	}
+
+	b := make(baggage.List)
+	for _, m := range members {
+		if !m.hasData {
+			return Baggage{}, errInvalidMember
+		}
+
+		// OpenTelemetry resolves duplicates by last-one-wins.
+		b[m.key] = baggage.Item{
+			Value:      m.value,
+			Properties: m.properties.asInternal(),
+		}
+	}
+
+	// Check member numbers after deduplication.
+	if len(b) > maxMembers {
+		return Baggage{}, errMemberNumber
+	}
+
+	bag := Baggage{b}
+	if n := len(bag.String()); n > maxBytesPerBaggageString {
+		return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n)
+	}
+
+	return bag, nil
+}
+
+// Parse attempts to decode a baggage-string from the passed string. It
+// returns an error if the input is invalid according to the W3C Baggage
+// specification.
+//
+// If there are duplicate list-members contained in baggage, the last one
+// defined (reading left-to-right) will be the only one kept. This diverges
+// from the W3C Baggage specification which allows duplicate list-members, but
+// conforms to the OpenTelemetry Baggage specification.
+func Parse(bStr string) (Baggage, error) {
+	if bStr == "" {
+		return Baggage{}, nil
+	}
+
+	if n := len(bStr); n > maxBytesPerBaggageString {
+		return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n)
+	}
+
+	b := make(baggage.List)
+	for _, memberStr := range strings.Split(bStr, listDelimiter) {
+		m, err := parseMember(memberStr)
+		if err != nil {
+			return Baggage{}, err
+		}
+		// OpenTelemetry resolves duplicates by last-one-wins.
+		b[m.key] = baggage.Item{
+			Value:      m.value,
+			Properties: m.properties.asInternal(),
+		}
+	}
+
+	// OpenTelemetry does not allow for duplicate list-members, but the W3C
+	// specification does. Now that we have deduplicated, ensure the baggage
+	// does not exceed list-member limits.
+	if len(b) > maxMembers {
+		return Baggage{}, errMemberNumber
+	}
+
+	return Baggage{b}, nil
+}
+
+// Member returns the baggage list-member identified by key.
+//
+// If there is no list-member matching the passed key the returned Member will
+// be a zero-value Member.
+// The returned member is not validated, as we assume the validation happened
+// when it was added to the Baggage.
+func (b Baggage) Member(key string) Member {
+	v, ok := b.list[key]
+	if !ok {
+		// We do not need to worry about distinguishing between the situation
+		// where a zero-valued Member is included in the Baggage because a
+		// zero-valued Member is invalid according to the W3C Baggage
+		// specification (it has an empty key).
+		return newInvalidMember()
+	}
+
+	return Member{
+		key:        key,
+		value:      v.Value,
+		properties: fromInternalProperties(v.Properties),
+		hasData:    true,
+	}
+}
+
+// Members returns all the baggage list-members.
+// The order of the returned list-members does not have significance.
+//
+// The returned members are not validated, as we assume the validation happened
+// when they were added to the Baggage.
+func (b Baggage) Members() []Member {
+	if len(b.list) == 0 {
+		return nil
+	}
+
+	members := make([]Member, 0, len(b.list))
+	for k, v := range b.list {
+		members = append(members, Member{
+			key:        k,
+			value:      v.Value,
+			properties: fromInternalProperties(v.Properties),
+			hasData:    true,
+		})
+	}
+	return members
+}
+
+// SetMember returns a copy the Baggage with the member included. If the
+// baggage contains a Member with the same key the existing Member is
+// replaced.
+//
+// If member is invalid according to the W3C Baggage specification, an error
+// is returned with the original Baggage.
+func (b Baggage) SetMember(member Member) (Baggage, error) {
+	if !member.hasData {
+		return b, errInvalidMember
+	}
+
+	n := len(b.list)
+	if _, ok := b.list[member.key]; !ok {
+		n++
+	}
+	list := make(baggage.List, n)
+
+	for k, v := range b.list {
+		// Do not copy if we are just going to overwrite.
+		if k == member.key {
+			continue
+		}
+		list[k] = v
+	}
+
+	list[member.key] = baggage.Item{
+		Value:      member.value,
+		Properties: member.properties.asInternal(),
+	}
+
+	return Baggage{list: list}, nil
+}
+
+// DeleteMember returns a copy of the Baggage with the list-member identified
+// by key removed.
+func (b Baggage) DeleteMember(key string) Baggage {
+	n := len(b.list)
+	if _, ok := b.list[key]; ok {
+		n--
+	}
+	list := make(baggage.List, n)
+
+	for k, v := range b.list {
+		if k == key {
+			continue
+		}
+		list[k] = v
+	}
+
+	return Baggage{list: list}
+}
+
+// Len returns the number of list-members in the Baggage.
+func (b Baggage) Len() int {
+	return len(b.list)
+}
+
+// String encodes Baggage into a string compliant with the W3C Baggage
+// specification. The returned string will be invalid if the Baggage contains
+// any invalid list-members.
+func (b Baggage) String() string {
+	members := make([]string, 0, len(b.list))
+	for k, v := range b.list {
+		members = append(members, Member{
+			key:        k,
+			value:      v.Value,
+			properties: fromInternalProperties(v.Properties),
+		}.String())
+	}
+	return strings.Join(members, listDelimiter)
+}
diff --git a/vendor/go.opentelemetry.io/otel/baggage/context.go b/vendor/go.opentelemetry.io/otel/baggage/context.go
new file mode 100644
index 0000000000..24b34b7564
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/baggage/context.go
@@ -0,0 +1,39 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package baggage // import "go.opentelemetry.io/otel/baggage"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/internal/baggage"
+)
+
+// ContextWithBaggage returns a copy of parent with baggage.
+func ContextWithBaggage(parent context.Context, b Baggage) context.Context {
+	// Delegate so any hooks for the OpenTracing bridge are handled.
+	return baggage.ContextWithList(parent, b.list)
+}
+
+// ContextWithoutBaggage returns a copy of parent with no baggage.
+func ContextWithoutBaggage(parent context.Context) context.Context {
+	// Delegate so any hooks for the OpenTracing bridge are handled.
+	return baggage.ContextWithList(parent, nil)
+}
+
+// FromContext returns the baggage contained in ctx.
+func FromContext(ctx context.Context) Baggage {
+	// Delegate so any hooks for the OpenTracing bridge are handled.
+	return Baggage{list: baggage.ListFromContext(ctx)}
+}
diff --git a/vendor/go.opentelemetry.io/otel/baggage/doc.go b/vendor/go.opentelemetry.io/otel/baggage/doc.go
new file mode 100644
index 0000000000..4545100df6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/baggage/doc.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package baggage provides functionality for storing and retrieving
+baggage items in Go context. For propagating the baggage, see the
+go.opentelemetry.io/otel/propagation package.
+*/
+package baggage // import "go.opentelemetry.io/otel/baggage"
diff --git a/vendor/go.opentelemetry.io/otel/codes/codes.go b/vendor/go.opentelemetry.io/otel/codes/codes.go
new file mode 100644
index 0000000000..587ebae4e3
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/codes/codes.go
@@ -0,0 +1,116 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package codes // import "go.opentelemetry.io/otel/codes"
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+)
+
+const (
+	// Unset is the default status code.
+	Unset Code = 0
+
+	// Error indicates the operation contains an error.
+	//
+	// NOTE: The error code in OTLP is 2.
+	// The value of this enum is only relevant to the internals
+	// of the Go SDK.
+	Error Code = 1
+
+	// Ok indicates operation has been validated by an Application developers
+	// or Operator to have completed successfully, or contain no error.
+	//
+	// NOTE: The Ok code in OTLP is 1.
+	// The value of this enum is only relevant to the internals
+	// of the Go SDK.
+	Ok Code = 2
+
+	maxCode = 3
+)
+
+// Code is an 32-bit representation of a status state.
+type Code uint32
+
+var codeToStr = map[Code]string{
+	Unset: "Unset",
+	Error: "Error",
+	Ok:    "Ok",
+}
+
+var strToCode = map[string]Code{
+	`"Unset"`: Unset,
+	`"Error"`: Error,
+	`"Ok"`:    Ok,
+}
+
+// String returns the Code as a string.
+func (c Code) String() string {
+	return codeToStr[c]
+}
+
+// UnmarshalJSON unmarshals b into the Code.
+//
+// This is based on the functionality in the gRPC codes package:
+// https://github.com/grpc/grpc-go/blob/bb64fee312b46ebee26be43364a7a966033521b1/codes/codes.go#L218-L244
+func (c *Code) UnmarshalJSON(b []byte) error {
+	// From json.Unmarshaler: By convention, to approximate the behavior of
+	// Unmarshal itself, Unmarshalers implement UnmarshalJSON([]byte("null")) as
+	// a no-op.
+	if string(b) == "null" {
+		return nil
+	}
+	if c == nil {
+		return fmt.Errorf("nil receiver passed to UnmarshalJSON")
+	}
+
+	var x interface{}
+	if err := json.Unmarshal(b, &x); err != nil {
+		return err
+	}
+	switch x.(type) {
+	case string:
+		if jc, ok := strToCode[string(b)]; ok {
+			*c = jc
+			return nil
+		}
+		return fmt.Errorf("invalid code: %q", string(b))
+	case float64:
+		if ci, err := strconv.ParseUint(string(b), 10, 32); err == nil {
+			if ci >= maxCode {
+				return fmt.Errorf("invalid code: %q", ci)
+			}
+
+			*c = Code(ci)
+			return nil
+		}
+		return fmt.Errorf("invalid code: %q", string(b))
+	default:
+		return fmt.Errorf("invalid code: %q", string(b))
+	}
+}
+
+// MarshalJSON returns c as the JSON encoding of c.
+func (c *Code) MarshalJSON() ([]byte, error) {
+	if c == nil {
+		return []byte("null"), nil
+	}
+	str, ok := codeToStr[*c]
+	if !ok {
+		return nil, fmt.Errorf("invalid code: %d", *c)
+	}
+	return []byte(fmt.Sprintf("%q", str)), nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/codes/doc.go b/vendor/go.opentelemetry.io/otel/codes/doc.go
new file mode 100644
index 0000000000..df3e0f1b62
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/codes/doc.go
@@ -0,0 +1,21 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package codes defines the canonical error codes used by OpenTelemetry.
+
+It conforms to [the OpenTelemetry
+specification](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/trace/api.md#statuscanonicalcode).
+*/
+package codes // import "go.opentelemetry.io/otel/codes"
diff --git a/vendor/go.opentelemetry.io/otel/doc.go b/vendor/go.opentelemetry.io/otel/doc.go
new file mode 100644
index 0000000000..daa36c89dc
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/doc.go
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package otel provides global access to the OpenTelemetry API. The subpackages of
+the otel package provide an implementation of the OpenTelemetry API.
+
+The provided API is used to instrument code and measure data about that code's
+performance and operation. The measured data, by default, is not processed or
+transmitted anywhere. An implementation of the OpenTelemetry SDK, like the
+default SDK implementation (go.opentelemetry.io/otel/sdk), and associated
+exporters are used to process and transport this data.
+
+To read the getting started guide, see https://opentelemetry.io/docs/go/getting-started/.
+
+To read more about tracing, see go.opentelemetry.io/otel/trace.
+
+To read more about metrics, see go.opentelemetry.io/otel/metric.
+
+To read more about propagation, see go.opentelemetry.io/otel/propagation and
+go.opentelemetry.io/otel/baggage.
+*/
+package otel // import "go.opentelemetry.io/otel"
diff --git a/vendor/go.opentelemetry.io/otel/error_handler.go b/vendor/go.opentelemetry.io/otel/error_handler.go
new file mode 100644
index 0000000000..72fad85412
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/error_handler.go
@@ -0,0 +1,38 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otel // import "go.opentelemetry.io/otel"
+
+// ErrorHandler handles irremediable events.
+type ErrorHandler interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Handle handles any error deemed irremediable by an OpenTelemetry
+	// component.
+	Handle(error)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+// ErrorHandlerFunc is a convenience adapter to allow the use of a function
+// as an ErrorHandler.
+type ErrorHandlerFunc func(error)
+
+var _ ErrorHandler = ErrorHandlerFunc(nil)
+
+// Handle handles the irremediable error by calling the ErrorHandlerFunc itself.
+func (f ErrorHandlerFunc) Handle(err error) {
+	f(err)
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/config.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/config.go
new file mode 100644
index 0000000000..b3fd45d9d3
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/config.go
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package internal contains common functionality for all OTLP exporters.
+package internal // import "go.opentelemetry.io/otel/exporters/otlp/internal"
+
+import (
+	"fmt"
+	"path"
+	"strings"
+)
+
+// CleanPath returns a path with all spaces trimmed and all redundancies removed. If urlPath is empty or cleaning it results in an empty string, defaultPath is returned instead.
+func CleanPath(urlPath string, defaultPath string) string {
+	tmp := path.Clean(strings.TrimSpace(urlPath))
+	if tmp == "." {
+		return defaultPath
+	}
+	if !path.IsAbs(tmp) {
+		tmp = fmt.Sprintf("/%s", tmp)
+	}
+	return tmp
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/envconfig/envconfig.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/envconfig/envconfig.go
new file mode 100644
index 0000000000..53ff3126b6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/envconfig/envconfig.go
@@ -0,0 +1,199 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package envconfig // import "go.opentelemetry.io/otel/exporters/otlp/internal/envconfig"
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"go.opentelemetry.io/otel/internal/global"
+)
+
+// ConfigFn is the generic function used to set a config.
+type ConfigFn func(*EnvOptionsReader)
+
+// EnvOptionsReader reads the required environment variables.
+type EnvOptionsReader struct {
+	GetEnv    func(string) string
+	ReadFile  func(string) ([]byte, error)
+	Namespace string
+}
+
+// Apply runs every ConfigFn.
+func (e *EnvOptionsReader) Apply(opts ...ConfigFn) {
+	for _, o := range opts {
+		o(e)
+	}
+}
+
+// GetEnvValue gets an OTLP environment variable value of the specified key
+// using the GetEnv function.
+// This function prepends the OTLP specified namespace to all key lookups.
+func (e *EnvOptionsReader) GetEnvValue(key string) (string, bool) {
+	v := strings.TrimSpace(e.GetEnv(keyWithNamespace(e.Namespace, key)))
+	return v, v != ""
+}
+
+// WithString retrieves the specified config and passes it to ConfigFn as a string.
+func WithString(n string, fn func(string)) func(e *EnvOptionsReader) {
+	return func(e *EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			fn(v)
+		}
+	}
+}
+
+// WithBool returns a ConfigFn that reads the environment variable n and if it exists passes its parsed bool value to fn.
+func WithBool(n string, fn func(bool)) ConfigFn {
+	return func(e *EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			b := strings.ToLower(v) == "true"
+			fn(b)
+		}
+	}
+}
+
+// WithDuration retrieves the specified config and passes it to ConfigFn as a duration.
+func WithDuration(n string, fn func(time.Duration)) func(e *EnvOptionsReader) {
+	return func(e *EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			d, err := strconv.Atoi(v)
+			if err != nil {
+				global.Error(err, "parse duration", "input", v)
+				return
+			}
+			fn(time.Duration(d) * time.Millisecond)
+		}
+	}
+}
+
+// WithHeaders retrieves the specified config and passes it to ConfigFn as a map of HTTP headers.
+func WithHeaders(n string, fn func(map[string]string)) func(e *EnvOptionsReader) {
+	return func(e *EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			fn(stringToHeader(v))
+		}
+	}
+}
+
+// WithURL retrieves the specified config and passes it to ConfigFn as a net/url.URL.
+func WithURL(n string, fn func(*url.URL)) func(e *EnvOptionsReader) {
+	return func(e *EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			u, err := url.Parse(v)
+			if err != nil {
+				global.Error(err, "parse url", "input", v)
+				return
+			}
+			fn(u)
+		}
+	}
+}
+
+// WithCertPool returns a ConfigFn that reads the environment variable n as a filepath to a TLS certificate pool. If it exists, it is parsed as a crypto/x509.CertPool and it is passed to fn.
+func WithCertPool(n string, fn func(*x509.CertPool)) ConfigFn {
+	return func(e *EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			b, err := e.ReadFile(v)
+			if err != nil {
+				global.Error(err, "read tls ca cert file", "file", v)
+				return
+			}
+			c, err := createCertPool(b)
+			if err != nil {
+				global.Error(err, "create tls cert pool")
+				return
+			}
+			fn(c)
+		}
+	}
+}
+
+// WithClientCert returns a ConfigFn that reads the environment variable nc and nk as filepaths to a client certificate and key pair. If they exists, they are parsed as a crypto/tls.Certificate and it is passed to fn.
+func WithClientCert(nc, nk string, fn func(tls.Certificate)) ConfigFn {
+	return func(e *EnvOptionsReader) {
+		vc, okc := e.GetEnvValue(nc)
+		vk, okk := e.GetEnvValue(nk)
+		if !okc || !okk {
+			return
+		}
+		cert, err := e.ReadFile(vc)
+		if err != nil {
+			global.Error(err, "read tls client cert", "file", vc)
+			return
+		}
+		key, err := e.ReadFile(vk)
+		if err != nil {
+			global.Error(err, "read tls client key", "file", vk)
+			return
+		}
+		crt, err := tls.X509KeyPair(cert, key)
+		if err != nil {
+			global.Error(err, "create tls client key pair")
+			return
+		}
+		fn(crt)
+	}
+}
+
+func keyWithNamespace(ns, key string) string {
+	if ns == "" {
+		return key
+	}
+	return fmt.Sprintf("%s_%s", ns, key)
+}
+
+func stringToHeader(value string) map[string]string {
+	headersPairs := strings.Split(value, ",")
+	headers := make(map[string]string)
+
+	for _, header := range headersPairs {
+		nameValue := strings.SplitN(header, "=", 2)
+		if len(nameValue) < 2 {
+			global.Error(errors.New("missing '="), "parse headers", "input", nameValue)
+			continue
+		}
+		name, err := url.QueryUnescape(nameValue[0])
+		if err != nil {
+			global.Error(err, "escape header key", "key", nameValue[0])
+			continue
+		}
+		trimmedName := strings.TrimSpace(name)
+		value, err := url.QueryUnescape(nameValue[1])
+		if err != nil {
+			global.Error(err, "escape header value", "value", nameValue[1])
+			continue
+		}
+		trimmedValue := strings.TrimSpace(value)
+
+		headers[trimmedName] = trimmedValue
+	}
+
+	return headers
+}
+
+func createCertPool(certBytes []byte) (*x509.CertPool, error) {
+	cp := x509.NewCertPool()
+	if ok := cp.AppendCertsFromPEM(certBytes); !ok {
+		return nil, errors.New("failed to append certificate to the cert pool")
+	}
+	return cp, nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/header.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/header.go
new file mode 100644
index 0000000000..9aa62ed9e8
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/header.go
@@ -0,0 +1,24 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package internal contains common functionality for all OTLP exporters.
+package internal // import "go.opentelemetry.io/otel/exporters/otlp/internal"
+
+import "go.opentelemetry.io/otel"
+
+// GetUserAgentHeader return an OTLP header value form "OTel OTLP Exporter Go/{{ .Version }}"
+// https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#user-agent
+func GetUserAgentHeader() string {
+	return "OTel OTLP Exporter Go/" + otel.Version()
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/partialsuccess.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/partialsuccess.go
new file mode 100644
index 0000000000..9ab89b3757
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/partialsuccess.go
@@ -0,0 +1,64 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package internal // import "go.opentelemetry.io/otel/exporters/otlp/internal"
+
+import "fmt"
+
+// PartialSuccess represents the underlying error for all handling
+// OTLP partial success messages.  Use `errors.Is(err,
+// PartialSuccess{})` to test whether an error passed to the OTel
+// error handler belongs to this category.
+type PartialSuccess struct {
+	ErrorMessage  string
+	RejectedItems int64
+	RejectedKind  string
+}
+
+var _ error = PartialSuccess{}
+
+// Error implements the error interface.
+func (ps PartialSuccess) Error() string {
+	msg := ps.ErrorMessage
+	if msg == "" {
+		msg = "empty message"
+	}
+	return fmt.Sprintf("OTLP partial success: %s (%d %s rejected)", msg, ps.RejectedItems, ps.RejectedKind)
+}
+
+// Is supports the errors.Is() interface.
+func (ps PartialSuccess) Is(err error) bool {
+	_, ok := err.(PartialSuccess)
+	return ok
+}
+
+// TracePartialSuccessError returns an error describing a partial success
+// response for the trace signal.
+func TracePartialSuccessError(itemsRejected int64, errorMessage string) error {
+	return PartialSuccess{
+		ErrorMessage:  errorMessage,
+		RejectedItems: itemsRejected,
+		RejectedKind:  "spans",
+	}
+}
+
+// MetricPartialSuccessError returns an error describing a partial success
+// response for the metric signal.
+func MetricPartialSuccessError(itemsRejected int64, errorMessage string) error {
+	return PartialSuccess{
+		ErrorMessage:  errorMessage,
+		RejectedItems: itemsRejected,
+		RejectedKind:  "metric data points",
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/retry/LICENSE b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/retry/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/retry/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/retry/retry.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/retry/retry.go
new file mode 100644
index 0000000000..7e1b0055a7
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/retry/retry.go
@@ -0,0 +1,153 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package retry provides request retry functionality that can perform
+// configurable exponential backoff for transient errors and honor any
+// explicit throttle responses received.
+package retry // import "go.opentelemetry.io/otel/exporters/otlp/internal/retry"
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+)
+
+// DefaultConfig are the recommended defaults to use.
+var DefaultConfig = Config{
+	Enabled:         true,
+	InitialInterval: 5 * time.Second,
+	MaxInterval:     30 * time.Second,
+	MaxElapsedTime:  time.Minute,
+}
+
+// Config defines configuration for retrying batches in case of export failure
+// using an exponential backoff.
+type Config struct {
+	// Enabled indicates whether to not retry sending batches in case of
+	// export failure.
+	Enabled bool
+	// InitialInterval the time to wait after the first failure before
+	// retrying.
+	InitialInterval time.Duration
+	// MaxInterval is the upper bound on backoff interval. Once this value is
+	// reached the delay between consecutive retries will always be
+	// `MaxInterval`.
+	MaxInterval time.Duration
+	// MaxElapsedTime is the maximum amount of time (including retries) spent
+	// trying to send a request/batch.  Once this value is reached, the data
+	// is discarded.
+	MaxElapsedTime time.Duration
+}
+
+// RequestFunc wraps a request with retry logic.
+type RequestFunc func(context.Context, func(context.Context) error) error
+
+// EvaluateFunc returns if an error is retry-able and if an explicit throttle
+// duration should be honored that was included in the error.
+//
+// The function must return true if the error argument is retry-able,
+// otherwise it must return false for the first return parameter.
+//
+// The function must return a non-zero time.Duration if the error contains
+// explicit throttle duration that should be honored, otherwise it must return
+// a zero valued time.Duration.
+type EvaluateFunc func(error) (bool, time.Duration)
+
+// RequestFunc returns a RequestFunc using the evaluate function to determine
+// if requests can be retried and based on the exponential backoff
+// configuration of c.
+func (c Config) RequestFunc(evaluate EvaluateFunc) RequestFunc {
+	if !c.Enabled {
+		return func(ctx context.Context, fn func(context.Context) error) error {
+			return fn(ctx)
+		}
+	}
+
+	return func(ctx context.Context, fn func(context.Context) error) error {
+		// Do not use NewExponentialBackOff since it calls Reset and the code here
+		// must call Reset after changing the InitialInterval (this saves an
+		// unnecessary call to Now).
+		b := &backoff.ExponentialBackOff{
+			InitialInterval:     c.InitialInterval,
+			RandomizationFactor: backoff.DefaultRandomizationFactor,
+			Multiplier:          backoff.DefaultMultiplier,
+			MaxInterval:         c.MaxInterval,
+			MaxElapsedTime:      c.MaxElapsedTime,
+			Stop:                backoff.Stop,
+			Clock:               backoff.SystemClock,
+		}
+		b.Reset()
+
+		for {
+			err := fn(ctx)
+			if err == nil {
+				return nil
+			}
+
+			retryable, throttle := evaluate(err)
+			if !retryable {
+				return err
+			}
+
+			bOff := b.NextBackOff()
+			if bOff == backoff.Stop {
+				return fmt.Errorf("max retry time elapsed: %w", err)
+			}
+
+			// Wait for the greater of the backoff or throttle delay.
+			var delay time.Duration
+			if bOff > throttle {
+				delay = bOff
+			} else {
+				elapsed := b.GetElapsedTime()
+				if b.MaxElapsedTime != 0 && elapsed+throttle > b.MaxElapsedTime {
+					return fmt.Errorf("max retry time would elapse: %w", err)
+				}
+				delay = throttle
+			}
+
+			if ctxErr := waitFunc(ctx, delay); ctxErr != nil {
+				return fmt.Errorf("%w: %s", ctxErr, err)
+			}
+		}
+	}
+}
+
+// Allow override for testing.
+var waitFunc = wait
+
+// wait takes the caller's context, and the amount of time to wait.  It will
+// return nil if the timer fires before or at the same time as the context's
+// deadline.  This indicates that the call can be retried.
+func wait(ctx context.Context, delay time.Duration) error {
+	timer := time.NewTimer(delay)
+	defer timer.Stop()
+
+	select {
+	case <-ctx.Done():
+		// Handle the case where the timer and context deadline end
+		// simultaneously by prioritizing the timer expiration nil value
+		// response.
+		select {
+		case <-timer.C:
+		default:
+			return ctx.Err()
+		}
+	case <-timer.C:
+	}
+
+	return nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/wrappederror.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/wrappederror.go
new file mode 100644
index 0000000000..217751da55
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/internal/wrappederror.go
@@ -0,0 +1,61 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package internal // import "go.opentelemetry.io/otel/exporters/otlp/internal"
+
+// ErrorKind is used to identify the kind of export error
+// being wrapped.
+type ErrorKind int
+
+const (
+	// TracesExport indicates the error comes from the OTLP trace exporter.
+	TracesExport ErrorKind = iota
+)
+
+// prefix returns a prefix for the Error() string.
+func (k ErrorKind) prefix() string {
+	switch k {
+	case TracesExport:
+		return "traces export: "
+	default:
+		return "unknown: "
+	}
+}
+
+// wrappedExportError wraps an OTLP exporter error with the kind of
+// signal that produced it.
+type wrappedExportError struct {
+	wrap error
+	kind ErrorKind
+}
+
+// WrapTracesError wraps an error from the OTLP exporter for traces.
+func WrapTracesError(err error) error {
+	return wrappedExportError{
+		wrap: err,
+		kind: TracesExport,
+	}
+}
+
+var _ error = wrappedExportError{}
+
+// Error attaches a prefix corresponding to the kind of exporter.
+func (t wrappedExportError) Error() string {
+	return t.kind.prefix() + t.wrap.Error()
+}
+
+// Unwrap returns the wrapped error.
+func (t wrappedExportError) Unwrap() error {
+	return t.wrap
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/LICENSE b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.md b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.md
new file mode 100644
index 0000000000..6e9cc0366b
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/README.md
@@ -0,0 +1,51 @@
+# OpenTelemetry-Go OTLP Span Exporter
+
+[![Go Reference](https://pkg.go.dev/badge/go.opentelemetry.io/otel/exporters/otlp/otlptrace.svg)](https://pkg.go.dev/go.opentelemetry.io/otel/exporters/otlp/otlptrace)
+
+[OpenTelemetry Protocol Exporter](https://github.com/open-telemetry/opentelemetry-specification/blob/v1.5.0/specification/protocol/exporter.md) implementation.
+
+## Installation
+
+```
+go get -u go.opentelemetry.io/otel/exporters/otlp/otlptrace
+```
+
+## Examples
+
+- [HTTP Exporter setup and examples](./otlptracehttp/example_test.go)
+- [Full example of gRPC Exporter sending telemetry to a local collector](../../../example/otel-collector)
+
+## [`otlptrace`](https://pkg.go.dev/go.opentelemetry.io/otel/exporters/otlp/otlptrace)
+
+The `otlptrace` package provides an exporter implementing the OTel span exporter interface.
+This exporter is configured using a client satisfying the `otlptrace.Client` interface.
+This client handles the transformation of data into wire format and the transmission of that data to the collector.
+
+## [`otlptracegrpc`](https://pkg.go.dev/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc)
+
+The `otlptracegrpc` package implements a client for the span exporter that sends trace telemetry data to the collector using gRPC with protobuf-encoded payloads.
+
+## [`otlptracehttp`](https://pkg.go.dev/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp)
+
+The `otlptracehttp` package implements a client for the span exporter that sends trace telemetry data to the collector using HTTP with protobuf-encoded payloads.
+
+## Configuration
+
+### Environment Variables
+
+The following environment variables can be used (instead of options objects) to
+override the default configuration. For more information about how each of
+these environment variables is interpreted, see [the OpenTelemetry
+specification](https://github.com/open-telemetry/opentelemetry-specification/blob/v1.8.0/specification/protocol/exporter.md).
+
+| Environment variable                                                     | Option                        | Default value                                            |
+| ------------------------------------------------------------------------ |------------------------------ | -------------------------------------------------------- |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`       | `WithEndpoint` `WithInsecure` | `https://localhost:4317` or `https://localhost:4318`[^1] |
+| `OTEL_EXPORTER_OTLP_CERTIFICATE` `OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE` | `WithTLSClientConfig`         |                                                          |
+| `OTEL_EXPORTER_OTLP_HEADERS` `OTEL_EXPORTER_OTLP_TRACES_HEADERS`         | `WithHeaders`                 |                                                          |
+| `OTEL_EXPORTER_OTLP_COMPRESSION` `OTEL_EXPORTER_OTLP_TRACES_COMPRESSION` | `WithCompression`             |                                                          |
+| `OTEL_EXPORTER_OTLP_TIMEOUT` `OTEL_EXPORTER_OTLP_TRACES_TIMEOUT`         | `WithTimeout`                 | `10s`                                                    |
+
+[^1]: The gRPC client defaults to `https://localhost:4317` and the HTTP client `https://localhost:4318`.
+
+Configuration using options have precedence over the environment variables.
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go
new file mode 100644
index 0000000000..dbb40cf582
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/clients.go
@@ -0,0 +1,54 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+
+import (
+	"context"
+
+	tracepb "go.opentelemetry.io/proto/otlp/trace/v1"
+)
+
+// Client manages connections to the collector, handles the
+// transformation of data into wire format, and the transmission of that
+// data to the collector.
+type Client interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Start should establish connection(s) to endpoint(s). It is
+	// called just once by the exporter, so the implementation
+	// does not need to worry about idempotence and locking.
+	Start(ctx context.Context) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Stop should close the connections. The function is called
+	// only once by the exporter, so the implementation does not
+	// need to worry about idempotence, but it may be called
+	// concurrently with UploadTraces, so proper
+	// locking is required. The function serves as a
+	// synchronization point - after the function returns, the
+	// process of closing connections is assumed to be finished.
+	Stop(ctx context.Context) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// UploadTraces should transform the passed traces to the wire
+	// format and send it to the collector. May be called
+	// concurrently.
+	UploadTraces(ctx context.Context, protoSpans []*tracepb.ResourceSpans) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go
new file mode 100644
index 0000000000..b65802edbb
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/exporter.go
@@ -0,0 +1,118 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlptrace // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+
+import (
+	"context"
+	"errors"
+	"sync"
+
+	"go.opentelemetry.io/otel/exporters/otlp/internal"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+	tracesdk "go.opentelemetry.io/otel/sdk/trace"
+)
+
+var (
+	errAlreadyStarted = errors.New("already started")
+)
+
+// Exporter exports trace data in the OTLP wire format.
+type Exporter struct {
+	client Client
+
+	mu      sync.RWMutex
+	started bool
+
+	startOnce sync.Once
+	stopOnce  sync.Once
+}
+
+// ExportSpans exports a batch of spans.
+func (e *Exporter) ExportSpans(ctx context.Context, ss []tracesdk.ReadOnlySpan) error {
+	protoSpans := tracetransform.Spans(ss)
+	if len(protoSpans) == 0 {
+		return nil
+	}
+
+	err := e.client.UploadTraces(ctx, protoSpans)
+	if err != nil {
+		return internal.WrapTracesError(err)
+	}
+	return nil
+}
+
+// Start establishes a connection to the receiving endpoint.
+func (e *Exporter) Start(ctx context.Context) error {
+	var err = errAlreadyStarted
+	e.startOnce.Do(func() {
+		e.mu.Lock()
+		e.started = true
+		e.mu.Unlock()
+		err = e.client.Start(ctx)
+	})
+
+	return err
+}
+
+// Shutdown flushes all exports and closes all connections to the receiving endpoint.
+func (e *Exporter) Shutdown(ctx context.Context) error {
+	e.mu.RLock()
+	started := e.started
+	e.mu.RUnlock()
+
+	if !started {
+		return nil
+	}
+
+	var err error
+
+	e.stopOnce.Do(func() {
+		err = e.client.Stop(ctx)
+		e.mu.Lock()
+		e.started = false
+		e.mu.Unlock()
+	})
+
+	return err
+}
+
+var _ tracesdk.SpanExporter = (*Exporter)(nil)
+
+// New constructs a new Exporter and starts it.
+func New(ctx context.Context, client Client) (*Exporter, error) {
+	exp := NewUnstarted(client)
+	if err := exp.Start(ctx); err != nil {
+		return nil, err
+	}
+	return exp, nil
+}
+
+// NewUnstarted constructs a new Exporter and does not start it.
+func NewUnstarted(client Client) *Exporter {
+	return &Exporter{
+		client: client,
+	}
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this exporter.
+func (e *Exporter) MarshalLog() interface{} {
+	return struct {
+		Type   string
+		Client Client
+	}{
+		Type:   "otlptrace",
+		Client: e.client,
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/envconfig.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/envconfig.go
new file mode 100644
index 0000000000..62c5029db2
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/envconfig.go
@@ -0,0 +1,150 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig"
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"net/url"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	"go.opentelemetry.io/otel/exporters/otlp/internal/envconfig"
+)
+
+// DefaultEnvOptionsReader is the default environments reader.
+var DefaultEnvOptionsReader = envconfig.EnvOptionsReader{
+	GetEnv:    os.Getenv,
+	ReadFile:  os.ReadFile,
+	Namespace: "OTEL_EXPORTER_OTLP",
+}
+
+// ApplyGRPCEnvConfigs applies the env configurations for gRPC.
+func ApplyGRPCEnvConfigs(cfg Config) Config {
+	opts := getOptionsFromEnv()
+	for _, opt := range opts {
+		cfg = opt.ApplyGRPCOption(cfg)
+	}
+	return cfg
+}
+
+// ApplyHTTPEnvConfigs applies the env configurations for HTTP.
+func ApplyHTTPEnvConfigs(cfg Config) Config {
+	opts := getOptionsFromEnv()
+	for _, opt := range opts {
+		cfg = opt.ApplyHTTPOption(cfg)
+	}
+	return cfg
+}
+
+func getOptionsFromEnv() []GenericOption {
+	opts := []GenericOption{}
+
+	tlsConf := &tls.Config{}
+	DefaultEnvOptionsReader.Apply(
+		envconfig.WithURL("ENDPOINT", func(u *url.URL) {
+			opts = append(opts, withEndpointScheme(u))
+			opts = append(opts, newSplitOption(func(cfg Config) Config {
+				cfg.Traces.Endpoint = u.Host
+				// For OTLP/HTTP endpoint URLs without a per-signal
+				// configuration, the passed endpoint is used as a base URL
+				// and the signals are sent to these paths relative to that.
+				cfg.Traces.URLPath = path.Join(u.Path, DefaultTracesPath)
+				return cfg
+			}, withEndpointForGRPC(u)))
+		}),
+		envconfig.WithURL("TRACES_ENDPOINT", func(u *url.URL) {
+			opts = append(opts, withEndpointScheme(u))
+			opts = append(opts, newSplitOption(func(cfg Config) Config {
+				cfg.Traces.Endpoint = u.Host
+				// For endpoint URLs for OTLP/HTTP per-signal variables, the
+				// URL MUST be used as-is without any modification. The only
+				// exception is that if an URL contains no path part, the root
+				// path / MUST be used.
+				path := u.Path
+				if path == "" {
+					path = "/"
+				}
+				cfg.Traces.URLPath = path
+				return cfg
+			}, withEndpointForGRPC(u)))
+		}),
+		envconfig.WithCertPool("CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
+		envconfig.WithCertPool("TRACES_CERTIFICATE", func(p *x509.CertPool) { tlsConf.RootCAs = p }),
+		envconfig.WithClientCert("CLIENT_CERTIFICATE", "CLIENT_KEY", func(c tls.Certificate) { tlsConf.Certificates = []tls.Certificate{c} }),
+		envconfig.WithClientCert("TRACES_CLIENT_CERTIFICATE", "TRACES_CLIENT_KEY", func(c tls.Certificate) { tlsConf.Certificates = []tls.Certificate{c} }),
+		withTLSConfig(tlsConf, func(c *tls.Config) { opts = append(opts, WithTLSClientConfig(c)) }),
+		envconfig.WithBool("INSECURE", func(b bool) { opts = append(opts, withInsecure(b)) }),
+		envconfig.WithBool("TRACES_INSECURE", func(b bool) { opts = append(opts, withInsecure(b)) }),
+		envconfig.WithHeaders("HEADERS", func(h map[string]string) { opts = append(opts, WithHeaders(h)) }),
+		envconfig.WithHeaders("TRACES_HEADERS", func(h map[string]string) { opts = append(opts, WithHeaders(h)) }),
+		WithEnvCompression("COMPRESSION", func(c Compression) { opts = append(opts, WithCompression(c)) }),
+		WithEnvCompression("TRACES_COMPRESSION", func(c Compression) { opts = append(opts, WithCompression(c)) }),
+		envconfig.WithDuration("TIMEOUT", func(d time.Duration) { opts = append(opts, WithTimeout(d)) }),
+		envconfig.WithDuration("TRACES_TIMEOUT", func(d time.Duration) { opts = append(opts, WithTimeout(d)) }),
+	)
+
+	return opts
+}
+
+func withEndpointScheme(u *url.URL) GenericOption {
+	switch strings.ToLower(u.Scheme) {
+	case "http", "unix":
+		return WithInsecure()
+	default:
+		return WithSecure()
+	}
+}
+
+func withEndpointForGRPC(u *url.URL) func(cfg Config) Config {
+	return func(cfg Config) Config {
+		// For OTLP/gRPC endpoints, this is the target to which the
+		// exporter is going to send telemetry.
+		cfg.Traces.Endpoint = path.Join(u.Host, u.Path)
+		return cfg
+	}
+}
+
+// WithEnvCompression retrieves the specified config and passes it to ConfigFn as a Compression.
+func WithEnvCompression(n string, fn func(Compression)) func(e *envconfig.EnvOptionsReader) {
+	return func(e *envconfig.EnvOptionsReader) {
+		if v, ok := e.GetEnvValue(n); ok {
+			cp := NoCompression
+			if v == "gzip" {
+				cp = GzipCompression
+			}
+
+			fn(cp)
+		}
+	}
+}
+
+// revive:disable-next-line:flag-parameter
+func withInsecure(b bool) GenericOption {
+	if b {
+		return WithInsecure()
+	}
+	return WithSecure()
+}
+
+func withTLSConfig(c *tls.Config, fn func(*tls.Config)) func(e *envconfig.EnvOptionsReader) {
+	return func(e *envconfig.EnvOptionsReader) {
+		if c.RootCAs != nil || len(c.Certificates) > 0 {
+			fn(c)
+		}
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/options.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/options.go
new file mode 100644
index 0000000000..c48ffd5308
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/options.go
@@ -0,0 +1,308 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig"
+
+import (
+	"crypto/tls"
+	"fmt"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/encoding/gzip"
+
+	"go.opentelemetry.io/otel/exporters/otlp/internal"
+	"go.opentelemetry.io/otel/exporters/otlp/internal/retry"
+)
+
+const (
+	// DefaultTracesPath is a default URL path for endpoint that
+	// receives spans.
+	DefaultTracesPath string = "/v1/traces"
+	// DefaultTimeout is a default max waiting time for the backend to process
+	// each span batch.
+	DefaultTimeout time.Duration = 10 * time.Second
+)
+
+type (
+	SignalConfig struct {
+		Endpoint    string
+		Insecure    bool
+		TLSCfg      *tls.Config
+		Headers     map[string]string
+		Compression Compression
+		Timeout     time.Duration
+		URLPath     string
+
+		// gRPC configurations
+		GRPCCredentials credentials.TransportCredentials
+	}
+
+	Config struct {
+		// Signal specific configurations
+		Traces SignalConfig
+
+		RetryConfig retry.Config
+
+		// gRPC configurations
+		ReconnectionPeriod time.Duration
+		ServiceConfig      string
+		DialOptions        []grpc.DialOption
+		GRPCConn           *grpc.ClientConn
+	}
+)
+
+// NewHTTPConfig returns a new Config with all settings applied from opts and
+// any unset setting using the default HTTP config values.
+func NewHTTPConfig(opts ...HTTPOption) Config {
+	cfg := Config{
+		Traces: SignalConfig{
+			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorHTTPPort),
+			URLPath:     DefaultTracesPath,
+			Compression: NoCompression,
+			Timeout:     DefaultTimeout,
+		},
+		RetryConfig: retry.DefaultConfig,
+	}
+	cfg = ApplyHTTPEnvConfigs(cfg)
+	for _, opt := range opts {
+		cfg = opt.ApplyHTTPOption(cfg)
+	}
+	cfg.Traces.URLPath = internal.CleanPath(cfg.Traces.URLPath, DefaultTracesPath)
+	return cfg
+}
+
+// NewGRPCConfig returns a new Config with all settings applied from opts and
+// any unset setting using the default gRPC config values.
+func NewGRPCConfig(opts ...GRPCOption) Config {
+	cfg := Config{
+		Traces: SignalConfig{
+			Endpoint:    fmt.Sprintf("%s:%d", DefaultCollectorHost, DefaultCollectorGRPCPort),
+			URLPath:     DefaultTracesPath,
+			Compression: NoCompression,
+			Timeout:     DefaultTimeout,
+		},
+		RetryConfig: retry.DefaultConfig,
+		DialOptions: []grpc.DialOption{grpc.WithUserAgent(internal.GetUserAgentHeader())},
+	}
+	cfg = ApplyGRPCEnvConfigs(cfg)
+	for _, opt := range opts {
+		cfg = opt.ApplyGRPCOption(cfg)
+	}
+
+	if cfg.ServiceConfig != "" {
+		cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
+	}
+	// Priroritize GRPCCredentials over Insecure (passing both is an error).
+	if cfg.Traces.GRPCCredentials != nil {
+		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Traces.GRPCCredentials))
+	} else if cfg.Traces.Insecure {
+		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	} else {
+		// Default to using the host's root CA.
+		creds := credentials.NewTLS(nil)
+		cfg.Traces.GRPCCredentials = creds
+		cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(creds))
+	}
+	if cfg.Traces.Compression == GzipCompression {
+		cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultCallOptions(grpc.UseCompressor(gzip.Name)))
+	}
+	if len(cfg.DialOptions) != 0 {
+		cfg.DialOptions = append(cfg.DialOptions, cfg.DialOptions...)
+	}
+	if cfg.ReconnectionPeriod != 0 {
+		p := grpc.ConnectParams{
+			Backoff:           backoff.DefaultConfig,
+			MinConnectTimeout: cfg.ReconnectionPeriod,
+		}
+		cfg.DialOptions = append(cfg.DialOptions, grpc.WithConnectParams(p))
+	}
+
+	return cfg
+}
+
+type (
+	// GenericOption applies an option to the HTTP or gRPC driver.
+	GenericOption interface {
+		ApplyHTTPOption(Config) Config
+		ApplyGRPCOption(Config) Config
+
+		// A private method to prevent users implementing the
+		// interface and so future additions to it will not
+		// violate compatibility.
+		private()
+	}
+
+	// HTTPOption applies an option to the HTTP driver.
+	HTTPOption interface {
+		ApplyHTTPOption(Config) Config
+
+		// A private method to prevent users implementing the
+		// interface and so future additions to it will not
+		// violate compatibility.
+		private()
+	}
+
+	// GRPCOption applies an option to the gRPC driver.
+	GRPCOption interface {
+		ApplyGRPCOption(Config) Config
+
+		// A private method to prevent users implementing the
+		// interface and so future additions to it will not
+		// violate compatibility.
+		private()
+	}
+)
+
+// genericOption is an option that applies the same logic
+// for both gRPC and HTTP.
+type genericOption struct {
+	fn func(Config) Config
+}
+
+func (g *genericOption) ApplyGRPCOption(cfg Config) Config {
+	return g.fn(cfg)
+}
+
+func (g *genericOption) ApplyHTTPOption(cfg Config) Config {
+	return g.fn(cfg)
+}
+
+func (genericOption) private() {}
+
+func newGenericOption(fn func(cfg Config) Config) GenericOption {
+	return &genericOption{fn: fn}
+}
+
+// splitOption is an option that applies different logics
+// for gRPC and HTTP.
+type splitOption struct {
+	httpFn func(Config) Config
+	grpcFn func(Config) Config
+}
+
+func (g *splitOption) ApplyGRPCOption(cfg Config) Config {
+	return g.grpcFn(cfg)
+}
+
+func (g *splitOption) ApplyHTTPOption(cfg Config) Config {
+	return g.httpFn(cfg)
+}
+
+func (splitOption) private() {}
+
+func newSplitOption(httpFn func(cfg Config) Config, grpcFn func(cfg Config) Config) GenericOption {
+	return &splitOption{httpFn: httpFn, grpcFn: grpcFn}
+}
+
+// httpOption is an option that is only applied to the HTTP driver.
+type httpOption struct {
+	fn func(Config) Config
+}
+
+func (h *httpOption) ApplyHTTPOption(cfg Config) Config {
+	return h.fn(cfg)
+}
+
+func (httpOption) private() {}
+
+func NewHTTPOption(fn func(cfg Config) Config) HTTPOption {
+	return &httpOption{fn: fn}
+}
+
+// grpcOption is an option that is only applied to the gRPC driver.
+type grpcOption struct {
+	fn func(Config) Config
+}
+
+func (h *grpcOption) ApplyGRPCOption(cfg Config) Config {
+	return h.fn(cfg)
+}
+
+func (grpcOption) private() {}
+
+func NewGRPCOption(fn func(cfg Config) Config) GRPCOption {
+	return &grpcOption{fn: fn}
+}
+
+// Generic Options
+
+func WithEndpoint(endpoint string) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.Endpoint = endpoint
+		return cfg
+	})
+}
+
+func WithCompression(compression Compression) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.Compression = compression
+		return cfg
+	})
+}
+
+func WithURLPath(urlPath string) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.URLPath = urlPath
+		return cfg
+	})
+}
+
+func WithRetry(rc retry.Config) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.RetryConfig = rc
+		return cfg
+	})
+}
+
+func WithTLSClientConfig(tlsCfg *tls.Config) GenericOption {
+	return newSplitOption(func(cfg Config) Config {
+		cfg.Traces.TLSCfg = tlsCfg.Clone()
+		return cfg
+	}, func(cfg Config) Config {
+		cfg.Traces.GRPCCredentials = credentials.NewTLS(tlsCfg)
+		return cfg
+	})
+}
+
+func WithInsecure() GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.Insecure = true
+		return cfg
+	})
+}
+
+func WithSecure() GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.Insecure = false
+		return cfg
+	})
+}
+
+func WithHeaders(headers map[string]string) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.Headers = headers
+		return cfg
+	})
+}
+
+func WithTimeout(duration time.Duration) GenericOption {
+	return newGenericOption(func(cfg Config) Config {
+		cfg.Traces.Timeout = duration
+		return cfg
+	})
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/optiontypes.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/optiontypes.go
new file mode 100644
index 0000000000..c2d6c03615
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/optiontypes.go
@@ -0,0 +1,48 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig"
+
+const (
+	// DefaultCollectorGRPCPort is the default gRPC port of the collector.
+	DefaultCollectorGRPCPort uint16 = 4317
+	// DefaultCollectorHTTPPort is the default HTTP port of the collector.
+	DefaultCollectorHTTPPort uint16 = 4318
+	// DefaultCollectorHost is the host address the Exporter will attempt
+	// connect to if no collector address is provided.
+	DefaultCollectorHost string = "localhost"
+)
+
+// Compression describes the compression used for payloads sent to the
+// collector.
+type Compression int
+
+const (
+	// NoCompression tells the driver to send payloads without
+	// compression.
+	NoCompression Compression = iota
+	// GzipCompression tells the driver to send payloads after
+	// compressing them with gzip.
+	GzipCompression
+)
+
+// Marshaler describes the kind of message format sent to the collector.
+type Marshaler int
+
+const (
+	// MarshalProto tells the driver to send using the protobuf binary format.
+	MarshalProto Marshaler = iota
+	// MarshalJSON tells the driver to send using json format.
+	MarshalJSON
+)
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/tls.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/tls.go
new file mode 100644
index 0000000000..7287cf6cfe
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig/tls.go
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlpconfig // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig"
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+)
+
+// CreateTLSConfig creates a tls.Config from a raw certificate bytes
+// to verify a server certificate.
+func CreateTLSConfig(certBytes []byte) (*tls.Config, error) {
+	cp := x509.NewCertPool()
+	if ok := cp.AppendCertsFromPEM(certBytes); !ok {
+		return nil, errors.New("failed to append certificate to the cert pool")
+	}
+
+	return &tls.Config{
+		RootCAs: cp,
+	}, nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go
new file mode 100644
index 0000000000..ec74f1aad7
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/attribute.go
@@ -0,0 +1,158 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+
+import (
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/sdk/resource"
+	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
+)
+
+// KeyValues transforms a slice of attribute KeyValues into OTLP key-values.
+func KeyValues(attrs []attribute.KeyValue) []*commonpb.KeyValue {
+	if len(attrs) == 0 {
+		return nil
+	}
+
+	out := make([]*commonpb.KeyValue, 0, len(attrs))
+	for _, kv := range attrs {
+		out = append(out, KeyValue(kv))
+	}
+	return out
+}
+
+// Iterator transforms an attribute iterator into OTLP key-values.
+func Iterator(iter attribute.Iterator) []*commonpb.KeyValue {
+	l := iter.Len()
+	if l == 0 {
+		return nil
+	}
+
+	out := make([]*commonpb.KeyValue, 0, l)
+	for iter.Next() {
+		out = append(out, KeyValue(iter.Attribute()))
+	}
+	return out
+}
+
+// ResourceAttributes transforms a Resource OTLP key-values.
+func ResourceAttributes(res *resource.Resource) []*commonpb.KeyValue {
+	return Iterator(res.Iter())
+}
+
+// KeyValue transforms an attribute KeyValue into an OTLP key-value.
+func KeyValue(kv attribute.KeyValue) *commonpb.KeyValue {
+	return &commonpb.KeyValue{Key: string(kv.Key), Value: Value(kv.Value)}
+}
+
+// Value transforms an attribute Value into an OTLP AnyValue.
+func Value(v attribute.Value) *commonpb.AnyValue {
+	av := new(commonpb.AnyValue)
+	switch v.Type() {
+	case attribute.BOOL:
+		av.Value = &commonpb.AnyValue_BoolValue{
+			BoolValue: v.AsBool(),
+		}
+	case attribute.BOOLSLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: boolSliceValues(v.AsBoolSlice()),
+			},
+		}
+	case attribute.INT64:
+		av.Value = &commonpb.AnyValue_IntValue{
+			IntValue: v.AsInt64(),
+		}
+	case attribute.INT64SLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: int64SliceValues(v.AsInt64Slice()),
+			},
+		}
+	case attribute.FLOAT64:
+		av.Value = &commonpb.AnyValue_DoubleValue{
+			DoubleValue: v.AsFloat64(),
+		}
+	case attribute.FLOAT64SLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: float64SliceValues(v.AsFloat64Slice()),
+			},
+		}
+	case attribute.STRING:
+		av.Value = &commonpb.AnyValue_StringValue{
+			StringValue: v.AsString(),
+		}
+	case attribute.STRINGSLICE:
+		av.Value = &commonpb.AnyValue_ArrayValue{
+			ArrayValue: &commonpb.ArrayValue{
+				Values: stringSliceValues(v.AsStringSlice()),
+			},
+		}
+	default:
+		av.Value = &commonpb.AnyValue_StringValue{
+			StringValue: "INVALID",
+		}
+	}
+	return av
+}
+
+func boolSliceValues(vals []bool) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_BoolValue{
+				BoolValue: v,
+			},
+		}
+	}
+	return converted
+}
+
+func int64SliceValues(vals []int64) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_IntValue{
+				IntValue: v,
+			},
+		}
+	}
+	return converted
+}
+
+func float64SliceValues(vals []float64) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_DoubleValue{
+				DoubleValue: v,
+			},
+		}
+	}
+	return converted
+}
+
+func stringSliceValues(vals []string) []*commonpb.AnyValue {
+	converted := make([]*commonpb.AnyValue, len(vals))
+	for i, v := range vals {
+		converted[i] = &commonpb.AnyValue{
+			Value: &commonpb.AnyValue_StringValue{
+				StringValue: v,
+			},
+		}
+	}
+	return converted
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go
new file mode 100644
index 0000000000..7aaec38d22
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/instrumentation.go
@@ -0,0 +1,30 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+
+import (
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
+)
+
+func InstrumentationScope(il instrumentation.Scope) *commonpb.InstrumentationScope {
+	if il == (instrumentation.Scope{}) {
+		return nil
+	}
+	return &commonpb.InstrumentationScope{
+		Name:    il.Name,
+		Version: il.Version,
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go
new file mode 100644
index 0000000000..05a1f78adb
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/resource.go
@@ -0,0 +1,28 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+
+import (
+	"go.opentelemetry.io/otel/sdk/resource"
+	resourcepb "go.opentelemetry.io/proto/otlp/resource/v1"
+)
+
+// Resource transforms a Resource into an OTLP Resource.
+func Resource(r *resource.Resource) *resourcepb.Resource {
+	if r == nil {
+		return nil
+	}
+	return &resourcepb.Resource{Attributes: ResourceAttributes(r)}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go
new file mode 100644
index 0000000000..b83cbd7247
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/span.go
@@ -0,0 +1,205 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tracetransform // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform"
+
+import (
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	tracesdk "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/trace"
+	tracepb "go.opentelemetry.io/proto/otlp/trace/v1"
+)
+
+// Spans transforms a slice of OpenTelemetry spans into a slice of OTLP
+// ResourceSpans.
+func Spans(sdl []tracesdk.ReadOnlySpan) []*tracepb.ResourceSpans {
+	if len(sdl) == 0 {
+		return nil
+	}
+
+	rsm := make(map[attribute.Distinct]*tracepb.ResourceSpans)
+
+	type key struct {
+		r  attribute.Distinct
+		is instrumentation.Scope
+	}
+	ssm := make(map[key]*tracepb.ScopeSpans)
+
+	var resources int
+	for _, sd := range sdl {
+		if sd == nil {
+			continue
+		}
+
+		rKey := sd.Resource().Equivalent()
+		k := key{
+			r:  rKey,
+			is: sd.InstrumentationScope(),
+		}
+		scopeSpan, iOk := ssm[k]
+		if !iOk {
+			// Either the resource or instrumentation scope were unknown.
+			scopeSpan = &tracepb.ScopeSpans{
+				Scope:     InstrumentationScope(sd.InstrumentationScope()),
+				Spans:     []*tracepb.Span{},
+				SchemaUrl: sd.InstrumentationScope().SchemaURL,
+			}
+		}
+		scopeSpan.Spans = append(scopeSpan.Spans, span(sd))
+		ssm[k] = scopeSpan
+
+		rs, rOk := rsm[rKey]
+		if !rOk {
+			resources++
+			// The resource was unknown.
+			rs = &tracepb.ResourceSpans{
+				Resource:   Resource(sd.Resource()),
+				ScopeSpans: []*tracepb.ScopeSpans{scopeSpan},
+				SchemaUrl:  sd.Resource().SchemaURL(),
+			}
+			rsm[rKey] = rs
+			continue
+		}
+
+		// The resource has been seen before. Check if the instrumentation
+		// library lookup was unknown because if so we need to add it to the
+		// ResourceSpans. Otherwise, the instrumentation library has already
+		// been seen and the append we did above will be included it in the
+		// ScopeSpans reference.
+		if !iOk {
+			rs.ScopeSpans = append(rs.ScopeSpans, scopeSpan)
+		}
+	}
+
+	// Transform the categorized map into a slice
+	rss := make([]*tracepb.ResourceSpans, 0, resources)
+	for _, rs := range rsm {
+		rss = append(rss, rs)
+	}
+	return rss
+}
+
+// span transforms a Span into an OTLP span.
+func span(sd tracesdk.ReadOnlySpan) *tracepb.Span {
+	if sd == nil {
+		return nil
+	}
+
+	tid := sd.SpanContext().TraceID()
+	sid := sd.SpanContext().SpanID()
+
+	s := &tracepb.Span{
+		TraceId:                tid[:],
+		SpanId:                 sid[:],
+		TraceState:             sd.SpanContext().TraceState().String(),
+		Status:                 status(sd.Status().Code, sd.Status().Description),
+		StartTimeUnixNano:      uint64(sd.StartTime().UnixNano()),
+		EndTimeUnixNano:        uint64(sd.EndTime().UnixNano()),
+		Links:                  links(sd.Links()),
+		Kind:                   spanKind(sd.SpanKind()),
+		Name:                   sd.Name(),
+		Attributes:             KeyValues(sd.Attributes()),
+		Events:                 spanEvents(sd.Events()),
+		DroppedAttributesCount: uint32(sd.DroppedAttributes()),
+		DroppedEventsCount:     uint32(sd.DroppedEvents()),
+		DroppedLinksCount:      uint32(sd.DroppedLinks()),
+	}
+
+	if psid := sd.Parent().SpanID(); psid.IsValid() {
+		s.ParentSpanId = psid[:]
+	}
+
+	return s
+}
+
+// status transform a span code and message into an OTLP span status.
+func status(status codes.Code, message string) *tracepb.Status {
+	var c tracepb.Status_StatusCode
+	switch status {
+	case codes.Ok:
+		c = tracepb.Status_STATUS_CODE_OK
+	case codes.Error:
+		c = tracepb.Status_STATUS_CODE_ERROR
+	default:
+		c = tracepb.Status_STATUS_CODE_UNSET
+	}
+	return &tracepb.Status{
+		Code:    c,
+		Message: message,
+	}
+}
+
+// links transforms span Links to OTLP span links.
+func links(links []tracesdk.Link) []*tracepb.Span_Link {
+	if len(links) == 0 {
+		return nil
+	}
+
+	sl := make([]*tracepb.Span_Link, 0, len(links))
+	for _, otLink := range links {
+		// This redefinition is necessary to prevent otLink.*ID[:] copies
+		// being reused -- in short we need a new otLink per iteration.
+		otLink := otLink
+
+		tid := otLink.SpanContext.TraceID()
+		sid := otLink.SpanContext.SpanID()
+
+		sl = append(sl, &tracepb.Span_Link{
+			TraceId:                tid[:],
+			SpanId:                 sid[:],
+			Attributes:             KeyValues(otLink.Attributes),
+			DroppedAttributesCount: uint32(otLink.DroppedAttributeCount),
+		})
+	}
+	return sl
+}
+
+// spanEvents transforms span Events to an OTLP span events.
+func spanEvents(es []tracesdk.Event) []*tracepb.Span_Event {
+	if len(es) == 0 {
+		return nil
+	}
+
+	events := make([]*tracepb.Span_Event, len(es))
+	// Transform message events
+	for i := 0; i < len(es); i++ {
+		events[i] = &tracepb.Span_Event{
+			Name:                   es[i].Name,
+			TimeUnixNano:           uint64(es[i].Time.UnixNano()),
+			Attributes:             KeyValues(es[i].Attributes),
+			DroppedAttributesCount: uint32(es[i].DroppedAttributeCount),
+		}
+	}
+	return events
+}
+
+// spanKind transforms a SpanKind to an OTLP span kind.
+func spanKind(kind trace.SpanKind) tracepb.Span_SpanKind {
+	switch kind {
+	case trace.SpanKindInternal:
+		return tracepb.Span_SPAN_KIND_INTERNAL
+	case trace.SpanKindClient:
+		return tracepb.Span_SPAN_KIND_CLIENT
+	case trace.SpanKindServer:
+		return tracepb.Span_SPAN_KIND_SERVER
+	case trace.SpanKindProducer:
+		return tracepb.Span_SPAN_KIND_PRODUCER
+	case trace.SpanKindConsumer:
+		return tracepb.Span_SPAN_KIND_CONSUMER
+	default:
+		return tracepb.Span_SPAN_KIND_UNSPECIFIED
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/LICENSE b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go
new file mode 100644
index 0000000000..fe23f8e376
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/client.go
@@ -0,0 +1,296 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"time"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/otlp/internal"
+	"go.opentelemetry.io/otel/exporters/otlp/internal/retry"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig"
+	coltracepb "go.opentelemetry.io/proto/otlp/collector/trace/v1"
+	tracepb "go.opentelemetry.io/proto/otlp/trace/v1"
+)
+
+type client struct {
+	endpoint      string
+	dialOpts      []grpc.DialOption
+	metadata      metadata.MD
+	exportTimeout time.Duration
+	requestFunc   retry.RequestFunc
+
+	// stopCtx is used as a parent context for all exports. Therefore, when it
+	// is canceled with the stopFunc all exports are canceled.
+	stopCtx context.Context
+	// stopFunc cancels stopCtx, stopping any active exports.
+	stopFunc context.CancelFunc
+
+	// ourConn keeps track of where conn was created: true if created here on
+	// Start, or false if passed with an option. This is important on Shutdown
+	// as the conn should only be closed if created here on start. Otherwise,
+	// it is up to the processes that passed the conn to close it.
+	ourConn bool
+	conn    *grpc.ClientConn
+	tscMu   sync.RWMutex
+	tsc     coltracepb.TraceServiceClient
+}
+
+// Compile time check *client implements otlptrace.Client.
+var _ otlptrace.Client = (*client)(nil)
+
+// NewClient creates a new gRPC trace client.
+func NewClient(opts ...Option) otlptrace.Client {
+	return newClient(opts...)
+}
+
+func newClient(opts ...Option) *client {
+	cfg := otlpconfig.NewGRPCConfig(asGRPCOptions(opts)...)
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	c := &client{
+		endpoint:      cfg.Traces.Endpoint,
+		exportTimeout: cfg.Traces.Timeout,
+		requestFunc:   cfg.RetryConfig.RequestFunc(retryable),
+		dialOpts:      cfg.DialOptions,
+		stopCtx:       ctx,
+		stopFunc:      cancel,
+		conn:          cfg.GRPCConn,
+	}
+
+	if len(cfg.Traces.Headers) > 0 {
+		c.metadata = metadata.New(cfg.Traces.Headers)
+	}
+
+	return c
+}
+
+// Start establishes a gRPC connection to the collector.
+func (c *client) Start(ctx context.Context) error {
+	if c.conn == nil {
+		// If the caller did not provide a ClientConn when the client was
+		// created, create one using the configuration they did provide.
+		conn, err := grpc.DialContext(ctx, c.endpoint, c.dialOpts...)
+		if err != nil {
+			return err
+		}
+		// Keep track that we own the lifecycle of this conn and need to close
+		// it on Shutdown.
+		c.ourConn = true
+		c.conn = conn
+	}
+
+	// The otlptrace.Client interface states this method is called just once,
+	// so no need to check if already started.
+	c.tscMu.Lock()
+	c.tsc = coltracepb.NewTraceServiceClient(c.conn)
+	c.tscMu.Unlock()
+
+	return nil
+}
+
+var errAlreadyStopped = errors.New("the client is already stopped")
+
+// Stop shuts down the client.
+//
+// Any active connections to a remote endpoint are closed if they were created
+// by the client. Any gRPC connection passed during creation using
+// WithGRPCConn will not be closed. It is the caller's responsibility to
+// handle cleanup of that resource.
+//
+// This method synchronizes with the UploadTraces method of the client. It
+// will wait for any active calls to that method to complete unimpeded, or it
+// will cancel any active calls if ctx expires. If ctx expires, the context
+// error will be forwarded as the returned error. All client held resources
+// will still be released in this situation.
+//
+// If the client has already stopped, an error will be returned describing
+// this.
+func (c *client) Stop(ctx context.Context) error {
+	// Acquire the c.tscMu lock within the ctx lifetime.
+	acquired := make(chan struct{})
+	go func() {
+		c.tscMu.Lock()
+		close(acquired)
+	}()
+	var err error
+	select {
+	case <-ctx.Done():
+		// The Stop timeout is reached. Kill any remaining exports to force
+		// the clear of the lock and save the timeout error to return and
+		// signal the shutdown timed out before cleanly stopping.
+		c.stopFunc()
+		err = ctx.Err()
+
+		// To ensure the client is not left in a dirty state c.tsc needs to be
+		// set to nil. To avoid the race condition when doing this, ensure
+		// that all the exports are killed (initiated by c.stopFunc).
+		<-acquired
+	case <-acquired:
+	}
+	// Hold the tscMu lock for the rest of the function to ensure no new
+	// exports are started.
+	defer c.tscMu.Unlock()
+
+	// The otlptrace.Client interface states this method is called only
+	// once, but there is no guarantee it is called after Start. Ensure the
+	// client is started before doing anything and let the called know if they
+	// made a mistake.
+	if c.tsc == nil {
+		return errAlreadyStopped
+	}
+
+	// Clear c.tsc to signal the client is stopped.
+	c.tsc = nil
+
+	if c.ourConn {
+		closeErr := c.conn.Close()
+		// A context timeout error takes precedence over this error.
+		if err == nil && closeErr != nil {
+			err = closeErr
+		}
+	}
+	return err
+}
+
+var errShutdown = errors.New("the client is shutdown")
+
+// UploadTraces sends a batch of spans.
+//
+// Retryable errors from the server will be handled according to any
+// RetryConfig the client was created with.
+func (c *client) UploadTraces(ctx context.Context, protoSpans []*tracepb.ResourceSpans) error {
+	// Hold a read lock to ensure a shut down initiated after this starts does
+	// not abandon the export. This read lock acquire has less priority than a
+	// write lock acquire (i.e. Stop), meaning if the client is shutting down
+	// this will come after the shut down.
+	c.tscMu.RLock()
+	defer c.tscMu.RUnlock()
+
+	if c.tsc == nil {
+		return errShutdown
+	}
+
+	ctx, cancel := c.exportContext(ctx)
+	defer cancel()
+
+	return c.requestFunc(ctx, func(iCtx context.Context) error {
+		resp, err := c.tsc.Export(iCtx, &coltracepb.ExportTraceServiceRequest{
+			ResourceSpans: protoSpans,
+		})
+		if resp != nil && resp.PartialSuccess != nil {
+			msg := resp.PartialSuccess.GetErrorMessage()
+			n := resp.PartialSuccess.GetRejectedSpans()
+			if n != 0 || msg != "" {
+				err := internal.TracePartialSuccessError(n, msg)
+				otel.Handle(err)
+			}
+		}
+		// nil is converted to OK.
+		if status.Code(err) == codes.OK {
+			// Success.
+			return nil
+		}
+		return err
+	})
+}
+
+// exportContext returns a copy of parent with an appropriate deadline and
+// cancellation function.
+//
+// It is the callers responsibility to cancel the returned context once its
+// use is complete, via the parent or directly with the returned CancelFunc, to
+// ensure all resources are correctly released.
+func (c *client) exportContext(parent context.Context) (context.Context, context.CancelFunc) {
+	var (
+		ctx    context.Context
+		cancel context.CancelFunc
+	)
+
+	if c.exportTimeout > 0 {
+		ctx, cancel = context.WithTimeout(parent, c.exportTimeout)
+	} else {
+		ctx, cancel = context.WithCancel(parent)
+	}
+
+	if c.metadata.Len() > 0 {
+		ctx = metadata.NewOutgoingContext(ctx, c.metadata)
+	}
+
+	// Unify the client stopCtx with the parent.
+	go func() {
+		select {
+		case <-ctx.Done():
+		case <-c.stopCtx.Done():
+			// Cancel the export as the shutdown has timed out.
+			cancel()
+		}
+	}()
+
+	return ctx, cancel
+}
+
+// retryable returns if err identifies a request that can be retried and a
+// duration to wait for if an explicit throttle time is included in err.
+func retryable(err error) (bool, time.Duration) {
+	//func retryable(err error) (bool, time.Duration) {
+	s := status.Convert(err)
+	switch s.Code() {
+	case codes.Canceled,
+		codes.DeadlineExceeded,
+		codes.ResourceExhausted,
+		codes.Aborted,
+		codes.OutOfRange,
+		codes.Unavailable,
+		codes.DataLoss:
+		return true, throttleDelay(s)
+	}
+
+	// Not a retry-able error.
+	return false, 0
+}
+
+// throttleDelay returns a duration to wait for if an explicit throttle time
+// is included in the response status.
+func throttleDelay(s *status.Status) time.Duration {
+	for _, detail := range s.Details() {
+		if t, ok := detail.(*errdetails.RetryInfo); ok {
+			return t.RetryDelay.AsDuration()
+		}
+	}
+	return 0
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this Client.
+func (c *client) MarshalLog() interface{} {
+	return struct {
+		Type     string
+		Endpoint string
+	}{
+		Type:     "otlphttpgrpc",
+		Endpoint: c.endpoint,
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go
new file mode 100644
index 0000000000..89af41002f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/exporter.go
@@ -0,0 +1,31 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+)
+
+// New constructs a new Exporter and starts it.
+func New(ctx context.Context, opts ...Option) (*otlptrace.Exporter, error) {
+	return otlptrace.New(ctx, NewClient(opts...))
+}
+
+// NewUnstarted constructs a new Exporter and does not start it.
+func NewUnstarted(opts ...Option) *otlptrace.Exporter {
+	return otlptrace.NewUnstarted(NewClient(opts...))
+}
diff --git a/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go
new file mode 100644
index 0000000000..3d09ce590d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/options.go
@@ -0,0 +1,189 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otlptracegrpc // import "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+
+import (
+	"fmt"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/exporters/otlp/internal/retry"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig"
+)
+
+// Option applies an option to the gRPC driver.
+type Option interface {
+	applyGRPCOption(otlpconfig.Config) otlpconfig.Config
+}
+
+func asGRPCOptions(opts []Option) []otlpconfig.GRPCOption {
+	converted := make([]otlpconfig.GRPCOption, len(opts))
+	for i, o := range opts {
+		converted[i] = otlpconfig.NewGRPCOption(o.applyGRPCOption)
+	}
+	return converted
+}
+
+// RetryConfig defines configuration for retrying export of span batches that
+// failed to be received by the target endpoint.
+//
+// This configuration does not define any network retry strategy. That is
+// entirely handled by the gRPC ClientConn.
+type RetryConfig retry.Config
+
+type wrappedOption struct {
+	otlpconfig.GRPCOption
+}
+
+func (w wrappedOption) applyGRPCOption(cfg otlpconfig.Config) otlpconfig.Config {
+	return w.ApplyGRPCOption(cfg)
+}
+
+// WithInsecure disables client transport security for the exporter's gRPC
+// connection just like grpc.WithInsecure()
+// (https://pkg.go.dev/google.golang.org/grpc#WithInsecure) does. Note, by
+// default, client security is required unless WithInsecure is used.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithInsecure() Option {
+	return wrappedOption{otlpconfig.WithInsecure()}
+}
+
+// WithEndpoint sets the target endpoint the exporter will connect to. If
+// unset, localhost:4317 will be used as a default.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithEndpoint(endpoint string) Option {
+	return wrappedOption{otlpconfig.WithEndpoint(endpoint)}
+}
+
+// WithReconnectionPeriod set the minimum amount of time between connection
+// attempts to the target endpoint.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithReconnectionPeriod(rp time.Duration) Option {
+	return wrappedOption{otlpconfig.NewGRPCOption(func(cfg otlpconfig.Config) otlpconfig.Config {
+		cfg.ReconnectionPeriod = rp
+		return cfg
+	})}
+}
+
+func compressorToCompression(compressor string) otlpconfig.Compression {
+	if compressor == "gzip" {
+		return otlpconfig.GzipCompression
+	}
+
+	otel.Handle(fmt.Errorf("invalid compression type: '%s', using no compression as default", compressor))
+	return otlpconfig.NoCompression
+}
+
+// WithCompressor sets the compressor for the gRPC client to use when sending
+// requests. It is the responsibility of the caller to ensure that the
+// compressor set has been registered with google.golang.org/grpc/encoding.
+// This can be done by encoding.RegisterCompressor. Some compressors
+// auto-register on import, such as gzip, which can be registered by calling
+// `import _ "google.golang.org/grpc/encoding/gzip"`.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithCompressor(compressor string) Option {
+	return wrappedOption{otlpconfig.WithCompression(compressorToCompression(compressor))}
+}
+
+// WithHeaders will send the provided headers with each gRPC requests.
+func WithHeaders(headers map[string]string) Option {
+	return wrappedOption{otlpconfig.WithHeaders(headers)}
+}
+
+// WithTLSCredentials allows the connection to use TLS credentials when
+// talking to the server. It takes in grpc.TransportCredentials instead of say
+// a Certificate file or a tls.Certificate, because the retrieving of these
+// credentials can be done in many ways e.g. plain file, in code tls.Config or
+// by certificate rotation, so it is up to the caller to decide what to use.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithTLSCredentials(creds credentials.TransportCredentials) Option {
+	return wrappedOption{otlpconfig.NewGRPCOption(func(cfg otlpconfig.Config) otlpconfig.Config {
+		cfg.Traces.GRPCCredentials = creds
+		return cfg
+	})}
+}
+
+// WithServiceConfig defines the default gRPC service config used.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithServiceConfig(serviceConfig string) Option {
+	return wrappedOption{otlpconfig.NewGRPCOption(func(cfg otlpconfig.Config) otlpconfig.Config {
+		cfg.ServiceConfig = serviceConfig
+		return cfg
+	})}
+}
+
+// WithDialOption sets explicit grpc.DialOptions to use when making a
+// connection. The options here are appended to the internal grpc.DialOptions
+// used so they will take precedence over any other internal grpc.DialOptions
+// they might conflict with.
+//
+// This option has no effect if WithGRPCConn is used.
+func WithDialOption(opts ...grpc.DialOption) Option {
+	return wrappedOption{otlpconfig.NewGRPCOption(func(cfg otlpconfig.Config) otlpconfig.Config {
+		cfg.DialOptions = opts
+		return cfg
+	})}
+}
+
+// WithGRPCConn sets conn as the gRPC ClientConn used for all communication.
+//
+// This option takes precedence over any other option that relates to
+// establishing or persisting a gRPC connection to a target endpoint. Any
+// other option of those types passed will be ignored.
+//
+// It is the callers responsibility to close the passed conn. The client
+// Shutdown method will not close this connection.
+func WithGRPCConn(conn *grpc.ClientConn) Option {
+	return wrappedOption{otlpconfig.NewGRPCOption(func(cfg otlpconfig.Config) otlpconfig.Config {
+		cfg.GRPCConn = conn
+		return cfg
+	})}
+}
+
+// WithTimeout sets the max amount of time a client will attempt to export a
+// batch of spans. This takes precedence over any retry settings defined with
+// WithRetry, once this time limit has been reached the export is abandoned
+// and the batch of spans is dropped.
+//
+// If unset, the default timeout will be set to 10 seconds.
+func WithTimeout(duration time.Duration) Option {
+	return wrappedOption{otlpconfig.WithTimeout(duration)}
+}
+
+// WithRetry sets the retry policy for transient retryable errors that may be
+// returned by the target endpoint when exporting a batch of spans.
+//
+// If the target endpoint responds with not only a retryable error, but
+// explicitly returns a backoff time in the response. That time will take
+// precedence over these settings.
+//
+// These settings do not define any network retry strategy. That is entirely
+// handled by the gRPC ClientConn.
+//
+// If unset, the default retry policy will be used. It will retry the export
+// 5 seconds after receiving a retryable error and increase exponentially
+// after each error for no more than a total time of 1 minute.
+func WithRetry(settings RetryConfig) Option {
+	return wrappedOption{otlpconfig.WithRetry(retry.Config(settings))}
+}
diff --git a/vendor/go.opentelemetry.io/otel/get_main_pkgs.sh b/vendor/go.opentelemetry.io/otel/get_main_pkgs.sh
new file mode 100644
index 0000000000..9a58fb1d37
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/get_main_pkgs.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+# Copyright The OpenTelemetry Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+top_dir='.'
+if [[ $# -gt 0 ]]; then
+    top_dir="${1}"
+fi
+
+p=$(pwd)
+mod_dirs=()
+
+# Note `mapfile` does not exist in older bash versions:
+# https://stackoverflow.com/questions/41475261/need-alternative-to-readarray-mapfile-for-script-on-older-version-of-bash
+
+while IFS= read -r line; do
+    mod_dirs+=("$line")
+done < <(find "${top_dir}" -type f -name 'go.mod' -exec dirname {} \; | sort)
+
+for mod_dir in "${mod_dirs[@]}"; do
+    cd "${mod_dir}"
+
+    while IFS= read -r line; do
+        echo ".${line#${p}}"
+    done < <(go list --find -f '{{.Name}}|{{.Dir}}' ./... | grep '^main|' | cut -f 2- -d '|')
+    cd "${p}"
+done
diff --git a/vendor/go.opentelemetry.io/otel/handler.go b/vendor/go.opentelemetry.io/otel/handler.go
new file mode 100644
index 0000000000..ecd363ab51
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/handler.go
@@ -0,0 +1,96 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otel // import "go.opentelemetry.io/otel"
+
+import (
+	"log"
+	"os"
+	"sync/atomic"
+	"unsafe"
+)
+
+var (
+	// globalErrorHandler provides an ErrorHandler that can be used
+	// throughout an OpenTelemetry instrumented project. When a user
+	// specified ErrorHandler is registered (`SetErrorHandler`) all calls to
+	// `Handle` and will be delegated to the registered ErrorHandler.
+	globalErrorHandler = defaultErrorHandler()
+
+	// Compile-time check that delegator implements ErrorHandler.
+	_ ErrorHandler = (*delegator)(nil)
+	// Compile-time check that errLogger implements ErrorHandler.
+	_ ErrorHandler = (*errLogger)(nil)
+)
+
+type delegator struct {
+	delegate unsafe.Pointer
+}
+
+func (d *delegator) Handle(err error) {
+	d.getDelegate().Handle(err)
+}
+
+func (d *delegator) getDelegate() ErrorHandler {
+	return *(*ErrorHandler)(atomic.LoadPointer(&d.delegate))
+}
+
+// setDelegate sets the ErrorHandler delegate.
+func (d *delegator) setDelegate(eh ErrorHandler) {
+	atomic.StorePointer(&d.delegate, unsafe.Pointer(&eh))
+}
+
+func defaultErrorHandler() *delegator {
+	d := &delegator{}
+	d.setDelegate(&errLogger{l: log.New(os.Stderr, "", log.LstdFlags)})
+	return d
+}
+
+// errLogger logs errors if no delegate is set, otherwise they are delegated.
+type errLogger struct {
+	l *log.Logger
+}
+
+// Handle logs err if no delegate is set, otherwise it is delegated.
+func (h *errLogger) Handle(err error) {
+	h.l.Print(err)
+}
+
+// GetErrorHandler returns the global ErrorHandler instance.
+//
+// The default ErrorHandler instance returned will log all errors to STDERR
+// until an override ErrorHandler is set with SetErrorHandler. All
+// ErrorHandler returned prior to this will automatically forward errors to
+// the set instance instead of logging.
+//
+// Subsequent calls to SetErrorHandler after the first will not forward errors
+// to the new ErrorHandler for prior returned instances.
+func GetErrorHandler() ErrorHandler {
+	return globalErrorHandler
+}
+
+// SetErrorHandler sets the global ErrorHandler to h.
+//
+// The first time this is called all ErrorHandler previously returned from
+// GetErrorHandler will send errors to h instead of the default logging
+// ErrorHandler. Subsequent calls will set the global ErrorHandler, but not
+// delegate errors to h.
+func SetErrorHandler(h ErrorHandler) {
+	globalErrorHandler.setDelegate(h)
+}
+
+// Handle is a convenience function for ErrorHandler().Handle(err).
+func Handle(err error) {
+	GetErrorHandler().Handle(err)
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/attribute/attribute.go b/vendor/go.opentelemetry.io/otel/internal/attribute/attribute.go
new file mode 100644
index 0000000000..622c3ee3f2
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/attribute/attribute.go
@@ -0,0 +1,111 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package attribute provide several helper functions for some commonly used
+logic of processing attributes.
+*/
+package attribute // import "go.opentelemetry.io/otel/internal/attribute"
+
+import (
+	"reflect"
+)
+
+// BoolSliceValue converts a bool slice into an array with same elements as slice.
+func BoolSliceValue(v []bool) interface{} {
+	var zero bool
+	cp := reflect.New(reflect.ArrayOf(len(v), reflect.TypeOf(zero)))
+	copy(cp.Elem().Slice(0, len(v)).Interface().([]bool), v)
+	return cp.Elem().Interface()
+}
+
+// Int64SliceValue converts an int64 slice into an array with same elements as slice.
+func Int64SliceValue(v []int64) interface{} {
+	var zero int64
+	cp := reflect.New(reflect.ArrayOf(len(v), reflect.TypeOf(zero)))
+	copy(cp.Elem().Slice(0, len(v)).Interface().([]int64), v)
+	return cp.Elem().Interface()
+}
+
+// Float64SliceValue converts a float64 slice into an array with same elements as slice.
+func Float64SliceValue(v []float64) interface{} {
+	var zero float64
+	cp := reflect.New(reflect.ArrayOf(len(v), reflect.TypeOf(zero)))
+	copy(cp.Elem().Slice(0, len(v)).Interface().([]float64), v)
+	return cp.Elem().Interface()
+}
+
+// StringSliceValue converts a string slice into an array with same elements as slice.
+func StringSliceValue(v []string) interface{} {
+	var zero string
+	cp := reflect.New(reflect.ArrayOf(len(v), reflect.TypeOf(zero)))
+	copy(cp.Elem().Slice(0, len(v)).Interface().([]string), v)
+	return cp.Elem().Interface()
+}
+
+// AsBoolSlice converts a bool array into a slice into with same elements as array.
+func AsBoolSlice(v interface{}) []bool {
+	rv := reflect.ValueOf(v)
+	if rv.Type().Kind() != reflect.Array {
+		return nil
+	}
+	var zero bool
+	correctLen := rv.Len()
+	correctType := reflect.ArrayOf(correctLen, reflect.TypeOf(zero))
+	cpy := reflect.New(correctType)
+	_ = reflect.Copy(cpy.Elem(), rv)
+	return cpy.Elem().Slice(0, correctLen).Interface().([]bool)
+}
+
+// AsInt64Slice converts an int64 array into a slice into with same elements as array.
+func AsInt64Slice(v interface{}) []int64 {
+	rv := reflect.ValueOf(v)
+	if rv.Type().Kind() != reflect.Array {
+		return nil
+	}
+	var zero int64
+	correctLen := rv.Len()
+	correctType := reflect.ArrayOf(correctLen, reflect.TypeOf(zero))
+	cpy := reflect.New(correctType)
+	_ = reflect.Copy(cpy.Elem(), rv)
+	return cpy.Elem().Slice(0, correctLen).Interface().([]int64)
+}
+
+// AsFloat64Slice converts a float64 array into a slice into with same elements as array.
+func AsFloat64Slice(v interface{}) []float64 {
+	rv := reflect.ValueOf(v)
+	if rv.Type().Kind() != reflect.Array {
+		return nil
+	}
+	var zero float64
+	correctLen := rv.Len()
+	correctType := reflect.ArrayOf(correctLen, reflect.TypeOf(zero))
+	cpy := reflect.New(correctType)
+	_ = reflect.Copy(cpy.Elem(), rv)
+	return cpy.Elem().Slice(0, correctLen).Interface().([]float64)
+}
+
+// AsStringSlice converts a string array into a slice into with same elements as array.
+func AsStringSlice(v interface{}) []string {
+	rv := reflect.ValueOf(v)
+	if rv.Type().Kind() != reflect.Array {
+		return nil
+	}
+	var zero string
+	correctLen := rv.Len()
+	correctType := reflect.ArrayOf(correctLen, reflect.TypeOf(zero))
+	cpy := reflect.New(correctType)
+	_ = reflect.Copy(cpy.Elem(), rv)
+	return cpy.Elem().Slice(0, correctLen).Interface().([]string)
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/baggage/baggage.go b/vendor/go.opentelemetry.io/otel/internal/baggage/baggage.go
new file mode 100644
index 0000000000..b96e5408e6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/baggage/baggage.go
@@ -0,0 +1,43 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package baggage provides base types and functionality to store and retrieve
+baggage in Go context. This package exists because the OpenTracing bridge to
+OpenTelemetry needs to synchronize state whenever baggage for a context is
+modified and that context contains an OpenTracing span. If it were not for
+this need this package would not need to exist and the
+`go.opentelemetry.io/otel/baggage` package would be the singular place where
+W3C baggage is handled.
+*/
+package baggage // import "go.opentelemetry.io/otel/internal/baggage"
+
+// List is the collection of baggage members. The W3C allows for duplicates,
+// but OpenTelemetry does not, therefore, this is represented as a map.
+type List map[string]Item
+
+// Item is the value and metadata properties part of a list-member.
+type Item struct {
+	Value      string
+	Properties []Property
+}
+
+// Property is a metadata entry for a list-member.
+type Property struct {
+	Key, Value string
+
+	// HasValue indicates if a zero-value value means the property does not
+	// have a value or if it was the zero-value.
+	HasValue bool
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/baggage/context.go b/vendor/go.opentelemetry.io/otel/internal/baggage/context.go
new file mode 100644
index 0000000000..4469700d9c
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/baggage/context.go
@@ -0,0 +1,92 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package baggage // import "go.opentelemetry.io/otel/internal/baggage"
+
+import "context"
+
+type baggageContextKeyType int
+
+const baggageKey baggageContextKeyType = iota
+
+// SetHookFunc is a callback called when storing baggage in the context.
+type SetHookFunc func(context.Context, List) context.Context
+
+// GetHookFunc is a callback called when getting baggage from the context.
+type GetHookFunc func(context.Context, List) List
+
+type baggageState struct {
+	list List
+
+	setHook SetHookFunc
+	getHook GetHookFunc
+}
+
+// ContextWithSetHook returns a copy of parent with hook configured to be
+// invoked every time ContextWithBaggage is called.
+//
+// Passing nil SetHookFunc creates a context with no set hook to call.
+func ContextWithSetHook(parent context.Context, hook SetHookFunc) context.Context {
+	var s baggageState
+	if v, ok := parent.Value(baggageKey).(baggageState); ok {
+		s = v
+	}
+
+	s.setHook = hook
+	return context.WithValue(parent, baggageKey, s)
+}
+
+// ContextWithGetHook returns a copy of parent with hook configured to be
+// invoked every time FromContext is called.
+//
+// Passing nil GetHookFunc creates a context with no get hook to call.
+func ContextWithGetHook(parent context.Context, hook GetHookFunc) context.Context {
+	var s baggageState
+	if v, ok := parent.Value(baggageKey).(baggageState); ok {
+		s = v
+	}
+
+	s.getHook = hook
+	return context.WithValue(parent, baggageKey, s)
+}
+
+// ContextWithList returns a copy of parent with baggage. Passing nil list
+// returns a context without any baggage.
+func ContextWithList(parent context.Context, list List) context.Context {
+	var s baggageState
+	if v, ok := parent.Value(baggageKey).(baggageState); ok {
+		s = v
+	}
+
+	s.list = list
+	ctx := context.WithValue(parent, baggageKey, s)
+	if s.setHook != nil {
+		ctx = s.setHook(ctx, list)
+	}
+
+	return ctx
+}
+
+// ListFromContext returns the baggage contained in ctx.
+func ListFromContext(ctx context.Context) List {
+	switch v := ctx.Value(baggageKey).(type) {
+	case baggageState:
+		if v.getHook != nil {
+			return v.getHook(ctx, v.list)
+		}
+		return v.list
+	default:
+		return nil
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/global/internal_logging.go b/vendor/go.opentelemetry.io/otel/internal/global/internal_logging.go
new file mode 100644
index 0000000000..293c08961f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/global/internal_logging.go
@@ -0,0 +1,63 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/internal/global"
+
+import (
+	"log"
+	"os"
+	"sync/atomic"
+	"unsafe"
+
+	"github.com/go-logr/logr"
+	"github.com/go-logr/stdr"
+)
+
+// globalLogger is the logging interface used within the otel api and sdk provide deatails of the internals.
+//
+// The default logger uses stdr which is backed by the standard `log.Logger`
+// interface. This logger will only show messages at the Error Level.
+var globalLogger unsafe.Pointer
+
+func init() {
+	SetLogger(stdr.New(log.New(os.Stderr, "", log.LstdFlags|log.Lshortfile)))
+}
+
+// SetLogger overrides the globalLogger with l.
+//
+// To see Info messages use a logger with `l.V(1).Enabled() == true`
+// To see Debug messages use a logger with `l.V(5).Enabled() == true`.
+func SetLogger(l logr.Logger) {
+	atomic.StorePointer(&globalLogger, unsafe.Pointer(&l))
+}
+
+func getLogger() logr.Logger {
+	return *(*logr.Logger)(atomic.LoadPointer(&globalLogger))
+}
+
+// Info prints messages about the general state of the API or SDK.
+// This should usually be less then 5 messages a minute.
+func Info(msg string, keysAndValues ...interface{}) {
+	getLogger().V(1).Info(msg, keysAndValues...)
+}
+
+// Error prints messages about exceptional states of the API or SDK.
+func Error(err error, msg string, keysAndValues ...interface{}) {
+	getLogger().Error(err, msg, keysAndValues...)
+}
+
+// Debug prints messages about all internal changes in the API or SDK.
+func Debug(msg string, keysAndValues ...interface{}) {
+	getLogger().V(5).Info(msg, keysAndValues...)
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/global/propagator.go b/vendor/go.opentelemetry.io/otel/internal/global/propagator.go
new file mode 100644
index 0000000000..06bac35c2f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/global/propagator.go
@@ -0,0 +1,82 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/internal/global"
+
+import (
+	"context"
+	"sync"
+
+	"go.opentelemetry.io/otel/propagation"
+)
+
+// textMapPropagator is a default TextMapPropagator that delegates calls to a
+// registered delegate if one is set, otherwise it defaults to delegating the
+// calls to a the default no-op propagation.TextMapPropagator.
+type textMapPropagator struct {
+	mtx      sync.Mutex
+	once     sync.Once
+	delegate propagation.TextMapPropagator
+	noop     propagation.TextMapPropagator
+}
+
+// Compile-time guarantee that textMapPropagator implements the
+// propagation.TextMapPropagator interface.
+var _ propagation.TextMapPropagator = (*textMapPropagator)(nil)
+
+func newTextMapPropagator() *textMapPropagator {
+	return &textMapPropagator{
+		noop: propagation.NewCompositeTextMapPropagator(),
+	}
+}
+
+// SetDelegate sets a delegate propagation.TextMapPropagator that all calls are
+// forwarded to. Delegation can only be performed once, all subsequent calls
+// perform no delegation.
+func (p *textMapPropagator) SetDelegate(delegate propagation.TextMapPropagator) {
+	if delegate == nil {
+		return
+	}
+
+	p.mtx.Lock()
+	p.once.Do(func() { p.delegate = delegate })
+	p.mtx.Unlock()
+}
+
+// effectiveDelegate returns the current delegate of p if one is set,
+// otherwise the default noop TextMapPropagator is returned. This method
+// can be called concurrently.
+func (p *textMapPropagator) effectiveDelegate() propagation.TextMapPropagator {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+	if p.delegate != nil {
+		return p.delegate
+	}
+	return p.noop
+}
+
+// Inject set cross-cutting concerns from the Context into the carrier.
+func (p *textMapPropagator) Inject(ctx context.Context, carrier propagation.TextMapCarrier) {
+	p.effectiveDelegate().Inject(ctx, carrier)
+}
+
+// Extract reads cross-cutting concerns from the carrier into a Context.
+func (p *textMapPropagator) Extract(ctx context.Context, carrier propagation.TextMapCarrier) context.Context {
+	return p.effectiveDelegate().Extract(ctx, carrier)
+}
+
+// Fields returns the keys whose values are set with Inject.
+func (p *textMapPropagator) Fields() []string {
+	return p.effectiveDelegate().Fields()
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/global/state.go b/vendor/go.opentelemetry.io/otel/internal/global/state.go
new file mode 100644
index 0000000000..1ad38f828e
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/global/state.go
@@ -0,0 +1,115 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/internal/global"
+
+import (
+	"errors"
+	"sync"
+	"sync/atomic"
+
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type (
+	tracerProviderHolder struct {
+		tp trace.TracerProvider
+	}
+
+	propagatorsHolder struct {
+		tm propagation.TextMapPropagator
+	}
+)
+
+var (
+	globalTracer      = defaultTracerValue()
+	globalPropagators = defaultPropagatorsValue()
+
+	delegateTraceOnce             sync.Once
+	delegateTextMapPropagatorOnce sync.Once
+)
+
+// TracerProvider is the internal implementation for global.TracerProvider.
+func TracerProvider() trace.TracerProvider {
+	return globalTracer.Load().(tracerProviderHolder).tp
+}
+
+// SetTracerProvider is the internal implementation for global.SetTracerProvider.
+func SetTracerProvider(tp trace.TracerProvider) {
+	current := TracerProvider()
+
+	if _, cOk := current.(*tracerProvider); cOk {
+		if _, tpOk := tp.(*tracerProvider); tpOk && current == tp {
+			// Do not assign the default delegating TracerProvider to delegate
+			// to itself.
+			Error(
+				errors.New("no delegate configured in tracer provider"),
+				"Setting tracer provider to it's current value. No delegate will be configured",
+			)
+			return
+		}
+	}
+
+	delegateTraceOnce.Do(func() {
+		if def, ok := current.(*tracerProvider); ok {
+			def.setDelegate(tp)
+		}
+	})
+	globalTracer.Store(tracerProviderHolder{tp: tp})
+}
+
+// TextMapPropagator is the internal implementation for global.TextMapPropagator.
+func TextMapPropagator() propagation.TextMapPropagator {
+	return globalPropagators.Load().(propagatorsHolder).tm
+}
+
+// SetTextMapPropagator is the internal implementation for global.SetTextMapPropagator.
+func SetTextMapPropagator(p propagation.TextMapPropagator) {
+	current := TextMapPropagator()
+
+	if _, cOk := current.(*textMapPropagator); cOk {
+		if _, pOk := p.(*textMapPropagator); pOk && current == p {
+			// Do not assign the default delegating TextMapPropagator to
+			// delegate to itself.
+			Error(
+				errors.New("no delegate configured in text map propagator"),
+				"Setting text map propagator to it's current value. No delegate will be configured",
+			)
+			return
+		}
+	}
+
+	// For the textMapPropagator already returned by TextMapPropagator
+	// delegate to p.
+	delegateTextMapPropagatorOnce.Do(func() {
+		if def, ok := current.(*textMapPropagator); ok {
+			def.SetDelegate(p)
+		}
+	})
+	// Return p when subsequent calls to TextMapPropagator are made.
+	globalPropagators.Store(propagatorsHolder{tm: p})
+}
+
+func defaultTracerValue() *atomic.Value {
+	v := &atomic.Value{}
+	v.Store(tracerProviderHolder{tp: &tracerProvider{}})
+	return v
+}
+
+func defaultPropagatorsValue() *atomic.Value {
+	v := &atomic.Value{}
+	v.Store(propagatorsHolder{tm: newTextMapPropagator()})
+	return v
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal/global/trace.go b/vendor/go.opentelemetry.io/otel/internal/global/trace.go
new file mode 100644
index 0000000000..5f008d0982
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/global/trace.go
@@ -0,0 +1,192 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/internal/global"
+
+/*
+This file contains the forwarding implementation of the TracerProvider used as
+the default global instance. Prior to initialization of an SDK, Tracers
+returned by the global TracerProvider will provide no-op functionality. This
+means that all Span created prior to initialization are no-op Spans.
+
+Once an SDK has been initialized, all provided no-op Tracers are swapped for
+Tracers provided by the SDK defined TracerProvider. However, any Span started
+prior to this initialization does not change its behavior. Meaning, the Span
+remains a no-op Span.
+
+The implementation to track and swap Tracers locks all new Tracer creation
+until the swap is complete. This assumes that this operation is not
+performance-critical. If that assumption is incorrect, be sure to configure an
+SDK prior to any Tracer creation.
+*/
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// tracerProvider is a placeholder for a configured SDK TracerProvider.
+//
+// All TracerProvider functionality is forwarded to a delegate once
+// configured.
+type tracerProvider struct {
+	mtx      sync.Mutex
+	tracers  map[il]*tracer
+	delegate trace.TracerProvider
+}
+
+// Compile-time guarantee that tracerProvider implements the TracerProvider
+// interface.
+var _ trace.TracerProvider = &tracerProvider{}
+
+// setDelegate configures p to delegate all TracerProvider functionality to
+// provider.
+//
+// All Tracers provided prior to this function call are switched out to be
+// Tracers provided by provider.
+//
+// It is guaranteed by the caller that this happens only once.
+func (p *tracerProvider) setDelegate(provider trace.TracerProvider) {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	p.delegate = provider
+
+	if len(p.tracers) == 0 {
+		return
+	}
+
+	for _, t := range p.tracers {
+		t.setDelegate(provider)
+	}
+
+	p.tracers = nil
+}
+
+// Tracer implements TracerProvider.
+func (p *tracerProvider) Tracer(name string, opts ...trace.TracerOption) trace.Tracer {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	if p.delegate != nil {
+		return p.delegate.Tracer(name, opts...)
+	}
+
+	// At this moment it is guaranteed that no sdk is installed, save the tracer in the tracers map.
+
+	c := trace.NewTracerConfig(opts...)
+	key := il{
+		name:    name,
+		version: c.InstrumentationVersion(),
+	}
+
+	if p.tracers == nil {
+		p.tracers = make(map[il]*tracer)
+	}
+
+	if val, ok := p.tracers[key]; ok {
+		return val
+	}
+
+	t := &tracer{name: name, opts: opts, provider: p}
+	p.tracers[key] = t
+	return t
+}
+
+type il struct {
+	name    string
+	version string
+}
+
+// tracer is a placeholder for a trace.Tracer.
+//
+// All Tracer functionality is forwarded to a delegate once configured.
+// Otherwise, all functionality is forwarded to a NoopTracer.
+type tracer struct {
+	name     string
+	opts     []trace.TracerOption
+	provider *tracerProvider
+
+	delegate atomic.Value
+}
+
+// Compile-time guarantee that tracer implements the trace.Tracer interface.
+var _ trace.Tracer = &tracer{}
+
+// setDelegate configures t to delegate all Tracer functionality to Tracers
+// created by provider.
+//
+// All subsequent calls to the Tracer methods will be passed to the delegate.
+//
+// It is guaranteed by the caller that this happens only once.
+func (t *tracer) setDelegate(provider trace.TracerProvider) {
+	t.delegate.Store(provider.Tracer(t.name, t.opts...))
+}
+
+// Start implements trace.Tracer by forwarding the call to t.delegate if
+// set, otherwise it forwards the call to a NoopTracer.
+func (t *tracer) Start(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
+	delegate := t.delegate.Load()
+	if delegate != nil {
+		return delegate.(trace.Tracer).Start(ctx, name, opts...)
+	}
+
+	s := nonRecordingSpan{sc: trace.SpanContextFromContext(ctx), tracer: t}
+	ctx = trace.ContextWithSpan(ctx, s)
+	return ctx, s
+}
+
+// nonRecordingSpan is a minimal implementation of a Span that wraps a
+// SpanContext. It performs no operations other than to return the wrapped
+// SpanContext.
+type nonRecordingSpan struct {
+	sc     trace.SpanContext
+	tracer *tracer
+}
+
+var _ trace.Span = nonRecordingSpan{}
+
+// SpanContext returns the wrapped SpanContext.
+func (s nonRecordingSpan) SpanContext() trace.SpanContext { return s.sc }
+
+// IsRecording always returns false.
+func (nonRecordingSpan) IsRecording() bool { return false }
+
+// SetStatus does nothing.
+func (nonRecordingSpan) SetStatus(codes.Code, string) {}
+
+// SetError does nothing.
+func (nonRecordingSpan) SetError(bool) {}
+
+// SetAttributes does nothing.
+func (nonRecordingSpan) SetAttributes(...attribute.KeyValue) {}
+
+// End does nothing.
+func (nonRecordingSpan) End(...trace.SpanEndOption) {}
+
+// RecordError does nothing.
+func (nonRecordingSpan) RecordError(error, ...trace.EventOption) {}
+
+// AddEvent does nothing.
+func (nonRecordingSpan) AddEvent(string, ...trace.EventOption) {}
+
+// SetName does nothing.
+func (nonRecordingSpan) SetName(string) {}
+
+func (s nonRecordingSpan) TracerProvider() trace.TracerProvider { return s.tracer.provider }
diff --git a/vendor/go.opentelemetry.io/otel/internal/rawhelpers.go b/vendor/go.opentelemetry.io/otel/internal/rawhelpers.go
new file mode 100644
index 0000000000..e07e794000
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal/rawhelpers.go
@@ -0,0 +1,55 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package internal // import "go.opentelemetry.io/otel/internal"
+
+import (
+	"math"
+	"unsafe"
+)
+
+func BoolToRaw(b bool) uint64 { // nolint:revive  // b is not a control flag.
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func RawToBool(r uint64) bool {
+	return r != 0
+}
+
+func Int64ToRaw(i int64) uint64 {
+	return uint64(i)
+}
+
+func RawToInt64(r uint64) int64 {
+	return int64(r)
+}
+
+func Float64ToRaw(f float64) uint64 {
+	return math.Float64bits(f)
+}
+
+func RawToFloat64(r uint64) float64 {
+	return math.Float64frombits(r)
+}
+
+func RawPtrToFloat64Ptr(r *uint64) *float64 {
+	return (*float64)(unsafe.Pointer(r))
+}
+
+func RawPtrToInt64Ptr(r *uint64) *int64 {
+	return (*int64)(unsafe.Pointer(r))
+}
diff --git a/vendor/go.opentelemetry.io/otel/internal_logging.go b/vendor/go.opentelemetry.io/otel/internal_logging.go
new file mode 100644
index 0000000000..c4f8acd5d8
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/internal_logging.go
@@ -0,0 +1,26 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otel // import "go.opentelemetry.io/otel"
+
+import (
+	"github.com/go-logr/logr"
+
+	"go.opentelemetry.io/otel/internal/global"
+)
+
+// SetLogger configures the logger used internally to opentelemetry.
+func SetLogger(logger logr.Logger) {
+	global.SetLogger(logger)
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/LICENSE b/vendor/go.opentelemetry.io/otel/metric/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/metric/config.go b/vendor/go.opentelemetry.io/otel/metric/config.go
new file mode 100644
index 0000000000..621e4c5fcb
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/config.go
@@ -0,0 +1,69 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package metric // import "go.opentelemetry.io/otel/metric"
+
+// MeterConfig contains options for Meters.
+type MeterConfig struct {
+	instrumentationVersion string
+	schemaURL              string
+}
+
+// InstrumentationVersion is the version of the library providing instrumentation.
+func (cfg MeterConfig) InstrumentationVersion() string {
+	return cfg.instrumentationVersion
+}
+
+// SchemaURL is the schema_url of the library providing instrumentation.
+func (cfg MeterConfig) SchemaURL() string {
+	return cfg.schemaURL
+}
+
+// MeterOption is an interface for applying Meter options.
+type MeterOption interface {
+	// applyMeter is used to set a MeterOption value of a MeterConfig.
+	applyMeter(MeterConfig) MeterConfig
+}
+
+// NewMeterConfig creates a new MeterConfig and applies
+// all the given options.
+func NewMeterConfig(opts ...MeterOption) MeterConfig {
+	var config MeterConfig
+	for _, o := range opts {
+		config = o.applyMeter(config)
+	}
+	return config
+}
+
+type meterOptionFunc func(MeterConfig) MeterConfig
+
+func (fn meterOptionFunc) applyMeter(cfg MeterConfig) MeterConfig {
+	return fn(cfg)
+}
+
+// WithInstrumentationVersion sets the instrumentation version.
+func WithInstrumentationVersion(version string) MeterOption {
+	return meterOptionFunc(func(config MeterConfig) MeterConfig {
+		config.instrumentationVersion = version
+		return config
+	})
+}
+
+// WithSchemaURL sets the schema URL.
+func WithSchemaURL(schemaURL string) MeterOption {
+	return meterOptionFunc(func(config MeterConfig) MeterConfig {
+		config.schemaURL = schemaURL
+		return config
+	})
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/doc.go b/vendor/go.opentelemetry.io/otel/metric/doc.go
new file mode 100644
index 0000000000..bd6f434372
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/doc.go
@@ -0,0 +1,23 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package metric provides an implementation of the metrics part of the
+OpenTelemetry API.
+
+This package is currently in a pre-GA phase. Backwards incompatible changes
+may be introduced in subsequent minor version releases as we work to track the
+evolving OpenTelemetry specification and user feedback.
+*/
+package metric // import "go.opentelemetry.io/otel/metric"
diff --git a/vendor/go.opentelemetry.io/otel/metric/global/global.go b/vendor/go.opentelemetry.io/otel/metric/global/global.go
new file mode 100644
index 0000000000..05a67c2e99
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/global/global.go
@@ -0,0 +1,42 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/metric/global"
+
+import (
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/internal/global"
+)
+
+// Meter returns a Meter from the global MeterProvider. The
+// instrumentationName must be the name of the library providing
+// instrumentation. This name may be the same as the instrumented code only if
+// that code provides built-in instrumentation. If the instrumentationName is
+// empty, then a implementation defined default name will be used instead.
+//
+// This is short for MeterProvider().Meter(name).
+func Meter(instrumentationName string, opts ...metric.MeterOption) metric.Meter {
+	return MeterProvider().Meter(instrumentationName, opts...)
+}
+
+// MeterProvider returns the registered global trace provider.
+// If none is registered then a No-op MeterProvider is returned.
+func MeterProvider() metric.MeterProvider {
+	return global.MeterProvider()
+}
+
+// SetMeterProvider registers `mp` as the global meter provider.
+func SetMeterProvider(mp metric.MeterProvider) {
+	global.SetMeterProvider(mp)
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument/asyncfloat64/asyncfloat64.go b/vendor/go.opentelemetry.io/otel/metric/instrument/asyncfloat64/asyncfloat64.go
new file mode 100644
index 0000000000..330a14c2f6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument/asyncfloat64/asyncfloat64.go
@@ -0,0 +1,80 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package asyncfloat64 // import "go.opentelemetry.io/otel/metric/instrument/asyncfloat64"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric/instrument"
+)
+
+// InstrumentProvider provides access to individual instruments.
+//
+// Warning: methods may be added to this interface in minor releases.
+type InstrumentProvider interface {
+	// Counter creates an instrument for recording increasing values.
+	Counter(name string, opts ...instrument.Option) (Counter, error)
+
+	// UpDownCounter creates an instrument for recording changes of a value.
+	UpDownCounter(name string, opts ...instrument.Option) (UpDownCounter, error)
+
+	// Gauge creates an instrument for recording the current value.
+	Gauge(name string, opts ...instrument.Option) (Gauge, error)
+}
+
+// Counter is an instrument that records increasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Counter interface {
+	// Observe records the state of the instrument to be x. Implementations
+	// will assume x to be the cumulative sum of the count.
+	//
+	// It is only valid to call this within a callback. If called outside of the
+	// registered callback it should have no effect on the instrument, and an
+	// error will be reported via the error handler.
+	Observe(ctx context.Context, x float64, attrs ...attribute.KeyValue)
+
+	instrument.Asynchronous
+}
+
+// UpDownCounter is an instrument that records increasing or decreasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type UpDownCounter interface {
+	// Observe records the state of the instrument to be x. Implementations
+	// will assume x to be the cumulative sum of the count.
+	//
+	// It is only valid to call this within a callback. If called outside of the
+	// registered callback it should have no effect on the instrument, and an
+	// error will be reported via the error handler.
+	Observe(ctx context.Context, x float64, attrs ...attribute.KeyValue)
+
+	instrument.Asynchronous
+}
+
+// Gauge is an instrument that records independent readings.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Gauge interface {
+	// Observe records the state of the instrument to be x.
+	//
+	// It is only valid to call this within a callback. If called outside of the
+	// registered callback it should have no effect on the instrument, and an
+	// error will be reported via the error handler.
+	Observe(ctx context.Context, x float64, attrs ...attribute.KeyValue)
+
+	instrument.Asynchronous
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument/asyncint64/asyncint64.go b/vendor/go.opentelemetry.io/otel/metric/instrument/asyncint64/asyncint64.go
new file mode 100644
index 0000000000..4fce9963c3
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument/asyncint64/asyncint64.go
@@ -0,0 +1,80 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package asyncint64 // import "go.opentelemetry.io/otel/metric/instrument/asyncint64"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric/instrument"
+)
+
+// InstrumentProvider provides access to individual instruments.
+//
+// Warning: methods may be added to this interface in minor releases.
+type InstrumentProvider interface {
+	// Counter creates an instrument for recording increasing values.
+	Counter(name string, opts ...instrument.Option) (Counter, error)
+
+	// UpDownCounter creates an instrument for recording changes of a value.
+	UpDownCounter(name string, opts ...instrument.Option) (UpDownCounter, error)
+
+	// Gauge creates an instrument for recording the current value.
+	Gauge(name string, opts ...instrument.Option) (Gauge, error)
+}
+
+// Counter is an instrument that records increasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Counter interface {
+	// Observe records the state of the instrument to be x. Implementations
+	// will assume x to be the cumulative sum of the count.
+	//
+	// It is only valid to call this within a callback. If called outside of the
+	// registered callback it should have no effect on the instrument, and an
+	// error will be reported via the error handler.
+	Observe(ctx context.Context, x int64, attrs ...attribute.KeyValue)
+
+	instrument.Asynchronous
+}
+
+// UpDownCounter is an instrument that records increasing or decreasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type UpDownCounter interface {
+	// Observe records the state of the instrument to be x. Implementations
+	// will assume x to be the cumulative sum of the count.
+	//
+	// It is only valid to call this within a callback. If called outside of the
+	// registered callback it should have no effect on the instrument, and an
+	// error will be reported via the error handler.
+	Observe(ctx context.Context, x int64, attrs ...attribute.KeyValue)
+
+	instrument.Asynchronous
+}
+
+// Gauge is an instrument that records independent readings.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Gauge interface {
+	// Observe records the state of the instrument to be x.
+	//
+	// It is only valid to call this within a callback. If called outside of the
+	// registered callback it should have no effect on the instrument, and an
+	// error will be reported via the error handler.
+	Observe(ctx context.Context, x int64, attrs ...attribute.KeyValue)
+
+	instrument.Asynchronous
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument/config.go b/vendor/go.opentelemetry.io/otel/metric/instrument/config.go
new file mode 100644
index 0000000000..8778bce161
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument/config.go
@@ -0,0 +1,69 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package instrument // import "go.opentelemetry.io/otel/metric/instrument"
+
+import "go.opentelemetry.io/otel/metric/unit"
+
+// Config contains options for metric instrument descriptors.
+type Config struct {
+	description string
+	unit        unit.Unit
+}
+
+// Description describes the instrument in human-readable terms.
+func (cfg Config) Description() string {
+	return cfg.description
+}
+
+// Unit describes the measurement unit for an instrument.
+func (cfg Config) Unit() unit.Unit {
+	return cfg.unit
+}
+
+// Option is an interface for applying metric instrument options.
+type Option interface {
+	applyInstrument(Config) Config
+}
+
+// NewConfig creates a new Config and applies all the given options.
+func NewConfig(opts ...Option) Config {
+	var config Config
+	for _, o := range opts {
+		config = o.applyInstrument(config)
+	}
+	return config
+}
+
+type optionFunc func(Config) Config
+
+func (fn optionFunc) applyInstrument(cfg Config) Config {
+	return fn(cfg)
+}
+
+// WithDescription applies provided description.
+func WithDescription(desc string) Option {
+	return optionFunc(func(cfg Config) Config {
+		cfg.description = desc
+		return cfg
+	})
+}
+
+// WithUnit applies provided unit.
+func WithUnit(u unit.Unit) Option {
+	return optionFunc(func(cfg Config) Config {
+		cfg.unit = u
+		return cfg
+	})
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument/instrument.go b/vendor/go.opentelemetry.io/otel/metric/instrument/instrument.go
new file mode 100644
index 0000000000..e1bbb850d7
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument/instrument.go
@@ -0,0 +1,30 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package instrument // import "go.opentelemetry.io/otel/metric/instrument"
+
+// Asynchronous instruments are instruments that are updated within a Callback.
+// If an instrument is observed outside of it's callback it should be an error.
+//
+// This interface is used as a grouping mechanism.
+type Asynchronous interface {
+	asynchronous()
+}
+
+// Synchronous instruments are updated in line with application code.
+//
+// This interface is used as a grouping mechanism.
+type Synchronous interface {
+	synchronous()
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument/syncfloat64/syncfloat64.go b/vendor/go.opentelemetry.io/otel/metric/instrument/syncfloat64/syncfloat64.go
new file mode 100644
index 0000000000..2ec192f70d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument/syncfloat64/syncfloat64.go
@@ -0,0 +1,64 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package syncfloat64 // import "go.opentelemetry.io/otel/metric/instrument/syncfloat64"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric/instrument"
+)
+
+// InstrumentProvider provides access to individual instruments.
+//
+// Warning: methods may be added to this interface in minor releases.
+type InstrumentProvider interface {
+	// Counter creates an instrument for recording increasing values.
+	Counter(name string, opts ...instrument.Option) (Counter, error)
+	// UpDownCounter creates an instrument for recording changes of a value.
+	UpDownCounter(name string, opts ...instrument.Option) (UpDownCounter, error)
+	// Histogram creates an instrument for recording a distribution of values.
+	Histogram(name string, opts ...instrument.Option) (Histogram, error)
+}
+
+// Counter is an instrument that records increasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Counter interface {
+	// Add records a change to the counter.
+	Add(ctx context.Context, incr float64, attrs ...attribute.KeyValue)
+
+	instrument.Synchronous
+}
+
+// UpDownCounter is an instrument that records increasing or decreasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type UpDownCounter interface {
+	// Add records a change to the counter.
+	Add(ctx context.Context, incr float64, attrs ...attribute.KeyValue)
+
+	instrument.Synchronous
+}
+
+// Histogram is an instrument that records a distribution of values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Histogram interface {
+	// Record adds an additional value to the distribution.
+	Record(ctx context.Context, incr float64, attrs ...attribute.KeyValue)
+
+	instrument.Synchronous
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/instrument/syncint64/syncint64.go b/vendor/go.opentelemetry.io/otel/metric/instrument/syncint64/syncint64.go
new file mode 100644
index 0000000000..03b5d53e63
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/instrument/syncint64/syncint64.go
@@ -0,0 +1,64 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package syncint64 // import "go.opentelemetry.io/otel/metric/instrument/syncint64"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric/instrument"
+)
+
+// InstrumentProvider provides access to individual instruments.
+//
+// Warning: methods may be added to this interface in minor releases.
+type InstrumentProvider interface {
+	// Counter creates an instrument for recording increasing values.
+	Counter(name string, opts ...instrument.Option) (Counter, error)
+	// UpDownCounter creates an instrument for recording changes of a value.
+	UpDownCounter(name string, opts ...instrument.Option) (UpDownCounter, error)
+	// Histogram creates an instrument for recording a distribution of values.
+	Histogram(name string, opts ...instrument.Option) (Histogram, error)
+}
+
+// Counter is an instrument that records increasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Counter interface {
+	// Add records a change to the counter.
+	Add(ctx context.Context, incr int64, attrs ...attribute.KeyValue)
+
+	instrument.Synchronous
+}
+
+// UpDownCounter is an instrument that records increasing or decreasing values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type UpDownCounter interface {
+	// Add records a change to the counter.
+	Add(ctx context.Context, incr int64, attrs ...attribute.KeyValue)
+
+	instrument.Synchronous
+}
+
+// Histogram is an instrument that records a distribution of values.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Histogram interface {
+	// Record adds an additional value to the distribution.
+	Record(ctx context.Context, incr int64, attrs ...attribute.KeyValue)
+
+	instrument.Synchronous
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/internal/global/instruments.go b/vendor/go.opentelemetry.io/otel/metric/internal/global/instruments.go
new file mode 100644
index 0000000000..7cce2bd15f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/internal/global/instruments.go
@@ -0,0 +1,360 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/metric/internal/global"
+
+import (
+	"context"
+	"sync/atomic"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/instrument"
+	"go.opentelemetry.io/otel/metric/instrument/asyncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/asyncint64"
+	"go.opentelemetry.io/otel/metric/instrument/syncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/syncint64"
+)
+
+type afCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //asyncfloat64.Counter
+
+	instrument.Asynchronous
+}
+
+func (i *afCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.AsyncFloat64().Counter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *afCounter) Observe(ctx context.Context, x float64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(asyncfloat64.Counter).Observe(ctx, x, attrs...)
+	}
+}
+
+func (i *afCounter) unwrap() instrument.Asynchronous {
+	if ctr := i.delegate.Load(); ctr != nil {
+		return ctr.(asyncfloat64.Counter)
+	}
+	return nil
+}
+
+type afUpDownCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //asyncfloat64.UpDownCounter
+
+	instrument.Asynchronous
+}
+
+func (i *afUpDownCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.AsyncFloat64().UpDownCounter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *afUpDownCounter) Observe(ctx context.Context, x float64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(asyncfloat64.UpDownCounter).Observe(ctx, x, attrs...)
+	}
+}
+
+func (i *afUpDownCounter) unwrap() instrument.Asynchronous {
+	if ctr := i.delegate.Load(); ctr != nil {
+		return ctr.(asyncfloat64.UpDownCounter)
+	}
+	return nil
+}
+
+type afGauge struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //asyncfloat64.Gauge
+
+	instrument.Asynchronous
+}
+
+func (i *afGauge) setDelegate(m metric.Meter) {
+	ctr, err := m.AsyncFloat64().Gauge(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *afGauge) Observe(ctx context.Context, x float64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(asyncfloat64.Gauge).Observe(ctx, x, attrs...)
+	}
+}
+
+func (i *afGauge) unwrap() instrument.Asynchronous {
+	if ctr := i.delegate.Load(); ctr != nil {
+		return ctr.(asyncfloat64.Gauge)
+	}
+	return nil
+}
+
+type aiCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //asyncint64.Counter
+
+	instrument.Asynchronous
+}
+
+func (i *aiCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.AsyncInt64().Counter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *aiCounter) Observe(ctx context.Context, x int64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(asyncint64.Counter).Observe(ctx, x, attrs...)
+	}
+}
+
+func (i *aiCounter) unwrap() instrument.Asynchronous {
+	if ctr := i.delegate.Load(); ctr != nil {
+		return ctr.(asyncint64.Counter)
+	}
+	return nil
+}
+
+type aiUpDownCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //asyncint64.UpDownCounter
+
+	instrument.Asynchronous
+}
+
+func (i *aiUpDownCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.AsyncInt64().UpDownCounter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *aiUpDownCounter) Observe(ctx context.Context, x int64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(asyncint64.UpDownCounter).Observe(ctx, x, attrs...)
+	}
+}
+
+func (i *aiUpDownCounter) unwrap() instrument.Asynchronous {
+	if ctr := i.delegate.Load(); ctr != nil {
+		return ctr.(asyncint64.UpDownCounter)
+	}
+	return nil
+}
+
+type aiGauge struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //asyncint64.Gauge
+
+	instrument.Asynchronous
+}
+
+func (i *aiGauge) setDelegate(m metric.Meter) {
+	ctr, err := m.AsyncInt64().Gauge(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *aiGauge) Observe(ctx context.Context, x int64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(asyncint64.Gauge).Observe(ctx, x, attrs...)
+	}
+}
+
+func (i *aiGauge) unwrap() instrument.Asynchronous {
+	if ctr := i.delegate.Load(); ctr != nil {
+		return ctr.(asyncint64.Gauge)
+	}
+	return nil
+}
+
+// Sync Instruments.
+type sfCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //syncfloat64.Counter
+
+	instrument.Synchronous
+}
+
+func (i *sfCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.SyncFloat64().Counter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *sfCounter) Add(ctx context.Context, incr float64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(syncfloat64.Counter).Add(ctx, incr, attrs...)
+	}
+}
+
+type sfUpDownCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //syncfloat64.UpDownCounter
+
+	instrument.Synchronous
+}
+
+func (i *sfUpDownCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.SyncFloat64().UpDownCounter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *sfUpDownCounter) Add(ctx context.Context, incr float64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(syncfloat64.UpDownCounter).Add(ctx, incr, attrs...)
+	}
+}
+
+type sfHistogram struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //syncfloat64.Histogram
+
+	instrument.Synchronous
+}
+
+func (i *sfHistogram) setDelegate(m metric.Meter) {
+	ctr, err := m.SyncFloat64().Histogram(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *sfHistogram) Record(ctx context.Context, x float64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(syncfloat64.Histogram).Record(ctx, x, attrs...)
+	}
+}
+
+type siCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //syncint64.Counter
+
+	instrument.Synchronous
+}
+
+func (i *siCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.SyncInt64().Counter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *siCounter) Add(ctx context.Context, x int64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(syncint64.Counter).Add(ctx, x, attrs...)
+	}
+}
+
+type siUpDownCounter struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //syncint64.UpDownCounter
+
+	instrument.Synchronous
+}
+
+func (i *siUpDownCounter) setDelegate(m metric.Meter) {
+	ctr, err := m.SyncInt64().UpDownCounter(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *siUpDownCounter) Add(ctx context.Context, x int64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(syncint64.UpDownCounter).Add(ctx, x, attrs...)
+	}
+}
+
+type siHistogram struct {
+	name string
+	opts []instrument.Option
+
+	delegate atomic.Value //syncint64.Histogram
+
+	instrument.Synchronous
+}
+
+func (i *siHistogram) setDelegate(m metric.Meter) {
+	ctr, err := m.SyncInt64().Histogram(i.name, i.opts...)
+	if err != nil {
+		otel.Handle(err)
+		return
+	}
+	i.delegate.Store(ctr)
+}
+
+func (i *siHistogram) Record(ctx context.Context, x int64, attrs ...attribute.KeyValue) {
+	if ctr := i.delegate.Load(); ctr != nil {
+		ctr.(syncint64.Histogram).Record(ctx, x, attrs...)
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/internal/global/meter.go b/vendor/go.opentelemetry.io/otel/metric/internal/global/meter.go
new file mode 100644
index 0000000000..0fa924f397
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/internal/global/meter.go
@@ -0,0 +1,347 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/metric/internal/global"
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/instrument"
+	"go.opentelemetry.io/otel/metric/instrument/asyncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/asyncint64"
+	"go.opentelemetry.io/otel/metric/instrument/syncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/syncint64"
+)
+
+// meterProvider is a placeholder for a configured SDK MeterProvider.
+//
+// All MeterProvider functionality is forwarded to a delegate once
+// configured.
+type meterProvider struct {
+	mtx    sync.Mutex
+	meters map[il]*meter
+
+	delegate metric.MeterProvider
+}
+
+type il struct {
+	name    string
+	version string
+}
+
+// setDelegate configures p to delegate all MeterProvider functionality to
+// provider.
+//
+// All Meters provided prior to this function call are switched out to be
+// Meters provided by provider. All instruments and callbacks are recreated and
+// delegated.
+//
+// It is guaranteed by the caller that this happens only once.
+func (p *meterProvider) setDelegate(provider metric.MeterProvider) {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	p.delegate = provider
+
+	if len(p.meters) == 0 {
+		return
+	}
+
+	for _, meter := range p.meters {
+		meter.setDelegate(provider)
+	}
+
+	p.meters = nil
+}
+
+// Meter implements MeterProvider.
+func (p *meterProvider) Meter(name string, opts ...metric.MeterOption) metric.Meter {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	if p.delegate != nil {
+		return p.delegate.Meter(name, opts...)
+	}
+
+	// At this moment it is guaranteed that no sdk is installed, save the meter in the meters map.
+
+	c := metric.NewMeterConfig(opts...)
+	key := il{
+		name:    name,
+		version: c.InstrumentationVersion(),
+	}
+
+	if p.meters == nil {
+		p.meters = make(map[il]*meter)
+	}
+
+	if val, ok := p.meters[key]; ok {
+		return val
+	}
+
+	t := &meter{name: name, opts: opts}
+	p.meters[key] = t
+	return t
+}
+
+// meter is a placeholder for a metric.Meter.
+//
+// All Meter functionality is forwarded to a delegate once configured.
+// Otherwise, all functionality is forwarded to a NoopMeter.
+type meter struct {
+	name string
+	opts []metric.MeterOption
+
+	mtx         sync.Mutex
+	instruments []delegatedInstrument
+	callbacks   []delegatedCallback
+
+	delegate atomic.Value // metric.Meter
+}
+
+type delegatedInstrument interface {
+	setDelegate(metric.Meter)
+}
+
+// setDelegate configures m to delegate all Meter functionality to Meters
+// created by provider.
+//
+// All subsequent calls to the Meter methods will be passed to the delegate.
+//
+// It is guaranteed by the caller that this happens only once.
+func (m *meter) setDelegate(provider metric.MeterProvider) {
+	meter := provider.Meter(m.name, m.opts...)
+	m.delegate.Store(meter)
+
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+
+	for _, inst := range m.instruments {
+		inst.setDelegate(meter)
+	}
+
+	for _, callback := range m.callbacks {
+		callback.setDelegate(meter)
+	}
+
+	m.instruments = nil
+	m.callbacks = nil
+}
+
+// AsyncInt64 is the namespace for the Asynchronous Integer instruments.
+//
+// To Observe data with instruments it must be registered in a callback.
+func (m *meter) AsyncInt64() asyncint64.InstrumentProvider {
+	if del, ok := m.delegate.Load().(metric.Meter); ok {
+		return del.AsyncInt64()
+	}
+	return (*aiInstProvider)(m)
+}
+
+// AsyncFloat64 is the namespace for the Asynchronous Float instruments.
+//
+// To Observe data with instruments it must be registered in a callback.
+func (m *meter) AsyncFloat64() asyncfloat64.InstrumentProvider {
+	if del, ok := m.delegate.Load().(metric.Meter); ok {
+		return del.AsyncFloat64()
+	}
+	return (*afInstProvider)(m)
+}
+
+// RegisterCallback captures the function that will be called during Collect.
+//
+// It is only valid to call Observe within the scope of the passed function,
+// and only on the instruments that were registered with this call.
+func (m *meter) RegisterCallback(insts []instrument.Asynchronous, function func(context.Context)) error {
+	if del, ok := m.delegate.Load().(metric.Meter); ok {
+		insts = unwrapInstruments(insts)
+		return del.RegisterCallback(insts, function)
+	}
+
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+	m.callbacks = append(m.callbacks, delegatedCallback{
+		instruments: insts,
+		function:    function,
+	})
+
+	return nil
+}
+
+type wrapped interface {
+	unwrap() instrument.Asynchronous
+}
+
+func unwrapInstruments(instruments []instrument.Asynchronous) []instrument.Asynchronous {
+	out := make([]instrument.Asynchronous, 0, len(instruments))
+
+	for _, inst := range instruments {
+		if in, ok := inst.(wrapped); ok {
+			out = append(out, in.unwrap())
+		} else {
+			out = append(out, inst)
+		}
+	}
+
+	return out
+}
+
+// SyncInt64 is the namespace for the Synchronous Integer instruments.
+func (m *meter) SyncInt64() syncint64.InstrumentProvider {
+	if del, ok := m.delegate.Load().(metric.Meter); ok {
+		return del.SyncInt64()
+	}
+	return (*siInstProvider)(m)
+}
+
+// SyncFloat64 is the namespace for the Synchronous Float instruments.
+func (m *meter) SyncFloat64() syncfloat64.InstrumentProvider {
+	if del, ok := m.delegate.Load().(metric.Meter); ok {
+		return del.SyncFloat64()
+	}
+	return (*sfInstProvider)(m)
+}
+
+type delegatedCallback struct {
+	instruments []instrument.Asynchronous
+	function    func(context.Context)
+}
+
+func (c *delegatedCallback) setDelegate(m metric.Meter) {
+	insts := unwrapInstruments(c.instruments)
+	err := m.RegisterCallback(insts, c.function)
+	if err != nil {
+		otel.Handle(err)
+	}
+}
+
+type afInstProvider meter
+
+// Counter creates an instrument for recording increasing values.
+func (ip *afInstProvider) Counter(name string, opts ...instrument.Option) (asyncfloat64.Counter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &afCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// UpDownCounter creates an instrument for recording changes of a value.
+func (ip *afInstProvider) UpDownCounter(name string, opts ...instrument.Option) (asyncfloat64.UpDownCounter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &afUpDownCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// Gauge creates an instrument for recording the current value.
+func (ip *afInstProvider) Gauge(name string, opts ...instrument.Option) (asyncfloat64.Gauge, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &afGauge{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+type aiInstProvider meter
+
+// Counter creates an instrument for recording increasing values.
+func (ip *aiInstProvider) Counter(name string, opts ...instrument.Option) (asyncint64.Counter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &aiCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// UpDownCounter creates an instrument for recording changes of a value.
+func (ip *aiInstProvider) UpDownCounter(name string, opts ...instrument.Option) (asyncint64.UpDownCounter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &aiUpDownCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// Gauge creates an instrument for recording the current value.
+func (ip *aiInstProvider) Gauge(name string, opts ...instrument.Option) (asyncint64.Gauge, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &aiGauge{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+type sfInstProvider meter
+
+// Counter creates an instrument for recording increasing values.
+func (ip *sfInstProvider) Counter(name string, opts ...instrument.Option) (syncfloat64.Counter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &sfCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// UpDownCounter creates an instrument for recording changes of a value.
+func (ip *sfInstProvider) UpDownCounter(name string, opts ...instrument.Option) (syncfloat64.UpDownCounter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &sfUpDownCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// Histogram creates an instrument for recording a distribution of values.
+func (ip *sfInstProvider) Histogram(name string, opts ...instrument.Option) (syncfloat64.Histogram, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &sfHistogram{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+type siInstProvider meter
+
+// Counter creates an instrument for recording increasing values.
+func (ip *siInstProvider) Counter(name string, opts ...instrument.Option) (syncint64.Counter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &siCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// UpDownCounter creates an instrument for recording changes of a value.
+func (ip *siInstProvider) UpDownCounter(name string, opts ...instrument.Option) (syncint64.UpDownCounter, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &siUpDownCounter{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
+
+// Histogram creates an instrument for recording a distribution of values.
+func (ip *siInstProvider) Histogram(name string, opts ...instrument.Option) (syncint64.Histogram, error) {
+	ip.mtx.Lock()
+	defer ip.mtx.Unlock()
+	ctr := &siHistogram{name: name, opts: opts}
+	ip.instruments = append(ip.instruments, ctr)
+	return ctr, nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/internal/global/state.go b/vendor/go.opentelemetry.io/otel/metric/internal/global/state.go
new file mode 100644
index 0000000000..47c0d787d8
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/internal/global/state.go
@@ -0,0 +1,68 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     htmp://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package global // import "go.opentelemetry.io/otel/metric/internal/global"
+
+import (
+	"errors"
+	"sync"
+	"sync/atomic"
+
+	"go.opentelemetry.io/otel/internal/global"
+	"go.opentelemetry.io/otel/metric"
+)
+
+var (
+	globalMeterProvider = defaultMeterProvider()
+
+	delegateMeterOnce sync.Once
+)
+
+type meterProviderHolder struct {
+	mp metric.MeterProvider
+}
+
+// MeterProvider is the internal implementation for global.MeterProvider.
+func MeterProvider() metric.MeterProvider {
+	return globalMeterProvider.Load().(meterProviderHolder).mp
+}
+
+// SetMeterProvider is the internal implementation for global.SetMeterProvider.
+func SetMeterProvider(mp metric.MeterProvider) {
+	current := MeterProvider()
+	if _, cOk := current.(*meterProvider); cOk {
+		if _, mpOk := mp.(*meterProvider); mpOk && current == mp {
+			// Do not assign the default delegating MeterProvider to delegate
+			// to itself.
+			global.Error(
+				errors.New("no delegate configured in meter provider"),
+				"Setting meter provider to it's current value. No delegate will be configured",
+			)
+			return
+		}
+	}
+
+	delegateMeterOnce.Do(func() {
+		if def, ok := current.(*meterProvider); ok {
+			def.setDelegate(mp)
+		}
+	})
+	globalMeterProvider.Store(meterProviderHolder{mp: mp})
+}
+
+func defaultMeterProvider() *atomic.Value {
+	v := &atomic.Value{}
+	v.Store(meterProviderHolder{mp: &meterProvider{}})
+	return v
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/meter.go b/vendor/go.opentelemetry.io/otel/metric/meter.go
new file mode 100644
index 0000000000..23e6853afb
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/meter.go
@@ -0,0 +1,64 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package metric // import "go.opentelemetry.io/otel/metric"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/metric/instrument"
+	"go.opentelemetry.io/otel/metric/instrument/asyncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/asyncint64"
+	"go.opentelemetry.io/otel/metric/instrument/syncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/syncint64"
+)
+
+// MeterProvider provides access to named Meter instances, for instrumenting
+// an application or library.
+//
+// Warning: methods may be added to this interface in minor releases.
+type MeterProvider interface {
+	// Meter creates an instance of a `Meter` interface. The instrumentationName
+	// must be the name of the library providing instrumentation. This name may
+	// be the same as the instrumented code only if that code provides built-in
+	// instrumentation. If the instrumentationName is empty, then a
+	// implementation defined default name will be used instead.
+	Meter(instrumentationName string, opts ...MeterOption) Meter
+}
+
+// Meter provides access to instrument instances for recording metrics.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Meter interface {
+	// AsyncInt64 is the namespace for the Asynchronous Integer instruments.
+	//
+	// To Observe data with instruments it must be registered in a callback.
+	AsyncInt64() asyncint64.InstrumentProvider
+
+	// AsyncFloat64 is the namespace for the Asynchronous Float instruments
+	//
+	// To Observe data with instruments it must be registered in a callback.
+	AsyncFloat64() asyncfloat64.InstrumentProvider
+
+	// RegisterCallback captures the function that will be called during Collect.
+	//
+	// It is only valid to call Observe within the scope of the passed function,
+	// and only on the instruments that were registered with this call.
+	RegisterCallback(insts []instrument.Asynchronous, function func(context.Context)) error
+
+	// SyncInt64 is the namespace for the Synchronous Integer instruments
+	SyncInt64() syncint64.InstrumentProvider
+	// SyncFloat64 is the namespace for the Synchronous Float instruments
+	SyncFloat64() syncfloat64.InstrumentProvider
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/noop.go b/vendor/go.opentelemetry.io/otel/metric/noop.go
new file mode 100644
index 0000000000..e8b9a9a145
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/noop.go
@@ -0,0 +1,181 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package metric // import "go.opentelemetry.io/otel/metric"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric/instrument"
+	"go.opentelemetry.io/otel/metric/instrument/asyncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/asyncint64"
+	"go.opentelemetry.io/otel/metric/instrument/syncfloat64"
+	"go.opentelemetry.io/otel/metric/instrument/syncint64"
+)
+
+// NewNoopMeterProvider creates a MeterProvider that does not record any metrics.
+func NewNoopMeterProvider() MeterProvider {
+	return noopMeterProvider{}
+}
+
+type noopMeterProvider struct{}
+
+func (noopMeterProvider) Meter(string, ...MeterOption) Meter {
+	return noopMeter{}
+}
+
+// NewNoopMeter creates a Meter that does not record any metrics.
+func NewNoopMeter() Meter {
+	return noopMeter{}
+}
+
+type noopMeter struct{}
+
+// AsyncInt64 creates an instrument that does not record any metrics.
+func (noopMeter) AsyncInt64() asyncint64.InstrumentProvider {
+	return nonrecordingAsyncInt64Instrument{}
+}
+
+// AsyncFloat64 creates an instrument that does not record any metrics.
+func (noopMeter) AsyncFloat64() asyncfloat64.InstrumentProvider {
+	return nonrecordingAsyncFloat64Instrument{}
+}
+
+// SyncInt64 creates an instrument that does not record any metrics.
+func (noopMeter) SyncInt64() syncint64.InstrumentProvider {
+	return nonrecordingSyncInt64Instrument{}
+}
+
+// SyncFloat64 creates an instrument that does not record any metrics.
+func (noopMeter) SyncFloat64() syncfloat64.InstrumentProvider {
+	return nonrecordingSyncFloat64Instrument{}
+}
+
+// RegisterCallback creates a register callback that does not record any metrics.
+func (noopMeter) RegisterCallback([]instrument.Asynchronous, func(context.Context)) error {
+	return nil
+}
+
+type nonrecordingAsyncFloat64Instrument struct {
+	instrument.Asynchronous
+}
+
+var (
+	_ asyncfloat64.InstrumentProvider = nonrecordingAsyncFloat64Instrument{}
+	_ asyncfloat64.Counter            = nonrecordingAsyncFloat64Instrument{}
+	_ asyncfloat64.UpDownCounter      = nonrecordingAsyncFloat64Instrument{}
+	_ asyncfloat64.Gauge              = nonrecordingAsyncFloat64Instrument{}
+)
+
+func (n nonrecordingAsyncFloat64Instrument) Counter(string, ...instrument.Option) (asyncfloat64.Counter, error) {
+	return n, nil
+}
+
+func (n nonrecordingAsyncFloat64Instrument) UpDownCounter(string, ...instrument.Option) (asyncfloat64.UpDownCounter, error) {
+	return n, nil
+}
+
+func (n nonrecordingAsyncFloat64Instrument) Gauge(string, ...instrument.Option) (asyncfloat64.Gauge, error) {
+	return n, nil
+}
+
+func (nonrecordingAsyncFloat64Instrument) Observe(context.Context, float64, ...attribute.KeyValue) {
+
+}
+
+type nonrecordingAsyncInt64Instrument struct {
+	instrument.Asynchronous
+}
+
+var (
+	_ asyncint64.InstrumentProvider = nonrecordingAsyncInt64Instrument{}
+	_ asyncint64.Counter            = nonrecordingAsyncInt64Instrument{}
+	_ asyncint64.UpDownCounter      = nonrecordingAsyncInt64Instrument{}
+	_ asyncint64.Gauge              = nonrecordingAsyncInt64Instrument{}
+)
+
+func (n nonrecordingAsyncInt64Instrument) Counter(string, ...instrument.Option) (asyncint64.Counter, error) {
+	return n, nil
+}
+
+func (n nonrecordingAsyncInt64Instrument) UpDownCounter(string, ...instrument.Option) (asyncint64.UpDownCounter, error) {
+	return n, nil
+}
+
+func (n nonrecordingAsyncInt64Instrument) Gauge(string, ...instrument.Option) (asyncint64.Gauge, error) {
+	return n, nil
+}
+
+func (nonrecordingAsyncInt64Instrument) Observe(context.Context, int64, ...attribute.KeyValue) {
+}
+
+type nonrecordingSyncFloat64Instrument struct {
+	instrument.Synchronous
+}
+
+var (
+	_ syncfloat64.InstrumentProvider = nonrecordingSyncFloat64Instrument{}
+	_ syncfloat64.Counter            = nonrecordingSyncFloat64Instrument{}
+	_ syncfloat64.UpDownCounter      = nonrecordingSyncFloat64Instrument{}
+	_ syncfloat64.Histogram          = nonrecordingSyncFloat64Instrument{}
+)
+
+func (n nonrecordingSyncFloat64Instrument) Counter(string, ...instrument.Option) (syncfloat64.Counter, error) {
+	return n, nil
+}
+
+func (n nonrecordingSyncFloat64Instrument) UpDownCounter(string, ...instrument.Option) (syncfloat64.UpDownCounter, error) {
+	return n, nil
+}
+
+func (n nonrecordingSyncFloat64Instrument) Histogram(string, ...instrument.Option) (syncfloat64.Histogram, error) {
+	return n, nil
+}
+
+func (nonrecordingSyncFloat64Instrument) Add(context.Context, float64, ...attribute.KeyValue) {
+
+}
+
+func (nonrecordingSyncFloat64Instrument) Record(context.Context, float64, ...attribute.KeyValue) {
+
+}
+
+type nonrecordingSyncInt64Instrument struct {
+	instrument.Synchronous
+}
+
+var (
+	_ syncint64.InstrumentProvider = nonrecordingSyncInt64Instrument{}
+	_ syncint64.Counter            = nonrecordingSyncInt64Instrument{}
+	_ syncint64.UpDownCounter      = nonrecordingSyncInt64Instrument{}
+	_ syncint64.Histogram          = nonrecordingSyncInt64Instrument{}
+)
+
+func (n nonrecordingSyncInt64Instrument) Counter(string, ...instrument.Option) (syncint64.Counter, error) {
+	return n, nil
+}
+
+func (n nonrecordingSyncInt64Instrument) UpDownCounter(string, ...instrument.Option) (syncint64.UpDownCounter, error) {
+	return n, nil
+}
+
+func (n nonrecordingSyncInt64Instrument) Histogram(string, ...instrument.Option) (syncint64.Histogram, error) {
+	return n, nil
+}
+
+func (nonrecordingSyncInt64Instrument) Add(context.Context, int64, ...attribute.KeyValue) {
+}
+func (nonrecordingSyncInt64Instrument) Record(context.Context, int64, ...attribute.KeyValue) {
+}
diff --git a/vendor/go.opentelemetry.io/otel/metric/unit/doc.go b/vendor/go.opentelemetry.io/otel/metric/unit/doc.go
new file mode 100644
index 0000000000..f8e723593e
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/unit/doc.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package unit provides units.
+//
+// This package is currently in a pre-GA phase. Backwards incompatible changes
+// may be introduced in subsequent minor version releases as we work to track
+// the evolving OpenTelemetry specification and user feedback.
+package unit // import "go.opentelemetry.io/otel/metric/unit"
diff --git a/vendor/go.opentelemetry.io/otel/metric/unit/unit.go b/vendor/go.opentelemetry.io/otel/metric/unit/unit.go
new file mode 100644
index 0000000000..647d77302d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/metric/unit/unit.go
@@ -0,0 +1,25 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package unit // import "go.opentelemetry.io/otel/metric/unit"
+
+// Unit is a determinate standard quantity of measurement.
+type Unit string
+
+// Units defined by OpenTelemetry.
+const (
+	Dimensionless Unit = "1"
+	Bytes         Unit = "By"
+	Milliseconds  Unit = "ms"
+)
diff --git a/vendor/go.opentelemetry.io/otel/propagation.go b/vendor/go.opentelemetry.io/otel/propagation.go
new file mode 100644
index 0000000000..d29aaa32c0
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/propagation.go
@@ -0,0 +1,31 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otel // import "go.opentelemetry.io/otel"
+
+import (
+	"go.opentelemetry.io/otel/internal/global"
+	"go.opentelemetry.io/otel/propagation"
+)
+
+// GetTextMapPropagator returns the global TextMapPropagator. If none has been
+// set, a No-Op TextMapPropagator is returned.
+func GetTextMapPropagator() propagation.TextMapPropagator {
+	return global.TextMapPropagator()
+}
+
+// SetTextMapPropagator sets propagator as the global TextMapPropagator.
+func SetTextMapPropagator(propagator propagation.TextMapPropagator) {
+	global.SetTextMapPropagator(propagator)
+}
diff --git a/vendor/go.opentelemetry.io/otel/propagation/baggage.go b/vendor/go.opentelemetry.io/otel/propagation/baggage.go
new file mode 100644
index 0000000000..303cdf1cbf
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/propagation/baggage.go
@@ -0,0 +1,58 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package propagation // import "go.opentelemetry.io/otel/propagation"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/baggage"
+)
+
+const baggageHeader = "baggage"
+
+// Baggage is a propagator that supports the W3C Baggage format.
+//
+// This propagates user-defined baggage associated with a trace. The complete
+// specification is defined at https://www.w3.org/TR/baggage/.
+type Baggage struct{}
+
+var _ TextMapPropagator = Baggage{}
+
+// Inject sets baggage key-values from ctx into the carrier.
+func (b Baggage) Inject(ctx context.Context, carrier TextMapCarrier) {
+	bStr := baggage.FromContext(ctx).String()
+	if bStr != "" {
+		carrier.Set(baggageHeader, bStr)
+	}
+}
+
+// Extract returns a copy of parent with the baggage from the carrier added.
+func (b Baggage) Extract(parent context.Context, carrier TextMapCarrier) context.Context {
+	bStr := carrier.Get(baggageHeader)
+	if bStr == "" {
+		return parent
+	}
+
+	bag, err := baggage.Parse(bStr)
+	if err != nil {
+		return parent
+	}
+	return baggage.ContextWithBaggage(parent, bag)
+}
+
+// Fields returns the keys who's values are set with Inject.
+func (b Baggage) Fields() []string {
+	return []string{baggageHeader}
+}
diff --git a/vendor/go.opentelemetry.io/otel/propagation/doc.go b/vendor/go.opentelemetry.io/otel/propagation/doc.go
new file mode 100644
index 0000000000..c119eb2858
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/propagation/doc.go
@@ -0,0 +1,24 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package propagation contains OpenTelemetry context propagators.
+
+OpenTelemetry propagators are used to extract and inject context data from and
+into messages exchanged by applications. The propagator supported by this
+package is the W3C Trace Context encoding
+(https://www.w3.org/TR/trace-context/), and W3C Baggage
+(https://www.w3.org/TR/baggage/).
+*/
+package propagation // import "go.opentelemetry.io/otel/propagation"
diff --git a/vendor/go.opentelemetry.io/otel/propagation/propagation.go b/vendor/go.opentelemetry.io/otel/propagation/propagation.go
new file mode 100644
index 0000000000..c94438f73a
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/propagation/propagation.go
@@ -0,0 +1,153 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package propagation // import "go.opentelemetry.io/otel/propagation"
+
+import (
+	"context"
+	"net/http"
+)
+
+// TextMapCarrier is the storage medium used by a TextMapPropagator.
+type TextMapCarrier interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Get returns the value associated with the passed key.
+	Get(key string) string
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Set stores the key-value pair.
+	Set(key string, value string)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Keys lists the keys stored in this carrier.
+	Keys() []string
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+// MapCarrier is a TextMapCarrier that uses a map held in memory as a storage
+// medium for propagated key-value pairs.
+type MapCarrier map[string]string
+
+// Compile time check that MapCarrier implements the TextMapCarrier.
+var _ TextMapCarrier = MapCarrier{}
+
+// Get returns the value associated with the passed key.
+func (c MapCarrier) Get(key string) string {
+	return c[key]
+}
+
+// Set stores the key-value pair.
+func (c MapCarrier) Set(key, value string) {
+	c[key] = value
+}
+
+// Keys lists the keys stored in this carrier.
+func (c MapCarrier) Keys() []string {
+	keys := make([]string, 0, len(c))
+	for k := range c {
+		keys = append(keys, k)
+	}
+	return keys
+}
+
+// HeaderCarrier adapts http.Header to satisfy the TextMapCarrier interface.
+type HeaderCarrier http.Header
+
+// Get returns the value associated with the passed key.
+func (hc HeaderCarrier) Get(key string) string {
+	return http.Header(hc).Get(key)
+}
+
+// Set stores the key-value pair.
+func (hc HeaderCarrier) Set(key string, value string) {
+	http.Header(hc).Set(key, value)
+}
+
+// Keys lists the keys stored in this carrier.
+func (hc HeaderCarrier) Keys() []string {
+	keys := make([]string, 0, len(hc))
+	for k := range hc {
+		keys = append(keys, k)
+	}
+	return keys
+}
+
+// TextMapPropagator propagates cross-cutting concerns as key-value text
+// pairs within a carrier that travels in-band across process boundaries.
+type TextMapPropagator interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Inject set cross-cutting concerns from the Context into the carrier.
+	Inject(ctx context.Context, carrier TextMapCarrier)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Extract reads cross-cutting concerns from the carrier into a Context.
+	Extract(ctx context.Context, carrier TextMapCarrier) context.Context
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Fields returns the keys whose values are set with Inject.
+	Fields() []string
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+type compositeTextMapPropagator []TextMapPropagator
+
+func (p compositeTextMapPropagator) Inject(ctx context.Context, carrier TextMapCarrier) {
+	for _, i := range p {
+		i.Inject(ctx, carrier)
+	}
+}
+
+func (p compositeTextMapPropagator) Extract(ctx context.Context, carrier TextMapCarrier) context.Context {
+	for _, i := range p {
+		ctx = i.Extract(ctx, carrier)
+	}
+	return ctx
+}
+
+func (p compositeTextMapPropagator) Fields() []string {
+	unique := make(map[string]struct{})
+	for _, i := range p {
+		for _, k := range i.Fields() {
+			unique[k] = struct{}{}
+		}
+	}
+
+	fields := make([]string, 0, len(unique))
+	for k := range unique {
+		fields = append(fields, k)
+	}
+	return fields
+}
+
+// NewCompositeTextMapPropagator returns a unified TextMapPropagator from the
+// group of passed TextMapPropagator. This allows different cross-cutting
+// concerns to be propagates in a unified manner.
+//
+// The returned TextMapPropagator will inject and extract cross-cutting
+// concerns in the order the TextMapPropagators were provided. Additionally,
+// the Fields method will return a de-duplicated slice of the keys that are
+// set with the Inject method.
+func NewCompositeTextMapPropagator(p ...TextMapPropagator) TextMapPropagator {
+	return compositeTextMapPropagator(p)
+}
diff --git a/vendor/go.opentelemetry.io/otel/propagation/trace_context.go b/vendor/go.opentelemetry.io/otel/propagation/trace_context.go
new file mode 100644
index 0000000000..902692da08
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/propagation/trace_context.go
@@ -0,0 +1,159 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package propagation // import "go.opentelemetry.io/otel/propagation"
+
+import (
+	"context"
+	"encoding/hex"
+	"fmt"
+	"regexp"
+
+	"go.opentelemetry.io/otel/trace"
+)
+
+const (
+	supportedVersion  = 0
+	maxVersion        = 254
+	traceparentHeader = "traceparent"
+	tracestateHeader  = "tracestate"
+)
+
+// TraceContext is a propagator that supports the W3C Trace Context format
+// (https://www.w3.org/TR/trace-context/)
+//
+// This propagator will propagate the traceparent and tracestate headers to
+// guarantee traces are not broken. It is up to the users of this propagator
+// to choose if they want to participate in a trace by modifying the
+// traceparent header and relevant parts of the tracestate header containing
+// their proprietary information.
+type TraceContext struct{}
+
+var _ TextMapPropagator = TraceContext{}
+var traceCtxRegExp = regexp.MustCompile("^(?P<version>[0-9a-f]{2})-(?P<traceID>[a-f0-9]{32})-(?P<spanID>[a-f0-9]{16})-(?P<traceFlags>[a-f0-9]{2})(?:-.*)?$")
+
+// Inject set tracecontext from the Context into the carrier.
+func (tc TraceContext) Inject(ctx context.Context, carrier TextMapCarrier) {
+	sc := trace.SpanContextFromContext(ctx)
+	if !sc.IsValid() {
+		return
+	}
+
+	if ts := sc.TraceState().String(); ts != "" {
+		carrier.Set(tracestateHeader, ts)
+	}
+
+	// Clear all flags other than the trace-context supported sampling bit.
+	flags := sc.TraceFlags() & trace.FlagsSampled
+
+	h := fmt.Sprintf("%.2x-%s-%s-%s",
+		supportedVersion,
+		sc.TraceID(),
+		sc.SpanID(),
+		flags)
+	carrier.Set(traceparentHeader, h)
+}
+
+// Extract reads tracecontext from the carrier into a returned Context.
+//
+// The returned Context will be a copy of ctx and contain the extracted
+// tracecontext as the remote SpanContext. If the extracted tracecontext is
+// invalid, the passed ctx will be returned directly instead.
+func (tc TraceContext) Extract(ctx context.Context, carrier TextMapCarrier) context.Context {
+	sc := tc.extract(carrier)
+	if !sc.IsValid() {
+		return ctx
+	}
+	return trace.ContextWithRemoteSpanContext(ctx, sc)
+}
+
+func (tc TraceContext) extract(carrier TextMapCarrier) trace.SpanContext {
+	h := carrier.Get(traceparentHeader)
+	if h == "" {
+		return trace.SpanContext{}
+	}
+
+	matches := traceCtxRegExp.FindStringSubmatch(h)
+
+	if len(matches) == 0 {
+		return trace.SpanContext{}
+	}
+
+	if len(matches) < 5 { // four subgroups plus the overall match
+		return trace.SpanContext{}
+	}
+
+	if len(matches[1]) != 2 {
+		return trace.SpanContext{}
+	}
+	ver, err := hex.DecodeString(matches[1])
+	if err != nil {
+		return trace.SpanContext{}
+	}
+	version := int(ver[0])
+	if version > maxVersion {
+		return trace.SpanContext{}
+	}
+
+	if version == 0 && len(matches) != 5 { // four subgroups plus the overall match
+		return trace.SpanContext{}
+	}
+
+	if len(matches[2]) != 32 {
+		return trace.SpanContext{}
+	}
+
+	var scc trace.SpanContextConfig
+
+	scc.TraceID, err = trace.TraceIDFromHex(matches[2][:32])
+	if err != nil {
+		return trace.SpanContext{}
+	}
+
+	if len(matches[3]) != 16 {
+		return trace.SpanContext{}
+	}
+	scc.SpanID, err = trace.SpanIDFromHex(matches[3])
+	if err != nil {
+		return trace.SpanContext{}
+	}
+
+	if len(matches[4]) != 2 {
+		return trace.SpanContext{}
+	}
+	opts, err := hex.DecodeString(matches[4])
+	if err != nil || len(opts) < 1 || (version == 0 && opts[0] > 2) {
+		return trace.SpanContext{}
+	}
+	// Clear all flags other than the trace-context supported sampling bit.
+	scc.TraceFlags = trace.TraceFlags(opts[0]) & trace.FlagsSampled
+
+	// Ignore the error returned here. Failure to parse tracestate MUST NOT
+	// affect the parsing of traceparent according to the W3C tracecontext
+	// specification.
+	scc.TraceState, _ = trace.ParseTraceState(carrier.Get(tracestateHeader))
+	scc.Remote = true
+
+	sc := trace.NewSpanContext(scc)
+	if !sc.IsValid() {
+		return trace.SpanContext{}
+	}
+
+	return sc
+}
+
+// Fields returns the keys who's values are set with Inject.
+func (tc TraceContext) Fields() []string {
+	return []string{traceparentHeader, tracestateHeader}
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/LICENSE b/vendor/go.opentelemetry.io/otel/sdk/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/sdk/instrumentation/doc.go b/vendor/go.opentelemetry.io/otel/sdk/instrumentation/doc.go
new file mode 100644
index 0000000000..6e923acab4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/instrumentation/doc.go
@@ -0,0 +1,24 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package instrumentation provides types to represent the code libraries that
+// provide OpenTelemetry instrumentation. These types are used in the
+// OpenTelemetry signal pipelines to identify the source of telemetry.
+//
+// See
+// https://github.com/open-telemetry/oteps/blob/d226b677d73a785523fe9b9701be13225ebc528d/text/0083-component.md
+// and
+// https://github.com/open-telemetry/oteps/blob/d226b677d73a785523fe9b9701be13225ebc528d/text/0201-scope-attributes.md
+// for more information.
+package instrumentation // import "go.opentelemetry.io/otel/sdk/instrumentation"
diff --git a/vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.go b/vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.go
new file mode 100644
index 0000000000..39f025a171
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/instrumentation/library.go
@@ -0,0 +1,19 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package instrumentation // import "go.opentelemetry.io/otel/sdk/instrumentation"
+
+// Library represents the instrumentation library.
+// Deprecated: please use Scope instead.
+type Library = Scope
diff --git a/vendor/go.opentelemetry.io/otel/sdk/instrumentation/scope.go b/vendor/go.opentelemetry.io/otel/sdk/instrumentation/scope.go
new file mode 100644
index 0000000000..09c6d93f6d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/instrumentation/scope.go
@@ -0,0 +1,26 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package instrumentation // import "go.opentelemetry.io/otel/sdk/instrumentation"
+
+// Scope represents the instrumentation scope.
+type Scope struct {
+	// Name is the name of the instrumentation scope. This should be the
+	// Go package name of that scope.
+	Name string
+	// Version is the version of the instrumentation scope.
+	Version string
+	// SchemaURL of the telemetry emitted by the scope.
+	SchemaURL string
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/internal/env/env.go b/vendor/go.opentelemetry.io/otel/sdk/internal/env/env.go
new file mode 100644
index 0000000000..5e94b8ae52
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/internal/env/env.go
@@ -0,0 +1,177 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package env // import "go.opentelemetry.io/otel/sdk/internal/env"
+
+import (
+	"os"
+	"strconv"
+
+	"go.opentelemetry.io/otel/internal/global"
+)
+
+// Environment variable names.
+const (
+	// BatchSpanProcessorScheduleDelayKey is the delay interval between two
+	// consecutive exports (i.e. 5000).
+	BatchSpanProcessorScheduleDelayKey = "OTEL_BSP_SCHEDULE_DELAY"
+	// BatchSpanProcessorExportTimeoutKey is the maximum allowed time to
+	// export data (i.e. 3000).
+	BatchSpanProcessorExportTimeoutKey = "OTEL_BSP_EXPORT_TIMEOUT"
+	// BatchSpanProcessorMaxQueueSizeKey is the maximum queue size (i.e. 2048).
+	BatchSpanProcessorMaxQueueSizeKey = "OTEL_BSP_MAX_QUEUE_SIZE"
+	// BatchSpanProcessorMaxExportBatchSizeKey is the maximum batch size (i.e.
+	// 512). Note: it must be less than or equal to
+	// EnvBatchSpanProcessorMaxQueueSize.
+	BatchSpanProcessorMaxExportBatchSizeKey = "OTEL_BSP_MAX_EXPORT_BATCH_SIZE"
+
+	// AttributeValueLengthKey is the maximum allowed attribute value size.
+	AttributeValueLengthKey = "OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT"
+
+	// AttributeCountKey is the maximum allowed span attribute count.
+	AttributeCountKey = "OTEL_ATTRIBUTE_COUNT_LIMIT"
+
+	// SpanAttributeValueLengthKey is the maximum allowed attribute value size
+	// for a span.
+	SpanAttributeValueLengthKey = "OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT"
+
+	// SpanAttributeCountKey is the maximum allowed span attribute count for a
+	// span.
+	SpanAttributeCountKey = "OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT"
+
+	// SpanEventCountKey is the maximum allowed span event count.
+	SpanEventCountKey = "OTEL_SPAN_EVENT_COUNT_LIMIT"
+
+	// SpanEventAttributeCountKey is the maximum allowed attribute per span
+	// event count.
+	SpanEventAttributeCountKey = "OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT"
+
+	// SpanLinkCountKey is the maximum allowed span link count.
+	SpanLinkCountKey = "OTEL_SPAN_LINK_COUNT_LIMIT"
+
+	// SpanLinkAttributeCountKey is the maximum allowed attribute per span
+	// link count.
+	SpanLinkAttributeCountKey = "OTEL_LINK_ATTRIBUTE_COUNT_LIMIT"
+)
+
+// firstInt returns the value of the first matching environment variable from
+// keys. If the value is not an integer or no match is found, defaultValue is
+// returned.
+func firstInt(defaultValue int, keys ...string) int {
+	for _, key := range keys {
+		value, ok := os.LookupEnv(key)
+		if !ok {
+			continue
+		}
+
+		intValue, err := strconv.Atoi(value)
+		if err != nil {
+			global.Info("Got invalid value, number value expected.", key, value)
+			return defaultValue
+		}
+
+		return intValue
+	}
+
+	return defaultValue
+}
+
+// IntEnvOr returns the int value of the environment variable with name key if
+// it exists and the value is an int. Otherwise, defaultValue is returned.
+func IntEnvOr(key string, defaultValue int) int {
+	value, ok := os.LookupEnv(key)
+	if !ok {
+		return defaultValue
+	}
+
+	intValue, err := strconv.Atoi(value)
+	if err != nil {
+		global.Info("Got invalid value, number value expected.", key, value)
+		return defaultValue
+	}
+
+	return intValue
+}
+
+// BatchSpanProcessorScheduleDelay returns the environment variable value for
+// the OTEL_BSP_SCHEDULE_DELAY key if it exists, otherwise defaultValue is
+// returned.
+func BatchSpanProcessorScheduleDelay(defaultValue int) int {
+	return IntEnvOr(BatchSpanProcessorScheduleDelayKey, defaultValue)
+}
+
+// BatchSpanProcessorExportTimeout returns the environment variable value for
+// the OTEL_BSP_EXPORT_TIMEOUT key if it exists, otherwise defaultValue is
+// returned.
+func BatchSpanProcessorExportTimeout(defaultValue int) int {
+	return IntEnvOr(BatchSpanProcessorExportTimeoutKey, defaultValue)
+}
+
+// BatchSpanProcessorMaxQueueSize returns the environment variable value for
+// the OTEL_BSP_MAX_QUEUE_SIZE key if it exists, otherwise defaultValue is
+// returned.
+func BatchSpanProcessorMaxQueueSize(defaultValue int) int {
+	return IntEnvOr(BatchSpanProcessorMaxQueueSizeKey, defaultValue)
+}
+
+// BatchSpanProcessorMaxExportBatchSize returns the environment variable value for
+// the OTEL_BSP_MAX_EXPORT_BATCH_SIZE key if it exists, otherwise defaultValue
+// is returned.
+func BatchSpanProcessorMaxExportBatchSize(defaultValue int) int {
+	return IntEnvOr(BatchSpanProcessorMaxExportBatchSizeKey, defaultValue)
+}
+
+// SpanAttributeValueLength returns the environment variable value for the
+// OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT key if it exists. Otherwise, the
+// environment variable value for OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT is
+// returned or defaultValue if that is not set.
+func SpanAttributeValueLength(defaultValue int) int {
+	return firstInt(defaultValue, SpanAttributeValueLengthKey, AttributeValueLengthKey)
+}
+
+// SpanAttributeCount returns the environment variable value for the
+// OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT key if it exists. Otherwise, the
+// environment variable value for OTEL_ATTRIBUTE_COUNT_LIMIT is returned or
+// defaultValue if that is not set.
+func SpanAttributeCount(defaultValue int) int {
+	return firstInt(defaultValue, SpanAttributeCountKey, AttributeCountKey)
+}
+
+// SpanEventCount returns the environment variable value for the
+// OTEL_SPAN_EVENT_COUNT_LIMIT key if it exists, otherwise defaultValue is
+// returned.
+func SpanEventCount(defaultValue int) int {
+	return IntEnvOr(SpanEventCountKey, defaultValue)
+}
+
+// SpanEventAttributeCount returns the environment variable value for the
+// OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT key if it exists, otherwise defaultValue
+// is returned.
+func SpanEventAttributeCount(defaultValue int) int {
+	return IntEnvOr(SpanEventAttributeCountKey, defaultValue)
+}
+
+// SpanLinkCount returns the environment variable value for the
+// OTEL_SPAN_LINK_COUNT_LIMIT key if it exists, otherwise defaultValue is
+// returned.
+func SpanLinkCount(defaultValue int) int {
+	return IntEnvOr(SpanLinkCountKey, defaultValue)
+}
+
+// SpanLinkAttributeCount returns the environment variable value for the
+// OTEL_LINK_ATTRIBUTE_COUNT_LIMIT key if it exists, otherwise defaultValue is
+// returned.
+func SpanLinkAttributeCount(defaultValue int) int {
+	return IntEnvOr(SpanLinkAttributeCountKey, defaultValue)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/internal/internal.go b/vendor/go.opentelemetry.io/otel/sdk/internal/internal.go
new file mode 100644
index 0000000000..84a02306e6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/internal/internal.go
@@ -0,0 +1,37 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package internal // import "go.opentelemetry.io/otel/sdk/internal"
+
+import (
+	"fmt"
+	"time"
+
+	"go.opentelemetry.io/otel"
+)
+
+// UserAgent is the user agent to be added to the outgoing
+// requests from the exporters.
+var UserAgent = fmt.Sprintf("opentelemetry-go/%s", otel.Version())
+
+// MonotonicEndTime returns the end time at present
+// but offset from start, monotonically.
+//
+// The monotonic clock is used in subtractions hence
+// the duration since start added back to start gives
+// end as a monotonic time.
+// See https://golang.org/pkg/time/#hdr-Monotonic_Clocks
+func MonotonicEndTime(start time.Time) time.Time {
+	return start.Add(time.Since(start))
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/auto.go b/vendor/go.opentelemetry.io/otel/sdk/resource/auto.go
new file mode 100644
index 0000000000..c1d220408a
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/auto.go
@@ -0,0 +1,72 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+	"errors"
+	"fmt"
+)
+
+var (
+	// ErrPartialResource is returned by a detector when complete source
+	// information for a Resource is unavailable or the source information
+	// contains invalid values that are omitted from the returned Resource.
+	ErrPartialResource = errors.New("partial resource")
+)
+
+// Detector detects OpenTelemetry resource information.
+type Detector interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Detect returns an initialized Resource based on gathered information.
+	// If the source information to construct a Resource contains invalid
+	// values, a Resource is returned with the valid parts of the source
+	// information used for initialization along with an appropriately
+	// wrapped ErrPartialResource error.
+	Detect(ctx context.Context) (*Resource, error)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+// Detect calls all input detectors sequentially and merges each result with the previous one.
+// It returns the merged error too.
+func Detect(ctx context.Context, detectors ...Detector) (*Resource, error) {
+	var autoDetectedRes *Resource
+	var errInfo []string
+	for _, detector := range detectors {
+		if detector == nil {
+			continue
+		}
+		res, err := detector.Detect(ctx)
+		if err != nil {
+			errInfo = append(errInfo, err.Error())
+			if !errors.Is(err, ErrPartialResource) {
+				continue
+			}
+		}
+		autoDetectedRes, err = Merge(autoDetectedRes, res)
+		if err != nil {
+			errInfo = append(errInfo, err.Error())
+		}
+	}
+
+	var aggregatedError error
+	if len(errInfo) > 0 {
+		aggregatedError = fmt.Errorf("detecting resources: %s", errInfo)
+	}
+	return autoDetectedRes, aggregatedError
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go b/vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go
new file mode 100644
index 0000000000..aa0f942f49
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/builtin.go
@@ -0,0 +1,108 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
+)
+
+type (
+	// telemetrySDK is a Detector that provides information about
+	// the OpenTelemetry SDK used.  This Detector is included as a
+	// builtin. If these resource attributes are not wanted, use
+	// the WithTelemetrySDK(nil) or WithoutBuiltin() options to
+	// explicitly disable them.
+	telemetrySDK struct{}
+
+	// host is a Detector that provides information about the host
+	// being run on. This Detector is included as a builtin. If
+	// these resource attributes are not wanted, use the
+	// WithHost(nil) or WithoutBuiltin() options to explicitly
+	// disable them.
+	host struct{}
+
+	stringDetector struct {
+		schemaURL string
+		K         attribute.Key
+		F         func() (string, error)
+	}
+
+	defaultServiceNameDetector struct{}
+)
+
+var (
+	_ Detector = telemetrySDK{}
+	_ Detector = host{}
+	_ Detector = stringDetector{}
+	_ Detector = defaultServiceNameDetector{}
+)
+
+// Detect returns a *Resource that describes the OpenTelemetry SDK used.
+func (telemetrySDK) Detect(context.Context) (*Resource, error) {
+	return NewWithAttributes(
+		semconv.SchemaURL,
+		semconv.TelemetrySDKName("opentelemetry"),
+		semconv.TelemetrySDKLanguageGo,
+		semconv.TelemetrySDKVersion(otel.Version()),
+	), nil
+}
+
+// Detect returns a *Resource that describes the host being run on.
+func (host) Detect(ctx context.Context) (*Resource, error) {
+	return StringDetector(semconv.SchemaURL, semconv.HostNameKey, os.Hostname).Detect(ctx)
+}
+
+// StringDetector returns a Detector that will produce a *Resource
+// containing the string as a value corresponding to k. The resulting Resource
+// will have the specified schemaURL.
+func StringDetector(schemaURL string, k attribute.Key, f func() (string, error)) Detector {
+	return stringDetector{schemaURL: schemaURL, K: k, F: f}
+}
+
+// Detect returns a *Resource that describes the string as a value
+// corresponding to attribute.Key as well as the specific schemaURL.
+func (sd stringDetector) Detect(ctx context.Context) (*Resource, error) {
+	value, err := sd.F()
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", string(sd.K), err)
+	}
+	a := sd.K.String(value)
+	if !a.Valid() {
+		return nil, fmt.Errorf("invalid attribute: %q -> %q", a.Key, a.Value.Emit())
+	}
+	return NewWithAttributes(sd.schemaURL, sd.K.String(value)), nil
+}
+
+// Detect implements Detector.
+func (defaultServiceNameDetector) Detect(ctx context.Context) (*Resource, error) {
+	return StringDetector(
+		semconv.SchemaURL,
+		semconv.ServiceNameKey,
+		func() (string, error) {
+			executable, err := os.Executable()
+			if err != nil {
+				return "unknown_service:go", nil
+			}
+			return "unknown_service:" + filepath.Base(executable), nil
+		},
+	).Detect(ctx)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/config.go b/vendor/go.opentelemetry.io/otel/sdk/resource/config.go
new file mode 100644
index 0000000000..f9a2a29990
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/config.go
@@ -0,0 +1,201 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// config contains configuration for Resource creation.
+type config struct {
+	// detectors that will be evaluated.
+	detectors []Detector
+	// SchemaURL to associate with the Resource.
+	schemaURL string
+}
+
+// Option is the interface that applies a configuration option.
+type Option interface {
+	// apply sets the Option value of a config.
+	apply(config) config
+}
+
+// WithAttributes adds attributes to the configured Resource.
+func WithAttributes(attributes ...attribute.KeyValue) Option {
+	return WithDetectors(detectAttributes{attributes})
+}
+
+type detectAttributes struct {
+	attributes []attribute.KeyValue
+}
+
+func (d detectAttributes) Detect(context.Context) (*Resource, error) {
+	return NewSchemaless(d.attributes...), nil
+}
+
+// WithDetectors adds detectors to be evaluated for the configured resource.
+func WithDetectors(detectors ...Detector) Option {
+	return detectorsOption{detectors: detectors}
+}
+
+type detectorsOption struct {
+	detectors []Detector
+}
+
+func (o detectorsOption) apply(cfg config) config {
+	cfg.detectors = append(cfg.detectors, o.detectors...)
+	return cfg
+}
+
+// WithFromEnv adds attributes from environment variables to the configured resource.
+func WithFromEnv() Option {
+	return WithDetectors(fromEnv{})
+}
+
+// WithHost adds attributes from the host to the configured resource.
+func WithHost() Option {
+	return WithDetectors(host{})
+}
+
+// WithTelemetrySDK adds TelemetrySDK version info to the configured resource.
+func WithTelemetrySDK() Option {
+	return WithDetectors(telemetrySDK{})
+}
+
+// WithSchemaURL sets the schema URL for the configured resource.
+func WithSchemaURL(schemaURL string) Option {
+	return schemaURLOption(schemaURL)
+}
+
+type schemaURLOption string
+
+func (o schemaURLOption) apply(cfg config) config {
+	cfg.schemaURL = string(o)
+	return cfg
+}
+
+// WithOS adds all the OS attributes to the configured Resource.
+// See individual WithOS* functions to configure specific attributes.
+func WithOS() Option {
+	return WithDetectors(
+		osTypeDetector{},
+		osDescriptionDetector{},
+	)
+}
+
+// WithOSType adds an attribute with the operating system type to the configured Resource.
+func WithOSType() Option {
+	return WithDetectors(osTypeDetector{})
+}
+
+// WithOSDescription adds an attribute with the operating system description to the
+// configured Resource. The formatted string is equivalent to the output of the
+// `uname -snrvm` command.
+func WithOSDescription() Option {
+	return WithDetectors(osDescriptionDetector{})
+}
+
+// WithProcess adds all the Process attributes to the configured Resource.
+//
+// Warning! This option will include process command line arguments. If these
+// contain sensitive information it will be included in the exported resource.
+//
+// This option is equivalent to calling WithProcessPID,
+// WithProcessExecutableName, WithProcessExecutablePath,
+// WithProcessCommandArgs, WithProcessOwner, WithProcessRuntimeName,
+// WithProcessRuntimeVersion, and WithProcessRuntimeDescription. See each
+// option function for information about what resource attributes each
+// includes.
+func WithProcess() Option {
+	return WithDetectors(
+		processPIDDetector{},
+		processExecutableNameDetector{},
+		processExecutablePathDetector{},
+		processCommandArgsDetector{},
+		processOwnerDetector{},
+		processRuntimeNameDetector{},
+		processRuntimeVersionDetector{},
+		processRuntimeDescriptionDetector{},
+	)
+}
+
+// WithProcessPID adds an attribute with the process identifier (PID) to the
+// configured Resource.
+func WithProcessPID() Option {
+	return WithDetectors(processPIDDetector{})
+}
+
+// WithProcessExecutableName adds an attribute with the name of the process
+// executable to the configured Resource.
+func WithProcessExecutableName() Option {
+	return WithDetectors(processExecutableNameDetector{})
+}
+
+// WithProcessExecutablePath adds an attribute with the full path to the process
+// executable to the configured Resource.
+func WithProcessExecutablePath() Option {
+	return WithDetectors(processExecutablePathDetector{})
+}
+
+// WithProcessCommandArgs adds an attribute with all the command arguments (including
+// the command/executable itself) as received by the process to the configured
+// Resource.
+//
+// Warning! This option will include process command line arguments. If these
+// contain sensitive information it will be included in the exported resource.
+func WithProcessCommandArgs() Option {
+	return WithDetectors(processCommandArgsDetector{})
+}
+
+// WithProcessOwner adds an attribute with the username of the user that owns the process
+// to the configured Resource.
+func WithProcessOwner() Option {
+	return WithDetectors(processOwnerDetector{})
+}
+
+// WithProcessRuntimeName adds an attribute with the name of the runtime of this
+// process to the configured Resource.
+func WithProcessRuntimeName() Option {
+	return WithDetectors(processRuntimeNameDetector{})
+}
+
+// WithProcessRuntimeVersion adds an attribute with the version of the runtime of
+// this process to the configured Resource.
+func WithProcessRuntimeVersion() Option {
+	return WithDetectors(processRuntimeVersionDetector{})
+}
+
+// WithProcessRuntimeDescription adds an attribute with an additional description
+// about the runtime of the process to the configured Resource.
+func WithProcessRuntimeDescription() Option {
+	return WithDetectors(processRuntimeDescriptionDetector{})
+}
+
+// WithContainer adds all the Container attributes to the configured Resource.
+// See individual WithContainer* functions to configure specific attributes.
+func WithContainer() Option {
+	return WithDetectors(
+		cgroupContainerIDDetector{},
+	)
+}
+
+// WithContainerID adds an attribute with the id of the container to the configured Resource.
+// Note: WithContainerID will not extract the correct container ID in an ECS environment.
+// Please use the ECS resource detector instead (https://pkg.go.dev/go.opentelemetry.io/contrib/detectors/aws/ecs).
+func WithContainerID() Option {
+	return WithDetectors(cgroupContainerIDDetector{})
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/container.go b/vendor/go.opentelemetry.io/otel/sdk/resource/container.go
new file mode 100644
index 0000000000..318dcf82fe
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/container.go
@@ -0,0 +1,100 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"io"
+	"os"
+	"regexp"
+
+	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
+)
+
+type containerIDProvider func() (string, error)
+
+var (
+	containerID         containerIDProvider = getContainerIDFromCGroup
+	cgroupContainerIDRe                     = regexp.MustCompile(`^.*/(?:.*-)?([0-9a-f]+)(?:\.|\s*$)`)
+)
+
+type cgroupContainerIDDetector struct{}
+
+const cgroupPath = "/proc/self/cgroup"
+
+// Detect returns a *Resource that describes the id of the container.
+// If no container id found, an empty resource will be returned.
+func (cgroupContainerIDDetector) Detect(ctx context.Context) (*Resource, error) {
+	containerID, err := containerID()
+	if err != nil {
+		return nil, err
+	}
+
+	if containerID == "" {
+		return Empty(), nil
+	}
+	return NewWithAttributes(semconv.SchemaURL, semconv.ContainerID(containerID)), nil
+}
+
+var (
+	defaultOSStat = os.Stat
+	osStat        = defaultOSStat
+
+	defaultOSOpen = func(name string) (io.ReadCloser, error) {
+		return os.Open(name)
+	}
+	osOpen = defaultOSOpen
+)
+
+// getContainerIDFromCGroup returns the id of the container from the cgroup file.
+// If no container id found, an empty string will be returned.
+func getContainerIDFromCGroup() (string, error) {
+	if _, err := osStat(cgroupPath); errors.Is(err, os.ErrNotExist) {
+		// File does not exist, skip
+		return "", nil
+	}
+
+	file, err := osOpen(cgroupPath)
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+
+	return getContainerIDFromReader(file), nil
+}
+
+// getContainerIDFromReader returns the id of the container from reader.
+func getContainerIDFromReader(reader io.Reader) string {
+	scanner := bufio.NewScanner(reader)
+	for scanner.Scan() {
+		line := scanner.Text()
+
+		if id := getContainerIDFromLine(line); id != "" {
+			return id
+		}
+	}
+	return ""
+}
+
+// getContainerIDFromLine returns the id of the container from one string line.
+func getContainerIDFromLine(line string) string {
+	matches := cgroupContainerIDRe.FindStringSubmatch(line)
+	if len(matches) <= 1 {
+		return ""
+	}
+	return matches[1]
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/doc.go b/vendor/go.opentelemetry.io/otel/sdk/resource/doc.go
new file mode 100644
index 0000000000..9aab3d8393
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/doc.go
@@ -0,0 +1,28 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package resource provides detecting and representing resources.
+//
+// The fundamental struct is a Resource which holds identifying information
+// about the entities for which telemetry is exported.
+//
+// To automatically construct Resources from an environment a Detector
+// interface is defined. Implementations of this interface can be passed to
+// the Detect function to generate a Resource from the merged information.
+//
+// To load a user defined Resource from the environment variable
+// OTEL_RESOURCE_ATTRIBUTES the FromEnv Detector can be used. It will interpret
+// the value as a list of comma delimited key/value pairs
+// (e.g. `<key1>=<value1>,<key2>=<value2>,...`).
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/env.go b/vendor/go.opentelemetry.io/otel/sdk/resource/env.go
new file mode 100644
index 0000000000..e32843cad1
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/env.go
@@ -0,0 +1,108 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
+)
+
+const (
+	// resourceAttrKey is the environment variable name OpenTelemetry Resource information will be read from.
+	resourceAttrKey = "OTEL_RESOURCE_ATTRIBUTES"
+
+	// svcNameKey is the environment variable name that Service Name information will be read from.
+	svcNameKey = "OTEL_SERVICE_NAME"
+)
+
+var (
+	// errMissingValue is returned when a resource value is missing.
+	errMissingValue = fmt.Errorf("%w: missing value", ErrPartialResource)
+)
+
+// fromEnv is a Detector that implements the Detector and collects
+// resources from environment.  This Detector is included as a
+// builtin.
+type fromEnv struct{}
+
+// compile time assertion that FromEnv implements Detector interface.
+var _ Detector = fromEnv{}
+
+// Detect collects resources from environment.
+func (fromEnv) Detect(context.Context) (*Resource, error) {
+	attrs := strings.TrimSpace(os.Getenv(resourceAttrKey))
+	svcName := strings.TrimSpace(os.Getenv(svcNameKey))
+
+	if attrs == "" && svcName == "" {
+		return Empty(), nil
+	}
+
+	var res *Resource
+
+	if svcName != "" {
+		res = NewSchemaless(semconv.ServiceName(svcName))
+	}
+
+	r2, err := constructOTResources(attrs)
+
+	// Ensure that the resource with the service name from OTEL_SERVICE_NAME
+	// takes precedence, if it was defined.
+	res, err2 := Merge(r2, res)
+
+	if err == nil {
+		err = err2
+	} else if err2 != nil {
+		err = fmt.Errorf("detecting resources: %s", []string{err.Error(), err2.Error()})
+	}
+
+	return res, err
+}
+
+func constructOTResources(s string) (*Resource, error) {
+	if s == "" {
+		return Empty(), nil
+	}
+	pairs := strings.Split(s, ",")
+	attrs := []attribute.KeyValue{}
+	var invalid []string
+	for _, p := range pairs {
+		field := strings.SplitN(p, "=", 2)
+		if len(field) != 2 {
+			invalid = append(invalid, p)
+			continue
+		}
+		k := strings.TrimSpace(field[0])
+		v, err := url.QueryUnescape(strings.TrimSpace(field[1]))
+		if err != nil {
+			// Retain original value if decoding fails, otherwise it will be
+			// an empty string.
+			v = field[1]
+			otel.Handle(err)
+		}
+		attrs = append(attrs, attribute.String(k, v))
+	}
+	var err error
+	if len(invalid) > 0 {
+		err = fmt.Errorf("%w: %v", errMissingValue, invalid)
+	}
+	return NewSchemaless(attrs...), err
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/os.go b/vendor/go.opentelemetry.io/otel/sdk/resource/os.go
new file mode 100644
index 0000000000..815fe5c204
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/os.go
@@ -0,0 +1,97 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+	"strings"
+
+	"go.opentelemetry.io/otel/attribute"
+	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
+)
+
+type osDescriptionProvider func() (string, error)
+
+var defaultOSDescriptionProvider osDescriptionProvider = platformOSDescription
+
+var osDescription = defaultOSDescriptionProvider
+
+func setDefaultOSDescriptionProvider() {
+	setOSDescriptionProvider(defaultOSDescriptionProvider)
+}
+
+func setOSDescriptionProvider(osDescriptionProvider osDescriptionProvider) {
+	osDescription = osDescriptionProvider
+}
+
+type osTypeDetector struct{}
+type osDescriptionDetector struct{}
+
+// Detect returns a *Resource that describes the operating system type the
+// service is running on.
+func (osTypeDetector) Detect(ctx context.Context) (*Resource, error) {
+	osType := runtimeOS()
+
+	osTypeAttribute := mapRuntimeOSToSemconvOSType(osType)
+
+	return NewWithAttributes(
+		semconv.SchemaURL,
+		osTypeAttribute,
+	), nil
+}
+
+// Detect returns a *Resource that describes the operating system the
+// service is running on.
+func (osDescriptionDetector) Detect(ctx context.Context) (*Resource, error) {
+	description, err := osDescription()
+
+	if err != nil {
+		return nil, err
+	}
+
+	return NewWithAttributes(
+		semconv.SchemaURL,
+		semconv.OSDescription(description),
+	), nil
+}
+
+// mapRuntimeOSToSemconvOSType translates the OS name as provided by the Go runtime
+// into an OS type attribute with the corresponding value defined by the semantic
+// conventions. In case the provided OS name isn't mapped, it's transformed to lowercase
+// and used as the value for the returned OS type attribute.
+func mapRuntimeOSToSemconvOSType(osType string) attribute.KeyValue {
+	// the elements in this map are the intersection between
+	// available GOOS values and defined semconv OS types
+	osTypeAttributeMap := map[string]attribute.KeyValue{
+		"darwin":    semconv.OSTypeDarwin,
+		"dragonfly": semconv.OSTypeDragonflyBSD,
+		"freebsd":   semconv.OSTypeFreeBSD,
+		"linux":     semconv.OSTypeLinux,
+		"netbsd":    semconv.OSTypeNetBSD,
+		"openbsd":   semconv.OSTypeOpenBSD,
+		"solaris":   semconv.OSTypeSolaris,
+		"windows":   semconv.OSTypeWindows,
+	}
+
+	var osTypeAttribute attribute.KeyValue
+
+	if attr, ok := osTypeAttributeMap[osType]; ok {
+		osTypeAttribute = attr
+	} else {
+		osTypeAttribute = semconv.OSTypeKey.String(strings.ToLower(osType))
+	}
+
+	return osTypeAttribute
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.go b/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.go
new file mode 100644
index 0000000000..24ec85793d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_darwin.go
@@ -0,0 +1,102 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"encoding/xml"
+	"fmt"
+	"io"
+	"os"
+)
+
+type plist struct {
+	XMLName xml.Name `xml:"plist"`
+	Dict    dict     `xml:"dict"`
+}
+
+type dict struct {
+	Key    []string `xml:"key"`
+	String []string `xml:"string"`
+}
+
+// osRelease builds a string describing the operating system release based on the
+// contents of the property list (.plist) system files. If no .plist files are found,
+// or if the required properties to build the release description string are missing,
+// an empty string is returned instead. The generated string resembles the output of
+// the `sw_vers` commandline program, but in a single-line string. For more information
+// about the `sw_vers` program, see: https://www.unix.com/man-page/osx/1/SW_VERS.
+func osRelease() string {
+	file, err := getPlistFile()
+	if err != nil {
+		return ""
+	}
+
+	defer file.Close()
+
+	values, err := parsePlistFile(file)
+	if err != nil {
+		return ""
+	}
+
+	return buildOSRelease(values)
+}
+
+// getPlistFile returns a *os.File pointing to one of the well-known .plist files
+// available on macOS. If no file can be opened, it returns an error.
+func getPlistFile() (*os.File, error) {
+	return getFirstAvailableFile([]string{
+		"/System/Library/CoreServices/SystemVersion.plist",
+		"/System/Library/CoreServices/ServerVersion.plist",
+	})
+}
+
+// parsePlistFile process the file pointed by `file` as a .plist file and returns
+// a map with the key-values for each pair of correlated <key> and <string> elements
+// contained in it.
+func parsePlistFile(file io.Reader) (map[string]string, error) {
+	var v plist
+
+	err := xml.NewDecoder(file).Decode(&v)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(v.Dict.Key) != len(v.Dict.String) {
+		return nil, fmt.Errorf("the number of <key> and <string> elements doesn't match")
+	}
+
+	properties := make(map[string]string, len(v.Dict.Key))
+	for i, key := range v.Dict.Key {
+		properties[key] = v.Dict.String[i]
+	}
+
+	return properties, nil
+}
+
+// buildOSRelease builds a string describing the OS release based on the properties
+// available on the provided map. It tries to find the `ProductName`, `ProductVersion`
+// and `ProductBuildVersion` properties. If some of these properties are not found,
+// it returns an empty string.
+func buildOSRelease(properties map[string]string) string {
+	productName := properties["ProductName"]
+	productVersion := properties["ProductVersion"]
+	productBuildVersion := properties["ProductBuildVersion"]
+
+	if productName == "" || productVersion == "" || productBuildVersion == "" {
+		return ""
+	}
+
+	return fmt.Sprintf("%s %s (%s)", productName, productVersion, productBuildVersion)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.go b/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.go
new file mode 100644
index 0000000000..fba6790e44
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/os_release_unix.go
@@ -0,0 +1,154 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build aix || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build aix dragonfly freebsd linux netbsd openbsd solaris zos
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+// osRelease builds a string describing the operating system release based on the
+// properties of the os-release file. If no os-release file is found, or if the
+// required properties to build the release description string are missing, an empty
+// string is returned instead. For more information about os-release files, see:
+// https://www.freedesktop.org/software/systemd/man/os-release.html
+func osRelease() string {
+	file, err := getOSReleaseFile()
+	if err != nil {
+		return ""
+	}
+
+	defer file.Close()
+
+	values := parseOSReleaseFile(file)
+
+	return buildOSRelease(values)
+}
+
+// getOSReleaseFile returns a *os.File pointing to one of the well-known os-release
+// files, according to their order of preference. If no file can be opened, it
+// returns an error.
+func getOSReleaseFile() (*os.File, error) {
+	return getFirstAvailableFile([]string{"/etc/os-release", "/usr/lib/os-release"})
+}
+
+// parseOSReleaseFile process the file pointed by `file` as an os-release file and
+// returns a map with the key-values contained in it. Empty lines or lines starting
+// with a '#' character are ignored, as well as lines with the missing key=value
+// separator. Values are unquoted and unescaped.
+func parseOSReleaseFile(file io.Reader) map[string]string {
+	values := make(map[string]string)
+	scanner := bufio.NewScanner(file)
+
+	for scanner.Scan() {
+		line := scanner.Text()
+
+		if skip(line) {
+			continue
+		}
+
+		key, value, ok := parse(line)
+		if ok {
+			values[key] = value
+		}
+	}
+
+	return values
+}
+
+// skip returns true if the line is blank or starts with a '#' character, and
+// therefore should be skipped from processing.
+func skip(line string) bool {
+	line = strings.TrimSpace(line)
+
+	return len(line) == 0 || strings.HasPrefix(line, "#")
+}
+
+// parse attempts to split the provided line on the first '=' character, and then
+// sanitize each side of the split before returning them as a key-value pair.
+func parse(line string) (string, string, bool) {
+	parts := strings.SplitN(line, "=", 2)
+
+	if len(parts) != 2 || len(parts[0]) == 0 {
+		return "", "", false
+	}
+
+	key := strings.TrimSpace(parts[0])
+	value := unescape(unquote(strings.TrimSpace(parts[1])))
+
+	return key, value, true
+}
+
+// unquote checks whether the string `s` is quoted with double or single quotes
+// and, if so, returns a version of the string without them. Otherwise it returns
+// the provided string unchanged.
+func unquote(s string) string {
+	if len(s) < 2 {
+		return s
+	}
+
+	if (s[0] == '"' || s[0] == '\'') && s[0] == s[len(s)-1] {
+		return s[1 : len(s)-1]
+	}
+
+	return s
+}
+
+// unescape removes the `\` prefix from some characters that are expected
+// to have it added in front of them for escaping purposes.
+func unescape(s string) string {
+	return strings.NewReplacer(
+		`\$`, `$`,
+		`\"`, `"`,
+		`\'`, `'`,
+		`\\`, `\`,
+		"\\`", "`",
+	).Replace(s)
+}
+
+// buildOSRelease builds a string describing the OS release based on the properties
+// available on the provided map. It favors a combination of the `NAME` and `VERSION`
+// properties as first option (falling back to `VERSION_ID` if `VERSION` isn't
+// found), and using `PRETTY_NAME` alone if some of the previous are not present. If
+// none of these properties are found, it returns an empty string.
+//
+// The rationale behind not using `PRETTY_NAME` as first choice was that, for some
+// Linux distributions, it doesn't include the same detail that can be found on the
+// individual `NAME` and `VERSION` properties, and combining `PRETTY_NAME` with
+// other properties can produce "pretty" redundant strings in some cases.
+func buildOSRelease(values map[string]string) string {
+	var osRelease string
+
+	name := values["NAME"]
+	version := values["VERSION"]
+
+	if version == "" {
+		version = values["VERSION_ID"]
+	}
+
+	if name != "" && version != "" {
+		osRelease = fmt.Sprintf("%s %s", name, version)
+	} else {
+		osRelease = values["PRETTY_NAME"]
+	}
+
+	return osRelease
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.go b/vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.go
new file mode 100644
index 0000000000..1c84afc185
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/os_unix.go
@@ -0,0 +1,90 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris zos
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+type unameProvider func(buf *unix.Utsname) (err error)
+
+var defaultUnameProvider unameProvider = unix.Uname
+
+var currentUnameProvider = defaultUnameProvider
+
+func setDefaultUnameProvider() {
+	setUnameProvider(defaultUnameProvider)
+}
+
+func setUnameProvider(unameProvider unameProvider) {
+	currentUnameProvider = unameProvider
+}
+
+// platformOSDescription returns a human readable OS version information string.
+// The final string combines OS release information (where available) and the
+// result of the `uname` system call.
+func platformOSDescription() (string, error) {
+	uname, err := uname()
+	if err != nil {
+		return "", err
+	}
+
+	osRelease := osRelease()
+	if osRelease != "" {
+		return fmt.Sprintf("%s (%s)", osRelease, uname), nil
+	}
+
+	return uname, nil
+}
+
+// uname issues a uname(2) system call (or equivalent on systems which doesn't
+// have one) and formats the output in a single string, similar to the output
+// of the `uname` commandline program. The final string resembles the one
+// obtained with a call to `uname -snrvm`.
+func uname() (string, error) {
+	var utsName unix.Utsname
+
+	err := currentUnameProvider(&utsName)
+	if err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("%s %s %s %s %s",
+		unix.ByteSliceToString(utsName.Sysname[:]),
+		unix.ByteSliceToString(utsName.Nodename[:]),
+		unix.ByteSliceToString(utsName.Release[:]),
+		unix.ByteSliceToString(utsName.Version[:]),
+		unix.ByteSliceToString(utsName.Machine[:]),
+	), nil
+}
+
+// getFirstAvailableFile returns an *os.File of the first available
+// file from a list of candidate file paths.
+func getFirstAvailableFile(candidates []string) (*os.File, error) {
+	for _, c := range candidates {
+		file, err := os.Open(c)
+		if err == nil {
+			return file, nil
+		}
+	}
+
+	return nil, fmt.Errorf("no candidate file available: %v", candidates)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.go b/vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.go
new file mode 100644
index 0000000000..3ebcb534f2
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/os_unsupported.go
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +build !aix
+// +build !darwin
+// +build !dragonfly
+// +build !freebsd
+// +build !linux
+// +build !netbsd
+// +build !openbsd
+// +build !solaris
+// +build !windows
+// +build !zos
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+// platformOSDescription is a placeholder implementation for OSes
+// for which this project currently doesn't support os.description
+// attribute detection. See build tags declaration early on this file
+// for a list of unsupported OSes.
+func platformOSDescription() (string, error) {
+	return "<unknown>", nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/os_windows.go b/vendor/go.opentelemetry.io/otel/sdk/resource/os_windows.go
new file mode 100644
index 0000000000..faad64d8da
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/os_windows.go
@@ -0,0 +1,101 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"fmt"
+	"strconv"
+
+	"golang.org/x/sys/windows/registry"
+)
+
+// platformOSDescription returns a human readable OS version information string.
+// It does so by querying registry values under the
+// `SOFTWARE\Microsoft\Windows NT\CurrentVersion` key. The final string
+// resembles the one displayed by the Version Reporter Applet (winver.exe).
+func platformOSDescription() (string, error) {
+	k, err := registry.OpenKey(
+		registry.LOCAL_MACHINE, `SOFTWARE\Microsoft\Windows NT\CurrentVersion`, registry.QUERY_VALUE)
+
+	if err != nil {
+		return "", err
+	}
+
+	defer k.Close()
+
+	var (
+		productName               = readProductName(k)
+		displayVersion            = readDisplayVersion(k)
+		releaseID                 = readReleaseID(k)
+		currentMajorVersionNumber = readCurrentMajorVersionNumber(k)
+		currentMinorVersionNumber = readCurrentMinorVersionNumber(k)
+		currentBuildNumber        = readCurrentBuildNumber(k)
+		ubr                       = readUBR(k)
+	)
+
+	if displayVersion != "" {
+		displayVersion += " "
+	}
+
+	return fmt.Sprintf("%s %s(%s) [Version %s.%s.%s.%s]",
+		productName,
+		displayVersion,
+		releaseID,
+		currentMajorVersionNumber,
+		currentMinorVersionNumber,
+		currentBuildNumber,
+		ubr,
+	), nil
+}
+
+func getStringValue(name string, k registry.Key) string {
+	value, _, _ := k.GetStringValue(name)
+
+	return value
+}
+
+func getIntegerValue(name string, k registry.Key) uint64 {
+	value, _, _ := k.GetIntegerValue(name)
+
+	return value
+}
+
+func readProductName(k registry.Key) string {
+	return getStringValue("ProductName", k)
+}
+
+func readDisplayVersion(k registry.Key) string {
+	return getStringValue("DisplayVersion", k)
+}
+
+func readReleaseID(k registry.Key) string {
+	return getStringValue("ReleaseID", k)
+}
+
+func readCurrentMajorVersionNumber(k registry.Key) string {
+	return strconv.FormatUint(getIntegerValue("CurrentMajorVersionNumber", k), 10)
+}
+
+func readCurrentMinorVersionNumber(k registry.Key) string {
+	return strconv.FormatUint(getIntegerValue("CurrentMinorVersionNumber", k), 10)
+}
+
+func readCurrentBuildNumber(k registry.Key) string {
+	return getStringValue("CurrentBuildNumber", k)
+}
+
+func readUBR(k registry.Key) string {
+	return strconv.FormatUint(getIntegerValue("UBR", k), 10)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/process.go b/vendor/go.opentelemetry.io/otel/sdk/resource/process.go
new file mode 100644
index 0000000000..bdd0e7fe68
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/process.go
@@ -0,0 +1,180 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/user"
+	"path/filepath"
+	"runtime"
+
+	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
+)
+
+type pidProvider func() int
+type executablePathProvider func() (string, error)
+type commandArgsProvider func() []string
+type ownerProvider func() (*user.User, error)
+type runtimeNameProvider func() string
+type runtimeVersionProvider func() string
+type runtimeOSProvider func() string
+type runtimeArchProvider func() string
+
+var (
+	defaultPidProvider            pidProvider            = os.Getpid
+	defaultExecutablePathProvider executablePathProvider = os.Executable
+	defaultCommandArgsProvider    commandArgsProvider    = func() []string { return os.Args }
+	defaultOwnerProvider          ownerProvider          = user.Current
+	defaultRuntimeNameProvider    runtimeNameProvider    = func() string {
+		if runtime.Compiler == "gc" {
+			return "go"
+		}
+		return runtime.Compiler
+	}
+	defaultRuntimeVersionProvider runtimeVersionProvider = runtime.Version
+	defaultRuntimeOSProvider      runtimeOSProvider      = func() string { return runtime.GOOS }
+	defaultRuntimeArchProvider    runtimeArchProvider    = func() string { return runtime.GOARCH }
+)
+
+var (
+	pid            = defaultPidProvider
+	executablePath = defaultExecutablePathProvider
+	commandArgs    = defaultCommandArgsProvider
+	owner          = defaultOwnerProvider
+	runtimeName    = defaultRuntimeNameProvider
+	runtimeVersion = defaultRuntimeVersionProvider
+	runtimeOS      = defaultRuntimeOSProvider
+	runtimeArch    = defaultRuntimeArchProvider
+)
+
+func setDefaultOSProviders() {
+	setOSProviders(
+		defaultPidProvider,
+		defaultExecutablePathProvider,
+		defaultCommandArgsProvider,
+	)
+}
+
+func setOSProviders(
+	pidProvider pidProvider,
+	executablePathProvider executablePathProvider,
+	commandArgsProvider commandArgsProvider,
+) {
+	pid = pidProvider
+	executablePath = executablePathProvider
+	commandArgs = commandArgsProvider
+}
+
+func setDefaultRuntimeProviders() {
+	setRuntimeProviders(
+		defaultRuntimeNameProvider,
+		defaultRuntimeVersionProvider,
+		defaultRuntimeOSProvider,
+		defaultRuntimeArchProvider,
+	)
+}
+
+func setRuntimeProviders(
+	runtimeNameProvider runtimeNameProvider,
+	runtimeVersionProvider runtimeVersionProvider,
+	runtimeOSProvider runtimeOSProvider,
+	runtimeArchProvider runtimeArchProvider,
+) {
+	runtimeName = runtimeNameProvider
+	runtimeVersion = runtimeVersionProvider
+	runtimeOS = runtimeOSProvider
+	runtimeArch = runtimeArchProvider
+}
+
+func setDefaultUserProviders() {
+	setUserProviders(defaultOwnerProvider)
+}
+
+func setUserProviders(ownerProvider ownerProvider) {
+	owner = ownerProvider
+}
+
+type processPIDDetector struct{}
+type processExecutableNameDetector struct{}
+type processExecutablePathDetector struct{}
+type processCommandArgsDetector struct{}
+type processOwnerDetector struct{}
+type processRuntimeNameDetector struct{}
+type processRuntimeVersionDetector struct{}
+type processRuntimeDescriptionDetector struct{}
+
+// Detect returns a *Resource that describes the process identifier (PID) of the
+// executing process.
+func (processPIDDetector) Detect(ctx context.Context) (*Resource, error) {
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessPID(pid())), nil
+}
+
+// Detect returns a *Resource that describes the name of the process executable.
+func (processExecutableNameDetector) Detect(ctx context.Context) (*Resource, error) {
+	executableName := filepath.Base(commandArgs()[0])
+
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessExecutableName(executableName)), nil
+}
+
+// Detect returns a *Resource that describes the full path of the process executable.
+func (processExecutablePathDetector) Detect(ctx context.Context) (*Resource, error) {
+	executablePath, err := executablePath()
+	if err != nil {
+		return nil, err
+	}
+
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessExecutablePath(executablePath)), nil
+}
+
+// Detect returns a *Resource that describes all the command arguments as received
+// by the process.
+func (processCommandArgsDetector) Detect(ctx context.Context) (*Resource, error) {
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessCommandArgs(commandArgs()...)), nil
+}
+
+// Detect returns a *Resource that describes the username of the user that owns the
+// process.
+func (processOwnerDetector) Detect(ctx context.Context) (*Resource, error) {
+	owner, err := owner()
+	if err != nil {
+		return nil, err
+	}
+
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessOwner(owner.Username)), nil
+}
+
+// Detect returns a *Resource that describes the name of the compiler used to compile
+// this process image.
+func (processRuntimeNameDetector) Detect(ctx context.Context) (*Resource, error) {
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessRuntimeName(runtimeName())), nil
+}
+
+// Detect returns a *Resource that describes the version of the runtime of this process.
+func (processRuntimeVersionDetector) Detect(ctx context.Context) (*Resource, error) {
+	return NewWithAttributes(semconv.SchemaURL, semconv.ProcessRuntimeVersion(runtimeVersion())), nil
+}
+
+// Detect returns a *Resource that describes the runtime of this process.
+func (processRuntimeDescriptionDetector) Detect(ctx context.Context) (*Resource, error) {
+	runtimeDescription := fmt.Sprintf(
+		"go version %s %s/%s", runtimeVersion(), runtimeOS(), runtimeArch())
+
+	return NewWithAttributes(
+		semconv.SchemaURL,
+		semconv.ProcessRuntimeDescription(runtimeDescription),
+	), nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/resource/resource.go b/vendor/go.opentelemetry.io/otel/sdk/resource/resource.go
new file mode 100644
index 0000000000..c425ff05db
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/resource/resource.go
@@ -0,0 +1,282 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource // import "go.opentelemetry.io/otel/sdk/resource"
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// Resource describes an entity about which identifying information
+// and metadata is exposed.  Resource is an immutable object,
+// equivalent to a map from key to unique value.
+//
+// Resources should be passed and stored as pointers
+// (`*resource.Resource`).  The `nil` value is equivalent to an empty
+// Resource.
+type Resource struct {
+	attrs     attribute.Set
+	schemaURL string
+}
+
+var (
+	emptyResource       Resource
+	defaultResource     *Resource
+	defaultResourceOnce sync.Once
+)
+
+var errMergeConflictSchemaURL = errors.New("cannot merge resource due to conflicting Schema URL")
+
+// New returns a Resource combined from the user-provided detectors.
+func New(ctx context.Context, opts ...Option) (*Resource, error) {
+	cfg := config{}
+	for _, opt := range opts {
+		cfg = opt.apply(cfg)
+	}
+
+	resource, err := Detect(ctx, cfg.detectors...)
+
+	var err2 error
+	resource, err2 = Merge(resource, &Resource{schemaURL: cfg.schemaURL})
+	if err == nil {
+		err = err2
+	} else if err2 != nil {
+		err = fmt.Errorf("detecting resources: %s", []string{err.Error(), err2.Error()})
+	}
+
+	return resource, err
+}
+
+// NewWithAttributes creates a resource from attrs and associates the resource with a
+// schema URL. If attrs contains duplicate keys, the last value will be used. If attrs
+// contains any invalid items those items will be dropped. The attrs are assumed to be
+// in a schema identified by schemaURL.
+func NewWithAttributes(schemaURL string, attrs ...attribute.KeyValue) *Resource {
+	resource := NewSchemaless(attrs...)
+	resource.schemaURL = schemaURL
+	return resource
+}
+
+// NewSchemaless creates a resource from attrs. If attrs contains duplicate keys,
+// the last value will be used. If attrs contains any invalid items those items will
+// be dropped. The resource will not be associated with a schema URL. If the schema
+// of the attrs is known use NewWithAttributes instead.
+func NewSchemaless(attrs ...attribute.KeyValue) *Resource {
+	if len(attrs) == 0 {
+		return &emptyResource
+	}
+
+	// Ensure attributes comply with the specification:
+	// https://github.com/open-telemetry/opentelemetry-specification/blob/v1.0.1/specification/common/common.md#attributes
+	s, _ := attribute.NewSetWithFiltered(attrs, func(kv attribute.KeyValue) bool {
+		return kv.Valid()
+	})
+
+	// If attrs only contains invalid entries do not allocate a new resource.
+	if s.Len() == 0 {
+		return &emptyResource
+	}
+
+	return &Resource{attrs: s} //nolint
+}
+
+// String implements the Stringer interface and provides a
+// human-readable form of the resource.
+//
+// Avoid using this representation as the key in a map of resources,
+// use Equivalent() as the key instead.
+func (r *Resource) String() string {
+	if r == nil {
+		return ""
+	}
+	return r.attrs.Encoded(attribute.DefaultEncoder())
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this exporter.
+func (r *Resource) MarshalLog() interface{} {
+	return struct {
+		Attributes attribute.Set
+		SchemaURL  string
+	}{
+		Attributes: r.attrs,
+		SchemaURL:  r.schemaURL,
+	}
+}
+
+// Attributes returns a copy of attributes from the resource in a sorted order.
+// To avoid allocating a new slice, use an iterator.
+func (r *Resource) Attributes() []attribute.KeyValue {
+	if r == nil {
+		r = Empty()
+	}
+	return r.attrs.ToSlice()
+}
+
+// SchemaURL returns the schema URL associated with Resource r.
+func (r *Resource) SchemaURL() string {
+	if r == nil {
+		return ""
+	}
+	return r.schemaURL
+}
+
+// Iter returns an iterator of the Resource attributes.
+// This is ideal to use if you do not want a copy of the attributes.
+func (r *Resource) Iter() attribute.Iterator {
+	if r == nil {
+		r = Empty()
+	}
+	return r.attrs.Iter()
+}
+
+// Equal returns true when a Resource is equivalent to this Resource.
+func (r *Resource) Equal(eq *Resource) bool {
+	if r == nil {
+		r = Empty()
+	}
+	if eq == nil {
+		eq = Empty()
+	}
+	return r.Equivalent() == eq.Equivalent()
+}
+
+// Merge creates a new resource by combining resource a and b.
+//
+// If there are common keys between resource a and b, then the value
+// from resource b will overwrite the value from resource a, even
+// if resource b's value is empty.
+//
+// The SchemaURL of the resources will be merged according to the spec rules:
+// https://github.com/open-telemetry/opentelemetry-specification/blob/bad49c714a62da5493f2d1d9bafd7ebe8c8ce7eb/specification/resource/sdk.md#merge
+// If the resources have different non-empty schemaURL an empty resource and an error
+// will be returned.
+func Merge(a, b *Resource) (*Resource, error) {
+	if a == nil && b == nil {
+		return Empty(), nil
+	}
+	if a == nil {
+		return b, nil
+	}
+	if b == nil {
+		return a, nil
+	}
+
+	// Merge the schema URL.
+	var schemaURL string
+	switch true {
+	case a.schemaURL == "":
+		schemaURL = b.schemaURL
+	case b.schemaURL == "":
+		schemaURL = a.schemaURL
+	case a.schemaURL == b.schemaURL:
+		schemaURL = a.schemaURL
+	default:
+		return Empty(), errMergeConflictSchemaURL
+	}
+
+	// Note: 'b' attributes will overwrite 'a' with last-value-wins in attribute.Key()
+	// Meaning this is equivalent to: append(a.Attributes(), b.Attributes()...)
+	mi := attribute.NewMergeIterator(b.Set(), a.Set())
+	combine := make([]attribute.KeyValue, 0, a.Len()+b.Len())
+	for mi.Next() {
+		combine = append(combine, mi.Attribute())
+	}
+	merged := NewWithAttributes(schemaURL, combine...)
+	return merged, nil
+}
+
+// Empty returns an instance of Resource with no attributes. It is
+// equivalent to a `nil` Resource.
+func Empty() *Resource {
+	return &emptyResource
+}
+
+// Default returns an instance of Resource with a default
+// "service.name" and OpenTelemetrySDK attributes.
+func Default() *Resource {
+	defaultResourceOnce.Do(func() {
+		var err error
+		defaultResource, err = Detect(
+			context.Background(),
+			defaultServiceNameDetector{},
+			fromEnv{},
+			telemetrySDK{},
+		)
+		if err != nil {
+			otel.Handle(err)
+		}
+		// If Detect did not return a valid resource, fall back to emptyResource.
+		if defaultResource == nil {
+			defaultResource = &emptyResource
+		}
+	})
+	return defaultResource
+}
+
+// Environment returns an instance of Resource with attributes
+// extracted from the OTEL_RESOURCE_ATTRIBUTES environment variable.
+func Environment() *Resource {
+	detector := &fromEnv{}
+	resource, err := detector.Detect(context.Background())
+	if err != nil {
+		otel.Handle(err)
+	}
+	return resource
+}
+
+// Equivalent returns an object that can be compared for equality
+// between two resources. This value is suitable for use as a key in
+// a map.
+func (r *Resource) Equivalent() attribute.Distinct {
+	return r.Set().Equivalent()
+}
+
+// Set returns the equivalent *attribute.Set of this resource's attributes.
+func (r *Resource) Set() *attribute.Set {
+	if r == nil {
+		r = Empty()
+	}
+	return &r.attrs
+}
+
+// MarshalJSON encodes the resource attributes as a JSON list of { "Key":
+// "...", "Value": ... } pairs in order sorted by key.
+func (r *Resource) MarshalJSON() ([]byte, error) {
+	if r == nil {
+		r = Empty()
+	}
+	return r.attrs.MarshalJSON()
+}
+
+// Len returns the number of unique key-values in this Resource.
+func (r *Resource) Len() int {
+	if r == nil {
+		return 0
+	}
+	return r.attrs.Len()
+}
+
+// Encoded returns an encoded representation of the resource.
+func (r *Resource) Encoded(enc attribute.Encoder) string {
+	if r == nil {
+		return ""
+	}
+	return r.attrs.Encoded(enc)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go b/vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go
new file mode 100644
index 0000000000..a2d7db4900
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/batch_span_processor.go
@@ -0,0 +1,432 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/internal/global"
+	"go.opentelemetry.io/otel/sdk/internal/env"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Defaults for BatchSpanProcessorOptions.
+const (
+	DefaultMaxQueueSize       = 2048
+	DefaultScheduleDelay      = 5000
+	DefaultExportTimeout      = 30000
+	DefaultMaxExportBatchSize = 512
+)
+
+// BatchSpanProcessorOption configures a BatchSpanProcessor.
+type BatchSpanProcessorOption func(o *BatchSpanProcessorOptions)
+
+// BatchSpanProcessorOptions is configuration settings for a
+// BatchSpanProcessor.
+type BatchSpanProcessorOptions struct {
+	// MaxQueueSize is the maximum queue size to buffer spans for delayed processing. If the
+	// queue gets full it drops the spans. Use BlockOnQueueFull to change this behavior.
+	// The default value of MaxQueueSize is 2048.
+	MaxQueueSize int
+
+	// BatchTimeout is the maximum duration for constructing a batch. Processor
+	// forcefully sends available spans when timeout is reached.
+	// The default value of BatchTimeout is 5000 msec.
+	BatchTimeout time.Duration
+
+	// ExportTimeout specifies the maximum duration for exporting spans. If the timeout
+	// is reached, the export will be cancelled.
+	// The default value of ExportTimeout is 30000 msec.
+	ExportTimeout time.Duration
+
+	// MaxExportBatchSize is the maximum number of spans to process in a single batch.
+	// If there are more than one batch worth of spans then it processes multiple batches
+	// of spans one batch after the other without any delay.
+	// The default value of MaxExportBatchSize is 512.
+	MaxExportBatchSize int
+
+	// BlockOnQueueFull blocks onEnd() and onStart() method if the queue is full
+	// AND if BlockOnQueueFull is set to true.
+	// Blocking option should be used carefully as it can severely affect the performance of an
+	// application.
+	BlockOnQueueFull bool
+}
+
+// batchSpanProcessor is a SpanProcessor that batches asynchronously-received
+// spans and sends them to a trace.Exporter when complete.
+type batchSpanProcessor struct {
+	e SpanExporter
+	o BatchSpanProcessorOptions
+
+	queue   chan ReadOnlySpan
+	dropped uint32
+
+	batch      []ReadOnlySpan
+	batchMutex sync.Mutex
+	timer      *time.Timer
+	stopWait   sync.WaitGroup
+	stopOnce   sync.Once
+	stopCh     chan struct{}
+}
+
+var _ SpanProcessor = (*batchSpanProcessor)(nil)
+
+// NewBatchSpanProcessor creates a new SpanProcessor that will send completed
+// span batches to the exporter with the supplied options.
+//
+// If the exporter is nil, the span processor will preform no action.
+func NewBatchSpanProcessor(exporter SpanExporter, options ...BatchSpanProcessorOption) SpanProcessor {
+	maxQueueSize := env.BatchSpanProcessorMaxQueueSize(DefaultMaxQueueSize)
+	maxExportBatchSize := env.BatchSpanProcessorMaxExportBatchSize(DefaultMaxExportBatchSize)
+
+	if maxExportBatchSize > maxQueueSize {
+		if DefaultMaxExportBatchSize > maxQueueSize {
+			maxExportBatchSize = maxQueueSize
+		} else {
+			maxExportBatchSize = DefaultMaxExportBatchSize
+		}
+	}
+
+	o := BatchSpanProcessorOptions{
+		BatchTimeout:       time.Duration(env.BatchSpanProcessorScheduleDelay(DefaultScheduleDelay)) * time.Millisecond,
+		ExportTimeout:      time.Duration(env.BatchSpanProcessorExportTimeout(DefaultExportTimeout)) * time.Millisecond,
+		MaxQueueSize:       maxQueueSize,
+		MaxExportBatchSize: maxExportBatchSize,
+	}
+	for _, opt := range options {
+		opt(&o)
+	}
+	bsp := &batchSpanProcessor{
+		e:      exporter,
+		o:      o,
+		batch:  make([]ReadOnlySpan, 0, o.MaxExportBatchSize),
+		timer:  time.NewTimer(o.BatchTimeout),
+		queue:  make(chan ReadOnlySpan, o.MaxQueueSize),
+		stopCh: make(chan struct{}),
+	}
+
+	bsp.stopWait.Add(1)
+	go func() {
+		defer bsp.stopWait.Done()
+		bsp.processQueue()
+		bsp.drainQueue()
+	}()
+
+	return bsp
+}
+
+// OnStart method does nothing.
+func (bsp *batchSpanProcessor) OnStart(parent context.Context, s ReadWriteSpan) {}
+
+// OnEnd method enqueues a ReadOnlySpan for later processing.
+func (bsp *batchSpanProcessor) OnEnd(s ReadOnlySpan) {
+	// Do not enqueue spans if we are just going to drop them.
+	if bsp.e == nil {
+		return
+	}
+	bsp.enqueue(s)
+}
+
+// Shutdown flushes the queue and waits until all spans are processed.
+// It only executes once. Subsequent call does nothing.
+func (bsp *batchSpanProcessor) Shutdown(ctx context.Context) error {
+	var err error
+	bsp.stopOnce.Do(func() {
+		wait := make(chan struct{})
+		go func() {
+			close(bsp.stopCh)
+			bsp.stopWait.Wait()
+			if bsp.e != nil {
+				if err := bsp.e.Shutdown(ctx); err != nil {
+					otel.Handle(err)
+				}
+			}
+			close(wait)
+		}()
+		// Wait until the wait group is done or the context is cancelled
+		select {
+		case <-wait:
+		case <-ctx.Done():
+			err = ctx.Err()
+		}
+	})
+	return err
+}
+
+type forceFlushSpan struct {
+	ReadOnlySpan
+	flushed chan struct{}
+}
+
+func (f forceFlushSpan) SpanContext() trace.SpanContext {
+	return trace.NewSpanContext(trace.SpanContextConfig{TraceFlags: trace.FlagsSampled})
+}
+
+// ForceFlush exports all ended spans that have not yet been exported.
+func (bsp *batchSpanProcessor) ForceFlush(ctx context.Context) error {
+	var err error
+	if bsp.e != nil {
+		flushCh := make(chan struct{})
+		if bsp.enqueueBlockOnQueueFull(ctx, forceFlushSpan{flushed: flushCh}) {
+			select {
+			case <-flushCh:
+				// Processed any items in queue prior to ForceFlush being called
+			case <-ctx.Done():
+				return ctx.Err()
+			}
+		}
+
+		wait := make(chan error)
+		go func() {
+			wait <- bsp.exportSpans(ctx)
+			close(wait)
+		}()
+		// Wait until the export is finished or the context is cancelled/timed out
+		select {
+		case err = <-wait:
+		case <-ctx.Done():
+			err = ctx.Err()
+		}
+	}
+	return err
+}
+
+// WithMaxQueueSize returns a BatchSpanProcessorOption that configures the
+// maximum queue size allowed for a BatchSpanProcessor.
+func WithMaxQueueSize(size int) BatchSpanProcessorOption {
+	return func(o *BatchSpanProcessorOptions) {
+		o.MaxQueueSize = size
+	}
+}
+
+// WithMaxExportBatchSize returns a BatchSpanProcessorOption that configures
+// the maximum export batch size allowed for a BatchSpanProcessor.
+func WithMaxExportBatchSize(size int) BatchSpanProcessorOption {
+	return func(o *BatchSpanProcessorOptions) {
+		o.MaxExportBatchSize = size
+	}
+}
+
+// WithBatchTimeout returns a BatchSpanProcessorOption that configures the
+// maximum delay allowed for a BatchSpanProcessor before it will export any
+// held span (whether the queue is full or not).
+func WithBatchTimeout(delay time.Duration) BatchSpanProcessorOption {
+	return func(o *BatchSpanProcessorOptions) {
+		o.BatchTimeout = delay
+	}
+}
+
+// WithExportTimeout returns a BatchSpanProcessorOption that configures the
+// amount of time a BatchSpanProcessor waits for an exporter to export before
+// abandoning the export.
+func WithExportTimeout(timeout time.Duration) BatchSpanProcessorOption {
+	return func(o *BatchSpanProcessorOptions) {
+		o.ExportTimeout = timeout
+	}
+}
+
+// WithBlocking returns a BatchSpanProcessorOption that configures a
+// BatchSpanProcessor to wait for enqueue operations to succeed instead of
+// dropping data when the queue is full.
+func WithBlocking() BatchSpanProcessorOption {
+	return func(o *BatchSpanProcessorOptions) {
+		o.BlockOnQueueFull = true
+	}
+}
+
+// exportSpans is a subroutine of processing and draining the queue.
+func (bsp *batchSpanProcessor) exportSpans(ctx context.Context) error {
+	bsp.timer.Reset(bsp.o.BatchTimeout)
+
+	bsp.batchMutex.Lock()
+	defer bsp.batchMutex.Unlock()
+
+	if bsp.o.ExportTimeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, bsp.o.ExportTimeout)
+		defer cancel()
+	}
+
+	if l := len(bsp.batch); l > 0 {
+		global.Debug("exporting spans", "count", len(bsp.batch), "total_dropped", atomic.LoadUint32(&bsp.dropped))
+		err := bsp.e.ExportSpans(ctx, bsp.batch)
+
+		// A new batch is always created after exporting, even if the batch failed to be exported.
+		//
+		// It is up to the exporter to implement any type of retry logic if a batch is failing
+		// to be exported, since it is specific to the protocol and backend being sent to.
+		bsp.batch = bsp.batch[:0]
+
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// processQueue removes spans from the `queue` channel until processor
+// is shut down. It calls the exporter in batches of up to MaxExportBatchSize
+// waiting up to BatchTimeout to form a batch.
+func (bsp *batchSpanProcessor) processQueue() {
+	defer bsp.timer.Stop()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	for {
+		select {
+		case <-bsp.stopCh:
+			return
+		case <-bsp.timer.C:
+			if err := bsp.exportSpans(ctx); err != nil {
+				otel.Handle(err)
+			}
+		case sd := <-bsp.queue:
+			if ffs, ok := sd.(forceFlushSpan); ok {
+				close(ffs.flushed)
+				continue
+			}
+			bsp.batchMutex.Lock()
+			bsp.batch = append(bsp.batch, sd)
+			shouldExport := len(bsp.batch) >= bsp.o.MaxExportBatchSize
+			bsp.batchMutex.Unlock()
+			if shouldExport {
+				if !bsp.timer.Stop() {
+					<-bsp.timer.C
+				}
+				if err := bsp.exportSpans(ctx); err != nil {
+					otel.Handle(err)
+				}
+			}
+		}
+	}
+}
+
+// drainQueue awaits the any caller that had added to bsp.stopWait
+// to finish the enqueue, then exports the final batch.
+func (bsp *batchSpanProcessor) drainQueue() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	for {
+		select {
+		case sd := <-bsp.queue:
+			if sd == nil {
+				if err := bsp.exportSpans(ctx); err != nil {
+					otel.Handle(err)
+				}
+				return
+			}
+
+			bsp.batchMutex.Lock()
+			bsp.batch = append(bsp.batch, sd)
+			shouldExport := len(bsp.batch) == bsp.o.MaxExportBatchSize
+			bsp.batchMutex.Unlock()
+
+			if shouldExport {
+				if err := bsp.exportSpans(ctx); err != nil {
+					otel.Handle(err)
+				}
+			}
+		default:
+			close(bsp.queue)
+		}
+	}
+}
+
+func (bsp *batchSpanProcessor) enqueue(sd ReadOnlySpan) {
+	ctx := context.TODO()
+	if bsp.o.BlockOnQueueFull {
+		bsp.enqueueBlockOnQueueFull(ctx, sd)
+	} else {
+		bsp.enqueueDrop(ctx, sd)
+	}
+}
+
+func recoverSendOnClosedChan() {
+	x := recover()
+	switch err := x.(type) {
+	case nil:
+		return
+	case runtime.Error:
+		if err.Error() == "send on closed channel" {
+			return
+		}
+	}
+	panic(x)
+}
+
+func (bsp *batchSpanProcessor) enqueueBlockOnQueueFull(ctx context.Context, sd ReadOnlySpan) bool {
+	if !sd.SpanContext().IsSampled() {
+		return false
+	}
+
+	// This ensures the bsp.queue<- below does not panic as the
+	// processor shuts down.
+	defer recoverSendOnClosedChan()
+
+	select {
+	case <-bsp.stopCh:
+		return false
+	default:
+	}
+
+	select {
+	case bsp.queue <- sd:
+		return true
+	case <-ctx.Done():
+		return false
+	}
+}
+
+func (bsp *batchSpanProcessor) enqueueDrop(ctx context.Context, sd ReadOnlySpan) bool {
+	if !sd.SpanContext().IsSampled() {
+		return false
+	}
+
+	// This ensures the bsp.queue<- below does not panic as the
+	// processor shuts down.
+	defer recoverSendOnClosedChan()
+
+	select {
+	case <-bsp.stopCh:
+		return false
+	default:
+	}
+
+	select {
+	case bsp.queue <- sd:
+		return true
+	default:
+		atomic.AddUint32(&bsp.dropped, 1)
+	}
+	return false
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this exporter.
+func (bsp *batchSpanProcessor) MarshalLog() interface{} {
+	return struct {
+		Type         string
+		SpanExporter SpanExporter
+		Config       BatchSpanProcessorOptions
+	}{
+		Type:         "BatchSpanProcessor",
+		SpanExporter: bsp.e,
+		Config:       bsp.o,
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/doc.go b/vendor/go.opentelemetry.io/otel/sdk/trace/doc.go
new file mode 100644
index 0000000000..0285e99be0
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/doc.go
@@ -0,0 +1,21 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package trace contains support for OpenTelemetry distributed tracing.
+
+The following assumes a basic familiarity with OpenTelemetry concepts.
+See https://opentelemetry.io.
+*/
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/event.go b/vendor/go.opentelemetry.io/otel/sdk/trace/event.go
new file mode 100644
index 0000000000..1e3b426757
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/event.go
@@ -0,0 +1,37 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"time"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// Event is a thing that happened during a Span's lifetime.
+type Event struct {
+	// Name is the name of this event
+	Name string
+
+	// Attributes describe the aspects of the event.
+	Attributes []attribute.KeyValue
+
+	// DroppedAttributeCount is the number of attributes that were not
+	// recorded due to configured limits being reached.
+	DroppedAttributeCount int
+
+	// Time at which this event was recorded.
+	Time time.Time
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/evictedqueue.go b/vendor/go.opentelemetry.io/otel/sdk/trace/evictedqueue.go
new file mode 100644
index 0000000000..d1c86e59b2
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/evictedqueue.go
@@ -0,0 +1,44 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+// evictedQueue is a FIFO queue with a configurable capacity.
+type evictedQueue struct {
+	queue        []interface{}
+	capacity     int
+	droppedCount int
+}
+
+func newEvictedQueue(capacity int) evictedQueue {
+	// Do not pre-allocate queue, do this lazily.
+	return evictedQueue{capacity: capacity}
+}
+
+// add adds value to the evictedQueue eq. If eq is at capacity, the oldest
+// queued value will be discarded and the drop count incremented.
+func (eq *evictedQueue) add(value interface{}) {
+	if eq.capacity == 0 {
+		eq.droppedCount++
+		return
+	}
+
+	if eq.capacity > 0 && len(eq.queue) == eq.capacity {
+		// Drop first-in while avoiding allocating more capacity to eq.queue.
+		copy(eq.queue[:eq.capacity-1], eq.queue[1:])
+		eq.queue = eq.queue[:eq.capacity-1]
+		eq.droppedCount++
+	}
+	eq.queue = append(eq.queue, value)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.go b/vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.go
new file mode 100644
index 0000000000..bba246041a
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/id_generator.go
@@ -0,0 +1,77 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	crand "crypto/rand"
+	"encoding/binary"
+	"math/rand"
+	"sync"
+
+	"go.opentelemetry.io/otel/trace"
+)
+
+// IDGenerator allows custom generators for TraceID and SpanID.
+type IDGenerator interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// NewIDs returns a new trace and span ID.
+	NewIDs(ctx context.Context) (trace.TraceID, trace.SpanID)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// NewSpanID returns a ID for a new span in the trace with traceID.
+	NewSpanID(ctx context.Context, traceID trace.TraceID) trace.SpanID
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+type randomIDGenerator struct {
+	sync.Mutex
+	randSource *rand.Rand
+}
+
+var _ IDGenerator = &randomIDGenerator{}
+
+// NewSpanID returns a non-zero span ID from a randomly-chosen sequence.
+func (gen *randomIDGenerator) NewSpanID(ctx context.Context, traceID trace.TraceID) trace.SpanID {
+	gen.Lock()
+	defer gen.Unlock()
+	sid := trace.SpanID{}
+	_, _ = gen.randSource.Read(sid[:])
+	return sid
+}
+
+// NewIDs returns a non-zero trace ID and a non-zero span ID from a
+// randomly-chosen sequence.
+func (gen *randomIDGenerator) NewIDs(ctx context.Context) (trace.TraceID, trace.SpanID) {
+	gen.Lock()
+	defer gen.Unlock()
+	tid := trace.TraceID{}
+	_, _ = gen.randSource.Read(tid[:])
+	sid := trace.SpanID{}
+	_, _ = gen.randSource.Read(sid[:])
+	return tid, sid
+}
+
+func defaultIDGenerator() IDGenerator {
+	gen := &randomIDGenerator{}
+	var rngSeed int64
+	_ = binary.Read(crand.Reader, binary.LittleEndian, &rngSeed)
+	gen.randSource = rand.New(rand.NewSource(rngSeed))
+	return gen
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/link.go b/vendor/go.opentelemetry.io/otel/sdk/trace/link.go
new file mode 100644
index 0000000000..19cfea4ba4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/link.go
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Link is the relationship between two Spans. The relationship can be within
+// the same Trace or across different Traces.
+type Link struct {
+	// SpanContext of the linked Span.
+	SpanContext trace.SpanContext
+
+	// Attributes describe the aspects of the link.
+	Attributes []attribute.KeyValue
+
+	// DroppedAttributeCount is the number of attributes that were not
+	// recorded due to configured limits being reached.
+	DroppedAttributeCount int
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/provider.go b/vendor/go.opentelemetry.io/otel/sdk/trace/provider.go
new file mode 100644
index 0000000000..201c178170
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/provider.go
@@ -0,0 +1,461 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/internal/global"
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	"go.opentelemetry.io/otel/trace"
+)
+
+const (
+	defaultTracerName = "go.opentelemetry.io/otel/sdk/tracer"
+)
+
+// tracerProviderConfig.
+type tracerProviderConfig struct {
+	// processors contains collection of SpanProcessors that are processing pipeline
+	// for spans in the trace signal.
+	// SpanProcessors registered with a TracerProvider and are called at the start
+	// and end of a Span's lifecycle, and are called in the order they are
+	// registered.
+	processors []SpanProcessor
+
+	// sampler is the default sampler used when creating new spans.
+	sampler Sampler
+
+	// idGenerator is used to generate all Span and Trace IDs when needed.
+	idGenerator IDGenerator
+
+	// spanLimits defines the attribute, event, and link limits for spans.
+	spanLimits SpanLimits
+
+	// resource contains attributes representing an entity that produces telemetry.
+	resource *resource.Resource
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this exporter.
+func (cfg tracerProviderConfig) MarshalLog() interface{} {
+	return struct {
+		SpanProcessors  []SpanProcessor
+		SamplerType     string
+		IDGeneratorType string
+		SpanLimits      SpanLimits
+		Resource        *resource.Resource
+	}{
+		SpanProcessors:  cfg.processors,
+		SamplerType:     fmt.Sprintf("%T", cfg.sampler),
+		IDGeneratorType: fmt.Sprintf("%T", cfg.idGenerator),
+		SpanLimits:      cfg.spanLimits,
+		Resource:        cfg.resource,
+	}
+}
+
+// TracerProvider is an OpenTelemetry TracerProvider. It provides Tracers to
+// instrumentation so it can trace operational flow through a system.
+type TracerProvider struct {
+	mu             sync.Mutex
+	namedTracer    map[instrumentation.Scope]*tracer
+	spanProcessors atomic.Value
+	isShutdown     bool
+
+	// These fields are not protected by the lock mu. They are assumed to be
+	// immutable after creation of the TracerProvider.
+	sampler     Sampler
+	idGenerator IDGenerator
+	spanLimits  SpanLimits
+	resource    *resource.Resource
+}
+
+var _ trace.TracerProvider = &TracerProvider{}
+
+// NewTracerProvider returns a new and configured TracerProvider.
+//
+// By default the returned TracerProvider is configured with:
+//   - a ParentBased(AlwaysSample) Sampler
+//   - a random number IDGenerator
+//   - the resource.Default() Resource
+//   - the default SpanLimits.
+//
+// The passed opts are used to override these default values and configure the
+// returned TracerProvider appropriately.
+func NewTracerProvider(opts ...TracerProviderOption) *TracerProvider {
+	o := tracerProviderConfig{
+		spanLimits: NewSpanLimits(),
+	}
+	o = applyTracerProviderEnvConfigs(o)
+
+	for _, opt := range opts {
+		o = opt.apply(o)
+	}
+
+	o = ensureValidTracerProviderConfig(o)
+
+	tp := &TracerProvider{
+		namedTracer: make(map[instrumentation.Scope]*tracer),
+		sampler:     o.sampler,
+		idGenerator: o.idGenerator,
+		spanLimits:  o.spanLimits,
+		resource:    o.resource,
+	}
+	global.Info("TracerProvider created", "config", o)
+
+	spss := spanProcessorStates{}
+	for _, sp := range o.processors {
+		spss = append(spss, newSpanProcessorState(sp))
+	}
+	tp.spanProcessors.Store(spss)
+
+	return tp
+}
+
+// Tracer returns a Tracer with the given name and options. If a Tracer for
+// the given name and options does not exist it is created, otherwise the
+// existing Tracer is returned.
+//
+// If name is empty, DefaultTracerName is used instead.
+//
+// This method is safe to be called concurrently.
+func (p *TracerProvider) Tracer(name string, opts ...trace.TracerOption) trace.Tracer {
+	c := trace.NewTracerConfig(opts...)
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if name == "" {
+		name = defaultTracerName
+	}
+	is := instrumentation.Scope{
+		Name:      name,
+		Version:   c.InstrumentationVersion(),
+		SchemaURL: c.SchemaURL(),
+	}
+	t, ok := p.namedTracer[is]
+	if !ok {
+		t = &tracer{
+			provider:             p,
+			instrumentationScope: is,
+		}
+		p.namedTracer[is] = t
+		global.Info("Tracer created", "name", name, "version", c.InstrumentationVersion(), "schemaURL", c.SchemaURL())
+	}
+	return t
+}
+
+// RegisterSpanProcessor adds the given SpanProcessor to the list of SpanProcessors.
+func (p *TracerProvider) RegisterSpanProcessor(sp SpanProcessor) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.isShutdown {
+		return
+	}
+	newSPS := spanProcessorStates{}
+	newSPS = append(newSPS, p.spanProcessors.Load().(spanProcessorStates)...)
+	newSPS = append(newSPS, newSpanProcessorState(sp))
+	p.spanProcessors.Store(newSPS)
+}
+
+// UnregisterSpanProcessor removes the given SpanProcessor from the list of SpanProcessors.
+func (p *TracerProvider) UnregisterSpanProcessor(sp SpanProcessor) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.isShutdown {
+		return
+	}
+	old := p.spanProcessors.Load().(spanProcessorStates)
+	if len(old) == 0 {
+		return
+	}
+	spss := spanProcessorStates{}
+	spss = append(spss, old...)
+
+	// stop the span processor if it is started and remove it from the list
+	var stopOnce *spanProcessorState
+	var idx int
+	for i, sps := range spss {
+		if sps.sp == sp {
+			stopOnce = sps
+			idx = i
+		}
+	}
+	if stopOnce != nil {
+		stopOnce.state.Do(func() {
+			if err := sp.Shutdown(context.Background()); err != nil {
+				otel.Handle(err)
+			}
+		})
+	}
+	if len(spss) > 1 {
+		copy(spss[idx:], spss[idx+1:])
+	}
+	spss[len(spss)-1] = nil
+	spss = spss[:len(spss)-1]
+
+	p.spanProcessors.Store(spss)
+}
+
+// ForceFlush immediately exports all spans that have not yet been exported for
+// all the registered span processors.
+func (p *TracerProvider) ForceFlush(ctx context.Context) error {
+	spss := p.spanProcessors.Load().(spanProcessorStates)
+	if len(spss) == 0 {
+		return nil
+	}
+
+	for _, sps := range spss {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		if err := sps.sp.ForceFlush(ctx); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Shutdown shuts down TracerProvider. All registered span processors are shut down
+// in the order they were registered and any held computational resources are released.
+func (p *TracerProvider) Shutdown(ctx context.Context) error {
+	spss := p.spanProcessors.Load().(spanProcessorStates)
+	if len(spss) == 0 {
+		return nil
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.isShutdown = true
+
+	var retErr error
+	for _, sps := range spss {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		var err error
+		sps.state.Do(func() {
+			err = sps.sp.Shutdown(ctx)
+		})
+		if err != nil {
+			if retErr == nil {
+				retErr = err
+			} else {
+				// Poor man's list of errors
+				retErr = fmt.Errorf("%v; %v", retErr, err)
+			}
+		}
+	}
+	p.spanProcessors.Store(spanProcessorStates{})
+	return retErr
+}
+
+// TracerProviderOption configures a TracerProvider.
+type TracerProviderOption interface {
+	apply(tracerProviderConfig) tracerProviderConfig
+}
+
+type traceProviderOptionFunc func(tracerProviderConfig) tracerProviderConfig
+
+func (fn traceProviderOptionFunc) apply(cfg tracerProviderConfig) tracerProviderConfig {
+	return fn(cfg)
+}
+
+// WithSyncer registers the exporter with the TracerProvider using a
+// SimpleSpanProcessor.
+//
+// This is not recommended for production use. The synchronous nature of the
+// SimpleSpanProcessor that will wrap the exporter make it good for testing,
+// debugging, or showing examples of other feature, but it will be slow and
+// have a high computation resource usage overhead. The WithBatcher option is
+// recommended for production use instead.
+func WithSyncer(e SpanExporter) TracerProviderOption {
+	return WithSpanProcessor(NewSimpleSpanProcessor(e))
+}
+
+// WithBatcher registers the exporter with the TracerProvider using a
+// BatchSpanProcessor configured with the passed opts.
+func WithBatcher(e SpanExporter, opts ...BatchSpanProcessorOption) TracerProviderOption {
+	return WithSpanProcessor(NewBatchSpanProcessor(e, opts...))
+}
+
+// WithSpanProcessor registers the SpanProcessor with a TracerProvider.
+func WithSpanProcessor(sp SpanProcessor) TracerProviderOption {
+	return traceProviderOptionFunc(func(cfg tracerProviderConfig) tracerProviderConfig {
+		cfg.processors = append(cfg.processors, sp)
+		return cfg
+	})
+}
+
+// WithResource returns a TracerProviderOption that will configure the
+// Resource r as a TracerProvider's Resource. The configured Resource is
+// referenced by all the Tracers the TracerProvider creates. It represents the
+// entity producing telemetry.
+//
+// If this option is not used, the TracerProvider will use the
+// resource.Default() Resource by default.
+func WithResource(r *resource.Resource) TracerProviderOption {
+	return traceProviderOptionFunc(func(cfg tracerProviderConfig) tracerProviderConfig {
+		var err error
+		cfg.resource, err = resource.Merge(resource.Environment(), r)
+		if err != nil {
+			otel.Handle(err)
+		}
+		return cfg
+	})
+}
+
+// WithIDGenerator returns a TracerProviderOption that will configure the
+// IDGenerator g as a TracerProvider's IDGenerator. The configured IDGenerator
+// is used by the Tracers the TracerProvider creates to generate new Span and
+// Trace IDs.
+//
+// If this option is not used, the TracerProvider will use a random number
+// IDGenerator by default.
+func WithIDGenerator(g IDGenerator) TracerProviderOption {
+	return traceProviderOptionFunc(func(cfg tracerProviderConfig) tracerProviderConfig {
+		if g != nil {
+			cfg.idGenerator = g
+		}
+		return cfg
+	})
+}
+
+// WithSampler returns a TracerProviderOption that will configure the Sampler
+// s as a TracerProvider's Sampler. The configured Sampler is used by the
+// Tracers the TracerProvider creates to make their sampling decisions for the
+// Spans they create.
+//
+// This option overrides the Sampler configured through the OTEL_TRACES_SAMPLER
+// and OTEL_TRACES_SAMPLER_ARG environment variables. If this option is not used
+// and the sampler is not configured through environment variables or the environment
+// contains invalid/unsupported configuration, the TracerProvider will use a
+// ParentBased(AlwaysSample) Sampler by default.
+func WithSampler(s Sampler) TracerProviderOption {
+	return traceProviderOptionFunc(func(cfg tracerProviderConfig) tracerProviderConfig {
+		if s != nil {
+			cfg.sampler = s
+		}
+		return cfg
+	})
+}
+
+// WithSpanLimits returns a TracerProviderOption that configures a
+// TracerProvider to use the SpanLimits sl. These SpanLimits bound any Span
+// created by a Tracer from the TracerProvider.
+//
+// If any field of sl is zero or negative it will be replaced with the default
+// value for that field.
+//
+// If this or WithRawSpanLimits are not provided, the TracerProvider will use
+// the limits defined by environment variables, or the defaults if unset.
+// Refer to the NewSpanLimits documentation for information about this
+// relationship.
+//
+// Deprecated: Use WithRawSpanLimits instead which allows setting unlimited
+// and zero limits. This option will be kept until the next major version
+// incremented release.
+func WithSpanLimits(sl SpanLimits) TracerProviderOption {
+	if sl.AttributeValueLengthLimit <= 0 {
+		sl.AttributeValueLengthLimit = DefaultAttributeValueLengthLimit
+	}
+	if sl.AttributeCountLimit <= 0 {
+		sl.AttributeCountLimit = DefaultAttributeCountLimit
+	}
+	if sl.EventCountLimit <= 0 {
+		sl.EventCountLimit = DefaultEventCountLimit
+	}
+	if sl.AttributePerEventCountLimit <= 0 {
+		sl.AttributePerEventCountLimit = DefaultAttributePerEventCountLimit
+	}
+	if sl.LinkCountLimit <= 0 {
+		sl.LinkCountLimit = DefaultLinkCountLimit
+	}
+	if sl.AttributePerLinkCountLimit <= 0 {
+		sl.AttributePerLinkCountLimit = DefaultAttributePerLinkCountLimit
+	}
+	return traceProviderOptionFunc(func(cfg tracerProviderConfig) tracerProviderConfig {
+		cfg.spanLimits = sl
+		return cfg
+	})
+}
+
+// WithRawSpanLimits returns a TracerProviderOption that configures a
+// TracerProvider to use these limits. These limits bound any Span created by
+// a Tracer from the TracerProvider.
+//
+// The limits will be used as-is. Zero or negative values will not be changed
+// to the default value like WithSpanLimits does. Setting a limit to zero will
+// effectively disable the related resource it limits and setting to a
+// negative value will mean that resource is unlimited. Consequentially, this
+// means that the zero-value SpanLimits will disable all span resources.
+// Because of this, limits should be constructed using NewSpanLimits and
+// updated accordingly.
+//
+// If this or WithSpanLimits are not provided, the TracerProvider will use the
+// limits defined by environment variables, or the defaults if unset. Refer to
+// the NewSpanLimits documentation for information about this relationship.
+func WithRawSpanLimits(limits SpanLimits) TracerProviderOption {
+	return traceProviderOptionFunc(func(cfg tracerProviderConfig) tracerProviderConfig {
+		cfg.spanLimits = limits
+		return cfg
+	})
+}
+
+func applyTracerProviderEnvConfigs(cfg tracerProviderConfig) tracerProviderConfig {
+	for _, opt := range tracerProviderOptionsFromEnv() {
+		cfg = opt.apply(cfg)
+	}
+
+	return cfg
+}
+
+func tracerProviderOptionsFromEnv() []TracerProviderOption {
+	var opts []TracerProviderOption
+
+	sampler, err := samplerFromEnv()
+	if err != nil {
+		otel.Handle(err)
+	}
+
+	if sampler != nil {
+		opts = append(opts, WithSampler(sampler))
+	}
+
+	return opts
+}
+
+// ensureValidTracerProviderConfig ensures that given TracerProviderConfig is valid.
+func ensureValidTracerProviderConfig(cfg tracerProviderConfig) tracerProviderConfig {
+	if cfg.sampler == nil {
+		cfg.sampler = ParentBased(AlwaysSample())
+	}
+	if cfg.idGenerator == nil {
+		cfg.idGenerator = defaultIDGenerator()
+	}
+	if cfg.resource == nil {
+		cfg.resource = resource.Default()
+	}
+	return cfg
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/sampler_env.go b/vendor/go.opentelemetry.io/otel/sdk/trace/sampler_env.go
new file mode 100644
index 0000000000..02053b318a
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/sampler_env.go
@@ -0,0 +1,108 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+const (
+	tracesSamplerKey    = "OTEL_TRACES_SAMPLER"
+	tracesSamplerArgKey = "OTEL_TRACES_SAMPLER_ARG"
+
+	samplerAlwaysOn                = "always_on"
+	samplerAlwaysOff               = "always_off"
+	samplerTraceIDRatio            = "traceidratio"
+	samplerParentBasedAlwaysOn     = "parentbased_always_on"
+	samplerParsedBasedAlwaysOff    = "parentbased_always_off"
+	samplerParentBasedTraceIDRatio = "parentbased_traceidratio"
+)
+
+type errUnsupportedSampler string
+
+func (e errUnsupportedSampler) Error() string {
+	return fmt.Sprintf("unsupported sampler: %s", string(e))
+}
+
+var (
+	errNegativeTraceIDRatio       = errors.New("invalid trace ID ratio: less than 0.0")
+	errGreaterThanOneTraceIDRatio = errors.New("invalid trace ID ratio: greater than 1.0")
+)
+
+type samplerArgParseError struct {
+	parseErr error
+}
+
+func (e samplerArgParseError) Error() string {
+	return fmt.Sprintf("parsing sampler argument: %s", e.parseErr.Error())
+}
+
+func (e samplerArgParseError) Unwrap() error {
+	return e.parseErr
+}
+
+func samplerFromEnv() (Sampler, error) {
+	sampler, ok := os.LookupEnv(tracesSamplerKey)
+	if !ok {
+		return nil, nil
+	}
+
+	sampler = strings.ToLower(strings.TrimSpace(sampler))
+	samplerArg, hasSamplerArg := os.LookupEnv(tracesSamplerArgKey)
+	samplerArg = strings.TrimSpace(samplerArg)
+
+	switch sampler {
+	case samplerAlwaysOn:
+		return AlwaysSample(), nil
+	case samplerAlwaysOff:
+		return NeverSample(), nil
+	case samplerTraceIDRatio:
+		if !hasSamplerArg {
+			return TraceIDRatioBased(1.0), nil
+		}
+		return parseTraceIDRatio(samplerArg)
+	case samplerParentBasedAlwaysOn:
+		return ParentBased(AlwaysSample()), nil
+	case samplerParsedBasedAlwaysOff:
+		return ParentBased(NeverSample()), nil
+	case samplerParentBasedTraceIDRatio:
+		if !hasSamplerArg {
+			return ParentBased(TraceIDRatioBased(1.0)), nil
+		}
+		ratio, err := parseTraceIDRatio(samplerArg)
+		return ParentBased(ratio), err
+	default:
+		return nil, errUnsupportedSampler(sampler)
+	}
+}
+
+func parseTraceIDRatio(arg string) (Sampler, error) {
+	v, err := strconv.ParseFloat(arg, 64)
+	if err != nil {
+		return TraceIDRatioBased(1.0), samplerArgParseError{err}
+	}
+	if v < 0.0 {
+		return TraceIDRatioBased(1.0), errNegativeTraceIDRatio
+	}
+	if v > 1.0 {
+		return TraceIDRatioBased(1.0), errGreaterThanOneTraceIDRatio
+	}
+
+	return TraceIDRatioBased(v), nil
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go b/vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go
new file mode 100644
index 0000000000..5ee9715d27
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/sampling.go
@@ -0,0 +1,293 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"encoding/binary"
+	"fmt"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Sampler decides whether a trace should be sampled and exported.
+type Sampler interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// ShouldSample returns a SamplingResult based on a decision made from the
+	// passed parameters.
+	ShouldSample(parameters SamplingParameters) SamplingResult
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Description returns information describing the Sampler.
+	Description() string
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+// SamplingParameters contains the values passed to a Sampler.
+type SamplingParameters struct {
+	ParentContext context.Context
+	TraceID       trace.TraceID
+	Name          string
+	Kind          trace.SpanKind
+	Attributes    []attribute.KeyValue
+	Links         []trace.Link
+}
+
+// SamplingDecision indicates whether a span is dropped, recorded and/or sampled.
+type SamplingDecision uint8
+
+// Valid sampling decisions.
+const (
+	// Drop will not record the span and all attributes/events will be dropped.
+	Drop SamplingDecision = iota
+
+	// Record indicates the span's `IsRecording() == true`, but `Sampled` flag
+	// *must not* be set.
+	RecordOnly
+
+	// RecordAndSample has span's `IsRecording() == true` and `Sampled` flag
+	// *must* be set.
+	RecordAndSample
+)
+
+// SamplingResult conveys a SamplingDecision, set of Attributes and a Tracestate.
+type SamplingResult struct {
+	Decision   SamplingDecision
+	Attributes []attribute.KeyValue
+	Tracestate trace.TraceState
+}
+
+type traceIDRatioSampler struct {
+	traceIDUpperBound uint64
+	description       string
+}
+
+func (ts traceIDRatioSampler) ShouldSample(p SamplingParameters) SamplingResult {
+	psc := trace.SpanContextFromContext(p.ParentContext)
+	x := binary.BigEndian.Uint64(p.TraceID[8:16]) >> 1
+	if x < ts.traceIDUpperBound {
+		return SamplingResult{
+			Decision:   RecordAndSample,
+			Tracestate: psc.TraceState(),
+		}
+	}
+	return SamplingResult{
+		Decision:   Drop,
+		Tracestate: psc.TraceState(),
+	}
+}
+
+func (ts traceIDRatioSampler) Description() string {
+	return ts.description
+}
+
+// TraceIDRatioBased samples a given fraction of traces. Fractions >= 1 will
+// always sample. Fractions < 0 are treated as zero. To respect the
+// parent trace's `SampledFlag`, the `TraceIDRatioBased` sampler should be used
+// as a delegate of a `Parent` sampler.
+//
+//nolint:revive // revive complains about stutter of `trace.TraceIDRatioBased`
+func TraceIDRatioBased(fraction float64) Sampler {
+	if fraction >= 1 {
+		return AlwaysSample()
+	}
+
+	if fraction <= 0 {
+		fraction = 0
+	}
+
+	return &traceIDRatioSampler{
+		traceIDUpperBound: uint64(fraction * (1 << 63)),
+		description:       fmt.Sprintf("TraceIDRatioBased{%g}", fraction),
+	}
+}
+
+type alwaysOnSampler struct{}
+
+func (as alwaysOnSampler) ShouldSample(p SamplingParameters) SamplingResult {
+	return SamplingResult{
+		Decision:   RecordAndSample,
+		Tracestate: trace.SpanContextFromContext(p.ParentContext).TraceState(),
+	}
+}
+
+func (as alwaysOnSampler) Description() string {
+	return "AlwaysOnSampler"
+}
+
+// AlwaysSample returns a Sampler that samples every trace.
+// Be careful about using this sampler in a production application with
+// significant traffic: a new trace will be started and exported for every
+// request.
+func AlwaysSample() Sampler {
+	return alwaysOnSampler{}
+}
+
+type alwaysOffSampler struct{}
+
+func (as alwaysOffSampler) ShouldSample(p SamplingParameters) SamplingResult {
+	return SamplingResult{
+		Decision:   Drop,
+		Tracestate: trace.SpanContextFromContext(p.ParentContext).TraceState(),
+	}
+}
+
+func (as alwaysOffSampler) Description() string {
+	return "AlwaysOffSampler"
+}
+
+// NeverSample returns a Sampler that samples no traces.
+func NeverSample() Sampler {
+	return alwaysOffSampler{}
+}
+
+// ParentBased returns a composite sampler which behaves differently,
+// based on the parent of the span. If the span has no parent,
+// the root(Sampler) is used to make sampling decision. If the span has
+// a parent, depending on whether the parent is remote and whether it
+// is sampled, one of the following samplers will apply:
+//   - remoteParentSampled(Sampler) (default: AlwaysOn)
+//   - remoteParentNotSampled(Sampler) (default: AlwaysOff)
+//   - localParentSampled(Sampler) (default: AlwaysOn)
+//   - localParentNotSampled(Sampler) (default: AlwaysOff)
+func ParentBased(root Sampler, samplers ...ParentBasedSamplerOption) Sampler {
+	return parentBased{
+		root:   root,
+		config: configureSamplersForParentBased(samplers),
+	}
+}
+
+type parentBased struct {
+	root   Sampler
+	config samplerConfig
+}
+
+func configureSamplersForParentBased(samplers []ParentBasedSamplerOption) samplerConfig {
+	c := samplerConfig{
+		remoteParentSampled:    AlwaysSample(),
+		remoteParentNotSampled: NeverSample(),
+		localParentSampled:     AlwaysSample(),
+		localParentNotSampled:  NeverSample(),
+	}
+
+	for _, so := range samplers {
+		c = so.apply(c)
+	}
+
+	return c
+}
+
+// samplerConfig is a group of options for parentBased sampler.
+type samplerConfig struct {
+	remoteParentSampled, remoteParentNotSampled Sampler
+	localParentSampled, localParentNotSampled   Sampler
+}
+
+// ParentBasedSamplerOption configures the sampler for a particular sampling case.
+type ParentBasedSamplerOption interface {
+	apply(samplerConfig) samplerConfig
+}
+
+// WithRemoteParentSampled sets the sampler for the case of sampled remote parent.
+func WithRemoteParentSampled(s Sampler) ParentBasedSamplerOption {
+	return remoteParentSampledOption{s}
+}
+
+type remoteParentSampledOption struct {
+	s Sampler
+}
+
+func (o remoteParentSampledOption) apply(config samplerConfig) samplerConfig {
+	config.remoteParentSampled = o.s
+	return config
+}
+
+// WithRemoteParentNotSampled sets the sampler for the case of remote parent
+// which is not sampled.
+func WithRemoteParentNotSampled(s Sampler) ParentBasedSamplerOption {
+	return remoteParentNotSampledOption{s}
+}
+
+type remoteParentNotSampledOption struct {
+	s Sampler
+}
+
+func (o remoteParentNotSampledOption) apply(config samplerConfig) samplerConfig {
+	config.remoteParentNotSampled = o.s
+	return config
+}
+
+// WithLocalParentSampled sets the sampler for the case of sampled local parent.
+func WithLocalParentSampled(s Sampler) ParentBasedSamplerOption {
+	return localParentSampledOption{s}
+}
+
+type localParentSampledOption struct {
+	s Sampler
+}
+
+func (o localParentSampledOption) apply(config samplerConfig) samplerConfig {
+	config.localParentSampled = o.s
+	return config
+}
+
+// WithLocalParentNotSampled sets the sampler for the case of local parent
+// which is not sampled.
+func WithLocalParentNotSampled(s Sampler) ParentBasedSamplerOption {
+	return localParentNotSampledOption{s}
+}
+
+type localParentNotSampledOption struct {
+	s Sampler
+}
+
+func (o localParentNotSampledOption) apply(config samplerConfig) samplerConfig {
+	config.localParentNotSampled = o.s
+	return config
+}
+
+func (pb parentBased) ShouldSample(p SamplingParameters) SamplingResult {
+	psc := trace.SpanContextFromContext(p.ParentContext)
+	if psc.IsValid() {
+		if psc.IsRemote() {
+			if psc.IsSampled() {
+				return pb.config.remoteParentSampled.ShouldSample(p)
+			}
+			return pb.config.remoteParentNotSampled.ShouldSample(p)
+		}
+
+		if psc.IsSampled() {
+			return pb.config.localParentSampled.ShouldSample(p)
+		}
+		return pb.config.localParentNotSampled.ShouldSample(p)
+	}
+	return pb.root.ShouldSample(p)
+}
+
+func (pb parentBased) Description() string {
+	return fmt.Sprintf("ParentBased{root:%s,remoteParentSampled:%s,"+
+		"remoteParentNotSampled:%s,localParentSampled:%s,localParentNotSampled:%s}",
+		pb.root.Description(),
+		pb.config.remoteParentSampled.Description(),
+		pb.config.remoteParentNotSampled.Description(),
+		pb.config.localParentSampled.Description(),
+		pb.config.localParentNotSampled.Description(),
+	)
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.go b/vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.go
new file mode 100644
index 0000000000..e8530a9593
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/simple_span_processor.go
@@ -0,0 +1,128 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"sync"
+
+	"go.opentelemetry.io/otel"
+)
+
+// simpleSpanProcessor is a SpanProcessor that synchronously sends all
+// completed Spans to a trace.Exporter immediately.
+type simpleSpanProcessor struct {
+	exporterMu sync.RWMutex
+	exporter   SpanExporter
+	stopOnce   sync.Once
+}
+
+var _ SpanProcessor = (*simpleSpanProcessor)(nil)
+
+// NewSimpleSpanProcessor returns a new SpanProcessor that will synchronously
+// send completed spans to the exporter immediately.
+//
+// This SpanProcessor is not recommended for production use. The synchronous
+// nature of this SpanProcessor make it good for testing, debugging, or
+// showing examples of other feature, but it will be slow and have a high
+// computation resource usage overhead. The BatchSpanProcessor is recommended
+// for production use instead.
+func NewSimpleSpanProcessor(exporter SpanExporter) SpanProcessor {
+	ssp := &simpleSpanProcessor{
+		exporter: exporter,
+	}
+	return ssp
+}
+
+// OnStart does nothing.
+func (ssp *simpleSpanProcessor) OnStart(context.Context, ReadWriteSpan) {}
+
+// OnEnd immediately exports a ReadOnlySpan.
+func (ssp *simpleSpanProcessor) OnEnd(s ReadOnlySpan) {
+	ssp.exporterMu.RLock()
+	defer ssp.exporterMu.RUnlock()
+
+	if ssp.exporter != nil && s.SpanContext().TraceFlags().IsSampled() {
+		if err := ssp.exporter.ExportSpans(context.Background(), []ReadOnlySpan{s}); err != nil {
+			otel.Handle(err)
+		}
+	}
+}
+
+// Shutdown shuts down the exporter this SimpleSpanProcessor exports to.
+func (ssp *simpleSpanProcessor) Shutdown(ctx context.Context) error {
+	var err error
+	ssp.stopOnce.Do(func() {
+		stopFunc := func(exp SpanExporter) (<-chan error, func()) {
+			done := make(chan error)
+			return done, func() { done <- exp.Shutdown(ctx) }
+		}
+
+		// The exporter field of the simpleSpanProcessor needs to be zeroed to
+		// signal it is shut down, meaning all subsequent calls to OnEnd will
+		// be gracefully ignored. This needs to be done synchronously to avoid
+		// any race condition.
+		//
+		// A closure is used to keep reference to the exporter and then the
+		// field is zeroed. This ensures the simpleSpanProcessor is shut down
+		// before the exporter. This order is important as it avoids a
+		// potential deadlock. If the exporter shut down operation generates a
+		// span, that span would need to be exported. Meaning, OnEnd would be
+		// called and try acquiring the lock that is held here.
+		ssp.exporterMu.Lock()
+		done, shutdown := stopFunc(ssp.exporter)
+		ssp.exporter = nil
+		ssp.exporterMu.Unlock()
+
+		go shutdown()
+
+		// Wait for the exporter to shut down or the deadline to expire.
+		select {
+		case err = <-done:
+		case <-ctx.Done():
+			// It is possible for the exporter to have immediately shut down
+			// and the context to be done simultaneously. In that case this
+			// outer select statement will randomly choose a case. This will
+			// result in a different returned error for similar scenarios.
+			// Instead, double check if the exporter shut down at the same
+			// time and return that error if so. This will ensure consistency
+			// as well as ensure the caller knows the exporter shut down
+			// successfully (they can already determine if the deadline is
+			// expired given they passed the context).
+			select {
+			case err = <-done:
+			default:
+				err = ctx.Err()
+			}
+		}
+	})
+	return err
+}
+
+// ForceFlush does nothing as there is no data to flush.
+func (ssp *simpleSpanProcessor) ForceFlush(context.Context) error {
+	return nil
+}
+
+// MarshalLog is the marshaling function used by the logging system to represent this Span Processor.
+func (ssp *simpleSpanProcessor) MarshalLog() interface{} {
+	return struct {
+		Type     string
+		Exporter SpanExporter
+	}{
+		Type:     "SimpleSpanProcessor",
+		Exporter: ssp.exporter,
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.go b/vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.go
new file mode 100644
index 0000000000..0349b2f198
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/snapshot.go
@@ -0,0 +1,144 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"time"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// snapshot is an record of a spans state at a particular checkpointed time.
+// It is used as a read-only representation of that state.
+type snapshot struct {
+	name                  string
+	spanContext           trace.SpanContext
+	parent                trace.SpanContext
+	spanKind              trace.SpanKind
+	startTime             time.Time
+	endTime               time.Time
+	attributes            []attribute.KeyValue
+	events                []Event
+	links                 []Link
+	status                Status
+	childSpanCount        int
+	droppedAttributeCount int
+	droppedEventCount     int
+	droppedLinkCount      int
+	resource              *resource.Resource
+	instrumentationScope  instrumentation.Scope
+}
+
+var _ ReadOnlySpan = snapshot{}
+
+func (s snapshot) private() {}
+
+// Name returns the name of the span.
+func (s snapshot) Name() string {
+	return s.name
+}
+
+// SpanContext returns the unique SpanContext that identifies the span.
+func (s snapshot) SpanContext() trace.SpanContext {
+	return s.spanContext
+}
+
+// Parent returns the unique SpanContext that identifies the parent of the
+// span if one exists. If the span has no parent the returned SpanContext
+// will be invalid.
+func (s snapshot) Parent() trace.SpanContext {
+	return s.parent
+}
+
+// SpanKind returns the role the span plays in a Trace.
+func (s snapshot) SpanKind() trace.SpanKind {
+	return s.spanKind
+}
+
+// StartTime returns the time the span started recording.
+func (s snapshot) StartTime() time.Time {
+	return s.startTime
+}
+
+// EndTime returns the time the span stopped recording. It will be zero if
+// the span has not ended.
+func (s snapshot) EndTime() time.Time {
+	return s.endTime
+}
+
+// Attributes returns the defining attributes of the span.
+func (s snapshot) Attributes() []attribute.KeyValue {
+	return s.attributes
+}
+
+// Links returns all the links the span has to other spans.
+func (s snapshot) Links() []Link {
+	return s.links
+}
+
+// Events returns all the events that occurred within in the spans
+// lifetime.
+func (s snapshot) Events() []Event {
+	return s.events
+}
+
+// Status returns the spans status.
+func (s snapshot) Status() Status {
+	return s.status
+}
+
+// InstrumentationScope returns information about the instrumentation
+// scope that created the span.
+func (s snapshot) InstrumentationScope() instrumentation.Scope {
+	return s.instrumentationScope
+}
+
+// InstrumentationLibrary returns information about the instrumentation
+// library that created the span.
+func (s snapshot) InstrumentationLibrary() instrumentation.Library {
+	return s.instrumentationScope
+}
+
+// Resource returns information about the entity that produced the span.
+func (s snapshot) Resource() *resource.Resource {
+	return s.resource
+}
+
+// DroppedAttributes returns the number of attributes dropped by the span
+// due to limits being reached.
+func (s snapshot) DroppedAttributes() int {
+	return s.droppedAttributeCount
+}
+
+// DroppedLinks returns the number of links dropped by the span due to limits
+// being reached.
+func (s snapshot) DroppedLinks() int {
+	return s.droppedLinkCount
+}
+
+// DroppedEvents returns the number of events dropped by the span due to
+// limits being reached.
+func (s snapshot) DroppedEvents() int {
+	return s.droppedEventCount
+}
+
+// ChildSpanCount returns the count of spans that consider the span a
+// direct parent.
+func (s snapshot) ChildSpanCount() int {
+	return s.childSpanCount
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/span.go b/vendor/go.opentelemetry.io/otel/sdk/trace/span.go
new file mode 100644
index 0000000000..9fb483a99f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/span.go
@@ -0,0 +1,828 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"runtime"
+	rt "runtime/trace"
+	"strings"
+	"sync"
+	"time"
+	"unicode/utf8"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	"go.opentelemetry.io/otel/sdk/internal"
+	"go.opentelemetry.io/otel/sdk/resource"
+	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// ReadOnlySpan allows reading information from the data structure underlying a
+// trace.Span. It is used in places where reading information from a span is
+// necessary but changing the span isn't necessary or allowed.
+//
+// Warning: methods may be added to this interface in minor releases.
+type ReadOnlySpan interface {
+	// Name returns the name of the span.
+	Name() string
+	// SpanContext returns the unique SpanContext that identifies the span.
+	SpanContext() trace.SpanContext
+	// Parent returns the unique SpanContext that identifies the parent of the
+	// span if one exists. If the span has no parent the returned SpanContext
+	// will be invalid.
+	Parent() trace.SpanContext
+	// SpanKind returns the role the span plays in a Trace.
+	SpanKind() trace.SpanKind
+	// StartTime returns the time the span started recording.
+	StartTime() time.Time
+	// EndTime returns the time the span stopped recording. It will be zero if
+	// the span has not ended.
+	EndTime() time.Time
+	// Attributes returns the defining attributes of the span.
+	// The order of the returned attributes is not guaranteed to be stable across invocations.
+	Attributes() []attribute.KeyValue
+	// Links returns all the links the span has to other spans.
+	Links() []Link
+	// Events returns all the events that occurred within in the spans
+	// lifetime.
+	Events() []Event
+	// Status returns the spans status.
+	Status() Status
+	// InstrumentationScope returns information about the instrumentation
+	// scope that created the span.
+	InstrumentationScope() instrumentation.Scope
+	// InstrumentationLibrary returns information about the instrumentation
+	// library that created the span.
+	// Deprecated: please use InstrumentationScope instead.
+	InstrumentationLibrary() instrumentation.Library
+	// Resource returns information about the entity that produced the span.
+	Resource() *resource.Resource
+	// DroppedAttributes returns the number of attributes dropped by the span
+	// due to limits being reached.
+	DroppedAttributes() int
+	// DroppedLinks returns the number of links dropped by the span due to
+	// limits being reached.
+	DroppedLinks() int
+	// DroppedEvents returns the number of events dropped by the span due to
+	// limits being reached.
+	DroppedEvents() int
+	// ChildSpanCount returns the count of spans that consider the span a
+	// direct parent.
+	ChildSpanCount() int
+
+	// A private method to prevent users implementing the
+	// interface and so future additions to it will not
+	// violate compatibility.
+	private()
+}
+
+// ReadWriteSpan exposes the same methods as trace.Span and in addition allows
+// reading information from the underlying data structure.
+// This interface exposes the union of the methods of trace.Span (which is a
+// "write-only" span) and ReadOnlySpan. New methods for writing or reading span
+// information should be added under trace.Span or ReadOnlySpan, respectively.
+//
+// Warning: methods may be added to this interface in minor releases.
+type ReadWriteSpan interface {
+	trace.Span
+	ReadOnlySpan
+}
+
+// recordingSpan is an implementation of the OpenTelemetry Span API
+// representing the individual component of a trace that is sampled.
+type recordingSpan struct {
+	// mu protects the contents of this span.
+	mu sync.Mutex
+
+	// parent holds the parent span of this span as a trace.SpanContext.
+	parent trace.SpanContext
+
+	// spanKind represents the kind of this span as a trace.SpanKind.
+	spanKind trace.SpanKind
+
+	// name is the name of this span.
+	name string
+
+	// startTime is the time at which this span was started.
+	startTime time.Time
+
+	// endTime is the time at which this span was ended. It contains the zero
+	// value of time.Time until the span is ended.
+	endTime time.Time
+
+	// status is the status of this span.
+	status Status
+
+	// childSpanCount holds the number of child spans created for this span.
+	childSpanCount int
+
+	// spanContext holds the SpanContext of this span.
+	spanContext trace.SpanContext
+
+	// attributes is a collection of user provided key/values. The collection
+	// is constrained by a configurable maximum held by the parent
+	// TracerProvider. When additional attributes are added after this maximum
+	// is reached these attributes the user is attempting to add are dropped.
+	// This dropped number of attributes is tracked and reported in the
+	// ReadOnlySpan exported when the span ends.
+	attributes        []attribute.KeyValue
+	droppedAttributes int
+
+	// events are stored in FIFO queue capped by configured limit.
+	events evictedQueue
+
+	// links are stored in FIFO queue capped by configured limit.
+	links evictedQueue
+
+	// executionTracerTaskEnd ends the execution tracer span.
+	executionTracerTaskEnd func()
+
+	// tracer is the SDK tracer that created this span.
+	tracer *tracer
+}
+
+var _ ReadWriteSpan = (*recordingSpan)(nil)
+var _ runtimeTracer = (*recordingSpan)(nil)
+
+// SpanContext returns the SpanContext of this span.
+func (s *recordingSpan) SpanContext() trace.SpanContext {
+	if s == nil {
+		return trace.SpanContext{}
+	}
+	return s.spanContext
+}
+
+// IsRecording returns if this span is being recorded. If this span has ended
+// this will return false.
+func (s *recordingSpan) IsRecording() bool {
+	if s == nil {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	return s.endTime.IsZero()
+}
+
+// SetStatus sets the status of the Span in the form of a code and a
+// description, overriding previous values set. The description is only
+// included in the set status when the code is for an error. If this span is
+// not being recorded than this method does nothing.
+func (s *recordingSpan) SetStatus(code codes.Code, description string) {
+	if !s.IsRecording() {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.status.Code > code {
+		return
+	}
+
+	status := Status{Code: code}
+	if code == codes.Error {
+		status.Description = description
+	}
+
+	s.status = status
+}
+
+// SetAttributes sets attributes of this span.
+//
+// If a key from attributes already exists the value associated with that key
+// will be overwritten with the value contained in attributes.
+//
+// If this span is not being recorded than this method does nothing.
+//
+// If adding attributes to the span would exceed the maximum amount of
+// attributes the span is configured to have, the last added attributes will
+// be dropped.
+func (s *recordingSpan) SetAttributes(attributes ...attribute.KeyValue) {
+	if !s.IsRecording() {
+		return
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	limit := s.tracer.provider.spanLimits.AttributeCountLimit
+	if limit == 0 {
+		// No attributes allowed.
+		s.droppedAttributes += len(attributes)
+		return
+	}
+
+	// If adding these attributes could exceed the capacity of s perform a
+	// de-duplication and truncation while adding to avoid over allocation.
+	if limit > 0 && len(s.attributes)+len(attributes) > limit {
+		s.addOverCapAttrs(limit, attributes)
+		return
+	}
+
+	// Otherwise, add without deduplication. When attributes are read they
+	// will be deduplicated, optimizing the operation.
+	for _, a := range attributes {
+		if !a.Valid() {
+			// Drop all invalid attributes.
+			s.droppedAttributes++
+			continue
+		}
+		a = truncateAttr(s.tracer.provider.spanLimits.AttributeValueLengthLimit, a)
+		s.attributes = append(s.attributes, a)
+	}
+}
+
+// addOverCapAttrs adds the attributes attrs to the span s while
+// de-duplicating the attributes of s and attrs and dropping attributes that
+// exceed the limit.
+//
+// This method assumes s.mu.Lock is held by the caller.
+//
+// This method should only be called when there is a possibility that adding
+// attrs to s will exceed the limit. Otherwise, attrs should be added to s
+// without checking for duplicates and all retrieval methods of the attributes
+// for s will de-duplicate as needed.
+//
+// This method assumes limit is a value > 0. The argument should be validated
+// by the caller.
+func (s *recordingSpan) addOverCapAttrs(limit int, attrs []attribute.KeyValue) {
+	// In order to not allocate more capacity to s.attributes than needed,
+	// prune and truncate this addition of attributes while adding.
+
+	// Do not set a capacity when creating this map. Benchmark testing has
+	// showed this to only add unused memory allocations in general use.
+	exists := make(map[attribute.Key]int)
+	s.dedupeAttrsFromRecord(&exists)
+
+	// Now that s.attributes is deduplicated, adding unique attributes up to
+	// the capacity of s will not over allocate s.attributes.
+	for _, a := range attrs {
+		if !a.Valid() {
+			// Drop all invalid attributes.
+			s.droppedAttributes++
+			continue
+		}
+
+		if idx, ok := exists[a.Key]; ok {
+			// Perform all updates before dropping, even when at capacity.
+			s.attributes[idx] = a
+			continue
+		}
+
+		if len(s.attributes) >= limit {
+			// Do not just drop all of the remaining attributes, make sure
+			// updates are checked and performed.
+			s.droppedAttributes++
+		} else {
+			a = truncateAttr(s.tracer.provider.spanLimits.AttributeValueLengthLimit, a)
+			s.attributes = append(s.attributes, a)
+			exists[a.Key] = len(s.attributes) - 1
+		}
+	}
+}
+
+// truncateAttr returns a truncated version of attr. Only string and string
+// slice attribute values are truncated. String values are truncated to at
+// most a length of limit. Each string slice value is truncated in this fashion
+// (the slice length itself is unaffected).
+//
+// No truncation is perfromed for a negative limit.
+func truncateAttr(limit int, attr attribute.KeyValue) attribute.KeyValue {
+	if limit < 0 {
+		return attr
+	}
+	switch attr.Value.Type() {
+	case attribute.STRING:
+		if v := attr.Value.AsString(); len(v) > limit {
+			return attr.Key.String(safeTruncate(v, limit))
+		}
+	case attribute.STRINGSLICE:
+		v := attr.Value.AsStringSlice()
+		for i := range v {
+			if len(v[i]) > limit {
+				v[i] = safeTruncate(v[i], limit)
+			}
+		}
+		return attr.Key.StringSlice(v)
+	}
+	return attr
+}
+
+// safeTruncate truncates the string and guarantees valid UTF-8 is returned.
+func safeTruncate(input string, limit int) string {
+	if trunc, ok := safeTruncateValidUTF8(input, limit); ok {
+		return trunc
+	}
+	trunc, _ := safeTruncateValidUTF8(strings.ToValidUTF8(input, ""), limit)
+	return trunc
+}
+
+// safeTruncateValidUTF8 returns a copy of the input string safely truncated to
+// limit. The truncation is ensured to occur at the bounds of complete UTF-8
+// characters. If invalid encoding of UTF-8 is encountered, input is returned
+// with false, otherwise, the truncated input will be returned with true.
+func safeTruncateValidUTF8(input string, limit int) (string, bool) {
+	for cnt := 0; cnt <= limit; {
+		r, size := utf8.DecodeRuneInString(input[cnt:])
+		if r == utf8.RuneError {
+			return input, false
+		}
+
+		if cnt+size > limit {
+			return input[:cnt], true
+		}
+		cnt += size
+	}
+	return input, true
+}
+
+// End ends the span. This method does nothing if the span is already ended or
+// is not being recorded.
+//
+// The only SpanOption currently supported is WithTimestamp which will set the
+// end time for a Span's life-cycle.
+//
+// If this method is called while panicking an error event is added to the
+// Span before ending it and the panic is continued.
+func (s *recordingSpan) End(options ...trace.SpanEndOption) {
+	// Do not start by checking if the span is being recorded which requires
+	// acquiring a lock. Make a minimal check that the span is not nil.
+	if s == nil {
+		return
+	}
+
+	// Store the end time as soon as possible to avoid artificially increasing
+	// the span's duration in case some operation below takes a while.
+	et := internal.MonotonicEndTime(s.startTime)
+
+	// Do relative expensive check now that we have an end time and see if we
+	// need to do any more processing.
+	if !s.IsRecording() {
+		return
+	}
+
+	config := trace.NewSpanEndConfig(options...)
+	if recovered := recover(); recovered != nil {
+		// Record but don't stop the panic.
+		defer panic(recovered)
+		opts := []trace.EventOption{
+			trace.WithAttributes(
+				semconv.ExceptionType(typeStr(recovered)),
+				semconv.ExceptionMessage(fmt.Sprint(recovered)),
+			),
+		}
+
+		if config.StackTrace() {
+			opts = append(opts, trace.WithAttributes(
+				semconv.ExceptionStacktrace(recordStackTrace()),
+			))
+		}
+
+		s.addEvent(semconv.ExceptionEventName, opts...)
+	}
+
+	if s.executionTracerTaskEnd != nil {
+		s.executionTracerTaskEnd()
+	}
+
+	s.mu.Lock()
+	// Setting endTime to non-zero marks the span as ended and not recording.
+	if config.Timestamp().IsZero() {
+		s.endTime = et
+	} else {
+		s.endTime = config.Timestamp()
+	}
+	s.mu.Unlock()
+
+	sps := s.tracer.provider.spanProcessors.Load().(spanProcessorStates)
+	if len(sps) == 0 {
+		return
+	}
+	snap := s.snapshot()
+	for _, sp := range sps {
+		sp.sp.OnEnd(snap)
+	}
+}
+
+// RecordError will record err as a span event for this span. An additional call to
+// SetStatus is required if the Status of the Span should be set to Error, this method
+// does not change the Span status. If this span is not being recorded or err is nil
+// than this method does nothing.
+func (s *recordingSpan) RecordError(err error, opts ...trace.EventOption) {
+	if s == nil || err == nil || !s.IsRecording() {
+		return
+	}
+
+	opts = append(opts, trace.WithAttributes(
+		semconv.ExceptionType(typeStr(err)),
+		semconv.ExceptionMessage(err.Error()),
+	))
+
+	c := trace.NewEventConfig(opts...)
+	if c.StackTrace() {
+		opts = append(opts, trace.WithAttributes(
+			semconv.ExceptionStacktrace(recordStackTrace()),
+		))
+	}
+
+	s.addEvent(semconv.ExceptionEventName, opts...)
+}
+
+func typeStr(i interface{}) string {
+	t := reflect.TypeOf(i)
+	if t.PkgPath() == "" && t.Name() == "" {
+		// Likely a builtin type.
+		return t.String()
+	}
+	return fmt.Sprintf("%s.%s", t.PkgPath(), t.Name())
+}
+
+func recordStackTrace() string {
+	stackTrace := make([]byte, 2048)
+	n := runtime.Stack(stackTrace, false)
+
+	return string(stackTrace[0:n])
+}
+
+// AddEvent adds an event with the provided name and options. If this span is
+// not being recorded than this method does nothing.
+func (s *recordingSpan) AddEvent(name string, o ...trace.EventOption) {
+	if !s.IsRecording() {
+		return
+	}
+	s.addEvent(name, o...)
+}
+
+func (s *recordingSpan) addEvent(name string, o ...trace.EventOption) {
+	c := trace.NewEventConfig(o...)
+	e := Event{Name: name, Attributes: c.Attributes(), Time: c.Timestamp()}
+
+	// Discard attributes over limit.
+	limit := s.tracer.provider.spanLimits.AttributePerEventCountLimit
+	if limit == 0 {
+		// Drop all attributes.
+		e.DroppedAttributeCount = len(e.Attributes)
+		e.Attributes = nil
+	} else if limit > 0 && len(e.Attributes) > limit {
+		// Drop over capacity.
+		e.DroppedAttributeCount = len(e.Attributes) - limit
+		e.Attributes = e.Attributes[:limit]
+	}
+
+	s.mu.Lock()
+	s.events.add(e)
+	s.mu.Unlock()
+}
+
+// SetName sets the name of this span. If this span is not being recorded than
+// this method does nothing.
+func (s *recordingSpan) SetName(name string) {
+	if !s.IsRecording() {
+		return
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.name = name
+}
+
+// Name returns the name of this span.
+func (s *recordingSpan) Name() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.name
+}
+
+// Name returns the SpanContext of this span's parent span.
+func (s *recordingSpan) Parent() trace.SpanContext {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.parent
+}
+
+// SpanKind returns the SpanKind of this span.
+func (s *recordingSpan) SpanKind() trace.SpanKind {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.spanKind
+}
+
+// StartTime returns the time this span started.
+func (s *recordingSpan) StartTime() time.Time {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.startTime
+}
+
+// EndTime returns the time this span ended. For spans that have not yet
+// ended, the returned value will be the zero value of time.Time.
+func (s *recordingSpan) EndTime() time.Time {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.endTime
+}
+
+// Attributes returns the attributes of this span.
+//
+// The order of the returned attributes is not guaranteed to be stable.
+func (s *recordingSpan) Attributes() []attribute.KeyValue {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.dedupeAttrs()
+	return s.attributes
+}
+
+// dedupeAttrs deduplicates the attributes of s to fit capacity.
+//
+// This method assumes s.mu.Lock is held by the caller.
+func (s *recordingSpan) dedupeAttrs() {
+	// Do not set a capacity when creating this map. Benchmark testing has
+	// showed this to only add unused memory allocations in general use.
+	exists := make(map[attribute.Key]int)
+	s.dedupeAttrsFromRecord(&exists)
+}
+
+// dedupeAttrsFromRecord deduplicates the attributes of s to fit capacity
+// using record as the record of unique attribute keys to their index.
+//
+// This method assumes s.mu.Lock is held by the caller.
+func (s *recordingSpan) dedupeAttrsFromRecord(record *map[attribute.Key]int) {
+	// Use the fact that slices share the same backing array.
+	unique := s.attributes[:0]
+	for _, a := range s.attributes {
+		if idx, ok := (*record)[a.Key]; ok {
+			unique[idx] = a
+		} else {
+			unique = append(unique, a)
+			(*record)[a.Key] = len(unique) - 1
+		}
+	}
+	// s.attributes have element types of attribute.KeyValue. These types are
+	// not pointers and they themselves do not contain pointer fields,
+	// therefore the duplicate values do not need to be zeroed for them to be
+	// garbage collected.
+	s.attributes = unique
+}
+
+// Links returns the links of this span.
+func (s *recordingSpan) Links() []Link {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(s.links.queue) == 0 {
+		return []Link{}
+	}
+	return s.interfaceArrayToLinksArray()
+}
+
+// Events returns the events of this span.
+func (s *recordingSpan) Events() []Event {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(s.events.queue) == 0 {
+		return []Event{}
+	}
+	return s.interfaceArrayToEventArray()
+}
+
+// Status returns the status of this span.
+func (s *recordingSpan) Status() Status {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.status
+}
+
+// InstrumentationScope returns the instrumentation.Scope associated with
+// the Tracer that created this span.
+func (s *recordingSpan) InstrumentationScope() instrumentation.Scope {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.tracer.instrumentationScope
+}
+
+// InstrumentationLibrary returns the instrumentation.Library associated with
+// the Tracer that created this span.
+func (s *recordingSpan) InstrumentationLibrary() instrumentation.Library {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.tracer.instrumentationScope
+}
+
+// Resource returns the Resource associated with the Tracer that created this
+// span.
+func (s *recordingSpan) Resource() *resource.Resource {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.tracer.provider.resource
+}
+
+func (s *recordingSpan) addLink(link trace.Link) {
+	if !s.IsRecording() || !link.SpanContext.IsValid() {
+		return
+	}
+
+	l := Link{SpanContext: link.SpanContext, Attributes: link.Attributes}
+
+	// Discard attributes over limit.
+	limit := s.tracer.provider.spanLimits.AttributePerLinkCountLimit
+	if limit == 0 {
+		// Drop all attributes.
+		l.DroppedAttributeCount = len(l.Attributes)
+		l.Attributes = nil
+	} else if limit > 0 && len(l.Attributes) > limit {
+		l.DroppedAttributeCount = len(l.Attributes) - limit
+		l.Attributes = l.Attributes[:limit]
+	}
+
+	s.mu.Lock()
+	s.links.add(l)
+	s.mu.Unlock()
+}
+
+// DroppedAttributes returns the number of attributes dropped by the span
+// due to limits being reached.
+func (s *recordingSpan) DroppedAttributes() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.droppedAttributes
+}
+
+// DroppedLinks returns the number of links dropped by the span due to limits
+// being reached.
+func (s *recordingSpan) DroppedLinks() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.links.droppedCount
+}
+
+// DroppedEvents returns the number of events dropped by the span due to
+// limits being reached.
+func (s *recordingSpan) DroppedEvents() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.events.droppedCount
+}
+
+// ChildSpanCount returns the count of spans that consider the span a
+// direct parent.
+func (s *recordingSpan) ChildSpanCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.childSpanCount
+}
+
+// TracerProvider returns a trace.TracerProvider that can be used to generate
+// additional Spans on the same telemetry pipeline as the current Span.
+func (s *recordingSpan) TracerProvider() trace.TracerProvider {
+	return s.tracer.provider
+}
+
+// snapshot creates a read-only copy of the current state of the span.
+func (s *recordingSpan) snapshot() ReadOnlySpan {
+	var sd snapshot
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	sd.endTime = s.endTime
+	sd.instrumentationScope = s.tracer.instrumentationScope
+	sd.name = s.name
+	sd.parent = s.parent
+	sd.resource = s.tracer.provider.resource
+	sd.spanContext = s.spanContext
+	sd.spanKind = s.spanKind
+	sd.startTime = s.startTime
+	sd.status = s.status
+	sd.childSpanCount = s.childSpanCount
+
+	if len(s.attributes) > 0 {
+		s.dedupeAttrs()
+		sd.attributes = s.attributes
+	}
+	sd.droppedAttributeCount = s.droppedAttributes
+	if len(s.events.queue) > 0 {
+		sd.events = s.interfaceArrayToEventArray()
+		sd.droppedEventCount = s.events.droppedCount
+	}
+	if len(s.links.queue) > 0 {
+		sd.links = s.interfaceArrayToLinksArray()
+		sd.droppedLinkCount = s.links.droppedCount
+	}
+	return &sd
+}
+
+func (s *recordingSpan) interfaceArrayToLinksArray() []Link {
+	linkArr := make([]Link, 0)
+	for _, value := range s.links.queue {
+		linkArr = append(linkArr, value.(Link))
+	}
+	return linkArr
+}
+
+func (s *recordingSpan) interfaceArrayToEventArray() []Event {
+	eventArr := make([]Event, 0)
+	for _, value := range s.events.queue {
+		eventArr = append(eventArr, value.(Event))
+	}
+	return eventArr
+}
+
+func (s *recordingSpan) addChild() {
+	if !s.IsRecording() {
+		return
+	}
+	s.mu.Lock()
+	s.childSpanCount++
+	s.mu.Unlock()
+}
+
+func (*recordingSpan) private() {}
+
+// runtimeTrace starts a "runtime/trace".Task for the span and returns a
+// context containing the task.
+func (s *recordingSpan) runtimeTrace(ctx context.Context) context.Context {
+	if !rt.IsEnabled() {
+		// Avoid additional overhead if runtime/trace is not enabled.
+		return ctx
+	}
+	nctx, task := rt.NewTask(ctx, s.name)
+
+	s.mu.Lock()
+	s.executionTracerTaskEnd = task.End
+	s.mu.Unlock()
+
+	return nctx
+}
+
+// nonRecordingSpan is a minimal implementation of the OpenTelemetry Span API
+// that wraps a SpanContext. It performs no operations other than to return
+// the wrapped SpanContext or TracerProvider that created it.
+type nonRecordingSpan struct {
+	// tracer is the SDK tracer that created this span.
+	tracer *tracer
+	sc     trace.SpanContext
+}
+
+var _ trace.Span = nonRecordingSpan{}
+
+// SpanContext returns the wrapped SpanContext.
+func (s nonRecordingSpan) SpanContext() trace.SpanContext { return s.sc }
+
+// IsRecording always returns false.
+func (nonRecordingSpan) IsRecording() bool { return false }
+
+// SetStatus does nothing.
+func (nonRecordingSpan) SetStatus(codes.Code, string) {}
+
+// SetError does nothing.
+func (nonRecordingSpan) SetError(bool) {}
+
+// SetAttributes does nothing.
+func (nonRecordingSpan) SetAttributes(...attribute.KeyValue) {}
+
+// End does nothing.
+func (nonRecordingSpan) End(...trace.SpanEndOption) {}
+
+// RecordError does nothing.
+func (nonRecordingSpan) RecordError(error, ...trace.EventOption) {}
+
+// AddEvent does nothing.
+func (nonRecordingSpan) AddEvent(string, ...trace.EventOption) {}
+
+// SetName does nothing.
+func (nonRecordingSpan) SetName(string) {}
+
+// TracerProvider returns the trace.TracerProvider that provided the Tracer
+// that created this span.
+func (s nonRecordingSpan) TracerProvider() trace.TracerProvider { return s.tracer.provider }
+
+func isRecording(s SamplingResult) bool {
+	return s.Decision == RecordOnly || s.Decision == RecordAndSample
+}
+
+func isSampled(s SamplingResult) bool {
+	return s.Decision == RecordAndSample
+}
+
+// Status is the classified state of a Span.
+type Status struct {
+	// Code is an identifier of a Spans state classification.
+	Code codes.Code
+	// Description is a user hint about why that status was set. It is only
+	// applicable when Code is Error.
+	Description string
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/span_exporter.go b/vendor/go.opentelemetry.io/otel/sdk/trace/span_exporter.go
new file mode 100644
index 0000000000..9fb3d6eac3
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/span_exporter.go
@@ -0,0 +1,47 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import "context"
+
+// SpanExporter handles the delivery of spans to external receivers. This is
+// the final component in the trace export pipeline.
+type SpanExporter interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// ExportSpans exports a batch of spans.
+	//
+	// This function is called synchronously, so there is no concurrency
+	// safety requirement. However, due to the synchronous calling pattern,
+	// it is critical that all timeouts and cancellations contained in the
+	// passed context must be honored.
+	//
+	// Any retry logic must be contained in this function. The SDK that
+	// calls this function will not implement any retry logic. All errors
+	// returned by this function are considered unrecoverable and will be
+	// reported to a configured error Handler.
+	ExportSpans(ctx context.Context, spans []ReadOnlySpan) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Shutdown notifies the exporter of a pending halt to operations. The
+	// exporter is expected to preform any cleanup or synchronization it
+	// requires while honoring all timeouts and cancellations contained in
+	// the passed context.
+	Shutdown(ctx context.Context) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.go b/vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.go
new file mode 100644
index 0000000000..aa4d4221db
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/span_limits.go
@@ -0,0 +1,125 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import "go.opentelemetry.io/otel/sdk/internal/env"
+
+const (
+	// DefaultAttributeValueLengthLimit is the default maximum allowed
+	// attribute value length, unlimited.
+	DefaultAttributeValueLengthLimit = -1
+
+	// DefaultAttributeCountLimit is the default maximum number of attributes
+	// a span can have.
+	DefaultAttributeCountLimit = 128
+
+	// DefaultEventCountLimit is the default maximum number of events a span
+	// can have.
+	DefaultEventCountLimit = 128
+
+	// DefaultLinkCountLimit is the default maximum number of links a span can
+	// have.
+	DefaultLinkCountLimit = 128
+
+	// DefaultAttributePerEventCountLimit is the default maximum number of
+	// attributes a span event can have.
+	DefaultAttributePerEventCountLimit = 128
+
+	// DefaultAttributePerLinkCountLimit is the default maximum number of
+	// attributes a span link can have.
+	DefaultAttributePerLinkCountLimit = 128
+)
+
+// SpanLimits represents the limits of a span.
+type SpanLimits struct {
+	// AttributeValueLengthLimit is the maximum allowed attribute value length.
+	//
+	// This limit only applies to string and string slice attribute values.
+	// Any string longer than this value will be truncated to this length.
+	//
+	// Setting this to a negative value means no limit is applied.
+	AttributeValueLengthLimit int
+
+	// AttributeCountLimit is the maximum allowed span attribute count. Any
+	// attribute added to a span once this limit is reached will be dropped.
+	//
+	// Setting this to zero means no attributes will be recorded.
+	//
+	// Setting this to a negative value means no limit is applied.
+	AttributeCountLimit int
+
+	// EventCountLimit is the maximum allowed span event count. Any event
+	// added to a span once this limit is reached means it will be added but
+	// the oldest event will be dropped.
+	//
+	// Setting this to zero means no events we be recorded.
+	//
+	// Setting this to a negative value means no limit is applied.
+	EventCountLimit int
+
+	// LinkCountLimit is the maximum allowed span link count. Any link added
+	// to a span once this limit is reached means it will be added but the
+	// oldest link will be dropped.
+	//
+	// Setting this to zero means no links we be recorded.
+	//
+	// Setting this to a negative value means no limit is applied.
+	LinkCountLimit int
+
+	// AttributePerEventCountLimit is the maximum number of attributes allowed
+	// per span event. Any attribute added after this limit reached will be
+	// dropped.
+	//
+	// Setting this to zero means no attributes will be recorded for events.
+	//
+	// Setting this to a negative value means no limit is applied.
+	AttributePerEventCountLimit int
+
+	// AttributePerLinkCountLimit is the maximum number of attributes allowed
+	// per span link. Any attribute added after this limit reached will be
+	// dropped.
+	//
+	// Setting this to zero means no attributes will be recorded for links.
+	//
+	// Setting this to a negative value means no limit is applied.
+	AttributePerLinkCountLimit int
+}
+
+// NewSpanLimits returns a SpanLimits with all limits set to the value their
+// corresponding environment variable holds, or the default if unset.
+//
+// • AttributeValueLengthLimit: OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT
+// (default: unlimited)
+//
+// • AttributeCountLimit: OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT (default: 128)
+//
+// • EventCountLimit: OTEL_SPAN_EVENT_COUNT_LIMIT (default: 128)
+//
+// • AttributePerEventCountLimit: OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT (default:
+// 128)
+//
+// • LinkCountLimit: OTEL_SPAN_LINK_COUNT_LIMIT (default: 128)
+//
+// • AttributePerLinkCountLimit: OTEL_LINK_ATTRIBUTE_COUNT_LIMIT (default: 128)
+func NewSpanLimits() SpanLimits {
+	return SpanLimits{
+		AttributeValueLengthLimit:   env.SpanAttributeValueLength(DefaultAttributeValueLengthLimit),
+		AttributeCountLimit:         env.SpanAttributeCount(DefaultAttributeCountLimit),
+		EventCountLimit:             env.SpanEventCount(DefaultEventCountLimit),
+		LinkCountLimit:              env.SpanLinkCount(DefaultLinkCountLimit),
+		AttributePerEventCountLimit: env.SpanEventAttributeCount(DefaultAttributePerEventCountLimit),
+		AttributePerLinkCountLimit:  env.SpanLinkAttributeCount(DefaultAttributePerLinkCountLimit),
+	}
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/span_processor.go b/vendor/go.opentelemetry.io/otel/sdk/trace/span_processor.go
new file mode 100644
index 0000000000..e6ae193521
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/span_processor.go
@@ -0,0 +1,72 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"sync"
+)
+
+// SpanProcessor is a processing pipeline for spans in the trace signal.
+// SpanProcessors registered with a TracerProvider and are called at the start
+// and end of a Span's lifecycle, and are called in the order they are
+// registered.
+type SpanProcessor interface {
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// OnStart is called when a span is started. It is called synchronously
+	// and should not block.
+	OnStart(parent context.Context, s ReadWriteSpan)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// OnEnd is called when span is finished. It is called synchronously and
+	// hence not block.
+	OnEnd(s ReadOnlySpan)
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// Shutdown is called when the SDK shuts down. Any cleanup or release of
+	// resources held by the processor should be done in this call.
+	//
+	// Calls to OnStart, OnEnd, or ForceFlush after this has been called
+	// should be ignored.
+	//
+	// All timeouts and cancellations contained in ctx must be honored, this
+	// should not block indefinitely.
+	Shutdown(ctx context.Context) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+
+	// ForceFlush exports all ended spans to the configured Exporter that have not yet
+	// been exported.  It should only be called when absolutely necessary, such as when
+	// using a FaaS provider that may suspend the process after an invocation, but before
+	// the Processor can export the completed spans.
+	ForceFlush(ctx context.Context) error
+	// DO NOT CHANGE: any modification will not be backwards compatible and
+	// must never be done outside of a new major release.
+}
+
+type spanProcessorState struct {
+	sp    SpanProcessor
+	state *sync.Once
+}
+
+func newSpanProcessorState(sp SpanProcessor) *spanProcessorState {
+	return &spanProcessorState{sp: sp, state: &sync.Once{}}
+}
+
+type spanProcessorStates []*spanProcessorState
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/tracer.go b/vendor/go.opentelemetry.io/otel/sdk/trace/tracer.go
new file mode 100644
index 0000000000..f17d924b89
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/tracer.go
@@ -0,0 +1,161 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/sdk/trace"
+
+import (
+	"context"
+	"time"
+
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type tracer struct {
+	provider             *TracerProvider
+	instrumentationScope instrumentation.Scope
+}
+
+var _ trace.Tracer = &tracer{}
+
+// Start starts a Span and returns it along with a context containing it.
+//
+// The Span is created with the provided name and as a child of any existing
+// span context found in the passed context. The created Span will be
+// configured appropriately by any SpanOption passed.
+func (tr *tracer) Start(ctx context.Context, name string, options ...trace.SpanStartOption) (context.Context, trace.Span) {
+	config := trace.NewSpanStartConfig(options...)
+
+	if ctx == nil {
+		// Prevent trace.ContextWithSpan from panicking.
+		ctx = context.Background()
+	}
+
+	// For local spans created by this SDK, track child span count.
+	if p := trace.SpanFromContext(ctx); p != nil {
+		if sdkSpan, ok := p.(*recordingSpan); ok {
+			sdkSpan.addChild()
+		}
+	}
+
+	s := tr.newSpan(ctx, name, &config)
+	if rw, ok := s.(ReadWriteSpan); ok && s.IsRecording() {
+		sps := tr.provider.spanProcessors.Load().(spanProcessorStates)
+		for _, sp := range sps {
+			sp.sp.OnStart(ctx, rw)
+		}
+	}
+	if rtt, ok := s.(runtimeTracer); ok {
+		ctx = rtt.runtimeTrace(ctx)
+	}
+
+	return trace.ContextWithSpan(ctx, s), s
+}
+
+type runtimeTracer interface {
+	// runtimeTrace starts a "runtime/trace".Task for the span and
+	// returns a context containing the task.
+	runtimeTrace(ctx context.Context) context.Context
+}
+
+// newSpan returns a new configured span.
+func (tr *tracer) newSpan(ctx context.Context, name string, config *trace.SpanConfig) trace.Span {
+	// If told explicitly to make this a new root use a zero value SpanContext
+	// as a parent which contains an invalid trace ID and is not remote.
+	var psc trace.SpanContext
+	if config.NewRoot() {
+		ctx = trace.ContextWithSpanContext(ctx, psc)
+	} else {
+		psc = trace.SpanContextFromContext(ctx)
+	}
+
+	// If there is a valid parent trace ID, use it to ensure the continuity of
+	// the trace. Always generate a new span ID so other components can rely
+	// on a unique span ID, even if the Span is non-recording.
+	var tid trace.TraceID
+	var sid trace.SpanID
+	if !psc.TraceID().IsValid() {
+		tid, sid = tr.provider.idGenerator.NewIDs(ctx)
+	} else {
+		tid = psc.TraceID()
+		sid = tr.provider.idGenerator.NewSpanID(ctx, tid)
+	}
+
+	samplingResult := tr.provider.sampler.ShouldSample(SamplingParameters{
+		ParentContext: ctx,
+		TraceID:       tid,
+		Name:          name,
+		Kind:          config.SpanKind(),
+		Attributes:    config.Attributes(),
+		Links:         config.Links(),
+	})
+
+	scc := trace.SpanContextConfig{
+		TraceID:    tid,
+		SpanID:     sid,
+		TraceState: samplingResult.Tracestate,
+	}
+	if isSampled(samplingResult) {
+		scc.TraceFlags = psc.TraceFlags() | trace.FlagsSampled
+	} else {
+		scc.TraceFlags = psc.TraceFlags() &^ trace.FlagsSampled
+	}
+	sc := trace.NewSpanContext(scc)
+
+	if !isRecording(samplingResult) {
+		return tr.newNonRecordingSpan(sc)
+	}
+	return tr.newRecordingSpan(psc, sc, name, samplingResult, config)
+}
+
+// newRecordingSpan returns a new configured recordingSpan.
+func (tr *tracer) newRecordingSpan(psc, sc trace.SpanContext, name string, sr SamplingResult, config *trace.SpanConfig) *recordingSpan {
+	startTime := config.Timestamp()
+	if startTime.IsZero() {
+		startTime = time.Now()
+	}
+
+	s := &recordingSpan{
+		// Do not pre-allocate the attributes slice here! Doing so will
+		// allocate memory that is likely never going to be used, or if used,
+		// will be over-sized. The default Go compiler has been tested to
+		// dynamically allocate needed space very well. Benchmarking has shown
+		// it to be more performant than what we can predetermine here,
+		// especially for the common use case of few to no added
+		// attributes.
+
+		parent:      psc,
+		spanContext: sc,
+		spanKind:    trace.ValidateSpanKind(config.SpanKind()),
+		name:        name,
+		startTime:   startTime,
+		events:      newEvictedQueue(tr.provider.spanLimits.EventCountLimit),
+		links:       newEvictedQueue(tr.provider.spanLimits.LinkCountLimit),
+		tracer:      tr,
+	}
+
+	for _, l := range config.Links() {
+		s.addLink(l)
+	}
+
+	s.SetAttributes(sr.Attributes...)
+	s.SetAttributes(config.Attributes()...)
+
+	return s
+}
+
+// newNonRecordingSpan returns a new configured nonRecordingSpan.
+func (tr *tracer) newNonRecordingSpan(sc trace.SpanContext) nonRecordingSpan {
+	return nonRecordingSpan{tracer: tr, sc: sc}
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/exporter.go b/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/exporter.go
new file mode 100644
index 0000000000..104489e79f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/exporter.go
@@ -0,0 +1,85 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package tracetest is a testing helper package for the SDK. User can
+// configure no-op or in-memory exporters to verify different SDK behaviors or
+// custom instrumentation.
+package tracetest // import "go.opentelemetry.io/otel/sdk/trace/tracetest"
+
+import (
+	"context"
+	"sync"
+
+	"go.opentelemetry.io/otel/sdk/trace"
+)
+
+var _ trace.SpanExporter = (*NoopExporter)(nil)
+
+// NewNoopExporter returns a new no-op exporter.
+func NewNoopExporter() *NoopExporter {
+	return new(NoopExporter)
+}
+
+// NoopExporter is an exporter that drops all received spans and performs no
+// action.
+type NoopExporter struct{}
+
+// ExportSpans handles export of spans by dropping them.
+func (nsb *NoopExporter) ExportSpans(context.Context, []trace.ReadOnlySpan) error { return nil }
+
+// Shutdown stops the exporter by doing nothing.
+func (nsb *NoopExporter) Shutdown(context.Context) error { return nil }
+
+var _ trace.SpanExporter = (*InMemoryExporter)(nil)
+
+// NewInMemoryExporter returns a new InMemoryExporter.
+func NewInMemoryExporter() *InMemoryExporter {
+	return new(InMemoryExporter)
+}
+
+// InMemoryExporter is an exporter that stores all received spans in-memory.
+type InMemoryExporter struct {
+	mu sync.Mutex
+	ss SpanStubs
+}
+
+// ExportSpans handles export of spans by storing them in memory.
+func (imsb *InMemoryExporter) ExportSpans(_ context.Context, spans []trace.ReadOnlySpan) error {
+	imsb.mu.Lock()
+	defer imsb.mu.Unlock()
+	imsb.ss = append(imsb.ss, SpanStubsFromReadOnlySpans(spans)...)
+	return nil
+}
+
+// Shutdown stops the exporter by clearing spans held in memory.
+func (imsb *InMemoryExporter) Shutdown(context.Context) error {
+	imsb.Reset()
+	return nil
+}
+
+// Reset the current in-memory storage.
+func (imsb *InMemoryExporter) Reset() {
+	imsb.mu.Lock()
+	defer imsb.mu.Unlock()
+	imsb.ss = nil
+}
+
+// GetSpans returns the current in-memory stored spans.
+func (imsb *InMemoryExporter) GetSpans() SpanStubs {
+	imsb.mu.Lock()
+	defer imsb.mu.Unlock()
+	ret := make(SpanStubs, len(imsb.ss))
+	copy(ret, imsb.ss)
+	return ret
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/recorder.go b/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/recorder.go
new file mode 100644
index 0000000000..06673a1c04
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/recorder.go
@@ -0,0 +1,92 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tracetest // import "go.opentelemetry.io/otel/sdk/trace/tracetest"
+
+import (
+	"context"
+	"sync"
+
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+)
+
+// SpanRecorder records started and ended spans.
+type SpanRecorder struct {
+	startedMu sync.RWMutex
+	started   []sdktrace.ReadWriteSpan
+
+	endedMu sync.RWMutex
+	ended   []sdktrace.ReadOnlySpan
+}
+
+var _ sdktrace.SpanProcessor = (*SpanRecorder)(nil)
+
+// NewSpanRecorder returns a new initialized SpanRecorder.
+func NewSpanRecorder() *SpanRecorder {
+	return new(SpanRecorder)
+}
+
+// OnStart records started spans.
+//
+// This method is safe to be called concurrently.
+func (sr *SpanRecorder) OnStart(_ context.Context, s sdktrace.ReadWriteSpan) {
+	sr.startedMu.Lock()
+	defer sr.startedMu.Unlock()
+	sr.started = append(sr.started, s)
+}
+
+// OnEnd records completed spans.
+//
+// This method is safe to be called concurrently.
+func (sr *SpanRecorder) OnEnd(s sdktrace.ReadOnlySpan) {
+	sr.endedMu.Lock()
+	defer sr.endedMu.Unlock()
+	sr.ended = append(sr.ended, s)
+}
+
+// Shutdown does nothing.
+//
+// This method is safe to be called concurrently.
+func (sr *SpanRecorder) Shutdown(context.Context) error {
+	return nil
+}
+
+// ForceFlush does nothing.
+//
+// This method is safe to be called concurrently.
+func (sr *SpanRecorder) ForceFlush(context.Context) error {
+	return nil
+}
+
+// Started returns a copy of all started spans that have been recorded.
+//
+// This method is safe to be called concurrently.
+func (sr *SpanRecorder) Started() []sdktrace.ReadWriteSpan {
+	sr.startedMu.RLock()
+	defer sr.startedMu.RUnlock()
+	dst := make([]sdktrace.ReadWriteSpan, len(sr.started))
+	copy(dst, sr.started)
+	return dst
+}
+
+// Ended returns a copy of all ended spans that have been recorded.
+//
+// This method is safe to be called concurrently.
+func (sr *SpanRecorder) Ended() []sdktrace.ReadOnlySpan {
+	sr.endedMu.RLock()
+	defer sr.endedMu.RUnlock()
+	dst := make([]sdktrace.ReadOnlySpan, len(sr.ended))
+	copy(dst, sr.ended)
+	return dst
+}
diff --git a/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/span.go b/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/span.go
new file mode 100644
index 0000000000..bfe73de9c4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/sdk/trace/tracetest/span.go
@@ -0,0 +1,167 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tracetest // import "go.opentelemetry.io/otel/sdk/trace/tracetest"
+
+import (
+	"time"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/sdk/instrumentation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	tracesdk "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// SpanStubs is a slice of SpanStub use for testing an SDK.
+type SpanStubs []SpanStub
+
+// SpanStubsFromReadOnlySpans returns SpanStubs populated from ro.
+func SpanStubsFromReadOnlySpans(ro []tracesdk.ReadOnlySpan) SpanStubs {
+	if len(ro) == 0 {
+		return nil
+	}
+
+	s := make(SpanStubs, 0, len(ro))
+	for _, r := range ro {
+		s = append(s, SpanStubFromReadOnlySpan(r))
+	}
+
+	return s
+}
+
+// Snapshots returns s as a slice of ReadOnlySpans.
+func (s SpanStubs) Snapshots() []tracesdk.ReadOnlySpan {
+	if len(s) == 0 {
+		return nil
+	}
+
+	ro := make([]tracesdk.ReadOnlySpan, len(s))
+	for i := 0; i < len(s); i++ {
+		ro[i] = s[i].Snapshot()
+	}
+	return ro
+}
+
+// SpanStub is a stand-in for a Span.
+type SpanStub struct {
+	Name                   string
+	SpanContext            trace.SpanContext
+	Parent                 trace.SpanContext
+	SpanKind               trace.SpanKind
+	StartTime              time.Time
+	EndTime                time.Time
+	Attributes             []attribute.KeyValue
+	Events                 []tracesdk.Event
+	Links                  []tracesdk.Link
+	Status                 tracesdk.Status
+	DroppedAttributes      int
+	DroppedEvents          int
+	DroppedLinks           int
+	ChildSpanCount         int
+	Resource               *resource.Resource
+	InstrumentationLibrary instrumentation.Library
+}
+
+// SpanStubFromReadOnlySpan returns a SpanStub populated from ro.
+func SpanStubFromReadOnlySpan(ro tracesdk.ReadOnlySpan) SpanStub {
+	if ro == nil {
+		return SpanStub{}
+	}
+
+	return SpanStub{
+		Name:                   ro.Name(),
+		SpanContext:            ro.SpanContext(),
+		Parent:                 ro.Parent(),
+		SpanKind:               ro.SpanKind(),
+		StartTime:              ro.StartTime(),
+		EndTime:                ro.EndTime(),
+		Attributes:             ro.Attributes(),
+		Events:                 ro.Events(),
+		Links:                  ro.Links(),
+		Status:                 ro.Status(),
+		DroppedAttributes:      ro.DroppedAttributes(),
+		DroppedEvents:          ro.DroppedEvents(),
+		DroppedLinks:           ro.DroppedLinks(),
+		ChildSpanCount:         ro.ChildSpanCount(),
+		Resource:               ro.Resource(),
+		InstrumentationLibrary: ro.InstrumentationScope(),
+	}
+}
+
+// Snapshot returns a read-only copy of the SpanStub.
+func (s SpanStub) Snapshot() tracesdk.ReadOnlySpan {
+	return spanSnapshot{
+		name:                 s.Name,
+		spanContext:          s.SpanContext,
+		parent:               s.Parent,
+		spanKind:             s.SpanKind,
+		startTime:            s.StartTime,
+		endTime:              s.EndTime,
+		attributes:           s.Attributes,
+		events:               s.Events,
+		links:                s.Links,
+		status:               s.Status,
+		droppedAttributes:    s.DroppedAttributes,
+		droppedEvents:        s.DroppedEvents,
+		droppedLinks:         s.DroppedLinks,
+		childSpanCount:       s.ChildSpanCount,
+		resource:             s.Resource,
+		instrumentationScope: s.InstrumentationLibrary,
+	}
+}
+
+type spanSnapshot struct {
+	// Embed the interface to implement the private method.
+	tracesdk.ReadOnlySpan
+
+	name                 string
+	spanContext          trace.SpanContext
+	parent               trace.SpanContext
+	spanKind             trace.SpanKind
+	startTime            time.Time
+	endTime              time.Time
+	attributes           []attribute.KeyValue
+	events               []tracesdk.Event
+	links                []tracesdk.Link
+	status               tracesdk.Status
+	droppedAttributes    int
+	droppedEvents        int
+	droppedLinks         int
+	childSpanCount       int
+	resource             *resource.Resource
+	instrumentationScope instrumentation.Scope
+}
+
+func (s spanSnapshot) Name() string                     { return s.name }
+func (s spanSnapshot) SpanContext() trace.SpanContext   { return s.spanContext }
+func (s spanSnapshot) Parent() trace.SpanContext        { return s.parent }
+func (s spanSnapshot) SpanKind() trace.SpanKind         { return s.spanKind }
+func (s spanSnapshot) StartTime() time.Time             { return s.startTime }
+func (s spanSnapshot) EndTime() time.Time               { return s.endTime }
+func (s spanSnapshot) Attributes() []attribute.KeyValue { return s.attributes }
+func (s spanSnapshot) Links() []tracesdk.Link           { return s.links }
+func (s spanSnapshot) Events() []tracesdk.Event         { return s.events }
+func (s spanSnapshot) Status() tracesdk.Status          { return s.status }
+func (s spanSnapshot) DroppedAttributes() int           { return s.droppedAttributes }
+func (s spanSnapshot) DroppedLinks() int                { return s.droppedLinks }
+func (s spanSnapshot) DroppedEvents() int               { return s.droppedEvents }
+func (s spanSnapshot) ChildSpanCount() int              { return s.childSpanCount }
+func (s spanSnapshot) Resource() *resource.Resource     { return s.resource }
+func (s spanSnapshot) InstrumentationScope() instrumentation.Scope {
+	return s.instrumentationScope
+}
+func (s spanSnapshot) InstrumentationLibrary() instrumentation.Library {
+	return s.instrumentationScope
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/internal/http.go b/vendor/go.opentelemetry.io/otel/semconv/internal/http.go
new file mode 100644
index 0000000000..b580eedeff
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/internal/http.go
@@ -0,0 +1,336 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package internal // import "go.opentelemetry.io/otel/semconv/internal"
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// SemanticConventions are the semantic convention values defined for a
+// version of the OpenTelemetry specification.
+type SemanticConventions struct {
+	EnduserIDKey                attribute.Key
+	HTTPClientIPKey             attribute.Key
+	HTTPFlavorKey               attribute.Key
+	HTTPHostKey                 attribute.Key
+	HTTPMethodKey               attribute.Key
+	HTTPRequestContentLengthKey attribute.Key
+	HTTPRouteKey                attribute.Key
+	HTTPSchemeHTTP              attribute.KeyValue
+	HTTPSchemeHTTPS             attribute.KeyValue
+	HTTPServerNameKey           attribute.Key
+	HTTPStatusCodeKey           attribute.Key
+	HTTPTargetKey               attribute.Key
+	HTTPURLKey                  attribute.Key
+	HTTPUserAgentKey            attribute.Key
+	NetHostIPKey                attribute.Key
+	NetHostNameKey              attribute.Key
+	NetHostPortKey              attribute.Key
+	NetPeerIPKey                attribute.Key
+	NetPeerNameKey              attribute.Key
+	NetPeerPortKey              attribute.Key
+	NetTransportIP              attribute.KeyValue
+	NetTransportOther           attribute.KeyValue
+	NetTransportTCP             attribute.KeyValue
+	NetTransportUDP             attribute.KeyValue
+	NetTransportUnix            attribute.KeyValue
+}
+
+// NetAttributesFromHTTPRequest generates attributes of the net
+// namespace as specified by the OpenTelemetry specification for a
+// span.  The network parameter is a string that net.Dial function
+// from standard library can understand.
+func (sc *SemanticConventions) NetAttributesFromHTTPRequest(network string, request *http.Request) []attribute.KeyValue {
+	attrs := []attribute.KeyValue{}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		attrs = append(attrs, sc.NetTransportTCP)
+	case "udp", "udp4", "udp6":
+		attrs = append(attrs, sc.NetTransportUDP)
+	case "ip", "ip4", "ip6":
+		attrs = append(attrs, sc.NetTransportIP)
+	case "unix", "unixgram", "unixpacket":
+		attrs = append(attrs, sc.NetTransportUnix)
+	default:
+		attrs = append(attrs, sc.NetTransportOther)
+	}
+
+	peerIP, peerName, peerPort := hostIPNamePort(request.RemoteAddr)
+	if peerIP != "" {
+		attrs = append(attrs, sc.NetPeerIPKey.String(peerIP))
+	}
+	if peerName != "" {
+		attrs = append(attrs, sc.NetPeerNameKey.String(peerName))
+	}
+	if peerPort != 0 {
+		attrs = append(attrs, sc.NetPeerPortKey.Int(peerPort))
+	}
+
+	hostIP, hostName, hostPort := "", "", 0
+	for _, someHost := range []string{request.Host, request.Header.Get("Host"), request.URL.Host} {
+		hostIP, hostName, hostPort = hostIPNamePort(someHost)
+		if hostIP != "" || hostName != "" || hostPort != 0 {
+			break
+		}
+	}
+	if hostIP != "" {
+		attrs = append(attrs, sc.NetHostIPKey.String(hostIP))
+	}
+	if hostName != "" {
+		attrs = append(attrs, sc.NetHostNameKey.String(hostName))
+	}
+	if hostPort != 0 {
+		attrs = append(attrs, sc.NetHostPortKey.Int(hostPort))
+	}
+
+	return attrs
+}
+
+// hostIPNamePort extracts the IP address, name and (optional) port from hostWithPort.
+// It handles both IPv4 and IPv6 addresses. If the host portion is not recognized
+// as a valid IPv4 or IPv6 address, the `ip` result will be empty and the
+// host portion will instead be returned in `name`.
+func hostIPNamePort(hostWithPort string) (ip string, name string, port int) {
+	var (
+		hostPart, portPart string
+		parsedPort         uint64
+		err                error
+	)
+	if hostPart, portPart, err = net.SplitHostPort(hostWithPort); err != nil {
+		hostPart, portPart = hostWithPort, ""
+	}
+	if parsedIP := net.ParseIP(hostPart); parsedIP != nil {
+		ip = parsedIP.String()
+	} else {
+		name = hostPart
+	}
+	if parsedPort, err = strconv.ParseUint(portPart, 10, 16); err == nil {
+		port = int(parsedPort)
+	}
+	return
+}
+
+// EndUserAttributesFromHTTPRequest generates attributes of the
+// enduser namespace as specified by the OpenTelemetry specification
+// for a span.
+func (sc *SemanticConventions) EndUserAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	if username, _, ok := request.BasicAuth(); ok {
+		return []attribute.KeyValue{sc.EnduserIDKey.String(username)}
+	}
+	return nil
+}
+
+// HTTPClientAttributesFromHTTPRequest generates attributes of the
+// http namespace as specified by the OpenTelemetry specification for
+// a span on the client side.
+func (sc *SemanticConventions) HTTPClientAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	attrs := []attribute.KeyValue{}
+
+	// remove any username/password info that may be in the URL
+	// before adding it to the attributes
+	userinfo := request.URL.User
+	request.URL.User = nil
+
+	attrs = append(attrs, sc.HTTPURLKey.String(request.URL.String()))
+
+	// restore any username/password info that was removed
+	request.URL.User = userinfo
+
+	return append(attrs, sc.httpCommonAttributesFromHTTPRequest(request)...)
+}
+
+func (sc *SemanticConventions) httpCommonAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	attrs := []attribute.KeyValue{}
+	if ua := request.UserAgent(); ua != "" {
+		attrs = append(attrs, sc.HTTPUserAgentKey.String(ua))
+	}
+	if request.ContentLength > 0 {
+		attrs = append(attrs, sc.HTTPRequestContentLengthKey.Int64(request.ContentLength))
+	}
+
+	return append(attrs, sc.httpBasicAttributesFromHTTPRequest(request)...)
+}
+
+func (sc *SemanticConventions) httpBasicAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	// as these attributes are used by HTTPServerMetricAttributesFromHTTPRequest, they should be low-cardinality
+	attrs := []attribute.KeyValue{}
+
+	if request.TLS != nil {
+		attrs = append(attrs, sc.HTTPSchemeHTTPS)
+	} else {
+		attrs = append(attrs, sc.HTTPSchemeHTTP)
+	}
+
+	if request.Host != "" {
+		attrs = append(attrs, sc.HTTPHostKey.String(request.Host))
+	} else if request.URL != nil && request.URL.Host != "" {
+		attrs = append(attrs, sc.HTTPHostKey.String(request.URL.Host))
+	}
+
+	flavor := ""
+	if request.ProtoMajor == 1 {
+		flavor = fmt.Sprintf("1.%d", request.ProtoMinor)
+	} else if request.ProtoMajor == 2 {
+		flavor = "2"
+	}
+	if flavor != "" {
+		attrs = append(attrs, sc.HTTPFlavorKey.String(flavor))
+	}
+
+	if request.Method != "" {
+		attrs = append(attrs, sc.HTTPMethodKey.String(request.Method))
+	} else {
+		attrs = append(attrs, sc.HTTPMethodKey.String(http.MethodGet))
+	}
+
+	return attrs
+}
+
+// HTTPServerMetricAttributesFromHTTPRequest generates low-cardinality attributes
+// to be used with server-side HTTP metrics.
+func (sc *SemanticConventions) HTTPServerMetricAttributesFromHTTPRequest(serverName string, request *http.Request) []attribute.KeyValue {
+	attrs := []attribute.KeyValue{}
+	if serverName != "" {
+		attrs = append(attrs, sc.HTTPServerNameKey.String(serverName))
+	}
+	return append(attrs, sc.httpBasicAttributesFromHTTPRequest(request)...)
+}
+
+// HTTPServerAttributesFromHTTPRequest generates attributes of the
+// http namespace as specified by the OpenTelemetry specification for
+// a span on the server side. Currently, only basic authentication is
+// supported.
+func (sc *SemanticConventions) HTTPServerAttributesFromHTTPRequest(serverName, route string, request *http.Request) []attribute.KeyValue {
+	attrs := []attribute.KeyValue{
+		sc.HTTPTargetKey.String(request.RequestURI),
+	}
+
+	if serverName != "" {
+		attrs = append(attrs, sc.HTTPServerNameKey.String(serverName))
+	}
+	if route != "" {
+		attrs = append(attrs, sc.HTTPRouteKey.String(route))
+	}
+	if values, ok := request.Header["X-Forwarded-For"]; ok && len(values) > 0 {
+		if addresses := strings.SplitN(values[0], ",", 2); len(addresses) > 0 {
+			attrs = append(attrs, sc.HTTPClientIPKey.String(addresses[0]))
+		}
+	}
+
+	return append(attrs, sc.httpCommonAttributesFromHTTPRequest(request)...)
+}
+
+// HTTPAttributesFromHTTPStatusCode generates attributes of the http
+// namespace as specified by the OpenTelemetry specification for a
+// span.
+func (sc *SemanticConventions) HTTPAttributesFromHTTPStatusCode(code int) []attribute.KeyValue {
+	attrs := []attribute.KeyValue{
+		sc.HTTPStatusCodeKey.Int(code),
+	}
+	return attrs
+}
+
+type codeRange struct {
+	fromInclusive int
+	toInclusive   int
+}
+
+func (r codeRange) contains(code int) bool {
+	return r.fromInclusive <= code && code <= r.toInclusive
+}
+
+var validRangesPerCategory = map[int][]codeRange{
+	1: {
+		{http.StatusContinue, http.StatusEarlyHints},
+	},
+	2: {
+		{http.StatusOK, http.StatusAlreadyReported},
+		{http.StatusIMUsed, http.StatusIMUsed},
+	},
+	3: {
+		{http.StatusMultipleChoices, http.StatusUseProxy},
+		{http.StatusTemporaryRedirect, http.StatusPermanentRedirect},
+	},
+	4: {
+		{http.StatusBadRequest, http.StatusTeapot}, // yes, teapot is so useful…
+		{http.StatusMisdirectedRequest, http.StatusUpgradeRequired},
+		{http.StatusPreconditionRequired, http.StatusTooManyRequests},
+		{http.StatusRequestHeaderFieldsTooLarge, http.StatusRequestHeaderFieldsTooLarge},
+		{http.StatusUnavailableForLegalReasons, http.StatusUnavailableForLegalReasons},
+	},
+	5: {
+		{http.StatusInternalServerError, http.StatusLoopDetected},
+		{http.StatusNotExtended, http.StatusNetworkAuthenticationRequired},
+	},
+}
+
+// SpanStatusFromHTTPStatusCode generates a status code and a message
+// as specified by the OpenTelemetry specification for a span.
+func SpanStatusFromHTTPStatusCode(code int) (codes.Code, string) {
+	spanCode, valid := validateHTTPStatusCode(code)
+	if !valid {
+		return spanCode, fmt.Sprintf("Invalid HTTP status code %d", code)
+	}
+	return spanCode, ""
+}
+
+// SpanStatusFromHTTPStatusCodeAndSpanKind generates a status code and a message
+// as specified by the OpenTelemetry specification for a span.
+// Exclude 4xx for SERVER to set the appropriate status.
+func SpanStatusFromHTTPStatusCodeAndSpanKind(code int, spanKind trace.SpanKind) (codes.Code, string) {
+	spanCode, valid := validateHTTPStatusCode(code)
+	if !valid {
+		return spanCode, fmt.Sprintf("Invalid HTTP status code %d", code)
+	}
+	category := code / 100
+	if spanKind == trace.SpanKindServer && category == 4 {
+		return codes.Unset, ""
+	}
+	return spanCode, ""
+}
+
+// validateHTTPStatusCode validates the HTTP status code and returns
+// corresponding span status code. If the `code` is not a valid HTTP status
+// code, returns span status Error and false.
+func validateHTTPStatusCode(code int) (codes.Code, bool) {
+	category := code / 100
+	ranges, ok := validRangesPerCategory[category]
+	if !ok {
+		return codes.Error, false
+	}
+	ok = false
+	for _, crange := range ranges {
+		ok = crange.contains(code)
+		if ok {
+			break
+		}
+	}
+	if !ok {
+		return codes.Error, false
+	}
+	if category > 0 && category < 4 {
+		return codes.Unset, true
+	}
+	return codes.Error, true
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/doc.go b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/doc.go
new file mode 100644
index 0000000000..181fcc9c52
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/doc.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package semconv implements OpenTelemetry semantic conventions.
+//
+// OpenTelemetry semantic conventions are agreed standardized naming
+// patterns for OpenTelemetry things. This package represents the conventions
+// as of the v1.12.0 version of the OpenTelemetry specification.
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.12.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/exception.go b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/exception.go
new file mode 100644
index 0000000000..d689270943
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/exception.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.12.0"
+
+const (
+	// ExceptionEventName is the name of the Span event representing an exception.
+	ExceptionEventName = "exception"
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/http.go b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/http.go
new file mode 100644
index 0000000000..4b4f3cbaf0
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/http.go
@@ -0,0 +1,114 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.12.0"
+
+import (
+	"net/http"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/semconv/internal"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// HTTP scheme attributes.
+var (
+	HTTPSchemeHTTP  = HTTPSchemeKey.String("http")
+	HTTPSchemeHTTPS = HTTPSchemeKey.String("https")
+)
+
+var sc = &internal.SemanticConventions{
+	EnduserIDKey:                EnduserIDKey,
+	HTTPClientIPKey:             HTTPClientIPKey,
+	HTTPFlavorKey:               HTTPFlavorKey,
+	HTTPHostKey:                 HTTPHostKey,
+	HTTPMethodKey:               HTTPMethodKey,
+	HTTPRequestContentLengthKey: HTTPRequestContentLengthKey,
+	HTTPRouteKey:                HTTPRouteKey,
+	HTTPSchemeHTTP:              HTTPSchemeHTTP,
+	HTTPSchemeHTTPS:             HTTPSchemeHTTPS,
+	HTTPServerNameKey:           HTTPServerNameKey,
+	HTTPStatusCodeKey:           HTTPStatusCodeKey,
+	HTTPTargetKey:               HTTPTargetKey,
+	HTTPURLKey:                  HTTPURLKey,
+	HTTPUserAgentKey:            HTTPUserAgentKey,
+	NetHostIPKey:                NetHostIPKey,
+	NetHostNameKey:              NetHostNameKey,
+	NetHostPortKey:              NetHostPortKey,
+	NetPeerIPKey:                NetPeerIPKey,
+	NetPeerNameKey:              NetPeerNameKey,
+	NetPeerPortKey:              NetPeerPortKey,
+	NetTransportIP:              NetTransportIP,
+	NetTransportOther:           NetTransportOther,
+	NetTransportTCP:             NetTransportTCP,
+	NetTransportUDP:             NetTransportUDP,
+	NetTransportUnix:            NetTransportUnix,
+}
+
+// NetAttributesFromHTTPRequest generates attributes of the net
+// namespace as specified by the OpenTelemetry specification for a
+// span.  The network parameter is a string that net.Dial function
+// from standard library can understand.
+func NetAttributesFromHTTPRequest(network string, request *http.Request) []attribute.KeyValue {
+	return sc.NetAttributesFromHTTPRequest(network, request)
+}
+
+// EndUserAttributesFromHTTPRequest generates attributes of the
+// enduser namespace as specified by the OpenTelemetry specification
+// for a span.
+func EndUserAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	return sc.EndUserAttributesFromHTTPRequest(request)
+}
+
+// HTTPClientAttributesFromHTTPRequest generates attributes of the
+// http namespace as specified by the OpenTelemetry specification for
+// a span on the client side.
+func HTTPClientAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	return sc.HTTPClientAttributesFromHTTPRequest(request)
+}
+
+// HTTPServerMetricAttributesFromHTTPRequest generates low-cardinality attributes
+// to be used with server-side HTTP metrics.
+func HTTPServerMetricAttributesFromHTTPRequest(serverName string, request *http.Request) []attribute.KeyValue {
+	return sc.HTTPServerMetricAttributesFromHTTPRequest(serverName, request)
+}
+
+// HTTPServerAttributesFromHTTPRequest generates attributes of the
+// http namespace as specified by the OpenTelemetry specification for
+// a span on the server side. Currently, only basic authentication is
+// supported.
+func HTTPServerAttributesFromHTTPRequest(serverName, route string, request *http.Request) []attribute.KeyValue {
+	return sc.HTTPServerAttributesFromHTTPRequest(serverName, route, request)
+}
+
+// HTTPAttributesFromHTTPStatusCode generates attributes of the http
+// namespace as specified by the OpenTelemetry specification for a
+// span.
+func HTTPAttributesFromHTTPStatusCode(code int) []attribute.KeyValue {
+	return sc.HTTPAttributesFromHTTPStatusCode(code)
+}
+
+// SpanStatusFromHTTPStatusCode generates a status code and a message
+// as specified by the OpenTelemetry specification for a span.
+func SpanStatusFromHTTPStatusCode(code int) (codes.Code, string) {
+	return internal.SpanStatusFromHTTPStatusCode(code)
+}
+
+// SpanStatusFromHTTPStatusCodeAndSpanKind generates a status code and a message
+// as specified by the OpenTelemetry specification for a span.
+// Exclude 4xx for SERVER to set the appropriate status.
+func SpanStatusFromHTTPStatusCodeAndSpanKind(code int, spanKind trace.SpanKind) (codes.Code, string) {
+	return internal.SpanStatusFromHTTPStatusCodeAndSpanKind(code, spanKind)
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/resource.go b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/resource.go
new file mode 100644
index 0000000000..b2155676f4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/resource.go
@@ -0,0 +1,1042 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.12.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// The web browser in which the application represented by the resource is running. The `browser.*` attributes MUST be used only for resources that represent applications running in a web browser (regardless of whether running on a mobile or desktop device).
+const (
+	// Array of brand name and version separated by a space
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: ' Not A;Brand 99', 'Chromium 99', 'Chrome 99'
+	// Note: This value is intended to be taken from the [UA client hints
+	// API](https://wicg.github.io/ua-client-hints/#interface)
+	// (navigator.userAgentData.brands).
+	BrowserBrandsKey = attribute.Key("browser.brands")
+	// The platform on which the browser is running
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Windows', 'macOS', 'Android'
+	// Note: This value is intended to be taken from the [UA client hints
+	// API](https://wicg.github.io/ua-client-hints/#interface)
+	// (navigator.userAgentData.platform). If unavailable, the legacy
+	// `navigator.platform` API SHOULD NOT be used instead and this attribute SHOULD
+	// be left unset in order for the values to be consistent.
+	// The list of possible values is defined in the [W3C User-Agent Client Hints
+	// specification](https://wicg.github.io/ua-client-hints/#sec-ch-ua-platform).
+	// Note that some (but not all) of these values can overlap with values in the
+	// [os.type and os.name attributes](./os.md). However, for consistency, the values
+	// in the `browser.platform` attribute should capture the exact value that the
+	// user agent provides.
+	BrowserPlatformKey = attribute.Key("browser.platform")
+	// Full user-agent string provided by the browser
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
+	// (KHTML, '
+	//  'like Gecko) Chrome/95.0.4638.54 Safari/537.36'
+	// Note: The user-agent value SHOULD be provided only from browsers that do not
+	// have a mechanism to retrieve brands and platform individually from the User-
+	// Agent Client Hints API. To retrieve the value, the legacy `navigator.userAgent`
+	// API can be used.
+	BrowserUserAgentKey = attribute.Key("browser.user_agent")
+)
+
+// A cloud environment (e.g. GCP, Azure, AWS)
+const (
+	// Name of the cloud provider.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	CloudProviderKey = attribute.Key("cloud.provider")
+	// The cloud account ID the resource is assigned to.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '111111111111', 'opentelemetry'
+	CloudAccountIDKey = attribute.Key("cloud.account.id")
+	// The geographical region the resource is running.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'us-central1', 'us-east-1'
+	// Note: Refer to your provider's docs to see the available regions, for example
+	// [Alibaba Cloud regions](https://www.alibabacloud.com/help/doc-
+	// detail/40654.htm), [AWS regions](https://aws.amazon.com/about-aws/global-
+	// infrastructure/regions_az/), [Azure regions](https://azure.microsoft.com/en-
+	// us/global-infrastructure/geographies/), [Google Cloud
+	// regions](https://cloud.google.com/about/locations), or [Tencent Cloud
+	// regions](https://intl.cloud.tencent.com/document/product/213/6091).
+	CloudRegionKey = attribute.Key("cloud.region")
+	// Cloud regions often have multiple, isolated locations known as zones to
+	// increase availability. Availability zone represents the zone where the resource
+	// is running.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'us-east-1c'
+	// Note: Availability zones are called "zones" on Alibaba Cloud and Google Cloud.
+	CloudAvailabilityZoneKey = attribute.Key("cloud.availability_zone")
+	// The cloud platform in use.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Note: The prefix of the service SHOULD match the one specified in
+	// `cloud.provider`.
+	CloudPlatformKey = attribute.Key("cloud.platform")
+)
+
+var (
+	// Alibaba Cloud
+	CloudProviderAlibabaCloud = CloudProviderKey.String("alibaba_cloud")
+	// Amazon Web Services
+	CloudProviderAWS = CloudProviderKey.String("aws")
+	// Microsoft Azure
+	CloudProviderAzure = CloudProviderKey.String("azure")
+	// Google Cloud Platform
+	CloudProviderGCP = CloudProviderKey.String("gcp")
+	// Tencent Cloud
+	CloudProviderTencentCloud = CloudProviderKey.String("tencent_cloud")
+)
+
+var (
+	// Alibaba Cloud Elastic Compute Service
+	CloudPlatformAlibabaCloudECS = CloudPlatformKey.String("alibaba_cloud_ecs")
+	// Alibaba Cloud Function Compute
+	CloudPlatformAlibabaCloudFc = CloudPlatformKey.String("alibaba_cloud_fc")
+	// AWS Elastic Compute Cloud
+	CloudPlatformAWSEC2 = CloudPlatformKey.String("aws_ec2")
+	// AWS Elastic Container Service
+	CloudPlatformAWSECS = CloudPlatformKey.String("aws_ecs")
+	// AWS Elastic Kubernetes Service
+	CloudPlatformAWSEKS = CloudPlatformKey.String("aws_eks")
+	// AWS Lambda
+	CloudPlatformAWSLambda = CloudPlatformKey.String("aws_lambda")
+	// AWS Elastic Beanstalk
+	CloudPlatformAWSElasticBeanstalk = CloudPlatformKey.String("aws_elastic_beanstalk")
+	// AWS App Runner
+	CloudPlatformAWSAppRunner = CloudPlatformKey.String("aws_app_runner")
+	// Azure Virtual Machines
+	CloudPlatformAzureVM = CloudPlatformKey.String("azure_vm")
+	// Azure Container Instances
+	CloudPlatformAzureContainerInstances = CloudPlatformKey.String("azure_container_instances")
+	// Azure Kubernetes Service
+	CloudPlatformAzureAKS = CloudPlatformKey.String("azure_aks")
+	// Azure Functions
+	CloudPlatformAzureFunctions = CloudPlatformKey.String("azure_functions")
+	// Azure App Service
+	CloudPlatformAzureAppService = CloudPlatformKey.String("azure_app_service")
+	// Google Cloud Compute Engine (GCE)
+	CloudPlatformGCPComputeEngine = CloudPlatformKey.String("gcp_compute_engine")
+	// Google Cloud Run
+	CloudPlatformGCPCloudRun = CloudPlatformKey.String("gcp_cloud_run")
+	// Google Cloud Kubernetes Engine (GKE)
+	CloudPlatformGCPKubernetesEngine = CloudPlatformKey.String("gcp_kubernetes_engine")
+	// Google Cloud Functions (GCF)
+	CloudPlatformGCPCloudFunctions = CloudPlatformKey.String("gcp_cloud_functions")
+	// Google Cloud App Engine (GAE)
+	CloudPlatformGCPAppEngine = CloudPlatformKey.String("gcp_app_engine")
+	// Tencent Cloud Cloud Virtual Machine (CVM)
+	CloudPlatformTencentCloudCvm = CloudPlatformKey.String("tencent_cloud_cvm")
+	// Tencent Cloud Elastic Kubernetes Service (EKS)
+	CloudPlatformTencentCloudEKS = CloudPlatformKey.String("tencent_cloud_eks")
+	// Tencent Cloud Serverless Cloud Function (SCF)
+	CloudPlatformTencentCloudScf = CloudPlatformKey.String("tencent_cloud_scf")
+)
+
+// Resources used by AWS Elastic Container Service (ECS).
+const (
+	// The Amazon Resource Name (ARN) of an [ECS container instance](https://docs.aws.
+	// amazon.com/AmazonECS/latest/developerguide/ECS_instances.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-
+	// west-1:123456789123:container/32624152-9086-4f0e-acae-1a75b14fe4d9'
+	AWSECSContainerARNKey = attribute.Key("aws.ecs.container.arn")
+	// The ARN of an [ECS cluster](https://docs.aws.amazon.com/AmazonECS/latest/develo
+	// perguide/clusters.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-west-2:123456789123:cluster/my-cluster'
+	AWSECSClusterARNKey = attribute.Key("aws.ecs.cluster.arn")
+	// The [launch type](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/l
+	// aunch_types.html) for an ECS task.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	AWSECSLaunchtypeKey = attribute.Key("aws.ecs.launchtype")
+	// The ARN of an [ECS task definition](https://docs.aws.amazon.com/AmazonECS/lates
+	// t/developerguide/task_definitions.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-
+	// west-1:123456789123:task/10838bed-421f-43ef-870a-f43feacbbb5b'
+	AWSECSTaskARNKey = attribute.Key("aws.ecs.task.arn")
+	// The task definition family this task definition is a member of.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-family'
+	AWSECSTaskFamilyKey = attribute.Key("aws.ecs.task.family")
+	// The revision for this task definition.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '8', '26'
+	AWSECSTaskRevisionKey = attribute.Key("aws.ecs.task.revision")
+)
+
+var (
+	// ec2
+	AWSECSLaunchtypeEC2 = AWSECSLaunchtypeKey.String("ec2")
+	// fargate
+	AWSECSLaunchtypeFargate = AWSECSLaunchtypeKey.String("fargate")
+)
+
+// Resources used by AWS Elastic Kubernetes Service (EKS).
+const (
+	// The ARN of an EKS cluster.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-west-2:123456789123:cluster/my-cluster'
+	AWSEKSClusterARNKey = attribute.Key("aws.eks.cluster.arn")
+)
+
+// Resources specific to Amazon Web Services.
+const (
+	// The name(s) of the AWS log group(s) an application is writing to.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '/aws/lambda/my-function', 'opentelemetry-service'
+	// Note: Multiple log groups must be supported for cases like multi-container
+	// applications, where a single application has sidecar containers, and each write
+	// to their own log group.
+	AWSLogGroupNamesKey = attribute.Key("aws.log.group.names")
+	// The Amazon Resource Name(s) (ARN) of the AWS log group(s).
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:logs:us-west-1:123456789012:log-group:/aws/my/group:*'
+	// Note: See the [log group ARN format
+	// documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-
+	// access-control-overview-cwl.html#CWL_ARN_Format).
+	AWSLogGroupARNsKey = attribute.Key("aws.log.group.arns")
+	// The name(s) of the AWS log stream(s) an application is writing to.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'logs/main/10838bed-421f-43ef-870a-f43feacbbb5b'
+	AWSLogStreamNamesKey = attribute.Key("aws.log.stream.names")
+	// The ARN(s) of the AWS log stream(s).
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:logs:us-west-1:123456789012:log-group:/aws/my/group:log-
+	// stream:logs/main/10838bed-421f-43ef-870a-f43feacbbb5b'
+	// Note: See the [log stream ARN format
+	// documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-
+	// access-control-overview-cwl.html#CWL_ARN_Format). One log group can contain
+	// several log streams, so these ARNs necessarily identify both a log group and a
+	// log stream.
+	AWSLogStreamARNsKey = attribute.Key("aws.log.stream.arns")
+)
+
+// A container instance.
+const (
+	// Container name used by container runtime.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-autoconf'
+	ContainerNameKey = attribute.Key("container.name")
+	// Container ID. Usually a UUID, as for example used to [identify Docker
+	// containers](https://docs.docker.com/engine/reference/run/#container-
+	// identification). The UUID might be abbreviated.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'a3bf90e006b2'
+	ContainerIDKey = attribute.Key("container.id")
+	// The container runtime managing this container.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'docker', 'containerd', 'rkt'
+	ContainerRuntimeKey = attribute.Key("container.runtime")
+	// Name of the image the container was built on.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'gcr.io/opentelemetry/operator'
+	ContainerImageNameKey = attribute.Key("container.image.name")
+	// Container image tag.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0.1'
+	ContainerImageTagKey = attribute.Key("container.image.tag")
+)
+
+// The software deployment.
+const (
+	// Name of the [deployment
+	// environment](https://en.wikipedia.org/wiki/Deployment_environment) (aka
+	// deployment tier).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'staging', 'production'
+	DeploymentEnvironmentKey = attribute.Key("deployment.environment")
+)
+
+// The device on which the process represented by this resource is running.
+const (
+	// A unique identifier representing the device
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '2ab2916d-a51f-4ac8-80ee-45ac31a28092'
+	// Note: The device identifier MUST only be defined using the values outlined
+	// below. This value is not an advertising identifier and MUST NOT be used as
+	// such. On iOS (Swift or Objective-C), this value MUST be equal to the [vendor id
+	// entifier](https://developer.apple.com/documentation/uikit/uidevice/1620059-iden
+	// tifierforvendor). On Android (Java or Kotlin), this value MUST be equal to the
+	// Firebase Installation ID or a globally unique UUID which is persisted across
+	// sessions in your application. More information can be found
+	// [here](https://developer.android.com/training/articles/user-data-ids) on best
+	// practices and exact implementation details. Caution should be taken when
+	// storing personal data or anything which can identify a user. GDPR and data
+	// protection laws may apply, ensure you do your own due diligence.
+	DeviceIDKey = attribute.Key("device.id")
+	// The model identifier for the device
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'iPhone3,4', 'SM-G920F'
+	// Note: It's recommended this value represents a machine readable version of the
+	// model identifier rather than the market or consumer-friendly name of the
+	// device.
+	DeviceModelIdentifierKey = attribute.Key("device.model.identifier")
+	// The marketing name for the device model
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'iPhone 6s Plus', 'Samsung Galaxy S6'
+	// Note: It's recommended this value represents a human readable version of the
+	// device model rather than a machine readable alternative.
+	DeviceModelNameKey = attribute.Key("device.model.name")
+	// The name of the device manufacturer
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Apple', 'Samsung'
+	// Note: The Android OS provides this field via
+	// [Build](https://developer.android.com/reference/android/os/Build#MANUFACTURER).
+	// iOS apps SHOULD hardcode the value `Apple`.
+	DeviceManufacturerKey = attribute.Key("device.manufacturer")
+)
+
+// A serverless instance.
+const (
+	// The name of the single function that this runtime instance executes.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'my-function', 'myazurefunctionapp/some-function-name'
+	// Note: This is the name of the function as configured/deployed on the FaaS
+	// platform and is usually different from the name of the callback
+	// function (which may be stored in the
+	// [`code.namespace`/`code.function`](../../trace/semantic_conventions/span-
+	// general.md#source-code-attributes)
+	// span attributes).
+
+	// For some cloud providers, the above definition is ambiguous. The following
+	// definition of function name MUST be used for this attribute
+	// (and consequently the span name) for the listed cloud providers/products:
+
+	// * **Azure:**  The full name `<FUNCAPP>/<FUNC>`, i.e., function app name
+	//   followed by a forward slash followed by the function name (this form
+	//   can also be seen in the resource JSON for the function).
+	//   This means that a span attribute MUST be used, as an Azure function
+	//   app can host multiple functions that would usually share
+	//   a TracerProvider (see also the `faas.id` attribute).
+	FaaSNameKey = attribute.Key("faas.name")
+	// The unique ID of the single function that this runtime instance executes.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:lambda:us-west-2:123456789012:function:my-function'
+	// Note: On some cloud providers, it may not be possible to determine the full ID
+	// at startup,
+	// so consider setting `faas.id` as a span attribute instead.
+
+	// The exact value to use for `faas.id` depends on the cloud provider:
+
+	// * **AWS Lambda:** The function
+	// [ARN](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-
+	// namespaces.html).
+	//   Take care not to use the "invoked ARN" directly but replace any
+	//   [alias suffix](https://docs.aws.amazon.com/lambda/latest/dg/configuration-
+	// aliases.html)
+	//   with the resolved function version, as the same runtime instance may be
+	// invokable with
+	//   multiple different aliases.
+	// * **GCP:** The [URI of the resource](https://cloud.google.com/iam/docs/full-
+	// resource-names)
+	// * **Azure:** The [Fully Qualified Resource ID](https://docs.microsoft.com/en-
+	// us/rest/api/resources/resources/get-by-id) of the invoked function,
+	//   *not* the function app, having the form
+	//   `/subscriptions/<SUBSCIPTION_GUID>/resourceGroups/<RG>/providers/Microsoft.We
+	// b/sites/<FUNCAPP>/functions/<FUNC>`.
+	//   This means that a span attribute MUST be used, as an Azure function app can
+	// host multiple functions that would usually share
+	//   a TracerProvider.
+	FaaSIDKey = attribute.Key("faas.id")
+	// The immutable version of the function being executed.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '26', 'pinkfroid-00002'
+	// Note: Depending on the cloud provider and platform, use:
+
+	// * **AWS Lambda:** The [function
+	// version](https://docs.aws.amazon.com/lambda/latest/dg/configuration-
+	// versions.html)
+	//   (an integer represented as a decimal string).
+	// * **Google Cloud Run:** The
+	// [revision](https://cloud.google.com/run/docs/managing/revisions)
+	//   (i.e., the function name plus the revision suffix).
+	// * **Google Cloud Functions:** The value of the
+	//   [`K_REVISION` environment
+	// variable](https://cloud.google.com/functions/docs/env-
+	// var#runtime_environment_variables_set_automatically).
+	// * **Azure Functions:** Not applicable. Do not set this attribute.
+	FaaSVersionKey = attribute.Key("faas.version")
+	// The execution environment ID as a string, that will be potentially reused for
+	// other invocations to the same function/function version.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '2021/06/28/[$LATEST]2f399eb14537447da05ab2a2e39309de'
+	// Note: * **AWS Lambda:** Use the (full) log stream name.
+	FaaSInstanceKey = attribute.Key("faas.instance")
+	// The amount of memory available to the serverless function in MiB.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 128
+	// Note: It's recommended to set this attribute since e.g. too little memory can
+	// easily stop a Java AWS Lambda function from working correctly. On AWS Lambda,
+	// the environment variable `AWS_LAMBDA_FUNCTION_MEMORY_SIZE` provides this
+	// information.
+	FaaSMaxMemoryKey = attribute.Key("faas.max_memory")
+)
+
+// A host is defined as a general computing instance.
+const (
+	// Unique host ID. For Cloud, this must be the instance_id assigned by the cloud
+	// provider.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-test'
+	HostIDKey = attribute.Key("host.id")
+	// Name of the host. On Unix systems, it may contain what the hostname command
+	// returns, or the fully qualified hostname, or another name specified by the
+	// user.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-test'
+	HostNameKey = attribute.Key("host.name")
+	// Type of host. For Cloud, this must be the machine type.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'n1-standard-1'
+	HostTypeKey = attribute.Key("host.type")
+	// The CPU architecture the host system is running on.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	HostArchKey = attribute.Key("host.arch")
+	// Name of the VM image or OS install the host was instantiated from.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'infra-ami-eks-worker-node-7d4ec78312', 'CentOS-8-x86_64-1905'
+	HostImageNameKey = attribute.Key("host.image.name")
+	// VM image ID. For Cloud, this value is from the provider.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'ami-07b06b442921831e5'
+	HostImageIDKey = attribute.Key("host.image.id")
+	// The version string of the VM image as defined in [Version
+	// Attributes](README.md#version-attributes).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0.1'
+	HostImageVersionKey = attribute.Key("host.image.version")
+)
+
+var (
+	// AMD64
+	HostArchAMD64 = HostArchKey.String("amd64")
+	// ARM32
+	HostArchARM32 = HostArchKey.String("arm32")
+	// ARM64
+	HostArchARM64 = HostArchKey.String("arm64")
+	// Itanium
+	HostArchIA64 = HostArchKey.String("ia64")
+	// 32-bit PowerPC
+	HostArchPPC32 = HostArchKey.String("ppc32")
+	// 64-bit PowerPC
+	HostArchPPC64 = HostArchKey.String("ppc64")
+	// IBM z/Architecture
+	HostArchS390x = HostArchKey.String("s390x")
+	// 32-bit x86
+	HostArchX86 = HostArchKey.String("x86")
+)
+
+// A Kubernetes Cluster.
+const (
+	// The name of the cluster.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-cluster'
+	K8SClusterNameKey = attribute.Key("k8s.cluster.name")
+)
+
+// A Kubernetes Node object.
+const (
+	// The name of the Node.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'node-1'
+	K8SNodeNameKey = attribute.Key("k8s.node.name")
+	// The UID of the Node.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '1eb3a0c6-0477-4080-a9cb-0cb7db65c6a2'
+	K8SNodeUIDKey = attribute.Key("k8s.node.uid")
+)
+
+// A Kubernetes Namespace.
+const (
+	// The name of the namespace that the pod is running in.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'default'
+	K8SNamespaceNameKey = attribute.Key("k8s.namespace.name")
+)
+
+// A Kubernetes Pod object.
+const (
+	// The UID of the Pod.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SPodUIDKey = attribute.Key("k8s.pod.uid")
+	// The name of the Pod.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-pod-autoconf'
+	K8SPodNameKey = attribute.Key("k8s.pod.name")
+)
+
+// A container in a [PodTemplate](https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates).
+const (
+	// The name of the Container from Pod specification, must be unique within a Pod.
+	// Container runtime usually uses different globally unique name
+	// (`container.name`).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'redis'
+	K8SContainerNameKey = attribute.Key("k8s.container.name")
+	// Number of times the container was restarted. This attribute can be used to
+	// identify a particular container (running or stopped) within a container spec.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 0, 2
+	K8SContainerRestartCountKey = attribute.Key("k8s.container.restart_count")
+)
+
+// A Kubernetes ReplicaSet object.
+const (
+	// The UID of the ReplicaSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SReplicaSetUIDKey = attribute.Key("k8s.replicaset.uid")
+	// The name of the ReplicaSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SReplicaSetNameKey = attribute.Key("k8s.replicaset.name")
+)
+
+// A Kubernetes Deployment object.
+const (
+	// The UID of the Deployment.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SDeploymentUIDKey = attribute.Key("k8s.deployment.uid")
+	// The name of the Deployment.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SDeploymentNameKey = attribute.Key("k8s.deployment.name")
+)
+
+// A Kubernetes StatefulSet object.
+const (
+	// The UID of the StatefulSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SStatefulSetUIDKey = attribute.Key("k8s.statefulset.uid")
+	// The name of the StatefulSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SStatefulSetNameKey = attribute.Key("k8s.statefulset.name")
+)
+
+// A Kubernetes DaemonSet object.
+const (
+	// The UID of the DaemonSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SDaemonSetUIDKey = attribute.Key("k8s.daemonset.uid")
+	// The name of the DaemonSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SDaemonSetNameKey = attribute.Key("k8s.daemonset.name")
+)
+
+// A Kubernetes Job object.
+const (
+	// The UID of the Job.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SJobUIDKey = attribute.Key("k8s.job.uid")
+	// The name of the Job.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SJobNameKey = attribute.Key("k8s.job.name")
+)
+
+// A Kubernetes CronJob object.
+const (
+	// The UID of the CronJob.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SCronJobUIDKey = attribute.Key("k8s.cronjob.uid")
+	// The name of the CronJob.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SCronJobNameKey = attribute.Key("k8s.cronjob.name")
+)
+
+// The operating system (OS) on which the process represented by this resource is running.
+const (
+	// The operating system type.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	OSTypeKey = attribute.Key("os.type")
+	// Human readable (not intended to be parsed) OS version information, like e.g.
+	// reported by `ver` or `lsb_release -a` commands.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Microsoft Windows [Version 10.0.18363.778]', 'Ubuntu 18.04.1 LTS'
+	OSDescriptionKey = attribute.Key("os.description")
+	// Human readable operating system name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'iOS', 'Android', 'Ubuntu'
+	OSNameKey = attribute.Key("os.name")
+	// The version string of the operating system as defined in [Version
+	// Attributes](../../resource/semantic_conventions/README.md#version-attributes).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '14.2.1', '18.04.1'
+	OSVersionKey = attribute.Key("os.version")
+)
+
+var (
+	// Microsoft Windows
+	OSTypeWindows = OSTypeKey.String("windows")
+	// Linux
+	OSTypeLinux = OSTypeKey.String("linux")
+	// Apple Darwin
+	OSTypeDarwin = OSTypeKey.String("darwin")
+	// FreeBSD
+	OSTypeFreeBSD = OSTypeKey.String("freebsd")
+	// NetBSD
+	OSTypeNetBSD = OSTypeKey.String("netbsd")
+	// OpenBSD
+	OSTypeOpenBSD = OSTypeKey.String("openbsd")
+	// DragonFly BSD
+	OSTypeDragonflyBSD = OSTypeKey.String("dragonflybsd")
+	// HP-UX (Hewlett Packard Unix)
+	OSTypeHPUX = OSTypeKey.String("hpux")
+	// AIX (Advanced Interactive eXecutive)
+	OSTypeAIX = OSTypeKey.String("aix")
+	// SunOS, Oracle Solaris
+	OSTypeSolaris = OSTypeKey.String("solaris")
+	// IBM z/OS
+	OSTypeZOS = OSTypeKey.String("z_os")
+)
+
+// An operating system process.
+const (
+	// Process identifier (PID).
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 1234
+	ProcessPIDKey = attribute.Key("process.pid")
+	// The name of the process executable. On Linux based systems, can be set to the
+	// `Name` in `proc/[pid]/status`. On Windows, can be set to the base name of
+	// `GetProcessImageFileNameW`.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: 'otelcol'
+	ProcessExecutableNameKey = attribute.Key("process.executable.name")
+	// The full path to the process executable. On Linux based systems, can be set to
+	// the target of `proc/[pid]/exe`. On Windows, can be set to the result of
+	// `GetProcessImageFileNameW`.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: '/usr/bin/cmd/otelcol'
+	ProcessExecutablePathKey = attribute.Key("process.executable.path")
+	// The command used to launch the process (i.e. the command name). On Linux based
+	// systems, can be set to the zeroth string in `proc/[pid]/cmdline`. On Windows,
+	// can be set to the first parameter extracted from `GetCommandLineW`.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: 'cmd/otelcol'
+	ProcessCommandKey = attribute.Key("process.command")
+	// The full command used to launch the process as a single string representing the
+	// full command. On Windows, can be set to the result of `GetCommandLineW`. Do not
+	// set this if you have to assemble it just for monitoring; use
+	// `process.command_args` instead.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: 'C:\\cmd\\otecol --config="my directory\\config.yaml"'
+	ProcessCommandLineKey = attribute.Key("process.command_line")
+	// All the command arguments (including the command/executable itself) as received
+	// by the process. On Linux-based systems (and some other Unixoid systems
+	// supporting procfs), can be set according to the list of null-delimited strings
+	// extracted from `proc/[pid]/cmdline`. For libc-based executables, this would be
+	// the full argv vector passed to `main`.
+	//
+	// Type: string[]
+	// Required: See below
+	// Stability: stable
+	// Examples: 'cmd/otecol', '--config=config.yaml'
+	ProcessCommandArgsKey = attribute.Key("process.command_args")
+	// The username of the user that owns the process.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'root'
+	ProcessOwnerKey = attribute.Key("process.owner")
+)
+
+// The single (language) runtime instance which is monitored.
+const (
+	// The name of the runtime of this process. For compiled native binaries, this
+	// SHOULD be the name of the compiler.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'OpenJDK Runtime Environment'
+	ProcessRuntimeNameKey = attribute.Key("process.runtime.name")
+	// The version of the runtime of this process, as returned by the runtime without
+	// modification.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '14.0.2'
+	ProcessRuntimeVersionKey = attribute.Key("process.runtime.version")
+	// An additional description about the runtime of the process, for example a
+	// specific vendor customization of the runtime environment.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Eclipse OpenJ9 Eclipse OpenJ9 VM openj9-0.21.0'
+	ProcessRuntimeDescriptionKey = attribute.Key("process.runtime.description")
+)
+
+// A service instance.
+const (
+	// Logical name of the service.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'shoppingcart'
+	// Note: MUST be the same for all instances of horizontally scaled services. If
+	// the value was not specified, SDKs MUST fallback to `unknown_service:`
+	// concatenated with [`process.executable.name`](process.md#process), e.g.
+	// `unknown_service:bash`. If `process.executable.name` is not available, the
+	// value MUST be set to `unknown_service`.
+	ServiceNameKey = attribute.Key("service.name")
+	// A namespace for `service.name`.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Shop'
+	// Note: A string value having a meaning that helps to distinguish a group of
+	// services, for example the team name that owns a group of services.
+	// `service.name` is expected to be unique within the same namespace. If
+	// `service.namespace` is not specified in the Resource then `service.name` is
+	// expected to be unique for all services that have no explicit namespace defined
+	// (so the empty/unspecified namespace is simply one more valid namespace). Zero-
+	// length namespace string is assumed equal to unspecified namespace.
+	ServiceNamespaceKey = attribute.Key("service.namespace")
+	// The string ID of the service instance.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '627cc493-f310-47de-96bd-71410b7dec09'
+	// Note: MUST be unique for each instance of the same
+	// `service.namespace,service.name` pair (in other words
+	// `service.namespace,service.name,service.instance.id` triplet MUST be globally
+	// unique). The ID helps to distinguish instances of the same service that exist
+	// at the same time (e.g. instances of a horizontally scaled service). It is
+	// preferable for the ID to be persistent and stay the same for the lifetime of
+	// the service instance, however it is acceptable that the ID is ephemeral and
+	// changes during important lifetime events for the service (e.g. service
+	// restarts). If the service has no inherent unique ID that can be used as the
+	// value of this attribute it is recommended to generate a random Version 1 or
+	// Version 4 RFC 4122 UUID (services aiming for reproducible UUIDs may also use
+	// Version 5, see RFC 4122 for more recommendations).
+	ServiceInstanceIDKey = attribute.Key("service.instance.id")
+	// The version string of the service API or implementation.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '2.0.0'
+	ServiceVersionKey = attribute.Key("service.version")
+)
+
+// The telemetry SDK used to capture data recorded by the instrumentation libraries.
+const (
+	// The name of the telemetry SDK as defined above.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	TelemetrySDKNameKey = attribute.Key("telemetry.sdk.name")
+	// The language of the telemetry SDK.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	TelemetrySDKLanguageKey = attribute.Key("telemetry.sdk.language")
+	// The version string of the telemetry SDK.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '1.2.3'
+	TelemetrySDKVersionKey = attribute.Key("telemetry.sdk.version")
+	// The version string of the auto instrumentation agent, if used.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '1.2.3'
+	TelemetryAutoVersionKey = attribute.Key("telemetry.auto.version")
+)
+
+var (
+	// cpp
+	TelemetrySDKLanguageCPP = TelemetrySDKLanguageKey.String("cpp")
+	// dotnet
+	TelemetrySDKLanguageDotnet = TelemetrySDKLanguageKey.String("dotnet")
+	// erlang
+	TelemetrySDKLanguageErlang = TelemetrySDKLanguageKey.String("erlang")
+	// go
+	TelemetrySDKLanguageGo = TelemetrySDKLanguageKey.String("go")
+	// java
+	TelemetrySDKLanguageJava = TelemetrySDKLanguageKey.String("java")
+	// nodejs
+	TelemetrySDKLanguageNodejs = TelemetrySDKLanguageKey.String("nodejs")
+	// php
+	TelemetrySDKLanguagePHP = TelemetrySDKLanguageKey.String("php")
+	// python
+	TelemetrySDKLanguagePython = TelemetrySDKLanguageKey.String("python")
+	// ruby
+	TelemetrySDKLanguageRuby = TelemetrySDKLanguageKey.String("ruby")
+	// webjs
+	TelemetrySDKLanguageWebjs = TelemetrySDKLanguageKey.String("webjs")
+	// swift
+	TelemetrySDKLanguageSwift = TelemetrySDKLanguageKey.String("swift")
+)
+
+// Resource describing the packaged software running the application code. Web engines are typically executed using process.runtime.
+const (
+	// The name of the web engine.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'WildFly'
+	WebEngineNameKey = attribute.Key("webengine.name")
+	// The version of the web engine.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '21.0.0'
+	WebEngineVersionKey = attribute.Key("webengine.version")
+	// Additional description of the web engine (e.g. detailed version and edition
+	// information).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'WildFly Full 21.0.0.Final (WildFly Core 13.0.1.Final) - 2.2.2.Final'
+	WebEngineDescriptionKey = attribute.Key("webengine.description")
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/schema.go b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/schema.go
new file mode 100644
index 0000000000..2f2a019e43
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/schema.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.12.0"
+
+// SchemaURL is the schema URL that matches the version of the semantic conventions
+// that this package defines. Semconv packages starting from v1.4.0 must declare
+// non-empty schema URL in the form https://opentelemetry.io/schemas/<version>
+const SchemaURL = "https://opentelemetry.io/schemas/1.12.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/trace.go b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/trace.go
new file mode 100644
index 0000000000..047d8e95cc
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.12.0/trace.go
@@ -0,0 +1,1704 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.12.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// Span attributes used by AWS Lambda (in addition to general `faas` attributes).
+const (
+	// The full invoked ARN as provided on the `Context` passed to the function
+	// (`Lambda-Runtime-Invoked-Function-ARN` header on the `/runtime/invocation/next`
+	// applicable).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:lambda:us-east-1:123456:function:myfunction:myalias'
+	// Note: This may be different from `faas.id` if an alias is involved.
+	AWSLambdaInvokedARNKey = attribute.Key("aws.lambda.invoked_arn")
+)
+
+// This document defines attributes for CloudEvents. CloudEvents is a specification on how to define event data in a standard way. These attributes can be attached to spans when performing operations with CloudEvents, regardless of the protocol being used.
+const (
+	// The [event_id](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec
+	// .md#id) uniquely identifies the event.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: '123e4567-e89b-12d3-a456-426614174000', '0001'
+	CloudeventsEventIDKey = attribute.Key("cloudevents.event_id")
+	// The [source](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.m
+	// d#source-1) identifies the context in which an event happened.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'https://github.com/cloudevents', '/cloudevents/spec/pull/123', 'my-
+	// service'
+	CloudeventsEventSourceKey = attribute.Key("cloudevents.event_source")
+	// The [version of the CloudEvents specification](https://github.com/cloudevents/s
+	// pec/blob/v1.0.2/cloudevents/spec.md#specversion) which the event uses.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: '1.0'
+	CloudeventsEventSpecVersionKey = attribute.Key("cloudevents.event_spec_version")
+	// The [event_type](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/sp
+	// ec.md#type) contains a value describing the type of event related to the
+	// originating occurrence.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'com.github.pull_request.opened', 'com.example.object.deleted.v2'
+	CloudeventsEventTypeKey = attribute.Key("cloudevents.event_type")
+	// The [subject](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.
+	// md#subject) of the event in the context of the event producer (identified by
+	// source).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'mynewfile.jpg'
+	CloudeventsEventSubjectKey = attribute.Key("cloudevents.event_subject")
+)
+
+// This document defines semantic conventions for the OpenTracing Shim
+const (
+	// Parent-child Reference type
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Note: The causal relationship between a child Span and a parent Span.
+	OpentracingRefTypeKey = attribute.Key("opentracing.ref_type")
+)
+
+var (
+	// The parent Span depends on the child Span in some capacity
+	OpentracingRefTypeChildOf = OpentracingRefTypeKey.String("child_of")
+	// The parent Span does not depend in any way on the result of the child Span
+	OpentracingRefTypeFollowsFrom = OpentracingRefTypeKey.String("follows_from")
+)
+
+// This document defines the attributes used to perform database client calls.
+const (
+	// An identifier for the database management system (DBMS) product being used. See
+	// below for a list of well-known identifiers.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	DBSystemKey = attribute.Key("db.system")
+	// The connection string used to connect to the database. It is recommended to
+	// remove embedded credentials.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Server=(localdb)\\v11.0;Integrated Security=true;'
+	DBConnectionStringKey = attribute.Key("db.connection_string")
+	// Username for accessing the database.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'readonly_user', 'reporting_user'
+	DBUserKey = attribute.Key("db.user")
+	// The fully-qualified class name of the [Java Database Connectivity
+	// (JDBC)](https://docs.oracle.com/javase/8/docs/technotes/guides/jdbc/) driver
+	// used to connect.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'org.postgresql.Driver',
+	// 'com.microsoft.sqlserver.jdbc.SQLServerDriver'
+	DBJDBCDriverClassnameKey = attribute.Key("db.jdbc.driver_classname")
+	// This attribute is used to report the name of the database being accessed. For
+	// commands that switch the database, this should be set to the target database
+	// (even if the command fails).
+	//
+	// Type: string
+	// Required: Required, if applicable.
+	// Stability: stable
+	// Examples: 'customers', 'main'
+	// Note: In some SQL databases, the database name to be used is called "schema
+	// name". In case there are multiple layers that could be considered for database
+	// name (e.g. Oracle instance name and schema name), the database name to be used
+	// is the more specific layer (e.g. Oracle schema name).
+	DBNameKey = attribute.Key("db.name")
+	// The database statement being executed.
+	//
+	// Type: string
+	// Required: Required if applicable and not explicitly disabled via
+	// instrumentation configuration.
+	// Stability: stable
+	// Examples: 'SELECT * FROM wuser_table', 'SET mykey "WuValue"'
+	// Note: The value may be sanitized to exclude sensitive information.
+	DBStatementKey = attribute.Key("db.statement")
+	// The name of the operation being executed, e.g. the [MongoDB command
+	// name](https://docs.mongodb.com/manual/reference/command/#database-operations)
+	// such as `findAndModify`, or the SQL keyword.
+	//
+	// Type: string
+	// Required: Required, if `db.statement` is not applicable.
+	// Stability: stable
+	// Examples: 'findAndModify', 'HMSET', 'SELECT'
+	// Note: When setting this to an SQL keyword, it is not recommended to attempt any
+	// client-side parsing of `db.statement` just to get this property, but it should
+	// be set if the operation name is provided by the library being instrumented. If
+	// the SQL statement has an ambiguous operation, or performs more than one
+	// operation, this value may be omitted.
+	DBOperationKey = attribute.Key("db.operation")
+)
+
+var (
+	// Some other SQL database. Fallback only. See notes
+	DBSystemOtherSQL = DBSystemKey.String("other_sql")
+	// Microsoft SQL Server
+	DBSystemMSSQL = DBSystemKey.String("mssql")
+	// MySQL
+	DBSystemMySQL = DBSystemKey.String("mysql")
+	// Oracle Database
+	DBSystemOracle = DBSystemKey.String("oracle")
+	// IBM DB2
+	DBSystemDB2 = DBSystemKey.String("db2")
+	// PostgreSQL
+	DBSystemPostgreSQL = DBSystemKey.String("postgresql")
+	// Amazon Redshift
+	DBSystemRedshift = DBSystemKey.String("redshift")
+	// Apache Hive
+	DBSystemHive = DBSystemKey.String("hive")
+	// Cloudscape
+	DBSystemCloudscape = DBSystemKey.String("cloudscape")
+	// HyperSQL DataBase
+	DBSystemHSQLDB = DBSystemKey.String("hsqldb")
+	// Progress Database
+	DBSystemProgress = DBSystemKey.String("progress")
+	// SAP MaxDB
+	DBSystemMaxDB = DBSystemKey.String("maxdb")
+	// SAP HANA
+	DBSystemHanaDB = DBSystemKey.String("hanadb")
+	// Ingres
+	DBSystemIngres = DBSystemKey.String("ingres")
+	// FirstSQL
+	DBSystemFirstSQL = DBSystemKey.String("firstsql")
+	// EnterpriseDB
+	DBSystemEDB = DBSystemKey.String("edb")
+	// InterSystems Caché
+	DBSystemCache = DBSystemKey.String("cache")
+	// Adabas (Adaptable Database System)
+	DBSystemAdabas = DBSystemKey.String("adabas")
+	// Firebird
+	DBSystemFirebird = DBSystemKey.String("firebird")
+	// Apache Derby
+	DBSystemDerby = DBSystemKey.String("derby")
+	// FileMaker
+	DBSystemFilemaker = DBSystemKey.String("filemaker")
+	// Informix
+	DBSystemInformix = DBSystemKey.String("informix")
+	// InstantDB
+	DBSystemInstantDB = DBSystemKey.String("instantdb")
+	// InterBase
+	DBSystemInterbase = DBSystemKey.String("interbase")
+	// MariaDB
+	DBSystemMariaDB = DBSystemKey.String("mariadb")
+	// Netezza
+	DBSystemNetezza = DBSystemKey.String("netezza")
+	// Pervasive PSQL
+	DBSystemPervasive = DBSystemKey.String("pervasive")
+	// PointBase
+	DBSystemPointbase = DBSystemKey.String("pointbase")
+	// SQLite
+	DBSystemSqlite = DBSystemKey.String("sqlite")
+	// Sybase
+	DBSystemSybase = DBSystemKey.String("sybase")
+	// Teradata
+	DBSystemTeradata = DBSystemKey.String("teradata")
+	// Vertica
+	DBSystemVertica = DBSystemKey.String("vertica")
+	// H2
+	DBSystemH2 = DBSystemKey.String("h2")
+	// ColdFusion IMQ
+	DBSystemColdfusion = DBSystemKey.String("coldfusion")
+	// Apache Cassandra
+	DBSystemCassandra = DBSystemKey.String("cassandra")
+	// Apache HBase
+	DBSystemHBase = DBSystemKey.String("hbase")
+	// MongoDB
+	DBSystemMongoDB = DBSystemKey.String("mongodb")
+	// Redis
+	DBSystemRedis = DBSystemKey.String("redis")
+	// Couchbase
+	DBSystemCouchbase = DBSystemKey.String("couchbase")
+	// CouchDB
+	DBSystemCouchDB = DBSystemKey.String("couchdb")
+	// Microsoft Azure Cosmos DB
+	DBSystemCosmosDB = DBSystemKey.String("cosmosdb")
+	// Amazon DynamoDB
+	DBSystemDynamoDB = DBSystemKey.String("dynamodb")
+	// Neo4j
+	DBSystemNeo4j = DBSystemKey.String("neo4j")
+	// Apache Geode
+	DBSystemGeode = DBSystemKey.String("geode")
+	// Elasticsearch
+	DBSystemElasticsearch = DBSystemKey.String("elasticsearch")
+	// Memcached
+	DBSystemMemcached = DBSystemKey.String("memcached")
+	// CockroachDB
+	DBSystemCockroachdb = DBSystemKey.String("cockroachdb")
+)
+
+// Connection-level attributes for Microsoft SQL Server
+const (
+	// The Microsoft SQL Server [instance name](https://docs.microsoft.com/en-
+	// us/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver15)
+	// connecting to. This name is used to determine the port of a named instance.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'MSSQLSERVER'
+	// Note: If setting a `db.mssql.instance_name`, `net.peer.port` is no longer
+	// required (but still recommended if non-standard).
+	DBMSSQLInstanceNameKey = attribute.Key("db.mssql.instance_name")
+)
+
+// Call-level attributes for Cassandra
+const (
+	// The fetch size used for paging, i.e. how many rows will be returned at once.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 5000
+	DBCassandraPageSizeKey = attribute.Key("db.cassandra.page_size")
+	// The consistency level of the query. Based on consistency values from
+	// [CQL](https://docs.datastax.com/en/cassandra-
+	// oss/3.0/cassandra/dml/dmlConfigConsistency.html).
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	DBCassandraConsistencyLevelKey = attribute.Key("db.cassandra.consistency_level")
+	// The name of the primary table that the operation is acting upon, including the
+	// keyspace name (if applicable).
+	//
+	// Type: string
+	// Required: Recommended if available.
+	// Stability: stable
+	// Examples: 'mytable'
+	// Note: This mirrors the db.sql.table attribute but references cassandra rather
+	// than sql. It is not recommended to attempt any client-side parsing of
+	// `db.statement` just to get this property, but it should be set if it is
+	// provided by the library being instrumented. If the operation is acting upon an
+	// anonymous table, or more than one table, this value MUST NOT be set.
+	DBCassandraTableKey = attribute.Key("db.cassandra.table")
+	// Whether or not the query is idempotent.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	DBCassandraIdempotenceKey = attribute.Key("db.cassandra.idempotence")
+	// The number of times a query was speculatively executed. Not set or `0` if the
+	// query was not executed speculatively.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 0, 2
+	DBCassandraSpeculativeExecutionCountKey = attribute.Key("db.cassandra.speculative_execution_count")
+	// The ID of the coordinating node for a query.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'be13faa2-8574-4d71-926d-27f16cf8a7af'
+	DBCassandraCoordinatorIDKey = attribute.Key("db.cassandra.coordinator.id")
+	// The data center of the coordinating node for a query.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'us-west-2'
+	DBCassandraCoordinatorDCKey = attribute.Key("db.cassandra.coordinator.dc")
+)
+
+var (
+	// all
+	DBCassandraConsistencyLevelAll = DBCassandraConsistencyLevelKey.String("all")
+	// each_quorum
+	DBCassandraConsistencyLevelEachQuorum = DBCassandraConsistencyLevelKey.String("each_quorum")
+	// quorum
+	DBCassandraConsistencyLevelQuorum = DBCassandraConsistencyLevelKey.String("quorum")
+	// local_quorum
+	DBCassandraConsistencyLevelLocalQuorum = DBCassandraConsistencyLevelKey.String("local_quorum")
+	// one
+	DBCassandraConsistencyLevelOne = DBCassandraConsistencyLevelKey.String("one")
+	// two
+	DBCassandraConsistencyLevelTwo = DBCassandraConsistencyLevelKey.String("two")
+	// three
+	DBCassandraConsistencyLevelThree = DBCassandraConsistencyLevelKey.String("three")
+	// local_one
+	DBCassandraConsistencyLevelLocalOne = DBCassandraConsistencyLevelKey.String("local_one")
+	// any
+	DBCassandraConsistencyLevelAny = DBCassandraConsistencyLevelKey.String("any")
+	// serial
+	DBCassandraConsistencyLevelSerial = DBCassandraConsistencyLevelKey.String("serial")
+	// local_serial
+	DBCassandraConsistencyLevelLocalSerial = DBCassandraConsistencyLevelKey.String("local_serial")
+)
+
+// Call-level attributes for Redis
+const (
+	// The index of the database being accessed as used in the [`SELECT`
+	// command](https://redis.io/commands/select), provided as an integer. To be used
+	// instead of the generic `db.name` attribute.
+	//
+	// Type: int
+	// Required: Required, if other than the default database (`0`).
+	// Stability: stable
+	// Examples: 0, 1, 15
+	DBRedisDBIndexKey = attribute.Key("db.redis.database_index")
+)
+
+// Call-level attributes for MongoDB
+const (
+	// The collection being accessed within the database stated in `db.name`.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'customers', 'products'
+	DBMongoDBCollectionKey = attribute.Key("db.mongodb.collection")
+)
+
+// Call-level attributes for SQL databases
+const (
+	// The name of the primary table that the operation is acting upon, including the
+	// database name (if applicable).
+	//
+	// Type: string
+	// Required: Recommended if available.
+	// Stability: stable
+	// Examples: 'public.users', 'customers'
+	// Note: It is not recommended to attempt any client-side parsing of
+	// `db.statement` just to get this property, but it should be set if it is
+	// provided by the library being instrumented. If the operation is acting upon an
+	// anonymous table, or more than one table, this value MUST NOT be set.
+	DBSQLTableKey = attribute.Key("db.sql.table")
+)
+
+// This document defines the attributes used to report a single exception associated with a span.
+const (
+	// The type of the exception (its fully-qualified class name, if applicable). The
+	// dynamic type of the exception should be preferred over the static type in
+	// languages that support it.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'java.net.ConnectException', 'OSError'
+	ExceptionTypeKey = attribute.Key("exception.type")
+	// The exception message.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Division by zero', "Can't convert 'int' object to str implicitly"
+	ExceptionMessageKey = attribute.Key("exception.message")
+	// A stacktrace as a string in the natural representation for the language
+	// runtime. The representation is to be determined and documented by each language
+	// SIG.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Exception in thread "main" java.lang.RuntimeException: Test
+	// exception\\n at '
+	//  'com.example.GenerateTrace.methodB(GenerateTrace.java:13)\\n at '
+	//  'com.example.GenerateTrace.methodA(GenerateTrace.java:9)\\n at '
+	//  'com.example.GenerateTrace.main(GenerateTrace.java:5)'
+	ExceptionStacktraceKey = attribute.Key("exception.stacktrace")
+	// SHOULD be set to true if the exception event is recorded at a point where it is
+	// known that the exception is escaping the scope of the span.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	// Note: An exception is considered to have escaped (or left) the scope of a span,
+	// if that span is ended while the exception is still logically "in flight".
+	// This may be actually "in flight" in some languages (e.g. if the exception
+	// is passed to a Context manager's `__exit__` method in Python) but will
+	// usually be caught at the point of recording the exception in most languages.
+
+	// It is usually not possible to determine at the point where an exception is
+	// thrown
+	// whether it will escape the scope of a span.
+	// However, it is trivial to know that an exception
+	// will escape, if one checks for an active exception just before ending the span,
+	// as done in the [example above](#recording-an-exception).
+
+	// It follows that an exception may still escape the scope of the span
+	// even if the `exception.escaped` attribute was not set or set to false,
+	// since the event might have been recorded at a time where it was not
+	// clear whether the exception will escape.
+	ExceptionEscapedKey = attribute.Key("exception.escaped")
+)
+
+// This semantic convention describes an instance of a function that runs without provisioning or managing of servers (also known as serverless functions or Function as a Service (FaaS)) with spans.
+const (
+	// Type of the trigger which caused this function execution.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Note: For the server/consumer span on the incoming side,
+	// `faas.trigger` MUST be set.
+
+	// Clients invoking FaaS instances usually cannot set `faas.trigger`,
+	// since they would typically need to look in the payload to determine
+	// the event type. If clients set it, it should be the same as the
+	// trigger that corresponding incoming would have (i.e., this has
+	// nothing to do with the underlying transport used to make the API
+	// call to invoke the lambda, which is often HTTP).
+	FaaSTriggerKey = attribute.Key("faas.trigger")
+	// The execution ID of the current function execution.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'af9d5aa4-a685-4c5f-a22b-444f80b3cc28'
+	FaaSExecutionKey = attribute.Key("faas.execution")
+)
+
+var (
+	// A response to some data source operation such as a database or filesystem read/write
+	FaaSTriggerDatasource = FaaSTriggerKey.String("datasource")
+	// To provide an answer to an inbound HTTP request
+	FaaSTriggerHTTP = FaaSTriggerKey.String("http")
+	// A function is set to be executed when messages are sent to a messaging system
+	FaaSTriggerPubsub = FaaSTriggerKey.String("pubsub")
+	// A function is scheduled to be executed regularly
+	FaaSTriggerTimer = FaaSTriggerKey.String("timer")
+	// If none of the others apply
+	FaaSTriggerOther = FaaSTriggerKey.String("other")
+)
+
+// Semantic Convention for FaaS triggered as a response to some data source operation such as a database or filesystem read/write.
+const (
+	// The name of the source on which the triggering operation was performed. For
+	// example, in Cloud Storage or S3 corresponds to the bucket name, and in Cosmos
+	// DB to the database name.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'myBucketName', 'myDBName'
+	FaaSDocumentCollectionKey = attribute.Key("faas.document.collection")
+	// Describes the type of the operation that was performed on the data.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	FaaSDocumentOperationKey = attribute.Key("faas.document.operation")
+	// A string containing the time when the data was accessed in the [ISO
+	// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format expressed
+	// in [UTC](https://www.w3.org/TR/NOTE-datetime).
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: '2020-01-23T13:47:06Z'
+	FaaSDocumentTimeKey = attribute.Key("faas.document.time")
+	// The document name/table subjected to the operation. For example, in Cloud
+	// Storage or S3 is the name of the file, and in Cosmos DB the table name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'myFile.txt', 'myTableName'
+	FaaSDocumentNameKey = attribute.Key("faas.document.name")
+)
+
+var (
+	// When a new object is created
+	FaaSDocumentOperationInsert = FaaSDocumentOperationKey.String("insert")
+	// When an object is modified
+	FaaSDocumentOperationEdit = FaaSDocumentOperationKey.String("edit")
+	// When an object is deleted
+	FaaSDocumentOperationDelete = FaaSDocumentOperationKey.String("delete")
+)
+
+// Semantic Convention for FaaS scheduled to be executed regularly.
+const (
+	// A string containing the function invocation time in the [ISO
+	// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format expressed
+	// in [UTC](https://www.w3.org/TR/NOTE-datetime).
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: '2020-01-23T13:47:06Z'
+	FaaSTimeKey = attribute.Key("faas.time")
+	// A string containing the schedule period as [Cron Expression](https://docs.oracl
+	// e.com/cd/E12058_01/doc/doc.1014/e12030/cron_expressions.htm).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0/5 * * * ? *'
+	FaaSCronKey = attribute.Key("faas.cron")
+)
+
+// Contains additional attributes for incoming FaaS spans.
+const (
+	// A boolean that is true if the serverless function is executed for the first
+	// time (aka cold-start).
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	FaaSColdstartKey = attribute.Key("faas.coldstart")
+)
+
+// Contains additional attributes for outgoing FaaS spans.
+const (
+	// The name of the invoked function.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'my-function'
+	// Note: SHOULD be equal to the `faas.name` resource attribute of the invoked
+	// function.
+	FaaSInvokedNameKey = attribute.Key("faas.invoked_name")
+	// The cloud provider of the invoked function.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	// Note: SHOULD be equal to the `cloud.provider` resource attribute of the invoked
+	// function.
+	FaaSInvokedProviderKey = attribute.Key("faas.invoked_provider")
+	// The cloud region of the invoked function.
+	//
+	// Type: string
+	// Required: For some cloud providers, like AWS or GCP, the region in which a
+	// function is hosted is essential to uniquely identify the function and also part
+	// of its endpoint. Since it's part of the endpoint being called, the region is
+	// always known to clients. In these cases, `faas.invoked_region` MUST be set
+	// accordingly. If the region is unknown to the client or not required for
+	// identifying the invoked function, setting `faas.invoked_region` is optional.
+	// Stability: stable
+	// Examples: 'eu-central-1'
+	// Note: SHOULD be equal to the `cloud.region` resource attribute of the invoked
+	// function.
+	FaaSInvokedRegionKey = attribute.Key("faas.invoked_region")
+)
+
+var (
+	// Alibaba Cloud
+	FaaSInvokedProviderAlibabaCloud = FaaSInvokedProviderKey.String("alibaba_cloud")
+	// Amazon Web Services
+	FaaSInvokedProviderAWS = FaaSInvokedProviderKey.String("aws")
+	// Microsoft Azure
+	FaaSInvokedProviderAzure = FaaSInvokedProviderKey.String("azure")
+	// Google Cloud Platform
+	FaaSInvokedProviderGCP = FaaSInvokedProviderKey.String("gcp")
+	// Tencent Cloud
+	FaaSInvokedProviderTencentCloud = FaaSInvokedProviderKey.String("tencent_cloud")
+)
+
+// These attributes may be used for any network related operation.
+const (
+	// Transport protocol used. See note below.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	NetTransportKey = attribute.Key("net.transport")
+	// Remote address of the peer (dotted decimal for IPv4 or
+	// [RFC5952](https://tools.ietf.org/html/rfc5952) for IPv6)
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '127.0.0.1'
+	NetPeerIPKey = attribute.Key("net.peer.ip")
+	// Remote port number.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 80, 8080, 443
+	NetPeerPortKey = attribute.Key("net.peer.port")
+	// Remote hostname or similar, see note below.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'example.com'
+	// Note: `net.peer.name` SHOULD NOT be set if capturing it would require an extra
+	// DNS lookup.
+	NetPeerNameKey = attribute.Key("net.peer.name")
+	// Like `net.peer.ip` but for the host IP. Useful in case of a multi-IP host.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '192.168.0.1'
+	NetHostIPKey = attribute.Key("net.host.ip")
+	// Like `net.peer.port` but for the host port.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 35555
+	NetHostPortKey = attribute.Key("net.host.port")
+	// Local hostname or similar, see note below.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'localhost'
+	NetHostNameKey = attribute.Key("net.host.name")
+	// The internet connection type currently being used by the host.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Examples: 'wifi'
+	NetHostConnectionTypeKey = attribute.Key("net.host.connection.type")
+	// This describes more details regarding the connection.type. It may be the type
+	// of cell technology connection, but it could be used for describing details
+	// about a wifi connection.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Examples: 'LTE'
+	NetHostConnectionSubtypeKey = attribute.Key("net.host.connection.subtype")
+	// The name of the mobile carrier.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'sprint'
+	NetHostCarrierNameKey = attribute.Key("net.host.carrier.name")
+	// The mobile carrier country code.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '310'
+	NetHostCarrierMccKey = attribute.Key("net.host.carrier.mcc")
+	// The mobile carrier network code.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '001'
+	NetHostCarrierMncKey = attribute.Key("net.host.carrier.mnc")
+	// The ISO 3166-1 alpha-2 2-character country code associated with the mobile
+	// carrier network.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'DE'
+	NetHostCarrierIccKey = attribute.Key("net.host.carrier.icc")
+)
+
+var (
+	// ip_tcp
+	NetTransportTCP = NetTransportKey.String("ip_tcp")
+	// ip_udp
+	NetTransportUDP = NetTransportKey.String("ip_udp")
+	// Another IP-based protocol
+	NetTransportIP = NetTransportKey.String("ip")
+	// Unix Domain socket. See below
+	NetTransportUnix = NetTransportKey.String("unix")
+	// Named or anonymous pipe. See note below
+	NetTransportPipe = NetTransportKey.String("pipe")
+	// In-process communication
+	NetTransportInProc = NetTransportKey.String("inproc")
+	// Something else (non IP-based)
+	NetTransportOther = NetTransportKey.String("other")
+)
+
+var (
+	// wifi
+	NetHostConnectionTypeWifi = NetHostConnectionTypeKey.String("wifi")
+	// wired
+	NetHostConnectionTypeWired = NetHostConnectionTypeKey.String("wired")
+	// cell
+	NetHostConnectionTypeCell = NetHostConnectionTypeKey.String("cell")
+	// unavailable
+	NetHostConnectionTypeUnavailable = NetHostConnectionTypeKey.String("unavailable")
+	// unknown
+	NetHostConnectionTypeUnknown = NetHostConnectionTypeKey.String("unknown")
+)
+
+var (
+	// GPRS
+	NetHostConnectionSubtypeGprs = NetHostConnectionSubtypeKey.String("gprs")
+	// EDGE
+	NetHostConnectionSubtypeEdge = NetHostConnectionSubtypeKey.String("edge")
+	// UMTS
+	NetHostConnectionSubtypeUmts = NetHostConnectionSubtypeKey.String("umts")
+	// CDMA
+	NetHostConnectionSubtypeCdma = NetHostConnectionSubtypeKey.String("cdma")
+	// EVDO Rel. 0
+	NetHostConnectionSubtypeEvdo0 = NetHostConnectionSubtypeKey.String("evdo_0")
+	// EVDO Rev. A
+	NetHostConnectionSubtypeEvdoA = NetHostConnectionSubtypeKey.String("evdo_a")
+	// CDMA2000 1XRTT
+	NetHostConnectionSubtypeCdma20001xrtt = NetHostConnectionSubtypeKey.String("cdma2000_1xrtt")
+	// HSDPA
+	NetHostConnectionSubtypeHsdpa = NetHostConnectionSubtypeKey.String("hsdpa")
+	// HSUPA
+	NetHostConnectionSubtypeHsupa = NetHostConnectionSubtypeKey.String("hsupa")
+	// HSPA
+	NetHostConnectionSubtypeHspa = NetHostConnectionSubtypeKey.String("hspa")
+	// IDEN
+	NetHostConnectionSubtypeIden = NetHostConnectionSubtypeKey.String("iden")
+	// EVDO Rev. B
+	NetHostConnectionSubtypeEvdoB = NetHostConnectionSubtypeKey.String("evdo_b")
+	// LTE
+	NetHostConnectionSubtypeLte = NetHostConnectionSubtypeKey.String("lte")
+	// EHRPD
+	NetHostConnectionSubtypeEhrpd = NetHostConnectionSubtypeKey.String("ehrpd")
+	// HSPAP
+	NetHostConnectionSubtypeHspap = NetHostConnectionSubtypeKey.String("hspap")
+	// GSM
+	NetHostConnectionSubtypeGsm = NetHostConnectionSubtypeKey.String("gsm")
+	// TD-SCDMA
+	NetHostConnectionSubtypeTdScdma = NetHostConnectionSubtypeKey.String("td_scdma")
+	// IWLAN
+	NetHostConnectionSubtypeIwlan = NetHostConnectionSubtypeKey.String("iwlan")
+	// 5G NR (New Radio)
+	NetHostConnectionSubtypeNr = NetHostConnectionSubtypeKey.String("nr")
+	// 5G NRNSA (New Radio Non-Standalone)
+	NetHostConnectionSubtypeNrnsa = NetHostConnectionSubtypeKey.String("nrnsa")
+	// LTE CA
+	NetHostConnectionSubtypeLteCa = NetHostConnectionSubtypeKey.String("lte_ca")
+)
+
+// Operations that access some remote service.
+const (
+	// The [`service.name`](../../resource/semantic_conventions/README.md#service) of
+	// the remote service. SHOULD be equal to the actual `service.name` resource
+	// attribute of the remote service if any.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'AuthTokenCache'
+	PeerServiceKey = attribute.Key("peer.service")
+)
+
+// These attributes may be used for any operation with an authenticated and/or authorized enduser.
+const (
+	// Username or client_id extracted from the access token or
+	// [Authorization](https://tools.ietf.org/html/rfc7235#section-4.2) header in the
+	// inbound request from outside the system.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'username'
+	EnduserIDKey = attribute.Key("enduser.id")
+	// Actual/assumed role the client is making the request under extracted from token
+	// or application security context.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'admin'
+	EnduserRoleKey = attribute.Key("enduser.role")
+	// Scopes or granted authorities the client currently possesses extracted from
+	// token or application security context. The value would come from the scope
+	// associated with an [OAuth 2.0 Access
+	// Token](https://tools.ietf.org/html/rfc6749#section-3.3) or an attribute value
+	// in a [SAML 2.0 Assertion](http://docs.oasis-
+	// open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'read:message, write:files'
+	EnduserScopeKey = attribute.Key("enduser.scope")
+)
+
+// These attributes may be used for any operation to store information about a thread that started a span.
+const (
+	// Current "managed" thread ID (as opposed to OS thread ID).
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 42
+	ThreadIDKey = attribute.Key("thread.id")
+	// Current thread name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'main'
+	ThreadNameKey = attribute.Key("thread.name")
+)
+
+// These attributes allow to report this unit of code and therefore to provide more context about the span.
+const (
+	// The method or function name, or equivalent (usually rightmost part of the code
+	// unit's name).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'serveRequest'
+	CodeFunctionKey = attribute.Key("code.function")
+	// The "namespace" within which `code.function` is defined. Usually the qualified
+	// class or module name, such that `code.namespace` + some separator +
+	// `code.function` form a unique identifier for the code unit.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'com.example.MyHTTPService'
+	CodeNamespaceKey = attribute.Key("code.namespace")
+	// The source code file name that identifies the code unit as uniquely as possible
+	// (preferably an absolute file path).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '/usr/local/MyApplication/content_root/app/index.php'
+	CodeFilepathKey = attribute.Key("code.filepath")
+	// The line number in `code.filepath` best representing the operation. It SHOULD
+	// point within the code unit named in `code.function`.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 42
+	CodeLineNumberKey = attribute.Key("code.lineno")
+)
+
+// This document defines semantic conventions for HTTP client and server Spans.
+const (
+	// HTTP request method.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'GET', 'POST', 'HEAD'
+	HTTPMethodKey = attribute.Key("http.method")
+	// Full HTTP request URL in the form `scheme://host[:port]/path?query[#fragment]`.
+	// Usually the fragment is not transmitted over HTTP, but if it is known, it
+	// should be included nevertheless.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'https://www.foo.bar/search?q=OpenTelemetry#SemConv'
+	// Note: `http.url` MUST NOT contain credentials passed via URL in form of
+	// `https://username:password@www.example.com/`. In such case the attribute's
+	// value should be `https://www.example.com/`.
+	HTTPURLKey = attribute.Key("http.url")
+	// The full request target as passed in a HTTP request line or equivalent.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '/path/12314/?q=ddds#123'
+	HTTPTargetKey = attribute.Key("http.target")
+	// The value of the [HTTP host
+	// header](https://tools.ietf.org/html/rfc7230#section-5.4). An empty Host header
+	// should also be reported, see note.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'www.example.org'
+	// Note: When the header is present but empty the attribute SHOULD be set to the
+	// empty string. Note that this is a valid situation that is expected in certain
+	// cases, according the aforementioned [section of RFC
+	// 7230](https://tools.ietf.org/html/rfc7230#section-5.4). When the header is not
+	// set the attribute MUST NOT be set.
+	HTTPHostKey = attribute.Key("http.host")
+	// The URI scheme identifying the used protocol.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'http', 'https'
+	HTTPSchemeKey = attribute.Key("http.scheme")
+	// [HTTP response status code](https://tools.ietf.org/html/rfc7231#section-6).
+	//
+	// Type: int
+	// Required: If and only if one was received/sent.
+	// Stability: stable
+	// Examples: 200
+	HTTPStatusCodeKey = attribute.Key("http.status_code")
+	// Kind of HTTP protocol used.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Note: If `net.transport` is not specified, it can be assumed to be `IP.TCP`
+	// except if `http.flavor` is `QUIC`, in which case `IP.UDP` is assumed.
+	HTTPFlavorKey = attribute.Key("http.flavor")
+	// Value of the [HTTP User-
+	// Agent](https://tools.ietf.org/html/rfc7231#section-5.5.3) header sent by the
+	// client.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'CERN-LineMode/2.15 libwww/2.17b3'
+	HTTPUserAgentKey = attribute.Key("http.user_agent")
+	// The size of the request payload body in bytes. This is the number of bytes
+	// transferred excluding headers and is often, but not always, present as the
+	// [Content-Length](https://tools.ietf.org/html/rfc7230#section-3.3.2) header. For
+	// requests using transport encoding, this should be the compressed size.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 3495
+	HTTPRequestContentLengthKey = attribute.Key("http.request_content_length")
+	// The size of the uncompressed request payload body after transport decoding. Not
+	// set if transport encoding not used.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 5493
+	HTTPRequestContentLengthUncompressedKey = attribute.Key("http.request_content_length_uncompressed")
+	// The size of the response payload body in bytes. This is the number of bytes
+	// transferred excluding headers and is often, but not always, present as the
+	// [Content-Length](https://tools.ietf.org/html/rfc7230#section-3.3.2) header. For
+	// requests using transport encoding, this should be the compressed size.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 3495
+	HTTPResponseContentLengthKey = attribute.Key("http.response_content_length")
+	// The size of the uncompressed response payload body after transport decoding.
+	// Not set if transport encoding not used.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 5493
+	HTTPResponseContentLengthUncompressedKey = attribute.Key("http.response_content_length_uncompressed")
+	// The ordinal number of request re-sending attempt.
+	//
+	// Type: int
+	// Required: If and only if a request was retried.
+	// Stability: stable
+	// Examples: 3
+	HTTPRetryCountKey = attribute.Key("http.retry_count")
+)
+
+var (
+	// HTTP/1.0
+	HTTPFlavorHTTP10 = HTTPFlavorKey.String("1.0")
+	// HTTP/1.1
+	HTTPFlavorHTTP11 = HTTPFlavorKey.String("1.1")
+	// HTTP/2
+	HTTPFlavorHTTP20 = HTTPFlavorKey.String("2.0")
+	// HTTP/3
+	HTTPFlavorHTTP30 = HTTPFlavorKey.String("3.0")
+	// SPDY protocol
+	HTTPFlavorSPDY = HTTPFlavorKey.String("SPDY")
+	// QUIC protocol
+	HTTPFlavorQUIC = HTTPFlavorKey.String("QUIC")
+)
+
+// Semantic Convention for HTTP Server
+const (
+	// The primary server name of the matched virtual host. This should be obtained
+	// via configuration. If no such configuration can be obtained, this attribute
+	// MUST NOT be set ( `net.host.name` should be used instead).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'example.com'
+	// Note: `http.url` is usually not readily available on the server side but would
+	// have to be assembled in a cumbersome and sometimes lossy process from other
+	// information (see e.g. open-telemetry/opentelemetry-python/pull/148). It is thus
+	// preferred to supply the raw data that is available.
+	HTTPServerNameKey = attribute.Key("http.server_name")
+	// The matched route (path template).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '/users/:userID?'
+	HTTPRouteKey = attribute.Key("http.route")
+	// The IP address of the original client behind all proxies, if known (e.g. from
+	// [X-Forwarded-For](https://developer.mozilla.org/en-
+	// US/docs/Web/HTTP/Headers/X-Forwarded-For)).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '83.164.160.102'
+	// Note: This is not necessarily the same as `net.peer.ip`, which would
+	// identify the network-level peer, which may be a proxy.
+
+	// This attribute should be set when a source of information different
+	// from the one used for `net.peer.ip`, is available even if that other
+	// source just confirms the same value as `net.peer.ip`.
+	// Rationale: For `net.peer.ip`, one typically does not know if it
+	// comes from a proxy, reverse proxy, or the actual client. Setting
+	// `http.client_ip` when it's the same as `net.peer.ip` means that
+	// one is at least somewhat confident that the address is not that of
+	// the closest proxy.
+	HTTPClientIPKey = attribute.Key("http.client_ip")
+)
+
+// Attributes that exist for multiple DynamoDB request types.
+const (
+	// The keys in the `RequestItems` object field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'Users', 'Cats'
+	AWSDynamoDBTableNamesKey = attribute.Key("aws.dynamodb.table_names")
+	// The JSON-serialized value of each item in the `ConsumedCapacity` response
+	// field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "CapacityUnits": number, "GlobalSecondaryIndexes": { "string" : {
+	// "CapacityUnits": number, "ReadCapacityUnits": number, "WriteCapacityUnits":
+	// number } }, "LocalSecondaryIndexes": { "string" : { "CapacityUnits": number,
+	// "ReadCapacityUnits": number, "WriteCapacityUnits": number } },
+	// "ReadCapacityUnits": number, "Table": { "CapacityUnits": number,
+	// "ReadCapacityUnits": number, "WriteCapacityUnits": number }, "TableName":
+	// "string", "WriteCapacityUnits": number }'
+	AWSDynamoDBConsumedCapacityKey = attribute.Key("aws.dynamodb.consumed_capacity")
+	// The JSON-serialized value of the `ItemCollectionMetrics` response field.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "string" : [ { "ItemCollectionKey": { "string" : { "B": blob,
+	// "BOOL": boolean, "BS": [ blob ], "L": [ "AttributeValue" ], "M": { "string" :
+	// "AttributeValue" }, "N": "string", "NS": [ "string" ], "NULL": boolean, "S":
+	// "string", "SS": [ "string" ] } }, "SizeEstimateRangeGB": [ number ] } ] }'
+	AWSDynamoDBItemCollectionMetricsKey = attribute.Key("aws.dynamodb.item_collection_metrics")
+	// The value of the `ProvisionedThroughput.ReadCapacityUnits` request parameter.
+	//
+	// Type: double
+	// Required: No
+	// Stability: stable
+	// Examples: 1.0, 2.0
+	AWSDynamoDBProvisionedReadCapacityKey = attribute.Key("aws.dynamodb.provisioned_read_capacity")
+	// The value of the `ProvisionedThroughput.WriteCapacityUnits` request parameter.
+	//
+	// Type: double
+	// Required: No
+	// Stability: stable
+	// Examples: 1.0, 2.0
+	AWSDynamoDBProvisionedWriteCapacityKey = attribute.Key("aws.dynamodb.provisioned_write_capacity")
+	// The value of the `ConsistentRead` request parameter.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	AWSDynamoDBConsistentReadKey = attribute.Key("aws.dynamodb.consistent_read")
+	// The value of the `ProjectionExpression` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Title', 'Title, Price, Color', 'Title, Description, RelatedItems,
+	// ProductReviews'
+	AWSDynamoDBProjectionKey = attribute.Key("aws.dynamodb.projection")
+	// The value of the `Limit` request parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBLimitKey = attribute.Key("aws.dynamodb.limit")
+	// The value of the `AttributesToGet` request parameter.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'lives', 'id'
+	AWSDynamoDBAttributesToGetKey = attribute.Key("aws.dynamodb.attributes_to_get")
+	// The value of the `IndexName` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'name_to_group'
+	AWSDynamoDBIndexNameKey = attribute.Key("aws.dynamodb.index_name")
+	// The value of the `Select` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'ALL_ATTRIBUTES', 'COUNT'
+	AWSDynamoDBSelectKey = attribute.Key("aws.dynamodb.select")
+)
+
+// DynamoDB.CreateTable
+const (
+	// The JSON-serialized value of each item of the `GlobalSecondaryIndexes` request
+	// field
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "IndexName": "string", "KeySchema": [ { "AttributeName": "string",
+	// "KeyType": "string" } ], "Projection": { "NonKeyAttributes": [ "string" ],
+	// "ProjectionType": "string" }, "ProvisionedThroughput": { "ReadCapacityUnits":
+	// number, "WriteCapacityUnits": number } }'
+	AWSDynamoDBGlobalSecondaryIndexesKey = attribute.Key("aws.dynamodb.global_secondary_indexes")
+	// The JSON-serialized value of each item of the `LocalSecondaryIndexes` request
+	// field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "IndexARN": "string", "IndexName": "string", "IndexSizeBytes":
+	// number, "ItemCount": number, "KeySchema": [ { "AttributeName": "string",
+	// "KeyType": "string" } ], "Projection": { "NonKeyAttributes": [ "string" ],
+	// "ProjectionType": "string" } }'
+	AWSDynamoDBLocalSecondaryIndexesKey = attribute.Key("aws.dynamodb.local_secondary_indexes")
+)
+
+// DynamoDB.ListTables
+const (
+	// The value of the `ExclusiveStartTableName` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Users', 'CatsTable'
+	AWSDynamoDBExclusiveStartTableKey = attribute.Key("aws.dynamodb.exclusive_start_table")
+	// The the number of items in the `TableNames` response parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 20
+	AWSDynamoDBTableCountKey = attribute.Key("aws.dynamodb.table_count")
+)
+
+// DynamoDB.Query
+const (
+	// The value of the `ScanIndexForward` request parameter.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	AWSDynamoDBScanForwardKey = attribute.Key("aws.dynamodb.scan_forward")
+)
+
+// DynamoDB.Scan
+const (
+	// The value of the `Segment` request parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBSegmentKey = attribute.Key("aws.dynamodb.segment")
+	// The value of the `TotalSegments` request parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 100
+	AWSDynamoDBTotalSegmentsKey = attribute.Key("aws.dynamodb.total_segments")
+	// The value of the `Count` response parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBCountKey = attribute.Key("aws.dynamodb.count")
+	// The value of the `ScannedCount` response parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 50
+	AWSDynamoDBScannedCountKey = attribute.Key("aws.dynamodb.scanned_count")
+)
+
+// DynamoDB.UpdateTable
+const (
+	// The JSON-serialized value of each item in the `AttributeDefinitions` request
+	// field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "AttributeName": "string", "AttributeType": "string" }'
+	AWSDynamoDBAttributeDefinitionsKey = attribute.Key("aws.dynamodb.attribute_definitions")
+	// The JSON-serialized value of each item in the the `GlobalSecondaryIndexUpdates`
+	// request field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "Create": { "IndexName": "string", "KeySchema": [ {
+	// "AttributeName": "string", "KeyType": "string" } ], "Projection": {
+	// "NonKeyAttributes": [ "string" ], "ProjectionType": "string" },
+	// "ProvisionedThroughput": { "ReadCapacityUnits": number, "WriteCapacityUnits":
+	// number } }'
+	AWSDynamoDBGlobalSecondaryIndexUpdatesKey = attribute.Key("aws.dynamodb.global_secondary_index_updates")
+)
+
+// This document defines the attributes used in messaging systems.
+const (
+	// A string identifying the messaging system.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'kafka', 'rabbitmq', 'rocketmq', 'activemq', 'AmazonSQS'
+	MessagingSystemKey = attribute.Key("messaging.system")
+	// The message destination name. This might be equal to the span name but is
+	// required nevertheless.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'MyQueue', 'MyTopic'
+	MessagingDestinationKey = attribute.Key("messaging.destination")
+	// The kind of message destination
+	//
+	// Type: Enum
+	// Required: Required only if the message destination is either a `queue` or
+	// `topic`.
+	// Stability: stable
+	MessagingDestinationKindKey = attribute.Key("messaging.destination_kind")
+	// A boolean that is true if the message destination is temporary.
+	//
+	// Type: boolean
+	// Required: If missing, it is assumed to be false.
+	// Stability: stable
+	MessagingTempDestinationKey = attribute.Key("messaging.temp_destination")
+	// The name of the transport protocol.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'AMQP', 'MQTT'
+	MessagingProtocolKey = attribute.Key("messaging.protocol")
+	// The version of the transport protocol.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0.9.1'
+	MessagingProtocolVersionKey = attribute.Key("messaging.protocol_version")
+	// Connection string.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'tibjmsnaming://localhost:7222',
+	// 'https://queue.amazonaws.com/80398EXAMPLE/MyQueue'
+	MessagingURLKey = attribute.Key("messaging.url")
+	// A value used by the messaging system as an identifier for the message,
+	// represented as a string.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '452a7c7c7c7048c2f887f61572b18fc2'
+	MessagingMessageIDKey = attribute.Key("messaging.message_id")
+	// The [conversation ID](#conversations) identifying the conversation to which the
+	// message belongs, represented as a string. Sometimes called "Correlation ID".
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'MyConversationID'
+	MessagingConversationIDKey = attribute.Key("messaging.conversation_id")
+	// The (uncompressed) size of the message payload in bytes. Also use this
+	// attribute if it is unknown whether the compressed or uncompressed payload size
+	// is reported.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 2738
+	MessagingMessagePayloadSizeBytesKey = attribute.Key("messaging.message_payload_size_bytes")
+	// The compressed size of the message payload in bytes.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 2048
+	MessagingMessagePayloadCompressedSizeBytesKey = attribute.Key("messaging.message_payload_compressed_size_bytes")
+)
+
+var (
+	// A message sent to a queue
+	MessagingDestinationKindQueue = MessagingDestinationKindKey.String("queue")
+	// A message sent to a topic
+	MessagingDestinationKindTopic = MessagingDestinationKindKey.String("topic")
+)
+
+// Semantic convention for a consumer of messages received from a messaging system
+const (
+	// A string identifying the kind of message consumption as defined in the
+	// [Operation names](#operation-names) section above. If the operation is "send",
+	// this attribute MUST NOT be set, since the operation can be inferred from the
+	// span kind in that case.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	MessagingOperationKey = attribute.Key("messaging.operation")
+	// The identifier for the consumer receiving a message. For Kafka, set it to
+	// `{messaging.kafka.consumer_group} - {messaging.kafka.client_id}`, if both are
+	// present, or only `messaging.kafka.consumer_group`. For brokers, such as
+	// RabbitMQ and Artemis, set it to the `client_id` of the client consuming the
+	// message.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'mygroup - client-6'
+	MessagingConsumerIDKey = attribute.Key("messaging.consumer_id")
+)
+
+var (
+	// receive
+	MessagingOperationReceive = MessagingOperationKey.String("receive")
+	// process
+	MessagingOperationProcess = MessagingOperationKey.String("process")
+)
+
+// Attributes for RabbitMQ
+const (
+	// RabbitMQ message routing key.
+	//
+	// Type: string
+	// Required: Unless it is empty.
+	// Stability: stable
+	// Examples: 'myKey'
+	MessagingRabbitmqRoutingKeyKey = attribute.Key("messaging.rabbitmq.routing_key")
+)
+
+// Attributes for Apache Kafka
+const (
+	// Message keys in Kafka are used for grouping alike messages to ensure they're
+	// processed on the same partition. They differ from `messaging.message_id` in
+	// that they're not unique. If the key is `null`, the attribute MUST NOT be set.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'myKey'
+	// Note: If the key type is not string, it's string representation has to be
+	// supplied for the attribute. If the key has no unambiguous, canonical string
+	// form, don't include its value.
+	MessagingKafkaMessageKeyKey = attribute.Key("messaging.kafka.message_key")
+	// Name of the Kafka Consumer Group that is handling the message. Only applies to
+	// consumers, not producers.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'my-group'
+	MessagingKafkaConsumerGroupKey = attribute.Key("messaging.kafka.consumer_group")
+	// Client ID for the Consumer or Producer that is handling the message.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'client-5'
+	MessagingKafkaClientIDKey = attribute.Key("messaging.kafka.client_id")
+	// Partition the message is sent to.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 2
+	MessagingKafkaPartitionKey = attribute.Key("messaging.kafka.partition")
+	// A boolean that is true if the message is a tombstone.
+	//
+	// Type: boolean
+	// Required: If missing, it is assumed to be false.
+	// Stability: stable
+	MessagingKafkaTombstoneKey = attribute.Key("messaging.kafka.tombstone")
+)
+
+// Attributes for Apache RocketMQ
+const (
+	// Namespace of RocketMQ resources, resources in different namespaces are
+	// individual.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'myNamespace'
+	MessagingRocketmqNamespaceKey = attribute.Key("messaging.rocketmq.namespace")
+	// Name of the RocketMQ producer/consumer group that is handling the message. The
+	// client type is identified by the SpanKind.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'myConsumerGroup'
+	MessagingRocketmqClientGroupKey = attribute.Key("messaging.rocketmq.client_group")
+	// The unique identifier for each client.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'myhost@8742@s8083jm'
+	MessagingRocketmqClientIDKey = attribute.Key("messaging.rocketmq.client_id")
+	// Type of message.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	MessagingRocketmqMessageTypeKey = attribute.Key("messaging.rocketmq.message_type")
+	// The secondary classifier of message besides topic.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'tagA'
+	MessagingRocketmqMessageTagKey = attribute.Key("messaging.rocketmq.message_tag")
+	// Key(s) of message, another way to mark message besides message id.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'keyA', 'keyB'
+	MessagingRocketmqMessageKeysKey = attribute.Key("messaging.rocketmq.message_keys")
+	// Model of message consumption. This only applies to consumer spans.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	MessagingRocketmqConsumptionModelKey = attribute.Key("messaging.rocketmq.consumption_model")
+)
+
+var (
+	// Normal message
+	MessagingRocketmqMessageTypeNormal = MessagingRocketmqMessageTypeKey.String("normal")
+	// FIFO message
+	MessagingRocketmqMessageTypeFifo = MessagingRocketmqMessageTypeKey.String("fifo")
+	// Delay message
+	MessagingRocketmqMessageTypeDelay = MessagingRocketmqMessageTypeKey.String("delay")
+	// Transaction message
+	MessagingRocketmqMessageTypeTransaction = MessagingRocketmqMessageTypeKey.String("transaction")
+)
+
+var (
+	// Clustering consumption model
+	MessagingRocketmqConsumptionModelClustering = MessagingRocketmqConsumptionModelKey.String("clustering")
+	// Broadcasting consumption model
+	MessagingRocketmqConsumptionModelBroadcasting = MessagingRocketmqConsumptionModelKey.String("broadcasting")
+)
+
+// This document defines semantic conventions for remote procedure calls.
+const (
+	// A string identifying the remoting system. See below for a list of well-known
+	// identifiers.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	RPCSystemKey = attribute.Key("rpc.system")
+	// The full (logical) name of the service being called, including its package
+	// name, if applicable.
+	//
+	// Type: string
+	// Required: No, but recommended
+	// Stability: stable
+	// Examples: 'myservice.EchoService'
+	// Note: This is the logical name of the service from the RPC interface
+	// perspective, which can be different from the name of any implementing class.
+	// The `code.namespace` attribute may be used to store the latter (despite the
+	// attribute name, it may include a class name; e.g., class with method actually
+	// executing the call on the server side, RPC client stub class on the client
+	// side).
+	RPCServiceKey = attribute.Key("rpc.service")
+	// The name of the (logical) method being called, must be equal to the $method
+	// part in the span name.
+	//
+	// Type: string
+	// Required: No, but recommended
+	// Stability: stable
+	// Examples: 'exampleMethod'
+	// Note: This is the logical name of the method from the RPC interface
+	// perspective, which can be different from the name of any implementing
+	// method/function. The `code.function` attribute may be used to store the latter
+	// (e.g., method actually executing the call on the server side, RPC client stub
+	// method on the client side).
+	RPCMethodKey = attribute.Key("rpc.method")
+)
+
+var (
+	// gRPC
+	RPCSystemGRPC = RPCSystemKey.String("grpc")
+	// Java RMI
+	RPCSystemJavaRmi = RPCSystemKey.String("java_rmi")
+	// .NET WCF
+	RPCSystemDotnetWcf = RPCSystemKey.String("dotnet_wcf")
+	// Apache Dubbo
+	RPCSystemApacheDubbo = RPCSystemKey.String("apache_dubbo")
+)
+
+// Tech-specific attributes for gRPC.
+const (
+	// The [numeric status
+	// code](https://github.com/grpc/grpc/blob/v1.33.2/doc/statuscodes.md) of the gRPC
+	// request.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	RPCGRPCStatusCodeKey = attribute.Key("rpc.grpc.status_code")
+)
+
+var (
+	// OK
+	RPCGRPCStatusCodeOk = RPCGRPCStatusCodeKey.Int(0)
+	// CANCELLED
+	RPCGRPCStatusCodeCancelled = RPCGRPCStatusCodeKey.Int(1)
+	// UNKNOWN
+	RPCGRPCStatusCodeUnknown = RPCGRPCStatusCodeKey.Int(2)
+	// INVALID_ARGUMENT
+	RPCGRPCStatusCodeInvalidArgument = RPCGRPCStatusCodeKey.Int(3)
+	// DEADLINE_EXCEEDED
+	RPCGRPCStatusCodeDeadlineExceeded = RPCGRPCStatusCodeKey.Int(4)
+	// NOT_FOUND
+	RPCGRPCStatusCodeNotFound = RPCGRPCStatusCodeKey.Int(5)
+	// ALREADY_EXISTS
+	RPCGRPCStatusCodeAlreadyExists = RPCGRPCStatusCodeKey.Int(6)
+	// PERMISSION_DENIED
+	RPCGRPCStatusCodePermissionDenied = RPCGRPCStatusCodeKey.Int(7)
+	// RESOURCE_EXHAUSTED
+	RPCGRPCStatusCodeResourceExhausted = RPCGRPCStatusCodeKey.Int(8)
+	// FAILED_PRECONDITION
+	RPCGRPCStatusCodeFailedPrecondition = RPCGRPCStatusCodeKey.Int(9)
+	// ABORTED
+	RPCGRPCStatusCodeAborted = RPCGRPCStatusCodeKey.Int(10)
+	// OUT_OF_RANGE
+	RPCGRPCStatusCodeOutOfRange = RPCGRPCStatusCodeKey.Int(11)
+	// UNIMPLEMENTED
+	RPCGRPCStatusCodeUnimplemented = RPCGRPCStatusCodeKey.Int(12)
+	// INTERNAL
+	RPCGRPCStatusCodeInternal = RPCGRPCStatusCodeKey.Int(13)
+	// UNAVAILABLE
+	RPCGRPCStatusCodeUnavailable = RPCGRPCStatusCodeKey.Int(14)
+	// DATA_LOSS
+	RPCGRPCStatusCodeDataLoss = RPCGRPCStatusCodeKey.Int(15)
+	// UNAUTHENTICATED
+	RPCGRPCStatusCodeUnauthenticated = RPCGRPCStatusCodeKey.Int(16)
+)
+
+// Tech-specific attributes for [JSON RPC](https://www.jsonrpc.org/).
+const (
+	// Protocol version as in `jsonrpc` property of request/response. Since JSON-RPC
+	// 1.0 does not specify this, the value can be omitted.
+	//
+	// Type: string
+	// Required: If missing, it is assumed to be "1.0".
+	// Stability: stable
+	// Examples: '2.0', '1.0'
+	RPCJsonrpcVersionKey = attribute.Key("rpc.jsonrpc.version")
+	// `id` property of request or response. Since protocol allows id to be int,
+	// string, `null` or missing (for notifications), value is expected to be cast to
+	// string for simplicity. Use empty string in case of `null` value. Omit entirely
+	// if this is a notification.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '10', 'request-7', ''
+	RPCJsonrpcRequestIDKey = attribute.Key("rpc.jsonrpc.request_id")
+	// `error.code` property of response if it is an error response.
+	//
+	// Type: int
+	// Required: If missing, response is assumed to be successful.
+	// Stability: stable
+	// Examples: -32700, 100
+	RPCJsonrpcErrorCodeKey = attribute.Key("rpc.jsonrpc.error_code")
+	// `error.message` property of response if it is an error response.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Parse error', 'User already exists'
+	RPCJsonrpcErrorMessageKey = attribute.Key("rpc.jsonrpc.error_message")
+)
+
+// RPC received/sent message.
+const (
+	// Whether this is a received or sent message.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	MessageTypeKey = attribute.Key("message.type")
+	// MUST be calculated as two different counters starting from `1` one for sent
+	// messages and one for received message.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Note: This way we guarantee that the values will be consistent between
+	// different implementations.
+	MessageIDKey = attribute.Key("message.id")
+	// Compressed size of the message in bytes.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	MessageCompressedSizeKey = attribute.Key("message.compressed_size")
+	// Uncompressed size of the message in bytes.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	MessageUncompressedSizeKey = attribute.Key("message.uncompressed_size")
+)
+
+var (
+	// sent
+	MessageTypeSent = MessageTypeKey.String("SENT")
+	// received
+	MessageTypeReceived = MessageTypeKey.String("RECEIVED")
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/doc.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/doc.go
new file mode 100644
index 0000000000..71a1f7748d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/doc.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package semconv implements OpenTelemetry semantic conventions.
+//
+// OpenTelemetry semantic conventions are agreed standardized naming
+// patterns for OpenTelemetry things. This package represents the conventions
+// as of the v1.17.0 version of the OpenTelemetry specification.
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/event.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/event.go
new file mode 100644
index 0000000000..679c40c4de
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/event.go
@@ -0,0 +1,199 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// This semantic convention defines the attributes used to represent a feature
+// flag evaluation as an event.
+const (
+	// FeatureFlagKeyKey is the attribute Key conforming to the
+	// "feature_flag.key" semantic conventions. It represents the unique
+	// identifier of the feature flag.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'logo-color'
+	FeatureFlagKeyKey = attribute.Key("feature_flag.key")
+
+	// FeatureFlagProviderNameKey is the attribute Key conforming to the
+	// "feature_flag.provider_name" semantic conventions. It represents the
+	// name of the service provider that performs the flag evaluation.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: stable
+	// Examples: 'Flag Manager'
+	FeatureFlagProviderNameKey = attribute.Key("feature_flag.provider_name")
+
+	// FeatureFlagVariantKey is the attribute Key conforming to the
+	// "feature_flag.variant" semantic conventions. It represents the sHOULD be
+	// a semantic identifier for a value. If one is unavailable, a stringified
+	// version of the value can be used.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: stable
+	// Examples: 'red', 'true', 'on'
+	// Note: A semantic identifier, commonly referred to as a variant, provides
+	// a means
+	// for referring to a value without including the value itself. This can
+	// provide additional context for understanding the meaning behind a value.
+	// For example, the variant `red` maybe be used for the value `#c05543`.
+	//
+	// A stringified version of the value can be used in situations where a
+	// semantic identifier is unavailable. String representation of the value
+	// should be determined by the implementer.
+	FeatureFlagVariantKey = attribute.Key("feature_flag.variant")
+)
+
+// FeatureFlagKey returns an attribute KeyValue conforming to the
+// "feature_flag.key" semantic conventions. It represents the unique identifier
+// of the feature flag.
+func FeatureFlagKey(val string) attribute.KeyValue {
+	return FeatureFlagKeyKey.String(val)
+}
+
+// FeatureFlagProviderName returns an attribute KeyValue conforming to the
+// "feature_flag.provider_name" semantic conventions. It represents the name of
+// the service provider that performs the flag evaluation.
+func FeatureFlagProviderName(val string) attribute.KeyValue {
+	return FeatureFlagProviderNameKey.String(val)
+}
+
+// FeatureFlagVariant returns an attribute KeyValue conforming to the
+// "feature_flag.variant" semantic conventions. It represents the sHOULD be a
+// semantic identifier for a value. If one is unavailable, a stringified
+// version of the value can be used.
+func FeatureFlagVariant(val string) attribute.KeyValue {
+	return FeatureFlagVariantKey.String(val)
+}
+
+// RPC received/sent message.
+const (
+	// MessageTypeKey is the attribute Key conforming to the "message.type"
+	// semantic conventions. It represents the whether this is a received or
+	// sent message.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessageTypeKey = attribute.Key("message.type")
+
+	// MessageIDKey is the attribute Key conforming to the "message.id"
+	// semantic conventions. It represents the mUST be calculated as two
+	// different counters starting from `1` one for sent messages and one for
+	// received message.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: This way we guarantee that the values will be consistent between
+	// different implementations.
+	MessageIDKey = attribute.Key("message.id")
+
+	// MessageCompressedSizeKey is the attribute Key conforming to the
+	// "message.compressed_size" semantic conventions. It represents the
+	// compressed size of the message in bytes.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessageCompressedSizeKey = attribute.Key("message.compressed_size")
+
+	// MessageUncompressedSizeKey is the attribute Key conforming to the
+	// "message.uncompressed_size" semantic conventions. It represents the
+	// uncompressed size of the message in bytes.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessageUncompressedSizeKey = attribute.Key("message.uncompressed_size")
+)
+
+var (
+	// sent
+	MessageTypeSent = MessageTypeKey.String("SENT")
+	// received
+	MessageTypeReceived = MessageTypeKey.String("RECEIVED")
+)
+
+// MessageID returns an attribute KeyValue conforming to the "message.id"
+// semantic conventions. It represents the mUST be calculated as two different
+// counters starting from `1` one for sent messages and one for received
+// message.
+func MessageID(val int) attribute.KeyValue {
+	return MessageIDKey.Int(val)
+}
+
+// MessageCompressedSize returns an attribute KeyValue conforming to the
+// "message.compressed_size" semantic conventions. It represents the compressed
+// size of the message in bytes.
+func MessageCompressedSize(val int) attribute.KeyValue {
+	return MessageCompressedSizeKey.Int(val)
+}
+
+// MessageUncompressedSize returns an attribute KeyValue conforming to the
+// "message.uncompressed_size" semantic conventions. It represents the
+// uncompressed size of the message in bytes.
+func MessageUncompressedSize(val int) attribute.KeyValue {
+	return MessageUncompressedSizeKey.Int(val)
+}
+
+// The attributes used to report a single exception associated with a span.
+const (
+	// ExceptionEscapedKey is the attribute Key conforming to the
+	// "exception.escaped" semantic conventions. It represents the sHOULD be
+	// set to true if the exception event is recorded at a point where it is
+	// known that the exception is escaping the scope of the span.
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: An exception is considered to have escaped (or left) the scope of
+	// a span,
+	// if that span is ended while the exception is still logically "in
+	// flight".
+	// This may be actually "in flight" in some languages (e.g. if the
+	// exception
+	// is passed to a Context manager's `__exit__` method in Python) but will
+	// usually be caught at the point of recording the exception in most
+	// languages.
+	//
+	// It is usually not possible to determine at the point where an exception
+	// is thrown
+	// whether it will escape the scope of a span.
+	// However, it is trivial to know that an exception
+	// will escape, if one checks for an active exception just before ending
+	// the span,
+	// as done in the [example above](#recording-an-exception).
+	//
+	// It follows that an exception may still escape the scope of the span
+	// even if the `exception.escaped` attribute was not set or set to false,
+	// since the event might have been recorded at a time where it was not
+	// clear whether the exception will escape.
+	ExceptionEscapedKey = attribute.Key("exception.escaped")
+)
+
+// ExceptionEscaped returns an attribute KeyValue conforming to the
+// "exception.escaped" semantic conventions. It represents the sHOULD be set to
+// true if the exception event is recorded at a point where it is known that
+// the exception is escaping the scope of the span.
+func ExceptionEscaped(val bool) attribute.KeyValue {
+	return ExceptionEscapedKey.Bool(val)
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/exception.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/exception.go
new file mode 100644
index 0000000000..9b8c559de4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/exception.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
+
+const (
+	// ExceptionEventName is the name of the Span event representing an exception.
+	ExceptionEventName = "exception"
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/http.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/http.go
new file mode 100644
index 0000000000..d5c4b5c136
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/http.go
@@ -0,0 +1,21 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
+
+// HTTP scheme attributes.
+var (
+	HTTPSchemeHTTP  = HTTPSchemeKey.String("http")
+	HTTPSchemeHTTPS = HTTPSchemeKey.String("https")
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/resource.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/resource.go
new file mode 100644
index 0000000000..39a2eab3a6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/resource.go
@@ -0,0 +1,2010 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// The web browser in which the application represented by the resource is
+// running. The `browser.*` attributes MUST be used only for resources that
+// represent applications running in a web browser (regardless of whether
+// running on a mobile or desktop device).
+const (
+	// BrowserBrandsKey is the attribute Key conforming to the "browser.brands"
+	// semantic conventions. It represents the array of brand name and version
+	// separated by a space
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: ' Not A;Brand 99', 'Chromium 99', 'Chrome 99'
+	// Note: This value is intended to be taken from the [UA client hints
+	// API](https://wicg.github.io/ua-client-hints/#interface)
+	// (`navigator.userAgentData.brands`).
+	BrowserBrandsKey = attribute.Key("browser.brands")
+
+	// BrowserPlatformKey is the attribute Key conforming to the
+	// "browser.platform" semantic conventions. It represents the platform on
+	// which the browser is running
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Windows', 'macOS', 'Android'
+	// Note: This value is intended to be taken from the [UA client hints
+	// API](https://wicg.github.io/ua-client-hints/#interface)
+	// (`navigator.userAgentData.platform`). If unavailable, the legacy
+	// `navigator.platform` API SHOULD NOT be used instead and this attribute
+	// SHOULD be left unset in order for the values to be consistent.
+	// The list of possible values is defined in the [W3C User-Agent Client
+	// Hints
+	// specification](https://wicg.github.io/ua-client-hints/#sec-ch-ua-platform).
+	// Note that some (but not all) of these values can overlap with values in
+	// the [`os.type` and `os.name` attributes](./os.md). However, for
+	// consistency, the values in the `browser.platform` attribute should
+	// capture the exact value that the user agent provides.
+	BrowserPlatformKey = attribute.Key("browser.platform")
+
+	// BrowserMobileKey is the attribute Key conforming to the "browser.mobile"
+	// semantic conventions. It represents a boolean that is true if the
+	// browser is running on a mobile device
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: This value is intended to be taken from the [UA client hints
+	// API](https://wicg.github.io/ua-client-hints/#interface)
+	// (`navigator.userAgentData.mobile`). If unavailable, this attribute
+	// SHOULD be left unset.
+	BrowserMobileKey = attribute.Key("browser.mobile")
+
+	// BrowserUserAgentKey is the attribute Key conforming to the
+	// "browser.user_agent" semantic conventions. It represents the full
+	// user-agent string provided by the browser
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
+	// AppleWebKit/537.36 (KHTML, '
+	//  'like Gecko) Chrome/95.0.4638.54 Safari/537.36'
+	// Note: The user-agent value SHOULD be provided only from browsers that do
+	// not have a mechanism to retrieve brands and platform individually from
+	// the User-Agent Client Hints API. To retrieve the value, the legacy
+	// `navigator.userAgent` API can be used.
+	BrowserUserAgentKey = attribute.Key("browser.user_agent")
+
+	// BrowserLanguageKey is the attribute Key conforming to the
+	// "browser.language" semantic conventions. It represents the preferred
+	// language of the user using the browser
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'en', 'en-US', 'fr', 'fr-FR'
+	// Note: This value is intended to be taken from the Navigator API
+	// `navigator.language`.
+	BrowserLanguageKey = attribute.Key("browser.language")
+)
+
+// BrowserBrands returns an attribute KeyValue conforming to the
+// "browser.brands" semantic conventions. It represents the array of brand name
+// and version separated by a space
+func BrowserBrands(val ...string) attribute.KeyValue {
+	return BrowserBrandsKey.StringSlice(val)
+}
+
+// BrowserPlatform returns an attribute KeyValue conforming to the
+// "browser.platform" semantic conventions. It represents the platform on which
+// the browser is running
+func BrowserPlatform(val string) attribute.KeyValue {
+	return BrowserPlatformKey.String(val)
+}
+
+// BrowserMobile returns an attribute KeyValue conforming to the
+// "browser.mobile" semantic conventions. It represents a boolean that is true
+// if the browser is running on a mobile device
+func BrowserMobile(val bool) attribute.KeyValue {
+	return BrowserMobileKey.Bool(val)
+}
+
+// BrowserUserAgent returns an attribute KeyValue conforming to the
+// "browser.user_agent" semantic conventions. It represents the full user-agent
+// string provided by the browser
+func BrowserUserAgent(val string) attribute.KeyValue {
+	return BrowserUserAgentKey.String(val)
+}
+
+// BrowserLanguage returns an attribute KeyValue conforming to the
+// "browser.language" semantic conventions. It represents the preferred
+// language of the user using the browser
+func BrowserLanguage(val string) attribute.KeyValue {
+	return BrowserLanguageKey.String(val)
+}
+
+// A cloud environment (e.g. GCP, Azure, AWS)
+const (
+	// CloudProviderKey is the attribute Key conforming to the "cloud.provider"
+	// semantic conventions. It represents the name of the cloud provider.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	CloudProviderKey = attribute.Key("cloud.provider")
+
+	// CloudAccountIDKey is the attribute Key conforming to the
+	// "cloud.account.id" semantic conventions. It represents the cloud account
+	// ID the resource is assigned to.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '111111111111', 'opentelemetry'
+	CloudAccountIDKey = attribute.Key("cloud.account.id")
+
+	// CloudRegionKey is the attribute Key conforming to the "cloud.region"
+	// semantic conventions. It represents the geographical region the resource
+	// is running.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'us-central1', 'us-east-1'
+	// Note: Refer to your provider's docs to see the available regions, for
+	// example [Alibaba Cloud
+	// regions](https://www.alibabacloud.com/help/doc-detail/40654.htm), [AWS
+	// regions](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/),
+	// [Azure
+	// regions](https://azure.microsoft.com/en-us/global-infrastructure/geographies/),
+	// [Google Cloud regions](https://cloud.google.com/about/locations), or
+	// [Tencent Cloud
+	// regions](https://intl.cloud.tencent.com/document/product/213/6091).
+	CloudRegionKey = attribute.Key("cloud.region")
+
+	// CloudAvailabilityZoneKey is the attribute Key conforming to the
+	// "cloud.availability_zone" semantic conventions. It represents the cloud
+	// regions often have multiple, isolated locations known as zones to
+	// increase availability. Availability zone represents the zone where the
+	// resource is running.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'us-east-1c'
+	// Note: Availability zones are called "zones" on Alibaba Cloud and Google
+	// Cloud.
+	CloudAvailabilityZoneKey = attribute.Key("cloud.availability_zone")
+
+	// CloudPlatformKey is the attribute Key conforming to the "cloud.platform"
+	// semantic conventions. It represents the cloud platform in use.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: The prefix of the service SHOULD match the one specified in
+	// `cloud.provider`.
+	CloudPlatformKey = attribute.Key("cloud.platform")
+)
+
+var (
+	// Alibaba Cloud
+	CloudProviderAlibabaCloud = CloudProviderKey.String("alibaba_cloud")
+	// Amazon Web Services
+	CloudProviderAWS = CloudProviderKey.String("aws")
+	// Microsoft Azure
+	CloudProviderAzure = CloudProviderKey.String("azure")
+	// Google Cloud Platform
+	CloudProviderGCP = CloudProviderKey.String("gcp")
+	// IBM Cloud
+	CloudProviderIbmCloud = CloudProviderKey.String("ibm_cloud")
+	// Tencent Cloud
+	CloudProviderTencentCloud = CloudProviderKey.String("tencent_cloud")
+)
+
+var (
+	// Alibaba Cloud Elastic Compute Service
+	CloudPlatformAlibabaCloudECS = CloudPlatformKey.String("alibaba_cloud_ecs")
+	// Alibaba Cloud Function Compute
+	CloudPlatformAlibabaCloudFc = CloudPlatformKey.String("alibaba_cloud_fc")
+	// Red Hat OpenShift on Alibaba Cloud
+	CloudPlatformAlibabaCloudOpenshift = CloudPlatformKey.String("alibaba_cloud_openshift")
+	// AWS Elastic Compute Cloud
+	CloudPlatformAWSEC2 = CloudPlatformKey.String("aws_ec2")
+	// AWS Elastic Container Service
+	CloudPlatformAWSECS = CloudPlatformKey.String("aws_ecs")
+	// AWS Elastic Kubernetes Service
+	CloudPlatformAWSEKS = CloudPlatformKey.String("aws_eks")
+	// AWS Lambda
+	CloudPlatformAWSLambda = CloudPlatformKey.String("aws_lambda")
+	// AWS Elastic Beanstalk
+	CloudPlatformAWSElasticBeanstalk = CloudPlatformKey.String("aws_elastic_beanstalk")
+	// AWS App Runner
+	CloudPlatformAWSAppRunner = CloudPlatformKey.String("aws_app_runner")
+	// Red Hat OpenShift on AWS (ROSA)
+	CloudPlatformAWSOpenshift = CloudPlatformKey.String("aws_openshift")
+	// Azure Virtual Machines
+	CloudPlatformAzureVM = CloudPlatformKey.String("azure_vm")
+	// Azure Container Instances
+	CloudPlatformAzureContainerInstances = CloudPlatformKey.String("azure_container_instances")
+	// Azure Kubernetes Service
+	CloudPlatformAzureAKS = CloudPlatformKey.String("azure_aks")
+	// Azure Functions
+	CloudPlatformAzureFunctions = CloudPlatformKey.String("azure_functions")
+	// Azure App Service
+	CloudPlatformAzureAppService = CloudPlatformKey.String("azure_app_service")
+	// Azure Red Hat OpenShift
+	CloudPlatformAzureOpenshift = CloudPlatformKey.String("azure_openshift")
+	// Google Cloud Compute Engine (GCE)
+	CloudPlatformGCPComputeEngine = CloudPlatformKey.String("gcp_compute_engine")
+	// Google Cloud Run
+	CloudPlatformGCPCloudRun = CloudPlatformKey.String("gcp_cloud_run")
+	// Google Cloud Kubernetes Engine (GKE)
+	CloudPlatformGCPKubernetesEngine = CloudPlatformKey.String("gcp_kubernetes_engine")
+	// Google Cloud Functions (GCF)
+	CloudPlatformGCPCloudFunctions = CloudPlatformKey.String("gcp_cloud_functions")
+	// Google Cloud App Engine (GAE)
+	CloudPlatformGCPAppEngine = CloudPlatformKey.String("gcp_app_engine")
+	// Red Hat OpenShift on Google Cloud
+	CloudPlatformGoogleCloudOpenshift = CloudPlatformKey.String("google_cloud_openshift")
+	// Red Hat OpenShift on IBM Cloud
+	CloudPlatformIbmCloudOpenshift = CloudPlatformKey.String("ibm_cloud_openshift")
+	// Tencent Cloud Cloud Virtual Machine (CVM)
+	CloudPlatformTencentCloudCvm = CloudPlatformKey.String("tencent_cloud_cvm")
+	// Tencent Cloud Elastic Kubernetes Service (EKS)
+	CloudPlatformTencentCloudEKS = CloudPlatformKey.String("tencent_cloud_eks")
+	// Tencent Cloud Serverless Cloud Function (SCF)
+	CloudPlatformTencentCloudScf = CloudPlatformKey.String("tencent_cloud_scf")
+)
+
+// CloudAccountID returns an attribute KeyValue conforming to the
+// "cloud.account.id" semantic conventions. It represents the cloud account ID
+// the resource is assigned to.
+func CloudAccountID(val string) attribute.KeyValue {
+	return CloudAccountIDKey.String(val)
+}
+
+// CloudRegion returns an attribute KeyValue conforming to the
+// "cloud.region" semantic conventions. It represents the geographical region
+// the resource is running.
+func CloudRegion(val string) attribute.KeyValue {
+	return CloudRegionKey.String(val)
+}
+
+// CloudAvailabilityZone returns an attribute KeyValue conforming to the
+// "cloud.availability_zone" semantic conventions. It represents the cloud
+// regions often have multiple, isolated locations known as zones to increase
+// availability. Availability zone represents the zone where the resource is
+// running.
+func CloudAvailabilityZone(val string) attribute.KeyValue {
+	return CloudAvailabilityZoneKey.String(val)
+}
+
+// Resources used by AWS Elastic Container Service (ECS).
+const (
+	// AWSECSContainerARNKey is the attribute Key conforming to the
+	// "aws.ecs.container.arn" semantic conventions. It represents the Amazon
+	// Resource Name (ARN) of an [ECS container
+	// instance](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_instances.html).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples:
+	// 'arn:aws:ecs:us-west-1:123456789123:container/32624152-9086-4f0e-acae-1a75b14fe4d9'
+	AWSECSContainerARNKey = attribute.Key("aws.ecs.container.arn")
+
+	// AWSECSClusterARNKey is the attribute Key conforming to the
+	// "aws.ecs.cluster.arn" semantic conventions. It represents the ARN of an
+	// [ECS
+	// cluster](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/clusters.html).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-west-2:123456789123:cluster/my-cluster'
+	AWSECSClusterARNKey = attribute.Key("aws.ecs.cluster.arn")
+
+	// AWSECSLaunchtypeKey is the attribute Key conforming to the
+	// "aws.ecs.launchtype" semantic conventions. It represents the [launch
+	// type](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_types.html)
+	// for an ECS task.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	AWSECSLaunchtypeKey = attribute.Key("aws.ecs.launchtype")
+
+	// AWSECSTaskARNKey is the attribute Key conforming to the
+	// "aws.ecs.task.arn" semantic conventions. It represents the ARN of an
+	// [ECS task
+	// definition](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples:
+	// 'arn:aws:ecs:us-west-1:123456789123:task/10838bed-421f-43ef-870a-f43feacbbb5b'
+	AWSECSTaskARNKey = attribute.Key("aws.ecs.task.arn")
+
+	// AWSECSTaskFamilyKey is the attribute Key conforming to the
+	// "aws.ecs.task.family" semantic conventions. It represents the task
+	// definition family this task definition is a member of.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry-family'
+	AWSECSTaskFamilyKey = attribute.Key("aws.ecs.task.family")
+
+	// AWSECSTaskRevisionKey is the attribute Key conforming to the
+	// "aws.ecs.task.revision" semantic conventions. It represents the revision
+	// for this task definition.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '8', '26'
+	AWSECSTaskRevisionKey = attribute.Key("aws.ecs.task.revision")
+)
+
+var (
+	// ec2
+	AWSECSLaunchtypeEC2 = AWSECSLaunchtypeKey.String("ec2")
+	// fargate
+	AWSECSLaunchtypeFargate = AWSECSLaunchtypeKey.String("fargate")
+)
+
+// AWSECSContainerARN returns an attribute KeyValue conforming to the
+// "aws.ecs.container.arn" semantic conventions. It represents the Amazon
+// Resource Name (ARN) of an [ECS container
+// instance](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_instances.html).
+func AWSECSContainerARN(val string) attribute.KeyValue {
+	return AWSECSContainerARNKey.String(val)
+}
+
+// AWSECSClusterARN returns an attribute KeyValue conforming to the
+// "aws.ecs.cluster.arn" semantic conventions. It represents the ARN of an [ECS
+// cluster](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/clusters.html).
+func AWSECSClusterARN(val string) attribute.KeyValue {
+	return AWSECSClusterARNKey.String(val)
+}
+
+// AWSECSTaskARN returns an attribute KeyValue conforming to the
+// "aws.ecs.task.arn" semantic conventions. It represents the ARN of an [ECS
+// task
+// definition](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html).
+func AWSECSTaskARN(val string) attribute.KeyValue {
+	return AWSECSTaskARNKey.String(val)
+}
+
+// AWSECSTaskFamily returns an attribute KeyValue conforming to the
+// "aws.ecs.task.family" semantic conventions. It represents the task
+// definition family this task definition is a member of.
+func AWSECSTaskFamily(val string) attribute.KeyValue {
+	return AWSECSTaskFamilyKey.String(val)
+}
+
+// AWSECSTaskRevision returns an attribute KeyValue conforming to the
+// "aws.ecs.task.revision" semantic conventions. It represents the revision for
+// this task definition.
+func AWSECSTaskRevision(val string) attribute.KeyValue {
+	return AWSECSTaskRevisionKey.String(val)
+}
+
+// Resources used by AWS Elastic Kubernetes Service (EKS).
+const (
+	// AWSEKSClusterARNKey is the attribute Key conforming to the
+	// "aws.eks.cluster.arn" semantic conventions. It represents the ARN of an
+	// EKS cluster.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-west-2:123456789123:cluster/my-cluster'
+	AWSEKSClusterARNKey = attribute.Key("aws.eks.cluster.arn")
+)
+
+// AWSEKSClusterARN returns an attribute KeyValue conforming to the
+// "aws.eks.cluster.arn" semantic conventions. It represents the ARN of an EKS
+// cluster.
+func AWSEKSClusterARN(val string) attribute.KeyValue {
+	return AWSEKSClusterARNKey.String(val)
+}
+
+// Resources specific to Amazon Web Services.
+const (
+	// AWSLogGroupNamesKey is the attribute Key conforming to the
+	// "aws.log.group.names" semantic conventions. It represents the name(s) of
+	// the AWS log group(s) an application is writing to.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '/aws/lambda/my-function', 'opentelemetry-service'
+	// Note: Multiple log groups must be supported for cases like
+	// multi-container applications, where a single application has sidecar
+	// containers, and each write to their own log group.
+	AWSLogGroupNamesKey = attribute.Key("aws.log.group.names")
+
+	// AWSLogGroupARNsKey is the attribute Key conforming to the
+	// "aws.log.group.arns" semantic conventions. It represents the Amazon
+	// Resource Name(s) (ARN) of the AWS log group(s).
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples:
+	// 'arn:aws:logs:us-west-1:123456789012:log-group:/aws/my/group:*'
+	// Note: See the [log group ARN format
+	// documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html#CWL_ARN_Format).
+	AWSLogGroupARNsKey = attribute.Key("aws.log.group.arns")
+
+	// AWSLogStreamNamesKey is the attribute Key conforming to the
+	// "aws.log.stream.names" semantic conventions. It represents the name(s)
+	// of the AWS log stream(s) an application is writing to.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'logs/main/10838bed-421f-43ef-870a-f43feacbbb5b'
+	AWSLogStreamNamesKey = attribute.Key("aws.log.stream.names")
+
+	// AWSLogStreamARNsKey is the attribute Key conforming to the
+	// "aws.log.stream.arns" semantic conventions. It represents the ARN(s) of
+	// the AWS log stream(s).
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples:
+	// 'arn:aws:logs:us-west-1:123456789012:log-group:/aws/my/group:log-stream:logs/main/10838bed-421f-43ef-870a-f43feacbbb5b'
+	// Note: See the [log stream ARN format
+	// documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html#CWL_ARN_Format).
+	// One log group can contain several log streams, so these ARNs necessarily
+	// identify both a log group and a log stream.
+	AWSLogStreamARNsKey = attribute.Key("aws.log.stream.arns")
+)
+
+// AWSLogGroupNames returns an attribute KeyValue conforming to the
+// "aws.log.group.names" semantic conventions. It represents the name(s) of the
+// AWS log group(s) an application is writing to.
+func AWSLogGroupNames(val ...string) attribute.KeyValue {
+	return AWSLogGroupNamesKey.StringSlice(val)
+}
+
+// AWSLogGroupARNs returns an attribute KeyValue conforming to the
+// "aws.log.group.arns" semantic conventions. It represents the Amazon Resource
+// Name(s) (ARN) of the AWS log group(s).
+func AWSLogGroupARNs(val ...string) attribute.KeyValue {
+	return AWSLogGroupARNsKey.StringSlice(val)
+}
+
+// AWSLogStreamNames returns an attribute KeyValue conforming to the
+// "aws.log.stream.names" semantic conventions. It represents the name(s) of
+// the AWS log stream(s) an application is writing to.
+func AWSLogStreamNames(val ...string) attribute.KeyValue {
+	return AWSLogStreamNamesKey.StringSlice(val)
+}
+
+// AWSLogStreamARNs returns an attribute KeyValue conforming to the
+// "aws.log.stream.arns" semantic conventions. It represents the ARN(s) of the
+// AWS log stream(s).
+func AWSLogStreamARNs(val ...string) attribute.KeyValue {
+	return AWSLogStreamARNsKey.StringSlice(val)
+}
+
+// A container instance.
+const (
+	// ContainerNameKey is the attribute Key conforming to the "container.name"
+	// semantic conventions. It represents the container name used by container
+	// runtime.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry-autoconf'
+	ContainerNameKey = attribute.Key("container.name")
+
+	// ContainerIDKey is the attribute Key conforming to the "container.id"
+	// semantic conventions. It represents the container ID. Usually a UUID, as
+	// for example used to [identify Docker
+	// containers](https://docs.docker.com/engine/reference/run/#container-identification).
+	// The UUID might be abbreviated.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'a3bf90e006b2'
+	ContainerIDKey = attribute.Key("container.id")
+
+	// ContainerRuntimeKey is the attribute Key conforming to the
+	// "container.runtime" semantic conventions. It represents the container
+	// runtime managing this container.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'docker', 'containerd', 'rkt'
+	ContainerRuntimeKey = attribute.Key("container.runtime")
+
+	// ContainerImageNameKey is the attribute Key conforming to the
+	// "container.image.name" semantic conventions. It represents the name of
+	// the image the container was built on.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'gcr.io/opentelemetry/operator'
+	ContainerImageNameKey = attribute.Key("container.image.name")
+
+	// ContainerImageTagKey is the attribute Key conforming to the
+	// "container.image.tag" semantic conventions. It represents the container
+	// image tag.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '0.1'
+	ContainerImageTagKey = attribute.Key("container.image.tag")
+)
+
+// ContainerName returns an attribute KeyValue conforming to the
+// "container.name" semantic conventions. It represents the container name used
+// by container runtime.
+func ContainerName(val string) attribute.KeyValue {
+	return ContainerNameKey.String(val)
+}
+
+// ContainerID returns an attribute KeyValue conforming to the
+// "container.id" semantic conventions. It represents the container ID. Usually
+// a UUID, as for example used to [identify Docker
+// containers](https://docs.docker.com/engine/reference/run/#container-identification).
+// The UUID might be abbreviated.
+func ContainerID(val string) attribute.KeyValue {
+	return ContainerIDKey.String(val)
+}
+
+// ContainerRuntime returns an attribute KeyValue conforming to the
+// "container.runtime" semantic conventions. It represents the container
+// runtime managing this container.
+func ContainerRuntime(val string) attribute.KeyValue {
+	return ContainerRuntimeKey.String(val)
+}
+
+// ContainerImageName returns an attribute KeyValue conforming to the
+// "container.image.name" semantic conventions. It represents the name of the
+// image the container was built on.
+func ContainerImageName(val string) attribute.KeyValue {
+	return ContainerImageNameKey.String(val)
+}
+
+// ContainerImageTag returns an attribute KeyValue conforming to the
+// "container.image.tag" semantic conventions. It represents the container
+// image tag.
+func ContainerImageTag(val string) attribute.KeyValue {
+	return ContainerImageTagKey.String(val)
+}
+
+// The software deployment.
+const (
+	// DeploymentEnvironmentKey is the attribute Key conforming to the
+	// "deployment.environment" semantic conventions. It represents the name of
+	// the [deployment
+	// environment](https://en.wikipedia.org/wiki/Deployment_environment) (aka
+	// deployment tier).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'staging', 'production'
+	DeploymentEnvironmentKey = attribute.Key("deployment.environment")
+)
+
+// DeploymentEnvironment returns an attribute KeyValue conforming to the
+// "deployment.environment" semantic conventions. It represents the name of the
+// [deployment
+// environment](https://en.wikipedia.org/wiki/Deployment_environment) (aka
+// deployment tier).
+func DeploymentEnvironment(val string) attribute.KeyValue {
+	return DeploymentEnvironmentKey.String(val)
+}
+
+// The device on which the process represented by this resource is running.
+const (
+	// DeviceIDKey is the attribute Key conforming to the "device.id" semantic
+	// conventions. It represents a unique identifier representing the device
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '2ab2916d-a51f-4ac8-80ee-45ac31a28092'
+	// Note: The device identifier MUST only be defined using the values
+	// outlined below. This value is not an advertising identifier and MUST NOT
+	// be used as such. On iOS (Swift or Objective-C), this value MUST be equal
+	// to the [vendor
+	// identifier](https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor).
+	// On Android (Java or Kotlin), this value MUST be equal to the Firebase
+	// Installation ID or a globally unique UUID which is persisted across
+	// sessions in your application. More information can be found
+	// [here](https://developer.android.com/training/articles/user-data-ids) on
+	// best practices and exact implementation details. Caution should be taken
+	// when storing personal data or anything which can identify a user. GDPR
+	// and data protection laws may apply, ensure you do your own due
+	// diligence.
+	DeviceIDKey = attribute.Key("device.id")
+
+	// DeviceModelIdentifierKey is the attribute Key conforming to the
+	// "device.model.identifier" semantic conventions. It represents the model
+	// identifier for the device
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'iPhone3,4', 'SM-G920F'
+	// Note: It's recommended this value represents a machine readable version
+	// of the model identifier rather than the market or consumer-friendly name
+	// of the device.
+	DeviceModelIdentifierKey = attribute.Key("device.model.identifier")
+
+	// DeviceModelNameKey is the attribute Key conforming to the
+	// "device.model.name" semantic conventions. It represents the marketing
+	// name for the device model
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'iPhone 6s Plus', 'Samsung Galaxy S6'
+	// Note: It's recommended this value represents a human readable version of
+	// the device model rather than a machine readable alternative.
+	DeviceModelNameKey = attribute.Key("device.model.name")
+
+	// DeviceManufacturerKey is the attribute Key conforming to the
+	// "device.manufacturer" semantic conventions. It represents the name of
+	// the device manufacturer
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Apple', 'Samsung'
+	// Note: The Android OS provides this field via
+	// [Build](https://developer.android.com/reference/android/os/Build#MANUFACTURER).
+	// iOS apps SHOULD hardcode the value `Apple`.
+	DeviceManufacturerKey = attribute.Key("device.manufacturer")
+)
+
+// DeviceID returns an attribute KeyValue conforming to the "device.id"
+// semantic conventions. It represents a unique identifier representing the
+// device
+func DeviceID(val string) attribute.KeyValue {
+	return DeviceIDKey.String(val)
+}
+
+// DeviceModelIdentifier returns an attribute KeyValue conforming to the
+// "device.model.identifier" semantic conventions. It represents the model
+// identifier for the device
+func DeviceModelIdentifier(val string) attribute.KeyValue {
+	return DeviceModelIdentifierKey.String(val)
+}
+
+// DeviceModelName returns an attribute KeyValue conforming to the
+// "device.model.name" semantic conventions. It represents the marketing name
+// for the device model
+func DeviceModelName(val string) attribute.KeyValue {
+	return DeviceModelNameKey.String(val)
+}
+
+// DeviceManufacturer returns an attribute KeyValue conforming to the
+// "device.manufacturer" semantic conventions. It represents the name of the
+// device manufacturer
+func DeviceManufacturer(val string) attribute.KeyValue {
+	return DeviceManufacturerKey.String(val)
+}
+
+// A serverless instance.
+const (
+	// FaaSNameKey is the attribute Key conforming to the "faas.name" semantic
+	// conventions. It represents the name of the single function that this
+	// runtime instance executes.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'my-function', 'myazurefunctionapp/some-function-name'
+	// Note: This is the name of the function as configured/deployed on the
+	// FaaS
+	// platform and is usually different from the name of the callback
+	// function (which may be stored in the
+	// [`code.namespace`/`code.function`](../../trace/semantic_conventions/span-general.md#source-code-attributes)
+	// span attributes).
+	//
+	// For some cloud providers, the above definition is ambiguous. The
+	// following
+	// definition of function name MUST be used for this attribute
+	// (and consequently the span name) for the listed cloud
+	// providers/products:
+	//
+	// * **Azure:**  The full name `<FUNCAPP>/<FUNC>`, i.e., function app name
+	//   followed by a forward slash followed by the function name (this form
+	//   can also be seen in the resource JSON for the function).
+	//   This means that a span attribute MUST be used, as an Azure function
+	//   app can host multiple functions that would usually share
+	//   a TracerProvider (see also the `faas.id` attribute).
+	FaaSNameKey = attribute.Key("faas.name")
+
+	// FaaSIDKey is the attribute Key conforming to the "faas.id" semantic
+	// conventions. It represents the unique ID of the single function that
+	// this runtime instance executes.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'arn:aws:lambda:us-west-2:123456789012:function:my-function'
+	// Note: On some cloud providers, it may not be possible to determine the
+	// full ID at startup,
+	// so consider setting `faas.id` as a span attribute instead.
+	//
+	// The exact value to use for `faas.id` depends on the cloud provider:
+	//
+	// * **AWS Lambda:** The function
+	// [ARN](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	//   Take care not to use the "invoked ARN" directly but replace any
+	//   [alias
+	// suffix](https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html)
+	//   with the resolved function version, as the same runtime instance may
+	// be invokable with
+	//   multiple different aliases.
+	// * **GCP:** The [URI of the
+	// resource](https://cloud.google.com/iam/docs/full-resource-names)
+	// * **Azure:** The [Fully Qualified Resource
+	// ID](https://docs.microsoft.com/en-us/rest/api/resources/resources/get-by-id)
+	// of the invoked function,
+	//   *not* the function app, having the form
+	// `/subscriptions/<SUBSCIPTION_GUID>/resourceGroups/<RG>/providers/Microsoft.Web/sites/<FUNCAPP>/functions/<FUNC>`.
+	//   This means that a span attribute MUST be used, as an Azure function
+	// app can host multiple functions that would usually share
+	//   a TracerProvider.
+	FaaSIDKey = attribute.Key("faas.id")
+
+	// FaaSVersionKey is the attribute Key conforming to the "faas.version"
+	// semantic conventions. It represents the immutable version of the
+	// function being executed.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '26', 'pinkfroid-00002'
+	// Note: Depending on the cloud provider and platform, use:
+	//
+	// * **AWS Lambda:** The [function
+	// version](https://docs.aws.amazon.com/lambda/latest/dg/configuration-versions.html)
+	//   (an integer represented as a decimal string).
+	// * **Google Cloud Run:** The
+	// [revision](https://cloud.google.com/run/docs/managing/revisions)
+	//   (i.e., the function name plus the revision suffix).
+	// * **Google Cloud Functions:** The value of the
+	//   [`K_REVISION` environment
+	// variable](https://cloud.google.com/functions/docs/env-var#runtime_environment_variables_set_automatically).
+	// * **Azure Functions:** Not applicable. Do not set this attribute.
+	FaaSVersionKey = attribute.Key("faas.version")
+
+	// FaaSInstanceKey is the attribute Key conforming to the "faas.instance"
+	// semantic conventions. It represents the execution environment ID as a
+	// string, that will be potentially reused for other invocations to the
+	// same function/function version.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '2021/06/28/[$LATEST]2f399eb14537447da05ab2a2e39309de'
+	// Note: * **AWS Lambda:** Use the (full) log stream name.
+	FaaSInstanceKey = attribute.Key("faas.instance")
+
+	// FaaSMaxMemoryKey is the attribute Key conforming to the
+	// "faas.max_memory" semantic conventions. It represents the amount of
+	// memory available to the serverless function in MiB.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 128
+	// Note: It's recommended to set this attribute since e.g. too little
+	// memory can easily stop a Java AWS Lambda function from working
+	// correctly. On AWS Lambda, the environment variable
+	// `AWS_LAMBDA_FUNCTION_MEMORY_SIZE` provides this information.
+	FaaSMaxMemoryKey = attribute.Key("faas.max_memory")
+)
+
+// FaaSName returns an attribute KeyValue conforming to the "faas.name"
+// semantic conventions. It represents the name of the single function that
+// this runtime instance executes.
+func FaaSName(val string) attribute.KeyValue {
+	return FaaSNameKey.String(val)
+}
+
+// FaaSID returns an attribute KeyValue conforming to the "faas.id" semantic
+// conventions. It represents the unique ID of the single function that this
+// runtime instance executes.
+func FaaSID(val string) attribute.KeyValue {
+	return FaaSIDKey.String(val)
+}
+
+// FaaSVersion returns an attribute KeyValue conforming to the
+// "faas.version" semantic conventions. It represents the immutable version of
+// the function being executed.
+func FaaSVersion(val string) attribute.KeyValue {
+	return FaaSVersionKey.String(val)
+}
+
+// FaaSInstance returns an attribute KeyValue conforming to the
+// "faas.instance" semantic conventions. It represents the execution
+// environment ID as a string, that will be potentially reused for other
+// invocations to the same function/function version.
+func FaaSInstance(val string) attribute.KeyValue {
+	return FaaSInstanceKey.String(val)
+}
+
+// FaaSMaxMemory returns an attribute KeyValue conforming to the
+// "faas.max_memory" semantic conventions. It represents the amount of memory
+// available to the serverless function in MiB.
+func FaaSMaxMemory(val int) attribute.KeyValue {
+	return FaaSMaxMemoryKey.Int(val)
+}
+
+// A host is defined as a general computing instance.
+const (
+	// HostIDKey is the attribute Key conforming to the "host.id" semantic
+	// conventions. It represents the unique host ID. For Cloud, this must be
+	// the instance_id assigned by the cloud provider. For non-containerized
+	// Linux systems, the `machine-id` located in `/etc/machine-id` or
+	// `/var/lib/dbus/machine-id` may be used.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'fdbf79e8af94cb7f9e8df36789187052'
+	HostIDKey = attribute.Key("host.id")
+
+	// HostNameKey is the attribute Key conforming to the "host.name" semantic
+	// conventions. It represents the name of the host. On Unix systems, it may
+	// contain what the hostname command returns, or the fully qualified
+	// hostname, or another name specified by the user.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry-test'
+	HostNameKey = attribute.Key("host.name")
+
+	// HostTypeKey is the attribute Key conforming to the "host.type" semantic
+	// conventions. It represents the type of host. For Cloud, this must be the
+	// machine type.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'n1-standard-1'
+	HostTypeKey = attribute.Key("host.type")
+
+	// HostArchKey is the attribute Key conforming to the "host.arch" semantic
+	// conventions. It represents the CPU architecture the host system is
+	// running on.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	HostArchKey = attribute.Key("host.arch")
+
+	// HostImageNameKey is the attribute Key conforming to the
+	// "host.image.name" semantic conventions. It represents the name of the VM
+	// image or OS install the host was instantiated from.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'infra-ami-eks-worker-node-7d4ec78312', 'CentOS-8-x86_64-1905'
+	HostImageNameKey = attribute.Key("host.image.name")
+
+	// HostImageIDKey is the attribute Key conforming to the "host.image.id"
+	// semantic conventions. It represents the vM image ID. For Cloud, this
+	// value is from the provider.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'ami-07b06b442921831e5'
+	HostImageIDKey = attribute.Key("host.image.id")
+
+	// HostImageVersionKey is the attribute Key conforming to the
+	// "host.image.version" semantic conventions. It represents the version
+	// string of the VM image as defined in [Version
+	// Attributes](README.md#version-attributes).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '0.1'
+	HostImageVersionKey = attribute.Key("host.image.version")
+)
+
+var (
+	// AMD64
+	HostArchAMD64 = HostArchKey.String("amd64")
+	// ARM32
+	HostArchARM32 = HostArchKey.String("arm32")
+	// ARM64
+	HostArchARM64 = HostArchKey.String("arm64")
+	// Itanium
+	HostArchIA64 = HostArchKey.String("ia64")
+	// 32-bit PowerPC
+	HostArchPPC32 = HostArchKey.String("ppc32")
+	// 64-bit PowerPC
+	HostArchPPC64 = HostArchKey.String("ppc64")
+	// IBM z/Architecture
+	HostArchS390x = HostArchKey.String("s390x")
+	// 32-bit x86
+	HostArchX86 = HostArchKey.String("x86")
+)
+
+// HostID returns an attribute KeyValue conforming to the "host.id" semantic
+// conventions. It represents the unique host ID. For Cloud, this must be the
+// instance_id assigned by the cloud provider. For non-containerized Linux
+// systems, the `machine-id` located in `/etc/machine-id` or
+// `/var/lib/dbus/machine-id` may be used.
+func HostID(val string) attribute.KeyValue {
+	return HostIDKey.String(val)
+}
+
+// HostName returns an attribute KeyValue conforming to the "host.name"
+// semantic conventions. It represents the name of the host. On Unix systems,
+// it may contain what the hostname command returns, or the fully qualified
+// hostname, or another name specified by the user.
+func HostName(val string) attribute.KeyValue {
+	return HostNameKey.String(val)
+}
+
+// HostType returns an attribute KeyValue conforming to the "host.type"
+// semantic conventions. It represents the type of host. For Cloud, this must
+// be the machine type.
+func HostType(val string) attribute.KeyValue {
+	return HostTypeKey.String(val)
+}
+
+// HostImageName returns an attribute KeyValue conforming to the
+// "host.image.name" semantic conventions. It represents the name of the VM
+// image or OS install the host was instantiated from.
+func HostImageName(val string) attribute.KeyValue {
+	return HostImageNameKey.String(val)
+}
+
+// HostImageID returns an attribute KeyValue conforming to the
+// "host.image.id" semantic conventions. It represents the vM image ID. For
+// Cloud, this value is from the provider.
+func HostImageID(val string) attribute.KeyValue {
+	return HostImageIDKey.String(val)
+}
+
+// HostImageVersion returns an attribute KeyValue conforming to the
+// "host.image.version" semantic conventions. It represents the version string
+// of the VM image as defined in [Version
+// Attributes](README.md#version-attributes).
+func HostImageVersion(val string) attribute.KeyValue {
+	return HostImageVersionKey.String(val)
+}
+
+// A Kubernetes Cluster.
+const (
+	// K8SClusterNameKey is the attribute Key conforming to the
+	// "k8s.cluster.name" semantic conventions. It represents the name of the
+	// cluster.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry-cluster'
+	K8SClusterNameKey = attribute.Key("k8s.cluster.name")
+)
+
+// K8SClusterName returns an attribute KeyValue conforming to the
+// "k8s.cluster.name" semantic conventions. It represents the name of the
+// cluster.
+func K8SClusterName(val string) attribute.KeyValue {
+	return K8SClusterNameKey.String(val)
+}
+
+// A Kubernetes Node object.
+const (
+	// K8SNodeNameKey is the attribute Key conforming to the "k8s.node.name"
+	// semantic conventions. It represents the name of the Node.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'node-1'
+	K8SNodeNameKey = attribute.Key("k8s.node.name")
+
+	// K8SNodeUIDKey is the attribute Key conforming to the "k8s.node.uid"
+	// semantic conventions. It represents the UID of the Node.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '1eb3a0c6-0477-4080-a9cb-0cb7db65c6a2'
+	K8SNodeUIDKey = attribute.Key("k8s.node.uid")
+)
+
+// K8SNodeName returns an attribute KeyValue conforming to the
+// "k8s.node.name" semantic conventions. It represents the name of the Node.
+func K8SNodeName(val string) attribute.KeyValue {
+	return K8SNodeNameKey.String(val)
+}
+
+// K8SNodeUID returns an attribute KeyValue conforming to the "k8s.node.uid"
+// semantic conventions. It represents the UID of the Node.
+func K8SNodeUID(val string) attribute.KeyValue {
+	return K8SNodeUIDKey.String(val)
+}
+
+// A Kubernetes Namespace.
+const (
+	// K8SNamespaceNameKey is the attribute Key conforming to the
+	// "k8s.namespace.name" semantic conventions. It represents the name of the
+	// namespace that the pod is running in.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'default'
+	K8SNamespaceNameKey = attribute.Key("k8s.namespace.name")
+)
+
+// K8SNamespaceName returns an attribute KeyValue conforming to the
+// "k8s.namespace.name" semantic conventions. It represents the name of the
+// namespace that the pod is running in.
+func K8SNamespaceName(val string) attribute.KeyValue {
+	return K8SNamespaceNameKey.String(val)
+}
+
+// A Kubernetes Pod object.
+const (
+	// K8SPodUIDKey is the attribute Key conforming to the "k8s.pod.uid"
+	// semantic conventions. It represents the UID of the Pod.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SPodUIDKey = attribute.Key("k8s.pod.uid")
+
+	// K8SPodNameKey is the attribute Key conforming to the "k8s.pod.name"
+	// semantic conventions. It represents the name of the Pod.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry-pod-autoconf'
+	K8SPodNameKey = attribute.Key("k8s.pod.name")
+)
+
+// K8SPodUID returns an attribute KeyValue conforming to the "k8s.pod.uid"
+// semantic conventions. It represents the UID of the Pod.
+func K8SPodUID(val string) attribute.KeyValue {
+	return K8SPodUIDKey.String(val)
+}
+
+// K8SPodName returns an attribute KeyValue conforming to the "k8s.pod.name"
+// semantic conventions. It represents the name of the Pod.
+func K8SPodName(val string) attribute.KeyValue {
+	return K8SPodNameKey.String(val)
+}
+
+// A container in a
+// [PodTemplate](https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates).
+const (
+	// K8SContainerNameKey is the attribute Key conforming to the
+	// "k8s.container.name" semantic conventions. It represents the name of the
+	// Container from Pod specification, must be unique within a Pod. Container
+	// runtime usually uses different globally unique name (`container.name`).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'redis'
+	K8SContainerNameKey = attribute.Key("k8s.container.name")
+
+	// K8SContainerRestartCountKey is the attribute Key conforming to the
+	// "k8s.container.restart_count" semantic conventions. It represents the
+	// number of times the container was restarted. This attribute can be used
+	// to identify a particular container (running or stopped) within a
+	// container spec.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 0, 2
+	K8SContainerRestartCountKey = attribute.Key("k8s.container.restart_count")
+)
+
+// K8SContainerName returns an attribute KeyValue conforming to the
+// "k8s.container.name" semantic conventions. It represents the name of the
+// Container from Pod specification, must be unique within a Pod. Container
+// runtime usually uses different globally unique name (`container.name`).
+func K8SContainerName(val string) attribute.KeyValue {
+	return K8SContainerNameKey.String(val)
+}
+
+// K8SContainerRestartCount returns an attribute KeyValue conforming to the
+// "k8s.container.restart_count" semantic conventions. It represents the number
+// of times the container was restarted. This attribute can be used to identify
+// a particular container (running or stopped) within a container spec.
+func K8SContainerRestartCount(val int) attribute.KeyValue {
+	return K8SContainerRestartCountKey.Int(val)
+}
+
+// A Kubernetes ReplicaSet object.
+const (
+	// K8SReplicaSetUIDKey is the attribute Key conforming to the
+	// "k8s.replicaset.uid" semantic conventions. It represents the UID of the
+	// ReplicaSet.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SReplicaSetUIDKey = attribute.Key("k8s.replicaset.uid")
+
+	// K8SReplicaSetNameKey is the attribute Key conforming to the
+	// "k8s.replicaset.name" semantic conventions. It represents the name of
+	// the ReplicaSet.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SReplicaSetNameKey = attribute.Key("k8s.replicaset.name")
+)
+
+// K8SReplicaSetUID returns an attribute KeyValue conforming to the
+// "k8s.replicaset.uid" semantic conventions. It represents the UID of the
+// ReplicaSet.
+func K8SReplicaSetUID(val string) attribute.KeyValue {
+	return K8SReplicaSetUIDKey.String(val)
+}
+
+// K8SReplicaSetName returns an attribute KeyValue conforming to the
+// "k8s.replicaset.name" semantic conventions. It represents the name of the
+// ReplicaSet.
+func K8SReplicaSetName(val string) attribute.KeyValue {
+	return K8SReplicaSetNameKey.String(val)
+}
+
+// A Kubernetes Deployment object.
+const (
+	// K8SDeploymentUIDKey is the attribute Key conforming to the
+	// "k8s.deployment.uid" semantic conventions. It represents the UID of the
+	// Deployment.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SDeploymentUIDKey = attribute.Key("k8s.deployment.uid")
+
+	// K8SDeploymentNameKey is the attribute Key conforming to the
+	// "k8s.deployment.name" semantic conventions. It represents the name of
+	// the Deployment.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SDeploymentNameKey = attribute.Key("k8s.deployment.name")
+)
+
+// K8SDeploymentUID returns an attribute KeyValue conforming to the
+// "k8s.deployment.uid" semantic conventions. It represents the UID of the
+// Deployment.
+func K8SDeploymentUID(val string) attribute.KeyValue {
+	return K8SDeploymentUIDKey.String(val)
+}
+
+// K8SDeploymentName returns an attribute KeyValue conforming to the
+// "k8s.deployment.name" semantic conventions. It represents the name of the
+// Deployment.
+func K8SDeploymentName(val string) attribute.KeyValue {
+	return K8SDeploymentNameKey.String(val)
+}
+
+// A Kubernetes StatefulSet object.
+const (
+	// K8SStatefulSetUIDKey is the attribute Key conforming to the
+	// "k8s.statefulset.uid" semantic conventions. It represents the UID of the
+	// StatefulSet.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SStatefulSetUIDKey = attribute.Key("k8s.statefulset.uid")
+
+	// K8SStatefulSetNameKey is the attribute Key conforming to the
+	// "k8s.statefulset.name" semantic conventions. It represents the name of
+	// the StatefulSet.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SStatefulSetNameKey = attribute.Key("k8s.statefulset.name")
+)
+
+// K8SStatefulSetUID returns an attribute KeyValue conforming to the
+// "k8s.statefulset.uid" semantic conventions. It represents the UID of the
+// StatefulSet.
+func K8SStatefulSetUID(val string) attribute.KeyValue {
+	return K8SStatefulSetUIDKey.String(val)
+}
+
+// K8SStatefulSetName returns an attribute KeyValue conforming to the
+// "k8s.statefulset.name" semantic conventions. It represents the name of the
+// StatefulSet.
+func K8SStatefulSetName(val string) attribute.KeyValue {
+	return K8SStatefulSetNameKey.String(val)
+}
+
+// A Kubernetes DaemonSet object.
+const (
+	// K8SDaemonSetUIDKey is the attribute Key conforming to the
+	// "k8s.daemonset.uid" semantic conventions. It represents the UID of the
+	// DaemonSet.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SDaemonSetUIDKey = attribute.Key("k8s.daemonset.uid")
+
+	// K8SDaemonSetNameKey is the attribute Key conforming to the
+	// "k8s.daemonset.name" semantic conventions. It represents the name of the
+	// DaemonSet.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SDaemonSetNameKey = attribute.Key("k8s.daemonset.name")
+)
+
+// K8SDaemonSetUID returns an attribute KeyValue conforming to the
+// "k8s.daemonset.uid" semantic conventions. It represents the UID of the
+// DaemonSet.
+func K8SDaemonSetUID(val string) attribute.KeyValue {
+	return K8SDaemonSetUIDKey.String(val)
+}
+
+// K8SDaemonSetName returns an attribute KeyValue conforming to the
+// "k8s.daemonset.name" semantic conventions. It represents the name of the
+// DaemonSet.
+func K8SDaemonSetName(val string) attribute.KeyValue {
+	return K8SDaemonSetNameKey.String(val)
+}
+
+// A Kubernetes Job object.
+const (
+	// K8SJobUIDKey is the attribute Key conforming to the "k8s.job.uid"
+	// semantic conventions. It represents the UID of the Job.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SJobUIDKey = attribute.Key("k8s.job.uid")
+
+	// K8SJobNameKey is the attribute Key conforming to the "k8s.job.name"
+	// semantic conventions. It represents the name of the Job.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SJobNameKey = attribute.Key("k8s.job.name")
+)
+
+// K8SJobUID returns an attribute KeyValue conforming to the "k8s.job.uid"
+// semantic conventions. It represents the UID of the Job.
+func K8SJobUID(val string) attribute.KeyValue {
+	return K8SJobUIDKey.String(val)
+}
+
+// K8SJobName returns an attribute KeyValue conforming to the "k8s.job.name"
+// semantic conventions. It represents the name of the Job.
+func K8SJobName(val string) attribute.KeyValue {
+	return K8SJobNameKey.String(val)
+}
+
+// A Kubernetes CronJob object.
+const (
+	// K8SCronJobUIDKey is the attribute Key conforming to the
+	// "k8s.cronjob.uid" semantic conventions. It represents the UID of the
+	// CronJob.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SCronJobUIDKey = attribute.Key("k8s.cronjob.uid")
+
+	// K8SCronJobNameKey is the attribute Key conforming to the
+	// "k8s.cronjob.name" semantic conventions. It represents the name of the
+	// CronJob.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SCronJobNameKey = attribute.Key("k8s.cronjob.name")
+)
+
+// K8SCronJobUID returns an attribute KeyValue conforming to the
+// "k8s.cronjob.uid" semantic conventions. It represents the UID of the
+// CronJob.
+func K8SCronJobUID(val string) attribute.KeyValue {
+	return K8SCronJobUIDKey.String(val)
+}
+
+// K8SCronJobName returns an attribute KeyValue conforming to the
+// "k8s.cronjob.name" semantic conventions. It represents the name of the
+// CronJob.
+func K8SCronJobName(val string) attribute.KeyValue {
+	return K8SCronJobNameKey.String(val)
+}
+
+// The operating system (OS) on which the process represented by this resource
+// is running.
+const (
+	// OSTypeKey is the attribute Key conforming to the "os.type" semantic
+	// conventions. It represents the operating system type.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	OSTypeKey = attribute.Key("os.type")
+
+	// OSDescriptionKey is the attribute Key conforming to the "os.description"
+	// semantic conventions. It represents the human readable (not intended to
+	// be parsed) OS version information, like e.g. reported by `ver` or
+	// `lsb_release -a` commands.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Microsoft Windows [Version 10.0.18363.778]', 'Ubuntu 18.04.1
+	// LTS'
+	OSDescriptionKey = attribute.Key("os.description")
+
+	// OSNameKey is the attribute Key conforming to the "os.name" semantic
+	// conventions. It represents the human readable operating system name.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'iOS', 'Android', 'Ubuntu'
+	OSNameKey = attribute.Key("os.name")
+
+	// OSVersionKey is the attribute Key conforming to the "os.version"
+	// semantic conventions. It represents the version string of the operating
+	// system as defined in [Version
+	// Attributes](../../resource/semantic_conventions/README.md#version-attributes).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '14.2.1', '18.04.1'
+	OSVersionKey = attribute.Key("os.version")
+)
+
+var (
+	// Microsoft Windows
+	OSTypeWindows = OSTypeKey.String("windows")
+	// Linux
+	OSTypeLinux = OSTypeKey.String("linux")
+	// Apple Darwin
+	OSTypeDarwin = OSTypeKey.String("darwin")
+	// FreeBSD
+	OSTypeFreeBSD = OSTypeKey.String("freebsd")
+	// NetBSD
+	OSTypeNetBSD = OSTypeKey.String("netbsd")
+	// OpenBSD
+	OSTypeOpenBSD = OSTypeKey.String("openbsd")
+	// DragonFly BSD
+	OSTypeDragonflyBSD = OSTypeKey.String("dragonflybsd")
+	// HP-UX (Hewlett Packard Unix)
+	OSTypeHPUX = OSTypeKey.String("hpux")
+	// AIX (Advanced Interactive eXecutive)
+	OSTypeAIX = OSTypeKey.String("aix")
+	// SunOS, Oracle Solaris
+	OSTypeSolaris = OSTypeKey.String("solaris")
+	// IBM z/OS
+	OSTypeZOS = OSTypeKey.String("z_os")
+)
+
+// OSDescription returns an attribute KeyValue conforming to the
+// "os.description" semantic conventions. It represents the human readable (not
+// intended to be parsed) OS version information, like e.g. reported by `ver`
+// or `lsb_release -a` commands.
+func OSDescription(val string) attribute.KeyValue {
+	return OSDescriptionKey.String(val)
+}
+
+// OSName returns an attribute KeyValue conforming to the "os.name" semantic
+// conventions. It represents the human readable operating system name.
+func OSName(val string) attribute.KeyValue {
+	return OSNameKey.String(val)
+}
+
+// OSVersion returns an attribute KeyValue conforming to the "os.version"
+// semantic conventions. It represents the version string of the operating
+// system as defined in [Version
+// Attributes](../../resource/semantic_conventions/README.md#version-attributes).
+func OSVersion(val string) attribute.KeyValue {
+	return OSVersionKey.String(val)
+}
+
+// An operating system process.
+const (
+	// ProcessPIDKey is the attribute Key conforming to the "process.pid"
+	// semantic conventions. It represents the process identifier (PID).
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 1234
+	ProcessPIDKey = attribute.Key("process.pid")
+
+	// ProcessParentPIDKey is the attribute Key conforming to the
+	// "process.parent_pid" semantic conventions. It represents the parent
+	// Process identifier (PID).
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 111
+	ProcessParentPIDKey = attribute.Key("process.parent_pid")
+
+	// ProcessExecutableNameKey is the attribute Key conforming to the
+	// "process.executable.name" semantic conventions. It represents the name
+	// of the process executable. On Linux based systems, can be set to the
+	// `Name` in `proc/[pid]/status`. On Windows, can be set to the base name
+	// of `GetProcessImageFileNameW`.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (See alternative attributes
+	// below.)
+	// Stability: stable
+	// Examples: 'otelcol'
+	ProcessExecutableNameKey = attribute.Key("process.executable.name")
+
+	// ProcessExecutablePathKey is the attribute Key conforming to the
+	// "process.executable.path" semantic conventions. It represents the full
+	// path to the process executable. On Linux based systems, can be set to
+	// the target of `proc/[pid]/exe`. On Windows, can be set to the result of
+	// `GetProcessImageFileNameW`.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (See alternative attributes
+	// below.)
+	// Stability: stable
+	// Examples: '/usr/bin/cmd/otelcol'
+	ProcessExecutablePathKey = attribute.Key("process.executable.path")
+
+	// ProcessCommandKey is the attribute Key conforming to the
+	// "process.command" semantic conventions. It represents the command used
+	// to launch the process (i.e. the command name). On Linux based systems,
+	// can be set to the zeroth string in `proc/[pid]/cmdline`. On Windows, can
+	// be set to the first parameter extracted from `GetCommandLineW`.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (See alternative attributes
+	// below.)
+	// Stability: stable
+	// Examples: 'cmd/otelcol'
+	ProcessCommandKey = attribute.Key("process.command")
+
+	// ProcessCommandLineKey is the attribute Key conforming to the
+	// "process.command_line" semantic conventions. It represents the full
+	// command used to launch the process as a single string representing the
+	// full command. On Windows, can be set to the result of `GetCommandLineW`.
+	// Do not set this if you have to assemble it just for monitoring; use
+	// `process.command_args` instead.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (See alternative attributes
+	// below.)
+	// Stability: stable
+	// Examples: 'C:\\cmd\\otecol --config="my directory\\config.yaml"'
+	ProcessCommandLineKey = attribute.Key("process.command_line")
+
+	// ProcessCommandArgsKey is the attribute Key conforming to the
+	// "process.command_args" semantic conventions. It represents the all the
+	// command arguments (including the command/executable itself) as received
+	// by the process. On Linux-based systems (and some other Unixoid systems
+	// supporting procfs), can be set according to the list of null-delimited
+	// strings extracted from `proc/[pid]/cmdline`. For libc-based executables,
+	// this would be the full argv vector passed to `main`.
+	//
+	// Type: string[]
+	// RequirementLevel: ConditionallyRequired (See alternative attributes
+	// below.)
+	// Stability: stable
+	// Examples: 'cmd/otecol', '--config=config.yaml'
+	ProcessCommandArgsKey = attribute.Key("process.command_args")
+
+	// ProcessOwnerKey is the attribute Key conforming to the "process.owner"
+	// semantic conventions. It represents the username of the user that owns
+	// the process.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'root'
+	ProcessOwnerKey = attribute.Key("process.owner")
+)
+
+// ProcessPID returns an attribute KeyValue conforming to the "process.pid"
+// semantic conventions. It represents the process identifier (PID).
+func ProcessPID(val int) attribute.KeyValue {
+	return ProcessPIDKey.Int(val)
+}
+
+// ProcessParentPID returns an attribute KeyValue conforming to the
+// "process.parent_pid" semantic conventions. It represents the parent Process
+// identifier (PID).
+func ProcessParentPID(val int) attribute.KeyValue {
+	return ProcessParentPIDKey.Int(val)
+}
+
+// ProcessExecutableName returns an attribute KeyValue conforming to the
+// "process.executable.name" semantic conventions. It represents the name of
+// the process executable. On Linux based systems, can be set to the `Name` in
+// `proc/[pid]/status`. On Windows, can be set to the base name of
+// `GetProcessImageFileNameW`.
+func ProcessExecutableName(val string) attribute.KeyValue {
+	return ProcessExecutableNameKey.String(val)
+}
+
+// ProcessExecutablePath returns an attribute KeyValue conforming to the
+// "process.executable.path" semantic conventions. It represents the full path
+// to the process executable. On Linux based systems, can be set to the target
+// of `proc/[pid]/exe`. On Windows, can be set to the result of
+// `GetProcessImageFileNameW`.
+func ProcessExecutablePath(val string) attribute.KeyValue {
+	return ProcessExecutablePathKey.String(val)
+}
+
+// ProcessCommand returns an attribute KeyValue conforming to the
+// "process.command" semantic conventions. It represents the command used to
+// launch the process (i.e. the command name). On Linux based systems, can be
+// set to the zeroth string in `proc/[pid]/cmdline`. On Windows, can be set to
+// the first parameter extracted from `GetCommandLineW`.
+func ProcessCommand(val string) attribute.KeyValue {
+	return ProcessCommandKey.String(val)
+}
+
+// ProcessCommandLine returns an attribute KeyValue conforming to the
+// "process.command_line" semantic conventions. It represents the full command
+// used to launch the process as a single string representing the full command.
+// On Windows, can be set to the result of `GetCommandLineW`. Do not set this
+// if you have to assemble it just for monitoring; use `process.command_args`
+// instead.
+func ProcessCommandLine(val string) attribute.KeyValue {
+	return ProcessCommandLineKey.String(val)
+}
+
+// ProcessCommandArgs returns an attribute KeyValue conforming to the
+// "process.command_args" semantic conventions. It represents the all the
+// command arguments (including the command/executable itself) as received by
+// the process. On Linux-based systems (and some other Unixoid systems
+// supporting procfs), can be set according to the list of null-delimited
+// strings extracted from `proc/[pid]/cmdline`. For libc-based executables,
+// this would be the full argv vector passed to `main`.
+func ProcessCommandArgs(val ...string) attribute.KeyValue {
+	return ProcessCommandArgsKey.StringSlice(val)
+}
+
+// ProcessOwner returns an attribute KeyValue conforming to the
+// "process.owner" semantic conventions. It represents the username of the user
+// that owns the process.
+func ProcessOwner(val string) attribute.KeyValue {
+	return ProcessOwnerKey.String(val)
+}
+
+// The single (language) runtime instance which is monitored.
+const (
+	// ProcessRuntimeNameKey is the attribute Key conforming to the
+	// "process.runtime.name" semantic conventions. It represents the name of
+	// the runtime of this process. For compiled native binaries, this SHOULD
+	// be the name of the compiler.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'OpenJDK Runtime Environment'
+	ProcessRuntimeNameKey = attribute.Key("process.runtime.name")
+
+	// ProcessRuntimeVersionKey is the attribute Key conforming to the
+	// "process.runtime.version" semantic conventions. It represents the
+	// version of the runtime of this process, as returned by the runtime
+	// without modification.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '14.0.2'
+	ProcessRuntimeVersionKey = attribute.Key("process.runtime.version")
+
+	// ProcessRuntimeDescriptionKey is the attribute Key conforming to the
+	// "process.runtime.description" semantic conventions. It represents an
+	// additional description about the runtime of the process, for example a
+	// specific vendor customization of the runtime environment.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Eclipse OpenJ9 Eclipse OpenJ9 VM openj9-0.21.0'
+	ProcessRuntimeDescriptionKey = attribute.Key("process.runtime.description")
+)
+
+// ProcessRuntimeName returns an attribute KeyValue conforming to the
+// "process.runtime.name" semantic conventions. It represents the name of the
+// runtime of this process. For compiled native binaries, this SHOULD be the
+// name of the compiler.
+func ProcessRuntimeName(val string) attribute.KeyValue {
+	return ProcessRuntimeNameKey.String(val)
+}
+
+// ProcessRuntimeVersion returns an attribute KeyValue conforming to the
+// "process.runtime.version" semantic conventions. It represents the version of
+// the runtime of this process, as returned by the runtime without
+// modification.
+func ProcessRuntimeVersion(val string) attribute.KeyValue {
+	return ProcessRuntimeVersionKey.String(val)
+}
+
+// ProcessRuntimeDescription returns an attribute KeyValue conforming to the
+// "process.runtime.description" semantic conventions. It represents an
+// additional description about the runtime of the process, for example a
+// specific vendor customization of the runtime environment.
+func ProcessRuntimeDescription(val string) attribute.KeyValue {
+	return ProcessRuntimeDescriptionKey.String(val)
+}
+
+// A service instance.
+const (
+	// ServiceNameKey is the attribute Key conforming to the "service.name"
+	// semantic conventions. It represents the logical name of the service.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'shoppingcart'
+	// Note: MUST be the same for all instances of horizontally scaled
+	// services. If the value was not specified, SDKs MUST fallback to
+	// `unknown_service:` concatenated with
+	// [`process.executable.name`](process.md#process), e.g.
+	// `unknown_service:bash`. If `process.executable.name` is not available,
+	// the value MUST be set to `unknown_service`.
+	ServiceNameKey = attribute.Key("service.name")
+
+	// ServiceNamespaceKey is the attribute Key conforming to the
+	// "service.namespace" semantic conventions. It represents a namespace for
+	// `service.name`.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Shop'
+	// Note: A string value having a meaning that helps to distinguish a group
+	// of services, for example the team name that owns a group of services.
+	// `service.name` is expected to be unique within the same namespace. If
+	// `service.namespace` is not specified in the Resource then `service.name`
+	// is expected to be unique for all services that have no explicit
+	// namespace defined (so the empty/unspecified namespace is simply one more
+	// valid namespace). Zero-length namespace string is assumed equal to
+	// unspecified namespace.
+	ServiceNamespaceKey = attribute.Key("service.namespace")
+
+	// ServiceInstanceIDKey is the attribute Key conforming to the
+	// "service.instance.id" semantic conventions. It represents the string ID
+	// of the service instance.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '627cc493-f310-47de-96bd-71410b7dec09'
+	// Note: MUST be unique for each instance of the same
+	// `service.namespace,service.name` pair (in other words
+	// `service.namespace,service.name,service.instance.id` triplet MUST be
+	// globally unique). The ID helps to distinguish instances of the same
+	// service that exist at the same time (e.g. instances of a horizontally
+	// scaled service). It is preferable for the ID to be persistent and stay
+	// the same for the lifetime of the service instance, however it is
+	// acceptable that the ID is ephemeral and changes during important
+	// lifetime events for the service (e.g. service restarts). If the service
+	// has no inherent unique ID that can be used as the value of this
+	// attribute it is recommended to generate a random Version 1 or Version 4
+	// RFC 4122 UUID (services aiming for reproducible UUIDs may also use
+	// Version 5, see RFC 4122 for more recommendations).
+	ServiceInstanceIDKey = attribute.Key("service.instance.id")
+
+	// ServiceVersionKey is the attribute Key conforming to the
+	// "service.version" semantic conventions. It represents the version string
+	// of the service API or implementation.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '2.0.0'
+	ServiceVersionKey = attribute.Key("service.version")
+)
+
+// ServiceName returns an attribute KeyValue conforming to the
+// "service.name" semantic conventions. It represents the logical name of the
+// service.
+func ServiceName(val string) attribute.KeyValue {
+	return ServiceNameKey.String(val)
+}
+
+// ServiceNamespace returns an attribute KeyValue conforming to the
+// "service.namespace" semantic conventions. It represents a namespace for
+// `service.name`.
+func ServiceNamespace(val string) attribute.KeyValue {
+	return ServiceNamespaceKey.String(val)
+}
+
+// ServiceInstanceID returns an attribute KeyValue conforming to the
+// "service.instance.id" semantic conventions. It represents the string ID of
+// the service instance.
+func ServiceInstanceID(val string) attribute.KeyValue {
+	return ServiceInstanceIDKey.String(val)
+}
+
+// ServiceVersion returns an attribute KeyValue conforming to the
+// "service.version" semantic conventions. It represents the version string of
+// the service API or implementation.
+func ServiceVersion(val string) attribute.KeyValue {
+	return ServiceVersionKey.String(val)
+}
+
+// The telemetry SDK used to capture data recorded by the instrumentation
+// libraries.
+const (
+	// TelemetrySDKNameKey is the attribute Key conforming to the
+	// "telemetry.sdk.name" semantic conventions. It represents the name of the
+	// telemetry SDK as defined above.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	TelemetrySDKNameKey = attribute.Key("telemetry.sdk.name")
+
+	// TelemetrySDKLanguageKey is the attribute Key conforming to the
+	// "telemetry.sdk.language" semantic conventions. It represents the
+	// language of the telemetry SDK.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	TelemetrySDKLanguageKey = attribute.Key("telemetry.sdk.language")
+
+	// TelemetrySDKVersionKey is the attribute Key conforming to the
+	// "telemetry.sdk.version" semantic conventions. It represents the version
+	// string of the telemetry SDK.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '1.2.3'
+	TelemetrySDKVersionKey = attribute.Key("telemetry.sdk.version")
+
+	// TelemetryAutoVersionKey is the attribute Key conforming to the
+	// "telemetry.auto.version" semantic conventions. It represents the version
+	// string of the auto instrumentation agent, if used.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '1.2.3'
+	TelemetryAutoVersionKey = attribute.Key("telemetry.auto.version")
+)
+
+var (
+	// cpp
+	TelemetrySDKLanguageCPP = TelemetrySDKLanguageKey.String("cpp")
+	// dotnet
+	TelemetrySDKLanguageDotnet = TelemetrySDKLanguageKey.String("dotnet")
+	// erlang
+	TelemetrySDKLanguageErlang = TelemetrySDKLanguageKey.String("erlang")
+	// go
+	TelemetrySDKLanguageGo = TelemetrySDKLanguageKey.String("go")
+	// java
+	TelemetrySDKLanguageJava = TelemetrySDKLanguageKey.String("java")
+	// nodejs
+	TelemetrySDKLanguageNodejs = TelemetrySDKLanguageKey.String("nodejs")
+	// php
+	TelemetrySDKLanguagePHP = TelemetrySDKLanguageKey.String("php")
+	// python
+	TelemetrySDKLanguagePython = TelemetrySDKLanguageKey.String("python")
+	// ruby
+	TelemetrySDKLanguageRuby = TelemetrySDKLanguageKey.String("ruby")
+	// webjs
+	TelemetrySDKLanguageWebjs = TelemetrySDKLanguageKey.String("webjs")
+	// swift
+	TelemetrySDKLanguageSwift = TelemetrySDKLanguageKey.String("swift")
+)
+
+// TelemetrySDKName returns an attribute KeyValue conforming to the
+// "telemetry.sdk.name" semantic conventions. It represents the name of the
+// telemetry SDK as defined above.
+func TelemetrySDKName(val string) attribute.KeyValue {
+	return TelemetrySDKNameKey.String(val)
+}
+
+// TelemetrySDKVersion returns an attribute KeyValue conforming to the
+// "telemetry.sdk.version" semantic conventions. It represents the version
+// string of the telemetry SDK.
+func TelemetrySDKVersion(val string) attribute.KeyValue {
+	return TelemetrySDKVersionKey.String(val)
+}
+
+// TelemetryAutoVersion returns an attribute KeyValue conforming to the
+// "telemetry.auto.version" semantic conventions. It represents the version
+// string of the auto instrumentation agent, if used.
+func TelemetryAutoVersion(val string) attribute.KeyValue {
+	return TelemetryAutoVersionKey.String(val)
+}
+
+// Resource describing the packaged software running the application code. Web
+// engines are typically executed using process.runtime.
+const (
+	// WebEngineNameKey is the attribute Key conforming to the "webengine.name"
+	// semantic conventions. It represents the name of the web engine.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'WildFly'
+	WebEngineNameKey = attribute.Key("webengine.name")
+
+	// WebEngineVersionKey is the attribute Key conforming to the
+	// "webengine.version" semantic conventions. It represents the version of
+	// the web engine.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '21.0.0'
+	WebEngineVersionKey = attribute.Key("webengine.version")
+
+	// WebEngineDescriptionKey is the attribute Key conforming to the
+	// "webengine.description" semantic conventions. It represents the
+	// additional description of the web engine (e.g. detailed version and
+	// edition information).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'WildFly Full 21.0.0.Final (WildFly Core 13.0.1.Final) -
+	// 2.2.2.Final'
+	WebEngineDescriptionKey = attribute.Key("webengine.description")
+)
+
+// WebEngineName returns an attribute KeyValue conforming to the
+// "webengine.name" semantic conventions. It represents the name of the web
+// engine.
+func WebEngineName(val string) attribute.KeyValue {
+	return WebEngineNameKey.String(val)
+}
+
+// WebEngineVersion returns an attribute KeyValue conforming to the
+// "webengine.version" semantic conventions. It represents the version of the
+// web engine.
+func WebEngineVersion(val string) attribute.KeyValue {
+	return WebEngineVersionKey.String(val)
+}
+
+// WebEngineDescription returns an attribute KeyValue conforming to the
+// "webengine.description" semantic conventions. It represents the additional
+// description of the web engine (e.g. detailed version and edition
+// information).
+func WebEngineDescription(val string) attribute.KeyValue {
+	return WebEngineDescriptionKey.String(val)
+}
+
+// Attributes used by non-OTLP exporters to represent OpenTelemetry Scope's
+// concepts.
+const (
+	// OtelScopeNameKey is the attribute Key conforming to the
+	// "otel.scope.name" semantic conventions. It represents the name of the
+	// instrumentation scope - (`InstrumentationScope.Name` in OTLP).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'io.opentelemetry.contrib.mongodb'
+	OtelScopeNameKey = attribute.Key("otel.scope.name")
+
+	// OtelScopeVersionKey is the attribute Key conforming to the
+	// "otel.scope.version" semantic conventions. It represents the version of
+	// the instrumentation scope - (`InstrumentationScope.Version` in OTLP).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '1.0.0'
+	OtelScopeVersionKey = attribute.Key("otel.scope.version")
+)
+
+// OtelScopeName returns an attribute KeyValue conforming to the
+// "otel.scope.name" semantic conventions. It represents the name of the
+// instrumentation scope - (`InstrumentationScope.Name` in OTLP).
+func OtelScopeName(val string) attribute.KeyValue {
+	return OtelScopeNameKey.String(val)
+}
+
+// OtelScopeVersion returns an attribute KeyValue conforming to the
+// "otel.scope.version" semantic conventions. It represents the version of the
+// instrumentation scope - (`InstrumentationScope.Version` in OTLP).
+func OtelScopeVersion(val string) attribute.KeyValue {
+	return OtelScopeVersionKey.String(val)
+}
+
+// Span attributes used by non-OTLP exporters to represent OpenTelemetry
+// Scope's concepts.
+const (
+	// OtelLibraryNameKey is the attribute Key conforming to the
+	// "otel.library.name" semantic conventions. It represents the deprecated,
+	// use the `otel.scope.name` attribute.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: deprecated
+	// Examples: 'io.opentelemetry.contrib.mongodb'
+	OtelLibraryNameKey = attribute.Key("otel.library.name")
+
+	// OtelLibraryVersionKey is the attribute Key conforming to the
+	// "otel.library.version" semantic conventions. It represents the
+	// deprecated, use the `otel.scope.version` attribute.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: deprecated
+	// Examples: '1.0.0'
+	OtelLibraryVersionKey = attribute.Key("otel.library.version")
+)
+
+// OtelLibraryName returns an attribute KeyValue conforming to the
+// "otel.library.name" semantic conventions. It represents the deprecated, use
+// the `otel.scope.name` attribute.
+func OtelLibraryName(val string) attribute.KeyValue {
+	return OtelLibraryNameKey.String(val)
+}
+
+// OtelLibraryVersion returns an attribute KeyValue conforming to the
+// "otel.library.version" semantic conventions. It represents the deprecated,
+// use the `otel.scope.version` attribute.
+func OtelLibraryVersion(val string) attribute.KeyValue {
+	return OtelLibraryVersionKey.String(val)
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/schema.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/schema.go
new file mode 100644
index 0000000000..42fc525d16
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/schema.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
+
+// SchemaURL is the schema URL that matches the version of the semantic conventions
+// that this package defines. Semconv packages starting from v1.4.0 must declare
+// non-empty schema URL in the form https://opentelemetry.io/schemas/<version>
+const SchemaURL = "https://opentelemetry.io/schemas/1.17.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/trace.go b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/trace.go
new file mode 100644
index 0000000000..8c4a7299d2
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/trace.go
@@ -0,0 +1,3375 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.17.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// The shared attributes used to report a single exception associated with a
+// span or log.
+const (
+	// ExceptionTypeKey is the attribute Key conforming to the "exception.type"
+	// semantic conventions. It represents the type of the exception (its
+	// fully-qualified class name, if applicable). The dynamic type of the
+	// exception should be preferred over the static type in languages that
+	// support it.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'java.net.ConnectException', 'OSError'
+	ExceptionTypeKey = attribute.Key("exception.type")
+
+	// ExceptionMessageKey is the attribute Key conforming to the
+	// "exception.message" semantic conventions. It represents the exception
+	// message.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Division by zero', "Can't convert 'int' object to str
+	// implicitly"
+	ExceptionMessageKey = attribute.Key("exception.message")
+
+	// ExceptionStacktraceKey is the attribute Key conforming to the
+	// "exception.stacktrace" semantic conventions. It represents a stacktrace
+	// as a string in the natural representation for the language runtime. The
+	// representation is to be determined and documented by each language SIG.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Exception in thread "main" java.lang.RuntimeException: Test
+	// exception\\n at '
+	//  'com.example.GenerateTrace.methodB(GenerateTrace.java:13)\\n at '
+	//  'com.example.GenerateTrace.methodA(GenerateTrace.java:9)\\n at '
+	//  'com.example.GenerateTrace.main(GenerateTrace.java:5)'
+	ExceptionStacktraceKey = attribute.Key("exception.stacktrace")
+)
+
+// ExceptionType returns an attribute KeyValue conforming to the
+// "exception.type" semantic conventions. It represents the type of the
+// exception (its fully-qualified class name, if applicable). The dynamic type
+// of the exception should be preferred over the static type in languages that
+// support it.
+func ExceptionType(val string) attribute.KeyValue {
+	return ExceptionTypeKey.String(val)
+}
+
+// ExceptionMessage returns an attribute KeyValue conforming to the
+// "exception.message" semantic conventions. It represents the exception
+// message.
+func ExceptionMessage(val string) attribute.KeyValue {
+	return ExceptionMessageKey.String(val)
+}
+
+// ExceptionStacktrace returns an attribute KeyValue conforming to the
+// "exception.stacktrace" semantic conventions. It represents a stacktrace as a
+// string in the natural representation for the language runtime. The
+// representation is to be determined and documented by each language SIG.
+func ExceptionStacktrace(val string) attribute.KeyValue {
+	return ExceptionStacktraceKey.String(val)
+}
+
+// Attributes for Events represented using Log Records.
+const (
+	// EventNameKey is the attribute Key conforming to the "event.name"
+	// semantic conventions. It represents the name identifies the event.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'click', 'exception'
+	EventNameKey = attribute.Key("event.name")
+
+	// EventDomainKey is the attribute Key conforming to the "event.domain"
+	// semantic conventions. It represents the domain identifies the business
+	// context for the events.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	// Note: Events across different domains may have same `event.name`, yet be
+	// unrelated events.
+	EventDomainKey = attribute.Key("event.domain")
+)
+
+var (
+	// Events from browser apps
+	EventDomainBrowser = EventDomainKey.String("browser")
+	// Events from mobile apps
+	EventDomainDevice = EventDomainKey.String("device")
+	// Events from Kubernetes
+	EventDomainK8S = EventDomainKey.String("k8s")
+)
+
+// EventName returns an attribute KeyValue conforming to the "event.name"
+// semantic conventions. It represents the name identifies the event.
+func EventName(val string) attribute.KeyValue {
+	return EventNameKey.String(val)
+}
+
+// Span attributes used by AWS Lambda (in addition to general `faas`
+// attributes).
+const (
+	// AWSLambdaInvokedARNKey is the attribute Key conforming to the
+	// "aws.lambda.invoked_arn" semantic conventions. It represents the full
+	// invoked ARN as provided on the `Context` passed to the function
+	// (`Lambda-Runtime-Invoked-Function-ARN` header on the
+	// `/runtime/invocation/next` applicable).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'arn:aws:lambda:us-east-1:123456:function:myfunction:myalias'
+	// Note: This may be different from `faas.id` if an alias is involved.
+	AWSLambdaInvokedARNKey = attribute.Key("aws.lambda.invoked_arn")
+)
+
+// AWSLambdaInvokedARN returns an attribute KeyValue conforming to the
+// "aws.lambda.invoked_arn" semantic conventions. It represents the full
+// invoked ARN as provided on the `Context` passed to the function
+// (`Lambda-Runtime-Invoked-Function-ARN` header on the
+// `/runtime/invocation/next` applicable).
+func AWSLambdaInvokedARN(val string) attribute.KeyValue {
+	return AWSLambdaInvokedARNKey.String(val)
+}
+
+// Attributes for CloudEvents. CloudEvents is a specification on how to define
+// event data in a standard way. These attributes can be attached to spans when
+// performing operations with CloudEvents, regardless of the protocol being
+// used.
+const (
+	// CloudeventsEventIDKey is the attribute Key conforming to the
+	// "cloudevents.event_id" semantic conventions. It represents the
+	// [event_id](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#id)
+	// uniquely identifies the event.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: '123e4567-e89b-12d3-a456-426614174000', '0001'
+	CloudeventsEventIDKey = attribute.Key("cloudevents.event_id")
+
+	// CloudeventsEventSourceKey is the attribute Key conforming to the
+	// "cloudevents.event_source" semantic conventions. It represents the
+	// [source](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#source-1)
+	// identifies the context in which an event happened.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'https://github.com/cloudevents',
+	// '/cloudevents/spec/pull/123', 'my-service'
+	CloudeventsEventSourceKey = attribute.Key("cloudevents.event_source")
+
+	// CloudeventsEventSpecVersionKey is the attribute Key conforming to the
+	// "cloudevents.event_spec_version" semantic conventions. It represents the
+	// [version of the CloudEvents
+	// specification](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#specversion)
+	// which the event uses.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '1.0'
+	CloudeventsEventSpecVersionKey = attribute.Key("cloudevents.event_spec_version")
+
+	// CloudeventsEventTypeKey is the attribute Key conforming to the
+	// "cloudevents.event_type" semantic conventions. It represents the
+	// [event_type](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#type)
+	// contains a value describing the type of event related to the originating
+	// occurrence.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'com.github.pull_request.opened',
+	// 'com.example.object.deleted.v2'
+	CloudeventsEventTypeKey = attribute.Key("cloudevents.event_type")
+
+	// CloudeventsEventSubjectKey is the attribute Key conforming to the
+	// "cloudevents.event_subject" semantic conventions. It represents the
+	// [subject](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#subject)
+	// of the event in the context of the event producer (identified by
+	// source).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'mynewfile.jpg'
+	CloudeventsEventSubjectKey = attribute.Key("cloudevents.event_subject")
+)
+
+// CloudeventsEventID returns an attribute KeyValue conforming to the
+// "cloudevents.event_id" semantic conventions. It represents the
+// [event_id](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#id)
+// uniquely identifies the event.
+func CloudeventsEventID(val string) attribute.KeyValue {
+	return CloudeventsEventIDKey.String(val)
+}
+
+// CloudeventsEventSource returns an attribute KeyValue conforming to the
+// "cloudevents.event_source" semantic conventions. It represents the
+// [source](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#source-1)
+// identifies the context in which an event happened.
+func CloudeventsEventSource(val string) attribute.KeyValue {
+	return CloudeventsEventSourceKey.String(val)
+}
+
+// CloudeventsEventSpecVersion returns an attribute KeyValue conforming to
+// the "cloudevents.event_spec_version" semantic conventions. It represents the
+// [version of the CloudEvents
+// specification](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#specversion)
+// which the event uses.
+func CloudeventsEventSpecVersion(val string) attribute.KeyValue {
+	return CloudeventsEventSpecVersionKey.String(val)
+}
+
+// CloudeventsEventType returns an attribute KeyValue conforming to the
+// "cloudevents.event_type" semantic conventions. It represents the
+// [event_type](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#type)
+// contains a value describing the type of event related to the originating
+// occurrence.
+func CloudeventsEventType(val string) attribute.KeyValue {
+	return CloudeventsEventTypeKey.String(val)
+}
+
+// CloudeventsEventSubject returns an attribute KeyValue conforming to the
+// "cloudevents.event_subject" semantic conventions. It represents the
+// [subject](https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md#subject)
+// of the event in the context of the event producer (identified by source).
+func CloudeventsEventSubject(val string) attribute.KeyValue {
+	return CloudeventsEventSubjectKey.String(val)
+}
+
+// Semantic conventions for the OpenTracing Shim
+const (
+	// OpentracingRefTypeKey is the attribute Key conforming to the
+	// "opentracing.ref_type" semantic conventions. It represents the
+	// parent-child Reference type
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: The causal relationship between a child Span and a parent Span.
+	OpentracingRefTypeKey = attribute.Key("opentracing.ref_type")
+)
+
+var (
+	// The parent Span depends on the child Span in some capacity
+	OpentracingRefTypeChildOf = OpentracingRefTypeKey.String("child_of")
+	// The parent Span does not depend in any way on the result of the child Span
+	OpentracingRefTypeFollowsFrom = OpentracingRefTypeKey.String("follows_from")
+)
+
+// The attributes used to perform database client calls.
+const (
+	// DBSystemKey is the attribute Key conforming to the "db.system" semantic
+	// conventions. It represents an identifier for the database management
+	// system (DBMS) product being used. See below for a list of well-known
+	// identifiers.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	DBSystemKey = attribute.Key("db.system")
+
+	// DBConnectionStringKey is the attribute Key conforming to the
+	// "db.connection_string" semantic conventions. It represents the
+	// connection string used to connect to the database. It is recommended to
+	// remove embedded credentials.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Server=(localdb)\\v11.0;Integrated Security=true;'
+	DBConnectionStringKey = attribute.Key("db.connection_string")
+
+	// DBUserKey is the attribute Key conforming to the "db.user" semantic
+	// conventions. It represents the username for accessing the database.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'readonly_user', 'reporting_user'
+	DBUserKey = attribute.Key("db.user")
+
+	// DBJDBCDriverClassnameKey is the attribute Key conforming to the
+	// "db.jdbc.driver_classname" semantic conventions. It represents the
+	// fully-qualified class name of the [Java Database Connectivity
+	// (JDBC)](https://docs.oracle.com/javase/8/docs/technotes/guides/jdbc/)
+	// driver used to connect.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'org.postgresql.Driver',
+	// 'com.microsoft.sqlserver.jdbc.SQLServerDriver'
+	DBJDBCDriverClassnameKey = attribute.Key("db.jdbc.driver_classname")
+
+	// DBNameKey is the attribute Key conforming to the "db.name" semantic
+	// conventions. It represents the this attribute is used to report the name
+	// of the database being accessed. For commands that switch the database,
+	// this should be set to the target database (even if the command fails).
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If applicable.)
+	// Stability: stable
+	// Examples: 'customers', 'main'
+	// Note: In some SQL databases, the database name to be used is called
+	// "schema name". In case there are multiple layers that could be
+	// considered for database name (e.g. Oracle instance name and schema
+	// name), the database name to be used is the more specific layer (e.g.
+	// Oracle schema name).
+	DBNameKey = attribute.Key("db.name")
+
+	// DBStatementKey is the attribute Key conforming to the "db.statement"
+	// semantic conventions. It represents the database statement being
+	// executed.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If applicable and not
+	// explicitly disabled via instrumentation configuration.)
+	// Stability: stable
+	// Examples: 'SELECT * FROM wuser_table', 'SET mykey "WuValue"'
+	// Note: The value may be sanitized to exclude sensitive information.
+	DBStatementKey = attribute.Key("db.statement")
+
+	// DBOperationKey is the attribute Key conforming to the "db.operation"
+	// semantic conventions. It represents the name of the operation being
+	// executed, e.g. the [MongoDB command
+	// name](https://docs.mongodb.com/manual/reference/command/#database-operations)
+	// such as `findAndModify`, or the SQL keyword.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If `db.statement` is not
+	// applicable.)
+	// Stability: stable
+	// Examples: 'findAndModify', 'HMSET', 'SELECT'
+	// Note: When setting this to an SQL keyword, it is not recommended to
+	// attempt any client-side parsing of `db.statement` just to get this
+	// property, but it should be set if the operation name is provided by the
+	// library being instrumented. If the SQL statement has an ambiguous
+	// operation, or performs more than one operation, this value may be
+	// omitted.
+	DBOperationKey = attribute.Key("db.operation")
+)
+
+var (
+	// Some other SQL database. Fallback only. See notes
+	DBSystemOtherSQL = DBSystemKey.String("other_sql")
+	// Microsoft SQL Server
+	DBSystemMSSQL = DBSystemKey.String("mssql")
+	// MySQL
+	DBSystemMySQL = DBSystemKey.String("mysql")
+	// Oracle Database
+	DBSystemOracle = DBSystemKey.String("oracle")
+	// IBM DB2
+	DBSystemDB2 = DBSystemKey.String("db2")
+	// PostgreSQL
+	DBSystemPostgreSQL = DBSystemKey.String("postgresql")
+	// Amazon Redshift
+	DBSystemRedshift = DBSystemKey.String("redshift")
+	// Apache Hive
+	DBSystemHive = DBSystemKey.String("hive")
+	// Cloudscape
+	DBSystemCloudscape = DBSystemKey.String("cloudscape")
+	// HyperSQL DataBase
+	DBSystemHSQLDB = DBSystemKey.String("hsqldb")
+	// Progress Database
+	DBSystemProgress = DBSystemKey.String("progress")
+	// SAP MaxDB
+	DBSystemMaxDB = DBSystemKey.String("maxdb")
+	// SAP HANA
+	DBSystemHanaDB = DBSystemKey.String("hanadb")
+	// Ingres
+	DBSystemIngres = DBSystemKey.String("ingres")
+	// FirstSQL
+	DBSystemFirstSQL = DBSystemKey.String("firstsql")
+	// EnterpriseDB
+	DBSystemEDB = DBSystemKey.String("edb")
+	// InterSystems Caché
+	DBSystemCache = DBSystemKey.String("cache")
+	// Adabas (Adaptable Database System)
+	DBSystemAdabas = DBSystemKey.String("adabas")
+	// Firebird
+	DBSystemFirebird = DBSystemKey.String("firebird")
+	// Apache Derby
+	DBSystemDerby = DBSystemKey.String("derby")
+	// FileMaker
+	DBSystemFilemaker = DBSystemKey.String("filemaker")
+	// Informix
+	DBSystemInformix = DBSystemKey.String("informix")
+	// InstantDB
+	DBSystemInstantDB = DBSystemKey.String("instantdb")
+	// InterBase
+	DBSystemInterbase = DBSystemKey.String("interbase")
+	// MariaDB
+	DBSystemMariaDB = DBSystemKey.String("mariadb")
+	// Netezza
+	DBSystemNetezza = DBSystemKey.String("netezza")
+	// Pervasive PSQL
+	DBSystemPervasive = DBSystemKey.String("pervasive")
+	// PointBase
+	DBSystemPointbase = DBSystemKey.String("pointbase")
+	// SQLite
+	DBSystemSqlite = DBSystemKey.String("sqlite")
+	// Sybase
+	DBSystemSybase = DBSystemKey.String("sybase")
+	// Teradata
+	DBSystemTeradata = DBSystemKey.String("teradata")
+	// Vertica
+	DBSystemVertica = DBSystemKey.String("vertica")
+	// H2
+	DBSystemH2 = DBSystemKey.String("h2")
+	// ColdFusion IMQ
+	DBSystemColdfusion = DBSystemKey.String("coldfusion")
+	// Apache Cassandra
+	DBSystemCassandra = DBSystemKey.String("cassandra")
+	// Apache HBase
+	DBSystemHBase = DBSystemKey.String("hbase")
+	// MongoDB
+	DBSystemMongoDB = DBSystemKey.String("mongodb")
+	// Redis
+	DBSystemRedis = DBSystemKey.String("redis")
+	// Couchbase
+	DBSystemCouchbase = DBSystemKey.String("couchbase")
+	// CouchDB
+	DBSystemCouchDB = DBSystemKey.String("couchdb")
+	// Microsoft Azure Cosmos DB
+	DBSystemCosmosDB = DBSystemKey.String("cosmosdb")
+	// Amazon DynamoDB
+	DBSystemDynamoDB = DBSystemKey.String("dynamodb")
+	// Neo4j
+	DBSystemNeo4j = DBSystemKey.String("neo4j")
+	// Apache Geode
+	DBSystemGeode = DBSystemKey.String("geode")
+	// Elasticsearch
+	DBSystemElasticsearch = DBSystemKey.String("elasticsearch")
+	// Memcached
+	DBSystemMemcached = DBSystemKey.String("memcached")
+	// CockroachDB
+	DBSystemCockroachdb = DBSystemKey.String("cockroachdb")
+	// OpenSearch
+	DBSystemOpensearch = DBSystemKey.String("opensearch")
+	// ClickHouse
+	DBSystemClickhouse = DBSystemKey.String("clickhouse")
+)
+
+// DBConnectionString returns an attribute KeyValue conforming to the
+// "db.connection_string" semantic conventions. It represents the connection
+// string used to connect to the database. It is recommended to remove embedded
+// credentials.
+func DBConnectionString(val string) attribute.KeyValue {
+	return DBConnectionStringKey.String(val)
+}
+
+// DBUser returns an attribute KeyValue conforming to the "db.user" semantic
+// conventions. It represents the username for accessing the database.
+func DBUser(val string) attribute.KeyValue {
+	return DBUserKey.String(val)
+}
+
+// DBJDBCDriverClassname returns an attribute KeyValue conforming to the
+// "db.jdbc.driver_classname" semantic conventions. It represents the
+// fully-qualified class name of the [Java Database Connectivity
+// (JDBC)](https://docs.oracle.com/javase/8/docs/technotes/guides/jdbc/) driver
+// used to connect.
+func DBJDBCDriverClassname(val string) attribute.KeyValue {
+	return DBJDBCDriverClassnameKey.String(val)
+}
+
+// DBName returns an attribute KeyValue conforming to the "db.name" semantic
+// conventions. It represents the this attribute is used to report the name of
+// the database being accessed. For commands that switch the database, this
+// should be set to the target database (even if the command fails).
+func DBName(val string) attribute.KeyValue {
+	return DBNameKey.String(val)
+}
+
+// DBStatement returns an attribute KeyValue conforming to the
+// "db.statement" semantic conventions. It represents the database statement
+// being executed.
+func DBStatement(val string) attribute.KeyValue {
+	return DBStatementKey.String(val)
+}
+
+// DBOperation returns an attribute KeyValue conforming to the
+// "db.operation" semantic conventions. It represents the name of the operation
+// being executed, e.g. the [MongoDB command
+// name](https://docs.mongodb.com/manual/reference/command/#database-operations)
+// such as `findAndModify`, or the SQL keyword.
+func DBOperation(val string) attribute.KeyValue {
+	return DBOperationKey.String(val)
+}
+
+// Connection-level attributes for Microsoft SQL Server
+const (
+	// DBMSSQLInstanceNameKey is the attribute Key conforming to the
+	// "db.mssql.instance_name" semantic conventions. It represents the
+	// Microsoft SQL Server [instance
+	// name](https://docs.microsoft.com/en-us/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver15)
+	// connecting to. This name is used to determine the port of a named
+	// instance.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'MSSQLSERVER'
+	// Note: If setting a `db.mssql.instance_name`, `net.peer.port` is no
+	// longer required (but still recommended if non-standard).
+	DBMSSQLInstanceNameKey = attribute.Key("db.mssql.instance_name")
+)
+
+// DBMSSQLInstanceName returns an attribute KeyValue conforming to the
+// "db.mssql.instance_name" semantic conventions. It represents the Microsoft
+// SQL Server [instance
+// name](https://docs.microsoft.com/en-us/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver15)
+// connecting to. This name is used to determine the port of a named instance.
+func DBMSSQLInstanceName(val string) attribute.KeyValue {
+	return DBMSSQLInstanceNameKey.String(val)
+}
+
+// Call-level attributes for Cassandra
+const (
+	// DBCassandraPageSizeKey is the attribute Key conforming to the
+	// "db.cassandra.page_size" semantic conventions. It represents the fetch
+	// size used for paging, i.e. how many rows will be returned at once.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 5000
+	DBCassandraPageSizeKey = attribute.Key("db.cassandra.page_size")
+
+	// DBCassandraConsistencyLevelKey is the attribute Key conforming to the
+	// "db.cassandra.consistency_level" semantic conventions. It represents the
+	// consistency level of the query. Based on consistency values from
+	// [CQL](https://docs.datastax.com/en/cassandra-oss/3.0/cassandra/dml/dmlConfigConsistency.html).
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	DBCassandraConsistencyLevelKey = attribute.Key("db.cassandra.consistency_level")
+
+	// DBCassandraTableKey is the attribute Key conforming to the
+	// "db.cassandra.table" semantic conventions. It represents the name of the
+	// primary table that the operation is acting upon, including the keyspace
+	// name (if applicable).
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: stable
+	// Examples: 'mytable'
+	// Note: This mirrors the db.sql.table attribute but references cassandra
+	// rather than sql. It is not recommended to attempt any client-side
+	// parsing of `db.statement` just to get this property, but it should be
+	// set if it is provided by the library being instrumented. If the
+	// operation is acting upon an anonymous table, or more than one table,
+	// this value MUST NOT be set.
+	DBCassandraTableKey = attribute.Key("db.cassandra.table")
+
+	// DBCassandraIdempotenceKey is the attribute Key conforming to the
+	// "db.cassandra.idempotence" semantic conventions. It represents the
+	// whether or not the query is idempotent.
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	DBCassandraIdempotenceKey = attribute.Key("db.cassandra.idempotence")
+
+	// DBCassandraSpeculativeExecutionCountKey is the attribute Key conforming
+	// to the "db.cassandra.speculative_execution_count" semantic conventions.
+	// It represents the number of times a query was speculatively executed.
+	// Not set or `0` if the query was not executed speculatively.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 0, 2
+	DBCassandraSpeculativeExecutionCountKey = attribute.Key("db.cassandra.speculative_execution_count")
+
+	// DBCassandraCoordinatorIDKey is the attribute Key conforming to the
+	// "db.cassandra.coordinator.id" semantic conventions. It represents the ID
+	// of the coordinating node for a query.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'be13faa2-8574-4d71-926d-27f16cf8a7af'
+	DBCassandraCoordinatorIDKey = attribute.Key("db.cassandra.coordinator.id")
+
+	// DBCassandraCoordinatorDCKey is the attribute Key conforming to the
+	// "db.cassandra.coordinator.dc" semantic conventions. It represents the
+	// data center of the coordinating node for a query.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'us-west-2'
+	DBCassandraCoordinatorDCKey = attribute.Key("db.cassandra.coordinator.dc")
+)
+
+var (
+	// all
+	DBCassandraConsistencyLevelAll = DBCassandraConsistencyLevelKey.String("all")
+	// each_quorum
+	DBCassandraConsistencyLevelEachQuorum = DBCassandraConsistencyLevelKey.String("each_quorum")
+	// quorum
+	DBCassandraConsistencyLevelQuorum = DBCassandraConsistencyLevelKey.String("quorum")
+	// local_quorum
+	DBCassandraConsistencyLevelLocalQuorum = DBCassandraConsistencyLevelKey.String("local_quorum")
+	// one
+	DBCassandraConsistencyLevelOne = DBCassandraConsistencyLevelKey.String("one")
+	// two
+	DBCassandraConsistencyLevelTwo = DBCassandraConsistencyLevelKey.String("two")
+	// three
+	DBCassandraConsistencyLevelThree = DBCassandraConsistencyLevelKey.String("three")
+	// local_one
+	DBCassandraConsistencyLevelLocalOne = DBCassandraConsistencyLevelKey.String("local_one")
+	// any
+	DBCassandraConsistencyLevelAny = DBCassandraConsistencyLevelKey.String("any")
+	// serial
+	DBCassandraConsistencyLevelSerial = DBCassandraConsistencyLevelKey.String("serial")
+	// local_serial
+	DBCassandraConsistencyLevelLocalSerial = DBCassandraConsistencyLevelKey.String("local_serial")
+)
+
+// DBCassandraPageSize returns an attribute KeyValue conforming to the
+// "db.cassandra.page_size" semantic conventions. It represents the fetch size
+// used for paging, i.e. how many rows will be returned at once.
+func DBCassandraPageSize(val int) attribute.KeyValue {
+	return DBCassandraPageSizeKey.Int(val)
+}
+
+// DBCassandraTable returns an attribute KeyValue conforming to the
+// "db.cassandra.table" semantic conventions. It represents the name of the
+// primary table that the operation is acting upon, including the keyspace name
+// (if applicable).
+func DBCassandraTable(val string) attribute.KeyValue {
+	return DBCassandraTableKey.String(val)
+}
+
+// DBCassandraIdempotence returns an attribute KeyValue conforming to the
+// "db.cassandra.idempotence" semantic conventions. It represents the whether
+// or not the query is idempotent.
+func DBCassandraIdempotence(val bool) attribute.KeyValue {
+	return DBCassandraIdempotenceKey.Bool(val)
+}
+
+// DBCassandraSpeculativeExecutionCount returns an attribute KeyValue
+// conforming to the "db.cassandra.speculative_execution_count" semantic
+// conventions. It represents the number of times a query was speculatively
+// executed. Not set or `0` if the query was not executed speculatively.
+func DBCassandraSpeculativeExecutionCount(val int) attribute.KeyValue {
+	return DBCassandraSpeculativeExecutionCountKey.Int(val)
+}
+
+// DBCassandraCoordinatorID returns an attribute KeyValue conforming to the
+// "db.cassandra.coordinator.id" semantic conventions. It represents the ID of
+// the coordinating node for a query.
+func DBCassandraCoordinatorID(val string) attribute.KeyValue {
+	return DBCassandraCoordinatorIDKey.String(val)
+}
+
+// DBCassandraCoordinatorDC returns an attribute KeyValue conforming to the
+// "db.cassandra.coordinator.dc" semantic conventions. It represents the data
+// center of the coordinating node for a query.
+func DBCassandraCoordinatorDC(val string) attribute.KeyValue {
+	return DBCassandraCoordinatorDCKey.String(val)
+}
+
+// Call-level attributes for Redis
+const (
+	// DBRedisDBIndexKey is the attribute Key conforming to the
+	// "db.redis.database_index" semantic conventions. It represents the index
+	// of the database being accessed as used in the [`SELECT`
+	// command](https://redis.io/commands/select), provided as an integer. To
+	// be used instead of the generic `db.name` attribute.
+	//
+	// Type: int
+	// RequirementLevel: ConditionallyRequired (If other than the default
+	// database (`0`).)
+	// Stability: stable
+	// Examples: 0, 1, 15
+	DBRedisDBIndexKey = attribute.Key("db.redis.database_index")
+)
+
+// DBRedisDBIndex returns an attribute KeyValue conforming to the
+// "db.redis.database_index" semantic conventions. It represents the index of
+// the database being accessed as used in the [`SELECT`
+// command](https://redis.io/commands/select), provided as an integer. To be
+// used instead of the generic `db.name` attribute.
+func DBRedisDBIndex(val int) attribute.KeyValue {
+	return DBRedisDBIndexKey.Int(val)
+}
+
+// Call-level attributes for MongoDB
+const (
+	// DBMongoDBCollectionKey is the attribute Key conforming to the
+	// "db.mongodb.collection" semantic conventions. It represents the
+	// collection being accessed within the database stated in `db.name`.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'customers', 'products'
+	DBMongoDBCollectionKey = attribute.Key("db.mongodb.collection")
+)
+
+// DBMongoDBCollection returns an attribute KeyValue conforming to the
+// "db.mongodb.collection" semantic conventions. It represents the collection
+// being accessed within the database stated in `db.name`.
+func DBMongoDBCollection(val string) attribute.KeyValue {
+	return DBMongoDBCollectionKey.String(val)
+}
+
+// Call-level attributes for SQL databases
+const (
+	// DBSQLTableKey is the attribute Key conforming to the "db.sql.table"
+	// semantic conventions. It represents the name of the primary table that
+	// the operation is acting upon, including the database name (if
+	// applicable).
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: stable
+	// Examples: 'public.users', 'customers'
+	// Note: It is not recommended to attempt any client-side parsing of
+	// `db.statement` just to get this property, but it should be set if it is
+	// provided by the library being instrumented. If the operation is acting
+	// upon an anonymous table, or more than one table, this value MUST NOT be
+	// set.
+	DBSQLTableKey = attribute.Key("db.sql.table")
+)
+
+// DBSQLTable returns an attribute KeyValue conforming to the "db.sql.table"
+// semantic conventions. It represents the name of the primary table that the
+// operation is acting upon, including the database name (if applicable).
+func DBSQLTable(val string) attribute.KeyValue {
+	return DBSQLTableKey.String(val)
+}
+
+// Span attributes used by non-OTLP exporters to represent OpenTelemetry Span's
+// concepts.
+const (
+	// OtelStatusCodeKey is the attribute Key conforming to the
+	// "otel.status_code" semantic conventions. It represents the name of the
+	// code, either "OK" or "ERROR". MUST NOT be set if the status code is
+	// UNSET.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	OtelStatusCodeKey = attribute.Key("otel.status_code")
+
+	// OtelStatusDescriptionKey is the attribute Key conforming to the
+	// "otel.status_description" semantic conventions. It represents the
+	// description of the Status if it has a value, otherwise not set.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'resource not found'
+	OtelStatusDescriptionKey = attribute.Key("otel.status_description")
+)
+
+var (
+	// The operation has been validated by an Application developer or Operator to have completed successfully
+	OtelStatusCodeOk = OtelStatusCodeKey.String("OK")
+	// The operation contains an error
+	OtelStatusCodeError = OtelStatusCodeKey.String("ERROR")
+)
+
+// OtelStatusDescription returns an attribute KeyValue conforming to the
+// "otel.status_description" semantic conventions. It represents the
+// description of the Status if it has a value, otherwise not set.
+func OtelStatusDescription(val string) attribute.KeyValue {
+	return OtelStatusDescriptionKey.String(val)
+}
+
+// This semantic convention describes an instance of a function that runs
+// without provisioning or managing of servers (also known as serverless
+// functions or Function as a Service (FaaS)) with spans.
+const (
+	// FaaSTriggerKey is the attribute Key conforming to the "faas.trigger"
+	// semantic conventions. It represents the type of the trigger which caused
+	// this function execution.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: For the server/consumer span on the incoming side,
+	// `faas.trigger` MUST be set.
+	//
+	// Clients invoking FaaS instances usually cannot set `faas.trigger`,
+	// since they would typically need to look in the payload to determine
+	// the event type. If clients set it, it should be the same as the
+	// trigger that corresponding incoming would have (i.e., this has
+	// nothing to do with the underlying transport used to make the API
+	// call to invoke the lambda, which is often HTTP).
+	FaaSTriggerKey = attribute.Key("faas.trigger")
+
+	// FaaSExecutionKey is the attribute Key conforming to the "faas.execution"
+	// semantic conventions. It represents the execution ID of the current
+	// function execution.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'af9d5aa4-a685-4c5f-a22b-444f80b3cc28'
+	FaaSExecutionKey = attribute.Key("faas.execution")
+)
+
+var (
+	// A response to some data source operation such as a database or filesystem read/write
+	FaaSTriggerDatasource = FaaSTriggerKey.String("datasource")
+	// To provide an answer to an inbound HTTP request
+	FaaSTriggerHTTP = FaaSTriggerKey.String("http")
+	// A function is set to be executed when messages are sent to a messaging system
+	FaaSTriggerPubsub = FaaSTriggerKey.String("pubsub")
+	// A function is scheduled to be executed regularly
+	FaaSTriggerTimer = FaaSTriggerKey.String("timer")
+	// If none of the others apply
+	FaaSTriggerOther = FaaSTriggerKey.String("other")
+)
+
+// FaaSExecution returns an attribute KeyValue conforming to the
+// "faas.execution" semantic conventions. It represents the execution ID of the
+// current function execution.
+func FaaSExecution(val string) attribute.KeyValue {
+	return FaaSExecutionKey.String(val)
+}
+
+// Semantic Convention for FaaS triggered as a response to some data source
+// operation such as a database or filesystem read/write.
+const (
+	// FaaSDocumentCollectionKey is the attribute Key conforming to the
+	// "faas.document.collection" semantic conventions. It represents the name
+	// of the source on which the triggering operation was performed. For
+	// example, in Cloud Storage or S3 corresponds to the bucket name, and in
+	// Cosmos DB to the database name.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'myBucketName', 'myDBName'
+	FaaSDocumentCollectionKey = attribute.Key("faas.document.collection")
+
+	// FaaSDocumentOperationKey is the attribute Key conforming to the
+	// "faas.document.operation" semantic conventions. It represents the
+	// describes the type of the operation that was performed on the data.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	FaaSDocumentOperationKey = attribute.Key("faas.document.operation")
+
+	// FaaSDocumentTimeKey is the attribute Key conforming to the
+	// "faas.document.time" semantic conventions. It represents a string
+	// containing the time when the data was accessed in the [ISO
+	// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format
+	// expressed in [UTC](https://www.w3.org/TR/NOTE-datetime).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '2020-01-23T13:47:06Z'
+	FaaSDocumentTimeKey = attribute.Key("faas.document.time")
+
+	// FaaSDocumentNameKey is the attribute Key conforming to the
+	// "faas.document.name" semantic conventions. It represents the document
+	// name/table subjected to the operation. For example, in Cloud Storage or
+	// S3 is the name of the file, and in Cosmos DB the table name.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'myFile.txt', 'myTableName'
+	FaaSDocumentNameKey = attribute.Key("faas.document.name")
+)
+
+var (
+	// When a new object is created
+	FaaSDocumentOperationInsert = FaaSDocumentOperationKey.String("insert")
+	// When an object is modified
+	FaaSDocumentOperationEdit = FaaSDocumentOperationKey.String("edit")
+	// When an object is deleted
+	FaaSDocumentOperationDelete = FaaSDocumentOperationKey.String("delete")
+)
+
+// FaaSDocumentCollection returns an attribute KeyValue conforming to the
+// "faas.document.collection" semantic conventions. It represents the name of
+// the source on which the triggering operation was performed. For example, in
+// Cloud Storage or S3 corresponds to the bucket name, and in Cosmos DB to the
+// database name.
+func FaaSDocumentCollection(val string) attribute.KeyValue {
+	return FaaSDocumentCollectionKey.String(val)
+}
+
+// FaaSDocumentTime returns an attribute KeyValue conforming to the
+// "faas.document.time" semantic conventions. It represents a string containing
+// the time when the data was accessed in the [ISO
+// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format
+// expressed in [UTC](https://www.w3.org/TR/NOTE-datetime).
+func FaaSDocumentTime(val string) attribute.KeyValue {
+	return FaaSDocumentTimeKey.String(val)
+}
+
+// FaaSDocumentName returns an attribute KeyValue conforming to the
+// "faas.document.name" semantic conventions. It represents the document
+// name/table subjected to the operation. For example, in Cloud Storage or S3
+// is the name of the file, and in Cosmos DB the table name.
+func FaaSDocumentName(val string) attribute.KeyValue {
+	return FaaSDocumentNameKey.String(val)
+}
+
+// Semantic Convention for FaaS scheduled to be executed regularly.
+const (
+	// FaaSTimeKey is the attribute Key conforming to the "faas.time" semantic
+	// conventions. It represents a string containing the function invocation
+	// time in the [ISO
+	// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format
+	// expressed in [UTC](https://www.w3.org/TR/NOTE-datetime).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '2020-01-23T13:47:06Z'
+	FaaSTimeKey = attribute.Key("faas.time")
+
+	// FaaSCronKey is the attribute Key conforming to the "faas.cron" semantic
+	// conventions. It represents a string containing the schedule period as
+	// [Cron
+	// Expression](https://docs.oracle.com/cd/E12058_01/doc/doc.1014/e12030/cron_expressions.htm).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '0/5 * * * ? *'
+	FaaSCronKey = attribute.Key("faas.cron")
+)
+
+// FaaSTime returns an attribute KeyValue conforming to the "faas.time"
+// semantic conventions. It represents a string containing the function
+// invocation time in the [ISO
+// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format
+// expressed in [UTC](https://www.w3.org/TR/NOTE-datetime).
+func FaaSTime(val string) attribute.KeyValue {
+	return FaaSTimeKey.String(val)
+}
+
+// FaaSCron returns an attribute KeyValue conforming to the "faas.cron"
+// semantic conventions. It represents a string containing the schedule period
+// as [Cron
+// Expression](https://docs.oracle.com/cd/E12058_01/doc/doc.1014/e12030/cron_expressions.htm).
+func FaaSCron(val string) attribute.KeyValue {
+	return FaaSCronKey.String(val)
+}
+
+// Contains additional attributes for incoming FaaS spans.
+const (
+	// FaaSColdstartKey is the attribute Key conforming to the "faas.coldstart"
+	// semantic conventions. It represents a boolean that is true if the
+	// serverless function is executed for the first time (aka cold-start).
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	FaaSColdstartKey = attribute.Key("faas.coldstart")
+)
+
+// FaaSColdstart returns an attribute KeyValue conforming to the
+// "faas.coldstart" semantic conventions. It represents a boolean that is true
+// if the serverless function is executed for the first time (aka cold-start).
+func FaaSColdstart(val bool) attribute.KeyValue {
+	return FaaSColdstartKey.Bool(val)
+}
+
+// Contains additional attributes for outgoing FaaS spans.
+const (
+	// FaaSInvokedNameKey is the attribute Key conforming to the
+	// "faas.invoked_name" semantic conventions. It represents the name of the
+	// invoked function.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'my-function'
+	// Note: SHOULD be equal to the `faas.name` resource attribute of the
+	// invoked function.
+	FaaSInvokedNameKey = attribute.Key("faas.invoked_name")
+
+	// FaaSInvokedProviderKey is the attribute Key conforming to the
+	// "faas.invoked_provider" semantic conventions. It represents the cloud
+	// provider of the invoked function.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	// Note: SHOULD be equal to the `cloud.provider` resource attribute of the
+	// invoked function.
+	FaaSInvokedProviderKey = attribute.Key("faas.invoked_provider")
+
+	// FaaSInvokedRegionKey is the attribute Key conforming to the
+	// "faas.invoked_region" semantic conventions. It represents the cloud
+	// region of the invoked function.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (For some cloud providers, like
+	// AWS or GCP, the region in which a function is hosted is essential to
+	// uniquely identify the function and also part of its endpoint. Since it's
+	// part of the endpoint being called, the region is always known to
+	// clients. In these cases, `faas.invoked_region` MUST be set accordingly.
+	// If the region is unknown to the client or not required for identifying
+	// the invoked function, setting `faas.invoked_region` is optional.)
+	// Stability: stable
+	// Examples: 'eu-central-1'
+	// Note: SHOULD be equal to the `cloud.region` resource attribute of the
+	// invoked function.
+	FaaSInvokedRegionKey = attribute.Key("faas.invoked_region")
+)
+
+var (
+	// Alibaba Cloud
+	FaaSInvokedProviderAlibabaCloud = FaaSInvokedProviderKey.String("alibaba_cloud")
+	// Amazon Web Services
+	FaaSInvokedProviderAWS = FaaSInvokedProviderKey.String("aws")
+	// Microsoft Azure
+	FaaSInvokedProviderAzure = FaaSInvokedProviderKey.String("azure")
+	// Google Cloud Platform
+	FaaSInvokedProviderGCP = FaaSInvokedProviderKey.String("gcp")
+	// Tencent Cloud
+	FaaSInvokedProviderTencentCloud = FaaSInvokedProviderKey.String("tencent_cloud")
+)
+
+// FaaSInvokedName returns an attribute KeyValue conforming to the
+// "faas.invoked_name" semantic conventions. It represents the name of the
+// invoked function.
+func FaaSInvokedName(val string) attribute.KeyValue {
+	return FaaSInvokedNameKey.String(val)
+}
+
+// FaaSInvokedRegion returns an attribute KeyValue conforming to the
+// "faas.invoked_region" semantic conventions. It represents the cloud region
+// of the invoked function.
+func FaaSInvokedRegion(val string) attribute.KeyValue {
+	return FaaSInvokedRegionKey.String(val)
+}
+
+// These attributes may be used for any network related operation.
+const (
+	// NetTransportKey is the attribute Key conforming to the "net.transport"
+	// semantic conventions. It represents the transport protocol used. See
+	// note below.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	NetTransportKey = attribute.Key("net.transport")
+
+	// NetAppProtocolNameKey is the attribute Key conforming to the
+	// "net.app.protocol.name" semantic conventions. It represents the
+	// application layer protocol used. The value SHOULD be normalized to
+	// lowercase.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'amqp', 'http', 'mqtt'
+	NetAppProtocolNameKey = attribute.Key("net.app.protocol.name")
+
+	// NetAppProtocolVersionKey is the attribute Key conforming to the
+	// "net.app.protocol.version" semantic conventions. It represents the
+	// version of the application layer protocol used. See note below.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '3.1.1'
+	// Note: `net.app.protocol.version` refers to the version of the protocol
+	// used and might be different from the protocol client's version. If the
+	// HTTP client used has a version of `0.27.2`, but sends HTTP version
+	// `1.1`, this attribute should be set to `1.1`.
+	NetAppProtocolVersionKey = attribute.Key("net.app.protocol.version")
+
+	// NetSockPeerNameKey is the attribute Key conforming to the
+	// "net.sock.peer.name" semantic conventions. It represents the remote
+	// socket peer name.
+	//
+	// Type: string
+	// RequirementLevel: Recommended (If available and different from
+	// `net.peer.name` and if `net.sock.peer.addr` is set.)
+	// Stability: stable
+	// Examples: 'proxy.example.com'
+	NetSockPeerNameKey = attribute.Key("net.sock.peer.name")
+
+	// NetSockPeerAddrKey is the attribute Key conforming to the
+	// "net.sock.peer.addr" semantic conventions. It represents the remote
+	// socket peer address: IPv4 or IPv6 for internet protocols, path for local
+	// communication,
+	// [etc](https://man7.org/linux/man-pages/man7/address_families.7.html).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '127.0.0.1', '/tmp/mysql.sock'
+	NetSockPeerAddrKey = attribute.Key("net.sock.peer.addr")
+
+	// NetSockPeerPortKey is the attribute Key conforming to the
+	// "net.sock.peer.port" semantic conventions. It represents the remote
+	// socket peer port.
+	//
+	// Type: int
+	// RequirementLevel: Recommended (If defined for the address family and if
+	// different than `net.peer.port` and if `net.sock.peer.addr` is set.)
+	// Stability: stable
+	// Examples: 16456
+	NetSockPeerPortKey = attribute.Key("net.sock.peer.port")
+
+	// NetSockFamilyKey is the attribute Key conforming to the
+	// "net.sock.family" semantic conventions. It represents the protocol
+	// [address
+	// family](https://man7.org/linux/man-pages/man7/address_families.7.html)
+	// which is used for communication.
+	//
+	// Type: Enum
+	// RequirementLevel: ConditionallyRequired (If different than `inet` and if
+	// any of `net.sock.peer.addr` or `net.sock.host.addr` are set. Consumers
+	// of telemetry SHOULD accept both IPv4 and IPv6 formats for the address in
+	// `net.sock.peer.addr` if `net.sock.family` is not set. This is to support
+	// instrumentations that follow previous versions of this document.)
+	// Stability: stable
+	// Examples: 'inet6', 'bluetooth'
+	NetSockFamilyKey = attribute.Key("net.sock.family")
+
+	// NetPeerNameKey is the attribute Key conforming to the "net.peer.name"
+	// semantic conventions. It represents the logical remote hostname, see
+	// note below.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'example.com'
+	// Note: `net.peer.name` SHOULD NOT be set if capturing it would require an
+	// extra DNS lookup.
+	NetPeerNameKey = attribute.Key("net.peer.name")
+
+	// NetPeerPortKey is the attribute Key conforming to the "net.peer.port"
+	// semantic conventions. It represents the logical remote port number
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 80, 8080, 443
+	NetPeerPortKey = attribute.Key("net.peer.port")
+
+	// NetHostNameKey is the attribute Key conforming to the "net.host.name"
+	// semantic conventions. It represents the logical local hostname or
+	// similar, see note below.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'localhost'
+	NetHostNameKey = attribute.Key("net.host.name")
+
+	// NetHostPortKey is the attribute Key conforming to the "net.host.port"
+	// semantic conventions. It represents the logical local port number,
+	// preferably the one that the peer used to connect
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 8080
+	NetHostPortKey = attribute.Key("net.host.port")
+
+	// NetSockHostAddrKey is the attribute Key conforming to the
+	// "net.sock.host.addr" semantic conventions. It represents the local
+	// socket address. Useful in case of a multi-IP host.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '192.168.0.1'
+	NetSockHostAddrKey = attribute.Key("net.sock.host.addr")
+
+	// NetSockHostPortKey is the attribute Key conforming to the
+	// "net.sock.host.port" semantic conventions. It represents the local
+	// socket port number.
+	//
+	// Type: int
+	// RequirementLevel: Recommended (If defined for the address family and if
+	// different than `net.host.port` and if `net.sock.host.addr` is set.)
+	// Stability: stable
+	// Examples: 35555
+	NetSockHostPortKey = attribute.Key("net.sock.host.port")
+
+	// NetHostConnectionTypeKey is the attribute Key conforming to the
+	// "net.host.connection.type" semantic conventions. It represents the
+	// internet connection type currently being used by the host.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'wifi'
+	NetHostConnectionTypeKey = attribute.Key("net.host.connection.type")
+
+	// NetHostConnectionSubtypeKey is the attribute Key conforming to the
+	// "net.host.connection.subtype" semantic conventions. It represents the
+	// this describes more details regarding the connection.type. It may be the
+	// type of cell technology connection, but it could be used for describing
+	// details about a wifi connection.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'LTE'
+	NetHostConnectionSubtypeKey = attribute.Key("net.host.connection.subtype")
+
+	// NetHostCarrierNameKey is the attribute Key conforming to the
+	// "net.host.carrier.name" semantic conventions. It represents the name of
+	// the mobile carrier.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'sprint'
+	NetHostCarrierNameKey = attribute.Key("net.host.carrier.name")
+
+	// NetHostCarrierMccKey is the attribute Key conforming to the
+	// "net.host.carrier.mcc" semantic conventions. It represents the mobile
+	// carrier country code.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '310'
+	NetHostCarrierMccKey = attribute.Key("net.host.carrier.mcc")
+
+	// NetHostCarrierMncKey is the attribute Key conforming to the
+	// "net.host.carrier.mnc" semantic conventions. It represents the mobile
+	// carrier network code.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '001'
+	NetHostCarrierMncKey = attribute.Key("net.host.carrier.mnc")
+
+	// NetHostCarrierIccKey is the attribute Key conforming to the
+	// "net.host.carrier.icc" semantic conventions. It represents the ISO
+	// 3166-1 alpha-2 2-character country code associated with the mobile
+	// carrier network.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'DE'
+	NetHostCarrierIccKey = attribute.Key("net.host.carrier.icc")
+)
+
+var (
+	// ip_tcp
+	NetTransportTCP = NetTransportKey.String("ip_tcp")
+	// ip_udp
+	NetTransportUDP = NetTransportKey.String("ip_udp")
+	// Named or anonymous pipe. See note below
+	NetTransportPipe = NetTransportKey.String("pipe")
+	// In-process communication
+	NetTransportInProc = NetTransportKey.String("inproc")
+	// Something else (non IP-based)
+	NetTransportOther = NetTransportKey.String("other")
+)
+
+var (
+	// IPv4 address
+	NetSockFamilyInet = NetSockFamilyKey.String("inet")
+	// IPv6 address
+	NetSockFamilyInet6 = NetSockFamilyKey.String("inet6")
+	// Unix domain socket path
+	NetSockFamilyUnix = NetSockFamilyKey.String("unix")
+)
+
+var (
+	// wifi
+	NetHostConnectionTypeWifi = NetHostConnectionTypeKey.String("wifi")
+	// wired
+	NetHostConnectionTypeWired = NetHostConnectionTypeKey.String("wired")
+	// cell
+	NetHostConnectionTypeCell = NetHostConnectionTypeKey.String("cell")
+	// unavailable
+	NetHostConnectionTypeUnavailable = NetHostConnectionTypeKey.String("unavailable")
+	// unknown
+	NetHostConnectionTypeUnknown = NetHostConnectionTypeKey.String("unknown")
+)
+
+var (
+	// GPRS
+	NetHostConnectionSubtypeGprs = NetHostConnectionSubtypeKey.String("gprs")
+	// EDGE
+	NetHostConnectionSubtypeEdge = NetHostConnectionSubtypeKey.String("edge")
+	// UMTS
+	NetHostConnectionSubtypeUmts = NetHostConnectionSubtypeKey.String("umts")
+	// CDMA
+	NetHostConnectionSubtypeCdma = NetHostConnectionSubtypeKey.String("cdma")
+	// EVDO Rel. 0
+	NetHostConnectionSubtypeEvdo0 = NetHostConnectionSubtypeKey.String("evdo_0")
+	// EVDO Rev. A
+	NetHostConnectionSubtypeEvdoA = NetHostConnectionSubtypeKey.String("evdo_a")
+	// CDMA2000 1XRTT
+	NetHostConnectionSubtypeCdma20001xrtt = NetHostConnectionSubtypeKey.String("cdma2000_1xrtt")
+	// HSDPA
+	NetHostConnectionSubtypeHsdpa = NetHostConnectionSubtypeKey.String("hsdpa")
+	// HSUPA
+	NetHostConnectionSubtypeHsupa = NetHostConnectionSubtypeKey.String("hsupa")
+	// HSPA
+	NetHostConnectionSubtypeHspa = NetHostConnectionSubtypeKey.String("hspa")
+	// IDEN
+	NetHostConnectionSubtypeIden = NetHostConnectionSubtypeKey.String("iden")
+	// EVDO Rev. B
+	NetHostConnectionSubtypeEvdoB = NetHostConnectionSubtypeKey.String("evdo_b")
+	// LTE
+	NetHostConnectionSubtypeLte = NetHostConnectionSubtypeKey.String("lte")
+	// EHRPD
+	NetHostConnectionSubtypeEhrpd = NetHostConnectionSubtypeKey.String("ehrpd")
+	// HSPAP
+	NetHostConnectionSubtypeHspap = NetHostConnectionSubtypeKey.String("hspap")
+	// GSM
+	NetHostConnectionSubtypeGsm = NetHostConnectionSubtypeKey.String("gsm")
+	// TD-SCDMA
+	NetHostConnectionSubtypeTdScdma = NetHostConnectionSubtypeKey.String("td_scdma")
+	// IWLAN
+	NetHostConnectionSubtypeIwlan = NetHostConnectionSubtypeKey.String("iwlan")
+	// 5G NR (New Radio)
+	NetHostConnectionSubtypeNr = NetHostConnectionSubtypeKey.String("nr")
+	// 5G NRNSA (New Radio Non-Standalone)
+	NetHostConnectionSubtypeNrnsa = NetHostConnectionSubtypeKey.String("nrnsa")
+	// LTE CA
+	NetHostConnectionSubtypeLteCa = NetHostConnectionSubtypeKey.String("lte_ca")
+)
+
+// NetAppProtocolName returns an attribute KeyValue conforming to the
+// "net.app.protocol.name" semantic conventions. It represents the application
+// layer protocol used. The value SHOULD be normalized to lowercase.
+func NetAppProtocolName(val string) attribute.KeyValue {
+	return NetAppProtocolNameKey.String(val)
+}
+
+// NetAppProtocolVersion returns an attribute KeyValue conforming to the
+// "net.app.protocol.version" semantic conventions. It represents the version
+// of the application layer protocol used. See note below.
+func NetAppProtocolVersion(val string) attribute.KeyValue {
+	return NetAppProtocolVersionKey.String(val)
+}
+
+// NetSockPeerName returns an attribute KeyValue conforming to the
+// "net.sock.peer.name" semantic conventions. It represents the remote socket
+// peer name.
+func NetSockPeerName(val string) attribute.KeyValue {
+	return NetSockPeerNameKey.String(val)
+}
+
+// NetSockPeerAddr returns an attribute KeyValue conforming to the
+// "net.sock.peer.addr" semantic conventions. It represents the remote socket
+// peer address: IPv4 or IPv6 for internet protocols, path for local
+// communication,
+// [etc](https://man7.org/linux/man-pages/man7/address_families.7.html).
+func NetSockPeerAddr(val string) attribute.KeyValue {
+	return NetSockPeerAddrKey.String(val)
+}
+
+// NetSockPeerPort returns an attribute KeyValue conforming to the
+// "net.sock.peer.port" semantic conventions. It represents the remote socket
+// peer port.
+func NetSockPeerPort(val int) attribute.KeyValue {
+	return NetSockPeerPortKey.Int(val)
+}
+
+// NetPeerName returns an attribute KeyValue conforming to the
+// "net.peer.name" semantic conventions. It represents the logical remote
+// hostname, see note below.
+func NetPeerName(val string) attribute.KeyValue {
+	return NetPeerNameKey.String(val)
+}
+
+// NetPeerPort returns an attribute KeyValue conforming to the
+// "net.peer.port" semantic conventions. It represents the logical remote port
+// number
+func NetPeerPort(val int) attribute.KeyValue {
+	return NetPeerPortKey.Int(val)
+}
+
+// NetHostName returns an attribute KeyValue conforming to the
+// "net.host.name" semantic conventions. It represents the logical local
+// hostname or similar, see note below.
+func NetHostName(val string) attribute.KeyValue {
+	return NetHostNameKey.String(val)
+}
+
+// NetHostPort returns an attribute KeyValue conforming to the
+// "net.host.port" semantic conventions. It represents the logical local port
+// number, preferably the one that the peer used to connect
+func NetHostPort(val int) attribute.KeyValue {
+	return NetHostPortKey.Int(val)
+}
+
+// NetSockHostAddr returns an attribute KeyValue conforming to the
+// "net.sock.host.addr" semantic conventions. It represents the local socket
+// address. Useful in case of a multi-IP host.
+func NetSockHostAddr(val string) attribute.KeyValue {
+	return NetSockHostAddrKey.String(val)
+}
+
+// NetSockHostPort returns an attribute KeyValue conforming to the
+// "net.sock.host.port" semantic conventions. It represents the local socket
+// port number.
+func NetSockHostPort(val int) attribute.KeyValue {
+	return NetSockHostPortKey.Int(val)
+}
+
+// NetHostCarrierName returns an attribute KeyValue conforming to the
+// "net.host.carrier.name" semantic conventions. It represents the name of the
+// mobile carrier.
+func NetHostCarrierName(val string) attribute.KeyValue {
+	return NetHostCarrierNameKey.String(val)
+}
+
+// NetHostCarrierMcc returns an attribute KeyValue conforming to the
+// "net.host.carrier.mcc" semantic conventions. It represents the mobile
+// carrier country code.
+func NetHostCarrierMcc(val string) attribute.KeyValue {
+	return NetHostCarrierMccKey.String(val)
+}
+
+// NetHostCarrierMnc returns an attribute KeyValue conforming to the
+// "net.host.carrier.mnc" semantic conventions. It represents the mobile
+// carrier network code.
+func NetHostCarrierMnc(val string) attribute.KeyValue {
+	return NetHostCarrierMncKey.String(val)
+}
+
+// NetHostCarrierIcc returns an attribute KeyValue conforming to the
+// "net.host.carrier.icc" semantic conventions. It represents the ISO 3166-1
+// alpha-2 2-character country code associated with the mobile carrier network.
+func NetHostCarrierIcc(val string) attribute.KeyValue {
+	return NetHostCarrierIccKey.String(val)
+}
+
+// Operations that access some remote service.
+const (
+	// PeerServiceKey is the attribute Key conforming to the "peer.service"
+	// semantic conventions. It represents the
+	// [`service.name`](../../resource/semantic_conventions/README.md#service)
+	// of the remote service. SHOULD be equal to the actual `service.name`
+	// resource attribute of the remote service if any.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'AuthTokenCache'
+	PeerServiceKey = attribute.Key("peer.service")
+)
+
+// PeerService returns an attribute KeyValue conforming to the
+// "peer.service" semantic conventions. It represents the
+// [`service.name`](../../resource/semantic_conventions/README.md#service) of
+// the remote service. SHOULD be equal to the actual `service.name` resource
+// attribute of the remote service if any.
+func PeerService(val string) attribute.KeyValue {
+	return PeerServiceKey.String(val)
+}
+
+// These attributes may be used for any operation with an authenticated and/or
+// authorized enduser.
+const (
+	// EnduserIDKey is the attribute Key conforming to the "enduser.id"
+	// semantic conventions. It represents the username or client_id extracted
+	// from the access token or
+	// [Authorization](https://tools.ietf.org/html/rfc7235#section-4.2) header
+	// in the inbound request from outside the system.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'username'
+	EnduserIDKey = attribute.Key("enduser.id")
+
+	// EnduserRoleKey is the attribute Key conforming to the "enduser.role"
+	// semantic conventions. It represents the actual/assumed role the client
+	// is making the request under extracted from token or application security
+	// context.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'admin'
+	EnduserRoleKey = attribute.Key("enduser.role")
+
+	// EnduserScopeKey is the attribute Key conforming to the "enduser.scope"
+	// semantic conventions. It represents the scopes or granted authorities
+	// the client currently possesses extracted from token or application
+	// security context. The value would come from the scope associated with an
+	// [OAuth 2.0 Access
+	// Token](https://tools.ietf.org/html/rfc6749#section-3.3) or an attribute
+	// value in a [SAML 2.0
+	// Assertion](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'read:message, write:files'
+	EnduserScopeKey = attribute.Key("enduser.scope")
+)
+
+// EnduserID returns an attribute KeyValue conforming to the "enduser.id"
+// semantic conventions. It represents the username or client_id extracted from
+// the access token or
+// [Authorization](https://tools.ietf.org/html/rfc7235#section-4.2) header in
+// the inbound request from outside the system.
+func EnduserID(val string) attribute.KeyValue {
+	return EnduserIDKey.String(val)
+}
+
+// EnduserRole returns an attribute KeyValue conforming to the
+// "enduser.role" semantic conventions. It represents the actual/assumed role
+// the client is making the request under extracted from token or application
+// security context.
+func EnduserRole(val string) attribute.KeyValue {
+	return EnduserRoleKey.String(val)
+}
+
+// EnduserScope returns an attribute KeyValue conforming to the
+// "enduser.scope" semantic conventions. It represents the scopes or granted
+// authorities the client currently possesses extracted from token or
+// application security context. The value would come from the scope associated
+// with an [OAuth 2.0 Access
+// Token](https://tools.ietf.org/html/rfc6749#section-3.3) or an attribute
+// value in a [SAML 2.0
+// Assertion](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html).
+func EnduserScope(val string) attribute.KeyValue {
+	return EnduserScopeKey.String(val)
+}
+
+// These attributes may be used for any operation to store information about a
+// thread that started a span.
+const (
+	// ThreadIDKey is the attribute Key conforming to the "thread.id" semantic
+	// conventions. It represents the current "managed" thread ID (as opposed
+	// to OS thread ID).
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 42
+	ThreadIDKey = attribute.Key("thread.id")
+
+	// ThreadNameKey is the attribute Key conforming to the "thread.name"
+	// semantic conventions. It represents the current thread name.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'main'
+	ThreadNameKey = attribute.Key("thread.name")
+)
+
+// ThreadID returns an attribute KeyValue conforming to the "thread.id"
+// semantic conventions. It represents the current "managed" thread ID (as
+// opposed to OS thread ID).
+func ThreadID(val int) attribute.KeyValue {
+	return ThreadIDKey.Int(val)
+}
+
+// ThreadName returns an attribute KeyValue conforming to the "thread.name"
+// semantic conventions. It represents the current thread name.
+func ThreadName(val string) attribute.KeyValue {
+	return ThreadNameKey.String(val)
+}
+
+// These attributes allow to report this unit of code and therefore to provide
+// more context about the span.
+const (
+	// CodeFunctionKey is the attribute Key conforming to the "code.function"
+	// semantic conventions. It represents the method or function name, or
+	// equivalent (usually rightmost part of the code unit's name).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'serveRequest'
+	CodeFunctionKey = attribute.Key("code.function")
+
+	// CodeNamespaceKey is the attribute Key conforming to the "code.namespace"
+	// semantic conventions. It represents the "namespace" within which
+	// `code.function` is defined. Usually the qualified class or module name,
+	// such that `code.namespace` + some separator + `code.function` form a
+	// unique identifier for the code unit.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'com.example.MyHTTPService'
+	CodeNamespaceKey = attribute.Key("code.namespace")
+
+	// CodeFilepathKey is the attribute Key conforming to the "code.filepath"
+	// semantic conventions. It represents the source code file name that
+	// identifies the code unit as uniquely as possible (preferably an absolute
+	// file path).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '/usr/local/MyApplication/content_root/app/index.php'
+	CodeFilepathKey = attribute.Key("code.filepath")
+
+	// CodeLineNumberKey is the attribute Key conforming to the "code.lineno"
+	// semantic conventions. It represents the line number in `code.filepath`
+	// best representing the operation. It SHOULD point within the code unit
+	// named in `code.function`.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 42
+	CodeLineNumberKey = attribute.Key("code.lineno")
+
+	// CodeColumnKey is the attribute Key conforming to the "code.column"
+	// semantic conventions. It represents the column number in `code.filepath`
+	// best representing the operation. It SHOULD point within the code unit
+	// named in `code.function`.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 16
+	CodeColumnKey = attribute.Key("code.column")
+)
+
+// CodeFunction returns an attribute KeyValue conforming to the
+// "code.function" semantic conventions. It represents the method or function
+// name, or equivalent (usually rightmost part of the code unit's name).
+func CodeFunction(val string) attribute.KeyValue {
+	return CodeFunctionKey.String(val)
+}
+
+// CodeNamespace returns an attribute KeyValue conforming to the
+// "code.namespace" semantic conventions. It represents the "namespace" within
+// which `code.function` is defined. Usually the qualified class or module
+// name, such that `code.namespace` + some separator + `code.function` form a
+// unique identifier for the code unit.
+func CodeNamespace(val string) attribute.KeyValue {
+	return CodeNamespaceKey.String(val)
+}
+
+// CodeFilepath returns an attribute KeyValue conforming to the
+// "code.filepath" semantic conventions. It represents the source code file
+// name that identifies the code unit as uniquely as possible (preferably an
+// absolute file path).
+func CodeFilepath(val string) attribute.KeyValue {
+	return CodeFilepathKey.String(val)
+}
+
+// CodeLineNumber returns an attribute KeyValue conforming to the "code.lineno"
+// semantic conventions. It represents the line number in `code.filepath` best
+// representing the operation. It SHOULD point within the code unit named in
+// `code.function`.
+func CodeLineNumber(val int) attribute.KeyValue {
+	return CodeLineNumberKey.Int(val)
+}
+
+// CodeColumn returns an attribute KeyValue conforming to the "code.column"
+// semantic conventions. It represents the column number in `code.filepath`
+// best representing the operation. It SHOULD point within the code unit named
+// in `code.function`.
+func CodeColumn(val int) attribute.KeyValue {
+	return CodeColumnKey.Int(val)
+}
+
+// Semantic conventions for HTTP client and server Spans.
+const (
+	// HTTPMethodKey is the attribute Key conforming to the "http.method"
+	// semantic conventions. It represents the hTTP request method.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'GET', 'POST', 'HEAD'
+	HTTPMethodKey = attribute.Key("http.method")
+
+	// HTTPStatusCodeKey is the attribute Key conforming to the
+	// "http.status_code" semantic conventions. It represents the [HTTP
+	// response status code](https://tools.ietf.org/html/rfc7231#section-6).
+	//
+	// Type: int
+	// RequirementLevel: ConditionallyRequired (If and only if one was
+	// received/sent.)
+	// Stability: stable
+	// Examples: 200
+	HTTPStatusCodeKey = attribute.Key("http.status_code")
+
+	// HTTPFlavorKey is the attribute Key conforming to the "http.flavor"
+	// semantic conventions. It represents the kind of HTTP protocol used.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Note: If `net.transport` is not specified, it can be assumed to be
+	// `IP.TCP` except if `http.flavor` is `QUIC`, in which case `IP.UDP` is
+	// assumed.
+	HTTPFlavorKey = attribute.Key("http.flavor")
+
+	// HTTPUserAgentKey is the attribute Key conforming to the
+	// "http.user_agent" semantic conventions. It represents the value of the
+	// [HTTP
+	// User-Agent](https://www.rfc-editor.org/rfc/rfc9110.html#field.user-agent)
+	// header sent by the client.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'CERN-LineMode/2.15 libwww/2.17b3'
+	HTTPUserAgentKey = attribute.Key("http.user_agent")
+
+	// HTTPRequestContentLengthKey is the attribute Key conforming to the
+	// "http.request_content_length" semantic conventions. It represents the
+	// size of the request payload body in bytes. This is the number of bytes
+	// transferred excluding headers and is often, but not always, present as
+	// the
+	// [Content-Length](https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length)
+	// header. For requests using transport encoding, this should be the
+	// compressed size.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 3495
+	HTTPRequestContentLengthKey = attribute.Key("http.request_content_length")
+
+	// HTTPResponseContentLengthKey is the attribute Key conforming to the
+	// "http.response_content_length" semantic conventions. It represents the
+	// size of the response payload body in bytes. This is the number of bytes
+	// transferred excluding headers and is often, but not always, present as
+	// the
+	// [Content-Length](https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length)
+	// header. For requests using transport encoding, this should be the
+	// compressed size.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 3495
+	HTTPResponseContentLengthKey = attribute.Key("http.response_content_length")
+)
+
+var (
+	// HTTP/1.0
+	HTTPFlavorHTTP10 = HTTPFlavorKey.String("1.0")
+	// HTTP/1.1
+	HTTPFlavorHTTP11 = HTTPFlavorKey.String("1.1")
+	// HTTP/2
+	HTTPFlavorHTTP20 = HTTPFlavorKey.String("2.0")
+	// HTTP/3
+	HTTPFlavorHTTP30 = HTTPFlavorKey.String("3.0")
+	// SPDY protocol
+	HTTPFlavorSPDY = HTTPFlavorKey.String("SPDY")
+	// QUIC protocol
+	HTTPFlavorQUIC = HTTPFlavorKey.String("QUIC")
+)
+
+// HTTPMethod returns an attribute KeyValue conforming to the "http.method"
+// semantic conventions. It represents the hTTP request method.
+func HTTPMethod(val string) attribute.KeyValue {
+	return HTTPMethodKey.String(val)
+}
+
+// HTTPStatusCode returns an attribute KeyValue conforming to the
+// "http.status_code" semantic conventions. It represents the [HTTP response
+// status code](https://tools.ietf.org/html/rfc7231#section-6).
+func HTTPStatusCode(val int) attribute.KeyValue {
+	return HTTPStatusCodeKey.Int(val)
+}
+
+// HTTPUserAgent returns an attribute KeyValue conforming to the
+// "http.user_agent" semantic conventions. It represents the value of the [HTTP
+// User-Agent](https://www.rfc-editor.org/rfc/rfc9110.html#field.user-agent)
+// header sent by the client.
+func HTTPUserAgent(val string) attribute.KeyValue {
+	return HTTPUserAgentKey.String(val)
+}
+
+// HTTPRequestContentLength returns an attribute KeyValue conforming to the
+// "http.request_content_length" semantic conventions. It represents the size
+// of the request payload body in bytes. This is the number of bytes
+// transferred excluding headers and is often, but not always, present as the
+// [Content-Length](https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length)
+// header. For requests using transport encoding, this should be the compressed
+// size.
+func HTTPRequestContentLength(val int) attribute.KeyValue {
+	return HTTPRequestContentLengthKey.Int(val)
+}
+
+// HTTPResponseContentLength returns an attribute KeyValue conforming to the
+// "http.response_content_length" semantic conventions. It represents the size
+// of the response payload body in bytes. This is the number of bytes
+// transferred excluding headers and is often, but not always, present as the
+// [Content-Length](https://www.rfc-editor.org/rfc/rfc9110.html#field.content-length)
+// header. For requests using transport encoding, this should be the compressed
+// size.
+func HTTPResponseContentLength(val int) attribute.KeyValue {
+	return HTTPResponseContentLengthKey.Int(val)
+}
+
+// Semantic Convention for HTTP Client
+const (
+	// HTTPURLKey is the attribute Key conforming to the "http.url" semantic
+	// conventions. It represents the full HTTP request URL in the form
+	// `scheme://host[:port]/path?query[#fragment]`. Usually the fragment is
+	// not transmitted over HTTP, but if it is known, it should be included
+	// nevertheless.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'https://www.foo.bar/search?q=OpenTelemetry#SemConv'
+	// Note: `http.url` MUST NOT contain credentials passed via URL in form of
+	// `https://username:password@www.example.com/`. In such case the
+	// attribute's value should be `https://www.example.com/`.
+	HTTPURLKey = attribute.Key("http.url")
+
+	// HTTPResendCountKey is the attribute Key conforming to the
+	// "http.resend_count" semantic conventions. It represents the ordinal
+	// number of request resending attempt (for any reason, including
+	// redirects).
+	//
+	// Type: int
+	// RequirementLevel: Recommended (if and only if request was retried.)
+	// Stability: stable
+	// Examples: 3
+	// Note: The resend count SHOULD be updated each time an HTTP request gets
+	// resent by the client, regardless of what was the cause of the resending
+	// (e.g. redirection, authorization failure, 503 Server Unavailable,
+	// network issues, or any other).
+	HTTPResendCountKey = attribute.Key("http.resend_count")
+)
+
+// HTTPURL returns an attribute KeyValue conforming to the "http.url"
+// semantic conventions. It represents the full HTTP request URL in the form
+// `scheme://host[:port]/path?query[#fragment]`. Usually the fragment is not
+// transmitted over HTTP, but if it is known, it should be included
+// nevertheless.
+func HTTPURL(val string) attribute.KeyValue {
+	return HTTPURLKey.String(val)
+}
+
+// HTTPResendCount returns an attribute KeyValue conforming to the
+// "http.resend_count" semantic conventions. It represents the ordinal number
+// of request resending attempt (for any reason, including redirects).
+func HTTPResendCount(val int) attribute.KeyValue {
+	return HTTPResendCountKey.Int(val)
+}
+
+// Semantic Convention for HTTP Server
+const (
+	// HTTPSchemeKey is the attribute Key conforming to the "http.scheme"
+	// semantic conventions. It represents the URI scheme identifying the used
+	// protocol.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'http', 'https'
+	HTTPSchemeKey = attribute.Key("http.scheme")
+
+	// HTTPTargetKey is the attribute Key conforming to the "http.target"
+	// semantic conventions. It represents the full request target as passed in
+	// a HTTP request line or equivalent.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: '/path/12314/?q=ddds'
+	HTTPTargetKey = attribute.Key("http.target")
+
+	// HTTPRouteKey is the attribute Key conforming to the "http.route"
+	// semantic conventions. It represents the matched route (path template in
+	// the format used by the respective server framework). See note below
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If and only if it's available)
+	// Stability: stable
+	// Examples: '/users/:userID?', '{controller}/{action}/{id?}'
+	// Note: 'http.route' MUST NOT be populated when this is not supported by
+	// the HTTP server framework as the route attribute should have
+	// low-cardinality and the URI path can NOT substitute it.
+	HTTPRouteKey = attribute.Key("http.route")
+
+	// HTTPClientIPKey is the attribute Key conforming to the "http.client_ip"
+	// semantic conventions. It represents the IP address of the original
+	// client behind all proxies, if known (e.g. from
+	// [X-Forwarded-For](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For)).
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '83.164.160.102'
+	// Note: This is not necessarily the same as `net.sock.peer.addr`, which
+	// would
+	// identify the network-level peer, which may be a proxy.
+	//
+	// This attribute should be set when a source of information different
+	// from the one used for `net.sock.peer.addr`, is available even if that
+	// other
+	// source just confirms the same value as `net.sock.peer.addr`.
+	// Rationale: For `net.sock.peer.addr`, one typically does not know if it
+	// comes from a proxy, reverse proxy, or the actual client. Setting
+	// `http.client_ip` when it's the same as `net.sock.peer.addr` means that
+	// one is at least somewhat confident that the address is not that of
+	// the closest proxy.
+	HTTPClientIPKey = attribute.Key("http.client_ip")
+)
+
+// HTTPScheme returns an attribute KeyValue conforming to the "http.scheme"
+// semantic conventions. It represents the URI scheme identifying the used
+// protocol.
+func HTTPScheme(val string) attribute.KeyValue {
+	return HTTPSchemeKey.String(val)
+}
+
+// HTTPTarget returns an attribute KeyValue conforming to the "http.target"
+// semantic conventions. It represents the full request target as passed in a
+// HTTP request line or equivalent.
+func HTTPTarget(val string) attribute.KeyValue {
+	return HTTPTargetKey.String(val)
+}
+
+// HTTPRoute returns an attribute KeyValue conforming to the "http.route"
+// semantic conventions. It represents the matched route (path template in the
+// format used by the respective server framework). See note below
+func HTTPRoute(val string) attribute.KeyValue {
+	return HTTPRouteKey.String(val)
+}
+
+// HTTPClientIP returns an attribute KeyValue conforming to the
+// "http.client_ip" semantic conventions. It represents the IP address of the
+// original client behind all proxies, if known (e.g. from
+// [X-Forwarded-For](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For)).
+func HTTPClientIP(val string) attribute.KeyValue {
+	return HTTPClientIPKey.String(val)
+}
+
+// Attributes that exist for multiple DynamoDB request types.
+const (
+	// AWSDynamoDBTableNamesKey is the attribute Key conforming to the
+	// "aws.dynamodb.table_names" semantic conventions. It represents the keys
+	// in the `RequestItems` object field.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Users', 'Cats'
+	AWSDynamoDBTableNamesKey = attribute.Key("aws.dynamodb.table_names")
+
+	// AWSDynamoDBConsumedCapacityKey is the attribute Key conforming to the
+	// "aws.dynamodb.consumed_capacity" semantic conventions. It represents the
+	// JSON-serialized value of each item in the `ConsumedCapacity` response
+	// field.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '{ "CapacityUnits": number, "GlobalSecondaryIndexes": {
+	// "string" : { "CapacityUnits": number, "ReadCapacityUnits": number,
+	// "WriteCapacityUnits": number } }, "LocalSecondaryIndexes": { "string" :
+	// { "CapacityUnits": number, "ReadCapacityUnits": number,
+	// "WriteCapacityUnits": number } }, "ReadCapacityUnits": number, "Table":
+	// { "CapacityUnits": number, "ReadCapacityUnits": number,
+	// "WriteCapacityUnits": number }, "TableName": "string",
+	// "WriteCapacityUnits": number }'
+	AWSDynamoDBConsumedCapacityKey = attribute.Key("aws.dynamodb.consumed_capacity")
+
+	// AWSDynamoDBItemCollectionMetricsKey is the attribute Key conforming to
+	// the "aws.dynamodb.item_collection_metrics" semantic conventions. It
+	// represents the JSON-serialized value of the `ItemCollectionMetrics`
+	// response field.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '{ "string" : [ { "ItemCollectionKey": { "string" : { "B":
+	// blob, "BOOL": boolean, "BS": [ blob ], "L": [ "AttributeValue" ], "M": {
+	// "string" : "AttributeValue" }, "N": "string", "NS": [ "string" ],
+	// "NULL": boolean, "S": "string", "SS": [ "string" ] } },
+	// "SizeEstimateRangeGB": [ number ] } ] }'
+	AWSDynamoDBItemCollectionMetricsKey = attribute.Key("aws.dynamodb.item_collection_metrics")
+
+	// AWSDynamoDBProvisionedReadCapacityKey is the attribute Key conforming to
+	// the "aws.dynamodb.provisioned_read_capacity" semantic conventions. It
+	// represents the value of the `ProvisionedThroughput.ReadCapacityUnits`
+	// request parameter.
+	//
+	// Type: double
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 1.0, 2.0
+	AWSDynamoDBProvisionedReadCapacityKey = attribute.Key("aws.dynamodb.provisioned_read_capacity")
+
+	// AWSDynamoDBProvisionedWriteCapacityKey is the attribute Key conforming
+	// to the "aws.dynamodb.provisioned_write_capacity" semantic conventions.
+	// It represents the value of the
+	// `ProvisionedThroughput.WriteCapacityUnits` request parameter.
+	//
+	// Type: double
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 1.0, 2.0
+	AWSDynamoDBProvisionedWriteCapacityKey = attribute.Key("aws.dynamodb.provisioned_write_capacity")
+
+	// AWSDynamoDBConsistentReadKey is the attribute Key conforming to the
+	// "aws.dynamodb.consistent_read" semantic conventions. It represents the
+	// value of the `ConsistentRead` request parameter.
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	AWSDynamoDBConsistentReadKey = attribute.Key("aws.dynamodb.consistent_read")
+
+	// AWSDynamoDBProjectionKey is the attribute Key conforming to the
+	// "aws.dynamodb.projection" semantic conventions. It represents the value
+	// of the `ProjectionExpression` request parameter.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Title', 'Title, Price, Color', 'Title, Description,
+	// RelatedItems, ProductReviews'
+	AWSDynamoDBProjectionKey = attribute.Key("aws.dynamodb.projection")
+
+	// AWSDynamoDBLimitKey is the attribute Key conforming to the
+	// "aws.dynamodb.limit" semantic conventions. It represents the value of
+	// the `Limit` request parameter.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBLimitKey = attribute.Key("aws.dynamodb.limit")
+
+	// AWSDynamoDBAttributesToGetKey is the attribute Key conforming to the
+	// "aws.dynamodb.attributes_to_get" semantic conventions. It represents the
+	// value of the `AttributesToGet` request parameter.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'lives', 'id'
+	AWSDynamoDBAttributesToGetKey = attribute.Key("aws.dynamodb.attributes_to_get")
+
+	// AWSDynamoDBIndexNameKey is the attribute Key conforming to the
+	// "aws.dynamodb.index_name" semantic conventions. It represents the value
+	// of the `IndexName` request parameter.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'name_to_group'
+	AWSDynamoDBIndexNameKey = attribute.Key("aws.dynamodb.index_name")
+
+	// AWSDynamoDBSelectKey is the attribute Key conforming to the
+	// "aws.dynamodb.select" semantic conventions. It represents the value of
+	// the `Select` request parameter.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'ALL_ATTRIBUTES', 'COUNT'
+	AWSDynamoDBSelectKey = attribute.Key("aws.dynamodb.select")
+)
+
+// AWSDynamoDBTableNames returns an attribute KeyValue conforming to the
+// "aws.dynamodb.table_names" semantic conventions. It represents the keys in
+// the `RequestItems` object field.
+func AWSDynamoDBTableNames(val ...string) attribute.KeyValue {
+	return AWSDynamoDBTableNamesKey.StringSlice(val)
+}
+
+// AWSDynamoDBConsumedCapacity returns an attribute KeyValue conforming to
+// the "aws.dynamodb.consumed_capacity" semantic conventions. It represents the
+// JSON-serialized value of each item in the `ConsumedCapacity` response field.
+func AWSDynamoDBConsumedCapacity(val ...string) attribute.KeyValue {
+	return AWSDynamoDBConsumedCapacityKey.StringSlice(val)
+}
+
+// AWSDynamoDBItemCollectionMetrics returns an attribute KeyValue conforming
+// to the "aws.dynamodb.item_collection_metrics" semantic conventions. It
+// represents the JSON-serialized value of the `ItemCollectionMetrics` response
+// field.
+func AWSDynamoDBItemCollectionMetrics(val string) attribute.KeyValue {
+	return AWSDynamoDBItemCollectionMetricsKey.String(val)
+}
+
+// AWSDynamoDBProvisionedReadCapacity returns an attribute KeyValue
+// conforming to the "aws.dynamodb.provisioned_read_capacity" semantic
+// conventions. It represents the value of the
+// `ProvisionedThroughput.ReadCapacityUnits` request parameter.
+func AWSDynamoDBProvisionedReadCapacity(val float64) attribute.KeyValue {
+	return AWSDynamoDBProvisionedReadCapacityKey.Float64(val)
+}
+
+// AWSDynamoDBProvisionedWriteCapacity returns an attribute KeyValue
+// conforming to the "aws.dynamodb.provisioned_write_capacity" semantic
+// conventions. It represents the value of the
+// `ProvisionedThroughput.WriteCapacityUnits` request parameter.
+func AWSDynamoDBProvisionedWriteCapacity(val float64) attribute.KeyValue {
+	return AWSDynamoDBProvisionedWriteCapacityKey.Float64(val)
+}
+
+// AWSDynamoDBConsistentRead returns an attribute KeyValue conforming to the
+// "aws.dynamodb.consistent_read" semantic conventions. It represents the value
+// of the `ConsistentRead` request parameter.
+func AWSDynamoDBConsistentRead(val bool) attribute.KeyValue {
+	return AWSDynamoDBConsistentReadKey.Bool(val)
+}
+
+// AWSDynamoDBProjection returns an attribute KeyValue conforming to the
+// "aws.dynamodb.projection" semantic conventions. It represents the value of
+// the `ProjectionExpression` request parameter.
+func AWSDynamoDBProjection(val string) attribute.KeyValue {
+	return AWSDynamoDBProjectionKey.String(val)
+}
+
+// AWSDynamoDBLimit returns an attribute KeyValue conforming to the
+// "aws.dynamodb.limit" semantic conventions. It represents the value of the
+// `Limit` request parameter.
+func AWSDynamoDBLimit(val int) attribute.KeyValue {
+	return AWSDynamoDBLimitKey.Int(val)
+}
+
+// AWSDynamoDBAttributesToGet returns an attribute KeyValue conforming to
+// the "aws.dynamodb.attributes_to_get" semantic conventions. It represents the
+// value of the `AttributesToGet` request parameter.
+func AWSDynamoDBAttributesToGet(val ...string) attribute.KeyValue {
+	return AWSDynamoDBAttributesToGetKey.StringSlice(val)
+}
+
+// AWSDynamoDBIndexName returns an attribute KeyValue conforming to the
+// "aws.dynamodb.index_name" semantic conventions. It represents the value of
+// the `IndexName` request parameter.
+func AWSDynamoDBIndexName(val string) attribute.KeyValue {
+	return AWSDynamoDBIndexNameKey.String(val)
+}
+
+// AWSDynamoDBSelect returns an attribute KeyValue conforming to the
+// "aws.dynamodb.select" semantic conventions. It represents the value of the
+// `Select` request parameter.
+func AWSDynamoDBSelect(val string) attribute.KeyValue {
+	return AWSDynamoDBSelectKey.String(val)
+}
+
+// DynamoDB.CreateTable
+const (
+	// AWSDynamoDBGlobalSecondaryIndexesKey is the attribute Key conforming to
+	// the "aws.dynamodb.global_secondary_indexes" semantic conventions. It
+	// represents the JSON-serialized value of each item of the
+	// `GlobalSecondaryIndexes` request field
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '{ "IndexName": "string", "KeySchema": [ { "AttributeName":
+	// "string", "KeyType": "string" } ], "Projection": { "NonKeyAttributes": [
+	// "string" ], "ProjectionType": "string" }, "ProvisionedThroughput": {
+	// "ReadCapacityUnits": number, "WriteCapacityUnits": number } }'
+	AWSDynamoDBGlobalSecondaryIndexesKey = attribute.Key("aws.dynamodb.global_secondary_indexes")
+
+	// AWSDynamoDBLocalSecondaryIndexesKey is the attribute Key conforming to
+	// the "aws.dynamodb.local_secondary_indexes" semantic conventions. It
+	// represents the JSON-serialized value of each item of the
+	// `LocalSecondaryIndexes` request field.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '{ "IndexARN": "string", "IndexName": "string",
+	// "IndexSizeBytes": number, "ItemCount": number, "KeySchema": [ {
+	// "AttributeName": "string", "KeyType": "string" } ], "Projection": {
+	// "NonKeyAttributes": [ "string" ], "ProjectionType": "string" } }'
+	AWSDynamoDBLocalSecondaryIndexesKey = attribute.Key("aws.dynamodb.local_secondary_indexes")
+)
+
+// AWSDynamoDBGlobalSecondaryIndexes returns an attribute KeyValue
+// conforming to the "aws.dynamodb.global_secondary_indexes" semantic
+// conventions. It represents the JSON-serialized value of each item of the
+// `GlobalSecondaryIndexes` request field
+func AWSDynamoDBGlobalSecondaryIndexes(val ...string) attribute.KeyValue {
+	return AWSDynamoDBGlobalSecondaryIndexesKey.StringSlice(val)
+}
+
+// AWSDynamoDBLocalSecondaryIndexes returns an attribute KeyValue conforming
+// to the "aws.dynamodb.local_secondary_indexes" semantic conventions. It
+// represents the JSON-serialized value of each item of the
+// `LocalSecondaryIndexes` request field.
+func AWSDynamoDBLocalSecondaryIndexes(val ...string) attribute.KeyValue {
+	return AWSDynamoDBLocalSecondaryIndexesKey.StringSlice(val)
+}
+
+// DynamoDB.ListTables
+const (
+	// AWSDynamoDBExclusiveStartTableKey is the attribute Key conforming to the
+	// "aws.dynamodb.exclusive_start_table" semantic conventions. It represents
+	// the value of the `ExclusiveStartTableName` request parameter.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Users', 'CatsTable'
+	AWSDynamoDBExclusiveStartTableKey = attribute.Key("aws.dynamodb.exclusive_start_table")
+
+	// AWSDynamoDBTableCountKey is the attribute Key conforming to the
+	// "aws.dynamodb.table_count" semantic conventions. It represents the the
+	// number of items in the `TableNames` response parameter.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 20
+	AWSDynamoDBTableCountKey = attribute.Key("aws.dynamodb.table_count")
+)
+
+// AWSDynamoDBExclusiveStartTable returns an attribute KeyValue conforming
+// to the "aws.dynamodb.exclusive_start_table" semantic conventions. It
+// represents the value of the `ExclusiveStartTableName` request parameter.
+func AWSDynamoDBExclusiveStartTable(val string) attribute.KeyValue {
+	return AWSDynamoDBExclusiveStartTableKey.String(val)
+}
+
+// AWSDynamoDBTableCount returns an attribute KeyValue conforming to the
+// "aws.dynamodb.table_count" semantic conventions. It represents the the
+// number of items in the `TableNames` response parameter.
+func AWSDynamoDBTableCount(val int) attribute.KeyValue {
+	return AWSDynamoDBTableCountKey.Int(val)
+}
+
+// DynamoDB.Query
+const (
+	// AWSDynamoDBScanForwardKey is the attribute Key conforming to the
+	// "aws.dynamodb.scan_forward" semantic conventions. It represents the
+	// value of the `ScanIndexForward` request parameter.
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	AWSDynamoDBScanForwardKey = attribute.Key("aws.dynamodb.scan_forward")
+)
+
+// AWSDynamoDBScanForward returns an attribute KeyValue conforming to the
+// "aws.dynamodb.scan_forward" semantic conventions. It represents the value of
+// the `ScanIndexForward` request parameter.
+func AWSDynamoDBScanForward(val bool) attribute.KeyValue {
+	return AWSDynamoDBScanForwardKey.Bool(val)
+}
+
+// DynamoDB.Scan
+const (
+	// AWSDynamoDBSegmentKey is the attribute Key conforming to the
+	// "aws.dynamodb.segment" semantic conventions. It represents the value of
+	// the `Segment` request parameter.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBSegmentKey = attribute.Key("aws.dynamodb.segment")
+
+	// AWSDynamoDBTotalSegmentsKey is the attribute Key conforming to the
+	// "aws.dynamodb.total_segments" semantic conventions. It represents the
+	// value of the `TotalSegments` request parameter.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 100
+	AWSDynamoDBTotalSegmentsKey = attribute.Key("aws.dynamodb.total_segments")
+
+	// AWSDynamoDBCountKey is the attribute Key conforming to the
+	// "aws.dynamodb.count" semantic conventions. It represents the value of
+	// the `Count` response parameter.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBCountKey = attribute.Key("aws.dynamodb.count")
+
+	// AWSDynamoDBScannedCountKey is the attribute Key conforming to the
+	// "aws.dynamodb.scanned_count" semantic conventions. It represents the
+	// value of the `ScannedCount` response parameter.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 50
+	AWSDynamoDBScannedCountKey = attribute.Key("aws.dynamodb.scanned_count")
+)
+
+// AWSDynamoDBSegment returns an attribute KeyValue conforming to the
+// "aws.dynamodb.segment" semantic conventions. It represents the value of the
+// `Segment` request parameter.
+func AWSDynamoDBSegment(val int) attribute.KeyValue {
+	return AWSDynamoDBSegmentKey.Int(val)
+}
+
+// AWSDynamoDBTotalSegments returns an attribute KeyValue conforming to the
+// "aws.dynamodb.total_segments" semantic conventions. It represents the value
+// of the `TotalSegments` request parameter.
+func AWSDynamoDBTotalSegments(val int) attribute.KeyValue {
+	return AWSDynamoDBTotalSegmentsKey.Int(val)
+}
+
+// AWSDynamoDBCount returns an attribute KeyValue conforming to the
+// "aws.dynamodb.count" semantic conventions. It represents the value of the
+// `Count` response parameter.
+func AWSDynamoDBCount(val int) attribute.KeyValue {
+	return AWSDynamoDBCountKey.Int(val)
+}
+
+// AWSDynamoDBScannedCount returns an attribute KeyValue conforming to the
+// "aws.dynamodb.scanned_count" semantic conventions. It represents the value
+// of the `ScannedCount` response parameter.
+func AWSDynamoDBScannedCount(val int) attribute.KeyValue {
+	return AWSDynamoDBScannedCountKey.Int(val)
+}
+
+// DynamoDB.UpdateTable
+const (
+	// AWSDynamoDBAttributeDefinitionsKey is the attribute Key conforming to
+	// the "aws.dynamodb.attribute_definitions" semantic conventions. It
+	// represents the JSON-serialized value of each item in the
+	// `AttributeDefinitions` request field.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '{ "AttributeName": "string", "AttributeType": "string" }'
+	AWSDynamoDBAttributeDefinitionsKey = attribute.Key("aws.dynamodb.attribute_definitions")
+
+	// AWSDynamoDBGlobalSecondaryIndexUpdatesKey is the attribute Key
+	// conforming to the "aws.dynamodb.global_secondary_index_updates" semantic
+	// conventions. It represents the JSON-serialized value of each item in the
+	// the `GlobalSecondaryIndexUpdates` request field.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '{ "Create": { "IndexName": "string", "KeySchema": [ {
+	// "AttributeName": "string", "KeyType": "string" } ], "Projection": {
+	// "NonKeyAttributes": [ "string" ], "ProjectionType": "string" },
+	// "ProvisionedThroughput": { "ReadCapacityUnits": number,
+	// "WriteCapacityUnits": number } }'
+	AWSDynamoDBGlobalSecondaryIndexUpdatesKey = attribute.Key("aws.dynamodb.global_secondary_index_updates")
+)
+
+// AWSDynamoDBAttributeDefinitions returns an attribute KeyValue conforming
+// to the "aws.dynamodb.attribute_definitions" semantic conventions. It
+// represents the JSON-serialized value of each item in the
+// `AttributeDefinitions` request field.
+func AWSDynamoDBAttributeDefinitions(val ...string) attribute.KeyValue {
+	return AWSDynamoDBAttributeDefinitionsKey.StringSlice(val)
+}
+
+// AWSDynamoDBGlobalSecondaryIndexUpdates returns an attribute KeyValue
+// conforming to the "aws.dynamodb.global_secondary_index_updates" semantic
+// conventions. It represents the JSON-serialized value of each item in the the
+// `GlobalSecondaryIndexUpdates` request field.
+func AWSDynamoDBGlobalSecondaryIndexUpdates(val ...string) attribute.KeyValue {
+	return AWSDynamoDBGlobalSecondaryIndexUpdatesKey.StringSlice(val)
+}
+
+// Semantic conventions to apply when instrumenting the GraphQL implementation.
+// They map GraphQL operations to attributes on a Span.
+const (
+	// GraphqlOperationNameKey is the attribute Key conforming to the
+	// "graphql.operation.name" semantic conventions. It represents the name of
+	// the operation being executed.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'findBookByID'
+	GraphqlOperationNameKey = attribute.Key("graphql.operation.name")
+
+	// GraphqlOperationTypeKey is the attribute Key conforming to the
+	// "graphql.operation.type" semantic conventions. It represents the type of
+	// the operation being executed.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'query', 'mutation', 'subscription'
+	GraphqlOperationTypeKey = attribute.Key("graphql.operation.type")
+
+	// GraphqlDocumentKey is the attribute Key conforming to the
+	// "graphql.document" semantic conventions. It represents the GraphQL
+	// document being executed.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'query findBookByID { bookByID(id: ?) { name } }'
+	// Note: The value may be sanitized to exclude sensitive information.
+	GraphqlDocumentKey = attribute.Key("graphql.document")
+)
+
+var (
+	// GraphQL query
+	GraphqlOperationTypeQuery = GraphqlOperationTypeKey.String("query")
+	// GraphQL mutation
+	GraphqlOperationTypeMutation = GraphqlOperationTypeKey.String("mutation")
+	// GraphQL subscription
+	GraphqlOperationTypeSubscription = GraphqlOperationTypeKey.String("subscription")
+)
+
+// GraphqlOperationName returns an attribute KeyValue conforming to the
+// "graphql.operation.name" semantic conventions. It represents the name of the
+// operation being executed.
+func GraphqlOperationName(val string) attribute.KeyValue {
+	return GraphqlOperationNameKey.String(val)
+}
+
+// GraphqlDocument returns an attribute KeyValue conforming to the
+// "graphql.document" semantic conventions. It represents the GraphQL document
+// being executed.
+func GraphqlDocument(val string) attribute.KeyValue {
+	return GraphqlDocumentKey.String(val)
+}
+
+// Semantic convention describing per-message attributes populated on messaging
+// spans or links.
+const (
+	// MessagingMessageIDKey is the attribute Key conforming to the
+	// "messaging.message.id" semantic conventions. It represents a value used
+	// by the messaging system as an identifier for the message, represented as
+	// a string.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '452a7c7c7c7048c2f887f61572b18fc2'
+	MessagingMessageIDKey = attribute.Key("messaging.message.id")
+
+	// MessagingMessageConversationIDKey is the attribute Key conforming to the
+	// "messaging.message.conversation_id" semantic conventions. It represents
+	// the [conversation ID](#conversations) identifying the conversation to
+	// which the message belongs, represented as a string. Sometimes called
+	// "Correlation ID".
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'MyConversationID'
+	MessagingMessageConversationIDKey = attribute.Key("messaging.message.conversation_id")
+
+	// MessagingMessagePayloadSizeBytesKey is the attribute Key conforming to
+	// the "messaging.message.payload_size_bytes" semantic conventions. It
+	// represents the (uncompressed) size of the message payload in bytes. Also
+	// use this attribute if it is unknown whether the compressed or
+	// uncompressed payload size is reported.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 2738
+	MessagingMessagePayloadSizeBytesKey = attribute.Key("messaging.message.payload_size_bytes")
+
+	// MessagingMessagePayloadCompressedSizeBytesKey is the attribute Key
+	// conforming to the "messaging.message.payload_compressed_size_bytes"
+	// semantic conventions. It represents the compressed size of the message
+	// payload in bytes.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 2048
+	MessagingMessagePayloadCompressedSizeBytesKey = attribute.Key("messaging.message.payload_compressed_size_bytes")
+)
+
+// MessagingMessageID returns an attribute KeyValue conforming to the
+// "messaging.message.id" semantic conventions. It represents a value used by
+// the messaging system as an identifier for the message, represented as a
+// string.
+func MessagingMessageID(val string) attribute.KeyValue {
+	return MessagingMessageIDKey.String(val)
+}
+
+// MessagingMessageConversationID returns an attribute KeyValue conforming
+// to the "messaging.message.conversation_id" semantic conventions. It
+// represents the [conversation ID](#conversations) identifying the
+// conversation to which the message belongs, represented as a string.
+// Sometimes called "Correlation ID".
+func MessagingMessageConversationID(val string) attribute.KeyValue {
+	return MessagingMessageConversationIDKey.String(val)
+}
+
+// MessagingMessagePayloadSizeBytes returns an attribute KeyValue conforming
+// to the "messaging.message.payload_size_bytes" semantic conventions. It
+// represents the (uncompressed) size of the message payload in bytes. Also use
+// this attribute if it is unknown whether the compressed or uncompressed
+// payload size is reported.
+func MessagingMessagePayloadSizeBytes(val int) attribute.KeyValue {
+	return MessagingMessagePayloadSizeBytesKey.Int(val)
+}
+
+// MessagingMessagePayloadCompressedSizeBytes returns an attribute KeyValue
+// conforming to the "messaging.message.payload_compressed_size_bytes" semantic
+// conventions. It represents the compressed size of the message payload in
+// bytes.
+func MessagingMessagePayloadCompressedSizeBytes(val int) attribute.KeyValue {
+	return MessagingMessagePayloadCompressedSizeBytesKey.Int(val)
+}
+
+// Semantic convention for attributes that describe messaging destination on
+// broker
+const (
+	// MessagingDestinationNameKey is the attribute Key conforming to the
+	// "messaging.destination.name" semantic conventions. It represents the
+	// message destination name
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'MyQueue', 'MyTopic'
+	// Note: Destination name SHOULD uniquely identify a specific queue, topic
+	// or other entity within the broker. If
+	// the broker does not have such notion, the destination name SHOULD
+	// uniquely identify the broker.
+	MessagingDestinationNameKey = attribute.Key("messaging.destination.name")
+
+	// MessagingDestinationKindKey is the attribute Key conforming to the
+	// "messaging.destination.kind" semantic conventions. It represents the
+	// kind of message destination
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingDestinationKindKey = attribute.Key("messaging.destination.kind")
+
+	// MessagingDestinationTemplateKey is the attribute Key conforming to the
+	// "messaging.destination.template" semantic conventions. It represents the
+	// low cardinality representation of the messaging destination name
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '/customers/{customerID}'
+	// Note: Destination names could be constructed from templates. An example
+	// would be a destination name involving a user name or product id.
+	// Although the destination name in this case is of high cardinality, the
+	// underlying template is of low cardinality and can be effectively used
+	// for grouping and aggregation.
+	MessagingDestinationTemplateKey = attribute.Key("messaging.destination.template")
+
+	// MessagingDestinationTemporaryKey is the attribute Key conforming to the
+	// "messaging.destination.temporary" semantic conventions. It represents a
+	// boolean that is true if the message destination is temporary and might
+	// not exist anymore after messages are processed.
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingDestinationTemporaryKey = attribute.Key("messaging.destination.temporary")
+
+	// MessagingDestinationAnonymousKey is the attribute Key conforming to the
+	// "messaging.destination.anonymous" semantic conventions. It represents a
+	// boolean that is true if the message destination is anonymous (could be
+	// unnamed or have auto-generated name).
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingDestinationAnonymousKey = attribute.Key("messaging.destination.anonymous")
+)
+
+var (
+	// A message sent to a queue
+	MessagingDestinationKindQueue = MessagingDestinationKindKey.String("queue")
+	// A message sent to a topic
+	MessagingDestinationKindTopic = MessagingDestinationKindKey.String("topic")
+)
+
+// MessagingDestinationName returns an attribute KeyValue conforming to the
+// "messaging.destination.name" semantic conventions. It represents the message
+// destination name
+func MessagingDestinationName(val string) attribute.KeyValue {
+	return MessagingDestinationNameKey.String(val)
+}
+
+// MessagingDestinationTemplate returns an attribute KeyValue conforming to
+// the "messaging.destination.template" semantic conventions. It represents the
+// low cardinality representation of the messaging destination name
+func MessagingDestinationTemplate(val string) attribute.KeyValue {
+	return MessagingDestinationTemplateKey.String(val)
+}
+
+// MessagingDestinationTemporary returns an attribute KeyValue conforming to
+// the "messaging.destination.temporary" semantic conventions. It represents a
+// boolean that is true if the message destination is temporary and might not
+// exist anymore after messages are processed.
+func MessagingDestinationTemporary(val bool) attribute.KeyValue {
+	return MessagingDestinationTemporaryKey.Bool(val)
+}
+
+// MessagingDestinationAnonymous returns an attribute KeyValue conforming to
+// the "messaging.destination.anonymous" semantic conventions. It represents a
+// boolean that is true if the message destination is anonymous (could be
+// unnamed or have auto-generated name).
+func MessagingDestinationAnonymous(val bool) attribute.KeyValue {
+	return MessagingDestinationAnonymousKey.Bool(val)
+}
+
+// Semantic convention for attributes that describe messaging source on broker
+const (
+	// MessagingSourceNameKey is the attribute Key conforming to the
+	// "messaging.source.name" semantic conventions. It represents the message
+	// source name
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'MyQueue', 'MyTopic'
+	// Note: Source name SHOULD uniquely identify a specific queue, topic, or
+	// other entity within the broker. If
+	// the broker does not have such notion, the source name SHOULD uniquely
+	// identify the broker.
+	MessagingSourceNameKey = attribute.Key("messaging.source.name")
+
+	// MessagingSourceKindKey is the attribute Key conforming to the
+	// "messaging.source.kind" semantic conventions. It represents the kind of
+	// message source
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingSourceKindKey = attribute.Key("messaging.source.kind")
+
+	// MessagingSourceTemplateKey is the attribute Key conforming to the
+	// "messaging.source.template" semantic conventions. It represents the low
+	// cardinality representation of the messaging source name
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '/customers/{customerID}'
+	// Note: Source names could be constructed from templates. An example would
+	// be a source name involving a user name or product id. Although the
+	// source name in this case is of high cardinality, the underlying template
+	// is of low cardinality and can be effectively used for grouping and
+	// aggregation.
+	MessagingSourceTemplateKey = attribute.Key("messaging.source.template")
+
+	// MessagingSourceTemporaryKey is the attribute Key conforming to the
+	// "messaging.source.temporary" semantic conventions. It represents a
+	// boolean that is true if the message source is temporary and might not
+	// exist anymore after messages are processed.
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingSourceTemporaryKey = attribute.Key("messaging.source.temporary")
+
+	// MessagingSourceAnonymousKey is the attribute Key conforming to the
+	// "messaging.source.anonymous" semantic conventions. It represents a
+	// boolean that is true if the message source is anonymous (could be
+	// unnamed or have auto-generated name).
+	//
+	// Type: boolean
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingSourceAnonymousKey = attribute.Key("messaging.source.anonymous")
+)
+
+var (
+	// A message received from a queue
+	MessagingSourceKindQueue = MessagingSourceKindKey.String("queue")
+	// A message received from a topic
+	MessagingSourceKindTopic = MessagingSourceKindKey.String("topic")
+)
+
+// MessagingSourceName returns an attribute KeyValue conforming to the
+// "messaging.source.name" semantic conventions. It represents the message
+// source name
+func MessagingSourceName(val string) attribute.KeyValue {
+	return MessagingSourceNameKey.String(val)
+}
+
+// MessagingSourceTemplate returns an attribute KeyValue conforming to the
+// "messaging.source.template" semantic conventions. It represents the low
+// cardinality representation of the messaging source name
+func MessagingSourceTemplate(val string) attribute.KeyValue {
+	return MessagingSourceTemplateKey.String(val)
+}
+
+// MessagingSourceTemporary returns an attribute KeyValue conforming to the
+// "messaging.source.temporary" semantic conventions. It represents a boolean
+// that is true if the message source is temporary and might not exist anymore
+// after messages are processed.
+func MessagingSourceTemporary(val bool) attribute.KeyValue {
+	return MessagingSourceTemporaryKey.Bool(val)
+}
+
+// MessagingSourceAnonymous returns an attribute KeyValue conforming to the
+// "messaging.source.anonymous" semantic conventions. It represents a boolean
+// that is true if the message source is anonymous (could be unnamed or have
+// auto-generated name).
+func MessagingSourceAnonymous(val bool) attribute.KeyValue {
+	return MessagingSourceAnonymousKey.Bool(val)
+}
+
+// General attributes used in messaging systems.
+const (
+	// MessagingSystemKey is the attribute Key conforming to the
+	// "messaging.system" semantic conventions. It represents a string
+	// identifying the messaging system.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'kafka', 'rabbitmq', 'rocketmq', 'activemq', 'AmazonSQS'
+	MessagingSystemKey = attribute.Key("messaging.system")
+
+	// MessagingOperationKey is the attribute Key conforming to the
+	// "messaging.operation" semantic conventions. It represents a string
+	// identifying the kind of messaging operation as defined in the [Operation
+	// names](#operation-names) section above.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	// Note: If a custom value is used, it MUST be of low cardinality.
+	MessagingOperationKey = attribute.Key("messaging.operation")
+
+	// MessagingBatchMessageCountKey is the attribute Key conforming to the
+	// "messaging.batch.message_count" semantic conventions. It represents the
+	// number of messages sent, received, or processed in the scope of the
+	// batching operation.
+	//
+	// Type: int
+	// RequirementLevel: ConditionallyRequired (If the span describes an
+	// operation on a batch of messages.)
+	// Stability: stable
+	// Examples: 0, 1, 2
+	// Note: Instrumentations SHOULD NOT set `messaging.batch.message_count` on
+	// spans that operate with a single message. When a messaging client
+	// library supports both batch and single-message API for the same
+	// operation, instrumentations SHOULD use `messaging.batch.message_count`
+	// for batching APIs and SHOULD NOT use it for single-message APIs.
+	MessagingBatchMessageCountKey = attribute.Key("messaging.batch.message_count")
+)
+
+var (
+	// publish
+	MessagingOperationPublish = MessagingOperationKey.String("publish")
+	// receive
+	MessagingOperationReceive = MessagingOperationKey.String("receive")
+	// process
+	MessagingOperationProcess = MessagingOperationKey.String("process")
+)
+
+// MessagingSystem returns an attribute KeyValue conforming to the
+// "messaging.system" semantic conventions. It represents a string identifying
+// the messaging system.
+func MessagingSystem(val string) attribute.KeyValue {
+	return MessagingSystemKey.String(val)
+}
+
+// MessagingBatchMessageCount returns an attribute KeyValue conforming to
+// the "messaging.batch.message_count" semantic conventions. It represents the
+// number of messages sent, received, or processed in the scope of the batching
+// operation.
+func MessagingBatchMessageCount(val int) attribute.KeyValue {
+	return MessagingBatchMessageCountKey.Int(val)
+}
+
+// Semantic convention for a consumer of messages received from a messaging
+// system
+const (
+	// MessagingConsumerIDKey is the attribute Key conforming to the
+	// "messaging.consumer.id" semantic conventions. It represents the
+	// identifier for the consumer receiving a message. For Kafka, set it to
+	// `{messaging.kafka.consumer.group} - {messaging.kafka.client_id}`, if
+	// both are present, or only `messaging.kafka.consumer.group`. For brokers,
+	// such as RabbitMQ and Artemis, set it to the `client_id` of the client
+	// consuming the message.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'mygroup - client-6'
+	MessagingConsumerIDKey = attribute.Key("messaging.consumer.id")
+)
+
+// MessagingConsumerID returns an attribute KeyValue conforming to the
+// "messaging.consumer.id" semantic conventions. It represents the identifier
+// for the consumer receiving a message. For Kafka, set it to
+// `{messaging.kafka.consumer.group} - {messaging.kafka.client_id}`, if both
+// are present, or only `messaging.kafka.consumer.group`. For brokers, such as
+// RabbitMQ and Artemis, set it to the `client_id` of the client consuming the
+// message.
+func MessagingConsumerID(val string) attribute.KeyValue {
+	return MessagingConsumerIDKey.String(val)
+}
+
+// Attributes for RabbitMQ
+const (
+	// MessagingRabbitmqDestinationRoutingKeyKey is the attribute Key
+	// conforming to the "messaging.rabbitmq.destination.routing_key" semantic
+	// conventions. It represents the rabbitMQ message routing key.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If not empty.)
+	// Stability: stable
+	// Examples: 'myKey'
+	MessagingRabbitmqDestinationRoutingKeyKey = attribute.Key("messaging.rabbitmq.destination.routing_key")
+)
+
+// MessagingRabbitmqDestinationRoutingKey returns an attribute KeyValue
+// conforming to the "messaging.rabbitmq.destination.routing_key" semantic
+// conventions. It represents the rabbitMQ message routing key.
+func MessagingRabbitmqDestinationRoutingKey(val string) attribute.KeyValue {
+	return MessagingRabbitmqDestinationRoutingKeyKey.String(val)
+}
+
+// Attributes for Apache Kafka
+const (
+	// MessagingKafkaMessageKeyKey is the attribute Key conforming to the
+	// "messaging.kafka.message.key" semantic conventions. It represents the
+	// message keys in Kafka are used for grouping alike messages to ensure
+	// they're processed on the same partition. They differ from
+	// `messaging.message.id` in that they're not unique. If the key is `null`,
+	// the attribute MUST NOT be set.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'myKey'
+	// Note: If the key type is not string, it's string representation has to
+	// be supplied for the attribute. If the key has no unambiguous, canonical
+	// string form, don't include its value.
+	MessagingKafkaMessageKeyKey = attribute.Key("messaging.kafka.message.key")
+
+	// MessagingKafkaConsumerGroupKey is the attribute Key conforming to the
+	// "messaging.kafka.consumer.group" semantic conventions. It represents the
+	// name of the Kafka Consumer Group that is handling the message. Only
+	// applies to consumers, not producers.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'my-group'
+	MessagingKafkaConsumerGroupKey = attribute.Key("messaging.kafka.consumer.group")
+
+	// MessagingKafkaClientIDKey is the attribute Key conforming to the
+	// "messaging.kafka.client_id" semantic conventions. It represents the
+	// client ID for the Consumer or Producer that is handling the message.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'client-5'
+	MessagingKafkaClientIDKey = attribute.Key("messaging.kafka.client_id")
+
+	// MessagingKafkaDestinationPartitionKey is the attribute Key conforming to
+	// the "messaging.kafka.destination.partition" semantic conventions. It
+	// represents the partition the message is sent to.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 2
+	MessagingKafkaDestinationPartitionKey = attribute.Key("messaging.kafka.destination.partition")
+
+	// MessagingKafkaSourcePartitionKey is the attribute Key conforming to the
+	// "messaging.kafka.source.partition" semantic conventions. It represents
+	// the partition the message is received from.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 2
+	MessagingKafkaSourcePartitionKey = attribute.Key("messaging.kafka.source.partition")
+
+	// MessagingKafkaMessageOffsetKey is the attribute Key conforming to the
+	// "messaging.kafka.message.offset" semantic conventions. It represents the
+	// offset of a record in the corresponding Kafka partition.
+	//
+	// Type: int
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 42
+	MessagingKafkaMessageOffsetKey = attribute.Key("messaging.kafka.message.offset")
+
+	// MessagingKafkaMessageTombstoneKey is the attribute Key conforming to the
+	// "messaging.kafka.message.tombstone" semantic conventions. It represents
+	// a boolean that is true if the message is a tombstone.
+	//
+	// Type: boolean
+	// RequirementLevel: ConditionallyRequired (If value is `true`. When
+	// missing, the value is assumed to be `false`.)
+	// Stability: stable
+	MessagingKafkaMessageTombstoneKey = attribute.Key("messaging.kafka.message.tombstone")
+)
+
+// MessagingKafkaMessageKey returns an attribute KeyValue conforming to the
+// "messaging.kafka.message.key" semantic conventions. It represents the
+// message keys in Kafka are used for grouping alike messages to ensure they're
+// processed on the same partition. They differ from `messaging.message.id` in
+// that they're not unique. If the key is `null`, the attribute MUST NOT be
+// set.
+func MessagingKafkaMessageKey(val string) attribute.KeyValue {
+	return MessagingKafkaMessageKeyKey.String(val)
+}
+
+// MessagingKafkaConsumerGroup returns an attribute KeyValue conforming to
+// the "messaging.kafka.consumer.group" semantic conventions. It represents the
+// name of the Kafka Consumer Group that is handling the message. Only applies
+// to consumers, not producers.
+func MessagingKafkaConsumerGroup(val string) attribute.KeyValue {
+	return MessagingKafkaConsumerGroupKey.String(val)
+}
+
+// MessagingKafkaClientID returns an attribute KeyValue conforming to the
+// "messaging.kafka.client_id" semantic conventions. It represents the client
+// ID for the Consumer or Producer that is handling the message.
+func MessagingKafkaClientID(val string) attribute.KeyValue {
+	return MessagingKafkaClientIDKey.String(val)
+}
+
+// MessagingKafkaDestinationPartition returns an attribute KeyValue
+// conforming to the "messaging.kafka.destination.partition" semantic
+// conventions. It represents the partition the message is sent to.
+func MessagingKafkaDestinationPartition(val int) attribute.KeyValue {
+	return MessagingKafkaDestinationPartitionKey.Int(val)
+}
+
+// MessagingKafkaSourcePartition returns an attribute KeyValue conforming to
+// the "messaging.kafka.source.partition" semantic conventions. It represents
+// the partition the message is received from.
+func MessagingKafkaSourcePartition(val int) attribute.KeyValue {
+	return MessagingKafkaSourcePartitionKey.Int(val)
+}
+
+// MessagingKafkaMessageOffset returns an attribute KeyValue conforming to
+// the "messaging.kafka.message.offset" semantic conventions. It represents the
+// offset of a record in the corresponding Kafka partition.
+func MessagingKafkaMessageOffset(val int) attribute.KeyValue {
+	return MessagingKafkaMessageOffsetKey.Int(val)
+}
+
+// MessagingKafkaMessageTombstone returns an attribute KeyValue conforming
+// to the "messaging.kafka.message.tombstone" semantic conventions. It
+// represents a boolean that is true if the message is a tombstone.
+func MessagingKafkaMessageTombstone(val bool) attribute.KeyValue {
+	return MessagingKafkaMessageTombstoneKey.Bool(val)
+}
+
+// Attributes for Apache RocketMQ
+const (
+	// MessagingRocketmqNamespaceKey is the attribute Key conforming to the
+	// "messaging.rocketmq.namespace" semantic conventions. It represents the
+	// namespace of RocketMQ resources, resources in different namespaces are
+	// individual.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'myNamespace'
+	MessagingRocketmqNamespaceKey = attribute.Key("messaging.rocketmq.namespace")
+
+	// MessagingRocketmqClientGroupKey is the attribute Key conforming to the
+	// "messaging.rocketmq.client_group" semantic conventions. It represents
+	// the name of the RocketMQ producer/consumer group that is handling the
+	// message. The client type is identified by the SpanKind.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'myConsumerGroup'
+	MessagingRocketmqClientGroupKey = attribute.Key("messaging.rocketmq.client_group")
+
+	// MessagingRocketmqClientIDKey is the attribute Key conforming to the
+	// "messaging.rocketmq.client_id" semantic conventions. It represents the
+	// unique identifier for each client.
+	//
+	// Type: string
+	// RequirementLevel: Required
+	// Stability: stable
+	// Examples: 'myhost@8742@s8083jm'
+	MessagingRocketmqClientIDKey = attribute.Key("messaging.rocketmq.client_id")
+
+	// MessagingRocketmqMessageDeliveryTimestampKey is the attribute Key
+	// conforming to the "messaging.rocketmq.message.delivery_timestamp"
+	// semantic conventions. It represents the timestamp in milliseconds that
+	// the delay message is expected to be delivered to consumer.
+	//
+	// Type: int
+	// RequirementLevel: ConditionallyRequired (If the message type is delay
+	// and delay time level is not specified.)
+	// Stability: stable
+	// Examples: 1665987217045
+	MessagingRocketmqMessageDeliveryTimestampKey = attribute.Key("messaging.rocketmq.message.delivery_timestamp")
+
+	// MessagingRocketmqMessageDelayTimeLevelKey is the attribute Key
+	// conforming to the "messaging.rocketmq.message.delay_time_level" semantic
+	// conventions. It represents the delay time level for delay message, which
+	// determines the message delay time.
+	//
+	// Type: int
+	// RequirementLevel: ConditionallyRequired (If the message type is delay
+	// and delivery timestamp is not specified.)
+	// Stability: stable
+	// Examples: 3
+	MessagingRocketmqMessageDelayTimeLevelKey = attribute.Key("messaging.rocketmq.message.delay_time_level")
+
+	// MessagingRocketmqMessageGroupKey is the attribute Key conforming to the
+	// "messaging.rocketmq.message.group" semantic conventions. It represents
+	// the it is essential for FIFO message. Messages that belong to the same
+	// message group are always processed one by one within the same consumer
+	// group.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If the message type is FIFO.)
+	// Stability: stable
+	// Examples: 'myMessageGroup'
+	MessagingRocketmqMessageGroupKey = attribute.Key("messaging.rocketmq.message.group")
+
+	// MessagingRocketmqMessageTypeKey is the attribute Key conforming to the
+	// "messaging.rocketmq.message.type" semantic conventions. It represents
+	// the type of message.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingRocketmqMessageTypeKey = attribute.Key("messaging.rocketmq.message.type")
+
+	// MessagingRocketmqMessageTagKey is the attribute Key conforming to the
+	// "messaging.rocketmq.message.tag" semantic conventions. It represents the
+	// secondary classifier of message besides topic.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'tagA'
+	MessagingRocketmqMessageTagKey = attribute.Key("messaging.rocketmq.message.tag")
+
+	// MessagingRocketmqMessageKeysKey is the attribute Key conforming to the
+	// "messaging.rocketmq.message.keys" semantic conventions. It represents
+	// the key(s) of message, another way to mark message besides message id.
+	//
+	// Type: string[]
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'keyA', 'keyB'
+	MessagingRocketmqMessageKeysKey = attribute.Key("messaging.rocketmq.message.keys")
+
+	// MessagingRocketmqConsumptionModelKey is the attribute Key conforming to
+	// the "messaging.rocketmq.consumption_model" semantic conventions. It
+	// represents the model of message consumption. This only applies to
+	// consumer spans.
+	//
+	// Type: Enum
+	// RequirementLevel: Optional
+	// Stability: stable
+	MessagingRocketmqConsumptionModelKey = attribute.Key("messaging.rocketmq.consumption_model")
+)
+
+var (
+	// Normal message
+	MessagingRocketmqMessageTypeNormal = MessagingRocketmqMessageTypeKey.String("normal")
+	// FIFO message
+	MessagingRocketmqMessageTypeFifo = MessagingRocketmqMessageTypeKey.String("fifo")
+	// Delay message
+	MessagingRocketmqMessageTypeDelay = MessagingRocketmqMessageTypeKey.String("delay")
+	// Transaction message
+	MessagingRocketmqMessageTypeTransaction = MessagingRocketmqMessageTypeKey.String("transaction")
+)
+
+var (
+	// Clustering consumption model
+	MessagingRocketmqConsumptionModelClustering = MessagingRocketmqConsumptionModelKey.String("clustering")
+	// Broadcasting consumption model
+	MessagingRocketmqConsumptionModelBroadcasting = MessagingRocketmqConsumptionModelKey.String("broadcasting")
+)
+
+// MessagingRocketmqNamespace returns an attribute KeyValue conforming to
+// the "messaging.rocketmq.namespace" semantic conventions. It represents the
+// namespace of RocketMQ resources, resources in different namespaces are
+// individual.
+func MessagingRocketmqNamespace(val string) attribute.KeyValue {
+	return MessagingRocketmqNamespaceKey.String(val)
+}
+
+// MessagingRocketmqClientGroup returns an attribute KeyValue conforming to
+// the "messaging.rocketmq.client_group" semantic conventions. It represents
+// the name of the RocketMQ producer/consumer group that is handling the
+// message. The client type is identified by the SpanKind.
+func MessagingRocketmqClientGroup(val string) attribute.KeyValue {
+	return MessagingRocketmqClientGroupKey.String(val)
+}
+
+// MessagingRocketmqClientID returns an attribute KeyValue conforming to the
+// "messaging.rocketmq.client_id" semantic conventions. It represents the
+// unique identifier for each client.
+func MessagingRocketmqClientID(val string) attribute.KeyValue {
+	return MessagingRocketmqClientIDKey.String(val)
+}
+
+// MessagingRocketmqMessageDeliveryTimestamp returns an attribute KeyValue
+// conforming to the "messaging.rocketmq.message.delivery_timestamp" semantic
+// conventions. It represents the timestamp in milliseconds that the delay
+// message is expected to be delivered to consumer.
+func MessagingRocketmqMessageDeliveryTimestamp(val int) attribute.KeyValue {
+	return MessagingRocketmqMessageDeliveryTimestampKey.Int(val)
+}
+
+// MessagingRocketmqMessageDelayTimeLevel returns an attribute KeyValue
+// conforming to the "messaging.rocketmq.message.delay_time_level" semantic
+// conventions. It represents the delay time level for delay message, which
+// determines the message delay time.
+func MessagingRocketmqMessageDelayTimeLevel(val int) attribute.KeyValue {
+	return MessagingRocketmqMessageDelayTimeLevelKey.Int(val)
+}
+
+// MessagingRocketmqMessageGroup returns an attribute KeyValue conforming to
+// the "messaging.rocketmq.message.group" semantic conventions. It represents
+// the it is essential for FIFO message. Messages that belong to the same
+// message group are always processed one by one within the same consumer
+// group.
+func MessagingRocketmqMessageGroup(val string) attribute.KeyValue {
+	return MessagingRocketmqMessageGroupKey.String(val)
+}
+
+// MessagingRocketmqMessageTag returns an attribute KeyValue conforming to
+// the "messaging.rocketmq.message.tag" semantic conventions. It represents the
+// secondary classifier of message besides topic.
+func MessagingRocketmqMessageTag(val string) attribute.KeyValue {
+	return MessagingRocketmqMessageTagKey.String(val)
+}
+
+// MessagingRocketmqMessageKeys returns an attribute KeyValue conforming to
+// the "messaging.rocketmq.message.keys" semantic conventions. It represents
+// the key(s) of message, another way to mark message besides message id.
+func MessagingRocketmqMessageKeys(val ...string) attribute.KeyValue {
+	return MessagingRocketmqMessageKeysKey.StringSlice(val)
+}
+
+// Semantic conventions for remote procedure calls.
+const (
+	// RPCSystemKey is the attribute Key conforming to the "rpc.system"
+	// semantic conventions. It represents a string identifying the remoting
+	// system. See below for a list of well-known identifiers.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	RPCSystemKey = attribute.Key("rpc.system")
+
+	// RPCServiceKey is the attribute Key conforming to the "rpc.service"
+	// semantic conventions. It represents the full (logical) name of the
+	// service being called, including its package name, if applicable.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: stable
+	// Examples: 'myservice.EchoService'
+	// Note: This is the logical name of the service from the RPC interface
+	// perspective, which can be different from the name of any implementing
+	// class. The `code.namespace` attribute may be used to store the latter
+	// (despite the attribute name, it may include a class name; e.g., class
+	// with method actually executing the call on the server side, RPC client
+	// stub class on the client side).
+	RPCServiceKey = attribute.Key("rpc.service")
+
+	// RPCMethodKey is the attribute Key conforming to the "rpc.method"
+	// semantic conventions. It represents the name of the (logical) method
+	// being called, must be equal to the $method part in the span name.
+	//
+	// Type: string
+	// RequirementLevel: Recommended
+	// Stability: stable
+	// Examples: 'exampleMethod'
+	// Note: This is the logical name of the method from the RPC interface
+	// perspective, which can be different from the name of any implementing
+	// method/function. The `code.function` attribute may be used to store the
+	// latter (e.g., method actually executing the call on the server side, RPC
+	// client stub method on the client side).
+	RPCMethodKey = attribute.Key("rpc.method")
+)
+
+var (
+	// gRPC
+	RPCSystemGRPC = RPCSystemKey.String("grpc")
+	// Java RMI
+	RPCSystemJavaRmi = RPCSystemKey.String("java_rmi")
+	// .NET WCF
+	RPCSystemDotnetWcf = RPCSystemKey.String("dotnet_wcf")
+	// Apache Dubbo
+	RPCSystemApacheDubbo = RPCSystemKey.String("apache_dubbo")
+)
+
+// RPCService returns an attribute KeyValue conforming to the "rpc.service"
+// semantic conventions. It represents the full (logical) name of the service
+// being called, including its package name, if applicable.
+func RPCService(val string) attribute.KeyValue {
+	return RPCServiceKey.String(val)
+}
+
+// RPCMethod returns an attribute KeyValue conforming to the "rpc.method"
+// semantic conventions. It represents the name of the (logical) method being
+// called, must be equal to the $method part in the span name.
+func RPCMethod(val string) attribute.KeyValue {
+	return RPCMethodKey.String(val)
+}
+
+// Tech-specific attributes for gRPC.
+const (
+	// RPCGRPCStatusCodeKey is the attribute Key conforming to the
+	// "rpc.grpc.status_code" semantic conventions. It represents the [numeric
+	// status
+	// code](https://github.com/grpc/grpc/blob/v1.33.2/doc/statuscodes.md) of
+	// the gRPC request.
+	//
+	// Type: Enum
+	// RequirementLevel: Required
+	// Stability: stable
+	RPCGRPCStatusCodeKey = attribute.Key("rpc.grpc.status_code")
+)
+
+var (
+	// OK
+	RPCGRPCStatusCodeOk = RPCGRPCStatusCodeKey.Int(0)
+	// CANCELLED
+	RPCGRPCStatusCodeCancelled = RPCGRPCStatusCodeKey.Int(1)
+	// UNKNOWN
+	RPCGRPCStatusCodeUnknown = RPCGRPCStatusCodeKey.Int(2)
+	// INVALID_ARGUMENT
+	RPCGRPCStatusCodeInvalidArgument = RPCGRPCStatusCodeKey.Int(3)
+	// DEADLINE_EXCEEDED
+	RPCGRPCStatusCodeDeadlineExceeded = RPCGRPCStatusCodeKey.Int(4)
+	// NOT_FOUND
+	RPCGRPCStatusCodeNotFound = RPCGRPCStatusCodeKey.Int(5)
+	// ALREADY_EXISTS
+	RPCGRPCStatusCodeAlreadyExists = RPCGRPCStatusCodeKey.Int(6)
+	// PERMISSION_DENIED
+	RPCGRPCStatusCodePermissionDenied = RPCGRPCStatusCodeKey.Int(7)
+	// RESOURCE_EXHAUSTED
+	RPCGRPCStatusCodeResourceExhausted = RPCGRPCStatusCodeKey.Int(8)
+	// FAILED_PRECONDITION
+	RPCGRPCStatusCodeFailedPrecondition = RPCGRPCStatusCodeKey.Int(9)
+	// ABORTED
+	RPCGRPCStatusCodeAborted = RPCGRPCStatusCodeKey.Int(10)
+	// OUT_OF_RANGE
+	RPCGRPCStatusCodeOutOfRange = RPCGRPCStatusCodeKey.Int(11)
+	// UNIMPLEMENTED
+	RPCGRPCStatusCodeUnimplemented = RPCGRPCStatusCodeKey.Int(12)
+	// INTERNAL
+	RPCGRPCStatusCodeInternal = RPCGRPCStatusCodeKey.Int(13)
+	// UNAVAILABLE
+	RPCGRPCStatusCodeUnavailable = RPCGRPCStatusCodeKey.Int(14)
+	// DATA_LOSS
+	RPCGRPCStatusCodeDataLoss = RPCGRPCStatusCodeKey.Int(15)
+	// UNAUTHENTICATED
+	RPCGRPCStatusCodeUnauthenticated = RPCGRPCStatusCodeKey.Int(16)
+)
+
+// Tech-specific attributes for [JSON RPC](https://www.jsonrpc.org/).
+const (
+	// RPCJsonrpcVersionKey is the attribute Key conforming to the
+	// "rpc.jsonrpc.version" semantic conventions. It represents the protocol
+	// version as in `jsonrpc` property of request/response. Since JSON-RPC 1.0
+	// does not specify this, the value can be omitted.
+	//
+	// Type: string
+	// RequirementLevel: ConditionallyRequired (If other than the default
+	// version (`1.0`))
+	// Stability: stable
+	// Examples: '2.0', '1.0'
+	RPCJsonrpcVersionKey = attribute.Key("rpc.jsonrpc.version")
+
+	// RPCJsonrpcRequestIDKey is the attribute Key conforming to the
+	// "rpc.jsonrpc.request_id" semantic conventions. It represents the `id`
+	// property of request or response. Since protocol allows id to be int,
+	// string, `null` or missing (for notifications), value is expected to be
+	// cast to string for simplicity. Use empty string in case of `null` value.
+	// Omit entirely if this is a notification.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: '10', 'request-7', ''
+	RPCJsonrpcRequestIDKey = attribute.Key("rpc.jsonrpc.request_id")
+
+	// RPCJsonrpcErrorCodeKey is the attribute Key conforming to the
+	// "rpc.jsonrpc.error_code" semantic conventions. It represents the
+	// `error.code` property of response if it is an error response.
+	//
+	// Type: int
+	// RequirementLevel: ConditionallyRequired (If response is not successful.)
+	// Stability: stable
+	// Examples: -32700, 100
+	RPCJsonrpcErrorCodeKey = attribute.Key("rpc.jsonrpc.error_code")
+
+	// RPCJsonrpcErrorMessageKey is the attribute Key conforming to the
+	// "rpc.jsonrpc.error_message" semantic conventions. It represents the
+	// `error.message` property of response if it is an error response.
+	//
+	// Type: string
+	// RequirementLevel: Optional
+	// Stability: stable
+	// Examples: 'Parse error', 'User already exists'
+	RPCJsonrpcErrorMessageKey = attribute.Key("rpc.jsonrpc.error_message")
+)
+
+// RPCJsonrpcVersion returns an attribute KeyValue conforming to the
+// "rpc.jsonrpc.version" semantic conventions. It represents the protocol
+// version as in `jsonrpc` property of request/response. Since JSON-RPC 1.0
+// does not specify this, the value can be omitted.
+func RPCJsonrpcVersion(val string) attribute.KeyValue {
+	return RPCJsonrpcVersionKey.String(val)
+}
+
+// RPCJsonrpcRequestID returns an attribute KeyValue conforming to the
+// "rpc.jsonrpc.request_id" semantic conventions. It represents the `id`
+// property of request or response. Since protocol allows id to be int, string,
+// `null` or missing (for notifications), value is expected to be cast to
+// string for simplicity. Use empty string in case of `null` value. Omit
+// entirely if this is a notification.
+func RPCJsonrpcRequestID(val string) attribute.KeyValue {
+	return RPCJsonrpcRequestIDKey.String(val)
+}
+
+// RPCJsonrpcErrorCode returns an attribute KeyValue conforming to the
+// "rpc.jsonrpc.error_code" semantic conventions. It represents the
+// `error.code` property of response if it is an error response.
+func RPCJsonrpcErrorCode(val int) attribute.KeyValue {
+	return RPCJsonrpcErrorCodeKey.Int(val)
+}
+
+// RPCJsonrpcErrorMessage returns an attribute KeyValue conforming to the
+// "rpc.jsonrpc.error_message" semantic conventions. It represents the
+// `error.message` property of response if it is an error response.
+func RPCJsonrpcErrorMessage(val string) attribute.KeyValue {
+	return RPCJsonrpcErrorMessageKey.String(val)
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/doc.go b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/doc.go
new file mode 100644
index 0000000000..ba878d1cf6
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/doc.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package semconv implements OpenTelemetry semantic conventions.
+//
+// OpenTelemetry semantic conventions are agreed standardized naming
+// patterns for OpenTelemetry things. This package represents the conventions
+// as of the v1.7.0 version of the OpenTelemetry specification.
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.7.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/exception.go b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/exception.go
new file mode 100644
index 0000000000..ea37068627
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/exception.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.7.0"
+
+const (
+	// ExceptionEventName is the name of the Span event representing an exception.
+	ExceptionEventName = "exception"
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/http.go b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/http.go
new file mode 100644
index 0000000000..945c95a18a
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/http.go
@@ -0,0 +1,114 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.7.0"
+
+import (
+	"net/http"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/semconv/internal"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// HTTP scheme attributes.
+var (
+	HTTPSchemeHTTP  = HTTPSchemeKey.String("http")
+	HTTPSchemeHTTPS = HTTPSchemeKey.String("https")
+)
+
+var sc = &internal.SemanticConventions{
+	EnduserIDKey:                EnduserIDKey,
+	HTTPClientIPKey:             HTTPClientIPKey,
+	HTTPFlavorKey:               HTTPFlavorKey,
+	HTTPHostKey:                 HTTPHostKey,
+	HTTPMethodKey:               HTTPMethodKey,
+	HTTPRequestContentLengthKey: HTTPRequestContentLengthKey,
+	HTTPRouteKey:                HTTPRouteKey,
+	HTTPSchemeHTTP:              HTTPSchemeHTTP,
+	HTTPSchemeHTTPS:             HTTPSchemeHTTPS,
+	HTTPServerNameKey:           HTTPServerNameKey,
+	HTTPStatusCodeKey:           HTTPStatusCodeKey,
+	HTTPTargetKey:               HTTPTargetKey,
+	HTTPURLKey:                  HTTPURLKey,
+	HTTPUserAgentKey:            HTTPUserAgentKey,
+	NetHostIPKey:                NetHostIPKey,
+	NetHostNameKey:              NetHostNameKey,
+	NetHostPortKey:              NetHostPortKey,
+	NetPeerIPKey:                NetPeerIPKey,
+	NetPeerNameKey:              NetPeerNameKey,
+	NetPeerPortKey:              NetPeerPortKey,
+	NetTransportIP:              NetTransportIP,
+	NetTransportOther:           NetTransportOther,
+	NetTransportTCP:             NetTransportTCP,
+	NetTransportUDP:             NetTransportUDP,
+	NetTransportUnix:            NetTransportUnix,
+}
+
+// NetAttributesFromHTTPRequest generates attributes of the net
+// namespace as specified by the OpenTelemetry specification for a
+// span.  The network parameter is a string that net.Dial function
+// from standard library can understand.
+func NetAttributesFromHTTPRequest(network string, request *http.Request) []attribute.KeyValue {
+	return sc.NetAttributesFromHTTPRequest(network, request)
+}
+
+// EndUserAttributesFromHTTPRequest generates attributes of the
+// enduser namespace as specified by the OpenTelemetry specification
+// for a span.
+func EndUserAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	return sc.EndUserAttributesFromHTTPRequest(request)
+}
+
+// HTTPClientAttributesFromHTTPRequest generates attributes of the
+// http namespace as specified by the OpenTelemetry specification for
+// a span on the client side.
+func HTTPClientAttributesFromHTTPRequest(request *http.Request) []attribute.KeyValue {
+	return sc.HTTPClientAttributesFromHTTPRequest(request)
+}
+
+// HTTPServerMetricAttributesFromHTTPRequest generates low-cardinality attributes
+// to be used with server-side HTTP metrics.
+func HTTPServerMetricAttributesFromHTTPRequest(serverName string, request *http.Request) []attribute.KeyValue {
+	return sc.HTTPServerMetricAttributesFromHTTPRequest(serverName, request)
+}
+
+// HTTPServerAttributesFromHTTPRequest generates attributes of the
+// http namespace as specified by the OpenTelemetry specification for
+// a span on the server side. Currently, only basic authentication is
+// supported.
+func HTTPServerAttributesFromHTTPRequest(serverName, route string, request *http.Request) []attribute.KeyValue {
+	return sc.HTTPServerAttributesFromHTTPRequest(serverName, route, request)
+}
+
+// HTTPAttributesFromHTTPStatusCode generates attributes of the http
+// namespace as specified by the OpenTelemetry specification for a
+// span.
+func HTTPAttributesFromHTTPStatusCode(code int) []attribute.KeyValue {
+	return sc.HTTPAttributesFromHTTPStatusCode(code)
+}
+
+// SpanStatusFromHTTPStatusCode generates a status code and a message
+// as specified by the OpenTelemetry specification for a span.
+func SpanStatusFromHTTPStatusCode(code int) (codes.Code, string) {
+	return internal.SpanStatusFromHTTPStatusCode(code)
+}
+
+// SpanStatusFromHTTPStatusCodeAndSpanKind generates a status code and a message
+// as specified by the OpenTelemetry specification for a span.
+// Exclude 4xx for SERVER to set the appropriate status.
+func SpanStatusFromHTTPStatusCodeAndSpanKind(code int, spanKind trace.SpanKind) (codes.Code, string) {
+	return internal.SpanStatusFromHTTPStatusCodeAndSpanKind(code, spanKind)
+}
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/resource.go b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/resource.go
new file mode 100644
index 0000000000..aab6daf3c5
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/resource.go
@@ -0,0 +1,946 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.7.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// A cloud environment (e.g. GCP, Azure, AWS)
+const (
+	// Name of the cloud provider.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	CloudProviderKey = attribute.Key("cloud.provider")
+	// The cloud account ID the resource is assigned to.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '111111111111', 'opentelemetry'
+	CloudAccountIDKey = attribute.Key("cloud.account.id")
+	// The geographical region the resource is running. Refer to your provider's docs
+	// to see the available regions, for example [Alibaba Cloud
+	// regions](https://www.alibabacloud.com/help/doc-detail/40654.htm), [AWS
+	// regions](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/),
+	// [Azure regions](https://azure.microsoft.com/en-us/global-
+	// infrastructure/geographies/), or [Google Cloud
+	// regions](https://cloud.google.com/about/locations).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'us-central1', 'us-east-1'
+	CloudRegionKey = attribute.Key("cloud.region")
+	// Cloud regions often have multiple, isolated locations known as zones to
+	// increase availability. Availability zone represents the zone where the resource
+	// is running.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'us-east-1c'
+	// Note: Availability zones are called "zones" on Alibaba Cloud and Google Cloud.
+	CloudAvailabilityZoneKey = attribute.Key("cloud.availability_zone")
+	// The cloud platform in use.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Note: The prefix of the service SHOULD match the one specified in
+	// `cloud.provider`.
+	CloudPlatformKey = attribute.Key("cloud.platform")
+)
+
+var (
+	// Alibaba Cloud
+	CloudProviderAlibabaCloud = CloudProviderKey.String("alibaba_cloud")
+	// Amazon Web Services
+	CloudProviderAWS = CloudProviderKey.String("aws")
+	// Microsoft Azure
+	CloudProviderAzure = CloudProviderKey.String("azure")
+	// Google Cloud Platform
+	CloudProviderGCP = CloudProviderKey.String("gcp")
+)
+
+var (
+	// Alibaba Cloud Elastic Compute Service
+	CloudPlatformAlibabaCloudECS = CloudPlatformKey.String("alibaba_cloud_ecs")
+	// Alibaba Cloud Function Compute
+	CloudPlatformAlibabaCloudFc = CloudPlatformKey.String("alibaba_cloud_fc")
+	// AWS Elastic Compute Cloud
+	CloudPlatformAWSEC2 = CloudPlatformKey.String("aws_ec2")
+	// AWS Elastic Container Service
+	CloudPlatformAWSECS = CloudPlatformKey.String("aws_ecs")
+	// AWS Elastic Kubernetes Service
+	CloudPlatformAWSEKS = CloudPlatformKey.String("aws_eks")
+	// AWS Lambda
+	CloudPlatformAWSLambda = CloudPlatformKey.String("aws_lambda")
+	// AWS Elastic Beanstalk
+	CloudPlatformAWSElasticBeanstalk = CloudPlatformKey.String("aws_elastic_beanstalk")
+	// Azure Virtual Machines
+	CloudPlatformAzureVM = CloudPlatformKey.String("azure_vm")
+	// Azure Container Instances
+	CloudPlatformAzureContainerInstances = CloudPlatformKey.String("azure_container_instances")
+	// Azure Kubernetes Service
+	CloudPlatformAzureAKS = CloudPlatformKey.String("azure_aks")
+	// Azure Functions
+	CloudPlatformAzureFunctions = CloudPlatformKey.String("azure_functions")
+	// Azure App Service
+	CloudPlatformAzureAppService = CloudPlatformKey.String("azure_app_service")
+	// Google Cloud Compute Engine (GCE)
+	CloudPlatformGCPComputeEngine = CloudPlatformKey.String("gcp_compute_engine")
+	// Google Cloud Run
+	CloudPlatformGCPCloudRun = CloudPlatformKey.String("gcp_cloud_run")
+	// Google Cloud Kubernetes Engine (GKE)
+	CloudPlatformGCPKubernetesEngine = CloudPlatformKey.String("gcp_kubernetes_engine")
+	// Google Cloud Functions (GCF)
+	CloudPlatformGCPCloudFunctions = CloudPlatformKey.String("gcp_cloud_functions")
+	// Google Cloud App Engine (GAE)
+	CloudPlatformGCPAppEngine = CloudPlatformKey.String("gcp_app_engine")
+)
+
+// Resources used by AWS Elastic Container Service (ECS).
+const (
+	// The Amazon Resource Name (ARN) of an [ECS container instance](https://docs.aws.
+	// amazon.com/AmazonECS/latest/developerguide/ECS_instances.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-
+	// west-1:123456789123:container/32624152-9086-4f0e-acae-1a75b14fe4d9'
+	AWSECSContainerARNKey = attribute.Key("aws.ecs.container.arn")
+	// The ARN of an [ECS cluster](https://docs.aws.amazon.com/AmazonECS/latest/develo
+	// perguide/clusters.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-west-2:123456789123:cluster/my-cluster'
+	AWSECSClusterARNKey = attribute.Key("aws.ecs.cluster.arn")
+	// The [launch type](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/l
+	// aunch_types.html) for an ECS task.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	AWSECSLaunchtypeKey = attribute.Key("aws.ecs.launchtype")
+	// The ARN of an [ECS task definition](https://docs.aws.amazon.com/AmazonECS/lates
+	// t/developerguide/task_definitions.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-
+	// west-1:123456789123:task/10838bed-421f-43ef-870a-f43feacbbb5b'
+	AWSECSTaskARNKey = attribute.Key("aws.ecs.task.arn")
+	// The task definition family this task definition is a member of.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-family'
+	AWSECSTaskFamilyKey = attribute.Key("aws.ecs.task.family")
+	// The revision for this task definition.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '8', '26'
+	AWSECSTaskRevisionKey = attribute.Key("aws.ecs.task.revision")
+)
+
+var (
+	// ec2
+	AWSECSLaunchtypeEC2 = AWSECSLaunchtypeKey.String("ec2")
+	// fargate
+	AWSECSLaunchtypeFargate = AWSECSLaunchtypeKey.String("fargate")
+)
+
+// Resources used by AWS Elastic Kubernetes Service (EKS).
+const (
+	// The ARN of an EKS cluster.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:ecs:us-west-2:123456789123:cluster/my-cluster'
+	AWSEKSClusterARNKey = attribute.Key("aws.eks.cluster.arn")
+)
+
+// Resources specific to Amazon Web Services.
+const (
+	// The name(s) of the AWS log group(s) an application is writing to.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '/aws/lambda/my-function', 'opentelemetry-service'
+	// Note: Multiple log groups must be supported for cases like multi-container
+	// applications, where a single application has sidecar containers, and each write
+	// to their own log group.
+	AWSLogGroupNamesKey = attribute.Key("aws.log.group.names")
+	// The Amazon Resource Name(s) (ARN) of the AWS log group(s).
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:logs:us-west-1:123456789012:log-group:/aws/my/group:*'
+	// Note: See the [log group ARN format
+	// documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-
+	// access-control-overview-cwl.html#CWL_ARN_Format).
+	AWSLogGroupARNsKey = attribute.Key("aws.log.group.arns")
+	// The name(s) of the AWS log stream(s) an application is writing to.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'logs/main/10838bed-421f-43ef-870a-f43feacbbb5b'
+	AWSLogStreamNamesKey = attribute.Key("aws.log.stream.names")
+	// The ARN(s) of the AWS log stream(s).
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:logs:us-west-1:123456789012:log-group:/aws/my/group:log-
+	// stream:logs/main/10838bed-421f-43ef-870a-f43feacbbb5b'
+	// Note: See the [log stream ARN format
+	// documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-
+	// access-control-overview-cwl.html#CWL_ARN_Format). One log group can contain
+	// several log streams, so these ARNs necessarily identify both a log group and a
+	// log stream.
+	AWSLogStreamARNsKey = attribute.Key("aws.log.stream.arns")
+)
+
+// A container instance.
+const (
+	// Container name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-autoconf'
+	ContainerNameKey = attribute.Key("container.name")
+	// Container ID. Usually a UUID, as for example used to [identify Docker
+	// containers](https://docs.docker.com/engine/reference/run/#container-
+	// identification). The UUID might be abbreviated.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'a3bf90e006b2'
+	ContainerIDKey = attribute.Key("container.id")
+	// The container runtime managing this container.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'docker', 'containerd', 'rkt'
+	ContainerRuntimeKey = attribute.Key("container.runtime")
+	// Name of the image the container was built on.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'gcr.io/opentelemetry/operator'
+	ContainerImageNameKey = attribute.Key("container.image.name")
+	// Container image tag.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0.1'
+	ContainerImageTagKey = attribute.Key("container.image.tag")
+)
+
+// The software deployment.
+const (
+	// Name of the [deployment
+	// environment](https://en.wikipedia.org/wiki/Deployment_environment) (aka
+	// deployment tier).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'staging', 'production'
+	DeploymentEnvironmentKey = attribute.Key("deployment.environment")
+)
+
+// The device on which the process represented by this resource is running.
+const (
+	// A unique identifier representing the device
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '2ab2916d-a51f-4ac8-80ee-45ac31a28092'
+	// Note: The device identifier MUST only be defined using the values outlined
+	// below. This value is not an advertising identifier and MUST NOT be used as
+	// such. On iOS (Swift or Objective-C), this value MUST be equal to the [vendor id
+	// entifier](https://developer.apple.com/documentation/uikit/uidevice/1620059-iden
+	// tifierforvendor). On Android (Java or Kotlin), this value MUST be equal to the
+	// Firebase Installation ID or a globally unique UUID which is persisted across
+	// sessions in your application. More information can be found
+	// [here](https://developer.android.com/training/articles/user-data-ids) on best
+	// practices and exact implementation details. Caution should be taken when
+	// storing personal data or anything which can identify a user. GDPR and data
+	// protection laws may apply, ensure you do your own due diligence.
+	DeviceIDKey = attribute.Key("device.id")
+	// The model identifier for the device
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'iPhone3,4', 'SM-G920F'
+	// Note: It's recommended this value represents a machine readable version of the
+	// model identifier rather than the market or consumer-friendly name of the
+	// device.
+	DeviceModelIdentifierKey = attribute.Key("device.model.identifier")
+	// The marketing name for the device model
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'iPhone 6s Plus', 'Samsung Galaxy S6'
+	// Note: It's recommended this value represents a human readable version of the
+	// device model rather than a machine readable alternative.
+	DeviceModelNameKey = attribute.Key("device.model.name")
+)
+
+// A serverless instance.
+const (
+	// The name of the single function that this runtime instance executes.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'my-function'
+	// Note: This is the name of the function as configured/deployed on the FaaS
+	// platform and is usually different from the name of the callback function (which
+	// may be stored in the
+	// [`code.namespace`/`code.function`](../../trace/semantic_conventions/span-
+	// general.md#source-code-attributes) span attributes).
+	FaaSNameKey = attribute.Key("faas.name")
+	// The unique ID of the single function that this runtime instance executes.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:lambda:us-west-2:123456789012:function:my-function'
+	// Note: Depending on the cloud provider, use:
+
+	// * **AWS Lambda:** The function
+	// [ARN](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-
+	// namespaces.html).
+	// Take care not to use the "invoked ARN" directly but replace any
+	// [alias suffix](https://docs.aws.amazon.com/lambda/latest/dg/configuration-
+	// aliases.html) with the resolved function version, as the same runtime instance
+	// may be invokable with multiple
+	// different aliases.
+	// * **GCP:** The [URI of the resource](https://cloud.google.com/iam/docs/full-
+	// resource-names)
+	// * **Azure:** The [Fully Qualified Resource ID](https://docs.microsoft.com/en-
+	// us/rest/api/resources/resources/get-by-id).
+
+	// On some providers, it may not be possible to determine the full ID at startup,
+	// which is why this field cannot be made required. For example, on AWS the
+	// account ID
+	// part of the ARN is not available without calling another AWS API
+	// which may be deemed too slow for a short-running lambda function.
+	// As an alternative, consider setting `faas.id` as a span attribute instead.
+	FaaSIDKey = attribute.Key("faas.id")
+	// The immutable version of the function being executed.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '26', 'pinkfroid-00002'
+	// Note: Depending on the cloud provider and platform, use:
+
+	// * **AWS Lambda:** The [function
+	// version](https://docs.aws.amazon.com/lambda/latest/dg/configuration-
+	// versions.html)
+	//   (an integer represented as a decimal string).
+	// * **Google Cloud Run:** The
+	// [revision](https://cloud.google.com/run/docs/managing/revisions)
+	//   (i.e., the function name plus the revision suffix).
+	// * **Google Cloud Functions:** The value of the
+	//   [`K_REVISION` environment
+	// variable](https://cloud.google.com/functions/docs/env-
+	// var#runtime_environment_variables_set_automatically).
+	// * **Azure Functions:** Not applicable. Do not set this attribute.
+	FaaSVersionKey = attribute.Key("faas.version")
+	// The execution environment ID as a string, that will be potentially reused for
+	// other invocations to the same function/function version.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '2021/06/28/[$LATEST]2f399eb14537447da05ab2a2e39309de'
+	// Note: * **AWS Lambda:** Use the (full) log stream name.
+	FaaSInstanceKey = attribute.Key("faas.instance")
+	// The amount of memory available to the serverless function in MiB.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 128
+	// Note: It's recommended to set this attribute since e.g. too little memory can
+	// easily stop a Java AWS Lambda function from working correctly. On AWS Lambda,
+	// the environment variable `AWS_LAMBDA_FUNCTION_MEMORY_SIZE` provides this
+	// information.
+	FaaSMaxMemoryKey = attribute.Key("faas.max_memory")
+)
+
+// A host is defined as a general computing instance.
+const (
+	// Unique host ID. For Cloud, this must be the instance_id assigned by the cloud
+	// provider.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-test'
+	HostIDKey = attribute.Key("host.id")
+	// Name of the host. On Unix systems, it may contain what the hostname command
+	// returns, or the fully qualified hostname, or another name specified by the
+	// user.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-test'
+	HostNameKey = attribute.Key("host.name")
+	// Type of host. For Cloud, this must be the machine type.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'n1-standard-1'
+	HostTypeKey = attribute.Key("host.type")
+	// The CPU architecture the host system is running on.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	HostArchKey = attribute.Key("host.arch")
+	// Name of the VM image or OS install the host was instantiated from.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'infra-ami-eks-worker-node-7d4ec78312', 'CentOS-8-x86_64-1905'
+	HostImageNameKey = attribute.Key("host.image.name")
+	// VM image ID. For Cloud, this value is from the provider.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'ami-07b06b442921831e5'
+	HostImageIDKey = attribute.Key("host.image.id")
+	// The version string of the VM image as defined in [Version
+	// Attributes](README.md#version-attributes).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0.1'
+	HostImageVersionKey = attribute.Key("host.image.version")
+)
+
+var (
+	// AMD64
+	HostArchAMD64 = HostArchKey.String("amd64")
+	// ARM32
+	HostArchARM32 = HostArchKey.String("arm32")
+	// ARM64
+	HostArchARM64 = HostArchKey.String("arm64")
+	// Itanium
+	HostArchIA64 = HostArchKey.String("ia64")
+	// 32-bit PowerPC
+	HostArchPPC32 = HostArchKey.String("ppc32")
+	// 64-bit PowerPC
+	HostArchPPC64 = HostArchKey.String("ppc64")
+	// 32-bit x86
+	HostArchX86 = HostArchKey.String("x86")
+)
+
+// A Kubernetes Cluster.
+const (
+	// The name of the cluster.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-cluster'
+	K8SClusterNameKey = attribute.Key("k8s.cluster.name")
+)
+
+// A Kubernetes Node object.
+const (
+	// The name of the Node.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'node-1'
+	K8SNodeNameKey = attribute.Key("k8s.node.name")
+	// The UID of the Node.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '1eb3a0c6-0477-4080-a9cb-0cb7db65c6a2'
+	K8SNodeUIDKey = attribute.Key("k8s.node.uid")
+)
+
+// A Kubernetes Namespace.
+const (
+	// The name of the namespace that the pod is running in.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'default'
+	K8SNamespaceNameKey = attribute.Key("k8s.namespace.name")
+)
+
+// A Kubernetes Pod object.
+const (
+	// The UID of the Pod.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SPodUIDKey = attribute.Key("k8s.pod.uid")
+	// The name of the Pod.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry-pod-autoconf'
+	K8SPodNameKey = attribute.Key("k8s.pod.name")
+)
+
+// A container in a [PodTemplate](https://kubernetes.io/docs/concepts/workloads/pods/#pod-templates).
+const (
+	// The name of the Container in a Pod template.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'redis'
+	K8SContainerNameKey = attribute.Key("k8s.container.name")
+)
+
+// A Kubernetes ReplicaSet object.
+const (
+	// The UID of the ReplicaSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SReplicaSetUIDKey = attribute.Key("k8s.replicaset.uid")
+	// The name of the ReplicaSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SReplicaSetNameKey = attribute.Key("k8s.replicaset.name")
+)
+
+// A Kubernetes Deployment object.
+const (
+	// The UID of the Deployment.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SDeploymentUIDKey = attribute.Key("k8s.deployment.uid")
+	// The name of the Deployment.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SDeploymentNameKey = attribute.Key("k8s.deployment.name")
+)
+
+// A Kubernetes StatefulSet object.
+const (
+	// The UID of the StatefulSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SStatefulSetUIDKey = attribute.Key("k8s.statefulset.uid")
+	// The name of the StatefulSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SStatefulSetNameKey = attribute.Key("k8s.statefulset.name")
+)
+
+// A Kubernetes DaemonSet object.
+const (
+	// The UID of the DaemonSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SDaemonSetUIDKey = attribute.Key("k8s.daemonset.uid")
+	// The name of the DaemonSet.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SDaemonSetNameKey = attribute.Key("k8s.daemonset.name")
+)
+
+// A Kubernetes Job object.
+const (
+	// The UID of the Job.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SJobUIDKey = attribute.Key("k8s.job.uid")
+	// The name of the Job.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SJobNameKey = attribute.Key("k8s.job.name")
+)
+
+// A Kubernetes CronJob object.
+const (
+	// The UID of the CronJob.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '275ecb36-5aa8-4c2a-9c47-d8bb681b9aff'
+	K8SCronJobUIDKey = attribute.Key("k8s.cronjob.uid")
+	// The name of the CronJob.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	K8SCronJobNameKey = attribute.Key("k8s.cronjob.name")
+)
+
+// The operating system (OS) on which the process represented by this resource is running.
+const (
+	// The operating system type.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	OSTypeKey = attribute.Key("os.type")
+	// Human readable (not intended to be parsed) OS version information, like e.g.
+	// reported by `ver` or `lsb_release -a` commands.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Microsoft Windows [Version 10.0.18363.778]', 'Ubuntu 18.04.1 LTS'
+	OSDescriptionKey = attribute.Key("os.description")
+	// Human readable operating system name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'iOS', 'Android', 'Ubuntu'
+	OSNameKey = attribute.Key("os.name")
+	// The version string of the operating system as defined in [Version
+	// Attributes](../../resource/semantic_conventions/README.md#version-attributes).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '14.2.1', '18.04.1'
+	OSVersionKey = attribute.Key("os.version")
+)
+
+var (
+	// Microsoft Windows
+	OSTypeWindows = OSTypeKey.String("windows")
+	// Linux
+	OSTypeLinux = OSTypeKey.String("linux")
+	// Apple Darwin
+	OSTypeDarwin = OSTypeKey.String("darwin")
+	// FreeBSD
+	OSTypeFreeBSD = OSTypeKey.String("freebsd")
+	// NetBSD
+	OSTypeNetBSD = OSTypeKey.String("netbsd")
+	// OpenBSD
+	OSTypeOpenBSD = OSTypeKey.String("openbsd")
+	// DragonFly BSD
+	OSTypeDragonflyBSD = OSTypeKey.String("dragonflybsd")
+	// HP-UX (Hewlett Packard Unix)
+	OSTypeHPUX = OSTypeKey.String("hpux")
+	// AIX (Advanced Interactive eXecutive)
+	OSTypeAIX = OSTypeKey.String("aix")
+	// Oracle Solaris
+	OSTypeSolaris = OSTypeKey.String("solaris")
+	// IBM z/OS
+	OSTypeZOS = OSTypeKey.String("z_os")
+)
+
+// An operating system process.
+const (
+	// Process identifier (PID).
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 1234
+	ProcessPIDKey = attribute.Key("process.pid")
+	// The name of the process executable. On Linux based systems, can be set to the
+	// `Name` in `proc/[pid]/status`. On Windows, can be set to the base name of
+	// `GetProcessImageFileNameW`.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: 'otelcol'
+	ProcessExecutableNameKey = attribute.Key("process.executable.name")
+	// The full path to the process executable. On Linux based systems, can be set to
+	// the target of `proc/[pid]/exe`. On Windows, can be set to the result of
+	// `GetProcessImageFileNameW`.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: '/usr/bin/cmd/otelcol'
+	ProcessExecutablePathKey = attribute.Key("process.executable.path")
+	// The command used to launch the process (i.e. the command name). On Linux based
+	// systems, can be set to the zeroth string in `proc/[pid]/cmdline`. On Windows,
+	// can be set to the first parameter extracted from `GetCommandLineW`.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: 'cmd/otelcol'
+	ProcessCommandKey = attribute.Key("process.command")
+	// The full command used to launch the process as a single string representing the
+	// full command. On Windows, can be set to the result of `GetCommandLineW`. Do not
+	// set this if you have to assemble it just for monitoring; use
+	// `process.command_args` instead.
+	//
+	// Type: string
+	// Required: See below
+	// Stability: stable
+	// Examples: 'C:\\cmd\\otecol --config="my directory\\config.yaml"'
+	ProcessCommandLineKey = attribute.Key("process.command_line")
+	// All the command arguments (including the command/executable itself) as received
+	// by the process. On Linux-based systems (and some other Unixoid systems
+	// supporting procfs), can be set according to the list of null-delimited strings
+	// extracted from `proc/[pid]/cmdline`. For libc-based executables, this would be
+	// the full argv vector passed to `main`.
+	//
+	// Type: string[]
+	// Required: See below
+	// Stability: stable
+	// Examples: 'cmd/otecol', '--config=config.yaml'
+	ProcessCommandArgsKey = attribute.Key("process.command_args")
+	// The username of the user that owns the process.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'root'
+	ProcessOwnerKey = attribute.Key("process.owner")
+)
+
+// The single (language) runtime instance which is monitored.
+const (
+	// The name of the runtime of this process. For compiled native binaries, this
+	// SHOULD be the name of the compiler.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'OpenJDK Runtime Environment'
+	ProcessRuntimeNameKey = attribute.Key("process.runtime.name")
+	// The version of the runtime of this process, as returned by the runtime without
+	// modification.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '14.0.2'
+	ProcessRuntimeVersionKey = attribute.Key("process.runtime.version")
+	// An additional description about the runtime of the process, for example a
+	// specific vendor customization of the runtime environment.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Eclipse OpenJ9 Eclipse OpenJ9 VM openj9-0.21.0'
+	ProcessRuntimeDescriptionKey = attribute.Key("process.runtime.description")
+)
+
+// A service instance.
+const (
+	// Logical name of the service.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'shoppingcart'
+	// Note: MUST be the same for all instances of horizontally scaled services. If
+	// the value was not specified, SDKs MUST fallback to `unknown_service:`
+	// concatenated with [`process.executable.name`](process.md#process), e.g.
+	// `unknown_service:bash`. If `process.executable.name` is not available, the
+	// value MUST be set to `unknown_service`.
+	ServiceNameKey = attribute.Key("service.name")
+	// A namespace for `service.name`.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Shop'
+	// Note: A string value having a meaning that helps to distinguish a group of
+	// services, for example the team name that owns a group of services.
+	// `service.name` is expected to be unique within the same namespace. If
+	// `service.namespace` is not specified in the Resource then `service.name` is
+	// expected to be unique for all services that have no explicit namespace defined
+	// (so the empty/unspecified namespace is simply one more valid namespace). Zero-
+	// length namespace string is assumed equal to unspecified namespace.
+	ServiceNamespaceKey = attribute.Key("service.namespace")
+	// The string ID of the service instance.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '627cc493-f310-47de-96bd-71410b7dec09'
+	// Note: MUST be unique for each instance of the same
+	// `service.namespace,service.name` pair (in other words
+	// `service.namespace,service.name,service.instance.id` triplet MUST be globally
+	// unique). The ID helps to distinguish instances of the same service that exist
+	// at the same time (e.g. instances of a horizontally scaled service). It is
+	// preferable for the ID to be persistent and stay the same for the lifetime of
+	// the service instance, however it is acceptable that the ID is ephemeral and
+	// changes during important lifetime events for the service (e.g. service
+	// restarts). If the service has no inherent unique ID that can be used as the
+	// value of this attribute it is recommended to generate a random Version 1 or
+	// Version 4 RFC 4122 UUID (services aiming for reproducible UUIDs may also use
+	// Version 5, see RFC 4122 for more recommendations).
+	ServiceInstanceIDKey = attribute.Key("service.instance.id")
+	// The version string of the service API or implementation.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '2.0.0'
+	ServiceVersionKey = attribute.Key("service.version")
+)
+
+// The telemetry SDK used to capture data recorded by the instrumentation libraries.
+const (
+	// The name of the telemetry SDK as defined above.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'opentelemetry'
+	TelemetrySDKNameKey = attribute.Key("telemetry.sdk.name")
+	// The language of the telemetry SDK.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	TelemetrySDKLanguageKey = attribute.Key("telemetry.sdk.language")
+	// The version string of the telemetry SDK.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '1.2.3'
+	TelemetrySDKVersionKey = attribute.Key("telemetry.sdk.version")
+	// The version string of the auto instrumentation agent, if used.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '1.2.3'
+	TelemetryAutoVersionKey = attribute.Key("telemetry.auto.version")
+)
+
+var (
+	// cpp
+	TelemetrySDKLanguageCPP = TelemetrySDKLanguageKey.String("cpp")
+	// dotnet
+	TelemetrySDKLanguageDotnet = TelemetrySDKLanguageKey.String("dotnet")
+	// erlang
+	TelemetrySDKLanguageErlang = TelemetrySDKLanguageKey.String("erlang")
+	// go
+	TelemetrySDKLanguageGo = TelemetrySDKLanguageKey.String("go")
+	// java
+	TelemetrySDKLanguageJava = TelemetrySDKLanguageKey.String("java")
+	// nodejs
+	TelemetrySDKLanguageNodejs = TelemetrySDKLanguageKey.String("nodejs")
+	// php
+	TelemetrySDKLanguagePHP = TelemetrySDKLanguageKey.String("php")
+	// python
+	TelemetrySDKLanguagePython = TelemetrySDKLanguageKey.String("python")
+	// ruby
+	TelemetrySDKLanguageRuby = TelemetrySDKLanguageKey.String("ruby")
+	// webjs
+	TelemetrySDKLanguageWebjs = TelemetrySDKLanguageKey.String("webjs")
+)
+
+// Resource describing the packaged software running the application code. Web engines are typically executed using process.runtime.
+const (
+	// The name of the web engine.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'WildFly'
+	WebEngineNameKey = attribute.Key("webengine.name")
+	// The version of the web engine.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '21.0.0'
+	WebEngineVersionKey = attribute.Key("webengine.version")
+	// Additional description of the web engine (e.g. detailed version and edition
+	// information).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'WildFly Full 21.0.0.Final (WildFly Core 13.0.1.Final) - 2.2.2.Final'
+	WebEngineDescriptionKey = attribute.Key("webengine.description")
+)
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/schema.go b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/schema.go
new file mode 100644
index 0000000000..64b6c46a58
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/schema.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.7.0"
+
+// SchemaURL is the schema URL that matches the version of the semantic conventions
+// that this package defines. Semconv packages starting from v1.4.0 must declare
+// non-empty schema URL in the form https://opentelemetry.io/schemas/<version>
+const SchemaURL = "https://opentelemetry.io/schemas/1.7.0"
diff --git a/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/trace.go b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/trace.go
new file mode 100644
index 0000000000..9b75bd77ae
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/semconv/v1.7.0/trace.go
@@ -0,0 +1,1558 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated from semantic convention specification. DO NOT EDIT.
+
+package semconv // import "go.opentelemetry.io/otel/semconv/v1.7.0"
+
+import "go.opentelemetry.io/otel/attribute"
+
+// Span attributes used by AWS Lambda (in addition to general `faas` attributes).
+const (
+	// The full invoked ARN as provided on the `Context` passed to the function
+	// (`Lambda-Runtime-Invoked-Function-ARN` header on the `/runtime/invocation/next`
+	// applicable).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'arn:aws:lambda:us-east-1:123456:function:myfunction:myalias'
+	// Note: This may be different from `faas.id` if an alias is involved.
+	AWSLambdaInvokedARNKey = attribute.Key("aws.lambda.invoked_arn")
+)
+
+// This document defines the attributes used to perform database client calls.
+const (
+	// An identifier for the database management system (DBMS) product being used. See
+	// below for a list of well-known identifiers.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	DBSystemKey = attribute.Key("db.system")
+	// The connection string used to connect to the database. It is recommended to
+	// remove embedded credentials.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Server=(localdb)\\v11.0;Integrated Security=true;'
+	DBConnectionStringKey = attribute.Key("db.connection_string")
+	// Username for accessing the database.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'readonly_user', 'reporting_user'
+	DBUserKey = attribute.Key("db.user")
+	// The fully-qualified class name of the [Java Database Connectivity
+	// (JDBC)](https://docs.oracle.com/javase/8/docs/technotes/guides/jdbc/) driver
+	// used to connect.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'org.postgresql.Driver',
+	// 'com.microsoft.sqlserver.jdbc.SQLServerDriver'
+	DBJDBCDriverClassnameKey = attribute.Key("db.jdbc.driver_classname")
+	// If no [tech-specific attribute](#call-level-attributes-for-specific-
+	// technologies) is defined, this attribute is used to report the name of the
+	// database being accessed. For commands that switch the database, this should be
+	// set to the target database (even if the command fails).
+	//
+	// Type: string
+	// Required: Required, if applicable and no more-specific attribute is defined.
+	// Stability: stable
+	// Examples: 'customers', 'main'
+	// Note: In some SQL databases, the database name to be used is called "schema
+	// name".
+	DBNameKey = attribute.Key("db.name")
+	// The database statement being executed.
+	//
+	// Type: string
+	// Required: Required if applicable and not explicitly disabled via
+	// instrumentation configuration.
+	// Stability: stable
+	// Examples: 'SELECT * FROM wuser_table', 'SET mykey "WuValue"'
+	// Note: The value may be sanitized to exclude sensitive information.
+	DBStatementKey = attribute.Key("db.statement")
+	// The name of the operation being executed, e.g. the [MongoDB command
+	// name](https://docs.mongodb.com/manual/reference/command/#database-operations)
+	// such as `findAndModify`, or the SQL keyword.
+	//
+	// Type: string
+	// Required: Required, if `db.statement` is not applicable.
+	// Stability: stable
+	// Examples: 'findAndModify', 'HMSET', 'SELECT'
+	// Note: When setting this to an SQL keyword, it is not recommended to attempt any
+	// client-side parsing of `db.statement` just to get this property, but it should
+	// be set if the operation name is provided by the library being instrumented. If
+	// the SQL statement has an ambiguous operation, or performs more than one
+	// operation, this value may be omitted.
+	DBOperationKey = attribute.Key("db.operation")
+)
+
+var (
+	// Some other SQL database. Fallback only. See notes
+	DBSystemOtherSQL = DBSystemKey.String("other_sql")
+	// Microsoft SQL Server
+	DBSystemMSSQL = DBSystemKey.String("mssql")
+	// MySQL
+	DBSystemMySQL = DBSystemKey.String("mysql")
+	// Oracle Database
+	DBSystemOracle = DBSystemKey.String("oracle")
+	// IBM DB2
+	DBSystemDB2 = DBSystemKey.String("db2")
+	// PostgreSQL
+	DBSystemPostgreSQL = DBSystemKey.String("postgresql")
+	// Amazon Redshift
+	DBSystemRedshift = DBSystemKey.String("redshift")
+	// Apache Hive
+	DBSystemHive = DBSystemKey.String("hive")
+	// Cloudscape
+	DBSystemCloudscape = DBSystemKey.String("cloudscape")
+	// HyperSQL DataBase
+	DBSystemHSQLDB = DBSystemKey.String("hsqldb")
+	// Progress Database
+	DBSystemProgress = DBSystemKey.String("progress")
+	// SAP MaxDB
+	DBSystemMaxDB = DBSystemKey.String("maxdb")
+	// SAP HANA
+	DBSystemHanaDB = DBSystemKey.String("hanadb")
+	// Ingres
+	DBSystemIngres = DBSystemKey.String("ingres")
+	// FirstSQL
+	DBSystemFirstSQL = DBSystemKey.String("firstsql")
+	// EnterpriseDB
+	DBSystemEDB = DBSystemKey.String("edb")
+	// InterSystems Caché
+	DBSystemCache = DBSystemKey.String("cache")
+	// Adabas (Adaptable Database System)
+	DBSystemAdabas = DBSystemKey.String("adabas")
+	// Firebird
+	DBSystemFirebird = DBSystemKey.String("firebird")
+	// Apache Derby
+	DBSystemDerby = DBSystemKey.String("derby")
+	// FileMaker
+	DBSystemFilemaker = DBSystemKey.String("filemaker")
+	// Informix
+	DBSystemInformix = DBSystemKey.String("informix")
+	// InstantDB
+	DBSystemInstantDB = DBSystemKey.String("instantdb")
+	// InterBase
+	DBSystemInterbase = DBSystemKey.String("interbase")
+	// MariaDB
+	DBSystemMariaDB = DBSystemKey.String("mariadb")
+	// Netezza
+	DBSystemNetezza = DBSystemKey.String("netezza")
+	// Pervasive PSQL
+	DBSystemPervasive = DBSystemKey.String("pervasive")
+	// PointBase
+	DBSystemPointbase = DBSystemKey.String("pointbase")
+	// SQLite
+	DBSystemSqlite = DBSystemKey.String("sqlite")
+	// Sybase
+	DBSystemSybase = DBSystemKey.String("sybase")
+	// Teradata
+	DBSystemTeradata = DBSystemKey.String("teradata")
+	// Vertica
+	DBSystemVertica = DBSystemKey.String("vertica")
+	// H2
+	DBSystemH2 = DBSystemKey.String("h2")
+	// ColdFusion IMQ
+	DBSystemColdfusion = DBSystemKey.String("coldfusion")
+	// Apache Cassandra
+	DBSystemCassandra = DBSystemKey.String("cassandra")
+	// Apache HBase
+	DBSystemHBase = DBSystemKey.String("hbase")
+	// MongoDB
+	DBSystemMongoDB = DBSystemKey.String("mongodb")
+	// Redis
+	DBSystemRedis = DBSystemKey.String("redis")
+	// Couchbase
+	DBSystemCouchbase = DBSystemKey.String("couchbase")
+	// CouchDB
+	DBSystemCouchDB = DBSystemKey.String("couchdb")
+	// Microsoft Azure Cosmos DB
+	DBSystemCosmosDB = DBSystemKey.String("cosmosdb")
+	// Amazon DynamoDB
+	DBSystemDynamoDB = DBSystemKey.String("dynamodb")
+	// Neo4j
+	DBSystemNeo4j = DBSystemKey.String("neo4j")
+	// Apache Geode
+	DBSystemGeode = DBSystemKey.String("geode")
+	// Elasticsearch
+	DBSystemElasticsearch = DBSystemKey.String("elasticsearch")
+	// Memcached
+	DBSystemMemcached = DBSystemKey.String("memcached")
+	// CockroachDB
+	DBSystemCockroachdb = DBSystemKey.String("cockroachdb")
+)
+
+// Connection-level attributes for Microsoft SQL Server
+const (
+	// The Microsoft SQL Server [instance name](https://docs.microsoft.com/en-
+	// us/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver15)
+	// connecting to. This name is used to determine the port of a named instance.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'MSSQLSERVER'
+	// Note: If setting a `db.mssql.instance_name`, `net.peer.port` is no longer
+	// required (but still recommended if non-standard).
+	DBMSSQLInstanceNameKey = attribute.Key("db.mssql.instance_name")
+)
+
+// Call-level attributes for Cassandra
+const (
+	// The name of the keyspace being accessed. To be used instead of the generic
+	// `db.name` attribute.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'mykeyspace'
+	DBCassandraKeyspaceKey = attribute.Key("db.cassandra.keyspace")
+	// The fetch size used for paging, i.e. how many rows will be returned at once.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 5000
+	DBCassandraPageSizeKey = attribute.Key("db.cassandra.page_size")
+	// The consistency level of the query. Based on consistency values from
+	// [CQL](https://docs.datastax.com/en/cassandra-
+	// oss/3.0/cassandra/dml/dmlConfigConsistency.html).
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	DBCassandraConsistencyLevelKey = attribute.Key("db.cassandra.consistency_level")
+	// The name of the primary table that the operation is acting upon, including the
+	// schema name (if applicable).
+	//
+	// Type: string
+	// Required: Recommended if available.
+	// Stability: stable
+	// Examples: 'mytable'
+	// Note: This mirrors the db.sql.table attribute but references cassandra rather
+	// than sql. It is not recommended to attempt any client-side parsing of
+	// `db.statement` just to get this property, but it should be set if it is
+	// provided by the library being instrumented. If the operation is acting upon an
+	// anonymous table, or more than one table, this value MUST NOT be set.
+	DBCassandraTableKey = attribute.Key("db.cassandra.table")
+	// Whether or not the query is idempotent.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	DBCassandraIdempotenceKey = attribute.Key("db.cassandra.idempotence")
+	// The number of times a query was speculatively executed. Not set or `0` if the
+	// query was not executed speculatively.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 0, 2
+	DBCassandraSpeculativeExecutionCountKey = attribute.Key("db.cassandra.speculative_execution_count")
+	// The ID of the coordinating node for a query.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'be13faa2-8574-4d71-926d-27f16cf8a7af'
+	DBCassandraCoordinatorIDKey = attribute.Key("db.cassandra.coordinator.id")
+	// The data center of the coordinating node for a query.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'us-west-2'
+	DBCassandraCoordinatorDCKey = attribute.Key("db.cassandra.coordinator.dc")
+)
+
+var (
+	// all
+	DBCassandraConsistencyLevelAll = DBCassandraConsistencyLevelKey.String("all")
+	// each_quorum
+	DBCassandraConsistencyLevelEachQuorum = DBCassandraConsistencyLevelKey.String("each_quorum")
+	// quorum
+	DBCassandraConsistencyLevelQuorum = DBCassandraConsistencyLevelKey.String("quorum")
+	// local_quorum
+	DBCassandraConsistencyLevelLocalQuorum = DBCassandraConsistencyLevelKey.String("local_quorum")
+	// one
+	DBCassandraConsistencyLevelOne = DBCassandraConsistencyLevelKey.String("one")
+	// two
+	DBCassandraConsistencyLevelTwo = DBCassandraConsistencyLevelKey.String("two")
+	// three
+	DBCassandraConsistencyLevelThree = DBCassandraConsistencyLevelKey.String("three")
+	// local_one
+	DBCassandraConsistencyLevelLocalOne = DBCassandraConsistencyLevelKey.String("local_one")
+	// any
+	DBCassandraConsistencyLevelAny = DBCassandraConsistencyLevelKey.String("any")
+	// serial
+	DBCassandraConsistencyLevelSerial = DBCassandraConsistencyLevelKey.String("serial")
+	// local_serial
+	DBCassandraConsistencyLevelLocalSerial = DBCassandraConsistencyLevelKey.String("local_serial")
+)
+
+// Call-level attributes for Apache HBase
+const (
+	// The [HBase namespace](https://hbase.apache.org/book.html#_namespace) being
+	// accessed. To be used instead of the generic `db.name` attribute.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'default'
+	DBHBaseNamespaceKey = attribute.Key("db.hbase.namespace")
+)
+
+// Call-level attributes for Redis
+const (
+	// The index of the database being accessed as used in the [`SELECT`
+	// command](https://redis.io/commands/select), provided as an integer. To be used
+	// instead of the generic `db.name` attribute.
+	//
+	// Type: int
+	// Required: Required, if other than the default database (`0`).
+	// Stability: stable
+	// Examples: 0, 1, 15
+	DBRedisDBIndexKey = attribute.Key("db.redis.database_index")
+)
+
+// Call-level attributes for MongoDB
+const (
+	// The collection being accessed within the database stated in `db.name`.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'customers', 'products'
+	DBMongoDBCollectionKey = attribute.Key("db.mongodb.collection")
+)
+
+// Call-level attrbiutes for SQL databases
+const (
+	// The name of the primary table that the operation is acting upon, including the
+	// schema name (if applicable).
+	//
+	// Type: string
+	// Required: Recommended if available.
+	// Stability: stable
+	// Examples: 'public.users', 'customers'
+	// Note: It is not recommended to attempt any client-side parsing of
+	// `db.statement` just to get this property, but it should be set if it is
+	// provided by the library being instrumented. If the operation is acting upon an
+	// anonymous table, or more than one table, this value MUST NOT be set.
+	DBSQLTableKey = attribute.Key("db.sql.table")
+)
+
+// This document defines the attributes used to report a single exception associated with a span.
+const (
+	// The type of the exception (its fully-qualified class name, if applicable). The
+	// dynamic type of the exception should be preferred over the static type in
+	// languages that support it.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'java.net.ConnectException', 'OSError'
+	ExceptionTypeKey = attribute.Key("exception.type")
+	// The exception message.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Division by zero', "Can't convert 'int' object to str implicitly"
+	ExceptionMessageKey = attribute.Key("exception.message")
+	// A stacktrace as a string in the natural representation for the language
+	// runtime. The representation is to be determined and documented by each language
+	// SIG.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Exception in thread "main" java.lang.RuntimeException: Test
+	// exception\\n at '
+	//  'com.example.GenerateTrace.methodB(GenerateTrace.java:13)\\n at '
+	//  'com.example.GenerateTrace.methodA(GenerateTrace.java:9)\\n at '
+	//  'com.example.GenerateTrace.main(GenerateTrace.java:5)'
+	ExceptionStacktraceKey = attribute.Key("exception.stacktrace")
+	// SHOULD be set to true if the exception event is recorded at a point where it is
+	// known that the exception is escaping the scope of the span.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	// Note: An exception is considered to have escaped (or left) the scope of a span,
+	// if that span is ended while the exception is still logically "in flight".
+	// This may be actually "in flight" in some languages (e.g. if the exception
+	// is passed to a Context manager's `__exit__` method in Python) but will
+	// usually be caught at the point of recording the exception in most languages.
+
+	// It is usually not possible to determine at the point where an exception is
+	// thrown
+	// whether it will escape the scope of a span.
+	// However, it is trivial to know that an exception
+	// will escape, if one checks for an active exception just before ending the span,
+	// as done in the [example above](#exception-end-example).
+
+	// It follows that an exception may still escape the scope of the span
+	// even if the `exception.escaped` attribute was not set or set to false,
+	// since the event might have been recorded at a time where it was not
+	// clear whether the exception will escape.
+	ExceptionEscapedKey = attribute.Key("exception.escaped")
+)
+
+// This semantic convention describes an instance of a function that runs without provisioning or managing of servers (also known as serverless functions or Function as a Service (FaaS)) with spans.
+const (
+	// Type of the trigger on which the function is executed.
+	//
+	// Type: Enum
+	// Required: On FaaS instances, faas.trigger MUST be set on incoming invocations.
+	// Clients invoking FaaS instances MUST set `faas.trigger` on outgoing
+	// invocations, if it is known to the client. This is, for example, not the case,
+	// when the transport layer is abstracted in a FaaS client framework without
+	// access to its configuration.
+	// Stability: stable
+	FaaSTriggerKey = attribute.Key("faas.trigger")
+	// The execution ID of the current function execution.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'af9d5aa4-a685-4c5f-a22b-444f80b3cc28'
+	FaaSExecutionKey = attribute.Key("faas.execution")
+)
+
+var (
+	// A response to some data source operation such as a database or filesystem read/write
+	FaaSTriggerDatasource = FaaSTriggerKey.String("datasource")
+	// To provide an answer to an inbound HTTP request
+	FaaSTriggerHTTP = FaaSTriggerKey.String("http")
+	// A function is set to be executed when messages are sent to a messaging system
+	FaaSTriggerPubsub = FaaSTriggerKey.String("pubsub")
+	// A function is scheduled to be executed regularly
+	FaaSTriggerTimer = FaaSTriggerKey.String("timer")
+	// If none of the others apply
+	FaaSTriggerOther = FaaSTriggerKey.String("other")
+)
+
+// Semantic Convention for FaaS triggered as a response to some data source operation such as a database or filesystem read/write.
+const (
+	// The name of the source on which the triggering operation was performed. For
+	// example, in Cloud Storage or S3 corresponds to the bucket name, and in Cosmos
+	// DB to the database name.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'myBucketName', 'myDBName'
+	FaaSDocumentCollectionKey = attribute.Key("faas.document.collection")
+	// Describes the type of the operation that was performed on the data.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	FaaSDocumentOperationKey = attribute.Key("faas.document.operation")
+	// A string containing the time when the data was accessed in the [ISO
+	// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format expressed
+	// in [UTC](https://www.w3.org/TR/NOTE-datetime).
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: '2020-01-23T13:47:06Z'
+	FaaSDocumentTimeKey = attribute.Key("faas.document.time")
+	// The document name/table subjected to the operation. For example, in Cloud
+	// Storage or S3 is the name of the file, and in Cosmos DB the table name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'myFile.txt', 'myTableName'
+	FaaSDocumentNameKey = attribute.Key("faas.document.name")
+)
+
+var (
+	// When a new object is created
+	FaaSDocumentOperationInsert = FaaSDocumentOperationKey.String("insert")
+	// When an object is modified
+	FaaSDocumentOperationEdit = FaaSDocumentOperationKey.String("edit")
+	// When an object is deleted
+	FaaSDocumentOperationDelete = FaaSDocumentOperationKey.String("delete")
+)
+
+// Semantic Convention for FaaS scheduled to be executed regularly.
+const (
+	// A string containing the function invocation time in the [ISO
+	// 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format expressed
+	// in [UTC](https://www.w3.org/TR/NOTE-datetime).
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: '2020-01-23T13:47:06Z'
+	FaaSTimeKey = attribute.Key("faas.time")
+	// A string containing the schedule period as [Cron Expression](https://docs.oracl
+	// e.com/cd/E12058_01/doc/doc.1014/e12030/cron_expressions.htm).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0/5 * * * ? *'
+	FaaSCronKey = attribute.Key("faas.cron")
+)
+
+// Contains additional attributes for incoming FaaS spans.
+const (
+	// A boolean that is true if the serverless function is executed for the first
+	// time (aka cold-start).
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	FaaSColdstartKey = attribute.Key("faas.coldstart")
+)
+
+// Contains additional attributes for outgoing FaaS spans.
+const (
+	// The name of the invoked function.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'my-function'
+	// Note: SHOULD be equal to the `faas.name` resource attribute of the invoked
+	// function.
+	FaaSInvokedNameKey = attribute.Key("faas.invoked_name")
+	// The cloud provider of the invoked function.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	// Note: SHOULD be equal to the `cloud.provider` resource attribute of the invoked
+	// function.
+	FaaSInvokedProviderKey = attribute.Key("faas.invoked_provider")
+	// The cloud region of the invoked function.
+	//
+	// Type: string
+	// Required: For some cloud providers, like AWS or GCP, the region in which a
+	// function is hosted is essential to uniquely identify the function and also part
+	// of its endpoint. Since it's part of the endpoint being called, the region is
+	// always known to clients. In these cases, `faas.invoked_region` MUST be set
+	// accordingly. If the region is unknown to the client or not required for
+	// identifying the invoked function, setting `faas.invoked_region` is optional.
+	// Stability: stable
+	// Examples: 'eu-central-1'
+	// Note: SHOULD be equal to the `cloud.region` resource attribute of the invoked
+	// function.
+	FaaSInvokedRegionKey = attribute.Key("faas.invoked_region")
+)
+
+var (
+	// Alibaba Cloud
+	FaaSInvokedProviderAlibabaCloud = FaaSInvokedProviderKey.String("alibaba_cloud")
+	// Amazon Web Services
+	FaaSInvokedProviderAWS = FaaSInvokedProviderKey.String("aws")
+	// Microsoft Azure
+	FaaSInvokedProviderAzure = FaaSInvokedProviderKey.String("azure")
+	// Google Cloud Platform
+	FaaSInvokedProviderGCP = FaaSInvokedProviderKey.String("gcp")
+)
+
+// These attributes may be used for any network related operation.
+const (
+	// Transport protocol used. See note below.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	NetTransportKey = attribute.Key("net.transport")
+	// Remote address of the peer (dotted decimal for IPv4 or
+	// [RFC5952](https://tools.ietf.org/html/rfc5952) for IPv6)
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '127.0.0.1'
+	NetPeerIPKey = attribute.Key("net.peer.ip")
+	// Remote port number.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 80, 8080, 443
+	NetPeerPortKey = attribute.Key("net.peer.port")
+	// Remote hostname or similar, see note below.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'example.com'
+	NetPeerNameKey = attribute.Key("net.peer.name")
+	// Like `net.peer.ip` but for the host IP. Useful in case of a multi-IP host.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '192.168.0.1'
+	NetHostIPKey = attribute.Key("net.host.ip")
+	// Like `net.peer.port` but for the host port.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 35555
+	NetHostPortKey = attribute.Key("net.host.port")
+	// Local hostname or similar, see note below.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'localhost'
+	NetHostNameKey = attribute.Key("net.host.name")
+	// The internet connection type currently being used by the host.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Examples: 'wifi'
+	NetHostConnectionTypeKey = attribute.Key("net.host.connection.type")
+	// This describes more details regarding the connection.type. It may be the type
+	// of cell technology connection, but it could be used for describing details
+	// about a wifi connection.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Examples: 'LTE'
+	NetHostConnectionSubtypeKey = attribute.Key("net.host.connection.subtype")
+	// The name of the mobile carrier.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'sprint'
+	NetHostCarrierNameKey = attribute.Key("net.host.carrier.name")
+	// The mobile carrier country code.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '310'
+	NetHostCarrierMccKey = attribute.Key("net.host.carrier.mcc")
+	// The mobile carrier network code.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '001'
+	NetHostCarrierMncKey = attribute.Key("net.host.carrier.mnc")
+	// The ISO 3166-1 alpha-2 2-character country code associated with the mobile
+	// carrier network.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'DE'
+	NetHostCarrierIccKey = attribute.Key("net.host.carrier.icc")
+)
+
+var (
+	// ip_tcp
+	NetTransportTCP = NetTransportKey.String("ip_tcp")
+	// ip_udp
+	NetTransportUDP = NetTransportKey.String("ip_udp")
+	// Another IP-based protocol
+	NetTransportIP = NetTransportKey.String("ip")
+	// Unix Domain socket. See below
+	NetTransportUnix = NetTransportKey.String("unix")
+	// Named or anonymous pipe. See note below
+	NetTransportPipe = NetTransportKey.String("pipe")
+	// In-process communication
+	NetTransportInProc = NetTransportKey.String("inproc")
+	// Something else (non IP-based)
+	NetTransportOther = NetTransportKey.String("other")
+)
+
+var (
+	// wifi
+	NetHostConnectionTypeWifi = NetHostConnectionTypeKey.String("wifi")
+	// wired
+	NetHostConnectionTypeWired = NetHostConnectionTypeKey.String("wired")
+	// cell
+	NetHostConnectionTypeCell = NetHostConnectionTypeKey.String("cell")
+	// unavailable
+	NetHostConnectionTypeUnavailable = NetHostConnectionTypeKey.String("unavailable")
+	// unknown
+	NetHostConnectionTypeUnknown = NetHostConnectionTypeKey.String("unknown")
+)
+
+var (
+	// GPRS
+	NetHostConnectionSubtypeGprs = NetHostConnectionSubtypeKey.String("gprs")
+	// EDGE
+	NetHostConnectionSubtypeEdge = NetHostConnectionSubtypeKey.String("edge")
+	// UMTS
+	NetHostConnectionSubtypeUmts = NetHostConnectionSubtypeKey.String("umts")
+	// CDMA
+	NetHostConnectionSubtypeCdma = NetHostConnectionSubtypeKey.String("cdma")
+	// EVDO Rel. 0
+	NetHostConnectionSubtypeEvdo0 = NetHostConnectionSubtypeKey.String("evdo_0")
+	// EVDO Rev. A
+	NetHostConnectionSubtypeEvdoA = NetHostConnectionSubtypeKey.String("evdo_a")
+	// CDMA2000 1XRTT
+	NetHostConnectionSubtypeCdma20001xrtt = NetHostConnectionSubtypeKey.String("cdma2000_1xrtt")
+	// HSDPA
+	NetHostConnectionSubtypeHsdpa = NetHostConnectionSubtypeKey.String("hsdpa")
+	// HSUPA
+	NetHostConnectionSubtypeHsupa = NetHostConnectionSubtypeKey.String("hsupa")
+	// HSPA
+	NetHostConnectionSubtypeHspa = NetHostConnectionSubtypeKey.String("hspa")
+	// IDEN
+	NetHostConnectionSubtypeIden = NetHostConnectionSubtypeKey.String("iden")
+	// EVDO Rev. B
+	NetHostConnectionSubtypeEvdoB = NetHostConnectionSubtypeKey.String("evdo_b")
+	// LTE
+	NetHostConnectionSubtypeLte = NetHostConnectionSubtypeKey.String("lte")
+	// EHRPD
+	NetHostConnectionSubtypeEhrpd = NetHostConnectionSubtypeKey.String("ehrpd")
+	// HSPAP
+	NetHostConnectionSubtypeHspap = NetHostConnectionSubtypeKey.String("hspap")
+	// GSM
+	NetHostConnectionSubtypeGsm = NetHostConnectionSubtypeKey.String("gsm")
+	// TD-SCDMA
+	NetHostConnectionSubtypeTdScdma = NetHostConnectionSubtypeKey.String("td_scdma")
+	// IWLAN
+	NetHostConnectionSubtypeIwlan = NetHostConnectionSubtypeKey.String("iwlan")
+	// 5G NR (New Radio)
+	NetHostConnectionSubtypeNr = NetHostConnectionSubtypeKey.String("nr")
+	// 5G NRNSA (New Radio Non-Standalone)
+	NetHostConnectionSubtypeNrnsa = NetHostConnectionSubtypeKey.String("nrnsa")
+	// LTE CA
+	NetHostConnectionSubtypeLteCa = NetHostConnectionSubtypeKey.String("lte_ca")
+)
+
+// Operations that access some remote service.
+const (
+	// The [`service.name`](../../resource/semantic_conventions/README.md#service) of
+	// the remote service. SHOULD be equal to the actual `service.name` resource
+	// attribute of the remote service if any.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'AuthTokenCache'
+	PeerServiceKey = attribute.Key("peer.service")
+)
+
+// These attributes may be used for any operation with an authenticated and/or authorized enduser.
+const (
+	// Username or client_id extracted from the access token or
+	// [Authorization](https://tools.ietf.org/html/rfc7235#section-4.2) header in the
+	// inbound request from outside the system.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'username'
+	EnduserIDKey = attribute.Key("enduser.id")
+	// Actual/assumed role the client is making the request under extracted from token
+	// or application security context.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'admin'
+	EnduserRoleKey = attribute.Key("enduser.role")
+	// Scopes or granted authorities the client currently possesses extracted from
+	// token or application security context. The value would come from the scope
+	// associated with an [OAuth 2.0 Access
+	// Token](https://tools.ietf.org/html/rfc6749#section-3.3) or an attribute value
+	// in a [SAML 2.0 Assertion](http://docs.oasis-
+	// open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'read:message, write:files'
+	EnduserScopeKey = attribute.Key("enduser.scope")
+)
+
+// These attributes may be used for any operation to store information about a thread that started a span.
+const (
+	// Current "managed" thread ID (as opposed to OS thread ID).
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 42
+	ThreadIDKey = attribute.Key("thread.id")
+	// Current thread name.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'main'
+	ThreadNameKey = attribute.Key("thread.name")
+)
+
+// These attributes allow to report this unit of code and therefore to provide more context about the span.
+const (
+	// The method or function name, or equivalent (usually rightmost part of the code
+	// unit's name).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'serveRequest'
+	CodeFunctionKey = attribute.Key("code.function")
+	// The "namespace" within which `code.function` is defined. Usually the qualified
+	// class or module name, such that `code.namespace` + some separator +
+	// `code.function` form a unique identifier for the code unit.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'com.example.MyHTTPService'
+	CodeNamespaceKey = attribute.Key("code.namespace")
+	// The source code file name that identifies the code unit as uniquely as possible
+	// (preferably an absolute file path).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '/usr/local/MyApplication/content_root/app/index.php'
+	CodeFilepathKey = attribute.Key("code.filepath")
+	// The line number in `code.filepath` best representing the operation. It SHOULD
+	// point within the code unit named in `code.function`.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 42
+	CodeLineNumberKey = attribute.Key("code.lineno")
+)
+
+// This document defines semantic conventions for HTTP client and server Spans.
+const (
+	// HTTP request method.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'GET', 'POST', 'HEAD'
+	HTTPMethodKey = attribute.Key("http.method")
+	// Full HTTP request URL in the form `scheme://host[:port]/path?query[#fragment]`.
+	// Usually the fragment is not transmitted over HTTP, but if it is known, it
+	// should be included nevertheless.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'https://www.foo.bar/search?q=OpenTelemetry#SemConv'
+	// Note: `http.url` MUST NOT contain credentials passed via URL in form of
+	// `https://username:password@www.example.com/`. In such case the attribute's
+	// value should be `https://www.example.com/`.
+	HTTPURLKey = attribute.Key("http.url")
+	// The full request target as passed in a HTTP request line or equivalent.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '/path/12314/?q=ddds#123'
+	HTTPTargetKey = attribute.Key("http.target")
+	// The value of the [HTTP host
+	// header](https://tools.ietf.org/html/rfc7230#section-5.4). An empty Host header
+	// should also be reported, see note.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'www.example.org'
+	// Note: When the header is present but empty the attribute SHOULD be set to the
+	// empty string. Note that this is a valid situation that is expected in certain
+	// cases, according the aforementioned [section of RFC
+	// 7230](https://tools.ietf.org/html/rfc7230#section-5.4). When the header is not
+	// set the attribute MUST NOT be set.
+	HTTPHostKey = attribute.Key("http.host")
+	// The URI scheme identifying the used protocol.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'http', 'https'
+	HTTPSchemeKey = attribute.Key("http.scheme")
+	// [HTTP response status code](https://tools.ietf.org/html/rfc7231#section-6).
+	//
+	// Type: int
+	// Required: If and only if one was received/sent.
+	// Stability: stable
+	// Examples: 200
+	HTTPStatusCodeKey = attribute.Key("http.status_code")
+	// Kind of HTTP protocol used.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	// Note: If `net.transport` is not specified, it can be assumed to be `IP.TCP`
+	// except if `http.flavor` is `QUIC`, in which case `IP.UDP` is assumed.
+	HTTPFlavorKey = attribute.Key("http.flavor")
+	// Value of the [HTTP User-
+	// Agent](https://tools.ietf.org/html/rfc7231#section-5.5.3) header sent by the
+	// client.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'CERN-LineMode/2.15 libwww/2.17b3'
+	HTTPUserAgentKey = attribute.Key("http.user_agent")
+	// The size of the request payload body in bytes. This is the number of bytes
+	// transferred excluding headers and is often, but not always, present as the
+	// [Content-Length](https://tools.ietf.org/html/rfc7230#section-3.3.2) header. For
+	// requests using transport encoding, this should be the compressed size.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 3495
+	HTTPRequestContentLengthKey = attribute.Key("http.request_content_length")
+	// The size of the uncompressed request payload body after transport decoding. Not
+	// set if transport encoding not used.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 5493
+	HTTPRequestContentLengthUncompressedKey = attribute.Key("http.request_content_length_uncompressed")
+	// The size of the response payload body in bytes. This is the number of bytes
+	// transferred excluding headers and is often, but not always, present as the
+	// [Content-Length](https://tools.ietf.org/html/rfc7230#section-3.3.2) header. For
+	// requests using transport encoding, this should be the compressed size.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 3495
+	HTTPResponseContentLengthKey = attribute.Key("http.response_content_length")
+	// The size of the uncompressed response payload body after transport decoding.
+	// Not set if transport encoding not used.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 5493
+	HTTPResponseContentLengthUncompressedKey = attribute.Key("http.response_content_length_uncompressed")
+)
+
+var (
+	// HTTP 1.0
+	HTTPFlavorHTTP10 = HTTPFlavorKey.String("1.0")
+	// HTTP 1.1
+	HTTPFlavorHTTP11 = HTTPFlavorKey.String("1.1")
+	// HTTP 2
+	HTTPFlavorHTTP20 = HTTPFlavorKey.String("2.0")
+	// SPDY protocol
+	HTTPFlavorSPDY = HTTPFlavorKey.String("SPDY")
+	// QUIC protocol
+	HTTPFlavorQUIC = HTTPFlavorKey.String("QUIC")
+)
+
+// Semantic Convention for HTTP Server
+const (
+	// The primary server name of the matched virtual host. This should be obtained
+	// via configuration. If no such configuration can be obtained, this attribute
+	// MUST NOT be set ( `net.host.name` should be used instead).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'example.com'
+	// Note: `http.url` is usually not readily available on the server side but would
+	// have to be assembled in a cumbersome and sometimes lossy process from other
+	// information (see e.g. open-telemetry/opentelemetry-python/pull/148). It is thus
+	// preferred to supply the raw data that is available.
+	HTTPServerNameKey = attribute.Key("http.server_name")
+	// The matched route (path template).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '/users/:userID?'
+	HTTPRouteKey = attribute.Key("http.route")
+	// The IP address of the original client behind all proxies, if known (e.g. from
+	// [X-Forwarded-For](https://developer.mozilla.org/en-
+	// US/docs/Web/HTTP/Headers/X-Forwarded-For)).
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '83.164.160.102'
+	// Note: This is not necessarily the same as `net.peer.ip`, which would
+	// identify the network-level peer, which may be a proxy.
+
+	// This attribute should be set when a source of information different
+	// from the one used for `net.peer.ip`, is available even if that other
+	// source just confirms the same value as `net.peer.ip`.
+	// Rationale: For `net.peer.ip`, one typically does not know if it
+	// comes from a proxy, reverse proxy, or the actual client. Setting
+	// `http.client_ip` when it's the same as `net.peer.ip` means that
+	// one is at least somewhat confident that the address is not that of
+	// the closest proxy.
+	HTTPClientIPKey = attribute.Key("http.client_ip")
+)
+
+// Attributes that exist for multiple DynamoDB request types.
+const (
+	// The keys in the `RequestItems` object field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'Users', 'Cats'
+	AWSDynamoDBTableNamesKey = attribute.Key("aws.dynamodb.table_names")
+	// The JSON-serialized value of each item in the `ConsumedCapacity` response
+	// field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "CapacityUnits": number, "GlobalSecondaryIndexes": { "string" : {
+	// "CapacityUnits": number, "ReadCapacityUnits": number, "WriteCapacityUnits":
+	// number } }, "LocalSecondaryIndexes": { "string" : { "CapacityUnits": number,
+	// "ReadCapacityUnits": number, "WriteCapacityUnits": number } },
+	// "ReadCapacityUnits": number, "Table": { "CapacityUnits": number,
+	// "ReadCapacityUnits": number, "WriteCapacityUnits": number }, "TableName":
+	// "string", "WriteCapacityUnits": number }'
+	AWSDynamoDBConsumedCapacityKey = attribute.Key("aws.dynamodb.consumed_capacity")
+	// The JSON-serialized value of the `ItemCollectionMetrics` response field.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "string" : [ { "ItemCollectionKey": { "string" : { "B": blob,
+	// "BOOL": boolean, "BS": [ blob ], "L": [ "AttributeValue" ], "M": { "string" :
+	// "AttributeValue" }, "N": "string", "NS": [ "string" ], "NULL": boolean, "S":
+	// "string", "SS": [ "string" ] } }, "SizeEstimateRangeGB": [ number ] } ] }'
+	AWSDynamoDBItemCollectionMetricsKey = attribute.Key("aws.dynamodb.item_collection_metrics")
+	// The value of the `ProvisionedThroughput.ReadCapacityUnits` request parameter.
+	//
+	// Type: double
+	// Required: No
+	// Stability: stable
+	// Examples: 1.0, 2.0
+	AWSDynamoDBProvisionedReadCapacityKey = attribute.Key("aws.dynamodb.provisioned_read_capacity")
+	// The value of the `ProvisionedThroughput.WriteCapacityUnits` request parameter.
+	//
+	// Type: double
+	// Required: No
+	// Stability: stable
+	// Examples: 1.0, 2.0
+	AWSDynamoDBProvisionedWriteCapacityKey = attribute.Key("aws.dynamodb.provisioned_write_capacity")
+	// The value of the `ConsistentRead` request parameter.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	AWSDynamoDBConsistentReadKey = attribute.Key("aws.dynamodb.consistent_read")
+	// The value of the `ProjectionExpression` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Title', 'Title, Price, Color', 'Title, Description, RelatedItems,
+	// ProductReviews'
+	AWSDynamoDBProjectionKey = attribute.Key("aws.dynamodb.projection")
+	// The value of the `Limit` request parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBLimitKey = attribute.Key("aws.dynamodb.limit")
+	// The value of the `AttributesToGet` request parameter.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: 'lives', 'id'
+	AWSDynamoDBAttributesToGetKey = attribute.Key("aws.dynamodb.attributes_to_get")
+	// The value of the `IndexName` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'name_to_group'
+	AWSDynamoDBIndexNameKey = attribute.Key("aws.dynamodb.index_name")
+	// The value of the `Select` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'ALL_ATTRIBUTES', 'COUNT'
+	AWSDynamoDBSelectKey = attribute.Key("aws.dynamodb.select")
+)
+
+// DynamoDB.CreateTable
+const (
+	// The JSON-serialized value of each item of the `GlobalSecondaryIndexes` request
+	// field
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "IndexName": "string", "KeySchema": [ { "AttributeName": "string",
+	// "KeyType": "string" } ], "Projection": { "NonKeyAttributes": [ "string" ],
+	// "ProjectionType": "string" }, "ProvisionedThroughput": { "ReadCapacityUnits":
+	// number, "WriteCapacityUnits": number } }'
+	AWSDynamoDBGlobalSecondaryIndexesKey = attribute.Key("aws.dynamodb.global_secondary_indexes")
+	// The JSON-serialized value of each item of the `LocalSecondaryIndexes` request
+	// field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "IndexARN": "string", "IndexName": "string", "IndexSizeBytes":
+	// number, "ItemCount": number, "KeySchema": [ { "AttributeName": "string",
+	// "KeyType": "string" } ], "Projection": { "NonKeyAttributes": [ "string" ],
+	// "ProjectionType": "string" } }'
+	AWSDynamoDBLocalSecondaryIndexesKey = attribute.Key("aws.dynamodb.local_secondary_indexes")
+)
+
+// DynamoDB.ListTables
+const (
+	// The value of the `ExclusiveStartTableName` request parameter.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Users', 'CatsTable'
+	AWSDynamoDBExclusiveStartTableKey = attribute.Key("aws.dynamodb.exclusive_start_table")
+	// The the number of items in the `TableNames` response parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 20
+	AWSDynamoDBTableCountKey = attribute.Key("aws.dynamodb.table_count")
+)
+
+// DynamoDB.Query
+const (
+	// The value of the `ScanIndexForward` request parameter.
+	//
+	// Type: boolean
+	// Required: No
+	// Stability: stable
+	AWSDynamoDBScanForwardKey = attribute.Key("aws.dynamodb.scan_forward")
+)
+
+// DynamoDB.Scan
+const (
+	// The value of the `Segment` request parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBSegmentKey = attribute.Key("aws.dynamodb.segment")
+	// The value of the `TotalSegments` request parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 100
+	AWSDynamoDBTotalSegmentsKey = attribute.Key("aws.dynamodb.total_segments")
+	// The value of the `Count` response parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 10
+	AWSDynamoDBCountKey = attribute.Key("aws.dynamodb.count")
+	// The value of the `ScannedCount` response parameter.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 50
+	AWSDynamoDBScannedCountKey = attribute.Key("aws.dynamodb.scanned_count")
+)
+
+// DynamoDB.UpdateTable
+const (
+	// The JSON-serialized value of each item in the `AttributeDefinitions` request
+	// field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "AttributeName": "string", "AttributeType": "string" }'
+	AWSDynamoDBAttributeDefinitionsKey = attribute.Key("aws.dynamodb.attribute_definitions")
+	// The JSON-serialized value of each item in the the `GlobalSecondaryIndexUpdates`
+	// request field.
+	//
+	// Type: string[]
+	// Required: No
+	// Stability: stable
+	// Examples: '{ "Create": { "IndexName": "string", "KeySchema": [ {
+	// "AttributeName": "string", "KeyType": "string" } ], "Projection": {
+	// "NonKeyAttributes": [ "string" ], "ProjectionType": "string" },
+	// "ProvisionedThroughput": { "ReadCapacityUnits": number, "WriteCapacityUnits":
+	// number } }'
+	AWSDynamoDBGlobalSecondaryIndexUpdatesKey = attribute.Key("aws.dynamodb.global_secondary_index_updates")
+)
+
+// This document defines the attributes used in messaging systems.
+const (
+	// A string identifying the messaging system.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'kafka', 'rabbitmq', 'activemq', 'AmazonSQS'
+	MessagingSystemKey = attribute.Key("messaging.system")
+	// The message destination name. This might be equal to the span name but is
+	// required nevertheless.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'MyQueue', 'MyTopic'
+	MessagingDestinationKey = attribute.Key("messaging.destination")
+	// The kind of message destination
+	//
+	// Type: Enum
+	// Required: Required only if the message destination is either a `queue` or
+	// `topic`.
+	// Stability: stable
+	MessagingDestinationKindKey = attribute.Key("messaging.destination_kind")
+	// A boolean that is true if the message destination is temporary.
+	//
+	// Type: boolean
+	// Required: If missing, it is assumed to be false.
+	// Stability: stable
+	MessagingTempDestinationKey = attribute.Key("messaging.temp_destination")
+	// The name of the transport protocol.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'AMQP', 'MQTT'
+	MessagingProtocolKey = attribute.Key("messaging.protocol")
+	// The version of the transport protocol.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '0.9.1'
+	MessagingProtocolVersionKey = attribute.Key("messaging.protocol_version")
+	// Connection string.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'tibjmsnaming://localhost:7222',
+	// 'https://queue.amazonaws.com/80398EXAMPLE/MyQueue'
+	MessagingURLKey = attribute.Key("messaging.url")
+	// A value used by the messaging system as an identifier for the message,
+	// represented as a string.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '452a7c7c7c7048c2f887f61572b18fc2'
+	MessagingMessageIDKey = attribute.Key("messaging.message_id")
+	// The [conversation ID](#conversations) identifying the conversation to which the
+	// message belongs, represented as a string. Sometimes called "Correlation ID".
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'MyConversationID'
+	MessagingConversationIDKey = attribute.Key("messaging.conversation_id")
+	// The (uncompressed) size of the message payload in bytes. Also use this
+	// attribute if it is unknown whether the compressed or uncompressed payload size
+	// is reported.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 2738
+	MessagingMessagePayloadSizeBytesKey = attribute.Key("messaging.message_payload_size_bytes")
+	// The compressed size of the message payload in bytes.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 2048
+	MessagingMessagePayloadCompressedSizeBytesKey = attribute.Key("messaging.message_payload_compressed_size_bytes")
+)
+
+var (
+	// A message sent to a queue
+	MessagingDestinationKindQueue = MessagingDestinationKindKey.String("queue")
+	// A message sent to a topic
+	MessagingDestinationKindTopic = MessagingDestinationKindKey.String("topic")
+)
+
+// Semantic convention for a consumer of messages received from a messaging system
+const (
+	// A string identifying the kind of message consumption as defined in the
+	// [Operation names](#operation-names) section above. If the operation is "send",
+	// this attribute MUST NOT be set, since the operation can be inferred from the
+	// span kind in that case.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	MessagingOperationKey = attribute.Key("messaging.operation")
+	// The identifier for the consumer receiving a message. For Kafka, set it to
+	// `{messaging.kafka.consumer_group} - {messaging.kafka.client_id}`, if both are
+	// present, or only `messaging.kafka.consumer_group`. For brokers, such as
+	// RabbitMQ and Artemis, set it to the `client_id` of the client consuming the
+	// message.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'mygroup - client-6'
+	MessagingConsumerIDKey = attribute.Key("messaging.consumer_id")
+)
+
+var (
+	// receive
+	MessagingOperationReceive = MessagingOperationKey.String("receive")
+	// process
+	MessagingOperationProcess = MessagingOperationKey.String("process")
+)
+
+// Attributes for RabbitMQ
+const (
+	// RabbitMQ message routing key.
+	//
+	// Type: string
+	// Required: Unless it is empty.
+	// Stability: stable
+	// Examples: 'myKey'
+	MessagingRabbitmqRoutingKeyKey = attribute.Key("messaging.rabbitmq.routing_key")
+)
+
+// Attributes for Apache Kafka
+const (
+	// Message keys in Kafka are used for grouping alike messages to ensure they're
+	// processed on the same partition. They differ from `messaging.message_id` in
+	// that they're not unique. If the key is `null`, the attribute MUST NOT be set.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'myKey'
+	// Note: If the key type is not string, it's string representation has to be
+	// supplied for the attribute. If the key has no unambiguous, canonical string
+	// form, don't include its value.
+	MessagingKafkaMessageKeyKey = attribute.Key("messaging.kafka.message_key")
+	// Name of the Kafka Consumer Group that is handling the message. Only applies to
+	// consumers, not producers.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'my-group'
+	MessagingKafkaConsumerGroupKey = attribute.Key("messaging.kafka.consumer_group")
+	// Client ID for the Consumer or Producer that is handling the message.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'client-5'
+	MessagingKafkaClientIDKey = attribute.Key("messaging.kafka.client_id")
+	// Partition the message is sent to.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Examples: 2
+	MessagingKafkaPartitionKey = attribute.Key("messaging.kafka.partition")
+	// A boolean that is true if the message is a tombstone.
+	//
+	// Type: boolean
+	// Required: If missing, it is assumed to be false.
+	// Stability: stable
+	MessagingKafkaTombstoneKey = attribute.Key("messaging.kafka.tombstone")
+)
+
+// This document defines semantic conventions for remote procedure calls.
+const (
+	// A string identifying the remoting system.
+	//
+	// Type: string
+	// Required: Always
+	// Stability: stable
+	// Examples: 'grpc', 'java_rmi', 'wcf'
+	RPCSystemKey = attribute.Key("rpc.system")
+	// The full (logical) name of the service being called, including its package
+	// name, if applicable.
+	//
+	// Type: string
+	// Required: No, but recommended
+	// Stability: stable
+	// Examples: 'myservice.EchoService'
+	// Note: This is the logical name of the service from the RPC interface
+	// perspective, which can be different from the name of any implementing class.
+	// The `code.namespace` attribute may be used to store the latter (despite the
+	// attribute name, it may include a class name; e.g., class with method actually
+	// executing the call on the server side, RPC client stub class on the client
+	// side).
+	RPCServiceKey = attribute.Key("rpc.service")
+	// The name of the (logical) method being called, must be equal to the $method
+	// part in the span name.
+	//
+	// Type: string
+	// Required: No, but recommended
+	// Stability: stable
+	// Examples: 'exampleMethod'
+	// Note: This is the logical name of the method from the RPC interface
+	// perspective, which can be different from the name of any implementing
+	// method/function. The `code.function` attribute may be used to store the latter
+	// (e.g., method actually executing the call on the server side, RPC client stub
+	// method on the client side).
+	RPCMethodKey = attribute.Key("rpc.method")
+)
+
+// Tech-specific attributes for gRPC.
+const (
+	// The [numeric status
+	// code](https://github.com/grpc/grpc/blob/v1.33.2/doc/statuscodes.md) of the gRPC
+	// request.
+	//
+	// Type: Enum
+	// Required: Always
+	// Stability: stable
+	RPCGRPCStatusCodeKey = attribute.Key("rpc.grpc.status_code")
+)
+
+var (
+	// OK
+	RPCGRPCStatusCodeOk = RPCGRPCStatusCodeKey.Int(0)
+	// CANCELLED
+	RPCGRPCStatusCodeCancelled = RPCGRPCStatusCodeKey.Int(1)
+	// UNKNOWN
+	RPCGRPCStatusCodeUnknown = RPCGRPCStatusCodeKey.Int(2)
+	// INVALID_ARGUMENT
+	RPCGRPCStatusCodeInvalidArgument = RPCGRPCStatusCodeKey.Int(3)
+	// DEADLINE_EXCEEDED
+	RPCGRPCStatusCodeDeadlineExceeded = RPCGRPCStatusCodeKey.Int(4)
+	// NOT_FOUND
+	RPCGRPCStatusCodeNotFound = RPCGRPCStatusCodeKey.Int(5)
+	// ALREADY_EXISTS
+	RPCGRPCStatusCodeAlreadyExists = RPCGRPCStatusCodeKey.Int(6)
+	// PERMISSION_DENIED
+	RPCGRPCStatusCodePermissionDenied = RPCGRPCStatusCodeKey.Int(7)
+	// RESOURCE_EXHAUSTED
+	RPCGRPCStatusCodeResourceExhausted = RPCGRPCStatusCodeKey.Int(8)
+	// FAILED_PRECONDITION
+	RPCGRPCStatusCodeFailedPrecondition = RPCGRPCStatusCodeKey.Int(9)
+	// ABORTED
+	RPCGRPCStatusCodeAborted = RPCGRPCStatusCodeKey.Int(10)
+	// OUT_OF_RANGE
+	RPCGRPCStatusCodeOutOfRange = RPCGRPCStatusCodeKey.Int(11)
+	// UNIMPLEMENTED
+	RPCGRPCStatusCodeUnimplemented = RPCGRPCStatusCodeKey.Int(12)
+	// INTERNAL
+	RPCGRPCStatusCodeInternal = RPCGRPCStatusCodeKey.Int(13)
+	// UNAVAILABLE
+	RPCGRPCStatusCodeUnavailable = RPCGRPCStatusCodeKey.Int(14)
+	// DATA_LOSS
+	RPCGRPCStatusCodeDataLoss = RPCGRPCStatusCodeKey.Int(15)
+	// UNAUTHENTICATED
+	RPCGRPCStatusCodeUnauthenticated = RPCGRPCStatusCodeKey.Int(16)
+)
+
+// Tech-specific attributes for [JSON RPC](https://www.jsonrpc.org/).
+const (
+	// Protocol version as in `jsonrpc` property of request/response. Since JSON-RPC
+	// 1.0 does not specify this, the value can be omitted.
+	//
+	// Type: string
+	// Required: If missing, it is assumed to be "1.0".
+	// Stability: stable
+	// Examples: '2.0', '1.0'
+	RPCJsonrpcVersionKey = attribute.Key("rpc.jsonrpc.version")
+	// `id` property of request or response. Since protocol allows id to be int,
+	// string, `null` or missing (for notifications), value is expected to be cast to
+	// string for simplicity. Use empty string in case of `null` value. Omit entirely
+	// if this is a notification.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: '10', 'request-7', ''
+	RPCJsonrpcRequestIDKey = attribute.Key("rpc.jsonrpc.request_id")
+	// `error.code` property of response if it is an error response.
+	//
+	// Type: int
+	// Required: If missing, response is assumed to be successful.
+	// Stability: stable
+	// Examples: -32700, 100
+	RPCJsonrpcErrorCodeKey = attribute.Key("rpc.jsonrpc.error_code")
+	// `error.message` property of response if it is an error response.
+	//
+	// Type: string
+	// Required: No
+	// Stability: stable
+	// Examples: 'Parse error', 'User already exists'
+	RPCJsonrpcErrorMessageKey = attribute.Key("rpc.jsonrpc.error_message")
+)
+
+// RPC received/sent message.
+const (
+	// Whether this is a received or sent message.
+	//
+	// Type: Enum
+	// Required: No
+	// Stability: stable
+	MessageTypeKey = attribute.Key("message.type")
+	// MUST be calculated as two different counters starting from `1` one for sent
+	// messages and one for received message.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	// Note: This way we guarantee that the values will be consistent between
+	// different implementations.
+	MessageIDKey = attribute.Key("message.id")
+	// Compressed size of the message in bytes.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	MessageCompressedSizeKey = attribute.Key("message.compressed_size")
+	// Uncompressed size of the message in bytes.
+	//
+	// Type: int
+	// Required: No
+	// Stability: stable
+	MessageUncompressedSizeKey = attribute.Key("message.uncompressed_size")
+)
+
+var (
+	// sent
+	MessageTypeSent = MessageTypeKey.String("SENT")
+	// received
+	MessageTypeReceived = MessageTypeKey.String("RECEIVED")
+)
diff --git a/vendor/go.opentelemetry.io/otel/trace.go b/vendor/go.opentelemetry.io/otel/trace.go
new file mode 100644
index 0000000000..caf7249de8
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace.go
@@ -0,0 +1,47 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otel // import "go.opentelemetry.io/otel"
+
+import (
+	"go.opentelemetry.io/otel/internal/global"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// Tracer creates a named tracer that implements Tracer interface.
+// If the name is an empty string then provider uses default name.
+//
+// This is short for GetTracerProvider().Tracer(name, opts...)
+func Tracer(name string, opts ...trace.TracerOption) trace.Tracer {
+	return GetTracerProvider().Tracer(name, opts...)
+}
+
+// GetTracerProvider returns the registered global trace provider.
+// If none is registered then an instance of NoopTracerProvider is returned.
+//
+// Use the trace provider to create a named tracer. E.g.
+//
+//	tracer := otel.GetTracerProvider().Tracer("example.com/foo")
+//
+// or
+//
+//	tracer := otel.Tracer("example.com/foo")
+func GetTracerProvider() trace.TracerProvider {
+	return global.TracerProvider()
+}
+
+// SetTracerProvider registers `tp` as the global trace provider.
+func SetTracerProvider(tp trace.TracerProvider) {
+	global.SetTracerProvider(tp)
+}
diff --git a/vendor/go.opentelemetry.io/otel/trace/LICENSE b/vendor/go.opentelemetry.io/otel/trace/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/otel/trace/config.go b/vendor/go.opentelemetry.io/otel/trace/config.go
new file mode 100644
index 0000000000..cb3efbb9ad
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/config.go
@@ -0,0 +1,333 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/trace"
+
+import (
+	"time"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// TracerConfig is a group of options for a Tracer.
+type TracerConfig struct {
+	instrumentationVersion string
+	// Schema URL of the telemetry emitted by the Tracer.
+	schemaURL string
+	attrs     attribute.Set
+}
+
+// InstrumentationVersion returns the version of the library providing instrumentation.
+func (t *TracerConfig) InstrumentationVersion() string {
+	return t.instrumentationVersion
+}
+
+// InstrumentationAttributes returns the attributes associated with the library
+// providing instrumentation.
+func (t *TracerConfig) InstrumentationAttributes() attribute.Set {
+	return t.attrs
+}
+
+// SchemaURL returns the Schema URL of the telemetry emitted by the Tracer.
+func (t *TracerConfig) SchemaURL() string {
+	return t.schemaURL
+}
+
+// NewTracerConfig applies all the options to a returned TracerConfig.
+func NewTracerConfig(options ...TracerOption) TracerConfig {
+	var config TracerConfig
+	for _, option := range options {
+		config = option.apply(config)
+	}
+	return config
+}
+
+// TracerOption applies an option to a TracerConfig.
+type TracerOption interface {
+	apply(TracerConfig) TracerConfig
+}
+
+type tracerOptionFunc func(TracerConfig) TracerConfig
+
+func (fn tracerOptionFunc) apply(cfg TracerConfig) TracerConfig {
+	return fn(cfg)
+}
+
+// SpanConfig is a group of options for a Span.
+type SpanConfig struct {
+	attributes []attribute.KeyValue
+	timestamp  time.Time
+	links      []Link
+	newRoot    bool
+	spanKind   SpanKind
+	stackTrace bool
+}
+
+// Attributes describe the associated qualities of a Span.
+func (cfg *SpanConfig) Attributes() []attribute.KeyValue {
+	return cfg.attributes
+}
+
+// Timestamp is a time in a Span life-cycle.
+func (cfg *SpanConfig) Timestamp() time.Time {
+	return cfg.timestamp
+}
+
+// StackTrace checks whether stack trace capturing is enabled.
+func (cfg *SpanConfig) StackTrace() bool {
+	return cfg.stackTrace
+}
+
+// Links are the associations a Span has with other Spans.
+func (cfg *SpanConfig) Links() []Link {
+	return cfg.links
+}
+
+// NewRoot identifies a Span as the root Span for a new trace. This is
+// commonly used when an existing trace crosses trust boundaries and the
+// remote parent span context should be ignored for security.
+func (cfg *SpanConfig) NewRoot() bool {
+	return cfg.newRoot
+}
+
+// SpanKind is the role a Span has in a trace.
+func (cfg *SpanConfig) SpanKind() SpanKind {
+	return cfg.spanKind
+}
+
+// NewSpanStartConfig applies all the options to a returned SpanConfig.
+// No validation is performed on the returned SpanConfig (e.g. no uniqueness
+// checking or bounding of data), it is left to the SDK to perform this
+// action.
+func NewSpanStartConfig(options ...SpanStartOption) SpanConfig {
+	var c SpanConfig
+	for _, option := range options {
+		c = option.applySpanStart(c)
+	}
+	return c
+}
+
+// NewSpanEndConfig applies all the options to a returned SpanConfig.
+// No validation is performed on the returned SpanConfig (e.g. no uniqueness
+// checking or bounding of data), it is left to the SDK to perform this
+// action.
+func NewSpanEndConfig(options ...SpanEndOption) SpanConfig {
+	var c SpanConfig
+	for _, option := range options {
+		c = option.applySpanEnd(c)
+	}
+	return c
+}
+
+// SpanStartOption applies an option to a SpanConfig. These options are applicable
+// only when the span is created.
+type SpanStartOption interface {
+	applySpanStart(SpanConfig) SpanConfig
+}
+
+type spanOptionFunc func(SpanConfig) SpanConfig
+
+func (fn spanOptionFunc) applySpanStart(cfg SpanConfig) SpanConfig {
+	return fn(cfg)
+}
+
+// SpanEndOption applies an option to a SpanConfig. These options are
+// applicable only when the span is ended.
+type SpanEndOption interface {
+	applySpanEnd(SpanConfig) SpanConfig
+}
+
+// EventConfig is a group of options for an Event.
+type EventConfig struct {
+	attributes []attribute.KeyValue
+	timestamp  time.Time
+	stackTrace bool
+}
+
+// Attributes describe the associated qualities of an Event.
+func (cfg *EventConfig) Attributes() []attribute.KeyValue {
+	return cfg.attributes
+}
+
+// Timestamp is a time in an Event life-cycle.
+func (cfg *EventConfig) Timestamp() time.Time {
+	return cfg.timestamp
+}
+
+// StackTrace checks whether stack trace capturing is enabled.
+func (cfg *EventConfig) StackTrace() bool {
+	return cfg.stackTrace
+}
+
+// NewEventConfig applies all the EventOptions to a returned EventConfig. If no
+// timestamp option is passed, the returned EventConfig will have a Timestamp
+// set to the call time, otherwise no validation is performed on the returned
+// EventConfig.
+func NewEventConfig(options ...EventOption) EventConfig {
+	var c EventConfig
+	for _, option := range options {
+		c = option.applyEvent(c)
+	}
+	if c.timestamp.IsZero() {
+		c.timestamp = time.Now()
+	}
+	return c
+}
+
+// EventOption applies span event options to an EventConfig.
+type EventOption interface {
+	applyEvent(EventConfig) EventConfig
+}
+
+// SpanOption are options that can be used at both the beginning and end of a span.
+type SpanOption interface {
+	SpanStartOption
+	SpanEndOption
+}
+
+// SpanStartEventOption are options that can be used at the start of a span, or with an event.
+type SpanStartEventOption interface {
+	SpanStartOption
+	EventOption
+}
+
+// SpanEndEventOption are options that can be used at the end of a span, or with an event.
+type SpanEndEventOption interface {
+	SpanEndOption
+	EventOption
+}
+
+type attributeOption []attribute.KeyValue
+
+func (o attributeOption) applySpan(c SpanConfig) SpanConfig {
+	c.attributes = append(c.attributes, []attribute.KeyValue(o)...)
+	return c
+}
+func (o attributeOption) applySpanStart(c SpanConfig) SpanConfig { return o.applySpan(c) }
+func (o attributeOption) applyEvent(c EventConfig) EventConfig {
+	c.attributes = append(c.attributes, []attribute.KeyValue(o)...)
+	return c
+}
+
+var _ SpanStartEventOption = attributeOption{}
+
+// WithAttributes adds the attributes related to a span life-cycle event.
+// These attributes are used to describe the work a Span represents when this
+// option is provided to a Span's start or end events. Otherwise, these
+// attributes provide additional information about the event being recorded
+// (e.g. error, state change, processing progress, system event).
+//
+// If multiple of these options are passed the attributes of each successive
+// option will extend the attributes instead of overwriting. There is no
+// guarantee of uniqueness in the resulting attributes.
+func WithAttributes(attributes ...attribute.KeyValue) SpanStartEventOption {
+	return attributeOption(attributes)
+}
+
+// SpanEventOption are options that can be used with an event or a span.
+type SpanEventOption interface {
+	SpanOption
+	EventOption
+}
+
+type timestampOption time.Time
+
+func (o timestampOption) applySpan(c SpanConfig) SpanConfig {
+	c.timestamp = time.Time(o)
+	return c
+}
+func (o timestampOption) applySpanStart(c SpanConfig) SpanConfig { return o.applySpan(c) }
+func (o timestampOption) applySpanEnd(c SpanConfig) SpanConfig   { return o.applySpan(c) }
+func (o timestampOption) applyEvent(c EventConfig) EventConfig {
+	c.timestamp = time.Time(o)
+	return c
+}
+
+var _ SpanEventOption = timestampOption{}
+
+// WithTimestamp sets the time of a Span or Event life-cycle moment (e.g.
+// started, stopped, errored).
+func WithTimestamp(t time.Time) SpanEventOption {
+	return timestampOption(t)
+}
+
+type stackTraceOption bool
+
+func (o stackTraceOption) applyEvent(c EventConfig) EventConfig {
+	c.stackTrace = bool(o)
+	return c
+}
+func (o stackTraceOption) applySpan(c SpanConfig) SpanConfig {
+	c.stackTrace = bool(o)
+	return c
+}
+func (o stackTraceOption) applySpanEnd(c SpanConfig) SpanConfig { return o.applySpan(c) }
+
+// WithStackTrace sets the flag to capture the error with stack trace (e.g. true, false).
+func WithStackTrace(b bool) SpanEndEventOption {
+	return stackTraceOption(b)
+}
+
+// WithLinks adds links to a Span. The links are added to the existing Span
+// links, i.e. this does not overwrite. Links with invalid span context are ignored.
+func WithLinks(links ...Link) SpanStartOption {
+	return spanOptionFunc(func(cfg SpanConfig) SpanConfig {
+		cfg.links = append(cfg.links, links...)
+		return cfg
+	})
+}
+
+// WithNewRoot specifies that the Span should be treated as a root Span. Any
+// existing parent span context will be ignored when defining the Span's trace
+// identifiers.
+func WithNewRoot() SpanStartOption {
+	return spanOptionFunc(func(cfg SpanConfig) SpanConfig {
+		cfg.newRoot = true
+		return cfg
+	})
+}
+
+// WithSpanKind sets the SpanKind of a Span.
+func WithSpanKind(kind SpanKind) SpanStartOption {
+	return spanOptionFunc(func(cfg SpanConfig) SpanConfig {
+		cfg.spanKind = kind
+		return cfg
+	})
+}
+
+// WithInstrumentationVersion sets the instrumentation version.
+func WithInstrumentationVersion(version string) TracerOption {
+	return tracerOptionFunc(func(cfg TracerConfig) TracerConfig {
+		cfg.instrumentationVersion = version
+		return cfg
+	})
+}
+
+// WithInstrumentationAttributes sets the instrumentation attributes.
+//
+// The passed attributes will be de-duplicated.
+func WithInstrumentationAttributes(attr ...attribute.KeyValue) TracerOption {
+	return tracerOptionFunc(func(config TracerConfig) TracerConfig {
+		config.attrs = attribute.NewSet(attr...)
+		return config
+	})
+}
+
+// WithSchemaURL sets the schema URL for the Tracer.
+func WithSchemaURL(schemaURL string) TracerOption {
+	return tracerOptionFunc(func(cfg TracerConfig) TracerConfig {
+		cfg.schemaURL = schemaURL
+		return cfg
+	})
+}
diff --git a/vendor/go.opentelemetry.io/otel/trace/context.go b/vendor/go.opentelemetry.io/otel/trace/context.go
new file mode 100644
index 0000000000..76f9a083c4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/context.go
@@ -0,0 +1,61 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/trace"
+
+import "context"
+
+type traceContextKeyType int
+
+const currentSpanKey traceContextKeyType = iota
+
+// ContextWithSpan returns a copy of parent with span set as the current Span.
+func ContextWithSpan(parent context.Context, span Span) context.Context {
+	return context.WithValue(parent, currentSpanKey, span)
+}
+
+// ContextWithSpanContext returns a copy of parent with sc as the current
+// Span. The Span implementation that wraps sc is non-recording and performs
+// no operations other than to return sc as the SpanContext from the
+// SpanContext method.
+func ContextWithSpanContext(parent context.Context, sc SpanContext) context.Context {
+	return ContextWithSpan(parent, nonRecordingSpan{sc: sc})
+}
+
+// ContextWithRemoteSpanContext returns a copy of parent with rsc set explicly
+// as a remote SpanContext and as the current Span. The Span implementation
+// that wraps rsc is non-recording and performs no operations other than to
+// return rsc as the SpanContext from the SpanContext method.
+func ContextWithRemoteSpanContext(parent context.Context, rsc SpanContext) context.Context {
+	return ContextWithSpanContext(parent, rsc.WithRemote(true))
+}
+
+// SpanFromContext returns the current Span from ctx.
+//
+// If no Span is currently set in ctx an implementation of a Span that
+// performs no operations is returned.
+func SpanFromContext(ctx context.Context) Span {
+	if ctx == nil {
+		return noopSpan{}
+	}
+	if span, ok := ctx.Value(currentSpanKey).(Span); ok {
+		return span
+	}
+	return noopSpan{}
+}
+
+// SpanContextFromContext returns the current Span's SpanContext.
+func SpanContextFromContext(ctx context.Context) SpanContext {
+	return SpanFromContext(ctx).SpanContext()
+}
diff --git a/vendor/go.opentelemetry.io/otel/trace/doc.go b/vendor/go.opentelemetry.io/otel/trace/doc.go
new file mode 100644
index 0000000000..ab0346f966
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/doc.go
@@ -0,0 +1,66 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Package trace provides an implementation of the tracing part of the
+OpenTelemetry API.
+
+To participate in distributed traces a Span needs to be created for the
+operation being performed as part of a traced workflow. In its simplest form:
+
+	var tracer trace.Tracer
+
+	func init() {
+		tracer = otel.Tracer("instrumentation/package/name")
+	}
+
+	func operation(ctx context.Context) {
+		var span trace.Span
+		ctx, span = tracer.Start(ctx, "operation")
+		defer span.End()
+		// ...
+	}
+
+A Tracer is unique to the instrumentation and is used to create Spans.
+Instrumentation should be designed to accept a TracerProvider from which it
+can create its own unique Tracer. Alternatively, the registered global
+TracerProvider from the go.opentelemetry.io/otel package can be used as
+a default.
+
+	const (
+		name    = "instrumentation/package/name"
+		version = "0.1.0"
+	)
+
+	type Instrumentation struct {
+		tracer trace.Tracer
+	}
+
+	func NewInstrumentation(tp trace.TracerProvider) *Instrumentation {
+		if tp == nil {
+			tp = otel.TracerProvider()
+		}
+		return &Instrumentation{
+			tracer: tp.Tracer(name, trace.WithInstrumentationVersion(version)),
+		}
+	}
+
+	func operation(ctx context.Context, inst *Instrumentation) {
+		var span trace.Span
+		ctx, span = inst.tracer.Start(ctx, "operation")
+		defer span.End()
+		// ...
+	}
+*/
+package trace // import "go.opentelemetry.io/otel/trace"
diff --git a/vendor/go.opentelemetry.io/otel/trace/nonrecording.go b/vendor/go.opentelemetry.io/otel/trace/nonrecording.go
new file mode 100644
index 0000000000..88fcb81611
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/nonrecording.go
@@ -0,0 +1,27 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/trace"
+
+// nonRecordingSpan is a minimal implementation of a Span that wraps a
+// SpanContext. It performs no operations other than to return the wrapped
+// SpanContext.
+type nonRecordingSpan struct {
+	noopSpan
+
+	sc SpanContext
+}
+
+// SpanContext returns the wrapped SpanContext.
+func (s nonRecordingSpan) SpanContext() SpanContext { return s.sc }
diff --git a/vendor/go.opentelemetry.io/otel/trace/noop.go b/vendor/go.opentelemetry.io/otel/trace/noop.go
new file mode 100644
index 0000000000..73950f2077
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/noop.go
@@ -0,0 +1,89 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/trace"
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+)
+
+// NewNoopTracerProvider returns an implementation of TracerProvider that
+// performs no operations. The Tracer and Spans created from the returned
+// TracerProvider also perform no operations.
+func NewNoopTracerProvider() TracerProvider {
+	return noopTracerProvider{}
+}
+
+type noopTracerProvider struct{}
+
+var _ TracerProvider = noopTracerProvider{}
+
+// Tracer returns noop implementation of Tracer.
+func (p noopTracerProvider) Tracer(string, ...TracerOption) Tracer {
+	return noopTracer{}
+}
+
+// noopTracer is an implementation of Tracer that preforms no operations.
+type noopTracer struct{}
+
+var _ Tracer = noopTracer{}
+
+// Start carries forward a non-recording Span, if one is present in the context, otherwise it
+// creates a no-op Span.
+func (t noopTracer) Start(ctx context.Context, name string, _ ...SpanStartOption) (context.Context, Span) {
+	span := SpanFromContext(ctx)
+	if _, ok := span.(nonRecordingSpan); !ok {
+		// span is likely already a noopSpan, but let's be sure
+		span = noopSpan{}
+	}
+	return ContextWithSpan(ctx, span), span
+}
+
+// noopSpan is an implementation of Span that preforms no operations.
+type noopSpan struct{}
+
+var _ Span = noopSpan{}
+
+// SpanContext returns an empty span context.
+func (noopSpan) SpanContext() SpanContext { return SpanContext{} }
+
+// IsRecording always returns false.
+func (noopSpan) IsRecording() bool { return false }
+
+// SetStatus does nothing.
+func (noopSpan) SetStatus(codes.Code, string) {}
+
+// SetError does nothing.
+func (noopSpan) SetError(bool) {}
+
+// SetAttributes does nothing.
+func (noopSpan) SetAttributes(...attribute.KeyValue) {}
+
+// End does nothing.
+func (noopSpan) End(...SpanEndOption) {}
+
+// RecordError does nothing.
+func (noopSpan) RecordError(error, ...EventOption) {}
+
+// AddEvent does nothing.
+func (noopSpan) AddEvent(string, ...EventOption) {}
+
+// SetName does nothing.
+func (noopSpan) SetName(string) {}
+
+// TracerProvider returns a no-op TracerProvider.
+func (noopSpan) TracerProvider() TracerProvider { return noopTracerProvider{} }
diff --git a/vendor/go.opentelemetry.io/otel/trace/trace.go b/vendor/go.opentelemetry.io/otel/trace/trace.go
new file mode 100644
index 0000000000..4aa94f79f4
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/trace.go
@@ -0,0 +1,551 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/trace"
+
+import (
+	"bytes"
+	"context"
+	"encoding/hex"
+	"encoding/json"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+)
+
+const (
+	// FlagsSampled is a bitmask with the sampled bit set. A SpanContext
+	// with the sampling bit set means the span is sampled.
+	FlagsSampled = TraceFlags(0x01)
+
+	errInvalidHexID errorConst = "trace-id and span-id can only contain [0-9a-f] characters, all lowercase"
+
+	errInvalidTraceIDLength errorConst = "hex encoded trace-id must have length equals to 32"
+	errNilTraceID           errorConst = "trace-id can't be all zero"
+
+	errInvalidSpanIDLength errorConst = "hex encoded span-id must have length equals to 16"
+	errNilSpanID           errorConst = "span-id can't be all zero"
+)
+
+type errorConst string
+
+func (e errorConst) Error() string {
+	return string(e)
+}
+
+// TraceID is a unique identity of a trace.
+// nolint:revive // revive complains about stutter of `trace.TraceID`.
+type TraceID [16]byte
+
+var nilTraceID TraceID
+var _ json.Marshaler = nilTraceID
+
+// IsValid checks whether the trace TraceID is valid. A valid trace ID does
+// not consist of zeros only.
+func (t TraceID) IsValid() bool {
+	return !bytes.Equal(t[:], nilTraceID[:])
+}
+
+// MarshalJSON implements a custom marshal function to encode TraceID
+// as a hex string.
+func (t TraceID) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.String())
+}
+
+// String returns the hex string representation form of a TraceID.
+func (t TraceID) String() string {
+	return hex.EncodeToString(t[:])
+}
+
+// SpanID is a unique identity of a span in a trace.
+type SpanID [8]byte
+
+var nilSpanID SpanID
+var _ json.Marshaler = nilSpanID
+
+// IsValid checks whether the SpanID is valid. A valid SpanID does not consist
+// of zeros only.
+func (s SpanID) IsValid() bool {
+	return !bytes.Equal(s[:], nilSpanID[:])
+}
+
+// MarshalJSON implements a custom marshal function to encode SpanID
+// as a hex string.
+func (s SpanID) MarshalJSON() ([]byte, error) {
+	return json.Marshal(s.String())
+}
+
+// String returns the hex string representation form of a SpanID.
+func (s SpanID) String() string {
+	return hex.EncodeToString(s[:])
+}
+
+// TraceIDFromHex returns a TraceID from a hex string if it is compliant with
+// the W3C trace-context specification.  See more at
+// https://www.w3.org/TR/trace-context/#trace-id
+// nolint:revive // revive complains about stutter of `trace.TraceIDFromHex`.
+func TraceIDFromHex(h string) (TraceID, error) {
+	t := TraceID{}
+	if len(h) != 32 {
+		return t, errInvalidTraceIDLength
+	}
+
+	if err := decodeHex(h, t[:]); err != nil {
+		return t, err
+	}
+
+	if !t.IsValid() {
+		return t, errNilTraceID
+	}
+	return t, nil
+}
+
+// SpanIDFromHex returns a SpanID from a hex string if it is compliant
+// with the w3c trace-context specification.
+// See more at https://www.w3.org/TR/trace-context/#parent-id
+func SpanIDFromHex(h string) (SpanID, error) {
+	s := SpanID{}
+	if len(h) != 16 {
+		return s, errInvalidSpanIDLength
+	}
+
+	if err := decodeHex(h, s[:]); err != nil {
+		return s, err
+	}
+
+	if !s.IsValid() {
+		return s, errNilSpanID
+	}
+	return s, nil
+}
+
+func decodeHex(h string, b []byte) error {
+	for _, r := range h {
+		switch {
+		case 'a' <= r && r <= 'f':
+			continue
+		case '0' <= r && r <= '9':
+			continue
+		default:
+			return errInvalidHexID
+		}
+	}
+
+	decoded, err := hex.DecodeString(h)
+	if err != nil {
+		return err
+	}
+
+	copy(b, decoded)
+	return nil
+}
+
+// TraceFlags contains flags that can be set on a SpanContext.
+type TraceFlags byte //nolint:revive // revive complains about stutter of `trace.TraceFlags`.
+
+// IsSampled returns if the sampling bit is set in the TraceFlags.
+func (tf TraceFlags) IsSampled() bool {
+	return tf&FlagsSampled == FlagsSampled
+}
+
+// WithSampled sets the sampling bit in a new copy of the TraceFlags.
+func (tf TraceFlags) WithSampled(sampled bool) TraceFlags { // nolint:revive  // sampled is not a control flag.
+	if sampled {
+		return tf | FlagsSampled
+	}
+
+	return tf &^ FlagsSampled
+}
+
+// MarshalJSON implements a custom marshal function to encode TraceFlags
+// as a hex string.
+func (tf TraceFlags) MarshalJSON() ([]byte, error) {
+	return json.Marshal(tf.String())
+}
+
+// String returns the hex string representation form of TraceFlags.
+func (tf TraceFlags) String() string {
+	return hex.EncodeToString([]byte{byte(tf)}[:])
+}
+
+// SpanContextConfig contains mutable fields usable for constructing
+// an immutable SpanContext.
+type SpanContextConfig struct {
+	TraceID    TraceID
+	SpanID     SpanID
+	TraceFlags TraceFlags
+	TraceState TraceState
+	Remote     bool
+}
+
+// NewSpanContext constructs a SpanContext using values from the provided
+// SpanContextConfig.
+func NewSpanContext(config SpanContextConfig) SpanContext {
+	return SpanContext{
+		traceID:    config.TraceID,
+		spanID:     config.SpanID,
+		traceFlags: config.TraceFlags,
+		traceState: config.TraceState,
+		remote:     config.Remote,
+	}
+}
+
+// SpanContext contains identifying trace information about a Span.
+type SpanContext struct {
+	traceID    TraceID
+	spanID     SpanID
+	traceFlags TraceFlags
+	traceState TraceState
+	remote     bool
+}
+
+var _ json.Marshaler = SpanContext{}
+
+// IsValid returns if the SpanContext is valid. A valid span context has a
+// valid TraceID and SpanID.
+func (sc SpanContext) IsValid() bool {
+	return sc.HasTraceID() && sc.HasSpanID()
+}
+
+// IsRemote indicates whether the SpanContext represents a remotely-created Span.
+func (sc SpanContext) IsRemote() bool {
+	return sc.remote
+}
+
+// WithRemote returns a copy of sc with the Remote property set to remote.
+func (sc SpanContext) WithRemote(remote bool) SpanContext {
+	return SpanContext{
+		traceID:    sc.traceID,
+		spanID:     sc.spanID,
+		traceFlags: sc.traceFlags,
+		traceState: sc.traceState,
+		remote:     remote,
+	}
+}
+
+// TraceID returns the TraceID from the SpanContext.
+func (sc SpanContext) TraceID() TraceID {
+	return sc.traceID
+}
+
+// HasTraceID checks if the SpanContext has a valid TraceID.
+func (sc SpanContext) HasTraceID() bool {
+	return sc.traceID.IsValid()
+}
+
+// WithTraceID returns a new SpanContext with the TraceID replaced.
+func (sc SpanContext) WithTraceID(traceID TraceID) SpanContext {
+	return SpanContext{
+		traceID:    traceID,
+		spanID:     sc.spanID,
+		traceFlags: sc.traceFlags,
+		traceState: sc.traceState,
+		remote:     sc.remote,
+	}
+}
+
+// SpanID returns the SpanID from the SpanContext.
+func (sc SpanContext) SpanID() SpanID {
+	return sc.spanID
+}
+
+// HasSpanID checks if the SpanContext has a valid SpanID.
+func (sc SpanContext) HasSpanID() bool {
+	return sc.spanID.IsValid()
+}
+
+// WithSpanID returns a new SpanContext with the SpanID replaced.
+func (sc SpanContext) WithSpanID(spanID SpanID) SpanContext {
+	return SpanContext{
+		traceID:    sc.traceID,
+		spanID:     spanID,
+		traceFlags: sc.traceFlags,
+		traceState: sc.traceState,
+		remote:     sc.remote,
+	}
+}
+
+// TraceFlags returns the flags from the SpanContext.
+func (sc SpanContext) TraceFlags() TraceFlags {
+	return sc.traceFlags
+}
+
+// IsSampled returns if the sampling bit is set in the SpanContext's TraceFlags.
+func (sc SpanContext) IsSampled() bool {
+	return sc.traceFlags.IsSampled()
+}
+
+// WithTraceFlags returns a new SpanContext with the TraceFlags replaced.
+func (sc SpanContext) WithTraceFlags(flags TraceFlags) SpanContext {
+	return SpanContext{
+		traceID:    sc.traceID,
+		spanID:     sc.spanID,
+		traceFlags: flags,
+		traceState: sc.traceState,
+		remote:     sc.remote,
+	}
+}
+
+// TraceState returns the TraceState from the SpanContext.
+func (sc SpanContext) TraceState() TraceState {
+	return sc.traceState
+}
+
+// WithTraceState returns a new SpanContext with the TraceState replaced.
+func (sc SpanContext) WithTraceState(state TraceState) SpanContext {
+	return SpanContext{
+		traceID:    sc.traceID,
+		spanID:     sc.spanID,
+		traceFlags: sc.traceFlags,
+		traceState: state,
+		remote:     sc.remote,
+	}
+}
+
+// Equal is a predicate that determines whether two SpanContext values are equal.
+func (sc SpanContext) Equal(other SpanContext) bool {
+	return sc.traceID == other.traceID &&
+		sc.spanID == other.spanID &&
+		sc.traceFlags == other.traceFlags &&
+		sc.traceState.String() == other.traceState.String() &&
+		sc.remote == other.remote
+}
+
+// MarshalJSON implements a custom marshal function to encode a SpanContext.
+func (sc SpanContext) MarshalJSON() ([]byte, error) {
+	return json.Marshal(SpanContextConfig{
+		TraceID:    sc.traceID,
+		SpanID:     sc.spanID,
+		TraceFlags: sc.traceFlags,
+		TraceState: sc.traceState,
+		Remote:     sc.remote,
+	})
+}
+
+// Span is the individual component of a trace. It represents a single named
+// and timed operation of a workflow that is traced. A Tracer is used to
+// create a Span and it is then up to the operation the Span represents to
+// properly end the Span when the operation itself ends.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Span interface {
+	// End completes the Span. The Span is considered complete and ready to be
+	// delivered through the rest of the telemetry pipeline after this method
+	// is called. Therefore, updates to the Span are not allowed after this
+	// method has been called.
+	End(options ...SpanEndOption)
+
+	// AddEvent adds an event with the provided name and options.
+	AddEvent(name string, options ...EventOption)
+
+	// IsRecording returns the recording state of the Span. It will return
+	// true if the Span is active and events can be recorded.
+	IsRecording() bool
+
+	// RecordError will record err as an exception span event for this span. An
+	// additional call to SetStatus is required if the Status of the Span should
+	// be set to Error, as this method does not change the Span status. If this
+	// span is not being recorded or err is nil then this method does nothing.
+	RecordError(err error, options ...EventOption)
+
+	// SpanContext returns the SpanContext of the Span. The returned SpanContext
+	// is usable even after the End method has been called for the Span.
+	SpanContext() SpanContext
+
+	// SetStatus sets the status of the Span in the form of a code and a
+	// description, provided the status hasn't already been set to a higher
+	// value before (OK > Error > Unset). The description is only included in a
+	// status when the code is for an error.
+	SetStatus(code codes.Code, description string)
+
+	// SetName sets the Span name.
+	SetName(name string)
+
+	// SetAttributes sets kv as attributes of the Span. If a key from kv
+	// already exists for an attribute of the Span it will be overwritten with
+	// the value contained in kv.
+	SetAttributes(kv ...attribute.KeyValue)
+
+	// TracerProvider returns a TracerProvider that can be used to generate
+	// additional Spans on the same telemetry pipeline as the current Span.
+	TracerProvider() TracerProvider
+}
+
+// Link is the relationship between two Spans. The relationship can be within
+// the same Trace or across different Traces.
+//
+// For example, a Link is used in the following situations:
+//
+//  1. Batch Processing: A batch of operations may contain operations
+//     associated with one or more traces/spans. Since there can only be one
+//     parent SpanContext, a Link is used to keep reference to the
+//     SpanContext of all operations in the batch.
+//  2. Public Endpoint: A SpanContext for an in incoming client request on a
+//     public endpoint should be considered untrusted. In such a case, a new
+//     trace with its own identity and sampling decision needs to be created,
+//     but this new trace needs to be related to the original trace in some
+//     form. A Link is used to keep reference to the original SpanContext and
+//     track the relationship.
+type Link struct {
+	// SpanContext of the linked Span.
+	SpanContext SpanContext
+
+	// Attributes describe the aspects of the link.
+	Attributes []attribute.KeyValue
+}
+
+// LinkFromContext returns a link encapsulating the SpanContext in the provided ctx.
+func LinkFromContext(ctx context.Context, attrs ...attribute.KeyValue) Link {
+	return Link{
+		SpanContext: SpanContextFromContext(ctx),
+		Attributes:  attrs,
+	}
+}
+
+// SpanKind is the role a Span plays in a Trace.
+type SpanKind int
+
+// As a convenience, these match the proto definition, see
+// https://github.com/open-telemetry/opentelemetry-proto/blob/30d237e1ff3ab7aa50e0922b5bebdd93505090af/opentelemetry/proto/trace/v1/trace.proto#L101-L129
+//
+// The unspecified value is not a valid `SpanKind`. Use `ValidateSpanKind()`
+// to coerce a span kind to a valid value.
+const (
+	// SpanKindUnspecified is an unspecified SpanKind and is not a valid
+	// SpanKind. SpanKindUnspecified should be replaced with SpanKindInternal
+	// if it is received.
+	SpanKindUnspecified SpanKind = 0
+	// SpanKindInternal is a SpanKind for a Span that represents an internal
+	// operation within an application.
+	SpanKindInternal SpanKind = 1
+	// SpanKindServer is a SpanKind for a Span that represents the operation
+	// of handling a request from a client.
+	SpanKindServer SpanKind = 2
+	// SpanKindClient is a SpanKind for a Span that represents the operation
+	// of client making a request to a server.
+	SpanKindClient SpanKind = 3
+	// SpanKindProducer is a SpanKind for a Span that represents the operation
+	// of a producer sending a message to a message broker. Unlike
+	// SpanKindClient and SpanKindServer, there is often no direct
+	// relationship between this kind of Span and a SpanKindConsumer kind. A
+	// SpanKindProducer Span will end once the message is accepted by the
+	// message broker which might not overlap with the processing of that
+	// message.
+	SpanKindProducer SpanKind = 4
+	// SpanKindConsumer is a SpanKind for a Span that represents the operation
+	// of a consumer receiving a message from a message broker. Like
+	// SpanKindProducer Spans, there is often no direct relationship between
+	// this Span and the Span that produced the message.
+	SpanKindConsumer SpanKind = 5
+)
+
+// ValidateSpanKind returns a valid span kind value.  This will coerce
+// invalid values into the default value, SpanKindInternal.
+func ValidateSpanKind(spanKind SpanKind) SpanKind {
+	switch spanKind {
+	case SpanKindInternal,
+		SpanKindServer,
+		SpanKindClient,
+		SpanKindProducer,
+		SpanKindConsumer:
+		// valid
+		return spanKind
+	default:
+		return SpanKindInternal
+	}
+}
+
+// String returns the specified name of the SpanKind in lower-case.
+func (sk SpanKind) String() string {
+	switch sk {
+	case SpanKindInternal:
+		return "internal"
+	case SpanKindServer:
+		return "server"
+	case SpanKindClient:
+		return "client"
+	case SpanKindProducer:
+		return "producer"
+	case SpanKindConsumer:
+		return "consumer"
+	default:
+		return "unspecified"
+	}
+}
+
+// Tracer is the creator of Spans.
+//
+// Warning: methods may be added to this interface in minor releases.
+type Tracer interface {
+	// Start creates a span and a context.Context containing the newly-created span.
+	//
+	// If the context.Context provided in `ctx` contains a Span then the newly-created
+	// Span will be a child of that span, otherwise it will be a root span. This behavior
+	// can be overridden by providing `WithNewRoot()` as a SpanOption, causing the
+	// newly-created Span to be a root span even if `ctx` contains a Span.
+	//
+	// When creating a Span it is recommended to provide all known span attributes using
+	// the `WithAttributes()` SpanOption as samplers will only have access to the
+	// attributes provided when a Span is created.
+	//
+	// Any Span that is created MUST also be ended. This is the responsibility of the user.
+	// Implementations of this API may leak memory or other resources if Spans are not ended.
+	Start(ctx context.Context, spanName string, opts ...SpanStartOption) (context.Context, Span)
+}
+
+// TracerProvider provides Tracers that are used by instrumentation code to
+// trace computational workflows.
+//
+// A TracerProvider is the collection destination of all Spans from Tracers it
+// provides, it represents a unique telemetry collection pipeline. How that
+// pipeline is defined, meaning how those Spans are collected, processed, and
+// where they are exported, depends on its implementation. Instrumentation
+// authors do not need to define this implementation, rather just use the
+// provided Tracers to instrument code.
+//
+// Commonly, instrumentation code will accept a TracerProvider implementation
+// at runtime from its users or it can simply use the globally registered one
+// (see https://pkg.go.dev/go.opentelemetry.io/otel#GetTracerProvider).
+//
+// Warning: methods may be added to this interface in minor releases.
+type TracerProvider interface {
+	// Tracer returns a unique Tracer scoped to be used by instrumentation code
+	// to trace computational workflows. The scope and identity of that
+	// instrumentation code is uniquely defined by the name and options passed.
+	//
+	// The passed name needs to uniquely identify instrumentation code.
+	// Therefore, it is recommended that name is the Go package name of the
+	// library providing instrumentation (note: not the code being
+	// instrumented). Instrumentation libraries can have multiple versions,
+	// therefore, the WithInstrumentationVersion option should be used to
+	// distinguish these different codebases. Additionally, instrumentation
+	// libraries may sometimes use traces to communicate different domains of
+	// workflow data (i.e. using spans to communicate workflow events only). If
+	// this is the case, the WithScopeAttributes option should be used to
+	// uniquely identify Tracers that handle the different domains of workflow
+	// data.
+	//
+	// If the same name and options are passed multiple times, the same Tracer
+	// will be returned (it is up to the implementation if this will be the
+	// same underlying instance of that Tracer or not). It is not necessary to
+	// call this multiple times with the same name and options to get an
+	// up-to-date Tracer. All implementations will ensure any TracerProvider
+	// configuration changes are propagated to all provided Tracers.
+	//
+	// If name is empty, then an implementation defined default name will be
+	// used instead.
+	//
+	// This method is safe to call concurrently.
+	Tracer(name string, options ...TracerOption) Tracer
+}
diff --git a/vendor/go.opentelemetry.io/otel/trace/tracestate.go b/vendor/go.opentelemetry.io/otel/trace/tracestate.go
new file mode 100644
index 0000000000..ca68a82e5f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/trace/tracestate.go
@@ -0,0 +1,212 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package trace // import "go.opentelemetry.io/otel/trace"
+
+import (
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+const (
+	maxListMembers = 32
+
+	listDelimiter = ","
+
+	// based on the W3C Trace Context specification, see
+	// https://www.w3.org/TR/trace-context-1/#tracestate-header
+	noTenantKeyFormat   = `[a-z][_0-9a-z\-\*\/]{0,255}`
+	withTenantKeyFormat = `[a-z0-9][_0-9a-z\-\*\/]{0,240}@[a-z][_0-9a-z\-\*\/]{0,13}`
+	valueFormat         = `[\x20-\x2b\x2d-\x3c\x3e-\x7e]{0,255}[\x21-\x2b\x2d-\x3c\x3e-\x7e]`
+
+	errInvalidKey    errorConst = "invalid tracestate key"
+	errInvalidValue  errorConst = "invalid tracestate value"
+	errInvalidMember errorConst = "invalid tracestate list-member"
+	errMemberNumber  errorConst = "too many list-members in tracestate"
+	errDuplicate     errorConst = "duplicate list-member in tracestate"
+)
+
+var (
+	keyRe    = regexp.MustCompile(`^((` + noTenantKeyFormat + `)|(` + withTenantKeyFormat + `))$`)
+	valueRe  = regexp.MustCompile(`^(` + valueFormat + `)$`)
+	memberRe = regexp.MustCompile(`^\s*((` + noTenantKeyFormat + `)|(` + withTenantKeyFormat + `))=(` + valueFormat + `)\s*$`)
+)
+
+type member struct {
+	Key   string
+	Value string
+}
+
+func newMember(key, value string) (member, error) {
+	if !keyRe.MatchString(key) {
+		return member{}, fmt.Errorf("%w: %s", errInvalidKey, key)
+	}
+	if !valueRe.MatchString(value) {
+		return member{}, fmt.Errorf("%w: %s", errInvalidValue, value)
+	}
+	return member{Key: key, Value: value}, nil
+}
+
+func parseMember(m string) (member, error) {
+	matches := memberRe.FindStringSubmatch(m)
+	if len(matches) != 5 {
+		return member{}, fmt.Errorf("%w: %s", errInvalidMember, m)
+	}
+
+	return member{
+		Key:   matches[1],
+		Value: matches[4],
+	}, nil
+}
+
+// String encodes member into a string compliant with the W3C Trace Context
+// specification.
+func (m member) String() string {
+	return fmt.Sprintf("%s=%s", m.Key, m.Value)
+}
+
+// TraceState provides additional vendor-specific trace identification
+// information across different distributed tracing systems. It represents an
+// immutable list consisting of key/value pairs, each pair is referred to as a
+// list-member.
+//
+// TraceState conforms to the W3C Trace Context specification
+// (https://www.w3.org/TR/trace-context-1). All operations that create or copy
+// a TraceState do so by validating all input and will only produce TraceState
+// that conform to the specification. Specifically, this means that all
+// list-member's key/value pairs are valid, no duplicate list-members exist,
+// and the maximum number of list-members (32) is not exceeded.
+type TraceState struct { //nolint:revive // revive complains about stutter of `trace.TraceState`
+	// list is the members in order.
+	list []member
+}
+
+var _ json.Marshaler = TraceState{}
+
+// ParseTraceState attempts to decode a TraceState from the passed
+// string. It returns an error if the input is invalid according to the W3C
+// Trace Context specification.
+func ParseTraceState(tracestate string) (TraceState, error) {
+	if tracestate == "" {
+		return TraceState{}, nil
+	}
+
+	wrapErr := func(err error) error {
+		return fmt.Errorf("failed to parse tracestate: %w", err)
+	}
+
+	var members []member
+	found := make(map[string]struct{})
+	for _, memberStr := range strings.Split(tracestate, listDelimiter) {
+		if len(memberStr) == 0 {
+			continue
+		}
+
+		m, err := parseMember(memberStr)
+		if err != nil {
+			return TraceState{}, wrapErr(err)
+		}
+
+		if _, ok := found[m.Key]; ok {
+			return TraceState{}, wrapErr(errDuplicate)
+		}
+		found[m.Key] = struct{}{}
+
+		members = append(members, m)
+		if n := len(members); n > maxListMembers {
+			return TraceState{}, wrapErr(errMemberNumber)
+		}
+	}
+
+	return TraceState{list: members}, nil
+}
+
+// MarshalJSON marshals the TraceState into JSON.
+func (ts TraceState) MarshalJSON() ([]byte, error) {
+	return json.Marshal(ts.String())
+}
+
+// String encodes the TraceState into a string compliant with the W3C
+// Trace Context specification. The returned string will be invalid if the
+// TraceState contains any invalid members.
+func (ts TraceState) String() string {
+	members := make([]string, len(ts.list))
+	for i, m := range ts.list {
+		members[i] = m.String()
+	}
+	return strings.Join(members, listDelimiter)
+}
+
+// Get returns the value paired with key from the corresponding TraceState
+// list-member if it exists, otherwise an empty string is returned.
+func (ts TraceState) Get(key string) string {
+	for _, member := range ts.list {
+		if member.Key == key {
+			return member.Value
+		}
+	}
+
+	return ""
+}
+
+// Insert adds a new list-member defined by the key/value pair to the
+// TraceState. If a list-member already exists for the given key, that
+// list-member's value is updated. The new or updated list-member is always
+// moved to the beginning of the TraceState as specified by the W3C Trace
+// Context specification.
+//
+// If key or value are invalid according to the W3C Trace Context
+// specification an error is returned with the original TraceState.
+//
+// If adding a new list-member means the TraceState would have more members
+// then is allowed, the new list-member will be inserted and the right-most
+// list-member will be dropped in the returned TraceState.
+func (ts TraceState) Insert(key, value string) (TraceState, error) {
+	m, err := newMember(key, value)
+	if err != nil {
+		return ts, err
+	}
+
+	cTS := ts.Delete(key)
+	if cTS.Len()+1 <= maxListMembers {
+		cTS.list = append(cTS.list, member{})
+	}
+	// When the number of members exceeds capacity, drop the "right-most".
+	copy(cTS.list[1:], cTS.list)
+	cTS.list[0] = m
+
+	return cTS, nil
+}
+
+// Delete returns a copy of the TraceState with the list-member identified by
+// key removed.
+func (ts TraceState) Delete(key string) TraceState {
+	members := make([]member, ts.Len())
+	copy(members, ts.list)
+	for i, member := range ts.list {
+		if member.Key == key {
+			members = append(members[:i], members[i+1:]...)
+			// TraceState should contain no duplicate members.
+			break
+		}
+	}
+	return TraceState{list: members}
+}
+
+// Len returns the number of list-members in the TraceState.
+func (ts TraceState) Len() int {
+	return len(ts.list)
+}
diff --git a/vendor/go.opentelemetry.io/otel/verify_examples.sh b/vendor/go.opentelemetry.io/otel/verify_examples.sh
new file mode 100644
index 0000000000..dbb61a4227
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/verify_examples.sh
@@ -0,0 +1,85 @@
+#!/bin/bash
+
+# Copyright The OpenTelemetry Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+cd $(dirname $0)
+TOOLS_DIR=$(pwd)/.tools
+
+if [ -z "${GOPATH}" ] ; then
+	printf "GOPATH is not defined.\n"
+	exit -1
+fi
+
+if [ ! -d "${GOPATH}" ] ; then
+	printf "GOPATH ${GOPATH} is invalid \n"
+	exit -1
+fi
+
+# Pre-requisites
+if ! git diff --quiet; then \
+	git status
+	printf "\n\nError: working tree is not clean\n"
+	exit -1
+fi
+
+if [ "$(git tag --contains $(git log -1 --pretty=format:"%H"))" = "" ] ; then
+	printf "$(git log -1)"
+	printf "\n\nError: HEAD is not pointing to a tagged version"
+fi
+
+make ${TOOLS_DIR}/gojq
+
+DIR_TMP="${GOPATH}/src/oteltmp/"
+rm -rf $DIR_TMP
+mkdir -p $DIR_TMP
+
+printf "Copy examples to ${DIR_TMP}\n"
+cp -a ./example ${DIR_TMP}
+
+# Update go.mod files
+printf "Update go.mod: rename module and remove replace\n"
+
+PACKAGE_DIRS=$(find . -mindepth 2 -type f -name 'go.mod' -exec dirname {} \; | egrep 'example' | sed 's/^\.\///' | sort)
+
+for dir in $PACKAGE_DIRS; do
+	printf "  Update go.mod for $dir\n"
+	(cd "${DIR_TMP}/${dir}" && \
+	 # replaces is ("mod1" "mod2" …)
+	 replaces=($(go mod edit -json | ${TOOLS_DIR}/gojq '.Replace[].Old.Path')) && \
+	 # strip double quotes
+	 replaces=("${replaces[@]%\"}") && \
+	 replaces=("${replaces[@]#\"}") && \
+	 # make an array (-dropreplace=mod1 -dropreplace=mod2 …)
+	 dropreplaces=("${replaces[@]/#/-dropreplace=}") && \
+	 go mod edit -module "oteltmp/${dir}" "${dropreplaces[@]}" && \
+	 go mod tidy)
+done
+printf "Update done:\n\n"
+
+# Build directories that contain main package. These directories are different than
+# directories that contain go.mod files.
+printf "Build examples:\n"
+EXAMPLES=$(./get_main_pkgs.sh ./example)
+for ex in $EXAMPLES; do
+	printf "  Build $ex in ${DIR_TMP}/${ex}\n"
+	(cd "${DIR_TMP}/${ex}" && \
+	 go build .)
+done
+
+# Cleanup
+printf "Remove copied files.\n"
+rm -rf $DIR_TMP
diff --git a/vendor/go.opentelemetry.io/otel/version.go b/vendor/go.opentelemetry.io/otel/version.go
new file mode 100644
index 0000000000..0e8e5e0232
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/version.go
@@ -0,0 +1,20 @@
+// Copyright The OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package otel // import "go.opentelemetry.io/otel"
+
+// Version is the current release version of OpenTelemetry in use.
+func Version() string {
+	return "1.14.0"
+}
diff --git a/vendor/go.opentelemetry.io/otel/versions.yaml b/vendor/go.opentelemetry.io/otel/versions.yaml
new file mode 100644
index 0000000000..40df1fae41
--- /dev/null
+++ b/vendor/go.opentelemetry.io/otel/versions.yaml
@@ -0,0 +1,57 @@
+# Copyright The OpenTelemetry Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module-sets:
+  stable-v1:
+    version: v1.14.0
+    modules:
+      - go.opentelemetry.io/otel
+      - go.opentelemetry.io/otel/bridge/opentracing
+      - go.opentelemetry.io/otel/bridge/opentracing/test
+      - go.opentelemetry.io/otel/example/fib
+      - go.opentelemetry.io/otel/example/jaeger
+      - go.opentelemetry.io/otel/example/namedtracer
+      - go.opentelemetry.io/otel/example/otel-collector
+      - go.opentelemetry.io/otel/example/passthrough
+      - go.opentelemetry.io/otel/example/zipkin
+      - go.opentelemetry.io/otel/exporters/jaeger
+      - go.opentelemetry.io/otel/exporters/zipkin
+      - go.opentelemetry.io/otel/exporters/otlp/otlptrace
+      - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
+      - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
+      - go.opentelemetry.io/otel/exporters/otlp/internal/retry
+      - go.opentelemetry.io/otel/exporters/stdout/stdouttrace
+      - go.opentelemetry.io/otel/trace
+      - go.opentelemetry.io/otel/sdk
+  experimental-metrics:
+    version: v0.37.0
+    modules:
+      - go.opentelemetry.io/otel/example/opencensus
+      - go.opentelemetry.io/otel/example/prometheus
+      - go.opentelemetry.io/otel/exporters/otlp/otlpmetric
+      - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
+      - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
+      - go.opentelemetry.io/otel/exporters/prometheus
+      - go.opentelemetry.io/otel/exporters/stdout/stdoutmetric
+      - go.opentelemetry.io/otel/metric
+      - go.opentelemetry.io/otel/sdk/metric
+      - go.opentelemetry.io/otel/bridge/opencensus
+      - go.opentelemetry.io/otel/bridge/opencensus/test
+      - go.opentelemetry.io/otel/example/view
+  experimental-schema:
+    version: v0.0.4
+    modules:
+      - go.opentelemetry.io/otel/schema
+excluded-modules:
+  - go.opentelemetry.io/otel/internal/tools
diff --git a/vendor/go.opentelemetry.io/proto/otlp/LICENSE b/vendor/go.opentelemetry.io/proto/otlp/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.go b/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.go
new file mode 100644
index 0000000000..fc285c089e
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.go
@@ -0,0 +1,367 @@
+// Copyright 2019, OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.17.3
+// source: opentelemetry/proto/collector/trace/v1/trace_service.proto
+
+package v1
+
+import (
+	v1 "go.opentelemetry.io/proto/otlp/trace/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ExportTraceServiceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// An array of ResourceSpans.
+	// For data coming from a single resource this array will typically contain one
+	// element. Intermediary nodes (such as OpenTelemetry Collector) that receive
+	// data from multiple origins typically batch the data before forwarding further and
+	// in that case this array will contain multiple elements.
+	ResourceSpans []*v1.ResourceSpans `protobuf:"bytes,1,rep,name=resource_spans,json=resourceSpans,proto3" json:"resource_spans,omitempty"`
+}
+
+func (x *ExportTraceServiceRequest) Reset() {
+	*x = ExportTraceServiceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExportTraceServiceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExportTraceServiceRequest) ProtoMessage() {}
+
+func (x *ExportTraceServiceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExportTraceServiceRequest.ProtoReflect.Descriptor instead.
+func (*ExportTraceServiceRequest) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ExportTraceServiceRequest) GetResourceSpans() []*v1.ResourceSpans {
+	if x != nil {
+		return x.ResourceSpans
+	}
+	return nil
+}
+
+type ExportTraceServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The details of a partially successful export request.
+	//
+	// If the request is only partially accepted
+	// (i.e. when the server accepts only parts of the data and rejects the rest)
+	// the server MUST initialize the `partial_success` field and MUST
+	// set the `rejected_<signal>` with the number of items it rejected.
+	//
+	// Servers MAY also make use of the `partial_success` field to convey
+	// warnings/suggestions to senders even when the request was fully accepted.
+	// In such cases, the `rejected_<signal>` MUST have a value of `0` and
+	// the `error_message` MUST be non-empty.
+	//
+	// A `partial_success` message with an empty value (rejected_<signal> = 0 and
+	// `error_message` = "") is equivalent to it not being set/present. Senders
+	// SHOULD interpret it the same way as in the full success case.
+	PartialSuccess *ExportTracePartialSuccess `protobuf:"bytes,1,opt,name=partial_success,json=partialSuccess,proto3" json:"partial_success,omitempty"`
+}
+
+func (x *ExportTraceServiceResponse) Reset() {
+	*x = ExportTraceServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExportTraceServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExportTraceServiceResponse) ProtoMessage() {}
+
+func (x *ExportTraceServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExportTraceServiceResponse.ProtoReflect.Descriptor instead.
+func (*ExportTraceServiceResponse) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ExportTraceServiceResponse) GetPartialSuccess() *ExportTracePartialSuccess {
+	if x != nil {
+		return x.PartialSuccess
+	}
+	return nil
+}
+
+type ExportTracePartialSuccess struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The number of rejected spans.
+	//
+	// A `rejected_<signal>` field holding a `0` value indicates that the
+	// request was fully accepted.
+	RejectedSpans int64 `protobuf:"varint,1,opt,name=rejected_spans,json=rejectedSpans,proto3" json:"rejected_spans,omitempty"`
+	// A developer-facing human-readable message in English. It should be used
+	// either to explain why the server rejected parts of the data during a partial
+	// success or to convey warnings/suggestions during a full success. The message
+	// should offer guidance on how users can address such issues.
+	//
+	// error_message is an optional field. An error_message with an empty value
+	// is equivalent to it not being set.
+	ErrorMessage string `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
+}
+
+func (x *ExportTracePartialSuccess) Reset() {
+	*x = ExportTracePartialSuccess{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExportTracePartialSuccess) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExportTracePartialSuccess) ProtoMessage() {}
+
+func (x *ExportTracePartialSuccess) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExportTracePartialSuccess.ProtoReflect.Descriptor instead.
+func (*ExportTracePartialSuccess) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ExportTracePartialSuccess) GetRejectedSpans() int64 {
+	if x != nil {
+		return x.RejectedSpans
+	}
+	return 0
+}
+
+func (x *ExportTracePartialSuccess) GetErrorMessage() string {
+	if x != nil {
+		return x.ErrorMessage
+	}
+	return ""
+}
+
+var File_opentelemetry_proto_collector_trace_v1_trace_service_proto protoreflect.FileDescriptor
+
+var file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDesc = []byte{
+	0x0a, 0x3a, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x26, 0x6f, 0x70,
+	0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2e, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x2e, 0x76, 0x31, 0x1a, 0x28, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65,
+	0x74, 0x72, 0x79, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2f,
+	0x76, 0x31, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6f,
+	0x0a, 0x19, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x52, 0x0a, 0x0e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65,
+	0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73,
+	0x52, 0x0d, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x22,
+	0x88, 0x01, 0x0a, 0x1a, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6a,
+	0x0a, 0x0f, 0x70, 0x61, 0x72, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x41, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65,
+	0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f,
+	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x50, 0x61, 0x72, 0x74,
+	0x69, 0x61, 0x6c, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x70, 0x61, 0x72, 0x74,
+	0x69, 0x61, 0x6c, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x22, 0x67, 0x0a, 0x19, 0x45, 0x78,
+	0x70, 0x6f, 0x72, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x50, 0x61, 0x72, 0x74, 0x69, 0x61, 0x6c,
+	0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x72, 0x65, 0x6a, 0x65, 0x63,
+	0x74, 0x65, 0x64, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x0d, 0x72, 0x65, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x12, 0x23,
+	0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x32, 0xa2, 0x01, 0x0a, 0x0c, 0x54, 0x72, 0x61, 0x63, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x91, 0x01, 0x0a, 0x06, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x41, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x54,
+	0x72, 0x61, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x42, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74,
+	0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x78, 0x70, 0x6f,
+	0x72, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x9c, 0x01, 0x0a, 0x29, 0x69, 0x6f, 0x2e,
+	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x11, 0x54, 0x72, 0x61, 0x63, 0x65, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x31, 0x67, 0x6f, 0x2e,
+	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x69, 0x6f,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x6f, 0x74, 0x6c, 0x70, 0x2f, 0x63, 0x6f, 0x6c, 0x6c,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2f, 0x76, 0x31, 0xaa, 0x02,
+	0x26, 0x4f, 0x70, 0x65, 0x6e, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x54,
+	0x72, 0x61, 0x63, 0x65, 0x2e, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescOnce sync.Once
+	file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescData = file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDesc
+)
+
+func file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescGZIP() []byte {
+	file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescOnce.Do(func() {
+		file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescData)
+	})
+	return file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDescData
+}
+
+var file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_opentelemetry_proto_collector_trace_v1_trace_service_proto_goTypes = []interface{}{
+	(*ExportTraceServiceRequest)(nil),  // 0: opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest
+	(*ExportTraceServiceResponse)(nil), // 1: opentelemetry.proto.collector.trace.v1.ExportTraceServiceResponse
+	(*ExportTracePartialSuccess)(nil),  // 2: opentelemetry.proto.collector.trace.v1.ExportTracePartialSuccess
+	(*v1.ResourceSpans)(nil),           // 3: opentelemetry.proto.trace.v1.ResourceSpans
+}
+var file_opentelemetry_proto_collector_trace_v1_trace_service_proto_depIdxs = []int32{
+	3, // 0: opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest.resource_spans:type_name -> opentelemetry.proto.trace.v1.ResourceSpans
+	2, // 1: opentelemetry.proto.collector.trace.v1.ExportTraceServiceResponse.partial_success:type_name -> opentelemetry.proto.collector.trace.v1.ExportTracePartialSuccess
+	0, // 2: opentelemetry.proto.collector.trace.v1.TraceService.Export:input_type -> opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest
+	1, // 3: opentelemetry.proto.collector.trace.v1.TraceService.Export:output_type -> opentelemetry.proto.collector.trace.v1.ExportTraceServiceResponse
+	3, // [3:4] is the sub-list for method output_type
+	2, // [2:3] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_opentelemetry_proto_collector_trace_v1_trace_service_proto_init() }
+func file_opentelemetry_proto_collector_trace_v1_trace_service_proto_init() {
+	if File_opentelemetry_proto_collector_trace_v1_trace_service_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExportTraceServiceRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExportTraceServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExportTracePartialSuccess); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_opentelemetry_proto_collector_trace_v1_trace_service_proto_goTypes,
+		DependencyIndexes: file_opentelemetry_proto_collector_trace_v1_trace_service_proto_depIdxs,
+		MessageInfos:      file_opentelemetry_proto_collector_trace_v1_trace_service_proto_msgTypes,
+	}.Build()
+	File_opentelemetry_proto_collector_trace_v1_trace_service_proto = out.File
+	file_opentelemetry_proto_collector_trace_v1_trace_service_proto_rawDesc = nil
+	file_opentelemetry_proto_collector_trace_v1_trace_service_proto_goTypes = nil
+	file_opentelemetry_proto_collector_trace_v1_trace_service_proto_depIdxs = nil
+}
diff --git a/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.gw.go b/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.gw.go
new file mode 100644
index 0000000000..d142c2a447
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service.pb.gw.go
@@ -0,0 +1,167 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: opentelemetry/proto/collector/trace/v1/trace_service.proto
+
+/*
+Package v1 is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package v1
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var _ codes.Code
+var _ io.Reader
+var _ status.Status
+var _ = runtime.String
+var _ = utilities.NewDoubleArray
+var _ = metadata.Join
+
+func request_TraceService_Export_0(ctx context.Context, marshaler runtime.Marshaler, client TraceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ExportTraceServiceRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Export(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_TraceService_Export_0(ctx context.Context, marshaler runtime.Marshaler, server TraceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ExportTraceServiceRequest
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Export(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+// RegisterTraceServiceHandlerServer registers the http handlers for service TraceService to "mux".
+// UnaryRPC     :call TraceServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterTraceServiceHandlerFromEndpoint instead.
+func RegisterTraceServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server TraceServiceServer) error {
+
+	mux.Handle("POST", pattern_TraceService_Export_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/opentelemetry.proto.collector.trace.v1.TraceService/Export", runtime.WithHTTPPathPattern("/v1/trace"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_TraceService_Export_0(rctx, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TraceService_Export_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+// RegisterTraceServiceHandlerFromEndpoint is same as RegisterTraceServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterTraceServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.Dial(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+
+	return RegisterTraceServiceHandler(ctx, mux, conn)
+}
+
+// RegisterTraceServiceHandler registers the http handlers for service TraceService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterTraceServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterTraceServiceHandlerClient(ctx, mux, NewTraceServiceClient(conn))
+}
+
+// RegisterTraceServiceHandlerClient registers the http handlers for service TraceService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "TraceServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "TraceServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "TraceServiceClient" to call the correct interceptors.
+func RegisterTraceServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client TraceServiceClient) error {
+
+	mux.Handle("POST", pattern_TraceService_Export_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req, "/opentelemetry.proto.collector.trace.v1.TraceService/Export", runtime.WithHTTPPathPattern("/v1/trace"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_TraceService_Export_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_TraceService_Export_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+var (
+	pattern_TraceService_Export_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"v1", "trace"}, ""))
+)
+
+var (
+	forward_TraceService_Export_0 = runtime.ForwardResponseMessage
+)
diff --git a/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service_grpc.pb.go b/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service_grpc.pb.go
new file mode 100644
index 0000000000..c21f2cb47c
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/trace_service_grpc.pb.go
@@ -0,0 +1,109 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.1.0
+// - protoc             v3.17.3
+// source: opentelemetry/proto/collector/trace/v1/trace_service.proto
+
+package v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+// TraceServiceClient is the client API for TraceService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type TraceServiceClient interface {
+	// For performance reasons, it is recommended to keep this RPC
+	// alive for the entire life of the application.
+	Export(ctx context.Context, in *ExportTraceServiceRequest, opts ...grpc.CallOption) (*ExportTraceServiceResponse, error)
+}
+
+type traceServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewTraceServiceClient(cc grpc.ClientConnInterface) TraceServiceClient {
+	return &traceServiceClient{cc}
+}
+
+func (c *traceServiceClient) Export(ctx context.Context, in *ExportTraceServiceRequest, opts ...grpc.CallOption) (*ExportTraceServiceResponse, error) {
+	out := new(ExportTraceServiceResponse)
+	err := c.cc.Invoke(ctx, "/opentelemetry.proto.collector.trace.v1.TraceService/Export", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// TraceServiceServer is the server API for TraceService service.
+// All implementations must embed UnimplementedTraceServiceServer
+// for forward compatibility
+type TraceServiceServer interface {
+	// For performance reasons, it is recommended to keep this RPC
+	// alive for the entire life of the application.
+	Export(context.Context, *ExportTraceServiceRequest) (*ExportTraceServiceResponse, error)
+	mustEmbedUnimplementedTraceServiceServer()
+}
+
+// UnimplementedTraceServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedTraceServiceServer struct {
+}
+
+func (UnimplementedTraceServiceServer) Export(context.Context, *ExportTraceServiceRequest) (*ExportTraceServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Export not implemented")
+}
+func (UnimplementedTraceServiceServer) mustEmbedUnimplementedTraceServiceServer() {}
+
+// UnsafeTraceServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to TraceServiceServer will
+// result in compilation errors.
+type UnsafeTraceServiceServer interface {
+	mustEmbedUnimplementedTraceServiceServer()
+}
+
+func RegisterTraceServiceServer(s grpc.ServiceRegistrar, srv TraceServiceServer) {
+	s.RegisterService(&TraceService_ServiceDesc, srv)
+}
+
+func _TraceService_Export_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExportTraceServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TraceServiceServer).Export(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/opentelemetry.proto.collector.trace.v1.TraceService/Export",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TraceServiceServer).Export(ctx, req.(*ExportTraceServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// TraceService_ServiceDesc is the grpc.ServiceDesc for TraceService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var TraceService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opentelemetry.proto.collector.trace.v1.TraceService",
+	HandlerType: (*TraceServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Export",
+			Handler:    _TraceService_Export_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opentelemetry/proto/collector/trace/v1/trace_service.proto",
+}
diff --git a/vendor/go.opentelemetry.io/proto/otlp/common/v1/common.pb.go b/vendor/go.opentelemetry.io/proto/otlp/common/v1/common.pb.go
new file mode 100644
index 0000000000..8502e607b2
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/common/v1/common.pb.go
@@ -0,0 +1,627 @@
+// Copyright 2019, OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.17.3
+// source: opentelemetry/proto/common/v1/common.proto
+
+package v1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AnyValue is used to represent any type of attribute value. AnyValue may contain a
+// primitive value such as a string or integer or it may contain an arbitrary nested
+// object containing arrays, key-value lists and primitives.
+type AnyValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The value is one of the listed fields. It is valid for all values to be unspecified
+	// in which case this AnyValue is considered to be "empty".
+	//
+	// Types that are assignable to Value:
+	//	*AnyValue_StringValue
+	//	*AnyValue_BoolValue
+	//	*AnyValue_IntValue
+	//	*AnyValue_DoubleValue
+	//	*AnyValue_ArrayValue
+	//	*AnyValue_KvlistValue
+	//	*AnyValue_BytesValue
+	Value isAnyValue_Value `protobuf_oneof:"value"`
+}
+
+func (x *AnyValue) Reset() {
+	*x = AnyValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AnyValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AnyValue) ProtoMessage() {}
+
+func (x *AnyValue) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AnyValue.ProtoReflect.Descriptor instead.
+func (*AnyValue) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_common_v1_common_proto_rawDescGZIP(), []int{0}
+}
+
+func (m *AnyValue) GetValue() isAnyValue_Value {
+	if m != nil {
+		return m.Value
+	}
+	return nil
+}
+
+func (x *AnyValue) GetStringValue() string {
+	if x, ok := x.GetValue().(*AnyValue_StringValue); ok {
+		return x.StringValue
+	}
+	return ""
+}
+
+func (x *AnyValue) GetBoolValue() bool {
+	if x, ok := x.GetValue().(*AnyValue_BoolValue); ok {
+		return x.BoolValue
+	}
+	return false
+}
+
+func (x *AnyValue) GetIntValue() int64 {
+	if x, ok := x.GetValue().(*AnyValue_IntValue); ok {
+		return x.IntValue
+	}
+	return 0
+}
+
+func (x *AnyValue) GetDoubleValue() float64 {
+	if x, ok := x.GetValue().(*AnyValue_DoubleValue); ok {
+		return x.DoubleValue
+	}
+	return 0
+}
+
+func (x *AnyValue) GetArrayValue() *ArrayValue {
+	if x, ok := x.GetValue().(*AnyValue_ArrayValue); ok {
+		return x.ArrayValue
+	}
+	return nil
+}
+
+func (x *AnyValue) GetKvlistValue() *KeyValueList {
+	if x, ok := x.GetValue().(*AnyValue_KvlistValue); ok {
+		return x.KvlistValue
+	}
+	return nil
+}
+
+func (x *AnyValue) GetBytesValue() []byte {
+	if x, ok := x.GetValue().(*AnyValue_BytesValue); ok {
+		return x.BytesValue
+	}
+	return nil
+}
+
+type isAnyValue_Value interface {
+	isAnyValue_Value()
+}
+
+type AnyValue_StringValue struct {
+	StringValue string `protobuf:"bytes,1,opt,name=string_value,json=stringValue,proto3,oneof"`
+}
+
+type AnyValue_BoolValue struct {
+	BoolValue bool `protobuf:"varint,2,opt,name=bool_value,json=boolValue,proto3,oneof"`
+}
+
+type AnyValue_IntValue struct {
+	IntValue int64 `protobuf:"varint,3,opt,name=int_value,json=intValue,proto3,oneof"`
+}
+
+type AnyValue_DoubleValue struct {
+	DoubleValue float64 `protobuf:"fixed64,4,opt,name=double_value,json=doubleValue,proto3,oneof"`
+}
+
+type AnyValue_ArrayValue struct {
+	ArrayValue *ArrayValue `protobuf:"bytes,5,opt,name=array_value,json=arrayValue,proto3,oneof"`
+}
+
+type AnyValue_KvlistValue struct {
+	KvlistValue *KeyValueList `protobuf:"bytes,6,opt,name=kvlist_value,json=kvlistValue,proto3,oneof"`
+}
+
+type AnyValue_BytesValue struct {
+	BytesValue []byte `protobuf:"bytes,7,opt,name=bytes_value,json=bytesValue,proto3,oneof"`
+}
+
+func (*AnyValue_StringValue) isAnyValue_Value() {}
+
+func (*AnyValue_BoolValue) isAnyValue_Value() {}
+
+func (*AnyValue_IntValue) isAnyValue_Value() {}
+
+func (*AnyValue_DoubleValue) isAnyValue_Value() {}
+
+func (*AnyValue_ArrayValue) isAnyValue_Value() {}
+
+func (*AnyValue_KvlistValue) isAnyValue_Value() {}
+
+func (*AnyValue_BytesValue) isAnyValue_Value() {}
+
+// ArrayValue is a list of AnyValue messages. We need ArrayValue as a message
+// since oneof in AnyValue does not allow repeated fields.
+type ArrayValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Array of values. The array may be empty (contain 0 elements).
+	Values []*AnyValue `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+}
+
+func (x *ArrayValue) Reset() {
+	*x = ArrayValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ArrayValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ArrayValue) ProtoMessage() {}
+
+func (x *ArrayValue) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ArrayValue.ProtoReflect.Descriptor instead.
+func (*ArrayValue) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_common_v1_common_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ArrayValue) GetValues() []*AnyValue {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
+// KeyValueList is a list of KeyValue messages. We need KeyValueList as a message
+// since `oneof` in AnyValue does not allow repeated fields. Everywhere else where we need
+// a list of KeyValue messages (e.g. in Span) we use `repeated KeyValue` directly to
+// avoid unnecessary extra wrapping (which slows down the protocol). The 2 approaches
+// are semantically equivalent.
+type KeyValueList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// A collection of key/value pairs of key-value pairs. The list may be empty (may
+	// contain 0 elements).
+	// The keys MUST be unique (it is not allowed to have more than one
+	// value with the same key).
+	Values []*KeyValue `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+}
+
+func (x *KeyValueList) Reset() {
+	*x = KeyValueList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KeyValueList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KeyValueList) ProtoMessage() {}
+
+func (x *KeyValueList) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KeyValueList.ProtoReflect.Descriptor instead.
+func (*KeyValueList) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_common_v1_common_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *KeyValueList) GetValues() []*KeyValue {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
+// KeyValue is a key-value pair that is used to store Span attributes, Link
+// attributes, etc.
+type KeyValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key   string    `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value *AnyValue `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *KeyValue) Reset() {
+	*x = KeyValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KeyValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KeyValue) ProtoMessage() {}
+
+func (x *KeyValue) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KeyValue.ProtoReflect.Descriptor instead.
+func (*KeyValue) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_common_v1_common_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *KeyValue) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *KeyValue) GetValue() *AnyValue {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+// InstrumentationScope is a message representing the instrumentation scope information
+// such as the fully qualified name and version.
+type InstrumentationScope struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// An empty instrumentation scope name means the name is unknown.
+	Name                   string      `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Version                string      `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
+	Attributes             []*KeyValue `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty"`
+	DroppedAttributesCount uint32      `protobuf:"varint,4,opt,name=dropped_attributes_count,json=droppedAttributesCount,proto3" json:"dropped_attributes_count,omitempty"`
+}
+
+func (x *InstrumentationScope) Reset() {
+	*x = InstrumentationScope{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *InstrumentationScope) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InstrumentationScope) ProtoMessage() {}
+
+func (x *InstrumentationScope) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_common_v1_common_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InstrumentationScope.ProtoReflect.Descriptor instead.
+func (*InstrumentationScope) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_common_v1_common_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *InstrumentationScope) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *InstrumentationScope) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *InstrumentationScope) GetAttributes() []*KeyValue {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *InstrumentationScope) GetDroppedAttributesCount() uint32 {
+	if x != nil {
+		return x.DroppedAttributesCount
+	}
+	return 0
+}
+
+var File_opentelemetry_proto_common_v1_common_proto protoreflect.FileDescriptor
+
+var file_opentelemetry_proto_common_v1_common_proto_rawDesc = []byte{
+	0x0a, 0x2a, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x76, 0x31, 0x2f,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1d, 0x6f, 0x70,
+	0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x22, 0xe0, 0x02, 0x0a, 0x08,
+	0x41, 0x6e, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x23, 0x0a, 0x0c, 0x73, 0x74, 0x72, 0x69,
+	0x6e, 0x67, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
+	0x52, 0x0b, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a,
+	0x0a, 0x62, 0x6f, 0x6f, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x48, 0x00, 0x52, 0x09, 0x62, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1d,
+	0x0a, 0x09, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x03, 0x48, 0x00, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x23, 0x0a,
+	0x0c, 0x64, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x01, 0x48, 0x00, 0x52, 0x0b, 0x64, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x12, 0x4c, 0x0a, 0x0b, 0x61, 0x72, 0x72, 0x61, 0x79, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65,
+	0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x72, 0x72, 0x61, 0x79, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x48, 0x00, 0x52, 0x0a, 0x61, 0x72, 0x72, 0x61, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x12, 0x50, 0x0a, 0x0c, 0x6b, 0x76, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c,
+	0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4c,
+	0x69, 0x73, 0x74, 0x48, 0x00, 0x52, 0x0b, 0x6b, 0x76, 0x6c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x12, 0x21, 0x0a, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x0a, 0x62, 0x79, 0x74, 0x65, 0x73,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x4d,
+	0x0a, 0x0a, 0x41, 0x72, 0x72, 0x61, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x3f, 0x0a, 0x06,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f,
+	0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x6e, 0x79,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x4f, 0x0a,
+	0x0c, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x3f, 0x0a,
+	0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e,
+	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4b, 0x65,
+	0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x5b,
+	0x0a, 0x08, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3d, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70,
+	0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x6e, 0x79, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xc7, 0x01, 0x0a, 0x14,
+	0x49, 0x6e, 0x73, 0x74, 0x72, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53,
+	0x63, 0x6f, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x47, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c,
+	0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
+	0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x64,
+	0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x16, 0x64,
+	0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
+	0x43, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x7b, 0x0a, 0x20, 0x69, 0x6f, 0x2e, 0x6f, 0x70, 0x65, 0x6e,
+	0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x42, 0x0b, 0x43, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x28, 0x67, 0x6f, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x69, 0x6f, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2f, 0x6f, 0x74, 0x6c, 0x70, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f,
+	0x76, 0x31, 0xaa, 0x02, 0x1d, 0x4f, 0x70, 0x65, 0x6e, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74,
+	0x72, 0x79, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_opentelemetry_proto_common_v1_common_proto_rawDescOnce sync.Once
+	file_opentelemetry_proto_common_v1_common_proto_rawDescData = file_opentelemetry_proto_common_v1_common_proto_rawDesc
+)
+
+func file_opentelemetry_proto_common_v1_common_proto_rawDescGZIP() []byte {
+	file_opentelemetry_proto_common_v1_common_proto_rawDescOnce.Do(func() {
+		file_opentelemetry_proto_common_v1_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_opentelemetry_proto_common_v1_common_proto_rawDescData)
+	})
+	return file_opentelemetry_proto_common_v1_common_proto_rawDescData
+}
+
+var file_opentelemetry_proto_common_v1_common_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_opentelemetry_proto_common_v1_common_proto_goTypes = []interface{}{
+	(*AnyValue)(nil),             // 0: opentelemetry.proto.common.v1.AnyValue
+	(*ArrayValue)(nil),           // 1: opentelemetry.proto.common.v1.ArrayValue
+	(*KeyValueList)(nil),         // 2: opentelemetry.proto.common.v1.KeyValueList
+	(*KeyValue)(nil),             // 3: opentelemetry.proto.common.v1.KeyValue
+	(*InstrumentationScope)(nil), // 4: opentelemetry.proto.common.v1.InstrumentationScope
+}
+var file_opentelemetry_proto_common_v1_common_proto_depIdxs = []int32{
+	1, // 0: opentelemetry.proto.common.v1.AnyValue.array_value:type_name -> opentelemetry.proto.common.v1.ArrayValue
+	2, // 1: opentelemetry.proto.common.v1.AnyValue.kvlist_value:type_name -> opentelemetry.proto.common.v1.KeyValueList
+	0, // 2: opentelemetry.proto.common.v1.ArrayValue.values:type_name -> opentelemetry.proto.common.v1.AnyValue
+	3, // 3: opentelemetry.proto.common.v1.KeyValueList.values:type_name -> opentelemetry.proto.common.v1.KeyValue
+	0, // 4: opentelemetry.proto.common.v1.KeyValue.value:type_name -> opentelemetry.proto.common.v1.AnyValue
+	3, // 5: opentelemetry.proto.common.v1.InstrumentationScope.attributes:type_name -> opentelemetry.proto.common.v1.KeyValue
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_opentelemetry_proto_common_v1_common_proto_init() }
+func file_opentelemetry_proto_common_v1_common_proto_init() {
+	if File_opentelemetry_proto_common_v1_common_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_opentelemetry_proto_common_v1_common_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AnyValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_common_v1_common_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ArrayValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_common_v1_common_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KeyValueList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_common_v1_common_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KeyValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_common_v1_common_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*InstrumentationScope); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_opentelemetry_proto_common_v1_common_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*AnyValue_StringValue)(nil),
+		(*AnyValue_BoolValue)(nil),
+		(*AnyValue_IntValue)(nil),
+		(*AnyValue_DoubleValue)(nil),
+		(*AnyValue_ArrayValue)(nil),
+		(*AnyValue_KvlistValue)(nil),
+		(*AnyValue_BytesValue)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_opentelemetry_proto_common_v1_common_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_opentelemetry_proto_common_v1_common_proto_goTypes,
+		DependencyIndexes: file_opentelemetry_proto_common_v1_common_proto_depIdxs,
+		MessageInfos:      file_opentelemetry_proto_common_v1_common_proto_msgTypes,
+	}.Build()
+	File_opentelemetry_proto_common_v1_common_proto = out.File
+	file_opentelemetry_proto_common_v1_common_proto_rawDesc = nil
+	file_opentelemetry_proto_common_v1_common_proto_goTypes = nil
+	file_opentelemetry_proto_common_v1_common_proto_depIdxs = nil
+}
diff --git a/vendor/go.opentelemetry.io/proto/otlp/resource/v1/resource.pb.go b/vendor/go.opentelemetry.io/proto/otlp/resource/v1/resource.pb.go
new file mode 100644
index 0000000000..bcc1060e3d
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/resource/v1/resource.pb.go
@@ -0,0 +1,193 @@
+// Copyright 2019, OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.17.3
+// source: opentelemetry/proto/resource/v1/resource.proto
+
+package v1
+
+import (
+	v1 "go.opentelemetry.io/proto/otlp/common/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Resource information.
+type Resource struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Set of attributes that describe the resource.
+	// Attribute keys MUST be unique (it is not allowed to have more than one
+	// attribute with the same key).
+	Attributes []*v1.KeyValue `protobuf:"bytes,1,rep,name=attributes,proto3" json:"attributes,omitempty"`
+	// dropped_attributes_count is the number of dropped attributes. If the value is 0, then
+	// no attributes were dropped.
+	DroppedAttributesCount uint32 `protobuf:"varint,2,opt,name=dropped_attributes_count,json=droppedAttributesCount,proto3" json:"dropped_attributes_count,omitempty"`
+}
+
+func (x *Resource) Reset() {
+	*x = Resource{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_resource_v1_resource_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Resource) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Resource) ProtoMessage() {}
+
+func (x *Resource) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_resource_v1_resource_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Resource.ProtoReflect.Descriptor instead.
+func (*Resource) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_resource_v1_resource_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Resource) GetAttributes() []*v1.KeyValue {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *Resource) GetDroppedAttributesCount() uint32 {
+	if x != nil {
+		return x.DroppedAttributesCount
+	}
+	return 0
+}
+
+var File_opentelemetry_proto_resource_v1_resource_proto protoreflect.FileDescriptor
+
+var file_opentelemetry_proto_resource_v1_resource_proto_rawDesc = []byte{
+	0x0a, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x76,
+	0x31, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x1f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x76,
+	0x31, 0x1a, 0x2a, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x76, 0x31,
+	0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x8d, 0x01,
+	0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x47, 0x0a, 0x0a, 0x61, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27,
+	0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4b,
+	0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x61,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x16, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x41, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x83, 0x01,
+	0x0a, 0x22, 0x69, 0x6f, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74,
+	0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x76, 0x31, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2a, 0x67, 0x6f, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65,
+	0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x69, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2f, 0x6f, 0x74, 0x6c, 0x70, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x76,
+	0x31, 0xaa, 0x02, 0x1f, 0x4f, 0x70, 0x65, 0x6e, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72,
+	0x79, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_opentelemetry_proto_resource_v1_resource_proto_rawDescOnce sync.Once
+	file_opentelemetry_proto_resource_v1_resource_proto_rawDescData = file_opentelemetry_proto_resource_v1_resource_proto_rawDesc
+)
+
+func file_opentelemetry_proto_resource_v1_resource_proto_rawDescGZIP() []byte {
+	file_opentelemetry_proto_resource_v1_resource_proto_rawDescOnce.Do(func() {
+		file_opentelemetry_proto_resource_v1_resource_proto_rawDescData = protoimpl.X.CompressGZIP(file_opentelemetry_proto_resource_v1_resource_proto_rawDescData)
+	})
+	return file_opentelemetry_proto_resource_v1_resource_proto_rawDescData
+}
+
+var file_opentelemetry_proto_resource_v1_resource_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_opentelemetry_proto_resource_v1_resource_proto_goTypes = []interface{}{
+	(*Resource)(nil),    // 0: opentelemetry.proto.resource.v1.Resource
+	(*v1.KeyValue)(nil), // 1: opentelemetry.proto.common.v1.KeyValue
+}
+var file_opentelemetry_proto_resource_v1_resource_proto_depIdxs = []int32{
+	1, // 0: opentelemetry.proto.resource.v1.Resource.attributes:type_name -> opentelemetry.proto.common.v1.KeyValue
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_opentelemetry_proto_resource_v1_resource_proto_init() }
+func file_opentelemetry_proto_resource_v1_resource_proto_init() {
+	if File_opentelemetry_proto_resource_v1_resource_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_opentelemetry_proto_resource_v1_resource_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Resource); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_opentelemetry_proto_resource_v1_resource_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_opentelemetry_proto_resource_v1_resource_proto_goTypes,
+		DependencyIndexes: file_opentelemetry_proto_resource_v1_resource_proto_depIdxs,
+		MessageInfos:      file_opentelemetry_proto_resource_v1_resource_proto_msgTypes,
+	}.Build()
+	File_opentelemetry_proto_resource_v1_resource_proto = out.File
+	file_opentelemetry_proto_resource_v1_resource_proto_rawDesc = nil
+	file_opentelemetry_proto_resource_v1_resource_proto_goTypes = nil
+	file_opentelemetry_proto_resource_v1_resource_proto_depIdxs = nil
+}
diff --git a/vendor/go.opentelemetry.io/proto/otlp/trace/v1/trace.pb.go b/vendor/go.opentelemetry.io/proto/otlp/trace/v1/trace.pb.go
new file mode 100644
index 0000000000..499a43d77b
--- /dev/null
+++ b/vendor/go.opentelemetry.io/proto/otlp/trace/v1/trace.pb.go
@@ -0,0 +1,1140 @@
+// Copyright 2019, OpenTelemetry Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.17.3
+// source: opentelemetry/proto/trace/v1/trace.proto
+
+package v1
+
+import (
+	v11 "go.opentelemetry.io/proto/otlp/common/v1"
+	v1 "go.opentelemetry.io/proto/otlp/resource/v1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// SpanKind is the type of span. Can be used to specify additional relationships between spans
+// in addition to a parent/child relationship.
+type Span_SpanKind int32
+
+const (
+	// Unspecified. Do NOT use as default.
+	// Implementations MAY assume SpanKind to be INTERNAL when receiving UNSPECIFIED.
+	Span_SPAN_KIND_UNSPECIFIED Span_SpanKind = 0
+	// Indicates that the span represents an internal operation within an application,
+	// as opposed to an operation happening at the boundaries. Default value.
+	Span_SPAN_KIND_INTERNAL Span_SpanKind = 1
+	// Indicates that the span covers server-side handling of an RPC or other
+	// remote network request.
+	Span_SPAN_KIND_SERVER Span_SpanKind = 2
+	// Indicates that the span describes a request to some remote service.
+	Span_SPAN_KIND_CLIENT Span_SpanKind = 3
+	// Indicates that the span describes a producer sending a message to a broker.
+	// Unlike CLIENT and SERVER, there is often no direct critical path latency relationship
+	// between producer and consumer spans. A PRODUCER span ends when the message was accepted
+	// by the broker while the logical processing of the message might span a much longer time.
+	Span_SPAN_KIND_PRODUCER Span_SpanKind = 4
+	// Indicates that the span describes consumer receiving a message from a broker.
+	// Like the PRODUCER kind, there is often no direct critical path latency relationship
+	// between producer and consumer spans.
+	Span_SPAN_KIND_CONSUMER Span_SpanKind = 5
+)
+
+// Enum value maps for Span_SpanKind.
+var (
+	Span_SpanKind_name = map[int32]string{
+		0: "SPAN_KIND_UNSPECIFIED",
+		1: "SPAN_KIND_INTERNAL",
+		2: "SPAN_KIND_SERVER",
+		3: "SPAN_KIND_CLIENT",
+		4: "SPAN_KIND_PRODUCER",
+		5: "SPAN_KIND_CONSUMER",
+	}
+	Span_SpanKind_value = map[string]int32{
+		"SPAN_KIND_UNSPECIFIED": 0,
+		"SPAN_KIND_INTERNAL":    1,
+		"SPAN_KIND_SERVER":      2,
+		"SPAN_KIND_CLIENT":      3,
+		"SPAN_KIND_PRODUCER":    4,
+		"SPAN_KIND_CONSUMER":    5,
+	}
+)
+
+func (x Span_SpanKind) Enum() *Span_SpanKind {
+	p := new(Span_SpanKind)
+	*p = x
+	return p
+}
+
+func (x Span_SpanKind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Span_SpanKind) Descriptor() protoreflect.EnumDescriptor {
+	return file_opentelemetry_proto_trace_v1_trace_proto_enumTypes[0].Descriptor()
+}
+
+func (Span_SpanKind) Type() protoreflect.EnumType {
+	return &file_opentelemetry_proto_trace_v1_trace_proto_enumTypes[0]
+}
+
+func (x Span_SpanKind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Span_SpanKind.Descriptor instead.
+func (Span_SpanKind) EnumDescriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{3, 0}
+}
+
+// For the semantics of status codes see
+// https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/trace/api.md#set-status
+type Status_StatusCode int32
+
+const (
+	// The default status.
+	Status_STATUS_CODE_UNSET Status_StatusCode = 0
+	// The Span has been validated by an Application developers or Operator to have
+	// completed successfully.
+	Status_STATUS_CODE_OK Status_StatusCode = 1
+	// The Span contains an error.
+	Status_STATUS_CODE_ERROR Status_StatusCode = 2
+)
+
+// Enum value maps for Status_StatusCode.
+var (
+	Status_StatusCode_name = map[int32]string{
+		0: "STATUS_CODE_UNSET",
+		1: "STATUS_CODE_OK",
+		2: "STATUS_CODE_ERROR",
+	}
+	Status_StatusCode_value = map[string]int32{
+		"STATUS_CODE_UNSET": 0,
+		"STATUS_CODE_OK":    1,
+		"STATUS_CODE_ERROR": 2,
+	}
+)
+
+func (x Status_StatusCode) Enum() *Status_StatusCode {
+	p := new(Status_StatusCode)
+	*p = x
+	return p
+}
+
+func (x Status_StatusCode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Status_StatusCode) Descriptor() protoreflect.EnumDescriptor {
+	return file_opentelemetry_proto_trace_v1_trace_proto_enumTypes[1].Descriptor()
+}
+
+func (Status_StatusCode) Type() protoreflect.EnumType {
+	return &file_opentelemetry_proto_trace_v1_trace_proto_enumTypes[1]
+}
+
+func (x Status_StatusCode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Status_StatusCode.Descriptor instead.
+func (Status_StatusCode) EnumDescriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{4, 0}
+}
+
+// TracesData represents the traces data that can be stored in a persistent storage,
+// OR can be embedded by other protocols that transfer OTLP traces data but do
+// not implement the OTLP protocol.
+//
+// The main difference between this message and collector protocol is that
+// in this message there will not be any "control" or "metadata" specific to
+// OTLP protocol.
+//
+// When new fields are added into this message, the OTLP request MUST be updated
+// as well.
+type TracesData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// An array of ResourceSpans.
+	// For data coming from a single resource this array will typically contain
+	// one element. Intermediary nodes that receive data from multiple origins
+	// typically batch the data before forwarding further and in that case this
+	// array will contain multiple elements.
+	ResourceSpans []*ResourceSpans `protobuf:"bytes,1,rep,name=resource_spans,json=resourceSpans,proto3" json:"resource_spans,omitempty"`
+}
+
+func (x *TracesData) Reset() {
+	*x = TracesData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TracesData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TracesData) ProtoMessage() {}
+
+func (x *TracesData) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TracesData.ProtoReflect.Descriptor instead.
+func (*TracesData) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *TracesData) GetResourceSpans() []*ResourceSpans {
+	if x != nil {
+		return x.ResourceSpans
+	}
+	return nil
+}
+
+// A collection of ScopeSpans from a Resource.
+type ResourceSpans struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The resource for the spans in this message.
+	// If this field is not set then no resource info is known.
+	Resource *v1.Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
+	// A list of ScopeSpans that originate from a resource.
+	ScopeSpans []*ScopeSpans `protobuf:"bytes,2,rep,name=scope_spans,json=scopeSpans,proto3" json:"scope_spans,omitempty"`
+	// This schema_url applies to the data in the "resource" field. It does not apply
+	// to the data in the "scope_spans" field which have their own schema_url field.
+	SchemaUrl string `protobuf:"bytes,3,opt,name=schema_url,json=schemaUrl,proto3" json:"schema_url,omitempty"`
+}
+
+func (x *ResourceSpans) Reset() {
+	*x = ResourceSpans{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResourceSpans) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceSpans) ProtoMessage() {}
+
+func (x *ResourceSpans) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceSpans.ProtoReflect.Descriptor instead.
+func (*ResourceSpans) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ResourceSpans) GetResource() *v1.Resource {
+	if x != nil {
+		return x.Resource
+	}
+	return nil
+}
+
+func (x *ResourceSpans) GetScopeSpans() []*ScopeSpans {
+	if x != nil {
+		return x.ScopeSpans
+	}
+	return nil
+}
+
+func (x *ResourceSpans) GetSchemaUrl() string {
+	if x != nil {
+		return x.SchemaUrl
+	}
+	return ""
+}
+
+// A collection of Spans produced by an InstrumentationScope.
+type ScopeSpans struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The instrumentation scope information for the spans in this message.
+	// Semantically when InstrumentationScope isn't set, it is equivalent with
+	// an empty instrumentation scope name (unknown).
+	Scope *v11.InstrumentationScope `protobuf:"bytes,1,opt,name=scope,proto3" json:"scope,omitempty"`
+	// A list of Spans that originate from an instrumentation scope.
+	Spans []*Span `protobuf:"bytes,2,rep,name=spans,proto3" json:"spans,omitempty"`
+	// This schema_url applies to all spans and span events in the "spans" field.
+	SchemaUrl string `protobuf:"bytes,3,opt,name=schema_url,json=schemaUrl,proto3" json:"schema_url,omitempty"`
+}
+
+func (x *ScopeSpans) Reset() {
+	*x = ScopeSpans{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ScopeSpans) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ScopeSpans) ProtoMessage() {}
+
+func (x *ScopeSpans) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ScopeSpans.ProtoReflect.Descriptor instead.
+func (*ScopeSpans) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ScopeSpans) GetScope() *v11.InstrumentationScope {
+	if x != nil {
+		return x.Scope
+	}
+	return nil
+}
+
+func (x *ScopeSpans) GetSpans() []*Span {
+	if x != nil {
+		return x.Spans
+	}
+	return nil
+}
+
+func (x *ScopeSpans) GetSchemaUrl() string {
+	if x != nil {
+		return x.SchemaUrl
+	}
+	return ""
+}
+
+// A Span represents a single operation performed by a single component of the system.
+//
+// The next available field id is 17.
+type Span struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// A unique identifier for a trace. All spans from the same trace share
+	// the same `trace_id`. The ID is a 16-byte array. An ID with all zeroes
+	// is considered invalid.
+	//
+	// This field is semantically required. Receiver should generate new
+	// random trace_id if empty or invalid trace_id was received.
+	//
+	// This field is required.
+	TraceId []byte `protobuf:"bytes,1,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
+	// A unique identifier for a span within a trace, assigned when the span
+	// is created. The ID is an 8-byte array. An ID with all zeroes is considered
+	// invalid.
+	//
+	// This field is semantically required. Receiver should generate new
+	// random span_id if empty or invalid span_id was received.
+	//
+	// This field is required.
+	SpanId []byte `protobuf:"bytes,2,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	// trace_state conveys information about request position in multiple distributed tracing graphs.
+	// It is a trace_state in w3c-trace-context format: https://www.w3.org/TR/trace-context/#tracestate-header
+	// See also https://github.com/w3c/distributed-tracing for more details about this field.
+	TraceState string `protobuf:"bytes,3,opt,name=trace_state,json=traceState,proto3" json:"trace_state,omitempty"`
+	// The `span_id` of this span's parent span. If this is a root span, then this
+	// field must be empty. The ID is an 8-byte array.
+	ParentSpanId []byte `protobuf:"bytes,4,opt,name=parent_span_id,json=parentSpanId,proto3" json:"parent_span_id,omitempty"`
+	// A description of the span's operation.
+	//
+	// For example, the name can be a qualified method name or a file name
+	// and a line number where the operation is called. A best practice is to use
+	// the same display name at the same call point in an application.
+	// This makes it easier to correlate spans in different traces.
+	//
+	// This field is semantically required to be set to non-empty string.
+	// Empty value is equivalent to an unknown span name.
+	//
+	// This field is required.
+	Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"`
+	// Distinguishes between spans generated in a particular context. For example,
+	// two spans with the same name may be distinguished using `CLIENT` (caller)
+	// and `SERVER` (callee) to identify queueing latency associated with the span.
+	Kind Span_SpanKind `protobuf:"varint,6,opt,name=kind,proto3,enum=opentelemetry.proto.trace.v1.Span_SpanKind" json:"kind,omitempty"`
+	// start_time_unix_nano is the start time of the span. On the client side, this is the time
+	// kept by the local machine where the span execution starts. On the server side, this
+	// is the time when the server's application handler starts running.
+	// Value is UNIX Epoch time in nanoseconds since 00:00:00 UTC on 1 January 1970.
+	//
+	// This field is semantically required and it is expected that end_time >= start_time.
+	StartTimeUnixNano uint64 `protobuf:"fixed64,7,opt,name=start_time_unix_nano,json=startTimeUnixNano,proto3" json:"start_time_unix_nano,omitempty"`
+	// end_time_unix_nano is the end time of the span. On the client side, this is the time
+	// kept by the local machine where the span execution ends. On the server side, this
+	// is the time when the server application handler stops running.
+	// Value is UNIX Epoch time in nanoseconds since 00:00:00 UTC on 1 January 1970.
+	//
+	// This field is semantically required and it is expected that end_time >= start_time.
+	EndTimeUnixNano uint64 `protobuf:"fixed64,8,opt,name=end_time_unix_nano,json=endTimeUnixNano,proto3" json:"end_time_unix_nano,omitempty"`
+	// attributes is a collection of key/value pairs. Note, global attributes
+	// like server name can be set using the resource API. Examples of attributes:
+	//
+	//     "/http/user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
+	//     "/http/server_latency": 300
+	//     "abc.com/myattribute": true
+	//     "abc.com/score": 10.239
+	//
+	// The OpenTelemetry API specification further restricts the allowed value types:
+	// https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/common/README.md#attribute
+	// Attribute keys MUST be unique (it is not allowed to have more than one
+	// attribute with the same key).
+	Attributes []*v11.KeyValue `protobuf:"bytes,9,rep,name=attributes,proto3" json:"attributes,omitempty"`
+	// dropped_attributes_count is the number of attributes that were discarded. Attributes
+	// can be discarded because their keys are too long or because there are too many
+	// attributes. If this value is 0, then no attributes were dropped.
+	DroppedAttributesCount uint32 `protobuf:"varint,10,opt,name=dropped_attributes_count,json=droppedAttributesCount,proto3" json:"dropped_attributes_count,omitempty"`
+	// events is a collection of Event items.
+	Events []*Span_Event `protobuf:"bytes,11,rep,name=events,proto3" json:"events,omitempty"`
+	// dropped_events_count is the number of dropped events. If the value is 0, then no
+	// events were dropped.
+	DroppedEventsCount uint32 `protobuf:"varint,12,opt,name=dropped_events_count,json=droppedEventsCount,proto3" json:"dropped_events_count,omitempty"`
+	// links is a collection of Links, which are references from this span to a span
+	// in the same or different trace.
+	Links []*Span_Link `protobuf:"bytes,13,rep,name=links,proto3" json:"links,omitempty"`
+	// dropped_links_count is the number of dropped links after the maximum size was
+	// enforced. If this value is 0, then no links were dropped.
+	DroppedLinksCount uint32 `protobuf:"varint,14,opt,name=dropped_links_count,json=droppedLinksCount,proto3" json:"dropped_links_count,omitempty"`
+	// An optional final status for this span. Semantically when Status isn't set, it means
+	// span's status code is unset, i.e. assume STATUS_CODE_UNSET (code = 0).
+	Status *Status `protobuf:"bytes,15,opt,name=status,proto3" json:"status,omitempty"`
+}
+
+func (x *Span) Reset() {
+	*x = Span{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Span) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Span) ProtoMessage() {}
+
+func (x *Span) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Span.ProtoReflect.Descriptor instead.
+func (*Span) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Span) GetTraceId() []byte {
+	if x != nil {
+		return x.TraceId
+	}
+	return nil
+}
+
+func (x *Span) GetSpanId() []byte {
+	if x != nil {
+		return x.SpanId
+	}
+	return nil
+}
+
+func (x *Span) GetTraceState() string {
+	if x != nil {
+		return x.TraceState
+	}
+	return ""
+}
+
+func (x *Span) GetParentSpanId() []byte {
+	if x != nil {
+		return x.ParentSpanId
+	}
+	return nil
+}
+
+func (x *Span) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Span) GetKind() Span_SpanKind {
+	if x != nil {
+		return x.Kind
+	}
+	return Span_SPAN_KIND_UNSPECIFIED
+}
+
+func (x *Span) GetStartTimeUnixNano() uint64 {
+	if x != nil {
+		return x.StartTimeUnixNano
+	}
+	return 0
+}
+
+func (x *Span) GetEndTimeUnixNano() uint64 {
+	if x != nil {
+		return x.EndTimeUnixNano
+	}
+	return 0
+}
+
+func (x *Span) GetAttributes() []*v11.KeyValue {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *Span) GetDroppedAttributesCount() uint32 {
+	if x != nil {
+		return x.DroppedAttributesCount
+	}
+	return 0
+}
+
+func (x *Span) GetEvents() []*Span_Event {
+	if x != nil {
+		return x.Events
+	}
+	return nil
+}
+
+func (x *Span) GetDroppedEventsCount() uint32 {
+	if x != nil {
+		return x.DroppedEventsCount
+	}
+	return 0
+}
+
+func (x *Span) GetLinks() []*Span_Link {
+	if x != nil {
+		return x.Links
+	}
+	return nil
+}
+
+func (x *Span) GetDroppedLinksCount() uint32 {
+	if x != nil {
+		return x.DroppedLinksCount
+	}
+	return 0
+}
+
+func (x *Span) GetStatus() *Status {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+// The Status type defines a logical error model that is suitable for different
+// programming environments, including REST APIs and RPC APIs.
+type Status struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// A developer-facing human readable error message.
+	Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	// The status code.
+	Code Status_StatusCode `protobuf:"varint,3,opt,name=code,proto3,enum=opentelemetry.proto.trace.v1.Status_StatusCode" json:"code,omitempty"`
+}
+
+func (x *Status) Reset() {
+	*x = Status{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Status) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Status) ProtoMessage() {}
+
+func (x *Status) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Status.ProtoReflect.Descriptor instead.
+func (*Status) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Status) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+func (x *Status) GetCode() Status_StatusCode {
+	if x != nil {
+		return x.Code
+	}
+	return Status_STATUS_CODE_UNSET
+}
+
+// Event is a time-stamped annotation of the span, consisting of user-supplied
+// text description and key-value pairs.
+type Span_Event struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// time_unix_nano is the time the event occurred.
+	TimeUnixNano uint64 `protobuf:"fixed64,1,opt,name=time_unix_nano,json=timeUnixNano,proto3" json:"time_unix_nano,omitempty"`
+	// name of the event.
+	// This field is semantically required to be set to non-empty string.
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	// attributes is a collection of attribute key/value pairs on the event.
+	// Attribute keys MUST be unique (it is not allowed to have more than one
+	// attribute with the same key).
+	Attributes []*v11.KeyValue `protobuf:"bytes,3,rep,name=attributes,proto3" json:"attributes,omitempty"`
+	// dropped_attributes_count is the number of dropped attributes. If the value is 0,
+	// then no attributes were dropped.
+	DroppedAttributesCount uint32 `protobuf:"varint,4,opt,name=dropped_attributes_count,json=droppedAttributesCount,proto3" json:"dropped_attributes_count,omitempty"`
+}
+
+func (x *Span_Event) Reset() {
+	*x = Span_Event{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Span_Event) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Span_Event) ProtoMessage() {}
+
+func (x *Span_Event) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Span_Event.ProtoReflect.Descriptor instead.
+func (*Span_Event) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *Span_Event) GetTimeUnixNano() uint64 {
+	if x != nil {
+		return x.TimeUnixNano
+	}
+	return 0
+}
+
+func (x *Span_Event) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Span_Event) GetAttributes() []*v11.KeyValue {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *Span_Event) GetDroppedAttributesCount() uint32 {
+	if x != nil {
+		return x.DroppedAttributesCount
+	}
+	return 0
+}
+
+// A pointer from the current span to another span in the same trace or in a
+// different trace. For example, this can be used in batching operations,
+// where a single batch handler processes multiple requests from different
+// traces or when the handler receives a request from a different project.
+type Span_Link struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// A unique identifier of a trace that this linked span is part of. The ID is a
+	// 16-byte array.
+	TraceId []byte `protobuf:"bytes,1,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
+	// A unique identifier for the linked span. The ID is an 8-byte array.
+	SpanId []byte `protobuf:"bytes,2,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	// The trace_state associated with the link.
+	TraceState string `protobuf:"bytes,3,opt,name=trace_state,json=traceState,proto3" json:"trace_state,omitempty"`
+	// attributes is a collection of attribute key/value pairs on the link.
+	// Attribute keys MUST be unique (it is not allowed to have more than one
+	// attribute with the same key).
+	Attributes []*v11.KeyValue `protobuf:"bytes,4,rep,name=attributes,proto3" json:"attributes,omitempty"`
+	// dropped_attributes_count is the number of dropped attributes. If the value is 0,
+	// then no attributes were dropped.
+	DroppedAttributesCount uint32 `protobuf:"varint,5,opt,name=dropped_attributes_count,json=droppedAttributesCount,proto3" json:"dropped_attributes_count,omitempty"`
+}
+
+func (x *Span_Link) Reset() {
+	*x = Span_Link{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Span_Link) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Span_Link) ProtoMessage() {}
+
+func (x *Span_Link) ProtoReflect() protoreflect.Message {
+	mi := &file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Span_Link.ProtoReflect.Descriptor instead.
+func (*Span_Link) Descriptor() ([]byte, []int) {
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP(), []int{3, 1}
+}
+
+func (x *Span_Link) GetTraceId() []byte {
+	if x != nil {
+		return x.TraceId
+	}
+	return nil
+}
+
+func (x *Span_Link) GetSpanId() []byte {
+	if x != nil {
+		return x.SpanId
+	}
+	return nil
+}
+
+func (x *Span_Link) GetTraceState() string {
+	if x != nil {
+		return x.TraceState
+	}
+	return ""
+}
+
+func (x *Span_Link) GetAttributes() []*v11.KeyValue {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *Span_Link) GetDroppedAttributesCount() uint32 {
+	if x != nil {
+		return x.DroppedAttributesCount
+	}
+	return 0
+}
+
+var File_opentelemetry_proto_trace_v1_trace_proto protoreflect.FileDescriptor
+
+var file_opentelemetry_proto_trace_v1_trace_proto_rawDesc = []byte{
+	0x0a, 0x28, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1c, 0x6f, 0x70, 0x65, 0x6e,
+	0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x1a, 0x2a, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65,
+	0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x76, 0x31, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65,
+	0x74, 0x72, 0x79, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0x60, 0x0a, 0x0a, 0x54, 0x72, 0x61, 0x63, 0x65, 0x73, 0x44, 0x61,
+	0x74, 0x61, 0x12, 0x52, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x73,
+	0x70, 0x61, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x52, 0x0d, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x22, 0xc8, 0x01, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x12, 0x45, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
+	0x49, 0x0a, 0x0b, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d,
+	0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x52, 0x0a,
+	0x73, 0x63, 0x6f, 0x70, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x55, 0x72, 0x6c, 0x4a, 0x06, 0x08, 0xe8, 0x07, 0x10, 0xe9,
+	0x07, 0x22, 0xb0, 0x01, 0x0a, 0x0a, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x73,
+	0x12, 0x49, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x33, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e,
+	0x49, 0x6e, 0x73, 0x74, 0x72, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53,
+	0x63, 0x6f, 0x70, 0x65, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x38, 0x0a, 0x05, 0x73,
+	0x70, 0x61, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x70, 0x61, 0x6e, 0x52, 0x05,
+	0x73, 0x70, 0x61, 0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x5f,
+	0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x55, 0x72, 0x6c, 0x22, 0x9c, 0x0a, 0x0a, 0x04, 0x53, 0x70, 0x61, 0x6e, 0x12, 0x19, 0x0a,
+	0x08, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x07, 0x74, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70, 0x61, 0x6e,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73, 0x70, 0x61, 0x6e, 0x49,
+	0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x70, 0x61,
+	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x61, 0x72, 0x65,
+	0x6e, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x04,
+	0x6b, 0x69, 0x6e, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x70, 0x61, 0x6e, 0x2e, 0x53,
+	0x70, 0x61, 0x6e, 0x4b, 0x69, 0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x2f, 0x0a,
+	0x14, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x5f, 0x75, 0x6e, 0x69, 0x78,
+	0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18, 0x07, 0x20, 0x01, 0x28, 0x06, 0x52, 0x11, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x2b,
+	0x0a, 0x12, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f,
+	0x6e, 0x61, 0x6e, 0x6f, 0x18, 0x08, 0x20, 0x01, 0x28, 0x06, 0x52, 0x0f, 0x65, 0x6e, 0x64, 0x54,
+	0x69, 0x6d, 0x65, 0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x47, 0x0a, 0x0a, 0x61,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e,
+	0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x16, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x41,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x40,
+	0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x70,
+	0x61, 0x6e, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
+	0x12, 0x30, 0x0a, 0x14, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x65, 0x76, 0x65, 0x6e,
+	0x74, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x12,
+	0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x43, 0x6f, 0x75,
+	0x6e, 0x74, 0x12, 0x3d, 0x0a, 0x05, 0x6c, 0x69, 0x6e, 0x6b, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x70, 0x61, 0x6e, 0x2e, 0x4c, 0x69, 0x6e, 0x6b, 0x52, 0x05, 0x6c, 0x69, 0x6e, 0x6b,
+	0x73, 0x12, 0x2e, 0x0a, 0x13, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x6c, 0x69, 0x6e,
+	0x6b, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x11,
+	0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x4c, 0x69, 0x6e, 0x6b, 0x73, 0x43, 0x6f, 0x75, 0x6e,
+	0x74, 0x12, 0x3c, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0f, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x24, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a,
+	0xc4, 0x01, 0x0a, 0x05, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x74, 0x69, 0x6d,
+	0x65, 0x5f, 0x75, 0x6e, 0x69, 0x78, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x06, 0x52, 0x0c, 0x74, 0x69, 0x6d, 0x65, 0x55, 0x6e, 0x69, 0x78, 0x4e, 0x61, 0x6e, 0x6f, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x47, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65,
+	0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x38, 0x0a, 0x18,
+	0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x16,
+	0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x73, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x1a, 0xde, 0x01, 0x0a, 0x04, 0x4c, 0x69, 0x6e, 0x6b, 0x12,
+	0x19, 0x0a, 0x08, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x07, 0x74, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70,
+	0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73, 0x70, 0x61,
+	0x6e, 0x49, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x47, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74,
+	0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x38, 0x0a,
+	0x18, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x16, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x73, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x22, 0x99, 0x01, 0x0a, 0x08, 0x53, 0x70, 0x61, 0x6e,
+	0x4b, 0x69, 0x6e, 0x64, 0x12, 0x19, 0x0a, 0x15, 0x53, 0x50, 0x41, 0x4e, 0x5f, 0x4b, 0x49, 0x4e,
+	0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x16, 0x0a, 0x12, 0x53, 0x50, 0x41, 0x4e, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x49, 0x4e, 0x54,
+	0x45, 0x52, 0x4e, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x50, 0x41, 0x4e, 0x5f,
+	0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x02, 0x12, 0x14, 0x0a,
+	0x10, 0x53, 0x50, 0x41, 0x4e, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x43, 0x4c, 0x49, 0x45, 0x4e,
+	0x54, 0x10, 0x03, 0x12, 0x16, 0x0a, 0x12, 0x53, 0x50, 0x41, 0x4e, 0x5f, 0x4b, 0x49, 0x4e, 0x44,
+	0x5f, 0x50, 0x52, 0x4f, 0x44, 0x55, 0x43, 0x45, 0x52, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x53,
+	0x50, 0x41, 0x4e, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x43, 0x4f, 0x4e, 0x53, 0x55, 0x4d, 0x45,
+	0x52, 0x10, 0x05, 0x22, 0xbd, 0x01, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18,
+	0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x43, 0x0a, 0x04, 0x63, 0x6f, 0x64, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c,
+	0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x22, 0x4e, 0x0a,
+	0x0a, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x15, 0x0a, 0x11, 0x53,
+	0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x4f, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x45, 0x54,
+	0x10, 0x00, 0x12, 0x12, 0x0a, 0x0e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x4f, 0x44,
+	0x45, 0x5f, 0x4f, 0x4b, 0x10, 0x01, 0x12, 0x15, 0x0a, 0x11, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x43, 0x4f, 0x44, 0x45, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x02, 0x4a, 0x04, 0x08,
+	0x01, 0x10, 0x02, 0x42, 0x77, 0x0a, 0x1f, 0x69, 0x6f, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65,
+	0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x76, 0x31, 0x42, 0x0a, 0x54, 0x72, 0x61, 0x63, 0x65, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x50, 0x01, 0x5a, 0x27, 0x67, 0x6f, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x65, 0x6c,
+	0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x69, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x6f, 0x74, 0x6c, 0x70, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2f, 0x76, 0x31, 0xaa, 0x02, 0x1c,
+	0x4f, 0x70, 0x65, 0x6e, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x2e, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_opentelemetry_proto_trace_v1_trace_proto_rawDescOnce sync.Once
+	file_opentelemetry_proto_trace_v1_trace_proto_rawDescData = file_opentelemetry_proto_trace_v1_trace_proto_rawDesc
+)
+
+func file_opentelemetry_proto_trace_v1_trace_proto_rawDescGZIP() []byte {
+	file_opentelemetry_proto_trace_v1_trace_proto_rawDescOnce.Do(func() {
+		file_opentelemetry_proto_trace_v1_trace_proto_rawDescData = protoimpl.X.CompressGZIP(file_opentelemetry_proto_trace_v1_trace_proto_rawDescData)
+	})
+	return file_opentelemetry_proto_trace_v1_trace_proto_rawDescData
+}
+
+var file_opentelemetry_proto_trace_v1_trace_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_opentelemetry_proto_trace_v1_trace_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_opentelemetry_proto_trace_v1_trace_proto_goTypes = []interface{}{
+	(Span_SpanKind)(0),               // 0: opentelemetry.proto.trace.v1.Span.SpanKind
+	(Status_StatusCode)(0),           // 1: opentelemetry.proto.trace.v1.Status.StatusCode
+	(*TracesData)(nil),               // 2: opentelemetry.proto.trace.v1.TracesData
+	(*ResourceSpans)(nil),            // 3: opentelemetry.proto.trace.v1.ResourceSpans
+	(*ScopeSpans)(nil),               // 4: opentelemetry.proto.trace.v1.ScopeSpans
+	(*Span)(nil),                     // 5: opentelemetry.proto.trace.v1.Span
+	(*Status)(nil),                   // 6: opentelemetry.proto.trace.v1.Status
+	(*Span_Event)(nil),               // 7: opentelemetry.proto.trace.v1.Span.Event
+	(*Span_Link)(nil),                // 8: opentelemetry.proto.trace.v1.Span.Link
+	(*v1.Resource)(nil),              // 9: opentelemetry.proto.resource.v1.Resource
+	(*v11.InstrumentationScope)(nil), // 10: opentelemetry.proto.common.v1.InstrumentationScope
+	(*v11.KeyValue)(nil),             // 11: opentelemetry.proto.common.v1.KeyValue
+}
+var file_opentelemetry_proto_trace_v1_trace_proto_depIdxs = []int32{
+	3,  // 0: opentelemetry.proto.trace.v1.TracesData.resource_spans:type_name -> opentelemetry.proto.trace.v1.ResourceSpans
+	9,  // 1: opentelemetry.proto.trace.v1.ResourceSpans.resource:type_name -> opentelemetry.proto.resource.v1.Resource
+	4,  // 2: opentelemetry.proto.trace.v1.ResourceSpans.scope_spans:type_name -> opentelemetry.proto.trace.v1.ScopeSpans
+	10, // 3: opentelemetry.proto.trace.v1.ScopeSpans.scope:type_name -> opentelemetry.proto.common.v1.InstrumentationScope
+	5,  // 4: opentelemetry.proto.trace.v1.ScopeSpans.spans:type_name -> opentelemetry.proto.trace.v1.Span
+	0,  // 5: opentelemetry.proto.trace.v1.Span.kind:type_name -> opentelemetry.proto.trace.v1.Span.SpanKind
+	11, // 6: opentelemetry.proto.trace.v1.Span.attributes:type_name -> opentelemetry.proto.common.v1.KeyValue
+	7,  // 7: opentelemetry.proto.trace.v1.Span.events:type_name -> opentelemetry.proto.trace.v1.Span.Event
+	8,  // 8: opentelemetry.proto.trace.v1.Span.links:type_name -> opentelemetry.proto.trace.v1.Span.Link
+	6,  // 9: opentelemetry.proto.trace.v1.Span.status:type_name -> opentelemetry.proto.trace.v1.Status
+	1,  // 10: opentelemetry.proto.trace.v1.Status.code:type_name -> opentelemetry.proto.trace.v1.Status.StatusCode
+	11, // 11: opentelemetry.proto.trace.v1.Span.Event.attributes:type_name -> opentelemetry.proto.common.v1.KeyValue
+	11, // 12: opentelemetry.proto.trace.v1.Span.Link.attributes:type_name -> opentelemetry.proto.common.v1.KeyValue
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
+}
+
+func init() { file_opentelemetry_proto_trace_v1_trace_proto_init() }
+func file_opentelemetry_proto_trace_v1_trace_proto_init() {
+	if File_opentelemetry_proto_trace_v1_trace_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TracesData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResourceSpans); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ScopeSpans); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Span); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Status); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Span_Event); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opentelemetry_proto_trace_v1_trace_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Span_Link); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_opentelemetry_proto_trace_v1_trace_proto_rawDesc,
+			NumEnums:      2,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_opentelemetry_proto_trace_v1_trace_proto_goTypes,
+		DependencyIndexes: file_opentelemetry_proto_trace_v1_trace_proto_depIdxs,
+		EnumInfos:         file_opentelemetry_proto_trace_v1_trace_proto_enumTypes,
+		MessageInfos:      file_opentelemetry_proto_trace_v1_trace_proto_msgTypes,
+	}.Build()
+	File_opentelemetry_proto_trace_v1_trace_proto = out.File
+	file_opentelemetry_proto_trace_v1_trace_proto_rawDesc = nil
+	file_opentelemetry_proto_trace_v1_trace_proto_goTypes = nil
+	file_opentelemetry_proto_trace_v1_trace_proto_depIdxs = nil
+}
diff --git a/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroup.go b/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroup.go
index 1257d0c92b..fe4ecf561e 100644
--- a/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroup.go
+++ b/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroup.go
@@ -18,6 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build linux
 // +build linux
 
 package cgroups
diff --git a/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups.go b/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups.go
index e2489b826e..e6c1731979 100644
--- a/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups.go
+++ b/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups.go
@@ -18,6 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build linux
 // +build linux
 
 package cgroups
diff --git a/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups2.go b/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups2.go
new file mode 100644
index 0000000000..3ac10c8b6f
--- /dev/null
+++ b/vendor/go.uber.org/automaxprocs/internal/cgroups/cgroups2.go
@@ -0,0 +1,172 @@
+// Copyright (c) 2022 Uber Technologies, Inc.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:build linux
+// +build linux
+
+package cgroups
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+)
+
+const (
+	// _cgroupv2CPUMax is the file name for the CGroup-V2 CPU max and period
+	// parameter.
+	_cgroupv2CPUMax = "cpu.max"
+	// _cgroupFSType is the Linux CGroup-V2 file system type used in
+	// `/proc/$PID/mountinfo`.
+	_cgroupv2FSType = "cgroup2"
+
+	_cgroupv2MountPoint = "/sys/fs/cgroup"
+
+	_cgroupV2CPUMaxDefaultPeriod = 100000
+	_cgroupV2CPUMaxQuotaMax      = "max"
+)
+
+const (
+	_cgroupv2CPUMaxQuotaIndex = iota
+	_cgroupv2CPUMaxPeriodIndex
+)
+
+// ErrNotV2 indicates that the system is not using cgroups2.
+var ErrNotV2 = errors.New("not using cgroups2")
+
+// CGroups2 provides access to cgroups data for systems using cgroups2.
+type CGroups2 struct {
+	mountPoint string
+	groupPath  string
+	cpuMaxFile string
+}
+
+// NewCGroups2ForCurrentProcess builds a CGroups2 for the current process.
+//
+// This returns ErrNotV2 if the system is not using cgroups2.
+func NewCGroups2ForCurrentProcess() (*CGroups2, error) {
+	return newCGroups2From(_procPathMountInfo, _procPathCGroup)
+}
+
+func newCGroups2From(mountInfoPath, procPathCGroup string) (*CGroups2, error) {
+	isV2, err := isCGroupV2(mountInfoPath)
+	if err != nil {
+		return nil, err
+	}
+
+	if !isV2 {
+		return nil, ErrNotV2
+	}
+
+	subsystems, err := parseCGroupSubsystems(procPathCGroup)
+	if err != nil {
+		return nil, err
+	}
+
+	// Find v2 subsystem by looking for the `0` id
+	var v2subsys *CGroupSubsys
+	for _, subsys := range subsystems {
+		if subsys.ID == 0 {
+			v2subsys = subsys
+			break
+		}
+	}
+
+	if v2subsys == nil {
+		return nil, ErrNotV2
+	}
+
+	return &CGroups2{
+		mountPoint: _cgroupv2MountPoint,
+		groupPath:  v2subsys.Name,
+		cpuMaxFile: _cgroupv2CPUMax,
+	}, nil
+}
+
+func isCGroupV2(procPathMountInfo string) (bool, error) {
+	var (
+		isV2          bool
+		newMountPoint = func(mp *MountPoint) error {
+			isV2 = isV2 || (mp.FSType == _cgroupv2FSType && mp.MountPoint == _cgroupv2MountPoint)
+			return nil
+		}
+	)
+
+	if err := parseMountInfo(procPathMountInfo, newMountPoint); err != nil {
+		return false, err
+	}
+
+	return isV2, nil
+}
+
+// CPUQuota returns the CPU quota applied with the CPU cgroup2 controller.
+// It is a result of reading cpu quota and period from cpu.max file.
+// It will return `cpu.max / cpu.period`. If cpu.max is set to max, it returns
+// (-1, false, nil)
+func (cg *CGroups2) CPUQuota() (float64, bool, error) {
+	cpuMaxParams, err := os.Open(path.Join(cg.mountPoint, cg.groupPath, cg.cpuMaxFile))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return -1, false, nil
+		}
+		return -1, false, err
+	}
+	defer cpuMaxParams.Close()
+
+	scanner := bufio.NewScanner(cpuMaxParams)
+	if scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) == 0 || len(fields) > 2 {
+			return -1, false, fmt.Errorf("invalid format")
+		}
+
+		if fields[_cgroupv2CPUMaxQuotaIndex] == _cgroupV2CPUMaxQuotaMax {
+			return -1, false, nil
+		}
+
+		max, err := strconv.Atoi(fields[_cgroupv2CPUMaxQuotaIndex])
+		if err != nil {
+			return -1, false, err
+		}
+
+		var period int
+		if len(fields) == 1 {
+			period = _cgroupV2CPUMaxDefaultPeriod
+		} else {
+			period, err = strconv.Atoi(fields[_cgroupv2CPUMaxPeriodIndex])
+			if err != nil {
+				return -1, false, err
+			}
+		}
+
+		return float64(max) / float64(period), true, nil
+	}
+
+	if err := scanner.Err(); err != nil {
+		return -1, false, err
+	}
+
+	return 0, false, io.ErrUnexpectedEOF
+}
diff --git a/vendor/go.uber.org/automaxprocs/internal/cgroups/errors.go b/vendor/go.uber.org/automaxprocs/internal/cgroups/errors.go
index bad8d7ae88..94ac75a46e 100644
--- a/vendor/go.uber.org/automaxprocs/internal/cgroups/errors.go
+++ b/vendor/go.uber.org/automaxprocs/internal/cgroups/errors.go
@@ -18,6 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build linux
 // +build linux
 
 package cgroups
diff --git a/vendor/go.uber.org/automaxprocs/internal/cgroups/mountpoint.go b/vendor/go.uber.org/automaxprocs/internal/cgroups/mountpoint.go
index d6238d5cf7..2efde4c4ba 100644
--- a/vendor/go.uber.org/automaxprocs/internal/cgroups/mountpoint.go
+++ b/vendor/go.uber.org/automaxprocs/internal/cgroups/mountpoint.go
@@ -18,6 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build linux
 // +build linux
 
 package cgroups
diff --git a/vendor/go.uber.org/automaxprocs/internal/cgroups/subsys.go b/vendor/go.uber.org/automaxprocs/internal/cgroups/subsys.go
index 103e86f3cc..cddc3eaec3 100644
--- a/vendor/go.uber.org/automaxprocs/internal/cgroups/subsys.go
+++ b/vendor/go.uber.org/automaxprocs/internal/cgroups/subsys.go
@@ -18,6 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build linux
 // +build linux
 
 package cgroups
diff --git a/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_linux.go b/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_linux.go
index 37699c31d3..3b974754c3 100644
--- a/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_linux.go
+++ b/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_linux.go
@@ -18,11 +18,13 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build linux
 // +build linux
 
 package runtime
 
 import (
+	"errors"
 	"math"
 
 	cg "go.uber.org/automaxprocs/internal/cgroups"
@@ -31,7 +33,7 @@ import (
 // CPUQuotaToGOMAXPROCS converts the CPU quota applied to the calling process
 // to a valid GOMAXPROCS value.
 func CPUQuotaToGOMAXPROCS(minValue int) (int, CPUQuotaStatus, error) {
-	cgroups, err := cg.NewCGroupsForCurrentProcess()
+	cgroups, err := newQueryer()
 	if err != nil {
 		return -1, CPUQuotaUndefined, err
 	}
@@ -47,3 +49,23 @@ func CPUQuotaToGOMAXPROCS(minValue int) (int, CPUQuotaStatus, error) {
 	}
 	return maxProcs, CPUQuotaUsed, nil
 }
+
+type queryer interface {
+	CPUQuota() (float64, bool, error)
+}
+
+var (
+	_newCgroups2 = cg.NewCGroups2ForCurrentProcess
+	_newCgroups  = cg.NewCGroupsForCurrentProcess
+)
+
+func newQueryer() (queryer, error) {
+	cgroups, err := _newCgroups2()
+	if err == nil {
+		return cgroups, nil
+	}
+	if errors.Is(err, cg.ErrNotV2) {
+		return _newCgroups()
+	}
+	return nil, err
+}
diff --git a/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_unsupported.go b/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_unsupported.go
index 5915a2efbf..6922554484 100644
--- a/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_unsupported.go
+++ b/vendor/go.uber.org/automaxprocs/internal/runtime/cpu_quota_unsupported.go
@@ -18,6 +18,7 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
+//go:build !linux
 // +build !linux
 
 package runtime
diff --git a/vendor/go.uber.org/automaxprocs/internal/runtime/runtime.go b/vendor/go.uber.org/automaxprocs/internal/runtime/runtime.go
index 3a75156491..df6eacf053 100644
--- a/vendor/go.uber.org/automaxprocs/internal/runtime/runtime.go
+++ b/vendor/go.uber.org/automaxprocs/internal/runtime/runtime.go
@@ -28,6 +28,6 @@ const (
 	CPUQuotaUndefined CPUQuotaStatus = iota
 	// CPUQuotaUsed is returned when a valid CPU quota can be used
 	CPUQuotaUsed
-	// CPUQuotaMinUsed is return when CPU quota is smaller than the min value
+	// CPUQuotaMinUsed is returned when CPU quota is smaller than the min value
 	CPUQuotaMinUsed
 )
diff --git a/vendor/go.uber.org/automaxprocs/maxprocs/maxprocs.go b/vendor/go.uber.org/automaxprocs/maxprocs/maxprocs.go
index ec032438fd..98176d6457 100644
--- a/vendor/go.uber.org/automaxprocs/maxprocs/maxprocs.go
+++ b/vendor/go.uber.org/automaxprocs/maxprocs/maxprocs.go
@@ -96,7 +96,7 @@ func Set(opts ...Option) (func(), error) {
 	// Honor the GOMAXPROCS environment variable if present. Otherwise, amend
 	// `runtime.GOMAXPROCS()` with the current process' CPU quota if the OS is
 	// Linux, and guarantee a minimum value of 1. The minimum guaranteed value
-	// can be overriden using `maxprocs.Min()`.
+	// can be overridden using `maxprocs.Min()`.
 	if max, exists := os.LookupEnv(_maxProcsKey); exists {
 		cfg.log("maxprocs: Honoring GOMAXPROCS=%q as set in environment", max)
 		return undoNoop, nil
diff --git a/vendor/go.uber.org/automaxprocs/maxprocs/version.go b/vendor/go.uber.org/automaxprocs/maxprocs/version.go
index d9ad8f4cf1..108a95535e 100644
--- a/vendor/go.uber.org/automaxprocs/maxprocs/version.go
+++ b/vendor/go.uber.org/automaxprocs/maxprocs/version.go
@@ -21,4 +21,4 @@
 package maxprocs
 
 // Version is the current package version.
-const Version = "1.4.0"
+const Version = "1.5.2"
diff --git a/vendor/golang.org/x/net/AUTHORS b/vendor/golang.org/x/net/AUTHORS
deleted file mode 100644
index 15167cd746..0000000000
--- a/vendor/golang.org/x/net/AUTHORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code refers to The Go Authors for copyright purposes.
-# The master list of authors is in the main Go distribution,
-# visible at http://tip.golang.org/AUTHORS.
diff --git a/vendor/golang.org/x/net/CONTRIBUTORS b/vendor/golang.org/x/net/CONTRIBUTORS
deleted file mode 100644
index 1c4577e968..0000000000
--- a/vendor/golang.org/x/net/CONTRIBUTORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code was written by the Go contributors.
-# The master list of contributors is in the main Go distribution,
-# visible at http://tip.golang.org/CONTRIBUTORS.
diff --git a/vendor/golang.org/x/net/bpf/doc.go b/vendor/golang.org/x/net/bpf/doc.go
index ae62feb534..04ec1c8ab5 100644
--- a/vendor/golang.org/x/net/bpf/doc.go
+++ b/vendor/golang.org/x/net/bpf/doc.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 /*
-
 Package bpf implements marshaling and unmarshaling of programs for the
 Berkeley Packet Filter virtual machine, and provides a Go implementation
 of the virtual machine.
@@ -21,7 +20,7 @@ access to kernel functions, and while conditional branches are
 allowed, they can only jump forwards, to guarantee that there are no
 infinite loops.
 
-The virtual machine
+# The virtual machine
 
 The BPF VM is an accumulator machine. Its main register, called
 register A, is an implicit source and destination in all arithmetic
@@ -50,7 +49,7 @@ to extensions, which are essentially calls to kernel utility
 functions. Currently, the only extensions supported by this package
 are the Linux packet filter extensions.
 
-Examples
+# Examples
 
 This packet filter selects all ARP packets.
 
@@ -77,6 +76,5 @@ This packet filter captures a random 1% sample of traffic.
 		// Ignore.
 		bpf.RetConstant{Val: 0},
 	})
-
 */
 package bpf // import "golang.org/x/net/bpf"
diff --git a/vendor/golang.org/x/net/bpf/vm_instructions.go b/vendor/golang.org/x/net/bpf/vm_instructions.go
index cf8947c332..0aa307c061 100644
--- a/vendor/golang.org/x/net/bpf/vm_instructions.go
+++ b/vendor/golang.org/x/net/bpf/vm_instructions.go
@@ -94,7 +94,7 @@ func jumpIfCommon(cond JumpTest, skipTrue, skipFalse uint8, regA uint32, value u
 
 func loadAbsolute(ins LoadAbsolute, in []byte) (uint32, bool) {
 	offset := int(ins.Off)
-	size := int(ins.Size)
+	size := ins.Size
 
 	return loadCommon(in, offset, size)
 }
@@ -121,7 +121,7 @@ func loadExtension(ins LoadExtension, in []byte) uint32 {
 
 func loadIndirect(ins LoadIndirect, in []byte, regX uint32) (uint32, bool) {
 	offset := int(ins.Off) + int(regX)
-	size := int(ins.Size)
+	size := ins.Size
 
 	return loadCommon(in, offset, size)
 }
diff --git a/vendor/golang.org/x/net/context/ctxhttp/ctxhttp.go b/vendor/golang.org/x/net/context/ctxhttp/ctxhttp.go
new file mode 100644
index 0000000000..37dc0cfdb5
--- /dev/null
+++ b/vendor/golang.org/x/net/context/ctxhttp/ctxhttp.go
@@ -0,0 +1,71 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package ctxhttp provides helper functions for performing context-aware HTTP requests.
+package ctxhttp // import "golang.org/x/net/context/ctxhttp"
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+// Do sends an HTTP request with the provided http.Client and returns
+// an HTTP response.
+//
+// If the client is nil, http.DefaultClient is used.
+//
+// The provided ctx must be non-nil. If it is canceled or times out,
+// ctx.Err() will be returned.
+func Do(ctx context.Context, client *http.Client, req *http.Request) (*http.Response, error) {
+	if client == nil {
+		client = http.DefaultClient
+	}
+	resp, err := client.Do(req.WithContext(ctx))
+	// If we got an error, and the context has been canceled,
+	// the context's error is probably more useful.
+	if err != nil {
+		select {
+		case <-ctx.Done():
+			err = ctx.Err()
+		default:
+		}
+	}
+	return resp, err
+}
+
+// Get issues a GET request via the Do function.
+func Get(ctx context.Context, client *http.Client, url string) (*http.Response, error) {
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+	return Do(ctx, client, req)
+}
+
+// Head issues a HEAD request via the Do function.
+func Head(ctx context.Context, client *http.Client, url string) (*http.Response, error) {
+	req, err := http.NewRequest("HEAD", url, nil)
+	if err != nil {
+		return nil, err
+	}
+	return Do(ctx, client, req)
+}
+
+// Post issues a POST request via the Do function.
+func Post(ctx context.Context, client *http.Client, url string, bodyType string, body io.Reader) (*http.Response, error) {
+	req, err := http.NewRequest("POST", url, body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", bodyType)
+	return Do(ctx, client, req)
+}
+
+// PostForm issues a POST request via the Do function.
+func PostForm(ctx context.Context, client *http.Client, url string, data url.Values) (*http.Response, error) {
+	return Post(ctx, client, url, "application/x-www-form-urlencoded", strings.NewReader(data.Encode()))
+}
diff --git a/vendor/golang.org/x/net/http/httpguts/httplex.go b/vendor/golang.org/x/net/http/httpguts/httplex.go
index c79aa73f28..6e071e8524 100644
--- a/vendor/golang.org/x/net/http/httpguts/httplex.go
+++ b/vendor/golang.org/x/net/http/httpguts/httplex.go
@@ -173,13 +173,15 @@ func tokenEqual(t1, t2 string) bool {
 
 // isLWS reports whether b is linear white space, according
 // to http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
-//      LWS            = [CRLF] 1*( SP | HT )
+//
+//	LWS            = [CRLF] 1*( SP | HT )
 func isLWS(b byte) bool { return b == ' ' || b == '\t' }
 
 // isCTL reports whether b is a control byte, according
 // to http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
-//      CTL            = <any US-ASCII control character
-//                       (octets 0 - 31) and DEL (127)>
+//
+//	CTL            = <any US-ASCII control character
+//	                 (octets 0 - 31) and DEL (127)>
 func isCTL(b byte) bool {
 	const del = 0x7f // a CTL
 	return b < ' ' || b == del
@@ -189,12 +191,13 @@ func isCTL(b byte) bool {
 // HTTP/2 imposes the additional restriction that uppercase ASCII
 // letters are not allowed.
 //
-//  RFC 7230 says:
-//   header-field   = field-name ":" OWS field-value OWS
-//   field-name     = token
-//   token          = 1*tchar
-//   tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
-//           "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+// RFC 7230 says:
+//
+//	header-field   = field-name ":" OWS field-value OWS
+//	field-name     = token
+//	token          = 1*tchar
+//	tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
+//	        "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
 func ValidHeaderFieldName(v string) bool {
 	if len(v) == 0 {
 		return false
@@ -267,27 +270,28 @@ var validHostByte = [256]bool{
 // ValidHeaderFieldValue reports whether v is a valid "field-value" according to
 // http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 :
 //
-//        message-header = field-name ":" [ field-value ]
-//        field-value    = *( field-content | LWS )
-//        field-content  = <the OCTETs making up the field-value
-//                         and consisting of either *TEXT or combinations
-//                         of token, separators, and quoted-string>
+//	message-header = field-name ":" [ field-value ]
+//	field-value    = *( field-content | LWS )
+//	field-content  = <the OCTETs making up the field-value
+//	                 and consisting of either *TEXT or combinations
+//	                 of token, separators, and quoted-string>
 //
 // http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 :
 //
-//        TEXT           = <any OCTET except CTLs,
-//                          but including LWS>
-//        LWS            = [CRLF] 1*( SP | HT )
-//        CTL            = <any US-ASCII control character
-//                         (octets 0 - 31) and DEL (127)>
+//	TEXT           = <any OCTET except CTLs,
+//	                  but including LWS>
+//	LWS            = [CRLF] 1*( SP | HT )
+//	CTL            = <any US-ASCII control character
+//	                 (octets 0 - 31) and DEL (127)>
 //
 // RFC 7230 says:
-//  field-value    = *( field-content / obs-fold )
-//  obj-fold       =  N/A to http2, and deprecated
-//  field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
-//  field-vchar    = VCHAR / obs-text
-//  obs-text       = %x80-FF
-//  VCHAR          = "any visible [USASCII] character"
+//
+//	field-value    = *( field-content / obs-fold )
+//	obj-fold       =  N/A to http2, and deprecated
+//	field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+//	field-vchar    = VCHAR / obs-text
+//	obs-text       = %x80-FF
+//	VCHAR          = "any visible [USASCII] character"
 //
 // http2 further says: "Similarly, HTTP/2 allows header field values
 // that are not valid. While most of the values that can be encoded
diff --git a/vendor/golang.org/x/net/http2/client_conn_pool.go b/vendor/golang.org/x/net/http2/client_conn_pool.go
index c936843eaf..780968d6c1 100644
--- a/vendor/golang.org/x/net/http2/client_conn_pool.go
+++ b/vendor/golang.org/x/net/http2/client_conn_pool.go
@@ -139,7 +139,6 @@ func (p *clientConnPool) getStartDialLocked(ctx context.Context, addr string) *d
 func (c *dialCall) dial(ctx context.Context, addr string) {
 	const singleUse = false // shared conn
 	c.res, c.err = c.p.t.dialClientConn(ctx, addr, singleUse)
-	close(c.done)
 
 	c.p.mu.Lock()
 	delete(c.p.dialing, addr)
@@ -147,6 +146,8 @@ func (c *dialCall) dial(ctx context.Context, addr string) {
 		c.p.addConnLocked(addr, c.res)
 	}
 	c.p.mu.Unlock()
+
+	close(c.done)
 }
 
 // addConnIfNeeded makes a NewClientConn out of c if a connection for key doesn't
diff --git a/vendor/golang.org/x/net/http2/errors.go b/vendor/golang.org/x/net/http2/errors.go
index 2663e5d287..f2067dabc5 100644
--- a/vendor/golang.org/x/net/http2/errors.go
+++ b/vendor/golang.org/x/net/http2/errors.go
@@ -136,7 +136,7 @@ func (e headerFieldNameError) Error() string {
 type headerFieldValueError string
 
 func (e headerFieldValueError) Error() string {
-	return fmt.Sprintf("invalid header field value %q", string(e))
+	return fmt.Sprintf("invalid header field value for %q", string(e))
 }
 
 var (
diff --git a/vendor/golang.org/x/net/http2/flow.go b/vendor/golang.org/x/net/http2/flow.go
index b51f0e0cf1..b7dbd18695 100644
--- a/vendor/golang.org/x/net/http2/flow.go
+++ b/vendor/golang.org/x/net/http2/flow.go
@@ -6,23 +6,91 @@
 
 package http2
 
-// flow is the flow control window's size.
-type flow struct {
+// inflowMinRefresh is the minimum number of bytes we'll send for a
+// flow control window update.
+const inflowMinRefresh = 4 << 10
+
+// inflow accounts for an inbound flow control window.
+// It tracks both the latest window sent to the peer (used for enforcement)
+// and the accumulated unsent window.
+type inflow struct {
+	avail  int32
+	unsent int32
+}
+
+// init sets the initial window.
+func (f *inflow) init(n int32) {
+	f.avail = n
+}
+
+// add adds n bytes to the window, with a maximum window size of max,
+// indicating that the peer can now send us more data.
+// For example, the user read from a {Request,Response} body and consumed
+// some of the buffered data, so the peer can now send more.
+// It returns the number of bytes to send in a WINDOW_UPDATE frame to the peer.
+// Window updates are accumulated and sent when the unsent capacity
+// is at least inflowMinRefresh or will at least double the peer's available window.
+func (f *inflow) add(n int) (connAdd int32) {
+	if n < 0 {
+		panic("negative update")
+	}
+	unsent := int64(f.unsent) + int64(n)
+	// "A sender MUST NOT allow a flow-control window to exceed 2^31-1 octets."
+	// RFC 7540 Section 6.9.1.
+	const maxWindow = 1<<31 - 1
+	if unsent+int64(f.avail) > maxWindow {
+		panic("flow control update exceeds maximum window size")
+	}
+	f.unsent = int32(unsent)
+	if f.unsent < inflowMinRefresh && f.unsent < f.avail {
+		// If there aren't at least inflowMinRefresh bytes of window to send,
+		// and this update won't at least double the window, buffer the update for later.
+		return 0
+	}
+	f.avail += f.unsent
+	f.unsent = 0
+	return int32(unsent)
+}
+
+// take attempts to take n bytes from the peer's flow control window.
+// It reports whether the window has available capacity.
+func (f *inflow) take(n uint32) bool {
+	if n > uint32(f.avail) {
+		return false
+	}
+	f.avail -= int32(n)
+	return true
+}
+
+// takeInflows attempts to take n bytes from two inflows,
+// typically connection-level and stream-level flows.
+// It reports whether both windows have available capacity.
+func takeInflows(f1, f2 *inflow, n uint32) bool {
+	if n > uint32(f1.avail) || n > uint32(f2.avail) {
+		return false
+	}
+	f1.avail -= int32(n)
+	f2.avail -= int32(n)
+	return true
+}
+
+// outflow is the outbound flow control window's size.
+type outflow struct {
 	_ incomparable
 
 	// n is the number of DATA bytes we're allowed to send.
-	// A flow is kept both on a conn and a per-stream.
+	// An outflow is kept both on a conn and a per-stream.
 	n int32
 
-	// conn points to the shared connection-level flow that is
-	// shared by all streams on that conn. It is nil for the flow
+	// conn points to the shared connection-level outflow that is
+	// shared by all streams on that conn. It is nil for the outflow
 	// that's on the conn directly.
-	conn *flow
+	conn *outflow
 }
 
-func (f *flow) setConnFlow(cf *flow) { f.conn = cf }
+func (f *outflow) setConnFlow(cf *outflow) { f.conn = cf }
 
-func (f *flow) available() int32 {
+func (f *outflow) available() int32 {
 	n := f.n
 	if f.conn != nil && f.conn.n < n {
 		n = f.conn.n
@@ -30,7 +98,7 @@ func (f *flow) available() int32 {
 	return n
 }
 
-func (f *flow) take(n int32) {
+func (f *outflow) take(n int32) {
 	if n > f.available() {
 		panic("internal error: took too much")
 	}
@@ -42,7 +110,7 @@ func (f *flow) take(n int32) {
 
 // add adds n bytes (positive or negative) to the flow control window.
 // It returns false if the sum would exceed 2^31-1.
-func (f *flow) add(n int32) bool {
+func (f *outflow) add(n int32) bool {
 	sum := f.n + n
 	if (sum > n) == (f.n > 0) {
 		f.n = sum
diff --git a/vendor/golang.org/x/net/http2/frame.go b/vendor/golang.org/x/net/http2/frame.go
index 96a7479052..c1f6b90dc3 100644
--- a/vendor/golang.org/x/net/http2/frame.go
+++ b/vendor/golang.org/x/net/http2/frame.go
@@ -23,7 +23,7 @@ const frameHeaderLen = 9
 var padZeros = make([]byte, 255) // zeros for padding
 
 // A FrameType is a registered frame type as defined in
-// http://http2.github.io/http2-spec/#rfc.section.11.2
+// https://httpwg.org/specs/rfc7540.html#rfc.section.11.2
 type FrameType uint8
 
 const (
@@ -146,7 +146,7 @@ func typeFrameParser(t FrameType) frameParser {
 
 // A FrameHeader is the 9 byte header of all HTTP/2 frames.
 //
-// See http://http2.github.io/http2-spec/#FrameHeader
+// See https://httpwg.org/specs/rfc7540.html#FrameHeader
 type FrameHeader struct {
 	valid bool // caller can access []byte fields in the Frame
 
@@ -575,7 +575,7 @@ func (fr *Framer) checkFrameOrder(f Frame) error {
 
 // A DataFrame conveys arbitrary, variable-length sequences of octets
 // associated with a stream.
-// See http://http2.github.io/http2-spec/#rfc.section.6.1
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.1
 type DataFrame struct {
 	FrameHeader
 	data []byte
@@ -662,6 +662,15 @@ func (f *Framer) WriteData(streamID uint32, endStream bool, data []byte) error {
 // It is the caller's responsibility not to violate the maximum frame size
 // and to not call other Write methods concurrently.
 func (f *Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad []byte) error {
+	if err := f.startWriteDataPadded(streamID, endStream, data, pad); err != nil {
+		return err
+	}
+	return f.endWrite()
+}
+
+// startWriteDataPadded is WriteDataPadded, but only writes the frame to the Framer's internal buffer.
+// The caller should call endWrite to flush the frame to the underlying writer.
+func (f *Framer) startWriteDataPadded(streamID uint32, endStream bool, data, pad []byte) error {
 	if !validStreamID(streamID) && !f.AllowIllegalWrites {
 		return errStreamID
 	}
@@ -691,14 +700,14 @@ func (f *Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad []by
 	}
 	f.wbuf = append(f.wbuf, data...)
 	f.wbuf = append(f.wbuf, pad...)
-	return f.endWrite()
+	return nil
 }
 
 // A SettingsFrame conveys configuration parameters that affect how
 // endpoints communicate, such as preferences and constraints on peer
 // behavior.
 //
-// See http://http2.github.io/http2-spec/#SETTINGS
+// See https://httpwg.org/specs/rfc7540.html#SETTINGS
 type SettingsFrame struct {
 	FrameHeader
 	p []byte
@@ -837,7 +846,7 @@ func (f *Framer) WriteSettingsAck() error {
 // A PingFrame is a mechanism for measuring a minimal round trip time
 // from the sender, as well as determining whether an idle connection
 // is still functional.
-// See http://http2.github.io/http2-spec/#rfc.section.6.7
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.7
 type PingFrame struct {
 	FrameHeader
 	Data [8]byte
@@ -870,7 +879,7 @@ func (f *Framer) WritePing(ack bool, data [8]byte) error {
 }
 
 // A GoAwayFrame informs the remote peer to stop creating streams on this connection.
-// See http://http2.github.io/http2-spec/#rfc.section.6.8
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.8
 type GoAwayFrame struct {
 	FrameHeader
 	LastStreamID uint32
@@ -934,7 +943,7 @@ func parseUnknownFrame(_ *frameCache, fh FrameHeader, countError func(string), p
 }
 
 // A WindowUpdateFrame is used to implement flow control.
-// See http://http2.github.io/http2-spec/#rfc.section.6.9
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.9
 type WindowUpdateFrame struct {
 	FrameHeader
 	Increment uint32 // never read with high bit set
@@ -1123,7 +1132,7 @@ func (f *Framer) WriteHeaders(p HeadersFrameParam) error {
 }
 
 // A PriorityFrame specifies the sender-advised priority of a stream.
-// See http://http2.github.io/http2-spec/#rfc.section.6.3
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.3
 type PriorityFrame struct {
 	FrameHeader
 	PriorityParam
@@ -1193,7 +1202,7 @@ func (f *Framer) WritePriority(streamID uint32, p PriorityParam) error {
 }
 
 // A RSTStreamFrame allows for abnormal termination of a stream.
-// See http://http2.github.io/http2-spec/#rfc.section.6.4
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.4
 type RSTStreamFrame struct {
 	FrameHeader
 	ErrCode ErrCode
@@ -1225,7 +1234,7 @@ func (f *Framer) WriteRSTStream(streamID uint32, code ErrCode) error {
 }
 
 // A ContinuationFrame is used to continue a sequence of header block fragments.
-// See http://http2.github.io/http2-spec/#rfc.section.6.10
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.10
 type ContinuationFrame struct {
 	FrameHeader
 	headerFragBuf []byte
@@ -1266,7 +1275,7 @@ func (f *Framer) WriteContinuation(streamID uint32, endHeaders bool, headerBlock
 }
 
 // A PushPromiseFrame is used to initiate a server stream.
-// See http://http2.github.io/http2-spec/#rfc.section.6.6
+// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.6
 type PushPromiseFrame struct {
 	FrameHeader
 	PromiseID     uint32
@@ -1532,7 +1541,8 @@ func (fr *Framer) readMetaFrame(hf *HeadersFrame) (*MetaHeadersFrame, error) {
 			fr.debugReadLoggerf("http2: decoded hpack field %+v", hf)
 		}
 		if !httpguts.ValidHeaderFieldValue(hf.Value) {
-			invalid = headerFieldValueError(hf.Value)
+			// Don't include the value in the error, because it may be sensitive.
+			invalid = headerFieldValueError(hf.Name)
 		}
 		isPseudo := strings.HasPrefix(hf.Name, ":")
 		if isPseudo {
diff --git a/vendor/golang.org/x/net/http2/go118.go b/vendor/golang.org/x/net/http2/go118.go
new file mode 100644
index 0000000000..aca4b2b31a
--- /dev/null
+++ b/vendor/golang.org/x/net/http2/go118.go
@@ -0,0 +1,17 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.18
+// +build go1.18
+
+package http2
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+func tlsUnderlyingConn(tc *tls.Conn) net.Conn {
+	return tc.NetConn()
+}
diff --git a/vendor/golang.org/x/net/http2/h2c/h2c.go b/vendor/golang.org/x/net/http2/h2c/h2c.go
index c0970d8467..a72bbed1bc 100644
--- a/vendor/golang.org/x/net/http2/h2c/h2c.go
+++ b/vendor/golang.org/x/net/http2/h2c/h2c.go
@@ -12,7 +12,6 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/base64"
-	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
@@ -25,7 +24,6 @@ import (
 
 	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/hpack"
 )
 
 var (
@@ -61,6 +59,10 @@ type h2cHandler struct {
 // Once a request is recognized as h2c, we hijack the connection and convert it
 // to an HTTP/2 connection which is understandable to s.ServeConn. (s.ServeConn
 // understands HTTP/2 except for the h2c part of it.)
+//
+// The first request on an h2c connection is read entirely into memory before
+// the Handler is called. To limit the memory consumed by this request, wrap
+// the result of NewHandler in an http.MaxBytesHandler.
 func NewHandler(h http.Handler, s *http2.Server) http.Handler {
 	return &h2cHandler{
 		Handler: h,
@@ -68,6 +70,15 @@ func NewHandler(h http.Handler, s *http2.Server) http.Handler {
 	}
 }
 
+// extractServer extracts existing http.Server instance from http.Request or create an empty http.Server
+func extractServer(r *http.Request) *http.Server {
+	server, ok := r.Context().Value(http.ServerContextKey).(*http.Server)
+	if ok {
+		return server
+	}
+	return new(http.Server)
+}
+
 // ServeHTTP implement the h2c support that is enabled by h2c.GetH2CHandler.
 func (s h2cHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// Handle h2c with prior knowledge (RFC 7540 Section 3.4)
@@ -83,24 +94,34 @@ func (s h2cHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		defer conn.Close()
-
 		s.s.ServeConn(conn, &http2.ServeConnOpts{
-			Context: r.Context(),
-			Handler: s.Handler,
+			Context:          r.Context(),
+			BaseConfig:       extractServer(r),
+			Handler:          s.Handler,
+			SawClientPreface: true,
 		})
 		return
 	}
 	// Handle Upgrade to h2c (RFC 7540 Section 3.2)
-	if conn, err := h2cUpgrade(w, r); err == nil {
+	if isH2CUpgrade(r.Header) {
+		conn, settings, err := h2cUpgrade(w, r)
+		if err != nil {
+			if http2VerboseLogs {
+				log.Printf("h2c: error h2c upgrade: %v", err)
+			}
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
 		defer conn.Close()
-
 		s.s.ServeConn(conn, &http2.ServeConnOpts{
-			Context: r.Context(),
-			Handler: s.Handler,
+			Context:        r.Context(),
+			BaseConfig:     extractServer(r),
+			Handler:        s.Handler,
+			UpgradeRequest: r,
+			Settings:       settings,
 		})
 		return
 	}
-
 	s.Handler.ServeHTTP(w, r)
 	return
 }
@@ -113,11 +134,11 @@ func (s h2cHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 func initH2CWithPriorKnowledge(w http.ResponseWriter) (net.Conn, error) {
 	hijacker, ok := w.(http.Hijacker)
 	if !ok {
-		panic("Hijack not supported.")
+		return nil, errors.New("h2c: connection does not support Hijack")
 	}
 	conn, rw, err := hijacker.Hijack()
 	if err != nil {
-		panic(fmt.Sprintf("Hijack failed: %v", err))
+		return nil, err
 	}
 
 	const expectedBody = "SM\r\n\r\n"
@@ -125,249 +146,43 @@ func initH2CWithPriorKnowledge(w http.ResponseWriter) (net.Conn, error) {
 	buf := make([]byte, len(expectedBody))
 	n, err := io.ReadFull(rw, buf)
 	if err != nil {
-		return nil, fmt.Errorf("could not read from the buffer: %s", err)
+		return nil, fmt.Errorf("h2c: error reading client preface: %s", err)
 	}
 
 	if string(buf[:n]) == expectedBody {
-		c := &rwConn{
-			Conn:      conn,
-			Reader:    io.MultiReader(strings.NewReader(http2.ClientPreface), rw),
-			BufWriter: rw.Writer,
-		}
-		return c, nil
+		return newBufConn(conn, rw), nil
 	}
 
 	conn.Close()
-	if http2VerboseLogs {
-		log.Printf(
-			"h2c: missing the request body portion of the client preface. Wanted: %v Got: %v",
-			[]byte(expectedBody),
-			buf[0:n],
-		)
-	}
-	return nil, errors.New("invalid client preface")
-}
-
-// drainClientPreface reads a single instance of the HTTP/2 client preface from
-// the supplied reader.
-func drainClientPreface(r io.Reader) error {
-	var buf bytes.Buffer
-	prefaceLen := int64(len(http2.ClientPreface))
-	n, err := io.CopyN(&buf, r, prefaceLen)
-	if err != nil {
-		return err
-	}
-	if n != prefaceLen || buf.String() != http2.ClientPreface {
-		return fmt.Errorf("Client never sent: %s", http2.ClientPreface)
-	}
-	return nil
+	return nil, errors.New("h2c: invalid client preface")
 }
 
 // h2cUpgrade establishes a h2c connection using the HTTP/1 upgrade (Section 3.2).
-func h2cUpgrade(w http.ResponseWriter, r *http.Request) (net.Conn, error) {
-	if !isH2CUpgrade(r.Header) {
-		return nil, errors.New("non-conforming h2c headers")
-	}
-
-	// Initial bytes we put into conn to fool http2 server
-	initBytes, _, err := convertH1ReqToH2(r)
+func h2cUpgrade(w http.ResponseWriter, r *http.Request) (_ net.Conn, settings []byte, err error) {
+	settings, err = getH2Settings(r.Header)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-
 	hijacker, ok := w.(http.Hijacker)
 	if !ok {
-		return nil, errors.New("hijack not supported.")
+		return nil, nil, errors.New("h2c: connection does not support Hijack")
 	}
-	conn, rw, err := hijacker.Hijack()
-	if err != nil {
-		return nil, fmt.Errorf("hijack failed: %v", err)
-	}
-
-	rw.Write([]byte("HTTP/1.1 101 Switching Protocols\r\n" +
-		"Connection: Upgrade\r\n" +
-		"Upgrade: h2c\r\n\r\n"))
-	rw.Flush()
 
-	// A conforming client will now send an H2 client preface which need to drain
-	// since we already sent this.
-	if err := drainClientPreface(rw); err != nil {
-		return nil, err
-	}
-
-	c := &rwConn{
-		Conn:      conn,
-		Reader:    io.MultiReader(initBytes, rw),
-		BufWriter: newSettingsAckSwallowWriter(rw.Writer),
-	}
-	return c, nil
-}
-
-// convert the data contained in the HTTP/1 upgrade request into the HTTP/2
-// version in byte form.
-func convertH1ReqToH2(r *http.Request) (*bytes.Buffer, []http2.Setting, error) {
-	h2Bytes := bytes.NewBuffer([]byte((http2.ClientPreface)))
-	framer := http2.NewFramer(h2Bytes, nil)
-	settings, err := getH2Settings(r.Header)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if err := framer.WriteSettings(settings...); err != nil {
-		return nil, nil, err
-	}
-
-	headerBytes, err := getH2HeaderBytes(r, getMaxHeaderTableSize(settings))
+	body, err := io.ReadAll(r.Body)
 	if err != nil {
 		return nil, nil, err
 	}
+	r.Body = io.NopCloser(bytes.NewBuffer(body))
 
-	maxFrameSize := int(getMaxFrameSize(settings))
-	needOneHeader := len(headerBytes) < maxFrameSize
-	err = framer.WriteHeaders(http2.HeadersFrameParam{
-		StreamID:      1,
-		BlockFragment: headerBytes,
-		EndHeaders:    needOneHeader,
-	})
+	conn, rw, err := hijacker.Hijack()
 	if err != nil {
 		return nil, nil, err
 	}
 
-	for i := maxFrameSize; i < len(headerBytes); i += maxFrameSize {
-		if len(headerBytes)-i > maxFrameSize {
-			if err := framer.WriteContinuation(1,
-				false, // endHeaders
-				headerBytes[i:maxFrameSize]); err != nil {
-				return nil, nil, err
-			}
-		} else {
-			if err := framer.WriteContinuation(1,
-				true, // endHeaders
-				headerBytes[i:]); err != nil {
-				return nil, nil, err
-			}
-		}
-	}
-
-	return h2Bytes, settings, nil
-}
-
-// getMaxFrameSize returns the SETTINGS_MAX_FRAME_SIZE. If not present default
-// value is 16384 as specified by RFC 7540 Section 6.5.2.
-func getMaxFrameSize(settings []http2.Setting) uint32 {
-	for _, setting := range settings {
-		if setting.ID == http2.SettingMaxFrameSize {
-			return setting.Val
-		}
-	}
-	return 16384
-}
-
-// getMaxHeaderTableSize returns the SETTINGS_HEADER_TABLE_SIZE. If not present
-// default value is 4096 as specified by RFC 7540 Section 6.5.2.
-func getMaxHeaderTableSize(settings []http2.Setting) uint32 {
-	for _, setting := range settings {
-		if setting.ID == http2.SettingHeaderTableSize {
-			return setting.Val
-		}
-	}
-	return 4096
-}
-
-// bufWriter is a Writer interface that also has a Flush method.
-type bufWriter interface {
-	io.Writer
-	Flush() error
-}
-
-// rwConn implements net.Conn but overrides Read and Write so that reads and
-// writes are forwarded to the provided io.Reader and bufWriter.
-type rwConn struct {
-	net.Conn
-	io.Reader
-	BufWriter bufWriter
-}
-
-// Read forwards reads to the underlying Reader.
-func (c *rwConn) Read(p []byte) (int, error) {
-	return c.Reader.Read(p)
-}
-
-// Write forwards writes to the underlying bufWriter and immediately flushes.
-func (c *rwConn) Write(p []byte) (int, error) {
-	n, err := c.BufWriter.Write(p)
-	if err := c.BufWriter.Flush(); err != nil {
-		return 0, err
-	}
-	return n, err
-}
-
-// settingsAckSwallowWriter is a writer that normally forwards bytes to its
-// underlying Writer, but swallows the first SettingsAck frame that it sees.
-type settingsAckSwallowWriter struct {
-	Writer     *bufio.Writer
-	buf        []byte
-	didSwallow bool
-}
-
-// newSettingsAckSwallowWriter returns a new settingsAckSwallowWriter.
-func newSettingsAckSwallowWriter(w *bufio.Writer) *settingsAckSwallowWriter {
-	return &settingsAckSwallowWriter{
-		Writer:     w,
-		buf:        make([]byte, 0),
-		didSwallow: false,
-	}
-}
-
-// Write implements io.Writer interface. Normally forwards bytes to w.Writer,
-// except for the first Settings ACK frame that it sees.
-func (w *settingsAckSwallowWriter) Write(p []byte) (int, error) {
-	if !w.didSwallow {
-		w.buf = append(w.buf, p...)
-		// Process all the frames we have collected into w.buf
-		for {
-			// Append until we get full frame header which is 9 bytes
-			if len(w.buf) < 9 {
-				break
-			}
-			// Check if we have collected a whole frame.
-			fh, err := http2.ReadFrameHeader(bytes.NewBuffer(w.buf))
-			if err != nil {
-				// Corrupted frame, fail current Write
-				return 0, err
-			}
-			fSize := fh.Length + 9
-			if uint32(len(w.buf)) < fSize {
-				// Have not collected whole frame. Stop processing buf, and withhold on
-				// forward bytes to w.Writer until we get the full frame.
-				break
-			}
-
-			// We have now collected a whole frame.
-			if fh.Type == http2.FrameSettings && fh.Flags.Has(http2.FlagSettingsAck) {
-				// If Settings ACK frame, do not forward to underlying writer, remove
-				// bytes from w.buf, and record that we have swallowed Settings Ack
-				// frame.
-				w.didSwallow = true
-				w.buf = w.buf[fSize:]
-				continue
-			}
-
-			// Not settings ack frame. Forward bytes to w.Writer.
-			if _, err := w.Writer.Write(w.buf[:fSize]); err != nil {
-				// Couldn't forward bytes. Fail current Write.
-				return 0, err
-			}
-			w.buf = w.buf[fSize:]
-		}
-		return len(p), nil
-	}
-	return w.Writer.Write(p)
-}
-
-// Flush calls w.Writer.Flush.
-func (w *settingsAckSwallowWriter) Flush() error {
-	return w.Writer.Flush()
+	rw.Write([]byte("HTTP/1.1 101 Switching Protocols\r\n" +
+		"Connection: Upgrade\r\n" +
+		"Upgrade: h2c\r\n\r\n"))
+	return newBufConn(conn, rw), settings, nil
 }
 
 // isH2CUpgrade returns true if the header properly request an upgrade to h2c
@@ -377,9 +192,8 @@ func isH2CUpgrade(h http.Header) bool {
 		httpguts.HeaderValuesContainsToken(h[textproto.CanonicalMIMEHeaderKey("Connection")], "HTTP2-Settings")
 }
 
-// getH2Settings returns the []http2.Setting that are encoded in the
-// HTTP2-Settings header.
-func getH2Settings(h http.Header) ([]http2.Setting, error) {
+// getH2Settings returns the settings in the HTTP2-Settings header.
+func getH2Settings(h http.Header) ([]byte, error) {
 	vals, ok := h[textproto.CanonicalMIMEHeaderKey("HTTP2-Settings")]
 	if !ok {
 		return nil, errors.New("missing HTTP2-Settings header")
@@ -387,115 +201,40 @@ func getH2Settings(h http.Header) ([]http2.Setting, error) {
 	if len(vals) != 1 {
 		return nil, fmt.Errorf("expected 1 HTTP2-Settings. Got: %v", vals)
 	}
-	settings, err := decodeSettings(vals[0])
-	if err != nil {
-		return nil, fmt.Errorf("Invalid HTTP2-Settings: %q", vals[0])
-	}
-	return settings, nil
-}
-
-// decodeSettings decodes the base64url header value of the HTTP2-Settings
-// header. RFC 7540 Section 3.2.1.
-func decodeSettings(headerVal string) ([]http2.Setting, error) {
-	b, err := base64.RawURLEncoding.DecodeString(headerVal)
+	settings, err := base64.RawURLEncoding.DecodeString(vals[0])
 	if err != nil {
 		return nil, err
 	}
-	if len(b)%6 != 0 {
-		return nil, err
-	}
-	settings := make([]http2.Setting, 0)
-	for i := 0; i < len(b)/6; i++ {
-		settings = append(settings, http2.Setting{
-			ID:  http2.SettingID(binary.BigEndian.Uint16(b[i*6 : i*6+2])),
-			Val: binary.BigEndian.Uint32(b[i*6+2 : i*6+6]),
-		})
-	}
-
 	return settings, nil
 }
 
-// getH2HeaderBytes return the headers in r a []bytes encoded by HPACK.
-func getH2HeaderBytes(r *http.Request, maxHeaderTableSize uint32) ([]byte, error) {
-	headerBytes := bytes.NewBuffer(nil)
-	hpackEnc := hpack.NewEncoder(headerBytes)
-	hpackEnc.SetMaxDynamicTableSize(maxHeaderTableSize)
-
-	// Section 8.1.2.3
-	err := hpackEnc.WriteField(hpack.HeaderField{
-		Name:  ":method",
-		Value: r.Method,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	err = hpackEnc.WriteField(hpack.HeaderField{
-		Name:  ":scheme",
-		Value: "http",
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	err = hpackEnc.WriteField(hpack.HeaderField{
-		Name:  ":authority",
-		Value: r.Host,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	path := r.URL.Path
-	if r.URL.RawQuery != "" {
-		path = strings.Join([]string{path, r.URL.RawQuery}, "?")
-	}
-	err = hpackEnc.WriteField(hpack.HeaderField{
-		Name:  ":path",
-		Value: path,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	// TODO Implement Section 8.3
-
-	for header, values := range r.Header {
-		// Skip non h2 headers
-		if isNonH2Header(header) {
-			continue
-		}
-		for _, v := range values {
-			err := hpackEnc.WriteField(hpack.HeaderField{
-				Name:  strings.ToLower(header),
-				Value: v,
-			})
-			if err != nil {
-				return nil, err
-			}
-		}
+func newBufConn(conn net.Conn, rw *bufio.ReadWriter) net.Conn {
+	rw.Flush()
+	if rw.Reader.Buffered() == 0 {
+		// If there's no buffered data to be read,
+		// we can just discard the bufio.ReadWriter.
+		return conn
 	}
-	return headerBytes.Bytes(), nil
+	return &bufConn{conn, rw.Reader}
 }
 
-// Connection specific headers listed in RFC 7540 Section 8.1.2.2 that are not
-// suppose to be transferred to HTTP/2. The Http2-Settings header is skipped
-// since already use to create the HTTP/2 SETTINGS frame.
-var nonH2Headers = []string{
-	"Connection",
-	"Keep-Alive",
-	"Proxy-Connection",
-	"Transfer-Encoding",
-	"Upgrade",
-	"Http2-Settings",
+// bufConn wraps a net.Conn, but reads drain the bufio.Reader first.
+type bufConn struct {
+	net.Conn
+	*bufio.Reader
 }
 
-// isNonH2Header returns true if header should not be transferred to HTTP/2.
-func isNonH2Header(header string) bool {
-	for _, nonH2h := range nonH2Headers {
-		if header == nonH2h {
-			return true
-		}
+func (c *bufConn) Read(p []byte) (int, error) {
+	if c.Reader == nil {
+		return c.Conn.Read(p)
+	}
+	n := c.Reader.Buffered()
+	if n == 0 {
+		c.Reader = nil
+		return c.Conn.Read(p)
 	}
-	return false
+	if n < len(p) {
+		p = p[:n]
+	}
+	return c.Reader.Read(p)
 }
diff --git a/vendor/golang.org/x/net/http2/headermap.go b/vendor/golang.org/x/net/http2/headermap.go
index 9e12941da4..149b3dd20e 100644
--- a/vendor/golang.org/x/net/http2/headermap.go
+++ b/vendor/golang.org/x/net/http2/headermap.go
@@ -27,7 +27,14 @@ func buildCommonHeaderMaps() {
 		"accept-language",
 		"accept-ranges",
 		"age",
+		"access-control-allow-credentials",
+		"access-control-allow-headers",
+		"access-control-allow-methods",
 		"access-control-allow-origin",
+		"access-control-expose-headers",
+		"access-control-max-age",
+		"access-control-request-headers",
+		"access-control-request-method",
 		"allow",
 		"authorization",
 		"cache-control",
@@ -53,6 +60,7 @@ func buildCommonHeaderMaps() {
 		"link",
 		"location",
 		"max-forwards",
+		"origin",
 		"proxy-authenticate",
 		"proxy-authorization",
 		"range",
@@ -68,6 +76,8 @@ func buildCommonHeaderMaps() {
 		"vary",
 		"via",
 		"www-authenticate",
+		"x-forwarded-for",
+		"x-forwarded-proto",
 	}
 	commonLowerHeader = make(map[string]string, len(common))
 	commonCanonHeader = make(map[string]string, len(common))
@@ -85,3 +95,11 @@ func lowerHeader(v string) (lower string, ascii bool) {
 	}
 	return asciiToLower(v)
 }
+
+func canonicalHeader(v string) string {
+	buildCommonHeaderMapsOnce()
+	if s, ok := commonCanonHeader[v]; ok {
+		return s
+	}
+	return http.CanonicalHeaderKey(v)
+}
diff --git a/vendor/golang.org/x/net/http2/hpack/encode.go b/vendor/golang.org/x/net/http2/hpack/encode.go
index 97f17831fc..46219da2b0 100644
--- a/vendor/golang.org/x/net/http2/hpack/encode.go
+++ b/vendor/golang.org/x/net/http2/hpack/encode.go
@@ -116,6 +116,11 @@ func (e *Encoder) SetMaxDynamicTableSize(v uint32) {
 	e.dynTab.setMaxSize(v)
 }
 
+// MaxDynamicTableSize returns the current dynamic header table size.
+func (e *Encoder) MaxDynamicTableSize() (v uint32) {
+	return e.dynTab.maxSize
+}
+
 // SetMaxDynamicTableSizeLimit changes the maximum value that can be
 // specified in SetMaxDynamicTableSize to v. By default, it is set to
 // 4096, which is the same size of the default dynamic header table
@@ -191,7 +196,7 @@ func appendTableSize(dst []byte, v uint32) []byte {
 // bit prefix, to dst and returns the extended buffer.
 //
 // See
-// http://http2.github.io/http2-spec/compression.html#integer.representation
+// https://httpwg.org/specs/rfc7541.html#integer.representation
 func appendVarInt(dst []byte, n byte, i uint64) []byte {
 	k := uint64((1 << n) - 1)
 	if i < k {
diff --git a/vendor/golang.org/x/net/http2/hpack/hpack.go b/vendor/golang.org/x/net/http2/hpack/hpack.go
index 85f18a2b0a..7a1d976696 100644
--- a/vendor/golang.org/x/net/http2/hpack/hpack.go
+++ b/vendor/golang.org/x/net/http2/hpack/hpack.go
@@ -59,7 +59,7 @@ func (hf HeaderField) String() string {
 
 // Size returns the size of an entry per RFC 7541 section 4.1.
 func (hf HeaderField) Size() uint32 {
-	// http://http2.github.io/http2-spec/compression.html#rfc.section.4.1
+	// https://httpwg.org/specs/rfc7541.html#rfc.section.4.1
 	// "The size of the dynamic table is the sum of the size of
 	// its entries. The size of an entry is the sum of its name's
 	// length in octets (as defined in Section 5.2), its value's
@@ -158,7 +158,7 @@ func (d *Decoder) SetAllowedMaxDynamicTableSize(v uint32) {
 }
 
 type dynamicTable struct {
-	// http://http2.github.io/http2-spec/compression.html#rfc.section.2.3.2
+	// https://httpwg.org/specs/rfc7541.html#rfc.section.2.3.2
 	table          headerFieldTable
 	size           uint32 // in bytes
 	maxSize        uint32 // current maxSize
@@ -211,7 +211,7 @@ func (d *Decoder) at(i uint64) (hf HeaderField, ok bool) {
 	return dt.ents[dt.len()-(int(i)-staticTable.len())], true
 }
 
-// Decode decodes an entire block.
+// DecodeFull decodes an entire block.
 //
 // TODO: remove this method and make it incremental later? This is
 // easier for debugging now.
@@ -307,27 +307,27 @@ func (d *Decoder) parseHeaderFieldRepr() error {
 	case b&128 != 0:
 		// Indexed representation.
 		// High bit set?
-		// http://http2.github.io/http2-spec/compression.html#rfc.section.6.1
+		// https://httpwg.org/specs/rfc7541.html#rfc.section.6.1
 		return d.parseFieldIndexed()
 	case b&192 == 64:
 		// 6.2.1 Literal Header Field with Incremental Indexing
 		// 0b10xxxxxx: top two bits are 10
-		// http://http2.github.io/http2-spec/compression.html#rfc.section.6.2.1
+		// https://httpwg.org/specs/rfc7541.html#rfc.section.6.2.1
 		return d.parseFieldLiteral(6, indexedTrue)
 	case b&240 == 0:
 		// 6.2.2 Literal Header Field without Indexing
 		// 0b0000xxxx: top four bits are 0000
-		// http://http2.github.io/http2-spec/compression.html#rfc.section.6.2.2
+		// https://httpwg.org/specs/rfc7541.html#rfc.section.6.2.2
 		return d.parseFieldLiteral(4, indexedFalse)
 	case b&240 == 16:
 		// 6.2.3 Literal Header Field never Indexed
 		// 0b0001xxxx: top four bits are 0001
-		// http://http2.github.io/http2-spec/compression.html#rfc.section.6.2.3
+		// https://httpwg.org/specs/rfc7541.html#rfc.section.6.2.3
 		return d.parseFieldLiteral(4, indexedNever)
 	case b&224 == 32:
 		// 6.3 Dynamic Table Size Update
 		// Top three bits are '001'.
-		// http://http2.github.io/http2-spec/compression.html#rfc.section.6.3
+		// https://httpwg.org/specs/rfc7541.html#rfc.section.6.3
 		return d.parseDynamicTableSizeUpdate()
 	}
 
@@ -359,6 +359,7 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
 
 	var hf HeaderField
 	wantStr := d.emitEnabled || it.indexed()
+	var undecodedName undecodedString
 	if nameIdx > 0 {
 		ihf, ok := d.at(nameIdx)
 		if !ok {
@@ -366,15 +367,27 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
 		}
 		hf.Name = ihf.Name
 	} else {
-		hf.Name, buf, err = d.readString(buf, wantStr)
+		undecodedName, buf, err = d.readString(buf)
 		if err != nil {
 			return err
 		}
 	}
-	hf.Value, buf, err = d.readString(buf, wantStr)
+	undecodedValue, buf, err := d.readString(buf)
 	if err != nil {
 		return err
 	}
+	if wantStr {
+		if nameIdx <= 0 {
+			hf.Name, err = d.decodeString(undecodedName)
+			if err != nil {
+				return err
+			}
+		}
+		hf.Value, err = d.decodeString(undecodedValue)
+		if err != nil {
+			return err
+		}
+	}
 	d.buf = buf
 	if it.indexed() {
 		d.dynTab.add(hf)
@@ -420,7 +433,7 @@ var errVarintOverflow = DecodingError{errors.New("varint integer overflow")}
 
 // readVarInt reads an unsigned variable length integer off the
 // beginning of p. n is the parameter as described in
-// http://http2.github.io/http2-spec/compression.html#rfc.section.5.1.
+// https://httpwg.org/specs/rfc7541.html#rfc.section.5.1.
 //
 // n must always be between 1 and 8.
 //
@@ -459,46 +472,52 @@ func readVarInt(n byte, p []byte) (i uint64, remain []byte, err error) {
 	return 0, origP, errNeedMore
 }
 
-// readString decodes an hpack string from p.
+// readString reads an hpack string from p.
 //
-// wantStr is whether s will be used. If false, decompression and
-// []byte->string garbage are skipped if s will be ignored
-// anyway. This does mean that huffman decoding errors for non-indexed
-// strings past the MAX_HEADER_LIST_SIZE are ignored, but the server
-// is returning an error anyway, and because they're not indexed, the error
-// won't affect the decoding state.
-func (d *Decoder) readString(p []byte, wantStr bool) (s string, remain []byte, err error) {
+// It returns a reference to the encoded string data to permit deferring decode costs
+// until after the caller verifies all data is present.
+func (d *Decoder) readString(p []byte) (u undecodedString, remain []byte, err error) {
 	if len(p) == 0 {
-		return "", p, errNeedMore
+		return u, p, errNeedMore
 	}
 	isHuff := p[0]&128 != 0
 	strLen, p, err := readVarInt(7, p)
 	if err != nil {
-		return "", p, err
+		return u, p, err
 	}
 	if d.maxStrLen != 0 && strLen > uint64(d.maxStrLen) {
-		return "", nil, ErrStringLength
+		// Returning an error here means Huffman decoding errors
+		// for non-indexed strings past the maximum string length
+		// are ignored, but the server is returning an error anyway
+		// and because the string is not indexed the error will not
+		// affect the decoding state.
+		return u, nil, ErrStringLength
 	}
 	if uint64(len(p)) < strLen {
-		return "", p, errNeedMore
-	}
-	if !isHuff {
-		if wantStr {
-			s = string(p[:strLen])
-		}
-		return s, p[strLen:], nil
+		return u, p, errNeedMore
 	}
+	u.isHuff = isHuff
+	u.b = p[:strLen]
+	return u, p[strLen:], nil
+}
 
-	if wantStr {
-		buf := bufPool.Get().(*bytes.Buffer)
-		buf.Reset() // don't trust others
-		defer bufPool.Put(buf)
-		if err := huffmanDecode(buf, d.maxStrLen, p[:strLen]); err != nil {
-			buf.Reset()
-			return "", nil, err
-		}
+type undecodedString struct {
+	isHuff bool
+	b      []byte
+}
+
+func (d *Decoder) decodeString(u undecodedString) (string, error) {
+	if !u.isHuff {
+		return string(u.b), nil
+	}
+	buf := bufPool.Get().(*bytes.Buffer)
+	buf.Reset() // don't trust others
+	var s string
+	err := huffmanDecode(buf, d.maxStrLen, u.b)
+	if err == nil {
 		s = buf.String()
-		buf.Reset() // be nice to GC
 	}
-	return s, p[strLen:], nil
+	buf.Reset() // be nice to GC
+	bufPool.Put(buf)
+	return s, err
 }
diff --git a/vendor/golang.org/x/net/http2/hpack/huffman.go b/vendor/golang.org/x/net/http2/hpack/huffman.go
index fe0b84ccd4..20d083a716 100644
--- a/vendor/golang.org/x/net/http2/hpack/huffman.go
+++ b/vendor/golang.org/x/net/http2/hpack/huffman.go
@@ -169,25 +169,50 @@ func buildRootHuffmanNode() {
 // AppendHuffmanString appends s, as encoded in Huffman codes, to dst
 // and returns the extended buffer.
 func AppendHuffmanString(dst []byte, s string) []byte {
-	rembits := uint8(8)
-
+	// This relies on the maximum huffman code length being 30 (See tables.go huffmanCodeLen array)
+	// So if a uint64 buffer has less than 32 valid bits can always accommodate another huffmanCode.
+	var (
+		x uint64 // buffer
+		n uint   // number valid of bits present in x
+	)
 	for i := 0; i < len(s); i++ {
-		if rembits == 8 {
-			dst = append(dst, 0)
+		c := s[i]
+		n += uint(huffmanCodeLen[c])
+		x <<= huffmanCodeLen[c] % 64
+		x |= uint64(huffmanCodes[c])
+		if n >= 32 {
+			n %= 32             // Normally would be -= 32 but %= 32 informs compiler 0 <= n <= 31 for upcoming shift
+			y := uint32(x >> n) // Compiler doesn't combine memory writes if y isn't uint32
+			dst = append(dst, byte(y>>24), byte(y>>16), byte(y>>8), byte(y))
 		}
-		dst, rembits = appendByteToHuffmanCode(dst, rembits, s[i])
 	}
-
-	if rembits < 8 {
-		// special EOS symbol
-		code := uint32(0x3fffffff)
-		nbits := uint8(30)
-
-		t := uint8(code >> (nbits - rembits))
-		dst[len(dst)-1] |= t
+	// Add padding bits if necessary
+	if over := n % 8; over > 0 {
+		const (
+			eosCode    = 0x3fffffff
+			eosNBits   = 30
+			eosPadByte = eosCode >> (eosNBits - 8)
+		)
+		pad := 8 - over
+		x = (x << pad) | (eosPadByte >> over)
+		n += pad // 8 now divides into n exactly
 	}
-
-	return dst
+	// n in (0, 8, 16, 24, 32)
+	switch n / 8 {
+	case 0:
+		return dst
+	case 1:
+		return append(dst, byte(x))
+	case 2:
+		y := uint16(x)
+		return append(dst, byte(y>>8), byte(y))
+	case 3:
+		y := uint16(x >> 8)
+		return append(dst, byte(y>>8), byte(y), byte(x))
+	}
+	//	case 4:
+	y := uint32(x)
+	return append(dst, byte(y>>24), byte(y>>16), byte(y>>8), byte(y))
 }
 
 // HuffmanEncodeLength returns the number of bytes required to encode
@@ -199,35 +224,3 @@ func HuffmanEncodeLength(s string) uint64 {
 	}
 	return (n + 7) / 8
 }
-
-// appendByteToHuffmanCode appends Huffman code for c to dst and
-// returns the extended buffer and the remaining bits in the last
-// element. The appending is not byte aligned and the remaining bits
-// in the last element of dst is given in rembits.
-func appendByteToHuffmanCode(dst []byte, rembits uint8, c byte) ([]byte, uint8) {
-	code := huffmanCodes[c]
-	nbits := huffmanCodeLen[c]
-
-	for {
-		if rembits > nbits {
-			t := uint8(code << (rembits - nbits))
-			dst[len(dst)-1] |= t
-			rembits -= nbits
-			break
-		}
-
-		t := uint8(code >> (nbits - rembits))
-		dst[len(dst)-1] |= t
-
-		nbits -= rembits
-		rembits = 8
-
-		if nbits == 0 {
-			break
-		}
-
-		dst = append(dst, 0)
-	}
-
-	return dst, rembits
-}
diff --git a/vendor/golang.org/x/net/http2/hpack/static_table.go b/vendor/golang.org/x/net/http2/hpack/static_table.go
new file mode 100644
index 0000000000..754a1eb919
--- /dev/null
+++ b/vendor/golang.org/x/net/http2/hpack/static_table.go
@@ -0,0 +1,188 @@
+// go generate gen.go
+// Code generated by the command above; DO NOT EDIT.
+
+package hpack
+
+var staticTable = &headerFieldTable{
+	evictCount: 0,
+	byName: map[string]uint64{
+		":authority":                  1,
+		":method":                     3,
+		":path":                       5,
+		":scheme":                     7,
+		":status":                     14,
+		"accept-charset":              15,
+		"accept-encoding":             16,
+		"accept-language":             17,
+		"accept-ranges":               18,
+		"accept":                      19,
+		"access-control-allow-origin": 20,
+		"age":                         21,
+		"allow":                       22,
+		"authorization":               23,
+		"cache-control":               24,
+		"content-disposition":         25,
+		"content-encoding":            26,
+		"content-language":            27,
+		"content-length":              28,
+		"content-location":            29,
+		"content-range":               30,
+		"content-type":                31,
+		"cookie":                      32,
+		"date":                        33,
+		"etag":                        34,
+		"expect":                      35,
+		"expires":                     36,
+		"from":                        37,
+		"host":                        38,
+		"if-match":                    39,
+		"if-modified-since":           40,
+		"if-none-match":               41,
+		"if-range":                    42,
+		"if-unmodified-since":         43,
+		"last-modified":               44,
+		"link":                        45,
+		"location":                    46,
+		"max-forwards":                47,
+		"proxy-authenticate":          48,
+		"proxy-authorization":         49,
+		"range":                       50,
+		"referer":                     51,
+		"refresh":                     52,
+		"retry-after":                 53,
+		"server":                      54,
+		"set-cookie":                  55,
+		"strict-transport-security":   56,
+		"transfer-encoding":           57,
+		"user-agent":                  58,
+		"vary":                        59,
+		"via":                         60,
+		"www-authenticate":            61,
+	},
+	byNameValue: map[pairNameValue]uint64{
+		{name: ":authority", value: ""}:                   1,
+		{name: ":method", value: "GET"}:                   2,
+		{name: ":method", value: "POST"}:                  3,
+		{name: ":path", value: "/"}:                       4,
+		{name: ":path", value: "/index.html"}:             5,
+		{name: ":scheme", value: "http"}:                  6,
+		{name: ":scheme", value: "https"}:                 7,
+		{name: ":status", value: "200"}:                   8,
+		{name: ":status", value: "204"}:                   9,
+		{name: ":status", value: "206"}:                   10,
+		{name: ":status", value: "304"}:                   11,
+		{name: ":status", value: "400"}:                   12,
+		{name: ":status", value: "404"}:                   13,
+		{name: ":status", value: "500"}:                   14,
+		{name: "accept-charset", value: ""}:               15,
+		{name: "accept-encoding", value: "gzip, deflate"}: 16,
+		{name: "accept-language", value: ""}:              17,
+		{name: "accept-ranges", value: ""}:                18,
+		{name: "accept", value: ""}:                       19,
+		{name: "access-control-allow-origin", value: ""}:  20,
+		{name: "age", value: ""}:                          21,
+		{name: "allow", value: ""}:                        22,
+		{name: "authorization", value: ""}:                23,
+		{name: "cache-control", value: ""}:                24,
+		{name: "content-disposition", value: ""}:          25,
+		{name: "content-encoding", value: ""}:             26,
+		{name: "content-language", value: ""}:             27,
+		{name: "content-length", value: ""}:               28,
+		{name: "content-location", value: ""}:             29,
+		{name: "content-range", value: ""}:                30,
+		{name: "content-type", value: ""}:                 31,
+		{name: "cookie", value: ""}:                       32,
+		{name: "date", value: ""}:                         33,
+		{name: "etag", value: ""}:                         34,
+		{name: "expect", value: ""}:                       35,
+		{name: "expires", value: ""}:                      36,
+		{name: "from", value: ""}:                         37,
+		{name: "host", value: ""}:                         38,
+		{name: "if-match", value: ""}:                     39,
+		{name: "if-modified-since", value: ""}:            40,
+		{name: "if-none-match", value: ""}:                41,
+		{name: "if-range", value: ""}:                     42,
+		{name: "if-unmodified-since", value: ""}:          43,
+		{name: "last-modified", value: ""}:                44,
+		{name: "link", value: ""}:                         45,
+		{name: "location", value: ""}:                     46,
+		{name: "max-forwards", value: ""}:                 47,
+		{name: "proxy-authenticate", value: ""}:           48,
+		{name: "proxy-authorization", value: ""}:          49,
+		{name: "range", value: ""}:                        50,
+		{name: "referer", value: ""}:                      51,
+		{name: "refresh", value: ""}:                      52,
+		{name: "retry-after", value: ""}:                  53,
+		{name: "server", value: ""}:                       54,
+		{name: "set-cookie", value: ""}:                   55,
+		{name: "strict-transport-security", value: ""}:    56,
+		{name: "transfer-encoding", value: ""}:            57,
+		{name: "user-agent", value: ""}:                   58,
+		{name: "vary", value: ""}:                         59,
+		{name: "via", value: ""}:                          60,
+		{name: "www-authenticate", value: ""}:             61,
+	},
+	ents: []HeaderField{
+		{Name: ":authority", Value: "", Sensitive: false},
+		{Name: ":method", Value: "GET", Sensitive: false},
+		{Name: ":method", Value: "POST", Sensitive: false},
+		{Name: ":path", Value: "/", Sensitive: false},
+		{Name: ":path", Value: "/index.html", Sensitive: false},
+		{Name: ":scheme", Value: "http", Sensitive: false},
+		{Name: ":scheme", Value: "https", Sensitive: false},
+		{Name: ":status", Value: "200", Sensitive: false},
+		{Name: ":status", Value: "204", Sensitive: false},
+		{Name: ":status", Value: "206", Sensitive: false},
+		{Name: ":status", Value: "304", Sensitive: false},
+		{Name: ":status", Value: "400", Sensitive: false},
+		{Name: ":status", Value: "404", Sensitive: false},
+		{Name: ":status", Value: "500", Sensitive: false},
+		{Name: "accept-charset", Value: "", Sensitive: false},
+		{Name: "accept-encoding", Value: "gzip, deflate", Sensitive: false},
+		{Name: "accept-language", Value: "", Sensitive: false},
+		{Name: "accept-ranges", Value: "", Sensitive: false},
+		{Name: "accept", Value: "", Sensitive: false},
+		{Name: "access-control-allow-origin", Value: "", Sensitive: false},
+		{Name: "age", Value: "", Sensitive: false},
+		{Name: "allow", Value: "", Sensitive: false},
+		{Name: "authorization", Value: "", Sensitive: false},
+		{Name: "cache-control", Value: "", Sensitive: false},
+		{Name: "content-disposition", Value: "", Sensitive: false},
+		{Name: "content-encoding", Value: "", Sensitive: false},
+		{Name: "content-language", Value: "", Sensitive: false},
+		{Name: "content-length", Value: "", Sensitive: false},
+		{Name: "content-location", Value: "", Sensitive: false},
+		{Name: "content-range", Value: "", Sensitive: false},
+		{Name: "content-type", Value: "", Sensitive: false},
+		{Name: "cookie", Value: "", Sensitive: false},
+		{Name: "date", Value: "", Sensitive: false},
+		{Name: "etag", Value: "", Sensitive: false},
+		{Name: "expect", Value: "", Sensitive: false},
+		{Name: "expires", Value: "", Sensitive: false},
+		{Name: "from", Value: "", Sensitive: false},
+		{Name: "host", Value: "", Sensitive: false},
+		{Name: "if-match", Value: "", Sensitive: false},
+		{Name: "if-modified-since", Value: "", Sensitive: false},
+		{Name: "if-none-match", Value: "", Sensitive: false},
+		{Name: "if-range", Value: "", Sensitive: false},
+		{Name: "if-unmodified-since", Value: "", Sensitive: false},
+		{Name: "last-modified", Value: "", Sensitive: false},
+		{Name: "link", Value: "", Sensitive: false},
+		{Name: "location", Value: "", Sensitive: false},
+		{Name: "max-forwards", Value: "", Sensitive: false},
+		{Name: "proxy-authenticate", Value: "", Sensitive: false},
+		{Name: "proxy-authorization", Value: "", Sensitive: false},
+		{Name: "range", Value: "", Sensitive: false},
+		{Name: "referer", Value: "", Sensitive: false},
+		{Name: "refresh", Value: "", Sensitive: false},
+		{Name: "retry-after", Value: "", Sensitive: false},
+		{Name: "server", Value: "", Sensitive: false},
+		{Name: "set-cookie", Value: "", Sensitive: false},
+		{Name: "strict-transport-security", Value: "", Sensitive: false},
+		{Name: "transfer-encoding", Value: "", Sensitive: false},
+		{Name: "user-agent", Value: "", Sensitive: false},
+		{Name: "vary", Value: "", Sensitive: false},
+		{Name: "via", Value: "", Sensitive: false},
+		{Name: "www-authenticate", Value: "", Sensitive: false},
+	},
+}
diff --git a/vendor/golang.org/x/net/http2/hpack/tables.go b/vendor/golang.org/x/net/http2/hpack/tables.go
index a66cfbea69..8cbdf3f019 100644
--- a/vendor/golang.org/x/net/http2/hpack/tables.go
+++ b/vendor/golang.org/x/net/http2/hpack/tables.go
@@ -96,8 +96,7 @@ func (t *headerFieldTable) evictOldest(n int) {
 // meaning t.ents is reversed for dynamic tables. Hence, when t is a dynamic
 // table, the return value i actually refers to the entry t.ents[t.len()-i].
 //
-// All tables are assumed to be a dynamic tables except for the global
-// staticTable pointer.
+// All tables are assumed to be a dynamic tables except for the global staticTable.
 //
 // See Section 2.3.3.
 func (t *headerFieldTable) search(f HeaderField) (i uint64, nameValueMatch bool) {
@@ -125,81 +124,6 @@ func (t *headerFieldTable) idToIndex(id uint64) uint64 {
 	return k + 1
 }
 
-// http://tools.ietf.org/html/draft-ietf-httpbis-header-compression-07#appendix-B
-var staticTable = newStaticTable()
-var staticTableEntries = [...]HeaderField{
-	{Name: ":authority"},
-	{Name: ":method", Value: "GET"},
-	{Name: ":method", Value: "POST"},
-	{Name: ":path", Value: "/"},
-	{Name: ":path", Value: "/index.html"},
-	{Name: ":scheme", Value: "http"},
-	{Name: ":scheme", Value: "https"},
-	{Name: ":status", Value: "200"},
-	{Name: ":status", Value: "204"},
-	{Name: ":status", Value: "206"},
-	{Name: ":status", Value: "304"},
-	{Name: ":status", Value: "400"},
-	{Name: ":status", Value: "404"},
-	{Name: ":status", Value: "500"},
-	{Name: "accept-charset"},
-	{Name: "accept-encoding", Value: "gzip, deflate"},
-	{Name: "accept-language"},
-	{Name: "accept-ranges"},
-	{Name: "accept"},
-	{Name: "access-control-allow-origin"},
-	{Name: "age"},
-	{Name: "allow"},
-	{Name: "authorization"},
-	{Name: "cache-control"},
-	{Name: "content-disposition"},
-	{Name: "content-encoding"},
-	{Name: "content-language"},
-	{Name: "content-length"},
-	{Name: "content-location"},
-	{Name: "content-range"},
-	{Name: "content-type"},
-	{Name: "cookie"},
-	{Name: "date"},
-	{Name: "etag"},
-	{Name: "expect"},
-	{Name: "expires"},
-	{Name: "from"},
-	{Name: "host"},
-	{Name: "if-match"},
-	{Name: "if-modified-since"},
-	{Name: "if-none-match"},
-	{Name: "if-range"},
-	{Name: "if-unmodified-since"},
-	{Name: "last-modified"},
-	{Name: "link"},
-	{Name: "location"},
-	{Name: "max-forwards"},
-	{Name: "proxy-authenticate"},
-	{Name: "proxy-authorization"},
-	{Name: "range"},
-	{Name: "referer"},
-	{Name: "refresh"},
-	{Name: "retry-after"},
-	{Name: "server"},
-	{Name: "set-cookie"},
-	{Name: "strict-transport-security"},
-	{Name: "transfer-encoding"},
-	{Name: "user-agent"},
-	{Name: "vary"},
-	{Name: "via"},
-	{Name: "www-authenticate"},
-}
-
-func newStaticTable() *headerFieldTable {
-	t := &headerFieldTable{}
-	t.init()
-	for _, e := range staticTableEntries[:] {
-		t.addEntry(e)
-	}
-	return t
-}
-
 var huffmanCodes = [256]uint32{
 	0x1ff8,
 	0x7fffd8,
diff --git a/vendor/golang.org/x/net/http2/http2.go b/vendor/golang.org/x/net/http2/http2.go
index 5571ccfd26..6f2df28187 100644
--- a/vendor/golang.org/x/net/http2/http2.go
+++ b/vendor/golang.org/x/net/http2/http2.go
@@ -13,7 +13,6 @@
 // See https://http2.github.io/ for more information on HTTP/2.
 //
 // See https://http2.golang.org/ for a test server running this code.
-//
 package http2 // import "golang.org/x/net/http2"
 
 import (
@@ -56,14 +55,14 @@ const (
 	ClientPreface = "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"
 
 	// SETTINGS_MAX_FRAME_SIZE default
-	// http://http2.github.io/http2-spec/#rfc.section.6.5.2
+	// https://httpwg.org/specs/rfc7540.html#rfc.section.6.5.2
 	initialMaxFrameSize = 16384
 
 	// NextProtoTLS is the NPN/ALPN protocol negotiated during
 	// HTTP/2's TLS setup.
 	NextProtoTLS = "h2"
 
-	// http://http2.github.io/http2-spec/#SettingValues
+	// https://httpwg.org/specs/rfc7540.html#SettingValues
 	initialHeaderTableSize = 4096
 
 	initialWindowSize = 65535 // 6.9.2 Initial Flow Control Window Size
@@ -112,7 +111,7 @@ func (st streamState) String() string {
 // Setting is a setting parameter: which setting it is, and its value.
 type Setting struct {
 	// ID is which setting is being set.
-	// See http://http2.github.io/http2-spec/#SettingValues
+	// See https://httpwg.org/specs/rfc7540.html#SettingFormat
 	ID SettingID
 
 	// Val is the value.
@@ -144,7 +143,7 @@ func (s Setting) Valid() error {
 }
 
 // A SettingID is an HTTP/2 setting as defined in
-// http://http2.github.io/http2-spec/#iana-settings
+// https://httpwg.org/specs/rfc7540.html#iana-settings
 type SettingID uint16
 
 const (
@@ -176,10 +175,11 @@ func (s SettingID) String() string {
 // name (key). See httpguts.ValidHeaderName for the base rules.
 //
 // Further, http2 says:
-//   "Just as in HTTP/1.x, header field names are strings of ASCII
-//   characters that are compared in a case-insensitive
-//   fashion. However, header field names MUST be converted to
-//   lowercase prior to their encoding in HTTP/2. "
+//
+//	"Just as in HTTP/1.x, header field names are strings of ASCII
+//	characters that are compared in a case-insensitive
+//	fashion. However, header field names MUST be converted to
+//	lowercase prior to their encoding in HTTP/2. "
 func validWireHeaderFieldName(v string) bool {
 	if len(v) == 0 {
 		return false
@@ -365,8 +365,8 @@ func (s *sorter) SortStrings(ss []string) {
 // validPseudoPath reports whether v is a valid :path pseudo-header
 // value. It must be either:
 //
-//     *) a non-empty string starting with '/'
-//     *) the string '*', for OPTIONS requests.
+//   - a non-empty string starting with '/'
+//   - the string '*', for OPTIONS requests.
 //
 // For now this is only used a quick check for deciding when to clean
 // up Opaque URLs before sending requests from the Transport.
diff --git a/vendor/golang.org/x/net/http2/not_go118.go b/vendor/golang.org/x/net/http2/not_go118.go
new file mode 100644
index 0000000000..eab532c96b
--- /dev/null
+++ b/vendor/golang.org/x/net/http2/not_go118.go
@@ -0,0 +1,17 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.18
+// +build !go1.18
+
+package http2
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+func tlsUnderlyingConn(tc *tls.Conn) net.Conn {
+	return nil
+}
diff --git a/vendor/golang.org/x/net/http2/pipe.go b/vendor/golang.org/x/net/http2/pipe.go
index c15b8a7719..684d984fd9 100644
--- a/vendor/golang.org/x/net/http2/pipe.go
+++ b/vendor/golang.org/x/net/http2/pipe.go
@@ -88,13 +88,9 @@ func (p *pipe) Write(d []byte) (n int, err error) {
 		p.c.L = &p.mu
 	}
 	defer p.c.Signal()
-	if p.err != nil {
+	if p.err != nil || p.breakErr != nil {
 		return 0, errClosedPipeWrite
 	}
-	if p.breakErr != nil {
-		p.unread += len(d)
-		return len(d), nil // discard when there is no reader
-	}
 	return p.b.Write(d)
 }
 
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
index c67e9b7f55..cd057f3982 100644
--- a/vendor/golang.org/x/net/http2/server.go
+++ b/vendor/golang.org/x/net/http2/server.go
@@ -98,6 +98,19 @@ type Server struct {
 	// the HTTP/2 spec's recommendations.
 	MaxConcurrentStreams uint32
 
+	// MaxDecoderHeaderTableSize optionally specifies the http2
+	// SETTINGS_HEADER_TABLE_SIZE to send in the initial settings frame. It
+	// informs the remote endpoint of the maximum size of the header compression
+	// table used to decode header blocks, in octets. If zero, the default value
+	// of 4096 is used.
+	MaxDecoderHeaderTableSize uint32
+
+	// MaxEncoderHeaderTableSize optionally specifies an upper limit for the
+	// header compression table used for encoding request headers. Received
+	// SETTINGS_HEADER_TABLE_SIZE settings are capped at this limit. If zero,
+	// the default value of 4096 is used.
+	MaxEncoderHeaderTableSize uint32
+
 	// MaxReadFrameSize optionally specifies the largest frame
 	// this server is willing to read. A valid value is between
 	// 16k and 16M, inclusive. If zero or otherwise invalid, a
@@ -143,7 +156,7 @@ type Server struct {
 }
 
 func (s *Server) initialConnRecvWindowSize() int32 {
-	if s.MaxUploadBufferPerConnection > initialWindowSize {
+	if s.MaxUploadBufferPerConnection >= initialWindowSize {
 		return s.MaxUploadBufferPerConnection
 	}
 	return 1 << 20
@@ -170,6 +183,20 @@ func (s *Server) maxConcurrentStreams() uint32 {
 	return defaultMaxStreams
 }
 
+func (s *Server) maxDecoderHeaderTableSize() uint32 {
+	if v := s.MaxDecoderHeaderTableSize; v > 0 {
+		return v
+	}
+	return initialHeaderTableSize
+}
+
+func (s *Server) maxEncoderHeaderTableSize() uint32 {
+	if v := s.MaxEncoderHeaderTableSize; v > 0 {
+		return v
+	}
+	return initialHeaderTableSize
+}
+
 // maxQueuedControlFrames is the maximum number of control frames like
 // SETTINGS, PING and RST_STREAM that will be queued for writing before
 // the connection is closed to prevent memory exhaustion attacks.
@@ -315,6 +342,20 @@ type ServeConnOpts struct {
 	// requests. If nil, BaseConfig.Handler is used. If BaseConfig
 	// or BaseConfig.Handler is nil, http.DefaultServeMux is used.
 	Handler http.Handler
+
+	// UpgradeRequest is an initial request received on a connection
+	// undergoing an h2c upgrade. The request body must have been
+	// completely read from the connection before calling ServeConn,
+	// and the 101 Switching Protocols response written.
+	UpgradeRequest *http.Request
+
+	// Settings is the decoded contents of the HTTP2-Settings header
+	// in an h2c upgrade request.
+	Settings []byte
+
+	// SawClientPreface is set if the HTTP/2 connection preface
+	// has already been read from the connection.
+	SawClientPreface bool
 }
 
 func (o *ServeConnOpts) context() context.Context {
@@ -380,9 +421,9 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 		advMaxStreams:               s.maxConcurrentStreams(),
 		initialStreamSendWindowSize: initialWindowSize,
 		maxFrameSize:                initialMaxFrameSize,
-		headerTableSize:             initialHeaderTableSize,
 		serveG:                      newGoroutineLock(),
 		pushEnabled:                 true,
+		sawClientPreface:            opts.SawClientPreface,
 	}
 
 	s.state.registerConn(sc)
@@ -400,21 +441,22 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	if s.NewWriteScheduler != nil {
 		sc.writeSched = s.NewWriteScheduler()
 	} else {
-		sc.writeSched = NewRandomWriteScheduler()
+		sc.writeSched = NewPriorityWriteScheduler(nil)
 	}
 
 	// These start at the RFC-specified defaults. If there is a higher
 	// configured value for inflow, that will be updated when we send a
 	// WINDOW_UPDATE shortly after sending SETTINGS.
 	sc.flow.add(initialWindowSize)
-	sc.inflow.add(initialWindowSize)
+	sc.inflow.init(initialWindowSize)
 	sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf)
+	sc.hpackEncoder.SetMaxDynamicTableSizeLimit(s.maxEncoderHeaderTableSize())
 
 	fr := NewFramer(sc.bw, c)
 	if s.CountError != nil {
 		fr.countError = s.CountError
 	}
-	fr.ReadMetaHeaders = hpack.NewDecoder(initialHeaderTableSize, nil)
+	fr.ReadMetaHeaders = hpack.NewDecoder(s.maxDecoderHeaderTableSize(), nil)
 	fr.MaxHeaderListSize = sc.maxHeaderListSize()
 	fr.SetMaxReadFrameSize(s.maxReadFrameSize())
 	sc.framer = fr
@@ -465,9 +507,27 @@ func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 		}
 	}
 
+	if opts.Settings != nil {
+		fr := &SettingsFrame{
+			FrameHeader: FrameHeader{valid: true},
+			p:           opts.Settings,
+		}
+		if err := fr.ForeachSetting(sc.processSetting); err != nil {
+			sc.rejectConn(ErrCodeProtocol, "invalid settings")
+			return
+		}
+		opts.Settings = nil
+	}
+
 	if hook := testHookGetServerConn; hook != nil {
 		hook(sc)
 	}
+
+	if opts.UpgradeRequest != nil {
+		sc.upgradeRequest(opts.UpgradeRequest)
+		opts.UpgradeRequest = nil
+	}
+
 	sc.serve()
 }
 
@@ -503,8 +563,8 @@ type serverConn struct {
 	wroteFrameCh     chan frameWriteResult  // from writeFrameAsync -> serve, tickles more frame writes
 	bodyReadCh       chan bodyReadMsg       // from handlers -> serve
 	serveMsgCh       chan interface{}       // misc messages & code to send to / run on the serve loop
-	flow             flow                   // conn-wide (not stream-specific) outbound flow control
-	inflow           flow                   // conn-wide inbound flow control
+	flow             outflow                // conn-wide (not stream-specific) outbound flow control
+	inflow           inflow                 // conn-wide inbound flow control
 	tlsState         *tls.ConnectionState   // shared by all handlers, like net/http
 	remoteAddrStr    string
 	writeSched       WriteScheduler
@@ -512,6 +572,7 @@ type serverConn struct {
 	// Everything following is owned by the serve loop; use serveG.check():
 	serveG                      goroutineLock // used to verify funcs are on serve()
 	pushEnabled                 bool
+	sawClientPreface            bool // preface has already been read, used in h2c upgrade
 	sawFirstSettings            bool // got the initial SETTINGS frame after the preface
 	needToSendSettingsAck       bool
 	unackedSettings             int    // how many SETTINGS have we sent without ACKs?
@@ -525,9 +586,9 @@ type serverConn struct {
 	streams                     map[uint32]*stream
 	initialStreamSendWindowSize int32
 	maxFrameSize                int32
-	headerTableSize             uint32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
 	canonHeader                 map[string]string // http2-lower-case -> Go-Canonical-Case
+	canonHeaderKeysSize         int               // canonHeader keys size in bytes
 	writingFrame                bool              // started writing a frame (on serve goroutine or separate)
 	writingFrameAsync           bool              // started a frame on its own goroutine but haven't heard back on wroteFrameCh
 	needsFrameFlush             bool              // last frame write wasn't a flush
@@ -580,15 +641,17 @@ type stream struct {
 	cancelCtx func()
 
 	// owned by serverConn's serve loop:
-	bodyBytes        int64 // body bytes seen so far
-	declBodyBytes    int64 // or -1 if undeclared
-	flow             flow  // limits writing from Handler to client
-	inflow           flow  // what the client is allowed to POST/etc to us
+	bodyBytes        int64   // body bytes seen so far
+	declBodyBytes    int64   // or -1 if undeclared
+	flow             outflow // limits writing from Handler to client
+	inflow           inflow  // what the client is allowed to POST/etc to us
 	state            streamState
 	resetQueued      bool        // RST_STREAM queued for write; set by sc.resetStream
 	gotTrailerHeader bool        // HEADER frame for trailers was seen
 	wroteHeaders     bool        // whether we wrote headers (not status 100)
+	readDeadline     *time.Timer // nil if unused
 	writeDeadline    *time.Timer // nil if unused
+	closeErr         error       // set before cw is closed
 
 	trailer    http.Header // accumulated trailers
 	reqTrailer http.Header // handler's Request.Trailer
@@ -704,6 +767,13 @@ func (sc *serverConn) condlogf(err error, format string, args ...interface{}) {
 	}
 }
 
+// maxCachedCanonicalHeadersKeysSize is an arbitrarily-chosen limit on the size
+// of the entries in the canonHeader cache.
+// This should be larger than the size of unique, uncommon header keys likely to
+// be sent by the peer, while not so high as to permit unreasonable memory usage
+// if the peer sends an unbounded number of unique header keys.
+const maxCachedCanonicalHeadersKeysSize = 2048
+
 func (sc *serverConn) canonicalHeader(v string) string {
 	sc.serveG.check()
 	buildCommonHeaderMapsOnce()
@@ -719,7 +789,11 @@ func (sc *serverConn) canonicalHeader(v string) string {
 		sc.canonHeader = make(map[string]string)
 	}
 	cv = http.CanonicalHeaderKey(v)
-	sc.canonHeader[v] = cv
+	size := 100 + len(v)*2 // 100 bytes of map overhead + key + value
+	if sc.canonHeaderKeysSize+size <= maxCachedCanonicalHeadersKeysSize {
+		sc.canonHeader[v] = cv
+		sc.canonHeaderKeysSize += size
+	}
 	return cv
 }
 
@@ -769,8 +843,13 @@ type frameWriteResult struct {
 // and then reports when it's done.
 // At most one goroutine can be running writeFrameAsync at a time per
 // serverConn.
-func (sc *serverConn) writeFrameAsync(wr FrameWriteRequest) {
-	err := wr.write.writeFrame(sc)
+func (sc *serverConn) writeFrameAsync(wr FrameWriteRequest, wd *writeData) {
+	var err error
+	if wd == nil {
+		err = wr.write.writeFrame(sc)
+	} else {
+		err = sc.framer.endWrite()
+	}
 	sc.wroteFrameCh <- frameWriteResult{wr: wr, err: err}
 }
 
@@ -820,6 +899,7 @@ func (sc *serverConn) serve() {
 			{SettingMaxFrameSize, sc.srv.maxReadFrameSize()},
 			{SettingMaxConcurrentStreams, sc.advMaxStreams},
 			{SettingMaxHeaderListSize, sc.maxHeaderListSize()},
+			{SettingHeaderTableSize, sc.srv.maxDecoderHeaderTableSize()},
 			{SettingInitialWindowSize, uint32(sc.srv.initialStreamRecvWindowSize())},
 		},
 	})
@@ -906,6 +986,8 @@ func (sc *serverConn) serve() {
 				}
 			case *startPushRequest:
 				sc.startPush(v)
+			case func(*serverConn):
+				v(sc)
 			default:
 				panic(fmt.Sprintf("unexpected type %T", v))
 			}
@@ -966,6 +1048,9 @@ var errPrefaceTimeout = errors.New("timeout waiting for client preface")
 // returns errPrefaceTimeout on timeout, or an error if the greeting
 // is invalid.
 func (sc *serverConn) readPreface() error {
+	if sc.sawClientPreface {
+		return nil
+	}
 	errc := make(chan error, 1)
 	go func() {
 		// Read the client preface
@@ -1171,9 +1256,16 @@ func (sc *serverConn) startFrameWrite(wr FrameWriteRequest) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
 		sc.wroteFrame(frameWriteResult{wr: wr, err: err})
+	} else if wd, ok := wr.write.(*writeData); ok {
+		// Encode the frame in the serve goroutine, to ensure we don't have
+		// any lingering asynchronous references to data passed to Write.
+		// See https://go.dev/issue/58446.
+		sc.framer.startWriteDataPadded(wd.streamID, wd.endStream, wd.p, nil)
+		sc.writingFrameAsync = true
+		go sc.writeFrameAsync(wr, wd)
 	} else {
 		sc.writingFrameAsync = true
-		go sc.writeFrameAsync(wr)
+		go sc.writeFrameAsync(wr, nil)
 	}
 }
 
@@ -1326,6 +1418,9 @@ func (sc *serverConn) startGracefulShutdownInternal() {
 func (sc *serverConn) goAway(code ErrCode) {
 	sc.serveG.check()
 	if sc.inGoAway {
+		if sc.goAwayCode == ErrCodeNo {
+			sc.goAwayCode = code
+		}
 		return
 	}
 	sc.inGoAway = true
@@ -1413,6 +1508,21 @@ func (sc *serverConn) processFrame(f Frame) error {
 		sc.sawFirstSettings = true
 	}
 
+	// Discard frames for streams initiated after the identified last
+	// stream sent in a GOAWAY, or all frames after sending an error.
+	// We still need to return connection-level flow control for DATA frames.
+	// RFC 9113 Section 6.8.
+	if sc.inGoAway && (sc.goAwayCode != ErrCodeNo || f.Header().StreamID > sc.maxClientStreamID) {
+
+		if f, ok := f.(*DataFrame); ok {
+			if !sc.inflow.take(f.Length) {
+				return sc.countError("data_flow", streamError(f.Header().StreamID, ErrCodeFlowControl))
+			}
+			sc.sendWindowUpdate(nil, int(f.Length)) // conn-level
+		}
+		return nil
+	}
+
 	switch f := f.(type) {
 	case *SettingsFrame:
 		return sc.processSettings(f)
@@ -1455,9 +1565,6 @@ func (sc *serverConn) processPing(f *PingFrame) error {
 		// PROTOCOL_ERROR."
 		return sc.countError("ping_on_stream", ConnectionError(ErrCodeProtocol))
 	}
-	if sc.inGoAway && sc.goAwayCode != ErrCodeNo {
-		return nil
-	}
 	sc.writeFrame(FrameWriteRequest{write: writePingAck{f}})
 	return nil
 }
@@ -1519,6 +1626,9 @@ func (sc *serverConn) closeStream(st *stream, err error) {
 		panic(fmt.Sprintf("invariant; can't close stream in state %v", st.state))
 	}
 	st.state = stateClosed
+	if st.readDeadline != nil {
+		st.readDeadline.Stop()
+	}
 	if st.writeDeadline != nil {
 		st.writeDeadline.Stop()
 	}
@@ -1544,6 +1654,14 @@ func (sc *serverConn) closeStream(st *stream, err error) {
 
 		p.CloseWithError(err)
 	}
+	if e, ok := err.(StreamError); ok {
+		if e.Cause != nil {
+			err = e.Cause
+		} else {
+			err = errStreamClosed
+		}
+	}
+	st.closeErr = err
 	st.cw.Close() // signals Handler's CloseNotifier, unblocks writes, etc
 	sc.writeSched.CloseStream(st.id)
 }
@@ -1586,7 +1704,6 @@ func (sc *serverConn) processSetting(s Setting) error {
 	}
 	switch s.ID {
 	case SettingHeaderTableSize:
-		sc.headerTableSize = s.Val
 		sc.hpackEncoder.SetMaxDynamicTableSize(s.Val)
 	case SettingEnablePush:
 		sc.pushEnabled = s.Val != 0
@@ -1640,16 +1757,6 @@ func (sc *serverConn) processSettingInitialWindowSize(val uint32) error {
 func (sc *serverConn) processData(f *DataFrame) error {
 	sc.serveG.check()
 	id := f.Header().StreamID
-	if sc.inGoAway && (sc.goAwayCode != ErrCodeNo || id > sc.maxClientStreamID) {
-		// Discard all DATA frames if the GOAWAY is due to an
-		// error, or:
-		//
-		// Section 6.8: After sending a GOAWAY frame, the sender
-		// can discard frames for streams initiated by the
-		// receiver with identifiers higher than the identified
-		// last stream.
-		return nil
-	}
 
 	data := f.Data()
 	state, st := sc.state(id)
@@ -1680,14 +1787,9 @@ func (sc *serverConn) processData(f *DataFrame) error {
 		// But still enforce their connection-level flow control,
 		// and return any flow control bytes since we're not going
 		// to consume them.
-		if sc.inflow.available() < int32(f.Length) {
+		if !sc.inflow.take(f.Length) {
 			return sc.countError("data_flow", streamError(id, ErrCodeFlowControl))
 		}
-		// Deduct the flow control from inflow, since we're
-		// going to immediately add it back in
-		// sendWindowUpdate, which also schedules sending the
-		// frames.
-		sc.inflow.take(int32(f.Length))
 		sc.sendWindowUpdate(nil, int(f.Length)) // conn-level
 
 		if st != nil && st.resetQueued {
@@ -1702,6 +1804,11 @@ func (sc *serverConn) processData(f *DataFrame) error {
 
 	// Sender sending more than they'd declared?
 	if st.declBodyBytes != -1 && st.bodyBytes+int64(len(data)) > st.declBodyBytes {
+		if !sc.inflow.take(f.Length) {
+			return sc.countError("data_flow", streamError(id, ErrCodeFlowControl))
+		}
+		sc.sendWindowUpdate(nil, int(f.Length)) // conn-level
+
 		st.body.CloseWithError(fmt.Errorf("sender tried to send more than declared Content-Length of %d bytes", st.declBodyBytes))
 		// RFC 7540, sec 8.1.2.6: A request or response is also malformed if the
 		// value of a content-length header field does not equal the sum of the
@@ -1710,29 +1817,33 @@ func (sc *serverConn) processData(f *DataFrame) error {
 	}
 	if f.Length > 0 {
 		// Check whether the client has flow control quota.
-		if st.inflow.available() < int32(f.Length) {
+		if !takeInflows(&sc.inflow, &st.inflow, f.Length) {
 			return sc.countError("flow_on_data_length", streamError(id, ErrCodeFlowControl))
 		}
-		st.inflow.take(int32(f.Length))
 
 		if len(data) > 0 {
+			st.bodyBytes += int64(len(data))
 			wrote, err := st.body.Write(data)
 			if err != nil {
+				// The handler has closed the request body.
+				// Return the connection-level flow control for the discarded data,
+				// but not the stream-level flow control.
 				sc.sendWindowUpdate(nil, int(f.Length)-wrote)
-				return sc.countError("body_write_err", streamError(id, ErrCodeStreamClosed))
+				return nil
 			}
 			if wrote != len(data) {
 				panic("internal error: bad Writer")
 			}
-			st.bodyBytes += int64(len(data))
 		}
 
 		// Return any padded flow control now, since we won't
 		// refund it later on body reads.
-		if pad := int32(f.Length) - int32(len(data)); pad > 0 {
-			sc.sendWindowUpdate32(nil, pad)
-			sc.sendWindowUpdate32(st, pad)
-		}
+		// Call sendWindowUpdate even if there is no padding,
+		// to return buffered flow control credit if the sent
+		// window has shrunk.
+		pad := int32(f.Length) - int32(len(data))
+		sc.sendWindowUpdate32(nil, pad)
+		sc.sendWindowUpdate32(st, pad)
 	}
 	if f.StreamEnded() {
 		st.endStream()
@@ -1786,19 +1897,27 @@ func (st *stream) copyTrailersToHandlerRequest() {
 	}
 }
 
+// onReadTimeout is run on its own goroutine (from time.AfterFunc)
+// when the stream's ReadTimeout has fired.
+func (st *stream) onReadTimeout() {
+	// Wrap the ErrDeadlineExceeded to avoid callers depending on us
+	// returning the bare error.
+	st.body.CloseWithError(fmt.Errorf("%w", os.ErrDeadlineExceeded))
+}
+
 // onWriteTimeout is run on its own goroutine (from time.AfterFunc)
 // when the stream's WriteTimeout has fired.
 func (st *stream) onWriteTimeout() {
-	st.sc.writeFrameFromHandler(FrameWriteRequest{write: streamError(st.id, ErrCodeInternal)})
+	st.sc.writeFrameFromHandler(FrameWriteRequest{write: StreamError{
+		StreamID: st.id,
+		Code:     ErrCodeInternal,
+		Cause:    os.ErrDeadlineExceeded,
+	}})
 }
 
 func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
 	sc.serveG.check()
 	id := f.StreamID
-	if sc.inGoAway {
-		// Ignore.
-		return nil
-	}
 	// http://tools.ietf.org/html/rfc7540#section-5.1.1
 	// Streams initiated by a client MUST use odd-numbered stream
 	// identifiers. [...] An endpoint that receives an unexpected
@@ -1901,12 +2020,35 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
 	// (in Go 1.8), though. That's a more sane option anyway.
 	if sc.hs.ReadTimeout != 0 {
 		sc.conn.SetReadDeadline(time.Time{})
+		if st.body != nil {
+			st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
+		}
 	}
 
 	go sc.runHandler(rw, req, handler)
 	return nil
 }
 
+func (sc *serverConn) upgradeRequest(req *http.Request) {
+	sc.serveG.check()
+	id := uint32(1)
+	sc.maxClientStreamID = id
+	st := sc.newStream(id, 0, stateHalfClosedRemote)
+	st.reqTrailer = req.Trailer
+	if st.reqTrailer != nil {
+		st.trailer = make(http.Header)
+	}
+	rw := sc.newResponseWriter(st, req)
+
+	// Disable any read deadline set by the net/http package
+	// prior to the upgrade.
+	if sc.hs.ReadTimeout != 0 {
+		sc.conn.SetReadDeadline(time.Time{})
+	}
+
+	go sc.runHandler(rw, req, sc.handler.ServeHTTP)
+}
+
 func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error {
 	sc := st.sc
 	sc.serveG.check()
@@ -1949,9 +2091,6 @@ func (sc *serverConn) checkPriority(streamID uint32, p PriorityParam) error {
 }
 
 func (sc *serverConn) processPriority(f *PriorityFrame) error {
-	if sc.inGoAway {
-		return nil
-	}
 	if err := sc.checkPriority(f.StreamID, f.PriorityParam); err != nil {
 		return err
 	}
@@ -1976,8 +2115,7 @@ func (sc *serverConn) newStream(id, pusherID uint32, state streamState) *stream
 	st.cw.Init()
 	st.flow.conn = &sc.flow // link to conn-level counter
 	st.flow.add(sc.initialStreamSendWindowSize)
-	st.inflow.conn = &sc.inflow // link to conn-level counter
-	st.inflow.add(sc.srv.initialStreamRecvWindowSize())
+	st.inflow.init(sc.srv.initialStreamRecvWindowSize())
 	if sc.hs.WriteTimeout != 0 {
 		st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout)
 	}
@@ -2025,12 +2163,6 @@ func (sc *serverConn) newWriterAndRequest(st *stream, f *MetaHeadersFrame) (*res
 		return nil, nil, sc.countError("bad_path_method", streamError(f.StreamID, ErrCodeProtocol))
 	}
 
-	bodyOpen := !f.StreamEnded()
-	if rp.method == "HEAD" && bodyOpen {
-		// HEAD requests can't have bodies
-		return nil, nil, sc.countError("head_body", streamError(f.StreamID, ErrCodeProtocol))
-	}
-
 	rp.header = make(http.Header)
 	for _, hf := range f.RegularFields() {
 		rp.header.Add(sc.canonicalHeader(hf.Name), hf.Value)
@@ -2043,6 +2175,7 @@ func (sc *serverConn) newWriterAndRequest(st *stream, f *MetaHeadersFrame) (*res
 	if err != nil {
 		return nil, nil, err
 	}
+	bodyOpen := !f.StreamEnded()
 	if bodyOpen {
 		if vv, ok := rp.header["Content-Length"]; ok {
 			if cl, err := strconv.ParseUint(vv[0], 10, 63); err == nil {
@@ -2074,7 +2207,7 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r
 		tlsState = sc.tlsState
 	}
 
-	needsContinue := rp.header.Get("Expect") == "100-continue"
+	needsContinue := httpguts.HeaderValuesContainsToken(rp.header["Expect"], "100-continue")
 	if needsContinue {
 		rp.header.Del("Expect")
 	}
@@ -2137,6 +2270,11 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r
 	}
 	req = req.WithContext(st.ctx)
 
+	rw := sc.newResponseWriter(st, req)
+	return rw, req, nil
+}
+
+func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *responseWriter {
 	rws := responseWriterStatePool.Get().(*responseWriterState)
 	bwSave := rws.bw
 	*rws = responseWriterState{} // zero all the fields
@@ -2145,10 +2283,7 @@ func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*r
 	rws.bw.Reset(chunkWriter{rws})
 	rws.stream = st
 	rws.req = req
-	rws.body = body
-
-	rw := &responseWriter{rws: rws}
-	return rw, req, nil
+	return &responseWriter{rws: rws}
 }
 
 // Run on its own goroutine.
@@ -2156,6 +2291,9 @@ func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler
 	didPanic := true
 	defer func() {
 		rw.rws.stream.cancelCtx()
+		if req.MultipartForm != nil {
+			req.MultipartForm.RemoveAll()
+		}
 		if didPanic {
 			e := recover()
 			sc.writeFrameFromHandler(FrameWriteRequest{
@@ -2259,47 +2397,28 @@ func (sc *serverConn) noteBodyRead(st *stream, n int) {
 }
 
 // st may be nil for conn-level
-func (sc *serverConn) sendWindowUpdate(st *stream, n int) {
-	sc.serveG.check()
-	// "The legal range for the increment to the flow control
-	// window is 1 to 2^31-1 (2,147,483,647) octets."
-	// A Go Read call on 64-bit machines could in theory read
-	// a larger Read than this. Very unlikely, but we handle it here
-	// rather than elsewhere for now.
-	const maxUint31 = 1<<31 - 1
-	for n >= maxUint31 {
-		sc.sendWindowUpdate32(st, maxUint31)
-		n -= maxUint31
-	}
-	sc.sendWindowUpdate32(st, int32(n))
+func (sc *serverConn) sendWindowUpdate32(st *stream, n int32) {
+	sc.sendWindowUpdate(st, int(n))
 }
 
 // st may be nil for conn-level
-func (sc *serverConn) sendWindowUpdate32(st *stream, n int32) {
+func (sc *serverConn) sendWindowUpdate(st *stream, n int) {
 	sc.serveG.check()
-	if n == 0 {
-		return
-	}
-	if n < 0 {
-		panic("negative update")
-	}
 	var streamID uint32
-	if st != nil {
+	var send int32
+	if st == nil {
+		send = sc.inflow.add(n)
+	} else {
 		streamID = st.id
+		send = st.inflow.add(n)
+	}
+	if send == 0 {
+		return
 	}
 	sc.writeFrame(FrameWriteRequest{
-		write:  writeWindowUpdate{streamID: streamID, n: uint32(n)},
+		write:  writeWindowUpdate{streamID: streamID, n: uint32(send)},
 		stream: st,
 	})
-	var ok bool
-	if st == nil {
-		ok = sc.inflow.add(n)
-	} else {
-		ok = st.inflow.add(n)
-	}
-	if !ok {
-		panic("internal error; sent too many window updates without decrements?")
-	}
 }
 
 // requestBody is the Handler's Request.Body type.
@@ -2308,17 +2427,18 @@ type requestBody struct {
 	_             incomparable
 	stream        *stream
 	conn          *serverConn
-	closed        bool  // for use by Close only
-	sawEOF        bool  // for use by Read only
-	pipe          *pipe // non-nil if we have a HTTP entity message body
-	needsContinue bool  // need to send a 100-continue
+	closeOnce     sync.Once // for use by Close only
+	sawEOF        bool      // for use by Read only
+	pipe          *pipe     // non-nil if we have a HTTP entity message body
+	needsContinue bool      // need to send a 100-continue
 }
 
 func (b *requestBody) Close() error {
-	if b.pipe != nil && !b.closed {
-		b.pipe.BreakWithError(errClosedBody)
-	}
-	b.closed = true
+	b.closeOnce.Do(func() {
+		if b.pipe != nil {
+			b.pipe.BreakWithError(errClosedBody)
+		}
+	})
 	return nil
 }
 
@@ -2362,7 +2482,6 @@ type responseWriterState struct {
 	// immutable within a request:
 	stream *stream
 	req    *http.Request
-	body   *requestBody // to close at end of request, if DATA frames didn't
 	conn   *serverConn
 
 	// TODO: adjust buffer writing sizes based on server config, frame size updates from peer, etc
@@ -2387,7 +2506,15 @@ type responseWriterState struct {
 
 type chunkWriter struct{ rws *responseWriterState }
 
-func (cw chunkWriter) Write(p []byte) (n int, err error) { return cw.rws.writeChunk(p) }
+func (cw chunkWriter) Write(p []byte) (n int, err error) {
+	n, err = cw.rws.writeChunk(p)
+	if err == errStreamClosed {
+		// If writing failed because the stream has been closed,
+		// return the reason it was closed.
+		err = cw.rws.stream.closeErr
+	}
+	return n, err
+}
 
 func (rws *responseWriterState) hasTrailers() bool { return len(rws.trailers) > 0 }
 
@@ -2426,6 +2553,10 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 		rws.writeHeader(200)
 	}
 
+	if rws.handlerDone {
+		rws.promoteUndeclaredTrailers()
+	}
+
 	isHeadResp := rws.req.Method == "HEAD"
 	if !rws.sentHeader {
 		rws.sentHeader = true
@@ -2497,10 +2628,6 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 		return 0, nil
 	}
 
-	if rws.handlerDone {
-		rws.promoteUndeclaredTrailers()
-	}
-
 	// only send trailers if they have actually been defined by the
 	// server handler.
 	hasNonemptyTrailers := rws.hasNonemptyTrailers()
@@ -2538,8 +2665,9 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 // prior to the headers being written. If the set of trailers is fixed
 // or known before the header is written, the normal Go trailers mechanism
 // is preferred:
-//    https://golang.org/pkg/net/http/#ResponseWriter
-//    https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
+//
+//	https://golang.org/pkg/net/http/#ResponseWriter
+//	https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
 const TrailerPrefix = "Trailer:"
 
 // promoteUndeclaredTrailers permits http.Handlers to set trailers
@@ -2580,23 +2708,85 @@ func (rws *responseWriterState) promoteUndeclaredTrailers() {
 	}
 }
 
+func (w *responseWriter) SetReadDeadline(deadline time.Time) error {
+	st := w.rws.stream
+	if !deadline.IsZero() && deadline.Before(time.Now()) {
+		// If we're setting a deadline in the past, reset the stream immediately
+		// so writes after SetWriteDeadline returns will fail.
+		st.onReadTimeout()
+		return nil
+	}
+	w.rws.conn.sendServeMsg(func(sc *serverConn) {
+		if st.readDeadline != nil {
+			if !st.readDeadline.Stop() {
+				// Deadline already exceeded, or stream has been closed.
+				return
+			}
+		}
+		if deadline.IsZero() {
+			st.readDeadline = nil
+		} else if st.readDeadline == nil {
+			st.readDeadline = time.AfterFunc(deadline.Sub(time.Now()), st.onReadTimeout)
+		} else {
+			st.readDeadline.Reset(deadline.Sub(time.Now()))
+		}
+	})
+	return nil
+}
+
+func (w *responseWriter) SetWriteDeadline(deadline time.Time) error {
+	st := w.rws.stream
+	if !deadline.IsZero() && deadline.Before(time.Now()) {
+		// If we're setting a deadline in the past, reset the stream immediately
+		// so writes after SetWriteDeadline returns will fail.
+		st.onWriteTimeout()
+		return nil
+	}
+	w.rws.conn.sendServeMsg(func(sc *serverConn) {
+		if st.writeDeadline != nil {
+			if !st.writeDeadline.Stop() {
+				// Deadline already exceeded, or stream has been closed.
+				return
+			}
+		}
+		if deadline.IsZero() {
+			st.writeDeadline = nil
+		} else if st.writeDeadline == nil {
+			st.writeDeadline = time.AfterFunc(deadline.Sub(time.Now()), st.onWriteTimeout)
+		} else {
+			st.writeDeadline.Reset(deadline.Sub(time.Now()))
+		}
+	})
+	return nil
+}
+
 func (w *responseWriter) Flush() {
+	w.FlushError()
+}
+
+func (w *responseWriter) FlushError() error {
 	rws := w.rws
 	if rws == nil {
 		panic("Header called after Handler finished")
 	}
+	var err error
 	if rws.bw.Buffered() > 0 {
-		if err := rws.bw.Flush(); err != nil {
-			// Ignore the error. The frame writer already knows.
-			return
-		}
+		err = rws.bw.Flush()
 	} else {
 		// The bufio.Writer won't call chunkWriter.Write
 		// (writeChunk with zero bytes, so we have to do it
 		// ourselves to force the HTTP response header and/or
 		// final DATA frame (with END_STREAM) to be sent.
-		rws.writeChunk(nil)
+		_, err = chunkWriter{rws}.Write(nil)
+		if err == nil {
+			select {
+			case <-rws.stream.cw:
+				err = rws.stream.closeErr
+			default:
+			}
+		}
 	}
+	return err
 }
 
 func (w *responseWriter) CloseNotify() <-chan bool {
@@ -2635,8 +2825,7 @@ func checkWriteHeaderCode(code int) {
 	// Issue 22880: require valid WriteHeader status codes.
 	// For now we only enforce that it's three digits.
 	// In the future we might block things over 599 (600 and above aren't defined
-	// at http://httpwg.org/specs/rfc7231.html#status.codes)
-	// and we might block under 200 (once we have more mature 1xx support).
+	// at http://httpwg.org/specs/rfc7231.html#status.codes).
 	// But for now any three digits.
 	//
 	// We used to send "HTTP/1.1 000 0" on the wire in responses but there's
@@ -2657,13 +2846,41 @@ func (w *responseWriter) WriteHeader(code int) {
 }
 
 func (rws *responseWriterState) writeHeader(code int) {
-	if !rws.wroteHeader {
-		checkWriteHeaderCode(code)
-		rws.wroteHeader = true
-		rws.status = code
-		if len(rws.handlerHeader) > 0 {
-			rws.snapHeader = cloneHeader(rws.handlerHeader)
+	if rws.wroteHeader {
+		return
+	}
+
+	checkWriteHeaderCode(code)
+
+	// Handle informational headers
+	if code >= 100 && code <= 199 {
+		// Per RFC 8297 we must not clear the current header map
+		h := rws.handlerHeader
+
+		_, cl := h["Content-Length"]
+		_, te := h["Transfer-Encoding"]
+		if cl || te {
+			h = h.Clone()
+			h.Del("Content-Length")
+			h.Del("Transfer-Encoding")
+		}
+
+		if rws.conn.writeHeaders(rws.stream, &writeResHeaders{
+			streamID:    rws.stream.id,
+			httpResCode: code,
+			h:           h,
+			endStream:   rws.handlerDone && !rws.hasTrailers(),
+		}) != nil {
+			rws.dirty = true
 		}
+
+		return
+	}
+
+	rws.wroteHeader = true
+	rws.status = code
+	if len(rws.handlerHeader) > 0 {
+		rws.snapHeader = cloneHeader(rws.handlerHeader)
 	}
 }
 
diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
index 6d6f88589b..ac90a2631c 100644
--- a/vendor/golang.org/x/net/http2/transport.go
+++ b/vendor/golang.org/x/net/http2/transport.go
@@ -16,7 +16,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
+	"io/fs"
 	"log"
 	"math"
 	mathrand "math/rand"
@@ -47,10 +47,6 @@ const (
 	// we buffer per stream.
 	transportDefaultStreamFlow = 4 << 20
 
-	// transportDefaultStreamMinRefresh is the minimum number of bytes we'll send
-	// a stream-level WINDOW_UPDATE for at a time.
-	transportDefaultStreamMinRefresh = 4 << 10
-
 	defaultUserAgent = "Go-http-client/2.0"
 
 	// initialMaxConcurrentStreams is a connections maxConcurrentStreams until
@@ -68,13 +64,23 @@ const (
 // A Transport internally caches connections to servers. It is safe
 // for concurrent use by multiple goroutines.
 type Transport struct {
-	// DialTLS specifies an optional dial function for creating
-	// TLS connections for requests.
+	// DialTLSContext specifies an optional dial function with context for
+	// creating TLS connections for requests.
 	//
-	// If DialTLS is nil, tls.Dial is used.
+	// If DialTLSContext and DialTLS is nil, tls.Dial is used.
 	//
 	// If the returned net.Conn has a ConnectionState method like tls.Conn,
 	// it will be used to set http.Response.TLS.
+	DialTLSContext func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error)
+
+	// DialTLS specifies an optional dial function for creating
+	// TLS connections for requests.
+	//
+	// If DialTLSContext and DialTLS is nil, tls.Dial is used.
+	//
+	// Deprecated: Use DialTLSContext instead, which allows the transport
+	// to cancel dials as soon as they are no longer needed.
+	// If both are set, DialTLSContext takes priority.
 	DialTLS func(network, addr string, cfg *tls.Config) (net.Conn, error)
 
 	// TLSClientConfig specifies the TLS configuration to use with
@@ -108,6 +114,28 @@ type Transport struct {
 	// to mean no limit.
 	MaxHeaderListSize uint32
 
+	// MaxReadFrameSize is the http2 SETTINGS_MAX_FRAME_SIZE to send in the
+	// initial settings frame. It is the size in bytes of the largest frame
+	// payload that the sender is willing to receive. If 0, no setting is
+	// sent, and the value is provided by the peer, which should be 16384
+	// according to the spec:
+	// https://datatracker.ietf.org/doc/html/rfc7540#section-6.5.2.
+	// Values are bounded in the range 16k to 16M.
+	MaxReadFrameSize uint32
+
+	// MaxDecoderHeaderTableSize optionally specifies the http2
+	// SETTINGS_HEADER_TABLE_SIZE to send in the initial settings frame. It
+	// informs the remote endpoint of the maximum size of the header compression
+	// table used to decode header blocks, in octets. If zero, the default value
+	// of 4096 is used.
+	MaxDecoderHeaderTableSize uint32
+
+	// MaxEncoderHeaderTableSize optionally specifies an upper limit for the
+	// header compression table used for encoding request headers. Received
+	// SETTINGS_HEADER_TABLE_SIZE settings are capped at this limit. If zero,
+	// the default value of 4096 is used.
+	MaxEncoderHeaderTableSize uint32
+
 	// StrictMaxConcurrentStreams controls whether the server's
 	// SETTINGS_MAX_CONCURRENT_STREAMS should be respected
 	// globally. If false, new TCP connections are created to the
@@ -161,6 +189,19 @@ func (t *Transport) maxHeaderListSize() uint32 {
 	return t.MaxHeaderListSize
 }
 
+func (t *Transport) maxFrameReadSize() uint32 {
+	if t.MaxReadFrameSize == 0 {
+		return 0 // use the default provided by the peer
+	}
+	if t.MaxReadFrameSize < minMaxFrameSize {
+		return minMaxFrameSize
+	}
+	if t.MaxReadFrameSize > maxFrameSize {
+		return maxFrameSize
+	}
+	return t.MaxReadFrameSize
+}
+
 func (t *Transport) disableCompression() bool {
 	return t.DisableCompression || (t.t1 != nil && t.t1.DisableCompression)
 }
@@ -249,7 +290,8 @@ func (t *Transport) initConnPool() {
 // HTTP/2 server.
 type ClientConn struct {
 	t             *Transport
-	tconn         net.Conn             // usually *tls.Conn, except specialized impls
+	tconn         net.Conn // usually *tls.Conn, except specialized impls
+	tconnClosed   bool
 	tlsState      *tls.ConnectionState // nil only for specialized impls
 	reused        uint32               // whether conn is being reused; atomic
 	singleUse     bool                 // whether being used for a single http.Request
@@ -264,8 +306,8 @@ type ClientConn struct {
 
 	mu              sync.Mutex // guards following
 	cond            *sync.Cond // hold mu; broadcast on flow/closed changes
-	flow            flow       // our conn-level flow control quota (cs.flow is per stream)
-	inflow          flow       // peer's conn-level flow control
+	flow            outflow    // our conn-level flow control quota (cs.outflow is per stream)
+	inflow          inflow     // peer's conn-level flow control
 	doNotReuse      bool       // whether conn is marked to not be reused for any future requests
 	closing         bool
 	closed          bool
@@ -282,10 +324,11 @@ type ClientConn struct {
 	lastActive      time.Time
 	lastIdle        time.Time // time last idle
 	// Settings from peer: (also guarded by wmu)
-	maxFrameSize          uint32
-	maxConcurrentStreams  uint32
-	peerMaxHeaderListSize uint64
-	initialWindowSize     uint32
+	maxFrameSize           uint32
+	maxConcurrentStreams   uint32
+	peerMaxHeaderListSize  uint64
+	peerMaxHeaderTableSize uint32
+	initialWindowSize      uint32
 
 	// reqHeaderMu is a 1-element semaphore channel controlling access to sending new requests.
 	// Write to reqHeaderMu to lock it, read from it to unlock.
@@ -329,14 +372,14 @@ type clientStream struct {
 	respHeaderRecv chan struct{}  // closed when headers are received
 	res            *http.Response // set if respHeaderRecv is closed
 
-	flow        flow  // guarded by cc.mu
-	inflow      flow  // guarded by cc.mu
-	bytesRemain int64 // -1 means unknown; owned by transportResponseBody.Read
-	readErr     error // sticky read error; owned by transportResponseBody.Read
+	flow        outflow // guarded by cc.mu
+	inflow      inflow  // guarded by cc.mu
+	bytesRemain int64   // -1 means unknown; owned by transportResponseBody.Read
+	readErr     error   // sticky read error; owned by transportResponseBody.Read
 
 	reqBody              io.ReadCloser
-	reqBodyContentLength int64 // -1 means unknown
-	reqBodyClosed        bool  // body has been closed; guarded by cc.mu
+	reqBodyContentLength int64         // -1 means unknown
+	reqBodyClosed        chan struct{} // guarded by cc.mu; non-nil on Close, closed when done
 
 	// owned by writeRequest:
 	sentEndStream bool // sent an END_STREAM flag to the peer
@@ -376,9 +419,8 @@ func (cs *clientStream) abortStreamLocked(err error) {
 		cs.abortErr = err
 		close(cs.abort)
 	})
-	if cs.reqBody != nil && !cs.reqBodyClosed {
-		cs.reqBody.Close()
-		cs.reqBodyClosed = true
+	if cs.reqBody != nil {
+		cs.closeReqBodyLocked()
 	}
 	// TODO(dneil): Clean up tests where cs.cc.cond is nil.
 	if cs.cc.cond != nil {
@@ -391,13 +433,24 @@ func (cs *clientStream) abortRequestBodyWrite() {
 	cc := cs.cc
 	cc.mu.Lock()
 	defer cc.mu.Unlock()
-	if cs.reqBody != nil && !cs.reqBodyClosed {
-		cs.reqBody.Close()
-		cs.reqBodyClosed = true
+	if cs.reqBody != nil && cs.reqBodyClosed == nil {
+		cs.closeReqBodyLocked()
 		cc.cond.Broadcast()
 	}
 }
 
+func (cs *clientStream) closeReqBodyLocked() {
+	if cs.reqBodyClosed != nil {
+		return
+	}
+	cs.reqBodyClosed = make(chan struct{})
+	reqBodyClosed := cs.reqBodyClosed
+	go func() {
+		cs.reqBody.Close()
+		close(reqBodyClosed)
+	}()
+}
+
 type stickyErrWriter struct {
 	conn    net.Conn
 	timeout time.Duration
@@ -481,6 +534,15 @@ func authorityAddr(scheme string, authority string) (addr string) {
 	return net.JoinHostPort(host, port)
 }
 
+var retryBackoffHook func(time.Duration) *time.Timer
+
+func backoffNewTimer(d time.Duration) *time.Timer {
+	if retryBackoffHook != nil {
+		return retryBackoffHook(d)
+	}
+	return time.NewTimer(d)
+}
+
 // RoundTripOpt is like RoundTrip, but takes options.
 func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
 	if !(req.URL.Scheme == "https" || (req.URL.Scheme == "http" && t.AllowHTTP)) {
@@ -498,17 +560,23 @@ func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Res
 		traceGotConn(req, cc, reused)
 		res, err := cc.RoundTrip(req)
 		if err != nil && retry <= 6 {
+			roundTripErr := err
 			if req, err = shouldRetryRequest(req, err); err == nil {
 				// After the first retry, do exponential backoff with 10% jitter.
 				if retry == 0 {
+					t.vlogf("RoundTrip retrying after failure: %v", roundTripErr)
 					continue
 				}
 				backoff := float64(uint(1) << (uint(retry) - 1))
 				backoff += backoff * (0.1 * mathrand.Float64())
+				d := time.Second * time.Duration(backoff)
+				timer := backoffNewTimer(d)
 				select {
-				case <-time.After(time.Second * time.Duration(backoff)):
+				case <-timer.C:
+					t.vlogf("RoundTrip retrying after failure: %v", roundTripErr)
 					continue
 				case <-req.Context().Done():
+					timer.Stop()
 					err = req.Context().Err()
 				}
 			}
@@ -591,7 +659,7 @@ func (t *Transport) dialClientConn(ctx context.Context, addr string, singleUse b
 	if err != nil {
 		return nil, err
 	}
-	tconn, err := t.dialTLS(ctx)("tcp", addr, t.newTLSConfig(host))
+	tconn, err := t.dialTLS(ctx, "tcp", addr, t.newTLSConfig(host))
 	if err != nil {
 		return nil, err
 	}
@@ -612,24 +680,25 @@ func (t *Transport) newTLSConfig(host string) *tls.Config {
 	return cfg
 }
 
-func (t *Transport) dialTLS(ctx context.Context) func(string, string, *tls.Config) (net.Conn, error) {
-	if t.DialTLS != nil {
-		return t.DialTLS
+func (t *Transport) dialTLS(ctx context.Context, network, addr string, tlsCfg *tls.Config) (net.Conn, error) {
+	if t.DialTLSContext != nil {
+		return t.DialTLSContext(ctx, network, addr, tlsCfg)
+	} else if t.DialTLS != nil {
+		return t.DialTLS(network, addr, tlsCfg)
 	}
-	return func(network, addr string, cfg *tls.Config) (net.Conn, error) {
-		tlsCn, err := t.dialTLSWithContext(ctx, network, addr, cfg)
-		if err != nil {
-			return nil, err
-		}
-		state := tlsCn.ConnectionState()
-		if p := state.NegotiatedProtocol; p != NextProtoTLS {
-			return nil, fmt.Errorf("http2: unexpected ALPN protocol %q; want %q", p, NextProtoTLS)
-		}
-		if !state.NegotiatedProtocolIsMutual {
-			return nil, errors.New("http2: could not negotiate protocol mutually")
-		}
-		return tlsCn, nil
+
+	tlsCn, err := t.dialTLSWithContext(ctx, network, addr, tlsCfg)
+	if err != nil {
+		return nil, err
+	}
+	state := tlsCn.ConnectionState()
+	if p := state.NegotiatedProtocol; p != NextProtoTLS {
+		return nil, fmt.Errorf("http2: unexpected ALPN protocol %q; want %q", p, NextProtoTLS)
 	}
+	if !state.NegotiatedProtocolIsMutual {
+		return nil, errors.New("http2: could not negotiate protocol mutually")
+	}
+	return tlsCn, nil
 }
 
 // disableKeepAlives reports whether connections should be closed as
@@ -645,6 +714,20 @@ func (t *Transport) expectContinueTimeout() time.Duration {
 	return t.t1.ExpectContinueTimeout
 }
 
+func (t *Transport) maxDecoderHeaderTableSize() uint32 {
+	if v := t.MaxDecoderHeaderTableSize; v > 0 {
+		return v
+	}
+	return initialHeaderTableSize
+}
+
+func (t *Transport) maxEncoderHeaderTableSize() uint32 {
+	if v := t.MaxEncoderHeaderTableSize; v > 0 {
+		return v
+	}
+	return initialHeaderTableSize
+}
+
 func (t *Transport) NewClientConn(c net.Conn) (*ClientConn, error) {
 	return t.newClientConn(c, t.disableKeepAlives())
 }
@@ -685,15 +768,19 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 	})
 	cc.br = bufio.NewReader(c)
 	cc.fr = NewFramer(cc.bw, cc.br)
+	if t.maxFrameReadSize() != 0 {
+		cc.fr.SetMaxReadFrameSize(t.maxFrameReadSize())
+	}
 	if t.CountError != nil {
 		cc.fr.countError = t.CountError
 	}
-	cc.fr.ReadMetaHeaders = hpack.NewDecoder(initialHeaderTableSize, nil)
+	maxHeaderTableSize := t.maxDecoderHeaderTableSize()
+	cc.fr.ReadMetaHeaders = hpack.NewDecoder(maxHeaderTableSize, nil)
 	cc.fr.MaxHeaderListSize = t.maxHeaderListSize()
 
-	// TODO: SetMaxDynamicTableSize, SetMaxDynamicTableSizeLimit on
-	// henc in response to SETTINGS frames?
 	cc.henc = hpack.NewEncoder(&cc.hbuf)
+	cc.henc.SetMaxDynamicTableSizeLimit(t.maxEncoderHeaderTableSize())
+	cc.peerMaxHeaderTableSize = initialHeaderTableSize
 
 	if t.AllowHTTP {
 		cc.nextStreamID = 3
@@ -708,14 +795,20 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 		{ID: SettingEnablePush, Val: 0},
 		{ID: SettingInitialWindowSize, Val: transportDefaultStreamFlow},
 	}
+	if max := t.maxFrameReadSize(); max != 0 {
+		initialSettings = append(initialSettings, Setting{ID: SettingMaxFrameSize, Val: max})
+	}
 	if max := t.maxHeaderListSize(); max != 0 {
 		initialSettings = append(initialSettings, Setting{ID: SettingMaxHeaderListSize, Val: max})
 	}
+	if maxHeaderTableSize != initialHeaderTableSize {
+		initialSettings = append(initialSettings, Setting{ID: SettingHeaderTableSize, Val: maxHeaderTableSize})
+	}
 
 	cc.bw.Write(clientPreface)
 	cc.fr.WriteSettings(initialSettings...)
 	cc.fr.WriteWindowUpdate(0, transportDefaultConnFlow)
-	cc.inflow.add(transportDefaultConnFlow + initialWindowSize)
+	cc.inflow.init(transportDefaultConnFlow + initialWindowSize)
 	cc.bw.Flush()
 	if cc.werr != nil {
 		cc.Close()
@@ -732,11 +825,13 @@ func (cc *ClientConn) healthCheck() {
 	// trigger the healthCheck again if there is no frame received.
 	ctx, cancel := context.WithTimeout(context.Background(), pingTimeout)
 	defer cancel()
+	cc.vlogf("http2: Transport sending health check")
 	err := cc.Ping(ctx)
 	if err != nil {
+		cc.vlogf("http2: Transport health check failure: %v", err)
 		cc.closeForLostPing()
-		cc.t.connPool().MarkDead(cc)
-		return
+	} else {
+		cc.vlogf("http2: Transport health check success")
 	}
 }
 
@@ -907,6 +1002,24 @@ func (cc *ClientConn) onIdleTimeout() {
 	cc.closeIfIdle()
 }
 
+func (cc *ClientConn) closeConn() {
+	t := time.AfterFunc(250*time.Millisecond, cc.forceCloseConn)
+	defer t.Stop()
+	cc.tconn.Close()
+}
+
+// A tls.Conn.Close can hang for a long time if the peer is unresponsive.
+// Try to shut it down more aggressively.
+func (cc *ClientConn) forceCloseConn() {
+	tc, ok := cc.tconn.(*tls.Conn)
+	if !ok {
+		return
+	}
+	if nc := tlsUnderlyingConn(tc); nc != nil {
+		nc.Close()
+	}
+}
+
 func (cc *ClientConn) closeIfIdle() {
 	cc.mu.Lock()
 	if len(cc.streams) > 0 || cc.streamsReserved > 0 {
@@ -921,7 +1034,7 @@ func (cc *ClientConn) closeIfIdle() {
 	if VerboseLogs {
 		cc.vlogf("http2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)", cc, cc.singleUse, nextID-2)
 	}
-	cc.tconn.Close()
+	cc.closeConn()
 }
 
 func (cc *ClientConn) isDoNotReuseAndIdle() bool {
@@ -938,7 +1051,7 @@ func (cc *ClientConn) Shutdown(ctx context.Context) error {
 		return err
 	}
 	// Wait for all in-flight streams to complete or connection to close
-	done := make(chan error, 1)
+	done := make(chan struct{})
 	cancelled := false // guarded by cc.mu
 	go func() {
 		cc.mu.Lock()
@@ -946,7 +1059,7 @@ func (cc *ClientConn) Shutdown(ctx context.Context) error {
 		for {
 			if len(cc.streams) == 0 || cc.closed {
 				cc.closed = true
-				done <- cc.tconn.Close()
+				close(done)
 				break
 			}
 			if cancelled {
@@ -957,8 +1070,9 @@ func (cc *ClientConn) Shutdown(ctx context.Context) error {
 	}()
 	shutdownEnterWaitStateHook()
 	select {
-	case err := <-done:
-		return err
+	case <-done:
+		cc.closeConn()
+		return nil
 	case <-ctx.Done():
 		cc.mu.Lock()
 		// Free the goroutine above
@@ -995,15 +1109,15 @@ func (cc *ClientConn) sendGoAway() error {
 
 // closes the client connection immediately. In-flight requests are interrupted.
 // err is sent to streams.
-func (cc *ClientConn) closeForError(err error) error {
+func (cc *ClientConn) closeForError(err error) {
 	cc.mu.Lock()
 	cc.closed = true
 	for _, cs := range cc.streams {
 		cs.abortStreamLocked(err)
 	}
-	defer cc.cond.Broadcast()
-	defer cc.mu.Unlock()
-	return cc.tconn.Close()
+	cc.cond.Broadcast()
+	cc.mu.Unlock()
+	cc.closeConn()
 }
 
 // Close closes the client connection immediately.
@@ -1011,16 +1125,17 @@ func (cc *ClientConn) closeForError(err error) error {
 // In-flight requests are interrupted. For a graceful shutdown, use Shutdown instead.
 func (cc *ClientConn) Close() error {
 	err := errors.New("http2: client connection force closed via ClientConn.Close")
-	return cc.closeForError(err)
+	cc.closeForError(err)
+	return nil
 }
 
 // closes the client connection immediately. In-flight requests are interrupted.
-func (cc *ClientConn) closeForLostPing() error {
+func (cc *ClientConn) closeForLostPing() {
 	err := errors.New("http2: client connection lost")
 	if f := cc.t.CountError; f != nil {
 		f("conn_close_lost_ping")
 	}
-	return cc.closeForError(err)
+	cc.closeForError(err)
 }
 
 // errRequestCanceled is a copy of net/http's errRequestCanceled because it's not
@@ -1030,7 +1145,7 @@ var errRequestCanceled = errors.New("net/http: request canceled")
 func commaSeparatedTrailers(req *http.Request) (string, error) {
 	keys := make([]string, 0, len(req.Trailer))
 	for k := range req.Trailer {
-		k = http.CanonicalHeaderKey(k)
+		k = canonicalHeader(k)
 		switch k {
 		case "Transfer-Encoding", "Trailer", "Content-Length":
 			return "", fmt.Errorf("invalid Trailer key %q", k)
@@ -1124,43 +1239,74 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 		}
 	}
 
+	handleResponseHeaders := func() (*http.Response, error) {
+		res := cs.res
+		if res.StatusCode > 299 {
+			// On error or status code 3xx, 4xx, 5xx, etc abort any
+			// ongoing write, assuming that the server doesn't care
+			// about our request body. If the server replied with 1xx or
+			// 2xx, however, then assume the server DOES potentially
+			// want our body (e.g. full-duplex streaming:
+			// golang.org/issue/13444). If it turns out the server
+			// doesn't, they'll RST_STREAM us soon enough. This is a
+			// heuristic to avoid adding knobs to Transport. Hopefully
+			// we can keep it.
+			cs.abortRequestBodyWrite()
+		}
+		res.Request = req
+		res.TLS = cc.tlsState
+		if res.Body == noBody && actualContentLength(req) == 0 {
+			// If there isn't a request or response body still being
+			// written, then wait for the stream to be closed before
+			// RoundTrip returns.
+			if err := waitDone(); err != nil {
+				return nil, err
+			}
+		}
+		return res, nil
+	}
+
+	cancelRequest := func(cs *clientStream, err error) error {
+		cs.cc.mu.Lock()
+		defer cs.cc.mu.Unlock()
+		cs.abortStreamLocked(err)
+		if cs.ID != 0 {
+			// This request may have failed because of a problem with the connection,
+			// or for some unrelated reason. (For example, the user might have canceled
+			// the request without waiting for a response.) Mark the connection as
+			// not reusable, since trying to reuse a dead connection is worse than
+			// unnecessarily creating a new one.
+			//
+			// If cs.ID is 0, then the request was never allocated a stream ID and
+			// whatever went wrong was unrelated to the connection. We might have
+			// timed out waiting for a stream slot when StrictMaxConcurrentStreams
+			// is set, for example, in which case retrying on a different connection
+			// will not help.
+			cs.cc.doNotReuse = true
+		}
+		return err
+	}
+
 	for {
 		select {
 		case <-cs.respHeaderRecv:
-			res := cs.res
-			if res.StatusCode > 299 {
-				// On error or status code 3xx, 4xx, 5xx, etc abort any
-				// ongoing write, assuming that the server doesn't care
-				// about our request body. If the server replied with 1xx or
-				// 2xx, however, then assume the server DOES potentially
-				// want our body (e.g. full-duplex streaming:
-				// golang.org/issue/13444). If it turns out the server
-				// doesn't, they'll RST_STREAM us soon enough. This is a
-				// heuristic to avoid adding knobs to Transport. Hopefully
-				// we can keep it.
-				cs.abortRequestBodyWrite()
-			}
-			res.Request = req
-			res.TLS = cc.tlsState
-			if res.Body == noBody && actualContentLength(req) == 0 {
-				// If there isn't a request or response body still being
-				// written, then wait for the stream to be closed before
-				// RoundTrip returns.
-				if err := waitDone(); err != nil {
-					return nil, err
-				}
-			}
-			return res, nil
+			return handleResponseHeaders()
 		case <-cs.abort:
-			waitDone()
-			return nil, cs.abortErr
+			select {
+			case <-cs.respHeaderRecv:
+				// If both cs.respHeaderRecv and cs.abort are signaling,
+				// pick respHeaderRecv. The server probably wrote the
+				// response and immediately reset the stream.
+				// golang.org/issue/49645
+				return handleResponseHeaders()
+			default:
+				waitDone()
+				return nil, cancelRequest(cs, cs.abortErr)
+			}
 		case <-ctx.Done():
-			err := ctx.Err()
-			cs.abortStream(err)
-			return nil, err
+			return nil, cancelRequest(cs, ctx.Err())
 		case <-cs.reqCancel:
-			cs.abortStream(errRequestCanceled)
-			return nil, errRequestCanceled
+			return nil, cancelRequest(cs, errRequestCanceled)
 		}
 	}
 }
@@ -1213,6 +1359,9 @@ func (cs *clientStream) writeRequest(req *http.Request) (err error) {
 		return err
 	}
 	cc.addStreamLocked(cs) // assigns stream ID
+	if isConnectionCloseRequest(req) {
+		cc.doNotReuse = true
+	}
 	cc.mu.Unlock()
 
 	// TODO(bradfitz): this is a copy of the logic in net/http. Unify somewhere?
@@ -1236,12 +1385,12 @@ func (cs *clientStream) writeRequest(req *http.Request) (err error) {
 	}
 
 	continueTimeout := cc.t.expectContinueTimeout()
-	if continueTimeout != 0 &&
-		!httpguts.HeaderValuesContainsToken(
-			req.Header["Expect"],
-			"100-continue") {
-		continueTimeout = 0
-		cs.on100 = make(chan struct{}, 1)
+	if continueTimeout != 0 {
+		if !httpguts.HeaderValuesContainsToken(req.Header["Expect"], "100-continue") {
+			continueTimeout = 0
+		} else {
+			cs.on100 = make(chan struct{}, 1)
+		}
 	}
 
 	// Past this point (where we send request headers), it is possible for
@@ -1310,6 +1459,7 @@ func (cs *clientStream) writeRequest(req *http.Request) (err error) {
 		case <-respHeaderTimer:
 			return errTimeout
 		case <-respHeaderRecv:
+			respHeaderRecv = nil
 			respHeaderTimer = nil // keep waiting for END_STREAM
 		case <-cs.abort:
 			return cs.abortErr
@@ -1381,11 +1531,19 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 	// and in multiple cases: server replies <=299 and >299
 	// while still writing request body
 	cc.mu.Lock()
+	mustCloseBody := false
+	if cs.reqBody != nil && cs.reqBodyClosed == nil {
+		mustCloseBody = true
+		cs.reqBodyClosed = make(chan struct{})
+	}
 	bodyClosed := cs.reqBodyClosed
-	cs.reqBodyClosed = true
 	cc.mu.Unlock()
-	if !bodyClosed && cs.reqBody != nil {
+	if mustCloseBody {
 		cs.reqBody.Close()
+		close(bodyClosed)
+	}
+	if bodyClosed != nil {
+		<-bodyClosed
 	}
 
 	if err != nil && cs.sentEndStream {
@@ -1430,7 +1588,7 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 	close(cs.donec)
 }
 
-// awaitOpenSlotForStream waits until len(streams) < maxConcurrentStreams.
+// awaitOpenSlotForStreamLocked waits until len(streams) < maxConcurrentStreams.
 // Must hold cc.mu.
 func (cc *ClientConn) awaitOpenSlotForStreamLocked(cs *clientStream) error {
 	for {
@@ -1542,7 +1700,7 @@ func (cs *clientStream) writeRequestBody(req *http.Request) (err error) {
 
 	var sawEOF bool
 	for !sawEOF {
-		n, err := body.Read(buf[:len(buf)])
+		n, err := body.Read(buf)
 		if hasContentLen {
 			remainLen -= int64(n)
 			if remainLen == 0 && err == nil {
@@ -1565,7 +1723,7 @@ func (cs *clientStream) writeRequestBody(req *http.Request) (err error) {
 		}
 		if err != nil {
 			cc.mu.Lock()
-			bodyClosed := cs.reqBodyClosed
+			bodyClosed := cs.reqBodyClosed != nil
 			cc.mu.Unlock()
 			switch {
 			case bodyClosed:
@@ -1660,7 +1818,7 @@ func (cs *clientStream) awaitFlowControl(maxBytes int) (taken int32, err error)
 		if cc.closed {
 			return 0, errClientConnClosed
 		}
-		if cs.reqBodyClosed {
+		if cs.reqBodyClosed != nil {
 			return 0, errStopReqBodyWrite
 		}
 		select {
@@ -1731,7 +1889,8 @@ func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trail
 		}
 		for _, v := range vv {
 			if !httpguts.ValidHeaderFieldValue(v) {
-				return nil, fmt.Errorf("invalid HTTP header value %q for header %q", v, k)
+				// Don't include the value in the error, because it may be sensitive.
+				return nil, fmt.Errorf("invalid HTTP header value for header %q", k)
 			}
 		}
 	}
@@ -1844,7 +2003,7 @@ func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trail
 
 	// Header list size is ok. Write the headers.
 	enumerateHeaders(func(name, value string) {
-		name, ascii := asciiToLower(name)
+		name, ascii := lowerHeader(name)
 		if !ascii {
 			// Skip writing invalid headers. Per RFC 7540, Section 8.1.2, header
 			// field names have to be ASCII characters (just as in HTTP/1.x).
@@ -1897,7 +2056,7 @@ func (cc *ClientConn) encodeTrailers(trailer http.Header) ([]byte, error) {
 	}
 
 	for k, vv := range trailer {
-		lowKey, ascii := asciiToLower(k)
+		lowKey, ascii := lowerHeader(k)
 		if !ascii {
 			// Skip writing invalid headers. Per RFC 7540, Section 8.1.2, header
 			// field names have to be ASCII characters (just as in HTTP/1.x).
@@ -1929,8 +2088,7 @@ type resAndError struct {
 func (cc *ClientConn) addStreamLocked(cs *clientStream) {
 	cs.flow.add(int32(cc.initialWindowSize))
 	cs.flow.setConnFlow(&cc.flow)
-	cs.inflow.add(transportDefaultStreamFlow)
-	cs.inflow.setConnFlow(&cc.inflow)
+	cs.inflow.init(transportDefaultStreamFlow)
 	cs.ID = cc.nextStreamID
 	cc.nextStreamID += 2
 	cc.streams[cs.ID] = cs
@@ -1955,13 +2113,13 @@ func (cc *ClientConn) forgetStreamID(id uint32) {
 	// wake up RoundTrip if there is a pending request.
 	cc.cond.Broadcast()
 
-	closeOnIdle := cc.singleUse || cc.doNotReuse || cc.t.disableKeepAlives()
+	closeOnIdle := cc.singleUse || cc.doNotReuse || cc.t.disableKeepAlives() || cc.goAway != nil
 	if closeOnIdle && cc.streamsReserved == 0 && len(cc.streams) == 0 {
 		if VerboseLogs {
 			cc.vlogf("http2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)", cc, cc.singleUse, cc.nextStreamID-2)
 		}
 		cc.closed = true
-		defer cc.tconn.Close()
+		defer cc.closeConn()
 	}
 
 	cc.mu.Unlock()
@@ -2008,8 +2166,8 @@ func isEOFOrNetReadError(err error) bool {
 
 func (rl *clientConnReadLoop) cleanup() {
 	cc := rl.cc
-	defer cc.tconn.Close()
-	defer cc.t.connPool().MarkDead(cc)
+	cc.t.connPool().MarkDead(cc)
+	defer cc.closeConn()
 	defer close(cc.readerDone)
 
 	if cc.idleTimer != nil {
@@ -2031,6 +2189,7 @@ func (rl *clientConnReadLoop) cleanup() {
 		err = io.ErrUnexpectedEOF
 	}
 	cc.closed = true
+
 	for _, cs := range cc.streams {
 		select {
 		case <-cs.peerClosed:
@@ -2229,7 +2388,7 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 		Status:     status + " " + http.StatusText(statusCode),
 	}
 	for _, hf := range regularFields {
-		key := http.CanonicalHeaderKey(hf.Name)
+		key := canonicalHeader(hf.Name)
 		if key == "Trailer" {
 			t := res.Trailer
 			if t == nil {
@@ -2237,7 +2396,7 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 				res.Trailer = t
 			}
 			foreachHeaderElement(hf.Value, func(v string) {
-				t[http.CanonicalHeaderKey(v)] = nil
+				t[canonicalHeader(v)] = nil
 			})
 		} else {
 			vv := header[key]
@@ -2313,7 +2472,7 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 	cs.bytesRemain = res.ContentLength
 	res.Body = transportResponseBody{cs}
 
-	if cs.requestedGzip && res.Header.Get("Content-Encoding") == "gzip" {
+	if cs.requestedGzip && asciiEqualFold(res.Header.Get("Content-Encoding"), "gzip") {
 		res.Header.Del("Content-Encoding")
 		res.Header.Del("Content-Length")
 		res.ContentLength = -1
@@ -2342,7 +2501,7 @@ func (rl *clientConnReadLoop) processTrailers(cs *clientStream, f *MetaHeadersFr
 
 	trailer := make(http.Header)
 	for _, hf := range f.RegularFields() {
-		key := http.CanonicalHeaderKey(hf.Name)
+		key := canonicalHeader(hf.Name)
 		trailer[key] = append(trailer[key], hf.Value)
 	}
 	cs.trailer = trailer
@@ -2388,21 +2547,10 @@ func (b transportResponseBody) Read(p []byte) (n int, err error) {
 	}
 
 	cc.mu.Lock()
-	var connAdd, streamAdd int32
-	// Check the conn-level first, before the stream-level.
-	if v := cc.inflow.available(); v < transportDefaultConnFlow/2 {
-		connAdd = transportDefaultConnFlow - v
-		cc.inflow.add(connAdd)
-	}
+	connAdd := cc.inflow.add(n)
+	var streamAdd int32
 	if err == nil { // No need to refresh if the stream is over or failed.
-		// Consider any buffered body data (read from the conn but not
-		// consumed by the client) when computing flow control for this
-		// stream.
-		v := int(cs.inflow.available()) + cs.bufPipe.Len()
-		if v < transportDefaultStreamFlow-transportDefaultStreamMinRefresh {
-			streamAdd = int32(transportDefaultStreamFlow - v)
-			cs.inflow.add(streamAdd)
-		}
+		streamAdd = cs.inflow.add(n)
 	}
 	cc.mu.Unlock()
 
@@ -2426,33 +2574,34 @@ func (b transportResponseBody) Close() error {
 	cs := b.cs
 	cc := cs.cc
 
+	cs.bufPipe.BreakWithError(errClosedResponseBody)
+	cs.abortStream(errClosedResponseBody)
+
 	unread := cs.bufPipe.Len()
 	if unread > 0 {
 		cc.mu.Lock()
 		// Return connection-level flow control.
-		if unread > 0 {
-			cc.inflow.add(int32(unread))
-		}
+		connAdd := cc.inflow.add(unread)
 		cc.mu.Unlock()
 
 		// TODO(dneil): Acquiring this mutex can block indefinitely.
 		// Move flow control return to a goroutine?
 		cc.wmu.Lock()
 		// Return connection-level flow control.
-		if unread > 0 {
-			cc.fr.WriteWindowUpdate(0, uint32(unread))
+		if connAdd > 0 {
+			cc.fr.WriteWindowUpdate(0, uint32(connAdd))
 		}
 		cc.bw.Flush()
 		cc.wmu.Unlock()
 	}
 
-	cs.bufPipe.BreakWithError(errClosedResponseBody)
-	cs.abortStream(errClosedResponseBody)
-
 	select {
 	case <-cs.donec:
 	case <-cs.ctx.Done():
-		return cs.ctx.Err()
+		// See golang/go#49366: The net/http package can cancel the
+		// request context after the response body is fully read.
+		// Don't treat this as an error.
+		return nil
 	case <-cs.reqCancel:
 		return errRequestCanceled
 	}
@@ -2480,13 +2629,18 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 		// But at least return their flow control:
 		if f.Length > 0 {
 			cc.mu.Lock()
-			cc.inflow.add(int32(f.Length))
+			ok := cc.inflow.take(f.Length)
+			connAdd := cc.inflow.add(int(f.Length))
 			cc.mu.Unlock()
-
-			cc.wmu.Lock()
-			cc.fr.WriteWindowUpdate(0, uint32(f.Length))
-			cc.bw.Flush()
-			cc.wmu.Unlock()
+			if !ok {
+				return ConnectionError(ErrCodeFlowControl)
+			}
+			if connAdd > 0 {
+				cc.wmu.Lock()
+				cc.fr.WriteWindowUpdate(0, uint32(connAdd))
+				cc.bw.Flush()
+				cc.wmu.Unlock()
+			}
 		}
 		return nil
 	}
@@ -2517,9 +2671,7 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 		}
 		// Check connection-level flow control.
 		cc.mu.Lock()
-		if cs.inflow.available() >= int32(f.Length) {
-			cs.inflow.take(int32(f.Length))
-		} else {
+		if !takeInflows(&cc.inflow, &cs.inflow, f.Length) {
 			cc.mu.Unlock()
 			return ConnectionError(ErrCodeFlowControl)
 		}
@@ -2541,19 +2693,20 @@ func (rl *clientConnReadLoop) processData(f *DataFrame) error {
 			}
 		}
 
-		if refund > 0 {
-			cc.inflow.add(int32(refund))
-			if !didReset {
-				cs.inflow.add(int32(refund))
-			}
+		sendConn := cc.inflow.add(refund)
+		var sendStream int32
+		if !didReset {
+			sendStream = cs.inflow.add(refund)
 		}
 		cc.mu.Unlock()
 
-		if refund > 0 {
+		if sendConn > 0 || sendStream > 0 {
 			cc.wmu.Lock()
-			cc.fr.WriteWindowUpdate(0, uint32(refund))
-			if !didReset {
-				cc.fr.WriteWindowUpdate(cs.ID, uint32(refund))
+			if sendConn > 0 {
+				cc.fr.WriteWindowUpdate(0, uint32(sendConn))
+			}
+			if sendStream > 0 {
+				cc.fr.WriteWindowUpdate(cs.ID, uint32(sendStream))
 			}
 			cc.bw.Flush()
 			cc.wmu.Unlock()
@@ -2621,7 +2774,6 @@ func (rl *clientConnReadLoop) processGoAway(f *GoAwayFrame) error {
 		if fn := cc.t.CountError; fn != nil {
 			fn("recv_goaway_" + f.ErrCode.stringToken())
 		}
-
 	}
 	cc.setGoAway(f)
 	return nil
@@ -2686,8 +2838,10 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
 			cc.cond.Broadcast()
 
 			cc.initialWindowSize = s.Val
+		case SettingHeaderTableSize:
+			cc.henc.SetMaxDynamicTableSize(s.Val)
+			cc.peerMaxHeaderTableSize = s.Val
 		default:
-			// TODO(bradfitz): handle more settings? SETTINGS_HEADER_TABLE_SIZE probably.
 			cc.vlogf("Unhandled Setting: %v", s)
 		}
 		return nil
@@ -2861,7 +3015,12 @@ func (t *Transport) logf(format string, args ...interface{}) {
 	log.Printf(format, args...)
 }
 
-var noBody io.ReadCloser = ioutil.NopCloser(bytes.NewReader(nil))
+var noBody io.ReadCloser = noBodyReader{}
+
+type noBodyReader struct{}
+
+func (noBodyReader) Close() error             { return nil }
+func (noBodyReader) Read([]byte) (int, error) { return 0, io.EOF }
 
 type missingBody struct{}
 
@@ -2906,7 +3065,11 @@ func (gz *gzipReader) Read(p []byte) (n int, err error) {
 }
 
 func (gz *gzipReader) Close() error {
-	return gz.body.Close()
+	if err := gz.body.Close(); err != nil {
+		return err
+	}
+	gz.zerr = fs.ErrClosed
+	return nil
 }
 
 type errorReader struct{ err error }
@@ -2970,7 +3133,7 @@ func traceGotConn(req *http.Request, cc *ClientConn, reused bool) {
 	cc.mu.Lock()
 	ci.WasIdle = len(cc.streams) == 0 && reused
 	if ci.WasIdle && !cc.lastActive.IsZero() {
-		ci.IdleTime = time.Now().Sub(cc.lastActive)
+		ci.IdleTime = time.Since(cc.lastActive)
 	}
 	cc.mu.Unlock()
 
diff --git a/vendor/golang.org/x/net/http2/writesched.go b/vendor/golang.org/x/net/http2/writesched.go
index f24d2b1e7d..c7cd001739 100644
--- a/vendor/golang.org/x/net/http2/writesched.go
+++ b/vendor/golang.org/x/net/http2/writesched.go
@@ -32,7 +32,8 @@ type WriteScheduler interface {
 
 	// Pop dequeues the next frame to write. Returns false if no frames can
 	// be written. Frames with a given wr.StreamID() are Pop'd in the same
-	// order they are Push'd. No frames should be discarded except by CloseStream.
+	// order they are Push'd, except RST_STREAM frames. No frames should be
+	// discarded except by CloseStream.
 	Pop() (wr FrameWriteRequest, ok bool)
 }
 
@@ -52,6 +53,7 @@ type FrameWriteRequest struct {
 
 	// stream is the stream on which this frame will be written.
 	// nil for non-stream frames like PING and SETTINGS.
+	// nil for RST_STREAM streams, which use the StreamError.StreamID field instead.
 	stream *stream
 
 	// done, if non-nil, must be a buffered channel with space for
diff --git a/vendor/golang.org/x/net/http2/writesched_priority.go b/vendor/golang.org/x/net/http2/writesched_priority.go
index 2618b2c11d..0a242c669e 100644
--- a/vendor/golang.org/x/net/http2/writesched_priority.go
+++ b/vendor/golang.org/x/net/http2/writesched_priority.go
@@ -383,16 +383,15 @@ func (ws *priorityWriteScheduler) AdjustStream(streamID uint32, priority Priorit
 
 func (ws *priorityWriteScheduler) Push(wr FrameWriteRequest) {
 	var n *priorityNode
-	if id := wr.StreamID(); id == 0 {
+	if wr.isControl() {
 		n = &ws.root
 	} else {
+		id := wr.StreamID()
 		n = ws.nodes[id]
 		if n == nil {
 			// id is an idle or closed stream. wr should not be a HEADERS or
-			// DATA frame. However, wr can be a RST_STREAM. In this case, we
-			// push wr onto the root, rather than creating a new priorityNode,
-			// since RST_STREAM is tiny and the stream's priority is unknown
-			// anyway. See issue #17919.
+			// DATA frame. In other case, we push wr onto the root, rather
+			// than creating a new priorityNode.
 			if wr.DataSize() > 0 {
 				panic("add DATA on non-open stream")
 			}
diff --git a/vendor/golang.org/x/net/http2/writesched_random.go b/vendor/golang.org/x/net/http2/writesched_random.go
index 9a7b9e581c..f2e55e05ce 100644
--- a/vendor/golang.org/x/net/http2/writesched_random.go
+++ b/vendor/golang.org/x/net/http2/writesched_random.go
@@ -45,11 +45,11 @@ func (ws *randomWriteScheduler) AdjustStream(streamID uint32, priority PriorityP
 }
 
 func (ws *randomWriteScheduler) Push(wr FrameWriteRequest) {
-	id := wr.StreamID()
-	if id == 0 {
+	if wr.isControl() {
 		ws.zero.push(wr)
 		return
 	}
+	id := wr.StreamID()
 	q, ok := ws.sq[id]
 	if !ok {
 		q = ws.queuePool.get()
@@ -59,7 +59,7 @@ func (ws *randomWriteScheduler) Push(wr FrameWriteRequest) {
 }
 
 func (ws *randomWriteScheduler) Pop() (FrameWriteRequest, bool) {
-	// Control frames first.
+	// Control and RST_STREAM frames first.
 	if !ws.zero.empty() {
 		return ws.zero.shift(), true
 	}
diff --git a/vendor/golang.org/x/net/idna/trieval.go b/vendor/golang.org/x/net/idna/trieval.go
index 7a8cf889b5..9c070a44b3 100644
--- a/vendor/golang.org/x/net/idna/trieval.go
+++ b/vendor/golang.org/x/net/idna/trieval.go
@@ -17,23 +17,23 @@ package idna
 //
 // The per-rune values have the following format:
 //
-//   if mapped {
-//     if inlinedXOR {
-//       15..13 inline XOR marker
-//       12..11 unused
-//       10..3  inline XOR mask
-//     } else {
-//       15..3  index into xor or mapping table
-//     }
-//   } else {
-//       15..14 unused
-//       13     mayNeedNorm
-//       12..11 attributes
-//       10..8  joining type
-//        7..3  category type
-//   }
-//      2  use xor pattern
-//   1..0  mapped category
+//	if mapped {
+//	  if inlinedXOR {
+//	    15..13 inline XOR marker
+//	    12..11 unused
+//	    10..3  inline XOR mask
+//	  } else {
+//	    15..3  index into xor or mapping table
+//	  }
+//	} else {
+//	    15..14 unused
+//	    13     mayNeedNorm
+//	    12..11 attributes
+//	    10..8  joining type
+//	     7..3  category type
+//	}
+//	   2  use xor pattern
+//	1..0  mapped category
 //
 // See the definitions below for a more detailed description of the various
 // bits.
diff --git a/vendor/golang.org/x/net/internal/socket/cmsghdr_linux_64bit.go b/vendor/golang.org/x/net/internal/socket/cmsghdr_linux_64bit.go
index 1ba43101fc..f6877f98fd 100644
--- a/vendor/golang.org/x/net/internal/socket/cmsghdr_linux_64bit.go
+++ b/vendor/golang.org/x/net/internal/socket/cmsghdr_linux_64bit.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (arm64 || amd64 || ppc64 || ppc64le || mips64 || mips64le || riscv64 || s390x) && linux
-// +build arm64 amd64 ppc64 ppc64le mips64 mips64le riscv64 s390x
+//go:build (arm64 || amd64 || loong64 || ppc64 || ppc64le || mips64 || mips64le || riscv64 || s390x) && linux
+// +build arm64 amd64 loong64 ppc64 ppc64le mips64 mips64le riscv64 s390x
 // +build linux
 
 package socket
diff --git a/vendor/golang.org/x/net/internal/socket/cmsghdr_unix.go b/vendor/golang.org/x/net/internal/socket/cmsghdr_unix.go
index aa1b06203c..19d46789de 100644
--- a/vendor/golang.org/x/net/internal/socket/cmsghdr_unix.go
+++ b/vendor/golang.org/x/net/internal/socket/cmsghdr_unix.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris zos
 
 package socket
 
diff --git a/vendor/golang.org/x/net/internal/socket/cmsghdr_zos_s390x.go b/vendor/golang.org/x/net/internal/socket/cmsghdr_zos_s390x.go
index 98be146bc5..68dc8ad638 100644
--- a/vendor/golang.org/x/net/internal/socket/cmsghdr_zos_s390x.go
+++ b/vendor/golang.org/x/net/internal/socket/cmsghdr_zos_s390x.go
@@ -4,22 +4,8 @@
 
 package socket
 
-import "syscall"
-
 func (h *cmsghdr) set(l, lvl, typ int) {
 	h.Len = int32(l)
 	h.Level = int32(lvl)
 	h.Type = int32(typ)
 }
-
-func controlHeaderLen() int {
-	return syscall.CmsgLen(0)
-}
-
-func controlMessageLen(dataLen int) int {
-	return syscall.CmsgLen(dataLen)
-}
-
-func controlMessageSpace(dataLen int) int {
-	return syscall.CmsgSpace(dataLen)
-}
diff --git a/vendor/golang.org/x/net/internal/socket/iovec_64bit.go b/vendor/golang.org/x/net/internal/socket/iovec_64bit.go
index 3dc5def2bc..2e94e96f8b 100644
--- a/vendor/golang.org/x/net/internal/socket/iovec_64bit.go
+++ b/vendor/golang.org/x/net/internal/socket/iovec_64bit.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (arm64 || amd64 || ppc64 || ppc64le || mips64 || mips64le || riscv64 || s390x) && (aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || zos)
-// +build arm64 amd64 ppc64 ppc64le mips64 mips64le riscv64 s390x
+//go:build (arm64 || amd64 || loong64 || ppc64 || ppc64le || mips64 || mips64le || riscv64 || s390x) && (aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || zos)
+// +build arm64 amd64 loong64 ppc64 ppc64le mips64 mips64le riscv64 s390x
 // +build aix darwin dragonfly freebsd linux netbsd openbsd zos
 
 package socket
diff --git a/vendor/golang.org/x/net/internal/socket/mmsghdr_unix.go b/vendor/golang.org/x/net/internal/socket/mmsghdr_unix.go
index 40ebedab3c..41883c530c 100644
--- a/vendor/golang.org/x/net/internal/socket/mmsghdr_unix.go
+++ b/vendor/golang.org/x/net/internal/socket/mmsghdr_unix.go
@@ -9,7 +9,9 @@ package socket
 
 import (
 	"net"
+	"os"
 	"sync"
+	"syscall"
 )
 
 type mmsghdrs []mmsghdr
@@ -93,22 +95,102 @@ func (p *mmsghdrsPacker) pack(ms []Message, parseFn func([]byte, string) (net.Ad
 	return hs
 }
 
-var defaultMmsghdrsPool = mmsghdrsPool{
+// syscaller is a helper to invoke recvmmsg and sendmmsg via the RawConn.Read/Write interface.
+// It is reusable, to amortize the overhead of allocating a closure for the function passed to
+// RawConn.Read/Write.
+type syscaller struct {
+	n     int
+	operr error
+	hs    mmsghdrs
+	flags int
+
+	boundRecvmmsgF func(uintptr) bool
+	boundSendmmsgF func(uintptr) bool
+}
+
+func (r *syscaller) init() {
+	r.boundRecvmmsgF = r.recvmmsgF
+	r.boundSendmmsgF = r.sendmmsgF
+}
+
+func (r *syscaller) recvmmsg(c syscall.RawConn, hs mmsghdrs, flags int) (int, error) {
+	r.n = 0
+	r.operr = nil
+	r.hs = hs
+	r.flags = flags
+	if err := c.Read(r.boundRecvmmsgF); err != nil {
+		return r.n, err
+	}
+	if r.operr != nil {
+		return r.n, os.NewSyscallError("recvmmsg", r.operr)
+	}
+	return r.n, nil
+}
+
+func (r *syscaller) recvmmsgF(s uintptr) bool {
+	r.n, r.operr = recvmmsg(s, r.hs, r.flags)
+	return ioComplete(r.flags, r.operr)
+}
+
+func (r *syscaller) sendmmsg(c syscall.RawConn, hs mmsghdrs, flags int) (int, error) {
+	r.n = 0
+	r.operr = nil
+	r.hs = hs
+	r.flags = flags
+	if err := c.Write(r.boundSendmmsgF); err != nil {
+		return r.n, err
+	}
+	if r.operr != nil {
+		return r.n, os.NewSyscallError("sendmmsg", r.operr)
+	}
+	return r.n, nil
+}
+
+func (r *syscaller) sendmmsgF(s uintptr) bool {
+	r.n, r.operr = sendmmsg(s, r.hs, r.flags)
+	return ioComplete(r.flags, r.operr)
+}
+
+// mmsgTmps holds reusable temporary helpers for recvmmsg and sendmmsg.
+type mmsgTmps struct {
+	packer    mmsghdrsPacker
+	syscaller syscaller
+}
+
+var defaultMmsgTmpsPool = mmsgTmpsPool{
 	p: sync.Pool{
 		New: func() interface{} {
-			return new(mmsghdrsPacker)
+			tmps := new(mmsgTmps)
+			tmps.syscaller.init()
+			return tmps
 		},
 	},
 }
 
-type mmsghdrsPool struct {
+type mmsgTmpsPool struct {
 	p sync.Pool
 }
 
-func (p *mmsghdrsPool) Get() *mmsghdrsPacker {
-	return p.p.Get().(*mmsghdrsPacker)
+func (p *mmsgTmpsPool) Get() *mmsgTmps {
+	m := p.p.Get().(*mmsgTmps)
+	// Clear fields up to the len (not the cap) of the slice,
+	// assuming that the previous caller only used that many elements.
+	for i := range m.packer.sockaddrs {
+		m.packer.sockaddrs[i] = 0
+	}
+	m.packer.sockaddrs = m.packer.sockaddrs[:0]
+	for i := range m.packer.vs {
+		m.packer.vs[i] = iovec{}
+	}
+	m.packer.vs = m.packer.vs[:0]
+	for i := range m.packer.hs {
+		m.packer.hs[i].Len = 0
+		m.packer.hs[i].Hdr = msghdr{}
+	}
+	m.packer.hs = m.packer.hs[:0]
+	return m
 }
 
-func (p *mmsghdrsPool) Put(packer *mmsghdrsPacker) {
-	p.p.Put(packer)
+func (p *mmsgTmpsPool) Put(tmps *mmsgTmps) {
+	p.p.Put(tmps)
 }
diff --git a/vendor/golang.org/x/net/internal/socket/msghdr_linux.go b/vendor/golang.org/x/net/internal/socket/msghdr_linux.go
index c3c7cc4c83..5a38798cc0 100644
--- a/vendor/golang.org/x/net/internal/socket/msghdr_linux.go
+++ b/vendor/golang.org/x/net/internal/socket/msghdr_linux.go
@@ -17,9 +17,6 @@ func (h *msghdr) pack(vs []iovec, bs [][]byte, oob []byte, sa []byte) {
 	if sa != nil {
 		h.Name = (*byte)(unsafe.Pointer(&sa[0]))
 		h.Namelen = uint32(len(sa))
-	} else {
-		h.Name = nil
-		h.Namelen = 0
 	}
 }
 
diff --git a/vendor/golang.org/x/net/internal/socket/msghdr_linux_64bit.go b/vendor/golang.org/x/net/internal/socket/msghdr_linux_64bit.go
index c9c592ddb8..42411affad 100644
--- a/vendor/golang.org/x/net/internal/socket/msghdr_linux_64bit.go
+++ b/vendor/golang.org/x/net/internal/socket/msghdr_linux_64bit.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (arm64 || amd64 || ppc64 || ppc64le || mips64 || mips64le || riscv64 || s390x) && linux
-// +build arm64 amd64 ppc64 ppc64le mips64 mips64le riscv64 s390x
+//go:build (arm64 || amd64 || loong64 || ppc64 || ppc64le || mips64 || mips64le || riscv64 || s390x) && linux
+// +build arm64 amd64 loong64 ppc64 ppc64le mips64 mips64le riscv64 s390x
 // +build linux
 
 package socket
diff --git a/vendor/golang.org/x/net/internal/socket/rawconn_mmsg.go b/vendor/golang.org/x/net/internal/socket/rawconn_mmsg.go
index 3fcb51b384..8f79b38f74 100644
--- a/vendor/golang.org/x/net/internal/socket/rawconn_mmsg.go
+++ b/vendor/golang.org/x/net/internal/socket/rawconn_mmsg.go
@@ -9,32 +9,23 @@ package socket
 
 import (
 	"net"
-	"os"
 )
 
 func (c *Conn) recvMsgs(ms []Message, flags int) (int, error) {
 	for i := range ms {
 		ms[i].raceWrite()
 	}
-	packer := defaultMmsghdrsPool.Get()
-	defer defaultMmsghdrsPool.Put(packer)
+	tmps := defaultMmsgTmpsPool.Get()
+	defer defaultMmsgTmpsPool.Put(tmps)
 	var parseFn func([]byte, string) (net.Addr, error)
 	if c.network != "tcp" {
 		parseFn = parseInetAddr
 	}
-	hs := packer.pack(ms, parseFn, nil)
-	var operr error
-	var n int
-	fn := func(s uintptr) bool {
-		n, operr = recvmmsg(s, hs, flags)
-		return ioComplete(flags, operr)
-	}
-	if err := c.c.Read(fn); err != nil {
+	hs := tmps.packer.pack(ms, parseFn, nil)
+	n, err := tmps.syscaller.recvmmsg(c.c, hs, flags)
+	if err != nil {
 		return n, err
 	}
-	if operr != nil {
-		return n, os.NewSyscallError("recvmmsg", operr)
-	}
 	if err := hs[:n].unpack(ms[:n], parseFn, c.network); err != nil {
 		return n, err
 	}
@@ -45,25 +36,17 @@ func (c *Conn) sendMsgs(ms []Message, flags int) (int, error) {
 	for i := range ms {
 		ms[i].raceRead()
 	}
-	packer := defaultMmsghdrsPool.Get()
-	defer defaultMmsghdrsPool.Put(packer)
+	tmps := defaultMmsgTmpsPool.Get()
+	defer defaultMmsgTmpsPool.Put(tmps)
 	var marshalFn func(net.Addr, []byte) int
 	if c.network != "tcp" {
 		marshalFn = marshalInetAddr
 	}
-	hs := packer.pack(ms, nil, marshalFn)
-	var operr error
-	var n int
-	fn := func(s uintptr) bool {
-		n, operr = sendmmsg(s, hs, flags)
-		return ioComplete(flags, operr)
-	}
-	if err := c.c.Write(fn); err != nil {
+	hs := tmps.packer.pack(ms, nil, marshalFn)
+	n, err := tmps.syscaller.sendmmsg(c.c, hs, flags)
+	if err != nil {
 		return n, err
 	}
-	if operr != nil {
-		return n, os.NewSyscallError("sendmmsg", operr)
-	}
 	if err := hs[:n].unpack(ms[:n], nil, ""); err != nil {
 		return n, err
 	}
diff --git a/vendor/golang.org/x/net/internal/socket/rawconn_msg.go b/vendor/golang.org/x/net/internal/socket/rawconn_msg.go
index ba53f564bb..f7d0b0d2b8 100644
--- a/vendor/golang.org/x/net/internal/socket/rawconn_msg.go
+++ b/vendor/golang.org/x/net/internal/socket/rawconn_msg.go
@@ -8,22 +8,21 @@
 package socket
 
 import (
+	"net"
 	"os"
 )
 
 func (c *Conn) recvMsg(m *Message, flags int) error {
 	m.raceWrite()
-	var h msghdr
-	vs := make([]iovec, len(m.Buffers))
-	var sa []byte
-	if c.network != "tcp" {
-		sa = make([]byte, sizeofSockaddrInet6)
-	}
-	h.pack(vs, m.Buffers, m.OOB, sa)
-	var operr error
-	var n int
+	var (
+		operr     error
+		n         int
+		oobn      int
+		recvflags int
+		from      net.Addr
+	)
 	fn := func(s uintptr) bool {
-		n, operr = recvmsg(s, &h, flags)
+		n, oobn, recvflags, from, operr = recvmsg(s, m.Buffers, m.OOB, flags, c.network)
 		return ioComplete(flags, operr)
 	}
 	if err := c.c.Read(fn); err != nil {
@@ -32,34 +31,21 @@ func (c *Conn) recvMsg(m *Message, flags int) error {
 	if operr != nil {
 		return os.NewSyscallError("recvmsg", operr)
 	}
-	if c.network != "tcp" {
-		var err error
-		m.Addr, err = parseInetAddr(sa[:], c.network)
-		if err != nil {
-			return err
-		}
-	}
+	m.Addr = from
 	m.N = n
-	m.NN = h.controllen()
-	m.Flags = h.flags()
+	m.NN = oobn
+	m.Flags = recvflags
 	return nil
 }
 
 func (c *Conn) sendMsg(m *Message, flags int) error {
 	m.raceRead()
-	var h msghdr
-	vs := make([]iovec, len(m.Buffers))
-	var sa []byte
-	if m.Addr != nil {
-		var a [sizeofSockaddrInet6]byte
-		n := marshalInetAddr(m.Addr, a[:])
-		sa = a[:n]
-	}
-	h.pack(vs, m.Buffers, m.OOB, sa)
-	var operr error
-	var n int
+	var (
+		operr error
+		n     int
+	)
 	fn := func(s uintptr) bool {
-		n, operr = sendmsg(s, &h, flags)
+		n, operr = sendmsg(s, m.Buffers, m.OOB, m.Addr, flags)
 		return ioComplete(flags, operr)
 	}
 	if err := c.c.Write(fn); err != nil {
diff --git a/vendor/golang.org/x/net/internal/socket/sys_bsd.go b/vendor/golang.org/x/net/internal/socket/sys_bsd.go
index b6cd77088d..b258879d44 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_bsd.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_bsd.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build aix || darwin || dragonfly || freebsd || openbsd
-// +build aix darwin dragonfly freebsd openbsd
+//go:build aix || darwin || dragonfly || freebsd || openbsd || solaris
+// +build aix darwin dragonfly freebsd openbsd solaris
 
 package socket
 
diff --git a/vendor/golang.org/x/net/internal/socket/sys_linkname.go b/vendor/golang.org/x/net/internal/socket/sys_linkname.go
deleted file mode 100644
index 21734af4b8..0000000000
--- a/vendor/golang.org/x/net/internal/socket/sys_linkname.go
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build aix || (go1.12 && darwin)
-// +build aix go1.12,darwin
-
-package socket
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-//go:linkname syscall_getsockopt syscall.getsockopt
-func syscall_getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *uint32) error
-
-func getsockopt(s uintptr, level, name int, b []byte) (int, error) {
-	l := uint32(len(b))
-	err := syscall_getsockopt(int(s), level, name, unsafe.Pointer(&b[0]), &l)
-	return int(l), err
-}
-
-//go:linkname syscall_setsockopt syscall.setsockopt
-func syscall_setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) error
-
-func setsockopt(s uintptr, level, name int, b []byte) error {
-	return syscall_setsockopt(int(s), level, name, unsafe.Pointer(&b[0]), uintptr(len(b)))
-}
-
-//go:linkname syscall_recvmsg syscall.recvmsg
-func syscall_recvmsg(s int, msg *syscall.Msghdr, flags int) (n int, err error)
-
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	return syscall_recvmsg(int(s), (*syscall.Msghdr)(unsafe.Pointer(h)), flags)
-}
-
-//go:linkname syscall_sendmsg syscall.sendmsg
-func syscall_sendmsg(s int, msg *syscall.Msghdr, flags int) (n int, err error)
-
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	return syscall_sendmsg(int(s), (*syscall.Msghdr)(unsafe.Pointer(h)), flags)
-}
diff --git a/vendor/golang.org/x/net/internal/socket/sys_linux_386.go b/vendor/golang.org/x/net/internal/socket/sys_linux_386.go
index 651215321b..c877ef23ae 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_linux_386.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_linux_386.go
@@ -10,38 +10,13 @@ import (
 )
 
 const (
-	sysSETSOCKOPT = 0xe
-	sysGETSOCKOPT = 0xf
-	sysSENDMSG    = 0x10
-	sysRECVMSG    = 0x11
-	sysRECVMMSG   = 0x13
-	sysSENDMMSG   = 0x14
+	sysRECVMMSG = 0x13
+	sysSENDMMSG = 0x14
 )
 
 func socketcall(call, a0, a1, a2, a3, a4, a5 uintptr) (uintptr, syscall.Errno)
 func rawsocketcall(call, a0, a1, a2, a3, a4, a5 uintptr) (uintptr, syscall.Errno)
 
-func getsockopt(s uintptr, level, name int, b []byte) (int, error) {
-	l := uint32(len(b))
-	_, errno := socketcall(sysGETSOCKOPT, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(unsafe.Pointer(&l)), 0)
-	return int(l), errnoErr(errno)
-}
-
-func setsockopt(s uintptr, level, name int, b []byte) error {
-	_, errno := socketcall(sysSETSOCKOPT, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)), 0)
-	return errnoErr(errno)
-}
-
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, errno := socketcall(sysRECVMSG, s, uintptr(unsafe.Pointer(h)), uintptr(flags), 0, 0, 0)
-	return int(n), errnoErr(errno)
-}
-
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, errno := socketcall(sysSENDMSG, s, uintptr(unsafe.Pointer(h)), uintptr(flags), 0, 0, 0)
-	return int(n), errnoErr(errno)
-}
-
 func recvmmsg(s uintptr, hs []mmsghdr, flags int) (int, error) {
 	n, errno := socketcall(sysRECVMMSG, s, uintptr(unsafe.Pointer(&hs[0])), uintptr(len(hs)), uintptr(flags), 0, 0)
 	return int(n), errnoErr(errno)
diff --git a/vendor/golang.org/x/net/internal/socket/sys_linux_loong64.go b/vendor/golang.org/x/net/internal/socket/sys_linux_loong64.go
new file mode 100644
index 0000000000..af964e6171
--- /dev/null
+++ b/vendor/golang.org/x/net/internal/socket/sys_linux_loong64.go
@@ -0,0 +1,13 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build loong64
+// +build loong64
+
+package socket
+
+const (
+	sysRECVMMSG = 0xf3
+	sysSENDMMSG = 0x10d
+)
diff --git a/vendor/golang.org/x/net/internal/socket/sys_linux_s390x.go b/vendor/golang.org/x/net/internal/socket/sys_linux_s390x.go
index 651215321b..c877ef23ae 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_linux_s390x.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_linux_s390x.go
@@ -10,38 +10,13 @@ import (
 )
 
 const (
-	sysSETSOCKOPT = 0xe
-	sysGETSOCKOPT = 0xf
-	sysSENDMSG    = 0x10
-	sysRECVMSG    = 0x11
-	sysRECVMMSG   = 0x13
-	sysSENDMMSG   = 0x14
+	sysRECVMMSG = 0x13
+	sysSENDMMSG = 0x14
 )
 
 func socketcall(call, a0, a1, a2, a3, a4, a5 uintptr) (uintptr, syscall.Errno)
 func rawsocketcall(call, a0, a1, a2, a3, a4, a5 uintptr) (uintptr, syscall.Errno)
 
-func getsockopt(s uintptr, level, name int, b []byte) (int, error) {
-	l := uint32(len(b))
-	_, errno := socketcall(sysGETSOCKOPT, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(unsafe.Pointer(&l)), 0)
-	return int(l), errnoErr(errno)
-}
-
-func setsockopt(s uintptr, level, name int, b []byte) error {
-	_, errno := socketcall(sysSETSOCKOPT, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)), 0)
-	return errnoErr(errno)
-}
-
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, errno := socketcall(sysRECVMSG, s, uintptr(unsafe.Pointer(h)), uintptr(flags), 0, 0, 0)
-	return int(n), errnoErr(errno)
-}
-
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, errno := socketcall(sysSENDMSG, s, uintptr(unsafe.Pointer(h)), uintptr(flags), 0, 0, 0)
-	return int(n), errnoErr(errno)
-}
-
 func recvmmsg(s uintptr, hs []mmsghdr, flags int) (int, error) {
 	n, errno := socketcall(sysRECVMMSG, s, uintptr(unsafe.Pointer(&hs[0])), uintptr(len(hs)), uintptr(flags), 0, 0)
 	return int(n), errnoErr(errno)
diff --git a/vendor/golang.org/x/net/internal/socket/sys_solaris.go b/vendor/golang.org/x/net/internal/socket/sys_solaris.go
deleted file mode 100644
index e79ca95183..0000000000
--- a/vendor/golang.org/x/net/internal/socket/sys_solaris.go
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package socket
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-//go:cgo_import_dynamic libc___xnet_getsockopt __xnet_getsockopt "libsocket.so"
-//go:cgo_import_dynamic libc_setsockopt setsockopt "libsocket.so"
-//go:cgo_import_dynamic libc___xnet_recvmsg __xnet_recvmsg "libsocket.so"
-//go:cgo_import_dynamic libc___xnet_sendmsg __xnet_sendmsg "libsocket.so"
-
-//go:linkname procGetsockopt libc___xnet_getsockopt
-//go:linkname procSetsockopt libc_setsockopt
-//go:linkname procRecvmsg libc___xnet_recvmsg
-//go:linkname procSendmsg libc___xnet_sendmsg
-
-var (
-	procGetsockopt uintptr
-	procSetsockopt uintptr
-	procRecvmsg    uintptr
-	procSendmsg    uintptr
-)
-
-func sysvicall6(trap, nargs, a1, a2, a3, a4, a5, a6 uintptr) (uintptr, uintptr, syscall.Errno)
-func rawSysvicall6(trap, nargs, a1, a2, a3, a4, a5, a6 uintptr) (uintptr, uintptr, syscall.Errno)
-
-func getsockopt(s uintptr, level, name int, b []byte) (int, error) {
-	l := uint32(len(b))
-	_, _, errno := sysvicall6(uintptr(unsafe.Pointer(&procGetsockopt)), 5, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(unsafe.Pointer(&l)), 0)
-	return int(l), errnoErr(errno)
-}
-
-func setsockopt(s uintptr, level, name int, b []byte) error {
-	_, _, errno := sysvicall6(uintptr(unsafe.Pointer(&procSetsockopt)), 5, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)), 0)
-	return errnoErr(errno)
-}
-
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, _, errno := sysvicall6(uintptr(unsafe.Pointer(&procRecvmsg)), 3, s, uintptr(unsafe.Pointer(h)), uintptr(flags), 0, 0, 0)
-	return int(n), errnoErr(errno)
-}
-
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, _, errno := sysvicall6(uintptr(unsafe.Pointer(&procSendmsg)), 3, s, uintptr(unsafe.Pointer(h)), uintptr(flags), 0, 0, 0)
-	return int(n), errnoErr(errno)
-}
-
-func recvmmsg(s uintptr, hs []mmsghdr, flags int) (int, error) {
-	return 0, errNotImplemented
-}
-
-func sendmmsg(s uintptr, hs []mmsghdr, flags int) (int, error) {
-	return 0, errNotImplemented
-}
diff --git a/vendor/golang.org/x/net/internal/socket/sys_solaris_amd64.s b/vendor/golang.org/x/net/internal/socket/sys_solaris_amd64.s
deleted file mode 100644
index a18ac5ed75..0000000000
--- a/vendor/golang.org/x/net/internal/socket/sys_solaris_amd64.s
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright 2016 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-#include "textflag.h"
-
-TEXT	·sysvicall6(SB),NOSPLIT,$0-88
-	JMP	syscall·sysvicall6(SB)
-
-TEXT	·rawSysvicall6(SB),NOSPLIT,$0-88
-	JMP	syscall·rawSysvicall6(SB)
diff --git a/vendor/golang.org/x/net/internal/socket/sys_stub.go b/vendor/golang.org/x/net/internal/socket/sys_stub.go
index 381e45e167..7cfb349c0c 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_stub.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_stub.go
@@ -36,11 +36,11 @@ func setsockopt(s uintptr, level, name int, b []byte) error {
 	return errNotImplemented
 }
 
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	return 0, errNotImplemented
+func recvmsg(s uintptr, buffers [][]byte, oob []byte, flags int, network string) (n, oobn int, recvflags int, from net.Addr, err error) {
+	return 0, 0, 0, nil, errNotImplemented
 }
 
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
+func sendmsg(s uintptr, buffers [][]byte, oob []byte, to net.Addr, flags int) (int, error) {
 	return 0, errNotImplemented
 }
 
diff --git a/vendor/golang.org/x/net/internal/socket/sys_unix.go b/vendor/golang.org/x/net/internal/socket/sys_unix.go
index c98ebae548..de823932b9 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_unix.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_unix.go
@@ -2,33 +2,121 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build dragonfly || freebsd || (linux && !s390x && !386) || netbsd || openbsd
-// +build dragonfly freebsd linux,!s390x,!386 netbsd openbsd
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
 
 package socket
 
 import (
-	"syscall"
+	"net"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
+//go:linkname syscall_getsockopt syscall.getsockopt
+func syscall_getsockopt(s, level, name int, val unsafe.Pointer, vallen *uint32) error
+
+//go:linkname syscall_setsockopt syscall.setsockopt
+func syscall_setsockopt(s, level, name int, val unsafe.Pointer, vallen uintptr) error
+
 func getsockopt(s uintptr, level, name int, b []byte) (int, error) {
 	l := uint32(len(b))
-	_, _, errno := syscall.Syscall6(syscall.SYS_GETSOCKOPT, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(unsafe.Pointer(&l)), 0)
-	return int(l), errnoErr(errno)
+	err := syscall_getsockopt(int(s), level, name, unsafe.Pointer(&b[0]), &l)
+	return int(l), err
 }
 
 func setsockopt(s uintptr, level, name int, b []byte) error {
-	_, _, errno := syscall.Syscall6(syscall.SYS_SETSOCKOPT, s, uintptr(level), uintptr(name), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)), 0)
-	return errnoErr(errno)
+	return syscall_setsockopt(int(s), level, name, unsafe.Pointer(&b[0]), uintptr(len(b)))
 }
 
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, _, errno := syscall.Syscall(syscall.SYS_RECVMSG, s, uintptr(unsafe.Pointer(h)), uintptr(flags))
-	return int(n), errnoErr(errno)
+func recvmsg(s uintptr, buffers [][]byte, oob []byte, flags int, network string) (n, oobn int, recvflags int, from net.Addr, err error) {
+	var unixFrom unix.Sockaddr
+	n, oobn, recvflags, unixFrom, err = unix.RecvmsgBuffers(int(s), buffers, oob, flags)
+	if unixFrom != nil {
+		from = sockaddrToAddr(unixFrom, network)
+	}
+	return
 }
 
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, _, errno := syscall.Syscall(syscall.SYS_SENDMSG, s, uintptr(unsafe.Pointer(h)), uintptr(flags))
-	return int(n), errnoErr(errno)
+func sendmsg(s uintptr, buffers [][]byte, oob []byte, to net.Addr, flags int) (int, error) {
+	var unixTo unix.Sockaddr
+	if to != nil {
+		unixTo = addrToSockaddr(to)
+	}
+	return unix.SendmsgBuffers(int(s), buffers, oob, unixTo, flags)
+}
+
+// addrToSockaddr converts a net.Addr to a unix.Sockaddr.
+func addrToSockaddr(a net.Addr) unix.Sockaddr {
+	var (
+		ip   net.IP
+		port int
+		zone string
+	)
+	switch a := a.(type) {
+	case *net.TCPAddr:
+		ip = a.IP
+		port = a.Port
+		zone = a.Zone
+	case *net.UDPAddr:
+		ip = a.IP
+		port = a.Port
+		zone = a.Zone
+	case *net.IPAddr:
+		ip = a.IP
+		zone = a.Zone
+	default:
+		return nil
+	}
+
+	if ip4 := ip.To4(); ip4 != nil {
+		sa := unix.SockaddrInet4{Port: port}
+		copy(sa.Addr[:], ip4)
+		return &sa
+	}
+
+	if ip6 := ip.To16(); ip6 != nil && ip.To4() == nil {
+		sa := unix.SockaddrInet6{Port: port}
+		copy(sa.Addr[:], ip6)
+		if zone != "" {
+			sa.ZoneId = uint32(zoneCache.index(zone))
+		}
+		return &sa
+	}
+
+	return nil
+}
+
+// sockaddrToAddr converts a unix.Sockaddr to a net.Addr.
+func sockaddrToAddr(sa unix.Sockaddr, network string) net.Addr {
+	var (
+		ip   net.IP
+		port int
+		zone string
+	)
+	switch sa := sa.(type) {
+	case *unix.SockaddrInet4:
+		ip = make(net.IP, net.IPv4len)
+		copy(ip, sa.Addr[:])
+		port = sa.Port
+	case *unix.SockaddrInet6:
+		ip = make(net.IP, net.IPv6len)
+		copy(ip, sa.Addr[:])
+		port = sa.Port
+		if sa.ZoneId > 0 {
+			zone = zoneCache.name(int(sa.ZoneId))
+		}
+	default:
+		return nil
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		return &net.TCPAddr{IP: ip, Port: port, Zone: zone}
+	case "udp", "udp4", "udp6":
+		return &net.UDPAddr{IP: ip, Port: port, Zone: zone}
+	default:
+		return &net.IPAddr{IP: ip, Zone: zone}
+	}
 }
diff --git a/vendor/golang.org/x/net/internal/socket/sys_windows.go b/vendor/golang.org/x/net/internal/socket/sys_windows.go
index 2de0d68c61..b738b89ddd 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_windows.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_windows.go
@@ -5,6 +5,7 @@
 package socket
 
 import (
+	"net"
 	"syscall"
 	"unsafe"
 
@@ -37,11 +38,11 @@ func setsockopt(s uintptr, level, name int, b []byte) error {
 	return syscall.Setsockopt(syscall.Handle(s), int32(level), int32(name), (*byte)(unsafe.Pointer(&b[0])), int32(len(b)))
 }
 
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	return 0, errNotImplemented
+func recvmsg(s uintptr, buffers [][]byte, oob []byte, flags int, network string) (n, oobn int, recvflags int, from net.Addr, err error) {
+	return 0, 0, 0, nil, errNotImplemented
 }
 
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
+func sendmsg(s uintptr, buffers [][]byte, oob []byte, to net.Addr, flags int) (int, error) {
 	return 0, errNotImplemented
 }
 
diff --git a/vendor/golang.org/x/net/internal/socket/sys_zos_s390x.go b/vendor/golang.org/x/net/internal/socket/sys_zos_s390x.go
index 1e38b92232..eaa896cb57 100644
--- a/vendor/golang.org/x/net/internal/socket/sys_zos_s390x.go
+++ b/vendor/golang.org/x/net/internal/socket/sys_zos_s390x.go
@@ -5,6 +5,7 @@
 package socket
 
 import (
+	"net"
 	"syscall"
 	"unsafe"
 )
@@ -27,12 +28,39 @@ func setsockopt(s uintptr, level, name int, b []byte) error {
 	return errnoErr(errno)
 }
 
-func recvmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, _, errno := syscall_syscall(syscall.SYS___RECVMSG_A, s, uintptr(unsafe.Pointer(h)), uintptr(flags))
-	return int(n), errnoErr(errno)
+func recvmsg(s uintptr, buffers [][]byte, oob []byte, flags int, network string) (n, oobn int, recvflags int, from net.Addr, err error) {
+	var h msghdr
+	vs := make([]iovec, len(buffers))
+	var sa []byte
+	if network != "tcp" {
+		sa = make([]byte, sizeofSockaddrInet6)
+	}
+	h.pack(vs, buffers, oob, sa)
+	sn, _, errno := syscall_syscall(syscall.SYS___RECVMSG_A, s, uintptr(unsafe.Pointer(&h)), uintptr(flags))
+	n = int(sn)
+	oobn = h.controllen()
+	recvflags = h.flags()
+	err = errnoErr(errno)
+	if network != "tcp" {
+		var err2 error
+		from, err2 = parseInetAddr(sa, network)
+		if err2 != nil && err == nil {
+			err = err2
+		}
+	}
+	return
 }
 
-func sendmsg(s uintptr, h *msghdr, flags int) (int, error) {
-	n, _, errno := syscall_syscall(syscall.SYS___SENDMSG_A, s, uintptr(unsafe.Pointer(h)), uintptr(flags))
+func sendmsg(s uintptr, buffers [][]byte, oob []byte, to net.Addr, flags int) (int, error) {
+	var h msghdr
+	vs := make([]iovec, len(buffers))
+	var sa []byte
+	if to != nil {
+		var a [sizeofSockaddrInet6]byte
+		n := marshalInetAddr(to, a[:])
+		sa = a[:n]
+	}
+	h.pack(vs, buffers, oob, sa)
+	n, _, errno := syscall_syscall(syscall.SYS___SENDMSG_A, s, uintptr(unsafe.Pointer(&h)), uintptr(flags))
 	return int(n), errnoErr(errno)
 }
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_darwin_386.go b/vendor/golang.org/x/net/internal/socket/zsys_darwin_386.go
deleted file mode 100644
index 5acf6db6ea..0000000000
--- a/vendor/golang.org/x/net/internal/socket/zsys_darwin_386.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs defs_darwin.go
-
-package socket
-
-type iovec struct {
-	Base *byte
-	Len  uint32
-}
-
-type msghdr struct {
-	Name       *byte
-	Namelen    uint32
-	Iov        *iovec
-	Iovlen     int32
-	Control    *byte
-	Controllen uint32
-	Flags      int32
-}
-
-type cmsghdr struct {
-	Len   uint32
-	Level int32
-	Type  int32
-}
-
-const (
-	sizeofIovec  = 0x8
-	sizeofMsghdr = 0x1c
-)
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_darwin_arm.go b/vendor/golang.org/x/net/internal/socket/zsys_darwin_arm.go
deleted file mode 100644
index 5acf6db6ea..0000000000
--- a/vendor/golang.org/x/net/internal/socket/zsys_darwin_arm.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs defs_darwin.go
-
-package socket
-
-type iovec struct {
-	Base *byte
-	Len  uint32
-}
-
-type msghdr struct {
-	Name       *byte
-	Namelen    uint32
-	Iov        *iovec
-	Iovlen     int32
-	Control    *byte
-	Controllen uint32
-	Flags      int32
-}
-
-type cmsghdr struct {
-	Len   uint32
-	Level int32
-	Type  int32
-}
-
-const (
-	sizeofIovec  = 0x8
-	sizeofMsghdr = 0x1c
-)
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_freebsd_riscv64.go b/vendor/golang.org/x/net/internal/socket/zsys_freebsd_riscv64.go
new file mode 100644
index 0000000000..965c0b28b5
--- /dev/null
+++ b/vendor/golang.org/x/net/internal/socket/zsys_freebsd_riscv64.go
@@ -0,0 +1,30 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_freebsd.go
+
+package socket
+
+type iovec struct {
+	Base *byte
+	Len  uint64
+}
+
+type msghdr struct {
+	Name       *byte
+	Namelen    uint32
+	Iov        *iovec
+	Iovlen     int32
+	Control    *byte
+	Controllen uint32
+	Flags      int32
+}
+
+type cmsghdr struct {
+	Len   uint32
+	Level int32
+	Type  int32
+}
+
+const (
+	sizeofIovec  = 0x10
+	sizeofMsghdr = 0x30
+)
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_linux_loong64.go b/vendor/golang.org/x/net/internal/socket/zsys_linux_loong64.go
new file mode 100644
index 0000000000..6a94fec2c5
--- /dev/null
+++ b/vendor/golang.org/x/net/internal/socket/zsys_linux_loong64.go
@@ -0,0 +1,40 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_linux.go
+
+//go:build loong64
+// +build loong64
+
+package socket
+
+type iovec struct {
+	Base *byte
+	Len  uint64
+}
+
+type msghdr struct {
+	Name       *byte
+	Namelen    uint32
+	Iov        *iovec
+	Iovlen     uint64
+	Control    *byte
+	Controllen uint64
+	Flags      int32
+	Pad_cgo_0  [4]byte
+}
+
+type mmsghdr struct {
+	Hdr       msghdr
+	Len       uint32
+	Pad_cgo_0 [4]byte
+}
+
+type cmsghdr struct {
+	Len   uint64
+	Level int32
+	Type  int32
+}
+
+const (
+	sizeofIovec  = 0x10
+	sizeofMsghdr = 0x38
+)
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_linux_ppc.go b/vendor/golang.org/x/net/internal/socket/zsys_linux_ppc.go
index 59b71da571..4c19269bee 100644
--- a/vendor/golang.org/x/net/internal/socket/zsys_linux_ppc.go
+++ b/vendor/golang.org/x/net/internal/socket/zsys_linux_ppc.go
@@ -4,32 +4,32 @@
 package socket
 
 type iovec struct {
-	Base	*byte
-	Len	uint32
+	Base *byte
+	Len  uint32
 }
 
 type msghdr struct {
-	Name		*byte
-	Namelen		uint32
-	Iov		*iovec
-	Iovlen		uint32
-	Control		*byte
-	Controllen	uint32
-	Flags		int32
+	Name       *byte
+	Namelen    uint32
+	Iov        *iovec
+	Iovlen     uint32
+	Control    *byte
+	Controllen uint32
+	Flags      int32
 }
 
 type mmsghdr struct {
-	Hdr	msghdr
-	Len	uint32
+	Hdr msghdr
+	Len uint32
 }
 
 type cmsghdr struct {
-	Len	uint32
-	Level	int32
-	Type	int32
+	Len   uint32
+	Level int32
+	Type  int32
 }
 
 const (
-	sizeofIovec	= 0x8
-	sizeofMsghdr	= 0x1c
+	sizeofIovec  = 0x8
+	sizeofMsghdr = 0x1c
 )
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_openbsd_ppc64.go b/vendor/golang.org/x/net/internal/socket/zsys_openbsd_ppc64.go
new file mode 100644
index 0000000000..cebde7634f
--- /dev/null
+++ b/vendor/golang.org/x/net/internal/socket/zsys_openbsd_ppc64.go
@@ -0,0 +1,30 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_openbsd.go
+
+package socket
+
+type iovec struct {
+	Base	*byte
+	Len	uint64
+}
+
+type msghdr struct {
+	Name		*byte
+	Namelen		uint32
+	Iov		*iovec
+	Iovlen		uint32
+	Control		*byte
+	Controllen	uint32
+	Flags		int32
+}
+
+type cmsghdr struct {
+	Len	uint32
+	Level	int32
+	Type	int32
+}
+
+const (
+	sizeofIovec	= 0x10
+	sizeofMsghdr	= 0x30
+)
diff --git a/vendor/golang.org/x/net/internal/socket/zsys_openbsd_riscv64.go b/vendor/golang.org/x/net/internal/socket/zsys_openbsd_riscv64.go
new file mode 100644
index 0000000000..cebde7634f
--- /dev/null
+++ b/vendor/golang.org/x/net/internal/socket/zsys_openbsd_riscv64.go
@@ -0,0 +1,30 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_openbsd.go
+
+package socket
+
+type iovec struct {
+	Base	*byte
+	Len	uint64
+}
+
+type msghdr struct {
+	Name		*byte
+	Namelen		uint32
+	Iov		*iovec
+	Iovlen		uint32
+	Control		*byte
+	Controllen	uint32
+	Flags		int32
+}
+
+type cmsghdr struct {
+	Len	uint32
+	Level	int32
+	Type	int32
+}
+
+const (
+	sizeofIovec	= 0x10
+	sizeofMsghdr	= 0x30
+)
diff --git a/vendor/golang.org/x/net/ipv4/doc.go b/vendor/golang.org/x/net/ipv4/doc.go
index 2458349799..6fbdc52b96 100644
--- a/vendor/golang.org/x/net/ipv4/doc.go
+++ b/vendor/golang.org/x/net/ipv4/doc.go
@@ -16,8 +16,7 @@
 // 3376.
 // Source-specific multicast is defined in RFC 4607.
 //
-//
-// Unicasting
+// # Unicasting
 //
 // The options for unicasting are available for net.TCPConn,
 // net.UDPConn and net.IPConn which are created as network connections
@@ -51,8 +50,7 @@
 //		}(c)
 //	}
 //
-//
-// Multicasting
+// # Multicasting
 //
 // The options for multicasting are available for net.UDPConn and
 // net.IPConn which are created as network connections that use the
@@ -141,8 +139,7 @@
 //		}
 //	}
 //
-//
-// More multicasting
+// # More multicasting
 //
 // An application that uses PacketConn or RawConn may join multiple
 // multicast groups. For example, a UDP listener with port 1024 might
@@ -200,8 +197,7 @@
 //		// error handling
 //	}
 //
-//
-// Source-specific multicasting
+// # Source-specific multicasting
 //
 // An application that uses PacketConn or RawConn on IGMPv3 supported
 // platform is able to join source-specific multicast groups.
diff --git a/vendor/golang.org/x/net/ipv4/zsys_freebsd_riscv64.go b/vendor/golang.org/x/net/ipv4/zsys_freebsd_riscv64.go
new file mode 100644
index 0000000000..0feb9a7536
--- /dev/null
+++ b/vendor/golang.org/x/net/ipv4/zsys_freebsd_riscv64.go
@@ -0,0 +1,52 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_freebsd.go
+
+package ipv4
+
+const (
+	sizeofSockaddrStorage = 0x80
+	sizeofSockaddrInet    = 0x10
+
+	sizeofIPMreq         = 0x8
+	sizeofIPMreqSource   = 0xc
+	sizeofGroupReq       = 0x88
+	sizeofGroupSourceReq = 0x108
+)
+
+type sockaddrStorage struct {
+	Len         uint8
+	Family      uint8
+	X__ss_pad1  [6]uint8
+	X__ss_align int64
+	X__ss_pad2  [112]uint8
+}
+
+type sockaddrInet struct {
+	Len    uint8
+	Family uint8
+	Port   uint16
+	Addr   [4]byte /* in_addr */
+	Zero   [8]uint8
+}
+
+type ipMreq struct {
+	Multiaddr [4]byte /* in_addr */
+	Interface [4]byte /* in_addr */
+}
+
+type ipMreqSource struct {
+	Multiaddr  [4]byte /* in_addr */
+	Sourceaddr [4]byte /* in_addr */
+	Interface  [4]byte /* in_addr */
+}
+
+type groupReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+}
+
+type groupSourceReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+	Source    sockaddrStorage
+}
diff --git a/vendor/golang.org/x/net/ipv4/zsys_linux_loong64.go b/vendor/golang.org/x/net/ipv4/zsys_linux_loong64.go
new file mode 100644
index 0000000000..e15c22c748
--- /dev/null
+++ b/vendor/golang.org/x/net/ipv4/zsys_linux_loong64.go
@@ -0,0 +1,77 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_linux.go
+
+//go:build loong64
+// +build loong64
+
+package ipv4
+
+const (
+	sizeofKernelSockaddrStorage = 0x80
+	sizeofSockaddrInet          = 0x10
+	sizeofInetPktinfo           = 0xc
+	sizeofSockExtendedErr       = 0x10
+
+	sizeofIPMreq         = 0x8
+	sizeofIPMreqSource   = 0xc
+	sizeofGroupReq       = 0x88
+	sizeofGroupSourceReq = 0x108
+
+	sizeofICMPFilter = 0x4
+)
+
+type kernelSockaddrStorage struct {
+	Family  uint16
+	X__data [126]int8
+}
+
+type sockaddrInet struct {
+	Family uint16
+	Port   uint16
+	Addr   [4]byte /* in_addr */
+	X__pad [8]uint8
+}
+
+type inetPktinfo struct {
+	Ifindex  int32
+	Spec_dst [4]byte /* in_addr */
+	Addr     [4]byte /* in_addr */
+}
+
+type sockExtendedErr struct {
+	Errno  uint32
+	Origin uint8
+	Type   uint8
+	Code   uint8
+	Pad    uint8
+	Info   uint32
+	Data   uint32
+}
+
+type ipMreq struct {
+	Multiaddr [4]byte /* in_addr */
+	Interface [4]byte /* in_addr */
+}
+
+type ipMreqSource struct {
+	Multiaddr  uint32
+	Interface  uint32
+	Sourceaddr uint32
+}
+
+type groupReq struct {
+	Interface uint32
+	Pad_cgo_0 [4]byte
+	Group     kernelSockaddrStorage
+}
+
+type groupSourceReq struct {
+	Interface uint32
+	Pad_cgo_0 [4]byte
+	Group     kernelSockaddrStorage
+	Source    kernelSockaddrStorage
+}
+
+type icmpFilter struct {
+	Data uint32
+}
diff --git a/vendor/golang.org/x/net/ipv6/dgramopt.go b/vendor/golang.org/x/net/ipv6/dgramopt.go
index 1f422e71dc..846f0e1f9c 100644
--- a/vendor/golang.org/x/net/ipv6/dgramopt.go
+++ b/vendor/golang.org/x/net/ipv6/dgramopt.go
@@ -245,7 +245,7 @@ func (c *dgramOpt) Checksum() (on bool, offset int, err error) {
 	return true, offset, nil
 }
 
-// SetChecksum enables the kernel checksum processing. If on is ture,
+// SetChecksum enables the kernel checksum processing. If on is true,
 // the offset should be an offset in bytes into the data of where the
 // checksum field is located.
 func (c *dgramOpt) SetChecksum(on bool, offset int) error {
diff --git a/vendor/golang.org/x/net/ipv6/doc.go b/vendor/golang.org/x/net/ipv6/doc.go
index e0be9d50d7..2148b814ff 100644
--- a/vendor/golang.org/x/net/ipv6/doc.go
+++ b/vendor/golang.org/x/net/ipv6/doc.go
@@ -17,8 +17,7 @@
 // On Darwin, this package requires OS X Mavericks version 10.9 or
 // above, or equivalent.
 //
-//
-// Unicasting
+// # Unicasting
 //
 // The options for unicasting are available for net.TCPConn,
 // net.UDPConn and net.IPConn which are created as network connections
@@ -52,8 +51,7 @@
 //		}(c)
 //	}
 //
-//
-// Multicasting
+// # Multicasting
 //
 // The options for multicasting are available for net.UDPConn and
 // net.IPConn which are created as network connections that use the
@@ -140,8 +138,7 @@
 //		}
 //	}
 //
-//
-// More multicasting
+// # More multicasting
 //
 // An application that uses PacketConn may join multiple multicast
 // groups. For example, a UDP listener with port 1024 might join two
@@ -199,8 +196,7 @@
 //		// error handling
 //	}
 //
-//
-// Source-specific multicasting
+// # Source-specific multicasting
 //
 // An application that uses PacketConn on MLDv2 supported platform is
 // able to join source-specific multicast groups.
diff --git a/vendor/golang.org/x/net/ipv6/zsys_freebsd_riscv64.go b/vendor/golang.org/x/net/ipv6/zsys_freebsd_riscv64.go
new file mode 100644
index 0000000000..5b39eb8dfd
--- /dev/null
+++ b/vendor/golang.org/x/net/ipv6/zsys_freebsd_riscv64.go
@@ -0,0 +1,64 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_freebsd.go
+
+package ipv6
+
+const (
+	sizeofSockaddrStorage = 0x80
+	sizeofSockaddrInet6   = 0x1c
+	sizeofInet6Pktinfo    = 0x14
+	sizeofIPv6Mtuinfo     = 0x20
+
+	sizeofIPv6Mreq       = 0x14
+	sizeofGroupReq       = 0x88
+	sizeofGroupSourceReq = 0x108
+
+	sizeofICMPv6Filter = 0x20
+)
+
+type sockaddrStorage struct {
+	Len         uint8
+	Family      uint8
+	X__ss_pad1  [6]uint8
+	X__ss_align int64
+	X__ss_pad2  [112]uint8
+}
+
+type sockaddrInet6 struct {
+	Len      uint8
+	Family   uint8
+	Port     uint16
+	Flowinfo uint32
+	Addr     [16]byte /* in6_addr */
+	Scope_id uint32
+}
+
+type inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex uint32
+}
+
+type ipv6Mtuinfo struct {
+	Addr sockaddrInet6
+	Mtu  uint32
+}
+
+type ipv6Mreq struct {
+	Multiaddr [16]byte /* in6_addr */
+	Interface uint32
+}
+
+type groupReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+}
+
+type groupSourceReq struct {
+	Interface uint32
+	Group     sockaddrStorage
+	Source    sockaddrStorage
+}
+
+type icmpv6Filter struct {
+	Filt [8]uint32
+}
diff --git a/vendor/golang.org/x/net/ipv6/zsys_linux_loong64.go b/vendor/golang.org/x/net/ipv6/zsys_linux_loong64.go
new file mode 100644
index 0000000000..598fbfa06f
--- /dev/null
+++ b/vendor/golang.org/x/net/ipv6/zsys_linux_loong64.go
@@ -0,0 +1,77 @@
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs defs_linux.go
+
+//go:build loong64
+// +build loong64
+
+package ipv6
+
+const (
+	sizeofKernelSockaddrStorage = 0x80
+	sizeofSockaddrInet6         = 0x1c
+	sizeofInet6Pktinfo          = 0x14
+	sizeofIPv6Mtuinfo           = 0x20
+	sizeofIPv6FlowlabelReq      = 0x20
+
+	sizeofIPv6Mreq       = 0x14
+	sizeofGroupReq       = 0x88
+	sizeofGroupSourceReq = 0x108
+
+	sizeofICMPv6Filter = 0x20
+)
+
+type kernelSockaddrStorage struct {
+	Family  uint16
+	X__data [126]int8
+}
+
+type sockaddrInet6 struct {
+	Family   uint16
+	Port     uint16
+	Flowinfo uint32
+	Addr     [16]byte /* in6_addr */
+	Scope_id uint32
+}
+
+type inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex int32
+}
+
+type ipv6Mtuinfo struct {
+	Addr sockaddrInet6
+	Mtu  uint32
+}
+
+type ipv6FlowlabelReq struct {
+	Dst        [16]byte /* in6_addr */
+	Label      uint32
+	Action     uint8
+	Share      uint8
+	Flags      uint16
+	Expires    uint16
+	Linger     uint16
+	X__flr_pad uint32
+}
+
+type ipv6Mreq struct {
+	Multiaddr [16]byte /* in6_addr */
+	Ifindex   int32
+}
+
+type groupReq struct {
+	Interface uint32
+	Pad_cgo_0 [4]byte
+	Group     kernelSockaddrStorage
+}
+
+type groupSourceReq struct {
+	Interface uint32
+	Pad_cgo_0 [4]byte
+	Group     kernelSockaddrStorage
+	Source    kernelSockaddrStorage
+}
+
+type icmpv6Filter struct {
+	Data [8]uint32
+}
diff --git a/vendor/golang.org/x/net/trace/histogram.go b/vendor/golang.org/x/net/trace/histogram.go
index 9bf4286c79..d6c71101e4 100644
--- a/vendor/golang.org/x/net/trace/histogram.go
+++ b/vendor/golang.org/x/net/trace/histogram.go
@@ -32,7 +32,7 @@ type histogram struct {
 	valueCount   int64   // number of values recorded for single value
 }
 
-// AddMeasurement records a value measurement observation to the histogram.
+// addMeasurement records a value measurement observation to the histogram.
 func (h *histogram) addMeasurement(value int64) {
 	// TODO: assert invariant
 	h.sum += value
diff --git a/vendor/golang.org/x/net/trace/trace.go b/vendor/golang.org/x/net/trace/trace.go
index 3ebf6f2daa..eae2a99f54 100644
--- a/vendor/golang.org/x/net/trace/trace.go
+++ b/vendor/golang.org/x/net/trace/trace.go
@@ -395,7 +395,7 @@ func New(family, title string) Trace {
 }
 
 func (tr *trace) Finish() {
-	elapsed := time.Now().Sub(tr.Start)
+	elapsed := time.Since(tr.Start)
 	tr.mu.Lock()
 	tr.Elapsed = elapsed
 	tr.mu.Unlock()
diff --git a/vendor/golang.org/x/sync/LICENSE b/vendor/golang.org/x/sync/LICENSE
new file mode 100644
index 0000000000..6a66aea5ea
--- /dev/null
+++ b/vendor/golang.org/x/sync/LICENSE
@@ -0,0 +1,27 @@
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/golang.org/x/sync/PATENTS b/vendor/golang.org/x/sync/PATENTS
new file mode 100644
index 0000000000..733099041f
--- /dev/null
+++ b/vendor/golang.org/x/sync/PATENTS
@@ -0,0 +1,22 @@
+Additional IP Rights Grant (Patents)
+
+"This implementation" means the copyrightable works distributed by
+Google as part of the Go project.
+
+Google hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section)
+patent license to make, have made, use, offer to sell, sell, import,
+transfer and otherwise run, modify and propagate the contents of this
+implementation of Go, where such license applies only to those patent
+claims, both currently owned or controlled by Google and acquired in
+the future, licensable by Google that are necessarily infringed by this
+implementation of Go.  This grant does not include claims that would be
+infringed only as a consequence of further modification of this
+implementation.  If you or your agent or exclusive licensee institute or
+order or agree to the institution of patent litigation against any
+entity (including a cross-claim or counterclaim in a lawsuit) alleging
+that this implementation of Go or any code incorporated within this
+implementation of Go constitutes direct or contributory patent
+infringement, or inducement of patent infringement, then any patent
+rights granted to you under this License for this implementation of Go
+shall terminate as of the date such litigation is filed.
diff --git a/vendor/golang.org/x/sync/errgroup/errgroup.go b/vendor/golang.org/x/sync/errgroup/errgroup.go
new file mode 100644
index 0000000000..cbee7a4e23
--- /dev/null
+++ b/vendor/golang.org/x/sync/errgroup/errgroup.go
@@ -0,0 +1,132 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package errgroup provides synchronization, error propagation, and Context
+// cancelation for groups of goroutines working on subtasks of a common task.
+package errgroup
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+type token struct{}
+
+// A Group is a collection of goroutines working on subtasks that are part of
+// the same overall task.
+//
+// A zero Group is valid, has no limit on the number of active goroutines,
+// and does not cancel on error.
+type Group struct {
+	cancel func()
+
+	wg sync.WaitGroup
+
+	sem chan token
+
+	errOnce sync.Once
+	err     error
+}
+
+func (g *Group) done() {
+	if g.sem != nil {
+		<-g.sem
+	}
+	g.wg.Done()
+}
+
+// WithContext returns a new Group and an associated Context derived from ctx.
+//
+// The derived Context is canceled the first time a function passed to Go
+// returns a non-nil error or the first time Wait returns, whichever occurs
+// first.
+func WithContext(ctx context.Context) (*Group, context.Context) {
+	ctx, cancel := context.WithCancel(ctx)
+	return &Group{cancel: cancel}, ctx
+}
+
+// Wait blocks until all function calls from the Go method have returned, then
+// returns the first non-nil error (if any) from them.
+func (g *Group) Wait() error {
+	g.wg.Wait()
+	if g.cancel != nil {
+		g.cancel()
+	}
+	return g.err
+}
+
+// Go calls the given function in a new goroutine.
+// It blocks until the new goroutine can be added without the number of
+// active goroutines in the group exceeding the configured limit.
+//
+// The first call to return a non-nil error cancels the group's context, if the
+// group was created by calling WithContext. The error will be returned by Wait.
+func (g *Group) Go(f func() error) {
+	if g.sem != nil {
+		g.sem <- token{}
+	}
+
+	g.wg.Add(1)
+	go func() {
+		defer g.done()
+
+		if err := f(); err != nil {
+			g.errOnce.Do(func() {
+				g.err = err
+				if g.cancel != nil {
+					g.cancel()
+				}
+			})
+		}
+	}()
+}
+
+// TryGo calls the given function in a new goroutine only if the number of
+// active goroutines in the group is currently below the configured limit.
+//
+// The return value reports whether the goroutine was started.
+func (g *Group) TryGo(f func() error) bool {
+	if g.sem != nil {
+		select {
+		case g.sem <- token{}:
+			// Note: this allows barging iff channels in general allow barging.
+		default:
+			return false
+		}
+	}
+
+	g.wg.Add(1)
+	go func() {
+		defer g.done()
+
+		if err := f(); err != nil {
+			g.errOnce.Do(func() {
+				g.err = err
+				if g.cancel != nil {
+					g.cancel()
+				}
+			})
+		}
+	}()
+	return true
+}
+
+// SetLimit limits the number of active goroutines in this group to at most n.
+// A negative value indicates no limit.
+//
+// Any subsequent call to the Go method will block until it can add an active
+// goroutine without exceeding the configured limit.
+//
+// The limit must not be modified while any goroutines in the group are active.
+func (g *Group) SetLimit(n int) {
+	if n < 0 {
+		g.sem = nil
+		return
+	}
+	if len(g.sem) != 0 {
+		panic(fmt.Errorf("errgroup: modify limit while %v goroutines in the group are still active", len(g.sem)))
+	}
+	g.sem = make(chan token, n)
+}
diff --git a/vendor/golang.org/x/sync/semaphore/semaphore.go b/vendor/golang.org/x/sync/semaphore/semaphore.go
new file mode 100644
index 0000000000..30f632c577
--- /dev/null
+++ b/vendor/golang.org/x/sync/semaphore/semaphore.go
@@ -0,0 +1,136 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package semaphore provides a weighted semaphore implementation.
+package semaphore // import "golang.org/x/sync/semaphore"
+
+import (
+	"container/list"
+	"context"
+	"sync"
+)
+
+type waiter struct {
+	n     int64
+	ready chan<- struct{} // Closed when semaphore acquired.
+}
+
+// NewWeighted creates a new weighted semaphore with the given
+// maximum combined weight for concurrent access.
+func NewWeighted(n int64) *Weighted {
+	w := &Weighted{size: n}
+	return w
+}
+
+// Weighted provides a way to bound concurrent access to a resource.
+// The callers can request access with a given weight.
+type Weighted struct {
+	size    int64
+	cur     int64
+	mu      sync.Mutex
+	waiters list.List
+}
+
+// Acquire acquires the semaphore with a weight of n, blocking until resources
+// are available or ctx is done. On success, returns nil. On failure, returns
+// ctx.Err() and leaves the semaphore unchanged.
+//
+// If ctx is already done, Acquire may still succeed without blocking.
+func (s *Weighted) Acquire(ctx context.Context, n int64) error {
+	s.mu.Lock()
+	if s.size-s.cur >= n && s.waiters.Len() == 0 {
+		s.cur += n
+		s.mu.Unlock()
+		return nil
+	}
+
+	if n > s.size {
+		// Don't make other Acquire calls block on one that's doomed to fail.
+		s.mu.Unlock()
+		<-ctx.Done()
+		return ctx.Err()
+	}
+
+	ready := make(chan struct{})
+	w := waiter{n: n, ready: ready}
+	elem := s.waiters.PushBack(w)
+	s.mu.Unlock()
+
+	select {
+	case <-ctx.Done():
+		err := ctx.Err()
+		s.mu.Lock()
+		select {
+		case <-ready:
+			// Acquired the semaphore after we were canceled.  Rather than trying to
+			// fix up the queue, just pretend we didn't notice the cancelation.
+			err = nil
+		default:
+			isFront := s.waiters.Front() == elem
+			s.waiters.Remove(elem)
+			// If we're at the front and there're extra tokens left, notify other waiters.
+			if isFront && s.size > s.cur {
+				s.notifyWaiters()
+			}
+		}
+		s.mu.Unlock()
+		return err
+
+	case <-ready:
+		return nil
+	}
+}
+
+// TryAcquire acquires the semaphore with a weight of n without blocking.
+// On success, returns true. On failure, returns false and leaves the semaphore unchanged.
+func (s *Weighted) TryAcquire(n int64) bool {
+	s.mu.Lock()
+	success := s.size-s.cur >= n && s.waiters.Len() == 0
+	if success {
+		s.cur += n
+	}
+	s.mu.Unlock()
+	return success
+}
+
+// Release releases the semaphore with a weight of n.
+func (s *Weighted) Release(n int64) {
+	s.mu.Lock()
+	s.cur -= n
+	if s.cur < 0 {
+		s.mu.Unlock()
+		panic("semaphore: released more than held")
+	}
+	s.notifyWaiters()
+	s.mu.Unlock()
+}
+
+func (s *Weighted) notifyWaiters() {
+	for {
+		next := s.waiters.Front()
+		if next == nil {
+			break // No more waiters blocked.
+		}
+
+		w := next.Value.(waiter)
+		if s.size-s.cur < w.n {
+			// Not enough tokens for the next waiter.  We could keep going (to try to
+			// find a waiter with a smaller request), but under load that could cause
+			// starvation for large requests; instead, we leave all remaining waiters
+			// blocked.
+			//
+			// Consider a semaphore used as a read-write lock, with N tokens, N
+			// readers, and one writer.  Each reader can Acquire(1) to obtain a read
+			// lock.  The writer can Acquire(N) to obtain a write lock, excluding all
+			// of the readers.  If we allow the readers to jump ahead in the queue,
+			// the writer will starve — there is always one token available for every
+			// reader.
+			break
+		}
+
+		s.cur += w.n
+		s.waiters.Remove(next)
+		close(w.ready)
+	}
+}
diff --git a/vendor/golang.org/x/sys/AUTHORS b/vendor/golang.org/x/sys/AUTHORS
deleted file mode 100644
index 15167cd746..0000000000
--- a/vendor/golang.org/x/sys/AUTHORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code refers to The Go Authors for copyright purposes.
-# The master list of authors is in the main Go distribution,
-# visible at http://tip.golang.org/AUTHORS.
diff --git a/vendor/golang.org/x/sys/CONTRIBUTORS b/vendor/golang.org/x/sys/CONTRIBUTORS
deleted file mode 100644
index 1c4577e968..0000000000
--- a/vendor/golang.org/x/sys/CONTRIBUTORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code was written by the Go contributors.
-# The master list of contributors is in the main Go distribution,
-# visible at http://tip.golang.org/CONTRIBUTORS.
diff --git a/vendor/golang.org/x/sys/execabs/execabs.go b/vendor/golang.org/x/sys/execabs/execabs.go
new file mode 100644
index 0000000000..3bf40fdfec
--- /dev/null
+++ b/vendor/golang.org/x/sys/execabs/execabs.go
@@ -0,0 +1,102 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package execabs is a drop-in replacement for os/exec
+// that requires PATH lookups to find absolute paths.
+// That is, execabs.Command("cmd") runs the same PATH lookup
+// as exec.Command("cmd"), but if the result is a path
+// which is relative, the Run and Start methods will report
+// an error instead of running the executable.
+//
+// See https://blog.golang.org/path-security for more information
+// about when it may be necessary or appropriate to use this package.
+package execabs
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"unsafe"
+)
+
+// ErrNotFound is the error resulting if a path search failed to find an executable file.
+// It is an alias for exec.ErrNotFound.
+var ErrNotFound = exec.ErrNotFound
+
+// Cmd represents an external command being prepared or run.
+// It is an alias for exec.Cmd.
+type Cmd = exec.Cmd
+
+// Error is returned by LookPath when it fails to classify a file as an executable.
+// It is an alias for exec.Error.
+type Error = exec.Error
+
+// An ExitError reports an unsuccessful exit by a command.
+// It is an alias for exec.ExitError.
+type ExitError = exec.ExitError
+
+func relError(file, path string) error {
+	return fmt.Errorf("%s resolves to executable in current directory (.%c%s)", file, filepath.Separator, path)
+}
+
+// LookPath searches for an executable named file in the directories
+// named by the PATH environment variable. If file contains a slash,
+// it is tried directly and the PATH is not consulted. The result will be
+// an absolute path.
+//
+// LookPath differs from exec.LookPath in its handling of PATH lookups,
+// which are used for file names without slashes. If exec.LookPath's
+// PATH lookup would have returned an executable from the current directory,
+// LookPath instead returns an error.
+func LookPath(file string) (string, error) {
+	path, err := exec.LookPath(file)
+	if err != nil && !isGo119ErrDot(err) {
+		return "", err
+	}
+	if filepath.Base(file) == file && !filepath.IsAbs(path) {
+		return "", relError(file, path)
+	}
+	return path, nil
+}
+
+func fixCmd(name string, cmd *exec.Cmd) {
+	if filepath.Base(name) == name && !filepath.IsAbs(cmd.Path) && !isGo119ErrFieldSet(cmd) {
+		// exec.Command was called with a bare binary name and
+		// exec.LookPath returned a path which is not absolute.
+		// Set cmd.lookPathErr and clear cmd.Path so that it
+		// cannot be run.
+		lookPathErr := (*error)(unsafe.Pointer(reflect.ValueOf(cmd).Elem().FieldByName("lookPathErr").Addr().Pointer()))
+		if *lookPathErr == nil {
+			*lookPathErr = relError(name, cmd.Path)
+		}
+		cmd.Path = ""
+	}
+}
+
+// CommandContext is like Command but includes a context.
+//
+// The provided context is used to kill the process (by calling os.Process.Kill)
+// if the context becomes done before the command completes on its own.
+func CommandContext(ctx context.Context, name string, arg ...string) *exec.Cmd {
+	cmd := exec.CommandContext(ctx, name, arg...)
+	fixCmd(name, cmd)
+	return cmd
+
+}
+
+// Command returns the Cmd struct to execute the named program with the given arguments.
+// See exec.Command for most details.
+//
+// Command differs from exec.Command in its handling of PATH lookups,
+// which are used when the program name contains no slashes.
+// If exec.Command would have returned an exec.Cmd configured to run an
+// executable from the current directory, Command instead
+// returns an exec.Cmd that will return an error from Start or Run.
+func Command(name string, arg ...string) *exec.Cmd {
+	cmd := exec.Command(name, arg...)
+	fixCmd(name, cmd)
+	return cmd
+}
diff --git a/vendor/golang.org/x/sys/execabs/execabs_go118.go b/vendor/golang.org/x/sys/execabs/execabs_go118.go
new file mode 100644
index 0000000000..2000064a81
--- /dev/null
+++ b/vendor/golang.org/x/sys/execabs/execabs_go118.go
@@ -0,0 +1,18 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.19
+// +build !go1.19
+
+package execabs
+
+import "os/exec"
+
+func isGo119ErrDot(err error) bool {
+	return false
+}
+
+func isGo119ErrFieldSet(cmd *exec.Cmd) bool {
+	return false
+}
diff --git a/vendor/golang.org/x/sys/execabs/execabs_go119.go b/vendor/golang.org/x/sys/execabs/execabs_go119.go
new file mode 100644
index 0000000000..f364b34189
--- /dev/null
+++ b/vendor/golang.org/x/sys/execabs/execabs_go119.go
@@ -0,0 +1,21 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.19
+// +build go1.19
+
+package execabs
+
+import (
+	"errors"
+	"os/exec"
+)
+
+func isGo119ErrDot(err error) bool {
+	return errors.Is(err, exec.ErrDot)
+}
+
+func isGo119ErrFieldSet(cmd *exec.Cmd) bool {
+	return cmd.Err != nil
+}
diff --git a/vendor/golang.org/x/sys/unix/README.md b/vendor/golang.org/x/sys/unix/README.md
index 474efad0e0..7d3c060e12 100644
--- a/vendor/golang.org/x/sys/unix/README.md
+++ b/vendor/golang.org/x/sys/unix/README.md
@@ -149,7 +149,7 @@ To add a constant, add the header that includes it to the appropriate variable.
 Then, edit the regex (if necessary) to match the desired constant. Avoid making
 the regex too broad to avoid matching unintended constants.
 
-### mkmerge.go
+### internal/mkmerge
 
 This program is used to extract duplicate const, func, and type declarations
 from the generated architecture-specific files listed below, and merge these
diff --git a/vendor/golang.org/x/sys/unix/asm_bsd_ppc64.s b/vendor/golang.org/x/sys/unix/asm_bsd_ppc64.s
new file mode 100644
index 0000000000..e5b9a84899
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/asm_bsd_ppc64.s
@@ -0,0 +1,31 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (darwin || freebsd || netbsd || openbsd) && gc
+// +build darwin freebsd netbsd openbsd
+// +build gc
+
+#include "textflag.h"
+
+//
+// System call support for ppc64, BSD
+//
+
+// Just jump to package syscall's implementation for all these functions.
+// The runtime may know about them.
+
+TEXT	·Syscall(SB),NOSPLIT,$0-56
+	JMP	syscall·Syscall(SB)
+
+TEXT	·Syscall6(SB),NOSPLIT,$0-80
+	JMP	syscall·Syscall6(SB)
+
+TEXT	·Syscall9(SB),NOSPLIT,$0-104
+	JMP	syscall·Syscall9(SB)
+
+TEXT	·RawSyscall(SB),NOSPLIT,$0-56
+	JMP	syscall·RawSyscall(SB)
+
+TEXT	·RawSyscall6(SB),NOSPLIT,$0-80
+	JMP	syscall·RawSyscall6(SB)
diff --git a/vendor/golang.org/x/sys/unix/asm_bsd_riscv64.s b/vendor/golang.org/x/sys/unix/asm_bsd_riscv64.s
new file mode 100644
index 0000000000..d560019ea2
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/asm_bsd_riscv64.s
@@ -0,0 +1,29 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build (darwin || freebsd || netbsd || openbsd) && gc
+// +build darwin freebsd netbsd openbsd
+// +build gc
+
+#include "textflag.h"
+
+// System call support for RISCV64 BSD
+
+// Just jump to package syscall's implementation for all these functions.
+// The runtime may know about them.
+
+TEXT	·Syscall(SB),NOSPLIT,$0-56
+	JMP	syscall·Syscall(SB)
+
+TEXT	·Syscall6(SB),NOSPLIT,$0-80
+	JMP	syscall·Syscall6(SB)
+
+TEXT	·Syscall9(SB),NOSPLIT,$0-104
+	JMP	syscall·Syscall9(SB)
+
+TEXT	·RawSyscall(SB),NOSPLIT,$0-56
+	JMP	syscall·RawSyscall(SB)
+
+TEXT	·RawSyscall6(SB),NOSPLIT,$0-80
+	JMP	syscall·RawSyscall6(SB)
diff --git a/vendor/golang.org/x/sys/unix/asm_linux_loong64.s b/vendor/golang.org/x/sys/unix/asm_linux_loong64.s
new file mode 100644
index 0000000000..565357288a
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/asm_linux_loong64.s
@@ -0,0 +1,54 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && loong64 && gc
+// +build linux
+// +build loong64
+// +build gc
+
+#include "textflag.h"
+
+
+// Just jump to package syscall's implementation for all these functions.
+// The runtime may know about them.
+
+TEXT ·Syscall(SB),NOSPLIT,$0-56
+	JMP	syscall·Syscall(SB)
+
+TEXT ·Syscall6(SB),NOSPLIT,$0-80
+	JMP	syscall·Syscall6(SB)
+
+TEXT ·SyscallNoError(SB),NOSPLIT,$0-48
+	JAL	runtime·entersyscall(SB)
+	MOVV	a1+8(FP), R4
+	MOVV	a2+16(FP), R5
+	MOVV	a3+24(FP), R6
+	MOVV	R0, R7
+	MOVV	R0, R8
+	MOVV	R0, R9
+	MOVV	trap+0(FP), R11	// syscall entry
+	SYSCALL
+	MOVV	R4, r1+32(FP)
+	MOVV	R0, r2+40(FP)	// r2 is not used. Always set to 0
+	JAL	runtime·exitsyscall(SB)
+	RET
+
+TEXT ·RawSyscall(SB),NOSPLIT,$0-56
+	JMP	syscall·RawSyscall(SB)
+
+TEXT ·RawSyscall6(SB),NOSPLIT,$0-80
+	JMP	syscall·RawSyscall6(SB)
+
+TEXT ·RawSyscallNoError(SB),NOSPLIT,$0-48
+	MOVV	a1+8(FP), R4
+	MOVV	a2+16(FP), R5
+	MOVV	a3+24(FP), R6
+	MOVV	R0, R7
+	MOVV	R0, R8
+	MOVV	R0, R9
+	MOVV	trap+0(FP), R11	// syscall entry
+	SYSCALL
+	MOVV	R4, r1+32(FP)
+	MOVV	R0, r2+40(FP)	// r2 is not used. Always set to 0
+	RET
diff --git a/vendor/golang.org/x/sys/unix/dirent.go b/vendor/golang.org/x/sys/unix/dirent.go
index e74e5eaa3b..2499f977b0 100644
--- a/vendor/golang.org/x/sys/unix/dirent.go
+++ b/vendor/golang.org/x/sys/unix/dirent.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris zos
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/endian_little.go b/vendor/golang.org/x/sys/unix/endian_little.go
index 4362f47e2c..b0f2bc4ae3 100644
--- a/vendor/golang.org/x/sys/unix/endian_little.go
+++ b/vendor/golang.org/x/sys/unix/endian_little.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 //
-//go:build 386 || amd64 || amd64p32 || alpha || arm || arm64 || mipsle || mips64le || mips64p32le || nios2 || ppc64le || riscv || riscv64 || sh
-// +build 386 amd64 amd64p32 alpha arm arm64 mipsle mips64le mips64p32le nios2 ppc64le riscv riscv64 sh
+//go:build 386 || amd64 || amd64p32 || alpha || arm || arm64 || loong64 || mipsle || mips64le || mips64p32le || nios2 || ppc64le || riscv || riscv64 || sh
+// +build 386 amd64 amd64p32 alpha arm arm64 loong64 mipsle mips64le mips64p32le nios2 ppc64le riscv riscv64 sh
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/errors_freebsd_386.go b/vendor/golang.org/x/sys/unix/errors_freebsd_386.go
deleted file mode 100644
index 761db66efe..0000000000
--- a/vendor/golang.org/x/sys/unix/errors_freebsd_386.go
+++ /dev/null
@@ -1,233 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Constants that were deprecated or moved to enums in the FreeBSD headers. Keep
-// them here for backwards compatibility.
-
-package unix
-
-const (
-	DLT_HHDLC                         = 0x79
-	IFF_SMART                         = 0x20
-	IFT_1822                          = 0x2
-	IFT_A12MPPSWITCH                  = 0x82
-	IFT_AAL2                          = 0xbb
-	IFT_AAL5                          = 0x31
-	IFT_ADSL                          = 0x5e
-	IFT_AFLANE8023                    = 0x3b
-	IFT_AFLANE8025                    = 0x3c
-	IFT_ARAP                          = 0x58
-	IFT_ARCNET                        = 0x23
-	IFT_ARCNETPLUS                    = 0x24
-	IFT_ASYNC                         = 0x54
-	IFT_ATM                           = 0x25
-	IFT_ATMDXI                        = 0x69
-	IFT_ATMFUNI                       = 0x6a
-	IFT_ATMIMA                        = 0x6b
-	IFT_ATMLOGICAL                    = 0x50
-	IFT_ATMRADIO                      = 0xbd
-	IFT_ATMSUBINTERFACE               = 0x86
-	IFT_ATMVCIENDPT                   = 0xc2
-	IFT_ATMVIRTUAL                    = 0x95
-	IFT_BGPPOLICYACCOUNTING           = 0xa2
-	IFT_BSC                           = 0x53
-	IFT_CCTEMUL                       = 0x3d
-	IFT_CEPT                          = 0x13
-	IFT_CES                           = 0x85
-	IFT_CHANNEL                       = 0x46
-	IFT_CNR                           = 0x55
-	IFT_COFFEE                        = 0x84
-	IFT_COMPOSITELINK                 = 0x9b
-	IFT_DCN                           = 0x8d
-	IFT_DIGITALPOWERLINE              = 0x8a
-	IFT_DIGITALWRAPPEROVERHEADCHANNEL = 0xba
-	IFT_DLSW                          = 0x4a
-	IFT_DOCSCABLEDOWNSTREAM           = 0x80
-	IFT_DOCSCABLEMACLAYER             = 0x7f
-	IFT_DOCSCABLEUPSTREAM             = 0x81
-	IFT_DS0                           = 0x51
-	IFT_DS0BUNDLE                     = 0x52
-	IFT_DS1FDL                        = 0xaa
-	IFT_DS3                           = 0x1e
-	IFT_DTM                           = 0x8c
-	IFT_DVBASILN                      = 0xac
-	IFT_DVBASIOUT                     = 0xad
-	IFT_DVBRCCDOWNSTREAM              = 0x93
-	IFT_DVBRCCMACLAYER                = 0x92
-	IFT_DVBRCCUPSTREAM                = 0x94
-	IFT_ENC                           = 0xf4
-	IFT_EON                           = 0x19
-	IFT_EPLRS                         = 0x57
-	IFT_ESCON                         = 0x49
-	IFT_ETHER                         = 0x6
-	IFT_FAITH                         = 0xf2
-	IFT_FAST                          = 0x7d
-	IFT_FASTETHER                     = 0x3e
-	IFT_FASTETHERFX                   = 0x45
-	IFT_FDDI                          = 0xf
-	IFT_FIBRECHANNEL                  = 0x38
-	IFT_FRAMERELAYINTERCONNECT        = 0x3a
-	IFT_FRAMERELAYMPI                 = 0x5c
-	IFT_FRDLCIENDPT                   = 0xc1
-	IFT_FRELAY                        = 0x20
-	IFT_FRELAYDCE                     = 0x2c
-	IFT_FRF16MFRBUNDLE                = 0xa3
-	IFT_FRFORWARD                     = 0x9e
-	IFT_G703AT2MB                     = 0x43
-	IFT_G703AT64K                     = 0x42
-	IFT_GIF                           = 0xf0
-	IFT_GIGABITETHERNET               = 0x75
-	IFT_GR303IDT                      = 0xb2
-	IFT_GR303RDT                      = 0xb1
-	IFT_H323GATEKEEPER                = 0xa4
-	IFT_H323PROXY                     = 0xa5
-	IFT_HDH1822                       = 0x3
-	IFT_HDLC                          = 0x76
-	IFT_HDSL2                         = 0xa8
-	IFT_HIPERLAN2                     = 0xb7
-	IFT_HIPPI                         = 0x2f
-	IFT_HIPPIINTERFACE                = 0x39
-	IFT_HOSTPAD                       = 0x5a
-	IFT_HSSI                          = 0x2e
-	IFT_HY                            = 0xe
-	IFT_IBM370PARCHAN                 = 0x48
-	IFT_IDSL                          = 0x9a
-	IFT_IEEE80211                     = 0x47
-	IFT_IEEE80212                     = 0x37
-	IFT_IEEE8023ADLAG                 = 0xa1
-	IFT_IFGSN                         = 0x91
-	IFT_IMT                           = 0xbe
-	IFT_INTERLEAVE                    = 0x7c
-	IFT_IP                            = 0x7e
-	IFT_IPFORWARD                     = 0x8e
-	IFT_IPOVERATM                     = 0x72
-	IFT_IPOVERCDLC                    = 0x6d
-	IFT_IPOVERCLAW                    = 0x6e
-	IFT_IPSWITCH                      = 0x4e
-	IFT_IPXIP                         = 0xf9
-	IFT_ISDN                          = 0x3f
-	IFT_ISDNBASIC                     = 0x14
-	IFT_ISDNPRIMARY                   = 0x15
-	IFT_ISDNS                         = 0x4b
-	IFT_ISDNU                         = 0x4c
-	IFT_ISO88022LLC                   = 0x29
-	IFT_ISO88023                      = 0x7
-	IFT_ISO88024                      = 0x8
-	IFT_ISO88025                      = 0x9
-	IFT_ISO88025CRFPINT               = 0x62
-	IFT_ISO88025DTR                   = 0x56
-	IFT_ISO88025FIBER                 = 0x73
-	IFT_ISO88026                      = 0xa
-	IFT_ISUP                          = 0xb3
-	IFT_L3IPXVLAN                     = 0x89
-	IFT_LAPB                          = 0x10
-	IFT_LAPD                          = 0x4d
-	IFT_LAPF                          = 0x77
-	IFT_LOCALTALK                     = 0x2a
-	IFT_LOOP                          = 0x18
-	IFT_MEDIAMAILOVERIP               = 0x8b
-	IFT_MFSIGLINK                     = 0xa7
-	IFT_MIOX25                        = 0x26
-	IFT_MODEM                         = 0x30
-	IFT_MPC                           = 0x71
-	IFT_MPLS                          = 0xa6
-	IFT_MPLSTUNNEL                    = 0x96
-	IFT_MSDSL                         = 0x8f
-	IFT_MVL                           = 0xbf
-	IFT_MYRINET                       = 0x63
-	IFT_NFAS                          = 0xaf
-	IFT_NSIP                          = 0x1b
-	IFT_OPTICALCHANNEL                = 0xc3
-	IFT_OPTICALTRANSPORT              = 0xc4
-	IFT_OTHER                         = 0x1
-	IFT_P10                           = 0xc
-	IFT_P80                           = 0xd
-	IFT_PARA                          = 0x22
-	IFT_PFLOG                         = 0xf6
-	IFT_PFSYNC                        = 0xf7
-	IFT_PLC                           = 0xae
-	IFT_POS                           = 0xab
-	IFT_PPPMULTILINKBUNDLE            = 0x6c
-	IFT_PROPBWAP2MP                   = 0xb8
-	IFT_PROPCNLS                      = 0x59
-	IFT_PROPDOCSWIRELESSDOWNSTREAM    = 0xb5
-	IFT_PROPDOCSWIRELESSMACLAYER      = 0xb4
-	IFT_PROPDOCSWIRELESSUPSTREAM      = 0xb6
-	IFT_PROPMUX                       = 0x36
-	IFT_PROPWIRELESSP2P               = 0x9d
-	IFT_PTPSERIAL                     = 0x16
-	IFT_PVC                           = 0xf1
-	IFT_QLLC                          = 0x44
-	IFT_RADIOMAC                      = 0xbc
-	IFT_RADSL                         = 0x5f
-	IFT_REACHDSL                      = 0xc0
-	IFT_RFC1483                       = 0x9f
-	IFT_RS232                         = 0x21
-	IFT_RSRB                          = 0x4f
-	IFT_SDLC                          = 0x11
-	IFT_SDSL                          = 0x60
-	IFT_SHDSL                         = 0xa9
-	IFT_SIP                           = 0x1f
-	IFT_SLIP                          = 0x1c
-	IFT_SMDSDXI                       = 0x2b
-	IFT_SMDSICIP                      = 0x34
-	IFT_SONET                         = 0x27
-	IFT_SONETOVERHEADCHANNEL          = 0xb9
-	IFT_SONETPATH                     = 0x32
-	IFT_SONETVT                       = 0x33
-	IFT_SRP                           = 0x97
-	IFT_SS7SIGLINK                    = 0x9c
-	IFT_STACKTOSTACK                  = 0x6f
-	IFT_STARLAN                       = 0xb
-	IFT_STF                           = 0xd7
-	IFT_T1                            = 0x12
-	IFT_TDLC                          = 0x74
-	IFT_TERMPAD                       = 0x5b
-	IFT_TR008                         = 0xb0
-	IFT_TRANSPHDLC                    = 0x7b
-	IFT_TUNNEL                        = 0x83
-	IFT_ULTRA                         = 0x1d
-	IFT_USB                           = 0xa0
-	IFT_V11                           = 0x40
-	IFT_V35                           = 0x2d
-	IFT_V36                           = 0x41
-	IFT_V37                           = 0x78
-	IFT_VDSL                          = 0x61
-	IFT_VIRTUALIPADDRESS              = 0x70
-	IFT_VOICEEM                       = 0x64
-	IFT_VOICEENCAP                    = 0x67
-	IFT_VOICEFXO                      = 0x65
-	IFT_VOICEFXS                      = 0x66
-	IFT_VOICEOVERATM                  = 0x98
-	IFT_VOICEOVERFRAMERELAY           = 0x99
-	IFT_VOICEOVERIP                   = 0x68
-	IFT_X213                          = 0x5d
-	IFT_X25                           = 0x5
-	IFT_X25DDN                        = 0x4
-	IFT_X25HUNTGROUP                  = 0x7a
-	IFT_X25MLP                        = 0x79
-	IFT_X25PLE                        = 0x28
-	IFT_XETHER                        = 0x1a
-	IPPROTO_MAXID                     = 0x34
-	IPV6_FAITH                        = 0x1d
-	IPV6_MIN_MEMBERSHIPS              = 0x1f
-	IP_FAITH                          = 0x16
-	IP_MAX_SOURCE_FILTER              = 0x400
-	IP_MIN_MEMBERSHIPS                = 0x1f
-	MAP_NORESERVE                     = 0x40
-	MAP_RENAME                        = 0x20
-	NET_RT_MAXID                      = 0x6
-	RTF_PRCLONING                     = 0x10000
-	RTM_OLDADD                        = 0x9
-	RTM_OLDDEL                        = 0xa
-	RT_CACHING_CONTEXT                = 0x1
-	RT_NORTREF                        = 0x2
-	SIOCADDRT                         = 0x8030720a
-	SIOCALIFADDR                      = 0x8118691b
-	SIOCDELRT                         = 0x8030720b
-	SIOCDLIFADDR                      = 0x8118691d
-	SIOCGLIFADDR                      = 0xc118691c
-	SIOCGLIFPHYADDR                   = 0xc118694b
-	SIOCSLIFPHYADDR                   = 0x8118694a
-)
diff --git a/vendor/golang.org/x/sys/unix/errors_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/errors_freebsd_amd64.go
deleted file mode 100644
index 070f44b651..0000000000
--- a/vendor/golang.org/x/sys/unix/errors_freebsd_amd64.go
+++ /dev/null
@@ -1,233 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Constants that were deprecated or moved to enums in the FreeBSD headers. Keep
-// them here for backwards compatibility.
-
-package unix
-
-const (
-	DLT_HHDLC                         = 0x79
-	IFF_SMART                         = 0x20
-	IFT_1822                          = 0x2
-	IFT_A12MPPSWITCH                  = 0x82
-	IFT_AAL2                          = 0xbb
-	IFT_AAL5                          = 0x31
-	IFT_ADSL                          = 0x5e
-	IFT_AFLANE8023                    = 0x3b
-	IFT_AFLANE8025                    = 0x3c
-	IFT_ARAP                          = 0x58
-	IFT_ARCNET                        = 0x23
-	IFT_ARCNETPLUS                    = 0x24
-	IFT_ASYNC                         = 0x54
-	IFT_ATM                           = 0x25
-	IFT_ATMDXI                        = 0x69
-	IFT_ATMFUNI                       = 0x6a
-	IFT_ATMIMA                        = 0x6b
-	IFT_ATMLOGICAL                    = 0x50
-	IFT_ATMRADIO                      = 0xbd
-	IFT_ATMSUBINTERFACE               = 0x86
-	IFT_ATMVCIENDPT                   = 0xc2
-	IFT_ATMVIRTUAL                    = 0x95
-	IFT_BGPPOLICYACCOUNTING           = 0xa2
-	IFT_BSC                           = 0x53
-	IFT_CCTEMUL                       = 0x3d
-	IFT_CEPT                          = 0x13
-	IFT_CES                           = 0x85
-	IFT_CHANNEL                       = 0x46
-	IFT_CNR                           = 0x55
-	IFT_COFFEE                        = 0x84
-	IFT_COMPOSITELINK                 = 0x9b
-	IFT_DCN                           = 0x8d
-	IFT_DIGITALPOWERLINE              = 0x8a
-	IFT_DIGITALWRAPPEROVERHEADCHANNEL = 0xba
-	IFT_DLSW                          = 0x4a
-	IFT_DOCSCABLEDOWNSTREAM           = 0x80
-	IFT_DOCSCABLEMACLAYER             = 0x7f
-	IFT_DOCSCABLEUPSTREAM             = 0x81
-	IFT_DS0                           = 0x51
-	IFT_DS0BUNDLE                     = 0x52
-	IFT_DS1FDL                        = 0xaa
-	IFT_DS3                           = 0x1e
-	IFT_DTM                           = 0x8c
-	IFT_DVBASILN                      = 0xac
-	IFT_DVBASIOUT                     = 0xad
-	IFT_DVBRCCDOWNSTREAM              = 0x93
-	IFT_DVBRCCMACLAYER                = 0x92
-	IFT_DVBRCCUPSTREAM                = 0x94
-	IFT_ENC                           = 0xf4
-	IFT_EON                           = 0x19
-	IFT_EPLRS                         = 0x57
-	IFT_ESCON                         = 0x49
-	IFT_ETHER                         = 0x6
-	IFT_FAITH                         = 0xf2
-	IFT_FAST                          = 0x7d
-	IFT_FASTETHER                     = 0x3e
-	IFT_FASTETHERFX                   = 0x45
-	IFT_FDDI                          = 0xf
-	IFT_FIBRECHANNEL                  = 0x38
-	IFT_FRAMERELAYINTERCONNECT        = 0x3a
-	IFT_FRAMERELAYMPI                 = 0x5c
-	IFT_FRDLCIENDPT                   = 0xc1
-	IFT_FRELAY                        = 0x20
-	IFT_FRELAYDCE                     = 0x2c
-	IFT_FRF16MFRBUNDLE                = 0xa3
-	IFT_FRFORWARD                     = 0x9e
-	IFT_G703AT2MB                     = 0x43
-	IFT_G703AT64K                     = 0x42
-	IFT_GIF                           = 0xf0
-	IFT_GIGABITETHERNET               = 0x75
-	IFT_GR303IDT                      = 0xb2
-	IFT_GR303RDT                      = 0xb1
-	IFT_H323GATEKEEPER                = 0xa4
-	IFT_H323PROXY                     = 0xa5
-	IFT_HDH1822                       = 0x3
-	IFT_HDLC                          = 0x76
-	IFT_HDSL2                         = 0xa8
-	IFT_HIPERLAN2                     = 0xb7
-	IFT_HIPPI                         = 0x2f
-	IFT_HIPPIINTERFACE                = 0x39
-	IFT_HOSTPAD                       = 0x5a
-	IFT_HSSI                          = 0x2e
-	IFT_HY                            = 0xe
-	IFT_IBM370PARCHAN                 = 0x48
-	IFT_IDSL                          = 0x9a
-	IFT_IEEE80211                     = 0x47
-	IFT_IEEE80212                     = 0x37
-	IFT_IEEE8023ADLAG                 = 0xa1
-	IFT_IFGSN                         = 0x91
-	IFT_IMT                           = 0xbe
-	IFT_INTERLEAVE                    = 0x7c
-	IFT_IP                            = 0x7e
-	IFT_IPFORWARD                     = 0x8e
-	IFT_IPOVERATM                     = 0x72
-	IFT_IPOVERCDLC                    = 0x6d
-	IFT_IPOVERCLAW                    = 0x6e
-	IFT_IPSWITCH                      = 0x4e
-	IFT_IPXIP                         = 0xf9
-	IFT_ISDN                          = 0x3f
-	IFT_ISDNBASIC                     = 0x14
-	IFT_ISDNPRIMARY                   = 0x15
-	IFT_ISDNS                         = 0x4b
-	IFT_ISDNU                         = 0x4c
-	IFT_ISO88022LLC                   = 0x29
-	IFT_ISO88023                      = 0x7
-	IFT_ISO88024                      = 0x8
-	IFT_ISO88025                      = 0x9
-	IFT_ISO88025CRFPINT               = 0x62
-	IFT_ISO88025DTR                   = 0x56
-	IFT_ISO88025FIBER                 = 0x73
-	IFT_ISO88026                      = 0xa
-	IFT_ISUP                          = 0xb3
-	IFT_L3IPXVLAN                     = 0x89
-	IFT_LAPB                          = 0x10
-	IFT_LAPD                          = 0x4d
-	IFT_LAPF                          = 0x77
-	IFT_LOCALTALK                     = 0x2a
-	IFT_LOOP                          = 0x18
-	IFT_MEDIAMAILOVERIP               = 0x8b
-	IFT_MFSIGLINK                     = 0xa7
-	IFT_MIOX25                        = 0x26
-	IFT_MODEM                         = 0x30
-	IFT_MPC                           = 0x71
-	IFT_MPLS                          = 0xa6
-	IFT_MPLSTUNNEL                    = 0x96
-	IFT_MSDSL                         = 0x8f
-	IFT_MVL                           = 0xbf
-	IFT_MYRINET                       = 0x63
-	IFT_NFAS                          = 0xaf
-	IFT_NSIP                          = 0x1b
-	IFT_OPTICALCHANNEL                = 0xc3
-	IFT_OPTICALTRANSPORT              = 0xc4
-	IFT_OTHER                         = 0x1
-	IFT_P10                           = 0xc
-	IFT_P80                           = 0xd
-	IFT_PARA                          = 0x22
-	IFT_PFLOG                         = 0xf6
-	IFT_PFSYNC                        = 0xf7
-	IFT_PLC                           = 0xae
-	IFT_POS                           = 0xab
-	IFT_PPPMULTILINKBUNDLE            = 0x6c
-	IFT_PROPBWAP2MP                   = 0xb8
-	IFT_PROPCNLS                      = 0x59
-	IFT_PROPDOCSWIRELESSDOWNSTREAM    = 0xb5
-	IFT_PROPDOCSWIRELESSMACLAYER      = 0xb4
-	IFT_PROPDOCSWIRELESSUPSTREAM      = 0xb6
-	IFT_PROPMUX                       = 0x36
-	IFT_PROPWIRELESSP2P               = 0x9d
-	IFT_PTPSERIAL                     = 0x16
-	IFT_PVC                           = 0xf1
-	IFT_QLLC                          = 0x44
-	IFT_RADIOMAC                      = 0xbc
-	IFT_RADSL                         = 0x5f
-	IFT_REACHDSL                      = 0xc0
-	IFT_RFC1483                       = 0x9f
-	IFT_RS232                         = 0x21
-	IFT_RSRB                          = 0x4f
-	IFT_SDLC                          = 0x11
-	IFT_SDSL                          = 0x60
-	IFT_SHDSL                         = 0xa9
-	IFT_SIP                           = 0x1f
-	IFT_SLIP                          = 0x1c
-	IFT_SMDSDXI                       = 0x2b
-	IFT_SMDSICIP                      = 0x34
-	IFT_SONET                         = 0x27
-	IFT_SONETOVERHEADCHANNEL          = 0xb9
-	IFT_SONETPATH                     = 0x32
-	IFT_SONETVT                       = 0x33
-	IFT_SRP                           = 0x97
-	IFT_SS7SIGLINK                    = 0x9c
-	IFT_STACKTOSTACK                  = 0x6f
-	IFT_STARLAN                       = 0xb
-	IFT_STF                           = 0xd7
-	IFT_T1                            = 0x12
-	IFT_TDLC                          = 0x74
-	IFT_TERMPAD                       = 0x5b
-	IFT_TR008                         = 0xb0
-	IFT_TRANSPHDLC                    = 0x7b
-	IFT_TUNNEL                        = 0x83
-	IFT_ULTRA                         = 0x1d
-	IFT_USB                           = 0xa0
-	IFT_V11                           = 0x40
-	IFT_V35                           = 0x2d
-	IFT_V36                           = 0x41
-	IFT_V37                           = 0x78
-	IFT_VDSL                          = 0x61
-	IFT_VIRTUALIPADDRESS              = 0x70
-	IFT_VOICEEM                       = 0x64
-	IFT_VOICEENCAP                    = 0x67
-	IFT_VOICEFXO                      = 0x65
-	IFT_VOICEFXS                      = 0x66
-	IFT_VOICEOVERATM                  = 0x98
-	IFT_VOICEOVERFRAMERELAY           = 0x99
-	IFT_VOICEOVERIP                   = 0x68
-	IFT_X213                          = 0x5d
-	IFT_X25                           = 0x5
-	IFT_X25DDN                        = 0x4
-	IFT_X25HUNTGROUP                  = 0x7a
-	IFT_X25MLP                        = 0x79
-	IFT_X25PLE                        = 0x28
-	IFT_XETHER                        = 0x1a
-	IPPROTO_MAXID                     = 0x34
-	IPV6_FAITH                        = 0x1d
-	IPV6_MIN_MEMBERSHIPS              = 0x1f
-	IP_FAITH                          = 0x16
-	IP_MAX_SOURCE_FILTER              = 0x400
-	IP_MIN_MEMBERSHIPS                = 0x1f
-	MAP_NORESERVE                     = 0x40
-	MAP_RENAME                        = 0x20
-	NET_RT_MAXID                      = 0x6
-	RTF_PRCLONING                     = 0x10000
-	RTM_OLDADD                        = 0x9
-	RTM_OLDDEL                        = 0xa
-	RT_CACHING_CONTEXT                = 0x1
-	RT_NORTREF                        = 0x2
-	SIOCADDRT                         = 0x8040720a
-	SIOCALIFADDR                      = 0x8118691b
-	SIOCDELRT                         = 0x8040720b
-	SIOCDLIFADDR                      = 0x8118691d
-	SIOCGLIFADDR                      = 0xc118691c
-	SIOCGLIFPHYADDR                   = 0xc118694b
-	SIOCSLIFPHYADDR                   = 0x8118694a
-)
diff --git a/vendor/golang.org/x/sys/unix/errors_freebsd_arm.go b/vendor/golang.org/x/sys/unix/errors_freebsd_arm.go
deleted file mode 100644
index 856dca3254..0000000000
--- a/vendor/golang.org/x/sys/unix/errors_freebsd_arm.go
+++ /dev/null
@@ -1,226 +0,0 @@
-// Copyright 2017 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package unix
-
-const (
-	IFT_1822                          = 0x2
-	IFT_A12MPPSWITCH                  = 0x82
-	IFT_AAL2                          = 0xbb
-	IFT_AAL5                          = 0x31
-	IFT_ADSL                          = 0x5e
-	IFT_AFLANE8023                    = 0x3b
-	IFT_AFLANE8025                    = 0x3c
-	IFT_ARAP                          = 0x58
-	IFT_ARCNET                        = 0x23
-	IFT_ARCNETPLUS                    = 0x24
-	IFT_ASYNC                         = 0x54
-	IFT_ATM                           = 0x25
-	IFT_ATMDXI                        = 0x69
-	IFT_ATMFUNI                       = 0x6a
-	IFT_ATMIMA                        = 0x6b
-	IFT_ATMLOGICAL                    = 0x50
-	IFT_ATMRADIO                      = 0xbd
-	IFT_ATMSUBINTERFACE               = 0x86
-	IFT_ATMVCIENDPT                   = 0xc2
-	IFT_ATMVIRTUAL                    = 0x95
-	IFT_BGPPOLICYACCOUNTING           = 0xa2
-	IFT_BSC                           = 0x53
-	IFT_CCTEMUL                       = 0x3d
-	IFT_CEPT                          = 0x13
-	IFT_CES                           = 0x85
-	IFT_CHANNEL                       = 0x46
-	IFT_CNR                           = 0x55
-	IFT_COFFEE                        = 0x84
-	IFT_COMPOSITELINK                 = 0x9b
-	IFT_DCN                           = 0x8d
-	IFT_DIGITALPOWERLINE              = 0x8a
-	IFT_DIGITALWRAPPEROVERHEADCHANNEL = 0xba
-	IFT_DLSW                          = 0x4a
-	IFT_DOCSCABLEDOWNSTREAM           = 0x80
-	IFT_DOCSCABLEMACLAYER             = 0x7f
-	IFT_DOCSCABLEUPSTREAM             = 0x81
-	IFT_DS0                           = 0x51
-	IFT_DS0BUNDLE                     = 0x52
-	IFT_DS1FDL                        = 0xaa
-	IFT_DS3                           = 0x1e
-	IFT_DTM                           = 0x8c
-	IFT_DVBASILN                      = 0xac
-	IFT_DVBASIOUT                     = 0xad
-	IFT_DVBRCCDOWNSTREAM              = 0x93
-	IFT_DVBRCCMACLAYER                = 0x92
-	IFT_DVBRCCUPSTREAM                = 0x94
-	IFT_ENC                           = 0xf4
-	IFT_EON                           = 0x19
-	IFT_EPLRS                         = 0x57
-	IFT_ESCON                         = 0x49
-	IFT_ETHER                         = 0x6
-	IFT_FAST                          = 0x7d
-	IFT_FASTETHER                     = 0x3e
-	IFT_FASTETHERFX                   = 0x45
-	IFT_FDDI                          = 0xf
-	IFT_FIBRECHANNEL                  = 0x38
-	IFT_FRAMERELAYINTERCONNECT        = 0x3a
-	IFT_FRAMERELAYMPI                 = 0x5c
-	IFT_FRDLCIENDPT                   = 0xc1
-	IFT_FRELAY                        = 0x20
-	IFT_FRELAYDCE                     = 0x2c
-	IFT_FRF16MFRBUNDLE                = 0xa3
-	IFT_FRFORWARD                     = 0x9e
-	IFT_G703AT2MB                     = 0x43
-	IFT_G703AT64K                     = 0x42
-	IFT_GIF                           = 0xf0
-	IFT_GIGABITETHERNET               = 0x75
-	IFT_GR303IDT                      = 0xb2
-	IFT_GR303RDT                      = 0xb1
-	IFT_H323GATEKEEPER                = 0xa4
-	IFT_H323PROXY                     = 0xa5
-	IFT_HDH1822                       = 0x3
-	IFT_HDLC                          = 0x76
-	IFT_HDSL2                         = 0xa8
-	IFT_HIPERLAN2                     = 0xb7
-	IFT_HIPPI                         = 0x2f
-	IFT_HIPPIINTERFACE                = 0x39
-	IFT_HOSTPAD                       = 0x5a
-	IFT_HSSI                          = 0x2e
-	IFT_HY                            = 0xe
-	IFT_IBM370PARCHAN                 = 0x48
-	IFT_IDSL                          = 0x9a
-	IFT_IEEE80211                     = 0x47
-	IFT_IEEE80212                     = 0x37
-	IFT_IEEE8023ADLAG                 = 0xa1
-	IFT_IFGSN                         = 0x91
-	IFT_IMT                           = 0xbe
-	IFT_INTERLEAVE                    = 0x7c
-	IFT_IP                            = 0x7e
-	IFT_IPFORWARD                     = 0x8e
-	IFT_IPOVERATM                     = 0x72
-	IFT_IPOVERCDLC                    = 0x6d
-	IFT_IPOVERCLAW                    = 0x6e
-	IFT_IPSWITCH                      = 0x4e
-	IFT_ISDN                          = 0x3f
-	IFT_ISDNBASIC                     = 0x14
-	IFT_ISDNPRIMARY                   = 0x15
-	IFT_ISDNS                         = 0x4b
-	IFT_ISDNU                         = 0x4c
-	IFT_ISO88022LLC                   = 0x29
-	IFT_ISO88023                      = 0x7
-	IFT_ISO88024                      = 0x8
-	IFT_ISO88025                      = 0x9
-	IFT_ISO88025CRFPINT               = 0x62
-	IFT_ISO88025DTR                   = 0x56
-	IFT_ISO88025FIBER                 = 0x73
-	IFT_ISO88026                      = 0xa
-	IFT_ISUP                          = 0xb3
-	IFT_L3IPXVLAN                     = 0x89
-	IFT_LAPB                          = 0x10
-	IFT_LAPD                          = 0x4d
-	IFT_LAPF                          = 0x77
-	IFT_LOCALTALK                     = 0x2a
-	IFT_LOOP                          = 0x18
-	IFT_MEDIAMAILOVERIP               = 0x8b
-	IFT_MFSIGLINK                     = 0xa7
-	IFT_MIOX25                        = 0x26
-	IFT_MODEM                         = 0x30
-	IFT_MPC                           = 0x71
-	IFT_MPLS                          = 0xa6
-	IFT_MPLSTUNNEL                    = 0x96
-	IFT_MSDSL                         = 0x8f
-	IFT_MVL                           = 0xbf
-	IFT_MYRINET                       = 0x63
-	IFT_NFAS                          = 0xaf
-	IFT_NSIP                          = 0x1b
-	IFT_OPTICALCHANNEL                = 0xc3
-	IFT_OPTICALTRANSPORT              = 0xc4
-	IFT_OTHER                         = 0x1
-	IFT_P10                           = 0xc
-	IFT_P80                           = 0xd
-	IFT_PARA                          = 0x22
-	IFT_PFLOG                         = 0xf6
-	IFT_PFSYNC                        = 0xf7
-	IFT_PLC                           = 0xae
-	IFT_POS                           = 0xab
-	IFT_PPPMULTILINKBUNDLE            = 0x6c
-	IFT_PROPBWAP2MP                   = 0xb8
-	IFT_PROPCNLS                      = 0x59
-	IFT_PROPDOCSWIRELESSDOWNSTREAM    = 0xb5
-	IFT_PROPDOCSWIRELESSMACLAYER      = 0xb4
-	IFT_PROPDOCSWIRELESSUPSTREAM      = 0xb6
-	IFT_PROPMUX                       = 0x36
-	IFT_PROPWIRELESSP2P               = 0x9d
-	IFT_PTPSERIAL                     = 0x16
-	IFT_PVC                           = 0xf1
-	IFT_QLLC                          = 0x44
-	IFT_RADIOMAC                      = 0xbc
-	IFT_RADSL                         = 0x5f
-	IFT_REACHDSL                      = 0xc0
-	IFT_RFC1483                       = 0x9f
-	IFT_RS232                         = 0x21
-	IFT_RSRB                          = 0x4f
-	IFT_SDLC                          = 0x11
-	IFT_SDSL                          = 0x60
-	IFT_SHDSL                         = 0xa9
-	IFT_SIP                           = 0x1f
-	IFT_SLIP                          = 0x1c
-	IFT_SMDSDXI                       = 0x2b
-	IFT_SMDSICIP                      = 0x34
-	IFT_SONET                         = 0x27
-	IFT_SONETOVERHEADCHANNEL          = 0xb9
-	IFT_SONETPATH                     = 0x32
-	IFT_SONETVT                       = 0x33
-	IFT_SRP                           = 0x97
-	IFT_SS7SIGLINK                    = 0x9c
-	IFT_STACKTOSTACK                  = 0x6f
-	IFT_STARLAN                       = 0xb
-	IFT_STF                           = 0xd7
-	IFT_T1                            = 0x12
-	IFT_TDLC                          = 0x74
-	IFT_TERMPAD                       = 0x5b
-	IFT_TR008                         = 0xb0
-	IFT_TRANSPHDLC                    = 0x7b
-	IFT_TUNNEL                        = 0x83
-	IFT_ULTRA                         = 0x1d
-	IFT_USB                           = 0xa0
-	IFT_V11                           = 0x40
-	IFT_V35                           = 0x2d
-	IFT_V36                           = 0x41
-	IFT_V37                           = 0x78
-	IFT_VDSL                          = 0x61
-	IFT_VIRTUALIPADDRESS              = 0x70
-	IFT_VOICEEM                       = 0x64
-	IFT_VOICEENCAP                    = 0x67
-	IFT_VOICEFXO                      = 0x65
-	IFT_VOICEFXS                      = 0x66
-	IFT_VOICEOVERATM                  = 0x98
-	IFT_VOICEOVERFRAMERELAY           = 0x99
-	IFT_VOICEOVERIP                   = 0x68
-	IFT_X213                          = 0x5d
-	IFT_X25                           = 0x5
-	IFT_X25DDN                        = 0x4
-	IFT_X25HUNTGROUP                  = 0x7a
-	IFT_X25MLP                        = 0x79
-	IFT_X25PLE                        = 0x28
-	IFT_XETHER                        = 0x1a
-
-	// missing constants on FreeBSD-11.1-RELEASE, copied from old values in ztypes_freebsd_arm.go
-	IFF_SMART       = 0x20
-	IFT_FAITH       = 0xf2
-	IFT_IPXIP       = 0xf9
-	IPPROTO_MAXID   = 0x34
-	IPV6_FAITH      = 0x1d
-	IP_FAITH        = 0x16
-	MAP_NORESERVE   = 0x40
-	MAP_RENAME      = 0x20
-	NET_RT_MAXID    = 0x6
-	RTF_PRCLONING   = 0x10000
-	RTM_OLDADD      = 0x9
-	RTM_OLDDEL      = 0xa
-	SIOCADDRT       = 0x8030720a
-	SIOCALIFADDR    = 0x8118691b
-	SIOCDELRT       = 0x8030720b
-	SIOCDLIFADDR    = 0x8118691d
-	SIOCGLIFADDR    = 0xc118691c
-	SIOCGLIFPHYADDR = 0xc118694b
-	SIOCSLIFPHYADDR = 0x8118694a
-)
diff --git a/vendor/golang.org/x/sys/unix/errors_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/errors_freebsd_arm64.go
deleted file mode 100644
index 946dcf3fc7..0000000000
--- a/vendor/golang.org/x/sys/unix/errors_freebsd_arm64.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2020 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Constants that were deprecated or moved to enums in the FreeBSD headers. Keep
-// them here for backwards compatibility.
-
-package unix
-
-const (
-	DLT_HHDLC            = 0x79
-	IPV6_MIN_MEMBERSHIPS = 0x1f
-	IP_MAX_SOURCE_FILTER = 0x400
-	IP_MIN_MEMBERSHIPS   = 0x1f
-	RT_CACHING_CONTEXT   = 0x1
-	RT_NORTREF           = 0x2
-)
diff --git a/vendor/golang.org/x/sys/unix/gccgo.go b/vendor/golang.org/x/sys/unix/gccgo.go
index 0dee23222c..b06f52d748 100644
--- a/vendor/golang.org/x/sys/unix/gccgo.go
+++ b/vendor/golang.org/x/sys/unix/gccgo.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build gccgo && !aix
-// +build gccgo,!aix
+//go:build gccgo && !aix && !hurd
+// +build gccgo,!aix,!hurd
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/gccgo_c.c b/vendor/golang.org/x/sys/unix/gccgo_c.c
index 2cb1fefac6..f98a1c542f 100644
--- a/vendor/golang.org/x/sys/unix/gccgo_c.c
+++ b/vendor/golang.org/x/sys/unix/gccgo_c.c
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build gccgo
-// +build !aix
+//go:build gccgo && !aix && !hurd
+// +build gccgo,!aix,!hurd
 
 #include <errno.h>
 #include <stdint.h>
diff --git a/vendor/golang.org/x/sys/unix/ifreq_linux.go b/vendor/golang.org/x/sys/unix/ifreq_linux.go
index 934af313c3..15721a5104 100644
--- a/vendor/golang.org/x/sys/unix/ifreq_linux.go
+++ b/vendor/golang.org/x/sys/unix/ifreq_linux.go
@@ -8,7 +8,6 @@
 package unix
 
 import (
-	"bytes"
 	"unsafe"
 )
 
@@ -45,13 +44,7 @@ func NewIfreq(name string) (*Ifreq, error) {
 
 // Name returns the interface name associated with the Ifreq.
 func (ifr *Ifreq) Name() string {
-	// BytePtrToString requires a NULL terminator or the program may crash. If
-	// one is not present, just return the empty string.
-	if !bytes.Contains(ifr.raw.Ifrn[:], []byte{0x00}) {
-		return ""
-	}
-
-	return BytePtrToString(&ifr.raw.Ifrn[0])
+	return ByteSliceToString(ifr.raw.Ifrn[:])
 }
 
 // According to netdevice(7), only AF_INET addresses are returned for numerous
diff --git a/vendor/golang.org/x/sys/unix/ioctl.go b/vendor/golang.org/x/sys/unix/ioctl.go
deleted file mode 100644
index 6c7ad052e6..0000000000
--- a/vendor/golang.org/x/sys/unix/ioctl.go
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
-
-package unix
-
-import (
-	"runtime"
-	"unsafe"
-)
-
-// ioctl itself should not be exposed directly, but additional get/set
-// functions for specific types are permissible.
-
-// IoctlSetInt performs an ioctl operation which sets an integer value
-// on fd, using the specified request number.
-func IoctlSetInt(fd int, req uint, value int) error {
-	return ioctl(fd, req, uintptr(value))
-}
-
-// IoctlSetPointerInt performs an ioctl operation which sets an
-// integer value on fd, using the specified request number. The ioctl
-// argument is called with a pointer to the integer value, rather than
-// passing the integer value directly.
-func IoctlSetPointerInt(fd int, req uint, value int) error {
-	v := int32(value)
-	return ioctl(fd, req, uintptr(unsafe.Pointer(&v)))
-}
-
-// IoctlSetWinsize performs an ioctl on fd with a *Winsize argument.
-//
-// To change fd's window size, the req argument should be TIOCSWINSZ.
-func IoctlSetWinsize(fd int, req uint, value *Winsize) error {
-	// TODO: if we get the chance, remove the req parameter and
-	// hardcode TIOCSWINSZ.
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(value)))
-	runtime.KeepAlive(value)
-	return err
-}
-
-// IoctlSetTermios performs an ioctl on fd with a *Termios.
-//
-// The req value will usually be TCSETA or TIOCSETA.
-func IoctlSetTermios(fd int, req uint, value *Termios) error {
-	// TODO: if we get the chance, remove the req parameter.
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(value)))
-	runtime.KeepAlive(value)
-	return err
-}
-
-// IoctlGetInt performs an ioctl operation which gets an integer value
-// from fd, using the specified request number.
-//
-// A few ioctl requests use the return value as an output parameter;
-// for those, IoctlRetInt should be used instead of this function.
-func IoctlGetInt(fd int, req uint) (int, error) {
-	var value int
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
-	return value, err
-}
-
-func IoctlGetWinsize(fd int, req uint) (*Winsize, error) {
-	var value Winsize
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
-	return &value, err
-}
-
-func IoctlGetTermios(fd int, req uint) (*Termios, error) {
-	var value Termios
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
-	return &value, err
-}
diff --git a/vendor/golang.org/x/sys/unix/ioctl_linux.go b/vendor/golang.org/x/sys/unix/ioctl_linux.go
index 1dadead21e..0d12c0851a 100644
--- a/vendor/golang.org/x/sys/unix/ioctl_linux.go
+++ b/vendor/golang.org/x/sys/unix/ioctl_linux.go
@@ -4,9 +4,7 @@
 
 package unix
 
-import (
-	"unsafe"
-)
+import "unsafe"
 
 // IoctlRetInt performs an ioctl operation specified by req on a device
 // associated with opened file descriptor fd, and returns a non-negative
@@ -194,3 +192,42 @@ func ioctlIfreqData(fd int, req uint, value *ifreqData) error {
 	// identical so pass *IfreqData directly.
 	return ioctlPtr(fd, req, unsafe.Pointer(value))
 }
+
+// IoctlKCMClone attaches a new file descriptor to a multiplexor by cloning an
+// existing KCM socket, returning a structure containing the file descriptor of
+// the new socket.
+func IoctlKCMClone(fd int) (*KCMClone, error) {
+	var info KCMClone
+	if err := ioctlPtr(fd, SIOCKCMCLONE, unsafe.Pointer(&info)); err != nil {
+		return nil, err
+	}
+
+	return &info, nil
+}
+
+// IoctlKCMAttach attaches a TCP socket and associated BPF program file
+// descriptor to a multiplexor.
+func IoctlKCMAttach(fd int, info KCMAttach) error {
+	return ioctlPtr(fd, SIOCKCMATTACH, unsafe.Pointer(&info))
+}
+
+// IoctlKCMUnattach unattaches a TCP socket file descriptor from a multiplexor.
+func IoctlKCMUnattach(fd int, info KCMUnattach) error {
+	return ioctlPtr(fd, SIOCKCMUNATTACH, unsafe.Pointer(&info))
+}
+
+// IoctlLoopGetStatus64 gets the status of the loop device associated with the
+// file descriptor fd using the LOOP_GET_STATUS64 operation.
+func IoctlLoopGetStatus64(fd int) (*LoopInfo64, error) {
+	var value LoopInfo64
+	if err := ioctlPtr(fd, LOOP_GET_STATUS64, unsafe.Pointer(&value)); err != nil {
+		return nil, err
+	}
+	return &value, nil
+}
+
+// IoctlLoopSetStatus64 sets the status of the loop device associated with the
+// file descriptor fd using the LOOP_SET_STATUS64 operation.
+func IoctlLoopSetStatus64(fd int, value *LoopInfo64) error {
+	return ioctlPtr(fd, LOOP_SET_STATUS64, unsafe.Pointer(value))
+}
diff --git a/vendor/golang.org/x/sys/unix/ioctl_signed.go b/vendor/golang.org/x/sys/unix/ioctl_signed.go
new file mode 100644
index 0000000000..7def9580e6
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/ioctl_signed.go
@@ -0,0 +1,70 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build aix || solaris
+// +build aix solaris
+
+package unix
+
+import (
+	"unsafe"
+)
+
+// ioctl itself should not be exposed directly, but additional get/set
+// functions for specific types are permissible.
+
+// IoctlSetInt performs an ioctl operation which sets an integer value
+// on fd, using the specified request number.
+func IoctlSetInt(fd int, req int, value int) error {
+	return ioctl(fd, req, uintptr(value))
+}
+
+// IoctlSetPointerInt performs an ioctl operation which sets an
+// integer value on fd, using the specified request number. The ioctl
+// argument is called with a pointer to the integer value, rather than
+// passing the integer value directly.
+func IoctlSetPointerInt(fd int, req int, value int) error {
+	v := int32(value)
+	return ioctlPtr(fd, req, unsafe.Pointer(&v))
+}
+
+// IoctlSetWinsize performs an ioctl on fd with a *Winsize argument.
+//
+// To change fd's window size, the req argument should be TIOCSWINSZ.
+func IoctlSetWinsize(fd int, req int, value *Winsize) error {
+	// TODO: if we get the chance, remove the req parameter and
+	// hardcode TIOCSWINSZ.
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+// IoctlSetTermios performs an ioctl on fd with a *Termios.
+//
+// The req value will usually be TCSETA or TIOCSETA.
+func IoctlSetTermios(fd int, req int, value *Termios) error {
+	// TODO: if we get the chance, remove the req parameter.
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+// IoctlGetInt performs an ioctl operation which gets an integer value
+// from fd, using the specified request number.
+//
+// A few ioctl requests use the return value as an output parameter;
+// for those, IoctlRetInt should be used instead of this function.
+func IoctlGetInt(fd int, req int) (int, error) {
+	var value int
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return value, err
+}
+
+func IoctlGetWinsize(fd int, req int) (*Winsize, error) {
+	var value Winsize
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return &value, err
+}
+
+func IoctlGetTermios(fd int, req int) (*Termios, error) {
+	var value Termios
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return &value, err
+}
diff --git a/vendor/golang.org/x/sys/unix/ioctl_unsigned.go b/vendor/golang.org/x/sys/unix/ioctl_unsigned.go
new file mode 100644
index 0000000000..649913d1ea
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/ioctl_unsigned.go
@@ -0,0 +1,70 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build darwin || dragonfly || freebsd || hurd || linux || netbsd || openbsd
+// +build darwin dragonfly freebsd hurd linux netbsd openbsd
+
+package unix
+
+import (
+	"unsafe"
+)
+
+// ioctl itself should not be exposed directly, but additional get/set
+// functions for specific types are permissible.
+
+// IoctlSetInt performs an ioctl operation which sets an integer value
+// on fd, using the specified request number.
+func IoctlSetInt(fd int, req uint, value int) error {
+	return ioctl(fd, req, uintptr(value))
+}
+
+// IoctlSetPointerInt performs an ioctl operation which sets an
+// integer value on fd, using the specified request number. The ioctl
+// argument is called with a pointer to the integer value, rather than
+// passing the integer value directly.
+func IoctlSetPointerInt(fd int, req uint, value int) error {
+	v := int32(value)
+	return ioctlPtr(fd, req, unsafe.Pointer(&v))
+}
+
+// IoctlSetWinsize performs an ioctl on fd with a *Winsize argument.
+//
+// To change fd's window size, the req argument should be TIOCSWINSZ.
+func IoctlSetWinsize(fd int, req uint, value *Winsize) error {
+	// TODO: if we get the chance, remove the req parameter and
+	// hardcode TIOCSWINSZ.
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+// IoctlSetTermios performs an ioctl on fd with a *Termios.
+//
+// The req value will usually be TCSETA or TIOCSETA.
+func IoctlSetTermios(fd int, req uint, value *Termios) error {
+	// TODO: if we get the chance, remove the req parameter.
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+// IoctlGetInt performs an ioctl operation which gets an integer value
+// from fd, using the specified request number.
+//
+// A few ioctl requests use the return value as an output parameter;
+// for those, IoctlRetInt should be used instead of this function.
+func IoctlGetInt(fd int, req uint) (int, error) {
+	var value int
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return value, err
+}
+
+func IoctlGetWinsize(fd int, req uint) (*Winsize, error) {
+	var value Winsize
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return &value, err
+}
+
+func IoctlGetTermios(fd int, req uint) (*Termios, error) {
+	var value Termios
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return &value, err
+}
diff --git a/vendor/golang.org/x/sys/unix/ioctl_zos.go b/vendor/golang.org/x/sys/unix/ioctl_zos.go
index 5384e7d91d..cdc21bf76d 100644
--- a/vendor/golang.org/x/sys/unix/ioctl_zos.go
+++ b/vendor/golang.org/x/sys/unix/ioctl_zos.go
@@ -17,25 +17,23 @@ import (
 
 // IoctlSetInt performs an ioctl operation which sets an integer value
 // on fd, using the specified request number.
-func IoctlSetInt(fd int, req uint, value int) error {
+func IoctlSetInt(fd int, req int, value int) error {
 	return ioctl(fd, req, uintptr(value))
 }
 
 // IoctlSetWinsize performs an ioctl on fd with a *Winsize argument.
 //
 // To change fd's window size, the req argument should be TIOCSWINSZ.
-func IoctlSetWinsize(fd int, req uint, value *Winsize) error {
+func IoctlSetWinsize(fd int, req int, value *Winsize) error {
 	// TODO: if we get the chance, remove the req parameter and
 	// hardcode TIOCSWINSZ.
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(value)))
-	runtime.KeepAlive(value)
-	return err
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
 }
 
 // IoctlSetTermios performs an ioctl on fd with a *Termios.
 //
 // The req value is expected to be TCSETS, TCSETSW, or TCSETSF
-func IoctlSetTermios(fd int, req uint, value *Termios) error {
+func IoctlSetTermios(fd int, req int, value *Termios) error {
 	if (req != TCSETS) && (req != TCSETSW) && (req != TCSETSF) {
 		return ENOSYS
 	}
@@ -49,22 +47,22 @@ func IoctlSetTermios(fd int, req uint, value *Termios) error {
 //
 // A few ioctl requests use the return value as an output parameter;
 // for those, IoctlRetInt should be used instead of this function.
-func IoctlGetInt(fd int, req uint) (int, error) {
+func IoctlGetInt(fd int, req int) (int, error) {
 	var value int
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return value, err
 }
 
-func IoctlGetWinsize(fd int, req uint) (*Winsize, error) {
+func IoctlGetWinsize(fd int, req int) (*Winsize, error) {
 	var value Winsize
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return &value, err
 }
 
 // IoctlGetTermios performs an ioctl on fd with a *Termios.
 //
 // The req value is expected to be TCGETS
-func IoctlGetTermios(fd int, req uint) (*Termios, error) {
+func IoctlGetTermios(fd int, req int) (*Termios, error) {
 	var value Termios
 	if req != TCGETS {
 		return &value, ENOSYS
diff --git a/vendor/golang.org/x/sys/unix/mkall.sh b/vendor/golang.org/x/sys/unix/mkall.sh
index 396aadf86d..8e3947c368 100644
--- a/vendor/golang.org/x/sys/unix/mkall.sh
+++ b/vendor/golang.org/x/sys/unix/mkall.sh
@@ -50,7 +50,7 @@ if [[ "$GOOS" = "linux" ]]; then
 	# Use the Docker-based build system
 	# Files generated through docker (use $cmd so you can Ctl-C the build or run)
 	$cmd docker build --tag generate:$GOOS $GOOS
-	$cmd docker run --interactive --tty --volume $(cd -- "$(dirname -- "$0")" && /bin/pwd):/build generate:$GOOS
+	$cmd docker run --interactive --tty --volume $(cd -- "$(dirname -- "$0")/.." && /bin/pwd):/build generate:$GOOS
 	exit
 fi
 
@@ -73,12 +73,12 @@ aix_ppc64)
 darwin_amd64)
 	mkerrors="$mkerrors -m64"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
-	mkasm="go run mkasm_darwin.go"
+	mkasm="go run mkasm.go"
 	;;
 darwin_arm64)
 	mkerrors="$mkerrors -m64"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
-	mkasm="go run mkasm_darwin.go"
+	mkasm="go run mkasm.go"
 	;;
 dragonfly_amd64)
 	mkerrors="$mkerrors -m64"
@@ -89,25 +89,30 @@ dragonfly_amd64)
 freebsd_386)
 	mkerrors="$mkerrors -m32"
 	mksyscall="go run mksyscall.go -l32"
-	mksysnum="go run mksysnum.go 'https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master'"
+	mksysnum="go run mksysnum.go 'https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12'"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
 	;;
 freebsd_amd64)
 	mkerrors="$mkerrors -m64"
-	mksysnum="go run mksysnum.go 'https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master'"
+	mksysnum="go run mksysnum.go 'https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12'"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
 	;;
 freebsd_arm)
 	mkerrors="$mkerrors"
 	mksyscall="go run mksyscall.go -l32 -arm"
-	mksysnum="go run mksysnum.go 'https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master'"
+	mksysnum="go run mksysnum.go 'https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12'"
 	# Let the type of C char be signed for making the bare syscall
 	# API consistent across platforms.
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
 	;;
 freebsd_arm64)
 	mkerrors="$mkerrors -m64"
-	mksysnum="go run mksysnum.go 'https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master'"
+	mksysnum="go run mksysnum.go 'https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12'"
+	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
+	;;
+freebsd_riscv64)
+	mkerrors="$mkerrors -m64"
+	mksysnum="go run mksysnum.go 'https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12'"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
 	;;
 netbsd_386)
@@ -137,42 +142,60 @@ netbsd_arm64)
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
 	;;
 openbsd_386)
+	mkasm="go run mkasm.go"
 	mkerrors="$mkerrors -m32"
-	mksyscall="go run mksyscall.go -l32 -openbsd"
+	mksyscall="go run mksyscall.go -l32 -openbsd -libc"
 	mksysctl="go run mksysctl_openbsd.go"
-	mksysnum="go run mksysnum.go 'https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master'"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
 	;;
 openbsd_amd64)
+	mkasm="go run mkasm.go"
 	mkerrors="$mkerrors -m64"
-	mksyscall="go run mksyscall.go -openbsd"
+	mksyscall="go run mksyscall.go -openbsd -libc"
 	mksysctl="go run mksysctl_openbsd.go"
-	mksysnum="go run mksysnum.go 'https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master'"
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs"
 	;;
 openbsd_arm)
+	mkasm="go run mkasm.go"
 	mkerrors="$mkerrors"
-	mksyscall="go run mksyscall.go -l32 -openbsd -arm"
+	mksyscall="go run mksyscall.go -l32 -openbsd -arm -libc"
 	mksysctl="go run mksysctl_openbsd.go"
-	mksysnum="go run mksysnum.go 'https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master'"
 	# Let the type of C char be signed for making the bare syscall
 	# API consistent across platforms.
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
 	;;
 openbsd_arm64)
+	mkasm="go run mkasm.go"
 	mkerrors="$mkerrors -m64"
-	mksyscall="go run mksyscall.go -openbsd"
+	mksyscall="go run mksyscall.go -openbsd -libc"
 	mksysctl="go run mksysctl_openbsd.go"
-	mksysnum="go run mksysnum.go 'https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master'"
 	# Let the type of C char be signed for making the bare syscall
 	# API consistent across platforms.
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
 	;;
 openbsd_mips64)
+	mkasm="go run mkasm.go"
+	mkerrors="$mkerrors -m64"
+	mksyscall="go run mksyscall.go -openbsd -libc"
+	mksysctl="go run mksysctl_openbsd.go"
+	# Let the type of C char be signed for making the bare syscall
+	# API consistent across platforms.
+	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
+	;;
+openbsd_ppc64)
+	mkasm="go run mkasm.go"
+	mkerrors="$mkerrors -m64"
+	mksyscall="go run mksyscall.go -openbsd -libc"
+	mksysctl="go run mksysctl_openbsd.go"
+	# Let the type of C char be signed for making the bare syscall
+	# API consistent across platforms.
+	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
+	;;
+openbsd_riscv64)
+	mkasm="go run mkasm.go"
 	mkerrors="$mkerrors -m64"
-	mksyscall="go run mksyscall.go -openbsd"
+	mksyscall="go run mksyscall.go -openbsd -libc"
 	mksysctl="go run mksysctl_openbsd.go"
-	mksysnum="go run mksysnum.go 'https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master'"
 	# Let the type of C char be signed for making the bare syscall
 	# API consistent across platforms.
 	mktypes="GOARCH=$GOARCH go tool cgo -godefs -- -fsigned-char"
@@ -209,11 +232,6 @@ esac
 			if [ "$GOOSARCH" == "aix_ppc64" ]; then
 				# aix/ppc64 script generates files instead of writing to stdin.
 				echo "$mksyscall -tags $GOOS,$GOARCH $syscall_goos $GOOSARCH_in && gofmt -w zsyscall_$GOOSARCH.go && gofmt -w zsyscall_"$GOOSARCH"_gccgo.go && gofmt -w zsyscall_"$GOOSARCH"_gc.go " ;
-			elif [ "$GOOS" == "darwin" ]; then
-			        # 1.12 and later, syscalls via libSystem
-				echo "$mksyscall -tags $GOOS,$GOARCH,go1.12 $syscall_goos $GOOSARCH_in |gofmt >zsyscall_$GOOSARCH.go";
-				# 1.13 and later, syscalls via libSystem (including syscallPtr)
-				echo "$mksyscall -tags $GOOS,$GOARCH,go1.13 syscall_darwin.1_13.go |gofmt >zsyscall_$GOOSARCH.1_13.go";
 			elif [ "$GOOS" == "illumos" ]; then
 			        # illumos code generation requires a --illumos switch
 			        echo "$mksyscall -illumos -tags illumos,$GOARCH syscall_illumos.go |gofmt > zsyscall_illumos_$GOARCH.go";
@@ -227,5 +245,5 @@ esac
 	if [ -n "$mksysctl" ]; then echo "$mksysctl |gofmt >$zsysctl"; fi
 	if [ -n "$mksysnum" ]; then echo "$mksysnum |gofmt >zsysnum_$GOOSARCH.go"; fi
 	if [ -n "$mktypes" ]; then echo "$mktypes types_$GOOS.go | go run mkpost.go > ztypes_$GOOSARCH.go"; fi
-	if [ -n "$mkasm" ]; then echo "$mkasm $GOARCH"; fi
+	if [ -n "$mkasm" ]; then echo "$mkasm $GOOS $GOARCH"; fi
 ) | $run
diff --git a/vendor/golang.org/x/sys/unix/mkerrors.sh b/vendor/golang.org/x/sys/unix/mkerrors.sh
index a74ef58f8c..be0423e685 100644
--- a/vendor/golang.org/x/sys/unix/mkerrors.sh
+++ b/vendor/golang.org/x/sys/unix/mkerrors.sh
@@ -66,6 +66,7 @@ includes_Darwin='
 #include <sys/ptrace.h>
 #include <sys/select.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 #include <sys/un.h>
 #include <sys/sockio.h>
 #include <sys/sys_domain.h>
@@ -128,6 +129,7 @@ includes_FreeBSD='
 #include <sys/mount.h>
 #include <sys/wait.h>
 #include <sys/ioctl.h>
+#include <sys/ptrace.h>
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_types.h>
@@ -202,9 +204,12 @@ struct ltchars {
 #include <sys/timerfd.h>
 #include <sys/uio.h>
 #include <sys/xattr.h>
+#include <netinet/udp.h>
+#include <linux/audit.h>
 #include <linux/bpf.h>
 #include <linux/can.h>
 #include <linux/can/error.h>
+#include <linux/can/netlink.h>
 #include <linux/can/raw.h>
 #include <linux/capability.h>
 #include <linux/cryptouser.h>
@@ -214,6 +219,7 @@ struct ltchars {
 #include <linux/ethtool_netlink.h>
 #include <linux/falloc.h>
 #include <linux/fanotify.h>
+#include <linux/fib_rules.h>
 #include <linux/filter.h>
 #include <linux/fs.h>
 #include <linux/fscrypt.h>
@@ -231,6 +237,7 @@ struct ltchars {
 #include <linux/if_packet.h>
 #include <linux/if_xdp.h>
 #include <linux/input.h>
+#include <linux/kcm.h>
 #include <linux/kexec.h>
 #include <linux/keyctl.h>
 #include <linux/landlock.h>
@@ -239,6 +246,7 @@ struct ltchars {
 #include <linux/magic.h>
 #include <linux/memfd.h>
 #include <linux/module.h>
+#include <linux/mount.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netlink.h>
 #include <linux/net_namespace.h>
@@ -260,6 +268,7 @@ struct ltchars {
 #include <linux/vm_sockets.h>
 #include <linux/wait.h>
 #include <linux/watchdog.h>
+#include <linux/wireguard.h>
 
 #include <mtd/ubi-user.h>
 #include <mtd/mtd-user.h>
@@ -290,6 +299,10 @@ struct ltchars {
 #define SOL_NETLINK	270
 #endif
 
+#ifndef SOL_SMC
+#define SOL_SMC 286
+#endif
+
 #ifdef SOL_BLUETOOTH
 // SPARC includes this in /usr/include/sparc64-linux-gnu/bits/socket.h
 // but it is already in bluetooth_linux.go
@@ -501,14 +514,16 @@ ccflags="$@"
 		$2 ~ /^O?XTABS$/ ||
 		$2 ~ /^TC[IO](ON|OFF)$/ ||
 		$2 ~ /^IN_/ ||
+		$2 ~ /^KCM/ ||
 		$2 ~ /^LANDLOCK_/ ||
 		$2 ~ /^LOCK_(SH|EX|NB|UN)$/ ||
 		$2 ~ /^LO_(KEY|NAME)_SIZE$/ ||
 		$2 ~ /^LOOP_(CLR|CTL|GET|SET)_/ ||
-		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT)_/ ||
+		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
 		$2 ~ /^NFC_(GENL|PROTO|COMM|RF|SE|DIRECTION|LLCP|SOCKPROTO)_/ ||
 		$2 ~ /^NFC_.*_(MAX)?SIZE$/ ||
 		$2 ~ /^RAW_PAYLOAD_/ ||
+		$2 ~ /^[US]F_/ ||
 		$2 ~ /^TP_STATUS_/ ||
 		$2 ~ /^FALLOC_/ ||
 		$2 ~ /^ICMPV?6?_(FILTER|SEC)/ ||
@@ -520,10 +535,10 @@ ccflags="$@"
 		$2 ~ /^HW_MACHINE$/ ||
 		$2 ~ /^SYSCTL_VERS/ ||
 		$2 !~ "MNT_BITS" &&
-		$2 ~ /^(MS|MNT|UMOUNT)_/ ||
+		$2 ~ /^(MS|MNT|MOUNT|UMOUNT)_/ ||
 		$2 ~ /^NS_GET_/ ||
 		$2 ~ /^TUN(SET|GET|ATTACH|DETACH)/ ||
-		$2 ~ /^(O|F|[ES]?FD|NAME|S|PTRACE|PT|TFD)_/ ||
+		$2 ~ /^(O|F|[ES]?FD|NAME|S|PTRACE|PT|PIOD|TFD)_/ ||
 		$2 ~ /^KEXEC_/ ||
 		$2 ~ /^LINUX_REBOOT_CMD_/ ||
 		$2 ~ /^LINUX_REBOOT_MAGIC[12]$/ ||
@@ -547,6 +562,7 @@ ccflags="$@"
 		$2 ~ /^CLONE_[A-Z_]+/ ||
 		$2 !~ /^(BPF_TIMEVAL|BPF_FIB_LOOKUP_[A-Z]+)$/ &&
 		$2 ~ /^(BPF|DLT)_/ ||
+		$2 ~ /^AUDIT_/ ||
 		$2 ~ /^(CLOCK|TIMER)_/ ||
 		$2 ~ /^CAN_/ ||
 		$2 ~ /^CAP_/ ||
@@ -569,7 +585,6 @@ ccflags="$@"
 		$2 ~ /^SEEK_/ ||
 		$2 ~ /^SPLICE_/ ||
 		$2 ~ /^SYNC_FILE_RANGE_/ ||
-		$2 !~ /^AUDIT_RECORD_MAGIC/ &&
 		$2 !~ /IOC_MAGIC/ &&
 		$2 ~ /^[A-Z][A-Z0-9_]+_MAGIC2?$/ ||
 		$2 ~ /^(VM|VMADDR)_/ ||
@@ -595,8 +610,10 @@ ccflags="$@"
 		$2 ~ /^DEVLINK_/ ||
 		$2 ~ /^ETHTOOL_/ ||
 		$2 ~ /^LWTUNNEL_IP/ ||
+		$2 ~ /^ITIMER_/ ||
 		$2 !~ "WMESGLEN" &&
 		$2 ~ /^W[A-Z0-9]+$/ ||
+		$2 ~ /^P_/ ||
 		$2 ~/^PPPIOC/ ||
 		$2 ~ /^FAN_|FANOTIFY_/ ||
 		$2 == "HID_MAX_DESCRIPTOR_SIZE" ||
@@ -605,6 +622,8 @@ ccflags="$@"
 		$2 ~ /^MTD/ ||
 		$2 ~ /^OTP/ ||
 		$2 ~ /^MEM/ ||
+		$2 ~ /^WG/ ||
+		$2 ~ /^FIB_RULE_/ ||
 		$2 ~ /^BLK[A-Z]*(GET$|SET$|BUF$|PART$|SIZE)/ {printf("\t%s = C.%s\n", $2, $2)}
 		$2 ~ /^__WCOREFLAG$/ {next}
 		$2 ~ /^__W[A-Z0-9]+$/ {printf("\t%s = C.%s\n", substr($2,3), $2)}
@@ -626,7 +645,7 @@ errors=$(
 signals=$(
 	echo '#include <signal.h>' | $CC -x c - -E -dM $ccflags |
 	awk '$1=="#define" && $2 ~ /^SIG[A-Z0-9]+$/ { print $2 }' |
-	egrep -v '(SIGSTKSIZE|SIGSTKSZ|SIGRT|SIGMAX64)' |
+	grep -v 'SIGSTKSIZE\|SIGSTKSZ\|SIGRT\|SIGMAX64' |
 	sort
 )
 
@@ -636,7 +655,7 @@ echo '#include <errno.h>' | $CC -x c - -E -dM $ccflags |
 	sort >_error.grep
 echo '#include <signal.h>' | $CC -x c - -E -dM $ccflags |
 	awk '$1=="#define" && $2 ~ /^SIG[A-Z0-9]+$/ { print "^\t" $2 "[ \t]*=" }' |
-	egrep -v '(SIGSTKSIZE|SIGSTKSZ|SIGRT|SIGMAX64)' |
+	grep -v 'SIGSTKSIZE\|SIGSTKSZ\|SIGRT\|SIGMAX64' |
 	sort >_signal.grep
 
 echo '// mkerrors.sh' "$@"
diff --git a/vendor/golang.org/x/sys/unix/ptrace_darwin.go b/vendor/golang.org/x/sys/unix/ptrace_darwin.go
index 463c3eff7f..39dba6ca6a 100644
--- a/vendor/golang.org/x/sys/unix/ptrace_darwin.go
+++ b/vendor/golang.org/x/sys/unix/ptrace_darwin.go
@@ -7,6 +7,12 @@
 
 package unix
 
+import "unsafe"
+
 func ptrace(request int, pid int, addr uintptr, data uintptr) error {
 	return ptrace1(request, pid, addr, data)
 }
+
+func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) error {
+	return ptrace1Ptr(request, pid, addr, data)
+}
diff --git a/vendor/golang.org/x/sys/unix/ptrace_ios.go b/vendor/golang.org/x/sys/unix/ptrace_ios.go
index ed0509a011..9ea66330a9 100644
--- a/vendor/golang.org/x/sys/unix/ptrace_ios.go
+++ b/vendor/golang.org/x/sys/unix/ptrace_ios.go
@@ -7,6 +7,12 @@
 
 package unix
 
+import "unsafe"
+
 func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return ENOTSUP
 }
+
+func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
+	return ENOTSUP
+}
diff --git a/vendor/golang.org/x/sys/unix/sockcmsg_unix.go b/vendor/golang.org/x/sys/unix/sockcmsg_unix.go
index 453a942c5d..3865943f6e 100644
--- a/vendor/golang.org/x/sys/unix/sockcmsg_unix.go
+++ b/vendor/golang.org/x/sys/unix/sockcmsg_unix.go
@@ -52,6 +52,20 @@ func ParseSocketControlMessage(b []byte) ([]SocketControlMessage, error) {
 	return msgs, nil
 }
 
+// ParseOneSocketControlMessage parses a single socket control message from b, returning the message header,
+// message data (a slice of b), and the remainder of b after that single message.
+// When there are no remaining messages, len(remainder) == 0.
+func ParseOneSocketControlMessage(b []byte) (hdr Cmsghdr, data []byte, remainder []byte, err error) {
+	h, dbuf, err := socketControlMessageHeaderAndData(b)
+	if err != nil {
+		return Cmsghdr{}, nil, nil, err
+	}
+	if i := cmsgAlignOf(int(h.Len)); i < len(b) {
+		remainder = b[i:]
+	}
+	return *h, dbuf, remainder, nil
+}
+
 func socketControlMessageHeaderAndData(b []byte) (*Cmsghdr, []byte, error) {
 	h := (*Cmsghdr)(unsafe.Pointer(&b[0]))
 	if h.Len < SizeofCmsghdr || uint64(h.Len) > uint64(len(b)) {
diff --git a/vendor/golang.org/x/sys/unix/str.go b/vendor/golang.org/x/sys/unix/str.go
deleted file mode 100644
index 8ba89ed869..0000000000
--- a/vendor/golang.org/x/sys/unix/str.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
-
-package unix
-
-func itoa(val int) string { // do it here rather than with fmt to avoid dependency
-	if val < 0 {
-		return "-" + uitoa(uint(-val))
-	}
-	return uitoa(uint(val))
-}
-
-func uitoa(val uint) string {
-	var buf [32]byte // big enough for int64
-	i := len(buf) - 1
-	for val >= 10 {
-		buf[i] = byte(val%10 + '0')
-		i--
-		val /= 10
-	}
-	buf[i] = byte(val + '0')
-	return string(buf[i:])
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall.go b/vendor/golang.org/x/sys/unix/syscall.go
index 649fa87405..63e8c83831 100644
--- a/vendor/golang.org/x/sys/unix/syscall.go
+++ b/vendor/golang.org/x/sys/unix/syscall.go
@@ -29,8 +29,6 @@ import (
 	"bytes"
 	"strings"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 // ByteSliceFromString returns a NUL-terminated slice of bytes
@@ -82,13 +80,7 @@ func BytePtrToString(p *byte) string {
 		ptr = unsafe.Pointer(uintptr(ptr) + 1)
 	}
 
-	var s []byte
-	h := (*unsafeheader.Slice)(unsafe.Pointer(&s))
-	h.Data = unsafe.Pointer(p)
-	h.Len = n
-	h.Cap = n
-
-	return string(s)
+	return string(unsafe.Slice(p, n))
 }
 
 // Single-word zero for use when we need a valid pointer to 0 bytes.
diff --git a/vendor/golang.org/x/sys/unix/syscall_aix.go b/vendor/golang.org/x/sys/unix/syscall_aix.go
index 6192750ce3..c406ae00f4 100644
--- a/vendor/golang.org/x/sys/unix/syscall_aix.go
+++ b/vendor/golang.org/x/sys/unix/syscall_aix.go
@@ -37,6 +37,7 @@ func Creat(path string, mode uint32) (fd int, err error) {
 }
 
 //sys	utimes(path string, times *[2]Timeval) (err error)
+
 func Utimes(path string, tv []Timeval) error {
 	if len(tv) != 2 {
 		return EINVAL
@@ -45,6 +46,7 @@ func Utimes(path string, tv []Timeval) error {
 }
 
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flag int) (err error)
+
 func UtimesNano(path string, ts []Timespec) error {
 	if len(ts) != 2 {
 		return EINVAL
@@ -215,20 +217,63 @@ func Accept(fd int) (nfd int, sa Sockaddr, err error) {
 	return
 }
 
-func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
-	// Recvmsg not implemented on AIX
-	sa := new(SockaddrUnix)
-	return -1, -1, -1, sa, ENOSYS
-}
-
-func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
-	_, err = SendmsgN(fd, p, oob, to, flags)
+func recvmsgRaw(fd int, iov []Iovec, oob []byte, flags int, rsa *RawSockaddrAny) (n, oobn int, recvflags int, err error) {
+	var msg Msghdr
+	msg.Name = (*byte)(unsafe.Pointer(rsa))
+	msg.Namelen = uint32(SizeofSockaddrAny)
+	var dummy byte
+	if len(oob) > 0 {
+		// receive at least one normal byte
+		if emptyIovecs(iov) {
+			var iova [1]Iovec
+			iova[0].Base = &dummy
+			iova[0].SetLen(1)
+			iov = iova[:]
+		}
+		msg.Control = (*byte)(unsafe.Pointer(&oob[0]))
+		msg.SetControllen(len(oob))
+	}
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
+	if n, err = recvmsg(fd, &msg, flags); n == -1 {
+		return
+	}
+	oobn = int(msg.Controllen)
+	recvflags = int(msg.Flags)
 	return
 }
 
-func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error) {
-	// SendmsgN not implemented on AIX
-	return -1, ENOSYS
+func sendmsgN(fd int, iov []Iovec, oob []byte, ptr unsafe.Pointer, salen _Socklen, flags int) (n int, err error) {
+	var msg Msghdr
+	msg.Name = (*byte)(unsafe.Pointer(ptr))
+	msg.Namelen = uint32(salen)
+	var dummy byte
+	var empty bool
+	if len(oob) > 0 {
+		// send at least one normal byte
+		empty = emptyIovecs(iov)
+		if empty {
+			var iova [1]Iovec
+			iova[0].Base = &dummy
+			iova[0].SetLen(1)
+			iov = iova[:]
+		}
+		msg.Control = (*byte)(unsafe.Pointer(&oob[0]))
+		msg.SetControllen(len(oob))
+	}
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
+	if n, err = sendmsg(fd, &msg, flags); err != nil {
+		return 0, err
+	}
+	if len(oob) > 0 && empty {
+		n = 0
+	}
+	return n, nil
 }
 
 func anyToSockaddr(fd int, rsa *RawSockaddrAny) (Sockaddr, error) {
@@ -247,9 +292,7 @@ func anyToSockaddr(fd int, rsa *RawSockaddrAny) (Sockaddr, error) {
 				break
 			}
 		}
-
-		bytes := (*[len(pp.Path)]byte)(unsafe.Pointer(&pp.Path[0]))[0:n]
-		sa.Name = string(bytes)
+		sa.Name = string(unsafe.Slice((*byte)(unsafe.Pointer(&pp.Path[0])), n))
 		return sa, nil
 
 	case AF_INET:
@@ -306,11 +349,13 @@ func direntNamlen(buf []byte) (uint64, bool) {
 }
 
 //sys	getdirent(fd int, buf []byte) (n int, err error)
+
 func Getdents(fd int, buf []byte) (n int, err error) {
 	return getdirent(fd, buf)
 }
 
 //sys	wait4(pid Pid_t, status *_C_int, options int, rusage *Rusage) (wpid Pid_t, err error)
+
 func Wait4(pid int, wstatus *WaitStatus, options int, rusage *Rusage) (wpid int, err error) {
 	var status _C_int
 	var r Pid_t
@@ -363,7 +408,8 @@ func (w WaitStatus) CoreDump() bool { return w&0x80 == 0x80 }
 
 func (w WaitStatus) TrapCause() int { return -1 }
 
-//sys	ioctl(fd int, req uint, arg uintptr) (err error)
+//sys	ioctl(fd int, req int, arg uintptr) (err error)
+//sys	ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) = ioctl
 
 // fcntl must never be called with cmd=F_DUP2FD because it doesn't work on AIX
 // There is no way to create a custom fcntl and to keep //sys fcntl easily,
@@ -378,6 +424,7 @@ func (w WaitStatus) TrapCause() int { return -1 }
 //sys	fcntl(fd int, cmd int, arg int) (val int, err error)
 
 //sys	fsyncRange(fd int, how int, start int64, length int64) (err error) = fsync_range
+
 func Fsync(fd int) error {
 	return fsyncRange(fd, O_SYNC, 0, 0)
 }
@@ -458,8 +505,8 @@ func Fsync(fd int) error {
 //sys	Listen(s int, n int) (err error)
 //sys	lstat(path string, stat *Stat_t) (err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = pread64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = pwrite64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = pread64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = pwrite64
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error)
 //sys	Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
@@ -519,8 +566,10 @@ func Pipe(p []int) (err error) {
 	}
 	var pp [2]_C_int
 	err = pipe(&pp)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return
 }
 
@@ -540,6 +589,7 @@ func Poll(fds []PollFd, timeout int) (n int, err error) {
 //sys	Getsystemcfg(label int) (n uint64)
 
 //sys	umount(target string) (err error)
+
 func Unmount(target string, flags int) (err error) {
 	if flags != 0 {
 		// AIX doesn't have any flags for umount.
diff --git a/vendor/golang.org/x/sys/unix/syscall_aix_ppc.go b/vendor/golang.org/x/sys/unix/syscall_aix_ppc.go
index e92a0be163..f2871fa953 100644
--- a/vendor/golang.org/x/sys/unix/syscall_aix_ppc.go
+++ b/vendor/golang.org/x/sys/unix/syscall_aix_ppc.go
@@ -8,7 +8,6 @@
 package unix
 
 //sysnb	Getrlimit(resource int, rlim *Rlimit) (err error) = getrlimit64
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error) = setrlimit64
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = lseek64
 
 //sys	mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_aix_ppc64.go b/vendor/golang.org/x/sys/unix/syscall_aix_ppc64.go
index 16eed17098..75718ec0f1 100644
--- a/vendor/golang.org/x/sys/unix/syscall_aix_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_aix_ppc64.go
@@ -8,7 +8,6 @@
 package unix
 
 //sysnb	Getrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = lseek
 
 //sys	mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error) = mmap64
diff --git a/vendor/golang.org/x/sys/unix/syscall_bsd.go b/vendor/golang.org/x/sys/unix/syscall_bsd.go
index 0ce4523261..7705c3270b 100644
--- a/vendor/golang.org/x/sys/unix/syscall_bsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_bsd.go
@@ -245,8 +245,7 @@ func anyToSockaddr(fd int, rsa *RawSockaddrAny) (Sockaddr, error) {
 				break
 			}
 		}
-		bytes := (*[len(pp.Path)]byte)(unsafe.Pointer(&pp.Path[0]))[0:n]
-		sa.Name = string(bytes)
+		sa.Name = string(unsafe.Slice((*byte)(unsafe.Pointer(&pp.Path[0])), n))
 		return sa, nil
 
 	case AF_INET:
@@ -325,80 +324,62 @@ func GetsockoptString(fd, level, opt int) (string, error) {
 //sys	sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	recvmsg(s int, msg *Msghdr, flags int) (n int, err error)
 
-func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
+func recvmsgRaw(fd int, iov []Iovec, oob []byte, flags int, rsa *RawSockaddrAny) (n, oobn int, recvflags int, err error) {
 	var msg Msghdr
-	var rsa RawSockaddrAny
-	msg.Name = (*byte)(unsafe.Pointer(&rsa))
+	msg.Name = (*byte)(unsafe.Pointer(rsa))
 	msg.Namelen = uint32(SizeofSockaddrAny)
-	var iov Iovec
-	if len(p) > 0 {
-		iov.Base = (*byte)(unsafe.Pointer(&p[0]))
-		iov.SetLen(len(p))
-	}
 	var dummy byte
 	if len(oob) > 0 {
 		// receive at least one normal byte
-		if len(p) == 0 {
-			iov.Base = &dummy
-			iov.SetLen(1)
+		if emptyIovecs(iov) {
+			var iova [1]Iovec
+			iova[0].Base = &dummy
+			iova[0].SetLen(1)
+			iov = iova[:]
 		}
 		msg.Control = (*byte)(unsafe.Pointer(&oob[0]))
 		msg.SetControllen(len(oob))
 	}
-	msg.Iov = &iov
-	msg.Iovlen = 1
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
 	if n, err = recvmsg(fd, &msg, flags); err != nil {
 		return
 	}
 	oobn = int(msg.Controllen)
 	recvflags = int(msg.Flags)
-	// source address is only specified if the socket is unconnected
-	if rsa.Addr.Family != AF_UNSPEC {
-		from, err = anyToSockaddr(fd, &rsa)
-	}
 	return
 }
 
 //sys	sendmsg(s int, msg *Msghdr, flags int) (n int, err error)
 
-func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
-	_, err = SendmsgN(fd, p, oob, to, flags)
-	return
-}
-
-func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error) {
-	var ptr unsafe.Pointer
-	var salen _Socklen
-	if to != nil {
-		ptr, salen, err = to.sockaddr()
-		if err != nil {
-			return 0, err
-		}
-	}
+func sendmsgN(fd int, iov []Iovec, oob []byte, ptr unsafe.Pointer, salen _Socklen, flags int) (n int, err error) {
 	var msg Msghdr
 	msg.Name = (*byte)(unsafe.Pointer(ptr))
 	msg.Namelen = uint32(salen)
-	var iov Iovec
-	if len(p) > 0 {
-		iov.Base = (*byte)(unsafe.Pointer(&p[0]))
-		iov.SetLen(len(p))
-	}
 	var dummy byte
+	var empty bool
 	if len(oob) > 0 {
 		// send at least one normal byte
-		if len(p) == 0 {
-			iov.Base = &dummy
-			iov.SetLen(1)
+		empty = emptyIovecs(iov)
+		if empty {
+			var iova [1]Iovec
+			iova[0].Base = &dummy
+			iova[0].SetLen(1)
+			iov = iova[:]
 		}
 		msg.Control = (*byte)(unsafe.Pointer(&oob[0]))
 		msg.SetControllen(len(oob))
 	}
-	msg.Iov = &iov
-	msg.Iovlen = 1
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
 	if n, err = sendmsg(fd, &msg, flags); err != nil {
 		return 0, err
 	}
-	if len(oob) > 0 && len(p) == 0 {
+	if len(oob) > 0 && empty {
 		n = 0
 	}
 	return n, nil
@@ -571,12 +552,7 @@ func UtimesNano(path string, ts []Timespec) error {
 	if len(ts) != 2 {
 		return EINVAL
 	}
-	// Darwin setattrlist can set nanosecond timestamps
-	err := setattrlistTimes(path, ts, 0)
-	if err != ENOSYS {
-		return err
-	}
-	err = utimensat(AT_FDCWD, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), 0)
+	err := utimensat(AT_FDCWD, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), 0)
 	if err != ENOSYS {
 		return err
 	}
@@ -596,10 +572,6 @@ func UtimesNanoAt(dirfd int, path string, ts []Timespec, flags int) error {
 	if len(ts) != 2 {
 		return EINVAL
 	}
-	err := setattrlistTimes(path, ts, flags)
-	if err != ENOSYS {
-		return err
-	}
 	return utimensat(dirfd, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), flags)
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin.1_12.go b/vendor/golang.org/x/sys/unix/syscall_darwin.1_12.go
deleted file mode 100644
index b0098607c7..0000000000
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.1_12.go
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build darwin && go1.12 && !go1.13
-// +build darwin,go1.12,!go1.13
-
-package unix
-
-import (
-	"unsafe"
-)
-
-const _SYS_GETDIRENTRIES64 = 344
-
-func Getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
-	// To implement this using libSystem we'd need syscall_syscallPtr for
-	// fdopendir. However, syscallPtr was only added in Go 1.13, so we fall
-	// back to raw syscalls for this func on Go 1.12.
-	var p unsafe.Pointer
-	if len(buf) > 0 {
-		p = unsafe.Pointer(&buf[0])
-	} else {
-		p = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(_SYS_GETDIRENTRIES64, uintptr(fd), uintptr(p), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		return n, errnoErr(e1)
-	}
-	return n, nil
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin.1_13.go b/vendor/golang.org/x/sys/unix/syscall_darwin.1_13.go
deleted file mode 100644
index 1596426b1e..0000000000
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.1_13.go
+++ /dev/null
@@ -1,108 +0,0 @@
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build darwin && go1.13
-// +build darwin,go1.13
-
-package unix
-
-import (
-	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
-)
-
-//sys	closedir(dir uintptr) (err error)
-//sys	readdir_r(dir uintptr, entry *Dirent, result **Dirent) (res Errno)
-
-func fdopendir(fd int) (dir uintptr, err error) {
-	r0, _, e1 := syscall_syscallPtr(libc_fdopendir_trampoline_addr, uintptr(fd), 0, 0)
-	dir = uintptr(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_fdopendir_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_fdopendir fdopendir "/usr/lib/libSystem.B.dylib"
-
-func Getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
-	// Simulate Getdirentries using fdopendir/readdir_r/closedir.
-	// We store the number of entries to skip in the seek
-	// offset of fd. See issue #31368.
-	// It's not the full required semantics, but should handle the case
-	// of calling Getdirentries or ReadDirent repeatedly.
-	// It won't handle assigning the results of lseek to *basep, or handle
-	// the directory being edited underfoot.
-	skip, err := Seek(fd, 0, 1 /* SEEK_CUR */)
-	if err != nil {
-		return 0, err
-	}
-
-	// We need to duplicate the incoming file descriptor
-	// because the caller expects to retain control of it, but
-	// fdopendir expects to take control of its argument.
-	// Just Dup'ing the file descriptor is not enough, as the
-	// result shares underlying state. Use Openat to make a really
-	// new file descriptor referring to the same directory.
-	fd2, err := Openat(fd, ".", O_RDONLY, 0)
-	if err != nil {
-		return 0, err
-	}
-	d, err := fdopendir(fd2)
-	if err != nil {
-		Close(fd2)
-		return 0, err
-	}
-	defer closedir(d)
-
-	var cnt int64
-	for {
-		var entry Dirent
-		var entryp *Dirent
-		e := readdir_r(d, &entry, &entryp)
-		if e != 0 {
-			return n, errnoErr(e)
-		}
-		if entryp == nil {
-			break
-		}
-		if skip > 0 {
-			skip--
-			cnt++
-			continue
-		}
-
-		reclen := int(entry.Reclen)
-		if reclen > len(buf) {
-			// Not enough room. Return for now.
-			// The counter will let us know where we should start up again.
-			// Note: this strategy for suspending in the middle and
-			// restarting is O(n^2) in the length of the directory. Oh well.
-			break
-		}
-
-		// Copy entry into return buffer.
-		var s []byte
-		hdr := (*unsafeheader.Slice)(unsafe.Pointer(&s))
-		hdr.Data = unsafe.Pointer(&entry)
-		hdr.Cap = reclen
-		hdr.Len = reclen
-		copy(buf, s)
-
-		buf = buf[reclen:]
-		n += reclen
-		cnt++
-	}
-	// Set the seek offset of the input fd to record
-	// how many files we've already returned.
-	_, err = Seek(fd, cnt, 0 /* SEEK_SET */)
-	if err != nil {
-		return n, err
-	}
-
-	return n, nil
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin.go b/vendor/golang.org/x/sys/unix/syscall_darwin.go
index 8826f41435..206921504c 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin.go
@@ -14,11 +14,100 @@ package unix
 
 import (
 	"fmt"
-	"runtime"
 	"syscall"
 	"unsafe"
 )
 
+//sys	closedir(dir uintptr) (err error)
+//sys	readdir_r(dir uintptr, entry *Dirent, result **Dirent) (res Errno)
+
+func fdopendir(fd int) (dir uintptr, err error) {
+	r0, _, e1 := syscall_syscallPtr(libc_fdopendir_trampoline_addr, uintptr(fd), 0, 0)
+	dir = uintptr(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fdopendir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fdopendir fdopendir "/usr/lib/libSystem.B.dylib"
+
+func Getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
+	// Simulate Getdirentries using fdopendir/readdir_r/closedir.
+	// We store the number of entries to skip in the seek
+	// offset of fd. See issue #31368.
+	// It's not the full required semantics, but should handle the case
+	// of calling Getdirentries or ReadDirent repeatedly.
+	// It won't handle assigning the results of lseek to *basep, or handle
+	// the directory being edited underfoot.
+	skip, err := Seek(fd, 0, 1 /* SEEK_CUR */)
+	if err != nil {
+		return 0, err
+	}
+
+	// We need to duplicate the incoming file descriptor
+	// because the caller expects to retain control of it, but
+	// fdopendir expects to take control of its argument.
+	// Just Dup'ing the file descriptor is not enough, as the
+	// result shares underlying state. Use Openat to make a really
+	// new file descriptor referring to the same directory.
+	fd2, err := Openat(fd, ".", O_RDONLY, 0)
+	if err != nil {
+		return 0, err
+	}
+	d, err := fdopendir(fd2)
+	if err != nil {
+		Close(fd2)
+		return 0, err
+	}
+	defer closedir(d)
+
+	var cnt int64
+	for {
+		var entry Dirent
+		var entryp *Dirent
+		e := readdir_r(d, &entry, &entryp)
+		if e != 0 {
+			return n, errnoErr(e)
+		}
+		if entryp == nil {
+			break
+		}
+		if skip > 0 {
+			skip--
+			cnt++
+			continue
+		}
+
+		reclen := int(entry.Reclen)
+		if reclen > len(buf) {
+			// Not enough room. Return for now.
+			// The counter will let us know where we should start up again.
+			// Note: this strategy for suspending in the middle and
+			// restarting is O(n^2) in the length of the directory. Oh well.
+			break
+		}
+
+		// Copy entry into return buffer.
+		s := unsafe.Slice((*byte)(unsafe.Pointer(&entry)), reclen)
+		copy(buf, s)
+
+		buf = buf[reclen:]
+		n += reclen
+		cnt++
+	}
+	// Set the seek offset of the input fd to record
+	// how many files we've already returned.
+	_, err = Seek(fd, cnt, 0 /* SEEK_SET */)
+	if err != nil {
+		return n, err
+	}
+
+	return n, nil
+}
+
 // SockaddrDatalink implements the Sockaddr interface for AF_LINK type sockets.
 type SockaddrDatalink struct {
 	Len    uint8
@@ -140,16 +229,7 @@ func direntNamlen(buf []byte) (uint64, bool) {
 
 func PtraceAttach(pid int) (err error) { return ptrace(PT_ATTACH, pid, 0, 0) }
 func PtraceDetach(pid int) (err error) { return ptrace(PT_DETACH, pid, 0, 0) }
-
-type attrList struct {
-	bitmapCount uint16
-	_           uint16
-	CommonAttr  uint32
-	VolAttr     uint32
-	DirAttr     uint32
-	FileAttr    uint32
-	Forkattr    uint32
-}
+func PtraceDenyAttach() (err error)    { return ptrace(PT_DENY_ATTACH, 0, 0, 0) }
 
 //sysnb	pipe(p *[2]int32) (err error)
 
@@ -159,8 +239,10 @@ func Pipe(p []int) (err error) {
 	}
 	var x [2]int32
 	err = pipe(&x)
-	p[0] = int(x[0])
-	p[1] = int(x[1])
+	if err == nil {
+		p[0] = int(x[0])
+		p[1] = int(x[1])
+	}
 	return
 }
 
@@ -280,36 +362,7 @@ func Flistxattr(fd int, dest []byte) (sz int, err error) {
 	return flistxattr(fd, xattrPointer(dest), len(dest), 0)
 }
 
-func setattrlistTimes(path string, times []Timespec, flags int) error {
-	_p0, err := BytePtrFromString(path)
-	if err != nil {
-		return err
-	}
-
-	var attrList attrList
-	attrList.bitmapCount = ATTR_BIT_MAP_COUNT
-	attrList.CommonAttr = ATTR_CMN_MODTIME | ATTR_CMN_ACCTIME
-
-	// order is mtime, atime: the opposite of Chtimes
-	attributes := [2]Timespec{times[1], times[0]}
-	options := 0
-	if flags&AT_SYMLINK_NOFOLLOW != 0 {
-		options |= FSOPT_NOFOLLOW
-	}
-	return setattrlist(
-		_p0,
-		unsafe.Pointer(&attrList),
-		unsafe.Pointer(&attributes),
-		unsafe.Sizeof(attributes),
-		options)
-}
-
-//sys	setattrlist(path *byte, list unsafe.Pointer, buf unsafe.Pointer, size uintptr, options int) (err error)
-
-func utimensat(dirfd int, path string, times *[2]Timespec, flags int) error {
-	// Darwin doesn't support SYS_UTIMENSAT
-	return ENOSYS
-}
+//sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
 
 /*
  * Wrapped
@@ -322,11 +375,10 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) error {
 func Kill(pid int, signum syscall.Signal) (err error) { return kill(pid, int(signum), 1) }
 
 //sys	ioctl(fd int, req uint, arg uintptr) (err error)
+//sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
 func IoctlCtlInfo(fd int, ctlInfo *CtlInfo) error {
-	err := ioctl(fd, CTLIOCGINFO, uintptr(unsafe.Pointer(ctlInfo)))
-	runtime.KeepAlive(ctlInfo)
-	return err
+	return ioctlPtr(fd, CTLIOCGINFO, unsafe.Pointer(ctlInfo))
 }
 
 // IfreqMTU is struct ifreq used to get or set a network device's MTU.
@@ -340,16 +392,14 @@ type IfreqMTU struct {
 func IoctlGetIfreqMTU(fd int, ifname string) (*IfreqMTU, error) {
 	var ifreq IfreqMTU
 	copy(ifreq.Name[:], ifname)
-	err := ioctl(fd, SIOCGIFMTU, uintptr(unsafe.Pointer(&ifreq)))
+	err := ioctlPtr(fd, SIOCGIFMTU, unsafe.Pointer(&ifreq))
 	return &ifreq, err
 }
 
 // IoctlSetIfreqMTU performs the SIOCSIFMTU ioctl operation on fd to set the MTU
 // of the network device specified by ifreq.Name.
 func IoctlSetIfreqMTU(fd int, ifreq *IfreqMTU) error {
-	err := ioctl(fd, SIOCSIFMTU, uintptr(unsafe.Pointer(ifreq)))
-	runtime.KeepAlive(ifreq)
-	return err
+	return ioctlPtr(fd, SIOCSIFMTU, unsafe.Pointer(ifreq))
 }
 
 //sys	sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) = SYS_SYSCTL
@@ -430,6 +480,13 @@ func GetsockoptXucred(fd, level, opt int) (*Xucred, error) {
 	return x, err
 }
 
+func GetsockoptTCPConnectionInfo(fd, level, opt int) (*TCPConnectionInfo, error) {
+	var value TCPConnectionInfo
+	vallen := _Socklen(SizeofTCPConnectionInfo)
+	err := getsockopt(fd, level, opt, unsafe.Pointer(&value), &vallen)
+	return &value, err
+}
+
 func SysctlKinfoProc(name string, args ...int) (*KinfoProc, error) {
 	mib, err := sysctlmib(name, args...)
 	if err != nil {
@@ -541,11 +598,12 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	Mkdirat(dirfd int, path string, mode uint32) (err error)
 //sys	Mkfifo(path string, mode uint32) (err error)
 //sys	Mknod(path string, mode uint32, dev int) (err error)
+//sys	Mount(fsType string, dir string, flags int, data unsafe.Pointer) (err error)
 //sys	Open(path string, mode int, perm uint32) (fd int, err error)
 //sys	Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error)
 //sys	Pathconf(path string, name int) (val int, err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error)
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error)
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Readlink(path string, buf []byte) (n int, err error)
 //sys	Readlinkat(dirfd int, path string, buf []byte) (n int, err error)
@@ -555,6 +613,7 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	Rmdir(path string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (newoffset int64, err error) = SYS_LSEEK
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error)
+//sys	Setattrlist(path string, attrlist *Attrlist, attrBuf []byte, options int) (err error)
 //sys	Setegid(egid int) (err error)
 //sysnb	Seteuid(euid int) (err error)
 //sysnb	Setgid(gid int) (err error)
@@ -564,7 +623,6 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	Setprivexec(flag int) (err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
 //sysnb	Setreuid(ruid int, euid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
@@ -609,7 +667,6 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 // Nfssvc
 // Getfh
 // Quotactl
-// Mount
 // Csops
 // Waitid
 // Add_profil
@@ -619,7 +676,6 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 // Kqueue_from_portset_np
 // Kqueue_portset
 // Getattrlist
-// Setattrlist
 // Getdirentriesattr
 // Searchfs
 // Delete
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go b/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
index b37310ce9b..9fa879806b 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
@@ -47,5 +47,6 @@ func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sys	getfsstat(buf unsafe.Pointer, size uintptr, flags int) (n int, err error) = SYS_GETFSSTAT64
 //sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
 //sys	ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) = SYS_ptrace
+//sys	ptrace1Ptr(request int, pid int, addr unsafe.Pointer, data uintptr) (err error) = SYS_ptrace
 //sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	Statfs(path string, stat *Statfs_t) (err error) = SYS_STATFS64
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go b/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
index d51ec99630..f17b8c526a 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
@@ -47,5 +47,6 @@ func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sys	getfsstat(buf unsafe.Pointer, size uintptr, flags int) (n int, err error) = SYS_GETFSSTAT
 //sys	Lstat(path string, stat *Stat_t) (err error)
 //sys	ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) = SYS_ptrace
+//sys	ptrace1Ptr(request int, pid int, addr unsafe.Pointer, data uintptr) (err error) = SYS_ptrace
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, stat *Statfs_t) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
index 5af108a503..d4ce988e72 100644
--- a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
+++ b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
@@ -101,7 +101,10 @@ func Pipe(p []int) (err error) {
 	if len(p) != 2 {
 		return EINVAL
 	}
-	p[0], p[1], err = pipe()
+	r, w, err := pipe()
+	if err == nil {
+		p[0], p[1] = r, w
+	}
 	return
 }
 
@@ -114,17 +117,22 @@ func Pipe2(p []int, flags int) (err error) {
 	var pp [2]_C_int
 	// pipe2 on dragonfly takes an fds array as an argument, but still
 	// returns the file descriptors.
-	p[0], p[1], err = pipe2(&pp, flags)
+	r, w, err := pipe2(&pp, flags)
+	if err == nil {
+		p[0], p[1] = r, w
+	}
 	return err
 }
 
 //sys	extpread(fd int, p []byte, flags int, offset int64) (n int, err error)
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	return extpread(fd, p, 0, offset)
 }
 
 //sys	extpwrite(fd int, p []byte, flags int, offset int64) (n int, err error)
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return extpwrite(fd, p, 0, offset)
 }
 
@@ -163,12 +171,8 @@ func Getfsstat(buf []Statfs_t, flags int) (n int, err error) {
 	return
 }
 
-func setattrlistTimes(path string, times []Timespec, flags int) error {
-	// used on Darwin for UtimesNano
-	return ENOSYS
-}
-
 //sys	ioctl(fd int, req uint, arg uintptr) (err error)
+//sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
 //sys	sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) = SYS___SYSCTL
 
@@ -252,6 +256,7 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
@@ -321,7 +326,6 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sysnb	Setreuid(ruid int, euid int) (err error)
 //sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
 //sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd.go b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
index 18c392cf36..afb10106f6 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
@@ -17,25 +17,12 @@ import (
 	"unsafe"
 )
 
-const (
-	SYS_FSTAT_FREEBSD12         = 551 // { int fstat(int fd, _Out_ struct stat *sb); }
-	SYS_FSTATAT_FREEBSD12       = 552 // { int fstatat(int fd, _In_z_ char *path, \
-	SYS_GETDIRENTRIES_FREEBSD12 = 554 // { ssize_t getdirentries(int fd, \
-	SYS_STATFS_FREEBSD12        = 555 // { int statfs(_In_z_ char *path, \
-	SYS_FSTATFS_FREEBSD12       = 556 // { int fstatfs(int fd, \
-	SYS_GETFSSTAT_FREEBSD12     = 557 // { int getfsstat( \
-	SYS_MKNODAT_FREEBSD12       = 559 // { int mknodat(int fd, _In_z_ char *path, \
-)
-
 // See https://www.freebsd.org/doc/en_US.ISO8859-1/books/porters-handbook/versions.html.
 var (
 	osreldateOnce sync.Once
 	osreldate     uint32
 )
 
-// INO64_FIRST from /usr/src/lib/libc/sys/compat-ino64.h
-const _ino64First = 1200031
-
 func supportsABI(ver uint32) bool {
 	osreldateOnce.Do(func() { osreldate, _ = SysctlUint32("kern.osreldate") })
 	return osreldate >= ver
@@ -110,8 +97,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
@@ -157,47 +146,23 @@ func Accept4(fd, flags int) (nfd int, sa Sockaddr, err error) {
 
 func Getfsstat(buf []Statfs_t, flags int) (n int, err error) {
 	var (
-		_p0          unsafe.Pointer
-		bufsize      uintptr
-		oldBuf       []statfs_freebsd11_t
-		needsConvert bool
+		_p0     unsafe.Pointer
+		bufsize uintptr
 	)
-
 	if len(buf) > 0 {
-		if supportsABI(_ino64First) {
-			_p0 = unsafe.Pointer(&buf[0])
-			bufsize = unsafe.Sizeof(Statfs_t{}) * uintptr(len(buf))
-		} else {
-			n := len(buf)
-			oldBuf = make([]statfs_freebsd11_t, n)
-			_p0 = unsafe.Pointer(&oldBuf[0])
-			bufsize = unsafe.Sizeof(statfs_freebsd11_t{}) * uintptr(n)
-			needsConvert = true
-		}
+		_p0 = unsafe.Pointer(&buf[0])
+		bufsize = unsafe.Sizeof(Statfs_t{}) * uintptr(len(buf))
 	}
-	var sysno uintptr = SYS_GETFSSTAT
-	if supportsABI(_ino64First) {
-		sysno = SYS_GETFSSTAT_FREEBSD12
-	}
-	r0, _, e1 := Syscall(sysno, uintptr(_p0), bufsize, uintptr(flags))
+	r0, _, e1 := Syscall(SYS_GETFSSTAT, uintptr(_p0), bufsize, uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = e1
 	}
-	if e1 == 0 && needsConvert {
-		for i := range oldBuf {
-			buf[i].convertFrom(&oldBuf[i])
-		}
-	}
 	return
 }
 
-func setattrlistTimes(path string, times []Timespec, flags int) error {
-	// used on Darwin for UtimesNano
-	return ENOSYS
-}
-
-//sys	ioctl(fd int, req uint, arg uintptr) (err error)
+//sys	ioctl(fd int, req uint, arg uintptr) (err error) = SYS_IOCTL
+//sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
 //sys	sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) = SYS___SYSCTL
 
@@ -248,87 +213,11 @@ func Uname(uname *Utsname) error {
 }
 
 func Stat(path string, st *Stat_t) (err error) {
-	var oldStat stat_freebsd11_t
-	if supportsABI(_ino64First) {
-		return fstatat_freebsd12(AT_FDCWD, path, st, 0)
-	}
-	err = stat(path, &oldStat)
-	if err != nil {
-		return err
-	}
-
-	st.convertFrom(&oldStat)
-	return nil
+	return Fstatat(AT_FDCWD, path, st, 0)
 }
 
 func Lstat(path string, st *Stat_t) (err error) {
-	var oldStat stat_freebsd11_t
-	if supportsABI(_ino64First) {
-		return fstatat_freebsd12(AT_FDCWD, path, st, AT_SYMLINK_NOFOLLOW)
-	}
-	err = lstat(path, &oldStat)
-	if err != nil {
-		return err
-	}
-
-	st.convertFrom(&oldStat)
-	return nil
-}
-
-func Fstat(fd int, st *Stat_t) (err error) {
-	var oldStat stat_freebsd11_t
-	if supportsABI(_ino64First) {
-		return fstat_freebsd12(fd, st)
-	}
-	err = fstat(fd, &oldStat)
-	if err != nil {
-		return err
-	}
-
-	st.convertFrom(&oldStat)
-	return nil
-}
-
-func Fstatat(fd int, path string, st *Stat_t, flags int) (err error) {
-	var oldStat stat_freebsd11_t
-	if supportsABI(_ino64First) {
-		return fstatat_freebsd12(fd, path, st, flags)
-	}
-	err = fstatat(fd, path, &oldStat, flags)
-	if err != nil {
-		return err
-	}
-
-	st.convertFrom(&oldStat)
-	return nil
-}
-
-func Statfs(path string, st *Statfs_t) (err error) {
-	var oldStatfs statfs_freebsd11_t
-	if supportsABI(_ino64First) {
-		return statfs_freebsd12(path, st)
-	}
-	err = statfs(path, &oldStatfs)
-	if err != nil {
-		return err
-	}
-
-	st.convertFrom(&oldStatfs)
-	return nil
-}
-
-func Fstatfs(fd int, st *Statfs_t) (err error) {
-	var oldStatfs statfs_freebsd11_t
-	if supportsABI(_ino64First) {
-		return fstatfs_freebsd12(fd, st)
-	}
-	err = fstatfs(fd, &oldStatfs)
-	if err != nil {
-		return err
-	}
-
-	st.convertFrom(&oldStatfs)
-	return nil
+	return Fstatat(AT_FDCWD, path, st, AT_SYMLINK_NOFOLLOW)
 }
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -336,162 +225,25 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 }
 
 func Getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
-	if supportsABI(_ino64First) {
-		if basep == nil || unsafe.Sizeof(*basep) == 8 {
-			return getdirentries_freebsd12(fd, buf, (*uint64)(unsafe.Pointer(basep)))
-		}
-		// The freebsd12 syscall needs a 64-bit base. On 32-bit machines
-		// we can't just use the basep passed in. See #32498.
-		var base uint64 = uint64(*basep)
-		n, err = getdirentries_freebsd12(fd, buf, &base)
-		*basep = uintptr(base)
-		if base>>32 != 0 {
-			// We can't stuff the base back into a uintptr, so any
-			// future calls would be suspect. Generate an error.
-			// EIO is allowed by getdirentries.
-			err = EIO
-		}
-		return
-	}
-
-	// The old syscall entries are smaller than the new. Use 1/4 of the original
-	// buffer size rounded up to DIRBLKSIZ (see /usr/src/lib/libc/sys/getdirentries.c).
-	oldBufLen := roundup(len(buf)/4, _dirblksiz)
-	oldBuf := make([]byte, oldBufLen)
-	n, err = getdirentries(fd, oldBuf, basep)
-	if err == nil && n > 0 {
-		n = convertFromDirents11(buf, oldBuf[:n])
+	if basep == nil || unsafe.Sizeof(*basep) == 8 {
+		return getdirentries(fd, buf, (*uint64)(unsafe.Pointer(basep)))
+	}
+	// The syscall needs a 64-bit base. On 32-bit machines
+	// we can't just use the basep passed in. See #32498.
+	var base uint64 = uint64(*basep)
+	n, err = getdirentries(fd, buf, &base)
+	*basep = uintptr(base)
+	if base>>32 != 0 {
+		// We can't stuff the base back into a uintptr, so any
+		// future calls would be suspect. Generate an error.
+		// EIO is allowed by getdirentries.
+		err = EIO
 	}
 	return
 }
 
 func Mknod(path string, mode uint32, dev uint64) (err error) {
-	var oldDev int
-	if supportsABI(_ino64First) {
-		return mknodat_freebsd12(AT_FDCWD, path, mode, dev)
-	}
-	oldDev = int(dev)
-	return mknod(path, mode, oldDev)
-}
-
-func Mknodat(fd int, path string, mode uint32, dev uint64) (err error) {
-	var oldDev int
-	if supportsABI(_ino64First) {
-		return mknodat_freebsd12(fd, path, mode, dev)
-	}
-	oldDev = int(dev)
-	return mknodat(fd, path, mode, oldDev)
-}
-
-// round x to the nearest multiple of y, larger or equal to x.
-//
-// from /usr/include/sys/param.h Macros for counting and rounding.
-// #define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
-func roundup(x, y int) int {
-	return ((x + y - 1) / y) * y
-}
-
-func (s *Stat_t) convertFrom(old *stat_freebsd11_t) {
-	*s = Stat_t{
-		Dev:     uint64(old.Dev),
-		Ino:     uint64(old.Ino),
-		Nlink:   uint64(old.Nlink),
-		Mode:    old.Mode,
-		Uid:     old.Uid,
-		Gid:     old.Gid,
-		Rdev:    uint64(old.Rdev),
-		Atim:    old.Atim,
-		Mtim:    old.Mtim,
-		Ctim:    old.Ctim,
-		Btim:    old.Btim,
-		Size:    old.Size,
-		Blocks:  old.Blocks,
-		Blksize: old.Blksize,
-		Flags:   old.Flags,
-		Gen:     uint64(old.Gen),
-	}
-}
-
-func (s *Statfs_t) convertFrom(old *statfs_freebsd11_t) {
-	*s = Statfs_t{
-		Version:     _statfsVersion,
-		Type:        old.Type,
-		Flags:       old.Flags,
-		Bsize:       old.Bsize,
-		Iosize:      old.Iosize,
-		Blocks:      old.Blocks,
-		Bfree:       old.Bfree,
-		Bavail:      old.Bavail,
-		Files:       old.Files,
-		Ffree:       old.Ffree,
-		Syncwrites:  old.Syncwrites,
-		Asyncwrites: old.Asyncwrites,
-		Syncreads:   old.Syncreads,
-		Asyncreads:  old.Asyncreads,
-		// Spare
-		Namemax: old.Namemax,
-		Owner:   old.Owner,
-		Fsid:    old.Fsid,
-		// Charspare
-		// Fstypename
-		// Mntfromname
-		// Mntonname
-	}
-
-	sl := old.Fstypename[:]
-	n := clen(*(*[]byte)(unsafe.Pointer(&sl)))
-	copy(s.Fstypename[:], old.Fstypename[:n])
-
-	sl = old.Mntfromname[:]
-	n = clen(*(*[]byte)(unsafe.Pointer(&sl)))
-	copy(s.Mntfromname[:], old.Mntfromname[:n])
-
-	sl = old.Mntonname[:]
-	n = clen(*(*[]byte)(unsafe.Pointer(&sl)))
-	copy(s.Mntonname[:], old.Mntonname[:n])
-}
-
-func convertFromDirents11(buf []byte, old []byte) int {
-	const (
-		fixedSize    = int(unsafe.Offsetof(Dirent{}.Name))
-		oldFixedSize = int(unsafe.Offsetof(dirent_freebsd11{}.Name))
-	)
-
-	dstPos := 0
-	srcPos := 0
-	for dstPos+fixedSize < len(buf) && srcPos+oldFixedSize < len(old) {
-		var dstDirent Dirent
-		var srcDirent dirent_freebsd11
-
-		// If multiple direntries are written, sometimes when we reach the final one,
-		// we may have cap of old less than size of dirent_freebsd11.
-		copy((*[unsafe.Sizeof(srcDirent)]byte)(unsafe.Pointer(&srcDirent))[:], old[srcPos:])
-
-		reclen := roundup(fixedSize+int(srcDirent.Namlen)+1, 8)
-		if dstPos+reclen > len(buf) {
-			break
-		}
-
-		dstDirent.Fileno = uint64(srcDirent.Fileno)
-		dstDirent.Off = 0
-		dstDirent.Reclen = uint16(reclen)
-		dstDirent.Type = srcDirent.Type
-		dstDirent.Pad0 = 0
-		dstDirent.Namlen = uint16(srcDirent.Namlen)
-		dstDirent.Pad1 = 0
-
-		copy(dstDirent.Name[:], srcDirent.Name[:srcDirent.Namlen])
-		copy(buf[dstPos:], (*[unsafe.Sizeof(dstDirent)]byte)(unsafe.Pointer(&dstDirent))[:])
-		padding := buf[dstPos+fixedSize+int(dstDirent.Namlen) : dstPos+reclen]
-		for i := range padding {
-			padding[i] = 0
-		}
-
-		dstPos += int(dstDirent.Reclen)
-		srcPos += int(srcDirent.Reclen)
-	}
-
-	return dstPos
+	return Mknodat(AT_FDCWD, path, mode, dev)
 }
 
 func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
@@ -502,33 +254,51 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 }
 
 //sys	ptrace(request int, pid int, addr uintptr, data int) (err error)
+//sys	ptracePtr(request int, pid int, addr unsafe.Pointer, data int) (err error) = SYS_PTRACE
 
 func PtraceAttach(pid int) (err error) {
-	return ptrace(PTRACE_ATTACH, pid, 0, 0)
+	return ptrace(PT_ATTACH, pid, 0, 0)
 }
 
 func PtraceCont(pid int, signal int) (err error) {
-	return ptrace(PTRACE_CONT, pid, 1, signal)
+	return ptrace(PT_CONTINUE, pid, 1, signal)
 }
 
 func PtraceDetach(pid int) (err error) {
-	return ptrace(PTRACE_DETACH, pid, 1, 0)
+	return ptrace(PT_DETACH, pid, 1, 0)
 }
 
 func PtraceGetFpRegs(pid int, fpregsout *FpReg) (err error) {
-	return ptrace(PTRACE_GETFPREGS, pid, uintptr(unsafe.Pointer(fpregsout)), 0)
+	return ptracePtr(PT_GETFPREGS, pid, unsafe.Pointer(fpregsout), 0)
 }
 
 func PtraceGetRegs(pid int, regsout *Reg) (err error) {
-	return ptrace(PTRACE_GETREGS, pid, uintptr(unsafe.Pointer(regsout)), 0)
+	return ptracePtr(PT_GETREGS, pid, unsafe.Pointer(regsout), 0)
+}
+
+func PtraceIO(req int, pid int, offs uintptr, out []byte, countin int) (count int, err error) {
+	ioDesc := PtraceIoDesc{
+		Op:   int32(req),
+		Offs: offs,
+	}
+	if countin > 0 {
+		_ = out[:countin] // check bounds
+		ioDesc.Addr = &out[0]
+	} else if out != nil {
+		ioDesc.Addr = (*byte)(unsafe.Pointer(&_zero))
+	}
+	ioDesc.SetLen(countin)
+
+	err = ptracePtr(PT_IO, pid, unsafe.Pointer(&ioDesc), 0)
+	return int(ioDesc.Len), err
 }
 
 func PtraceLwpEvents(pid int, enable int) (err error) {
-	return ptrace(PTRACE_LWPEVENTS, pid, 0, enable)
+	return ptrace(PT_LWP_EVENTS, pid, 0, enable)
 }
 
-func PtraceLwpInfo(pid int, info uintptr) (err error) {
-	return ptrace(PTRACE_LWPINFO, pid, info, int(unsafe.Sizeof(PtraceLwpInfoStruct{})))
+func PtraceLwpInfo(pid int, info *PtraceLwpInfoStruct) (err error) {
+	return ptracePtr(PT_LWPINFO, pid, unsafe.Pointer(info), int(unsafe.Sizeof(*info)))
 }
 
 func PtracePeekData(pid int, addr uintptr, out []byte) (count int, err error) {
@@ -548,11 +318,23 @@ func PtracePokeText(pid int, addr uintptr, data []byte) (count int, err error) {
 }
 
 func PtraceSetRegs(pid int, regs *Reg) (err error) {
-	return ptrace(PTRACE_SETREGS, pid, uintptr(unsafe.Pointer(regs)), 0)
+	return ptracePtr(PT_SETREGS, pid, unsafe.Pointer(regs), 0)
 }
 
 func PtraceSingleStep(pid int) (err error) {
-	return ptrace(PTRACE_SINGLESTEP, pid, 1, 0)
+	return ptrace(PT_STEP, pid, 1, 0)
+}
+
+func Dup3(oldfd, newfd, flags int) error {
+	if oldfd == newfd || flags&^O_CLOEXEC != 0 {
+		return EINVAL
+	}
+	how := F_DUP2FD
+	if flags&O_CLOEXEC != 0 {
+		how = F_DUP2FD_CLOEXEC
+	}
+	_, err := fcntl(oldfd, how, newfd)
+	return err
 }
 
 /*
@@ -568,6 +350,7 @@ func PtraceSingleStep(pid int) (err error) {
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
@@ -594,16 +377,12 @@ func PtraceSingleStep(pid int) (err error) {
 //sys	Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error)
 //sys	Flock(fd int, how int) (err error)
 //sys	Fpathconf(fd int, name int) (val int, err error)
-//sys	fstat(fd int, stat *stat_freebsd11_t) (err error)
-//sys	fstat_freebsd12(fd int, stat *Stat_t) (err error)
-//sys	fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error)
-//sys	fstatat_freebsd12(fd int, path string, stat *Stat_t, flags int) (err error)
-//sys	fstatfs(fd int, stat *statfs_freebsd11_t) (err error)
-//sys	fstatfs_freebsd12(fd int, stat *Statfs_t) (err error)
+//sys	Fstat(fd int, stat *Stat_t) (err error)
+//sys	Fstatat(fd int, path string, stat *Stat_t, flags int) (err error)
+//sys	Fstatfs(fd int, stat *Statfs_t) (err error)
 //sys	Fsync(fd int) (err error)
 //sys	Ftruncate(fd int, length int64) (err error)
-//sys	getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error)
-//sys	getdirentries_freebsd12(fd int, buf []byte, basep *uint64) (n int, err error)
+//sys	getdirentries(fd int, buf []byte, basep *uint64) (n int, err error)
 //sys	Getdtablesize() (size int)
 //sysnb	Getegid() (egid int)
 //sysnb	Geteuid() (uid int)
@@ -625,19 +404,16 @@ func PtraceSingleStep(pid int) (err error) {
 //sys	Link(path string, link string) (err error)
 //sys	Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error)
 //sys	Listen(s int, backlog int) (err error)
-//sys	lstat(path string, stat *stat_freebsd11_t) (err error)
 //sys	Mkdir(path string, mode uint32) (err error)
 //sys	Mkdirat(dirfd int, path string, mode uint32) (err error)
 //sys	Mkfifo(path string, mode uint32) (err error)
-//sys	mknod(path string, mode uint32, dev int) (err error)
-//sys	mknodat(fd int, path string, mode uint32, dev int) (err error)
-//sys	mknodat_freebsd12(fd int, path string, mode uint32, dev uint64) (err error)
+//sys	Mknodat(fd int, path string, mode uint32, dev uint64) (err error)
 //sys	Nanosleep(time *Timespec, leftover *Timespec) (err error)
 //sys	Open(path string, mode int, perm uint32) (fd int, err error)
 //sys	Openat(fdat int, path string, mode int, perm uint32) (fd int, err error)
 //sys	Pathconf(path string, name int) (val int, err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error)
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error)
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Readlink(path string, buf []byte) (n int, err error)
 //sys	Readlinkat(dirfd int, path string, buf []byte) (n int, err error)
@@ -657,13 +433,10 @@ func PtraceSingleStep(pid int) (err error) {
 //sysnb	Setreuid(ruid int, euid int) (err error)
 //sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
 //sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
-//sys	stat(path string, stat *stat_freebsd11_t) (err error)
-//sys	statfs(path string, stat *statfs_freebsd11_t) (err error)
-//sys	statfs_freebsd12(path string, stat *Statfs_t) (err error)
+//sys	Statfs(path string, stat *Statfs_t) (err error)
 //sys	Symlink(path string, link string) (err error)
 //sys	Symlinkat(oldpath string, newdirfd int, newpath string) (err error)
 //sys	Sync() (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd_386.go b/vendor/golang.org/x/sys/unix/syscall_freebsd_386.go
index 342fc32b16..b8da510043 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd_386.go
@@ -42,6 +42,10 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 	cmsg.Len = uint32(length)
 }
 
+func (d *PtraceIoDesc) SetLen(length int) {
+	d.Len = uint32(length)
+}
+
 func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
 	var writtenOut uint64 = 0
 	_, _, e1 := Syscall9(SYS_SENDFILE, uintptr(infd), uintptr(outfd), uintptr(*offset), uintptr((*offset)>>32), uintptr(count), 0, uintptr(unsafe.Pointer(&writtenOut)), 0, 0)
@@ -57,11 +61,5 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
 
 func PtraceGetFsBase(pid int, fsbase *int64) (err error) {
-	return ptrace(PTRACE_GETFSBASE, pid, uintptr(unsafe.Pointer(fsbase)), 0)
-}
-
-func PtraceIO(req int, pid int, addr uintptr, out []byte, countin int) (count int, err error) {
-	ioDesc := PtraceIoDesc{Op: int32(req), Offs: (*byte)(unsafe.Pointer(addr)), Addr: (*byte)(unsafe.Pointer(&out[0])), Len: uint32(countin)}
-	err = ptrace(PTRACE_IO, pid, uintptr(unsafe.Pointer(&ioDesc)), 0)
-	return int(ioDesc.Len), err
+	return ptracePtr(PT_GETFSBASE, pid, unsafe.Pointer(fsbase), 0)
 }
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/syscall_freebsd_amd64.go
index a32d5aa4ae..47155c4839 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd_amd64.go
@@ -42,6 +42,10 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 	cmsg.Len = uint32(length)
 }
 
+func (d *PtraceIoDesc) SetLen(length int) {
+	d.Len = uint64(length)
+}
+
 func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
 	var writtenOut uint64 = 0
 	_, _, e1 := Syscall9(SYS_SENDFILE, uintptr(infd), uintptr(outfd), uintptr(*offset), uintptr(count), 0, uintptr(unsafe.Pointer(&writtenOut)), 0, 0, 0)
@@ -57,11 +61,5 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
 
 func PtraceGetFsBase(pid int, fsbase *int64) (err error) {
-	return ptrace(PTRACE_GETFSBASE, pid, uintptr(unsafe.Pointer(fsbase)), 0)
-}
-
-func PtraceIO(req int, pid int, addr uintptr, out []byte, countin int) (count int, err error) {
-	ioDesc := PtraceIoDesc{Op: int32(req), Offs: (*byte)(unsafe.Pointer(addr)), Addr: (*byte)(unsafe.Pointer(&out[0])), Len: uint64(countin)}
-	err = ptrace(PTRACE_IO, pid, uintptr(unsafe.Pointer(&ioDesc)), 0)
-	return int(ioDesc.Len), err
+	return ptracePtr(PT_GETFSBASE, pid, unsafe.Pointer(fsbase), 0)
 }
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd_arm.go b/vendor/golang.org/x/sys/unix/syscall_freebsd_arm.go
index 1e36d39abe..08932093fa 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd_arm.go
@@ -42,6 +42,10 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 	cmsg.Len = uint32(length)
 }
 
+func (d *PtraceIoDesc) SetLen(length int) {
+	d.Len = uint32(length)
+}
+
 func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
 	var writtenOut uint64 = 0
 	_, _, e1 := Syscall9(SYS_SENDFILE, uintptr(infd), uintptr(outfd), uintptr(*offset), uintptr((*offset)>>32), uintptr(count), 0, uintptr(unsafe.Pointer(&writtenOut)), 0, 0)
@@ -55,9 +59,3 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 }
 
 func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
-
-func PtraceIO(req int, pid int, addr uintptr, out []byte, countin int) (count int, err error) {
-	ioDesc := PtraceIoDesc{Op: int32(req), Offs: (*byte)(unsafe.Pointer(addr)), Addr: (*byte)(unsafe.Pointer(&out[0])), Len: uint32(countin)}
-	err = ptrace(PTRACE_IO, pid, uintptr(unsafe.Pointer(&ioDesc)), 0)
-	return int(ioDesc.Len), err
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/syscall_freebsd_arm64.go
index a09a1537bd..d151a0d0e5 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd_arm64.go
@@ -42,6 +42,10 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 	cmsg.Len = uint32(length)
 }
 
+func (d *PtraceIoDesc) SetLen(length int) {
+	d.Len = uint64(length)
+}
+
 func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
 	var writtenOut uint64 = 0
 	_, _, e1 := Syscall9(SYS_SENDFILE, uintptr(infd), uintptr(outfd), uintptr(*offset), uintptr(count), 0, uintptr(unsafe.Pointer(&writtenOut)), 0, 0, 0)
@@ -55,9 +59,3 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 }
 
 func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
-
-func PtraceIO(req int, pid int, addr uintptr, out []byte, countin int) (count int, err error) {
-	ioDesc := PtraceIoDesc{Op: int32(req), Offs: (*byte)(unsafe.Pointer(addr)), Addr: (*byte)(unsafe.Pointer(&out[0])), Len: uint64(countin)}
-	err = ptrace(PTRACE_IO, pid, uintptr(unsafe.Pointer(&ioDesc)), 0)
-	return int(ioDesc.Len), err
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/syscall_freebsd_riscv64.go
new file mode 100644
index 0000000000..d5cd64b378
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd_riscv64.go
@@ -0,0 +1,61 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build riscv64 && freebsd
+// +build riscv64,freebsd
+
+package unix
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+func setTimespec(sec, nsec int64) Timespec {
+	return Timespec{Sec: sec, Nsec: nsec}
+}
+
+func setTimeval(sec, usec int64) Timeval {
+	return Timeval{Sec: sec, Usec: usec}
+}
+
+func SetKevent(k *Kevent_t, fd, mode, flags int) {
+	k.Ident = uint64(fd)
+	k.Filter = int16(mode)
+	k.Flags = uint16(flags)
+}
+
+func (iov *Iovec) SetLen(length int) {
+	iov.Len = uint64(length)
+}
+
+func (msghdr *Msghdr) SetControllen(length int) {
+	msghdr.Controllen = uint32(length)
+}
+
+func (msghdr *Msghdr) SetIovlen(length int) {
+	msghdr.Iovlen = int32(length)
+}
+
+func (cmsg *Cmsghdr) SetLen(length int) {
+	cmsg.Len = uint32(length)
+}
+
+func (d *PtraceIoDesc) SetLen(length int) {
+	d.Len = uint64(length)
+}
+
+func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
+	var writtenOut uint64 = 0
+	_, _, e1 := Syscall9(SYS_SENDFILE, uintptr(infd), uintptr(outfd), uintptr(*offset), uintptr(count), 0, uintptr(unsafe.Pointer(&writtenOut)), 0, 0, 0)
+
+	written = int(writtenOut)
+
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
+
+func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
diff --git a/vendor/golang.org/x/sys/unix/syscall_hurd.go b/vendor/golang.org/x/sys/unix/syscall_hurd.go
new file mode 100644
index 0000000000..381fd4673b
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_hurd.go
@@ -0,0 +1,30 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build hurd
+// +build hurd
+
+package unix
+
+/*
+#include <stdint.h>
+int ioctl(int, unsigned long int, uintptr_t);
+*/
+import "C"
+
+func ioctl(fd int, req uint, arg uintptr) (err error) {
+	r0, er := C.ioctl(C.int(fd), C.ulong(req), C.uintptr_t(arg))
+	if r0 == -1 && er != nil {
+		err = er
+	}
+	return
+}
+
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	r0, er := C.ioctl(C.int(fd), C.ulong(req), C.uintptr_t(uintptr(arg)))
+	if r0 == -1 && er != nil {
+		err = er
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_hurd_386.go b/vendor/golang.org/x/sys/unix/syscall_hurd_386.go
new file mode 100644
index 0000000000..7cf54a3e4f
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_hurd_386.go
@@ -0,0 +1,29 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build 386 && hurd
+// +build 386,hurd
+
+package unix
+
+const (
+	TIOCGETA = 0x62251713
+)
+
+type Winsize struct {
+	Row    uint16
+	Col    uint16
+	Xpixel uint16
+	Ypixel uint16
+}
+
+type Termios struct {
+	Iflag  uint32
+	Oflag  uint32
+	Cflag  uint32
+	Lflag  uint32
+	Cc     [20]uint8
+	Ispeed int32
+	Ospeed int32
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_illumos.go b/vendor/golang.org/x/sys/unix/syscall_illumos.go
index 8d5f294c42..87db5a6a8c 100644
--- a/vendor/golang.org/x/sys/unix/syscall_illumos.go
+++ b/vendor/golang.org/x/sys/unix/syscall_illumos.go
@@ -10,8 +10,6 @@
 package unix
 
 import (
-	"fmt"
-	"runtime"
 	"unsafe"
 )
 
@@ -20,10 +18,9 @@ func bytes2iovec(bs [][]byte) []Iovec {
 	for i, b := range bs {
 		iovecs[i].SetLen(len(b))
 		if len(b) > 0 {
-			// somehow Iovec.Base on illumos is (*int8), not (*byte)
-			iovecs[i].Base = (*int8)(unsafe.Pointer(&b[0]))
+			iovecs[i].Base = &b[0]
 		} else {
-			iovecs[i].Base = (*int8)(unsafe.Pointer(&_zero))
+			iovecs[i].Base = (*byte)(unsafe.Pointer(&_zero))
 		}
 	}
 	return iovecs
@@ -80,107 +77,3 @@ func Accept4(fd int, flags int) (nfd int, sa Sockaddr, err error) {
 	}
 	return
 }
-
-//sys	putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error)
-
-func Putmsg(fd int, cl []byte, data []byte, flags int) (err error) {
-	var clp, datap *strbuf
-	if len(cl) > 0 {
-		clp = &strbuf{
-			Len: int32(len(cl)),
-			Buf: (*int8)(unsafe.Pointer(&cl[0])),
-		}
-	}
-	if len(data) > 0 {
-		datap = &strbuf{
-			Len: int32(len(data)),
-			Buf: (*int8)(unsafe.Pointer(&data[0])),
-		}
-	}
-	return putmsg(fd, clp, datap, flags)
-}
-
-//sys	getmsg(fd int, clptr *strbuf, dataptr *strbuf, flags *int) (err error)
-
-func Getmsg(fd int, cl []byte, data []byte) (retCl []byte, retData []byte, flags int, err error) {
-	var clp, datap *strbuf
-	if len(cl) > 0 {
-		clp = &strbuf{
-			Maxlen: int32(len(cl)),
-			Buf:    (*int8)(unsafe.Pointer(&cl[0])),
-		}
-	}
-	if len(data) > 0 {
-		datap = &strbuf{
-			Maxlen: int32(len(data)),
-			Buf:    (*int8)(unsafe.Pointer(&data[0])),
-		}
-	}
-
-	if err = getmsg(fd, clp, datap, &flags); err != nil {
-		return nil, nil, 0, err
-	}
-
-	if len(cl) > 0 {
-		retCl = cl[:clp.Len]
-	}
-	if len(data) > 0 {
-		retData = data[:datap.Len]
-	}
-	return retCl, retData, flags, nil
-}
-
-func IoctlSetIntRetInt(fd int, req uint, arg int) (int, error) {
-	return ioctlRet(fd, req, uintptr(arg))
-}
-
-func IoctlSetString(fd int, req uint, val string) error {
-	bs := make([]byte, len(val)+1)
-	copy(bs[:len(bs)-1], val)
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&bs[0])))
-	runtime.KeepAlive(&bs[0])
-	return err
-}
-
-// Lifreq Helpers
-
-func (l *Lifreq) SetName(name string) error {
-	if len(name) >= len(l.Name) {
-		return fmt.Errorf("name cannot be more than %d characters", len(l.Name)-1)
-	}
-	for i := range name {
-		l.Name[i] = int8(name[i])
-	}
-	return nil
-}
-
-func (l *Lifreq) SetLifruInt(d int) {
-	*(*int)(unsafe.Pointer(&l.Lifru[0])) = d
-}
-
-func (l *Lifreq) GetLifruInt() int {
-	return *(*int)(unsafe.Pointer(&l.Lifru[0]))
-}
-
-func (l *Lifreq) SetLifruUint(d uint) {
-	*(*uint)(unsafe.Pointer(&l.Lifru[0])) = d
-}
-
-func (l *Lifreq) GetLifruUint() uint {
-	return *(*uint)(unsafe.Pointer(&l.Lifru[0]))
-}
-
-func IoctlLifreq(fd int, req uint, l *Lifreq) error {
-	return ioctl(fd, req, uintptr(unsafe.Pointer(l)))
-}
-
-// Strioctl Helpers
-
-func (s *Strioctl) SetInt(i int) {
-	s.Len = int32(unsafe.Sizeof(i))
-	s.Dp = (*int8)(unsafe.Pointer(&i))
-}
-
-func IoctlSetStrioctlRetInt(fd int, req uint, s *Strioctl) (int, error) {
-	return ioctlRet(fd, req, uintptr(unsafe.Pointer(s)))
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go
index bc9dc2e10a..fbaeb5fff1 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -13,7 +13,9 @@ package unix
 
 import (
 	"encoding/binary"
+	"strconv"
 	"syscall"
+	"time"
 	"unsafe"
 )
 
@@ -131,8 +133,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
@@ -230,7 +234,7 @@ func Futimesat(dirfd int, path string, tv []Timeval) error {
 func Futimes(fd int, tv []Timeval) (err error) {
 	// Believe it or not, this is the best we can do on Linux
 	// (and is what glibc does).
-	return Utimes("/proc/self/fd/"+itoa(fd), tv)
+	return Utimes("/proc/self/fd/"+strconv.Itoa(fd), tv)
 }
 
 const ImplementsGetwd = true
@@ -247,6 +251,13 @@ func Getwd() (wd string, err error) {
 	if n < 1 || n > len(buf) || buf[n-1] != 0 {
 		return "", EINVAL
 	}
+	// In some cases, Linux can return a path that starts with the
+	// "(unreachable)" prefix, which can potentially be a valid relative
+	// path. To work around that, return ENOENT if path is not absolute.
+	if buf[0] != '/' {
+		return "", ENOENT
+	}
+
 	return string(buf[0 : n-1]), nil
 }
 
@@ -356,6 +367,8 @@ func Wait4(pid int, wstatus *WaitStatus, options int, rusage *Rusage) (wpid int,
 	return
 }
 
+//sys	Waitid(idType int, id int, info *Siginfo, options int, rusage *Rusage) (err error)
+
 func Mkfifo(path string, mode uint32) error {
 	return Mknod(path, mode|S_IFIFO, 0)
 }
@@ -500,24 +513,24 @@ func (sa *SockaddrL2) sockaddr() (unsafe.Pointer, _Socklen, error) {
 //
 // Server example:
 //
-//      fd, _ := Socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM)
-//      _ = unix.Bind(fd, &unix.SockaddrRFCOMM{
-//      	Channel: 1,
-//      	Addr:    [6]uint8{0, 0, 0, 0, 0, 0}, // BDADDR_ANY or 00:00:00:00:00:00
-//      })
-//      _ = Listen(fd, 1)
-//      nfd, sa, _ := Accept(fd)
-//      fmt.Printf("conn addr=%v fd=%d", sa.(*unix.SockaddrRFCOMM).Addr, nfd)
-//      Read(nfd, buf)
+//	fd, _ := Socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM)
+//	_ = unix.Bind(fd, &unix.SockaddrRFCOMM{
+//		Channel: 1,
+//		Addr:    [6]uint8{0, 0, 0, 0, 0, 0}, // BDADDR_ANY or 00:00:00:00:00:00
+//	})
+//	_ = Listen(fd, 1)
+//	nfd, sa, _ := Accept(fd)
+//	fmt.Printf("conn addr=%v fd=%d", sa.(*unix.SockaddrRFCOMM).Addr, nfd)
+//	Read(nfd, buf)
 //
 // Client example:
 //
-//      fd, _ := Socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM)
-//      _ = Connect(fd, &SockaddrRFCOMM{
-//      	Channel: 1,
-//      	Addr:    [6]byte{0x11, 0x22, 0x33, 0xaa, 0xbb, 0xcc}, // CC:BB:AA:33:22:11
-//      })
-//      Write(fd, []byte(`hello`))
+//	fd, _ := Socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM)
+//	_ = Connect(fd, &SockaddrRFCOMM{
+//		Channel: 1,
+//		Addr:    [6]byte{0x11, 0x22, 0x33, 0xaa, 0xbb, 0xcc}, // CC:BB:AA:33:22:11
+//	})
+//	Write(fd, []byte(`hello`))
 type SockaddrRFCOMM struct {
 	// Addr represents a bluetooth address, byte ordering is little-endian.
 	Addr [6]uint8
@@ -544,12 +557,12 @@ func (sa *SockaddrRFCOMM) sockaddr() (unsafe.Pointer, _Socklen, error) {
 // The SockaddrCAN struct must be bound to the socket file descriptor
 // using Bind before the CAN socket can be used.
 //
-//      // Read one raw CAN frame
-//      fd, _ := Socket(AF_CAN, SOCK_RAW, CAN_RAW)
-//      addr := &SockaddrCAN{Ifindex: index}
-//      Bind(fd, addr)
-//      frame := make([]byte, 16)
-//      Read(fd, frame)
+//	// Read one raw CAN frame
+//	fd, _ := Socket(AF_CAN, SOCK_RAW, CAN_RAW)
+//	addr := &SockaddrCAN{Ifindex: index}
+//	Bind(fd, addr)
+//	frame := make([]byte, 16)
+//	Read(fd, frame)
 //
 // The full SocketCAN documentation can be found in the linux kernel
 // archives at: https://www.kernel.org/doc/Documentation/networking/can.txt
@@ -620,13 +633,13 @@ func (sa *SockaddrCANJ1939) sockaddr() (unsafe.Pointer, _Socklen, error) {
 // Here is an example of using an AF_ALG socket with SHA1 hashing.
 // The initial socket setup process is as follows:
 //
-//      // Open a socket to perform SHA1 hashing.
-//      fd, _ := unix.Socket(unix.AF_ALG, unix.SOCK_SEQPACKET, 0)
-//      addr := &unix.SockaddrALG{Type: "hash", Name: "sha1"}
-//      unix.Bind(fd, addr)
-//      // Note: unix.Accept does not work at this time; must invoke accept()
-//      // manually using unix.Syscall.
-//      hashfd, _, _ := unix.Syscall(unix.SYS_ACCEPT, uintptr(fd), 0, 0)
+//	// Open a socket to perform SHA1 hashing.
+//	fd, _ := unix.Socket(unix.AF_ALG, unix.SOCK_SEQPACKET, 0)
+//	addr := &unix.SockaddrALG{Type: "hash", Name: "sha1"}
+//	unix.Bind(fd, addr)
+//	// Note: unix.Accept does not work at this time; must invoke accept()
+//	// manually using unix.Syscall.
+//	hashfd, _, _ := unix.Syscall(unix.SYS_ACCEPT, uintptr(fd), 0, 0)
 //
 // Once a file descriptor has been returned from Accept, it may be used to
 // perform SHA1 hashing. The descriptor is not safe for concurrent use, but
@@ -635,39 +648,39 @@ func (sa *SockaddrCANJ1939) sockaddr() (unsafe.Pointer, _Socklen, error) {
 // When hashing a small byte slice or string, a single Write and Read may
 // be used:
 //
-//      // Assume hashfd is already configured using the setup process.
-//      hash := os.NewFile(hashfd, "sha1")
-//      // Hash an input string and read the results. Each Write discards
-//      // previous hash state. Read always reads the current state.
-//      b := make([]byte, 20)
-//      for i := 0; i < 2; i++ {
-//          io.WriteString(hash, "Hello, world.")
-//          hash.Read(b)
-//          fmt.Println(hex.EncodeToString(b))
-//      }
-//      // Output:
-//      // 2ae01472317d1935a84797ec1983ae243fc6aa28
-//      // 2ae01472317d1935a84797ec1983ae243fc6aa28
+//	// Assume hashfd is already configured using the setup process.
+//	hash := os.NewFile(hashfd, "sha1")
+//	// Hash an input string and read the results. Each Write discards
+//	// previous hash state. Read always reads the current state.
+//	b := make([]byte, 20)
+//	for i := 0; i < 2; i++ {
+//	    io.WriteString(hash, "Hello, world.")
+//	    hash.Read(b)
+//	    fmt.Println(hex.EncodeToString(b))
+//	}
+//	// Output:
+//	// 2ae01472317d1935a84797ec1983ae243fc6aa28
+//	// 2ae01472317d1935a84797ec1983ae243fc6aa28
 //
 // For hashing larger byte slices, or byte streams such as those read from
 // a file or socket, use Sendto with MSG_MORE to instruct the kernel to update
 // the hash digest instead of creating a new one for a given chunk and finalizing it.
 //
-//      // Assume hashfd and addr are already configured using the setup process.
-//      hash := os.NewFile(hashfd, "sha1")
-//      // Hash the contents of a file.
-//      f, _ := os.Open("/tmp/linux-4.10-rc7.tar.xz")
-//      b := make([]byte, 4096)
-//      for {
-//          n, err := f.Read(b)
-//          if err == io.EOF {
-//              break
-//          }
-//          unix.Sendto(hashfd, b[:n], unix.MSG_MORE, addr)
-//      }
-//      hash.Read(b)
-//      fmt.Println(hex.EncodeToString(b))
-//      // Output: 85cdcad0c06eef66f805ecce353bec9accbeecc5
+//	// Assume hashfd and addr are already configured using the setup process.
+//	hash := os.NewFile(hashfd, "sha1")
+//	// Hash the contents of a file.
+//	f, _ := os.Open("/tmp/linux-4.10-rc7.tar.xz")
+//	b := make([]byte, 4096)
+//	for {
+//	    n, err := f.Read(b)
+//	    if err == io.EOF {
+//	        break
+//	    }
+//	    unix.Sendto(hashfd, b[:n], unix.MSG_MORE, addr)
+//	}
+//	hash.Read(b)
+//	fmt.Println(hex.EncodeToString(b))
+//	// Output: 85cdcad0c06eef66f805ecce353bec9accbeecc5
 //
 // For more information, see: http://www.chronox.de/crypto-API/crypto/userspace-if.html.
 type SockaddrALG struct {
@@ -1002,8 +1015,7 @@ func anyToSockaddr(fd int, rsa *RawSockaddrAny) (Sockaddr, error) {
 		for n < len(pp.Path) && pp.Path[n] != 0 {
 			n++
 		}
-		bytes := (*[len(pp.Path)]byte)(unsafe.Pointer(&pp.Path[0]))[0:n]
-		sa.Name = string(bytes)
+		sa.Name = string(unsafe.Slice((*byte)(unsafe.Pointer(&pp.Path[0])), n))
 		return sa, nil
 
 	case AF_INET:
@@ -1352,6 +1364,10 @@ func SetsockoptTCPRepairOpt(fd, level, opt int, o []TCPRepairOpt) (err error) {
 	return setsockopt(fd, level, opt, unsafe.Pointer(&o[0]), uintptr(SizeofTCPRepairOpt*len(o)))
 }
 
+func SetsockoptTCPMD5Sig(fd, level, opt int, s *TCPMD5Sig) error {
+	return setsockopt(fd, level, opt, unsafe.Pointer(s), unsafe.Sizeof(*s))
+}
+
 // Keyctl Commands (http://man7.org/linux/man-pages/man2/keyctl.2.html)
 
 // KeyctlInt calls keyctl commands in which each argument is an int.
@@ -1487,19 +1503,13 @@ func KeyctlRestrictKeyring(ringid int, keyType string, restriction string) error
 //sys	keyctlRestrictKeyringByType(cmd int, arg2 int, keyType string, restriction string) (err error) = SYS_KEYCTL
 //sys	keyctlRestrictKeyring(cmd int, arg2 int) (err error) = SYS_KEYCTL
 
-func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
+func recvmsgRaw(fd int, iov []Iovec, oob []byte, flags int, rsa *RawSockaddrAny) (n, oobn int, recvflags int, err error) {
 	var msg Msghdr
-	var rsa RawSockaddrAny
-	msg.Name = (*byte)(unsafe.Pointer(&rsa))
+	msg.Name = (*byte)(unsafe.Pointer(rsa))
 	msg.Namelen = uint32(SizeofSockaddrAny)
-	var iov Iovec
-	if len(p) > 0 {
-		iov.Base = &p[0]
-		iov.SetLen(len(p))
-	}
 	var dummy byte
 	if len(oob) > 0 {
-		if len(p) == 0 {
+		if emptyIovecs(iov) {
 			var sockType int
 			sockType, err = GetsockoptInt(fd, SOL_SOCKET, SO_TYPE)
 			if err != nil {
@@ -1507,53 +1517,36 @@ func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from
 			}
 			// receive at least one normal byte
 			if sockType != SOCK_DGRAM {
-				iov.Base = &dummy
-				iov.SetLen(1)
+				var iova [1]Iovec
+				iova[0].Base = &dummy
+				iova[0].SetLen(1)
+				iov = iova[:]
 			}
 		}
 		msg.Control = &oob[0]
 		msg.SetControllen(len(oob))
 	}
-	msg.Iov = &iov
-	msg.Iovlen = 1
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
 	if n, err = recvmsg(fd, &msg, flags); err != nil {
 		return
 	}
 	oobn = int(msg.Controllen)
 	recvflags = int(msg.Flags)
-	// source address is only specified if the socket is unconnected
-	if rsa.Addr.Family != AF_UNSPEC {
-		from, err = anyToSockaddr(fd, &rsa)
-	}
-	return
-}
-
-func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
-	_, err = SendmsgN(fd, p, oob, to, flags)
 	return
 }
 
-func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error) {
-	var ptr unsafe.Pointer
-	var salen _Socklen
-	if to != nil {
-		var err error
-		ptr, salen, err = to.sockaddr()
-		if err != nil {
-			return 0, err
-		}
-	}
+func sendmsgN(fd int, iov []Iovec, oob []byte, ptr unsafe.Pointer, salen _Socklen, flags int) (n int, err error) {
 	var msg Msghdr
 	msg.Name = (*byte)(ptr)
 	msg.Namelen = uint32(salen)
-	var iov Iovec
-	if len(p) > 0 {
-		iov.Base = &p[0]
-		iov.SetLen(len(p))
-	}
 	var dummy byte
+	var empty bool
 	if len(oob) > 0 {
-		if len(p) == 0 {
+		empty = emptyIovecs(iov)
+		if empty {
 			var sockType int
 			sockType, err = GetsockoptInt(fd, SOL_SOCKET, SO_TYPE)
 			if err != nil {
@@ -1561,19 +1554,23 @@ func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error)
 			}
 			// send at least one normal byte
 			if sockType != SOCK_DGRAM {
-				iov.Base = &dummy
-				iov.SetLen(1)
+				var iova [1]Iovec
+				iova[0].Base = &dummy
+				iova[0].SetLen(1)
+				iov = iova[:]
 			}
 		}
 		msg.Control = &oob[0]
 		msg.SetControllen(len(oob))
 	}
-	msg.Iov = &iov
-	msg.Iovlen = 1
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
 	if n, err = sendmsg(fd, &msg, flags); err != nil {
 		return 0, err
 	}
-	if len(oob) > 0 && len(p) == 0 {
+	if len(oob) > 0 && empty {
 		n = 0
 	}
 	return n, nil
@@ -1585,6 +1582,7 @@ func BindToDevice(fd int, device string) (err error) {
 }
 
 //sys	ptrace(request int, pid int, addr uintptr, data uintptr) (err error)
+//sys	ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) = SYS_PTRACE
 
 func ptracePeek(req int, pid int, addr uintptr, out []byte) (count int, err error) {
 	// The peek requests are machine-size oriented, so we wrap it
@@ -1602,7 +1600,7 @@ func ptracePeek(req int, pid int, addr uintptr, out []byte) (count int, err erro
 	// boundary.
 	n := 0
 	if addr%SizeofPtr != 0 {
-		err = ptrace(req, pid, addr-addr%SizeofPtr, uintptr(unsafe.Pointer(&buf[0])))
+		err = ptracePtr(req, pid, addr-addr%SizeofPtr, unsafe.Pointer(&buf[0]))
 		if err != nil {
 			return 0, err
 		}
@@ -1614,7 +1612,7 @@ func ptracePeek(req int, pid int, addr uintptr, out []byte) (count int, err erro
 	for len(out) > 0 {
 		// We use an internal buffer to guarantee alignment.
 		// It's not documented if this is necessary, but we're paranoid.
-		err = ptrace(req, pid, addr+uintptr(n), uintptr(unsafe.Pointer(&buf[0])))
+		err = ptracePtr(req, pid, addr+uintptr(n), unsafe.Pointer(&buf[0]))
 		if err != nil {
 			return n, err
 		}
@@ -1646,7 +1644,7 @@ func ptracePoke(pokeReq int, peekReq int, pid int, addr uintptr, data []byte) (c
 	n := 0
 	if addr%SizeofPtr != 0 {
 		var buf [SizeofPtr]byte
-		err = ptrace(peekReq, pid, addr-addr%SizeofPtr, uintptr(unsafe.Pointer(&buf[0])))
+		err = ptracePtr(peekReq, pid, addr-addr%SizeofPtr, unsafe.Pointer(&buf[0]))
 		if err != nil {
 			return 0, err
 		}
@@ -1673,7 +1671,7 @@ func ptracePoke(pokeReq int, peekReq int, pid int, addr uintptr, data []byte) (c
 	// Trailing edge.
 	if len(data) > 0 {
 		var buf [SizeofPtr]byte
-		err = ptrace(peekReq, pid, addr+uintptr(n), uintptr(unsafe.Pointer(&buf[0])))
+		err = ptracePtr(peekReq, pid, addr+uintptr(n), unsafe.Pointer(&buf[0]))
 		if err != nil {
 			return n, err
 		}
@@ -1702,11 +1700,11 @@ func PtracePokeUser(pid int, addr uintptr, data []byte) (count int, err error) {
 }
 
 func PtraceGetRegs(pid int, regsout *PtraceRegs) (err error) {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 func PtraceSetRegs(pid int, regs *PtraceRegs) (err error) {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
 
 func PtraceSetOptions(pid int, options int) (err error) {
@@ -1715,7 +1713,7 @@ func PtraceSetOptions(pid int, options int) (err error) {
 
 func PtraceGetEventMsg(pid int) (msg uint, err error) {
 	var data _C_long
-	err = ptrace(PTRACE_GETEVENTMSG, pid, 0, uintptr(unsafe.Pointer(&data)))
+	err = ptracePtr(PTRACE_GETEVENTMSG, pid, 0, unsafe.Pointer(&data))
 	msg = uint(data)
 	return
 }
@@ -1775,6 +1773,16 @@ func Mount(source string, target string, fstype string, flags uintptr, data stri
 	return mount(source, target, fstype, flags, datap)
 }
 
+//sys	mountSetattr(dirfd int, pathname string, flags uint, attr *MountAttr, size uintptr) (err error) = SYS_MOUNT_SETATTR
+
+// MountSetattr is a wrapper for mount_setattr(2).
+// https://man7.org/linux/man-pages/man2/mount_setattr.2.html
+//
+// Requires kernel >= 5.12.
+func MountSetattr(dirfd int, pathname string, flags uint, attr *MountAttr) error {
+	return mountSetattr(dirfd, pathname, flags, attr, unsafe.Sizeof(*attr))
+}
+
 func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
@@ -1796,6 +1804,7 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sysnb	Capset(hdr *CapUserHeader, data *CapUserData) (err error)
 //sys	Chdir(path string) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockAdjtime(clockid int32, buf *Timex) (state int, err error)
 //sys	ClockGetres(clockid int32, res *Timespec) (err error)
 //sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	ClockNanosleep(clockid int32, flags int, request *Timespec, remain *Timespec) (err error)
@@ -1826,6 +1835,9 @@ func Dup2(oldfd, newfd int) error {
 //sys	Fremovexattr(fd int, attr string) (err error)
 //sys	Fsetxattr(fd int, attr string, dest []byte, flags int) (err error)
 //sys	Fsync(fd int) (err error)
+//sys	Fsmount(fd int, flags int, mountAttrs int) (fsfd int, err error)
+//sys	Fsopen(fsName string, flags int) (fd int, err error)
+//sys	Fspick(dirfd int, pathName string, flags int) (fd int, err error)
 //sys	Getdents(fd int, buf []byte) (n int, err error) = SYS_GETDENTS64
 //sysnb	Getpgid(pid int) (pgid int, err error)
 
@@ -1856,10 +1868,11 @@ func Getpgrp() (pid int) {
 //sys	MemfdCreate(name string, flags int) (fd int, err error)
 //sys	Mkdirat(dirfd int, path string, mode uint32) (err error)
 //sys	Mknodat(dirfd int, path string, mode uint32, dev int) (err error)
+//sys	MoveMount(fromDirfd int, fromPathName string, toDirfd int, toPathName string, flags int) (err error)
 //sys	Nanosleep(time *Timespec, leftover *Timespec) (err error)
+//sys	OpenTree(dfd int, fileName string, flags uint) (r int, err error)
 //sys	PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error)
 //sys	PivotRoot(newroot string, putold string) (err error) = SYS_PIVOT_ROOT
-//sysnb	Prlimit(pid int, resource int, newlimit *Rlimit, old *Rlimit) (err error) = SYS_PRLIMIT64
 //sys	Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error)
 //sys	Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error) = SYS_PSELECT6
 //sys	read(fd int, p []byte) (n int, err error)
@@ -1873,6 +1886,15 @@ func Getpgrp() (pid int) {
 //sysnb	Settimeofday(tv *Timeval) (err error)
 //sys	Setns(fd int, nstype int) (err error)
 
+//go:linkname syscall_prlimit syscall.prlimit
+func syscall_prlimit(pid, resource int, newlimit, old *syscall.Rlimit) error
+
+func Prlimit(pid, resource int, newlimit, old *Rlimit) error {
+	// Just call the syscall version, because as of Go 1.21
+	// it will affect starting a new process.
+	return syscall_prlimit(pid, resource, (*syscall.Rlimit)(newlimit), (*syscall.Rlimit)(old))
+}
+
 // PrctlRetInt performs a prctl operation specified by option and further
 // optional arguments arg2 through arg5 depending on option. It returns a
 // non-negative integer that is returned by the prctl syscall.
@@ -1884,17 +1906,28 @@ func PrctlRetInt(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uint
 	return int(ret), nil
 }
 
-// issue 1435.
-// On linux Setuid and Setgid only affects the current thread, not the process.
-// This does not match what most callers expect so we must return an error
-// here rather than letting the caller think that the call succeeded.
-
 func Setuid(uid int) (err error) {
-	return EOPNOTSUPP
+	return syscall.Setuid(uid)
+}
+
+func Setgid(gid int) (err error) {
+	return syscall.Setgid(gid)
+}
+
+func Setreuid(ruid, euid int) (err error) {
+	return syscall.Setreuid(ruid, euid)
+}
+
+func Setregid(rgid, egid int) (err error) {
+	return syscall.Setregid(rgid, egid)
+}
+
+func Setresuid(ruid, euid, suid int) (err error) {
+	return syscall.Setresuid(ruid, euid, suid)
 }
 
-func Setgid(uid int) (err error) {
-	return EOPNOTSUPP
+func Setresgid(rgid, egid, sgid int) (err error) {
+	return syscall.Setresgid(rgid, egid, sgid)
 }
 
 // SetfsgidRetGid sets fsgid for current thread and returns previous fsgid set.
@@ -1953,36 +1986,46 @@ func Signalfd(fd int, sigmask *Sigset_t, flags int) (newfd int, err error) {
 //sys	preadv2(fd int, iovs []Iovec, offs_l uintptr, offs_h uintptr, flags int) (n int, err error) = SYS_PREADV2
 //sys	pwritev2(fd int, iovs []Iovec, offs_l uintptr, offs_h uintptr, flags int) (n int, err error) = SYS_PWRITEV2
 
-func bytes2iovec(bs [][]byte) []Iovec {
-	iovecs := make([]Iovec, len(bs))
-	for i, b := range bs {
-		iovecs[i].SetLen(len(b))
+// minIovec is the size of the small initial allocation used by
+// Readv, Writev, etc.
+//
+// This small allocation gets stack allocated, which lets the
+// common use case of len(iovs) <= minIovs avoid more expensive
+// heap allocations.
+const minIovec = 8
+
+// appendBytes converts bs to Iovecs and appends them to vecs.
+func appendBytes(vecs []Iovec, bs [][]byte) []Iovec {
+	for _, b := range bs {
+		var v Iovec
+		v.SetLen(len(b))
 		if len(b) > 0 {
-			iovecs[i].Base = &b[0]
+			v.Base = &b[0]
 		} else {
-			iovecs[i].Base = (*byte)(unsafe.Pointer(&_zero))
+			v.Base = (*byte)(unsafe.Pointer(&_zero))
 		}
+		vecs = append(vecs, v)
 	}
-	return iovecs
+	return vecs
 }
 
-// offs2lohi splits offs into its lower and upper unsigned long. On 64-bit
-// systems, hi will always be 0. On 32-bit systems, offs will be split in half.
-// preadv/pwritev chose this calling convention so they don't need to add a
-// padding-register for alignment on ARM.
+// offs2lohi splits offs into its low and high order bits.
 func offs2lohi(offs int64) (lo, hi uintptr) {
-	return uintptr(offs), uintptr(uint64(offs) >> SizeofLong)
+	const longBits = SizeofLong * 8
+	return uintptr(offs), uintptr(uint64(offs) >> (longBits - 1) >> 1) // two shifts to avoid false positive in vet
 }
 
 func Readv(fd int, iovs [][]byte) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	n, err = readv(fd, iovecs)
 	readvRacedetect(iovecs, n, err)
 	return n, err
 }
 
 func Preadv(fd int, iovs [][]byte, offset int64) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	lo, hi := offs2lohi(offset)
 	n, err = preadv(fd, iovecs, lo, hi)
 	readvRacedetect(iovecs, n, err)
@@ -1990,7 +2033,8 @@ func Preadv(fd int, iovs [][]byte, offset int64) (n int, err error) {
 }
 
 func Preadv2(fd int, iovs [][]byte, offset int64, flags int) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	lo, hi := offs2lohi(offset)
 	n, err = preadv2(fd, iovecs, lo, hi, flags)
 	readvRacedetect(iovecs, n, err)
@@ -2017,7 +2061,8 @@ func readvRacedetect(iovecs []Iovec, n int, err error) {
 }
 
 func Writev(fd int, iovs [][]byte) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
 	}
@@ -2027,7 +2072,8 @@ func Writev(fd int, iovs [][]byte) (n int, err error) {
 }
 
 func Pwritev(fd int, iovs [][]byte, offset int64) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
 	}
@@ -2038,7 +2084,8 @@ func Pwritev(fd int, iovs [][]byte, offset int64) (n int, err error) {
 }
 
 func Pwritev2(fd int, iovs [][]byte, offset int64, flags int) (n int, err error) {
-	iovecs := bytes2iovec(iovs)
+	iovecs := make([]Iovec, 0, minIovec)
+	iovecs = appendBytes(iovecs, iovs)
 	if raceenabled {
 		raceReleaseMerge(unsafe.Pointer(&ioSync))
 	}
@@ -2119,6 +2166,14 @@ func isGroupMember(gid int) bool {
 	return false
 }
 
+func isCapDacOverrideSet() bool {
+	hdr := CapUserHeader{Version: LINUX_CAPABILITY_VERSION_3}
+	data := [2]CapUserData{}
+	err := Capget(&hdr, &data[0])
+
+	return err == nil && data[0].Effective&(1<<CAP_DAC_OVERRIDE) != 0
+}
+
 //sys	faccessat(dirfd int, path string, mode uint32) (err error)
 //sys	Faccessat2(dirfd int, path string, mode uint32, flags int) (err error)
 
@@ -2154,6 +2209,12 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	var uid int
 	if flags&AT_EACCESS != 0 {
 		uid = Geteuid()
+		if uid != 0 && isCapDacOverrideSet() {
+			// If CAP_DAC_OVERRIDE is set, file access check is
+			// done by the kernel in the same way as for root
+			// (see generic_permission() in the Linux sources).
+			uid = 0
+		}
 	} else {
 		uid = Getuid()
 	}
@@ -2181,7 +2242,7 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 			gid = Getgid()
 		}
 
-		if uint32(gid) == st.Gid || isGroupMember(gid) {
+		if uint32(gid) == st.Gid || isGroupMember(int(st.Gid)) {
 			fmode = (st.Mode >> 3) & 7
 		} else {
 			fmode = st.Mode & 7
@@ -2233,7 +2294,7 @@ func (fh *FileHandle) Bytes() []byte {
 	if n == 0 {
 		return nil
 	}
-	return (*[1 << 30]byte)(unsafe.Pointer(uintptr(unsafe.Pointer(&fh.fileHandle.Type)) + 4))[:n:n]
+	return unsafe.Slice((*byte)(unsafe.Pointer(uintptr(unsafe.Pointer(&fh.fileHandle.Type))+4)), n)
 }
 
 // NameToHandleAt wraps the name_to_handle_at system call; it obtains
@@ -2296,17 +2357,73 @@ type RemoteIovec struct {
 
 //sys	PidfdOpen(pid int, flags int) (fd int, err error) = SYS_PIDFD_OPEN
 //sys	PidfdGetfd(pidfd int, targetfd int, flags int) (fd int, err error) = SYS_PIDFD_GETFD
+//sys	PidfdSendSignal(pidfd int, sig Signal, info *Siginfo, flags int) (err error) = SYS_PIDFD_SEND_SIGNAL
 
 //sys	shmat(id int, addr uintptr, flag int) (ret uintptr, err error)
 //sys	shmctl(id int, cmd int, buf *SysvShmDesc) (result int, err error)
 //sys	shmdt(addr uintptr) (err error)
 //sys	shmget(key int, size int, flag int) (id int, err error)
 
+//sys	getitimer(which int, currValue *Itimerval) (err error)
+//sys	setitimer(which int, newValue *Itimerval, oldValue *Itimerval) (err error)
+
+// MakeItimerval creates an Itimerval from interval and value durations.
+func MakeItimerval(interval, value time.Duration) Itimerval {
+	return Itimerval{
+		Interval: NsecToTimeval(interval.Nanoseconds()),
+		Value:    NsecToTimeval(value.Nanoseconds()),
+	}
+}
+
+// A value which may be passed to the which parameter for Getitimer and
+// Setitimer.
+type ItimerWhich int
+
+// Possible which values for Getitimer and Setitimer.
+const (
+	ItimerReal    ItimerWhich = ITIMER_REAL
+	ItimerVirtual ItimerWhich = ITIMER_VIRTUAL
+	ItimerProf    ItimerWhich = ITIMER_PROF
+)
+
+// Getitimer wraps getitimer(2) to return the current value of the timer
+// specified by which.
+func Getitimer(which ItimerWhich) (Itimerval, error) {
+	var it Itimerval
+	if err := getitimer(int(which), &it); err != nil {
+		return Itimerval{}, err
+	}
+
+	return it, nil
+}
+
+// Setitimer wraps setitimer(2) to arm or disarm the timer specified by which.
+// It returns the previous value of the timer.
+//
+// If the Itimerval argument is the zero value, the timer will be disarmed.
+func Setitimer(which ItimerWhich, it Itimerval) (Itimerval, error) {
+	var prev Itimerval
+	if err := setitimer(int(which), &it, &prev); err != nil {
+		return Itimerval{}, err
+	}
+
+	return prev, nil
+}
+
+//sysnb	rtSigprocmask(how int, set *Sigset_t, oldset *Sigset_t, sigsetsize uintptr) (err error) = SYS_RT_SIGPROCMASK
+
+func PthreadSigmask(how int, set, oldset *Sigset_t) error {
+	if oldset != nil {
+		// Explicitly clear in case Sigset_t is larger than _C__NSIG.
+		*oldset = Sigset_t{}
+	}
+	return rtSigprocmask(how, set, oldset, _C__NSIG/8)
+}
+
 /*
  * Unimplemented
  */
 // AfsSyscall
-// Alarm
 // ArchPrctl
 // Brk
 // ClockNanosleep
@@ -2322,7 +2439,6 @@ type RemoteIovec struct {
 // GetMempolicy
 // GetRobustList
 // GetThreadArea
-// Getitimer
 // Getpmsg
 // IoCancel
 // IoDestroy
@@ -2362,7 +2478,6 @@ type RemoteIovec struct {
 // RestartSyscall
 // RtSigaction
 // RtSigpending
-// RtSigprocmask
 // RtSigqueueinfo
 // RtSigreturn
 // RtSigsuspend
@@ -2400,5 +2515,4 @@ type RemoteIovec struct {
 // Vfork
 // Vhangup
 // Vserver
-// Waitid
 // _Sysctl
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_386.go b/vendor/golang.org/x/sys/unix/syscall_linux_386.go
index 5f757e8aa7..c7d9945ea1 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_386.go
@@ -35,16 +35,12 @@ func setTimeval(sec, usec int64) Timeval {
 //sys	Iopl(level int) (err error)
 //sys	Lchown(path string, uid int, gid int) (err error) = SYS_LCHOWN32
 //sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) = SYS_SENDFILE64
 //sys	setfsgid(gid int) (prev int, err error) = SYS_SETFSGID32
 //sys	setfsuid(uid int) (prev int, err error) = SYS_SETFSUID32
-//sysnb	Setregid(rgid int, egid int) (err error) = SYS_SETREGID32
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error) = SYS_SETRESGID32
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error) = SYS_SETRESUID32
-//sysnb	Setreuid(ruid int, euid int) (err error) = SYS_SETREUID32
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int, err error)
 //sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
@@ -101,33 +97,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }
 
-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	newoffset, errno := seek(fd, offset, whence)
 	if errno != 0 {
@@ -173,14 +142,6 @@ const (
 	_SENDMMSG    = 20
 )
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	fd, e := socketcall(_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
-	if e != 0 {
-		err = e
-	}
-	return
-}
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	fd, e := socketcall(_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	if e != 0 {
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_alarm.go b/vendor/golang.org/x/sys/unix/syscall_linux_alarm.go
new file mode 100644
index 0000000000..08086ac6a4
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_alarm.go
@@ -0,0 +1,14 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && (386 || amd64 || mips || mipsle || mips64 || mipsle || ppc64 || ppc64le || ppc || s390x || sparc64)
+// +build linux
+// +build 386 amd64 mips mipsle mips64 mipsle ppc64 ppc64le ppc s390x sparc64
+
+package unix
+
+// SYS_ALARM is not defined on arm or riscv, but is available for other GOARCH
+// values.
+
+//sys	Alarm(seconds uint) (remaining uint, err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go b/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
index 4299125aa7..5b21fcfd75 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
@@ -28,9 +28,10 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	return Fstatat(AT_FDCWD, path, stat, AT_SYMLINK_NOFOLLOW)
 }
 
+//sys	MemfdSecret(flags int) (fd int, err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 
@@ -45,11 +46,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 
@@ -62,7 +58,6 @@ func Stat(path string, stat *Stat_t) (err error) {
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
 //sys	Truncate(path string, length int64) (err error)
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_arm.go b/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
index 79edeb9cb1..da2986415a 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
@@ -27,7 +27,6 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return newoffset, nil
 }
 
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
@@ -63,10 +62,6 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) = SYS__NEWSELECT
 //sys	setfsgid(gid int) (prev int, err error) = SYS_SETFSGID32
 //sys	setfsuid(uid int) (prev int, err error) = SYS_SETFSUID32
-//sysnb	Setregid(rgid int, egid int) (err error) = SYS_SETREGID32
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error) = SYS_SETRESGID32
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error) = SYS_SETRESUID32
-//sysnb	Setreuid(ruid int, euid int) (err error) = SYS_SETREUID32
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int, err error)
 //sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
@@ -97,8 +92,8 @@ func Utime(path string, buf *Utimbuf) error {
 
 //sys	utimes(path string, times *[2]Timeval) (err error)
 
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Truncate(path string, length int64) (err error) = SYS_TRUNCATE64
 //sys	Ftruncate(fd int, length int64) (err error) = SYS_FTRUNCATE64
 
@@ -176,33 +171,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }
 
-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func (r *PtraceRegs) PC() uint64 { return uint64(r.Uregs[15]) }
 
 func (r *PtraceRegs) SetPC(pc uint64) { r.Uregs[15] = uint32(pc) }
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go b/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
index 862890de29..a81f5742b8 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
@@ -22,8 +22,9 @@ import "unsafe"
 //sysnb	getrlimit(resource int, rlim *Rlimit) (err error)
 //sysnb	Getuid() (uid int)
 //sys	Listen(s int, n int) (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	MemfdSecret(flags int) (fd int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 
@@ -38,11 +39,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 
@@ -66,7 +62,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 	return ENOSYS
 }
 
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
@@ -147,15 +142,6 @@ func Getrlimit(resource int, rlim *Rlimit) error {
 	return getrlimit(resource, rlim)
 }
 
-// Setrlimit prefers the prlimit64 system call. See issue 38604.
-func Setrlimit(resource int, rlim *Rlimit) error {
-	err := Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-	return setrlimit(resource, rlim)
-}
-
 func (r *PtraceRegs) PC() uint64 { return r.Pc }
 
 func (r *PtraceRegs) SetPC(pc uint64) { r.Pc = pc }
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go b/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
new file mode 100644
index 0000000000..69d2d7c3db
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
@@ -0,0 +1,217 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build loong64 && linux
+// +build loong64,linux
+
+package unix
+
+import "unsafe"
+
+//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
+//sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
+//sys	Fchown(fd int, uid int, gid int) (err error)
+//sys	Fstatfs(fd int, buf *Statfs_t) (err error)
+//sys	Ftruncate(fd int, length int64) (err error)
+//sysnb	Getegid() (egid int)
+//sysnb	Geteuid() (euid int)
+//sysnb	Getgid() (gid int)
+//sysnb	Getuid() (uid int)
+//sys	Listen(s int, n int) (err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
+
+func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
+	var ts *Timespec
+	if timeout != nil {
+		ts = &Timespec{Sec: timeout.Sec, Nsec: timeout.Usec * 1000}
+	}
+	return Pselect(nfd, r, w, e, ts, nil)
+}
+
+//sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
+//sys	setfsgid(gid int) (prev int, err error)
+//sys	setfsuid(uid int) (prev int, err error)
+//sys	Shutdown(fd int, how int) (err error)
+//sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
+
+func timespecFromStatxTimestamp(x StatxTimestamp) Timespec {
+	return Timespec{
+		Sec:  x.Sec,
+		Nsec: int64(x.Nsec),
+	}
+}
+
+func Fstatat(fd int, path string, stat *Stat_t, flags int) error {
+	var r Statx_t
+	// Do it the glibc way, add AT_NO_AUTOMOUNT.
+	if err := Statx(fd, path, AT_NO_AUTOMOUNT|flags, STATX_BASIC_STATS, &r); err != nil {
+		return err
+	}
+
+	stat.Dev = Mkdev(r.Dev_major, r.Dev_minor)
+	stat.Ino = r.Ino
+	stat.Mode = uint32(r.Mode)
+	stat.Nlink = r.Nlink
+	stat.Uid = r.Uid
+	stat.Gid = r.Gid
+	stat.Rdev = Mkdev(r.Rdev_major, r.Rdev_minor)
+	// hope we don't get to process files so large to overflow these size
+	// fields...
+	stat.Size = int64(r.Size)
+	stat.Blksize = int32(r.Blksize)
+	stat.Blocks = int64(r.Blocks)
+	stat.Atim = timespecFromStatxTimestamp(r.Atime)
+	stat.Mtim = timespecFromStatxTimestamp(r.Mtime)
+	stat.Ctim = timespecFromStatxTimestamp(r.Ctime)
+
+	return nil
+}
+
+func Fstat(fd int, stat *Stat_t) (err error) {
+	return Fstatat(fd, "", stat, AT_EMPTY_PATH)
+}
+
+func Stat(path string, stat *Stat_t) (err error) {
+	return Fstatat(AT_FDCWD, path, stat, 0)
+}
+
+func Lchown(path string, uid int, gid int) (err error) {
+	return Fchownat(AT_FDCWD, path, uid, gid, AT_SYMLINK_NOFOLLOW)
+}
+
+func Lstat(path string, stat *Stat_t) (err error) {
+	return Fstatat(AT_FDCWD, path, stat, AT_SYMLINK_NOFOLLOW)
+}
+
+//sys	Statfs(path string, buf *Statfs_t) (err error)
+//sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
+//sys	Truncate(path string, length int64) (err error)
+
+func Ustat(dev int, ubuf *Ustat_t) (err error) {
+	return ENOSYS
+}
+
+//sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
+//sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
+//sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
+//sysnb	getgroups(n int, list *_Gid_t) (nn int, err error)
+//sysnb	setgroups(n int, list *_Gid_t) (err error)
+//sys	getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error)
+//sys	setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error)
+//sysnb	socket(domain int, typ int, proto int) (fd int, err error)
+//sysnb	socketpair(domain int, typ int, proto int, fd *[2]int32) (err error)
+//sysnb	getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error)
+//sysnb	getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error)
+//sys	recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error)
+//sys	sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error)
+//sys	recvmsg(s int, msg *Msghdr, flags int) (n int, err error)
+//sys	sendmsg(s int, msg *Msghdr, flags int) (n int, err error)
+//sys	mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error)
+
+//sysnb	Gettimeofday(tv *Timeval) (err error)
+
+func setTimespec(sec, nsec int64) Timespec {
+	return Timespec{Sec: sec, Nsec: nsec}
+}
+
+func setTimeval(sec, usec int64) Timeval {
+	return Timeval{Sec: sec, Usec: usec}
+}
+
+func Getrlimit(resource int, rlim *Rlimit) (err error) {
+	err = Prlimit(0, resource, nil, rlim)
+	return
+}
+
+func futimesat(dirfd int, path string, tv *[2]Timeval) (err error) {
+	if tv == nil {
+		return utimensat(dirfd, path, nil, 0)
+	}
+
+	ts := []Timespec{
+		NsecToTimespec(TimevalToNsec(tv[0])),
+		NsecToTimespec(TimevalToNsec(tv[1])),
+	}
+	return utimensat(dirfd, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), 0)
+}
+
+func Time(t *Time_t) (Time_t, error) {
+	var tv Timeval
+	err := Gettimeofday(&tv)
+	if err != nil {
+		return 0, err
+	}
+	if t != nil {
+		*t = Time_t(tv.Sec)
+	}
+	return Time_t(tv.Sec), nil
+}
+
+func Utime(path string, buf *Utimbuf) error {
+	tv := []Timeval{
+		{Sec: buf.Actime},
+		{Sec: buf.Modtime},
+	}
+	return Utimes(path, tv)
+}
+
+func utimes(path string, tv *[2]Timeval) (err error) {
+	if tv == nil {
+		return utimensat(AT_FDCWD, path, nil, 0)
+	}
+
+	ts := []Timespec{
+		NsecToTimespec(TimevalToNsec(tv[0])),
+		NsecToTimespec(TimevalToNsec(tv[1])),
+	}
+	return utimensat(AT_FDCWD, path, (*[2]Timespec)(unsafe.Pointer(&ts[0])), 0)
+}
+
+func (r *PtraceRegs) PC() uint64 { return r.Era }
+
+func (r *PtraceRegs) SetPC(era uint64) { r.Era = era }
+
+func (iov *Iovec) SetLen(length int) {
+	iov.Len = uint64(length)
+}
+
+func (msghdr *Msghdr) SetControllen(length int) {
+	msghdr.Controllen = uint64(length)
+}
+
+func (msghdr *Msghdr) SetIovlen(length int) {
+	msghdr.Iovlen = uint64(length)
+}
+
+func (cmsg *Cmsghdr) SetLen(length int) {
+	cmsg.Len = uint64(length)
+}
+
+func (rsa *RawSockaddrNFCLLCP) SetServiceNameLen(length int) {
+	rsa.Service_name_len = uint64(length)
+}
+
+func Pause() error {
+	_, err := ppoll(nil, 0, nil, nil)
+	return err
+}
+
+func Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error) {
+	return Renameat2(olddirfd, oldpath, newdirfd, newpath, 0)
+}
+
+//sys	kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, flags int) (err error)
+
+func KexecFileLoad(kernelFd int, initrdFd int, cmdline string, flags int) error {
+	cmdlineLen := len(cmdline)
+	if cmdlineLen > 0 {
+		// Account for the additional NULL byte added by
+		// BytePtrFromString in kexecFileLoad. The kexec_file_load
+		// syscall expects a NULL-terminated string.
+		cmdlineLen++
+	}
+	return kexecFileLoad(kernelFd, initrdFd, cmdlineLen, cmdline, flags)
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go b/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
index 8932e34ad2..76d564095e 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
@@ -21,8 +21,8 @@ package unix
 //sys	Lchown(path string, uid int, gid int) (err error)
 //sys	Listen(s int, n int) (err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 
@@ -37,18 +37,12 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Statfs(path string, buf *Statfs_t) (err error)
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
 //sys	Truncate(path string, length int64) (err error)
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go b/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
index 7821c25d9f..aae7f0ffd3 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
@@ -25,23 +25,18 @@ func Syscall9(trap, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sysnb	Getuid() (uid int)
 //sys	Lchown(path string, uid int, gid int) (err error)
 //sys	Listen(s int, n int) (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) = SYS__NEWSELECT
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) = SYS_SENDFILE64
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int, err error)
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
 //sys	Truncate(path string, length int64) (err error) = SYS_TRUNCATE64
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
@@ -156,33 +151,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }
 
-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func (r *PtraceRegs) PC() uint64 { return r.Epc }
 
 func (r *PtraceRegs) SetPC(pc uint64) { r.Epc = pc }
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go b/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
index c5053a0f03..66eff19a32 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
@@ -27,23 +27,18 @@ import (
 //sys	Listen(s int, n int) (err error)
 //sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) = SYS__NEWSELECT
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) = SYS_SENDFILE64
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int, err error)
 //sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	Truncate(path string, length int64) (err error) = SYS_TRUNCATE64
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
@@ -164,33 +159,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }
 
-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func (r *PtraceRegs) PC() uint32 { return r.Nip }
 
 func (r *PtraceRegs) SetPC(pc uint32) { r.Nip = pc }
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go b/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
index 25786c4216..806aa2574d 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
@@ -26,26 +26,20 @@ package unix
 //sys	Listen(s int, n int) (err error)
 //sys	Lstat(path string, stat *Stat_t) (err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) = SYS__NEWSELECT
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, buf *Statfs_t) (err error)
 //sys	Truncate(path string, length int64) (err error)
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
index 6f9f710414..35851ef70b 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
@@ -22,8 +22,9 @@ import "unsafe"
 //sysnb	Getrlimit(resource int, rlim *Rlimit) (err error)
 //sysnb	Getuid() (uid int)
 //sys	Listen(s int, n int) (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	MemfdSecret(flags int) (fd int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
@@ -37,11 +38,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 
@@ -65,7 +61,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 	return ENOSYS
 }
 
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go b/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
index 6aa59cb270..2f89e8f5de 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
@@ -26,19 +26,14 @@ import (
 //sys	Lchown(path string, uid int, gid int) (err error)
 //sys	Lstat(path string, stat *Stat_t) (err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error)
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, buf *Statfs_t) (err error)
@@ -145,15 +140,6 @@ const (
 	netSendMMsg    = 20
 )
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (int, error) {
-	args := [3]uintptr{uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen))}
-	fd, _, err := Syscall(SYS_SOCKETCALL, netAccept, uintptr(unsafe.Pointer(&args)), 0)
-	if err != 0 {
-		return 0, err
-	}
-	return int(fd), nil
-}
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (int, error) {
 	args := [4]uintptr{uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags)}
 	fd, _, err := Syscall(SYS_SOCKETCALL, netAccept4, uintptr(unsafe.Pointer(&args)), 0)
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go b/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
index bbe8d174f8..7ca064ae76 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
@@ -23,26 +23,20 @@ package unix
 //sys	Listen(s int, n int) (err error)
 //sys	Lstat(path string, stat *Stat_t) (err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
+//sys	pread(fd int, p []byte, offset int64) (n int, err error) = SYS_PREAD64
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error) = SYS_PWRITE64
 //sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = SYS_LSEEK
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error)
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setregid(rgid int, egid int) (err error)
-//sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
-//sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setreuid(ruid int, euid int) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, buf *Statfs_t) (err error)
 //sys	SyncFileRange(fd int, off int64, n int64, flags int) (err error)
 //sys	Truncate(path string, length int64) (err error)
-//sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error)
 //sys	accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error)
 //sys	bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
 //sys	connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_netbsd.go b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
index 853d5f0f43..018d7d4782 100644
--- a/vendor/golang.org/x/sys/unix/syscall_netbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
@@ -13,7 +13,6 @@
 package unix
 
 import (
-	"runtime"
 	"syscall"
 	"unsafe"
 )
@@ -110,14 +109,22 @@ func direntNamlen(buf []byte) (uint64, bool) {
 	return readInt(buf, unsafe.Offsetof(Dirent{}.Namlen), unsafe.Sizeof(Dirent{}.Namlen))
 }
 
-//sysnb	pipe() (fd1 int, fd2 int, err error)
+func SysctlUvmexp(name string) (*Uvmexp, error) {
+	mib, err := sysctlmib(name)
+	if err != nil {
+		return nil, err
+	}
 
-func Pipe(p []int) (err error) {
-	if len(p) != 2 {
-		return EINVAL
+	n := uintptr(SizeofUvmexp)
+	var u Uvmexp
+	if err := sysctl(mib, (*byte)(unsafe.Pointer(&u)), &n, nil, 0); err != nil {
+		return nil, err
 	}
-	p[0], p[1], err = pipe()
-	return
+	return &u, nil
+}
+
+func Pipe(p []int) (err error) {
+	return Pipe2(p, 0)
 }
 
 //sysnb	pipe2(p *[2]_C_int, flags int) (err error)
@@ -128,8 +135,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
@@ -167,19 +176,14 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 	return -1, ENOSYS
 }
 
-func setattrlistTimes(path string, times []Timespec, flags int) error {
-	// used on Darwin for UtimesNano
-	return ENOSYS
-}
-
 //sys	ioctl(fd int, req uint, arg uintptr) (err error)
+//sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
 //sys	sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) = SYS___SYSCTL
 
 func IoctlGetPtmget(fd int, req uint) (*Ptmget, error) {
 	var value Ptmget
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
-	runtime.KeepAlive(value)
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return &value, err
 }
 
@@ -254,6 +258,7 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
@@ -317,8 +322,8 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	Open(path string, mode int, perm uint32) (fd int, err error)
 //sys	Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error)
 //sys	Pathconf(path string, name int) (val int, err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error)
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error)
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Readlink(path string, buf []byte) (n int, err error)
 //sys	Readlinkat(dirfd int, path string, buf []byte) (n int, err error)
@@ -335,7 +340,6 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	Setpriority(which int, who int, prio int) (err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
 //sysnb	Setreuid(ruid int, euid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
@@ -496,7 +500,6 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 // compat_43_osendmsg
 // compat_43_osethostid
 // compat_43_osethostname
-// compat_43_osetrlimit
 // compat_43_osigblock
 // compat_43_osigsetmask
 // compat_43_osigstack
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd.go b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
index 22b5503850..f9c7a9663c 100644
--- a/vendor/golang.org/x/sys/unix/syscall_openbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
@@ -81,18 +81,22 @@ func Pipe(p []int) (err error) {
 }
 
 //sysnb	pipe2(p *[2]_C_int, flags int) (err error)
+
 func Pipe2(p []int, flags int) error {
 	if len(p) != 2 {
 		return EINVAL
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
 //sys	Getdents(fd int, buf []byte) (n int, err error)
+
 func Getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
 	n, err = Getdents(fd, buf)
 	if err != nil || basep == nil {
@@ -147,12 +151,8 @@ func Getfsstat(buf []Statfs_t, flags int) (n int, err error) {
 	return
 }
 
-func setattrlistTimes(path string, times []Timespec, flags int) error {
-	// used on Darwin for UtimesNano
-	return ENOSYS
-}
-
 //sys	ioctl(fd int, req uint, arg uintptr) (err error)
+//sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
 //sys	sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) = SYS___SYSCTL
 
@@ -221,6 +221,7 @@ func Uname(uname *Utsname) error {
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Dup(fd int) (nfd int, err error)
 //sys	Dup2(from int, to int) (err error)
@@ -272,8 +273,8 @@ func Uname(uname *Utsname) error {
 //sys	Open(path string, mode int, perm uint32) (fd int, err error)
 //sys	Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error)
 //sys	Pathconf(path string, name int) (val int, err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error)
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error)
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Readlink(path string, buf []byte) (n int, err error)
 //sys	Readlinkat(dirfd int, path string, buf []byte) (n int, err error)
@@ -293,7 +294,6 @@ func Uname(uname *Utsname) error {
 //sysnb	Setreuid(ruid int, euid int) (err error)
 //sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
 //sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setrtable(rtable int) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go b/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go
new file mode 100644
index 0000000000..04aa43f41b
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd_libc.go
@@ -0,0 +1,27 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build openbsd
+// +build openbsd
+
+package unix
+
+import _ "unsafe"
+
+// Implemented in the runtime package (runtime/sys_openbsd3.go)
+func syscall_syscall(fn, a1, a2, a3 uintptr) (r1, r2 uintptr, err Errno)
+func syscall_syscall6(fn, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err Errno)
+func syscall_syscall10(fn, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10 uintptr) (r1, r2 uintptr, err Errno)
+func syscall_rawSyscall(fn, a1, a2, a3 uintptr) (r1, r2 uintptr, err Errno)
+func syscall_rawSyscall6(fn, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintptr, err Errno)
+
+//go:linkname syscall_syscall syscall.syscall
+//go:linkname syscall_syscall6 syscall.syscall6
+//go:linkname syscall_syscall10 syscall.syscall10
+//go:linkname syscall_rawSyscall syscall.rawSyscall
+//go:linkname syscall_rawSyscall6 syscall.rawSyscall6
+
+func syscall_syscall9(fn, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err Errno) {
+	return syscall_syscall10(fn, a1, a2, a3, a4, a5, a6, a7, a8, a9, 0)
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/syscall_openbsd_mips64.go
index 30f285343e..1378489f8d 100644
--- a/vendor/golang.org/x/sys/unix/syscall_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd_mips64.go
@@ -26,6 +26,10 @@ func (msghdr *Msghdr) SetControllen(length int) {
 	msghdr.Controllen = uint32(length)
 }
 
+func (msghdr *Msghdr) SetIovlen(length int) {
+	msghdr.Iovlen = uint32(length)
+}
+
 func (cmsg *Cmsghdr) SetLen(length int) {
 	cmsg.Len = uint32(length)
 }
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/syscall_openbsd_ppc64.go
new file mode 100644
index 0000000000..c2796139c0
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd_ppc64.go
@@ -0,0 +1,42 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build ppc64 && openbsd
+// +build ppc64,openbsd
+
+package unix
+
+func setTimespec(sec, nsec int64) Timespec {
+	return Timespec{Sec: sec, Nsec: nsec}
+}
+
+func setTimeval(sec, usec int64) Timeval {
+	return Timeval{Sec: sec, Usec: usec}
+}
+
+func SetKevent(k *Kevent_t, fd, mode, flags int) {
+	k.Ident = uint64(fd)
+	k.Filter = int16(mode)
+	k.Flags = uint16(flags)
+}
+
+func (iov *Iovec) SetLen(length int) {
+	iov.Len = uint64(length)
+}
+
+func (msghdr *Msghdr) SetControllen(length int) {
+	msghdr.Controllen = uint32(length)
+}
+
+func (msghdr *Msghdr) SetIovlen(length int) {
+	msghdr.Iovlen = uint32(length)
+}
+
+func (cmsg *Cmsghdr) SetLen(length int) {
+	cmsg.Len = uint32(length)
+}
+
+// SYS___SYSCTL is used by syscall_bsd.go for all BSDs, but in modern versions
+// of openbsd/ppc64 the syscall is called sysctl instead of __sysctl.
+const SYS___SYSCTL = SYS_SYSCTL
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/syscall_openbsd_riscv64.go
new file mode 100644
index 0000000000..23199a7ff6
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd_riscv64.go
@@ -0,0 +1,42 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build riscv64 && openbsd
+// +build riscv64,openbsd
+
+package unix
+
+func setTimespec(sec, nsec int64) Timespec {
+	return Timespec{Sec: sec, Nsec: nsec}
+}
+
+func setTimeval(sec, usec int64) Timeval {
+	return Timeval{Sec: sec, Usec: usec}
+}
+
+func SetKevent(k *Kevent_t, fd, mode, flags int) {
+	k.Ident = uint64(fd)
+	k.Filter = int16(mode)
+	k.Flags = uint16(flags)
+}
+
+func (iov *Iovec) SetLen(length int) {
+	iov.Len = uint64(length)
+}
+
+func (msghdr *Msghdr) SetControllen(length int) {
+	msghdr.Controllen = uint32(length)
+}
+
+func (msghdr *Msghdr) SetIovlen(length int) {
+	msghdr.Iovlen = uint32(length)
+}
+
+func (cmsg *Cmsghdr) SetLen(length int) {
+	cmsg.Len = uint32(length)
+}
+
+// SYS___SYSCTL is used by syscall_bsd.go for all BSDs, but in modern versions
+// of openbsd/riscv64 the syscall is called sysctl instead of __sysctl.
+const SYS___SYSCTL = SYS_SYSCTL
diff --git a/vendor/golang.org/x/sys/unix/syscall_solaris.go b/vendor/golang.org/x/sys/unix/syscall_solaris.go
index 8b88ac2133..b600a289d3 100644
--- a/vendor/golang.org/x/sys/unix/syscall_solaris.go
+++ b/vendor/golang.org/x/sys/unix/syscall_solaris.go
@@ -66,8 +66,10 @@ func Pipe(p []int) (err error) {
 	if n != 0 {
 		return err
 	}
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return nil
 }
 
@@ -79,8 +81,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
@@ -404,8 +408,7 @@ func anyToSockaddr(fd int, rsa *RawSockaddrAny) (Sockaddr, error) {
 		for n < len(pp.Path) && pp.Path[n] != 0 {
 			n++
 		}
-		bytes := (*[len(pp.Path)]byte)(unsafe.Pointer(&pp.Path[0]))[0:n]
-		sa.Name = string(bytes)
+		sa.Name = string(unsafe.Slice((*byte)(unsafe.Pointer(&pp.Path[0])), n))
 		return sa, nil
 
 	case AF_INET:
@@ -447,77 +450,59 @@ func Accept(fd int) (nfd int, sa Sockaddr, err error) {
 
 //sys	recvmsg(s int, msg *Msghdr, flags int) (n int, err error) = libsocket.__xnet_recvmsg
 
-func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
+func recvmsgRaw(fd int, iov []Iovec, oob []byte, flags int, rsa *RawSockaddrAny) (n, oobn int, recvflags int, err error) {
 	var msg Msghdr
-	var rsa RawSockaddrAny
-	msg.Name = (*byte)(unsafe.Pointer(&rsa))
+	msg.Name = (*byte)(unsafe.Pointer(rsa))
 	msg.Namelen = uint32(SizeofSockaddrAny)
-	var iov Iovec
-	if len(p) > 0 {
-		iov.Base = (*int8)(unsafe.Pointer(&p[0]))
-		iov.SetLen(len(p))
-	}
-	var dummy int8
+	var dummy byte
 	if len(oob) > 0 {
 		// receive at least one normal byte
-		if len(p) == 0 {
-			iov.Base = &dummy
-			iov.SetLen(1)
+		if emptyIovecs(iov) {
+			var iova [1]Iovec
+			iova[0].Base = &dummy
+			iova[0].SetLen(1)
+			iov = iova[:]
 		}
 		msg.Accrightslen = int32(len(oob))
 	}
-	msg.Iov = &iov
-	msg.Iovlen = 1
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
 	if n, err = recvmsg(fd, &msg, flags); n == -1 {
 		return
 	}
 	oobn = int(msg.Accrightslen)
-	// source address is only specified if the socket is unconnected
-	if rsa.Addr.Family != AF_UNSPEC {
-		from, err = anyToSockaddr(fd, &rsa)
-	}
-	return
-}
-
-func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
-	_, err = SendmsgN(fd, p, oob, to, flags)
 	return
 }
 
 //sys	sendmsg(s int, msg *Msghdr, flags int) (n int, err error) = libsocket.__xnet_sendmsg
 
-func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error) {
-	var ptr unsafe.Pointer
-	var salen _Socklen
-	if to != nil {
-		ptr, salen, err = to.sockaddr()
-		if err != nil {
-			return 0, err
-		}
-	}
+func sendmsgN(fd int, iov []Iovec, oob []byte, ptr unsafe.Pointer, salen _Socklen, flags int) (n int, err error) {
 	var msg Msghdr
 	msg.Name = (*byte)(unsafe.Pointer(ptr))
 	msg.Namelen = uint32(salen)
-	var iov Iovec
-	if len(p) > 0 {
-		iov.Base = (*int8)(unsafe.Pointer(&p[0]))
-		iov.SetLen(len(p))
-	}
-	var dummy int8
+	var dummy byte
+	var empty bool
 	if len(oob) > 0 {
 		// send at least one normal byte
-		if len(p) == 0 {
-			iov.Base = &dummy
-			iov.SetLen(1)
+		empty = emptyIovecs(iov)
+		if empty {
+			var iova [1]Iovec
+			iova[0].Base = &dummy
+			iova[0].SetLen(1)
+			iov = iova[:]
 		}
 		msg.Accrightslen = int32(len(oob))
 	}
-	msg.Iov = &iov
-	msg.Iovlen = 1
+	if len(iov) > 0 {
+		msg.Iov = &iov[0]
+		msg.SetIovlen(len(iov))
+	}
 	if n, err = sendmsg(fd, &msg, flags); err != nil {
 		return 0, err
 	}
-	if len(oob) > 0 && len(p) == 0 {
+	if len(oob) > 0 && empty {
 		n = 0
 	}
 	return n, nil
@@ -560,22 +545,26 @@ func Minor(dev uint64) uint32 {
  * Expose the ioctl function
  */
 
-//sys	ioctlRet(fd int, req uint, arg uintptr) (ret int, err error) = libc.ioctl
+//sys	ioctlRet(fd int, req int, arg uintptr) (ret int, err error) = libc.ioctl
+//sys	ioctlPtrRet(fd int, req int, arg unsafe.Pointer) (ret int, err error) = libc.ioctl
 
-func ioctl(fd int, req uint, arg uintptr) (err error) {
+func ioctl(fd int, req int, arg uintptr) (err error) {
 	_, err = ioctlRet(fd, req, arg)
 	return err
 }
 
-func IoctlSetTermio(fd int, req uint, value *Termio) error {
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(value)))
-	runtime.KeepAlive(value)
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
+	_, err = ioctlPtrRet(fd, req, arg)
 	return err
 }
 
-func IoctlGetTermio(fd int, req uint) (*Termio, error) {
+func IoctlSetTermio(fd int, req int, value *Termio) error {
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+func IoctlGetTermio(fd int, req int) (*Termio, error) {
 	var value Termio
-	err := ioctl(fd, req, uintptr(unsafe.Pointer(&value)))
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return &value, err
 }
 
@@ -604,6 +593,7 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Chmod(path string, mode uint32) (err error)
 //sys	Chown(path string, uid int, gid int) (err error)
 //sys	Chroot(path string) (err error)
+//sys	ClockGettime(clockid int32, time *Timespec) (err error)
 //sys	Close(fd int) (err error)
 //sys	Creat(path string, mode uint32) (fd int, err error)
 //sys	Dup(fd int) (nfd int, err error)
@@ -632,6 +622,7 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Getpriority(which int, who int) (n int, err error)
 //sysnb	Getrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Getrusage(who int, rusage *Rusage) (err error)
+//sysnb	Getsid(pid int) (sid int, err error)
 //sysnb	Gettimeofday(tv *Timeval) (err error)
 //sysnb	Getuid() (uid int)
 //sys	Kill(pid int, signum syscall.Signal) (err error)
@@ -657,8 +648,8 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Openat(dirfd int, path string, flags int, mode uint32) (fd int, err error)
 //sys	Pathconf(path string, name int) (val int, err error)
 //sys	Pause() (err error)
-//sys	Pread(fd int, p []byte, offset int64) (n int, err error)
-//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error)
+//sys	pread(fd int, p []byte, offset int64) (n int, err error)
+//sys	pwrite(fd int, p []byte, offset int64) (n int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
 //sys	Readlink(path string, buf []byte) (n int, err error)
 //sys	Rename(from string, to string) (err error)
@@ -674,7 +665,6 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Setpriority(which int, who int, prio int) (err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
 //sysnb	Setreuid(ruid int, euid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Setuid(uid int) (err error)
 //sys	Shutdown(s int, how int) (err error) = libsocket.shutdown
@@ -751,8 +741,20 @@ type fileObjCookie struct {
 type EventPort struct {
 	port  int
 	mu    sync.Mutex
-	fds   map[uintptr]interface{}
+	fds   map[uintptr]*fileObjCookie
 	paths map[string]*fileObjCookie
+	// The user cookie presents an interesting challenge from a memory management perspective.
+	// There are two paths by which we can discover that it is no longer in use:
+	// 1. The user calls port_dissociate before any events fire
+	// 2. An event fires and we return it to the user
+	// The tricky situation is if the event has fired in the kernel but
+	// the user hasn't requested/received it yet.
+	// If the user wants to port_dissociate before the event has been processed,
+	// we should handle things gracefully. To do so, we need to keep an extra
+	// reference to the cookie around until the event is processed
+	// thus the otherwise seemingly extraneous "cookies" map
+	// The key of this map is a pointer to the corresponding fCookie
+	cookies map[*fileObjCookie]struct{}
 }
 
 // PortEvent is an abstraction of the port_event C struct.
@@ -776,9 +778,10 @@ func NewEventPort() (*EventPort, error) {
 		return nil, err
 	}
 	e := &EventPort{
-		port:  port,
-		fds:   make(map[uintptr]interface{}),
-		paths: make(map[string]*fileObjCookie),
+		port:    port,
+		fds:     make(map[uintptr]*fileObjCookie),
+		paths:   make(map[string]*fileObjCookie),
+		cookies: make(map[*fileObjCookie]struct{}),
 	}
 	return e, nil
 }
@@ -793,9 +796,14 @@ func NewEventPort() (*EventPort, error) {
 func (e *EventPort) Close() error {
 	e.mu.Lock()
 	defer e.mu.Unlock()
+	err := Close(e.port)
+	if err != nil {
+		return err
+	}
 	e.fds = nil
 	e.paths = nil
-	return Close(e.port)
+	e.cookies = nil
+	return nil
 }
 
 // PathIsWatched checks to see if path is associated with this EventPort.
@@ -822,16 +830,16 @@ func (e *EventPort) AssociatePath(path string, stat os.FileInfo, events int, coo
 	if _, found := e.paths[path]; found {
 		return fmt.Errorf("%v is already associated with this Event Port", path)
 	}
-	fobj, err := createFileObj(path, stat)
+	fCookie, err := createFileObjCookie(path, stat, cookie)
 	if err != nil {
 		return err
 	}
-	fCookie := &fileObjCookie{fobj, cookie}
-	_, err = port_associate(e.port, PORT_SOURCE_FILE, uintptr(unsafe.Pointer(fobj)), events, (*byte)(unsafe.Pointer(&fCookie.cookie)))
+	_, err = port_associate(e.port, PORT_SOURCE_FILE, uintptr(unsafe.Pointer(fCookie.fobj)), events, (*byte)(unsafe.Pointer(fCookie)))
 	if err != nil {
 		return err
 	}
 	e.paths[path] = fCookie
+	e.cookies[fCookie] = struct{}{}
 	return nil
 }
 
@@ -844,11 +852,19 @@ func (e *EventPort) DissociatePath(path string) error {
 		return fmt.Errorf("%v is not associated with this Event Port", path)
 	}
 	_, err := port_dissociate(e.port, PORT_SOURCE_FILE, uintptr(unsafe.Pointer(f.fobj)))
-	if err != nil {
+	// If the path is no longer associated with this event port (ENOENT)
+	// we should delete it from our map. We can still return ENOENT to the caller.
+	// But we need to save the cookie
+	if err != nil && err != ENOENT {
 		return err
 	}
+	if err == nil {
+		// dissociate was successful, safe to delete the cookie
+		fCookie := e.paths[path]
+		delete(e.cookies, fCookie)
+	}
 	delete(e.paths, path)
-	return nil
+	return err
 }
 
 // AssociateFd wraps calls to port_associate(3c) on file descriptors.
@@ -858,12 +874,16 @@ func (e *EventPort) AssociateFd(fd uintptr, events int, cookie interface{}) erro
 	if _, found := e.fds[fd]; found {
 		return fmt.Errorf("%v is already associated with this Event Port", fd)
 	}
-	pcookie := &cookie
-	_, err := port_associate(e.port, PORT_SOURCE_FD, fd, events, (*byte)(unsafe.Pointer(pcookie)))
+	fCookie, err := createFileObjCookie("", nil, cookie)
 	if err != nil {
 		return err
 	}
-	e.fds[fd] = pcookie
+	_, err = port_associate(e.port, PORT_SOURCE_FD, fd, events, (*byte)(unsafe.Pointer(fCookie)))
+	if err != nil {
+		return err
+	}
+	e.fds[fd] = fCookie
+	e.cookies[fCookie] = struct{}{}
 	return nil
 }
 
@@ -876,28 +896,37 @@ func (e *EventPort) DissociateFd(fd uintptr) error {
 		return fmt.Errorf("%v is not associated with this Event Port", fd)
 	}
 	_, err := port_dissociate(e.port, PORT_SOURCE_FD, fd)
-	if err != nil {
+	if err != nil && err != ENOENT {
 		return err
 	}
+	if err == nil {
+		// dissociate was successful, safe to delete the cookie
+		fCookie := e.fds[fd]
+		delete(e.cookies, fCookie)
+	}
 	delete(e.fds, fd)
-	return nil
+	return err
 }
 
-func createFileObj(name string, stat os.FileInfo) (*fileObj, error) {
-	fobj := new(fileObj)
-	bs, err := ByteSliceFromString(name)
-	if err != nil {
-		return nil, err
-	}
-	fobj.Name = (*int8)(unsafe.Pointer(&bs[0]))
-	s := stat.Sys().(*syscall.Stat_t)
-	fobj.Atim.Sec = s.Atim.Sec
-	fobj.Atim.Nsec = s.Atim.Nsec
-	fobj.Mtim.Sec = s.Mtim.Sec
-	fobj.Mtim.Nsec = s.Mtim.Nsec
-	fobj.Ctim.Sec = s.Ctim.Sec
-	fobj.Ctim.Nsec = s.Ctim.Nsec
-	return fobj, nil
+func createFileObjCookie(name string, stat os.FileInfo, cookie interface{}) (*fileObjCookie, error) {
+	fCookie := new(fileObjCookie)
+	fCookie.cookie = cookie
+	if name != "" && stat != nil {
+		fCookie.fobj = new(fileObj)
+		bs, err := ByteSliceFromString(name)
+		if err != nil {
+			return nil, err
+		}
+		fCookie.fobj.Name = (*int8)(unsafe.Pointer(&bs[0]))
+		s := stat.Sys().(*syscall.Stat_t)
+		fCookie.fobj.Atim.Sec = s.Atim.Sec
+		fCookie.fobj.Atim.Nsec = s.Atim.Nsec
+		fCookie.fobj.Mtim.Sec = s.Mtim.Sec
+		fCookie.fobj.Mtim.Nsec = s.Mtim.Nsec
+		fCookie.fobj.Ctim.Sec = s.Ctim.Sec
+		fCookie.fobj.Ctim.Nsec = s.Ctim.Nsec
+	}
+	return fCookie, nil
 }
 
 // GetOne wraps port_get(3c) and returns a single PortEvent.
@@ -908,24 +937,52 @@ func (e *EventPort) GetOne(t *Timespec) (*PortEvent, error) {
 		return nil, err
 	}
 	p := new(PortEvent)
-	p.Events = pe.Events
-	p.Source = pe.Source
 	e.mu.Lock()
 	defer e.mu.Unlock()
-	switch pe.Source {
+	err = e.peIntToExt(pe, p)
+	if err != nil {
+		return nil, err
+	}
+	return p, nil
+}
+
+// peIntToExt converts a cgo portEvent struct into the friendlier PortEvent
+// NOTE: Always call this function while holding the e.mu mutex
+func (e *EventPort) peIntToExt(peInt *portEvent, peExt *PortEvent) error {
+	if e.cookies == nil {
+		return fmt.Errorf("this EventPort is already closed")
+	}
+	peExt.Events = peInt.Events
+	peExt.Source = peInt.Source
+	fCookie := (*fileObjCookie)(unsafe.Pointer(peInt.User))
+	_, found := e.cookies[fCookie]
+
+	if !found {
+		panic("unexpected event port address; may be due to kernel bug; see https://go.dev/issue/54254")
+	}
+	peExt.Cookie = fCookie.cookie
+	delete(e.cookies, fCookie)
+
+	switch peInt.Source {
 	case PORT_SOURCE_FD:
-		p.Fd = uintptr(pe.Object)
-		cookie := (*interface{})(unsafe.Pointer(pe.User))
-		p.Cookie = *cookie
-		delete(e.fds, p.Fd)
+		peExt.Fd = uintptr(peInt.Object)
+		// Only remove the fds entry if it exists and this cookie matches
+		if fobj, ok := e.fds[peExt.Fd]; ok {
+			if fobj == fCookie {
+				delete(e.fds, peExt.Fd)
+			}
+		}
 	case PORT_SOURCE_FILE:
-		p.fobj = (*fileObj)(unsafe.Pointer(uintptr(pe.Object)))
-		p.Path = BytePtrToString((*byte)(unsafe.Pointer(p.fobj.Name)))
-		cookie := (*interface{})(unsafe.Pointer(pe.User))
-		p.Cookie = *cookie
-		delete(e.paths, p.Path)
+		peExt.fobj = fCookie.fobj
+		peExt.Path = BytePtrToString((*byte)(unsafe.Pointer(peExt.fobj.Name)))
+		// Only remove the paths entry if it exists and this cookie matches
+		if fobj, ok := e.paths[peExt.Path]; ok {
+			if fobj == fCookie {
+				delete(e.paths, peExt.Path)
+			}
+		}
 	}
-	return p, nil
+	return nil
 }
 
 // Pending wraps port_getn(3c) and returns how many events are pending.
@@ -949,7 +1006,7 @@ func (e *EventPort) Get(s []PortEvent, min int, timeout *Timespec) (int, error)
 	got := uint32(min)
 	max := uint32(len(s))
 	var err error
-	ps := make([]portEvent, max, max)
+	ps := make([]portEvent, max)
 	_, err = port_getn(e.port, &ps[0], max, &got, timeout)
 	// got will be trustworthy with ETIME, but not any other error.
 	if err != nil && err != ETIME {
@@ -957,22 +1014,122 @@ func (e *EventPort) Get(s []PortEvent, min int, timeout *Timespec) (int, error)
 	}
 	e.mu.Lock()
 	defer e.mu.Unlock()
+	valid := 0
 	for i := 0; i < int(got); i++ {
-		s[i].Events = ps[i].Events
-		s[i].Source = ps[i].Source
-		switch ps[i].Source {
-		case PORT_SOURCE_FD:
-			s[i].Fd = uintptr(ps[i].Object)
-			cookie := (*interface{})(unsafe.Pointer(ps[i].User))
-			s[i].Cookie = *cookie
-			delete(e.fds, s[i].Fd)
-		case PORT_SOURCE_FILE:
-			s[i].fobj = (*fileObj)(unsafe.Pointer(uintptr(ps[i].Object)))
-			s[i].Path = BytePtrToString((*byte)(unsafe.Pointer(s[i].fobj.Name)))
-			cookie := (*interface{})(unsafe.Pointer(ps[i].User))
-			s[i].Cookie = *cookie
-			delete(e.paths, s[i].Path)
+		err2 := e.peIntToExt(&ps[i], &s[i])
+		if err2 != nil {
+			if valid == 0 && err == nil {
+				// If err2 is the only error and there are no valid events
+				// to return, return it to the caller.
+				err = err2
+			}
+			break
+		}
+		valid = i + 1
+	}
+	return valid, err
+}
+
+//sys	putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error)
+
+func Putmsg(fd int, cl []byte, data []byte, flags int) (err error) {
+	var clp, datap *strbuf
+	if len(cl) > 0 {
+		clp = &strbuf{
+			Len: int32(len(cl)),
+			Buf: (*int8)(unsafe.Pointer(&cl[0])),
+		}
+	}
+	if len(data) > 0 {
+		datap = &strbuf{
+			Len: int32(len(data)),
+			Buf: (*int8)(unsafe.Pointer(&data[0])),
+		}
+	}
+	return putmsg(fd, clp, datap, flags)
+}
+
+//sys	getmsg(fd int, clptr *strbuf, dataptr *strbuf, flags *int) (err error)
+
+func Getmsg(fd int, cl []byte, data []byte) (retCl []byte, retData []byte, flags int, err error) {
+	var clp, datap *strbuf
+	if len(cl) > 0 {
+		clp = &strbuf{
+			Maxlen: int32(len(cl)),
+			Buf:    (*int8)(unsafe.Pointer(&cl[0])),
 		}
 	}
-	return int(got), err
+	if len(data) > 0 {
+		datap = &strbuf{
+			Maxlen: int32(len(data)),
+			Buf:    (*int8)(unsafe.Pointer(&data[0])),
+		}
+	}
+
+	if err = getmsg(fd, clp, datap, &flags); err != nil {
+		return nil, nil, 0, err
+	}
+
+	if len(cl) > 0 {
+		retCl = cl[:clp.Len]
+	}
+	if len(data) > 0 {
+		retData = data[:datap.Len]
+	}
+	return retCl, retData, flags, nil
+}
+
+func IoctlSetIntRetInt(fd int, req int, arg int) (int, error) {
+	return ioctlRet(fd, req, uintptr(arg))
+}
+
+func IoctlSetString(fd int, req int, val string) error {
+	bs := make([]byte, len(val)+1)
+	copy(bs[:len(bs)-1], val)
+	err := ioctlPtr(fd, req, unsafe.Pointer(&bs[0]))
+	runtime.KeepAlive(&bs[0])
+	return err
+}
+
+// Lifreq Helpers
+
+func (l *Lifreq) SetName(name string) error {
+	if len(name) >= len(l.Name) {
+		return fmt.Errorf("name cannot be more than %d characters", len(l.Name)-1)
+	}
+	for i := range name {
+		l.Name[i] = int8(name[i])
+	}
+	return nil
+}
+
+func (l *Lifreq) SetLifruInt(d int) {
+	*(*int)(unsafe.Pointer(&l.Lifru[0])) = d
+}
+
+func (l *Lifreq) GetLifruInt() int {
+	return *(*int)(unsafe.Pointer(&l.Lifru[0]))
+}
+
+func (l *Lifreq) SetLifruUint(d uint) {
+	*(*uint)(unsafe.Pointer(&l.Lifru[0])) = d
+}
+
+func (l *Lifreq) GetLifruUint() uint {
+	return *(*uint)(unsafe.Pointer(&l.Lifru[0]))
+}
+
+func IoctlLifreq(fd int, req int, l *Lifreq) error {
+	return ioctlPtr(fd, req, unsafe.Pointer(l))
+}
+
+// Strioctl Helpers
+
+func (s *Strioctl) SetInt(i int) {
+	s.Len = int32(unsafe.Sizeof(i))
+	s.Dp = (*int8)(unsafe.Pointer(&i))
+}
+
+func IoctlSetStrioctlRetInt(fd int, req int, s *Strioctl) (int, error) {
+	return ioctlPtrRet(fd, req, unsafe.Pointer(s))
 }
diff --git a/vendor/golang.org/x/sys/unix/syscall_unix.go b/vendor/golang.org/x/sys/unix/syscall_unix.go
index cf296a2433..8e48c29ec3 100644
--- a/vendor/golang.org/x/sys/unix/syscall_unix.go
+++ b/vendor/golang.org/x/sys/unix/syscall_unix.go
@@ -13,8 +13,6 @@ import (
 	"sync"
 	"syscall"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 var (
@@ -117,11 +115,7 @@ func (m *mmapper) Mmap(fd int, offset int64, length int, prot int, flags int) (d
 	}
 
 	// Use unsafe to convert addr into a []byte.
-	var b []byte
-	hdr := (*unsafeheader.Slice)(unsafe.Pointer(&b))
-	hdr.Data = unsafe.Pointer(addr)
-	hdr.Cap = length
-	hdr.Len = length
+	b := unsafe.Slice((*byte)(unsafe.Pointer(addr)), length)
 
 	// Register mapping in m and return it.
 	p := &b[cap(b)-1]
@@ -177,6 +171,30 @@ func Write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+func Pread(fd int, p []byte, offset int64) (n int, err error) {
+	n, err = pread(fd, p, offset)
+	if raceenabled {
+		if n > 0 {
+			raceWriteRange(unsafe.Pointer(&p[0]), n)
+		}
+		if err == nil {
+			raceAcquire(unsafe.Pointer(&ioSync))
+		}
+	}
+	return
+}
+
+func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+	if raceenabled {
+		raceReleaseMerge(unsafe.Pointer(&ioSync))
+	}
+	n, err = pwrite(fd, p, offset)
+	if raceenabled && n > 0 {
+		raceReadRange(unsafe.Pointer(&p[0]), n)
+	}
+	return
+}
+
 // For testing: clients can set this flag to force
 // creation of IPv6 sockets to return EAFNOSUPPORT.
 var SocketDisableIPv6 bool
@@ -313,16 +331,142 @@ func Recvfrom(fd int, p []byte, flags int) (n int, from Sockaddr, err error) {
 	return
 }
 
+// Recvmsg receives a message from a socket using the recvmsg system call. The
+// received non-control data will be written to p, and any "out of band"
+// control data will be written to oob. The flags are passed to recvmsg.
+//
+// The results are:
+//   - n is the number of non-control data bytes read into p
+//   - oobn is the number of control data bytes read into oob; this may be interpreted using [ParseSocketControlMessage]
+//   - recvflags is flags returned by recvmsg
+//   - from is the address of the sender
+//
+// If the underlying socket type is not SOCK_DGRAM, a received message
+// containing oob data and a single '\0' of non-control data is treated as if
+// the message contained only control data, i.e. n will be zero on return.
+func Recvmsg(fd int, p, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
+	var iov [1]Iovec
+	if len(p) > 0 {
+		iov[0].Base = &p[0]
+		iov[0].SetLen(len(p))
+	}
+	var rsa RawSockaddrAny
+	n, oobn, recvflags, err = recvmsgRaw(fd, iov[:], oob, flags, &rsa)
+	// source address is only specified if the socket is unconnected
+	if rsa.Addr.Family != AF_UNSPEC {
+		from, err = anyToSockaddr(fd, &rsa)
+	}
+	return
+}
+
+// RecvmsgBuffers receives a message from a socket using the recvmsg system
+// call. This function is equivalent to Recvmsg, but non-control data read is
+// scattered into the buffers slices.
+func RecvmsgBuffers(fd int, buffers [][]byte, oob []byte, flags int) (n, oobn int, recvflags int, from Sockaddr, err error) {
+	iov := make([]Iovec, len(buffers))
+	for i := range buffers {
+		if len(buffers[i]) > 0 {
+			iov[i].Base = &buffers[i][0]
+			iov[i].SetLen(len(buffers[i]))
+		} else {
+			iov[i].Base = (*byte)(unsafe.Pointer(&_zero))
+		}
+	}
+	var rsa RawSockaddrAny
+	n, oobn, recvflags, err = recvmsgRaw(fd, iov, oob, flags, &rsa)
+	if err == nil && rsa.Addr.Family != AF_UNSPEC {
+		from, err = anyToSockaddr(fd, &rsa)
+	}
+	return
+}
+
+// Sendmsg sends a message on a socket to an address using the sendmsg system
+// call. This function is equivalent to SendmsgN, but does not return the
+// number of bytes actually sent.
+func Sendmsg(fd int, p, oob []byte, to Sockaddr, flags int) (err error) {
+	_, err = SendmsgN(fd, p, oob, to, flags)
+	return
+}
+
+// SendmsgN sends a message on a socket to an address using the sendmsg system
+// call. p contains the non-control data to send, and oob contains the "out of
+// band" control data. The flags are passed to sendmsg. The number of
+// non-control bytes actually written to the socket is returned.
+//
+// Some socket types do not support sending control data without accompanying
+// non-control data. If p is empty, and oob contains control data, and the
+// underlying socket type is not SOCK_DGRAM, p will be treated as containing a
+// single '\0' and the return value will indicate zero bytes sent.
+//
+// The Go function Recvmsg, if called with an empty p and a non-empty oob,
+// will read and ignore this additional '\0'.  If the message is received by
+// code that does not use Recvmsg, or that does not use Go at all, that code
+// will need to be written to expect and ignore the additional '\0'.
+//
+// If you need to send non-empty oob with p actually empty, and if the
+// underlying socket type supports it, you can do so via a raw system call as
+// follows:
+//
+//	msg := &unix.Msghdr{
+//	    Control: &oob[0],
+//	}
+//	msg.SetControllen(len(oob))
+//	n, _, errno := unix.Syscall(unix.SYS_SENDMSG, uintptr(fd), uintptr(unsafe.Pointer(msg)), flags)
+func SendmsgN(fd int, p, oob []byte, to Sockaddr, flags int) (n int, err error) {
+	var iov [1]Iovec
+	if len(p) > 0 {
+		iov[0].Base = &p[0]
+		iov[0].SetLen(len(p))
+	}
+	var ptr unsafe.Pointer
+	var salen _Socklen
+	if to != nil {
+		ptr, salen, err = to.sockaddr()
+		if err != nil {
+			return 0, err
+		}
+	}
+	return sendmsgN(fd, iov[:], oob, ptr, salen, flags)
+}
+
+// SendmsgBuffers sends a message on a socket to an address using the sendmsg
+// system call. This function is equivalent to SendmsgN, but the non-control
+// data is gathered from buffers.
+func SendmsgBuffers(fd int, buffers [][]byte, oob []byte, to Sockaddr, flags int) (n int, err error) {
+	iov := make([]Iovec, len(buffers))
+	for i := range buffers {
+		if len(buffers[i]) > 0 {
+			iov[i].Base = &buffers[i][0]
+			iov[i].SetLen(len(buffers[i]))
+		} else {
+			iov[i].Base = (*byte)(unsafe.Pointer(&_zero))
+		}
+	}
+	var ptr unsafe.Pointer
+	var salen _Socklen
+	if to != nil {
+		ptr, salen, err = to.sockaddr()
+		if err != nil {
+			return 0, err
+		}
+	}
+	return sendmsgN(fd, iov, oob, ptr, salen, flags)
+}
+
 func Send(s int, buf []byte, flags int) (err error) {
 	return sendto(s, buf, flags, nil, 0)
 }
 
 func Sendto(fd int, p []byte, flags int, to Sockaddr) (err error) {
-	ptr, n, err := to.sockaddr()
-	if err != nil {
-		return err
+	var ptr unsafe.Pointer
+	var salen _Socklen
+	if to != nil {
+		ptr, salen, err = to.sockaddr()
+		if err != nil {
+			return err
+		}
 	}
-	return sendto(fd, p, flags, ptr, n)
+	return sendto(fd, p, flags, ptr, salen)
 }
 
 func SetsockoptByte(fd, level, opt int, value byte) (err error) {
@@ -433,3 +577,20 @@ func Lutimes(path string, tv []Timeval) error {
 	}
 	return UtimesNanoAt(AT_FDCWD, path, ts, AT_SYMLINK_NOFOLLOW)
 }
+
+// emptyIovecs reports whether there are no bytes in the slice of Iovec.
+func emptyIovecs(iov []Iovec) bool {
+	for i := range iov {
+		if iov[i].Len > 0 {
+			return false
+		}
+	}
+	return true
+}
+
+// Setrlimit sets a resource limit.
+func Setrlimit(resource int, rlim *Rlimit) error {
+	// Just call the syscall version, because as of Go 1.21
+	// it will affect starting a new process.
+	return syscall.Setrlimit(resource, (*syscall.Rlimit)(rlim))
+}
diff --git a/vendor/golang.org/x/sys/unix/syscall_unix_gc.go b/vendor/golang.org/x/sys/unix/syscall_unix_gc.go
index 5898e9a52b..b6919ca580 100644
--- a/vendor/golang.org/x/sys/unix/syscall_unix_gc.go
+++ b/vendor/golang.org/x/sys/unix/syscall_unix_gc.go
@@ -2,11 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris) && gc && !ppc64le && !ppc64
-// +build darwin dragonfly freebsd linux netbsd openbsd solaris
+//go:build (darwin || dragonfly || freebsd || (linux && !ppc64 && !ppc64le) || netbsd || openbsd || solaris) && gc
+// +build darwin dragonfly freebsd linux,!ppc64,!ppc64le netbsd openbsd solaris
 // +build gc
-// +build !ppc64le
-// +build !ppc64
 
 package unix
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
index 5fb76a1468..d3d49ec3ed 100644
--- a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
+++ b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
@@ -9,8 +9,10 @@ package unix
 
 import (
 	"bytes"
+	"fmt"
 	"runtime"
 	"sort"
+	"strings"
 	"sync"
 	"syscall"
 	"unsafe"
@@ -55,7 +57,13 @@ func (d *Dirent) NameString() string {
 	if d == nil {
 		return ""
 	}
-	return string(d.Name[:d.Namlen])
+	s := string(d.Name[:])
+	idx := strings.IndexByte(s, 0)
+	if idx == -1 {
+		return s
+	} else {
+		return s[:idx]
+	}
 }
 
 func (sa *SockaddrInet4) sockaddr() (unsafe.Pointer, _Socklen, error) {
@@ -131,8 +139,7 @@ func anyToSockaddr(_ int, rsa *RawSockaddrAny) (Sockaddr, error) {
 		for n < int(pp.Len) && pp.Path[n] != 0 {
 			n++
 		}
-		bytes := (*[len(pp.Path)]byte)(unsafe.Pointer(&pp.Path[0]))[0:n]
-		sa.Name = string(bytes)
+		sa.Name = string(unsafe.Slice((*byte)(unsafe.Pointer(&pp.Path[0])), n))
 		return sa, nil
 
 	case AF_INET:
@@ -205,7 +212,8 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 //sys	sendmsg(s int, msg *Msghdr, flags int) (n int, err error) = SYS___SENDMSG_A
 //sys   mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) = SYS_MMAP
 //sys   munmap(addr uintptr, length uintptr) (err error) = SYS_MUNMAP
-//sys   ioctl(fd int, req uint, arg uintptr) (err error) = SYS_IOCTL
+//sys   ioctl(fd int, req int, arg uintptr) (err error) = SYS_IOCTL
+//sys   ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) = SYS_IOCTL
 
 //sys   Access(path string, mode uint32) (err error) = SYS___ACCESS_A
 //sys   Chdir(path string) (err error) = SYS___CHDIR_A
@@ -579,8 +587,10 @@ func Pipe(p []int) (err error) {
 	}
 	var pp [2]_C_int
 	err = pipe(&pp)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return
 }
 
@@ -1228,6 +1238,14 @@ func Readdir(dir uintptr) (*Dirent, error) {
 	return &ent, err
 }
 
+func readdir_r(dirp uintptr, entry *direntLE, result **direntLE) (err error) {
+	r0, _, e1 := syscall_syscall(SYS___READDIR_R_A, dirp, uintptr(unsafe.Pointer(entry)), uintptr(unsafe.Pointer(result)))
+	if int64(r0) == -1 {
+		err = errnoErr(Errno(e1))
+	}
+	return
+}
+
 func Closedir(dir uintptr) error {
 	_, _, e := syscall_syscall(SYS_CLOSEDIR, dir, 0, 0)
 	if e != 0 {
@@ -1819,3 +1837,158 @@ func Unmount(name string, mtm int) (err error) {
 	}
 	return err
 }
+
+func fdToPath(dirfd int) (path string, err error) {
+	var buffer [1024]byte
+	// w_ctrl()
+	ret := runtime.CallLeFuncByPtr(runtime.XplinkLibvec+SYS_W_IOCTL<<4,
+		[]uintptr{uintptr(dirfd), 17, 1024, uintptr(unsafe.Pointer(&buffer[0]))})
+	if ret == 0 {
+		zb := bytes.IndexByte(buffer[:], 0)
+		if zb == -1 {
+			zb = len(buffer)
+		}
+		// __e2a_l()
+		runtime.CallLeFuncByPtr(runtime.XplinkLibvec+SYS___E2A_L<<4,
+			[]uintptr{uintptr(unsafe.Pointer(&buffer[0])), uintptr(zb)})
+		return string(buffer[:zb]), nil
+	}
+	// __errno()
+	errno := int(*(*int32)(unsafe.Pointer(runtime.CallLeFuncByPtr(runtime.XplinkLibvec+SYS___ERRNO<<4,
+		[]uintptr{}))))
+	// __errno2()
+	errno2 := int(runtime.CallLeFuncByPtr(runtime.XplinkLibvec+SYS___ERRNO2<<4,
+		[]uintptr{}))
+	// strerror_r()
+	ret = runtime.CallLeFuncByPtr(runtime.XplinkLibvec+SYS_STRERROR_R<<4,
+		[]uintptr{uintptr(errno), uintptr(unsafe.Pointer(&buffer[0])), 1024})
+	if ret == 0 {
+		zb := bytes.IndexByte(buffer[:], 0)
+		if zb == -1 {
+			zb = len(buffer)
+		}
+		return "", fmt.Errorf("%s (errno2=0x%x)", buffer[:zb], errno2)
+	} else {
+		return "", fmt.Errorf("fdToPath errno %d (errno2=0x%x)", errno, errno2)
+	}
+}
+
+func direntLeToDirentUnix(dirent *direntLE, dir uintptr, path string) (Dirent, error) {
+	var d Dirent
+
+	d.Ino = uint64(dirent.Ino)
+	offset, err := Telldir(dir)
+	if err != nil {
+		return d, err
+	}
+
+	d.Off = int64(offset)
+	s := string(bytes.Split(dirent.Name[:], []byte{0})[0])
+	copy(d.Name[:], s)
+
+	d.Reclen = uint16(24 + len(d.NameString()))
+	var st Stat_t
+	path = path + "/" + s
+	err = Lstat(path, &st)
+	if err != nil {
+		return d, err
+	}
+
+	d.Type = uint8(st.Mode >> 24)
+	return d, err
+}
+
+func Getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
+	// Simulation of Getdirentries port from the Darwin implementation.
+	// COMMENTS FROM DARWIN:
+	// It's not the full required semantics, but should handle the case
+	// of calling Getdirentries or ReadDirent repeatedly.
+	// It won't handle assigning the results of lseek to *basep, or handle
+	// the directory being edited underfoot.
+
+	skip, err := Seek(fd, 0, 1 /* SEEK_CUR */)
+	if err != nil {
+		return 0, err
+	}
+
+	// Get path from fd to avoid unavailable call (fdopendir)
+	path, err := fdToPath(fd)
+	if err != nil {
+		return 0, err
+	}
+	d, err := Opendir(path)
+	if err != nil {
+		return 0, err
+	}
+	defer Closedir(d)
+
+	var cnt int64
+	for {
+		var entryLE direntLE
+		var entrypLE *direntLE
+		e := readdir_r(d, &entryLE, &entrypLE)
+		if e != nil {
+			return n, e
+		}
+		if entrypLE == nil {
+			break
+		}
+		if skip > 0 {
+			skip--
+			cnt++
+			continue
+		}
+
+		// Dirent on zos has a different structure
+		entry, e := direntLeToDirentUnix(&entryLE, d, path)
+		if e != nil {
+			return n, e
+		}
+
+		reclen := int(entry.Reclen)
+		if reclen > len(buf) {
+			// Not enough room. Return for now.
+			// The counter will let us know where we should start up again.
+			// Note: this strategy for suspending in the middle and
+			// restarting is O(n^2) in the length of the directory. Oh well.
+			break
+		}
+
+		// Copy entry into return buffer.
+		s := unsafe.Slice((*byte)(unsafe.Pointer(&entry)), reclen)
+		copy(buf, s)
+
+		buf = buf[reclen:]
+		n += reclen
+		cnt++
+	}
+	// Set the seek offset of the input fd to record
+	// how many files we've already returned.
+	_, err = Seek(fd, cnt, 0 /* SEEK_SET */)
+	if err != nil {
+		return n, err
+	}
+
+	return n, nil
+}
+
+func ReadDirent(fd int, buf []byte) (n int, err error) {
+	var base = (*uintptr)(unsafe.Pointer(new(uint64)))
+	return Getdirentries(fd, buf, base)
+}
+
+func direntIno(buf []byte) (uint64, bool) {
+	return readInt(buf, unsafe.Offsetof(Dirent{}.Ino), unsafe.Sizeof(Dirent{}.Ino))
+}
+
+func direntReclen(buf []byte) (uint64, bool) {
+	return readInt(buf, unsafe.Offsetof(Dirent{}.Reclen), unsafe.Sizeof(Dirent{}.Reclen))
+}
+
+func direntNamlen(buf []byte) (uint64, bool) {
+	reclen, ok := direntReclen(buf)
+	if !ok {
+		return 0, false
+	}
+	return reclen - uint64(unsafe.Offsetof(Dirent{}.Name)), true
+}
diff --git a/vendor/golang.org/x/sys/unix/sysvshm_unix.go b/vendor/golang.org/x/sys/unix/sysvshm_unix.go
index 0bb4c8de55..5bb41d17bc 100644
--- a/vendor/golang.org/x/sys/unix/sysvshm_unix.go
+++ b/vendor/golang.org/x/sys/unix/sysvshm_unix.go
@@ -7,11 +7,7 @@
 
 package unix
 
-import (
-	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
-)
+import "unsafe"
 
 // SysvShmAttach attaches the Sysv shared memory segment associated with the
 // shared memory identifier id.
@@ -34,12 +30,7 @@ func SysvShmAttach(id int, addr uintptr, flag int) ([]byte, error) {
 	}
 
 	// Use unsafe to convert addr into a []byte.
-	// TODO: convert to unsafe.Slice once we can assume Go 1.17
-	var b []byte
-	hdr := (*unsafeheader.Slice)(unsafe.Pointer(&b))
-	hdr.Data = unsafe.Pointer(addr)
-	hdr.Cap = int(info.Segsz)
-	hdr.Len = int(info.Segsz)
+	b := unsafe.Slice((*byte)(unsafe.Pointer(addr)), int(info.Segsz))
 	return b, nil
 }
 
diff --git a/vendor/golang.org/x/sys/unix/timestruct.go b/vendor/golang.org/x/sys/unix/timestruct.go
index 3d89304055..616b1b2848 100644
--- a/vendor/golang.org/x/sys/unix/timestruct.go
+++ b/vendor/golang.org/x/sys/unix/timestruct.go
@@ -9,7 +9,7 @@ package unix
 
 import "time"
 
-// TimespecToNSec returns the time stored in ts as nanoseconds.
+// TimespecToNsec returns the time stored in ts as nanoseconds.
 func TimespecToNsec(ts Timespec) int64 { return ts.Nano() }
 
 // NsecToTimespec converts a number of nanoseconds into a Timespec.
diff --git a/vendor/golang.org/x/sys/unix/xattr_bsd.go b/vendor/golang.org/x/sys/unix/xattr_bsd.go
index 25df1e3780..f5f8e9f366 100644
--- a/vendor/golang.org/x/sys/unix/xattr_bsd.go
+++ b/vendor/golang.org/x/sys/unix/xattr_bsd.go
@@ -36,9 +36,14 @@ func xattrnamespace(fullattr string) (ns int, attr string, err error) {
 func initxattrdest(dest []byte, idx int) (d unsafe.Pointer) {
 	if len(dest) > idx {
 		return unsafe.Pointer(&dest[idx])
-	} else {
-		return unsafe.Pointer(_zero)
 	}
+	if dest != nil {
+		// extattr_get_file and extattr_list_file treat NULL differently from
+		// a non-NULL pointer of length zero. Preserve the property of nilness,
+		// even if we can't use dest directly.
+		return unsafe.Pointer(&_zero)
+	}
+	return nil
 }
 
 // FreeBSD and NetBSD implement their own syscalls to handle extended attributes
@@ -160,13 +165,12 @@ func Lremovexattr(link string, attr string) (err error) {
 }
 
 func Listxattr(file string, dest []byte) (sz int, err error) {
-	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
 	// FreeBSD won't allow you to list xattrs from multiple namespaces
-	s := 0
+	s, pos := 0, 0
 	for _, nsid := range [...]int{EXTATTR_NAMESPACE_USER, EXTATTR_NAMESPACE_SYSTEM} {
-		stmp, e := ExtattrListFile(file, nsid, uintptr(d), destsiz)
+		stmp, e := ListxattrNS(file, nsid, dest[pos:])
 
 		/* Errors accessing system attrs are ignored so that
 		 * we can implement the Linux-like behavior of omitting errors that
@@ -175,66 +179,102 @@ func Listxattr(file string, dest []byte) (sz int, err error) {
 		 * Linux will still error if we ask for user attributes on a file that
 		 * we don't have read permissions on, so don't ignore those errors
 		 */
-		if e != nil && e == EPERM && nsid != EXTATTR_NAMESPACE_USER {
-			continue
-		} else if e != nil {
+		if e != nil {
+			if e == EPERM && nsid != EXTATTR_NAMESPACE_USER {
+				continue
+			}
 			return s, e
 		}
 
 		s += stmp
-		destsiz -= s
-		if destsiz < 0 {
-			destsiz = 0
+		pos = s
+		if pos > destsiz {
+			pos = destsiz
 		}
-		d = initxattrdest(dest, s)
 	}
 
 	return s, nil
 }
 
-func Flistxattr(fd int, dest []byte) (sz int, err error) {
+func ListxattrNS(file string, nsid int, dest []byte) (sz int, err error) {
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s := 0
+	s, e := ExtattrListFile(file, nsid, uintptr(d), destsiz)
+	if e != nil {
+		return 0, err
+	}
+
+	return s, nil
+}
+
+func Flistxattr(fd int, dest []byte) (sz int, err error) {
+	destsiz := len(dest)
+
+	s, pos := 0, 0
 	for _, nsid := range [...]int{EXTATTR_NAMESPACE_USER, EXTATTR_NAMESPACE_SYSTEM} {
-		stmp, e := ExtattrListFd(fd, nsid, uintptr(d), destsiz)
-		if e != nil && e == EPERM && nsid != EXTATTR_NAMESPACE_USER {
-			continue
-		} else if e != nil {
+		stmp, e := FlistxattrNS(fd, nsid, dest[pos:])
+
+		if e != nil {
+			if e == EPERM && nsid != EXTATTR_NAMESPACE_USER {
+				continue
+			}
 			return s, e
 		}
 
 		s += stmp
-		destsiz -= s
-		if destsiz < 0 {
-			destsiz = 0
+		pos = s
+		if pos > destsiz {
+			pos = destsiz
 		}
-		d = initxattrdest(dest, s)
 	}
 
 	return s, nil
 }
 
-func Llistxattr(link string, dest []byte) (sz int, err error) {
+func FlistxattrNS(fd int, nsid int, dest []byte) (sz int, err error) {
 	d := initxattrdest(dest, 0)
 	destsiz := len(dest)
 
-	s := 0
+	s, e := ExtattrListFd(fd, nsid, uintptr(d), destsiz)
+	if e != nil {
+		return 0, err
+	}
+
+	return s, nil
+}
+
+func Llistxattr(link string, dest []byte) (sz int, err error) {
+	destsiz := len(dest)
+
+	s, pos := 0, 0
 	for _, nsid := range [...]int{EXTATTR_NAMESPACE_USER, EXTATTR_NAMESPACE_SYSTEM} {
-		stmp, e := ExtattrListLink(link, nsid, uintptr(d), destsiz)
-		if e != nil && e == EPERM && nsid != EXTATTR_NAMESPACE_USER {
-			continue
-		} else if e != nil {
+		stmp, e := LlistxattrNS(link, nsid, dest[pos:])
+
+		if e != nil {
+			if e == EPERM && nsid != EXTATTR_NAMESPACE_USER {
+				continue
+			}
 			return s, e
 		}
 
 		s += stmp
-		destsiz -= s
-		if destsiz < 0 {
-			destsiz = 0
+		pos = s
+		if pos > destsiz {
+			pos = destsiz
 		}
-		d = initxattrdest(dest, s)
+	}
+
+	return s, nil
+}
+
+func LlistxattrNS(link string, nsid int, dest []byte) (sz int, err error) {
+	d := initxattrdest(dest, 0)
+	destsiz := len(dest)
+
+	s, e := ExtattrListLink(link, nsid, uintptr(d), destsiz)
+	if e != nil {
+		return 0, err
 	}
 
 	return s, nil
diff --git a/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go
index 476a1c7e77..1430076271 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_darwin_amd64.go
@@ -1270,6 +1270,16 @@ const (
 	SEEK_END                                = 0x2
 	SEEK_HOLE                               = 0x3
 	SEEK_SET                                = 0x0
+	SF_APPEND                               = 0x40000
+	SF_ARCHIVED                             = 0x10000
+	SF_DATALESS                             = 0x40000000
+	SF_FIRMLINK                             = 0x800000
+	SF_IMMUTABLE                            = 0x20000
+	SF_NOUNLINK                             = 0x100000
+	SF_RESTRICTED                           = 0x80000
+	SF_SETTABLE                             = 0x3fff0000
+	SF_SUPPORTED                            = 0x9f0000
+	SF_SYNTHETIC                            = 0xc0000000
 	SHUT_RD                                 = 0x0
 	SHUT_RDWR                               = 0x2
 	SHUT_WR                                 = 0x1
@@ -1543,6 +1553,15 @@ const (
 	TIOCTIMESTAMP                           = 0x40107459
 	TIOCUCNTL                               = 0x80047466
 	TOSTOP                                  = 0x400000
+	UF_APPEND                               = 0x4
+	UF_COMPRESSED                           = 0x20
+	UF_DATAVAULT                            = 0x80
+	UF_HIDDEN                               = 0x8000
+	UF_IMMUTABLE                            = 0x2
+	UF_NODUMP                               = 0x1
+	UF_OPAQUE                               = 0x8
+	UF_SETTABLE                             = 0xffff
+	UF_TRACKED                              = 0x40
 	VDISCARD                                = 0xf
 	VDSUSP                                  = 0xb
 	VEOF                                    = 0x0
diff --git a/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go
index e36f5178d6..ab044a7427 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_darwin_arm64.go
@@ -1270,6 +1270,16 @@ const (
 	SEEK_END                                = 0x2
 	SEEK_HOLE                               = 0x3
 	SEEK_SET                                = 0x0
+	SF_APPEND                               = 0x40000
+	SF_ARCHIVED                             = 0x10000
+	SF_DATALESS                             = 0x40000000
+	SF_FIRMLINK                             = 0x800000
+	SF_IMMUTABLE                            = 0x20000
+	SF_NOUNLINK                             = 0x100000
+	SF_RESTRICTED                           = 0x80000
+	SF_SETTABLE                             = 0x3fff0000
+	SF_SUPPORTED                            = 0x9f0000
+	SF_SYNTHETIC                            = 0xc0000000
 	SHUT_RD                                 = 0x0
 	SHUT_RDWR                               = 0x2
 	SHUT_WR                                 = 0x1
@@ -1543,6 +1553,15 @@ const (
 	TIOCTIMESTAMP                           = 0x40107459
 	TIOCUCNTL                               = 0x80047466
 	TOSTOP                                  = 0x400000
+	UF_APPEND                               = 0x4
+	UF_COMPRESSED                           = 0x20
+	UF_DATAVAULT                            = 0x80
+	UF_HIDDEN                               = 0x8000
+	UF_IMMUTABLE                            = 0x2
+	UF_NODUMP                               = 0x1
+	UF_OPAQUE                               = 0x8
+	UF_SETTABLE                             = 0xffff
+	UF_TRACKED                              = 0x40
 	VDISCARD                                = 0xf
 	VDSUSP                                  = 0xb
 	VEOF                                    = 0x0
diff --git a/vendor/golang.org/x/sys/unix/zerrors_freebsd_386.go b/vendor/golang.org/x/sys/unix/zerrors_freebsd_386.go
index 440900112c..f8c2c51387 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_freebsd_386.go
@@ -151,6 +151,7 @@ const (
 	BIOCSETF                       = 0x80084267
 	BIOCSETFNR                     = 0x80084282
 	BIOCSETIF                      = 0x8020426c
+	BIOCSETVLANPCP                 = 0x80044285
 	BIOCSETWF                      = 0x8008427b
 	BIOCSETZBUF                    = 0x800c4281
 	BIOCSHDRCMPLT                  = 0x80044275
@@ -447,7 +448,7 @@ const (
 	DLT_IEEE802_16_MAC_CPS_RADIO   = 0xc1
 	DLT_INFINIBAND                 = 0xf7
 	DLT_IPFILTER                   = 0x74
-	DLT_IPMB                       = 0xc7
+	DLT_IPMB_KONTRON               = 0xc7
 	DLT_IPMB_LINUX                 = 0xd1
 	DLT_IPMI_HPM_2                 = 0x104
 	DLT_IPNET                      = 0xe2
@@ -487,10 +488,11 @@ const (
 	DLT_LINUX_LAPD                 = 0xb1
 	DLT_LINUX_PPP_WITHDIRECTION    = 0xa6
 	DLT_LINUX_SLL                  = 0x71
+	DLT_LINUX_SLL2                 = 0x114
 	DLT_LOOP                       = 0x6c
 	DLT_LORATAP                    = 0x10e
 	DLT_LTALK                      = 0x72
-	DLT_MATCHING_MAX               = 0x113
+	DLT_MATCHING_MAX               = 0x114
 	DLT_MATCHING_MIN               = 0x68
 	DLT_MFR                        = 0xb6
 	DLT_MOST                       = 0xd3
@@ -734,6 +736,7 @@ const (
 	IPPROTO_CMTP                   = 0x26
 	IPPROTO_CPHB                   = 0x49
 	IPPROTO_CPNX                   = 0x48
+	IPPROTO_DCCP                   = 0x21
 	IPPROTO_DDP                    = 0x25
 	IPPROTO_DGP                    = 0x56
 	IPPROTO_DIVERT                 = 0x102
@@ -814,7 +817,6 @@ const (
 	IPPROTO_SCTP                   = 0x84
 	IPPROTO_SDRP                   = 0x2a
 	IPPROTO_SEND                   = 0x103
-	IPPROTO_SEP                    = 0x21
 	IPPROTO_SHIM6                  = 0x8c
 	IPPROTO_SKIP                   = 0x39
 	IPPROTO_SPACER                 = 0x7fff
@@ -911,6 +913,7 @@ const (
 	IPV6_V6ONLY                    = 0x1b
 	IPV6_VERSION                   = 0x60
 	IPV6_VERSION_MASK              = 0xf0
+	IPV6_VLAN_PCP                  = 0x4b
 	IP_ADD_MEMBERSHIP              = 0xc
 	IP_ADD_SOURCE_MEMBERSHIP       = 0x46
 	IP_BINDANY                     = 0x18
@@ -989,8 +992,12 @@ const (
 	IP_TOS                         = 0x3
 	IP_TTL                         = 0x4
 	IP_UNBLOCK_SOURCE              = 0x49
+	IP_VLAN_PCP                    = 0x4b
 	ISIG                           = 0x80
 	ISTRIP                         = 0x20
+	ITIMER_PROF                    = 0x2
+	ITIMER_REAL                    = 0x0
+	ITIMER_VIRTUAL                 = 0x1
 	IXANY                          = 0x800
 	IXOFF                          = 0x400
 	IXON                           = 0x200
@@ -1000,7 +1007,6 @@ const (
 	KERN_VERSION                   = 0x4
 	LOCAL_CONNWAIT                 = 0x4
 	LOCAL_CREDS                    = 0x2
-	LOCAL_CREDS_PERSISTENT         = 0x3
 	LOCAL_PEERCRED                 = 0x1
 	LOCAL_VENDOR                   = 0x80000000
 	LOCK_EX                        = 0x2
@@ -1179,6 +1185,8 @@ const (
 	O_NONBLOCK                     = 0x4
 	O_RDONLY                       = 0x0
 	O_RDWR                         = 0x2
+	O_RESOLVE_BENEATH              = 0x800000
+	O_SEARCH                       = 0x40000
 	O_SHLOCK                       = 0x10
 	O_SYNC                         = 0x80
 	O_TRUNC                        = 0x400
@@ -1189,6 +1197,10 @@ const (
 	PARMRK                         = 0x8
 	PARODD                         = 0x2000
 	PENDIN                         = 0x20000000
+	PIOD_READ_D                    = 0x1
+	PIOD_READ_I                    = 0x3
+	PIOD_WRITE_D                   = 0x2
+	PIOD_WRITE_I                   = 0x4
 	PRIO_PGRP                      = 0x1
 	PRIO_PROCESS                   = 0x0
 	PRIO_USER                      = 0x2
@@ -1196,6 +1208,60 @@ const (
 	PROT_NONE                      = 0x0
 	PROT_READ                      = 0x1
 	PROT_WRITE                     = 0x2
+	PTRACE_DEFAULT                 = 0x1
+	PTRACE_EXEC                    = 0x1
+	PTRACE_FORK                    = 0x8
+	PTRACE_LWP                     = 0x10
+	PTRACE_SCE                     = 0x2
+	PTRACE_SCX                     = 0x4
+	PTRACE_SYSCALL                 = 0x6
+	PTRACE_VFORK                   = 0x20
+	PT_ATTACH                      = 0xa
+	PT_CLEARSTEP                   = 0x10
+	PT_CONTINUE                    = 0x7
+	PT_DETACH                      = 0xb
+	PT_FIRSTMACH                   = 0x40
+	PT_FOLLOW_FORK                 = 0x17
+	PT_GETDBREGS                   = 0x25
+	PT_GETFPREGS                   = 0x23
+	PT_GETFSBASE                   = 0x47
+	PT_GETGSBASE                   = 0x49
+	PT_GETLWPLIST                  = 0xf
+	PT_GETNUMLWPS                  = 0xe
+	PT_GETREGS                     = 0x21
+	PT_GETXMMREGS                  = 0x40
+	PT_GETXSTATE                   = 0x45
+	PT_GETXSTATE_INFO              = 0x44
+	PT_GET_EVENT_MASK              = 0x19
+	PT_GET_SC_ARGS                 = 0x1b
+	PT_GET_SC_RET                  = 0x1c
+	PT_IO                          = 0xc
+	PT_KILL                        = 0x8
+	PT_LWPINFO                     = 0xd
+	PT_LWP_EVENTS                  = 0x18
+	PT_READ_D                      = 0x2
+	PT_READ_I                      = 0x1
+	PT_RESUME                      = 0x13
+	PT_SETDBREGS                   = 0x26
+	PT_SETFPREGS                   = 0x24
+	PT_SETFSBASE                   = 0x48
+	PT_SETGSBASE                   = 0x4a
+	PT_SETREGS                     = 0x22
+	PT_SETSTEP                     = 0x11
+	PT_SETXMMREGS                  = 0x41
+	PT_SETXSTATE                   = 0x46
+	PT_SET_EVENT_MASK              = 0x1a
+	PT_STEP                        = 0x9
+	PT_SUSPEND                     = 0x12
+	PT_SYSCALL                     = 0x16
+	PT_TO_SCE                      = 0x14
+	PT_TO_SCX                      = 0x15
+	PT_TRACE_ME                    = 0x0
+	PT_VM_ENTRY                    = 0x29
+	PT_VM_TIMESTAMP                = 0x28
+	PT_WRITE_D                     = 0x5
+	PT_WRITE_I                     = 0x4
+	P_ZONEID                       = 0xc
 	RLIMIT_AS                      = 0xa
 	RLIMIT_CORE                    = 0x4
 	RLIMIT_CPU                     = 0x0
@@ -1320,10 +1386,12 @@ const (
 	SIOCGHWADDR                    = 0xc020693e
 	SIOCGI2C                       = 0xc020693d
 	SIOCGIFADDR                    = 0xc0206921
+	SIOCGIFALIAS                   = 0xc044692d
 	SIOCGIFBRDADDR                 = 0xc0206923
 	SIOCGIFCAP                     = 0xc020691f
 	SIOCGIFCONF                    = 0xc0086924
 	SIOCGIFDESCR                   = 0xc020692a
+	SIOCGIFDOWNREASON              = 0xc058699a
 	SIOCGIFDSTADDR                 = 0xc0206922
 	SIOCGIFFIB                     = 0xc020695c
 	SIOCGIFFLAGS                   = 0xc0206911
@@ -1414,6 +1482,7 @@ const (
 	SO_RCVBUF                      = 0x1002
 	SO_RCVLOWAT                    = 0x1004
 	SO_RCVTIMEO                    = 0x1006
+	SO_RERROR                      = 0x20000
 	SO_REUSEADDR                   = 0x4
 	SO_REUSEPORT                   = 0x200
 	SO_REUSEPORT_LB                = 0x10000
@@ -1472,22 +1541,40 @@ const (
 	TCOFLUSH                       = 0x2
 	TCOOFF                         = 0x1
 	TCOON                          = 0x2
+	TCPOPT_EOL                     = 0x0
+	TCPOPT_FAST_OPEN               = 0x22
+	TCPOPT_MAXSEG                  = 0x2
+	TCPOPT_NOP                     = 0x1
+	TCPOPT_PAD                     = 0x0
+	TCPOPT_SACK                    = 0x5
+	TCPOPT_SACK_PERMITTED          = 0x4
+	TCPOPT_SIGNATURE               = 0x13
+	TCPOPT_TIMESTAMP               = 0x8
+	TCPOPT_WINDOW                  = 0x3
 	TCP_BBR_ACK_COMP_ALG           = 0x448
+	TCP_BBR_ALGORITHM              = 0x43b
 	TCP_BBR_DRAIN_INC_EXTRA        = 0x43c
 	TCP_BBR_DRAIN_PG               = 0x42e
 	TCP_BBR_EXTRA_GAIN             = 0x449
+	TCP_BBR_EXTRA_STATE            = 0x453
+	TCP_BBR_FLOOR_MIN_TSO          = 0x454
+	TCP_BBR_HDWR_PACE              = 0x451
+	TCP_BBR_HOLD_TARGET            = 0x436
 	TCP_BBR_IWINTSO                = 0x42b
 	TCP_BBR_LOWGAIN_FD             = 0x436
 	TCP_BBR_LOWGAIN_HALF           = 0x435
 	TCP_BBR_LOWGAIN_THRESH         = 0x434
 	TCP_BBR_MAX_RTO                = 0x439
 	TCP_BBR_MIN_RTO                = 0x438
+	TCP_BBR_MIN_TOPACEOUT          = 0x455
 	TCP_BBR_ONE_RETRAN             = 0x431
 	TCP_BBR_PACE_CROSS             = 0x442
 	TCP_BBR_PACE_DEL_TAR           = 0x43f
+	TCP_BBR_PACE_OH                = 0x435
 	TCP_BBR_PACE_PER_SEC           = 0x43e
 	TCP_BBR_PACE_SEG_MAX           = 0x440
 	TCP_BBR_PACE_SEG_MIN           = 0x441
+	TCP_BBR_POLICER_DETECT         = 0x457
 	TCP_BBR_PROBE_RTT_GAIN         = 0x44d
 	TCP_BBR_PROBE_RTT_INT          = 0x430
 	TCP_BBR_PROBE_RTT_LEN          = 0x44e
@@ -1496,12 +1583,18 @@ const (
 	TCP_BBR_REC_OVER_HPTS          = 0x43a
 	TCP_BBR_RETRAN_WTSO            = 0x44b
 	TCP_BBR_RWND_IS_APP            = 0x42f
+	TCP_BBR_SEND_IWND_IN_TSO       = 0x44f
 	TCP_BBR_STARTUP_EXIT_EPOCH     = 0x43d
 	TCP_BBR_STARTUP_LOSS_EXIT      = 0x432
 	TCP_BBR_STARTUP_PG             = 0x42d
+	TCP_BBR_TMR_PACE_OH            = 0x448
+	TCP_BBR_TSLIMITS               = 0x434
+	TCP_BBR_TSTMP_RAISES           = 0x456
 	TCP_BBR_UNLIMITED              = 0x43b
 	TCP_BBR_USEDEL_RATE            = 0x437
 	TCP_BBR_USE_LOWGAIN            = 0x433
+	TCP_BBR_USE_RACK_CHEAT         = 0x450
+	TCP_BBR_UTTER_MAX_TSO          = 0x452
 	TCP_CA_NAME_MAX                = 0x10
 	TCP_CCALGOOPT                  = 0x41
 	TCP_CONGESTION                 = 0x40
@@ -1541,6 +1634,7 @@ const (
 	TCP_PCAP_OUT                   = 0x800
 	TCP_RACK_EARLY_RECOV           = 0x423
 	TCP_RACK_EARLY_SEG             = 0x424
+	TCP_RACK_GP_INCREASE           = 0x446
 	TCP_RACK_IDLE_REDUCE_HIGH      = 0x444
 	TCP_RACK_MIN_PACE              = 0x445
 	TCP_RACK_MIN_PACE_SEG          = 0x446
@@ -1554,7 +1648,6 @@ const (
 	TCP_RACK_PRR_SENDALOT          = 0x421
 	TCP_RACK_REORD_FADE            = 0x426
 	TCP_RACK_REORD_THRESH          = 0x425
-	TCP_RACK_SESS_CWV              = 0x42a
 	TCP_RACK_TLP_INC_VAR           = 0x429
 	TCP_RACK_TLP_REDUCE            = 0x41c
 	TCP_RACK_TLP_THRESH            = 0x427
@@ -1694,12 +1787,13 @@ const (
 	EIDRM           = syscall.Errno(0x52)
 	EILSEQ          = syscall.Errno(0x56)
 	EINPROGRESS     = syscall.Errno(0x24)
+	EINTEGRITY      = syscall.Errno(0x61)
 	EINTR           = syscall.Errno(0x4)
 	EINVAL          = syscall.Errno(0x16)
 	EIO             = syscall.Errno(0x5)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x60)
+	ELAST           = syscall.Errno(0x61)
 	ELOOP           = syscall.Errno(0x3e)
 	EMFILE          = syscall.Errno(0x18)
 	EMLINK          = syscall.Errno(0x1f)
@@ -1842,7 +1936,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EAGAIN", "resource temporarily unavailable"},
+	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1904,6 +1998,7 @@ var errorList = [...]struct {
 	{94, "ECAPMODE", "not permitted in capability mode"},
 	{95, "ENOTRECOVERABLE", "state not recoverable"},
 	{96, "EOWNERDEAD", "previous owner died"},
+	{97, "EINTEGRITY", "integrity check failed"},
 }
 
 // Signal table
diff --git a/vendor/golang.org/x/sys/unix/zerrors_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_freebsd_amd64.go
index 64520d3122..96310c3be1 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_freebsd_amd64.go
@@ -151,6 +151,7 @@ const (
 	BIOCSETF                       = 0x80104267
 	BIOCSETFNR                     = 0x80104282
 	BIOCSETIF                      = 0x8020426c
+	BIOCSETVLANPCP                 = 0x80044285
 	BIOCSETWF                      = 0x8010427b
 	BIOCSETZBUF                    = 0x80184281
 	BIOCSHDRCMPLT                  = 0x80044275
@@ -447,7 +448,7 @@ const (
 	DLT_IEEE802_16_MAC_CPS_RADIO   = 0xc1
 	DLT_INFINIBAND                 = 0xf7
 	DLT_IPFILTER                   = 0x74
-	DLT_IPMB                       = 0xc7
+	DLT_IPMB_KONTRON               = 0xc7
 	DLT_IPMB_LINUX                 = 0xd1
 	DLT_IPMI_HPM_2                 = 0x104
 	DLT_IPNET                      = 0xe2
@@ -487,10 +488,11 @@ const (
 	DLT_LINUX_LAPD                 = 0xb1
 	DLT_LINUX_PPP_WITHDIRECTION    = 0xa6
 	DLT_LINUX_SLL                  = 0x71
+	DLT_LINUX_SLL2                 = 0x114
 	DLT_LOOP                       = 0x6c
 	DLT_LORATAP                    = 0x10e
 	DLT_LTALK                      = 0x72
-	DLT_MATCHING_MAX               = 0x113
+	DLT_MATCHING_MAX               = 0x114
 	DLT_MATCHING_MIN               = 0x68
 	DLT_MFR                        = 0xb6
 	DLT_MOST                       = 0xd3
@@ -734,6 +736,7 @@ const (
 	IPPROTO_CMTP                   = 0x26
 	IPPROTO_CPHB                   = 0x49
 	IPPROTO_CPNX                   = 0x48
+	IPPROTO_DCCP                   = 0x21
 	IPPROTO_DDP                    = 0x25
 	IPPROTO_DGP                    = 0x56
 	IPPROTO_DIVERT                 = 0x102
@@ -814,7 +817,6 @@ const (
 	IPPROTO_SCTP                   = 0x84
 	IPPROTO_SDRP                   = 0x2a
 	IPPROTO_SEND                   = 0x103
-	IPPROTO_SEP                    = 0x21
 	IPPROTO_SHIM6                  = 0x8c
 	IPPROTO_SKIP                   = 0x39
 	IPPROTO_SPACER                 = 0x7fff
@@ -911,6 +913,7 @@ const (
 	IPV6_V6ONLY                    = 0x1b
 	IPV6_VERSION                   = 0x60
 	IPV6_VERSION_MASK              = 0xf0
+	IPV6_VLAN_PCP                  = 0x4b
 	IP_ADD_MEMBERSHIP              = 0xc
 	IP_ADD_SOURCE_MEMBERSHIP       = 0x46
 	IP_BINDANY                     = 0x18
@@ -989,8 +992,12 @@ const (
 	IP_TOS                         = 0x3
 	IP_TTL                         = 0x4
 	IP_UNBLOCK_SOURCE              = 0x49
+	IP_VLAN_PCP                    = 0x4b
 	ISIG                           = 0x80
 	ISTRIP                         = 0x20
+	ITIMER_PROF                    = 0x2
+	ITIMER_REAL                    = 0x0
+	ITIMER_VIRTUAL                 = 0x1
 	IXANY                          = 0x800
 	IXOFF                          = 0x400
 	IXON                           = 0x200
@@ -1000,7 +1007,6 @@ const (
 	KERN_VERSION                   = 0x4
 	LOCAL_CONNWAIT                 = 0x4
 	LOCAL_CREDS                    = 0x2
-	LOCAL_CREDS_PERSISTENT         = 0x3
 	LOCAL_PEERCRED                 = 0x1
 	LOCAL_VENDOR                   = 0x80000000
 	LOCK_EX                        = 0x2
@@ -1180,6 +1186,8 @@ const (
 	O_NONBLOCK                     = 0x4
 	O_RDONLY                       = 0x0
 	O_RDWR                         = 0x2
+	O_RESOLVE_BENEATH              = 0x800000
+	O_SEARCH                       = 0x40000
 	O_SHLOCK                       = 0x10
 	O_SYNC                         = 0x80
 	O_TRUNC                        = 0x400
@@ -1190,6 +1198,10 @@ const (
 	PARMRK                         = 0x8
 	PARODD                         = 0x2000
 	PENDIN                         = 0x20000000
+	PIOD_READ_D                    = 0x1
+	PIOD_READ_I                    = 0x3
+	PIOD_WRITE_D                   = 0x2
+	PIOD_WRITE_I                   = 0x4
 	PRIO_PGRP                      = 0x1
 	PRIO_PROCESS                   = 0x0
 	PRIO_USER                      = 0x2
@@ -1197,6 +1209,58 @@ const (
 	PROT_NONE                      = 0x0
 	PROT_READ                      = 0x1
 	PROT_WRITE                     = 0x2
+	PTRACE_DEFAULT                 = 0x1
+	PTRACE_EXEC                    = 0x1
+	PTRACE_FORK                    = 0x8
+	PTRACE_LWP                     = 0x10
+	PTRACE_SCE                     = 0x2
+	PTRACE_SCX                     = 0x4
+	PTRACE_SYSCALL                 = 0x6
+	PTRACE_VFORK                   = 0x20
+	PT_ATTACH                      = 0xa
+	PT_CLEARSTEP                   = 0x10
+	PT_CONTINUE                    = 0x7
+	PT_DETACH                      = 0xb
+	PT_FIRSTMACH                   = 0x40
+	PT_FOLLOW_FORK                 = 0x17
+	PT_GETDBREGS                   = 0x25
+	PT_GETFPREGS                   = 0x23
+	PT_GETFSBASE                   = 0x47
+	PT_GETGSBASE                   = 0x49
+	PT_GETLWPLIST                  = 0xf
+	PT_GETNUMLWPS                  = 0xe
+	PT_GETREGS                     = 0x21
+	PT_GETXSTATE                   = 0x45
+	PT_GETXSTATE_INFO              = 0x44
+	PT_GET_EVENT_MASK              = 0x19
+	PT_GET_SC_ARGS                 = 0x1b
+	PT_GET_SC_RET                  = 0x1c
+	PT_IO                          = 0xc
+	PT_KILL                        = 0x8
+	PT_LWPINFO                     = 0xd
+	PT_LWP_EVENTS                  = 0x18
+	PT_READ_D                      = 0x2
+	PT_READ_I                      = 0x1
+	PT_RESUME                      = 0x13
+	PT_SETDBREGS                   = 0x26
+	PT_SETFPREGS                   = 0x24
+	PT_SETFSBASE                   = 0x48
+	PT_SETGSBASE                   = 0x4a
+	PT_SETREGS                     = 0x22
+	PT_SETSTEP                     = 0x11
+	PT_SETXSTATE                   = 0x46
+	PT_SET_EVENT_MASK              = 0x1a
+	PT_STEP                        = 0x9
+	PT_SUSPEND                     = 0x12
+	PT_SYSCALL                     = 0x16
+	PT_TO_SCE                      = 0x14
+	PT_TO_SCX                      = 0x15
+	PT_TRACE_ME                    = 0x0
+	PT_VM_ENTRY                    = 0x29
+	PT_VM_TIMESTAMP                = 0x28
+	PT_WRITE_D                     = 0x5
+	PT_WRITE_I                     = 0x4
+	P_ZONEID                       = 0xc
 	RLIMIT_AS                      = 0xa
 	RLIMIT_CORE                    = 0x4
 	RLIMIT_CPU                     = 0x0
@@ -1321,10 +1385,12 @@ const (
 	SIOCGHWADDR                    = 0xc020693e
 	SIOCGI2C                       = 0xc020693d
 	SIOCGIFADDR                    = 0xc0206921
+	SIOCGIFALIAS                   = 0xc044692d
 	SIOCGIFBRDADDR                 = 0xc0206923
 	SIOCGIFCAP                     = 0xc020691f
 	SIOCGIFCONF                    = 0xc0106924
 	SIOCGIFDESCR                   = 0xc020692a
+	SIOCGIFDOWNREASON              = 0xc058699a
 	SIOCGIFDSTADDR                 = 0xc0206922
 	SIOCGIFFIB                     = 0xc020695c
 	SIOCGIFFLAGS                   = 0xc0206911
@@ -1415,6 +1481,7 @@ const (
 	SO_RCVBUF                      = 0x1002
 	SO_RCVLOWAT                    = 0x1004
 	SO_RCVTIMEO                    = 0x1006
+	SO_RERROR                      = 0x20000
 	SO_REUSEADDR                   = 0x4
 	SO_REUSEPORT                   = 0x200
 	SO_REUSEPORT_LB                = 0x10000
@@ -1473,22 +1540,40 @@ const (
 	TCOFLUSH                       = 0x2
 	TCOOFF                         = 0x1
 	TCOON                          = 0x2
+	TCPOPT_EOL                     = 0x0
+	TCPOPT_FAST_OPEN               = 0x22
+	TCPOPT_MAXSEG                  = 0x2
+	TCPOPT_NOP                     = 0x1
+	TCPOPT_PAD                     = 0x0
+	TCPOPT_SACK                    = 0x5
+	TCPOPT_SACK_PERMITTED          = 0x4
+	TCPOPT_SIGNATURE               = 0x13
+	TCPOPT_TIMESTAMP               = 0x8
+	TCPOPT_WINDOW                  = 0x3
 	TCP_BBR_ACK_COMP_ALG           = 0x448
+	TCP_BBR_ALGORITHM              = 0x43b
 	TCP_BBR_DRAIN_INC_EXTRA        = 0x43c
 	TCP_BBR_DRAIN_PG               = 0x42e
 	TCP_BBR_EXTRA_GAIN             = 0x449
+	TCP_BBR_EXTRA_STATE            = 0x453
+	TCP_BBR_FLOOR_MIN_TSO          = 0x454
+	TCP_BBR_HDWR_PACE              = 0x451
+	TCP_BBR_HOLD_TARGET            = 0x436
 	TCP_BBR_IWINTSO                = 0x42b
 	TCP_BBR_LOWGAIN_FD             = 0x436
 	TCP_BBR_LOWGAIN_HALF           = 0x435
 	TCP_BBR_LOWGAIN_THRESH         = 0x434
 	TCP_BBR_MAX_RTO                = 0x439
 	TCP_BBR_MIN_RTO                = 0x438
+	TCP_BBR_MIN_TOPACEOUT          = 0x455
 	TCP_BBR_ONE_RETRAN             = 0x431
 	TCP_BBR_PACE_CROSS             = 0x442
 	TCP_BBR_PACE_DEL_TAR           = 0x43f
+	TCP_BBR_PACE_OH                = 0x435
 	TCP_BBR_PACE_PER_SEC           = 0x43e
 	TCP_BBR_PACE_SEG_MAX           = 0x440
 	TCP_BBR_PACE_SEG_MIN           = 0x441
+	TCP_BBR_POLICER_DETECT         = 0x457
 	TCP_BBR_PROBE_RTT_GAIN         = 0x44d
 	TCP_BBR_PROBE_RTT_INT          = 0x430
 	TCP_BBR_PROBE_RTT_LEN          = 0x44e
@@ -1497,12 +1582,18 @@ const (
 	TCP_BBR_REC_OVER_HPTS          = 0x43a
 	TCP_BBR_RETRAN_WTSO            = 0x44b
 	TCP_BBR_RWND_IS_APP            = 0x42f
+	TCP_BBR_SEND_IWND_IN_TSO       = 0x44f
 	TCP_BBR_STARTUP_EXIT_EPOCH     = 0x43d
 	TCP_BBR_STARTUP_LOSS_EXIT      = 0x432
 	TCP_BBR_STARTUP_PG             = 0x42d
+	TCP_BBR_TMR_PACE_OH            = 0x448
+	TCP_BBR_TSLIMITS               = 0x434
+	TCP_BBR_TSTMP_RAISES           = 0x456
 	TCP_BBR_UNLIMITED              = 0x43b
 	TCP_BBR_USEDEL_RATE            = 0x437
 	TCP_BBR_USE_LOWGAIN            = 0x433
+	TCP_BBR_USE_RACK_CHEAT         = 0x450
+	TCP_BBR_UTTER_MAX_TSO          = 0x452
 	TCP_CA_NAME_MAX                = 0x10
 	TCP_CCALGOOPT                  = 0x41
 	TCP_CONGESTION                 = 0x40
@@ -1542,6 +1633,7 @@ const (
 	TCP_PCAP_OUT                   = 0x800
 	TCP_RACK_EARLY_RECOV           = 0x423
 	TCP_RACK_EARLY_SEG             = 0x424
+	TCP_RACK_GP_INCREASE           = 0x446
 	TCP_RACK_IDLE_REDUCE_HIGH      = 0x444
 	TCP_RACK_MIN_PACE              = 0x445
 	TCP_RACK_MIN_PACE_SEG          = 0x446
@@ -1555,7 +1647,6 @@ const (
 	TCP_RACK_PRR_SENDALOT          = 0x421
 	TCP_RACK_REORD_FADE            = 0x426
 	TCP_RACK_REORD_THRESH          = 0x425
-	TCP_RACK_SESS_CWV              = 0x42a
 	TCP_RACK_TLP_INC_VAR           = 0x429
 	TCP_RACK_TLP_REDUCE            = 0x41c
 	TCP_RACK_TLP_THRESH            = 0x427
@@ -1693,12 +1784,13 @@ const (
 	EIDRM           = syscall.Errno(0x52)
 	EILSEQ          = syscall.Errno(0x56)
 	EINPROGRESS     = syscall.Errno(0x24)
+	EINTEGRITY      = syscall.Errno(0x61)
 	EINTR           = syscall.Errno(0x4)
 	EINVAL          = syscall.Errno(0x16)
 	EIO             = syscall.Errno(0x5)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x60)
+	ELAST           = syscall.Errno(0x61)
 	ELOOP           = syscall.Errno(0x3e)
 	EMFILE          = syscall.Errno(0x18)
 	EMLINK          = syscall.Errno(0x1f)
@@ -1841,7 +1933,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EAGAIN", "resource temporarily unavailable"},
+	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1903,6 +1995,7 @@ var errorList = [...]struct {
 	{94, "ECAPMODE", "not permitted in capability mode"},
 	{95, "ENOTRECOVERABLE", "state not recoverable"},
 	{96, "EOWNERDEAD", "previous owner died"},
+	{97, "EINTEGRITY", "integrity check failed"},
 }
 
 // Signal table
diff --git a/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm.go b/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm.go
index 99e9a0e06e..777b69defa 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm.go
@@ -151,6 +151,7 @@ const (
 	BIOCSETF                       = 0x80084267
 	BIOCSETFNR                     = 0x80084282
 	BIOCSETIF                      = 0x8020426c
+	BIOCSETVLANPCP                 = 0x80044285
 	BIOCSETWF                      = 0x8008427b
 	BIOCSETZBUF                    = 0x800c4281
 	BIOCSHDRCMPLT                  = 0x80044275
@@ -362,7 +363,7 @@ const (
 	CTL_KERN                       = 0x1
 	CTL_MAXNAME                    = 0x18
 	CTL_NET                        = 0x4
-	DIOCGATTR                      = 0xc144648e
+	DIOCGATTR                      = 0xc148648e
 	DIOCGDELETE                    = 0x80106488
 	DIOCGFLUSH                     = 0x20006487
 	DIOCGFRONTSTUFF                = 0x40086486
@@ -377,7 +378,7 @@ const (
 	DIOCGSTRIPESIZE                = 0x4008648b
 	DIOCSKERNELDUMP                = 0x804c6490
 	DIOCSKERNELDUMP_FREEBSD11      = 0x80046485
-	DIOCZONECMD                    = 0xc06c648f
+	DIOCZONECMD                    = 0xc078648f
 	DLT_A429                       = 0xb8
 	DLT_A653_ICM                   = 0xb9
 	DLT_AIRONET_HEADER             = 0x78
@@ -407,7 +408,9 @@ const (
 	DLT_C_HDLC_WITH_DIR            = 0xcd
 	DLT_DBUS                       = 0xe7
 	DLT_DECT                       = 0xdd
+	DLT_DISPLAYPORT_AUX            = 0x113
 	DLT_DOCSIS                     = 0x8f
+	DLT_DOCSIS31_XRA31             = 0x111
 	DLT_DVB_CI                     = 0xeb
 	DLT_ECONET                     = 0x73
 	DLT_EN10MB                     = 0x1
@@ -417,6 +420,7 @@ const (
 	DLT_ERF                        = 0xc5
 	DLT_ERF_ETH                    = 0xaf
 	DLT_ERF_POS                    = 0xb0
+	DLT_ETHERNET_MPACKET           = 0x112
 	DLT_FC_2                       = 0xe0
 	DLT_FC_2_WITH_FRAME_DELIMS     = 0xe1
 	DLT_FDDI                       = 0xa
@@ -444,7 +448,7 @@ const (
 	DLT_IEEE802_16_MAC_CPS_RADIO   = 0xc1
 	DLT_INFINIBAND                 = 0xf7
 	DLT_IPFILTER                   = 0x74
-	DLT_IPMB                       = 0xc7
+	DLT_IPMB_KONTRON               = 0xc7
 	DLT_IPMB_LINUX                 = 0xd1
 	DLT_IPMI_HPM_2                 = 0x104
 	DLT_IPNET                      = 0xe2
@@ -484,9 +488,11 @@ const (
 	DLT_LINUX_LAPD                 = 0xb1
 	DLT_LINUX_PPP_WITHDIRECTION    = 0xa6
 	DLT_LINUX_SLL                  = 0x71
+	DLT_LINUX_SLL2                 = 0x114
 	DLT_LOOP                       = 0x6c
+	DLT_LORATAP                    = 0x10e
 	DLT_LTALK                      = 0x72
-	DLT_MATCHING_MAX               = 0x109
+	DLT_MATCHING_MAX               = 0x114
 	DLT_MATCHING_MIN               = 0x68
 	DLT_MFR                        = 0xb6
 	DLT_MOST                       = 0xd3
@@ -502,7 +508,9 @@ const (
 	DLT_NFC_LLCP                   = 0xf5
 	DLT_NFLOG                      = 0xef
 	DLT_NG40                       = 0xf4
+	DLT_NORDIC_BLE                 = 0x110
 	DLT_NULL                       = 0x0
+	DLT_OPENFLOW                   = 0x10b
 	DLT_PCI_EXP                    = 0x7d
 	DLT_PFLOG                      = 0x75
 	DLT_PFSYNC                     = 0x79
@@ -526,15 +534,18 @@ const (
 	DLT_RTAC_SERIAL                = 0xfa
 	DLT_SCCP                       = 0x8e
 	DLT_SCTP                       = 0xf8
+	DLT_SDLC                       = 0x10c
 	DLT_SITA                       = 0xc4
 	DLT_SLIP                       = 0x8
 	DLT_SLIP_BSDOS                 = 0xd
 	DLT_STANAG_5066_D_PDU          = 0xed
 	DLT_SUNATM                     = 0x7b
 	DLT_SYMANTEC_FIREWALL          = 0x63
+	DLT_TI_LLN_SNIFFER             = 0x10d
 	DLT_TZSP                       = 0x80
 	DLT_USB                        = 0xba
 	DLT_USBPCAP                    = 0xf9
+	DLT_USB_DARWIN                 = 0x10a
 	DLT_USB_FREEBSD                = 0xba
 	DLT_USB_LINUX                  = 0xbd
 	DLT_USB_LINUX_MMAPPED          = 0xdc
@@ -554,6 +565,7 @@ const (
 	DLT_USER7                      = 0x9a
 	DLT_USER8                      = 0x9b
 	DLT_USER9                      = 0x9c
+	DLT_VSOCK                      = 0x10f
 	DLT_WATTSTOPPER_DLM            = 0x107
 	DLT_WIHART                     = 0xdf
 	DLT_WIRESHARK_UPPER_PDU        = 0xfc
@@ -578,6 +590,7 @@ const (
 	ECHONL                         = 0x10
 	ECHOPRT                        = 0x20
 	EVFILT_AIO                     = -0x3
+	EVFILT_EMPTY                   = -0xd
 	EVFILT_FS                      = -0x9
 	EVFILT_LIO                     = -0xa
 	EVFILT_PROC                    = -0x5
@@ -585,11 +598,12 @@ const (
 	EVFILT_READ                    = -0x1
 	EVFILT_SENDFILE                = -0xc
 	EVFILT_SIGNAL                  = -0x6
-	EVFILT_SYSCOUNT                = 0xc
+	EVFILT_SYSCOUNT                = 0xd
 	EVFILT_TIMER                   = -0x7
 	EVFILT_USER                    = -0xb
 	EVFILT_VNODE                   = -0x4
 	EVFILT_WRITE                   = -0x2
+	EVNAMEMAP_NAME_SIZE            = 0x40
 	EV_ADD                         = 0x1
 	EV_CLEAR                       = 0x20
 	EV_DELETE                      = 0x2
@@ -606,6 +620,7 @@ const (
 	EV_RECEIPT                     = 0x40
 	EV_SYSFLAGS                    = 0xf000
 	EXTA                           = 0x4b00
+	EXTATTR_MAXNAMELEN             = 0xff
 	EXTATTR_NAMESPACE_EMPTY        = 0x0
 	EXTATTR_NAMESPACE_SYSTEM       = 0x2
 	EXTATTR_NAMESPACE_USER         = 0x1
@@ -647,6 +662,7 @@ const (
 	IEXTEN                         = 0x400
 	IFAN_ARRIVAL                   = 0x0
 	IFAN_DEPARTURE                 = 0x1
+	IFCAP_WOL_MAGIC                = 0x2000
 	IFF_ALLMULTI                   = 0x200
 	IFF_ALTPHYS                    = 0x4000
 	IFF_BROADCAST                  = 0x2
@@ -663,6 +679,7 @@ const (
 	IFF_MONITOR                    = 0x40000
 	IFF_MULTICAST                  = 0x8000
 	IFF_NOARP                      = 0x80
+	IFF_NOGROUP                    = 0x800000
 	IFF_OACTIVE                    = 0x400
 	IFF_POINTOPOINT                = 0x10
 	IFF_PPROMISC                   = 0x20000
@@ -719,6 +736,7 @@ const (
 	IPPROTO_CMTP                   = 0x26
 	IPPROTO_CPHB                   = 0x49
 	IPPROTO_CPNX                   = 0x48
+	IPPROTO_DCCP                   = 0x21
 	IPPROTO_DDP                    = 0x25
 	IPPROTO_DGP                    = 0x56
 	IPPROTO_DIVERT                 = 0x102
@@ -799,7 +817,6 @@ const (
 	IPPROTO_SCTP                   = 0x84
 	IPPROTO_SDRP                   = 0x2a
 	IPPROTO_SEND                   = 0x103
-	IPPROTO_SEP                    = 0x21
 	IPPROTO_SHIM6                  = 0x8c
 	IPPROTO_SKIP                   = 0x39
 	IPPROTO_SPACER                 = 0x7fff
@@ -837,6 +854,7 @@ const (
 	IPV6_DSTOPTS                   = 0x32
 	IPV6_FLOWID                    = 0x43
 	IPV6_FLOWINFO_MASK             = 0xffffff0f
+	IPV6_FLOWLABEL_LEN             = 0x14
 	IPV6_FLOWLABEL_MASK            = 0xffff0f00
 	IPV6_FLOWTYPE                  = 0x44
 	IPV6_FRAGTTL                   = 0x78
@@ -857,13 +875,13 @@ const (
 	IPV6_MAX_GROUP_SRC_FILTER      = 0x200
 	IPV6_MAX_MEMBERSHIPS           = 0xfff
 	IPV6_MAX_SOCK_SRC_FILTER       = 0x80
-	IPV6_MIN_MEMBERSHIPS           = 0x1f
 	IPV6_MMTU                      = 0x500
 	IPV6_MSFILTER                  = 0x4a
 	IPV6_MULTICAST_HOPS            = 0xa
 	IPV6_MULTICAST_IF              = 0x9
 	IPV6_MULTICAST_LOOP            = 0xb
 	IPV6_NEXTHOP                   = 0x30
+	IPV6_ORIGDSTADDR               = 0x48
 	IPV6_PATHMTU                   = 0x2c
 	IPV6_PKTINFO                   = 0x2e
 	IPV6_PORTRANGE                 = 0xe
@@ -875,6 +893,7 @@ const (
 	IPV6_RECVFLOWID                = 0x46
 	IPV6_RECVHOPLIMIT              = 0x25
 	IPV6_RECVHOPOPTS               = 0x27
+	IPV6_RECVORIGDSTADDR           = 0x48
 	IPV6_RECVPATHMTU               = 0x2b
 	IPV6_RECVPKTINFO               = 0x24
 	IPV6_RECVRSSBUCKETID           = 0x47
@@ -894,6 +913,7 @@ const (
 	IPV6_V6ONLY                    = 0x1b
 	IPV6_VERSION                   = 0x60
 	IPV6_VERSION_MASK              = 0xf0
+	IPV6_VLAN_PCP                  = 0x4b
 	IP_ADD_MEMBERSHIP              = 0xc
 	IP_ADD_SOURCE_MEMBERSHIP       = 0x46
 	IP_BINDANY                     = 0x18
@@ -935,10 +955,8 @@ const (
 	IP_MAX_MEMBERSHIPS             = 0xfff
 	IP_MAX_SOCK_MUTE_FILTER        = 0x80
 	IP_MAX_SOCK_SRC_FILTER         = 0x80
-	IP_MAX_SOURCE_FILTER           = 0x400
 	IP_MF                          = 0x2000
 	IP_MINTTL                      = 0x42
-	IP_MIN_MEMBERSHIPS             = 0x1f
 	IP_MSFILTER                    = 0x4a
 	IP_MSS                         = 0x240
 	IP_MULTICAST_IF                = 0x9
@@ -948,6 +966,7 @@ const (
 	IP_OFFMASK                     = 0x1fff
 	IP_ONESBCAST                   = 0x17
 	IP_OPTIONS                     = 0x1
+	IP_ORIGDSTADDR                 = 0x1b
 	IP_PORTRANGE                   = 0x13
 	IP_PORTRANGE_DEFAULT           = 0x0
 	IP_PORTRANGE_HIGH              = 0x1
@@ -956,6 +975,7 @@ const (
 	IP_RECVFLOWID                  = 0x5d
 	IP_RECVIF                      = 0x14
 	IP_RECVOPTS                    = 0x5
+	IP_RECVORIGDSTADDR             = 0x1b
 	IP_RECVRETOPTS                 = 0x6
 	IP_RECVRSSBUCKETID             = 0x5e
 	IP_RECVTOS                     = 0x44
@@ -972,8 +992,12 @@ const (
 	IP_TOS                         = 0x3
 	IP_TTL                         = 0x4
 	IP_UNBLOCK_SOURCE              = 0x49
+	IP_VLAN_PCP                    = 0x4b
 	ISIG                           = 0x80
 	ISTRIP                         = 0x20
+	ITIMER_PROF                    = 0x2
+	ITIMER_REAL                    = 0x0
+	ITIMER_VIRTUAL                 = 0x1
 	IXANY                          = 0x800
 	IXOFF                          = 0x400
 	IXON                           = 0x200
@@ -983,7 +1007,6 @@ const (
 	KERN_VERSION                   = 0x4
 	LOCAL_CONNWAIT                 = 0x4
 	LOCAL_CREDS                    = 0x2
-	LOCAL_CREDS_PERSISTENT         = 0x3
 	LOCAL_PEERCRED                 = 0x1
 	LOCAL_VENDOR                   = 0x80000000
 	LOCK_EX                        = 0x2
@@ -1071,10 +1094,12 @@ const (
 	MNT_SUSPEND                    = 0x4
 	MNT_SYNCHRONOUS                = 0x2
 	MNT_UNION                      = 0x20
+	MNT_UNTRUSTED                  = 0x800000000
 	MNT_UPDATE                     = 0x10000
-	MNT_UPDATEMASK                 = 0x2d8d0807e
+	MNT_UPDATEMASK                 = 0xad8d0807e
 	MNT_USER                       = 0x8000
-	MNT_VISFLAGMASK                = 0x3fef0ffff
+	MNT_VERIFIED                   = 0x400000000
+	MNT_VISFLAGMASK                = 0xffef0ffff
 	MNT_WAIT                       = 0x1
 	MSG_CMSG_CLOEXEC               = 0x40000
 	MSG_COMPAT                     = 0x8000
@@ -1103,6 +1128,7 @@ const (
 	NFDBITS                        = 0x20
 	NOFLSH                         = 0x80000000
 	NOKERNINFO                     = 0x2000000
+	NOTE_ABSTIME                   = 0x10
 	NOTE_ATTRIB                    = 0x8
 	NOTE_CHILD                     = 0x4
 	NOTE_CLOSE                     = 0x100
@@ -1159,6 +1185,8 @@ const (
 	O_NONBLOCK                     = 0x4
 	O_RDONLY                       = 0x0
 	O_RDWR                         = 0x2
+	O_RESOLVE_BENEATH              = 0x800000
+	O_SEARCH                       = 0x40000
 	O_SHLOCK                       = 0x10
 	O_SYNC                         = 0x80
 	O_TRUNC                        = 0x400
@@ -1169,6 +1197,10 @@ const (
 	PARMRK                         = 0x8
 	PARODD                         = 0x2000
 	PENDIN                         = 0x20000000
+	PIOD_READ_D                    = 0x1
+	PIOD_READ_I                    = 0x3
+	PIOD_WRITE_D                   = 0x2
+	PIOD_WRITE_I                   = 0x4
 	PRIO_PGRP                      = 0x1
 	PRIO_PROCESS                   = 0x0
 	PRIO_USER                      = 0x2
@@ -1176,6 +1208,53 @@ const (
 	PROT_NONE                      = 0x0
 	PROT_READ                      = 0x1
 	PROT_WRITE                     = 0x2
+	PTRACE_DEFAULT                 = 0x1
+	PTRACE_EXEC                    = 0x1
+	PTRACE_FORK                    = 0x8
+	PTRACE_LWP                     = 0x10
+	PTRACE_SCE                     = 0x2
+	PTRACE_SCX                     = 0x4
+	PTRACE_SYSCALL                 = 0x6
+	PTRACE_VFORK                   = 0x20
+	PT_ATTACH                      = 0xa
+	PT_CLEARSTEP                   = 0x10
+	PT_CONTINUE                    = 0x7
+	PT_DETACH                      = 0xb
+	PT_FIRSTMACH                   = 0x40
+	PT_FOLLOW_FORK                 = 0x17
+	PT_GETDBREGS                   = 0x25
+	PT_GETFPREGS                   = 0x23
+	PT_GETLWPLIST                  = 0xf
+	PT_GETNUMLWPS                  = 0xe
+	PT_GETREGS                     = 0x21
+	PT_GETVFPREGS                  = 0x40
+	PT_GET_EVENT_MASK              = 0x19
+	PT_GET_SC_ARGS                 = 0x1b
+	PT_GET_SC_RET                  = 0x1c
+	PT_IO                          = 0xc
+	PT_KILL                        = 0x8
+	PT_LWPINFO                     = 0xd
+	PT_LWP_EVENTS                  = 0x18
+	PT_READ_D                      = 0x2
+	PT_READ_I                      = 0x1
+	PT_RESUME                      = 0x13
+	PT_SETDBREGS                   = 0x26
+	PT_SETFPREGS                   = 0x24
+	PT_SETREGS                     = 0x22
+	PT_SETSTEP                     = 0x11
+	PT_SETVFPREGS                  = 0x41
+	PT_SET_EVENT_MASK              = 0x1a
+	PT_STEP                        = 0x9
+	PT_SUSPEND                     = 0x12
+	PT_SYSCALL                     = 0x16
+	PT_TO_SCE                      = 0x14
+	PT_TO_SCX                      = 0x15
+	PT_TRACE_ME                    = 0x0
+	PT_VM_ENTRY                    = 0x29
+	PT_VM_TIMESTAMP                = 0x28
+	PT_WRITE_D                     = 0x5
+	PT_WRITE_I                     = 0x4
+	P_ZONEID                       = 0xc
 	RLIMIT_AS                      = 0xa
 	RLIMIT_CORE                    = 0x4
 	RLIMIT_CPU                     = 0x0
@@ -1257,7 +1336,6 @@ const (
 	RTV_WEIGHT                     = 0x100
 	RT_ALL_FIBS                    = -0x1
 	RT_BLACKHOLE                   = 0x40
-	RT_CACHING_CONTEXT             = 0x1
 	RT_DEFAULT_FIB                 = 0x0
 	RT_HAS_GW                      = 0x80
 	RT_HAS_HEADER                  = 0x10
@@ -1267,15 +1345,17 @@ const (
 	RT_LLE_CACHE                   = 0x100
 	RT_MAY_LOOP                    = 0x8
 	RT_MAY_LOOP_BIT                = 0x3
-	RT_NORTREF                     = 0x2
 	RT_REJECT                      = 0x20
 	RUSAGE_CHILDREN                = -0x1
 	RUSAGE_SELF                    = 0x0
 	RUSAGE_THREAD                  = 0x1
 	SCM_BINTIME                    = 0x4
 	SCM_CREDS                      = 0x3
+	SCM_MONOTONIC                  = 0x6
+	SCM_REALTIME                   = 0x5
 	SCM_RIGHTS                     = 0x1
 	SCM_TIMESTAMP                  = 0x2
+	SCM_TIME_INFO                  = 0x7
 	SEEK_CUR                       = 0x1
 	SEEK_DATA                      = 0x3
 	SEEK_END                       = 0x2
@@ -1299,10 +1379,12 @@ const (
 	SIOCGHWADDR                    = 0xc020693e
 	SIOCGI2C                       = 0xc020693d
 	SIOCGIFADDR                    = 0xc0206921
+	SIOCGIFALIAS                   = 0xc044692d
 	SIOCGIFBRDADDR                 = 0xc0206923
 	SIOCGIFCAP                     = 0xc020691f
 	SIOCGIFCONF                    = 0xc0086924
 	SIOCGIFDESCR                   = 0xc020692a
+	SIOCGIFDOWNREASON              = 0xc058699a
 	SIOCGIFDSTADDR                 = 0xc0206922
 	SIOCGIFFIB                     = 0xc020695c
 	SIOCGIFFLAGS                   = 0xc0206911
@@ -1318,8 +1400,11 @@ const (
 	SIOCGIFPDSTADDR                = 0xc0206948
 	SIOCGIFPHYS                    = 0xc0206935
 	SIOCGIFPSRCADDR                = 0xc0206947
+	SIOCGIFRSSHASH                 = 0xc0186997
+	SIOCGIFRSSKEY                  = 0xc0946996
 	SIOCGIFSTATUS                  = 0xc331693b
 	SIOCGIFXMEDIA                  = 0xc028698b
+	SIOCGLANPCP                    = 0xc0206998
 	SIOCGLOWAT                     = 0x40047303
 	SIOCGPGRP                      = 0x40047309
 	SIOCGPRIVATE_0                 = 0xc0206950
@@ -1350,6 +1435,7 @@ const (
 	SIOCSIFPHYS                    = 0x80206936
 	SIOCSIFRVNET                   = 0xc020695b
 	SIOCSIFVNET                    = 0xc020695a
+	SIOCSLANPCP                    = 0x80206999
 	SIOCSLOWAT                     = 0x80047302
 	SIOCSPGRP                      = 0x80047308
 	SIOCSTUNFIB                    = 0x8020695f
@@ -1369,6 +1455,7 @@ const (
 	SO_BINTIME                     = 0x2000
 	SO_BROADCAST                   = 0x20
 	SO_DEBUG                       = 0x1
+	SO_DOMAIN                      = 0x1019
 	SO_DONTROUTE                   = 0x10
 	SO_ERROR                       = 0x1007
 	SO_KEEPALIVE                   = 0x8
@@ -1377,6 +1464,7 @@ const (
 	SO_LISTENINCQLEN               = 0x1013
 	SO_LISTENQLEN                  = 0x1012
 	SO_LISTENQLIMIT                = 0x1011
+	SO_MAX_PACING_RATE             = 0x1018
 	SO_NOSIGPIPE                   = 0x800
 	SO_NO_DDP                      = 0x8000
 	SO_NO_OFFLOAD                  = 0x4000
@@ -1387,13 +1475,22 @@ const (
 	SO_RCVBUF                      = 0x1002
 	SO_RCVLOWAT                    = 0x1004
 	SO_RCVTIMEO                    = 0x1006
+	SO_RERROR                      = 0x20000
 	SO_REUSEADDR                   = 0x4
 	SO_REUSEPORT                   = 0x200
+	SO_REUSEPORT_LB                = 0x10000
 	SO_SETFIB                      = 0x1014
 	SO_SNDBUF                      = 0x1001
 	SO_SNDLOWAT                    = 0x1003
 	SO_SNDTIMEO                    = 0x1005
 	SO_TIMESTAMP                   = 0x400
+	SO_TS_BINTIME                  = 0x1
+	SO_TS_CLOCK                    = 0x1017
+	SO_TS_CLOCK_MAX                = 0x3
+	SO_TS_DEFAULT                  = 0x0
+	SO_TS_MONOTONIC                = 0x3
+	SO_TS_REALTIME                 = 0x2
+	SO_TS_REALTIME_MICRO           = 0x0
 	SO_TYPE                        = 0x1008
 	SO_USELOOPBACK                 = 0x40
 	SO_USER_COOKIE                 = 0x1015
@@ -1437,10 +1534,69 @@ const (
 	TCOFLUSH                       = 0x2
 	TCOOFF                         = 0x1
 	TCOON                          = 0x2
+	TCPOPT_EOL                     = 0x0
+	TCPOPT_FAST_OPEN               = 0x22
+	TCPOPT_MAXSEG                  = 0x2
+	TCPOPT_NOP                     = 0x1
+	TCPOPT_PAD                     = 0x0
+	TCPOPT_SACK                    = 0x5
+	TCPOPT_SACK_PERMITTED          = 0x4
+	TCPOPT_SIGNATURE               = 0x13
+	TCPOPT_TIMESTAMP               = 0x8
+	TCPOPT_WINDOW                  = 0x3
+	TCP_BBR_ACK_COMP_ALG           = 0x448
+	TCP_BBR_ALGORITHM              = 0x43b
+	TCP_BBR_DRAIN_INC_EXTRA        = 0x43c
+	TCP_BBR_DRAIN_PG               = 0x42e
+	TCP_BBR_EXTRA_GAIN             = 0x449
+	TCP_BBR_EXTRA_STATE            = 0x453
+	TCP_BBR_FLOOR_MIN_TSO          = 0x454
+	TCP_BBR_HDWR_PACE              = 0x451
+	TCP_BBR_HOLD_TARGET            = 0x436
+	TCP_BBR_IWINTSO                = 0x42b
+	TCP_BBR_LOWGAIN_FD             = 0x436
+	TCP_BBR_LOWGAIN_HALF           = 0x435
+	TCP_BBR_LOWGAIN_THRESH         = 0x434
+	TCP_BBR_MAX_RTO                = 0x439
+	TCP_BBR_MIN_RTO                = 0x438
+	TCP_BBR_MIN_TOPACEOUT          = 0x455
+	TCP_BBR_ONE_RETRAN             = 0x431
+	TCP_BBR_PACE_CROSS             = 0x442
+	TCP_BBR_PACE_DEL_TAR           = 0x43f
+	TCP_BBR_PACE_OH                = 0x435
+	TCP_BBR_PACE_PER_SEC           = 0x43e
+	TCP_BBR_PACE_SEG_MAX           = 0x440
+	TCP_BBR_PACE_SEG_MIN           = 0x441
+	TCP_BBR_POLICER_DETECT         = 0x457
+	TCP_BBR_PROBE_RTT_GAIN         = 0x44d
+	TCP_BBR_PROBE_RTT_INT          = 0x430
+	TCP_BBR_PROBE_RTT_LEN          = 0x44e
+	TCP_BBR_RACK_RTT_USE           = 0x44a
+	TCP_BBR_RECFORCE               = 0x42c
+	TCP_BBR_REC_OVER_HPTS          = 0x43a
+	TCP_BBR_RETRAN_WTSO            = 0x44b
+	TCP_BBR_RWND_IS_APP            = 0x42f
+	TCP_BBR_SEND_IWND_IN_TSO       = 0x44f
+	TCP_BBR_STARTUP_EXIT_EPOCH     = 0x43d
+	TCP_BBR_STARTUP_LOSS_EXIT      = 0x432
+	TCP_BBR_STARTUP_PG             = 0x42d
+	TCP_BBR_TMR_PACE_OH            = 0x448
+	TCP_BBR_TSLIMITS               = 0x434
+	TCP_BBR_TSTMP_RAISES           = 0x456
+	TCP_BBR_UNLIMITED              = 0x43b
+	TCP_BBR_USEDEL_RATE            = 0x437
+	TCP_BBR_USE_LOWGAIN            = 0x433
+	TCP_BBR_USE_RACK_CHEAT         = 0x450
+	TCP_BBR_UTTER_MAX_TSO          = 0x452
 	TCP_CA_NAME_MAX                = 0x10
 	TCP_CCALGOOPT                  = 0x41
 	TCP_CONGESTION                 = 0x40
+	TCP_DATA_AFTER_CLOSE           = 0x44c
+	TCP_DELACK                     = 0x48
 	TCP_FASTOPEN                   = 0x401
+	TCP_FASTOPEN_MAX_COOKIE_LEN    = 0x10
+	TCP_FASTOPEN_MIN_COOKIE_LEN    = 0x4
+	TCP_FASTOPEN_PSK_LEN           = 0x10
 	TCP_FUNCTION_BLK               = 0x2000
 	TCP_FUNCTION_NAME_LEN_MAX      = 0x20
 	TCP_INFO                       = 0x20
@@ -1448,6 +1604,12 @@ const (
 	TCP_KEEPIDLE                   = 0x100
 	TCP_KEEPINIT                   = 0x80
 	TCP_KEEPINTVL                  = 0x200
+	TCP_LOG                        = 0x22
+	TCP_LOGBUF                     = 0x23
+	TCP_LOGDUMP                    = 0x25
+	TCP_LOGDUMPID                  = 0x26
+	TCP_LOGID                      = 0x24
+	TCP_LOG_ID_LEN                 = 0x40
 	TCP_MAXBURST                   = 0x4
 	TCP_MAXHLEN                    = 0x3c
 	TCP_MAXOLEN                    = 0x28
@@ -1463,8 +1625,30 @@ const (
 	TCP_NOPUSH                     = 0x4
 	TCP_PCAP_IN                    = 0x1000
 	TCP_PCAP_OUT                   = 0x800
+	TCP_RACK_EARLY_RECOV           = 0x423
+	TCP_RACK_EARLY_SEG             = 0x424
+	TCP_RACK_GP_INCREASE           = 0x446
+	TCP_RACK_IDLE_REDUCE_HIGH      = 0x444
+	TCP_RACK_MIN_PACE              = 0x445
+	TCP_RACK_MIN_PACE_SEG          = 0x446
+	TCP_RACK_MIN_TO                = 0x422
+	TCP_RACK_PACE_ALWAYS           = 0x41f
+	TCP_RACK_PACE_MAX_SEG          = 0x41e
+	TCP_RACK_PACE_REDUCE           = 0x41d
+	TCP_RACK_PKT_DELAY             = 0x428
+	TCP_RACK_PROP                  = 0x41b
+	TCP_RACK_PROP_RATE             = 0x420
+	TCP_RACK_PRR_SENDALOT          = 0x421
+	TCP_RACK_REORD_FADE            = 0x426
+	TCP_RACK_REORD_THRESH          = 0x425
+	TCP_RACK_TLP_INC_VAR           = 0x429
+	TCP_RACK_TLP_REDUCE            = 0x41c
+	TCP_RACK_TLP_THRESH            = 0x427
+	TCP_RACK_TLP_USE               = 0x447
 	TCP_VENDOR                     = 0x80000000
 	TCSAFLUSH                      = 0x2
+	TIMER_ABSTIME                  = 0x1
+	TIMER_RELTIME                  = 0x0
 	TIOCCBRK                       = 0x2000747a
 	TIOCCDTR                       = 0x20007478
 	TIOCCONS                       = 0x80047462
@@ -1528,6 +1712,8 @@ const (
 	TIOCTIMESTAMP                  = 0x40107459
 	TIOCUCNTL                      = 0x80047466
 	TOSTOP                         = 0x400000
+	UTIME_NOW                      = -0x1
+	UTIME_OMIT                     = -0x2
 	VDISCARD                       = 0xf
 	VDSUSP                         = 0xb
 	VEOF                           = 0x0
@@ -1592,12 +1778,13 @@ const (
 	EIDRM           = syscall.Errno(0x52)
 	EILSEQ          = syscall.Errno(0x56)
 	EINPROGRESS     = syscall.Errno(0x24)
+	EINTEGRITY      = syscall.Errno(0x61)
 	EINTR           = syscall.Errno(0x4)
 	EINVAL          = syscall.Errno(0x16)
 	EIO             = syscall.Errno(0x5)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x60)
+	ELAST           = syscall.Errno(0x61)
 	ELOOP           = syscall.Errno(0x3e)
 	EMFILE          = syscall.Errno(0x18)
 	EMLINK          = syscall.Errno(0x1f)
@@ -1740,7 +1927,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EAGAIN", "resource temporarily unavailable"},
+	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1802,6 +1989,7 @@ var errorList = [...]struct {
 	{94, "ECAPMODE", "not permitted in capability mode"},
 	{95, "ENOTRECOVERABLE", "state not recoverable"},
 	{96, "EOWNERDEAD", "previous owner died"},
+	{97, "EINTEGRITY", "integrity check failed"},
 }
 
 // Signal table
diff --git a/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm64.go
index 4c83771149..c557ac2db3 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_freebsd_arm64.go
@@ -151,6 +151,7 @@ const (
 	BIOCSETF                       = 0x80104267
 	BIOCSETFNR                     = 0x80104282
 	BIOCSETIF                      = 0x8020426c
+	BIOCSETVLANPCP                 = 0x80044285
 	BIOCSETWF                      = 0x8010427b
 	BIOCSETZBUF                    = 0x80184281
 	BIOCSHDRCMPLT                  = 0x80044275
@@ -447,7 +448,7 @@ const (
 	DLT_IEEE802_16_MAC_CPS_RADIO   = 0xc1
 	DLT_INFINIBAND                 = 0xf7
 	DLT_IPFILTER                   = 0x74
-	DLT_IPMB                       = 0xc7
+	DLT_IPMB_KONTRON               = 0xc7
 	DLT_IPMB_LINUX                 = 0xd1
 	DLT_IPMI_HPM_2                 = 0x104
 	DLT_IPNET                      = 0xe2
@@ -487,10 +488,11 @@ const (
 	DLT_LINUX_LAPD                 = 0xb1
 	DLT_LINUX_PPP_WITHDIRECTION    = 0xa6
 	DLT_LINUX_SLL                  = 0x71
+	DLT_LINUX_SLL2                 = 0x114
 	DLT_LOOP                       = 0x6c
 	DLT_LORATAP                    = 0x10e
 	DLT_LTALK                      = 0x72
-	DLT_MATCHING_MAX               = 0x113
+	DLT_MATCHING_MAX               = 0x114
 	DLT_MATCHING_MIN               = 0x68
 	DLT_MFR                        = 0xb6
 	DLT_MOST                       = 0xd3
@@ -734,6 +736,7 @@ const (
 	IPPROTO_CMTP                   = 0x26
 	IPPROTO_CPHB                   = 0x49
 	IPPROTO_CPNX                   = 0x48
+	IPPROTO_DCCP                   = 0x21
 	IPPROTO_DDP                    = 0x25
 	IPPROTO_DGP                    = 0x56
 	IPPROTO_DIVERT                 = 0x102
@@ -814,7 +817,6 @@ const (
 	IPPROTO_SCTP                   = 0x84
 	IPPROTO_SDRP                   = 0x2a
 	IPPROTO_SEND                   = 0x103
-	IPPROTO_SEP                    = 0x21
 	IPPROTO_SHIM6                  = 0x8c
 	IPPROTO_SKIP                   = 0x39
 	IPPROTO_SPACER                 = 0x7fff
@@ -911,6 +913,7 @@ const (
 	IPV6_V6ONLY                    = 0x1b
 	IPV6_VERSION                   = 0x60
 	IPV6_VERSION_MASK              = 0xf0
+	IPV6_VLAN_PCP                  = 0x4b
 	IP_ADD_MEMBERSHIP              = 0xc
 	IP_ADD_SOURCE_MEMBERSHIP       = 0x46
 	IP_BINDANY                     = 0x18
@@ -989,8 +992,12 @@ const (
 	IP_TOS                         = 0x3
 	IP_TTL                         = 0x4
 	IP_UNBLOCK_SOURCE              = 0x49
+	IP_VLAN_PCP                    = 0x4b
 	ISIG                           = 0x80
 	ISTRIP                         = 0x20
+	ITIMER_PROF                    = 0x2
+	ITIMER_REAL                    = 0x0
+	ITIMER_VIRTUAL                 = 0x1
 	IXANY                          = 0x800
 	IXOFF                          = 0x400
 	IXON                           = 0x200
@@ -1000,7 +1007,6 @@ const (
 	KERN_VERSION                   = 0x4
 	LOCAL_CONNWAIT                 = 0x4
 	LOCAL_CREDS                    = 0x2
-	LOCAL_CREDS_PERSISTENT         = 0x3
 	LOCAL_PEERCRED                 = 0x1
 	LOCAL_VENDOR                   = 0x80000000
 	LOCK_EX                        = 0x2
@@ -1180,6 +1186,8 @@ const (
 	O_NONBLOCK                     = 0x4
 	O_RDONLY                       = 0x0
 	O_RDWR                         = 0x2
+	O_RESOLVE_BENEATH              = 0x800000
+	O_SEARCH                       = 0x40000
 	O_SHLOCK                       = 0x10
 	O_SYNC                         = 0x80
 	O_TRUNC                        = 0x400
@@ -1190,6 +1198,10 @@ const (
 	PARMRK                         = 0x8
 	PARODD                         = 0x2000
 	PENDIN                         = 0x20000000
+	PIOD_READ_D                    = 0x1
+	PIOD_READ_I                    = 0x3
+	PIOD_WRITE_D                   = 0x2
+	PIOD_WRITE_I                   = 0x4
 	PRIO_PGRP                      = 0x1
 	PRIO_PROCESS                   = 0x0
 	PRIO_USER                      = 0x2
@@ -1197,6 +1209,51 @@ const (
 	PROT_NONE                      = 0x0
 	PROT_READ                      = 0x1
 	PROT_WRITE                     = 0x2
+	PTRACE_DEFAULT                 = 0x1
+	PTRACE_EXEC                    = 0x1
+	PTRACE_FORK                    = 0x8
+	PTRACE_LWP                     = 0x10
+	PTRACE_SCE                     = 0x2
+	PTRACE_SCX                     = 0x4
+	PTRACE_SYSCALL                 = 0x6
+	PTRACE_VFORK                   = 0x20
+	PT_ATTACH                      = 0xa
+	PT_CLEARSTEP                   = 0x10
+	PT_CONTINUE                    = 0x7
+	PT_DETACH                      = 0xb
+	PT_FIRSTMACH                   = 0x40
+	PT_FOLLOW_FORK                 = 0x17
+	PT_GETDBREGS                   = 0x25
+	PT_GETFPREGS                   = 0x23
+	PT_GETLWPLIST                  = 0xf
+	PT_GETNUMLWPS                  = 0xe
+	PT_GETREGS                     = 0x21
+	PT_GET_EVENT_MASK              = 0x19
+	PT_GET_SC_ARGS                 = 0x1b
+	PT_GET_SC_RET                  = 0x1c
+	PT_IO                          = 0xc
+	PT_KILL                        = 0x8
+	PT_LWPINFO                     = 0xd
+	PT_LWP_EVENTS                  = 0x18
+	PT_READ_D                      = 0x2
+	PT_READ_I                      = 0x1
+	PT_RESUME                      = 0x13
+	PT_SETDBREGS                   = 0x26
+	PT_SETFPREGS                   = 0x24
+	PT_SETREGS                     = 0x22
+	PT_SETSTEP                     = 0x11
+	PT_SET_EVENT_MASK              = 0x1a
+	PT_STEP                        = 0x9
+	PT_SUSPEND                     = 0x12
+	PT_SYSCALL                     = 0x16
+	PT_TO_SCE                      = 0x14
+	PT_TO_SCX                      = 0x15
+	PT_TRACE_ME                    = 0x0
+	PT_VM_ENTRY                    = 0x29
+	PT_VM_TIMESTAMP                = 0x28
+	PT_WRITE_D                     = 0x5
+	PT_WRITE_I                     = 0x4
+	P_ZONEID                       = 0xc
 	RLIMIT_AS                      = 0xa
 	RLIMIT_CORE                    = 0x4
 	RLIMIT_CPU                     = 0x0
@@ -1321,10 +1378,12 @@ const (
 	SIOCGHWADDR                    = 0xc020693e
 	SIOCGI2C                       = 0xc020693d
 	SIOCGIFADDR                    = 0xc0206921
+	SIOCGIFALIAS                   = 0xc044692d
 	SIOCGIFBRDADDR                 = 0xc0206923
 	SIOCGIFCAP                     = 0xc020691f
 	SIOCGIFCONF                    = 0xc0106924
 	SIOCGIFDESCR                   = 0xc020692a
+	SIOCGIFDOWNREASON              = 0xc058699a
 	SIOCGIFDSTADDR                 = 0xc0206922
 	SIOCGIFFIB                     = 0xc020695c
 	SIOCGIFFLAGS                   = 0xc0206911
@@ -1415,6 +1474,7 @@ const (
 	SO_RCVBUF                      = 0x1002
 	SO_RCVLOWAT                    = 0x1004
 	SO_RCVTIMEO                    = 0x1006
+	SO_RERROR                      = 0x20000
 	SO_REUSEADDR                   = 0x4
 	SO_REUSEPORT                   = 0x200
 	SO_REUSEPORT_LB                = 0x10000
@@ -1473,22 +1533,40 @@ const (
 	TCOFLUSH                       = 0x2
 	TCOOFF                         = 0x1
 	TCOON                          = 0x2
+	TCPOPT_EOL                     = 0x0
+	TCPOPT_FAST_OPEN               = 0x22
+	TCPOPT_MAXSEG                  = 0x2
+	TCPOPT_NOP                     = 0x1
+	TCPOPT_PAD                     = 0x0
+	TCPOPT_SACK                    = 0x5
+	TCPOPT_SACK_PERMITTED          = 0x4
+	TCPOPT_SIGNATURE               = 0x13
+	TCPOPT_TIMESTAMP               = 0x8
+	TCPOPT_WINDOW                  = 0x3
 	TCP_BBR_ACK_COMP_ALG           = 0x448
+	TCP_BBR_ALGORITHM              = 0x43b
 	TCP_BBR_DRAIN_INC_EXTRA        = 0x43c
 	TCP_BBR_DRAIN_PG               = 0x42e
 	TCP_BBR_EXTRA_GAIN             = 0x449
+	TCP_BBR_EXTRA_STATE            = 0x453
+	TCP_BBR_FLOOR_MIN_TSO          = 0x454
+	TCP_BBR_HDWR_PACE              = 0x451
+	TCP_BBR_HOLD_TARGET            = 0x436
 	TCP_BBR_IWINTSO                = 0x42b
 	TCP_BBR_LOWGAIN_FD             = 0x436
 	TCP_BBR_LOWGAIN_HALF           = 0x435
 	TCP_BBR_LOWGAIN_THRESH         = 0x434
 	TCP_BBR_MAX_RTO                = 0x439
 	TCP_BBR_MIN_RTO                = 0x438
+	TCP_BBR_MIN_TOPACEOUT          = 0x455
 	TCP_BBR_ONE_RETRAN             = 0x431
 	TCP_BBR_PACE_CROSS             = 0x442
 	TCP_BBR_PACE_DEL_TAR           = 0x43f
+	TCP_BBR_PACE_OH                = 0x435
 	TCP_BBR_PACE_PER_SEC           = 0x43e
 	TCP_BBR_PACE_SEG_MAX           = 0x440
 	TCP_BBR_PACE_SEG_MIN           = 0x441
+	TCP_BBR_POLICER_DETECT         = 0x457
 	TCP_BBR_PROBE_RTT_GAIN         = 0x44d
 	TCP_BBR_PROBE_RTT_INT          = 0x430
 	TCP_BBR_PROBE_RTT_LEN          = 0x44e
@@ -1497,12 +1575,18 @@ const (
 	TCP_BBR_REC_OVER_HPTS          = 0x43a
 	TCP_BBR_RETRAN_WTSO            = 0x44b
 	TCP_BBR_RWND_IS_APP            = 0x42f
+	TCP_BBR_SEND_IWND_IN_TSO       = 0x44f
 	TCP_BBR_STARTUP_EXIT_EPOCH     = 0x43d
 	TCP_BBR_STARTUP_LOSS_EXIT      = 0x432
 	TCP_BBR_STARTUP_PG             = 0x42d
+	TCP_BBR_TMR_PACE_OH            = 0x448
+	TCP_BBR_TSLIMITS               = 0x434
+	TCP_BBR_TSTMP_RAISES           = 0x456
 	TCP_BBR_UNLIMITED              = 0x43b
 	TCP_BBR_USEDEL_RATE            = 0x437
 	TCP_BBR_USE_LOWGAIN            = 0x433
+	TCP_BBR_USE_RACK_CHEAT         = 0x450
+	TCP_BBR_UTTER_MAX_TSO          = 0x452
 	TCP_CA_NAME_MAX                = 0x10
 	TCP_CCALGOOPT                  = 0x41
 	TCP_CONGESTION                 = 0x40
@@ -1542,6 +1626,7 @@ const (
 	TCP_PCAP_OUT                   = 0x800
 	TCP_RACK_EARLY_RECOV           = 0x423
 	TCP_RACK_EARLY_SEG             = 0x424
+	TCP_RACK_GP_INCREASE           = 0x446
 	TCP_RACK_IDLE_REDUCE_HIGH      = 0x444
 	TCP_RACK_MIN_PACE              = 0x445
 	TCP_RACK_MIN_PACE_SEG          = 0x446
@@ -1555,7 +1640,6 @@ const (
 	TCP_RACK_PRR_SENDALOT          = 0x421
 	TCP_RACK_REORD_FADE            = 0x426
 	TCP_RACK_REORD_THRESH          = 0x425
-	TCP_RACK_SESS_CWV              = 0x42a
 	TCP_RACK_TLP_INC_VAR           = 0x429
 	TCP_RACK_TLP_REDUCE            = 0x41c
 	TCP_RACK_TLP_THRESH            = 0x427
@@ -1694,12 +1778,13 @@ const (
 	EIDRM           = syscall.Errno(0x52)
 	EILSEQ          = syscall.Errno(0x56)
 	EINPROGRESS     = syscall.Errno(0x24)
+	EINTEGRITY      = syscall.Errno(0x61)
 	EINTR           = syscall.Errno(0x4)
 	EINVAL          = syscall.Errno(0x16)
 	EIO             = syscall.Errno(0x5)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x60)
+	ELAST           = syscall.Errno(0x61)
 	ELOOP           = syscall.Errno(0x3e)
 	EMFILE          = syscall.Errno(0x18)
 	EMLINK          = syscall.Errno(0x1f)
@@ -1842,7 +1927,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EAGAIN", "resource temporarily unavailable"},
+	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1904,6 +1989,7 @@ var errorList = [...]struct {
 	{94, "ECAPMODE", "not permitted in capability mode"},
 	{95, "ENOTRECOVERABLE", "state not recoverable"},
 	{96, "EOWNERDEAD", "previous owner died"},
+	{97, "EINTEGRITY", "integrity check failed"},
 }
 
 // Signal table
diff --git a/vendor/golang.org/x/sys/unix/zerrors_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/zerrors_freebsd_riscv64.go
new file mode 100644
index 0000000000..341b4d9626
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zerrors_freebsd_riscv64.go
@@ -0,0 +1,2148 @@
+// mkerrors.sh -m64
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build riscv64 && freebsd
+// +build riscv64,freebsd
+
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs -- -m64 _const.go
+
+package unix
+
+import "syscall"
+
+const (
+	AF_APPLETALK                   = 0x10
+	AF_ARP                         = 0x23
+	AF_ATM                         = 0x1e
+	AF_BLUETOOTH                   = 0x24
+	AF_CCITT                       = 0xa
+	AF_CHAOS                       = 0x5
+	AF_CNT                         = 0x15
+	AF_COIP                        = 0x14
+	AF_DATAKIT                     = 0x9
+	AF_DECnet                      = 0xc
+	AF_DLI                         = 0xd
+	AF_E164                        = 0x1a
+	AF_ECMA                        = 0x8
+	AF_HYLINK                      = 0xf
+	AF_HYPERV                      = 0x2b
+	AF_IEEE80211                   = 0x25
+	AF_IMPLINK                     = 0x3
+	AF_INET                        = 0x2
+	AF_INET6                       = 0x1c
+	AF_INET6_SDP                   = 0x2a
+	AF_INET_SDP                    = 0x28
+	AF_IPX                         = 0x17
+	AF_ISDN                        = 0x1a
+	AF_ISO                         = 0x7
+	AF_LAT                         = 0xe
+	AF_LINK                        = 0x12
+	AF_LOCAL                       = 0x1
+	AF_MAX                         = 0x2b
+	AF_NATM                        = 0x1d
+	AF_NETBIOS                     = 0x6
+	AF_NETGRAPH                    = 0x20
+	AF_OSI                         = 0x7
+	AF_PUP                         = 0x4
+	AF_ROUTE                       = 0x11
+	AF_SCLUSTER                    = 0x22
+	AF_SIP                         = 0x18
+	AF_SLOW                        = 0x21
+	AF_SNA                         = 0xb
+	AF_UNIX                        = 0x1
+	AF_UNSPEC                      = 0x0
+	AF_VENDOR00                    = 0x27
+	AF_VENDOR01                    = 0x29
+	AF_VENDOR03                    = 0x2d
+	AF_VENDOR04                    = 0x2f
+	AF_VENDOR05                    = 0x31
+	AF_VENDOR06                    = 0x33
+	AF_VENDOR07                    = 0x35
+	AF_VENDOR08                    = 0x37
+	AF_VENDOR09                    = 0x39
+	AF_VENDOR10                    = 0x3b
+	AF_VENDOR11                    = 0x3d
+	AF_VENDOR12                    = 0x3f
+	AF_VENDOR13                    = 0x41
+	AF_VENDOR14                    = 0x43
+	AF_VENDOR15                    = 0x45
+	AF_VENDOR16                    = 0x47
+	AF_VENDOR17                    = 0x49
+	AF_VENDOR18                    = 0x4b
+	AF_VENDOR19                    = 0x4d
+	AF_VENDOR20                    = 0x4f
+	AF_VENDOR21                    = 0x51
+	AF_VENDOR22                    = 0x53
+	AF_VENDOR23                    = 0x55
+	AF_VENDOR24                    = 0x57
+	AF_VENDOR25                    = 0x59
+	AF_VENDOR26                    = 0x5b
+	AF_VENDOR27                    = 0x5d
+	AF_VENDOR28                    = 0x5f
+	AF_VENDOR29                    = 0x61
+	AF_VENDOR30                    = 0x63
+	AF_VENDOR31                    = 0x65
+	AF_VENDOR32                    = 0x67
+	AF_VENDOR33                    = 0x69
+	AF_VENDOR34                    = 0x6b
+	AF_VENDOR35                    = 0x6d
+	AF_VENDOR36                    = 0x6f
+	AF_VENDOR37                    = 0x71
+	AF_VENDOR38                    = 0x73
+	AF_VENDOR39                    = 0x75
+	AF_VENDOR40                    = 0x77
+	AF_VENDOR41                    = 0x79
+	AF_VENDOR42                    = 0x7b
+	AF_VENDOR43                    = 0x7d
+	AF_VENDOR44                    = 0x7f
+	AF_VENDOR45                    = 0x81
+	AF_VENDOR46                    = 0x83
+	AF_VENDOR47                    = 0x85
+	ALTWERASE                      = 0x200
+	B0                             = 0x0
+	B1000000                       = 0xf4240
+	B110                           = 0x6e
+	B115200                        = 0x1c200
+	B1200                          = 0x4b0
+	B134                           = 0x86
+	B14400                         = 0x3840
+	B150                           = 0x96
+	B1500000                       = 0x16e360
+	B1800                          = 0x708
+	B19200                         = 0x4b00
+	B200                           = 0xc8
+	B2000000                       = 0x1e8480
+	B230400                        = 0x38400
+	B2400                          = 0x960
+	B2500000                       = 0x2625a0
+	B28800                         = 0x7080
+	B300                           = 0x12c
+	B3000000                       = 0x2dc6c0
+	B3500000                       = 0x3567e0
+	B38400                         = 0x9600
+	B4000000                       = 0x3d0900
+	B460800                        = 0x70800
+	B4800                          = 0x12c0
+	B50                            = 0x32
+	B500000                        = 0x7a120
+	B57600                         = 0xe100
+	B600                           = 0x258
+	B7200                          = 0x1c20
+	B75                            = 0x4b
+	B76800                         = 0x12c00
+	B921600                        = 0xe1000
+	B9600                          = 0x2580
+	BIOCFEEDBACK                   = 0x8004427c
+	BIOCFLUSH                      = 0x20004268
+	BIOCGBLEN                      = 0x40044266
+	BIOCGDIRECTION                 = 0x40044276
+	BIOCGDLT                       = 0x4004426a
+	BIOCGDLTLIST                   = 0xc0104279
+	BIOCGETBUFMODE                 = 0x4004427d
+	BIOCGETIF                      = 0x4020426b
+	BIOCGETZMAX                    = 0x4008427f
+	BIOCGHDRCMPLT                  = 0x40044274
+	BIOCGRSIG                      = 0x40044272
+	BIOCGRTIMEOUT                  = 0x4010426e
+	BIOCGSEESENT                   = 0x40044276
+	BIOCGSTATS                     = 0x4008426f
+	BIOCGTSTAMP                    = 0x40044283
+	BIOCIMMEDIATE                  = 0x80044270
+	BIOCLOCK                       = 0x2000427a
+	BIOCPROMISC                    = 0x20004269
+	BIOCROTZBUF                    = 0x40184280
+	BIOCSBLEN                      = 0xc0044266
+	BIOCSDIRECTION                 = 0x80044277
+	BIOCSDLT                       = 0x80044278
+	BIOCSETBUFMODE                 = 0x8004427e
+	BIOCSETF                       = 0x80104267
+	BIOCSETFNR                     = 0x80104282
+	BIOCSETIF                      = 0x8020426c
+	BIOCSETVLANPCP                 = 0x80044285
+	BIOCSETWF                      = 0x8010427b
+	BIOCSETZBUF                    = 0x80184281
+	BIOCSHDRCMPLT                  = 0x80044275
+	BIOCSRSIG                      = 0x80044273
+	BIOCSRTIMEOUT                  = 0x8010426d
+	BIOCSSEESENT                   = 0x80044277
+	BIOCSTSTAMP                    = 0x80044284
+	BIOCVERSION                    = 0x40044271
+	BPF_A                          = 0x10
+	BPF_ABS                        = 0x20
+	BPF_ADD                        = 0x0
+	BPF_ALIGNMENT                  = 0x8
+	BPF_ALU                        = 0x4
+	BPF_AND                        = 0x50
+	BPF_B                          = 0x10
+	BPF_BUFMODE_BUFFER             = 0x1
+	BPF_BUFMODE_ZBUF               = 0x2
+	BPF_DIV                        = 0x30
+	BPF_H                          = 0x8
+	BPF_IMM                        = 0x0
+	BPF_IND                        = 0x40
+	BPF_JA                         = 0x0
+	BPF_JEQ                        = 0x10
+	BPF_JGE                        = 0x30
+	BPF_JGT                        = 0x20
+	BPF_JMP                        = 0x5
+	BPF_JSET                       = 0x40
+	BPF_K                          = 0x0
+	BPF_LD                         = 0x0
+	BPF_LDX                        = 0x1
+	BPF_LEN                        = 0x80
+	BPF_LSH                        = 0x60
+	BPF_MAJOR_VERSION              = 0x1
+	BPF_MAXBUFSIZE                 = 0x80000
+	BPF_MAXINSNS                   = 0x200
+	BPF_MEM                        = 0x60
+	BPF_MEMWORDS                   = 0x10
+	BPF_MINBUFSIZE                 = 0x20
+	BPF_MINOR_VERSION              = 0x1
+	BPF_MISC                       = 0x7
+	BPF_MOD                        = 0x90
+	BPF_MSH                        = 0xa0
+	BPF_MUL                        = 0x20
+	BPF_NEG                        = 0x80
+	BPF_OR                         = 0x40
+	BPF_RELEASE                    = 0x30bb6
+	BPF_RET                        = 0x6
+	BPF_RSH                        = 0x70
+	BPF_ST                         = 0x2
+	BPF_STX                        = 0x3
+	BPF_SUB                        = 0x10
+	BPF_TAX                        = 0x0
+	BPF_TXA                        = 0x80
+	BPF_T_BINTIME                  = 0x2
+	BPF_T_BINTIME_FAST             = 0x102
+	BPF_T_BINTIME_MONOTONIC        = 0x202
+	BPF_T_BINTIME_MONOTONIC_FAST   = 0x302
+	BPF_T_FAST                     = 0x100
+	BPF_T_FLAG_MASK                = 0x300
+	BPF_T_FORMAT_MASK              = 0x3
+	BPF_T_MICROTIME                = 0x0
+	BPF_T_MICROTIME_FAST           = 0x100
+	BPF_T_MICROTIME_MONOTONIC      = 0x200
+	BPF_T_MICROTIME_MONOTONIC_FAST = 0x300
+	BPF_T_MONOTONIC                = 0x200
+	BPF_T_MONOTONIC_FAST           = 0x300
+	BPF_T_NANOTIME                 = 0x1
+	BPF_T_NANOTIME_FAST            = 0x101
+	BPF_T_NANOTIME_MONOTONIC       = 0x201
+	BPF_T_NANOTIME_MONOTONIC_FAST  = 0x301
+	BPF_T_NONE                     = 0x3
+	BPF_T_NORMAL                   = 0x0
+	BPF_W                          = 0x0
+	BPF_X                          = 0x8
+	BPF_XOR                        = 0xa0
+	BRKINT                         = 0x2
+	CAP_ACCEPT                     = 0x200000020000000
+	CAP_ACL_CHECK                  = 0x400000000010000
+	CAP_ACL_DELETE                 = 0x400000000020000
+	CAP_ACL_GET                    = 0x400000000040000
+	CAP_ACL_SET                    = 0x400000000080000
+	CAP_ALL0                       = 0x20007ffffffffff
+	CAP_ALL1                       = 0x4000000001fffff
+	CAP_BIND                       = 0x200000040000000
+	CAP_BINDAT                     = 0x200008000000400
+	CAP_CHFLAGSAT                  = 0x200000000001400
+	CAP_CONNECT                    = 0x200000080000000
+	CAP_CONNECTAT                  = 0x200010000000400
+	CAP_CREATE                     = 0x200000000000040
+	CAP_EVENT                      = 0x400000000000020
+	CAP_EXTATTR_DELETE             = 0x400000000001000
+	CAP_EXTATTR_GET                = 0x400000000002000
+	CAP_EXTATTR_LIST               = 0x400000000004000
+	CAP_EXTATTR_SET                = 0x400000000008000
+	CAP_FCHDIR                     = 0x200000000000800
+	CAP_FCHFLAGS                   = 0x200000000001000
+	CAP_FCHMOD                     = 0x200000000002000
+	CAP_FCHMODAT                   = 0x200000000002400
+	CAP_FCHOWN                     = 0x200000000004000
+	CAP_FCHOWNAT                   = 0x200000000004400
+	CAP_FCNTL                      = 0x200000000008000
+	CAP_FCNTL_ALL                  = 0x78
+	CAP_FCNTL_GETFL                = 0x8
+	CAP_FCNTL_GETOWN               = 0x20
+	CAP_FCNTL_SETFL                = 0x10
+	CAP_FCNTL_SETOWN               = 0x40
+	CAP_FEXECVE                    = 0x200000000000080
+	CAP_FLOCK                      = 0x200000000010000
+	CAP_FPATHCONF                  = 0x200000000020000
+	CAP_FSCK                       = 0x200000000040000
+	CAP_FSTAT                      = 0x200000000080000
+	CAP_FSTATAT                    = 0x200000000080400
+	CAP_FSTATFS                    = 0x200000000100000
+	CAP_FSYNC                      = 0x200000000000100
+	CAP_FTRUNCATE                  = 0x200000000000200
+	CAP_FUTIMES                    = 0x200000000200000
+	CAP_FUTIMESAT                  = 0x200000000200400
+	CAP_GETPEERNAME                = 0x200000100000000
+	CAP_GETSOCKNAME                = 0x200000200000000
+	CAP_GETSOCKOPT                 = 0x200000400000000
+	CAP_IOCTL                      = 0x400000000000080
+	CAP_IOCTLS_ALL                 = 0x7fffffffffffffff
+	CAP_KQUEUE                     = 0x400000000100040
+	CAP_KQUEUE_CHANGE              = 0x400000000100000
+	CAP_KQUEUE_EVENT               = 0x400000000000040
+	CAP_LINKAT_SOURCE              = 0x200020000000400
+	CAP_LINKAT_TARGET              = 0x200000000400400
+	CAP_LISTEN                     = 0x200000800000000
+	CAP_LOOKUP                     = 0x200000000000400
+	CAP_MAC_GET                    = 0x400000000000001
+	CAP_MAC_SET                    = 0x400000000000002
+	CAP_MKDIRAT                    = 0x200000000800400
+	CAP_MKFIFOAT                   = 0x200000001000400
+	CAP_MKNODAT                    = 0x200000002000400
+	CAP_MMAP                       = 0x200000000000010
+	CAP_MMAP_R                     = 0x20000000000001d
+	CAP_MMAP_RW                    = 0x20000000000001f
+	CAP_MMAP_RWX                   = 0x20000000000003f
+	CAP_MMAP_RX                    = 0x20000000000003d
+	CAP_MMAP_W                     = 0x20000000000001e
+	CAP_MMAP_WX                    = 0x20000000000003e
+	CAP_MMAP_X                     = 0x20000000000003c
+	CAP_PDGETPID                   = 0x400000000000200
+	CAP_PDKILL                     = 0x400000000000800
+	CAP_PDWAIT                     = 0x400000000000400
+	CAP_PEELOFF                    = 0x200001000000000
+	CAP_POLL_EVENT                 = 0x400000000000020
+	CAP_PREAD                      = 0x20000000000000d
+	CAP_PWRITE                     = 0x20000000000000e
+	CAP_READ                       = 0x200000000000001
+	CAP_RECV                       = 0x200000000000001
+	CAP_RENAMEAT_SOURCE            = 0x200000004000400
+	CAP_RENAMEAT_TARGET            = 0x200040000000400
+	CAP_RIGHTS_VERSION             = 0x0
+	CAP_RIGHTS_VERSION_00          = 0x0
+	CAP_SEEK                       = 0x20000000000000c
+	CAP_SEEK_TELL                  = 0x200000000000004
+	CAP_SEM_GETVALUE               = 0x400000000000004
+	CAP_SEM_POST                   = 0x400000000000008
+	CAP_SEM_WAIT                   = 0x400000000000010
+	CAP_SEND                       = 0x200000000000002
+	CAP_SETSOCKOPT                 = 0x200002000000000
+	CAP_SHUTDOWN                   = 0x200004000000000
+	CAP_SOCK_CLIENT                = 0x200007780000003
+	CAP_SOCK_SERVER                = 0x200007f60000003
+	CAP_SYMLINKAT                  = 0x200000008000400
+	CAP_TTYHOOK                    = 0x400000000000100
+	CAP_UNLINKAT                   = 0x200000010000400
+	CAP_UNUSED0_44                 = 0x200080000000000
+	CAP_UNUSED0_57                 = 0x300000000000000
+	CAP_UNUSED1_22                 = 0x400000000200000
+	CAP_UNUSED1_57                 = 0x500000000000000
+	CAP_WRITE                      = 0x200000000000002
+	CFLUSH                         = 0xf
+	CLOCAL                         = 0x8000
+	CLOCK_BOOTTIME                 = 0x5
+	CLOCK_MONOTONIC                = 0x4
+	CLOCK_MONOTONIC_COARSE         = 0xc
+	CLOCK_MONOTONIC_FAST           = 0xc
+	CLOCK_MONOTONIC_PRECISE        = 0xb
+	CLOCK_PROCESS_CPUTIME_ID       = 0xf
+	CLOCK_PROF                     = 0x2
+	CLOCK_REALTIME                 = 0x0
+	CLOCK_REALTIME_COARSE          = 0xa
+	CLOCK_REALTIME_FAST            = 0xa
+	CLOCK_REALTIME_PRECISE         = 0x9
+	CLOCK_SECOND                   = 0xd
+	CLOCK_THREAD_CPUTIME_ID        = 0xe
+	CLOCK_UPTIME                   = 0x5
+	CLOCK_UPTIME_FAST              = 0x8
+	CLOCK_UPTIME_PRECISE           = 0x7
+	CLOCK_VIRTUAL                  = 0x1
+	CPUSTATES                      = 0x5
+	CP_IDLE                        = 0x4
+	CP_INTR                        = 0x3
+	CP_NICE                        = 0x1
+	CP_SYS                         = 0x2
+	CP_USER                        = 0x0
+	CREAD                          = 0x800
+	CRTSCTS                        = 0x30000
+	CS5                            = 0x0
+	CS6                            = 0x100
+	CS7                            = 0x200
+	CS8                            = 0x300
+	CSIZE                          = 0x300
+	CSTART                         = 0x11
+	CSTATUS                        = 0x14
+	CSTOP                          = 0x13
+	CSTOPB                         = 0x400
+	CSUSP                          = 0x1a
+	CTL_HW                         = 0x6
+	CTL_KERN                       = 0x1
+	CTL_MAXNAME                    = 0x18
+	CTL_NET                        = 0x4
+	DIOCGATTR                      = 0xc148648e
+	DIOCGDELETE                    = 0x80106488
+	DIOCGFLUSH                     = 0x20006487
+	DIOCGFWHEADS                   = 0x40046483
+	DIOCGFWSECTORS                 = 0x40046482
+	DIOCGIDENT                     = 0x41006489
+	DIOCGKERNELDUMP                = 0xc0986492
+	DIOCGMEDIASIZE                 = 0x40086481
+	DIOCGPHYSPATH                  = 0x4400648d
+	DIOCGPROVIDERNAME              = 0x4400648a
+	DIOCGSECTORSIZE                = 0x40046480
+	DIOCGSTRIPEOFFSET              = 0x4008648c
+	DIOCGSTRIPESIZE                = 0x4008648b
+	DIOCSKERNELDUMP                = 0x80986491
+	DIOCSKERNELDUMP_FREEBSD11      = 0x80046485
+	DIOCSKERNELDUMP_FREEBSD12      = 0x80506490
+	DIOCZONECMD                    = 0xc080648f
+	DLT_A429                       = 0xb8
+	DLT_A653_ICM                   = 0xb9
+	DLT_AIRONET_HEADER             = 0x78
+	DLT_AOS                        = 0xde
+	DLT_APPLE_IP_OVER_IEEE1394     = 0x8a
+	DLT_ARCNET                     = 0x7
+	DLT_ARCNET_LINUX               = 0x81
+	DLT_ATM_CLIP                   = 0x13
+	DLT_ATM_RFC1483                = 0xb
+	DLT_AURORA                     = 0x7e
+	DLT_AX25                       = 0x3
+	DLT_AX25_KISS                  = 0xca
+	DLT_BACNET_MS_TP               = 0xa5
+	DLT_BLUETOOTH_BREDR_BB         = 0xff
+	DLT_BLUETOOTH_HCI_H4           = 0xbb
+	DLT_BLUETOOTH_HCI_H4_WITH_PHDR = 0xc9
+	DLT_BLUETOOTH_LE_LL            = 0xfb
+	DLT_BLUETOOTH_LE_LL_WITH_PHDR  = 0x100
+	DLT_BLUETOOTH_LINUX_MONITOR    = 0xfe
+	DLT_CAN20B                     = 0xbe
+	DLT_CAN_SOCKETCAN              = 0xe3
+	DLT_CHAOS                      = 0x5
+	DLT_CHDLC                      = 0x68
+	DLT_CISCO_IOS                  = 0x76
+	DLT_CLASS_NETBSD_RAWAF         = 0x2240000
+	DLT_C_HDLC                     = 0x68
+	DLT_C_HDLC_WITH_DIR            = 0xcd
+	DLT_DBUS                       = 0xe7
+	DLT_DECT                       = 0xdd
+	DLT_DISPLAYPORT_AUX            = 0x113
+	DLT_DOCSIS                     = 0x8f
+	DLT_DOCSIS31_XRA31             = 0x111
+	DLT_DVB_CI                     = 0xeb
+	DLT_ECONET                     = 0x73
+	DLT_EN10MB                     = 0x1
+	DLT_EN3MB                      = 0x2
+	DLT_ENC                        = 0x6d
+	DLT_EPON                       = 0x103
+	DLT_ERF                        = 0xc5
+	DLT_ERF_ETH                    = 0xaf
+	DLT_ERF_POS                    = 0xb0
+	DLT_ETHERNET_MPACKET           = 0x112
+	DLT_FC_2                       = 0xe0
+	DLT_FC_2_WITH_FRAME_DELIMS     = 0xe1
+	DLT_FDDI                       = 0xa
+	DLT_FLEXRAY                    = 0xd2
+	DLT_FRELAY                     = 0x6b
+	DLT_FRELAY_WITH_DIR            = 0xce
+	DLT_GCOM_SERIAL                = 0xad
+	DLT_GCOM_T1E1                  = 0xac
+	DLT_GPF_F                      = 0xab
+	DLT_GPF_T                      = 0xaa
+	DLT_GPRS_LLC                   = 0xa9
+	DLT_GSMTAP_ABIS                = 0xda
+	DLT_GSMTAP_UM                  = 0xd9
+	DLT_IBM_SN                     = 0x92
+	DLT_IBM_SP                     = 0x91
+	DLT_IEEE802                    = 0x6
+	DLT_IEEE802_11                 = 0x69
+	DLT_IEEE802_11_RADIO           = 0x7f
+	DLT_IEEE802_11_RADIO_AVS       = 0xa3
+	DLT_IEEE802_15_4               = 0xc3
+	DLT_IEEE802_15_4_LINUX         = 0xbf
+	DLT_IEEE802_15_4_NOFCS         = 0xe6
+	DLT_IEEE802_15_4_NONASK_PHY    = 0xd7
+	DLT_IEEE802_16_MAC_CPS         = 0xbc
+	DLT_IEEE802_16_MAC_CPS_RADIO   = 0xc1
+	DLT_INFINIBAND                 = 0xf7
+	DLT_IPFILTER                   = 0x74
+	DLT_IPMB_KONTRON               = 0xc7
+	DLT_IPMB_LINUX                 = 0xd1
+	DLT_IPMI_HPM_2                 = 0x104
+	DLT_IPNET                      = 0xe2
+	DLT_IPOIB                      = 0xf2
+	DLT_IPV4                       = 0xe4
+	DLT_IPV6                       = 0xe5
+	DLT_IP_OVER_FC                 = 0x7a
+	DLT_ISO_14443                  = 0x108
+	DLT_JUNIPER_ATM1               = 0x89
+	DLT_JUNIPER_ATM2               = 0x87
+	DLT_JUNIPER_ATM_CEMIC          = 0xee
+	DLT_JUNIPER_CHDLC              = 0xb5
+	DLT_JUNIPER_ES                 = 0x84
+	DLT_JUNIPER_ETHER              = 0xb2
+	DLT_JUNIPER_FIBRECHANNEL       = 0xea
+	DLT_JUNIPER_FRELAY             = 0xb4
+	DLT_JUNIPER_GGSN               = 0x85
+	DLT_JUNIPER_ISM                = 0xc2
+	DLT_JUNIPER_MFR                = 0x86
+	DLT_JUNIPER_MLFR               = 0x83
+	DLT_JUNIPER_MLPPP              = 0x82
+	DLT_JUNIPER_MONITOR            = 0xa4
+	DLT_JUNIPER_PIC_PEER           = 0xae
+	DLT_JUNIPER_PPP                = 0xb3
+	DLT_JUNIPER_PPPOE              = 0xa7
+	DLT_JUNIPER_PPPOE_ATM          = 0xa8
+	DLT_JUNIPER_SERVICES           = 0x88
+	DLT_JUNIPER_SRX_E2E            = 0xe9
+	DLT_JUNIPER_ST                 = 0xc8
+	DLT_JUNIPER_VP                 = 0xb7
+	DLT_JUNIPER_VS                 = 0xe8
+	DLT_LAPB_WITH_DIR              = 0xcf
+	DLT_LAPD                       = 0xcb
+	DLT_LIN                        = 0xd4
+	DLT_LINUX_EVDEV                = 0xd8
+	DLT_LINUX_IRDA                 = 0x90
+	DLT_LINUX_LAPD                 = 0xb1
+	DLT_LINUX_PPP_WITHDIRECTION    = 0xa6
+	DLT_LINUX_SLL                  = 0x71
+	DLT_LINUX_SLL2                 = 0x114
+	DLT_LOOP                       = 0x6c
+	DLT_LORATAP                    = 0x10e
+	DLT_LTALK                      = 0x72
+	DLT_MATCHING_MAX               = 0x114
+	DLT_MATCHING_MIN               = 0x68
+	DLT_MFR                        = 0xb6
+	DLT_MOST                       = 0xd3
+	DLT_MPEG_2_TS                  = 0xf3
+	DLT_MPLS                       = 0xdb
+	DLT_MTP2                       = 0x8c
+	DLT_MTP2_WITH_PHDR             = 0x8b
+	DLT_MTP3                       = 0x8d
+	DLT_MUX27010                   = 0xec
+	DLT_NETANALYZER                = 0xf0
+	DLT_NETANALYZER_TRANSPARENT    = 0xf1
+	DLT_NETLINK                    = 0xfd
+	DLT_NFC_LLCP                   = 0xf5
+	DLT_NFLOG                      = 0xef
+	DLT_NG40                       = 0xf4
+	DLT_NORDIC_BLE                 = 0x110
+	DLT_NULL                       = 0x0
+	DLT_OPENFLOW                   = 0x10b
+	DLT_PCI_EXP                    = 0x7d
+	DLT_PFLOG                      = 0x75
+	DLT_PFSYNC                     = 0x79
+	DLT_PKTAP                      = 0x102
+	DLT_PPI                        = 0xc0
+	DLT_PPP                        = 0x9
+	DLT_PPP_BSDOS                  = 0xe
+	DLT_PPP_ETHER                  = 0x33
+	DLT_PPP_PPPD                   = 0xa6
+	DLT_PPP_SERIAL                 = 0x32
+	DLT_PPP_WITH_DIR               = 0xcc
+	DLT_PPP_WITH_DIRECTION         = 0xa6
+	DLT_PRISM_HEADER               = 0x77
+	DLT_PROFIBUS_DL                = 0x101
+	DLT_PRONET                     = 0x4
+	DLT_RAIF1                      = 0xc6
+	DLT_RAW                        = 0xc
+	DLT_RDS                        = 0x109
+	DLT_REDBACK_SMARTEDGE          = 0x20
+	DLT_RIO                        = 0x7c
+	DLT_RTAC_SERIAL                = 0xfa
+	DLT_SCCP                       = 0x8e
+	DLT_SCTP                       = 0xf8
+	DLT_SDLC                       = 0x10c
+	DLT_SITA                       = 0xc4
+	DLT_SLIP                       = 0x8
+	DLT_SLIP_BSDOS                 = 0xd
+	DLT_STANAG_5066_D_PDU          = 0xed
+	DLT_SUNATM                     = 0x7b
+	DLT_SYMANTEC_FIREWALL          = 0x63
+	DLT_TI_LLN_SNIFFER             = 0x10d
+	DLT_TZSP                       = 0x80
+	DLT_USB                        = 0xba
+	DLT_USBPCAP                    = 0xf9
+	DLT_USB_DARWIN                 = 0x10a
+	DLT_USB_FREEBSD                = 0xba
+	DLT_USB_LINUX                  = 0xbd
+	DLT_USB_LINUX_MMAPPED          = 0xdc
+	DLT_USER0                      = 0x93
+	DLT_USER1                      = 0x94
+	DLT_USER10                     = 0x9d
+	DLT_USER11                     = 0x9e
+	DLT_USER12                     = 0x9f
+	DLT_USER13                     = 0xa0
+	DLT_USER14                     = 0xa1
+	DLT_USER15                     = 0xa2
+	DLT_USER2                      = 0x95
+	DLT_USER3                      = 0x96
+	DLT_USER4                      = 0x97
+	DLT_USER5                      = 0x98
+	DLT_USER6                      = 0x99
+	DLT_USER7                      = 0x9a
+	DLT_USER8                      = 0x9b
+	DLT_USER9                      = 0x9c
+	DLT_VSOCK                      = 0x10f
+	DLT_WATTSTOPPER_DLM            = 0x107
+	DLT_WIHART                     = 0xdf
+	DLT_WIRESHARK_UPPER_PDU        = 0xfc
+	DLT_X2E_SERIAL                 = 0xd5
+	DLT_X2E_XORAYA                 = 0xd6
+	DLT_ZWAVE_R1_R2                = 0x105
+	DLT_ZWAVE_R3                   = 0x106
+	DT_BLK                         = 0x6
+	DT_CHR                         = 0x2
+	DT_DIR                         = 0x4
+	DT_FIFO                        = 0x1
+	DT_LNK                         = 0xa
+	DT_REG                         = 0x8
+	DT_SOCK                        = 0xc
+	DT_UNKNOWN                     = 0x0
+	DT_WHT                         = 0xe
+	ECHO                           = 0x8
+	ECHOCTL                        = 0x40
+	ECHOE                          = 0x2
+	ECHOK                          = 0x4
+	ECHOKE                         = 0x1
+	ECHONL                         = 0x10
+	ECHOPRT                        = 0x20
+	EHE_DEAD_PRIORITY              = -0x1
+	EVFILT_AIO                     = -0x3
+	EVFILT_EMPTY                   = -0xd
+	EVFILT_FS                      = -0x9
+	EVFILT_LIO                     = -0xa
+	EVFILT_PROC                    = -0x5
+	EVFILT_PROCDESC                = -0x8
+	EVFILT_READ                    = -0x1
+	EVFILT_SENDFILE                = -0xc
+	EVFILT_SIGNAL                  = -0x6
+	EVFILT_SYSCOUNT                = 0xd
+	EVFILT_TIMER                   = -0x7
+	EVFILT_USER                    = -0xb
+	EVFILT_VNODE                   = -0x4
+	EVFILT_WRITE                   = -0x2
+	EVNAMEMAP_NAME_SIZE            = 0x40
+	EV_ADD                         = 0x1
+	EV_CLEAR                       = 0x20
+	EV_DELETE                      = 0x2
+	EV_DISABLE                     = 0x8
+	EV_DISPATCH                    = 0x80
+	EV_DROP                        = 0x1000
+	EV_ENABLE                      = 0x4
+	EV_EOF                         = 0x8000
+	EV_ERROR                       = 0x4000
+	EV_FLAG1                       = 0x2000
+	EV_FLAG2                       = 0x4000
+	EV_FORCEONESHOT                = 0x100
+	EV_ONESHOT                     = 0x10
+	EV_RECEIPT                     = 0x40
+	EV_SYSFLAGS                    = 0xf000
+	EXTA                           = 0x4b00
+	EXTATTR_MAXNAMELEN             = 0xff
+	EXTATTR_NAMESPACE_EMPTY        = 0x0
+	EXTATTR_NAMESPACE_SYSTEM       = 0x2
+	EXTATTR_NAMESPACE_USER         = 0x1
+	EXTB                           = 0x9600
+	EXTPROC                        = 0x800
+	FD_CLOEXEC                     = 0x1
+	FD_NONE                        = -0xc8
+	FD_SETSIZE                     = 0x400
+	FLUSHO                         = 0x800000
+	F_ADD_SEALS                    = 0x13
+	F_CANCEL                       = 0x5
+	F_DUP2FD                       = 0xa
+	F_DUP2FD_CLOEXEC               = 0x12
+	F_DUPFD                        = 0x0
+	F_DUPFD_CLOEXEC                = 0x11
+	F_GETFD                        = 0x1
+	F_GETFL                        = 0x3
+	F_GETLK                        = 0xb
+	F_GETOWN                       = 0x5
+	F_GET_SEALS                    = 0x14
+	F_ISUNIONSTACK                 = 0x15
+	F_KINFO                        = 0x16
+	F_OGETLK                       = 0x7
+	F_OK                           = 0x0
+	F_OSETLK                       = 0x8
+	F_OSETLKW                      = 0x9
+	F_RDAHEAD                      = 0x10
+	F_RDLCK                        = 0x1
+	F_READAHEAD                    = 0xf
+	F_SEAL_GROW                    = 0x4
+	F_SEAL_SEAL                    = 0x1
+	F_SEAL_SHRINK                  = 0x2
+	F_SEAL_WRITE                   = 0x8
+	F_SETFD                        = 0x2
+	F_SETFL                        = 0x4
+	F_SETLK                        = 0xc
+	F_SETLKW                       = 0xd
+	F_SETLK_REMOTE                 = 0xe
+	F_SETOWN                       = 0x6
+	F_UNLCK                        = 0x2
+	F_UNLCKSYS                     = 0x4
+	F_WRLCK                        = 0x3
+	HUPCL                          = 0x4000
+	HW_MACHINE                     = 0x1
+	ICANON                         = 0x100
+	ICMP6_FILTER                   = 0x12
+	ICRNL                          = 0x100
+	IEXTEN                         = 0x400
+	IFAN_ARRIVAL                   = 0x0
+	IFAN_DEPARTURE                 = 0x1
+	IFCAP_WOL_MAGIC                = 0x2000
+	IFF_ALLMULTI                   = 0x200
+	IFF_ALTPHYS                    = 0x4000
+	IFF_BROADCAST                  = 0x2
+	IFF_CANTCHANGE                 = 0x218f72
+	IFF_CANTCONFIG                 = 0x10000
+	IFF_DEBUG                      = 0x4
+	IFF_DRV_OACTIVE                = 0x400
+	IFF_DRV_RUNNING                = 0x40
+	IFF_DYING                      = 0x200000
+	IFF_KNOWSEPOCH                 = 0x20
+	IFF_LINK0                      = 0x1000
+	IFF_LINK1                      = 0x2000
+	IFF_LINK2                      = 0x4000
+	IFF_LOOPBACK                   = 0x8
+	IFF_MONITOR                    = 0x40000
+	IFF_MULTICAST                  = 0x8000
+	IFF_NOARP                      = 0x80
+	IFF_NOGROUP                    = 0x800000
+	IFF_OACTIVE                    = 0x400
+	IFF_POINTOPOINT                = 0x10
+	IFF_PPROMISC                   = 0x20000
+	IFF_PROMISC                    = 0x100
+	IFF_RENAMING                   = 0x400000
+	IFF_RUNNING                    = 0x40
+	IFF_SIMPLEX                    = 0x800
+	IFF_STATICARP                  = 0x80000
+	IFF_UP                         = 0x1
+	IFNAMSIZ                       = 0x10
+	IFT_BRIDGE                     = 0xd1
+	IFT_CARP                       = 0xf8
+	IFT_IEEE1394                   = 0x90
+	IFT_INFINIBAND                 = 0xc7
+	IFT_L2VLAN                     = 0x87
+	IFT_L3IPVLAN                   = 0x88
+	IFT_PPP                        = 0x17
+	IFT_PROPVIRTUAL                = 0x35
+	IGNBRK                         = 0x1
+	IGNCR                          = 0x80
+	IGNPAR                         = 0x4
+	IMAXBEL                        = 0x2000
+	INLCR                          = 0x40
+	INPCK                          = 0x10
+	IN_CLASSA_HOST                 = 0xffffff
+	IN_CLASSA_MAX                  = 0x80
+	IN_CLASSA_NET                  = 0xff000000
+	IN_CLASSA_NSHIFT               = 0x18
+	IN_CLASSB_HOST                 = 0xffff
+	IN_CLASSB_MAX                  = 0x10000
+	IN_CLASSB_NET                  = 0xffff0000
+	IN_CLASSB_NSHIFT               = 0x10
+	IN_CLASSC_HOST                 = 0xff
+	IN_CLASSC_NET                  = 0xffffff00
+	IN_CLASSC_NSHIFT               = 0x8
+	IN_CLASSD_HOST                 = 0xfffffff
+	IN_CLASSD_NET                  = 0xf0000000
+	IN_CLASSD_NSHIFT               = 0x1c
+	IN_LOOPBACKNET                 = 0x7f
+	IN_NETMASK_DEFAULT             = 0xffffff00
+	IN_RFC3021_MASK                = 0xfffffffe
+	IPPROTO_3PC                    = 0x22
+	IPPROTO_ADFS                   = 0x44
+	IPPROTO_AH                     = 0x33
+	IPPROTO_AHIP                   = 0x3d
+	IPPROTO_APES                   = 0x63
+	IPPROTO_ARGUS                  = 0xd
+	IPPROTO_AX25                   = 0x5d
+	IPPROTO_BHA                    = 0x31
+	IPPROTO_BLT                    = 0x1e
+	IPPROTO_BRSATMON               = 0x4c
+	IPPROTO_CARP                   = 0x70
+	IPPROTO_CFTP                   = 0x3e
+	IPPROTO_CHAOS                  = 0x10
+	IPPROTO_CMTP                   = 0x26
+	IPPROTO_CPHB                   = 0x49
+	IPPROTO_CPNX                   = 0x48
+	IPPROTO_DCCP                   = 0x21
+	IPPROTO_DDP                    = 0x25
+	IPPROTO_DGP                    = 0x56
+	IPPROTO_DIVERT                 = 0x102
+	IPPROTO_DONE                   = 0x101
+	IPPROTO_DSTOPTS                = 0x3c
+	IPPROTO_EGP                    = 0x8
+	IPPROTO_EMCON                  = 0xe
+	IPPROTO_ENCAP                  = 0x62
+	IPPROTO_EON                    = 0x50
+	IPPROTO_ESP                    = 0x32
+	IPPROTO_ETHERIP                = 0x61
+	IPPROTO_FRAGMENT               = 0x2c
+	IPPROTO_GGP                    = 0x3
+	IPPROTO_GMTP                   = 0x64
+	IPPROTO_GRE                    = 0x2f
+	IPPROTO_HELLO                  = 0x3f
+	IPPROTO_HIP                    = 0x8b
+	IPPROTO_HMP                    = 0x14
+	IPPROTO_HOPOPTS                = 0x0
+	IPPROTO_ICMP                   = 0x1
+	IPPROTO_ICMPV6                 = 0x3a
+	IPPROTO_IDP                    = 0x16
+	IPPROTO_IDPR                   = 0x23
+	IPPROTO_IDRP                   = 0x2d
+	IPPROTO_IGMP                   = 0x2
+	IPPROTO_IGP                    = 0x55
+	IPPROTO_IGRP                   = 0x58
+	IPPROTO_IL                     = 0x28
+	IPPROTO_INLSP                  = 0x34
+	IPPROTO_INP                    = 0x20
+	IPPROTO_IP                     = 0x0
+	IPPROTO_IPCOMP                 = 0x6c
+	IPPROTO_IPCV                   = 0x47
+	IPPROTO_IPEIP                  = 0x5e
+	IPPROTO_IPIP                   = 0x4
+	IPPROTO_IPPC                   = 0x43
+	IPPROTO_IPV4                   = 0x4
+	IPPROTO_IPV6                   = 0x29
+	IPPROTO_IRTP                   = 0x1c
+	IPPROTO_KRYPTOLAN              = 0x41
+	IPPROTO_LARP                   = 0x5b
+	IPPROTO_LEAF1                  = 0x19
+	IPPROTO_LEAF2                  = 0x1a
+	IPPROTO_MAX                    = 0x100
+	IPPROTO_MEAS                   = 0x13
+	IPPROTO_MH                     = 0x87
+	IPPROTO_MHRP                   = 0x30
+	IPPROTO_MICP                   = 0x5f
+	IPPROTO_MOBILE                 = 0x37
+	IPPROTO_MPLS                   = 0x89
+	IPPROTO_MTP                    = 0x5c
+	IPPROTO_MUX                    = 0x12
+	IPPROTO_ND                     = 0x4d
+	IPPROTO_NHRP                   = 0x36
+	IPPROTO_NONE                   = 0x3b
+	IPPROTO_NSP                    = 0x1f
+	IPPROTO_NVPII                  = 0xb
+	IPPROTO_OLD_DIVERT             = 0xfe
+	IPPROTO_OSPFIGP                = 0x59
+	IPPROTO_PFSYNC                 = 0xf0
+	IPPROTO_PGM                    = 0x71
+	IPPROTO_PIGP                   = 0x9
+	IPPROTO_PIM                    = 0x67
+	IPPROTO_PRM                    = 0x15
+	IPPROTO_PUP                    = 0xc
+	IPPROTO_PVP                    = 0x4b
+	IPPROTO_RAW                    = 0xff
+	IPPROTO_RCCMON                 = 0xa
+	IPPROTO_RDP                    = 0x1b
+	IPPROTO_RESERVED_253           = 0xfd
+	IPPROTO_RESERVED_254           = 0xfe
+	IPPROTO_ROUTING                = 0x2b
+	IPPROTO_RSVP                   = 0x2e
+	IPPROTO_RVD                    = 0x42
+	IPPROTO_SATEXPAK               = 0x40
+	IPPROTO_SATMON                 = 0x45
+	IPPROTO_SCCSP                  = 0x60
+	IPPROTO_SCTP                   = 0x84
+	IPPROTO_SDRP                   = 0x2a
+	IPPROTO_SEND                   = 0x103
+	IPPROTO_SHIM6                  = 0x8c
+	IPPROTO_SKIP                   = 0x39
+	IPPROTO_SPACER                 = 0x7fff
+	IPPROTO_SRPC                   = 0x5a
+	IPPROTO_ST                     = 0x7
+	IPPROTO_SVMTP                  = 0x52
+	IPPROTO_SWIPE                  = 0x35
+	IPPROTO_TCF                    = 0x57
+	IPPROTO_TCP                    = 0x6
+	IPPROTO_TLSP                   = 0x38
+	IPPROTO_TP                     = 0x1d
+	IPPROTO_TPXX                   = 0x27
+	IPPROTO_TRUNK1                 = 0x17
+	IPPROTO_TRUNK2                 = 0x18
+	IPPROTO_TTP                    = 0x54
+	IPPROTO_UDP                    = 0x11
+	IPPROTO_UDPLITE                = 0x88
+	IPPROTO_VINES                  = 0x53
+	IPPROTO_VISA                   = 0x46
+	IPPROTO_VMTP                   = 0x51
+	IPPROTO_WBEXPAK                = 0x4f
+	IPPROTO_WBMON                  = 0x4e
+	IPPROTO_WSN                    = 0x4a
+	IPPROTO_XNET                   = 0xf
+	IPPROTO_XTP                    = 0x24
+	IPV6_AUTOFLOWLABEL             = 0x3b
+	IPV6_BINDANY                   = 0x40
+	IPV6_BINDMULTI                 = 0x41
+	IPV6_BINDV6ONLY                = 0x1b
+	IPV6_CHECKSUM                  = 0x1a
+	IPV6_DEFAULT_MULTICAST_HOPS    = 0x1
+	IPV6_DEFAULT_MULTICAST_LOOP    = 0x1
+	IPV6_DEFHLIM                   = 0x40
+	IPV6_DONTFRAG                  = 0x3e
+	IPV6_DSTOPTS                   = 0x32
+	IPV6_FLOWID                    = 0x43
+	IPV6_FLOWINFO_MASK             = 0xffffff0f
+	IPV6_FLOWLABEL_LEN             = 0x14
+	IPV6_FLOWLABEL_MASK            = 0xffff0f00
+	IPV6_FLOWTYPE                  = 0x44
+	IPV6_FRAGTTL                   = 0x78
+	IPV6_FW_ADD                    = 0x1e
+	IPV6_FW_DEL                    = 0x1f
+	IPV6_FW_FLUSH                  = 0x20
+	IPV6_FW_GET                    = 0x22
+	IPV6_FW_ZERO                   = 0x21
+	IPV6_HLIMDEC                   = 0x1
+	IPV6_HOPLIMIT                  = 0x2f
+	IPV6_HOPOPTS                   = 0x31
+	IPV6_IPSEC_POLICY              = 0x1c
+	IPV6_JOIN_GROUP                = 0xc
+	IPV6_LEAVE_GROUP               = 0xd
+	IPV6_MAXHLIM                   = 0xff
+	IPV6_MAXOPTHDR                 = 0x800
+	IPV6_MAXPACKET                 = 0xffff
+	IPV6_MAX_GROUP_SRC_FILTER      = 0x200
+	IPV6_MAX_MEMBERSHIPS           = 0xfff
+	IPV6_MAX_SOCK_SRC_FILTER       = 0x80
+	IPV6_MMTU                      = 0x500
+	IPV6_MSFILTER                  = 0x4a
+	IPV6_MULTICAST_HOPS            = 0xa
+	IPV6_MULTICAST_IF              = 0x9
+	IPV6_MULTICAST_LOOP            = 0xb
+	IPV6_NEXTHOP                   = 0x30
+	IPV6_ORIGDSTADDR               = 0x48
+	IPV6_PATHMTU                   = 0x2c
+	IPV6_PKTINFO                   = 0x2e
+	IPV6_PORTRANGE                 = 0xe
+	IPV6_PORTRANGE_DEFAULT         = 0x0
+	IPV6_PORTRANGE_HIGH            = 0x1
+	IPV6_PORTRANGE_LOW             = 0x2
+	IPV6_PREFER_TEMPADDR           = 0x3f
+	IPV6_RECVDSTOPTS               = 0x28
+	IPV6_RECVFLOWID                = 0x46
+	IPV6_RECVHOPLIMIT              = 0x25
+	IPV6_RECVHOPOPTS               = 0x27
+	IPV6_RECVORIGDSTADDR           = 0x48
+	IPV6_RECVPATHMTU               = 0x2b
+	IPV6_RECVPKTINFO               = 0x24
+	IPV6_RECVRSSBUCKETID           = 0x47
+	IPV6_RECVRTHDR                 = 0x26
+	IPV6_RECVTCLASS                = 0x39
+	IPV6_RSSBUCKETID               = 0x45
+	IPV6_RSS_LISTEN_BUCKET         = 0x42
+	IPV6_RTHDR                     = 0x33
+	IPV6_RTHDRDSTOPTS              = 0x23
+	IPV6_RTHDR_LOOSE               = 0x0
+	IPV6_RTHDR_STRICT              = 0x1
+	IPV6_RTHDR_TYPE_0              = 0x0
+	IPV6_SOCKOPT_RESERVED1         = 0x3
+	IPV6_TCLASS                    = 0x3d
+	IPV6_UNICAST_HOPS              = 0x4
+	IPV6_USE_MIN_MTU               = 0x2a
+	IPV6_V6ONLY                    = 0x1b
+	IPV6_VERSION                   = 0x60
+	IPV6_VERSION_MASK              = 0xf0
+	IPV6_VLAN_PCP                  = 0x4b
+	IP_ADD_MEMBERSHIP              = 0xc
+	IP_ADD_SOURCE_MEMBERSHIP       = 0x46
+	IP_BINDANY                     = 0x18
+	IP_BINDMULTI                   = 0x19
+	IP_BLOCK_SOURCE                = 0x48
+	IP_DEFAULT_MULTICAST_LOOP      = 0x1
+	IP_DEFAULT_MULTICAST_TTL       = 0x1
+	IP_DF                          = 0x4000
+	IP_DONTFRAG                    = 0x43
+	IP_DROP_MEMBERSHIP             = 0xd
+	IP_DROP_SOURCE_MEMBERSHIP      = 0x47
+	IP_DUMMYNET3                   = 0x31
+	IP_DUMMYNET_CONFIGURE          = 0x3c
+	IP_DUMMYNET_DEL                = 0x3d
+	IP_DUMMYNET_FLUSH              = 0x3e
+	IP_DUMMYNET_GET                = 0x40
+	IP_FLOWID                      = 0x5a
+	IP_FLOWTYPE                    = 0x5b
+	IP_FW3                         = 0x30
+	IP_FW_ADD                      = 0x32
+	IP_FW_DEL                      = 0x33
+	IP_FW_FLUSH                    = 0x34
+	IP_FW_GET                      = 0x36
+	IP_FW_NAT_CFG                  = 0x38
+	IP_FW_NAT_DEL                  = 0x39
+	IP_FW_NAT_GET_CONFIG           = 0x3a
+	IP_FW_NAT_GET_LOG              = 0x3b
+	IP_FW_RESETLOG                 = 0x37
+	IP_FW_TABLE_ADD                = 0x28
+	IP_FW_TABLE_DEL                = 0x29
+	IP_FW_TABLE_FLUSH              = 0x2a
+	IP_FW_TABLE_GETSIZE            = 0x2b
+	IP_FW_TABLE_LIST               = 0x2c
+	IP_FW_ZERO                     = 0x35
+	IP_HDRINCL                     = 0x2
+	IP_IPSEC_POLICY                = 0x15
+	IP_MAXPACKET                   = 0xffff
+	IP_MAX_GROUP_SRC_FILTER        = 0x200
+	IP_MAX_MEMBERSHIPS             = 0xfff
+	IP_MAX_SOCK_MUTE_FILTER        = 0x80
+	IP_MAX_SOCK_SRC_FILTER         = 0x80
+	IP_MF                          = 0x2000
+	IP_MINTTL                      = 0x42
+	IP_MSFILTER                    = 0x4a
+	IP_MSS                         = 0x240
+	IP_MULTICAST_IF                = 0x9
+	IP_MULTICAST_LOOP              = 0xb
+	IP_MULTICAST_TTL               = 0xa
+	IP_MULTICAST_VIF               = 0xe
+	IP_OFFMASK                     = 0x1fff
+	IP_ONESBCAST                   = 0x17
+	IP_OPTIONS                     = 0x1
+	IP_ORIGDSTADDR                 = 0x1b
+	IP_PORTRANGE                   = 0x13
+	IP_PORTRANGE_DEFAULT           = 0x0
+	IP_PORTRANGE_HIGH              = 0x1
+	IP_PORTRANGE_LOW               = 0x2
+	IP_RECVDSTADDR                 = 0x7
+	IP_RECVFLOWID                  = 0x5d
+	IP_RECVIF                      = 0x14
+	IP_RECVOPTS                    = 0x5
+	IP_RECVORIGDSTADDR             = 0x1b
+	IP_RECVRETOPTS                 = 0x6
+	IP_RECVRSSBUCKETID             = 0x5e
+	IP_RECVTOS                     = 0x44
+	IP_RECVTTL                     = 0x41
+	IP_RETOPTS                     = 0x8
+	IP_RF                          = 0x8000
+	IP_RSSBUCKETID                 = 0x5c
+	IP_RSS_LISTEN_BUCKET           = 0x1a
+	IP_RSVP_OFF                    = 0x10
+	IP_RSVP_ON                     = 0xf
+	IP_RSVP_VIF_OFF                = 0x12
+	IP_RSVP_VIF_ON                 = 0x11
+	IP_SENDSRCADDR                 = 0x7
+	IP_TOS                         = 0x3
+	IP_TTL                         = 0x4
+	IP_UNBLOCK_SOURCE              = 0x49
+	IP_VLAN_PCP                    = 0x4b
+	ISIG                           = 0x80
+	ISTRIP                         = 0x20
+	ITIMER_PROF                    = 0x2
+	ITIMER_REAL                    = 0x0
+	ITIMER_VIRTUAL                 = 0x1
+	IXANY                          = 0x800
+	IXOFF                          = 0x400
+	IXON                           = 0x200
+	KERN_HOSTNAME                  = 0xa
+	KERN_OSRELEASE                 = 0x2
+	KERN_OSTYPE                    = 0x1
+	KERN_VERSION                   = 0x4
+	LOCAL_CONNWAIT                 = 0x4
+	LOCAL_CREDS                    = 0x2
+	LOCAL_CREDS_PERSISTENT         = 0x3
+	LOCAL_PEERCRED                 = 0x1
+	LOCAL_VENDOR                   = 0x80000000
+	LOCK_EX                        = 0x2
+	LOCK_NB                        = 0x4
+	LOCK_SH                        = 0x1
+	LOCK_UN                        = 0x8
+	MADV_AUTOSYNC                  = 0x7
+	MADV_CORE                      = 0x9
+	MADV_DONTNEED                  = 0x4
+	MADV_FREE                      = 0x5
+	MADV_NOCORE                    = 0x8
+	MADV_NORMAL                    = 0x0
+	MADV_NOSYNC                    = 0x6
+	MADV_PROTECT                   = 0xa
+	MADV_RANDOM                    = 0x1
+	MADV_SEQUENTIAL                = 0x2
+	MADV_WILLNEED                  = 0x3
+	MAP_32BIT                      = 0x80000
+	MAP_ALIGNED_SUPER              = 0x1000000
+	MAP_ALIGNMENT_MASK             = -0x1000000
+	MAP_ALIGNMENT_SHIFT            = 0x18
+	MAP_ANON                       = 0x1000
+	MAP_ANONYMOUS                  = 0x1000
+	MAP_COPY                       = 0x2
+	MAP_EXCL                       = 0x4000
+	MAP_FILE                       = 0x0
+	MAP_FIXED                      = 0x10
+	MAP_GUARD                      = 0x2000
+	MAP_HASSEMAPHORE               = 0x200
+	MAP_NOCORE                     = 0x20000
+	MAP_NOSYNC                     = 0x800
+	MAP_PREFAULT_READ              = 0x40000
+	MAP_PRIVATE                    = 0x2
+	MAP_RESERVED0020               = 0x20
+	MAP_RESERVED0040               = 0x40
+	MAP_RESERVED0080               = 0x80
+	MAP_RESERVED0100               = 0x100
+	MAP_SHARED                     = 0x1
+	MAP_STACK                      = 0x400
+	MCAST_BLOCK_SOURCE             = 0x54
+	MCAST_EXCLUDE                  = 0x2
+	MCAST_INCLUDE                  = 0x1
+	MCAST_JOIN_GROUP               = 0x50
+	MCAST_JOIN_SOURCE_GROUP        = 0x52
+	MCAST_LEAVE_GROUP              = 0x51
+	MCAST_LEAVE_SOURCE_GROUP       = 0x53
+	MCAST_UNBLOCK_SOURCE           = 0x55
+	MCAST_UNDEFINED                = 0x0
+	MCL_CURRENT                    = 0x1
+	MCL_FUTURE                     = 0x2
+	MFD_ALLOW_SEALING              = 0x2
+	MFD_CLOEXEC                    = 0x1
+	MFD_HUGETLB                    = 0x4
+	MFD_HUGE_16GB                  = -0x78000000
+	MFD_HUGE_16MB                  = 0x60000000
+	MFD_HUGE_1GB                   = 0x78000000
+	MFD_HUGE_1MB                   = 0x50000000
+	MFD_HUGE_256MB                 = 0x70000000
+	MFD_HUGE_2GB                   = 0x7c000000
+	MFD_HUGE_2MB                   = 0x54000000
+	MFD_HUGE_32MB                  = 0x64000000
+	MFD_HUGE_512KB                 = 0x4c000000
+	MFD_HUGE_512MB                 = 0x74000000
+	MFD_HUGE_64KB                  = 0x40000000
+	MFD_HUGE_8MB                   = 0x5c000000
+	MFD_HUGE_MASK                  = 0xfc000000
+	MFD_HUGE_SHIFT                 = 0x1a
+	MNT_ACLS                       = 0x8000000
+	MNT_ASYNC                      = 0x40
+	MNT_AUTOMOUNTED                = 0x200000000
+	MNT_BYFSID                     = 0x8000000
+	MNT_CMDFLAGS                   = 0x300d0f0000
+	MNT_DEFEXPORTED                = 0x200
+	MNT_DELEXPORT                  = 0x20000
+	MNT_EMPTYDIR                   = 0x2000000000
+	MNT_EXKERB                     = 0x800
+	MNT_EXPORTANON                 = 0x400
+	MNT_EXPORTED                   = 0x100
+	MNT_EXPUBLIC                   = 0x20000000
+	MNT_EXRDONLY                   = 0x80
+	MNT_EXTLS                      = 0x4000000000
+	MNT_EXTLSCERT                  = 0x8000000000
+	MNT_EXTLSCERTUSER              = 0x10000000000
+	MNT_FORCE                      = 0x80000
+	MNT_GJOURNAL                   = 0x2000000
+	MNT_IGNORE                     = 0x800000
+	MNT_LAZY                       = 0x3
+	MNT_LOCAL                      = 0x1000
+	MNT_MULTILABEL                 = 0x4000000
+	MNT_NFS4ACLS                   = 0x10
+	MNT_NOATIME                    = 0x10000000
+	MNT_NOCLUSTERR                 = 0x40000000
+	MNT_NOCLUSTERW                 = 0x80000000
+	MNT_NOCOVER                    = 0x1000000000
+	MNT_NOEXEC                     = 0x4
+	MNT_NONBUSY                    = 0x4000000
+	MNT_NOSUID                     = 0x8
+	MNT_NOSYMFOLLOW                = 0x400000
+	MNT_NOWAIT                     = 0x2
+	MNT_QUOTA                      = 0x2000
+	MNT_RDONLY                     = 0x1
+	MNT_RELOAD                     = 0x40000
+	MNT_ROOTFS                     = 0x4000
+	MNT_SNAPSHOT                   = 0x1000000
+	MNT_SOFTDEP                    = 0x200000
+	MNT_SUIDDIR                    = 0x100000
+	MNT_SUJ                        = 0x100000000
+	MNT_SUSPEND                    = 0x4
+	MNT_SYNCHRONOUS                = 0x2
+	MNT_UNION                      = 0x20
+	MNT_UNTRUSTED                  = 0x800000000
+	MNT_UPDATE                     = 0x10000
+	MNT_UPDATEMASK                 = 0xad8d0807e
+	MNT_USER                       = 0x8000
+	MNT_VERIFIED                   = 0x400000000
+	MNT_VISFLAGMASK                = 0xffef0ffff
+	MNT_WAIT                       = 0x1
+	MSG_CMSG_CLOEXEC               = 0x40000
+	MSG_COMPAT                     = 0x8000
+	MSG_CTRUNC                     = 0x20
+	MSG_DONTROUTE                  = 0x4
+	MSG_DONTWAIT                   = 0x80
+	MSG_EOF                        = 0x100
+	MSG_EOR                        = 0x8
+	MSG_NBIO                       = 0x4000
+	MSG_NOSIGNAL                   = 0x20000
+	MSG_NOTIFICATION               = 0x2000
+	MSG_OOB                        = 0x1
+	MSG_PEEK                       = 0x2
+	MSG_TRUNC                      = 0x10
+	MSG_WAITALL                    = 0x40
+	MSG_WAITFORONE                 = 0x80000
+	MS_ASYNC                       = 0x1
+	MS_INVALIDATE                  = 0x2
+	MS_SYNC                        = 0x0
+	NAME_MAX                       = 0xff
+	NET_RT_DUMP                    = 0x1
+	NET_RT_FLAGS                   = 0x2
+	NET_RT_IFLIST                  = 0x3
+	NET_RT_IFLISTL                 = 0x5
+	NET_RT_IFMALIST                = 0x4
+	NET_RT_NHGRP                   = 0x7
+	NET_RT_NHOP                    = 0x6
+	NFDBITS                        = 0x40
+	NOFLSH                         = 0x80000000
+	NOKERNINFO                     = 0x2000000
+	NOTE_ABSTIME                   = 0x10
+	NOTE_ATTRIB                    = 0x8
+	NOTE_CHILD                     = 0x4
+	NOTE_CLOSE                     = 0x100
+	NOTE_CLOSE_WRITE               = 0x200
+	NOTE_DELETE                    = 0x1
+	NOTE_EXEC                      = 0x20000000
+	NOTE_EXIT                      = 0x80000000
+	NOTE_EXTEND                    = 0x4
+	NOTE_FFAND                     = 0x40000000
+	NOTE_FFCOPY                    = 0xc0000000
+	NOTE_FFCTRLMASK                = 0xc0000000
+	NOTE_FFLAGSMASK                = 0xffffff
+	NOTE_FFNOP                     = 0x0
+	NOTE_FFOR                      = 0x80000000
+	NOTE_FILE_POLL                 = 0x2
+	NOTE_FORK                      = 0x40000000
+	NOTE_LINK                      = 0x10
+	NOTE_LOWAT                     = 0x1
+	NOTE_MSECONDS                  = 0x2
+	NOTE_NSECONDS                  = 0x8
+	NOTE_OPEN                      = 0x80
+	NOTE_PCTRLMASK                 = 0xf0000000
+	NOTE_PDATAMASK                 = 0xfffff
+	NOTE_READ                      = 0x400
+	NOTE_RENAME                    = 0x20
+	NOTE_REVOKE                    = 0x40
+	NOTE_SECONDS                   = 0x1
+	NOTE_TRACK                     = 0x1
+	NOTE_TRACKERR                  = 0x2
+	NOTE_TRIGGER                   = 0x1000000
+	NOTE_USECONDS                  = 0x4
+	NOTE_WRITE                     = 0x2
+	OCRNL                          = 0x10
+	ONLCR                          = 0x2
+	ONLRET                         = 0x40
+	ONOCR                          = 0x20
+	ONOEOT                         = 0x8
+	OPOST                          = 0x1
+	OXTABS                         = 0x4
+	O_ACCMODE                      = 0x3
+	O_APPEND                       = 0x8
+	O_ASYNC                        = 0x40
+	O_CLOEXEC                      = 0x100000
+	O_CREAT                        = 0x200
+	O_DIRECT                       = 0x10000
+	O_DIRECTORY                    = 0x20000
+	O_DSYNC                        = 0x1000000
+	O_EMPTY_PATH                   = 0x2000000
+	O_EXCL                         = 0x800
+	O_EXEC                         = 0x40000
+	O_EXLOCK                       = 0x20
+	O_FSYNC                        = 0x80
+	O_NDELAY                       = 0x4
+	O_NOCTTY                       = 0x8000
+	O_NOFOLLOW                     = 0x100
+	O_NONBLOCK                     = 0x4
+	O_PATH                         = 0x400000
+	O_RDONLY                       = 0x0
+	O_RDWR                         = 0x2
+	O_RESOLVE_BENEATH              = 0x800000
+	O_SEARCH                       = 0x40000
+	O_SHLOCK                       = 0x10
+	O_SYNC                         = 0x80
+	O_TRUNC                        = 0x400
+	O_TTY_INIT                     = 0x80000
+	O_VERIFY                       = 0x200000
+	O_WRONLY                       = 0x1
+	PARENB                         = 0x1000
+	PARMRK                         = 0x8
+	PARODD                         = 0x2000
+	PENDIN                         = 0x20000000
+	PIOD_READ_D                    = 0x1
+	PIOD_READ_I                    = 0x3
+	PIOD_WRITE_D                   = 0x2
+	PIOD_WRITE_I                   = 0x4
+	PRIO_PGRP                      = 0x1
+	PRIO_PROCESS                   = 0x0
+	PRIO_USER                      = 0x2
+	PROT_EXEC                      = 0x4
+	PROT_NONE                      = 0x0
+	PROT_READ                      = 0x1
+	PROT_WRITE                     = 0x2
+	PTRACE_DEFAULT                 = 0x1
+	PTRACE_EXEC                    = 0x1
+	PTRACE_FORK                    = 0x8
+	PTRACE_LWP                     = 0x10
+	PTRACE_SCE                     = 0x2
+	PTRACE_SCX                     = 0x4
+	PTRACE_SYSCALL                 = 0x6
+	PTRACE_VFORK                   = 0x20
+	PT_ATTACH                      = 0xa
+	PT_CLEARSTEP                   = 0x10
+	PT_CONTINUE                    = 0x7
+	PT_COREDUMP                    = 0x1d
+	PT_DETACH                      = 0xb
+	PT_FIRSTMACH                   = 0x40
+	PT_FOLLOW_FORK                 = 0x17
+	PT_GETDBREGS                   = 0x25
+	PT_GETFPREGS                   = 0x23
+	PT_GETLWPLIST                  = 0xf
+	PT_GETNUMLWPS                  = 0xe
+	PT_GETREGS                     = 0x21
+	PT_GET_EVENT_MASK              = 0x19
+	PT_GET_SC_ARGS                 = 0x1b
+	PT_GET_SC_RET                  = 0x1c
+	PT_IO                          = 0xc
+	PT_KILL                        = 0x8
+	PT_LWPINFO                     = 0xd
+	PT_LWP_EVENTS                  = 0x18
+	PT_READ_D                      = 0x2
+	PT_READ_I                      = 0x1
+	PT_RESUME                      = 0x13
+	PT_SETDBREGS                   = 0x26
+	PT_SETFPREGS                   = 0x24
+	PT_SETREGS                     = 0x22
+	PT_SETSTEP                     = 0x11
+	PT_SET_EVENT_MASK              = 0x1a
+	PT_STEP                        = 0x9
+	PT_SUSPEND                     = 0x12
+	PT_SYSCALL                     = 0x16
+	PT_TO_SCE                      = 0x14
+	PT_TO_SCX                      = 0x15
+	PT_TRACE_ME                    = 0x0
+	PT_VM_ENTRY                    = 0x29
+	PT_VM_TIMESTAMP                = 0x28
+	PT_WRITE_D                     = 0x5
+	PT_WRITE_I                     = 0x4
+	P_ZONEID                       = 0xc
+	RLIMIT_AS                      = 0xa
+	RLIMIT_CORE                    = 0x4
+	RLIMIT_CPU                     = 0x0
+	RLIMIT_DATA                    = 0x2
+	RLIMIT_FSIZE                   = 0x1
+	RLIMIT_MEMLOCK                 = 0x6
+	RLIMIT_NOFILE                  = 0x8
+	RLIMIT_NPROC                   = 0x7
+	RLIMIT_RSS                     = 0x5
+	RLIMIT_STACK                   = 0x3
+	RLIM_INFINITY                  = 0x7fffffffffffffff
+	RTAX_AUTHOR                    = 0x6
+	RTAX_BRD                       = 0x7
+	RTAX_DST                       = 0x0
+	RTAX_GATEWAY                   = 0x1
+	RTAX_GENMASK                   = 0x3
+	RTAX_IFA                       = 0x5
+	RTAX_IFP                       = 0x4
+	RTAX_MAX                       = 0x8
+	RTAX_NETMASK                   = 0x2
+	RTA_AUTHOR                     = 0x40
+	RTA_BRD                        = 0x80
+	RTA_DST                        = 0x1
+	RTA_GATEWAY                    = 0x2
+	RTA_GENMASK                    = 0x8
+	RTA_IFA                        = 0x20
+	RTA_IFP                        = 0x10
+	RTA_NETMASK                    = 0x4
+	RTF_BLACKHOLE                  = 0x1000
+	RTF_BROADCAST                  = 0x400000
+	RTF_DONE                       = 0x40
+	RTF_DYNAMIC                    = 0x10
+	RTF_FIXEDMTU                   = 0x80000
+	RTF_FMASK                      = 0x1004d808
+	RTF_GATEWAY                    = 0x2
+	RTF_GWFLAG_COMPAT              = 0x80000000
+	RTF_HOST                       = 0x4
+	RTF_LLDATA                     = 0x400
+	RTF_LLINFO                     = 0x400
+	RTF_LOCAL                      = 0x200000
+	RTF_MODIFIED                   = 0x20
+	RTF_MULTICAST                  = 0x800000
+	RTF_PINNED                     = 0x100000
+	RTF_PROTO1                     = 0x8000
+	RTF_PROTO2                     = 0x4000
+	RTF_PROTO3                     = 0x40000
+	RTF_REJECT                     = 0x8
+	RTF_STATIC                     = 0x800
+	RTF_STICKY                     = 0x10000000
+	RTF_UP                         = 0x1
+	RTF_XRESOLVE                   = 0x200
+	RTM_ADD                        = 0x1
+	RTM_CHANGE                     = 0x3
+	RTM_DELADDR                    = 0xd
+	RTM_DELETE                     = 0x2
+	RTM_DELMADDR                   = 0x10
+	RTM_GET                        = 0x4
+	RTM_IEEE80211                  = 0x12
+	RTM_IFANNOUNCE                 = 0x11
+	RTM_IFINFO                     = 0xe
+	RTM_LOCK                       = 0x8
+	RTM_LOSING                     = 0x5
+	RTM_MISS                       = 0x7
+	RTM_NEWADDR                    = 0xc
+	RTM_NEWMADDR                   = 0xf
+	RTM_REDIRECT                   = 0x6
+	RTM_RESOLVE                    = 0xb
+	RTM_RTTUNIT                    = 0xf4240
+	RTM_VERSION                    = 0x5
+	RTV_EXPIRE                     = 0x4
+	RTV_HOPCOUNT                   = 0x2
+	RTV_MTU                        = 0x1
+	RTV_RPIPE                      = 0x8
+	RTV_RTT                        = 0x40
+	RTV_RTTVAR                     = 0x80
+	RTV_SPIPE                      = 0x10
+	RTV_SSTHRESH                   = 0x20
+	RTV_WEIGHT                     = 0x100
+	RT_ALL_FIBS                    = -0x1
+	RT_BLACKHOLE                   = 0x40
+	RT_DEFAULT_FIB                 = 0x0
+	RT_DEFAULT_WEIGHT              = 0x1
+	RT_HAS_GW                      = 0x80
+	RT_HAS_HEADER                  = 0x10
+	RT_HAS_HEADER_BIT              = 0x4
+	RT_L2_ME                       = 0x4
+	RT_L2_ME_BIT                   = 0x2
+	RT_LLE_CACHE                   = 0x100
+	RT_MAX_WEIGHT                  = 0xffffff
+	RT_MAY_LOOP                    = 0x8
+	RT_MAY_LOOP_BIT                = 0x3
+	RT_REJECT                      = 0x20
+	RUSAGE_CHILDREN                = -0x1
+	RUSAGE_SELF                    = 0x0
+	RUSAGE_THREAD                  = 0x1
+	SCM_BINTIME                    = 0x4
+	SCM_CREDS                      = 0x3
+	SCM_CREDS2                     = 0x8
+	SCM_MONOTONIC                  = 0x6
+	SCM_REALTIME                   = 0x5
+	SCM_RIGHTS                     = 0x1
+	SCM_TIMESTAMP                  = 0x2
+	SCM_TIME_INFO                  = 0x7
+	SEEK_CUR                       = 0x1
+	SEEK_DATA                      = 0x3
+	SEEK_END                       = 0x2
+	SEEK_HOLE                      = 0x4
+	SEEK_SET                       = 0x0
+	SHUT_RD                        = 0x0
+	SHUT_RDWR                      = 0x2
+	SHUT_WR                        = 0x1
+	SIOCADDMULTI                   = 0x80206931
+	SIOCAIFADDR                    = 0x8040691a
+	SIOCAIFGROUP                   = 0x80286987
+	SIOCATMARK                     = 0x40047307
+	SIOCDELMULTI                   = 0x80206932
+	SIOCDIFADDR                    = 0x80206919
+	SIOCDIFGROUP                   = 0x80286989
+	SIOCDIFPHYADDR                 = 0x80206949
+	SIOCGDRVSPEC                   = 0xc028697b
+	SIOCGETSGCNT                   = 0xc0207210
+	SIOCGETVIFCNT                  = 0xc028720f
+	SIOCGHIWAT                     = 0x40047301
+	SIOCGHWADDR                    = 0xc020693e
+	SIOCGI2C                       = 0xc020693d
+	SIOCGIFADDR                    = 0xc0206921
+	SIOCGIFALIAS                   = 0xc044692d
+	SIOCGIFBRDADDR                 = 0xc0206923
+	SIOCGIFCAP                     = 0xc020691f
+	SIOCGIFCONF                    = 0xc0106924
+	SIOCGIFDATA                    = 0x8020692c
+	SIOCGIFDESCR                   = 0xc020692a
+	SIOCGIFDOWNREASON              = 0xc058699a
+	SIOCGIFDSTADDR                 = 0xc0206922
+	SIOCGIFFIB                     = 0xc020695c
+	SIOCGIFFLAGS                   = 0xc0206911
+	SIOCGIFGENERIC                 = 0xc020693a
+	SIOCGIFGMEMB                   = 0xc028698a
+	SIOCGIFGROUP                   = 0xc0286988
+	SIOCGIFINDEX                   = 0xc0206920
+	SIOCGIFMAC                     = 0xc0206926
+	SIOCGIFMEDIA                   = 0xc0306938
+	SIOCGIFMETRIC                  = 0xc0206917
+	SIOCGIFMTU                     = 0xc0206933
+	SIOCGIFNETMASK                 = 0xc0206925
+	SIOCGIFPDSTADDR                = 0xc0206948
+	SIOCGIFPHYS                    = 0xc0206935
+	SIOCGIFPSRCADDR                = 0xc0206947
+	SIOCGIFRSSHASH                 = 0xc0186997
+	SIOCGIFRSSKEY                  = 0xc0946996
+	SIOCGIFSTATUS                  = 0xc331693b
+	SIOCGIFXMEDIA                  = 0xc030698b
+	SIOCGLANPCP                    = 0xc0206998
+	SIOCGLOWAT                     = 0x40047303
+	SIOCGPGRP                      = 0x40047309
+	SIOCGPRIVATE_0                 = 0xc0206950
+	SIOCGPRIVATE_1                 = 0xc0206951
+	SIOCGTUNFIB                    = 0xc020695e
+	SIOCIFCREATE                   = 0xc020697a
+	SIOCIFCREATE2                  = 0xc020697c
+	SIOCIFDESTROY                  = 0x80206979
+	SIOCIFGCLONERS                 = 0xc0106978
+	SIOCSDRVSPEC                   = 0x8028697b
+	SIOCSHIWAT                     = 0x80047300
+	SIOCSIFADDR                    = 0x8020690c
+	SIOCSIFBRDADDR                 = 0x80206913
+	SIOCSIFCAP                     = 0x8020691e
+	SIOCSIFDESCR                   = 0x80206929
+	SIOCSIFDSTADDR                 = 0x8020690e
+	SIOCSIFFIB                     = 0x8020695d
+	SIOCSIFFLAGS                   = 0x80206910
+	SIOCSIFGENERIC                 = 0x80206939
+	SIOCSIFLLADDR                  = 0x8020693c
+	SIOCSIFMAC                     = 0x80206927
+	SIOCSIFMEDIA                   = 0xc0206937
+	SIOCSIFMETRIC                  = 0x80206918
+	SIOCSIFMTU                     = 0x80206934
+	SIOCSIFNAME                    = 0x80206928
+	SIOCSIFNETMASK                 = 0x80206916
+	SIOCSIFPHYADDR                 = 0x80406946
+	SIOCSIFPHYS                    = 0x80206936
+	SIOCSIFRVNET                   = 0xc020695b
+	SIOCSIFVNET                    = 0xc020695a
+	SIOCSLANPCP                    = 0x80206999
+	SIOCSLOWAT                     = 0x80047302
+	SIOCSPGRP                      = 0x80047308
+	SIOCSTUNFIB                    = 0x8020695f
+	SOCK_CLOEXEC                   = 0x10000000
+	SOCK_DGRAM                     = 0x2
+	SOCK_MAXADDRLEN                = 0xff
+	SOCK_NONBLOCK                  = 0x20000000
+	SOCK_RAW                       = 0x3
+	SOCK_RDM                       = 0x4
+	SOCK_SEQPACKET                 = 0x5
+	SOCK_STREAM                    = 0x1
+	SOL_LOCAL                      = 0x0
+	SOL_SOCKET                     = 0xffff
+	SOMAXCONN                      = 0x80
+	SO_ACCEPTCONN                  = 0x2
+	SO_ACCEPTFILTER                = 0x1000
+	SO_BINTIME                     = 0x2000
+	SO_BROADCAST                   = 0x20
+	SO_DEBUG                       = 0x1
+	SO_DOMAIN                      = 0x1019
+	SO_DONTROUTE                   = 0x10
+	SO_ERROR                       = 0x1007
+	SO_KEEPALIVE                   = 0x8
+	SO_LABEL                       = 0x1009
+	SO_LINGER                      = 0x80
+	SO_LISTENINCQLEN               = 0x1013
+	SO_LISTENQLEN                  = 0x1012
+	SO_LISTENQLIMIT                = 0x1011
+	SO_MAX_PACING_RATE             = 0x1018
+	SO_NOSIGPIPE                   = 0x800
+	SO_NO_DDP                      = 0x8000
+	SO_NO_OFFLOAD                  = 0x4000
+	SO_OOBINLINE                   = 0x100
+	SO_PEERLABEL                   = 0x1010
+	SO_PROTOCOL                    = 0x1016
+	SO_PROTOTYPE                   = 0x1016
+	SO_RCVBUF                      = 0x1002
+	SO_RCVLOWAT                    = 0x1004
+	SO_RCVTIMEO                    = 0x1006
+	SO_RERROR                      = 0x20000
+	SO_REUSEADDR                   = 0x4
+	SO_REUSEPORT                   = 0x200
+	SO_REUSEPORT_LB                = 0x10000
+	SO_SETFIB                      = 0x1014
+	SO_SNDBUF                      = 0x1001
+	SO_SNDLOWAT                    = 0x1003
+	SO_SNDTIMEO                    = 0x1005
+	SO_TIMESTAMP                   = 0x400
+	SO_TS_BINTIME                  = 0x1
+	SO_TS_CLOCK                    = 0x1017
+	SO_TS_CLOCK_MAX                = 0x3
+	SO_TS_DEFAULT                  = 0x0
+	SO_TS_MONOTONIC                = 0x3
+	SO_TS_REALTIME                 = 0x2
+	SO_TS_REALTIME_MICRO           = 0x0
+	SO_TYPE                        = 0x1008
+	SO_USELOOPBACK                 = 0x40
+	SO_USER_COOKIE                 = 0x1015
+	SO_VENDOR                      = 0x80000000
+	S_BLKSIZE                      = 0x200
+	S_IEXEC                        = 0x40
+	S_IFBLK                        = 0x6000
+	S_IFCHR                        = 0x2000
+	S_IFDIR                        = 0x4000
+	S_IFIFO                        = 0x1000
+	S_IFLNK                        = 0xa000
+	S_IFMT                         = 0xf000
+	S_IFREG                        = 0x8000
+	S_IFSOCK                       = 0xc000
+	S_IFWHT                        = 0xe000
+	S_IREAD                        = 0x100
+	S_IRGRP                        = 0x20
+	S_IROTH                        = 0x4
+	S_IRUSR                        = 0x100
+	S_IRWXG                        = 0x38
+	S_IRWXO                        = 0x7
+	S_IRWXU                        = 0x1c0
+	S_ISGID                        = 0x400
+	S_ISTXT                        = 0x200
+	S_ISUID                        = 0x800
+	S_ISVTX                        = 0x200
+	S_IWGRP                        = 0x10
+	S_IWOTH                        = 0x2
+	S_IWRITE                       = 0x80
+	S_IWUSR                        = 0x80
+	S_IXGRP                        = 0x8
+	S_IXOTH                        = 0x1
+	S_IXUSR                        = 0x40
+	TAB0                           = 0x0
+	TAB3                           = 0x4
+	TABDLY                         = 0x4
+	TCIFLUSH                       = 0x1
+	TCIOFF                         = 0x3
+	TCIOFLUSH                      = 0x3
+	TCION                          = 0x4
+	TCOFLUSH                       = 0x2
+	TCOOFF                         = 0x1
+	TCOON                          = 0x2
+	TCPOPT_EOL                     = 0x0
+	TCPOPT_FAST_OPEN               = 0x22
+	TCPOPT_MAXSEG                  = 0x2
+	TCPOPT_NOP                     = 0x1
+	TCPOPT_PAD                     = 0x0
+	TCPOPT_SACK                    = 0x5
+	TCPOPT_SACK_PERMITTED          = 0x4
+	TCPOPT_SIGNATURE               = 0x13
+	TCPOPT_TIMESTAMP               = 0x8
+	TCPOPT_WINDOW                  = 0x3
+	TCP_BBR_ACK_COMP_ALG           = 0x448
+	TCP_BBR_ALGORITHM              = 0x43b
+	TCP_BBR_DRAIN_INC_EXTRA        = 0x43c
+	TCP_BBR_DRAIN_PG               = 0x42e
+	TCP_BBR_EXTRA_GAIN             = 0x449
+	TCP_BBR_EXTRA_STATE            = 0x453
+	TCP_BBR_FLOOR_MIN_TSO          = 0x454
+	TCP_BBR_HDWR_PACE              = 0x451
+	TCP_BBR_HOLD_TARGET            = 0x436
+	TCP_BBR_IWINTSO                = 0x42b
+	TCP_BBR_LOWGAIN_FD             = 0x436
+	TCP_BBR_LOWGAIN_HALF           = 0x435
+	TCP_BBR_LOWGAIN_THRESH         = 0x434
+	TCP_BBR_MAX_RTO                = 0x439
+	TCP_BBR_MIN_RTO                = 0x438
+	TCP_BBR_MIN_TOPACEOUT          = 0x455
+	TCP_BBR_ONE_RETRAN             = 0x431
+	TCP_BBR_PACE_CROSS             = 0x442
+	TCP_BBR_PACE_DEL_TAR           = 0x43f
+	TCP_BBR_PACE_OH                = 0x435
+	TCP_BBR_PACE_PER_SEC           = 0x43e
+	TCP_BBR_PACE_SEG_MAX           = 0x440
+	TCP_BBR_PACE_SEG_MIN           = 0x441
+	TCP_BBR_POLICER_DETECT         = 0x457
+	TCP_BBR_PROBE_RTT_GAIN         = 0x44d
+	TCP_BBR_PROBE_RTT_INT          = 0x430
+	TCP_BBR_PROBE_RTT_LEN          = 0x44e
+	TCP_BBR_RACK_INIT_RATE         = 0x458
+	TCP_BBR_RACK_RTT_USE           = 0x44a
+	TCP_BBR_RECFORCE               = 0x42c
+	TCP_BBR_REC_OVER_HPTS          = 0x43a
+	TCP_BBR_RETRAN_WTSO            = 0x44b
+	TCP_BBR_RWND_IS_APP            = 0x42f
+	TCP_BBR_SEND_IWND_IN_TSO       = 0x44f
+	TCP_BBR_STARTUP_EXIT_EPOCH     = 0x43d
+	TCP_BBR_STARTUP_LOSS_EXIT      = 0x432
+	TCP_BBR_STARTUP_PG             = 0x42d
+	TCP_BBR_TMR_PACE_OH            = 0x448
+	TCP_BBR_TSLIMITS               = 0x434
+	TCP_BBR_TSTMP_RAISES           = 0x456
+	TCP_BBR_UNLIMITED              = 0x43b
+	TCP_BBR_USEDEL_RATE            = 0x437
+	TCP_BBR_USE_LOWGAIN            = 0x433
+	TCP_BBR_USE_RACK_CHEAT         = 0x450
+	TCP_BBR_USE_RACK_RR            = 0x450
+	TCP_BBR_UTTER_MAX_TSO          = 0x452
+	TCP_CA_NAME_MAX                = 0x10
+	TCP_CCALGOOPT                  = 0x41
+	TCP_CONGESTION                 = 0x40
+	TCP_DATA_AFTER_CLOSE           = 0x44c
+	TCP_DEFER_OPTIONS              = 0x470
+	TCP_DELACK                     = 0x48
+	TCP_FASTOPEN                   = 0x401
+	TCP_FASTOPEN_MAX_COOKIE_LEN    = 0x10
+	TCP_FASTOPEN_MIN_COOKIE_LEN    = 0x4
+	TCP_FASTOPEN_PSK_LEN           = 0x10
+	TCP_FAST_RSM_HACK              = 0x471
+	TCP_FIN_IS_RST                 = 0x49
+	TCP_FUNCTION_BLK               = 0x2000
+	TCP_FUNCTION_NAME_LEN_MAX      = 0x20
+	TCP_HDWR_RATE_CAP              = 0x46a
+	TCP_HDWR_UP_ONLY               = 0x46c
+	TCP_IDLE_REDUCE                = 0x46
+	TCP_INFO                       = 0x20
+	TCP_IWND_NB                    = 0x2b
+	TCP_IWND_NSEG                  = 0x2c
+	TCP_KEEPCNT                    = 0x400
+	TCP_KEEPIDLE                   = 0x100
+	TCP_KEEPINIT                   = 0x80
+	TCP_KEEPINTVL                  = 0x200
+	TCP_LOG                        = 0x22
+	TCP_LOGBUF                     = 0x23
+	TCP_LOGDUMP                    = 0x25
+	TCP_LOGDUMPID                  = 0x26
+	TCP_LOGID                      = 0x24
+	TCP_LOGID_CNT                  = 0x2e
+	TCP_LOG_ID_LEN                 = 0x40
+	TCP_LOG_LIMIT                  = 0x4a
+	TCP_LOG_TAG                    = 0x2f
+	TCP_MAXBURST                   = 0x4
+	TCP_MAXHLEN                    = 0x3c
+	TCP_MAXOLEN                    = 0x28
+	TCP_MAXPEAKRATE                = 0x45
+	TCP_MAXSEG                     = 0x2
+	TCP_MAXUNACKTIME               = 0x44
+	TCP_MAXWIN                     = 0xffff
+	TCP_MAX_SACK                   = 0x4
+	TCP_MAX_WINSHIFT               = 0xe
+	TCP_MD5SIG                     = 0x10
+	TCP_MINMSS                     = 0xd8
+	TCP_MSS                        = 0x218
+	TCP_NODELAY                    = 0x1
+	TCP_NOOPT                      = 0x8
+	TCP_NOPUSH                     = 0x4
+	TCP_NO_PRR                     = 0x462
+	TCP_PACING_RATE_CAP            = 0x46b
+	TCP_PCAP_IN                    = 0x1000
+	TCP_PCAP_OUT                   = 0x800
+	TCP_PERF_INFO                  = 0x4e
+	TCP_PROC_ACCOUNTING            = 0x4c
+	TCP_RACK_ABC_VAL               = 0x46d
+	TCP_RACK_CHEAT_NOT_CONF_RATE   = 0x459
+	TCP_RACK_DO_DETECTION          = 0x449
+	TCP_RACK_EARLY_RECOV           = 0x423
+	TCP_RACK_EARLY_SEG             = 0x424
+	TCP_RACK_FORCE_MSEG            = 0x45d
+	TCP_RACK_GP_INCREASE           = 0x446
+	TCP_RACK_GP_INCREASE_CA        = 0x45a
+	TCP_RACK_GP_INCREASE_REC       = 0x45c
+	TCP_RACK_GP_INCREASE_SS        = 0x45b
+	TCP_RACK_IDLE_REDUCE_HIGH      = 0x444
+	TCP_RACK_MBUF_QUEUE            = 0x41a
+	TCP_RACK_MEASURE_CNT           = 0x46f
+	TCP_RACK_MIN_PACE              = 0x445
+	TCP_RACK_MIN_PACE_SEG          = 0x446
+	TCP_RACK_MIN_TO                = 0x422
+	TCP_RACK_NONRXT_CFG_RATE       = 0x463
+	TCP_RACK_NO_PUSH_AT_MAX        = 0x466
+	TCP_RACK_PACE_ALWAYS           = 0x41f
+	TCP_RACK_PACE_MAX_SEG          = 0x41e
+	TCP_RACK_PACE_RATE_CA          = 0x45e
+	TCP_RACK_PACE_RATE_REC         = 0x460
+	TCP_RACK_PACE_RATE_SS          = 0x45f
+	TCP_RACK_PACE_REDUCE           = 0x41d
+	TCP_RACK_PACE_TO_FILL          = 0x467
+	TCP_RACK_PACING_BETA           = 0x472
+	TCP_RACK_PACING_BETA_ECN       = 0x473
+	TCP_RACK_PKT_DELAY             = 0x428
+	TCP_RACK_PROFILE               = 0x469
+	TCP_RACK_PROP                  = 0x41b
+	TCP_RACK_PROP_RATE             = 0x420
+	TCP_RACK_PRR_SENDALOT          = 0x421
+	TCP_RACK_REORD_FADE            = 0x426
+	TCP_RACK_REORD_THRESH          = 0x425
+	TCP_RACK_RR_CONF               = 0x459
+	TCP_RACK_TIMER_SLOP            = 0x474
+	TCP_RACK_TLP_INC_VAR           = 0x429
+	TCP_RACK_TLP_REDUCE            = 0x41c
+	TCP_RACK_TLP_THRESH            = 0x427
+	TCP_RACK_TLP_USE               = 0x447
+	TCP_REC_ABC_VAL                = 0x46e
+	TCP_REMOTE_UDP_ENCAPS_PORT     = 0x47
+	TCP_REUSPORT_LB_NUMA           = 0x402
+	TCP_REUSPORT_LB_NUMA_CURDOM    = -0x1
+	TCP_REUSPORT_LB_NUMA_NODOM     = -0x2
+	TCP_RXTLS_ENABLE               = 0x29
+	TCP_RXTLS_MODE                 = 0x2a
+	TCP_SHARED_CWND_ALLOWED        = 0x4b
+	TCP_SHARED_CWND_ENABLE         = 0x464
+	TCP_SHARED_CWND_TIME_LIMIT     = 0x468
+	TCP_STATS                      = 0x21
+	TCP_TIMELY_DYN_ADJ             = 0x465
+	TCP_TLS_MODE_IFNET             = 0x2
+	TCP_TLS_MODE_NONE              = 0x0
+	TCP_TLS_MODE_SW                = 0x1
+	TCP_TLS_MODE_TOE               = 0x3
+	TCP_TXTLS_ENABLE               = 0x27
+	TCP_TXTLS_MODE                 = 0x28
+	TCP_USER_LOG                   = 0x30
+	TCP_USE_CMP_ACKS               = 0x4d
+	TCP_VENDOR                     = 0x80000000
+	TCSAFLUSH                      = 0x2
+	TIMER_ABSTIME                  = 0x1
+	TIMER_RELTIME                  = 0x0
+	TIOCCBRK                       = 0x2000747a
+	TIOCCDTR                       = 0x20007478
+	TIOCCONS                       = 0x80047462
+	TIOCDRAIN                      = 0x2000745e
+	TIOCEXCL                       = 0x2000740d
+	TIOCEXT                        = 0x80047460
+	TIOCFLUSH                      = 0x80047410
+	TIOCGDRAINWAIT                 = 0x40047456
+	TIOCGETA                       = 0x402c7413
+	TIOCGETD                       = 0x4004741a
+	TIOCGPGRP                      = 0x40047477
+	TIOCGPTN                       = 0x4004740f
+	TIOCGSID                       = 0x40047463
+	TIOCGWINSZ                     = 0x40087468
+	TIOCMBIC                       = 0x8004746b
+	TIOCMBIS                       = 0x8004746c
+	TIOCMGDTRWAIT                  = 0x4004745a
+	TIOCMGET                       = 0x4004746a
+	TIOCMSDTRWAIT                  = 0x8004745b
+	TIOCMSET                       = 0x8004746d
+	TIOCM_CAR                      = 0x40
+	TIOCM_CD                       = 0x40
+	TIOCM_CTS                      = 0x20
+	TIOCM_DCD                      = 0x40
+	TIOCM_DSR                      = 0x100
+	TIOCM_DTR                      = 0x2
+	TIOCM_LE                       = 0x1
+	TIOCM_RI                       = 0x80
+	TIOCM_RNG                      = 0x80
+	TIOCM_RTS                      = 0x4
+	TIOCM_SR                       = 0x10
+	TIOCM_ST                       = 0x8
+	TIOCNOTTY                      = 0x20007471
+	TIOCNXCL                       = 0x2000740e
+	TIOCOUTQ                       = 0x40047473
+	TIOCPKT                        = 0x80047470
+	TIOCPKT_DATA                   = 0x0
+	TIOCPKT_DOSTOP                 = 0x20
+	TIOCPKT_FLUSHREAD              = 0x1
+	TIOCPKT_FLUSHWRITE             = 0x2
+	TIOCPKT_IOCTL                  = 0x40
+	TIOCPKT_NOSTOP                 = 0x10
+	TIOCPKT_START                  = 0x8
+	TIOCPKT_STOP                   = 0x4
+	TIOCPTMASTER                   = 0x2000741c
+	TIOCSBRK                       = 0x2000747b
+	TIOCSCTTY                      = 0x20007461
+	TIOCSDRAINWAIT                 = 0x80047457
+	TIOCSDTR                       = 0x20007479
+	TIOCSETA                       = 0x802c7414
+	TIOCSETAF                      = 0x802c7416
+	TIOCSETAW                      = 0x802c7415
+	TIOCSETD                       = 0x8004741b
+	TIOCSIG                        = 0x2004745f
+	TIOCSPGRP                      = 0x80047476
+	TIOCSTART                      = 0x2000746e
+	TIOCSTAT                       = 0x20007465
+	TIOCSTI                        = 0x80017472
+	TIOCSTOP                       = 0x2000746f
+	TIOCSWINSZ                     = 0x80087467
+	TIOCTIMESTAMP                  = 0x40107459
+	TIOCUCNTL                      = 0x80047466
+	TOSTOP                         = 0x400000
+	UTIME_NOW                      = -0x1
+	UTIME_OMIT                     = -0x2
+	VDISCARD                       = 0xf
+	VDSUSP                         = 0xb
+	VEOF                           = 0x0
+	VEOL                           = 0x1
+	VEOL2                          = 0x2
+	VERASE                         = 0x3
+	VERASE2                        = 0x7
+	VINTR                          = 0x8
+	VKILL                          = 0x5
+	VLNEXT                         = 0xe
+	VMIN                           = 0x10
+	VQUIT                          = 0x9
+	VREPRINT                       = 0x6
+	VSTART                         = 0xc
+	VSTATUS                        = 0x12
+	VSTOP                          = 0xd
+	VSUSP                          = 0xa
+	VTIME                          = 0x11
+	VWERASE                        = 0x4
+	WCONTINUED                     = 0x4
+	WCOREFLAG                      = 0x80
+	WEXITED                        = 0x10
+	WLINUXCLONE                    = 0x80000000
+	WNOHANG                        = 0x1
+	WNOWAIT                        = 0x8
+	WSTOPPED                       = 0x2
+	WTRAPPED                       = 0x20
+	WUNTRACED                      = 0x2
+)
+
+// Errors
+const (
+	E2BIG           = syscall.Errno(0x7)
+	EACCES          = syscall.Errno(0xd)
+	EADDRINUSE      = syscall.Errno(0x30)
+	EADDRNOTAVAIL   = syscall.Errno(0x31)
+	EAFNOSUPPORT    = syscall.Errno(0x2f)
+	EAGAIN          = syscall.Errno(0x23)
+	EALREADY        = syscall.Errno(0x25)
+	EAUTH           = syscall.Errno(0x50)
+	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x59)
+	EBADRPC         = syscall.Errno(0x48)
+	EBUSY           = syscall.Errno(0x10)
+	ECANCELED       = syscall.Errno(0x55)
+	ECAPMODE        = syscall.Errno(0x5e)
+	ECHILD          = syscall.Errno(0xa)
+	ECONNABORTED    = syscall.Errno(0x35)
+	ECONNREFUSED    = syscall.Errno(0x3d)
+	ECONNRESET      = syscall.Errno(0x36)
+	EDEADLK         = syscall.Errno(0xb)
+	EDESTADDRREQ    = syscall.Errno(0x27)
+	EDOM            = syscall.Errno(0x21)
+	EDOOFUS         = syscall.Errno(0x58)
+	EDQUOT          = syscall.Errno(0x45)
+	EEXIST          = syscall.Errno(0x11)
+	EFAULT          = syscall.Errno(0xe)
+	EFBIG           = syscall.Errno(0x1b)
+	EFTYPE          = syscall.Errno(0x4f)
+	EHOSTDOWN       = syscall.Errno(0x40)
+	EHOSTUNREACH    = syscall.Errno(0x41)
+	EIDRM           = syscall.Errno(0x52)
+	EILSEQ          = syscall.Errno(0x56)
+	EINPROGRESS     = syscall.Errno(0x24)
+	EINTEGRITY      = syscall.Errno(0x61)
+	EINTR           = syscall.Errno(0x4)
+	EINVAL          = syscall.Errno(0x16)
+	EIO             = syscall.Errno(0x5)
+	EISCONN         = syscall.Errno(0x38)
+	EISDIR          = syscall.Errno(0x15)
+	ELAST           = syscall.Errno(0x61)
+	ELOOP           = syscall.Errno(0x3e)
+	EMFILE          = syscall.Errno(0x18)
+	EMLINK          = syscall.Errno(0x1f)
+	EMSGSIZE        = syscall.Errno(0x28)
+	EMULTIHOP       = syscall.Errno(0x5a)
+	ENAMETOOLONG    = syscall.Errno(0x3f)
+	ENEEDAUTH       = syscall.Errno(0x51)
+	ENETDOWN        = syscall.Errno(0x32)
+	ENETRESET       = syscall.Errno(0x34)
+	ENETUNREACH     = syscall.Errno(0x33)
+	ENFILE          = syscall.Errno(0x17)
+	ENOATTR         = syscall.Errno(0x57)
+	ENOBUFS         = syscall.Errno(0x37)
+	ENODEV          = syscall.Errno(0x13)
+	ENOENT          = syscall.Errno(0x2)
+	ENOEXEC         = syscall.Errno(0x8)
+	ENOLCK          = syscall.Errno(0x4d)
+	ENOLINK         = syscall.Errno(0x5b)
+	ENOMEM          = syscall.Errno(0xc)
+	ENOMSG          = syscall.Errno(0x53)
+	ENOPROTOOPT     = syscall.Errno(0x2a)
+	ENOSPC          = syscall.Errno(0x1c)
+	ENOSYS          = syscall.Errno(0x4e)
+	ENOTBLK         = syscall.Errno(0xf)
+	ENOTCAPABLE     = syscall.Errno(0x5d)
+	ENOTCONN        = syscall.Errno(0x39)
+	ENOTDIR         = syscall.Errno(0x14)
+	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5f)
+	ENOTSOCK        = syscall.Errno(0x26)
+	ENOTSUP         = syscall.Errno(0x2d)
+	ENOTTY          = syscall.Errno(0x19)
+	ENXIO           = syscall.Errno(0x6)
+	EOPNOTSUPP      = syscall.Errno(0x2d)
+	EOVERFLOW       = syscall.Errno(0x54)
+	EOWNERDEAD      = syscall.Errno(0x60)
+	EPERM           = syscall.Errno(0x1)
+	EPFNOSUPPORT    = syscall.Errno(0x2e)
+	EPIPE           = syscall.Errno(0x20)
+	EPROCLIM        = syscall.Errno(0x43)
+	EPROCUNAVAIL    = syscall.Errno(0x4c)
+	EPROGMISMATCH   = syscall.Errno(0x4b)
+	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5c)
+	EPROTONOSUPPORT = syscall.Errno(0x2b)
+	EPROTOTYPE      = syscall.Errno(0x29)
+	ERANGE          = syscall.Errno(0x22)
+	EREMOTE         = syscall.Errno(0x47)
+	EROFS           = syscall.Errno(0x1e)
+	ERPCMISMATCH    = syscall.Errno(0x49)
+	ESHUTDOWN       = syscall.Errno(0x3a)
+	ESOCKTNOSUPPORT = syscall.Errno(0x2c)
+	ESPIPE          = syscall.Errno(0x1d)
+	ESRCH           = syscall.Errno(0x3)
+	ESTALE          = syscall.Errno(0x46)
+	ETIMEDOUT       = syscall.Errno(0x3c)
+	ETOOMANYREFS    = syscall.Errno(0x3b)
+	ETXTBSY         = syscall.Errno(0x1a)
+	EUSERS          = syscall.Errno(0x44)
+	EWOULDBLOCK     = syscall.Errno(0x23)
+	EXDEV           = syscall.Errno(0x12)
+)
+
+// Signals
+const (
+	SIGABRT   = syscall.Signal(0x6)
+	SIGALRM   = syscall.Signal(0xe)
+	SIGBUS    = syscall.Signal(0xa)
+	SIGCHLD   = syscall.Signal(0x14)
+	SIGCONT   = syscall.Signal(0x13)
+	SIGEMT    = syscall.Signal(0x7)
+	SIGFPE    = syscall.Signal(0x8)
+	SIGHUP    = syscall.Signal(0x1)
+	SIGILL    = syscall.Signal(0x4)
+	SIGINFO   = syscall.Signal(0x1d)
+	SIGINT    = syscall.Signal(0x2)
+	SIGIO     = syscall.Signal(0x17)
+	SIGIOT    = syscall.Signal(0x6)
+	SIGKILL   = syscall.Signal(0x9)
+	SIGLIBRT  = syscall.Signal(0x21)
+	SIGLWP    = syscall.Signal(0x20)
+	SIGPIPE   = syscall.Signal(0xd)
+	SIGPROF   = syscall.Signal(0x1b)
+	SIGQUIT   = syscall.Signal(0x3)
+	SIGSEGV   = syscall.Signal(0xb)
+	SIGSTOP   = syscall.Signal(0x11)
+	SIGSYS    = syscall.Signal(0xc)
+	SIGTERM   = syscall.Signal(0xf)
+	SIGTHR    = syscall.Signal(0x20)
+	SIGTRAP   = syscall.Signal(0x5)
+	SIGTSTP   = syscall.Signal(0x12)
+	SIGTTIN   = syscall.Signal(0x15)
+	SIGTTOU   = syscall.Signal(0x16)
+	SIGURG    = syscall.Signal(0x10)
+	SIGUSR1   = syscall.Signal(0x1e)
+	SIGUSR2   = syscall.Signal(0x1f)
+	SIGVTALRM = syscall.Signal(0x1a)
+	SIGWINCH  = syscall.Signal(0x1c)
+	SIGXCPU   = syscall.Signal(0x18)
+	SIGXFSZ   = syscall.Signal(0x19)
+)
+
+// Error table
+var errorList = [...]struct {
+	num  syscall.Errno
+	name string
+	desc string
+}{
+	{1, "EPERM", "operation not permitted"},
+	{2, "ENOENT", "no such file or directory"},
+	{3, "ESRCH", "no such process"},
+	{4, "EINTR", "interrupted system call"},
+	{5, "EIO", "input/output error"},
+	{6, "ENXIO", "device not configured"},
+	{7, "E2BIG", "argument list too long"},
+	{8, "ENOEXEC", "exec format error"},
+	{9, "EBADF", "bad file descriptor"},
+	{10, "ECHILD", "no child processes"},
+	{11, "EDEADLK", "resource deadlock avoided"},
+	{12, "ENOMEM", "cannot allocate memory"},
+	{13, "EACCES", "permission denied"},
+	{14, "EFAULT", "bad address"},
+	{15, "ENOTBLK", "block device required"},
+	{16, "EBUSY", "device busy"},
+	{17, "EEXIST", "file exists"},
+	{18, "EXDEV", "cross-device link"},
+	{19, "ENODEV", "operation not supported by device"},
+	{20, "ENOTDIR", "not a directory"},
+	{21, "EISDIR", "is a directory"},
+	{22, "EINVAL", "invalid argument"},
+	{23, "ENFILE", "too many open files in system"},
+	{24, "EMFILE", "too many open files"},
+	{25, "ENOTTY", "inappropriate ioctl for device"},
+	{26, "ETXTBSY", "text file busy"},
+	{27, "EFBIG", "file too large"},
+	{28, "ENOSPC", "no space left on device"},
+	{29, "ESPIPE", "illegal seek"},
+	{30, "EROFS", "read-only file system"},
+	{31, "EMLINK", "too many links"},
+	{32, "EPIPE", "broken pipe"},
+	{33, "EDOM", "numerical argument out of domain"},
+	{34, "ERANGE", "result too large"},
+	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
+	{36, "EINPROGRESS", "operation now in progress"},
+	{37, "EALREADY", "operation already in progress"},
+	{38, "ENOTSOCK", "socket operation on non-socket"},
+	{39, "EDESTADDRREQ", "destination address required"},
+	{40, "EMSGSIZE", "message too long"},
+	{41, "EPROTOTYPE", "protocol wrong type for socket"},
+	{42, "ENOPROTOOPT", "protocol not available"},
+	{43, "EPROTONOSUPPORT", "protocol not supported"},
+	{44, "ESOCKTNOSUPPORT", "socket type not supported"},
+	{45, "EOPNOTSUPP", "operation not supported"},
+	{46, "EPFNOSUPPORT", "protocol family not supported"},
+	{47, "EAFNOSUPPORT", "address family not supported by protocol family"},
+	{48, "EADDRINUSE", "address already in use"},
+	{49, "EADDRNOTAVAIL", "can't assign requested address"},
+	{50, "ENETDOWN", "network is down"},
+	{51, "ENETUNREACH", "network is unreachable"},
+	{52, "ENETRESET", "network dropped connection on reset"},
+	{53, "ECONNABORTED", "software caused connection abort"},
+	{54, "ECONNRESET", "connection reset by peer"},
+	{55, "ENOBUFS", "no buffer space available"},
+	{56, "EISCONN", "socket is already connected"},
+	{57, "ENOTCONN", "socket is not connected"},
+	{58, "ESHUTDOWN", "can't send after socket shutdown"},
+	{59, "ETOOMANYREFS", "too many references: can't splice"},
+	{60, "ETIMEDOUT", "operation timed out"},
+	{61, "ECONNREFUSED", "connection refused"},
+	{62, "ELOOP", "too many levels of symbolic links"},
+	{63, "ENAMETOOLONG", "file name too long"},
+	{64, "EHOSTDOWN", "host is down"},
+	{65, "EHOSTUNREACH", "no route to host"},
+	{66, "ENOTEMPTY", "directory not empty"},
+	{67, "EPROCLIM", "too many processes"},
+	{68, "EUSERS", "too many users"},
+	{69, "EDQUOT", "disc quota exceeded"},
+	{70, "ESTALE", "stale NFS file handle"},
+	{71, "EREMOTE", "too many levels of remote in path"},
+	{72, "EBADRPC", "RPC struct is bad"},
+	{73, "ERPCMISMATCH", "RPC version wrong"},
+	{74, "EPROGUNAVAIL", "RPC prog. not avail"},
+	{75, "EPROGMISMATCH", "program version wrong"},
+	{76, "EPROCUNAVAIL", "bad procedure for program"},
+	{77, "ENOLCK", "no locks available"},
+	{78, "ENOSYS", "function not implemented"},
+	{79, "EFTYPE", "inappropriate file type or format"},
+	{80, "EAUTH", "authentication error"},
+	{81, "ENEEDAUTH", "need authenticator"},
+	{82, "EIDRM", "identifier removed"},
+	{83, "ENOMSG", "no message of desired type"},
+	{84, "EOVERFLOW", "value too large to be stored in data type"},
+	{85, "ECANCELED", "operation canceled"},
+	{86, "EILSEQ", "illegal byte sequence"},
+	{87, "ENOATTR", "attribute not found"},
+	{88, "EDOOFUS", "programming error"},
+	{89, "EBADMSG", "bad message"},
+	{90, "EMULTIHOP", "multihop attempted"},
+	{91, "ENOLINK", "link has been severed"},
+	{92, "EPROTO", "protocol error"},
+	{93, "ENOTCAPABLE", "capabilities insufficient"},
+	{94, "ECAPMODE", "not permitted in capability mode"},
+	{95, "ENOTRECOVERABLE", "state not recoverable"},
+	{96, "EOWNERDEAD", "previous owner died"},
+	{97, "EINTEGRITY", "integrity check failed"},
+}
+
+// Signal table
+var signalList = [...]struct {
+	num  syscall.Signal
+	name string
+	desc string
+}{
+	{1, "SIGHUP", "hangup"},
+	{2, "SIGINT", "interrupt"},
+	{3, "SIGQUIT", "quit"},
+	{4, "SIGILL", "illegal instruction"},
+	{5, "SIGTRAP", "trace/BPT trap"},
+	{6, "SIGIOT", "abort trap"},
+	{7, "SIGEMT", "EMT trap"},
+	{8, "SIGFPE", "floating point exception"},
+	{9, "SIGKILL", "killed"},
+	{10, "SIGBUS", "bus error"},
+	{11, "SIGSEGV", "segmentation fault"},
+	{12, "SIGSYS", "bad system call"},
+	{13, "SIGPIPE", "broken pipe"},
+	{14, "SIGALRM", "alarm clock"},
+	{15, "SIGTERM", "terminated"},
+	{16, "SIGURG", "urgent I/O condition"},
+	{17, "SIGSTOP", "suspended (signal)"},
+	{18, "SIGTSTP", "suspended"},
+	{19, "SIGCONT", "continued"},
+	{20, "SIGCHLD", "child exited"},
+	{21, "SIGTTIN", "stopped (tty input)"},
+	{22, "SIGTTOU", "stopped (tty output)"},
+	{23, "SIGIO", "I/O possible"},
+	{24, "SIGXCPU", "cputime limit exceeded"},
+	{25, "SIGXFSZ", "filesize limit exceeded"},
+	{26, "SIGVTALRM", "virtual timer expired"},
+	{27, "SIGPROF", "profiling timer expired"},
+	{28, "SIGWINCH", "window size changes"},
+	{29, "SIGINFO", "information request"},
+	{30, "SIGUSR1", "user defined signal 1"},
+	{31, "SIGUSR2", "user defined signal 2"},
+	{32, "SIGTHR", "unknown signal"},
+	{33, "SIGLIBRT", "unknown signal"},
+}
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux.go b/vendor/golang.org/x/sys/unix/zerrors_linux.go
index 3bbc527519..de936b677b 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go
@@ -1,4 +1,4 @@
-// Code generated by mkmerge.go; DO NOT EDIT.
+// Code generated by mkmerge; DO NOT EDIT.
 
 //go:build linux
 // +build linux
@@ -38,7 +38,8 @@ const (
 	AF_KEY                                      = 0xf
 	AF_LLC                                      = 0x1a
 	AF_LOCAL                                    = 0x1
-	AF_MAX                                      = 0x2d
+	AF_MAX                                      = 0x2e
+	AF_MCTP                                     = 0x2d
 	AF_MPLS                                     = 0x1c
 	AF_NETBEUI                                  = 0xd
 	AF_NETLINK                                  = 0x10
@@ -69,6 +70,7 @@ const (
 	ALG_SET_DRBG_ENTROPY                        = 0x6
 	ALG_SET_IV                                  = 0x2
 	ALG_SET_KEY                                 = 0x1
+	ALG_SET_KEY_BY_KEY_SERIAL                   = 0x7
 	ALG_SET_OP                                  = 0x3
 	ANON_INODE_FS_MAGIC                         = 0x9041934
 	ARPHRD_6LOWPAN                              = 0x339
@@ -139,6 +141,306 @@ const (
 	ARPHRD_VOID                                 = 0xffff
 	ARPHRD_VSOCKMON                             = 0x33a
 	ARPHRD_X25                                  = 0x10f
+	AUDIT_ADD                                   = 0x3eb
+	AUDIT_ADD_RULE                              = 0x3f3
+	AUDIT_ALWAYS                                = 0x2
+	AUDIT_ANOM_ABEND                            = 0x6a5
+	AUDIT_ANOM_CREAT                            = 0x6a7
+	AUDIT_ANOM_LINK                             = 0x6a6
+	AUDIT_ANOM_PROMISCUOUS                      = 0x6a4
+	AUDIT_ARCH                                  = 0xb
+	AUDIT_ARCH_AARCH64                          = 0xc00000b7
+	AUDIT_ARCH_ALPHA                            = 0xc0009026
+	AUDIT_ARCH_ARCOMPACT                        = 0x4000005d
+	AUDIT_ARCH_ARCOMPACTBE                      = 0x5d
+	AUDIT_ARCH_ARCV2                            = 0x400000c3
+	AUDIT_ARCH_ARCV2BE                          = 0xc3
+	AUDIT_ARCH_ARM                              = 0x40000028
+	AUDIT_ARCH_ARMEB                            = 0x28
+	AUDIT_ARCH_C6X                              = 0x4000008c
+	AUDIT_ARCH_C6XBE                            = 0x8c
+	AUDIT_ARCH_CRIS                             = 0x4000004c
+	AUDIT_ARCH_CSKY                             = 0x400000fc
+	AUDIT_ARCH_FRV                              = 0x5441
+	AUDIT_ARCH_H8300                            = 0x2e
+	AUDIT_ARCH_HEXAGON                          = 0xa4
+	AUDIT_ARCH_I386                             = 0x40000003
+	AUDIT_ARCH_IA64                             = 0xc0000032
+	AUDIT_ARCH_LOONGARCH32                      = 0x40000102
+	AUDIT_ARCH_LOONGARCH64                      = 0xc0000102
+	AUDIT_ARCH_M32R                             = 0x58
+	AUDIT_ARCH_M68K                             = 0x4
+	AUDIT_ARCH_MICROBLAZE                       = 0xbd
+	AUDIT_ARCH_MIPS                             = 0x8
+	AUDIT_ARCH_MIPS64                           = 0x80000008
+	AUDIT_ARCH_MIPS64N32                        = 0xa0000008
+	AUDIT_ARCH_MIPSEL                           = 0x40000008
+	AUDIT_ARCH_MIPSEL64                         = 0xc0000008
+	AUDIT_ARCH_MIPSEL64N32                      = 0xe0000008
+	AUDIT_ARCH_NDS32                            = 0x400000a7
+	AUDIT_ARCH_NDS32BE                          = 0xa7
+	AUDIT_ARCH_NIOS2                            = 0x40000071
+	AUDIT_ARCH_OPENRISC                         = 0x5c
+	AUDIT_ARCH_PARISC                           = 0xf
+	AUDIT_ARCH_PARISC64                         = 0x8000000f
+	AUDIT_ARCH_PPC                              = 0x14
+	AUDIT_ARCH_PPC64                            = 0x80000015
+	AUDIT_ARCH_PPC64LE                          = 0xc0000015
+	AUDIT_ARCH_RISCV32                          = 0x400000f3
+	AUDIT_ARCH_RISCV64                          = 0xc00000f3
+	AUDIT_ARCH_S390                             = 0x16
+	AUDIT_ARCH_S390X                            = 0x80000016
+	AUDIT_ARCH_SH                               = 0x2a
+	AUDIT_ARCH_SH64                             = 0x8000002a
+	AUDIT_ARCH_SHEL                             = 0x4000002a
+	AUDIT_ARCH_SHEL64                           = 0xc000002a
+	AUDIT_ARCH_SPARC                            = 0x2
+	AUDIT_ARCH_SPARC64                          = 0x8000002b
+	AUDIT_ARCH_TILEGX                           = 0xc00000bf
+	AUDIT_ARCH_TILEGX32                         = 0x400000bf
+	AUDIT_ARCH_TILEPRO                          = 0x400000bc
+	AUDIT_ARCH_UNICORE                          = 0x4000006e
+	AUDIT_ARCH_X86_64                           = 0xc000003e
+	AUDIT_ARCH_XTENSA                           = 0x5e
+	AUDIT_ARG0                                  = 0xc8
+	AUDIT_ARG1                                  = 0xc9
+	AUDIT_ARG2                                  = 0xca
+	AUDIT_ARG3                                  = 0xcb
+	AUDIT_AVC                                   = 0x578
+	AUDIT_AVC_PATH                              = 0x57a
+	AUDIT_BITMASK_SIZE                          = 0x40
+	AUDIT_BIT_MASK                              = 0x8000000
+	AUDIT_BIT_TEST                              = 0x48000000
+	AUDIT_BPF                                   = 0x536
+	AUDIT_BPRM_FCAPS                            = 0x529
+	AUDIT_CAPSET                                = 0x52a
+	AUDIT_CLASS_CHATTR                          = 0x2
+	AUDIT_CLASS_CHATTR_32                       = 0x3
+	AUDIT_CLASS_DIR_WRITE                       = 0x0
+	AUDIT_CLASS_DIR_WRITE_32                    = 0x1
+	AUDIT_CLASS_READ                            = 0x4
+	AUDIT_CLASS_READ_32                         = 0x5
+	AUDIT_CLASS_SIGNAL                          = 0x8
+	AUDIT_CLASS_SIGNAL_32                       = 0x9
+	AUDIT_CLASS_WRITE                           = 0x6
+	AUDIT_CLASS_WRITE_32                        = 0x7
+	AUDIT_COMPARE_AUID_TO_EUID                  = 0x10
+	AUDIT_COMPARE_AUID_TO_FSUID                 = 0xe
+	AUDIT_COMPARE_AUID_TO_OBJ_UID               = 0x5
+	AUDIT_COMPARE_AUID_TO_SUID                  = 0xf
+	AUDIT_COMPARE_EGID_TO_FSGID                 = 0x17
+	AUDIT_COMPARE_EGID_TO_OBJ_GID               = 0x4
+	AUDIT_COMPARE_EGID_TO_SGID                  = 0x18
+	AUDIT_COMPARE_EUID_TO_FSUID                 = 0x12
+	AUDIT_COMPARE_EUID_TO_OBJ_UID               = 0x3
+	AUDIT_COMPARE_EUID_TO_SUID                  = 0x11
+	AUDIT_COMPARE_FSGID_TO_OBJ_GID              = 0x9
+	AUDIT_COMPARE_FSUID_TO_OBJ_UID              = 0x8
+	AUDIT_COMPARE_GID_TO_EGID                   = 0x14
+	AUDIT_COMPARE_GID_TO_FSGID                  = 0x15
+	AUDIT_COMPARE_GID_TO_OBJ_GID                = 0x2
+	AUDIT_COMPARE_GID_TO_SGID                   = 0x16
+	AUDIT_COMPARE_SGID_TO_FSGID                 = 0x19
+	AUDIT_COMPARE_SGID_TO_OBJ_GID               = 0x7
+	AUDIT_COMPARE_SUID_TO_FSUID                 = 0x13
+	AUDIT_COMPARE_SUID_TO_OBJ_UID               = 0x6
+	AUDIT_COMPARE_UID_TO_AUID                   = 0xa
+	AUDIT_COMPARE_UID_TO_EUID                   = 0xb
+	AUDIT_COMPARE_UID_TO_FSUID                  = 0xc
+	AUDIT_COMPARE_UID_TO_OBJ_UID                = 0x1
+	AUDIT_COMPARE_UID_TO_SUID                   = 0xd
+	AUDIT_CONFIG_CHANGE                         = 0x519
+	AUDIT_CWD                                   = 0x51b
+	AUDIT_DAEMON_ABORT                          = 0x4b2
+	AUDIT_DAEMON_CONFIG                         = 0x4b3
+	AUDIT_DAEMON_END                            = 0x4b1
+	AUDIT_DAEMON_START                          = 0x4b0
+	AUDIT_DEL                                   = 0x3ec
+	AUDIT_DEL_RULE                              = 0x3f4
+	AUDIT_DEVMAJOR                              = 0x64
+	AUDIT_DEVMINOR                              = 0x65
+	AUDIT_DIR                                   = 0x6b
+	AUDIT_DM_CTRL                               = 0x53a
+	AUDIT_DM_EVENT                              = 0x53b
+	AUDIT_EGID                                  = 0x6
+	AUDIT_EOE                                   = 0x528
+	AUDIT_EQUAL                                 = 0x40000000
+	AUDIT_EUID                                  = 0x2
+	AUDIT_EVENT_LISTENER                        = 0x537
+	AUDIT_EXE                                   = 0x70
+	AUDIT_EXECVE                                = 0x51d
+	AUDIT_EXIT                                  = 0x67
+	AUDIT_FAIL_PANIC                            = 0x2
+	AUDIT_FAIL_PRINTK                           = 0x1
+	AUDIT_FAIL_SILENT                           = 0x0
+	AUDIT_FANOTIFY                              = 0x533
+	AUDIT_FD_PAIR                               = 0x525
+	AUDIT_FEATURE_BITMAP_ALL                    = 0x7f
+	AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT          = 0x1
+	AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME      = 0x2
+	AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND         = 0x8
+	AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH        = 0x4
+	AUDIT_FEATURE_BITMAP_FILTER_FS              = 0x40
+	AUDIT_FEATURE_BITMAP_LOST_RESET             = 0x20
+	AUDIT_FEATURE_BITMAP_SESSIONID_FILTER       = 0x10
+	AUDIT_FEATURE_CHANGE                        = 0x530
+	AUDIT_FEATURE_LOGINUID_IMMUTABLE            = 0x1
+	AUDIT_FEATURE_ONLY_UNSET_LOGINUID           = 0x0
+	AUDIT_FEATURE_VERSION                       = 0x1
+	AUDIT_FIELD_COMPARE                         = 0x6f
+	AUDIT_FILETYPE                              = 0x6c
+	AUDIT_FILTERKEY                             = 0xd2
+	AUDIT_FILTER_ENTRY                          = 0x2
+	AUDIT_FILTER_EXCLUDE                        = 0x5
+	AUDIT_FILTER_EXIT                           = 0x4
+	AUDIT_FILTER_FS                             = 0x6
+	AUDIT_FILTER_PREPEND                        = 0x10
+	AUDIT_FILTER_TASK                           = 0x1
+	AUDIT_FILTER_TYPE                           = 0x5
+	AUDIT_FILTER_URING_EXIT                     = 0x7
+	AUDIT_FILTER_USER                           = 0x0
+	AUDIT_FILTER_WATCH                          = 0x3
+	AUDIT_FIRST_KERN_ANOM_MSG                   = 0x6a4
+	AUDIT_FIRST_USER_MSG                        = 0x44c
+	AUDIT_FIRST_USER_MSG2                       = 0x834
+	AUDIT_FSGID                                 = 0x8
+	AUDIT_FSTYPE                                = 0x1a
+	AUDIT_FSUID                                 = 0x4
+	AUDIT_GET                                   = 0x3e8
+	AUDIT_GET_FEATURE                           = 0x3fb
+	AUDIT_GID                                   = 0x5
+	AUDIT_GREATER_THAN                          = 0x20000000
+	AUDIT_GREATER_THAN_OR_EQUAL                 = 0x60000000
+	AUDIT_INODE                                 = 0x66
+	AUDIT_INTEGRITY_DATA                        = 0x708
+	AUDIT_INTEGRITY_EVM_XATTR                   = 0x70e
+	AUDIT_INTEGRITY_HASH                        = 0x70b
+	AUDIT_INTEGRITY_METADATA                    = 0x709
+	AUDIT_INTEGRITY_PCR                         = 0x70c
+	AUDIT_INTEGRITY_POLICY_RULE                 = 0x70f
+	AUDIT_INTEGRITY_RULE                        = 0x70d
+	AUDIT_INTEGRITY_STATUS                      = 0x70a
+	AUDIT_IPC                                   = 0x517
+	AUDIT_IPC_SET_PERM                          = 0x51f
+	AUDIT_KERNEL                                = 0x7d0
+	AUDIT_KERNEL_OTHER                          = 0x524
+	AUDIT_KERN_MODULE                           = 0x532
+	AUDIT_LAST_FEATURE                          = 0x1
+	AUDIT_LAST_KERN_ANOM_MSG                    = 0x707
+	AUDIT_LAST_USER_MSG                         = 0x4af
+	AUDIT_LAST_USER_MSG2                        = 0xbb7
+	AUDIT_LESS_THAN                             = 0x10000000
+	AUDIT_LESS_THAN_OR_EQUAL                    = 0x50000000
+	AUDIT_LIST                                  = 0x3ea
+	AUDIT_LIST_RULES                            = 0x3f5
+	AUDIT_LOGIN                                 = 0x3ee
+	AUDIT_LOGINUID                              = 0x9
+	AUDIT_LOGINUID_SET                          = 0x18
+	AUDIT_MAC_CALIPSO_ADD                       = 0x58a
+	AUDIT_MAC_CALIPSO_DEL                       = 0x58b
+	AUDIT_MAC_CIPSOV4_ADD                       = 0x57f
+	AUDIT_MAC_CIPSOV4_DEL                       = 0x580
+	AUDIT_MAC_CONFIG_CHANGE                     = 0x57d
+	AUDIT_MAC_IPSEC_ADDSA                       = 0x583
+	AUDIT_MAC_IPSEC_ADDSPD                      = 0x585
+	AUDIT_MAC_IPSEC_DELSA                       = 0x584
+	AUDIT_MAC_IPSEC_DELSPD                      = 0x586
+	AUDIT_MAC_IPSEC_EVENT                       = 0x587
+	AUDIT_MAC_MAP_ADD                           = 0x581
+	AUDIT_MAC_MAP_DEL                           = 0x582
+	AUDIT_MAC_POLICY_LOAD                       = 0x57b
+	AUDIT_MAC_STATUS                            = 0x57c
+	AUDIT_MAC_UNLBL_ALLOW                       = 0x57e
+	AUDIT_MAC_UNLBL_STCADD                      = 0x588
+	AUDIT_MAC_UNLBL_STCDEL                      = 0x589
+	AUDIT_MAKE_EQUIV                            = 0x3f7
+	AUDIT_MAX_FIELDS                            = 0x40
+	AUDIT_MAX_FIELD_COMPARE                     = 0x19
+	AUDIT_MAX_KEY_LEN                           = 0x100
+	AUDIT_MESSAGE_TEXT_MAX                      = 0x2170
+	AUDIT_MMAP                                  = 0x52b
+	AUDIT_MQ_GETSETATTR                         = 0x523
+	AUDIT_MQ_NOTIFY                             = 0x522
+	AUDIT_MQ_OPEN                               = 0x520
+	AUDIT_MQ_SENDRECV                           = 0x521
+	AUDIT_MSGTYPE                               = 0xc
+	AUDIT_NEGATE                                = 0x80000000
+	AUDIT_NETFILTER_CFG                         = 0x52d
+	AUDIT_NETFILTER_PKT                         = 0x52c
+	AUDIT_NEVER                                 = 0x0
+	AUDIT_NLGRP_MAX                             = 0x1
+	AUDIT_NOT_EQUAL                             = 0x30000000
+	AUDIT_NR_FILTERS                            = 0x8
+	AUDIT_OBJ_GID                               = 0x6e
+	AUDIT_OBJ_LEV_HIGH                          = 0x17
+	AUDIT_OBJ_LEV_LOW                           = 0x16
+	AUDIT_OBJ_PID                               = 0x526
+	AUDIT_OBJ_ROLE                              = 0x14
+	AUDIT_OBJ_TYPE                              = 0x15
+	AUDIT_OBJ_UID                               = 0x6d
+	AUDIT_OBJ_USER                              = 0x13
+	AUDIT_OPENAT2                               = 0x539
+	AUDIT_OPERATORS                             = 0x78000000
+	AUDIT_PATH                                  = 0x516
+	AUDIT_PERM                                  = 0x6a
+	AUDIT_PERM_ATTR                             = 0x8
+	AUDIT_PERM_EXEC                             = 0x1
+	AUDIT_PERM_READ                             = 0x4
+	AUDIT_PERM_WRITE                            = 0x2
+	AUDIT_PERS                                  = 0xa
+	AUDIT_PID                                   = 0x0
+	AUDIT_POSSIBLE                              = 0x1
+	AUDIT_PPID                                  = 0x12
+	AUDIT_PROCTITLE                             = 0x52f
+	AUDIT_REPLACE                               = 0x531
+	AUDIT_SADDR_FAM                             = 0x71
+	AUDIT_SECCOMP                               = 0x52e
+	AUDIT_SELINUX_ERR                           = 0x579
+	AUDIT_SESSIONID                             = 0x19
+	AUDIT_SET                                   = 0x3e9
+	AUDIT_SET_FEATURE                           = 0x3fa
+	AUDIT_SGID                                  = 0x7
+	AUDIT_SID_UNSET                             = 0xffffffff
+	AUDIT_SIGNAL_INFO                           = 0x3f2
+	AUDIT_SOCKADDR                              = 0x51a
+	AUDIT_SOCKETCALL                            = 0x518
+	AUDIT_STATUS_BACKLOG_LIMIT                  = 0x10
+	AUDIT_STATUS_BACKLOG_WAIT_TIME              = 0x20
+	AUDIT_STATUS_BACKLOG_WAIT_TIME_ACTUAL       = 0x80
+	AUDIT_STATUS_ENABLED                        = 0x1
+	AUDIT_STATUS_FAILURE                        = 0x2
+	AUDIT_STATUS_LOST                           = 0x40
+	AUDIT_STATUS_PID                            = 0x4
+	AUDIT_STATUS_RATE_LIMIT                     = 0x8
+	AUDIT_SUBJ_CLR                              = 0x11
+	AUDIT_SUBJ_ROLE                             = 0xe
+	AUDIT_SUBJ_SEN                              = 0x10
+	AUDIT_SUBJ_TYPE                             = 0xf
+	AUDIT_SUBJ_USER                             = 0xd
+	AUDIT_SUCCESS                               = 0x68
+	AUDIT_SUID                                  = 0x3
+	AUDIT_SYSCALL                               = 0x514
+	AUDIT_SYSCALL_CLASSES                       = 0x10
+	AUDIT_TIME_ADJNTPVAL                        = 0x535
+	AUDIT_TIME_INJOFFSET                        = 0x534
+	AUDIT_TRIM                                  = 0x3f6
+	AUDIT_TTY                                   = 0x527
+	AUDIT_TTY_GET                               = 0x3f8
+	AUDIT_TTY_SET                               = 0x3f9
+	AUDIT_UID                                   = 0x1
+	AUDIT_UID_UNSET                             = 0xffffffff
+	AUDIT_UNUSED_BITS                           = 0x7fffc00
+	AUDIT_URINGOP                               = 0x538
+	AUDIT_USER                                  = 0x3ed
+	AUDIT_USER_AVC                              = 0x453
+	AUDIT_USER_TTY                              = 0x464
+	AUDIT_VERSION_BACKLOG_LIMIT                 = 0x1
+	AUDIT_VERSION_BACKLOG_WAIT_TIME             = 0x2
+	AUDIT_VERSION_LATEST                        = 0x7f
+	AUDIT_WATCH                                 = 0x69
+	AUDIT_WATCH_INS                             = 0x3ef
+	AUDIT_WATCH_LIST                            = 0x3f1
+	AUDIT_WATCH_REM                             = 0x3f0
 	AUTOFS_SUPER_MAGIC                          = 0x187
 	B0                                          = 0x0
 	B110                                        = 0x3
@@ -156,7 +458,6 @@ const (
 	B600                                        = 0x8
 	B75                                         = 0x2
 	B9600                                       = 0xd
-	BALLOON_KVM_MAGIC                           = 0x13661366
 	BDEVFS_MAGIC                                = 0x62646576
 	BINDERFS_SUPER_MAGIC                        = 0x6c6f6f70
 	BINFMTFS_MAGIC                              = 0x42494e4d
@@ -183,6 +484,7 @@ const (
 	BPF_F_ALLOW_MULTI                           = 0x2
 	BPF_F_ALLOW_OVERRIDE                        = 0x1
 	BPF_F_ANY_ALIGNMENT                         = 0x2
+	BPF_F_KPROBE_MULTI_RETURN                   = 0x1
 	BPF_F_QUERY_EFFECTIVE                       = 0x1
 	BPF_F_REPLACE                               = 0x4
 	BPF_F_SLEEPABLE                             = 0x10
@@ -190,6 +492,8 @@ const (
 	BPF_F_TEST_RND_HI32                         = 0x4
 	BPF_F_TEST_RUN_ON_CPU                       = 0x1
 	BPF_F_TEST_STATE_FREQ                       = 0x8
+	BPF_F_TEST_XDP_LIVE_FRAMES                  = 0x2
+	BPF_F_XDP_HAS_FRAGS                         = 0x20
 	BPF_H                                       = 0x8
 	BPF_IMM                                     = 0x0
 	BPF_IND                                     = 0x40
@@ -259,12 +563,27 @@ const (
 	BUS_USB                                     = 0x3
 	BUS_VIRTUAL                                 = 0x6
 	CAN_BCM                                     = 0x2
+	CAN_BUS_OFF_THRESHOLD                       = 0x100
+	CAN_CTRLMODE_3_SAMPLES                      = 0x4
+	CAN_CTRLMODE_BERR_REPORTING                 = 0x10
+	CAN_CTRLMODE_CC_LEN8_DLC                    = 0x100
+	CAN_CTRLMODE_FD                             = 0x20
+	CAN_CTRLMODE_FD_NON_ISO                     = 0x80
+	CAN_CTRLMODE_LISTENONLY                     = 0x2
+	CAN_CTRLMODE_LOOPBACK                       = 0x1
+	CAN_CTRLMODE_ONE_SHOT                       = 0x8
+	CAN_CTRLMODE_PRESUME_ACK                    = 0x40
+	CAN_CTRLMODE_TDC_AUTO                       = 0x200
+	CAN_CTRLMODE_TDC_MANUAL                     = 0x400
 	CAN_EFF_FLAG                                = 0x80000000
 	CAN_EFF_ID_BITS                             = 0x1d
 	CAN_EFF_MASK                                = 0x1fffffff
+	CAN_ERROR_PASSIVE_THRESHOLD                 = 0x80
+	CAN_ERROR_WARNING_THRESHOLD                 = 0x60
 	CAN_ERR_ACK                                 = 0x20
 	CAN_ERR_BUSERROR                            = 0x80
 	CAN_ERR_BUSOFF                              = 0x40
+	CAN_ERR_CNT                                 = 0x200
 	CAN_ERR_CRTL                                = 0x4
 	CAN_ERR_CRTL_ACTIVE                         = 0x40
 	CAN_ERR_CRTL_RX_OVERFLOW                    = 0x1
@@ -336,6 +655,7 @@ const (
 	CAN_RTR_FLAG                                = 0x40000000
 	CAN_SFF_ID_BITS                             = 0xb
 	CAN_SFF_MASK                                = 0x7ff
+	CAN_TERMINATION_DISABLED                    = 0x0
 	CAN_TP16                                    = 0x3
 	CAN_TP20                                    = 0x4
 	CAP_AUDIT_CONTROL                           = 0x1e
@@ -380,9 +700,11 @@ const (
 	CAP_SYS_TIME                                = 0x19
 	CAP_SYS_TTY_CONFIG                          = 0x1a
 	CAP_WAKE_ALARM                              = 0x23
+	CEPH_SUPER_MAGIC                            = 0xc36400
 	CFLUSH                                      = 0xf
 	CGROUP2_SUPER_MAGIC                         = 0x63677270
 	CGROUP_SUPER_MAGIC                          = 0x27e0eb
+	CIFS_SUPER_MAGIC                            = 0xff534d42
 	CLOCK_BOOTTIME                              = 0x7
 	CLOCK_BOOTTIME_ALARM                        = 0x9
 	CLOCK_DEFAULT                               = 0x0
@@ -453,6 +775,8 @@ const (
 	DEVLINK_GENL_MCGRP_CONFIG_NAME              = "config"
 	DEVLINK_GENL_NAME                           = "devlink"
 	DEVLINK_GENL_VERSION                        = 0x1
+	DEVLINK_PORT_FN_CAP_MIGRATABLE              = 0x2
+	DEVLINK_PORT_FN_CAP_ROCE                    = 0x1
 	DEVLINK_SB_THRESHOLD_TO_ALPHA_MAX           = 0x14
 	DEVLINK_SUPPORTED_FLASH_OVERWRITE_SECTIONS  = 0x3
 	DEVMEM_MAGIC                                = 0x454d444d
@@ -502,9 +826,9 @@ const (
 	DM_UUID_FLAG                                = 0x4000
 	DM_UUID_LEN                                 = 0x81
 	DM_VERSION                                  = 0xc138fd00
-	DM_VERSION_EXTRA                            = "-ioctl (2021-03-22)"
+	DM_VERSION_EXTRA                            = "-ioctl (2022-07-28)"
 	DM_VERSION_MAJOR                            = 0x4
-	DM_VERSION_MINOR                            = 0x2d
+	DM_VERSION_MINOR                            = 0x2f
 	DM_VERSION_PATCHLEVEL                       = 0x0
 	DT_BLK                                      = 0x6
 	DT_CHR                                      = 0x2
@@ -520,6 +844,55 @@ const (
 	EFD_SEMAPHORE                               = 0x1
 	EFIVARFS_MAGIC                              = 0xde5e81e4
 	EFS_SUPER_MAGIC                             = 0x414a53
+	EM_386                                      = 0x3
+	EM_486                                      = 0x6
+	EM_68K                                      = 0x4
+	EM_860                                      = 0x7
+	EM_88K                                      = 0x5
+	EM_AARCH64                                  = 0xb7
+	EM_ALPHA                                    = 0x9026
+	EM_ALTERA_NIOS2                             = 0x71
+	EM_ARCOMPACT                                = 0x5d
+	EM_ARCV2                                    = 0xc3
+	EM_ARM                                      = 0x28
+	EM_BLACKFIN                                 = 0x6a
+	EM_BPF                                      = 0xf7
+	EM_CRIS                                     = 0x4c
+	EM_CSKY                                     = 0xfc
+	EM_CYGNUS_M32R                              = 0x9041
+	EM_CYGNUS_MN10300                           = 0xbeef
+	EM_FRV                                      = 0x5441
+	EM_H8_300                                   = 0x2e
+	EM_HEXAGON                                  = 0xa4
+	EM_IA_64                                    = 0x32
+	EM_LOONGARCH                                = 0x102
+	EM_M32                                      = 0x1
+	EM_M32R                                     = 0x58
+	EM_MICROBLAZE                               = 0xbd
+	EM_MIPS                                     = 0x8
+	EM_MIPS_RS3_LE                              = 0xa
+	EM_MIPS_RS4_BE                              = 0xa
+	EM_MN10300                                  = 0x59
+	EM_NDS32                                    = 0xa7
+	EM_NONE                                     = 0x0
+	EM_OPENRISC                                 = 0x5c
+	EM_PARISC                                   = 0xf
+	EM_PPC                                      = 0x14
+	EM_PPC64                                    = 0x15
+	EM_RISCV                                    = 0xf3
+	EM_S390                                     = 0x16
+	EM_S390_OLD                                 = 0xa390
+	EM_SH                                       = 0x2a
+	EM_SPARC                                    = 0x2
+	EM_SPARC32PLUS                              = 0x12
+	EM_SPARCV9                                  = 0x2b
+	EM_SPU                                      = 0x17
+	EM_TILEGX                                   = 0xbf
+	EM_TILEPRO                                  = 0xbc
+	EM_TI_C6000                                 = 0x8c
+	EM_UNICORE                                  = 0x6e
+	EM_X86_64                                   = 0x3e
+	EM_XTENSA                                   = 0x5e
 	ENCODING_DEFAULT                            = 0x0
 	ENCODING_FM_MARK                            = 0x3
 	ENCODING_FM_SPACE                           = 0x4
@@ -682,6 +1055,7 @@ const (
 	ETH_P_CAIF                                  = 0xf7
 	ETH_P_CAN                                   = 0xc
 	ETH_P_CANFD                                 = 0xd
+	ETH_P_CANXL                                 = 0xe
 	ETH_P_CFM                                   = 0x8902
 	ETH_P_CONTROL                               = 0x16
 	ETH_P_CUST                                  = 0x6006
@@ -693,10 +1067,12 @@ const (
 	ETH_P_DNA_RT                                = 0x6003
 	ETH_P_DSA                                   = 0x1b
 	ETH_P_DSA_8021Q                             = 0xdadb
+	ETH_P_DSA_A5PSW                             = 0xe001
 	ETH_P_ECONET                                = 0x18
 	ETH_P_EDSA                                  = 0xdada
 	ETH_P_ERSPAN                                = 0x88be
 	ETH_P_ERSPAN2                               = 0x22eb
+	ETH_P_ETHERCAT                              = 0x88a4
 	ETH_P_FCOE                                  = 0x8906
 	ETH_P_FIP                                   = 0x8914
 	ETH_P_HDLC                                  = 0x19
@@ -734,6 +1110,7 @@ const (
 	ETH_P_PPP_MP                                = 0x8
 	ETH_P_PPP_SES                               = 0x8864
 	ETH_P_PREAUTH                               = 0x88c7
+	ETH_P_PROFINET                              = 0x8892
 	ETH_P_PRP                                   = 0x88fb
 	ETH_P_PUP                                   = 0x200
 	ETH_P_PUPAT                                 = 0x201
@@ -741,6 +1118,7 @@ const (
 	ETH_P_QINQ2                                 = 0x9200
 	ETH_P_QINQ3                                 = 0x9300
 	ETH_P_RARP                                  = 0x8035
+	ETH_P_REALTEK                               = 0x8899
 	ETH_P_SCA                                   = 0x6007
 	ETH_P_SLOW                                  = 0x8809
 	ETH_P_SNAP                                  = 0x5
@@ -770,6 +1148,7 @@ const (
 	EV_SYN                                      = 0x0
 	EV_VERSION                                  = 0x10001
 	EXABYTE_ENABLE_NEST                         = 0xf0
+	EXFAT_SUPER_MAGIC                           = 0x2011bab0
 	EXT2_SUPER_MAGIC                            = 0xef53
 	EXT3_SUPER_MAGIC                            = 0xef53
 	EXT4_SUPER_MAGIC                            = 0xef53
@@ -810,16 +1189,23 @@ const (
 	FAN_EPIDFD                                  = -0x2
 	FAN_EVENT_INFO_TYPE_DFID                    = 0x3
 	FAN_EVENT_INFO_TYPE_DFID_NAME               = 0x2
+	FAN_EVENT_INFO_TYPE_ERROR                   = 0x5
 	FAN_EVENT_INFO_TYPE_FID                     = 0x1
+	FAN_EVENT_INFO_TYPE_NEW_DFID_NAME           = 0xc
+	FAN_EVENT_INFO_TYPE_OLD_DFID_NAME           = 0xa
 	FAN_EVENT_INFO_TYPE_PIDFD                   = 0x4
 	FAN_EVENT_METADATA_LEN                      = 0x18
 	FAN_EVENT_ON_CHILD                          = 0x8000000
+	FAN_FS_ERROR                                = 0x8000
 	FAN_MARK_ADD                                = 0x1
 	FAN_MARK_DONT_FOLLOW                        = 0x4
+	FAN_MARK_EVICTABLE                          = 0x200
 	FAN_MARK_FILESYSTEM                         = 0x100
 	FAN_MARK_FLUSH                              = 0x80
+	FAN_MARK_IGNORE                             = 0x400
 	FAN_MARK_IGNORED_MASK                       = 0x20
 	FAN_MARK_IGNORED_SURV_MODIFY                = 0x40
+	FAN_MARK_IGNORE_SURV                        = 0x440
 	FAN_MARK_INODE                              = 0x0
 	FAN_MARK_MOUNT                              = 0x10
 	FAN_MARK_ONLYDIR                            = 0x8
@@ -838,17 +1224,27 @@ const (
 	FAN_OPEN_EXEC_PERM                          = 0x40000
 	FAN_OPEN_PERM                               = 0x10000
 	FAN_Q_OVERFLOW                              = 0x4000
+	FAN_RENAME                                  = 0x10000000
 	FAN_REPORT_DFID_NAME                        = 0xc00
+	FAN_REPORT_DFID_NAME_TARGET                 = 0x1e00
 	FAN_REPORT_DIR_FID                          = 0x400
 	FAN_REPORT_FID                              = 0x200
 	FAN_REPORT_NAME                             = 0x800
 	FAN_REPORT_PIDFD                            = 0x80
+	FAN_REPORT_TARGET_FID                       = 0x1000
 	FAN_REPORT_TID                              = 0x100
 	FAN_UNLIMITED_MARKS                         = 0x20
 	FAN_UNLIMITED_QUEUE                         = 0x10
 	FD_CLOEXEC                                  = 0x1
 	FD_SETSIZE                                  = 0x400
 	FF0                                         = 0x0
+	FIB_RULE_DEV_DETACHED                       = 0x8
+	FIB_RULE_FIND_SADDR                         = 0x10000
+	FIB_RULE_IIF_DETACHED                       = 0x8
+	FIB_RULE_INVERT                             = 0x2
+	FIB_RULE_OIF_DETACHED                       = 0x10
+	FIB_RULE_PERMANENT                          = 0x1
+	FIB_RULE_UNRESOLVED                         = 0x4
 	FIDEDUPERANGE                               = 0xc0189436
 	FSCRYPT_KEY_DESCRIPTOR_SIZE                 = 0x8
 	FSCRYPT_KEY_DESC_PREFIX                     = "fscrypt:"
@@ -867,7 +1263,10 @@ const (
 	FSCRYPT_MODE_AES_128_CBC                    = 0x5
 	FSCRYPT_MODE_AES_128_CTS                    = 0x6
 	FSCRYPT_MODE_AES_256_CTS                    = 0x4
+	FSCRYPT_MODE_AES_256_HCTR2                  = 0xa
 	FSCRYPT_MODE_AES_256_XTS                    = 0x1
+	FSCRYPT_MODE_SM4_CTS                        = 0x8
+	FSCRYPT_MODE_SM4_XTS                        = 0x7
 	FSCRYPT_POLICY_FLAGS_PAD_16                 = 0x2
 	FSCRYPT_POLICY_FLAGS_PAD_32                 = 0x3
 	FSCRYPT_POLICY_FLAGS_PAD_4                  = 0x0
@@ -886,8 +1285,6 @@ const (
 	FS_ENCRYPTION_MODE_AES_256_GCM              = 0x2
 	FS_ENCRYPTION_MODE_AES_256_XTS              = 0x1
 	FS_ENCRYPTION_MODE_INVALID                  = 0x0
-	FS_ENCRYPTION_MODE_SPECK128_256_CTS         = 0x8
-	FS_ENCRYPTION_MODE_SPECK128_256_XTS         = 0x7
 	FS_IOC_ADD_ENCRYPTION_KEY                   = 0xc0506617
 	FS_IOC_GET_ENCRYPTION_KEY_STATUS            = 0xc080661a
 	FS_IOC_GET_ENCRYPTION_POLICY_EX             = 0xc0096616
@@ -911,6 +1308,7 @@ const (
 	FS_VERITY_METADATA_TYPE_DESCRIPTOR          = 0x2
 	FS_VERITY_METADATA_TYPE_MERKLE_TREE         = 0x1
 	FS_VERITY_METADATA_TYPE_SIGNATURE           = 0x3
+	FUSE_SUPER_MAGIC                            = 0x65735546
 	FUTEXFS_SUPER_MAGIC                         = 0xbad1dea
 	F_ADD_SEALS                                 = 0x409
 	F_DUPFD                                     = 0x0
@@ -1023,7 +1421,7 @@ const (
 	IFA_F_STABLE_PRIVACY                        = 0x800
 	IFA_F_TEMPORARY                             = 0x1
 	IFA_F_TENTATIVE                             = 0x40
-	IFA_MAX                                     = 0xa
+	IFA_MAX                                     = 0xb
 	IFF_ALLMULTI                                = 0x200
 	IFF_ATTACH_QUEUE                            = 0x200
 	IFF_AUTOMEDIA                               = 0x4000
@@ -1043,6 +1441,7 @@ const (
 	IFF_NOARP                                   = 0x80
 	IFF_NOFILTER                                = 0x1000
 	IFF_NOTRAILERS                              = 0x20
+	IFF_NO_CARRIER                              = 0x40
 	IFF_NO_PI                                   = 0x1000
 	IFF_ONE_QUEUE                               = 0x2000
 	IFF_PERSIST                                 = 0x800
@@ -1264,15 +1663,21 @@ const (
 	IP_XFRM_POLICY                              = 0x11
 	ISOFS_SUPER_MAGIC                           = 0x9660
 	ISTRIP                                      = 0x20
+	ITIMER_PROF                                 = 0x2
+	ITIMER_REAL                                 = 0x0
+	ITIMER_VIRTUAL                              = 0x1
 	IUTF8                                       = 0x4000
 	IXANY                                       = 0x800
 	JFFS2_SUPER_MAGIC                           = 0x72b6
+	KCMPROTO_CONNECTED                          = 0x0
+	KCM_RECV_DISABLE                            = 0x1
 	KEXEC_ARCH_386                              = 0x30000
 	KEXEC_ARCH_68K                              = 0x40000
 	KEXEC_ARCH_AARCH64                          = 0xb70000
 	KEXEC_ARCH_ARM                              = 0x280000
 	KEXEC_ARCH_DEFAULT                          = 0x0
 	KEXEC_ARCH_IA_64                            = 0x320000
+	KEXEC_ARCH_LOONGARCH                        = 0x1020000
 	KEXEC_ARCH_MASK                             = 0xffff0000
 	KEXEC_ARCH_MIPS                             = 0x80000
 	KEXEC_ARCH_MIPS_LE                          = 0xa0000
@@ -1365,8 +1770,10 @@ const (
 	LANDLOCK_ACCESS_FS_MAKE_SYM                 = 0x1000
 	LANDLOCK_ACCESS_FS_READ_DIR                 = 0x8
 	LANDLOCK_ACCESS_FS_READ_FILE                = 0x4
+	LANDLOCK_ACCESS_FS_REFER                    = 0x2000
 	LANDLOCK_ACCESS_FS_REMOVE_DIR               = 0x10
 	LANDLOCK_ACCESS_FS_REMOVE_FILE              = 0x20
+	LANDLOCK_ACCESS_FS_TRUNCATE                 = 0x4000
 	LANDLOCK_ACCESS_FS_WRITE_FILE               = 0x2
 	LANDLOCK_CREATE_RULESET_VERSION             = 0x1
 	LINUX_REBOOT_CMD_CAD_OFF                    = 0x0
@@ -1406,11 +1813,13 @@ const (
 	LWTUNNEL_IP_OPT_GENEVE_MAX                  = 0x3
 	LWTUNNEL_IP_OPT_VXLAN_MAX                   = 0x1
 	MADV_COLD                                   = 0x14
+	MADV_COLLAPSE                               = 0x19
 	MADV_DODUMP                                 = 0x11
 	MADV_DOFORK                                 = 0xb
 	MADV_DONTDUMP                               = 0x10
 	MADV_DONTFORK                               = 0xa
 	MADV_DONTNEED                               = 0x4
+	MADV_DONTNEED_LOCKED                        = 0x18
 	MADV_FREE                                   = 0x8
 	MADV_HUGEPAGE                               = 0xe
 	MADV_HWPOISON                               = 0x64
@@ -1452,7 +1861,7 @@ const (
 	MFD_ALLOW_SEALING                           = 0x2
 	MFD_CLOEXEC                                 = 0x1
 	MFD_HUGETLB                                 = 0x4
-	MFD_HUGE_16GB                               = -0x78000000
+	MFD_HUGE_16GB                               = 0x88000000
 	MFD_HUGE_16MB                               = 0x60000000
 	MFD_HUGE_1GB                                = 0x78000000
 	MFD_HUGE_1MB                                = 0x50000000
@@ -1474,8 +1883,21 @@ const (
 	MNT_DETACH                                  = 0x2
 	MNT_EXPIRE                                  = 0x4
 	MNT_FORCE                                   = 0x1
+	MODULE_INIT_COMPRESSED_FILE                 = 0x4
 	MODULE_INIT_IGNORE_MODVERSIONS              = 0x1
 	MODULE_INIT_IGNORE_VERMAGIC                 = 0x2
+	MOUNT_ATTR_IDMAP                            = 0x100000
+	MOUNT_ATTR_NOATIME                          = 0x10
+	MOUNT_ATTR_NODEV                            = 0x4
+	MOUNT_ATTR_NODIRATIME                       = 0x80
+	MOUNT_ATTR_NOEXEC                           = 0x8
+	MOUNT_ATTR_NOSUID                           = 0x2
+	MOUNT_ATTR_NOSYMFOLLOW                      = 0x200000
+	MOUNT_ATTR_RDONLY                           = 0x1
+	MOUNT_ATTR_RELATIME                         = 0x0
+	MOUNT_ATTR_SIZE_VER0                        = 0x20
+	MOUNT_ATTR_STRICTATIME                      = 0x20
+	MOUNT_ATTR__ATIME                           = 0x70
 	MSDOS_SUPER_MAGIC                           = 0x4d44
 	MSG_BATCH                                   = 0x40000
 	MSG_CMSG_CLOEXEC                            = 0x40000000
@@ -1707,6 +2129,7 @@ const (
 	NLM_F_ACK_TLVS                              = 0x200
 	NLM_F_APPEND                                = 0x800
 	NLM_F_ATOMIC                                = 0x400
+	NLM_F_BULK                                  = 0x200
 	NLM_F_CAPPED                                = 0x100
 	NLM_F_CREATE                                = 0x400
 	NLM_F_DUMP                                  = 0x300
@@ -1745,6 +2168,7 @@ const (
 	PACKET_FANOUT_DATA                          = 0x16
 	PACKET_FANOUT_EBPF                          = 0x7
 	PACKET_FANOUT_FLAG_DEFRAG                   = 0x8000
+	PACKET_FANOUT_FLAG_IGNORE_OUTGOING          = 0x4000
 	PACKET_FANOUT_FLAG_ROLLOVER                 = 0x1000
 	PACKET_FANOUT_FLAG_UNIQUEID                 = 0x2000
 	PACKET_FANOUT_HASH                          = 0x0
@@ -1804,6 +2228,11 @@ const (
 	PERF_AUX_FLAG_PARTIAL                       = 0x4
 	PERF_AUX_FLAG_PMU_FORMAT_TYPE_MASK          = 0xff00
 	PERF_AUX_FLAG_TRUNCATED                     = 0x1
+	PERF_BR_ARM64_DEBUG_DATA                    = 0x7
+	PERF_BR_ARM64_DEBUG_EXIT                    = 0x5
+	PERF_BR_ARM64_DEBUG_HALT                    = 0x4
+	PERF_BR_ARM64_DEBUG_INST                    = 0x6
+	PERF_BR_ARM64_FIQ                           = 0x3
 	PERF_FLAG_FD_CLOEXEC                        = 0x8
 	PERF_FLAG_FD_NO_GROUP                       = 0x1
 	PERF_FLAG_FD_OUTPUT                         = 0x2
@@ -1815,10 +2244,17 @@ const (
 	PERF_MEM_BLK_DATA                           = 0x2
 	PERF_MEM_BLK_NA                             = 0x1
 	PERF_MEM_BLK_SHIFT                          = 0x28
+	PERF_MEM_HOPS_0                             = 0x1
+	PERF_MEM_HOPS_1                             = 0x2
+	PERF_MEM_HOPS_2                             = 0x3
+	PERF_MEM_HOPS_3                             = 0x4
+	PERF_MEM_HOPS_SHIFT                         = 0x2b
 	PERF_MEM_LOCK_LOCKED                        = 0x2
 	PERF_MEM_LOCK_NA                            = 0x1
 	PERF_MEM_LOCK_SHIFT                         = 0x18
 	PERF_MEM_LVLNUM_ANY_CACHE                   = 0xb
+	PERF_MEM_LVLNUM_CXL                         = 0x9
+	PERF_MEM_LVLNUM_IO                          = 0xa
 	PERF_MEM_LVLNUM_L1                          = 0x1
 	PERF_MEM_LVLNUM_L2                          = 0x2
 	PERF_MEM_LVLNUM_L3                          = 0x3
@@ -1852,6 +2288,7 @@ const (
 	PERF_MEM_REMOTE_REMOTE                      = 0x1
 	PERF_MEM_REMOTE_SHIFT                       = 0x25
 	PERF_MEM_SNOOPX_FWD                         = 0x1
+	PERF_MEM_SNOOPX_PEER                        = 0x2
 	PERF_MEM_SNOOPX_SHIFT                       = 0x26
 	PERF_MEM_SNOOP_HIT                          = 0x4
 	PERF_MEM_SNOOP_HITM                         = 0x10
@@ -1888,7 +2325,6 @@ const (
 	PERF_SAMPLE_BRANCH_PLM_ALL                  = 0x7
 	PERF_SAMPLE_WEIGHT_TYPE                     = 0x1004000
 	PIPEFS_MAGIC                                = 0x50495045
-	PPC_CMM_MAGIC                               = 0xc7571590
 	PPPIOCGNPMODE                               = 0xc008744c
 	PPPIOCNEWUNIT                               = 0xc004743e
 	PRIO_PGRP                                   = 0x1
@@ -1974,6 +2410,9 @@ const (
 	PR_SCHED_CORE_CREATE                        = 0x1
 	PR_SCHED_CORE_GET                           = 0x0
 	PR_SCHED_CORE_MAX                           = 0x4
+	PR_SCHED_CORE_SCOPE_PROCESS_GROUP           = 0x2
+	PR_SCHED_CORE_SCOPE_THREAD                  = 0x0
+	PR_SCHED_CORE_SCOPE_THREAD_GROUP            = 0x1
 	PR_SCHED_CORE_SHARE_FROM                    = 0x3
 	PR_SCHED_CORE_SHARE_TO                      = 0x2
 	PR_SET_CHILD_SUBREAPER                      = 0x24
@@ -2014,6 +2453,13 @@ const (
 	PR_SET_TIMING                               = 0xe
 	PR_SET_TSC                                  = 0x1a
 	PR_SET_UNALIGN                              = 0x6
+	PR_SET_VMA                                  = 0x53564d41
+	PR_SET_VMA_ANON_NAME                        = 0x0
+	PR_SME_GET_VL                               = 0x40
+	PR_SME_SET_VL                               = 0x3f
+	PR_SME_SET_VL_ONEXEC                        = 0x40000
+	PR_SME_VL_INHERIT                           = 0x20000
+	PR_SME_VL_LEN_MASK                          = 0xffff
 	PR_SPEC_DISABLE                             = 0x4
 	PR_SPEC_DISABLE_NOEXEC                      = 0x10
 	PR_SPEC_ENABLE                              = 0x2
@@ -2097,6 +2543,10 @@ const (
 	PTRACE_SYSCALL_INFO_NONE                    = 0x0
 	PTRACE_SYSCALL_INFO_SECCOMP                 = 0x3
 	PTRACE_TRACEME                              = 0x0
+	P_ALL                                       = 0x0
+	P_PGID                                      = 0x2
+	P_PID                                       = 0x1
+	P_PIDFD                                     = 0x3
 	QNX4_SUPER_MAGIC                            = 0x2f
 	QNX6_SUPER_MAGIC                            = 0x68191122
 	RAMFS_MAGIC                                 = 0x858458f6
@@ -2155,12 +2605,24 @@ const (
 	RTCF_NAT                                    = 0x800000
 	RTCF_VALVE                                  = 0x200000
 	RTC_AF                                      = 0x20
+	RTC_BSM_DIRECT                              = 0x1
+	RTC_BSM_DISABLED                            = 0x0
+	RTC_BSM_LEVEL                               = 0x2
+	RTC_BSM_STANDBY                             = 0x3
 	RTC_FEATURE_ALARM                           = 0x0
+	RTC_FEATURE_ALARM_RES_2S                    = 0x3
 	RTC_FEATURE_ALARM_RES_MINUTE                = 0x1
-	RTC_FEATURE_CNT                             = 0x3
+	RTC_FEATURE_ALARM_WAKEUP_ONLY               = 0x7
+	RTC_FEATURE_BACKUP_SWITCH_MODE              = 0x6
+	RTC_FEATURE_CNT                             = 0x8
+	RTC_FEATURE_CORRECTION                      = 0x5
 	RTC_FEATURE_NEED_WEEK_DAY                   = 0x2
+	RTC_FEATURE_UPDATE_INTERRUPT                = 0x4
 	RTC_IRQF                                    = 0x80
 	RTC_MAX_FREQ                                = 0x2000
+	RTC_PARAM_BACKUP_SWITCH_MODE                = 0x2
+	RTC_PARAM_CORRECTION                        = 0x1
+	RTC_PARAM_FEATURES                          = 0x0
 	RTC_PF                                      = 0x40
 	RTC_UF                                      = 0x10
 	RTF_ADDRCLASSMASK                           = 0xf8000000
@@ -2226,6 +2688,7 @@ const (
 	RTM_DELRULE                                 = 0x21
 	RTM_DELTCLASS                               = 0x29
 	RTM_DELTFILTER                              = 0x2d
+	RTM_DELTUNNEL                               = 0x79
 	RTM_DELVLAN                                 = 0x71
 	RTM_F_CLONED                                = 0x200
 	RTM_F_EQUALIZE                              = 0x400
@@ -2258,8 +2721,9 @@ const (
 	RTM_GETSTATS                                = 0x5e
 	RTM_GETTCLASS                               = 0x2a
 	RTM_GETTFILTER                              = 0x2e
+	RTM_GETTUNNEL                               = 0x7a
 	RTM_GETVLAN                                 = 0x72
-	RTM_MAX                                     = 0x77
+	RTM_MAX                                     = 0x7b
 	RTM_NEWACTION                               = 0x30
 	RTM_NEWADDR                                 = 0x14
 	RTM_NEWADDRLABEL                            = 0x48
@@ -2283,11 +2747,13 @@ const (
 	RTM_NEWSTATS                                = 0x5c
 	RTM_NEWTCLASS                               = 0x28
 	RTM_NEWTFILTER                              = 0x2c
-	RTM_NR_FAMILIES                             = 0x1a
-	RTM_NR_MSGTYPES                             = 0x68
+	RTM_NEWTUNNEL                               = 0x78
+	RTM_NR_FAMILIES                             = 0x1b
+	RTM_NR_MSGTYPES                             = 0x6c
 	RTM_SETDCB                                  = 0x4f
 	RTM_SETLINK                                 = 0x13
 	RTM_SETNEIGHTBL                             = 0x43
+	RTM_SETSTATS                                = 0x5f
 	RTNH_ALIGNTO                                = 0x4
 	RTNH_COMPARE_MASK                           = 0x59
 	RTNH_F_DEAD                                 = 0x1
@@ -2411,6 +2877,9 @@ const (
 	SIOCGSTAMPNS                                = 0x8907
 	SIOCGSTAMPNS_OLD                            = 0x8907
 	SIOCGSTAMP_OLD                              = 0x8906
+	SIOCKCMATTACH                               = 0x89e0
+	SIOCKCMCLONE                                = 0x89e2
+	SIOCKCMUNATTACH                             = 0x89e1
 	SIOCOUTQNSD                                 = 0x894b
 	SIOCPROTOPRIVATE                            = 0x89e0
 	SIOCRTMSG                                   = 0x890d
@@ -2453,6 +2922,7 @@ const (
 	SMART_STATUS                                = 0xda
 	SMART_WRITE_LOG_SECTOR                      = 0xd6
 	SMART_WRITE_THRESHOLDS                      = 0xd7
+	SMB2_SUPER_MAGIC                            = 0xfe534d42
 	SMB_SUPER_MAGIC                             = 0x517b
 	SOCKFS_MAGIC                                = 0x534f434b
 	SOCK_BUF_LOCK_MASK                          = 0x3
@@ -2464,6 +2934,9 @@ const (
 	SOCK_RDM                                    = 0x4
 	SOCK_SEQPACKET                              = 0x5
 	SOCK_SNDBUF_LOCK                            = 0x1
+	SOCK_TXREHASH_DEFAULT                       = 0xff
+	SOCK_TXREHASH_DISABLED                      = 0x0
+	SOCK_TXREHASH_ENABLED                       = 0x1
 	SOL_AAL                                     = 0x109
 	SOL_ALG                                     = 0x117
 	SOL_ATM                                     = 0x108
@@ -2479,6 +2952,8 @@ const (
 	SOL_IUCV                                    = 0x115
 	SOL_KCM                                     = 0x119
 	SOL_LLC                                     = 0x10c
+	SOL_MCTP                                    = 0x11d
+	SOL_MPTCP                                   = 0x11c
 	SOL_NETBEUI                                 = 0x10b
 	SOL_NETLINK                                 = 0x10e
 	SOL_NFC                                     = 0x118
@@ -2488,9 +2963,11 @@ const (
 	SOL_RAW                                     = 0xff
 	SOL_RDS                                     = 0x114
 	SOL_RXRPC                                   = 0x110
+	SOL_SMC                                     = 0x11e
 	SOL_TCP                                     = 0x6
 	SOL_TIPC                                    = 0x10f
 	SOL_TLS                                     = 0x11a
+	SOL_UDP                                     = 0x11
 	SOL_X25                                     = 0x106
 	SOL_XDP                                     = 0x11b
 	SOMAXCONN                                   = 0x1000
@@ -2520,6 +2997,8 @@ const (
 	SO_VM_SOCKETS_BUFFER_MIN_SIZE               = 0x1
 	SO_VM_SOCKETS_BUFFER_SIZE                   = 0x0
 	SO_VM_SOCKETS_CONNECT_TIMEOUT               = 0x6
+	SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW           = 0x8
+	SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD           = 0x6
 	SO_VM_SOCKETS_NONBLOCK_TXRX                 = 0x7
 	SO_VM_SOCKETS_PEER_HOST_VM_ID               = 0x3
 	SO_VM_SOCKETS_TRUSTED                       = 0x5
@@ -2544,6 +3023,7 @@ const (
 	STATX_BLOCKS                                = 0x400
 	STATX_BTIME                                 = 0x800
 	STATX_CTIME                                 = 0x80
+	STATX_DIOALIGN                              = 0x2000
 	STATX_GID                                   = 0x10
 	STATX_INO                                   = 0x100
 	STATX_MNT_ID                                = 0x1000
@@ -2592,7 +3072,7 @@ const (
 	TASKSTATS_GENL_NAME                         = "TASKSTATS"
 	TASKSTATS_GENL_VERSION                      = 0x1
 	TASKSTATS_TYPE_MAX                          = 0x6
-	TASKSTATS_VERSION                           = 0xa
+	TASKSTATS_VERSION                           = 0xd
 	TCIFLUSH                                    = 0x0
 	TCIOFF                                      = 0x2
 	TCIOFLUSH                                   = 0x2
@@ -2772,6 +3252,19 @@ const (
 	TRACEFS_MAGIC                               = 0x74726163
 	TS_COMM_LEN                                 = 0x20
 	UDF_SUPER_MAGIC                             = 0x15013346
+	UDP_CORK                                    = 0x1
+	UDP_ENCAP                                   = 0x64
+	UDP_ENCAP_ESPINUDP                          = 0x2
+	UDP_ENCAP_ESPINUDP_NON_IKE                  = 0x1
+	UDP_ENCAP_GTP0                              = 0x4
+	UDP_ENCAP_GTP1U                             = 0x5
+	UDP_ENCAP_L2TPINUDP                         = 0x3
+	UDP_GRO                                     = 0x68
+	UDP_NO_CHECK6_RX                            = 0x66
+	UDP_NO_CHECK6_TX                            = 0x65
+	UDP_SEGMENT                                 = 0x67
+	UDP_V4_FLOW                                 = 0x2
+	UDP_V6_FLOW                                 = 0x6
 	UMOUNT_NOFOLLOW                             = 0x8
 	USBDEVICE_SUPER_MAGIC                       = 0x9fa2
 	UTIME_NOW                                   = 0x3fffffff
@@ -2814,6 +3307,13 @@ const (
 	WDIOS_TEMPPANIC                             = 0x4
 	WDIOS_UNKNOWN                               = -0x1
 	WEXITED                                     = 0x4
+	WGALLOWEDIP_A_MAX                           = 0x3
+	WGDEVICE_A_MAX                              = 0x8
+	WGPEER_A_MAX                                = 0xa
+	WG_CMD_MAX                                  = 0x1
+	WG_GENL_NAME                                = "wireguard"
+	WG_GENL_VERSION                             = 0x1
+	WG_KEY_LEN                                  = 0x20
 	WIN_ACKMEDIACHANGE                          = 0xdb
 	WIN_CHECKPOWERMODE1                         = 0xe5
 	WIN_CHECKPOWERMODE2                         = 0x98
@@ -2930,9 +3430,7 @@ const (
 	XDP_ZEROCOPY                                = 0x4
 	XENFS_SUPER_MAGIC                           = 0xabba1974
 	XFS_SUPER_MAGIC                             = 0x58465342
-	Z3FOLD_MAGIC                                = 0x33
 	ZONEFS_MAGIC                                = 0x5a4f4653
-	ZSMALLOC_MAGIC                              = 0x58295829
 	_HIDIOCGRAWNAME_LEN                         = 0x80
 	_HIDIOCGRAWPHYS_LEN                         = 0x40
 	_HIDIOCGRAWUNIQ_LEN                         = 0x40
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
index 80c790840c..a46df0f1e5 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include -m32
+// mkerrors.sh -Wall -Werror -static -I/tmp/386/include -m32
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build 386 && linux
 // +build 386,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -m32 /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/386/include -m32 _const.go
 
 package unix
 
@@ -133,6 +133,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x80044d07
 	MEMISLOCKED                      = 0x80084d17
 	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc03c4d1a
 	MEMREADOOB                       = 0xc00c4d04
 	MEMSETBADBLOCK                   = 0x40084d0c
 	MEMUNLOCK                        = 0x40084d06
@@ -250,6 +251,8 @@ const (
 	RTC_EPOCH_SET                    = 0x4004700e
 	RTC_IRQP_READ                    = 0x8004700b
 	RTC_IRQP_SET                     = 0x4004700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
 	RTC_PIE_OFF                      = 0x7006
 	RTC_PIE_ON                       = 0x7005
 	RTC_PLL_GET                      = 0x801c7011
@@ -324,9 +327,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x14
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -347,6 +352,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
index da55638a44..6cd4a3ea9d 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include -m64
+// mkerrors.sh -Wall -Werror -static -I/tmp/amd64/include -m64
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build amd64 && linux
 // +build amd64,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -m64 /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/amd64/include -m64 _const.go
 
 package unix
 
@@ -133,6 +133,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x80044d07
 	MEMISLOCKED                      = 0x80084d17
 	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x40084d0c
 	MEMUNLOCK                        = 0x40084d06
@@ -251,6 +252,8 @@ const (
 	RTC_EPOCH_SET                    = 0x4008700e
 	RTC_IRQP_READ                    = 0x8008700b
 	RTC_IRQP_SET                     = 0x4008700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
 	RTC_PIE_OFF                      = 0x7006
 	RTC_PIE_ON                       = 0x7005
 	RTC_PLL_GET                      = 0x80207011
@@ -325,9 +328,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x14
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -348,6 +353,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
index c3da063c70..c7ebee24df 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/arm/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm && linux
 // +build arm,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/arm/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x80044d07
 	MEMISLOCKED                      = 0x80084d17
 	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc00c4d04
 	MEMSETBADBLOCK                   = 0x40084d0c
 	MEMUNLOCK                        = 0x40084d06
@@ -257,6 +258,8 @@ const (
 	RTC_EPOCH_SET                    = 0x4004700e
 	RTC_IRQP_READ                    = 0x8004700b
 	RTC_IRQP_SET                     = 0x4004700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
 	RTC_PIE_OFF                      = 0x7006
 	RTC_PIE_ON                       = 0x7005
 	RTC_PLL_GET                      = 0x801c7011
@@ -331,9 +334,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x14
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -354,6 +359,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
index fd9f0d1dbf..9d5352c3e4 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include -fsigned-char
+// mkerrors.sh -Wall -Werror -static -I/tmp/arm64/include -fsigned-char
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm64 && linux
 // +build arm64,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -fsigned-char /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/arm64/include -fsigned-char _const.go
 
 package unix
 
@@ -134,6 +134,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x80044d07
 	MEMISLOCKED                      = 0x80084d17
 	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x40084d0c
 	MEMUNLOCK                        = 0x40084d06
@@ -247,6 +248,8 @@ const (
 	RTC_EPOCH_SET                    = 0x4008700e
 	RTC_IRQP_READ                    = 0x8008700b
 	RTC_IRQP_SET                     = 0x4008700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
 	RTC_PIE_OFF                      = 0x7006
 	RTC_PIE_ON                       = 0x7005
 	RTC_PLL_GET                      = 0x80207011
@@ -321,9 +324,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x14
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -344,6 +349,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
@@ -508,6 +514,7 @@ const (
 	WORDSIZE                         = 0x40
 	XCASE                            = 0x4
 	XTABS                            = 0x1800
+	ZA_MAGIC                         = 0x54366345
 	_HIDIOCGRAWNAME                  = 0x80804804
 	_HIDIOCGRAWPHYS                  = 0x80404805
 	_HIDIOCGRAWUNIQ                  = 0x80404808
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
new file mode 100644
index 0000000000..f26a164f4a
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
@@ -0,0 +1,819 @@
+// mkerrors.sh -Wall -Werror -static -I/tmp/loong64/include
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build loong64 && linux
+// +build loong64,linux
+
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs -- -Wall -Werror -static -I/tmp/loong64/include _const.go
+
+package unix
+
+import "syscall"
+
+const (
+	B1000000                         = 0x1008
+	B115200                          = 0x1002
+	B1152000                         = 0x1009
+	B1500000                         = 0x100a
+	B2000000                         = 0x100b
+	B230400                          = 0x1003
+	B2500000                         = 0x100c
+	B3000000                         = 0x100d
+	B3500000                         = 0x100e
+	B4000000                         = 0x100f
+	B460800                          = 0x1004
+	B500000                          = 0x1005
+	B57600                           = 0x1001
+	B576000                          = 0x1006
+	B921600                          = 0x1007
+	BLKBSZGET                        = 0x80081270
+	BLKBSZSET                        = 0x40081271
+	BLKFLSBUF                        = 0x1261
+	BLKFRAGET                        = 0x1265
+	BLKFRASET                        = 0x1264
+	BLKGETSIZE                       = 0x1260
+	BLKGETSIZE64                     = 0x80081272
+	BLKPBSZGET                       = 0x127b
+	BLKRAGET                         = 0x1263
+	BLKRASET                         = 0x1262
+	BLKROGET                         = 0x125e
+	BLKROSET                         = 0x125d
+	BLKRRPART                        = 0x125f
+	BLKSECTGET                       = 0x1267
+	BLKSECTSET                       = 0x1266
+	BLKSSZGET                        = 0x1268
+	BOTHER                           = 0x1000
+	BS1                              = 0x2000
+	BSDLY                            = 0x2000
+	CBAUD                            = 0x100f
+	CBAUDEX                          = 0x1000
+	CIBAUD                           = 0x100f0000
+	CLOCAL                           = 0x800
+	CR1                              = 0x200
+	CR2                              = 0x400
+	CR3                              = 0x600
+	CRDLY                            = 0x600
+	CREAD                            = 0x80
+	CS6                              = 0x10
+	CS7                              = 0x20
+	CS8                              = 0x30
+	CSIZE                            = 0x30
+	CSTOPB                           = 0x40
+	ECCGETLAYOUT                     = 0x81484d11
+	ECCGETSTATS                      = 0x80104d12
+	ECHOCTL                          = 0x200
+	ECHOE                            = 0x10
+	ECHOK                            = 0x20
+	ECHOKE                           = 0x800
+	ECHONL                           = 0x40
+	ECHOPRT                          = 0x400
+	EFD_CLOEXEC                      = 0x80000
+	EFD_NONBLOCK                     = 0x800
+	EPOLL_CLOEXEC                    = 0x80000
+	EXTPROC                          = 0x10000
+	FF1                              = 0x8000
+	FFDLY                            = 0x8000
+	FICLONE                          = 0x40049409
+	FICLONERANGE                     = 0x4020940d
+	FLUSHO                           = 0x1000
+	FPU_CTX_MAGIC                    = 0x46505501
+	FS_IOC_ENABLE_VERITY             = 0x40806685
+	FS_IOC_GETFLAGS                  = 0x80086601
+	FS_IOC_GET_ENCRYPTION_NONCE      = 0x8010661b
+	FS_IOC_GET_ENCRYPTION_POLICY     = 0x400c6615
+	FS_IOC_GET_ENCRYPTION_PWSALT     = 0x40106614
+	FS_IOC_SETFLAGS                  = 0x40086602
+	FS_IOC_SET_ENCRYPTION_POLICY     = 0x800c6613
+	F_GETLK                          = 0x5
+	F_GETLK64                        = 0x5
+	F_GETOWN                         = 0x9
+	F_RDLCK                          = 0x0
+	F_SETLK                          = 0x6
+	F_SETLK64                        = 0x6
+	F_SETLKW                         = 0x7
+	F_SETLKW64                       = 0x7
+	F_SETOWN                         = 0x8
+	F_UNLCK                          = 0x2
+	F_WRLCK                          = 0x1
+	HIDIOCGRAWINFO                   = 0x80084803
+	HIDIOCGRDESC                     = 0x90044802
+	HIDIOCGRDESCSIZE                 = 0x80044801
+	HUPCL                            = 0x400
+	ICANON                           = 0x2
+	IEXTEN                           = 0x8000
+	IN_CLOEXEC                       = 0x80000
+	IN_NONBLOCK                      = 0x800
+	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
+	ISIG                             = 0x1
+	IUCLC                            = 0x200
+	IXOFF                            = 0x1000
+	IXON                             = 0x400
+	MAP_ANON                         = 0x20
+	MAP_ANONYMOUS                    = 0x20
+	MAP_DENYWRITE                    = 0x800
+	MAP_EXECUTABLE                   = 0x1000
+	MAP_GROWSDOWN                    = 0x100
+	MAP_HUGETLB                      = 0x40000
+	MAP_LOCKED                       = 0x2000
+	MAP_NONBLOCK                     = 0x10000
+	MAP_NORESERVE                    = 0x4000
+	MAP_POPULATE                     = 0x8000
+	MAP_STACK                        = 0x20000
+	MAP_SYNC                         = 0x80000
+	MCL_CURRENT                      = 0x1
+	MCL_FUTURE                       = 0x2
+	MCL_ONFAULT                      = 0x4
+	MEMERASE                         = 0x40084d02
+	MEMERASE64                       = 0x40104d14
+	MEMGETBADBLOCK                   = 0x40084d0b
+	MEMGETINFO                       = 0x80204d01
+	MEMGETOOBSEL                     = 0x80c84d0a
+	MEMGETREGIONCOUNT                = 0x80044d07
+	MEMISLOCKED                      = 0x80084d17
+	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc0404d1a
+	MEMREADOOB                       = 0xc0104d04
+	MEMSETBADBLOCK                   = 0x40084d0c
+	MEMUNLOCK                        = 0x40084d06
+	MEMWRITEOOB                      = 0xc0104d03
+	MTDFILEMODE                      = 0x4d13
+	NFDBITS                          = 0x40
+	NLDLY                            = 0x100
+	NOFLSH                           = 0x80
+	NS_GET_NSTYPE                    = 0xb703
+	NS_GET_OWNER_UID                 = 0xb704
+	NS_GET_PARENT                    = 0xb702
+	NS_GET_USERNS                    = 0xb701
+	OLCUC                            = 0x2
+	ONLCR                            = 0x4
+	OTPERASE                         = 0x400c4d19
+	OTPGETREGIONCOUNT                = 0x40044d0e
+	OTPGETREGIONINFO                 = 0x400c4d0f
+	OTPLOCK                          = 0x800c4d10
+	OTPSELECT                        = 0x80044d0d
+	O_APPEND                         = 0x400
+	O_ASYNC                          = 0x2000
+	O_CLOEXEC                        = 0x80000
+	O_CREAT                          = 0x40
+	O_DIRECT                         = 0x4000
+	O_DIRECTORY                      = 0x10000
+	O_DSYNC                          = 0x1000
+	O_EXCL                           = 0x80
+	O_FSYNC                          = 0x101000
+	O_LARGEFILE                      = 0x0
+	O_NDELAY                         = 0x800
+	O_NOATIME                        = 0x40000
+	O_NOCTTY                         = 0x100
+	O_NOFOLLOW                       = 0x20000
+	O_NONBLOCK                       = 0x800
+	O_PATH                           = 0x200000
+	O_RSYNC                          = 0x101000
+	O_SYNC                           = 0x101000
+	O_TMPFILE                        = 0x410000
+	O_TRUNC                          = 0x200
+	PARENB                           = 0x100
+	PARODD                           = 0x200
+	PENDIN                           = 0x4000
+	PERF_EVENT_IOC_DISABLE           = 0x2401
+	PERF_EVENT_IOC_ENABLE            = 0x2400
+	PERF_EVENT_IOC_ID                = 0x80082407
+	PERF_EVENT_IOC_MODIFY_ATTRIBUTES = 0x4008240b
+	PERF_EVENT_IOC_PAUSE_OUTPUT      = 0x40042409
+	PERF_EVENT_IOC_PERIOD            = 0x40082404
+	PERF_EVENT_IOC_QUERY_BPF         = 0xc008240a
+	PERF_EVENT_IOC_REFRESH           = 0x2402
+	PERF_EVENT_IOC_RESET             = 0x2403
+	PERF_EVENT_IOC_SET_BPF           = 0x40042408
+	PERF_EVENT_IOC_SET_FILTER        = 0x40082406
+	PERF_EVENT_IOC_SET_OUTPUT        = 0x2405
+	PPPIOCATTACH                     = 0x4004743d
+	PPPIOCATTCHAN                    = 0x40047438
+	PPPIOCBRIDGECHAN                 = 0x40047435
+	PPPIOCCONNECT                    = 0x4004743a
+	PPPIOCDETACH                     = 0x4004743c
+	PPPIOCDISCONN                    = 0x7439
+	PPPIOCGASYNCMAP                  = 0x80047458
+	PPPIOCGCHAN                      = 0x80047437
+	PPPIOCGDEBUG                     = 0x80047441
+	PPPIOCGFLAGS                     = 0x8004745a
+	PPPIOCGIDLE                      = 0x8010743f
+	PPPIOCGIDLE32                    = 0x8008743f
+	PPPIOCGIDLE64                    = 0x8010743f
+	PPPIOCGL2TPSTATS                 = 0x80487436
+	PPPIOCGMRU                       = 0x80047453
+	PPPIOCGRASYNCMAP                 = 0x80047455
+	PPPIOCGUNIT                      = 0x80047456
+	PPPIOCGXASYNCMAP                 = 0x80207450
+	PPPIOCSACTIVE                    = 0x40107446
+	PPPIOCSASYNCMAP                  = 0x40047457
+	PPPIOCSCOMPRESS                  = 0x4010744d
+	PPPIOCSDEBUG                     = 0x40047440
+	PPPIOCSFLAGS                     = 0x40047459
+	PPPIOCSMAXCID                    = 0x40047451
+	PPPIOCSMRRU                      = 0x4004743b
+	PPPIOCSMRU                       = 0x40047452
+	PPPIOCSNPMODE                    = 0x4008744b
+	PPPIOCSPASS                      = 0x40107447
+	PPPIOCSRASYNCMAP                 = 0x40047454
+	PPPIOCSXASYNCMAP                 = 0x4020744f
+	PPPIOCUNBRIDGECHAN               = 0x7434
+	PPPIOCXFERUNIT                   = 0x744e
+	PR_SET_PTRACER_ANY               = 0xffffffffffffffff
+	PTRACE_SYSEMU                    = 0x1f
+	PTRACE_SYSEMU_SINGLESTEP         = 0x20
+	RLIMIT_AS                        = 0x9
+	RLIMIT_MEMLOCK                   = 0x8
+	RLIMIT_NOFILE                    = 0x7
+	RLIMIT_NPROC                     = 0x6
+	RLIMIT_RSS                       = 0x5
+	RNDADDENTROPY                    = 0x40085203
+	RNDADDTOENTCNT                   = 0x40045201
+	RNDCLEARPOOL                     = 0x5206
+	RNDGETENTCNT                     = 0x80045200
+	RNDGETPOOL                       = 0x80085202
+	RNDRESEEDCRNG                    = 0x5207
+	RNDZAPENTCNT                     = 0x5204
+	RTC_AIE_OFF                      = 0x7002
+	RTC_AIE_ON                       = 0x7001
+	RTC_ALM_READ                     = 0x80247008
+	RTC_ALM_SET                      = 0x40247007
+	RTC_EPOCH_READ                   = 0x8008700d
+	RTC_EPOCH_SET                    = 0x4008700e
+	RTC_IRQP_READ                    = 0x8008700b
+	RTC_IRQP_SET                     = 0x4008700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
+	RTC_PIE_OFF                      = 0x7006
+	RTC_PIE_ON                       = 0x7005
+	RTC_PLL_GET                      = 0x80207011
+	RTC_PLL_SET                      = 0x40207012
+	RTC_RD_TIME                      = 0x80247009
+	RTC_SET_TIME                     = 0x4024700a
+	RTC_UIE_OFF                      = 0x7004
+	RTC_UIE_ON                       = 0x7003
+	RTC_VL_CLR                       = 0x7014
+	RTC_VL_READ                      = 0x80047013
+	RTC_WIE_OFF                      = 0x7010
+	RTC_WIE_ON                       = 0x700f
+	RTC_WKALM_RD                     = 0x80287010
+	RTC_WKALM_SET                    = 0x4028700f
+	SCM_TIMESTAMPING                 = 0x25
+	SCM_TIMESTAMPING_OPT_STATS       = 0x36
+	SCM_TIMESTAMPING_PKTINFO         = 0x3a
+	SCM_TIMESTAMPNS                  = 0x23
+	SCM_TXTIME                       = 0x3d
+	SCM_WIFI_STATUS                  = 0x29
+	SFD_CLOEXEC                      = 0x80000
+	SFD_NONBLOCK                     = 0x800
+	SIOCATMARK                       = 0x8905
+	SIOCGPGRP                        = 0x8904
+	SIOCGSTAMPNS_NEW                 = 0x80108907
+	SIOCGSTAMP_NEW                   = 0x80108906
+	SIOCINQ                          = 0x541b
+	SIOCOUTQ                         = 0x5411
+	SIOCSPGRP                        = 0x8902
+	SOCK_CLOEXEC                     = 0x80000
+	SOCK_DGRAM                       = 0x2
+	SOCK_NONBLOCK                    = 0x800
+	SOCK_STREAM                      = 0x1
+	SOL_SOCKET                       = 0x1
+	SO_ACCEPTCONN                    = 0x1e
+	SO_ATTACH_BPF                    = 0x32
+	SO_ATTACH_REUSEPORT_CBPF         = 0x33
+	SO_ATTACH_REUSEPORT_EBPF         = 0x34
+	SO_BINDTODEVICE                  = 0x19
+	SO_BINDTOIFINDEX                 = 0x3e
+	SO_BPF_EXTENSIONS                = 0x30
+	SO_BROADCAST                     = 0x6
+	SO_BSDCOMPAT                     = 0xe
+	SO_BUF_LOCK                      = 0x48
+	SO_BUSY_POLL                     = 0x2e
+	SO_BUSY_POLL_BUDGET              = 0x46
+	SO_CNX_ADVICE                    = 0x35
+	SO_COOKIE                        = 0x39
+	SO_DETACH_REUSEPORT_BPF          = 0x44
+	SO_DOMAIN                        = 0x27
+	SO_DONTROUTE                     = 0x5
+	SO_ERROR                         = 0x4
+	SO_INCOMING_CPU                  = 0x31
+	SO_INCOMING_NAPI_ID              = 0x38
+	SO_KEEPALIVE                     = 0x9
+	SO_LINGER                        = 0xd
+	SO_LOCK_FILTER                   = 0x2c
+	SO_MARK                          = 0x24
+	SO_MAX_PACING_RATE               = 0x2f
+	SO_MEMINFO                       = 0x37
+	SO_NETNS_COOKIE                  = 0x47
+	SO_NOFCS                         = 0x2b
+	SO_OOBINLINE                     = 0xa
+	SO_PASSCRED                      = 0x10
+	SO_PASSSEC                       = 0x22
+	SO_PEEK_OFF                      = 0x2a
+	SO_PEERCRED                      = 0x11
+	SO_PEERGROUPS                    = 0x3b
+	SO_PEERSEC                       = 0x1f
+	SO_PREFER_BUSY_POLL              = 0x45
+	SO_PROTOCOL                      = 0x26
+	SO_RCVBUF                        = 0x8
+	SO_RCVBUFFORCE                   = 0x21
+	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
+	SO_RCVTIMEO                      = 0x14
+	SO_RCVTIMEO_NEW                  = 0x42
+	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
+	SO_REUSEADDR                     = 0x2
+	SO_REUSEPORT                     = 0xf
+	SO_RXQ_OVFL                      = 0x28
+	SO_SECURITY_AUTHENTICATION       = 0x16
+	SO_SECURITY_ENCRYPTION_NETWORK   = 0x18
+	SO_SECURITY_ENCRYPTION_TRANSPORT = 0x17
+	SO_SELECT_ERR_QUEUE              = 0x2d
+	SO_SNDBUF                        = 0x7
+	SO_SNDBUFFORCE                   = 0x20
+	SO_SNDLOWAT                      = 0x13
+	SO_SNDTIMEO                      = 0x15
+	SO_SNDTIMEO_NEW                  = 0x43
+	SO_SNDTIMEO_OLD                  = 0x15
+	SO_TIMESTAMPING                  = 0x25
+	SO_TIMESTAMPING_NEW              = 0x41
+	SO_TIMESTAMPING_OLD              = 0x25
+	SO_TIMESTAMPNS                   = 0x23
+	SO_TIMESTAMPNS_NEW               = 0x40
+	SO_TIMESTAMPNS_OLD               = 0x23
+	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
+	SO_TXTIME                        = 0x3d
+	SO_TYPE                          = 0x3
+	SO_WIFI_STATUS                   = 0x29
+	SO_ZEROCOPY                      = 0x3c
+	TAB1                             = 0x800
+	TAB2                             = 0x1000
+	TAB3                             = 0x1800
+	TABDLY                           = 0x1800
+	TCFLSH                           = 0x540b
+	TCGETA                           = 0x5405
+	TCGETS                           = 0x5401
+	TCGETS2                          = 0x802c542a
+	TCGETX                           = 0x5432
+	TCSAFLUSH                        = 0x2
+	TCSBRK                           = 0x5409
+	TCSBRKP                          = 0x5425
+	TCSETA                           = 0x5406
+	TCSETAF                          = 0x5408
+	TCSETAW                          = 0x5407
+	TCSETS                           = 0x5402
+	TCSETS2                          = 0x402c542b
+	TCSETSF                          = 0x5404
+	TCSETSF2                         = 0x402c542d
+	TCSETSW                          = 0x5403
+	TCSETSW2                         = 0x402c542c
+	TCSETX                           = 0x5433
+	TCSETXF                          = 0x5434
+	TCSETXW                          = 0x5435
+	TCXONC                           = 0x540a
+	TFD_CLOEXEC                      = 0x80000
+	TFD_NONBLOCK                     = 0x800
+	TIOCCBRK                         = 0x5428
+	TIOCCONS                         = 0x541d
+	TIOCEXCL                         = 0x540c
+	TIOCGDEV                         = 0x80045432
+	TIOCGETD                         = 0x5424
+	TIOCGEXCL                        = 0x80045440
+	TIOCGICOUNT                      = 0x545d
+	TIOCGISO7816                     = 0x80285442
+	TIOCGLCKTRMIOS                   = 0x5456
+	TIOCGPGRP                        = 0x540f
+	TIOCGPKT                         = 0x80045438
+	TIOCGPTLCK                       = 0x80045439
+	TIOCGPTN                         = 0x80045430
+	TIOCGPTPEER                      = 0x5441
+	TIOCGRS485                       = 0x542e
+	TIOCGSERIAL                      = 0x541e
+	TIOCGSID                         = 0x5429
+	TIOCGSOFTCAR                     = 0x5419
+	TIOCGWINSZ                       = 0x5413
+	TIOCINQ                          = 0x541b
+	TIOCLINUX                        = 0x541c
+	TIOCMBIC                         = 0x5417
+	TIOCMBIS                         = 0x5416
+	TIOCMGET                         = 0x5415
+	TIOCMIWAIT                       = 0x545c
+	TIOCMSET                         = 0x5418
+	TIOCM_CAR                        = 0x40
+	TIOCM_CD                         = 0x40
+	TIOCM_CTS                        = 0x20
+	TIOCM_DSR                        = 0x100
+	TIOCM_RI                         = 0x80
+	TIOCM_RNG                        = 0x80
+	TIOCM_SR                         = 0x10
+	TIOCM_ST                         = 0x8
+	TIOCNOTTY                        = 0x5422
+	TIOCNXCL                         = 0x540d
+	TIOCOUTQ                         = 0x5411
+	TIOCPKT                          = 0x5420
+	TIOCSBRK                         = 0x5427
+	TIOCSCTTY                        = 0x540e
+	TIOCSERCONFIG                    = 0x5453
+	TIOCSERGETLSR                    = 0x5459
+	TIOCSERGETMULTI                  = 0x545a
+	TIOCSERGSTRUCT                   = 0x5458
+	TIOCSERGWILD                     = 0x5454
+	TIOCSERSETMULTI                  = 0x545b
+	TIOCSERSWILD                     = 0x5455
+	TIOCSER_TEMT                     = 0x1
+	TIOCSETD                         = 0x5423
+	TIOCSIG                          = 0x40045436
+	TIOCSISO7816                     = 0xc0285443
+	TIOCSLCKTRMIOS                   = 0x5457
+	TIOCSPGRP                        = 0x5410
+	TIOCSPTLCK                       = 0x40045431
+	TIOCSRS485                       = 0x542f
+	TIOCSSERIAL                      = 0x541f
+	TIOCSSOFTCAR                     = 0x541a
+	TIOCSTI                          = 0x5412
+	TIOCSWINSZ                       = 0x5414
+	TIOCVHANGUP                      = 0x5437
+	TOSTOP                           = 0x100
+	TUNATTACHFILTER                  = 0x401054d5
+	TUNDETACHFILTER                  = 0x401054d6
+	TUNGETDEVNETNS                   = 0x54e3
+	TUNGETFEATURES                   = 0x800454cf
+	TUNGETFILTER                     = 0x801054db
+	TUNGETIFF                        = 0x800454d2
+	TUNGETSNDBUF                     = 0x800454d3
+	TUNGETVNETBE                     = 0x800454df
+	TUNGETVNETHDRSZ                  = 0x800454d7
+	TUNGETVNETLE                     = 0x800454dd
+	TUNSETCARRIER                    = 0x400454e2
+	TUNSETDEBUG                      = 0x400454c9
+	TUNSETFILTEREBPF                 = 0x800454e1
+	TUNSETGROUP                      = 0x400454ce
+	TUNSETIFF                        = 0x400454ca
+	TUNSETIFINDEX                    = 0x400454da
+	TUNSETLINK                       = 0x400454cd
+	TUNSETNOCSUM                     = 0x400454c8
+	TUNSETOFFLOAD                    = 0x400454d0
+	TUNSETOWNER                      = 0x400454cc
+	TUNSETPERSIST                    = 0x400454cb
+	TUNSETQUEUE                      = 0x400454d9
+	TUNSETSNDBUF                     = 0x400454d4
+	TUNSETSTEERINGEBPF               = 0x800454e0
+	TUNSETTXFILTER                   = 0x400454d1
+	TUNSETVNETBE                     = 0x400454de
+	TUNSETVNETHDRSZ                  = 0x400454d8
+	TUNSETVNETLE                     = 0x400454dc
+	UBI_IOCATT                       = 0x40186f40
+	UBI_IOCDET                       = 0x40046f41
+	UBI_IOCEBCH                      = 0x40044f02
+	UBI_IOCEBER                      = 0x40044f01
+	UBI_IOCEBISMAP                   = 0x80044f05
+	UBI_IOCEBMAP                     = 0x40084f03
+	UBI_IOCEBUNMAP                   = 0x40044f04
+	UBI_IOCMKVOL                     = 0x40986f00
+	UBI_IOCRMVOL                     = 0x40046f01
+	UBI_IOCRNVOL                     = 0x51106f03
+	UBI_IOCRPEB                      = 0x40046f04
+	UBI_IOCRSVOL                     = 0x400c6f02
+	UBI_IOCSETVOLPROP                = 0x40104f06
+	UBI_IOCSPEB                      = 0x40046f05
+	UBI_IOCVOLCRBLK                  = 0x40804f07
+	UBI_IOCVOLRMBLK                  = 0x4f08
+	UBI_IOCVOLUP                     = 0x40084f00
+	VDISCARD                         = 0xd
+	VEOF                             = 0x4
+	VEOL                             = 0xb
+	VEOL2                            = 0x10
+	VMIN                             = 0x6
+	VREPRINT                         = 0xc
+	VSTART                           = 0x8
+	VSTOP                            = 0x9
+	VSUSP                            = 0xa
+	VSWTC                            = 0x7
+	VT1                              = 0x4000
+	VTDLY                            = 0x4000
+	VTIME                            = 0x5
+	VWERASE                          = 0xe
+	WDIOC_GETBOOTSTATUS              = 0x80045702
+	WDIOC_GETPRETIMEOUT              = 0x80045709
+	WDIOC_GETSTATUS                  = 0x80045701
+	WDIOC_GETSUPPORT                 = 0x80285700
+	WDIOC_GETTEMP                    = 0x80045703
+	WDIOC_GETTIMELEFT                = 0x8004570a
+	WDIOC_GETTIMEOUT                 = 0x80045707
+	WDIOC_KEEPALIVE                  = 0x80045705
+	WDIOC_SETOPTIONS                 = 0x80045704
+	WORDSIZE                         = 0x40
+	XCASE                            = 0x4
+	XTABS                            = 0x1800
+	_HIDIOCGRAWNAME                  = 0x80804804
+	_HIDIOCGRAWPHYS                  = 0x80404805
+	_HIDIOCGRAWUNIQ                  = 0x80404808
+)
+
+// Errors
+const (
+	EADDRINUSE      = syscall.Errno(0x62)
+	EADDRNOTAVAIL   = syscall.Errno(0x63)
+	EADV            = syscall.Errno(0x44)
+	EAFNOSUPPORT    = syscall.Errno(0x61)
+	EALREADY        = syscall.Errno(0x72)
+	EBADE           = syscall.Errno(0x34)
+	EBADFD          = syscall.Errno(0x4d)
+	EBADMSG         = syscall.Errno(0x4a)
+	EBADR           = syscall.Errno(0x35)
+	EBADRQC         = syscall.Errno(0x38)
+	EBADSLT         = syscall.Errno(0x39)
+	EBFONT          = syscall.Errno(0x3b)
+	ECANCELED       = syscall.Errno(0x7d)
+	ECHRNG          = syscall.Errno(0x2c)
+	ECOMM           = syscall.Errno(0x46)
+	ECONNABORTED    = syscall.Errno(0x67)
+	ECONNREFUSED    = syscall.Errno(0x6f)
+	ECONNRESET      = syscall.Errno(0x68)
+	EDEADLK         = syscall.Errno(0x23)
+	EDEADLOCK       = syscall.Errno(0x23)
+	EDESTADDRREQ    = syscall.Errno(0x59)
+	EDOTDOT         = syscall.Errno(0x49)
+	EDQUOT          = syscall.Errno(0x7a)
+	EHOSTDOWN       = syscall.Errno(0x70)
+	EHOSTUNREACH    = syscall.Errno(0x71)
+	EHWPOISON       = syscall.Errno(0x85)
+	EIDRM           = syscall.Errno(0x2b)
+	EILSEQ          = syscall.Errno(0x54)
+	EINPROGRESS     = syscall.Errno(0x73)
+	EISCONN         = syscall.Errno(0x6a)
+	EISNAM          = syscall.Errno(0x78)
+	EKEYEXPIRED     = syscall.Errno(0x7f)
+	EKEYREJECTED    = syscall.Errno(0x81)
+	EKEYREVOKED     = syscall.Errno(0x80)
+	EL2HLT          = syscall.Errno(0x33)
+	EL2NSYNC        = syscall.Errno(0x2d)
+	EL3HLT          = syscall.Errno(0x2e)
+	EL3RST          = syscall.Errno(0x2f)
+	ELIBACC         = syscall.Errno(0x4f)
+	ELIBBAD         = syscall.Errno(0x50)
+	ELIBEXEC        = syscall.Errno(0x53)
+	ELIBMAX         = syscall.Errno(0x52)
+	ELIBSCN         = syscall.Errno(0x51)
+	ELNRNG          = syscall.Errno(0x30)
+	ELOOP           = syscall.Errno(0x28)
+	EMEDIUMTYPE     = syscall.Errno(0x7c)
+	EMSGSIZE        = syscall.Errno(0x5a)
+	EMULTIHOP       = syscall.Errno(0x48)
+	ENAMETOOLONG    = syscall.Errno(0x24)
+	ENAVAIL         = syscall.Errno(0x77)
+	ENETDOWN        = syscall.Errno(0x64)
+	ENETRESET       = syscall.Errno(0x66)
+	ENETUNREACH     = syscall.Errno(0x65)
+	ENOANO          = syscall.Errno(0x37)
+	ENOBUFS         = syscall.Errno(0x69)
+	ENOCSI          = syscall.Errno(0x32)
+	ENODATA         = syscall.Errno(0x3d)
+	ENOKEY          = syscall.Errno(0x7e)
+	ENOLCK          = syscall.Errno(0x25)
+	ENOLINK         = syscall.Errno(0x43)
+	ENOMEDIUM       = syscall.Errno(0x7b)
+	ENOMSG          = syscall.Errno(0x2a)
+	ENONET          = syscall.Errno(0x40)
+	ENOPKG          = syscall.Errno(0x41)
+	ENOPROTOOPT     = syscall.Errno(0x5c)
+	ENOSR           = syscall.Errno(0x3f)
+	ENOSTR          = syscall.Errno(0x3c)
+	ENOSYS          = syscall.Errno(0x26)
+	ENOTCONN        = syscall.Errno(0x6b)
+	ENOTEMPTY       = syscall.Errno(0x27)
+	ENOTNAM         = syscall.Errno(0x76)
+	ENOTRECOVERABLE = syscall.Errno(0x83)
+	ENOTSOCK        = syscall.Errno(0x58)
+	ENOTSUP         = syscall.Errno(0x5f)
+	ENOTUNIQ        = syscall.Errno(0x4c)
+	EOPNOTSUPP      = syscall.Errno(0x5f)
+	EOVERFLOW       = syscall.Errno(0x4b)
+	EOWNERDEAD      = syscall.Errno(0x82)
+	EPFNOSUPPORT    = syscall.Errno(0x60)
+	EPROTO          = syscall.Errno(0x47)
+	EPROTONOSUPPORT = syscall.Errno(0x5d)
+	EPROTOTYPE      = syscall.Errno(0x5b)
+	EREMCHG         = syscall.Errno(0x4e)
+	EREMOTE         = syscall.Errno(0x42)
+	EREMOTEIO       = syscall.Errno(0x79)
+	ERESTART        = syscall.Errno(0x55)
+	ERFKILL         = syscall.Errno(0x84)
+	ESHUTDOWN       = syscall.Errno(0x6c)
+	ESOCKTNOSUPPORT = syscall.Errno(0x5e)
+	ESRMNT          = syscall.Errno(0x45)
+	ESTALE          = syscall.Errno(0x74)
+	ESTRPIPE        = syscall.Errno(0x56)
+	ETIME           = syscall.Errno(0x3e)
+	ETIMEDOUT       = syscall.Errno(0x6e)
+	ETOOMANYREFS    = syscall.Errno(0x6d)
+	EUCLEAN         = syscall.Errno(0x75)
+	EUNATCH         = syscall.Errno(0x31)
+	EUSERS          = syscall.Errno(0x57)
+	EXFULL          = syscall.Errno(0x36)
+)
+
+// Signals
+const (
+	SIGBUS    = syscall.Signal(0x7)
+	SIGCHLD   = syscall.Signal(0x11)
+	SIGCLD    = syscall.Signal(0x11)
+	SIGCONT   = syscall.Signal(0x12)
+	SIGIO     = syscall.Signal(0x1d)
+	SIGPOLL   = syscall.Signal(0x1d)
+	SIGPROF   = syscall.Signal(0x1b)
+	SIGPWR    = syscall.Signal(0x1e)
+	SIGSTKFLT = syscall.Signal(0x10)
+	SIGSTOP   = syscall.Signal(0x13)
+	SIGSYS    = syscall.Signal(0x1f)
+	SIGTSTP   = syscall.Signal(0x14)
+	SIGTTIN   = syscall.Signal(0x15)
+	SIGTTOU   = syscall.Signal(0x16)
+	SIGURG    = syscall.Signal(0x17)
+	SIGUSR1   = syscall.Signal(0xa)
+	SIGUSR2   = syscall.Signal(0xc)
+	SIGVTALRM = syscall.Signal(0x1a)
+	SIGWINCH  = syscall.Signal(0x1c)
+	SIGXCPU   = syscall.Signal(0x18)
+	SIGXFSZ   = syscall.Signal(0x19)
+)
+
+// Error table
+var errorList = [...]struct {
+	num  syscall.Errno
+	name string
+	desc string
+}{
+	{1, "EPERM", "operation not permitted"},
+	{2, "ENOENT", "no such file or directory"},
+	{3, "ESRCH", "no such process"},
+	{4, "EINTR", "interrupted system call"},
+	{5, "EIO", "input/output error"},
+	{6, "ENXIO", "no such device or address"},
+	{7, "E2BIG", "argument list too long"},
+	{8, "ENOEXEC", "exec format error"},
+	{9, "EBADF", "bad file descriptor"},
+	{10, "ECHILD", "no child processes"},
+	{11, "EAGAIN", "resource temporarily unavailable"},
+	{12, "ENOMEM", "cannot allocate memory"},
+	{13, "EACCES", "permission denied"},
+	{14, "EFAULT", "bad address"},
+	{15, "ENOTBLK", "block device required"},
+	{16, "EBUSY", "device or resource busy"},
+	{17, "EEXIST", "file exists"},
+	{18, "EXDEV", "invalid cross-device link"},
+	{19, "ENODEV", "no such device"},
+	{20, "ENOTDIR", "not a directory"},
+	{21, "EISDIR", "is a directory"},
+	{22, "EINVAL", "invalid argument"},
+	{23, "ENFILE", "too many open files in system"},
+	{24, "EMFILE", "too many open files"},
+	{25, "ENOTTY", "inappropriate ioctl for device"},
+	{26, "ETXTBSY", "text file busy"},
+	{27, "EFBIG", "file too large"},
+	{28, "ENOSPC", "no space left on device"},
+	{29, "ESPIPE", "illegal seek"},
+	{30, "EROFS", "read-only file system"},
+	{31, "EMLINK", "too many links"},
+	{32, "EPIPE", "broken pipe"},
+	{33, "EDOM", "numerical argument out of domain"},
+	{34, "ERANGE", "numerical result out of range"},
+	{35, "EDEADLK", "resource deadlock avoided"},
+	{36, "ENAMETOOLONG", "file name too long"},
+	{37, "ENOLCK", "no locks available"},
+	{38, "ENOSYS", "function not implemented"},
+	{39, "ENOTEMPTY", "directory not empty"},
+	{40, "ELOOP", "too many levels of symbolic links"},
+	{42, "ENOMSG", "no message of desired type"},
+	{43, "EIDRM", "identifier removed"},
+	{44, "ECHRNG", "channel number out of range"},
+	{45, "EL2NSYNC", "level 2 not synchronized"},
+	{46, "EL3HLT", "level 3 halted"},
+	{47, "EL3RST", "level 3 reset"},
+	{48, "ELNRNG", "link number out of range"},
+	{49, "EUNATCH", "protocol driver not attached"},
+	{50, "ENOCSI", "no CSI structure available"},
+	{51, "EL2HLT", "level 2 halted"},
+	{52, "EBADE", "invalid exchange"},
+	{53, "EBADR", "invalid request descriptor"},
+	{54, "EXFULL", "exchange full"},
+	{55, "ENOANO", "no anode"},
+	{56, "EBADRQC", "invalid request code"},
+	{57, "EBADSLT", "invalid slot"},
+	{59, "EBFONT", "bad font file format"},
+	{60, "ENOSTR", "device not a stream"},
+	{61, "ENODATA", "no data available"},
+	{62, "ETIME", "timer expired"},
+	{63, "ENOSR", "out of streams resources"},
+	{64, "ENONET", "machine is not on the network"},
+	{65, "ENOPKG", "package not installed"},
+	{66, "EREMOTE", "object is remote"},
+	{67, "ENOLINK", "link has been severed"},
+	{68, "EADV", "advertise error"},
+	{69, "ESRMNT", "srmount error"},
+	{70, "ECOMM", "communication error on send"},
+	{71, "EPROTO", "protocol error"},
+	{72, "EMULTIHOP", "multihop attempted"},
+	{73, "EDOTDOT", "RFS specific error"},
+	{74, "EBADMSG", "bad message"},
+	{75, "EOVERFLOW", "value too large for defined data type"},
+	{76, "ENOTUNIQ", "name not unique on network"},
+	{77, "EBADFD", "file descriptor in bad state"},
+	{78, "EREMCHG", "remote address changed"},
+	{79, "ELIBACC", "can not access a needed shared library"},
+	{80, "ELIBBAD", "accessing a corrupted shared library"},
+	{81, "ELIBSCN", ".lib section in a.out corrupted"},
+	{82, "ELIBMAX", "attempting to link in too many shared libraries"},
+	{83, "ELIBEXEC", "cannot exec a shared library directly"},
+	{84, "EILSEQ", "invalid or incomplete multibyte or wide character"},
+	{85, "ERESTART", "interrupted system call should be restarted"},
+	{86, "ESTRPIPE", "streams pipe error"},
+	{87, "EUSERS", "too many users"},
+	{88, "ENOTSOCK", "socket operation on non-socket"},
+	{89, "EDESTADDRREQ", "destination address required"},
+	{90, "EMSGSIZE", "message too long"},
+	{91, "EPROTOTYPE", "protocol wrong type for socket"},
+	{92, "ENOPROTOOPT", "protocol not available"},
+	{93, "EPROTONOSUPPORT", "protocol not supported"},
+	{94, "ESOCKTNOSUPPORT", "socket type not supported"},
+	{95, "ENOTSUP", "operation not supported"},
+	{96, "EPFNOSUPPORT", "protocol family not supported"},
+	{97, "EAFNOSUPPORT", "address family not supported by protocol"},
+	{98, "EADDRINUSE", "address already in use"},
+	{99, "EADDRNOTAVAIL", "cannot assign requested address"},
+	{100, "ENETDOWN", "network is down"},
+	{101, "ENETUNREACH", "network is unreachable"},
+	{102, "ENETRESET", "network dropped connection on reset"},
+	{103, "ECONNABORTED", "software caused connection abort"},
+	{104, "ECONNRESET", "connection reset by peer"},
+	{105, "ENOBUFS", "no buffer space available"},
+	{106, "EISCONN", "transport endpoint is already connected"},
+	{107, "ENOTCONN", "transport endpoint is not connected"},
+	{108, "ESHUTDOWN", "cannot send after transport endpoint shutdown"},
+	{109, "ETOOMANYREFS", "too many references: cannot splice"},
+	{110, "ETIMEDOUT", "connection timed out"},
+	{111, "ECONNREFUSED", "connection refused"},
+	{112, "EHOSTDOWN", "host is down"},
+	{113, "EHOSTUNREACH", "no route to host"},
+	{114, "EALREADY", "operation already in progress"},
+	{115, "EINPROGRESS", "operation now in progress"},
+	{116, "ESTALE", "stale file handle"},
+	{117, "EUCLEAN", "structure needs cleaning"},
+	{118, "ENOTNAM", "not a XENIX named type file"},
+	{119, "ENAVAIL", "no XENIX semaphores available"},
+	{120, "EISNAM", "is a named type file"},
+	{121, "EREMOTEIO", "remote I/O error"},
+	{122, "EDQUOT", "disk quota exceeded"},
+	{123, "ENOMEDIUM", "no medium found"},
+	{124, "EMEDIUMTYPE", "wrong medium type"},
+	{125, "ECANCELED", "operation canceled"},
+	{126, "ENOKEY", "required key not available"},
+	{127, "EKEYEXPIRED", "key has expired"},
+	{128, "EKEYREVOKED", "key has been revoked"},
+	{129, "EKEYREJECTED", "key was rejected by service"},
+	{130, "EOWNERDEAD", "owner died"},
+	{131, "ENOTRECOVERABLE", "state not recoverable"},
+	{132, "ERFKILL", "operation not possible due to RF-kill"},
+	{133, "EHWPOISON", "memory page has hardware error"},
+}
+
+// Signal table
+var signalList = [...]struct {
+	num  syscall.Signal
+	name string
+	desc string
+}{
+	{1, "SIGHUP", "hangup"},
+	{2, "SIGINT", "interrupt"},
+	{3, "SIGQUIT", "quit"},
+	{4, "SIGILL", "illegal instruction"},
+	{5, "SIGTRAP", "trace/breakpoint trap"},
+	{6, "SIGABRT", "aborted"},
+	{7, "SIGBUS", "bus error"},
+	{8, "SIGFPE", "floating point exception"},
+	{9, "SIGKILL", "killed"},
+	{10, "SIGUSR1", "user defined signal 1"},
+	{11, "SIGSEGV", "segmentation fault"},
+	{12, "SIGUSR2", "user defined signal 2"},
+	{13, "SIGPIPE", "broken pipe"},
+	{14, "SIGALRM", "alarm clock"},
+	{15, "SIGTERM", "terminated"},
+	{16, "SIGSTKFLT", "stack fault"},
+	{17, "SIGCHLD", "child exited"},
+	{18, "SIGCONT", "continued"},
+	{19, "SIGSTOP", "stopped (signal)"},
+	{20, "SIGTSTP", "stopped"},
+	{21, "SIGTTIN", "stopped (tty input)"},
+	{22, "SIGTTOU", "stopped (tty output)"},
+	{23, "SIGURG", "urgent I/O condition"},
+	{24, "SIGXCPU", "CPU time limit exceeded"},
+	{25, "SIGXFSZ", "file size limit exceeded"},
+	{26, "SIGVTALRM", "virtual timer expired"},
+	{27, "SIGPROF", "profiling timer expired"},
+	{28, "SIGWINCH", "window changed"},
+	{29, "SIGIO", "I/O possible"},
+	{30, "SIGPWR", "power failure"},
+	{31, "SIGSYS", "bad system call"},
+}
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
index c358ada0d3..890bc3c9b7 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/mips/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips && linux
 // +build mips,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/mips/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc00c4d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -250,6 +251,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8004700e
 	RTC_IRQP_READ                    = 0x4004700b
 	RTC_IRQP_SET                     = 0x8004700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x401c7011
@@ -324,9 +327,11 @@ const (
 	SO_RCVBUF                        = 0x1002
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x1004
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x1006
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x1006
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x4
 	SO_REUSEPORT                     = 0x200
 	SO_RXQ_OVFL                      = 0x28
@@ -348,6 +353,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x1008
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
index 1dc1ee16b9..549f26ac64 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/mips64/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips64 && linux
 // +build mips64,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/mips64/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -250,6 +251,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8008700e
 	RTC_IRQP_READ                    = 0x4008700b
 	RTC_IRQP_SET                     = 0x8008700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x40207011
@@ -324,9 +327,11 @@ const (
 	SO_RCVBUF                        = 0x1002
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x1004
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x1006
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x1006
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x4
 	SO_REUSEPORT                     = 0x200
 	SO_RXQ_OVFL                      = 0x28
@@ -348,6 +353,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x1008
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
index 3ae187dd93..e0365e32c1 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/mips64le/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips64le && linux
 // +build mips64le,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/mips64le/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -250,6 +251,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8008700e
 	RTC_IRQP_READ                    = 0x4008700b
 	RTC_IRQP_SET                     = 0x8008700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x40207011
@@ -324,9 +327,11 @@ const (
 	SO_RCVBUF                        = 0x1002
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x1004
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x1006
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x1006
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x4
 	SO_REUSEPORT                     = 0x200
 	SO_RXQ_OVFL                      = 0x28
@@ -348,6 +353,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x1008
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
index 39895f0dd1..fdccce15ca 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/mipsle/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mipsle && linux
 // +build mipsle,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/mipsle/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc00c4d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -250,6 +251,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8004700e
 	RTC_IRQP_READ                    = 0x4004700b
 	RTC_IRQP_SET                     = 0x8004700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x401c7011
@@ -324,9 +327,11 @@ const (
 	SO_RCVBUF                        = 0x1002
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x1004
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x1006
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x1006
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x4
 	SO_REUSEPORT                     = 0x200
 	SO_RXQ_OVFL                      = 0x28
@@ -348,6 +353,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x1008
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
index a98a45537b..b2205c83fa 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/ppc/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc && linux
 // +build ppc,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/ppc/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc00c4d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -305,6 +306,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8004700e
 	RTC_IRQP_READ                    = 0x4004700b
 	RTC_IRQP_SET                     = 0x8004700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x401c7011
@@ -379,9 +382,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x10
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x12
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x12
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -402,6 +407,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
index 0a8fbbffaa..81aa5ad0f6 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/ppc64/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc64 && linux
 // +build ppc64,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/ppc64/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -309,6 +310,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8008700e
 	RTC_IRQP_READ                    = 0x4008700b
 	RTC_IRQP_SET                     = 0x8008700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x40207011
@@ -383,9 +386,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x10
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x12
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x12
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -406,6 +411,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
index cb835a1442..76807a1fd4 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/ppc64le/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc64le && linux
 // +build ppc64le,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/ppc64le/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -309,6 +310,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8008700e
 	RTC_IRQP_READ                    = 0x4008700b
 	RTC_IRQP_SET                     = 0x8008700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x40207011
@@ -383,9 +386,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x10
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x12
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x12
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -406,6 +411,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
index 73cf6554b0..d4a5ab9e4e 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/riscv64/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build riscv64 && linux
 // +build riscv64,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/riscv64/include _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x80044d07
 	MEMISLOCKED                      = 0x80084d17
 	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x40084d0c
 	MEMUNLOCK                        = 0x40084d06
@@ -238,6 +239,8 @@ const (
 	RTC_EPOCH_SET                    = 0x4008700e
 	RTC_IRQP_READ                    = 0x8008700b
 	RTC_IRQP_SET                     = 0x4008700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
 	RTC_PIE_OFF                      = 0x7006
 	RTC_PIE_ON                       = 0x7005
 	RTC_PLL_GET                      = 0x80207011
@@ -312,9 +315,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x14
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -335,6 +340,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
index 04b6dfaf5f..66e65db951 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include -fsigned-char
+// mkerrors.sh -Wall -Werror -static -I/tmp/s390x/include -fsigned-char
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build s390x && linux
 // +build s390x,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -fsigned-char /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/s390x/include -fsigned-char _const.go
 
 package unix
 
@@ -131,6 +131,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x80044d07
 	MEMISLOCKED                      = 0x80084d17
 	MEMLOCK                          = 0x40084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x40084d0c
 	MEMUNLOCK                        = 0x40084d06
@@ -313,6 +314,8 @@ const (
 	RTC_EPOCH_SET                    = 0x4008700e
 	RTC_IRQP_READ                    = 0x8008700b
 	RTC_IRQP_SET                     = 0x4008700c
+	RTC_PARAM_GET                    = 0x40187013
+	RTC_PARAM_SET                    = 0x40187014
 	RTC_PIE_OFF                      = 0x7006
 	RTC_PIE_ON                       = 0x7005
 	RTC_PLL_GET                      = 0x80207011
@@ -387,9 +390,11 @@ const (
 	SO_RCVBUF                        = 0x8
 	SO_RCVBUFFORCE                   = 0x21
 	SO_RCVLOWAT                      = 0x12
+	SO_RCVMARK                       = 0x4b
 	SO_RCVTIMEO                      = 0x14
 	SO_RCVTIMEO_NEW                  = 0x42
 	SO_RCVTIMEO_OLD                  = 0x14
+	SO_RESERVE_MEM                   = 0x49
 	SO_REUSEADDR                     = 0x2
 	SO_REUSEPORT                     = 0xf
 	SO_RXQ_OVFL                      = 0x28
@@ -410,6 +415,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x40
 	SO_TIMESTAMPNS_OLD               = 0x23
 	SO_TIMESTAMP_NEW                 = 0x3f
+	SO_TXREHASH                      = 0x4a
 	SO_TXTIME                        = 0x3d
 	SO_TYPE                          = 0x3
 	SO_WIFI_STATUS                   = 0x29
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
index 8c87d979d4..f619252691 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
@@ -1,11 +1,11 @@
-// mkerrors.sh -Wall -Werror -static -I/tmp/include
+// mkerrors.sh -Wall -Werror -static -I/tmp/sparc64/include
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build sparc64 && linux
 // +build sparc64,linux
 
 // Code generated by cmd/cgo -godefs; DO NOT EDIT.
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/_const.go
+// cgo -godefs -- -Wall -Werror -static -I/tmp/sparc64/include _const.go
 
 package unix
 
@@ -136,6 +136,7 @@ const (
 	MEMGETREGIONCOUNT                = 0x40044d07
 	MEMISLOCKED                      = 0x40084d17
 	MEMLOCK                          = 0x80084d05
+	MEMREAD                          = 0xc0404d1a
 	MEMREADOOB                       = 0xc0104d04
 	MEMSETBADBLOCK                   = 0x80084d0c
 	MEMUNLOCK                        = 0x80084d06
@@ -304,6 +305,8 @@ const (
 	RTC_EPOCH_SET                    = 0x8008700e
 	RTC_IRQP_READ                    = 0x4008700b
 	RTC_IRQP_SET                     = 0x8008700c
+	RTC_PARAM_GET                    = 0x80187013
+	RTC_PARAM_SET                    = 0x80187014
 	RTC_PIE_OFF                      = 0x20007006
 	RTC_PIE_ON                       = 0x20007005
 	RTC_PLL_GET                      = 0x40207011
@@ -378,9 +381,11 @@ const (
 	SO_RCVBUF                        = 0x1002
 	SO_RCVBUFFORCE                   = 0x100b
 	SO_RCVLOWAT                      = 0x800
+	SO_RCVMARK                       = 0x54
 	SO_RCVTIMEO                      = 0x2000
 	SO_RCVTIMEO_NEW                  = 0x44
 	SO_RCVTIMEO_OLD                  = 0x2000
+	SO_RESERVE_MEM                   = 0x52
 	SO_REUSEADDR                     = 0x4
 	SO_REUSEPORT                     = 0x200
 	SO_RXQ_OVFL                      = 0x24
@@ -401,6 +406,7 @@ const (
 	SO_TIMESTAMPNS_NEW               = 0x42
 	SO_TIMESTAMPNS_OLD               = 0x21
 	SO_TIMESTAMP_NEW                 = 0x46
+	SO_TXREHASH                      = 0x53
 	SO_TXTIME                        = 0x3f
 	SO_TYPE                          = 0x1008
 	SO_WIFI_STATUS                   = 0x25
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go
index 6d56edc05a..af20e474b3 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_386.go
@@ -46,6 +46,7 @@ const (
 	AF_SNA                            = 0xb
 	AF_UNIX                           = 0x1
 	AF_UNSPEC                         = 0x0
+	ALTWERASE                         = 0x200
 	ARPHRD_ETHER                      = 0x1
 	ARPHRD_FRELAY                     = 0xf
 	ARPHRD_IEEE1394                   = 0x18
@@ -108,6 +109,15 @@ const (
 	BPF_DIRECTION_IN                  = 0x1
 	BPF_DIRECTION_OUT                 = 0x2
 	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -136,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -147,6 +158,12 @@ const (
 	BRKINT                            = 0x2
 	CFLUSH                            = 0xf
 	CLOCAL                            = 0x8000
+	CLOCK_BOOTTIME                    = 0x6
+	CLOCK_MONOTONIC                   = 0x3
+	CLOCK_PROCESS_CPUTIME_ID          = 0x2
+	CLOCK_REALTIME                    = 0x0
+	CLOCK_THREAD_CPUTIME_ID           = 0x4
+	CLOCK_UPTIME                      = 0x5
 	CPUSTATES                         = 0x6
 	CP_IDLE                           = 0x5
 	CP_INTR                           = 0x4
@@ -170,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc100445d
+	DIOCADDRULE                       = 0xccc84404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xccc8441a
+	DIOCCLRIFFLAG                     = 0xc024445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0d04412
+	DIOCCLRSTATUS                     = 0xc0244416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1084460
+	DIOCGETQUEUE                      = 0xc100445f
+	DIOCGETQUEUES                     = 0xc100445e
+	DIOCGETRULE                       = 0xccc84407
+	DIOCGETRULES                      = 0xccc84406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0084454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0084419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0244457
+	DIOCKILLSRCNODES                  = 0xc068445b
+	DIOCKILLSTATES                    = 0xc0d04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc084444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0844450
+	DIOCRADDADDRS                     = 0xc44c4443
+	DIOCRADDTABLES                    = 0xc44c443d
+	DIOCRCLRADDRS                     = 0xc44c4442
+	DIOCRCLRASTATS                    = 0xc44c4448
+	DIOCRCLRTABLES                    = 0xc44c443c
+	DIOCRCLRTSTATS                    = 0xc44c4441
+	DIOCRDELADDRS                     = 0xc44c4444
+	DIOCRDELTABLES                    = 0xc44c443e
+	DIOCRGETADDRS                     = 0xc44c4446
+	DIOCRGETASTATS                    = 0xc44c4447
+	DIOCRGETTABLES                    = 0xc44c443f
+	DIOCRGETTSTATS                    = 0xc44c4440
+	DIOCRINADEFINE                    = 0xc44c444d
+	DIOCRSETADDRS                     = 0xc44c4445
+	DIOCRSETTFLAGS                    = 0xc44c444a
+	DIOCRTSTADDRS                     = 0xc44c4449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0244459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0244414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc00c4451
+	DIOCXCOMMIT                       = 0xc00c4452
+	DIOCXROLLBACK                     = 0xc00c4453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -186,6 +261,7 @@ const (
 	DLT_LOOP                          = 0xc
 	DLT_MPLS                          = 0xdb
 	DLT_NULL                          = 0x0
+	DLT_OPENFLOW                      = 0x10b
 	DLT_PFLOG                         = 0x75
 	DLT_PFSYNC                        = 0x12
 	DLT_PPP                           = 0x9
@@ -196,6 +272,23 @@ const (
 	DLT_RAW                           = 0xe
 	DLT_SLIP                          = 0x8
 	DLT_SLIP_BSDOS                    = 0xf
+	DLT_USBPCAP                       = 0xf9
+	DLT_USER0                         = 0x93
+	DLT_USER1                         = 0x94
+	DLT_USER10                        = 0x9d
+	DLT_USER11                        = 0x9e
+	DLT_USER12                        = 0x9f
+	DLT_USER13                        = 0xa0
+	DLT_USER14                        = 0xa1
+	DLT_USER15                        = 0xa2
+	DLT_USER2                         = 0x95
+	DLT_USER3                         = 0x96
+	DLT_USER4                         = 0x97
+	DLT_USER5                         = 0x98
+	DLT_USER6                         = 0x99
+	DLT_USER7                         = 0x9a
+	DLT_USER8                         = 0x9b
+	DLT_USER9                         = 0x9c
 	DT_BLK                            = 0x6
 	DT_CHR                            = 0x2
 	DT_DIR                            = 0x4
@@ -215,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -267,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -298,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -326,15 +423,17 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
+	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
 	ETHERTYPE_PPP                     = 0x880b
@@ -409,28 +508,40 @@ const (
 	ETHER_CRC_POLY_LE                 = 0xedb88320
 	ETHER_HDR_LEN                     = 0xe
 	ETHER_MAX_DIX_LEN                 = 0x600
+	ETHER_MAX_HARDMTU_LEN             = 0xff9b
 	ETHER_MAX_LEN                     = 0x5ee
 	ETHER_MIN_LEN                     = 0x40
 	ETHER_TYPE_LEN                    = 0x2
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
+	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x7
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
+	EVL_ENCAPLEN                      = 0x4
+	EVL_PRIO_BITS                     = 0xd
+	EVL_PRIO_MAX                      = 0x7
+	EVL_VLID_MASK                     = 0xfff
+	EVL_VLID_MAX                      = 0xffe
+	EVL_VLID_MIN                      = 0x1
+	EVL_VLID_NULL                     = 0x0
 	EV_ADD                            = 0x1
 	EV_CLEAR                          = 0x20
 	EV_DELETE                         = 0x2
 	EV_DISABLE                        = 0x8
+	EV_DISPATCH                       = 0x80
 	EV_ENABLE                         = 0x4
 	EV_EOF                            = 0x8000
 	EV_ERROR                          = 0x4000
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
-	EV_SYSFLAGS                       = 0xf000
+	EV_RECEIPT                        = 0x40
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -443,6 +554,7 @@ const (
 	F_GETFL                           = 0x3
 	F_GETLK                           = 0x7
 	F_GETOWN                          = 0x5
+	F_ISATTY                          = 0xb
 	F_OK                              = 0x0
 	F_RDLCK                           = 0x1
 	F_SETFD                           = 0x2
@@ -460,7 +572,6 @@ const (
 	IEXTEN                            = 0x400
 	IFAN_ARRIVAL                      = 0x0
 	IFAN_DEPARTURE                    = 0x1
-	IFA_ROUTE                         = 0x1
 	IFF_ALLMULTI                      = 0x200
 	IFF_BROADCAST                     = 0x2
 	IFF_CANTCHANGE                    = 0x8e52
@@ -471,12 +582,12 @@ const (
 	IFF_LOOPBACK                      = 0x8
 	IFF_MULTICAST                     = 0x8000
 	IFF_NOARP                         = 0x80
-	IFF_NOTRAILERS                    = 0x20
 	IFF_OACTIVE                       = 0x400
 	IFF_POINTOPOINT                   = 0x10
 	IFF_PROMISC                       = 0x100
 	IFF_RUNNING                       = 0x40
 	IFF_SIMPLEX                       = 0x800
+	IFF_STATICARP                     = 0x20
 	IFF_UP                            = 0x1
 	IFNAMSIZ                          = 0x10
 	IFT_1822                          = 0x2
@@ -605,6 +716,7 @@ const (
 	IFT_LINEGROUP                     = 0xd2
 	IFT_LOCALTALK                     = 0x2a
 	IFT_LOOP                          = 0x18
+	IFT_MBIM                          = 0xfa
 	IFT_MEDIAMAILOVERIP               = 0x8b
 	IFT_MFSIGLINK                     = 0xa7
 	IFT_MIOX25                        = 0x26
@@ -695,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -729,8 +842,6 @@ const (
 	IPPROTO_AH                        = 0x33
 	IPPROTO_CARP                      = 0x70
 	IPPROTO_DIVERT                    = 0x102
-	IPPROTO_DIVERT_INIT               = 0x2
-	IPPROTO_DIVERT_RESP               = 0x1
 	IPPROTO_DONE                      = 0x101
 	IPPROTO_DSTOPTS                   = 0x3c
 	IPPROTO_EGP                       = 0x8
@@ -762,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -787,6 +900,7 @@ const (
 	IPV6_LEAVE_GROUP                  = 0xd
 	IPV6_MAXHLIM                      = 0xff
 	IPV6_MAXPACKET                    = 0xffff
+	IPV6_MINHOPCOUNT                  = 0x41
 	IPV6_MMTU                         = 0x500
 	IPV6_MULTICAST_HOPS               = 0xa
 	IPV6_MULTICAST_IF                 = 0x9
@@ -826,12 +940,12 @@ const (
 	IP_DEFAULT_MULTICAST_LOOP         = 0x1
 	IP_DEFAULT_MULTICAST_TTL          = 0x1
 	IP_DF                             = 0x4000
-	IP_DIVERTFL                       = 0x1022
 	IP_DROP_MEMBERSHIP                = 0xd
 	IP_ESP_NETWORK_LEVEL              = 0x16
 	IP_ESP_TRANS_LEVEL                = 0x15
 	IP_HDRINCL                        = 0x2
 	IP_IPCOMP_LEVEL                   = 0x1d
+	IP_IPDEFTTL                       = 0x25
 	IP_IPSECFLOWINFO                  = 0x24
 	IP_IPSEC_LOCAL_AUTH               = 0x1b
 	IP_IPSEC_LOCAL_CRED               = 0x19
@@ -865,10 +979,15 @@ const (
 	IP_RETOPTS                        = 0x8
 	IP_RF                             = 0x8000
 	IP_RTABLE                         = 0x1021
+	IP_SENDSRCADDR                    = 0x7
 	IP_TOS                            = 0x3
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
+	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
 	IXON                              = 0x200
@@ -900,10 +1019,11 @@ const (
 	MAP_INHERIT_COPY                  = 0x1
 	MAP_INHERIT_NONE                  = 0x2
 	MAP_INHERIT_SHARE                 = 0x0
-	MAP_NOEXTEND                      = 0x100
-	MAP_NORESERVE                     = 0x40
+	MAP_INHERIT_ZERO                  = 0x3
+	MAP_NOEXTEND                      = 0x0
+	MAP_NORESERVE                     = 0x0
 	MAP_PRIVATE                       = 0x2
-	MAP_RENAME                        = 0x20
+	MAP_RENAME                        = 0x0
 	MAP_SHARED                        = 0x1
 	MAP_STACK                         = 0x4000
 	MAP_TRYFIXED                      = 0x0
@@ -922,6 +1042,7 @@ const (
 	MNT_NOATIME                       = 0x8000
 	MNT_NODEV                         = 0x10
 	MNT_NOEXEC                        = 0x4
+	MNT_NOPERM                        = 0x20
 	MNT_NOSUID                        = 0x8
 	MNT_NOWAIT                        = 0x2
 	MNT_QUOTA                         = 0x2000
@@ -929,13 +1050,29 @@ const (
 	MNT_RELOAD                        = 0x40000
 	MNT_ROOTFS                        = 0x4000
 	MNT_SOFTDEP                       = 0x4000000
+	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
 	MNT_SYNCHRONOUS                   = 0x2
 	MNT_UPDATE                        = 0x10000
 	MNT_VISFLAGMASK                   = 0x400ffff
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
+	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
 	MSG_DONTROUTE                     = 0x4
 	MSG_DONTWAIT                      = 0x80
@@ -946,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -953,12 +1091,16 @@ const (
 	NET_RT_DUMP                       = 0x1
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
-	NET_RT_MAXID                      = 0x6
+	NET_RT_IFNAMES                    = 0x6
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
 	NOFLSH                            = 0x80000000
+	NOKERNINFO                        = 0x2000000
 	NOTE_ATTRIB                       = 0x8
+	NOTE_CHANGE                       = 0x1
 	NOTE_CHILD                        = 0x4
 	NOTE_DELETE                       = 0x1
 	NOTE_EOF                          = 0x2
@@ -968,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -977,11 +1120,13 @@ const (
 	NOTE_TRUNCATE                     = 0x80
 	NOTE_WRITE                        = 0x2
 	OCRNL                             = 0x10
+	OLCUC                             = 0x20
 	ONLCR                             = 0x2
 	ONLRET                            = 0x80
 	ONOCR                             = 0x40
 	ONOEOT                            = 0x8
 	OPOST                             = 0x1
+	OXTABS                            = 0x4
 	O_ACCMODE                         = 0x3
 	O_APPEND                          = 0x8
 	O_ASYNC                           = 0x40
@@ -1015,7 +1160,6 @@ const (
 	PROT_NONE                         = 0x0
 	PROT_READ                         = 0x1
 	PROT_WRITE                        = 0x2
-	PT_MASK                           = 0x3ff000
 	RLIMIT_CORE                       = 0x4
 	RLIMIT_CPU                        = 0x0
 	RLIMIT_DATA                       = 0x2
@@ -1027,19 +1171,25 @@ const (
 	RLIMIT_STACK                      = 0x3
 	RLIM_INFINITY                     = 0x7fffffffffffffff
 	RTAX_AUTHOR                       = 0x6
+	RTAX_BFD                          = 0xb
 	RTAX_BRD                          = 0x7
+	RTAX_DNS                          = 0xc
 	RTAX_DST                          = 0x0
 	RTAX_GATEWAY                      = 0x1
 	RTAX_GENMASK                      = 0x3
 	RTAX_IFA                          = 0x5
 	RTAX_IFP                          = 0x4
 	RTAX_LABEL                        = 0xa
-	RTAX_MAX                          = 0xb
+	RTAX_MAX                          = 0xf
 	RTAX_NETMASK                      = 0x2
+	RTAX_SEARCH                       = 0xe
 	RTAX_SRC                          = 0x8
 	RTAX_SRCMASK                      = 0x9
+	RTAX_STATIC                       = 0xd
 	RTA_AUTHOR                        = 0x40
+	RTA_BFD                           = 0x800
 	RTA_BRD                           = 0x80
+	RTA_DNS                           = 0x1000
 	RTA_DST                           = 0x1
 	RTA_GATEWAY                       = 0x2
 	RTA_GENMASK                       = 0x8
@@ -1047,49 +1197,57 @@ const (
 	RTA_IFP                           = 0x10
 	RTA_LABEL                         = 0x400
 	RTA_NETMASK                       = 0x4
+	RTA_SEARCH                        = 0x4000
 	RTA_SRC                           = 0x100
 	RTA_SRCMASK                       = 0x200
+	RTA_STATIC                        = 0x2000
 	RTF_ANNOUNCE                      = 0x4000
+	RTF_BFD                           = 0x1000000
 	RTF_BLACKHOLE                     = 0x1000
+	RTF_BROADCAST                     = 0x400000
+	RTF_CACHED                        = 0x20000
 	RTF_CLONED                        = 0x10000
 	RTF_CLONING                       = 0x100
+	RTF_CONNECTED                     = 0x800000
 	RTF_DONE                          = 0x40
 	RTF_DYNAMIC                       = 0x10
-	RTF_FMASK                         = 0x10f808
+	RTF_FMASK                         = 0x110fc08
 	RTF_GATEWAY                       = 0x2
 	RTF_HOST                          = 0x4
 	RTF_LLINFO                        = 0x400
-	RTF_MASK                          = 0x80
+	RTF_LOCAL                         = 0x200000
 	RTF_MODIFIED                      = 0x20
 	RTF_MPATH                         = 0x40000
 	RTF_MPLS                          = 0x100000
+	RTF_MULTICAST                     = 0x200
 	RTF_PERMANENT_ARP                 = 0x2000
 	RTF_PROTO1                        = 0x8000
 	RTF_PROTO2                        = 0x4000
 	RTF_PROTO3                        = 0x2000
 	RTF_REJECT                        = 0x8
-	RTF_SOURCE                        = 0x20000
 	RTF_STATIC                        = 0x800
-	RTF_TUNNEL                        = 0x100000
 	RTF_UP                            = 0x1
 	RTF_USETRAILERS                   = 0x8000
-	RTF_XRESOLVE                      = 0x200
+	RTM_80211INFO                     = 0x15
 	RTM_ADD                           = 0x1
+	RTM_BFD                           = 0x12
 	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
 	RTM_DELADDR                       = 0xd
 	RTM_DELETE                        = 0x2
 	RTM_DESYNC                        = 0x10
 	RTM_GET                           = 0x4
 	RTM_IFANNOUNCE                    = 0xf
 	RTM_IFINFO                        = 0xe
-	RTM_LOCK                          = 0x8
+	RTM_INVALIDATE                    = 0x11
 	RTM_LOSING                        = 0x5
 	RTM_MAXSIZE                       = 0x800
 	RTM_MISS                          = 0x7
 	RTM_NEWADDR                       = 0xc
+	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1099,67 +1257,74 @@ const (
 	RTV_RTTVAR                        = 0x80
 	RTV_SPIPE                         = 0x10
 	RTV_SSTHRESH                      = 0x20
+	RT_TABLEID_BITS                   = 0x8
+	RT_TABLEID_MASK                   = 0xff
 	RT_TABLEID_MAX                    = 0xff
 	RUSAGE_CHILDREN                   = -0x1
 	RUSAGE_SELF                       = 0x0
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
 	SIOCADDMULTI                      = 0x80206931
 	SIOCAIFADDR                       = 0x8040691a
 	SIOCAIFGROUP                      = 0x80246987
-	SIOCALIFADDR                      = 0x8218691c
 	SIOCATMARK                        = 0x40047307
-	SIOCBRDGADD                       = 0x8054693c
-	SIOCBRDGADDS                      = 0x80546941
-	SIOCBRDGARL                       = 0x806e694d
+	SIOCBRDGADD                       = 0x805c693c
+	SIOCBRDGADDL                      = 0x805c6949
+	SIOCBRDGADDS                      = 0x805c6941
+	SIOCBRDGARL                       = 0x808c694d
 	SIOCBRDGDADDR                     = 0x81286947
-	SIOCBRDGDEL                       = 0x8054693d
-	SIOCBRDGDELS                      = 0x80546942
-	SIOCBRDGFLUSH                     = 0x80546948
-	SIOCBRDGFRL                       = 0x806e694e
+	SIOCBRDGDEL                       = 0x805c693d
+	SIOCBRDGDELS                      = 0x805c6942
+	SIOCBRDGFLUSH                     = 0x805c6948
+	SIOCBRDGFRL                       = 0x808c694e
 	SIOCBRDGGCACHE                    = 0xc0146941
 	SIOCBRDGGFD                       = 0xc0146952
 	SIOCBRDGGHT                       = 0xc0146951
-	SIOCBRDGGIFFLGS                   = 0xc054693e
+	SIOCBRDGGIFFLGS                   = 0xc05c693e
 	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc03c6958
 	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc028694f
-	SIOCBRDGGSIFS                     = 0xc054693c
 	SIOCBRDGGTO                       = 0xc0146946
-	SIOCBRDGIFS                       = 0xc0546942
+	SIOCBRDGIFS                       = 0xc05c6942
 	SIOCBRDGRTS                       = 0xc0186943
 	SIOCBRDGSADDR                     = 0xc1286944
 	SIOCBRDGSCACHE                    = 0x80146940
 	SIOCBRDGSFD                       = 0x80146952
 	SIOCBRDGSHT                       = 0x80146951
-	SIOCBRDGSIFCOST                   = 0x80546955
-	SIOCBRDGSIFFLGS                   = 0x8054693f
-	SIOCBRDGSIFPRIO                   = 0x80546954
+	SIOCBRDGSIFCOST                   = 0x805c6955
+	SIOCBRDGSIFFLGS                   = 0x805c693f
+	SIOCBRDGSIFPRIO                   = 0x805c6954
+	SIOCBRDGSIFPROT                   = 0x805c694a
 	SIOCBRDGSMA                       = 0x80146953
 	SIOCBRDGSPRI                      = 0x80146950
 	SIOCBRDGSPROTO                    = 0x8014695a
 	SIOCBRDGSTO                       = 0x80146945
 	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
 	SIOCDIFGROUP                      = 0x80246989
+	SIOCDIFPARENT                     = 0x802069b4
 	SIOCDIFPHYADDR                    = 0x80206949
-	SIOCDLIFADDR                      = 0x8218691e
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
+	SIOCDVNETID                       = 0x802069af
 	SIOCGETKALIVE                     = 0xc01869a4
 	SIOCGETLABEL                      = 0x8020699a
+	SIOCGETMPWCFG                     = 0xc02069ae
 	SIOCGETPFLOW                      = 0xc02069fe
 	SIOCGETPFSYNC                     = 0xc02069f8
 	SIOCGETSGCNT                      = 0xc0147534
 	SIOCGETVIFCNT                     = 0xc0147533
 	SIOCGETVLAN                       = 0xc0206990
-	SIOCGHIWAT                        = 0x40047301
 	SIOCGIFADDR                       = 0xc0206921
-	SIOCGIFASYNCMAP                   = 0xc020697c
 	SIOCGIFBRDADDR                    = 0xc0206923
 	SIOCGIFCONF                       = 0xc0086924
 	SIOCGIFDATA                       = 0xc020691b
@@ -1168,40 +1333,53 @@ const (
 	SIOCGIFFLAGS                      = 0xc0206911
 	SIOCGIFGATTR                      = 0xc024698b
 	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc024698d
 	SIOCGIFGMEMB                      = 0xc024698a
 	SIOCGIFGROUP                      = 0xc0246988
 	SIOCGIFHARDMTU                    = 0xc02069a5
-	SIOCGIFMEDIA                      = 0xc0286936
+	SIOCGIFLLPRIO                     = 0xc02069b6
+	SIOCGIFMEDIA                      = 0xc0386938
 	SIOCGIFMETRIC                     = 0xc0206917
 	SIOCGIFMTU                        = 0xc020697e
 	SIOCGIFNETMASK                    = 0xc0206925
-	SIOCGIFPDSTADDR                   = 0xc0206948
+	SIOCGIFPAIR                       = 0xc02069b1
+	SIOCGIFPARENT                     = 0xc02069b3
 	SIOCGIFPRIORITY                   = 0xc020699c
-	SIOCGIFPSRCADDR                   = 0xc0206947
 	SIOCGIFRDOMAIN                    = 0xc02069a0
 	SIOCGIFRTLABEL                    = 0xc0206983
-	SIOCGIFTIMESLOT                   = 0xc0206986
+	SIOCGIFRXR                        = 0x802069aa
+	SIOCGIFSFFPAGE                    = 0xc1126939
 	SIOCGIFXFLAGS                     = 0xc020699e
-	SIOCGLIFADDR                      = 0xc218691d
 	SIOCGLIFPHYADDR                   = 0xc218694b
+	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
 	SIOCGLIFPHYRTABLE                 = 0xc02069a2
 	SIOCGLIFPHYTTL                    = 0xc02069a9
-	SIOCGLOWAT                        = 0x40047303
 	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
+	SIOCGUMBINFO                      = 0xc02069be
+	SIOCGUMBPARAM                     = 0xc02069c0
 	SIOCGVH                           = 0xc02069f6
+	SIOCGVNETFLOWID                   = 0xc02069c4
 	SIOCGVNETID                       = 0xc02069a7
+	SIOCIFAFATTACH                    = 0x801169ab
+	SIOCIFAFDETACH                    = 0x801169ac
 	SIOCIFCREATE                      = 0x8020697a
 	SIOCIFDESTROY                     = 0x80206979
 	SIOCIFGCLONERS                    = 0xc00c6978
 	SIOCSETKALIVE                     = 0x801869a3
 	SIOCSETLABEL                      = 0x80206999
+	SIOCSETMPWCFG                     = 0x802069ad
 	SIOCSETPFLOW                      = 0x802069fd
 	SIOCSETPFSYNC                     = 0x802069f7
 	SIOCSETVLAN                       = 0x8020698f
-	SIOCSHIWAT                        = 0x80047300
 	SIOCSIFADDR                       = 0x8020690c
-	SIOCSIFASYNCMAP                   = 0x8020697d
 	SIOCSIFBRDADDR                    = 0x80206913
 	SIOCSIFDESCR                      = 0x80206980
 	SIOCSIFDSTADDR                    = 0x8020690e
@@ -1209,25 +1387,37 @@ const (
 	SIOCSIFGATTR                      = 0x8024698c
 	SIOCSIFGENERIC                    = 0x80206939
 	SIOCSIFLLADDR                     = 0x8020691f
-	SIOCSIFMEDIA                      = 0xc0206935
+	SIOCSIFLLPRIO                     = 0x802069b5
+	SIOCSIFMEDIA                      = 0xc0206937
 	SIOCSIFMETRIC                     = 0x80206918
 	SIOCSIFMTU                        = 0x8020697f
 	SIOCSIFNETMASK                    = 0x80206916
-	SIOCSIFPHYADDR                    = 0x80406946
+	SIOCSIFPAIR                       = 0x802069b0
+	SIOCSIFPARENT                     = 0x802069b2
 	SIOCSIFPRIORITY                   = 0x8020699b
 	SIOCSIFRDOMAIN                    = 0x8020699f
 	SIOCSIFRTLABEL                    = 0x80206982
-	SIOCSIFTIMESLOT                   = 0x80206985
 	SIOCSIFXFLAGS                     = 0x8020699d
 	SIOCSLIFPHYADDR                   = 0x8218694a
+	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
 	SIOCSLIFPHYRTABLE                 = 0x802069a1
 	SIOCSLIFPHYTTL                    = 0x802069a8
-	SIOCSLOWAT                        = 0x80047302
 	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
+	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
+	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
+	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
+	SOCK_DNS                          = 0x1000
+	SOCK_NONBLOCK                     = 0x4000
 	SOCK_RAW                          = 0x3
 	SOCK_RDM                          = 0x4
 	SOCK_SEQPACKET                    = 0x5
@@ -1238,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1245,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1258,6 +1450,7 @@ const (
 	SO_TIMESTAMP                      = 0x800
 	SO_TYPE                           = 0x1008
 	SO_USELOOPBACK                    = 0x40
+	SO_ZEROIZE                        = 0x2000
 	S_BLKSIZE                         = 0x200
 	S_IEXEC                           = 0x40
 	S_IFBLK                           = 0x6000
@@ -1287,9 +1480,24 @@ const (
 	S_IXOTH                           = 0x1
 	S_IXUSR                           = 0x40
 	TCIFLUSH                          = 0x1
+	TCIOFF                            = 0x3
 	TCIOFLUSH                         = 0x3
+	TCION                             = 0x4
 	TCOFLUSH                          = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCOOFF                            = 0x1
+	TCOON                             = 0x2
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1298,11 +1506,15 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
-	TCP_NSTATES                       = 0xb
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
 	TIOCCBRK                          = 0x2000747a
 	TIOCCDTR                          = 0x20007478
+	TIOCCHKVERAUTH                    = 0x2000741e
+	TIOCCLRVERAUTH                    = 0x2000741d
 	TIOCCONS                          = 0x80047462
 	TIOCDRAIN                         = 0x2000745e
 	TIOCEXCL                          = 0x2000740d
@@ -1357,17 +1569,21 @@ const (
 	TIOCSETAF                         = 0x802c7416
 	TIOCSETAW                         = 0x802c7415
 	TIOCSETD                          = 0x8004741b
+	TIOCSETVERAUTH                    = 0x8004741c
 	TIOCSFLAGS                        = 0x8004745c
 	TIOCSIG                           = 0x8004745f
 	TIOCSPGRP                         = 0x80047476
 	TIOCSTART                         = 0x2000746e
-	TIOCSTAT                          = 0x80047465
-	TIOCSTI                           = 0x80017472
+	TIOCSTAT                          = 0x20007465
 	TIOCSTOP                          = 0x2000746f
 	TIOCSTSTAMP                       = 0x8008745a
 	TIOCSWINSZ                        = 0x80087467
 	TIOCUCNTL                         = 0x80047466
+	TIOCUCNTL_CBRK                    = 0x7a
+	TIOCUCNTL_SBRK                    = 0x7b
 	TOSTOP                            = 0x400000
+	UTIME_NOW                         = -0x2
+	UTIME_OMIT                        = -0x1
 	VDISCARD                          = 0xf
 	VDSUSP                            = 0xb
 	VEOF                              = 0x0
@@ -1378,6 +1594,19 @@ const (
 	VKILL                             = 0x5
 	VLNEXT                            = 0xe
 	VMIN                              = 0x10
+	VM_ANONMIN                        = 0x7
+	VM_LOADAVG                        = 0x2
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
+	VM_MAXSLP                         = 0xa
+	VM_METER                          = 0x1
+	VM_NKMEMPAGES                     = 0x6
+	VM_PSSTRINGS                      = 0x3
+	VM_SWAPENCRYPT                    = 0x5
+	VM_USPACE                         = 0xb
+	VM_UVMEXP                         = 0x4
+	VM_VNODEMIN                       = 0x9
+	VM_VTEXTMIN                       = 0x8
 	VQUIT                             = 0x9
 	VREPRINT                          = 0x6
 	VSTART                            = 0xc
@@ -1390,8 +1619,8 @@ const (
 	WCONTINUED                        = 0x8
 	WCOREFLAG                         = 0x80
 	WNOHANG                           = 0x1
-	WSTOPPED                          = 0x7f
 	WUNTRACED                         = 0x2
+	XCASE                             = 0x1000000
 )
 
 // Errors
@@ -1405,6 +1634,7 @@ const (
 	EALREADY        = syscall.Errno(0x25)
 	EAUTH           = syscall.Errno(0x50)
 	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x5c)
 	EBADRPC         = syscall.Errno(0x48)
 	EBUSY           = syscall.Errno(0x10)
 	ECANCELED       = syscall.Errno(0x58)
@@ -1431,7 +1661,7 @@ const (
 	EIPSEC          = syscall.Errno(0x52)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x5b)
+	ELAST           = syscall.Errno(0x5f)
 	ELOOP           = syscall.Errno(0x3e)
 	EMEDIUMTYPE     = syscall.Errno(0x56)
 	EMFILE          = syscall.Errno(0x18)
@@ -1459,12 +1689,14 @@ const (
 	ENOTCONN        = syscall.Errno(0x39)
 	ENOTDIR         = syscall.Errno(0x14)
 	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5d)
 	ENOTSOCK        = syscall.Errno(0x26)
 	ENOTSUP         = syscall.Errno(0x5b)
 	ENOTTY          = syscall.Errno(0x19)
 	ENXIO           = syscall.Errno(0x6)
 	EOPNOTSUPP      = syscall.Errno(0x2d)
 	EOVERFLOW       = syscall.Errno(0x57)
+	EOWNERDEAD      = syscall.Errno(0x5e)
 	EPERM           = syscall.Errno(0x1)
 	EPFNOSUPPORT    = syscall.Errno(0x2e)
 	EPIPE           = syscall.Errno(0x20)
@@ -1472,6 +1704,7 @@ const (
 	EPROCUNAVAIL    = syscall.Errno(0x4c)
 	EPROGMISMATCH   = syscall.Errno(0x4b)
 	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5f)
 	EPROTONOSUPPORT = syscall.Errno(0x2b)
 	EPROTOTYPE      = syscall.Errno(0x29)
 	ERANGE          = syscall.Errno(0x22)
@@ -1568,7 +1801,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
+	{35, "EAGAIN", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1624,7 +1857,11 @@ var errorList = [...]struct {
 	{88, "ECANCELED", "operation canceled"},
 	{89, "EIDRM", "identifier removed"},
 	{90, "ENOMSG", "no message of desired type"},
-	{91, "ELAST", "not supported"},
+	{91, "ENOTSUP", "not supported"},
+	{92, "EBADMSG", "bad message"},
+	{93, "ENOTRECOVERABLE", "state not recoverable"},
+	{94, "EOWNERDEAD", "previous owner died"},
+	{95, "ELAST", "protocol error"},
 }
 
 // Signal table
@@ -1638,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1665,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go
index 25cb609481..6015fcb2bf 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_amd64.go
@@ -109,6 +109,15 @@ const (
 	BPF_DIRECTION_IN                  = 0x1
 	BPF_DIRECTION_OUT                 = 0x2
 	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -137,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -177,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc110445d
+	DIOCADDRULE                       = 0xcd604404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcd60441a
+	DIOCCLRIFFLAG                     = 0xc028445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0e04412
+	DIOCCLRSTATUS                     = 0xc0284416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1204460
+	DIOCGETQUEUE                      = 0xc110445f
+	DIOCGETQUEUES                     = 0xc110445e
+	DIOCGETRULE                       = 0xcd604407
+	DIOCGETRULES                      = 0xcd604406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0104454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0104419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0284457
+	DIOCKILLSRCNODES                  = 0xc080445b
+	DIOCKILLSTATES                    = 0xc0e04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc4504443
+	DIOCRADDTABLES                    = 0xc450443d
+	DIOCRCLRADDRS                     = 0xc4504442
+	DIOCRCLRASTATS                    = 0xc4504448
+	DIOCRCLRTABLES                    = 0xc450443c
+	DIOCRCLRTSTATS                    = 0xc4504441
+	DIOCRDELADDRS                     = 0xc4504444
+	DIOCRDELTABLES                    = 0xc450443e
+	DIOCRGETADDRS                     = 0xc4504446
+	DIOCRGETASTATS                    = 0xc4504447
+	DIOCRGETTABLES                    = 0xc450443f
+	DIOCRGETTSTATS                    = 0xc4504440
+	DIOCRINADEFINE                    = 0xc450444d
+	DIOCRSETADDRS                     = 0xc4504445
+	DIOCRSETTFLAGS                    = 0xc450444a
+	DIOCRTSTADDRS                     = 0xc4504449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0284459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0284414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc0104451
+	DIOCXCOMMIT                       = 0xc0104452
+	DIOCXROLLBACK                     = 0xc0104453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -240,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -292,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -323,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -351,15 +423,17 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
+	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
 	ETHERTYPE_PPP                     = 0x880b
@@ -441,10 +515,11 @@ const (
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
 	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x8
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
@@ -466,7 +541,7 @@ const (
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
 	EV_RECEIPT                        = 0x40
-	EV_SYSFLAGS                       = 0xf000
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -732,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -797,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -906,6 +984,9 @@ const (
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
 	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
@@ -970,12 +1051,26 @@ const (
 	MNT_ROOTFS                        = 0x4000
 	MNT_SOFTDEP                       = 0x4000000
 	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
 	MNT_SYNCHRONOUS                   = 0x2
 	MNT_UPDATE                        = 0x10000
 	MNT_VISFLAGMASK                   = 0x400ffff
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -988,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -996,7 +1092,8 @@ const (
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
 	NET_RT_IFNAMES                    = 0x6
-	NET_RT_MAXID                      = 0x7
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
@@ -1013,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -1130,9 +1228,11 @@ const (
 	RTF_STATIC                        = 0x800
 	RTF_UP                            = 0x1
 	RTF_USETRAILERS                   = 0x8000
+	RTM_80211INFO                     = 0x15
 	RTM_ADD                           = 0x1
 	RTM_BFD                           = 0x12
 	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
 	RTM_DELADDR                       = 0xd
 	RTM_DELETE                        = 0x2
 	RTM_DESYNC                        = 0x10
@@ -1140,7 +1240,6 @@ const (
 	RTM_IFANNOUNCE                    = 0xf
 	RTM_IFINFO                        = 0xe
 	RTM_INVALIDATE                    = 0x11
-	RTM_LOCK                          = 0x8
 	RTM_LOSING                        = 0x5
 	RTM_MAXSIZE                       = 0x800
 	RTM_MISS                          = 0x7
@@ -1148,7 +1247,7 @@ const (
 	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1166,6 +1265,9 @@ const (
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
@@ -1182,35 +1284,37 @@ const (
 	SIOCBRDGDELS                      = 0x80606942
 	SIOCBRDGFLUSH                     = 0x80606948
 	SIOCBRDGFRL                       = 0x808c694e
-	SIOCBRDGGCACHE                    = 0xc0186941
-	SIOCBRDGGFD                       = 0xc0186952
-	SIOCBRDGGHT                       = 0xc0186951
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
 	SIOCBRDGGIFFLGS                   = 0xc060693e
-	SIOCBRDGGMA                       = 0xc0186953
+	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc0406958
-	SIOCBRDGGPRI                      = 0xc0186950
+	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc030694f
-	SIOCBRDGGTO                       = 0xc0186946
+	SIOCBRDGGTO                       = 0xc0146946
 	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0206943
 	SIOCBRDGSADDR                     = 0xc1286944
-	SIOCBRDGSCACHE                    = 0x80186940
-	SIOCBRDGSFD                       = 0x80186952
-	SIOCBRDGSHT                       = 0x80186951
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
 	SIOCBRDGSIFCOST                   = 0x80606955
 	SIOCBRDGSIFFLGS                   = 0x8060693f
 	SIOCBRDGSIFPRIO                   = 0x80606954
 	SIOCBRDGSIFPROT                   = 0x8060694a
-	SIOCBRDGSMA                       = 0x80186953
-	SIOCBRDGSPRI                      = 0x80186950
-	SIOCBRDGSPROTO                    = 0x8018695a
-	SIOCBRDGSTO                       = 0x80186945
-	SIOCBRDGSTXHC                     = 0x80186959
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
 	SIOCDIFGROUP                      = 0x80286989
 	SIOCDIFPARENT                     = 0x802069b4
 	SIOCDIFPHYADDR                    = 0x80206949
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
 	SIOCDVNETID                       = 0x802069af
 	SIOCGETKALIVE                     = 0xc01869a4
 	SIOCGETLABEL                      = 0x8020699a
@@ -1229,6 +1333,7 @@ const (
 	SIOCGIFFLAGS                      = 0xc0206911
 	SIOCGIFGATTR                      = 0xc028698b
 	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc028698d
 	SIOCGIFGMEMB                      = 0xc028698a
 	SIOCGIFGROUP                      = 0xc0286988
 	SIOCGIFHARDMTU                    = 0xc02069a5
@@ -1243,13 +1348,21 @@ const (
 	SIOCGIFRDOMAIN                    = 0xc02069a0
 	SIOCGIFRTLABEL                    = 0xc0206983
 	SIOCGIFRXR                        = 0x802069aa
+	SIOCGIFSFFPAGE                    = 0xc1126939
 	SIOCGIFXFLAGS                     = 0xc020699e
 	SIOCGLIFPHYADDR                   = 0xc218694b
 	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
 	SIOCGLIFPHYRTABLE                 = 0xc02069a2
 	SIOCGLIFPHYTTL                    = 0xc02069a9
 	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
 	SIOCGUMBINFO                      = 0xc02069be
 	SIOCGUMBPARAM                     = 0xc02069c0
 	SIOCGVH                           = 0xc02069f6
@@ -1287,19 +1400,20 @@ const (
 	SIOCSIFXFLAGS                     = 0x8020699d
 	SIOCSLIFPHYADDR                   = 0x8218694a
 	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
 	SIOCSLIFPHYRTABLE                 = 0x802069a1
 	SIOCSLIFPHYTTL                    = 0x802069a8
 	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
 	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
 	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
-	SIOCSWGDPID                       = 0xc018695b
-	SIOCSWGMAXFLOW                    = 0xc0186960
-	SIOCSWGMAXGROUP                   = 0xc018695d
-	SIOCSWSDPID                       = 0x8018695c
-	SIOCSWSPORTNO                     = 0xc060695f
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
 	SOCK_DNS                          = 0x1000
@@ -1314,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1321,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1370,7 +1486,18 @@ const (
 	TCOFLUSH                          = 0x2
 	TCOOFF                            = 0x1
 	TCOON                             = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1379,8 +1506,11 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
 	TIOCCBRK                          = 0x2000747a
 	TIOCCDTR                          = 0x20007478
 	TIOCCHKVERAUTH                    = 0x2000741e
@@ -1445,7 +1575,6 @@ const (
 	TIOCSPGRP                         = 0x80047476
 	TIOCSTART                         = 0x2000746e
 	TIOCSTAT                          = 0x20007465
-	TIOCSTI                           = 0x80017472
 	TIOCSTOP                          = 0x2000746f
 	TIOCSTSTAMP                       = 0x8008745a
 	TIOCSWINSZ                        = 0x80087467
@@ -1467,7 +1596,8 @@ const (
 	VMIN                              = 0x10
 	VM_ANONMIN                        = 0x7
 	VM_LOADAVG                        = 0x2
-	VM_MAXID                          = 0xc
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
 	VM_MAXSLP                         = 0xa
 	VM_METER                          = 0x1
 	VM_NKMEMPAGES                     = 0x6
@@ -1745,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1772,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go
index aef6c08560..8d44955e44 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm.go
@@ -46,6 +46,7 @@ const (
 	AF_SNA                            = 0xb
 	AF_UNIX                           = 0x1
 	AF_UNSPEC                         = 0x0
+	ALTWERASE                         = 0x200
 	ARPHRD_ETHER                      = 0x1
 	ARPHRD_FRELAY                     = 0xf
 	ARPHRD_IEEE1394                   = 0x18
@@ -82,7 +83,7 @@ const (
 	BIOCGFILDROP                      = 0x40044278
 	BIOCGHDRCMPLT                     = 0x40044274
 	BIOCGRSIG                         = 0x40044273
-	BIOCGRTIMEOUT                     = 0x400c426e
+	BIOCGRTIMEOUT                     = 0x4010426e
 	BIOCGSTATS                        = 0x4008426f
 	BIOCIMMEDIATE                     = 0x80044270
 	BIOCLOCK                          = 0x20004276
@@ -96,7 +97,7 @@ const (
 	BIOCSFILDROP                      = 0x80044279
 	BIOCSHDRCMPLT                     = 0x80044275
 	BIOCSRSIG                         = 0x80044272
-	BIOCSRTIMEOUT                     = 0x800c426d
+	BIOCSRTIMEOUT                     = 0x8010426d
 	BIOCVERSION                       = 0x40044271
 	BPF_A                             = 0x10
 	BPF_ABS                           = 0x20
@@ -108,6 +109,15 @@ const (
 	BPF_DIRECTION_IN                  = 0x1
 	BPF_DIRECTION_OUT                 = 0x2
 	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -136,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -147,6 +158,12 @@ const (
 	BRKINT                            = 0x2
 	CFLUSH                            = 0xf
 	CLOCAL                            = 0x8000
+	CLOCK_BOOTTIME                    = 0x6
+	CLOCK_MONOTONIC                   = 0x3
+	CLOCK_PROCESS_CPUTIME_ID          = 0x2
+	CLOCK_REALTIME                    = 0x0
+	CLOCK_THREAD_CPUTIME_ID           = 0x4
+	CLOCK_UPTIME                      = 0x5
 	CPUSTATES                         = 0x6
 	CP_IDLE                           = 0x5
 	CP_INTR                           = 0x4
@@ -170,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc100445d
+	DIOCADDRULE                       = 0xcce04404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcce0441a
+	DIOCCLRIFFLAG                     = 0xc024445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0d04412
+	DIOCCLRSTATUS                     = 0xc0244416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1084460
+	DIOCGETQUEUE                      = 0xc100445f
+	DIOCGETQUEUES                     = 0xc100445e
+	DIOCGETRULE                       = 0xcce04407
+	DIOCGETRULES                      = 0xcce04406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0084454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0084419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0244457
+	DIOCKILLSRCNODES                  = 0xc068445b
+	DIOCKILLSTATES                    = 0xc0d04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc44c4443
+	DIOCRADDTABLES                    = 0xc44c443d
+	DIOCRCLRADDRS                     = 0xc44c4442
+	DIOCRCLRASTATS                    = 0xc44c4448
+	DIOCRCLRTABLES                    = 0xc44c443c
+	DIOCRCLRTSTATS                    = 0xc44c4441
+	DIOCRDELADDRS                     = 0xc44c4444
+	DIOCRDELTABLES                    = 0xc44c443e
+	DIOCRGETADDRS                     = 0xc44c4446
+	DIOCRGETASTATS                    = 0xc44c4447
+	DIOCRGETTABLES                    = 0xc44c443f
+	DIOCRGETTSTATS                    = 0xc44c4440
+	DIOCRINADEFINE                    = 0xc44c444d
+	DIOCRSETADDRS                     = 0xc44c4445
+	DIOCRSETTFLAGS                    = 0xc44c444a
+	DIOCRTSTADDRS                     = 0xc44c4449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0244459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0244414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc00c4451
+	DIOCXCOMMIT                       = 0xc00c4452
+	DIOCXROLLBACK                     = 0xc00c4453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -186,6 +261,7 @@ const (
 	DLT_LOOP                          = 0xc
 	DLT_MPLS                          = 0xdb
 	DLT_NULL                          = 0x0
+	DLT_OPENFLOW                      = 0x10b
 	DLT_PFLOG                         = 0x75
 	DLT_PFSYNC                        = 0x12
 	DLT_PPP                           = 0x9
@@ -196,6 +272,23 @@ const (
 	DLT_RAW                           = 0xe
 	DLT_SLIP                          = 0x8
 	DLT_SLIP_BSDOS                    = 0xf
+	DLT_USBPCAP                       = 0xf9
+	DLT_USER0                         = 0x93
+	DLT_USER1                         = 0x94
+	DLT_USER10                        = 0x9d
+	DLT_USER11                        = 0x9e
+	DLT_USER12                        = 0x9f
+	DLT_USER13                        = 0xa0
+	DLT_USER14                        = 0xa1
+	DLT_USER15                        = 0xa2
+	DLT_USER2                         = 0x95
+	DLT_USER3                         = 0x96
+	DLT_USER4                         = 0x97
+	DLT_USER5                         = 0x98
+	DLT_USER6                         = 0x99
+	DLT_USER7                         = 0x9a
+	DLT_USER8                         = 0x9b
+	DLT_USER9                         = 0x9c
 	DT_BLK                            = 0x6
 	DT_CHR                            = 0x2
 	DT_DIR                            = 0x4
@@ -215,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -267,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -298,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -326,15 +423,17 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
+	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
 	ETHERTYPE_PPP                     = 0x880b
@@ -409,28 +508,40 @@ const (
 	ETHER_CRC_POLY_LE                 = 0xedb88320
 	ETHER_HDR_LEN                     = 0xe
 	ETHER_MAX_DIX_LEN                 = 0x600
+	ETHER_MAX_HARDMTU_LEN             = 0xff9b
 	ETHER_MAX_LEN                     = 0x5ee
 	ETHER_MIN_LEN                     = 0x40
 	ETHER_TYPE_LEN                    = 0x2
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
+	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x7
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
+	EVL_ENCAPLEN                      = 0x4
+	EVL_PRIO_BITS                     = 0xd
+	EVL_PRIO_MAX                      = 0x7
+	EVL_VLID_MASK                     = 0xfff
+	EVL_VLID_MAX                      = 0xffe
+	EVL_VLID_MIN                      = 0x1
+	EVL_VLID_NULL                     = 0x0
 	EV_ADD                            = 0x1
 	EV_CLEAR                          = 0x20
 	EV_DELETE                         = 0x2
 	EV_DISABLE                        = 0x8
+	EV_DISPATCH                       = 0x80
 	EV_ENABLE                         = 0x4
 	EV_EOF                            = 0x8000
 	EV_ERROR                          = 0x4000
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
-	EV_SYSFLAGS                       = 0xf000
+	EV_RECEIPT                        = 0x40
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -443,6 +554,8 @@ const (
 	F_GETFL                           = 0x3
 	F_GETLK                           = 0x7
 	F_GETOWN                          = 0x5
+	F_ISATTY                          = 0xb
+	F_OK                              = 0x0
 	F_RDLCK                           = 0x1
 	F_SETFD                           = 0x2
 	F_SETFL                           = 0x4
@@ -459,7 +572,6 @@ const (
 	IEXTEN                            = 0x400
 	IFAN_ARRIVAL                      = 0x0
 	IFAN_DEPARTURE                    = 0x1
-	IFA_ROUTE                         = 0x1
 	IFF_ALLMULTI                      = 0x200
 	IFF_BROADCAST                     = 0x2
 	IFF_CANTCHANGE                    = 0x8e52
@@ -470,12 +582,12 @@ const (
 	IFF_LOOPBACK                      = 0x8
 	IFF_MULTICAST                     = 0x8000
 	IFF_NOARP                         = 0x80
-	IFF_NOTRAILERS                    = 0x20
 	IFF_OACTIVE                       = 0x400
 	IFF_POINTOPOINT                   = 0x10
 	IFF_PROMISC                       = 0x100
 	IFF_RUNNING                       = 0x40
 	IFF_SIMPLEX                       = 0x800
+	IFF_STATICARP                     = 0x20
 	IFF_UP                            = 0x1
 	IFNAMSIZ                          = 0x10
 	IFT_1822                          = 0x2
@@ -604,6 +716,7 @@ const (
 	IFT_LINEGROUP                     = 0xd2
 	IFT_LOCALTALK                     = 0x2a
 	IFT_LOOP                          = 0x18
+	IFT_MBIM                          = 0xfa
 	IFT_MEDIAMAILOVERIP               = 0x8b
 	IFT_MFSIGLINK                     = 0xa7
 	IFT_MIOX25                        = 0x26
@@ -694,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -728,8 +842,6 @@ const (
 	IPPROTO_AH                        = 0x33
 	IPPROTO_CARP                      = 0x70
 	IPPROTO_DIVERT                    = 0x102
-	IPPROTO_DIVERT_INIT               = 0x2
-	IPPROTO_DIVERT_RESP               = 0x1
 	IPPROTO_DONE                      = 0x101
 	IPPROTO_DSTOPTS                   = 0x3c
 	IPPROTO_EGP                       = 0x8
@@ -761,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -786,6 +900,7 @@ const (
 	IPV6_LEAVE_GROUP                  = 0xd
 	IPV6_MAXHLIM                      = 0xff
 	IPV6_MAXPACKET                    = 0xffff
+	IPV6_MINHOPCOUNT                  = 0x41
 	IPV6_MMTU                         = 0x500
 	IPV6_MULTICAST_HOPS               = 0xa
 	IPV6_MULTICAST_IF                 = 0x9
@@ -825,12 +940,12 @@ const (
 	IP_DEFAULT_MULTICAST_LOOP         = 0x1
 	IP_DEFAULT_MULTICAST_TTL          = 0x1
 	IP_DF                             = 0x4000
-	IP_DIVERTFL                       = 0x1022
 	IP_DROP_MEMBERSHIP                = 0xd
 	IP_ESP_NETWORK_LEVEL              = 0x16
 	IP_ESP_TRANS_LEVEL                = 0x15
 	IP_HDRINCL                        = 0x2
 	IP_IPCOMP_LEVEL                   = 0x1d
+	IP_IPDEFTTL                       = 0x25
 	IP_IPSECFLOWINFO                  = 0x24
 	IP_IPSEC_LOCAL_AUTH               = 0x1b
 	IP_IPSEC_LOCAL_CRED               = 0x19
@@ -864,10 +979,15 @@ const (
 	IP_RETOPTS                        = 0x8
 	IP_RF                             = 0x8000
 	IP_RTABLE                         = 0x1021
+	IP_SENDSRCADDR                    = 0x7
 	IP_TOS                            = 0x3
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
+	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
 	IXON                              = 0x200
@@ -922,6 +1042,7 @@ const (
 	MNT_NOATIME                       = 0x8000
 	MNT_NODEV                         = 0x10
 	MNT_NOEXEC                        = 0x4
+	MNT_NOPERM                        = 0x20
 	MNT_NOSUID                        = 0x8
 	MNT_NOWAIT                        = 0x2
 	MNT_QUOTA                         = 0x2000
@@ -929,12 +1050,27 @@ const (
 	MNT_RELOAD                        = 0x40000
 	MNT_ROOTFS                        = 0x4000
 	MNT_SOFTDEP                       = 0x4000000
+	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
 	MNT_SYNCHRONOUS                   = 0x2
 	MNT_UPDATE                        = 0x10000
 	MNT_VISFLAGMASK                   = 0x400ffff
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -947,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -954,12 +1091,16 @@ const (
 	NET_RT_DUMP                       = 0x1
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
-	NET_RT_MAXID                      = 0x6
+	NET_RT_IFNAMES                    = 0x6
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
 	NOFLSH                            = 0x80000000
+	NOKERNINFO                        = 0x2000000
 	NOTE_ATTRIB                       = 0x8
+	NOTE_CHANGE                       = 0x1
 	NOTE_CHILD                        = 0x4
 	NOTE_DELETE                       = 0x1
 	NOTE_EOF                          = 0x2
@@ -969,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -978,11 +1120,13 @@ const (
 	NOTE_TRUNCATE                     = 0x80
 	NOTE_WRITE                        = 0x2
 	OCRNL                             = 0x10
+	OLCUC                             = 0x20
 	ONLCR                             = 0x2
 	ONLRET                            = 0x80
 	ONOCR                             = 0x40
 	ONOEOT                            = 0x8
 	OPOST                             = 0x1
+	OXTABS                            = 0x4
 	O_ACCMODE                         = 0x3
 	O_APPEND                          = 0x8
 	O_ASYNC                           = 0x40
@@ -1027,19 +1171,25 @@ const (
 	RLIMIT_STACK                      = 0x3
 	RLIM_INFINITY                     = 0x7fffffffffffffff
 	RTAX_AUTHOR                       = 0x6
+	RTAX_BFD                          = 0xb
 	RTAX_BRD                          = 0x7
+	RTAX_DNS                          = 0xc
 	RTAX_DST                          = 0x0
 	RTAX_GATEWAY                      = 0x1
 	RTAX_GENMASK                      = 0x3
 	RTAX_IFA                          = 0x5
 	RTAX_IFP                          = 0x4
 	RTAX_LABEL                        = 0xa
-	RTAX_MAX                          = 0xb
+	RTAX_MAX                          = 0xf
 	RTAX_NETMASK                      = 0x2
+	RTAX_SEARCH                       = 0xe
 	RTAX_SRC                          = 0x8
 	RTAX_SRCMASK                      = 0x9
+	RTAX_STATIC                       = 0xd
 	RTA_AUTHOR                        = 0x40
+	RTA_BFD                           = 0x800
 	RTA_BRD                           = 0x80
+	RTA_DNS                           = 0x1000
 	RTA_DST                           = 0x1
 	RTA_GATEWAY                       = 0x2
 	RTA_GENMASK                       = 0x8
@@ -1047,24 +1197,29 @@ const (
 	RTA_IFP                           = 0x10
 	RTA_LABEL                         = 0x400
 	RTA_NETMASK                       = 0x4
+	RTA_SEARCH                        = 0x4000
 	RTA_SRC                           = 0x100
 	RTA_SRCMASK                       = 0x200
+	RTA_STATIC                        = 0x2000
 	RTF_ANNOUNCE                      = 0x4000
+	RTF_BFD                           = 0x1000000
 	RTF_BLACKHOLE                     = 0x1000
 	RTF_BROADCAST                     = 0x400000
+	RTF_CACHED                        = 0x20000
 	RTF_CLONED                        = 0x10000
 	RTF_CLONING                       = 0x100
+	RTF_CONNECTED                     = 0x800000
 	RTF_DONE                          = 0x40
 	RTF_DYNAMIC                       = 0x10
-	RTF_FMASK                         = 0x70f808
+	RTF_FMASK                         = 0x110fc08
 	RTF_GATEWAY                       = 0x2
 	RTF_HOST                          = 0x4
 	RTF_LLINFO                        = 0x400
 	RTF_LOCAL                         = 0x200000
-	RTF_MASK                          = 0x80
 	RTF_MODIFIED                      = 0x20
 	RTF_MPATH                         = 0x40000
 	RTF_MPLS                          = 0x100000
+	RTF_MULTICAST                     = 0x200
 	RTF_PERMANENT_ARP                 = 0x2000
 	RTF_PROTO1                        = 0x8000
 	RTF_PROTO2                        = 0x4000
@@ -1073,23 +1228,26 @@ const (
 	RTF_STATIC                        = 0x800
 	RTF_UP                            = 0x1
 	RTF_USETRAILERS                   = 0x8000
-	RTF_XRESOLVE                      = 0x200
+	RTM_80211INFO                     = 0x15
 	RTM_ADD                           = 0x1
+	RTM_BFD                           = 0x12
 	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
 	RTM_DELADDR                       = 0xd
 	RTM_DELETE                        = 0x2
 	RTM_DESYNC                        = 0x10
 	RTM_GET                           = 0x4
 	RTM_IFANNOUNCE                    = 0xf
 	RTM_IFINFO                        = 0xe
-	RTM_LOCK                          = 0x8
+	RTM_INVALIDATE                    = 0x11
 	RTM_LOSING                        = 0x5
 	RTM_MAXSIZE                       = 0x800
 	RTM_MISS                          = 0x7
 	RTM_NEWADDR                       = 0xc
+	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1099,67 +1257,74 @@ const (
 	RTV_RTTVAR                        = 0x80
 	RTV_SPIPE                         = 0x10
 	RTV_SSTHRESH                      = 0x20
+	RT_TABLEID_BITS                   = 0x8
+	RT_TABLEID_MASK                   = 0xff
 	RT_TABLEID_MAX                    = 0xff
 	RUSAGE_CHILDREN                   = -0x1
 	RUSAGE_SELF                       = 0x0
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
 	SIOCADDMULTI                      = 0x80206931
 	SIOCAIFADDR                       = 0x8040691a
 	SIOCAIFGROUP                      = 0x80246987
-	SIOCALIFADDR                      = 0x8218691c
 	SIOCATMARK                        = 0x40047307
-	SIOCBRDGADD                       = 0x8054693c
-	SIOCBRDGADDS                      = 0x80546941
-	SIOCBRDGARL                       = 0x806e694d
+	SIOCBRDGADD                       = 0x8060693c
+	SIOCBRDGADDL                      = 0x80606949
+	SIOCBRDGADDS                      = 0x80606941
+	SIOCBRDGARL                       = 0x808c694d
 	SIOCBRDGDADDR                     = 0x81286947
-	SIOCBRDGDEL                       = 0x8054693d
-	SIOCBRDGDELS                      = 0x80546942
-	SIOCBRDGFLUSH                     = 0x80546948
-	SIOCBRDGFRL                       = 0x806e694e
+	SIOCBRDGDEL                       = 0x8060693d
+	SIOCBRDGDELS                      = 0x80606942
+	SIOCBRDGFLUSH                     = 0x80606948
+	SIOCBRDGFRL                       = 0x808c694e
 	SIOCBRDGGCACHE                    = 0xc0146941
 	SIOCBRDGGFD                       = 0xc0146952
 	SIOCBRDGGHT                       = 0xc0146951
-	SIOCBRDGGIFFLGS                   = 0xc054693e
+	SIOCBRDGGIFFLGS                   = 0xc060693e
 	SIOCBRDGGMA                       = 0xc0146953
-	SIOCBRDGGPARAM                    = 0xc03c6958
+	SIOCBRDGGPARAM                    = 0xc0406958
 	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc028694f
-	SIOCBRDGGSIFS                     = 0xc054693c
 	SIOCBRDGGTO                       = 0xc0146946
-	SIOCBRDGIFS                       = 0xc0546942
+	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0186943
 	SIOCBRDGSADDR                     = 0xc1286944
 	SIOCBRDGSCACHE                    = 0x80146940
 	SIOCBRDGSFD                       = 0x80146952
 	SIOCBRDGSHT                       = 0x80146951
-	SIOCBRDGSIFCOST                   = 0x80546955
-	SIOCBRDGSIFFLGS                   = 0x8054693f
-	SIOCBRDGSIFPRIO                   = 0x80546954
+	SIOCBRDGSIFCOST                   = 0x80606955
+	SIOCBRDGSIFFLGS                   = 0x8060693f
+	SIOCBRDGSIFPRIO                   = 0x80606954
+	SIOCBRDGSIFPROT                   = 0x8060694a
 	SIOCBRDGSMA                       = 0x80146953
 	SIOCBRDGSPRI                      = 0x80146950
 	SIOCBRDGSPROTO                    = 0x8014695a
 	SIOCBRDGSTO                       = 0x80146945
 	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
 	SIOCDIFGROUP                      = 0x80246989
+	SIOCDIFPARENT                     = 0x802069b4
 	SIOCDIFPHYADDR                    = 0x80206949
-	SIOCDLIFADDR                      = 0x8218691e
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
+	SIOCDVNETID                       = 0x802069af
 	SIOCGETKALIVE                     = 0xc01869a4
 	SIOCGETLABEL                      = 0x8020699a
+	SIOCGETMPWCFG                     = 0xc02069ae
 	SIOCGETPFLOW                      = 0xc02069fe
 	SIOCGETPFSYNC                     = 0xc02069f8
 	SIOCGETSGCNT                      = 0xc0147534
 	SIOCGETVIFCNT                     = 0xc0147533
 	SIOCGETVLAN                       = 0xc0206990
-	SIOCGHIWAT                        = 0x40047301
 	SIOCGIFADDR                       = 0xc0206921
-	SIOCGIFASYNCMAP                   = 0xc020697c
 	SIOCGIFBRDADDR                    = 0xc0206923
 	SIOCGIFCONF                       = 0xc0086924
 	SIOCGIFDATA                       = 0xc020691b
@@ -1168,41 +1333,53 @@ const (
 	SIOCGIFFLAGS                      = 0xc0206911
 	SIOCGIFGATTR                      = 0xc024698b
 	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc024698d
 	SIOCGIFGMEMB                      = 0xc024698a
 	SIOCGIFGROUP                      = 0xc0246988
 	SIOCGIFHARDMTU                    = 0xc02069a5
-	SIOCGIFMEDIA                      = 0xc0286936
+	SIOCGIFLLPRIO                     = 0xc02069b6
+	SIOCGIFMEDIA                      = 0xc0386938
 	SIOCGIFMETRIC                     = 0xc0206917
 	SIOCGIFMTU                        = 0xc020697e
 	SIOCGIFNETMASK                    = 0xc0206925
-	SIOCGIFPDSTADDR                   = 0xc0206948
+	SIOCGIFPAIR                       = 0xc02069b1
+	SIOCGIFPARENT                     = 0xc02069b3
 	SIOCGIFPRIORITY                   = 0xc020699c
-	SIOCGIFPSRCADDR                   = 0xc0206947
 	SIOCGIFRDOMAIN                    = 0xc02069a0
 	SIOCGIFRTLABEL                    = 0xc0206983
 	SIOCGIFRXR                        = 0x802069aa
-	SIOCGIFTIMESLOT                   = 0xc0206986
+	SIOCGIFSFFPAGE                    = 0xc1126939
 	SIOCGIFXFLAGS                     = 0xc020699e
-	SIOCGLIFADDR                      = 0xc218691d
 	SIOCGLIFPHYADDR                   = 0xc218694b
+	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
 	SIOCGLIFPHYRTABLE                 = 0xc02069a2
 	SIOCGLIFPHYTTL                    = 0xc02069a9
-	SIOCGLOWAT                        = 0x40047303
 	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
+	SIOCGUMBINFO                      = 0xc02069be
+	SIOCGUMBPARAM                     = 0xc02069c0
 	SIOCGVH                           = 0xc02069f6
+	SIOCGVNETFLOWID                   = 0xc02069c4
 	SIOCGVNETID                       = 0xc02069a7
+	SIOCIFAFATTACH                    = 0x801169ab
+	SIOCIFAFDETACH                    = 0x801169ac
 	SIOCIFCREATE                      = 0x8020697a
 	SIOCIFDESTROY                     = 0x80206979
 	SIOCIFGCLONERS                    = 0xc00c6978
 	SIOCSETKALIVE                     = 0x801869a3
 	SIOCSETLABEL                      = 0x80206999
+	SIOCSETMPWCFG                     = 0x802069ad
 	SIOCSETPFLOW                      = 0x802069fd
 	SIOCSETPFSYNC                     = 0x802069f7
 	SIOCSETVLAN                       = 0x8020698f
-	SIOCSHIWAT                        = 0x80047300
 	SIOCSIFADDR                       = 0x8020690c
-	SIOCSIFASYNCMAP                   = 0x8020697d
 	SIOCSIFBRDADDR                    = 0x80206913
 	SIOCSIFDESCR                      = 0x80206980
 	SIOCSIFDSTADDR                    = 0x8020690e
@@ -1210,26 +1387,36 @@ const (
 	SIOCSIFGATTR                      = 0x8024698c
 	SIOCSIFGENERIC                    = 0x80206939
 	SIOCSIFLLADDR                     = 0x8020691f
-	SIOCSIFMEDIA                      = 0xc0206935
+	SIOCSIFLLPRIO                     = 0x802069b5
+	SIOCSIFMEDIA                      = 0xc0206937
 	SIOCSIFMETRIC                     = 0x80206918
 	SIOCSIFMTU                        = 0x8020697f
 	SIOCSIFNETMASK                    = 0x80206916
-	SIOCSIFPHYADDR                    = 0x80406946
+	SIOCSIFPAIR                       = 0x802069b0
+	SIOCSIFPARENT                     = 0x802069b2
 	SIOCSIFPRIORITY                   = 0x8020699b
 	SIOCSIFRDOMAIN                    = 0x8020699f
 	SIOCSIFRTLABEL                    = 0x80206982
-	SIOCSIFTIMESLOT                   = 0x80206985
 	SIOCSIFXFLAGS                     = 0x8020699d
 	SIOCSLIFPHYADDR                   = 0x8218694a
+	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
 	SIOCSLIFPHYRTABLE                 = 0x802069a1
 	SIOCSLIFPHYTTL                    = 0x802069a8
-	SIOCSLOWAT                        = 0x80047302
 	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
+	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
+	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
+	SOCK_DNS                          = 0x1000
 	SOCK_NONBLOCK                     = 0x4000
 	SOCK_RAW                          = 0x3
 	SOCK_RDM                          = 0x4
@@ -1241,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1248,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1261,6 +1450,7 @@ const (
 	SO_TIMESTAMP                      = 0x800
 	SO_TYPE                           = 0x1008
 	SO_USELOOPBACK                    = 0x40
+	SO_ZEROIZE                        = 0x2000
 	S_BLKSIZE                         = 0x200
 	S_IEXEC                           = 0x40
 	S_IFBLK                           = 0x6000
@@ -1290,9 +1480,24 @@ const (
 	S_IXOTH                           = 0x1
 	S_IXUSR                           = 0x40
 	TCIFLUSH                          = 0x1
+	TCIOFF                            = 0x3
 	TCIOFLUSH                         = 0x3
+	TCION                             = 0x4
 	TCOFLUSH                          = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCOOFF                            = 0x1
+	TCOON                             = 0x2
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1301,11 +1506,15 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
-	TCP_NSTATES                       = 0xb
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
 	TIOCCBRK                          = 0x2000747a
 	TIOCCDTR                          = 0x20007478
+	TIOCCHKVERAUTH                    = 0x2000741e
+	TIOCCLRVERAUTH                    = 0x2000741d
 	TIOCCONS                          = 0x80047462
 	TIOCDRAIN                         = 0x2000745e
 	TIOCEXCL                          = 0x2000740d
@@ -1321,7 +1530,7 @@ const (
 	TIOCGFLAGS                        = 0x4004745d
 	TIOCGPGRP                         = 0x40047477
 	TIOCGSID                          = 0x40047463
-	TIOCGTSTAMP                       = 0x400c745b
+	TIOCGTSTAMP                       = 0x4010745b
 	TIOCGWINSZ                        = 0x40087468
 	TIOCMBIC                          = 0x8004746b
 	TIOCMBIS                          = 0x8004746c
@@ -1360,17 +1569,21 @@ const (
 	TIOCSETAF                         = 0x802c7416
 	TIOCSETAW                         = 0x802c7415
 	TIOCSETD                          = 0x8004741b
+	TIOCSETVERAUTH                    = 0x8004741c
 	TIOCSFLAGS                        = 0x8004745c
 	TIOCSIG                           = 0x8004745f
 	TIOCSPGRP                         = 0x80047476
 	TIOCSTART                         = 0x2000746e
-	TIOCSTAT                          = 0x80047465
-	TIOCSTI                           = 0x80017472
+	TIOCSTAT                          = 0x20007465
 	TIOCSTOP                          = 0x2000746f
 	TIOCSTSTAMP                       = 0x8008745a
 	TIOCSWINSZ                        = 0x80087467
 	TIOCUCNTL                         = 0x80047466
+	TIOCUCNTL_CBRK                    = 0x7a
+	TIOCUCNTL_SBRK                    = 0x7b
 	TOSTOP                            = 0x400000
+	UTIME_NOW                         = -0x2
+	UTIME_OMIT                        = -0x1
 	VDISCARD                          = 0xf
 	VDSUSP                            = 0xb
 	VEOF                              = 0x0
@@ -1381,6 +1594,19 @@ const (
 	VKILL                             = 0x5
 	VLNEXT                            = 0xe
 	VMIN                              = 0x10
+	VM_ANONMIN                        = 0x7
+	VM_LOADAVG                        = 0x2
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
+	VM_MAXSLP                         = 0xa
+	VM_METER                          = 0x1
+	VM_NKMEMPAGES                     = 0x6
+	VM_PSSTRINGS                      = 0x3
+	VM_SWAPENCRYPT                    = 0x5
+	VM_USPACE                         = 0xb
+	VM_UVMEXP                         = 0x4
+	VM_VNODEMIN                       = 0x9
+	VM_VTEXTMIN                       = 0x8
 	VQUIT                             = 0x9
 	VREPRINT                          = 0x6
 	VSTART                            = 0xc
@@ -1394,6 +1620,7 @@ const (
 	WCOREFLAG                         = 0x80
 	WNOHANG                           = 0x1
 	WUNTRACED                         = 0x2
+	XCASE                             = 0x1000000
 )
 
 // Errors
@@ -1407,6 +1634,7 @@ const (
 	EALREADY        = syscall.Errno(0x25)
 	EAUTH           = syscall.Errno(0x50)
 	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x5c)
 	EBADRPC         = syscall.Errno(0x48)
 	EBUSY           = syscall.Errno(0x10)
 	ECANCELED       = syscall.Errno(0x58)
@@ -1433,7 +1661,7 @@ const (
 	EIPSEC          = syscall.Errno(0x52)
 	EISCONN         = syscall.Errno(0x38)
 	EISDIR          = syscall.Errno(0x15)
-	ELAST           = syscall.Errno(0x5b)
+	ELAST           = syscall.Errno(0x5f)
 	ELOOP           = syscall.Errno(0x3e)
 	EMEDIUMTYPE     = syscall.Errno(0x56)
 	EMFILE          = syscall.Errno(0x18)
@@ -1461,12 +1689,14 @@ const (
 	ENOTCONN        = syscall.Errno(0x39)
 	ENOTDIR         = syscall.Errno(0x14)
 	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5d)
 	ENOTSOCK        = syscall.Errno(0x26)
 	ENOTSUP         = syscall.Errno(0x5b)
 	ENOTTY          = syscall.Errno(0x19)
 	ENXIO           = syscall.Errno(0x6)
 	EOPNOTSUPP      = syscall.Errno(0x2d)
 	EOVERFLOW       = syscall.Errno(0x57)
+	EOWNERDEAD      = syscall.Errno(0x5e)
 	EPERM           = syscall.Errno(0x1)
 	EPFNOSUPPORT    = syscall.Errno(0x2e)
 	EPIPE           = syscall.Errno(0x20)
@@ -1474,6 +1704,7 @@ const (
 	EPROCUNAVAIL    = syscall.Errno(0x4c)
 	EPROGMISMATCH   = syscall.Errno(0x4b)
 	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5f)
 	EPROTONOSUPPORT = syscall.Errno(0x2b)
 	EPROTOTYPE      = syscall.Errno(0x29)
 	ERANGE          = syscall.Errno(0x22)
@@ -1570,7 +1801,7 @@ var errorList = [...]struct {
 	{32, "EPIPE", "broken pipe"},
 	{33, "EDOM", "numerical argument out of domain"},
 	{34, "ERANGE", "result too large"},
-	{35, "EWOULDBLOCK", "resource temporarily unavailable"},
+	{35, "EAGAIN", "resource temporarily unavailable"},
 	{36, "EINPROGRESS", "operation now in progress"},
 	{37, "EALREADY", "operation already in progress"},
 	{38, "ENOTSOCK", "socket operation on non-socket"},
@@ -1626,7 +1857,11 @@ var errorList = [...]struct {
 	{88, "ECANCELED", "operation canceled"},
 	{89, "EIDRM", "identifier removed"},
 	{90, "ENOMSG", "no message of desired type"},
-	{91, "ELAST", "not supported"},
+	{91, "ENOTSUP", "not supported"},
+	{92, "EBADMSG", "bad message"},
+	{93, "ENOTRECOVERABLE", "state not recoverable"},
+	{94, "EOWNERDEAD", "previous owner died"},
+	{95, "ELAST", "protocol error"},
 }
 
 // Signal table
@@ -1640,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1667,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go
index 90de7dfc33..ae16fe7542 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_arm64.go
@@ -112,6 +112,12 @@ const (
 	BPF_FILDROP_CAPTURE               = 0x1
 	BPF_FILDROP_DROP                  = 0x2
 	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -140,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -180,7 +187,65 @@ const (
 	CTL_KERN                          = 0x1
 	CTL_MAXNAME                       = 0xc
 	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc110445d
+	DIOCADDRULE                       = 0xcd604404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcd60441a
+	DIOCCLRIFFLAG                     = 0xc028445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0e04412
+	DIOCCLRSTATUS                     = 0xc0284416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1204460
+	DIOCGETQUEUE                      = 0xc110445f
+	DIOCGETQUEUES                     = 0xc110445e
+	DIOCGETRULE                       = 0xcd604407
+	DIOCGETRULES                      = 0xcd604406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0104454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0104419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0284457
+	DIOCKILLSRCNODES                  = 0xc080445b
+	DIOCKILLSTATES                    = 0xc0e04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
 	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc4504443
+	DIOCRADDTABLES                    = 0xc450443d
+	DIOCRCLRADDRS                     = 0xc4504442
+	DIOCRCLRASTATS                    = 0xc4504448
+	DIOCRCLRTABLES                    = 0xc450443c
+	DIOCRCLRTSTATS                    = 0xc4504441
+	DIOCRDELADDRS                     = 0xc4504444
+	DIOCRDELTABLES                    = 0xc450443e
+	DIOCRGETADDRS                     = 0xc4504446
+	DIOCRGETASTATS                    = 0xc4504447
+	DIOCRGETTABLES                    = 0xc450443f
+	DIOCRGETTSTATS                    = 0xc4504440
+	DIOCRINADEFINE                    = 0xc450444d
+	DIOCRSETADDRS                     = 0xc4504445
+	DIOCRSETTFLAGS                    = 0xc450444a
+	DIOCRTSTADDRS                     = 0xc4504449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0284459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0284414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc0104451
+	DIOCXCOMMIT                       = 0xc0104452
+	DIOCXROLLBACK                     = 0xc0104453
 	DLT_ARCNET                        = 0x7
 	DLT_ATM_RFC1483                   = 0xb
 	DLT_AX25                          = 0x3
@@ -243,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -295,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -326,6 +394,7 @@ const (
 	ETHERTYPE_LLDP                    = 0x88cc
 	ETHERTYPE_LOGICRAFT               = 0x8148
 	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
 	ETHERTYPE_MATRA                   = 0x807a
 	ETHERTYPE_MAX                     = 0xffff
 	ETHERTYPE_MERIT                   = 0x807c
@@ -354,15 +423,16 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
 	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
@@ -445,10 +515,11 @@ const (
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
 	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x8
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
@@ -470,7 +541,7 @@ const (
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
 	EV_RECEIPT                        = 0x40
-	EV_SYSFLAGS                       = 0xf000
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -736,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -801,9 +873,11 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
 	IPV6_AUTH_LEVEL                   = 0x35
 	IPV6_AUTOFLOWLABEL                = 0x3b
 	IPV6_CHECKSUM                     = 0x1a
@@ -910,6 +984,9 @@ const (
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
 	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
@@ -981,6 +1058,19 @@ const (
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -993,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -1001,7 +1092,8 @@ const (
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
 	NET_RT_IFNAMES                    = 0x6
-	NET_RT_MAXID                      = 0x7
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
@@ -1018,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -1154,7 +1247,7 @@ const (
 	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1172,6 +1265,9 @@ const (
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
@@ -1188,30 +1284,30 @@ const (
 	SIOCBRDGDELS                      = 0x80606942
 	SIOCBRDGFLUSH                     = 0x80606948
 	SIOCBRDGFRL                       = 0x808c694e
-	SIOCBRDGGCACHE                    = 0xc0186941
-	SIOCBRDGGFD                       = 0xc0186952
-	SIOCBRDGGHT                       = 0xc0186951
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
 	SIOCBRDGGIFFLGS                   = 0xc060693e
-	SIOCBRDGGMA                       = 0xc0186953
+	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc0406958
-	SIOCBRDGGPRI                      = 0xc0186950
+	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc030694f
-	SIOCBRDGGTO                       = 0xc0186946
+	SIOCBRDGGTO                       = 0xc0146946
 	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0206943
 	SIOCBRDGSADDR                     = 0xc1286944
-	SIOCBRDGSCACHE                    = 0x80186940
-	SIOCBRDGSFD                       = 0x80186952
-	SIOCBRDGSHT                       = 0x80186951
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
 	SIOCBRDGSIFCOST                   = 0x80606955
 	SIOCBRDGSIFFLGS                   = 0x8060693f
 	SIOCBRDGSIFPRIO                   = 0x80606954
 	SIOCBRDGSIFPROT                   = 0x8060694a
-	SIOCBRDGSMA                       = 0x80186953
-	SIOCBRDGSPRI                      = 0x80186950
-	SIOCBRDGSPROTO                    = 0x8018695a
-	SIOCBRDGSTO                       = 0x80186945
-	SIOCBRDGSTXHC                     = 0x80186959
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
 	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
@@ -1264,6 +1360,7 @@ const (
 	SIOCGPWE3CTRLWORD                 = 0xc02069dc
 	SIOCGPWE3FAT                      = 0xc02069dd
 	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
 	SIOCGSPPPPARAMS                   = 0xc0206994
 	SIOCGTXHPRIO                      = 0xc02069c6
 	SIOCGUMBINFO                      = 0xc02069be
@@ -1310,17 +1407,13 @@ const (
 	SIOCSPWE3CTRLWORD                 = 0x802069dc
 	SIOCSPWE3FAT                      = 0x802069dd
 	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
 	SIOCSSPPPPARAMS                   = 0x80206993
 	SIOCSTXHPRIO                      = 0x802069c5
 	SIOCSUMBPARAM                     = 0x802069bf
 	SIOCSVH                           = 0xc02069f5
 	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
-	SIOCSWGDPID                       = 0xc018695b
-	SIOCSWGMAXFLOW                    = 0xc0186960
-	SIOCSWGMAXGROUP                   = 0xc018695d
-	SIOCSWSDPID                       = 0x8018695c
-	SIOCSWSPORTNO                     = 0xc060695f
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
 	SOCK_DNS                          = 0x1000
@@ -1335,6 +1428,7 @@ const (
 	SO_BINDANY                        = 0x1000
 	SO_BROADCAST                      = 0x20
 	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
 	SO_DONTROUTE                      = 0x10
 	SO_ERROR                          = 0x1007
 	SO_KEEPALIVE                      = 0x8
@@ -1342,6 +1436,7 @@ const (
 	SO_NETPROC                        = 0x1020
 	SO_OOBINLINE                      = 0x100
 	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
 	SO_RCVBUF                         = 0x1002
 	SO_RCVLOWAT                       = 0x1004
 	SO_RCVTIMEO                       = 0x1006
@@ -1391,7 +1486,18 @@ const (
 	TCOFLUSH                          = 0x2
 	TCOOFF                            = 0x1
 	TCOON                             = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1400,6 +1506,7 @@ const (
 	TCP_MSS                           = 0x200
 	TCP_NODELAY                       = 0x1
 	TCP_NOPUSH                        = 0x10
+	TCP_SACKHOLE_LIMIT                = 0x80
 	TCP_SACK_ENABLE                   = 0x8
 	TCSAFLUSH                         = 0x2
 	TIMER_ABSTIME                     = 0x1
@@ -1768,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1795,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{28672, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go
index f1154ff56f..03d90fe355 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_mips64.go
@@ -112,6 +112,12 @@ const (
 	BPF_FILDROP_CAPTURE               = 0x1
 	BPF_FILDROP_DROP                  = 0x2
 	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
 	BPF_H                             = 0x8
 	BPF_IMM                           = 0x0
 	BPF_IND                           = 0x40
@@ -140,6 +146,7 @@ const (
 	BPF_OR                            = 0x40
 	BPF_RELEASE                       = 0x30bb6
 	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
 	BPF_RSH                           = 0x70
 	BPF_ST                            = 0x2
 	BPF_STX                           = 0x3
@@ -301,6 +308,8 @@ const (
 	EMUL_ENABLED                      = 0x1
 	EMUL_NATIVE                       = 0x2
 	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
 	ETHERMIN                          = 0x2e
 	ETHERMTU                          = 0x5dc
 	ETHERTYPE_8023                    = 0x4
@@ -353,6 +362,7 @@ const (
 	ETHERTYPE_DN                      = 0x6003
 	ETHERTYPE_DOGFIGHT                = 0x1989
 	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
 	ETHERTYPE_ECMA                    = 0x803
 	ETHERTYPE_ENCRYPT                 = 0x803d
 	ETHERTYPE_ES                      = 0x805d
@@ -413,15 +423,16 @@ const (
 	ETHERTYPE_NCD                     = 0x8149
 	ETHERTYPE_NESTAR                  = 0x8006
 	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
 	ETHERTYPE_NOVELL                  = 0x8138
 	ETHERTYPE_NS                      = 0x600
 	ETHERTYPE_NSAT                    = 0x601
 	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
 	ETHERTYPE_NTRAILER                = 0x10
 	ETHERTYPE_OS9                     = 0x7007
 	ETHERTYPE_OS9NET                  = 0x7009
 	ETHERTYPE_PACER                   = 0x80c6
-	ETHERTYPE_PAE                     = 0x888e
 	ETHERTYPE_PBB                     = 0x88e7
 	ETHERTYPE_PCS                     = 0x4242
 	ETHERTYPE_PLANNING                = 0x8044
@@ -504,10 +515,11 @@ const (
 	ETHER_VLAN_ENCAP_LEN              = 0x4
 	EVFILT_AIO                        = -0x3
 	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
 	EVFILT_PROC                       = -0x5
 	EVFILT_READ                       = -0x1
 	EVFILT_SIGNAL                     = -0x6
-	EVFILT_SYSCOUNT                   = 0x8
+	EVFILT_SYSCOUNT                   = 0x9
 	EVFILT_TIMER                      = -0x7
 	EVFILT_VNODE                      = -0x4
 	EVFILT_WRITE                      = -0x2
@@ -529,7 +541,7 @@ const (
 	EV_FLAG1                          = 0x2000
 	EV_ONESHOT                        = 0x10
 	EV_RECEIPT                        = 0x40
-	EV_SYSFLAGS                       = 0xf000
+	EV_SYSFLAGS                       = 0xf800
 	EXTA                              = 0x4b00
 	EXTB                              = 0x9600
 	EXTPROC                           = 0x800
@@ -795,6 +807,7 @@ const (
 	IFT_VOICEOVERCABLE                = 0xc6
 	IFT_VOICEOVERFRAMERELAY           = 0x99
 	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
 	IFT_X213                          = 0x5d
 	IFT_X25                           = 0x5
 	IFT_X25DDN                        = 0x4
@@ -860,6 +873,7 @@ const (
 	IPPROTO_RAW                       = 0xff
 	IPPROTO_ROUTING                   = 0x2b
 	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
 	IPPROTO_TCP                       = 0x6
 	IPPROTO_TP                        = 0x1d
 	IPPROTO_UDP                       = 0x11
@@ -970,6 +984,9 @@ const (
 	IP_TTL                            = 0x4
 	ISIG                              = 0x80
 	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
 	IUCLC                             = 0x1000
 	IXANY                             = 0x800
 	IXOFF                             = 0x400
@@ -1041,6 +1058,19 @@ const (
 	MNT_WAIT                          = 0x1
 	MNT_WANTRDWR                      = 0x2000000
 	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
 	MSG_BCAST                         = 0x100
 	MSG_CMSG_CLOEXEC                  = 0x800
 	MSG_CTRUNC                        = 0x20
@@ -1053,6 +1083,7 @@ const (
 	MSG_PEEK                          = 0x2
 	MSG_TRUNC                         = 0x10
 	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
 	MS_ASYNC                          = 0x1
 	MS_INVALIDATE                     = 0x4
 	MS_SYNC                           = 0x2
@@ -1061,7 +1092,8 @@ const (
 	NET_RT_FLAGS                      = 0x2
 	NET_RT_IFLIST                     = 0x3
 	NET_RT_IFNAMES                    = 0x6
-	NET_RT_MAXID                      = 0x7
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
 	NET_RT_STATS                      = 0x4
 	NET_RT_TABLE                      = 0x5
 	NFDBITS                           = 0x20
@@ -1078,6 +1110,7 @@ const (
 	NOTE_FORK                         = 0x40000000
 	NOTE_LINK                         = 0x10
 	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
 	NOTE_PCTRLMASK                    = 0xf0000000
 	NOTE_PDATAMASK                    = 0xfffff
 	NOTE_RENAME                       = 0x20
@@ -1214,7 +1247,7 @@ const (
 	RTM_PROPOSAL                      = 0x13
 	RTM_REDIRECT                      = 0x6
 	RTM_RESOLVE                       = 0xb
-	RTM_RTTUNIT                       = 0xf4240
+	RTM_SOURCE                        = 0x16
 	RTM_VERSION                       = 0x5
 	RTV_EXPIRE                        = 0x4
 	RTV_HOPCOUNT                      = 0x2
@@ -1232,6 +1265,9 @@ const (
 	RUSAGE_THREAD                     = 0x1
 	SCM_RIGHTS                        = 0x1
 	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
 	SHUT_RD                           = 0x0
 	SHUT_RDWR                         = 0x2
 	SHUT_WR                           = 0x1
@@ -1248,30 +1284,30 @@ const (
 	SIOCBRDGDELS                      = 0x80606942
 	SIOCBRDGFLUSH                     = 0x80606948
 	SIOCBRDGFRL                       = 0x808c694e
-	SIOCBRDGGCACHE                    = 0xc0186941
-	SIOCBRDGGFD                       = 0xc0186952
-	SIOCBRDGGHT                       = 0xc0186951
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
 	SIOCBRDGGIFFLGS                   = 0xc060693e
-	SIOCBRDGGMA                       = 0xc0186953
+	SIOCBRDGGMA                       = 0xc0146953
 	SIOCBRDGGPARAM                    = 0xc0406958
-	SIOCBRDGGPRI                      = 0xc0186950
+	SIOCBRDGGPRI                      = 0xc0146950
 	SIOCBRDGGRL                       = 0xc030694f
-	SIOCBRDGGTO                       = 0xc0186946
+	SIOCBRDGGTO                       = 0xc0146946
 	SIOCBRDGIFS                       = 0xc0606942
 	SIOCBRDGRTS                       = 0xc0206943
 	SIOCBRDGSADDR                     = 0xc1286944
-	SIOCBRDGSCACHE                    = 0x80186940
-	SIOCBRDGSFD                       = 0x80186952
-	SIOCBRDGSHT                       = 0x80186951
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
 	SIOCBRDGSIFCOST                   = 0x80606955
 	SIOCBRDGSIFFLGS                   = 0x8060693f
 	SIOCBRDGSIFPRIO                   = 0x80606954
 	SIOCBRDGSIFPROT                   = 0x8060694a
-	SIOCBRDGSMA                       = 0x80186953
-	SIOCBRDGSPRI                      = 0x80186950
-	SIOCBRDGSPROTO                    = 0x8018695a
-	SIOCBRDGSTO                       = 0x80186945
-	SIOCBRDGSTXHC                     = 0x80186959
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
 	SIOCDELLABEL                      = 0x80206997
 	SIOCDELMULTI                      = 0x80206932
 	SIOCDIFADDR                       = 0x80206919
@@ -1378,11 +1414,6 @@ const (
 	SIOCSVH                           = 0xc02069f5
 	SIOCSVNETFLOWID                   = 0x802069c3
 	SIOCSVNETID                       = 0x802069a6
-	SIOCSWGDPID                       = 0xc018695b
-	SIOCSWGMAXFLOW                    = 0xc0186960
-	SIOCSWGMAXGROUP                   = 0xc018695d
-	SIOCSWSDPID                       = 0x8018695c
-	SIOCSWSPORTNO                     = 0xc060695f
 	SOCK_CLOEXEC                      = 0x8000
 	SOCK_DGRAM                        = 0x2
 	SOCK_DNS                          = 0x1000
@@ -1455,7 +1486,18 @@ const (
 	TCOFLUSH                          = 0x2
 	TCOOFF                            = 0x1
 	TCOON                             = 0x2
-	TCP_MAXBURST                      = 0x4
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
 	TCP_MAXSEG                        = 0x2
 	TCP_MAXWIN                        = 0xffff
 	TCP_MAX_SACK                      = 0x3
@@ -1833,7 +1875,7 @@ var signalList = [...]struct {
 	{3, "SIGQUIT", "quit"},
 	{4, "SIGILL", "illegal instruction"},
 	{5, "SIGTRAP", "trace/BPT trap"},
-	{6, "SIGABRT", "abort trap"},
+	{6, "SIGIOT", "abort trap"},
 	{7, "SIGEMT", "EMT trap"},
 	{8, "SIGFPE", "floating point exception"},
 	{9, "SIGKILL", "killed"},
@@ -1860,4 +1902,5 @@ var signalList = [...]struct {
 	{30, "SIGUSR1", "user defined signal 1"},
 	{31, "SIGUSR2", "user defined signal 2"},
 	{32, "SIGTHR", "thread AST"},
+	{81920, "SIGSTKSZ", "unknown signal"},
 }
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_ppc64.go
new file mode 100644
index 0000000000..8e2c51b1ee
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_ppc64.go
@@ -0,0 +1,1905 @@
+// mkerrors.sh -m64
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build ppc64 && openbsd
+// +build ppc64,openbsd
+
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs -- -m64 _const.go
+
+package unix
+
+import "syscall"
+
+const (
+	AF_APPLETALK                      = 0x10
+	AF_BLUETOOTH                      = 0x20
+	AF_CCITT                          = 0xa
+	AF_CHAOS                          = 0x5
+	AF_CNT                            = 0x15
+	AF_COIP                           = 0x14
+	AF_DATAKIT                        = 0x9
+	AF_DECnet                         = 0xc
+	AF_DLI                            = 0xd
+	AF_E164                           = 0x1a
+	AF_ECMA                           = 0x8
+	AF_ENCAP                          = 0x1c
+	AF_HYLINK                         = 0xf
+	AF_IMPLINK                        = 0x3
+	AF_INET                           = 0x2
+	AF_INET6                          = 0x18
+	AF_IPX                            = 0x17
+	AF_ISDN                           = 0x1a
+	AF_ISO                            = 0x7
+	AF_KEY                            = 0x1e
+	AF_LAT                            = 0xe
+	AF_LINK                           = 0x12
+	AF_LOCAL                          = 0x1
+	AF_MAX                            = 0x24
+	AF_MPLS                           = 0x21
+	AF_NATM                           = 0x1b
+	AF_NS                             = 0x6
+	AF_OSI                            = 0x7
+	AF_PUP                            = 0x4
+	AF_ROUTE                          = 0x11
+	AF_SIP                            = 0x1d
+	AF_SNA                            = 0xb
+	AF_UNIX                           = 0x1
+	AF_UNSPEC                         = 0x0
+	ALTWERASE                         = 0x200
+	ARPHRD_ETHER                      = 0x1
+	ARPHRD_FRELAY                     = 0xf
+	ARPHRD_IEEE1394                   = 0x18
+	ARPHRD_IEEE802                    = 0x6
+	B0                                = 0x0
+	B110                              = 0x6e
+	B115200                           = 0x1c200
+	B1200                             = 0x4b0
+	B134                              = 0x86
+	B14400                            = 0x3840
+	B150                              = 0x96
+	B1800                             = 0x708
+	B19200                            = 0x4b00
+	B200                              = 0xc8
+	B230400                           = 0x38400
+	B2400                             = 0x960
+	B28800                            = 0x7080
+	B300                              = 0x12c
+	B38400                            = 0x9600
+	B4800                             = 0x12c0
+	B50                               = 0x32
+	B57600                            = 0xe100
+	B600                              = 0x258
+	B7200                             = 0x1c20
+	B75                               = 0x4b
+	B76800                            = 0x12c00
+	B9600                             = 0x2580
+	BIOCFLUSH                         = 0x20004268
+	BIOCGBLEN                         = 0x40044266
+	BIOCGDIRFILT                      = 0x4004427c
+	BIOCGDLT                          = 0x4004426a
+	BIOCGDLTLIST                      = 0xc010427b
+	BIOCGETIF                         = 0x4020426b
+	BIOCGFILDROP                      = 0x40044278
+	BIOCGHDRCMPLT                     = 0x40044274
+	BIOCGRSIG                         = 0x40044273
+	BIOCGRTIMEOUT                     = 0x4010426e
+	BIOCGSTATS                        = 0x4008426f
+	BIOCIMMEDIATE                     = 0x80044270
+	BIOCLOCK                          = 0x20004276
+	BIOCPROMISC                       = 0x20004269
+	BIOCSBLEN                         = 0xc0044266
+	BIOCSDIRFILT                      = 0x8004427d
+	BIOCSDLT                          = 0x8004427a
+	BIOCSETF                          = 0x80104267
+	BIOCSETIF                         = 0x8020426c
+	BIOCSETWF                         = 0x80104277
+	BIOCSFILDROP                      = 0x80044279
+	BIOCSHDRCMPLT                     = 0x80044275
+	BIOCSRSIG                         = 0x80044272
+	BIOCSRTIMEOUT                     = 0x8010426d
+	BIOCVERSION                       = 0x40044271
+	BPF_A                             = 0x10
+	BPF_ABS                           = 0x20
+	BPF_ADD                           = 0x0
+	BPF_ALIGNMENT                     = 0x4
+	BPF_ALU                           = 0x4
+	BPF_AND                           = 0x50
+	BPF_B                             = 0x10
+	BPF_DIRECTION_IN                  = 0x1
+	BPF_DIRECTION_OUT                 = 0x2
+	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
+	BPF_H                             = 0x8
+	BPF_IMM                           = 0x0
+	BPF_IND                           = 0x40
+	BPF_JA                            = 0x0
+	BPF_JEQ                           = 0x10
+	BPF_JGE                           = 0x30
+	BPF_JGT                           = 0x20
+	BPF_JMP                           = 0x5
+	BPF_JSET                          = 0x40
+	BPF_K                             = 0x0
+	BPF_LD                            = 0x0
+	BPF_LDX                           = 0x1
+	BPF_LEN                           = 0x80
+	BPF_LSH                           = 0x60
+	BPF_MAJOR_VERSION                 = 0x1
+	BPF_MAXBUFSIZE                    = 0x200000
+	BPF_MAXINSNS                      = 0x200
+	BPF_MEM                           = 0x60
+	BPF_MEMWORDS                      = 0x10
+	BPF_MINBUFSIZE                    = 0x20
+	BPF_MINOR_VERSION                 = 0x1
+	BPF_MISC                          = 0x7
+	BPF_MSH                           = 0xa0
+	BPF_MUL                           = 0x20
+	BPF_NEG                           = 0x80
+	BPF_OR                            = 0x40
+	BPF_RELEASE                       = 0x30bb6
+	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
+	BPF_RSH                           = 0x70
+	BPF_ST                            = 0x2
+	BPF_STX                           = 0x3
+	BPF_SUB                           = 0x10
+	BPF_TAX                           = 0x0
+	BPF_TXA                           = 0x80
+	BPF_W                             = 0x0
+	BPF_X                             = 0x8
+	BRKINT                            = 0x2
+	CFLUSH                            = 0xf
+	CLOCAL                            = 0x8000
+	CLOCK_BOOTTIME                    = 0x6
+	CLOCK_MONOTONIC                   = 0x3
+	CLOCK_PROCESS_CPUTIME_ID          = 0x2
+	CLOCK_REALTIME                    = 0x0
+	CLOCK_THREAD_CPUTIME_ID           = 0x4
+	CLOCK_UPTIME                      = 0x5
+	CPUSTATES                         = 0x6
+	CP_IDLE                           = 0x5
+	CP_INTR                           = 0x4
+	CP_NICE                           = 0x1
+	CP_SPIN                           = 0x3
+	CP_SYS                            = 0x2
+	CP_USER                           = 0x0
+	CREAD                             = 0x800
+	CRTSCTS                           = 0x10000
+	CS5                               = 0x0
+	CS6                               = 0x100
+	CS7                               = 0x200
+	CS8                               = 0x300
+	CSIZE                             = 0x300
+	CSTART                            = 0x11
+	CSTATUS                           = 0xff
+	CSTOP                             = 0x13
+	CSTOPB                            = 0x400
+	CSUSP                             = 0x1a
+	CTL_HW                            = 0x6
+	CTL_KERN                          = 0x1
+	CTL_MAXNAME                       = 0xc
+	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc110445d
+	DIOCADDRULE                       = 0xcd604404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcd60441a
+	DIOCCLRIFFLAG                     = 0xc028445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0e04412
+	DIOCCLRSTATUS                     = 0xc0284416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1204460
+	DIOCGETQUEUE                      = 0xc110445f
+	DIOCGETQUEUES                     = 0xc110445e
+	DIOCGETRULE                       = 0xcd604407
+	DIOCGETRULES                      = 0xcd604406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0104454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0104419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0284457
+	DIOCKILLSRCNODES                  = 0xc080445b
+	DIOCKILLSTATES                    = 0xc0e04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
+	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc4504443
+	DIOCRADDTABLES                    = 0xc450443d
+	DIOCRCLRADDRS                     = 0xc4504442
+	DIOCRCLRASTATS                    = 0xc4504448
+	DIOCRCLRTABLES                    = 0xc450443c
+	DIOCRCLRTSTATS                    = 0xc4504441
+	DIOCRDELADDRS                     = 0xc4504444
+	DIOCRDELTABLES                    = 0xc450443e
+	DIOCRGETADDRS                     = 0xc4504446
+	DIOCRGETASTATS                    = 0xc4504447
+	DIOCRGETTABLES                    = 0xc450443f
+	DIOCRGETTSTATS                    = 0xc4504440
+	DIOCRINADEFINE                    = 0xc450444d
+	DIOCRSETADDRS                     = 0xc4504445
+	DIOCRSETTFLAGS                    = 0xc450444a
+	DIOCRTSTADDRS                     = 0xc4504449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0284459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0284414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc0104451
+	DIOCXCOMMIT                       = 0xc0104452
+	DIOCXROLLBACK                     = 0xc0104453
+	DLT_ARCNET                        = 0x7
+	DLT_ATM_RFC1483                   = 0xb
+	DLT_AX25                          = 0x3
+	DLT_CHAOS                         = 0x5
+	DLT_C_HDLC                        = 0x68
+	DLT_EN10MB                        = 0x1
+	DLT_EN3MB                         = 0x2
+	DLT_ENC                           = 0xd
+	DLT_FDDI                          = 0xa
+	DLT_IEEE802                       = 0x6
+	DLT_IEEE802_11                    = 0x69
+	DLT_IEEE802_11_RADIO              = 0x7f
+	DLT_LOOP                          = 0xc
+	DLT_MPLS                          = 0xdb
+	DLT_NULL                          = 0x0
+	DLT_OPENFLOW                      = 0x10b
+	DLT_PFLOG                         = 0x75
+	DLT_PFSYNC                        = 0x12
+	DLT_PPP                           = 0x9
+	DLT_PPP_BSDOS                     = 0x10
+	DLT_PPP_ETHER                     = 0x33
+	DLT_PPP_SERIAL                    = 0x32
+	DLT_PRONET                        = 0x4
+	DLT_RAW                           = 0xe
+	DLT_SLIP                          = 0x8
+	DLT_SLIP_BSDOS                    = 0xf
+	DLT_USBPCAP                       = 0xf9
+	DLT_USER0                         = 0x93
+	DLT_USER1                         = 0x94
+	DLT_USER10                        = 0x9d
+	DLT_USER11                        = 0x9e
+	DLT_USER12                        = 0x9f
+	DLT_USER13                        = 0xa0
+	DLT_USER14                        = 0xa1
+	DLT_USER15                        = 0xa2
+	DLT_USER2                         = 0x95
+	DLT_USER3                         = 0x96
+	DLT_USER4                         = 0x97
+	DLT_USER5                         = 0x98
+	DLT_USER6                         = 0x99
+	DLT_USER7                         = 0x9a
+	DLT_USER8                         = 0x9b
+	DLT_USER9                         = 0x9c
+	DT_BLK                            = 0x6
+	DT_CHR                            = 0x2
+	DT_DIR                            = 0x4
+	DT_FIFO                           = 0x1
+	DT_LNK                            = 0xa
+	DT_REG                            = 0x8
+	DT_SOCK                           = 0xc
+	DT_UNKNOWN                        = 0x0
+	ECHO                              = 0x8
+	ECHOCTL                           = 0x40
+	ECHOE                             = 0x2
+	ECHOK                             = 0x4
+	ECHOKE                            = 0x1
+	ECHONL                            = 0x10
+	ECHOPRT                           = 0x20
+	EMT_TAGOVF                        = 0x1
+	EMUL_ENABLED                      = 0x1
+	EMUL_NATIVE                       = 0x2
+	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
+	ETHERMIN                          = 0x2e
+	ETHERMTU                          = 0x5dc
+	ETHERTYPE_8023                    = 0x4
+	ETHERTYPE_AARP                    = 0x80f3
+	ETHERTYPE_ACCTON                  = 0x8390
+	ETHERTYPE_AEONIC                  = 0x8036
+	ETHERTYPE_ALPHA                   = 0x814a
+	ETHERTYPE_AMBER                   = 0x6008
+	ETHERTYPE_AMOEBA                  = 0x8145
+	ETHERTYPE_AOE                     = 0x88a2
+	ETHERTYPE_APOLLO                  = 0x80f7
+	ETHERTYPE_APOLLODOMAIN            = 0x8019
+	ETHERTYPE_APPLETALK               = 0x809b
+	ETHERTYPE_APPLITEK                = 0x80c7
+	ETHERTYPE_ARGONAUT                = 0x803a
+	ETHERTYPE_ARP                     = 0x806
+	ETHERTYPE_AT                      = 0x809b
+	ETHERTYPE_ATALK                   = 0x809b
+	ETHERTYPE_ATOMIC                  = 0x86df
+	ETHERTYPE_ATT                     = 0x8069
+	ETHERTYPE_ATTSTANFORD             = 0x8008
+	ETHERTYPE_AUTOPHON                = 0x806a
+	ETHERTYPE_AXIS                    = 0x8856
+	ETHERTYPE_BCLOOP                  = 0x9003
+	ETHERTYPE_BOFL                    = 0x8102
+	ETHERTYPE_CABLETRON               = 0x7034
+	ETHERTYPE_CHAOS                   = 0x804
+	ETHERTYPE_COMDESIGN               = 0x806c
+	ETHERTYPE_COMPUGRAPHIC            = 0x806d
+	ETHERTYPE_COUNTERPOINT            = 0x8062
+	ETHERTYPE_CRONUS                  = 0x8004
+	ETHERTYPE_CRONUSVLN               = 0x8003
+	ETHERTYPE_DCA                     = 0x1234
+	ETHERTYPE_DDE                     = 0x807b
+	ETHERTYPE_DEBNI                   = 0xaaaa
+	ETHERTYPE_DECAM                   = 0x8048
+	ETHERTYPE_DECCUST                 = 0x6006
+	ETHERTYPE_DECDIAG                 = 0x6005
+	ETHERTYPE_DECDNS                  = 0x803c
+	ETHERTYPE_DECDTS                  = 0x803e
+	ETHERTYPE_DECEXPER                = 0x6000
+	ETHERTYPE_DECLAST                 = 0x8041
+	ETHERTYPE_DECLTM                  = 0x803f
+	ETHERTYPE_DECMUMPS                = 0x6009
+	ETHERTYPE_DECNETBIOS              = 0x8040
+	ETHERTYPE_DELTACON                = 0x86de
+	ETHERTYPE_DIDDLE                  = 0x4321
+	ETHERTYPE_DLOG1                   = 0x660
+	ETHERTYPE_DLOG2                   = 0x661
+	ETHERTYPE_DN                      = 0x6003
+	ETHERTYPE_DOGFIGHT                = 0x1989
+	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
+	ETHERTYPE_ECMA                    = 0x803
+	ETHERTYPE_ENCRYPT                 = 0x803d
+	ETHERTYPE_ES                      = 0x805d
+	ETHERTYPE_EXCELAN                 = 0x8010
+	ETHERTYPE_EXPERDATA               = 0x8049
+	ETHERTYPE_FLIP                    = 0x8146
+	ETHERTYPE_FLOWCONTROL             = 0x8808
+	ETHERTYPE_FRARP                   = 0x808
+	ETHERTYPE_GENDYN                  = 0x8068
+	ETHERTYPE_HAYES                   = 0x8130
+	ETHERTYPE_HIPPI_FP                = 0x8180
+	ETHERTYPE_HITACHI                 = 0x8820
+	ETHERTYPE_HP                      = 0x8005
+	ETHERTYPE_IEEEPUP                 = 0xa00
+	ETHERTYPE_IEEEPUPAT               = 0xa01
+	ETHERTYPE_IMLBL                   = 0x4c42
+	ETHERTYPE_IMLBLDIAG               = 0x424c
+	ETHERTYPE_IP                      = 0x800
+	ETHERTYPE_IPAS                    = 0x876c
+	ETHERTYPE_IPV6                    = 0x86dd
+	ETHERTYPE_IPX                     = 0x8137
+	ETHERTYPE_IPXNEW                  = 0x8037
+	ETHERTYPE_KALPANA                 = 0x8582
+	ETHERTYPE_LANBRIDGE               = 0x8038
+	ETHERTYPE_LANPROBE                = 0x8888
+	ETHERTYPE_LAT                     = 0x6004
+	ETHERTYPE_LBACK                   = 0x9000
+	ETHERTYPE_LITTLE                  = 0x8060
+	ETHERTYPE_LLDP                    = 0x88cc
+	ETHERTYPE_LOGICRAFT               = 0x8148
+	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
+	ETHERTYPE_MATRA                   = 0x807a
+	ETHERTYPE_MAX                     = 0xffff
+	ETHERTYPE_MERIT                   = 0x807c
+	ETHERTYPE_MICP                    = 0x873a
+	ETHERTYPE_MOPDL                   = 0x6001
+	ETHERTYPE_MOPRC                   = 0x6002
+	ETHERTYPE_MOTOROLA                = 0x818d
+	ETHERTYPE_MPLS                    = 0x8847
+	ETHERTYPE_MPLS_MCAST              = 0x8848
+	ETHERTYPE_MUMPS                   = 0x813f
+	ETHERTYPE_NBPCC                   = 0x3c04
+	ETHERTYPE_NBPCLAIM                = 0x3c09
+	ETHERTYPE_NBPCLREQ                = 0x3c05
+	ETHERTYPE_NBPCLRSP                = 0x3c06
+	ETHERTYPE_NBPCREQ                 = 0x3c02
+	ETHERTYPE_NBPCRSP                 = 0x3c03
+	ETHERTYPE_NBPDG                   = 0x3c07
+	ETHERTYPE_NBPDGB                  = 0x3c08
+	ETHERTYPE_NBPDLTE                 = 0x3c0a
+	ETHERTYPE_NBPRAR                  = 0x3c0c
+	ETHERTYPE_NBPRAS                  = 0x3c0b
+	ETHERTYPE_NBPRST                  = 0x3c0d
+	ETHERTYPE_NBPSCD                  = 0x3c01
+	ETHERTYPE_NBPVCD                  = 0x3c00
+	ETHERTYPE_NBS                     = 0x802
+	ETHERTYPE_NCD                     = 0x8149
+	ETHERTYPE_NESTAR                  = 0x8006
+	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
+	ETHERTYPE_NOVELL                  = 0x8138
+	ETHERTYPE_NS                      = 0x600
+	ETHERTYPE_NSAT                    = 0x601
+	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
+	ETHERTYPE_NTRAILER                = 0x10
+	ETHERTYPE_OS9                     = 0x7007
+	ETHERTYPE_OS9NET                  = 0x7009
+	ETHERTYPE_PACER                   = 0x80c6
+	ETHERTYPE_PBB                     = 0x88e7
+	ETHERTYPE_PCS                     = 0x4242
+	ETHERTYPE_PLANNING                = 0x8044
+	ETHERTYPE_PPP                     = 0x880b
+	ETHERTYPE_PPPOE                   = 0x8864
+	ETHERTYPE_PPPOEDISC               = 0x8863
+	ETHERTYPE_PRIMENTS                = 0x7031
+	ETHERTYPE_PUP                     = 0x200
+	ETHERTYPE_PUPAT                   = 0x200
+	ETHERTYPE_QINQ                    = 0x88a8
+	ETHERTYPE_RACAL                   = 0x7030
+	ETHERTYPE_RATIONAL                = 0x8150
+	ETHERTYPE_RAWFR                   = 0x6559
+	ETHERTYPE_RCL                     = 0x1995
+	ETHERTYPE_RDP                     = 0x8739
+	ETHERTYPE_RETIX                   = 0x80f2
+	ETHERTYPE_REVARP                  = 0x8035
+	ETHERTYPE_SCA                     = 0x6007
+	ETHERTYPE_SECTRA                  = 0x86db
+	ETHERTYPE_SECUREDATA              = 0x876d
+	ETHERTYPE_SGITW                   = 0x817e
+	ETHERTYPE_SG_BOUNCE               = 0x8016
+	ETHERTYPE_SG_DIAG                 = 0x8013
+	ETHERTYPE_SG_NETGAMES             = 0x8014
+	ETHERTYPE_SG_RESV                 = 0x8015
+	ETHERTYPE_SIMNET                  = 0x5208
+	ETHERTYPE_SLOW                    = 0x8809
+	ETHERTYPE_SNA                     = 0x80d5
+	ETHERTYPE_SNMP                    = 0x814c
+	ETHERTYPE_SONIX                   = 0xfaf5
+	ETHERTYPE_SPIDER                  = 0x809f
+	ETHERTYPE_SPRITE                  = 0x500
+	ETHERTYPE_STP                     = 0x8181
+	ETHERTYPE_TALARIS                 = 0x812b
+	ETHERTYPE_TALARISMC               = 0x852b
+	ETHERTYPE_TCPCOMP                 = 0x876b
+	ETHERTYPE_TCPSM                   = 0x9002
+	ETHERTYPE_TEC                     = 0x814f
+	ETHERTYPE_TIGAN                   = 0x802f
+	ETHERTYPE_TRAIL                   = 0x1000
+	ETHERTYPE_TRANSETHER              = 0x6558
+	ETHERTYPE_TYMSHARE                = 0x802e
+	ETHERTYPE_UBBST                   = 0x7005
+	ETHERTYPE_UBDEBUG                 = 0x900
+	ETHERTYPE_UBDIAGLOOP              = 0x7002
+	ETHERTYPE_UBDL                    = 0x7000
+	ETHERTYPE_UBNIU                   = 0x7001
+	ETHERTYPE_UBNMC                   = 0x7003
+	ETHERTYPE_VALID                   = 0x1600
+	ETHERTYPE_VARIAN                  = 0x80dd
+	ETHERTYPE_VAXELN                  = 0x803b
+	ETHERTYPE_VEECO                   = 0x8067
+	ETHERTYPE_VEXP                    = 0x805b
+	ETHERTYPE_VGLAB                   = 0x8131
+	ETHERTYPE_VINES                   = 0xbad
+	ETHERTYPE_VINESECHO               = 0xbaf
+	ETHERTYPE_VINESLOOP               = 0xbae
+	ETHERTYPE_VITAL                   = 0xff00
+	ETHERTYPE_VLAN                    = 0x8100
+	ETHERTYPE_VLTLMAN                 = 0x8080
+	ETHERTYPE_VPROD                   = 0x805c
+	ETHERTYPE_VURESERVED              = 0x8147
+	ETHERTYPE_WATERLOO                = 0x8130
+	ETHERTYPE_WELLFLEET               = 0x8103
+	ETHERTYPE_X25                     = 0x805
+	ETHERTYPE_X75                     = 0x801
+	ETHERTYPE_XNSSM                   = 0x9001
+	ETHERTYPE_XTP                     = 0x817d
+	ETHER_ADDR_LEN                    = 0x6
+	ETHER_ALIGN                       = 0x2
+	ETHER_CRC_LEN                     = 0x4
+	ETHER_CRC_POLY_BE                 = 0x4c11db6
+	ETHER_CRC_POLY_LE                 = 0xedb88320
+	ETHER_HDR_LEN                     = 0xe
+	ETHER_MAX_DIX_LEN                 = 0x600
+	ETHER_MAX_HARDMTU_LEN             = 0xff9b
+	ETHER_MAX_LEN                     = 0x5ee
+	ETHER_MIN_LEN                     = 0x40
+	ETHER_TYPE_LEN                    = 0x2
+	ETHER_VLAN_ENCAP_LEN              = 0x4
+	EVFILT_AIO                        = -0x3
+	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
+	EVFILT_PROC                       = -0x5
+	EVFILT_READ                       = -0x1
+	EVFILT_SIGNAL                     = -0x6
+	EVFILT_SYSCOUNT                   = 0x9
+	EVFILT_TIMER                      = -0x7
+	EVFILT_VNODE                      = -0x4
+	EVFILT_WRITE                      = -0x2
+	EVL_ENCAPLEN                      = 0x4
+	EVL_PRIO_BITS                     = 0xd
+	EVL_PRIO_MAX                      = 0x7
+	EVL_VLID_MASK                     = 0xfff
+	EVL_VLID_MAX                      = 0xffe
+	EVL_VLID_MIN                      = 0x1
+	EVL_VLID_NULL                     = 0x0
+	EV_ADD                            = 0x1
+	EV_CLEAR                          = 0x20
+	EV_DELETE                         = 0x2
+	EV_DISABLE                        = 0x8
+	EV_DISPATCH                       = 0x80
+	EV_ENABLE                         = 0x4
+	EV_EOF                            = 0x8000
+	EV_ERROR                          = 0x4000
+	EV_FLAG1                          = 0x2000
+	EV_ONESHOT                        = 0x10
+	EV_RECEIPT                        = 0x40
+	EV_SYSFLAGS                       = 0xf800
+	EXTA                              = 0x4b00
+	EXTB                              = 0x9600
+	EXTPROC                           = 0x800
+	FD_CLOEXEC                        = 0x1
+	FD_SETSIZE                        = 0x400
+	FLUSHO                            = 0x800000
+	F_DUPFD                           = 0x0
+	F_DUPFD_CLOEXEC                   = 0xa
+	F_GETFD                           = 0x1
+	F_GETFL                           = 0x3
+	F_GETLK                           = 0x7
+	F_GETOWN                          = 0x5
+	F_ISATTY                          = 0xb
+	F_OK                              = 0x0
+	F_RDLCK                           = 0x1
+	F_SETFD                           = 0x2
+	F_SETFL                           = 0x4
+	F_SETLK                           = 0x8
+	F_SETLKW                          = 0x9
+	F_SETOWN                          = 0x6
+	F_UNLCK                           = 0x2
+	F_WRLCK                           = 0x3
+	HUPCL                             = 0x4000
+	HW_MACHINE                        = 0x1
+	ICANON                            = 0x100
+	ICMP6_FILTER                      = 0x12
+	ICRNL                             = 0x100
+	IEXTEN                            = 0x400
+	IFAN_ARRIVAL                      = 0x0
+	IFAN_DEPARTURE                    = 0x1
+	IFF_ALLMULTI                      = 0x200
+	IFF_BROADCAST                     = 0x2
+	IFF_CANTCHANGE                    = 0x8e52
+	IFF_DEBUG                         = 0x4
+	IFF_LINK0                         = 0x1000
+	IFF_LINK1                         = 0x2000
+	IFF_LINK2                         = 0x4000
+	IFF_LOOPBACK                      = 0x8
+	IFF_MULTICAST                     = 0x8000
+	IFF_NOARP                         = 0x80
+	IFF_OACTIVE                       = 0x400
+	IFF_POINTOPOINT                   = 0x10
+	IFF_PROMISC                       = 0x100
+	IFF_RUNNING                       = 0x40
+	IFF_SIMPLEX                       = 0x800
+	IFF_STATICARP                     = 0x20
+	IFF_UP                            = 0x1
+	IFNAMSIZ                          = 0x10
+	IFT_1822                          = 0x2
+	IFT_A12MPPSWITCH                  = 0x82
+	IFT_AAL2                          = 0xbb
+	IFT_AAL5                          = 0x31
+	IFT_ADSL                          = 0x5e
+	IFT_AFLANE8023                    = 0x3b
+	IFT_AFLANE8025                    = 0x3c
+	IFT_ARAP                          = 0x58
+	IFT_ARCNET                        = 0x23
+	IFT_ARCNETPLUS                    = 0x24
+	IFT_ASYNC                         = 0x54
+	IFT_ATM                           = 0x25
+	IFT_ATMDXI                        = 0x69
+	IFT_ATMFUNI                       = 0x6a
+	IFT_ATMIMA                        = 0x6b
+	IFT_ATMLOGICAL                    = 0x50
+	IFT_ATMRADIO                      = 0xbd
+	IFT_ATMSUBINTERFACE               = 0x86
+	IFT_ATMVCIENDPT                   = 0xc2
+	IFT_ATMVIRTUAL                    = 0x95
+	IFT_BGPPOLICYACCOUNTING           = 0xa2
+	IFT_BLUETOOTH                     = 0xf8
+	IFT_BRIDGE                        = 0xd1
+	IFT_BSC                           = 0x53
+	IFT_CARP                          = 0xf7
+	IFT_CCTEMUL                       = 0x3d
+	IFT_CEPT                          = 0x13
+	IFT_CES                           = 0x85
+	IFT_CHANNEL                       = 0x46
+	IFT_CNR                           = 0x55
+	IFT_COFFEE                        = 0x84
+	IFT_COMPOSITELINK                 = 0x9b
+	IFT_DCN                           = 0x8d
+	IFT_DIGITALPOWERLINE              = 0x8a
+	IFT_DIGITALWRAPPEROVERHEADCHANNEL = 0xba
+	IFT_DLSW                          = 0x4a
+	IFT_DOCSCABLEDOWNSTREAM           = 0x80
+	IFT_DOCSCABLEMACLAYER             = 0x7f
+	IFT_DOCSCABLEUPSTREAM             = 0x81
+	IFT_DOCSCABLEUPSTREAMCHANNEL      = 0xcd
+	IFT_DS0                           = 0x51
+	IFT_DS0BUNDLE                     = 0x52
+	IFT_DS1FDL                        = 0xaa
+	IFT_DS3                           = 0x1e
+	IFT_DTM                           = 0x8c
+	IFT_DUMMY                         = 0xf1
+	IFT_DVBASILN                      = 0xac
+	IFT_DVBASIOUT                     = 0xad
+	IFT_DVBRCCDOWNSTREAM              = 0x93
+	IFT_DVBRCCMACLAYER                = 0x92
+	IFT_DVBRCCUPSTREAM                = 0x94
+	IFT_ECONET                        = 0xce
+	IFT_ENC                           = 0xf4
+	IFT_EON                           = 0x19
+	IFT_EPLRS                         = 0x57
+	IFT_ESCON                         = 0x49
+	IFT_ETHER                         = 0x6
+	IFT_FAITH                         = 0xf3
+	IFT_FAST                          = 0x7d
+	IFT_FASTETHER                     = 0x3e
+	IFT_FASTETHERFX                   = 0x45
+	IFT_FDDI                          = 0xf
+	IFT_FIBRECHANNEL                  = 0x38
+	IFT_FRAMERELAYINTERCONNECT        = 0x3a
+	IFT_FRAMERELAYMPI                 = 0x5c
+	IFT_FRDLCIENDPT                   = 0xc1
+	IFT_FRELAY                        = 0x20
+	IFT_FRELAYDCE                     = 0x2c
+	IFT_FRF16MFRBUNDLE                = 0xa3
+	IFT_FRFORWARD                     = 0x9e
+	IFT_G703AT2MB                     = 0x43
+	IFT_G703AT64K                     = 0x42
+	IFT_GIF                           = 0xf0
+	IFT_GIGABITETHERNET               = 0x75
+	IFT_GR303IDT                      = 0xb2
+	IFT_GR303RDT                      = 0xb1
+	IFT_H323GATEKEEPER                = 0xa4
+	IFT_H323PROXY                     = 0xa5
+	IFT_HDH1822                       = 0x3
+	IFT_HDLC                          = 0x76
+	IFT_HDSL2                         = 0xa8
+	IFT_HIPERLAN2                     = 0xb7
+	IFT_HIPPI                         = 0x2f
+	IFT_HIPPIINTERFACE                = 0x39
+	IFT_HOSTPAD                       = 0x5a
+	IFT_HSSI                          = 0x2e
+	IFT_HY                            = 0xe
+	IFT_IBM370PARCHAN                 = 0x48
+	IFT_IDSL                          = 0x9a
+	IFT_IEEE1394                      = 0x90
+	IFT_IEEE80211                     = 0x47
+	IFT_IEEE80212                     = 0x37
+	IFT_IEEE8023ADLAG                 = 0xa1
+	IFT_IFGSN                         = 0x91
+	IFT_IMT                           = 0xbe
+	IFT_INFINIBAND                    = 0xc7
+	IFT_INTERLEAVE                    = 0x7c
+	IFT_IP                            = 0x7e
+	IFT_IPFORWARD                     = 0x8e
+	IFT_IPOVERATM                     = 0x72
+	IFT_IPOVERCDLC                    = 0x6d
+	IFT_IPOVERCLAW                    = 0x6e
+	IFT_IPSWITCH                      = 0x4e
+	IFT_ISDN                          = 0x3f
+	IFT_ISDNBASIC                     = 0x14
+	IFT_ISDNPRIMARY                   = 0x15
+	IFT_ISDNS                         = 0x4b
+	IFT_ISDNU                         = 0x4c
+	IFT_ISO88022LLC                   = 0x29
+	IFT_ISO88023                      = 0x7
+	IFT_ISO88024                      = 0x8
+	IFT_ISO88025                      = 0x9
+	IFT_ISO88025CRFPINT               = 0x62
+	IFT_ISO88025DTR                   = 0x56
+	IFT_ISO88025FIBER                 = 0x73
+	IFT_ISO88026                      = 0xa
+	IFT_ISUP                          = 0xb3
+	IFT_L2VLAN                        = 0x87
+	IFT_L3IPVLAN                      = 0x88
+	IFT_L3IPXVLAN                     = 0x89
+	IFT_LAPB                          = 0x10
+	IFT_LAPD                          = 0x4d
+	IFT_LAPF                          = 0x77
+	IFT_LINEGROUP                     = 0xd2
+	IFT_LOCALTALK                     = 0x2a
+	IFT_LOOP                          = 0x18
+	IFT_MBIM                          = 0xfa
+	IFT_MEDIAMAILOVERIP               = 0x8b
+	IFT_MFSIGLINK                     = 0xa7
+	IFT_MIOX25                        = 0x26
+	IFT_MODEM                         = 0x30
+	IFT_MPC                           = 0x71
+	IFT_MPLS                          = 0xa6
+	IFT_MPLSTUNNEL                    = 0x96
+	IFT_MSDSL                         = 0x8f
+	IFT_MVL                           = 0xbf
+	IFT_MYRINET                       = 0x63
+	IFT_NFAS                          = 0xaf
+	IFT_NSIP                          = 0x1b
+	IFT_OPTICALCHANNEL                = 0xc3
+	IFT_OPTICALTRANSPORT              = 0xc4
+	IFT_OTHER                         = 0x1
+	IFT_P10                           = 0xc
+	IFT_P80                           = 0xd
+	IFT_PARA                          = 0x22
+	IFT_PFLOG                         = 0xf5
+	IFT_PFLOW                         = 0xf9
+	IFT_PFSYNC                        = 0xf6
+	IFT_PLC                           = 0xae
+	IFT_PON155                        = 0xcf
+	IFT_PON622                        = 0xd0
+	IFT_POS                           = 0xab
+	IFT_PPP                           = 0x17
+	IFT_PPPMULTILINKBUNDLE            = 0x6c
+	IFT_PROPATM                       = 0xc5
+	IFT_PROPBWAP2MP                   = 0xb8
+	IFT_PROPCNLS                      = 0x59
+	IFT_PROPDOCSWIRELESSDOWNSTREAM    = 0xb5
+	IFT_PROPDOCSWIRELESSMACLAYER      = 0xb4
+	IFT_PROPDOCSWIRELESSUPSTREAM      = 0xb6
+	IFT_PROPMUX                       = 0x36
+	IFT_PROPVIRTUAL                   = 0x35
+	IFT_PROPWIRELESSP2P               = 0x9d
+	IFT_PTPSERIAL                     = 0x16
+	IFT_PVC                           = 0xf2
+	IFT_Q2931                         = 0xc9
+	IFT_QLLC                          = 0x44
+	IFT_RADIOMAC                      = 0xbc
+	IFT_RADSL                         = 0x5f
+	IFT_REACHDSL                      = 0xc0
+	IFT_RFC1483                       = 0x9f
+	IFT_RS232                         = 0x21
+	IFT_RSRB                          = 0x4f
+	IFT_SDLC                          = 0x11
+	IFT_SDSL                          = 0x60
+	IFT_SHDSL                         = 0xa9
+	IFT_SIP                           = 0x1f
+	IFT_SIPSIG                        = 0xcc
+	IFT_SIPTG                         = 0xcb
+	IFT_SLIP                          = 0x1c
+	IFT_SMDSDXI                       = 0x2b
+	IFT_SMDSICIP                      = 0x34
+	IFT_SONET                         = 0x27
+	IFT_SONETOVERHEADCHANNEL          = 0xb9
+	IFT_SONETPATH                     = 0x32
+	IFT_SONETVT                       = 0x33
+	IFT_SRP                           = 0x97
+	IFT_SS7SIGLINK                    = 0x9c
+	IFT_STACKTOSTACK                  = 0x6f
+	IFT_STARLAN                       = 0xb
+	IFT_T1                            = 0x12
+	IFT_TDLC                          = 0x74
+	IFT_TELINK                        = 0xc8
+	IFT_TERMPAD                       = 0x5b
+	IFT_TR008                         = 0xb0
+	IFT_TRANSPHDLC                    = 0x7b
+	IFT_TUNNEL                        = 0x83
+	IFT_ULTRA                         = 0x1d
+	IFT_USB                           = 0xa0
+	IFT_V11                           = 0x40
+	IFT_V35                           = 0x2d
+	IFT_V36                           = 0x41
+	IFT_V37                           = 0x78
+	IFT_VDSL                          = 0x61
+	IFT_VIRTUALIPADDRESS              = 0x70
+	IFT_VIRTUALTG                     = 0xca
+	IFT_VOICEDID                      = 0xd5
+	IFT_VOICEEM                       = 0x64
+	IFT_VOICEEMFGD                    = 0xd3
+	IFT_VOICEENCAP                    = 0x67
+	IFT_VOICEFGDEANA                  = 0xd4
+	IFT_VOICEFXO                      = 0x65
+	IFT_VOICEFXS                      = 0x66
+	IFT_VOICEOVERATM                  = 0x98
+	IFT_VOICEOVERCABLE                = 0xc6
+	IFT_VOICEOVERFRAMERELAY           = 0x99
+	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
+	IFT_X213                          = 0x5d
+	IFT_X25                           = 0x5
+	IFT_X25DDN                        = 0x4
+	IFT_X25HUNTGROUP                  = 0x7a
+	IFT_X25MLP                        = 0x79
+	IFT_X25PLE                        = 0x28
+	IFT_XETHER                        = 0x1a
+	IGNBRK                            = 0x1
+	IGNCR                             = 0x80
+	IGNPAR                            = 0x4
+	IMAXBEL                           = 0x2000
+	INLCR                             = 0x40
+	INPCK                             = 0x10
+	IN_CLASSA_HOST                    = 0xffffff
+	IN_CLASSA_MAX                     = 0x80
+	IN_CLASSA_NET                     = 0xff000000
+	IN_CLASSA_NSHIFT                  = 0x18
+	IN_CLASSB_HOST                    = 0xffff
+	IN_CLASSB_MAX                     = 0x10000
+	IN_CLASSB_NET                     = 0xffff0000
+	IN_CLASSB_NSHIFT                  = 0x10
+	IN_CLASSC_HOST                    = 0xff
+	IN_CLASSC_NET                     = 0xffffff00
+	IN_CLASSC_NSHIFT                  = 0x8
+	IN_CLASSD_HOST                    = 0xfffffff
+	IN_CLASSD_NET                     = 0xf0000000
+	IN_CLASSD_NSHIFT                  = 0x1c
+	IN_LOOPBACKNET                    = 0x7f
+	IN_RFC3021_HOST                   = 0x1
+	IN_RFC3021_NET                    = 0xfffffffe
+	IN_RFC3021_NSHIFT                 = 0x1f
+	IPPROTO_AH                        = 0x33
+	IPPROTO_CARP                      = 0x70
+	IPPROTO_DIVERT                    = 0x102
+	IPPROTO_DONE                      = 0x101
+	IPPROTO_DSTOPTS                   = 0x3c
+	IPPROTO_EGP                       = 0x8
+	IPPROTO_ENCAP                     = 0x62
+	IPPROTO_EON                       = 0x50
+	IPPROTO_ESP                       = 0x32
+	IPPROTO_ETHERIP                   = 0x61
+	IPPROTO_FRAGMENT                  = 0x2c
+	IPPROTO_GGP                       = 0x3
+	IPPROTO_GRE                       = 0x2f
+	IPPROTO_HOPOPTS                   = 0x0
+	IPPROTO_ICMP                      = 0x1
+	IPPROTO_ICMPV6                    = 0x3a
+	IPPROTO_IDP                       = 0x16
+	IPPROTO_IGMP                      = 0x2
+	IPPROTO_IP                        = 0x0
+	IPPROTO_IPCOMP                    = 0x6c
+	IPPROTO_IPIP                      = 0x4
+	IPPROTO_IPV4                      = 0x4
+	IPPROTO_IPV6                      = 0x29
+	IPPROTO_MAX                       = 0x100
+	IPPROTO_MAXID                     = 0x103
+	IPPROTO_MOBILE                    = 0x37
+	IPPROTO_MPLS                      = 0x89
+	IPPROTO_NONE                      = 0x3b
+	IPPROTO_PFSYNC                    = 0xf0
+	IPPROTO_PIM                       = 0x67
+	IPPROTO_PUP                       = 0xc
+	IPPROTO_RAW                       = 0xff
+	IPPROTO_ROUTING                   = 0x2b
+	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
+	IPPROTO_TCP                       = 0x6
+	IPPROTO_TP                        = 0x1d
+	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
+	IPV6_AUTH_LEVEL                   = 0x35
+	IPV6_AUTOFLOWLABEL                = 0x3b
+	IPV6_CHECKSUM                     = 0x1a
+	IPV6_DEFAULT_MULTICAST_HOPS       = 0x1
+	IPV6_DEFAULT_MULTICAST_LOOP       = 0x1
+	IPV6_DEFHLIM                      = 0x40
+	IPV6_DONTFRAG                     = 0x3e
+	IPV6_DSTOPTS                      = 0x32
+	IPV6_ESP_NETWORK_LEVEL            = 0x37
+	IPV6_ESP_TRANS_LEVEL              = 0x36
+	IPV6_FAITH                        = 0x1d
+	IPV6_FLOWINFO_MASK                = 0xfffffff
+	IPV6_FLOWLABEL_MASK               = 0xfffff
+	IPV6_FRAGTTL                      = 0x78
+	IPV6_HLIMDEC                      = 0x1
+	IPV6_HOPLIMIT                     = 0x2f
+	IPV6_HOPOPTS                      = 0x31
+	IPV6_IPCOMP_LEVEL                 = 0x3c
+	IPV6_JOIN_GROUP                   = 0xc
+	IPV6_LEAVE_GROUP                  = 0xd
+	IPV6_MAXHLIM                      = 0xff
+	IPV6_MAXPACKET                    = 0xffff
+	IPV6_MINHOPCOUNT                  = 0x41
+	IPV6_MMTU                         = 0x500
+	IPV6_MULTICAST_HOPS               = 0xa
+	IPV6_MULTICAST_IF                 = 0x9
+	IPV6_MULTICAST_LOOP               = 0xb
+	IPV6_NEXTHOP                      = 0x30
+	IPV6_OPTIONS                      = 0x1
+	IPV6_PATHMTU                      = 0x2c
+	IPV6_PIPEX                        = 0x3f
+	IPV6_PKTINFO                      = 0x2e
+	IPV6_PORTRANGE                    = 0xe
+	IPV6_PORTRANGE_DEFAULT            = 0x0
+	IPV6_PORTRANGE_HIGH               = 0x1
+	IPV6_PORTRANGE_LOW                = 0x2
+	IPV6_RECVDSTOPTS                  = 0x28
+	IPV6_RECVDSTPORT                  = 0x40
+	IPV6_RECVHOPLIMIT                 = 0x25
+	IPV6_RECVHOPOPTS                  = 0x27
+	IPV6_RECVPATHMTU                  = 0x2b
+	IPV6_RECVPKTINFO                  = 0x24
+	IPV6_RECVRTHDR                    = 0x26
+	IPV6_RECVTCLASS                   = 0x39
+	IPV6_RTABLE                       = 0x1021
+	IPV6_RTHDR                        = 0x33
+	IPV6_RTHDRDSTOPTS                 = 0x23
+	IPV6_RTHDR_LOOSE                  = 0x0
+	IPV6_RTHDR_STRICT                 = 0x1
+	IPV6_RTHDR_TYPE_0                 = 0x0
+	IPV6_SOCKOPT_RESERVED1            = 0x3
+	IPV6_TCLASS                       = 0x3d
+	IPV6_UNICAST_HOPS                 = 0x4
+	IPV6_USE_MIN_MTU                  = 0x2a
+	IPV6_V6ONLY                       = 0x1b
+	IPV6_VERSION                      = 0x60
+	IPV6_VERSION_MASK                 = 0xf0
+	IP_ADD_MEMBERSHIP                 = 0xc
+	IP_AUTH_LEVEL                     = 0x14
+	IP_DEFAULT_MULTICAST_LOOP         = 0x1
+	IP_DEFAULT_MULTICAST_TTL          = 0x1
+	IP_DF                             = 0x4000
+	IP_DROP_MEMBERSHIP                = 0xd
+	IP_ESP_NETWORK_LEVEL              = 0x16
+	IP_ESP_TRANS_LEVEL                = 0x15
+	IP_HDRINCL                        = 0x2
+	IP_IPCOMP_LEVEL                   = 0x1d
+	IP_IPDEFTTL                       = 0x25
+	IP_IPSECFLOWINFO                  = 0x24
+	IP_IPSEC_LOCAL_AUTH               = 0x1b
+	IP_IPSEC_LOCAL_CRED               = 0x19
+	IP_IPSEC_LOCAL_ID                 = 0x17
+	IP_IPSEC_REMOTE_AUTH              = 0x1c
+	IP_IPSEC_REMOTE_CRED              = 0x1a
+	IP_IPSEC_REMOTE_ID                = 0x18
+	IP_MAXPACKET                      = 0xffff
+	IP_MAX_MEMBERSHIPS                = 0xfff
+	IP_MF                             = 0x2000
+	IP_MINTTL                         = 0x20
+	IP_MIN_MEMBERSHIPS                = 0xf
+	IP_MSS                            = 0x240
+	IP_MULTICAST_IF                   = 0x9
+	IP_MULTICAST_LOOP                 = 0xb
+	IP_MULTICAST_TTL                  = 0xa
+	IP_OFFMASK                        = 0x1fff
+	IP_OPTIONS                        = 0x1
+	IP_PIPEX                          = 0x22
+	IP_PORTRANGE                      = 0x13
+	IP_PORTRANGE_DEFAULT              = 0x0
+	IP_PORTRANGE_HIGH                 = 0x1
+	IP_PORTRANGE_LOW                  = 0x2
+	IP_RECVDSTADDR                    = 0x7
+	IP_RECVDSTPORT                    = 0x21
+	IP_RECVIF                         = 0x1e
+	IP_RECVOPTS                       = 0x5
+	IP_RECVRETOPTS                    = 0x6
+	IP_RECVRTABLE                     = 0x23
+	IP_RECVTTL                        = 0x1f
+	IP_RETOPTS                        = 0x8
+	IP_RF                             = 0x8000
+	IP_RTABLE                         = 0x1021
+	IP_SENDSRCADDR                    = 0x7
+	IP_TOS                            = 0x3
+	IP_TTL                            = 0x4
+	ISIG                              = 0x80
+	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
+	IUCLC                             = 0x1000
+	IXANY                             = 0x800
+	IXOFF                             = 0x400
+	IXON                              = 0x200
+	KERN_HOSTNAME                     = 0xa
+	KERN_OSRELEASE                    = 0x2
+	KERN_OSTYPE                       = 0x1
+	KERN_VERSION                      = 0x4
+	LCNT_OVERLOAD_FLUSH               = 0x6
+	LOCK_EX                           = 0x2
+	LOCK_NB                           = 0x4
+	LOCK_SH                           = 0x1
+	LOCK_UN                           = 0x8
+	MADV_DONTNEED                     = 0x4
+	MADV_FREE                         = 0x6
+	MADV_NORMAL                       = 0x0
+	MADV_RANDOM                       = 0x1
+	MADV_SEQUENTIAL                   = 0x2
+	MADV_SPACEAVAIL                   = 0x5
+	MADV_WILLNEED                     = 0x3
+	MAP_ANON                          = 0x1000
+	MAP_ANONYMOUS                     = 0x1000
+	MAP_CONCEAL                       = 0x8000
+	MAP_COPY                          = 0x2
+	MAP_FILE                          = 0x0
+	MAP_FIXED                         = 0x10
+	MAP_FLAGMASK                      = 0xfff7
+	MAP_HASSEMAPHORE                  = 0x0
+	MAP_INHERIT                       = 0x0
+	MAP_INHERIT_COPY                  = 0x1
+	MAP_INHERIT_NONE                  = 0x2
+	MAP_INHERIT_SHARE                 = 0x0
+	MAP_INHERIT_ZERO                  = 0x3
+	MAP_NOEXTEND                      = 0x0
+	MAP_NORESERVE                     = 0x0
+	MAP_PRIVATE                       = 0x2
+	MAP_RENAME                        = 0x0
+	MAP_SHARED                        = 0x1
+	MAP_STACK                         = 0x4000
+	MAP_TRYFIXED                      = 0x0
+	MCL_CURRENT                       = 0x1
+	MCL_FUTURE                        = 0x2
+	MNT_ASYNC                         = 0x40
+	MNT_DEFEXPORTED                   = 0x200
+	MNT_DELEXPORT                     = 0x20000
+	MNT_DOOMED                        = 0x8000000
+	MNT_EXPORTANON                    = 0x400
+	MNT_EXPORTED                      = 0x100
+	MNT_EXRDONLY                      = 0x80
+	MNT_FORCE                         = 0x80000
+	MNT_LAZY                          = 0x3
+	MNT_LOCAL                         = 0x1000
+	MNT_NOATIME                       = 0x8000
+	MNT_NODEV                         = 0x10
+	MNT_NOEXEC                        = 0x4
+	MNT_NOPERM                        = 0x20
+	MNT_NOSUID                        = 0x8
+	MNT_NOWAIT                        = 0x2
+	MNT_QUOTA                         = 0x2000
+	MNT_RDONLY                        = 0x1
+	MNT_RELOAD                        = 0x40000
+	MNT_ROOTFS                        = 0x4000
+	MNT_SOFTDEP                       = 0x4000000
+	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
+	MNT_SYNCHRONOUS                   = 0x2
+	MNT_UPDATE                        = 0x10000
+	MNT_VISFLAGMASK                   = 0x400ffff
+	MNT_WAIT                          = 0x1
+	MNT_WANTRDWR                      = 0x2000000
+	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
+	MSG_BCAST                         = 0x100
+	MSG_CMSG_CLOEXEC                  = 0x800
+	MSG_CTRUNC                        = 0x20
+	MSG_DONTROUTE                     = 0x4
+	MSG_DONTWAIT                      = 0x80
+	MSG_EOR                           = 0x8
+	MSG_MCAST                         = 0x200
+	MSG_NOSIGNAL                      = 0x400
+	MSG_OOB                           = 0x1
+	MSG_PEEK                          = 0x2
+	MSG_TRUNC                         = 0x10
+	MSG_WAITALL                       = 0x40
+	MSG_WAITFORONE                    = 0x1000
+	MS_ASYNC                          = 0x1
+	MS_INVALIDATE                     = 0x4
+	MS_SYNC                           = 0x2
+	NAME_MAX                          = 0xff
+	NET_RT_DUMP                       = 0x1
+	NET_RT_FLAGS                      = 0x2
+	NET_RT_IFLIST                     = 0x3
+	NET_RT_IFNAMES                    = 0x6
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
+	NET_RT_STATS                      = 0x4
+	NET_RT_TABLE                      = 0x5
+	NFDBITS                           = 0x20
+	NOFLSH                            = 0x80000000
+	NOKERNINFO                        = 0x2000000
+	NOTE_ATTRIB                       = 0x8
+	NOTE_CHANGE                       = 0x1
+	NOTE_CHILD                        = 0x4
+	NOTE_DELETE                       = 0x1
+	NOTE_EOF                          = 0x2
+	NOTE_EXEC                         = 0x20000000
+	NOTE_EXIT                         = 0x80000000
+	NOTE_EXTEND                       = 0x4
+	NOTE_FORK                         = 0x40000000
+	NOTE_LINK                         = 0x10
+	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
+	NOTE_PCTRLMASK                    = 0xf0000000
+	NOTE_PDATAMASK                    = 0xfffff
+	NOTE_RENAME                       = 0x20
+	NOTE_REVOKE                       = 0x40
+	NOTE_TRACK                        = 0x1
+	NOTE_TRACKERR                     = 0x2
+	NOTE_TRUNCATE                     = 0x80
+	NOTE_WRITE                        = 0x2
+	OCRNL                             = 0x10
+	OLCUC                             = 0x20
+	ONLCR                             = 0x2
+	ONLRET                            = 0x80
+	ONOCR                             = 0x40
+	ONOEOT                            = 0x8
+	OPOST                             = 0x1
+	OXTABS                            = 0x4
+	O_ACCMODE                         = 0x3
+	O_APPEND                          = 0x8
+	O_ASYNC                           = 0x40
+	O_CLOEXEC                         = 0x10000
+	O_CREAT                           = 0x200
+	O_DIRECTORY                       = 0x20000
+	O_DSYNC                           = 0x80
+	O_EXCL                            = 0x800
+	O_EXLOCK                          = 0x20
+	O_FSYNC                           = 0x80
+	O_NDELAY                          = 0x4
+	O_NOCTTY                          = 0x8000
+	O_NOFOLLOW                        = 0x100
+	O_NONBLOCK                        = 0x4
+	O_RDONLY                          = 0x0
+	O_RDWR                            = 0x2
+	O_RSYNC                           = 0x80
+	O_SHLOCK                          = 0x10
+	O_SYNC                            = 0x80
+	O_TRUNC                           = 0x400
+	O_WRONLY                          = 0x1
+	PARENB                            = 0x1000
+	PARMRK                            = 0x8
+	PARODD                            = 0x2000
+	PENDIN                            = 0x20000000
+	PF_FLUSH                          = 0x1
+	PRIO_PGRP                         = 0x1
+	PRIO_PROCESS                      = 0x0
+	PRIO_USER                         = 0x2
+	PROT_EXEC                         = 0x4
+	PROT_NONE                         = 0x0
+	PROT_READ                         = 0x1
+	PROT_WRITE                        = 0x2
+	RLIMIT_CORE                       = 0x4
+	RLIMIT_CPU                        = 0x0
+	RLIMIT_DATA                       = 0x2
+	RLIMIT_FSIZE                      = 0x1
+	RLIMIT_MEMLOCK                    = 0x6
+	RLIMIT_NOFILE                     = 0x8
+	RLIMIT_NPROC                      = 0x7
+	RLIMIT_RSS                        = 0x5
+	RLIMIT_STACK                      = 0x3
+	RLIM_INFINITY                     = 0x7fffffffffffffff
+	RTAX_AUTHOR                       = 0x6
+	RTAX_BFD                          = 0xb
+	RTAX_BRD                          = 0x7
+	RTAX_DNS                          = 0xc
+	RTAX_DST                          = 0x0
+	RTAX_GATEWAY                      = 0x1
+	RTAX_GENMASK                      = 0x3
+	RTAX_IFA                          = 0x5
+	RTAX_IFP                          = 0x4
+	RTAX_LABEL                        = 0xa
+	RTAX_MAX                          = 0xf
+	RTAX_NETMASK                      = 0x2
+	RTAX_SEARCH                       = 0xe
+	RTAX_SRC                          = 0x8
+	RTAX_SRCMASK                      = 0x9
+	RTAX_STATIC                       = 0xd
+	RTA_AUTHOR                        = 0x40
+	RTA_BFD                           = 0x800
+	RTA_BRD                           = 0x80
+	RTA_DNS                           = 0x1000
+	RTA_DST                           = 0x1
+	RTA_GATEWAY                       = 0x2
+	RTA_GENMASK                       = 0x8
+	RTA_IFA                           = 0x20
+	RTA_IFP                           = 0x10
+	RTA_LABEL                         = 0x400
+	RTA_NETMASK                       = 0x4
+	RTA_SEARCH                        = 0x4000
+	RTA_SRC                           = 0x100
+	RTA_SRCMASK                       = 0x200
+	RTA_STATIC                        = 0x2000
+	RTF_ANNOUNCE                      = 0x4000
+	RTF_BFD                           = 0x1000000
+	RTF_BLACKHOLE                     = 0x1000
+	RTF_BROADCAST                     = 0x400000
+	RTF_CACHED                        = 0x20000
+	RTF_CLONED                        = 0x10000
+	RTF_CLONING                       = 0x100
+	RTF_CONNECTED                     = 0x800000
+	RTF_DONE                          = 0x40
+	RTF_DYNAMIC                       = 0x10
+	RTF_FMASK                         = 0x110fc08
+	RTF_GATEWAY                       = 0x2
+	RTF_HOST                          = 0x4
+	RTF_LLINFO                        = 0x400
+	RTF_LOCAL                         = 0x200000
+	RTF_MODIFIED                      = 0x20
+	RTF_MPATH                         = 0x40000
+	RTF_MPLS                          = 0x100000
+	RTF_MULTICAST                     = 0x200
+	RTF_PERMANENT_ARP                 = 0x2000
+	RTF_PROTO1                        = 0x8000
+	RTF_PROTO2                        = 0x4000
+	RTF_PROTO3                        = 0x2000
+	RTF_REJECT                        = 0x8
+	RTF_STATIC                        = 0x800
+	RTF_UP                            = 0x1
+	RTF_USETRAILERS                   = 0x8000
+	RTM_80211INFO                     = 0x15
+	RTM_ADD                           = 0x1
+	RTM_BFD                           = 0x12
+	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
+	RTM_DELADDR                       = 0xd
+	RTM_DELETE                        = 0x2
+	RTM_DESYNC                        = 0x10
+	RTM_GET                           = 0x4
+	RTM_IFANNOUNCE                    = 0xf
+	RTM_IFINFO                        = 0xe
+	RTM_INVALIDATE                    = 0x11
+	RTM_LOSING                        = 0x5
+	RTM_MAXSIZE                       = 0x800
+	RTM_MISS                          = 0x7
+	RTM_NEWADDR                       = 0xc
+	RTM_PROPOSAL                      = 0x13
+	RTM_REDIRECT                      = 0x6
+	RTM_RESOLVE                       = 0xb
+	RTM_SOURCE                        = 0x16
+	RTM_VERSION                       = 0x5
+	RTV_EXPIRE                        = 0x4
+	RTV_HOPCOUNT                      = 0x2
+	RTV_MTU                           = 0x1
+	RTV_RPIPE                         = 0x8
+	RTV_RTT                           = 0x40
+	RTV_RTTVAR                        = 0x80
+	RTV_SPIPE                         = 0x10
+	RTV_SSTHRESH                      = 0x20
+	RT_TABLEID_BITS                   = 0x8
+	RT_TABLEID_MASK                   = 0xff
+	RT_TABLEID_MAX                    = 0xff
+	RUSAGE_CHILDREN                   = -0x1
+	RUSAGE_SELF                       = 0x0
+	RUSAGE_THREAD                     = 0x1
+	SCM_RIGHTS                        = 0x1
+	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
+	SHUT_RD                           = 0x0
+	SHUT_RDWR                         = 0x2
+	SHUT_WR                           = 0x1
+	SIOCADDMULTI                      = 0x80206931
+	SIOCAIFADDR                       = 0x8040691a
+	SIOCAIFGROUP                      = 0x80286987
+	SIOCATMARK                        = 0x40047307
+	SIOCBRDGADD                       = 0x8060693c
+	SIOCBRDGADDL                      = 0x80606949
+	SIOCBRDGADDS                      = 0x80606941
+	SIOCBRDGARL                       = 0x808c694d
+	SIOCBRDGDADDR                     = 0x81286947
+	SIOCBRDGDEL                       = 0x8060693d
+	SIOCBRDGDELS                      = 0x80606942
+	SIOCBRDGFLUSH                     = 0x80606948
+	SIOCBRDGFRL                       = 0x808c694e
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
+	SIOCBRDGGIFFLGS                   = 0xc060693e
+	SIOCBRDGGMA                       = 0xc0146953
+	SIOCBRDGGPARAM                    = 0xc0406958
+	SIOCBRDGGPRI                      = 0xc0146950
+	SIOCBRDGGRL                       = 0xc030694f
+	SIOCBRDGGTO                       = 0xc0146946
+	SIOCBRDGIFS                       = 0xc0606942
+	SIOCBRDGRTS                       = 0xc0206943
+	SIOCBRDGSADDR                     = 0xc1286944
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
+	SIOCBRDGSIFCOST                   = 0x80606955
+	SIOCBRDGSIFFLGS                   = 0x8060693f
+	SIOCBRDGSIFPRIO                   = 0x80606954
+	SIOCBRDGSIFPROT                   = 0x8060694a
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
+	SIOCDELMULTI                      = 0x80206932
+	SIOCDIFADDR                       = 0x80206919
+	SIOCDIFGROUP                      = 0x80286989
+	SIOCDIFPARENT                     = 0x802069b4
+	SIOCDIFPHYADDR                    = 0x80206949
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
+	SIOCDVNETID                       = 0x802069af
+	SIOCGETKALIVE                     = 0xc01869a4
+	SIOCGETLABEL                      = 0x8020699a
+	SIOCGETMPWCFG                     = 0xc02069ae
+	SIOCGETPFLOW                      = 0xc02069fe
+	SIOCGETPFSYNC                     = 0xc02069f8
+	SIOCGETSGCNT                      = 0xc0207534
+	SIOCGETVIFCNT                     = 0xc0287533
+	SIOCGETVLAN                       = 0xc0206990
+	SIOCGIFADDR                       = 0xc0206921
+	SIOCGIFBRDADDR                    = 0xc0206923
+	SIOCGIFCONF                       = 0xc0106924
+	SIOCGIFDATA                       = 0xc020691b
+	SIOCGIFDESCR                      = 0xc0206981
+	SIOCGIFDSTADDR                    = 0xc0206922
+	SIOCGIFFLAGS                      = 0xc0206911
+	SIOCGIFGATTR                      = 0xc028698b
+	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc028698d
+	SIOCGIFGMEMB                      = 0xc028698a
+	SIOCGIFGROUP                      = 0xc0286988
+	SIOCGIFHARDMTU                    = 0xc02069a5
+	SIOCGIFLLPRIO                     = 0xc02069b6
+	SIOCGIFMEDIA                      = 0xc0406938
+	SIOCGIFMETRIC                     = 0xc0206917
+	SIOCGIFMTU                        = 0xc020697e
+	SIOCGIFNETMASK                    = 0xc0206925
+	SIOCGIFPAIR                       = 0xc02069b1
+	SIOCGIFPARENT                     = 0xc02069b3
+	SIOCGIFPRIORITY                   = 0xc020699c
+	SIOCGIFRDOMAIN                    = 0xc02069a0
+	SIOCGIFRTLABEL                    = 0xc0206983
+	SIOCGIFRXR                        = 0x802069aa
+	SIOCGIFSFFPAGE                    = 0xc1126939
+	SIOCGIFXFLAGS                     = 0xc020699e
+	SIOCGLIFPHYADDR                   = 0xc218694b
+	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
+	SIOCGLIFPHYRTABLE                 = 0xc02069a2
+	SIOCGLIFPHYTTL                    = 0xc02069a9
+	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
+	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
+	SIOCGUMBINFO                      = 0xc02069be
+	SIOCGUMBPARAM                     = 0xc02069c0
+	SIOCGVH                           = 0xc02069f6
+	SIOCGVNETFLOWID                   = 0xc02069c4
+	SIOCGVNETID                       = 0xc02069a7
+	SIOCIFAFATTACH                    = 0x801169ab
+	SIOCIFAFDETACH                    = 0x801169ac
+	SIOCIFCREATE                      = 0x8020697a
+	SIOCIFDESTROY                     = 0x80206979
+	SIOCIFGCLONERS                    = 0xc0106978
+	SIOCSETKALIVE                     = 0x801869a3
+	SIOCSETLABEL                      = 0x80206999
+	SIOCSETMPWCFG                     = 0x802069ad
+	SIOCSETPFLOW                      = 0x802069fd
+	SIOCSETPFSYNC                     = 0x802069f7
+	SIOCSETVLAN                       = 0x8020698f
+	SIOCSIFADDR                       = 0x8020690c
+	SIOCSIFBRDADDR                    = 0x80206913
+	SIOCSIFDESCR                      = 0x80206980
+	SIOCSIFDSTADDR                    = 0x8020690e
+	SIOCSIFFLAGS                      = 0x80206910
+	SIOCSIFGATTR                      = 0x8028698c
+	SIOCSIFGENERIC                    = 0x80206939
+	SIOCSIFLLADDR                     = 0x8020691f
+	SIOCSIFLLPRIO                     = 0x802069b5
+	SIOCSIFMEDIA                      = 0xc0206937
+	SIOCSIFMETRIC                     = 0x80206918
+	SIOCSIFMTU                        = 0x8020697f
+	SIOCSIFNETMASK                    = 0x80206916
+	SIOCSIFPAIR                       = 0x802069b0
+	SIOCSIFPARENT                     = 0x802069b2
+	SIOCSIFPRIORITY                   = 0x8020699b
+	SIOCSIFRDOMAIN                    = 0x8020699f
+	SIOCSIFRTLABEL                    = 0x80206982
+	SIOCSIFXFLAGS                     = 0x8020699d
+	SIOCSLIFPHYADDR                   = 0x8218694a
+	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
+	SIOCSLIFPHYRTABLE                 = 0x802069a1
+	SIOCSLIFPHYTTL                    = 0x802069a8
+	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
+	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
+	SIOCSUMBPARAM                     = 0x802069bf
+	SIOCSVH                           = 0xc02069f5
+	SIOCSVNETFLOWID                   = 0x802069c3
+	SIOCSVNETID                       = 0x802069a6
+	SOCK_CLOEXEC                      = 0x8000
+	SOCK_DGRAM                        = 0x2
+	SOCK_DNS                          = 0x1000
+	SOCK_NONBLOCK                     = 0x4000
+	SOCK_RAW                          = 0x3
+	SOCK_RDM                          = 0x4
+	SOCK_SEQPACKET                    = 0x5
+	SOCK_STREAM                       = 0x1
+	SOL_SOCKET                        = 0xffff
+	SOMAXCONN                         = 0x80
+	SO_ACCEPTCONN                     = 0x2
+	SO_BINDANY                        = 0x1000
+	SO_BROADCAST                      = 0x20
+	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
+	SO_DONTROUTE                      = 0x10
+	SO_ERROR                          = 0x1007
+	SO_KEEPALIVE                      = 0x8
+	SO_LINGER                         = 0x80
+	SO_NETPROC                        = 0x1020
+	SO_OOBINLINE                      = 0x100
+	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
+	SO_RCVBUF                         = 0x1002
+	SO_RCVLOWAT                       = 0x1004
+	SO_RCVTIMEO                       = 0x1006
+	SO_REUSEADDR                      = 0x4
+	SO_REUSEPORT                      = 0x200
+	SO_RTABLE                         = 0x1021
+	SO_SNDBUF                         = 0x1001
+	SO_SNDLOWAT                       = 0x1003
+	SO_SNDTIMEO                       = 0x1005
+	SO_SPLICE                         = 0x1023
+	SO_TIMESTAMP                      = 0x800
+	SO_TYPE                           = 0x1008
+	SO_USELOOPBACK                    = 0x40
+	SO_ZEROIZE                        = 0x2000
+	S_BLKSIZE                         = 0x200
+	S_IEXEC                           = 0x40
+	S_IFBLK                           = 0x6000
+	S_IFCHR                           = 0x2000
+	S_IFDIR                           = 0x4000
+	S_IFIFO                           = 0x1000
+	S_IFLNK                           = 0xa000
+	S_IFMT                            = 0xf000
+	S_IFREG                           = 0x8000
+	S_IFSOCK                          = 0xc000
+	S_IREAD                           = 0x100
+	S_IRGRP                           = 0x20
+	S_IROTH                           = 0x4
+	S_IRUSR                           = 0x100
+	S_IRWXG                           = 0x38
+	S_IRWXO                           = 0x7
+	S_IRWXU                           = 0x1c0
+	S_ISGID                           = 0x400
+	S_ISTXT                           = 0x200
+	S_ISUID                           = 0x800
+	S_ISVTX                           = 0x200
+	S_IWGRP                           = 0x10
+	S_IWOTH                           = 0x2
+	S_IWRITE                          = 0x80
+	S_IWUSR                           = 0x80
+	S_IXGRP                           = 0x8
+	S_IXOTH                           = 0x1
+	S_IXUSR                           = 0x40
+	TCIFLUSH                          = 0x1
+	TCIOFF                            = 0x3
+	TCIOFLUSH                         = 0x3
+	TCION                             = 0x4
+	TCOFLUSH                          = 0x2
+	TCOOFF                            = 0x1
+	TCOON                             = 0x2
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
+	TCP_MAXSEG                        = 0x2
+	TCP_MAXWIN                        = 0xffff
+	TCP_MAX_SACK                      = 0x3
+	TCP_MAX_WINSHIFT                  = 0xe
+	TCP_MD5SIG                        = 0x4
+	TCP_MSS                           = 0x200
+	TCP_NODELAY                       = 0x1
+	TCP_NOPUSH                        = 0x10
+	TCP_SACKHOLE_LIMIT                = 0x80
+	TCP_SACK_ENABLE                   = 0x8
+	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
+	TIOCCBRK                          = 0x2000747a
+	TIOCCDTR                          = 0x20007478
+	TIOCCHKVERAUTH                    = 0x2000741e
+	TIOCCLRVERAUTH                    = 0x2000741d
+	TIOCCONS                          = 0x80047462
+	TIOCDRAIN                         = 0x2000745e
+	TIOCEXCL                          = 0x2000740d
+	TIOCEXT                           = 0x80047460
+	TIOCFLAG_CLOCAL                   = 0x2
+	TIOCFLAG_CRTSCTS                  = 0x4
+	TIOCFLAG_MDMBUF                   = 0x8
+	TIOCFLAG_PPS                      = 0x10
+	TIOCFLAG_SOFTCAR                  = 0x1
+	TIOCFLUSH                         = 0x80047410
+	TIOCGETA                          = 0x402c7413
+	TIOCGETD                          = 0x4004741a
+	TIOCGFLAGS                        = 0x4004745d
+	TIOCGPGRP                         = 0x40047477
+	TIOCGSID                          = 0x40047463
+	TIOCGTSTAMP                       = 0x4010745b
+	TIOCGWINSZ                        = 0x40087468
+	TIOCMBIC                          = 0x8004746b
+	TIOCMBIS                          = 0x8004746c
+	TIOCMGET                          = 0x4004746a
+	TIOCMODG                          = 0x4004746a
+	TIOCMODS                          = 0x8004746d
+	TIOCMSET                          = 0x8004746d
+	TIOCM_CAR                         = 0x40
+	TIOCM_CD                          = 0x40
+	TIOCM_CTS                         = 0x20
+	TIOCM_DSR                         = 0x100
+	TIOCM_DTR                         = 0x2
+	TIOCM_LE                          = 0x1
+	TIOCM_RI                          = 0x80
+	TIOCM_RNG                         = 0x80
+	TIOCM_RTS                         = 0x4
+	TIOCM_SR                          = 0x10
+	TIOCM_ST                          = 0x8
+	TIOCNOTTY                         = 0x20007471
+	TIOCNXCL                          = 0x2000740e
+	TIOCOUTQ                          = 0x40047473
+	TIOCPKT                           = 0x80047470
+	TIOCPKT_DATA                      = 0x0
+	TIOCPKT_DOSTOP                    = 0x20
+	TIOCPKT_FLUSHREAD                 = 0x1
+	TIOCPKT_FLUSHWRITE                = 0x2
+	TIOCPKT_IOCTL                     = 0x40
+	TIOCPKT_NOSTOP                    = 0x10
+	TIOCPKT_START                     = 0x8
+	TIOCPKT_STOP                      = 0x4
+	TIOCREMOTE                        = 0x80047469
+	TIOCSBRK                          = 0x2000747b
+	TIOCSCTTY                         = 0x20007461
+	TIOCSDTR                          = 0x20007479
+	TIOCSETA                          = 0x802c7414
+	TIOCSETAF                         = 0x802c7416
+	TIOCSETAW                         = 0x802c7415
+	TIOCSETD                          = 0x8004741b
+	TIOCSETVERAUTH                    = 0x8004741c
+	TIOCSFLAGS                        = 0x8004745c
+	TIOCSIG                           = 0x8004745f
+	TIOCSPGRP                         = 0x80047476
+	TIOCSTART                         = 0x2000746e
+	TIOCSTAT                          = 0x20007465
+	TIOCSTOP                          = 0x2000746f
+	TIOCSTSTAMP                       = 0x8008745a
+	TIOCSWINSZ                        = 0x80087467
+	TIOCUCNTL                         = 0x80047466
+	TIOCUCNTL_CBRK                    = 0x7a
+	TIOCUCNTL_SBRK                    = 0x7b
+	TOSTOP                            = 0x400000
+	UTIME_NOW                         = -0x2
+	UTIME_OMIT                        = -0x1
+	VDISCARD                          = 0xf
+	VDSUSP                            = 0xb
+	VEOF                              = 0x0
+	VEOL                              = 0x1
+	VEOL2                             = 0x2
+	VERASE                            = 0x3
+	VINTR                             = 0x8
+	VKILL                             = 0x5
+	VLNEXT                            = 0xe
+	VMIN                              = 0x10
+	VM_ANONMIN                        = 0x7
+	VM_LOADAVG                        = 0x2
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
+	VM_MAXSLP                         = 0xa
+	VM_METER                          = 0x1
+	VM_NKMEMPAGES                     = 0x6
+	VM_PSSTRINGS                      = 0x3
+	VM_SWAPENCRYPT                    = 0x5
+	VM_USPACE                         = 0xb
+	VM_UVMEXP                         = 0x4
+	VM_VNODEMIN                       = 0x9
+	VM_VTEXTMIN                       = 0x8
+	VQUIT                             = 0x9
+	VREPRINT                          = 0x6
+	VSTART                            = 0xc
+	VSTATUS                           = 0x12
+	VSTOP                             = 0xd
+	VSUSP                             = 0xa
+	VTIME                             = 0x11
+	VWERASE                           = 0x4
+	WALTSIG                           = 0x4
+	WCONTINUED                        = 0x8
+	WCOREFLAG                         = 0x80
+	WNOHANG                           = 0x1
+	WUNTRACED                         = 0x2
+	XCASE                             = 0x1000000
+)
+
+// Errors
+const (
+	E2BIG           = syscall.Errno(0x7)
+	EACCES          = syscall.Errno(0xd)
+	EADDRINUSE      = syscall.Errno(0x30)
+	EADDRNOTAVAIL   = syscall.Errno(0x31)
+	EAFNOSUPPORT    = syscall.Errno(0x2f)
+	EAGAIN          = syscall.Errno(0x23)
+	EALREADY        = syscall.Errno(0x25)
+	EAUTH           = syscall.Errno(0x50)
+	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x5c)
+	EBADRPC         = syscall.Errno(0x48)
+	EBUSY           = syscall.Errno(0x10)
+	ECANCELED       = syscall.Errno(0x58)
+	ECHILD          = syscall.Errno(0xa)
+	ECONNABORTED    = syscall.Errno(0x35)
+	ECONNREFUSED    = syscall.Errno(0x3d)
+	ECONNRESET      = syscall.Errno(0x36)
+	EDEADLK         = syscall.Errno(0xb)
+	EDESTADDRREQ    = syscall.Errno(0x27)
+	EDOM            = syscall.Errno(0x21)
+	EDQUOT          = syscall.Errno(0x45)
+	EEXIST          = syscall.Errno(0x11)
+	EFAULT          = syscall.Errno(0xe)
+	EFBIG           = syscall.Errno(0x1b)
+	EFTYPE          = syscall.Errno(0x4f)
+	EHOSTDOWN       = syscall.Errno(0x40)
+	EHOSTUNREACH    = syscall.Errno(0x41)
+	EIDRM           = syscall.Errno(0x59)
+	EILSEQ          = syscall.Errno(0x54)
+	EINPROGRESS     = syscall.Errno(0x24)
+	EINTR           = syscall.Errno(0x4)
+	EINVAL          = syscall.Errno(0x16)
+	EIO             = syscall.Errno(0x5)
+	EIPSEC          = syscall.Errno(0x52)
+	EISCONN         = syscall.Errno(0x38)
+	EISDIR          = syscall.Errno(0x15)
+	ELAST           = syscall.Errno(0x5f)
+	ELOOP           = syscall.Errno(0x3e)
+	EMEDIUMTYPE     = syscall.Errno(0x56)
+	EMFILE          = syscall.Errno(0x18)
+	EMLINK          = syscall.Errno(0x1f)
+	EMSGSIZE        = syscall.Errno(0x28)
+	ENAMETOOLONG    = syscall.Errno(0x3f)
+	ENEEDAUTH       = syscall.Errno(0x51)
+	ENETDOWN        = syscall.Errno(0x32)
+	ENETRESET       = syscall.Errno(0x34)
+	ENETUNREACH     = syscall.Errno(0x33)
+	ENFILE          = syscall.Errno(0x17)
+	ENOATTR         = syscall.Errno(0x53)
+	ENOBUFS         = syscall.Errno(0x37)
+	ENODEV          = syscall.Errno(0x13)
+	ENOENT          = syscall.Errno(0x2)
+	ENOEXEC         = syscall.Errno(0x8)
+	ENOLCK          = syscall.Errno(0x4d)
+	ENOMEDIUM       = syscall.Errno(0x55)
+	ENOMEM          = syscall.Errno(0xc)
+	ENOMSG          = syscall.Errno(0x5a)
+	ENOPROTOOPT     = syscall.Errno(0x2a)
+	ENOSPC          = syscall.Errno(0x1c)
+	ENOSYS          = syscall.Errno(0x4e)
+	ENOTBLK         = syscall.Errno(0xf)
+	ENOTCONN        = syscall.Errno(0x39)
+	ENOTDIR         = syscall.Errno(0x14)
+	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5d)
+	ENOTSOCK        = syscall.Errno(0x26)
+	ENOTSUP         = syscall.Errno(0x5b)
+	ENOTTY          = syscall.Errno(0x19)
+	ENXIO           = syscall.Errno(0x6)
+	EOPNOTSUPP      = syscall.Errno(0x2d)
+	EOVERFLOW       = syscall.Errno(0x57)
+	EOWNERDEAD      = syscall.Errno(0x5e)
+	EPERM           = syscall.Errno(0x1)
+	EPFNOSUPPORT    = syscall.Errno(0x2e)
+	EPIPE           = syscall.Errno(0x20)
+	EPROCLIM        = syscall.Errno(0x43)
+	EPROCUNAVAIL    = syscall.Errno(0x4c)
+	EPROGMISMATCH   = syscall.Errno(0x4b)
+	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5f)
+	EPROTONOSUPPORT = syscall.Errno(0x2b)
+	EPROTOTYPE      = syscall.Errno(0x29)
+	ERANGE          = syscall.Errno(0x22)
+	EREMOTE         = syscall.Errno(0x47)
+	EROFS           = syscall.Errno(0x1e)
+	ERPCMISMATCH    = syscall.Errno(0x49)
+	ESHUTDOWN       = syscall.Errno(0x3a)
+	ESOCKTNOSUPPORT = syscall.Errno(0x2c)
+	ESPIPE          = syscall.Errno(0x1d)
+	ESRCH           = syscall.Errno(0x3)
+	ESTALE          = syscall.Errno(0x46)
+	ETIMEDOUT       = syscall.Errno(0x3c)
+	ETOOMANYREFS    = syscall.Errno(0x3b)
+	ETXTBSY         = syscall.Errno(0x1a)
+	EUSERS          = syscall.Errno(0x44)
+	EWOULDBLOCK     = syscall.Errno(0x23)
+	EXDEV           = syscall.Errno(0x12)
+)
+
+// Signals
+const (
+	SIGABRT   = syscall.Signal(0x6)
+	SIGALRM   = syscall.Signal(0xe)
+	SIGBUS    = syscall.Signal(0xa)
+	SIGCHLD   = syscall.Signal(0x14)
+	SIGCONT   = syscall.Signal(0x13)
+	SIGEMT    = syscall.Signal(0x7)
+	SIGFPE    = syscall.Signal(0x8)
+	SIGHUP    = syscall.Signal(0x1)
+	SIGILL    = syscall.Signal(0x4)
+	SIGINFO   = syscall.Signal(0x1d)
+	SIGINT    = syscall.Signal(0x2)
+	SIGIO     = syscall.Signal(0x17)
+	SIGIOT    = syscall.Signal(0x6)
+	SIGKILL   = syscall.Signal(0x9)
+	SIGPIPE   = syscall.Signal(0xd)
+	SIGPROF   = syscall.Signal(0x1b)
+	SIGQUIT   = syscall.Signal(0x3)
+	SIGSEGV   = syscall.Signal(0xb)
+	SIGSTOP   = syscall.Signal(0x11)
+	SIGSYS    = syscall.Signal(0xc)
+	SIGTERM   = syscall.Signal(0xf)
+	SIGTHR    = syscall.Signal(0x20)
+	SIGTRAP   = syscall.Signal(0x5)
+	SIGTSTP   = syscall.Signal(0x12)
+	SIGTTIN   = syscall.Signal(0x15)
+	SIGTTOU   = syscall.Signal(0x16)
+	SIGURG    = syscall.Signal(0x10)
+	SIGUSR1   = syscall.Signal(0x1e)
+	SIGUSR2   = syscall.Signal(0x1f)
+	SIGVTALRM = syscall.Signal(0x1a)
+	SIGWINCH  = syscall.Signal(0x1c)
+	SIGXCPU   = syscall.Signal(0x18)
+	SIGXFSZ   = syscall.Signal(0x19)
+)
+
+// Error table
+var errorList = [...]struct {
+	num  syscall.Errno
+	name string
+	desc string
+}{
+	{1, "EPERM", "operation not permitted"},
+	{2, "ENOENT", "no such file or directory"},
+	{3, "ESRCH", "no such process"},
+	{4, "EINTR", "interrupted system call"},
+	{5, "EIO", "input/output error"},
+	{6, "ENXIO", "device not configured"},
+	{7, "E2BIG", "argument list too long"},
+	{8, "ENOEXEC", "exec format error"},
+	{9, "EBADF", "bad file descriptor"},
+	{10, "ECHILD", "no child processes"},
+	{11, "EDEADLK", "resource deadlock avoided"},
+	{12, "ENOMEM", "cannot allocate memory"},
+	{13, "EACCES", "permission denied"},
+	{14, "EFAULT", "bad address"},
+	{15, "ENOTBLK", "block device required"},
+	{16, "EBUSY", "device busy"},
+	{17, "EEXIST", "file exists"},
+	{18, "EXDEV", "cross-device link"},
+	{19, "ENODEV", "operation not supported by device"},
+	{20, "ENOTDIR", "not a directory"},
+	{21, "EISDIR", "is a directory"},
+	{22, "EINVAL", "invalid argument"},
+	{23, "ENFILE", "too many open files in system"},
+	{24, "EMFILE", "too many open files"},
+	{25, "ENOTTY", "inappropriate ioctl for device"},
+	{26, "ETXTBSY", "text file busy"},
+	{27, "EFBIG", "file too large"},
+	{28, "ENOSPC", "no space left on device"},
+	{29, "ESPIPE", "illegal seek"},
+	{30, "EROFS", "read-only file system"},
+	{31, "EMLINK", "too many links"},
+	{32, "EPIPE", "broken pipe"},
+	{33, "EDOM", "numerical argument out of domain"},
+	{34, "ERANGE", "result too large"},
+	{35, "EAGAIN", "resource temporarily unavailable"},
+	{36, "EINPROGRESS", "operation now in progress"},
+	{37, "EALREADY", "operation already in progress"},
+	{38, "ENOTSOCK", "socket operation on non-socket"},
+	{39, "EDESTADDRREQ", "destination address required"},
+	{40, "EMSGSIZE", "message too long"},
+	{41, "EPROTOTYPE", "protocol wrong type for socket"},
+	{42, "ENOPROTOOPT", "protocol not available"},
+	{43, "EPROTONOSUPPORT", "protocol not supported"},
+	{44, "ESOCKTNOSUPPORT", "socket type not supported"},
+	{45, "EOPNOTSUPP", "operation not supported"},
+	{46, "EPFNOSUPPORT", "protocol family not supported"},
+	{47, "EAFNOSUPPORT", "address family not supported by protocol family"},
+	{48, "EADDRINUSE", "address already in use"},
+	{49, "EADDRNOTAVAIL", "can't assign requested address"},
+	{50, "ENETDOWN", "network is down"},
+	{51, "ENETUNREACH", "network is unreachable"},
+	{52, "ENETRESET", "network dropped connection on reset"},
+	{53, "ECONNABORTED", "software caused connection abort"},
+	{54, "ECONNRESET", "connection reset by peer"},
+	{55, "ENOBUFS", "no buffer space available"},
+	{56, "EISCONN", "socket is already connected"},
+	{57, "ENOTCONN", "socket is not connected"},
+	{58, "ESHUTDOWN", "can't send after socket shutdown"},
+	{59, "ETOOMANYREFS", "too many references: can't splice"},
+	{60, "ETIMEDOUT", "operation timed out"},
+	{61, "ECONNREFUSED", "connection refused"},
+	{62, "ELOOP", "too many levels of symbolic links"},
+	{63, "ENAMETOOLONG", "file name too long"},
+	{64, "EHOSTDOWN", "host is down"},
+	{65, "EHOSTUNREACH", "no route to host"},
+	{66, "ENOTEMPTY", "directory not empty"},
+	{67, "EPROCLIM", "too many processes"},
+	{68, "EUSERS", "too many users"},
+	{69, "EDQUOT", "disk quota exceeded"},
+	{70, "ESTALE", "stale NFS file handle"},
+	{71, "EREMOTE", "too many levels of remote in path"},
+	{72, "EBADRPC", "RPC struct is bad"},
+	{73, "ERPCMISMATCH", "RPC version wrong"},
+	{74, "EPROGUNAVAIL", "RPC program not available"},
+	{75, "EPROGMISMATCH", "program version wrong"},
+	{76, "EPROCUNAVAIL", "bad procedure for program"},
+	{77, "ENOLCK", "no locks available"},
+	{78, "ENOSYS", "function not implemented"},
+	{79, "EFTYPE", "inappropriate file type or format"},
+	{80, "EAUTH", "authentication error"},
+	{81, "ENEEDAUTH", "need authenticator"},
+	{82, "EIPSEC", "IPsec processing failure"},
+	{83, "ENOATTR", "attribute not found"},
+	{84, "EILSEQ", "illegal byte sequence"},
+	{85, "ENOMEDIUM", "no medium found"},
+	{86, "EMEDIUMTYPE", "wrong medium type"},
+	{87, "EOVERFLOW", "value too large to be stored in data type"},
+	{88, "ECANCELED", "operation canceled"},
+	{89, "EIDRM", "identifier removed"},
+	{90, "ENOMSG", "no message of desired type"},
+	{91, "ENOTSUP", "not supported"},
+	{92, "EBADMSG", "bad message"},
+	{93, "ENOTRECOVERABLE", "state not recoverable"},
+	{94, "EOWNERDEAD", "previous owner died"},
+	{95, "ELAST", "protocol error"},
+}
+
+// Signal table
+var signalList = [...]struct {
+	num  syscall.Signal
+	name string
+	desc string
+}{
+	{1, "SIGHUP", "hangup"},
+	{2, "SIGINT", "interrupt"},
+	{3, "SIGQUIT", "quit"},
+	{4, "SIGILL", "illegal instruction"},
+	{5, "SIGTRAP", "trace/BPT trap"},
+	{6, "SIGABRT", "abort trap"},
+	{7, "SIGEMT", "EMT trap"},
+	{8, "SIGFPE", "floating point exception"},
+	{9, "SIGKILL", "killed"},
+	{10, "SIGBUS", "bus error"},
+	{11, "SIGSEGV", "segmentation fault"},
+	{12, "SIGSYS", "bad system call"},
+	{13, "SIGPIPE", "broken pipe"},
+	{14, "SIGALRM", "alarm clock"},
+	{15, "SIGTERM", "terminated"},
+	{16, "SIGURG", "urgent I/O condition"},
+	{17, "SIGSTOP", "suspended (signal)"},
+	{18, "SIGTSTP", "suspended"},
+	{19, "SIGCONT", "continued"},
+	{20, "SIGCHLD", "child exited"},
+	{21, "SIGTTIN", "stopped (tty input)"},
+	{22, "SIGTTOU", "stopped (tty output)"},
+	{23, "SIGIO", "I/O possible"},
+	{24, "SIGXCPU", "cputime limit exceeded"},
+	{25, "SIGXFSZ", "filesize limit exceeded"},
+	{26, "SIGVTALRM", "virtual timer expired"},
+	{27, "SIGPROF", "profiling timer expired"},
+	{28, "SIGWINCH", "window size changes"},
+	{29, "SIGINFO", "information request"},
+	{30, "SIGUSR1", "user defined signal 1"},
+	{31, "SIGUSR2", "user defined signal 2"},
+	{32, "SIGTHR", "thread AST"},
+}
diff --git a/vendor/golang.org/x/sys/unix/zerrors_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/zerrors_openbsd_riscv64.go
new file mode 100644
index 0000000000..13d403031e
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zerrors_openbsd_riscv64.go
@@ -0,0 +1,1904 @@
+// mkerrors.sh -m64
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build riscv64 && openbsd
+// +build riscv64,openbsd
+
+// Code generated by cmd/cgo -godefs; DO NOT EDIT.
+// cgo -godefs -- -m64 _const.go
+
+package unix
+
+import "syscall"
+
+const (
+	AF_APPLETALK                      = 0x10
+	AF_BLUETOOTH                      = 0x20
+	AF_CCITT                          = 0xa
+	AF_CHAOS                          = 0x5
+	AF_CNT                            = 0x15
+	AF_COIP                           = 0x14
+	AF_DATAKIT                        = 0x9
+	AF_DECnet                         = 0xc
+	AF_DLI                            = 0xd
+	AF_E164                           = 0x1a
+	AF_ECMA                           = 0x8
+	AF_ENCAP                          = 0x1c
+	AF_HYLINK                         = 0xf
+	AF_IMPLINK                        = 0x3
+	AF_INET                           = 0x2
+	AF_INET6                          = 0x18
+	AF_IPX                            = 0x17
+	AF_ISDN                           = 0x1a
+	AF_ISO                            = 0x7
+	AF_KEY                            = 0x1e
+	AF_LAT                            = 0xe
+	AF_LINK                           = 0x12
+	AF_LOCAL                          = 0x1
+	AF_MAX                            = 0x24
+	AF_MPLS                           = 0x21
+	AF_NATM                           = 0x1b
+	AF_NS                             = 0x6
+	AF_OSI                            = 0x7
+	AF_PUP                            = 0x4
+	AF_ROUTE                          = 0x11
+	AF_SIP                            = 0x1d
+	AF_SNA                            = 0xb
+	AF_UNIX                           = 0x1
+	AF_UNSPEC                         = 0x0
+	ALTWERASE                         = 0x200
+	ARPHRD_ETHER                      = 0x1
+	ARPHRD_FRELAY                     = 0xf
+	ARPHRD_IEEE1394                   = 0x18
+	ARPHRD_IEEE802                    = 0x6
+	B0                                = 0x0
+	B110                              = 0x6e
+	B115200                           = 0x1c200
+	B1200                             = 0x4b0
+	B134                              = 0x86
+	B14400                            = 0x3840
+	B150                              = 0x96
+	B1800                             = 0x708
+	B19200                            = 0x4b00
+	B200                              = 0xc8
+	B230400                           = 0x38400
+	B2400                             = 0x960
+	B28800                            = 0x7080
+	B300                              = 0x12c
+	B38400                            = 0x9600
+	B4800                             = 0x12c0
+	B50                               = 0x32
+	B57600                            = 0xe100
+	B600                              = 0x258
+	B7200                             = 0x1c20
+	B75                               = 0x4b
+	B76800                            = 0x12c00
+	B9600                             = 0x2580
+	BIOCFLUSH                         = 0x20004268
+	BIOCGBLEN                         = 0x40044266
+	BIOCGDIRFILT                      = 0x4004427c
+	BIOCGDLT                          = 0x4004426a
+	BIOCGDLTLIST                      = 0xc010427b
+	BIOCGETIF                         = 0x4020426b
+	BIOCGFILDROP                      = 0x40044278
+	BIOCGHDRCMPLT                     = 0x40044274
+	BIOCGRSIG                         = 0x40044273
+	BIOCGRTIMEOUT                     = 0x4010426e
+	BIOCGSTATS                        = 0x4008426f
+	BIOCIMMEDIATE                     = 0x80044270
+	BIOCLOCK                          = 0x20004276
+	BIOCPROMISC                       = 0x20004269
+	BIOCSBLEN                         = 0xc0044266
+	BIOCSDIRFILT                      = 0x8004427d
+	BIOCSDLT                          = 0x8004427a
+	BIOCSETF                          = 0x80104267
+	BIOCSETIF                         = 0x8020426c
+	BIOCSETWF                         = 0x80104277
+	BIOCSFILDROP                      = 0x80044279
+	BIOCSHDRCMPLT                     = 0x80044275
+	BIOCSRSIG                         = 0x80044272
+	BIOCSRTIMEOUT                     = 0x8010426d
+	BIOCVERSION                       = 0x40044271
+	BPF_A                             = 0x10
+	BPF_ABS                           = 0x20
+	BPF_ADD                           = 0x0
+	BPF_ALIGNMENT                     = 0x4
+	BPF_ALU                           = 0x4
+	BPF_AND                           = 0x50
+	BPF_B                             = 0x10
+	BPF_DIRECTION_IN                  = 0x1
+	BPF_DIRECTION_OUT                 = 0x2
+	BPF_DIV                           = 0x30
+	BPF_FILDROP_CAPTURE               = 0x1
+	BPF_FILDROP_DROP                  = 0x2
+	BPF_FILDROP_PASS                  = 0x0
+	BPF_F_DIR_IN                      = 0x10
+	BPF_F_DIR_MASK                    = 0x30
+	BPF_F_DIR_OUT                     = 0x20
+	BPF_F_DIR_SHIFT                   = 0x4
+	BPF_F_FLOWID                      = 0x8
+	BPF_F_PRI_MASK                    = 0x7
+	BPF_H                             = 0x8
+	BPF_IMM                           = 0x0
+	BPF_IND                           = 0x40
+	BPF_JA                            = 0x0
+	BPF_JEQ                           = 0x10
+	BPF_JGE                           = 0x30
+	BPF_JGT                           = 0x20
+	BPF_JMP                           = 0x5
+	BPF_JSET                          = 0x40
+	BPF_K                             = 0x0
+	BPF_LD                            = 0x0
+	BPF_LDX                           = 0x1
+	BPF_LEN                           = 0x80
+	BPF_LSH                           = 0x60
+	BPF_MAJOR_VERSION                 = 0x1
+	BPF_MAXBUFSIZE                    = 0x200000
+	BPF_MAXINSNS                      = 0x200
+	BPF_MEM                           = 0x60
+	BPF_MEMWORDS                      = 0x10
+	BPF_MINBUFSIZE                    = 0x20
+	BPF_MINOR_VERSION                 = 0x1
+	BPF_MISC                          = 0x7
+	BPF_MSH                           = 0xa0
+	BPF_MUL                           = 0x20
+	BPF_NEG                           = 0x80
+	BPF_OR                            = 0x40
+	BPF_RELEASE                       = 0x30bb6
+	BPF_RET                           = 0x6
+	BPF_RND                           = 0xc0
+	BPF_RSH                           = 0x70
+	BPF_ST                            = 0x2
+	BPF_STX                           = 0x3
+	BPF_SUB                           = 0x10
+	BPF_TAX                           = 0x0
+	BPF_TXA                           = 0x80
+	BPF_W                             = 0x0
+	BPF_X                             = 0x8
+	BRKINT                            = 0x2
+	CFLUSH                            = 0xf
+	CLOCAL                            = 0x8000
+	CLOCK_BOOTTIME                    = 0x6
+	CLOCK_MONOTONIC                   = 0x3
+	CLOCK_PROCESS_CPUTIME_ID          = 0x2
+	CLOCK_REALTIME                    = 0x0
+	CLOCK_THREAD_CPUTIME_ID           = 0x4
+	CLOCK_UPTIME                      = 0x5
+	CPUSTATES                         = 0x6
+	CP_IDLE                           = 0x5
+	CP_INTR                           = 0x4
+	CP_NICE                           = 0x1
+	CP_SPIN                           = 0x3
+	CP_SYS                            = 0x2
+	CP_USER                           = 0x0
+	CREAD                             = 0x800
+	CRTSCTS                           = 0x10000
+	CS5                               = 0x0
+	CS6                               = 0x100
+	CS7                               = 0x200
+	CS8                               = 0x300
+	CSIZE                             = 0x300
+	CSTART                            = 0x11
+	CSTATUS                           = 0xff
+	CSTOP                             = 0x13
+	CSTOPB                            = 0x400
+	CSUSP                             = 0x1a
+	CTL_HW                            = 0x6
+	CTL_KERN                          = 0x1
+	CTL_MAXNAME                       = 0xc
+	CTL_NET                           = 0x4
+	DIOCADDQUEUE                      = 0xc110445d
+	DIOCADDRULE                       = 0xcd604404
+	DIOCADDSTATE                      = 0xc1084425
+	DIOCCHANGERULE                    = 0xcd60441a
+	DIOCCLRIFFLAG                     = 0xc028445a
+	DIOCCLRSRCNODES                   = 0x20004455
+	DIOCCLRSTATES                     = 0xc0e04412
+	DIOCCLRSTATUS                     = 0xc0284416
+	DIOCGETLIMIT                      = 0xc0084427
+	DIOCGETQSTATS                     = 0xc1204460
+	DIOCGETQUEUE                      = 0xc110445f
+	DIOCGETQUEUES                     = 0xc110445e
+	DIOCGETRULE                       = 0xcd604407
+	DIOCGETRULES                      = 0xcd604406
+	DIOCGETRULESET                    = 0xc444443b
+	DIOCGETRULESETS                   = 0xc444443a
+	DIOCGETSRCNODES                   = 0xc0104454
+	DIOCGETSTATE                      = 0xc1084413
+	DIOCGETSTATES                     = 0xc0104419
+	DIOCGETSTATUS                     = 0xc1e84415
+	DIOCGETSYNFLWATS                  = 0xc0084463
+	DIOCGETTIMEOUT                    = 0xc008441e
+	DIOCIGETIFACES                    = 0xc0284457
+	DIOCKILLSRCNODES                  = 0xc080445b
+	DIOCKILLSTATES                    = 0xc0e04429
+	DIOCNATLOOK                       = 0xc0504417
+	DIOCOSFPADD                       = 0xc088444f
+	DIOCOSFPFLUSH                     = 0x2000444e
+	DIOCOSFPGET                       = 0xc0884450
+	DIOCRADDADDRS                     = 0xc4504443
+	DIOCRADDTABLES                    = 0xc450443d
+	DIOCRCLRADDRS                     = 0xc4504442
+	DIOCRCLRASTATS                    = 0xc4504448
+	DIOCRCLRTABLES                    = 0xc450443c
+	DIOCRCLRTSTATS                    = 0xc4504441
+	DIOCRDELADDRS                     = 0xc4504444
+	DIOCRDELTABLES                    = 0xc450443e
+	DIOCRGETADDRS                     = 0xc4504446
+	DIOCRGETASTATS                    = 0xc4504447
+	DIOCRGETTABLES                    = 0xc450443f
+	DIOCRGETTSTATS                    = 0xc4504440
+	DIOCRINADEFINE                    = 0xc450444d
+	DIOCRSETADDRS                     = 0xc4504445
+	DIOCRSETTFLAGS                    = 0xc450444a
+	DIOCRTSTADDRS                     = 0xc4504449
+	DIOCSETDEBUG                      = 0xc0044418
+	DIOCSETHOSTID                     = 0xc0044456
+	DIOCSETIFFLAG                     = 0xc0284459
+	DIOCSETLIMIT                      = 0xc0084428
+	DIOCSETREASS                      = 0xc004445c
+	DIOCSETSTATUSIF                   = 0xc0284414
+	DIOCSETSYNCOOKIES                 = 0xc0014462
+	DIOCSETSYNFLWATS                  = 0xc0084461
+	DIOCSETTIMEOUT                    = 0xc008441d
+	DIOCSTART                         = 0x20004401
+	DIOCSTOP                          = 0x20004402
+	DIOCXBEGIN                        = 0xc0104451
+	DIOCXCOMMIT                       = 0xc0104452
+	DIOCXROLLBACK                     = 0xc0104453
+	DLT_ARCNET                        = 0x7
+	DLT_ATM_RFC1483                   = 0xb
+	DLT_AX25                          = 0x3
+	DLT_CHAOS                         = 0x5
+	DLT_C_HDLC                        = 0x68
+	DLT_EN10MB                        = 0x1
+	DLT_EN3MB                         = 0x2
+	DLT_ENC                           = 0xd
+	DLT_FDDI                          = 0xa
+	DLT_IEEE802                       = 0x6
+	DLT_IEEE802_11                    = 0x69
+	DLT_IEEE802_11_RADIO              = 0x7f
+	DLT_LOOP                          = 0xc
+	DLT_MPLS                          = 0xdb
+	DLT_NULL                          = 0x0
+	DLT_OPENFLOW                      = 0x10b
+	DLT_PFLOG                         = 0x75
+	DLT_PFSYNC                        = 0x12
+	DLT_PPP                           = 0x9
+	DLT_PPP_BSDOS                     = 0x10
+	DLT_PPP_ETHER                     = 0x33
+	DLT_PPP_SERIAL                    = 0x32
+	DLT_PRONET                        = 0x4
+	DLT_RAW                           = 0xe
+	DLT_SLIP                          = 0x8
+	DLT_SLIP_BSDOS                    = 0xf
+	DLT_USBPCAP                       = 0xf9
+	DLT_USER0                         = 0x93
+	DLT_USER1                         = 0x94
+	DLT_USER10                        = 0x9d
+	DLT_USER11                        = 0x9e
+	DLT_USER12                        = 0x9f
+	DLT_USER13                        = 0xa0
+	DLT_USER14                        = 0xa1
+	DLT_USER15                        = 0xa2
+	DLT_USER2                         = 0x95
+	DLT_USER3                         = 0x96
+	DLT_USER4                         = 0x97
+	DLT_USER5                         = 0x98
+	DLT_USER6                         = 0x99
+	DLT_USER7                         = 0x9a
+	DLT_USER8                         = 0x9b
+	DLT_USER9                         = 0x9c
+	DT_BLK                            = 0x6
+	DT_CHR                            = 0x2
+	DT_DIR                            = 0x4
+	DT_FIFO                           = 0x1
+	DT_LNK                            = 0xa
+	DT_REG                            = 0x8
+	DT_SOCK                           = 0xc
+	DT_UNKNOWN                        = 0x0
+	ECHO                              = 0x8
+	ECHOCTL                           = 0x40
+	ECHOE                             = 0x2
+	ECHOK                             = 0x4
+	ECHOKE                            = 0x1
+	ECHONL                            = 0x10
+	ECHOPRT                           = 0x20
+	EMT_TAGOVF                        = 0x1
+	EMUL_ENABLED                      = 0x1
+	EMUL_NATIVE                       = 0x2
+	ENDRUNDISC                        = 0x9
+	ETH64_8021_RSVD_MASK              = 0xfffffffffff0
+	ETH64_8021_RSVD_PREFIX            = 0x180c2000000
+	ETHERMIN                          = 0x2e
+	ETHERMTU                          = 0x5dc
+	ETHERTYPE_8023                    = 0x4
+	ETHERTYPE_AARP                    = 0x80f3
+	ETHERTYPE_ACCTON                  = 0x8390
+	ETHERTYPE_AEONIC                  = 0x8036
+	ETHERTYPE_ALPHA                   = 0x814a
+	ETHERTYPE_AMBER                   = 0x6008
+	ETHERTYPE_AMOEBA                  = 0x8145
+	ETHERTYPE_AOE                     = 0x88a2
+	ETHERTYPE_APOLLO                  = 0x80f7
+	ETHERTYPE_APOLLODOMAIN            = 0x8019
+	ETHERTYPE_APPLETALK               = 0x809b
+	ETHERTYPE_APPLITEK                = 0x80c7
+	ETHERTYPE_ARGONAUT                = 0x803a
+	ETHERTYPE_ARP                     = 0x806
+	ETHERTYPE_AT                      = 0x809b
+	ETHERTYPE_ATALK                   = 0x809b
+	ETHERTYPE_ATOMIC                  = 0x86df
+	ETHERTYPE_ATT                     = 0x8069
+	ETHERTYPE_ATTSTANFORD             = 0x8008
+	ETHERTYPE_AUTOPHON                = 0x806a
+	ETHERTYPE_AXIS                    = 0x8856
+	ETHERTYPE_BCLOOP                  = 0x9003
+	ETHERTYPE_BOFL                    = 0x8102
+	ETHERTYPE_CABLETRON               = 0x7034
+	ETHERTYPE_CHAOS                   = 0x804
+	ETHERTYPE_COMDESIGN               = 0x806c
+	ETHERTYPE_COMPUGRAPHIC            = 0x806d
+	ETHERTYPE_COUNTERPOINT            = 0x8062
+	ETHERTYPE_CRONUS                  = 0x8004
+	ETHERTYPE_CRONUSVLN               = 0x8003
+	ETHERTYPE_DCA                     = 0x1234
+	ETHERTYPE_DDE                     = 0x807b
+	ETHERTYPE_DEBNI                   = 0xaaaa
+	ETHERTYPE_DECAM                   = 0x8048
+	ETHERTYPE_DECCUST                 = 0x6006
+	ETHERTYPE_DECDIAG                 = 0x6005
+	ETHERTYPE_DECDNS                  = 0x803c
+	ETHERTYPE_DECDTS                  = 0x803e
+	ETHERTYPE_DECEXPER                = 0x6000
+	ETHERTYPE_DECLAST                 = 0x8041
+	ETHERTYPE_DECLTM                  = 0x803f
+	ETHERTYPE_DECMUMPS                = 0x6009
+	ETHERTYPE_DECNETBIOS              = 0x8040
+	ETHERTYPE_DELTACON                = 0x86de
+	ETHERTYPE_DIDDLE                  = 0x4321
+	ETHERTYPE_DLOG1                   = 0x660
+	ETHERTYPE_DLOG2                   = 0x661
+	ETHERTYPE_DN                      = 0x6003
+	ETHERTYPE_DOGFIGHT                = 0x1989
+	ETHERTYPE_DSMD                    = 0x8039
+	ETHERTYPE_EAPOL                   = 0x888e
+	ETHERTYPE_ECMA                    = 0x803
+	ETHERTYPE_ENCRYPT                 = 0x803d
+	ETHERTYPE_ES                      = 0x805d
+	ETHERTYPE_EXCELAN                 = 0x8010
+	ETHERTYPE_EXPERDATA               = 0x8049
+	ETHERTYPE_FLIP                    = 0x8146
+	ETHERTYPE_FLOWCONTROL             = 0x8808
+	ETHERTYPE_FRARP                   = 0x808
+	ETHERTYPE_GENDYN                  = 0x8068
+	ETHERTYPE_HAYES                   = 0x8130
+	ETHERTYPE_HIPPI_FP                = 0x8180
+	ETHERTYPE_HITACHI                 = 0x8820
+	ETHERTYPE_HP                      = 0x8005
+	ETHERTYPE_IEEEPUP                 = 0xa00
+	ETHERTYPE_IEEEPUPAT               = 0xa01
+	ETHERTYPE_IMLBL                   = 0x4c42
+	ETHERTYPE_IMLBLDIAG               = 0x424c
+	ETHERTYPE_IP                      = 0x800
+	ETHERTYPE_IPAS                    = 0x876c
+	ETHERTYPE_IPV6                    = 0x86dd
+	ETHERTYPE_IPX                     = 0x8137
+	ETHERTYPE_IPXNEW                  = 0x8037
+	ETHERTYPE_KALPANA                 = 0x8582
+	ETHERTYPE_LANBRIDGE               = 0x8038
+	ETHERTYPE_LANPROBE                = 0x8888
+	ETHERTYPE_LAT                     = 0x6004
+	ETHERTYPE_LBACK                   = 0x9000
+	ETHERTYPE_LITTLE                  = 0x8060
+	ETHERTYPE_LLDP                    = 0x88cc
+	ETHERTYPE_LOGICRAFT               = 0x8148
+	ETHERTYPE_LOOPBACK                = 0x9000
+	ETHERTYPE_MACSEC                  = 0x88e5
+	ETHERTYPE_MATRA                   = 0x807a
+	ETHERTYPE_MAX                     = 0xffff
+	ETHERTYPE_MERIT                   = 0x807c
+	ETHERTYPE_MICP                    = 0x873a
+	ETHERTYPE_MOPDL                   = 0x6001
+	ETHERTYPE_MOPRC                   = 0x6002
+	ETHERTYPE_MOTOROLA                = 0x818d
+	ETHERTYPE_MPLS                    = 0x8847
+	ETHERTYPE_MPLS_MCAST              = 0x8848
+	ETHERTYPE_MUMPS                   = 0x813f
+	ETHERTYPE_NBPCC                   = 0x3c04
+	ETHERTYPE_NBPCLAIM                = 0x3c09
+	ETHERTYPE_NBPCLREQ                = 0x3c05
+	ETHERTYPE_NBPCLRSP                = 0x3c06
+	ETHERTYPE_NBPCREQ                 = 0x3c02
+	ETHERTYPE_NBPCRSP                 = 0x3c03
+	ETHERTYPE_NBPDG                   = 0x3c07
+	ETHERTYPE_NBPDGB                  = 0x3c08
+	ETHERTYPE_NBPDLTE                 = 0x3c0a
+	ETHERTYPE_NBPRAR                  = 0x3c0c
+	ETHERTYPE_NBPRAS                  = 0x3c0b
+	ETHERTYPE_NBPRST                  = 0x3c0d
+	ETHERTYPE_NBPSCD                  = 0x3c01
+	ETHERTYPE_NBPVCD                  = 0x3c00
+	ETHERTYPE_NBS                     = 0x802
+	ETHERTYPE_NCD                     = 0x8149
+	ETHERTYPE_NESTAR                  = 0x8006
+	ETHERTYPE_NETBEUI                 = 0x8191
+	ETHERTYPE_NHRP                    = 0x2001
+	ETHERTYPE_NOVELL                  = 0x8138
+	ETHERTYPE_NS                      = 0x600
+	ETHERTYPE_NSAT                    = 0x601
+	ETHERTYPE_NSCOMPAT                = 0x807
+	ETHERTYPE_NSH                     = 0x984f
+	ETHERTYPE_NTRAILER                = 0x10
+	ETHERTYPE_OS9                     = 0x7007
+	ETHERTYPE_OS9NET                  = 0x7009
+	ETHERTYPE_PACER                   = 0x80c6
+	ETHERTYPE_PBB                     = 0x88e7
+	ETHERTYPE_PCS                     = 0x4242
+	ETHERTYPE_PLANNING                = 0x8044
+	ETHERTYPE_PPP                     = 0x880b
+	ETHERTYPE_PPPOE                   = 0x8864
+	ETHERTYPE_PPPOEDISC               = 0x8863
+	ETHERTYPE_PRIMENTS                = 0x7031
+	ETHERTYPE_PUP                     = 0x200
+	ETHERTYPE_PUPAT                   = 0x200
+	ETHERTYPE_QINQ                    = 0x88a8
+	ETHERTYPE_RACAL                   = 0x7030
+	ETHERTYPE_RATIONAL                = 0x8150
+	ETHERTYPE_RAWFR                   = 0x6559
+	ETHERTYPE_RCL                     = 0x1995
+	ETHERTYPE_RDP                     = 0x8739
+	ETHERTYPE_RETIX                   = 0x80f2
+	ETHERTYPE_REVARP                  = 0x8035
+	ETHERTYPE_SCA                     = 0x6007
+	ETHERTYPE_SECTRA                  = 0x86db
+	ETHERTYPE_SECUREDATA              = 0x876d
+	ETHERTYPE_SGITW                   = 0x817e
+	ETHERTYPE_SG_BOUNCE               = 0x8016
+	ETHERTYPE_SG_DIAG                 = 0x8013
+	ETHERTYPE_SG_NETGAMES             = 0x8014
+	ETHERTYPE_SG_RESV                 = 0x8015
+	ETHERTYPE_SIMNET                  = 0x5208
+	ETHERTYPE_SLOW                    = 0x8809
+	ETHERTYPE_SNA                     = 0x80d5
+	ETHERTYPE_SNMP                    = 0x814c
+	ETHERTYPE_SONIX                   = 0xfaf5
+	ETHERTYPE_SPIDER                  = 0x809f
+	ETHERTYPE_SPRITE                  = 0x500
+	ETHERTYPE_STP                     = 0x8181
+	ETHERTYPE_TALARIS                 = 0x812b
+	ETHERTYPE_TALARISMC               = 0x852b
+	ETHERTYPE_TCPCOMP                 = 0x876b
+	ETHERTYPE_TCPSM                   = 0x9002
+	ETHERTYPE_TEC                     = 0x814f
+	ETHERTYPE_TIGAN                   = 0x802f
+	ETHERTYPE_TRAIL                   = 0x1000
+	ETHERTYPE_TRANSETHER              = 0x6558
+	ETHERTYPE_TYMSHARE                = 0x802e
+	ETHERTYPE_UBBST                   = 0x7005
+	ETHERTYPE_UBDEBUG                 = 0x900
+	ETHERTYPE_UBDIAGLOOP              = 0x7002
+	ETHERTYPE_UBDL                    = 0x7000
+	ETHERTYPE_UBNIU                   = 0x7001
+	ETHERTYPE_UBNMC                   = 0x7003
+	ETHERTYPE_VALID                   = 0x1600
+	ETHERTYPE_VARIAN                  = 0x80dd
+	ETHERTYPE_VAXELN                  = 0x803b
+	ETHERTYPE_VEECO                   = 0x8067
+	ETHERTYPE_VEXP                    = 0x805b
+	ETHERTYPE_VGLAB                   = 0x8131
+	ETHERTYPE_VINES                   = 0xbad
+	ETHERTYPE_VINESECHO               = 0xbaf
+	ETHERTYPE_VINESLOOP               = 0xbae
+	ETHERTYPE_VITAL                   = 0xff00
+	ETHERTYPE_VLAN                    = 0x8100
+	ETHERTYPE_VLTLMAN                 = 0x8080
+	ETHERTYPE_VPROD                   = 0x805c
+	ETHERTYPE_VURESERVED              = 0x8147
+	ETHERTYPE_WATERLOO                = 0x8130
+	ETHERTYPE_WELLFLEET               = 0x8103
+	ETHERTYPE_X25                     = 0x805
+	ETHERTYPE_X75                     = 0x801
+	ETHERTYPE_XNSSM                   = 0x9001
+	ETHERTYPE_XTP                     = 0x817d
+	ETHER_ADDR_LEN                    = 0x6
+	ETHER_ALIGN                       = 0x2
+	ETHER_CRC_LEN                     = 0x4
+	ETHER_CRC_POLY_BE                 = 0x4c11db6
+	ETHER_CRC_POLY_LE                 = 0xedb88320
+	ETHER_HDR_LEN                     = 0xe
+	ETHER_MAX_DIX_LEN                 = 0x600
+	ETHER_MAX_HARDMTU_LEN             = 0xff9b
+	ETHER_MAX_LEN                     = 0x5ee
+	ETHER_MIN_LEN                     = 0x40
+	ETHER_TYPE_LEN                    = 0x2
+	ETHER_VLAN_ENCAP_LEN              = 0x4
+	EVFILT_AIO                        = -0x3
+	EVFILT_DEVICE                     = -0x8
+	EVFILT_EXCEPT                     = -0x9
+	EVFILT_PROC                       = -0x5
+	EVFILT_READ                       = -0x1
+	EVFILT_SIGNAL                     = -0x6
+	EVFILT_SYSCOUNT                   = 0x9
+	EVFILT_TIMER                      = -0x7
+	EVFILT_VNODE                      = -0x4
+	EVFILT_WRITE                      = -0x2
+	EVL_ENCAPLEN                      = 0x4
+	EVL_PRIO_BITS                     = 0xd
+	EVL_PRIO_MAX                      = 0x7
+	EVL_VLID_MASK                     = 0xfff
+	EVL_VLID_MAX                      = 0xffe
+	EVL_VLID_MIN                      = 0x1
+	EVL_VLID_NULL                     = 0x0
+	EV_ADD                            = 0x1
+	EV_CLEAR                          = 0x20
+	EV_DELETE                         = 0x2
+	EV_DISABLE                        = 0x8
+	EV_DISPATCH                       = 0x80
+	EV_ENABLE                         = 0x4
+	EV_EOF                            = 0x8000
+	EV_ERROR                          = 0x4000
+	EV_FLAG1                          = 0x2000
+	EV_ONESHOT                        = 0x10
+	EV_RECEIPT                        = 0x40
+	EV_SYSFLAGS                       = 0xf800
+	EXTA                              = 0x4b00
+	EXTB                              = 0x9600
+	EXTPROC                           = 0x800
+	FD_CLOEXEC                        = 0x1
+	FD_SETSIZE                        = 0x400
+	FLUSHO                            = 0x800000
+	F_DUPFD                           = 0x0
+	F_DUPFD_CLOEXEC                   = 0xa
+	F_GETFD                           = 0x1
+	F_GETFL                           = 0x3
+	F_GETLK                           = 0x7
+	F_GETOWN                          = 0x5
+	F_ISATTY                          = 0xb
+	F_OK                              = 0x0
+	F_RDLCK                           = 0x1
+	F_SETFD                           = 0x2
+	F_SETFL                           = 0x4
+	F_SETLK                           = 0x8
+	F_SETLKW                          = 0x9
+	F_SETOWN                          = 0x6
+	F_UNLCK                           = 0x2
+	F_WRLCK                           = 0x3
+	HUPCL                             = 0x4000
+	HW_MACHINE                        = 0x1
+	ICANON                            = 0x100
+	ICMP6_FILTER                      = 0x12
+	ICRNL                             = 0x100
+	IEXTEN                            = 0x400
+	IFAN_ARRIVAL                      = 0x0
+	IFAN_DEPARTURE                    = 0x1
+	IFF_ALLMULTI                      = 0x200
+	IFF_BROADCAST                     = 0x2
+	IFF_CANTCHANGE                    = 0x8e52
+	IFF_DEBUG                         = 0x4
+	IFF_LINK0                         = 0x1000
+	IFF_LINK1                         = 0x2000
+	IFF_LINK2                         = 0x4000
+	IFF_LOOPBACK                      = 0x8
+	IFF_MULTICAST                     = 0x8000
+	IFF_NOARP                         = 0x80
+	IFF_OACTIVE                       = 0x400
+	IFF_POINTOPOINT                   = 0x10
+	IFF_PROMISC                       = 0x100
+	IFF_RUNNING                       = 0x40
+	IFF_SIMPLEX                       = 0x800
+	IFF_STATICARP                     = 0x20
+	IFF_UP                            = 0x1
+	IFNAMSIZ                          = 0x10
+	IFT_1822                          = 0x2
+	IFT_A12MPPSWITCH                  = 0x82
+	IFT_AAL2                          = 0xbb
+	IFT_AAL5                          = 0x31
+	IFT_ADSL                          = 0x5e
+	IFT_AFLANE8023                    = 0x3b
+	IFT_AFLANE8025                    = 0x3c
+	IFT_ARAP                          = 0x58
+	IFT_ARCNET                        = 0x23
+	IFT_ARCNETPLUS                    = 0x24
+	IFT_ASYNC                         = 0x54
+	IFT_ATM                           = 0x25
+	IFT_ATMDXI                        = 0x69
+	IFT_ATMFUNI                       = 0x6a
+	IFT_ATMIMA                        = 0x6b
+	IFT_ATMLOGICAL                    = 0x50
+	IFT_ATMRADIO                      = 0xbd
+	IFT_ATMSUBINTERFACE               = 0x86
+	IFT_ATMVCIENDPT                   = 0xc2
+	IFT_ATMVIRTUAL                    = 0x95
+	IFT_BGPPOLICYACCOUNTING           = 0xa2
+	IFT_BLUETOOTH                     = 0xf8
+	IFT_BRIDGE                        = 0xd1
+	IFT_BSC                           = 0x53
+	IFT_CARP                          = 0xf7
+	IFT_CCTEMUL                       = 0x3d
+	IFT_CEPT                          = 0x13
+	IFT_CES                           = 0x85
+	IFT_CHANNEL                       = 0x46
+	IFT_CNR                           = 0x55
+	IFT_COFFEE                        = 0x84
+	IFT_COMPOSITELINK                 = 0x9b
+	IFT_DCN                           = 0x8d
+	IFT_DIGITALPOWERLINE              = 0x8a
+	IFT_DIGITALWRAPPEROVERHEADCHANNEL = 0xba
+	IFT_DLSW                          = 0x4a
+	IFT_DOCSCABLEDOWNSTREAM           = 0x80
+	IFT_DOCSCABLEMACLAYER             = 0x7f
+	IFT_DOCSCABLEUPSTREAM             = 0x81
+	IFT_DOCSCABLEUPSTREAMCHANNEL      = 0xcd
+	IFT_DS0                           = 0x51
+	IFT_DS0BUNDLE                     = 0x52
+	IFT_DS1FDL                        = 0xaa
+	IFT_DS3                           = 0x1e
+	IFT_DTM                           = 0x8c
+	IFT_DUMMY                         = 0xf1
+	IFT_DVBASILN                      = 0xac
+	IFT_DVBASIOUT                     = 0xad
+	IFT_DVBRCCDOWNSTREAM              = 0x93
+	IFT_DVBRCCMACLAYER                = 0x92
+	IFT_DVBRCCUPSTREAM                = 0x94
+	IFT_ECONET                        = 0xce
+	IFT_ENC                           = 0xf4
+	IFT_EON                           = 0x19
+	IFT_EPLRS                         = 0x57
+	IFT_ESCON                         = 0x49
+	IFT_ETHER                         = 0x6
+	IFT_FAITH                         = 0xf3
+	IFT_FAST                          = 0x7d
+	IFT_FASTETHER                     = 0x3e
+	IFT_FASTETHERFX                   = 0x45
+	IFT_FDDI                          = 0xf
+	IFT_FIBRECHANNEL                  = 0x38
+	IFT_FRAMERELAYINTERCONNECT        = 0x3a
+	IFT_FRAMERELAYMPI                 = 0x5c
+	IFT_FRDLCIENDPT                   = 0xc1
+	IFT_FRELAY                        = 0x20
+	IFT_FRELAYDCE                     = 0x2c
+	IFT_FRF16MFRBUNDLE                = 0xa3
+	IFT_FRFORWARD                     = 0x9e
+	IFT_G703AT2MB                     = 0x43
+	IFT_G703AT64K                     = 0x42
+	IFT_GIF                           = 0xf0
+	IFT_GIGABITETHERNET               = 0x75
+	IFT_GR303IDT                      = 0xb2
+	IFT_GR303RDT                      = 0xb1
+	IFT_H323GATEKEEPER                = 0xa4
+	IFT_H323PROXY                     = 0xa5
+	IFT_HDH1822                       = 0x3
+	IFT_HDLC                          = 0x76
+	IFT_HDSL2                         = 0xa8
+	IFT_HIPERLAN2                     = 0xb7
+	IFT_HIPPI                         = 0x2f
+	IFT_HIPPIINTERFACE                = 0x39
+	IFT_HOSTPAD                       = 0x5a
+	IFT_HSSI                          = 0x2e
+	IFT_HY                            = 0xe
+	IFT_IBM370PARCHAN                 = 0x48
+	IFT_IDSL                          = 0x9a
+	IFT_IEEE1394                      = 0x90
+	IFT_IEEE80211                     = 0x47
+	IFT_IEEE80212                     = 0x37
+	IFT_IEEE8023ADLAG                 = 0xa1
+	IFT_IFGSN                         = 0x91
+	IFT_IMT                           = 0xbe
+	IFT_INFINIBAND                    = 0xc7
+	IFT_INTERLEAVE                    = 0x7c
+	IFT_IP                            = 0x7e
+	IFT_IPFORWARD                     = 0x8e
+	IFT_IPOVERATM                     = 0x72
+	IFT_IPOVERCDLC                    = 0x6d
+	IFT_IPOVERCLAW                    = 0x6e
+	IFT_IPSWITCH                      = 0x4e
+	IFT_ISDN                          = 0x3f
+	IFT_ISDNBASIC                     = 0x14
+	IFT_ISDNPRIMARY                   = 0x15
+	IFT_ISDNS                         = 0x4b
+	IFT_ISDNU                         = 0x4c
+	IFT_ISO88022LLC                   = 0x29
+	IFT_ISO88023                      = 0x7
+	IFT_ISO88024                      = 0x8
+	IFT_ISO88025                      = 0x9
+	IFT_ISO88025CRFPINT               = 0x62
+	IFT_ISO88025DTR                   = 0x56
+	IFT_ISO88025FIBER                 = 0x73
+	IFT_ISO88026                      = 0xa
+	IFT_ISUP                          = 0xb3
+	IFT_L2VLAN                        = 0x87
+	IFT_L3IPVLAN                      = 0x88
+	IFT_L3IPXVLAN                     = 0x89
+	IFT_LAPB                          = 0x10
+	IFT_LAPD                          = 0x4d
+	IFT_LAPF                          = 0x77
+	IFT_LINEGROUP                     = 0xd2
+	IFT_LOCALTALK                     = 0x2a
+	IFT_LOOP                          = 0x18
+	IFT_MBIM                          = 0xfa
+	IFT_MEDIAMAILOVERIP               = 0x8b
+	IFT_MFSIGLINK                     = 0xa7
+	IFT_MIOX25                        = 0x26
+	IFT_MODEM                         = 0x30
+	IFT_MPC                           = 0x71
+	IFT_MPLS                          = 0xa6
+	IFT_MPLSTUNNEL                    = 0x96
+	IFT_MSDSL                         = 0x8f
+	IFT_MVL                           = 0xbf
+	IFT_MYRINET                       = 0x63
+	IFT_NFAS                          = 0xaf
+	IFT_NSIP                          = 0x1b
+	IFT_OPTICALCHANNEL                = 0xc3
+	IFT_OPTICALTRANSPORT              = 0xc4
+	IFT_OTHER                         = 0x1
+	IFT_P10                           = 0xc
+	IFT_P80                           = 0xd
+	IFT_PARA                          = 0x22
+	IFT_PFLOG                         = 0xf5
+	IFT_PFLOW                         = 0xf9
+	IFT_PFSYNC                        = 0xf6
+	IFT_PLC                           = 0xae
+	IFT_PON155                        = 0xcf
+	IFT_PON622                        = 0xd0
+	IFT_POS                           = 0xab
+	IFT_PPP                           = 0x17
+	IFT_PPPMULTILINKBUNDLE            = 0x6c
+	IFT_PROPATM                       = 0xc5
+	IFT_PROPBWAP2MP                   = 0xb8
+	IFT_PROPCNLS                      = 0x59
+	IFT_PROPDOCSWIRELESSDOWNSTREAM    = 0xb5
+	IFT_PROPDOCSWIRELESSMACLAYER      = 0xb4
+	IFT_PROPDOCSWIRELESSUPSTREAM      = 0xb6
+	IFT_PROPMUX                       = 0x36
+	IFT_PROPVIRTUAL                   = 0x35
+	IFT_PROPWIRELESSP2P               = 0x9d
+	IFT_PTPSERIAL                     = 0x16
+	IFT_PVC                           = 0xf2
+	IFT_Q2931                         = 0xc9
+	IFT_QLLC                          = 0x44
+	IFT_RADIOMAC                      = 0xbc
+	IFT_RADSL                         = 0x5f
+	IFT_REACHDSL                      = 0xc0
+	IFT_RFC1483                       = 0x9f
+	IFT_RS232                         = 0x21
+	IFT_RSRB                          = 0x4f
+	IFT_SDLC                          = 0x11
+	IFT_SDSL                          = 0x60
+	IFT_SHDSL                         = 0xa9
+	IFT_SIP                           = 0x1f
+	IFT_SIPSIG                        = 0xcc
+	IFT_SIPTG                         = 0xcb
+	IFT_SLIP                          = 0x1c
+	IFT_SMDSDXI                       = 0x2b
+	IFT_SMDSICIP                      = 0x34
+	IFT_SONET                         = 0x27
+	IFT_SONETOVERHEADCHANNEL          = 0xb9
+	IFT_SONETPATH                     = 0x32
+	IFT_SONETVT                       = 0x33
+	IFT_SRP                           = 0x97
+	IFT_SS7SIGLINK                    = 0x9c
+	IFT_STACKTOSTACK                  = 0x6f
+	IFT_STARLAN                       = 0xb
+	IFT_T1                            = 0x12
+	IFT_TDLC                          = 0x74
+	IFT_TELINK                        = 0xc8
+	IFT_TERMPAD                       = 0x5b
+	IFT_TR008                         = 0xb0
+	IFT_TRANSPHDLC                    = 0x7b
+	IFT_TUNNEL                        = 0x83
+	IFT_ULTRA                         = 0x1d
+	IFT_USB                           = 0xa0
+	IFT_V11                           = 0x40
+	IFT_V35                           = 0x2d
+	IFT_V36                           = 0x41
+	IFT_V37                           = 0x78
+	IFT_VDSL                          = 0x61
+	IFT_VIRTUALIPADDRESS              = 0x70
+	IFT_VIRTUALTG                     = 0xca
+	IFT_VOICEDID                      = 0xd5
+	IFT_VOICEEM                       = 0x64
+	IFT_VOICEEMFGD                    = 0xd3
+	IFT_VOICEENCAP                    = 0x67
+	IFT_VOICEFGDEANA                  = 0xd4
+	IFT_VOICEFXO                      = 0x65
+	IFT_VOICEFXS                      = 0x66
+	IFT_VOICEOVERATM                  = 0x98
+	IFT_VOICEOVERCABLE                = 0xc6
+	IFT_VOICEOVERFRAMERELAY           = 0x99
+	IFT_VOICEOVERIP                   = 0x68
+	IFT_WIREGUARD                     = 0xfb
+	IFT_X213                          = 0x5d
+	IFT_X25                           = 0x5
+	IFT_X25DDN                        = 0x4
+	IFT_X25HUNTGROUP                  = 0x7a
+	IFT_X25MLP                        = 0x79
+	IFT_X25PLE                        = 0x28
+	IFT_XETHER                        = 0x1a
+	IGNBRK                            = 0x1
+	IGNCR                             = 0x80
+	IGNPAR                            = 0x4
+	IMAXBEL                           = 0x2000
+	INLCR                             = 0x40
+	INPCK                             = 0x10
+	IN_CLASSA_HOST                    = 0xffffff
+	IN_CLASSA_MAX                     = 0x80
+	IN_CLASSA_NET                     = 0xff000000
+	IN_CLASSA_NSHIFT                  = 0x18
+	IN_CLASSB_HOST                    = 0xffff
+	IN_CLASSB_MAX                     = 0x10000
+	IN_CLASSB_NET                     = 0xffff0000
+	IN_CLASSB_NSHIFT                  = 0x10
+	IN_CLASSC_HOST                    = 0xff
+	IN_CLASSC_NET                     = 0xffffff00
+	IN_CLASSC_NSHIFT                  = 0x8
+	IN_CLASSD_HOST                    = 0xfffffff
+	IN_CLASSD_NET                     = 0xf0000000
+	IN_CLASSD_NSHIFT                  = 0x1c
+	IN_LOOPBACKNET                    = 0x7f
+	IN_RFC3021_HOST                   = 0x1
+	IN_RFC3021_NET                    = 0xfffffffe
+	IN_RFC3021_NSHIFT                 = 0x1f
+	IPPROTO_AH                        = 0x33
+	IPPROTO_CARP                      = 0x70
+	IPPROTO_DIVERT                    = 0x102
+	IPPROTO_DONE                      = 0x101
+	IPPROTO_DSTOPTS                   = 0x3c
+	IPPROTO_EGP                       = 0x8
+	IPPROTO_ENCAP                     = 0x62
+	IPPROTO_EON                       = 0x50
+	IPPROTO_ESP                       = 0x32
+	IPPROTO_ETHERIP                   = 0x61
+	IPPROTO_FRAGMENT                  = 0x2c
+	IPPROTO_GGP                       = 0x3
+	IPPROTO_GRE                       = 0x2f
+	IPPROTO_HOPOPTS                   = 0x0
+	IPPROTO_ICMP                      = 0x1
+	IPPROTO_ICMPV6                    = 0x3a
+	IPPROTO_IDP                       = 0x16
+	IPPROTO_IGMP                      = 0x2
+	IPPROTO_IP                        = 0x0
+	IPPROTO_IPCOMP                    = 0x6c
+	IPPROTO_IPIP                      = 0x4
+	IPPROTO_IPV4                      = 0x4
+	IPPROTO_IPV6                      = 0x29
+	IPPROTO_MAX                       = 0x100
+	IPPROTO_MAXID                     = 0x103
+	IPPROTO_MOBILE                    = 0x37
+	IPPROTO_MPLS                      = 0x89
+	IPPROTO_NONE                      = 0x3b
+	IPPROTO_PFSYNC                    = 0xf0
+	IPPROTO_PIM                       = 0x67
+	IPPROTO_PUP                       = 0xc
+	IPPROTO_RAW                       = 0xff
+	IPPROTO_ROUTING                   = 0x2b
+	IPPROTO_RSVP                      = 0x2e
+	IPPROTO_SCTP                      = 0x84
+	IPPROTO_TCP                       = 0x6
+	IPPROTO_TP                        = 0x1d
+	IPPROTO_UDP                       = 0x11
+	IPPROTO_UDPLITE                   = 0x88
+	IPV6_AUTH_LEVEL                   = 0x35
+	IPV6_AUTOFLOWLABEL                = 0x3b
+	IPV6_CHECKSUM                     = 0x1a
+	IPV6_DEFAULT_MULTICAST_HOPS       = 0x1
+	IPV6_DEFAULT_MULTICAST_LOOP       = 0x1
+	IPV6_DEFHLIM                      = 0x40
+	IPV6_DONTFRAG                     = 0x3e
+	IPV6_DSTOPTS                      = 0x32
+	IPV6_ESP_NETWORK_LEVEL            = 0x37
+	IPV6_ESP_TRANS_LEVEL              = 0x36
+	IPV6_FAITH                        = 0x1d
+	IPV6_FLOWINFO_MASK                = 0xffffff0f
+	IPV6_FLOWLABEL_MASK               = 0xffff0f00
+	IPV6_FRAGTTL                      = 0x78
+	IPV6_HLIMDEC                      = 0x1
+	IPV6_HOPLIMIT                     = 0x2f
+	IPV6_HOPOPTS                      = 0x31
+	IPV6_IPCOMP_LEVEL                 = 0x3c
+	IPV6_JOIN_GROUP                   = 0xc
+	IPV6_LEAVE_GROUP                  = 0xd
+	IPV6_MAXHLIM                      = 0xff
+	IPV6_MAXPACKET                    = 0xffff
+	IPV6_MINHOPCOUNT                  = 0x41
+	IPV6_MMTU                         = 0x500
+	IPV6_MULTICAST_HOPS               = 0xa
+	IPV6_MULTICAST_IF                 = 0x9
+	IPV6_MULTICAST_LOOP               = 0xb
+	IPV6_NEXTHOP                      = 0x30
+	IPV6_OPTIONS                      = 0x1
+	IPV6_PATHMTU                      = 0x2c
+	IPV6_PIPEX                        = 0x3f
+	IPV6_PKTINFO                      = 0x2e
+	IPV6_PORTRANGE                    = 0xe
+	IPV6_PORTRANGE_DEFAULT            = 0x0
+	IPV6_PORTRANGE_HIGH               = 0x1
+	IPV6_PORTRANGE_LOW                = 0x2
+	IPV6_RECVDSTOPTS                  = 0x28
+	IPV6_RECVDSTPORT                  = 0x40
+	IPV6_RECVHOPLIMIT                 = 0x25
+	IPV6_RECVHOPOPTS                  = 0x27
+	IPV6_RECVPATHMTU                  = 0x2b
+	IPV6_RECVPKTINFO                  = 0x24
+	IPV6_RECVRTHDR                    = 0x26
+	IPV6_RECVTCLASS                   = 0x39
+	IPV6_RTABLE                       = 0x1021
+	IPV6_RTHDR                        = 0x33
+	IPV6_RTHDRDSTOPTS                 = 0x23
+	IPV6_RTHDR_LOOSE                  = 0x0
+	IPV6_RTHDR_STRICT                 = 0x1
+	IPV6_RTHDR_TYPE_0                 = 0x0
+	IPV6_SOCKOPT_RESERVED1            = 0x3
+	IPV6_TCLASS                       = 0x3d
+	IPV6_UNICAST_HOPS                 = 0x4
+	IPV6_USE_MIN_MTU                  = 0x2a
+	IPV6_V6ONLY                       = 0x1b
+	IPV6_VERSION                      = 0x60
+	IPV6_VERSION_MASK                 = 0xf0
+	IP_ADD_MEMBERSHIP                 = 0xc
+	IP_AUTH_LEVEL                     = 0x14
+	IP_DEFAULT_MULTICAST_LOOP         = 0x1
+	IP_DEFAULT_MULTICAST_TTL          = 0x1
+	IP_DF                             = 0x4000
+	IP_DROP_MEMBERSHIP                = 0xd
+	IP_ESP_NETWORK_LEVEL              = 0x16
+	IP_ESP_TRANS_LEVEL                = 0x15
+	IP_HDRINCL                        = 0x2
+	IP_IPCOMP_LEVEL                   = 0x1d
+	IP_IPDEFTTL                       = 0x25
+	IP_IPSECFLOWINFO                  = 0x24
+	IP_IPSEC_LOCAL_AUTH               = 0x1b
+	IP_IPSEC_LOCAL_CRED               = 0x19
+	IP_IPSEC_LOCAL_ID                 = 0x17
+	IP_IPSEC_REMOTE_AUTH              = 0x1c
+	IP_IPSEC_REMOTE_CRED              = 0x1a
+	IP_IPSEC_REMOTE_ID                = 0x18
+	IP_MAXPACKET                      = 0xffff
+	IP_MAX_MEMBERSHIPS                = 0xfff
+	IP_MF                             = 0x2000
+	IP_MINTTL                         = 0x20
+	IP_MIN_MEMBERSHIPS                = 0xf
+	IP_MSS                            = 0x240
+	IP_MULTICAST_IF                   = 0x9
+	IP_MULTICAST_LOOP                 = 0xb
+	IP_MULTICAST_TTL                  = 0xa
+	IP_OFFMASK                        = 0x1fff
+	IP_OPTIONS                        = 0x1
+	IP_PIPEX                          = 0x22
+	IP_PORTRANGE                      = 0x13
+	IP_PORTRANGE_DEFAULT              = 0x0
+	IP_PORTRANGE_HIGH                 = 0x1
+	IP_PORTRANGE_LOW                  = 0x2
+	IP_RECVDSTADDR                    = 0x7
+	IP_RECVDSTPORT                    = 0x21
+	IP_RECVIF                         = 0x1e
+	IP_RECVOPTS                       = 0x5
+	IP_RECVRETOPTS                    = 0x6
+	IP_RECVRTABLE                     = 0x23
+	IP_RECVTTL                        = 0x1f
+	IP_RETOPTS                        = 0x8
+	IP_RF                             = 0x8000
+	IP_RTABLE                         = 0x1021
+	IP_SENDSRCADDR                    = 0x7
+	IP_TOS                            = 0x3
+	IP_TTL                            = 0x4
+	ISIG                              = 0x80
+	ISTRIP                            = 0x20
+	ITIMER_PROF                       = 0x2
+	ITIMER_REAL                       = 0x0
+	ITIMER_VIRTUAL                    = 0x1
+	IUCLC                             = 0x1000
+	IXANY                             = 0x800
+	IXOFF                             = 0x400
+	IXON                              = 0x200
+	KERN_HOSTNAME                     = 0xa
+	KERN_OSRELEASE                    = 0x2
+	KERN_OSTYPE                       = 0x1
+	KERN_VERSION                      = 0x4
+	LCNT_OVERLOAD_FLUSH               = 0x6
+	LOCK_EX                           = 0x2
+	LOCK_NB                           = 0x4
+	LOCK_SH                           = 0x1
+	LOCK_UN                           = 0x8
+	MADV_DONTNEED                     = 0x4
+	MADV_FREE                         = 0x6
+	MADV_NORMAL                       = 0x0
+	MADV_RANDOM                       = 0x1
+	MADV_SEQUENTIAL                   = 0x2
+	MADV_SPACEAVAIL                   = 0x5
+	MADV_WILLNEED                     = 0x3
+	MAP_ANON                          = 0x1000
+	MAP_ANONYMOUS                     = 0x1000
+	MAP_CONCEAL                       = 0x8000
+	MAP_COPY                          = 0x2
+	MAP_FILE                          = 0x0
+	MAP_FIXED                         = 0x10
+	MAP_FLAGMASK                      = 0xfff7
+	MAP_HASSEMAPHORE                  = 0x0
+	MAP_INHERIT                       = 0x0
+	MAP_INHERIT_COPY                  = 0x1
+	MAP_INHERIT_NONE                  = 0x2
+	MAP_INHERIT_SHARE                 = 0x0
+	MAP_INHERIT_ZERO                  = 0x3
+	MAP_NOEXTEND                      = 0x0
+	MAP_NORESERVE                     = 0x0
+	MAP_PRIVATE                       = 0x2
+	MAP_RENAME                        = 0x0
+	MAP_SHARED                        = 0x1
+	MAP_STACK                         = 0x4000
+	MAP_TRYFIXED                      = 0x0
+	MCL_CURRENT                       = 0x1
+	MCL_FUTURE                        = 0x2
+	MNT_ASYNC                         = 0x40
+	MNT_DEFEXPORTED                   = 0x200
+	MNT_DELEXPORT                     = 0x20000
+	MNT_DOOMED                        = 0x8000000
+	MNT_EXPORTANON                    = 0x400
+	MNT_EXPORTED                      = 0x100
+	MNT_EXRDONLY                      = 0x80
+	MNT_FORCE                         = 0x80000
+	MNT_LAZY                          = 0x3
+	MNT_LOCAL                         = 0x1000
+	MNT_NOATIME                       = 0x8000
+	MNT_NODEV                         = 0x10
+	MNT_NOEXEC                        = 0x4
+	MNT_NOPERM                        = 0x20
+	MNT_NOSUID                        = 0x8
+	MNT_NOWAIT                        = 0x2
+	MNT_QUOTA                         = 0x2000
+	MNT_RDONLY                        = 0x1
+	MNT_RELOAD                        = 0x40000
+	MNT_ROOTFS                        = 0x4000
+	MNT_SOFTDEP                       = 0x4000000
+	MNT_STALLED                       = 0x100000
+	MNT_SWAPPABLE                     = 0x200000
+	MNT_SYNCHRONOUS                   = 0x2
+	MNT_UPDATE                        = 0x10000
+	MNT_VISFLAGMASK                   = 0x400ffff
+	MNT_WAIT                          = 0x1
+	MNT_WANTRDWR                      = 0x2000000
+	MNT_WXALLOWED                     = 0x800
+	MOUNT_AFS                         = "afs"
+	MOUNT_CD9660                      = "cd9660"
+	MOUNT_EXT2FS                      = "ext2fs"
+	MOUNT_FFS                         = "ffs"
+	MOUNT_FUSEFS                      = "fuse"
+	MOUNT_MFS                         = "mfs"
+	MOUNT_MSDOS                       = "msdos"
+	MOUNT_NCPFS                       = "ncpfs"
+	MOUNT_NFS                         = "nfs"
+	MOUNT_NTFS                        = "ntfs"
+	MOUNT_TMPFS                       = "tmpfs"
+	MOUNT_UDF                         = "udf"
+	MOUNT_UFS                         = "ffs"
+	MSG_BCAST                         = 0x100
+	MSG_CMSG_CLOEXEC                  = 0x800
+	MSG_CTRUNC                        = 0x20
+	MSG_DONTROUTE                     = 0x4
+	MSG_DONTWAIT                      = 0x80
+	MSG_EOR                           = 0x8
+	MSG_MCAST                         = 0x200
+	MSG_NOSIGNAL                      = 0x400
+	MSG_OOB                           = 0x1
+	MSG_PEEK                          = 0x2
+	MSG_TRUNC                         = 0x10
+	MSG_WAITALL                       = 0x40
+	MS_ASYNC                          = 0x1
+	MS_INVALIDATE                     = 0x4
+	MS_SYNC                           = 0x2
+	NAME_MAX                          = 0xff
+	NET_RT_DUMP                       = 0x1
+	NET_RT_FLAGS                      = 0x2
+	NET_RT_IFLIST                     = 0x3
+	NET_RT_IFNAMES                    = 0x6
+	NET_RT_MAXID                      = 0x8
+	NET_RT_SOURCE                     = 0x7
+	NET_RT_STATS                      = 0x4
+	NET_RT_TABLE                      = 0x5
+	NFDBITS                           = 0x20
+	NOFLSH                            = 0x80000000
+	NOKERNINFO                        = 0x2000000
+	NOTE_ATTRIB                       = 0x8
+	NOTE_CHANGE                       = 0x1
+	NOTE_CHILD                        = 0x4
+	NOTE_DELETE                       = 0x1
+	NOTE_EOF                          = 0x2
+	NOTE_EXEC                         = 0x20000000
+	NOTE_EXIT                         = 0x80000000
+	NOTE_EXTEND                       = 0x4
+	NOTE_FORK                         = 0x40000000
+	NOTE_LINK                         = 0x10
+	NOTE_LOWAT                        = 0x1
+	NOTE_OOB                          = 0x4
+	NOTE_PCTRLMASK                    = 0xf0000000
+	NOTE_PDATAMASK                    = 0xfffff
+	NOTE_RENAME                       = 0x20
+	NOTE_REVOKE                       = 0x40
+	NOTE_TRACK                        = 0x1
+	NOTE_TRACKERR                     = 0x2
+	NOTE_TRUNCATE                     = 0x80
+	NOTE_WRITE                        = 0x2
+	OCRNL                             = 0x10
+	OLCUC                             = 0x20
+	ONLCR                             = 0x2
+	ONLRET                            = 0x80
+	ONOCR                             = 0x40
+	ONOEOT                            = 0x8
+	OPOST                             = 0x1
+	OXTABS                            = 0x4
+	O_ACCMODE                         = 0x3
+	O_APPEND                          = 0x8
+	O_ASYNC                           = 0x40
+	O_CLOEXEC                         = 0x10000
+	O_CREAT                           = 0x200
+	O_DIRECTORY                       = 0x20000
+	O_DSYNC                           = 0x80
+	O_EXCL                            = 0x800
+	O_EXLOCK                          = 0x20
+	O_FSYNC                           = 0x80
+	O_NDELAY                          = 0x4
+	O_NOCTTY                          = 0x8000
+	O_NOFOLLOW                        = 0x100
+	O_NONBLOCK                        = 0x4
+	O_RDONLY                          = 0x0
+	O_RDWR                            = 0x2
+	O_RSYNC                           = 0x80
+	O_SHLOCK                          = 0x10
+	O_SYNC                            = 0x80
+	O_TRUNC                           = 0x400
+	O_WRONLY                          = 0x1
+	PARENB                            = 0x1000
+	PARMRK                            = 0x8
+	PARODD                            = 0x2000
+	PENDIN                            = 0x20000000
+	PF_FLUSH                          = 0x1
+	PRIO_PGRP                         = 0x1
+	PRIO_PROCESS                      = 0x0
+	PRIO_USER                         = 0x2
+	PROT_EXEC                         = 0x4
+	PROT_NONE                         = 0x0
+	PROT_READ                         = 0x1
+	PROT_WRITE                        = 0x2
+	RLIMIT_CORE                       = 0x4
+	RLIMIT_CPU                        = 0x0
+	RLIMIT_DATA                       = 0x2
+	RLIMIT_FSIZE                      = 0x1
+	RLIMIT_MEMLOCK                    = 0x6
+	RLIMIT_NOFILE                     = 0x8
+	RLIMIT_NPROC                      = 0x7
+	RLIMIT_RSS                        = 0x5
+	RLIMIT_STACK                      = 0x3
+	RLIM_INFINITY                     = 0x7fffffffffffffff
+	RTAX_AUTHOR                       = 0x6
+	RTAX_BFD                          = 0xb
+	RTAX_BRD                          = 0x7
+	RTAX_DNS                          = 0xc
+	RTAX_DST                          = 0x0
+	RTAX_GATEWAY                      = 0x1
+	RTAX_GENMASK                      = 0x3
+	RTAX_IFA                          = 0x5
+	RTAX_IFP                          = 0x4
+	RTAX_LABEL                        = 0xa
+	RTAX_MAX                          = 0xf
+	RTAX_NETMASK                      = 0x2
+	RTAX_SEARCH                       = 0xe
+	RTAX_SRC                          = 0x8
+	RTAX_SRCMASK                      = 0x9
+	RTAX_STATIC                       = 0xd
+	RTA_AUTHOR                        = 0x40
+	RTA_BFD                           = 0x800
+	RTA_BRD                           = 0x80
+	RTA_DNS                           = 0x1000
+	RTA_DST                           = 0x1
+	RTA_GATEWAY                       = 0x2
+	RTA_GENMASK                       = 0x8
+	RTA_IFA                           = 0x20
+	RTA_IFP                           = 0x10
+	RTA_LABEL                         = 0x400
+	RTA_NETMASK                       = 0x4
+	RTA_SEARCH                        = 0x4000
+	RTA_SRC                           = 0x100
+	RTA_SRCMASK                       = 0x200
+	RTA_STATIC                        = 0x2000
+	RTF_ANNOUNCE                      = 0x4000
+	RTF_BFD                           = 0x1000000
+	RTF_BLACKHOLE                     = 0x1000
+	RTF_BROADCAST                     = 0x400000
+	RTF_CACHED                        = 0x20000
+	RTF_CLONED                        = 0x10000
+	RTF_CLONING                       = 0x100
+	RTF_CONNECTED                     = 0x800000
+	RTF_DONE                          = 0x40
+	RTF_DYNAMIC                       = 0x10
+	RTF_FMASK                         = 0x110fc08
+	RTF_GATEWAY                       = 0x2
+	RTF_HOST                          = 0x4
+	RTF_LLINFO                        = 0x400
+	RTF_LOCAL                         = 0x200000
+	RTF_MODIFIED                      = 0x20
+	RTF_MPATH                         = 0x40000
+	RTF_MPLS                          = 0x100000
+	RTF_MULTICAST                     = 0x200
+	RTF_PERMANENT_ARP                 = 0x2000
+	RTF_PROTO1                        = 0x8000
+	RTF_PROTO2                        = 0x4000
+	RTF_PROTO3                        = 0x2000
+	RTF_REJECT                        = 0x8
+	RTF_STATIC                        = 0x800
+	RTF_UP                            = 0x1
+	RTF_USETRAILERS                   = 0x8000
+	RTM_80211INFO                     = 0x15
+	RTM_ADD                           = 0x1
+	RTM_BFD                           = 0x12
+	RTM_CHANGE                        = 0x3
+	RTM_CHGADDRATTR                   = 0x14
+	RTM_DELADDR                       = 0xd
+	RTM_DELETE                        = 0x2
+	RTM_DESYNC                        = 0x10
+	RTM_GET                           = 0x4
+	RTM_IFANNOUNCE                    = 0xf
+	RTM_IFINFO                        = 0xe
+	RTM_INVALIDATE                    = 0x11
+	RTM_LOSING                        = 0x5
+	RTM_MAXSIZE                       = 0x800
+	RTM_MISS                          = 0x7
+	RTM_NEWADDR                       = 0xc
+	RTM_PROPOSAL                      = 0x13
+	RTM_REDIRECT                      = 0x6
+	RTM_RESOLVE                       = 0xb
+	RTM_SOURCE                        = 0x16
+	RTM_VERSION                       = 0x5
+	RTV_EXPIRE                        = 0x4
+	RTV_HOPCOUNT                      = 0x2
+	RTV_MTU                           = 0x1
+	RTV_RPIPE                         = 0x8
+	RTV_RTT                           = 0x40
+	RTV_RTTVAR                        = 0x80
+	RTV_SPIPE                         = 0x10
+	RTV_SSTHRESH                      = 0x20
+	RT_TABLEID_BITS                   = 0x8
+	RT_TABLEID_MASK                   = 0xff
+	RT_TABLEID_MAX                    = 0xff
+	RUSAGE_CHILDREN                   = -0x1
+	RUSAGE_SELF                       = 0x0
+	RUSAGE_THREAD                     = 0x1
+	SCM_RIGHTS                        = 0x1
+	SCM_TIMESTAMP                     = 0x4
+	SEEK_CUR                          = 0x1
+	SEEK_END                          = 0x2
+	SEEK_SET                          = 0x0
+	SHUT_RD                           = 0x0
+	SHUT_RDWR                         = 0x2
+	SHUT_WR                           = 0x1
+	SIOCADDMULTI                      = 0x80206931
+	SIOCAIFADDR                       = 0x8040691a
+	SIOCAIFGROUP                      = 0x80286987
+	SIOCATMARK                        = 0x40047307
+	SIOCBRDGADD                       = 0x8060693c
+	SIOCBRDGADDL                      = 0x80606949
+	SIOCBRDGADDS                      = 0x80606941
+	SIOCBRDGARL                       = 0x808c694d
+	SIOCBRDGDADDR                     = 0x81286947
+	SIOCBRDGDEL                       = 0x8060693d
+	SIOCBRDGDELS                      = 0x80606942
+	SIOCBRDGFLUSH                     = 0x80606948
+	SIOCBRDGFRL                       = 0x808c694e
+	SIOCBRDGGCACHE                    = 0xc0146941
+	SIOCBRDGGFD                       = 0xc0146952
+	SIOCBRDGGHT                       = 0xc0146951
+	SIOCBRDGGIFFLGS                   = 0xc060693e
+	SIOCBRDGGMA                       = 0xc0146953
+	SIOCBRDGGPARAM                    = 0xc0406958
+	SIOCBRDGGPRI                      = 0xc0146950
+	SIOCBRDGGRL                       = 0xc030694f
+	SIOCBRDGGTO                       = 0xc0146946
+	SIOCBRDGIFS                       = 0xc0606942
+	SIOCBRDGRTS                       = 0xc0206943
+	SIOCBRDGSADDR                     = 0xc1286944
+	SIOCBRDGSCACHE                    = 0x80146940
+	SIOCBRDGSFD                       = 0x80146952
+	SIOCBRDGSHT                       = 0x80146951
+	SIOCBRDGSIFCOST                   = 0x80606955
+	SIOCBRDGSIFFLGS                   = 0x8060693f
+	SIOCBRDGSIFPRIO                   = 0x80606954
+	SIOCBRDGSIFPROT                   = 0x8060694a
+	SIOCBRDGSMA                       = 0x80146953
+	SIOCBRDGSPRI                      = 0x80146950
+	SIOCBRDGSPROTO                    = 0x8014695a
+	SIOCBRDGSTO                       = 0x80146945
+	SIOCBRDGSTXHC                     = 0x80146959
+	SIOCDELLABEL                      = 0x80206997
+	SIOCDELMULTI                      = 0x80206932
+	SIOCDIFADDR                       = 0x80206919
+	SIOCDIFGROUP                      = 0x80286989
+	SIOCDIFPARENT                     = 0x802069b4
+	SIOCDIFPHYADDR                    = 0x80206949
+	SIOCDPWE3NEIGHBOR                 = 0x802069de
+	SIOCDVNETID                       = 0x802069af
+	SIOCGETKALIVE                     = 0xc01869a4
+	SIOCGETLABEL                      = 0x8020699a
+	SIOCGETMPWCFG                     = 0xc02069ae
+	SIOCGETPFLOW                      = 0xc02069fe
+	SIOCGETPFSYNC                     = 0xc02069f8
+	SIOCGETSGCNT                      = 0xc0207534
+	SIOCGETVIFCNT                     = 0xc0287533
+	SIOCGETVLAN                       = 0xc0206990
+	SIOCGIFADDR                       = 0xc0206921
+	SIOCGIFBRDADDR                    = 0xc0206923
+	SIOCGIFCONF                       = 0xc0106924
+	SIOCGIFDATA                       = 0xc020691b
+	SIOCGIFDESCR                      = 0xc0206981
+	SIOCGIFDSTADDR                    = 0xc0206922
+	SIOCGIFFLAGS                      = 0xc0206911
+	SIOCGIFGATTR                      = 0xc028698b
+	SIOCGIFGENERIC                    = 0xc020693a
+	SIOCGIFGLIST                      = 0xc028698d
+	SIOCGIFGMEMB                      = 0xc028698a
+	SIOCGIFGROUP                      = 0xc0286988
+	SIOCGIFHARDMTU                    = 0xc02069a5
+	SIOCGIFLLPRIO                     = 0xc02069b6
+	SIOCGIFMEDIA                      = 0xc0406938
+	SIOCGIFMETRIC                     = 0xc0206917
+	SIOCGIFMTU                        = 0xc020697e
+	SIOCGIFNETMASK                    = 0xc0206925
+	SIOCGIFPAIR                       = 0xc02069b1
+	SIOCGIFPARENT                     = 0xc02069b3
+	SIOCGIFPRIORITY                   = 0xc020699c
+	SIOCGIFRDOMAIN                    = 0xc02069a0
+	SIOCGIFRTLABEL                    = 0xc0206983
+	SIOCGIFRXR                        = 0x802069aa
+	SIOCGIFSFFPAGE                    = 0xc1126939
+	SIOCGIFXFLAGS                     = 0xc020699e
+	SIOCGLIFPHYADDR                   = 0xc218694b
+	SIOCGLIFPHYDF                     = 0xc02069c2
+	SIOCGLIFPHYECN                    = 0xc02069c8
+	SIOCGLIFPHYRTABLE                 = 0xc02069a2
+	SIOCGLIFPHYTTL                    = 0xc02069a9
+	SIOCGPGRP                         = 0x40047309
+	SIOCGPWE3                         = 0xc0206998
+	SIOCGPWE3CTRLWORD                 = 0xc02069dc
+	SIOCGPWE3FAT                      = 0xc02069dd
+	SIOCGPWE3NEIGHBOR                 = 0xc21869de
+	SIOCGRXHPRIO                      = 0xc02069db
+	SIOCGSPPPPARAMS                   = 0xc0206994
+	SIOCGTXHPRIO                      = 0xc02069c6
+	SIOCGUMBINFO                      = 0xc02069be
+	SIOCGUMBPARAM                     = 0xc02069c0
+	SIOCGVH                           = 0xc02069f6
+	SIOCGVNETFLOWID                   = 0xc02069c4
+	SIOCGVNETID                       = 0xc02069a7
+	SIOCIFAFATTACH                    = 0x801169ab
+	SIOCIFAFDETACH                    = 0x801169ac
+	SIOCIFCREATE                      = 0x8020697a
+	SIOCIFDESTROY                     = 0x80206979
+	SIOCIFGCLONERS                    = 0xc0106978
+	SIOCSETKALIVE                     = 0x801869a3
+	SIOCSETLABEL                      = 0x80206999
+	SIOCSETMPWCFG                     = 0x802069ad
+	SIOCSETPFLOW                      = 0x802069fd
+	SIOCSETPFSYNC                     = 0x802069f7
+	SIOCSETVLAN                       = 0x8020698f
+	SIOCSIFADDR                       = 0x8020690c
+	SIOCSIFBRDADDR                    = 0x80206913
+	SIOCSIFDESCR                      = 0x80206980
+	SIOCSIFDSTADDR                    = 0x8020690e
+	SIOCSIFFLAGS                      = 0x80206910
+	SIOCSIFGATTR                      = 0x8028698c
+	SIOCSIFGENERIC                    = 0x80206939
+	SIOCSIFLLADDR                     = 0x8020691f
+	SIOCSIFLLPRIO                     = 0x802069b5
+	SIOCSIFMEDIA                      = 0xc0206937
+	SIOCSIFMETRIC                     = 0x80206918
+	SIOCSIFMTU                        = 0x8020697f
+	SIOCSIFNETMASK                    = 0x80206916
+	SIOCSIFPAIR                       = 0x802069b0
+	SIOCSIFPARENT                     = 0x802069b2
+	SIOCSIFPRIORITY                   = 0x8020699b
+	SIOCSIFRDOMAIN                    = 0x8020699f
+	SIOCSIFRTLABEL                    = 0x80206982
+	SIOCSIFXFLAGS                     = 0x8020699d
+	SIOCSLIFPHYADDR                   = 0x8218694a
+	SIOCSLIFPHYDF                     = 0x802069c1
+	SIOCSLIFPHYECN                    = 0x802069c7
+	SIOCSLIFPHYRTABLE                 = 0x802069a1
+	SIOCSLIFPHYTTL                    = 0x802069a8
+	SIOCSPGRP                         = 0x80047308
+	SIOCSPWE3CTRLWORD                 = 0x802069dc
+	SIOCSPWE3FAT                      = 0x802069dd
+	SIOCSPWE3NEIGHBOR                 = 0x821869de
+	SIOCSRXHPRIO                      = 0x802069db
+	SIOCSSPPPPARAMS                   = 0x80206993
+	SIOCSTXHPRIO                      = 0x802069c5
+	SIOCSUMBPARAM                     = 0x802069bf
+	SIOCSVH                           = 0xc02069f5
+	SIOCSVNETFLOWID                   = 0x802069c3
+	SIOCSVNETID                       = 0x802069a6
+	SOCK_CLOEXEC                      = 0x8000
+	SOCK_DGRAM                        = 0x2
+	SOCK_DNS                          = 0x1000
+	SOCK_NONBLOCK                     = 0x4000
+	SOCK_RAW                          = 0x3
+	SOCK_RDM                          = 0x4
+	SOCK_SEQPACKET                    = 0x5
+	SOCK_STREAM                       = 0x1
+	SOL_SOCKET                        = 0xffff
+	SOMAXCONN                         = 0x80
+	SO_ACCEPTCONN                     = 0x2
+	SO_BINDANY                        = 0x1000
+	SO_BROADCAST                      = 0x20
+	SO_DEBUG                          = 0x1
+	SO_DOMAIN                         = 0x1024
+	SO_DONTROUTE                      = 0x10
+	SO_ERROR                          = 0x1007
+	SO_KEEPALIVE                      = 0x8
+	SO_LINGER                         = 0x80
+	SO_NETPROC                        = 0x1020
+	SO_OOBINLINE                      = 0x100
+	SO_PEERCRED                       = 0x1022
+	SO_PROTOCOL                       = 0x1025
+	SO_RCVBUF                         = 0x1002
+	SO_RCVLOWAT                       = 0x1004
+	SO_RCVTIMEO                       = 0x1006
+	SO_REUSEADDR                      = 0x4
+	SO_REUSEPORT                      = 0x200
+	SO_RTABLE                         = 0x1021
+	SO_SNDBUF                         = 0x1001
+	SO_SNDLOWAT                       = 0x1003
+	SO_SNDTIMEO                       = 0x1005
+	SO_SPLICE                         = 0x1023
+	SO_TIMESTAMP                      = 0x800
+	SO_TYPE                           = 0x1008
+	SO_USELOOPBACK                    = 0x40
+	SO_ZEROIZE                        = 0x2000
+	S_BLKSIZE                         = 0x200
+	S_IEXEC                           = 0x40
+	S_IFBLK                           = 0x6000
+	S_IFCHR                           = 0x2000
+	S_IFDIR                           = 0x4000
+	S_IFIFO                           = 0x1000
+	S_IFLNK                           = 0xa000
+	S_IFMT                            = 0xf000
+	S_IFREG                           = 0x8000
+	S_IFSOCK                          = 0xc000
+	S_IREAD                           = 0x100
+	S_IRGRP                           = 0x20
+	S_IROTH                           = 0x4
+	S_IRUSR                           = 0x100
+	S_IRWXG                           = 0x38
+	S_IRWXO                           = 0x7
+	S_IRWXU                           = 0x1c0
+	S_ISGID                           = 0x400
+	S_ISTXT                           = 0x200
+	S_ISUID                           = 0x800
+	S_ISVTX                           = 0x200
+	S_IWGRP                           = 0x10
+	S_IWOTH                           = 0x2
+	S_IWRITE                          = 0x80
+	S_IWUSR                           = 0x80
+	S_IXGRP                           = 0x8
+	S_IXOTH                           = 0x1
+	S_IXUSR                           = 0x40
+	TCIFLUSH                          = 0x1
+	TCIOFF                            = 0x3
+	TCIOFLUSH                         = 0x3
+	TCION                             = 0x4
+	TCOFLUSH                          = 0x2
+	TCOOFF                            = 0x1
+	TCOON                             = 0x2
+	TCPOPT_EOL                        = 0x0
+	TCPOPT_MAXSEG                     = 0x2
+	TCPOPT_NOP                        = 0x1
+	TCPOPT_SACK                       = 0x5
+	TCPOPT_SACK_HDR                   = 0x1010500
+	TCPOPT_SACK_PERMITTED             = 0x4
+	TCPOPT_SACK_PERMIT_HDR            = 0x1010402
+	TCPOPT_SIGNATURE                  = 0x13
+	TCPOPT_TIMESTAMP                  = 0x8
+	TCPOPT_TSTAMP_HDR                 = 0x101080a
+	TCPOPT_WINDOW                     = 0x3
+	TCP_INFO                          = 0x9
+	TCP_MAXSEG                        = 0x2
+	TCP_MAXWIN                        = 0xffff
+	TCP_MAX_SACK                      = 0x3
+	TCP_MAX_WINSHIFT                  = 0xe
+	TCP_MD5SIG                        = 0x4
+	TCP_MSS                           = 0x200
+	TCP_NODELAY                       = 0x1
+	TCP_NOPUSH                        = 0x10
+	TCP_SACKHOLE_LIMIT                = 0x80
+	TCP_SACK_ENABLE                   = 0x8
+	TCSAFLUSH                         = 0x2
+	TIMER_ABSTIME                     = 0x1
+	TIMER_RELTIME                     = 0x0
+	TIOCCBRK                          = 0x2000747a
+	TIOCCDTR                          = 0x20007478
+	TIOCCHKVERAUTH                    = 0x2000741e
+	TIOCCLRVERAUTH                    = 0x2000741d
+	TIOCCONS                          = 0x80047462
+	TIOCDRAIN                         = 0x2000745e
+	TIOCEXCL                          = 0x2000740d
+	TIOCEXT                           = 0x80047460
+	TIOCFLAG_CLOCAL                   = 0x2
+	TIOCFLAG_CRTSCTS                  = 0x4
+	TIOCFLAG_MDMBUF                   = 0x8
+	TIOCFLAG_PPS                      = 0x10
+	TIOCFLAG_SOFTCAR                  = 0x1
+	TIOCFLUSH                         = 0x80047410
+	TIOCGETA                          = 0x402c7413
+	TIOCGETD                          = 0x4004741a
+	TIOCGFLAGS                        = 0x4004745d
+	TIOCGPGRP                         = 0x40047477
+	TIOCGSID                          = 0x40047463
+	TIOCGTSTAMP                       = 0x4010745b
+	TIOCGWINSZ                        = 0x40087468
+	TIOCMBIC                          = 0x8004746b
+	TIOCMBIS                          = 0x8004746c
+	TIOCMGET                          = 0x4004746a
+	TIOCMODG                          = 0x4004746a
+	TIOCMODS                          = 0x8004746d
+	TIOCMSET                          = 0x8004746d
+	TIOCM_CAR                         = 0x40
+	TIOCM_CD                          = 0x40
+	TIOCM_CTS                         = 0x20
+	TIOCM_DSR                         = 0x100
+	TIOCM_DTR                         = 0x2
+	TIOCM_LE                          = 0x1
+	TIOCM_RI                          = 0x80
+	TIOCM_RNG                         = 0x80
+	TIOCM_RTS                         = 0x4
+	TIOCM_SR                          = 0x10
+	TIOCM_ST                          = 0x8
+	TIOCNOTTY                         = 0x20007471
+	TIOCNXCL                          = 0x2000740e
+	TIOCOUTQ                          = 0x40047473
+	TIOCPKT                           = 0x80047470
+	TIOCPKT_DATA                      = 0x0
+	TIOCPKT_DOSTOP                    = 0x20
+	TIOCPKT_FLUSHREAD                 = 0x1
+	TIOCPKT_FLUSHWRITE                = 0x2
+	TIOCPKT_IOCTL                     = 0x40
+	TIOCPKT_NOSTOP                    = 0x10
+	TIOCPKT_START                     = 0x8
+	TIOCPKT_STOP                      = 0x4
+	TIOCREMOTE                        = 0x80047469
+	TIOCSBRK                          = 0x2000747b
+	TIOCSCTTY                         = 0x20007461
+	TIOCSDTR                          = 0x20007479
+	TIOCSETA                          = 0x802c7414
+	TIOCSETAF                         = 0x802c7416
+	TIOCSETAW                         = 0x802c7415
+	TIOCSETD                          = 0x8004741b
+	TIOCSETVERAUTH                    = 0x8004741c
+	TIOCSFLAGS                        = 0x8004745c
+	TIOCSIG                           = 0x8004745f
+	TIOCSPGRP                         = 0x80047476
+	TIOCSTART                         = 0x2000746e
+	TIOCSTAT                          = 0x20007465
+	TIOCSTOP                          = 0x2000746f
+	TIOCSTSTAMP                       = 0x8008745a
+	TIOCSWINSZ                        = 0x80087467
+	TIOCUCNTL                         = 0x80047466
+	TIOCUCNTL_CBRK                    = 0x7a
+	TIOCUCNTL_SBRK                    = 0x7b
+	TOSTOP                            = 0x400000
+	UTIME_NOW                         = -0x2
+	UTIME_OMIT                        = -0x1
+	VDISCARD                          = 0xf
+	VDSUSP                            = 0xb
+	VEOF                              = 0x0
+	VEOL                              = 0x1
+	VEOL2                             = 0x2
+	VERASE                            = 0x3
+	VINTR                             = 0x8
+	VKILL                             = 0x5
+	VLNEXT                            = 0xe
+	VMIN                              = 0x10
+	VM_ANONMIN                        = 0x7
+	VM_LOADAVG                        = 0x2
+	VM_MALLOC_CONF                    = 0xc
+	VM_MAXID                          = 0xd
+	VM_MAXSLP                         = 0xa
+	VM_METER                          = 0x1
+	VM_NKMEMPAGES                     = 0x6
+	VM_PSSTRINGS                      = 0x3
+	VM_SWAPENCRYPT                    = 0x5
+	VM_USPACE                         = 0xb
+	VM_UVMEXP                         = 0x4
+	VM_VNODEMIN                       = 0x9
+	VM_VTEXTMIN                       = 0x8
+	VQUIT                             = 0x9
+	VREPRINT                          = 0x6
+	VSTART                            = 0xc
+	VSTATUS                           = 0x12
+	VSTOP                             = 0xd
+	VSUSP                             = 0xa
+	VTIME                             = 0x11
+	VWERASE                           = 0x4
+	WALTSIG                           = 0x4
+	WCONTINUED                        = 0x8
+	WCOREFLAG                         = 0x80
+	WNOHANG                           = 0x1
+	WUNTRACED                         = 0x2
+	XCASE                             = 0x1000000
+)
+
+// Errors
+const (
+	E2BIG           = syscall.Errno(0x7)
+	EACCES          = syscall.Errno(0xd)
+	EADDRINUSE      = syscall.Errno(0x30)
+	EADDRNOTAVAIL   = syscall.Errno(0x31)
+	EAFNOSUPPORT    = syscall.Errno(0x2f)
+	EAGAIN          = syscall.Errno(0x23)
+	EALREADY        = syscall.Errno(0x25)
+	EAUTH           = syscall.Errno(0x50)
+	EBADF           = syscall.Errno(0x9)
+	EBADMSG         = syscall.Errno(0x5c)
+	EBADRPC         = syscall.Errno(0x48)
+	EBUSY           = syscall.Errno(0x10)
+	ECANCELED       = syscall.Errno(0x58)
+	ECHILD          = syscall.Errno(0xa)
+	ECONNABORTED    = syscall.Errno(0x35)
+	ECONNREFUSED    = syscall.Errno(0x3d)
+	ECONNRESET      = syscall.Errno(0x36)
+	EDEADLK         = syscall.Errno(0xb)
+	EDESTADDRREQ    = syscall.Errno(0x27)
+	EDOM            = syscall.Errno(0x21)
+	EDQUOT          = syscall.Errno(0x45)
+	EEXIST          = syscall.Errno(0x11)
+	EFAULT          = syscall.Errno(0xe)
+	EFBIG           = syscall.Errno(0x1b)
+	EFTYPE          = syscall.Errno(0x4f)
+	EHOSTDOWN       = syscall.Errno(0x40)
+	EHOSTUNREACH    = syscall.Errno(0x41)
+	EIDRM           = syscall.Errno(0x59)
+	EILSEQ          = syscall.Errno(0x54)
+	EINPROGRESS     = syscall.Errno(0x24)
+	EINTR           = syscall.Errno(0x4)
+	EINVAL          = syscall.Errno(0x16)
+	EIO             = syscall.Errno(0x5)
+	EIPSEC          = syscall.Errno(0x52)
+	EISCONN         = syscall.Errno(0x38)
+	EISDIR          = syscall.Errno(0x15)
+	ELAST           = syscall.Errno(0x5f)
+	ELOOP           = syscall.Errno(0x3e)
+	EMEDIUMTYPE     = syscall.Errno(0x56)
+	EMFILE          = syscall.Errno(0x18)
+	EMLINK          = syscall.Errno(0x1f)
+	EMSGSIZE        = syscall.Errno(0x28)
+	ENAMETOOLONG    = syscall.Errno(0x3f)
+	ENEEDAUTH       = syscall.Errno(0x51)
+	ENETDOWN        = syscall.Errno(0x32)
+	ENETRESET       = syscall.Errno(0x34)
+	ENETUNREACH     = syscall.Errno(0x33)
+	ENFILE          = syscall.Errno(0x17)
+	ENOATTR         = syscall.Errno(0x53)
+	ENOBUFS         = syscall.Errno(0x37)
+	ENODEV          = syscall.Errno(0x13)
+	ENOENT          = syscall.Errno(0x2)
+	ENOEXEC         = syscall.Errno(0x8)
+	ENOLCK          = syscall.Errno(0x4d)
+	ENOMEDIUM       = syscall.Errno(0x55)
+	ENOMEM          = syscall.Errno(0xc)
+	ENOMSG          = syscall.Errno(0x5a)
+	ENOPROTOOPT     = syscall.Errno(0x2a)
+	ENOSPC          = syscall.Errno(0x1c)
+	ENOSYS          = syscall.Errno(0x4e)
+	ENOTBLK         = syscall.Errno(0xf)
+	ENOTCONN        = syscall.Errno(0x39)
+	ENOTDIR         = syscall.Errno(0x14)
+	ENOTEMPTY       = syscall.Errno(0x42)
+	ENOTRECOVERABLE = syscall.Errno(0x5d)
+	ENOTSOCK        = syscall.Errno(0x26)
+	ENOTSUP         = syscall.Errno(0x5b)
+	ENOTTY          = syscall.Errno(0x19)
+	ENXIO           = syscall.Errno(0x6)
+	EOPNOTSUPP      = syscall.Errno(0x2d)
+	EOVERFLOW       = syscall.Errno(0x57)
+	EOWNERDEAD      = syscall.Errno(0x5e)
+	EPERM           = syscall.Errno(0x1)
+	EPFNOSUPPORT    = syscall.Errno(0x2e)
+	EPIPE           = syscall.Errno(0x20)
+	EPROCLIM        = syscall.Errno(0x43)
+	EPROCUNAVAIL    = syscall.Errno(0x4c)
+	EPROGMISMATCH   = syscall.Errno(0x4b)
+	EPROGUNAVAIL    = syscall.Errno(0x4a)
+	EPROTO          = syscall.Errno(0x5f)
+	EPROTONOSUPPORT = syscall.Errno(0x2b)
+	EPROTOTYPE      = syscall.Errno(0x29)
+	ERANGE          = syscall.Errno(0x22)
+	EREMOTE         = syscall.Errno(0x47)
+	EROFS           = syscall.Errno(0x1e)
+	ERPCMISMATCH    = syscall.Errno(0x49)
+	ESHUTDOWN       = syscall.Errno(0x3a)
+	ESOCKTNOSUPPORT = syscall.Errno(0x2c)
+	ESPIPE          = syscall.Errno(0x1d)
+	ESRCH           = syscall.Errno(0x3)
+	ESTALE          = syscall.Errno(0x46)
+	ETIMEDOUT       = syscall.Errno(0x3c)
+	ETOOMANYREFS    = syscall.Errno(0x3b)
+	ETXTBSY         = syscall.Errno(0x1a)
+	EUSERS          = syscall.Errno(0x44)
+	EWOULDBLOCK     = syscall.Errno(0x23)
+	EXDEV           = syscall.Errno(0x12)
+)
+
+// Signals
+const (
+	SIGABRT   = syscall.Signal(0x6)
+	SIGALRM   = syscall.Signal(0xe)
+	SIGBUS    = syscall.Signal(0xa)
+	SIGCHLD   = syscall.Signal(0x14)
+	SIGCONT   = syscall.Signal(0x13)
+	SIGEMT    = syscall.Signal(0x7)
+	SIGFPE    = syscall.Signal(0x8)
+	SIGHUP    = syscall.Signal(0x1)
+	SIGILL    = syscall.Signal(0x4)
+	SIGINFO   = syscall.Signal(0x1d)
+	SIGINT    = syscall.Signal(0x2)
+	SIGIO     = syscall.Signal(0x17)
+	SIGIOT    = syscall.Signal(0x6)
+	SIGKILL   = syscall.Signal(0x9)
+	SIGPIPE   = syscall.Signal(0xd)
+	SIGPROF   = syscall.Signal(0x1b)
+	SIGQUIT   = syscall.Signal(0x3)
+	SIGSEGV   = syscall.Signal(0xb)
+	SIGSTOP   = syscall.Signal(0x11)
+	SIGSYS    = syscall.Signal(0xc)
+	SIGTERM   = syscall.Signal(0xf)
+	SIGTHR    = syscall.Signal(0x20)
+	SIGTRAP   = syscall.Signal(0x5)
+	SIGTSTP   = syscall.Signal(0x12)
+	SIGTTIN   = syscall.Signal(0x15)
+	SIGTTOU   = syscall.Signal(0x16)
+	SIGURG    = syscall.Signal(0x10)
+	SIGUSR1   = syscall.Signal(0x1e)
+	SIGUSR2   = syscall.Signal(0x1f)
+	SIGVTALRM = syscall.Signal(0x1a)
+	SIGWINCH  = syscall.Signal(0x1c)
+	SIGXCPU   = syscall.Signal(0x18)
+	SIGXFSZ   = syscall.Signal(0x19)
+)
+
+// Error table
+var errorList = [...]struct {
+	num  syscall.Errno
+	name string
+	desc string
+}{
+	{1, "EPERM", "operation not permitted"},
+	{2, "ENOENT", "no such file or directory"},
+	{3, "ESRCH", "no such process"},
+	{4, "EINTR", "interrupted system call"},
+	{5, "EIO", "input/output error"},
+	{6, "ENXIO", "device not configured"},
+	{7, "E2BIG", "argument list too long"},
+	{8, "ENOEXEC", "exec format error"},
+	{9, "EBADF", "bad file descriptor"},
+	{10, "ECHILD", "no child processes"},
+	{11, "EDEADLK", "resource deadlock avoided"},
+	{12, "ENOMEM", "cannot allocate memory"},
+	{13, "EACCES", "permission denied"},
+	{14, "EFAULT", "bad address"},
+	{15, "ENOTBLK", "block device required"},
+	{16, "EBUSY", "device busy"},
+	{17, "EEXIST", "file exists"},
+	{18, "EXDEV", "cross-device link"},
+	{19, "ENODEV", "operation not supported by device"},
+	{20, "ENOTDIR", "not a directory"},
+	{21, "EISDIR", "is a directory"},
+	{22, "EINVAL", "invalid argument"},
+	{23, "ENFILE", "too many open files in system"},
+	{24, "EMFILE", "too many open files"},
+	{25, "ENOTTY", "inappropriate ioctl for device"},
+	{26, "ETXTBSY", "text file busy"},
+	{27, "EFBIG", "file too large"},
+	{28, "ENOSPC", "no space left on device"},
+	{29, "ESPIPE", "illegal seek"},
+	{30, "EROFS", "read-only file system"},
+	{31, "EMLINK", "too many links"},
+	{32, "EPIPE", "broken pipe"},
+	{33, "EDOM", "numerical argument out of domain"},
+	{34, "ERANGE", "result too large"},
+	{35, "EAGAIN", "resource temporarily unavailable"},
+	{36, "EINPROGRESS", "operation now in progress"},
+	{37, "EALREADY", "operation already in progress"},
+	{38, "ENOTSOCK", "socket operation on non-socket"},
+	{39, "EDESTADDRREQ", "destination address required"},
+	{40, "EMSGSIZE", "message too long"},
+	{41, "EPROTOTYPE", "protocol wrong type for socket"},
+	{42, "ENOPROTOOPT", "protocol not available"},
+	{43, "EPROTONOSUPPORT", "protocol not supported"},
+	{44, "ESOCKTNOSUPPORT", "socket type not supported"},
+	{45, "EOPNOTSUPP", "operation not supported"},
+	{46, "EPFNOSUPPORT", "protocol family not supported"},
+	{47, "EAFNOSUPPORT", "address family not supported by protocol family"},
+	{48, "EADDRINUSE", "address already in use"},
+	{49, "EADDRNOTAVAIL", "can't assign requested address"},
+	{50, "ENETDOWN", "network is down"},
+	{51, "ENETUNREACH", "network is unreachable"},
+	{52, "ENETRESET", "network dropped connection on reset"},
+	{53, "ECONNABORTED", "software caused connection abort"},
+	{54, "ECONNRESET", "connection reset by peer"},
+	{55, "ENOBUFS", "no buffer space available"},
+	{56, "EISCONN", "socket is already connected"},
+	{57, "ENOTCONN", "socket is not connected"},
+	{58, "ESHUTDOWN", "can't send after socket shutdown"},
+	{59, "ETOOMANYREFS", "too many references: can't splice"},
+	{60, "ETIMEDOUT", "operation timed out"},
+	{61, "ECONNREFUSED", "connection refused"},
+	{62, "ELOOP", "too many levels of symbolic links"},
+	{63, "ENAMETOOLONG", "file name too long"},
+	{64, "EHOSTDOWN", "host is down"},
+	{65, "EHOSTUNREACH", "no route to host"},
+	{66, "ENOTEMPTY", "directory not empty"},
+	{67, "EPROCLIM", "too many processes"},
+	{68, "EUSERS", "too many users"},
+	{69, "EDQUOT", "disk quota exceeded"},
+	{70, "ESTALE", "stale NFS file handle"},
+	{71, "EREMOTE", "too many levels of remote in path"},
+	{72, "EBADRPC", "RPC struct is bad"},
+	{73, "ERPCMISMATCH", "RPC version wrong"},
+	{74, "EPROGUNAVAIL", "RPC program not available"},
+	{75, "EPROGMISMATCH", "program version wrong"},
+	{76, "EPROCUNAVAIL", "bad procedure for program"},
+	{77, "ENOLCK", "no locks available"},
+	{78, "ENOSYS", "function not implemented"},
+	{79, "EFTYPE", "inappropriate file type or format"},
+	{80, "EAUTH", "authentication error"},
+	{81, "ENEEDAUTH", "need authenticator"},
+	{82, "EIPSEC", "IPsec processing failure"},
+	{83, "ENOATTR", "attribute not found"},
+	{84, "EILSEQ", "illegal byte sequence"},
+	{85, "ENOMEDIUM", "no medium found"},
+	{86, "EMEDIUMTYPE", "wrong medium type"},
+	{87, "EOVERFLOW", "value too large to be stored in data type"},
+	{88, "ECANCELED", "operation canceled"},
+	{89, "EIDRM", "identifier removed"},
+	{90, "ENOMSG", "no message of desired type"},
+	{91, "ENOTSUP", "not supported"},
+	{92, "EBADMSG", "bad message"},
+	{93, "ENOTRECOVERABLE", "state not recoverable"},
+	{94, "EOWNERDEAD", "previous owner died"},
+	{95, "ELAST", "protocol error"},
+}
+
+// Signal table
+var signalList = [...]struct {
+	num  syscall.Signal
+	name string
+	desc string
+}{
+	{1, "SIGHUP", "hangup"},
+	{2, "SIGINT", "interrupt"},
+	{3, "SIGQUIT", "quit"},
+	{4, "SIGILL", "illegal instruction"},
+	{5, "SIGTRAP", "trace/BPT trap"},
+	{6, "SIGABRT", "abort trap"},
+	{7, "SIGEMT", "EMT trap"},
+	{8, "SIGFPE", "floating point exception"},
+	{9, "SIGKILL", "killed"},
+	{10, "SIGBUS", "bus error"},
+	{11, "SIGSEGV", "segmentation fault"},
+	{12, "SIGSYS", "bad system call"},
+	{13, "SIGPIPE", "broken pipe"},
+	{14, "SIGALRM", "alarm clock"},
+	{15, "SIGTERM", "terminated"},
+	{16, "SIGURG", "urgent I/O condition"},
+	{17, "SIGSTOP", "suspended (signal)"},
+	{18, "SIGTSTP", "suspended"},
+	{19, "SIGCONT", "continued"},
+	{20, "SIGCHLD", "child exited"},
+	{21, "SIGTTIN", "stopped (tty input)"},
+	{22, "SIGTTOU", "stopped (tty output)"},
+	{23, "SIGIO", "I/O possible"},
+	{24, "SIGXCPU", "cputime limit exceeded"},
+	{25, "SIGXFSZ", "filesize limit exceeded"},
+	{26, "SIGVTALRM", "virtual timer expired"},
+	{27, "SIGPROF", "profiling timer expired"},
+	{28, "SIGWINCH", "window size changes"},
+	{29, "SIGINFO", "information request"},
+	{30, "SIGUSR1", "user defined signal 1"},
+	{31, "SIGUSR2", "user defined signal 2"},
+	{32, "SIGTHR", "thread AST"},
+}
diff --git a/vendor/golang.org/x/sys/unix/zptrace_armnn_linux.go b/vendor/golang.org/x/sys/unix/zptrace_armnn_linux.go
index bd001a6e1c..97f20ca282 100644
--- a/vendor/golang.org/x/sys/unix/zptrace_armnn_linux.go
+++ b/vendor/golang.org/x/sys/unix/zptrace_armnn_linux.go
@@ -15,12 +15,12 @@ type PtraceRegsArm struct {
 
 // PtraceGetRegsArm fetches the registers used by arm binaries.
 func PtraceGetRegsArm(pid int, regsout *PtraceRegsArm) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsArm sets the registers used by arm binaries.
 func PtraceSetRegsArm(pid int, regs *PtraceRegsArm) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
 
 // PtraceRegsArm64 is the registers used by arm64 binaries.
@@ -33,10 +33,10 @@ type PtraceRegsArm64 struct {
 
 // PtraceGetRegsArm64 fetches the registers used by arm64 binaries.
 func PtraceGetRegsArm64(pid int, regsout *PtraceRegsArm64) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsArm64 sets the registers used by arm64 binaries.
 func PtraceSetRegsArm64(pid int, regs *PtraceRegsArm64) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
diff --git a/vendor/golang.org/x/sys/unix/zptrace_linux_arm64.go b/vendor/golang.org/x/sys/unix/zptrace_linux_arm64.go
index 6cb6d688aa..834d2856dd 100644
--- a/vendor/golang.org/x/sys/unix/zptrace_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zptrace_linux_arm64.go
@@ -7,11 +7,11 @@ import "unsafe"
 // PtraceGetRegSetArm64 fetches the registers used by arm64 binaries.
 func PtraceGetRegSetArm64(pid, addr int, regsout *PtraceRegsArm64) error {
 	iovec := Iovec{(*byte)(unsafe.Pointer(regsout)), uint64(unsafe.Sizeof(*regsout))}
-	return ptrace(PTRACE_GETREGSET, pid, uintptr(addr), uintptr(unsafe.Pointer(&iovec)))
+	return ptracePtr(PTRACE_GETREGSET, pid, uintptr(addr), unsafe.Pointer(&iovec))
 }
 
 // PtraceSetRegSetArm64 sets the registers used by arm64 binaries.
 func PtraceSetRegSetArm64(pid, addr int, regs *PtraceRegsArm64) error {
 	iovec := Iovec{(*byte)(unsafe.Pointer(regs)), uint64(unsafe.Sizeof(*regs))}
-	return ptrace(PTRACE_SETREGSET, pid, uintptr(addr), uintptr(unsafe.Pointer(&iovec)))
+	return ptracePtr(PTRACE_SETREGSET, pid, uintptr(addr), unsafe.Pointer(&iovec))
 }
diff --git a/vendor/golang.org/x/sys/unix/zptrace_mipsnn_linux.go b/vendor/golang.org/x/sys/unix/zptrace_mipsnn_linux.go
index c34d0639be..0b5f794305 100644
--- a/vendor/golang.org/x/sys/unix/zptrace_mipsnn_linux.go
+++ b/vendor/golang.org/x/sys/unix/zptrace_mipsnn_linux.go
@@ -21,12 +21,12 @@ type PtraceRegsMips struct {
 
 // PtraceGetRegsMips fetches the registers used by mips binaries.
 func PtraceGetRegsMips(pid int, regsout *PtraceRegsMips) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsMips sets the registers used by mips binaries.
 func PtraceSetRegsMips(pid int, regs *PtraceRegsMips) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
 
 // PtraceRegsMips64 is the registers used by mips64 binaries.
@@ -42,10 +42,10 @@ type PtraceRegsMips64 struct {
 
 // PtraceGetRegsMips64 fetches the registers used by mips64 binaries.
 func PtraceGetRegsMips64(pid int, regsout *PtraceRegsMips64) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsMips64 sets the registers used by mips64 binaries.
 func PtraceSetRegsMips64(pid int, regs *PtraceRegsMips64) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
diff --git a/vendor/golang.org/x/sys/unix/zptrace_mipsnnle_linux.go b/vendor/golang.org/x/sys/unix/zptrace_mipsnnle_linux.go
index 3ccf0c0c4a..2807f7e646 100644
--- a/vendor/golang.org/x/sys/unix/zptrace_mipsnnle_linux.go
+++ b/vendor/golang.org/x/sys/unix/zptrace_mipsnnle_linux.go
@@ -21,12 +21,12 @@ type PtraceRegsMipsle struct {
 
 // PtraceGetRegsMipsle fetches the registers used by mipsle binaries.
 func PtraceGetRegsMipsle(pid int, regsout *PtraceRegsMipsle) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsMipsle sets the registers used by mipsle binaries.
 func PtraceSetRegsMipsle(pid int, regs *PtraceRegsMipsle) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
 
 // PtraceRegsMips64le is the registers used by mips64le binaries.
@@ -42,10 +42,10 @@ type PtraceRegsMips64le struct {
 
 // PtraceGetRegsMips64le fetches the registers used by mips64le binaries.
 func PtraceGetRegsMips64le(pid int, regsout *PtraceRegsMips64le) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsMips64le sets the registers used by mips64le binaries.
 func PtraceSetRegsMips64le(pid int, regs *PtraceRegsMips64le) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
diff --git a/vendor/golang.org/x/sys/unix/zptrace_x86_linux.go b/vendor/golang.org/x/sys/unix/zptrace_x86_linux.go
index 7d65857004..281ea64e34 100644
--- a/vendor/golang.org/x/sys/unix/zptrace_x86_linux.go
+++ b/vendor/golang.org/x/sys/unix/zptrace_x86_linux.go
@@ -31,12 +31,12 @@ type PtraceRegs386 struct {
 
 // PtraceGetRegs386 fetches the registers used by 386 binaries.
 func PtraceGetRegs386(pid int, regsout *PtraceRegs386) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegs386 sets the registers used by 386 binaries.
 func PtraceSetRegs386(pid int, regs *PtraceRegs386) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
 
 // PtraceRegsAmd64 is the registers used by amd64 binaries.
@@ -72,10 +72,10 @@ type PtraceRegsAmd64 struct {
 
 // PtraceGetRegsAmd64 fetches the registers used by amd64 binaries.
 func PtraceGetRegsAmd64(pid int, regsout *PtraceRegsAmd64) error {
-	return ptrace(PTRACE_GETREGS, pid, 0, uintptr(unsafe.Pointer(regsout)))
+	return ptracePtr(PTRACE_GETREGS, pid, 0, unsafe.Pointer(regsout))
 }
 
 // PtraceSetRegsAmd64 sets the registers used by amd64 binaries.
 func PtraceSetRegsAmd64(pid int, regs *PtraceRegsAmd64) error {
-	return ptrace(PTRACE_SETREGS, pid, 0, uintptr(unsafe.Pointer(regs)))
+	return ptracePtr(PTRACE_SETREGS, pid, 0, unsafe.Pointer(regs))
 }
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
index 85e0cc3866..9a257219d7 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
@@ -124,7 +124,6 @@ int utime(uintptr_t, uintptr_t);
 unsigned long long getsystemcfg(int);
 int umount(uintptr_t);
 int getrlimit64(int, uintptr_t);
-int setrlimit64(int, uintptr_t);
 long long lseek64(int, long long, int);
 uintptr_t mmap(uintptr_t, uintptr_t, int, int, int, long long);
 
@@ -213,7 +212,7 @@ func wait4(pid Pid_t, status *_C_int, options int, rusage *Rusage) (wpid Pid_t,
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func ioctl(fd int, req uint, arg uintptr) (err error) {
+func ioctl(fd int, req int, arg uintptr) (err error) {
 	r0, er := C.ioctl(C.int(fd), C.int(req), C.uintptr_t(arg))
 	if r0 == -1 && er != nil {
 		err = er
@@ -223,6 +222,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
+	r0, er := C.ioctl(C.int(fd), C.int(req), C.uintptr_t(uintptr(arg)))
+	if r0 == -1 && er != nil {
+		err = er
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func FcntlInt(fd uintptr, cmd int, arg int) (r int, err error) {
 	r0, er := C.fcntl(C.uintptr_t(fd), C.int(cmd), C.uintptr_t(arg))
 	r = int(r0)
@@ -975,7 +984,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 *byte
 	if len(p) > 0 {
 		_p0 = &p[0]
@@ -992,7 +1001,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 *byte
 	if len(p) > 0 {
 		_p0 = &p[0]
@@ -1454,16 +1463,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	r0, er := C.setrlimit64(C.int(resource), C.uintptr_t(uintptr(unsafe.Pointer(rlim))))
-	if r0 == -1 && er != nil {
-		err = er
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Seek(fd int, offset int64, whence int) (off int64, err error) {
 	r0, er := C.lseek64(C.int(fd), C.longlong(offset), C.int(whence))
 	off = int64(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
index f1d4a73b08..6de80c20cf 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
@@ -93,8 +93,18 @@ func wait4(pid Pid_t, status *_C_int, options int, rusage *Rusage) (wpid Pid_t,
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, e1 := callioctl(fd, int(req), arg)
+func ioctl(fd int, req int, arg uintptr) (err error) {
+	_, e1 := callioctl(fd, req, arg)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
+	_, e1 := callioctl_ptr(fd, req, arg)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -931,7 +941,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 *byte
 	if len(p) > 0 {
 		_p0 = &p[0]
@@ -946,7 +956,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 *byte
 	if len(p) > 0 {
 		_p0 = &p[0]
@@ -1412,16 +1422,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, e1 := callsetrlimit(resource, uintptr(unsafe.Pointer(rlim)))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Seek(fd int, offset int64, whence int) (off int64, err error) {
 	r0, e1 := calllseek(fd, offset, whence)
 	off = int64(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gc.go b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gc.go
index 2caa5adf95..c4d50ae500 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gc.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gc.go
@@ -124,7 +124,6 @@ import (
 //go:cgo_import_dynamic libc_getsystemcfg getsystemcfg "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_umount umount "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_getrlimit getrlimit "libc.a/shr_64.o"
-//go:cgo_import_dynamic libc_setrlimit setrlimit "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_lseek lseek "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_mmap64 mmap64 "libc.a/shr_64.o"
 
@@ -242,7 +241,6 @@ import (
 //go:linkname libc_getsystemcfg libc_getsystemcfg
 //go:linkname libc_umount libc_umount
 //go:linkname libc_getrlimit libc_getrlimit
-//go:linkname libc_setrlimit libc_setrlimit
 //go:linkname libc_lseek libc_lseek
 //go:linkname libc_mmap64 libc_mmap64
 
@@ -363,7 +361,6 @@ var (
 	libc_getsystemcfg,
 	libc_umount,
 	libc_getrlimit,
-	libc_setrlimit,
 	libc_lseek,
 	libc_mmap64 syscallFunc
 )
@@ -423,6 +420,13 @@ func callioctl(fd int, req int, arg uintptr) (r1 uintptr, e1 Errno) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func callioctl_ptr(fd int, req int, arg unsafe.Pointer) (r1 uintptr, e1 Errno) {
+	r1, _, e1 = syscall6(uintptr(unsafe.Pointer(&libc_ioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func callfcntl(fd uintptr, cmd int, arg uintptr) (r1 uintptr, e1 Errno) {
 	r1, _, e1 = syscall6(uintptr(unsafe.Pointer(&libc_fcntl)), 3, fd, uintptr(cmd), arg, 0, 0, 0)
 	return
@@ -1172,13 +1176,6 @@ func callgetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func callsetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {
-	r1, _, e1 = rawSyscall6(uintptr(unsafe.Pointer(&libc_setrlimit)), 2, uintptr(resource), rlim, 0, 0, 0, 0)
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func calllseek(fd int, offset int64, whence int) (r1 uintptr, e1 Errno) {
 	r1, _, e1 = syscall6(uintptr(unsafe.Pointer(&libc_lseek)), 3, uintptr(fd), uintptr(offset), uintptr(whence), 0, 0, 0)
 	return
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gccgo.go b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gccgo.go
index 944a714b1a..6903d3b09e 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gccgo.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64_gccgo.go
@@ -123,7 +123,6 @@ int utime(uintptr_t, uintptr_t);
 unsigned long long getsystemcfg(int);
 int umount(uintptr_t);
 int getrlimit(int, uintptr_t);
-int setrlimit(int, uintptr_t);
 long long lseek(int, long long, int);
 uintptr_t mmap64(uintptr_t, uintptr_t, int, int, int, long long);
 
@@ -131,6 +130,7 @@ uintptr_t mmap64(uintptr_t, uintptr_t, int, int, int, long long);
 import "C"
 import (
 	"syscall"
+	"unsafe"
 )
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
@@ -191,6 +191,14 @@ func callioctl(fd int, req int, arg uintptr) (r1 uintptr, e1 Errno) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func callioctl_ptr(fd int, req int, arg unsafe.Pointer) (r1 uintptr, e1 Errno) {
+	r1 = uintptr(C.ioctl(C.int(fd), C.int(req), C.uintptr_t(uintptr(arg))))
+	e1 = syscall.GetErrno()
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func callfcntl(fd uintptr, cmd int, arg uintptr) (r1 uintptr, e1 Errno) {
 	r1 = uintptr(C.fcntl(C.uintptr_t(fd), C.int(cmd), C.uintptr_t(arg)))
 	e1 = syscall.GetErrno()
@@ -1047,14 +1055,6 @@ func callgetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func callsetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {
-	r1 = uintptr(C.setrlimit(C.int(resource), C.uintptr_t(rlim)))
-	e1 = syscall.GetErrno()
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func calllseek(fd int, offset int64, whence int) (r1 uintptr, e1 Errno) {
 	r1 = uintptr(C.lseek(C.int(fd), C.longlong(offset), C.int(whence)))
 	e1 = syscall.GetErrno()
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.1_13.go b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.1_13.go
deleted file mode 100644
index a06eb09324..0000000000
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.1_13.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// go run mksyscall.go -tags darwin,amd64,go1.13 syscall_darwin.1_13.go
-// Code generated by the command above; see README.md. DO NOT EDIT.
-
-//go:build darwin && amd64 && go1.13
-// +build darwin,amd64,go1.13
-
-package unix
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-var _ syscall.Errno
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func closedir(dir uintptr) (err error) {
-	_, _, e1 := syscall_syscall(libc_closedir_trampoline_addr, uintptr(dir), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_closedir_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_closedir closedir "/usr/lib/libSystem.B.dylib"
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func readdir_r(dir uintptr, entry *Dirent, result **Dirent) (res Errno) {
-	r0, _, _ := syscall_syscall(libc_readdir_r_trampoline_addr, uintptr(dir), uintptr(unsafe.Pointer(entry)), uintptr(unsafe.Pointer(result)))
-	res = Errno(r0)
-	return
-}
-
-var libc_readdir_r_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_readdir_r readdir_r "/usr/lib/libSystem.B.dylib"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.1_13.s b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.1_13.s
deleted file mode 100644
index d6c3e25c01..0000000000
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.1_13.s
+++ /dev/null
@@ -1,25 +0,0 @@
-// go run mkasm_darwin.go amd64
-// Code generated by the command above; DO NOT EDIT.
-
-//go:build go1.13
-// +build go1.13
-
-#include "textflag.h"
-
-TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_fdopendir(SB)
-
-GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
-DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
-
-TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_closedir(SB)
-
-GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
-DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
-
-TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_readdir_r(SB)
-
-GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
-DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
index 0ae0ed4cb8..4037ccf7a9 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
@@ -1,8 +1,8 @@
-// go run mksyscall.go -tags darwin,amd64,go1.12 syscall_bsd.go syscall_darwin.go syscall_darwin_amd64.go
+// go run mksyscall.go -tags darwin,amd64 syscall_bsd.go syscall_darwin.go syscall_darwin_amd64.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
-//go:build darwin && amd64 && go1.12
-// +build darwin,amd64,go1.12
+//go:build darwin && amd64
+// +build darwin,amd64
 
 package unix
 
@@ -463,6 +463,32 @@ var libc_munlockall_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func closedir(dir uintptr) (err error) {
+	_, _, e1 := syscall_syscall(libc_closedir_trampoline_addr, uintptr(dir), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_closedir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_closedir closedir "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func readdir_r(dir uintptr, entry *Dirent, result **Dirent) (res Errno) {
+	r0, _, _ := syscall_syscall(libc_readdir_r_trampoline_addr, uintptr(dir), uintptr(unsafe.Pointer(entry)), uintptr(unsafe.Pointer(result)))
+	res = Errno(r0)
+	return
+}
+
+var libc_readdir_r_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readdir_r readdir_r "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func pipe(p *[2]int32) (err error) {
 	_, _, e1 := syscall_rawSyscall(libc_pipe_trampoline_addr, uintptr(unsafe.Pointer(p)), 0, 0)
 	if e1 != 0 {
@@ -643,17 +669,22 @@ var libc_flistxattr_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setattrlist(path *byte, list unsafe.Pointer, buf unsafe.Pointer, size uintptr, options int) (err error) {
-	_, _, e1 := syscall_syscall6(libc_setattrlist_trampoline_addr, uintptr(unsafe.Pointer(path)), uintptr(list), uintptr(buf), uintptr(size), uintptr(options), 0)
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-var libc_setattrlist_trampoline_addr uintptr
+var libc_utimensat_trampoline_addr uintptr
 
-//go:cgo_import_dynamic libc_setattrlist setattrlist "/usr/lib/libSystem.B.dylib"
+//go:cgo_import_dynamic libc_utimensat utimensat "/usr/lib/libSystem.B.dylib"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
@@ -694,6 +725,14 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 var libc_ioctl_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
@@ -1638,6 +1677,30 @@ var libc_mknod_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Mount(fsType string, dir string, flags int, data unsafe.Pointer) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(fsType)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(dir)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_mount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(flags), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mount mount "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Open(path string, mode int, perm uint32) (fd int, err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1698,7 +1761,7 @@ var libc_pathconf_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1719,7 +1782,7 @@ var libc_pread_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1929,6 +1992,31 @@ var libc_select_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Setattrlist(path string, attrlist *Attrlist, attrBuf []byte, options int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(attrBuf) > 0 {
+		_p1 = unsafe.Pointer(&attrBuf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_setattrlist_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(attrlist)), uintptr(_p1), uintptr(len(attrBuf)), uintptr(options), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setattrlist_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setattrlist setattrlist "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Setegid(egid int) (err error) {
 	_, _, e1 := syscall_syscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
@@ -2060,20 +2148,6 @@ var libc_setreuid_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := syscall_rawSyscall(libc_setrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_setrlimit_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_setrlimit setrlimit "/usr/lib/libSystem.B.dylib"
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
@@ -2447,6 +2521,14 @@ func ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return
 }
 
+func ptrace1Ptr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall6(libc_ptrace_trampoline_addr, uintptr(request), uintptr(pid), addr, uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 var libc_ptrace_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ptrace ptrace "/usr/lib/libSystem.B.dylib"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
index eac6ca806f..4baaed0bc1 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
@@ -1,11 +1,14 @@
-// go run mkasm_darwin.go amd64
+// go run mkasm.go darwin amd64
 // Code generated by the command above; DO NOT EDIT.
 
-//go:build go1.12
-// +build go1.12
-
 #include "textflag.h"
 
+TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fdopendir(SB)
+
+GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
+
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
 
@@ -174,6 +177,18 @@ TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
+TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_closedir(SB)
+
+GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
+
+TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readdir_r(SB)
+
+GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
+
 TEXT libc_pipe_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe(SB)
 
@@ -228,11 +243,11 @@ TEXT libc_flistxattr_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_flistxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flistxattr_trampoline_addr(SB)/8, $libc_flistxattr_trampoline<>(SB)
 
-TEXT libc_setattrlist_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_setattrlist(SB)
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
 
-GLOBL	·libc_setattrlist_trampoline_addr(SB), RODATA, $8
-DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
 
 TEXT libc_fcntl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fcntl(SB)
@@ -600,6 +615,12 @@ TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
+TEXT libc_mount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mount(SB)
+
+GLOBL	·libc_mount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mount_trampoline_addr(SB)/8, $libc_mount_trampoline<>(SB)
+
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
 
@@ -684,6 +705,11 @@ TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
+TEXT libc_setattrlist_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setattrlist(SB)
+GLOBL	·libc_setattrlist_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB)
+
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
 
@@ -738,12 +764,6 @@ TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
-TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_setrlimit(SB)
-
-GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
-DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
-
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
 
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.go b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.go
deleted file mode 100644
index cec595d553..0000000000
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// go run mksyscall.go -tags darwin,arm64,go1.13 syscall_darwin.1_13.go
-// Code generated by the command above; see README.md. DO NOT EDIT.
-
-//go:build darwin && arm64 && go1.13
-// +build darwin,arm64,go1.13
-
-package unix
-
-import (
-	"syscall"
-	"unsafe"
-)
-
-var _ syscall.Errno
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func closedir(dir uintptr) (err error) {
-	_, _, e1 := syscall_syscall(libc_closedir_trampoline_addr, uintptr(dir), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_closedir_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_closedir closedir "/usr/lib/libSystem.B.dylib"
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func readdir_r(dir uintptr, entry *Dirent, result **Dirent) (res Errno) {
-	r0, _, _ := syscall_syscall(libc_readdir_r_trampoline_addr, uintptr(dir), uintptr(unsafe.Pointer(entry)), uintptr(unsafe.Pointer(result)))
-	res = Errno(r0)
-	return
-}
-
-var libc_readdir_r_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_readdir_r readdir_r "/usr/lib/libSystem.B.dylib"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.s b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.s
deleted file mode 100644
index 357989722c..0000000000
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.s
+++ /dev/null
@@ -1,25 +0,0 @@
-// go run mkasm_darwin.go arm64
-// Code generated by the command above; DO NOT EDIT.
-
-//go:build go1.13
-// +build go1.13
-
-#include "textflag.h"
-
-TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_fdopendir(SB)
-
-GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
-DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
-
-TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_closedir(SB)
-
-GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
-DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
-
-TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_readdir_r(SB)
-
-GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
-DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
index cf71be3edb..51d6f3fb25 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
@@ -1,8 +1,8 @@
-// go run mksyscall.go -tags darwin,arm64,go1.12 syscall_bsd.go syscall_darwin.go syscall_darwin_arm64.go
+// go run mksyscall.go -tags darwin,arm64 syscall_bsd.go syscall_darwin.go syscall_darwin_arm64.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
-//go:build darwin && arm64 && go1.12
-// +build darwin,arm64,go1.12
+//go:build darwin && arm64
+// +build darwin,arm64
 
 package unix
 
@@ -463,6 +463,32 @@ var libc_munlockall_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func closedir(dir uintptr) (err error) {
+	_, _, e1 := syscall_syscall(libc_closedir_trampoline_addr, uintptr(dir), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_closedir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_closedir closedir "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func readdir_r(dir uintptr, entry *Dirent, result **Dirent) (res Errno) {
+	r0, _, _ := syscall_syscall(libc_readdir_r_trampoline_addr, uintptr(dir), uintptr(unsafe.Pointer(entry)), uintptr(unsafe.Pointer(result)))
+	res = Errno(r0)
+	return
+}
+
+var libc_readdir_r_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readdir_r readdir_r "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func pipe(p *[2]int32) (err error) {
 	_, _, e1 := syscall_rawSyscall(libc_pipe_trampoline_addr, uintptr(unsafe.Pointer(p)), 0, 0)
 	if e1 != 0 {
@@ -643,17 +669,22 @@ var libc_flistxattr_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setattrlist(path *byte, list unsafe.Pointer, buf unsafe.Pointer, size uintptr, options int) (err error) {
-	_, _, e1 := syscall_syscall6(libc_setattrlist_trampoline_addr, uintptr(unsafe.Pointer(path)), uintptr(list), uintptr(buf), uintptr(size), uintptr(options), 0)
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-var libc_setattrlist_trampoline_addr uintptr
+var libc_utimensat_trampoline_addr uintptr
 
-//go:cgo_import_dynamic libc_setattrlist setattrlist "/usr/lib/libSystem.B.dylib"
+//go:cgo_import_dynamic libc_utimensat utimensat "/usr/lib/libSystem.B.dylib"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
@@ -694,6 +725,14 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 var libc_ioctl_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
@@ -1638,6 +1677,30 @@ var libc_mknod_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Mount(fsType string, dir string, flags int, data unsafe.Pointer) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(fsType)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(dir)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_mount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(flags), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mount mount "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Open(path string, mode int, perm uint32) (fd int, err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1698,7 +1761,7 @@ var libc_pathconf_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1719,7 +1782,7 @@ var libc_pread_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1929,6 +1992,31 @@ var libc_select_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Setattrlist(path string, attrlist *Attrlist, attrBuf []byte, options int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(attrBuf) > 0 {
+		_p1 = unsafe.Pointer(&attrBuf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_setattrlist_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(attrlist)), uintptr(_p1), uintptr(len(attrBuf)), uintptr(options), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setattrlist_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setattrlist setattrlist "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Setegid(egid int) (err error) {
 	_, _, e1 := syscall_syscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
@@ -2060,20 +2148,6 @@ var libc_setreuid_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := syscall_rawSyscall(libc_setrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_setrlimit_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_setrlimit setrlimit "/usr/lib/libSystem.B.dylib"
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
@@ -2447,6 +2521,14 @@ func ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return
 }
 
+func ptrace1Ptr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall6(libc_ptrace_trampoline_addr, uintptr(request), uintptr(pid), addr, uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 var libc_ptrace_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ptrace ptrace "/usr/lib/libSystem.B.dylib"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
index 4ebcf21758..c3b82c0379 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
@@ -1,11 +1,14 @@
-// go run mkasm_darwin.go arm64
+// go run mkasm.go darwin arm64
 // Code generated by the command above; DO NOT EDIT.
 
-//go:build go1.12
-// +build go1.12
-
 #include "textflag.h"
 
+TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fdopendir(SB)
+
+GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
+
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
 
@@ -174,6 +177,18 @@ TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
+TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_closedir(SB)
+
+GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
+
+TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readdir_r(SB)
+
+GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
+
 TEXT libc_pipe_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe(SB)
 
@@ -228,11 +243,11 @@ TEXT libc_flistxattr_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_flistxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flistxattr_trampoline_addr(SB)/8, $libc_flistxattr_trampoline<>(SB)
 
-TEXT libc_setattrlist_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_setattrlist(SB)
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
 
-GLOBL	·libc_setattrlist_trampoline_addr(SB), RODATA, $8
-DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
 
 TEXT libc_fcntl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fcntl(SB)
@@ -600,6 +615,12 @@ TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
+TEXT libc_mount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mount(SB)
+
+GLOBL	·libc_mount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mount_trampoline_addr(SB)/8, $libc_mount_trampoline<>(SB)
+
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
 
@@ -684,6 +705,11 @@ TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
+TEXT libc_setattrlist_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setattrlist(SB)
+GLOBL	·libc_setattrlist_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB)
+
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
 
@@ -738,12 +764,6 @@ TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
-TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_setrlimit(SB)
-
-GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
-DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
-
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
 
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
index 1b6eedfa61..0eabac7ade 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
@@ -436,6 +436,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -552,6 +562,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1390,16 +1410,6 @@ func Setresuid(ruid int, euid int, suid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
index 3e9bddb7b2..ee313eb007 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
@@ -388,6 +388,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -414,6 +424,16 @@ func ptrace(request int, pid int, addr uintptr, data int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ptracePtr(request int, pid int, addr unsafe.Pointer, data int) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Access(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -544,6 +564,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -912,7 +942,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat(fd int, stat *stat_freebsd11_t) (err error) {
+func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -922,17 +952,7 @@ func fstat(fd int, stat *stat_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat_freebsd12(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error) {
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -947,22 +967,7 @@ func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error)
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatat_freebsd12(fd int, path string, stat *Stat_t, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_FSTATAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -972,16 +977,6 @@ func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatfs_freebsd12(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fsync(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1002,7 +997,7 @@ func Ftruncate(fd int, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
+func getdirentries(fd int, buf []byte, basep *uint64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
 		_p0 = unsafe.Pointer(&buf[0])
@@ -1019,23 +1014,6 @@ func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries_freebsd12(fd int, buf []byte, basep *uint64) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(buf) > 0 {
-		_p0 = unsafe.Pointer(&buf[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_GETDIRENTRIES_FREEBSD12, uintptr(fd), uintptr(_p0), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Getdtablesize() (size int) {
 	r0, _, _ := Syscall(SYS_GETDTABLESIZE, 0, 0, 0)
 	size = int(r0)
@@ -1257,21 +1235,6 @@ func Listen(s int, backlog int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func lstat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Mkdir(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1317,43 +1280,13 @@ func Mkfifo(path string, mode uint32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func mknod(path string, mode uint32, dev int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func mknodat(fd int, path string, mode uint32, dev int) (err error) {
+func Mknodat(fd int, path string, mode uint32, dev uint64) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func mknodat_freebsd12(fd int, path string, mode uint32, dev uint64) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_MKNODAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), uintptr(dev>>32), 0)
+	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), uintptr(dev>>32), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1420,7 +1353,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1437,7 +1370,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1712,16 +1645,6 @@ func Setresuid(ruid int, euid int, suid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
@@ -1753,22 +1676,7 @@ func Setuid(uid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func stat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func statfs(path string, stat *statfs_freebsd11_t) (err error) {
+func Statfs(path string, stat *Statfs_t) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -1783,21 +1691,6 @@ func statfs(path string, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func statfs_freebsd12(path string, stat *Statfs_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STATFS_FREEBSD12, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Symlink(path string, link string) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
index c72a462b91..4c986e448e 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
@@ -388,6 +388,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -414,6 +424,16 @@ func ptrace(request int, pid int, addr uintptr, data int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ptracePtr(request int, pid int, addr unsafe.Pointer, data int) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Access(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -544,6 +564,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -912,7 +942,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat(fd int, stat *stat_freebsd11_t) (err error) {
+func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -922,17 +952,7 @@ func fstat(fd int, stat *stat_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat_freebsd12(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error) {
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -947,22 +967,7 @@ func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error)
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatat_freebsd12(fd int, path string, stat *Stat_t, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_FSTATAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -972,16 +977,6 @@ func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatfs_freebsd12(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fsync(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1002,7 +997,7 @@ func Ftruncate(fd int, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
+func getdirentries(fd int, buf []byte, basep *uint64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
 		_p0 = unsafe.Pointer(&buf[0])
@@ -1019,23 +1014,6 @@ func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries_freebsd12(fd int, buf []byte, basep *uint64) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(buf) > 0 {
-		_p0 = unsafe.Pointer(&buf[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_GETDIRENTRIES_FREEBSD12, uintptr(fd), uintptr(_p0), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Getdtablesize() (size int) {
 	r0, _, _ := Syscall(SYS_GETDTABLESIZE, 0, 0, 0)
 	size = int(r0)
@@ -1257,21 +1235,6 @@ func Listen(s int, backlog int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func lstat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Mkdir(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1317,22 +1280,7 @@ func Mkfifo(path string, mode uint32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func mknod(path string, mode uint32, dev int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func mknodat(fd int, path string, mode uint32, dev int) (err error) {
+func Mknodat(fd int, path string, mode uint32, dev uint64) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -1347,21 +1295,6 @@ func mknodat(fd int, path string, mode uint32, dev int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func mknodat_freebsd12(fd int, path string, mode uint32, dev uint64) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_MKNODAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
 	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
@@ -1420,7 +1353,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1437,7 +1370,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1712,16 +1645,6 @@ func Setresuid(ruid int, euid int, suid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
@@ -1753,22 +1676,7 @@ func Setuid(uid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func stat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func statfs(path string, stat *statfs_freebsd11_t) (err error) {
+func Statfs(path string, stat *Statfs_t) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -1783,21 +1691,6 @@ func statfs(path string, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func statfs_freebsd12(path string, stat *Statfs_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STATFS_FREEBSD12, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Symlink(path string, link string) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
index 530d5df90c..555216944a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
@@ -351,14 +351,25 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
+func pipe2(p *[2]_C_int, flags int) (err error) {
+	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getcwd(buf []byte) (n int, err error) {
 	var _p0 unsafe.Pointer
-	if len(mib) > 0 {
-		_p0 = unsafe.Pointer(&mib[0])
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -367,8 +378,8 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+func ioctl(fd int, req uint, arg uintptr) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -377,15 +388,24 @@ func pipe2(p *[2]_C_int, flags int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Getcwd(buf []byte) (n int, err error) {
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
-	if len(buf) > 0 {
-		_p0 = unsafe.Pointer(&buf[0])
+	if len(mib) > 0 {
+		_p0 = unsafe.Pointer(&mib[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
-	n = int(r0)
+	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -394,8 +414,8 @@ func Getcwd(buf []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+func ptrace(request int, pid int, addr uintptr, data int) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -404,7 +424,7 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func ptrace(request int, pid int, addr uintptr, data int) (err error) {
+func ptracePtr(request int, pid int, addr unsafe.Pointer, data int) (err error) {
 	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -544,6 +564,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -912,7 +942,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat(fd int, stat *stat_freebsd11_t) (err error) {
+func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -922,17 +952,7 @@ func fstat(fd int, stat *stat_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat_freebsd12(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error) {
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -947,22 +967,7 @@ func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error)
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatat_freebsd12(fd int, path string, stat *Stat_t, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_FSTATAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -972,16 +977,6 @@ func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatfs_freebsd12(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fsync(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1002,7 +997,7 @@ func Ftruncate(fd int, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
+func getdirentries(fd int, buf []byte, basep *uint64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
 		_p0 = unsafe.Pointer(&buf[0])
@@ -1019,23 +1014,6 @@ func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries_freebsd12(fd int, buf []byte, basep *uint64) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(buf) > 0 {
-		_p0 = unsafe.Pointer(&buf[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_GETDIRENTRIES_FREEBSD12, uintptr(fd), uintptr(_p0), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Getdtablesize() (size int) {
 	r0, _, _ := Syscall(SYS_GETDTABLESIZE, 0, 0, 0)
 	size = int(r0)
@@ -1257,21 +1235,6 @@ func Listen(s int, backlog int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func lstat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Mkdir(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1317,43 +1280,13 @@ func Mkfifo(path string, mode uint32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func mknod(path string, mode uint32, dev int) (err error) {
+func Mknodat(fd int, path string, mode uint32, dev uint64) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func mknodat(fd int, path string, mode uint32, dev int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func mknodat_freebsd12(fd int, path string, mode uint32, dev uint64) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_MKNODAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, uintptr(dev), uintptr(dev>>32))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1420,7 +1353,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1437,7 +1370,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1712,16 +1645,6 @@ func Setresuid(ruid int, euid int, suid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
@@ -1753,22 +1676,7 @@ func Setuid(uid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func stat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func statfs(path string, stat *statfs_freebsd11_t) (err error) {
+func Statfs(path string, stat *Statfs_t) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -1783,21 +1691,6 @@ func statfs(path string, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func statfs_freebsd12(path string, stat *Statfs_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STATFS_FREEBSD12, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Symlink(path string, link string) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
index 71e7df9e85..67a226fbf5 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
@@ -388,6 +388,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -414,6 +424,16 @@ func ptrace(request int, pid int, addr uintptr, data int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ptracePtr(request int, pid int, addr unsafe.Pointer, data int) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Access(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -544,6 +564,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -912,7 +942,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat(fd int, stat *stat_freebsd11_t) (err error) {
+func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -922,17 +952,7 @@ func fstat(fd int, stat *stat_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstat_freebsd12(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error) {
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -947,22 +967,7 @@ func fstatat(fd int, path string, stat *stat_freebsd11_t, flags int) (err error)
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatat_freebsd12(fd int, path string, stat *Stat_t, flags int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_FSTATAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
 	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -972,16 +977,6 @@ func fstatfs(fd int, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func fstatfs_freebsd12(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fsync(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1002,7 +997,7 @@ func Ftruncate(fd int, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
+func getdirentries(fd int, buf []byte, basep *uint64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
 		_p0 = unsafe.Pointer(&buf[0])
@@ -1019,23 +1014,6 @@ func getdirentries(fd int, buf []byte, basep *uintptr) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func getdirentries_freebsd12(fd int, buf []byte, basep *uint64) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(buf) > 0 {
-		_p0 = unsafe.Pointer(&buf[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_GETDIRENTRIES_FREEBSD12, uintptr(fd), uintptr(_p0), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Getdtablesize() (size int) {
 	r0, _, _ := Syscall(SYS_GETDTABLESIZE, 0, 0, 0)
 	size = int(r0)
@@ -1257,21 +1235,6 @@ func Listen(s int, backlog int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func lstat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Mkdir(path string, mode uint32) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -1317,22 +1280,7 @@ func Mkfifo(path string, mode uint32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func mknod(path string, mode uint32, dev int) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func mknodat(fd int, path string, mode uint32, dev int) (err error) {
+func Mknodat(fd int, path string, mode uint32, dev uint64) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -1347,21 +1295,6 @@ func mknodat(fd int, path string, mode uint32, dev int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func mknodat_freebsd12(fd int, path string, mode uint32, dev uint64) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall6(SYS_MKNODAT_FREEBSD12, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
 	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
@@ -1420,7 +1353,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1437,7 +1370,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1712,16 +1645,6 @@ func Setresuid(ruid int, euid int, suid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
@@ -1753,22 +1676,7 @@ func Setuid(uid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func stat(path string, stat *stat_freebsd11_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func statfs(path string, stat *statfs_freebsd11_t) (err error) {
+func Statfs(path string, stat *Statfs_t) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
 	if err != nil {
@@ -1783,21 +1691,6 @@ func statfs(path string, stat *statfs_freebsd11_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func statfs_freebsd12(path string, stat *Statfs_t) (err error) {
-	var _p0 *byte
-	_p0, err = BytePtrFromString(path)
-	if err != nil {
-		return
-	}
-	_, _, e1 := Syscall(SYS_STATFS_FREEBSD12, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Symlink(path string, link string) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
new file mode 100644
index 0000000000..f0b9ddaaa2
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
@@ -0,0 +1,1909 @@
+// go run mksyscall.go -tags freebsd,riscv64 syscall_bsd.go syscall_freebsd.go syscall_freebsd_riscv64.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build freebsd && riscv64
+// +build freebsd,riscv64
+
+package unix
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _ syscall.Errno
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
+	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setgroups(ngid int, gid *_Gid_t) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
+	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	wpid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
+	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socket(domain int, typ int, proto int) (fd int, err error) {
+	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
+	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
+	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Shutdown(s int, how int) (err error) {
+	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
+	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
+	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func utimes(path string, timeval *[2]Timeval) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func futimes(fd int, timeval *[2]Timeval) (err error) {
+	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Madvise(b []byte, behav int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mlock(b []byte) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mlockall(flags int) (err error) {
+	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mprotect(b []byte, prot int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Msync(b []byte, flags int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Munlock(b []byte) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Munlockall() (err error) {
+	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pipe2(p *[2]_C_int, flags int) (err error) {
+	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getcwd(buf []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctl(fd int, req uint, arg uintptr) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
+	var _p0 unsafe.Pointer
+	if len(mib) > 0 {
+		_p0 = unsafe.Pointer(&mib[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ptrace(request int, pid int, addr uintptr, data int) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ptracePtr(request int, pid int, addr unsafe.Pointer, data int) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Access(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
+	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func CapEnter() (err error) {
+	_, _, e1 := Syscall(SYS_CAP_ENTER, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func capRightsGet(version int, fd int, rightsp *CapRights) (err error) {
+	_, _, e1 := Syscall(SYS___CAP_RIGHTS_GET, uintptr(version), uintptr(fd), uintptr(unsafe.Pointer(rightsp)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func capRightsLimit(fd int, rightsp *CapRights) (err error) {
+	_, _, e1 := Syscall(SYS_CAP_RIGHTS_LIMIT, uintptr(fd), uintptr(unsafe.Pointer(rightsp)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chdir(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chflags(path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chmod(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chown(path string, uid int, gid int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chroot(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Close(fd int) (err error) {
+	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup(fd int) (nfd int, err error) {
+	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	nfd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup2(from int, to int) (err error) {
+	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Exit(code int) {
+	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrGetFd(fd int, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrSetFd(fd int, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrDeleteFd(fd int, attrnamespace int, attrname string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_EXTATTR_DELETE_FD, uintptr(fd), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p0)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrListFd(fd int, attrnamespace int, data uintptr, nbytes int) (ret int, err error) {
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FD, uintptr(fd), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrGetFile(file string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrSetFile(file string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrDeleteFile(file string, attrnamespace int, attrname string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_EXTATTR_DELETE_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrListFile(file string, attrnamespace int, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(file)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_FILE, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrGetLink(link string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_GET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrSetLink(link string, attrnamespace int, attrname string, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_SET_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)), uintptr(data), uintptr(nbytes), 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrDeleteLink(link string, attrnamespace int, attrname string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(attrname)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_EXTATTR_DELETE_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(unsafe.Pointer(_p1)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ExtattrListLink(link string, attrnamespace int, data uintptr, nbytes int) (ret int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_EXTATTR_LIST_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(attrnamespace), uintptr(data), uintptr(nbytes), 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
+	_, _, e1 := Syscall6(SYS_POSIX_FADVISE, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchdir(fd int) (err error) {
+	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchflags(fd int, flags int) (err error) {
+	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmod(fd int, mode uint32) (err error) {
+	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchown(fd int, uid int, gid int) (err error) {
+	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Flock(fd int, how int) (err error) {
+	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fpathconf(fd int, name int) (val int, err error) {
+	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstat(fd int, stat *Stat_t) (err error) {
+	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
+	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fsync(fd int) (err error) {
+	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Ftruncate(fd int, length int64) (err error) {
+	_, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getdirentries(fd int, buf []byte, basep *uint64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_GETDIRENTRIES, uintptr(fd), uintptr(_p0), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getdtablesize() (size int) {
+	r0, _, _ := Syscall(SYS_GETDTABLESIZE, 0, 0, 0)
+	size = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getegid() (egid int) {
+	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	egid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Geteuid() (uid int) {
+	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getgid() (gid int) {
+	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	gid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpgid(pid int) (pgid int, err error) {
+	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	pgid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpgrp() (pgrp int) {
+	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	pgrp = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpid() (pid int) {
+	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	pid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getppid() (ppid int) {
+	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	ppid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpriority(which int, who int) (prio int, err error) {
+	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	prio = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrlimit(which int, lim *Rlimit) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrusage(who int, rusage *Rusage) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getsid(pid int) (sid int, err error) {
+	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	sid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Gettimeofday(tv *Timeval) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getuid() (uid int) {
+	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Issetugid() (tainted bool) {
+	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	tainted = bool(r0 != 0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Kill(pid int, signum syscall.Signal) (err error) {
+	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Kqueue() (fd int, err error) {
+	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Lchown(path string, uid int, gid int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Link(path string, link string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Listen(s int, backlog int) (err error) {
+	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkdir(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkdirat(dirfd int, path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkfifo(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mknodat(fd int, path string, mode uint32, dev uint64) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Open(path string, mode int, perm uint32) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Openat(fdat int, path string, mode int, perm uint32) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(fdat), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Pathconf(path string, name int) (val int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func read(fd int, p []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Readlink(path string, buf []byte) (n int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(buf) > 0 {
+		_p1 = unsafe.Pointer(&buf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(buf) > 0 {
+		_p1 = unsafe.Pointer(&buf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Rename(from string, to string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(from)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(to)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Renameat(fromfd int, from string, tofd int, to string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(from)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(to)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Revoke(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Rmdir(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
+	r0, _, e1 := Syscall(SYS_LSEEK, uintptr(fd), uintptr(offset), uintptr(whence))
+	newoffset = int64(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
+	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setegid(egid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seteuid(euid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setgid(gid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setlogin(name string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(name)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setpgid(pid int, pgid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setpriority(which int, who int, prio int) (err error) {
+	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setregid(rgid int, egid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setreuid(ruid int, euid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setresgid(rgid int, egid int, sgid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setresuid(ruid int, euid int, suid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setsid() (pid int, err error) {
+	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	pid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Settimeofday(tp *Timeval) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setuid(uid int) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Statfs(path string, stat *Statfs_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Symlink(path string, link string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(oldpath)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(newpath)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Sync() (err error) {
+	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Truncate(path string, length int64) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Umask(newmask int) (oldmask int) {
+	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	oldmask = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Undelete(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_UNDELETE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unlink(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unlinkat(dirfd int, path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unmount(path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func write(fd int, p []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
+	ret = uintptr(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func munmap(addr uintptr, length uintptr) (err error) {
+	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
+	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
+	nfd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
index af5cb064ec..b57c7050d7 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
@@ -15,25 +15,19 @@ import (
 //go:cgo_import_dynamic libc_writev writev "libc.so"
 //go:cgo_import_dynamic libc_pwritev pwritev "libc.so"
 //go:cgo_import_dynamic libc_accept4 accept4 "libsocket.so"
-//go:cgo_import_dynamic libc_putmsg putmsg "libc.so"
-//go:cgo_import_dynamic libc_getmsg getmsg "libc.so"
 
 //go:linkname procreadv libc_readv
 //go:linkname procpreadv libc_preadv
 //go:linkname procwritev libc_writev
 //go:linkname procpwritev libc_pwritev
 //go:linkname procaccept4 libc_accept4
-//go:linkname procputmsg libc_putmsg
-//go:linkname procgetmsg libc_getmsg
 
 var (
 	procreadv,
 	procpreadv,
 	procwritev,
 	procpwritev,
-	procaccept4,
-	procputmsg,
-	procgetmsg syscallFunc
+	procaccept4 syscallFunc
 )
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
@@ -106,23 +100,3 @@ func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int,
 	}
 	return
 }
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error) {
-	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procputmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(flags), 0, 0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func getmsg(fd int, clptr *strbuf, dataptr *strbuf, flags *int) (err error) {
-	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgetmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(unsafe.Pointer(flags)), 0, 0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux.go b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
index 4f5da1f54f..da63d9d782 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
@@ -1,4 +1,4 @@
-// Code generated by mkmerge.go; DO NOT EDIT.
+// Code generated by mkmerge; DO NOT EDIT.
 
 //go:build linux
 // +build linux
@@ -231,6 +231,16 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Waitid(idType int, id int, info *Siginfo, options int, rusage *Rusage) (err error) {
+	_, _, e1 := Syscall6(SYS_WAITID, uintptr(idType), uintptr(id), uintptr(unsafe.Pointer(info)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func KeyctlInt(cmd int, arg2 int, arg3 int, arg4 int, arg5 int) (ret int, err error) {
 	r0, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0)
 	ret = int(r0)
@@ -369,6 +379,16 @@ func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func reboot(magic1 uint, magic2 uint, cmd int, arg string) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(arg)
@@ -409,6 +429,21 @@ func mount(source string, target string, fstype string, flags uintptr, data *byt
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func mountSetattr(dirfd int, pathname string, flags uint, attr *MountAttr, size uintptr) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(pathname)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_MOUNT_SETATTR, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), uintptr(unsafe.Pointer(attr)), uintptr(size), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Acct(path string) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -512,6 +547,17 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockAdjtime(clockid int32, buf *Timex) (state int, err error) {
+	r0, _, e1 := Syscall(SYS_CLOCK_ADJTIME, uintptr(clockid), uintptr(unsafe.Pointer(buf)), 0)
+	state = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ClockGetres(clockid int32, res *Timespec) (err error) {
 	_, _, e1 := Syscall(SYS_CLOCK_GETRES, uintptr(clockid), uintptr(unsafe.Pointer(res)), 0)
 	if e1 != 0 {
@@ -803,6 +849,49 @@ func Fsync(fd int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Fsmount(fd int, flags int, mountAttrs int) (fsfd int, err error) {
+	r0, _, e1 := Syscall(SYS_FSMOUNT, uintptr(fd), uintptr(flags), uintptr(mountAttrs))
+	fsfd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fsopen(fsName string, flags int) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(fsName)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall(SYS_FSOPEN, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fspick(dirfd int, pathName string, flags int) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(pathName)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall(SYS_FSPICK, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Getdents(fd int, buf []byte) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(buf) > 0 {
@@ -1180,6 +1269,26 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func MoveMount(fromDirfd int, fromPathName string, toDirfd int, toPathName string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(fromPathName)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(toPathName)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_MOVE_MOUNT, uintptr(fromDirfd), uintptr(unsafe.Pointer(_p0)), uintptr(toDirfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
 	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
@@ -1190,6 +1299,22 @@ func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func OpenTree(dfd int, fileName string, flags uint) (r int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(fileName)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := Syscall(SYS_OPEN_TREE, uintptr(dfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	r = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_PERF_EVENT_OPEN, uintptr(unsafe.Pointer(attr)), uintptr(pid), uintptr(cpu), uintptr(groupFd), uintptr(flags), 0)
 	fd = int(r0)
@@ -1221,16 +1346,6 @@ func PivotRoot(newroot string, putold string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Prlimit(pid int, resource int, newlimit *Rlimit, old *Rlimit) (err error) {
-	_, _, e1 := RawSyscall6(SYS_PRLIMIT64, uintptr(pid), uintptr(resource), uintptr(unsafe.Pointer(newlimit)), uintptr(unsafe.Pointer(old)), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error) {
 	_, _, e1 := Syscall6(SYS_PRCTL, uintptr(option), uintptr(arg2), uintptr(arg3), uintptr(arg4), uintptr(arg5), 0)
 	if e1 != 0 {
@@ -1977,6 +2092,16 @@ func PidfdGetfd(pidfd int, targetfd int, flags int) (fd int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func PidfdSendSignal(pidfd int, sig Signal, info *Siginfo, flags int) (err error) {
+	_, _, e1 := Syscall6(SYS_PIDFD_SEND_SIGNAL, uintptr(pidfd), uintptr(sig), uintptr(unsafe.Pointer(info)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func shmat(id int, addr uintptr, flag int) (ret uintptr, err error) {
 	r0, _, e1 := Syscall(SYS_SHMAT, uintptr(id), uintptr(addr), uintptr(flag))
 	ret = uintptr(r0)
@@ -2017,3 +2142,33 @@ func shmget(key int, size int, flag int) (id int, err error) {
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getitimer(which int, currValue *Itimerval) (err error) {
+	_, _, e1 := Syscall(SYS_GETITIMER, uintptr(which), uintptr(unsafe.Pointer(currValue)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setitimer(which int, newValue *Itimerval, oldValue *Itimerval) (err error) {
+	_, _, e1 := Syscall(SYS_SETITIMER, uintptr(which), uintptr(unsafe.Pointer(newValue)), uintptr(unsafe.Pointer(oldValue)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func rtSigprocmask(how int, set *Sigset_t, oldset *Sigset_t, sigsetsize uintptr) (err error) {
+	_, _, e1 := RawSyscall6(SYS_RT_SIGPROCMASK, uintptr(how), uintptr(unsafe.Pointer(set)), uintptr(unsafe.Pointer(oldset)), uintptr(sigsetsize), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
index ff90c81e73..07b549cc25 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -l32 -tags linux,386 syscall_linux.go syscall_linux_386.go
+// go run mksyscall.go -l32 -tags linux,386 syscall_linux.go syscall_linux_386.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && 386
@@ -200,7 +200,7 @@ func Lstat(path string, stat *Stat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -217,7 +217,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -287,46 +287,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID32, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID32, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID32, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID32, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int, err error) {
 	r0, _, e1 := Syscall6(SYS_SPLICE, uintptr(rfd), uintptr(unsafe.Pointer(roff)), uintptr(wfd), uintptr(unsafe.Pointer(woff)), uintptr(len), uintptr(flags))
 	n = int(r0)
@@ -451,16 +411,6 @@ func getrlimit(resource int, rlim *rlimit32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setrlimit(resource int, rlim *rlimit32) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func futimesat(dirfd int, path string, times *[2]Timeval) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
@@ -524,3 +474,14 @@ func utimes(path string, times *[2]Timeval) (err error) {
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
index fa7d3dbe4e..5f481bf83f 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -tags linux,amd64 syscall_linux.go syscall_linux_amd64.go
+// go run mksyscall.go -tags linux,amd64 syscall_linux.go syscall_linux_amd64.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && amd64
@@ -215,6 +215,17 @@ func Listen(s int, n int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func MemfdSecret(flags int) (fd int, err error) {
+	r0, _, e1 := Syscall(SYS_MEMFD_SECRET, uintptr(flags), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Pause() (err error) {
 	_, _, e1 := Syscall(SYS_PAUSE, 0, 0, 0)
 	if e1 != 0 {
@@ -225,7 +236,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -242,7 +253,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -323,56 +334,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -444,17 +405,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -691,3 +641,14 @@ func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, f
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
index 654f91530f..824cd52c7f 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
@@ -46,17 +46,6 @@ func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -423,46 +412,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID32, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID32, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID32, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID32, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -549,7 +498,7 @@ func utimes(path string, times *[2]Timeval) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -566,7 +515,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -629,16 +578,6 @@ func getrlimit(resource int, rlim *rlimit32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setrlimit(resource int, rlim *rlimit32) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func armSyncFileRange(fd int, flags int, off int64, n int64) (err error) {
 	_, _, e1 := Syscall6(SYS_ARM_SYNC_FILE_RANGE, uintptr(fd), uintptr(flags), uintptr(off), uintptr(off>>32), uintptr(n), uintptr(n>>32))
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
index e893f987f9..e77aecfe98 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
@@ -180,7 +180,18 @@ func Listen(s int, n int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func MemfdSecret(flags int) (fd int, err error) {
+	r0, _, e1 := Syscall(SYS_MEMFD_SECRET, uintptr(flags), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -197,7 +208,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -278,56 +289,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -389,17 +350,6 @@ func Truncate(path string, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
new file mode 100644
index 0000000000..806ffd1e12
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
@@ -0,0 +1,487 @@
+// go run mksyscall.go -tags linux,loong64 syscall_linux.go syscall_linux_loong64.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build linux && loong64
+// +build linux,loong64
+
+package unix
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _ syscall.Errno
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func fanotifyMark(fd int, flags uint, mask uint64, dirFd int, pathname *byte) (err error) {
+	_, _, e1 := Syscall6(SYS_FANOTIFY_MARK, uintptr(fd), uintptr(flags), uintptr(mask), uintptr(dirFd), uintptr(unsafe.Pointer(pathname)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fallocate(fd int, mode uint32, off int64, len int64) (err error) {
+	_, _, e1 := Syscall6(SYS_FALLOCATE, uintptr(fd), uintptr(mode), uintptr(off), uintptr(len), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Tee(rfd int, wfd int, len int, flags int) (n int64, err error) {
+	r0, _, e1 := Syscall6(SYS_TEE, uintptr(rfd), uintptr(wfd), uintptr(len), uintptr(flags), 0, 0)
+	n = int64(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(events) > 0 {
+		_p0 = unsafe.Pointer(&events[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
+	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchown(fd int, uid int, gid int) (err error) {
+	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatfs(fd int, buf *Statfs_t) (err error) {
+	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(buf)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Ftruncate(fd int, length int64) (err error) {
+	_, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getegid() (egid int) {
+	r0, _ := RawSyscallNoError(SYS_GETEGID, 0, 0, 0)
+	egid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Geteuid() (euid int) {
+	r0, _ := RawSyscallNoError(SYS_GETEUID, 0, 0, 0)
+	euid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getgid() (gid int) {
+	r0, _ := RawSyscallNoError(SYS_GETGID, 0, 0, 0)
+	gid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getuid() (uid int) {
+	r0, _ := RawSyscallNoError(SYS_GETUID, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Listen(s int, n int) (err error) {
+	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(n), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_PREAD64, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_PWRITE64, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seek(fd int, offset int64, whence int) (off int64, err error) {
+	r0, _, e1 := Syscall(SYS_LSEEK, uintptr(fd), uintptr(offset), uintptr(whence))
+	off = int64(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendfile(outfd int, infd int, offset *int64, count int) (written int, err error) {
+	r0, _, e1 := Syscall6(SYS_SENDFILE, uintptr(outfd), uintptr(infd), uintptr(unsafe.Pointer(offset)), uintptr(count), 0, 0)
+	written = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setfsgid(gid int) (prev int, err error) {
+	r0, _, e1 := Syscall(SYS_SETFSGID, uintptr(gid), 0, 0)
+	prev = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setfsuid(uid int) (prev int, err error) {
+	r0, _, e1 := Syscall(SYS_SETFSUID, uintptr(uid), 0, 0)
+	prev = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Shutdown(fd int, how int) (err error) {
+	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error) {
+	r0, _, e1 := Syscall6(SYS_SPLICE, uintptr(rfd), uintptr(unsafe.Pointer(roff)), uintptr(wfd), uintptr(unsafe.Pointer(woff)), uintptr(len), uintptr(flags))
+	n = int64(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Statfs(path string, buf *Statfs_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(buf)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func SyncFileRange(fd int, off int64, n int64, flags int) (err error) {
+	_, _, e1 := Syscall6(SYS_SYNC_FILE_RANGE, uintptr(fd), uintptr(off), uintptr(n), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Truncate(path string, length int64) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
+	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getgroups(n int, list *_Gid_t) (nn int, err error) {
+	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(n), uintptr(unsafe.Pointer(list)), 0)
+	nn = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setgroups(n int, list *_Gid_t) (err error) {
+	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(n), uintptr(unsafe.Pointer(list)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
+	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
+	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socket(domain int, typ int, proto int) (fd int, err error) {
+	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
+	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error) {
+	r0, _, e1 := Syscall6(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flags), uintptr(fd), uintptr(offset))
+	xaddr = uintptr(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Gettimeofday(tv *Timeval) (err error) {
+	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(cmdline)
+	if err != nil {
+		return
+	}
+	_, _, e1 := Syscall6(SYS_KEXEC_FILE_LOAD, uintptr(kernelFd), uintptr(initrdFd), uintptr(cmdlineLen), uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
index 6d15528853..961a3afb7b 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -b32 -arm -tags linux,mips syscall_linux.go syscall_linux_mipsx.go
+// go run mksyscall.go -b32 -arm -tags linux,mips syscall_linux.go syscall_linux_mipsx.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && mips
@@ -150,7 +150,7 @@ func Listen(s int, n int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -167,7 +167,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -248,46 +248,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -344,17 +304,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -695,8 +644,9 @@ func getrlimit(resource int, rlim *rlimit32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setrlimit(resource int, rlim *rlimit32) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
index 1e20d72df2..ed05005e91 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -tags linux,mips64 syscall_linux.go syscall_linux_mips64x.go
+// go run mksyscall.go -tags linux,mips64 syscall_linux.go syscall_linux_mips64x.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && mips64
@@ -180,7 +180,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -197,7 +197,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -278,56 +278,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -399,17 +349,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -696,3 +635,14 @@ func stat(path string, st *stat_t) (err error) {
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
index 82b5e2d9ed..d365b718f3 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
@@ -180,7 +180,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -197,7 +197,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -278,56 +278,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -399,17 +349,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
index a0440c1d43..c3f1b8bbde 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -l32 -arm -tags linux,mipsle syscall_linux.go syscall_linux_mipsx.go
+// go run mksyscall.go -l32 -arm -tags linux,mipsle syscall_linux.go syscall_linux_mipsx.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && mipsle
@@ -150,7 +150,7 @@ func Listen(s int, n int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -167,7 +167,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -248,46 +248,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -344,17 +304,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -695,8 +644,9 @@ func getrlimit(resource int, rlim *rlimit32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setrlimit(resource int, rlim *rlimit32) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
index 5864b9ca64..a6574cf98b 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -b32 -tags linux,ppc syscall_linux.go syscall_linux_ppc.go
+// go run mksyscall.go -b32 -tags linux,ppc syscall_linux.go syscall_linux_ppc.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && ppc
@@ -210,7 +210,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -227,7 +227,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -308,46 +308,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -409,17 +369,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -675,16 +624,6 @@ func getrlimit(resource int, rlim *rlimit32) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setrlimit(resource int, rlim *rlimit32) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func syncFileRange2(fd int, flags int, off int64, n int64) (err error) {
 	_, _, e1 := Syscall6(SYS_SYNC_FILE_RANGE2, uintptr(fd), uintptr(flags), uintptr(off>>32), uintptr(off), uintptr(n>>32), uintptr(n))
 	if e1 != 0 {
@@ -707,3 +646,14 @@ func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, f
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
index beeb49e342..f40990264f 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -tags linux,ppc64 syscall_linux.go syscall_linux_ppc64x.go
+// go run mksyscall.go -tags linux,ppc64 syscall_linux.go syscall_linux_ppc64x.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && ppc64
@@ -240,7 +240,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -257,7 +257,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -349,56 +349,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -475,17 +425,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -753,3 +692,14 @@ func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, f
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
index 53139b82c7..9dfcc29974 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -tags linux,ppc64le syscall_linux.go syscall_linux_ppc64x.go
+// go run mksyscall.go -tags linux,ppc64le syscall_linux.go syscall_linux_ppc64x.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && ppc64le
@@ -240,7 +240,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -257,7 +257,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -349,56 +349,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -475,17 +425,6 @@ func Ustat(dev int, ubuf *Ustat_t) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -753,3 +692,14 @@ func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, f
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
index 63b393b802..0b29239583 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
@@ -180,7 +180,18 @@ func Listen(s int, n int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func MemfdSecret(flags int) (fd int, err error) {
+	r0, _, e1 := Syscall(SYS_MEMFD_SECRET, uintptr(flags), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -197,7 +208,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -258,56 +269,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -369,17 +330,6 @@ func Truncate(path string, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
index 202add37d1..6cde32237d 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -tags linux,s390x syscall_linux.go syscall_linux_s390x.go
+// go run mksyscall.go -tags linux,s390x syscall_linux.go syscall_linux_s390x.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && s390x
@@ -210,7 +210,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -227,7 +227,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -319,56 +319,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error) {
 	r0, _, e1 := Syscall6(SYS_SPLICE, uintptr(rfd), uintptr(unsafe.Pointer(roff)), uintptr(wfd), uintptr(unsafe.Pointer(woff)), uintptr(len), uintptr(flags))
 	n = int64(r0)
@@ -533,3 +483,14 @@ func kexecFileLoad(kernelFd int, initrdFd int, cmdlineLen int, cmdline string, f
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go b/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
index 2ab268c343..5253d65bf1 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -tags linux,sparc64 syscall_linux.go syscall_linux_sparc64.go
+// go run mksyscall.go -tags linux,sparc64 syscall_linux.go syscall_linux_sparc64.go syscall_linux_alarm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build linux && sparc64
@@ -220,7 +220,7 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -237,7 +237,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -329,56 +329,6 @@ func setfsuid(uid int) (prev int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(resource), uintptr(unsafe.Pointer(rlim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Shutdown(fd int, how int) (err error) {
 	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
@@ -455,17 +405,6 @@ func Truncate(path string, length int64) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
-	fd = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
@@ -697,3 +636,14 @@ func utimes(path string, times *[2]Timeval) (err error) {
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Alarm(seconds uint) (remaining uint, err error) {
+	r0, _, e1 := Syscall(SYS_ALARM, uintptr(seconds), 0, 0)
+	remaining = uint(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
index 4726ab30a8..cdb2af5ae0 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
@@ -417,6 +405,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -533,6 +531,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1342,7 +1350,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1359,7 +1367,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1599,16 +1607,6 @@ func Setreuid(ruid int, euid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
index fe71456dbc..9d25f76b0b 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
@@ -417,6 +405,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -533,6 +531,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1342,7 +1350,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1359,7 +1367,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1599,16 +1607,6 @@ func Setreuid(ruid int, euid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
index 0b5b2f0143..d3f8035169 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
@@ -417,6 +405,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -533,6 +531,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1342,7 +1350,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1359,7 +1367,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1599,16 +1607,6 @@ func Setreuid(ruid int, euid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
index bfca28648f..887188a529 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
@@ -417,6 +405,16 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
 	var _p0 unsafe.Pointer
 	if len(mib) > 0 {
@@ -533,6 +531,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := Syscall(SYS_CLOCK_GETTIME, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
 	if e1 != 0 {
@@ -1342,7 +1350,7 @@ func Pathconf(path string, name int) (val int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1359,7 +1367,7 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
@@ -1599,16 +1607,6 @@ func Setreuid(ruid int, euid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
index 8f80f4ade5..6699a783e1 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -l32 -openbsd -tags openbsd,386 syscall_bsd.go syscall_openbsd.go syscall_openbsd_386.go
+// go run mksyscall.go -l32 -openbsd -libc -tags openbsd,386 syscall_bsd.go syscall_openbsd.go syscall_openbsd_386.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build openbsd && 386
@@ -16,7 +16,7 @@ var _ syscall.Errno
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -24,20 +24,28 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	return
 }
 
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setgroups(ngid int, gid *_Gid_t) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
-	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -45,10 +53,14 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 	return
 }
 
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -56,30 +68,42 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	return
 }
 
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socket(domain int, typ int, proto int) (fd int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -87,66 +111,94 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	return
 }
 
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
-	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
-	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Shutdown(s int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
-	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
@@ -156,7 +208,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -164,6 +216,10 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	return
 }
 
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
@@ -173,17 +229,21 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -191,10 +251,14 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -202,10 +266,14 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -213,6 +281,10 @@ func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, ne
 	return
 }
 
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func utimes(path string, timeval *[2]Timeval) (err error) {
@@ -221,27 +293,35 @@ func utimes(path string, timeval *[2]Timeval) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func futimes(fd int, timeval *[2]Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -249,6 +329,10 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	return
 }
 
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Madvise(b []byte, behav int) (err error) {
@@ -258,13 +342,17 @@ func Madvise(b []byte, behav int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlock(b []byte) (err error) {
@@ -274,23 +362,31 @@ func Mlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlockall(flags int) (err error) {
-	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mprotect(b []byte, prot int) (err error) {
@@ -300,13 +396,17 @@ func Mprotect(b []byte, prot int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Msync(b []byte, flags int) (err error) {
@@ -316,13 +416,17 @@ func Msync(b []byte, flags int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlock(b []byte) (err error) {
@@ -332,33 +436,45 @@ func Munlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlockall() (err error) {
-	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -368,7 +484,7 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_GETDENTS, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -376,6 +492,10 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getcwd(buf []byte) (n int, err error) {
@@ -385,7 +505,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -393,16 +513,32 @@ func Getcwd(buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -412,17 +548,21 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -430,6 +570,10 @@ func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int,
 	return
 }
 
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Access(path string, mode uint32) (err error) {
@@ -438,23 +582,31 @@ func Access(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chdir(path string) (err error) {
@@ -463,13 +615,17 @@ func Chdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chflags(path string, flags int) (err error) {
@@ -478,13 +634,17 @@ func Chflags(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chmod(path string, mode uint32) (err error) {
@@ -493,13 +653,17 @@ func Chmod(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chown(path string, uid int, gid int) (err error) {
@@ -508,13 +672,17 @@ func Chown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chroot(path string) (err error) {
@@ -523,27 +691,49 @@ func Chroot(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Close(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup(fd int) (nfd int, err error) {
-	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -551,33 +741,49 @@ func Dup(fd int) (nfd int, err error) {
 	return
 }
 
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup2(from int, to int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup3(from int, to int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP3, uintptr(from), uintptr(to), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Exit(code int) {
-	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
 	return
 }
 
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -586,43 +792,59 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchdir(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchflags(fd int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmod(fd int, mode uint32) (err error) {
-	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -631,23 +853,31 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchown(fd int, uid int, gid int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
@@ -656,27 +886,35 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Flock(fd int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fpathconf(fd int, name int) (val int, err error) {
-	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -684,16 +922,24 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	return
 }
 
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
@@ -702,71 +948,99 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatfs(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fsync(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Ftruncate(fd int, length int64) (err error) {
-	_, _, e1 := Syscall6(SYS_FTRUNCATE, uintptr(fd), 0, uintptr(length), uintptr(length>>32), 0, 0)
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), uintptr(length>>32))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getegid() (egid int) {
-	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
 	egid = int(r0)
 	return
 }
 
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Geteuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getgid() (gid int) {
-	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
 	gid = int(r0)
 	return
 }
 
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgid(pid int) (pgid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -774,34 +1048,50 @@ func Getpgid(pid int) (pgid int, err error) {
 	return
 }
 
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgrp() (pgrp int) {
-	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
 	pgrp = int(r0)
 	return
 }
 
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpid() (pid int) {
-	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	return
 }
 
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getppid() (ppid int) {
-	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
 	ppid = int(r0)
 	return
 }
 
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpriority(which int, who int) (prio int, err error) {
-	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
 	prio = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -809,20 +1099,28 @@ func Getpriority(which int, who int) (prio int, err error) {
 	return
 }
 
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrtable() (rtable int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETRTABLE, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
 	rtable = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -830,20 +1128,28 @@ func Getrtable() (rtable int, err error) {
 	return
 }
 
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrusage(who int, rusage *Rusage) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getsid(pid int) (sid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -851,46 +1157,66 @@ func Getsid(pid int) (sid int, err error) {
 	return
 }
 
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Gettimeofday(tv *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Issetugid() (tainted bool) {
-	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
 	tainted = bool(r0 != 0)
 	return
 }
 
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kill(pid int, signum syscall.Signal) (err error) {
-	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kqueue() (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -898,6 +1224,10 @@ func Kqueue() (fd int, err error) {
 	return
 }
 
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lchown(path string, uid int, gid int) (err error) {
@@ -906,13 +1236,17 @@ func Lchown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Link(path string, link string) (err error) {
@@ -926,13 +1260,17 @@ func Link(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
@@ -946,23 +1284,31 @@ func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err er
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Listen(s int, backlog int) (err error) {
-	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lstat(path string, stat *Stat_t) (err error) {
@@ -971,13 +1317,17 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdir(path string, mode uint32) (err error) {
@@ -986,13 +1336,17 @@ func Mkdir(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdirat(dirfd int, path string, mode uint32) (err error) {
@@ -1001,13 +1355,17 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifo(path string, mode uint32) (err error) {
@@ -1016,13 +1374,17 @@ func Mkfifo(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
@@ -1031,13 +1393,17 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFOAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknod(path string, mode uint32, dev int) (err error) {
@@ -1046,13 +1412,17 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
@@ -1061,23 +1431,31 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
-	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Open(path string, mode int, perm uint32) (fd int, err error) {
@@ -1086,7 +1464,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1094,6 +1472,10 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
@@ -1102,7 +1484,7 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1110,6 +1492,10 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Pathconf(path string, name int) (val int, err error) {
@@ -1118,7 +1504,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1126,16 +1512,20 @@ func Pathconf(path string, name int) (val int, err error) {
 	return
 }
 
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), uintptr(offset>>32))
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), uintptr(offset>>32), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1143,16 +1533,20 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), uintptr(offset>>32))
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), uintptr(offset>>32), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1160,6 +1554,10 @@ func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func read(fd int, p []byte) (n int, err error) {
@@ -1169,7 +1567,7 @@ func read(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1177,6 +1575,10 @@ func read(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlink(path string, buf []byte) (n int, err error) {
@@ -1191,7 +1593,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1199,6 +1601,10 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
@@ -1213,7 +1619,7 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1221,6 +1627,10 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rename(from string, to string) (err error) {
@@ -1234,13 +1644,17 @@ func Rename(from string, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Renameat(fromfd int, from string, tofd int, to string) (err error) {
@@ -1254,13 +1668,17 @@ func Renameat(fromfd int, from string, tofd int, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Revoke(path string) (err error) {
@@ -1269,13 +1687,17 @@ func Revoke(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rmdir(path string) (err error) {
@@ -1284,17 +1706,21 @@ func Rmdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
-	r0, r1, e1 := Syscall6(SYS_LSEEK, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(whence), 0)
+	r0, r1, e1 := syscall_syscall6(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(offset>>32), uintptr(whence), 0, 0)
 	newoffset = int64(int64(r1)<<32 | int64(r0))
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1302,10 +1728,14 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return
 }
 
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1313,36 +1743,52 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	return
 }
 
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setegid(egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seteuid(euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setgid(gid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setlogin(name string) (err error) {
@@ -1351,97 +1797,119 @@ func Setlogin(name string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpgid(pid int, pgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpriority(which int, who int, prio int) (err error) {
-	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+var libc_setresuid_trampoline_addr uintptr
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrtable(rtable int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRTABLE, uintptr(rtable), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setsid() (pid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1449,26 +1917,38 @@ func Setsid() (pid int, err error) {
 	return
 }
 
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Settimeofday(tp *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setuid(uid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Stat(path string, stat *Stat_t) (err error) {
@@ -1477,13 +1957,17 @@ func Stat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Statfs(path string, stat *Statfs_t) (err error) {
@@ -1492,13 +1976,17 @@ func Statfs(path string, stat *Statfs_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlink(path string, link string) (err error) {
@@ -1512,13 +2000,17 @@ func Symlink(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
@@ -1532,23 +2024,31 @@ func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Sync() (err error) {
-	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Truncate(path string, length int64) (err error) {
@@ -1557,21 +2057,29 @@ func Truncate(path string, length int64) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length), uintptr(length>>32), 0, 0)
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), uintptr(length>>32))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Umask(newmask int) (oldmask int) {
-	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
 	oldmask = int(r0)
 	return
 }
 
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlink(path string) (err error) {
@@ -1580,13 +2088,17 @@ func Unlink(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlinkat(dirfd int, path string, flags int) (err error) {
@@ -1595,13 +2107,17 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unmount(path string, flags int) (err error) {
@@ -1610,13 +2126,17 @@ func Unmount(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func write(fd int, p []byte) (n int, err error) {
@@ -1626,7 +2146,7 @@ func write(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1634,10 +2154,14 @@ func write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
-	r0, _, e1 := Syscall9(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), uintptr(pos>>32), 0)
+	r0, _, e1 := syscall_syscall9(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos), uintptr(pos>>32), 0, 0)
 	ret = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1645,20 +2169,28 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	return
 }
 
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func munmap(addr uintptr, length uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1669,7 +2201,7 @@ func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1685,9 +2217,13 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
new file mode 100644
index 0000000000..04f0de34b2
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.s
@@ -0,0 +1,664 @@
+// go run mkasm.go openbsd 386
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getgroups_trampoline_addr(SB)/4, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setgroups_trampoline_addr(SB)/4, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $4
+DATA	·libc_wait4_trampoline_addr(SB)/4, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $4
+DATA	·libc_accept_trampoline_addr(SB)/4, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $4
+DATA	·libc_bind_trampoline_addr(SB)/4, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $4
+DATA	·libc_connect_trampoline_addr(SB)/4, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $4
+DATA	·libc_socket_trampoline_addr(SB)/4, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getsockopt_trampoline_addr(SB)/4, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setsockopt_trampoline_addr(SB)/4, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpeername_trampoline_addr(SB)/4, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getsockname_trampoline_addr(SB)/4, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_shutdown_trampoline_addr(SB)/4, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $4
+DATA	·libc_socketpair_trampoline_addr(SB)/4, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $4
+DATA	·libc_recvfrom_trampoline_addr(SB)/4, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sendto_trampoline_addr(SB)/4, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $4
+DATA	·libc_recvmsg_trampoline_addr(SB)/4, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sendmsg_trampoline_addr(SB)/4, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $4
+DATA	·libc_kevent_trampoline_addr(SB)/4, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $4
+DATA	·libc_utimes_trampoline_addr(SB)/4, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $4
+DATA	·libc_futimes_trampoline_addr(SB)/4, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $4
+DATA	·libc_poll_trampoline_addr(SB)/4, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $4
+DATA	·libc_madvise_trampoline_addr(SB)/4, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mlock_trampoline_addr(SB)/4, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mlockall_trampoline_addr(SB)/4, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mprotect_trampoline_addr(SB)/4, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $4
+DATA	·libc_msync_trampoline_addr(SB)/4, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $4
+DATA	·libc_munlock_trampoline_addr(SB)/4, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $4
+DATA	·libc_munlockall_trampoline_addr(SB)/4, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pipe2_trampoline_addr(SB)/4, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getdents_trampoline_addr(SB)/4, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getcwd_trampoline_addr(SB)/4, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $4
+DATA	·libc_ioctl_trampoline_addr(SB)/4, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sysctl_trampoline_addr(SB)/4, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $4
+DATA	·libc_ppoll_trampoline_addr(SB)/4, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $4
+DATA	·libc_access_trampoline_addr(SB)/4, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $4
+DATA	·libc_adjtime_trampoline_addr(SB)/4, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chdir_trampoline_addr(SB)/4, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chflags_trampoline_addr(SB)/4, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chmod_trampoline_addr(SB)/4, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chown_trampoline_addr(SB)/4, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chroot_trampoline_addr(SB)/4, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $4
+DATA	·libc_clock_gettime_trampoline_addr(SB)/4, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $4
+DATA	·libc_close_trampoline_addr(SB)/4, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $4
+DATA	·libc_dup_trampoline_addr(SB)/4, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $4
+DATA	·libc_dup2_trampoline_addr(SB)/4, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $4
+DATA	·libc_dup3_trampoline_addr(SB)/4, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $4
+DATA	·libc_exit_trampoline_addr(SB)/4, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_faccessat_trampoline_addr(SB)/4, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchdir_trampoline_addr(SB)/4, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchflags_trampoline_addr(SB)/4, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchmod_trampoline_addr(SB)/4, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchmodat_trampoline_addr(SB)/4, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchown_trampoline_addr(SB)/4, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchownat_trampoline_addr(SB)/4, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $4
+DATA	·libc_flock_trampoline_addr(SB)/4, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fpathconf_trampoline_addr(SB)/4, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fstat_trampoline_addr(SB)/4, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fstatat_trampoline_addr(SB)/4, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fstatfs_trampoline_addr(SB)/4, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fsync_trampoline_addr(SB)/4, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $4
+DATA	·libc_ftruncate_trampoline_addr(SB)/4, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getegid_trampoline_addr(SB)/4, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_geteuid_trampoline_addr(SB)/4, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getgid_trampoline_addr(SB)/4, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpgid_trampoline_addr(SB)/4, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpgrp_trampoline_addr(SB)/4, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpid_trampoline_addr(SB)/4, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getppid_trampoline_addr(SB)/4, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpriority_trampoline_addr(SB)/4, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getrlimit_trampoline_addr(SB)/4, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getrtable_trampoline_addr(SB)/4, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getrusage_trampoline_addr(SB)/4, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getsid_trampoline_addr(SB)/4, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $4
+DATA	·libc_gettimeofday_trampoline_addr(SB)/4, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getuid_trampoline_addr(SB)/4, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_issetugid_trampoline_addr(SB)/4, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $4
+DATA	·libc_kill_trampoline_addr(SB)/4, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $4
+DATA	·libc_kqueue_trampoline_addr(SB)/4, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_lchown_trampoline_addr(SB)/4, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $4
+DATA	·libc_link_trampoline_addr(SB)/4, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_linkat_trampoline_addr(SB)/4, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $4
+DATA	·libc_listen_trampoline_addr(SB)/4, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_lstat_trampoline_addr(SB)/4, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkdir_trampoline_addr(SB)/4, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkdirat_trampoline_addr(SB)/4, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkfifo_trampoline_addr(SB)/4, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkfifoat_trampoline_addr(SB)/4, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mknod_trampoline_addr(SB)/4, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mknodat_trampoline_addr(SB)/4, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $4
+DATA	·libc_nanosleep_trampoline_addr(SB)/4, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $4
+DATA	·libc_open_trampoline_addr(SB)/4, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_openat_trampoline_addr(SB)/4, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pathconf_trampoline_addr(SB)/4, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pread_trampoline_addr(SB)/4, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pwrite_trampoline_addr(SB)/4, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $4
+DATA	·libc_read_trampoline_addr(SB)/4, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $4
+DATA	·libc_readlink_trampoline_addr(SB)/4, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_readlinkat_trampoline_addr(SB)/4, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $4
+DATA	·libc_rename_trampoline_addr(SB)/4, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_renameat_trampoline_addr(SB)/4, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $4
+DATA	·libc_revoke_trampoline_addr(SB)/4, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_rmdir_trampoline_addr(SB)/4, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $4
+DATA	·libc_lseek_trampoline_addr(SB)/4, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $4
+DATA	·libc_select_trampoline_addr(SB)/4, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setegid_trampoline_addr(SB)/4, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_seteuid_trampoline_addr(SB)/4, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setgid_trampoline_addr(SB)/4, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setlogin_trampoline_addr(SB)/4, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setpgid_trampoline_addr(SB)/4, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setpriority_trampoline_addr(SB)/4, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setregid_trampoline_addr(SB)/4, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setreuid_trampoline_addr(SB)/4, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setresgid_trampoline_addr(SB)/4, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setresuid_trampoline_addr(SB)/4, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setrtable_trampoline_addr(SB)/4, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setsid_trampoline_addr(SB)/4, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $4
+DATA	·libc_settimeofday_trampoline_addr(SB)/4, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setuid_trampoline_addr(SB)/4, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_stat_trampoline_addr(SB)/4, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $4
+DATA	·libc_statfs_trampoline_addr(SB)/4, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $4
+DATA	·libc_symlink_trampoline_addr(SB)/4, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_symlinkat_trampoline_addr(SB)/4, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sync_trampoline_addr(SB)/4, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $4
+DATA	·libc_truncate_trampoline_addr(SB)/4, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $4
+DATA	·libc_umask_trampoline_addr(SB)/4, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $4
+DATA	·libc_unlink_trampoline_addr(SB)/4, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_unlinkat_trampoline_addr(SB)/4, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $4
+DATA	·libc_unmount_trampoline_addr(SB)/4, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $4
+DATA	·libc_write_trampoline_addr(SB)/4, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mmap_trampoline_addr(SB)/4, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $4
+DATA	·libc_munmap_trampoline_addr(SB)/4, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_utimensat_trampoline_addr(SB)/4, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
index 3a47aca7bf..1e775fe057 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -openbsd -tags openbsd,amd64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_amd64.go
+// go run mksyscall.go -openbsd -libc -tags openbsd,amd64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_amd64.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build openbsd && amd64
@@ -16,7 +16,7 @@ var _ syscall.Errno
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -24,20 +24,28 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	return
 }
 
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setgroups(ngid int, gid *_Gid_t) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
-	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -45,10 +53,14 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 	return
 }
 
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -56,30 +68,42 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	return
 }
 
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socket(domain int, typ int, proto int) (fd int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -87,66 +111,94 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	return
 }
 
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
-	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
-	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Shutdown(s int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
-	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
@@ -156,7 +208,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -164,6 +216,10 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	return
 }
 
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
@@ -173,17 +229,21 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -191,10 +251,14 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -202,10 +266,14 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -213,6 +281,10 @@ func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, ne
 	return
 }
 
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func utimes(path string, timeval *[2]Timeval) (err error) {
@@ -221,27 +293,35 @@ func utimes(path string, timeval *[2]Timeval) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func futimes(fd int, timeval *[2]Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -249,6 +329,10 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	return
 }
 
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Madvise(b []byte, behav int) (err error) {
@@ -258,13 +342,17 @@ func Madvise(b []byte, behav int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlock(b []byte) (err error) {
@@ -274,23 +362,31 @@ func Mlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlockall(flags int) (err error) {
-	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mprotect(b []byte, prot int) (err error) {
@@ -300,13 +396,17 @@ func Mprotect(b []byte, prot int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Msync(b []byte, flags int) (err error) {
@@ -316,13 +416,17 @@ func Msync(b []byte, flags int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlock(b []byte) (err error) {
@@ -332,33 +436,45 @@ func Munlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlockall() (err error) {
-	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -368,7 +484,7 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_GETDENTS, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -376,6 +492,10 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getcwd(buf []byte) (n int, err error) {
@@ -385,7 +505,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -393,16 +513,32 @@ func Getcwd(buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -412,17 +548,21 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -430,6 +570,10 @@ func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int,
 	return
 }
 
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Access(path string, mode uint32) (err error) {
@@ -438,23 +582,31 @@ func Access(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chdir(path string) (err error) {
@@ -463,13 +615,17 @@ func Chdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chflags(path string, flags int) (err error) {
@@ -478,13 +634,17 @@ func Chflags(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chmod(path string, mode uint32) (err error) {
@@ -493,13 +653,17 @@ func Chmod(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chown(path string, uid int, gid int) (err error) {
@@ -508,13 +672,17 @@ func Chown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chroot(path string) (err error) {
@@ -523,27 +691,49 @@ func Chroot(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Close(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup(fd int) (nfd int, err error) {
-	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -551,33 +741,49 @@ func Dup(fd int) (nfd int, err error) {
 	return
 }
 
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup2(from int, to int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup3(from int, to int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP3, uintptr(from), uintptr(to), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Exit(code int) {
-	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
 	return
 }
 
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -586,43 +792,59 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchdir(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchflags(fd int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmod(fd int, mode uint32) (err error) {
-	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -631,23 +853,31 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchown(fd int, uid int, gid int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
@@ -656,27 +886,35 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Flock(fd int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fpathconf(fd int, name int) (val int, err error) {
-	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -684,16 +922,24 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	return
 }
 
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
@@ -702,71 +948,99 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatfs(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fsync(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Ftruncate(fd int, length int64) (err error) {
-	_, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getegid() (egid int) {
-	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
 	egid = int(r0)
 	return
 }
 
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Geteuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getgid() (gid int) {
-	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
 	gid = int(r0)
 	return
 }
 
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgid(pid int) (pgid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -774,34 +1048,50 @@ func Getpgid(pid int) (pgid int, err error) {
 	return
 }
 
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgrp() (pgrp int) {
-	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
 	pgrp = int(r0)
 	return
 }
 
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpid() (pid int) {
-	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	return
 }
 
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getppid() (ppid int) {
-	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
 	ppid = int(r0)
 	return
 }
 
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpriority(which int, who int) (prio int, err error) {
-	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
 	prio = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -809,20 +1099,28 @@ func Getpriority(which int, who int) (prio int, err error) {
 	return
 }
 
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrtable() (rtable int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETRTABLE, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
 	rtable = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -830,20 +1128,28 @@ func Getrtable() (rtable int, err error) {
 	return
 }
 
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrusage(who int, rusage *Rusage) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getsid(pid int) (sid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -851,46 +1157,66 @@ func Getsid(pid int) (sid int, err error) {
 	return
 }
 
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Gettimeofday(tv *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Issetugid() (tainted bool) {
-	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
 	tainted = bool(r0 != 0)
 	return
 }
 
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kill(pid int, signum syscall.Signal) (err error) {
-	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kqueue() (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -898,6 +1224,10 @@ func Kqueue() (fd int, err error) {
 	return
 }
 
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lchown(path string, uid int, gid int) (err error) {
@@ -906,13 +1236,17 @@ func Lchown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Link(path string, link string) (err error) {
@@ -926,13 +1260,17 @@ func Link(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
@@ -946,23 +1284,31 @@ func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err er
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Listen(s int, backlog int) (err error) {
-	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lstat(path string, stat *Stat_t) (err error) {
@@ -971,13 +1317,17 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdir(path string, mode uint32) (err error) {
@@ -986,13 +1336,17 @@ func Mkdir(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdirat(dirfd int, path string, mode uint32) (err error) {
@@ -1001,13 +1355,17 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifo(path string, mode uint32) (err error) {
@@ -1016,13 +1374,17 @@ func Mkfifo(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
@@ -1031,13 +1393,17 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFOAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknod(path string, mode uint32, dev int) (err error) {
@@ -1046,13 +1412,17 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
@@ -1061,23 +1431,31 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
-	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Open(path string, mode int, perm uint32) (fd int, err error) {
@@ -1086,7 +1464,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1094,6 +1472,10 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
@@ -1102,7 +1484,7 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1110,6 +1492,10 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Pathconf(path string, name int) (val int, err error) {
@@ -1118,7 +1504,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1126,16 +1512,20 @@ func Pathconf(path string, name int) (val int, err error) {
 	return
 }
 
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1143,16 +1533,20 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1160,6 +1554,10 @@ func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func read(fd int, p []byte) (n int, err error) {
@@ -1169,7 +1567,7 @@ func read(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1177,6 +1575,10 @@ func read(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlink(path string, buf []byte) (n int, err error) {
@@ -1191,7 +1593,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1199,6 +1601,10 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
@@ -1213,7 +1619,7 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1221,6 +1627,10 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rename(from string, to string) (err error) {
@@ -1234,13 +1644,17 @@ func Rename(from string, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Renameat(fromfd int, from string, tofd int, to string) (err error) {
@@ -1254,13 +1668,17 @@ func Renameat(fromfd int, from string, tofd int, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Revoke(path string) (err error) {
@@ -1269,13 +1687,17 @@ func Revoke(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rmdir(path string) (err error) {
@@ -1284,17 +1706,21 @@ func Rmdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
-	r0, _, e1 := Syscall6(SYS_LSEEK, uintptr(fd), 0, uintptr(offset), uintptr(whence), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(whence))
 	newoffset = int64(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1302,10 +1728,14 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return
 }
 
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1313,36 +1743,52 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	return
 }
 
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setegid(egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seteuid(euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setgid(gid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setlogin(name string) (err error) {
@@ -1351,97 +1797,119 @@ func Setlogin(name string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpgid(pid int, pgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpriority(which int, who int, prio int) (err error) {
-	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+var libc_setresuid_trampoline_addr uintptr
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrtable(rtable int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRTABLE, uintptr(rtable), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setsid() (pid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1449,26 +1917,38 @@ func Setsid() (pid int, err error) {
 	return
 }
 
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Settimeofday(tp *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setuid(uid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Stat(path string, stat *Stat_t) (err error) {
@@ -1477,13 +1957,17 @@ func Stat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Statfs(path string, stat *Statfs_t) (err error) {
@@ -1492,13 +1976,17 @@ func Statfs(path string, stat *Statfs_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlink(path string, link string) (err error) {
@@ -1512,13 +2000,17 @@ func Symlink(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
@@ -1532,23 +2024,31 @@ func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Sync() (err error) {
-	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Truncate(path string, length int64) (err error) {
@@ -1557,21 +2057,29 @@ func Truncate(path string, length int64) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Umask(newmask int) (oldmask int) {
-	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
 	oldmask = int(r0)
 	return
 }
 
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlink(path string) (err error) {
@@ -1580,13 +2088,17 @@ func Unlink(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlinkat(dirfd int, path string, flags int) (err error) {
@@ -1595,13 +2107,17 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unmount(path string, flags int) (err error) {
@@ -1610,13 +2126,17 @@ func Unmount(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func write(fd int, p []byte) (n int, err error) {
@@ -1626,7 +2146,7 @@ func write(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1634,10 +2154,14 @@ func write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
-	r0, _, e1 := Syscall9(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
 	ret = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1645,20 +2169,28 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	return
 }
 
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func munmap(addr uintptr, length uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1669,7 +2201,7 @@ func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1685,9 +2217,13 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
new file mode 100644
index 0000000000..27b6f4df74
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.s
@@ -0,0 +1,664 @@
+// go run mkasm.go openbsd amd64
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
+DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
+DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
+DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
+DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
+DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
+DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
+DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
+DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
+DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
+DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
+DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
+DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
+DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
+DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
+DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
index 883a9b45e8..7f6427899a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -l32 -openbsd -arm -tags openbsd,arm syscall_bsd.go syscall_openbsd.go syscall_openbsd_arm.go
+// go run mksyscall.go -l32 -openbsd -arm -libc -tags openbsd,arm syscall_bsd.go syscall_openbsd.go syscall_openbsd_arm.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build openbsd && arm
@@ -16,7 +16,7 @@ var _ syscall.Errno
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -24,20 +24,28 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	return
 }
 
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setgroups(ngid int, gid *_Gid_t) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
-	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -45,10 +53,14 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 	return
 }
 
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -56,30 +68,42 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	return
 }
 
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socket(domain int, typ int, proto int) (fd int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -87,66 +111,94 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	return
 }
 
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
-	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
-	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Shutdown(s int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
-	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
@@ -156,7 +208,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -164,6 +216,10 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	return
 }
 
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
@@ -173,17 +229,21 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -191,10 +251,14 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -202,10 +266,14 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -213,6 +281,10 @@ func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, ne
 	return
 }
 
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func utimes(path string, timeval *[2]Timeval) (err error) {
@@ -221,27 +293,35 @@ func utimes(path string, timeval *[2]Timeval) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func futimes(fd int, timeval *[2]Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -249,6 +329,10 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	return
 }
 
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Madvise(b []byte, behav int) (err error) {
@@ -258,13 +342,17 @@ func Madvise(b []byte, behav int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlock(b []byte) (err error) {
@@ -274,23 +362,31 @@ func Mlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlockall(flags int) (err error) {
-	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mprotect(b []byte, prot int) (err error) {
@@ -300,13 +396,17 @@ func Mprotect(b []byte, prot int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Msync(b []byte, flags int) (err error) {
@@ -316,13 +416,17 @@ func Msync(b []byte, flags int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlock(b []byte) (err error) {
@@ -332,33 +436,45 @@ func Munlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlockall() (err error) {
-	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -368,7 +484,7 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_GETDENTS, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -376,6 +492,10 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getcwd(buf []byte) (n int, err error) {
@@ -385,7 +505,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -393,16 +513,32 @@ func Getcwd(buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -412,17 +548,21 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -430,6 +570,10 @@ func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int,
 	return
 }
 
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Access(path string, mode uint32) (err error) {
@@ -438,23 +582,31 @@ func Access(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chdir(path string) (err error) {
@@ -463,13 +615,17 @@ func Chdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chflags(path string, flags int) (err error) {
@@ -478,13 +634,17 @@ func Chflags(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chmod(path string, mode uint32) (err error) {
@@ -493,13 +653,17 @@ func Chmod(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chown(path string, uid int, gid int) (err error) {
@@ -508,13 +672,17 @@ func Chown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chroot(path string) (err error) {
@@ -523,27 +691,49 @@ func Chroot(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Close(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup(fd int) (nfd int, err error) {
-	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -551,33 +741,49 @@ func Dup(fd int) (nfd int, err error) {
 	return
 }
 
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup2(from int, to int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup3(from int, to int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP3, uintptr(from), uintptr(to), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Exit(code int) {
-	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
 	return
 }
 
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -586,43 +792,59 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchdir(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchflags(fd int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmod(fd int, mode uint32) (err error) {
-	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -631,23 +853,31 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchown(fd int, uid int, gid int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
@@ -656,27 +886,35 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Flock(fd int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fpathconf(fd int, name int) (val int, err error) {
-	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -684,16 +922,24 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	return
 }
 
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
@@ -702,71 +948,99 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatfs(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fsync(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Ftruncate(fd int, length int64) (err error) {
-	_, _, e1 := Syscall6(SYS_FTRUNCATE, uintptr(fd), 0, uintptr(length), uintptr(length>>32), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_ftruncate_trampoline_addr, uintptr(fd), 0, uintptr(length), uintptr(length>>32), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getegid() (egid int) {
-	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
 	egid = int(r0)
 	return
 }
 
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Geteuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getgid() (gid int) {
-	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
 	gid = int(r0)
 	return
 }
 
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgid(pid int) (pgid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -774,34 +1048,50 @@ func Getpgid(pid int) (pgid int, err error) {
 	return
 }
 
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgrp() (pgrp int) {
-	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
 	pgrp = int(r0)
 	return
 }
 
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpid() (pid int) {
-	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	return
 }
 
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getppid() (ppid int) {
-	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
 	ppid = int(r0)
 	return
 }
 
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpriority(which int, who int) (prio int, err error) {
-	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
 	prio = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -809,20 +1099,28 @@ func Getpriority(which int, who int) (prio int, err error) {
 	return
 }
 
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrtable() (rtable int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETRTABLE, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
 	rtable = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -830,20 +1128,28 @@ func Getrtable() (rtable int, err error) {
 	return
 }
 
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrusage(who int, rusage *Rusage) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getsid(pid int) (sid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -851,46 +1157,66 @@ func Getsid(pid int) (sid int, err error) {
 	return
 }
 
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Gettimeofday(tv *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Issetugid() (tainted bool) {
-	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
 	tainted = bool(r0 != 0)
 	return
 }
 
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kill(pid int, signum syscall.Signal) (err error) {
-	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kqueue() (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -898,6 +1224,10 @@ func Kqueue() (fd int, err error) {
 	return
 }
 
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lchown(path string, uid int, gid int) (err error) {
@@ -906,13 +1236,17 @@ func Lchown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Link(path string, link string) (err error) {
@@ -926,13 +1260,17 @@ func Link(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
@@ -946,23 +1284,31 @@ func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err er
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Listen(s int, backlog int) (err error) {
-	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lstat(path string, stat *Stat_t) (err error) {
@@ -971,13 +1317,17 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdir(path string, mode uint32) (err error) {
@@ -986,13 +1336,17 @@ func Mkdir(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdirat(dirfd int, path string, mode uint32) (err error) {
@@ -1001,13 +1355,17 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifo(path string, mode uint32) (err error) {
@@ -1016,13 +1374,17 @@ func Mkfifo(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
@@ -1031,13 +1393,17 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFOAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknod(path string, mode uint32, dev int) (err error) {
@@ -1046,13 +1412,17 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
@@ -1061,23 +1431,31 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
-	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Open(path string, mode int, perm uint32) (fd int, err error) {
@@ -1086,7 +1464,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1094,6 +1472,10 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
@@ -1102,7 +1484,7 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1110,6 +1492,10 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Pathconf(path string, name int) (val int, err error) {
@@ -1118,7 +1504,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1126,16 +1512,20 @@ func Pathconf(path string, name int) (val int, err error) {
 	return
 }
 
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), uintptr(offset>>32))
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), uintptr(offset>>32))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1143,16 +1533,20 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), uintptr(offset>>32))
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), uintptr(offset>>32))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1160,6 +1554,10 @@ func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func read(fd int, p []byte) (n int, err error) {
@@ -1169,7 +1567,7 @@ func read(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1177,6 +1575,10 @@ func read(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlink(path string, buf []byte) (n int, err error) {
@@ -1191,7 +1593,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1199,6 +1601,10 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
@@ -1213,7 +1619,7 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1221,6 +1627,10 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rename(from string, to string) (err error) {
@@ -1234,13 +1644,17 @@ func Rename(from string, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Renameat(fromfd int, from string, tofd int, to string) (err error) {
@@ -1254,13 +1668,17 @@ func Renameat(fromfd int, from string, tofd int, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Revoke(path string) (err error) {
@@ -1269,13 +1687,17 @@ func Revoke(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rmdir(path string) (err error) {
@@ -1284,17 +1706,21 @@ func Rmdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
-	r0, r1, e1 := Syscall6(SYS_LSEEK, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(whence), 0)
+	r0, r1, e1 := syscall_syscall6(libc_lseek_trampoline_addr, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(whence), 0)
 	newoffset = int64(int64(r1)<<32 | int64(r0))
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1302,10 +1728,14 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return
 }
 
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1313,36 +1743,52 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	return
 }
 
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setegid(egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seteuid(euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setgid(gid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setlogin(name string) (err error) {
@@ -1351,97 +1797,119 @@ func Setlogin(name string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpgid(pid int, pgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpriority(which int, who int, prio int) (err error) {
-	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+var libc_setresuid_trampoline_addr uintptr
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrtable(rtable int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRTABLE, uintptr(rtable), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setsid() (pid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1449,26 +1917,38 @@ func Setsid() (pid int, err error) {
 	return
 }
 
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Settimeofday(tp *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setuid(uid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Stat(path string, stat *Stat_t) (err error) {
@@ -1477,13 +1957,17 @@ func Stat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Statfs(path string, stat *Statfs_t) (err error) {
@@ -1492,13 +1976,17 @@ func Statfs(path string, stat *Statfs_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlink(path string, link string) (err error) {
@@ -1512,13 +2000,17 @@ func Symlink(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
@@ -1532,23 +2024,31 @@ func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Sync() (err error) {
-	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Truncate(path string, length int64) (err error) {
@@ -1557,21 +2057,29 @@ func Truncate(path string, length int64) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length), uintptr(length>>32), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length), uintptr(length>>32), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Umask(newmask int) (oldmask int) {
-	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
 	oldmask = int(r0)
 	return
 }
 
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlink(path string) (err error) {
@@ -1580,13 +2088,17 @@ func Unlink(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlinkat(dirfd int, path string, flags int) (err error) {
@@ -1595,13 +2107,17 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unmount(path string, flags int) (err error) {
@@ -1610,13 +2126,17 @@ func Unmount(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func write(fd int, p []byte) (n int, err error) {
@@ -1626,7 +2146,7 @@ func write(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1634,10 +2154,14 @@ func write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
-	r0, _, e1 := Syscall9(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), uintptr(pos>>32), 0)
+	r0, _, e1 := syscall_syscall9(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), uintptr(pos>>32), 0)
 	ret = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1645,20 +2169,28 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	return
 }
 
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func munmap(addr uintptr, length uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1669,7 +2201,7 @@ func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1685,9 +2217,13 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
new file mode 100644
index 0000000000..b797045fd2
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.s
@@ -0,0 +1,664 @@
+// go run mkasm.go openbsd arm
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getgroups_trampoline_addr(SB)/4, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setgroups_trampoline_addr(SB)/4, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $4
+DATA	·libc_wait4_trampoline_addr(SB)/4, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $4
+DATA	·libc_accept_trampoline_addr(SB)/4, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $4
+DATA	·libc_bind_trampoline_addr(SB)/4, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $4
+DATA	·libc_connect_trampoline_addr(SB)/4, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $4
+DATA	·libc_socket_trampoline_addr(SB)/4, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getsockopt_trampoline_addr(SB)/4, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setsockopt_trampoline_addr(SB)/4, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpeername_trampoline_addr(SB)/4, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getsockname_trampoline_addr(SB)/4, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_shutdown_trampoline_addr(SB)/4, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $4
+DATA	·libc_socketpair_trampoline_addr(SB)/4, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $4
+DATA	·libc_recvfrom_trampoline_addr(SB)/4, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sendto_trampoline_addr(SB)/4, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $4
+DATA	·libc_recvmsg_trampoline_addr(SB)/4, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sendmsg_trampoline_addr(SB)/4, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $4
+DATA	·libc_kevent_trampoline_addr(SB)/4, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $4
+DATA	·libc_utimes_trampoline_addr(SB)/4, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $4
+DATA	·libc_futimes_trampoline_addr(SB)/4, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $4
+DATA	·libc_poll_trampoline_addr(SB)/4, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $4
+DATA	·libc_madvise_trampoline_addr(SB)/4, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mlock_trampoline_addr(SB)/4, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mlockall_trampoline_addr(SB)/4, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mprotect_trampoline_addr(SB)/4, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $4
+DATA	·libc_msync_trampoline_addr(SB)/4, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $4
+DATA	·libc_munlock_trampoline_addr(SB)/4, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $4
+DATA	·libc_munlockall_trampoline_addr(SB)/4, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pipe2_trampoline_addr(SB)/4, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getdents_trampoline_addr(SB)/4, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getcwd_trampoline_addr(SB)/4, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $4
+DATA	·libc_ioctl_trampoline_addr(SB)/4, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sysctl_trampoline_addr(SB)/4, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $4
+DATA	·libc_ppoll_trampoline_addr(SB)/4, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $4
+DATA	·libc_access_trampoline_addr(SB)/4, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $4
+DATA	·libc_adjtime_trampoline_addr(SB)/4, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chdir_trampoline_addr(SB)/4, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chflags_trampoline_addr(SB)/4, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chmod_trampoline_addr(SB)/4, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chown_trampoline_addr(SB)/4, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $4
+DATA	·libc_chroot_trampoline_addr(SB)/4, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $4
+DATA	·libc_clock_gettime_trampoline_addr(SB)/4, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $4
+DATA	·libc_close_trampoline_addr(SB)/4, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $4
+DATA	·libc_dup_trampoline_addr(SB)/4, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $4
+DATA	·libc_dup2_trampoline_addr(SB)/4, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $4
+DATA	·libc_dup3_trampoline_addr(SB)/4, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $4
+DATA	·libc_exit_trampoline_addr(SB)/4, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_faccessat_trampoline_addr(SB)/4, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchdir_trampoline_addr(SB)/4, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchflags_trampoline_addr(SB)/4, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchmod_trampoline_addr(SB)/4, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchmodat_trampoline_addr(SB)/4, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchown_trampoline_addr(SB)/4, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fchownat_trampoline_addr(SB)/4, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $4
+DATA	·libc_flock_trampoline_addr(SB)/4, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fpathconf_trampoline_addr(SB)/4, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fstat_trampoline_addr(SB)/4, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fstatat_trampoline_addr(SB)/4, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fstatfs_trampoline_addr(SB)/4, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $4
+DATA	·libc_fsync_trampoline_addr(SB)/4, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $4
+DATA	·libc_ftruncate_trampoline_addr(SB)/4, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getegid_trampoline_addr(SB)/4, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_geteuid_trampoline_addr(SB)/4, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getgid_trampoline_addr(SB)/4, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpgid_trampoline_addr(SB)/4, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpgrp_trampoline_addr(SB)/4, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpid_trampoline_addr(SB)/4, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getppid_trampoline_addr(SB)/4, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getpriority_trampoline_addr(SB)/4, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getrlimit_trampoline_addr(SB)/4, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getrtable_trampoline_addr(SB)/4, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getrusage_trampoline_addr(SB)/4, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getsid_trampoline_addr(SB)/4, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $4
+DATA	·libc_gettimeofday_trampoline_addr(SB)/4, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_getuid_trampoline_addr(SB)/4, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_issetugid_trampoline_addr(SB)/4, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $4
+DATA	·libc_kill_trampoline_addr(SB)/4, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $4
+DATA	·libc_kqueue_trampoline_addr(SB)/4, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $4
+DATA	·libc_lchown_trampoline_addr(SB)/4, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $4
+DATA	·libc_link_trampoline_addr(SB)/4, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_linkat_trampoline_addr(SB)/4, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $4
+DATA	·libc_listen_trampoline_addr(SB)/4, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_lstat_trampoline_addr(SB)/4, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkdir_trampoline_addr(SB)/4, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkdirat_trampoline_addr(SB)/4, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkfifo_trampoline_addr(SB)/4, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mkfifoat_trampoline_addr(SB)/4, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mknod_trampoline_addr(SB)/4, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mknodat_trampoline_addr(SB)/4, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $4
+DATA	·libc_nanosleep_trampoline_addr(SB)/4, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $4
+DATA	·libc_open_trampoline_addr(SB)/4, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_openat_trampoline_addr(SB)/4, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pathconf_trampoline_addr(SB)/4, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pread_trampoline_addr(SB)/4, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $4
+DATA	·libc_pwrite_trampoline_addr(SB)/4, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $4
+DATA	·libc_read_trampoline_addr(SB)/4, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $4
+DATA	·libc_readlink_trampoline_addr(SB)/4, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_readlinkat_trampoline_addr(SB)/4, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $4
+DATA	·libc_rename_trampoline_addr(SB)/4, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_renameat_trampoline_addr(SB)/4, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $4
+DATA	·libc_revoke_trampoline_addr(SB)/4, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $4
+DATA	·libc_rmdir_trampoline_addr(SB)/4, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $4
+DATA	·libc_lseek_trampoline_addr(SB)/4, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $4
+DATA	·libc_select_trampoline_addr(SB)/4, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setegid_trampoline_addr(SB)/4, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_seteuid_trampoline_addr(SB)/4, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setgid_trampoline_addr(SB)/4, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setlogin_trampoline_addr(SB)/4, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setpgid_trampoline_addr(SB)/4, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setpriority_trampoline_addr(SB)/4, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setregid_trampoline_addr(SB)/4, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setreuid_trampoline_addr(SB)/4, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setresgid_trampoline_addr(SB)/4, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setresuid_trampoline_addr(SB)/4, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setrtable_trampoline_addr(SB)/4, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setsid_trampoline_addr(SB)/4, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $4
+DATA	·libc_settimeofday_trampoline_addr(SB)/4, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $4
+DATA	·libc_setuid_trampoline_addr(SB)/4, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_stat_trampoline_addr(SB)/4, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $4
+DATA	·libc_statfs_trampoline_addr(SB)/4, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $4
+DATA	·libc_symlink_trampoline_addr(SB)/4, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_symlinkat_trampoline_addr(SB)/4, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $4
+DATA	·libc_sync_trampoline_addr(SB)/4, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $4
+DATA	·libc_truncate_trampoline_addr(SB)/4, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $4
+DATA	·libc_umask_trampoline_addr(SB)/4, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $4
+DATA	·libc_unlink_trampoline_addr(SB)/4, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_unlinkat_trampoline_addr(SB)/4, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $4
+DATA	·libc_unmount_trampoline_addr(SB)/4, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $4
+DATA	·libc_write_trampoline_addr(SB)/4, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $4
+DATA	·libc_mmap_trampoline_addr(SB)/4, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $4
+DATA	·libc_munmap_trampoline_addr(SB)/4, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $4
+DATA	·libc_utimensat_trampoline_addr(SB)/4, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
index aac7fdc95e..756ef7b173 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -openbsd -tags openbsd,arm64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_arm64.go
+// go run mksyscall.go -openbsd -libc -tags openbsd,arm64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_arm64.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build openbsd && arm64
@@ -16,7 +16,7 @@ var _ syscall.Errno
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -24,20 +24,28 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	return
 }
 
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setgroups(ngid int, gid *_Gid_t) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
-	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -45,10 +53,14 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 	return
 }
 
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -56,30 +68,42 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	return
 }
 
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socket(domain int, typ int, proto int) (fd int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -87,66 +111,94 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	return
 }
 
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
-	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
-	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Shutdown(s int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
-	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
@@ -156,7 +208,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -164,6 +216,10 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	return
 }
 
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
@@ -173,17 +229,21 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -191,10 +251,14 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -202,10 +266,14 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -213,6 +281,10 @@ func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, ne
 	return
 }
 
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func utimes(path string, timeval *[2]Timeval) (err error) {
@@ -221,27 +293,35 @@ func utimes(path string, timeval *[2]Timeval) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func futimes(fd int, timeval *[2]Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -249,6 +329,10 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	return
 }
 
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Madvise(b []byte, behav int) (err error) {
@@ -258,13 +342,17 @@ func Madvise(b []byte, behav int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlock(b []byte) (err error) {
@@ -274,23 +362,31 @@ func Mlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlockall(flags int) (err error) {
-	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mprotect(b []byte, prot int) (err error) {
@@ -300,13 +396,17 @@ func Mprotect(b []byte, prot int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Msync(b []byte, flags int) (err error) {
@@ -316,13 +416,17 @@ func Msync(b []byte, flags int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlock(b []byte) (err error) {
@@ -332,33 +436,45 @@ func Munlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlockall() (err error) {
-	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -368,7 +484,7 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_GETDENTS, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -376,6 +492,10 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getcwd(buf []byte) (n int, err error) {
@@ -385,7 +505,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -393,16 +513,32 @@ func Getcwd(buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -412,17 +548,21 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -430,6 +570,10 @@ func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int,
 	return
 }
 
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Access(path string, mode uint32) (err error) {
@@ -438,23 +582,31 @@ func Access(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chdir(path string) (err error) {
@@ -463,13 +615,17 @@ func Chdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chflags(path string, flags int) (err error) {
@@ -478,13 +634,17 @@ func Chflags(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chmod(path string, mode uint32) (err error) {
@@ -493,13 +653,17 @@ func Chmod(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chown(path string, uid int, gid int) (err error) {
@@ -508,13 +672,17 @@ func Chown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chroot(path string) (err error) {
@@ -523,27 +691,49 @@ func Chroot(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Close(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup(fd int) (nfd int, err error) {
-	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -551,33 +741,49 @@ func Dup(fd int) (nfd int, err error) {
 	return
 }
 
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup2(from int, to int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup3(from int, to int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP3, uintptr(from), uintptr(to), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Exit(code int) {
-	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
 	return
 }
 
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -586,43 +792,59 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchdir(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchflags(fd int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmod(fd int, mode uint32) (err error) {
-	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -631,23 +853,31 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchown(fd int, uid int, gid int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
@@ -656,27 +886,35 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Flock(fd int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fpathconf(fd int, name int) (val int, err error) {
-	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -684,16 +922,24 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	return
 }
 
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
@@ -702,71 +948,99 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatfs(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fsync(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Ftruncate(fd int, length int64) (err error) {
-	_, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getegid() (egid int) {
-	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
 	egid = int(r0)
 	return
 }
 
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Geteuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getgid() (gid int) {
-	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
 	gid = int(r0)
 	return
 }
 
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgid(pid int) (pgid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -774,34 +1048,50 @@ func Getpgid(pid int) (pgid int, err error) {
 	return
 }
 
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgrp() (pgrp int) {
-	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
 	pgrp = int(r0)
 	return
 }
 
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpid() (pid int) {
-	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	return
 }
 
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getppid() (ppid int) {
-	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
 	ppid = int(r0)
 	return
 }
 
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpriority(which int, who int) (prio int, err error) {
-	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
 	prio = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -809,20 +1099,28 @@ func Getpriority(which int, who int) (prio int, err error) {
 	return
 }
 
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrtable() (rtable int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETRTABLE, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
 	rtable = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -830,20 +1128,28 @@ func Getrtable() (rtable int, err error) {
 	return
 }
 
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrusage(who int, rusage *Rusage) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getsid(pid int) (sid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -851,46 +1157,66 @@ func Getsid(pid int) (sid int, err error) {
 	return
 }
 
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Gettimeofday(tv *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Issetugid() (tainted bool) {
-	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
 	tainted = bool(r0 != 0)
 	return
 }
 
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kill(pid int, signum syscall.Signal) (err error) {
-	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kqueue() (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -898,6 +1224,10 @@ func Kqueue() (fd int, err error) {
 	return
 }
 
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lchown(path string, uid int, gid int) (err error) {
@@ -906,13 +1236,17 @@ func Lchown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Link(path string, link string) (err error) {
@@ -926,13 +1260,17 @@ func Link(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
@@ -946,23 +1284,31 @@ func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err er
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Listen(s int, backlog int) (err error) {
-	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lstat(path string, stat *Stat_t) (err error) {
@@ -971,13 +1317,17 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdir(path string, mode uint32) (err error) {
@@ -986,13 +1336,17 @@ func Mkdir(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdirat(dirfd int, path string, mode uint32) (err error) {
@@ -1001,13 +1355,17 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifo(path string, mode uint32) (err error) {
@@ -1016,13 +1374,17 @@ func Mkfifo(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
@@ -1031,13 +1393,17 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFOAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknod(path string, mode uint32, dev int) (err error) {
@@ -1046,13 +1412,17 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
@@ -1061,23 +1431,31 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
-	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Open(path string, mode int, perm uint32) (fd int, err error) {
@@ -1086,7 +1464,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1094,6 +1472,10 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
@@ -1102,7 +1484,7 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1110,6 +1492,10 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Pathconf(path string, name int) (val int, err error) {
@@ -1118,7 +1504,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1126,16 +1512,20 @@ func Pathconf(path string, name int) (val int, err error) {
 	return
 }
 
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1143,16 +1533,20 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1160,6 +1554,10 @@ func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func read(fd int, p []byte) (n int, err error) {
@@ -1169,7 +1567,7 @@ func read(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1177,6 +1575,10 @@ func read(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlink(path string, buf []byte) (n int, err error) {
@@ -1191,7 +1593,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1199,6 +1601,10 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
@@ -1213,7 +1619,7 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1221,6 +1627,10 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rename(from string, to string) (err error) {
@@ -1234,13 +1644,17 @@ func Rename(from string, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Renameat(fromfd int, from string, tofd int, to string) (err error) {
@@ -1254,13 +1668,17 @@ func Renameat(fromfd int, from string, tofd int, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Revoke(path string) (err error) {
@@ -1269,13 +1687,17 @@ func Revoke(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rmdir(path string) (err error) {
@@ -1284,17 +1706,21 @@ func Rmdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
-	r0, _, e1 := Syscall6(SYS_LSEEK, uintptr(fd), 0, uintptr(offset), uintptr(whence), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(whence))
 	newoffset = int64(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1302,10 +1728,14 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return
 }
 
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1313,36 +1743,52 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	return
 }
 
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setegid(egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seteuid(euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setgid(gid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setlogin(name string) (err error) {
@@ -1351,97 +1797,119 @@ func Setlogin(name string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpgid(pid int, pgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpriority(which int, who int, prio int) (err error) {
-	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+var libc_setresuid_trampoline_addr uintptr
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrtable(rtable int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRTABLE, uintptr(rtable), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setsid() (pid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1449,26 +1917,38 @@ func Setsid() (pid int, err error) {
 	return
 }
 
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Settimeofday(tp *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setuid(uid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Stat(path string, stat *Stat_t) (err error) {
@@ -1477,13 +1957,17 @@ func Stat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Statfs(path string, stat *Statfs_t) (err error) {
@@ -1492,13 +1976,17 @@ func Statfs(path string, stat *Statfs_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlink(path string, link string) (err error) {
@@ -1512,13 +2000,17 @@ func Symlink(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
@@ -1532,23 +2024,31 @@ func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Sync() (err error) {
-	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Truncate(path string, length int64) (err error) {
@@ -1557,21 +2057,29 @@ func Truncate(path string, length int64) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Umask(newmask int) (oldmask int) {
-	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
 	oldmask = int(r0)
 	return
 }
 
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlink(path string) (err error) {
@@ -1580,13 +2088,17 @@ func Unlink(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlinkat(dirfd int, path string, flags int) (err error) {
@@ -1595,13 +2107,17 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unmount(path string, flags int) (err error) {
@@ -1610,13 +2126,17 @@ func Unmount(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func write(fd int, p []byte) (n int, err error) {
@@ -1626,7 +2146,7 @@ func write(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1634,10 +2154,14 @@ func write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
-	r0, _, e1 := Syscall9(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
 	ret = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1645,20 +2169,28 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	return
 }
 
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func munmap(addr uintptr, length uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1669,7 +2201,7 @@ func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1685,9 +2217,13 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
new file mode 100644
index 0000000000..a871266221
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.s
@@ -0,0 +1,664 @@
+// go run mkasm.go openbsd arm64
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
+DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
+DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
+DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
+DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
+DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
+DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
+DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
+DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
+DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
+DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
+DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
+DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
+DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
+DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
+DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
index 8776187462..7bc2e24eb9 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
@@ -1,4 +1,4 @@
-// go run mksyscall.go -openbsd -tags openbsd,mips64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_mips64.go
+// go run mksyscall.go -openbsd -libc -tags openbsd,mips64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_mips64.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build openbsd && mips64
@@ -16,7 +16,7 @@ var _ syscall.Errno
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -24,20 +24,28 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	return
 }
 
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setgroups(ngid int, gid *_Gid_t) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGROUPS, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
-	r0, _, e1 := Syscall6(SYS_WAIT4, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -45,10 +53,14 @@ func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err
 	return
 }
 
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_ACCEPT, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -56,30 +68,42 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	return
 }
 
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_BIND, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
-	_, _, e1 := Syscall(SYS_CONNECT, uintptr(s), uintptr(addr), uintptr(addrlen))
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socket(domain int, typ int, proto int) (fd int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SOCKET, uintptr(domain), uintptr(typ), uintptr(proto))
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -87,66 +111,94 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	return
 }
 
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
-	_, _, e1 := Syscall6(SYS_GETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
-	_, _, e1 := Syscall6(SYS_SETSOCKOPT, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETPEERNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETSOCKNAME, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Shutdown(s int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_SHUTDOWN, uintptr(s), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
-	_, _, e1 := RawSyscall6(SYS_SOCKETPAIR, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
@@ -156,7 +208,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_RECVFROM, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -164,6 +216,10 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	return
 }
 
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
@@ -173,17 +229,21 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS_SENDTO, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_RECVMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -191,10 +251,14 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_SENDMSG, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -202,10 +266,14 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	return
 }
 
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_KEVENT, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -213,6 +281,10 @@ func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, ne
 	return
 }
 
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func utimes(path string, timeval *[2]Timeval) (err error) {
@@ -221,27 +293,35 @@ func utimes(path string, timeval *[2]Timeval) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UTIMES, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func futimes(fd int, timeval *[2]Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_FUTIMES, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_POLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -249,6 +329,10 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	return
 }
 
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Madvise(b []byte, behav int) (err error) {
@@ -258,13 +342,17 @@ func Madvise(b []byte, behav int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MADVISE, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlock(b []byte) (err error) {
@@ -274,23 +362,31 @@ func Mlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mlockall(flags int) (err error) {
-	_, _, e1 := Syscall(SYS_MLOCKALL, uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mprotect(b []byte, prot int) (err error) {
@@ -300,13 +396,17 @@ func Mprotect(b []byte, prot int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MPROTECT, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Msync(b []byte, flags int) (err error) {
@@ -316,13 +416,17 @@ func Msync(b []byte, flags int) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MSYNC, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlock(b []byte) (err error) {
@@ -332,33 +436,45 @@ func Munlock(b []byte) (err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall(SYS_MUNLOCK, uintptr(_p0), uintptr(len(b)), 0)
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Munlockall() (err error) {
-	_, _, e1 := Syscall(SYS_MUNLOCKALL, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func pipe2(p *[2]_C_int, flags int) (err error) {
-	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getdents(fd int, buf []byte) (n int, err error) {
@@ -368,7 +484,7 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_GETDENTS, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -376,6 +492,10 @@ func Getdents(fd int, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getcwd(buf []byte) (n int, err error) {
@@ -385,7 +505,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS___GETCWD, uintptr(_p0), uintptr(len(buf)), 0)
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -393,16 +513,32 @@ func Getcwd(buf []byte) (n int, err error) {
 	return
 }
 
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -412,17 +548,21 @@ func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr)
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	_, _, e1 := Syscall6(SYS___SYSCTL, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_PPOLL, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -430,6 +570,10 @@ func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int,
 	return
 }
 
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Access(path string, mode uint32) (err error) {
@@ -438,23 +582,31 @@ func Access(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_ACCESS, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
-	_, _, e1 := Syscall(SYS_ADJTIME, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chdir(path string) (err error) {
@@ -463,13 +615,17 @@ func Chdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chflags(path string, flags int) (err error) {
@@ -478,13 +634,17 @@ func Chflags(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHFLAGS, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chmod(path string, mode uint32) (err error) {
@@ -493,13 +653,17 @@ func Chmod(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHMOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chown(path string, uid int, gid int) (err error) {
@@ -508,13 +672,17 @@ func Chown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Chroot(path string) (err error) {
@@ -523,27 +691,49 @@ func Chroot(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_CHROOT, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Close(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_CLOSE, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup(fd int) (nfd int, err error) {
-	r0, _, e1 := Syscall(SYS_DUP, uintptr(fd), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -551,33 +741,49 @@ func Dup(fd int) (nfd int, err error) {
 	return
 }
 
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup2(from int, to int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP2, uintptr(from), uintptr(to), 0)
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Dup3(from int, to int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_DUP3, uintptr(from), uintptr(to), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Exit(code int) {
-	Syscall(SYS_EXIT, uintptr(code), 0, 0)
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
 	return
 }
 
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -586,43 +792,59 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FACCESSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchdir(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHDIR, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchflags(fd int, flags int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHFLAGS, uintptr(fd), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmod(fd int, mode uint32) (err error) {
-	_, _, e1 := Syscall(SYS_FCHMOD, uintptr(fd), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
@@ -631,23 +853,31 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHMODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchown(fd int, uid int, gid int) (err error) {
-	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
@@ -656,27 +886,35 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FCHOWNAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Flock(fd int, how int) (err error) {
-	_, _, e1 := Syscall(SYS_FLOCK, uintptr(fd), uintptr(how), 0)
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fpathconf(fd int, name int) (val int, err error) {
-	r0, _, e1 := Syscall(SYS_FPATHCONF, uintptr(fd), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -684,16 +922,24 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	return
 }
 
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstat(fd int, stat *Stat_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTAT, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
@@ -702,71 +948,99 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_FSTATAT, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fstatfs(fd int, stat *Statfs_t) (err error) {
-	_, _, e1 := Syscall(SYS_FSTATFS, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Fsync(fd int) (err error) {
-	_, _, e1 := Syscall(SYS_FSYNC, uintptr(fd), 0, 0)
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Ftruncate(fd int, length int64) (err error) {
-	_, _, e1 := Syscall(SYS_FTRUNCATE, uintptr(fd), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getegid() (egid int) {
-	r0, _, _ := RawSyscall(SYS_GETEGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
 	egid = int(r0)
 	return
 }
 
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Geteuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETEUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getgid() (gid int) {
-	r0, _, _ := RawSyscall(SYS_GETGID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
 	gid = int(r0)
 	return
 }
 
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgid(pid int) (pgid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETPGID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -774,34 +1048,50 @@ func Getpgid(pid int) (pgid int, err error) {
 	return
 }
 
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpgrp() (pgrp int) {
-	r0, _, _ := RawSyscall(SYS_GETPGRP, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
 	pgrp = int(r0)
 	return
 }
 
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpid() (pid int) {
-	r0, _, _ := RawSyscall(SYS_GETPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	return
 }
 
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getppid() (ppid int) {
-	r0, _, _ := RawSyscall(SYS_GETPPID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
 	ppid = int(r0)
 	return
 }
 
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getpriority(which int, who int) (prio int, err error) {
-	r0, _, e1 := Syscall(SYS_GETPRIORITY, uintptr(which), uintptr(who), 0)
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
 	prio = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -809,20 +1099,28 @@ func Getpriority(which int, who int) (prio int, err error) {
 	return
 }
 
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrtable() (rtable int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETRTABLE, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
 	rtable = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -830,20 +1128,28 @@ func Getrtable() (rtable int, err error) {
 	return
 }
 
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getrusage(who int, rusage *Rusage) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETRUSAGE, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getsid(pid int) (sid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_GETSID, uintptr(pid), 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -851,46 +1157,66 @@ func Getsid(pid int) (sid int, err error) {
 	return
 }
 
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Gettimeofday(tv *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_GETTIMEOFDAY, uintptr(unsafe.Pointer(tv)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Getuid() (uid int) {
-	r0, _, _ := RawSyscall(SYS_GETUID, 0, 0, 0)
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
 	uid = int(r0)
 	return
 }
 
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Issetugid() (tainted bool) {
-	r0, _, _ := Syscall(SYS_ISSETUGID, 0, 0, 0)
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
 	tainted = bool(r0 != 0)
 	return
 }
 
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kill(pid int, signum syscall.Signal) (err error) {
-	_, _, e1 := Syscall(SYS_KILL, uintptr(pid), uintptr(signum), 0)
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Kqueue() (fd int, err error) {
-	r0, _, e1 := Syscall(SYS_KQUEUE, 0, 0, 0)
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -898,6 +1224,10 @@ func Kqueue() (fd int, err error) {
 	return
 }
 
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lchown(path string, uid int, gid int) (err error) {
@@ -906,13 +1236,17 @@ func Lchown(path string, uid int, gid int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LCHOWN, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Link(path string, link string) (err error) {
@@ -926,13 +1260,17 @@ func Link(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
@@ -946,23 +1284,31 @@ func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err er
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_LINKAT, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Listen(s int, backlog int) (err error) {
-	_, _, e1 := Syscall(SYS_LISTEN, uintptr(s), uintptr(backlog), 0)
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Lstat(path string, stat *Stat_t) (err error) {
@@ -971,13 +1317,17 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_LSTAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdir(path string, mode uint32) (err error) {
@@ -986,13 +1336,17 @@ func Mkdir(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIR, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkdirat(dirfd int, path string, mode uint32) (err error) {
@@ -1001,13 +1355,17 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKDIRAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifo(path string, mode uint32) (err error) {
@@ -1016,13 +1374,17 @@ func Mkfifo(path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFO, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
@@ -1031,13 +1393,17 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKFIFOAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknod(path string, mode uint32, dev int) (err error) {
@@ -1046,13 +1412,17 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_MKNOD, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
@@ -1061,23 +1431,31 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_MKNODAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
-	_, _, e1 := Syscall(SYS_NANOSLEEP, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Open(path string, mode int, perm uint32) (fd int, err error) {
@@ -1086,7 +1464,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_OPEN, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1094,6 +1472,10 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
@@ -1102,7 +1484,7 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall6(SYS_OPENAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1110,6 +1492,10 @@ func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
 	return
 }
 
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Pathconf(path string, name int) (val int, err error) {
@@ -1118,7 +1504,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	if err != nil {
 		return
 	}
-	r0, _, e1 := Syscall(SYS_PATHCONF, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
 	val = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1126,16 +1512,20 @@ func Pathconf(path string, name int) (val int, err error) {
 	return
 }
 
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PREAD, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1143,16 +1533,20 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
 		_p0 = unsafe.Pointer(&p[0])
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_PWRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)), 0, uintptr(offset), 0)
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1160,6 +1554,10 @@ func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	return
 }
 
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func read(fd int, p []byte) (n int, err error) {
@@ -1169,7 +1567,7 @@ func read(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1177,6 +1575,10 @@ func read(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlink(path string, buf []byte) (n int, err error) {
@@ -1191,7 +1593,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_READLINK, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1199,6 +1601,10 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
@@ -1213,7 +1619,7 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	} else {
 		_p1 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall6(SYS_READLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1221,6 +1627,10 @@ func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
 	return
 }
 
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rename(from string, to string) (err error) {
@@ -1234,13 +1644,17 @@ func Rename(from string, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RENAME, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Renameat(fromfd int, from string, tofd int, to string) (err error) {
@@ -1254,13 +1668,17 @@ func Renameat(fromfd int, from string, tofd int, to string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_RENAMEAT, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Revoke(path string) (err error) {
@@ -1269,13 +1687,17 @@ func Revoke(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_REVOKE, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Rmdir(path string) (err error) {
@@ -1284,17 +1706,21 @@ func Rmdir(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_RMDIR, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
-	r0, _, e1 := Syscall6(SYS_LSEEK, uintptr(fd), 0, uintptr(offset), uintptr(whence), 0, 0)
+	r0, _, e1 := syscall_syscall(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(whence))
 	newoffset = int64(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1302,10 +1728,14 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	return
 }
 
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
-	r0, _, e1 := Syscall6(SYS_SELECT, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1313,36 +1743,52 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	return
 }
 
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setegid(egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEGID, uintptr(egid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Seteuid(euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETEUID, uintptr(euid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setgid(gid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETGID, uintptr(gid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setlogin(name string) (err error) {
@@ -1351,97 +1797,119 @@ func Setlogin(name string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SETLOGIN, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpgid(pid int, pgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETPGID, uintptr(pid), uintptr(pgid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setpriority(which int, who int, prio int) (err error) {
-	_, _, e1 := Syscall(SYS_SETPRIORITY, uintptr(which), uintptr(who), uintptr(prio))
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setregid(rgid int, egid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREGID, uintptr(rgid), uintptr(egid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setreuid(ruid int, euid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETREUID, uintptr(ruid), uintptr(euid), 0)
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresgid(rgid int, egid int, sgid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESGID, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setresuid(ruid int, euid int, suid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRESUID, uintptr(ruid), uintptr(euid), uintptr(suid))
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+var libc_setresuid_trampoline_addr uintptr
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setrtable(rtable int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRTABLE, uintptr(rtable), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setsid() (pid int, err error) {
-	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1449,26 +1917,38 @@ func Setsid() (pid int, err error) {
 	return
 }
 
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Settimeofday(tp *Timeval) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETTIMEOFDAY, uintptr(unsafe.Pointer(tp)), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Setuid(uid int) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETUID, uintptr(uid), 0, 0)
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Stat(path string, stat *Stat_t) (err error) {
@@ -1477,13 +1957,17 @@ func Stat(path string, stat *Stat_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STAT, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Statfs(path string, stat *Statfs_t) (err error) {
@@ -1492,13 +1976,17 @@ func Statfs(path string, stat *Statfs_t) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_STATFS, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlink(path string, link string) (err error) {
@@ -1512,13 +2000,17 @@ func Symlink(path string, link string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINK, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
@@ -1532,23 +2024,31 @@ func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_SYMLINKAT, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Sync() (err error) {
-	_, _, e1 := Syscall(SYS_SYNC, 0, 0, 0)
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Truncate(path string, length int64) (err error) {
@@ -1557,21 +2057,29 @@ func Truncate(path string, length int64) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_TRUNCATE, uintptr(unsafe.Pointer(_p0)), 0, uintptr(length))
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Umask(newmask int) (oldmask int) {
-	r0, _, _ := Syscall(SYS_UMASK, uintptr(newmask), 0, 0)
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
 	oldmask = int(r0)
 	return
 }
 
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlink(path string) (err error) {
@@ -1580,13 +2088,17 @@ func Unlink(path string) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINK, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unlinkat(dirfd int, path string, flags int) (err error) {
@@ -1595,13 +2107,17 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNLINKAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func Unmount(path string, flags int) (err error) {
@@ -1610,13 +2126,17 @@ func Unmount(path string, flags int) (err error) {
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall(SYS_UNMOUNT, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func write(fd int, p []byte) (n int, err error) {
@@ -1626,7 +2146,7 @@ func write(fd int, p []byte) (n int, err error) {
 	} else {
 		_p0 = unsafe.Pointer(&_zero)
 	}
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1634,10 +2154,14 @@ func write(fd int, p []byte) (n int, err error) {
 	return
 }
 
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
-	r0, _, e1 := Syscall9(SYS_MMAP, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), 0, uintptr(pos), 0, 0)
+	r0, _, e1 := syscall_syscall6(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
 	ret = uintptr(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1645,20 +2169,28 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	return
 }
 
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func munmap(addr uintptr, length uintptr) (err error) {
-	_, _, e1 := Syscall(SYS_MUNMAP, uintptr(addr), uintptr(length), 0)
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
 
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1669,7 +2201,7 @@ func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
 	n = int(r0)
 	if e1 != 0 {
 		err = errnoErr(e1)
@@ -1685,9 +2217,13 @@ func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error
 	if err != nil {
 		return
 	}
-	_, _, e1 := Syscall6(SYS_UTIMENSAT, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
 	return
 }
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
new file mode 100644
index 0000000000..05d4bffd79
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.s
@@ -0,0 +1,664 @@
+// go run mkasm.go openbsd mips64
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
+DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
+DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
+DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
+DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
+DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
+DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
+DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
+DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
+DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
+DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
+DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
+DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
+DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
+DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
+DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
new file mode 100644
index 0000000000..739be6217a
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
@@ -0,0 +1,2229 @@
+// go run mksyscall.go -openbsd -libc -tags openbsd,ppc64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_ppc64.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build openbsd && ppc64
+// +build openbsd,ppc64
+
+package unix
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _ syscall.Errno
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setgroups(ngid int, gid *_Gid_t) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	wpid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socket(domain int, typ int, proto int) (fd int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Shutdown(s int, how int) (err error) {
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func utimes(path string, timeval *[2]Timeval) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func futimes(fd int, timeval *[2]Timeval) (err error) {
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Madvise(b []byte, behav int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mlock(b []byte) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mlockall(flags int) (err error) {
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mprotect(b []byte, prot int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Msync(b []byte, flags int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Munlock(b []byte) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Munlockall() (err error) {
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pipe2(p *[2]_C_int, flags int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getdents(fd int, buf []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getcwd(buf []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctl(fd int, req uint, arg uintptr) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
+	var _p0 unsafe.Pointer
+	if len(mib) > 0 {
+		_p0 = unsafe.Pointer(&mib[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Access(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chdir(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chflags(path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chmod(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chown(path string, uid int, gid int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chroot(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Close(fd int) (err error) {
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup(fd int) (nfd int, err error) {
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
+	nfd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup2(from int, to int) (err error) {
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup3(from int, to int, flags int) (err error) {
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Exit(code int) {
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
+	return
+}
+
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchdir(fd int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchflags(fd int, flags int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmod(fd int, mode uint32) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchown(fd int, uid int, gid int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Flock(fd int, how int) (err error) {
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fpathconf(fd int, name int) (val int, err error) {
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstat(fd int, stat *Stat_t) (err error) {
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fsync(fd int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Ftruncate(fd int, length int64) (err error) {
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getegid() (egid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
+	egid = int(r0)
+	return
+}
+
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Geteuid() (uid int) {
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getgid() (gid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
+	gid = int(r0)
+	return
+}
+
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpgid(pid int) (pgid int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
+	pgid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpgrp() (pgrp int) {
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
+	pgrp = int(r0)
+	return
+}
+
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpid() (pid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
+	pid = int(r0)
+	return
+}
+
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getppid() (ppid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
+	ppid = int(r0)
+	return
+}
+
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpriority(which int, who int) (prio int, err error) {
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
+	prio = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrlimit(which int, lim *Rlimit) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrtable() (rtable int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
+	rtable = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrusage(who int, rusage *Rusage) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getsid(pid int) (sid int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
+	sid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Gettimeofday(tv *Timeval) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getuid() (uid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Issetugid() (tainted bool) {
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
+	tainted = bool(r0 != 0)
+	return
+}
+
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Kill(pid int, signum syscall.Signal) (err error) {
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Kqueue() (fd int, err error) {
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Lchown(path string, uid int, gid int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Link(path string, link string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Listen(s int, backlog int) (err error) {
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Lstat(path string, stat *Stat_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkdir(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkdirat(dirfd int, path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkfifo(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mknod(path string, mode uint32, dev int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Open(path string, mode int, perm uint32) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Pathconf(path string, name int) (val int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func read(fd int, p []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Readlink(path string, buf []byte) (n int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(buf) > 0 {
+		_p1 = unsafe.Pointer(&buf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(buf) > 0 {
+		_p1 = unsafe.Pointer(&buf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Rename(from string, to string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(from)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(to)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Renameat(fromfd int, from string, tofd int, to string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(from)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(to)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Revoke(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Rmdir(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
+	r0, _, e1 := syscall_syscall(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(whence))
+	newoffset = int64(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setegid(egid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seteuid(euid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setgid(gid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setlogin(name string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(name)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setpgid(pid int, pgid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setpriority(which int, who int, prio int) (err error) {
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setregid(rgid int, egid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setreuid(ruid int, euid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setresgid(rgid int, egid int, sgid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setresuid(ruid int, euid int, suid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setrtable(rtable int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setsid() (pid int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
+	pid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Settimeofday(tp *Timeval) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setuid(uid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Stat(path string, stat *Stat_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Statfs(path string, stat *Statfs_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Symlink(path string, link string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(oldpath)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(newpath)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Sync() (err error) {
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Truncate(path string, length int64) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Umask(newmask int) (oldmask int) {
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
+	oldmask = int(r0)
+	return
+}
+
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unlink(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unlinkat(dirfd int, path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unmount(path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func write(fd int, p []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
+	r0, _, e1 := syscall_syscall6(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
+	ret = uintptr(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func munmap(addr uintptr, length uintptr) (err error) {
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
new file mode 100644
index 0000000000..74a25f8d64
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.s
@@ -0,0 +1,796 @@
+// go run mkasm.go openbsd ppc64
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getgroups(SB)
+	RET
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setgroups(SB)
+	RET
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_wait4(SB)
+	RET
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
+DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_accept(SB)
+	RET
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
+DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_bind(SB)
+	RET
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
+DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_connect(SB)
+	RET
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_socket(SB)
+	RET
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getsockopt(SB)
+	RET
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setsockopt(SB)
+	RET
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getpeername(SB)
+	RET
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getsockname(SB)
+	RET
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_shutdown(SB)
+	RET
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_socketpair(SB)
+	RET
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_recvfrom(SB)
+	RET
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_sendto(SB)
+	RET
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_recvmsg(SB)
+	RET
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_sendmsg(SB)
+	RET
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_kevent(SB)
+	RET
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_utimes(SB)
+	RET
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_futimes(SB)
+	RET
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_poll(SB)
+	RET
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_madvise(SB)
+	RET
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
+DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mlock(SB)
+	RET
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mlockall(SB)
+	RET
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mprotect(SB)
+	RET
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_msync(SB)
+	RET
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_munlock(SB)
+	RET
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_munlockall(SB)
+	RET
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_pipe2(SB)
+	RET
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getdents(SB)
+	RET
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getcwd(SB)
+	RET
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_ioctl(SB)
+	RET
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_sysctl(SB)
+	RET
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_ppoll(SB)
+	RET
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_access(SB)
+	RET
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
+DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_adjtime(SB)
+	RET
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_chdir(SB)
+	RET
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_chflags(SB)
+	RET
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_chmod(SB)
+	RET
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_chown(SB)
+	RET
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_chroot(SB)
+	RET
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_clock_gettime(SB)
+	RET
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_close(SB)
+	RET
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
+DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_dup(SB)
+	RET
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_dup2(SB)
+	RET
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_dup3(SB)
+	RET
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_exit(SB)
+	RET
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_faccessat(SB)
+	RET
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fchdir(SB)
+	RET
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fchflags(SB)
+	RET
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fchmod(SB)
+	RET
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fchmodat(SB)
+	RET
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fchown(SB)
+	RET
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fchownat(SB)
+	RET
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_flock(SB)
+	RET
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fpathconf(SB)
+	RET
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fstat(SB)
+	RET
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fstatat(SB)
+	RET
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fstatfs(SB)
+	RET
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_fsync(SB)
+	RET
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_ftruncate(SB)
+	RET
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getegid(SB)
+	RET
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_geteuid(SB)
+	RET
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getgid(SB)
+	RET
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getpgid(SB)
+	RET
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getpgrp(SB)
+	RET
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getpid(SB)
+	RET
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getppid(SB)
+	RET
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getpriority(SB)
+	RET
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getrlimit(SB)
+	RET
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getrtable(SB)
+	RET
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getrusage(SB)
+	RET
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getsid(SB)
+	RET
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_gettimeofday(SB)
+	RET
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_getuid(SB)
+	RET
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_issetugid(SB)
+	RET
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_kill(SB)
+	RET
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_kqueue(SB)
+	RET
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_lchown(SB)
+	RET
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_link(SB)
+	RET
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
+DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_linkat(SB)
+	RET
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_listen(SB)
+	RET
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
+DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_lstat(SB)
+	RET
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mkdir(SB)
+	RET
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mkdirat(SB)
+	RET
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mkfifo(SB)
+	RET
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mkfifoat(SB)
+	RET
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mknod(SB)
+	RET
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mknodat(SB)
+	RET
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_nanosleep(SB)
+	RET
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
+DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_open(SB)
+	RET
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
+DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_openat(SB)
+	RET
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_pathconf(SB)
+	RET
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_pread(SB)
+	RET
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_pwrite(SB)
+	RET
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_read(SB)
+	RET
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
+DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_readlink(SB)
+	RET
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_readlinkat(SB)
+	RET
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_rename(SB)
+	RET
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_renameat(SB)
+	RET
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_revoke(SB)
+	RET
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
+DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_rmdir(SB)
+	RET
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_lseek(SB)
+	RET
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_select(SB)
+	RET
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
+DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setegid(SB)
+	RET
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_seteuid(SB)
+	RET
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setgid(SB)
+	RET
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setlogin(SB)
+	RET
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setpgid(SB)
+	RET
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setpriority(SB)
+	RET
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setregid(SB)
+	RET
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setreuid(SB)
+	RET
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setresgid(SB)
+	RET
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setresuid(SB)
+	RET
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setrtable(SB)
+	RET
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setsid(SB)
+	RET
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_settimeofday(SB)
+	RET
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_setuid(SB)
+	RET
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_stat(SB)
+	RET
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_statfs(SB)
+	RET
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_symlink(SB)
+	RET
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_symlinkat(SB)
+	RET
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_sync(SB)
+	RET
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_truncate(SB)
+	RET
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_umask(SB)
+	RET
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
+DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_unlink(SB)
+	RET
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_unlinkat(SB)
+	RET
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_unmount(SB)
+	RET
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_write(SB)
+	RET
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
+DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_mmap(SB)
+	RET
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_munmap(SB)
+	RET
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	CALL	libc_utimensat(SB)
+	RET
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
new file mode 100644
index 0000000000..7d95a19780
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
@@ -0,0 +1,2229 @@
+// go run mksyscall.go -openbsd -libc -tags openbsd,riscv64 syscall_bsd.go syscall_openbsd.go syscall_openbsd_riscv64.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build openbsd && riscv64
+// +build openbsd,riscv64
+
+package unix
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var _ syscall.Errno
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgroups getgroups "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setgroups(ngid int, gid *_Gid_t) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setgroups_trampoline_addr, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setgroups_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgroups setgroups "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func wait4(pid int, wstatus *_C_int, options int, rusage *Rusage) (wpid int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_wait4_trampoline_addr, uintptr(pid), uintptr(unsafe.Pointer(wstatus)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
+	wpid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_wait4_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_wait4 wait4 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
+	r0, _, e1 := syscall_syscall(libc_accept_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_accept_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_accept accept "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := syscall_syscall(libc_bind_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_bind_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_bind bind "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
+	_, _, e1 := syscall_syscall(libc_connect_trampoline_addr, uintptr(s), uintptr(addr), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_connect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_connect connect "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socket(domain int, typ int, proto int) (fd int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_socket_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_socket_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socket socket "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
+	_, _, e1 := syscall_syscall6(libc_getsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockopt getsockopt "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
+	_, _, e1 := syscall_syscall6(libc_setsockopt_trampoline_addr, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setsockopt_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsockopt setsockopt "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getpeername_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getpeername_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpeername getpeername "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getsockname_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getsockname_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsockname getsockname "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Shutdown(s int, how int) (err error) {
+	_, _, e1 := syscall_syscall(libc_shutdown_trampoline_addr, uintptr(s), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_shutdown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_shutdown shutdown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
+	_, _, e1 := syscall_rawSyscall6(libc_socketpair_trampoline_addr, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_socketpair_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_socketpair socketpair "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_recvfrom_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_recvfrom_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvfrom recvfrom "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_sendto_trampoline_addr, uintptr(s), uintptr(_p0), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sendto_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendto sendto "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_recvmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_recvmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_recvmsg recvmsg "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_sendmsg_trampoline_addr, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sendmsg_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sendmsg sendmsg "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func kevent(kq int, change unsafe.Pointer, nchange int, event unsafe.Pointer, nevent int, timeout *Timespec) (n int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_kevent_trampoline_addr, uintptr(kq), uintptr(change), uintptr(nchange), uintptr(event), uintptr(nevent), uintptr(unsafe.Pointer(timeout)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_kevent_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kevent kevent "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func utimes(path string, timeval *[2]Timeval) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_utimes_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(timeval)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_utimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimes utimes "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func futimes(fd int, timeval *[2]Timeval) (err error) {
+	_, _, e1 := syscall_syscall(libc_futimes_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(timeval)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_futimes_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_futimes futimes "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_poll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_poll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_poll poll "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Madvise(b []byte, behav int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_madvise_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(behav))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_madvise_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_madvise madvise "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mlock(b []byte) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_mlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlock mlock "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mlockall(flags int) (err error) {
+	_, _, e1 := syscall_syscall(libc_mlockall_trampoline_addr, uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mlockall mlockall "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mprotect(b []byte, prot int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_mprotect_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(prot))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mprotect_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mprotect mprotect "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Msync(b []byte, flags int) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_msync_trampoline_addr, uintptr(_p0), uintptr(len(b)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_msync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_msync msync "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Munlock(b []byte) (err error) {
+	var _p0 unsafe.Pointer
+	if len(b) > 0 {
+		_p0 = unsafe.Pointer(&b[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall(libc_munlock_trampoline_addr, uintptr(_p0), uintptr(len(b)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_munlock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlock munlock "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Munlockall() (err error) {
+	_, _, e1 := syscall_syscall(libc_munlockall_trampoline_addr, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_munlockall_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munlockall munlockall "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pipe2(p *[2]_C_int, flags int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_pipe2_trampoline_addr, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pipe2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pipe2 pipe2 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getdents(fd int, buf []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_getdents_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(buf)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getdents_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getdents getdents "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getcwd(buf []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(buf) > 0 {
+		_p0 = unsafe.Pointer(&buf[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_getcwd_trampoline_addr, uintptr(_p0), uintptr(len(buf)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getcwd_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getcwd getcwd "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctl(fd int, req uint, arg uintptr) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
+	var _p0 unsafe.Pointer
+	if len(mib) > 0 {
+		_p0 = unsafe.Pointer(&mib[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_sysctl_trampoline_addr, uintptr(_p0), uintptr(len(mib)), uintptr(unsafe.Pointer(old)), uintptr(unsafe.Pointer(oldlen)), uintptr(unsafe.Pointer(new)), uintptr(newlen))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sysctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sysctl sysctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ppoll(fds *PollFd, nfds int, timeout *Timespec, sigmask *Sigset_t) (n int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_ppoll_trampoline_addr, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(unsafe.Pointer(timeout)), uintptr(unsafe.Pointer(sigmask)), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ppoll_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ppoll ppoll "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Access(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_access_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_access_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_access access "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
+	_, _, e1 := syscall_syscall(libc_adjtime_trampoline_addr, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_adjtime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_adjtime adjtime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chdir(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chdir chdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chflags(path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chflags_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chflags chflags "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chmod(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chmod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chmod chmod "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chown(path string, uid int, gid int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chown chown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Chroot(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_chroot_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_chroot_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_chroot chroot "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_clock_gettime_trampoline_addr, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_clock_gettime_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_clock_gettime clock_gettime "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Close(fd int) (err error) {
+	_, _, e1 := syscall_syscall(libc_close_trampoline_addr, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_close_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_close close "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup(fd int) (nfd int, err error) {
+	r0, _, e1 := syscall_syscall(libc_dup_trampoline_addr, uintptr(fd), 0, 0)
+	nfd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_dup_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup dup "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup2(from int, to int) (err error) {
+	_, _, e1 := syscall_syscall(libc_dup2_trampoline_addr, uintptr(from), uintptr(to), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_dup2_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup2 dup2 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Dup3(from int, to int, flags int) (err error) {
+	_, _, e1 := syscall_syscall(libc_dup3_trampoline_addr, uintptr(from), uintptr(to), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_dup3_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_dup3 dup3 "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Exit(code int) {
+	syscall_syscall(libc_exit_trampoline_addr, uintptr(code), 0, 0)
+	return
+}
+
+var libc_exit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_exit exit "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_faccessat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_faccessat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_faccessat faccessat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchdir(fd int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchdir_trampoline_addr, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchdir fchdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchflags(fd int, flags int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchflags_trampoline_addr, uintptr(fd), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchflags_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchflags fchflags "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmod(fd int, mode uint32) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchmod_trampoline_addr, uintptr(fd), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchmod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmod fchmod "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_fchmodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchmodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchmodat fchmodat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchown(fd int, uid int, gid int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fchown_trampoline_addr, uintptr(fd), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchown fchown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_fchownat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fchownat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fchownat fchownat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Flock(fd int, how int) (err error) {
+	_, _, e1 := syscall_syscall(libc_flock_trampoline_addr, uintptr(fd), uintptr(how), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_flock_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_flock flock "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fpathconf(fd int, name int) (val int, err error) {
+	r0, _, e1 := syscall_syscall(libc_fpathconf_trampoline_addr, uintptr(fd), uintptr(name), 0)
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fpathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fpathconf fpathconf "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstat(fd int, stat *Stat_t) (err error) {
+	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstat fstat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_fstatat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fstatat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatat fstatat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fstatfs(fd int, stat *Statfs_t) (err error) {
+	_, _, e1 := syscall_syscall(libc_fstatfs_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fstatfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fstatfs fstatfs "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Fsync(fd int) (err error) {
+	_, _, e1 := syscall_syscall(libc_fsync_trampoline_addr, uintptr(fd), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_fsync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_fsync fsync "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Ftruncate(fd int, length int64) (err error) {
+	_, _, e1 := syscall_syscall(libc_ftruncate_trampoline_addr, uintptr(fd), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_ftruncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ftruncate ftruncate "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getegid() (egid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getegid_trampoline_addr, 0, 0, 0)
+	egid = int(r0)
+	return
+}
+
+var libc_getegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getegid getegid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Geteuid() (uid int) {
+	r0, _, _ := syscall_rawSyscall(libc_geteuid_trampoline_addr, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+var libc_geteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_geteuid geteuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getgid() (gid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getgid_trampoline_addr, 0, 0, 0)
+	gid = int(r0)
+	return
+}
+
+var libc_getgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getgid getgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpgid(pid int) (pgid int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getpgid_trampoline_addr, uintptr(pid), 0, 0)
+	pgid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgid getpgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpgrp() (pgrp int) {
+	r0, _, _ := syscall_rawSyscall(libc_getpgrp_trampoline_addr, 0, 0, 0)
+	pgrp = int(r0)
+	return
+}
+
+var libc_getpgrp_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpgrp getpgrp "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpid() (pid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getpid_trampoline_addr, 0, 0, 0)
+	pid = int(r0)
+	return
+}
+
+var libc_getpid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpid getpid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getppid() (ppid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getppid_trampoline_addr, 0, 0, 0)
+	ppid = int(r0)
+	return
+}
+
+var libc_getppid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getppid getppid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getpriority(which int, who int) (prio int, err error) {
+	r0, _, e1 := syscall_syscall(libc_getpriority_trampoline_addr, uintptr(which), uintptr(who), 0)
+	prio = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrlimit(which int, lim *Rlimit) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getrlimit_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrtable() (rtable int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getrtable_trampoline_addr, 0, 0, 0)
+	rtable = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrtable getrtable "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getrusage(who int, rusage *Rusage) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_getrusage_trampoline_addr, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getrusage_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getsid(pid int) (sid int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_getsid_trampoline_addr, uintptr(pid), 0, 0)
+	sid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_getsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Gettimeofday(tv *Timeval) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_gettimeofday_trampoline_addr, uintptr(unsafe.Pointer(tv)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_gettimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Getuid() (uid int) {
+	r0, _, _ := syscall_rawSyscall(libc_getuid_trampoline_addr, 0, 0, 0)
+	uid = int(r0)
+	return
+}
+
+var libc_getuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_getuid getuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Issetugid() (tainted bool) {
+	r0, _, _ := syscall_syscall(libc_issetugid_trampoline_addr, 0, 0, 0)
+	tainted = bool(r0 != 0)
+	return
+}
+
+var libc_issetugid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_issetugid issetugid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Kill(pid int, signum syscall.Signal) (err error) {
+	_, _, e1 := syscall_syscall(libc_kill_trampoline_addr, uintptr(pid), uintptr(signum), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_kill_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kill kill "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Kqueue() (fd int, err error) {
+	r0, _, e1 := syscall_syscall(libc_kqueue_trampoline_addr, 0, 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_kqueue_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_kqueue kqueue "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Lchown(path string, uid int, gid int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_lchown_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_lchown_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lchown lchown "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Link(path string, link string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_link_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_link_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_link link "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Linkat(pathfd int, path string, linkfd int, link string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_linkat_trampoline_addr, uintptr(pathfd), uintptr(unsafe.Pointer(_p0)), uintptr(linkfd), uintptr(unsafe.Pointer(_p1)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_linkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_linkat linkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Listen(s int, backlog int) (err error) {
+	_, _, e1 := syscall_syscall(libc_listen_trampoline_addr, uintptr(s), uintptr(backlog), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_listen_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_listen listen "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Lstat(path string, stat *Stat_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_lstat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_lstat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lstat lstat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkdir(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdir mkdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkdirat(dirfd int, path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkdirat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkdirat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkdirat mkdirat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkfifo(path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkfifo_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkfifo_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifo mkfifo "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mkfifoat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mkfifoat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mkfifoat mkfifoat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mknod(path string, mode uint32, dev int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_mknod_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mknod_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknod mknod "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_mknodat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mknodat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mknodat mknodat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
+	_, _, e1 := syscall_syscall(libc_nanosleep_trampoline_addr, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_nanosleep_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_nanosleep nanosleep "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Open(path string, mode int, perm uint32) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall_syscall(libc_open_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm))
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_open_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_open open "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Openat(dirfd int, path string, mode int, perm uint32) (fd int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall_syscall6(libc_openat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0)
+	fd = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_openat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_openat openat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Pathconf(path string, name int) (val int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	r0, _, e1 := syscall_syscall(libc_pathconf_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0)
+	val = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pathconf_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pathconf pathconf "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pread(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_pread_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pread_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pread pread "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_pwrite_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)), uintptr(offset), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_pwrite_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_pwrite pwrite "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func read(fd int, p []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_read_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_read read "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Readlink(path string, buf []byte) (n int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(buf) > 0 {
+		_p1 = unsafe.Pointer(&buf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_readlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_readlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlink readlink "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Readlinkat(dirfd int, path string, buf []byte) (n int, err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(buf) > 0 {
+		_p1 = unsafe.Pointer(&buf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall6(libc_readlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(_p1), uintptr(len(buf)), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_readlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_readlinkat readlinkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Rename(from string, to string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(from)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(to)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_rename_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_rename_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rename rename "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Renameat(fromfd int, from string, tofd int, to string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(from)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(to)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_renameat_trampoline_addr, uintptr(fromfd), uintptr(unsafe.Pointer(_p0)), uintptr(tofd), uintptr(unsafe.Pointer(_p1)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_renameat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_renameat renameat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Revoke(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_revoke_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_revoke_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_revoke revoke "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Rmdir(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_rmdir_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_rmdir_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_rmdir rmdir "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
+	r0, _, e1 := syscall_syscall(libc_lseek_trampoline_addr, uintptr(fd), uintptr(offset), uintptr(whence))
+	newoffset = int64(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_lseek_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_lseek lseek "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error) {
+	r0, _, e1 := syscall_syscall6(libc_select_trampoline_addr, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_select_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_select select "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setegid(egid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setegid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setegid setegid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Seteuid(euid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_seteuid_trampoline_addr, uintptr(euid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_seteuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_seteuid seteuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setgid(gid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setgid_trampoline_addr, uintptr(gid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setgid setgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setlogin(name string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(name)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_setlogin_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setlogin_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setlogin setlogin "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setpgid(pid int, pgid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setpgid_trampoline_addr, uintptr(pid), uintptr(pgid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setpgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpgid setpgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setpriority(which int, who int, prio int) (err error) {
+	_, _, e1 := syscall_syscall(libc_setpriority_trampoline_addr, uintptr(which), uintptr(who), uintptr(prio))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setpriority_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setregid(rgid int, egid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setregid_trampoline_addr, uintptr(rgid), uintptr(egid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setregid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setregid setregid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setreuid(ruid int, euid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setreuid_trampoline_addr, uintptr(ruid), uintptr(euid), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setreuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setresgid(rgid int, egid int, sgid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setresgid_trampoline_addr, uintptr(rgid), uintptr(egid), uintptr(sgid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setresgid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresgid setresgid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setresuid(ruid int, euid int, suid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setresuid_trampoline_addr, uintptr(ruid), uintptr(euid), uintptr(suid))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setresuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setresuid setresuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setrtable(rtable int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setrtable_trampoline_addr, uintptr(rtable), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setrtable_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setrtable setrtable "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setsid() (pid int, err error) {
+	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
+	pid = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setsid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setsid setsid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Settimeofday(tp *Timeval) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_settimeofday_trampoline_addr, uintptr(unsafe.Pointer(tp)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_settimeofday_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_settimeofday settimeofday "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Setuid(uid int) (err error) {
+	_, _, e1 := syscall_rawSyscall(libc_setuid_trampoline_addr, uintptr(uid), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setuid_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setuid setuid "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Stat(path string, stat *Stat_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_stat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_stat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_stat stat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Statfs(path string, stat *Statfs_t) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_statfs_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_statfs_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_statfs statfs "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Symlink(path string, link string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(link)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_symlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_symlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlink symlink "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Symlinkat(oldpath string, newdirfd int, newpath string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(oldpath)
+	if err != nil {
+		return
+	}
+	var _p1 *byte
+	_p1, err = BytePtrFromString(newpath)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_symlinkat_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_symlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_symlinkat symlinkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Sync() (err error) {
+	_, _, e1 := syscall_syscall(libc_sync_trampoline_addr, 0, 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_sync_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_sync sync "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Truncate(path string, length int64) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_truncate_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_truncate_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_truncate truncate "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Umask(newmask int) (oldmask int) {
+	r0, _, _ := syscall_syscall(libc_umask_trampoline_addr, uintptr(newmask), 0, 0)
+	oldmask = int(r0)
+	return
+}
+
+var libc_umask_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_umask umask "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unlink(path string) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_unlink_trampoline_addr, uintptr(unsafe.Pointer(_p0)), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_unlink_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlink unlink "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unlinkat(dirfd int, path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_unlinkat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_unlinkat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unlinkat unlinkat "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func Unmount(path string, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall(libc_unmount_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_unmount_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_unmount unmount "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func write(fd int, p []byte) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(p) > 0 {
+		_p0 = unsafe.Pointer(&p[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(_p0), uintptr(len(p)))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_write_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_write write "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) {
+	r0, _, e1 := syscall_syscall6(libc_mmap_trampoline_addr, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
+	ret = uintptr(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_mmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_mmap mmap "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func munmap(addr uintptr, length uintptr) (err error) {
+	_, _, e1 := syscall_syscall(libc_munmap_trampoline_addr, uintptr(addr), uintptr(length), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_munmap_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_munmap munmap "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
+	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	_, _, e1 := syscall_syscall6(libc_utimensat_trampoline_addr, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_utimensat_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_utimensat utimensat "libc.so"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
new file mode 100644
index 0000000000..990be24574
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.s
@@ -0,0 +1,664 @@
+// go run mkasm.go openbsd riscv64
+// Code generated by the command above; DO NOT EDIT.
+
+#include "textflag.h"
+
+TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgroups(SB)
+GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
+
+TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgroups(SB)
+GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
+
+TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_wait4(SB)
+GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
+DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
+
+TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_accept(SB)
+GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
+DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
+
+TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_bind(SB)
+GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
+DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
+
+TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_connect(SB)
+GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
+
+TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socket(SB)
+GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
+
+TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockopt(SB)
+GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
+
+TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsockopt(SB)
+GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
+
+TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpeername(SB)
+GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
+
+TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsockname(SB)
+GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
+
+TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_shutdown(SB)
+GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
+
+TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_socketpair(SB)
+GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
+DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
+
+TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvfrom(SB)
+GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
+
+TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendto(SB)
+GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
+
+TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_recvmsg(SB)
+GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
+
+TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sendmsg(SB)
+GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
+
+TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kevent(SB)
+GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
+
+TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimes(SB)
+GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
+
+TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_futimes(SB)
+GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
+DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
+
+TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_poll(SB)
+GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
+
+TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_madvise(SB)
+GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
+DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
+
+TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlock(SB)
+GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
+
+TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mlockall(SB)
+GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
+
+TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mprotect(SB)
+GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
+
+TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_msync(SB)
+GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
+
+TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlock(SB)
+GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
+
+TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munlockall(SB)
+GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
+
+TEXT libc_pipe2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pipe2(SB)
+GLOBL	·libc_pipe2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pipe2_trampoline_addr(SB)/8, $libc_pipe2_trampoline<>(SB)
+
+TEXT libc_getdents_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getdents(SB)
+GLOBL	·libc_getdents_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getdents_trampoline_addr(SB)/8, $libc_getdents_trampoline<>(SB)
+
+TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getcwd(SB)
+GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
+
+TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ioctl(SB)
+GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
+
+TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sysctl(SB)
+GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
+
+TEXT libc_ppoll_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ppoll(SB)
+GLOBL	·libc_ppoll_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ppoll_trampoline_addr(SB)/8, $libc_ppoll_trampoline<>(SB)
+
+TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_access(SB)
+GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
+DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
+
+TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_adjtime(SB)
+GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
+
+TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chdir(SB)
+GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
+
+TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chflags(SB)
+GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
+
+TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chmod(SB)
+GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
+
+TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chown(SB)
+GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
+
+TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_chroot(SB)
+GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
+DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
+
+TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_clock_gettime(SB)
+GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
+DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
+
+TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_close(SB)
+GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
+DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
+
+TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup(SB)
+GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
+
+TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup2(SB)
+GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
+
+TEXT libc_dup3_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_dup3(SB)
+GLOBL	·libc_dup3_trampoline_addr(SB), RODATA, $8
+DATA	·libc_dup3_trampoline_addr(SB)/8, $libc_dup3_trampoline<>(SB)
+
+TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_exit(SB)
+GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
+
+TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_faccessat(SB)
+GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
+
+TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchdir(SB)
+GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
+
+TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchflags(SB)
+GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
+
+TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmod(SB)
+GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
+
+TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchmodat(SB)
+GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
+
+TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchown(SB)
+GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
+
+TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fchownat(SB)
+GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
+
+TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_flock(SB)
+GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
+DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
+
+TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fpathconf(SB)
+GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
+
+TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstat(SB)
+GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
+
+TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatat(SB)
+GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
+
+TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fstatfs(SB)
+GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
+
+TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_fsync(SB)
+GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
+
+TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_ftruncate(SB)
+GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
+
+TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getegid(SB)
+GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
+
+TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_geteuid(SB)
+GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
+
+TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getgid(SB)
+GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
+
+TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgid(SB)
+GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
+
+TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpgrp(SB)
+GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
+
+TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpid(SB)
+GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
+
+TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getppid(SB)
+GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
+
+TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getpriority(SB)
+GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
+
+TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrlimit(SB)
+GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
+
+TEXT libc_getrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrtable(SB)
+GLOBL	·libc_getrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrtable_trampoline_addr(SB)/8, $libc_getrtable_trampoline<>(SB)
+
+TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getrusage(SB)
+GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
+
+TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getsid(SB)
+GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
+
+TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_gettimeofday(SB)
+GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
+
+TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_getuid(SB)
+GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
+
+TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_issetugid(SB)
+GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
+
+TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kill(SB)
+GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
+
+TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_kqueue(SB)
+GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
+DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
+
+TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lchown(SB)
+GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
+
+TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_link(SB)
+GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
+DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
+
+TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_linkat(SB)
+GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
+
+TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_listen(SB)
+GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
+DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
+
+TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lstat(SB)
+GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
+
+TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdir(SB)
+GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
+
+TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkdirat(SB)
+GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
+
+TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifo(SB)
+GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
+
+TEXT libc_mkfifoat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mkfifoat(SB)
+GLOBL	·libc_mkfifoat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mkfifoat_trampoline_addr(SB)/8, $libc_mkfifoat_trampoline<>(SB)
+
+TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknod(SB)
+GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
+
+TEXT libc_mknodat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mknodat(SB)
+GLOBL	·libc_mknodat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mknodat_trampoline_addr(SB)/8, $libc_mknodat_trampoline<>(SB)
+
+TEXT libc_nanosleep_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_nanosleep(SB)
+GLOBL	·libc_nanosleep_trampoline_addr(SB), RODATA, $8
+DATA	·libc_nanosleep_trampoline_addr(SB)/8, $libc_nanosleep_trampoline<>(SB)
+
+TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_open(SB)
+GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
+DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
+
+TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_openat(SB)
+GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
+
+TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pathconf(SB)
+GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
+
+TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pread(SB)
+GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
+
+TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_pwrite(SB)
+GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
+DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
+
+TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_read(SB)
+GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
+DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
+
+TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlink(SB)
+GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
+
+TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_readlinkat(SB)
+GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
+
+TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rename(SB)
+GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
+
+TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_renameat(SB)
+GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
+
+TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_revoke(SB)
+GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
+DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
+
+TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_rmdir(SB)
+GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
+DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
+
+TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_lseek(SB)
+GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
+DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
+
+TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_select(SB)
+GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
+DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
+
+TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setegid(SB)
+GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
+
+TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_seteuid(SB)
+GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
+
+TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setgid(SB)
+GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
+
+TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setlogin(SB)
+GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
+
+TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpgid(SB)
+GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
+
+TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setpriority(SB)
+GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
+
+TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setregid(SB)
+GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
+
+TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setreuid(SB)
+GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
+
+TEXT libc_setresgid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresgid(SB)
+GLOBL	·libc_setresgid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresgid_trampoline_addr(SB)/8, $libc_setresgid_trampoline<>(SB)
+
+TEXT libc_setresuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setresuid(SB)
+GLOBL	·libc_setresuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setresuid_trampoline_addr(SB)/8, $libc_setresuid_trampoline<>(SB)
+
+TEXT libc_setrtable_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setrtable(SB)
+GLOBL	·libc_setrtable_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setrtable_trampoline_addr(SB)/8, $libc_setrtable_trampoline<>(SB)
+
+TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setsid(SB)
+GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
+
+TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_settimeofday(SB)
+GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
+DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
+
+TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setuid(SB)
+GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
+
+TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_stat(SB)
+GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
+
+TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_statfs(SB)
+GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
+DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
+
+TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlink(SB)
+GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
+
+TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_symlinkat(SB)
+GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
+
+TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_sync(SB)
+GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
+DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
+
+TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_truncate(SB)
+GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
+DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
+
+TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_umask(SB)
+GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
+DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
+
+TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlink(SB)
+GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
+
+TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unlinkat(SB)
+GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
+
+TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_unmount(SB)
+GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
+DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
+
+TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_write(SB)
+GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
+DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
+
+TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_mmap(SB)
+GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
+
+TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_munmap(SB)
+GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
+DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
+
+TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_utimensat(SB)
+GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
+DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
index b5f926cee2..609d1c598a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
@@ -38,6 +38,7 @@ import (
 //go:cgo_import_dynamic libc_chmod chmod "libc.so"
 //go:cgo_import_dynamic libc_chown chown "libc.so"
 //go:cgo_import_dynamic libc_chroot chroot "libc.so"
+//go:cgo_import_dynamic libc_clockgettime clockgettime "libc.so"
 //go:cgo_import_dynamic libc_close close "libc.so"
 //go:cgo_import_dynamic libc_creat creat "libc.so"
 //go:cgo_import_dynamic libc_dup dup "libc.so"
@@ -66,6 +67,7 @@ import (
 //go:cgo_import_dynamic libc_getpriority getpriority "libc.so"
 //go:cgo_import_dynamic libc_getrlimit getrlimit "libc.so"
 //go:cgo_import_dynamic libc_getrusage getrusage "libc.so"
+//go:cgo_import_dynamic libc_getsid getsid "libc.so"
 //go:cgo_import_dynamic libc_gettimeofday gettimeofday "libc.so"
 //go:cgo_import_dynamic libc_getuid getuid "libc.so"
 //go:cgo_import_dynamic libc_kill kill "libc.so"
@@ -108,7 +110,6 @@ import (
 //go:cgo_import_dynamic libc_setpriority setpriority "libc.so"
 //go:cgo_import_dynamic libc_setregid setregid "libc.so"
 //go:cgo_import_dynamic libc_setreuid setreuid "libc.so"
-//go:cgo_import_dynamic libc_setrlimit setrlimit "libc.so"
 //go:cgo_import_dynamic libc_setsid setsid "libc.so"
 //go:cgo_import_dynamic libc_setuid setuid "libc.so"
 //go:cgo_import_dynamic libc_shutdown shutdown "libsocket.so"
@@ -146,6 +147,8 @@ import (
 //go:cgo_import_dynamic libc_port_dissociate port_dissociate "libc.so"
 //go:cgo_import_dynamic libc_port_get port_get "libc.so"
 //go:cgo_import_dynamic libc_port_getn port_getn "libc.so"
+//go:cgo_import_dynamic libc_putmsg putmsg "libc.so"
+//go:cgo_import_dynamic libc_getmsg getmsg "libc.so"
 
 //go:linkname procpipe libc_pipe
 //go:linkname procpipe2 libc_pipe2
@@ -174,6 +177,7 @@ import (
 //go:linkname procChmod libc_chmod
 //go:linkname procChown libc_chown
 //go:linkname procChroot libc_chroot
+//go:linkname procClockGettime libc_clockgettime
 //go:linkname procClose libc_close
 //go:linkname procCreat libc_creat
 //go:linkname procDup libc_dup
@@ -202,6 +206,7 @@ import (
 //go:linkname procGetpriority libc_getpriority
 //go:linkname procGetrlimit libc_getrlimit
 //go:linkname procGetrusage libc_getrusage
+//go:linkname procGetsid libc_getsid
 //go:linkname procGettimeofday libc_gettimeofday
 //go:linkname procGetuid libc_getuid
 //go:linkname procKill libc_kill
@@ -227,8 +232,8 @@ import (
 //go:linkname procOpenat libc_openat
 //go:linkname procPathconf libc_pathconf
 //go:linkname procPause libc_pause
-//go:linkname procPread libc_pread
-//go:linkname procPwrite libc_pwrite
+//go:linkname procpread libc_pread
+//go:linkname procpwrite libc_pwrite
 //go:linkname procread libc_read
 //go:linkname procReadlink libc_readlink
 //go:linkname procRename libc_rename
@@ -244,7 +249,6 @@ import (
 //go:linkname procSetpriority libc_setpriority
 //go:linkname procSetregid libc_setregid
 //go:linkname procSetreuid libc_setreuid
-//go:linkname procSetrlimit libc_setrlimit
 //go:linkname procSetsid libc_setsid
 //go:linkname procSetuid libc_setuid
 //go:linkname procshutdown libc_shutdown
@@ -282,6 +286,8 @@ import (
 //go:linkname procport_dissociate libc_port_dissociate
 //go:linkname procport_get libc_port_get
 //go:linkname procport_getn libc_port_getn
+//go:linkname procputmsg libc_putmsg
+//go:linkname procgetmsg libc_getmsg
 
 var (
 	procpipe,
@@ -311,6 +317,7 @@ var (
 	procChmod,
 	procChown,
 	procChroot,
+	procClockGettime,
 	procClose,
 	procCreat,
 	procDup,
@@ -339,6 +346,7 @@ var (
 	procGetpriority,
 	procGetrlimit,
 	procGetrusage,
+	procGetsid,
 	procGettimeofday,
 	procGetuid,
 	procKill,
@@ -364,8 +372,8 @@ var (
 	procOpenat,
 	procPathconf,
 	procPause,
-	procPread,
-	procPwrite,
+	procpread,
+	procpwrite,
 	procread,
 	procReadlink,
 	procRename,
@@ -381,7 +389,6 @@ var (
 	procSetpriority,
 	procSetregid,
 	procSetreuid,
-	procSetrlimit,
 	procSetsid,
 	procSetuid,
 	procshutdown,
@@ -418,7 +425,9 @@ var (
 	procport_associate,
 	procport_dissociate,
 	procport_get,
-	procport_getn syscallFunc
+	procport_getn,
+	procputmsg,
+	procgetmsg syscallFunc
 )
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
@@ -634,7 +643,18 @@ func __minor(version int, dev uint64) (val uint) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func ioctlRet(fd int, req uint, arg uintptr) (ret int, err error) {
+func ioctlRet(fd int, req int, arg uintptr) (ret int, err error) {
+	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
+	ret = int(r0)
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctlPtrRet(fd int, req int, arg unsafe.Pointer) (ret int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
 	ret = int(r0)
 	if e1 != 0 {
@@ -741,6 +761,16 @@ func Chroot(path string) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func ClockGettime(clockid int32, time *Timespec) (err error) {
+	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClockGettime)), 2, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0, 0, 0, 0)
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Close(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClose)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
@@ -1044,6 +1074,17 @@ func Getrusage(who int, rusage *Rusage) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func Getsid(pid int) (sid int, err error) {
+	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetsid)), 1, uintptr(pid), 0, 0, 0, 0, 0)
+	sid = int(r0)
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Gettimeofday(tv *Timeval) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGettimeofday)), 1, uintptr(unsafe.Pointer(tv)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
@@ -1380,12 +1421,12 @@ func Pause() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pread(fd int, p []byte, offset int64) (n int, err error) {
+func pread(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 *byte
 	if len(p) > 0 {
 		_p0 = &p[0]
 	}
-	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procPread)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
+	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpread)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = e1
@@ -1395,12 +1436,12 @@ func Pread(fd int, p []byte, offset int64) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Pwrite(fd int, p []byte, offset int64) (n int, err error) {
+func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	var _p0 *byte
 	if len(p) > 0 {
 		_p0 = &p[0]
 	}
-	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procPwrite)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
+	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpwrite)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
 		err = e1
@@ -1606,16 +1647,6 @@ func Setreuid(ruid int, euid int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetrlimit)), 2, uintptr(which), uintptr(unsafe.Pointer(lim)), 0, 0, 0, 0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetsid)), 0, 0, 0, 0, 0, 0, 0)
 	pid = int(r0)
@@ -2051,3 +2082,23 @@ func port_getn(port int, pe *portEvent, max uint32, nget *uint32, timeout *Times
 	}
 	return
 }
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error) {
+	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procputmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(flags), 0, 0)
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func getmsg(fd int, clptr *strbuf, dataptr *strbuf, flags *int) (err error) {
+	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgetmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(unsafe.Pointer(flags)), 0, 0)
+	if e1 != 0 {
+		err = e1
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go b/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
index f2079457c6..c31681743c 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
@@ -257,7 +257,17 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func ioctl(fd int, req uint, arg uintptr) (err error) {
+func ioctl(fd int, req int, arg uintptr) (err error) {
+	_, _, e1 := syscall_syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(SYS_IOCTL, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
 		err = errnoErr(e1)
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go
index 9e9d0b2a9c..55e0484719 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_386.go
@@ -17,6 +17,7 @@ var sysctlMib = []mibentry{
 	{"ddb.max_line", []_C_int{9, 3}},
 	{"ddb.max_width", []_C_int{9, 2}},
 	{"ddb.panic", []_C_int{9, 5}},
+	{"ddb.profile", []_C_int{9, 9}},
 	{"ddb.radix", []_C_int{9, 1}},
 	{"ddb.tab_stop_width", []_C_int{9, 4}},
 	{"ddb.trigger", []_C_int{9, 8}},
@@ -33,29 +34,37 @@ var sysctlMib = []mibentry{
 	{"hw.ncpufound", []_C_int{6, 21}},
 	{"hw.ncpuonline", []_C_int{6, 25}},
 	{"hw.pagesize", []_C_int{6, 7}},
+	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
 	{"hw.usermem", []_C_int{6, 20}},
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
-	{"kern.arandom", []_C_int{1, 37}},
+	{"kern.allowdt", []_C_int{1, 65}},
+	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
 	{"kern.boottime", []_C_int{1, 21}},
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
-	{"kern.cryptodevallowsoft", []_C_int{1, 53}},
+	{"kern.cpustats", []_C_int{1, 85}},
 	{"kern.domainname", []_C_int{1, 22}},
 	{"kern.file", []_C_int{1, 73}},
 	{"kern.forkstat", []_C_int{1, 42}},
 	{"kern.fscale", []_C_int{1, 46}},
 	{"kern.fsync", []_C_int{1, 33}},
+	{"kern.global_ptrace", []_C_int{1, 81}},
 	{"kern.hostid", []_C_int{1, 11}},
 	{"kern.hostname", []_C_int{1, 10}},
 	{"kern.intrcnt.nintrcnt", []_C_int{1, 63, 1}},
@@ -78,17 +87,16 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
-	{"kern.random", []_C_int{1, 31}},
 	{"kern.rawpartition", []_C_int{1, 24}},
 	{"kern.saved_ids", []_C_int{1, 20}},
 	{"kern.securelevel", []_C_int{1, 9}},
@@ -106,21 +114,20 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
-	{"kern.tty.maxptys", []_C_int{1, 44, 6}},
-	{"kern.tty.nptys", []_C_int{1, 44, 7}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
-	{"kern.userasymcrypto", []_C_int{1, 60}},
-	{"kern.usercrypto", []_C_int{1, 52}},
-	{"kern.usermount", []_C_int{1, 30}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
-	{"kern.vnode", []_C_int{1, 13}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
+	{"kern.wxabort", []_C_int{1, 74}},
 	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
 	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
 	{"net.inet.ah.enable", []_C_int{4, 2, 51, 1}},
@@ -148,7 +155,9 @@ var sysctlMib = []mibentry{
 	{"net.inet.icmp.stats", []_C_int{4, 2, 1, 7}},
 	{"net.inet.icmp.tstamprepl", []_C_int{4, 2, 1, 6}},
 	{"net.inet.igmp.stats", []_C_int{4, 2, 2, 1}},
+	{"net.inet.ip.arpdown", []_C_int{4, 2, 0, 40}},
 	{"net.inet.ip.arpqueued", []_C_int{4, 2, 0, 36}},
+	{"net.inet.ip.arptimeout", []_C_int{4, 2, 0, 39}},
 	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
 	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
 	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
@@ -157,8 +166,10 @@ var sysctlMib = []mibentry{
 	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
 	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},
 	{"net.inet.ip.mforwarding", []_C_int{4, 2, 0, 31}},
+	{"net.inet.ip.mrtmfc", []_C_int{4, 2, 0, 37}},
 	{"net.inet.ip.mrtproto", []_C_int{4, 2, 0, 34}},
 	{"net.inet.ip.mrtstats", []_C_int{4, 2, 0, 35}},
+	{"net.inet.ip.mrtvif", []_C_int{4, 2, 0, 38}},
 	{"net.inet.ip.mtu", []_C_int{4, 2, 0, 4}},
 	{"net.inet.ip.mtudisc", []_C_int{4, 2, 0, 27}},
 	{"net.inet.ip.mtudisctimeout", []_C_int{4, 2, 0, 28}},
@@ -175,9 +186,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
-	{"net.inet.pim.stats", []_C_int{4, 2, 103, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
 	{"net.inet.tcp.baddynamic", []_C_int{4, 2, 6, 6}},
@@ -191,6 +200,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.reasslimit", []_C_int{4, 2, 6, 18}},
 	{"net.inet.tcp.rfc1323", []_C_int{4, 2, 6, 1}},
 	{"net.inet.tcp.rfc3390", []_C_int{4, 2, 6, 17}},
+	{"net.inet.tcp.rootonly", []_C_int{4, 2, 6, 24}},
 	{"net.inet.tcp.rstppslimit", []_C_int{4, 2, 6, 12}},
 	{"net.inet.tcp.sack", []_C_int{4, 2, 6, 10}},
 	{"net.inet.tcp.sackholelimit", []_C_int{4, 2, 6, 20}},
@@ -198,9 +208,12 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.stats", []_C_int{4, 2, 6, 21}},
 	{"net.inet.tcp.synbucketlimit", []_C_int{4, 2, 6, 16}},
 	{"net.inet.tcp.syncachelimit", []_C_int{4, 2, 6, 15}},
+	{"net.inet.tcp.synhashsize", []_C_int{4, 2, 6, 25}},
+	{"net.inet.tcp.synuselimit", []_C_int{4, 2, 6, 23}},
 	{"net.inet.udp.baddynamic", []_C_int{4, 2, 17, 2}},
 	{"net.inet.udp.checksum", []_C_int{4, 2, 17, 1}},
 	{"net.inet.udp.recvspace", []_C_int{4, 2, 17, 3}},
+	{"net.inet.udp.rootonly", []_C_int{4, 2, 17, 6}},
 	{"net.inet.udp.sendspace", []_C_int{4, 2, 17, 4}},
 	{"net.inet.udp.stats", []_C_int{4, 2, 17, 5}},
 	{"net.inet6.divert.recvspace", []_C_int{4, 24, 86, 1}},
@@ -213,13 +226,8 @@ var sysctlMib = []mibentry{
 	{"net.inet6.icmp6.nd6_delay", []_C_int{4, 24, 30, 8}},
 	{"net.inet6.icmp6.nd6_maxnudhint", []_C_int{4, 24, 30, 15}},
 	{"net.inet6.icmp6.nd6_mmaxtries", []_C_int{4, 24, 30, 10}},
-	{"net.inet6.icmp6.nd6_prune", []_C_int{4, 24, 30, 6}},
 	{"net.inet6.icmp6.nd6_umaxtries", []_C_int{4, 24, 30, 9}},
-	{"net.inet6.icmp6.nd6_useloopback", []_C_int{4, 24, 30, 11}},
-	{"net.inet6.icmp6.nodeinfo", []_C_int{4, 24, 30, 13}},
-	{"net.inet6.icmp6.rediraccept", []_C_int{4, 24, 30, 2}},
 	{"net.inet6.icmp6.redirtimeout", []_C_int{4, 24, 30, 3}},
-	{"net.inet6.ip6.accept_rtadv", []_C_int{4, 24, 17, 12}},
 	{"net.inet6.ip6.auto_flowlabel", []_C_int{4, 24, 17, 17}},
 	{"net.inet6.ip6.dad_count", []_C_int{4, 24, 17, 16}},
 	{"net.inet6.ip6.dad_pending", []_C_int{4, 24, 17, 49}},
@@ -232,20 +240,19 @@ var sysctlMib = []mibentry{
 	{"net.inet6.ip6.maxdynroutes", []_C_int{4, 24, 17, 48}},
 	{"net.inet6.ip6.maxfragpackets", []_C_int{4, 24, 17, 9}},
 	{"net.inet6.ip6.maxfrags", []_C_int{4, 24, 17, 41}},
-	{"net.inet6.ip6.maxifdefrouters", []_C_int{4, 24, 17, 47}},
-	{"net.inet6.ip6.maxifprefixes", []_C_int{4, 24, 17, 46}},
 	{"net.inet6.ip6.mforwarding", []_C_int{4, 24, 17, 42}},
+	{"net.inet6.ip6.mrtmfc", []_C_int{4, 24, 17, 53}},
+	{"net.inet6.ip6.mrtmif", []_C_int{4, 24, 17, 52}},
 	{"net.inet6.ip6.mrtproto", []_C_int{4, 24, 17, 8}},
 	{"net.inet6.ip6.mtudisctimeout", []_C_int{4, 24, 17, 50}},
 	{"net.inet6.ip6.multicast_mtudisc", []_C_int{4, 24, 17, 44}},
 	{"net.inet6.ip6.multipath", []_C_int{4, 24, 17, 43}},
 	{"net.inet6.ip6.neighborgcthresh", []_C_int{4, 24, 17, 45}},
 	{"net.inet6.ip6.redirect", []_C_int{4, 24, 17, 2}},
-	{"net.inet6.ip6.rr_prune", []_C_int{4, 24, 17, 22}},
+	{"net.inet6.ip6.soiikey", []_C_int{4, 24, 17, 54}},
 	{"net.inet6.ip6.sourcecheck", []_C_int{4, 24, 17, 10}},
 	{"net.inet6.ip6.sourcecheck_logint", []_C_int{4, 24, 17, 11}},
 	{"net.inet6.ip6.use_deprecated", []_C_int{4, 24, 17, 21}},
-	{"net.inet6.ip6.v6only", []_C_int{4, 24, 17, 24}},
 	{"net.key.sadb_dump", []_C_int{4, 30, 1}},
 	{"net.key.spd_dump", []_C_int{4, 30, 2}},
 	{"net.mpls.ifq.congestion", []_C_int{4, 33, 3, 4}},
@@ -254,12 +261,12 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
 	{"vm.anonmin", []_C_int{2, 7}},
 	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
 	{"vm.maxslp", []_C_int{2, 10}},
 	{"vm.nkmempages", []_C_int{2, 6}},
 	{"vm.psstrings", []_C_int{2, 3}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go
index adecd09667..d2243cf83f 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_amd64.go
@@ -36,23 +36,29 @@ var sysctlMib = []mibentry{
 	{"hw.pagesize", []_C_int{6, 7}},
 	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
 	{"hw.usermem", []_C_int{6, 20}},
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
+	{"kern.allowdt", []_C_int{1, 65}},
 	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
 	{"kern.boottime", []_C_int{1, 21}},
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
-	{"kern.dnsjackport", []_C_int{1, 13}},
+	{"kern.cpustats", []_C_int{1, 85}},
 	{"kern.domainname", []_C_int{1, 22}},
 	{"kern.file", []_C_int{1, 73}},
 	{"kern.forkstat", []_C_int{1, 42}},
@@ -81,13 +87,13 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
@@ -108,15 +114,19 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
 	{"kern.wxabort", []_C_int{1, 74}},
 	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
 	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
@@ -176,7 +186,6 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
@@ -252,12 +261,12 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
 	{"vm.anonmin", []_C_int{2, 7}},
 	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
 	{"vm.maxslp", []_C_int{2, 10}},
 	{"vm.nkmempages", []_C_int{2, 6}},
 	{"vm.psstrings", []_C_int{2, 3}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go
index 8ea52a4a18..82dc51bd8b 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm.go
@@ -17,6 +17,7 @@ var sysctlMib = []mibentry{
 	{"ddb.max_line", []_C_int{9, 3}},
 	{"ddb.max_width", []_C_int{9, 2}},
 	{"ddb.panic", []_C_int{9, 5}},
+	{"ddb.profile", []_C_int{9, 9}},
 	{"ddb.radix", []_C_int{9, 1}},
 	{"ddb.tab_stop_width", []_C_int{9, 4}},
 	{"ddb.trigger", []_C_int{9, 8}},
@@ -33,29 +34,37 @@ var sysctlMib = []mibentry{
 	{"hw.ncpufound", []_C_int{6, 21}},
 	{"hw.ncpuonline", []_C_int{6, 25}},
 	{"hw.pagesize", []_C_int{6, 7}},
+	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
 	{"hw.usermem", []_C_int{6, 20}},
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
-	{"kern.arandom", []_C_int{1, 37}},
+	{"kern.allowdt", []_C_int{1, 65}},
+	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
 	{"kern.boottime", []_C_int{1, 21}},
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
-	{"kern.cryptodevallowsoft", []_C_int{1, 53}},
+	{"kern.cpustats", []_C_int{1, 85}},
 	{"kern.domainname", []_C_int{1, 22}},
 	{"kern.file", []_C_int{1, 73}},
 	{"kern.forkstat", []_C_int{1, 42}},
 	{"kern.fscale", []_C_int{1, 46}},
 	{"kern.fsync", []_C_int{1, 33}},
+	{"kern.global_ptrace", []_C_int{1, 81}},
 	{"kern.hostid", []_C_int{1, 11}},
 	{"kern.hostname", []_C_int{1, 10}},
 	{"kern.intrcnt.nintrcnt", []_C_int{1, 63, 1}},
@@ -78,17 +87,16 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
-	{"kern.random", []_C_int{1, 31}},
 	{"kern.rawpartition", []_C_int{1, 24}},
 	{"kern.saved_ids", []_C_int{1, 20}},
 	{"kern.securelevel", []_C_int{1, 9}},
@@ -106,21 +114,20 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
-	{"kern.tty.maxptys", []_C_int{1, 44, 6}},
-	{"kern.tty.nptys", []_C_int{1, 44, 7}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
-	{"kern.userasymcrypto", []_C_int{1, 60}},
-	{"kern.usercrypto", []_C_int{1, 52}},
-	{"kern.usermount", []_C_int{1, 30}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
-	{"kern.vnode", []_C_int{1, 13}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
+	{"kern.wxabort", []_C_int{1, 74}},
 	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
 	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
 	{"net.inet.ah.enable", []_C_int{4, 2, 51, 1}},
@@ -148,7 +155,9 @@ var sysctlMib = []mibentry{
 	{"net.inet.icmp.stats", []_C_int{4, 2, 1, 7}},
 	{"net.inet.icmp.tstamprepl", []_C_int{4, 2, 1, 6}},
 	{"net.inet.igmp.stats", []_C_int{4, 2, 2, 1}},
+	{"net.inet.ip.arpdown", []_C_int{4, 2, 0, 40}},
 	{"net.inet.ip.arpqueued", []_C_int{4, 2, 0, 36}},
+	{"net.inet.ip.arptimeout", []_C_int{4, 2, 0, 39}},
 	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
 	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
 	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
@@ -157,8 +166,10 @@ var sysctlMib = []mibentry{
 	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
 	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},
 	{"net.inet.ip.mforwarding", []_C_int{4, 2, 0, 31}},
+	{"net.inet.ip.mrtmfc", []_C_int{4, 2, 0, 37}},
 	{"net.inet.ip.mrtproto", []_C_int{4, 2, 0, 34}},
 	{"net.inet.ip.mrtstats", []_C_int{4, 2, 0, 35}},
+	{"net.inet.ip.mrtvif", []_C_int{4, 2, 0, 38}},
 	{"net.inet.ip.mtu", []_C_int{4, 2, 0, 4}},
 	{"net.inet.ip.mtudisc", []_C_int{4, 2, 0, 27}},
 	{"net.inet.ip.mtudisctimeout", []_C_int{4, 2, 0, 28}},
@@ -175,9 +186,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
-	{"net.inet.pim.stats", []_C_int{4, 2, 103, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
 	{"net.inet.tcp.baddynamic", []_C_int{4, 2, 6, 6}},
@@ -191,6 +200,7 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.reasslimit", []_C_int{4, 2, 6, 18}},
 	{"net.inet.tcp.rfc1323", []_C_int{4, 2, 6, 1}},
 	{"net.inet.tcp.rfc3390", []_C_int{4, 2, 6, 17}},
+	{"net.inet.tcp.rootonly", []_C_int{4, 2, 6, 24}},
 	{"net.inet.tcp.rstppslimit", []_C_int{4, 2, 6, 12}},
 	{"net.inet.tcp.sack", []_C_int{4, 2, 6, 10}},
 	{"net.inet.tcp.sackholelimit", []_C_int{4, 2, 6, 20}},
@@ -198,9 +208,12 @@ var sysctlMib = []mibentry{
 	{"net.inet.tcp.stats", []_C_int{4, 2, 6, 21}},
 	{"net.inet.tcp.synbucketlimit", []_C_int{4, 2, 6, 16}},
 	{"net.inet.tcp.syncachelimit", []_C_int{4, 2, 6, 15}},
+	{"net.inet.tcp.synhashsize", []_C_int{4, 2, 6, 25}},
+	{"net.inet.tcp.synuselimit", []_C_int{4, 2, 6, 23}},
 	{"net.inet.udp.baddynamic", []_C_int{4, 2, 17, 2}},
 	{"net.inet.udp.checksum", []_C_int{4, 2, 17, 1}},
 	{"net.inet.udp.recvspace", []_C_int{4, 2, 17, 3}},
+	{"net.inet.udp.rootonly", []_C_int{4, 2, 17, 6}},
 	{"net.inet.udp.sendspace", []_C_int{4, 2, 17, 4}},
 	{"net.inet.udp.stats", []_C_int{4, 2, 17, 5}},
 	{"net.inet6.divert.recvspace", []_C_int{4, 24, 86, 1}},
@@ -213,13 +226,8 @@ var sysctlMib = []mibentry{
 	{"net.inet6.icmp6.nd6_delay", []_C_int{4, 24, 30, 8}},
 	{"net.inet6.icmp6.nd6_maxnudhint", []_C_int{4, 24, 30, 15}},
 	{"net.inet6.icmp6.nd6_mmaxtries", []_C_int{4, 24, 30, 10}},
-	{"net.inet6.icmp6.nd6_prune", []_C_int{4, 24, 30, 6}},
 	{"net.inet6.icmp6.nd6_umaxtries", []_C_int{4, 24, 30, 9}},
-	{"net.inet6.icmp6.nd6_useloopback", []_C_int{4, 24, 30, 11}},
-	{"net.inet6.icmp6.nodeinfo", []_C_int{4, 24, 30, 13}},
-	{"net.inet6.icmp6.rediraccept", []_C_int{4, 24, 30, 2}},
 	{"net.inet6.icmp6.redirtimeout", []_C_int{4, 24, 30, 3}},
-	{"net.inet6.ip6.accept_rtadv", []_C_int{4, 24, 17, 12}},
 	{"net.inet6.ip6.auto_flowlabel", []_C_int{4, 24, 17, 17}},
 	{"net.inet6.ip6.dad_count", []_C_int{4, 24, 17, 16}},
 	{"net.inet6.ip6.dad_pending", []_C_int{4, 24, 17, 49}},
@@ -232,20 +240,19 @@ var sysctlMib = []mibentry{
 	{"net.inet6.ip6.maxdynroutes", []_C_int{4, 24, 17, 48}},
 	{"net.inet6.ip6.maxfragpackets", []_C_int{4, 24, 17, 9}},
 	{"net.inet6.ip6.maxfrags", []_C_int{4, 24, 17, 41}},
-	{"net.inet6.ip6.maxifdefrouters", []_C_int{4, 24, 17, 47}},
-	{"net.inet6.ip6.maxifprefixes", []_C_int{4, 24, 17, 46}},
 	{"net.inet6.ip6.mforwarding", []_C_int{4, 24, 17, 42}},
+	{"net.inet6.ip6.mrtmfc", []_C_int{4, 24, 17, 53}},
+	{"net.inet6.ip6.mrtmif", []_C_int{4, 24, 17, 52}},
 	{"net.inet6.ip6.mrtproto", []_C_int{4, 24, 17, 8}},
 	{"net.inet6.ip6.mtudisctimeout", []_C_int{4, 24, 17, 50}},
 	{"net.inet6.ip6.multicast_mtudisc", []_C_int{4, 24, 17, 44}},
 	{"net.inet6.ip6.multipath", []_C_int{4, 24, 17, 43}},
 	{"net.inet6.ip6.neighborgcthresh", []_C_int{4, 24, 17, 45}},
 	{"net.inet6.ip6.redirect", []_C_int{4, 24, 17, 2}},
-	{"net.inet6.ip6.rr_prune", []_C_int{4, 24, 17, 22}},
+	{"net.inet6.ip6.soiikey", []_C_int{4, 24, 17, 54}},
 	{"net.inet6.ip6.sourcecheck", []_C_int{4, 24, 17, 10}},
 	{"net.inet6.ip6.sourcecheck_logint", []_C_int{4, 24, 17, 11}},
 	{"net.inet6.ip6.use_deprecated", []_C_int{4, 24, 17, 21}},
-	{"net.inet6.ip6.v6only", []_C_int{4, 24, 17, 24}},
 	{"net.key.sadb_dump", []_C_int{4, 30, 1}},
 	{"net.key.spd_dump", []_C_int{4, 30, 2}},
 	{"net.mpls.ifq.congestion", []_C_int{4, 33, 3, 4}},
@@ -254,12 +261,12 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
 	{"vm.anonmin", []_C_int{2, 7}},
 	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
 	{"vm.maxslp", []_C_int{2, 10}},
 	{"vm.nkmempages", []_C_int{2, 6}},
 	{"vm.psstrings", []_C_int{2, 3}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go
index 154b57ae3e..cbdda1a4ae 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_arm64.go
@@ -36,6 +36,7 @@ var sysctlMib = []mibentry{
 	{"hw.pagesize", []_C_int{6, 7}},
 	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
@@ -44,6 +45,7 @@ var sysctlMib = []mibentry{
 	{"hw.uuid", []_C_int{6, 18}},
 	{"hw.vendor", []_C_int{6, 14}},
 	{"hw.version", []_C_int{6, 16}},
+	{"kern.allowdt", []_C_int{1, 65}},
 	{"kern.allowkmem", []_C_int{1, 52}},
 	{"kern.argmax", []_C_int{1, 8}},
 	{"kern.audio", []_C_int{1, 84}},
@@ -51,6 +53,8 @@ var sysctlMib = []mibentry{
 	{"kern.bufcachepercent", []_C_int{1, 72}},
 	{"kern.ccpu", []_C_int{1, 45}},
 	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
 	{"kern.consdev", []_C_int{1, 75}},
 	{"kern.cp_time", []_C_int{1, 40}},
 	{"kern.cp_time2", []_C_int{1, 71}},
@@ -83,13 +87,13 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
 	{"kern.osrevision", []_C_int{1, 3}},
 	{"kern.ostype", []_C_int{1, 1}},
 	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
 	{"kern.pool_debug", []_C_int{1, 77}},
 	{"kern.posix1version", []_C_int{1, 17}},
 	{"kern.proc", []_C_int{1, 66}},
@@ -110,13 +114,16 @@ var sysctlMib = []mibentry{
 	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
 	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
 	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
 	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
 	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
 	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
 	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
 	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
 	{"kern.ttycount", []_C_int{1, 57}},
+	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
 	{"kern.witnesswatch", []_C_int{1, 53}},
@@ -179,7 +186,6 @@ var sysctlMib = []mibentry{
 	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
 	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
 	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
-	{"net.inet.mobileip.allow", []_C_int{4, 2, 55, 1}},
 	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
 	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
 	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
@@ -255,7 +261,6 @@ var sysctlMib = []mibentry{
 	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
 	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
 	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
-	{"net.mpls.maxloop_inkernel", []_C_int{4, 33, 4}},
 	{"net.mpls.ttl", []_C_int{4, 33, 2}},
 	{"net.pflow.stats", []_C_int{4, 34, 1}},
 	{"net.pipex.enable", []_C_int{4, 35, 1}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go
index d96bb2ba4d..f55eae1a82 100644
--- a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_mips64.go
@@ -36,6 +36,7 @@ var sysctlMib = []mibentry{
 	{"hw.pagesize", []_C_int{6, 7}},
 	{"hw.perfpolicy", []_C_int{6, 23}},
 	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
 	{"hw.product", []_C_int{6, 15}},
 	{"hw.serialno", []_C_int{6, 17}},
 	{"hw.setperf", []_C_int{6, 13}},
@@ -86,7 +87,6 @@ var sysctlMib = []mibentry{
 	{"kern.ngroups", []_C_int{1, 18}},
 	{"kern.nosuidcoredump", []_C_int{1, 32}},
 	{"kern.nprocs", []_C_int{1, 47}},
-	{"kern.nselcoll", []_C_int{1, 43}},
 	{"kern.nthreads", []_C_int{1, 26}},
 	{"kern.numvnodes", []_C_int{1, 58}},
 	{"kern.osrelease", []_C_int{1, 2}},
@@ -123,6 +123,7 @@ var sysctlMib = []mibentry{
 	{"kern.ttycount", []_C_int{1, 57}},
 	{"kern.utc_offset", []_C_int{1, 88}},
 	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
 	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
 	{"kern.watchdog.period", []_C_int{1, 64, 1}},
 	{"kern.witnesswatch", []_C_int{1, 53}},
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_ppc64.go
new file mode 100644
index 0000000000..e44054470b
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_ppc64.go
@@ -0,0 +1,281 @@
+// go run mksysctl_openbsd.go
+// Code generated by the command above; DO NOT EDIT.
+
+//go:build ppc64 && openbsd
+// +build ppc64,openbsd
+
+package unix
+
+type mibentry struct {
+	ctlname string
+	ctloid  []_C_int
+}
+
+var sysctlMib = []mibentry{
+	{"ddb.console", []_C_int{9, 6}},
+	{"ddb.log", []_C_int{9, 7}},
+	{"ddb.max_line", []_C_int{9, 3}},
+	{"ddb.max_width", []_C_int{9, 2}},
+	{"ddb.panic", []_C_int{9, 5}},
+	{"ddb.profile", []_C_int{9, 9}},
+	{"ddb.radix", []_C_int{9, 1}},
+	{"ddb.tab_stop_width", []_C_int{9, 4}},
+	{"ddb.trigger", []_C_int{9, 8}},
+	{"fs.posix.setuid", []_C_int{3, 1, 1}},
+	{"hw.allowpowerdown", []_C_int{6, 22}},
+	{"hw.byteorder", []_C_int{6, 4}},
+	{"hw.cpuspeed", []_C_int{6, 12}},
+	{"hw.diskcount", []_C_int{6, 10}},
+	{"hw.disknames", []_C_int{6, 8}},
+	{"hw.diskstats", []_C_int{6, 9}},
+	{"hw.machine", []_C_int{6, 1}},
+	{"hw.model", []_C_int{6, 2}},
+	{"hw.ncpu", []_C_int{6, 3}},
+	{"hw.ncpufound", []_C_int{6, 21}},
+	{"hw.ncpuonline", []_C_int{6, 25}},
+	{"hw.pagesize", []_C_int{6, 7}},
+	{"hw.perfpolicy", []_C_int{6, 23}},
+	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
+	{"hw.product", []_C_int{6, 15}},
+	{"hw.serialno", []_C_int{6, 17}},
+	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
+	{"hw.usermem", []_C_int{6, 20}},
+	{"hw.uuid", []_C_int{6, 18}},
+	{"hw.vendor", []_C_int{6, 14}},
+	{"hw.version", []_C_int{6, 16}},
+	{"kern.allowdt", []_C_int{1, 65}},
+	{"kern.allowkmem", []_C_int{1, 52}},
+	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
+	{"kern.boottime", []_C_int{1, 21}},
+	{"kern.bufcachepercent", []_C_int{1, 72}},
+	{"kern.ccpu", []_C_int{1, 45}},
+	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
+	{"kern.consdev", []_C_int{1, 75}},
+	{"kern.cp_time", []_C_int{1, 40}},
+	{"kern.cp_time2", []_C_int{1, 71}},
+	{"kern.cpustats", []_C_int{1, 85}},
+	{"kern.domainname", []_C_int{1, 22}},
+	{"kern.file", []_C_int{1, 73}},
+	{"kern.forkstat", []_C_int{1, 42}},
+	{"kern.fscale", []_C_int{1, 46}},
+	{"kern.fsync", []_C_int{1, 33}},
+	{"kern.global_ptrace", []_C_int{1, 81}},
+	{"kern.hostid", []_C_int{1, 11}},
+	{"kern.hostname", []_C_int{1, 10}},
+	{"kern.intrcnt.nintrcnt", []_C_int{1, 63, 1}},
+	{"kern.job_control", []_C_int{1, 19}},
+	{"kern.malloc.buckets", []_C_int{1, 39, 1}},
+	{"kern.malloc.kmemnames", []_C_int{1, 39, 3}},
+	{"kern.maxclusters", []_C_int{1, 67}},
+	{"kern.maxfiles", []_C_int{1, 7}},
+	{"kern.maxlocksperuid", []_C_int{1, 70}},
+	{"kern.maxpartitions", []_C_int{1, 23}},
+	{"kern.maxproc", []_C_int{1, 6}},
+	{"kern.maxthread", []_C_int{1, 25}},
+	{"kern.maxvnodes", []_C_int{1, 5}},
+	{"kern.mbstat", []_C_int{1, 59}},
+	{"kern.msgbuf", []_C_int{1, 48}},
+	{"kern.msgbufsize", []_C_int{1, 38}},
+	{"kern.nchstats", []_C_int{1, 41}},
+	{"kern.netlivelocks", []_C_int{1, 76}},
+	{"kern.nfiles", []_C_int{1, 56}},
+	{"kern.ngroups", []_C_int{1, 18}},
+	{"kern.nosuidcoredump", []_C_int{1, 32}},
+	{"kern.nprocs", []_C_int{1, 47}},
+	{"kern.nthreads", []_C_int{1, 26}},
+	{"kern.numvnodes", []_C_int{1, 58}},
+	{"kern.osrelease", []_C_int{1, 2}},
+	{"kern.osrevision", []_C_int{1, 3}},
+	{"kern.ostype", []_C_int{1, 1}},
+	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
+	{"kern.pool_debug", []_C_int{1, 77}},
+	{"kern.posix1version", []_C_int{1, 17}},
+	{"kern.proc", []_C_int{1, 66}},
+	{"kern.rawpartition", []_C_int{1, 24}},
+	{"kern.saved_ids", []_C_int{1, 20}},
+	{"kern.securelevel", []_C_int{1, 9}},
+	{"kern.seminfo", []_C_int{1, 61}},
+	{"kern.shminfo", []_C_int{1, 62}},
+	{"kern.somaxconn", []_C_int{1, 28}},
+	{"kern.sominconn", []_C_int{1, 29}},
+	{"kern.splassert", []_C_int{1, 54}},
+	{"kern.stackgap_random", []_C_int{1, 50}},
+	{"kern.sysvipc_info", []_C_int{1, 51}},
+	{"kern.sysvmsg", []_C_int{1, 34}},
+	{"kern.sysvsem", []_C_int{1, 35}},
+	{"kern.sysvshm", []_C_int{1, 36}},
+	{"kern.timecounter.choice", []_C_int{1, 69, 4}},
+	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
+	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
+	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
+	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
+	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
+	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
+	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
+	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
+	{"kern.ttycount", []_C_int{1, 57}},
+	{"kern.utc_offset", []_C_int{1, 88}},
+	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
+	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
+	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
+	{"kern.wxabort", []_C_int{1, 74}},
+	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
+	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
+	{"net.inet.ah.enable", []_C_int{4, 2, 51, 1}},
+	{"net.inet.ah.stats", []_C_int{4, 2, 51, 2}},
+	{"net.inet.carp.allow", []_C_int{4, 2, 112, 1}},
+	{"net.inet.carp.log", []_C_int{4, 2, 112, 3}},
+	{"net.inet.carp.preempt", []_C_int{4, 2, 112, 2}},
+	{"net.inet.carp.stats", []_C_int{4, 2, 112, 4}},
+	{"net.inet.divert.recvspace", []_C_int{4, 2, 258, 1}},
+	{"net.inet.divert.sendspace", []_C_int{4, 2, 258, 2}},
+	{"net.inet.divert.stats", []_C_int{4, 2, 258, 3}},
+	{"net.inet.esp.enable", []_C_int{4, 2, 50, 1}},
+	{"net.inet.esp.stats", []_C_int{4, 2, 50, 4}},
+	{"net.inet.esp.udpencap", []_C_int{4, 2, 50, 2}},
+	{"net.inet.esp.udpencap_port", []_C_int{4, 2, 50, 3}},
+	{"net.inet.etherip.allow", []_C_int{4, 2, 97, 1}},
+	{"net.inet.etherip.stats", []_C_int{4, 2, 97, 2}},
+	{"net.inet.gre.allow", []_C_int{4, 2, 47, 1}},
+	{"net.inet.gre.wccp", []_C_int{4, 2, 47, 2}},
+	{"net.inet.icmp.bmcastecho", []_C_int{4, 2, 1, 2}},
+	{"net.inet.icmp.errppslimit", []_C_int{4, 2, 1, 3}},
+	{"net.inet.icmp.maskrepl", []_C_int{4, 2, 1, 1}},
+	{"net.inet.icmp.rediraccept", []_C_int{4, 2, 1, 4}},
+	{"net.inet.icmp.redirtimeout", []_C_int{4, 2, 1, 5}},
+	{"net.inet.icmp.stats", []_C_int{4, 2, 1, 7}},
+	{"net.inet.icmp.tstamprepl", []_C_int{4, 2, 1, 6}},
+	{"net.inet.igmp.stats", []_C_int{4, 2, 2, 1}},
+	{"net.inet.ip.arpdown", []_C_int{4, 2, 0, 40}},
+	{"net.inet.ip.arpqueued", []_C_int{4, 2, 0, 36}},
+	{"net.inet.ip.arptimeout", []_C_int{4, 2, 0, 39}},
+	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
+	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
+	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
+	{"net.inet.ip.ifq.drops", []_C_int{4, 2, 0, 30, 3}},
+	{"net.inet.ip.ifq.len", []_C_int{4, 2, 0, 30, 1}},
+	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
+	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},
+	{"net.inet.ip.mforwarding", []_C_int{4, 2, 0, 31}},
+	{"net.inet.ip.mrtmfc", []_C_int{4, 2, 0, 37}},
+	{"net.inet.ip.mrtproto", []_C_int{4, 2, 0, 34}},
+	{"net.inet.ip.mrtstats", []_C_int{4, 2, 0, 35}},
+	{"net.inet.ip.mrtvif", []_C_int{4, 2, 0, 38}},
+	{"net.inet.ip.mtu", []_C_int{4, 2, 0, 4}},
+	{"net.inet.ip.mtudisc", []_C_int{4, 2, 0, 27}},
+	{"net.inet.ip.mtudisctimeout", []_C_int{4, 2, 0, 28}},
+	{"net.inet.ip.multipath", []_C_int{4, 2, 0, 32}},
+	{"net.inet.ip.portfirst", []_C_int{4, 2, 0, 7}},
+	{"net.inet.ip.porthifirst", []_C_int{4, 2, 0, 9}},
+	{"net.inet.ip.porthilast", []_C_int{4, 2, 0, 10}},
+	{"net.inet.ip.portlast", []_C_int{4, 2, 0, 8}},
+	{"net.inet.ip.redirect", []_C_int{4, 2, 0, 2}},
+	{"net.inet.ip.sourceroute", []_C_int{4, 2, 0, 5}},
+	{"net.inet.ip.stats", []_C_int{4, 2, 0, 33}},
+	{"net.inet.ip.ttl", []_C_int{4, 2, 0, 3}},
+	{"net.inet.ipcomp.enable", []_C_int{4, 2, 108, 1}},
+	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
+	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
+	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
+	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
+	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
+	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
+	{"net.inet.tcp.baddynamic", []_C_int{4, 2, 6, 6}},
+	{"net.inet.tcp.drop", []_C_int{4, 2, 6, 19}},
+	{"net.inet.tcp.ecn", []_C_int{4, 2, 6, 14}},
+	{"net.inet.tcp.ident", []_C_int{4, 2, 6, 9}},
+	{"net.inet.tcp.keepidle", []_C_int{4, 2, 6, 3}},
+	{"net.inet.tcp.keepinittime", []_C_int{4, 2, 6, 2}},
+	{"net.inet.tcp.keepintvl", []_C_int{4, 2, 6, 4}},
+	{"net.inet.tcp.mssdflt", []_C_int{4, 2, 6, 11}},
+	{"net.inet.tcp.reasslimit", []_C_int{4, 2, 6, 18}},
+	{"net.inet.tcp.rfc1323", []_C_int{4, 2, 6, 1}},
+	{"net.inet.tcp.rfc3390", []_C_int{4, 2, 6, 17}},
+	{"net.inet.tcp.rootonly", []_C_int{4, 2, 6, 24}},
+	{"net.inet.tcp.rstppslimit", []_C_int{4, 2, 6, 12}},
+	{"net.inet.tcp.sack", []_C_int{4, 2, 6, 10}},
+	{"net.inet.tcp.sackholelimit", []_C_int{4, 2, 6, 20}},
+	{"net.inet.tcp.slowhz", []_C_int{4, 2, 6, 5}},
+	{"net.inet.tcp.stats", []_C_int{4, 2, 6, 21}},
+	{"net.inet.tcp.synbucketlimit", []_C_int{4, 2, 6, 16}},
+	{"net.inet.tcp.syncachelimit", []_C_int{4, 2, 6, 15}},
+	{"net.inet.tcp.synhashsize", []_C_int{4, 2, 6, 25}},
+	{"net.inet.tcp.synuselimit", []_C_int{4, 2, 6, 23}},
+	{"net.inet.udp.baddynamic", []_C_int{4, 2, 17, 2}},
+	{"net.inet.udp.checksum", []_C_int{4, 2, 17, 1}},
+	{"net.inet.udp.recvspace", []_C_int{4, 2, 17, 3}},
+	{"net.inet.udp.rootonly", []_C_int{4, 2, 17, 6}},
+	{"net.inet.udp.sendspace", []_C_int{4, 2, 17, 4}},
+	{"net.inet.udp.stats", []_C_int{4, 2, 17, 5}},
+	{"net.inet6.divert.recvspace", []_C_int{4, 24, 86, 1}},
+	{"net.inet6.divert.sendspace", []_C_int{4, 24, 86, 2}},
+	{"net.inet6.divert.stats", []_C_int{4, 24, 86, 3}},
+	{"net.inet6.icmp6.errppslimit", []_C_int{4, 24, 30, 14}},
+	{"net.inet6.icmp6.mtudisc_hiwat", []_C_int{4, 24, 30, 16}},
+	{"net.inet6.icmp6.mtudisc_lowat", []_C_int{4, 24, 30, 17}},
+	{"net.inet6.icmp6.nd6_debug", []_C_int{4, 24, 30, 18}},
+	{"net.inet6.icmp6.nd6_delay", []_C_int{4, 24, 30, 8}},
+	{"net.inet6.icmp6.nd6_maxnudhint", []_C_int{4, 24, 30, 15}},
+	{"net.inet6.icmp6.nd6_mmaxtries", []_C_int{4, 24, 30, 10}},
+	{"net.inet6.icmp6.nd6_umaxtries", []_C_int{4, 24, 30, 9}},
+	{"net.inet6.icmp6.redirtimeout", []_C_int{4, 24, 30, 3}},
+	{"net.inet6.ip6.auto_flowlabel", []_C_int{4, 24, 17, 17}},
+	{"net.inet6.ip6.dad_count", []_C_int{4, 24, 17, 16}},
+	{"net.inet6.ip6.dad_pending", []_C_int{4, 24, 17, 49}},
+	{"net.inet6.ip6.defmcasthlim", []_C_int{4, 24, 17, 18}},
+	{"net.inet6.ip6.forwarding", []_C_int{4, 24, 17, 1}},
+	{"net.inet6.ip6.forwsrcrt", []_C_int{4, 24, 17, 5}},
+	{"net.inet6.ip6.hdrnestlimit", []_C_int{4, 24, 17, 15}},
+	{"net.inet6.ip6.hlim", []_C_int{4, 24, 17, 3}},
+	{"net.inet6.ip6.log_interval", []_C_int{4, 24, 17, 14}},
+	{"net.inet6.ip6.maxdynroutes", []_C_int{4, 24, 17, 48}},
+	{"net.inet6.ip6.maxfragpackets", []_C_int{4, 24, 17, 9}},
+	{"net.inet6.ip6.maxfrags", []_C_int{4, 24, 17, 41}},
+	{"net.inet6.ip6.mforwarding", []_C_int{4, 24, 17, 42}},
+	{"net.inet6.ip6.mrtmfc", []_C_int{4, 24, 17, 53}},
+	{"net.inet6.ip6.mrtmif", []_C_int{4, 24, 17, 52}},
+	{"net.inet6.ip6.mrtproto", []_C_int{4, 24, 17, 8}},
+	{"net.inet6.ip6.mtudisctimeout", []_C_int{4, 24, 17, 50}},
+	{"net.inet6.ip6.multicast_mtudisc", []_C_int{4, 24, 17, 44}},
+	{"net.inet6.ip6.multipath", []_C_int{4, 24, 17, 43}},
+	{"net.inet6.ip6.neighborgcthresh", []_C_int{4, 24, 17, 45}},
+	{"net.inet6.ip6.redirect", []_C_int{4, 24, 17, 2}},
+	{"net.inet6.ip6.soiikey", []_C_int{4, 24, 17, 54}},
+	{"net.inet6.ip6.sourcecheck", []_C_int{4, 24, 17, 10}},
+	{"net.inet6.ip6.sourcecheck_logint", []_C_int{4, 24, 17, 11}},
+	{"net.inet6.ip6.use_deprecated", []_C_int{4, 24, 17, 21}},
+	{"net.key.sadb_dump", []_C_int{4, 30, 1}},
+	{"net.key.spd_dump", []_C_int{4, 30, 2}},
+	{"net.mpls.ifq.congestion", []_C_int{4, 33, 3, 4}},
+	{"net.mpls.ifq.drops", []_C_int{4, 33, 3, 3}},
+	{"net.mpls.ifq.len", []_C_int{4, 33, 3, 1}},
+	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
+	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
+	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
+	{"net.mpls.ttl", []_C_int{4, 33, 2}},
+	{"net.pflow.stats", []_C_int{4, 34, 1}},
+	{"net.pipex.enable", []_C_int{4, 35, 1}},
+	{"vm.anonmin", []_C_int{2, 7}},
+	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
+	{"vm.maxslp", []_C_int{2, 10}},
+	{"vm.nkmempages", []_C_int{2, 6}},
+	{"vm.psstrings", []_C_int{2, 3}},
+	{"vm.swapencrypt.enable", []_C_int{2, 5, 0}},
+	{"vm.swapencrypt.keyscreated", []_C_int{2, 5, 1}},
+	{"vm.swapencrypt.keysdeleted", []_C_int{2, 5, 2}},
+	{"vm.uspace", []_C_int{2, 11}},
+	{"vm.uvmexp", []_C_int{2, 4}},
+	{"vm.vmmeter", []_C_int{2, 1}},
+	{"vm.vnodemin", []_C_int{2, 9}},
+	{"vm.vtextmin", []_C_int{2, 8}},
+}
diff --git a/vendor/golang.org/x/sys/unix/zsysctl_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_riscv64.go
new file mode 100644
index 0000000000..a0db82fce2
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsysctl_openbsd_riscv64.go
@@ -0,0 +1,282 @@
+// go run mksysctl_openbsd.go
+// Code generated by the command above; DO NOT EDIT.
+
+//go:build riscv64 && openbsd
+// +build riscv64,openbsd
+
+package unix
+
+type mibentry struct {
+	ctlname string
+	ctloid  []_C_int
+}
+
+var sysctlMib = []mibentry{
+	{"ddb.console", []_C_int{9, 6}},
+	{"ddb.log", []_C_int{9, 7}},
+	{"ddb.max_line", []_C_int{9, 3}},
+	{"ddb.max_width", []_C_int{9, 2}},
+	{"ddb.panic", []_C_int{9, 5}},
+	{"ddb.profile", []_C_int{9, 9}},
+	{"ddb.radix", []_C_int{9, 1}},
+	{"ddb.tab_stop_width", []_C_int{9, 4}},
+	{"ddb.trigger", []_C_int{9, 8}},
+	{"fs.posix.setuid", []_C_int{3, 1, 1}},
+	{"hw.allowpowerdown", []_C_int{6, 22}},
+	{"hw.byteorder", []_C_int{6, 4}},
+	{"hw.cpuspeed", []_C_int{6, 12}},
+	{"hw.diskcount", []_C_int{6, 10}},
+	{"hw.disknames", []_C_int{6, 8}},
+	{"hw.diskstats", []_C_int{6, 9}},
+	{"hw.machine", []_C_int{6, 1}},
+	{"hw.model", []_C_int{6, 2}},
+	{"hw.ncpu", []_C_int{6, 3}},
+	{"hw.ncpufound", []_C_int{6, 21}},
+	{"hw.ncpuonline", []_C_int{6, 25}},
+	{"hw.pagesize", []_C_int{6, 7}},
+	{"hw.perfpolicy", []_C_int{6, 23}},
+	{"hw.physmem", []_C_int{6, 19}},
+	{"hw.power", []_C_int{6, 26}},
+	{"hw.product", []_C_int{6, 15}},
+	{"hw.serialno", []_C_int{6, 17}},
+	{"hw.setperf", []_C_int{6, 13}},
+	{"hw.smt", []_C_int{6, 24}},
+	{"hw.usermem", []_C_int{6, 20}},
+	{"hw.uuid", []_C_int{6, 18}},
+	{"hw.vendor", []_C_int{6, 14}},
+	{"hw.version", []_C_int{6, 16}},
+	{"kern.allowdt", []_C_int{1, 65}},
+	{"kern.allowkmem", []_C_int{1, 52}},
+	{"kern.argmax", []_C_int{1, 8}},
+	{"kern.audio", []_C_int{1, 84}},
+	{"kern.boottime", []_C_int{1, 21}},
+	{"kern.bufcachepercent", []_C_int{1, 72}},
+	{"kern.ccpu", []_C_int{1, 45}},
+	{"kern.clockrate", []_C_int{1, 12}},
+	{"kern.consbuf", []_C_int{1, 83}},
+	{"kern.consbufsize", []_C_int{1, 82}},
+	{"kern.consdev", []_C_int{1, 75}},
+	{"kern.cp_time", []_C_int{1, 40}},
+	{"kern.cp_time2", []_C_int{1, 71}},
+	{"kern.cpustats", []_C_int{1, 85}},
+	{"kern.domainname", []_C_int{1, 22}},
+	{"kern.file", []_C_int{1, 73}},
+	{"kern.forkstat", []_C_int{1, 42}},
+	{"kern.fscale", []_C_int{1, 46}},
+	{"kern.fsync", []_C_int{1, 33}},
+	{"kern.global_ptrace", []_C_int{1, 81}},
+	{"kern.hostid", []_C_int{1, 11}},
+	{"kern.hostname", []_C_int{1, 10}},
+	{"kern.intrcnt.nintrcnt", []_C_int{1, 63, 1}},
+	{"kern.job_control", []_C_int{1, 19}},
+	{"kern.malloc.buckets", []_C_int{1, 39, 1}},
+	{"kern.malloc.kmemnames", []_C_int{1, 39, 3}},
+	{"kern.maxclusters", []_C_int{1, 67}},
+	{"kern.maxfiles", []_C_int{1, 7}},
+	{"kern.maxlocksperuid", []_C_int{1, 70}},
+	{"kern.maxpartitions", []_C_int{1, 23}},
+	{"kern.maxproc", []_C_int{1, 6}},
+	{"kern.maxthread", []_C_int{1, 25}},
+	{"kern.maxvnodes", []_C_int{1, 5}},
+	{"kern.mbstat", []_C_int{1, 59}},
+	{"kern.msgbuf", []_C_int{1, 48}},
+	{"kern.msgbufsize", []_C_int{1, 38}},
+	{"kern.nchstats", []_C_int{1, 41}},
+	{"kern.netlivelocks", []_C_int{1, 76}},
+	{"kern.nfiles", []_C_int{1, 56}},
+	{"kern.ngroups", []_C_int{1, 18}},
+	{"kern.nosuidcoredump", []_C_int{1, 32}},
+	{"kern.nprocs", []_C_int{1, 47}},
+	{"kern.nselcoll", []_C_int{1, 43}},
+	{"kern.nthreads", []_C_int{1, 26}},
+	{"kern.numvnodes", []_C_int{1, 58}},
+	{"kern.osrelease", []_C_int{1, 2}},
+	{"kern.osrevision", []_C_int{1, 3}},
+	{"kern.ostype", []_C_int{1, 1}},
+	{"kern.osversion", []_C_int{1, 27}},
+	{"kern.pfstatus", []_C_int{1, 86}},
+	{"kern.pool_debug", []_C_int{1, 77}},
+	{"kern.posix1version", []_C_int{1, 17}},
+	{"kern.proc", []_C_int{1, 66}},
+	{"kern.rawpartition", []_C_int{1, 24}},
+	{"kern.saved_ids", []_C_int{1, 20}},
+	{"kern.securelevel", []_C_int{1, 9}},
+	{"kern.seminfo", []_C_int{1, 61}},
+	{"kern.shminfo", []_C_int{1, 62}},
+	{"kern.somaxconn", []_C_int{1, 28}},
+	{"kern.sominconn", []_C_int{1, 29}},
+	{"kern.splassert", []_C_int{1, 54}},
+	{"kern.stackgap_random", []_C_int{1, 50}},
+	{"kern.sysvipc_info", []_C_int{1, 51}},
+	{"kern.sysvmsg", []_C_int{1, 34}},
+	{"kern.sysvsem", []_C_int{1, 35}},
+	{"kern.sysvshm", []_C_int{1, 36}},
+	{"kern.timecounter.choice", []_C_int{1, 69, 4}},
+	{"kern.timecounter.hardware", []_C_int{1, 69, 3}},
+	{"kern.timecounter.tick", []_C_int{1, 69, 1}},
+	{"kern.timecounter.timestepwarnings", []_C_int{1, 69, 2}},
+	{"kern.timeout_stats", []_C_int{1, 87}},
+	{"kern.tty.tk_cancc", []_C_int{1, 44, 4}},
+	{"kern.tty.tk_nin", []_C_int{1, 44, 1}},
+	{"kern.tty.tk_nout", []_C_int{1, 44, 2}},
+	{"kern.tty.tk_rawcc", []_C_int{1, 44, 3}},
+	{"kern.tty.ttyinfo", []_C_int{1, 44, 5}},
+	{"kern.ttycount", []_C_int{1, 57}},
+	{"kern.utc_offset", []_C_int{1, 88}},
+	{"kern.version", []_C_int{1, 4}},
+	{"kern.video", []_C_int{1, 89}},
+	{"kern.watchdog.auto", []_C_int{1, 64, 2}},
+	{"kern.watchdog.period", []_C_int{1, 64, 1}},
+	{"kern.witnesswatch", []_C_int{1, 53}},
+	{"kern.wxabort", []_C_int{1, 74}},
+	{"net.bpf.bufsize", []_C_int{4, 31, 1}},
+	{"net.bpf.maxbufsize", []_C_int{4, 31, 2}},
+	{"net.inet.ah.enable", []_C_int{4, 2, 51, 1}},
+	{"net.inet.ah.stats", []_C_int{4, 2, 51, 2}},
+	{"net.inet.carp.allow", []_C_int{4, 2, 112, 1}},
+	{"net.inet.carp.log", []_C_int{4, 2, 112, 3}},
+	{"net.inet.carp.preempt", []_C_int{4, 2, 112, 2}},
+	{"net.inet.carp.stats", []_C_int{4, 2, 112, 4}},
+	{"net.inet.divert.recvspace", []_C_int{4, 2, 258, 1}},
+	{"net.inet.divert.sendspace", []_C_int{4, 2, 258, 2}},
+	{"net.inet.divert.stats", []_C_int{4, 2, 258, 3}},
+	{"net.inet.esp.enable", []_C_int{4, 2, 50, 1}},
+	{"net.inet.esp.stats", []_C_int{4, 2, 50, 4}},
+	{"net.inet.esp.udpencap", []_C_int{4, 2, 50, 2}},
+	{"net.inet.esp.udpencap_port", []_C_int{4, 2, 50, 3}},
+	{"net.inet.etherip.allow", []_C_int{4, 2, 97, 1}},
+	{"net.inet.etherip.stats", []_C_int{4, 2, 97, 2}},
+	{"net.inet.gre.allow", []_C_int{4, 2, 47, 1}},
+	{"net.inet.gre.wccp", []_C_int{4, 2, 47, 2}},
+	{"net.inet.icmp.bmcastecho", []_C_int{4, 2, 1, 2}},
+	{"net.inet.icmp.errppslimit", []_C_int{4, 2, 1, 3}},
+	{"net.inet.icmp.maskrepl", []_C_int{4, 2, 1, 1}},
+	{"net.inet.icmp.rediraccept", []_C_int{4, 2, 1, 4}},
+	{"net.inet.icmp.redirtimeout", []_C_int{4, 2, 1, 5}},
+	{"net.inet.icmp.stats", []_C_int{4, 2, 1, 7}},
+	{"net.inet.icmp.tstamprepl", []_C_int{4, 2, 1, 6}},
+	{"net.inet.igmp.stats", []_C_int{4, 2, 2, 1}},
+	{"net.inet.ip.arpdown", []_C_int{4, 2, 0, 40}},
+	{"net.inet.ip.arpqueued", []_C_int{4, 2, 0, 36}},
+	{"net.inet.ip.arptimeout", []_C_int{4, 2, 0, 39}},
+	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
+	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
+	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
+	{"net.inet.ip.ifq.drops", []_C_int{4, 2, 0, 30, 3}},
+	{"net.inet.ip.ifq.len", []_C_int{4, 2, 0, 30, 1}},
+	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
+	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},
+	{"net.inet.ip.mforwarding", []_C_int{4, 2, 0, 31}},
+	{"net.inet.ip.mrtmfc", []_C_int{4, 2, 0, 37}},
+	{"net.inet.ip.mrtproto", []_C_int{4, 2, 0, 34}},
+	{"net.inet.ip.mrtstats", []_C_int{4, 2, 0, 35}},
+	{"net.inet.ip.mrtvif", []_C_int{4, 2, 0, 38}},
+	{"net.inet.ip.mtu", []_C_int{4, 2, 0, 4}},
+	{"net.inet.ip.mtudisc", []_C_int{4, 2, 0, 27}},
+	{"net.inet.ip.mtudisctimeout", []_C_int{4, 2, 0, 28}},
+	{"net.inet.ip.multipath", []_C_int{4, 2, 0, 32}},
+	{"net.inet.ip.portfirst", []_C_int{4, 2, 0, 7}},
+	{"net.inet.ip.porthifirst", []_C_int{4, 2, 0, 9}},
+	{"net.inet.ip.porthilast", []_C_int{4, 2, 0, 10}},
+	{"net.inet.ip.portlast", []_C_int{4, 2, 0, 8}},
+	{"net.inet.ip.redirect", []_C_int{4, 2, 0, 2}},
+	{"net.inet.ip.sourceroute", []_C_int{4, 2, 0, 5}},
+	{"net.inet.ip.stats", []_C_int{4, 2, 0, 33}},
+	{"net.inet.ip.ttl", []_C_int{4, 2, 0, 3}},
+	{"net.inet.ipcomp.enable", []_C_int{4, 2, 108, 1}},
+	{"net.inet.ipcomp.stats", []_C_int{4, 2, 108, 2}},
+	{"net.inet.ipip.allow", []_C_int{4, 2, 4, 1}},
+	{"net.inet.ipip.stats", []_C_int{4, 2, 4, 2}},
+	{"net.inet.pfsync.stats", []_C_int{4, 2, 240, 1}},
+	{"net.inet.tcp.ackonpush", []_C_int{4, 2, 6, 13}},
+	{"net.inet.tcp.always_keepalive", []_C_int{4, 2, 6, 22}},
+	{"net.inet.tcp.baddynamic", []_C_int{4, 2, 6, 6}},
+	{"net.inet.tcp.drop", []_C_int{4, 2, 6, 19}},
+	{"net.inet.tcp.ecn", []_C_int{4, 2, 6, 14}},
+	{"net.inet.tcp.ident", []_C_int{4, 2, 6, 9}},
+	{"net.inet.tcp.keepidle", []_C_int{4, 2, 6, 3}},
+	{"net.inet.tcp.keepinittime", []_C_int{4, 2, 6, 2}},
+	{"net.inet.tcp.keepintvl", []_C_int{4, 2, 6, 4}},
+	{"net.inet.tcp.mssdflt", []_C_int{4, 2, 6, 11}},
+	{"net.inet.tcp.reasslimit", []_C_int{4, 2, 6, 18}},
+	{"net.inet.tcp.rfc1323", []_C_int{4, 2, 6, 1}},
+	{"net.inet.tcp.rfc3390", []_C_int{4, 2, 6, 17}},
+	{"net.inet.tcp.rootonly", []_C_int{4, 2, 6, 24}},
+	{"net.inet.tcp.rstppslimit", []_C_int{4, 2, 6, 12}},
+	{"net.inet.tcp.sack", []_C_int{4, 2, 6, 10}},
+	{"net.inet.tcp.sackholelimit", []_C_int{4, 2, 6, 20}},
+	{"net.inet.tcp.slowhz", []_C_int{4, 2, 6, 5}},
+	{"net.inet.tcp.stats", []_C_int{4, 2, 6, 21}},
+	{"net.inet.tcp.synbucketlimit", []_C_int{4, 2, 6, 16}},
+	{"net.inet.tcp.syncachelimit", []_C_int{4, 2, 6, 15}},
+	{"net.inet.tcp.synhashsize", []_C_int{4, 2, 6, 25}},
+	{"net.inet.tcp.synuselimit", []_C_int{4, 2, 6, 23}},
+	{"net.inet.udp.baddynamic", []_C_int{4, 2, 17, 2}},
+	{"net.inet.udp.checksum", []_C_int{4, 2, 17, 1}},
+	{"net.inet.udp.recvspace", []_C_int{4, 2, 17, 3}},
+	{"net.inet.udp.rootonly", []_C_int{4, 2, 17, 6}},
+	{"net.inet.udp.sendspace", []_C_int{4, 2, 17, 4}},
+	{"net.inet.udp.stats", []_C_int{4, 2, 17, 5}},
+	{"net.inet6.divert.recvspace", []_C_int{4, 24, 86, 1}},
+	{"net.inet6.divert.sendspace", []_C_int{4, 24, 86, 2}},
+	{"net.inet6.divert.stats", []_C_int{4, 24, 86, 3}},
+	{"net.inet6.icmp6.errppslimit", []_C_int{4, 24, 30, 14}},
+	{"net.inet6.icmp6.mtudisc_hiwat", []_C_int{4, 24, 30, 16}},
+	{"net.inet6.icmp6.mtudisc_lowat", []_C_int{4, 24, 30, 17}},
+	{"net.inet6.icmp6.nd6_debug", []_C_int{4, 24, 30, 18}},
+	{"net.inet6.icmp6.nd6_delay", []_C_int{4, 24, 30, 8}},
+	{"net.inet6.icmp6.nd6_maxnudhint", []_C_int{4, 24, 30, 15}},
+	{"net.inet6.icmp6.nd6_mmaxtries", []_C_int{4, 24, 30, 10}},
+	{"net.inet6.icmp6.nd6_umaxtries", []_C_int{4, 24, 30, 9}},
+	{"net.inet6.icmp6.redirtimeout", []_C_int{4, 24, 30, 3}},
+	{"net.inet6.ip6.auto_flowlabel", []_C_int{4, 24, 17, 17}},
+	{"net.inet6.ip6.dad_count", []_C_int{4, 24, 17, 16}},
+	{"net.inet6.ip6.dad_pending", []_C_int{4, 24, 17, 49}},
+	{"net.inet6.ip6.defmcasthlim", []_C_int{4, 24, 17, 18}},
+	{"net.inet6.ip6.forwarding", []_C_int{4, 24, 17, 1}},
+	{"net.inet6.ip6.forwsrcrt", []_C_int{4, 24, 17, 5}},
+	{"net.inet6.ip6.hdrnestlimit", []_C_int{4, 24, 17, 15}},
+	{"net.inet6.ip6.hlim", []_C_int{4, 24, 17, 3}},
+	{"net.inet6.ip6.log_interval", []_C_int{4, 24, 17, 14}},
+	{"net.inet6.ip6.maxdynroutes", []_C_int{4, 24, 17, 48}},
+	{"net.inet6.ip6.maxfragpackets", []_C_int{4, 24, 17, 9}},
+	{"net.inet6.ip6.maxfrags", []_C_int{4, 24, 17, 41}},
+	{"net.inet6.ip6.mforwarding", []_C_int{4, 24, 17, 42}},
+	{"net.inet6.ip6.mrtmfc", []_C_int{4, 24, 17, 53}},
+	{"net.inet6.ip6.mrtmif", []_C_int{4, 24, 17, 52}},
+	{"net.inet6.ip6.mrtproto", []_C_int{4, 24, 17, 8}},
+	{"net.inet6.ip6.mtudisctimeout", []_C_int{4, 24, 17, 50}},
+	{"net.inet6.ip6.multicast_mtudisc", []_C_int{4, 24, 17, 44}},
+	{"net.inet6.ip6.multipath", []_C_int{4, 24, 17, 43}},
+	{"net.inet6.ip6.neighborgcthresh", []_C_int{4, 24, 17, 45}},
+	{"net.inet6.ip6.redirect", []_C_int{4, 24, 17, 2}},
+	{"net.inet6.ip6.soiikey", []_C_int{4, 24, 17, 54}},
+	{"net.inet6.ip6.sourcecheck", []_C_int{4, 24, 17, 10}},
+	{"net.inet6.ip6.sourcecheck_logint", []_C_int{4, 24, 17, 11}},
+	{"net.inet6.ip6.use_deprecated", []_C_int{4, 24, 17, 21}},
+	{"net.key.sadb_dump", []_C_int{4, 30, 1}},
+	{"net.key.spd_dump", []_C_int{4, 30, 2}},
+	{"net.mpls.ifq.congestion", []_C_int{4, 33, 3, 4}},
+	{"net.mpls.ifq.drops", []_C_int{4, 33, 3, 3}},
+	{"net.mpls.ifq.len", []_C_int{4, 33, 3, 1}},
+	{"net.mpls.ifq.maxlen", []_C_int{4, 33, 3, 2}},
+	{"net.mpls.mapttl_ip", []_C_int{4, 33, 5}},
+	{"net.mpls.mapttl_ip6", []_C_int{4, 33, 6}},
+	{"net.mpls.ttl", []_C_int{4, 33, 2}},
+	{"net.pflow.stats", []_C_int{4, 34, 1}},
+	{"net.pipex.enable", []_C_int{4, 35, 1}},
+	{"vm.anonmin", []_C_int{2, 7}},
+	{"vm.loadavg", []_C_int{2, 2}},
+	{"vm.malloc_conf", []_C_int{2, 12}},
+	{"vm.maxslp", []_C_int{2, 10}},
+	{"vm.nkmempages", []_C_int{2, 6}},
+	{"vm.psstrings", []_C_int{2, 3}},
+	{"vm.swapencrypt.enable", []_C_int{2, 5, 0}},
+	{"vm.swapencrypt.keyscreated", []_C_int{2, 5, 1}},
+	{"vm.swapencrypt.keysdeleted", []_C_int{2, 5, 2}},
+	{"vm.uspace", []_C_int{2, 11}},
+	{"vm.uvmexp", []_C_int{2, 4}},
+	{"vm.vmmeter", []_C_int{2, 1}},
+	{"vm.vnodemin", []_C_int{2, 9}},
+	{"vm.vtextmin", []_C_int{2, 8}},
+}
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_386.go b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_386.go
index 59d5dfc209..4e0d96107b 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_386.go
@@ -1,4 +1,4 @@
-// go run mksysnum.go https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master
+// go run mksysnum.go https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build 386 && freebsd
@@ -19,10 +19,9 @@ const (
 	SYS_UNLINK                   = 10  // { int unlink(char *path); }
 	SYS_CHDIR                    = 12  // { int chdir(char *path); }
 	SYS_FCHDIR                   = 13  // { int fchdir(int fd); }
-	SYS_MKNOD                    = 14  // { int mknod(char *path, int mode, int dev); }
 	SYS_CHMOD                    = 15  // { int chmod(char *path, int mode); }
 	SYS_CHOWN                    = 16  // { int chown(char *path, int uid, int gid); }
-	SYS_OBREAK                   = 17  // { int obreak(char *nsize); } break obreak_args int
+	SYS_BREAK                    = 17  // { caddr_t break(char *nsize); }
 	SYS_GETPID                   = 20  // { pid_t getpid(void); }
 	SYS_MOUNT                    = 21  // { int mount(char *type, char *path, int flags, caddr_t data); }
 	SYS_UNMOUNT                  = 22  // { int unmount(char *path, int flags); }
@@ -43,7 +42,6 @@ const (
 	SYS_KILL                     = 37  // { int kill(int pid, int signum); }
 	SYS_GETPPID                  = 39  // { pid_t getppid(void); }
 	SYS_DUP                      = 41  // { int dup(u_int fd); }
-	SYS_PIPE                     = 42  // { int pipe(void); }
 	SYS_GETEGID                  = 43  // { gid_t getegid(void); }
 	SYS_PROFIL                   = 44  // { int profil(caddr_t samples, size_t size, size_t offset, u_int scale); }
 	SYS_KTRACE                   = 45  // { int ktrace(const char *fname, int ops, int facs, int pid); }
@@ -58,15 +56,14 @@ const (
 	SYS_SYMLINK                  = 57  // { int symlink(char *path, char *link); }
 	SYS_READLINK                 = 58  // { ssize_t readlink(char *path, char *buf, size_t count); }
 	SYS_EXECVE                   = 59  // { int execve(char *fname, char **argv, char **envv); }
-	SYS_UMASK                    = 60  // { int umask(int newmask); } umask umask_args int
+	SYS_UMASK                    = 60  // { int umask(int newmask); }
 	SYS_CHROOT                   = 61  // { int chroot(char *path); }
 	SYS_MSYNC                    = 65  // { int msync(void *addr, size_t len, int flags); }
 	SYS_VFORK                    = 66  // { int vfork(void); }
 	SYS_SBRK                     = 69  // { int sbrk(int incr); }
 	SYS_SSTK                     = 70  // { int sstk(int incr); }
-	SYS_OVADVISE                 = 72  // { int ovadvise(int anom); } vadvise ovadvise_args int
 	SYS_MUNMAP                   = 73  // { int munmap(void *addr, size_t len); }
-	SYS_MPROTECT                 = 74  // { int mprotect(const void *addr, size_t len, int prot); }
+	SYS_MPROTECT                 = 74  // { int mprotect(void *addr, size_t len, int prot); }
 	SYS_MADVISE                  = 75  // { int madvise(void *addr, size_t len, int behav); }
 	SYS_MINCORE                  = 78  // { int mincore(const void *addr, size_t len, char *vec); }
 	SYS_GETGROUPS                = 79  // { int getgroups(u_int gidsetsize, gid_t *gidset); }
@@ -124,14 +121,10 @@ const (
 	SYS_SETGID                   = 181 // { int setgid(gid_t gid); }
 	SYS_SETEGID                  = 182 // { int setegid(gid_t egid); }
 	SYS_SETEUID                  = 183 // { int seteuid(uid_t euid); }
-	SYS_STAT                     = 188 // { int stat(char *path, struct stat *ub); }
-	SYS_FSTAT                    = 189 // { int fstat(int fd, struct stat *sb); }
-	SYS_LSTAT                    = 190 // { int lstat(char *path, struct stat *ub); }
 	SYS_PATHCONF                 = 191 // { int pathconf(char *path, int name); }
 	SYS_FPATHCONF                = 192 // { int fpathconf(int fd, int name); }
 	SYS_GETRLIMIT                = 194 // { int getrlimit(u_int which, struct rlimit *rlp); } getrlimit __getrlimit_args int
 	SYS_SETRLIMIT                = 195 // { int setrlimit(u_int which, struct rlimit *rlp); } setrlimit __setrlimit_args int
-	SYS_GETDIRENTRIES            = 196 // { int getdirentries(int fd, char *buf, u_int count, long *basep); }
 	SYS___SYSCTL                 = 202 // { int __sysctl(int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); } __sysctl sysctl_args int
 	SYS_MLOCK                    = 203 // { int mlock(const void *addr, size_t len); }
 	SYS_MUNLOCK                  = 204 // { int munlock(const void *addr, size_t len); }
@@ -143,12 +136,12 @@ const (
 	SYS_SEMOP                    = 222 // { int semop(int semid, struct sembuf *sops, size_t nsops); }
 	SYS_MSGGET                   = 225 // { int msgget(key_t key, int msgflg); }
 	SYS_MSGSND                   = 226 // { int msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
-	SYS_MSGRCV                   = 227 // { int msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_MSGRCV                   = 227 // { ssize_t msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
 	SYS_SHMAT                    = 228 // { int shmat(int shmid, const void *shmaddr, int shmflg); }
 	SYS_SHMDT                    = 230 // { int shmdt(const void *shmaddr); }
 	SYS_SHMGET                   = 231 // { int shmget(key_t key, size_t size, int shmflg); }
 	SYS_CLOCK_GETTIME            = 232 // { int clock_gettime(clockid_t clock_id, struct timespec *tp); }
-	SYS_CLOCK_SETTIME            = 233 // { int clock_settime( clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_SETTIME            = 233 // { int clock_settime(clockid_t clock_id, const struct timespec *tp); }
 	SYS_CLOCK_GETRES             = 234 // { int clock_getres(clockid_t clock_id, struct timespec *tp); }
 	SYS_KTIMER_CREATE            = 235 // { int ktimer_create(clockid_t clock_id, struct sigevent *evp, int *timerid); }
 	SYS_KTIMER_DELETE            = 236 // { int ktimer_delete(int timerid); }
@@ -157,50 +150,44 @@ const (
 	SYS_KTIMER_GETOVERRUN        = 239 // { int ktimer_getoverrun(int timerid); }
 	SYS_NANOSLEEP                = 240 // { int nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
 	SYS_FFCLOCK_GETCOUNTER       = 241 // { int ffclock_getcounter(ffcounter *ffcount); }
-	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate( struct ffclock_estimate *cest); }
-	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate( struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate(struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate(struct ffclock_estimate *cest); }
 	SYS_CLOCK_NANOSLEEP          = 244 // { int clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp); }
-	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id,int which, clockid_t *clock_id); }
+	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id, int which, clockid_t *clock_id); }
 	SYS_NTP_GETTIME              = 248 // { int ntp_gettime(struct ntptimeval *ntvp); }
 	SYS_MINHERIT                 = 250 // { int minherit(void *addr, size_t len, int inherit); }
 	SYS_RFORK                    = 251 // { int rfork(int flags); }
-	SYS_OPENBSD_POLL             = 252 // { int openbsd_poll(struct pollfd *fds, u_int nfds, int timeout); }
 	SYS_ISSETUGID                = 253 // { int issetugid(void); }
 	SYS_LCHOWN                   = 254 // { int lchown(char *path, int uid, int gid); }
 	SYS_AIO_READ                 = 255 // { int aio_read(struct aiocb *aiocbp); }
 	SYS_AIO_WRITE                = 256 // { int aio_write(struct aiocb *aiocbp); }
-	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb * const *acb_list, int nent, struct sigevent *sig); }
-	SYS_GETDENTS                 = 272 // { int getdents(int fd, char *buf, size_t count); }
+	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb* const *acb_list, int nent, struct sigevent *sig); }
 	SYS_LCHMOD                   = 274 // { int lchmod(char *path, mode_t mode); }
 	SYS_LUTIMES                  = 276 // { int lutimes(char *path, struct timeval *tptr); }
-	SYS_NSTAT                    = 278 // { int nstat(char *path, struct nstat *ub); }
-	SYS_NFSTAT                   = 279 // { int nfstat(int fd, struct nstat *sb); }
-	SYS_NLSTAT                   = 280 // { int nlstat(char *path, struct nstat *ub); }
 	SYS_PREADV                   = 289 // { ssize_t preadv(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_PWRITEV                  = 290 // { ssize_t pwritev(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_FHOPEN                   = 298 // { int fhopen(const struct fhandle *u_fhp, int flags); }
-	SYS_FHSTAT                   = 299 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
 	SYS_MODNEXT                  = 300 // { int modnext(int modid); }
-	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat *stat); }
+	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat* stat); }
 	SYS_MODFNEXT                 = 302 // { int modfnext(int modid); }
 	SYS_MODFIND                  = 303 // { int modfind(const char *name); }
 	SYS_KLDLOAD                  = 304 // { int kldload(const char *file); }
 	SYS_KLDUNLOAD                = 305 // { int kldunload(int fileid); }
 	SYS_KLDFIND                  = 306 // { int kldfind(const char *file); }
 	SYS_KLDNEXT                  = 307 // { int kldnext(int fileid); }
-	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat* stat); }
+	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat *stat); }
 	SYS_KLDFIRSTMOD              = 309 // { int kldfirstmod(int fileid); }
 	SYS_GETSID                   = 310 // { int getsid(pid_t pid); }
 	SYS_SETRESUID                = 311 // { int setresuid(uid_t ruid, uid_t euid, uid_t suid); }
 	SYS_SETRESGID                = 312 // { int setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
 	SYS_AIO_RETURN               = 314 // { ssize_t aio_return(struct aiocb *aiocbp); }
-	SYS_AIO_SUSPEND              = 315 // { int aio_suspend( struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
+	SYS_AIO_SUSPEND              = 315 // { int aio_suspend(struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
 	SYS_AIO_CANCEL               = 316 // { int aio_cancel(int fd, struct aiocb *aiocbp); }
 	SYS_AIO_ERROR                = 317 // { int aio_error(struct aiocb *aiocbp); }
 	SYS_YIELD                    = 321 // { int yield(void); }
 	SYS_MLOCKALL                 = 324 // { int mlockall(int how); }
 	SYS_MUNLOCKALL               = 325 // { int munlockall(void); }
-	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, u_int buflen); }
+	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, size_t buflen); }
 	SYS_SCHED_SETPARAM           = 327 // { int sched_setparam (pid_t pid, const struct sched_param *param); }
 	SYS_SCHED_GETPARAM           = 328 // { int sched_getparam (pid_t pid, struct sched_param *param); }
 	SYS_SCHED_SETSCHEDULER       = 329 // { int sched_setscheduler (pid_t pid, int policy, const struct sched_param *param); }
@@ -226,14 +213,13 @@ const (
 	SYS___ACL_ACLCHECK_FILE      = 353 // { int __acl_aclcheck_file(const char *path, acl_type_t type, struct acl *aclp); }
 	SYS___ACL_ACLCHECK_FD        = 354 // { int __acl_aclcheck_fd(int filedes, acl_type_t type, struct acl *aclp); }
 	SYS_EXTATTRCTL               = 355 // { int extattrctl(const char *path, int cmd, const char *filename, int attrnamespace, const char *attrname); }
-	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FILE      = 358 // { int extattr_delete_file(const char *path, int attrnamespace, const char *attrname); }
-	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete( struct aiocb **aiocbp, struct timespec *timeout); }
+	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete(struct aiocb **aiocbp, struct timespec *timeout); }
 	SYS_GETRESUID                = 360 // { int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
 	SYS_GETRESGID                = 361 // { int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
 	SYS_KQUEUE                   = 362 // { int kqueue(void); }
-	SYS_KEVENT                   = 363 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
 	SYS_EXTATTR_SET_FD           = 371 // { ssize_t extattr_set_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_GET_FD           = 372 // { ssize_t extattr_get_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FD        = 373 // { int extattr_delete_fd(int fd, int attrnamespace, const char *attrname); }
@@ -251,10 +237,6 @@ const (
 	SYS_UUIDGEN                  = 392 // { int uuidgen(struct uuid *store, int count); }
 	SYS_SENDFILE                 = 393 // { int sendfile(int fd, int s, off_t offset, size_t nbytes, struct sf_hdtr *hdtr, off_t *sbytes, int flags); }
 	SYS_MAC_SYSCALL              = 394 // { int mac_syscall(const char *policy, int call, void *arg); }
-	SYS_GETFSSTAT                = 395 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
-	SYS_STATFS                   = 396 // { int statfs(char *path, struct statfs *buf); }
-	SYS_FSTATFS                  = 397 // { int fstatfs(int fd, struct statfs *buf); }
-	SYS_FHSTATFS                 = 398 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
 	SYS_KSEM_CLOSE               = 400 // { int ksem_close(semid_t id); }
 	SYS_KSEM_POST                = 401 // { int ksem_post(semid_t id); }
 	SYS_KSEM_WAIT                = 402 // { int ksem_wait(semid_t id); }
@@ -267,14 +249,14 @@ const (
 	SYS___MAC_GET_PID            = 409 // { int __mac_get_pid(pid_t pid, struct mac *mac_p); }
 	SYS___MAC_GET_LINK           = 410 // { int __mac_get_link(const char *path_p, struct mac *mac_p); }
 	SYS___MAC_SET_LINK           = 411 // { int __mac_set_link(const char *path_p, struct mac *mac_p); }
-	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link( const char *path, int attrnamespace, const char *attrname); }
+	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link(const char *path, int attrnamespace, const char *attrname); }
 	SYS___MAC_EXECVE             = 415 // { int __mac_execve(char *fname, char **argv, char **envv, struct mac *mac_p); }
 	SYS_SIGACTION                = 416 // { int sigaction(int sig, const struct sigaction *act, struct sigaction *oact); }
-	SYS_SIGRETURN                = 417 // { int sigreturn( const struct __ucontext *sigcntxp); }
+	SYS_SIGRETURN                = 417 // { int sigreturn(const struct __ucontext *sigcntxp); }
 	SYS_GETCONTEXT               = 421 // { int getcontext(struct __ucontext *ucp); }
-	SYS_SETCONTEXT               = 422 // { int setcontext( const struct __ucontext *ucp); }
+	SYS_SETCONTEXT               = 422 // { int setcontext(const struct __ucontext *ucp); }
 	SYS_SWAPCONTEXT              = 423 // { int swapcontext(struct __ucontext *oucp, const struct __ucontext *ucp); }
 	SYS_SWAPOFF                  = 424 // { int swapoff(const char *name); }
 	SYS___ACL_GET_LINK           = 425 // { int __acl_get_link(const char *path, acl_type_t type, struct acl *aclp); }
@@ -288,10 +270,10 @@ const (
 	SYS_THR_KILL                 = 433 // { int thr_kill(long id, int sig); }
 	SYS_JAIL_ATTACH              = 436 // { int jail_attach(int jid); }
 	SYS_EXTATTR_LIST_FD          = 437 // { ssize_t extattr_list_fd(int fd, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file( const char *path, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link( const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file(const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link(const char *path, int attrnamespace, void *data, size_t nbytes); }
 	SYS_KSEM_TIMEDWAIT           = 441 // { int ksem_timedwait(semid_t id, const struct timespec *abstime); }
-	SYS_THR_SUSPEND              = 442 // { int thr_suspend( const struct timespec *timeout); }
+	SYS_THR_SUSPEND              = 442 // { int thr_suspend(const struct timespec *timeout); }
 	SYS_THR_WAKE                 = 443 // { int thr_wake(long id); }
 	SYS_KLDUNLOADF               = 444 // { int kldunloadf(int fileid, int flags); }
 	SYS_AUDIT                    = 445 // { int audit(const void *record, u_int length); }
@@ -300,17 +282,17 @@ const (
 	SYS_SETAUID                  = 448 // { int setauid(uid_t *auid); }
 	SYS_GETAUDIT                 = 449 // { int getaudit(struct auditinfo *auditinfo); }
 	SYS_SETAUDIT                 = 450 // { int setaudit(struct auditinfo *auditinfo); }
-	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
-	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
 	SYS_AUDITCTL                 = 453 // { int auditctl(char *path); }
 	SYS__UMTX_OP                 = 454 // { int _umtx_op(void *obj, int op, u_long val, void *uaddr1, void *uaddr2); }
 	SYS_THR_NEW                  = 455 // { int thr_new(struct thr_param *param, int param_size); }
 	SYS_SIGQUEUE                 = 456 // { int sigqueue(pid_t pid, int signum, void *value); }
 	SYS_KMQ_OPEN                 = 457 // { int kmq_open(const char *path, int flags, mode_t mode, const struct mq_attr *attr); }
-	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd,		const struct mq_attr *attr,		struct mq_attr *oattr); }
-	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd,	char *msg_ptr, size_t msg_len,	unsigned *msg_prio,			const struct timespec *abs_timeout); }
-	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd,		const char *msg_ptr, size_t msg_len,unsigned msg_prio,			const struct timespec *abs_timeout);}
-	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd,		const struct sigevent *sigev); }
+	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd, const struct mq_attr *attr, struct mq_attr *oattr); }
+	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd, char *msg_ptr, size_t msg_len, unsigned *msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd, const char *msg_ptr, size_t msg_len, unsigned msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd, const struct sigevent *sigev); }
 	SYS_KMQ_UNLINK               = 462 // { int kmq_unlink(const char *path); }
 	SYS_ABORT2                   = 463 // { int abort2(const char *why, int nargs, void **args); }
 	SYS_THR_SET_NAME             = 464 // { int thr_set_name(long id, const char *name); }
@@ -319,7 +301,7 @@ const (
 	SYS_SCTP_PEELOFF             = 471 // { int sctp_peeloff(int sd, uint32_t name); }
 	SYS_SCTP_GENERIC_SENDMSG     = 472 // { int sctp_generic_sendmsg(int sd, caddr_t msg, int mlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
 	SYS_SCTP_GENERIC_SENDMSG_IOV = 473 // { int sctp_generic_sendmsg_iov(int sd, struct iovec *iov, int iovlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
-	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr * from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
+	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr *from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
 	SYS_PREAD                    = 475 // { ssize_t pread(int fd, void *buf, size_t nbyte, off_t offset); }
 	SYS_PWRITE                   = 476 // { ssize_t pwrite(int fd, const void *buf, size_t nbyte, off_t offset); }
 	SYS_MMAP                     = 477 // { caddr_t mmap(caddr_t addr, size_t len, int prot, int flags, int fd, off_t pos); }
@@ -338,14 +320,12 @@ const (
 	SYS_FCHMODAT                 = 490 // { int fchmodat(int fd, char *path, mode_t mode, int flag); }
 	SYS_FCHOWNAT                 = 491 // { int fchownat(int fd, char *path, uid_t uid, gid_t gid, int flag); }
 	SYS_FEXECVE                  = 492 // { int fexecve(int fd, char **argv, char **envv); }
-	SYS_FSTATAT                  = 493 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
 	SYS_FUTIMESAT                = 494 // { int futimesat(int fd, char *path, struct timeval *times); }
 	SYS_LINKAT                   = 495 // { int linkat(int fd1, char *path1, int fd2, char *path2, int flag); }
 	SYS_MKDIRAT                  = 496 // { int mkdirat(int fd, char *path, mode_t mode); }
 	SYS_MKFIFOAT                 = 497 // { int mkfifoat(int fd, char *path, mode_t mode); }
-	SYS_MKNODAT                  = 498 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
 	SYS_OPENAT                   = 499 // { int openat(int fd, char *path, int flag, mode_t mode); }
-	SYS_READLINKAT               = 500 // { int readlinkat(int fd, char *path, char *buf, size_t bufsize); }
+	SYS_READLINKAT               = 500 // { ssize_t readlinkat(int fd, char *path, char *buf, size_t bufsize); }
 	SYS_RENAMEAT                 = 501 // { int renameat(int oldfd, char *old, int newfd, char *new); }
 	SYS_SYMLINKAT                = 502 // { int symlinkat(char *path1, int fd, char *path2); }
 	SYS_UNLINKAT                 = 503 // { int unlinkat(int fd, char *path, int flag); }
@@ -391,7 +371,24 @@ const (
 	SYS_PPOLL                    = 545 // { int ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *set); }
 	SYS_FUTIMENS                 = 546 // { int futimens(int fd, struct timespec *times); }
 	SYS_UTIMENSAT                = 547 // { int utimensat(int fd, char *path, struct timespec *times, int flag); }
-	SYS_NUMA_GETAFFINITY         = 548 // { int numa_getaffinity(cpuwhich_t which, id_t id, struct vm_domain_policy_entry *policy); }
-	SYS_NUMA_SETAFFINITY         = 549 // { int numa_setaffinity(cpuwhich_t which, id_t id, const struct vm_domain_policy_entry *policy); }
 	SYS_FDATASYNC                = 550 // { int fdatasync(int fd); }
+	SYS_FSTAT                    = 551 // { int fstat(int fd, struct stat *sb); }
+	SYS_FSTATAT                  = 552 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
+	SYS_FHSTAT                   = 553 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
+	SYS_GETDIRENTRIES            = 554 // { ssize_t getdirentries(int fd, char *buf, size_t count, off_t *basep); }
+	SYS_STATFS                   = 555 // { int statfs(char *path, struct statfs *buf); }
+	SYS_FSTATFS                  = 556 // { int fstatfs(int fd, struct statfs *buf); }
+	SYS_GETFSSTAT                = 557 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
+	SYS_FHSTATFS                 = 558 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
+	SYS_MKNODAT                  = 559 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
+	SYS_KEVENT                   = 560 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_CPUSET_GETDOMAIN         = 561 // { int cpuset_getdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int *policy); }
+	SYS_CPUSET_SETDOMAIN         = 562 // { int cpuset_setdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int policy); }
+	SYS_GETRANDOM                = 563 // { int getrandom(void *buf, size_t buflen, unsigned int flags); }
+	SYS_GETFHAT                  = 564 // { int getfhat(int fd, char *path, struct fhandle *fhp, int flags); }
+	SYS_FHLINK                   = 565 // { int fhlink(struct fhandle *fhp, const char *to); }
+	SYS_FHLINKAT                 = 566 // { int fhlinkat(struct fhandle *fhp, int tofd, const char *to,); }
+	SYS_FHREADLINK               = 567 // { int fhreadlink(struct fhandle *fhp, char *buf, size_t bufsize); }
+	SYS___SYSCTLBYNAME           = 570 // { int __sysctlbyname(const char *name, size_t namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_CLOSE_RANGE              = 575 // { int close_range(u_int lowfd, u_int highfd, int flags); }
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_amd64.go
index 342d471d2e..01636b838d 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_amd64.go
@@ -1,4 +1,4 @@
-// go run mksysnum.go https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master
+// go run mksysnum.go https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build amd64 && freebsd
@@ -19,10 +19,9 @@ const (
 	SYS_UNLINK                   = 10  // { int unlink(char *path); }
 	SYS_CHDIR                    = 12  // { int chdir(char *path); }
 	SYS_FCHDIR                   = 13  // { int fchdir(int fd); }
-	SYS_MKNOD                    = 14  // { int mknod(char *path, int mode, int dev); }
 	SYS_CHMOD                    = 15  // { int chmod(char *path, int mode); }
 	SYS_CHOWN                    = 16  // { int chown(char *path, int uid, int gid); }
-	SYS_OBREAK                   = 17  // { int obreak(char *nsize); } break obreak_args int
+	SYS_BREAK                    = 17  // { caddr_t break(char *nsize); }
 	SYS_GETPID                   = 20  // { pid_t getpid(void); }
 	SYS_MOUNT                    = 21  // { int mount(char *type, char *path, int flags, caddr_t data); }
 	SYS_UNMOUNT                  = 22  // { int unmount(char *path, int flags); }
@@ -43,7 +42,6 @@ const (
 	SYS_KILL                     = 37  // { int kill(int pid, int signum); }
 	SYS_GETPPID                  = 39  // { pid_t getppid(void); }
 	SYS_DUP                      = 41  // { int dup(u_int fd); }
-	SYS_PIPE                     = 42  // { int pipe(void); }
 	SYS_GETEGID                  = 43  // { gid_t getegid(void); }
 	SYS_PROFIL                   = 44  // { int profil(caddr_t samples, size_t size, size_t offset, u_int scale); }
 	SYS_KTRACE                   = 45  // { int ktrace(const char *fname, int ops, int facs, int pid); }
@@ -58,15 +56,14 @@ const (
 	SYS_SYMLINK                  = 57  // { int symlink(char *path, char *link); }
 	SYS_READLINK                 = 58  // { ssize_t readlink(char *path, char *buf, size_t count); }
 	SYS_EXECVE                   = 59  // { int execve(char *fname, char **argv, char **envv); }
-	SYS_UMASK                    = 60  // { int umask(int newmask); } umask umask_args int
+	SYS_UMASK                    = 60  // { int umask(int newmask); }
 	SYS_CHROOT                   = 61  // { int chroot(char *path); }
 	SYS_MSYNC                    = 65  // { int msync(void *addr, size_t len, int flags); }
 	SYS_VFORK                    = 66  // { int vfork(void); }
 	SYS_SBRK                     = 69  // { int sbrk(int incr); }
 	SYS_SSTK                     = 70  // { int sstk(int incr); }
-	SYS_OVADVISE                 = 72  // { int ovadvise(int anom); } vadvise ovadvise_args int
 	SYS_MUNMAP                   = 73  // { int munmap(void *addr, size_t len); }
-	SYS_MPROTECT                 = 74  // { int mprotect(const void *addr, size_t len, int prot); }
+	SYS_MPROTECT                 = 74  // { int mprotect(void *addr, size_t len, int prot); }
 	SYS_MADVISE                  = 75  // { int madvise(void *addr, size_t len, int behav); }
 	SYS_MINCORE                  = 78  // { int mincore(const void *addr, size_t len, char *vec); }
 	SYS_GETGROUPS                = 79  // { int getgroups(u_int gidsetsize, gid_t *gidset); }
@@ -124,14 +121,10 @@ const (
 	SYS_SETGID                   = 181 // { int setgid(gid_t gid); }
 	SYS_SETEGID                  = 182 // { int setegid(gid_t egid); }
 	SYS_SETEUID                  = 183 // { int seteuid(uid_t euid); }
-	SYS_STAT                     = 188 // { int stat(char *path, struct stat *ub); }
-	SYS_FSTAT                    = 189 // { int fstat(int fd, struct stat *sb); }
-	SYS_LSTAT                    = 190 // { int lstat(char *path, struct stat *ub); }
 	SYS_PATHCONF                 = 191 // { int pathconf(char *path, int name); }
 	SYS_FPATHCONF                = 192 // { int fpathconf(int fd, int name); }
 	SYS_GETRLIMIT                = 194 // { int getrlimit(u_int which, struct rlimit *rlp); } getrlimit __getrlimit_args int
 	SYS_SETRLIMIT                = 195 // { int setrlimit(u_int which, struct rlimit *rlp); } setrlimit __setrlimit_args int
-	SYS_GETDIRENTRIES            = 196 // { int getdirentries(int fd, char *buf, u_int count, long *basep); }
 	SYS___SYSCTL                 = 202 // { int __sysctl(int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); } __sysctl sysctl_args int
 	SYS_MLOCK                    = 203 // { int mlock(const void *addr, size_t len); }
 	SYS_MUNLOCK                  = 204 // { int munlock(const void *addr, size_t len); }
@@ -143,12 +136,12 @@ const (
 	SYS_SEMOP                    = 222 // { int semop(int semid, struct sembuf *sops, size_t nsops); }
 	SYS_MSGGET                   = 225 // { int msgget(key_t key, int msgflg); }
 	SYS_MSGSND                   = 226 // { int msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
-	SYS_MSGRCV                   = 227 // { int msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_MSGRCV                   = 227 // { ssize_t msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
 	SYS_SHMAT                    = 228 // { int shmat(int shmid, const void *shmaddr, int shmflg); }
 	SYS_SHMDT                    = 230 // { int shmdt(const void *shmaddr); }
 	SYS_SHMGET                   = 231 // { int shmget(key_t key, size_t size, int shmflg); }
 	SYS_CLOCK_GETTIME            = 232 // { int clock_gettime(clockid_t clock_id, struct timespec *tp); }
-	SYS_CLOCK_SETTIME            = 233 // { int clock_settime( clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_SETTIME            = 233 // { int clock_settime(clockid_t clock_id, const struct timespec *tp); }
 	SYS_CLOCK_GETRES             = 234 // { int clock_getres(clockid_t clock_id, struct timespec *tp); }
 	SYS_KTIMER_CREATE            = 235 // { int ktimer_create(clockid_t clock_id, struct sigevent *evp, int *timerid); }
 	SYS_KTIMER_DELETE            = 236 // { int ktimer_delete(int timerid); }
@@ -157,50 +150,44 @@ const (
 	SYS_KTIMER_GETOVERRUN        = 239 // { int ktimer_getoverrun(int timerid); }
 	SYS_NANOSLEEP                = 240 // { int nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
 	SYS_FFCLOCK_GETCOUNTER       = 241 // { int ffclock_getcounter(ffcounter *ffcount); }
-	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate( struct ffclock_estimate *cest); }
-	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate( struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate(struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate(struct ffclock_estimate *cest); }
 	SYS_CLOCK_NANOSLEEP          = 244 // { int clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp); }
-	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id,int which, clockid_t *clock_id); }
+	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id, int which, clockid_t *clock_id); }
 	SYS_NTP_GETTIME              = 248 // { int ntp_gettime(struct ntptimeval *ntvp); }
 	SYS_MINHERIT                 = 250 // { int minherit(void *addr, size_t len, int inherit); }
 	SYS_RFORK                    = 251 // { int rfork(int flags); }
-	SYS_OPENBSD_POLL             = 252 // { int openbsd_poll(struct pollfd *fds, u_int nfds, int timeout); }
 	SYS_ISSETUGID                = 253 // { int issetugid(void); }
 	SYS_LCHOWN                   = 254 // { int lchown(char *path, int uid, int gid); }
 	SYS_AIO_READ                 = 255 // { int aio_read(struct aiocb *aiocbp); }
 	SYS_AIO_WRITE                = 256 // { int aio_write(struct aiocb *aiocbp); }
-	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb * const *acb_list, int nent, struct sigevent *sig); }
-	SYS_GETDENTS                 = 272 // { int getdents(int fd, char *buf, size_t count); }
+	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb* const *acb_list, int nent, struct sigevent *sig); }
 	SYS_LCHMOD                   = 274 // { int lchmod(char *path, mode_t mode); }
 	SYS_LUTIMES                  = 276 // { int lutimes(char *path, struct timeval *tptr); }
-	SYS_NSTAT                    = 278 // { int nstat(char *path, struct nstat *ub); }
-	SYS_NFSTAT                   = 279 // { int nfstat(int fd, struct nstat *sb); }
-	SYS_NLSTAT                   = 280 // { int nlstat(char *path, struct nstat *ub); }
 	SYS_PREADV                   = 289 // { ssize_t preadv(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_PWRITEV                  = 290 // { ssize_t pwritev(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_FHOPEN                   = 298 // { int fhopen(const struct fhandle *u_fhp, int flags); }
-	SYS_FHSTAT                   = 299 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
 	SYS_MODNEXT                  = 300 // { int modnext(int modid); }
-	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat *stat); }
+	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat* stat); }
 	SYS_MODFNEXT                 = 302 // { int modfnext(int modid); }
 	SYS_MODFIND                  = 303 // { int modfind(const char *name); }
 	SYS_KLDLOAD                  = 304 // { int kldload(const char *file); }
 	SYS_KLDUNLOAD                = 305 // { int kldunload(int fileid); }
 	SYS_KLDFIND                  = 306 // { int kldfind(const char *file); }
 	SYS_KLDNEXT                  = 307 // { int kldnext(int fileid); }
-	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat* stat); }
+	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat *stat); }
 	SYS_KLDFIRSTMOD              = 309 // { int kldfirstmod(int fileid); }
 	SYS_GETSID                   = 310 // { int getsid(pid_t pid); }
 	SYS_SETRESUID                = 311 // { int setresuid(uid_t ruid, uid_t euid, uid_t suid); }
 	SYS_SETRESGID                = 312 // { int setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
 	SYS_AIO_RETURN               = 314 // { ssize_t aio_return(struct aiocb *aiocbp); }
-	SYS_AIO_SUSPEND              = 315 // { int aio_suspend( struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
+	SYS_AIO_SUSPEND              = 315 // { int aio_suspend(struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
 	SYS_AIO_CANCEL               = 316 // { int aio_cancel(int fd, struct aiocb *aiocbp); }
 	SYS_AIO_ERROR                = 317 // { int aio_error(struct aiocb *aiocbp); }
 	SYS_YIELD                    = 321 // { int yield(void); }
 	SYS_MLOCKALL                 = 324 // { int mlockall(int how); }
 	SYS_MUNLOCKALL               = 325 // { int munlockall(void); }
-	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, u_int buflen); }
+	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, size_t buflen); }
 	SYS_SCHED_SETPARAM           = 327 // { int sched_setparam (pid_t pid, const struct sched_param *param); }
 	SYS_SCHED_GETPARAM           = 328 // { int sched_getparam (pid_t pid, struct sched_param *param); }
 	SYS_SCHED_SETSCHEDULER       = 329 // { int sched_setscheduler (pid_t pid, int policy, const struct sched_param *param); }
@@ -226,14 +213,13 @@ const (
 	SYS___ACL_ACLCHECK_FILE      = 353 // { int __acl_aclcheck_file(const char *path, acl_type_t type, struct acl *aclp); }
 	SYS___ACL_ACLCHECK_FD        = 354 // { int __acl_aclcheck_fd(int filedes, acl_type_t type, struct acl *aclp); }
 	SYS_EXTATTRCTL               = 355 // { int extattrctl(const char *path, int cmd, const char *filename, int attrnamespace, const char *attrname); }
-	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FILE      = 358 // { int extattr_delete_file(const char *path, int attrnamespace, const char *attrname); }
-	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete( struct aiocb **aiocbp, struct timespec *timeout); }
+	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete(struct aiocb **aiocbp, struct timespec *timeout); }
 	SYS_GETRESUID                = 360 // { int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
 	SYS_GETRESGID                = 361 // { int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
 	SYS_KQUEUE                   = 362 // { int kqueue(void); }
-	SYS_KEVENT                   = 363 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
 	SYS_EXTATTR_SET_FD           = 371 // { ssize_t extattr_set_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_GET_FD           = 372 // { ssize_t extattr_get_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FD        = 373 // { int extattr_delete_fd(int fd, int attrnamespace, const char *attrname); }
@@ -251,10 +237,6 @@ const (
 	SYS_UUIDGEN                  = 392 // { int uuidgen(struct uuid *store, int count); }
 	SYS_SENDFILE                 = 393 // { int sendfile(int fd, int s, off_t offset, size_t nbytes, struct sf_hdtr *hdtr, off_t *sbytes, int flags); }
 	SYS_MAC_SYSCALL              = 394 // { int mac_syscall(const char *policy, int call, void *arg); }
-	SYS_GETFSSTAT                = 395 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
-	SYS_STATFS                   = 396 // { int statfs(char *path, struct statfs *buf); }
-	SYS_FSTATFS                  = 397 // { int fstatfs(int fd, struct statfs *buf); }
-	SYS_FHSTATFS                 = 398 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
 	SYS_KSEM_CLOSE               = 400 // { int ksem_close(semid_t id); }
 	SYS_KSEM_POST                = 401 // { int ksem_post(semid_t id); }
 	SYS_KSEM_WAIT                = 402 // { int ksem_wait(semid_t id); }
@@ -267,14 +249,14 @@ const (
 	SYS___MAC_GET_PID            = 409 // { int __mac_get_pid(pid_t pid, struct mac *mac_p); }
 	SYS___MAC_GET_LINK           = 410 // { int __mac_get_link(const char *path_p, struct mac *mac_p); }
 	SYS___MAC_SET_LINK           = 411 // { int __mac_set_link(const char *path_p, struct mac *mac_p); }
-	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link( const char *path, int attrnamespace, const char *attrname); }
+	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link(const char *path, int attrnamespace, const char *attrname); }
 	SYS___MAC_EXECVE             = 415 // { int __mac_execve(char *fname, char **argv, char **envv, struct mac *mac_p); }
 	SYS_SIGACTION                = 416 // { int sigaction(int sig, const struct sigaction *act, struct sigaction *oact); }
-	SYS_SIGRETURN                = 417 // { int sigreturn( const struct __ucontext *sigcntxp); }
+	SYS_SIGRETURN                = 417 // { int sigreturn(const struct __ucontext *sigcntxp); }
 	SYS_GETCONTEXT               = 421 // { int getcontext(struct __ucontext *ucp); }
-	SYS_SETCONTEXT               = 422 // { int setcontext( const struct __ucontext *ucp); }
+	SYS_SETCONTEXT               = 422 // { int setcontext(const struct __ucontext *ucp); }
 	SYS_SWAPCONTEXT              = 423 // { int swapcontext(struct __ucontext *oucp, const struct __ucontext *ucp); }
 	SYS_SWAPOFF                  = 424 // { int swapoff(const char *name); }
 	SYS___ACL_GET_LINK           = 425 // { int __acl_get_link(const char *path, acl_type_t type, struct acl *aclp); }
@@ -288,10 +270,10 @@ const (
 	SYS_THR_KILL                 = 433 // { int thr_kill(long id, int sig); }
 	SYS_JAIL_ATTACH              = 436 // { int jail_attach(int jid); }
 	SYS_EXTATTR_LIST_FD          = 437 // { ssize_t extattr_list_fd(int fd, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file( const char *path, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link( const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file(const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link(const char *path, int attrnamespace, void *data, size_t nbytes); }
 	SYS_KSEM_TIMEDWAIT           = 441 // { int ksem_timedwait(semid_t id, const struct timespec *abstime); }
-	SYS_THR_SUSPEND              = 442 // { int thr_suspend( const struct timespec *timeout); }
+	SYS_THR_SUSPEND              = 442 // { int thr_suspend(const struct timespec *timeout); }
 	SYS_THR_WAKE                 = 443 // { int thr_wake(long id); }
 	SYS_KLDUNLOADF               = 444 // { int kldunloadf(int fileid, int flags); }
 	SYS_AUDIT                    = 445 // { int audit(const void *record, u_int length); }
@@ -300,17 +282,17 @@ const (
 	SYS_SETAUID                  = 448 // { int setauid(uid_t *auid); }
 	SYS_GETAUDIT                 = 449 // { int getaudit(struct auditinfo *auditinfo); }
 	SYS_SETAUDIT                 = 450 // { int setaudit(struct auditinfo *auditinfo); }
-	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
-	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
 	SYS_AUDITCTL                 = 453 // { int auditctl(char *path); }
 	SYS__UMTX_OP                 = 454 // { int _umtx_op(void *obj, int op, u_long val, void *uaddr1, void *uaddr2); }
 	SYS_THR_NEW                  = 455 // { int thr_new(struct thr_param *param, int param_size); }
 	SYS_SIGQUEUE                 = 456 // { int sigqueue(pid_t pid, int signum, void *value); }
 	SYS_KMQ_OPEN                 = 457 // { int kmq_open(const char *path, int flags, mode_t mode, const struct mq_attr *attr); }
-	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd,		const struct mq_attr *attr,		struct mq_attr *oattr); }
-	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd,	char *msg_ptr, size_t msg_len,	unsigned *msg_prio,			const struct timespec *abs_timeout); }
-	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd,		const char *msg_ptr, size_t msg_len,unsigned msg_prio,			const struct timespec *abs_timeout);}
-	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd,		const struct sigevent *sigev); }
+	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd, const struct mq_attr *attr, struct mq_attr *oattr); }
+	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd, char *msg_ptr, size_t msg_len, unsigned *msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd, const char *msg_ptr, size_t msg_len, unsigned msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd, const struct sigevent *sigev); }
 	SYS_KMQ_UNLINK               = 462 // { int kmq_unlink(const char *path); }
 	SYS_ABORT2                   = 463 // { int abort2(const char *why, int nargs, void **args); }
 	SYS_THR_SET_NAME             = 464 // { int thr_set_name(long id, const char *name); }
@@ -319,7 +301,7 @@ const (
 	SYS_SCTP_PEELOFF             = 471 // { int sctp_peeloff(int sd, uint32_t name); }
 	SYS_SCTP_GENERIC_SENDMSG     = 472 // { int sctp_generic_sendmsg(int sd, caddr_t msg, int mlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
 	SYS_SCTP_GENERIC_SENDMSG_IOV = 473 // { int sctp_generic_sendmsg_iov(int sd, struct iovec *iov, int iovlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
-	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr * from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
+	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr *from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
 	SYS_PREAD                    = 475 // { ssize_t pread(int fd, void *buf, size_t nbyte, off_t offset); }
 	SYS_PWRITE                   = 476 // { ssize_t pwrite(int fd, const void *buf, size_t nbyte, off_t offset); }
 	SYS_MMAP                     = 477 // { caddr_t mmap(caddr_t addr, size_t len, int prot, int flags, int fd, off_t pos); }
@@ -338,14 +320,12 @@ const (
 	SYS_FCHMODAT                 = 490 // { int fchmodat(int fd, char *path, mode_t mode, int flag); }
 	SYS_FCHOWNAT                 = 491 // { int fchownat(int fd, char *path, uid_t uid, gid_t gid, int flag); }
 	SYS_FEXECVE                  = 492 // { int fexecve(int fd, char **argv, char **envv); }
-	SYS_FSTATAT                  = 493 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
 	SYS_FUTIMESAT                = 494 // { int futimesat(int fd, char *path, struct timeval *times); }
 	SYS_LINKAT                   = 495 // { int linkat(int fd1, char *path1, int fd2, char *path2, int flag); }
 	SYS_MKDIRAT                  = 496 // { int mkdirat(int fd, char *path, mode_t mode); }
 	SYS_MKFIFOAT                 = 497 // { int mkfifoat(int fd, char *path, mode_t mode); }
-	SYS_MKNODAT                  = 498 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
 	SYS_OPENAT                   = 499 // { int openat(int fd, char *path, int flag, mode_t mode); }
-	SYS_READLINKAT               = 500 // { int readlinkat(int fd, char *path, char *buf, size_t bufsize); }
+	SYS_READLINKAT               = 500 // { ssize_t readlinkat(int fd, char *path, char *buf, size_t bufsize); }
 	SYS_RENAMEAT                 = 501 // { int renameat(int oldfd, char *old, int newfd, char *new); }
 	SYS_SYMLINKAT                = 502 // { int symlinkat(char *path1, int fd, char *path2); }
 	SYS_UNLINKAT                 = 503 // { int unlinkat(int fd, char *path, int flag); }
@@ -391,7 +371,24 @@ const (
 	SYS_PPOLL                    = 545 // { int ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *set); }
 	SYS_FUTIMENS                 = 546 // { int futimens(int fd, struct timespec *times); }
 	SYS_UTIMENSAT                = 547 // { int utimensat(int fd, char *path, struct timespec *times, int flag); }
-	SYS_NUMA_GETAFFINITY         = 548 // { int numa_getaffinity(cpuwhich_t which, id_t id, struct vm_domain_policy_entry *policy); }
-	SYS_NUMA_SETAFFINITY         = 549 // { int numa_setaffinity(cpuwhich_t which, id_t id, const struct vm_domain_policy_entry *policy); }
 	SYS_FDATASYNC                = 550 // { int fdatasync(int fd); }
+	SYS_FSTAT                    = 551 // { int fstat(int fd, struct stat *sb); }
+	SYS_FSTATAT                  = 552 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
+	SYS_FHSTAT                   = 553 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
+	SYS_GETDIRENTRIES            = 554 // { ssize_t getdirentries(int fd, char *buf, size_t count, off_t *basep); }
+	SYS_STATFS                   = 555 // { int statfs(char *path, struct statfs *buf); }
+	SYS_FSTATFS                  = 556 // { int fstatfs(int fd, struct statfs *buf); }
+	SYS_GETFSSTAT                = 557 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
+	SYS_FHSTATFS                 = 558 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
+	SYS_MKNODAT                  = 559 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
+	SYS_KEVENT                   = 560 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_CPUSET_GETDOMAIN         = 561 // { int cpuset_getdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int *policy); }
+	SYS_CPUSET_SETDOMAIN         = 562 // { int cpuset_setdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int policy); }
+	SYS_GETRANDOM                = 563 // { int getrandom(void *buf, size_t buflen, unsigned int flags); }
+	SYS_GETFHAT                  = 564 // { int getfhat(int fd, char *path, struct fhandle *fhp, int flags); }
+	SYS_FHLINK                   = 565 // { int fhlink(struct fhandle *fhp, const char *to); }
+	SYS_FHLINKAT                 = 566 // { int fhlinkat(struct fhandle *fhp, int tofd, const char *to,); }
+	SYS_FHREADLINK               = 567 // { int fhreadlink(struct fhandle *fhp, char *buf, size_t bufsize); }
+	SYS___SYSCTLBYNAME           = 570 // { int __sysctlbyname(const char *name, size_t namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_CLOSE_RANGE              = 575 // { int close_range(u_int lowfd, u_int highfd, int flags); }
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm.go b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm.go
index e2e3d72c5b..ad99bc106a 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm.go
@@ -1,4 +1,4 @@
-// go run mksysnum.go https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master
+// go run mksysnum.go https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm && freebsd
@@ -19,10 +19,9 @@ const (
 	SYS_UNLINK                   = 10  // { int unlink(char *path); }
 	SYS_CHDIR                    = 12  // { int chdir(char *path); }
 	SYS_FCHDIR                   = 13  // { int fchdir(int fd); }
-	SYS_MKNOD                    = 14  // { int mknod(char *path, int mode, int dev); }
 	SYS_CHMOD                    = 15  // { int chmod(char *path, int mode); }
 	SYS_CHOWN                    = 16  // { int chown(char *path, int uid, int gid); }
-	SYS_OBREAK                   = 17  // { int obreak(char *nsize); } break obreak_args int
+	SYS_BREAK                    = 17  // { caddr_t break(char *nsize); }
 	SYS_GETPID                   = 20  // { pid_t getpid(void); }
 	SYS_MOUNT                    = 21  // { int mount(char *type, char *path, int flags, caddr_t data); }
 	SYS_UNMOUNT                  = 22  // { int unmount(char *path, int flags); }
@@ -43,7 +42,6 @@ const (
 	SYS_KILL                     = 37  // { int kill(int pid, int signum); }
 	SYS_GETPPID                  = 39  // { pid_t getppid(void); }
 	SYS_DUP                      = 41  // { int dup(u_int fd); }
-	SYS_PIPE                     = 42  // { int pipe(void); }
 	SYS_GETEGID                  = 43  // { gid_t getegid(void); }
 	SYS_PROFIL                   = 44  // { int profil(caddr_t samples, size_t size, size_t offset, u_int scale); }
 	SYS_KTRACE                   = 45  // { int ktrace(const char *fname, int ops, int facs, int pid); }
@@ -58,15 +56,14 @@ const (
 	SYS_SYMLINK                  = 57  // { int symlink(char *path, char *link); }
 	SYS_READLINK                 = 58  // { ssize_t readlink(char *path, char *buf, size_t count); }
 	SYS_EXECVE                   = 59  // { int execve(char *fname, char **argv, char **envv); }
-	SYS_UMASK                    = 60  // { int umask(int newmask); } umask umask_args int
+	SYS_UMASK                    = 60  // { int umask(int newmask); }
 	SYS_CHROOT                   = 61  // { int chroot(char *path); }
 	SYS_MSYNC                    = 65  // { int msync(void *addr, size_t len, int flags); }
 	SYS_VFORK                    = 66  // { int vfork(void); }
 	SYS_SBRK                     = 69  // { int sbrk(int incr); }
 	SYS_SSTK                     = 70  // { int sstk(int incr); }
-	SYS_OVADVISE                 = 72  // { int ovadvise(int anom); } vadvise ovadvise_args int
 	SYS_MUNMAP                   = 73  // { int munmap(void *addr, size_t len); }
-	SYS_MPROTECT                 = 74  // { int mprotect(const void *addr, size_t len, int prot); }
+	SYS_MPROTECT                 = 74  // { int mprotect(void *addr, size_t len, int prot); }
 	SYS_MADVISE                  = 75  // { int madvise(void *addr, size_t len, int behav); }
 	SYS_MINCORE                  = 78  // { int mincore(const void *addr, size_t len, char *vec); }
 	SYS_GETGROUPS                = 79  // { int getgroups(u_int gidsetsize, gid_t *gidset); }
@@ -124,14 +121,10 @@ const (
 	SYS_SETGID                   = 181 // { int setgid(gid_t gid); }
 	SYS_SETEGID                  = 182 // { int setegid(gid_t egid); }
 	SYS_SETEUID                  = 183 // { int seteuid(uid_t euid); }
-	SYS_STAT                     = 188 // { int stat(char *path, struct stat *ub); }
-	SYS_FSTAT                    = 189 // { int fstat(int fd, struct stat *sb); }
-	SYS_LSTAT                    = 190 // { int lstat(char *path, struct stat *ub); }
 	SYS_PATHCONF                 = 191 // { int pathconf(char *path, int name); }
 	SYS_FPATHCONF                = 192 // { int fpathconf(int fd, int name); }
 	SYS_GETRLIMIT                = 194 // { int getrlimit(u_int which, struct rlimit *rlp); } getrlimit __getrlimit_args int
 	SYS_SETRLIMIT                = 195 // { int setrlimit(u_int which, struct rlimit *rlp); } setrlimit __setrlimit_args int
-	SYS_GETDIRENTRIES            = 196 // { int getdirentries(int fd, char *buf, u_int count, long *basep); }
 	SYS___SYSCTL                 = 202 // { int __sysctl(int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); } __sysctl sysctl_args int
 	SYS_MLOCK                    = 203 // { int mlock(const void *addr, size_t len); }
 	SYS_MUNLOCK                  = 204 // { int munlock(const void *addr, size_t len); }
@@ -143,12 +136,12 @@ const (
 	SYS_SEMOP                    = 222 // { int semop(int semid, struct sembuf *sops, size_t nsops); }
 	SYS_MSGGET                   = 225 // { int msgget(key_t key, int msgflg); }
 	SYS_MSGSND                   = 226 // { int msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
-	SYS_MSGRCV                   = 227 // { int msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_MSGRCV                   = 227 // { ssize_t msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
 	SYS_SHMAT                    = 228 // { int shmat(int shmid, const void *shmaddr, int shmflg); }
 	SYS_SHMDT                    = 230 // { int shmdt(const void *shmaddr); }
 	SYS_SHMGET                   = 231 // { int shmget(key_t key, size_t size, int shmflg); }
 	SYS_CLOCK_GETTIME            = 232 // { int clock_gettime(clockid_t clock_id, struct timespec *tp); }
-	SYS_CLOCK_SETTIME            = 233 // { int clock_settime( clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_SETTIME            = 233 // { int clock_settime(clockid_t clock_id, const struct timespec *tp); }
 	SYS_CLOCK_GETRES             = 234 // { int clock_getres(clockid_t clock_id, struct timespec *tp); }
 	SYS_KTIMER_CREATE            = 235 // { int ktimer_create(clockid_t clock_id, struct sigevent *evp, int *timerid); }
 	SYS_KTIMER_DELETE            = 236 // { int ktimer_delete(int timerid); }
@@ -157,50 +150,44 @@ const (
 	SYS_KTIMER_GETOVERRUN        = 239 // { int ktimer_getoverrun(int timerid); }
 	SYS_NANOSLEEP                = 240 // { int nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
 	SYS_FFCLOCK_GETCOUNTER       = 241 // { int ffclock_getcounter(ffcounter *ffcount); }
-	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate( struct ffclock_estimate *cest); }
-	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate( struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate(struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate(struct ffclock_estimate *cest); }
 	SYS_CLOCK_NANOSLEEP          = 244 // { int clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp); }
-	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id,int which, clockid_t *clock_id); }
+	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id, int which, clockid_t *clock_id); }
 	SYS_NTP_GETTIME              = 248 // { int ntp_gettime(struct ntptimeval *ntvp); }
 	SYS_MINHERIT                 = 250 // { int minherit(void *addr, size_t len, int inherit); }
 	SYS_RFORK                    = 251 // { int rfork(int flags); }
-	SYS_OPENBSD_POLL             = 252 // { int openbsd_poll(struct pollfd *fds, u_int nfds, int timeout); }
 	SYS_ISSETUGID                = 253 // { int issetugid(void); }
 	SYS_LCHOWN                   = 254 // { int lchown(char *path, int uid, int gid); }
 	SYS_AIO_READ                 = 255 // { int aio_read(struct aiocb *aiocbp); }
 	SYS_AIO_WRITE                = 256 // { int aio_write(struct aiocb *aiocbp); }
-	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb * const *acb_list, int nent, struct sigevent *sig); }
-	SYS_GETDENTS                 = 272 // { int getdents(int fd, char *buf, size_t count); }
+	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb* const *acb_list, int nent, struct sigevent *sig); }
 	SYS_LCHMOD                   = 274 // { int lchmod(char *path, mode_t mode); }
 	SYS_LUTIMES                  = 276 // { int lutimes(char *path, struct timeval *tptr); }
-	SYS_NSTAT                    = 278 // { int nstat(char *path, struct nstat *ub); }
-	SYS_NFSTAT                   = 279 // { int nfstat(int fd, struct nstat *sb); }
-	SYS_NLSTAT                   = 280 // { int nlstat(char *path, struct nstat *ub); }
 	SYS_PREADV                   = 289 // { ssize_t preadv(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_PWRITEV                  = 290 // { ssize_t pwritev(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_FHOPEN                   = 298 // { int fhopen(const struct fhandle *u_fhp, int flags); }
-	SYS_FHSTAT                   = 299 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
 	SYS_MODNEXT                  = 300 // { int modnext(int modid); }
-	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat *stat); }
+	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat* stat); }
 	SYS_MODFNEXT                 = 302 // { int modfnext(int modid); }
 	SYS_MODFIND                  = 303 // { int modfind(const char *name); }
 	SYS_KLDLOAD                  = 304 // { int kldload(const char *file); }
 	SYS_KLDUNLOAD                = 305 // { int kldunload(int fileid); }
 	SYS_KLDFIND                  = 306 // { int kldfind(const char *file); }
 	SYS_KLDNEXT                  = 307 // { int kldnext(int fileid); }
-	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat* stat); }
+	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat *stat); }
 	SYS_KLDFIRSTMOD              = 309 // { int kldfirstmod(int fileid); }
 	SYS_GETSID                   = 310 // { int getsid(pid_t pid); }
 	SYS_SETRESUID                = 311 // { int setresuid(uid_t ruid, uid_t euid, uid_t suid); }
 	SYS_SETRESGID                = 312 // { int setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
 	SYS_AIO_RETURN               = 314 // { ssize_t aio_return(struct aiocb *aiocbp); }
-	SYS_AIO_SUSPEND              = 315 // { int aio_suspend( struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
+	SYS_AIO_SUSPEND              = 315 // { int aio_suspend(struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
 	SYS_AIO_CANCEL               = 316 // { int aio_cancel(int fd, struct aiocb *aiocbp); }
 	SYS_AIO_ERROR                = 317 // { int aio_error(struct aiocb *aiocbp); }
 	SYS_YIELD                    = 321 // { int yield(void); }
 	SYS_MLOCKALL                 = 324 // { int mlockall(int how); }
 	SYS_MUNLOCKALL               = 325 // { int munlockall(void); }
-	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, u_int buflen); }
+	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, size_t buflen); }
 	SYS_SCHED_SETPARAM           = 327 // { int sched_setparam (pid_t pid, const struct sched_param *param); }
 	SYS_SCHED_GETPARAM           = 328 // { int sched_getparam (pid_t pid, struct sched_param *param); }
 	SYS_SCHED_SETSCHEDULER       = 329 // { int sched_setscheduler (pid_t pid, int policy, const struct sched_param *param); }
@@ -226,14 +213,13 @@ const (
 	SYS___ACL_ACLCHECK_FILE      = 353 // { int __acl_aclcheck_file(const char *path, acl_type_t type, struct acl *aclp); }
 	SYS___ACL_ACLCHECK_FD        = 354 // { int __acl_aclcheck_fd(int filedes, acl_type_t type, struct acl *aclp); }
 	SYS_EXTATTRCTL               = 355 // { int extattrctl(const char *path, int cmd, const char *filename, int attrnamespace, const char *attrname); }
-	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FILE      = 358 // { int extattr_delete_file(const char *path, int attrnamespace, const char *attrname); }
-	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete( struct aiocb **aiocbp, struct timespec *timeout); }
+	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete(struct aiocb **aiocbp, struct timespec *timeout); }
 	SYS_GETRESUID                = 360 // { int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
 	SYS_GETRESGID                = 361 // { int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
 	SYS_KQUEUE                   = 362 // { int kqueue(void); }
-	SYS_KEVENT                   = 363 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
 	SYS_EXTATTR_SET_FD           = 371 // { ssize_t extattr_set_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_GET_FD           = 372 // { ssize_t extattr_get_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FD        = 373 // { int extattr_delete_fd(int fd, int attrnamespace, const char *attrname); }
@@ -251,10 +237,6 @@ const (
 	SYS_UUIDGEN                  = 392 // { int uuidgen(struct uuid *store, int count); }
 	SYS_SENDFILE                 = 393 // { int sendfile(int fd, int s, off_t offset, size_t nbytes, struct sf_hdtr *hdtr, off_t *sbytes, int flags); }
 	SYS_MAC_SYSCALL              = 394 // { int mac_syscall(const char *policy, int call, void *arg); }
-	SYS_GETFSSTAT                = 395 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
-	SYS_STATFS                   = 396 // { int statfs(char *path, struct statfs *buf); }
-	SYS_FSTATFS                  = 397 // { int fstatfs(int fd, struct statfs *buf); }
-	SYS_FHSTATFS                 = 398 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
 	SYS_KSEM_CLOSE               = 400 // { int ksem_close(semid_t id); }
 	SYS_KSEM_POST                = 401 // { int ksem_post(semid_t id); }
 	SYS_KSEM_WAIT                = 402 // { int ksem_wait(semid_t id); }
@@ -267,14 +249,14 @@ const (
 	SYS___MAC_GET_PID            = 409 // { int __mac_get_pid(pid_t pid, struct mac *mac_p); }
 	SYS___MAC_GET_LINK           = 410 // { int __mac_get_link(const char *path_p, struct mac *mac_p); }
 	SYS___MAC_SET_LINK           = 411 // { int __mac_set_link(const char *path_p, struct mac *mac_p); }
-	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link( const char *path, int attrnamespace, const char *attrname); }
+	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link(const char *path, int attrnamespace, const char *attrname); }
 	SYS___MAC_EXECVE             = 415 // { int __mac_execve(char *fname, char **argv, char **envv, struct mac *mac_p); }
 	SYS_SIGACTION                = 416 // { int sigaction(int sig, const struct sigaction *act, struct sigaction *oact); }
-	SYS_SIGRETURN                = 417 // { int sigreturn( const struct __ucontext *sigcntxp); }
+	SYS_SIGRETURN                = 417 // { int sigreturn(const struct __ucontext *sigcntxp); }
 	SYS_GETCONTEXT               = 421 // { int getcontext(struct __ucontext *ucp); }
-	SYS_SETCONTEXT               = 422 // { int setcontext( const struct __ucontext *ucp); }
+	SYS_SETCONTEXT               = 422 // { int setcontext(const struct __ucontext *ucp); }
 	SYS_SWAPCONTEXT              = 423 // { int swapcontext(struct __ucontext *oucp, const struct __ucontext *ucp); }
 	SYS_SWAPOFF                  = 424 // { int swapoff(const char *name); }
 	SYS___ACL_GET_LINK           = 425 // { int __acl_get_link(const char *path, acl_type_t type, struct acl *aclp); }
@@ -288,10 +270,10 @@ const (
 	SYS_THR_KILL                 = 433 // { int thr_kill(long id, int sig); }
 	SYS_JAIL_ATTACH              = 436 // { int jail_attach(int jid); }
 	SYS_EXTATTR_LIST_FD          = 437 // { ssize_t extattr_list_fd(int fd, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file( const char *path, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link( const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file(const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link(const char *path, int attrnamespace, void *data, size_t nbytes); }
 	SYS_KSEM_TIMEDWAIT           = 441 // { int ksem_timedwait(semid_t id, const struct timespec *abstime); }
-	SYS_THR_SUSPEND              = 442 // { int thr_suspend( const struct timespec *timeout); }
+	SYS_THR_SUSPEND              = 442 // { int thr_suspend(const struct timespec *timeout); }
 	SYS_THR_WAKE                 = 443 // { int thr_wake(long id); }
 	SYS_KLDUNLOADF               = 444 // { int kldunloadf(int fileid, int flags); }
 	SYS_AUDIT                    = 445 // { int audit(const void *record, u_int length); }
@@ -300,17 +282,17 @@ const (
 	SYS_SETAUID                  = 448 // { int setauid(uid_t *auid); }
 	SYS_GETAUDIT                 = 449 // { int getaudit(struct auditinfo *auditinfo); }
 	SYS_SETAUDIT                 = 450 // { int setaudit(struct auditinfo *auditinfo); }
-	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
-	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
 	SYS_AUDITCTL                 = 453 // { int auditctl(char *path); }
 	SYS__UMTX_OP                 = 454 // { int _umtx_op(void *obj, int op, u_long val, void *uaddr1, void *uaddr2); }
 	SYS_THR_NEW                  = 455 // { int thr_new(struct thr_param *param, int param_size); }
 	SYS_SIGQUEUE                 = 456 // { int sigqueue(pid_t pid, int signum, void *value); }
 	SYS_KMQ_OPEN                 = 457 // { int kmq_open(const char *path, int flags, mode_t mode, const struct mq_attr *attr); }
-	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd,		const struct mq_attr *attr,		struct mq_attr *oattr); }
-	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd,	char *msg_ptr, size_t msg_len,	unsigned *msg_prio,			const struct timespec *abs_timeout); }
-	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd,		const char *msg_ptr, size_t msg_len,unsigned msg_prio,			const struct timespec *abs_timeout);}
-	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd,		const struct sigevent *sigev); }
+	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd, const struct mq_attr *attr, struct mq_attr *oattr); }
+	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd, char *msg_ptr, size_t msg_len, unsigned *msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd, const char *msg_ptr, size_t msg_len, unsigned msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd, const struct sigevent *sigev); }
 	SYS_KMQ_UNLINK               = 462 // { int kmq_unlink(const char *path); }
 	SYS_ABORT2                   = 463 // { int abort2(const char *why, int nargs, void **args); }
 	SYS_THR_SET_NAME             = 464 // { int thr_set_name(long id, const char *name); }
@@ -319,7 +301,7 @@ const (
 	SYS_SCTP_PEELOFF             = 471 // { int sctp_peeloff(int sd, uint32_t name); }
 	SYS_SCTP_GENERIC_SENDMSG     = 472 // { int sctp_generic_sendmsg(int sd, caddr_t msg, int mlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
 	SYS_SCTP_GENERIC_SENDMSG_IOV = 473 // { int sctp_generic_sendmsg_iov(int sd, struct iovec *iov, int iovlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
-	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr * from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
+	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr *from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
 	SYS_PREAD                    = 475 // { ssize_t pread(int fd, void *buf, size_t nbyte, off_t offset); }
 	SYS_PWRITE                   = 476 // { ssize_t pwrite(int fd, const void *buf, size_t nbyte, off_t offset); }
 	SYS_MMAP                     = 477 // { caddr_t mmap(caddr_t addr, size_t len, int prot, int flags, int fd, off_t pos); }
@@ -338,14 +320,12 @@ const (
 	SYS_FCHMODAT                 = 490 // { int fchmodat(int fd, char *path, mode_t mode, int flag); }
 	SYS_FCHOWNAT                 = 491 // { int fchownat(int fd, char *path, uid_t uid, gid_t gid, int flag); }
 	SYS_FEXECVE                  = 492 // { int fexecve(int fd, char **argv, char **envv); }
-	SYS_FSTATAT                  = 493 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
 	SYS_FUTIMESAT                = 494 // { int futimesat(int fd, char *path, struct timeval *times); }
 	SYS_LINKAT                   = 495 // { int linkat(int fd1, char *path1, int fd2, char *path2, int flag); }
 	SYS_MKDIRAT                  = 496 // { int mkdirat(int fd, char *path, mode_t mode); }
 	SYS_MKFIFOAT                 = 497 // { int mkfifoat(int fd, char *path, mode_t mode); }
-	SYS_MKNODAT                  = 498 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
 	SYS_OPENAT                   = 499 // { int openat(int fd, char *path, int flag, mode_t mode); }
-	SYS_READLINKAT               = 500 // { int readlinkat(int fd, char *path, char *buf, size_t bufsize); }
+	SYS_READLINKAT               = 500 // { ssize_t readlinkat(int fd, char *path, char *buf, size_t bufsize); }
 	SYS_RENAMEAT                 = 501 // { int renameat(int oldfd, char *old, int newfd, char *new); }
 	SYS_SYMLINKAT                = 502 // { int symlinkat(char *path1, int fd, char *path2); }
 	SYS_UNLINKAT                 = 503 // { int unlinkat(int fd, char *path, int flag); }
@@ -391,7 +371,24 @@ const (
 	SYS_PPOLL                    = 545 // { int ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *set); }
 	SYS_FUTIMENS                 = 546 // { int futimens(int fd, struct timespec *times); }
 	SYS_UTIMENSAT                = 547 // { int utimensat(int fd, char *path, struct timespec *times, int flag); }
-	SYS_NUMA_GETAFFINITY         = 548 // { int numa_getaffinity(cpuwhich_t which, id_t id, struct vm_domain_policy_entry *policy); }
-	SYS_NUMA_SETAFFINITY         = 549 // { int numa_setaffinity(cpuwhich_t which, id_t id, const struct vm_domain_policy_entry *policy); }
 	SYS_FDATASYNC                = 550 // { int fdatasync(int fd); }
+	SYS_FSTAT                    = 551 // { int fstat(int fd, struct stat *sb); }
+	SYS_FSTATAT                  = 552 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
+	SYS_FHSTAT                   = 553 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
+	SYS_GETDIRENTRIES            = 554 // { ssize_t getdirentries(int fd, char *buf, size_t count, off_t *basep); }
+	SYS_STATFS                   = 555 // { int statfs(char *path, struct statfs *buf); }
+	SYS_FSTATFS                  = 556 // { int fstatfs(int fd, struct statfs *buf); }
+	SYS_GETFSSTAT                = 557 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
+	SYS_FHSTATFS                 = 558 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
+	SYS_MKNODAT                  = 559 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
+	SYS_KEVENT                   = 560 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_CPUSET_GETDOMAIN         = 561 // { int cpuset_getdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int *policy); }
+	SYS_CPUSET_SETDOMAIN         = 562 // { int cpuset_setdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int policy); }
+	SYS_GETRANDOM                = 563 // { int getrandom(void *buf, size_t buflen, unsigned int flags); }
+	SYS_GETFHAT                  = 564 // { int getfhat(int fd, char *path, struct fhandle *fhp, int flags); }
+	SYS_FHLINK                   = 565 // { int fhlink(struct fhandle *fhp, const char *to); }
+	SYS_FHLINKAT                 = 566 // { int fhlinkat(struct fhandle *fhp, int tofd, const char *to,); }
+	SYS_FHREADLINK               = 567 // { int fhreadlink(struct fhandle *fhp, char *buf, size_t bufsize); }
+	SYS___SYSCTLBYNAME           = 570 // { int __sysctlbyname(const char *name, size_t namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_CLOSE_RANGE              = 575 // { int close_range(u_int lowfd, u_int highfd, int flags); }
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm64.go
index 61ad5ca3c1..89dcc42747 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_arm64.go
@@ -1,4 +1,4 @@
-// go run mksysnum.go https://svn.freebsd.org/base/stable/11/sys/kern/syscalls.master
+// go run mksysnum.go https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm64 && freebsd
@@ -19,10 +19,9 @@ const (
 	SYS_UNLINK                   = 10  // { int unlink(char *path); }
 	SYS_CHDIR                    = 12  // { int chdir(char *path); }
 	SYS_FCHDIR                   = 13  // { int fchdir(int fd); }
-	SYS_MKNOD                    = 14  // { int mknod(char *path, int mode, int dev); }
 	SYS_CHMOD                    = 15  // { int chmod(char *path, int mode); }
 	SYS_CHOWN                    = 16  // { int chown(char *path, int uid, int gid); }
-	SYS_OBREAK                   = 17  // { int obreak(char *nsize); } break obreak_args int
+	SYS_BREAK                    = 17  // { caddr_t break(char *nsize); }
 	SYS_GETPID                   = 20  // { pid_t getpid(void); }
 	SYS_MOUNT                    = 21  // { int mount(char *type, char *path, int flags, caddr_t data); }
 	SYS_UNMOUNT                  = 22  // { int unmount(char *path, int flags); }
@@ -43,7 +42,6 @@ const (
 	SYS_KILL                     = 37  // { int kill(int pid, int signum); }
 	SYS_GETPPID                  = 39  // { pid_t getppid(void); }
 	SYS_DUP                      = 41  // { int dup(u_int fd); }
-	SYS_PIPE                     = 42  // { int pipe(void); }
 	SYS_GETEGID                  = 43  // { gid_t getegid(void); }
 	SYS_PROFIL                   = 44  // { int profil(caddr_t samples, size_t size, size_t offset, u_int scale); }
 	SYS_KTRACE                   = 45  // { int ktrace(const char *fname, int ops, int facs, int pid); }
@@ -58,15 +56,14 @@ const (
 	SYS_SYMLINK                  = 57  // { int symlink(char *path, char *link); }
 	SYS_READLINK                 = 58  // { ssize_t readlink(char *path, char *buf, size_t count); }
 	SYS_EXECVE                   = 59  // { int execve(char *fname, char **argv, char **envv); }
-	SYS_UMASK                    = 60  // { int umask(int newmask); } umask umask_args int
+	SYS_UMASK                    = 60  // { int umask(int newmask); }
 	SYS_CHROOT                   = 61  // { int chroot(char *path); }
 	SYS_MSYNC                    = 65  // { int msync(void *addr, size_t len, int flags); }
 	SYS_VFORK                    = 66  // { int vfork(void); }
 	SYS_SBRK                     = 69  // { int sbrk(int incr); }
 	SYS_SSTK                     = 70  // { int sstk(int incr); }
-	SYS_OVADVISE                 = 72  // { int ovadvise(int anom); } vadvise ovadvise_args int
 	SYS_MUNMAP                   = 73  // { int munmap(void *addr, size_t len); }
-	SYS_MPROTECT                 = 74  // { int mprotect(const void *addr, size_t len, int prot); }
+	SYS_MPROTECT                 = 74  // { int mprotect(void *addr, size_t len, int prot); }
 	SYS_MADVISE                  = 75  // { int madvise(void *addr, size_t len, int behav); }
 	SYS_MINCORE                  = 78  // { int mincore(const void *addr, size_t len, char *vec); }
 	SYS_GETGROUPS                = 79  // { int getgroups(u_int gidsetsize, gid_t *gidset); }
@@ -124,14 +121,10 @@ const (
 	SYS_SETGID                   = 181 // { int setgid(gid_t gid); }
 	SYS_SETEGID                  = 182 // { int setegid(gid_t egid); }
 	SYS_SETEUID                  = 183 // { int seteuid(uid_t euid); }
-	SYS_STAT                     = 188 // { int stat(char *path, struct stat *ub); }
-	SYS_FSTAT                    = 189 // { int fstat(int fd, struct stat *sb); }
-	SYS_LSTAT                    = 190 // { int lstat(char *path, struct stat *ub); }
 	SYS_PATHCONF                 = 191 // { int pathconf(char *path, int name); }
 	SYS_FPATHCONF                = 192 // { int fpathconf(int fd, int name); }
 	SYS_GETRLIMIT                = 194 // { int getrlimit(u_int which, struct rlimit *rlp); } getrlimit __getrlimit_args int
 	SYS_SETRLIMIT                = 195 // { int setrlimit(u_int which, struct rlimit *rlp); } setrlimit __setrlimit_args int
-	SYS_GETDIRENTRIES            = 196 // { int getdirentries(int fd, char *buf, u_int count, long *basep); }
 	SYS___SYSCTL                 = 202 // { int __sysctl(int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); } __sysctl sysctl_args int
 	SYS_MLOCK                    = 203 // { int mlock(const void *addr, size_t len); }
 	SYS_MUNLOCK                  = 204 // { int munlock(const void *addr, size_t len); }
@@ -143,12 +136,12 @@ const (
 	SYS_SEMOP                    = 222 // { int semop(int semid, struct sembuf *sops, size_t nsops); }
 	SYS_MSGGET                   = 225 // { int msgget(key_t key, int msgflg); }
 	SYS_MSGSND                   = 226 // { int msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
-	SYS_MSGRCV                   = 227 // { int msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_MSGRCV                   = 227 // { ssize_t msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
 	SYS_SHMAT                    = 228 // { int shmat(int shmid, const void *shmaddr, int shmflg); }
 	SYS_SHMDT                    = 230 // { int shmdt(const void *shmaddr); }
 	SYS_SHMGET                   = 231 // { int shmget(key_t key, size_t size, int shmflg); }
 	SYS_CLOCK_GETTIME            = 232 // { int clock_gettime(clockid_t clock_id, struct timespec *tp); }
-	SYS_CLOCK_SETTIME            = 233 // { int clock_settime( clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_SETTIME            = 233 // { int clock_settime(clockid_t clock_id, const struct timespec *tp); }
 	SYS_CLOCK_GETRES             = 234 // { int clock_getres(clockid_t clock_id, struct timespec *tp); }
 	SYS_KTIMER_CREATE            = 235 // { int ktimer_create(clockid_t clock_id, struct sigevent *evp, int *timerid); }
 	SYS_KTIMER_DELETE            = 236 // { int ktimer_delete(int timerid); }
@@ -157,50 +150,44 @@ const (
 	SYS_KTIMER_GETOVERRUN        = 239 // { int ktimer_getoverrun(int timerid); }
 	SYS_NANOSLEEP                = 240 // { int nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
 	SYS_FFCLOCK_GETCOUNTER       = 241 // { int ffclock_getcounter(ffcounter *ffcount); }
-	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate( struct ffclock_estimate *cest); }
-	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate( struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate(struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate(struct ffclock_estimate *cest); }
 	SYS_CLOCK_NANOSLEEP          = 244 // { int clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp); }
-	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id,int which, clockid_t *clock_id); }
+	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id, int which, clockid_t *clock_id); }
 	SYS_NTP_GETTIME              = 248 // { int ntp_gettime(struct ntptimeval *ntvp); }
 	SYS_MINHERIT                 = 250 // { int minherit(void *addr, size_t len, int inherit); }
 	SYS_RFORK                    = 251 // { int rfork(int flags); }
-	SYS_OPENBSD_POLL             = 252 // { int openbsd_poll(struct pollfd *fds, u_int nfds, int timeout); }
 	SYS_ISSETUGID                = 253 // { int issetugid(void); }
 	SYS_LCHOWN                   = 254 // { int lchown(char *path, int uid, int gid); }
 	SYS_AIO_READ                 = 255 // { int aio_read(struct aiocb *aiocbp); }
 	SYS_AIO_WRITE                = 256 // { int aio_write(struct aiocb *aiocbp); }
-	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb * const *acb_list, int nent, struct sigevent *sig); }
-	SYS_GETDENTS                 = 272 // { int getdents(int fd, char *buf, size_t count); }
+	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb* const *acb_list, int nent, struct sigevent *sig); }
 	SYS_LCHMOD                   = 274 // { int lchmod(char *path, mode_t mode); }
 	SYS_LUTIMES                  = 276 // { int lutimes(char *path, struct timeval *tptr); }
-	SYS_NSTAT                    = 278 // { int nstat(char *path, struct nstat *ub); }
-	SYS_NFSTAT                   = 279 // { int nfstat(int fd, struct nstat *sb); }
-	SYS_NLSTAT                   = 280 // { int nlstat(char *path, struct nstat *ub); }
 	SYS_PREADV                   = 289 // { ssize_t preadv(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_PWRITEV                  = 290 // { ssize_t pwritev(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
 	SYS_FHOPEN                   = 298 // { int fhopen(const struct fhandle *u_fhp, int flags); }
-	SYS_FHSTAT                   = 299 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
 	SYS_MODNEXT                  = 300 // { int modnext(int modid); }
-	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat *stat); }
+	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat* stat); }
 	SYS_MODFNEXT                 = 302 // { int modfnext(int modid); }
 	SYS_MODFIND                  = 303 // { int modfind(const char *name); }
 	SYS_KLDLOAD                  = 304 // { int kldload(const char *file); }
 	SYS_KLDUNLOAD                = 305 // { int kldunload(int fileid); }
 	SYS_KLDFIND                  = 306 // { int kldfind(const char *file); }
 	SYS_KLDNEXT                  = 307 // { int kldnext(int fileid); }
-	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat* stat); }
+	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat *stat); }
 	SYS_KLDFIRSTMOD              = 309 // { int kldfirstmod(int fileid); }
 	SYS_GETSID                   = 310 // { int getsid(pid_t pid); }
 	SYS_SETRESUID                = 311 // { int setresuid(uid_t ruid, uid_t euid, uid_t suid); }
 	SYS_SETRESGID                = 312 // { int setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
 	SYS_AIO_RETURN               = 314 // { ssize_t aio_return(struct aiocb *aiocbp); }
-	SYS_AIO_SUSPEND              = 315 // { int aio_suspend( struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
+	SYS_AIO_SUSPEND              = 315 // { int aio_suspend(struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
 	SYS_AIO_CANCEL               = 316 // { int aio_cancel(int fd, struct aiocb *aiocbp); }
 	SYS_AIO_ERROR                = 317 // { int aio_error(struct aiocb *aiocbp); }
 	SYS_YIELD                    = 321 // { int yield(void); }
 	SYS_MLOCKALL                 = 324 // { int mlockall(int how); }
 	SYS_MUNLOCKALL               = 325 // { int munlockall(void); }
-	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, u_int buflen); }
+	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, size_t buflen); }
 	SYS_SCHED_SETPARAM           = 327 // { int sched_setparam (pid_t pid, const struct sched_param *param); }
 	SYS_SCHED_GETPARAM           = 328 // { int sched_getparam (pid_t pid, struct sched_param *param); }
 	SYS_SCHED_SETSCHEDULER       = 329 // { int sched_setscheduler (pid_t pid, int policy, const struct sched_param *param); }
@@ -226,14 +213,13 @@ const (
 	SYS___ACL_ACLCHECK_FILE      = 353 // { int __acl_aclcheck_file(const char *path, acl_type_t type, struct acl *aclp); }
 	SYS___ACL_ACLCHECK_FD        = 354 // { int __acl_aclcheck_fd(int filedes, acl_type_t type, struct acl *aclp); }
 	SYS_EXTATTRCTL               = 355 // { int extattrctl(const char *path, int cmd, const char *filename, int attrnamespace, const char *attrname); }
-	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FILE      = 358 // { int extattr_delete_file(const char *path, int attrnamespace, const char *attrname); }
-	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete( struct aiocb **aiocbp, struct timespec *timeout); }
+	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete(struct aiocb **aiocbp, struct timespec *timeout); }
 	SYS_GETRESUID                = 360 // { int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
 	SYS_GETRESGID                = 361 // { int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
 	SYS_KQUEUE                   = 362 // { int kqueue(void); }
-	SYS_KEVENT                   = 363 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
 	SYS_EXTATTR_SET_FD           = 371 // { ssize_t extattr_set_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_GET_FD           = 372 // { ssize_t extattr_get_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
 	SYS_EXTATTR_DELETE_FD        = 373 // { int extattr_delete_fd(int fd, int attrnamespace, const char *attrname); }
@@ -251,10 +237,6 @@ const (
 	SYS_UUIDGEN                  = 392 // { int uuidgen(struct uuid *store, int count); }
 	SYS_SENDFILE                 = 393 // { int sendfile(int fd, int s, off_t offset, size_t nbytes, struct sf_hdtr *hdtr, off_t *sbytes, int flags); }
 	SYS_MAC_SYSCALL              = 394 // { int mac_syscall(const char *policy, int call, void *arg); }
-	SYS_GETFSSTAT                = 395 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
-	SYS_STATFS                   = 396 // { int statfs(char *path, struct statfs *buf); }
-	SYS_FSTATFS                  = 397 // { int fstatfs(int fd, struct statfs *buf); }
-	SYS_FHSTATFS                 = 398 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
 	SYS_KSEM_CLOSE               = 400 // { int ksem_close(semid_t id); }
 	SYS_KSEM_POST                = 401 // { int ksem_post(semid_t id); }
 	SYS_KSEM_WAIT                = 402 // { int ksem_wait(semid_t id); }
@@ -267,14 +249,14 @@ const (
 	SYS___MAC_GET_PID            = 409 // { int __mac_get_pid(pid_t pid, struct mac *mac_p); }
 	SYS___MAC_GET_LINK           = 410 // { int __mac_get_link(const char *path_p, struct mac *mac_p); }
 	SYS___MAC_SET_LINK           = 411 // { int __mac_set_link(const char *path_p, struct mac *mac_p); }
-	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link( const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
-	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link( const char *path, int attrnamespace, const char *attrname); }
+	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link(const char *path, int attrnamespace, const char *attrname); }
 	SYS___MAC_EXECVE             = 415 // { int __mac_execve(char *fname, char **argv, char **envv, struct mac *mac_p); }
 	SYS_SIGACTION                = 416 // { int sigaction(int sig, const struct sigaction *act, struct sigaction *oact); }
-	SYS_SIGRETURN                = 417 // { int sigreturn( const struct __ucontext *sigcntxp); }
+	SYS_SIGRETURN                = 417 // { int sigreturn(const struct __ucontext *sigcntxp); }
 	SYS_GETCONTEXT               = 421 // { int getcontext(struct __ucontext *ucp); }
-	SYS_SETCONTEXT               = 422 // { int setcontext( const struct __ucontext *ucp); }
+	SYS_SETCONTEXT               = 422 // { int setcontext(const struct __ucontext *ucp); }
 	SYS_SWAPCONTEXT              = 423 // { int swapcontext(struct __ucontext *oucp, const struct __ucontext *ucp); }
 	SYS_SWAPOFF                  = 424 // { int swapoff(const char *name); }
 	SYS___ACL_GET_LINK           = 425 // { int __acl_get_link(const char *path, acl_type_t type, struct acl *aclp); }
@@ -288,10 +270,10 @@ const (
 	SYS_THR_KILL                 = 433 // { int thr_kill(long id, int sig); }
 	SYS_JAIL_ATTACH              = 436 // { int jail_attach(int jid); }
 	SYS_EXTATTR_LIST_FD          = 437 // { ssize_t extattr_list_fd(int fd, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file( const char *path, int attrnamespace, void *data, size_t nbytes); }
-	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link( const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file(const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link(const char *path, int attrnamespace, void *data, size_t nbytes); }
 	SYS_KSEM_TIMEDWAIT           = 441 // { int ksem_timedwait(semid_t id, const struct timespec *abstime); }
-	SYS_THR_SUSPEND              = 442 // { int thr_suspend( const struct timespec *timeout); }
+	SYS_THR_SUSPEND              = 442 // { int thr_suspend(const struct timespec *timeout); }
 	SYS_THR_WAKE                 = 443 // { int thr_wake(long id); }
 	SYS_KLDUNLOADF               = 444 // { int kldunloadf(int fileid, int flags); }
 	SYS_AUDIT                    = 445 // { int audit(const void *record, u_int length); }
@@ -300,17 +282,17 @@ const (
 	SYS_SETAUID                  = 448 // { int setauid(uid_t *auid); }
 	SYS_GETAUDIT                 = 449 // { int getaudit(struct auditinfo *auditinfo); }
 	SYS_SETAUDIT                 = 450 // { int setaudit(struct auditinfo *auditinfo); }
-	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
-	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr( struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
 	SYS_AUDITCTL                 = 453 // { int auditctl(char *path); }
 	SYS__UMTX_OP                 = 454 // { int _umtx_op(void *obj, int op, u_long val, void *uaddr1, void *uaddr2); }
 	SYS_THR_NEW                  = 455 // { int thr_new(struct thr_param *param, int param_size); }
 	SYS_SIGQUEUE                 = 456 // { int sigqueue(pid_t pid, int signum, void *value); }
 	SYS_KMQ_OPEN                 = 457 // { int kmq_open(const char *path, int flags, mode_t mode, const struct mq_attr *attr); }
-	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd,		const struct mq_attr *attr,		struct mq_attr *oattr); }
-	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd,	char *msg_ptr, size_t msg_len,	unsigned *msg_prio,			const struct timespec *abs_timeout); }
-	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd,		const char *msg_ptr, size_t msg_len,unsigned msg_prio,			const struct timespec *abs_timeout);}
-	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd,		const struct sigevent *sigev); }
+	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd, const struct mq_attr *attr, struct mq_attr *oattr); }
+	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd, char *msg_ptr, size_t msg_len, unsigned *msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd, const char *msg_ptr, size_t msg_len, unsigned msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd, const struct sigevent *sigev); }
 	SYS_KMQ_UNLINK               = 462 // { int kmq_unlink(const char *path); }
 	SYS_ABORT2                   = 463 // { int abort2(const char *why, int nargs, void **args); }
 	SYS_THR_SET_NAME             = 464 // { int thr_set_name(long id, const char *name); }
@@ -319,7 +301,7 @@ const (
 	SYS_SCTP_PEELOFF             = 471 // { int sctp_peeloff(int sd, uint32_t name); }
 	SYS_SCTP_GENERIC_SENDMSG     = 472 // { int sctp_generic_sendmsg(int sd, caddr_t msg, int mlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
 	SYS_SCTP_GENERIC_SENDMSG_IOV = 473 // { int sctp_generic_sendmsg_iov(int sd, struct iovec *iov, int iovlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
-	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr * from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
+	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr *from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
 	SYS_PREAD                    = 475 // { ssize_t pread(int fd, void *buf, size_t nbyte, off_t offset); }
 	SYS_PWRITE                   = 476 // { ssize_t pwrite(int fd, const void *buf, size_t nbyte, off_t offset); }
 	SYS_MMAP                     = 477 // { caddr_t mmap(caddr_t addr, size_t len, int prot, int flags, int fd, off_t pos); }
@@ -338,14 +320,12 @@ const (
 	SYS_FCHMODAT                 = 490 // { int fchmodat(int fd, char *path, mode_t mode, int flag); }
 	SYS_FCHOWNAT                 = 491 // { int fchownat(int fd, char *path, uid_t uid, gid_t gid, int flag); }
 	SYS_FEXECVE                  = 492 // { int fexecve(int fd, char **argv, char **envv); }
-	SYS_FSTATAT                  = 493 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
 	SYS_FUTIMESAT                = 494 // { int futimesat(int fd, char *path, struct timeval *times); }
 	SYS_LINKAT                   = 495 // { int linkat(int fd1, char *path1, int fd2, char *path2, int flag); }
 	SYS_MKDIRAT                  = 496 // { int mkdirat(int fd, char *path, mode_t mode); }
 	SYS_MKFIFOAT                 = 497 // { int mkfifoat(int fd, char *path, mode_t mode); }
-	SYS_MKNODAT                  = 498 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
 	SYS_OPENAT                   = 499 // { int openat(int fd, char *path, int flag, mode_t mode); }
-	SYS_READLINKAT               = 500 // { int readlinkat(int fd, char *path, char *buf, size_t bufsize); }
+	SYS_READLINKAT               = 500 // { ssize_t readlinkat(int fd, char *path, char *buf, size_t bufsize); }
 	SYS_RENAMEAT                 = 501 // { int renameat(int oldfd, char *old, int newfd, char *new); }
 	SYS_SYMLINKAT                = 502 // { int symlinkat(char *path1, int fd, char *path2); }
 	SYS_UNLINKAT                 = 503 // { int unlinkat(int fd, char *path, int flag); }
@@ -391,7 +371,24 @@ const (
 	SYS_PPOLL                    = 545 // { int ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *set); }
 	SYS_FUTIMENS                 = 546 // { int futimens(int fd, struct timespec *times); }
 	SYS_UTIMENSAT                = 547 // { int utimensat(int fd, char *path, struct timespec *times, int flag); }
-	SYS_NUMA_GETAFFINITY         = 548 // { int numa_getaffinity(cpuwhich_t which, id_t id, struct vm_domain_policy_entry *policy); }
-	SYS_NUMA_SETAFFINITY         = 549 // { int numa_setaffinity(cpuwhich_t which, id_t id, const struct vm_domain_policy_entry *policy); }
 	SYS_FDATASYNC                = 550 // { int fdatasync(int fd); }
+	SYS_FSTAT                    = 551 // { int fstat(int fd, struct stat *sb); }
+	SYS_FSTATAT                  = 552 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
+	SYS_FHSTAT                   = 553 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
+	SYS_GETDIRENTRIES            = 554 // { ssize_t getdirentries(int fd, char *buf, size_t count, off_t *basep); }
+	SYS_STATFS                   = 555 // { int statfs(char *path, struct statfs *buf); }
+	SYS_FSTATFS                  = 556 // { int fstatfs(int fd, struct statfs *buf); }
+	SYS_GETFSSTAT                = 557 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
+	SYS_FHSTATFS                 = 558 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
+	SYS_MKNODAT                  = 559 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
+	SYS_KEVENT                   = 560 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_CPUSET_GETDOMAIN         = 561 // { int cpuset_getdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int *policy); }
+	SYS_CPUSET_SETDOMAIN         = 562 // { int cpuset_setdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int policy); }
+	SYS_GETRANDOM                = 563 // { int getrandom(void *buf, size_t buflen, unsigned int flags); }
+	SYS_GETFHAT                  = 564 // { int getfhat(int fd, char *path, struct fhandle *fhp, int flags); }
+	SYS_FHLINK                   = 565 // { int fhlink(struct fhandle *fhp, const char *to); }
+	SYS_FHLINKAT                 = 566 // { int fhlinkat(struct fhandle *fhp, int tofd, const char *to,); }
+	SYS_FHREADLINK               = 567 // { int fhreadlink(struct fhandle *fhp, char *buf, size_t bufsize); }
+	SYS___SYSCTLBYNAME           = 570 // { int __sysctlbyname(const char *name, size_t namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_CLOSE_RANGE              = 575 // { int close_range(u_int lowfd, u_int highfd, int flags); }
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_riscv64.go
new file mode 100644
index 0000000000..ee37aaa0c9
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsysnum_freebsd_riscv64.go
@@ -0,0 +1,394 @@
+// go run mksysnum.go https://cgit.freebsd.org/src/plain/sys/kern/syscalls.master?h=stable/12
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build riscv64 && freebsd
+// +build riscv64,freebsd
+
+package unix
+
+const (
+	// SYS_NOSYS = 0;  // { int nosys(void); } syscall nosys_args int
+	SYS_EXIT                     = 1   // { void sys_exit(int rval); } exit sys_exit_args void
+	SYS_FORK                     = 2   // { int fork(void); }
+	SYS_READ                     = 3   // { ssize_t read(int fd, void *buf, size_t nbyte); }
+	SYS_WRITE                    = 4   // { ssize_t write(int fd, const void *buf, size_t nbyte); }
+	SYS_OPEN                     = 5   // { int open(char *path, int flags, int mode); }
+	SYS_CLOSE                    = 6   // { int close(int fd); }
+	SYS_WAIT4                    = 7   // { int wait4(int pid, int *status, int options, struct rusage *rusage); }
+	SYS_LINK                     = 9   // { int link(char *path, char *link); }
+	SYS_UNLINK                   = 10  // { int unlink(char *path); }
+	SYS_CHDIR                    = 12  // { int chdir(char *path); }
+	SYS_FCHDIR                   = 13  // { int fchdir(int fd); }
+	SYS_CHMOD                    = 15  // { int chmod(char *path, int mode); }
+	SYS_CHOWN                    = 16  // { int chown(char *path, int uid, int gid); }
+	SYS_BREAK                    = 17  // { caddr_t break(char *nsize); }
+	SYS_GETPID                   = 20  // { pid_t getpid(void); }
+	SYS_MOUNT                    = 21  // { int mount(char *type, char *path, int flags, caddr_t data); }
+	SYS_UNMOUNT                  = 22  // { int unmount(char *path, int flags); }
+	SYS_SETUID                   = 23  // { int setuid(uid_t uid); }
+	SYS_GETUID                   = 24  // { uid_t getuid(void); }
+	SYS_GETEUID                  = 25  // { uid_t geteuid(void); }
+	SYS_PTRACE                   = 26  // { int ptrace(int req, pid_t pid, caddr_t addr, int data); }
+	SYS_RECVMSG                  = 27  // { int recvmsg(int s, struct msghdr *msg, int flags); }
+	SYS_SENDMSG                  = 28  // { int sendmsg(int s, struct msghdr *msg, int flags); }
+	SYS_RECVFROM                 = 29  // { int recvfrom(int s, caddr_t buf, size_t len, int flags, struct sockaddr * __restrict from, __socklen_t * __restrict fromlenaddr); }
+	SYS_ACCEPT                   = 30  // { int accept(int s, struct sockaddr * __restrict name, __socklen_t * __restrict anamelen); }
+	SYS_GETPEERNAME              = 31  // { int getpeername(int fdes, struct sockaddr * __restrict asa, __socklen_t * __restrict alen); }
+	SYS_GETSOCKNAME              = 32  // { int getsockname(int fdes, struct sockaddr * __restrict asa, __socklen_t * __restrict alen); }
+	SYS_ACCESS                   = 33  // { int access(char *path, int amode); }
+	SYS_CHFLAGS                  = 34  // { int chflags(const char *path, u_long flags); }
+	SYS_FCHFLAGS                 = 35  // { int fchflags(int fd, u_long flags); }
+	SYS_SYNC                     = 36  // { int sync(void); }
+	SYS_KILL                     = 37  // { int kill(int pid, int signum); }
+	SYS_GETPPID                  = 39  // { pid_t getppid(void); }
+	SYS_DUP                      = 41  // { int dup(u_int fd); }
+	SYS_GETEGID                  = 43  // { gid_t getegid(void); }
+	SYS_PROFIL                   = 44  // { int profil(caddr_t samples, size_t size, size_t offset, u_int scale); }
+	SYS_KTRACE                   = 45  // { int ktrace(const char *fname, int ops, int facs, int pid); }
+	SYS_GETGID                   = 47  // { gid_t getgid(void); }
+	SYS_GETLOGIN                 = 49  // { int getlogin(char *namebuf, u_int namelen); }
+	SYS_SETLOGIN                 = 50  // { int setlogin(char *namebuf); }
+	SYS_ACCT                     = 51  // { int acct(char *path); }
+	SYS_SIGALTSTACK              = 53  // { int sigaltstack(stack_t *ss, stack_t *oss); }
+	SYS_IOCTL                    = 54  // { int ioctl(int fd, u_long com, caddr_t data); }
+	SYS_REBOOT                   = 55  // { int reboot(int opt); }
+	SYS_REVOKE                   = 56  // { int revoke(char *path); }
+	SYS_SYMLINK                  = 57  // { int symlink(char *path, char *link); }
+	SYS_READLINK                 = 58  // { ssize_t readlink(char *path, char *buf, size_t count); }
+	SYS_EXECVE                   = 59  // { int execve(char *fname, char **argv, char **envv); }
+	SYS_UMASK                    = 60  // { int umask(int newmask); }
+	SYS_CHROOT                   = 61  // { int chroot(char *path); }
+	SYS_MSYNC                    = 65  // { int msync(void *addr, size_t len, int flags); }
+	SYS_VFORK                    = 66  // { int vfork(void); }
+	SYS_SBRK                     = 69  // { int sbrk(int incr); }
+	SYS_SSTK                     = 70  // { int sstk(int incr); }
+	SYS_MUNMAP                   = 73  // { int munmap(void *addr, size_t len); }
+	SYS_MPROTECT                 = 74  // { int mprotect(void *addr, size_t len, int prot); }
+	SYS_MADVISE                  = 75  // { int madvise(void *addr, size_t len, int behav); }
+	SYS_MINCORE                  = 78  // { int mincore(const void *addr, size_t len, char *vec); }
+	SYS_GETGROUPS                = 79  // { int getgroups(u_int gidsetsize, gid_t *gidset); }
+	SYS_SETGROUPS                = 80  // { int setgroups(u_int gidsetsize, gid_t *gidset); }
+	SYS_GETPGRP                  = 81  // { int getpgrp(void); }
+	SYS_SETPGID                  = 82  // { int setpgid(int pid, int pgid); }
+	SYS_SETITIMER                = 83  // { int setitimer(u_int which, struct itimerval *itv, struct itimerval *oitv); }
+	SYS_SWAPON                   = 85  // { int swapon(char *name); }
+	SYS_GETITIMER                = 86  // { int getitimer(u_int which, struct itimerval *itv); }
+	SYS_GETDTABLESIZE            = 89  // { int getdtablesize(void); }
+	SYS_DUP2                     = 90  // { int dup2(u_int from, u_int to); }
+	SYS_FCNTL                    = 92  // { int fcntl(int fd, int cmd, long arg); }
+	SYS_SELECT                   = 93  // { int select(int nd, fd_set *in, fd_set *ou, fd_set *ex, struct timeval *tv); }
+	SYS_FSYNC                    = 95  // { int fsync(int fd); }
+	SYS_SETPRIORITY              = 96  // { int setpriority(int which, int who, int prio); }
+	SYS_SOCKET                   = 97  // { int socket(int domain, int type, int protocol); }
+	SYS_CONNECT                  = 98  // { int connect(int s, caddr_t name, int namelen); }
+	SYS_GETPRIORITY              = 100 // { int getpriority(int which, int who); }
+	SYS_BIND                     = 104 // { int bind(int s, caddr_t name, int namelen); }
+	SYS_SETSOCKOPT               = 105 // { int setsockopt(int s, int level, int name, caddr_t val, int valsize); }
+	SYS_LISTEN                   = 106 // { int listen(int s, int backlog); }
+	SYS_GETTIMEOFDAY             = 116 // { int gettimeofday(struct timeval *tp, struct timezone *tzp); }
+	SYS_GETRUSAGE                = 117 // { int getrusage(int who, struct rusage *rusage); }
+	SYS_GETSOCKOPT               = 118 // { int getsockopt(int s, int level, int name, caddr_t val, int *avalsize); }
+	SYS_READV                    = 120 // { int readv(int fd, struct iovec *iovp, u_int iovcnt); }
+	SYS_WRITEV                   = 121 // { int writev(int fd, struct iovec *iovp, u_int iovcnt); }
+	SYS_SETTIMEOFDAY             = 122 // { int settimeofday(struct timeval *tv, struct timezone *tzp); }
+	SYS_FCHOWN                   = 123 // { int fchown(int fd, int uid, int gid); }
+	SYS_FCHMOD                   = 124 // { int fchmod(int fd, int mode); }
+	SYS_SETREUID                 = 126 // { int setreuid(int ruid, int euid); }
+	SYS_SETREGID                 = 127 // { int setregid(int rgid, int egid); }
+	SYS_RENAME                   = 128 // { int rename(char *from, char *to); }
+	SYS_FLOCK                    = 131 // { int flock(int fd, int how); }
+	SYS_MKFIFO                   = 132 // { int mkfifo(char *path, int mode); }
+	SYS_SENDTO                   = 133 // { int sendto(int s, caddr_t buf, size_t len, int flags, caddr_t to, int tolen); }
+	SYS_SHUTDOWN                 = 134 // { int shutdown(int s, int how); }
+	SYS_SOCKETPAIR               = 135 // { int socketpair(int domain, int type, int protocol, int *rsv); }
+	SYS_MKDIR                    = 136 // { int mkdir(char *path, int mode); }
+	SYS_RMDIR                    = 137 // { int rmdir(char *path); }
+	SYS_UTIMES                   = 138 // { int utimes(char *path, struct timeval *tptr); }
+	SYS_ADJTIME                  = 140 // { int adjtime(struct timeval *delta, struct timeval *olddelta); }
+	SYS_SETSID                   = 147 // { int setsid(void); }
+	SYS_QUOTACTL                 = 148 // { int quotactl(char *path, int cmd, int uid, caddr_t arg); }
+	SYS_NLM_SYSCALL              = 154 // { int nlm_syscall(int debug_level, int grace_period, int addr_count, char **addrs); }
+	SYS_NFSSVC                   = 155 // { int nfssvc(int flag, caddr_t argp); }
+	SYS_LGETFH                   = 160 // { int lgetfh(char *fname, struct fhandle *fhp); }
+	SYS_GETFH                    = 161 // { int getfh(char *fname, struct fhandle *fhp); }
+	SYS_SYSARCH                  = 165 // { int sysarch(int op, char *parms); }
+	SYS_RTPRIO                   = 166 // { int rtprio(int function, pid_t pid, struct rtprio *rtp); }
+	SYS_SEMSYS                   = 169 // { int semsys(int which, int a2, int a3, int a4, int a5); }
+	SYS_MSGSYS                   = 170 // { int msgsys(int which, int a2, int a3, int a4, int a5, int a6); }
+	SYS_SHMSYS                   = 171 // { int shmsys(int which, int a2, int a3, int a4); }
+	SYS_SETFIB                   = 175 // { int setfib(int fibnum); }
+	SYS_NTP_ADJTIME              = 176 // { int ntp_adjtime(struct timex *tp); }
+	SYS_SETGID                   = 181 // { int setgid(gid_t gid); }
+	SYS_SETEGID                  = 182 // { int setegid(gid_t egid); }
+	SYS_SETEUID                  = 183 // { int seteuid(uid_t euid); }
+	SYS_PATHCONF                 = 191 // { int pathconf(char *path, int name); }
+	SYS_FPATHCONF                = 192 // { int fpathconf(int fd, int name); }
+	SYS_GETRLIMIT                = 194 // { int getrlimit(u_int which, struct rlimit *rlp); } getrlimit __getrlimit_args int
+	SYS_SETRLIMIT                = 195 // { int setrlimit(u_int which, struct rlimit *rlp); } setrlimit __setrlimit_args int
+	SYS___SYSCTL                 = 202 // { int __sysctl(int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); } __sysctl sysctl_args int
+	SYS_MLOCK                    = 203 // { int mlock(const void *addr, size_t len); }
+	SYS_MUNLOCK                  = 204 // { int munlock(const void *addr, size_t len); }
+	SYS_UNDELETE                 = 205 // { int undelete(char *path); }
+	SYS_FUTIMES                  = 206 // { int futimes(int fd, struct timeval *tptr); }
+	SYS_GETPGID                  = 207 // { int getpgid(pid_t pid); }
+	SYS_POLL                     = 209 // { int poll(struct pollfd *fds, u_int nfds, int timeout); }
+	SYS_SEMGET                   = 221 // { int semget(key_t key, int nsems, int semflg); }
+	SYS_SEMOP                    = 222 // { int semop(int semid, struct sembuf *sops, size_t nsops); }
+	SYS_MSGGET                   = 225 // { int msgget(key_t key, int msgflg); }
+	SYS_MSGSND                   = 226 // { int msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
+	SYS_MSGRCV                   = 227 // { ssize_t msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_SHMAT                    = 228 // { int shmat(int shmid, const void *shmaddr, int shmflg); }
+	SYS_SHMDT                    = 230 // { int shmdt(const void *shmaddr); }
+	SYS_SHMGET                   = 231 // { int shmget(key_t key, size_t size, int shmflg); }
+	SYS_CLOCK_GETTIME            = 232 // { int clock_gettime(clockid_t clock_id, struct timespec *tp); }
+	SYS_CLOCK_SETTIME            = 233 // { int clock_settime(clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_GETRES             = 234 // { int clock_getres(clockid_t clock_id, struct timespec *tp); }
+	SYS_KTIMER_CREATE            = 235 // { int ktimer_create(clockid_t clock_id, struct sigevent *evp, int *timerid); }
+	SYS_KTIMER_DELETE            = 236 // { int ktimer_delete(int timerid); }
+	SYS_KTIMER_SETTIME           = 237 // { int ktimer_settime(int timerid, int flags, const struct itimerspec *value, struct itimerspec *ovalue); }
+	SYS_KTIMER_GETTIME           = 238 // { int ktimer_gettime(int timerid, struct itimerspec *value); }
+	SYS_KTIMER_GETOVERRUN        = 239 // { int ktimer_getoverrun(int timerid); }
+	SYS_NANOSLEEP                = 240 // { int nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
+	SYS_FFCLOCK_GETCOUNTER       = 241 // { int ffclock_getcounter(ffcounter *ffcount); }
+	SYS_FFCLOCK_SETESTIMATE      = 242 // { int ffclock_setestimate(struct ffclock_estimate *cest); }
+	SYS_FFCLOCK_GETESTIMATE      = 243 // { int ffclock_getestimate(struct ffclock_estimate *cest); }
+	SYS_CLOCK_NANOSLEEP          = 244 // { int clock_nanosleep(clockid_t clock_id, int flags, const struct timespec *rqtp, struct timespec *rmtp); }
+	SYS_CLOCK_GETCPUCLOCKID2     = 247 // { int clock_getcpuclockid2(id_t id, int which, clockid_t *clock_id); }
+	SYS_NTP_GETTIME              = 248 // { int ntp_gettime(struct ntptimeval *ntvp); }
+	SYS_MINHERIT                 = 250 // { int minherit(void *addr, size_t len, int inherit); }
+	SYS_RFORK                    = 251 // { int rfork(int flags); }
+	SYS_ISSETUGID                = 253 // { int issetugid(void); }
+	SYS_LCHOWN                   = 254 // { int lchown(char *path, int uid, int gid); }
+	SYS_AIO_READ                 = 255 // { int aio_read(struct aiocb *aiocbp); }
+	SYS_AIO_WRITE                = 256 // { int aio_write(struct aiocb *aiocbp); }
+	SYS_LIO_LISTIO               = 257 // { int lio_listio(int mode, struct aiocb* const *acb_list, int nent, struct sigevent *sig); }
+	SYS_LCHMOD                   = 274 // { int lchmod(char *path, mode_t mode); }
+	SYS_LUTIMES                  = 276 // { int lutimes(char *path, struct timeval *tptr); }
+	SYS_PREADV                   = 289 // { ssize_t preadv(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
+	SYS_PWRITEV                  = 290 // { ssize_t pwritev(int fd, struct iovec *iovp, u_int iovcnt, off_t offset); }
+	SYS_FHOPEN                   = 298 // { int fhopen(const struct fhandle *u_fhp, int flags); }
+	SYS_MODNEXT                  = 300 // { int modnext(int modid); }
+	SYS_MODSTAT                  = 301 // { int modstat(int modid, struct module_stat* stat); }
+	SYS_MODFNEXT                 = 302 // { int modfnext(int modid); }
+	SYS_MODFIND                  = 303 // { int modfind(const char *name); }
+	SYS_KLDLOAD                  = 304 // { int kldload(const char *file); }
+	SYS_KLDUNLOAD                = 305 // { int kldunload(int fileid); }
+	SYS_KLDFIND                  = 306 // { int kldfind(const char *file); }
+	SYS_KLDNEXT                  = 307 // { int kldnext(int fileid); }
+	SYS_KLDSTAT                  = 308 // { int kldstat(int fileid, struct kld_file_stat *stat); }
+	SYS_KLDFIRSTMOD              = 309 // { int kldfirstmod(int fileid); }
+	SYS_GETSID                   = 310 // { int getsid(pid_t pid); }
+	SYS_SETRESUID                = 311 // { int setresuid(uid_t ruid, uid_t euid, uid_t suid); }
+	SYS_SETRESGID                = 312 // { int setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
+	SYS_AIO_RETURN               = 314 // { ssize_t aio_return(struct aiocb *aiocbp); }
+	SYS_AIO_SUSPEND              = 315 // { int aio_suspend(struct aiocb * const * aiocbp, int nent, const struct timespec *timeout); }
+	SYS_AIO_CANCEL               = 316 // { int aio_cancel(int fd, struct aiocb *aiocbp); }
+	SYS_AIO_ERROR                = 317 // { int aio_error(struct aiocb *aiocbp); }
+	SYS_YIELD                    = 321 // { int yield(void); }
+	SYS_MLOCKALL                 = 324 // { int mlockall(int how); }
+	SYS_MUNLOCKALL               = 325 // { int munlockall(void); }
+	SYS___GETCWD                 = 326 // { int __getcwd(char *buf, size_t buflen); }
+	SYS_SCHED_SETPARAM           = 327 // { int sched_setparam (pid_t pid, const struct sched_param *param); }
+	SYS_SCHED_GETPARAM           = 328 // { int sched_getparam (pid_t pid, struct sched_param *param); }
+	SYS_SCHED_SETSCHEDULER       = 329 // { int sched_setscheduler (pid_t pid, int policy, const struct sched_param *param); }
+	SYS_SCHED_GETSCHEDULER       = 330 // { int sched_getscheduler (pid_t pid); }
+	SYS_SCHED_YIELD              = 331 // { int sched_yield (void); }
+	SYS_SCHED_GET_PRIORITY_MAX   = 332 // { int sched_get_priority_max (int policy); }
+	SYS_SCHED_GET_PRIORITY_MIN   = 333 // { int sched_get_priority_min (int policy); }
+	SYS_SCHED_RR_GET_INTERVAL    = 334 // { int sched_rr_get_interval (pid_t pid, struct timespec *interval); }
+	SYS_UTRACE                   = 335 // { int utrace(const void *addr, size_t len); }
+	SYS_KLDSYM                   = 337 // { int kldsym(int fileid, int cmd, void *data); }
+	SYS_JAIL                     = 338 // { int jail(struct jail *jail); }
+	SYS_SIGPROCMASK              = 340 // { int sigprocmask(int how, const sigset_t *set, sigset_t *oset); }
+	SYS_SIGSUSPEND               = 341 // { int sigsuspend(const sigset_t *sigmask); }
+	SYS_SIGPENDING               = 343 // { int sigpending(sigset_t *set); }
+	SYS_SIGTIMEDWAIT             = 345 // { int sigtimedwait(const sigset_t *set, siginfo_t *info, const struct timespec *timeout); }
+	SYS_SIGWAITINFO              = 346 // { int sigwaitinfo(const sigset_t *set, siginfo_t *info); }
+	SYS___ACL_GET_FILE           = 347 // { int __acl_get_file(const char *path, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_SET_FILE           = 348 // { int __acl_set_file(const char *path, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_GET_FD             = 349 // { int __acl_get_fd(int filedes, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_SET_FD             = 350 // { int __acl_set_fd(int filedes, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_DELETE_FILE        = 351 // { int __acl_delete_file(const char *path, acl_type_t type); }
+	SYS___ACL_DELETE_FD          = 352 // { int __acl_delete_fd(int filedes, acl_type_t type); }
+	SYS___ACL_ACLCHECK_FILE      = 353 // { int __acl_aclcheck_file(const char *path, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_ACLCHECK_FD        = 354 // { int __acl_aclcheck_fd(int filedes, acl_type_t type, struct acl *aclp); }
+	SYS_EXTATTRCTL               = 355 // { int extattrctl(const char *path, int cmd, const char *filename, int attrnamespace, const char *attrname); }
+	SYS_EXTATTR_SET_FILE         = 356 // { ssize_t extattr_set_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_FILE         = 357 // { ssize_t extattr_get_file(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_FILE      = 358 // { int extattr_delete_file(const char *path, int attrnamespace, const char *attrname); }
+	SYS_AIO_WAITCOMPLETE         = 359 // { ssize_t aio_waitcomplete(struct aiocb **aiocbp, struct timespec *timeout); }
+	SYS_GETRESUID                = 360 // { int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
+	SYS_GETRESGID                = 361 // { int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
+	SYS_KQUEUE                   = 362 // { int kqueue(void); }
+	SYS_EXTATTR_SET_FD           = 371 // { ssize_t extattr_set_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_FD           = 372 // { ssize_t extattr_get_fd(int fd, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_FD        = 373 // { int extattr_delete_fd(int fd, int attrnamespace, const char *attrname); }
+	SYS___SETUGID                = 374 // { int __setugid(int flag); }
+	SYS_EACCESS                  = 376 // { int eaccess(char *path, int amode); }
+	SYS_NMOUNT                   = 378 // { int nmount(struct iovec *iovp, unsigned int iovcnt, int flags); }
+	SYS___MAC_GET_PROC           = 384 // { int __mac_get_proc(struct mac *mac_p); }
+	SYS___MAC_SET_PROC           = 385 // { int __mac_set_proc(struct mac *mac_p); }
+	SYS___MAC_GET_FD             = 386 // { int __mac_get_fd(int fd, struct mac *mac_p); }
+	SYS___MAC_GET_FILE           = 387 // { int __mac_get_file(const char *path_p, struct mac *mac_p); }
+	SYS___MAC_SET_FD             = 388 // { int __mac_set_fd(int fd, struct mac *mac_p); }
+	SYS___MAC_SET_FILE           = 389 // { int __mac_set_file(const char *path_p, struct mac *mac_p); }
+	SYS_KENV                     = 390 // { int kenv(int what, const char *name, char *value, int len); }
+	SYS_LCHFLAGS                 = 391 // { int lchflags(const char *path, u_long flags); }
+	SYS_UUIDGEN                  = 392 // { int uuidgen(struct uuid *store, int count); }
+	SYS_SENDFILE                 = 393 // { int sendfile(int fd, int s, off_t offset, size_t nbytes, struct sf_hdtr *hdtr, off_t *sbytes, int flags); }
+	SYS_MAC_SYSCALL              = 394 // { int mac_syscall(const char *policy, int call, void *arg); }
+	SYS_KSEM_CLOSE               = 400 // { int ksem_close(semid_t id); }
+	SYS_KSEM_POST                = 401 // { int ksem_post(semid_t id); }
+	SYS_KSEM_WAIT                = 402 // { int ksem_wait(semid_t id); }
+	SYS_KSEM_TRYWAIT             = 403 // { int ksem_trywait(semid_t id); }
+	SYS_KSEM_INIT                = 404 // { int ksem_init(semid_t *idp, unsigned int value); }
+	SYS_KSEM_OPEN                = 405 // { int ksem_open(semid_t *idp, const char *name, int oflag, mode_t mode, unsigned int value); }
+	SYS_KSEM_UNLINK              = 406 // { int ksem_unlink(const char *name); }
+	SYS_KSEM_GETVALUE            = 407 // { int ksem_getvalue(semid_t id, int *val); }
+	SYS_KSEM_DESTROY             = 408 // { int ksem_destroy(semid_t id); }
+	SYS___MAC_GET_PID            = 409 // { int __mac_get_pid(pid_t pid, struct mac *mac_p); }
+	SYS___MAC_GET_LINK           = 410 // { int __mac_get_link(const char *path_p, struct mac *mac_p); }
+	SYS___MAC_SET_LINK           = 411 // { int __mac_set_link(const char *path_p, struct mac *mac_p); }
+	SYS_EXTATTR_SET_LINK         = 412 // { ssize_t extattr_set_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_GET_LINK         = 413 // { ssize_t extattr_get_link(const char *path, int attrnamespace, const char *attrname, void *data, size_t nbytes); }
+	SYS_EXTATTR_DELETE_LINK      = 414 // { int extattr_delete_link(const char *path, int attrnamespace, const char *attrname); }
+	SYS___MAC_EXECVE             = 415 // { int __mac_execve(char *fname, char **argv, char **envv, struct mac *mac_p); }
+	SYS_SIGACTION                = 416 // { int sigaction(int sig, const struct sigaction *act, struct sigaction *oact); }
+	SYS_SIGRETURN                = 417 // { int sigreturn(const struct __ucontext *sigcntxp); }
+	SYS_GETCONTEXT               = 421 // { int getcontext(struct __ucontext *ucp); }
+	SYS_SETCONTEXT               = 422 // { int setcontext(const struct __ucontext *ucp); }
+	SYS_SWAPCONTEXT              = 423 // { int swapcontext(struct __ucontext *oucp, const struct __ucontext *ucp); }
+	SYS_SWAPOFF                  = 424 // { int swapoff(const char *name); }
+	SYS___ACL_GET_LINK           = 425 // { int __acl_get_link(const char *path, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_SET_LINK           = 426 // { int __acl_set_link(const char *path, acl_type_t type, struct acl *aclp); }
+	SYS___ACL_DELETE_LINK        = 427 // { int __acl_delete_link(const char *path, acl_type_t type); }
+	SYS___ACL_ACLCHECK_LINK      = 428 // { int __acl_aclcheck_link(const char *path, acl_type_t type, struct acl *aclp); }
+	SYS_SIGWAIT                  = 429 // { int sigwait(const sigset_t *set, int *sig); }
+	SYS_THR_CREATE               = 430 // { int thr_create(ucontext_t *ctx, long *id, int flags); }
+	SYS_THR_EXIT                 = 431 // { void thr_exit(long *state); }
+	SYS_THR_SELF                 = 432 // { int thr_self(long *id); }
+	SYS_THR_KILL                 = 433 // { int thr_kill(long id, int sig); }
+	SYS_JAIL_ATTACH              = 436 // { int jail_attach(int jid); }
+	SYS_EXTATTR_LIST_FD          = 437 // { ssize_t extattr_list_fd(int fd, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_FILE        = 438 // { ssize_t extattr_list_file(const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_EXTATTR_LIST_LINK        = 439 // { ssize_t extattr_list_link(const char *path, int attrnamespace, void *data, size_t nbytes); }
+	SYS_KSEM_TIMEDWAIT           = 441 // { int ksem_timedwait(semid_t id, const struct timespec *abstime); }
+	SYS_THR_SUSPEND              = 442 // { int thr_suspend(const struct timespec *timeout); }
+	SYS_THR_WAKE                 = 443 // { int thr_wake(long id); }
+	SYS_KLDUNLOADF               = 444 // { int kldunloadf(int fileid, int flags); }
+	SYS_AUDIT                    = 445 // { int audit(const void *record, u_int length); }
+	SYS_AUDITON                  = 446 // { int auditon(int cmd, void *data, u_int length); }
+	SYS_GETAUID                  = 447 // { int getauid(uid_t *auid); }
+	SYS_SETAUID                  = 448 // { int setauid(uid_t *auid); }
+	SYS_GETAUDIT                 = 449 // { int getaudit(struct auditinfo *auditinfo); }
+	SYS_SETAUDIT                 = 450 // { int setaudit(struct auditinfo *auditinfo); }
+	SYS_GETAUDIT_ADDR            = 451 // { int getaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_SETAUDIT_ADDR            = 452 // { int setaudit_addr(struct auditinfo_addr *auditinfo_addr, u_int length); }
+	SYS_AUDITCTL                 = 453 // { int auditctl(char *path); }
+	SYS__UMTX_OP                 = 454 // { int _umtx_op(void *obj, int op, u_long val, void *uaddr1, void *uaddr2); }
+	SYS_THR_NEW                  = 455 // { int thr_new(struct thr_param *param, int param_size); }
+	SYS_SIGQUEUE                 = 456 // { int sigqueue(pid_t pid, int signum, void *value); }
+	SYS_KMQ_OPEN                 = 457 // { int kmq_open(const char *path, int flags, mode_t mode, const struct mq_attr *attr); }
+	SYS_KMQ_SETATTR              = 458 // { int kmq_setattr(int mqd, const struct mq_attr *attr, struct mq_attr *oattr); }
+	SYS_KMQ_TIMEDRECEIVE         = 459 // { int kmq_timedreceive(int mqd, char *msg_ptr, size_t msg_len, unsigned *msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_TIMEDSEND            = 460 // { int kmq_timedsend(int mqd, const char *msg_ptr, size_t msg_len, unsigned msg_prio, const struct timespec *abs_timeout); }
+	SYS_KMQ_NOTIFY               = 461 // { int kmq_notify(int mqd, const struct sigevent *sigev); }
+	SYS_KMQ_UNLINK               = 462 // { int kmq_unlink(const char *path); }
+	SYS_ABORT2                   = 463 // { int abort2(const char *why, int nargs, void **args); }
+	SYS_THR_SET_NAME             = 464 // { int thr_set_name(long id, const char *name); }
+	SYS_AIO_FSYNC                = 465 // { int aio_fsync(int op, struct aiocb *aiocbp); }
+	SYS_RTPRIO_THREAD            = 466 // { int rtprio_thread(int function, lwpid_t lwpid, struct rtprio *rtp); }
+	SYS_SCTP_PEELOFF             = 471 // { int sctp_peeloff(int sd, uint32_t name); }
+	SYS_SCTP_GENERIC_SENDMSG     = 472 // { int sctp_generic_sendmsg(int sd, caddr_t msg, int mlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
+	SYS_SCTP_GENERIC_SENDMSG_IOV = 473 // { int sctp_generic_sendmsg_iov(int sd, struct iovec *iov, int iovlen, caddr_t to, __socklen_t tolen, struct sctp_sndrcvinfo *sinfo, int flags); }
+	SYS_SCTP_GENERIC_RECVMSG     = 474 // { int sctp_generic_recvmsg(int sd, struct iovec *iov, int iovlen, struct sockaddr *from, __socklen_t *fromlenaddr, struct sctp_sndrcvinfo *sinfo, int *msg_flags); }
+	SYS_PREAD                    = 475 // { ssize_t pread(int fd, void *buf, size_t nbyte, off_t offset); }
+	SYS_PWRITE                   = 476 // { ssize_t pwrite(int fd, const void *buf, size_t nbyte, off_t offset); }
+	SYS_MMAP                     = 477 // { caddr_t mmap(caddr_t addr, size_t len, int prot, int flags, int fd, off_t pos); }
+	SYS_LSEEK                    = 478 // { off_t lseek(int fd, off_t offset, int whence); }
+	SYS_TRUNCATE                 = 479 // { int truncate(char *path, off_t length); }
+	SYS_FTRUNCATE                = 480 // { int ftruncate(int fd, off_t length); }
+	SYS_THR_KILL2                = 481 // { int thr_kill2(pid_t pid, long id, int sig); }
+	SYS_SHM_OPEN                 = 482 // { int shm_open(const char *path, int flags, mode_t mode); }
+	SYS_SHM_UNLINK               = 483 // { int shm_unlink(const char *path); }
+	SYS_CPUSET                   = 484 // { int cpuset(cpusetid_t *setid); }
+	SYS_CPUSET_SETID             = 485 // { int cpuset_setid(cpuwhich_t which, id_t id, cpusetid_t setid); }
+	SYS_CPUSET_GETID             = 486 // { int cpuset_getid(cpulevel_t level, cpuwhich_t which, id_t id, cpusetid_t *setid); }
+	SYS_CPUSET_GETAFFINITY       = 487 // { int cpuset_getaffinity(cpulevel_t level, cpuwhich_t which, id_t id, size_t cpusetsize, cpuset_t *mask); }
+	SYS_CPUSET_SETAFFINITY       = 488 // { int cpuset_setaffinity(cpulevel_t level, cpuwhich_t which, id_t id, size_t cpusetsize, const cpuset_t *mask); }
+	SYS_FACCESSAT                = 489 // { int faccessat(int fd, char *path, int amode, int flag); }
+	SYS_FCHMODAT                 = 490 // { int fchmodat(int fd, char *path, mode_t mode, int flag); }
+	SYS_FCHOWNAT                 = 491 // { int fchownat(int fd, char *path, uid_t uid, gid_t gid, int flag); }
+	SYS_FEXECVE                  = 492 // { int fexecve(int fd, char **argv, char **envv); }
+	SYS_FUTIMESAT                = 494 // { int futimesat(int fd, char *path, struct timeval *times); }
+	SYS_LINKAT                   = 495 // { int linkat(int fd1, char *path1, int fd2, char *path2, int flag); }
+	SYS_MKDIRAT                  = 496 // { int mkdirat(int fd, char *path, mode_t mode); }
+	SYS_MKFIFOAT                 = 497 // { int mkfifoat(int fd, char *path, mode_t mode); }
+	SYS_OPENAT                   = 499 // { int openat(int fd, char *path, int flag, mode_t mode); }
+	SYS_READLINKAT               = 500 // { ssize_t readlinkat(int fd, char *path, char *buf, size_t bufsize); }
+	SYS_RENAMEAT                 = 501 // { int renameat(int oldfd, char *old, int newfd, char *new); }
+	SYS_SYMLINKAT                = 502 // { int symlinkat(char *path1, int fd, char *path2); }
+	SYS_UNLINKAT                 = 503 // { int unlinkat(int fd, char *path, int flag); }
+	SYS_POSIX_OPENPT             = 504 // { int posix_openpt(int flags); }
+	SYS_GSSD_SYSCALL             = 505 // { int gssd_syscall(char *path); }
+	SYS_JAIL_GET                 = 506 // { int jail_get(struct iovec *iovp, unsigned int iovcnt, int flags); }
+	SYS_JAIL_SET                 = 507 // { int jail_set(struct iovec *iovp, unsigned int iovcnt, int flags); }
+	SYS_JAIL_REMOVE              = 508 // { int jail_remove(int jid); }
+	SYS_CLOSEFROM                = 509 // { int closefrom(int lowfd); }
+	SYS___SEMCTL                 = 510 // { int __semctl(int semid, int semnum, int cmd, union semun *arg); }
+	SYS_MSGCTL                   = 511 // { int msgctl(int msqid, int cmd, struct msqid_ds *buf); }
+	SYS_SHMCTL                   = 512 // { int shmctl(int shmid, int cmd, struct shmid_ds *buf); }
+	SYS_LPATHCONF                = 513 // { int lpathconf(char *path, int name); }
+	SYS___CAP_RIGHTS_GET         = 515 // { int __cap_rights_get(int version, int fd, cap_rights_t *rightsp); }
+	SYS_CAP_ENTER                = 516 // { int cap_enter(void); }
+	SYS_CAP_GETMODE              = 517 // { int cap_getmode(u_int *modep); }
+	SYS_PDFORK                   = 518 // { int pdfork(int *fdp, int flags); }
+	SYS_PDKILL                   = 519 // { int pdkill(int fd, int signum); }
+	SYS_PDGETPID                 = 520 // { int pdgetpid(int fd, pid_t *pidp); }
+	SYS_PSELECT                  = 522 // { int pselect(int nd, fd_set *in, fd_set *ou, fd_set *ex, const struct timespec *ts, const sigset_t *sm); }
+	SYS_GETLOGINCLASS            = 523 // { int getloginclass(char *namebuf, size_t namelen); }
+	SYS_SETLOGINCLASS            = 524 // { int setloginclass(const char *namebuf); }
+	SYS_RCTL_GET_RACCT           = 525 // { int rctl_get_racct(const void *inbufp, size_t inbuflen, void *outbufp, size_t outbuflen); }
+	SYS_RCTL_GET_RULES           = 526 // { int rctl_get_rules(const void *inbufp, size_t inbuflen, void *outbufp, size_t outbuflen); }
+	SYS_RCTL_GET_LIMITS          = 527 // { int rctl_get_limits(const void *inbufp, size_t inbuflen, void *outbufp, size_t outbuflen); }
+	SYS_RCTL_ADD_RULE            = 528 // { int rctl_add_rule(const void *inbufp, size_t inbuflen, void *outbufp, size_t outbuflen); }
+	SYS_RCTL_REMOVE_RULE         = 529 // { int rctl_remove_rule(const void *inbufp, size_t inbuflen, void *outbufp, size_t outbuflen); }
+	SYS_POSIX_FALLOCATE          = 530 // { int posix_fallocate(int fd, off_t offset, off_t len); }
+	SYS_POSIX_FADVISE            = 531 // { int posix_fadvise(int fd, off_t offset, off_t len, int advice); }
+	SYS_WAIT6                    = 532 // { int wait6(idtype_t idtype, id_t id, int *status, int options, struct __wrusage *wrusage, siginfo_t *info); }
+	SYS_CAP_RIGHTS_LIMIT         = 533 // { int cap_rights_limit(int fd, cap_rights_t *rightsp); }
+	SYS_CAP_IOCTLS_LIMIT         = 534 // { int cap_ioctls_limit(int fd, const u_long *cmds, size_t ncmds); }
+	SYS_CAP_IOCTLS_GET           = 535 // { ssize_t cap_ioctls_get(int fd, u_long *cmds, size_t maxcmds); }
+	SYS_CAP_FCNTLS_LIMIT         = 536 // { int cap_fcntls_limit(int fd, uint32_t fcntlrights); }
+	SYS_CAP_FCNTLS_GET           = 537 // { int cap_fcntls_get(int fd, uint32_t *fcntlrightsp); }
+	SYS_BINDAT                   = 538 // { int bindat(int fd, int s, caddr_t name, int namelen); }
+	SYS_CONNECTAT                = 539 // { int connectat(int fd, int s, caddr_t name, int namelen); }
+	SYS_CHFLAGSAT                = 540 // { int chflagsat(int fd, const char *path, u_long flags, int atflag); }
+	SYS_ACCEPT4                  = 541 // { int accept4(int s, struct sockaddr * __restrict name, __socklen_t * __restrict anamelen, int flags); }
+	SYS_PIPE2                    = 542 // { int pipe2(int *fildes, int flags); }
+	SYS_AIO_MLOCK                = 543 // { int aio_mlock(struct aiocb *aiocbp); }
+	SYS_PROCCTL                  = 544 // { int procctl(idtype_t idtype, id_t id, int com, void *data); }
+	SYS_PPOLL                    = 545 // { int ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *set); }
+	SYS_FUTIMENS                 = 546 // { int futimens(int fd, struct timespec *times); }
+	SYS_UTIMENSAT                = 547 // { int utimensat(int fd, char *path, struct timespec *times, int flag); }
+	SYS_FDATASYNC                = 550 // { int fdatasync(int fd); }
+	SYS_FSTAT                    = 551 // { int fstat(int fd, struct stat *sb); }
+	SYS_FSTATAT                  = 552 // { int fstatat(int fd, char *path, struct stat *buf, int flag); }
+	SYS_FHSTAT                   = 553 // { int fhstat(const struct fhandle *u_fhp, struct stat *sb); }
+	SYS_GETDIRENTRIES            = 554 // { ssize_t getdirentries(int fd, char *buf, size_t count, off_t *basep); }
+	SYS_STATFS                   = 555 // { int statfs(char *path, struct statfs *buf); }
+	SYS_FSTATFS                  = 556 // { int fstatfs(int fd, struct statfs *buf); }
+	SYS_GETFSSTAT                = 557 // { int getfsstat(struct statfs *buf, long bufsize, int mode); }
+	SYS_FHSTATFS                 = 558 // { int fhstatfs(const struct fhandle *u_fhp, struct statfs *buf); }
+	SYS_MKNODAT                  = 559 // { int mknodat(int fd, char *path, mode_t mode, dev_t dev); }
+	SYS_KEVENT                   = 560 // { int kevent(int fd, struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_CPUSET_GETDOMAIN         = 561 // { int cpuset_getdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int *policy); }
+	SYS_CPUSET_SETDOMAIN         = 562 // { int cpuset_setdomain(cpulevel_t level, cpuwhich_t which, id_t id, size_t domainsetsize, domainset_t *mask, int policy); }
+	SYS_GETRANDOM                = 563 // { int getrandom(void *buf, size_t buflen, unsigned int flags); }
+	SYS_GETFHAT                  = 564 // { int getfhat(int fd, char *path, struct fhandle *fhp, int flags); }
+	SYS_FHLINK                   = 565 // { int fhlink(struct fhandle *fhp, const char *to); }
+	SYS_FHLINKAT                 = 566 // { int fhlinkat(struct fhandle *fhp, int tofd, const char *to,); }
+	SYS_FHREADLINK               = 567 // { int fhreadlink(struct fhandle *fhp, char *buf, size_t bufsize); }
+	SYS___SYSCTLBYNAME           = 570 // { int __sysctlbyname(const char *name, size_t namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_CLOSE_RANGE              = 575 // { int close_range(u_int lowfd, u_int highfd, int flags); }
+)
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
index 31847d2305..c9c4ad0314 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include -m32 /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/386/include -m32 /tmp/386/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build 386 && linux
@@ -445,4 +445,6 @@ const (
 	SYS_LANDLOCK_RESTRICT_SELF       = 446
 	SYS_MEMFD_SECRET                 = 447
 	SYS_PROCESS_MRELEASE             = 448
+	SYS_FUTEX_WAITV                  = 449
+	SYS_SET_MEMPOLICY_HOME_NODE      = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
index 3503cbbde3..12ff3417c5 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include -m64 /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/amd64/include -m64 /tmp/amd64/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build amd64 && linux
@@ -367,4 +367,6 @@ const (
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
 	SYS_MEMFD_SECRET            = 447
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
index 5ecd24bf68..c3fb5e77ab 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/arm/include /tmp/arm/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm && linux
@@ -409,4 +409,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE            = 445
 	SYS_LANDLOCK_RESTRICT_SELF       = 446
 	SYS_PROCESS_MRELEASE             = 448
+	SYS_FUTEX_WAITV                  = 449
+	SYS_SET_MEMPOLICY_HOME_NODE      = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
index 7e5c94cc7f..358c847a40 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include -fsigned-char /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/arm64/include -fsigned-char /tmp/arm64/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm64 && linux
@@ -312,4 +312,6 @@ const (
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
 	SYS_MEMFD_SECRET            = 447
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
new file mode 100644
index 0000000000..81c4849b16
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
@@ -0,0 +1,311 @@
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/loong64/include /tmp/loong64/include/asm/unistd.h
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build loong64 && linux
+// +build loong64,linux
+
+package unix
+
+const (
+	SYS_IO_SETUP                = 0
+	SYS_IO_DESTROY              = 1
+	SYS_IO_SUBMIT               = 2
+	SYS_IO_CANCEL               = 3
+	SYS_IO_GETEVENTS            = 4
+	SYS_SETXATTR                = 5
+	SYS_LSETXATTR               = 6
+	SYS_FSETXATTR               = 7
+	SYS_GETXATTR                = 8
+	SYS_LGETXATTR               = 9
+	SYS_FGETXATTR               = 10
+	SYS_LISTXATTR               = 11
+	SYS_LLISTXATTR              = 12
+	SYS_FLISTXATTR              = 13
+	SYS_REMOVEXATTR             = 14
+	SYS_LREMOVEXATTR            = 15
+	SYS_FREMOVEXATTR            = 16
+	SYS_GETCWD                  = 17
+	SYS_LOOKUP_DCOOKIE          = 18
+	SYS_EVENTFD2                = 19
+	SYS_EPOLL_CREATE1           = 20
+	SYS_EPOLL_CTL               = 21
+	SYS_EPOLL_PWAIT             = 22
+	SYS_DUP                     = 23
+	SYS_DUP3                    = 24
+	SYS_FCNTL                   = 25
+	SYS_INOTIFY_INIT1           = 26
+	SYS_INOTIFY_ADD_WATCH       = 27
+	SYS_INOTIFY_RM_WATCH        = 28
+	SYS_IOCTL                   = 29
+	SYS_IOPRIO_SET              = 30
+	SYS_IOPRIO_GET              = 31
+	SYS_FLOCK                   = 32
+	SYS_MKNODAT                 = 33
+	SYS_MKDIRAT                 = 34
+	SYS_UNLINKAT                = 35
+	SYS_SYMLINKAT               = 36
+	SYS_LINKAT                  = 37
+	SYS_UMOUNT2                 = 39
+	SYS_MOUNT                   = 40
+	SYS_PIVOT_ROOT              = 41
+	SYS_NFSSERVCTL              = 42
+	SYS_STATFS                  = 43
+	SYS_FSTATFS                 = 44
+	SYS_TRUNCATE                = 45
+	SYS_FTRUNCATE               = 46
+	SYS_FALLOCATE               = 47
+	SYS_FACCESSAT               = 48
+	SYS_CHDIR                   = 49
+	SYS_FCHDIR                  = 50
+	SYS_CHROOT                  = 51
+	SYS_FCHMOD                  = 52
+	SYS_FCHMODAT                = 53
+	SYS_FCHOWNAT                = 54
+	SYS_FCHOWN                  = 55
+	SYS_OPENAT                  = 56
+	SYS_CLOSE                   = 57
+	SYS_VHANGUP                 = 58
+	SYS_PIPE2                   = 59
+	SYS_QUOTACTL                = 60
+	SYS_GETDENTS64              = 61
+	SYS_LSEEK                   = 62
+	SYS_READ                    = 63
+	SYS_WRITE                   = 64
+	SYS_READV                   = 65
+	SYS_WRITEV                  = 66
+	SYS_PREAD64                 = 67
+	SYS_PWRITE64                = 68
+	SYS_PREADV                  = 69
+	SYS_PWRITEV                 = 70
+	SYS_SENDFILE                = 71
+	SYS_PSELECT6                = 72
+	SYS_PPOLL                   = 73
+	SYS_SIGNALFD4               = 74
+	SYS_VMSPLICE                = 75
+	SYS_SPLICE                  = 76
+	SYS_TEE                     = 77
+	SYS_READLINKAT              = 78
+	SYS_SYNC                    = 81
+	SYS_FSYNC                   = 82
+	SYS_FDATASYNC               = 83
+	SYS_SYNC_FILE_RANGE         = 84
+	SYS_TIMERFD_CREATE          = 85
+	SYS_TIMERFD_SETTIME         = 86
+	SYS_TIMERFD_GETTIME         = 87
+	SYS_UTIMENSAT               = 88
+	SYS_ACCT                    = 89
+	SYS_CAPGET                  = 90
+	SYS_CAPSET                  = 91
+	SYS_PERSONALITY             = 92
+	SYS_EXIT                    = 93
+	SYS_EXIT_GROUP              = 94
+	SYS_WAITID                  = 95
+	SYS_SET_TID_ADDRESS         = 96
+	SYS_UNSHARE                 = 97
+	SYS_FUTEX                   = 98
+	SYS_SET_ROBUST_LIST         = 99
+	SYS_GET_ROBUST_LIST         = 100
+	SYS_NANOSLEEP               = 101
+	SYS_GETITIMER               = 102
+	SYS_SETITIMER               = 103
+	SYS_KEXEC_LOAD              = 104
+	SYS_INIT_MODULE             = 105
+	SYS_DELETE_MODULE           = 106
+	SYS_TIMER_CREATE            = 107
+	SYS_TIMER_GETTIME           = 108
+	SYS_TIMER_GETOVERRUN        = 109
+	SYS_TIMER_SETTIME           = 110
+	SYS_TIMER_DELETE            = 111
+	SYS_CLOCK_SETTIME           = 112
+	SYS_CLOCK_GETTIME           = 113
+	SYS_CLOCK_GETRES            = 114
+	SYS_CLOCK_NANOSLEEP         = 115
+	SYS_SYSLOG                  = 116
+	SYS_PTRACE                  = 117
+	SYS_SCHED_SETPARAM          = 118
+	SYS_SCHED_SETSCHEDULER      = 119
+	SYS_SCHED_GETSCHEDULER      = 120
+	SYS_SCHED_GETPARAM          = 121
+	SYS_SCHED_SETAFFINITY       = 122
+	SYS_SCHED_GETAFFINITY       = 123
+	SYS_SCHED_YIELD             = 124
+	SYS_SCHED_GET_PRIORITY_MAX  = 125
+	SYS_SCHED_GET_PRIORITY_MIN  = 126
+	SYS_SCHED_RR_GET_INTERVAL   = 127
+	SYS_RESTART_SYSCALL         = 128
+	SYS_KILL                    = 129
+	SYS_TKILL                   = 130
+	SYS_TGKILL                  = 131
+	SYS_SIGALTSTACK             = 132
+	SYS_RT_SIGSUSPEND           = 133
+	SYS_RT_SIGACTION            = 134
+	SYS_RT_SIGPROCMASK          = 135
+	SYS_RT_SIGPENDING           = 136
+	SYS_RT_SIGTIMEDWAIT         = 137
+	SYS_RT_SIGQUEUEINFO         = 138
+	SYS_RT_SIGRETURN            = 139
+	SYS_SETPRIORITY             = 140
+	SYS_GETPRIORITY             = 141
+	SYS_REBOOT                  = 142
+	SYS_SETREGID                = 143
+	SYS_SETGID                  = 144
+	SYS_SETREUID                = 145
+	SYS_SETUID                  = 146
+	SYS_SETRESUID               = 147
+	SYS_GETRESUID               = 148
+	SYS_SETRESGID               = 149
+	SYS_GETRESGID               = 150
+	SYS_SETFSUID                = 151
+	SYS_SETFSGID                = 152
+	SYS_TIMES                   = 153
+	SYS_SETPGID                 = 154
+	SYS_GETPGID                 = 155
+	SYS_GETSID                  = 156
+	SYS_SETSID                  = 157
+	SYS_GETGROUPS               = 158
+	SYS_SETGROUPS               = 159
+	SYS_UNAME                   = 160
+	SYS_SETHOSTNAME             = 161
+	SYS_SETDOMAINNAME           = 162
+	SYS_GETRUSAGE               = 165
+	SYS_UMASK                   = 166
+	SYS_PRCTL                   = 167
+	SYS_GETCPU                  = 168
+	SYS_GETTIMEOFDAY            = 169
+	SYS_SETTIMEOFDAY            = 170
+	SYS_ADJTIMEX                = 171
+	SYS_GETPID                  = 172
+	SYS_GETPPID                 = 173
+	SYS_GETUID                  = 174
+	SYS_GETEUID                 = 175
+	SYS_GETGID                  = 176
+	SYS_GETEGID                 = 177
+	SYS_GETTID                  = 178
+	SYS_SYSINFO                 = 179
+	SYS_MQ_OPEN                 = 180
+	SYS_MQ_UNLINK               = 181
+	SYS_MQ_TIMEDSEND            = 182
+	SYS_MQ_TIMEDRECEIVE         = 183
+	SYS_MQ_NOTIFY               = 184
+	SYS_MQ_GETSETATTR           = 185
+	SYS_MSGGET                  = 186
+	SYS_MSGCTL                  = 187
+	SYS_MSGRCV                  = 188
+	SYS_MSGSND                  = 189
+	SYS_SEMGET                  = 190
+	SYS_SEMCTL                  = 191
+	SYS_SEMTIMEDOP              = 192
+	SYS_SEMOP                   = 193
+	SYS_SHMGET                  = 194
+	SYS_SHMCTL                  = 195
+	SYS_SHMAT                   = 196
+	SYS_SHMDT                   = 197
+	SYS_SOCKET                  = 198
+	SYS_SOCKETPAIR              = 199
+	SYS_BIND                    = 200
+	SYS_LISTEN                  = 201
+	SYS_ACCEPT                  = 202
+	SYS_CONNECT                 = 203
+	SYS_GETSOCKNAME             = 204
+	SYS_GETPEERNAME             = 205
+	SYS_SENDTO                  = 206
+	SYS_RECVFROM                = 207
+	SYS_SETSOCKOPT              = 208
+	SYS_GETSOCKOPT              = 209
+	SYS_SHUTDOWN                = 210
+	SYS_SENDMSG                 = 211
+	SYS_RECVMSG                 = 212
+	SYS_READAHEAD               = 213
+	SYS_BRK                     = 214
+	SYS_MUNMAP                  = 215
+	SYS_MREMAP                  = 216
+	SYS_ADD_KEY                 = 217
+	SYS_REQUEST_KEY             = 218
+	SYS_KEYCTL                  = 219
+	SYS_CLONE                   = 220
+	SYS_EXECVE                  = 221
+	SYS_MMAP                    = 222
+	SYS_FADVISE64               = 223
+	SYS_SWAPON                  = 224
+	SYS_SWAPOFF                 = 225
+	SYS_MPROTECT                = 226
+	SYS_MSYNC                   = 227
+	SYS_MLOCK                   = 228
+	SYS_MUNLOCK                 = 229
+	SYS_MLOCKALL                = 230
+	SYS_MUNLOCKALL              = 231
+	SYS_MINCORE                 = 232
+	SYS_MADVISE                 = 233
+	SYS_REMAP_FILE_PAGES        = 234
+	SYS_MBIND                   = 235
+	SYS_GET_MEMPOLICY           = 236
+	SYS_SET_MEMPOLICY           = 237
+	SYS_MIGRATE_PAGES           = 238
+	SYS_MOVE_PAGES              = 239
+	SYS_RT_TGSIGQUEUEINFO       = 240
+	SYS_PERF_EVENT_OPEN         = 241
+	SYS_ACCEPT4                 = 242
+	SYS_RECVMMSG                = 243
+	SYS_ARCH_SPECIFIC_SYSCALL   = 244
+	SYS_WAIT4                   = 260
+	SYS_PRLIMIT64               = 261
+	SYS_FANOTIFY_INIT           = 262
+	SYS_FANOTIFY_MARK           = 263
+	SYS_NAME_TO_HANDLE_AT       = 264
+	SYS_OPEN_BY_HANDLE_AT       = 265
+	SYS_CLOCK_ADJTIME           = 266
+	SYS_SYNCFS                  = 267
+	SYS_SETNS                   = 268
+	SYS_SENDMMSG                = 269
+	SYS_PROCESS_VM_READV        = 270
+	SYS_PROCESS_VM_WRITEV       = 271
+	SYS_KCMP                    = 272
+	SYS_FINIT_MODULE            = 273
+	SYS_SCHED_SETATTR           = 274
+	SYS_SCHED_GETATTR           = 275
+	SYS_RENAMEAT2               = 276
+	SYS_SECCOMP                 = 277
+	SYS_GETRANDOM               = 278
+	SYS_MEMFD_CREATE            = 279
+	SYS_BPF                     = 280
+	SYS_EXECVEAT                = 281
+	SYS_USERFAULTFD             = 282
+	SYS_MEMBARRIER              = 283
+	SYS_MLOCK2                  = 284
+	SYS_COPY_FILE_RANGE         = 285
+	SYS_PREADV2                 = 286
+	SYS_PWRITEV2                = 287
+	SYS_PKEY_MPROTECT           = 288
+	SYS_PKEY_ALLOC              = 289
+	SYS_PKEY_FREE               = 290
+	SYS_STATX                   = 291
+	SYS_IO_PGETEVENTS           = 292
+	SYS_RSEQ                    = 293
+	SYS_KEXEC_FILE_LOAD         = 294
+	SYS_PIDFD_SEND_SIGNAL       = 424
+	SYS_IO_URING_SETUP          = 425
+	SYS_IO_URING_ENTER          = 426
+	SYS_IO_URING_REGISTER       = 427
+	SYS_OPEN_TREE               = 428
+	SYS_MOVE_MOUNT              = 429
+	SYS_FSOPEN                  = 430
+	SYS_FSCONFIG                = 431
+	SYS_FSMOUNT                 = 432
+	SYS_FSPICK                  = 433
+	SYS_PIDFD_OPEN              = 434
+	SYS_CLONE3                  = 435
+	SYS_CLOSE_RANGE             = 436
+	SYS_OPENAT2                 = 437
+	SYS_PIDFD_GETFD             = 438
+	SYS_FACCESSAT2              = 439
+	SYS_PROCESS_MADVISE         = 440
+	SYS_EPOLL_PWAIT2            = 441
+	SYS_MOUNT_SETATTR           = 442
+	SYS_QUOTACTL_FD             = 443
+	SYS_LANDLOCK_CREATE_RULESET = 444
+	SYS_LANDLOCK_ADD_RULE       = 445
+	SYS_LANDLOCK_RESTRICT_SELF  = 446
+	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
+)
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
index e1e2a2bf59..202a57e900 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/mips/include /tmp/mips/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips && linux
@@ -429,4 +429,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE            = 4445
 	SYS_LANDLOCK_RESTRICT_SELF       = 4446
 	SYS_PROCESS_MRELEASE             = 4448
+	SYS_FUTEX_WAITV                  = 4449
+	SYS_SET_MEMPOLICY_HOME_NODE      = 4450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
index 7651915a3a..1fbceb52d7 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/mips64/include /tmp/mips64/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips64 && linux
@@ -359,4 +359,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE       = 5445
 	SYS_LANDLOCK_RESTRICT_SELF  = 5446
 	SYS_PROCESS_MRELEASE        = 5448
+	SYS_FUTEX_WAITV             = 5449
+	SYS_SET_MEMPOLICY_HOME_NODE = 5450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
index a26a2c050b..b4ffb7a207 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/mips64le/include /tmp/mips64le/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips64le && linux
@@ -359,4 +359,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE       = 5445
 	SYS_LANDLOCK_RESTRICT_SELF  = 5446
 	SYS_PROCESS_MRELEASE        = 5448
+	SYS_FUTEX_WAITV             = 5449
+	SYS_SET_MEMPOLICY_HOME_NODE = 5450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
index fda9a6a991..867985f9b4 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/mipsle/include /tmp/mipsle/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mipsle && linux
@@ -429,4 +429,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE            = 4445
 	SYS_LANDLOCK_RESTRICT_SELF       = 4446
 	SYS_PROCESS_MRELEASE             = 4448
+	SYS_FUTEX_WAITV                  = 4449
+	SYS_SET_MEMPOLICY_HOME_NODE      = 4450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
index e8496150d4..a8cce69ede 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/ppc/include /tmp/ppc/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc && linux
@@ -436,4 +436,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE            = 445
 	SYS_LANDLOCK_RESTRICT_SELF       = 446
 	SYS_PROCESS_MRELEASE             = 448
+	SYS_FUTEX_WAITV                  = 449
+	SYS_SET_MEMPOLICY_HOME_NODE      = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
index 5ee0678a36..d44c5b39d7 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/ppc64/include /tmp/ppc64/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc64 && linux
@@ -408,4 +408,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE       = 445
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
index 29c0f9a39e..4214dd9c03 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/ppc64le/include /tmp/ppc64le/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc64le && linux
@@ -408,4 +408,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE       = 445
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
index 5c9a9a3b61..3e594a8c09 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/riscv64/include /tmp/riscv64/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build riscv64 && linux
@@ -309,5 +309,8 @@ const (
 	SYS_LANDLOCK_CREATE_RULESET = 444
 	SYS_LANDLOCK_ADD_RULE       = 445
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
+	SYS_MEMFD_SECRET            = 447
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
index 913f50f98b..7ea465204b 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include -fsigned-char /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/s390x/include -fsigned-char /tmp/s390x/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build s390x && linux
@@ -373,4 +373,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE       = 445
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
index 0de03a7227..92f628ef4f 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
@@ -1,4 +1,4 @@
-// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/include /tmp/include/asm/unistd.h
+// go run linux/mksysnum.go -Wall -Werror -static -I/tmp/sparc64/include /tmp/sparc64/include/asm/unistd.h
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build sparc64 && linux
@@ -387,4 +387,6 @@ const (
 	SYS_LANDLOCK_ADD_RULE       = 445
 	SYS_LANDLOCK_RESTRICT_SELF  = 446
 	SYS_PROCESS_MRELEASE        = 448
+	SYS_FUTEX_WAITV             = 449
+	SYS_SET_MEMPOLICY_HOME_NODE = 450
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_386.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_386.go
index 817edbf95c..597733813e 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_386.go
@@ -6,6 +6,7 @@
 
 package unix
 
+// Deprecated: Use libc wrappers instead of direct syscalls.
 const (
 	SYS_EXIT           = 1   // { void sys_exit(int rval); }
 	SYS_FORK           = 2   // { int sys_fork(void); }
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_amd64.go
index ea453614e6..16af291899 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_amd64.go
@@ -6,6 +6,7 @@
 
 package unix
 
+// Deprecated: Use libc wrappers instead of direct syscalls.
 const (
 	SYS_EXIT           = 1   // { void sys_exit(int rval); }
 	SYS_FORK           = 2   // { int sys_fork(void); }
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm.go
index 467971eed6..f59b18a977 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm.go
@@ -6,6 +6,7 @@
 
 package unix
 
+// Deprecated: Use libc wrappers instead of direct syscalls.
 const (
 	SYS_EXIT           = 1   // { void sys_exit(int rval); }
 	SYS_FORK           = 2   // { int sys_fork(void); }
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm64.go
index 32eec5ed56..721ef59103 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_arm64.go
@@ -6,6 +6,7 @@
 
 package unix
 
+// Deprecated: Use libc wrappers instead of direct syscalls.
 const (
 	SYS_EXIT           = 1   // { void sys_exit(int rval); }
 	SYS_FORK           = 2   // { int sys_fork(void); }
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go
index a37f773756..01c43a01fd 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_mips64.go
@@ -6,6 +6,7 @@
 
 package unix
 
+// Deprecated: Use libc wrappers instead of direct syscalls.
 const (
 	SYS_EXIT           = 1   // { void sys_exit(int rval); }
 	SYS_FORK           = 2   // { int sys_fork(void); }
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_ppc64.go
new file mode 100644
index 0000000000..f258cfa24e
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_ppc64.go
@@ -0,0 +1,218 @@
+// go run mksysnum.go https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build ppc64 && openbsd
+// +build ppc64,openbsd
+
+package unix
+
+const (
+	SYS_EXIT           = 1   // { void sys_exit(int rval); }
+	SYS_FORK           = 2   // { int sys_fork(void); }
+	SYS_READ           = 3   // { ssize_t sys_read(int fd, void *buf, size_t nbyte); }
+	SYS_WRITE          = 4   // { ssize_t sys_write(int fd, const void *buf, size_t nbyte); }
+	SYS_OPEN           = 5   // { int sys_open(const char *path, int flags, ... mode_t mode); }
+	SYS_CLOSE          = 6   // { int sys_close(int fd); }
+	SYS_GETENTROPY     = 7   // { int sys_getentropy(void *buf, size_t nbyte); }
+	SYS___TFORK        = 8   // { int sys___tfork(const struct __tfork *param, size_t psize); }
+	SYS_LINK           = 9   // { int sys_link(const char *path, const char *link); }
+	SYS_UNLINK         = 10  // { int sys_unlink(const char *path); }
+	SYS_WAIT4          = 11  // { pid_t sys_wait4(pid_t pid, int *status, int options, struct rusage *rusage); }
+	SYS_CHDIR          = 12  // { int sys_chdir(const char *path); }
+	SYS_FCHDIR         = 13  // { int sys_fchdir(int fd); }
+	SYS_MKNOD          = 14  // { int sys_mknod(const char *path, mode_t mode, dev_t dev); }
+	SYS_CHMOD          = 15  // { int sys_chmod(const char *path, mode_t mode); }
+	SYS_CHOWN          = 16  // { int sys_chown(const char *path, uid_t uid, gid_t gid); }
+	SYS_OBREAK         = 17  // { int sys_obreak(char *nsize); } break
+	SYS_GETDTABLECOUNT = 18  // { int sys_getdtablecount(void); }
+	SYS_GETRUSAGE      = 19  // { int sys_getrusage(int who, struct rusage *rusage); }
+	SYS_GETPID         = 20  // { pid_t sys_getpid(void); }
+	SYS_MOUNT          = 21  // { int sys_mount(const char *type, const char *path, int flags, void *data); }
+	SYS_UNMOUNT        = 22  // { int sys_unmount(const char *path, int flags); }
+	SYS_SETUID         = 23  // { int sys_setuid(uid_t uid); }
+	SYS_GETUID         = 24  // { uid_t sys_getuid(void); }
+	SYS_GETEUID        = 25  // { uid_t sys_geteuid(void); }
+	SYS_PTRACE         = 26  // { int sys_ptrace(int req, pid_t pid, caddr_t addr, int data); }
+	SYS_RECVMSG        = 27  // { ssize_t sys_recvmsg(int s, struct msghdr *msg, int flags); }
+	SYS_SENDMSG        = 28  // { ssize_t sys_sendmsg(int s, const struct msghdr *msg, int flags); }
+	SYS_RECVFROM       = 29  // { ssize_t sys_recvfrom(int s, void *buf, size_t len, int flags, struct sockaddr *from, socklen_t *fromlenaddr); }
+	SYS_ACCEPT         = 30  // { int sys_accept(int s, struct sockaddr *name, socklen_t *anamelen); }
+	SYS_GETPEERNAME    = 31  // { int sys_getpeername(int fdes, struct sockaddr *asa, socklen_t *alen); }
+	SYS_GETSOCKNAME    = 32  // { int sys_getsockname(int fdes, struct sockaddr *asa, socklen_t *alen); }
+	SYS_ACCESS         = 33  // { int sys_access(const char *path, int amode); }
+	SYS_CHFLAGS        = 34  // { int sys_chflags(const char *path, u_int flags); }
+	SYS_FCHFLAGS       = 35  // { int sys_fchflags(int fd, u_int flags); }
+	SYS_SYNC           = 36  // { void sys_sync(void); }
+	SYS_STAT           = 38  // { int sys_stat(const char *path, struct stat *ub); }
+	SYS_GETPPID        = 39  // { pid_t sys_getppid(void); }
+	SYS_LSTAT          = 40  // { int sys_lstat(const char *path, struct stat *ub); }
+	SYS_DUP            = 41  // { int sys_dup(int fd); }
+	SYS_FSTATAT        = 42  // { int sys_fstatat(int fd, const char *path, struct stat *buf, int flag); }
+	SYS_GETEGID        = 43  // { gid_t sys_getegid(void); }
+	SYS_PROFIL         = 44  // { int sys_profil(caddr_t samples, size_t size, u_long offset, u_int scale); }
+	SYS_KTRACE         = 45  // { int sys_ktrace(const char *fname, int ops, int facs, pid_t pid); }
+	SYS_SIGACTION      = 46  // { int sys_sigaction(int signum, const struct sigaction *nsa, struct sigaction *osa); }
+	SYS_GETGID         = 47  // { gid_t sys_getgid(void); }
+	SYS_SIGPROCMASK    = 48  // { int sys_sigprocmask(int how, sigset_t mask); }
+	SYS_SETLOGIN       = 50  // { int sys_setlogin(const char *namebuf); }
+	SYS_ACCT           = 51  // { int sys_acct(const char *path); }
+	SYS_SIGPENDING     = 52  // { int sys_sigpending(void); }
+	SYS_FSTAT          = 53  // { int sys_fstat(int fd, struct stat *sb); }
+	SYS_IOCTL          = 54  // { int sys_ioctl(int fd, u_long com, ... void *data); }
+	SYS_REBOOT         = 55  // { int sys_reboot(int opt); }
+	SYS_REVOKE         = 56  // { int sys_revoke(const char *path); }
+	SYS_SYMLINK        = 57  // { int sys_symlink(const char *path, const char *link); }
+	SYS_READLINK       = 58  // { ssize_t sys_readlink(const char *path, char *buf, size_t count); }
+	SYS_EXECVE         = 59  // { int sys_execve(const char *path, char * const *argp, char * const *envp); }
+	SYS_UMASK          = 60  // { mode_t sys_umask(mode_t newmask); }
+	SYS_CHROOT         = 61  // { int sys_chroot(const char *path); }
+	SYS_GETFSSTAT      = 62  // { int sys_getfsstat(struct statfs *buf, size_t bufsize, int flags); }
+	SYS_STATFS         = 63  // { int sys_statfs(const char *path, struct statfs *buf); }
+	SYS_FSTATFS        = 64  // { int sys_fstatfs(int fd, struct statfs *buf); }
+	SYS_FHSTATFS       = 65  // { int sys_fhstatfs(const fhandle_t *fhp, struct statfs *buf); }
+	SYS_VFORK          = 66  // { int sys_vfork(void); }
+	SYS_GETTIMEOFDAY   = 67  // { int sys_gettimeofday(struct timeval *tp, struct timezone *tzp); }
+	SYS_SETTIMEOFDAY   = 68  // { int sys_settimeofday(const struct timeval *tv, const struct timezone *tzp); }
+	SYS_SETITIMER      = 69  // { int sys_setitimer(int which, const struct itimerval *itv, struct itimerval *oitv); }
+	SYS_GETITIMER      = 70  // { int sys_getitimer(int which, struct itimerval *itv); }
+	SYS_SELECT         = 71  // { int sys_select(int nd, fd_set *in, fd_set *ou, fd_set *ex, struct timeval *tv); }
+	SYS_KEVENT         = 72  // { int sys_kevent(int fd, const struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_MUNMAP         = 73  // { int sys_munmap(void *addr, size_t len); }
+	SYS_MPROTECT       = 74  // { int sys_mprotect(void *addr, size_t len, int prot); }
+	SYS_MADVISE        = 75  // { int sys_madvise(void *addr, size_t len, int behav); }
+	SYS_UTIMES         = 76  // { int sys_utimes(const char *path, const struct timeval *tptr); }
+	SYS_FUTIMES        = 77  // { int sys_futimes(int fd, const struct timeval *tptr); }
+	SYS_GETGROUPS      = 79  // { int sys_getgroups(int gidsetsize, gid_t *gidset); }
+	SYS_SETGROUPS      = 80  // { int sys_setgroups(int gidsetsize, const gid_t *gidset); }
+	SYS_GETPGRP        = 81  // { int sys_getpgrp(void); }
+	SYS_SETPGID        = 82  // { int sys_setpgid(pid_t pid, pid_t pgid); }
+	SYS_FUTEX          = 83  // { int sys_futex(uint32_t *f, int op, int val, const struct timespec *timeout, uint32_t *g); }
+	SYS_UTIMENSAT      = 84  // { int sys_utimensat(int fd, const char *path, const struct timespec *times, int flag); }
+	SYS_FUTIMENS       = 85  // { int sys_futimens(int fd, const struct timespec *times); }
+	SYS_KBIND          = 86  // { int sys_kbind(const struct __kbind *param, size_t psize, int64_t proc_cookie); }
+	SYS_CLOCK_GETTIME  = 87  // { int sys_clock_gettime(clockid_t clock_id, struct timespec *tp); }
+	SYS_CLOCK_SETTIME  = 88  // { int sys_clock_settime(clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_GETRES   = 89  // { int sys_clock_getres(clockid_t clock_id, struct timespec *tp); }
+	SYS_DUP2           = 90  // { int sys_dup2(int from, int to); }
+	SYS_NANOSLEEP      = 91  // { int sys_nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
+	SYS_FCNTL          = 92  // { int sys_fcntl(int fd, int cmd, ... void *arg); }
+	SYS_ACCEPT4        = 93  // { int sys_accept4(int s, struct sockaddr *name, socklen_t *anamelen, int flags); }
+	SYS___THRSLEEP     = 94  // { int sys___thrsleep(const volatile void *ident, clockid_t clock_id, const struct timespec *tp, void *lock, const int *abort); }
+	SYS_FSYNC          = 95  // { int sys_fsync(int fd); }
+	SYS_SETPRIORITY    = 96  // { int sys_setpriority(int which, id_t who, int prio); }
+	SYS_SOCKET         = 97  // { int sys_socket(int domain, int type, int protocol); }
+	SYS_CONNECT        = 98  // { int sys_connect(int s, const struct sockaddr *name, socklen_t namelen); }
+	SYS_GETDENTS       = 99  // { int sys_getdents(int fd, void *buf, size_t buflen); }
+	SYS_GETPRIORITY    = 100 // { int sys_getpriority(int which, id_t who); }
+	SYS_PIPE2          = 101 // { int sys_pipe2(int *fdp, int flags); }
+	SYS_DUP3           = 102 // { int sys_dup3(int from, int to, int flags); }
+	SYS_SIGRETURN      = 103 // { int sys_sigreturn(struct sigcontext *sigcntxp); }
+	SYS_BIND           = 104 // { int sys_bind(int s, const struct sockaddr *name, socklen_t namelen); }
+	SYS_SETSOCKOPT     = 105 // { int sys_setsockopt(int s, int level, int name, const void *val, socklen_t valsize); }
+	SYS_LISTEN         = 106 // { int sys_listen(int s, int backlog); }
+	SYS_CHFLAGSAT      = 107 // { int sys_chflagsat(int fd, const char *path, u_int flags, int atflags); }
+	SYS_PLEDGE         = 108 // { int sys_pledge(const char *promises, const char *execpromises); }
+	SYS_PPOLL          = 109 // { int sys_ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *mask); }
+	SYS_PSELECT        = 110 // { int sys_pselect(int nd, fd_set *in, fd_set *ou, fd_set *ex, const struct timespec *ts, const sigset_t *mask); }
+	SYS_SIGSUSPEND     = 111 // { int sys_sigsuspend(int mask); }
+	SYS_SENDSYSLOG     = 112 // { int sys_sendsyslog(const char *buf, size_t nbyte, int flags); }
+	SYS_UNVEIL         = 114 // { int sys_unveil(const char *path, const char *permissions); }
+	SYS_GETSOCKOPT     = 118 // { int sys_getsockopt(int s, int level, int name, void *val, socklen_t *avalsize); }
+	SYS_THRKILL        = 119 // { int sys_thrkill(pid_t tid, int signum, void *tcb); }
+	SYS_READV          = 120 // { ssize_t sys_readv(int fd, const struct iovec *iovp, int iovcnt); }
+	SYS_WRITEV         = 121 // { ssize_t sys_writev(int fd, const struct iovec *iovp, int iovcnt); }
+	SYS_KILL           = 122 // { int sys_kill(int pid, int signum); }
+	SYS_FCHOWN         = 123 // { int sys_fchown(int fd, uid_t uid, gid_t gid); }
+	SYS_FCHMOD         = 124 // { int sys_fchmod(int fd, mode_t mode); }
+	SYS_SETREUID       = 126 // { int sys_setreuid(uid_t ruid, uid_t euid); }
+	SYS_SETREGID       = 127 // { int sys_setregid(gid_t rgid, gid_t egid); }
+	SYS_RENAME         = 128 // { int sys_rename(const char *from, const char *to); }
+	SYS_FLOCK          = 131 // { int sys_flock(int fd, int how); }
+	SYS_MKFIFO         = 132 // { int sys_mkfifo(const char *path, mode_t mode); }
+	SYS_SENDTO         = 133 // { ssize_t sys_sendto(int s, const void *buf, size_t len, int flags, const struct sockaddr *to, socklen_t tolen); }
+	SYS_SHUTDOWN       = 134 // { int sys_shutdown(int s, int how); }
+	SYS_SOCKETPAIR     = 135 // { int sys_socketpair(int domain, int type, int protocol, int *rsv); }
+	SYS_MKDIR          = 136 // { int sys_mkdir(const char *path, mode_t mode); }
+	SYS_RMDIR          = 137 // { int sys_rmdir(const char *path); }
+	SYS_ADJTIME        = 140 // { int sys_adjtime(const struct timeval *delta, struct timeval *olddelta); }
+	SYS_GETLOGIN_R     = 141 // { int sys_getlogin_r(char *namebuf, u_int namelen); }
+	SYS_SETSID         = 147 // { int sys_setsid(void); }
+	SYS_QUOTACTL       = 148 // { int sys_quotactl(const char *path, int cmd, int uid, char *arg); }
+	SYS_NFSSVC         = 155 // { int sys_nfssvc(int flag, void *argp); }
+	SYS_GETFH          = 161 // { int sys_getfh(const char *fname, fhandle_t *fhp); }
+	SYS_SYSARCH        = 165 // { int sys_sysarch(int op, void *parms); }
+	SYS_PREAD          = 173 // { ssize_t sys_pread(int fd, void *buf, size_t nbyte, int pad, off_t offset); }
+	SYS_PWRITE         = 174 // { ssize_t sys_pwrite(int fd, const void *buf, size_t nbyte, int pad, off_t offset); }
+	SYS_SETGID         = 181 // { int sys_setgid(gid_t gid); }
+	SYS_SETEGID        = 182 // { int sys_setegid(gid_t egid); }
+	SYS_SETEUID        = 183 // { int sys_seteuid(uid_t euid); }
+	SYS_PATHCONF       = 191 // { long sys_pathconf(const char *path, int name); }
+	SYS_FPATHCONF      = 192 // { long sys_fpathconf(int fd, int name); }
+	SYS_SWAPCTL        = 193 // { int sys_swapctl(int cmd, const void *arg, int misc); }
+	SYS_GETRLIMIT      = 194 // { int sys_getrlimit(int which, struct rlimit *rlp); }
+	SYS_SETRLIMIT      = 195 // { int sys_setrlimit(int which, const struct rlimit *rlp); }
+	SYS_MMAP           = 197 // { void *sys_mmap(void *addr, size_t len, int prot, int flags, int fd, long pad, off_t pos); }
+	SYS_LSEEK          = 199 // { off_t sys_lseek(int fd, int pad, off_t offset, int whence); }
+	SYS_TRUNCATE       = 200 // { int sys_truncate(const char *path, int pad, off_t length); }
+	SYS_FTRUNCATE      = 201 // { int sys_ftruncate(int fd, int pad, off_t length); }
+	SYS_SYSCTL         = 202 // { int sys_sysctl(const int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_MLOCK          = 203 // { int sys_mlock(const void *addr, size_t len); }
+	SYS_MUNLOCK        = 204 // { int sys_munlock(const void *addr, size_t len); }
+	SYS_GETPGID        = 207 // { pid_t sys_getpgid(pid_t pid); }
+	SYS_UTRACE         = 209 // { int sys_utrace(const char *label, const void *addr, size_t len); }
+	SYS_SEMGET         = 221 // { int sys_semget(key_t key, int nsems, int semflg); }
+	SYS_MSGGET         = 225 // { int sys_msgget(key_t key, int msgflg); }
+	SYS_MSGSND         = 226 // { int sys_msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
+	SYS_MSGRCV         = 227 // { int sys_msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_SHMAT          = 228 // { void *sys_shmat(int shmid, const void *shmaddr, int shmflg); }
+	SYS_SHMDT          = 230 // { int sys_shmdt(const void *shmaddr); }
+	SYS_MINHERIT       = 250 // { int sys_minherit(void *addr, size_t len, int inherit); }
+	SYS_POLL           = 252 // { int sys_poll(struct pollfd *fds, u_int nfds, int timeout); }
+	SYS_ISSETUGID      = 253 // { int sys_issetugid(void); }
+	SYS_LCHOWN         = 254 // { int sys_lchown(const char *path, uid_t uid, gid_t gid); }
+	SYS_GETSID         = 255 // { pid_t sys_getsid(pid_t pid); }
+	SYS_MSYNC          = 256 // { int sys_msync(void *addr, size_t len, int flags); }
+	SYS_PIPE           = 263 // { int sys_pipe(int *fdp); }
+	SYS_FHOPEN         = 264 // { int sys_fhopen(const fhandle_t *fhp, int flags); }
+	SYS_PREADV         = 267 // { ssize_t sys_preadv(int fd, const struct iovec *iovp, int iovcnt, int pad, off_t offset); }
+	SYS_PWRITEV        = 268 // { ssize_t sys_pwritev(int fd, const struct iovec *iovp, int iovcnt, int pad, off_t offset); }
+	SYS_KQUEUE         = 269 // { int sys_kqueue(void); }
+	SYS_MLOCKALL       = 271 // { int sys_mlockall(int flags); }
+	SYS_MUNLOCKALL     = 272 // { int sys_munlockall(void); }
+	SYS_GETRESUID      = 281 // { int sys_getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
+	SYS_SETRESUID      = 282 // { int sys_setresuid(uid_t ruid, uid_t euid, uid_t suid); }
+	SYS_GETRESGID      = 283 // { int sys_getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
+	SYS_SETRESGID      = 284 // { int sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
+	SYS_MQUERY         = 286 // { void *sys_mquery(void *addr, size_t len, int prot, int flags, int fd, long pad, off_t pos); }
+	SYS_CLOSEFROM      = 287 // { int sys_closefrom(int fd); }
+	SYS_SIGALTSTACK    = 288 // { int sys_sigaltstack(const struct sigaltstack *nss, struct sigaltstack *oss); }
+	SYS_SHMGET         = 289 // { int sys_shmget(key_t key, size_t size, int shmflg); }
+	SYS_SEMOP          = 290 // { int sys_semop(int semid, struct sembuf *sops, size_t nsops); }
+	SYS_FHSTAT         = 294 // { int sys_fhstat(const fhandle_t *fhp, struct stat *sb); }
+	SYS___SEMCTL       = 295 // { int sys___semctl(int semid, int semnum, int cmd, union semun *arg); }
+	SYS_SHMCTL         = 296 // { int sys_shmctl(int shmid, int cmd, struct shmid_ds *buf); }
+	SYS_MSGCTL         = 297 // { int sys_msgctl(int msqid, int cmd, struct msqid_ds *buf); }
+	SYS_SCHED_YIELD    = 298 // { int sys_sched_yield(void); }
+	SYS_GETTHRID       = 299 // { pid_t sys_getthrid(void); }
+	SYS___THRWAKEUP    = 301 // { int sys___thrwakeup(const volatile void *ident, int n); }
+	SYS___THREXIT      = 302 // { void sys___threxit(pid_t *notdead); }
+	SYS___THRSIGDIVERT = 303 // { int sys___thrsigdivert(sigset_t sigmask, siginfo_t *info, const struct timespec *timeout); }
+	SYS___GETCWD       = 304 // { int sys___getcwd(char *buf, size_t len); }
+	SYS_ADJFREQ        = 305 // { int sys_adjfreq(const int64_t *freq, int64_t *oldfreq); }
+	SYS_SETRTABLE      = 310 // { int sys_setrtable(int rtableid); }
+	SYS_GETRTABLE      = 311 // { int sys_getrtable(void); }
+	SYS_FACCESSAT      = 313 // { int sys_faccessat(int fd, const char *path, int amode, int flag); }
+	SYS_FCHMODAT       = 314 // { int sys_fchmodat(int fd, const char *path, mode_t mode, int flag); }
+	SYS_FCHOWNAT       = 315 // { int sys_fchownat(int fd, const char *path, uid_t uid, gid_t gid, int flag); }
+	SYS_LINKAT         = 317 // { int sys_linkat(int fd1, const char *path1, int fd2, const char *path2, int flag); }
+	SYS_MKDIRAT        = 318 // { int sys_mkdirat(int fd, const char *path, mode_t mode); }
+	SYS_MKFIFOAT       = 319 // { int sys_mkfifoat(int fd, const char *path, mode_t mode); }
+	SYS_MKNODAT        = 320 // { int sys_mknodat(int fd, const char *path, mode_t mode, dev_t dev); }
+	SYS_OPENAT         = 321 // { int sys_openat(int fd, const char *path, int flags, ... mode_t mode); }
+	SYS_READLINKAT     = 322 // { ssize_t sys_readlinkat(int fd, const char *path, char *buf, size_t count); }
+	SYS_RENAMEAT       = 323 // { int sys_renameat(int fromfd, const char *from, int tofd, const char *to); }
+	SYS_SYMLINKAT      = 324 // { int sys_symlinkat(const char *path, int fd, const char *link); }
+	SYS_UNLINKAT       = 325 // { int sys_unlinkat(int fd, const char *path, int flag); }
+	SYS___SET_TCB      = 329 // { void sys___set_tcb(void *tcb); }
+	SYS___GET_TCB      = 330 // { void *sys___get_tcb(void); }
+)
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_riscv64.go
new file mode 100644
index 0000000000..07919e0ecc
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/zsysnum_openbsd_riscv64.go
@@ -0,0 +1,219 @@
+// go run mksysnum.go https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/kern/syscalls.master
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build riscv64 && openbsd
+// +build riscv64,openbsd
+
+package unix
+
+// Deprecated: Use libc wrappers instead of direct syscalls.
+const (
+	SYS_EXIT           = 1   // { void sys_exit(int rval); }
+	SYS_FORK           = 2   // { int sys_fork(void); }
+	SYS_READ           = 3   // { ssize_t sys_read(int fd, void *buf, size_t nbyte); }
+	SYS_WRITE          = 4   // { ssize_t sys_write(int fd, const void *buf, size_t nbyte); }
+	SYS_OPEN           = 5   // { int sys_open(const char *path, int flags, ... mode_t mode); }
+	SYS_CLOSE          = 6   // { int sys_close(int fd); }
+	SYS_GETENTROPY     = 7   // { int sys_getentropy(void *buf, size_t nbyte); }
+	SYS___TFORK        = 8   // { int sys___tfork(const struct __tfork *param, size_t psize); }
+	SYS_LINK           = 9   // { int sys_link(const char *path, const char *link); }
+	SYS_UNLINK         = 10  // { int sys_unlink(const char *path); }
+	SYS_WAIT4          = 11  // { pid_t sys_wait4(pid_t pid, int *status, int options, struct rusage *rusage); }
+	SYS_CHDIR          = 12  // { int sys_chdir(const char *path); }
+	SYS_FCHDIR         = 13  // { int sys_fchdir(int fd); }
+	SYS_MKNOD          = 14  // { int sys_mknod(const char *path, mode_t mode, dev_t dev); }
+	SYS_CHMOD          = 15  // { int sys_chmod(const char *path, mode_t mode); }
+	SYS_CHOWN          = 16  // { int sys_chown(const char *path, uid_t uid, gid_t gid); }
+	SYS_OBREAK         = 17  // { int sys_obreak(char *nsize); } break
+	SYS_GETDTABLECOUNT = 18  // { int sys_getdtablecount(void); }
+	SYS_GETRUSAGE      = 19  // { int sys_getrusage(int who, struct rusage *rusage); }
+	SYS_GETPID         = 20  // { pid_t sys_getpid(void); }
+	SYS_MOUNT          = 21  // { int sys_mount(const char *type, const char *path, int flags, void *data); }
+	SYS_UNMOUNT        = 22  // { int sys_unmount(const char *path, int flags); }
+	SYS_SETUID         = 23  // { int sys_setuid(uid_t uid); }
+	SYS_GETUID         = 24  // { uid_t sys_getuid(void); }
+	SYS_GETEUID        = 25  // { uid_t sys_geteuid(void); }
+	SYS_PTRACE         = 26  // { int sys_ptrace(int req, pid_t pid, caddr_t addr, int data); }
+	SYS_RECVMSG        = 27  // { ssize_t sys_recvmsg(int s, struct msghdr *msg, int flags); }
+	SYS_SENDMSG        = 28  // { ssize_t sys_sendmsg(int s, const struct msghdr *msg, int flags); }
+	SYS_RECVFROM       = 29  // { ssize_t sys_recvfrom(int s, void *buf, size_t len, int flags, struct sockaddr *from, socklen_t *fromlenaddr); }
+	SYS_ACCEPT         = 30  // { int sys_accept(int s, struct sockaddr *name, socklen_t *anamelen); }
+	SYS_GETPEERNAME    = 31  // { int sys_getpeername(int fdes, struct sockaddr *asa, socklen_t *alen); }
+	SYS_GETSOCKNAME    = 32  // { int sys_getsockname(int fdes, struct sockaddr *asa, socklen_t *alen); }
+	SYS_ACCESS         = 33  // { int sys_access(const char *path, int amode); }
+	SYS_CHFLAGS        = 34  // { int sys_chflags(const char *path, u_int flags); }
+	SYS_FCHFLAGS       = 35  // { int sys_fchflags(int fd, u_int flags); }
+	SYS_SYNC           = 36  // { void sys_sync(void); }
+	SYS_STAT           = 38  // { int sys_stat(const char *path, struct stat *ub); }
+	SYS_GETPPID        = 39  // { pid_t sys_getppid(void); }
+	SYS_LSTAT          = 40  // { int sys_lstat(const char *path, struct stat *ub); }
+	SYS_DUP            = 41  // { int sys_dup(int fd); }
+	SYS_FSTATAT        = 42  // { int sys_fstatat(int fd, const char *path, struct stat *buf, int flag); }
+	SYS_GETEGID        = 43  // { gid_t sys_getegid(void); }
+	SYS_PROFIL         = 44  // { int sys_profil(caddr_t samples, size_t size, u_long offset, u_int scale); }
+	SYS_KTRACE         = 45  // { int sys_ktrace(const char *fname, int ops, int facs, pid_t pid); }
+	SYS_SIGACTION      = 46  // { int sys_sigaction(int signum, const struct sigaction *nsa, struct sigaction *osa); }
+	SYS_GETGID         = 47  // { gid_t sys_getgid(void); }
+	SYS_SIGPROCMASK    = 48  // { int sys_sigprocmask(int how, sigset_t mask); }
+	SYS_SETLOGIN       = 50  // { int sys_setlogin(const char *namebuf); }
+	SYS_ACCT           = 51  // { int sys_acct(const char *path); }
+	SYS_SIGPENDING     = 52  // { int sys_sigpending(void); }
+	SYS_FSTAT          = 53  // { int sys_fstat(int fd, struct stat *sb); }
+	SYS_IOCTL          = 54  // { int sys_ioctl(int fd, u_long com, ... void *data); }
+	SYS_REBOOT         = 55  // { int sys_reboot(int opt); }
+	SYS_REVOKE         = 56  // { int sys_revoke(const char *path); }
+	SYS_SYMLINK        = 57  // { int sys_symlink(const char *path, const char *link); }
+	SYS_READLINK       = 58  // { ssize_t sys_readlink(const char *path, char *buf, size_t count); }
+	SYS_EXECVE         = 59  // { int sys_execve(const char *path, char * const *argp, char * const *envp); }
+	SYS_UMASK          = 60  // { mode_t sys_umask(mode_t newmask); }
+	SYS_CHROOT         = 61  // { int sys_chroot(const char *path); }
+	SYS_GETFSSTAT      = 62  // { int sys_getfsstat(struct statfs *buf, size_t bufsize, int flags); }
+	SYS_STATFS         = 63  // { int sys_statfs(const char *path, struct statfs *buf); }
+	SYS_FSTATFS        = 64  // { int sys_fstatfs(int fd, struct statfs *buf); }
+	SYS_FHSTATFS       = 65  // { int sys_fhstatfs(const fhandle_t *fhp, struct statfs *buf); }
+	SYS_VFORK          = 66  // { int sys_vfork(void); }
+	SYS_GETTIMEOFDAY   = 67  // { int sys_gettimeofday(struct timeval *tp, struct timezone *tzp); }
+	SYS_SETTIMEOFDAY   = 68  // { int sys_settimeofday(const struct timeval *tv, const struct timezone *tzp); }
+	SYS_SETITIMER      = 69  // { int sys_setitimer(int which, const struct itimerval *itv, struct itimerval *oitv); }
+	SYS_GETITIMER      = 70  // { int sys_getitimer(int which, struct itimerval *itv); }
+	SYS_SELECT         = 71  // { int sys_select(int nd, fd_set *in, fd_set *ou, fd_set *ex, struct timeval *tv); }
+	SYS_KEVENT         = 72  // { int sys_kevent(int fd, const struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout); }
+	SYS_MUNMAP         = 73  // { int sys_munmap(void *addr, size_t len); }
+	SYS_MPROTECT       = 74  // { int sys_mprotect(void *addr, size_t len, int prot); }
+	SYS_MADVISE        = 75  // { int sys_madvise(void *addr, size_t len, int behav); }
+	SYS_UTIMES         = 76  // { int sys_utimes(const char *path, const struct timeval *tptr); }
+	SYS_FUTIMES        = 77  // { int sys_futimes(int fd, const struct timeval *tptr); }
+	SYS_GETGROUPS      = 79  // { int sys_getgroups(int gidsetsize, gid_t *gidset); }
+	SYS_SETGROUPS      = 80  // { int sys_setgroups(int gidsetsize, const gid_t *gidset); }
+	SYS_GETPGRP        = 81  // { int sys_getpgrp(void); }
+	SYS_SETPGID        = 82  // { int sys_setpgid(pid_t pid, pid_t pgid); }
+	SYS_FUTEX          = 83  // { int sys_futex(uint32_t *f, int op, int val, const struct timespec *timeout, uint32_t *g); }
+	SYS_UTIMENSAT      = 84  // { int sys_utimensat(int fd, const char *path, const struct timespec *times, int flag); }
+	SYS_FUTIMENS       = 85  // { int sys_futimens(int fd, const struct timespec *times); }
+	SYS_KBIND          = 86  // { int sys_kbind(const struct __kbind *param, size_t psize, int64_t proc_cookie); }
+	SYS_CLOCK_GETTIME  = 87  // { int sys_clock_gettime(clockid_t clock_id, struct timespec *tp); }
+	SYS_CLOCK_SETTIME  = 88  // { int sys_clock_settime(clockid_t clock_id, const struct timespec *tp); }
+	SYS_CLOCK_GETRES   = 89  // { int sys_clock_getres(clockid_t clock_id, struct timespec *tp); }
+	SYS_DUP2           = 90  // { int sys_dup2(int from, int to); }
+	SYS_NANOSLEEP      = 91  // { int sys_nanosleep(const struct timespec *rqtp, struct timespec *rmtp); }
+	SYS_FCNTL          = 92  // { int sys_fcntl(int fd, int cmd, ... void *arg); }
+	SYS_ACCEPT4        = 93  // { int sys_accept4(int s, struct sockaddr *name, socklen_t *anamelen, int flags); }
+	SYS___THRSLEEP     = 94  // { int sys___thrsleep(const volatile void *ident, clockid_t clock_id, const struct timespec *tp, void *lock, const int *abort); }
+	SYS_FSYNC          = 95  // { int sys_fsync(int fd); }
+	SYS_SETPRIORITY    = 96  // { int sys_setpriority(int which, id_t who, int prio); }
+	SYS_SOCKET         = 97  // { int sys_socket(int domain, int type, int protocol); }
+	SYS_CONNECT        = 98  // { int sys_connect(int s, const struct sockaddr *name, socklen_t namelen); }
+	SYS_GETDENTS       = 99  // { int sys_getdents(int fd, void *buf, size_t buflen); }
+	SYS_GETPRIORITY    = 100 // { int sys_getpriority(int which, id_t who); }
+	SYS_PIPE2          = 101 // { int sys_pipe2(int *fdp, int flags); }
+	SYS_DUP3           = 102 // { int sys_dup3(int from, int to, int flags); }
+	SYS_SIGRETURN      = 103 // { int sys_sigreturn(struct sigcontext *sigcntxp); }
+	SYS_BIND           = 104 // { int sys_bind(int s, const struct sockaddr *name, socklen_t namelen); }
+	SYS_SETSOCKOPT     = 105 // { int sys_setsockopt(int s, int level, int name, const void *val, socklen_t valsize); }
+	SYS_LISTEN         = 106 // { int sys_listen(int s, int backlog); }
+	SYS_CHFLAGSAT      = 107 // { int sys_chflagsat(int fd, const char *path, u_int flags, int atflags); }
+	SYS_PLEDGE         = 108 // { int sys_pledge(const char *promises, const char *execpromises); }
+	SYS_PPOLL          = 109 // { int sys_ppoll(struct pollfd *fds, u_int nfds, const struct timespec *ts, const sigset_t *mask); }
+	SYS_PSELECT        = 110 // { int sys_pselect(int nd, fd_set *in, fd_set *ou, fd_set *ex, const struct timespec *ts, const sigset_t *mask); }
+	SYS_SIGSUSPEND     = 111 // { int sys_sigsuspend(int mask); }
+	SYS_SENDSYSLOG     = 112 // { int sys_sendsyslog(const char *buf, size_t nbyte, int flags); }
+	SYS_UNVEIL         = 114 // { int sys_unveil(const char *path, const char *permissions); }
+	SYS_GETSOCKOPT     = 118 // { int sys_getsockopt(int s, int level, int name, void *val, socklen_t *avalsize); }
+	SYS_THRKILL        = 119 // { int sys_thrkill(pid_t tid, int signum, void *tcb); }
+	SYS_READV          = 120 // { ssize_t sys_readv(int fd, const struct iovec *iovp, int iovcnt); }
+	SYS_WRITEV         = 121 // { ssize_t sys_writev(int fd, const struct iovec *iovp, int iovcnt); }
+	SYS_KILL           = 122 // { int sys_kill(int pid, int signum); }
+	SYS_FCHOWN         = 123 // { int sys_fchown(int fd, uid_t uid, gid_t gid); }
+	SYS_FCHMOD         = 124 // { int sys_fchmod(int fd, mode_t mode); }
+	SYS_SETREUID       = 126 // { int sys_setreuid(uid_t ruid, uid_t euid); }
+	SYS_SETREGID       = 127 // { int sys_setregid(gid_t rgid, gid_t egid); }
+	SYS_RENAME         = 128 // { int sys_rename(const char *from, const char *to); }
+	SYS_FLOCK          = 131 // { int sys_flock(int fd, int how); }
+	SYS_MKFIFO         = 132 // { int sys_mkfifo(const char *path, mode_t mode); }
+	SYS_SENDTO         = 133 // { ssize_t sys_sendto(int s, const void *buf, size_t len, int flags, const struct sockaddr *to, socklen_t tolen); }
+	SYS_SHUTDOWN       = 134 // { int sys_shutdown(int s, int how); }
+	SYS_SOCKETPAIR     = 135 // { int sys_socketpair(int domain, int type, int protocol, int *rsv); }
+	SYS_MKDIR          = 136 // { int sys_mkdir(const char *path, mode_t mode); }
+	SYS_RMDIR          = 137 // { int sys_rmdir(const char *path); }
+	SYS_ADJTIME        = 140 // { int sys_adjtime(const struct timeval *delta, struct timeval *olddelta); }
+	SYS_GETLOGIN_R     = 141 // { int sys_getlogin_r(char *namebuf, u_int namelen); }
+	SYS_SETSID         = 147 // { int sys_setsid(void); }
+	SYS_QUOTACTL       = 148 // { int sys_quotactl(const char *path, int cmd, int uid, char *arg); }
+	SYS_NFSSVC         = 155 // { int sys_nfssvc(int flag, void *argp); }
+	SYS_GETFH          = 161 // { int sys_getfh(const char *fname, fhandle_t *fhp); }
+	SYS_SYSARCH        = 165 // { int sys_sysarch(int op, void *parms); }
+	SYS_PREAD          = 173 // { ssize_t sys_pread(int fd, void *buf, size_t nbyte, int pad, off_t offset); }
+	SYS_PWRITE         = 174 // { ssize_t sys_pwrite(int fd, const void *buf, size_t nbyte, int pad, off_t offset); }
+	SYS_SETGID         = 181 // { int sys_setgid(gid_t gid); }
+	SYS_SETEGID        = 182 // { int sys_setegid(gid_t egid); }
+	SYS_SETEUID        = 183 // { int sys_seteuid(uid_t euid); }
+	SYS_PATHCONF       = 191 // { long sys_pathconf(const char *path, int name); }
+	SYS_FPATHCONF      = 192 // { long sys_fpathconf(int fd, int name); }
+	SYS_SWAPCTL        = 193 // { int sys_swapctl(int cmd, const void *arg, int misc); }
+	SYS_GETRLIMIT      = 194 // { int sys_getrlimit(int which, struct rlimit *rlp); }
+	SYS_SETRLIMIT      = 195 // { int sys_setrlimit(int which, const struct rlimit *rlp); }
+	SYS_MMAP           = 197 // { void *sys_mmap(void *addr, size_t len, int prot, int flags, int fd, long pad, off_t pos); }
+	SYS_LSEEK          = 199 // { off_t sys_lseek(int fd, int pad, off_t offset, int whence); }
+	SYS_TRUNCATE       = 200 // { int sys_truncate(const char *path, int pad, off_t length); }
+	SYS_FTRUNCATE      = 201 // { int sys_ftruncate(int fd, int pad, off_t length); }
+	SYS_SYSCTL         = 202 // { int sys_sysctl(const int *name, u_int namelen, void *old, size_t *oldlenp, void *new, size_t newlen); }
+	SYS_MLOCK          = 203 // { int sys_mlock(const void *addr, size_t len); }
+	SYS_MUNLOCK        = 204 // { int sys_munlock(const void *addr, size_t len); }
+	SYS_GETPGID        = 207 // { pid_t sys_getpgid(pid_t pid); }
+	SYS_UTRACE         = 209 // { int sys_utrace(const char *label, const void *addr, size_t len); }
+	SYS_SEMGET         = 221 // { int sys_semget(key_t key, int nsems, int semflg); }
+	SYS_MSGGET         = 225 // { int sys_msgget(key_t key, int msgflg); }
+	SYS_MSGSND         = 226 // { int sys_msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); }
+	SYS_MSGRCV         = 227 // { int sys_msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp, int msgflg); }
+	SYS_SHMAT          = 228 // { void *sys_shmat(int shmid, const void *shmaddr, int shmflg); }
+	SYS_SHMDT          = 230 // { int sys_shmdt(const void *shmaddr); }
+	SYS_MINHERIT       = 250 // { int sys_minherit(void *addr, size_t len, int inherit); }
+	SYS_POLL           = 252 // { int sys_poll(struct pollfd *fds, u_int nfds, int timeout); }
+	SYS_ISSETUGID      = 253 // { int sys_issetugid(void); }
+	SYS_LCHOWN         = 254 // { int sys_lchown(const char *path, uid_t uid, gid_t gid); }
+	SYS_GETSID         = 255 // { pid_t sys_getsid(pid_t pid); }
+	SYS_MSYNC          = 256 // { int sys_msync(void *addr, size_t len, int flags); }
+	SYS_PIPE           = 263 // { int sys_pipe(int *fdp); }
+	SYS_FHOPEN         = 264 // { int sys_fhopen(const fhandle_t *fhp, int flags); }
+	SYS_PREADV         = 267 // { ssize_t sys_preadv(int fd, const struct iovec *iovp, int iovcnt, int pad, off_t offset); }
+	SYS_PWRITEV        = 268 // { ssize_t sys_pwritev(int fd, const struct iovec *iovp, int iovcnt, int pad, off_t offset); }
+	SYS_KQUEUE         = 269 // { int sys_kqueue(void); }
+	SYS_MLOCKALL       = 271 // { int sys_mlockall(int flags); }
+	SYS_MUNLOCKALL     = 272 // { int sys_munlockall(void); }
+	SYS_GETRESUID      = 281 // { int sys_getresuid(uid_t *ruid, uid_t *euid, uid_t *suid); }
+	SYS_SETRESUID      = 282 // { int sys_setresuid(uid_t ruid, uid_t euid, uid_t suid); }
+	SYS_GETRESGID      = 283 // { int sys_getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); }
+	SYS_SETRESGID      = 284 // { int sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid); }
+	SYS_MQUERY         = 286 // { void *sys_mquery(void *addr, size_t len, int prot, int flags, int fd, long pad, off_t pos); }
+	SYS_CLOSEFROM      = 287 // { int sys_closefrom(int fd); }
+	SYS_SIGALTSTACK    = 288 // { int sys_sigaltstack(const struct sigaltstack *nss, struct sigaltstack *oss); }
+	SYS_SHMGET         = 289 // { int sys_shmget(key_t key, size_t size, int shmflg); }
+	SYS_SEMOP          = 290 // { int sys_semop(int semid, struct sembuf *sops, size_t nsops); }
+	SYS_FHSTAT         = 294 // { int sys_fhstat(const fhandle_t *fhp, struct stat *sb); }
+	SYS___SEMCTL       = 295 // { int sys___semctl(int semid, int semnum, int cmd, union semun *arg); }
+	SYS_SHMCTL         = 296 // { int sys_shmctl(int shmid, int cmd, struct shmid_ds *buf); }
+	SYS_MSGCTL         = 297 // { int sys_msgctl(int msqid, int cmd, struct msqid_ds *buf); }
+	SYS_SCHED_YIELD    = 298 // { int sys_sched_yield(void); }
+	SYS_GETTHRID       = 299 // { pid_t sys_getthrid(void); }
+	SYS___THRWAKEUP    = 301 // { int sys___thrwakeup(const volatile void *ident, int n); }
+	SYS___THREXIT      = 302 // { void sys___threxit(pid_t *notdead); }
+	SYS___THRSIGDIVERT = 303 // { int sys___thrsigdivert(sigset_t sigmask, siginfo_t *info, const struct timespec *timeout); }
+	SYS___GETCWD       = 304 // { int sys___getcwd(char *buf, size_t len); }
+	SYS_ADJFREQ        = 305 // { int sys_adjfreq(const int64_t *freq, int64_t *oldfreq); }
+	SYS_SETRTABLE      = 310 // { int sys_setrtable(int rtableid); }
+	SYS_GETRTABLE      = 311 // { int sys_getrtable(void); }
+	SYS_FACCESSAT      = 313 // { int sys_faccessat(int fd, const char *path, int amode, int flag); }
+	SYS_FCHMODAT       = 314 // { int sys_fchmodat(int fd, const char *path, mode_t mode, int flag); }
+	SYS_FCHOWNAT       = 315 // { int sys_fchownat(int fd, const char *path, uid_t uid, gid_t gid, int flag); }
+	SYS_LINKAT         = 317 // { int sys_linkat(int fd1, const char *path1, int fd2, const char *path2, int flag); }
+	SYS_MKDIRAT        = 318 // { int sys_mkdirat(int fd, const char *path, mode_t mode); }
+	SYS_MKFIFOAT       = 319 // { int sys_mkfifoat(int fd, const char *path, mode_t mode); }
+	SYS_MKNODAT        = 320 // { int sys_mknodat(int fd, const char *path, mode_t mode, dev_t dev); }
+	SYS_OPENAT         = 321 // { int sys_openat(int fd, const char *path, int flags, ... mode_t mode); }
+	SYS_READLINKAT     = 322 // { ssize_t sys_readlinkat(int fd, const char *path, char *buf, size_t count); }
+	SYS_RENAMEAT       = 323 // { int sys_renameat(int fromfd, const char *from, int tofd, const char *to); }
+	SYS_SYMLINKAT      = 324 // { int sys_symlinkat(const char *path, int fd, const char *link); }
+	SYS_UNLINKAT       = 325 // { int sys_unlinkat(int fd, const char *path, int flag); }
+	SYS___SET_TCB      = 329 // { void sys___set_tcb(void *tcb); }
+	SYS___GET_TCB      = 330 // { void *sys___get_tcb(void); }
+)
diff --git a/vendor/golang.org/x/sys/unix/ztypes_darwin_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_darwin_amd64.go
index 885842c0eb..690cefc3d0 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_darwin_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_darwin_amd64.go
@@ -151,6 +151,16 @@ type Dirent struct {
 	_       [3]byte
 }
 
+type Attrlist struct {
+	Bitmapcount uint16
+	Reserved    uint16
+	Commonattr  uint32
+	Volattr     uint32
+	Dirattr     uint32
+	Fileattr    uint32
+	Forkattr    uint32
+}
+
 const (
 	PathMax = 0x400
 )
@@ -366,30 +376,57 @@ type ICMPv6Filter struct {
 	Filt [8]uint32
 }
 
+type TCPConnectionInfo struct {
+	State               uint8
+	Snd_wscale          uint8
+	Rcv_wscale          uint8
+	_                   uint8
+	Options             uint32
+	Flags               uint32
+	Rto                 uint32
+	Maxseg              uint32
+	Snd_ssthresh        uint32
+	Snd_cwnd            uint32
+	Snd_wnd             uint32
+	Snd_sbbytes         uint32
+	Rcv_wnd             uint32
+	Rttcur              uint32
+	Srtt                uint32
+	Rttvar              uint32
+	Txpackets           uint64
+	Txbytes             uint64
+	Txretransmitbytes   uint64
+	Rxpackets           uint64
+	Rxbytes             uint64
+	Rxoutoforderbytes   uint64
+	Txretransmitpackets uint64
+}
+
 const (
-	SizeofSockaddrInet4    = 0x10
-	SizeofSockaddrInet6    = 0x1c
-	SizeofSockaddrAny      = 0x6c
-	SizeofSockaddrUnix     = 0x6a
-	SizeofSockaddrDatalink = 0x14
-	SizeofSockaddrCtl      = 0x20
-	SizeofSockaddrVM       = 0xc
-	SizeofXvsockpcb        = 0xa8
-	SizeofXSocket          = 0x64
-	SizeofXSockbuf         = 0x18
-	SizeofXVSockPgen       = 0x20
-	SizeofXucred           = 0x4c
-	SizeofLinger           = 0x8
-	SizeofIovec            = 0x10
-	SizeofIPMreq           = 0x8
-	SizeofIPMreqn          = 0xc
-	SizeofIPv6Mreq         = 0x14
-	SizeofMsghdr           = 0x30
-	SizeofCmsghdr          = 0xc
-	SizeofInet4Pktinfo     = 0xc
-	SizeofInet6Pktinfo     = 0x14
-	SizeofIPv6MTUInfo      = 0x20
-	SizeofICMPv6Filter     = 0x20
+	SizeofSockaddrInet4     = 0x10
+	SizeofSockaddrInet6     = 0x1c
+	SizeofSockaddrAny       = 0x6c
+	SizeofSockaddrUnix      = 0x6a
+	SizeofSockaddrDatalink  = 0x14
+	SizeofSockaddrCtl       = 0x20
+	SizeofSockaddrVM        = 0xc
+	SizeofXvsockpcb         = 0xa8
+	SizeofXSocket           = 0x64
+	SizeofXSockbuf          = 0x18
+	SizeofXVSockPgen        = 0x20
+	SizeofXucred            = 0x4c
+	SizeofLinger            = 0x8
+	SizeofIovec             = 0x10
+	SizeofIPMreq            = 0x8
+	SizeofIPMreqn           = 0xc
+	SizeofIPv6Mreq          = 0x14
+	SizeofMsghdr            = 0x30
+	SizeofCmsghdr           = 0xc
+	SizeofInet4Pktinfo      = 0xc
+	SizeofInet6Pktinfo      = 0x14
+	SizeofIPv6MTUInfo       = 0x20
+	SizeofICMPv6Filter      = 0x20
+	SizeofTCPConnectionInfo = 0x70
 )
 
 const (
@@ -583,6 +620,7 @@ const (
 	AT_REMOVEDIR        = 0x80
 	AT_SYMLINK_FOLLOW   = 0x40
 	AT_SYMLINK_NOFOLLOW = 0x20
+	AT_EACCESS          = 0x10
 )
 
 type PollFd struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_darwin_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_darwin_arm64.go
index b23c02337d..5bffc10eac 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_darwin_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_darwin_arm64.go
@@ -151,6 +151,16 @@ type Dirent struct {
 	_       [3]byte
 }
 
+type Attrlist struct {
+	Bitmapcount uint16
+	Reserved    uint16
+	Commonattr  uint32
+	Volattr     uint32
+	Dirattr     uint32
+	Fileattr    uint32
+	Forkattr    uint32
+}
+
 const (
 	PathMax = 0x400
 )
@@ -366,30 +376,57 @@ type ICMPv6Filter struct {
 	Filt [8]uint32
 }
 
+type TCPConnectionInfo struct {
+	State               uint8
+	Snd_wscale          uint8
+	Rcv_wscale          uint8
+	_                   uint8
+	Options             uint32
+	Flags               uint32
+	Rto                 uint32
+	Maxseg              uint32
+	Snd_ssthresh        uint32
+	Snd_cwnd            uint32
+	Snd_wnd             uint32
+	Snd_sbbytes         uint32
+	Rcv_wnd             uint32
+	Rttcur              uint32
+	Srtt                uint32
+	Rttvar              uint32
+	Txpackets           uint64
+	Txbytes             uint64
+	Txretransmitbytes   uint64
+	Rxpackets           uint64
+	Rxbytes             uint64
+	Rxoutoforderbytes   uint64
+	Txretransmitpackets uint64
+}
+
 const (
-	SizeofSockaddrInet4    = 0x10
-	SizeofSockaddrInet6    = 0x1c
-	SizeofSockaddrAny      = 0x6c
-	SizeofSockaddrUnix     = 0x6a
-	SizeofSockaddrDatalink = 0x14
-	SizeofSockaddrCtl      = 0x20
-	SizeofSockaddrVM       = 0xc
-	SizeofXvsockpcb        = 0xa8
-	SizeofXSocket          = 0x64
-	SizeofXSockbuf         = 0x18
-	SizeofXVSockPgen       = 0x20
-	SizeofXucred           = 0x4c
-	SizeofLinger           = 0x8
-	SizeofIovec            = 0x10
-	SizeofIPMreq           = 0x8
-	SizeofIPMreqn          = 0xc
-	SizeofIPv6Mreq         = 0x14
-	SizeofMsghdr           = 0x30
-	SizeofCmsghdr          = 0xc
-	SizeofInet4Pktinfo     = 0xc
-	SizeofInet6Pktinfo     = 0x14
-	SizeofIPv6MTUInfo      = 0x20
-	SizeofICMPv6Filter     = 0x20
+	SizeofSockaddrInet4     = 0x10
+	SizeofSockaddrInet6     = 0x1c
+	SizeofSockaddrAny       = 0x6c
+	SizeofSockaddrUnix      = 0x6a
+	SizeofSockaddrDatalink  = 0x14
+	SizeofSockaddrCtl       = 0x20
+	SizeofSockaddrVM        = 0xc
+	SizeofXvsockpcb         = 0xa8
+	SizeofXSocket           = 0x64
+	SizeofXSockbuf          = 0x18
+	SizeofXVSockPgen        = 0x20
+	SizeofXucred            = 0x4c
+	SizeofLinger            = 0x8
+	SizeofIovec             = 0x10
+	SizeofIPMreq            = 0x8
+	SizeofIPMreqn           = 0xc
+	SizeofIPv6Mreq          = 0x14
+	SizeofMsghdr            = 0x30
+	SizeofCmsghdr           = 0xc
+	SizeofInet4Pktinfo      = 0xc
+	SizeofInet6Pktinfo      = 0x14
+	SizeofIPv6MTUInfo       = 0x20
+	SizeofICMPv6Filter      = 0x20
+	SizeofTCPConnectionInfo = 0x70
 )
 
 const (
@@ -583,6 +620,7 @@ const (
 	AT_REMOVEDIR        = 0x80
 	AT_SYMLINK_FOLLOW   = 0x40
 	AT_SYMLINK_NOFOLLOW = 0x20
+	AT_EACCESS          = 0x10
 )
 
 type PollFd struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_freebsd_386.go b/vendor/golang.org/x/sys/unix/ztypes_freebsd_386.go
index 4eec078e52..29dc483378 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_freebsd_386.go
@@ -90,27 +90,6 @@ type Stat_t struct {
 	Spare   [10]uint64
 }
 
-type stat_freebsd11_t struct {
-	Dev     uint32
-	Ino     uint32
-	Mode    uint16
-	Nlink   uint16
-	Uid     uint32
-	Gid     uint32
-	Rdev    uint32
-	Atim    Timespec
-	Mtim    Timespec
-	Ctim    Timespec
-	Size    int64
-	Blocks  int64
-	Blksize int32
-	Flags   uint32
-	Gen     uint32
-	Lspare  int32
-	Btim    Timespec
-	_       [8]byte
-}
-
 type Statfs_t struct {
 	Version     uint32
 	Type        uint32
@@ -136,31 +115,6 @@ type Statfs_t struct {
 	Mntonname   [1024]byte
 }
 
-type statfs_freebsd11_t struct {
-	Version     uint32
-	Type        uint32
-	Flags       uint64
-	Bsize       uint64
-	Iosize      uint64
-	Blocks      uint64
-	Bfree       uint64
-	Bavail      int64
-	Files       uint64
-	Ffree       int64
-	Syncwrites  uint64
-	Asyncwrites uint64
-	Syncreads   uint64
-	Asyncreads  uint64
-	Spare       [10]uint64
-	Namemax     uint32
-	Owner       uint32
-	Fsid        Fsid
-	Charspare   [80]int8
-	Fstypename  [16]byte
-	Mntfromname [88]byte
-	Mntonname   [88]byte
-}
-
 type Flock_t struct {
 	Start  int64
 	Len    int64
@@ -181,14 +135,6 @@ type Dirent struct {
 	Name   [256]int8
 }
 
-type dirent_freebsd11 struct {
-	Fileno uint32
-	Reclen uint16
-	Type   uint8
-	Namlen uint8
-	Name   [256]int8
-}
-
 type Fsid struct {
 	Val [2]int32
 }
@@ -337,41 +283,9 @@ const (
 )
 
 const (
-	PTRACE_ATTACH     = 0xa
-	PTRACE_CONT       = 0x7
-	PTRACE_DETACH     = 0xb
-	PTRACE_GETFPREGS  = 0x23
-	PTRACE_GETFSBASE  = 0x47
-	PTRACE_GETLWPLIST = 0xf
-	PTRACE_GETNUMLWPS = 0xe
-	PTRACE_GETREGS    = 0x21
-	PTRACE_GETXSTATE  = 0x45
-	PTRACE_IO         = 0xc
-	PTRACE_KILL       = 0x8
-	PTRACE_LWPEVENTS  = 0x18
-	PTRACE_LWPINFO    = 0xd
-	PTRACE_SETFPREGS  = 0x24
-	PTRACE_SETREGS    = 0x22
-	PTRACE_SINGLESTEP = 0x9
-	PTRACE_TRACEME    = 0x0
-)
-
-const (
-	PIOD_READ_D  = 0x1
-	PIOD_WRITE_D = 0x2
-	PIOD_READ_I  = 0x3
-	PIOD_WRITE_I = 0x4
-)
-
-const (
-	PL_FLAG_BORN   = 0x100
-	PL_FLAG_EXITED = 0x200
-	PL_FLAG_SI     = 0x20
-)
-
-const (
-	TRAP_BRKPT = 0x1
-	TRAP_TRACE = 0x2
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
 )
 
 type PtraceLwpInfoStruct struct {
@@ -380,7 +294,7 @@ type PtraceLwpInfoStruct struct {
 	Flags        int32
 	Sigmask      Sigset_t
 	Siglist      Sigset_t
-	Siginfo      __Siginfo
+	Siginfo      __PtraceSiginfo
 	Tdname       [20]int8
 	Child_pid    int32
 	Syscall_code uint32
@@ -398,6 +312,17 @@ type __Siginfo struct {
 	Value  [4]byte
 	_      [32]byte
 }
+type __PtraceSiginfo struct {
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   uintptr
+	Value  [4]byte
+	_      [32]byte
+}
 
 type Sigset_t struct {
 	Val [4]uint32
@@ -432,9 +357,11 @@ type FpReg struct {
 	Pad   [64]uint8
 }
 
+type FpExtendedPrecision struct{}
+
 type PtraceIoDesc struct {
 	Op   int32
-	Offs *byte
+	Offs uintptr
 	Addr *byte
 	Len  uint32
 }
@@ -444,8 +371,9 @@ type Kevent_t struct {
 	Filter int16
 	Flags  uint16
 	Fflags uint32
-	Data   int32
+	Data   int64
 	Udata  *byte
+	Ext    [4]uint64
 }
 
 type FdSet struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_freebsd_amd64.go
index 7622904a53..0a89b28906 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_freebsd_amd64.go
@@ -86,26 +86,6 @@ type Stat_t struct {
 	Spare   [10]uint64
 }
 
-type stat_freebsd11_t struct {
-	Dev     uint32
-	Ino     uint32
-	Mode    uint16
-	Nlink   uint16
-	Uid     uint32
-	Gid     uint32
-	Rdev    uint32
-	Atim    Timespec
-	Mtim    Timespec
-	Ctim    Timespec
-	Size    int64
-	Blocks  int64
-	Blksize int32
-	Flags   uint32
-	Gen     uint32
-	Lspare  int32
-	Btim    Timespec
-}
-
 type Statfs_t struct {
 	Version     uint32
 	Type        uint32
@@ -131,31 +111,6 @@ type Statfs_t struct {
 	Mntonname   [1024]byte
 }
 
-type statfs_freebsd11_t struct {
-	Version     uint32
-	Type        uint32
-	Flags       uint64
-	Bsize       uint64
-	Iosize      uint64
-	Blocks      uint64
-	Bfree       uint64
-	Bavail      int64
-	Files       uint64
-	Ffree       int64
-	Syncwrites  uint64
-	Asyncwrites uint64
-	Syncreads   uint64
-	Asyncreads  uint64
-	Spare       [10]uint64
-	Namemax     uint32
-	Owner       uint32
-	Fsid        Fsid
-	Charspare   [80]int8
-	Fstypename  [16]byte
-	Mntfromname [88]byte
-	Mntonname   [88]byte
-}
-
 type Flock_t struct {
 	Start  int64
 	Len    int64
@@ -177,14 +132,6 @@ type Dirent struct {
 	Name   [256]int8
 }
 
-type dirent_freebsd11 struct {
-	Fileno uint32
-	Reclen uint16
-	Type   uint8
-	Namlen uint8
-	Name   [256]int8
-}
-
 type Fsid struct {
 	Val [2]int32
 }
@@ -333,41 +280,9 @@ const (
 )
 
 const (
-	PTRACE_ATTACH     = 0xa
-	PTRACE_CONT       = 0x7
-	PTRACE_DETACH     = 0xb
-	PTRACE_GETFPREGS  = 0x23
-	PTRACE_GETFSBASE  = 0x47
-	PTRACE_GETLWPLIST = 0xf
-	PTRACE_GETNUMLWPS = 0xe
-	PTRACE_GETREGS    = 0x21
-	PTRACE_GETXSTATE  = 0x45
-	PTRACE_IO         = 0xc
-	PTRACE_KILL       = 0x8
-	PTRACE_LWPEVENTS  = 0x18
-	PTRACE_LWPINFO    = 0xd
-	PTRACE_SETFPREGS  = 0x24
-	PTRACE_SETREGS    = 0x22
-	PTRACE_SINGLESTEP = 0x9
-	PTRACE_TRACEME    = 0x0
-)
-
-const (
-	PIOD_READ_D  = 0x1
-	PIOD_WRITE_D = 0x2
-	PIOD_READ_I  = 0x3
-	PIOD_WRITE_I = 0x4
-)
-
-const (
-	PL_FLAG_BORN   = 0x100
-	PL_FLAG_EXITED = 0x200
-	PL_FLAG_SI     = 0x20
-)
-
-const (
-	TRAP_BRKPT = 0x1
-	TRAP_TRACE = 0x2
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
 )
 
 type PtraceLwpInfoStruct struct {
@@ -376,7 +291,7 @@ type PtraceLwpInfoStruct struct {
 	Flags        int32
 	Sigmask      Sigset_t
 	Siglist      Sigset_t
-	Siginfo      __Siginfo
+	Siginfo      __PtraceSiginfo
 	Tdname       [20]int8
 	Child_pid    int32
 	Syscall_code uint32
@@ -395,6 +310,18 @@ type __Siginfo struct {
 	_      [40]byte
 }
 
+type __PtraceSiginfo struct {
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   uintptr
+	Value  [8]byte
+	_      [40]byte
+}
+
 type Sigset_t struct {
 	Val [4]uint32
 }
@@ -435,9 +362,11 @@ type FpReg struct {
 	Spare [12]uint64
 }
 
+type FpExtendedPrecision struct{}
+
 type PtraceIoDesc struct {
 	Op   int32
-	Offs *byte
+	Offs uintptr
 	Addr *byte
 	Len  uint64
 }
@@ -449,6 +378,7 @@ type Kevent_t struct {
 	Fflags uint32
 	Data   int64
 	Udata  *byte
+	Ext    [4]uint64
 }
 
 type FdSet struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm.go b/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm.go
index 19223ce8ec..c8666bb152 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm.go
@@ -33,7 +33,7 @@ type Timeval struct {
 	_    [4]byte
 }
 
-type Time_t int32
+type Time_t int64
 
 type Rusage struct {
 	Utime    Timeval
@@ -88,26 +88,6 @@ type Stat_t struct {
 	Spare   [10]uint64
 }
 
-type stat_freebsd11_t struct {
-	Dev     uint32
-	Ino     uint32
-	Mode    uint16
-	Nlink   uint16
-	Uid     uint32
-	Gid     uint32
-	Rdev    uint32
-	Atim    Timespec
-	Mtim    Timespec
-	Ctim    Timespec
-	Size    int64
-	Blocks  int64
-	Blksize int32
-	Flags   uint32
-	Gen     uint32
-	Lspare  int32
-	Btim    Timespec
-}
-
 type Statfs_t struct {
 	Version     uint32
 	Type        uint32
@@ -133,31 +113,6 @@ type Statfs_t struct {
 	Mntonname   [1024]byte
 }
 
-type statfs_freebsd11_t struct {
-	Version     uint32
-	Type        uint32
-	Flags       uint64
-	Bsize       uint64
-	Iosize      uint64
-	Blocks      uint64
-	Bfree       uint64
-	Bavail      int64
-	Files       uint64
-	Ffree       int64
-	Syncwrites  uint64
-	Asyncwrites uint64
-	Syncreads   uint64
-	Asyncreads  uint64
-	Spare       [10]uint64
-	Namemax     uint32
-	Owner       uint32
-	Fsid        Fsid
-	Charspare   [80]int8
-	Fstypename  [16]byte
-	Mntfromname [88]byte
-	Mntonname   [88]byte
-}
-
 type Flock_t struct {
 	Start  int64
 	Len    int64
@@ -179,14 +134,6 @@ type Dirent struct {
 	Name   [256]int8
 }
 
-type dirent_freebsd11 struct {
-	Fileno uint32
-	Reclen uint16
-	Type   uint8
-	Namlen uint8
-	Name   [256]int8
-}
-
 type Fsid struct {
 	Val [2]int32
 }
@@ -335,41 +282,9 @@ const (
 )
 
 const (
-	PTRACE_ATTACH     = 0xa
-	PTRACE_CONT       = 0x7
-	PTRACE_DETACH     = 0xb
-	PTRACE_GETFPREGS  = 0x23
-	PTRACE_GETFSBASE  = 0x47
-	PTRACE_GETLWPLIST = 0xf
-	PTRACE_GETNUMLWPS = 0xe
-	PTRACE_GETREGS    = 0x21
-	PTRACE_GETXSTATE  = 0x45
-	PTRACE_IO         = 0xc
-	PTRACE_KILL       = 0x8
-	PTRACE_LWPEVENTS  = 0x18
-	PTRACE_LWPINFO    = 0xd
-	PTRACE_SETFPREGS  = 0x24
-	PTRACE_SETREGS    = 0x22
-	PTRACE_SINGLESTEP = 0x9
-	PTRACE_TRACEME    = 0x0
-)
-
-const (
-	PIOD_READ_D  = 0x1
-	PIOD_WRITE_D = 0x2
-	PIOD_READ_I  = 0x3
-	PIOD_WRITE_I = 0x4
-)
-
-const (
-	PL_FLAG_BORN   = 0x100
-	PL_FLAG_EXITED = 0x200
-	PL_FLAG_SI     = 0x20
-)
-
-const (
-	TRAP_BRKPT = 0x1
-	TRAP_TRACE = 0x2
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
 )
 
 type PtraceLwpInfoStruct struct {
@@ -378,7 +293,7 @@ type PtraceLwpInfoStruct struct {
 	Flags        int32
 	Sigmask      Sigset_t
 	Siglist      Sigset_t
-	Siginfo      __Siginfo
+	Siginfo      __PtraceSiginfo
 	Tdname       [20]int8
 	Child_pid    int32
 	Syscall_code uint32
@@ -386,15 +301,27 @@ type PtraceLwpInfoStruct struct {
 }
 
 type __Siginfo struct {
-	Signo    int32
-	Errno    int32
-	Code     int32
-	Pid      int32
-	Uid      uint32
-	Status   int32
-	Addr     *byte
-	Value    [4]byte
-	X_reason [32]byte
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   *byte
+	Value  [4]byte
+	_      [32]byte
+}
+
+type __PtraceSiginfo struct {
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   uintptr
+	Value  [4]byte
+	_      [32]byte
 }
 
 type Sigset_t struct {
@@ -402,21 +329,27 @@ type Sigset_t struct {
 }
 
 type Reg struct {
-	R      [13]uint32
-	R_sp   uint32
-	R_lr   uint32
-	R_pc   uint32
-	R_cpsr uint32
+	R    [13]uint32
+	Sp   uint32
+	Lr   uint32
+	Pc   uint32
+	Cpsr uint32
 }
 
 type FpReg struct {
-	Fpr_fpsr uint32
-	Fpr      [8][3]uint32
+	Fpsr uint32
+	Fpr  [8]FpExtendedPrecision
+}
+
+type FpExtendedPrecision struct {
+	Exponent    uint32
+	Mantissa_hi uint32
+	Mantissa_lo uint32
 }
 
 type PtraceIoDesc struct {
 	Op   int32
-	Offs *byte
+	Offs uintptr
 	Addr *byte
 	Len  uint32
 }
@@ -426,8 +359,11 @@ type Kevent_t struct {
 	Filter int16
 	Flags  uint16
 	Fflags uint32
-	Data   int32
+	_      [4]byte
+	Data   int64
 	Udata  *byte
+	_      [4]byte
+	Ext    [4]uint64
 }
 
 type FdSet struct {
@@ -453,7 +389,7 @@ type ifMsghdr struct {
 	Addrs   int32
 	Flags   int32
 	Index   uint16
-	_       [2]byte
+	_       uint16
 	Data    ifData
 }
 
@@ -464,7 +400,6 @@ type IfMsghdr struct {
 	Addrs   int32
 	Flags   int32
 	Index   uint16
-	_       [2]byte
 	Data    IfData
 }
 
@@ -532,7 +467,7 @@ type IfaMsghdr struct {
 	Addrs   int32
 	Flags   int32
 	Index   uint16
-	_       [2]byte
+	_       uint16
 	Metric  int32
 }
 
@@ -543,7 +478,7 @@ type IfmaMsghdr struct {
 	Addrs   int32
 	Flags   int32
 	Index   uint16
-	_       [2]byte
+	_       uint16
 }
 
 type IfAnnounceMsghdr struct {
@@ -560,7 +495,7 @@ type RtMsghdr struct {
 	Version uint8
 	Type    uint8
 	Index   uint16
-	_       [2]byte
+	_       uint16
 	Flags   int32
 	Addrs   int32
 	Pid     int32
diff --git a/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go
index 8e3e33f679..88fb48a887 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_freebsd_arm64.go
@@ -86,26 +86,6 @@ type Stat_t struct {
 	Spare   [10]uint64
 }
 
-type stat_freebsd11_t struct {
-	Dev     uint32
-	Ino     uint32
-	Mode    uint16
-	Nlink   uint16
-	Uid     uint32
-	Gid     uint32
-	Rdev    uint32
-	Atim    Timespec
-	Mtim    Timespec
-	Ctim    Timespec
-	Size    int64
-	Blocks  int64
-	Blksize int32
-	Flags   uint32
-	Gen     uint32
-	Lspare  int32
-	Btim    Timespec
-}
-
 type Statfs_t struct {
 	Version     uint32
 	Type        uint32
@@ -131,31 +111,6 @@ type Statfs_t struct {
 	Mntonname   [1024]byte
 }
 
-type statfs_freebsd11_t struct {
-	Version     uint32
-	Type        uint32
-	Flags       uint64
-	Bsize       uint64
-	Iosize      uint64
-	Blocks      uint64
-	Bfree       uint64
-	Bavail      int64
-	Files       uint64
-	Ffree       int64
-	Syncwrites  uint64
-	Asyncwrites uint64
-	Syncreads   uint64
-	Asyncreads  uint64
-	Spare       [10]uint64
-	Namemax     uint32
-	Owner       uint32
-	Fsid        Fsid
-	Charspare   [80]int8
-	Fstypename  [16]byte
-	Mntfromname [88]byte
-	Mntonname   [88]byte
-}
-
 type Flock_t struct {
 	Start  int64
 	Len    int64
@@ -177,14 +132,6 @@ type Dirent struct {
 	Name   [256]int8
 }
 
-type dirent_freebsd11 struct {
-	Fileno uint32
-	Reclen uint16
-	Type   uint8
-	Namlen uint8
-	Name   [256]int8
-}
-
 type Fsid struct {
 	Val [2]int32
 }
@@ -333,39 +280,9 @@ const (
 )
 
 const (
-	PTRACE_ATTACH     = 0xa
-	PTRACE_CONT       = 0x7
-	PTRACE_DETACH     = 0xb
-	PTRACE_GETFPREGS  = 0x23
-	PTRACE_GETLWPLIST = 0xf
-	PTRACE_GETNUMLWPS = 0xe
-	PTRACE_GETREGS    = 0x21
-	PTRACE_IO         = 0xc
-	PTRACE_KILL       = 0x8
-	PTRACE_LWPEVENTS  = 0x18
-	PTRACE_LWPINFO    = 0xd
-	PTRACE_SETFPREGS  = 0x24
-	PTRACE_SETREGS    = 0x22
-	PTRACE_SINGLESTEP = 0x9
-	PTRACE_TRACEME    = 0x0
-)
-
-const (
-	PIOD_READ_D  = 0x1
-	PIOD_WRITE_D = 0x2
-	PIOD_READ_I  = 0x3
-	PIOD_WRITE_I = 0x4
-)
-
-const (
-	PL_FLAG_BORN   = 0x100
-	PL_FLAG_EXITED = 0x200
-	PL_FLAG_SI     = 0x20
-)
-
-const (
-	TRAP_BRKPT = 0x1
-	TRAP_TRACE = 0x2
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
 )
 
 type PtraceLwpInfoStruct struct {
@@ -374,7 +291,7 @@ type PtraceLwpInfoStruct struct {
 	Flags        int32
 	Sigmask      Sigset_t
 	Siglist      Sigset_t
-	Siginfo      __Siginfo
+	Siginfo      __PtraceSiginfo
 	Tdname       [20]int8
 	Child_pid    int32
 	Syscall_code uint32
@@ -393,6 +310,18 @@ type __Siginfo struct {
 	_      [40]byte
 }
 
+type __PtraceSiginfo struct {
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   uintptr
+	Value  [8]byte
+	_      [40]byte
+}
+
 type Sigset_t struct {
 	Val [4]uint32
 }
@@ -413,9 +342,11 @@ type FpReg struct {
 	_  [8]byte
 }
 
+type FpExtendedPrecision struct{}
+
 type PtraceIoDesc struct {
 	Op   int32
-	Offs *byte
+	Offs uintptr
 	Addr *byte
 	Len  uint64
 }
@@ -427,6 +358,7 @@ type Kevent_t struct {
 	Fflags uint32
 	Data   int64
 	Udata  *byte
+	Ext    [4]uint64
 }
 
 type FdSet struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/ztypes_freebsd_riscv64.go
new file mode 100644
index 0000000000..698dc975e9
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/ztypes_freebsd_riscv64.go
@@ -0,0 +1,638 @@
+// cgo -godefs -- -fsigned-char types_freebsd.go | go run mkpost.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build riscv64 && freebsd
+// +build riscv64,freebsd
+
+package unix
+
+const (
+	SizeofPtr      = 0x8
+	SizeofShort    = 0x2
+	SizeofInt      = 0x4
+	SizeofLong     = 0x8
+	SizeofLongLong = 0x8
+)
+
+type (
+	_C_short     int16
+	_C_int       int32
+	_C_long      int64
+	_C_long_long int64
+)
+
+type Timespec struct {
+	Sec  int64
+	Nsec int64
+}
+
+type Timeval struct {
+	Sec  int64
+	Usec int64
+}
+
+type Time_t int64
+
+type Rusage struct {
+	Utime    Timeval
+	Stime    Timeval
+	Maxrss   int64
+	Ixrss    int64
+	Idrss    int64
+	Isrss    int64
+	Minflt   int64
+	Majflt   int64
+	Nswap    int64
+	Inblock  int64
+	Oublock  int64
+	Msgsnd   int64
+	Msgrcv   int64
+	Nsignals int64
+	Nvcsw    int64
+	Nivcsw   int64
+}
+
+type Rlimit struct {
+	Cur int64
+	Max int64
+}
+
+type _Gid_t uint32
+
+const (
+	_statfsVersion = 0x20140518
+	_dirblksiz     = 0x400
+)
+
+type Stat_t struct {
+	Dev     uint64
+	Ino     uint64
+	Nlink   uint64
+	Mode    uint16
+	_0      int16
+	Uid     uint32
+	Gid     uint32
+	_1      int32
+	Rdev    uint64
+	Atim    Timespec
+	Mtim    Timespec
+	Ctim    Timespec
+	Btim    Timespec
+	Size    int64
+	Blocks  int64
+	Blksize int32
+	Flags   uint32
+	Gen     uint64
+	Spare   [10]uint64
+}
+
+type Statfs_t struct {
+	Version     uint32
+	Type        uint32
+	Flags       uint64
+	Bsize       uint64
+	Iosize      uint64
+	Blocks      uint64
+	Bfree       uint64
+	Bavail      int64
+	Files       uint64
+	Ffree       int64
+	Syncwrites  uint64
+	Asyncwrites uint64
+	Syncreads   uint64
+	Asyncreads  uint64
+	Spare       [10]uint64
+	Namemax     uint32
+	Owner       uint32
+	Fsid        Fsid
+	Charspare   [80]int8
+	Fstypename  [16]byte
+	Mntfromname [1024]byte
+	Mntonname   [1024]byte
+}
+
+type Flock_t struct {
+	Start  int64
+	Len    int64
+	Pid    int32
+	Type   int16
+	Whence int16
+	Sysid  int32
+	_      [4]byte
+}
+
+type Dirent struct {
+	Fileno uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Pad0   uint8
+	Namlen uint16
+	Pad1   uint16
+	Name   [256]int8
+}
+
+type Fsid struct {
+	Val [2]int32
+}
+
+const (
+	PathMax = 0x400
+)
+
+const (
+	FADV_NORMAL     = 0x0
+	FADV_RANDOM     = 0x1
+	FADV_SEQUENTIAL = 0x2
+	FADV_WILLNEED   = 0x3
+	FADV_DONTNEED   = 0x4
+	FADV_NOREUSE    = 0x5
+)
+
+type RawSockaddrInet4 struct {
+	Len    uint8
+	Family uint8
+	Port   uint16
+	Addr   [4]byte /* in_addr */
+	Zero   [8]int8
+}
+
+type RawSockaddrInet6 struct {
+	Len      uint8
+	Family   uint8
+	Port     uint16
+	Flowinfo uint32
+	Addr     [16]byte /* in6_addr */
+	Scope_id uint32
+}
+
+type RawSockaddrUnix struct {
+	Len    uint8
+	Family uint8
+	Path   [104]int8
+}
+
+type RawSockaddrDatalink struct {
+	Len    uint8
+	Family uint8
+	Index  uint16
+	Type   uint8
+	Nlen   uint8
+	Alen   uint8
+	Slen   uint8
+	Data   [46]int8
+}
+
+type RawSockaddr struct {
+	Len    uint8
+	Family uint8
+	Data   [14]int8
+}
+
+type RawSockaddrAny struct {
+	Addr RawSockaddr
+	Pad  [92]int8
+}
+
+type _Socklen uint32
+
+type Xucred struct {
+	Version uint32
+	Uid     uint32
+	Ngroups int16
+	Groups  [16]uint32
+	_       *byte
+}
+
+type Linger struct {
+	Onoff  int32
+	Linger int32
+}
+
+type Iovec struct {
+	Base *byte
+	Len  uint64
+}
+
+type IPMreq struct {
+	Multiaddr [4]byte /* in_addr */
+	Interface [4]byte /* in_addr */
+}
+
+type IPMreqn struct {
+	Multiaddr [4]byte /* in_addr */
+	Address   [4]byte /* in_addr */
+	Ifindex   int32
+}
+
+type IPv6Mreq struct {
+	Multiaddr [16]byte /* in6_addr */
+	Interface uint32
+}
+
+type Msghdr struct {
+	Name       *byte
+	Namelen    uint32
+	Iov        *Iovec
+	Iovlen     int32
+	Control    *byte
+	Controllen uint32
+	Flags      int32
+}
+
+type Cmsghdr struct {
+	Len   uint32
+	Level int32
+	Type  int32
+}
+
+type Inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex uint32
+}
+
+type IPv6MTUInfo struct {
+	Addr RawSockaddrInet6
+	Mtu  uint32
+}
+
+type ICMPv6Filter struct {
+	Filt [8]uint32
+}
+
+const (
+	SizeofSockaddrInet4    = 0x10
+	SizeofSockaddrInet6    = 0x1c
+	SizeofSockaddrAny      = 0x6c
+	SizeofSockaddrUnix     = 0x6a
+	SizeofSockaddrDatalink = 0x36
+	SizeofXucred           = 0x58
+	SizeofLinger           = 0x8
+	SizeofIovec            = 0x10
+	SizeofIPMreq           = 0x8
+	SizeofIPMreqn          = 0xc
+	SizeofIPv6Mreq         = 0x14
+	SizeofMsghdr           = 0x30
+	SizeofCmsghdr          = 0xc
+	SizeofInet6Pktinfo     = 0x14
+	SizeofIPv6MTUInfo      = 0x20
+	SizeofICMPv6Filter     = 0x20
+)
+
+const (
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
+)
+
+type PtraceLwpInfoStruct struct {
+	Lwpid        int32
+	Event        int32
+	Flags        int32
+	Sigmask      Sigset_t
+	Siglist      Sigset_t
+	Siginfo      __PtraceSiginfo
+	Tdname       [20]int8
+	Child_pid    int32
+	Syscall_code uint32
+	Syscall_narg uint32
+}
+
+type __Siginfo struct {
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   *byte
+	Value  [8]byte
+	_      [40]byte
+}
+
+type __PtraceSiginfo struct {
+	Signo  int32
+	Errno  int32
+	Code   int32
+	Pid    int32
+	Uid    uint32
+	Status int32
+	Addr   uintptr
+	Value  [8]byte
+	_      [40]byte
+}
+
+type Sigset_t struct {
+	Val [4]uint32
+}
+
+type Reg struct {
+	Ra      uint64
+	Sp      uint64
+	Gp      uint64
+	Tp      uint64
+	T       [7]uint64
+	S       [12]uint64
+	A       [8]uint64
+	Sepc    uint64
+	Sstatus uint64
+}
+
+type FpReg struct {
+	X    [32][2]uint64
+	Fcsr uint64
+}
+
+type FpExtendedPrecision struct{}
+
+type PtraceIoDesc struct {
+	Op   int32
+	Offs uintptr
+	Addr *byte
+	Len  uint64
+}
+
+type Kevent_t struct {
+	Ident  uint64
+	Filter int16
+	Flags  uint16
+	Fflags uint32
+	Data   int64
+	Udata  *byte
+	Ext    [4]uint64
+}
+
+type FdSet struct {
+	Bits [16]uint64
+}
+
+const (
+	sizeofIfMsghdr         = 0xa8
+	SizeofIfMsghdr         = 0xa8
+	sizeofIfData           = 0x98
+	SizeofIfData           = 0x98
+	SizeofIfaMsghdr        = 0x14
+	SizeofIfmaMsghdr       = 0x10
+	SizeofIfAnnounceMsghdr = 0x18
+	SizeofRtMsghdr         = 0x98
+	SizeofRtMetrics        = 0x70
+)
+
+type ifMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Addrs   int32
+	Flags   int32
+	Index   uint16
+	_       uint16
+	Data    ifData
+}
+
+type IfMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Addrs   int32
+	Flags   int32
+	Index   uint16
+	Data    IfData
+}
+
+type ifData struct {
+	Type       uint8
+	Physical   uint8
+	Addrlen    uint8
+	Hdrlen     uint8
+	Link_state uint8
+	Vhid       uint8
+	Datalen    uint16
+	Mtu        uint32
+	Metric     uint32
+	Baudrate   uint64
+	Ipackets   uint64
+	Ierrors    uint64
+	Opackets   uint64
+	Oerrors    uint64
+	Collisions uint64
+	Ibytes     uint64
+	Obytes     uint64
+	Imcasts    uint64
+	Omcasts    uint64
+	Iqdrops    uint64
+	Oqdrops    uint64
+	Noproto    uint64
+	Hwassist   uint64
+	_          [8]byte
+	_          [16]byte
+}
+
+type IfData struct {
+	Type        uint8
+	Physical    uint8
+	Addrlen     uint8
+	Hdrlen      uint8
+	Link_state  uint8
+	Spare_char1 uint8
+	Spare_char2 uint8
+	Datalen     uint8
+	Mtu         uint64
+	Metric      uint64
+	Baudrate    uint64
+	Ipackets    uint64
+	Ierrors     uint64
+	Opackets    uint64
+	Oerrors     uint64
+	Collisions  uint64
+	Ibytes      uint64
+	Obytes      uint64
+	Imcasts     uint64
+	Omcasts     uint64
+	Iqdrops     uint64
+	Noproto     uint64
+	Hwassist    uint64
+	Epoch       int64
+	Lastchange  Timeval
+}
+
+type IfaMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Addrs   int32
+	Flags   int32
+	Index   uint16
+	_       uint16
+	Metric  int32
+}
+
+type IfmaMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Addrs   int32
+	Flags   int32
+	Index   uint16
+	_       uint16
+}
+
+type IfAnnounceMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Index   uint16
+	Name    [16]int8
+	What    uint16
+}
+
+type RtMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Index   uint16
+	_       uint16
+	Flags   int32
+	Addrs   int32
+	Pid     int32
+	Seq     int32
+	Errno   int32
+	Fmask   int32
+	Inits   uint64
+	Rmx     RtMetrics
+}
+
+type RtMetrics struct {
+	Locks    uint64
+	Mtu      uint64
+	Hopcount uint64
+	Expire   uint64
+	Recvpipe uint64
+	Sendpipe uint64
+	Ssthresh uint64
+	Rtt      uint64
+	Rttvar   uint64
+	Pksent   uint64
+	Weight   uint64
+	Nhidx    uint64
+	Filler   [2]uint64
+}
+
+const (
+	SizeofBpfVersion    = 0x4
+	SizeofBpfStat       = 0x8
+	SizeofBpfZbuf       = 0x18
+	SizeofBpfProgram    = 0x10
+	SizeofBpfInsn       = 0x8
+	SizeofBpfHdr        = 0x20
+	SizeofBpfZbufHeader = 0x20
+)
+
+type BpfVersion struct {
+	Major uint16
+	Minor uint16
+}
+
+type BpfStat struct {
+	Recv uint32
+	Drop uint32
+}
+
+type BpfZbuf struct {
+	Bufa   *byte
+	Bufb   *byte
+	Buflen uint64
+}
+
+type BpfProgram struct {
+	Len   uint32
+	Insns *BpfInsn
+}
+
+type BpfInsn struct {
+	Code uint16
+	Jt   uint8
+	Jf   uint8
+	K    uint32
+}
+
+type BpfHdr struct {
+	Tstamp  Timeval
+	Caplen  uint32
+	Datalen uint32
+	Hdrlen  uint16
+	_       [6]byte
+}
+
+type BpfZbufHeader struct {
+	Kernel_gen uint32
+	Kernel_len uint32
+	User_gen   uint32
+	_          [5]uint32
+}
+
+type Termios struct {
+	Iflag  uint32
+	Oflag  uint32
+	Cflag  uint32
+	Lflag  uint32
+	Cc     [20]uint8
+	Ispeed uint32
+	Ospeed uint32
+}
+
+type Winsize struct {
+	Row    uint16
+	Col    uint16
+	Xpixel uint16
+	Ypixel uint16
+}
+
+const (
+	AT_FDCWD            = -0x64
+	AT_EACCESS          = 0x100
+	AT_SYMLINK_NOFOLLOW = 0x200
+	AT_SYMLINK_FOLLOW   = 0x400
+	AT_REMOVEDIR        = 0x800
+)
+
+type PollFd struct {
+	Fd      int32
+	Events  int16
+	Revents int16
+}
+
+const (
+	POLLERR      = 0x8
+	POLLHUP      = 0x10
+	POLLIN       = 0x1
+	POLLINIGNEOF = 0x2000
+	POLLNVAL     = 0x20
+	POLLOUT      = 0x4
+	POLLPRI      = 0x2
+	POLLRDBAND   = 0x80
+	POLLRDNORM   = 0x40
+	POLLWRBAND   = 0x100
+	POLLWRNORM   = 0x4
+)
+
+type CapRights struct {
+	Rights [2]uint64
+}
+
+type Utsname struct {
+	Sysname  [256]byte
+	Nodename [256]byte
+	Release  [256]byte
+	Version  [256]byte
+	Machine  [256]byte
+}
+
+const SizeofClockinfo = 0x14
+
+type Clockinfo struct {
+	Hz     int32
+	Tick   int32
+	Spare  int32
+	Stathz int32
+	Profhz int32
+}
diff --git a/vendor/golang.org/x/sys/unix/ztypes_illumos_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_illumos_amd64.go
deleted file mode 100644
index 4c485261d6..0000000000
--- a/vendor/golang.org/x/sys/unix/ztypes_illumos_amd64.go
+++ /dev/null
@@ -1,42 +0,0 @@
-// cgo -godefs types_illumos.go | go run mkpost.go
-// Code generated by the command above; see README.md. DO NOT EDIT.
-
-//go:build amd64 && illumos
-// +build amd64,illumos
-
-package unix
-
-const (
-	TUNNEWPPA = 0x540001
-	TUNSETPPA = 0x540002
-
-	I_STR     = 0x5308
-	I_POP     = 0x5303
-	I_PUSH    = 0x5302
-	I_LINK    = 0x530c
-	I_UNLINK  = 0x530d
-	I_PLINK   = 0x5316
-	I_PUNLINK = 0x5317
-
-	IF_UNITSEL = -0x7ffb8cca
-)
-
-type strbuf struct {
-	Maxlen int32
-	Len    int32
-	Buf    *int8
-}
-
-type Strioctl struct {
-	Cmd    int32
-	Timout int32
-	Len    int32
-	Dp     *int8
-}
-
-type Lifreq struct {
-	Name   [32]int8
-	Lifru1 [4]byte
-	Type   uint32
-	Lifru  [336]byte
-}
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux.go b/vendor/golang.org/x/sys/unix/ztypes_linux.go
index 620a6702fe..ca84727cfe 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go
@@ -1,4 +1,4 @@
-// Code generated by mkmerge.go; DO NOT EDIT.
+// Code generated by mkmerge; DO NOT EDIT.
 
 //go:build linux
 // +build linux
@@ -24,6 +24,46 @@ type ItimerSpec struct {
 	Value    Timespec
 }
 
+type Itimerval struct {
+	Interval Timeval
+	Value    Timeval
+}
+
+const (
+	ADJ_OFFSET            = 0x1
+	ADJ_FREQUENCY         = 0x2
+	ADJ_MAXERROR          = 0x4
+	ADJ_ESTERROR          = 0x8
+	ADJ_STATUS            = 0x10
+	ADJ_TIMECONST         = 0x20
+	ADJ_TAI               = 0x80
+	ADJ_SETOFFSET         = 0x100
+	ADJ_MICRO             = 0x1000
+	ADJ_NANO              = 0x2000
+	ADJ_TICK              = 0x4000
+	ADJ_OFFSET_SINGLESHOT = 0x8001
+	ADJ_OFFSET_SS_READ    = 0xa001
+)
+
+const (
+	STA_PLL       = 0x1
+	STA_PPSFREQ   = 0x2
+	STA_PPSTIME   = 0x4
+	STA_FLL       = 0x8
+	STA_INS       = 0x10
+	STA_DEL       = 0x20
+	STA_UNSYNC    = 0x40
+	STA_FREQHOLD  = 0x80
+	STA_PPSSIGNAL = 0x100
+	STA_PPSJITTER = 0x200
+	STA_PPSWANDER = 0x400
+	STA_PPSERROR  = 0x800
+	STA_CLOCKERR  = 0x1000
+	STA_NANO      = 0x2000
+	STA_MODE      = 0x4000
+	STA_CLK       = 0x8000
+)
+
 const (
 	TIME_OK    = 0x0
 	TIME_INS   = 0x1
@@ -48,29 +88,30 @@ type StatxTimestamp struct {
 }
 
 type Statx_t struct {
-	Mask            uint32
-	Blksize         uint32
-	Attributes      uint64
-	Nlink           uint32
-	Uid             uint32
-	Gid             uint32
-	Mode            uint16
-	_               [1]uint16
-	Ino             uint64
-	Size            uint64
-	Blocks          uint64
-	Attributes_mask uint64
-	Atime           StatxTimestamp
-	Btime           StatxTimestamp
-	Ctime           StatxTimestamp
-	Mtime           StatxTimestamp
-	Rdev_major      uint32
-	Rdev_minor      uint32
-	Dev_major       uint32
-	Dev_minor       uint32
-	Mnt_id          uint64
-	_               uint64
-	_               [12]uint64
+	Mask             uint32
+	Blksize          uint32
+	Attributes       uint64
+	Nlink            uint32
+	Uid              uint32
+	Gid              uint32
+	Mode             uint16
+	_                [1]uint16
+	Ino              uint64
+	Size             uint64
+	Blocks           uint64
+	Attributes_mask  uint64
+	Atime            StatxTimestamp
+	Btime            StatxTimestamp
+	Ctime            StatxTimestamp
+	Mtime            StatxTimestamp
+	Rdev_major       uint32
+	Rdev_minor       uint32
+	Dev_major        uint32
+	Dev_minor        uint32
+	Mnt_id           uint64
+	Dio_mem_align    uint32
+	Dio_offset_align uint32
+	_                [12]uint64
 }
 
 type Fsid struct {
@@ -415,36 +456,60 @@ type Ucred struct {
 }
 
 type TCPInfo struct {
-	State          uint8
-	Ca_state       uint8
-	Retransmits    uint8
-	Probes         uint8
-	Backoff        uint8
-	Options        uint8
-	Rto            uint32
-	Ato            uint32
-	Snd_mss        uint32
-	Rcv_mss        uint32
-	Unacked        uint32
-	Sacked         uint32
-	Lost           uint32
-	Retrans        uint32
-	Fackets        uint32
-	Last_data_sent uint32
-	Last_ack_sent  uint32
-	Last_data_recv uint32
-	Last_ack_recv  uint32
-	Pmtu           uint32
-	Rcv_ssthresh   uint32
-	Rtt            uint32
-	Rttvar         uint32
-	Snd_ssthresh   uint32
-	Snd_cwnd       uint32
-	Advmss         uint32
-	Reordering     uint32
-	Rcv_rtt        uint32
-	Rcv_space      uint32
-	Total_retrans  uint32
+	State           uint8
+	Ca_state        uint8
+	Retransmits     uint8
+	Probes          uint8
+	Backoff         uint8
+	Options         uint8
+	Rto             uint32
+	Ato             uint32
+	Snd_mss         uint32
+	Rcv_mss         uint32
+	Unacked         uint32
+	Sacked          uint32
+	Lost            uint32
+	Retrans         uint32
+	Fackets         uint32
+	Last_data_sent  uint32
+	Last_ack_sent   uint32
+	Last_data_recv  uint32
+	Last_ack_recv   uint32
+	Pmtu            uint32
+	Rcv_ssthresh    uint32
+	Rtt             uint32
+	Rttvar          uint32
+	Snd_ssthresh    uint32
+	Snd_cwnd        uint32
+	Advmss          uint32
+	Reordering      uint32
+	Rcv_rtt         uint32
+	Rcv_space       uint32
+	Total_retrans   uint32
+	Pacing_rate     uint64
+	Max_pacing_rate uint64
+	Bytes_acked     uint64
+	Bytes_received  uint64
+	Segs_out        uint32
+	Segs_in         uint32
+	Notsent_bytes   uint32
+	Min_rtt         uint32
+	Data_segs_in    uint32
+	Data_segs_out   uint32
+	Delivery_rate   uint64
+	Busy_time       uint64
+	Rwnd_limited    uint64
+	Sndbuf_limited  uint64
+	Delivered       uint32
+	Delivered_ce    uint32
+	Bytes_sent      uint64
+	Bytes_retrans   uint64
+	Dsack_dups      uint32
+	Reord_seen      uint32
+	Rcv_ooopack     uint32
+	Snd_wnd         uint32
+	Rcv_wnd         uint32
+	Rehash          uint32
 }
 
 type CanFilter struct {
@@ -487,7 +552,7 @@ const (
 	SizeofIPv6MTUInfo       = 0x20
 	SizeofICMPv6Filter      = 0x20
 	SizeofUcred             = 0xc
-	SizeofTCPInfo           = 0x68
+	SizeofTCPInfo           = 0xf0
 	SizeofCanFilter         = 0x8
 	SizeofTCPRepairOpt      = 0x8
 )
@@ -743,10 +808,31 @@ const (
 	AT_STATX_FORCE_SYNC   = 0x2000
 	AT_STATX_DONT_SYNC    = 0x4000
 
+	AT_RECURSIVE = 0x8000
+
 	AT_SYMLINK_FOLLOW   = 0x400
 	AT_SYMLINK_NOFOLLOW = 0x100
 
 	AT_EACCESS = 0x200
+
+	OPEN_TREE_CLONE = 0x1
+
+	MOVE_MOUNT_F_SYMLINKS   = 0x1
+	MOVE_MOUNT_F_AUTOMOUNTS = 0x2
+	MOVE_MOUNT_F_EMPTY_PATH = 0x4
+	MOVE_MOUNT_T_SYMLINKS   = 0x10
+	MOVE_MOUNT_T_AUTOMOUNTS = 0x20
+	MOVE_MOUNT_T_EMPTY_PATH = 0x40
+	MOVE_MOUNT_SET_GROUP    = 0x100
+
+	FSOPEN_CLOEXEC = 0x1
+
+	FSPICK_CLOEXEC          = 0x1
+	FSPICK_SYMLINK_NOFOLLOW = 0x2
+	FSPICK_NO_AUTOMOUNT     = 0x4
+	FSPICK_EMPTY_PATH       = 0x8
+
+	FSMOUNT_CLOEXEC = 0x1
 )
 
 type OpenHow struct {
@@ -865,6 +951,7 @@ const (
 	CTRL_CMD_NEWMCAST_GRP      = 0x7
 	CTRL_CMD_DELMCAST_GRP      = 0x8
 	CTRL_CMD_GETMCAST_GRP      = 0x9
+	CTRL_CMD_GETPOLICY         = 0xa
 	CTRL_ATTR_UNSPEC           = 0x0
 	CTRL_ATTR_FAMILY_ID        = 0x1
 	CTRL_ATTR_FAMILY_NAME      = 0x2
@@ -873,12 +960,19 @@ const (
 	CTRL_ATTR_MAXATTR          = 0x5
 	CTRL_ATTR_OPS              = 0x6
 	CTRL_ATTR_MCAST_GROUPS     = 0x7
+	CTRL_ATTR_POLICY           = 0x8
+	CTRL_ATTR_OP_POLICY        = 0x9
+	CTRL_ATTR_OP               = 0xa
 	CTRL_ATTR_OP_UNSPEC        = 0x0
 	CTRL_ATTR_OP_ID            = 0x1
 	CTRL_ATTR_OP_FLAGS         = 0x2
 	CTRL_ATTR_MCAST_GRP_UNSPEC = 0x0
 	CTRL_ATTR_MCAST_GRP_NAME   = 0x1
 	CTRL_ATTR_MCAST_GRP_ID     = 0x2
+	CTRL_ATTR_POLICY_UNSPEC    = 0x0
+	CTRL_ATTR_POLICY_DO        = 0x1
+	CTRL_ATTR_POLICY_DUMP      = 0x2
+	CTRL_ATTR_POLICY_DUMP_MAX  = 0x2
 )
 
 const (
@@ -911,6 +1005,9 @@ type PerfEventAttr struct {
 	Aux_watermark      uint32
 	Sample_max_stack   uint16
 	_                  uint16
+	Aux_sample_size    uint32
+	_                  uint32
+	Sig_data           uint64
 }
 
 type PerfEventMmapPage struct {
@@ -970,6 +1067,7 @@ const (
 	PerfBitCommExec                      = CBitFieldMaskBit24
 	PerfBitUseClockID                    = CBitFieldMaskBit25
 	PerfBitContextSwitch                 = CBitFieldMaskBit26
+	PerfBitWriteBackward                 = CBitFieldMaskBit27
 )
 
 const (
@@ -1062,7 +1160,8 @@ const (
 	PERF_SAMPLE_BRANCH_NO_CYCLES_SHIFT    = 0xf
 	PERF_SAMPLE_BRANCH_TYPE_SAVE_SHIFT    = 0x10
 	PERF_SAMPLE_BRANCH_HW_INDEX_SHIFT     = 0x11
-	PERF_SAMPLE_BRANCH_MAX_SHIFT          = 0x12
+	PERF_SAMPLE_BRANCH_PRIV_SAVE_SHIFT    = 0x12
+	PERF_SAMPLE_BRANCH_MAX_SHIFT          = 0x13
 	PERF_SAMPLE_BRANCH_USER               = 0x1
 	PERF_SAMPLE_BRANCH_KERNEL             = 0x2
 	PERF_SAMPLE_BRANCH_HV                 = 0x4
@@ -1081,7 +1180,8 @@ const (
 	PERF_SAMPLE_BRANCH_NO_CYCLES          = 0x8000
 	PERF_SAMPLE_BRANCH_TYPE_SAVE          = 0x10000
 	PERF_SAMPLE_BRANCH_HW_INDEX           = 0x20000
-	PERF_SAMPLE_BRANCH_MAX                = 0x40000
+	PERF_SAMPLE_BRANCH_PRIV_SAVE          = 0x40000
+	PERF_SAMPLE_BRANCH_MAX                = 0x80000
 	PERF_BR_UNKNOWN                       = 0x0
 	PERF_BR_COND                          = 0x1
 	PERF_BR_UNCOND                        = 0x2
@@ -1093,7 +1193,12 @@ const (
 	PERF_BR_SYSRET                        = 0x8
 	PERF_BR_COND_CALL                     = 0x9
 	PERF_BR_COND_RET                      = 0xa
-	PERF_BR_MAX                           = 0xb
+	PERF_BR_ERET                          = 0xb
+	PERF_BR_IRQ                           = 0xc
+	PERF_BR_SERROR                        = 0xd
+	PERF_BR_NO_TX                         = 0xe
+	PERF_BR_EXTEND_ABI                    = 0xf
+	PERF_BR_MAX                           = 0x10
 	PERF_SAMPLE_REGS_ABI_NONE             = 0x0
 	PERF_SAMPLE_REGS_ABI_32               = 0x1
 	PERF_SAMPLE_REGS_ABI_64               = 0x2
@@ -1112,7 +1217,8 @@ const (
 	PERF_FORMAT_TOTAL_TIME_RUNNING        = 0x2
 	PERF_FORMAT_ID                        = 0x4
 	PERF_FORMAT_GROUP                     = 0x8
-	PERF_FORMAT_MAX                       = 0x10
+	PERF_FORMAT_LOST                      = 0x10
+	PERF_FORMAT_MAX                       = 0x20
 	PERF_IOC_FLAG_GROUP                   = 0x1
 	PERF_RECORD_MMAP                      = 0x1
 	PERF_RECORD_LOST                      = 0x2
@@ -1134,7 +1240,8 @@ const (
 	PERF_RECORD_BPF_EVENT                 = 0x12
 	PERF_RECORD_CGROUP                    = 0x13
 	PERF_RECORD_TEXT_POKE                 = 0x14
-	PERF_RECORD_MAX                       = 0x15
+	PERF_RECORD_AUX_OUTPUT_HW_ID          = 0x15
+	PERF_RECORD_MAX                       = 0x16
 	PERF_RECORD_KSYMBOL_TYPE_UNKNOWN      = 0x0
 	PERF_RECORD_KSYMBOL_TYPE_BPF          = 0x1
 	PERF_RECORD_KSYMBOL_TYPE_OOL          = 0x2
@@ -1157,7 +1264,7 @@ type TCPMD5Sig struct {
 	Flags     uint8
 	Prefixlen uint8
 	Keylen    uint16
-	_         uint32
+	Ifindex   int32
 	Key       [80]uint8
 }
 
@@ -1426,6 +1533,11 @@ const (
 	IFLA_ALT_IFNAME                            = 0x35
 	IFLA_PERM_ADDRESS                          = 0x36
 	IFLA_PROTO_DOWN_REASON                     = 0x37
+	IFLA_PARENT_DEV_NAME                       = 0x38
+	IFLA_PARENT_DEV_BUS_NAME                   = 0x39
+	IFLA_GRO_MAX_SIZE                          = 0x3a
+	IFLA_TSO_MAX_SIZE                          = 0x3b
+	IFLA_TSO_MAX_SEGS                          = 0x3c
 	IFLA_PROTO_DOWN_REASON_UNSPEC              = 0x0
 	IFLA_PROTO_DOWN_REASON_MASK                = 0x1
 	IFLA_PROTO_DOWN_REASON_VALUE               = 0x2
@@ -1774,7 +1886,8 @@ const (
 
 const (
 	NF_NETDEV_INGRESS  = 0x0
-	NF_NETDEV_NUMHOOKS = 0x1
+	NF_NETDEV_EGRESS   = 0x1
+	NF_NETDEV_NUMHOOKS = 0x2
 )
 
 const (
@@ -1851,7 +1964,11 @@ const (
 	NFT_MSG_GETOBJ                    = 0x13
 	NFT_MSG_DELOBJ                    = 0x14
 	NFT_MSG_GETOBJ_RESET              = 0x15
-	NFT_MSG_MAX                       = 0x19
+	NFT_MSG_NEWFLOWTABLE              = 0x16
+	NFT_MSG_GETFLOWTABLE              = 0x17
+	NFT_MSG_DELFLOWTABLE              = 0x18
+	NFT_MSG_GETRULE_RESET             = 0x19
+	NFT_MSG_MAX                       = 0x1a
 	NFTA_LIST_UNSPEC                  = 0x0
 	NFTA_LIST_ELEM                    = 0x1
 	NFTA_HOOK_UNSPEC                  = 0x0
@@ -2355,9 +2472,11 @@ const (
 	SOF_TIMESTAMPING_OPT_STATS    = 0x1000
 	SOF_TIMESTAMPING_OPT_PKTINFO  = 0x2000
 	SOF_TIMESTAMPING_OPT_TX_SWHW  = 0x4000
+	SOF_TIMESTAMPING_BIND_PHC     = 0x8000
+	SOF_TIMESTAMPING_OPT_ID_TCP   = 0x10000
 
-	SOF_TIMESTAMPING_LAST = 0x8000
-	SOF_TIMESTAMPING_MASK = 0xffff
+	SOF_TIMESTAMPING_LAST = 0x10000
+	SOF_TIMESTAMPING_MASK = 0x1ffff
 
 	SCM_TSTAMP_SND   = 0x0
 	SCM_TSTAMP_SCHED = 0x1
@@ -2933,7 +3052,16 @@ const (
 	DEVLINK_CMD_TRAP_POLICER_NEW                       = 0x47
 	DEVLINK_CMD_TRAP_POLICER_DEL                       = 0x48
 	DEVLINK_CMD_HEALTH_REPORTER_TEST                   = 0x49
-	DEVLINK_CMD_MAX                                    = 0x4d
+	DEVLINK_CMD_RATE_GET                               = 0x4a
+	DEVLINK_CMD_RATE_SET                               = 0x4b
+	DEVLINK_CMD_RATE_NEW                               = 0x4c
+	DEVLINK_CMD_RATE_DEL                               = 0x4d
+	DEVLINK_CMD_LINECARD_GET                           = 0x4e
+	DEVLINK_CMD_LINECARD_SET                           = 0x4f
+	DEVLINK_CMD_LINECARD_NEW                           = 0x50
+	DEVLINK_CMD_LINECARD_DEL                           = 0x51
+	DEVLINK_CMD_SELFTESTS_GET                          = 0x52
+	DEVLINK_CMD_MAX                                    = 0x53
 	DEVLINK_PORT_TYPE_NOTSET                           = 0x0
 	DEVLINK_PORT_TYPE_AUTO                             = 0x1
 	DEVLINK_PORT_TYPE_ETH                              = 0x2
@@ -3156,7 +3284,19 @@ const (
 	DEVLINK_ATTR_RELOAD_ACTION_INFO                    = 0xa2
 	DEVLINK_ATTR_RELOAD_ACTION_STATS                   = 0xa3
 	DEVLINK_ATTR_PORT_PCI_SF_NUMBER                    = 0xa4
-	DEVLINK_ATTR_MAX                                   = 0xa9
+	DEVLINK_ATTR_RATE_TYPE                             = 0xa5
+	DEVLINK_ATTR_RATE_TX_SHARE                         = 0xa6
+	DEVLINK_ATTR_RATE_TX_MAX                           = 0xa7
+	DEVLINK_ATTR_RATE_NODE_NAME                        = 0xa8
+	DEVLINK_ATTR_RATE_PARENT_NODE_NAME                 = 0xa9
+	DEVLINK_ATTR_REGION_MAX_SNAPSHOTS                  = 0xaa
+	DEVLINK_ATTR_LINECARD_INDEX                        = 0xab
+	DEVLINK_ATTR_LINECARD_STATE                        = 0xac
+	DEVLINK_ATTR_LINECARD_TYPE                         = 0xad
+	DEVLINK_ATTR_LINECARD_SUPPORTED_TYPES              = 0xae
+	DEVLINK_ATTR_NESTED_DEVLINK                        = 0xaf
+	DEVLINK_ATTR_SELFTESTS                             = 0xb0
+	DEVLINK_ATTR_MAX                                   = 0xb3
 	DEVLINK_DPIPE_FIELD_MAPPING_TYPE_NONE              = 0x0
 	DEVLINK_DPIPE_FIELD_MAPPING_TYPE_IFINDEX           = 0x1
 	DEVLINK_DPIPE_MATCH_TYPE_FIELD_EXACT               = 0x0
@@ -3172,7 +3312,8 @@ const (
 	DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR                 = 0x1
 	DEVLINK_PORT_FN_ATTR_STATE                         = 0x2
 	DEVLINK_PORT_FN_ATTR_OPSTATE                       = 0x3
-	DEVLINK_PORT_FUNCTION_ATTR_MAX                     = 0x3
+	DEVLINK_PORT_FN_ATTR_CAPS                          = 0x4
+	DEVLINK_PORT_FUNCTION_ATTR_MAX                     = 0x4
 )
 
 type FsverityDigest struct {
@@ -3265,7 +3406,8 @@ const (
 	LWTUNNEL_ENCAP_SEG6_LOCAL = 0x7
 	LWTUNNEL_ENCAP_RPL        = 0x8
 	LWTUNNEL_ENCAP_IOAM6      = 0x9
-	LWTUNNEL_ENCAP_MAX        = 0x9
+	LWTUNNEL_ENCAP_XFRM       = 0xa
+	LWTUNNEL_ENCAP_MAX        = 0xa
 
 	MPLS_IPTUNNEL_UNSPEC = 0x0
 	MPLS_IPTUNNEL_DST    = 0x1
@@ -3453,7 +3595,17 @@ const (
 	ETHTOOL_MSG_CABLE_TEST_ACT                = 0x1a
 	ETHTOOL_MSG_CABLE_TEST_TDR_ACT            = 0x1b
 	ETHTOOL_MSG_TUNNEL_INFO_GET               = 0x1c
-	ETHTOOL_MSG_USER_MAX                      = 0x21
+	ETHTOOL_MSG_FEC_GET                       = 0x1d
+	ETHTOOL_MSG_FEC_SET                       = 0x1e
+	ETHTOOL_MSG_MODULE_EEPROM_GET             = 0x1f
+	ETHTOOL_MSG_STATS_GET                     = 0x20
+	ETHTOOL_MSG_PHC_VCLOCKS_GET               = 0x21
+	ETHTOOL_MSG_MODULE_GET                    = 0x22
+	ETHTOOL_MSG_MODULE_SET                    = 0x23
+	ETHTOOL_MSG_PSE_GET                       = 0x24
+	ETHTOOL_MSG_PSE_SET                       = 0x25
+	ETHTOOL_MSG_RSS_GET                       = 0x26
+	ETHTOOL_MSG_USER_MAX                      = 0x26
 	ETHTOOL_MSG_KERNEL_NONE                   = 0x0
 	ETHTOOL_MSG_STRSET_GET_REPLY              = 0x1
 	ETHTOOL_MSG_LINKINFO_GET_REPLY            = 0x2
@@ -3484,7 +3636,16 @@ const (
 	ETHTOOL_MSG_CABLE_TEST_NTF                = 0x1b
 	ETHTOOL_MSG_CABLE_TEST_TDR_NTF            = 0x1c
 	ETHTOOL_MSG_TUNNEL_INFO_GET_REPLY         = 0x1d
-	ETHTOOL_MSG_KERNEL_MAX                    = 0x22
+	ETHTOOL_MSG_FEC_GET_REPLY                 = 0x1e
+	ETHTOOL_MSG_FEC_NTF                       = 0x1f
+	ETHTOOL_MSG_MODULE_EEPROM_GET_REPLY       = 0x20
+	ETHTOOL_MSG_STATS_GET_REPLY               = 0x21
+	ETHTOOL_MSG_PHC_VCLOCKS_GET_REPLY         = 0x22
+	ETHTOOL_MSG_MODULE_GET_REPLY              = 0x23
+	ETHTOOL_MSG_MODULE_NTF                    = 0x24
+	ETHTOOL_MSG_PSE_GET_REPLY                 = 0x25
+	ETHTOOL_MSG_RSS_GET_REPLY                 = 0x26
+	ETHTOOL_MSG_KERNEL_MAX                    = 0x26
 	ETHTOOL_A_HEADER_UNSPEC                   = 0x0
 	ETHTOOL_A_HEADER_DEV_INDEX                = 0x1
 	ETHTOOL_A_HEADER_DEV_NAME                 = 0x2
@@ -3543,7 +3704,8 @@ const (
 	ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG      = 0x7
 	ETHTOOL_A_LINKMODES_MASTER_SLAVE_STATE    = 0x8
 	ETHTOOL_A_LINKMODES_LANES                 = 0x9
-	ETHTOOL_A_LINKMODES_MAX                   = 0x9
+	ETHTOOL_A_LINKMODES_RATE_MATCHING         = 0xa
+	ETHTOOL_A_LINKMODES_MAX                   = 0xa
 	ETHTOOL_A_LINKSTATE_UNSPEC                = 0x0
 	ETHTOOL_A_LINKSTATE_HEADER                = 0x1
 	ETHTOOL_A_LINKSTATE_LINK                  = 0x2
@@ -3551,7 +3713,8 @@ const (
 	ETHTOOL_A_LINKSTATE_SQI_MAX               = 0x4
 	ETHTOOL_A_LINKSTATE_EXT_STATE             = 0x5
 	ETHTOOL_A_LINKSTATE_EXT_SUBSTATE          = 0x6
-	ETHTOOL_A_LINKSTATE_MAX                   = 0x6
+	ETHTOOL_A_LINKSTATE_EXT_DOWN_CNT          = 0x7
+	ETHTOOL_A_LINKSTATE_MAX                   = 0x7
 	ETHTOOL_A_DEBUG_UNSPEC                    = 0x0
 	ETHTOOL_A_DEBUG_HEADER                    = 0x1
 	ETHTOOL_A_DEBUG_MSGMASK                   = 0x2
@@ -3582,7 +3745,11 @@ const (
 	ETHTOOL_A_RINGS_RX_MINI                   = 0x7
 	ETHTOOL_A_RINGS_RX_JUMBO                  = 0x8
 	ETHTOOL_A_RINGS_TX                        = 0x9
-	ETHTOOL_A_RINGS_MAX                       = 0x9
+	ETHTOOL_A_RINGS_RX_BUF_LEN                = 0xa
+	ETHTOOL_A_RINGS_TCP_DATA_SPLIT            = 0xb
+	ETHTOOL_A_RINGS_CQE_SIZE                  = 0xc
+	ETHTOOL_A_RINGS_TX_PUSH                   = 0xd
+	ETHTOOL_A_RINGS_MAX                       = 0xd
 	ETHTOOL_A_CHANNELS_UNSPEC                 = 0x0
 	ETHTOOL_A_CHANNELS_HEADER                 = 0x1
 	ETHTOOL_A_CHANNELS_RX_MAX                 = 0x2
@@ -3734,6 +3901,8 @@ const (
 	ETHTOOL_A_TUNNEL_INFO_MAX                 = 0x2
 )
 
+const SPEED_UNKNOWN = -0x1
+
 type EthtoolDrvinfo struct {
 	Cmd          uint32
 	Driver       [32]byte
@@ -3959,3 +4128,1685 @@ const (
 	SHM_RDONLY = 0x1000
 	SHM_RND    = 0x2000
 )
+
+type MountAttr struct {
+	Attr_set    uint64
+	Attr_clr    uint64
+	Propagation uint64
+	Userns_fd   uint64
+}
+
+const (
+	WG_CMD_GET_DEVICE                      = 0x0
+	WG_CMD_SET_DEVICE                      = 0x1
+	WGDEVICE_F_REPLACE_PEERS               = 0x1
+	WGDEVICE_A_UNSPEC                      = 0x0
+	WGDEVICE_A_IFINDEX                     = 0x1
+	WGDEVICE_A_IFNAME                      = 0x2
+	WGDEVICE_A_PRIVATE_KEY                 = 0x3
+	WGDEVICE_A_PUBLIC_KEY                  = 0x4
+	WGDEVICE_A_FLAGS                       = 0x5
+	WGDEVICE_A_LISTEN_PORT                 = 0x6
+	WGDEVICE_A_FWMARK                      = 0x7
+	WGDEVICE_A_PEERS                       = 0x8
+	WGPEER_F_REMOVE_ME                     = 0x1
+	WGPEER_F_REPLACE_ALLOWEDIPS            = 0x2
+	WGPEER_F_UPDATE_ONLY                   = 0x4
+	WGPEER_A_UNSPEC                        = 0x0
+	WGPEER_A_PUBLIC_KEY                    = 0x1
+	WGPEER_A_PRESHARED_KEY                 = 0x2
+	WGPEER_A_FLAGS                         = 0x3
+	WGPEER_A_ENDPOINT                      = 0x4
+	WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL = 0x5
+	WGPEER_A_LAST_HANDSHAKE_TIME           = 0x6
+	WGPEER_A_RX_BYTES                      = 0x7
+	WGPEER_A_TX_BYTES                      = 0x8
+	WGPEER_A_ALLOWEDIPS                    = 0x9
+	WGPEER_A_PROTOCOL_VERSION              = 0xa
+	WGALLOWEDIP_A_UNSPEC                   = 0x0
+	WGALLOWEDIP_A_FAMILY                   = 0x1
+	WGALLOWEDIP_A_IPADDR                   = 0x2
+	WGALLOWEDIP_A_CIDR_MASK                = 0x3
+)
+
+const (
+	NL_ATTR_TYPE_INVALID      = 0x0
+	NL_ATTR_TYPE_FLAG         = 0x1
+	NL_ATTR_TYPE_U8           = 0x2
+	NL_ATTR_TYPE_U16          = 0x3
+	NL_ATTR_TYPE_U32          = 0x4
+	NL_ATTR_TYPE_U64          = 0x5
+	NL_ATTR_TYPE_S8           = 0x6
+	NL_ATTR_TYPE_S16          = 0x7
+	NL_ATTR_TYPE_S32          = 0x8
+	NL_ATTR_TYPE_S64          = 0x9
+	NL_ATTR_TYPE_BINARY       = 0xa
+	NL_ATTR_TYPE_STRING       = 0xb
+	NL_ATTR_TYPE_NUL_STRING   = 0xc
+	NL_ATTR_TYPE_NESTED       = 0xd
+	NL_ATTR_TYPE_NESTED_ARRAY = 0xe
+	NL_ATTR_TYPE_BITFIELD32   = 0xf
+
+	NL_POLICY_TYPE_ATTR_UNSPEC          = 0x0
+	NL_POLICY_TYPE_ATTR_TYPE            = 0x1
+	NL_POLICY_TYPE_ATTR_MIN_VALUE_S     = 0x2
+	NL_POLICY_TYPE_ATTR_MAX_VALUE_S     = 0x3
+	NL_POLICY_TYPE_ATTR_MIN_VALUE_U     = 0x4
+	NL_POLICY_TYPE_ATTR_MAX_VALUE_U     = 0x5
+	NL_POLICY_TYPE_ATTR_MIN_LENGTH      = 0x6
+	NL_POLICY_TYPE_ATTR_MAX_LENGTH      = 0x7
+	NL_POLICY_TYPE_ATTR_POLICY_IDX      = 0x8
+	NL_POLICY_TYPE_ATTR_POLICY_MAXTYPE  = 0x9
+	NL_POLICY_TYPE_ATTR_BITFIELD32_MASK = 0xa
+	NL_POLICY_TYPE_ATTR_PAD             = 0xb
+	NL_POLICY_TYPE_ATTR_MASK            = 0xc
+	NL_POLICY_TYPE_ATTR_MAX             = 0xc
+)
+
+type CANBitTiming struct {
+	Bitrate      uint32
+	Sample_point uint32
+	Tq           uint32
+	Prop_seg     uint32
+	Phase_seg1   uint32
+	Phase_seg2   uint32
+	Sjw          uint32
+	Brp          uint32
+}
+
+type CANBitTimingConst struct {
+	Name      [16]uint8
+	Tseg1_min uint32
+	Tseg1_max uint32
+	Tseg2_min uint32
+	Tseg2_max uint32
+	Sjw_max   uint32
+	Brp_min   uint32
+	Brp_max   uint32
+	Brp_inc   uint32
+}
+
+type CANClock struct {
+	Freq uint32
+}
+
+type CANBusErrorCounters struct {
+	Txerr uint16
+	Rxerr uint16
+}
+
+type CANCtrlMode struct {
+	Mask  uint32
+	Flags uint32
+}
+
+type CANDeviceStats struct {
+	Bus_error        uint32
+	Error_warning    uint32
+	Error_passive    uint32
+	Bus_off          uint32
+	Arbitration_lost uint32
+	Restarts         uint32
+}
+
+const (
+	CAN_STATE_ERROR_ACTIVE  = 0x0
+	CAN_STATE_ERROR_WARNING = 0x1
+	CAN_STATE_ERROR_PASSIVE = 0x2
+	CAN_STATE_BUS_OFF       = 0x3
+	CAN_STATE_STOPPED       = 0x4
+	CAN_STATE_SLEEPING      = 0x5
+	CAN_STATE_MAX           = 0x6
+)
+
+const (
+	IFLA_CAN_UNSPEC               = 0x0
+	IFLA_CAN_BITTIMING            = 0x1
+	IFLA_CAN_BITTIMING_CONST      = 0x2
+	IFLA_CAN_CLOCK                = 0x3
+	IFLA_CAN_STATE                = 0x4
+	IFLA_CAN_CTRLMODE             = 0x5
+	IFLA_CAN_RESTART_MS           = 0x6
+	IFLA_CAN_RESTART              = 0x7
+	IFLA_CAN_BERR_COUNTER         = 0x8
+	IFLA_CAN_DATA_BITTIMING       = 0x9
+	IFLA_CAN_DATA_BITTIMING_CONST = 0xa
+	IFLA_CAN_TERMINATION          = 0xb
+	IFLA_CAN_TERMINATION_CONST    = 0xc
+	IFLA_CAN_BITRATE_CONST        = 0xd
+	IFLA_CAN_DATA_BITRATE_CONST   = 0xe
+	IFLA_CAN_BITRATE_MAX          = 0xf
+)
+
+type KCMAttach struct {
+	Fd     int32
+	Bpf_fd int32
+}
+
+type KCMUnattach struct {
+	Fd int32
+}
+
+type KCMClone struct {
+	Fd int32
+}
+
+const (
+	NL80211_AC_BE                                           = 0x2
+	NL80211_AC_BK                                           = 0x3
+	NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED                 = 0x0
+	NL80211_ACL_POLICY_DENY_UNLESS_LISTED                   = 0x1
+	NL80211_AC_VI                                           = 0x1
+	NL80211_AC_VO                                           = 0x0
+	NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT               = 0x1
+	NL80211_AP_SETTINGS_SA_QUERY_OFFLOAD_SUPPORT            = 0x2
+	NL80211_AP_SME_SA_QUERY_OFFLOAD                         = 0x1
+	NL80211_ATTR_4ADDR                                      = 0x53
+	NL80211_ATTR_ACK                                        = 0x5c
+	NL80211_ATTR_ACK_SIGNAL                                 = 0x107
+	NL80211_ATTR_ACL_POLICY                                 = 0xa5
+	NL80211_ATTR_ADMITTED_TIME                              = 0xd4
+	NL80211_ATTR_AIRTIME_WEIGHT                             = 0x112
+	NL80211_ATTR_AKM_SUITES                                 = 0x4c
+	NL80211_ATTR_AP_ISOLATE                                 = 0x60
+	NL80211_ATTR_AP_SETTINGS_FLAGS                          = 0x135
+	NL80211_ATTR_AUTH_DATA                                  = 0x9c
+	NL80211_ATTR_AUTH_TYPE                                  = 0x35
+	NL80211_ATTR_BANDS                                      = 0xef
+	NL80211_ATTR_BEACON_HEAD                                = 0xe
+	NL80211_ATTR_BEACON_INTERVAL                            = 0xc
+	NL80211_ATTR_BEACON_TAIL                                = 0xf
+	NL80211_ATTR_BG_SCAN_PERIOD                             = 0x98
+	NL80211_ATTR_BSS_BASIC_RATES                            = 0x24
+	NL80211_ATTR_BSS                                        = 0x2f
+	NL80211_ATTR_BSS_CTS_PROT                               = 0x1c
+	NL80211_ATTR_BSS_HT_OPMODE                              = 0x6d
+	NL80211_ATTR_BSSID                                      = 0xf5
+	NL80211_ATTR_BSS_SELECT                                 = 0xe3
+	NL80211_ATTR_BSS_SHORT_PREAMBLE                         = 0x1d
+	NL80211_ATTR_BSS_SHORT_SLOT_TIME                        = 0x1e
+	NL80211_ATTR_CENTER_FREQ1                               = 0xa0
+	NL80211_ATTR_CENTER_FREQ1_OFFSET                        = 0x123
+	NL80211_ATTR_CENTER_FREQ2                               = 0xa1
+	NL80211_ATTR_CHANNEL_WIDTH                              = 0x9f
+	NL80211_ATTR_CH_SWITCH_BLOCK_TX                         = 0xb8
+	NL80211_ATTR_CH_SWITCH_COUNT                            = 0xb7
+	NL80211_ATTR_CIPHER_SUITE_GROUP                         = 0x4a
+	NL80211_ATTR_CIPHER_SUITES                              = 0x39
+	NL80211_ATTR_CIPHER_SUITES_PAIRWISE                     = 0x49
+	NL80211_ATTR_CNTDWN_OFFS_BEACON                         = 0xba
+	NL80211_ATTR_CNTDWN_OFFS_PRESP                          = 0xbb
+	NL80211_ATTR_COALESCE_RULE                              = 0xb6
+	NL80211_ATTR_COALESCE_RULE_CONDITION                    = 0x2
+	NL80211_ATTR_COALESCE_RULE_DELAY                        = 0x1
+	NL80211_ATTR_COALESCE_RULE_MAX                          = 0x3
+	NL80211_ATTR_COALESCE_RULE_PKT_PATTERN                  = 0x3
+	NL80211_ATTR_COLOR_CHANGE_COLOR                         = 0x130
+	NL80211_ATTR_COLOR_CHANGE_COUNT                         = 0x12f
+	NL80211_ATTR_COLOR_CHANGE_ELEMS                         = 0x131
+	NL80211_ATTR_CONN_FAILED_REASON                         = 0x9b
+	NL80211_ATTR_CONTROL_PORT                               = 0x44
+	NL80211_ATTR_CONTROL_PORT_ETHERTYPE                     = 0x66
+	NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT                    = 0x67
+	NL80211_ATTR_CONTROL_PORT_NO_PREAUTH                    = 0x11e
+	NL80211_ATTR_CONTROL_PORT_OVER_NL80211                  = 0x108
+	NL80211_ATTR_COOKIE                                     = 0x58
+	NL80211_ATTR_CQM_BEACON_LOSS_EVENT                      = 0x8
+	NL80211_ATTR_CQM                                        = 0x5e
+	NL80211_ATTR_CQM_MAX                                    = 0x9
+	NL80211_ATTR_CQM_PKT_LOSS_EVENT                         = 0x4
+	NL80211_ATTR_CQM_RSSI_HYST                              = 0x2
+	NL80211_ATTR_CQM_RSSI_LEVEL                             = 0x9
+	NL80211_ATTR_CQM_RSSI_THOLD                             = 0x1
+	NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT                   = 0x3
+	NL80211_ATTR_CQM_TXE_INTVL                              = 0x7
+	NL80211_ATTR_CQM_TXE_PKTS                               = 0x6
+	NL80211_ATTR_CQM_TXE_RATE                               = 0x5
+	NL80211_ATTR_CRIT_PROT_ID                               = 0xb3
+	NL80211_ATTR_CSA_C_OFF_BEACON                           = 0xba
+	NL80211_ATTR_CSA_C_OFF_PRESP                            = 0xbb
+	NL80211_ATTR_CSA_C_OFFSETS_TX                           = 0xcd
+	NL80211_ATTR_CSA_IES                                    = 0xb9
+	NL80211_ATTR_DEVICE_AP_SME                              = 0x8d
+	NL80211_ATTR_DFS_CAC_TIME                               = 0x7
+	NL80211_ATTR_DFS_REGION                                 = 0x92
+	NL80211_ATTR_DISABLE_EHT                                = 0x137
+	NL80211_ATTR_DISABLE_HE                                 = 0x12d
+	NL80211_ATTR_DISABLE_HT                                 = 0x93
+	NL80211_ATTR_DISABLE_VHT                                = 0xaf
+	NL80211_ATTR_DISCONNECTED_BY_AP                         = 0x47
+	NL80211_ATTR_DONT_WAIT_FOR_ACK                          = 0x8e
+	NL80211_ATTR_DTIM_PERIOD                                = 0xd
+	NL80211_ATTR_DURATION                                   = 0x57
+	NL80211_ATTR_EHT_CAPABILITY                             = 0x136
+	NL80211_ATTR_EML_CAPABILITY                             = 0x13d
+	NL80211_ATTR_EXT_CAPA                                   = 0xa9
+	NL80211_ATTR_EXT_CAPA_MASK                              = 0xaa
+	NL80211_ATTR_EXTERNAL_AUTH_ACTION                       = 0x104
+	NL80211_ATTR_EXTERNAL_AUTH_SUPPORT                      = 0x105
+	NL80211_ATTR_EXT_FEATURES                               = 0xd9
+	NL80211_ATTR_FEATURE_FLAGS                              = 0x8f
+	NL80211_ATTR_FILS_CACHE_ID                              = 0xfd
+	NL80211_ATTR_FILS_DISCOVERY                             = 0x126
+	NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM                      = 0xfb
+	NL80211_ATTR_FILS_ERP_REALM                             = 0xfa
+	NL80211_ATTR_FILS_ERP_RRK                               = 0xfc
+	NL80211_ATTR_FILS_ERP_USERNAME                          = 0xf9
+	NL80211_ATTR_FILS_KEK                                   = 0xf2
+	NL80211_ATTR_FILS_NONCES                                = 0xf3
+	NL80211_ATTR_FRAME                                      = 0x33
+	NL80211_ATTR_FRAME_MATCH                                = 0x5b
+	NL80211_ATTR_FRAME_TYPE                                 = 0x65
+	NL80211_ATTR_FREQ_AFTER                                 = 0x3b
+	NL80211_ATTR_FREQ_BEFORE                                = 0x3a
+	NL80211_ATTR_FREQ_FIXED                                 = 0x3c
+	NL80211_ATTR_FREQ_RANGE_END                             = 0x3
+	NL80211_ATTR_FREQ_RANGE_MAX_BW                          = 0x4
+	NL80211_ATTR_FREQ_RANGE_START                           = 0x2
+	NL80211_ATTR_FTM_RESPONDER                              = 0x10e
+	NL80211_ATTR_FTM_RESPONDER_STATS                        = 0x10f
+	NL80211_ATTR_GENERATION                                 = 0x2e
+	NL80211_ATTR_HANDLE_DFS                                 = 0xbf
+	NL80211_ATTR_HE_6GHZ_CAPABILITY                         = 0x125
+	NL80211_ATTR_HE_BSS_COLOR                               = 0x11b
+	NL80211_ATTR_HE_CAPABILITY                              = 0x10d
+	NL80211_ATTR_HE_OBSS_PD                                 = 0x117
+	NL80211_ATTR_HIDDEN_SSID                                = 0x7e
+	NL80211_ATTR_HT_CAPABILITY                              = 0x1f
+	NL80211_ATTR_HT_CAPABILITY_MASK                         = 0x94
+	NL80211_ATTR_IE_ASSOC_RESP                              = 0x80
+	NL80211_ATTR_IE                                         = 0x2a
+	NL80211_ATTR_IE_PROBE_RESP                              = 0x7f
+	NL80211_ATTR_IE_RIC                                     = 0xb2
+	NL80211_ATTR_IFACE_SOCKET_OWNER                         = 0xcc
+	NL80211_ATTR_IFINDEX                                    = 0x3
+	NL80211_ATTR_IFNAME                                     = 0x4
+	NL80211_ATTR_IFTYPE_AKM_SUITES                          = 0x11c
+	NL80211_ATTR_IFTYPE                                     = 0x5
+	NL80211_ATTR_IFTYPE_EXT_CAPA                            = 0xe6
+	NL80211_ATTR_INACTIVITY_TIMEOUT                         = 0x96
+	NL80211_ATTR_INTERFACE_COMBINATIONS                     = 0x78
+	NL80211_ATTR_KEY_CIPHER                                 = 0x9
+	NL80211_ATTR_KEY                                        = 0x50
+	NL80211_ATTR_KEY_DATA                                   = 0x7
+	NL80211_ATTR_KEY_DEFAULT                                = 0xb
+	NL80211_ATTR_KEY_DEFAULT_MGMT                           = 0x28
+	NL80211_ATTR_KEY_DEFAULT_TYPES                          = 0x6e
+	NL80211_ATTR_KEY_IDX                                    = 0x8
+	NL80211_ATTR_KEYS                                       = 0x51
+	NL80211_ATTR_KEY_SEQ                                    = 0xa
+	NL80211_ATTR_KEY_TYPE                                   = 0x37
+	NL80211_ATTR_LOCAL_MESH_POWER_MODE                      = 0xa4
+	NL80211_ATTR_LOCAL_STATE_CHANGE                         = 0x5f
+	NL80211_ATTR_MAC_ACL_MAX                                = 0xa7
+	NL80211_ATTR_MAC_ADDRS                                  = 0xa6
+	NL80211_ATTR_MAC                                        = 0x6
+	NL80211_ATTR_MAC_HINT                                   = 0xc8
+	NL80211_ATTR_MAC_MASK                                   = 0xd7
+	NL80211_ATTR_MAX_AP_ASSOC_STA                           = 0xca
+	NL80211_ATTR_MAX                                        = 0x141
+	NL80211_ATTR_MAX_CRIT_PROT_DURATION                     = 0xb4
+	NL80211_ATTR_MAX_CSA_COUNTERS                           = 0xce
+	NL80211_ATTR_MAX_MATCH_SETS                             = 0x85
+	NL80211_ATTR_MAX_NUM_AKM_SUITES                         = 0x13c
+	NL80211_ATTR_MAX_NUM_PMKIDS                             = 0x56
+	NL80211_ATTR_MAX_NUM_SCAN_SSIDS                         = 0x2b
+	NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS                   = 0xde
+	NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS                   = 0x7b
+	NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION             = 0x6f
+	NL80211_ATTR_MAX_SCAN_IE_LEN                            = 0x38
+	NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL                     = 0xdf
+	NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS                   = 0xe0
+	NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN                      = 0x7c
+	NL80211_ATTR_MBSSID_CONFIG                              = 0x132
+	NL80211_ATTR_MBSSID_ELEMS                               = 0x133
+	NL80211_ATTR_MCAST_RATE                                 = 0x6b
+	NL80211_ATTR_MDID                                       = 0xb1
+	NL80211_ATTR_MEASUREMENT_DURATION                       = 0xeb
+	NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY             = 0xec
+	NL80211_ATTR_MESH_CONFIG                                = 0x23
+	NL80211_ATTR_MESH_ID                                    = 0x18
+	NL80211_ATTR_MESH_PEER_AID                              = 0xed
+	NL80211_ATTR_MESH_SETUP                                 = 0x70
+	NL80211_ATTR_MGMT_SUBTYPE                               = 0x29
+	NL80211_ATTR_MLD_ADDR                                   = 0x13a
+	NL80211_ATTR_MLD_CAPA_AND_OPS                           = 0x13e
+	NL80211_ATTR_MLO_LINK_ID                                = 0x139
+	NL80211_ATTR_MLO_LINKS                                  = 0x138
+	NL80211_ATTR_MLO_SUPPORT                                = 0x13b
+	NL80211_ATTR_MNTR_FLAGS                                 = 0x17
+	NL80211_ATTR_MPATH_INFO                                 = 0x1b
+	NL80211_ATTR_MPATH_NEXT_HOP                             = 0x1a
+	NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED               = 0xf4
+	NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR                    = 0xe8
+	NL80211_ATTR_MU_MIMO_GROUP_DATA                         = 0xe7
+	NL80211_ATTR_NAN_FUNC                                   = 0xf0
+	NL80211_ATTR_NAN_MASTER_PREF                            = 0xee
+	NL80211_ATTR_NAN_MATCH                                  = 0xf1
+	NL80211_ATTR_NETNS_FD                                   = 0xdb
+	NL80211_ATTR_NOACK_MAP                                  = 0x95
+	NL80211_ATTR_NSS                                        = 0x106
+	NL80211_ATTR_OBSS_COLOR_BITMAP                          = 0x12e
+	NL80211_ATTR_OFFCHANNEL_TX_OK                           = 0x6c
+	NL80211_ATTR_OPER_CLASS                                 = 0xd6
+	NL80211_ATTR_OPMODE_NOTIF                               = 0xc2
+	NL80211_ATTR_P2P_CTWINDOW                               = 0xa2
+	NL80211_ATTR_P2P_OPPPS                                  = 0xa3
+	NL80211_ATTR_PAD                                        = 0xe5
+	NL80211_ATTR_PBSS                                       = 0xe2
+	NL80211_ATTR_PEER_AID                                   = 0xb5
+	NL80211_ATTR_PEER_MEASUREMENTS                          = 0x111
+	NL80211_ATTR_PID                                        = 0x52
+	NL80211_ATTR_PMK                                        = 0xfe
+	NL80211_ATTR_PMKID                                      = 0x55
+	NL80211_ATTR_PMK_LIFETIME                               = 0x11f
+	NL80211_ATTR_PMKR0_NAME                                 = 0x102
+	NL80211_ATTR_PMK_REAUTH_THRESHOLD                       = 0x120
+	NL80211_ATTR_PMKSA_CANDIDATE                            = 0x86
+	NL80211_ATTR_PORT_AUTHORIZED                            = 0x103
+	NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN                    = 0x5
+	NL80211_ATTR_POWER_RULE_MAX_EIRP                        = 0x6
+	NL80211_ATTR_PREV_BSSID                                 = 0x4f
+	NL80211_ATTR_PRIVACY                                    = 0x46
+	NL80211_ATTR_PROBE_RESP                                 = 0x91
+	NL80211_ATTR_PROBE_RESP_OFFLOAD                         = 0x90
+	NL80211_ATTR_PROTOCOL_FEATURES                          = 0xad
+	NL80211_ATTR_PS_STATE                                   = 0x5d
+	NL80211_ATTR_QOS_MAP                                    = 0xc7
+	NL80211_ATTR_RADAR_BACKGROUND                           = 0x134
+	NL80211_ATTR_RADAR_EVENT                                = 0xa8
+	NL80211_ATTR_REASON_CODE                                = 0x36
+	NL80211_ATTR_RECEIVE_MULTICAST                          = 0x121
+	NL80211_ATTR_RECONNECT_REQUESTED                        = 0x12b
+	NL80211_ATTR_REG_ALPHA2                                 = 0x21
+	NL80211_ATTR_REG_INDOOR                                 = 0xdd
+	NL80211_ATTR_REG_INITIATOR                              = 0x30
+	NL80211_ATTR_REG_RULE_FLAGS                             = 0x1
+	NL80211_ATTR_REG_RULES                                  = 0x22
+	NL80211_ATTR_REG_TYPE                                   = 0x31
+	NL80211_ATTR_REKEY_DATA                                 = 0x7a
+	NL80211_ATTR_REQ_IE                                     = 0x4d
+	NL80211_ATTR_RESP_IE                                    = 0x4e
+	NL80211_ATTR_ROAM_SUPPORT                               = 0x83
+	NL80211_ATTR_RX_FRAME_TYPES                             = 0x64
+	NL80211_ATTR_RX_HW_TIMESTAMP                            = 0x140
+	NL80211_ATTR_RXMGMT_FLAGS                               = 0xbc
+	NL80211_ATTR_RX_SIGNAL_DBM                              = 0x97
+	NL80211_ATTR_S1G_CAPABILITY                             = 0x128
+	NL80211_ATTR_S1G_CAPABILITY_MASK                        = 0x129
+	NL80211_ATTR_SAE_DATA                                   = 0x9c
+	NL80211_ATTR_SAE_PASSWORD                               = 0x115
+	NL80211_ATTR_SAE_PWE                                    = 0x12a
+	NL80211_ATTR_SAR_SPEC                                   = 0x12c
+	NL80211_ATTR_SCAN_FLAGS                                 = 0x9e
+	NL80211_ATTR_SCAN_FREQ_KHZ                              = 0x124
+	NL80211_ATTR_SCAN_FREQUENCIES                           = 0x2c
+	NL80211_ATTR_SCAN_GENERATION                            = 0x2e
+	NL80211_ATTR_SCAN_SSIDS                                 = 0x2d
+	NL80211_ATTR_SCAN_START_TIME_TSF_BSSID                  = 0xea
+	NL80211_ATTR_SCAN_START_TIME_TSF                        = 0xe9
+	NL80211_ATTR_SCAN_SUPP_RATES                            = 0x7d
+	NL80211_ATTR_SCHED_SCAN_DELAY                           = 0xdc
+	NL80211_ATTR_SCHED_SCAN_INTERVAL                        = 0x77
+	NL80211_ATTR_SCHED_SCAN_MATCH                           = 0x84
+	NL80211_ATTR_SCHED_SCAN_MATCH_SSID                      = 0x1
+	NL80211_ATTR_SCHED_SCAN_MAX_REQS                        = 0x100
+	NL80211_ATTR_SCHED_SCAN_MULTI                           = 0xff
+	NL80211_ATTR_SCHED_SCAN_PLANS                           = 0xe1
+	NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI                   = 0xf6
+	NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST                     = 0xf7
+	NL80211_ATTR_SMPS_MODE                                  = 0xd5
+	NL80211_ATTR_SOCKET_OWNER                               = 0xcc
+	NL80211_ATTR_SOFTWARE_IFTYPES                           = 0x79
+	NL80211_ATTR_SPLIT_WIPHY_DUMP                           = 0xae
+	NL80211_ATTR_SSID                                       = 0x34
+	NL80211_ATTR_STA_AID                                    = 0x10
+	NL80211_ATTR_STA_CAPABILITY                             = 0xab
+	NL80211_ATTR_STA_EXT_CAPABILITY                         = 0xac
+	NL80211_ATTR_STA_FLAGS2                                 = 0x43
+	NL80211_ATTR_STA_FLAGS                                  = 0x11
+	NL80211_ATTR_STA_INFO                                   = 0x15
+	NL80211_ATTR_STA_LISTEN_INTERVAL                        = 0x12
+	NL80211_ATTR_STA_PLINK_ACTION                           = 0x19
+	NL80211_ATTR_STA_PLINK_STATE                            = 0x74
+	NL80211_ATTR_STA_SUPPORTED_CHANNELS                     = 0xbd
+	NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES                 = 0xbe
+	NL80211_ATTR_STA_SUPPORTED_RATES                        = 0x13
+	NL80211_ATTR_STA_SUPPORT_P2P_PS                         = 0xe4
+	NL80211_ATTR_STATUS_CODE                                = 0x48
+	NL80211_ATTR_STA_TX_POWER                               = 0x114
+	NL80211_ATTR_STA_TX_POWER_SETTING                       = 0x113
+	NL80211_ATTR_STA_VLAN                                   = 0x14
+	NL80211_ATTR_STA_WME                                    = 0x81
+	NL80211_ATTR_SUPPORT_10_MHZ                             = 0xc1
+	NL80211_ATTR_SUPPORT_5_MHZ                              = 0xc0
+	NL80211_ATTR_SUPPORT_AP_UAPSD                           = 0x82
+	NL80211_ATTR_SUPPORTED_COMMANDS                         = 0x32
+	NL80211_ATTR_SUPPORTED_IFTYPES                          = 0x20
+	NL80211_ATTR_SUPPORT_IBSS_RSN                           = 0x68
+	NL80211_ATTR_SUPPORT_MESH_AUTH                          = 0x73
+	NL80211_ATTR_SURVEY_INFO                                = 0x54
+	NL80211_ATTR_SURVEY_RADIO_STATS                         = 0xda
+	NL80211_ATTR_TD_BITMAP                                  = 0x141
+	NL80211_ATTR_TDLS_ACTION                                = 0x88
+	NL80211_ATTR_TDLS_DIALOG_TOKEN                          = 0x89
+	NL80211_ATTR_TDLS_EXTERNAL_SETUP                        = 0x8c
+	NL80211_ATTR_TDLS_INITIATOR                             = 0xcf
+	NL80211_ATTR_TDLS_OPERATION                             = 0x8a
+	NL80211_ATTR_TDLS_PEER_CAPABILITY                       = 0xcb
+	NL80211_ATTR_TDLS_SUPPORT                               = 0x8b
+	NL80211_ATTR_TESTDATA                                   = 0x45
+	NL80211_ATTR_TID_CONFIG                                 = 0x11d
+	NL80211_ATTR_TIMED_OUT                                  = 0x41
+	NL80211_ATTR_TIMEOUT                                    = 0x110
+	NL80211_ATTR_TIMEOUT_REASON                             = 0xf8
+	NL80211_ATTR_TSID                                       = 0xd2
+	NL80211_ATTR_TWT_RESPONDER                              = 0x116
+	NL80211_ATTR_TX_FRAME_TYPES                             = 0x63
+	NL80211_ATTR_TX_HW_TIMESTAMP                            = 0x13f
+	NL80211_ATTR_TX_NO_CCK_RATE                             = 0x87
+	NL80211_ATTR_TXQ_LIMIT                                  = 0x10a
+	NL80211_ATTR_TXQ_MEMORY_LIMIT                           = 0x10b
+	NL80211_ATTR_TXQ_QUANTUM                                = 0x10c
+	NL80211_ATTR_TXQ_STATS                                  = 0x109
+	NL80211_ATTR_TX_RATES                                   = 0x5a
+	NL80211_ATTR_UNSOL_BCAST_PROBE_RESP                     = 0x127
+	NL80211_ATTR_UNSPEC                                     = 0x0
+	NL80211_ATTR_USE_MFP                                    = 0x42
+	NL80211_ATTR_USER_PRIO                                  = 0xd3
+	NL80211_ATTR_USER_REG_HINT_TYPE                         = 0x9a
+	NL80211_ATTR_USE_RRM                                    = 0xd0
+	NL80211_ATTR_VENDOR_DATA                                = 0xc5
+	NL80211_ATTR_VENDOR_EVENTS                              = 0xc6
+	NL80211_ATTR_VENDOR_ID                                  = 0xc3
+	NL80211_ATTR_VENDOR_SUBCMD                              = 0xc4
+	NL80211_ATTR_VHT_CAPABILITY                             = 0x9d
+	NL80211_ATTR_VHT_CAPABILITY_MASK                        = 0xb0
+	NL80211_ATTR_VLAN_ID                                    = 0x11a
+	NL80211_ATTR_WANT_1X_4WAY_HS                            = 0x101
+	NL80211_ATTR_WDEV                                       = 0x99
+	NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX                     = 0x72
+	NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX                     = 0x71
+	NL80211_ATTR_WIPHY_ANTENNA_RX                           = 0x6a
+	NL80211_ATTR_WIPHY_ANTENNA_TX                           = 0x69
+	NL80211_ATTR_WIPHY_BANDS                                = 0x16
+	NL80211_ATTR_WIPHY_CHANNEL_TYPE                         = 0x27
+	NL80211_ATTR_WIPHY                                      = 0x1
+	NL80211_ATTR_WIPHY_COVERAGE_CLASS                       = 0x59
+	NL80211_ATTR_WIPHY_DYN_ACK                              = 0xd1
+	NL80211_ATTR_WIPHY_EDMG_BW_CONFIG                       = 0x119
+	NL80211_ATTR_WIPHY_EDMG_CHANNELS                        = 0x118
+	NL80211_ATTR_WIPHY_FRAG_THRESHOLD                       = 0x3f
+	NL80211_ATTR_WIPHY_FREQ                                 = 0x26
+	NL80211_ATTR_WIPHY_FREQ_HINT                            = 0xc9
+	NL80211_ATTR_WIPHY_FREQ_OFFSET                          = 0x122
+	NL80211_ATTR_WIPHY_NAME                                 = 0x2
+	NL80211_ATTR_WIPHY_RETRY_LONG                           = 0x3e
+	NL80211_ATTR_WIPHY_RETRY_SHORT                          = 0x3d
+	NL80211_ATTR_WIPHY_RTS_THRESHOLD                        = 0x40
+	NL80211_ATTR_WIPHY_SELF_MANAGED_REG                     = 0xd8
+	NL80211_ATTR_WIPHY_TX_POWER_LEVEL                       = 0x62
+	NL80211_ATTR_WIPHY_TX_POWER_SETTING                     = 0x61
+	NL80211_ATTR_WIPHY_TXQ_PARAMS                           = 0x25
+	NL80211_ATTR_WOWLAN_TRIGGERS                            = 0x75
+	NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED                  = 0x76
+	NL80211_ATTR_WPA_VERSIONS                               = 0x4b
+	NL80211_AUTHTYPE_AUTOMATIC                              = 0x8
+	NL80211_AUTHTYPE_FILS_PK                                = 0x7
+	NL80211_AUTHTYPE_FILS_SK                                = 0x5
+	NL80211_AUTHTYPE_FILS_SK_PFS                            = 0x6
+	NL80211_AUTHTYPE_FT                                     = 0x2
+	NL80211_AUTHTYPE_MAX                                    = 0x7
+	NL80211_AUTHTYPE_NETWORK_EAP                            = 0x3
+	NL80211_AUTHTYPE_OPEN_SYSTEM                            = 0x0
+	NL80211_AUTHTYPE_SAE                                    = 0x4
+	NL80211_AUTHTYPE_SHARED_KEY                             = 0x1
+	NL80211_BAND_2GHZ                                       = 0x0
+	NL80211_BAND_5GHZ                                       = 0x1
+	NL80211_BAND_60GHZ                                      = 0x2
+	NL80211_BAND_6GHZ                                       = 0x3
+	NL80211_BAND_ATTR_EDMG_BW_CONFIG                        = 0xb
+	NL80211_BAND_ATTR_EDMG_CHANNELS                         = 0xa
+	NL80211_BAND_ATTR_FREQS                                 = 0x1
+	NL80211_BAND_ATTR_HT_AMPDU_DENSITY                      = 0x6
+	NL80211_BAND_ATTR_HT_AMPDU_FACTOR                       = 0x5
+	NL80211_BAND_ATTR_HT_CAPA                               = 0x4
+	NL80211_BAND_ATTR_HT_MCS_SET                            = 0x3
+	NL80211_BAND_ATTR_IFTYPE_DATA                           = 0x9
+	NL80211_BAND_ATTR_MAX                                   = 0xb
+	NL80211_BAND_ATTR_RATES                                 = 0x2
+	NL80211_BAND_ATTR_VHT_CAPA                              = 0x8
+	NL80211_BAND_ATTR_VHT_MCS_SET                           = 0x7
+	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC                    = 0x8
+	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET                = 0xa
+	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY                    = 0x9
+	NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE                    = 0xb
+	NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA                   = 0x6
+	NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC                     = 0x2
+	NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET                 = 0x4
+	NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY                     = 0x3
+	NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE                     = 0x5
+	NL80211_BAND_IFTYPE_ATTR_IFTYPES                        = 0x1
+	NL80211_BAND_IFTYPE_ATTR_MAX                            = 0xb
+	NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS                   = 0x7
+	NL80211_BAND_LC                                         = 0x5
+	NL80211_BAND_S1GHZ                                      = 0x4
+	NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE                 = 0x2
+	NL80211_BITRATE_ATTR_MAX                                = 0x2
+	NL80211_BITRATE_ATTR_RATE                               = 0x1
+	NL80211_BSS_BEACON_IES                                  = 0xb
+	NL80211_BSS_BEACON_INTERVAL                             = 0x4
+	NL80211_BSS_BEACON_TSF                                  = 0xd
+	NL80211_BSS_BSSID                                       = 0x1
+	NL80211_BSS_CAPABILITY                                  = 0x5
+	NL80211_BSS_CHAIN_SIGNAL                                = 0x13
+	NL80211_BSS_CHAN_WIDTH_10                               = 0x1
+	NL80211_BSS_CHAN_WIDTH_1                                = 0x3
+	NL80211_BSS_CHAN_WIDTH_20                               = 0x0
+	NL80211_BSS_CHAN_WIDTH_2                                = 0x4
+	NL80211_BSS_CHAN_WIDTH_5                                = 0x2
+	NL80211_BSS_CHAN_WIDTH                                  = 0xc
+	NL80211_BSS_FREQUENCY                                   = 0x2
+	NL80211_BSS_FREQUENCY_OFFSET                            = 0x14
+	NL80211_BSS_INFORMATION_ELEMENTS                        = 0x6
+	NL80211_BSS_LAST_SEEN_BOOTTIME                          = 0xf
+	NL80211_BSS_MAX                                         = 0x16
+	NL80211_BSS_MLD_ADDR                                    = 0x16
+	NL80211_BSS_MLO_LINK_ID                                 = 0x15
+	NL80211_BSS_PAD                                         = 0x10
+	NL80211_BSS_PARENT_BSSID                                = 0x12
+	NL80211_BSS_PARENT_TSF                                  = 0x11
+	NL80211_BSS_PRESP_DATA                                  = 0xe
+	NL80211_BSS_SEEN_MS_AGO                                 = 0xa
+	NL80211_BSS_SELECT_ATTR_BAND_PREF                       = 0x2
+	NL80211_BSS_SELECT_ATTR_MAX                             = 0x3
+	NL80211_BSS_SELECT_ATTR_RSSI_ADJUST                     = 0x3
+	NL80211_BSS_SELECT_ATTR_RSSI                            = 0x1
+	NL80211_BSS_SIGNAL_MBM                                  = 0x7
+	NL80211_BSS_SIGNAL_UNSPEC                               = 0x8
+	NL80211_BSS_STATUS_ASSOCIATED                           = 0x1
+	NL80211_BSS_STATUS_AUTHENTICATED                        = 0x0
+	NL80211_BSS_STATUS                                      = 0x9
+	NL80211_BSS_STATUS_IBSS_JOINED                          = 0x2
+	NL80211_BSS_TSF                                         = 0x3
+	NL80211_CHAN_HT20                                       = 0x1
+	NL80211_CHAN_HT40MINUS                                  = 0x2
+	NL80211_CHAN_HT40PLUS                                   = 0x3
+	NL80211_CHAN_NO_HT                                      = 0x0
+	NL80211_CHAN_WIDTH_10                                   = 0x7
+	NL80211_CHAN_WIDTH_160                                  = 0x5
+	NL80211_CHAN_WIDTH_16                                   = 0xc
+	NL80211_CHAN_WIDTH_1                                    = 0x8
+	NL80211_CHAN_WIDTH_20                                   = 0x1
+	NL80211_CHAN_WIDTH_20_NOHT                              = 0x0
+	NL80211_CHAN_WIDTH_2                                    = 0x9
+	NL80211_CHAN_WIDTH_320                                  = 0xd
+	NL80211_CHAN_WIDTH_40                                   = 0x2
+	NL80211_CHAN_WIDTH_4                                    = 0xa
+	NL80211_CHAN_WIDTH_5                                    = 0x6
+	NL80211_CHAN_WIDTH_80                                   = 0x3
+	NL80211_CHAN_WIDTH_80P80                                = 0x4
+	NL80211_CHAN_WIDTH_8                                    = 0xb
+	NL80211_CMD_ABORT_SCAN                                  = 0x72
+	NL80211_CMD_ACTION                                      = 0x3b
+	NL80211_CMD_ACTION_TX_STATUS                            = 0x3c
+	NL80211_CMD_ADD_LINK                                    = 0x94
+	NL80211_CMD_ADD_LINK_STA                                = 0x96
+	NL80211_CMD_ADD_NAN_FUNCTION                            = 0x75
+	NL80211_CMD_ADD_TX_TS                                   = 0x69
+	NL80211_CMD_ASSOC_COMEBACK                              = 0x93
+	NL80211_CMD_ASSOCIATE                                   = 0x26
+	NL80211_CMD_AUTHENTICATE                                = 0x25
+	NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL                    = 0x38
+	NL80211_CMD_CHANGE_NAN_CONFIG                           = 0x77
+	NL80211_CMD_CHANNEL_SWITCH                              = 0x66
+	NL80211_CMD_CH_SWITCH_NOTIFY                            = 0x58
+	NL80211_CMD_CH_SWITCH_STARTED_NOTIFY                    = 0x6e
+	NL80211_CMD_COLOR_CHANGE_ABORTED                        = 0x90
+	NL80211_CMD_COLOR_CHANGE_COMPLETED                      = 0x91
+	NL80211_CMD_COLOR_CHANGE_REQUEST                        = 0x8e
+	NL80211_CMD_COLOR_CHANGE_STARTED                        = 0x8f
+	NL80211_CMD_CONNECT                                     = 0x2e
+	NL80211_CMD_CONN_FAILED                                 = 0x5b
+	NL80211_CMD_CONTROL_PORT_FRAME                          = 0x81
+	NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS                = 0x8b
+	NL80211_CMD_CRIT_PROTOCOL_START                         = 0x62
+	NL80211_CMD_CRIT_PROTOCOL_STOP                          = 0x63
+	NL80211_CMD_DEAUTHENTICATE                              = 0x27
+	NL80211_CMD_DEL_BEACON                                  = 0x10
+	NL80211_CMD_DEL_INTERFACE                               = 0x8
+	NL80211_CMD_DEL_KEY                                     = 0xc
+	NL80211_CMD_DEL_MPATH                                   = 0x18
+	NL80211_CMD_DEL_NAN_FUNCTION                            = 0x76
+	NL80211_CMD_DEL_PMK                                     = 0x7c
+	NL80211_CMD_DEL_PMKSA                                   = 0x35
+	NL80211_CMD_DEL_STATION                                 = 0x14
+	NL80211_CMD_DEL_TX_TS                                   = 0x6a
+	NL80211_CMD_DEL_WIPHY                                   = 0x4
+	NL80211_CMD_DISASSOCIATE                                = 0x28
+	NL80211_CMD_DISCONNECT                                  = 0x30
+	NL80211_CMD_EXTERNAL_AUTH                               = 0x7f
+	NL80211_CMD_FLUSH_PMKSA                                 = 0x36
+	NL80211_CMD_FRAME                                       = 0x3b
+	NL80211_CMD_FRAME_TX_STATUS                             = 0x3c
+	NL80211_CMD_FRAME_WAIT_CANCEL                           = 0x43
+	NL80211_CMD_FT_EVENT                                    = 0x61
+	NL80211_CMD_GET_BEACON                                  = 0xd
+	NL80211_CMD_GET_COALESCE                                = 0x64
+	NL80211_CMD_GET_FTM_RESPONDER_STATS                     = 0x82
+	NL80211_CMD_GET_INTERFACE                               = 0x5
+	NL80211_CMD_GET_KEY                                     = 0x9
+	NL80211_CMD_GET_MESH_CONFIG                             = 0x1c
+	NL80211_CMD_GET_MESH_PARAMS                             = 0x1c
+	NL80211_CMD_GET_MPATH                                   = 0x15
+	NL80211_CMD_GET_MPP                                     = 0x6b
+	NL80211_CMD_GET_POWER_SAVE                              = 0x3e
+	NL80211_CMD_GET_PROTOCOL_FEATURES                       = 0x5f
+	NL80211_CMD_GET_REG                                     = 0x1f
+	NL80211_CMD_GET_SCAN                                    = 0x20
+	NL80211_CMD_GET_STATION                                 = 0x11
+	NL80211_CMD_GET_SURVEY                                  = 0x32
+	NL80211_CMD_GET_WIPHY                                   = 0x1
+	NL80211_CMD_GET_WOWLAN                                  = 0x49
+	NL80211_CMD_JOIN_IBSS                                   = 0x2b
+	NL80211_CMD_JOIN_MESH                                   = 0x44
+	NL80211_CMD_JOIN_OCB                                    = 0x6c
+	NL80211_CMD_LEAVE_IBSS                                  = 0x2c
+	NL80211_CMD_LEAVE_MESH                                  = 0x45
+	NL80211_CMD_LEAVE_OCB                                   = 0x6d
+	NL80211_CMD_MAX                                         = 0x98
+	NL80211_CMD_MICHAEL_MIC_FAILURE                         = 0x29
+	NL80211_CMD_MODIFY_LINK_STA                             = 0x97
+	NL80211_CMD_NAN_MATCH                                   = 0x78
+	NL80211_CMD_NEW_BEACON                                  = 0xf
+	NL80211_CMD_NEW_INTERFACE                               = 0x7
+	NL80211_CMD_NEW_KEY                                     = 0xb
+	NL80211_CMD_NEW_MPATH                                   = 0x17
+	NL80211_CMD_NEW_PEER_CANDIDATE                          = 0x48
+	NL80211_CMD_NEW_SCAN_RESULTS                            = 0x22
+	NL80211_CMD_NEW_STATION                                 = 0x13
+	NL80211_CMD_NEW_SURVEY_RESULTS                          = 0x33
+	NL80211_CMD_NEW_WIPHY                                   = 0x3
+	NL80211_CMD_NOTIFY_CQM                                  = 0x40
+	NL80211_CMD_NOTIFY_RADAR                                = 0x86
+	NL80211_CMD_OBSS_COLOR_COLLISION                        = 0x8d
+	NL80211_CMD_PEER_MEASUREMENT_COMPLETE                   = 0x85
+	NL80211_CMD_PEER_MEASUREMENT_RESULT                     = 0x84
+	NL80211_CMD_PEER_MEASUREMENT_START                      = 0x83
+	NL80211_CMD_PMKSA_CANDIDATE                             = 0x50
+	NL80211_CMD_PORT_AUTHORIZED                             = 0x7d
+	NL80211_CMD_PROBE_CLIENT                                = 0x54
+	NL80211_CMD_PROBE_MESH_LINK                             = 0x88
+	NL80211_CMD_RADAR_DETECT                                = 0x5e
+	NL80211_CMD_REG_BEACON_HINT                             = 0x2a
+	NL80211_CMD_REG_CHANGE                                  = 0x24
+	NL80211_CMD_REGISTER_ACTION                             = 0x3a
+	NL80211_CMD_REGISTER_BEACONS                            = 0x55
+	NL80211_CMD_REGISTER_FRAME                              = 0x3a
+	NL80211_CMD_RELOAD_REGDB                                = 0x7e
+	NL80211_CMD_REMAIN_ON_CHANNEL                           = 0x37
+	NL80211_CMD_REMOVE_LINK                                 = 0x95
+	NL80211_CMD_REMOVE_LINK_STA                             = 0x98
+	NL80211_CMD_REQ_SET_REG                                 = 0x1b
+	NL80211_CMD_ROAM                                        = 0x2f
+	NL80211_CMD_SCAN_ABORTED                                = 0x23
+	NL80211_CMD_SCHED_SCAN_RESULTS                          = 0x4d
+	NL80211_CMD_SCHED_SCAN_STOPPED                          = 0x4e
+	NL80211_CMD_SET_BEACON                                  = 0xe
+	NL80211_CMD_SET_BSS                                     = 0x19
+	NL80211_CMD_SET_CHANNEL                                 = 0x41
+	NL80211_CMD_SET_COALESCE                                = 0x65
+	NL80211_CMD_SET_CQM                                     = 0x3f
+	NL80211_CMD_SET_FILS_AAD                                = 0x92
+	NL80211_CMD_SET_INTERFACE                               = 0x6
+	NL80211_CMD_SET_KEY                                     = 0xa
+	NL80211_CMD_SET_MAC_ACL                                 = 0x5d
+	NL80211_CMD_SET_MCAST_RATE                              = 0x5c
+	NL80211_CMD_SET_MESH_CONFIG                             = 0x1d
+	NL80211_CMD_SET_MESH_PARAMS                             = 0x1d
+	NL80211_CMD_SET_MGMT_EXTRA_IE                           = 0x1e
+	NL80211_CMD_SET_MPATH                                   = 0x16
+	NL80211_CMD_SET_MULTICAST_TO_UNICAST                    = 0x79
+	NL80211_CMD_SET_NOACK_MAP                               = 0x57
+	NL80211_CMD_SET_PMK                                     = 0x7b
+	NL80211_CMD_SET_PMKSA                                   = 0x34
+	NL80211_CMD_SET_POWER_SAVE                              = 0x3d
+	NL80211_CMD_SET_QOS_MAP                                 = 0x68
+	NL80211_CMD_SET_REG                                     = 0x1a
+	NL80211_CMD_SET_REKEY_OFFLOAD                           = 0x4f
+	NL80211_CMD_SET_SAR_SPECS                               = 0x8c
+	NL80211_CMD_SET_STATION                                 = 0x12
+	NL80211_CMD_SET_TID_CONFIG                              = 0x89
+	NL80211_CMD_SET_TX_BITRATE_MASK                         = 0x39
+	NL80211_CMD_SET_WDS_PEER                                = 0x42
+	NL80211_CMD_SET_WIPHY                                   = 0x2
+	NL80211_CMD_SET_WIPHY_NETNS                             = 0x31
+	NL80211_CMD_SET_WOWLAN                                  = 0x4a
+	NL80211_CMD_STA_OPMODE_CHANGED                          = 0x80
+	NL80211_CMD_START_AP                                    = 0xf
+	NL80211_CMD_START_NAN                                   = 0x73
+	NL80211_CMD_START_P2P_DEVICE                            = 0x59
+	NL80211_CMD_START_SCHED_SCAN                            = 0x4b
+	NL80211_CMD_STOP_AP                                     = 0x10
+	NL80211_CMD_STOP_NAN                                    = 0x74
+	NL80211_CMD_STOP_P2P_DEVICE                             = 0x5a
+	NL80211_CMD_STOP_SCHED_SCAN                             = 0x4c
+	NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH                  = 0x70
+	NL80211_CMD_TDLS_CHANNEL_SWITCH                         = 0x6f
+	NL80211_CMD_TDLS_MGMT                                   = 0x52
+	NL80211_CMD_TDLS_OPER                                   = 0x51
+	NL80211_CMD_TESTMODE                                    = 0x2d
+	NL80211_CMD_TRIGGER_SCAN                                = 0x21
+	NL80211_CMD_UNEXPECTED_4ADDR_FRAME                      = 0x56
+	NL80211_CMD_UNEXPECTED_FRAME                            = 0x53
+	NL80211_CMD_UNPROT_BEACON                               = 0x8a
+	NL80211_CMD_UNPROT_DEAUTHENTICATE                       = 0x46
+	NL80211_CMD_UNPROT_DISASSOCIATE                         = 0x47
+	NL80211_CMD_UNSPEC                                      = 0x0
+	NL80211_CMD_UPDATE_CONNECT_PARAMS                       = 0x7a
+	NL80211_CMD_UPDATE_FT_IES                               = 0x60
+	NL80211_CMD_UPDATE_OWE_INFO                             = 0x87
+	NL80211_CMD_VENDOR                                      = 0x67
+	NL80211_CMD_WIPHY_REG_CHANGE                            = 0x71
+	NL80211_COALESCE_CONDITION_MATCH                        = 0x0
+	NL80211_COALESCE_CONDITION_NO_MATCH                     = 0x1
+	NL80211_CONN_FAIL_BLOCKED_CLIENT                        = 0x1
+	NL80211_CONN_FAIL_MAX_CLIENTS                           = 0x0
+	NL80211_CQM_RSSI_BEACON_LOSS_EVENT                      = 0x2
+	NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH                   = 0x1
+	NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW                    = 0x0
+	NL80211_CQM_TXE_MAX_INTVL                               = 0x708
+	NL80211_CRIT_PROTO_APIPA                                = 0x3
+	NL80211_CRIT_PROTO_DHCP                                 = 0x1
+	NL80211_CRIT_PROTO_EAPOL                                = 0x2
+	NL80211_CRIT_PROTO_MAX_DURATION                         = 0x1388
+	NL80211_CRIT_PROTO_UNSPEC                               = 0x0
+	NL80211_DFS_AVAILABLE                                   = 0x2
+	NL80211_DFS_ETSI                                        = 0x2
+	NL80211_DFS_FCC                                         = 0x1
+	NL80211_DFS_JP                                          = 0x3
+	NL80211_DFS_UNAVAILABLE                                 = 0x1
+	NL80211_DFS_UNSET                                       = 0x0
+	NL80211_DFS_USABLE                                      = 0x0
+	NL80211_EDMG_BW_CONFIG_MAX                              = 0xf
+	NL80211_EDMG_BW_CONFIG_MIN                              = 0x4
+	NL80211_EDMG_CHANNELS_MAX                               = 0x3c
+	NL80211_EDMG_CHANNELS_MIN                               = 0x1
+	NL80211_EHT_MAX_CAPABILITY_LEN                          = 0x33
+	NL80211_EHT_MIN_CAPABILITY_LEN                          = 0xd
+	NL80211_EXTERNAL_AUTH_ABORT                             = 0x1
+	NL80211_EXTERNAL_AUTH_START                             = 0x0
+	NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK               = 0x32
+	NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X               = 0x10
+	NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK              = 0xf
+	NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP             = 0x12
+	NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT                  = 0x1b
+	NL80211_EXT_FEATURE_AIRTIME_FAIRNESS                    = 0x21
+	NL80211_EXT_FEATURE_AP_PMKSA_CACHING                    = 0x22
+	NL80211_EXT_FEATURE_AQL                                 = 0x28
+	NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT            = 0x2e
+	NL80211_EXT_FEATURE_BEACON_PROTECTION                   = 0x29
+	NL80211_EXT_FEATURE_BEACON_RATE_HE                      = 0x36
+	NL80211_EXT_FEATURE_BEACON_RATE_HT                      = 0x7
+	NL80211_EXT_FEATURE_BEACON_RATE_LEGACY                  = 0x6
+	NL80211_EXT_FEATURE_BEACON_RATE_VHT                     = 0x8
+	NL80211_EXT_FEATURE_BSS_COLOR                           = 0x3a
+	NL80211_EXT_FEATURE_BSS_PARENT_TSF                      = 0x4
+	NL80211_EXT_FEATURE_CAN_REPLACE_PTK0                    = 0x1f
+	NL80211_EXT_FEATURE_CONTROL_PORT_NO_PREAUTH             = 0x2a
+	NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211           = 0x1a
+	NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS = 0x30
+	NL80211_EXT_FEATURE_CQM_RSSI_LIST                       = 0xd
+	NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT             = 0x1b
+	NL80211_EXT_FEATURE_DEL_IBSS_STA                        = 0x2c
+	NL80211_EXT_FEATURE_DFS_OFFLOAD                         = 0x19
+	NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER                = 0x20
+	NL80211_EXT_FEATURE_EXT_KEY_ID                          = 0x24
+	NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD                 = 0x3b
+	NL80211_EXT_FEATURE_FILS_DISCOVERY                      = 0x34
+	NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME               = 0x11
+	NL80211_EXT_FEATURE_FILS_SK_OFFLOAD                     = 0xe
+	NL80211_EXT_FEATURE_FILS_STA                            = 0x9
+	NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN                  = 0x18
+	NL80211_EXT_FEATURE_LOW_POWER_SCAN                      = 0x17
+	NL80211_EXT_FEATURE_LOW_SPAN_SCAN                       = 0x16
+	NL80211_EXT_FEATURE_MFP_OPTIONAL                        = 0x15
+	NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA                   = 0xa
+	NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED         = 0xb
+	NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS             = 0x2d
+	NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER                 = 0x2
+	NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION  = 0x14
+	NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE          = 0x13
+	NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION        = 0x31
+	NL80211_EXT_FEATURE_POWERED_ADDR_CHANGE                 = 0x3d
+	NL80211_EXT_FEATURE_PROTECTED_TWT                       = 0x2b
+	NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE         = 0x39
+	NL80211_EXT_FEATURE_RADAR_BACKGROUND                    = 0x3c
+	NL80211_EXT_FEATURE_RRM                                 = 0x1
+	NL80211_EXT_FEATURE_SAE_OFFLOAD_AP                      = 0x33
+	NL80211_EXT_FEATURE_SAE_OFFLOAD                         = 0x26
+	NL80211_EXT_FEATURE_SCAN_FREQ_KHZ                       = 0x2f
+	NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT               = 0x1e
+	NL80211_EXT_FEATURE_SCAN_RANDOM_SN                      = 0x1d
+	NL80211_EXT_FEATURE_SCAN_START_TIME                     = 0x3
+	NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD = 0x23
+	NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI            = 0xc
+	NL80211_EXT_FEATURE_SECURE_LTF                          = 0x37
+	NL80211_EXT_FEATURE_SECURE_RTT                          = 0x38
+	NL80211_EXT_FEATURE_SET_SCAN_DWELL                      = 0x5
+	NL80211_EXT_FEATURE_STA_TX_PWR                          = 0x25
+	NL80211_EXT_FEATURE_TXQS                                = 0x1c
+	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP              = 0x35
+	NL80211_EXT_FEATURE_VHT_IBSS                            = 0x0
+	NL80211_EXT_FEATURE_VLAN_OFFLOAD                        = 0x27
+	NL80211_FEATURE_ACKTO_ESTIMATION                        = 0x800000
+	NL80211_FEATURE_ACTIVE_MONITOR                          = 0x20000
+	NL80211_FEATURE_ADVERTISE_CHAN_LIMITS                   = 0x4000
+	NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE               = 0x40000
+	NL80211_FEATURE_AP_SCAN                                 = 0x100
+	NL80211_FEATURE_CELL_BASE_REG_HINTS                     = 0x8
+	NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES               = 0x80000
+	NL80211_FEATURE_DYNAMIC_SMPS                            = 0x2000000
+	NL80211_FEATURE_FULL_AP_CLIENT_STATE                    = 0x8000
+	NL80211_FEATURE_HT_IBSS                                 = 0x2
+	NL80211_FEATURE_INACTIVITY_TIMER                        = 0x4
+	NL80211_FEATURE_LOW_PRIORITY_SCAN                       = 0x40
+	NL80211_FEATURE_MAC_ON_CREATE                           = 0x8000000
+	NL80211_FEATURE_ND_RANDOM_MAC_ADDR                      = 0x80000000
+	NL80211_FEATURE_NEED_OBSS_SCAN                          = 0x400
+	NL80211_FEATURE_P2P_DEVICE_NEEDS_CHANNEL                = 0x10
+	NL80211_FEATURE_P2P_GO_CTWIN                            = 0x800
+	NL80211_FEATURE_P2P_GO_OPPPS                            = 0x1000
+	NL80211_FEATURE_QUIET                                   = 0x200000
+	NL80211_FEATURE_SAE                                     = 0x20
+	NL80211_FEATURE_SCAN_FLUSH                              = 0x80
+	NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR                    = 0x20000000
+	NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR              = 0x40000000
+	NL80211_FEATURE_SK_TX_STATUS                            = 0x1
+	NL80211_FEATURE_STATIC_SMPS                             = 0x1000000
+	NL80211_FEATURE_SUPPORTS_WMM_ADMISSION                  = 0x4000000
+	NL80211_FEATURE_TDLS_CHANNEL_SWITCH                     = 0x10000000
+	NL80211_FEATURE_TX_POWER_INSERTION                      = 0x400000
+	NL80211_FEATURE_USERSPACE_MPM                           = 0x10000
+	NL80211_FEATURE_VIF_TXPOWER                             = 0x200
+	NL80211_FEATURE_WFA_TPC_IE_IN_PROBES                    = 0x100000
+	NL80211_FILS_DISCOVERY_ATTR_INT_MAX                     = 0x2
+	NL80211_FILS_DISCOVERY_ATTR_INT_MIN                     = 0x1
+	NL80211_FILS_DISCOVERY_ATTR_MAX                         = 0x3
+	NL80211_FILS_DISCOVERY_ATTR_TMPL                        = 0x3
+	NL80211_FILS_DISCOVERY_TMPL_MIN_LEN                     = 0x2a
+	NL80211_FREQUENCY_ATTR_16MHZ                            = 0x19
+	NL80211_FREQUENCY_ATTR_1MHZ                             = 0x15
+	NL80211_FREQUENCY_ATTR_2MHZ                             = 0x16
+	NL80211_FREQUENCY_ATTR_4MHZ                             = 0x17
+	NL80211_FREQUENCY_ATTR_8MHZ                             = 0x18
+	NL80211_FREQUENCY_ATTR_DFS_CAC_TIME                     = 0xd
+	NL80211_FREQUENCY_ATTR_DFS_STATE                        = 0x7
+	NL80211_FREQUENCY_ATTR_DFS_TIME                         = 0x8
+	NL80211_FREQUENCY_ATTR_DISABLED                         = 0x2
+	NL80211_FREQUENCY_ATTR_FREQ                             = 0x1
+	NL80211_FREQUENCY_ATTR_GO_CONCURRENT                    = 0xf
+	NL80211_FREQUENCY_ATTR_INDOOR_ONLY                      = 0xe
+	NL80211_FREQUENCY_ATTR_IR_CONCURRENT                    = 0xf
+	NL80211_FREQUENCY_ATTR_MAX                              = 0x1b
+	NL80211_FREQUENCY_ATTR_MAX_TX_POWER                     = 0x6
+	NL80211_FREQUENCY_ATTR_NO_10MHZ                         = 0x11
+	NL80211_FREQUENCY_ATTR_NO_160MHZ                        = 0xc
+	NL80211_FREQUENCY_ATTR_NO_20MHZ                         = 0x10
+	NL80211_FREQUENCY_ATTR_NO_320MHZ                        = 0x1a
+	NL80211_FREQUENCY_ATTR_NO_80MHZ                         = 0xb
+	NL80211_FREQUENCY_ATTR_NO_EHT                           = 0x1b
+	NL80211_FREQUENCY_ATTR_NO_HE                            = 0x13
+	NL80211_FREQUENCY_ATTR_NO_HT40_MINUS                    = 0x9
+	NL80211_FREQUENCY_ATTR_NO_HT40_PLUS                     = 0xa
+	NL80211_FREQUENCY_ATTR_NO_IBSS                          = 0x3
+	NL80211_FREQUENCY_ATTR_NO_IR                            = 0x3
+	NL80211_FREQUENCY_ATTR_OFFSET                           = 0x14
+	NL80211_FREQUENCY_ATTR_PASSIVE_SCAN                     = 0x3
+	NL80211_FREQUENCY_ATTR_RADAR                            = 0x5
+	NL80211_FREQUENCY_ATTR_WMM                              = 0x12
+	NL80211_FTM_RESP_ATTR_CIVICLOC                          = 0x3
+	NL80211_FTM_RESP_ATTR_ENABLED                           = 0x1
+	NL80211_FTM_RESP_ATTR_LCI                               = 0x2
+	NL80211_FTM_RESP_ATTR_MAX                               = 0x3
+	NL80211_FTM_STATS_ASAP_NUM                              = 0x4
+	NL80211_FTM_STATS_FAILED_NUM                            = 0x3
+	NL80211_FTM_STATS_MAX                                   = 0xa
+	NL80211_FTM_STATS_NON_ASAP_NUM                          = 0x5
+	NL80211_FTM_STATS_OUT_OF_WINDOW_TRIGGERS_NUM            = 0x9
+	NL80211_FTM_STATS_PAD                                   = 0xa
+	NL80211_FTM_STATS_PARTIAL_NUM                           = 0x2
+	NL80211_FTM_STATS_RESCHEDULE_REQUESTS_NUM               = 0x8
+	NL80211_FTM_STATS_SUCCESS_NUM                           = 0x1
+	NL80211_FTM_STATS_TOTAL_DURATION_MSEC                   = 0x6
+	NL80211_FTM_STATS_UNKNOWN_TRIGGERS_NUM                  = 0x7
+	NL80211_GENL_NAME                                       = "nl80211"
+	NL80211_HE_BSS_COLOR_ATTR_COLOR                         = 0x1
+	NL80211_HE_BSS_COLOR_ATTR_DISABLED                      = 0x2
+	NL80211_HE_BSS_COLOR_ATTR_MAX                           = 0x3
+	NL80211_HE_BSS_COLOR_ATTR_PARTIAL                       = 0x3
+	NL80211_HE_MAX_CAPABILITY_LEN                           = 0x36
+	NL80211_HE_MIN_CAPABILITY_LEN                           = 0x10
+	NL80211_HE_NSS_MAX                                      = 0x8
+	NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP                = 0x4
+	NL80211_HE_OBSS_PD_ATTR_MAX                             = 0x6
+	NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET                      = 0x2
+	NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET                      = 0x1
+	NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET              = 0x3
+	NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP            = 0x5
+	NL80211_HE_OBSS_PD_ATTR_SR_CTRL                         = 0x6
+	NL80211_HIDDEN_SSID_NOT_IN_USE                          = 0x0
+	NL80211_HIDDEN_SSID_ZERO_CONTENTS                       = 0x2
+	NL80211_HIDDEN_SSID_ZERO_LEN                            = 0x1
+	NL80211_HT_CAPABILITY_LEN                               = 0x1a
+	NL80211_IFACE_COMB_BI_MIN_GCD                           = 0x7
+	NL80211_IFACE_COMB_LIMITS                               = 0x1
+	NL80211_IFACE_COMB_MAXNUM                               = 0x2
+	NL80211_IFACE_COMB_NUM_CHANNELS                         = 0x4
+	NL80211_IFACE_COMB_RADAR_DETECT_REGIONS                 = 0x6
+	NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS                  = 0x5
+	NL80211_IFACE_COMB_STA_AP_BI_MATCH                      = 0x3
+	NL80211_IFACE_COMB_UNSPEC                               = 0x0
+	NL80211_IFACE_LIMIT_MAX                                 = 0x1
+	NL80211_IFACE_LIMIT_TYPES                               = 0x2
+	NL80211_IFACE_LIMIT_UNSPEC                              = 0x0
+	NL80211_IFTYPE_ADHOC                                    = 0x1
+	NL80211_IFTYPE_AKM_ATTR_IFTYPES                         = 0x1
+	NL80211_IFTYPE_AKM_ATTR_MAX                             = 0x2
+	NL80211_IFTYPE_AKM_ATTR_SUITES                          = 0x2
+	NL80211_IFTYPE_AP                                       = 0x3
+	NL80211_IFTYPE_AP_VLAN                                  = 0x4
+	NL80211_IFTYPE_MAX                                      = 0xc
+	NL80211_IFTYPE_MESH_POINT                               = 0x7
+	NL80211_IFTYPE_MONITOR                                  = 0x6
+	NL80211_IFTYPE_NAN                                      = 0xc
+	NL80211_IFTYPE_OCB                                      = 0xb
+	NL80211_IFTYPE_P2P_CLIENT                               = 0x8
+	NL80211_IFTYPE_P2P_DEVICE                               = 0xa
+	NL80211_IFTYPE_P2P_GO                                   = 0x9
+	NL80211_IFTYPE_STATION                                  = 0x2
+	NL80211_IFTYPE_UNSPECIFIED                              = 0x0
+	NL80211_IFTYPE_WDS                                      = 0x5
+	NL80211_KCK_EXT_LEN                                     = 0x18
+	NL80211_KCK_LEN                                         = 0x10
+	NL80211_KEK_EXT_LEN                                     = 0x20
+	NL80211_KEK_LEN                                         = 0x10
+	NL80211_KEY_CIPHER                                      = 0x3
+	NL80211_KEY_DATA                                        = 0x1
+	NL80211_KEY_DEFAULT_BEACON                              = 0xa
+	NL80211_KEY_DEFAULT                                     = 0x5
+	NL80211_KEY_DEFAULT_MGMT                                = 0x6
+	NL80211_KEY_DEFAULT_TYPE_MULTICAST                      = 0x2
+	NL80211_KEY_DEFAULT_TYPES                               = 0x8
+	NL80211_KEY_DEFAULT_TYPE_UNICAST                        = 0x1
+	NL80211_KEY_IDX                                         = 0x2
+	NL80211_KEY_MAX                                         = 0xa
+	NL80211_KEY_MODE                                        = 0x9
+	NL80211_KEY_NO_TX                                       = 0x1
+	NL80211_KEY_RX_TX                                       = 0x0
+	NL80211_KEY_SEQ                                         = 0x4
+	NL80211_KEY_SET_TX                                      = 0x2
+	NL80211_KEY_TYPE                                        = 0x7
+	NL80211_KEYTYPE_GROUP                                   = 0x0
+	NL80211_KEYTYPE_PAIRWISE                                = 0x1
+	NL80211_KEYTYPE_PEERKEY                                 = 0x2
+	NL80211_MAX_NR_AKM_SUITES                               = 0x2
+	NL80211_MAX_NR_CIPHER_SUITES                            = 0x5
+	NL80211_MAX_SUPP_HT_RATES                               = 0x4d
+	NL80211_MAX_SUPP_RATES                                  = 0x20
+	NL80211_MAX_SUPP_REG_RULES                              = 0x80
+	NL80211_MBSSID_CONFIG_ATTR_EMA                          = 0x5
+	NL80211_MBSSID_CONFIG_ATTR_INDEX                        = 0x3
+	NL80211_MBSSID_CONFIG_ATTR_MAX                          = 0x5
+	NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY  = 0x2
+	NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES               = 0x1
+	NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX                   = 0x4
+	NL80211_MESHCONF_ATTR_MAX                               = 0x1f
+	NL80211_MESHCONF_AUTO_OPEN_PLINKS                       = 0x7
+	NL80211_MESHCONF_AWAKE_WINDOW                           = 0x1b
+	NL80211_MESHCONF_CONFIRM_TIMEOUT                        = 0x2
+	NL80211_MESHCONF_CONNECTED_TO_AS                        = 0x1f
+	NL80211_MESHCONF_CONNECTED_TO_GATE                      = 0x1d
+	NL80211_MESHCONF_ELEMENT_TTL                            = 0xf
+	NL80211_MESHCONF_FORWARDING                             = 0x13
+	NL80211_MESHCONF_GATE_ANNOUNCEMENTS                     = 0x11
+	NL80211_MESHCONF_HOLDING_TIMEOUT                        = 0x3
+	NL80211_MESHCONF_HT_OPMODE                              = 0x16
+	NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT               = 0xb
+	NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL             = 0x19
+	NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES                  = 0x8
+	NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME                = 0xd
+	NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT              = 0x17
+	NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL                 = 0x12
+	NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL                 = 0xc
+	NL80211_MESHCONF_HWMP_RANN_INTERVAL                     = 0x10
+	NL80211_MESHCONF_HWMP_ROOT_INTERVAL                     = 0x18
+	NL80211_MESHCONF_HWMP_ROOTMODE                          = 0xe
+	NL80211_MESHCONF_MAX_PEER_LINKS                         = 0x4
+	NL80211_MESHCONF_MAX_RETRIES                            = 0x5
+	NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT                  = 0xa
+	NL80211_MESHCONF_NOLEARN                                = 0x1e
+	NL80211_MESHCONF_PATH_REFRESH_TIME                      = 0x9
+	NL80211_MESHCONF_PLINK_TIMEOUT                          = 0x1c
+	NL80211_MESHCONF_POWER_MODE                             = 0x1a
+	NL80211_MESHCONF_RETRY_TIMEOUT                          = 0x1
+	NL80211_MESHCONF_RSSI_THRESHOLD                         = 0x14
+	NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR               = 0x15
+	NL80211_MESHCONF_TTL                                    = 0x6
+	NL80211_MESH_POWER_ACTIVE                               = 0x1
+	NL80211_MESH_POWER_DEEP_SLEEP                           = 0x3
+	NL80211_MESH_POWER_LIGHT_SLEEP                          = 0x2
+	NL80211_MESH_POWER_MAX                                  = 0x3
+	NL80211_MESH_POWER_UNKNOWN                              = 0x0
+	NL80211_MESH_SETUP_ATTR_MAX                             = 0x8
+	NL80211_MESH_SETUP_AUTH_PROTOCOL                        = 0x8
+	NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC                 = 0x2
+	NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL               = 0x1
+	NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC                   = 0x6
+	NL80211_MESH_SETUP_IE                                   = 0x3
+	NL80211_MESH_SETUP_USERSPACE_AMPE                       = 0x5
+	NL80211_MESH_SETUP_USERSPACE_AUTH                       = 0x4
+	NL80211_MESH_SETUP_USERSPACE_MPM                        = 0x7
+	NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE                   = 0x3
+	NL80211_MFP_NO                                          = 0x0
+	NL80211_MFP_OPTIONAL                                    = 0x2
+	NL80211_MFP_REQUIRED                                    = 0x1
+	NL80211_MIN_REMAIN_ON_CHANNEL_TIME                      = 0xa
+	NL80211_MNTR_FLAG_ACTIVE                                = 0x6
+	NL80211_MNTR_FLAG_CONTROL                               = 0x3
+	NL80211_MNTR_FLAG_COOK_FRAMES                           = 0x5
+	NL80211_MNTR_FLAG_FCSFAIL                               = 0x1
+	NL80211_MNTR_FLAG_MAX                                   = 0x6
+	NL80211_MNTR_FLAG_OTHER_BSS                             = 0x4
+	NL80211_MNTR_FLAG_PLCPFAIL                              = 0x2
+	NL80211_MPATH_FLAG_ACTIVE                               = 0x1
+	NL80211_MPATH_FLAG_FIXED                                = 0x8
+	NL80211_MPATH_FLAG_RESOLVED                             = 0x10
+	NL80211_MPATH_FLAG_RESOLVING                            = 0x2
+	NL80211_MPATH_FLAG_SN_VALID                             = 0x4
+	NL80211_MPATH_INFO_DISCOVERY_RETRIES                    = 0x7
+	NL80211_MPATH_INFO_DISCOVERY_TIMEOUT                    = 0x6
+	NL80211_MPATH_INFO_EXPTIME                              = 0x4
+	NL80211_MPATH_INFO_FLAGS                                = 0x5
+	NL80211_MPATH_INFO_FRAME_QLEN                           = 0x1
+	NL80211_MPATH_INFO_HOP_COUNT                            = 0x8
+	NL80211_MPATH_INFO_MAX                                  = 0x9
+	NL80211_MPATH_INFO_METRIC                               = 0x3
+	NL80211_MPATH_INFO_PATH_CHANGE                          = 0x9
+	NL80211_MPATH_INFO_SN                                   = 0x2
+	NL80211_MULTICAST_GROUP_CONFIG                          = "config"
+	NL80211_MULTICAST_GROUP_MLME                            = "mlme"
+	NL80211_MULTICAST_GROUP_NAN                             = "nan"
+	NL80211_MULTICAST_GROUP_REG                             = "regulatory"
+	NL80211_MULTICAST_GROUP_SCAN                            = "scan"
+	NL80211_MULTICAST_GROUP_TESTMODE                        = "testmode"
+	NL80211_MULTICAST_GROUP_VENDOR                          = "vendor"
+	NL80211_NAN_FUNC_ATTR_MAX                               = 0x10
+	NL80211_NAN_FUNC_CLOSE_RANGE                            = 0x9
+	NL80211_NAN_FUNC_FOLLOW_UP                              = 0x2
+	NL80211_NAN_FUNC_FOLLOW_UP_DEST                         = 0x8
+	NL80211_NAN_FUNC_FOLLOW_UP_ID                           = 0x6
+	NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID                       = 0x7
+	NL80211_NAN_FUNC_INSTANCE_ID                            = 0xf
+	NL80211_NAN_FUNC_MAX_TYPE                               = 0x2
+	NL80211_NAN_FUNC_PUBLISH_BCAST                          = 0x4
+	NL80211_NAN_FUNC_PUBLISH                                = 0x0
+	NL80211_NAN_FUNC_PUBLISH_TYPE                           = 0x3
+	NL80211_NAN_FUNC_RX_MATCH_FILTER                        = 0xd
+	NL80211_NAN_FUNC_SERVICE_ID                             = 0x2
+	NL80211_NAN_FUNC_SERVICE_ID_LEN                         = 0x6
+	NL80211_NAN_FUNC_SERVICE_INFO                           = 0xb
+	NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN              = 0xff
+	NL80211_NAN_FUNC_SRF                                    = 0xc
+	NL80211_NAN_FUNC_SRF_MAX_LEN                            = 0xff
+	NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE                       = 0x5
+	NL80211_NAN_FUNC_SUBSCRIBE                              = 0x1
+	NL80211_NAN_FUNC_TERM_REASON                            = 0x10
+	NL80211_NAN_FUNC_TERM_REASON_ERROR                      = 0x2
+	NL80211_NAN_FUNC_TERM_REASON_TTL_EXPIRED                = 0x1
+	NL80211_NAN_FUNC_TERM_REASON_USER_REQUEST               = 0x0
+	NL80211_NAN_FUNC_TTL                                    = 0xa
+	NL80211_NAN_FUNC_TX_MATCH_FILTER                        = 0xe
+	NL80211_NAN_FUNC_TYPE                                   = 0x1
+	NL80211_NAN_MATCH_ATTR_MAX                              = 0x2
+	NL80211_NAN_MATCH_FUNC_LOCAL                            = 0x1
+	NL80211_NAN_MATCH_FUNC_PEER                             = 0x2
+	NL80211_NAN_SOLICITED_PUBLISH                           = 0x1
+	NL80211_NAN_SRF_ATTR_MAX                                = 0x4
+	NL80211_NAN_SRF_BF                                      = 0x2
+	NL80211_NAN_SRF_BF_IDX                                  = 0x3
+	NL80211_NAN_SRF_INCLUDE                                 = 0x1
+	NL80211_NAN_SRF_MAC_ADDRS                               = 0x4
+	NL80211_NAN_UNSOLICITED_PUBLISH                         = 0x2
+	NL80211_NUM_ACS                                         = 0x4
+	NL80211_P2P_PS_SUPPORTED                                = 0x1
+	NL80211_P2P_PS_UNSUPPORTED                              = 0x0
+	NL80211_PKTPAT_MASK                                     = 0x1
+	NL80211_PKTPAT_OFFSET                                   = 0x3
+	NL80211_PKTPAT_PATTERN                                  = 0x2
+	NL80211_PLINK_ACTION_BLOCK                              = 0x2
+	NL80211_PLINK_ACTION_NO_ACTION                          = 0x0
+	NL80211_PLINK_ACTION_OPEN                               = 0x1
+	NL80211_PLINK_BLOCKED                                   = 0x6
+	NL80211_PLINK_CNF_RCVD                                  = 0x3
+	NL80211_PLINK_ESTAB                                     = 0x4
+	NL80211_PLINK_HOLDING                                   = 0x5
+	NL80211_PLINK_LISTEN                                    = 0x0
+	NL80211_PLINK_OPN_RCVD                                  = 0x2
+	NL80211_PLINK_OPN_SNT                                   = 0x1
+	NL80211_PMKSA_CANDIDATE_BSSID                           = 0x2
+	NL80211_PMKSA_CANDIDATE_INDEX                           = 0x1
+	NL80211_PMKSA_CANDIDATE_PREAUTH                         = 0x3
+	NL80211_PMSR_ATTR_MAX                                   = 0x5
+	NL80211_PMSR_ATTR_MAX_PEERS                             = 0x1
+	NL80211_PMSR_ATTR_PEERS                                 = 0x5
+	NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR                    = 0x3
+	NL80211_PMSR_ATTR_REPORT_AP_TSF                         = 0x2
+	NL80211_PMSR_ATTR_TYPE_CAPA                             = 0x4
+	NL80211_PMSR_FTM_CAPA_ATTR_ASAP                         = 0x1
+	NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS                   = 0x6
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT          = 0x7
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX                          = 0xa
+	NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST           = 0x8
+	NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP                     = 0x2
+	NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED            = 0xa
+	NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES                    = 0x5
+	NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC                 = 0x4
+	NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI                      = 0x3
+	NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED                = 0x9
+	NL80211_PMSR_FTM_FAILURE_BAD_CHANGED_PARAMS             = 0x7
+	NL80211_PMSR_FTM_FAILURE_INVALID_TIMESTAMP              = 0x5
+	NL80211_PMSR_FTM_FAILURE_NO_RESPONSE                    = 0x1
+	NL80211_PMSR_FTM_FAILURE_PEER_BUSY                      = 0x6
+	NL80211_PMSR_FTM_FAILURE_PEER_NOT_CAPABLE               = 0x4
+	NL80211_PMSR_FTM_FAILURE_REJECTED                       = 0x2
+	NL80211_PMSR_FTM_FAILURE_UNSPECIFIED                    = 0x0
+	NL80211_PMSR_FTM_FAILURE_WRONG_CHANNEL                  = 0x3
+	NL80211_PMSR_FTM_REQ_ATTR_ASAP                          = 0x1
+	NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR                     = 0xd
+	NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION                = 0x5
+	NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD                  = 0x4
+	NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST                = 0x6
+	NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK                  = 0xc
+	NL80211_PMSR_FTM_REQ_ATTR_MAX                           = 0xd
+	NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED             = 0xb
+	NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP                = 0x3
+	NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES              = 0x7
+	NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE                      = 0x2
+	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC              = 0x9
+	NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI                   = 0x8
+	NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED                 = 0xa
+	NL80211_PMSR_FTM_RESP_ATTR_BURST_DURATION               = 0x7
+	NL80211_PMSR_FTM_RESP_ATTR_BURST_INDEX                  = 0x2
+	NL80211_PMSR_FTM_RESP_ATTR_BUSY_RETRY_TIME              = 0x5
+	NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC                     = 0x14
+	NL80211_PMSR_FTM_RESP_ATTR_DIST_AVG                     = 0x10
+	NL80211_PMSR_FTM_RESP_ATTR_DIST_SPREAD                  = 0x12
+	NL80211_PMSR_FTM_RESP_ATTR_DIST_VARIANCE                = 0x11
+	NL80211_PMSR_FTM_RESP_ATTR_FAIL_REASON                  = 0x1
+	NL80211_PMSR_FTM_RESP_ATTR_FTMS_PER_BURST               = 0x8
+	NL80211_PMSR_FTM_RESP_ATTR_LCI                          = 0x13
+	NL80211_PMSR_FTM_RESP_ATTR_MAX                          = 0x15
+	NL80211_PMSR_FTM_RESP_ATTR_NUM_BURSTS_EXP               = 0x6
+	NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_ATTEMPTS            = 0x3
+	NL80211_PMSR_FTM_RESP_ATTR_NUM_FTMR_SUCCESSES           = 0x4
+	NL80211_PMSR_FTM_RESP_ATTR_PAD                          = 0x15
+	NL80211_PMSR_FTM_RESP_ATTR_RSSI_AVG                     = 0x9
+	NL80211_PMSR_FTM_RESP_ATTR_RSSI_SPREAD                  = 0xa
+	NL80211_PMSR_FTM_RESP_ATTR_RTT_AVG                      = 0xd
+	NL80211_PMSR_FTM_RESP_ATTR_RTT_SPREAD                   = 0xf
+	NL80211_PMSR_FTM_RESP_ATTR_RTT_VARIANCE                 = 0xe
+	NL80211_PMSR_FTM_RESP_ATTR_RX_RATE                      = 0xc
+	NL80211_PMSR_FTM_RESP_ATTR_TX_RATE                      = 0xb
+	NL80211_PMSR_PEER_ATTR_ADDR                             = 0x1
+	NL80211_PMSR_PEER_ATTR_CHAN                             = 0x2
+	NL80211_PMSR_PEER_ATTR_MAX                              = 0x4
+	NL80211_PMSR_PEER_ATTR_REQ                              = 0x3
+	NL80211_PMSR_PEER_ATTR_RESP                             = 0x4
+	NL80211_PMSR_REQ_ATTR_DATA                              = 0x1
+	NL80211_PMSR_REQ_ATTR_GET_AP_TSF                        = 0x2
+	NL80211_PMSR_REQ_ATTR_MAX                               = 0x2
+	NL80211_PMSR_RESP_ATTR_AP_TSF                           = 0x4
+	NL80211_PMSR_RESP_ATTR_DATA                             = 0x1
+	NL80211_PMSR_RESP_ATTR_FINAL                            = 0x5
+	NL80211_PMSR_RESP_ATTR_HOST_TIME                        = 0x3
+	NL80211_PMSR_RESP_ATTR_MAX                              = 0x6
+	NL80211_PMSR_RESP_ATTR_PAD                              = 0x6
+	NL80211_PMSR_RESP_ATTR_STATUS                           = 0x2
+	NL80211_PMSR_STATUS_FAILURE                             = 0x3
+	NL80211_PMSR_STATUS_REFUSED                             = 0x1
+	NL80211_PMSR_STATUS_SUCCESS                             = 0x0
+	NL80211_PMSR_STATUS_TIMEOUT                             = 0x2
+	NL80211_PMSR_TYPE_FTM                                   = 0x1
+	NL80211_PMSR_TYPE_INVALID                               = 0x0
+	NL80211_PMSR_TYPE_MAX                                   = 0x1
+	NL80211_PREAMBLE_DMG                                    = 0x3
+	NL80211_PREAMBLE_HE                                     = 0x4
+	NL80211_PREAMBLE_HT                                     = 0x1
+	NL80211_PREAMBLE_LEGACY                                 = 0x0
+	NL80211_PREAMBLE_VHT                                    = 0x2
+	NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U               = 0x8
+	NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P                  = 0x4
+	NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2                 = 0x2
+	NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS                  = 0x1
+	NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP               = 0x1
+	NL80211_PS_DISABLED                                     = 0x0
+	NL80211_PS_ENABLED                                      = 0x1
+	NL80211_RADAR_CAC_ABORTED                               = 0x2
+	NL80211_RADAR_CAC_FINISHED                              = 0x1
+	NL80211_RADAR_CAC_STARTED                               = 0x5
+	NL80211_RADAR_DETECTED                                  = 0x0
+	NL80211_RADAR_NOP_FINISHED                              = 0x3
+	NL80211_RADAR_PRE_CAC_EXPIRED                           = 0x4
+	NL80211_RATE_INFO_10_MHZ_WIDTH                          = 0xb
+	NL80211_RATE_INFO_160_MHZ_WIDTH                         = 0xa
+	NL80211_RATE_INFO_320_MHZ_WIDTH                         = 0x12
+	NL80211_RATE_INFO_40_MHZ_WIDTH                          = 0x3
+	NL80211_RATE_INFO_5_MHZ_WIDTH                           = 0xc
+	NL80211_RATE_INFO_80_MHZ_WIDTH                          = 0x8
+	NL80211_RATE_INFO_80P80_MHZ_WIDTH                       = 0x9
+	NL80211_RATE_INFO_BITRATE32                             = 0x5
+	NL80211_RATE_INFO_BITRATE                               = 0x1
+	NL80211_RATE_INFO_EHT_GI_0_8                            = 0x0
+	NL80211_RATE_INFO_EHT_GI_1_6                            = 0x1
+	NL80211_RATE_INFO_EHT_GI_3_2                            = 0x2
+	NL80211_RATE_INFO_EHT_GI                                = 0x15
+	NL80211_RATE_INFO_EHT_MCS                               = 0x13
+	NL80211_RATE_INFO_EHT_NSS                               = 0x14
+	NL80211_RATE_INFO_EHT_RU_ALLOC_106                      = 0x3
+	NL80211_RATE_INFO_EHT_RU_ALLOC_106P26                   = 0x4
+	NL80211_RATE_INFO_EHT_RU_ALLOC_242                      = 0x5
+	NL80211_RATE_INFO_EHT_RU_ALLOC_26                       = 0x0
+	NL80211_RATE_INFO_EHT_RU_ALLOC_2x996                    = 0xb
+	NL80211_RATE_INFO_EHT_RU_ALLOC_2x996P484                = 0xc
+	NL80211_RATE_INFO_EHT_RU_ALLOC_3x996                    = 0xd
+	NL80211_RATE_INFO_EHT_RU_ALLOC_3x996P484                = 0xe
+	NL80211_RATE_INFO_EHT_RU_ALLOC_484                      = 0x6
+	NL80211_RATE_INFO_EHT_RU_ALLOC_484P242                  = 0x7
+	NL80211_RATE_INFO_EHT_RU_ALLOC_4x996                    = 0xf
+	NL80211_RATE_INFO_EHT_RU_ALLOC_52                       = 0x1
+	NL80211_RATE_INFO_EHT_RU_ALLOC_52P26                    = 0x2
+	NL80211_RATE_INFO_EHT_RU_ALLOC_996                      = 0x8
+	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484                  = 0x9
+	NL80211_RATE_INFO_EHT_RU_ALLOC_996P484P242              = 0xa
+	NL80211_RATE_INFO_EHT_RU_ALLOC                          = 0x16
+	NL80211_RATE_INFO_HE_1XLTF                              = 0x0
+	NL80211_RATE_INFO_HE_2XLTF                              = 0x1
+	NL80211_RATE_INFO_HE_4XLTF                              = 0x2
+	NL80211_RATE_INFO_HE_DCM                                = 0x10
+	NL80211_RATE_INFO_HE_GI_0_8                             = 0x0
+	NL80211_RATE_INFO_HE_GI_1_6                             = 0x1
+	NL80211_RATE_INFO_HE_GI_3_2                             = 0x2
+	NL80211_RATE_INFO_HE_GI                                 = 0xf
+	NL80211_RATE_INFO_HE_MCS                                = 0xd
+	NL80211_RATE_INFO_HE_NSS                                = 0xe
+	NL80211_RATE_INFO_HE_RU_ALLOC_106                       = 0x2
+	NL80211_RATE_INFO_HE_RU_ALLOC_242                       = 0x3
+	NL80211_RATE_INFO_HE_RU_ALLOC_26                        = 0x0
+	NL80211_RATE_INFO_HE_RU_ALLOC_2x996                     = 0x6
+	NL80211_RATE_INFO_HE_RU_ALLOC_484                       = 0x4
+	NL80211_RATE_INFO_HE_RU_ALLOC_52                        = 0x1
+	NL80211_RATE_INFO_HE_RU_ALLOC_996                       = 0x5
+	NL80211_RATE_INFO_HE_RU_ALLOC                           = 0x11
+	NL80211_RATE_INFO_MAX                                   = 0x16
+	NL80211_RATE_INFO_MCS                                   = 0x2
+	NL80211_RATE_INFO_SHORT_GI                              = 0x4
+	NL80211_RATE_INFO_VHT_MCS                               = 0x6
+	NL80211_RATE_INFO_VHT_NSS                               = 0x7
+	NL80211_REGDOM_SET_BY_CORE                              = 0x0
+	NL80211_REGDOM_SET_BY_COUNTRY_IE                        = 0x3
+	NL80211_REGDOM_SET_BY_DRIVER                            = 0x2
+	NL80211_REGDOM_SET_BY_USER                              = 0x1
+	NL80211_REGDOM_TYPE_COUNTRY                             = 0x0
+	NL80211_REGDOM_TYPE_CUSTOM_WORLD                        = 0x2
+	NL80211_REGDOM_TYPE_INTERSECTION                        = 0x3
+	NL80211_REGDOM_TYPE_WORLD                               = 0x1
+	NL80211_REG_RULE_ATTR_MAX                               = 0x7
+	NL80211_REKEY_DATA_AKM                                  = 0x4
+	NL80211_REKEY_DATA_KCK                                  = 0x2
+	NL80211_REKEY_DATA_KEK                                  = 0x1
+	NL80211_REKEY_DATA_REPLAY_CTR                           = 0x3
+	NL80211_REPLAY_CTR_LEN                                  = 0x8
+	NL80211_RRF_AUTO_BW                                     = 0x800
+	NL80211_RRF_DFS                                         = 0x10
+	NL80211_RRF_GO_CONCURRENT                               = 0x1000
+	NL80211_RRF_IR_CONCURRENT                               = 0x1000
+	NL80211_RRF_NO_160MHZ                                   = 0x10000
+	NL80211_RRF_NO_320MHZ                                   = 0x40000
+	NL80211_RRF_NO_80MHZ                                    = 0x8000
+	NL80211_RRF_NO_CCK                                      = 0x2
+	NL80211_RRF_NO_HE                                       = 0x20000
+	NL80211_RRF_NO_HT40                                     = 0x6000
+	NL80211_RRF_NO_HT40MINUS                                = 0x2000
+	NL80211_RRF_NO_HT40PLUS                                 = 0x4000
+	NL80211_RRF_NO_IBSS                                     = 0x80
+	NL80211_RRF_NO_INDOOR                                   = 0x4
+	NL80211_RRF_NO_IR_ALL                                   = 0x180
+	NL80211_RRF_NO_IR                                       = 0x80
+	NL80211_RRF_NO_OFDM                                     = 0x1
+	NL80211_RRF_NO_OUTDOOR                                  = 0x8
+	NL80211_RRF_PASSIVE_SCAN                                = 0x80
+	NL80211_RRF_PTMP_ONLY                                   = 0x40
+	NL80211_RRF_PTP_ONLY                                    = 0x20
+	NL80211_RXMGMT_FLAG_ANSWERED                            = 0x1
+	NL80211_RXMGMT_FLAG_EXTERNAL_AUTH                       = 0x2
+	NL80211_SAE_PWE_BOTH                                    = 0x3
+	NL80211_SAE_PWE_HASH_TO_ELEMENT                         = 0x2
+	NL80211_SAE_PWE_HUNT_AND_PECK                           = 0x1
+	NL80211_SAE_PWE_UNSPECIFIED                             = 0x0
+	NL80211_SAR_ATTR_MAX                                    = 0x2
+	NL80211_SAR_ATTR_SPECS                                  = 0x2
+	NL80211_SAR_ATTR_SPECS_END_FREQ                         = 0x4
+	NL80211_SAR_ATTR_SPECS_MAX                              = 0x4
+	NL80211_SAR_ATTR_SPECS_POWER                            = 0x1
+	NL80211_SAR_ATTR_SPECS_RANGE_INDEX                      = 0x2
+	NL80211_SAR_ATTR_SPECS_START_FREQ                       = 0x3
+	NL80211_SAR_ATTR_TYPE                                   = 0x1
+	NL80211_SAR_TYPE_POWER                                  = 0x0
+	NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP               = 0x20
+	NL80211_SCAN_FLAG_AP                                    = 0x4
+	NL80211_SCAN_FLAG_COLOCATED_6GHZ                        = 0x4000
+	NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME                 = 0x10
+	NL80211_SCAN_FLAG_FLUSH                                 = 0x2
+	NL80211_SCAN_FLAG_FREQ_KHZ                              = 0x2000
+	NL80211_SCAN_FLAG_HIGH_ACCURACY                         = 0x400
+	NL80211_SCAN_FLAG_LOW_POWER                             = 0x200
+	NL80211_SCAN_FLAG_LOW_PRIORITY                          = 0x1
+	NL80211_SCAN_FLAG_LOW_SPAN                              = 0x100
+	NL80211_SCAN_FLAG_MIN_PREQ_CONTENT                      = 0x1000
+	NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION    = 0x80
+	NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE            = 0x40
+	NL80211_SCAN_FLAG_RANDOM_ADDR                           = 0x8
+	NL80211_SCAN_FLAG_RANDOM_SN                             = 0x800
+	NL80211_SCAN_RSSI_THOLD_OFF                             = -0x12c
+	NL80211_SCHED_SCAN_MATCH_ATTR_BSSID                     = 0x5
+	NL80211_SCHED_SCAN_MATCH_ATTR_MAX                       = 0x6
+	NL80211_SCHED_SCAN_MATCH_ATTR_RELATIVE_RSSI             = 0x3
+	NL80211_SCHED_SCAN_MATCH_ATTR_RSSI_ADJUST               = 0x4
+	NL80211_SCHED_SCAN_MATCH_ATTR_RSSI                      = 0x2
+	NL80211_SCHED_SCAN_MATCH_ATTR_SSID                      = 0x1
+	NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI                  = 0x6
+	NL80211_SCHED_SCAN_PLAN_INTERVAL                        = 0x1
+	NL80211_SCHED_SCAN_PLAN_ITERATIONS                      = 0x2
+	NL80211_SCHED_SCAN_PLAN_MAX                             = 0x2
+	NL80211_SMPS_DYNAMIC                                    = 0x2
+	NL80211_SMPS_MAX                                        = 0x2
+	NL80211_SMPS_OFF                                        = 0x0
+	NL80211_SMPS_STATIC                                     = 0x1
+	NL80211_STA_BSS_PARAM_BEACON_INTERVAL                   = 0x5
+	NL80211_STA_BSS_PARAM_CTS_PROT                          = 0x1
+	NL80211_STA_BSS_PARAM_DTIM_PERIOD                       = 0x4
+	NL80211_STA_BSS_PARAM_MAX                               = 0x5
+	NL80211_STA_BSS_PARAM_SHORT_PREAMBLE                    = 0x2
+	NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME                   = 0x3
+	NL80211_STA_FLAG_ASSOCIATED                             = 0x7
+	NL80211_STA_FLAG_AUTHENTICATED                          = 0x5
+	NL80211_STA_FLAG_AUTHORIZED                             = 0x1
+	NL80211_STA_FLAG_MAX                                    = 0x7
+	NL80211_STA_FLAG_MAX_OLD_API                            = 0x6
+	NL80211_STA_FLAG_MFP                                    = 0x4
+	NL80211_STA_FLAG_SHORT_PREAMBLE                         = 0x2
+	NL80211_STA_FLAG_TDLS_PEER                              = 0x6
+	NL80211_STA_FLAG_WME                                    = 0x3
+	NL80211_STA_INFO_ACK_SIGNAL_AVG                         = 0x23
+	NL80211_STA_INFO_ACK_SIGNAL                             = 0x22
+	NL80211_STA_INFO_AIRTIME_LINK_METRIC                    = 0x29
+	NL80211_STA_INFO_AIRTIME_WEIGHT                         = 0x28
+	NL80211_STA_INFO_ASSOC_AT_BOOTTIME                      = 0x2a
+	NL80211_STA_INFO_BEACON_LOSS                            = 0x12
+	NL80211_STA_INFO_BEACON_RX                              = 0x1d
+	NL80211_STA_INFO_BEACON_SIGNAL_AVG                      = 0x1e
+	NL80211_STA_INFO_BSS_PARAM                              = 0xf
+	NL80211_STA_INFO_CHAIN_SIGNAL_AVG                       = 0x1a
+	NL80211_STA_INFO_CHAIN_SIGNAL                           = 0x19
+	NL80211_STA_INFO_CONNECTED_TIME                         = 0x10
+	NL80211_STA_INFO_CONNECTED_TO_AS                        = 0x2b
+	NL80211_STA_INFO_CONNECTED_TO_GATE                      = 0x26
+	NL80211_STA_INFO_DATA_ACK_SIGNAL_AVG                    = 0x23
+	NL80211_STA_INFO_EXPECTED_THROUGHPUT                    = 0x1b
+	NL80211_STA_INFO_FCS_ERROR_COUNT                        = 0x25
+	NL80211_STA_INFO_INACTIVE_TIME                          = 0x1
+	NL80211_STA_INFO_LLID                                   = 0x4
+	NL80211_STA_INFO_LOCAL_PM                               = 0x14
+	NL80211_STA_INFO_MAX                                    = 0x2b
+	NL80211_STA_INFO_NONPEER_PM                             = 0x16
+	NL80211_STA_INFO_PAD                                    = 0x21
+	NL80211_STA_INFO_PEER_PM                                = 0x15
+	NL80211_STA_INFO_PLID                                   = 0x5
+	NL80211_STA_INFO_PLINK_STATE                            = 0x6
+	NL80211_STA_INFO_RX_BITRATE                             = 0xe
+	NL80211_STA_INFO_RX_BYTES64                             = 0x17
+	NL80211_STA_INFO_RX_BYTES                               = 0x2
+	NL80211_STA_INFO_RX_DROP_MISC                           = 0x1c
+	NL80211_STA_INFO_RX_DURATION                            = 0x20
+	NL80211_STA_INFO_RX_MPDUS                               = 0x24
+	NL80211_STA_INFO_RX_PACKETS                             = 0x9
+	NL80211_STA_INFO_SIGNAL_AVG                             = 0xd
+	NL80211_STA_INFO_SIGNAL                                 = 0x7
+	NL80211_STA_INFO_STA_FLAGS                              = 0x11
+	NL80211_STA_INFO_TID_STATS                              = 0x1f
+	NL80211_STA_INFO_T_OFFSET                               = 0x13
+	NL80211_STA_INFO_TX_BITRATE                             = 0x8
+	NL80211_STA_INFO_TX_BYTES64                             = 0x18
+	NL80211_STA_INFO_TX_BYTES                               = 0x3
+	NL80211_STA_INFO_TX_DURATION                            = 0x27
+	NL80211_STA_INFO_TX_FAILED                              = 0xc
+	NL80211_STA_INFO_TX_PACKETS                             = 0xa
+	NL80211_STA_INFO_TX_RETRIES                             = 0xb
+	NL80211_STA_WME_MAX                                     = 0x2
+	NL80211_STA_WME_MAX_SP                                  = 0x2
+	NL80211_STA_WME_UAPSD_QUEUES                            = 0x1
+	NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY                   = 0x5
+	NL80211_SURVEY_INFO_CHANNEL_TIME                        = 0x4
+	NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY               = 0x6
+	NL80211_SURVEY_INFO_CHANNEL_TIME_RX                     = 0x7
+	NL80211_SURVEY_INFO_CHANNEL_TIME_TX                     = 0x8
+	NL80211_SURVEY_INFO_FREQUENCY                           = 0x1
+	NL80211_SURVEY_INFO_FREQUENCY_OFFSET                    = 0xc
+	NL80211_SURVEY_INFO_IN_USE                              = 0x3
+	NL80211_SURVEY_INFO_MAX                                 = 0xc
+	NL80211_SURVEY_INFO_NOISE                               = 0x2
+	NL80211_SURVEY_INFO_PAD                                 = 0xa
+	NL80211_SURVEY_INFO_TIME_BSS_RX                         = 0xb
+	NL80211_SURVEY_INFO_TIME_BUSY                           = 0x5
+	NL80211_SURVEY_INFO_TIME                                = 0x4
+	NL80211_SURVEY_INFO_TIME_EXT_BUSY                       = 0x6
+	NL80211_SURVEY_INFO_TIME_RX                             = 0x7
+	NL80211_SURVEY_INFO_TIME_SCAN                           = 0x9
+	NL80211_SURVEY_INFO_TIME_TX                             = 0x8
+	NL80211_TDLS_DISABLE_LINK                               = 0x4
+	NL80211_TDLS_DISCOVERY_REQ                              = 0x0
+	NL80211_TDLS_ENABLE_LINK                                = 0x3
+	NL80211_TDLS_PEER_HE                                    = 0x8
+	NL80211_TDLS_PEER_HT                                    = 0x1
+	NL80211_TDLS_PEER_VHT                                   = 0x2
+	NL80211_TDLS_PEER_WMM                                   = 0x4
+	NL80211_TDLS_SETUP                                      = 0x1
+	NL80211_TDLS_TEARDOWN                                   = 0x2
+	NL80211_TID_CONFIG_ATTR_AMPDU_CTRL                      = 0x9
+	NL80211_TID_CONFIG_ATTR_AMSDU_CTRL                      = 0xb
+	NL80211_TID_CONFIG_ATTR_MAX                             = 0xd
+	NL80211_TID_CONFIG_ATTR_NOACK                           = 0x6
+	NL80211_TID_CONFIG_ATTR_OVERRIDE                        = 0x4
+	NL80211_TID_CONFIG_ATTR_PAD                             = 0x1
+	NL80211_TID_CONFIG_ATTR_PEER_SUPP                       = 0x3
+	NL80211_TID_CONFIG_ATTR_RETRY_LONG                      = 0x8
+	NL80211_TID_CONFIG_ATTR_RETRY_SHORT                     = 0x7
+	NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL                     = 0xa
+	NL80211_TID_CONFIG_ATTR_TIDS                            = 0x5
+	NL80211_TID_CONFIG_ATTR_TX_RATE                         = 0xd
+	NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE                    = 0xc
+	NL80211_TID_CONFIG_ATTR_VIF_SUPP                        = 0x2
+	NL80211_TID_CONFIG_DISABLE                              = 0x1
+	NL80211_TID_CONFIG_ENABLE                               = 0x0
+	NL80211_TID_STATS_MAX                                   = 0x6
+	NL80211_TID_STATS_PAD                                   = 0x5
+	NL80211_TID_STATS_RX_MSDU                               = 0x1
+	NL80211_TID_STATS_TX_MSDU                               = 0x2
+	NL80211_TID_STATS_TX_MSDU_FAILED                        = 0x4
+	NL80211_TID_STATS_TX_MSDU_RETRIES                       = 0x3
+	NL80211_TID_STATS_TXQ_STATS                             = 0x6
+	NL80211_TIMEOUT_ASSOC                                   = 0x3
+	NL80211_TIMEOUT_AUTH                                    = 0x2
+	NL80211_TIMEOUT_SCAN                                    = 0x1
+	NL80211_TIMEOUT_UNSPECIFIED                             = 0x0
+	NL80211_TKIP_DATA_OFFSET_ENCR_KEY                       = 0x0
+	NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY                     = 0x18
+	NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY                     = 0x10
+	NL80211_TX_POWER_AUTOMATIC                              = 0x0
+	NL80211_TX_POWER_FIXED                                  = 0x2
+	NL80211_TX_POWER_LIMITED                                = 0x1
+	NL80211_TXQ_ATTR_AC                                     = 0x1
+	NL80211_TXQ_ATTR_AIFS                                   = 0x5
+	NL80211_TXQ_ATTR_CWMAX                                  = 0x4
+	NL80211_TXQ_ATTR_CWMIN                                  = 0x3
+	NL80211_TXQ_ATTR_MAX                                    = 0x5
+	NL80211_TXQ_ATTR_QUEUE                                  = 0x1
+	NL80211_TXQ_ATTR_TXOP                                   = 0x2
+	NL80211_TXQ_Q_BE                                        = 0x2
+	NL80211_TXQ_Q_BK                                        = 0x3
+	NL80211_TXQ_Q_VI                                        = 0x1
+	NL80211_TXQ_Q_VO                                        = 0x0
+	NL80211_TXQ_STATS_BACKLOG_BYTES                         = 0x1
+	NL80211_TXQ_STATS_BACKLOG_PACKETS                       = 0x2
+	NL80211_TXQ_STATS_COLLISIONS                            = 0x8
+	NL80211_TXQ_STATS_DROPS                                 = 0x4
+	NL80211_TXQ_STATS_ECN_MARKS                             = 0x5
+	NL80211_TXQ_STATS_FLOWS                                 = 0x3
+	NL80211_TXQ_STATS_MAX                                   = 0xb
+	NL80211_TXQ_STATS_MAX_FLOWS                             = 0xb
+	NL80211_TXQ_STATS_OVERLIMIT                             = 0x6
+	NL80211_TXQ_STATS_OVERMEMORY                            = 0x7
+	NL80211_TXQ_STATS_TX_BYTES                              = 0x9
+	NL80211_TXQ_STATS_TX_PACKETS                            = 0xa
+	NL80211_TX_RATE_AUTOMATIC                               = 0x0
+	NL80211_TXRATE_DEFAULT_GI                               = 0x0
+	NL80211_TX_RATE_FIXED                                   = 0x2
+	NL80211_TXRATE_FORCE_LGI                                = 0x2
+	NL80211_TXRATE_FORCE_SGI                                = 0x1
+	NL80211_TXRATE_GI                                       = 0x4
+	NL80211_TXRATE_HE                                       = 0x5
+	NL80211_TXRATE_HE_GI                                    = 0x6
+	NL80211_TXRATE_HE_LTF                                   = 0x7
+	NL80211_TXRATE_HT                                       = 0x2
+	NL80211_TXRATE_LEGACY                                   = 0x1
+	NL80211_TX_RATE_LIMITED                                 = 0x1
+	NL80211_TXRATE_MAX                                      = 0x7
+	NL80211_TXRATE_MCS                                      = 0x2
+	NL80211_TXRATE_VHT                                      = 0x3
+	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT                 = 0x1
+	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX                 = 0x2
+	NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL                = 0x2
+	NL80211_USER_REG_HINT_CELL_BASE                         = 0x1
+	NL80211_USER_REG_HINT_INDOOR                            = 0x2
+	NL80211_USER_REG_HINT_USER                              = 0x0
+	NL80211_VENDOR_ID_IS_LINUX                              = 0x80000000
+	NL80211_VHT_CAPABILITY_LEN                              = 0xc
+	NL80211_VHT_NSS_MAX                                     = 0x8
+	NL80211_WIPHY_NAME_MAXLEN                               = 0x40
+	NL80211_WMMR_AIFSN                                      = 0x3
+	NL80211_WMMR_CW_MAX                                     = 0x2
+	NL80211_WMMR_CW_MIN                                     = 0x1
+	NL80211_WMMR_MAX                                        = 0x4
+	NL80211_WMMR_TXOP                                       = 0x4
+	NL80211_WOWLAN_PKTPAT_MASK                              = 0x1
+	NL80211_WOWLAN_PKTPAT_OFFSET                            = 0x3
+	NL80211_WOWLAN_PKTPAT_PATTERN                           = 0x2
+	NL80211_WOWLAN_TCP_DATA_INTERVAL                        = 0x9
+	NL80211_WOWLAN_TCP_DATA_PAYLOAD                         = 0x6
+	NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ                     = 0x7
+	NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN                   = 0x8
+	NL80211_WOWLAN_TCP_DST_IPV4                             = 0x2
+	NL80211_WOWLAN_TCP_DST_MAC                              = 0x3
+	NL80211_WOWLAN_TCP_DST_PORT                             = 0x5
+	NL80211_WOWLAN_TCP_SRC_IPV4                             = 0x1
+	NL80211_WOWLAN_TCP_SRC_PORT                             = 0x4
+	NL80211_WOWLAN_TCP_WAKE_MASK                            = 0xb
+	NL80211_WOWLAN_TCP_WAKE_PAYLOAD                         = 0xa
+	NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE                      = 0x8
+	NL80211_WOWLAN_TRIG_ANY                                 = 0x1
+	NL80211_WOWLAN_TRIG_DISCONNECT                          = 0x2
+	NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST                   = 0x7
+	NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE                   = 0x6
+	NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED                 = 0x5
+	NL80211_WOWLAN_TRIG_MAGIC_PKT                           = 0x3
+	NL80211_WOWLAN_TRIG_NET_DETECT                          = 0x12
+	NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS                  = 0x13
+	NL80211_WOWLAN_TRIG_PKT_PATTERN                         = 0x4
+	NL80211_WOWLAN_TRIG_RFKILL_RELEASE                      = 0x9
+	NL80211_WOWLAN_TRIG_TCP_CONNECTION                      = 0xe
+	NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211                    = 0xa
+	NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN                = 0xb
+	NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023                     = 0xc
+	NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN                 = 0xd
+	NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST                 = 0x10
+	NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH                    = 0xf
+	NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS             = 0x11
+	NL80211_WPA_VERSION_1                                   = 0x1
+	NL80211_WPA_VERSION_2                                   = 0x2
+	NL80211_WPA_VERSION_3                                   = 0x4
+)
+
+const (
+	FRA_UNSPEC             = 0x0
+	FRA_DST                = 0x1
+	FRA_SRC                = 0x2
+	FRA_IIFNAME            = 0x3
+	FRA_GOTO               = 0x4
+	FRA_UNUSED2            = 0x5
+	FRA_PRIORITY           = 0x6
+	FRA_UNUSED3            = 0x7
+	FRA_UNUSED4            = 0x8
+	FRA_UNUSED5            = 0x9
+	FRA_FWMARK             = 0xa
+	FRA_FLOW               = 0xb
+	FRA_TUN_ID             = 0xc
+	FRA_SUPPRESS_IFGROUP   = 0xd
+	FRA_SUPPRESS_PREFIXLEN = 0xe
+	FRA_TABLE              = 0xf
+	FRA_FWMASK             = 0x10
+	FRA_OIFNAME            = 0x11
+	FRA_PAD                = 0x12
+	FRA_L3MDEV             = 0x13
+	FRA_UID_RANGE          = 0x14
+	FRA_PROTOCOL           = 0x15
+	FRA_IP_PROTO           = 0x16
+	FRA_SPORT_RANGE        = 0x17
+	FRA_DPORT_RANGE        = 0x18
+	FR_ACT_UNSPEC          = 0x0
+	FR_ACT_TO_TBL          = 0x1
+	FR_ACT_GOTO            = 0x2
+	FR_ACT_NOP             = 0x3
+	FR_ACT_RES3            = 0x4
+	FR_ACT_RES4            = 0x5
+	FR_ACT_BLACKHOLE       = 0x6
+	FR_ACT_UNREACHABLE     = 0x7
+	FR_ACT_PROHIBIT        = 0x8
+)
+
+const (
+	AUDIT_NLGRP_NONE    = 0x0
+	AUDIT_NLGRP_READLOG = 0x1
+)
+
+const (
+	TUN_F_CSUM    = 0x1
+	TUN_F_TSO4    = 0x2
+	TUN_F_TSO6    = 0x4
+	TUN_F_TSO_ECN = 0x8
+	TUN_F_UFO     = 0x10
+)
+
+const (
+	VIRTIO_NET_HDR_F_NEEDS_CSUM = 0x1
+	VIRTIO_NET_HDR_F_DATA_VALID = 0x2
+	VIRTIO_NET_HDR_F_RSC_INFO   = 0x4
+)
+
+const (
+	VIRTIO_NET_HDR_GSO_NONE  = 0x0
+	VIRTIO_NET_HDR_GSO_TCPV4 = 0x1
+	VIRTIO_NET_HDR_GSO_UDP   = 0x3
+	VIRTIO_NET_HDR_GSO_TCPV6 = 0x4
+	VIRTIO_NET_HDR_GSO_ECN   = 0x80
+)
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
index eeeb9aa39a..4ecc1495cd 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -m32 /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/386/cgo -- -Wall -Werror -static -I/tmp/386/include -m32 linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build 386 && linux
@@ -240,6 +240,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -250,6 +254,19 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     [116]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -311,6 +328,15 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	_                         [4]byte
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint32
@@ -388,7 +414,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [122]int8
+	Data   [122]byte
 	_      uint32
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
index d30e1155cc..34fddff964 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -m64 /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/amd64/cgo -- -Wall -Werror -static -I/tmp/amd64/include -m64 linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build amd64 && linux
@@ -255,6 +255,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -265,6 +269,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -324,6 +342,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -401,7 +427,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]int8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
index 69d0297520..3b14a6031f 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/arm/cgo -- -Wall -Werror -static -I/tmp/arm/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm && linux
@@ -231,6 +231,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -241,6 +245,19 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     [116]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -302,6 +319,15 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	_                         [4]byte
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint32
@@ -379,7 +405,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [122]uint8
+	Data   [122]byte
 	_      uint32
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
index 28a0455bc9..0517651ab3 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -fsigned-char /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/arm64/cgo -- -Wall -Werror -static -I/tmp/arm64/include -fsigned-char linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build arm64 && linux
@@ -234,6 +234,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -244,6 +248,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -303,6 +321,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -380,7 +406,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]int8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
new file mode 100644
index 0000000000..3b0c518134
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
@@ -0,0 +1,691 @@
+// cgo -godefs -objdir=/tmp/loong64/cgo -- -Wall -Werror -static -I/tmp/loong64/include linux/types.go | go run mkpost.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build loong64 && linux
+// +build loong64,linux
+
+package unix
+
+const (
+	SizeofPtr  = 0x8
+	SizeofLong = 0x8
+)
+
+type (
+	_C_long int64
+)
+
+type Timespec struct {
+	Sec  int64
+	Nsec int64
+}
+
+type Timeval struct {
+	Sec  int64
+	Usec int64
+}
+
+type Timex struct {
+	Modes     uint32
+	Offset    int64
+	Freq      int64
+	Maxerror  int64
+	Esterror  int64
+	Status    int32
+	Constant  int64
+	Precision int64
+	Tolerance int64
+	Time      Timeval
+	Tick      int64
+	Ppsfreq   int64
+	Jitter    int64
+	Shift     int32
+	Stabil    int64
+	Jitcnt    int64
+	Calcnt    int64
+	Errcnt    int64
+	Stbcnt    int64
+	Tai       int32
+	_         [44]byte
+}
+
+type Time_t int64
+
+type Tms struct {
+	Utime  int64
+	Stime  int64
+	Cutime int64
+	Cstime int64
+}
+
+type Utimbuf struct {
+	Actime  int64
+	Modtime int64
+}
+
+type Rusage struct {
+	Utime    Timeval
+	Stime    Timeval
+	Maxrss   int64
+	Ixrss    int64
+	Idrss    int64
+	Isrss    int64
+	Minflt   int64
+	Majflt   int64
+	Nswap    int64
+	Inblock  int64
+	Oublock  int64
+	Msgsnd   int64
+	Msgrcv   int64
+	Nsignals int64
+	Nvcsw    int64
+	Nivcsw   int64
+}
+
+type Stat_t struct {
+	Dev     uint64
+	Ino     uint64
+	Mode    uint32
+	Nlink   uint32
+	Uid     uint32
+	Gid     uint32
+	Rdev    uint64
+	_       uint64
+	Size    int64
+	Blksize int32
+	_       int32
+	Blocks  int64
+	Atim    Timespec
+	Mtim    Timespec
+	Ctim    Timespec
+	_       [2]int32
+}
+
+type Dirent struct {
+	Ino    uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Name   [256]int8
+	_      [5]byte
+}
+
+type Flock_t struct {
+	Type   int16
+	Whence int16
+	Start  int64
+	Len    int64
+	Pid    int32
+	_      [4]byte
+}
+
+type DmNameList struct {
+	Dev  uint64
+	Next uint32
+	Name [0]byte
+	_    [4]byte
+}
+
+const (
+	FADV_DONTNEED = 0x4
+	FADV_NOREUSE  = 0x5
+)
+
+type RawSockaddrNFCLLCP struct {
+	Sa_family        uint16
+	Dev_idx          uint32
+	Target_idx       uint32
+	Nfc_protocol     uint32
+	Dsap             uint8
+	Ssap             uint8
+	Service_name     [63]uint8
+	Service_name_len uint64
+}
+
+type RawSockaddr struct {
+	Family uint16
+	Data   [14]int8
+}
+
+type RawSockaddrAny struct {
+	Addr RawSockaddr
+	Pad  [96]int8
+}
+
+type Iovec struct {
+	Base *byte
+	Len  uint64
+}
+
+type Msghdr struct {
+	Name       *byte
+	Namelen    uint32
+	Iov        *Iovec
+	Iovlen     uint64
+	Control    *byte
+	Controllen uint64
+	Flags      int32
+	_          [4]byte
+}
+
+type Cmsghdr struct {
+	Len   uint64
+	Level int32
+	Type  int32
+}
+
+type ifreq struct {
+	Ifrn [16]byte
+	Ifru [24]byte
+}
+
+const (
+	SizeofSockaddrNFCLLCP = 0x60
+	SizeofIovec           = 0x10
+	SizeofMsghdr          = 0x38
+	SizeofCmsghdr         = 0x10
+)
+
+const (
+	SizeofSockFprog = 0x10
+)
+
+type PtraceRegs struct {
+	Regs     [32]uint64
+	Orig_a0  uint64
+	Era      uint64
+	Badv     uint64
+	Reserved [10]uint64
+}
+
+type FdSet struct {
+	Bits [16]int64
+}
+
+type Sysinfo_t struct {
+	Uptime    int64
+	Loads     [3]uint64
+	Totalram  uint64
+	Freeram   uint64
+	Sharedram uint64
+	Bufferram uint64
+	Totalswap uint64
+	Freeswap  uint64
+	Procs     uint16
+	Pad       uint16
+	Totalhigh uint64
+	Freehigh  uint64
+	Unit      uint32
+	_         [0]int8
+	_         [4]byte
+}
+
+type Ustat_t struct {
+	Tfree  int32
+	Tinode uint64
+	Fname  [6]int8
+	Fpack  [6]int8
+	_      [4]byte
+}
+
+type EpollEvent struct {
+	Events uint32
+	_      int32
+	Fd     int32
+	Pad    int32
+}
+
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
+const (
+	POLLRDHUP = 0x2000
+)
+
+type Sigset_t struct {
+	Val [16]uint64
+}
+
+const _C__NSIG = 0x41
+
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
+type Termios struct {
+	Iflag  uint32
+	Oflag  uint32
+	Cflag  uint32
+	Lflag  uint32
+	Line   uint8
+	Cc     [19]uint8
+	Ispeed uint32
+	Ospeed uint32
+}
+
+type Taskstats struct {
+	Version                   uint16
+	Ac_exitcode               uint32
+	Ac_flag                   uint8
+	Ac_nice                   uint8
+	Cpu_count                 uint64
+	Cpu_delay_total           uint64
+	Blkio_count               uint64
+	Blkio_delay_total         uint64
+	Swapin_count              uint64
+	Swapin_delay_total        uint64
+	Cpu_run_real_total        uint64
+	Cpu_run_virtual_total     uint64
+	Ac_comm                   [32]int8
+	Ac_sched                  uint8
+	Ac_pad                    [3]uint8
+	_                         [4]byte
+	Ac_uid                    uint32
+	Ac_gid                    uint32
+	Ac_pid                    uint32
+	Ac_ppid                   uint32
+	Ac_btime                  uint32
+	Ac_etime                  uint64
+	Ac_utime                  uint64
+	Ac_stime                  uint64
+	Ac_minflt                 uint64
+	Ac_majflt                 uint64
+	Coremem                   uint64
+	Virtmem                   uint64
+	Hiwater_rss               uint64
+	Hiwater_vm                uint64
+	Read_char                 uint64
+	Write_char                uint64
+	Read_syscalls             uint64
+	Write_syscalls            uint64
+	Read_bytes                uint64
+	Write_bytes               uint64
+	Cancelled_write_bytes     uint64
+	Nvcsw                     uint64
+	Nivcsw                    uint64
+	Ac_utimescaled            uint64
+	Ac_stimescaled            uint64
+	Cpu_scaled_run_real_total uint64
+	Freepages_count           uint64
+	Freepages_delay_total     uint64
+	Thrashing_count           uint64
+	Thrashing_delay_total     uint64
+	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
+}
+
+type cpuMask uint64
+
+const (
+	_NCPUBITS = 0x40
+)
+
+const (
+	CBitFieldMaskBit0  = 0x1
+	CBitFieldMaskBit1  = 0x2
+	CBitFieldMaskBit2  = 0x4
+	CBitFieldMaskBit3  = 0x8
+	CBitFieldMaskBit4  = 0x10
+	CBitFieldMaskBit5  = 0x20
+	CBitFieldMaskBit6  = 0x40
+	CBitFieldMaskBit7  = 0x80
+	CBitFieldMaskBit8  = 0x100
+	CBitFieldMaskBit9  = 0x200
+	CBitFieldMaskBit10 = 0x400
+	CBitFieldMaskBit11 = 0x800
+	CBitFieldMaskBit12 = 0x1000
+	CBitFieldMaskBit13 = 0x2000
+	CBitFieldMaskBit14 = 0x4000
+	CBitFieldMaskBit15 = 0x8000
+	CBitFieldMaskBit16 = 0x10000
+	CBitFieldMaskBit17 = 0x20000
+	CBitFieldMaskBit18 = 0x40000
+	CBitFieldMaskBit19 = 0x80000
+	CBitFieldMaskBit20 = 0x100000
+	CBitFieldMaskBit21 = 0x200000
+	CBitFieldMaskBit22 = 0x400000
+	CBitFieldMaskBit23 = 0x800000
+	CBitFieldMaskBit24 = 0x1000000
+	CBitFieldMaskBit25 = 0x2000000
+	CBitFieldMaskBit26 = 0x4000000
+	CBitFieldMaskBit27 = 0x8000000
+	CBitFieldMaskBit28 = 0x10000000
+	CBitFieldMaskBit29 = 0x20000000
+	CBitFieldMaskBit30 = 0x40000000
+	CBitFieldMaskBit31 = 0x80000000
+	CBitFieldMaskBit32 = 0x100000000
+	CBitFieldMaskBit33 = 0x200000000
+	CBitFieldMaskBit34 = 0x400000000
+	CBitFieldMaskBit35 = 0x800000000
+	CBitFieldMaskBit36 = 0x1000000000
+	CBitFieldMaskBit37 = 0x2000000000
+	CBitFieldMaskBit38 = 0x4000000000
+	CBitFieldMaskBit39 = 0x8000000000
+	CBitFieldMaskBit40 = 0x10000000000
+	CBitFieldMaskBit41 = 0x20000000000
+	CBitFieldMaskBit42 = 0x40000000000
+	CBitFieldMaskBit43 = 0x80000000000
+	CBitFieldMaskBit44 = 0x100000000000
+	CBitFieldMaskBit45 = 0x200000000000
+	CBitFieldMaskBit46 = 0x400000000000
+	CBitFieldMaskBit47 = 0x800000000000
+	CBitFieldMaskBit48 = 0x1000000000000
+	CBitFieldMaskBit49 = 0x2000000000000
+	CBitFieldMaskBit50 = 0x4000000000000
+	CBitFieldMaskBit51 = 0x8000000000000
+	CBitFieldMaskBit52 = 0x10000000000000
+	CBitFieldMaskBit53 = 0x20000000000000
+	CBitFieldMaskBit54 = 0x40000000000000
+	CBitFieldMaskBit55 = 0x80000000000000
+	CBitFieldMaskBit56 = 0x100000000000000
+	CBitFieldMaskBit57 = 0x200000000000000
+	CBitFieldMaskBit58 = 0x400000000000000
+	CBitFieldMaskBit59 = 0x800000000000000
+	CBitFieldMaskBit60 = 0x1000000000000000
+	CBitFieldMaskBit61 = 0x2000000000000000
+	CBitFieldMaskBit62 = 0x4000000000000000
+	CBitFieldMaskBit63 = 0x8000000000000000
+)
+
+type SockaddrStorage struct {
+	Family uint16
+	Data   [118]byte
+	_      uint64
+}
+
+type HDGeometry struct {
+	Heads     uint8
+	Sectors   uint8
+	Cylinders uint16
+	Start     uint64
+}
+
+type Statfs_t struct {
+	Type    int64
+	Bsize   int64
+	Blocks  uint64
+	Bfree   uint64
+	Bavail  uint64
+	Files   uint64
+	Ffree   uint64
+	Fsid    Fsid
+	Namelen int64
+	Frsize  int64
+	Flags   int64
+	Spare   [4]int64
+}
+
+type TpacketHdr struct {
+	Status  uint64
+	Len     uint32
+	Snaplen uint32
+	Mac     uint16
+	Net     uint16
+	Sec     uint32
+	Usec    uint32
+	_       [4]byte
+}
+
+const (
+	SizeofTpacketHdr = 0x20
+)
+
+type RTCPLLInfo struct {
+	Ctrl    int32
+	Value   int32
+	Max     int32
+	Min     int32
+	Posmult int32
+	Negmult int32
+	Clock   int64
+}
+
+type BlkpgPartition struct {
+	Start   int64
+	Length  int64
+	Pno     int32
+	Devname [64]uint8
+	Volname [64]uint8
+	_       [4]byte
+}
+
+const (
+	BLKPG = 0x1269
+)
+
+type XDPUmemReg struct {
+	Addr     uint64
+	Len      uint64
+	Size     uint32
+	Headroom uint32
+	Flags    uint32
+	_        [4]byte
+}
+
+type CryptoUserAlg struct {
+	Name        [64]int8
+	Driver_name [64]int8
+	Module_name [64]int8
+	Type        uint32
+	Mask        uint32
+	Refcnt      uint32
+	Flags       uint32
+}
+
+type CryptoStatAEAD struct {
+	Type         [64]int8
+	Encrypt_cnt  uint64
+	Encrypt_tlen uint64
+	Decrypt_cnt  uint64
+	Decrypt_tlen uint64
+	Err_cnt      uint64
+}
+
+type CryptoStatAKCipher struct {
+	Type         [64]int8
+	Encrypt_cnt  uint64
+	Encrypt_tlen uint64
+	Decrypt_cnt  uint64
+	Decrypt_tlen uint64
+	Verify_cnt   uint64
+	Sign_cnt     uint64
+	Err_cnt      uint64
+}
+
+type CryptoStatCipher struct {
+	Type         [64]int8
+	Encrypt_cnt  uint64
+	Encrypt_tlen uint64
+	Decrypt_cnt  uint64
+	Decrypt_tlen uint64
+	Err_cnt      uint64
+}
+
+type CryptoStatCompress struct {
+	Type            [64]int8
+	Compress_cnt    uint64
+	Compress_tlen   uint64
+	Decompress_cnt  uint64
+	Decompress_tlen uint64
+	Err_cnt         uint64
+}
+
+type CryptoStatHash struct {
+	Type      [64]int8
+	Hash_cnt  uint64
+	Hash_tlen uint64
+	Err_cnt   uint64
+}
+
+type CryptoStatKPP struct {
+	Type                      [64]int8
+	Setsecret_cnt             uint64
+	Generate_public_key_cnt   uint64
+	Compute_shared_secret_cnt uint64
+	Err_cnt                   uint64
+}
+
+type CryptoStatRNG struct {
+	Type          [64]int8
+	Generate_cnt  uint64
+	Generate_tlen uint64
+	Seed_cnt      uint64
+	Err_cnt       uint64
+}
+
+type CryptoStatLarval struct {
+	Type [64]int8
+}
+
+type CryptoReportLarval struct {
+	Type [64]int8
+}
+
+type CryptoReportHash struct {
+	Type       [64]int8
+	Blocksize  uint32
+	Digestsize uint32
+}
+
+type CryptoReportCipher struct {
+	Type        [64]int8
+	Blocksize   uint32
+	Min_keysize uint32
+	Max_keysize uint32
+}
+
+type CryptoReportBlkCipher struct {
+	Type        [64]int8
+	Geniv       [64]int8
+	Blocksize   uint32
+	Min_keysize uint32
+	Max_keysize uint32
+	Ivsize      uint32
+}
+
+type CryptoReportAEAD struct {
+	Type        [64]int8
+	Geniv       [64]int8
+	Blocksize   uint32
+	Maxauthsize uint32
+	Ivsize      uint32
+}
+
+type CryptoReportComp struct {
+	Type [64]int8
+}
+
+type CryptoReportRNG struct {
+	Type     [64]int8
+	Seedsize uint32
+}
+
+type CryptoReportAKCipher struct {
+	Type [64]int8
+}
+
+type CryptoReportKPP struct {
+	Type [64]int8
+}
+
+type CryptoReportAcomp struct {
+	Type [64]int8
+}
+
+type LoopInfo struct {
+	Number           int32
+	Device           uint32
+	Inode            uint64
+	Rdevice          uint32
+	Offset           int32
+	Encrypt_type     int32
+	Encrypt_key_size int32
+	Flags            int32
+	Name             [64]int8
+	Encrypt_key      [32]uint8
+	Init             [2]uint64
+	Reserved         [4]int8
+	_                [4]byte
+}
+
+type TIPCSubscr struct {
+	Seq     TIPCServiceRange
+	Timeout uint32
+	Filter  uint32
+	Handle  [8]int8
+}
+
+type TIPCSIOCLNReq struct {
+	Peer     uint32
+	Id       uint32
+	Linkname [68]int8
+}
+
+type TIPCSIOCNodeIDReq struct {
+	Peer uint32
+	Id   [16]int8
+}
+
+type PPSKInfo struct {
+	Assert_sequence uint32
+	Clear_sequence  uint32
+	Assert_tu       PPSKTime
+	Clear_tu        PPSKTime
+	Current_mode    int32
+	_               [4]byte
+}
+
+const (
+	PPS_GETPARAMS = 0x800870a1
+	PPS_SETPARAMS = 0x400870a2
+	PPS_GETCAP    = 0x800870a3
+	PPS_FETCH     = 0xc00870a4
+)
+
+const (
+	PIDFD_NONBLOCK = 0x800
+)
+
+type SysvIpcPerm struct {
+	Key  int32
+	Uid  uint32
+	Gid  uint32
+	Cuid uint32
+	Cgid uint32
+	Mode uint32
+	_    [0]uint8
+	Seq  uint16
+	_    uint16
+	_    uint64
+	_    uint64
+}
+type SysvShmDesc struct {
+	Perm   SysvIpcPerm
+	Segsz  uint64
+	Atime  int64
+	Dtime  int64
+	Ctime  int64
+	Cpid   int32
+	Lpid   int32
+	Nattch uint64
+	_      uint64
+	_      uint64
+}
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
index 64a845483d..fccdf4dd0f 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/mips/cgo -- -Wall -Werror -static -I/tmp/mips/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips && linux
@@ -236,6 +236,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -246,6 +250,19 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x80
 
+const (
+	SIG_BLOCK   = 0x1
+	SIG_UNBLOCK = 0x2
+	SIG_SETMASK = 0x3
+)
+
+type Siginfo struct {
+	Signo int32
+	Code  int32
+	Errno int32
+	_     [116]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -307,6 +324,15 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	_                         [4]byte
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint32
@@ -384,7 +410,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [122]int8
+	Data   [122]byte
 	_      uint32
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
index a1b7dee412..500de8fc07 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/mips64/cgo -- -Wall -Werror -static -I/tmp/mips64/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips64 && linux
@@ -237,6 +237,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -247,6 +251,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x80
 
+const (
+	SIG_BLOCK   = 0x1
+	SIG_UNBLOCK = 0x2
+	SIG_SETMASK = 0x3
+)
+
+type Siginfo struct {
+	Signo int32
+	Code  int32
+	Errno int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -306,6 +324,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -383,7 +409,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]int8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
index 936fa6a266..d0434cd2c6 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/mips64le/cgo -- -Wall -Werror -static -I/tmp/mips64le/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mips64le && linux
@@ -237,6 +237,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -247,6 +251,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x80
 
+const (
+	SIG_BLOCK   = 0x1
+	SIG_UNBLOCK = 0x2
+	SIG_SETMASK = 0x3
+)
+
+type Siginfo struct {
+	Signo int32
+	Code  int32
+	Errno int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -306,6 +324,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -383,7 +409,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]int8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
index 5dd546fbf0..84206ba534 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/mipsle/cgo -- -Wall -Werror -static -I/tmp/mipsle/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build mipsle && linux
@@ -236,6 +236,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -246,6 +250,19 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x80
 
+const (
+	SIG_BLOCK   = 0x1
+	SIG_UNBLOCK = 0x2
+	SIG_SETMASK = 0x3
+)
+
+type Siginfo struct {
+	Signo int32
+	Code  int32
+	Errno int32
+	_     [116]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -307,6 +324,15 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	_                         [4]byte
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint32
@@ -384,7 +410,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [122]int8
+	Data   [122]byte
 	_      uint32
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
index 947b32e434..ab078cf1f5 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/ppc/cgo -- -Wall -Werror -static -I/tmp/ppc/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc && linux
@@ -243,6 +243,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -253,6 +257,19 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     [116]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -314,6 +331,15 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	_                         [4]byte
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint32
@@ -391,7 +417,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [122]uint8
+	Data   [122]byte
 	_      uint32
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
index 2a606151b0..42eb2c4cef 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/ppc64/cgo -- -Wall -Werror -static -I/tmp/ppc64/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc64 && linux
@@ -244,6 +244,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -254,6 +258,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -313,6 +331,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -390,7 +416,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]uint8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
index d0d735d02c..31304a4e8b 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/ppc64le/cgo -- -Wall -Werror -static -I/tmp/ppc64le/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build ppc64le && linux
@@ -244,6 +244,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -254,6 +258,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -313,6 +331,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -390,7 +416,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]uint8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
index 95e3d6d06f..c311f9612d 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/riscv64/cgo -- -Wall -Werror -static -I/tmp/riscv64/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build riscv64 && linux
@@ -262,6 +262,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -272,6 +276,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -331,6 +349,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -408,7 +434,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]uint8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
index cccf1ef26a..bba3cefac1 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include -fsigned-char /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/s390x/cgo -- -Wall -Werror -static -I/tmp/s390x/include -fsigned-char linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build s390x && linux
@@ -210,8 +210,8 @@ type PtraceFpregs struct {
 }
 
 type PtracePer struct {
-	_             [0]uint64
-	_             [32]byte
+	Control_regs  [3]uint64
+	_             [8]byte
 	Starting_addr uint64
 	Ending_addr   uint64
 	Perc_atmid    uint16
@@ -257,6 +257,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x80000
+)
+
 const (
 	POLLRDHUP = 0x2000
 )
@@ -267,6 +271,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x0
+	SIG_UNBLOCK = 0x1
+	SIG_SETMASK = 0x2
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -326,6 +344,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -403,7 +429,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]int8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
index 44fcbe4e9a..ad8a013804 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
@@ -1,4 +1,4 @@
-// cgo -godefs -- -Wall -Werror -static -I/tmp/include /build/linux/types.go | go run mkpost.go
+// cgo -godefs -objdir=/tmp/sparc64/cgo -- -Wall -Werror -static -I/tmp/sparc64/include linux/types.go | go run mkpost.go
 // Code generated by the command above; see README.md. DO NOT EDIT.
 
 //go:build sparc64 && linux
@@ -239,6 +239,10 @@ type EpollEvent struct {
 	Pad    int32
 }
 
+const (
+	OPEN_TREE_CLOEXEC = 0x400000
+)
+
 const (
 	POLLRDHUP = 0x800
 )
@@ -249,6 +253,20 @@ type Sigset_t struct {
 
 const _C__NSIG = 0x41
 
+const (
+	SIG_BLOCK   = 0x1
+	SIG_UNBLOCK = 0x2
+	SIG_SETMASK = 0x4
+)
+
+type Siginfo struct {
+	Signo int32
+	Errno int32
+	Code  int32
+	_     int32
+	_     [112]byte
+}
+
 type Termios struct {
 	Iflag  uint32
 	Oflag  uint32
@@ -308,6 +326,14 @@ type Taskstats struct {
 	Thrashing_count           uint64
 	Thrashing_delay_total     uint64
 	Ac_btime64                uint64
+	Compact_count             uint64
+	Compact_delay_total       uint64
+	Ac_tgid                   uint32
+	Ac_tgetime                uint64
+	Ac_exe_dev                uint64
+	Ac_exe_inode              uint64
+	Wpcopy_count              uint64
+	Wpcopy_delay_total        uint64
 }
 
 type cpuMask uint64
@@ -385,7 +411,7 @@ const (
 
 type SockaddrStorage struct {
 	Family uint16
-	_      [118]int8
+	Data   [118]byte
 	_      uint64
 }
 
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go
index 2fd2060e61..9bc4c8f9d8 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_386.go
@@ -491,6 +491,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go
index 6a5a1a8ae5..bb05f655d2 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_amd64.go
@@ -499,6 +499,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
index 84cc8d01e6..db40e3a19c 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm.go
@@ -496,6 +496,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go
index c844e7096f..11121151cc 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_netbsd_arm64.go
@@ -499,6 +499,90 @@ type Utsname struct {
 	Machine  [256]byte
 }
 
+const SizeofUvmexp = 0x278
+
+type Uvmexp struct {
+	Pagesize           int64
+	Pagemask           int64
+	Pageshift          int64
+	Npages             int64
+	Free               int64
+	Active             int64
+	Inactive           int64
+	Paging             int64
+	Wired              int64
+	Zeropages          int64
+	Reserve_pagedaemon int64
+	Reserve_kernel     int64
+	Freemin            int64
+	Freetarg           int64
+	Inactarg           int64
+	Wiredmax           int64
+	Nswapdev           int64
+	Swpages            int64
+	Swpginuse          int64
+	Swpgonly           int64
+	Nswget             int64
+	Unused1            int64
+	Cpuhit             int64
+	Cpumiss            int64
+	Faults             int64
+	Traps              int64
+	Intrs              int64
+	Swtch              int64
+	Softs              int64
+	Syscalls           int64
+	Pageins            int64
+	Swapins            int64
+	Swapouts           int64
+	Pgswapin           int64
+	Pgswapout          int64
+	Forks              int64
+	Forks_ppwait       int64
+	Forks_sharevm      int64
+	Pga_zerohit        int64
+	Pga_zeromiss       int64
+	Zeroaborts         int64
+	Fltnoram           int64
+	Fltnoanon          int64
+	Fltpgwait          int64
+	Fltpgrele          int64
+	Fltrelck           int64
+	Fltrelckok         int64
+	Fltanget           int64
+	Fltanretry         int64
+	Fltamcopy          int64
+	Fltnamap           int64
+	Fltnomap           int64
+	Fltlget            int64
+	Fltget             int64
+	Flt_anon           int64
+	Flt_acow           int64
+	Flt_obj            int64
+	Flt_prcopy         int64
+	Flt_przero         int64
+	Pdwoke             int64
+	Pdrevs             int64
+	Unused4            int64
+	Pdfreed            int64
+	Pdscans            int64
+	Pdanscan           int64
+	Pdobscan           int64
+	Pdreact            int64
+	Pdbusy             int64
+	Pdpageouts         int64
+	Pdpending          int64
+	Pddeact            int64
+	Anonpages          int64
+	Filepages          int64
+	Execpages          int64
+	Colorhit           int64
+	Colormiss          int64
+	Ncolors            int64
+	Bootpages          int64
+	Poolpages          int64
+}
+
 const SizeofClockinfo = 0x14
 
 type Clockinfo struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go
index baf5fe6504..26eba23b72 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_386.go
@@ -58,22 +58,22 @@ type Rlimit struct {
 type _Gid_t uint32
 
 type Stat_t struct {
-	Mode           uint32
-	Dev            int32
-	Ino            uint64
-	Nlink          uint32
-	Uid            uint32
-	Gid            uint32
-	Rdev           int32
-	Atim           Timespec
-	Mtim           Timespec
-	Ctim           Timespec
-	Size           int64
-	Blocks         int64
-	Blksize        uint32
-	Flags          uint32
-	Gen            uint32
-	X__st_birthtim Timespec
+	Mode    uint32
+	Dev     int32
+	Ino     uint64
+	Nlink   uint32
+	Uid     uint32
+	Gid     uint32
+	Rdev    int32
+	Atim    Timespec
+	Mtim    Timespec
+	Ctim    Timespec
+	Size    int64
+	Blocks  int64
+	Blksize int32
+	Flags   uint32
+	Gen     uint32
+	_       Timespec
 }
 
 type Statfs_t struct {
@@ -94,11 +94,11 @@ type Statfs_t struct {
 	F_namemax     uint32
 	F_owner       uint32
 	F_ctime       uint64
-	F_fstypename  [16]int8
-	F_mntonname   [90]int8
-	F_mntfromname [90]int8
-	F_mntfromspec [90]int8
-	Pad_cgo_0     [2]byte
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
+	_             [2]byte
 	Mount_info    [160]byte
 }
 
@@ -111,13 +111,13 @@ type Flock_t struct {
 }
 
 type Dirent struct {
-	Fileno       uint64
-	Off          int64
-	Reclen       uint16
-	Type         uint8
-	Namlen       uint8
-	X__d_padding [4]uint8
-	Name         [256]int8
+	Fileno uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Namlen uint8
+	_      [4]uint8
+	Name   [256]int8
 }
 
 type Fsid struct {
@@ -262,8 +262,8 @@ type FdSet struct {
 }
 
 const (
-	SizeofIfMsghdr         = 0xec
-	SizeofIfData           = 0xd4
+	SizeofIfMsghdr         = 0xa0
+	SizeofIfData           = 0x88
 	SizeofIfaMsghdr        = 0x18
 	SizeofIfAnnounceMsghdr = 0x1a
 	SizeofRtMsghdr         = 0x60
@@ -292,7 +292,7 @@ type IfData struct {
 	Link_state   uint8
 	Mtu          uint32
 	Metric       uint32
-	Pad          uint32
+	Rdomain      uint32
 	Baudrate     uint64
 	Ipackets     uint64
 	Ierrors      uint64
@@ -304,10 +304,10 @@ type IfData struct {
 	Imcasts      uint64
 	Omcasts      uint64
 	Iqdrops      uint64
+	Oqdrops      uint64
 	Noproto      uint64
 	Capabilities uint32
 	Lastchange   Timeval
-	Mclpool      [7]Mclpool
 }
 
 type IfaMsghdr struct {
@@ -368,20 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct {
-	Grown int32
-	Alive uint16
-	Hwm   uint16
-	Cwm   uint16
-	Lwm   uint16
-}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x8
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -407,11 +399,14 @@ type BpfInsn struct {
 }
 
 type BpfHdr struct {
-	Tstamp    BpfTimeval
-	Caplen    uint32
-	Datalen   uint32
-	Hdrlen    uint16
-	Pad_cgo_0 [2]byte
+	Tstamp  BpfTimeval
+	Caplen  uint32
+	Datalen uint32
+	Hdrlen  uint16
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
@@ -488,7 +483,7 @@ type Uvmexp struct {
 	Zeropages          int32
 	Reserve_pagedaemon int32
 	Reserve_kernel     int32
-	Anonpages          int32
+	Unused01           int32
 	Vnodepages         int32
 	Vtextpages         int32
 	Freemin            int32
@@ -507,8 +502,8 @@ type Uvmexp struct {
 	Swpgonly           int32
 	Nswget             int32
 	Nanon              int32
-	Nanonneeded        int32
-	Nfreeanon          int32
+	Unused05           int32
+	Unused06           int32
 	Faults             int32
 	Traps              int32
 	Intrs              int32
@@ -516,8 +511,8 @@ type Uvmexp struct {
 	Softs              int32
 	Syscalls           int32
 	Pageins            int32
-	Obsolete_swapins   int32
-	Obsolete_swapouts  int32
+	Unused07           int32
+	Unused08           int32
 	Pgswapin           int32
 	Pgswapout          int32
 	Forks              int32
@@ -525,7 +520,7 @@ type Uvmexp struct {
 	Forks_sharevm      int32
 	Pga_zerohit        int32
 	Pga_zeromiss       int32
-	Zeroaborts         int32
+	Unused09           int32
 	Fltnoram           int32
 	Fltnoanon          int32
 	Fltnoamap          int32
@@ -557,9 +552,9 @@ type Uvmexp struct {
 	Pdpageouts         int32
 	Pdpending          int32
 	Pddeact            int32
-	Pdreanon           int32
-	Pdrevnode          int32
-	Pdrevtext          int32
+	Unused11           int32
+	Unused12           int32
+	Unused13           int32
 	Fpswtch            int32
 	Kmapent            int32
 }
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go
index e21ae8ecfa..5a54798869 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_amd64.go
@@ -73,7 +73,6 @@ type Stat_t struct {
 	Blksize int32
 	Flags   uint32
 	Gen     uint32
-	_       [4]byte
 	_       Timespec
 }
 
@@ -81,7 +80,6 @@ type Statfs_t struct {
 	F_flags       uint32
 	F_bsize       uint32
 	F_iosize      uint32
-	_             [4]byte
 	F_blocks      uint64
 	F_bfree       uint64
 	F_bavail      int64
@@ -96,10 +94,10 @@ type Statfs_t struct {
 	F_namemax     uint32
 	F_owner       uint32
 	F_ctime       uint64
-	F_fstypename  [16]int8
-	F_mntonname   [90]int8
-	F_mntfromname [90]int8
-	F_mntfromspec [90]int8
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
 	_             [2]byte
 	Mount_info    [160]byte
 }
@@ -200,10 +198,8 @@ type IPv6Mreq struct {
 type Msghdr struct {
 	Name       *byte
 	Namelen    uint32
-	_          [4]byte
 	Iov        *Iovec
 	Iovlen     uint32
-	_          [4]byte
 	Control    *byte
 	Controllen uint32
 	Flags      int32
@@ -311,7 +307,6 @@ type IfData struct {
 	Oqdrops      uint64
 	Noproto      uint64
 	Capabilities uint32
-	_            [4]byte
 	Lastchange   Timeval
 }
 
@@ -373,14 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x10
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -395,7 +388,6 @@ type BpfStat struct {
 
 type BpfProgram struct {
 	Len   uint32
-	_     [4]byte
 	Insns *BpfInsn
 }
 
@@ -411,7 +403,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
@@ -488,7 +483,7 @@ type Uvmexp struct {
 	Zeropages          int32
 	Reserve_pagedaemon int32
 	Reserve_kernel     int32
-	Anonpages          int32
+	Unused01           int32
 	Vnodepages         int32
 	Vtextpages         int32
 	Freemin            int32
@@ -507,8 +502,8 @@ type Uvmexp struct {
 	Swpgonly           int32
 	Nswget             int32
 	Nanon              int32
-	Nanonneeded        int32
-	Nfreeanon          int32
+	Unused05           int32
+	Unused06           int32
 	Faults             int32
 	Traps              int32
 	Intrs              int32
@@ -516,8 +511,8 @@ type Uvmexp struct {
 	Softs              int32
 	Syscalls           int32
 	Pageins            int32
-	Obsolete_swapins   int32
-	Obsolete_swapouts  int32
+	Unused07           int32
+	Unused08           int32
 	Pgswapin           int32
 	Pgswapout          int32
 	Forks              int32
@@ -525,7 +520,7 @@ type Uvmexp struct {
 	Forks_sharevm      int32
 	Pga_zerohit        int32
 	Pga_zeromiss       int32
-	Zeroaborts         int32
+	Unused09           int32
 	Fltnoram           int32
 	Fltnoanon          int32
 	Fltnoamap          int32
@@ -557,9 +552,9 @@ type Uvmexp struct {
 	Pdpageouts         int32
 	Pdpending          int32
 	Pddeact            int32
-	Pdreanon           int32
-	Pdrevnode          int32
-	Pdrevtext          int32
+	Unused11           int32
+	Unused12           int32
+	Unused13           int32
 	Fpswtch            int32
 	Kmapent            int32
 }
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go
index f190651cd9..be58c4e1ff 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm.go
@@ -98,10 +98,10 @@ type Statfs_t struct {
 	F_namemax     uint32
 	F_owner       uint32
 	F_ctime       uint64
-	F_fstypename  [16]int8
-	F_mntonname   [90]int8
-	F_mntfromname [90]int8
-	F_mntfromspec [90]int8
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
 	_             [2]byte
 	Mount_info    [160]byte
 }
@@ -375,14 +375,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x8
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -412,7 +410,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go
index 84747c582c..52338266cb 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_arm64.go
@@ -94,10 +94,10 @@ type Statfs_t struct {
 	F_namemax     uint32
 	F_owner       uint32
 	F_ctime       uint64
-	F_fstypename  [16]int8
-	F_mntonname   [90]int8
-	F_mntfromname [90]int8
-	F_mntfromspec [90]int8
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
 	_             [2]byte
 	Mount_info    [160]byte
 }
@@ -368,14 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x10
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -405,7 +403,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go
index ac5c8b6370..605cfdb12b 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_mips64.go
@@ -94,10 +94,10 @@ type Statfs_t struct {
 	F_namemax     uint32
 	F_owner       uint32
 	F_ctime       uint64
-	F_fstypename  [16]int8
-	F_mntonname   [90]int8
-	F_mntfromname [90]int8
-	F_mntfromspec [90]int8
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
 	_             [2]byte
 	Mount_info    [160]byte
 }
@@ -368,14 +368,12 @@ type RtMetrics struct {
 	Pad      uint32
 }
 
-type Mclpool struct{}
-
 const (
 	SizeofBpfVersion = 0x4
 	SizeofBpfStat    = 0x8
 	SizeofBpfProgram = 0x10
 	SizeofBpfInsn    = 0x8
-	SizeofBpfHdr     = 0x14
+	SizeofBpfHdr     = 0x18
 )
 
 type BpfVersion struct {
@@ -405,7 +403,10 @@ type BpfHdr struct {
 	Caplen  uint32
 	Datalen uint32
 	Hdrlen  uint16
-	_       [2]byte
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
 }
 
 type BpfTimeval struct {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_ppc64.go
new file mode 100644
index 0000000000..d6724c0102
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_ppc64.go
@@ -0,0 +1,571 @@
+// cgo -godefs -- -fsigned-char types_openbsd.go | go run mkpost.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build ppc64 && openbsd
+// +build ppc64,openbsd
+
+package unix
+
+const (
+	SizeofPtr      = 0x8
+	SizeofShort    = 0x2
+	SizeofInt      = 0x4
+	SizeofLong     = 0x8
+	SizeofLongLong = 0x8
+)
+
+type (
+	_C_short     int16
+	_C_int       int32
+	_C_long      int64
+	_C_long_long int64
+)
+
+type Timespec struct {
+	Sec  int64
+	Nsec int64
+}
+
+type Timeval struct {
+	Sec  int64
+	Usec int64
+}
+
+type Rusage struct {
+	Utime    Timeval
+	Stime    Timeval
+	Maxrss   int64
+	Ixrss    int64
+	Idrss    int64
+	Isrss    int64
+	Minflt   int64
+	Majflt   int64
+	Nswap    int64
+	Inblock  int64
+	Oublock  int64
+	Msgsnd   int64
+	Msgrcv   int64
+	Nsignals int64
+	Nvcsw    int64
+	Nivcsw   int64
+}
+
+type Rlimit struct {
+	Cur uint64
+	Max uint64
+}
+
+type _Gid_t uint32
+
+type Stat_t struct {
+	Mode    uint32
+	Dev     int32
+	Ino     uint64
+	Nlink   uint32
+	Uid     uint32
+	Gid     uint32
+	Rdev    int32
+	Atim    Timespec
+	Mtim    Timespec
+	Ctim    Timespec
+	Size    int64
+	Blocks  int64
+	Blksize int32
+	Flags   uint32
+	Gen     uint32
+	_       Timespec
+}
+
+type Statfs_t struct {
+	F_flags       uint32
+	F_bsize       uint32
+	F_iosize      uint32
+	F_blocks      uint64
+	F_bfree       uint64
+	F_bavail      int64
+	F_files       uint64
+	F_ffree       uint64
+	F_favail      int64
+	F_syncwrites  uint64
+	F_syncreads   uint64
+	F_asyncwrites uint64
+	F_asyncreads  uint64
+	F_fsid        Fsid
+	F_namemax     uint32
+	F_owner       uint32
+	F_ctime       uint64
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
+	_             [2]byte
+	Mount_info    [160]byte
+}
+
+type Flock_t struct {
+	Start  int64
+	Len    int64
+	Pid    int32
+	Type   int16
+	Whence int16
+}
+
+type Dirent struct {
+	Fileno uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Namlen uint8
+	_      [4]uint8
+	Name   [256]int8
+}
+
+type Fsid struct {
+	Val [2]int32
+}
+
+const (
+	PathMax = 0x400
+)
+
+type RawSockaddrInet4 struct {
+	Len    uint8
+	Family uint8
+	Port   uint16
+	Addr   [4]byte /* in_addr */
+	Zero   [8]int8
+}
+
+type RawSockaddrInet6 struct {
+	Len      uint8
+	Family   uint8
+	Port     uint16
+	Flowinfo uint32
+	Addr     [16]byte /* in6_addr */
+	Scope_id uint32
+}
+
+type RawSockaddrUnix struct {
+	Len    uint8
+	Family uint8
+	Path   [104]int8
+}
+
+type RawSockaddrDatalink struct {
+	Len    uint8
+	Family uint8
+	Index  uint16
+	Type   uint8
+	Nlen   uint8
+	Alen   uint8
+	Slen   uint8
+	Data   [24]int8
+}
+
+type RawSockaddr struct {
+	Len    uint8
+	Family uint8
+	Data   [14]int8
+}
+
+type RawSockaddrAny struct {
+	Addr RawSockaddr
+	Pad  [92]int8
+}
+
+type _Socklen uint32
+
+type Linger struct {
+	Onoff  int32
+	Linger int32
+}
+
+type Iovec struct {
+	Base *byte
+	Len  uint64
+}
+
+type IPMreq struct {
+	Multiaddr [4]byte /* in_addr */
+	Interface [4]byte /* in_addr */
+}
+
+type IPv6Mreq struct {
+	Multiaddr [16]byte /* in6_addr */
+	Interface uint32
+}
+
+type Msghdr struct {
+	Name       *byte
+	Namelen    uint32
+	Iov        *Iovec
+	Iovlen     uint32
+	Control    *byte
+	Controllen uint32
+	Flags      int32
+}
+
+type Cmsghdr struct {
+	Len   uint32
+	Level int32
+	Type  int32
+}
+
+type Inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex uint32
+}
+
+type IPv6MTUInfo struct {
+	Addr RawSockaddrInet6
+	Mtu  uint32
+}
+
+type ICMPv6Filter struct {
+	Filt [8]uint32
+}
+
+const (
+	SizeofSockaddrInet4    = 0x10
+	SizeofSockaddrInet6    = 0x1c
+	SizeofSockaddrAny      = 0x6c
+	SizeofSockaddrUnix     = 0x6a
+	SizeofSockaddrDatalink = 0x20
+	SizeofLinger           = 0x8
+	SizeofIovec            = 0x10
+	SizeofIPMreq           = 0x8
+	SizeofIPv6Mreq         = 0x14
+	SizeofMsghdr           = 0x30
+	SizeofCmsghdr          = 0xc
+	SizeofInet6Pktinfo     = 0x14
+	SizeofIPv6MTUInfo      = 0x20
+	SizeofICMPv6Filter     = 0x20
+)
+
+const (
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
+)
+
+type Kevent_t struct {
+	Ident  uint64
+	Filter int16
+	Flags  uint16
+	Fflags uint32
+	Data   int64
+	Udata  *byte
+}
+
+type FdSet struct {
+	Bits [32]uint32
+}
+
+const (
+	SizeofIfMsghdr         = 0xa8
+	SizeofIfData           = 0x90
+	SizeofIfaMsghdr        = 0x18
+	SizeofIfAnnounceMsghdr = 0x1a
+	SizeofRtMsghdr         = 0x60
+	SizeofRtMetrics        = 0x38
+)
+
+type IfMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Hdrlen  uint16
+	Index   uint16
+	Tableid uint16
+	Pad1    uint8
+	Pad2    uint8
+	Addrs   int32
+	Flags   int32
+	Xflags  int32
+	Data    IfData
+}
+
+type IfData struct {
+	Type         uint8
+	Addrlen      uint8
+	Hdrlen       uint8
+	Link_state   uint8
+	Mtu          uint32
+	Metric       uint32
+	Rdomain      uint32
+	Baudrate     uint64
+	Ipackets     uint64
+	Ierrors      uint64
+	Opackets     uint64
+	Oerrors      uint64
+	Collisions   uint64
+	Ibytes       uint64
+	Obytes       uint64
+	Imcasts      uint64
+	Omcasts      uint64
+	Iqdrops      uint64
+	Oqdrops      uint64
+	Noproto      uint64
+	Capabilities uint32
+	Lastchange   Timeval
+}
+
+type IfaMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Hdrlen  uint16
+	Index   uint16
+	Tableid uint16
+	Pad1    uint8
+	Pad2    uint8
+	Addrs   int32
+	Flags   int32
+	Metric  int32
+}
+
+type IfAnnounceMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Hdrlen  uint16
+	Index   uint16
+	What    uint16
+	Name    [16]int8
+}
+
+type RtMsghdr struct {
+	Msglen   uint16
+	Version  uint8
+	Type     uint8
+	Hdrlen   uint16
+	Index    uint16
+	Tableid  uint16
+	Priority uint8
+	Mpls     uint8
+	Addrs    int32
+	Flags    int32
+	Fmask    int32
+	Pid      int32
+	Seq      int32
+	Errno    int32
+	Inits    uint32
+	Rmx      RtMetrics
+}
+
+type RtMetrics struct {
+	Pksent   uint64
+	Expire   int64
+	Locks    uint32
+	Mtu      uint32
+	Refcnt   uint32
+	Hopcount uint32
+	Recvpipe uint32
+	Sendpipe uint32
+	Ssthresh uint32
+	Rtt      uint32
+	Rttvar   uint32
+	Pad      uint32
+}
+
+type Mclpool struct{}
+
+const (
+	SizeofBpfVersion = 0x4
+	SizeofBpfStat    = 0x8
+	SizeofBpfProgram = 0x10
+	SizeofBpfInsn    = 0x8
+	SizeofBpfHdr     = 0x18
+)
+
+type BpfVersion struct {
+	Major uint16
+	Minor uint16
+}
+
+type BpfStat struct {
+	Recv uint32
+	Drop uint32
+}
+
+type BpfProgram struct {
+	Len   uint32
+	Insns *BpfInsn
+}
+
+type BpfInsn struct {
+	Code uint16
+	Jt   uint8
+	Jf   uint8
+	K    uint32
+}
+
+type BpfHdr struct {
+	Tstamp  BpfTimeval
+	Caplen  uint32
+	Datalen uint32
+	Hdrlen  uint16
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
+}
+
+type BpfTimeval struct {
+	Sec  uint32
+	Usec uint32
+}
+
+type Termios struct {
+	Iflag  uint32
+	Oflag  uint32
+	Cflag  uint32
+	Lflag  uint32
+	Cc     [20]uint8
+	Ispeed int32
+	Ospeed int32
+}
+
+type Winsize struct {
+	Row    uint16
+	Col    uint16
+	Xpixel uint16
+	Ypixel uint16
+}
+
+const (
+	AT_FDCWD            = -0x64
+	AT_EACCESS          = 0x1
+	AT_SYMLINK_NOFOLLOW = 0x2
+	AT_SYMLINK_FOLLOW   = 0x4
+	AT_REMOVEDIR        = 0x8
+)
+
+type PollFd struct {
+	Fd      int32
+	Events  int16
+	Revents int16
+}
+
+const (
+	POLLERR    = 0x8
+	POLLHUP    = 0x10
+	POLLIN     = 0x1
+	POLLNVAL   = 0x20
+	POLLOUT    = 0x4
+	POLLPRI    = 0x2
+	POLLRDBAND = 0x80
+	POLLRDNORM = 0x40
+	POLLWRBAND = 0x100
+	POLLWRNORM = 0x4
+)
+
+type Sigset_t uint32
+
+type Utsname struct {
+	Sysname  [256]byte
+	Nodename [256]byte
+	Release  [256]byte
+	Version  [256]byte
+	Machine  [256]byte
+}
+
+const SizeofUvmexp = 0x158
+
+type Uvmexp struct {
+	Pagesize           int32
+	Pagemask           int32
+	Pageshift          int32
+	Npages             int32
+	Free               int32
+	Active             int32
+	Inactive           int32
+	Paging             int32
+	Wired              int32
+	Zeropages          int32
+	Reserve_pagedaemon int32
+	Reserve_kernel     int32
+	Unused01           int32
+	Vnodepages         int32
+	Vtextpages         int32
+	Freemin            int32
+	Freetarg           int32
+	Inactarg           int32
+	Wiredmax           int32
+	Anonmin            int32
+	Vtextmin           int32
+	Vnodemin           int32
+	Anonminpct         int32
+	Vtextminpct        int32
+	Vnodeminpct        int32
+	Nswapdev           int32
+	Swpages            int32
+	Swpginuse          int32
+	Swpgonly           int32
+	Nswget             int32
+	Nanon              int32
+	Unused05           int32
+	Unused06           int32
+	Faults             int32
+	Traps              int32
+	Intrs              int32
+	Swtch              int32
+	Softs              int32
+	Syscalls           int32
+	Pageins            int32
+	Unused07           int32
+	Unused08           int32
+	Pgswapin           int32
+	Pgswapout          int32
+	Forks              int32
+	Forks_ppwait       int32
+	Forks_sharevm      int32
+	Pga_zerohit        int32
+	Pga_zeromiss       int32
+	Unused09           int32
+	Fltnoram           int32
+	Fltnoanon          int32
+	Fltnoamap          int32
+	Fltpgwait          int32
+	Fltpgrele          int32
+	Fltrelck           int32
+	Fltrelckok         int32
+	Fltanget           int32
+	Fltanretry         int32
+	Fltamcopy          int32
+	Fltnamap           int32
+	Fltnomap           int32
+	Fltlget            int32
+	Fltget             int32
+	Flt_anon           int32
+	Flt_acow           int32
+	Flt_obj            int32
+	Flt_prcopy         int32
+	Flt_przero         int32
+	Pdwoke             int32
+	Pdrevs             int32
+	Pdswout            int32
+	Pdfreed            int32
+	Pdscans            int32
+	Pdanscan           int32
+	Pdobscan           int32
+	Pdreact            int32
+	Pdbusy             int32
+	Pdpageouts         int32
+	Pdpending          int32
+	Pddeact            int32
+	Unused11           int32
+	Unused12           int32
+	Unused13           int32
+	Fpswtch            int32
+	Kmapent            int32
+}
+
+const SizeofClockinfo = 0x10
+
+type Clockinfo struct {
+	Hz     int32
+	Tick   int32
+	Stathz int32
+	Profhz int32
+}
diff --git a/vendor/golang.org/x/sys/unix/ztypes_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/ztypes_openbsd_riscv64.go
new file mode 100644
index 0000000000..ddfd27a434
--- /dev/null
+++ b/vendor/golang.org/x/sys/unix/ztypes_openbsd_riscv64.go
@@ -0,0 +1,571 @@
+// cgo -godefs -- -fsigned-char types_openbsd.go | go run mkpost.go
+// Code generated by the command above; see README.md. DO NOT EDIT.
+
+//go:build riscv64 && openbsd
+// +build riscv64,openbsd
+
+package unix
+
+const (
+	SizeofPtr      = 0x8
+	SizeofShort    = 0x2
+	SizeofInt      = 0x4
+	SizeofLong     = 0x8
+	SizeofLongLong = 0x8
+)
+
+type (
+	_C_short     int16
+	_C_int       int32
+	_C_long      int64
+	_C_long_long int64
+)
+
+type Timespec struct {
+	Sec  int64
+	Nsec int64
+}
+
+type Timeval struct {
+	Sec  int64
+	Usec int64
+}
+
+type Rusage struct {
+	Utime    Timeval
+	Stime    Timeval
+	Maxrss   int64
+	Ixrss    int64
+	Idrss    int64
+	Isrss    int64
+	Minflt   int64
+	Majflt   int64
+	Nswap    int64
+	Inblock  int64
+	Oublock  int64
+	Msgsnd   int64
+	Msgrcv   int64
+	Nsignals int64
+	Nvcsw    int64
+	Nivcsw   int64
+}
+
+type Rlimit struct {
+	Cur uint64
+	Max uint64
+}
+
+type _Gid_t uint32
+
+type Stat_t struct {
+	Mode    uint32
+	Dev     int32
+	Ino     uint64
+	Nlink   uint32
+	Uid     uint32
+	Gid     uint32
+	Rdev    int32
+	Atim    Timespec
+	Mtim    Timespec
+	Ctim    Timespec
+	Size    int64
+	Blocks  int64
+	Blksize int32
+	Flags   uint32
+	Gen     uint32
+	_       Timespec
+}
+
+type Statfs_t struct {
+	F_flags       uint32
+	F_bsize       uint32
+	F_iosize      uint32
+	F_blocks      uint64
+	F_bfree       uint64
+	F_bavail      int64
+	F_files       uint64
+	F_ffree       uint64
+	F_favail      int64
+	F_syncwrites  uint64
+	F_syncreads   uint64
+	F_asyncwrites uint64
+	F_asyncreads  uint64
+	F_fsid        Fsid
+	F_namemax     uint32
+	F_owner       uint32
+	F_ctime       uint64
+	F_fstypename  [16]byte
+	F_mntonname   [90]byte
+	F_mntfromname [90]byte
+	F_mntfromspec [90]byte
+	_             [2]byte
+	Mount_info    [160]byte
+}
+
+type Flock_t struct {
+	Start  int64
+	Len    int64
+	Pid    int32
+	Type   int16
+	Whence int16
+}
+
+type Dirent struct {
+	Fileno uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Namlen uint8
+	_      [4]uint8
+	Name   [256]int8
+}
+
+type Fsid struct {
+	Val [2]int32
+}
+
+const (
+	PathMax = 0x400
+)
+
+type RawSockaddrInet4 struct {
+	Len    uint8
+	Family uint8
+	Port   uint16
+	Addr   [4]byte /* in_addr */
+	Zero   [8]int8
+}
+
+type RawSockaddrInet6 struct {
+	Len      uint8
+	Family   uint8
+	Port     uint16
+	Flowinfo uint32
+	Addr     [16]byte /* in6_addr */
+	Scope_id uint32
+}
+
+type RawSockaddrUnix struct {
+	Len    uint8
+	Family uint8
+	Path   [104]int8
+}
+
+type RawSockaddrDatalink struct {
+	Len    uint8
+	Family uint8
+	Index  uint16
+	Type   uint8
+	Nlen   uint8
+	Alen   uint8
+	Slen   uint8
+	Data   [24]int8
+}
+
+type RawSockaddr struct {
+	Len    uint8
+	Family uint8
+	Data   [14]int8
+}
+
+type RawSockaddrAny struct {
+	Addr RawSockaddr
+	Pad  [92]int8
+}
+
+type _Socklen uint32
+
+type Linger struct {
+	Onoff  int32
+	Linger int32
+}
+
+type Iovec struct {
+	Base *byte
+	Len  uint64
+}
+
+type IPMreq struct {
+	Multiaddr [4]byte /* in_addr */
+	Interface [4]byte /* in_addr */
+}
+
+type IPv6Mreq struct {
+	Multiaddr [16]byte /* in6_addr */
+	Interface uint32
+}
+
+type Msghdr struct {
+	Name       *byte
+	Namelen    uint32
+	Iov        *Iovec
+	Iovlen     uint32
+	Control    *byte
+	Controllen uint32
+	Flags      int32
+}
+
+type Cmsghdr struct {
+	Len   uint32
+	Level int32
+	Type  int32
+}
+
+type Inet6Pktinfo struct {
+	Addr    [16]byte /* in6_addr */
+	Ifindex uint32
+}
+
+type IPv6MTUInfo struct {
+	Addr RawSockaddrInet6
+	Mtu  uint32
+}
+
+type ICMPv6Filter struct {
+	Filt [8]uint32
+}
+
+const (
+	SizeofSockaddrInet4    = 0x10
+	SizeofSockaddrInet6    = 0x1c
+	SizeofSockaddrAny      = 0x6c
+	SizeofSockaddrUnix     = 0x6a
+	SizeofSockaddrDatalink = 0x20
+	SizeofLinger           = 0x8
+	SizeofIovec            = 0x10
+	SizeofIPMreq           = 0x8
+	SizeofIPv6Mreq         = 0x14
+	SizeofMsghdr           = 0x30
+	SizeofCmsghdr          = 0xc
+	SizeofInet6Pktinfo     = 0x14
+	SizeofIPv6MTUInfo      = 0x20
+	SizeofICMPv6Filter     = 0x20
+)
+
+const (
+	PTRACE_TRACEME = 0x0
+	PTRACE_CONT    = 0x7
+	PTRACE_KILL    = 0x8
+)
+
+type Kevent_t struct {
+	Ident  uint64
+	Filter int16
+	Flags  uint16
+	Fflags uint32
+	Data   int64
+	Udata  *byte
+}
+
+type FdSet struct {
+	Bits [32]uint32
+}
+
+const (
+	SizeofIfMsghdr         = 0xa8
+	SizeofIfData           = 0x90
+	SizeofIfaMsghdr        = 0x18
+	SizeofIfAnnounceMsghdr = 0x1a
+	SizeofRtMsghdr         = 0x60
+	SizeofRtMetrics        = 0x38
+)
+
+type IfMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Hdrlen  uint16
+	Index   uint16
+	Tableid uint16
+	Pad1    uint8
+	Pad2    uint8
+	Addrs   int32
+	Flags   int32
+	Xflags  int32
+	Data    IfData
+}
+
+type IfData struct {
+	Type         uint8
+	Addrlen      uint8
+	Hdrlen       uint8
+	Link_state   uint8
+	Mtu          uint32
+	Metric       uint32
+	Rdomain      uint32
+	Baudrate     uint64
+	Ipackets     uint64
+	Ierrors      uint64
+	Opackets     uint64
+	Oerrors      uint64
+	Collisions   uint64
+	Ibytes       uint64
+	Obytes       uint64
+	Imcasts      uint64
+	Omcasts      uint64
+	Iqdrops      uint64
+	Oqdrops      uint64
+	Noproto      uint64
+	Capabilities uint32
+	Lastchange   Timeval
+}
+
+type IfaMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Hdrlen  uint16
+	Index   uint16
+	Tableid uint16
+	Pad1    uint8
+	Pad2    uint8
+	Addrs   int32
+	Flags   int32
+	Metric  int32
+}
+
+type IfAnnounceMsghdr struct {
+	Msglen  uint16
+	Version uint8
+	Type    uint8
+	Hdrlen  uint16
+	Index   uint16
+	What    uint16
+	Name    [16]int8
+}
+
+type RtMsghdr struct {
+	Msglen   uint16
+	Version  uint8
+	Type     uint8
+	Hdrlen   uint16
+	Index    uint16
+	Tableid  uint16
+	Priority uint8
+	Mpls     uint8
+	Addrs    int32
+	Flags    int32
+	Fmask    int32
+	Pid      int32
+	Seq      int32
+	Errno    int32
+	Inits    uint32
+	Rmx      RtMetrics
+}
+
+type RtMetrics struct {
+	Pksent   uint64
+	Expire   int64
+	Locks    uint32
+	Mtu      uint32
+	Refcnt   uint32
+	Hopcount uint32
+	Recvpipe uint32
+	Sendpipe uint32
+	Ssthresh uint32
+	Rtt      uint32
+	Rttvar   uint32
+	Pad      uint32
+}
+
+type Mclpool struct{}
+
+const (
+	SizeofBpfVersion = 0x4
+	SizeofBpfStat    = 0x8
+	SizeofBpfProgram = 0x10
+	SizeofBpfInsn    = 0x8
+	SizeofBpfHdr     = 0x18
+)
+
+type BpfVersion struct {
+	Major uint16
+	Minor uint16
+}
+
+type BpfStat struct {
+	Recv uint32
+	Drop uint32
+}
+
+type BpfProgram struct {
+	Len   uint32
+	Insns *BpfInsn
+}
+
+type BpfInsn struct {
+	Code uint16
+	Jt   uint8
+	Jf   uint8
+	K    uint32
+}
+
+type BpfHdr struct {
+	Tstamp  BpfTimeval
+	Caplen  uint32
+	Datalen uint32
+	Hdrlen  uint16
+	Ifidx   uint16
+	Flowid  uint16
+	Flags   uint8
+	Drops   uint8
+}
+
+type BpfTimeval struct {
+	Sec  uint32
+	Usec uint32
+}
+
+type Termios struct {
+	Iflag  uint32
+	Oflag  uint32
+	Cflag  uint32
+	Lflag  uint32
+	Cc     [20]uint8
+	Ispeed int32
+	Ospeed int32
+}
+
+type Winsize struct {
+	Row    uint16
+	Col    uint16
+	Xpixel uint16
+	Ypixel uint16
+}
+
+const (
+	AT_FDCWD            = -0x64
+	AT_EACCESS          = 0x1
+	AT_SYMLINK_NOFOLLOW = 0x2
+	AT_SYMLINK_FOLLOW   = 0x4
+	AT_REMOVEDIR        = 0x8
+)
+
+type PollFd struct {
+	Fd      int32
+	Events  int16
+	Revents int16
+}
+
+const (
+	POLLERR    = 0x8
+	POLLHUP    = 0x10
+	POLLIN     = 0x1
+	POLLNVAL   = 0x20
+	POLLOUT    = 0x4
+	POLLPRI    = 0x2
+	POLLRDBAND = 0x80
+	POLLRDNORM = 0x40
+	POLLWRBAND = 0x100
+	POLLWRNORM = 0x4
+)
+
+type Sigset_t uint32
+
+type Utsname struct {
+	Sysname  [256]byte
+	Nodename [256]byte
+	Release  [256]byte
+	Version  [256]byte
+	Machine  [256]byte
+}
+
+const SizeofUvmexp = 0x158
+
+type Uvmexp struct {
+	Pagesize           int32
+	Pagemask           int32
+	Pageshift          int32
+	Npages             int32
+	Free               int32
+	Active             int32
+	Inactive           int32
+	Paging             int32
+	Wired              int32
+	Zeropages          int32
+	Reserve_pagedaemon int32
+	Reserve_kernel     int32
+	Unused01           int32
+	Vnodepages         int32
+	Vtextpages         int32
+	Freemin            int32
+	Freetarg           int32
+	Inactarg           int32
+	Wiredmax           int32
+	Anonmin            int32
+	Vtextmin           int32
+	Vnodemin           int32
+	Anonminpct         int32
+	Vtextminpct        int32
+	Vnodeminpct        int32
+	Nswapdev           int32
+	Swpages            int32
+	Swpginuse          int32
+	Swpgonly           int32
+	Nswget             int32
+	Nanon              int32
+	Unused05           int32
+	Unused06           int32
+	Faults             int32
+	Traps              int32
+	Intrs              int32
+	Swtch              int32
+	Softs              int32
+	Syscalls           int32
+	Pageins            int32
+	Unused07           int32
+	Unused08           int32
+	Pgswapin           int32
+	Pgswapout          int32
+	Forks              int32
+	Forks_ppwait       int32
+	Forks_sharevm      int32
+	Pga_zerohit        int32
+	Pga_zeromiss       int32
+	Unused09           int32
+	Fltnoram           int32
+	Fltnoanon          int32
+	Fltnoamap          int32
+	Fltpgwait          int32
+	Fltpgrele          int32
+	Fltrelck           int32
+	Fltrelckok         int32
+	Fltanget           int32
+	Fltanretry         int32
+	Fltamcopy          int32
+	Fltnamap           int32
+	Fltnomap           int32
+	Fltlget            int32
+	Fltget             int32
+	Flt_anon           int32
+	Flt_acow           int32
+	Flt_obj            int32
+	Flt_prcopy         int32
+	Flt_przero         int32
+	Pdwoke             int32
+	Pdrevs             int32
+	Pdswout            int32
+	Pdfreed            int32
+	Pdscans            int32
+	Pdanscan           int32
+	Pdobscan           int32
+	Pdreact            int32
+	Pdbusy             int32
+	Pdpageouts         int32
+	Pdpending          int32
+	Pddeact            int32
+	Unused11           int32
+	Unused12           int32
+	Unused13           int32
+	Fpswtch            int32
+	Kmapent            int32
+}
+
+const SizeofClockinfo = 0x10
+
+type Clockinfo struct {
+	Hz     int32
+	Tick   int32
+	Stathz int32
+	Profhz int32
+}
diff --git a/vendor/golang.org/x/sys/unix/ztypes_solaris_amd64.go b/vendor/golang.org/x/sys/unix/ztypes_solaris_amd64.go
index ad4aad2796..0400747c67 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_solaris_amd64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_solaris_amd64.go
@@ -178,7 +178,7 @@ type Linger struct {
 }
 
 type Iovec struct {
-	Base *int8
+	Base *byte
 	Len  uint64
 }
 
@@ -480,3 +480,38 @@ const (
 	MOUNTEDOVER        = 0x40000000
 	FILE_EXCEPTION     = 0x60000070
 )
+
+const (
+	TUNNEWPPA = 0x540001
+	TUNSETPPA = 0x540002
+
+	I_STR     = 0x5308
+	I_POP     = 0x5303
+	I_PUSH    = 0x5302
+	I_LINK    = 0x530c
+	I_UNLINK  = 0x530d
+	I_PLINK   = 0x5316
+	I_PUNLINK = 0x5317
+
+	IF_UNITSEL = -0x7ffb8cca
+)
+
+type strbuf struct {
+	Maxlen int32
+	Len    int32
+	Buf    *int8
+}
+
+type Strioctl struct {
+	Cmd    int32
+	Timout int32
+	Len    int32
+	Dp     *int8
+}
+
+type Lifreq struct {
+	Name   [32]int8
+	Lifru1 [4]byte
+	Type   uint32
+	Lifru  [336]byte
+}
diff --git a/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go b/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go
index 4ab638cb94..aec1efcb30 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_zos_s390x.go
@@ -339,7 +339,7 @@ type Statfs_t struct {
 	Flags   uint64
 }
 
-type Dirent struct {
+type direntLE struct {
 	Reclen uint16
 	Namlen uint16
 	Ino    uint32
@@ -347,6 +347,15 @@ type Dirent struct {
 	Name   [256]byte
 }
 
+type Dirent struct {
+	Ino    uint64
+	Off    int64
+	Reclen uint16
+	Type   uint8
+	Name   [256]uint8
+	_      [5]byte
+}
+
 type FdSet struct {
 	Bits [64]int32
 }
diff --git a/vendor/golang.org/x/sys/windows/env_windows.go b/vendor/golang.org/x/sys/windows/env_windows.go
index 92ac05ff4e..b8ad192506 100644
--- a/vendor/golang.org/x/sys/windows/env_windows.go
+++ b/vendor/golang.org/x/sys/windows/env_windows.go
@@ -37,14 +37,14 @@ func (token Token) Environ(inheritExisting bool) (env []string, err error) {
 		return nil, err
 	}
 	defer DestroyEnvironmentBlock(block)
-	blockp := uintptr(unsafe.Pointer(block))
+	blockp := unsafe.Pointer(block)
 	for {
-		entry := UTF16PtrToString((*uint16)(unsafe.Pointer(blockp)))
+		entry := UTF16PtrToString((*uint16)(blockp))
 		if len(entry) == 0 {
 			break
 		}
 		env = append(env, entry)
-		blockp += 2 * (uintptr(len(entry)) + 1)
+		blockp = unsafe.Add(blockp, 2*(len(entry)+1))
 	}
 	return env, nil
 }
diff --git a/vendor/golang.org/x/sys/windows/exec_windows.go b/vendor/golang.org/x/sys/windows/exec_windows.go
index 7a11e83b7e..a52e0331d8 100644
--- a/vendor/golang.org/x/sys/windows/exec_windows.go
+++ b/vendor/golang.org/x/sys/windows/exec_windows.go
@@ -9,19 +9,17 @@ package windows
 import (
 	errorspkg "errors"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 // EscapeArg rewrites command line argument s as prescribed
 // in http://msdn.microsoft.com/en-us/library/ms880421.
 // This function returns "" (2 double quotes) if s is empty.
 // Alternatively, these transformations are done:
-// - every back slash (\) is doubled, but only if immediately
-//   followed by double quote (");
-// - every double quote (") is escaped by back slash (\);
-// - finally, s is wrapped with double quotes (arg -> "arg"),
-//   but only if there is space or tab inside s.
+//   - every back slash (\) is doubled, but only if immediately
+//     followed by double quote (");
+//   - every double quote (") is escaped by back slash (\);
+//   - finally, s is wrapped with double quotes (arg -> "arg"),
+//     but only if there is space or tab inside s.
 func EscapeArg(s string) string {
 	if len(s) == 0 {
 		return "\"\""
@@ -97,12 +95,17 @@ func ComposeCommandLine(args []string) string {
 // DecomposeCommandLine breaks apart its argument command line into unescaped parts using CommandLineToArgv,
 // as gathered from GetCommandLine, QUERY_SERVICE_CONFIG's BinaryPathName argument, or elsewhere that
 // command lines are passed around.
+// DecomposeCommandLine returns error if commandLine contains NUL.
 func DecomposeCommandLine(commandLine string) ([]string, error) {
 	if len(commandLine) == 0 {
 		return []string{}, nil
 	}
+	utf16CommandLine, err := UTF16FromString(commandLine)
+	if err != nil {
+		return nil, errorspkg.New("string with NUL passed to DecomposeCommandLine")
+	}
 	var argc int32
-	argv, err := CommandLineToArgv(StringToUTF16Ptr(commandLine), &argc)
+	argv, err := CommandLineToArgv(&utf16CommandLine[0], &argc)
 	if err != nil {
 		return nil, err
 	}
@@ -147,8 +150,12 @@ func NewProcThreadAttributeList(maxAttrCount uint32) (*ProcThreadAttributeListCo
 		}
 		return nil, err
 	}
+	alloc, err := LocalAlloc(LMEM_FIXED, uint32(size))
+	if err != nil {
+		return nil, err
+	}
 	// size is guaranteed to be ≥1 by InitializeProcThreadAttributeList.
-	al := &ProcThreadAttributeListContainer{data: (*ProcThreadAttributeList)(unsafe.Pointer(&make([]byte, size)[0]))}
+	al := &ProcThreadAttributeListContainer{data: (*ProcThreadAttributeList)(unsafe.Pointer(alloc))}
 	err = initializeProcThreadAttributeList(al.data, maxAttrCount, 0, &size)
 	if err != nil {
 		return nil, err
@@ -157,36 +164,17 @@ func NewProcThreadAttributeList(maxAttrCount uint32) (*ProcThreadAttributeListCo
 }
 
 // Update modifies the ProcThreadAttributeList using UpdateProcThreadAttribute.
-// Note that the value passed to this function will be copied into memory
-// allocated by LocalAlloc, the contents of which should not contain any
-// Go-managed pointers, even if the passed value itself is a Go-managed
-// pointer.
 func (al *ProcThreadAttributeListContainer) Update(attribute uintptr, value unsafe.Pointer, size uintptr) error {
-	alloc, err := LocalAlloc(LMEM_FIXED, uint32(size))
-	if err != nil {
-		return err
-	}
-	var src, dst []byte
-	hdr := (*unsafeheader.Slice)(unsafe.Pointer(&src))
-	hdr.Data = value
-	hdr.Cap = int(size)
-	hdr.Len = int(size)
-	hdr = (*unsafeheader.Slice)(unsafe.Pointer(&dst))
-	hdr.Data = unsafe.Pointer(alloc)
-	hdr.Cap = int(size)
-	hdr.Len = int(size)
-	copy(dst, src)
-	al.heapAllocations = append(al.heapAllocations, alloc)
-	return updateProcThreadAttribute(al.data, 0, attribute, unsafe.Pointer(alloc), size, nil, nil)
+	al.pointers = append(al.pointers, value)
+	return updateProcThreadAttribute(al.data, 0, attribute, value, size, nil, nil)
 }
 
 // Delete frees ProcThreadAttributeList's resources.
 func (al *ProcThreadAttributeListContainer) Delete() {
 	deleteProcThreadAttributeList(al.data)
-	for i := range al.heapAllocations {
-		LocalFree(Handle(al.heapAllocations[i]))
-	}
-	al.heapAllocations = nil
+	LocalFree(Handle(unsafe.Pointer(al.data)))
+	al.data = nil
+	al.pointers = nil
 }
 
 // List returns the actual ProcThreadAttributeList to be passed to StartupInfoEx.
diff --git a/vendor/golang.org/x/sys/windows/mksyscall.go b/vendor/golang.org/x/sys/windows/mksyscall.go
index 6102910989..8563f79c57 100644
--- a/vendor/golang.org/x/sys/windows/mksyscall.go
+++ b/vendor/golang.org/x/sys/windows/mksyscall.go
@@ -7,4 +7,4 @@
 
 package windows
 
-//go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go eventlog.go service.go syscall_windows.go security_windows.go
+//go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go eventlog.go service.go syscall_windows.go security_windows.go setupapi_windows.go
diff --git a/vendor/golang.org/x/sys/windows/registry/key.go b/vendor/golang.org/x/sys/windows/registry/key.go
new file mode 100644
index 0000000000..6c8d97b6a5
--- /dev/null
+++ b/vendor/golang.org/x/sys/windows/registry/key.go
@@ -0,0 +1,206 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build windows
+// +build windows
+
+// Package registry provides access to the Windows registry.
+//
+// Here is a simple example, opening a registry key and reading a string value from it.
+//
+//	k, err := registry.OpenKey(registry.LOCAL_MACHINE, `SOFTWARE\Microsoft\Windows NT\CurrentVersion`, registry.QUERY_VALUE)
+//	if err != nil {
+//		log.Fatal(err)
+//	}
+//	defer k.Close()
+//
+//	s, _, err := k.GetStringValue("SystemRoot")
+//	if err != nil {
+//		log.Fatal(err)
+//	}
+//	fmt.Printf("Windows system root is %q\n", s)
+package registry
+
+import (
+	"io"
+	"runtime"
+	"syscall"
+	"time"
+)
+
+const (
+	// Registry key security and access rights.
+	// See https://msdn.microsoft.com/en-us/library/windows/desktop/ms724878.aspx
+	// for details.
+	ALL_ACCESS         = 0xf003f
+	CREATE_LINK        = 0x00020
+	CREATE_SUB_KEY     = 0x00004
+	ENUMERATE_SUB_KEYS = 0x00008
+	EXECUTE            = 0x20019
+	NOTIFY             = 0x00010
+	QUERY_VALUE        = 0x00001
+	READ               = 0x20019
+	SET_VALUE          = 0x00002
+	WOW64_32KEY        = 0x00200
+	WOW64_64KEY        = 0x00100
+	WRITE              = 0x20006
+)
+
+// Key is a handle to an open Windows registry key.
+// Keys can be obtained by calling OpenKey; there are
+// also some predefined root keys such as CURRENT_USER.
+// Keys can be used directly in the Windows API.
+type Key syscall.Handle
+
+const (
+	// Windows defines some predefined root keys that are always open.
+	// An application can use these keys as entry points to the registry.
+	// Normally these keys are used in OpenKey to open new keys,
+	// but they can also be used anywhere a Key is required.
+	CLASSES_ROOT     = Key(syscall.HKEY_CLASSES_ROOT)
+	CURRENT_USER     = Key(syscall.HKEY_CURRENT_USER)
+	LOCAL_MACHINE    = Key(syscall.HKEY_LOCAL_MACHINE)
+	USERS            = Key(syscall.HKEY_USERS)
+	CURRENT_CONFIG   = Key(syscall.HKEY_CURRENT_CONFIG)
+	PERFORMANCE_DATA = Key(syscall.HKEY_PERFORMANCE_DATA)
+)
+
+// Close closes open key k.
+func (k Key) Close() error {
+	return syscall.RegCloseKey(syscall.Handle(k))
+}
+
+// OpenKey opens a new key with path name relative to key k.
+// It accepts any open key, including CURRENT_USER and others,
+// and returns the new key and an error.
+// The access parameter specifies desired access rights to the
+// key to be opened.
+func OpenKey(k Key, path string, access uint32) (Key, error) {
+	p, err := syscall.UTF16PtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	var subkey syscall.Handle
+	err = syscall.RegOpenKeyEx(syscall.Handle(k), p, 0, access, &subkey)
+	if err != nil {
+		return 0, err
+	}
+	return Key(subkey), nil
+}
+
+// OpenRemoteKey opens a predefined registry key on another
+// computer pcname. The key to be opened is specified by k, but
+// can only be one of LOCAL_MACHINE, PERFORMANCE_DATA or USERS.
+// If pcname is "", OpenRemoteKey returns local computer key.
+func OpenRemoteKey(pcname string, k Key) (Key, error) {
+	var err error
+	var p *uint16
+	if pcname != "" {
+		p, err = syscall.UTF16PtrFromString(`\\` + pcname)
+		if err != nil {
+			return 0, err
+		}
+	}
+	var remoteKey syscall.Handle
+	err = regConnectRegistry(p, syscall.Handle(k), &remoteKey)
+	if err != nil {
+		return 0, err
+	}
+	return Key(remoteKey), nil
+}
+
+// ReadSubKeyNames returns the names of subkeys of key k.
+// The parameter n controls the number of returned names,
+// analogous to the way os.File.Readdirnames works.
+func (k Key) ReadSubKeyNames(n int) ([]string, error) {
+	// RegEnumKeyEx must be called repeatedly and to completion.
+	// During this time, this goroutine cannot migrate away from
+	// its current thread. See https://golang.org/issue/49320 and
+	// https://golang.org/issue/49466.
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	names := make([]string, 0)
+	// Registry key size limit is 255 bytes and described there:
+	// https://msdn.microsoft.com/library/windows/desktop/ms724872.aspx
+	buf := make([]uint16, 256) //plus extra room for terminating zero byte
+loopItems:
+	for i := uint32(0); ; i++ {
+		if n > 0 {
+			if len(names) == n {
+				return names, nil
+			}
+		}
+		l := uint32(len(buf))
+		for {
+			err := syscall.RegEnumKeyEx(syscall.Handle(k), i, &buf[0], &l, nil, nil, nil, nil)
+			if err == nil {
+				break
+			}
+			if err == syscall.ERROR_MORE_DATA {
+				// Double buffer size and try again.
+				l = uint32(2 * len(buf))
+				buf = make([]uint16, l)
+				continue
+			}
+			if err == _ERROR_NO_MORE_ITEMS {
+				break loopItems
+			}
+			return names, err
+		}
+		names = append(names, syscall.UTF16ToString(buf[:l]))
+	}
+	if n > len(names) {
+		return names, io.EOF
+	}
+	return names, nil
+}
+
+// CreateKey creates a key named path under open key k.
+// CreateKey returns the new key and a boolean flag that reports
+// whether the key already existed.
+// The access parameter specifies the access rights for the key
+// to be created.
+func CreateKey(k Key, path string, access uint32) (newk Key, openedExisting bool, err error) {
+	var h syscall.Handle
+	var d uint32
+	err = regCreateKeyEx(syscall.Handle(k), syscall.StringToUTF16Ptr(path),
+		0, nil, _REG_OPTION_NON_VOLATILE, access, nil, &h, &d)
+	if err != nil {
+		return 0, false, err
+	}
+	return Key(h), d == _REG_OPENED_EXISTING_KEY, nil
+}
+
+// DeleteKey deletes the subkey path of key k and its values.
+func DeleteKey(k Key, path string) error {
+	return regDeleteKey(syscall.Handle(k), syscall.StringToUTF16Ptr(path))
+}
+
+// A KeyInfo describes the statistics of a key. It is returned by Stat.
+type KeyInfo struct {
+	SubKeyCount     uint32
+	MaxSubKeyLen    uint32 // size of the key's subkey with the longest name, in Unicode characters, not including the terminating zero byte
+	ValueCount      uint32
+	MaxValueNameLen uint32 // size of the key's longest value name, in Unicode characters, not including the terminating zero byte
+	MaxValueLen     uint32 // longest data component among the key's values, in bytes
+	lastWriteTime   syscall.Filetime
+}
+
+// ModTime returns the key's last write time.
+func (ki *KeyInfo) ModTime() time.Time {
+	return time.Unix(0, ki.lastWriteTime.Nanoseconds())
+}
+
+// Stat retrieves information about the open key k.
+func (k Key) Stat() (*KeyInfo, error) {
+	var ki KeyInfo
+	err := syscall.RegQueryInfoKey(syscall.Handle(k), nil, nil, nil,
+		&ki.SubKeyCount, &ki.MaxSubKeyLen, nil, &ki.ValueCount,
+		&ki.MaxValueNameLen, &ki.MaxValueLen, nil, &ki.lastWriteTime)
+	if err != nil {
+		return nil, err
+	}
+	return &ki, nil
+}
diff --git a/vendor/golang.org/x/sys/windows/registry/mksyscall.go b/vendor/golang.org/x/sys/windows/registry/mksyscall.go
new file mode 100644
index 0000000000..ee74927d3c
--- /dev/null
+++ b/vendor/golang.org/x/sys/windows/registry/mksyscall.go
@@ -0,0 +1,10 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build generate
+// +build generate
+
+package registry
+
+//go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go syscall.go
diff --git a/vendor/golang.org/x/sys/windows/registry/syscall.go b/vendor/golang.org/x/sys/windows/registry/syscall.go
new file mode 100644
index 0000000000..4173351230
--- /dev/null
+++ b/vendor/golang.org/x/sys/windows/registry/syscall.go
@@ -0,0 +1,33 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build windows
+// +build windows
+
+package registry
+
+import "syscall"
+
+const (
+	_REG_OPTION_NON_VOLATILE = 0
+
+	_REG_CREATED_NEW_KEY     = 1
+	_REG_OPENED_EXISTING_KEY = 2
+
+	_ERROR_NO_MORE_ITEMS syscall.Errno = 259
+)
+
+func LoadRegLoadMUIString() error {
+	return procRegLoadMUIStringW.Find()
+}
+
+//sys	regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) = advapi32.RegCreateKeyExW
+//sys	regDeleteKey(key syscall.Handle, subkey *uint16) (regerrno error) = advapi32.RegDeleteKeyW
+//sys	regSetValueEx(key syscall.Handle, valueName *uint16, reserved uint32, vtype uint32, buf *byte, bufsize uint32) (regerrno error) = advapi32.RegSetValueExW
+//sys	regEnumValue(key syscall.Handle, index uint32, name *uint16, nameLen *uint32, reserved *uint32, valtype *uint32, buf *byte, buflen *uint32) (regerrno error) = advapi32.RegEnumValueW
+//sys	regDeleteValue(key syscall.Handle, name *uint16) (regerrno error) = advapi32.RegDeleteValueW
+//sys   regLoadMUIString(key syscall.Handle, name *uint16, buf *uint16, buflen uint32, buflenCopied *uint32, flags uint32, dir *uint16) (regerrno error) = advapi32.RegLoadMUIStringW
+//sys	regConnectRegistry(machinename *uint16, key syscall.Handle, result *syscall.Handle) (regerrno error) = advapi32.RegConnectRegistryW
+
+//sys	expandEnvironmentStrings(src *uint16, dst *uint16, size uint32) (n uint32, err error) = kernel32.ExpandEnvironmentStringsW
diff --git a/vendor/golang.org/x/sys/windows/registry/value.go b/vendor/golang.org/x/sys/windows/registry/value.go
new file mode 100644
index 0000000000..2789f6f18d
--- /dev/null
+++ b/vendor/golang.org/x/sys/windows/registry/value.go
@@ -0,0 +1,387 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build windows
+// +build windows
+
+package registry
+
+import (
+	"errors"
+	"io"
+	"syscall"
+	"unicode/utf16"
+	"unsafe"
+)
+
+const (
+	// Registry value types.
+	NONE                       = 0
+	SZ                         = 1
+	EXPAND_SZ                  = 2
+	BINARY                     = 3
+	DWORD                      = 4
+	DWORD_BIG_ENDIAN           = 5
+	LINK                       = 6
+	MULTI_SZ                   = 7
+	RESOURCE_LIST              = 8
+	FULL_RESOURCE_DESCRIPTOR   = 9
+	RESOURCE_REQUIREMENTS_LIST = 10
+	QWORD                      = 11
+)
+
+var (
+	// ErrShortBuffer is returned when the buffer was too short for the operation.
+	ErrShortBuffer = syscall.ERROR_MORE_DATA
+
+	// ErrNotExist is returned when a registry key or value does not exist.
+	ErrNotExist = syscall.ERROR_FILE_NOT_FOUND
+
+	// ErrUnexpectedType is returned by Get*Value when the value's type was unexpected.
+	ErrUnexpectedType = errors.New("unexpected key value type")
+)
+
+// GetValue retrieves the type and data for the specified value associated
+// with an open key k. It fills up buffer buf and returns the retrieved
+// byte count n. If buf is too small to fit the stored value it returns
+// ErrShortBuffer error along with the required buffer size n.
+// If no buffer is provided, it returns true and actual buffer size n.
+// If no buffer is provided, GetValue returns the value's type only.
+// If the value does not exist, the error returned is ErrNotExist.
+//
+// GetValue is a low level function. If value's type is known, use the appropriate
+// Get*Value function instead.
+func (k Key) GetValue(name string, buf []byte) (n int, valtype uint32, err error) {
+	pname, err := syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return 0, 0, err
+	}
+	var pbuf *byte
+	if len(buf) > 0 {
+		pbuf = (*byte)(unsafe.Pointer(&buf[0]))
+	}
+	l := uint32(len(buf))
+	err = syscall.RegQueryValueEx(syscall.Handle(k), pname, nil, &valtype, pbuf, &l)
+	if err != nil {
+		return int(l), valtype, err
+	}
+	return int(l), valtype, nil
+}
+
+func (k Key) getValue(name string, buf []byte) (data []byte, valtype uint32, err error) {
+	p, err := syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return nil, 0, err
+	}
+	var t uint32
+	n := uint32(len(buf))
+	for {
+		err = syscall.RegQueryValueEx(syscall.Handle(k), p, nil, &t, (*byte)(unsafe.Pointer(&buf[0])), &n)
+		if err == nil {
+			return buf[:n], t, nil
+		}
+		if err != syscall.ERROR_MORE_DATA {
+			return nil, 0, err
+		}
+		if n <= uint32(len(buf)) {
+			return nil, 0, err
+		}
+		buf = make([]byte, n)
+	}
+}
+
+// GetStringValue retrieves the string value for the specified
+// value name associated with an open key k. It also returns the value's type.
+// If value does not exist, GetStringValue returns ErrNotExist.
+// If value is not SZ or EXPAND_SZ, it will return the correct value
+// type and ErrUnexpectedType.
+func (k Key) GetStringValue(name string) (val string, valtype uint32, err error) {
+	data, typ, err2 := k.getValue(name, make([]byte, 64))
+	if err2 != nil {
+		return "", typ, err2
+	}
+	switch typ {
+	case SZ, EXPAND_SZ:
+	default:
+		return "", typ, ErrUnexpectedType
+	}
+	if len(data) == 0 {
+		return "", typ, nil
+	}
+	u := (*[1 << 29]uint16)(unsafe.Pointer(&data[0]))[: len(data)/2 : len(data)/2]
+	return syscall.UTF16ToString(u), typ, nil
+}
+
+// GetMUIStringValue retrieves the localized string value for
+// the specified value name associated with an open key k.
+// If the value name doesn't exist or the localized string value
+// can't be resolved, GetMUIStringValue returns ErrNotExist.
+// GetMUIStringValue panics if the system doesn't support
+// regLoadMUIString; use LoadRegLoadMUIString to check if
+// regLoadMUIString is supported before calling this function.
+func (k Key) GetMUIStringValue(name string) (string, error) {
+	pname, err := syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return "", err
+	}
+
+	buf := make([]uint16, 1024)
+	var buflen uint32
+	var pdir *uint16
+
+	err = regLoadMUIString(syscall.Handle(k), pname, &buf[0], uint32(len(buf)), &buflen, 0, pdir)
+	if err == syscall.ERROR_FILE_NOT_FOUND { // Try fallback path
+
+		// Try to resolve the string value using the system directory as
+		// a DLL search path; this assumes the string value is of the form
+		// @[path]\dllname,-strID but with no path given, e.g. @tzres.dll,-320.
+
+		// This approach works with tzres.dll but may have to be revised
+		// in the future to allow callers to provide custom search paths.
+
+		var s string
+		s, err = ExpandString("%SystemRoot%\\system32\\")
+		if err != nil {
+			return "", err
+		}
+		pdir, err = syscall.UTF16PtrFromString(s)
+		if err != nil {
+			return "", err
+		}
+
+		err = regLoadMUIString(syscall.Handle(k), pname, &buf[0], uint32(len(buf)), &buflen, 0, pdir)
+	}
+
+	for err == syscall.ERROR_MORE_DATA { // Grow buffer if needed
+		if buflen <= uint32(len(buf)) {
+			break // Buffer not growing, assume race; break
+		}
+		buf = make([]uint16, buflen)
+		err = regLoadMUIString(syscall.Handle(k), pname, &buf[0], uint32(len(buf)), &buflen, 0, pdir)
+	}
+
+	if err != nil {
+		return "", err
+	}
+
+	return syscall.UTF16ToString(buf), nil
+}
+
+// ExpandString expands environment-variable strings and replaces
+// them with the values defined for the current user.
+// Use ExpandString to expand EXPAND_SZ strings.
+func ExpandString(value string) (string, error) {
+	if value == "" {
+		return "", nil
+	}
+	p, err := syscall.UTF16PtrFromString(value)
+	if err != nil {
+		return "", err
+	}
+	r := make([]uint16, 100)
+	for {
+		n, err := expandEnvironmentStrings(p, &r[0], uint32(len(r)))
+		if err != nil {
+			return "", err
+		}
+		if n <= uint32(len(r)) {
+			return syscall.UTF16ToString(r[:n]), nil
+		}
+		r = make([]uint16, n)
+	}
+}
+
+// GetStringsValue retrieves the []string value for the specified
+// value name associated with an open key k. It also returns the value's type.
+// If value does not exist, GetStringsValue returns ErrNotExist.
+// If value is not MULTI_SZ, it will return the correct value
+// type and ErrUnexpectedType.
+func (k Key) GetStringsValue(name string) (val []string, valtype uint32, err error) {
+	data, typ, err2 := k.getValue(name, make([]byte, 64))
+	if err2 != nil {
+		return nil, typ, err2
+	}
+	if typ != MULTI_SZ {
+		return nil, typ, ErrUnexpectedType
+	}
+	if len(data) == 0 {
+		return nil, typ, nil
+	}
+	p := (*[1 << 29]uint16)(unsafe.Pointer(&data[0]))[: len(data)/2 : len(data)/2]
+	if len(p) == 0 {
+		return nil, typ, nil
+	}
+	if p[len(p)-1] == 0 {
+		p = p[:len(p)-1] // remove terminating null
+	}
+	val = make([]string, 0, 5)
+	from := 0
+	for i, c := range p {
+		if c == 0 {
+			val = append(val, string(utf16.Decode(p[from:i])))
+			from = i + 1
+		}
+	}
+	return val, typ, nil
+}
+
+// GetIntegerValue retrieves the integer value for the specified
+// value name associated with an open key k. It also returns the value's type.
+// If value does not exist, GetIntegerValue returns ErrNotExist.
+// If value is not DWORD or QWORD, it will return the correct value
+// type and ErrUnexpectedType.
+func (k Key) GetIntegerValue(name string) (val uint64, valtype uint32, err error) {
+	data, typ, err2 := k.getValue(name, make([]byte, 8))
+	if err2 != nil {
+		return 0, typ, err2
+	}
+	switch typ {
+	case DWORD:
+		if len(data) != 4 {
+			return 0, typ, errors.New("DWORD value is not 4 bytes long")
+		}
+		var val32 uint32
+		copy((*[4]byte)(unsafe.Pointer(&val32))[:], data)
+		return uint64(val32), DWORD, nil
+	case QWORD:
+		if len(data) != 8 {
+			return 0, typ, errors.New("QWORD value is not 8 bytes long")
+		}
+		copy((*[8]byte)(unsafe.Pointer(&val))[:], data)
+		return val, QWORD, nil
+	default:
+		return 0, typ, ErrUnexpectedType
+	}
+}
+
+// GetBinaryValue retrieves the binary value for the specified
+// value name associated with an open key k. It also returns the value's type.
+// If value does not exist, GetBinaryValue returns ErrNotExist.
+// If value is not BINARY, it will return the correct value
+// type and ErrUnexpectedType.
+func (k Key) GetBinaryValue(name string) (val []byte, valtype uint32, err error) {
+	data, typ, err2 := k.getValue(name, make([]byte, 64))
+	if err2 != nil {
+		return nil, typ, err2
+	}
+	if typ != BINARY {
+		return nil, typ, ErrUnexpectedType
+	}
+	return data, typ, nil
+}
+
+func (k Key) setValue(name string, valtype uint32, data []byte) error {
+	p, err := syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return err
+	}
+	if len(data) == 0 {
+		return regSetValueEx(syscall.Handle(k), p, 0, valtype, nil, 0)
+	}
+	return regSetValueEx(syscall.Handle(k), p, 0, valtype, &data[0], uint32(len(data)))
+}
+
+// SetDWordValue sets the data and type of a name value
+// under key k to value and DWORD.
+func (k Key) SetDWordValue(name string, value uint32) error {
+	return k.setValue(name, DWORD, (*[4]byte)(unsafe.Pointer(&value))[:])
+}
+
+// SetQWordValue sets the data and type of a name value
+// under key k to value and QWORD.
+func (k Key) SetQWordValue(name string, value uint64) error {
+	return k.setValue(name, QWORD, (*[8]byte)(unsafe.Pointer(&value))[:])
+}
+
+func (k Key) setStringValue(name string, valtype uint32, value string) error {
+	v, err := syscall.UTF16FromString(value)
+	if err != nil {
+		return err
+	}
+	buf := (*[1 << 29]byte)(unsafe.Pointer(&v[0]))[: len(v)*2 : len(v)*2]
+	return k.setValue(name, valtype, buf)
+}
+
+// SetStringValue sets the data and type of a name value
+// under key k to value and SZ. The value must not contain a zero byte.
+func (k Key) SetStringValue(name, value string) error {
+	return k.setStringValue(name, SZ, value)
+}
+
+// SetExpandStringValue sets the data and type of a name value
+// under key k to value and EXPAND_SZ. The value must not contain a zero byte.
+func (k Key) SetExpandStringValue(name, value string) error {
+	return k.setStringValue(name, EXPAND_SZ, value)
+}
+
+// SetStringsValue sets the data and type of a name value
+// under key k to value and MULTI_SZ. The value strings
+// must not contain a zero byte.
+func (k Key) SetStringsValue(name string, value []string) error {
+	ss := ""
+	for _, s := range value {
+		for i := 0; i < len(s); i++ {
+			if s[i] == 0 {
+				return errors.New("string cannot have 0 inside")
+			}
+		}
+		ss += s + "\x00"
+	}
+	v := utf16.Encode([]rune(ss + "\x00"))
+	buf := (*[1 << 29]byte)(unsafe.Pointer(&v[0]))[: len(v)*2 : len(v)*2]
+	return k.setValue(name, MULTI_SZ, buf)
+}
+
+// SetBinaryValue sets the data and type of a name value
+// under key k to value and BINARY.
+func (k Key) SetBinaryValue(name string, value []byte) error {
+	return k.setValue(name, BINARY, value)
+}
+
+// DeleteValue removes a named value from the key k.
+func (k Key) DeleteValue(name string) error {
+	return regDeleteValue(syscall.Handle(k), syscall.StringToUTF16Ptr(name))
+}
+
+// ReadValueNames returns the value names of key k.
+// The parameter n controls the number of returned names,
+// analogous to the way os.File.Readdirnames works.
+func (k Key) ReadValueNames(n int) ([]string, error) {
+	ki, err := k.Stat()
+	if err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, ki.ValueCount)
+	buf := make([]uint16, ki.MaxValueNameLen+1) // extra room for terminating null character
+loopItems:
+	for i := uint32(0); ; i++ {
+		if n > 0 {
+			if len(names) == n {
+				return names, nil
+			}
+		}
+		l := uint32(len(buf))
+		for {
+			err := regEnumValue(syscall.Handle(k), i, &buf[0], &l, nil, nil, nil, nil)
+			if err == nil {
+				break
+			}
+			if err == syscall.ERROR_MORE_DATA {
+				// Double buffer size and try again.
+				l = uint32(2 * len(buf))
+				buf = make([]uint16, l)
+				continue
+			}
+			if err == _ERROR_NO_MORE_ITEMS {
+				break loopItems
+			}
+			return names, err
+		}
+		names = append(names, syscall.UTF16ToString(buf[:l]))
+	}
+	if n > len(names) {
+		return names, io.EOF
+	}
+	return names, nil
+}
diff --git a/vendor/golang.org/x/sys/windows/registry/zsyscall_windows.go b/vendor/golang.org/x/sys/windows/registry/zsyscall_windows.go
new file mode 100644
index 0000000000..fc1835d8a2
--- /dev/null
+++ b/vendor/golang.org/x/sys/windows/registry/zsyscall_windows.go
@@ -0,0 +1,117 @@
+// Code generated by 'go generate'; DO NOT EDIT.
+
+package registry
+
+import (
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var _ unsafe.Pointer
+
+// Do the interface allocations only once for common
+// Errno values.
+const (
+	errnoERROR_IO_PENDING = 997
+)
+
+var (
+	errERROR_IO_PENDING error = syscall.Errno(errnoERROR_IO_PENDING)
+	errERROR_EINVAL     error = syscall.EINVAL
+)
+
+// errnoErr returns common boxed Errno values, to prevent
+// allocations at runtime.
+func errnoErr(e syscall.Errno) error {
+	switch e {
+	case 0:
+		return errERROR_EINVAL
+	case errnoERROR_IO_PENDING:
+		return errERROR_IO_PENDING
+	}
+	// TODO: add more here, after collecting data on the common
+	// error values see on Windows. (perhaps when running
+	// all.bat?)
+	return e
+}
+
+var (
+	modadvapi32 = windows.NewLazySystemDLL("advapi32.dll")
+	modkernel32 = windows.NewLazySystemDLL("kernel32.dll")
+
+	procRegConnectRegistryW       = modadvapi32.NewProc("RegConnectRegistryW")
+	procRegCreateKeyExW           = modadvapi32.NewProc("RegCreateKeyExW")
+	procRegDeleteKeyW             = modadvapi32.NewProc("RegDeleteKeyW")
+	procRegDeleteValueW           = modadvapi32.NewProc("RegDeleteValueW")
+	procRegEnumValueW             = modadvapi32.NewProc("RegEnumValueW")
+	procRegLoadMUIStringW         = modadvapi32.NewProc("RegLoadMUIStringW")
+	procRegSetValueExW            = modadvapi32.NewProc("RegSetValueExW")
+	procExpandEnvironmentStringsW = modkernel32.NewProc("ExpandEnvironmentStringsW")
+)
+
+func regConnectRegistry(machinename *uint16, key syscall.Handle, result *syscall.Handle) (regerrno error) {
+	r0, _, _ := syscall.Syscall(procRegConnectRegistryW.Addr(), 3, uintptr(unsafe.Pointer(machinename)), uintptr(key), uintptr(unsafe.Pointer(result)))
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func regCreateKeyEx(key syscall.Handle, subkey *uint16, reserved uint32, class *uint16, options uint32, desired uint32, sa *syscall.SecurityAttributes, result *syscall.Handle, disposition *uint32) (regerrno error) {
+	r0, _, _ := syscall.Syscall9(procRegCreateKeyExW.Addr(), 9, uintptr(key), uintptr(unsafe.Pointer(subkey)), uintptr(reserved), uintptr(unsafe.Pointer(class)), uintptr(options), uintptr(desired), uintptr(unsafe.Pointer(sa)), uintptr(unsafe.Pointer(result)), uintptr(unsafe.Pointer(disposition)))
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func regDeleteKey(key syscall.Handle, subkey *uint16) (regerrno error) {
+	r0, _, _ := syscall.Syscall(procRegDeleteKeyW.Addr(), 2, uintptr(key), uintptr(unsafe.Pointer(subkey)), 0)
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func regDeleteValue(key syscall.Handle, name *uint16) (regerrno error) {
+	r0, _, _ := syscall.Syscall(procRegDeleteValueW.Addr(), 2, uintptr(key), uintptr(unsafe.Pointer(name)), 0)
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func regEnumValue(key syscall.Handle, index uint32, name *uint16, nameLen *uint32, reserved *uint32, valtype *uint32, buf *byte, buflen *uint32) (regerrno error) {
+	r0, _, _ := syscall.Syscall9(procRegEnumValueW.Addr(), 8, uintptr(key), uintptr(index), uintptr(unsafe.Pointer(name)), uintptr(unsafe.Pointer(nameLen)), uintptr(unsafe.Pointer(reserved)), uintptr(unsafe.Pointer(valtype)), uintptr(unsafe.Pointer(buf)), uintptr(unsafe.Pointer(buflen)), 0)
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func regLoadMUIString(key syscall.Handle, name *uint16, buf *uint16, buflen uint32, buflenCopied *uint32, flags uint32, dir *uint16) (regerrno error) {
+	r0, _, _ := syscall.Syscall9(procRegLoadMUIStringW.Addr(), 7, uintptr(key), uintptr(unsafe.Pointer(name)), uintptr(unsafe.Pointer(buf)), uintptr(buflen), uintptr(unsafe.Pointer(buflenCopied)), uintptr(flags), uintptr(unsafe.Pointer(dir)), 0, 0)
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func regSetValueEx(key syscall.Handle, valueName *uint16, reserved uint32, vtype uint32, buf *byte, bufsize uint32) (regerrno error) {
+	r0, _, _ := syscall.Syscall6(procRegSetValueExW.Addr(), 6, uintptr(key), uintptr(unsafe.Pointer(valueName)), uintptr(reserved), uintptr(vtype), uintptr(unsafe.Pointer(buf)), uintptr(bufsize))
+	if r0 != 0 {
+		regerrno = syscall.Errno(r0)
+	}
+	return
+}
+
+func expandEnvironmentStrings(src *uint16, dst *uint16, size uint32) (n uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procExpandEnvironmentStringsW.Addr(), 3, uintptr(unsafe.Pointer(src)), uintptr(unsafe.Pointer(dst)), uintptr(size))
+	n = uint32(r0)
+	if n == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
diff --git a/vendor/golang.org/x/sys/windows/service.go b/vendor/golang.org/x/sys/windows/service.go
index f8deca8397..c964b6848d 100644
--- a/vendor/golang.org/x/sys/windows/service.go
+++ b/vendor/golang.org/x/sys/windows/service.go
@@ -141,6 +141,12 @@ const (
 	SERVICE_DYNAMIC_INFORMATION_LEVEL_START_REASON = 1
 )
 
+type ENUM_SERVICE_STATUS struct {
+	ServiceName   *uint16
+	DisplayName   *uint16
+	ServiceStatus SERVICE_STATUS
+}
+
 type SERVICE_STATUS struct {
 	ServiceType             uint32
 	CurrentState            uint32
@@ -245,3 +251,4 @@ type QUERY_SERVICE_LOCK_STATUS struct {
 //sys	UnsubscribeServiceChangeNotifications(subscription uintptr) = sechost.UnsubscribeServiceChangeNotifications?
 //sys	RegisterServiceCtrlHandlerEx(serviceName *uint16, handlerProc uintptr, context uintptr) (handle Handle, err error) = advapi32.RegisterServiceCtrlHandlerExW
 //sys	QueryServiceDynamicInformation(service Handle, infoLevel uint32, dynamicInfo unsafe.Pointer) (err error) = advapi32.QueryServiceDynamicInformation?
+//sys	EnumDependentServices(service Handle, activityState uint32, services *ENUM_SERVICE_STATUS, buffSize uint32, bytesNeeded *uint32, servicesReturned *uint32) (err error) = advapi32.EnumDependentServicesW
diff --git a/vendor/golang.org/x/sys/windows/setupapi_windows.go b/vendor/golang.org/x/sys/windows/setupapi_windows.go
new file mode 100644
index 0000000000..f8126482fa
--- /dev/null
+++ b/vendor/golang.org/x/sys/windows/setupapi_windows.go
@@ -0,0 +1,1425 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package windows
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"runtime"
+	"strings"
+	"syscall"
+	"unsafe"
+)
+
+// This file contains functions that wrap SetupAPI.dll and CfgMgr32.dll,
+// core system functions for managing hardware devices, drivers, and the PnP tree.
+// Information about these APIs can be found at:
+//     https://docs.microsoft.com/en-us/windows-hardware/drivers/install/setupapi
+//     https://docs.microsoft.com/en-us/windows/win32/devinst/cfgmgr32-
+
+const (
+	ERROR_EXPECTED_SECTION_NAME                  Errno = 0x20000000 | 0xC0000000 | 0
+	ERROR_BAD_SECTION_NAME_LINE                  Errno = 0x20000000 | 0xC0000000 | 1
+	ERROR_SECTION_NAME_TOO_LONG                  Errno = 0x20000000 | 0xC0000000 | 2
+	ERROR_GENERAL_SYNTAX                         Errno = 0x20000000 | 0xC0000000 | 3
+	ERROR_WRONG_INF_STYLE                        Errno = 0x20000000 | 0xC0000000 | 0x100
+	ERROR_SECTION_NOT_FOUND                      Errno = 0x20000000 | 0xC0000000 | 0x101
+	ERROR_LINE_NOT_FOUND                         Errno = 0x20000000 | 0xC0000000 | 0x102
+	ERROR_NO_BACKUP                              Errno = 0x20000000 | 0xC0000000 | 0x103
+	ERROR_NO_ASSOCIATED_CLASS                    Errno = 0x20000000 | 0xC0000000 | 0x200
+	ERROR_CLASS_MISMATCH                         Errno = 0x20000000 | 0xC0000000 | 0x201
+	ERROR_DUPLICATE_FOUND                        Errno = 0x20000000 | 0xC0000000 | 0x202
+	ERROR_NO_DRIVER_SELECTED                     Errno = 0x20000000 | 0xC0000000 | 0x203
+	ERROR_KEY_DOES_NOT_EXIST                     Errno = 0x20000000 | 0xC0000000 | 0x204
+	ERROR_INVALID_DEVINST_NAME                   Errno = 0x20000000 | 0xC0000000 | 0x205
+	ERROR_INVALID_CLASS                          Errno = 0x20000000 | 0xC0000000 | 0x206
+	ERROR_DEVINST_ALREADY_EXISTS                 Errno = 0x20000000 | 0xC0000000 | 0x207
+	ERROR_DEVINFO_NOT_REGISTERED                 Errno = 0x20000000 | 0xC0000000 | 0x208
+	ERROR_INVALID_REG_PROPERTY                   Errno = 0x20000000 | 0xC0000000 | 0x209
+	ERROR_NO_INF                                 Errno = 0x20000000 | 0xC0000000 | 0x20A
+	ERROR_NO_SUCH_DEVINST                        Errno = 0x20000000 | 0xC0000000 | 0x20B
+	ERROR_CANT_LOAD_CLASS_ICON                   Errno = 0x20000000 | 0xC0000000 | 0x20C
+	ERROR_INVALID_CLASS_INSTALLER                Errno = 0x20000000 | 0xC0000000 | 0x20D
+	ERROR_DI_DO_DEFAULT                          Errno = 0x20000000 | 0xC0000000 | 0x20E
+	ERROR_DI_NOFILECOPY                          Errno = 0x20000000 | 0xC0000000 | 0x20F
+	ERROR_INVALID_HWPROFILE                      Errno = 0x20000000 | 0xC0000000 | 0x210
+	ERROR_NO_DEVICE_SELECTED                     Errno = 0x20000000 | 0xC0000000 | 0x211
+	ERROR_DEVINFO_LIST_LOCKED                    Errno = 0x20000000 | 0xC0000000 | 0x212
+	ERROR_DEVINFO_DATA_LOCKED                    Errno = 0x20000000 | 0xC0000000 | 0x213
+	ERROR_DI_BAD_PATH                            Errno = 0x20000000 | 0xC0000000 | 0x214
+	ERROR_NO_CLASSINSTALL_PARAMS                 Errno = 0x20000000 | 0xC0000000 | 0x215
+	ERROR_FILEQUEUE_LOCKED                       Errno = 0x20000000 | 0xC0000000 | 0x216
+	ERROR_BAD_SERVICE_INSTALLSECT                Errno = 0x20000000 | 0xC0000000 | 0x217
+	ERROR_NO_CLASS_DRIVER_LIST                   Errno = 0x20000000 | 0xC0000000 | 0x218
+	ERROR_NO_ASSOCIATED_SERVICE                  Errno = 0x20000000 | 0xC0000000 | 0x219
+	ERROR_NO_DEFAULT_DEVICE_INTERFACE            Errno = 0x20000000 | 0xC0000000 | 0x21A
+	ERROR_DEVICE_INTERFACE_ACTIVE                Errno = 0x20000000 | 0xC0000000 | 0x21B
+	ERROR_DEVICE_INTERFACE_REMOVED               Errno = 0x20000000 | 0xC0000000 | 0x21C
+	ERROR_BAD_INTERFACE_INSTALLSECT              Errno = 0x20000000 | 0xC0000000 | 0x21D
+	ERROR_NO_SUCH_INTERFACE_CLASS                Errno = 0x20000000 | 0xC0000000 | 0x21E
+	ERROR_INVALID_REFERENCE_STRING               Errno = 0x20000000 | 0xC0000000 | 0x21F
+	ERROR_INVALID_MACHINENAME                    Errno = 0x20000000 | 0xC0000000 | 0x220
+	ERROR_REMOTE_COMM_FAILURE                    Errno = 0x20000000 | 0xC0000000 | 0x221
+	ERROR_MACHINE_UNAVAILABLE                    Errno = 0x20000000 | 0xC0000000 | 0x222
+	ERROR_NO_CONFIGMGR_SERVICES                  Errno = 0x20000000 | 0xC0000000 | 0x223
+	ERROR_INVALID_PROPPAGE_PROVIDER              Errno = 0x20000000 | 0xC0000000 | 0x224
+	ERROR_NO_SUCH_DEVICE_INTERFACE               Errno = 0x20000000 | 0xC0000000 | 0x225
+	ERROR_DI_POSTPROCESSING_REQUIRED             Errno = 0x20000000 | 0xC0000000 | 0x226
+	ERROR_INVALID_COINSTALLER                    Errno = 0x20000000 | 0xC0000000 | 0x227
+	ERROR_NO_COMPAT_DRIVERS                      Errno = 0x20000000 | 0xC0000000 | 0x228
+	ERROR_NO_DEVICE_ICON                         Errno = 0x20000000 | 0xC0000000 | 0x229
+	ERROR_INVALID_INF_LOGCONFIG                  Errno = 0x20000000 | 0xC0000000 | 0x22A
+	ERROR_DI_DONT_INSTALL                        Errno = 0x20000000 | 0xC0000000 | 0x22B
+	ERROR_INVALID_FILTER_DRIVER                  Errno = 0x20000000 | 0xC0000000 | 0x22C
+	ERROR_NON_WINDOWS_NT_DRIVER                  Errno = 0x20000000 | 0xC0000000 | 0x22D
+	ERROR_NON_WINDOWS_DRIVER                     Errno = 0x20000000 | 0xC0000000 | 0x22E
+	ERROR_NO_CATALOG_FOR_OEM_INF                 Errno = 0x20000000 | 0xC0000000 | 0x22F
+	ERROR_DEVINSTALL_QUEUE_NONNATIVE             Errno = 0x20000000 | 0xC0000000 | 0x230
+	ERROR_NOT_DISABLEABLE                        Errno = 0x20000000 | 0xC0000000 | 0x231
+	ERROR_CANT_REMOVE_DEVINST                    Errno = 0x20000000 | 0xC0000000 | 0x232
+	ERROR_INVALID_TARGET                         Errno = 0x20000000 | 0xC0000000 | 0x233
+	ERROR_DRIVER_NONNATIVE                       Errno = 0x20000000 | 0xC0000000 | 0x234
+	ERROR_IN_WOW64                               Errno = 0x20000000 | 0xC0000000 | 0x235
+	ERROR_SET_SYSTEM_RESTORE_POINT               Errno = 0x20000000 | 0xC0000000 | 0x236
+	ERROR_SCE_DISABLED                           Errno = 0x20000000 | 0xC0000000 | 0x238
+	ERROR_UNKNOWN_EXCEPTION                      Errno = 0x20000000 | 0xC0000000 | 0x239
+	ERROR_PNP_REGISTRY_ERROR                     Errno = 0x20000000 | 0xC0000000 | 0x23A
+	ERROR_REMOTE_REQUEST_UNSUPPORTED             Errno = 0x20000000 | 0xC0000000 | 0x23B
+	ERROR_NOT_AN_INSTALLED_OEM_INF               Errno = 0x20000000 | 0xC0000000 | 0x23C
+	ERROR_INF_IN_USE_BY_DEVICES                  Errno = 0x20000000 | 0xC0000000 | 0x23D
+	ERROR_DI_FUNCTION_OBSOLETE                   Errno = 0x20000000 | 0xC0000000 | 0x23E
+	ERROR_NO_AUTHENTICODE_CATALOG                Errno = 0x20000000 | 0xC0000000 | 0x23F
+	ERROR_AUTHENTICODE_DISALLOWED                Errno = 0x20000000 | 0xC0000000 | 0x240
+	ERROR_AUTHENTICODE_TRUSTED_PUBLISHER         Errno = 0x20000000 | 0xC0000000 | 0x241
+	ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED     Errno = 0x20000000 | 0xC0000000 | 0x242
+	ERROR_AUTHENTICODE_PUBLISHER_NOT_TRUSTED     Errno = 0x20000000 | 0xC0000000 | 0x243
+	ERROR_SIGNATURE_OSATTRIBUTE_MISMATCH         Errno = 0x20000000 | 0xC0000000 | 0x244
+	ERROR_ONLY_VALIDATE_VIA_AUTHENTICODE         Errno = 0x20000000 | 0xC0000000 | 0x245
+	ERROR_DEVICE_INSTALLER_NOT_READY             Errno = 0x20000000 | 0xC0000000 | 0x246
+	ERROR_DRIVER_STORE_ADD_FAILED                Errno = 0x20000000 | 0xC0000000 | 0x247
+	ERROR_DEVICE_INSTALL_BLOCKED                 Errno = 0x20000000 | 0xC0000000 | 0x248
+	ERROR_DRIVER_INSTALL_BLOCKED                 Errno = 0x20000000 | 0xC0000000 | 0x249
+	ERROR_WRONG_INF_TYPE                         Errno = 0x20000000 | 0xC0000000 | 0x24A
+	ERROR_FILE_HASH_NOT_IN_CATALOG               Errno = 0x20000000 | 0xC0000000 | 0x24B
+	ERROR_DRIVER_STORE_DELETE_FAILED             Errno = 0x20000000 | 0xC0000000 | 0x24C
+	ERROR_UNRECOVERABLE_STACK_OVERFLOW           Errno = 0x20000000 | 0xC0000000 | 0x300
+	EXCEPTION_SPAPI_UNRECOVERABLE_STACK_OVERFLOW Errno = ERROR_UNRECOVERABLE_STACK_OVERFLOW
+	ERROR_NO_DEFAULT_INTERFACE_DEVICE            Errno = ERROR_NO_DEFAULT_DEVICE_INTERFACE
+	ERROR_INTERFACE_DEVICE_ACTIVE                Errno = ERROR_DEVICE_INTERFACE_ACTIVE
+	ERROR_INTERFACE_DEVICE_REMOVED               Errno = ERROR_DEVICE_INTERFACE_REMOVED
+	ERROR_NO_SUCH_INTERFACE_DEVICE               Errno = ERROR_NO_SUCH_DEVICE_INTERFACE
+)
+
+const (
+	MAX_DEVICE_ID_LEN   = 200
+	MAX_DEVNODE_ID_LEN  = MAX_DEVICE_ID_LEN
+	MAX_GUID_STRING_LEN = 39 // 38 chars + terminator null
+	MAX_CLASS_NAME_LEN  = 32
+	MAX_PROFILE_LEN     = 80
+	MAX_CONFIG_VALUE    = 9999
+	MAX_INSTANCE_VALUE  = 9999
+	CONFIGMG_VERSION    = 0x0400
+)
+
+// Maximum string length constants
+const (
+	LINE_LEN                    = 256  // Windows 9x-compatible maximum for displayable strings coming from a device INF.
+	MAX_INF_STRING_LENGTH       = 4096 // Actual maximum size of an INF string (including string substitutions).
+	MAX_INF_SECTION_NAME_LENGTH = 255  // For Windows 9x compatibility, INF section names should be constrained to 32 characters.
+	MAX_TITLE_LEN               = 60
+	MAX_INSTRUCTION_LEN         = 256
+	MAX_LABEL_LEN               = 30
+	MAX_SERVICE_NAME_LEN        = 256
+	MAX_SUBTITLE_LEN            = 256
+)
+
+const (
+	// SP_MAX_MACHINENAME_LENGTH defines maximum length of a machine name in the format expected by ConfigMgr32 CM_Connect_Machine (i.e., "\\\\MachineName\0").
+	SP_MAX_MACHINENAME_LENGTH = MAX_PATH + 3
+)
+
+// HSPFILEQ is type for setup file queue
+type HSPFILEQ uintptr
+
+// DevInfo holds reference to device information set
+type DevInfo Handle
+
+// DEVINST is a handle usually recognized by cfgmgr32 APIs
+type DEVINST uint32
+
+// DevInfoData is a device information structure (references a device instance that is a member of a device information set)
+type DevInfoData struct {
+	size      uint32
+	ClassGUID GUID
+	DevInst   DEVINST
+	_         uintptr
+}
+
+// DevInfoListDetailData is a structure for detailed information on a device information set (used for SetupDiGetDeviceInfoListDetail which supersedes the functionality of SetupDiGetDeviceInfoListClass).
+type DevInfoListDetailData struct {
+	size                uint32 // Use unsafeSizeOf method
+	ClassGUID           GUID
+	RemoteMachineHandle Handle
+	remoteMachineName   [SP_MAX_MACHINENAME_LENGTH]uint16
+}
+
+func (*DevInfoListDetailData) unsafeSizeOf() uint32 {
+	if unsafe.Sizeof(uintptr(0)) == 4 {
+		// Windows declares this with pshpack1.h
+		return uint32(unsafe.Offsetof(DevInfoListDetailData{}.remoteMachineName) + unsafe.Sizeof(DevInfoListDetailData{}.remoteMachineName))
+	}
+	return uint32(unsafe.Sizeof(DevInfoListDetailData{}))
+}
+
+func (data *DevInfoListDetailData) RemoteMachineName() string {
+	return UTF16ToString(data.remoteMachineName[:])
+}
+
+func (data *DevInfoListDetailData) SetRemoteMachineName(remoteMachineName string) error {
+	str, err := UTF16FromString(remoteMachineName)
+	if err != nil {
+		return err
+	}
+	copy(data.remoteMachineName[:], str)
+	return nil
+}
+
+// DI_FUNCTION is function type for device installer
+type DI_FUNCTION uint32
+
+const (
+	DIF_SELECTDEVICE                   DI_FUNCTION = 0x00000001
+	DIF_INSTALLDEVICE                  DI_FUNCTION = 0x00000002
+	DIF_ASSIGNRESOURCES                DI_FUNCTION = 0x00000003
+	DIF_PROPERTIES                     DI_FUNCTION = 0x00000004
+	DIF_REMOVE                         DI_FUNCTION = 0x00000005
+	DIF_FIRSTTIMESETUP                 DI_FUNCTION = 0x00000006
+	DIF_FOUNDDEVICE                    DI_FUNCTION = 0x00000007
+	DIF_SELECTCLASSDRIVERS             DI_FUNCTION = 0x00000008
+	DIF_VALIDATECLASSDRIVERS           DI_FUNCTION = 0x00000009
+	DIF_INSTALLCLASSDRIVERS            DI_FUNCTION = 0x0000000A
+	DIF_CALCDISKSPACE                  DI_FUNCTION = 0x0000000B
+	DIF_DESTROYPRIVATEDATA             DI_FUNCTION = 0x0000000C
+	DIF_VALIDATEDRIVER                 DI_FUNCTION = 0x0000000D
+	DIF_DETECT                         DI_FUNCTION = 0x0000000F
+	DIF_INSTALLWIZARD                  DI_FUNCTION = 0x00000010
+	DIF_DESTROYWIZARDDATA              DI_FUNCTION = 0x00000011
+	DIF_PROPERTYCHANGE                 DI_FUNCTION = 0x00000012
+	DIF_ENABLECLASS                    DI_FUNCTION = 0x00000013
+	DIF_DETECTVERIFY                   DI_FUNCTION = 0x00000014
+	DIF_INSTALLDEVICEFILES             DI_FUNCTION = 0x00000015
+	DIF_UNREMOVE                       DI_FUNCTION = 0x00000016
+	DIF_SELECTBESTCOMPATDRV            DI_FUNCTION = 0x00000017
+	DIF_ALLOW_INSTALL                  DI_FUNCTION = 0x00000018
+	DIF_REGISTERDEVICE                 DI_FUNCTION = 0x00000019
+	DIF_NEWDEVICEWIZARD_PRESELECT      DI_FUNCTION = 0x0000001A
+	DIF_NEWDEVICEWIZARD_SELECT         DI_FUNCTION = 0x0000001B
+	DIF_NEWDEVICEWIZARD_PREANALYZE     DI_FUNCTION = 0x0000001C
+	DIF_NEWDEVICEWIZARD_POSTANALYZE    DI_FUNCTION = 0x0000001D
+	DIF_NEWDEVICEWIZARD_FINISHINSTALL  DI_FUNCTION = 0x0000001E
+	DIF_INSTALLINTERFACES              DI_FUNCTION = 0x00000020
+	DIF_DETECTCANCEL                   DI_FUNCTION = 0x00000021
+	DIF_REGISTER_COINSTALLERS          DI_FUNCTION = 0x00000022
+	DIF_ADDPROPERTYPAGE_ADVANCED       DI_FUNCTION = 0x00000023
+	DIF_ADDPROPERTYPAGE_BASIC          DI_FUNCTION = 0x00000024
+	DIF_TROUBLESHOOTER                 DI_FUNCTION = 0x00000026
+	DIF_POWERMESSAGEWAKE               DI_FUNCTION = 0x00000027
+	DIF_ADDREMOTEPROPERTYPAGE_ADVANCED DI_FUNCTION = 0x00000028
+	DIF_UPDATEDRIVER_UI                DI_FUNCTION = 0x00000029
+	DIF_FINISHINSTALL_ACTION           DI_FUNCTION = 0x0000002A
+)
+
+// DevInstallParams is device installation parameters structure (associated with a particular device information element, or globally with a device information set)
+type DevInstallParams struct {
+	size                     uint32
+	Flags                    DI_FLAGS
+	FlagsEx                  DI_FLAGSEX
+	hwndParent               uintptr
+	InstallMsgHandler        uintptr
+	InstallMsgHandlerContext uintptr
+	FileQueue                HSPFILEQ
+	_                        uintptr
+	_                        uint32
+	driverPath               [MAX_PATH]uint16
+}
+
+func (params *DevInstallParams) DriverPath() string {
+	return UTF16ToString(params.driverPath[:])
+}
+
+func (params *DevInstallParams) SetDriverPath(driverPath string) error {
+	str, err := UTF16FromString(driverPath)
+	if err != nil {
+		return err
+	}
+	copy(params.driverPath[:], str)
+	return nil
+}
+
+// DI_FLAGS is SP_DEVINSTALL_PARAMS.Flags values
+type DI_FLAGS uint32
+
+const (
+	// Flags for choosing a device
+	DI_SHOWOEM       DI_FLAGS = 0x00000001 // support Other... button
+	DI_SHOWCOMPAT    DI_FLAGS = 0x00000002 // show compatibility list
+	DI_SHOWCLASS     DI_FLAGS = 0x00000004 // show class list
+	DI_SHOWALL       DI_FLAGS = 0x00000007 // both class & compat list shown
+	DI_NOVCP         DI_FLAGS = 0x00000008 // don't create a new copy queue--use caller-supplied FileQueue
+	DI_DIDCOMPAT     DI_FLAGS = 0x00000010 // Searched for compatible devices
+	DI_DIDCLASS      DI_FLAGS = 0x00000020 // Searched for class devices
+	DI_AUTOASSIGNRES DI_FLAGS = 0x00000040 // No UI for resources if possible
+
+	// Flags returned by DiInstallDevice to indicate need to reboot/restart
+	DI_NEEDRESTART DI_FLAGS = 0x00000080 // Reboot required to take effect
+	DI_NEEDREBOOT  DI_FLAGS = 0x00000100 // ""
+
+	// Flags for device installation
+	DI_NOBROWSE DI_FLAGS = 0x00000200 // no Browse... in InsertDisk
+
+	// Flags set by DiBuildDriverInfoList
+	DI_MULTMFGS DI_FLAGS = 0x00000400 // Set if multiple manufacturers in class driver list
+
+	// Flag indicates that device is disabled
+	DI_DISABLED DI_FLAGS = 0x00000800 // Set if device disabled
+
+	// Flags for Device/Class Properties
+	DI_GENERALPAGE_ADDED  DI_FLAGS = 0x00001000
+	DI_RESOURCEPAGE_ADDED DI_FLAGS = 0x00002000
+
+	// Flag to indicate the setting properties for this Device (or class) caused a change so the Dev Mgr UI probably needs to be updated.
+	DI_PROPERTIES_CHANGE DI_FLAGS = 0x00004000
+
+	// Flag to indicate that the sorting from the INF file should be used.
+	DI_INF_IS_SORTED DI_FLAGS = 0x00008000
+
+	// Flag to indicate that only the INF specified by SP_DEVINSTALL_PARAMS.DriverPath should be searched.
+	DI_ENUMSINGLEINF DI_FLAGS = 0x00010000
+
+	// Flag that prevents ConfigMgr from removing/re-enumerating devices during device
+	// registration, installation, and deletion.
+	DI_DONOTCALLCONFIGMG DI_FLAGS = 0x00020000
+
+	// The following flag can be used to install a device disabled
+	DI_INSTALLDISABLED DI_FLAGS = 0x00040000
+
+	// Flag that causes SetupDiBuildDriverInfoList to build a device's compatible driver
+	// list from its existing class driver list, instead of the normal INF search.
+	DI_COMPAT_FROM_CLASS DI_FLAGS = 0x00080000
+
+	// This flag is set if the Class Install params should be used.
+	DI_CLASSINSTALLPARAMS DI_FLAGS = 0x00100000
+
+	// This flag is set if the caller of DiCallClassInstaller does NOT want the internal default action performed if the Class installer returns ERROR_DI_DO_DEFAULT.
+	DI_NODI_DEFAULTACTION DI_FLAGS = 0x00200000
+
+	// Flags for device installation
+	DI_QUIETINSTALL        DI_FLAGS = 0x00800000 // don't confuse the user with questions or excess info
+	DI_NOFILECOPY          DI_FLAGS = 0x01000000 // No file Copy necessary
+	DI_FORCECOPY           DI_FLAGS = 0x02000000 // Force files to be copied from install path
+	DI_DRIVERPAGE_ADDED    DI_FLAGS = 0x04000000 // Prop provider added Driver page.
+	DI_USECI_SELECTSTRINGS DI_FLAGS = 0x08000000 // Use Class Installer Provided strings in the Select Device Dlg
+	DI_OVERRIDE_INFFLAGS   DI_FLAGS = 0x10000000 // Override INF flags
+	DI_PROPS_NOCHANGEUSAGE DI_FLAGS = 0x20000000 // No Enable/Disable in General Props
+
+	DI_NOSELECTICONS DI_FLAGS = 0x40000000 // No small icons in select device dialogs
+
+	DI_NOWRITE_IDS DI_FLAGS = 0x80000000 // Don't write HW & Compat IDs on install
+)
+
+// DI_FLAGSEX is SP_DEVINSTALL_PARAMS.FlagsEx values
+type DI_FLAGSEX uint32
+
+const (
+	DI_FLAGSEX_CI_FAILED                DI_FLAGSEX = 0x00000004 // Failed to Load/Call class installer
+	DI_FLAGSEX_FINISHINSTALL_ACTION     DI_FLAGSEX = 0x00000008 // Class/co-installer wants to get a DIF_FINISH_INSTALL action in client context.
+	DI_FLAGSEX_DIDINFOLIST              DI_FLAGSEX = 0x00000010 // Did the Class Info List
+	DI_FLAGSEX_DIDCOMPATINFO            DI_FLAGSEX = 0x00000020 // Did the Compat Info List
+	DI_FLAGSEX_FILTERCLASSES            DI_FLAGSEX = 0x00000040
+	DI_FLAGSEX_SETFAILEDINSTALL         DI_FLAGSEX = 0x00000080
+	DI_FLAGSEX_DEVICECHANGE             DI_FLAGSEX = 0x00000100
+	DI_FLAGSEX_ALWAYSWRITEIDS           DI_FLAGSEX = 0x00000200
+	DI_FLAGSEX_PROPCHANGE_PENDING       DI_FLAGSEX = 0x00000400 // One or more device property sheets have had changes made to them, and need to have a DIF_PROPERTYCHANGE occur.
+	DI_FLAGSEX_ALLOWEXCLUDEDDRVS        DI_FLAGSEX = 0x00000800
+	DI_FLAGSEX_NOUIONQUERYREMOVE        DI_FLAGSEX = 0x00001000
+	DI_FLAGSEX_USECLASSFORCOMPAT        DI_FLAGSEX = 0x00002000 // Use the device's class when building compat drv list. (Ignored if DI_COMPAT_FROM_CLASS flag is specified.)
+	DI_FLAGSEX_NO_DRVREG_MODIFY         DI_FLAGSEX = 0x00008000 // Don't run AddReg and DelReg for device's software (driver) key.
+	DI_FLAGSEX_IN_SYSTEM_SETUP          DI_FLAGSEX = 0x00010000 // Installation is occurring during initial system setup.
+	DI_FLAGSEX_INET_DRIVER              DI_FLAGSEX = 0x00020000 // Driver came from Windows Update
+	DI_FLAGSEX_APPENDDRIVERLIST         DI_FLAGSEX = 0x00040000 // Cause SetupDiBuildDriverInfoList to append a new driver list to an existing list.
+	DI_FLAGSEX_PREINSTALLBACKUP         DI_FLAGSEX = 0x00080000 // not used
+	DI_FLAGSEX_BACKUPONREPLACE          DI_FLAGSEX = 0x00100000 // not used
+	DI_FLAGSEX_DRIVERLIST_FROM_URL      DI_FLAGSEX = 0x00200000 // build driver list from INF(s) retrieved from URL specified in SP_DEVINSTALL_PARAMS.DriverPath (empty string means Windows Update website)
+	DI_FLAGSEX_EXCLUDE_OLD_INET_DRIVERS DI_FLAGSEX = 0x00800000 // Don't include old Internet drivers when building a driver list. Ignored on Windows Vista and later.
+	DI_FLAGSEX_POWERPAGE_ADDED          DI_FLAGSEX = 0x01000000 // class installer added their own power page
+	DI_FLAGSEX_FILTERSIMILARDRIVERS     DI_FLAGSEX = 0x02000000 // only include similar drivers in class list
+	DI_FLAGSEX_INSTALLEDDRIVER          DI_FLAGSEX = 0x04000000 // only add the installed driver to the class or compat driver list.  Used in calls to SetupDiBuildDriverInfoList
+	DI_FLAGSEX_NO_CLASSLIST_NODE_MERGE  DI_FLAGSEX = 0x08000000 // Don't remove identical driver nodes from the class list
+	DI_FLAGSEX_ALTPLATFORM_DRVSEARCH    DI_FLAGSEX = 0x10000000 // Build driver list based on alternate platform information specified in associated file queue
+	DI_FLAGSEX_RESTART_DEVICE_ONLY      DI_FLAGSEX = 0x20000000 // only restart the device drivers are being installed on as opposed to restarting all devices using those drivers.
+	DI_FLAGSEX_RECURSIVESEARCH          DI_FLAGSEX = 0x40000000 // Tell SetupDiBuildDriverInfoList to do a recursive search
+	DI_FLAGSEX_SEARCH_PUBLISHED_INFS    DI_FLAGSEX = 0x80000000 // Tell SetupDiBuildDriverInfoList to do a "published INF" search
+)
+
+// ClassInstallHeader is the first member of any class install parameters structure. It contains the device installation request code that defines the format of the rest of the install parameters structure.
+type ClassInstallHeader struct {
+	size            uint32
+	InstallFunction DI_FUNCTION
+}
+
+func MakeClassInstallHeader(installFunction DI_FUNCTION) *ClassInstallHeader {
+	hdr := &ClassInstallHeader{InstallFunction: installFunction}
+	hdr.size = uint32(unsafe.Sizeof(*hdr))
+	return hdr
+}
+
+// DICS_STATE specifies values indicating a change in a device's state
+type DICS_STATE uint32
+
+const (
+	DICS_ENABLE     DICS_STATE = 0x00000001 // The device is being enabled.
+	DICS_DISABLE    DICS_STATE = 0x00000002 // The device is being disabled.
+	DICS_PROPCHANGE DICS_STATE = 0x00000003 // The properties of the device have changed.
+	DICS_START      DICS_STATE = 0x00000004 // The device is being started (if the request is for the currently active hardware profile).
+	DICS_STOP       DICS_STATE = 0x00000005 // The device is being stopped. The driver stack will be unloaded and the CSCONFIGFLAG_DO_NOT_START flag will be set for the device.
+)
+
+// DICS_FLAG specifies the scope of a device property change
+type DICS_FLAG uint32
+
+const (
+	DICS_FLAG_GLOBAL         DICS_FLAG = 0x00000001 // make change in all hardware profiles
+	DICS_FLAG_CONFIGSPECIFIC DICS_FLAG = 0x00000002 // make change in specified profile only
+	DICS_FLAG_CONFIGGENERAL  DICS_FLAG = 0x00000004 // 1 or more hardware profile-specific changes to follow (obsolete)
+)
+
+// PropChangeParams is a structure corresponding to a DIF_PROPERTYCHANGE install function.
+type PropChangeParams struct {
+	ClassInstallHeader ClassInstallHeader
+	StateChange        DICS_STATE
+	Scope              DICS_FLAG
+	HwProfile          uint32
+}
+
+// DI_REMOVEDEVICE specifies the scope of the device removal
+type DI_REMOVEDEVICE uint32
+
+const (
+	DI_REMOVEDEVICE_GLOBAL         DI_REMOVEDEVICE = 0x00000001 // Make this change in all hardware profiles. Remove information about the device from the registry.
+	DI_REMOVEDEVICE_CONFIGSPECIFIC DI_REMOVEDEVICE = 0x00000002 // Make this change to only the hardware profile specified by HwProfile. this flag only applies to root-enumerated devices. When Windows removes the device from the last hardware profile in which it was configured, Windows performs a global removal.
+)
+
+// RemoveDeviceParams is a structure corresponding to a DIF_REMOVE install function.
+type RemoveDeviceParams struct {
+	ClassInstallHeader ClassInstallHeader
+	Scope              DI_REMOVEDEVICE
+	HwProfile          uint32
+}
+
+// DrvInfoData is driver information structure (member of a driver info list that may be associated with a particular device instance, or (globally) with a device information set)
+type DrvInfoData struct {
+	size          uint32
+	DriverType    uint32
+	_             uintptr
+	description   [LINE_LEN]uint16
+	mfgName       [LINE_LEN]uint16
+	providerName  [LINE_LEN]uint16
+	DriverDate    Filetime
+	DriverVersion uint64
+}
+
+func (data *DrvInfoData) Description() string {
+	return UTF16ToString(data.description[:])
+}
+
+func (data *DrvInfoData) SetDescription(description string) error {
+	str, err := UTF16FromString(description)
+	if err != nil {
+		return err
+	}
+	copy(data.description[:], str)
+	return nil
+}
+
+func (data *DrvInfoData) MfgName() string {
+	return UTF16ToString(data.mfgName[:])
+}
+
+func (data *DrvInfoData) SetMfgName(mfgName string) error {
+	str, err := UTF16FromString(mfgName)
+	if err != nil {
+		return err
+	}
+	copy(data.mfgName[:], str)
+	return nil
+}
+
+func (data *DrvInfoData) ProviderName() string {
+	return UTF16ToString(data.providerName[:])
+}
+
+func (data *DrvInfoData) SetProviderName(providerName string) error {
+	str, err := UTF16FromString(providerName)
+	if err != nil {
+		return err
+	}
+	copy(data.providerName[:], str)
+	return nil
+}
+
+// IsNewer method returns true if DrvInfoData date and version is newer than supplied parameters.
+func (data *DrvInfoData) IsNewer(driverDate Filetime, driverVersion uint64) bool {
+	if data.DriverDate.HighDateTime > driverDate.HighDateTime {
+		return true
+	}
+	if data.DriverDate.HighDateTime < driverDate.HighDateTime {
+		return false
+	}
+
+	if data.DriverDate.LowDateTime > driverDate.LowDateTime {
+		return true
+	}
+	if data.DriverDate.LowDateTime < driverDate.LowDateTime {
+		return false
+	}
+
+	if data.DriverVersion > driverVersion {
+		return true
+	}
+	if data.DriverVersion < driverVersion {
+		return false
+	}
+
+	return false
+}
+
+// DrvInfoDetailData is driver information details structure (provides detailed information about a particular driver information structure)
+type DrvInfoDetailData struct {
+	size            uint32 // Use unsafeSizeOf method
+	InfDate         Filetime
+	compatIDsOffset uint32
+	compatIDsLength uint32
+	_               uintptr
+	sectionName     [LINE_LEN]uint16
+	infFileName     [MAX_PATH]uint16
+	drvDescription  [LINE_LEN]uint16
+	hardwareID      [1]uint16
+}
+
+func (*DrvInfoDetailData) unsafeSizeOf() uint32 {
+	if unsafe.Sizeof(uintptr(0)) == 4 {
+		// Windows declares this with pshpack1.h
+		return uint32(unsafe.Offsetof(DrvInfoDetailData{}.hardwareID) + unsafe.Sizeof(DrvInfoDetailData{}.hardwareID))
+	}
+	return uint32(unsafe.Sizeof(DrvInfoDetailData{}))
+}
+
+func (data *DrvInfoDetailData) SectionName() string {
+	return UTF16ToString(data.sectionName[:])
+}
+
+func (data *DrvInfoDetailData) InfFileName() string {
+	return UTF16ToString(data.infFileName[:])
+}
+
+func (data *DrvInfoDetailData) DrvDescription() string {
+	return UTF16ToString(data.drvDescription[:])
+}
+
+func (data *DrvInfoDetailData) HardwareID() string {
+	if data.compatIDsOffset > 1 {
+		bufW := data.getBuf()
+		return UTF16ToString(bufW[:wcslen(bufW)])
+	}
+
+	return ""
+}
+
+func (data *DrvInfoDetailData) CompatIDs() []string {
+	a := make([]string, 0)
+
+	if data.compatIDsLength > 0 {
+		bufW := data.getBuf()
+		bufW = bufW[data.compatIDsOffset : data.compatIDsOffset+data.compatIDsLength]
+		for i := 0; i < len(bufW); {
+			j := i + wcslen(bufW[i:])
+			if i < j {
+				a = append(a, UTF16ToString(bufW[i:j]))
+			}
+			i = j + 1
+		}
+	}
+
+	return a
+}
+
+func (data *DrvInfoDetailData) getBuf() []uint16 {
+	len := (data.size - uint32(unsafe.Offsetof(data.hardwareID))) / 2
+	sl := struct {
+		addr *uint16
+		len  int
+		cap  int
+	}{&data.hardwareID[0], int(len), int(len)}
+	return *(*[]uint16)(unsafe.Pointer(&sl))
+}
+
+// IsCompatible method tests if given hardware ID matches the driver or is listed on the compatible ID list.
+func (data *DrvInfoDetailData) IsCompatible(hwid string) bool {
+	hwidLC := strings.ToLower(hwid)
+	if strings.ToLower(data.HardwareID()) == hwidLC {
+		return true
+	}
+	a := data.CompatIDs()
+	for i := range a {
+		if strings.ToLower(a[i]) == hwidLC {
+			return true
+		}
+	}
+
+	return false
+}
+
+// DICD flags control SetupDiCreateDeviceInfo
+type DICD uint32
+
+const (
+	DICD_GENERATE_ID       DICD = 0x00000001
+	DICD_INHERIT_CLASSDRVS DICD = 0x00000002
+)
+
+// SUOI flags control SetupUninstallOEMInf
+type SUOI uint32
+
+const (
+	SUOI_FORCEDELETE SUOI = 0x0001
+)
+
+// SPDIT flags to distinguish between class drivers and
+// device drivers. (Passed in 'DriverType' parameter of
+// driver information list APIs)
+type SPDIT uint32
+
+const (
+	SPDIT_NODRIVER     SPDIT = 0x00000000
+	SPDIT_CLASSDRIVER  SPDIT = 0x00000001
+	SPDIT_COMPATDRIVER SPDIT = 0x00000002
+)
+
+// DIGCF flags control what is included in the device information set built by SetupDiGetClassDevs
+type DIGCF uint32
+
+const (
+	DIGCF_DEFAULT         DIGCF = 0x00000001 // only valid with DIGCF_DEVICEINTERFACE
+	DIGCF_PRESENT         DIGCF = 0x00000002
+	DIGCF_ALLCLASSES      DIGCF = 0x00000004
+	DIGCF_PROFILE         DIGCF = 0x00000008
+	DIGCF_DEVICEINTERFACE DIGCF = 0x00000010
+)
+
+// DIREG specifies values for SetupDiCreateDevRegKey, SetupDiOpenDevRegKey, and SetupDiDeleteDevRegKey.
+type DIREG uint32
+
+const (
+	DIREG_DEV  DIREG = 0x00000001 // Open/Create/Delete device key
+	DIREG_DRV  DIREG = 0x00000002 // Open/Create/Delete driver key
+	DIREG_BOTH DIREG = 0x00000004 // Delete both driver and Device key
+)
+
+// SPDRP specifies device registry property codes
+// (Codes marked as read-only (R) may only be used for
+// SetupDiGetDeviceRegistryProperty)
+//
+// These values should cover the same set of registry properties
+// as defined by the CM_DRP codes in cfgmgr32.h.
+//
+// Note that SPDRP codes are zero based while CM_DRP codes are one based!
+type SPDRP uint32
+
+const (
+	SPDRP_DEVICEDESC                  SPDRP = 0x00000000 // DeviceDesc (R/W)
+	SPDRP_HARDWAREID                  SPDRP = 0x00000001 // HardwareID (R/W)
+	SPDRP_COMPATIBLEIDS               SPDRP = 0x00000002 // CompatibleIDs (R/W)
+	SPDRP_SERVICE                     SPDRP = 0x00000004 // Service (R/W)
+	SPDRP_CLASS                       SPDRP = 0x00000007 // Class (R--tied to ClassGUID)
+	SPDRP_CLASSGUID                   SPDRP = 0x00000008 // ClassGUID (R/W)
+	SPDRP_DRIVER                      SPDRP = 0x00000009 // Driver (R/W)
+	SPDRP_CONFIGFLAGS                 SPDRP = 0x0000000A // ConfigFlags (R/W)
+	SPDRP_MFG                         SPDRP = 0x0000000B // Mfg (R/W)
+	SPDRP_FRIENDLYNAME                SPDRP = 0x0000000C // FriendlyName (R/W)
+	SPDRP_LOCATION_INFORMATION        SPDRP = 0x0000000D // LocationInformation (R/W)
+	SPDRP_PHYSICAL_DEVICE_OBJECT_NAME SPDRP = 0x0000000E // PhysicalDeviceObjectName (R)
+	SPDRP_CAPABILITIES                SPDRP = 0x0000000F // Capabilities (R)
+	SPDRP_UI_NUMBER                   SPDRP = 0x00000010 // UiNumber (R)
+	SPDRP_UPPERFILTERS                SPDRP = 0x00000011 // UpperFilters (R/W)
+	SPDRP_LOWERFILTERS                SPDRP = 0x00000012 // LowerFilters (R/W)
+	SPDRP_BUSTYPEGUID                 SPDRP = 0x00000013 // BusTypeGUID (R)
+	SPDRP_LEGACYBUSTYPE               SPDRP = 0x00000014 // LegacyBusType (R)
+	SPDRP_BUSNUMBER                   SPDRP = 0x00000015 // BusNumber (R)
+	SPDRP_ENUMERATOR_NAME             SPDRP = 0x00000016 // Enumerator Name (R)
+	SPDRP_SECURITY                    SPDRP = 0x00000017 // Security (R/W, binary form)
+	SPDRP_SECURITY_SDS                SPDRP = 0x00000018 // Security (W, SDS form)
+	SPDRP_DEVTYPE                     SPDRP = 0x00000019 // Device Type (R/W)
+	SPDRP_EXCLUSIVE                   SPDRP = 0x0000001A // Device is exclusive-access (R/W)
+	SPDRP_CHARACTERISTICS             SPDRP = 0x0000001B // Device Characteristics (R/W)
+	SPDRP_ADDRESS                     SPDRP = 0x0000001C // Device Address (R)
+	SPDRP_UI_NUMBER_DESC_FORMAT       SPDRP = 0x0000001D // UiNumberDescFormat (R/W)
+	SPDRP_DEVICE_POWER_DATA           SPDRP = 0x0000001E // Device Power Data (R)
+	SPDRP_REMOVAL_POLICY              SPDRP = 0x0000001F // Removal Policy (R)
+	SPDRP_REMOVAL_POLICY_HW_DEFAULT   SPDRP = 0x00000020 // Hardware Removal Policy (R)
+	SPDRP_REMOVAL_POLICY_OVERRIDE     SPDRP = 0x00000021 // Removal Policy Override (RW)
+	SPDRP_INSTALL_STATE               SPDRP = 0x00000022 // Device Install State (R)
+	SPDRP_LOCATION_PATHS              SPDRP = 0x00000023 // Device Location Paths (R)
+	SPDRP_BASE_CONTAINERID            SPDRP = 0x00000024 // Base ContainerID (R)
+
+	SPDRP_MAXIMUM_PROPERTY SPDRP = 0x00000025 // Upper bound on ordinals
+)
+
+// DEVPROPTYPE represents the property-data-type identifier that specifies the
+// data type of a device property value in the unified device property model.
+type DEVPROPTYPE uint32
+
+const (
+	DEVPROP_TYPEMOD_ARRAY DEVPROPTYPE = 0x00001000
+	DEVPROP_TYPEMOD_LIST  DEVPROPTYPE = 0x00002000
+
+	DEVPROP_TYPE_EMPTY                      DEVPROPTYPE = 0x00000000
+	DEVPROP_TYPE_NULL                       DEVPROPTYPE = 0x00000001
+	DEVPROP_TYPE_SBYTE                      DEVPROPTYPE = 0x00000002
+	DEVPROP_TYPE_BYTE                       DEVPROPTYPE = 0x00000003
+	DEVPROP_TYPE_INT16                      DEVPROPTYPE = 0x00000004
+	DEVPROP_TYPE_UINT16                     DEVPROPTYPE = 0x00000005
+	DEVPROP_TYPE_INT32                      DEVPROPTYPE = 0x00000006
+	DEVPROP_TYPE_UINT32                     DEVPROPTYPE = 0x00000007
+	DEVPROP_TYPE_INT64                      DEVPROPTYPE = 0x00000008
+	DEVPROP_TYPE_UINT64                     DEVPROPTYPE = 0x00000009
+	DEVPROP_TYPE_FLOAT                      DEVPROPTYPE = 0x0000000A
+	DEVPROP_TYPE_DOUBLE                     DEVPROPTYPE = 0x0000000B
+	DEVPROP_TYPE_DECIMAL                    DEVPROPTYPE = 0x0000000C
+	DEVPROP_TYPE_GUID                       DEVPROPTYPE = 0x0000000D
+	DEVPROP_TYPE_CURRENCY                   DEVPROPTYPE = 0x0000000E
+	DEVPROP_TYPE_DATE                       DEVPROPTYPE = 0x0000000F
+	DEVPROP_TYPE_FILETIME                   DEVPROPTYPE = 0x00000010
+	DEVPROP_TYPE_BOOLEAN                    DEVPROPTYPE = 0x00000011
+	DEVPROP_TYPE_STRING                     DEVPROPTYPE = 0x00000012
+	DEVPROP_TYPE_STRING_LIST                DEVPROPTYPE = DEVPROP_TYPE_STRING | DEVPROP_TYPEMOD_LIST
+	DEVPROP_TYPE_SECURITY_DESCRIPTOR        DEVPROPTYPE = 0x00000013
+	DEVPROP_TYPE_SECURITY_DESCRIPTOR_STRING DEVPROPTYPE = 0x00000014
+	DEVPROP_TYPE_DEVPROPKEY                 DEVPROPTYPE = 0x00000015
+	DEVPROP_TYPE_DEVPROPTYPE                DEVPROPTYPE = 0x00000016
+	DEVPROP_TYPE_BINARY                     DEVPROPTYPE = DEVPROP_TYPE_BYTE | DEVPROP_TYPEMOD_ARRAY
+	DEVPROP_TYPE_ERROR                      DEVPROPTYPE = 0x00000017
+	DEVPROP_TYPE_NTSTATUS                   DEVPROPTYPE = 0x00000018
+	DEVPROP_TYPE_STRING_INDIRECT            DEVPROPTYPE = 0x00000019
+
+	MAX_DEVPROP_TYPE    DEVPROPTYPE = 0x00000019
+	MAX_DEVPROP_TYPEMOD DEVPROPTYPE = 0x00002000
+
+	DEVPROP_MASK_TYPE    DEVPROPTYPE = 0x00000FFF
+	DEVPROP_MASK_TYPEMOD DEVPROPTYPE = 0x0000F000
+)
+
+// DEVPROPGUID specifies a property category.
+type DEVPROPGUID GUID
+
+// DEVPROPID uniquely identifies the property within the property category.
+type DEVPROPID uint32
+
+const DEVPROPID_FIRST_USABLE DEVPROPID = 2
+
+// DEVPROPKEY represents a device property key for a device property in the
+// unified device property model.
+type DEVPROPKEY struct {
+	FmtID DEVPROPGUID
+	PID   DEVPROPID
+}
+
+// CONFIGRET is a return value or error code from cfgmgr32 APIs
+type CONFIGRET uint32
+
+func (ret CONFIGRET) Error() string {
+	if win32Error, ok := ret.Unwrap().(Errno); ok {
+		return fmt.Sprintf("%s (CfgMgr error: 0x%08x)", win32Error.Error(), uint32(ret))
+	}
+	return fmt.Sprintf("CfgMgr error: 0x%08x", uint32(ret))
+}
+
+func (ret CONFIGRET) Win32Error(defaultError Errno) Errno {
+	return cm_MapCrToWin32Err(ret, defaultError)
+}
+
+func (ret CONFIGRET) Unwrap() error {
+	const noMatch = Errno(^uintptr(0))
+	win32Error := ret.Win32Error(noMatch)
+	if win32Error == noMatch {
+		return nil
+	}
+	return win32Error
+}
+
+const (
+	CR_SUCCESS                  CONFIGRET = 0x00000000
+	CR_DEFAULT                  CONFIGRET = 0x00000001
+	CR_OUT_OF_MEMORY            CONFIGRET = 0x00000002
+	CR_INVALID_POINTER          CONFIGRET = 0x00000003
+	CR_INVALID_FLAG             CONFIGRET = 0x00000004
+	CR_INVALID_DEVNODE          CONFIGRET = 0x00000005
+	CR_INVALID_DEVINST                    = CR_INVALID_DEVNODE
+	CR_INVALID_RES_DES          CONFIGRET = 0x00000006
+	CR_INVALID_LOG_CONF         CONFIGRET = 0x00000007
+	CR_INVALID_ARBITRATOR       CONFIGRET = 0x00000008
+	CR_INVALID_NODELIST         CONFIGRET = 0x00000009
+	CR_DEVNODE_HAS_REQS         CONFIGRET = 0x0000000A
+	CR_DEVINST_HAS_REQS                   = CR_DEVNODE_HAS_REQS
+	CR_INVALID_RESOURCEID       CONFIGRET = 0x0000000B
+	CR_DLVXD_NOT_FOUND          CONFIGRET = 0x0000000C
+	CR_NO_SUCH_DEVNODE          CONFIGRET = 0x0000000D
+	CR_NO_SUCH_DEVINST                    = CR_NO_SUCH_DEVNODE
+	CR_NO_MORE_LOG_CONF         CONFIGRET = 0x0000000E
+	CR_NO_MORE_RES_DES          CONFIGRET = 0x0000000F
+	CR_ALREADY_SUCH_DEVNODE     CONFIGRET = 0x00000010
+	CR_ALREADY_SUCH_DEVINST               = CR_ALREADY_SUCH_DEVNODE
+	CR_INVALID_RANGE_LIST       CONFIGRET = 0x00000011
+	CR_INVALID_RANGE            CONFIGRET = 0x00000012
+	CR_FAILURE                  CONFIGRET = 0x00000013
+	CR_NO_SUCH_LOGICAL_DEV      CONFIGRET = 0x00000014
+	CR_CREATE_BLOCKED           CONFIGRET = 0x00000015
+	CR_NOT_SYSTEM_VM            CONFIGRET = 0x00000016
+	CR_REMOVE_VETOED            CONFIGRET = 0x00000017
+	CR_APM_VETOED               CONFIGRET = 0x00000018
+	CR_INVALID_LOAD_TYPE        CONFIGRET = 0x00000019
+	CR_BUFFER_SMALL             CONFIGRET = 0x0000001A
+	CR_NO_ARBITRATOR            CONFIGRET = 0x0000001B
+	CR_NO_REGISTRY_HANDLE       CONFIGRET = 0x0000001C
+	CR_REGISTRY_ERROR           CONFIGRET = 0x0000001D
+	CR_INVALID_DEVICE_ID        CONFIGRET = 0x0000001E
+	CR_INVALID_DATA             CONFIGRET = 0x0000001F
+	CR_INVALID_API              CONFIGRET = 0x00000020
+	CR_DEVLOADER_NOT_READY      CONFIGRET = 0x00000021
+	CR_NEED_RESTART             CONFIGRET = 0x00000022
+	CR_NO_MORE_HW_PROFILES      CONFIGRET = 0x00000023
+	CR_DEVICE_NOT_THERE         CONFIGRET = 0x00000024
+	CR_NO_SUCH_VALUE            CONFIGRET = 0x00000025
+	CR_WRONG_TYPE               CONFIGRET = 0x00000026
+	CR_INVALID_PRIORITY         CONFIGRET = 0x00000027
+	CR_NOT_DISABLEABLE          CONFIGRET = 0x00000028
+	CR_FREE_RESOURCES           CONFIGRET = 0x00000029
+	CR_QUERY_VETOED             CONFIGRET = 0x0000002A
+	CR_CANT_SHARE_IRQ           CONFIGRET = 0x0000002B
+	CR_NO_DEPENDENT             CONFIGRET = 0x0000002C
+	CR_SAME_RESOURCES           CONFIGRET = 0x0000002D
+	CR_NO_SUCH_REGISTRY_KEY     CONFIGRET = 0x0000002E
+	CR_INVALID_MACHINENAME      CONFIGRET = 0x0000002F
+	CR_REMOTE_COMM_FAILURE      CONFIGRET = 0x00000030
+	CR_MACHINE_UNAVAILABLE      CONFIGRET = 0x00000031
+	CR_NO_CM_SERVICES           CONFIGRET = 0x00000032
+	CR_ACCESS_DENIED            CONFIGRET = 0x00000033
+	CR_CALL_NOT_IMPLEMENTED     CONFIGRET = 0x00000034
+	CR_INVALID_PROPERTY         CONFIGRET = 0x00000035
+	CR_DEVICE_INTERFACE_ACTIVE  CONFIGRET = 0x00000036
+	CR_NO_SUCH_DEVICE_INTERFACE CONFIGRET = 0x00000037
+	CR_INVALID_REFERENCE_STRING CONFIGRET = 0x00000038
+	CR_INVALID_CONFLICT_LIST    CONFIGRET = 0x00000039
+	CR_INVALID_INDEX            CONFIGRET = 0x0000003A
+	CR_INVALID_STRUCTURE_SIZE   CONFIGRET = 0x0000003B
+	NUM_CR_RESULTS              CONFIGRET = 0x0000003C
+)
+
+const (
+	CM_GET_DEVICE_INTERFACE_LIST_PRESENT     = 0 // only currently 'live' device interfaces
+	CM_GET_DEVICE_INTERFACE_LIST_ALL_DEVICES = 1 // all registered device interfaces, live or not
+)
+
+const (
+	DN_ROOT_ENUMERATED       = 0x00000001        // Was enumerated by ROOT
+	DN_DRIVER_LOADED         = 0x00000002        // Has Register_Device_Driver
+	DN_ENUM_LOADED           = 0x00000004        // Has Register_Enumerator
+	DN_STARTED               = 0x00000008        // Is currently configured
+	DN_MANUAL                = 0x00000010        // Manually installed
+	DN_NEED_TO_ENUM          = 0x00000020        // May need reenumeration
+	DN_NOT_FIRST_TIME        = 0x00000040        // Has received a config
+	DN_HARDWARE_ENUM         = 0x00000080        // Enum generates hardware ID
+	DN_LIAR                  = 0x00000100        // Lied about can reconfig once
+	DN_HAS_MARK              = 0x00000200        // Not CM_Create_DevInst lately
+	DN_HAS_PROBLEM           = 0x00000400        // Need device installer
+	DN_FILTERED              = 0x00000800        // Is filtered
+	DN_MOVED                 = 0x00001000        // Has been moved
+	DN_DISABLEABLE           = 0x00002000        // Can be disabled
+	DN_REMOVABLE             = 0x00004000        // Can be removed
+	DN_PRIVATE_PROBLEM       = 0x00008000        // Has a private problem
+	DN_MF_PARENT             = 0x00010000        // Multi function parent
+	DN_MF_CHILD              = 0x00020000        // Multi function child
+	DN_WILL_BE_REMOVED       = 0x00040000        // DevInst is being removed
+	DN_NOT_FIRST_TIMEE       = 0x00080000        // Has received a config enumerate
+	DN_STOP_FREE_RES         = 0x00100000        // When child is stopped, free resources
+	DN_REBAL_CANDIDATE       = 0x00200000        // Don't skip during rebalance
+	DN_BAD_PARTIAL           = 0x00400000        // This devnode's log_confs do not have same resources
+	DN_NT_ENUMERATOR         = 0x00800000        // This devnode's is an NT enumerator
+	DN_NT_DRIVER             = 0x01000000        // This devnode's is an NT driver
+	DN_NEEDS_LOCKING         = 0x02000000        // Devnode need lock resume processing
+	DN_ARM_WAKEUP            = 0x04000000        // Devnode can be the wakeup device
+	DN_APM_ENUMERATOR        = 0x08000000        // APM aware enumerator
+	DN_APM_DRIVER            = 0x10000000        // APM aware driver
+	DN_SILENT_INSTALL        = 0x20000000        // Silent install
+	DN_NO_SHOW_IN_DM         = 0x40000000        // No show in device manager
+	DN_BOOT_LOG_PROB         = 0x80000000        // Had a problem during preassignment of boot log conf
+	DN_NEED_RESTART          = DN_LIAR           // System needs to be restarted for this Devnode to work properly
+	DN_DRIVER_BLOCKED        = DN_NOT_FIRST_TIME // One or more drivers are blocked from loading for this Devnode
+	DN_LEGACY_DRIVER         = DN_MOVED          // This device is using a legacy driver
+	DN_CHILD_WITH_INVALID_ID = DN_HAS_MARK       // One or more children have invalid IDs
+	DN_DEVICE_DISCONNECTED   = DN_NEEDS_LOCKING  // The function driver for a device reported that the device is not connected.  Typically this means a wireless device is out of range.
+	DN_QUERY_REMOVE_PENDING  = DN_MF_PARENT      // Device is part of a set of related devices collectively pending query-removal
+	DN_QUERY_REMOVE_ACTIVE   = DN_MF_CHILD       // Device is actively engaged in a query-remove IRP
+	DN_CHANGEABLE_FLAGS      = DN_NOT_FIRST_TIME | DN_HARDWARE_ENUM | DN_HAS_MARK | DN_DISABLEABLE | DN_REMOVABLE | DN_MF_CHILD | DN_MF_PARENT | DN_NOT_FIRST_TIMEE | DN_STOP_FREE_RES | DN_REBAL_CANDIDATE | DN_NT_ENUMERATOR | DN_NT_DRIVER | DN_SILENT_INSTALL | DN_NO_SHOW_IN_DM
+)
+
+//sys	setupDiCreateDeviceInfoListEx(classGUID *GUID, hwndParent uintptr, machineName *uint16, reserved uintptr) (handle DevInfo, err error) [failretval==DevInfo(InvalidHandle)] = setupapi.SetupDiCreateDeviceInfoListExW
+
+// SetupDiCreateDeviceInfoListEx function creates an empty device information set on a remote or a local computer and optionally associates the set with a device setup class.
+func SetupDiCreateDeviceInfoListEx(classGUID *GUID, hwndParent uintptr, machineName string) (deviceInfoSet DevInfo, err error) {
+	var machineNameUTF16 *uint16
+	if machineName != "" {
+		machineNameUTF16, err = UTF16PtrFromString(machineName)
+		if err != nil {
+			return
+		}
+	}
+	return setupDiCreateDeviceInfoListEx(classGUID, hwndParent, machineNameUTF16, 0)
+}
+
+//sys	setupDiGetDeviceInfoListDetail(deviceInfoSet DevInfo, deviceInfoSetDetailData *DevInfoListDetailData) (err error) = setupapi.SetupDiGetDeviceInfoListDetailW
+
+// SetupDiGetDeviceInfoListDetail function retrieves information associated with a device information set including the class GUID, remote computer handle, and remote computer name.
+func SetupDiGetDeviceInfoListDetail(deviceInfoSet DevInfo) (deviceInfoSetDetailData *DevInfoListDetailData, err error) {
+	data := &DevInfoListDetailData{}
+	data.size = data.unsafeSizeOf()
+
+	return data, setupDiGetDeviceInfoListDetail(deviceInfoSet, data)
+}
+
+// DeviceInfoListDetail method retrieves information associated with a device information set including the class GUID, remote computer handle, and remote computer name.
+func (deviceInfoSet DevInfo) DeviceInfoListDetail() (*DevInfoListDetailData, error) {
+	return SetupDiGetDeviceInfoListDetail(deviceInfoSet)
+}
+
+//sys	setupDiCreateDeviceInfo(deviceInfoSet DevInfo, DeviceName *uint16, classGUID *GUID, DeviceDescription *uint16, hwndParent uintptr, CreationFlags DICD, deviceInfoData *DevInfoData) (err error) = setupapi.SetupDiCreateDeviceInfoW
+
+// SetupDiCreateDeviceInfo function creates a new device information element and adds it as a new member to the specified device information set.
+func SetupDiCreateDeviceInfo(deviceInfoSet DevInfo, deviceName string, classGUID *GUID, deviceDescription string, hwndParent uintptr, creationFlags DICD) (deviceInfoData *DevInfoData, err error) {
+	deviceNameUTF16, err := UTF16PtrFromString(deviceName)
+	if err != nil {
+		return
+	}
+
+	var deviceDescriptionUTF16 *uint16
+	if deviceDescription != "" {
+		deviceDescriptionUTF16, err = UTF16PtrFromString(deviceDescription)
+		if err != nil {
+			return
+		}
+	}
+
+	data := &DevInfoData{}
+	data.size = uint32(unsafe.Sizeof(*data))
+
+	return data, setupDiCreateDeviceInfo(deviceInfoSet, deviceNameUTF16, classGUID, deviceDescriptionUTF16, hwndParent, creationFlags, data)
+}
+
+// CreateDeviceInfo method creates a new device information element and adds it as a new member to the specified device information set.
+func (deviceInfoSet DevInfo) CreateDeviceInfo(deviceName string, classGUID *GUID, deviceDescription string, hwndParent uintptr, creationFlags DICD) (*DevInfoData, error) {
+	return SetupDiCreateDeviceInfo(deviceInfoSet, deviceName, classGUID, deviceDescription, hwndParent, creationFlags)
+}
+
+//sys	setupDiEnumDeviceInfo(deviceInfoSet DevInfo, memberIndex uint32, deviceInfoData *DevInfoData) (err error) = setupapi.SetupDiEnumDeviceInfo
+
+// SetupDiEnumDeviceInfo function returns a DevInfoData structure that specifies a device information element in a device information set.
+func SetupDiEnumDeviceInfo(deviceInfoSet DevInfo, memberIndex int) (*DevInfoData, error) {
+	data := &DevInfoData{}
+	data.size = uint32(unsafe.Sizeof(*data))
+
+	return data, setupDiEnumDeviceInfo(deviceInfoSet, uint32(memberIndex), data)
+}
+
+// EnumDeviceInfo method returns a DevInfoData structure that specifies a device information element in a device information set.
+func (deviceInfoSet DevInfo) EnumDeviceInfo(memberIndex int) (*DevInfoData, error) {
+	return SetupDiEnumDeviceInfo(deviceInfoSet, memberIndex)
+}
+
+// SetupDiDestroyDeviceInfoList function deletes a device information set and frees all associated memory.
+//sys	SetupDiDestroyDeviceInfoList(deviceInfoSet DevInfo) (err error) = setupapi.SetupDiDestroyDeviceInfoList
+
+// Close method deletes a device information set and frees all associated memory.
+func (deviceInfoSet DevInfo) Close() error {
+	return SetupDiDestroyDeviceInfoList(deviceInfoSet)
+}
+
+//sys	SetupDiBuildDriverInfoList(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT) (err error) = setupapi.SetupDiBuildDriverInfoList
+
+// BuildDriverInfoList method builds a list of drivers that is associated with a specific device or with the global class driver list for a device information set.
+func (deviceInfoSet DevInfo) BuildDriverInfoList(deviceInfoData *DevInfoData, driverType SPDIT) error {
+	return SetupDiBuildDriverInfoList(deviceInfoSet, deviceInfoData, driverType)
+}
+
+//sys	SetupDiCancelDriverInfoSearch(deviceInfoSet DevInfo) (err error) = setupapi.SetupDiCancelDriverInfoSearch
+
+// CancelDriverInfoSearch method cancels a driver list search that is currently in progress in a different thread.
+func (deviceInfoSet DevInfo) CancelDriverInfoSearch() error {
+	return SetupDiCancelDriverInfoSearch(deviceInfoSet)
+}
+
+//sys	setupDiEnumDriverInfo(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT, memberIndex uint32, driverInfoData *DrvInfoData) (err error) = setupapi.SetupDiEnumDriverInfoW
+
+// SetupDiEnumDriverInfo function enumerates the members of a driver list.
+func SetupDiEnumDriverInfo(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT, memberIndex int) (*DrvInfoData, error) {
+	data := &DrvInfoData{}
+	data.size = uint32(unsafe.Sizeof(*data))
+
+	return data, setupDiEnumDriverInfo(deviceInfoSet, deviceInfoData, driverType, uint32(memberIndex), data)
+}
+
+// EnumDriverInfo method enumerates the members of a driver list.
+func (deviceInfoSet DevInfo) EnumDriverInfo(deviceInfoData *DevInfoData, driverType SPDIT, memberIndex int) (*DrvInfoData, error) {
+	return SetupDiEnumDriverInfo(deviceInfoSet, deviceInfoData, driverType, memberIndex)
+}
+
+//sys	setupDiGetSelectedDriver(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) (err error) = setupapi.SetupDiGetSelectedDriverW
+
+// SetupDiGetSelectedDriver function retrieves the selected driver for a device information set or a particular device information element.
+func SetupDiGetSelectedDriver(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (*DrvInfoData, error) {
+	data := &DrvInfoData{}
+	data.size = uint32(unsafe.Sizeof(*data))
+
+	return data, setupDiGetSelectedDriver(deviceInfoSet, deviceInfoData, data)
+}
+
+// SelectedDriver method retrieves the selected driver for a device information set or a particular device information element.
+func (deviceInfoSet DevInfo) SelectedDriver(deviceInfoData *DevInfoData) (*DrvInfoData, error) {
+	return SetupDiGetSelectedDriver(deviceInfoSet, deviceInfoData)
+}
+
+//sys	SetupDiSetSelectedDriver(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) (err error) = setupapi.SetupDiSetSelectedDriverW
+
+// SetSelectedDriver method sets, or resets, the selected driver for a device information element or the selected class driver for a device information set.
+func (deviceInfoSet DevInfo) SetSelectedDriver(deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) error {
+	return SetupDiSetSelectedDriver(deviceInfoSet, deviceInfoData, driverInfoData)
+}
+
+//sys	setupDiGetDriverInfoDetail(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData, driverInfoDetailData *DrvInfoDetailData, driverInfoDetailDataSize uint32, requiredSize *uint32) (err error) = setupapi.SetupDiGetDriverInfoDetailW
+
+// SetupDiGetDriverInfoDetail function retrieves driver information detail for a device information set or a particular device information element in the device information set.
+func SetupDiGetDriverInfoDetail(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) (*DrvInfoDetailData, error) {
+	reqSize := uint32(2048)
+	for {
+		buf := make([]byte, reqSize)
+		data := (*DrvInfoDetailData)(unsafe.Pointer(&buf[0]))
+		data.size = data.unsafeSizeOf()
+		err := setupDiGetDriverInfoDetail(deviceInfoSet, deviceInfoData, driverInfoData, data, uint32(len(buf)), &reqSize)
+		if err == ERROR_INSUFFICIENT_BUFFER {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		data.size = reqSize
+		return data, nil
+	}
+}
+
+// DriverInfoDetail method retrieves driver information detail for a device information set or a particular device information element in the device information set.
+func (deviceInfoSet DevInfo) DriverInfoDetail(deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) (*DrvInfoDetailData, error) {
+	return SetupDiGetDriverInfoDetail(deviceInfoSet, deviceInfoData, driverInfoData)
+}
+
+//sys	SetupDiDestroyDriverInfoList(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT) (err error) = setupapi.SetupDiDestroyDriverInfoList
+
+// DestroyDriverInfoList method deletes a driver list.
+func (deviceInfoSet DevInfo) DestroyDriverInfoList(deviceInfoData *DevInfoData, driverType SPDIT) error {
+	return SetupDiDestroyDriverInfoList(deviceInfoSet, deviceInfoData, driverType)
+}
+
+//sys	setupDiGetClassDevsEx(classGUID *GUID, Enumerator *uint16, hwndParent uintptr, Flags DIGCF, deviceInfoSet DevInfo, machineName *uint16, reserved uintptr) (handle DevInfo, err error) [failretval==DevInfo(InvalidHandle)] = setupapi.SetupDiGetClassDevsExW
+
+// SetupDiGetClassDevsEx function returns a handle to a device information set that contains requested device information elements for a local or a remote computer.
+func SetupDiGetClassDevsEx(classGUID *GUID, enumerator string, hwndParent uintptr, flags DIGCF, deviceInfoSet DevInfo, machineName string) (handle DevInfo, err error) {
+	var enumeratorUTF16 *uint16
+	if enumerator != "" {
+		enumeratorUTF16, err = UTF16PtrFromString(enumerator)
+		if err != nil {
+			return
+		}
+	}
+	var machineNameUTF16 *uint16
+	if machineName != "" {
+		machineNameUTF16, err = UTF16PtrFromString(machineName)
+		if err != nil {
+			return
+		}
+	}
+	return setupDiGetClassDevsEx(classGUID, enumeratorUTF16, hwndParent, flags, deviceInfoSet, machineNameUTF16, 0)
+}
+
+// SetupDiCallClassInstaller function calls the appropriate class installer, and any registered co-installers, with the specified installation request (DIF code).
+//sys	SetupDiCallClassInstaller(installFunction DI_FUNCTION, deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (err error) = setupapi.SetupDiCallClassInstaller
+
+// CallClassInstaller member calls the appropriate class installer, and any registered co-installers, with the specified installation request (DIF code).
+func (deviceInfoSet DevInfo) CallClassInstaller(installFunction DI_FUNCTION, deviceInfoData *DevInfoData) error {
+	return SetupDiCallClassInstaller(installFunction, deviceInfoSet, deviceInfoData)
+}
+
+// SetupDiOpenDevRegKey function opens a registry key for device-specific configuration information.
+//sys	SetupDiOpenDevRegKey(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, Scope DICS_FLAG, HwProfile uint32, KeyType DIREG, samDesired uint32) (key Handle, err error) [failretval==InvalidHandle] = setupapi.SetupDiOpenDevRegKey
+
+// OpenDevRegKey method opens a registry key for device-specific configuration information.
+func (deviceInfoSet DevInfo) OpenDevRegKey(DeviceInfoData *DevInfoData, Scope DICS_FLAG, HwProfile uint32, KeyType DIREG, samDesired uint32) (Handle, error) {
+	return SetupDiOpenDevRegKey(deviceInfoSet, DeviceInfoData, Scope, HwProfile, KeyType, samDesired)
+}
+
+//sys	setupDiGetDeviceProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, propertyKey *DEVPROPKEY, propertyType *DEVPROPTYPE, propertyBuffer *byte, propertyBufferSize uint32, requiredSize *uint32, flags uint32) (err error) = setupapi.SetupDiGetDevicePropertyW
+
+// SetupDiGetDeviceProperty function retrieves a specified device instance property.
+func SetupDiGetDeviceProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, propertyKey *DEVPROPKEY) (value interface{}, err error) {
+	reqSize := uint32(256)
+	for {
+		var dataType DEVPROPTYPE
+		buf := make([]byte, reqSize)
+		err = setupDiGetDeviceProperty(deviceInfoSet, deviceInfoData, propertyKey, &dataType, &buf[0], uint32(len(buf)), &reqSize, 0)
+		if err == ERROR_INSUFFICIENT_BUFFER {
+			continue
+		}
+		if err != nil {
+			return
+		}
+		switch dataType {
+		case DEVPROP_TYPE_STRING:
+			ret := UTF16ToString(bufToUTF16(buf))
+			runtime.KeepAlive(buf)
+			return ret, nil
+		}
+		return nil, errors.New("unimplemented property type")
+	}
+}
+
+//sys	setupDiGetDeviceRegistryProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, property SPDRP, propertyRegDataType *uint32, propertyBuffer *byte, propertyBufferSize uint32, requiredSize *uint32) (err error) = setupapi.SetupDiGetDeviceRegistryPropertyW
+
+// SetupDiGetDeviceRegistryProperty function retrieves a specified Plug and Play device property.
+func SetupDiGetDeviceRegistryProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, property SPDRP) (value interface{}, err error) {
+	reqSize := uint32(256)
+	for {
+		var dataType uint32
+		buf := make([]byte, reqSize)
+		err = setupDiGetDeviceRegistryProperty(deviceInfoSet, deviceInfoData, property, &dataType, &buf[0], uint32(len(buf)), &reqSize)
+		if err == ERROR_INSUFFICIENT_BUFFER {
+			continue
+		}
+		if err != nil {
+			return
+		}
+		return getRegistryValue(buf[:reqSize], dataType)
+	}
+}
+
+func getRegistryValue(buf []byte, dataType uint32) (interface{}, error) {
+	switch dataType {
+	case REG_SZ:
+		ret := UTF16ToString(bufToUTF16(buf))
+		runtime.KeepAlive(buf)
+		return ret, nil
+	case REG_EXPAND_SZ:
+		value := UTF16ToString(bufToUTF16(buf))
+		if value == "" {
+			return "", nil
+		}
+		p, err := syscall.UTF16PtrFromString(value)
+		if err != nil {
+			return "", err
+		}
+		ret := make([]uint16, 100)
+		for {
+			n, err := ExpandEnvironmentStrings(p, &ret[0], uint32(len(ret)))
+			if err != nil {
+				return "", err
+			}
+			if n <= uint32(len(ret)) {
+				return UTF16ToString(ret[:n]), nil
+			}
+			ret = make([]uint16, n)
+		}
+	case REG_BINARY:
+		return buf, nil
+	case REG_DWORD_LITTLE_ENDIAN:
+		return binary.LittleEndian.Uint32(buf), nil
+	case REG_DWORD_BIG_ENDIAN:
+		return binary.BigEndian.Uint32(buf), nil
+	case REG_MULTI_SZ:
+		bufW := bufToUTF16(buf)
+		a := []string{}
+		for i := 0; i < len(bufW); {
+			j := i + wcslen(bufW[i:])
+			if i < j {
+				a = append(a, UTF16ToString(bufW[i:j]))
+			}
+			i = j + 1
+		}
+		runtime.KeepAlive(buf)
+		return a, nil
+	case REG_QWORD_LITTLE_ENDIAN:
+		return binary.LittleEndian.Uint64(buf), nil
+	default:
+		return nil, fmt.Errorf("Unsupported registry value type: %v", dataType)
+	}
+}
+
+// bufToUTF16 function reinterprets []byte buffer as []uint16
+func bufToUTF16(buf []byte) []uint16 {
+	sl := struct {
+		addr *uint16
+		len  int
+		cap  int
+	}{(*uint16)(unsafe.Pointer(&buf[0])), len(buf) / 2, cap(buf) / 2}
+	return *(*[]uint16)(unsafe.Pointer(&sl))
+}
+
+// utf16ToBuf function reinterprets []uint16 as []byte
+func utf16ToBuf(buf []uint16) []byte {
+	sl := struct {
+		addr *byte
+		len  int
+		cap  int
+	}{(*byte)(unsafe.Pointer(&buf[0])), len(buf) * 2, cap(buf) * 2}
+	return *(*[]byte)(unsafe.Pointer(&sl))
+}
+
+func wcslen(str []uint16) int {
+	for i := 0; i < len(str); i++ {
+		if str[i] == 0 {
+			return i
+		}
+	}
+	return len(str)
+}
+
+// DeviceRegistryProperty method retrieves a specified Plug and Play device property.
+func (deviceInfoSet DevInfo) DeviceRegistryProperty(deviceInfoData *DevInfoData, property SPDRP) (interface{}, error) {
+	return SetupDiGetDeviceRegistryProperty(deviceInfoSet, deviceInfoData, property)
+}
+
+//sys	setupDiSetDeviceRegistryProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, property SPDRP, propertyBuffer *byte, propertyBufferSize uint32) (err error) = setupapi.SetupDiSetDeviceRegistryPropertyW
+
+// SetupDiSetDeviceRegistryProperty function sets a Plug and Play device property for a device.
+func SetupDiSetDeviceRegistryProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, property SPDRP, propertyBuffers []byte) error {
+	return setupDiSetDeviceRegistryProperty(deviceInfoSet, deviceInfoData, property, &propertyBuffers[0], uint32(len(propertyBuffers)))
+}
+
+// SetDeviceRegistryProperty function sets a Plug and Play device property for a device.
+func (deviceInfoSet DevInfo) SetDeviceRegistryProperty(deviceInfoData *DevInfoData, property SPDRP, propertyBuffers []byte) error {
+	return SetupDiSetDeviceRegistryProperty(deviceInfoSet, deviceInfoData, property, propertyBuffers)
+}
+
+// SetDeviceRegistryPropertyString method sets a Plug and Play device property string for a device.
+func (deviceInfoSet DevInfo) SetDeviceRegistryPropertyString(deviceInfoData *DevInfoData, property SPDRP, str string) error {
+	str16, err := UTF16FromString(str)
+	if err != nil {
+		return err
+	}
+	err = SetupDiSetDeviceRegistryProperty(deviceInfoSet, deviceInfoData, property, utf16ToBuf(append(str16, 0)))
+	runtime.KeepAlive(str16)
+	return err
+}
+
+//sys	setupDiGetDeviceInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, deviceInstallParams *DevInstallParams) (err error) = setupapi.SetupDiGetDeviceInstallParamsW
+
+// SetupDiGetDeviceInstallParams function retrieves device installation parameters for a device information set or a particular device information element.
+func SetupDiGetDeviceInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (*DevInstallParams, error) {
+	params := &DevInstallParams{}
+	params.size = uint32(unsafe.Sizeof(*params))
+
+	return params, setupDiGetDeviceInstallParams(deviceInfoSet, deviceInfoData, params)
+}
+
+// DeviceInstallParams method retrieves device installation parameters for a device information set or a particular device information element.
+func (deviceInfoSet DevInfo) DeviceInstallParams(deviceInfoData *DevInfoData) (*DevInstallParams, error) {
+	return SetupDiGetDeviceInstallParams(deviceInfoSet, deviceInfoData)
+}
+
+//sys	setupDiGetDeviceInstanceId(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, instanceId *uint16, instanceIdSize uint32, instanceIdRequiredSize *uint32) (err error) = setupapi.SetupDiGetDeviceInstanceIdW
+
+// SetupDiGetDeviceInstanceId function retrieves the instance ID of the device.
+func SetupDiGetDeviceInstanceId(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (string, error) {
+	reqSize := uint32(1024)
+	for {
+		buf := make([]uint16, reqSize)
+		err := setupDiGetDeviceInstanceId(deviceInfoSet, deviceInfoData, &buf[0], uint32(len(buf)), &reqSize)
+		if err == ERROR_INSUFFICIENT_BUFFER {
+			continue
+		}
+		if err != nil {
+			return "", err
+		}
+		return UTF16ToString(buf), nil
+	}
+}
+
+// DeviceInstanceID method retrieves the instance ID of the device.
+func (deviceInfoSet DevInfo) DeviceInstanceID(deviceInfoData *DevInfoData) (string, error) {
+	return SetupDiGetDeviceInstanceId(deviceInfoSet, deviceInfoData)
+}
+
+// SetupDiGetClassInstallParams function retrieves class installation parameters for a device information set or a particular device information element.
+//sys	SetupDiGetClassInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, classInstallParams *ClassInstallHeader, classInstallParamsSize uint32, requiredSize *uint32) (err error) = setupapi.SetupDiGetClassInstallParamsW
+
+// ClassInstallParams method retrieves class installation parameters for a device information set or a particular device information element.
+func (deviceInfoSet DevInfo) ClassInstallParams(deviceInfoData *DevInfoData, classInstallParams *ClassInstallHeader, classInstallParamsSize uint32, requiredSize *uint32) error {
+	return SetupDiGetClassInstallParams(deviceInfoSet, deviceInfoData, classInstallParams, classInstallParamsSize, requiredSize)
+}
+
+//sys	SetupDiSetDeviceInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, deviceInstallParams *DevInstallParams) (err error) = setupapi.SetupDiSetDeviceInstallParamsW
+
+// SetDeviceInstallParams member sets device installation parameters for a device information set or a particular device information element.
+func (deviceInfoSet DevInfo) SetDeviceInstallParams(deviceInfoData *DevInfoData, deviceInstallParams *DevInstallParams) error {
+	return SetupDiSetDeviceInstallParams(deviceInfoSet, deviceInfoData, deviceInstallParams)
+}
+
+// SetupDiSetClassInstallParams function sets or clears class install parameters for a device information set or a particular device information element.
+//sys	SetupDiSetClassInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, classInstallParams *ClassInstallHeader, classInstallParamsSize uint32) (err error) = setupapi.SetupDiSetClassInstallParamsW
+
+// SetClassInstallParams method sets or clears class install parameters for a device information set or a particular device information element.
+func (deviceInfoSet DevInfo) SetClassInstallParams(deviceInfoData *DevInfoData, classInstallParams *ClassInstallHeader, classInstallParamsSize uint32) error {
+	return SetupDiSetClassInstallParams(deviceInfoSet, deviceInfoData, classInstallParams, classInstallParamsSize)
+}
+
+//sys	setupDiClassNameFromGuidEx(classGUID *GUID, className *uint16, classNameSize uint32, requiredSize *uint32, machineName *uint16, reserved uintptr) (err error) = setupapi.SetupDiClassNameFromGuidExW
+
+// SetupDiClassNameFromGuidEx function retrieves the class name associated with a class GUID. The class can be installed on a local or remote computer.
+func SetupDiClassNameFromGuidEx(classGUID *GUID, machineName string) (className string, err error) {
+	var classNameUTF16 [MAX_CLASS_NAME_LEN]uint16
+
+	var machineNameUTF16 *uint16
+	if machineName != "" {
+		machineNameUTF16, err = UTF16PtrFromString(machineName)
+		if err != nil {
+			return
+		}
+	}
+
+	err = setupDiClassNameFromGuidEx(classGUID, &classNameUTF16[0], MAX_CLASS_NAME_LEN, nil, machineNameUTF16, 0)
+	if err != nil {
+		return
+	}
+
+	className = UTF16ToString(classNameUTF16[:])
+	return
+}
+
+//sys	setupDiClassGuidsFromNameEx(className *uint16, classGuidList *GUID, classGuidListSize uint32, requiredSize *uint32, machineName *uint16, reserved uintptr) (err error) = setupapi.SetupDiClassGuidsFromNameExW
+
+// SetupDiClassGuidsFromNameEx function retrieves the GUIDs associated with the specified class name. This resulting list contains the classes currently installed on a local or remote computer.
+func SetupDiClassGuidsFromNameEx(className string, machineName string) ([]GUID, error) {
+	classNameUTF16, err := UTF16PtrFromString(className)
+	if err != nil {
+		return nil, err
+	}
+
+	var machineNameUTF16 *uint16
+	if machineName != "" {
+		machineNameUTF16, err = UTF16PtrFromString(machineName)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	reqSize := uint32(4)
+	for {
+		buf := make([]GUID, reqSize)
+		err = setupDiClassGuidsFromNameEx(classNameUTF16, &buf[0], uint32(len(buf)), &reqSize, machineNameUTF16, 0)
+		if err == ERROR_INSUFFICIENT_BUFFER {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		return buf[:reqSize], nil
+	}
+}
+
+//sys	setupDiGetSelectedDevice(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (err error) = setupapi.SetupDiGetSelectedDevice
+
+// SetupDiGetSelectedDevice function retrieves the selected device information element in a device information set.
+func SetupDiGetSelectedDevice(deviceInfoSet DevInfo) (*DevInfoData, error) {
+	data := &DevInfoData{}
+	data.size = uint32(unsafe.Sizeof(*data))
+
+	return data, setupDiGetSelectedDevice(deviceInfoSet, data)
+}
+
+// SelectedDevice method retrieves the selected device information element in a device information set.
+func (deviceInfoSet DevInfo) SelectedDevice() (*DevInfoData, error) {
+	return SetupDiGetSelectedDevice(deviceInfoSet)
+}
+
+// SetupDiSetSelectedDevice function sets a device information element as the selected member of a device information set. This function is typically used by an installation wizard.
+//sys	SetupDiSetSelectedDevice(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (err error) = setupapi.SetupDiSetSelectedDevice
+
+// SetSelectedDevice method sets a device information element as the selected member of a device information set. This function is typically used by an installation wizard.
+func (deviceInfoSet DevInfo) SetSelectedDevice(deviceInfoData *DevInfoData) error {
+	return SetupDiSetSelectedDevice(deviceInfoSet, deviceInfoData)
+}
+
+//sys	setupUninstallOEMInf(infFileName *uint16, flags SUOI, reserved uintptr) (err error) = setupapi.SetupUninstallOEMInfW
+
+// SetupUninstallOEMInf uninstalls the specified driver.
+func SetupUninstallOEMInf(infFileName string, flags SUOI) error {
+	infFileName16, err := UTF16PtrFromString(infFileName)
+	if err != nil {
+		return err
+	}
+	return setupUninstallOEMInf(infFileName16, flags, 0)
+}
+
+//sys cm_MapCrToWin32Err(configRet CONFIGRET, defaultWin32Error Errno) (ret Errno) = CfgMgr32.CM_MapCrToWin32Err
+
+//sys cm_Get_Device_Interface_List_Size(len *uint32, interfaceClass *GUID, deviceID *uint16, flags uint32) (ret CONFIGRET) = CfgMgr32.CM_Get_Device_Interface_List_SizeW
+//sys cm_Get_Device_Interface_List(interfaceClass *GUID, deviceID *uint16, buffer *uint16, bufferLen uint32, flags uint32) (ret CONFIGRET) = CfgMgr32.CM_Get_Device_Interface_ListW
+
+func CM_Get_Device_Interface_List(deviceID string, interfaceClass *GUID, flags uint32) ([]string, error) {
+	deviceID16, err := UTF16PtrFromString(deviceID)
+	if err != nil {
+		return nil, err
+	}
+	var buf []uint16
+	var buflen uint32
+	for {
+		if ret := cm_Get_Device_Interface_List_Size(&buflen, interfaceClass, deviceID16, flags); ret != CR_SUCCESS {
+			return nil, ret
+		}
+		buf = make([]uint16, buflen)
+		if ret := cm_Get_Device_Interface_List(interfaceClass, deviceID16, &buf[0], buflen, flags); ret == CR_SUCCESS {
+			break
+		} else if ret != CR_BUFFER_SMALL {
+			return nil, ret
+		}
+	}
+	var interfaces []string
+	for i := 0; i < len(buf); {
+		j := i + wcslen(buf[i:])
+		if i < j {
+			interfaces = append(interfaces, UTF16ToString(buf[i:j]))
+		}
+		i = j + 1
+	}
+	if interfaces == nil {
+		return nil, ERROR_NO_SUCH_DEVICE_INTERFACE
+	}
+	return interfaces, nil
+}
+
+//sys cm_Get_DevNode_Status(status *uint32, problemNumber *uint32, devInst DEVINST, flags uint32) (ret CONFIGRET) = CfgMgr32.CM_Get_DevNode_Status
+
+func CM_Get_DevNode_Status(status *uint32, problemNumber *uint32, devInst DEVINST, flags uint32) error {
+	ret := cm_Get_DevNode_Status(status, problemNumber, devInst, flags)
+	if ret == CR_SUCCESS {
+		return nil
+	}
+	return ret
+}
diff --git a/vendor/golang.org/x/sys/windows/setupapierrors_windows.go b/vendor/golang.org/x/sys/windows/setupapierrors_windows.go
deleted file mode 100644
index 1681810e04..0000000000
--- a/vendor/golang.org/x/sys/windows/setupapierrors_windows.go
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright 2020 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package windows
-
-import "syscall"
-
-const (
-	ERROR_EXPECTED_SECTION_NAME                  syscall.Errno = 0x20000000 | 0xC0000000 | 0
-	ERROR_BAD_SECTION_NAME_LINE                  syscall.Errno = 0x20000000 | 0xC0000000 | 1
-	ERROR_SECTION_NAME_TOO_LONG                  syscall.Errno = 0x20000000 | 0xC0000000 | 2
-	ERROR_GENERAL_SYNTAX                         syscall.Errno = 0x20000000 | 0xC0000000 | 3
-	ERROR_WRONG_INF_STYLE                        syscall.Errno = 0x20000000 | 0xC0000000 | 0x100
-	ERROR_SECTION_NOT_FOUND                      syscall.Errno = 0x20000000 | 0xC0000000 | 0x101
-	ERROR_LINE_NOT_FOUND                         syscall.Errno = 0x20000000 | 0xC0000000 | 0x102
-	ERROR_NO_BACKUP                              syscall.Errno = 0x20000000 | 0xC0000000 | 0x103
-	ERROR_NO_ASSOCIATED_CLASS                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x200
-	ERROR_CLASS_MISMATCH                         syscall.Errno = 0x20000000 | 0xC0000000 | 0x201
-	ERROR_DUPLICATE_FOUND                        syscall.Errno = 0x20000000 | 0xC0000000 | 0x202
-	ERROR_NO_DRIVER_SELECTED                     syscall.Errno = 0x20000000 | 0xC0000000 | 0x203
-	ERROR_KEY_DOES_NOT_EXIST                     syscall.Errno = 0x20000000 | 0xC0000000 | 0x204
-	ERROR_INVALID_DEVINST_NAME                   syscall.Errno = 0x20000000 | 0xC0000000 | 0x205
-	ERROR_INVALID_CLASS                          syscall.Errno = 0x20000000 | 0xC0000000 | 0x206
-	ERROR_DEVINST_ALREADY_EXISTS                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x207
-	ERROR_DEVINFO_NOT_REGISTERED                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x208
-	ERROR_INVALID_REG_PROPERTY                   syscall.Errno = 0x20000000 | 0xC0000000 | 0x209
-	ERROR_NO_INF                                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x20A
-	ERROR_NO_SUCH_DEVINST                        syscall.Errno = 0x20000000 | 0xC0000000 | 0x20B
-	ERROR_CANT_LOAD_CLASS_ICON                   syscall.Errno = 0x20000000 | 0xC0000000 | 0x20C
-	ERROR_INVALID_CLASS_INSTALLER                syscall.Errno = 0x20000000 | 0xC0000000 | 0x20D
-	ERROR_DI_DO_DEFAULT                          syscall.Errno = 0x20000000 | 0xC0000000 | 0x20E
-	ERROR_DI_NOFILECOPY                          syscall.Errno = 0x20000000 | 0xC0000000 | 0x20F
-	ERROR_INVALID_HWPROFILE                      syscall.Errno = 0x20000000 | 0xC0000000 | 0x210
-	ERROR_NO_DEVICE_SELECTED                     syscall.Errno = 0x20000000 | 0xC0000000 | 0x211
-	ERROR_DEVINFO_LIST_LOCKED                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x212
-	ERROR_DEVINFO_DATA_LOCKED                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x213
-	ERROR_DI_BAD_PATH                            syscall.Errno = 0x20000000 | 0xC0000000 | 0x214
-	ERROR_NO_CLASSINSTALL_PARAMS                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x215
-	ERROR_FILEQUEUE_LOCKED                       syscall.Errno = 0x20000000 | 0xC0000000 | 0x216
-	ERROR_BAD_SERVICE_INSTALLSECT                syscall.Errno = 0x20000000 | 0xC0000000 | 0x217
-	ERROR_NO_CLASS_DRIVER_LIST                   syscall.Errno = 0x20000000 | 0xC0000000 | 0x218
-	ERROR_NO_ASSOCIATED_SERVICE                  syscall.Errno = 0x20000000 | 0xC0000000 | 0x219
-	ERROR_NO_DEFAULT_DEVICE_INTERFACE            syscall.Errno = 0x20000000 | 0xC0000000 | 0x21A
-	ERROR_DEVICE_INTERFACE_ACTIVE                syscall.Errno = 0x20000000 | 0xC0000000 | 0x21B
-	ERROR_DEVICE_INTERFACE_REMOVED               syscall.Errno = 0x20000000 | 0xC0000000 | 0x21C
-	ERROR_BAD_INTERFACE_INSTALLSECT              syscall.Errno = 0x20000000 | 0xC0000000 | 0x21D
-	ERROR_NO_SUCH_INTERFACE_CLASS                syscall.Errno = 0x20000000 | 0xC0000000 | 0x21E
-	ERROR_INVALID_REFERENCE_STRING               syscall.Errno = 0x20000000 | 0xC0000000 | 0x21F
-	ERROR_INVALID_MACHINENAME                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x220
-	ERROR_REMOTE_COMM_FAILURE                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x221
-	ERROR_MACHINE_UNAVAILABLE                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x222
-	ERROR_NO_CONFIGMGR_SERVICES                  syscall.Errno = 0x20000000 | 0xC0000000 | 0x223
-	ERROR_INVALID_PROPPAGE_PROVIDER              syscall.Errno = 0x20000000 | 0xC0000000 | 0x224
-	ERROR_NO_SUCH_DEVICE_INTERFACE               syscall.Errno = 0x20000000 | 0xC0000000 | 0x225
-	ERROR_DI_POSTPROCESSING_REQUIRED             syscall.Errno = 0x20000000 | 0xC0000000 | 0x226
-	ERROR_INVALID_COINSTALLER                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x227
-	ERROR_NO_COMPAT_DRIVERS                      syscall.Errno = 0x20000000 | 0xC0000000 | 0x228
-	ERROR_NO_DEVICE_ICON                         syscall.Errno = 0x20000000 | 0xC0000000 | 0x229
-	ERROR_INVALID_INF_LOGCONFIG                  syscall.Errno = 0x20000000 | 0xC0000000 | 0x22A
-	ERROR_DI_DONT_INSTALL                        syscall.Errno = 0x20000000 | 0xC0000000 | 0x22B
-	ERROR_INVALID_FILTER_DRIVER                  syscall.Errno = 0x20000000 | 0xC0000000 | 0x22C
-	ERROR_NON_WINDOWS_NT_DRIVER                  syscall.Errno = 0x20000000 | 0xC0000000 | 0x22D
-	ERROR_NON_WINDOWS_DRIVER                     syscall.Errno = 0x20000000 | 0xC0000000 | 0x22E
-	ERROR_NO_CATALOG_FOR_OEM_INF                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x22F
-	ERROR_DEVINSTALL_QUEUE_NONNATIVE             syscall.Errno = 0x20000000 | 0xC0000000 | 0x230
-	ERROR_NOT_DISABLEABLE                        syscall.Errno = 0x20000000 | 0xC0000000 | 0x231
-	ERROR_CANT_REMOVE_DEVINST                    syscall.Errno = 0x20000000 | 0xC0000000 | 0x232
-	ERROR_INVALID_TARGET                         syscall.Errno = 0x20000000 | 0xC0000000 | 0x233
-	ERROR_DRIVER_NONNATIVE                       syscall.Errno = 0x20000000 | 0xC0000000 | 0x234
-	ERROR_IN_WOW64                               syscall.Errno = 0x20000000 | 0xC0000000 | 0x235
-	ERROR_SET_SYSTEM_RESTORE_POINT               syscall.Errno = 0x20000000 | 0xC0000000 | 0x236
-	ERROR_SCE_DISABLED                           syscall.Errno = 0x20000000 | 0xC0000000 | 0x238
-	ERROR_UNKNOWN_EXCEPTION                      syscall.Errno = 0x20000000 | 0xC0000000 | 0x239
-	ERROR_PNP_REGISTRY_ERROR                     syscall.Errno = 0x20000000 | 0xC0000000 | 0x23A
-	ERROR_REMOTE_REQUEST_UNSUPPORTED             syscall.Errno = 0x20000000 | 0xC0000000 | 0x23B
-	ERROR_NOT_AN_INSTALLED_OEM_INF               syscall.Errno = 0x20000000 | 0xC0000000 | 0x23C
-	ERROR_INF_IN_USE_BY_DEVICES                  syscall.Errno = 0x20000000 | 0xC0000000 | 0x23D
-	ERROR_DI_FUNCTION_OBSOLETE                   syscall.Errno = 0x20000000 | 0xC0000000 | 0x23E
-	ERROR_NO_AUTHENTICODE_CATALOG                syscall.Errno = 0x20000000 | 0xC0000000 | 0x23F
-	ERROR_AUTHENTICODE_DISALLOWED                syscall.Errno = 0x20000000 | 0xC0000000 | 0x240
-	ERROR_AUTHENTICODE_TRUSTED_PUBLISHER         syscall.Errno = 0x20000000 | 0xC0000000 | 0x241
-	ERROR_AUTHENTICODE_TRUST_NOT_ESTABLISHED     syscall.Errno = 0x20000000 | 0xC0000000 | 0x242
-	ERROR_AUTHENTICODE_PUBLISHER_NOT_TRUSTED     syscall.Errno = 0x20000000 | 0xC0000000 | 0x243
-	ERROR_SIGNATURE_OSATTRIBUTE_MISMATCH         syscall.Errno = 0x20000000 | 0xC0000000 | 0x244
-	ERROR_ONLY_VALIDATE_VIA_AUTHENTICODE         syscall.Errno = 0x20000000 | 0xC0000000 | 0x245
-	ERROR_DEVICE_INSTALLER_NOT_READY             syscall.Errno = 0x20000000 | 0xC0000000 | 0x246
-	ERROR_DRIVER_STORE_ADD_FAILED                syscall.Errno = 0x20000000 | 0xC0000000 | 0x247
-	ERROR_DEVICE_INSTALL_BLOCKED                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x248
-	ERROR_DRIVER_INSTALL_BLOCKED                 syscall.Errno = 0x20000000 | 0xC0000000 | 0x249
-	ERROR_WRONG_INF_TYPE                         syscall.Errno = 0x20000000 | 0xC0000000 | 0x24A
-	ERROR_FILE_HASH_NOT_IN_CATALOG               syscall.Errno = 0x20000000 | 0xC0000000 | 0x24B
-	ERROR_DRIVER_STORE_DELETE_FAILED             syscall.Errno = 0x20000000 | 0xC0000000 | 0x24C
-	ERROR_UNRECOVERABLE_STACK_OVERFLOW           syscall.Errno = 0x20000000 | 0xC0000000 | 0x300
-	EXCEPTION_SPAPI_UNRECOVERABLE_STACK_OVERFLOW syscall.Errno = ERROR_UNRECOVERABLE_STACK_OVERFLOW
-	ERROR_NO_DEFAULT_INTERFACE_DEVICE            syscall.Errno = ERROR_NO_DEFAULT_DEVICE_INTERFACE
-	ERROR_INTERFACE_DEVICE_ACTIVE                syscall.Errno = ERROR_DEVICE_INTERFACE_ACTIVE
-	ERROR_INTERFACE_DEVICE_REMOVED               syscall.Errno = ERROR_DEVICE_INTERFACE_REMOVED
-	ERROR_NO_SUCH_INTERFACE_DEVICE               syscall.Errno = ERROR_NO_SUCH_DEVICE_INTERFACE
-)
diff --git a/vendor/golang.org/x/sys/windows/syscall.go b/vendor/golang.org/x/sys/windows/syscall.go
index 72074d582f..8732cdb957 100644
--- a/vendor/golang.org/x/sys/windows/syscall.go
+++ b/vendor/golang.org/x/sys/windows/syscall.go
@@ -30,8 +30,6 @@ import (
 	"strings"
 	"syscall"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 // ByteSliceFromString returns a NUL-terminated slice of bytes
@@ -83,13 +81,7 @@ func BytePtrToString(p *byte) string {
 		ptr = unsafe.Pointer(uintptr(ptr) + 1)
 	}
 
-	var s []byte
-	h := (*unsafeheader.Slice)(unsafe.Pointer(&s))
-	h.Data = unsafe.Pointer(p)
-	h.Len = n
-	h.Cap = n
-
-	return string(s)
+	return string(unsafe.Slice(p, n))
 }
 
 // Single-word zero for use when we need a valid pointer to 0 bytes.
diff --git a/vendor/golang.org/x/sys/windows/syscall_windows.go b/vendor/golang.org/x/sys/windows/syscall_windows.go
index 2ff6aa0470..3723b2c224 100644
--- a/vendor/golang.org/x/sys/windows/syscall_windows.go
+++ b/vendor/golang.org/x/sys/windows/syscall_windows.go
@@ -86,24 +86,13 @@ func StringToUTF16(s string) []uint16 {
 // s, with a terminating NUL added. If s contains a NUL byte at any
 // location, it returns (nil, syscall.EINVAL).
 func UTF16FromString(s string) ([]uint16, error) {
-	for i := 0; i < len(s); i++ {
-		if s[i] == 0 {
-			return nil, syscall.EINVAL
-		}
-	}
-	return utf16.Encode([]rune(s + "\x00")), nil
+	return syscall.UTF16FromString(s)
 }
 
 // UTF16ToString returns the UTF-8 encoding of the UTF-16 sequence s,
 // with a terminating NUL and any bytes after the NUL removed.
 func UTF16ToString(s []uint16) string {
-	for i, v := range s {
-		if v == 0 {
-			s = s[:i]
-			break
-		}
-	}
-	return string(utf16.Decode(s))
+	return syscall.UTF16ToString(s)
 }
 
 // StringToUTF16Ptr is deprecated. Use UTF16PtrFromString instead.
@@ -139,13 +128,7 @@ func UTF16PtrToString(p *uint16) string {
 		ptr = unsafe.Pointer(uintptr(ptr) + unsafe.Sizeof(*p))
 	}
 
-	var s []uint16
-	h := (*unsafeheader.Slice)(unsafe.Pointer(&s))
-	h.Data = unsafe.Pointer(p)
-	h.Len = n
-	h.Cap = n
-
-	return string(utf16.Decode(s))
+	return string(utf16.Decode(unsafe.Slice(p, n)))
 }
 
 func Getpagesize() int { return 4096 }
@@ -186,8 +169,8 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	GetNamedPipeInfo(pipe Handle, flags *uint32, outSize *uint32, inSize *uint32, maxInstances *uint32) (err error)
 //sys	GetNamedPipeHandleState(pipe Handle, state *uint32, curInstances *uint32, maxCollectionCount *uint32, collectDataTimeout *uint32, userName *uint16, maxUserNameSize uint32) (err error) = GetNamedPipeHandleStateW
 //sys	SetNamedPipeHandleState(pipe Handle, state *uint32, maxCollectionCount *uint32, collectDataTimeout *uint32) (err error) = SetNamedPipeHandleState
-//sys	ReadFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error)
-//sys	WriteFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error)
+//sys	readFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error) = ReadFile
+//sys	writeFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error) = WriteFile
 //sys	GetOverlappedResult(handle Handle, overlapped *Overlapped, done *uint32, wait bool) (err error)
 //sys	SetFilePointer(handle Handle, lowoffset int32, highoffsetptr *int32, whence uint32) (newlowoffset uint32, err error) [failretval==0xffffffff]
 //sys	CloseHandle(handle Handle) (err error)
@@ -248,6 +231,7 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	FreeEnvironmentStrings(envs *uint16) (err error) = kernel32.FreeEnvironmentStringsW
 //sys	GetEnvironmentVariable(name *uint16, buffer *uint16, size uint32) (n uint32, err error) = kernel32.GetEnvironmentVariableW
 //sys	SetEnvironmentVariable(name *uint16, value *uint16) (err error) = kernel32.SetEnvironmentVariableW
+//sys	ExpandEnvironmentStrings(src *uint16, dst *uint16, size uint32) (n uint32, err error) = kernel32.ExpandEnvironmentStringsW
 //sys	CreateEnvironmentBlock(block **uint16, token Token, inheritExisting bool) (err error) = userenv.CreateEnvironmentBlock
 //sys	DestroyEnvironmentBlock(block *uint16) (err error) = userenv.DestroyEnvironmentBlock
 //sys	getTickCount64() (ms uint64) = kernel32.GetTickCount64
@@ -322,6 +306,8 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	WriteConsole(console Handle, buf *uint16, towrite uint32, written *uint32, reserved *byte) (err error) = kernel32.WriteConsoleW
 //sys	ReadConsole(console Handle, buf *uint16, toread uint32, read *uint32, inputControl *byte) (err error) = kernel32.ReadConsoleW
 //sys	CreateToolhelp32Snapshot(flags uint32, processId uint32) (handle Handle, err error) [failretval==InvalidHandle] = kernel32.CreateToolhelp32Snapshot
+//sys	Module32First(snapshot Handle, moduleEntry *ModuleEntry32) (err error) = kernel32.Module32FirstW
+//sys	Module32Next(snapshot Handle, moduleEntry *ModuleEntry32) (err error) = kernel32.Module32NextW
 //sys	Process32First(snapshot Handle, procEntry *ProcessEntry32) (err error) = kernel32.Process32FirstW
 //sys	Process32Next(snapshot Handle, procEntry *ProcessEntry32) (err error) = kernel32.Process32NextW
 //sys	Thread32First(snapshot Handle, threadEntry *ThreadEntry32) (err error)
@@ -360,6 +346,18 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	SetProcessWorkingSetSizeEx(hProcess Handle, dwMinimumWorkingSetSize uintptr, dwMaximumWorkingSetSize uintptr, flags uint32) (err error)
 //sys	GetCommTimeouts(handle Handle, timeouts *CommTimeouts) (err error)
 //sys	SetCommTimeouts(handle Handle, timeouts *CommTimeouts) (err error)
+//sys	GetActiveProcessorCount(groupNumber uint16) (ret uint32)
+//sys	GetMaximumProcessorCount(groupNumber uint16) (ret uint32)
+//sys	EnumWindows(enumFunc uintptr, param unsafe.Pointer) (err error) = user32.EnumWindows
+//sys	EnumChildWindows(hwnd HWND, enumFunc uintptr, param unsafe.Pointer) = user32.EnumChildWindows
+//sys	GetClassName(hwnd HWND, className *uint16, maxCount int32) (copied int32, err error) = user32.GetClassNameW
+//sys	GetDesktopWindow() (hwnd HWND) = user32.GetDesktopWindow
+//sys	GetForegroundWindow() (hwnd HWND) = user32.GetForegroundWindow
+//sys	IsWindow(hwnd HWND) (isWindow bool) = user32.IsWindow
+//sys	IsWindowUnicode(hwnd HWND) (isUnicode bool) = user32.IsWindowUnicode
+//sys	IsWindowVisible(hwnd HWND) (isVisible bool) = user32.IsWindowVisible
+//sys	GetGUIThreadInfo(thread uint32, info *GUIThreadInfo) (err error) = user32.GetGUIThreadInfo
+//sys	GetLargePageMinimum() (size uintptr)
 
 // Volume Management Functions
 //sys	DefineDosDevice(flags uint32, deviceName *uint16, targetPath *uint16) (err error) = DefineDosDeviceW
@@ -413,6 +411,7 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	GetModuleInformation(process Handle, module Handle, modinfo *ModuleInfo, cb uint32) (err error) = psapi.GetModuleInformation
 //sys	GetModuleFileNameEx(process Handle, module Handle, filename *uint16, size uint32) (err error) = psapi.GetModuleFileNameExW
 //sys	GetModuleBaseName(process Handle, module Handle, baseName *uint16, size uint32) (err error) = psapi.GetModuleBaseNameW
+//sys   QueryWorkingSetEx(process Handle, pv uintptr, cb uint32) (err error) = psapi.QueryWorkingSetEx
 
 // NT Native APIs
 //sys	rtlNtStatusToDosErrorNoTeb(ntstatus NTStatus) (ret syscall.Errno) = ntdll.RtlNtStatusToDosErrorNoTeb
@@ -434,6 +433,10 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	RtlAddFunctionTable(functionTable *RUNTIME_FUNCTION, entryCount uint32, baseAddress uintptr) (ret bool) = ntdll.RtlAddFunctionTable
 //sys	RtlDeleteFunctionTable(functionTable *RUNTIME_FUNCTION) (ret bool) = ntdll.RtlDeleteFunctionTable
 
+// Desktop Window Manager API (Dwmapi)
+//sys	DwmGetWindowAttribute(hwnd HWND, attribute uint32, value unsafe.Pointer, size uint32) (ret error) = dwmapi.DwmGetWindowAttribute
+//sys	DwmSetWindowAttribute(hwnd HWND, attribute uint32, value unsafe.Pointer, size uint32) (ret error) = dwmapi.DwmSetWindowAttribute
+
 // syscall interface implementation for other packages
 
 // GetCurrentProcess returns the handle for the current process.
@@ -544,12 +547,6 @@ func Read(fd Handle, p []byte) (n int, err error) {
 		}
 		return 0, e
 	}
-	if raceenabled {
-		if done > 0 {
-			raceWriteRange(unsafe.Pointer(&p[0]), int(done))
-		}
-		raceAcquire(unsafe.Pointer(&ioSync))
-	}
 	return int(done), nil
 }
 
@@ -562,12 +559,31 @@ func Write(fd Handle, p []byte) (n int, err error) {
 	if e != nil {
 		return 0, e
 	}
-	if raceenabled && done > 0 {
-		raceReadRange(unsafe.Pointer(&p[0]), int(done))
-	}
 	return int(done), nil
 }
 
+func ReadFile(fd Handle, p []byte, done *uint32, overlapped *Overlapped) error {
+	err := readFile(fd, p, done, overlapped)
+	if raceenabled {
+		if *done > 0 {
+			raceWriteRange(unsafe.Pointer(&p[0]), int(*done))
+		}
+		raceAcquire(unsafe.Pointer(&ioSync))
+	}
+	return err
+}
+
+func WriteFile(fd Handle, p []byte, done *uint32, overlapped *Overlapped) error {
+	if raceenabled {
+		raceReleaseMerge(unsafe.Pointer(&ioSync))
+	}
+	err := writeFile(fd, p, done, overlapped)
+	if raceenabled && *done > 0 {
+		raceReadRange(unsafe.Pointer(&p[0]), int(*done))
+	}
+	return err
+}
+
 var ioSync int64
 
 func Seek(fd Handle, offset int64, whence int) (newoffset int64, err error) {
@@ -606,7 +622,6 @@ var (
 
 func getStdHandle(stdhandle uint32) (fd Handle) {
 	r, _ := GetStdHandle(stdhandle)
-	CloseOnExec(r)
 	return r
 }
 
@@ -731,7 +746,7 @@ func Utimes(path string, tv []Timeval) (err error) {
 	if e != nil {
 		return e
 	}
-	defer Close(h)
+	defer CloseHandle(h)
 	a := NsecToFiletime(tv[0].Nanoseconds())
 	w := NsecToFiletime(tv[1].Nanoseconds())
 	return SetFileTime(h, nil, &a, &w)
@@ -751,7 +766,7 @@ func UtimesNano(path string, ts []Timespec) (err error) {
 	if e != nil {
 		return e
 	}
-	defer Close(h)
+	defer CloseHandle(h)
 	a := NsecToFiletime(TimespecToNsec(ts[0]))
 	w := NsecToFiletime(TimespecToNsec(ts[1]))
 	return SetFileTime(h, nil, &a, &w)
@@ -809,6 +824,9 @@ const socket_error = uintptr(^uint32(0))
 //sys	WSAStartup(verreq uint32, data *WSAData) (sockerr error) = ws2_32.WSAStartup
 //sys	WSACleanup() (err error) [failretval==socket_error] = ws2_32.WSACleanup
 //sys	WSAIoctl(s Handle, iocc uint32, inbuf *byte, cbif uint32, outbuf *byte, cbob uint32, cbbr *uint32, overlapped *Overlapped, completionRoutine uintptr) (err error) [failretval==socket_error] = ws2_32.WSAIoctl
+//sys	WSALookupServiceBegin(querySet *WSAQUERYSET, flags uint32, handle *Handle) (err error) [failretval==socket_error] = ws2_32.WSALookupServiceBeginW
+//sys	WSALookupServiceNext(handle Handle, flags uint32, size *int32, querySet *WSAQUERYSET) (err error) [failretval==socket_error] = ws2_32.WSALookupServiceNextW
+//sys	WSALookupServiceEnd(handle Handle) (err error) [failretval==socket_error] = ws2_32.WSALookupServiceEnd
 //sys	socket(af int32, typ int32, protocol int32) (handle Handle, err error) [failretval==InvalidHandle] = ws2_32.socket
 //sys	sendto(s Handle, buf []byte, flags int32, to unsafe.Pointer, tolen int32) (err error) [failretval==socket_error] = ws2_32.sendto
 //sys	recvfrom(s Handle, buf []byte, flags int32, from *RawSockaddrAny, fromlen *int32) (n int32, err error) [failretval==-1] = ws2_32.recvfrom
@@ -845,6 +863,7 @@ const socket_error = uintptr(^uint32(0))
 //sys	GetAdaptersAddresses(family uint32, flags uint32, reserved uintptr, adapterAddresses *IpAdapterAddresses, sizePointer *uint32) (errcode error) = iphlpapi.GetAdaptersAddresses
 //sys	GetACP() (acp uint32) = kernel32.GetACP
 //sys	MultiByteToWideChar(codePage uint32, dwFlags uint32, str *byte, nstr int32, wchar *uint16, nwchar int32) (nwrite int32, err error) = kernel32.MultiByteToWideChar
+//sys	getBestInterfaceEx(sockaddr unsafe.Pointer, pdwBestIfIndex *uint32) (errcode error) = iphlpapi.GetBestInterfaceEx
 
 // For testing: clients can set this flag to force
 // creation of IPv6 sockets to return EAFNOSUPPORT.
@@ -954,6 +973,32 @@ func (sa *SockaddrUnix) sockaddr() (unsafe.Pointer, int32, error) {
 	return unsafe.Pointer(&sa.raw), sl, nil
 }
 
+type RawSockaddrBth struct {
+	AddressFamily  [2]byte
+	BtAddr         [8]byte
+	ServiceClassId [16]byte
+	Port           [4]byte
+}
+
+type SockaddrBth struct {
+	BtAddr         uint64
+	ServiceClassId GUID
+	Port           uint32
+
+	raw RawSockaddrBth
+}
+
+func (sa *SockaddrBth) sockaddr() (unsafe.Pointer, int32, error) {
+	family := AF_BTH
+	sa.raw = RawSockaddrBth{
+		AddressFamily:  *(*[2]byte)(unsafe.Pointer(&family)),
+		BtAddr:         *(*[8]byte)(unsafe.Pointer(&sa.BtAddr)),
+		Port:           *(*[4]byte)(unsafe.Pointer(&sa.Port)),
+		ServiceClassId: *(*[16]byte)(unsafe.Pointer(&sa.ServiceClassId)),
+	}
+	return unsafe.Pointer(&sa.raw), int32(unsafe.Sizeof(sa.raw)), nil
+}
+
 func (rsa *RawSockaddrAny) Sockaddr() (Sockaddr, error) {
 	switch rsa.Addr.Family {
 	case AF_UNIX:
@@ -977,8 +1022,7 @@ func (rsa *RawSockaddrAny) Sockaddr() (Sockaddr, error) {
 		for n < len(pp.Path) && pp.Path[n] != 0 {
 			n++
 		}
-		bytes := (*[len(pp.Path)]byte)(unsafe.Pointer(&pp.Path[0]))[0:n]
-		sa.Name = string(bytes)
+		sa.Name = string(unsafe.Slice((*byte)(unsafe.Pointer(&pp.Path[0])), n))
 		return sa, nil
 
 	case AF_INET:
@@ -1029,6 +1073,14 @@ func Connect(fd Handle, sa Sockaddr) (err error) {
 	return connect(fd, ptr, n)
 }
 
+func GetBestInterfaceEx(sa Sockaddr, pdwBestIfIndex *uint32) (err error) {
+	ptr, _, err := sa.sockaddr()
+	if err != nil {
+		return err
+	}
+	return getBestInterfaceEx(ptr, pdwBestIfIndex)
+}
+
 func Getsockname(fd Handle) (sa Sockaddr, err error) {
 	var rsa RawSockaddrAny
 	l := int32(unsafe.Sizeof(rsa))
@@ -1056,9 +1108,13 @@ func Shutdown(fd Handle, how int) (err error) {
 }
 
 func WSASendto(s Handle, bufs *WSABuf, bufcnt uint32, sent *uint32, flags uint32, to Sockaddr, overlapped *Overlapped, croutine *byte) (err error) {
-	rsa, l, err := to.sockaddr()
-	if err != nil {
-		return err
+	var rsa unsafe.Pointer
+	var l int32
+	if to != nil {
+		rsa, l, err = to.sockaddr()
+		if err != nil {
+			return err
+		}
 	}
 	return WSASendTo(s, bufs, bufcnt, sent, flags, (*RawSockaddrAny)(unsafe.Pointer(rsa)), l, overlapped, croutine)
 }
@@ -1682,3 +1738,71 @@ func LoadResourceData(module, resInfo Handle) (data []byte, err error) {
 	h.Cap = int(size)
 	return
 }
+
+// PSAPI_WORKING_SET_EX_BLOCK contains extended working set information for a page.
+type PSAPI_WORKING_SET_EX_BLOCK uint64
+
+// Valid returns the validity of this page.
+// If this bit is 1, the subsequent members are valid; otherwise they should be ignored.
+func (b PSAPI_WORKING_SET_EX_BLOCK) Valid() bool {
+	return (b & 1) == 1
+}
+
+// ShareCount is the number of processes that share this page. The maximum value of this member is 7.
+func (b PSAPI_WORKING_SET_EX_BLOCK) ShareCount() uint64 {
+	return b.intField(1, 3)
+}
+
+// Win32Protection is the memory protection attributes of the page. For a list of values, see
+// https://docs.microsoft.com/en-us/windows/win32/memory/memory-protection-constants
+func (b PSAPI_WORKING_SET_EX_BLOCK) Win32Protection() uint64 {
+	return b.intField(4, 11)
+}
+
+// Shared returns the shared status of this page.
+// If this bit is 1, the page can be shared.
+func (b PSAPI_WORKING_SET_EX_BLOCK) Shared() bool {
+	return (b & (1 << 15)) == 1
+}
+
+// Node is the NUMA node. The maximum value of this member is 63.
+func (b PSAPI_WORKING_SET_EX_BLOCK) Node() uint64 {
+	return b.intField(16, 6)
+}
+
+// Locked returns the locked status of this page.
+// If this bit is 1, the virtual page is locked in physical memory.
+func (b PSAPI_WORKING_SET_EX_BLOCK) Locked() bool {
+	return (b & (1 << 22)) == 1
+}
+
+// LargePage returns the large page status of this page.
+// If this bit is 1, the page is a large page.
+func (b PSAPI_WORKING_SET_EX_BLOCK) LargePage() bool {
+	return (b & (1 << 23)) == 1
+}
+
+// Bad returns the bad status of this page.
+// If this bit is 1, the page is has been reported as bad.
+func (b PSAPI_WORKING_SET_EX_BLOCK) Bad() bool {
+	return (b & (1 << 31)) == 1
+}
+
+// intField extracts an integer field in the PSAPI_WORKING_SET_EX_BLOCK union.
+func (b PSAPI_WORKING_SET_EX_BLOCK) intField(start, length int) uint64 {
+	var mask PSAPI_WORKING_SET_EX_BLOCK
+	for pos := start; pos < start+length; pos++ {
+		mask |= (1 << pos)
+	}
+
+	masked := b & mask
+	return uint64(masked >> start)
+}
+
+// PSAPI_WORKING_SET_EX_INFORMATION contains extended working set information for a process.
+type PSAPI_WORKING_SET_EX_INFORMATION struct {
+	// The virtual address.
+	VirtualAddress Pointer
+	// A PSAPI_WORKING_SET_EX_BLOCK union that indicates the attributes of the page at VirtualAddress.
+	VirtualAttributes PSAPI_WORKING_SET_EX_BLOCK
+}
diff --git a/vendor/golang.org/x/sys/windows/types_windows.go b/vendor/golang.org/x/sys/windows/types_windows.go
index 286dd1eab9..88e62a6385 100644
--- a/vendor/golang.org/x/sys/windows/types_windows.go
+++ b/vendor/golang.org/x/sys/windows/types_windows.go
@@ -156,8 +156,14 @@ const (
 	MAX_PATH      = 260
 	MAX_LONG_PATH = 32768
 
+	MAX_MODULE_NAME32 = 255
+
 	MAX_COMPUTERNAME_LENGTH = 15
 
+	MAX_DHCPV6_DUID_LENGTH = 130
+
+	MAX_DNS_SUFFIX_STRING_LENGTH = 256
+
 	TIME_ZONE_ID_UNKNOWN  = 0
 	TIME_ZONE_ID_STANDARD = 1
 
@@ -936,8 +942,8 @@ type StartupInfoEx struct {
 type ProcThreadAttributeList struct{}
 
 type ProcThreadAttributeListContainer struct {
-	data            *ProcThreadAttributeList
-	heapAllocations []uintptr
+	data     *ProcThreadAttributeList
+	pointers []unsafe.Pointer
 }
 
 type ProcessInformation struct {
@@ -970,6 +976,21 @@ type ThreadEntry32 struct {
 	Flags          uint32
 }
 
+type ModuleEntry32 struct {
+	Size         uint32
+	ModuleID     uint32
+	ProcessID    uint32
+	GlblcntUsage uint32
+	ProccntUsage uint32
+	ModBaseAddr  uintptr
+	ModBaseSize  uint32
+	ModuleHandle Handle
+	Module       [MAX_MODULE_NAME32 + 1]uint16
+	ExePath      [MAX_PATH]uint16
+}
+
+const SizeofModuleEntry32 = unsafe.Sizeof(ModuleEntry32{})
+
 type Systemtime struct {
 	Year         uint16
 	Month        uint16
@@ -1222,6 +1243,51 @@ const (
 	DnsSectionAdditional = 0x0003
 )
 
+const (
+	// flags of WSALookupService
+	LUP_DEEP                = 0x0001
+	LUP_CONTAINERS          = 0x0002
+	LUP_NOCONTAINERS        = 0x0004
+	LUP_NEAREST             = 0x0008
+	LUP_RETURN_NAME         = 0x0010
+	LUP_RETURN_TYPE         = 0x0020
+	LUP_RETURN_VERSION      = 0x0040
+	LUP_RETURN_COMMENT      = 0x0080
+	LUP_RETURN_ADDR         = 0x0100
+	LUP_RETURN_BLOB         = 0x0200
+	LUP_RETURN_ALIASES      = 0x0400
+	LUP_RETURN_QUERY_STRING = 0x0800
+	LUP_RETURN_ALL          = 0x0FF0
+	LUP_RES_SERVICE         = 0x8000
+
+	LUP_FLUSHCACHE    = 0x1000
+	LUP_FLUSHPREVIOUS = 0x2000
+
+	LUP_NON_AUTHORITATIVE      = 0x4000
+	LUP_SECURE                 = 0x8000
+	LUP_RETURN_PREFERRED_NAMES = 0x10000
+	LUP_DNS_ONLY               = 0x20000
+
+	LUP_ADDRCONFIG           = 0x100000
+	LUP_DUAL_ADDR            = 0x200000
+	LUP_FILESERVER           = 0x400000
+	LUP_DISABLE_IDN_ENCODING = 0x00800000
+	LUP_API_ANSI             = 0x01000000
+
+	LUP_RESOLUTION_HANDLE = 0x80000000
+)
+
+const (
+	// values of WSAQUERYSET's namespace
+	NS_ALL       = 0
+	NS_DNS       = 12
+	NS_NLA       = 15
+	NS_BTH       = 16
+	NS_EMAIL     = 37
+	NS_PNRPNAME  = 38
+	NS_PNRPCLOUD = 39
+)
+
 type DNSSRVData struct {
 	Target   *uint16
 	Priority uint16
@@ -1983,27 +2049,62 @@ type IpAdapterPrefix struct {
 }
 
 type IpAdapterAddresses struct {
-	Length                uint32
-	IfIndex               uint32
-	Next                  *IpAdapterAddresses
-	AdapterName           *byte
-	FirstUnicastAddress   *IpAdapterUnicastAddress
-	FirstAnycastAddress   *IpAdapterAnycastAddress
-	FirstMulticastAddress *IpAdapterMulticastAddress
-	FirstDnsServerAddress *IpAdapterDnsServerAdapter
-	DnsSuffix             *uint16
-	Description           *uint16
-	FriendlyName          *uint16
-	PhysicalAddress       [syscall.MAX_ADAPTER_ADDRESS_LENGTH]byte
-	PhysicalAddressLength uint32
-	Flags                 uint32
-	Mtu                   uint32
-	IfType                uint32
-	OperStatus            uint32
-	Ipv6IfIndex           uint32
-	ZoneIndices           [16]uint32
-	FirstPrefix           *IpAdapterPrefix
-	/* more fields might be present here. */
+	Length                 uint32
+	IfIndex                uint32
+	Next                   *IpAdapterAddresses
+	AdapterName            *byte
+	FirstUnicastAddress    *IpAdapterUnicastAddress
+	FirstAnycastAddress    *IpAdapterAnycastAddress
+	FirstMulticastAddress  *IpAdapterMulticastAddress
+	FirstDnsServerAddress  *IpAdapterDnsServerAdapter
+	DnsSuffix              *uint16
+	Description            *uint16
+	FriendlyName           *uint16
+	PhysicalAddress        [syscall.MAX_ADAPTER_ADDRESS_LENGTH]byte
+	PhysicalAddressLength  uint32
+	Flags                  uint32
+	Mtu                    uint32
+	IfType                 uint32
+	OperStatus             uint32
+	Ipv6IfIndex            uint32
+	ZoneIndices            [16]uint32
+	FirstPrefix            *IpAdapterPrefix
+	TransmitLinkSpeed      uint64
+	ReceiveLinkSpeed       uint64
+	FirstWinsServerAddress *IpAdapterWinsServerAddress
+	FirstGatewayAddress    *IpAdapterGatewayAddress
+	Ipv4Metric             uint32
+	Ipv6Metric             uint32
+	Luid                   uint64
+	Dhcpv4Server           SocketAddress
+	CompartmentId          uint32
+	NetworkGuid            GUID
+	ConnectionType         uint32
+	TunnelType             uint32
+	Dhcpv6Server           SocketAddress
+	Dhcpv6ClientDuid       [MAX_DHCPV6_DUID_LENGTH]byte
+	Dhcpv6ClientDuidLength uint32
+	Dhcpv6Iaid             uint32
+	FirstDnsSuffix         *IpAdapterDNSSuffix
+}
+
+type IpAdapterWinsServerAddress struct {
+	Length   uint32
+	Reserved uint32
+	Next     *IpAdapterWinsServerAddress
+	Address  SocketAddress
+}
+
+type IpAdapterGatewayAddress struct {
+	Length   uint32
+	Reserved uint32
+	Next     *IpAdapterGatewayAddress
+	Address  SocketAddress
+}
+
+type IpAdapterDNSSuffix struct {
+	Next   *IpAdapterDNSSuffix
+	String [MAX_DNS_SUFFIX_STRING_LENGTH]uint16
 }
 
 const (
@@ -2119,19 +2220,23 @@ type JOBOBJECT_BASIC_UI_RESTRICTIONS struct {
 }
 
 const (
-	// JobObjectInformationClass
+	// JobObjectInformationClass for QueryInformationJobObject and SetInformationJobObject
 	JobObjectAssociateCompletionPortInformation = 7
+	JobObjectBasicAccountingInformation         = 1
+	JobObjectBasicAndIoAccountingInformation    = 8
 	JobObjectBasicLimitInformation              = 2
+	JobObjectBasicProcessIdList                 = 3
 	JobObjectBasicUIRestrictions                = 4
 	JobObjectCpuRateControlInformation          = 15
 	JobObjectEndOfJobTimeInformation            = 6
 	JobObjectExtendedLimitInformation           = 9
 	JobObjectGroupInformation                   = 11
 	JobObjectGroupInformationEx                 = 14
-	JobObjectLimitViolationInformation2         = 35
+	JobObjectLimitViolationInformation          = 13
+	JobObjectLimitViolationInformation2         = 34
 	JobObjectNetRateControlInformation          = 32
 	JobObjectNotificationLimitInformation       = 12
-	JobObjectNotificationLimitInformation2      = 34
+	JobObjectNotificationLimitInformation2      = 33
 	JobObjectSecurityLimitInformation           = 5
 )
 
@@ -2732,6 +2837,43 @@ type PROCESS_BASIC_INFORMATION struct {
 	InheritedFromUniqueProcessId uintptr
 }
 
+type SYSTEM_PROCESS_INFORMATION struct {
+	NextEntryOffset              uint32
+	NumberOfThreads              uint32
+	WorkingSetPrivateSize        int64
+	HardFaultCount               uint32
+	NumberOfThreadsHighWatermark uint32
+	CycleTime                    uint64
+	CreateTime                   int64
+	UserTime                     int64
+	KernelTime                   int64
+	ImageName                    NTUnicodeString
+	BasePriority                 int32
+	UniqueProcessID              uintptr
+	InheritedFromUniqueProcessID uintptr
+	HandleCount                  uint32
+	SessionID                    uint32
+	UniqueProcessKey             *uint32
+	PeakVirtualSize              uintptr
+	VirtualSize                  uintptr
+	PageFaultCount               uint32
+	PeakWorkingSetSize           uintptr
+	WorkingSetSize               uintptr
+	QuotaPeakPagedPoolUsage      uintptr
+	QuotaPagedPoolUsage          uintptr
+	QuotaPeakNonPagedPoolUsage   uintptr
+	QuotaNonPagedPoolUsage       uintptr
+	PagefileUsage                uintptr
+	PeakPagefileUsage            uintptr
+	PrivatePageCount             uintptr
+	ReadOperationCount           int64
+	WriteOperationCount          int64
+	OtherOperationCount          int64
+	ReadTransferCount            int64
+	WriteTransferCount           int64
+	OtherTransferCount           int64
+}
+
 // SystemInformationClasses for NtQuerySystemInformation and NtSetSystemInformation
 const (
 	SystemBasicInformation = iota
@@ -3118,3 +3260,90 @@ type ModuleInfo struct {
 	SizeOfImage uint32
 	EntryPoint  uintptr
 }
+
+const ALL_PROCESSOR_GROUPS = 0xFFFF
+
+type Rect struct {
+	Left   int32
+	Top    int32
+	Right  int32
+	Bottom int32
+}
+
+type GUIThreadInfo struct {
+	Size        uint32
+	Flags       uint32
+	Active      HWND
+	Focus       HWND
+	Capture     HWND
+	MenuOwner   HWND
+	MoveSize    HWND
+	CaretHandle HWND
+	CaretRect   Rect
+}
+
+const (
+	DWMWA_NCRENDERING_ENABLED            = 1
+	DWMWA_NCRENDERING_POLICY             = 2
+	DWMWA_TRANSITIONS_FORCEDISABLED      = 3
+	DWMWA_ALLOW_NCPAINT                  = 4
+	DWMWA_CAPTION_BUTTON_BOUNDS          = 5
+	DWMWA_NONCLIENT_RTL_LAYOUT           = 6
+	DWMWA_FORCE_ICONIC_REPRESENTATION    = 7
+	DWMWA_FLIP3D_POLICY                  = 8
+	DWMWA_EXTENDED_FRAME_BOUNDS          = 9
+	DWMWA_HAS_ICONIC_BITMAP              = 10
+	DWMWA_DISALLOW_PEEK                  = 11
+	DWMWA_EXCLUDED_FROM_PEEK             = 12
+	DWMWA_CLOAK                          = 13
+	DWMWA_CLOAKED                        = 14
+	DWMWA_FREEZE_REPRESENTATION          = 15
+	DWMWA_PASSIVE_UPDATE_MODE            = 16
+	DWMWA_USE_HOSTBACKDROPBRUSH          = 17
+	DWMWA_USE_IMMERSIVE_DARK_MODE        = 20
+	DWMWA_WINDOW_CORNER_PREFERENCE       = 33
+	DWMWA_BORDER_COLOR                   = 34
+	DWMWA_CAPTION_COLOR                  = 35
+	DWMWA_TEXT_COLOR                     = 36
+	DWMWA_VISIBLE_FRAME_BORDER_THICKNESS = 37
+)
+
+type WSAQUERYSET struct {
+	Size                uint32
+	ServiceInstanceName *uint16
+	ServiceClassId      *GUID
+	Version             *WSAVersion
+	Comment             *uint16
+	NameSpace           uint32
+	NSProviderId        *GUID
+	Context             *uint16
+	NumberOfProtocols   uint32
+	AfpProtocols        *AFProtocols
+	QueryString         *uint16
+	NumberOfCsAddrs     uint32
+	SaBuffer            *CSAddrInfo
+	OutputFlags         uint32
+	Blob                *BLOB
+}
+
+type WSAVersion struct {
+	Version                 uint32
+	EnumerationOfComparison int32
+}
+
+type AFProtocols struct {
+	AddressFamily int32
+	Protocol      int32
+}
+
+type CSAddrInfo struct {
+	LocalAddr  SocketAddress
+	RemoteAddr SocketAddress
+	SocketType int32
+	Protocol   int32
+}
+
+type BLOB struct {
+	Size     uint32
+	BlobData *byte
+}
diff --git a/vendor/golang.org/x/sys/windows/zsyscall_windows.go b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
index 91817d6dcb..a81ea2c700 100644
--- a/vendor/golang.org/x/sys/windows/zsyscall_windows.go
+++ b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
@@ -36,9 +36,11 @@ func errnoErr(e syscall.Errno) error {
 }
 
 var (
+	modCfgMgr32 = NewLazySystemDLL("CfgMgr32.dll")
 	modadvapi32 = NewLazySystemDLL("advapi32.dll")
 	modcrypt32  = NewLazySystemDLL("crypt32.dll")
 	moddnsapi   = NewLazySystemDLL("dnsapi.dll")
+	moddwmapi   = NewLazySystemDLL("dwmapi.dll")
 	modiphlpapi = NewLazySystemDLL("iphlpapi.dll")
 	modkernel32 = NewLazySystemDLL("kernel32.dll")
 	modmswsock  = NewLazySystemDLL("mswsock.dll")
@@ -48,6 +50,7 @@ var (
 	modpsapi    = NewLazySystemDLL("psapi.dll")
 	modsechost  = NewLazySystemDLL("sechost.dll")
 	modsecur32  = NewLazySystemDLL("secur32.dll")
+	modsetupapi = NewLazySystemDLL("setupapi.dll")
 	modshell32  = NewLazySystemDLL("shell32.dll")
 	moduser32   = NewLazySystemDLL("user32.dll")
 	moduserenv  = NewLazySystemDLL("userenv.dll")
@@ -56,6 +59,10 @@ var (
 	modws2_32   = NewLazySystemDLL("ws2_32.dll")
 	modwtsapi32 = NewLazySystemDLL("wtsapi32.dll")
 
+	procCM_Get_DevNode_Status                                = modCfgMgr32.NewProc("CM_Get_DevNode_Status")
+	procCM_Get_Device_Interface_ListW                        = modCfgMgr32.NewProc("CM_Get_Device_Interface_ListW")
+	procCM_Get_Device_Interface_List_SizeW                   = modCfgMgr32.NewProc("CM_Get_Device_Interface_List_SizeW")
+	procCM_MapCrToWin32Err                                   = modCfgMgr32.NewProc("CM_MapCrToWin32Err")
 	procAdjustTokenGroups                                    = modadvapi32.NewProc("AdjustTokenGroups")
 	procAdjustTokenPrivileges                                = modadvapi32.NewProc("AdjustTokenPrivileges")
 	procAllocateAndInitializeSid                             = modadvapi32.NewProc("AllocateAndInitializeSid")
@@ -79,6 +86,7 @@ var (
 	procDeleteService                                        = modadvapi32.NewProc("DeleteService")
 	procDeregisterEventSource                                = modadvapi32.NewProc("DeregisterEventSource")
 	procDuplicateTokenEx                                     = modadvapi32.NewProc("DuplicateTokenEx")
+	procEnumDependentServicesW                               = modadvapi32.NewProc("EnumDependentServicesW")
 	procEnumServicesStatusExW                                = modadvapi32.NewProc("EnumServicesStatusExW")
 	procEqualSid                                             = modadvapi32.NewProc("EqualSid")
 	procFreeSid                                              = modadvapi32.NewProc("FreeSid")
@@ -169,8 +177,11 @@ var (
 	procDnsNameCompare_W                                     = moddnsapi.NewProc("DnsNameCompare_W")
 	procDnsQuery_W                                           = moddnsapi.NewProc("DnsQuery_W")
 	procDnsRecordListFree                                    = moddnsapi.NewProc("DnsRecordListFree")
+	procDwmGetWindowAttribute                                = moddwmapi.NewProc("DwmGetWindowAttribute")
+	procDwmSetWindowAttribute                                = moddwmapi.NewProc("DwmSetWindowAttribute")
 	procGetAdaptersAddresses                                 = modiphlpapi.NewProc("GetAdaptersAddresses")
 	procGetAdaptersInfo                                      = modiphlpapi.NewProc("GetAdaptersInfo")
+	procGetBestInterfaceEx                                   = modiphlpapi.NewProc("GetBestInterfaceEx")
 	procGetIfEntry                                           = modiphlpapi.NewProc("GetIfEntry")
 	procAssignProcessToJobObject                             = modkernel32.NewProc("AssignProcessToJobObject")
 	procCancelIo                                             = modkernel32.NewProc("CancelIo")
@@ -199,6 +210,7 @@ var (
 	procDeviceIoControl                                      = modkernel32.NewProc("DeviceIoControl")
 	procDuplicateHandle                                      = modkernel32.NewProc("DuplicateHandle")
 	procExitProcess                                          = modkernel32.NewProc("ExitProcess")
+	procExpandEnvironmentStringsW                            = modkernel32.NewProc("ExpandEnvironmentStringsW")
 	procFindClose                                            = modkernel32.NewProc("FindClose")
 	procFindCloseChangeNotification                          = modkernel32.NewProc("FindCloseChangeNotification")
 	procFindFirstChangeNotificationW                         = modkernel32.NewProc("FindFirstChangeNotificationW")
@@ -219,6 +231,7 @@ var (
 	procFreeLibrary                                          = modkernel32.NewProc("FreeLibrary")
 	procGenerateConsoleCtrlEvent                             = modkernel32.NewProc("GenerateConsoleCtrlEvent")
 	procGetACP                                               = modkernel32.NewProc("GetACP")
+	procGetActiveProcessorCount                              = modkernel32.NewProc("GetActiveProcessorCount")
 	procGetCommTimeouts                                      = modkernel32.NewProc("GetCommTimeouts")
 	procGetCommandLineW                                      = modkernel32.NewProc("GetCommandLineW")
 	procGetComputerNameExW                                   = modkernel32.NewProc("GetComputerNameExW")
@@ -240,10 +253,12 @@ var (
 	procGetFileType                                          = modkernel32.NewProc("GetFileType")
 	procGetFinalPathNameByHandleW                            = modkernel32.NewProc("GetFinalPathNameByHandleW")
 	procGetFullPathNameW                                     = modkernel32.NewProc("GetFullPathNameW")
+	procGetLargePageMinimum                                  = modkernel32.NewProc("GetLargePageMinimum")
 	procGetLastError                                         = modkernel32.NewProc("GetLastError")
 	procGetLogicalDriveStringsW                              = modkernel32.NewProc("GetLogicalDriveStringsW")
 	procGetLogicalDrives                                     = modkernel32.NewProc("GetLogicalDrives")
 	procGetLongPathNameW                                     = modkernel32.NewProc("GetLongPathNameW")
+	procGetMaximumProcessorCount                             = modkernel32.NewProc("GetMaximumProcessorCount")
 	procGetModuleFileNameW                                   = modkernel32.NewProc("GetModuleFileNameW")
 	procGetModuleHandleExW                                   = modkernel32.NewProc("GetModuleHandleExW")
 	procGetNamedPipeHandleStateW                             = modkernel32.NewProc("GetNamedPipeHandleStateW")
@@ -288,6 +303,8 @@ var (
 	procLockFileEx                                           = modkernel32.NewProc("LockFileEx")
 	procLockResource                                         = modkernel32.NewProc("LockResource")
 	procMapViewOfFile                                        = modkernel32.NewProc("MapViewOfFile")
+	procModule32FirstW                                       = modkernel32.NewProc("Module32FirstW")
+	procModule32NextW                                        = modkernel32.NewProc("Module32NextW")
 	procMoveFileExW                                          = modkernel32.NewProc("MoveFileExW")
 	procMoveFileW                                            = modkernel32.NewProc("MoveFileW")
 	procMultiByteToWideChar                                  = modkernel32.NewProc("MultiByteToWideChar")
@@ -396,16 +413,54 @@ var (
 	procGetModuleBaseNameW                                   = modpsapi.NewProc("GetModuleBaseNameW")
 	procGetModuleFileNameExW                                 = modpsapi.NewProc("GetModuleFileNameExW")
 	procGetModuleInformation                                 = modpsapi.NewProc("GetModuleInformation")
+	procQueryWorkingSetEx                                    = modpsapi.NewProc("QueryWorkingSetEx")
 	procSubscribeServiceChangeNotifications                  = modsechost.NewProc("SubscribeServiceChangeNotifications")
 	procUnsubscribeServiceChangeNotifications                = modsechost.NewProc("UnsubscribeServiceChangeNotifications")
 	procGetUserNameExW                                       = modsecur32.NewProc("GetUserNameExW")
 	procTranslateNameW                                       = modsecur32.NewProc("TranslateNameW")
+	procSetupDiBuildDriverInfoList                           = modsetupapi.NewProc("SetupDiBuildDriverInfoList")
+	procSetupDiCallClassInstaller                            = modsetupapi.NewProc("SetupDiCallClassInstaller")
+	procSetupDiCancelDriverInfoSearch                        = modsetupapi.NewProc("SetupDiCancelDriverInfoSearch")
+	procSetupDiClassGuidsFromNameExW                         = modsetupapi.NewProc("SetupDiClassGuidsFromNameExW")
+	procSetupDiClassNameFromGuidExW                          = modsetupapi.NewProc("SetupDiClassNameFromGuidExW")
+	procSetupDiCreateDeviceInfoListExW                       = modsetupapi.NewProc("SetupDiCreateDeviceInfoListExW")
+	procSetupDiCreateDeviceInfoW                             = modsetupapi.NewProc("SetupDiCreateDeviceInfoW")
+	procSetupDiDestroyDeviceInfoList                         = modsetupapi.NewProc("SetupDiDestroyDeviceInfoList")
+	procSetupDiDestroyDriverInfoList                         = modsetupapi.NewProc("SetupDiDestroyDriverInfoList")
+	procSetupDiEnumDeviceInfo                                = modsetupapi.NewProc("SetupDiEnumDeviceInfo")
+	procSetupDiEnumDriverInfoW                               = modsetupapi.NewProc("SetupDiEnumDriverInfoW")
+	procSetupDiGetClassDevsExW                               = modsetupapi.NewProc("SetupDiGetClassDevsExW")
+	procSetupDiGetClassInstallParamsW                        = modsetupapi.NewProc("SetupDiGetClassInstallParamsW")
+	procSetupDiGetDeviceInfoListDetailW                      = modsetupapi.NewProc("SetupDiGetDeviceInfoListDetailW")
+	procSetupDiGetDeviceInstallParamsW                       = modsetupapi.NewProc("SetupDiGetDeviceInstallParamsW")
+	procSetupDiGetDeviceInstanceIdW                          = modsetupapi.NewProc("SetupDiGetDeviceInstanceIdW")
+	procSetupDiGetDevicePropertyW                            = modsetupapi.NewProc("SetupDiGetDevicePropertyW")
+	procSetupDiGetDeviceRegistryPropertyW                    = modsetupapi.NewProc("SetupDiGetDeviceRegistryPropertyW")
+	procSetupDiGetDriverInfoDetailW                          = modsetupapi.NewProc("SetupDiGetDriverInfoDetailW")
+	procSetupDiGetSelectedDevice                             = modsetupapi.NewProc("SetupDiGetSelectedDevice")
+	procSetupDiGetSelectedDriverW                            = modsetupapi.NewProc("SetupDiGetSelectedDriverW")
+	procSetupDiOpenDevRegKey                                 = modsetupapi.NewProc("SetupDiOpenDevRegKey")
+	procSetupDiSetClassInstallParamsW                        = modsetupapi.NewProc("SetupDiSetClassInstallParamsW")
+	procSetupDiSetDeviceInstallParamsW                       = modsetupapi.NewProc("SetupDiSetDeviceInstallParamsW")
+	procSetupDiSetDeviceRegistryPropertyW                    = modsetupapi.NewProc("SetupDiSetDeviceRegistryPropertyW")
+	procSetupDiSetSelectedDevice                             = modsetupapi.NewProc("SetupDiSetSelectedDevice")
+	procSetupDiSetSelectedDriverW                            = modsetupapi.NewProc("SetupDiSetSelectedDriverW")
+	procSetupUninstallOEMInfW                                = modsetupapi.NewProc("SetupUninstallOEMInfW")
 	procCommandLineToArgvW                                   = modshell32.NewProc("CommandLineToArgvW")
 	procSHGetKnownFolderPath                                 = modshell32.NewProc("SHGetKnownFolderPath")
 	procShellExecuteW                                        = modshell32.NewProc("ShellExecuteW")
+	procEnumChildWindows                                     = moduser32.NewProc("EnumChildWindows")
+	procEnumWindows                                          = moduser32.NewProc("EnumWindows")
 	procExitWindowsEx                                        = moduser32.NewProc("ExitWindowsEx")
+	procGetClassNameW                                        = moduser32.NewProc("GetClassNameW")
+	procGetDesktopWindow                                     = moduser32.NewProc("GetDesktopWindow")
+	procGetForegroundWindow                                  = moduser32.NewProc("GetForegroundWindow")
+	procGetGUIThreadInfo                                     = moduser32.NewProc("GetGUIThreadInfo")
 	procGetShellWindow                                       = moduser32.NewProc("GetShellWindow")
 	procGetWindowThreadProcessId                             = moduser32.NewProc("GetWindowThreadProcessId")
+	procIsWindow                                             = moduser32.NewProc("IsWindow")
+	procIsWindowUnicode                                      = moduser32.NewProc("IsWindowUnicode")
+	procIsWindowVisible                                      = moduser32.NewProc("IsWindowVisible")
 	procMessageBoxW                                          = moduser32.NewProc("MessageBoxW")
 	procCreateEnvironmentBlock                               = moduserenv.NewProc("CreateEnvironmentBlock")
 	procDestroyEnvironmentBlock                              = moduserenv.NewProc("DestroyEnvironmentBlock")
@@ -420,6 +475,9 @@ var (
 	procWSAEnumProtocolsW                                    = modws2_32.NewProc("WSAEnumProtocolsW")
 	procWSAGetOverlappedResult                               = modws2_32.NewProc("WSAGetOverlappedResult")
 	procWSAIoctl                                             = modws2_32.NewProc("WSAIoctl")
+	procWSALookupServiceBeginW                               = modws2_32.NewProc("WSALookupServiceBeginW")
+	procWSALookupServiceEnd                                  = modws2_32.NewProc("WSALookupServiceEnd")
+	procWSALookupServiceNextW                                = modws2_32.NewProc("WSALookupServiceNextW")
 	procWSARecv                                              = modws2_32.NewProc("WSARecv")
 	procWSARecvFrom                                          = modws2_32.NewProc("WSARecvFrom")
 	procWSASend                                              = modws2_32.NewProc("WSASend")
@@ -447,6 +505,30 @@ var (
 	procWTSQueryUserToken                                    = modwtsapi32.NewProc("WTSQueryUserToken")
 )
 
+func cm_Get_DevNode_Status(status *uint32, problemNumber *uint32, devInst DEVINST, flags uint32) (ret CONFIGRET) {
+	r0, _, _ := syscall.Syscall6(procCM_Get_DevNode_Status.Addr(), 4, uintptr(unsafe.Pointer(status)), uintptr(unsafe.Pointer(problemNumber)), uintptr(devInst), uintptr(flags), 0, 0)
+	ret = CONFIGRET(r0)
+	return
+}
+
+func cm_Get_Device_Interface_List(interfaceClass *GUID, deviceID *uint16, buffer *uint16, bufferLen uint32, flags uint32) (ret CONFIGRET) {
+	r0, _, _ := syscall.Syscall6(procCM_Get_Device_Interface_ListW.Addr(), 5, uintptr(unsafe.Pointer(interfaceClass)), uintptr(unsafe.Pointer(deviceID)), uintptr(unsafe.Pointer(buffer)), uintptr(bufferLen), uintptr(flags), 0)
+	ret = CONFIGRET(r0)
+	return
+}
+
+func cm_Get_Device_Interface_List_Size(len *uint32, interfaceClass *GUID, deviceID *uint16, flags uint32) (ret CONFIGRET) {
+	r0, _, _ := syscall.Syscall6(procCM_Get_Device_Interface_List_SizeW.Addr(), 4, uintptr(unsafe.Pointer(len)), uintptr(unsafe.Pointer(interfaceClass)), uintptr(unsafe.Pointer(deviceID)), uintptr(flags), 0, 0)
+	ret = CONFIGRET(r0)
+	return
+}
+
+func cm_MapCrToWin32Err(configRet CONFIGRET, defaultWin32Error Errno) (ret Errno) {
+	r0, _, _ := syscall.Syscall(procCM_MapCrToWin32Err.Addr(), 2, uintptr(configRet), uintptr(defaultWin32Error), 0)
+	ret = Errno(r0)
+	return
+}
+
 func AdjustTokenGroups(token Token, resetToDefault bool, newstate *Tokengroups, buflen uint32, prevstate *Tokengroups, returnlen *uint32) (err error) {
 	var _p0 uint32
 	if resetToDefault {
@@ -653,6 +735,14 @@ func DuplicateTokenEx(existingToken Token, desiredAccess uint32, tokenAttributes
 	return
 }
 
+func EnumDependentServices(service Handle, activityState uint32, services *ENUM_SERVICE_STATUS, buffSize uint32, bytesNeeded *uint32, servicesReturned *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procEnumDependentServicesW.Addr(), 6, uintptr(service), uintptr(activityState), uintptr(unsafe.Pointer(services)), uintptr(buffSize), uintptr(unsafe.Pointer(bytesNeeded)), uintptr(unsafe.Pointer(servicesReturned)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func EnumServicesStatusEx(mgr Handle, infoLevel uint32, serviceType uint32, serviceState uint32, services *byte, bufSize uint32, bytesNeeded *uint32, servicesReturned *uint32, resumeHandle *uint32, groupName *uint16) (err error) {
 	r1, _, e1 := syscall.Syscall12(procEnumServicesStatusExW.Addr(), 10, uintptr(mgr), uintptr(infoLevel), uintptr(serviceType), uintptr(serviceState), uintptr(unsafe.Pointer(services)), uintptr(bufSize), uintptr(unsafe.Pointer(bytesNeeded)), uintptr(unsafe.Pointer(servicesReturned)), uintptr(unsafe.Pointer(resumeHandle)), uintptr(unsafe.Pointer(groupName)), 0, 0)
 	if r1 == 0 {
@@ -1460,6 +1550,22 @@ func DnsRecordListFree(rl *DNSRecord, freetype uint32) {
 	return
 }
 
+func DwmGetWindowAttribute(hwnd HWND, attribute uint32, value unsafe.Pointer, size uint32) (ret error) {
+	r0, _, _ := syscall.Syscall6(procDwmGetWindowAttribute.Addr(), 4, uintptr(hwnd), uintptr(attribute), uintptr(value), uintptr(size), 0, 0)
+	if r0 != 0 {
+		ret = syscall.Errno(r0)
+	}
+	return
+}
+
+func DwmSetWindowAttribute(hwnd HWND, attribute uint32, value unsafe.Pointer, size uint32) (ret error) {
+	r0, _, _ := syscall.Syscall6(procDwmSetWindowAttribute.Addr(), 4, uintptr(hwnd), uintptr(attribute), uintptr(value), uintptr(size), 0, 0)
+	if r0 != 0 {
+		ret = syscall.Errno(r0)
+	}
+	return
+}
+
 func GetAdaptersAddresses(family uint32, flags uint32, reserved uintptr, adapterAddresses *IpAdapterAddresses, sizePointer *uint32) (errcode error) {
 	r0, _, _ := syscall.Syscall6(procGetAdaptersAddresses.Addr(), 5, uintptr(family), uintptr(flags), uintptr(reserved), uintptr(unsafe.Pointer(adapterAddresses)), uintptr(unsafe.Pointer(sizePointer)), 0)
 	if r0 != 0 {
@@ -1476,6 +1582,14 @@ func GetAdaptersInfo(ai *IpAdapterInfo, ol *uint32) (errcode error) {
 	return
 }
 
+func getBestInterfaceEx(sockaddr unsafe.Pointer, pdwBestIfIndex *uint32) (errcode error) {
+	r0, _, _ := syscall.Syscall(procGetBestInterfaceEx.Addr(), 2, uintptr(sockaddr), uintptr(unsafe.Pointer(pdwBestIfIndex)), 0)
+	if r0 != 0 {
+		errcode = syscall.Errno(r0)
+	}
+	return
+}
+
 func GetIfEntry(pIfRow *MibIfRow) (errcode error) {
 	r0, _, _ := syscall.Syscall(procGetIfEntry.Addr(), 1, uintptr(unsafe.Pointer(pIfRow)), 0, 0)
 	if r0 != 0 {
@@ -1716,6 +1830,15 @@ func ExitProcess(exitcode uint32) {
 	return
 }
 
+func ExpandEnvironmentStrings(src *uint16, dst *uint16, size uint32) (n uint32, err error) {
+	r0, _, e1 := syscall.Syscall(procExpandEnvironmentStringsW.Addr(), 3, uintptr(unsafe.Pointer(src)), uintptr(unsafe.Pointer(dst)), uintptr(size))
+	n = uint32(r0)
+	if n == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func FindClose(handle Handle) (err error) {
 	r1, _, e1 := syscall.Syscall(procFindClose.Addr(), 1, uintptr(handle), 0, 0)
 	if r1 == 0 {
@@ -1897,6 +2020,12 @@ func GetACP() (acp uint32) {
 	return
 }
 
+func GetActiveProcessorCount(groupNumber uint16) (ret uint32) {
+	r0, _, _ := syscall.Syscall(procGetActiveProcessorCount.Addr(), 1, uintptr(groupNumber), 0, 0)
+	ret = uint32(r0)
+	return
+}
+
 func GetCommTimeouts(handle Handle, timeouts *CommTimeouts) (err error) {
 	r1, _, e1 := syscall.Syscall(procGetCommTimeouts.Addr(), 2, uintptr(handle), uintptr(unsafe.Pointer(timeouts)), 0)
 	if r1 == 0 {
@@ -2064,6 +2193,12 @@ func GetFullPathName(path *uint16, buflen uint32, buf *uint16, fname **uint16) (
 	return
 }
 
+func GetLargePageMinimum() (size uintptr) {
+	r0, _, _ := syscall.Syscall(procGetLargePageMinimum.Addr(), 0, 0, 0, 0)
+	size = uintptr(r0)
+	return
+}
+
 func GetLastError() (lasterr error) {
 	r0, _, _ := syscall.Syscall(procGetLastError.Addr(), 0, 0, 0, 0)
 	if r0 != 0 {
@@ -2099,6 +2234,12 @@ func GetLongPathName(path *uint16, buf *uint16, buflen uint32) (n uint32, err er
 	return
 }
 
+func GetMaximumProcessorCount(groupNumber uint16) (ret uint32) {
+	r0, _, _ := syscall.Syscall(procGetMaximumProcessorCount.Addr(), 1, uintptr(groupNumber), 0, 0)
+	ret = uint32(r0)
+	return
+}
+
 func GetModuleFileName(module Handle, filename *uint16, size uint32) (n uint32, err error) {
 	r0, _, e1 := syscall.Syscall(procGetModuleFileNameW.Addr(), 3, uintptr(module), uintptr(unsafe.Pointer(filename)), uintptr(size))
 	n = uint32(r0)
@@ -2499,6 +2640,22 @@ func MapViewOfFile(handle Handle, access uint32, offsetHigh uint32, offsetLow ui
 	return
 }
 
+func Module32First(snapshot Handle, moduleEntry *ModuleEntry32) (err error) {
+	r1, _, e1 := syscall.Syscall(procModule32FirstW.Addr(), 2, uintptr(snapshot), uintptr(unsafe.Pointer(moduleEntry)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func Module32Next(snapshot Handle, moduleEntry *ModuleEntry32) (err error) {
+	r1, _, e1 := syscall.Syscall(procModule32NextW.Addr(), 2, uintptr(snapshot), uintptr(unsafe.Pointer(moduleEntry)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func MoveFileEx(from *uint16, to *uint16, flags uint32) (err error) {
 	r1, _, e1 := syscall.Syscall(procMoveFileExW.Addr(), 3, uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(to)), uintptr(flags))
 	if r1 == 0 {
@@ -2661,7 +2818,7 @@ func ReadDirectoryChanges(handle Handle, buf *byte, buflen uint32, watchSubTree
 	return
 }
 
-func ReadFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error) {
+func readFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error) {
 	var _p0 *byte
 	if len(buf) > 0 {
 		_p0 = &buf[0]
@@ -3103,7 +3260,7 @@ func WriteConsole(console Handle, buf *uint16, towrite uint32, written *uint32,
 	return
 }
 
-func WriteFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error) {
+func writeFile(handle Handle, buf []byte, done *uint32, overlapped *Overlapped) (err error) {
 	var _p0 *byte
 	if len(buf) > 0 {
 		_p0 = &buf[0]
@@ -3395,6 +3552,14 @@ func GetModuleInformation(process Handle, module Handle, modinfo *ModuleInfo, cb
 	return
 }
 
+func QueryWorkingSetEx(process Handle, pv uintptr, cb uint32) (err error) {
+	r1, _, e1 := syscall.Syscall(procQueryWorkingSetEx.Addr(), 3, uintptr(process), uintptr(pv), uintptr(cb))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func SubscribeServiceChangeNotifications(service Handle, eventType uint32, callback uintptr, callbackCtx uintptr, subscription *uintptr) (ret error) {
 	ret = procSubscribeServiceChangeNotifications.Find()
 	if ret != nil {
@@ -3432,6 +3597,233 @@ func TranslateName(accName *uint16, accNameFormat uint32, desiredNameFormat uint
 	return
 }
 
+func SetupDiBuildDriverInfoList(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiBuildDriverInfoList.Addr(), 3, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(driverType))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiCallClassInstaller(installFunction DI_FUNCTION, deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiCallClassInstaller.Addr(), 3, uintptr(installFunction), uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiCancelDriverInfoSearch(deviceInfoSet DevInfo) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiCancelDriverInfoSearch.Addr(), 1, uintptr(deviceInfoSet), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiClassGuidsFromNameEx(className *uint16, classGuidList *GUID, classGuidListSize uint32, requiredSize *uint32, machineName *uint16, reserved uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiClassGuidsFromNameExW.Addr(), 6, uintptr(unsafe.Pointer(className)), uintptr(unsafe.Pointer(classGuidList)), uintptr(classGuidListSize), uintptr(unsafe.Pointer(requiredSize)), uintptr(unsafe.Pointer(machineName)), uintptr(reserved))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiClassNameFromGuidEx(classGUID *GUID, className *uint16, classNameSize uint32, requiredSize *uint32, machineName *uint16, reserved uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiClassNameFromGuidExW.Addr(), 6, uintptr(unsafe.Pointer(classGUID)), uintptr(unsafe.Pointer(className)), uintptr(classNameSize), uintptr(unsafe.Pointer(requiredSize)), uintptr(unsafe.Pointer(machineName)), uintptr(reserved))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiCreateDeviceInfoListEx(classGUID *GUID, hwndParent uintptr, machineName *uint16, reserved uintptr) (handle DevInfo, err error) {
+	r0, _, e1 := syscall.Syscall6(procSetupDiCreateDeviceInfoListExW.Addr(), 4, uintptr(unsafe.Pointer(classGUID)), uintptr(hwndParent), uintptr(unsafe.Pointer(machineName)), uintptr(reserved), 0, 0)
+	handle = DevInfo(r0)
+	if handle == DevInfo(InvalidHandle) {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiCreateDeviceInfo(deviceInfoSet DevInfo, DeviceName *uint16, classGUID *GUID, DeviceDescription *uint16, hwndParent uintptr, CreationFlags DICD, deviceInfoData *DevInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall9(procSetupDiCreateDeviceInfoW.Addr(), 7, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(DeviceName)), uintptr(unsafe.Pointer(classGUID)), uintptr(unsafe.Pointer(DeviceDescription)), uintptr(hwndParent), uintptr(CreationFlags), uintptr(unsafe.Pointer(deviceInfoData)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiDestroyDeviceInfoList(deviceInfoSet DevInfo) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiDestroyDeviceInfoList.Addr(), 1, uintptr(deviceInfoSet), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiDestroyDriverInfoList(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiDestroyDriverInfoList.Addr(), 3, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(driverType))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiEnumDeviceInfo(deviceInfoSet DevInfo, memberIndex uint32, deviceInfoData *DevInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiEnumDeviceInfo.Addr(), 3, uintptr(deviceInfoSet), uintptr(memberIndex), uintptr(unsafe.Pointer(deviceInfoData)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiEnumDriverInfo(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverType SPDIT, memberIndex uint32, driverInfoData *DrvInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiEnumDriverInfoW.Addr(), 5, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(driverType), uintptr(memberIndex), uintptr(unsafe.Pointer(driverInfoData)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetClassDevsEx(classGUID *GUID, Enumerator *uint16, hwndParent uintptr, Flags DIGCF, deviceInfoSet DevInfo, machineName *uint16, reserved uintptr) (handle DevInfo, err error) {
+	r0, _, e1 := syscall.Syscall9(procSetupDiGetClassDevsExW.Addr(), 7, uintptr(unsafe.Pointer(classGUID)), uintptr(unsafe.Pointer(Enumerator)), uintptr(hwndParent), uintptr(Flags), uintptr(deviceInfoSet), uintptr(unsafe.Pointer(machineName)), uintptr(reserved), 0, 0)
+	handle = DevInfo(r0)
+	if handle == DevInfo(InvalidHandle) {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiGetClassInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, classInstallParams *ClassInstallHeader, classInstallParamsSize uint32, requiredSize *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiGetClassInstallParamsW.Addr(), 5, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(classInstallParams)), uintptr(classInstallParamsSize), uintptr(unsafe.Pointer(requiredSize)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetDeviceInfoListDetail(deviceInfoSet DevInfo, deviceInfoSetDetailData *DevInfoListDetailData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiGetDeviceInfoListDetailW.Addr(), 2, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoSetDetailData)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetDeviceInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, deviceInstallParams *DevInstallParams) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiGetDeviceInstallParamsW.Addr(), 3, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(deviceInstallParams)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetDeviceInstanceId(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, instanceId *uint16, instanceIdSize uint32, instanceIdRequiredSize *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiGetDeviceInstanceIdW.Addr(), 5, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(instanceId)), uintptr(instanceIdSize), uintptr(unsafe.Pointer(instanceIdRequiredSize)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetDeviceProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, propertyKey *DEVPROPKEY, propertyType *DEVPROPTYPE, propertyBuffer *byte, propertyBufferSize uint32, requiredSize *uint32, flags uint32) (err error) {
+	r1, _, e1 := syscall.Syscall9(procSetupDiGetDevicePropertyW.Addr(), 8, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(propertyKey)), uintptr(unsafe.Pointer(propertyType)), uintptr(unsafe.Pointer(propertyBuffer)), uintptr(propertyBufferSize), uintptr(unsafe.Pointer(requiredSize)), uintptr(flags), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetDeviceRegistryProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, property SPDRP, propertyRegDataType *uint32, propertyBuffer *byte, propertyBufferSize uint32, requiredSize *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall9(procSetupDiGetDeviceRegistryPropertyW.Addr(), 7, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(property), uintptr(unsafe.Pointer(propertyRegDataType)), uintptr(unsafe.Pointer(propertyBuffer)), uintptr(propertyBufferSize), uintptr(unsafe.Pointer(requiredSize)), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetDriverInfoDetail(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData, driverInfoDetailData *DrvInfoDetailData, driverInfoDetailDataSize uint32, requiredSize *uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiGetDriverInfoDetailW.Addr(), 6, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(driverInfoData)), uintptr(unsafe.Pointer(driverInfoDetailData)), uintptr(driverInfoDetailDataSize), uintptr(unsafe.Pointer(requiredSize)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetSelectedDevice(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiGetSelectedDevice.Addr(), 2, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiGetSelectedDriver(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiGetSelectedDriverW.Addr(), 3, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(driverInfoData)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiOpenDevRegKey(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, Scope DICS_FLAG, HwProfile uint32, KeyType DIREG, samDesired uint32) (key Handle, err error) {
+	r0, _, e1 := syscall.Syscall6(procSetupDiOpenDevRegKey.Addr(), 6, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(Scope), uintptr(HwProfile), uintptr(KeyType), uintptr(samDesired))
+	key = Handle(r0)
+	if key == InvalidHandle {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiSetClassInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, classInstallParams *ClassInstallHeader, classInstallParamsSize uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiSetClassInstallParamsW.Addr(), 4, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(classInstallParams)), uintptr(classInstallParamsSize), 0, 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiSetDeviceInstallParams(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, deviceInstallParams *DevInstallParams) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiSetDeviceInstallParamsW.Addr(), 3, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(deviceInstallParams)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupDiSetDeviceRegistryProperty(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, property SPDRP, propertyBuffer *byte, propertyBufferSize uint32) (err error) {
+	r1, _, e1 := syscall.Syscall6(procSetupDiSetDeviceRegistryPropertyW.Addr(), 5, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(property), uintptr(unsafe.Pointer(propertyBuffer)), uintptr(propertyBufferSize), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiSetSelectedDevice(deviceInfoSet DevInfo, deviceInfoData *DevInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiSetSelectedDevice.Addr(), 2, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func SetupDiSetSelectedDriver(deviceInfoSet DevInfo, deviceInfoData *DevInfoData, driverInfoData *DrvInfoData) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupDiSetSelectedDriverW.Addr(), 3, uintptr(deviceInfoSet), uintptr(unsafe.Pointer(deviceInfoData)), uintptr(unsafe.Pointer(driverInfoData)))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func setupUninstallOEMInf(infFileName *uint16, flags SUOI, reserved uintptr) (err error) {
+	r1, _, e1 := syscall.Syscall(procSetupUninstallOEMInfW.Addr(), 3, uintptr(unsafe.Pointer(infFileName)), uintptr(flags), uintptr(reserved))
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func CommandLineToArgv(cmd *uint16, argc *int32) (argv *[8192]*[8192]uint16, err error) {
 	r0, _, e1 := syscall.Syscall(procCommandLineToArgvW.Addr(), 2, uintptr(unsafe.Pointer(cmd)), uintptr(unsafe.Pointer(argc)), 0)
 	argv = (*[8192]*[8192]uint16)(unsafe.Pointer(r0))
@@ -3457,6 +3849,19 @@ func ShellExecute(hwnd Handle, verb *uint16, file *uint16, args *uint16, cwd *ui
 	return
 }
 
+func EnumChildWindows(hwnd HWND, enumFunc uintptr, param unsafe.Pointer) {
+	syscall.Syscall(procEnumChildWindows.Addr(), 3, uintptr(hwnd), uintptr(enumFunc), uintptr(param))
+	return
+}
+
+func EnumWindows(enumFunc uintptr, param unsafe.Pointer) (err error) {
+	r1, _, e1 := syscall.Syscall(procEnumWindows.Addr(), 2, uintptr(enumFunc), uintptr(param), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func ExitWindowsEx(flags uint32, reason uint32) (err error) {
 	r1, _, e1 := syscall.Syscall(procExitWindowsEx.Addr(), 2, uintptr(flags), uintptr(reason), 0)
 	if r1 == 0 {
@@ -3465,6 +3870,35 @@ func ExitWindowsEx(flags uint32, reason uint32) (err error) {
 	return
 }
 
+func GetClassName(hwnd HWND, className *uint16, maxCount int32) (copied int32, err error) {
+	r0, _, e1 := syscall.Syscall(procGetClassNameW.Addr(), 3, uintptr(hwnd), uintptr(unsafe.Pointer(className)), uintptr(maxCount))
+	copied = int32(r0)
+	if copied == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func GetDesktopWindow() (hwnd HWND) {
+	r0, _, _ := syscall.Syscall(procGetDesktopWindow.Addr(), 0, 0, 0, 0)
+	hwnd = HWND(r0)
+	return
+}
+
+func GetForegroundWindow() (hwnd HWND) {
+	r0, _, _ := syscall.Syscall(procGetForegroundWindow.Addr(), 0, 0, 0, 0)
+	hwnd = HWND(r0)
+	return
+}
+
+func GetGUIThreadInfo(thread uint32, info *GUIThreadInfo) (err error) {
+	r1, _, e1 := syscall.Syscall(procGetGUIThreadInfo.Addr(), 2, uintptr(thread), uintptr(unsafe.Pointer(info)), 0)
+	if r1 == 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func GetShellWindow() (shellWindow HWND) {
 	r0, _, _ := syscall.Syscall(procGetShellWindow.Addr(), 0, 0, 0, 0)
 	shellWindow = HWND(r0)
@@ -3480,6 +3914,24 @@ func GetWindowThreadProcessId(hwnd HWND, pid *uint32) (tid uint32, err error) {
 	return
 }
 
+func IsWindow(hwnd HWND) (isWindow bool) {
+	r0, _, _ := syscall.Syscall(procIsWindow.Addr(), 1, uintptr(hwnd), 0, 0)
+	isWindow = r0 != 0
+	return
+}
+
+func IsWindowUnicode(hwnd HWND) (isUnicode bool) {
+	r0, _, _ := syscall.Syscall(procIsWindowUnicode.Addr(), 1, uintptr(hwnd), 0, 0)
+	isUnicode = r0 != 0
+	return
+}
+
+func IsWindowVisible(hwnd HWND) (isVisible bool) {
+	r0, _, _ := syscall.Syscall(procIsWindowVisible.Addr(), 1, uintptr(hwnd), 0, 0)
+	isVisible = r0 != 0
+	return
+}
+
 func MessageBox(hwnd HWND, text *uint16, caption *uint16, boxtype uint32) (ret int32, err error) {
 	r0, _, e1 := syscall.Syscall6(procMessageBoxW.Addr(), 4, uintptr(hwnd), uintptr(unsafe.Pointer(text)), uintptr(unsafe.Pointer(caption)), uintptr(boxtype), 0, 0)
 	ret = int32(r0)
@@ -3627,6 +4079,30 @@ func WSAIoctl(s Handle, iocc uint32, inbuf *byte, cbif uint32, outbuf *byte, cbo
 	return
 }
 
+func WSALookupServiceBegin(querySet *WSAQUERYSET, flags uint32, handle *Handle) (err error) {
+	r1, _, e1 := syscall.Syscall(procWSALookupServiceBeginW.Addr(), 3, uintptr(unsafe.Pointer(querySet)), uintptr(flags), uintptr(unsafe.Pointer(handle)))
+	if r1 == socket_error {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func WSALookupServiceEnd(handle Handle) (err error) {
+	r1, _, e1 := syscall.Syscall(procWSALookupServiceEnd.Addr(), 1, uintptr(handle), 0, 0)
+	if r1 == socket_error {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+func WSALookupServiceNext(handle Handle, flags uint32, size *int32, querySet *WSAQUERYSET) (err error) {
+	r1, _, e1 := syscall.Syscall6(procWSALookupServiceNextW.Addr(), 4, uintptr(handle), uintptr(flags), uintptr(unsafe.Pointer(size)), uintptr(unsafe.Pointer(querySet)), 0, 0)
+	if r1 == socket_error {
+		err = errnoErr(e1)
+	}
+	return
+}
+
 func WSARecv(s Handle, bufs *WSABuf, bufcnt uint32, recvd *uint32, flags *uint32, overlapped *Overlapped, croutine *byte) (err error) {
 	r1, _, e1 := syscall.Syscall9(procWSARecv.Addr(), 7, uintptr(s), uintptr(unsafe.Pointer(bufs)), uintptr(bufcnt), uintptr(unsafe.Pointer(recvd)), uintptr(unsafe.Pointer(flags)), uintptr(unsafe.Pointer(overlapped)), uintptr(unsafe.Pointer(croutine)), 0, 0)
 	if r1 == socket_error {
diff --git a/vendor/golang.org/x/text/AUTHORS b/vendor/golang.org/x/text/AUTHORS
deleted file mode 100644
index 15167cd746..0000000000
--- a/vendor/golang.org/x/text/AUTHORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code refers to The Go Authors for copyright purposes.
-# The master list of authors is in the main Go distribution,
-# visible at http://tip.golang.org/AUTHORS.
diff --git a/vendor/golang.org/x/text/CONTRIBUTORS b/vendor/golang.org/x/text/CONTRIBUTORS
deleted file mode 100644
index 1c4577e968..0000000000
--- a/vendor/golang.org/x/text/CONTRIBUTORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code was written by the Go contributors.
-# The master list of contributors is in the main Go distribution,
-# visible at http://tip.golang.org/CONTRIBUTORS.
diff --git a/vendor/golang.org/x/text/unicode/bidi/core.go b/vendor/golang.org/x/text/unicode/bidi/core.go
index e4c0811016..9d2ae547b5 100644
--- a/vendor/golang.org/x/text/unicode/bidi/core.go
+++ b/vendor/golang.org/x/text/unicode/bidi/core.go
@@ -193,14 +193,14 @@ func (p *paragraph) run() {
 //
 // At the end of this function:
 //
-//  - The member variable matchingPDI is set to point to the index of the
-//    matching PDI character for each isolate initiator character. If there is
-//    no matching PDI, it is set to the length of the input text. For other
-//    characters, it is set to -1.
-//  - The member variable matchingIsolateInitiator is set to point to the
-//    index of the matching isolate initiator character for each PDI character.
-//    If there is no matching isolate initiator, or the character is not a PDI,
-//    it is set to -1.
+//   - The member variable matchingPDI is set to point to the index of the
+//     matching PDI character for each isolate initiator character. If there is
+//     no matching PDI, it is set to the length of the input text. For other
+//     characters, it is set to -1.
+//   - The member variable matchingIsolateInitiator is set to point to the
+//     index of the matching isolate initiator character for each PDI character.
+//     If there is no matching isolate initiator, or the character is not a PDI,
+//     it is set to -1.
 func (p *paragraph) determineMatchingIsolates() {
 	p.matchingPDI = make([]int, p.Len())
 	p.matchingIsolateInitiator = make([]int, p.Len())
@@ -435,7 +435,7 @@ func maxLevel(a, b level) level {
 }
 
 // Rule X10, second bullet: Determine the start-of-sequence (sos) and end-of-sequence (eos) types,
-// 			 either L or R, for each isolating run sequence.
+// either L or R, for each isolating run sequence.
 func (p *paragraph) isolatingRunSequence(indexes []int) *isolatingRunSequence {
 	length := len(indexes)
 	types := make([]Class, length)
@@ -495,9 +495,9 @@ func (s *isolatingRunSequence) resolveWeakTypes() {
 		if t == NSM {
 			s.types[i] = precedingCharacterType
 		} else {
-			if t.in(LRI, RLI, FSI, PDI) {
-				precedingCharacterType = ON
-			}
+			// if t.in(LRI, RLI, FSI, PDI) {
+			// 	precedingCharacterType = ON
+			// }
 			precedingCharacterType = t
 		}
 	}
@@ -905,7 +905,7 @@ func (p *paragraph) getLevels(linebreaks []int) []level {
 // Lines are concatenated from left to right. So for example, the fifth
 // character from the left on the third line is
 //
-// 		getReordering(linebreaks)[linebreaks[1] + 4]
+//	getReordering(linebreaks)[linebreaks[1] + 4]
 //
 // (linebreaks[1] is the position after the last character of the second
 // line, which is also the index of the first character on the third line,
diff --git a/vendor/golang.org/x/text/unicode/bidi/trieval.go b/vendor/golang.org/x/text/unicode/bidi/trieval.go
index 4c459c4b72..6a796e2214 100644
--- a/vendor/golang.org/x/text/unicode/bidi/trieval.go
+++ b/vendor/golang.org/x/text/unicode/bidi/trieval.go
@@ -37,18 +37,6 @@ const (
 	unknownClass = ^Class(0)
 )
 
-var controlToClass = map[rune]Class{
-	0x202D: LRO, // LeftToRightOverride,
-	0x202E: RLO, // RightToLeftOverride,
-	0x202A: LRE, // LeftToRightEmbedding,
-	0x202B: RLE, // RightToLeftEmbedding,
-	0x202C: PDF, // PopDirectionalFormat,
-	0x2066: LRI, // LeftToRightIsolate,
-	0x2067: RLI, // RightToLeftIsolate,
-	0x2068: FSI, // FirstStrongIsolate,
-	0x2069: PDI, // PopDirectionalIsolate,
-}
-
 // A trie entry has the following bits:
 // 7..5  XOR mask for brackets
 // 4     1: Bracket open, 0: Bracket close
diff --git a/vendor/golang.org/x/text/unicode/norm/forminfo.go b/vendor/golang.org/x/text/unicode/norm/forminfo.go
index 526c7033ac..487335d14d 100644
--- a/vendor/golang.org/x/text/unicode/norm/forminfo.go
+++ b/vendor/golang.org/x/text/unicode/norm/forminfo.go
@@ -13,7 +13,7 @@ import "encoding/binary"
 // a rune to a uint16. The values take two forms.  For v >= 0x8000:
 //   bits
 //   15:    1 (inverse of NFD_QC bit of qcInfo)
-//   13..7: qcInfo (see below). isYesD is always true (no decompostion).
+//   13..7: qcInfo (see below). isYesD is always true (no decomposition).
 //    6..0: ccc (compressed CCC value).
 // For v < 0x8000, the respective rune has a decomposition and v is an index
 // into a byte array of UTF-8 decomposition sequences and additional info and
@@ -110,10 +110,11 @@ func (p Properties) BoundaryAfter() bool {
 }
 
 // We pack quick check data in 4 bits:
-//   5:    Combines forward  (0 == false, 1 == true)
-//   4..3: NFC_QC Yes(00), No (10), or Maybe (11)
-//   2:    NFD_QC Yes (0) or No (1). No also means there is a decomposition.
-//   1..0: Number of trailing non-starters.
+//
+//	5:    Combines forward  (0 == false, 1 == true)
+//	4..3: NFC_QC Yes(00), No (10), or Maybe (11)
+//	2:    NFD_QC Yes (0) or No (1). No also means there is a decomposition.
+//	1..0: Number of trailing non-starters.
 //
 // When all 4 bits are zero, the character is inert, meaning it is never
 // influenced by normalization.
diff --git a/vendor/golang.org/x/text/unicode/norm/normalize.go b/vendor/golang.org/x/text/unicode/norm/normalize.go
index 95efcf26e8..4747ad07a8 100644
--- a/vendor/golang.org/x/text/unicode/norm/normalize.go
+++ b/vendor/golang.org/x/text/unicode/norm/normalize.go
@@ -18,16 +18,17 @@ import (
 // A Form denotes a canonical representation of Unicode code points.
 // The Unicode-defined normalization and equivalence forms are:
 //
-//   NFC   Unicode Normalization Form C
-//   NFD   Unicode Normalization Form D
-//   NFKC  Unicode Normalization Form KC
-//   NFKD  Unicode Normalization Form KD
+//	NFC   Unicode Normalization Form C
+//	NFD   Unicode Normalization Form D
+//	NFKC  Unicode Normalization Form KC
+//	NFKD  Unicode Normalization Form KD
 //
 // For a Form f, this documentation uses the notation f(x) to mean
 // the bytes or string x converted to the given form.
 // A position n in x is called a boundary if conversion to the form can
 // proceed independently on both sides:
-//   f(x) == append(f(x[0:n]), f(x[n:])...)
+//
+//	f(x) == append(f(x[0:n]), f(x[n:])...)
 //
 // References: https://unicode.org/reports/tr15/ and
 // https://unicode.org/notes/tn5/.
diff --git a/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go b/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
index 96a130d30e..9115ef257e 100644
--- a/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
+++ b/vendor/golang.org/x/text/unicode/norm/tables13.0.0.go
@@ -7315,7 +7315,7 @@ const recompMapPacked = "" +
 	"\x00V\x03\x03\x00\x00\x1e|" + // 0x00560303: 0x00001E7C
 	"\x00v\x03\x03\x00\x00\x1e}" + // 0x00760303: 0x00001E7D
 	"\x00V\x03#\x00\x00\x1e~" + // 0x00560323: 0x00001E7E
-	"\x00v\x03#\x00\x00\x1e\u007f" + // 0x00760323: 0x00001E7F
+	"\x00v\x03#\x00\x00\x1e\x7f" + // 0x00760323: 0x00001E7F
 	"\x00W\x03\x00\x00\x00\x1e\x80" + // 0x00570300: 0x00001E80
 	"\x00w\x03\x00\x00\x00\x1e\x81" + // 0x00770300: 0x00001E81
 	"\x00W\x03\x01\x00\x00\x1e\x82" + // 0x00570301: 0x00001E82
@@ -7342,7 +7342,7 @@ const recompMapPacked = "" +
 	"\x00t\x03\b\x00\x00\x1e\x97" + // 0x00740308: 0x00001E97
 	"\x00w\x03\n\x00\x00\x1e\x98" + // 0x0077030A: 0x00001E98
 	"\x00y\x03\n\x00\x00\x1e\x99" + // 0x0079030A: 0x00001E99
-	"\x01\u007f\x03\a\x00\x00\x1e\x9b" + // 0x017F0307: 0x00001E9B
+	"\x01\x7f\x03\a\x00\x00\x1e\x9b" + // 0x017F0307: 0x00001E9B
 	"\x00A\x03#\x00\x00\x1e\xa0" + // 0x00410323: 0x00001EA0
 	"\x00a\x03#\x00\x00\x1e\xa1" + // 0x00610323: 0x00001EA1
 	"\x00A\x03\t\x00\x00\x1e\xa2" + // 0x00410309: 0x00001EA2
diff --git a/vendor/golang.org/x/time/AUTHORS b/vendor/golang.org/x/time/AUTHORS
deleted file mode 100644
index 15167cd746..0000000000
--- a/vendor/golang.org/x/time/AUTHORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code refers to The Go Authors for copyright purposes.
-# The master list of authors is in the main Go distribution,
-# visible at http://tip.golang.org/AUTHORS.
diff --git a/vendor/golang.org/x/time/CONTRIBUTORS b/vendor/golang.org/x/time/CONTRIBUTORS
deleted file mode 100644
index 1c4577e968..0000000000
--- a/vendor/golang.org/x/time/CONTRIBUTORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code was written by the Go contributors.
-# The master list of contributors is in the main Go distribution,
-# visible at http://tip.golang.org/CONTRIBUTORS.
diff --git a/vendor/golang.org/x/time/rate/rate.go b/vendor/golang.org/x/time/rate/rate.go
index a98fe77827..f0e0cf3cb1 100644
--- a/vendor/golang.org/x/time/rate/rate.go
+++ b/vendor/golang.org/x/time/rate/rate.go
@@ -80,6 +80,19 @@ func (lim *Limiter) Burst() int {
 	return lim.burst
 }
 
+// TokensAt returns the number of tokens available at time t.
+func (lim *Limiter) TokensAt(t time.Time) float64 {
+	lim.mu.Lock()
+	_, tokens := lim.advance(t) // does not mutate lim
+	lim.mu.Unlock()
+	return tokens
+}
+
+// Tokens returns the number of tokens available now.
+func (lim *Limiter) Tokens() float64 {
+	return lim.TokensAt(time.Now())
+}
+
 // NewLimiter returns a new Limiter that allows events up to rate r and permits
 // bursts of at most b tokens.
 func NewLimiter(r Limit, b int) *Limiter {
@@ -89,16 +102,16 @@ func NewLimiter(r Limit, b int) *Limiter {
 	}
 }
 
-// Allow is shorthand for AllowN(time.Now(), 1).
+// Allow reports whether an event may happen now.
 func (lim *Limiter) Allow() bool {
 	return lim.AllowN(time.Now(), 1)
 }
 
-// AllowN reports whether n events may happen at time now.
+// AllowN reports whether n events may happen at time t.
 // Use this method if you intend to drop / skip events that exceed the rate limit.
 // Otherwise use Reserve or Wait.
-func (lim *Limiter) AllowN(now time.Time, n int) bool {
-	return lim.reserveN(now, n, 0).ok
+func (lim *Limiter) AllowN(t time.Time, n int) bool {
+	return lim.reserveN(t, n, 0).ok
 }
 
 // A Reservation holds information about events that are permitted by a Limiter to happen after a delay.
@@ -125,17 +138,17 @@ func (r *Reservation) Delay() time.Duration {
 }
 
 // InfDuration is the duration returned by Delay when a Reservation is not OK.
-const InfDuration = time.Duration(1<<63 - 1)
+const InfDuration = time.Duration(math.MaxInt64)
 
 // DelayFrom returns the duration for which the reservation holder must wait
 // before taking the reserved action.  Zero duration means act immediately.
 // InfDuration means the limiter cannot grant the tokens requested in this
 // Reservation within the maximum wait time.
-func (r *Reservation) DelayFrom(now time.Time) time.Duration {
+func (r *Reservation) DelayFrom(t time.Time) time.Duration {
 	if !r.ok {
 		return InfDuration
 	}
-	delay := r.timeToAct.Sub(now)
+	delay := r.timeToAct.Sub(t)
 	if delay < 0 {
 		return 0
 	}
@@ -145,13 +158,12 @@ func (r *Reservation) DelayFrom(now time.Time) time.Duration {
 // Cancel is shorthand for CancelAt(time.Now()).
 func (r *Reservation) Cancel() {
 	r.CancelAt(time.Now())
-	return
 }
 
 // CancelAt indicates that the reservation holder will not perform the reserved action
 // and reverses the effects of this Reservation on the rate limit as much as possible,
 // considering that other reservations may have already been made.
-func (r *Reservation) CancelAt(now time.Time) {
+func (r *Reservation) CancelAt(t time.Time) {
 	if !r.ok {
 		return
 	}
@@ -159,7 +171,7 @@ func (r *Reservation) CancelAt(now time.Time) {
 	r.lim.mu.Lock()
 	defer r.lim.mu.Unlock()
 
-	if r.lim.limit == Inf || r.tokens == 0 || r.timeToAct.Before(now) {
+	if r.lim.limit == Inf || r.tokens == 0 || r.timeToAct.Before(t) {
 		return
 	}
 
@@ -171,23 +183,21 @@ func (r *Reservation) CancelAt(now time.Time) {
 		return
 	}
 	// advance time to now
-	now, _, tokens := r.lim.advance(now)
+	t, tokens := r.lim.advance(t)
 	// calculate new number of tokens
 	tokens += restoreTokens
 	if burst := float64(r.lim.burst); tokens > burst {
 		tokens = burst
 	}
 	// update state
-	r.lim.last = now
+	r.lim.last = t
 	r.lim.tokens = tokens
 	if r.timeToAct == r.lim.lastEvent {
 		prevEvent := r.timeToAct.Add(r.limit.durationFromTokens(float64(-r.tokens)))
-		if !prevEvent.Before(now) {
+		if !prevEvent.Before(t) {
 			r.lim.lastEvent = prevEvent
 		}
 	}
-
-	return
 }
 
 // Reserve is shorthand for ReserveN(time.Now(), 1).
@@ -199,18 +209,20 @@ func (lim *Limiter) Reserve() *Reservation {
 // The Limiter takes this Reservation into account when allowing future events.
 // The returned Reservation’s OK() method returns false if n exceeds the Limiter's burst size.
 // Usage example:
-//   r := lim.ReserveN(time.Now(), 1)
-//   if !r.OK() {
-//     // Not allowed to act! Did you remember to set lim.burst to be > 0 ?
-//     return
-//   }
-//   time.Sleep(r.Delay())
-//   Act()
+//
+//	r := lim.ReserveN(time.Now(), 1)
+//	if !r.OK() {
+//	  // Not allowed to act! Did you remember to set lim.burst to be > 0 ?
+//	  return
+//	}
+//	time.Sleep(r.Delay())
+//	Act()
+//
 // Use this method if you wish to wait and slow down in accordance with the rate limit without dropping events.
 // If you need to respect a deadline or cancel the delay, use Wait instead.
 // To drop or skip events exceeding rate limit, use Allow instead.
-func (lim *Limiter) ReserveN(now time.Time, n int) *Reservation {
-	r := lim.reserveN(now, n, InfDuration)
+func (lim *Limiter) ReserveN(t time.Time, n int) *Reservation {
+	r := lim.reserveN(t, n, InfDuration)
 	return &r
 }
 
@@ -224,6 +236,18 @@ func (lim *Limiter) Wait(ctx context.Context) (err error) {
 // canceled, or the expected wait time exceeds the Context's Deadline.
 // The burst limit is ignored if the rate limit is Inf.
 func (lim *Limiter) WaitN(ctx context.Context, n int) (err error) {
+	// The test code calls lim.wait with a fake timer generator.
+	// This is the real timer generator.
+	newTimer := func(d time.Duration) (<-chan time.Time, func() bool, func()) {
+		timer := time.NewTimer(d)
+		return timer.C, timer.Stop, func() {}
+	}
+
+	return lim.wait(ctx, n, time.Now(), newTimer)
+}
+
+// wait is the internal implementation of WaitN.
+func (lim *Limiter) wait(ctx context.Context, n int, t time.Time, newTimer func(d time.Duration) (<-chan time.Time, func() bool, func())) error {
 	lim.mu.Lock()
 	burst := lim.burst
 	limit := lim.limit
@@ -239,25 +263,25 @@ func (lim *Limiter) WaitN(ctx context.Context, n int) (err error) {
 	default:
 	}
 	// Determine wait limit
-	now := time.Now()
 	waitLimit := InfDuration
 	if deadline, ok := ctx.Deadline(); ok {
-		waitLimit = deadline.Sub(now)
+		waitLimit = deadline.Sub(t)
 	}
 	// Reserve
-	r := lim.reserveN(now, n, waitLimit)
+	r := lim.reserveN(t, n, waitLimit)
 	if !r.ok {
 		return fmt.Errorf("rate: Wait(n=%d) would exceed context deadline", n)
 	}
 	// Wait if necessary
-	delay := r.DelayFrom(now)
+	delay := r.DelayFrom(t)
 	if delay == 0 {
 		return nil
 	}
-	t := time.NewTimer(delay)
-	defer t.Stop()
+	ch, stop, advance := newTimer(delay)
+	defer stop()
+	advance() // only has an effect when testing
 	select {
-	case <-t.C:
+	case <-ch:
 		// We can proceed.
 		return nil
 	case <-ctx.Done():
@@ -276,13 +300,13 @@ func (lim *Limiter) SetLimit(newLimit Limit) {
 // SetLimitAt sets a new Limit for the limiter. The new Limit, and Burst, may be violated
 // or underutilized by those which reserved (using Reserve or Wait) but did not yet act
 // before SetLimitAt was called.
-func (lim *Limiter) SetLimitAt(now time.Time, newLimit Limit) {
+func (lim *Limiter) SetLimitAt(t time.Time, newLimit Limit) {
 	lim.mu.Lock()
 	defer lim.mu.Unlock()
 
-	now, _, tokens := lim.advance(now)
+	t, tokens := lim.advance(t)
 
-	lim.last = now
+	lim.last = t
 	lim.tokens = tokens
 	lim.limit = newLimit
 }
@@ -293,13 +317,13 @@ func (lim *Limiter) SetBurst(newBurst int) {
 }
 
 // SetBurstAt sets a new burst size for the limiter.
-func (lim *Limiter) SetBurstAt(now time.Time, newBurst int) {
+func (lim *Limiter) SetBurstAt(t time.Time, newBurst int) {
 	lim.mu.Lock()
 	defer lim.mu.Unlock()
 
-	now, _, tokens := lim.advance(now)
+	t, tokens := lim.advance(t)
 
-	lim.last = now
+	lim.last = t
 	lim.tokens = tokens
 	lim.burst = newBurst
 }
@@ -307,20 +331,32 @@ func (lim *Limiter) SetBurstAt(now time.Time, newBurst int) {
 // reserveN is a helper method for AllowN, ReserveN, and WaitN.
 // maxFutureReserve specifies the maximum reservation wait duration allowed.
 // reserveN returns Reservation, not *Reservation, to avoid allocation in AllowN and WaitN.
-func (lim *Limiter) reserveN(now time.Time, n int, maxFutureReserve time.Duration) Reservation {
+func (lim *Limiter) reserveN(t time.Time, n int, maxFutureReserve time.Duration) Reservation {
 	lim.mu.Lock()
+	defer lim.mu.Unlock()
 
 	if lim.limit == Inf {
-		lim.mu.Unlock()
 		return Reservation{
 			ok:        true,
 			lim:       lim,
 			tokens:    n,
-			timeToAct: now,
+			timeToAct: t,
+		}
+	} else if lim.limit == 0 {
+		var ok bool
+		if lim.burst >= n {
+			ok = true
+			lim.burst -= n
+		}
+		return Reservation{
+			ok:        ok,
+			lim:       lim,
+			tokens:    lim.burst,
+			timeToAct: t,
 		}
 	}
 
-	now, last, tokens := lim.advance(now)
+	t, tokens := lim.advance(t)
 
 	// Calculate the remaining number of tokens resulting from the request.
 	tokens -= float64(n)
@@ -342,61 +378,51 @@ func (lim *Limiter) reserveN(now time.Time, n int, maxFutureReserve time.Duratio
 	}
 	if ok {
 		r.tokens = n
-		r.timeToAct = now.Add(waitDuration)
-	}
+		r.timeToAct = t.Add(waitDuration)
 
-	// Update state
-	if ok {
-		lim.last = now
+		// Update state
+		lim.last = t
 		lim.tokens = tokens
 		lim.lastEvent = r.timeToAct
-	} else {
-		lim.last = last
 	}
 
-	lim.mu.Unlock()
 	return r
 }
 
 // advance calculates and returns an updated state for lim resulting from the passage of time.
 // lim is not changed.
 // advance requires that lim.mu is held.
-func (lim *Limiter) advance(now time.Time) (newNow time.Time, newLast time.Time, newTokens float64) {
+func (lim *Limiter) advance(t time.Time) (newT time.Time, newTokens float64) {
 	last := lim.last
-	if now.Before(last) {
-		last = now
-	}
-
-	// Avoid making delta overflow below when last is very old.
-	maxElapsed := lim.limit.durationFromTokens(float64(lim.burst) - lim.tokens)
-	elapsed := now.Sub(last)
-	if elapsed > maxElapsed {
-		elapsed = maxElapsed
+	if t.Before(last) {
+		last = t
 	}
 
 	// Calculate the new number of tokens, due to time that passed.
+	elapsed := t.Sub(last)
 	delta := lim.limit.tokensFromDuration(elapsed)
 	tokens := lim.tokens + delta
 	if burst := float64(lim.burst); tokens > burst {
 		tokens = burst
 	}
-
-	return now, last, tokens
+	return t, tokens
 }
 
 // durationFromTokens is a unit conversion function from the number of tokens to the duration
 // of time it takes to accumulate them at a rate of limit tokens per second.
 func (limit Limit) durationFromTokens(tokens float64) time.Duration {
+	if limit <= 0 {
+		return InfDuration
+	}
 	seconds := tokens / float64(limit)
-	return time.Nanosecond * time.Duration(1e9*seconds)
+	return time.Duration(float64(time.Second) * seconds)
 }
 
 // tokensFromDuration is a unit conversion function from a time duration to the number of tokens
 // which could be accumulated during that duration at a rate of limit tokens per second.
 func (limit Limit) tokensFromDuration(d time.Duration) float64 {
-	// Split the integer and fractional parts ourself to minimize rounding errors.
-	// See golang.org/issues/34861.
-	sec := float64(d/time.Second) * float64(limit)
-	nsec := float64(d%time.Second) * float64(limit)
-	return sec + nsec/1e9
+	if limit <= 0 {
+		return 0
+	}
+	return d.Seconds() * float64(limit)
 }
diff --git a/vendor/golang.org/x/time/rate/sometimes.go b/vendor/golang.org/x/time/rate/sometimes.go
new file mode 100644
index 0000000000..6ba99ddb67
--- /dev/null
+++ b/vendor/golang.org/x/time/rate/sometimes.go
@@ -0,0 +1,67 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package rate
+
+import (
+	"sync"
+	"time"
+)
+
+// Sometimes will perform an action occasionally.  The First, Every, and
+// Interval fields govern the behavior of Do, which performs the action.
+// A zero Sometimes value will perform an action exactly once.
+//
+// # Example: logging with rate limiting
+//
+//	var sometimes = rate.Sometimes{First: 3, Interval: 10*time.Second}
+//	func Spammy() {
+//	        sometimes.Do(func() { log.Info("here I am!") })
+//	}
+type Sometimes struct {
+	First    int           // if non-zero, the first N calls to Do will run f.
+	Every    int           // if non-zero, every Nth call to Do will run f.
+	Interval time.Duration // if non-zero and Interval has elapsed since f's last run, Do will run f.
+
+	mu    sync.Mutex
+	count int       // number of Do calls
+	last  time.Time // last time f was run
+}
+
+// Do runs the function f as allowed by First, Every, and Interval.
+//
+// The model is a union (not intersection) of filters.  The first call to Do
+// always runs f.  Subsequent calls to Do run f if allowed by First or Every or
+// Interval.
+//
+// A non-zero First:N causes the first N Do(f) calls to run f.
+//
+// A non-zero Every:M causes every Mth Do(f) call, starting with the first, to
+// run f.
+//
+// A non-zero Interval causes Do(f) to run f if Interval has elapsed since
+// Do last ran f.
+//
+// Specifying multiple filters produces the union of these execution streams.
+// For example, specifying both First:N and Every:M causes the first N Do(f)
+// calls and every Mth Do(f) call, starting with the first, to run f.  See
+// Examples for more.
+//
+// If Do is called multiple times simultaneously, the calls will block and run
+// serially.  Therefore, Do is intended for lightweight operations.
+//
+// Because a call to Do may block until f returns, if f causes Do to be called,
+// it will deadlock.
+func (s *Sometimes) Do(f func()) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.count == 0 ||
+		(s.First > 0 && s.count < s.First) ||
+		(s.Every > 0 && s.count%s.Every == 0) ||
+		(s.Interval > 0 && time.Since(s.last) >= s.Interval) {
+		f()
+		s.last = time.Now()
+	}
+	s.count++
+}
diff --git a/vendor/google.golang.org/genproto/LICENSE b/vendor/google.golang.org/genproto/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/vendor/google.golang.org/genproto/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go b/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go
new file mode 100644
index 0000000000..af72196c80
--- /dev/null
+++ b/vendor/google.golang.org/genproto/googleapis/api/httpbody/httpbody.pb.go
@@ -0,0 +1,235 @@
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.12.2
+// source: google/api/httpbody.proto
+
+package httpbody
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Message that represents an arbitrary HTTP body. It should only be used for
+// payload formats that can't be represented as JSON, such as raw binary or
+// an HTML page.
+//
+// This message can be used both in streaming and non-streaming API methods in
+// the request as well as the response.
+//
+// It can be used as a top-level request field, which is convenient if one
+// wants to extract parameters from either the URL or HTTP template into the
+// request fields and also want access to the raw HTTP body.
+//
+// Example:
+//
+//	message GetResourceRequest {
+//	  // A unique request id.
+//	  string request_id = 1;
+//
+//	  // The raw HTTP body is bound to this field.
+//	  google.api.HttpBody http_body = 2;
+//
+//	}
+//
+//	service ResourceService {
+//	  rpc GetResource(GetResourceRequest)
+//	    returns (google.api.HttpBody);
+//	  rpc UpdateResource(google.api.HttpBody)
+//	    returns (google.protobuf.Empty);
+//
+//	}
+//
+// Example with streaming methods:
+//
+//	service CaldavService {
+//	  rpc GetCalendar(stream google.api.HttpBody)
+//	    returns (stream google.api.HttpBody);
+//	  rpc UpdateCalendar(stream google.api.HttpBody)
+//	    returns (stream google.api.HttpBody);
+//
+//	}
+//
+// Use of this type only changes how the request and response bodies are
+// handled, all other features will continue to work unchanged.
+type HttpBody struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The HTTP Content-Type header value specifying the content type of the body.
+	ContentType string `protobuf:"bytes,1,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
+	// The HTTP request/response body as raw binary.
+	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+	// Application specific response metadata. Must be set in the first response
+	// for streaming APIs.
+	Extensions []*anypb.Any `protobuf:"bytes,3,rep,name=extensions,proto3" json:"extensions,omitempty"`
+}
+
+func (x *HttpBody) Reset() {
+	*x = HttpBody{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_api_httpbody_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HttpBody) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HttpBody) ProtoMessage() {}
+
+func (x *HttpBody) ProtoReflect() protoreflect.Message {
+	mi := &file_google_api_httpbody_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HttpBody.ProtoReflect.Descriptor instead.
+func (*HttpBody) Descriptor() ([]byte, []int) {
+	return file_google_api_httpbody_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HttpBody) GetContentType() string {
+	if x != nil {
+		return x.ContentType
+	}
+	return ""
+}
+
+func (x *HttpBody) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+func (x *HttpBody) GetExtensions() []*anypb.Any {
+	if x != nil {
+		return x.Extensions
+	}
+	return nil
+}
+
+var File_google_api_httpbody_proto protoreflect.FileDescriptor
+
+var file_google_api_httpbody_proto_rawDesc = []byte{
+	0x0a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x68, 0x74, 0x74,
+	0x70, 0x62, 0x6f, 0x64, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0a, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x22, 0x77, 0x0a, 0x08, 0x48, 0x74, 0x74, 0x70, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x21,
+	0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x34, 0x0a, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52,
+	0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x68, 0x0a, 0x0e, 0x63,
+	0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x0d, 0x48,
+	0x74, 0x74, 0x70, 0x42, 0x6f, 0x64, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x3b,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72,
+	0x67, 0x2f, 0x67, 0x65, 0x6e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x61, 0x70, 0x69, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x68, 0x74, 0x74, 0x70, 0x62, 0x6f,
+	0x64, 0x79, 0x3b, 0x68, 0x74, 0x74, 0x70, 0x62, 0x6f, 0x64, 0x79, 0xf8, 0x01, 0x01, 0xa2, 0x02,
+	0x04, 0x47, 0x41, 0x50, 0x49, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_google_api_httpbody_proto_rawDescOnce sync.Once
+	file_google_api_httpbody_proto_rawDescData = file_google_api_httpbody_proto_rawDesc
+)
+
+func file_google_api_httpbody_proto_rawDescGZIP() []byte {
+	file_google_api_httpbody_proto_rawDescOnce.Do(func() {
+		file_google_api_httpbody_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_api_httpbody_proto_rawDescData)
+	})
+	return file_google_api_httpbody_proto_rawDescData
+}
+
+var file_google_api_httpbody_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_google_api_httpbody_proto_goTypes = []interface{}{
+	(*HttpBody)(nil),  // 0: google.api.HttpBody
+	(*anypb.Any)(nil), // 1: google.protobuf.Any
+}
+var file_google_api_httpbody_proto_depIdxs = []int32{
+	1, // 0: google.api.HttpBody.extensions:type_name -> google.protobuf.Any
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_google_api_httpbody_proto_init() }
+func file_google_api_httpbody_proto_init() {
+	if File_google_api_httpbody_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_google_api_httpbody_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HttpBody); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_google_api_httpbody_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_google_api_httpbody_proto_goTypes,
+		DependencyIndexes: file_google_api_httpbody_proto_depIdxs,
+		MessageInfos:      file_google_api_httpbody_proto_msgTypes,
+	}.Build()
+	File_google_api_httpbody_proto = out.File
+	file_google_api_httpbody_proto_rawDesc = nil
+	file_google_api_httpbody_proto_goTypes = nil
+	file_google_api_httpbody_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/genproto/googleapis/rpc/errdetails/error_details.pb.go b/vendor/google.golang.org/genproto/googleapis/rpc/errdetails/error_details.pb.go
new file mode 100644
index 0000000000..7bd161e48a
--- /dev/null
+++ b/vendor/google.golang.org/genproto/googleapis/rpc/errdetails/error_details.pb.go
@@ -0,0 +1,1314 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.9
+// source: google/rpc/error_details.proto
+
+package errdetails
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Describes the cause of the error with structured details.
+//
+// Example of an error when contacting the "pubsub.googleapis.com" API when it
+// is not enabled:
+//
+//	{ "reason": "API_DISABLED"
+//	  "domain": "googleapis.com"
+//	  "metadata": {
+//	    "resource": "projects/123",
+//	    "service": "pubsub.googleapis.com"
+//	  }
+//	}
+//
+// This response indicates that the pubsub.googleapis.com API is not enabled.
+//
+// Example of an error that is returned when attempting to create a Spanner
+// instance in a region that is out of stock:
+//
+//	{ "reason": "STOCKOUT"
+//	  "domain": "spanner.googleapis.com",
+//	  "metadata": {
+//	    "availableRegions": "us-central1,us-east2"
+//	  }
+//	}
+type ErrorInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The reason of the error. This is a constant value that identifies the
+	// proximate cause of the error. Error reasons are unique within a particular
+	// domain of errors. This should be at most 63 characters and match a
+	// regular expression of `[A-Z][A-Z0-9_]+[A-Z0-9]`, which represents
+	// UPPER_SNAKE_CASE.
+	Reason string `protobuf:"bytes,1,opt,name=reason,proto3" json:"reason,omitempty"`
+	// The logical grouping to which the "reason" belongs. The error domain
+	// is typically the registered service name of the tool or product that
+	// generates the error. Example: "pubsub.googleapis.com". If the error is
+	// generated by some common infrastructure, the error domain must be a
+	// globally unique value that identifies the infrastructure. For Google API
+	// infrastructure, the error domain is "googleapis.com".
+	Domain string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
+	// Additional structured details about this error.
+	//
+	// Keys should match /[a-zA-Z0-9-_]/ and be limited to 64 characters in
+	// length. When identifying the current value of an exceeded limit, the units
+	// should be contained in the key, not the value.  For example, rather than
+	// {"instanceLimit": "100/request"}, should be returned as,
+	// {"instanceLimitPerRequest": "100"}, if the client exceeds the number of
+	// instances that can be created in a single (batch) request.
+	Metadata map[string]string `protobuf:"bytes,3,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *ErrorInfo) Reset() {
+	*x = ErrorInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ErrorInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ErrorInfo) ProtoMessage() {}
+
+func (x *ErrorInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ErrorInfo.ProtoReflect.Descriptor instead.
+func (*ErrorInfo) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ErrorInfo) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+func (x *ErrorInfo) GetDomain() string {
+	if x != nil {
+		return x.Domain
+	}
+	return ""
+}
+
+func (x *ErrorInfo) GetMetadata() map[string]string {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+// Describes when the clients can retry a failed request. Clients could ignore
+// the recommendation here or retry when this information is missing from error
+// responses.
+//
+// It's always recommended that clients should use exponential backoff when
+// retrying.
+//
+// Clients should wait until `retry_delay` amount of time has passed since
+// receiving the error response before retrying.  If retrying requests also
+// fail, clients should use an exponential backoff scheme to gradually increase
+// the delay between retries based on `retry_delay`, until either a maximum
+// number of retries have been reached or a maximum retry delay cap has been
+// reached.
+type RetryInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Clients should wait at least this long between retrying the same request.
+	RetryDelay *durationpb.Duration `protobuf:"bytes,1,opt,name=retry_delay,json=retryDelay,proto3" json:"retry_delay,omitempty"`
+}
+
+func (x *RetryInfo) Reset() {
+	*x = RetryInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RetryInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RetryInfo) ProtoMessage() {}
+
+func (x *RetryInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RetryInfo.ProtoReflect.Descriptor instead.
+func (*RetryInfo) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RetryInfo) GetRetryDelay() *durationpb.Duration {
+	if x != nil {
+		return x.RetryDelay
+	}
+	return nil
+}
+
+// Describes additional debugging info.
+type DebugInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The stack trace entries indicating where the error occurred.
+	StackEntries []string `protobuf:"bytes,1,rep,name=stack_entries,json=stackEntries,proto3" json:"stack_entries,omitempty"`
+	// Additional debugging information provided by the server.
+	Detail string `protobuf:"bytes,2,opt,name=detail,proto3" json:"detail,omitempty"`
+}
+
+func (x *DebugInfo) Reset() {
+	*x = DebugInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DebugInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DebugInfo) ProtoMessage() {}
+
+func (x *DebugInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DebugInfo.ProtoReflect.Descriptor instead.
+func (*DebugInfo) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *DebugInfo) GetStackEntries() []string {
+	if x != nil {
+		return x.StackEntries
+	}
+	return nil
+}
+
+func (x *DebugInfo) GetDetail() string {
+	if x != nil {
+		return x.Detail
+	}
+	return ""
+}
+
+// Describes how a quota check failed.
+//
+// For example if a daily limit was exceeded for the calling project,
+// a service could respond with a QuotaFailure detail containing the project
+// id and the description of the quota limit that was exceeded.  If the
+// calling project hasn't enabled the service in the developer console, then
+// a service could respond with the project id and set `service_disabled`
+// to true.
+//
+// Also see RetryInfo and Help types for other details about handling a
+// quota failure.
+type QuotaFailure struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Describes all quota violations.
+	Violations []*QuotaFailure_Violation `protobuf:"bytes,1,rep,name=violations,proto3" json:"violations,omitempty"`
+}
+
+func (x *QuotaFailure) Reset() {
+	*x = QuotaFailure{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuotaFailure) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuotaFailure) ProtoMessage() {}
+
+func (x *QuotaFailure) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuotaFailure.ProtoReflect.Descriptor instead.
+func (*QuotaFailure) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *QuotaFailure) GetViolations() []*QuotaFailure_Violation {
+	if x != nil {
+		return x.Violations
+	}
+	return nil
+}
+
+// Describes what preconditions have failed.
+//
+// For example, if an RPC failed because it required the Terms of Service to be
+// acknowledged, it could list the terms of service violation in the
+// PreconditionFailure message.
+type PreconditionFailure struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Describes all precondition violations.
+	Violations []*PreconditionFailure_Violation `protobuf:"bytes,1,rep,name=violations,proto3" json:"violations,omitempty"`
+}
+
+func (x *PreconditionFailure) Reset() {
+	*x = PreconditionFailure{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PreconditionFailure) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PreconditionFailure) ProtoMessage() {}
+
+func (x *PreconditionFailure) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PreconditionFailure.ProtoReflect.Descriptor instead.
+func (*PreconditionFailure) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *PreconditionFailure) GetViolations() []*PreconditionFailure_Violation {
+	if x != nil {
+		return x.Violations
+	}
+	return nil
+}
+
+// Describes violations in a client request. This error type focuses on the
+// syntactic aspects of the request.
+type BadRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Describes all violations in a client request.
+	FieldViolations []*BadRequest_FieldViolation `protobuf:"bytes,1,rep,name=field_violations,json=fieldViolations,proto3" json:"field_violations,omitempty"`
+}
+
+func (x *BadRequest) Reset() {
+	*x = BadRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BadRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BadRequest) ProtoMessage() {}
+
+func (x *BadRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BadRequest.ProtoReflect.Descriptor instead.
+func (*BadRequest) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *BadRequest) GetFieldViolations() []*BadRequest_FieldViolation {
+	if x != nil {
+		return x.FieldViolations
+	}
+	return nil
+}
+
+// Contains metadata about the request that clients can attach when filing a bug
+// or providing other forms of feedback.
+type RequestInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// An opaque string that should only be interpreted by the service generating
+	// it. For example, it can be used to identify requests in the service's logs.
+	RequestId string `protobuf:"bytes,1,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
+	// Any data that was used to serve this request. For example, an encrypted
+	// stack trace that can be sent back to the service provider for debugging.
+	ServingData string `protobuf:"bytes,2,opt,name=serving_data,json=servingData,proto3" json:"serving_data,omitempty"`
+}
+
+func (x *RequestInfo) Reset() {
+	*x = RequestInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestInfo) ProtoMessage() {}
+
+func (x *RequestInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestInfo.ProtoReflect.Descriptor instead.
+func (*RequestInfo) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RequestInfo) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+func (x *RequestInfo) GetServingData() string {
+	if x != nil {
+		return x.ServingData
+	}
+	return ""
+}
+
+// Describes the resource that is being accessed.
+type ResourceInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// A name for the type of resource being accessed, e.g. "sql table",
+	// "cloud storage bucket", "file", "Google calendar"; or the type URL
+	// of the resource: e.g. "type.googleapis.com/google.pubsub.v1.Topic".
+	ResourceType string `protobuf:"bytes,1,opt,name=resource_type,json=resourceType,proto3" json:"resource_type,omitempty"`
+	// The name of the resource being accessed.  For example, a shared calendar
+	// name: "example.com_4fghdhgsrgh@group.calendar.google.com", if the current
+	// error is
+	// [google.rpc.Code.PERMISSION_DENIED][google.rpc.Code.PERMISSION_DENIED].
+	ResourceName string `protobuf:"bytes,2,opt,name=resource_name,json=resourceName,proto3" json:"resource_name,omitempty"`
+	// The owner of the resource (optional).
+	// For example, "user:<owner email>" or "project:<Google developer project
+	// id>".
+	Owner string `protobuf:"bytes,3,opt,name=owner,proto3" json:"owner,omitempty"`
+	// Describes what error is encountered when accessing this resource.
+	// For example, updating a cloud project may require the `writer` permission
+	// on the developer console project.
+	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *ResourceInfo) Reset() {
+	*x = ResourceInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResourceInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceInfo) ProtoMessage() {}
+
+func (x *ResourceInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceInfo.ProtoReflect.Descriptor instead.
+func (*ResourceInfo) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *ResourceInfo) GetResourceType() string {
+	if x != nil {
+		return x.ResourceType
+	}
+	return ""
+}
+
+func (x *ResourceInfo) GetResourceName() string {
+	if x != nil {
+		return x.ResourceName
+	}
+	return ""
+}
+
+func (x *ResourceInfo) GetOwner() string {
+	if x != nil {
+		return x.Owner
+	}
+	return ""
+}
+
+func (x *ResourceInfo) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+// Provides links to documentation or for performing an out of band action.
+//
+// For example, if a quota check failed with an error indicating the calling
+// project hasn't enabled the accessed service, this can contain a URL pointing
+// directly to the right place in the developer console to flip the bit.
+type Help struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// URL(s) pointing to additional information on handling the current error.
+	Links []*Help_Link `protobuf:"bytes,1,rep,name=links,proto3" json:"links,omitempty"`
+}
+
+func (x *Help) Reset() {
+	*x = Help{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Help) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Help) ProtoMessage() {}
+
+func (x *Help) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Help.ProtoReflect.Descriptor instead.
+func (*Help) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *Help) GetLinks() []*Help_Link {
+	if x != nil {
+		return x.Links
+	}
+	return nil
+}
+
+// Provides a localized error message that is safe to return to the user
+// which can be attached to an RPC error.
+type LocalizedMessage struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The locale used following the specification defined at
+	// https://www.rfc-editor.org/rfc/bcp/bcp47.txt.
+	// Examples are: "en-US", "fr-CH", "es-MX"
+	Locale string `protobuf:"bytes,1,opt,name=locale,proto3" json:"locale,omitempty"`
+	// The localized error message in the above locale.
+	Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+}
+
+func (x *LocalizedMessage) Reset() {
+	*x = LocalizedMessage{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LocalizedMessage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LocalizedMessage) ProtoMessage() {}
+
+func (x *LocalizedMessage) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LocalizedMessage.ProtoReflect.Descriptor instead.
+func (*LocalizedMessage) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *LocalizedMessage) GetLocale() string {
+	if x != nil {
+		return x.Locale
+	}
+	return ""
+}
+
+func (x *LocalizedMessage) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+// A message type used to describe a single quota violation.  For example, a
+// daily quota or a custom quota that was exceeded.
+type QuotaFailure_Violation struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The subject on which the quota check failed.
+	// For example, "clientip:<ip address of client>" or "project:<Google
+	// developer project id>".
+	Subject string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
+	// A description of how the quota check failed. Clients can use this
+	// description to find more about the quota configuration in the service's
+	// public documentation, or find the relevant quota limit to adjust through
+	// developer console.
+	//
+	// For example: "Service disabled" or "Daily Limit for read operations
+	// exceeded".
+	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *QuotaFailure_Violation) Reset() {
+	*x = QuotaFailure_Violation{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QuotaFailure_Violation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QuotaFailure_Violation) ProtoMessage() {}
+
+func (x *QuotaFailure_Violation) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QuotaFailure_Violation.ProtoReflect.Descriptor instead.
+func (*QuotaFailure_Violation) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *QuotaFailure_Violation) GetSubject() string {
+	if x != nil {
+		return x.Subject
+	}
+	return ""
+}
+
+func (x *QuotaFailure_Violation) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+// A message type used to describe a single precondition failure.
+type PreconditionFailure_Violation struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The type of PreconditionFailure. We recommend using a service-specific
+	// enum type to define the supported precondition violation subjects. For
+	// example, "TOS" for "Terms of Service violation".
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// The subject, relative to the type, that failed.
+	// For example, "google.com/cloud" relative to the "TOS" type would indicate
+	// which terms of service is being referenced.
+	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
+	// A description of how the precondition failed. Developers can use this
+	// description to understand how to fix the failure.
+	//
+	// For example: "Terms of service not accepted".
+	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *PreconditionFailure_Violation) Reset() {
+	*x = PreconditionFailure_Violation{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PreconditionFailure_Violation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PreconditionFailure_Violation) ProtoMessage() {}
+
+func (x *PreconditionFailure_Violation) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PreconditionFailure_Violation.ProtoReflect.Descriptor instead.
+func (*PreconditionFailure_Violation) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{4, 0}
+}
+
+func (x *PreconditionFailure_Violation) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *PreconditionFailure_Violation) GetSubject() string {
+	if x != nil {
+		return x.Subject
+	}
+	return ""
+}
+
+func (x *PreconditionFailure_Violation) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+// A message type used to describe a single bad request field.
+type BadRequest_FieldViolation struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// A path that leads to a field in the request body. The value will be a
+	// sequence of dot-separated identifiers that identify a protocol buffer
+	// field.
+	//
+	// Consider the following:
+	//
+	//	message CreateContactRequest {
+	//	  message EmailAddress {
+	//	    enum Type {
+	//	      TYPE_UNSPECIFIED = 0;
+	//	      HOME = 1;
+	//	      WORK = 2;
+	//	    }
+	//
+	//	    optional string email = 1;
+	//	    repeated EmailType type = 2;
+	//	  }
+	//
+	//	  string full_name = 1;
+	//	  repeated EmailAddress email_addresses = 2;
+	//	}
+	//
+	// In this example, in proto `field` could take one of the following values:
+	//
+	//   - `full_name` for a violation in the `full_name` value
+	//   - `email_addresses[1].email` for a violation in the `email` field of the
+	//     first `email_addresses` message
+	//   - `email_addresses[3].type[2]` for a violation in the second `type`
+	//     value in the third `email_addresses` message.
+	//
+	// In JSON, the same values are represented as:
+	//
+	//   - `fullName` for a violation in the `fullName` value
+	//   - `emailAddresses[1].email` for a violation in the `email` field of the
+	//     first `emailAddresses` message
+	//   - `emailAddresses[3].type[2]` for a violation in the second `type`
+	//     value in the third `emailAddresses` message.
+	Field string `protobuf:"bytes,1,opt,name=field,proto3" json:"field,omitempty"`
+	// A description of why the request element is bad.
+	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *BadRequest_FieldViolation) Reset() {
+	*x = BadRequest_FieldViolation{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BadRequest_FieldViolation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BadRequest_FieldViolation) ProtoMessage() {}
+
+func (x *BadRequest_FieldViolation) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BadRequest_FieldViolation.ProtoReflect.Descriptor instead.
+func (*BadRequest_FieldViolation) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{5, 0}
+}
+
+func (x *BadRequest_FieldViolation) GetField() string {
+	if x != nil {
+		return x.Field
+	}
+	return ""
+}
+
+func (x *BadRequest_FieldViolation) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+// Describes a URL link.
+type Help_Link struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Describes what the link offers.
+	Description string `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
+	// The URL of the link.
+	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
+}
+
+func (x *Help_Link) Reset() {
+	*x = Help_Link{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_error_details_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Help_Link) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Help_Link) ProtoMessage() {}
+
+func (x *Help_Link) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_error_details_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Help_Link.ProtoReflect.Descriptor instead.
+func (*Help_Link) Descriptor() ([]byte, []int) {
+	return file_google_rpc_error_details_proto_rawDescGZIP(), []int{8, 0}
+}
+
+func (x *Help_Link) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Help_Link) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+var File_google_rpc_error_details_proto protoreflect.FileDescriptor
+
+var file_google_rpc_error_details_proto_rawDesc = []byte{
+	0x0a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x72, 0x70, 0x63, 0x2f, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x5f, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x0a, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x1a, 0x1e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb9, 0x01, 0x0a,
+	0x09, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65,
+	0x61, 0x73, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x61, 0x73,
+	0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x49,
+	0x6e, 0x66, 0x6f, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x47, 0x0a, 0x09, 0x52, 0x65, 0x74, 0x72,
+	0x79, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x3a, 0x0a, 0x0b, 0x72, 0x65, 0x74, 0x72, 0x79, 0x5f, 0x64,
+	0x65, 0x6c, 0x61, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x72, 0x65, 0x74, 0x72, 0x79, 0x44, 0x65, 0x6c, 0x61,
+	0x79, 0x22, 0x48, 0x0a, 0x09, 0x44, 0x65, 0x62, 0x75, 0x67, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x23,
+	0x0a, 0x0d, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x5f, 0x65, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x45, 0x6e, 0x74, 0x72,
+	0x69, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x22, 0x9b, 0x01, 0x0a, 0x0c,
+	0x51, 0x75, 0x6f, 0x74, 0x61, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x12, 0x42, 0x0a, 0x0a,
+	0x76, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x22, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x51, 0x75,
+	0x6f, 0x74, 0x61, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x2e, 0x56, 0x69, 0x6f, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x76, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x1a, 0x47, 0x0a, 0x09, 0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a,
+	0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x50, 0x72,
+	0x65, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72,
+	0x65, 0x12, 0x49, 0x0a, 0x0a, 0x76, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72,
+	0x70, 0x63, 0x2e, 0x50, 0x72, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x46,
+	0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x2e, 0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x0a, 0x76, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x5b, 0x0a, 0x09,
+	0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a,
+	0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xa8, 0x01, 0x0a, 0x0a, 0x42, 0x61,
+	0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x50, 0x0a, 0x10, 0x66, 0x69, 0x65, 0x6c,
+	0x64, 0x5f, 0x76, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e,
+	0x42, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x66, 0x69, 0x65, 0x6c, 0x64,
+	0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x48, 0x0a, 0x0e, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x56, 0x69, 0x6f, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x05,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x66, 0x69, 0x65,
+	0x6c, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x4f, 0x0a, 0x0b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49,
+	0x6e, 0x66, 0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x6e,
+	0x67, 0x44, 0x61, 0x74, 0x61, 0x22, 0x90, 0x01, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x6f, 0x0a, 0x04, 0x48, 0x65, 0x6c, 0x70,
+	0x12, 0x2b, 0x0a, 0x05, 0x6c, 0x69, 0x6e, 0x6b, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x15, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x48, 0x65, 0x6c,
+	0x70, 0x2e, 0x4c, 0x69, 0x6e, 0x6b, 0x52, 0x05, 0x6c, 0x69, 0x6e, 0x6b, 0x73, 0x1a, 0x3a, 0x0a,
+	0x04, 0x4c, 0x69, 0x6e, 0x6b, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x44, 0x0a, 0x10, 0x4c, 0x6f, 0x63,
+	0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x16, 0x0a,
+	0x06, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6c,
+	0x6f, 0x63, 0x61, 0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42,
+	0x6c, 0x0a, 0x0e, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70,
+	0x63, 0x42, 0x11, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x3f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67,
+	0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x61, 0x70, 0x69, 0x73, 0x2f, 0x72, 0x70,
+	0x63, 0x2f, 0x65, 0x72, 0x72, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x3b, 0x65, 0x72, 0x72,
+	0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0xa2, 0x02, 0x03, 0x52, 0x50, 0x43, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_google_rpc_error_details_proto_rawDescOnce sync.Once
+	file_google_rpc_error_details_proto_rawDescData = file_google_rpc_error_details_proto_rawDesc
+)
+
+func file_google_rpc_error_details_proto_rawDescGZIP() []byte {
+	file_google_rpc_error_details_proto_rawDescOnce.Do(func() {
+		file_google_rpc_error_details_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_rpc_error_details_proto_rawDescData)
+	})
+	return file_google_rpc_error_details_proto_rawDescData
+}
+
+var file_google_rpc_error_details_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
+var file_google_rpc_error_details_proto_goTypes = []interface{}{
+	(*ErrorInfo)(nil),                     // 0: google.rpc.ErrorInfo
+	(*RetryInfo)(nil),                     // 1: google.rpc.RetryInfo
+	(*DebugInfo)(nil),                     // 2: google.rpc.DebugInfo
+	(*QuotaFailure)(nil),                  // 3: google.rpc.QuotaFailure
+	(*PreconditionFailure)(nil),           // 4: google.rpc.PreconditionFailure
+	(*BadRequest)(nil),                    // 5: google.rpc.BadRequest
+	(*RequestInfo)(nil),                   // 6: google.rpc.RequestInfo
+	(*ResourceInfo)(nil),                  // 7: google.rpc.ResourceInfo
+	(*Help)(nil),                          // 8: google.rpc.Help
+	(*LocalizedMessage)(nil),              // 9: google.rpc.LocalizedMessage
+	nil,                                   // 10: google.rpc.ErrorInfo.MetadataEntry
+	(*QuotaFailure_Violation)(nil),        // 11: google.rpc.QuotaFailure.Violation
+	(*PreconditionFailure_Violation)(nil), // 12: google.rpc.PreconditionFailure.Violation
+	(*BadRequest_FieldViolation)(nil),     // 13: google.rpc.BadRequest.FieldViolation
+	(*Help_Link)(nil),                     // 14: google.rpc.Help.Link
+	(*durationpb.Duration)(nil),           // 15: google.protobuf.Duration
+}
+var file_google_rpc_error_details_proto_depIdxs = []int32{
+	10, // 0: google.rpc.ErrorInfo.metadata:type_name -> google.rpc.ErrorInfo.MetadataEntry
+	15, // 1: google.rpc.RetryInfo.retry_delay:type_name -> google.protobuf.Duration
+	11, // 2: google.rpc.QuotaFailure.violations:type_name -> google.rpc.QuotaFailure.Violation
+	12, // 3: google.rpc.PreconditionFailure.violations:type_name -> google.rpc.PreconditionFailure.Violation
+	13, // 4: google.rpc.BadRequest.field_violations:type_name -> google.rpc.BadRequest.FieldViolation
+	14, // 5: google.rpc.Help.links:type_name -> google.rpc.Help.Link
+	6,  // [6:6] is the sub-list for method output_type
+	6,  // [6:6] is the sub-list for method input_type
+	6,  // [6:6] is the sub-list for extension type_name
+	6,  // [6:6] is the sub-list for extension extendee
+	0,  // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_google_rpc_error_details_proto_init() }
+func file_google_rpc_error_details_proto_init() {
+	if File_google_rpc_error_details_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_google_rpc_error_details_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ErrorInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RetryInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DebugInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuotaFailure); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PreconditionFailure); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BadRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResourceInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Help); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LocalizedMessage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QuotaFailure_Violation); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PreconditionFailure_Violation); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BadRequest_FieldViolation); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_rpc_error_details_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Help_Link); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_google_rpc_error_details_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   15,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_google_rpc_error_details_proto_goTypes,
+		DependencyIndexes: file_google_rpc_error_details_proto_depIdxs,
+		MessageInfos:      file_google_rpc_error_details_proto_msgTypes,
+	}.Build()
+	File_google_rpc_error_details_proto = out.File
+	file_google_rpc_error_details_proto_rawDesc = nil
+	file_google_rpc_error_details_proto_goTypes = nil
+	file_google_rpc_error_details_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go b/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
new file mode 100644
index 0000000000..a6b5081888
--- /dev/null
+++ b/vendor/google.golang.org/genproto/googleapis/rpc/status/status.pb.go
@@ -0,0 +1,203 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.9
+// source: google/rpc/status.proto
+
+package status
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The `Status` type defines a logical error model that is suitable for
+// different programming environments, including REST APIs and RPC APIs. It is
+// used by [gRPC](https://github.com/grpc). Each `Status` message contains
+// three pieces of data: error code, error message, and error details.
+//
+// You can find out more about this error model and how to work with it in the
+// [API Design Guide](https://cloud.google.com/apis/design/errors).
+type Status struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The status code, which should be an enum value of
+	// [google.rpc.Code][google.rpc.Code].
+	Code int32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
+	// A developer-facing error message, which should be in English. Any
+	// user-facing error message should be localized and sent in the
+	// [google.rpc.Status.details][google.rpc.Status.details] field, or localized
+	// by the client.
+	Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	// A list of messages that carry the error details.  There is a common set of
+	// message types for APIs to use.
+	Details []*anypb.Any `protobuf:"bytes,3,rep,name=details,proto3" json:"details,omitempty"`
+}
+
+func (x *Status) Reset() {
+	*x = Status{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_rpc_status_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Status) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Status) ProtoMessage() {}
+
+func (x *Status) ProtoReflect() protoreflect.Message {
+	mi := &file_google_rpc_status_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Status.ProtoReflect.Descriptor instead.
+func (*Status) Descriptor() ([]byte, []int) {
+	return file_google_rpc_status_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Status) GetCode() int32 {
+	if x != nil {
+		return x.Code
+	}
+	return 0
+}
+
+func (x *Status) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+func (x *Status) GetDetails() []*anypb.Any {
+	if x != nil {
+		return x.Details
+	}
+	return nil
+}
+
+var File_google_rpc_status_proto protoreflect.FileDescriptor
+
+var file_google_rpc_status_proto_rawDesc = []byte{
+	0x0a, 0x17, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x72, 0x70, 0x63, 0x2f, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0a, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x72, 0x70, 0x63, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0x66, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x6f,
+	0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x12, 0x18,
+	0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x2e, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61,
+	0x69, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52,
+	0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x42, 0x61, 0x0a, 0x0e, 0x63, 0x6f, 0x6d, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x42, 0x0b, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x37, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x65, 0x6e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x61, 0x70, 0x69, 0x73,
+	0x2f, 0x72, 0x70, 0x63, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x3b, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0xf8, 0x01, 0x01, 0xa2, 0x02, 0x03, 0x52, 0x50, 0x43, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
+}
+
+var (
+	file_google_rpc_status_proto_rawDescOnce sync.Once
+	file_google_rpc_status_proto_rawDescData = file_google_rpc_status_proto_rawDesc
+)
+
+func file_google_rpc_status_proto_rawDescGZIP() []byte {
+	file_google_rpc_status_proto_rawDescOnce.Do(func() {
+		file_google_rpc_status_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_rpc_status_proto_rawDescData)
+	})
+	return file_google_rpc_status_proto_rawDescData
+}
+
+var file_google_rpc_status_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_google_rpc_status_proto_goTypes = []interface{}{
+	(*Status)(nil),    // 0: google.rpc.Status
+	(*anypb.Any)(nil), // 1: google.protobuf.Any
+}
+var file_google_rpc_status_proto_depIdxs = []int32{
+	1, // 0: google.rpc.Status.details:type_name -> google.protobuf.Any
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_google_rpc_status_proto_init() }
+func file_google_rpc_status_proto_init() {
+	if File_google_rpc_status_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_google_rpc_status_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Status); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_google_rpc_status_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_google_rpc_status_proto_goTypes,
+		DependencyIndexes: file_google_rpc_status_proto_depIdxs,
+		MessageInfos:      file_google_rpc_status_proto_msgTypes,
+	}.Build()
+	File_google_rpc_status_proto = out.File
+	file_google_rpc_status_proto_rawDesc = nil
+	file_google_rpc_status_proto_goTypes = nil
+	file_google_rpc_status_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/genproto/protobuf/field_mask/field_mask.go b/vendor/google.golang.org/genproto/protobuf/field_mask/field_mask.go
new file mode 100644
index 0000000000..d10ad66533
--- /dev/null
+++ b/vendor/google.golang.org/genproto/protobuf/field_mask/field_mask.go
@@ -0,0 +1,23 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package field_mask aliases all exported identifiers in
+// package "google.golang.org/protobuf/types/known/fieldmaskpb".
+package field_mask
+
+import "google.golang.org/protobuf/types/known/fieldmaskpb"
+
+type FieldMask = fieldmaskpb.FieldMask
+
+var File_google_protobuf_field_mask_proto = fieldmaskpb.File_google_protobuf_field_mask_proto
diff --git a/vendor/google.golang.org/grpc/AUTHORS b/vendor/google.golang.org/grpc/AUTHORS
new file mode 100644
index 0000000000..e491a9e7f7
--- /dev/null
+++ b/vendor/google.golang.org/grpc/AUTHORS
@@ -0,0 +1 @@
+Google Inc.
diff --git a/vendor/google.golang.org/grpc/CODE-OF-CONDUCT.md b/vendor/google.golang.org/grpc/CODE-OF-CONDUCT.md
new file mode 100644
index 0000000000..9d4213ebca
--- /dev/null
+++ b/vendor/google.golang.org/grpc/CODE-OF-CONDUCT.md
@@ -0,0 +1,3 @@
+## Community Code of Conduct
+
+gRPC follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
diff --git a/vendor/google.golang.org/grpc/CONTRIBUTING.md b/vendor/google.golang.org/grpc/CONTRIBUTING.md
new file mode 100644
index 0000000000..608aa6e1ac
--- /dev/null
+++ b/vendor/google.golang.org/grpc/CONTRIBUTING.md
@@ -0,0 +1,73 @@
+# How to contribute
+
+We definitely welcome your patches and contributions to gRPC! Please read the gRPC
+organization's [governance rules](https://github.com/grpc/grpc-community/blob/master/governance.md)
+and [contribution guidelines](https://github.com/grpc/grpc-community/blob/master/CONTRIBUTING.md) before proceeding.
+
+If you are new to github, please start by reading [Pull Request howto](https://help.github.com/articles/about-pull-requests/)
+
+## Legal requirements
+
+In order to protect both you and ourselves, you will need to sign the
+[Contributor License Agreement](https://identity.linuxfoundation.org/projects/cncf).
+
+## Guidelines for Pull Requests
+How to get your contributions merged smoothly and quickly.
+
+- Create **small PRs** that are narrowly focused on **addressing a single
+  concern**. We often times receive PRs that are trying to fix several things at
+  a time, but only one fix is considered acceptable, nothing gets merged and
+  both author's & review's time is wasted. Create more PRs to address different
+  concerns and everyone will be happy.
+
+- If you are searching for features to work on, issues labeled [Status: Help
+  Wanted](https://github.com/grpc/grpc-go/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3A%22Status%3A+Help+Wanted%22)
+  is a great place to start. These issues are well-documented and usually can be
+  resolved with a single pull request.
+
+- If you are adding a new file, make sure it has the copyright message template 
+  at the top as a comment. You can copy over the message from an existing file 
+  and update the year.
+
+- The grpc package should only depend on standard Go packages and a small number
+  of exceptions. If your contribution introduces new dependencies which are NOT
+  in the [list](https://godoc.org/google.golang.org/grpc?imports), you need a
+  discussion with gRPC-Go authors and consultants.
+
+- For speculative changes, consider opening an issue and discussing it first. If
+  you are suggesting a behavioral or API change, consider starting with a [gRFC
+  proposal](https://github.com/grpc/proposal).
+
+- Provide a good **PR description** as a record of **what** change is being made
+  and **why** it was made. Link to a github issue if it exists.
+
+- If you want to fix formatting or style, consider whether your changes are an 
+  obvious improvement or might be considered a personal preference. If a style 
+  change is based on preference, it likely will not be accepted. If it corrects 
+  widely agreed-upon anti-patterns, then please do create a PR and explain the 
+  benefits of the change.
+
+- Unless your PR is trivial, you should expect there will be reviewer comments
+  that you'll need to address before merging. We'll mark it as `Status: Requires
+  Reporter Clarification` if we expect you to respond to these comments in a
+  timely manner. If the PR remains inactive for 6 days, it will be marked as
+  `stale` and automatically close 7 days after that if we don't hear back from
+  you.
+
+- Maintain **clean commit history** and use **meaningful commit messages**. PRs
+  with messy commit history are difficult to review and won't be merged. Use
+  `rebase -i upstream/master` to curate your commit history and/or to bring in
+  latest changes from master (but avoid rebasing in the middle of a code
+  review).
+
+- Keep your PR up to date with upstream/master (if there are merge conflicts, we
+  can't really merge your change).
+
+- **All tests need to be passing** before your change can be merged. We
+  recommend you **run tests locally** before creating your PR to catch breakages
+  early on.
+  - `VET_SKIP_PROTO=1 ./vet.sh` to catch vet errors
+  - `go test -cpu 1,4 -timeout 7m ./...` to run the tests
+  - `go test -race -cpu 1,4 -timeout 7m ./...` to run tests in race mode
+
+- Exceptions to the rules can be made if there's a compelling reason for doing so.
diff --git a/vendor/google.golang.org/grpc/GOVERNANCE.md b/vendor/google.golang.org/grpc/GOVERNANCE.md
new file mode 100644
index 0000000000..d6ff267471
--- /dev/null
+++ b/vendor/google.golang.org/grpc/GOVERNANCE.md
@@ -0,0 +1 @@
+This repository is governed by the gRPC organization's [governance rules](https://github.com/grpc/grpc-community/blob/master/governance.md).
diff --git a/vendor/google.golang.org/grpc/LICENSE b/vendor/google.golang.org/grpc/LICENSE
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/vendor/google.golang.org/grpc/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/google.golang.org/grpc/MAINTAINERS.md b/vendor/google.golang.org/grpc/MAINTAINERS.md
new file mode 100644
index 0000000000..c6672c0a3e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/MAINTAINERS.md
@@ -0,0 +1,28 @@
+This page lists all active maintainers of this repository. If you were a
+maintainer and would like to add your name to the Emeritus list, please send us a
+PR.
+
+See [GOVERNANCE.md](https://github.com/grpc/grpc-community/blob/master/governance.md)
+for governance guidelines and how to become a maintainer.
+See [CONTRIBUTING.md](https://github.com/grpc/grpc-community/blob/master/CONTRIBUTING.md)
+for general contribution guidelines.
+
+## Maintainers (in alphabetical order)
+
+- [cesarghali](https://github.com/cesarghali), Google LLC
+- [dfawley](https://github.com/dfawley), Google LLC
+- [easwars](https://github.com/easwars), Google LLC
+- [menghanl](https://github.com/menghanl), Google LLC
+- [srini100](https://github.com/srini100), Google LLC
+
+## Emeritus Maintainers (in alphabetical order)
+- [adelez](https://github.com/adelez), Google LLC
+- [canguler](https://github.com/canguler), Google LLC
+- [iamqizhao](https://github.com/iamqizhao), Google LLC
+- [jadekler](https://github.com/jadekler), Google LLC
+- [jtattermusch](https://github.com/jtattermusch), Google LLC
+- [lyuxuan](https://github.com/lyuxuan), Google LLC
+- [makmukhi](https://github.com/makmukhi), Google LLC
+- [matt-kwong](https://github.com/matt-kwong), Google LLC
+- [nicolasnoble](https://github.com/nicolasnoble), Google LLC
+- [yongni](https://github.com/yongni), Google LLC
diff --git a/vendor/google.golang.org/grpc/Makefile b/vendor/google.golang.org/grpc/Makefile
new file mode 100644
index 0000000000..1f8960922b
--- /dev/null
+++ b/vendor/google.golang.org/grpc/Makefile
@@ -0,0 +1,46 @@
+all: vet test testrace
+
+build:
+	go build google.golang.org/grpc/...
+
+clean:
+	go clean -i google.golang.org/grpc/...
+
+deps:
+	GO111MODULE=on go get -d -v google.golang.org/grpc/...
+
+proto:
+	@ if ! which protoc > /dev/null; then \
+		echo "error: protoc not installed" >&2; \
+		exit 1; \
+	fi
+	go generate google.golang.org/grpc/...
+
+test:
+	go test -cpu 1,4 -timeout 7m google.golang.org/grpc/...
+
+testsubmodule:
+	cd security/advancedtls && go test -cpu 1,4 -timeout 7m google.golang.org/grpc/security/advancedtls/...
+	cd security/authorization && go test -cpu 1,4 -timeout 7m google.golang.org/grpc/security/authorization/...
+
+testrace:
+	go test -race -cpu 1,4 -timeout 7m google.golang.org/grpc/...
+
+testdeps:
+	GO111MODULE=on go get -d -v -t google.golang.org/grpc/...
+
+vet: vetdeps
+	./vet.sh
+
+vetdeps:
+	./vet.sh -install
+
+.PHONY: \
+	all \
+	build \
+	clean \
+	proto \
+	test \
+	testrace \
+	vet \
+	vetdeps
diff --git a/vendor/google.golang.org/grpc/NOTICE.txt b/vendor/google.golang.org/grpc/NOTICE.txt
new file mode 100644
index 0000000000..530197749e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/NOTICE.txt
@@ -0,0 +1,13 @@
+Copyright 2014 gRPC authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/vendor/google.golang.org/grpc/README.md b/vendor/google.golang.org/grpc/README.md
new file mode 100644
index 0000000000..0e6ae69a58
--- /dev/null
+++ b/vendor/google.golang.org/grpc/README.md
@@ -0,0 +1,141 @@
+# gRPC-Go
+
+[![Build Status](https://travis-ci.org/grpc/grpc-go.svg)](https://travis-ci.org/grpc/grpc-go)
+[![GoDoc](https://pkg.go.dev/badge/google.golang.org/grpc)][API]
+[![GoReportCard](https://goreportcard.com/badge/grpc/grpc-go)](https://goreportcard.com/report/github.com/grpc/grpc-go)
+
+The [Go][] implementation of [gRPC][]: A high performance, open source, general
+RPC framework that puts mobile and HTTP/2 first. For more information see the
+[Go gRPC docs][], or jump directly into the [quick start][].
+
+## Prerequisites
+
+- **[Go][]**: any one of the **three latest major** [releases][go-releases].
+
+## Installation
+
+With [Go module][] support (Go 1.11+), simply add the following import
+
+```go
+import "google.golang.org/grpc"
+```
+
+to your code, and then `go [build|run|test]` will automatically fetch the
+necessary dependencies.
+
+Otherwise, to install the `grpc-go` package, run the following command:
+
+```console
+$ go get -u google.golang.org/grpc
+```
+
+> **Note:** If you are trying to access `grpc-go` from **China**, see the
+> [FAQ](#FAQ) below.
+
+## Learn more
+
+- [Go gRPC docs][], which include a [quick start][] and [API
+  reference][API] among other resources
+- [Low-level technical docs](Documentation) from this repository
+- [Performance benchmark][]
+- [Examples](examples)
+
+## FAQ
+
+### I/O Timeout Errors
+
+The `golang.org` domain may be blocked from some countries. `go get` usually
+produces an error like the following when this happens:
+
+```console
+$ go get -u google.golang.org/grpc
+package google.golang.org/grpc: unrecognized import path "google.golang.org/grpc" (https fetch: Get https://google.golang.org/grpc?go-get=1: dial tcp 216.239.37.1:443: i/o timeout)
+```
+
+To build Go code, there are several options:
+
+- Set up a VPN and access google.golang.org through that.
+
+- Without Go module support: `git clone` the repo manually:
+
+  ```sh
+  git clone https://github.com/grpc/grpc-go.git $GOPATH/src/google.golang.org/grpc
+  ```
+
+  You will need to do the same for all of grpc's dependencies in `golang.org`,
+  e.g. `golang.org/x/net`.
+
+- With Go module support: it is possible to use the `replace` feature of `go
+  mod` to create aliases for golang.org packages.  In your project's directory:
+
+  ```sh
+  go mod edit -replace=google.golang.org/grpc=github.com/grpc/grpc-go@latest
+  go mod tidy
+  go mod vendor
+  go build -mod=vendor
+  ```
+
+  Again, this will need to be done for all transitive dependencies hosted on
+  golang.org as well. For details, refer to [golang/go issue #28652](https://github.com/golang/go/issues/28652).
+
+### Compiling error, undefined: grpc.SupportPackageIsVersion
+
+#### If you are using Go modules:
+
+Ensure your gRPC-Go version is `require`d at the appropriate version in
+the same module containing the generated `.pb.go` files.  For example,
+`SupportPackageIsVersion6` needs `v1.27.0`, so in your `go.mod` file:
+
+```go
+module <your module name>
+
+require (
+    google.golang.org/grpc v1.27.0
+)
+```
+
+#### If you are *not* using Go modules:
+
+Update the `proto` package, gRPC package, and rebuild the `.proto` files:
+
+```sh
+go get -u github.com/golang/protobuf/{proto,protoc-gen-go}
+go get -u google.golang.org/grpc
+protoc --go_out=plugins=grpc:. *.proto
+```
+
+### How to turn on logging
+
+The default logger is controlled by environment variables. Turn everything on
+like this:
+
+```console
+$ export GRPC_GO_LOG_VERBOSITY_LEVEL=99
+$ export GRPC_GO_LOG_SEVERITY_LEVEL=info
+```
+
+### The RPC failed with error `"code = Unavailable desc = transport is closing"`
+
+This error means the connection the RPC is using was closed, and there are many
+possible reasons, including:
+ 1. mis-configured transport credentials, connection failed on handshaking
+ 1. bytes disrupted, possibly by a proxy in between
+ 1. server shutdown
+ 1. Keepalive parameters caused connection shutdown, for example if you have configured
+    your server to terminate connections regularly to [trigger DNS lookups](https://github.com/grpc/grpc-go/issues/3170#issuecomment-552517779).
+    If this is the case, you may want to increase your [MaxConnectionAgeGrace](https://pkg.go.dev/google.golang.org/grpc/keepalive?tab=doc#ServerParameters),
+    to allow longer RPC calls to finish.
+
+It can be tricky to debug this because the error happens on the client side but
+the root cause of the connection being closed is on the server side. Turn on
+logging on __both client and server__, and see if there are any transport
+errors.
+
+[API]: https://pkg.go.dev/google.golang.org/grpc
+[Go]: https://golang.org
+[Go module]: https://github.com/golang/go/wiki/Modules
+[gRPC]: https://grpc.io
+[Go gRPC docs]: https://grpc.io/docs/languages/go
+[Performance benchmark]: https://performance-dot-grpc-testing.appspot.com/explore?dashboard=5180705743044608
+[quick start]: https://grpc.io/docs/languages/go/quickstart
+[go-releases]: https://golang.org/doc/devel/release.html
diff --git a/vendor/google.golang.org/grpc/SECURITY.md b/vendor/google.golang.org/grpc/SECURITY.md
new file mode 100644
index 0000000000..be6e108705
--- /dev/null
+++ b/vendor/google.golang.org/grpc/SECURITY.md
@@ -0,0 +1,3 @@
+# Security Policy
+
+For information on gRPC Security Policy and reporting potentional security issues, please see [gRPC CVE Process](https://github.com/grpc/proposal/blob/master/P4-grpc-cve-process.md).
diff --git a/vendor/google.golang.org/grpc/attributes/attributes.go b/vendor/google.golang.org/grpc/attributes/attributes.go
new file mode 100644
index 0000000000..02f5dc5318
--- /dev/null
+++ b/vendor/google.golang.org/grpc/attributes/attributes.go
@@ -0,0 +1,101 @@
+/*
+ *
+ * Copyright 2019 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package attributes defines a generic key/value store used in various gRPC
+// components.
+//
+// # Experimental
+//
+// Notice: This package is EXPERIMENTAL and may be changed or removed in a
+// later release.
+package attributes
+
+// Attributes is an immutable struct for storing and retrieving generic
+// key/value pairs.  Keys must be hashable, and users should define their own
+// types for keys.  Values should not be modified after they are added to an
+// Attributes or if they were received from one.  If values implement 'Equal(o
+// interface{}) bool', it will be called by (*Attributes).Equal to determine
+// whether two values with the same key should be considered equal.
+type Attributes struct {
+	m map[interface{}]interface{}
+}
+
+// New returns a new Attributes containing the key/value pair.
+func New(key, value interface{}) *Attributes {
+	return &Attributes{m: map[interface{}]interface{}{key: value}}
+}
+
+// WithValue returns a new Attributes containing the previous keys and values
+// and the new key/value pair.  If the same key appears multiple times, the
+// last value overwrites all previous values for that key.  To remove an
+// existing key, use a nil value.  value should not be modified later.
+func (a *Attributes) WithValue(key, value interface{}) *Attributes {
+	if a == nil {
+		return New(key, value)
+	}
+	n := &Attributes{m: make(map[interface{}]interface{}, len(a.m)+1)}
+	for k, v := range a.m {
+		n.m[k] = v
+	}
+	n.m[key] = value
+	return n
+}
+
+// Value returns the value associated with these attributes for key, or nil if
+// no value is associated with key.  The returned value should not be modified.
+func (a *Attributes) Value(key interface{}) interface{} {
+	if a == nil {
+		return nil
+	}
+	return a.m[key]
+}
+
+// Equal returns whether a and o are equivalent.  If 'Equal(o interface{})
+// bool' is implemented for a value in the attributes, it is called to
+// determine if the value matches the one stored in the other attributes.  If
+// Equal is not implemented, standard equality is used to determine if the two
+// values are equal. Note that some types (e.g. maps) aren't comparable by
+// default, so they must be wrapped in a struct, or in an alias type, with Equal
+// defined.
+func (a *Attributes) Equal(o *Attributes) bool {
+	if a == nil && o == nil {
+		return true
+	}
+	if a == nil || o == nil {
+		return false
+	}
+	if len(a.m) != len(o.m) {
+		return false
+	}
+	for k, v := range a.m {
+		ov, ok := o.m[k]
+		if !ok {
+			// o missing element of a
+			return false
+		}
+		if eq, ok := v.(interface{ Equal(o interface{}) bool }); ok {
+			if !eq.Equal(ov) {
+				return false
+			}
+		} else if v != ov {
+			// Fallback to a standard equality check if Value is unimplemented.
+			return false
+		}
+	}
+	return true
+}
diff --git a/vendor/google.golang.org/grpc/backoff.go b/vendor/google.golang.org/grpc/backoff.go
new file mode 100644
index 0000000000..29475e31c9
--- /dev/null
+++ b/vendor/google.golang.org/grpc/backoff.go
@@ -0,0 +1,61 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// See internal/backoff package for the backoff implementation. This file is
+// kept for the exported types and API backward compatibility.
+
+package grpc
+
+import (
+	"time"
+
+	"google.golang.org/grpc/backoff"
+)
+
+// DefaultBackoffConfig uses values specified for backoff in
+// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md.
+//
+// Deprecated: use ConnectParams instead. Will be supported throughout 1.x.
+var DefaultBackoffConfig = BackoffConfig{
+	MaxDelay: 120 * time.Second,
+}
+
+// BackoffConfig defines the parameters for the default gRPC backoff strategy.
+//
+// Deprecated: use ConnectParams instead. Will be supported throughout 1.x.
+type BackoffConfig struct {
+	// MaxDelay is the upper bound of backoff delay.
+	MaxDelay time.Duration
+}
+
+// ConnectParams defines the parameters for connecting and retrying. Users are
+// encouraged to use this instead of the BackoffConfig type defined above. See
+// here for more details:
+// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type ConnectParams struct {
+	// Backoff specifies the configuration options for connection backoff.
+	Backoff backoff.Config
+	// MinConnectTimeout is the minimum amount of time we are willing to give a
+	// connection to complete.
+	MinConnectTimeout time.Duration
+}
diff --git a/vendor/google.golang.org/grpc/backoff/backoff.go b/vendor/google.golang.org/grpc/backoff/backoff.go
new file mode 100644
index 0000000000..0787d0b50c
--- /dev/null
+++ b/vendor/google.golang.org/grpc/backoff/backoff.go
@@ -0,0 +1,52 @@
+/*
+ *
+ * Copyright 2019 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package backoff provides configuration options for backoff.
+//
+// More details can be found at:
+// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md.
+//
+// All APIs in this package are experimental.
+package backoff
+
+import "time"
+
+// Config defines the configuration options for backoff.
+type Config struct {
+	// BaseDelay is the amount of time to backoff after the first failure.
+	BaseDelay time.Duration
+	// Multiplier is the factor with which to multiply backoffs after a
+	// failed retry. Should ideally be greater than 1.
+	Multiplier float64
+	// Jitter is the factor with which backoffs are randomized.
+	Jitter float64
+	// MaxDelay is the upper bound of backoff delay.
+	MaxDelay time.Duration
+}
+
+// DefaultConfig is a backoff configuration with the default values specfied
+// at https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md.
+//
+// This should be useful for callers who want to configure backoff with
+// non-default values only for a subset of the options.
+var DefaultConfig = Config{
+	BaseDelay:  1.0 * time.Second,
+	Multiplier: 1.6,
+	Jitter:     0.2,
+	MaxDelay:   120 * time.Second,
+}
diff --git a/vendor/google.golang.org/grpc/balancer/balancer.go b/vendor/google.golang.org/grpc/balancer/balancer.go
new file mode 100644
index 0000000000..09d61dd1b5
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/balancer.go
@@ -0,0 +1,404 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package balancer defines APIs for load balancing in gRPC.
+// All APIs in this package are experimental.
+package balancer
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net"
+	"strings"
+
+	"google.golang.org/grpc/channelz"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+var (
+	// m is a map from name to balancer builder.
+	m = make(map[string]Builder)
+)
+
+// Register registers the balancer builder to the balancer map. b.Name
+// (lowercased) will be used as the name registered with this builder.  If the
+// Builder implements ConfigParser, ParseConfig will be called when new service
+// configs are received by the resolver, and the result will be provided to the
+// Balancer in UpdateClientConnState.
+//
+// NOTE: this function must only be called during initialization time (i.e. in
+// an init() function), and is not thread-safe. If multiple Balancers are
+// registered with the same name, the one registered last will take effect.
+func Register(b Builder) {
+	m[strings.ToLower(b.Name())] = b
+}
+
+// unregisterForTesting deletes the balancer with the given name from the
+// balancer map.
+//
+// This function is not thread-safe.
+func unregisterForTesting(name string) {
+	delete(m, name)
+}
+
+func init() {
+	internal.BalancerUnregister = unregisterForTesting
+}
+
+// Get returns the resolver builder registered with the given name.
+// Note that the compare is done in a case-insensitive fashion.
+// If no builder is register with the name, nil will be returned.
+func Get(name string) Builder {
+	if b, ok := m[strings.ToLower(name)]; ok {
+		return b
+	}
+	return nil
+}
+
+// A SubConn represents a single connection to a gRPC backend service.
+//
+// Each SubConn contains a list of addresses.
+//
+// All SubConns start in IDLE, and will not try to connect. To trigger the
+// connecting, Balancers must call Connect.  If a connection re-enters IDLE,
+// Balancers must call Connect again to trigger a new connection attempt.
+//
+// gRPC will try to connect to the addresses in sequence, and stop trying the
+// remainder once the first connection is successful. If an attempt to connect
+// to all addresses encounters an error, the SubConn will enter
+// TRANSIENT_FAILURE for a backoff period, and then transition to IDLE.
+//
+// Once established, if a connection is lost, the SubConn will transition
+// directly to IDLE.
+//
+// This interface is to be implemented by gRPC. Users should not need their own
+// implementation of this interface. For situations like testing, any
+// implementations should embed this interface. This allows gRPC to add new
+// methods to this interface.
+type SubConn interface {
+	// UpdateAddresses updates the addresses used in this SubConn.
+	// gRPC checks if currently-connected address is still in the new list.
+	// If it's in the list, the connection will be kept.
+	// If it's not in the list, the connection will gracefully closed, and
+	// a new connection will be created.
+	//
+	// This will trigger a state transition for the SubConn.
+	//
+	// Deprecated: This method is now part of the ClientConn interface and will
+	// eventually be removed from here.
+	UpdateAddresses([]resolver.Address)
+	// Connect starts the connecting for this SubConn.
+	Connect()
+	// GetOrBuildProducer returns a reference to the existing Producer for this
+	// ProducerBuilder in this SubConn, or, if one does not currently exist,
+	// creates a new one and returns it.  Returns a close function which must
+	// be called when the Producer is no longer needed.
+	GetOrBuildProducer(ProducerBuilder) (p Producer, close func())
+}
+
+// NewSubConnOptions contains options to create new SubConn.
+type NewSubConnOptions struct {
+	// CredsBundle is the credentials bundle that will be used in the created
+	// SubConn. If it's nil, the original creds from grpc DialOptions will be
+	// used.
+	//
+	// Deprecated: Use the Attributes field in resolver.Address to pass
+	// arbitrary data to the credential handshaker.
+	CredsBundle credentials.Bundle
+	// HealthCheckEnabled indicates whether health check service should be
+	// enabled on this SubConn
+	HealthCheckEnabled bool
+}
+
+// State contains the balancer's state relevant to the gRPC ClientConn.
+type State struct {
+	// State contains the connectivity state of the balancer, which is used to
+	// determine the state of the ClientConn.
+	ConnectivityState connectivity.State
+	// Picker is used to choose connections (SubConns) for RPCs.
+	Picker Picker
+}
+
+// ClientConn represents a gRPC ClientConn.
+//
+// This interface is to be implemented by gRPC. Users should not need a
+// brand new implementation of this interface. For the situations like
+// testing, the new implementation should embed this interface. This allows
+// gRPC to add new methods to this interface.
+type ClientConn interface {
+	// NewSubConn is called by balancer to create a new SubConn.
+	// It doesn't block and wait for the connections to be established.
+	// Behaviors of the SubConn can be controlled by options.
+	NewSubConn([]resolver.Address, NewSubConnOptions) (SubConn, error)
+	// RemoveSubConn removes the SubConn from ClientConn.
+	// The SubConn will be shutdown.
+	RemoveSubConn(SubConn)
+	// UpdateAddresses updates the addresses used in the passed in SubConn.
+	// gRPC checks if the currently connected address is still in the new list.
+	// If so, the connection will be kept. Else, the connection will be
+	// gracefully closed, and a new connection will be created.
+	//
+	// This will trigger a state transition for the SubConn.
+	UpdateAddresses(SubConn, []resolver.Address)
+
+	// UpdateState notifies gRPC that the balancer's internal state has
+	// changed.
+	//
+	// gRPC will update the connectivity state of the ClientConn, and will call
+	// Pick on the new Picker to pick new SubConns.
+	UpdateState(State)
+
+	// ResolveNow is called by balancer to notify gRPC to do a name resolving.
+	ResolveNow(resolver.ResolveNowOptions)
+
+	// Target returns the dial target for this ClientConn.
+	//
+	// Deprecated: Use the Target field in the BuildOptions instead.
+	Target() string
+}
+
+// BuildOptions contains additional information for Build.
+type BuildOptions struct {
+	// DialCreds is the transport credentials to use when communicating with a
+	// remote load balancer server. Balancer implementations which do not
+	// communicate with a remote load balancer server can ignore this field.
+	DialCreds credentials.TransportCredentials
+	// CredsBundle is the credentials bundle to use when communicating with a
+	// remote load balancer server. Balancer implementations which do not
+	// communicate with a remote load balancer server can ignore this field.
+	CredsBundle credentials.Bundle
+	// Dialer is the custom dialer to use when communicating with a remote load
+	// balancer server. Balancer implementations which do not communicate with a
+	// remote load balancer server can ignore this field.
+	Dialer func(context.Context, string) (net.Conn, error)
+	// Authority is the server name to use as part of the authentication
+	// handshake when communicating with a remote load balancer server. Balancer
+	// implementations which do not communicate with a remote load balancer
+	// server can ignore this field.
+	Authority string
+	// ChannelzParentID is the parent ClientConn's channelz ID.
+	ChannelzParentID *channelz.Identifier
+	// CustomUserAgent is the custom user agent set on the parent ClientConn.
+	// The balancer should set the same custom user agent if it creates a
+	// ClientConn.
+	CustomUserAgent string
+	// Target contains the parsed address info of the dial target. It is the
+	// same resolver.Target as passed to the resolver. See the documentation for
+	// the resolver.Target type for details about what it contains.
+	Target resolver.Target
+}
+
+// Builder creates a balancer.
+type Builder interface {
+	// Build creates a new balancer with the ClientConn.
+	Build(cc ClientConn, opts BuildOptions) Balancer
+	// Name returns the name of balancers built by this builder.
+	// It will be used to pick balancers (for example in service config).
+	Name() string
+}
+
+// ConfigParser parses load balancer configs.
+type ConfigParser interface {
+	// ParseConfig parses the JSON load balancer config provided into an
+	// internal form or returns an error if the config is invalid.  For future
+	// compatibility reasons, unknown fields in the config should be ignored.
+	ParseConfig(LoadBalancingConfigJSON json.RawMessage) (serviceconfig.LoadBalancingConfig, error)
+}
+
+// PickInfo contains additional information for the Pick operation.
+type PickInfo struct {
+	// FullMethodName is the method name that NewClientStream() is called
+	// with. The canonical format is /service/Method.
+	FullMethodName string
+	// Ctx is the RPC's context, and may contain relevant RPC-level information
+	// like the outgoing header metadata.
+	Ctx context.Context
+}
+
+// DoneInfo contains additional information for done.
+type DoneInfo struct {
+	// Err is the rpc error the RPC finished with. It could be nil.
+	Err error
+	// Trailer contains the metadata from the RPC's trailer, if present.
+	Trailer metadata.MD
+	// BytesSent indicates if any bytes have been sent to the server.
+	BytesSent bool
+	// BytesReceived indicates if any byte has been received from the server.
+	BytesReceived bool
+	// ServerLoad is the load received from server. It's usually sent as part of
+	// trailing metadata.
+	//
+	// The only supported type now is *orca_v3.LoadReport.
+	ServerLoad interface{}
+}
+
+var (
+	// ErrNoSubConnAvailable indicates no SubConn is available for pick().
+	// gRPC will block the RPC until a new picker is available via UpdateState().
+	ErrNoSubConnAvailable = errors.New("no SubConn is available")
+	// ErrTransientFailure indicates all SubConns are in TransientFailure.
+	// WaitForReady RPCs will block, non-WaitForReady RPCs will fail.
+	//
+	// Deprecated: return an appropriate error based on the last resolution or
+	// connection attempt instead.  The behavior is the same for any non-gRPC
+	// status error.
+	ErrTransientFailure = errors.New("all SubConns are in TransientFailure")
+)
+
+// PickResult contains information related to a connection chosen for an RPC.
+type PickResult struct {
+	// SubConn is the connection to use for this pick, if its state is Ready.
+	// If the state is not Ready, gRPC will block the RPC until a new Picker is
+	// provided by the balancer (using ClientConn.UpdateState).  The SubConn
+	// must be one returned by ClientConn.NewSubConn.
+	SubConn SubConn
+
+	// Done is called when the RPC is completed.  If the SubConn is not ready,
+	// this will be called with a nil parameter.  If the SubConn is not a valid
+	// type, Done may not be called.  May be nil if the balancer does not wish
+	// to be notified when the RPC completes.
+	Done func(DoneInfo)
+
+	// Metadata provides a way for LB policies to inject arbitrary per-call
+	// metadata. Any metadata returned here will be merged with existing
+	// metadata added by the client application.
+	//
+	// LB policies with child policies are responsible for propagating metadata
+	// injected by their children to the ClientConn, as part of Pick().
+	Metatada metadata.MD
+}
+
+// TransientFailureError returns e.  It exists for backward compatibility and
+// will be deleted soon.
+//
+// Deprecated: no longer necessary, picker errors are treated this way by
+// default.
+func TransientFailureError(e error) error { return e }
+
+// Picker is used by gRPC to pick a SubConn to send an RPC.
+// Balancer is expected to generate a new picker from its snapshot every time its
+// internal state has changed.
+//
+// The pickers used by gRPC can be updated by ClientConn.UpdateState().
+type Picker interface {
+	// Pick returns the connection to use for this RPC and related information.
+	//
+	// Pick should not block.  If the balancer needs to do I/O or any blocking
+	// or time-consuming work to service this call, it should return
+	// ErrNoSubConnAvailable, and the Pick call will be repeated by gRPC when
+	// the Picker is updated (using ClientConn.UpdateState).
+	//
+	// If an error is returned:
+	//
+	// - If the error is ErrNoSubConnAvailable, gRPC will block until a new
+	//   Picker is provided by the balancer (using ClientConn.UpdateState).
+	//
+	// - If the error is a status error (implemented by the grpc/status
+	//   package), gRPC will terminate the RPC with the code and message
+	//   provided.
+	//
+	// - For all other errors, wait for ready RPCs will wait, but non-wait for
+	//   ready RPCs will be terminated with this error's Error() string and
+	//   status code Unavailable.
+	Pick(info PickInfo) (PickResult, error)
+}
+
+// Balancer takes input from gRPC, manages SubConns, and collects and aggregates
+// the connectivity states.
+//
+// It also generates and updates the Picker used by gRPC to pick SubConns for RPCs.
+//
+// UpdateClientConnState, ResolverError, UpdateSubConnState, and Close are
+// guaranteed to be called synchronously from the same goroutine.  There's no
+// guarantee on picker.Pick, it may be called anytime.
+type Balancer interface {
+	// UpdateClientConnState is called by gRPC when the state of the ClientConn
+	// changes.  If the error returned is ErrBadResolverState, the ClientConn
+	// will begin calling ResolveNow on the active name resolver with
+	// exponential backoff until a subsequent call to UpdateClientConnState
+	// returns a nil error.  Any other errors are currently ignored.
+	UpdateClientConnState(ClientConnState) error
+	// ResolverError is called by gRPC when the name resolver reports an error.
+	ResolverError(error)
+	// UpdateSubConnState is called by gRPC when the state of a SubConn
+	// changes.
+	UpdateSubConnState(SubConn, SubConnState)
+	// Close closes the balancer. The balancer is not required to call
+	// ClientConn.RemoveSubConn for its existing SubConns.
+	Close()
+}
+
+// ExitIdler is an optional interface for balancers to implement.  If
+// implemented, ExitIdle will be called when ClientConn.Connect is called, if
+// the ClientConn is idle.  If unimplemented, ClientConn.Connect will cause
+// all SubConns to connect.
+//
+// Notice: it will be required for all balancers to implement this in a future
+// release.
+type ExitIdler interface {
+	// ExitIdle instructs the LB policy to reconnect to backends / exit the
+	// IDLE state, if appropriate and possible.  Note that SubConns that enter
+	// the IDLE state will not reconnect until SubConn.Connect is called.
+	ExitIdle()
+}
+
+// SubConnState describes the state of a SubConn.
+type SubConnState struct {
+	// ConnectivityState is the connectivity state of the SubConn.
+	ConnectivityState connectivity.State
+	// ConnectionError is set if the ConnectivityState is TransientFailure,
+	// describing the reason the SubConn failed.  Otherwise, it is nil.
+	ConnectionError error
+}
+
+// ClientConnState describes the state of a ClientConn relevant to the
+// balancer.
+type ClientConnState struct {
+	ResolverState resolver.State
+	// The parsed load balancing configuration returned by the builder's
+	// ParseConfig method, if implemented.
+	BalancerConfig serviceconfig.LoadBalancingConfig
+}
+
+// ErrBadResolverState may be returned by UpdateClientConnState to indicate a
+// problem with the provided name resolver data.
+var ErrBadResolverState = errors.New("bad resolver state")
+
+// A ProducerBuilder is a simple constructor for a Producer.  It is used by the
+// SubConn to create producers when needed.
+type ProducerBuilder interface {
+	// Build creates a Producer.  The first parameter is always a
+	// grpc.ClientConnInterface (a type to allow creating RPCs/streams on the
+	// associated SubConn), but is declared as interface{} to avoid a
+	// dependency cycle.  Should also return a close function that will be
+	// called when all references to the Producer have been given up.
+	Build(grpcClientConnInterface interface{}) (p Producer, close func())
+}
+
+// A Producer is a type shared among potentially many consumers.  It is
+// associated with a SubConn, and an implementation will typically contain
+// other methods to provide additional functionality, e.g. configuration or
+// subscription registration.
+type Producer interface {
+}
diff --git a/vendor/google.golang.org/grpc/balancer/base/balancer.go b/vendor/google.golang.org/grpc/balancer/base/balancer.go
new file mode 100644
index 0000000000..3929c26d31
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/base/balancer.go
@@ -0,0 +1,254 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package base
+
+import (
+	"errors"
+	"fmt"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/resolver"
+)
+
+var logger = grpclog.Component("balancer")
+
+type baseBuilder struct {
+	name          string
+	pickerBuilder PickerBuilder
+	config        Config
+}
+
+func (bb *baseBuilder) Build(cc balancer.ClientConn, opt balancer.BuildOptions) balancer.Balancer {
+	bal := &baseBalancer{
+		cc:            cc,
+		pickerBuilder: bb.pickerBuilder,
+
+		subConns: resolver.NewAddressMap(),
+		scStates: make(map[balancer.SubConn]connectivity.State),
+		csEvltr:  &balancer.ConnectivityStateEvaluator{},
+		config:   bb.config,
+		state:    connectivity.Connecting,
+	}
+	// Initialize picker to a picker that always returns
+	// ErrNoSubConnAvailable, because when state of a SubConn changes, we
+	// may call UpdateState with this picker.
+	bal.picker = NewErrPicker(balancer.ErrNoSubConnAvailable)
+	return bal
+}
+
+func (bb *baseBuilder) Name() string {
+	return bb.name
+}
+
+type baseBalancer struct {
+	cc            balancer.ClientConn
+	pickerBuilder PickerBuilder
+
+	csEvltr *balancer.ConnectivityStateEvaluator
+	state   connectivity.State
+
+	subConns *resolver.AddressMap
+	scStates map[balancer.SubConn]connectivity.State
+	picker   balancer.Picker
+	config   Config
+
+	resolverErr error // the last error reported by the resolver; cleared on successful resolution
+	connErr     error // the last connection error; cleared upon leaving TransientFailure
+}
+
+func (b *baseBalancer) ResolverError(err error) {
+	b.resolverErr = err
+	if b.subConns.Len() == 0 {
+		b.state = connectivity.TransientFailure
+	}
+
+	if b.state != connectivity.TransientFailure {
+		// The picker will not change since the balancer does not currently
+		// report an error.
+		return
+	}
+	b.regeneratePicker()
+	b.cc.UpdateState(balancer.State{
+		ConnectivityState: b.state,
+		Picker:            b.picker,
+	})
+}
+
+func (b *baseBalancer) UpdateClientConnState(s balancer.ClientConnState) error {
+	// TODO: handle s.ResolverState.ServiceConfig?
+	if logger.V(2) {
+		logger.Info("base.baseBalancer: got new ClientConn state: ", s)
+	}
+	// Successful resolution; clear resolver error and ensure we return nil.
+	b.resolverErr = nil
+	// addrsSet is the set converted from addrs, it's used for quick lookup of an address.
+	addrsSet := resolver.NewAddressMap()
+	for _, a := range s.ResolverState.Addresses {
+		addrsSet.Set(a, nil)
+		if _, ok := b.subConns.Get(a); !ok {
+			// a is a new address (not existing in b.subConns).
+			sc, err := b.cc.NewSubConn([]resolver.Address{a}, balancer.NewSubConnOptions{HealthCheckEnabled: b.config.HealthCheck})
+			if err != nil {
+				logger.Warningf("base.baseBalancer: failed to create new SubConn: %v", err)
+				continue
+			}
+			b.subConns.Set(a, sc)
+			b.scStates[sc] = connectivity.Idle
+			b.csEvltr.RecordTransition(connectivity.Shutdown, connectivity.Idle)
+			sc.Connect()
+		}
+	}
+	for _, a := range b.subConns.Keys() {
+		sci, _ := b.subConns.Get(a)
+		sc := sci.(balancer.SubConn)
+		// a was removed by resolver.
+		if _, ok := addrsSet.Get(a); !ok {
+			b.cc.RemoveSubConn(sc)
+			b.subConns.Delete(a)
+			// Keep the state of this sc in b.scStates until sc's state becomes Shutdown.
+			// The entry will be deleted in UpdateSubConnState.
+		}
+	}
+	// If resolver state contains no addresses, return an error so ClientConn
+	// will trigger re-resolve. Also records this as an resolver error, so when
+	// the overall state turns transient failure, the error message will have
+	// the zero address information.
+	if len(s.ResolverState.Addresses) == 0 {
+		b.ResolverError(errors.New("produced zero addresses"))
+		return balancer.ErrBadResolverState
+	}
+
+	b.regeneratePicker()
+	b.cc.UpdateState(balancer.State{ConnectivityState: b.state, Picker: b.picker})
+	return nil
+}
+
+// mergeErrors builds an error from the last connection error and the last
+// resolver error.  Must only be called if b.state is TransientFailure.
+func (b *baseBalancer) mergeErrors() error {
+	// connErr must always be non-nil unless there are no SubConns, in which
+	// case resolverErr must be non-nil.
+	if b.connErr == nil {
+		return fmt.Errorf("last resolver error: %v", b.resolverErr)
+	}
+	if b.resolverErr == nil {
+		return fmt.Errorf("last connection error: %v", b.connErr)
+	}
+	return fmt.Errorf("last connection error: %v; last resolver error: %v", b.connErr, b.resolverErr)
+}
+
+// regeneratePicker takes a snapshot of the balancer, and generates a picker
+// from it. The picker is
+//   - errPicker if the balancer is in TransientFailure,
+//   - built by the pickerBuilder with all READY SubConns otherwise.
+func (b *baseBalancer) regeneratePicker() {
+	if b.state == connectivity.TransientFailure {
+		b.picker = NewErrPicker(b.mergeErrors())
+		return
+	}
+	readySCs := make(map[balancer.SubConn]SubConnInfo)
+
+	// Filter out all ready SCs from full subConn map.
+	for _, addr := range b.subConns.Keys() {
+		sci, _ := b.subConns.Get(addr)
+		sc := sci.(balancer.SubConn)
+		if st, ok := b.scStates[sc]; ok && st == connectivity.Ready {
+			readySCs[sc] = SubConnInfo{Address: addr}
+		}
+	}
+	b.picker = b.pickerBuilder.Build(PickerBuildInfo{ReadySCs: readySCs})
+}
+
+func (b *baseBalancer) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
+	s := state.ConnectivityState
+	if logger.V(2) {
+		logger.Infof("base.baseBalancer: handle SubConn state change: %p, %v", sc, s)
+	}
+	oldS, ok := b.scStates[sc]
+	if !ok {
+		if logger.V(2) {
+			logger.Infof("base.baseBalancer: got state changes for an unknown SubConn: %p, %v", sc, s)
+		}
+		return
+	}
+	if oldS == connectivity.TransientFailure &&
+		(s == connectivity.Connecting || s == connectivity.Idle) {
+		// Once a subconn enters TRANSIENT_FAILURE, ignore subsequent IDLE or
+		// CONNECTING transitions to prevent the aggregated state from being
+		// always CONNECTING when many backends exist but are all down.
+		if s == connectivity.Idle {
+			sc.Connect()
+		}
+		return
+	}
+	b.scStates[sc] = s
+	switch s {
+	case connectivity.Idle:
+		sc.Connect()
+	case connectivity.Shutdown:
+		// When an address was removed by resolver, b called RemoveSubConn but
+		// kept the sc's state in scStates. Remove state for this sc here.
+		delete(b.scStates, sc)
+	case connectivity.TransientFailure:
+		// Save error to be reported via picker.
+		b.connErr = state.ConnectionError
+	}
+
+	b.state = b.csEvltr.RecordTransition(oldS, s)
+
+	// Regenerate picker when one of the following happens:
+	//  - this sc entered or left ready
+	//  - the aggregated state of balancer is TransientFailure
+	//    (may need to update error message)
+	if (s == connectivity.Ready) != (oldS == connectivity.Ready) ||
+		b.state == connectivity.TransientFailure {
+		b.regeneratePicker()
+	}
+	b.cc.UpdateState(balancer.State{ConnectivityState: b.state, Picker: b.picker})
+}
+
+// Close is a nop because base balancer doesn't have internal state to clean up,
+// and it doesn't need to call RemoveSubConn for the SubConns.
+func (b *baseBalancer) Close() {
+}
+
+// ExitIdle is a nop because the base balancer attempts to stay connected to
+// all SubConns at all times.
+func (b *baseBalancer) ExitIdle() {
+}
+
+// NewErrPicker returns a Picker that always returns err on Pick().
+func NewErrPicker(err error) balancer.Picker {
+	return &errPicker{err: err}
+}
+
+// NewErrPickerV2 is temporarily defined for backward compatibility reasons.
+//
+// Deprecated: use NewErrPicker instead.
+var NewErrPickerV2 = NewErrPicker
+
+type errPicker struct {
+	err error // Pick() always returns this err.
+}
+
+func (p *errPicker) Pick(info balancer.PickInfo) (balancer.PickResult, error) {
+	return balancer.PickResult{}, p.err
+}
diff --git a/vendor/google.golang.org/grpc/balancer/base/base.go b/vendor/google.golang.org/grpc/balancer/base/base.go
new file mode 100644
index 0000000000..e31d76e338
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/base/base.go
@@ -0,0 +1,71 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package base defines a balancer base that can be used to build balancers with
+// different picking algorithms.
+//
+// The base balancer creates a new SubConn for each resolved address. The
+// provided picker will only be notified about READY SubConns.
+//
+// This package is the base of round_robin balancer, its purpose is to be used
+// to build round_robin like balancers with complex picking algorithms.
+// Balancers with more complicated logic should try to implement a balancer
+// builder from scratch.
+//
+// All APIs in this package are experimental.
+package base
+
+import (
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/resolver"
+)
+
+// PickerBuilder creates balancer.Picker.
+type PickerBuilder interface {
+	// Build returns a picker that will be used by gRPC to pick a SubConn.
+	Build(info PickerBuildInfo) balancer.Picker
+}
+
+// PickerBuildInfo contains information needed by the picker builder to
+// construct a picker.
+type PickerBuildInfo struct {
+	// ReadySCs is a map from all ready SubConns to the Addresses used to
+	// create them.
+	ReadySCs map[balancer.SubConn]SubConnInfo
+}
+
+// SubConnInfo contains information about a SubConn created by the base
+// balancer.
+type SubConnInfo struct {
+	Address resolver.Address // the address used to create this SubConn
+}
+
+// Config contains the config info about the base balancer builder.
+type Config struct {
+	// HealthCheck indicates whether health checking should be enabled for this specific balancer.
+	HealthCheck bool
+}
+
+// NewBalancerBuilder returns a base balancer builder configured by the provided config.
+func NewBalancerBuilder(name string, pb PickerBuilder, config Config) balancer.Builder {
+	return &baseBuilder{
+		name:          name,
+		pickerBuilder: pb,
+		config:        config,
+	}
+}
diff --git a/vendor/google.golang.org/grpc/balancer/conn_state_evaluator.go b/vendor/google.golang.org/grpc/balancer/conn_state_evaluator.go
new file mode 100644
index 0000000000..c334135810
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/conn_state_evaluator.go
@@ -0,0 +1,74 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package balancer
+
+import "google.golang.org/grpc/connectivity"
+
+// ConnectivityStateEvaluator takes the connectivity states of multiple SubConns
+// and returns one aggregated connectivity state.
+//
+// It's not thread safe.
+type ConnectivityStateEvaluator struct {
+	numReady            uint64 // Number of addrConns in ready state.
+	numConnecting       uint64 // Number of addrConns in connecting state.
+	numTransientFailure uint64 // Number of addrConns in transient failure state.
+	numIdle             uint64 // Number of addrConns in idle state.
+}
+
+// RecordTransition records state change happening in subConn and based on that
+// it evaluates what aggregated state should be.
+//
+//   - If at least one SubConn in Ready, the aggregated state is Ready;
+//   - Else if at least one SubConn in Connecting, the aggregated state is Connecting;
+//   - Else if at least one SubConn is Idle, the aggregated state is Idle;
+//   - Else if at least one SubConn is TransientFailure (or there are no SubConns), the aggregated state is Transient Failure.
+//
+// Shutdown is not considered.
+func (cse *ConnectivityStateEvaluator) RecordTransition(oldState, newState connectivity.State) connectivity.State {
+	// Update counters.
+	for idx, state := range []connectivity.State{oldState, newState} {
+		updateVal := 2*uint64(idx) - 1 // -1 for oldState and +1 for new.
+		switch state {
+		case connectivity.Ready:
+			cse.numReady += updateVal
+		case connectivity.Connecting:
+			cse.numConnecting += updateVal
+		case connectivity.TransientFailure:
+			cse.numTransientFailure += updateVal
+		case connectivity.Idle:
+			cse.numIdle += updateVal
+		}
+	}
+	return cse.CurrentState()
+}
+
+// CurrentState returns the current aggregate conn state by evaluating the counters
+func (cse *ConnectivityStateEvaluator) CurrentState() connectivity.State {
+	// Evaluate.
+	if cse.numReady > 0 {
+		return connectivity.Ready
+	}
+	if cse.numConnecting > 0 {
+		return connectivity.Connecting
+	}
+	if cse.numIdle > 0 {
+		return connectivity.Idle
+	}
+	return connectivity.TransientFailure
+}
diff --git a/vendor/google.golang.org/grpc/balancer/grpclb/state/state.go b/vendor/google.golang.org/grpc/balancer/grpclb/state/state.go
new file mode 100644
index 0000000000..4ecfa1c215
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/grpclb/state/state.go
@@ -0,0 +1,51 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package state declares grpclb types to be set by resolvers wishing to pass
+// information to grpclb via resolver.State Attributes.
+package state
+
+import (
+	"google.golang.org/grpc/resolver"
+)
+
+// keyType is the key to use for storing State in Attributes.
+type keyType string
+
+const key = keyType("grpc.grpclb.state")
+
+// State contains gRPCLB-relevant data passed from the name resolver.
+type State struct {
+	// BalancerAddresses contains the remote load balancer address(es).  If
+	// set, overrides any resolver-provided addresses with Type of GRPCLB.
+	BalancerAddresses []resolver.Address
+}
+
+// Set returns a copy of the provided state with attributes containing s.  s's
+// data should not be mutated after calling Set.
+func Set(state resolver.State, s *State) resolver.State {
+	state.Attributes = state.Attributes.WithValue(key, s)
+	return state
+}
+
+// Get returns the grpclb State in the resolver.State, or nil if not present.
+// The returned data should not be mutated.
+func Get(state resolver.State) *State {
+	s, _ := state.Attributes.Value(key).(*State)
+	return s
+}
diff --git a/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go b/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go
new file mode 100644
index 0000000000..f7031ad225
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer/roundrobin/roundrobin.go
@@ -0,0 +1,81 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package roundrobin defines a roundrobin balancer. Roundrobin balancer is
+// installed as one of the default balancers in gRPC, users don't need to
+// explicitly install this balancer.
+package roundrobin
+
+import (
+	"sync/atomic"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/balancer/base"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/internal/grpcrand"
+)
+
+// Name is the name of round_robin balancer.
+const Name = "round_robin"
+
+var logger = grpclog.Component("roundrobin")
+
+// newBuilder creates a new roundrobin balancer builder.
+func newBuilder() balancer.Builder {
+	return base.NewBalancerBuilder(Name, &rrPickerBuilder{}, base.Config{HealthCheck: true})
+}
+
+func init() {
+	balancer.Register(newBuilder())
+}
+
+type rrPickerBuilder struct{}
+
+func (*rrPickerBuilder) Build(info base.PickerBuildInfo) balancer.Picker {
+	logger.Infof("roundrobinPicker: Build called with info: %v", info)
+	if len(info.ReadySCs) == 0 {
+		return base.NewErrPicker(balancer.ErrNoSubConnAvailable)
+	}
+	scs := make([]balancer.SubConn, 0, len(info.ReadySCs))
+	for sc := range info.ReadySCs {
+		scs = append(scs, sc)
+	}
+	return &rrPicker{
+		subConns: scs,
+		// Start at a random index, as the same RR balancer rebuilds a new
+		// picker when SubConn states change, and we don't want to apply excess
+		// load to the first server in the list.
+		next: uint32(grpcrand.Intn(len(scs))),
+	}
+}
+
+type rrPicker struct {
+	// subConns is the snapshot of the roundrobin balancer when this picker was
+	// created. The slice is immutable. Each Get() will do a round robin
+	// selection from it and return the selected SubConn.
+	subConns []balancer.SubConn
+	next     uint32
+}
+
+func (p *rrPicker) Pick(balancer.PickInfo) (balancer.PickResult, error) {
+	subConnsLen := uint32(len(p.subConns))
+	nextIndex := atomic.AddUint32(&p.next, 1)
+
+	sc := p.subConns[nextIndex%subConnsLen]
+	return balancer.PickResult{SubConn: sc}, nil
+}
diff --git a/vendor/google.golang.org/grpc/balancer_conn_wrappers.go b/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
new file mode 100644
index 0000000000..0359956d36
--- /dev/null
+++ b/vendor/google.golang.org/grpc/balancer_conn_wrappers.go
@@ -0,0 +1,481 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/internal/balancer/gracefulswitch"
+	"google.golang.org/grpc/internal/buffer"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/status"
+)
+
+// ccBalancerWrapper sits between the ClientConn and the Balancer.
+//
+// ccBalancerWrapper implements methods corresponding to the ones on the
+// balancer.Balancer interface. The ClientConn is free to call these methods
+// concurrently and the ccBalancerWrapper ensures that calls from the ClientConn
+// to the Balancer happen synchronously and in order.
+//
+// ccBalancerWrapper also implements the balancer.ClientConn interface and is
+// passed to the Balancer implementations. It invokes unexported methods on the
+// ClientConn to handle these calls from the Balancer.
+//
+// It uses the gracefulswitch.Balancer internally to ensure that balancer
+// switches happen in a graceful manner.
+type ccBalancerWrapper struct {
+	cc *ClientConn
+
+	// Since these fields are accessed only from handleXxx() methods which are
+	// synchronized by the watcher goroutine, we do not need a mutex to protect
+	// these fields.
+	balancer        *gracefulswitch.Balancer
+	curBalancerName string
+
+	updateCh *buffer.Unbounded // Updates written on this channel are processed by watcher().
+	resultCh *buffer.Unbounded // Results of calls to UpdateClientConnState() are pushed here.
+	closed   *grpcsync.Event   // Indicates if close has been called.
+	done     *grpcsync.Event   // Indicates if close has completed its work.
+}
+
+// newCCBalancerWrapper creates a new balancer wrapper. The underlying balancer
+// is not created until the switchTo() method is invoked.
+func newCCBalancerWrapper(cc *ClientConn, bopts balancer.BuildOptions) *ccBalancerWrapper {
+	ccb := &ccBalancerWrapper{
+		cc:       cc,
+		updateCh: buffer.NewUnbounded(),
+		resultCh: buffer.NewUnbounded(),
+		closed:   grpcsync.NewEvent(),
+		done:     grpcsync.NewEvent(),
+	}
+	go ccb.watcher()
+	ccb.balancer = gracefulswitch.NewBalancer(ccb, bopts)
+	return ccb
+}
+
+// The following xxxUpdate structs wrap the arguments received as part of the
+// corresponding update. The watcher goroutine uses the 'type' of the update to
+// invoke the appropriate handler routine to handle the update.
+
+type ccStateUpdate struct {
+	ccs *balancer.ClientConnState
+}
+
+type scStateUpdate struct {
+	sc    balancer.SubConn
+	state connectivity.State
+	err   error
+}
+
+type exitIdleUpdate struct{}
+
+type resolverErrorUpdate struct {
+	err error
+}
+
+type switchToUpdate struct {
+	name string
+}
+
+type subConnUpdate struct {
+	acbw *acBalancerWrapper
+}
+
+// watcher is a long-running goroutine which reads updates from a channel and
+// invokes corresponding methods on the underlying balancer. It ensures that
+// these methods are invoked in a synchronous fashion. It also ensures that
+// these methods are invoked in the order in which the updates were received.
+func (ccb *ccBalancerWrapper) watcher() {
+	for {
+		select {
+		case u := <-ccb.updateCh.Get():
+			ccb.updateCh.Load()
+			if ccb.closed.HasFired() {
+				break
+			}
+			switch update := u.(type) {
+			case *ccStateUpdate:
+				ccb.handleClientConnStateChange(update.ccs)
+			case *scStateUpdate:
+				ccb.handleSubConnStateChange(update)
+			case *exitIdleUpdate:
+				ccb.handleExitIdle()
+			case *resolverErrorUpdate:
+				ccb.handleResolverError(update.err)
+			case *switchToUpdate:
+				ccb.handleSwitchTo(update.name)
+			case *subConnUpdate:
+				ccb.handleRemoveSubConn(update.acbw)
+			default:
+				logger.Errorf("ccBalancerWrapper.watcher: unknown update %+v, type %T", update, update)
+			}
+		case <-ccb.closed.Done():
+		}
+
+		if ccb.closed.HasFired() {
+			ccb.handleClose()
+			return
+		}
+	}
+}
+
+// updateClientConnState is invoked by grpc to push a ClientConnState update to
+// the underlying balancer.
+//
+// Unlike other methods invoked by grpc to push updates to the underlying
+// balancer, this method cannot simply push the update onto the update channel
+// and return. It needs to return the error returned by the underlying balancer
+// back to grpc which propagates that to the resolver.
+func (ccb *ccBalancerWrapper) updateClientConnState(ccs *balancer.ClientConnState) error {
+	ccb.updateCh.Put(&ccStateUpdate{ccs: ccs})
+
+	var res interface{}
+	select {
+	case res = <-ccb.resultCh.Get():
+		ccb.resultCh.Load()
+	case <-ccb.closed.Done():
+		// Return early if the balancer wrapper is closed while we are waiting for
+		// the underlying balancer to process a ClientConnState update.
+		return nil
+	}
+	// If the returned error is nil, attempting to type assert to error leads to
+	// panic. So, this needs to handled separately.
+	if res == nil {
+		return nil
+	}
+	return res.(error)
+}
+
+// handleClientConnStateChange handles a ClientConnState update from the update
+// channel and invokes the appropriate method on the underlying balancer.
+//
+// If the addresses specified in the update contain addresses of type "grpclb"
+// and the selected LB policy is not "grpclb", these addresses will be filtered
+// out and ccs will be modified with the updated address list.
+func (ccb *ccBalancerWrapper) handleClientConnStateChange(ccs *balancer.ClientConnState) {
+	if ccb.curBalancerName != grpclbName {
+		// Filter any grpclb addresses since we don't have the grpclb balancer.
+		var addrs []resolver.Address
+		for _, addr := range ccs.ResolverState.Addresses {
+			if addr.Type == resolver.GRPCLB {
+				continue
+			}
+			addrs = append(addrs, addr)
+		}
+		ccs.ResolverState.Addresses = addrs
+	}
+	ccb.resultCh.Put(ccb.balancer.UpdateClientConnState(*ccs))
+}
+
+// updateSubConnState is invoked by grpc to push a subConn state update to the
+// underlying balancer.
+func (ccb *ccBalancerWrapper) updateSubConnState(sc balancer.SubConn, s connectivity.State, err error) {
+	// When updating addresses for a SubConn, if the address in use is not in
+	// the new addresses, the old ac will be tearDown() and a new ac will be
+	// created. tearDown() generates a state change with Shutdown state, we
+	// don't want the balancer to receive this state change. So before
+	// tearDown() on the old ac, ac.acbw (acWrapper) will be set to nil, and
+	// this function will be called with (nil, Shutdown). We don't need to call
+	// balancer method in this case.
+	if sc == nil {
+		return
+	}
+	ccb.updateCh.Put(&scStateUpdate{
+		sc:    sc,
+		state: s,
+		err:   err,
+	})
+}
+
+// handleSubConnStateChange handles a SubConnState update from the update
+// channel and invokes the appropriate method on the underlying balancer.
+func (ccb *ccBalancerWrapper) handleSubConnStateChange(update *scStateUpdate) {
+	ccb.balancer.UpdateSubConnState(update.sc, balancer.SubConnState{ConnectivityState: update.state, ConnectionError: update.err})
+}
+
+func (ccb *ccBalancerWrapper) exitIdle() {
+	ccb.updateCh.Put(&exitIdleUpdate{})
+}
+
+func (ccb *ccBalancerWrapper) handleExitIdle() {
+	if ccb.cc.GetState() != connectivity.Idle {
+		return
+	}
+	ccb.balancer.ExitIdle()
+}
+
+func (ccb *ccBalancerWrapper) resolverError(err error) {
+	ccb.updateCh.Put(&resolverErrorUpdate{err: err})
+}
+
+func (ccb *ccBalancerWrapper) handleResolverError(err error) {
+	ccb.balancer.ResolverError(err)
+}
+
+// switchTo is invoked by grpc to instruct the balancer wrapper to switch to the
+// LB policy identified by name.
+//
+// ClientConn calls newCCBalancerWrapper() at creation time. Upon receipt of the
+// first good update from the name resolver, it determines the LB policy to use
+// and invokes the switchTo() method. Upon receipt of every subsequent update
+// from the name resolver, it invokes this method.
+//
+// the ccBalancerWrapper keeps track of the current LB policy name, and skips
+// the graceful balancer switching process if the name does not change.
+func (ccb *ccBalancerWrapper) switchTo(name string) {
+	ccb.updateCh.Put(&switchToUpdate{name: name})
+}
+
+// handleSwitchTo handles a balancer switch update from the update channel. It
+// calls the SwitchTo() method on the gracefulswitch.Balancer with a
+// balancer.Builder corresponding to name. If no balancer.Builder is registered
+// for the given name, it uses the default LB policy which is "pick_first".
+func (ccb *ccBalancerWrapper) handleSwitchTo(name string) {
+	// TODO: Other languages use case-insensitive balancer registries. We should
+	// switch as well. See: https://github.com/grpc/grpc-go/issues/5288.
+	if strings.EqualFold(ccb.curBalancerName, name) {
+		return
+	}
+
+	// TODO: Ensure that name is a registered LB policy when we get here.
+	// We currently only validate the `loadBalancingConfig` field. We need to do
+	// the same for the `loadBalancingPolicy` field and reject the service config
+	// if the specified policy is not registered.
+	builder := balancer.Get(name)
+	if builder == nil {
+		channelz.Warningf(logger, ccb.cc.channelzID, "Channel switches to new LB policy %q, since the specified LB policy %q was not registered", PickFirstBalancerName, name)
+		builder = newPickfirstBuilder()
+	} else {
+		channelz.Infof(logger, ccb.cc.channelzID, "Channel switches to new LB policy %q", name)
+	}
+
+	if err := ccb.balancer.SwitchTo(builder); err != nil {
+		channelz.Errorf(logger, ccb.cc.channelzID, "Channel failed to build new LB policy %q: %v", name, err)
+		return
+	}
+	ccb.curBalancerName = builder.Name()
+}
+
+// handleRemoveSucConn handles a request from the underlying balancer to remove
+// a subConn.
+//
+// See comments in RemoveSubConn() for more details.
+func (ccb *ccBalancerWrapper) handleRemoveSubConn(acbw *acBalancerWrapper) {
+	ccb.cc.removeAddrConn(acbw.getAddrConn(), errConnDrain)
+}
+
+func (ccb *ccBalancerWrapper) close() {
+	ccb.closed.Fire()
+	<-ccb.done.Done()
+}
+
+func (ccb *ccBalancerWrapper) handleClose() {
+	ccb.balancer.Close()
+	ccb.done.Fire()
+}
+
+func (ccb *ccBalancerWrapper) NewSubConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (balancer.SubConn, error) {
+	if len(addrs) <= 0 {
+		return nil, fmt.Errorf("grpc: cannot create SubConn with empty address list")
+	}
+	ac, err := ccb.cc.newAddrConn(addrs, opts)
+	if err != nil {
+		channelz.Warningf(logger, ccb.cc.channelzID, "acBalancerWrapper: NewSubConn: failed to newAddrConn: %v", err)
+		return nil, err
+	}
+	acbw := &acBalancerWrapper{ac: ac, producers: make(map[balancer.ProducerBuilder]*refCountedProducer)}
+	acbw.ac.mu.Lock()
+	ac.acbw = acbw
+	acbw.ac.mu.Unlock()
+	return acbw, nil
+}
+
+func (ccb *ccBalancerWrapper) RemoveSubConn(sc balancer.SubConn) {
+	// Before we switched the ccBalancerWrapper to use gracefulswitch.Balancer, it
+	// was required to handle the RemoveSubConn() method asynchronously by pushing
+	// the update onto the update channel. This was done to avoid a deadlock as
+	// switchBalancer() was holding cc.mu when calling Close() on the old
+	// balancer, which would in turn call RemoveSubConn().
+	//
+	// With the use of gracefulswitch.Balancer in ccBalancerWrapper, handling this
+	// asynchronously is probably not required anymore since the switchTo() method
+	// handles the balancer switch by pushing the update onto the channel.
+	// TODO(easwars): Handle this inline.
+	acbw, ok := sc.(*acBalancerWrapper)
+	if !ok {
+		return
+	}
+	ccb.updateCh.Put(&subConnUpdate{acbw: acbw})
+}
+
+func (ccb *ccBalancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resolver.Address) {
+	acbw, ok := sc.(*acBalancerWrapper)
+	if !ok {
+		return
+	}
+	acbw.UpdateAddresses(addrs)
+}
+
+func (ccb *ccBalancerWrapper) UpdateState(s balancer.State) {
+	// Update picker before updating state.  Even though the ordering here does
+	// not matter, it can lead to multiple calls of Pick in the common start-up
+	// case where we wait for ready and then perform an RPC.  If the picker is
+	// updated later, we could call the "connecting" picker when the state is
+	// updated, and then call the "ready" picker after the picker gets updated.
+	ccb.cc.blockingpicker.updatePicker(s.Picker)
+	ccb.cc.csMgr.updateState(s.ConnectivityState)
+}
+
+func (ccb *ccBalancerWrapper) ResolveNow(o resolver.ResolveNowOptions) {
+	ccb.cc.resolveNow(o)
+}
+
+func (ccb *ccBalancerWrapper) Target() string {
+	return ccb.cc.target
+}
+
+// acBalancerWrapper is a wrapper on top of ac for balancers.
+// It implements balancer.SubConn interface.
+type acBalancerWrapper struct {
+	mu        sync.Mutex
+	ac        *addrConn
+	producers map[balancer.ProducerBuilder]*refCountedProducer
+}
+
+func (acbw *acBalancerWrapper) UpdateAddresses(addrs []resolver.Address) {
+	acbw.mu.Lock()
+	defer acbw.mu.Unlock()
+	if len(addrs) <= 0 {
+		acbw.ac.cc.removeAddrConn(acbw.ac, errConnDrain)
+		return
+	}
+	if !acbw.ac.tryUpdateAddrs(addrs) {
+		cc := acbw.ac.cc
+		opts := acbw.ac.scopts
+		acbw.ac.mu.Lock()
+		// Set old ac.acbw to nil so the Shutdown state update will be ignored
+		// by balancer.
+		//
+		// TODO(bar) the state transition could be wrong when tearDown() old ac
+		// and creating new ac, fix the transition.
+		acbw.ac.acbw = nil
+		acbw.ac.mu.Unlock()
+		acState := acbw.ac.getState()
+		acbw.ac.cc.removeAddrConn(acbw.ac, errConnDrain)
+
+		if acState == connectivity.Shutdown {
+			return
+		}
+
+		newAC, err := cc.newAddrConn(addrs, opts)
+		if err != nil {
+			channelz.Warningf(logger, acbw.ac.channelzID, "acBalancerWrapper: UpdateAddresses: failed to newAddrConn: %v", err)
+			return
+		}
+		acbw.ac = newAC
+		newAC.mu.Lock()
+		newAC.acbw = acbw
+		newAC.mu.Unlock()
+		if acState != connectivity.Idle {
+			go newAC.connect()
+		}
+	}
+}
+
+func (acbw *acBalancerWrapper) Connect() {
+	acbw.mu.Lock()
+	defer acbw.mu.Unlock()
+	go acbw.ac.connect()
+}
+
+func (acbw *acBalancerWrapper) getAddrConn() *addrConn {
+	acbw.mu.Lock()
+	defer acbw.mu.Unlock()
+	return acbw.ac
+}
+
+var errSubConnNotReady = status.Error(codes.Unavailable, "SubConn not currently connected")
+
+// NewStream begins a streaming RPC on the addrConn.  If the addrConn is not
+// ready, returns errSubConnNotReady.
+func (acbw *acBalancerWrapper) NewStream(ctx context.Context, desc *StreamDesc, method string, opts ...CallOption) (ClientStream, error) {
+	transport := acbw.ac.getReadyTransport()
+	if transport == nil {
+		return nil, errSubConnNotReady
+	}
+	return newNonRetryClientStream(ctx, desc, method, transport, acbw.ac, opts...)
+}
+
+// Invoke performs a unary RPC.  If the addrConn is not ready, returns
+// errSubConnNotReady.
+func (acbw *acBalancerWrapper) Invoke(ctx context.Context, method string, args interface{}, reply interface{}, opts ...CallOption) error {
+	cs, err := acbw.NewStream(ctx, unaryStreamDesc, method, opts...)
+	if err != nil {
+		return err
+	}
+	if err := cs.SendMsg(args); err != nil {
+		return err
+	}
+	return cs.RecvMsg(reply)
+}
+
+type refCountedProducer struct {
+	producer balancer.Producer
+	refs     int    // number of current refs to the producer
+	close    func() // underlying producer's close function
+}
+
+func (acbw *acBalancerWrapper) GetOrBuildProducer(pb balancer.ProducerBuilder) (balancer.Producer, func()) {
+	acbw.mu.Lock()
+	defer acbw.mu.Unlock()
+
+	// Look up existing producer from this builder.
+	pData := acbw.producers[pb]
+	if pData == nil {
+		// Not found; create a new one and add it to the producers map.
+		p, close := pb.Build(acbw)
+		pData = &refCountedProducer{producer: p, close: close}
+		acbw.producers[pb] = pData
+	}
+	// Account for this new reference.
+	pData.refs++
+
+	// Return a cleanup function wrapped in a OnceFunc to remove this reference
+	// and delete the refCountedProducer from the map if the total reference
+	// count goes to zero.
+	unref := func() {
+		acbw.mu.Lock()
+		pData.refs--
+		if pData.refs == 0 {
+			defer pData.close() // Run outside the acbw mutex
+			delete(acbw.producers, pb)
+		}
+		acbw.mu.Unlock()
+	}
+	return pData.producer, grpcsync.OnceFunc(unref)
+}
diff --git a/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go b/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
new file mode 100644
index 0000000000..ec2c2fa14d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
@@ -0,0 +1,1183 @@
+// Copyright 2018 The gRPC Authors
+// All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// The canonical version of this proto can be found at
+// https://github.com/grpc/grpc-proto/blob/master/grpc/binlog/v1/binarylog.proto
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.22.0
+// source: grpc/binlog/v1/binarylog.proto
+
+package grpc_binarylog_v1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Enumerates the type of event
+// Note the terminology is different from the RPC semantics
+// definition, but the same meaning is expressed here.
+type GrpcLogEntry_EventType int32
+
+const (
+	GrpcLogEntry_EVENT_TYPE_UNKNOWN GrpcLogEntry_EventType = 0
+	// Header sent from client to server
+	GrpcLogEntry_EVENT_TYPE_CLIENT_HEADER GrpcLogEntry_EventType = 1
+	// Header sent from server to client
+	GrpcLogEntry_EVENT_TYPE_SERVER_HEADER GrpcLogEntry_EventType = 2
+	// Message sent from client to server
+	GrpcLogEntry_EVENT_TYPE_CLIENT_MESSAGE GrpcLogEntry_EventType = 3
+	// Message sent from server to client
+	GrpcLogEntry_EVENT_TYPE_SERVER_MESSAGE GrpcLogEntry_EventType = 4
+	// A signal that client is done sending
+	GrpcLogEntry_EVENT_TYPE_CLIENT_HALF_CLOSE GrpcLogEntry_EventType = 5
+	// Trailer indicates the end of the RPC.
+	// On client side, this event means a trailer was either received
+	// from the network or the gRPC library locally generated a status
+	// to inform the application about a failure.
+	// On server side, this event means the server application requested
+	// to send a trailer. Note: EVENT_TYPE_CANCEL may still arrive after
+	// this due to races on server side.
+	GrpcLogEntry_EVENT_TYPE_SERVER_TRAILER GrpcLogEntry_EventType = 6
+	// A signal that the RPC is cancelled. On client side, this
+	// indicates the client application requests a cancellation.
+	// On server side, this indicates that cancellation was detected.
+	// Note: This marks the end of the RPC. Events may arrive after
+	// this due to races. For example, on client side a trailer
+	// may arrive even though the application requested to cancel the RPC.
+	GrpcLogEntry_EVENT_TYPE_CANCEL GrpcLogEntry_EventType = 7
+)
+
+// Enum value maps for GrpcLogEntry_EventType.
+var (
+	GrpcLogEntry_EventType_name = map[int32]string{
+		0: "EVENT_TYPE_UNKNOWN",
+		1: "EVENT_TYPE_CLIENT_HEADER",
+		2: "EVENT_TYPE_SERVER_HEADER",
+		3: "EVENT_TYPE_CLIENT_MESSAGE",
+		4: "EVENT_TYPE_SERVER_MESSAGE",
+		5: "EVENT_TYPE_CLIENT_HALF_CLOSE",
+		6: "EVENT_TYPE_SERVER_TRAILER",
+		7: "EVENT_TYPE_CANCEL",
+	}
+	GrpcLogEntry_EventType_value = map[string]int32{
+		"EVENT_TYPE_UNKNOWN":           0,
+		"EVENT_TYPE_CLIENT_HEADER":     1,
+		"EVENT_TYPE_SERVER_HEADER":     2,
+		"EVENT_TYPE_CLIENT_MESSAGE":    3,
+		"EVENT_TYPE_SERVER_MESSAGE":    4,
+		"EVENT_TYPE_CLIENT_HALF_CLOSE": 5,
+		"EVENT_TYPE_SERVER_TRAILER":    6,
+		"EVENT_TYPE_CANCEL":            7,
+	}
+)
+
+func (x GrpcLogEntry_EventType) Enum() *GrpcLogEntry_EventType {
+	p := new(GrpcLogEntry_EventType)
+	*p = x
+	return p
+}
+
+func (x GrpcLogEntry_EventType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (GrpcLogEntry_EventType) Descriptor() protoreflect.EnumDescriptor {
+	return file_grpc_binlog_v1_binarylog_proto_enumTypes[0].Descriptor()
+}
+
+func (GrpcLogEntry_EventType) Type() protoreflect.EnumType {
+	return &file_grpc_binlog_v1_binarylog_proto_enumTypes[0]
+}
+
+func (x GrpcLogEntry_EventType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use GrpcLogEntry_EventType.Descriptor instead.
+func (GrpcLogEntry_EventType) EnumDescriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{0, 0}
+}
+
+// Enumerates the entity that generates the log entry
+type GrpcLogEntry_Logger int32
+
+const (
+	GrpcLogEntry_LOGGER_UNKNOWN GrpcLogEntry_Logger = 0
+	GrpcLogEntry_LOGGER_CLIENT  GrpcLogEntry_Logger = 1
+	GrpcLogEntry_LOGGER_SERVER  GrpcLogEntry_Logger = 2
+)
+
+// Enum value maps for GrpcLogEntry_Logger.
+var (
+	GrpcLogEntry_Logger_name = map[int32]string{
+		0: "LOGGER_UNKNOWN",
+		1: "LOGGER_CLIENT",
+		2: "LOGGER_SERVER",
+	}
+	GrpcLogEntry_Logger_value = map[string]int32{
+		"LOGGER_UNKNOWN": 0,
+		"LOGGER_CLIENT":  1,
+		"LOGGER_SERVER":  2,
+	}
+)
+
+func (x GrpcLogEntry_Logger) Enum() *GrpcLogEntry_Logger {
+	p := new(GrpcLogEntry_Logger)
+	*p = x
+	return p
+}
+
+func (x GrpcLogEntry_Logger) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (GrpcLogEntry_Logger) Descriptor() protoreflect.EnumDescriptor {
+	return file_grpc_binlog_v1_binarylog_proto_enumTypes[1].Descriptor()
+}
+
+func (GrpcLogEntry_Logger) Type() protoreflect.EnumType {
+	return &file_grpc_binlog_v1_binarylog_proto_enumTypes[1]
+}
+
+func (x GrpcLogEntry_Logger) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use GrpcLogEntry_Logger.Descriptor instead.
+func (GrpcLogEntry_Logger) EnumDescriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{0, 1}
+}
+
+type Address_Type int32
+
+const (
+	Address_TYPE_UNKNOWN Address_Type = 0
+	// address is in 1.2.3.4 form
+	Address_TYPE_IPV4 Address_Type = 1
+	// address is in IPv6 canonical form (RFC5952 section 4)
+	// The scope is NOT included in the address string.
+	Address_TYPE_IPV6 Address_Type = 2
+	// address is UDS string
+	Address_TYPE_UNIX Address_Type = 3
+)
+
+// Enum value maps for Address_Type.
+var (
+	Address_Type_name = map[int32]string{
+		0: "TYPE_UNKNOWN",
+		1: "TYPE_IPV4",
+		2: "TYPE_IPV6",
+		3: "TYPE_UNIX",
+	}
+	Address_Type_value = map[string]int32{
+		"TYPE_UNKNOWN": 0,
+		"TYPE_IPV4":    1,
+		"TYPE_IPV6":    2,
+		"TYPE_UNIX":    3,
+	}
+)
+
+func (x Address_Type) Enum() *Address_Type {
+	p := new(Address_Type)
+	*p = x
+	return p
+}
+
+func (x Address_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Address_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_grpc_binlog_v1_binarylog_proto_enumTypes[2].Descriptor()
+}
+
+func (Address_Type) Type() protoreflect.EnumType {
+	return &file_grpc_binlog_v1_binarylog_proto_enumTypes[2]
+}
+
+func (x Address_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Address_Type.Descriptor instead.
+func (Address_Type) EnumDescriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{7, 0}
+}
+
+// Log entry we store in binary logs
+type GrpcLogEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The timestamp of the binary log message
+	Timestamp *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Uniquely identifies a call. The value must not be 0 in order to disambiguate
+	// from an unset value.
+	// Each call may have several log entries, they will all have the same call_id.
+	// Nothing is guaranteed about their value other than they are unique across
+	// different RPCs in the same gRPC process.
+	CallId uint64 `protobuf:"varint,2,opt,name=call_id,json=callId,proto3" json:"call_id,omitempty"`
+	// The entry sequence id for this call. The first GrpcLogEntry has a
+	// value of 1, to disambiguate from an unset value. The purpose of
+	// this field is to detect missing entries in environments where
+	// durability or ordering is not guaranteed.
+	SequenceIdWithinCall uint64                 `protobuf:"varint,3,opt,name=sequence_id_within_call,json=sequenceIdWithinCall,proto3" json:"sequence_id_within_call,omitempty"`
+	Type                 GrpcLogEntry_EventType `protobuf:"varint,4,opt,name=type,proto3,enum=grpc.binarylog.v1.GrpcLogEntry_EventType" json:"type,omitempty"`
+	Logger               GrpcLogEntry_Logger    `protobuf:"varint,5,opt,name=logger,proto3,enum=grpc.binarylog.v1.GrpcLogEntry_Logger" json:"logger,omitempty"` // One of the above Logger enum
+	// The logger uses one of the following fields to record the payload,
+	// according to the type of the log entry.
+	//
+	// Types that are assignable to Payload:
+	//
+	//	*GrpcLogEntry_ClientHeader
+	//	*GrpcLogEntry_ServerHeader
+	//	*GrpcLogEntry_Message
+	//	*GrpcLogEntry_Trailer
+	Payload isGrpcLogEntry_Payload `protobuf_oneof:"payload"`
+	// true if payload does not represent the full message or metadata.
+	PayloadTruncated bool `protobuf:"varint,10,opt,name=payload_truncated,json=payloadTruncated,proto3" json:"payload_truncated,omitempty"`
+	// Peer address information, will only be recorded on the first
+	// incoming event. On client side, peer is logged on
+	// EVENT_TYPE_SERVER_HEADER normally or EVENT_TYPE_SERVER_TRAILER in
+	// the case of trailers-only. On server side, peer is always
+	// logged on EVENT_TYPE_CLIENT_HEADER.
+	Peer *Address `protobuf:"bytes,11,opt,name=peer,proto3" json:"peer,omitempty"`
+}
+
+func (x *GrpcLogEntry) Reset() {
+	*x = GrpcLogEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GrpcLogEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GrpcLogEntry) ProtoMessage() {}
+
+func (x *GrpcLogEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GrpcLogEntry.ProtoReflect.Descriptor instead.
+func (*GrpcLogEntry) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GrpcLogEntry) GetTimestamp() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Timestamp
+	}
+	return nil
+}
+
+func (x *GrpcLogEntry) GetCallId() uint64 {
+	if x != nil {
+		return x.CallId
+	}
+	return 0
+}
+
+func (x *GrpcLogEntry) GetSequenceIdWithinCall() uint64 {
+	if x != nil {
+		return x.SequenceIdWithinCall
+	}
+	return 0
+}
+
+func (x *GrpcLogEntry) GetType() GrpcLogEntry_EventType {
+	if x != nil {
+		return x.Type
+	}
+	return GrpcLogEntry_EVENT_TYPE_UNKNOWN
+}
+
+func (x *GrpcLogEntry) GetLogger() GrpcLogEntry_Logger {
+	if x != nil {
+		return x.Logger
+	}
+	return GrpcLogEntry_LOGGER_UNKNOWN
+}
+
+func (m *GrpcLogEntry) GetPayload() isGrpcLogEntry_Payload {
+	if m != nil {
+		return m.Payload
+	}
+	return nil
+}
+
+func (x *GrpcLogEntry) GetClientHeader() *ClientHeader {
+	if x, ok := x.GetPayload().(*GrpcLogEntry_ClientHeader); ok {
+		return x.ClientHeader
+	}
+	return nil
+}
+
+func (x *GrpcLogEntry) GetServerHeader() *ServerHeader {
+	if x, ok := x.GetPayload().(*GrpcLogEntry_ServerHeader); ok {
+		return x.ServerHeader
+	}
+	return nil
+}
+
+func (x *GrpcLogEntry) GetMessage() *Message {
+	if x, ok := x.GetPayload().(*GrpcLogEntry_Message); ok {
+		return x.Message
+	}
+	return nil
+}
+
+func (x *GrpcLogEntry) GetTrailer() *Trailer {
+	if x, ok := x.GetPayload().(*GrpcLogEntry_Trailer); ok {
+		return x.Trailer
+	}
+	return nil
+}
+
+func (x *GrpcLogEntry) GetPayloadTruncated() bool {
+	if x != nil {
+		return x.PayloadTruncated
+	}
+	return false
+}
+
+func (x *GrpcLogEntry) GetPeer() *Address {
+	if x != nil {
+		return x.Peer
+	}
+	return nil
+}
+
+type isGrpcLogEntry_Payload interface {
+	isGrpcLogEntry_Payload()
+}
+
+type GrpcLogEntry_ClientHeader struct {
+	ClientHeader *ClientHeader `protobuf:"bytes,6,opt,name=client_header,json=clientHeader,proto3,oneof"`
+}
+
+type GrpcLogEntry_ServerHeader struct {
+	ServerHeader *ServerHeader `protobuf:"bytes,7,opt,name=server_header,json=serverHeader,proto3,oneof"`
+}
+
+type GrpcLogEntry_Message struct {
+	// Used by EVENT_TYPE_CLIENT_MESSAGE, EVENT_TYPE_SERVER_MESSAGE
+	Message *Message `protobuf:"bytes,8,opt,name=message,proto3,oneof"`
+}
+
+type GrpcLogEntry_Trailer struct {
+	Trailer *Trailer `protobuf:"bytes,9,opt,name=trailer,proto3,oneof"`
+}
+
+func (*GrpcLogEntry_ClientHeader) isGrpcLogEntry_Payload() {}
+
+func (*GrpcLogEntry_ServerHeader) isGrpcLogEntry_Payload() {}
+
+func (*GrpcLogEntry_Message) isGrpcLogEntry_Payload() {}
+
+func (*GrpcLogEntry_Trailer) isGrpcLogEntry_Payload() {}
+
+type ClientHeader struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// This contains only the metadata from the application.
+	Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// The name of the RPC method, which looks something like:
+	// /<service>/<method>
+	// Note the leading "/" character.
+	MethodName string `protobuf:"bytes,2,opt,name=method_name,json=methodName,proto3" json:"method_name,omitempty"`
+	// A single process may be used to run multiple virtual
+	// servers with different identities.
+	// The authority is the name of such a server identitiy.
+	// It is typically a portion of the URI in the form of
+	// <host> or <host>:<port> .
+	Authority string `protobuf:"bytes,3,opt,name=authority,proto3" json:"authority,omitempty"`
+	// the RPC timeout
+	Timeout *durationpb.Duration `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"`
+}
+
+func (x *ClientHeader) Reset() {
+	*x = ClientHeader{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClientHeader) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientHeader) ProtoMessage() {}
+
+func (x *ClientHeader) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientHeader.ProtoReflect.Descriptor instead.
+func (*ClientHeader) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ClientHeader) GetMetadata() *Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ClientHeader) GetMethodName() string {
+	if x != nil {
+		return x.MethodName
+	}
+	return ""
+}
+
+func (x *ClientHeader) GetAuthority() string {
+	if x != nil {
+		return x.Authority
+	}
+	return ""
+}
+
+func (x *ClientHeader) GetTimeout() *durationpb.Duration {
+	if x != nil {
+		return x.Timeout
+	}
+	return nil
+}
+
+type ServerHeader struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// This contains only the metadata from the application.
+	Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *ServerHeader) Reset() {
+	*x = ServerHeader{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServerHeader) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServerHeader) ProtoMessage() {}
+
+func (x *ServerHeader) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServerHeader.ProtoReflect.Descriptor instead.
+func (*ServerHeader) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ServerHeader) GetMetadata() *Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+type Trailer struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// This contains only the metadata from the application.
+	Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// The gRPC status code.
+	StatusCode uint32 `protobuf:"varint,2,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"`
+	// An original status message before any transport specific
+	// encoding.
+	StatusMessage string `protobuf:"bytes,3,opt,name=status_message,json=statusMessage,proto3" json:"status_message,omitempty"`
+	// The value of the 'grpc-status-details-bin' metadata key. If
+	// present, this is always an encoded 'google.rpc.Status' message.
+	StatusDetails []byte `protobuf:"bytes,4,opt,name=status_details,json=statusDetails,proto3" json:"status_details,omitempty"`
+}
+
+func (x *Trailer) Reset() {
+	*x = Trailer{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Trailer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Trailer) ProtoMessage() {}
+
+func (x *Trailer) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Trailer.ProtoReflect.Descriptor instead.
+func (*Trailer) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Trailer) GetMetadata() *Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *Trailer) GetStatusCode() uint32 {
+	if x != nil {
+		return x.StatusCode
+	}
+	return 0
+}
+
+func (x *Trailer) GetStatusMessage() string {
+	if x != nil {
+		return x.StatusMessage
+	}
+	return ""
+}
+
+func (x *Trailer) GetStatusDetails() []byte {
+	if x != nil {
+		return x.StatusDetails
+	}
+	return nil
+}
+
+// Message payload, used by CLIENT_MESSAGE and SERVER_MESSAGE
+type Message struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Length of the message. It may not be the same as the length of the
+	// data field, as the logging payload can be truncated or omitted.
+	Length uint32 `protobuf:"varint,1,opt,name=length,proto3" json:"length,omitempty"`
+	// May be truncated or omitted.
+	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *Message) Reset() {
+	*x = Message{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Message) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Message) ProtoMessage() {}
+
+func (x *Message) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Message.ProtoReflect.Descriptor instead.
+func (*Message) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Message) GetLength() uint32 {
+	if x != nil {
+		return x.Length
+	}
+	return 0
+}
+
+func (x *Message) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+// A list of metadata pairs, used in the payload of client header,
+// server header, and server trailer.
+// Implementations may omit some entries to honor the header limits
+// of GRPC_BINARY_LOG_CONFIG.
+//
+// Header keys added by gRPC are omitted. To be more specific,
+// implementations will not log the following entries, and this is
+// not to be treated as a truncation:
+//   - entries handled by grpc that are not user visible, such as those
+//     that begin with 'grpc-' (with exception of grpc-trace-bin)
+//     or keys like 'lb-token'
+//   - transport specific entries, including but not limited to:
+//     ':path', ':authority', 'content-encoding', 'user-agent', 'te', etc
+//   - entries added for call credentials
+//
+// Implementations must always log grpc-trace-bin if it is present.
+// Practically speaking it will only be visible on server side because
+// grpc-trace-bin is managed by low level client side mechanisms
+// inaccessible from the application level. On server side, the
+// header is just a normal metadata key.
+// The pair will not count towards the size limit.
+type Metadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Entry []*MetadataEntry `protobuf:"bytes,1,rep,name=entry,proto3" json:"entry,omitempty"`
+}
+
+func (x *Metadata) Reset() {
+	*x = Metadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metadata) ProtoMessage() {}
+
+func (x *Metadata) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
+func (*Metadata) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *Metadata) GetEntry() []*MetadataEntry {
+	if x != nil {
+		return x.Entry
+	}
+	return nil
+}
+
+// A metadata key value pair
+type MetadataEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *MetadataEntry) Reset() {
+	*x = MetadataEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetadataEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetadataEntry) ProtoMessage() {}
+
+func (x *MetadataEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetadataEntry.ProtoReflect.Descriptor instead.
+func (*MetadataEntry) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *MetadataEntry) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *MetadataEntry) GetValue() []byte {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+// Address information
+type Address struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type    Address_Type `protobuf:"varint,1,opt,name=type,proto3,enum=grpc.binarylog.v1.Address_Type" json:"type,omitempty"`
+	Address string       `protobuf:"bytes,2,opt,name=address,proto3" json:"address,omitempty"`
+	// only for TYPE_IPV4 and TYPE_IPV6
+	IpPort uint32 `protobuf:"varint,3,opt,name=ip_port,json=ipPort,proto3" json:"ip_port,omitempty"`
+}
+
+func (x *Address) Reset() {
+	*x = Address{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Address) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Address) ProtoMessage() {}
+
+func (x *Address) ProtoReflect() protoreflect.Message {
+	mi := &file_grpc_binlog_v1_binarylog_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Address.ProtoReflect.Descriptor instead.
+func (*Address) Descriptor() ([]byte, []int) {
+	return file_grpc_binlog_v1_binarylog_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *Address) GetType() Address_Type {
+	if x != nil {
+		return x.Type
+	}
+	return Address_TYPE_UNKNOWN
+}
+
+func (x *Address) GetAddress() string {
+	if x != nil {
+		return x.Address
+	}
+	return ""
+}
+
+func (x *Address) GetIpPort() uint32 {
+	if x != nil {
+		return x.IpPort
+	}
+	return 0
+}
+
+var File_grpc_binlog_v1_binarylog_proto protoreflect.FileDescriptor
+
+var file_grpc_binlog_v1_binarylog_proto_rawDesc = []byte{
+	0x0a, 0x1e, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x62, 0x69, 0x6e, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31,
+	0x2f, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x11, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xbb, 0x07, 0x0a, 0x0c, 0x47, 0x72, 0x70, 0x63, 0x4c, 0x6f, 0x67,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12,
+	0x17, 0x0a, 0x07, 0x63, 0x61, 0x6c, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x06, 0x63, 0x61, 0x6c, 0x6c, 0x49, 0x64, 0x12, 0x35, 0x0a, 0x17, 0x73, 0x65, 0x71, 0x75,
+	0x65, 0x6e, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x69, 0x6e, 0x5f, 0x63,
+	0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x14, 0x73, 0x65, 0x71, 0x75, 0x65,
+	0x6e, 0x63, 0x65, 0x49, 0x64, 0x57, 0x69, 0x74, 0x68, 0x69, 0x6e, 0x43, 0x61, 0x6c, 0x6c, 0x12,
+	0x3d, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e,
+	0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x72, 0x70, 0x63, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3e,
+	0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x67, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x26,
+	0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e,
+	0x76, 0x31, 0x2e, 0x47, 0x72, 0x70, 0x63, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x2e,
+	0x4c, 0x6f, 0x67, 0x67, 0x65, 0x72, 0x52, 0x06, 0x6c, 0x6f, 0x67, 0x67, 0x65, 0x72, 0x12, 0x46,
+	0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e,
+	0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x48, 0x00, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x46, 0x0a, 0x0d, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x48, 0x00,
+	0x52, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x36,
+	0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x48, 0x00, 0x52, 0x07, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x65,
+	0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62,
+	0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x69,
+	0x6c, 0x65, 0x72, 0x48, 0x00, 0x52, 0x07, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x65, 0x72, 0x12, 0x2b,
+	0x0a, 0x11, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x74, 0x72, 0x75, 0x6e, 0x63, 0x61,
+	0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x70, 0x61, 0x79, 0x6c, 0x6f,
+	0x61, 0x64, 0x54, 0x72, 0x75, 0x6e, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x04, 0x70,
+	0x65, 0x65, 0x72, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x72, 0x70, 0x63,
+	0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x52, 0x04, 0x70, 0x65, 0x65, 0x72, 0x22, 0xf5, 0x01, 0x0a, 0x09,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x45, 0x56, 0x45,
+	0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10,
+	0x00, 0x12, 0x1c, 0x0a, 0x18, 0x45, 0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x43, 0x4c, 0x49, 0x45, 0x4e, 0x54, 0x5f, 0x48, 0x45, 0x41, 0x44, 0x45, 0x52, 0x10, 0x01, 0x12,
+	0x1c, 0x0a, 0x18, 0x45, 0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x45,
+	0x52, 0x56, 0x45, 0x52, 0x5f, 0x48, 0x45, 0x41, 0x44, 0x45, 0x52, 0x10, 0x02, 0x12, 0x1d, 0x0a,
+	0x19, 0x45, 0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x4c, 0x49, 0x45,
+	0x4e, 0x54, 0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45, 0x10, 0x03, 0x12, 0x1d, 0x0a, 0x19,
+	0x45, 0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x45,
+	0x52, 0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45, 0x10, 0x04, 0x12, 0x20, 0x0a, 0x1c, 0x45,
+	0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x4c, 0x49, 0x45, 0x4e, 0x54,
+	0x5f, 0x48, 0x41, 0x4c, 0x46, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x10, 0x05, 0x12, 0x1d, 0x0a,
+	0x19, 0x45, 0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x45, 0x52, 0x56,
+	0x45, 0x52, 0x5f, 0x54, 0x52, 0x41, 0x49, 0x4c, 0x45, 0x52, 0x10, 0x06, 0x12, 0x15, 0x0a, 0x11,
+	0x45, 0x56, 0x45, 0x4e, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x41, 0x4e, 0x43, 0x45,
+	0x4c, 0x10, 0x07, 0x22, 0x42, 0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x67, 0x65, 0x72, 0x12, 0x12, 0x0a,
+	0x0e, 0x4c, 0x4f, 0x47, 0x47, 0x45, 0x52, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10,
+	0x00, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x4f, 0x47, 0x47, 0x45, 0x52, 0x5f, 0x43, 0x4c, 0x49, 0x45,
+	0x4e, 0x54, 0x10, 0x01, 0x12, 0x11, 0x0a, 0x0d, 0x4c, 0x4f, 0x47, 0x47, 0x45, 0x52, 0x5f, 0x53,
+	0x45, 0x52, 0x56, 0x45, 0x52, 0x10, 0x02, 0x42, 0x09, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f,
+	0x61, 0x64, 0x22, 0xbb, 0x01, 0x0a, 0x0c, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x12, 0x37, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e,
+	0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1f, 0x0a, 0x0b,
+	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1c, 0x0a,
+	0x09, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x33, 0x0a, 0x07, 0x74,
+	0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
+	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
+	0x22, 0x47, 0x0a, 0x0c, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x12, 0x37, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79,
+	0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xb1, 0x01, 0x0a, 0x07, 0x54, 0x72,
+	0x61, 0x69, 0x6c, 0x65, 0x72, 0x12, 0x37, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62,
+	0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1f,
+	0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x12,
+	0x25, 0x0a, 0x0e, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x5f, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0d,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x22, 0x35, 0x0a,
+	0x07, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6c, 0x65, 0x6e, 0x67,
+	0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68,
+	0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0x42, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x12, 0x36, 0x0a, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x20, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67,
+	0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x05, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x22, 0x37, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x22, 0xb8, 0x01, 0x0a, 0x07, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x33, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e, 0x67, 0x72,
+	0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2e, 0x76, 0x31, 0x2e,
+	0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x17, 0x0a, 0x07,
+	0x69, 0x70, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x69,
+	0x70, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x45, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x10, 0x0a,
+	0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12,
+	0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x50, 0x56, 0x34, 0x10, 0x01, 0x12, 0x0d,
+	0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x50, 0x56, 0x36, 0x10, 0x02, 0x12, 0x0d, 0x0a,
+	0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x49, 0x58, 0x10, 0x03, 0x42, 0x5c, 0x0a, 0x14,
+	0x69, 0x6f, 0x2e, 0x67, 0x72, 0x70, 0x63, 0x2e, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f,
+	0x67, 0x2e, 0x76, 0x31, 0x42, 0x0e, 0x42, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x4c, 0x6f, 0x67, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x32, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67,
+	0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x62,
+	0x69, 0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x5f, 0x62, 0x69,
+	0x6e, 0x61, 0x72, 0x79, 0x6c, 0x6f, 0x67, 0x5f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_grpc_binlog_v1_binarylog_proto_rawDescOnce sync.Once
+	file_grpc_binlog_v1_binarylog_proto_rawDescData = file_grpc_binlog_v1_binarylog_proto_rawDesc
+)
+
+func file_grpc_binlog_v1_binarylog_proto_rawDescGZIP() []byte {
+	file_grpc_binlog_v1_binarylog_proto_rawDescOnce.Do(func() {
+		file_grpc_binlog_v1_binarylog_proto_rawDescData = protoimpl.X.CompressGZIP(file_grpc_binlog_v1_binarylog_proto_rawDescData)
+	})
+	return file_grpc_binlog_v1_binarylog_proto_rawDescData
+}
+
+var file_grpc_binlog_v1_binarylog_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_grpc_binlog_v1_binarylog_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_grpc_binlog_v1_binarylog_proto_goTypes = []interface{}{
+	(GrpcLogEntry_EventType)(0),   // 0: grpc.binarylog.v1.GrpcLogEntry.EventType
+	(GrpcLogEntry_Logger)(0),      // 1: grpc.binarylog.v1.GrpcLogEntry.Logger
+	(Address_Type)(0),             // 2: grpc.binarylog.v1.Address.Type
+	(*GrpcLogEntry)(nil),          // 3: grpc.binarylog.v1.GrpcLogEntry
+	(*ClientHeader)(nil),          // 4: grpc.binarylog.v1.ClientHeader
+	(*ServerHeader)(nil),          // 5: grpc.binarylog.v1.ServerHeader
+	(*Trailer)(nil),               // 6: grpc.binarylog.v1.Trailer
+	(*Message)(nil),               // 7: grpc.binarylog.v1.Message
+	(*Metadata)(nil),              // 8: grpc.binarylog.v1.Metadata
+	(*MetadataEntry)(nil),         // 9: grpc.binarylog.v1.MetadataEntry
+	(*Address)(nil),               // 10: grpc.binarylog.v1.Address
+	(*timestamppb.Timestamp)(nil), // 11: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),   // 12: google.protobuf.Duration
+}
+var file_grpc_binlog_v1_binarylog_proto_depIdxs = []int32{
+	11, // 0: grpc.binarylog.v1.GrpcLogEntry.timestamp:type_name -> google.protobuf.Timestamp
+	0,  // 1: grpc.binarylog.v1.GrpcLogEntry.type:type_name -> grpc.binarylog.v1.GrpcLogEntry.EventType
+	1,  // 2: grpc.binarylog.v1.GrpcLogEntry.logger:type_name -> grpc.binarylog.v1.GrpcLogEntry.Logger
+	4,  // 3: grpc.binarylog.v1.GrpcLogEntry.client_header:type_name -> grpc.binarylog.v1.ClientHeader
+	5,  // 4: grpc.binarylog.v1.GrpcLogEntry.server_header:type_name -> grpc.binarylog.v1.ServerHeader
+	7,  // 5: grpc.binarylog.v1.GrpcLogEntry.message:type_name -> grpc.binarylog.v1.Message
+	6,  // 6: grpc.binarylog.v1.GrpcLogEntry.trailer:type_name -> grpc.binarylog.v1.Trailer
+	10, // 7: grpc.binarylog.v1.GrpcLogEntry.peer:type_name -> grpc.binarylog.v1.Address
+	8,  // 8: grpc.binarylog.v1.ClientHeader.metadata:type_name -> grpc.binarylog.v1.Metadata
+	12, // 9: grpc.binarylog.v1.ClientHeader.timeout:type_name -> google.protobuf.Duration
+	8,  // 10: grpc.binarylog.v1.ServerHeader.metadata:type_name -> grpc.binarylog.v1.Metadata
+	8,  // 11: grpc.binarylog.v1.Trailer.metadata:type_name -> grpc.binarylog.v1.Metadata
+	9,  // 12: grpc.binarylog.v1.Metadata.entry:type_name -> grpc.binarylog.v1.MetadataEntry
+	2,  // 13: grpc.binarylog.v1.Address.type:type_name -> grpc.binarylog.v1.Address.Type
+	14, // [14:14] is the sub-list for method output_type
+	14, // [14:14] is the sub-list for method input_type
+	14, // [14:14] is the sub-list for extension type_name
+	14, // [14:14] is the sub-list for extension extendee
+	0,  // [0:14] is the sub-list for field type_name
+}
+
+func init() { file_grpc_binlog_v1_binarylog_proto_init() }
+func file_grpc_binlog_v1_binarylog_proto_init() {
+	if File_grpc_binlog_v1_binarylog_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GrpcLogEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClientHeader); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServerHeader); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Trailer); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Message); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetadataEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_grpc_binlog_v1_binarylog_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Address); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_grpc_binlog_v1_binarylog_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*GrpcLogEntry_ClientHeader)(nil),
+		(*GrpcLogEntry_ServerHeader)(nil),
+		(*GrpcLogEntry_Message)(nil),
+		(*GrpcLogEntry_Trailer)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_grpc_binlog_v1_binarylog_proto_rawDesc,
+			NumEnums:      3,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_grpc_binlog_v1_binarylog_proto_goTypes,
+		DependencyIndexes: file_grpc_binlog_v1_binarylog_proto_depIdxs,
+		EnumInfos:         file_grpc_binlog_v1_binarylog_proto_enumTypes,
+		MessageInfos:      file_grpc_binlog_v1_binarylog_proto_msgTypes,
+	}.Build()
+	File_grpc_binlog_v1_binarylog_proto = out.File
+	file_grpc_binlog_v1_binarylog_proto_rawDesc = nil
+	file_grpc_binlog_v1_binarylog_proto_goTypes = nil
+	file_grpc_binlog_v1_binarylog_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/grpc/call.go b/vendor/google.golang.org/grpc/call.go
new file mode 100644
index 0000000000..9e20e4d385
--- /dev/null
+++ b/vendor/google.golang.org/grpc/call.go
@@ -0,0 +1,74 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+)
+
+// Invoke sends the RPC request on the wire and returns after response is
+// received.  This is typically called by generated code.
+//
+// All errors returned by Invoke are compatible with the status package.
+func (cc *ClientConn) Invoke(ctx context.Context, method string, args, reply interface{}, opts ...CallOption) error {
+	// allow interceptor to see all applicable call options, which means those
+	// configured as defaults from dial option as well as per-call options
+	opts = combine(cc.dopts.callOptions, opts)
+
+	if cc.dopts.unaryInt != nil {
+		return cc.dopts.unaryInt(ctx, method, args, reply, cc, invoke, opts...)
+	}
+	return invoke(ctx, method, args, reply, cc, opts...)
+}
+
+func combine(o1 []CallOption, o2 []CallOption) []CallOption {
+	// we don't use append because o1 could have extra capacity whose
+	// elements would be overwritten, which could cause inadvertent
+	// sharing (and race conditions) between concurrent calls
+	if len(o1) == 0 {
+		return o2
+	} else if len(o2) == 0 {
+		return o1
+	}
+	ret := make([]CallOption, len(o1)+len(o2))
+	copy(ret, o1)
+	copy(ret[len(o1):], o2)
+	return ret
+}
+
+// Invoke sends the RPC request on the wire and returns after response is
+// received.  This is typically called by generated code.
+//
+// DEPRECATED: Use ClientConn.Invoke instead.
+func Invoke(ctx context.Context, method string, args, reply interface{}, cc *ClientConn, opts ...CallOption) error {
+	return cc.Invoke(ctx, method, args, reply, opts...)
+}
+
+var unaryStreamDesc = &StreamDesc{ServerStreams: false, ClientStreams: false}
+
+func invoke(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, opts ...CallOption) error {
+	cs, err := newClientStream(ctx, unaryStreamDesc, cc, method, opts...)
+	if err != nil {
+		return err
+	}
+	if err := cs.SendMsg(req); err != nil {
+		return err
+	}
+	return cs.RecvMsg(reply)
+}
diff --git a/vendor/google.golang.org/grpc/channelz/channelz.go b/vendor/google.golang.org/grpc/channelz/channelz.go
new file mode 100644
index 0000000000..32b7fa5794
--- /dev/null
+++ b/vendor/google.golang.org/grpc/channelz/channelz.go
@@ -0,0 +1,36 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package channelz exports internals of the channelz implementation as required
+// by other gRPC packages.
+//
+// The implementation of the channelz spec as defined in
+// https://github.com/grpc/proposal/blob/master/A14-channelz.md, is provided by
+// the `internal/channelz` package.
+//
+// # Experimental
+//
+// Notice: All APIs in this package are experimental and may be removed in a
+// later release.
+package channelz
+
+import "google.golang.org/grpc/internal/channelz"
+
+// Identifier is an opaque identifier which uniquely identifies an entity in the
+// channelz database.
+type Identifier = channelz.Identifier
diff --git a/vendor/google.golang.org/grpc/clientconn.go b/vendor/google.golang.org/grpc/clientconn.go
new file mode 100644
index 0000000000..3a76142424
--- /dev/null
+++ b/vendor/google.golang.org/grpc/clientconn.go
@@ -0,0 +1,1651 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"net/url"
+	"reflect"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/balancer/base"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/backoff"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/grpcsync"
+	iresolver "google.golang.org/grpc/internal/resolver"
+	"google.golang.org/grpc/internal/transport"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/serviceconfig"
+	"google.golang.org/grpc/status"
+
+	_ "google.golang.org/grpc/balancer/roundrobin"           // To register roundrobin.
+	_ "google.golang.org/grpc/internal/resolver/dns"         // To register dns resolver.
+	_ "google.golang.org/grpc/internal/resolver/passthrough" // To register passthrough resolver.
+	_ "google.golang.org/grpc/internal/resolver/unix"        // To register unix resolver.
+)
+
+const (
+	// minimum time to give a connection to complete
+	minConnectTimeout = 20 * time.Second
+	// must match grpclbName in grpclb/grpclb.go
+	grpclbName = "grpclb"
+)
+
+var (
+	// ErrClientConnClosing indicates that the operation is illegal because
+	// the ClientConn is closing.
+	//
+	// Deprecated: this error should not be relied upon by users; use the status
+	// code of Canceled instead.
+	ErrClientConnClosing = status.Error(codes.Canceled, "grpc: the client connection is closing")
+	// errConnDrain indicates that the connection starts to be drained and does not accept any new RPCs.
+	errConnDrain = errors.New("grpc: the connection is drained")
+	// errConnClosing indicates that the connection is closing.
+	errConnClosing = errors.New("grpc: the connection is closing")
+	// invalidDefaultServiceConfigErrPrefix is used to prefix the json parsing error for the default
+	// service config.
+	invalidDefaultServiceConfigErrPrefix = "grpc: the provided default service config is invalid"
+)
+
+// The following errors are returned from Dial and DialContext
+var (
+	// errNoTransportSecurity indicates that there is no transport security
+	// being set for ClientConn. Users should either set one or explicitly
+	// call WithInsecure DialOption to disable security.
+	errNoTransportSecurity = errors.New("grpc: no transport security set (use grpc.WithTransportCredentials(insecure.NewCredentials()) explicitly or set credentials)")
+	// errTransportCredsAndBundle indicates that creds bundle is used together
+	// with other individual Transport Credentials.
+	errTransportCredsAndBundle = errors.New("grpc: credentials.Bundle may not be used with individual TransportCredentials")
+	// errNoTransportCredsInBundle indicated that the configured creds bundle
+	// returned a transport credentials which was nil.
+	errNoTransportCredsInBundle = errors.New("grpc: credentials.Bundle must return non-nil transport credentials")
+	// errTransportCredentialsMissing indicates that users want to transmit
+	// security information (e.g., OAuth2 token) which requires secure
+	// connection on an insecure connection.
+	errTransportCredentialsMissing = errors.New("grpc: the credentials require transport level security (use grpc.WithTransportCredentials() to set)")
+)
+
+const (
+	defaultClientMaxReceiveMessageSize = 1024 * 1024 * 4
+	defaultClientMaxSendMessageSize    = math.MaxInt32
+	// http2IOBufSize specifies the buffer size for sending frames.
+	defaultWriteBufSize = 32 * 1024
+	defaultReadBufSize  = 32 * 1024
+)
+
+// Dial creates a client connection to the given target.
+func Dial(target string, opts ...DialOption) (*ClientConn, error) {
+	return DialContext(context.Background(), target, opts...)
+}
+
+type defaultConfigSelector struct {
+	sc *ServiceConfig
+}
+
+func (dcs *defaultConfigSelector) SelectConfig(rpcInfo iresolver.RPCInfo) (*iresolver.RPCConfig, error) {
+	return &iresolver.RPCConfig{
+		Context:      rpcInfo.Context,
+		MethodConfig: getMethodConfig(dcs.sc, rpcInfo.Method),
+	}, nil
+}
+
+// DialContext creates a client connection to the given target. By default, it's
+// a non-blocking dial (the function won't wait for connections to be
+// established, and connecting happens in the background). To make it a blocking
+// dial, use WithBlock() dial option.
+//
+// In the non-blocking case, the ctx does not act against the connection. It
+// only controls the setup steps.
+//
+// In the blocking case, ctx can be used to cancel or expire the pending
+// connection. Once this function returns, the cancellation and expiration of
+// ctx will be noop. Users should call ClientConn.Close to terminate all the
+// pending operations after this function returns.
+//
+// The target name syntax is defined in
+// https://github.com/grpc/grpc/blob/master/doc/naming.md.
+// e.g. to use dns resolver, a "dns:///" prefix should be applied to the target.
+func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *ClientConn, err error) {
+	cc := &ClientConn{
+		target:            target,
+		csMgr:             &connectivityStateManager{},
+		conns:             make(map[*addrConn]struct{}),
+		dopts:             defaultDialOptions(),
+		blockingpicker:    newPickerWrapper(),
+		czData:            new(channelzData),
+		firstResolveEvent: grpcsync.NewEvent(),
+	}
+	cc.retryThrottler.Store((*retryThrottler)(nil))
+	cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{nil})
+	cc.ctx, cc.cancel = context.WithCancel(context.Background())
+
+	disableGlobalOpts := false
+	for _, opt := range opts {
+		if _, ok := opt.(*disableGlobalDialOptions); ok {
+			disableGlobalOpts = true
+			break
+		}
+	}
+
+	if !disableGlobalOpts {
+		for _, opt := range globalDialOptions {
+			opt.apply(&cc.dopts)
+		}
+	}
+
+	for _, opt := range opts {
+		opt.apply(&cc.dopts)
+	}
+
+	chainUnaryClientInterceptors(cc)
+	chainStreamClientInterceptors(cc)
+
+	defer func() {
+		if err != nil {
+			cc.Close()
+		}
+	}()
+
+	pid := cc.dopts.channelzParentID
+	cc.channelzID = channelz.RegisterChannel(&channelzChannel{cc}, pid, target)
+	ted := &channelz.TraceEventDesc{
+		Desc:     "Channel created",
+		Severity: channelz.CtInfo,
+	}
+	if cc.dopts.channelzParentID != nil {
+		ted.Parent = &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Nested Channel(id:%d) created", cc.channelzID.Int()),
+			Severity: channelz.CtInfo,
+		}
+	}
+	channelz.AddTraceEvent(logger, cc.channelzID, 1, ted)
+	cc.csMgr.channelzID = cc.channelzID
+
+	if cc.dopts.copts.TransportCredentials == nil && cc.dopts.copts.CredsBundle == nil {
+		return nil, errNoTransportSecurity
+	}
+	if cc.dopts.copts.TransportCredentials != nil && cc.dopts.copts.CredsBundle != nil {
+		return nil, errTransportCredsAndBundle
+	}
+	if cc.dopts.copts.CredsBundle != nil && cc.dopts.copts.CredsBundle.TransportCredentials() == nil {
+		return nil, errNoTransportCredsInBundle
+	}
+	transportCreds := cc.dopts.copts.TransportCredentials
+	if transportCreds == nil {
+		transportCreds = cc.dopts.copts.CredsBundle.TransportCredentials()
+	}
+	if transportCreds.Info().SecurityProtocol == "insecure" {
+		for _, cd := range cc.dopts.copts.PerRPCCredentials {
+			if cd.RequireTransportSecurity() {
+				return nil, errTransportCredentialsMissing
+			}
+		}
+	}
+
+	if cc.dopts.defaultServiceConfigRawJSON != nil {
+		scpr := parseServiceConfig(*cc.dopts.defaultServiceConfigRawJSON)
+		if scpr.Err != nil {
+			return nil, fmt.Errorf("%s: %v", invalidDefaultServiceConfigErrPrefix, scpr.Err)
+		}
+		cc.dopts.defaultServiceConfig, _ = scpr.Config.(*ServiceConfig)
+	}
+	cc.mkp = cc.dopts.copts.KeepaliveParams
+
+	if cc.dopts.copts.UserAgent != "" {
+		cc.dopts.copts.UserAgent += " " + grpcUA
+	} else {
+		cc.dopts.copts.UserAgent = grpcUA
+	}
+
+	if cc.dopts.timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, cc.dopts.timeout)
+		defer cancel()
+	}
+	defer func() {
+		select {
+		case <-ctx.Done():
+			switch {
+			case ctx.Err() == err:
+				conn = nil
+			case err == nil || !cc.dopts.returnLastError:
+				conn, err = nil, ctx.Err()
+			default:
+				conn, err = nil, fmt.Errorf("%v: %v", ctx.Err(), err)
+			}
+		default:
+		}
+	}()
+
+	if cc.dopts.bs == nil {
+		cc.dopts.bs = backoff.DefaultExponential
+	}
+
+	// Determine the resolver to use.
+	resolverBuilder, err := cc.parseTargetAndFindResolver()
+	if err != nil {
+		return nil, err
+	}
+	cc.authority, err = determineAuthority(cc.parsedTarget.Endpoint(), cc.target, cc.dopts)
+	if err != nil {
+		return nil, err
+	}
+	channelz.Infof(logger, cc.channelzID, "Channel authority set to %q", cc.authority)
+
+	if cc.dopts.scChan != nil {
+		// Blocking wait for the initial service config.
+		select {
+		case sc, ok := <-cc.dopts.scChan:
+			if ok {
+				cc.sc = &sc
+				cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{&sc})
+			}
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+	if cc.dopts.scChan != nil {
+		go cc.scWatcher()
+	}
+
+	var credsClone credentials.TransportCredentials
+	if creds := cc.dopts.copts.TransportCredentials; creds != nil {
+		credsClone = creds.Clone()
+	}
+	cc.balancerWrapper = newCCBalancerWrapper(cc, balancer.BuildOptions{
+		DialCreds:        credsClone,
+		CredsBundle:      cc.dopts.copts.CredsBundle,
+		Dialer:           cc.dopts.copts.Dialer,
+		Authority:        cc.authority,
+		CustomUserAgent:  cc.dopts.copts.UserAgent,
+		ChannelzParentID: cc.channelzID,
+		Target:           cc.parsedTarget,
+	})
+
+	// Build the resolver.
+	rWrapper, err := newCCResolverWrapper(cc, resolverBuilder)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build resolver: %v", err)
+	}
+	cc.mu.Lock()
+	cc.resolverWrapper = rWrapper
+	cc.mu.Unlock()
+
+	// A blocking dial blocks until the clientConn is ready.
+	if cc.dopts.block {
+		for {
+			cc.Connect()
+			s := cc.GetState()
+			if s == connectivity.Ready {
+				break
+			} else if cc.dopts.copts.FailOnNonTempDialError && s == connectivity.TransientFailure {
+				if err = cc.connectionError(); err != nil {
+					terr, ok := err.(interface {
+						Temporary() bool
+					})
+					if ok && !terr.Temporary() {
+						return nil, err
+					}
+				}
+			}
+			if !cc.WaitForStateChange(ctx, s) {
+				// ctx got timeout or canceled.
+				if err = cc.connectionError(); err != nil && cc.dopts.returnLastError {
+					return nil, err
+				}
+				return nil, ctx.Err()
+			}
+		}
+	}
+
+	return cc, nil
+}
+
+// chainUnaryClientInterceptors chains all unary client interceptors into one.
+func chainUnaryClientInterceptors(cc *ClientConn) {
+	interceptors := cc.dopts.chainUnaryInts
+	// Prepend dopts.unaryInt to the chaining interceptors if it exists, since unaryInt will
+	// be executed before any other chained interceptors.
+	if cc.dopts.unaryInt != nil {
+		interceptors = append([]UnaryClientInterceptor{cc.dopts.unaryInt}, interceptors...)
+	}
+	var chainedInt UnaryClientInterceptor
+	if len(interceptors) == 0 {
+		chainedInt = nil
+	} else if len(interceptors) == 1 {
+		chainedInt = interceptors[0]
+	} else {
+		chainedInt = func(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, invoker UnaryInvoker, opts ...CallOption) error {
+			return interceptors[0](ctx, method, req, reply, cc, getChainUnaryInvoker(interceptors, 0, invoker), opts...)
+		}
+	}
+	cc.dopts.unaryInt = chainedInt
+}
+
+// getChainUnaryInvoker recursively generate the chained unary invoker.
+func getChainUnaryInvoker(interceptors []UnaryClientInterceptor, curr int, finalInvoker UnaryInvoker) UnaryInvoker {
+	if curr == len(interceptors)-1 {
+		return finalInvoker
+	}
+	return func(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, opts ...CallOption) error {
+		return interceptors[curr+1](ctx, method, req, reply, cc, getChainUnaryInvoker(interceptors, curr+1, finalInvoker), opts...)
+	}
+}
+
+// chainStreamClientInterceptors chains all stream client interceptors into one.
+func chainStreamClientInterceptors(cc *ClientConn) {
+	interceptors := cc.dopts.chainStreamInts
+	// Prepend dopts.streamInt to the chaining interceptors if it exists, since streamInt will
+	// be executed before any other chained interceptors.
+	if cc.dopts.streamInt != nil {
+		interceptors = append([]StreamClientInterceptor{cc.dopts.streamInt}, interceptors...)
+	}
+	var chainedInt StreamClientInterceptor
+	if len(interceptors) == 0 {
+		chainedInt = nil
+	} else if len(interceptors) == 1 {
+		chainedInt = interceptors[0]
+	} else {
+		chainedInt = func(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, streamer Streamer, opts ...CallOption) (ClientStream, error) {
+			return interceptors[0](ctx, desc, cc, method, getChainStreamer(interceptors, 0, streamer), opts...)
+		}
+	}
+	cc.dopts.streamInt = chainedInt
+}
+
+// getChainStreamer recursively generate the chained client stream constructor.
+func getChainStreamer(interceptors []StreamClientInterceptor, curr int, finalStreamer Streamer) Streamer {
+	if curr == len(interceptors)-1 {
+		return finalStreamer
+	}
+	return func(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (ClientStream, error) {
+		return interceptors[curr+1](ctx, desc, cc, method, getChainStreamer(interceptors, curr+1, finalStreamer), opts...)
+	}
+}
+
+// connectivityStateManager keeps the connectivity.State of ClientConn.
+// This struct will eventually be exported so the balancers can access it.
+type connectivityStateManager struct {
+	mu         sync.Mutex
+	state      connectivity.State
+	notifyChan chan struct{}
+	channelzID *channelz.Identifier
+}
+
+// updateState updates the connectivity.State of ClientConn.
+// If there's a change it notifies goroutines waiting on state change to
+// happen.
+func (csm *connectivityStateManager) updateState(state connectivity.State) {
+	csm.mu.Lock()
+	defer csm.mu.Unlock()
+	if csm.state == connectivity.Shutdown {
+		return
+	}
+	if csm.state == state {
+		return
+	}
+	csm.state = state
+	channelz.Infof(logger, csm.channelzID, "Channel Connectivity change to %v", state)
+	if csm.notifyChan != nil {
+		// There are other goroutines waiting on this channel.
+		close(csm.notifyChan)
+		csm.notifyChan = nil
+	}
+}
+
+func (csm *connectivityStateManager) getState() connectivity.State {
+	csm.mu.Lock()
+	defer csm.mu.Unlock()
+	return csm.state
+}
+
+func (csm *connectivityStateManager) getNotifyChan() <-chan struct{} {
+	csm.mu.Lock()
+	defer csm.mu.Unlock()
+	if csm.notifyChan == nil {
+		csm.notifyChan = make(chan struct{})
+	}
+	return csm.notifyChan
+}
+
+// ClientConnInterface defines the functions clients need to perform unary and
+// streaming RPCs.  It is implemented by *ClientConn, and is only intended to
+// be referenced by generated code.
+type ClientConnInterface interface {
+	// Invoke performs a unary RPC and returns after the response is received
+	// into reply.
+	Invoke(ctx context.Context, method string, args interface{}, reply interface{}, opts ...CallOption) error
+	// NewStream begins a streaming RPC.
+	NewStream(ctx context.Context, desc *StreamDesc, method string, opts ...CallOption) (ClientStream, error)
+}
+
+// Assert *ClientConn implements ClientConnInterface.
+var _ ClientConnInterface = (*ClientConn)(nil)
+
+// ClientConn represents a virtual connection to a conceptual endpoint, to
+// perform RPCs.
+//
+// A ClientConn is free to have zero or more actual connections to the endpoint
+// based on configuration, load, etc. It is also free to determine which actual
+// endpoints to use and may change it every RPC, permitting client-side load
+// balancing.
+//
+// A ClientConn encapsulates a range of functionality including name
+// resolution, TCP connection establishment (with retries and backoff) and TLS
+// handshakes. It also handles errors on established connections by
+// re-resolving the name and reconnecting.
+type ClientConn struct {
+	ctx    context.Context    // Initialized using the background context at dial time.
+	cancel context.CancelFunc // Cancelled on close.
+
+	// The following are initialized at dial time, and are read-only after that.
+	target          string               // User's dial target.
+	parsedTarget    resolver.Target      // See parseTargetAndFindResolver().
+	authority       string               // See determineAuthority().
+	dopts           dialOptions          // Default and user specified dial options.
+	channelzID      *channelz.Identifier // Channelz identifier for the channel.
+	balancerWrapper *ccBalancerWrapper   // Uses gracefulswitch.balancer underneath.
+
+	// The following provide their own synchronization, and therefore don't
+	// require cc.mu to be held to access them.
+	csMgr              *connectivityStateManager
+	blockingpicker     *pickerWrapper
+	safeConfigSelector iresolver.SafeConfigSelector
+	czData             *channelzData
+	retryThrottler     atomic.Value // Updated from service config.
+
+	// firstResolveEvent is used to track whether the name resolver sent us at
+	// least one update. RPCs block on this event.
+	firstResolveEvent *grpcsync.Event
+
+	// mu protects the following fields.
+	// TODO: split mu so the same mutex isn't used for everything.
+	mu              sync.RWMutex
+	resolverWrapper *ccResolverWrapper         // Initialized in Dial; cleared in Close.
+	sc              *ServiceConfig             // Latest service config received from the resolver.
+	conns           map[*addrConn]struct{}     // Set to nil on close.
+	mkp             keepalive.ClientParameters // May be updated upon receipt of a GoAway.
+
+	lceMu               sync.Mutex // protects lastConnectionError
+	lastConnectionError error
+}
+
+// WaitForStateChange waits until the connectivity.State of ClientConn changes from sourceState or
+// ctx expires. A true value is returned in former case and false in latter.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func (cc *ClientConn) WaitForStateChange(ctx context.Context, sourceState connectivity.State) bool {
+	ch := cc.csMgr.getNotifyChan()
+	if cc.csMgr.getState() != sourceState {
+		return true
+	}
+	select {
+	case <-ctx.Done():
+		return false
+	case <-ch:
+		return true
+	}
+}
+
+// GetState returns the connectivity.State of ClientConn.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a later
+// release.
+func (cc *ClientConn) GetState() connectivity.State {
+	return cc.csMgr.getState()
+}
+
+// Connect causes all subchannels in the ClientConn to attempt to connect if
+// the channel is idle.  Does not wait for the connection attempts to begin
+// before returning.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a later
+// release.
+func (cc *ClientConn) Connect() {
+	cc.balancerWrapper.exitIdle()
+}
+
+func (cc *ClientConn) scWatcher() {
+	for {
+		select {
+		case sc, ok := <-cc.dopts.scChan:
+			if !ok {
+				return
+			}
+			cc.mu.Lock()
+			// TODO: load balance policy runtime change is ignored.
+			// We may revisit this decision in the future.
+			cc.sc = &sc
+			cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{&sc})
+			cc.mu.Unlock()
+		case <-cc.ctx.Done():
+			return
+		}
+	}
+}
+
+// waitForResolvedAddrs blocks until the resolver has provided addresses or the
+// context expires.  Returns nil unless the context expires first; otherwise
+// returns a status error based on the context.
+func (cc *ClientConn) waitForResolvedAddrs(ctx context.Context) error {
+	// This is on the RPC path, so we use a fast path to avoid the
+	// more-expensive "select" below after the resolver has returned once.
+	if cc.firstResolveEvent.HasFired() {
+		return nil
+	}
+	select {
+	case <-cc.firstResolveEvent.Done():
+		return nil
+	case <-ctx.Done():
+		return status.FromContextError(ctx.Err()).Err()
+	case <-cc.ctx.Done():
+		return ErrClientConnClosing
+	}
+}
+
+var emptyServiceConfig *ServiceConfig
+
+func init() {
+	cfg := parseServiceConfig("{}")
+	if cfg.Err != nil {
+		panic(fmt.Sprintf("impossible error parsing empty service config: %v", cfg.Err))
+	}
+	emptyServiceConfig = cfg.Config.(*ServiceConfig)
+}
+
+func (cc *ClientConn) maybeApplyDefaultServiceConfig(addrs []resolver.Address) {
+	if cc.sc != nil {
+		cc.applyServiceConfigAndBalancer(cc.sc, nil, addrs)
+		return
+	}
+	if cc.dopts.defaultServiceConfig != nil {
+		cc.applyServiceConfigAndBalancer(cc.dopts.defaultServiceConfig, &defaultConfigSelector{cc.dopts.defaultServiceConfig}, addrs)
+	} else {
+		cc.applyServiceConfigAndBalancer(emptyServiceConfig, &defaultConfigSelector{emptyServiceConfig}, addrs)
+	}
+}
+
+func (cc *ClientConn) updateResolverState(s resolver.State, err error) error {
+	defer cc.firstResolveEvent.Fire()
+	cc.mu.Lock()
+	// Check if the ClientConn is already closed. Some fields (e.g.
+	// balancerWrapper) are set to nil when closing the ClientConn, and could
+	// cause nil pointer panic if we don't have this check.
+	if cc.conns == nil {
+		cc.mu.Unlock()
+		return nil
+	}
+
+	if err != nil {
+		// May need to apply the initial service config in case the resolver
+		// doesn't support service configs, or doesn't provide a service config
+		// with the new addresses.
+		cc.maybeApplyDefaultServiceConfig(nil)
+
+		cc.balancerWrapper.resolverError(err)
+
+		// No addresses are valid with err set; return early.
+		cc.mu.Unlock()
+		return balancer.ErrBadResolverState
+	}
+
+	var ret error
+	if cc.dopts.disableServiceConfig {
+		channelz.Infof(logger, cc.channelzID, "ignoring service config from resolver (%v) and applying the default because service config is disabled", s.ServiceConfig)
+		cc.maybeApplyDefaultServiceConfig(s.Addresses)
+	} else if s.ServiceConfig == nil {
+		cc.maybeApplyDefaultServiceConfig(s.Addresses)
+		// TODO: do we need to apply a failing LB policy if there is no
+		// default, per the error handling design?
+	} else {
+		if sc, ok := s.ServiceConfig.Config.(*ServiceConfig); s.ServiceConfig.Err == nil && ok {
+			configSelector := iresolver.GetConfigSelector(s)
+			if configSelector != nil {
+				if len(s.ServiceConfig.Config.(*ServiceConfig).Methods) != 0 {
+					channelz.Infof(logger, cc.channelzID, "method configs in service config will be ignored due to presence of config selector")
+				}
+			} else {
+				configSelector = &defaultConfigSelector{sc}
+			}
+			cc.applyServiceConfigAndBalancer(sc, configSelector, s.Addresses)
+		} else {
+			ret = balancer.ErrBadResolverState
+			if cc.sc == nil {
+				// Apply the failing LB only if we haven't received valid service config
+				// from the name resolver in the past.
+				cc.applyFailingLB(s.ServiceConfig)
+				cc.mu.Unlock()
+				return ret
+			}
+		}
+	}
+
+	var balCfg serviceconfig.LoadBalancingConfig
+	if cc.sc != nil && cc.sc.lbConfig != nil {
+		balCfg = cc.sc.lbConfig.cfg
+	}
+	bw := cc.balancerWrapper
+	cc.mu.Unlock()
+
+	uccsErr := bw.updateClientConnState(&balancer.ClientConnState{ResolverState: s, BalancerConfig: balCfg})
+	if ret == nil {
+		ret = uccsErr // prefer ErrBadResolver state since any other error is
+		// currently meaningless to the caller.
+	}
+	return ret
+}
+
+// applyFailingLB is akin to configuring an LB policy on the channel which
+// always fails RPCs. Here, an actual LB policy is not configured, but an always
+// erroring picker is configured, which returns errors with information about
+// what was invalid in the received service config. A config selector with no
+// service config is configured, and the connectivity state of the channel is
+// set to TransientFailure.
+//
+// Caller must hold cc.mu.
+func (cc *ClientConn) applyFailingLB(sc *serviceconfig.ParseResult) {
+	var err error
+	if sc.Err != nil {
+		err = status.Errorf(codes.Unavailable, "error parsing service config: %v", sc.Err)
+	} else {
+		err = status.Errorf(codes.Unavailable, "illegal service config type: %T", sc.Config)
+	}
+	cc.safeConfigSelector.UpdateConfigSelector(&defaultConfigSelector{nil})
+	cc.blockingpicker.updatePicker(base.NewErrPicker(err))
+	cc.csMgr.updateState(connectivity.TransientFailure)
+}
+
+func (cc *ClientConn) handleSubConnStateChange(sc balancer.SubConn, s connectivity.State, err error) {
+	cc.balancerWrapper.updateSubConnState(sc, s, err)
+}
+
+// newAddrConn creates an addrConn for addrs and adds it to cc.conns.
+//
+// Caller needs to make sure len(addrs) > 0.
+func (cc *ClientConn) newAddrConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (*addrConn, error) {
+	ac := &addrConn{
+		state:        connectivity.Idle,
+		cc:           cc,
+		addrs:        addrs,
+		scopts:       opts,
+		dopts:        cc.dopts,
+		czData:       new(channelzData),
+		resetBackoff: make(chan struct{}),
+	}
+	ac.ctx, ac.cancel = context.WithCancel(cc.ctx)
+	// Track ac in cc. This needs to be done before any getTransport(...) is called.
+	cc.mu.Lock()
+	defer cc.mu.Unlock()
+	if cc.conns == nil {
+		return nil, ErrClientConnClosing
+	}
+
+	var err error
+	ac.channelzID, err = channelz.RegisterSubChannel(ac, cc.channelzID, "")
+	if err != nil {
+		return nil, err
+	}
+	channelz.AddTraceEvent(logger, ac.channelzID, 0, &channelz.TraceEventDesc{
+		Desc:     "Subchannel created",
+		Severity: channelz.CtInfo,
+		Parent: &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Subchannel(id:%d) created", ac.channelzID.Int()),
+			Severity: channelz.CtInfo,
+		},
+	})
+
+	cc.conns[ac] = struct{}{}
+	return ac, nil
+}
+
+// removeAddrConn removes the addrConn in the subConn from clientConn.
+// It also tears down the ac with the given error.
+func (cc *ClientConn) removeAddrConn(ac *addrConn, err error) {
+	cc.mu.Lock()
+	if cc.conns == nil {
+		cc.mu.Unlock()
+		return
+	}
+	delete(cc.conns, ac)
+	cc.mu.Unlock()
+	ac.tearDown(err)
+}
+
+func (cc *ClientConn) channelzMetric() *channelz.ChannelInternalMetric {
+	return &channelz.ChannelInternalMetric{
+		State:                    cc.GetState(),
+		Target:                   cc.target,
+		CallsStarted:             atomic.LoadInt64(&cc.czData.callsStarted),
+		CallsSucceeded:           atomic.LoadInt64(&cc.czData.callsSucceeded),
+		CallsFailed:              atomic.LoadInt64(&cc.czData.callsFailed),
+		LastCallStartedTimestamp: time.Unix(0, atomic.LoadInt64(&cc.czData.lastCallStartedTime)),
+	}
+}
+
+// Target returns the target string of the ClientConn.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func (cc *ClientConn) Target() string {
+	return cc.target
+}
+
+func (cc *ClientConn) incrCallsStarted() {
+	atomic.AddInt64(&cc.czData.callsStarted, 1)
+	atomic.StoreInt64(&cc.czData.lastCallStartedTime, time.Now().UnixNano())
+}
+
+func (cc *ClientConn) incrCallsSucceeded() {
+	atomic.AddInt64(&cc.czData.callsSucceeded, 1)
+}
+
+func (cc *ClientConn) incrCallsFailed() {
+	atomic.AddInt64(&cc.czData.callsFailed, 1)
+}
+
+// connect starts creating a transport.
+// It does nothing if the ac is not IDLE.
+// TODO(bar) Move this to the addrConn section.
+func (ac *addrConn) connect() error {
+	ac.mu.Lock()
+	if ac.state == connectivity.Shutdown {
+		if logger.V(2) {
+			logger.Infof("connect called on shutdown addrConn; ignoring.")
+		}
+		ac.mu.Unlock()
+		return errConnClosing
+	}
+	if ac.state != connectivity.Idle {
+		if logger.V(2) {
+			logger.Infof("connect called on addrConn in non-idle state (%v); ignoring.", ac.state)
+		}
+		ac.mu.Unlock()
+		return nil
+	}
+	// Update connectivity state within the lock to prevent subsequent or
+	// concurrent calls from resetting the transport more than once.
+	ac.updateConnectivityState(connectivity.Connecting, nil)
+	ac.mu.Unlock()
+
+	ac.resetTransport()
+	return nil
+}
+
+func equalAddresses(a, b []resolver.Address) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i, v := range a {
+		if !v.Equal(b[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// tryUpdateAddrs tries to update ac.addrs with the new addresses list.
+//
+// If ac is TransientFailure, it updates ac.addrs and returns true. The updated
+// addresses will be picked up by retry in the next iteration after backoff.
+//
+// If ac is Shutdown or Idle, it updates ac.addrs and returns true.
+//
+// If the addresses is the same as the old list, it does nothing and returns
+// true.
+//
+// If ac is Connecting, it returns false. The caller should tear down the ac and
+// create a new one. Note that the backoff will be reset when this happens.
+//
+// If ac is Ready, it checks whether current connected address of ac is in the
+// new addrs list.
+//   - If true, it updates ac.addrs and returns true. The ac will keep using
+//     the existing connection.
+//   - If false, it does nothing and returns false.
+func (ac *addrConn) tryUpdateAddrs(addrs []resolver.Address) bool {
+	ac.mu.Lock()
+	defer ac.mu.Unlock()
+	channelz.Infof(logger, ac.channelzID, "addrConn: tryUpdateAddrs curAddr: %v, addrs: %v", ac.curAddr, addrs)
+	if ac.state == connectivity.Shutdown ||
+		ac.state == connectivity.TransientFailure ||
+		ac.state == connectivity.Idle {
+		ac.addrs = addrs
+		return true
+	}
+
+	if equalAddresses(ac.addrs, addrs) {
+		return true
+	}
+
+	if ac.state == connectivity.Connecting {
+		return false
+	}
+
+	// ac.state is Ready, try to find the connected address.
+	var curAddrFound bool
+	for _, a := range addrs {
+		a.ServerName = ac.cc.getServerName(a)
+		if reflect.DeepEqual(ac.curAddr, a) {
+			curAddrFound = true
+			break
+		}
+	}
+	channelz.Infof(logger, ac.channelzID, "addrConn: tryUpdateAddrs curAddrFound: %v", curAddrFound)
+	if curAddrFound {
+		ac.addrs = addrs
+	}
+
+	return curAddrFound
+}
+
+// getServerName determines the serverName to be used in the connection
+// handshake. The default value for the serverName is the authority on the
+// ClientConn, which either comes from the user's dial target or through an
+// authority override specified using the WithAuthority dial option. Name
+// resolvers can specify a per-address override for the serverName through the
+// resolver.Address.ServerName field which is used only if the WithAuthority
+// dial option was not used. The rationale is that per-address authority
+// overrides specified by the name resolver can represent a security risk, while
+// an override specified by the user is more dependable since they probably know
+// what they are doing.
+func (cc *ClientConn) getServerName(addr resolver.Address) string {
+	if cc.dopts.authority != "" {
+		return cc.dopts.authority
+	}
+	if addr.ServerName != "" {
+		return addr.ServerName
+	}
+	return cc.authority
+}
+
+func getMethodConfig(sc *ServiceConfig, method string) MethodConfig {
+	if sc == nil {
+		return MethodConfig{}
+	}
+	if m, ok := sc.Methods[method]; ok {
+		return m
+	}
+	i := strings.LastIndex(method, "/")
+	if m, ok := sc.Methods[method[:i+1]]; ok {
+		return m
+	}
+	return sc.Methods[""]
+}
+
+// GetMethodConfig gets the method config of the input method.
+// If there's an exact match for input method (i.e. /service/method), we return
+// the corresponding MethodConfig.
+// If there isn't an exact match for the input method, we look for the service's default
+// config under the service (i.e /service/) and then for the default for all services (empty string).
+//
+// If there is a default MethodConfig for the service, we return it.
+// Otherwise, we return an empty MethodConfig.
+func (cc *ClientConn) GetMethodConfig(method string) MethodConfig {
+	// TODO: Avoid the locking here.
+	cc.mu.RLock()
+	defer cc.mu.RUnlock()
+	return getMethodConfig(cc.sc, method)
+}
+
+func (cc *ClientConn) healthCheckConfig() *healthCheckConfig {
+	cc.mu.RLock()
+	defer cc.mu.RUnlock()
+	if cc.sc == nil {
+		return nil
+	}
+	return cc.sc.healthCheckConfig
+}
+
+func (cc *ClientConn) getTransport(ctx context.Context, failfast bool, method string) (transport.ClientTransport, balancer.PickResult, error) {
+	return cc.blockingpicker.pick(ctx, failfast, balancer.PickInfo{
+		Ctx:            ctx,
+		FullMethodName: method,
+	})
+}
+
+func (cc *ClientConn) applyServiceConfigAndBalancer(sc *ServiceConfig, configSelector iresolver.ConfigSelector, addrs []resolver.Address) {
+	if sc == nil {
+		// should never reach here.
+		return
+	}
+	cc.sc = sc
+	if configSelector != nil {
+		cc.safeConfigSelector.UpdateConfigSelector(configSelector)
+	}
+
+	if cc.sc.retryThrottling != nil {
+		newThrottler := &retryThrottler{
+			tokens: cc.sc.retryThrottling.MaxTokens,
+			max:    cc.sc.retryThrottling.MaxTokens,
+			thresh: cc.sc.retryThrottling.MaxTokens / 2,
+			ratio:  cc.sc.retryThrottling.TokenRatio,
+		}
+		cc.retryThrottler.Store(newThrottler)
+	} else {
+		cc.retryThrottler.Store((*retryThrottler)(nil))
+	}
+
+	var newBalancerName string
+	if cc.sc != nil && cc.sc.lbConfig != nil {
+		newBalancerName = cc.sc.lbConfig.name
+	} else {
+		var isGRPCLB bool
+		for _, a := range addrs {
+			if a.Type == resolver.GRPCLB {
+				isGRPCLB = true
+				break
+			}
+		}
+		if isGRPCLB {
+			newBalancerName = grpclbName
+		} else if cc.sc != nil && cc.sc.LB != nil {
+			newBalancerName = *cc.sc.LB
+		} else {
+			newBalancerName = PickFirstBalancerName
+		}
+	}
+	cc.balancerWrapper.switchTo(newBalancerName)
+}
+
+func (cc *ClientConn) resolveNow(o resolver.ResolveNowOptions) {
+	cc.mu.RLock()
+	r := cc.resolverWrapper
+	cc.mu.RUnlock()
+	if r == nil {
+		return
+	}
+	go r.resolveNow(o)
+}
+
+// ResetConnectBackoff wakes up all subchannels in transient failure and causes
+// them to attempt another connection immediately.  It also resets the backoff
+// times used for subsequent attempts regardless of the current state.
+//
+// In general, this function should not be used.  Typical service or network
+// outages result in a reasonable client reconnection strategy by default.
+// However, if a previously unavailable network becomes available, this may be
+// used to trigger an immediate reconnect.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func (cc *ClientConn) ResetConnectBackoff() {
+	cc.mu.Lock()
+	conns := cc.conns
+	cc.mu.Unlock()
+	for ac := range conns {
+		ac.resetConnectBackoff()
+	}
+}
+
+// Close tears down the ClientConn and all underlying connections.
+func (cc *ClientConn) Close() error {
+	defer cc.cancel()
+
+	cc.mu.Lock()
+	if cc.conns == nil {
+		cc.mu.Unlock()
+		return ErrClientConnClosing
+	}
+	conns := cc.conns
+	cc.conns = nil
+	cc.csMgr.updateState(connectivity.Shutdown)
+
+	rWrapper := cc.resolverWrapper
+	cc.resolverWrapper = nil
+	bWrapper := cc.balancerWrapper
+	cc.mu.Unlock()
+
+	// The order of closing matters here since the balancer wrapper assumes the
+	// picker is closed before it is closed.
+	cc.blockingpicker.close()
+	if bWrapper != nil {
+		bWrapper.close()
+	}
+	if rWrapper != nil {
+		rWrapper.close()
+	}
+
+	for ac := range conns {
+		ac.tearDown(ErrClientConnClosing)
+	}
+	ted := &channelz.TraceEventDesc{
+		Desc:     "Channel deleted",
+		Severity: channelz.CtInfo,
+	}
+	if cc.dopts.channelzParentID != nil {
+		ted.Parent = &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Nested channel(id:%d) deleted", cc.channelzID.Int()),
+			Severity: channelz.CtInfo,
+		}
+	}
+	channelz.AddTraceEvent(logger, cc.channelzID, 0, ted)
+	// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add
+	// trace reference to the entity being deleted, and thus prevent it from being
+	// deleted right away.
+	channelz.RemoveEntry(cc.channelzID)
+
+	return nil
+}
+
+// addrConn is a network connection to a given address.
+type addrConn struct {
+	ctx    context.Context
+	cancel context.CancelFunc
+
+	cc     *ClientConn
+	dopts  dialOptions
+	acbw   balancer.SubConn
+	scopts balancer.NewSubConnOptions
+
+	// transport is set when there's a viable transport (note: ac state may not be READY as LB channel
+	// health checking may require server to report healthy to set ac to READY), and is reset
+	// to nil when the current transport should no longer be used to create a stream (e.g. after GoAway
+	// is received, transport is closed, ac has been torn down).
+	transport transport.ClientTransport // The current transport.
+
+	mu      sync.Mutex
+	curAddr resolver.Address   // The current address.
+	addrs   []resolver.Address // All addresses that the resolver resolved to.
+
+	// Use updateConnectivityState for updating addrConn's connectivity state.
+	state connectivity.State
+
+	backoffIdx   int // Needs to be stateful for resetConnectBackoff.
+	resetBackoff chan struct{}
+
+	channelzID *channelz.Identifier
+	czData     *channelzData
+}
+
+// Note: this requires a lock on ac.mu.
+func (ac *addrConn) updateConnectivityState(s connectivity.State, lastErr error) {
+	if ac.state == s {
+		return
+	}
+	ac.state = s
+	if lastErr == nil {
+		channelz.Infof(logger, ac.channelzID, "Subchannel Connectivity change to %v", s)
+	} else {
+		channelz.Infof(logger, ac.channelzID, "Subchannel Connectivity change to %v, last error: %s", s, lastErr)
+	}
+	ac.cc.handleSubConnStateChange(ac.acbw, s, lastErr)
+}
+
+// adjustParams updates parameters used to create transports upon
+// receiving a GoAway.
+func (ac *addrConn) adjustParams(r transport.GoAwayReason) {
+	switch r {
+	case transport.GoAwayTooManyPings:
+		v := 2 * ac.dopts.copts.KeepaliveParams.Time
+		ac.cc.mu.Lock()
+		if v > ac.cc.mkp.Time {
+			ac.cc.mkp.Time = v
+		}
+		ac.cc.mu.Unlock()
+	}
+}
+
+func (ac *addrConn) resetTransport() {
+	ac.mu.Lock()
+	if ac.state == connectivity.Shutdown {
+		ac.mu.Unlock()
+		return
+	}
+
+	addrs := ac.addrs
+	backoffFor := ac.dopts.bs.Backoff(ac.backoffIdx)
+	// This will be the duration that dial gets to finish.
+	dialDuration := minConnectTimeout
+	if ac.dopts.minConnectTimeout != nil {
+		dialDuration = ac.dopts.minConnectTimeout()
+	}
+
+	if dialDuration < backoffFor {
+		// Give dial more time as we keep failing to connect.
+		dialDuration = backoffFor
+	}
+	// We can potentially spend all the time trying the first address, and
+	// if the server accepts the connection and then hangs, the following
+	// addresses will never be tried.
+	//
+	// The spec doesn't mention what should be done for multiple addresses.
+	// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md#proposed-backoff-algorithm
+	connectDeadline := time.Now().Add(dialDuration)
+
+	ac.updateConnectivityState(connectivity.Connecting, nil)
+	ac.mu.Unlock()
+
+	if err := ac.tryAllAddrs(addrs, connectDeadline); err != nil {
+		ac.cc.resolveNow(resolver.ResolveNowOptions{})
+		// After exhausting all addresses, the addrConn enters
+		// TRANSIENT_FAILURE.
+		ac.mu.Lock()
+		if ac.state == connectivity.Shutdown {
+			ac.mu.Unlock()
+			return
+		}
+		ac.updateConnectivityState(connectivity.TransientFailure, err)
+
+		// Backoff.
+		b := ac.resetBackoff
+		ac.mu.Unlock()
+
+		timer := time.NewTimer(backoffFor)
+		select {
+		case <-timer.C:
+			ac.mu.Lock()
+			ac.backoffIdx++
+			ac.mu.Unlock()
+		case <-b:
+			timer.Stop()
+		case <-ac.ctx.Done():
+			timer.Stop()
+			return
+		}
+
+		ac.mu.Lock()
+		if ac.state != connectivity.Shutdown {
+			ac.updateConnectivityState(connectivity.Idle, err)
+		}
+		ac.mu.Unlock()
+		return
+	}
+	// Success; reset backoff.
+	ac.mu.Lock()
+	ac.backoffIdx = 0
+	ac.mu.Unlock()
+}
+
+// tryAllAddrs tries to creates a connection to the addresses, and stop when at
+// the first successful one. It returns an error if no address was successfully
+// connected, or updates ac appropriately with the new transport.
+func (ac *addrConn) tryAllAddrs(addrs []resolver.Address, connectDeadline time.Time) error {
+	var firstConnErr error
+	for _, addr := range addrs {
+		ac.mu.Lock()
+		if ac.state == connectivity.Shutdown {
+			ac.mu.Unlock()
+			return errConnClosing
+		}
+
+		ac.cc.mu.RLock()
+		ac.dopts.copts.KeepaliveParams = ac.cc.mkp
+		ac.cc.mu.RUnlock()
+
+		copts := ac.dopts.copts
+		if ac.scopts.CredsBundle != nil {
+			copts.CredsBundle = ac.scopts.CredsBundle
+		}
+		ac.mu.Unlock()
+
+		channelz.Infof(logger, ac.channelzID, "Subchannel picks a new address %q to connect", addr.Addr)
+
+		err := ac.createTransport(addr, copts, connectDeadline)
+		if err == nil {
+			return nil
+		}
+		if firstConnErr == nil {
+			firstConnErr = err
+		}
+		ac.cc.updateConnectionError(err)
+	}
+
+	// Couldn't connect to any address.
+	return firstConnErr
+}
+
+// createTransport creates a connection to addr. It returns an error if the
+// address was not successfully connected, or updates ac appropriately with the
+// new transport.
+func (ac *addrConn) createTransport(addr resolver.Address, copts transport.ConnectOptions, connectDeadline time.Time) error {
+	addr.ServerName = ac.cc.getServerName(addr)
+	hctx, hcancel := context.WithCancel(ac.ctx)
+
+	onClose := func(r transport.GoAwayReason) {
+		ac.mu.Lock()
+		defer ac.mu.Unlock()
+		// adjust params based on GoAwayReason
+		ac.adjustParams(r)
+		if ac.state == connectivity.Shutdown {
+			// Already shut down.  tearDown() already cleared the transport and
+			// canceled hctx via ac.ctx, and we expected this connection to be
+			// closed, so do nothing here.
+			return
+		}
+		hcancel()
+		if ac.transport == nil {
+			// We're still connecting to this address, which could error.  Do
+			// not update the connectivity state or resolve; these will happen
+			// at the end of the tryAllAddrs connection loop in the event of an
+			// error.
+			return
+		}
+		ac.transport = nil
+		// Refresh the name resolver on any connection loss.
+		ac.cc.resolveNow(resolver.ResolveNowOptions{})
+		// Always go idle and wait for the LB policy to initiate a new
+		// connection attempt.
+		ac.updateConnectivityState(connectivity.Idle, nil)
+	}
+
+	connectCtx, cancel := context.WithDeadline(ac.ctx, connectDeadline)
+	defer cancel()
+	copts.ChannelzParentID = ac.channelzID
+
+	newTr, err := transport.NewClientTransport(connectCtx, ac.cc.ctx, addr, copts, onClose)
+	if err != nil {
+		if logger.V(2) {
+			logger.Infof("Creating new client transport to %q: %v", addr, err)
+		}
+		// newTr is either nil, or closed.
+		hcancel()
+		channelz.Warningf(logger, ac.channelzID, "grpc: addrConn.createTransport failed to connect to %s. Err: %v", addr, err)
+		return err
+	}
+
+	ac.mu.Lock()
+	defer ac.mu.Unlock()
+	if ac.state == connectivity.Shutdown {
+		// This can happen if the subConn was removed while in `Connecting`
+		// state. tearDown() would have set the state to `Shutdown`, but
+		// would not have closed the transport since ac.transport would not
+		// have been set at that point.
+		//
+		// We run this in a goroutine because newTr.Close() calls onClose()
+		// inline, which requires locking ac.mu.
+		//
+		// The error we pass to Close() is immaterial since there are no open
+		// streams at this point, so no trailers with error details will be sent
+		// out. We just need to pass a non-nil error.
+		go newTr.Close(transport.ErrConnClosing)
+		return nil
+	}
+	if hctx.Err() != nil {
+		// onClose was already called for this connection, but the connection
+		// was successfully established first.  Consider it a success and set
+		// the new state to Idle.
+		ac.updateConnectivityState(connectivity.Idle, nil)
+		return nil
+	}
+	ac.curAddr = addr
+	ac.transport = newTr
+	ac.startHealthCheck(hctx) // Will set state to READY if appropriate.
+	return nil
+}
+
+// startHealthCheck starts the health checking stream (RPC) to watch the health
+// stats of this connection if health checking is requested and configured.
+//
+// LB channel health checking is enabled when all requirements below are met:
+// 1. it is not disabled by the user with the WithDisableHealthCheck DialOption
+// 2. internal.HealthCheckFunc is set by importing the grpc/health package
+// 3. a service config with non-empty healthCheckConfig field is provided
+// 4. the load balancer requests it
+//
+// It sets addrConn to READY if the health checking stream is not started.
+//
+// Caller must hold ac.mu.
+func (ac *addrConn) startHealthCheck(ctx context.Context) {
+	var healthcheckManagingState bool
+	defer func() {
+		if !healthcheckManagingState {
+			ac.updateConnectivityState(connectivity.Ready, nil)
+		}
+	}()
+
+	if ac.cc.dopts.disableHealthCheck {
+		return
+	}
+	healthCheckConfig := ac.cc.healthCheckConfig()
+	if healthCheckConfig == nil {
+		return
+	}
+	if !ac.scopts.HealthCheckEnabled {
+		return
+	}
+	healthCheckFunc := ac.cc.dopts.healthCheckFunc
+	if healthCheckFunc == nil {
+		// The health package is not imported to set health check function.
+		//
+		// TODO: add a link to the health check doc in the error message.
+		channelz.Error(logger, ac.channelzID, "Health check is requested but health check function is not set.")
+		return
+	}
+
+	healthcheckManagingState = true
+
+	// Set up the health check helper functions.
+	currentTr := ac.transport
+	newStream := func(method string) (interface{}, error) {
+		ac.mu.Lock()
+		if ac.transport != currentTr {
+			ac.mu.Unlock()
+			return nil, status.Error(codes.Canceled, "the provided transport is no longer valid to use")
+		}
+		ac.mu.Unlock()
+		return newNonRetryClientStream(ctx, &StreamDesc{ServerStreams: true}, method, currentTr, ac)
+	}
+	setConnectivityState := func(s connectivity.State, lastErr error) {
+		ac.mu.Lock()
+		defer ac.mu.Unlock()
+		if ac.transport != currentTr {
+			return
+		}
+		ac.updateConnectivityState(s, lastErr)
+	}
+	// Start the health checking stream.
+	go func() {
+		err := ac.cc.dopts.healthCheckFunc(ctx, newStream, setConnectivityState, healthCheckConfig.ServiceName)
+		if err != nil {
+			if status.Code(err) == codes.Unimplemented {
+				channelz.Error(logger, ac.channelzID, "Subchannel health check is unimplemented at server side, thus health check is disabled")
+			} else {
+				channelz.Errorf(logger, ac.channelzID, "Health checking failed: %v", err)
+			}
+		}
+	}()
+}
+
+func (ac *addrConn) resetConnectBackoff() {
+	ac.mu.Lock()
+	close(ac.resetBackoff)
+	ac.backoffIdx = 0
+	ac.resetBackoff = make(chan struct{})
+	ac.mu.Unlock()
+}
+
+// getReadyTransport returns the transport if ac's state is READY or nil if not.
+func (ac *addrConn) getReadyTransport() transport.ClientTransport {
+	ac.mu.Lock()
+	defer ac.mu.Unlock()
+	if ac.state == connectivity.Ready {
+		return ac.transport
+	}
+	return nil
+}
+
+// tearDown starts to tear down the addrConn.
+//
+// Note that tearDown doesn't remove ac from ac.cc.conns, so the addrConn struct
+// will leak. In most cases, call cc.removeAddrConn() instead.
+func (ac *addrConn) tearDown(err error) {
+	ac.mu.Lock()
+	if ac.state == connectivity.Shutdown {
+		ac.mu.Unlock()
+		return
+	}
+	curTr := ac.transport
+	ac.transport = nil
+	// We have to set the state to Shutdown before anything else to prevent races
+	// between setting the state and logic that waits on context cancellation / etc.
+	ac.updateConnectivityState(connectivity.Shutdown, nil)
+	ac.cancel()
+	ac.curAddr = resolver.Address{}
+	if err == errConnDrain && curTr != nil {
+		// GracefulClose(...) may be executed multiple times when
+		// i) receiving multiple GoAway frames from the server; or
+		// ii) there are concurrent name resolver/Balancer triggered
+		// address removal and GoAway.
+		// We have to unlock and re-lock here because GracefulClose => Close => onClose, which requires locking ac.mu.
+		ac.mu.Unlock()
+		curTr.GracefulClose()
+		ac.mu.Lock()
+	}
+	channelz.AddTraceEvent(logger, ac.channelzID, 0, &channelz.TraceEventDesc{
+		Desc:     "Subchannel deleted",
+		Severity: channelz.CtInfo,
+		Parent: &channelz.TraceEventDesc{
+			Desc:     fmt.Sprintf("Subchannel(id:%d) deleted", ac.channelzID.Int()),
+			Severity: channelz.CtInfo,
+		},
+	})
+	// TraceEvent needs to be called before RemoveEntry, as TraceEvent may add
+	// trace reference to the entity being deleted, and thus prevent it from
+	// being deleted right away.
+	channelz.RemoveEntry(ac.channelzID)
+	ac.mu.Unlock()
+}
+
+func (ac *addrConn) getState() connectivity.State {
+	ac.mu.Lock()
+	defer ac.mu.Unlock()
+	return ac.state
+}
+
+func (ac *addrConn) ChannelzMetric() *channelz.ChannelInternalMetric {
+	ac.mu.Lock()
+	addr := ac.curAddr.Addr
+	ac.mu.Unlock()
+	return &channelz.ChannelInternalMetric{
+		State:                    ac.getState(),
+		Target:                   addr,
+		CallsStarted:             atomic.LoadInt64(&ac.czData.callsStarted),
+		CallsSucceeded:           atomic.LoadInt64(&ac.czData.callsSucceeded),
+		CallsFailed:              atomic.LoadInt64(&ac.czData.callsFailed),
+		LastCallStartedTimestamp: time.Unix(0, atomic.LoadInt64(&ac.czData.lastCallStartedTime)),
+	}
+}
+
+func (ac *addrConn) incrCallsStarted() {
+	atomic.AddInt64(&ac.czData.callsStarted, 1)
+	atomic.StoreInt64(&ac.czData.lastCallStartedTime, time.Now().UnixNano())
+}
+
+func (ac *addrConn) incrCallsSucceeded() {
+	atomic.AddInt64(&ac.czData.callsSucceeded, 1)
+}
+
+func (ac *addrConn) incrCallsFailed() {
+	atomic.AddInt64(&ac.czData.callsFailed, 1)
+}
+
+type retryThrottler struct {
+	max    float64
+	thresh float64
+	ratio  float64
+
+	mu     sync.Mutex
+	tokens float64 // TODO(dfawley): replace with atomic and remove lock.
+}
+
+// throttle subtracts a retry token from the pool and returns whether a retry
+// should be throttled (disallowed) based upon the retry throttling policy in
+// the service config.
+func (rt *retryThrottler) throttle() bool {
+	if rt == nil {
+		return false
+	}
+	rt.mu.Lock()
+	defer rt.mu.Unlock()
+	rt.tokens--
+	if rt.tokens < 0 {
+		rt.tokens = 0
+	}
+	return rt.tokens <= rt.thresh
+}
+
+func (rt *retryThrottler) successfulRPC() {
+	if rt == nil {
+		return
+	}
+	rt.mu.Lock()
+	defer rt.mu.Unlock()
+	rt.tokens += rt.ratio
+	if rt.tokens > rt.max {
+		rt.tokens = rt.max
+	}
+}
+
+type channelzChannel struct {
+	cc *ClientConn
+}
+
+func (c *channelzChannel) ChannelzMetric() *channelz.ChannelInternalMetric {
+	return c.cc.channelzMetric()
+}
+
+// ErrClientConnTimeout indicates that the ClientConn cannot establish the
+// underlying connections within the specified timeout.
+//
+// Deprecated: This error is never returned by grpc and should not be
+// referenced by users.
+var ErrClientConnTimeout = errors.New("grpc: timed out when dialing")
+
+// getResolver finds the scheme in the cc's resolvers or the global registry.
+// scheme should always be lowercase (typically by virtue of url.Parse()
+// performing proper RFC3986 behavior).
+func (cc *ClientConn) getResolver(scheme string) resolver.Builder {
+	for _, rb := range cc.dopts.resolvers {
+		if scheme == rb.Scheme() {
+			return rb
+		}
+	}
+	return resolver.Get(scheme)
+}
+
+func (cc *ClientConn) updateConnectionError(err error) {
+	cc.lceMu.Lock()
+	cc.lastConnectionError = err
+	cc.lceMu.Unlock()
+}
+
+func (cc *ClientConn) connectionError() error {
+	cc.lceMu.Lock()
+	defer cc.lceMu.Unlock()
+	return cc.lastConnectionError
+}
+
+func (cc *ClientConn) parseTargetAndFindResolver() (resolver.Builder, error) {
+	channelz.Infof(logger, cc.channelzID, "original dial target is: %q", cc.target)
+
+	var rb resolver.Builder
+	parsedTarget, err := parseTarget(cc.target)
+	if err != nil {
+		channelz.Infof(logger, cc.channelzID, "dial target %q parse failed: %v", cc.target, err)
+	} else {
+		channelz.Infof(logger, cc.channelzID, "parsed dial target is: %+v", parsedTarget)
+		rb = cc.getResolver(parsedTarget.URL.Scheme)
+		if rb != nil {
+			cc.parsedTarget = parsedTarget
+			return rb, nil
+		}
+	}
+
+	// We are here because the user's dial target did not contain a scheme or
+	// specified an unregistered scheme. We should fallback to the default
+	// scheme, except when a custom dialer is specified in which case, we should
+	// always use passthrough scheme.
+	defScheme := resolver.GetDefaultScheme()
+	channelz.Infof(logger, cc.channelzID, "fallback to scheme %q", defScheme)
+	canonicalTarget := defScheme + ":///" + cc.target
+
+	parsedTarget, err = parseTarget(canonicalTarget)
+	if err != nil {
+		channelz.Infof(logger, cc.channelzID, "dial target %q parse failed: %v", canonicalTarget, err)
+		return nil, err
+	}
+	channelz.Infof(logger, cc.channelzID, "parsed dial target is: %+v", parsedTarget)
+	rb = cc.getResolver(parsedTarget.URL.Scheme)
+	if rb == nil {
+		return nil, fmt.Errorf("could not get resolver for default scheme: %q", parsedTarget.URL.Scheme)
+	}
+	cc.parsedTarget = parsedTarget
+	return rb, nil
+}
+
+// parseTarget uses RFC 3986 semantics to parse the given target into a
+// resolver.Target struct containing scheme, authority and url. Query
+// params are stripped from the endpoint.
+func parseTarget(target string) (resolver.Target, error) {
+	u, err := url.Parse(target)
+	if err != nil {
+		return resolver.Target{}, err
+	}
+
+	return resolver.Target{
+		Scheme:    u.Scheme,
+		Authority: u.Host,
+		URL:       *u,
+	}, nil
+}
+
+// Determine channel authority. The order of precedence is as follows:
+// - user specified authority override using `WithAuthority` dial option
+// - creds' notion of server name for the authentication handshake
+// - endpoint from dial target of the form "scheme://[authority]/endpoint"
+func determineAuthority(endpoint, target string, dopts dialOptions) (string, error) {
+	// Historically, we had two options for users to specify the serverName or
+	// authority for a channel. One was through the transport credentials
+	// (either in its constructor, or through the OverrideServerName() method).
+	// The other option (for cases where WithInsecure() dial option was used)
+	// was to use the WithAuthority() dial option.
+	//
+	// A few things have changed since:
+	// - `insecure` package with an implementation of the `TransportCredentials`
+	//   interface for the insecure case
+	// - WithAuthority() dial option support for secure credentials
+	authorityFromCreds := ""
+	if creds := dopts.copts.TransportCredentials; creds != nil && creds.Info().ServerName != "" {
+		authorityFromCreds = creds.Info().ServerName
+	}
+	authorityFromDialOption := dopts.authority
+	if (authorityFromCreds != "" && authorityFromDialOption != "") && authorityFromCreds != authorityFromDialOption {
+		return "", fmt.Errorf("ClientConn's authority from transport creds %q and dial option %q don't match", authorityFromCreds, authorityFromDialOption)
+	}
+
+	switch {
+	case authorityFromDialOption != "":
+		return authorityFromDialOption, nil
+	case authorityFromCreds != "":
+		return authorityFromCreds, nil
+	case strings.HasPrefix(target, "unix:") || strings.HasPrefix(target, "unix-abstract:"):
+		// TODO: remove when the unix resolver implements optional interface to
+		// return channel authority.
+		return "localhost", nil
+	case strings.HasPrefix(endpoint, ":"):
+		return "localhost" + endpoint, nil
+	default:
+		// TODO: Define an optional interface on the resolver builder to return
+		// the channel authority given the user's dial target. For resolvers
+		// which don't implement this interface, we will use the endpoint from
+		// "scheme://authority/endpoint" as the default authority.
+		return endpoint, nil
+	}
+}
diff --git a/vendor/google.golang.org/grpc/codec.go b/vendor/google.golang.org/grpc/codec.go
new file mode 100644
index 0000000000..1297765478
--- /dev/null
+++ b/vendor/google.golang.org/grpc/codec.go
@@ -0,0 +1,50 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"google.golang.org/grpc/encoding"
+	_ "google.golang.org/grpc/encoding/proto" // to register the Codec for "proto"
+)
+
+// baseCodec contains the functionality of both Codec and encoding.Codec, but
+// omits the name/string, which vary between the two and are not needed for
+// anything besides the registry in the encoding package.
+type baseCodec interface {
+	Marshal(v interface{}) ([]byte, error)
+	Unmarshal(data []byte, v interface{}) error
+}
+
+var _ baseCodec = Codec(nil)
+var _ baseCodec = encoding.Codec(nil)
+
+// Codec defines the interface gRPC uses to encode and decode messages.
+// Note that implementations of this interface must be thread safe;
+// a Codec's methods can be called from concurrent goroutines.
+//
+// Deprecated: use encoding.Codec instead.
+type Codec interface {
+	// Marshal returns the wire format of v.
+	Marshal(v interface{}) ([]byte, error)
+	// Unmarshal parses the wire format into v.
+	Unmarshal(data []byte, v interface{}) error
+	// String returns the name of the Codec implementation.  This is unused by
+	// gRPC.
+	String() string
+}
diff --git a/vendor/google.golang.org/grpc/codegen.sh b/vendor/google.golang.org/grpc/codegen.sh
new file mode 100644
index 0000000000..4cdc6ba7c0
--- /dev/null
+++ b/vendor/google.golang.org/grpc/codegen.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+# This script serves as an example to demonstrate how to generate the gRPC-Go
+# interface and the related messages from .proto file.
+#
+# It assumes the installation of i) Google proto buffer compiler at
+# https://github.com/google/protobuf (after v2.6.1) and ii) the Go codegen
+# plugin at https://github.com/golang/protobuf (after 2015-02-20). If you have
+# not, please install them first.
+#
+# We recommend running this script at $GOPATH/src.
+#
+# If this is not what you need, feel free to make your own scripts. Again, this
+# script is for demonstration purpose.
+#
+proto=$1
+protoc --go_out=plugins=grpc:. $proto
diff --git a/vendor/google.golang.org/grpc/codes/code_string.go b/vendor/google.golang.org/grpc/codes/code_string.go
new file mode 100644
index 0000000000..934fac2b09
--- /dev/null
+++ b/vendor/google.golang.org/grpc/codes/code_string.go
@@ -0,0 +1,111 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package codes
+
+import (
+	"strconv"
+
+	"google.golang.org/grpc/internal"
+)
+
+func init() {
+	internal.CanonicalString = canonicalString
+}
+
+func (c Code) String() string {
+	switch c {
+	case OK:
+		return "OK"
+	case Canceled:
+		return "Canceled"
+	case Unknown:
+		return "Unknown"
+	case InvalidArgument:
+		return "InvalidArgument"
+	case DeadlineExceeded:
+		return "DeadlineExceeded"
+	case NotFound:
+		return "NotFound"
+	case AlreadyExists:
+		return "AlreadyExists"
+	case PermissionDenied:
+		return "PermissionDenied"
+	case ResourceExhausted:
+		return "ResourceExhausted"
+	case FailedPrecondition:
+		return "FailedPrecondition"
+	case Aborted:
+		return "Aborted"
+	case OutOfRange:
+		return "OutOfRange"
+	case Unimplemented:
+		return "Unimplemented"
+	case Internal:
+		return "Internal"
+	case Unavailable:
+		return "Unavailable"
+	case DataLoss:
+		return "DataLoss"
+	case Unauthenticated:
+		return "Unauthenticated"
+	default:
+		return "Code(" + strconv.FormatInt(int64(c), 10) + ")"
+	}
+}
+
+func canonicalString(c Code) string {
+	switch c {
+	case OK:
+		return "OK"
+	case Canceled:
+		return "CANCELLED"
+	case Unknown:
+		return "UNKNOWN"
+	case InvalidArgument:
+		return "INVALID_ARGUMENT"
+	case DeadlineExceeded:
+		return "DEADLINE_EXCEEDED"
+	case NotFound:
+		return "NOT_FOUND"
+	case AlreadyExists:
+		return "ALREADY_EXISTS"
+	case PermissionDenied:
+		return "PERMISSION_DENIED"
+	case ResourceExhausted:
+		return "RESOURCE_EXHAUSTED"
+	case FailedPrecondition:
+		return "FAILED_PRECONDITION"
+	case Aborted:
+		return "ABORTED"
+	case OutOfRange:
+		return "OUT_OF_RANGE"
+	case Unimplemented:
+		return "UNIMPLEMENTED"
+	case Internal:
+		return "INTERNAL"
+	case Unavailable:
+		return "UNAVAILABLE"
+	case DataLoss:
+		return "DATA_LOSS"
+	case Unauthenticated:
+		return "UNAUTHENTICATED"
+	default:
+		return "CODE(" + strconv.FormatInt(int64(c), 10) + ")"
+	}
+}
diff --git a/vendor/google.golang.org/grpc/codes/codes.go b/vendor/google.golang.org/grpc/codes/codes.go
new file mode 100644
index 0000000000..11b106182d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/codes/codes.go
@@ -0,0 +1,244 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package codes defines the canonical error codes used by gRPC. It is
+// consistent across various languages.
+package codes // import "google.golang.org/grpc/codes"
+
+import (
+	"fmt"
+	"strconv"
+)
+
+// A Code is an unsigned 32-bit error code as defined in the gRPC spec.
+type Code uint32
+
+const (
+	// OK is returned on success.
+	OK Code = 0
+
+	// Canceled indicates the operation was canceled (typically by the caller).
+	//
+	// The gRPC framework will generate this error code when cancellation
+	// is requested.
+	Canceled Code = 1
+
+	// Unknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// The gRPC framework will generate this error code in the above two
+	// mentioned cases.
+	Unknown Code = 2
+
+	// InvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	InvalidArgument Code = 3
+
+	// DeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	DeadlineExceeded Code = 4
+
+	// NotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	NotFound Code = 5
+
+	// AlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	AlreadyExists Code = 6
+
+	// PermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	PermissionDenied Code = 7
+
+	// ResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ResourceExhausted Code = 8
+
+	// FailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//  (a) Use Unavailable if the client can retry just the failing call.
+	//  (b) Use Aborted if the client should retry at a higher-level
+	//      (e.g., restarting a read-modify-write sequence).
+	//  (c) Use FailedPrecondition if the client should not retry until
+	//      the system state has been explicitly fixed. E.g., if an "rmdir"
+	//      fails because the directory is non-empty, FailedPrecondition
+	//      should be returned since the client should not retry unless
+	//      they have first fixed up the directory by deleting files from it.
+	//  (d) Use FailedPrecondition if the client performs conditional
+	//      REST Get/Update/Delete on a resource and the resource on the
+	//      server does not match the condition. E.g., conflicting
+	//      read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	FailedPrecondition Code = 9
+
+	// Aborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	//
+	// This error code will not be generated by the gRPC framework.
+	Aborted Code = 10
+
+	// OutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// system will generate InvalidArgument if asked to read at an
+	// offset that is not in the range [0,2^32-1], but it will generate
+	// OutOfRange if asked to read from an offset past the current
+	// file size.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// OutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	OutOfRange Code = 11
+
+	// Unimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This error code will be generated by the gRPC framework. Most
+	// commonly, you will see this error code when a method implementation
+	// is missing on the server. It can also be generated for unknown
+	// compression algorithms or a disagreement as to whether an RPC should
+	// be streaming.
+	Unimplemented Code = 12
+
+	// Internal errors. Means some invariants expected by underlying
+	// system has been broken. If you see one of these errors,
+	// something is very broken.
+	//
+	// This error code will be generated by the gRPC framework in several
+	// internal error conditions.
+	Internal Code = 13
+
+	// Unavailable indicates the service is currently unavailable.
+	// This is a most likely a transient condition and may be corrected
+	// by retrying with a backoff. Note that it is not always safe to retry
+	// non-idempotent operations.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	//
+	// This error code will be generated by the gRPC framework during
+	// abrupt shutdown of a server process or network connection.
+	Unavailable Code = 14
+
+	// DataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code will not be generated by the gRPC framework.
+	DataLoss Code = 15
+
+	// Unauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	Unauthenticated Code = 16
+
+	_maxCode = 17
+)
+
+var strToCode = map[string]Code{
+	`"OK"`: OK,
+	`"CANCELLED"`:/* [sic] */ Canceled,
+	`"UNKNOWN"`:             Unknown,
+	`"INVALID_ARGUMENT"`:    InvalidArgument,
+	`"DEADLINE_EXCEEDED"`:   DeadlineExceeded,
+	`"NOT_FOUND"`:           NotFound,
+	`"ALREADY_EXISTS"`:      AlreadyExists,
+	`"PERMISSION_DENIED"`:   PermissionDenied,
+	`"RESOURCE_EXHAUSTED"`:  ResourceExhausted,
+	`"FAILED_PRECONDITION"`: FailedPrecondition,
+	`"ABORTED"`:             Aborted,
+	`"OUT_OF_RANGE"`:        OutOfRange,
+	`"UNIMPLEMENTED"`:       Unimplemented,
+	`"INTERNAL"`:            Internal,
+	`"UNAVAILABLE"`:         Unavailable,
+	`"DATA_LOSS"`:           DataLoss,
+	`"UNAUTHENTICATED"`:     Unauthenticated,
+}
+
+// UnmarshalJSON unmarshals b into the Code.
+func (c *Code) UnmarshalJSON(b []byte) error {
+	// From json.Unmarshaler: By convention, to approximate the behavior of
+	// Unmarshal itself, Unmarshalers implement UnmarshalJSON([]byte("null")) as
+	// a no-op.
+	if string(b) == "null" {
+		return nil
+	}
+	if c == nil {
+		return fmt.Errorf("nil receiver passed to UnmarshalJSON")
+	}
+
+	if ci, err := strconv.ParseUint(string(b), 10, 32); err == nil {
+		if ci >= _maxCode {
+			return fmt.Errorf("invalid code: %q", ci)
+		}
+
+		*c = Code(ci)
+		return nil
+	}
+
+	if jc, ok := strToCode[string(b)]; ok {
+		*c = jc
+		return nil
+	}
+	return fmt.Errorf("invalid code: %q", string(b))
+}
diff --git a/vendor/google.golang.org/grpc/connectivity/connectivity.go b/vendor/google.golang.org/grpc/connectivity/connectivity.go
new file mode 100644
index 0000000000..4a89926422
--- /dev/null
+++ b/vendor/google.golang.org/grpc/connectivity/connectivity.go
@@ -0,0 +1,94 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package connectivity defines connectivity semantics.
+// For details, see https://github.com/grpc/grpc/blob/master/doc/connectivity-semantics-and-api.md.
+package connectivity
+
+import (
+	"google.golang.org/grpc/grpclog"
+)
+
+var logger = grpclog.Component("core")
+
+// State indicates the state of connectivity.
+// It can be the state of a ClientConn or SubConn.
+type State int
+
+func (s State) String() string {
+	switch s {
+	case Idle:
+		return "IDLE"
+	case Connecting:
+		return "CONNECTING"
+	case Ready:
+		return "READY"
+	case TransientFailure:
+		return "TRANSIENT_FAILURE"
+	case Shutdown:
+		return "SHUTDOWN"
+	default:
+		logger.Errorf("unknown connectivity state: %d", s)
+		return "INVALID_STATE"
+	}
+}
+
+const (
+	// Idle indicates the ClientConn is idle.
+	Idle State = iota
+	// Connecting indicates the ClientConn is connecting.
+	Connecting
+	// Ready indicates the ClientConn is ready for work.
+	Ready
+	// TransientFailure indicates the ClientConn has seen a failure but expects to recover.
+	TransientFailure
+	// Shutdown indicates the ClientConn has started shutting down.
+	Shutdown
+)
+
+// ServingMode indicates the current mode of operation of the server.
+//
+// Only xDS enabled gRPC servers currently report their serving mode.
+type ServingMode int
+
+const (
+	// ServingModeStarting indicates that the server is starting up.
+	ServingModeStarting ServingMode = iota
+	// ServingModeServing indicates that the server contains all required
+	// configuration and is serving RPCs.
+	ServingModeServing
+	// ServingModeNotServing indicates that the server is not accepting new
+	// connections. Existing connections will be closed gracefully, allowing
+	// in-progress RPCs to complete. A server enters this mode when it does not
+	// contain the required configuration to serve RPCs.
+	ServingModeNotServing
+)
+
+func (s ServingMode) String() string {
+	switch s {
+	case ServingModeStarting:
+		return "STARTING"
+	case ServingModeServing:
+		return "SERVING"
+	case ServingModeNotServing:
+		return "NOT_SERVING"
+	default:
+		logger.Errorf("unknown serving mode: %d", s)
+		return "INVALID_MODE"
+	}
+}
diff --git a/vendor/google.golang.org/grpc/credentials/credentials.go b/vendor/google.golang.org/grpc/credentials/credentials.go
new file mode 100644
index 0000000000..5feac3aa0e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/credentials/credentials.go
@@ -0,0 +1,291 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package credentials implements various credentials supported by gRPC library,
+// which encapsulate all the state needed by a client to authenticate with a
+// server and make various assertions, e.g., about the client's identity, role,
+// or whether it is authorized to make a particular call.
+package credentials // import "google.golang.org/grpc/credentials"
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+
+	"github.com/golang/protobuf/proto"
+	"google.golang.org/grpc/attributes"
+	icredentials "google.golang.org/grpc/internal/credentials"
+)
+
+// PerRPCCredentials defines the common interface for the credentials which need to
+// attach security information to every RPC (e.g., oauth2).
+type PerRPCCredentials interface {
+	// GetRequestMetadata gets the current request metadata, refreshing tokens
+	// if required. This should be called by the transport layer on each
+	// request, and the data should be populated in headers or other
+	// context. If a status code is returned, it will be used as the status for
+	// the RPC (restricted to an allowable set of codes as defined by gRFC
+	// A54). uri is the URI of the entry point for the request.  When supported
+	// by the underlying implementation, ctx can be used for timeout and
+	// cancellation. Additionally, RequestInfo data will be available via ctx
+	// to this call.  TODO(zhaoq): Define the set of the qualified keys instead
+	// of leaving it as an arbitrary string.
+	GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)
+	// RequireTransportSecurity indicates whether the credentials requires
+	// transport security.
+	RequireTransportSecurity() bool
+}
+
+// SecurityLevel defines the protection level on an established connection.
+//
+// This API is experimental.
+type SecurityLevel int
+
+const (
+	// InvalidSecurityLevel indicates an invalid security level.
+	// The zero SecurityLevel value is invalid for backward compatibility.
+	InvalidSecurityLevel SecurityLevel = iota
+	// NoSecurity indicates a connection is insecure.
+	NoSecurity
+	// IntegrityOnly indicates a connection only provides integrity protection.
+	IntegrityOnly
+	// PrivacyAndIntegrity indicates a connection provides both privacy and integrity protection.
+	PrivacyAndIntegrity
+)
+
+// String returns SecurityLevel in a string format.
+func (s SecurityLevel) String() string {
+	switch s {
+	case NoSecurity:
+		return "NoSecurity"
+	case IntegrityOnly:
+		return "IntegrityOnly"
+	case PrivacyAndIntegrity:
+		return "PrivacyAndIntegrity"
+	}
+	return fmt.Sprintf("invalid SecurityLevel: %v", int(s))
+}
+
+// CommonAuthInfo contains authenticated information common to AuthInfo implementations.
+// It should be embedded in a struct implementing AuthInfo to provide additional information
+// about the credentials.
+//
+// This API is experimental.
+type CommonAuthInfo struct {
+	SecurityLevel SecurityLevel
+}
+
+// GetCommonAuthInfo returns the pointer to CommonAuthInfo struct.
+func (c CommonAuthInfo) GetCommonAuthInfo() CommonAuthInfo {
+	return c
+}
+
+// ProtocolInfo provides information regarding the gRPC wire protocol version,
+// security protocol, security protocol version in use, server name, etc.
+type ProtocolInfo struct {
+	// ProtocolVersion is the gRPC wire protocol version.
+	ProtocolVersion string
+	// SecurityProtocol is the security protocol in use.
+	SecurityProtocol string
+	// SecurityVersion is the security protocol version.  It is a static version string from the
+	// credentials, not a value that reflects per-connection protocol negotiation.  To retrieve
+	// details about the credentials used for a connection, use the Peer's AuthInfo field instead.
+	//
+	// Deprecated: please use Peer.AuthInfo.
+	SecurityVersion string
+	// ServerName is the user-configured server name.
+	ServerName string
+}
+
+// AuthInfo defines the common interface for the auth information the users are interested in.
+// A struct that implements AuthInfo should embed CommonAuthInfo by including additional
+// information about the credentials in it.
+type AuthInfo interface {
+	AuthType() string
+}
+
+// ErrConnDispatched indicates that rawConn has been dispatched out of gRPC
+// and the caller should not close rawConn.
+var ErrConnDispatched = errors.New("credentials: rawConn is dispatched out of gRPC")
+
+// TransportCredentials defines the common interface for all the live gRPC wire
+// protocols and supported transport security protocols (e.g., TLS, SSL).
+type TransportCredentials interface {
+	// ClientHandshake does the authentication handshake specified by the
+	// corresponding authentication protocol on rawConn for clients. It returns
+	// the authenticated connection and the corresponding auth information
+	// about the connection.  The auth information should embed CommonAuthInfo
+	// to return additional information about the credentials. Implementations
+	// must use the provided context to implement timely cancellation.  gRPC
+	// will try to reconnect if the error returned is a temporary error
+	// (io.EOF, context.DeadlineExceeded or err.Temporary() == true).  If the
+	// returned error is a wrapper error, implementations should make sure that
+	// the error implements Temporary() to have the correct retry behaviors.
+	// Additionally, ClientHandshakeInfo data will be available via the context
+	// passed to this call.
+	//
+	// The second argument to this method is the `:authority` header value used
+	// while creating new streams on this connection after authentication
+	// succeeds. Implementations must use this as the server name during the
+	// authentication handshake.
+	//
+	// If the returned net.Conn is closed, it MUST close the net.Conn provided.
+	ClientHandshake(context.Context, string, net.Conn) (net.Conn, AuthInfo, error)
+	// ServerHandshake does the authentication handshake for servers. It returns
+	// the authenticated connection and the corresponding auth information about
+	// the connection. The auth information should embed CommonAuthInfo to return additional information
+	// about the credentials.
+	//
+	// If the returned net.Conn is closed, it MUST close the net.Conn provided.
+	ServerHandshake(net.Conn) (net.Conn, AuthInfo, error)
+	// Info provides the ProtocolInfo of this TransportCredentials.
+	Info() ProtocolInfo
+	// Clone makes a copy of this TransportCredentials.
+	Clone() TransportCredentials
+	// OverrideServerName specifies the value used for the following:
+	// - verifying the hostname on the returned certificates
+	// - as SNI in the client's handshake to support virtual hosting
+	// - as the value for `:authority` header at stream creation time
+	//
+	// Deprecated: use grpc.WithAuthority instead. Will be supported
+	// throughout 1.x.
+	OverrideServerName(string) error
+}
+
+// Bundle is a combination of TransportCredentials and PerRPCCredentials.
+//
+// It also contains a mode switching method, so it can be used as a combination
+// of different credential policies.
+//
+// Bundle cannot be used together with individual TransportCredentials.
+// PerRPCCredentials from Bundle will be appended to other PerRPCCredentials.
+//
+// This API is experimental.
+type Bundle interface {
+	// TransportCredentials returns the transport credentials from the Bundle.
+	//
+	// Implementations must return non-nil transport credentials. If transport
+	// security is not needed by the Bundle, implementations may choose to
+	// return insecure.NewCredentials().
+	TransportCredentials() TransportCredentials
+
+	// PerRPCCredentials returns the per-RPC credentials from the Bundle.
+	//
+	// May be nil if per-RPC credentials are not needed.
+	PerRPCCredentials() PerRPCCredentials
+
+	// NewWithMode should make a copy of Bundle, and switch mode. Modifying the
+	// existing Bundle may cause races.
+	//
+	// NewWithMode returns nil if the requested mode is not supported.
+	NewWithMode(mode string) (Bundle, error)
+}
+
+// RequestInfo contains request data attached to the context passed to GetRequestMetadata calls.
+//
+// This API is experimental.
+type RequestInfo struct {
+	// The method passed to Invoke or NewStream for this RPC. (For proto methods, this has the format "/some.Service/Method")
+	Method string
+	// AuthInfo contains the information from a security handshake (TransportCredentials.ClientHandshake, TransportCredentials.ServerHandshake)
+	AuthInfo AuthInfo
+}
+
+// RequestInfoFromContext extracts the RequestInfo from the context if it exists.
+//
+// This API is experimental.
+func RequestInfoFromContext(ctx context.Context) (ri RequestInfo, ok bool) {
+	ri, ok = icredentials.RequestInfoFromContext(ctx).(RequestInfo)
+	return ri, ok
+}
+
+// ClientHandshakeInfo holds data to be passed to ClientHandshake. This makes
+// it possible to pass arbitrary data to the handshaker from gRPC, resolver,
+// balancer etc. Individual credential implementations control the actual
+// format of the data that they are willing to receive.
+//
+// This API is experimental.
+type ClientHandshakeInfo struct {
+	// Attributes contains the attributes for the address. It could be provided
+	// by the gRPC, resolver, balancer etc.
+	Attributes *attributes.Attributes
+}
+
+// ClientHandshakeInfoFromContext returns the ClientHandshakeInfo struct stored
+// in ctx.
+//
+// This API is experimental.
+func ClientHandshakeInfoFromContext(ctx context.Context) ClientHandshakeInfo {
+	chi, _ := icredentials.ClientHandshakeInfoFromContext(ctx).(ClientHandshakeInfo)
+	return chi
+}
+
+// CheckSecurityLevel checks if a connection's security level is greater than or equal to the specified one.
+// It returns success if 1) the condition is satisified or 2) AuthInfo struct does not implement GetCommonAuthInfo() method
+// or 3) CommonAuthInfo.SecurityLevel has an invalid zero value. For 2) and 3), it is for the purpose of backward-compatibility.
+//
+// This API is experimental.
+func CheckSecurityLevel(ai AuthInfo, level SecurityLevel) error {
+	type internalInfo interface {
+		GetCommonAuthInfo() CommonAuthInfo
+	}
+	if ai == nil {
+		return errors.New("AuthInfo is nil")
+	}
+	if ci, ok := ai.(internalInfo); ok {
+		// CommonAuthInfo.SecurityLevel has an invalid value.
+		if ci.GetCommonAuthInfo().SecurityLevel == InvalidSecurityLevel {
+			return nil
+		}
+		if ci.GetCommonAuthInfo().SecurityLevel < level {
+			return fmt.Errorf("requires SecurityLevel %v; connection has %v", level, ci.GetCommonAuthInfo().SecurityLevel)
+		}
+	}
+	// The condition is satisfied or AuthInfo struct does not implement GetCommonAuthInfo() method.
+	return nil
+}
+
+// ChannelzSecurityInfo defines the interface that security protocols should implement
+// in order to provide security info to channelz.
+//
+// This API is experimental.
+type ChannelzSecurityInfo interface {
+	GetSecurityValue() ChannelzSecurityValue
+}
+
+// ChannelzSecurityValue defines the interface that GetSecurityValue() return value
+// should satisfy. This interface should only be satisfied by *TLSChannelzSecurityValue
+// and *OtherChannelzSecurityValue.
+//
+// This API is experimental.
+type ChannelzSecurityValue interface {
+	isChannelzSecurityValue()
+}
+
+// OtherChannelzSecurityValue defines the struct that non-TLS protocol should return
+// from GetSecurityValue(), which contains protocol specific security info. Note
+// the Value field will be sent to users of channelz requesting channel info, and
+// thus sensitive info should better be avoided.
+//
+// This API is experimental.
+type OtherChannelzSecurityValue struct {
+	ChannelzSecurityValue
+	Name  string
+	Value proto.Message
+}
diff --git a/vendor/google.golang.org/grpc/credentials/insecure/insecure.go b/vendor/google.golang.org/grpc/credentials/insecure/insecure.go
new file mode 100644
index 0000000000..82bee1443b
--- /dev/null
+++ b/vendor/google.golang.org/grpc/credentials/insecure/insecure.go
@@ -0,0 +1,98 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package insecure provides an implementation of the
+// credentials.TransportCredentials interface which disables transport security.
+package insecure
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewCredentials returns a credentials which disables transport security.
+//
+// Note that using this credentials with per-RPC credentials which require
+// transport security is incompatible and will cause grpc.Dial() to fail.
+func NewCredentials() credentials.TransportCredentials {
+	return insecureTC{}
+}
+
+// insecureTC implements the insecure transport credentials. The handshake
+// methods simply return the passed in net.Conn and set the security level to
+// NoSecurity.
+type insecureTC struct{}
+
+func (insecureTC) ClientHandshake(ctx context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, info{credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity}}, nil
+}
+
+func (insecureTC) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, info{credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity}}, nil
+}
+
+func (insecureTC) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: "insecure"}
+}
+
+func (insecureTC) Clone() credentials.TransportCredentials {
+	return insecureTC{}
+}
+
+func (insecureTC) OverrideServerName(string) error {
+	return nil
+}
+
+// info contains the auth information for an insecure connection.
+// It implements the AuthInfo interface.
+type info struct {
+	credentials.CommonAuthInfo
+}
+
+// AuthType returns the type of info as a string.
+func (info) AuthType() string {
+	return "insecure"
+}
+
+// insecureBundle implements an insecure bundle.
+// An insecure bundle provides a thin wrapper around insecureTC to support
+// the credentials.Bundle interface.
+type insecureBundle struct{}
+
+// NewBundle returns a bundle with disabled transport security and no per rpc credential.
+func NewBundle() credentials.Bundle {
+	return insecureBundle{}
+}
+
+// NewWithMode returns a new insecure Bundle. The mode is ignored.
+func (insecureBundle) NewWithMode(string) (credentials.Bundle, error) {
+	return insecureBundle{}, nil
+}
+
+// PerRPCCredentials returns an nil implementation as insecure
+// bundle does not support a per rpc credential.
+func (insecureBundle) PerRPCCredentials() credentials.PerRPCCredentials {
+	return nil
+}
+
+// TransportCredentials returns the underlying insecure transport credential.
+func (insecureBundle) TransportCredentials() credentials.TransportCredentials {
+	return NewCredentials()
+}
diff --git a/vendor/google.golang.org/grpc/credentials/tls.go b/vendor/google.golang.org/grpc/credentials/tls.go
new file mode 100644
index 0000000000..877b7cd21a
--- /dev/null
+++ b/vendor/google.golang.org/grpc/credentials/tls.go
@@ -0,0 +1,236 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package credentials
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+
+	credinternal "google.golang.org/grpc/internal/credentials"
+)
+
+// TLSInfo contains the auth information for a TLS authenticated connection.
+// It implements the AuthInfo interface.
+type TLSInfo struct {
+	State tls.ConnectionState
+	CommonAuthInfo
+	// This API is experimental.
+	SPIFFEID *url.URL
+}
+
+// AuthType returns the type of TLSInfo as a string.
+func (t TLSInfo) AuthType() string {
+	return "tls"
+}
+
+// GetSecurityValue returns security info requested by channelz.
+func (t TLSInfo) GetSecurityValue() ChannelzSecurityValue {
+	v := &TLSChannelzSecurityValue{
+		StandardName: cipherSuiteLookup[t.State.CipherSuite],
+	}
+	// Currently there's no way to get LocalCertificate info from tls package.
+	if len(t.State.PeerCertificates) > 0 {
+		v.RemoteCertificate = t.State.PeerCertificates[0].Raw
+	}
+	return v
+}
+
+// tlsCreds is the credentials required for authenticating a connection using TLS.
+type tlsCreds struct {
+	// TLS configuration
+	config *tls.Config
+}
+
+func (c tlsCreds) Info() ProtocolInfo {
+	return ProtocolInfo{
+		SecurityProtocol: "tls",
+		SecurityVersion:  "1.2",
+		ServerName:       c.config.ServerName,
+	}
+}
+
+func (c *tlsCreds) ClientHandshake(ctx context.Context, authority string, rawConn net.Conn) (_ net.Conn, _ AuthInfo, err error) {
+	// use local cfg to avoid clobbering ServerName if using multiple endpoints
+	cfg := credinternal.CloneTLSConfig(c.config)
+	if cfg.ServerName == "" {
+		serverName, _, err := net.SplitHostPort(authority)
+		if err != nil {
+			// If the authority had no host port or if the authority cannot be parsed, use it as-is.
+			serverName = authority
+		}
+		cfg.ServerName = serverName
+	}
+	conn := tls.Client(rawConn, cfg)
+	errChannel := make(chan error, 1)
+	go func() {
+		errChannel <- conn.Handshake()
+		close(errChannel)
+	}()
+	select {
+	case err := <-errChannel:
+		if err != nil {
+			conn.Close()
+			return nil, nil, err
+		}
+	case <-ctx.Done():
+		conn.Close()
+		return nil, nil, ctx.Err()
+	}
+	tlsInfo := TLSInfo{
+		State: conn.ConnectionState(),
+		CommonAuthInfo: CommonAuthInfo{
+			SecurityLevel: PrivacyAndIntegrity,
+		},
+	}
+	id := credinternal.SPIFFEIDFromState(conn.ConnectionState())
+	if id != nil {
+		tlsInfo.SPIFFEID = id
+	}
+	return credinternal.WrapSyscallConn(rawConn, conn), tlsInfo, nil
+}
+
+func (c *tlsCreds) ServerHandshake(rawConn net.Conn) (net.Conn, AuthInfo, error) {
+	conn := tls.Server(rawConn, c.config)
+	if err := conn.Handshake(); err != nil {
+		conn.Close()
+		return nil, nil, err
+	}
+	tlsInfo := TLSInfo{
+		State: conn.ConnectionState(),
+		CommonAuthInfo: CommonAuthInfo{
+			SecurityLevel: PrivacyAndIntegrity,
+		},
+	}
+	id := credinternal.SPIFFEIDFromState(conn.ConnectionState())
+	if id != nil {
+		tlsInfo.SPIFFEID = id
+	}
+	return credinternal.WrapSyscallConn(rawConn, conn), tlsInfo, nil
+}
+
+func (c *tlsCreds) Clone() TransportCredentials {
+	return NewTLS(c.config)
+}
+
+func (c *tlsCreds) OverrideServerName(serverNameOverride string) error {
+	c.config.ServerName = serverNameOverride
+	return nil
+}
+
+// NewTLS uses c to construct a TransportCredentials based on TLS.
+func NewTLS(c *tls.Config) TransportCredentials {
+	tc := &tlsCreds{credinternal.CloneTLSConfig(c)}
+	tc.config.NextProtos = credinternal.AppendH2ToNextProtos(tc.config.NextProtos)
+	return tc
+}
+
+// NewClientTLSFromCert constructs TLS credentials from the provided root
+// certificate authority certificate(s) to validate server connections. If
+// certificates to establish the identity of the client need to be included in
+// the credentials (eg: for mTLS), use NewTLS instead, where a complete
+// tls.Config can be specified.
+// serverNameOverride is for testing only. If set to a non empty string,
+// it will override the virtual host name of authority (e.g. :authority header
+// field) in requests.
+func NewClientTLSFromCert(cp *x509.CertPool, serverNameOverride string) TransportCredentials {
+	return NewTLS(&tls.Config{ServerName: serverNameOverride, RootCAs: cp})
+}
+
+// NewClientTLSFromFile constructs TLS credentials from the provided root
+// certificate authority certificate file(s) to validate server connections. If
+// certificates to establish the identity of the client need to be included in
+// the credentials (eg: for mTLS), use NewTLS instead, where a complete
+// tls.Config can be specified.
+// serverNameOverride is for testing only. If set to a non empty string,
+// it will override the virtual host name of authority (e.g. :authority header
+// field) in requests.
+func NewClientTLSFromFile(certFile, serverNameOverride string) (TransportCredentials, error) {
+	b, err := os.ReadFile(certFile)
+	if err != nil {
+		return nil, err
+	}
+	cp := x509.NewCertPool()
+	if !cp.AppendCertsFromPEM(b) {
+		return nil, fmt.Errorf("credentials: failed to append certificates")
+	}
+	return NewTLS(&tls.Config{ServerName: serverNameOverride, RootCAs: cp}), nil
+}
+
+// NewServerTLSFromCert constructs TLS credentials from the input certificate for server.
+func NewServerTLSFromCert(cert *tls.Certificate) TransportCredentials {
+	return NewTLS(&tls.Config{Certificates: []tls.Certificate{*cert}})
+}
+
+// NewServerTLSFromFile constructs TLS credentials from the input certificate file and key
+// file for server.
+func NewServerTLSFromFile(certFile, keyFile string) (TransportCredentials, error) {
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return nil, err
+	}
+	return NewTLS(&tls.Config{Certificates: []tls.Certificate{cert}}), nil
+}
+
+// TLSChannelzSecurityValue defines the struct that TLS protocol should return
+// from GetSecurityValue(), containing security info like cipher and certificate used.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type TLSChannelzSecurityValue struct {
+	ChannelzSecurityValue
+	StandardName      string
+	LocalCertificate  []byte
+	RemoteCertificate []byte
+}
+
+var cipherSuiteLookup = map[uint16]string{
+	tls.TLS_RSA_WITH_RC4_128_SHA:                "TLS_RSA_WITH_RC4_128_SHA",
+	tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA:           "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+	tls.TLS_RSA_WITH_AES_128_CBC_SHA:            "TLS_RSA_WITH_AES_128_CBC_SHA",
+	tls.TLS_RSA_WITH_AES_256_CBC_SHA:            "TLS_RSA_WITH_AES_256_CBC_SHA",
+	tls.TLS_RSA_WITH_AES_128_GCM_SHA256:         "TLS_RSA_WITH_AES_128_GCM_SHA256",
+	tls.TLS_RSA_WITH_AES_256_GCM_SHA384:         "TLS_RSA_WITH_AES_256_GCM_SHA384",
+	tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:        "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:    "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:    "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+	tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA:          "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
+	tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:     "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
+	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+	tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:   "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:   "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+	tls.TLS_FALLBACK_SCSV:                       "TLS_FALLBACK_SCSV",
+	tls.TLS_RSA_WITH_AES_128_CBC_SHA256:         "TLS_RSA_WITH_AES_128_CBC_SHA256",
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:   "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+	tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305:    "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
+	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305:  "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
+	tls.TLS_AES_128_GCM_SHA256:                  "TLS_AES_128_GCM_SHA256",
+	tls.TLS_AES_256_GCM_SHA384:                  "TLS_AES_256_GCM_SHA384",
+	tls.TLS_CHACHA20_POLY1305_SHA256:            "TLS_CHACHA20_POLY1305_SHA256",
+}
diff --git a/vendor/google.golang.org/grpc/dialoptions.go b/vendor/google.golang.org/grpc/dialoptions.go
new file mode 100644
index 0000000000..cdc8263bda
--- /dev/null
+++ b/vendor/google.golang.org/grpc/dialoptions.go
@@ -0,0 +1,657 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/channelz"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/internal"
+	internalbackoff "google.golang.org/grpc/internal/backoff"
+	"google.golang.org/grpc/internal/binarylog"
+	"google.golang.org/grpc/internal/transport"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/stats"
+)
+
+func init() {
+	internal.AddGlobalDialOptions = func(opt ...DialOption) {
+		globalDialOptions = append(globalDialOptions, opt...)
+	}
+	internal.ClearGlobalDialOptions = func() {
+		globalDialOptions = nil
+	}
+	internal.WithBinaryLogger = withBinaryLogger
+	internal.JoinDialOptions = newJoinDialOption
+	internal.DisableGlobalDialOptions = newDisableGlobalDialOptions
+}
+
+// dialOptions configure a Dial call. dialOptions are set by the DialOption
+// values passed to Dial.
+type dialOptions struct {
+	unaryInt  UnaryClientInterceptor
+	streamInt StreamClientInterceptor
+
+	chainUnaryInts  []UnaryClientInterceptor
+	chainStreamInts []StreamClientInterceptor
+
+	cp                          Compressor
+	dc                          Decompressor
+	bs                          internalbackoff.Strategy
+	block                       bool
+	returnLastError             bool
+	timeout                     time.Duration
+	scChan                      <-chan ServiceConfig
+	authority                   string
+	binaryLogger                binarylog.Logger
+	copts                       transport.ConnectOptions
+	callOptions                 []CallOption
+	channelzParentID            *channelz.Identifier
+	disableServiceConfig        bool
+	disableRetry                bool
+	disableHealthCheck          bool
+	healthCheckFunc             internal.HealthChecker
+	minConnectTimeout           func() time.Duration
+	defaultServiceConfig        *ServiceConfig // defaultServiceConfig is parsed from defaultServiceConfigRawJSON.
+	defaultServiceConfigRawJSON *string
+	resolvers                   []resolver.Builder
+}
+
+// DialOption configures how we set up the connection.
+type DialOption interface {
+	apply(*dialOptions)
+}
+
+var globalDialOptions []DialOption
+
+// EmptyDialOption does not alter the dial configuration. It can be embedded in
+// another structure to build custom dial options.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type EmptyDialOption struct{}
+
+func (EmptyDialOption) apply(*dialOptions) {}
+
+type disableGlobalDialOptions struct{}
+
+func (disableGlobalDialOptions) apply(*dialOptions) {}
+
+// newDisableGlobalDialOptions returns a DialOption that prevents the ClientConn
+// from applying the global DialOptions (set via AddGlobalDialOptions).
+func newDisableGlobalDialOptions() DialOption {
+	return &disableGlobalDialOptions{}
+}
+
+// funcDialOption wraps a function that modifies dialOptions into an
+// implementation of the DialOption interface.
+type funcDialOption struct {
+	f func(*dialOptions)
+}
+
+func (fdo *funcDialOption) apply(do *dialOptions) {
+	fdo.f(do)
+}
+
+func newFuncDialOption(f func(*dialOptions)) *funcDialOption {
+	return &funcDialOption{
+		f: f,
+	}
+}
+
+type joinDialOption struct {
+	opts []DialOption
+}
+
+func (jdo *joinDialOption) apply(do *dialOptions) {
+	for _, opt := range jdo.opts {
+		opt.apply(do)
+	}
+}
+
+func newJoinDialOption(opts ...DialOption) DialOption {
+	return &joinDialOption{opts: opts}
+}
+
+// WithWriteBufferSize determines how much data can be batched before doing a
+// write on the wire. The corresponding memory allocation for this buffer will
+// be twice the size to keep syscalls low. The default value for this buffer is
+// 32KB.
+//
+// Zero or negative values will disable the write buffer such that each write
+// will be on underlying connection. Note: A Send call may not directly
+// translate to a write.
+func WithWriteBufferSize(s int) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.WriteBufferSize = s
+	})
+}
+
+// WithReadBufferSize lets you set the size of read buffer, this determines how
+// much data can be read at most for each read syscall.
+//
+// The default value for this buffer is 32KB. Zero or negative values will
+// disable read buffer for a connection so data framer can access the
+// underlying conn directly.
+func WithReadBufferSize(s int) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.ReadBufferSize = s
+	})
+}
+
+// WithInitialWindowSize returns a DialOption which sets the value for initial
+// window size on a stream. The lower bound for window size is 64K and any value
+// smaller than that will be ignored.
+func WithInitialWindowSize(s int32) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.InitialWindowSize = s
+	})
+}
+
+// WithInitialConnWindowSize returns a DialOption which sets the value for
+// initial window size on a connection. The lower bound for window size is 64K
+// and any value smaller than that will be ignored.
+func WithInitialConnWindowSize(s int32) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.InitialConnWindowSize = s
+	})
+}
+
+// WithMaxMsgSize returns a DialOption which sets the maximum message size the
+// client can receive.
+//
+// Deprecated: use WithDefaultCallOptions(MaxCallRecvMsgSize(s)) instead.  Will
+// be supported throughout 1.x.
+func WithMaxMsgSize(s int) DialOption {
+	return WithDefaultCallOptions(MaxCallRecvMsgSize(s))
+}
+
+// WithDefaultCallOptions returns a DialOption which sets the default
+// CallOptions for calls over the connection.
+func WithDefaultCallOptions(cos ...CallOption) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.callOptions = append(o.callOptions, cos...)
+	})
+}
+
+// WithCodec returns a DialOption which sets a codec for message marshaling and
+// unmarshaling.
+//
+// Deprecated: use WithDefaultCallOptions(ForceCodec(_)) instead.  Will be
+// supported throughout 1.x.
+func WithCodec(c Codec) DialOption {
+	return WithDefaultCallOptions(CallCustomCodec(c))
+}
+
+// WithCompressor returns a DialOption which sets a Compressor to use for
+// message compression. It has lower priority than the compressor set by the
+// UseCompressor CallOption.
+//
+// Deprecated: use UseCompressor instead.  Will be supported throughout 1.x.
+func WithCompressor(cp Compressor) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.cp = cp
+	})
+}
+
+// WithDecompressor returns a DialOption which sets a Decompressor to use for
+// incoming message decompression.  If incoming response messages are encoded
+// using the decompressor's Type(), it will be used.  Otherwise, the message
+// encoding will be used to look up the compressor registered via
+// encoding.RegisterCompressor, which will then be used to decompress the
+// message.  If no compressor is registered for the encoding, an Unimplemented
+// status error will be returned.
+//
+// Deprecated: use encoding.RegisterCompressor instead.  Will be supported
+// throughout 1.x.
+func WithDecompressor(dc Decompressor) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.dc = dc
+	})
+}
+
+// WithServiceConfig returns a DialOption which has a channel to read the
+// service configuration.
+//
+// Deprecated: service config should be received through name resolver or via
+// WithDefaultServiceConfig, as specified at
+// https://github.com/grpc/grpc/blob/master/doc/service_config.md.  Will be
+// removed in a future 1.x release.
+func WithServiceConfig(c <-chan ServiceConfig) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.scChan = c
+	})
+}
+
+// WithConnectParams configures the ClientConn to use the provided ConnectParams
+// for creating and maintaining connections to servers.
+//
+// The backoff configuration specified as part of the ConnectParams overrides
+// all defaults specified in
+// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md. Consider
+// using the backoff.DefaultConfig as a base, in cases where you want to
+// override only a subset of the backoff configuration.
+func WithConnectParams(p ConnectParams) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.bs = internalbackoff.Exponential{Config: p.Backoff}
+		o.minConnectTimeout = func() time.Duration {
+			return p.MinConnectTimeout
+		}
+	})
+}
+
+// WithBackoffMaxDelay configures the dialer to use the provided maximum delay
+// when backing off after failed connection attempts.
+//
+// Deprecated: use WithConnectParams instead. Will be supported throughout 1.x.
+func WithBackoffMaxDelay(md time.Duration) DialOption {
+	return WithBackoffConfig(BackoffConfig{MaxDelay: md})
+}
+
+// WithBackoffConfig configures the dialer to use the provided backoff
+// parameters after connection failures.
+//
+// Deprecated: use WithConnectParams instead. Will be supported throughout 1.x.
+func WithBackoffConfig(b BackoffConfig) DialOption {
+	bc := backoff.DefaultConfig
+	bc.MaxDelay = b.MaxDelay
+	return withBackoff(internalbackoff.Exponential{Config: bc})
+}
+
+// withBackoff sets the backoff strategy used for connectRetryNum after a failed
+// connection attempt.
+//
+// This can be exported if arbitrary backoff strategies are allowed by gRPC.
+func withBackoff(bs internalbackoff.Strategy) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.bs = bs
+	})
+}
+
+// WithBlock returns a DialOption which makes callers of Dial block until the
+// underlying connection is up. Without this, Dial returns immediately and
+// connecting the server happens in background.
+//
+// Use of this feature is not recommended.  For more information, please see:
+// https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
+func WithBlock() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.block = true
+	})
+}
+
+// WithReturnConnectionError returns a DialOption which makes the client connection
+// return a string containing both the last connection error that occurred and
+// the context.DeadlineExceeded error.
+// Implies WithBlock()
+//
+// Use of this feature is not recommended.  For more information, please see:
+// https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithReturnConnectionError() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.block = true
+		o.returnLastError = true
+	})
+}
+
+// WithInsecure returns a DialOption which disables transport security for this
+// ClientConn. Under the hood, it uses insecure.NewCredentials().
+//
+// Note that using this DialOption with per-RPC credentials (through
+// WithCredentialsBundle or WithPerRPCCredentials) which require transport
+// security is incompatible and will cause grpc.Dial() to fail.
+//
+// Deprecated: use WithTransportCredentials and insecure.NewCredentials()
+// instead. Will be supported throughout 1.x.
+func WithInsecure() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.TransportCredentials = insecure.NewCredentials()
+	})
+}
+
+// WithNoProxy returns a DialOption which disables the use of proxies for this
+// ClientConn. This is ignored if WithDialer or WithContextDialer are used.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithNoProxy() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.UseProxy = false
+	})
+}
+
+// WithTransportCredentials returns a DialOption which configures a connection
+// level security credentials (e.g., TLS/SSL). This should not be used together
+// with WithCredentialsBundle.
+func WithTransportCredentials(creds credentials.TransportCredentials) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.TransportCredentials = creds
+	})
+}
+
+// WithPerRPCCredentials returns a DialOption which sets credentials and places
+// auth state on each outbound RPC.
+func WithPerRPCCredentials(creds credentials.PerRPCCredentials) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.PerRPCCredentials = append(o.copts.PerRPCCredentials, creds)
+	})
+}
+
+// WithCredentialsBundle returns a DialOption to set a credentials bundle for
+// the ClientConn.WithCreds. This should not be used together with
+// WithTransportCredentials.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithCredentialsBundle(b credentials.Bundle) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.CredsBundle = b
+	})
+}
+
+// WithTimeout returns a DialOption that configures a timeout for dialing a
+// ClientConn initially. This is valid if and only if WithBlock() is present.
+//
+// Deprecated: use DialContext instead of Dial and context.WithTimeout
+// instead.  Will be supported throughout 1.x.
+func WithTimeout(d time.Duration) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.timeout = d
+	})
+}
+
+// WithContextDialer returns a DialOption that sets a dialer to create
+// connections. If FailOnNonTempDialError() is set to true, and an error is
+// returned by f, gRPC checks the error's Temporary() method to decide if it
+// should try to reconnect to the network address.
+func WithContextDialer(f func(context.Context, string) (net.Conn, error)) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.Dialer = f
+	})
+}
+
+func init() {
+	internal.WithHealthCheckFunc = withHealthCheckFunc
+}
+
+// WithDialer returns a DialOption that specifies a function to use for dialing
+// network addresses. If FailOnNonTempDialError() is set to true, and an error
+// is returned by f, gRPC checks the error's Temporary() method to decide if it
+// should try to reconnect to the network address.
+//
+// Deprecated: use WithContextDialer instead.  Will be supported throughout
+// 1.x.
+func WithDialer(f func(string, time.Duration) (net.Conn, error)) DialOption {
+	return WithContextDialer(
+		func(ctx context.Context, addr string) (net.Conn, error) {
+			if deadline, ok := ctx.Deadline(); ok {
+				return f(addr, time.Until(deadline))
+			}
+			return f(addr, 0)
+		})
+}
+
+// WithStatsHandler returns a DialOption that specifies the stats handler for
+// all the RPCs and underlying network connections in this ClientConn.
+func WithStatsHandler(h stats.Handler) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		if h == nil {
+			logger.Error("ignoring nil parameter in grpc.WithStatsHandler ClientOption")
+			// Do not allow a nil stats handler, which would otherwise cause
+			// panics.
+			return
+		}
+		o.copts.StatsHandlers = append(o.copts.StatsHandlers, h)
+	})
+}
+
+// withBinaryLogger returns a DialOption that specifies the binary logger for
+// this ClientConn.
+func withBinaryLogger(bl binarylog.Logger) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.binaryLogger = bl
+	})
+}
+
+// FailOnNonTempDialError returns a DialOption that specifies if gRPC fails on
+// non-temporary dial errors. If f is true, and dialer returns a non-temporary
+// error, gRPC will fail the connection to the network address and won't try to
+// reconnect. The default value of FailOnNonTempDialError is false.
+//
+// FailOnNonTempDialError only affects the initial dial, and does not do
+// anything useful unless you are also using WithBlock().
+//
+// Use of this feature is not recommended.  For more information, please see:
+// https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func FailOnNonTempDialError(f bool) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.FailOnNonTempDialError = f
+	})
+}
+
+// WithUserAgent returns a DialOption that specifies a user agent string for all
+// the RPCs.
+func WithUserAgent(s string) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.UserAgent = s
+	})
+}
+
+// WithKeepaliveParams returns a DialOption that specifies keepalive parameters
+// for the client transport.
+func WithKeepaliveParams(kp keepalive.ClientParameters) DialOption {
+	if kp.Time < internal.KeepaliveMinPingTime {
+		logger.Warningf("Adjusting keepalive ping interval to minimum period of %v", internal.KeepaliveMinPingTime)
+		kp.Time = internal.KeepaliveMinPingTime
+	}
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.KeepaliveParams = kp
+	})
+}
+
+// WithUnaryInterceptor returns a DialOption that specifies the interceptor for
+// unary RPCs.
+func WithUnaryInterceptor(f UnaryClientInterceptor) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.unaryInt = f
+	})
+}
+
+// WithChainUnaryInterceptor returns a DialOption that specifies the chained
+// interceptor for unary RPCs. The first interceptor will be the outer most,
+// while the last interceptor will be the inner most wrapper around the real call.
+// All interceptors added by this method will be chained, and the interceptor
+// defined by WithUnaryInterceptor will always be prepended to the chain.
+func WithChainUnaryInterceptor(interceptors ...UnaryClientInterceptor) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.chainUnaryInts = append(o.chainUnaryInts, interceptors...)
+	})
+}
+
+// WithStreamInterceptor returns a DialOption that specifies the interceptor for
+// streaming RPCs.
+func WithStreamInterceptor(f StreamClientInterceptor) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.streamInt = f
+	})
+}
+
+// WithChainStreamInterceptor returns a DialOption that specifies the chained
+// interceptor for streaming RPCs. The first interceptor will be the outer most,
+// while the last interceptor will be the inner most wrapper around the real call.
+// All interceptors added by this method will be chained, and the interceptor
+// defined by WithStreamInterceptor will always be prepended to the chain.
+func WithChainStreamInterceptor(interceptors ...StreamClientInterceptor) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.chainStreamInts = append(o.chainStreamInts, interceptors...)
+	})
+}
+
+// WithAuthority returns a DialOption that specifies the value to be used as the
+// :authority pseudo-header and as the server name in authentication handshake.
+func WithAuthority(a string) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.authority = a
+	})
+}
+
+// WithChannelzParentID returns a DialOption that specifies the channelz ID of
+// current ClientConn's parent. This function is used in nested channel creation
+// (e.g. grpclb dial).
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithChannelzParentID(id *channelz.Identifier) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.channelzParentID = id
+	})
+}
+
+// WithDisableServiceConfig returns a DialOption that causes gRPC to ignore any
+// service config provided by the resolver and provides a hint to the resolver
+// to not fetch service configs.
+//
+// Note that this dial option only disables service config from resolver. If
+// default service config is provided, gRPC will use the default service config.
+func WithDisableServiceConfig() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.disableServiceConfig = true
+	})
+}
+
+// WithDefaultServiceConfig returns a DialOption that configures the default
+// service config, which will be used in cases where:
+//
+// 1. WithDisableServiceConfig is also used, or
+//
+// 2. The name resolver does not provide a service config or provides an
+// invalid service config.
+//
+// The parameter s is the JSON representation of the default service config.
+// For more information about service configs, see:
+// https://github.com/grpc/grpc/blob/master/doc/service_config.md
+// For a simple example of usage, see:
+// examples/features/load_balancing/client/main.go
+func WithDefaultServiceConfig(s string) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.defaultServiceConfigRawJSON = &s
+	})
+}
+
+// WithDisableRetry returns a DialOption that disables retries, even if the
+// service config enables them.  This does not impact transparent retries, which
+// will happen automatically if no data is written to the wire or if the RPC is
+// unprocessed by the remote server.
+func WithDisableRetry() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.disableRetry = true
+	})
+}
+
+// WithMaxHeaderListSize returns a DialOption that specifies the maximum
+// (uncompressed) size of header list that the client is prepared to accept.
+func WithMaxHeaderListSize(s uint32) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.copts.MaxHeaderListSize = &s
+	})
+}
+
+// WithDisableHealthCheck disables the LB channel health checking for all
+// SubConns of this ClientConn.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithDisableHealthCheck() DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.disableHealthCheck = true
+	})
+}
+
+// withHealthCheckFunc replaces the default health check function with the
+// provided one. It makes tests easier to change the health check function.
+//
+// For testing purpose only.
+func withHealthCheckFunc(f internal.HealthChecker) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.healthCheckFunc = f
+	})
+}
+
+func defaultDialOptions() dialOptions {
+	return dialOptions{
+		healthCheckFunc: internal.HealthCheckFunc,
+		copts: transport.ConnectOptions{
+			WriteBufferSize: defaultWriteBufSize,
+			ReadBufferSize:  defaultReadBufSize,
+			UseProxy:        true,
+		},
+	}
+}
+
+// withGetMinConnectDeadline specifies the function that clientconn uses to
+// get minConnectDeadline. This can be used to make connection attempts happen
+// faster/slower.
+//
+// For testing purpose only.
+func withMinConnectDeadline(f func() time.Duration) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.minConnectTimeout = f
+	})
+}
+
+// WithResolvers allows a list of resolver implementations to be registered
+// locally with the ClientConn without needing to be globally registered via
+// resolver.Register.  They will be matched against the scheme used for the
+// current Dial only, and will take precedence over the global registry.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func WithResolvers(rs ...resolver.Builder) DialOption {
+	return newFuncDialOption(func(o *dialOptions) {
+		o.resolvers = append(o.resolvers, rs...)
+	})
+}
diff --git a/vendor/google.golang.org/grpc/doc.go b/vendor/google.golang.org/grpc/doc.go
new file mode 100644
index 0000000000..0022859ad7
--- /dev/null
+++ b/vendor/google.golang.org/grpc/doc.go
@@ -0,0 +1,26 @@
+/*
+ *
+ * Copyright 2015 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+//go:generate ./regenerate.sh
+
+/*
+Package grpc implements an RPC system called gRPC.
+
+See grpc.io for more information about gRPC.
+*/
+package grpc // import "google.golang.org/grpc"
diff --git a/vendor/google.golang.org/grpc/encoding/encoding.go b/vendor/google.golang.org/grpc/encoding/encoding.go
new file mode 100644
index 0000000000..07a5861352
--- /dev/null
+++ b/vendor/google.golang.org/grpc/encoding/encoding.go
@@ -0,0 +1,135 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package encoding defines the interface for the compressor and codec, and
+// functions to register and retrieve compressors and codecs.
+//
+// # Experimental
+//
+// Notice: This package is EXPERIMENTAL and may be changed or removed in a
+// later release.
+package encoding
+
+import (
+	"io"
+	"strings"
+
+	"google.golang.org/grpc/internal/grpcutil"
+)
+
+// Identity specifies the optional encoding for uncompressed streams.
+// It is intended for grpc internal use only.
+const Identity = "identity"
+
+// Compressor is used for compressing and decompressing when sending or
+// receiving messages.
+type Compressor interface {
+	// Compress writes the data written to wc to w after compressing it.  If an
+	// error occurs while initializing the compressor, that error is returned
+	// instead.
+	Compress(w io.Writer) (io.WriteCloser, error)
+	// Decompress reads data from r, decompresses it, and provides the
+	// uncompressed data via the returned io.Reader.  If an error occurs while
+	// initializing the decompressor, that error is returned instead.
+	Decompress(r io.Reader) (io.Reader, error)
+	// Name is the name of the compression codec and is used to set the content
+	// coding header.  The result must be static; the result cannot change
+	// between calls.
+	Name() string
+	// If a Compressor implements
+	// DecompressedSize(compressedBytes []byte) int, gRPC will call it
+	// to determine the size of the buffer allocated for the result of decompression.
+	// Return -1 to indicate unknown size.
+	//
+	// Experimental
+	//
+	// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+	// later release.
+}
+
+var registeredCompressor = make(map[string]Compressor)
+
+// RegisterCompressor registers the compressor with gRPC by its name.  It can
+// be activated when sending an RPC via grpc.UseCompressor().  It will be
+// automatically accessed when receiving a message based on the content coding
+// header.  Servers also use it to send a response with the same encoding as
+// the request.
+//
+// NOTE: this function must only be called during initialization time (i.e. in
+// an init() function), and is not thread-safe.  If multiple Compressors are
+// registered with the same name, the one registered last will take effect.
+func RegisterCompressor(c Compressor) {
+	registeredCompressor[c.Name()] = c
+	if !grpcutil.IsCompressorNameRegistered(c.Name()) {
+		grpcutil.RegisteredCompressorNames = append(grpcutil.RegisteredCompressorNames, c.Name())
+	}
+}
+
+// GetCompressor returns Compressor for the given compressor name.
+func GetCompressor(name string) Compressor {
+	return registeredCompressor[name]
+}
+
+// Codec defines the interface gRPC uses to encode and decode messages.  Note
+// that implementations of this interface must be thread safe; a Codec's
+// methods can be called from concurrent goroutines.
+type Codec interface {
+	// Marshal returns the wire format of v.
+	Marshal(v interface{}) ([]byte, error)
+	// Unmarshal parses the wire format into v.
+	Unmarshal(data []byte, v interface{}) error
+	// Name returns the name of the Codec implementation. The returned string
+	// will be used as part of content type in transmission.  The result must be
+	// static; the result cannot change between calls.
+	Name() string
+}
+
+var registeredCodecs = make(map[string]Codec)
+
+// RegisterCodec registers the provided Codec for use with all gRPC clients and
+// servers.
+//
+// The Codec will be stored and looked up by result of its Name() method, which
+// should match the content-subtype of the encoding handled by the Codec.  This
+// is case-insensitive, and is stored and looked up as lowercase.  If the
+// result of calling Name() is an empty string, RegisterCodec will panic. See
+// Content-Type on
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests for
+// more details.
+//
+// NOTE: this function must only be called during initialization time (i.e. in
+// an init() function), and is not thread-safe.  If multiple Codecs are
+// registered with the same name, the one registered last will take effect.
+func RegisterCodec(codec Codec) {
+	if codec == nil {
+		panic("cannot register a nil Codec")
+	}
+	if codec.Name() == "" {
+		panic("cannot register Codec with empty string result for Name()")
+	}
+	contentSubtype := strings.ToLower(codec.Name())
+	registeredCodecs[contentSubtype] = codec
+}
+
+// GetCodec gets a registered Codec by content-subtype, or nil if no Codec is
+// registered for the content-subtype.
+//
+// The content-subtype is expected to be lowercase.
+func GetCodec(contentSubtype string) Codec {
+	return registeredCodecs[contentSubtype]
+}
diff --git a/vendor/google.golang.org/grpc/encoding/gzip/gzip.go b/vendor/google.golang.org/grpc/encoding/gzip/gzip.go
new file mode 100644
index 0000000000..a3bb173c24
--- /dev/null
+++ b/vendor/google.golang.org/grpc/encoding/gzip/gzip.go
@@ -0,0 +1,132 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package gzip implements and registers the gzip compressor
+// during the initialization.
+//
+// # Experimental
+//
+// Notice: This package is EXPERIMENTAL and may be changed or removed in a
+// later release.
+package gzip
+
+import (
+	"compress/gzip"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"sync"
+
+	"google.golang.org/grpc/encoding"
+)
+
+// Name is the name registered for the gzip compressor.
+const Name = "gzip"
+
+func init() {
+	c := &compressor{}
+	c.poolCompressor.New = func() interface{} {
+		return &writer{Writer: gzip.NewWriter(io.Discard), pool: &c.poolCompressor}
+	}
+	encoding.RegisterCompressor(c)
+}
+
+type writer struct {
+	*gzip.Writer
+	pool *sync.Pool
+}
+
+// SetLevel updates the registered gzip compressor to use the compression level specified (gzip.HuffmanOnly is not supported).
+// NOTE: this function must only be called during initialization time (i.e. in an init() function),
+// and is not thread-safe.
+//
+// The error returned will be nil if the specified level is valid.
+func SetLevel(level int) error {
+	if level < gzip.DefaultCompression || level > gzip.BestCompression {
+		return fmt.Errorf("grpc: invalid gzip compression level: %d", level)
+	}
+	c := encoding.GetCompressor(Name).(*compressor)
+	c.poolCompressor.New = func() interface{} {
+		w, err := gzip.NewWriterLevel(io.Discard, level)
+		if err != nil {
+			panic(err)
+		}
+		return &writer{Writer: w, pool: &c.poolCompressor}
+	}
+	return nil
+}
+
+func (c *compressor) Compress(w io.Writer) (io.WriteCloser, error) {
+	z := c.poolCompressor.Get().(*writer)
+	z.Writer.Reset(w)
+	return z, nil
+}
+
+func (z *writer) Close() error {
+	defer z.pool.Put(z)
+	return z.Writer.Close()
+}
+
+type reader struct {
+	*gzip.Reader
+	pool *sync.Pool
+}
+
+func (c *compressor) Decompress(r io.Reader) (io.Reader, error) {
+	z, inPool := c.poolDecompressor.Get().(*reader)
+	if !inPool {
+		newZ, err := gzip.NewReader(r)
+		if err != nil {
+			return nil, err
+		}
+		return &reader{Reader: newZ, pool: &c.poolDecompressor}, nil
+	}
+	if err := z.Reset(r); err != nil {
+		c.poolDecompressor.Put(z)
+		return nil, err
+	}
+	return z, nil
+}
+
+func (z *reader) Read(p []byte) (n int, err error) {
+	n, err = z.Reader.Read(p)
+	if err == io.EOF {
+		z.pool.Put(z)
+	}
+	return n, err
+}
+
+// RFC1952 specifies that the last four bytes "contains the size of
+// the original (uncompressed) input data modulo 2^32."
+// gRPC has a max message size of 2GB so we don't need to worry about wraparound.
+func (c *compressor) DecompressedSize(buf []byte) int {
+	last := len(buf)
+	if last < 4 {
+		return -1
+	}
+	return int(binary.LittleEndian.Uint32(buf[last-4 : last]))
+}
+
+func (c *compressor) Name() string {
+	return Name
+}
+
+type compressor struct {
+	poolCompressor   sync.Pool
+	poolDecompressor sync.Pool
+}
diff --git a/vendor/google.golang.org/grpc/encoding/proto/proto.go b/vendor/google.golang.org/grpc/encoding/proto/proto.go
new file mode 100644
index 0000000000..3009b35afe
--- /dev/null
+++ b/vendor/google.golang.org/grpc/encoding/proto/proto.go
@@ -0,0 +1,58 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package proto defines the protobuf codec. Importing this package will
+// register the codec.
+package proto
+
+import (
+	"fmt"
+
+	"github.com/golang/protobuf/proto"
+	"google.golang.org/grpc/encoding"
+)
+
+// Name is the name registered for the proto compressor.
+const Name = "proto"
+
+func init() {
+	encoding.RegisterCodec(codec{})
+}
+
+// codec is a Codec implementation with protobuf. It is the default codec for gRPC.
+type codec struct{}
+
+func (codec) Marshal(v interface{}) ([]byte, error) {
+	vv, ok := v.(proto.Message)
+	if !ok {
+		return nil, fmt.Errorf("failed to marshal, message is %T, want proto.Message", v)
+	}
+	return proto.Marshal(vv)
+}
+
+func (codec) Unmarshal(data []byte, v interface{}) error {
+	vv, ok := v.(proto.Message)
+	if !ok {
+		return fmt.Errorf("failed to unmarshal, message is %T, want proto.Message", v)
+	}
+	return proto.Unmarshal(data, vv)
+}
+
+func (codec) Name() string {
+	return Name
+}
diff --git a/vendor/google.golang.org/grpc/grpclog/component.go b/vendor/google.golang.org/grpc/grpclog/component.go
new file mode 100644
index 0000000000..8358dd6e2a
--- /dev/null
+++ b/vendor/google.golang.org/grpc/grpclog/component.go
@@ -0,0 +1,117 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpclog
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/internal/grpclog"
+)
+
+// componentData records the settings for a component.
+type componentData struct {
+	name string
+}
+
+var cache = map[string]*componentData{}
+
+func (c *componentData) InfoDepth(depth int, args ...interface{}) {
+	args = append([]interface{}{"[" + string(c.name) + "]"}, args...)
+	grpclog.InfoDepth(depth+1, args...)
+}
+
+func (c *componentData) WarningDepth(depth int, args ...interface{}) {
+	args = append([]interface{}{"[" + string(c.name) + "]"}, args...)
+	grpclog.WarningDepth(depth+1, args...)
+}
+
+func (c *componentData) ErrorDepth(depth int, args ...interface{}) {
+	args = append([]interface{}{"[" + string(c.name) + "]"}, args...)
+	grpclog.ErrorDepth(depth+1, args...)
+}
+
+func (c *componentData) FatalDepth(depth int, args ...interface{}) {
+	args = append([]interface{}{"[" + string(c.name) + "]"}, args...)
+	grpclog.FatalDepth(depth+1, args...)
+}
+
+func (c *componentData) Info(args ...interface{}) {
+	c.InfoDepth(1, args...)
+}
+
+func (c *componentData) Warning(args ...interface{}) {
+	c.WarningDepth(1, args...)
+}
+
+func (c *componentData) Error(args ...interface{}) {
+	c.ErrorDepth(1, args...)
+}
+
+func (c *componentData) Fatal(args ...interface{}) {
+	c.FatalDepth(1, args...)
+}
+
+func (c *componentData) Infof(format string, args ...interface{}) {
+	c.InfoDepth(1, fmt.Sprintf(format, args...))
+}
+
+func (c *componentData) Warningf(format string, args ...interface{}) {
+	c.WarningDepth(1, fmt.Sprintf(format, args...))
+}
+
+func (c *componentData) Errorf(format string, args ...interface{}) {
+	c.ErrorDepth(1, fmt.Sprintf(format, args...))
+}
+
+func (c *componentData) Fatalf(format string, args ...interface{}) {
+	c.FatalDepth(1, fmt.Sprintf(format, args...))
+}
+
+func (c *componentData) Infoln(args ...interface{}) {
+	c.InfoDepth(1, args...)
+}
+
+func (c *componentData) Warningln(args ...interface{}) {
+	c.WarningDepth(1, args...)
+}
+
+func (c *componentData) Errorln(args ...interface{}) {
+	c.ErrorDepth(1, args...)
+}
+
+func (c *componentData) Fatalln(args ...interface{}) {
+	c.FatalDepth(1, args...)
+}
+
+func (c *componentData) V(l int) bool {
+	return V(l)
+}
+
+// Component creates a new component and returns it for logging. If a component
+// with the name already exists, nothing will be created and it will be
+// returned. SetLoggerV2 will panic if it is called with a logger created by
+// Component.
+func Component(componentName string) DepthLoggerV2 {
+	if cData, ok := cache[componentName]; ok {
+		return cData
+	}
+	c := &componentData{componentName}
+	cache[componentName] = c
+	return c
+}
diff --git a/vendor/google.golang.org/grpc/grpclog/grpclog.go b/vendor/google.golang.org/grpc/grpclog/grpclog.go
new file mode 100644
index 0000000000..c8bb2be34b
--- /dev/null
+++ b/vendor/google.golang.org/grpc/grpclog/grpclog.go
@@ -0,0 +1,132 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package grpclog defines logging for grpc.
+//
+// All logs in transport and grpclb packages only go to verbose level 2.
+// All logs in other packages in grpc are logged in spite of the verbosity level.
+//
+// In the default logger,
+// severity level can be set by environment variable GRPC_GO_LOG_SEVERITY_LEVEL,
+// verbosity level can be set by GRPC_GO_LOG_VERBOSITY_LEVEL.
+package grpclog // import "google.golang.org/grpc/grpclog"
+
+import (
+	"os"
+
+	"google.golang.org/grpc/internal/grpclog"
+)
+
+func init() {
+	SetLoggerV2(newLoggerV2())
+}
+
+// V reports whether verbosity level l is at least the requested verbose level.
+func V(l int) bool {
+	return grpclog.Logger.V(l)
+}
+
+// Info logs to the INFO log.
+func Info(args ...interface{}) {
+	grpclog.Logger.Info(args...)
+}
+
+// Infof logs to the INFO log. Arguments are handled in the manner of fmt.Printf.
+func Infof(format string, args ...interface{}) {
+	grpclog.Logger.Infof(format, args...)
+}
+
+// Infoln logs to the INFO log. Arguments are handled in the manner of fmt.Println.
+func Infoln(args ...interface{}) {
+	grpclog.Logger.Infoln(args...)
+}
+
+// Warning logs to the WARNING log.
+func Warning(args ...interface{}) {
+	grpclog.Logger.Warning(args...)
+}
+
+// Warningf logs to the WARNING log. Arguments are handled in the manner of fmt.Printf.
+func Warningf(format string, args ...interface{}) {
+	grpclog.Logger.Warningf(format, args...)
+}
+
+// Warningln logs to the WARNING log. Arguments are handled in the manner of fmt.Println.
+func Warningln(args ...interface{}) {
+	grpclog.Logger.Warningln(args...)
+}
+
+// Error logs to the ERROR log.
+func Error(args ...interface{}) {
+	grpclog.Logger.Error(args...)
+}
+
+// Errorf logs to the ERROR log. Arguments are handled in the manner of fmt.Printf.
+func Errorf(format string, args ...interface{}) {
+	grpclog.Logger.Errorf(format, args...)
+}
+
+// Errorln logs to the ERROR log. Arguments are handled in the manner of fmt.Println.
+func Errorln(args ...interface{}) {
+	grpclog.Logger.Errorln(args...)
+}
+
+// Fatal logs to the FATAL log. Arguments are handled in the manner of fmt.Print.
+// It calls os.Exit() with exit code 1.
+func Fatal(args ...interface{}) {
+	grpclog.Logger.Fatal(args...)
+	// Make sure fatal logs will exit.
+	os.Exit(1)
+}
+
+// Fatalf logs to the FATAL log. Arguments are handled in the manner of fmt.Printf.
+// It calls os.Exit() with exit code 1.
+func Fatalf(format string, args ...interface{}) {
+	grpclog.Logger.Fatalf(format, args...)
+	// Make sure fatal logs will exit.
+	os.Exit(1)
+}
+
+// Fatalln logs to the FATAL log. Arguments are handled in the manner of fmt.Println.
+// It calle os.Exit()) with exit code 1.
+func Fatalln(args ...interface{}) {
+	grpclog.Logger.Fatalln(args...)
+	// Make sure fatal logs will exit.
+	os.Exit(1)
+}
+
+// Print prints to the logger. Arguments are handled in the manner of fmt.Print.
+//
+// Deprecated: use Info.
+func Print(args ...interface{}) {
+	grpclog.Logger.Info(args...)
+}
+
+// Printf prints to the logger. Arguments are handled in the manner of fmt.Printf.
+//
+// Deprecated: use Infof.
+func Printf(format string, args ...interface{}) {
+	grpclog.Logger.Infof(format, args...)
+}
+
+// Println prints to the logger. Arguments are handled in the manner of fmt.Println.
+//
+// Deprecated: use Infoln.
+func Println(args ...interface{}) {
+	grpclog.Logger.Infoln(args...)
+}
diff --git a/vendor/google.golang.org/grpc/grpclog/logger.go b/vendor/google.golang.org/grpc/grpclog/logger.go
new file mode 100644
index 0000000000..ef06a4822b
--- /dev/null
+++ b/vendor/google.golang.org/grpc/grpclog/logger.go
@@ -0,0 +1,87 @@
+/*
+ *
+ * Copyright 2015 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpclog
+
+import "google.golang.org/grpc/internal/grpclog"
+
+// Logger mimics golang's standard Logger as an interface.
+//
+// Deprecated: use LoggerV2.
+type Logger interface {
+	Fatal(args ...interface{})
+	Fatalf(format string, args ...interface{})
+	Fatalln(args ...interface{})
+	Print(args ...interface{})
+	Printf(format string, args ...interface{})
+	Println(args ...interface{})
+}
+
+// SetLogger sets the logger that is used in grpc. Call only from
+// init() functions.
+//
+// Deprecated: use SetLoggerV2.
+func SetLogger(l Logger) {
+	grpclog.Logger = &loggerWrapper{Logger: l}
+}
+
+// loggerWrapper wraps Logger into a LoggerV2.
+type loggerWrapper struct {
+	Logger
+}
+
+func (g *loggerWrapper) Info(args ...interface{}) {
+	g.Logger.Print(args...)
+}
+
+func (g *loggerWrapper) Infoln(args ...interface{}) {
+	g.Logger.Println(args...)
+}
+
+func (g *loggerWrapper) Infof(format string, args ...interface{}) {
+	g.Logger.Printf(format, args...)
+}
+
+func (g *loggerWrapper) Warning(args ...interface{}) {
+	g.Logger.Print(args...)
+}
+
+func (g *loggerWrapper) Warningln(args ...interface{}) {
+	g.Logger.Println(args...)
+}
+
+func (g *loggerWrapper) Warningf(format string, args ...interface{}) {
+	g.Logger.Printf(format, args...)
+}
+
+func (g *loggerWrapper) Error(args ...interface{}) {
+	g.Logger.Print(args...)
+}
+
+func (g *loggerWrapper) Errorln(args ...interface{}) {
+	g.Logger.Println(args...)
+}
+
+func (g *loggerWrapper) Errorf(format string, args ...interface{}) {
+	g.Logger.Printf(format, args...)
+}
+
+func (g *loggerWrapper) V(l int) bool {
+	// Returns true for all verbose level.
+	return true
+}
diff --git a/vendor/google.golang.org/grpc/grpclog/loggerv2.go b/vendor/google.golang.org/grpc/grpclog/loggerv2.go
new file mode 100644
index 0000000000..5de66e40d3
--- /dev/null
+++ b/vendor/google.golang.org/grpc/grpclog/loggerv2.go
@@ -0,0 +1,258 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpclog
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"strconv"
+	"strings"
+
+	"google.golang.org/grpc/internal/grpclog"
+)
+
+// LoggerV2 does underlying logging work for grpclog.
+type LoggerV2 interface {
+	// Info logs to INFO log. Arguments are handled in the manner of fmt.Print.
+	Info(args ...interface{})
+	// Infoln logs to INFO log. Arguments are handled in the manner of fmt.Println.
+	Infoln(args ...interface{})
+	// Infof logs to INFO log. Arguments are handled in the manner of fmt.Printf.
+	Infof(format string, args ...interface{})
+	// Warning logs to WARNING log. Arguments are handled in the manner of fmt.Print.
+	Warning(args ...interface{})
+	// Warningln logs to WARNING log. Arguments are handled in the manner of fmt.Println.
+	Warningln(args ...interface{})
+	// Warningf logs to WARNING log. Arguments are handled in the manner of fmt.Printf.
+	Warningf(format string, args ...interface{})
+	// Error logs to ERROR log. Arguments are handled in the manner of fmt.Print.
+	Error(args ...interface{})
+	// Errorln logs to ERROR log. Arguments are handled in the manner of fmt.Println.
+	Errorln(args ...interface{})
+	// Errorf logs to ERROR log. Arguments are handled in the manner of fmt.Printf.
+	Errorf(format string, args ...interface{})
+	// Fatal logs to ERROR log. Arguments are handled in the manner of fmt.Print.
+	// gRPC ensures that all Fatal logs will exit with os.Exit(1).
+	// Implementations may also call os.Exit() with a non-zero exit code.
+	Fatal(args ...interface{})
+	// Fatalln logs to ERROR log. Arguments are handled in the manner of fmt.Println.
+	// gRPC ensures that all Fatal logs will exit with os.Exit(1).
+	// Implementations may also call os.Exit() with a non-zero exit code.
+	Fatalln(args ...interface{})
+	// Fatalf logs to ERROR log. Arguments are handled in the manner of fmt.Printf.
+	// gRPC ensures that all Fatal logs will exit with os.Exit(1).
+	// Implementations may also call os.Exit() with a non-zero exit code.
+	Fatalf(format string, args ...interface{})
+	// V reports whether verbosity level l is at least the requested verbose level.
+	V(l int) bool
+}
+
+// SetLoggerV2 sets logger that is used in grpc to a V2 logger.
+// Not mutex-protected, should be called before any gRPC functions.
+func SetLoggerV2(l LoggerV2) {
+	if _, ok := l.(*componentData); ok {
+		panic("cannot use component logger as grpclog logger")
+	}
+	grpclog.Logger = l
+	grpclog.DepthLogger, _ = l.(grpclog.DepthLoggerV2)
+}
+
+const (
+	// infoLog indicates Info severity.
+	infoLog int = iota
+	// warningLog indicates Warning severity.
+	warningLog
+	// errorLog indicates Error severity.
+	errorLog
+	// fatalLog indicates Fatal severity.
+	fatalLog
+)
+
+// severityName contains the string representation of each severity.
+var severityName = []string{
+	infoLog:    "INFO",
+	warningLog: "WARNING",
+	errorLog:   "ERROR",
+	fatalLog:   "FATAL",
+}
+
+// loggerT is the default logger used by grpclog.
+type loggerT struct {
+	m          []*log.Logger
+	v          int
+	jsonFormat bool
+}
+
+// NewLoggerV2 creates a loggerV2 with the provided writers.
+// Fatal logs will be written to errorW, warningW, infoW, followed by exit(1).
+// Error logs will be written to errorW, warningW and infoW.
+// Warning logs will be written to warningW and infoW.
+// Info logs will be written to infoW.
+func NewLoggerV2(infoW, warningW, errorW io.Writer) LoggerV2 {
+	return newLoggerV2WithConfig(infoW, warningW, errorW, loggerV2Config{})
+}
+
+// NewLoggerV2WithVerbosity creates a loggerV2 with the provided writers and
+// verbosity level.
+func NewLoggerV2WithVerbosity(infoW, warningW, errorW io.Writer, v int) LoggerV2 {
+	return newLoggerV2WithConfig(infoW, warningW, errorW, loggerV2Config{verbose: v})
+}
+
+type loggerV2Config struct {
+	verbose    int
+	jsonFormat bool
+}
+
+func newLoggerV2WithConfig(infoW, warningW, errorW io.Writer, c loggerV2Config) LoggerV2 {
+	var m []*log.Logger
+	flag := log.LstdFlags
+	if c.jsonFormat {
+		flag = 0
+	}
+	m = append(m, log.New(infoW, "", flag))
+	m = append(m, log.New(io.MultiWriter(infoW, warningW), "", flag))
+	ew := io.MultiWriter(infoW, warningW, errorW) // ew will be used for error and fatal.
+	m = append(m, log.New(ew, "", flag))
+	m = append(m, log.New(ew, "", flag))
+	return &loggerT{m: m, v: c.verbose, jsonFormat: c.jsonFormat}
+}
+
+// newLoggerV2 creates a loggerV2 to be used as default logger.
+// All logs are written to stderr.
+func newLoggerV2() LoggerV2 {
+	errorW := io.Discard
+	warningW := io.Discard
+	infoW := io.Discard
+
+	logLevel := os.Getenv("GRPC_GO_LOG_SEVERITY_LEVEL")
+	switch logLevel {
+	case "", "ERROR", "error": // If env is unset, set level to ERROR.
+		errorW = os.Stderr
+	case "WARNING", "warning":
+		warningW = os.Stderr
+	case "INFO", "info":
+		infoW = os.Stderr
+	}
+
+	var v int
+	vLevel := os.Getenv("GRPC_GO_LOG_VERBOSITY_LEVEL")
+	if vl, err := strconv.Atoi(vLevel); err == nil {
+		v = vl
+	}
+
+	jsonFormat := strings.EqualFold(os.Getenv("GRPC_GO_LOG_FORMATTER"), "json")
+
+	return newLoggerV2WithConfig(infoW, warningW, errorW, loggerV2Config{
+		verbose:    v,
+		jsonFormat: jsonFormat,
+	})
+}
+
+func (g *loggerT) output(severity int, s string) {
+	sevStr := severityName[severity]
+	if !g.jsonFormat {
+		g.m[severity].Output(2, fmt.Sprintf("%v: %v", sevStr, s))
+		return
+	}
+	// TODO: we can also include the logging component, but that needs more
+	// (API) changes.
+	b, _ := json.Marshal(map[string]string{
+		"severity": sevStr,
+		"message":  s,
+	})
+	g.m[severity].Output(2, string(b))
+}
+
+func (g *loggerT) Info(args ...interface{}) {
+	g.output(infoLog, fmt.Sprint(args...))
+}
+
+func (g *loggerT) Infoln(args ...interface{}) {
+	g.output(infoLog, fmt.Sprintln(args...))
+}
+
+func (g *loggerT) Infof(format string, args ...interface{}) {
+	g.output(infoLog, fmt.Sprintf(format, args...))
+}
+
+func (g *loggerT) Warning(args ...interface{}) {
+	g.output(warningLog, fmt.Sprint(args...))
+}
+
+func (g *loggerT) Warningln(args ...interface{}) {
+	g.output(warningLog, fmt.Sprintln(args...))
+}
+
+func (g *loggerT) Warningf(format string, args ...interface{}) {
+	g.output(warningLog, fmt.Sprintf(format, args...))
+}
+
+func (g *loggerT) Error(args ...interface{}) {
+	g.output(errorLog, fmt.Sprint(args...))
+}
+
+func (g *loggerT) Errorln(args ...interface{}) {
+	g.output(errorLog, fmt.Sprintln(args...))
+}
+
+func (g *loggerT) Errorf(format string, args ...interface{}) {
+	g.output(errorLog, fmt.Sprintf(format, args...))
+}
+
+func (g *loggerT) Fatal(args ...interface{}) {
+	g.output(fatalLog, fmt.Sprint(args...))
+	os.Exit(1)
+}
+
+func (g *loggerT) Fatalln(args ...interface{}) {
+	g.output(fatalLog, fmt.Sprintln(args...))
+	os.Exit(1)
+}
+
+func (g *loggerT) Fatalf(format string, args ...interface{}) {
+	g.output(fatalLog, fmt.Sprintf(format, args...))
+	os.Exit(1)
+}
+
+func (g *loggerT) V(l int) bool {
+	return l <= g.v
+}
+
+// DepthLoggerV2 logs at a specified call frame. If a LoggerV2 also implements
+// DepthLoggerV2, the below functions will be called with the appropriate stack
+// depth set for trivial functions the logger may ignore.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type DepthLoggerV2 interface {
+	LoggerV2
+	// InfoDepth logs to INFO log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	InfoDepth(depth int, args ...interface{})
+	// WarningDepth logs to WARNING log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	WarningDepth(depth int, args ...interface{})
+	// ErrorDepth logs to ERROR log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	ErrorDepth(depth int, args ...interface{})
+	// FatalDepth logs to FATAL log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	FatalDepth(depth int, args ...interface{})
+}
diff --git a/vendor/google.golang.org/grpc/interceptor.go b/vendor/google.golang.org/grpc/interceptor.go
new file mode 100644
index 0000000000..bb96ef57be
--- /dev/null
+++ b/vendor/google.golang.org/grpc/interceptor.go
@@ -0,0 +1,104 @@
+/*
+ *
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+)
+
+// UnaryInvoker is called by UnaryClientInterceptor to complete RPCs.
+type UnaryInvoker func(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, opts ...CallOption) error
+
+// UnaryClientInterceptor intercepts the execution of a unary RPC on the client.
+// Unary interceptors can be specified as a DialOption, using
+// WithUnaryInterceptor() or WithChainUnaryInterceptor(), when creating a
+// ClientConn. When a unary interceptor(s) is set on a ClientConn, gRPC
+// delegates all unary RPC invocations to the interceptor, and it is the
+// responsibility of the interceptor to call invoker to complete the processing
+// of the RPC.
+//
+// method is the RPC name. req and reply are the corresponding request and
+// response messages. cc is the ClientConn on which the RPC was invoked. invoker
+// is the handler to complete the RPC and it is the responsibility of the
+// interceptor to call it. opts contain all applicable call options, including
+// defaults from the ClientConn as well as per-call options.
+//
+// The returned error must be compatible with the status package.
+type UnaryClientInterceptor func(ctx context.Context, method string, req, reply interface{}, cc *ClientConn, invoker UnaryInvoker, opts ...CallOption) error
+
+// Streamer is called by StreamClientInterceptor to create a ClientStream.
+type Streamer func(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (ClientStream, error)
+
+// StreamClientInterceptor intercepts the creation of a ClientStream. Stream
+// interceptors can be specified as a DialOption, using WithStreamInterceptor()
+// or WithChainStreamInterceptor(), when creating a ClientConn. When a stream
+// interceptor(s) is set on the ClientConn, gRPC delegates all stream creations
+// to the interceptor, and it is the responsibility of the interceptor to call
+// streamer.
+//
+// desc contains a description of the stream. cc is the ClientConn on which the
+// RPC was invoked. streamer is the handler to create a ClientStream and it is
+// the responsibility of the interceptor to call it. opts contain all applicable
+// call options, including defaults from the ClientConn as well as per-call
+// options.
+//
+// StreamClientInterceptor may return a custom ClientStream to intercept all I/O
+// operations. The returned error must be compatible with the status package.
+type StreamClientInterceptor func(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, streamer Streamer, opts ...CallOption) (ClientStream, error)
+
+// UnaryServerInfo consists of various information about a unary RPC on
+// server side. All per-rpc information may be mutated by the interceptor.
+type UnaryServerInfo struct {
+	// Server is the service implementation the user provides. This is read-only.
+	Server interface{}
+	// FullMethod is the full RPC method string, i.e., /package.service/method.
+	FullMethod string
+}
+
+// UnaryHandler defines the handler invoked by UnaryServerInterceptor to complete the normal
+// execution of a unary RPC.
+//
+// If a UnaryHandler returns an error, it should either be produced by the
+// status package, or be one of the context errors. Otherwise, gRPC will use
+// codes.Unknown as the status code and err.Error() as the status message of the
+// RPC.
+type UnaryHandler func(ctx context.Context, req interface{}) (interface{}, error)
+
+// UnaryServerInterceptor provides a hook to intercept the execution of a unary RPC on the server. info
+// contains all the information of this RPC the interceptor can operate on. And handler is the wrapper
+// of the service method implementation. It is the responsibility of the interceptor to invoke handler
+// to complete the RPC.
+type UnaryServerInterceptor func(ctx context.Context, req interface{}, info *UnaryServerInfo, handler UnaryHandler) (resp interface{}, err error)
+
+// StreamServerInfo consists of various information about a streaming RPC on
+// server side. All per-rpc information may be mutated by the interceptor.
+type StreamServerInfo struct {
+	// FullMethod is the full RPC method string, i.e., /package.service/method.
+	FullMethod string
+	// IsClientStream indicates whether the RPC is a client streaming RPC.
+	IsClientStream bool
+	// IsServerStream indicates whether the RPC is a server streaming RPC.
+	IsServerStream bool
+}
+
+// StreamServerInterceptor provides a hook to intercept the execution of a streaming RPC on the server.
+// info contains all the information of this RPC the interceptor can operate on. And handler is the
+// service method implementation. It is the responsibility of the interceptor to invoke handler to
+// complete the RPC.
+type StreamServerInterceptor func(srv interface{}, ss ServerStream, info *StreamServerInfo, handler StreamHandler) error
diff --git a/vendor/google.golang.org/grpc/internal/backoff/backoff.go b/vendor/google.golang.org/grpc/internal/backoff/backoff.go
new file mode 100644
index 0000000000..5fc0ee3da5
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/backoff/backoff.go
@@ -0,0 +1,73 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package backoff implement the backoff strategy for gRPC.
+//
+// This is kept in internal until the gRPC project decides whether or not to
+// allow alternative backoff strategies.
+package backoff
+
+import (
+	"time"
+
+	grpcbackoff "google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/internal/grpcrand"
+)
+
+// Strategy defines the methodology for backing off after a grpc connection
+// failure.
+type Strategy interface {
+	// Backoff returns the amount of time to wait before the next retry given
+	// the number of consecutive failures.
+	Backoff(retries int) time.Duration
+}
+
+// DefaultExponential is an exponential backoff implementation using the
+// default values for all the configurable knobs defined in
+// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md.
+var DefaultExponential = Exponential{Config: grpcbackoff.DefaultConfig}
+
+// Exponential implements exponential backoff algorithm as defined in
+// https://github.com/grpc/grpc/blob/master/doc/connection-backoff.md.
+type Exponential struct {
+	// Config contains all options to configure the backoff algorithm.
+	Config grpcbackoff.Config
+}
+
+// Backoff returns the amount of time to wait before the next retry given the
+// number of retries.
+func (bc Exponential) Backoff(retries int) time.Duration {
+	if retries == 0 {
+		return bc.Config.BaseDelay
+	}
+	backoff, max := float64(bc.Config.BaseDelay), float64(bc.Config.MaxDelay)
+	for backoff < max && retries > 0 {
+		backoff *= bc.Config.Multiplier
+		retries--
+	}
+	if backoff > max {
+		backoff = max
+	}
+	// Randomize backoff delays so that if a cluster of requests start at
+	// the same time, they won't operate in lockstep.
+	backoff *= 1 + bc.Config.Jitter*(grpcrand.Float64()*2-1)
+	if backoff < 0 {
+		return 0
+	}
+	return time.Duration(backoff)
+}
diff --git a/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
new file mode 100644
index 0000000000..08666f62a7
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
@@ -0,0 +1,384 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package gracefulswitch implements a graceful switch load balancer.
+package gracefulswitch
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/balancer/base"
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/resolver"
+)
+
+var errBalancerClosed = errors.New("gracefulSwitchBalancer is closed")
+var _ balancer.Balancer = (*Balancer)(nil)
+
+// NewBalancer returns a graceful switch Balancer.
+func NewBalancer(cc balancer.ClientConn, opts balancer.BuildOptions) *Balancer {
+	return &Balancer{
+		cc:    cc,
+		bOpts: opts,
+	}
+}
+
+// Balancer is a utility to gracefully switch from one balancer to
+// a new balancer. It implements the balancer.Balancer interface.
+type Balancer struct {
+	bOpts balancer.BuildOptions
+	cc    balancer.ClientConn
+
+	// mu protects the following fields and all fields within balancerCurrent
+	// and balancerPending. mu does not need to be held when calling into the
+	// child balancers, as all calls into these children happen only as a direct
+	// result of a call into the gracefulSwitchBalancer, which are also
+	// guaranteed to be synchronous. There is one exception: an UpdateState call
+	// from a child balancer when current and pending are populated can lead to
+	// calling Close() on the current. To prevent that racing with an
+	// UpdateSubConnState from the channel, we hold currentMu during Close and
+	// UpdateSubConnState calls.
+	mu              sync.Mutex
+	balancerCurrent *balancerWrapper
+	balancerPending *balancerWrapper
+	closed          bool // set to true when this balancer is closed
+
+	// currentMu must be locked before mu. This mutex guards against this
+	// sequence of events: UpdateSubConnState() called, finds the
+	// balancerCurrent, gives up lock, updateState comes in, causes Close() on
+	// balancerCurrent before the UpdateSubConnState is called on the
+	// balancerCurrent.
+	currentMu sync.Mutex
+}
+
+// swap swaps out the current lb with the pending lb and updates the ClientConn.
+// The caller must hold gsb.mu.
+func (gsb *Balancer) swap() {
+	gsb.cc.UpdateState(gsb.balancerPending.lastState)
+	cur := gsb.balancerCurrent
+	gsb.balancerCurrent = gsb.balancerPending
+	gsb.balancerPending = nil
+	go func() {
+		gsb.currentMu.Lock()
+		defer gsb.currentMu.Unlock()
+		cur.Close()
+	}()
+}
+
+// Helper function that checks if the balancer passed in is current or pending.
+// The caller must hold gsb.mu.
+func (gsb *Balancer) balancerCurrentOrPending(bw *balancerWrapper) bool {
+	return bw == gsb.balancerCurrent || bw == gsb.balancerPending
+}
+
+// SwitchTo initializes the graceful switch process, which completes based on
+// connectivity state changes on the current/pending balancer. Thus, the switch
+// process is not complete when this method returns. This method must be called
+// synchronously alongside the rest of the balancer.Balancer methods this
+// Graceful Switch Balancer implements.
+func (gsb *Balancer) SwitchTo(builder balancer.Builder) error {
+	gsb.mu.Lock()
+	if gsb.closed {
+		gsb.mu.Unlock()
+		return errBalancerClosed
+	}
+	bw := &balancerWrapper{
+		gsb: gsb,
+		lastState: balancer.State{
+			ConnectivityState: connectivity.Connecting,
+			Picker:            base.NewErrPicker(balancer.ErrNoSubConnAvailable),
+		},
+		subconns: make(map[balancer.SubConn]bool),
+	}
+	balToClose := gsb.balancerPending // nil if there is no pending balancer
+	if gsb.balancerCurrent == nil {
+		gsb.balancerCurrent = bw
+	} else {
+		gsb.balancerPending = bw
+	}
+	gsb.mu.Unlock()
+	balToClose.Close()
+	// This function takes a builder instead of a balancer because builder.Build
+	// can call back inline, and this utility needs to handle the callbacks.
+	newBalancer := builder.Build(bw, gsb.bOpts)
+	if newBalancer == nil {
+		// This is illegal and should never happen; we clear the balancerWrapper
+		// we were constructing if it happens to avoid a potential panic.
+		gsb.mu.Lock()
+		if gsb.balancerPending != nil {
+			gsb.balancerPending = nil
+		} else {
+			gsb.balancerCurrent = nil
+		}
+		gsb.mu.Unlock()
+		return balancer.ErrBadResolverState
+	}
+
+	// This write doesn't need to take gsb.mu because this field never gets read
+	// or written to on any calls from the current or pending. Calls from grpc
+	// to this balancer are guaranteed to be called synchronously, so this
+	// bw.Balancer field will never be forwarded to until this SwitchTo()
+	// function returns.
+	bw.Balancer = newBalancer
+	return nil
+}
+
+// Returns nil if the graceful switch balancer is closed.
+func (gsb *Balancer) latestBalancer() *balancerWrapper {
+	gsb.mu.Lock()
+	defer gsb.mu.Unlock()
+	if gsb.balancerPending != nil {
+		return gsb.balancerPending
+	}
+	return gsb.balancerCurrent
+}
+
+// UpdateClientConnState forwards the update to the latest balancer created.
+func (gsb *Balancer) UpdateClientConnState(state balancer.ClientConnState) error {
+	// The resolver data is only relevant to the most recent LB Policy.
+	balToUpdate := gsb.latestBalancer()
+	if balToUpdate == nil {
+		return errBalancerClosed
+	}
+	// Perform this call without gsb.mu to prevent deadlocks if the child calls
+	// back into the channel. The latest balancer can never be closed during a
+	// call from the channel, even without gsb.mu held.
+	return balToUpdate.UpdateClientConnState(state)
+}
+
+// ResolverError forwards the error to the latest balancer created.
+func (gsb *Balancer) ResolverError(err error) {
+	// The resolver data is only relevant to the most recent LB Policy.
+	balToUpdate := gsb.latestBalancer()
+	if balToUpdate == nil {
+		return
+	}
+	// Perform this call without gsb.mu to prevent deadlocks if the child calls
+	// back into the channel. The latest balancer can never be closed during a
+	// call from the channel, even without gsb.mu held.
+	balToUpdate.ResolverError(err)
+}
+
+// ExitIdle forwards the call to the latest balancer created.
+//
+// If the latest balancer does not support ExitIdle, the subConns are
+// re-connected to manually.
+func (gsb *Balancer) ExitIdle() {
+	balToUpdate := gsb.latestBalancer()
+	if balToUpdate == nil {
+		return
+	}
+	// There is no need to protect this read with a mutex, as the write to the
+	// Balancer field happens in SwitchTo, which completes before this can be
+	// called.
+	if ei, ok := balToUpdate.Balancer.(balancer.ExitIdler); ok {
+		ei.ExitIdle()
+		return
+	}
+	gsb.mu.Lock()
+	defer gsb.mu.Unlock()
+	for sc := range balToUpdate.subconns {
+		sc.Connect()
+	}
+}
+
+// UpdateSubConnState forwards the update to the appropriate child.
+func (gsb *Balancer) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
+	gsb.currentMu.Lock()
+	defer gsb.currentMu.Unlock()
+	gsb.mu.Lock()
+	// Forward update to the appropriate child.  Even if there is a pending
+	// balancer, the current balancer should continue to get SubConn updates to
+	// maintain the proper state while the pending is still connecting.
+	var balToUpdate *balancerWrapper
+	if gsb.balancerCurrent != nil && gsb.balancerCurrent.subconns[sc] {
+		balToUpdate = gsb.balancerCurrent
+	} else if gsb.balancerPending != nil && gsb.balancerPending.subconns[sc] {
+		balToUpdate = gsb.balancerPending
+	}
+	gsb.mu.Unlock()
+	if balToUpdate == nil {
+		// SubConn belonged to a stale lb policy that has not yet fully closed,
+		// or the balancer was already closed.
+		return
+	}
+	balToUpdate.UpdateSubConnState(sc, state)
+}
+
+// Close closes any active child balancers.
+func (gsb *Balancer) Close() {
+	gsb.mu.Lock()
+	gsb.closed = true
+	currentBalancerToClose := gsb.balancerCurrent
+	gsb.balancerCurrent = nil
+	pendingBalancerToClose := gsb.balancerPending
+	gsb.balancerPending = nil
+	gsb.mu.Unlock()
+
+	currentBalancerToClose.Close()
+	pendingBalancerToClose.Close()
+}
+
+// balancerWrapper wraps a balancer.Balancer, and overrides some Balancer
+// methods to help cleanup SubConns created by the wrapped balancer.
+//
+// It implements the balancer.ClientConn interface and is passed down in that
+// capacity to the wrapped balancer. It maintains a set of subConns created by
+// the wrapped balancer and calls from the latter to create/update/remove
+// SubConns update this set before being forwarded to the parent ClientConn.
+// State updates from the wrapped balancer can result in invocation of the
+// graceful switch logic.
+type balancerWrapper struct {
+	balancer.Balancer
+	gsb *Balancer
+
+	lastState balancer.State
+	subconns  map[balancer.SubConn]bool // subconns created by this balancer
+}
+
+func (bw *balancerWrapper) UpdateSubConnState(sc balancer.SubConn, state balancer.SubConnState) {
+	if state.ConnectivityState == connectivity.Shutdown {
+		bw.gsb.mu.Lock()
+		delete(bw.subconns, sc)
+		bw.gsb.mu.Unlock()
+	}
+	// There is no need to protect this read with a mutex, as the write to the
+	// Balancer field happens in SwitchTo, which completes before this can be
+	// called.
+	bw.Balancer.UpdateSubConnState(sc, state)
+}
+
+// Close closes the underlying LB policy and removes the subconns it created. bw
+// must not be referenced via balancerCurrent or balancerPending in gsb when
+// called. gsb.mu must not be held.  Does not panic with a nil receiver.
+func (bw *balancerWrapper) Close() {
+	// before Close is called.
+	if bw == nil {
+		return
+	}
+	// There is no need to protect this read with a mutex, as Close() is
+	// impossible to be called concurrently with the write in SwitchTo(). The
+	// callsites of Close() for this balancer in Graceful Switch Balancer will
+	// never be called until SwitchTo() returns.
+	bw.Balancer.Close()
+	bw.gsb.mu.Lock()
+	for sc := range bw.subconns {
+		bw.gsb.cc.RemoveSubConn(sc)
+	}
+	bw.gsb.mu.Unlock()
+}
+
+func (bw *balancerWrapper) UpdateState(state balancer.State) {
+	// Hold the mutex for this entire call to ensure it cannot occur
+	// concurrently with other updateState() calls. This causes updates to
+	// lastState and calls to cc.UpdateState to happen atomically.
+	bw.gsb.mu.Lock()
+	defer bw.gsb.mu.Unlock()
+	bw.lastState = state
+
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		return
+	}
+
+	if bw == bw.gsb.balancerCurrent {
+		// In the case that the current balancer exits READY, and there is a pending
+		// balancer, you can forward the pending balancer's cached State up to
+		// ClientConn and swap the pending into the current. This is because there
+		// is no reason to gracefully switch from and keep using the old policy as
+		// the ClientConn is not connected to any backends.
+		if state.ConnectivityState != connectivity.Ready && bw.gsb.balancerPending != nil {
+			bw.gsb.swap()
+			return
+		}
+		// Even if there is a pending balancer waiting to be gracefully switched to,
+		// continue to forward current balancer updates to the Client Conn. Ignoring
+		// state + picker from the current would cause undefined behavior/cause the
+		// system to behave incorrectly from the current LB policies perspective.
+		// Also, the current LB is still being used by grpc to choose SubConns per
+		// RPC, and thus should use the most updated form of the current balancer.
+		bw.gsb.cc.UpdateState(state)
+		return
+	}
+	// This method is now dealing with a state update from the pending balancer.
+	// If the current balancer is currently in a state other than READY, the new
+	// policy can be swapped into place immediately. This is because there is no
+	// reason to gracefully switch from and keep using the old policy as the
+	// ClientConn is not connected to any backends.
+	if state.ConnectivityState != connectivity.Connecting || bw.gsb.balancerCurrent.lastState.ConnectivityState != connectivity.Ready {
+		bw.gsb.swap()
+	}
+}
+
+func (bw *balancerWrapper) NewSubConn(addrs []resolver.Address, opts balancer.NewSubConnOptions) (balancer.SubConn, error) {
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		bw.gsb.mu.Unlock()
+		return nil, fmt.Errorf("%T at address %p that called NewSubConn is deleted", bw, bw)
+	}
+	bw.gsb.mu.Unlock()
+
+	sc, err := bw.gsb.cc.NewSubConn(addrs, opts)
+	if err != nil {
+		return nil, err
+	}
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) { // balancer was closed during this call
+		bw.gsb.cc.RemoveSubConn(sc)
+		bw.gsb.mu.Unlock()
+		return nil, fmt.Errorf("%T at address %p that called NewSubConn is deleted", bw, bw)
+	}
+	bw.subconns[sc] = true
+	bw.gsb.mu.Unlock()
+	return sc, nil
+}
+
+func (bw *balancerWrapper) ResolveNow(opts resolver.ResolveNowOptions) {
+	// Ignore ResolveNow requests from anything other than the most recent
+	// balancer, because older balancers were already removed from the config.
+	if bw != bw.gsb.latestBalancer() {
+		return
+	}
+	bw.gsb.cc.ResolveNow(opts)
+}
+
+func (bw *balancerWrapper) RemoveSubConn(sc balancer.SubConn) {
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		bw.gsb.mu.Unlock()
+		return
+	}
+	bw.gsb.mu.Unlock()
+	bw.gsb.cc.RemoveSubConn(sc)
+}
+
+func (bw *balancerWrapper) UpdateAddresses(sc balancer.SubConn, addrs []resolver.Address) {
+	bw.gsb.mu.Lock()
+	if !bw.gsb.balancerCurrentOrPending(bw) {
+		bw.gsb.mu.Unlock()
+		return
+	}
+	bw.gsb.mu.Unlock()
+	bw.gsb.cc.UpdateAddresses(sc, addrs)
+}
+
+func (bw *balancerWrapper) Target() string {
+	return bw.gsb.cc.Target()
+}
diff --git a/vendor/google.golang.org/grpc/internal/balancerload/load.go b/vendor/google.golang.org/grpc/internal/balancerload/load.go
new file mode 100644
index 0000000000..3a905d9665
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/balancerload/load.go
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2019 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Package balancerload defines APIs to parse server loads in trailers. The
+// parsed loads are sent to balancers in DoneInfo.
+package balancerload
+
+import (
+	"google.golang.org/grpc/metadata"
+)
+
+// Parser converts loads from metadata into a concrete type.
+type Parser interface {
+	// Parse parses loads from metadata.
+	Parse(md metadata.MD) interface{}
+}
+
+var parser Parser
+
+// SetParser sets the load parser.
+//
+// Not mutex-protected, should be called before any gRPC functions.
+func SetParser(lr Parser) {
+	parser = lr
+}
+
+// Parse calls parser.Read().
+func Parse(md metadata.MD) interface{} {
+	if parser == nil {
+		return nil
+	}
+	return parser.Parse(md)
+}
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go b/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
new file mode 100644
index 0000000000..af03a40d99
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/binarylog/binarylog.go
@@ -0,0 +1,189 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package binarylog implementation binary logging as defined in
+// https://github.com/grpc/proposal/blob/master/A16-binary-logging.md.
+package binarylog
+
+import (
+	"fmt"
+	"os"
+
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/internal/grpcutil"
+)
+
+var grpclogLogger = grpclog.Component("binarylog")
+
+// Logger specifies MethodLoggers for method names with a Log call that
+// takes a context.
+type Logger interface {
+	GetMethodLogger(methodName string) MethodLogger
+}
+
+// binLogger is the global binary logger for the binary. One of this should be
+// built at init time from the configuration (environment variable or flags).
+//
+// It is used to get a MethodLogger for each individual method.
+var binLogger Logger
+
+// SetLogger sets the binary logger.
+//
+// Only call this at init time.
+func SetLogger(l Logger) {
+	binLogger = l
+}
+
+// GetLogger gets the binary logger.
+//
+// Only call this at init time.
+func GetLogger() Logger {
+	return binLogger
+}
+
+// GetMethodLogger returns the MethodLogger for the given methodName.
+//
+// methodName should be in the format of "/service/method".
+//
+// Each MethodLogger returned by this method is a new instance. This is to
+// generate sequence id within the call.
+func GetMethodLogger(methodName string) MethodLogger {
+	if binLogger == nil {
+		return nil
+	}
+	return binLogger.GetMethodLogger(methodName)
+}
+
+func init() {
+	const envStr = "GRPC_BINARY_LOG_FILTER"
+	configStr := os.Getenv(envStr)
+	binLogger = NewLoggerFromConfigString(configStr)
+}
+
+// MethodLoggerConfig contains the setting for logging behavior of a method
+// logger. Currently, it contains the max length of header and message.
+type MethodLoggerConfig struct {
+	// Max length of header and message.
+	Header, Message uint64
+}
+
+// LoggerConfig contains the config for loggers to create method loggers.
+type LoggerConfig struct {
+	All      *MethodLoggerConfig
+	Services map[string]*MethodLoggerConfig
+	Methods  map[string]*MethodLoggerConfig
+
+	Blacklist map[string]struct{}
+}
+
+type logger struct {
+	config LoggerConfig
+}
+
+// NewLoggerFromConfig builds a logger with the given LoggerConfig.
+func NewLoggerFromConfig(config LoggerConfig) Logger {
+	return &logger{config: config}
+}
+
+// newEmptyLogger creates an empty logger. The map fields need to be filled in
+// using the set* functions.
+func newEmptyLogger() *logger {
+	return &logger{}
+}
+
+// Set method logger for "*".
+func (l *logger) setDefaultMethodLogger(ml *MethodLoggerConfig) error {
+	if l.config.All != nil {
+		return fmt.Errorf("conflicting global rules found")
+	}
+	l.config.All = ml
+	return nil
+}
+
+// Set method logger for "service/*".
+//
+// New MethodLogger with same service overrides the old one.
+func (l *logger) setServiceMethodLogger(service string, ml *MethodLoggerConfig) error {
+	if _, ok := l.config.Services[service]; ok {
+		return fmt.Errorf("conflicting service rules for service %v found", service)
+	}
+	if l.config.Services == nil {
+		l.config.Services = make(map[string]*MethodLoggerConfig)
+	}
+	l.config.Services[service] = ml
+	return nil
+}
+
+// Set method logger for "service/method".
+//
+// New MethodLogger with same method overrides the old one.
+func (l *logger) setMethodMethodLogger(method string, ml *MethodLoggerConfig) error {
+	if _, ok := l.config.Blacklist[method]; ok {
+		return fmt.Errorf("conflicting blacklist rules for method %v found", method)
+	}
+	if _, ok := l.config.Methods[method]; ok {
+		return fmt.Errorf("conflicting method rules for method %v found", method)
+	}
+	if l.config.Methods == nil {
+		l.config.Methods = make(map[string]*MethodLoggerConfig)
+	}
+	l.config.Methods[method] = ml
+	return nil
+}
+
+// Set blacklist method for "-service/method".
+func (l *logger) setBlacklist(method string) error {
+	if _, ok := l.config.Blacklist[method]; ok {
+		return fmt.Errorf("conflicting blacklist rules for method %v found", method)
+	}
+	if _, ok := l.config.Methods[method]; ok {
+		return fmt.Errorf("conflicting method rules for method %v found", method)
+	}
+	if l.config.Blacklist == nil {
+		l.config.Blacklist = make(map[string]struct{})
+	}
+	l.config.Blacklist[method] = struct{}{}
+	return nil
+}
+
+// getMethodLogger returns the MethodLogger for the given methodName.
+//
+// methodName should be in the format of "/service/method".
+//
+// Each MethodLogger returned by this method is a new instance. This is to
+// generate sequence id within the call.
+func (l *logger) GetMethodLogger(methodName string) MethodLogger {
+	s, m, err := grpcutil.ParseMethod(methodName)
+	if err != nil {
+		grpclogLogger.Infof("binarylogging: failed to parse %q: %v", methodName, err)
+		return nil
+	}
+	if ml, ok := l.config.Methods[s+"/"+m]; ok {
+		return NewTruncatingMethodLogger(ml.Header, ml.Message)
+	}
+	if _, ok := l.config.Blacklist[s+"/"+m]; ok {
+		return nil
+	}
+	if ml, ok := l.config.Services[s]; ok {
+		return NewTruncatingMethodLogger(ml.Header, ml.Message)
+	}
+	if l.config.All == nil {
+		return nil
+	}
+	return NewTruncatingMethodLogger(l.config.All.Header, l.config.All.Message)
+}
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/binarylog_testutil.go b/vendor/google.golang.org/grpc/internal/binarylog/binarylog_testutil.go
new file mode 100644
index 0000000000..1ee00a39ac
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/binarylog/binarylog_testutil.go
@@ -0,0 +1,42 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// This file contains exported variables/functions that are exported for testing
+// only.
+//
+// An ideal way for this would be to put those in a *_test.go but in binarylog
+// package. But this doesn't work with staticcheck with go module. Error was:
+// "MdToMetadataProto not declared by package binarylog". This could be caused
+// by the way staticcheck looks for files for a certain package, which doesn't
+// support *_test.go files.
+//
+// Move those to binary_test.go when staticcheck is fixed.
+
+package binarylog
+
+var (
+	// AllLogger is a logger that logs all headers/messages for all RPCs. It's
+	// for testing only.
+	AllLogger = NewLoggerFromConfigString("*")
+	// MdToMetadataProto converts metadata to a binary logging proto message.
+	// It's for testing only.
+	MdToMetadataProto = mdToMetadataProto
+	// AddrToProto converts an address to a binary logging proto message. It's
+	// for testing only.
+	AddrToProto = addrToProto
+)
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/env_config.go b/vendor/google.golang.org/grpc/internal/binarylog/env_config.go
new file mode 100644
index 0000000000..f9e80e27ab
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/binarylog/env_config.go
@@ -0,0 +1,208 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package binarylog
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// NewLoggerFromConfigString reads the string and build a logger. It can be used
+// to build a new logger and assign it to binarylog.Logger.
+//
+// Example filter config strings:
+//   - "" Nothing will be logged
+//   - "*" All headers and messages will be fully logged.
+//   - "*{h}" Only headers will be logged.
+//   - "*{m:256}" Only the first 256 bytes of each message will be logged.
+//   - "Foo/*" Logs every method in service Foo
+//   - "Foo/*,-Foo/Bar" Logs every method in service Foo except method /Foo/Bar
+//   - "Foo/*,Foo/Bar{m:256}" Logs the first 256 bytes of each message in method
+//     /Foo/Bar, logs all headers and messages in every other method in service
+//     Foo.
+//
+// If two configs exist for one certain method or service, the one specified
+// later overrides the previous config.
+func NewLoggerFromConfigString(s string) Logger {
+	if s == "" {
+		return nil
+	}
+	l := newEmptyLogger()
+	methods := strings.Split(s, ",")
+	for _, method := range methods {
+		if err := l.fillMethodLoggerWithConfigString(method); err != nil {
+			grpclogLogger.Warningf("failed to parse binary log config: %v", err)
+			return nil
+		}
+	}
+	return l
+}
+
+// fillMethodLoggerWithConfigString parses config, creates TruncatingMethodLogger and adds
+// it to the right map in the logger.
+func (l *logger) fillMethodLoggerWithConfigString(config string) error {
+	// "" is invalid.
+	if config == "" {
+		return errors.New("empty string is not a valid method binary logging config")
+	}
+
+	// "-service/method", blacklist, no * or {} allowed.
+	if config[0] == '-' {
+		s, m, suffix, err := parseMethodConfigAndSuffix(config[1:])
+		if err != nil {
+			return fmt.Errorf("invalid config: %q, %v", config, err)
+		}
+		if m == "*" {
+			return fmt.Errorf("invalid config: %q, %v", config, "* not allowed in blacklist config")
+		}
+		if suffix != "" {
+			return fmt.Errorf("invalid config: %q, %v", config, "header/message limit not allowed in blacklist config")
+		}
+		if err := l.setBlacklist(s + "/" + m); err != nil {
+			return fmt.Errorf("invalid config: %v", err)
+		}
+		return nil
+	}
+
+	// "*{h:256;m:256}"
+	if config[0] == '*' {
+		hdr, msg, err := parseHeaderMessageLengthConfig(config[1:])
+		if err != nil {
+			return fmt.Errorf("invalid config: %q, %v", config, err)
+		}
+		if err := l.setDefaultMethodLogger(&MethodLoggerConfig{Header: hdr, Message: msg}); err != nil {
+			return fmt.Errorf("invalid config: %v", err)
+		}
+		return nil
+	}
+
+	s, m, suffix, err := parseMethodConfigAndSuffix(config)
+	if err != nil {
+		return fmt.Errorf("invalid config: %q, %v", config, err)
+	}
+	hdr, msg, err := parseHeaderMessageLengthConfig(suffix)
+	if err != nil {
+		return fmt.Errorf("invalid header/message length config: %q, %v", suffix, err)
+	}
+	if m == "*" {
+		if err := l.setServiceMethodLogger(s, &MethodLoggerConfig{Header: hdr, Message: msg}); err != nil {
+			return fmt.Errorf("invalid config: %v", err)
+		}
+	} else {
+		if err := l.setMethodMethodLogger(s+"/"+m, &MethodLoggerConfig{Header: hdr, Message: msg}); err != nil {
+			return fmt.Errorf("invalid config: %v", err)
+		}
+	}
+	return nil
+}
+
+const (
+	// TODO: this const is only used by env_config now. But could be useful for
+	// other config. Move to binarylog.go if necessary.
+	maxUInt = ^uint64(0)
+
+	// For "p.s/m" plus any suffix. Suffix will be parsed again. See test for
+	// expected output.
+	longMethodConfigRegexpStr = `^([\w./]+)/((?:\w+)|[*])(.+)?$`
+
+	// For suffix from above, "{h:123,m:123}". See test for expected output.
+	optionalLengthRegexpStr      = `(?::(\d+))?` // Optional ":123".
+	headerConfigRegexpStr        = `^{h` + optionalLengthRegexpStr + `}$`
+	messageConfigRegexpStr       = `^{m` + optionalLengthRegexpStr + `}$`
+	headerMessageConfigRegexpStr = `^{h` + optionalLengthRegexpStr + `;m` + optionalLengthRegexpStr + `}$`
+)
+
+var (
+	longMethodConfigRegexp    = regexp.MustCompile(longMethodConfigRegexpStr)
+	headerConfigRegexp        = regexp.MustCompile(headerConfigRegexpStr)
+	messageConfigRegexp       = regexp.MustCompile(messageConfigRegexpStr)
+	headerMessageConfigRegexp = regexp.MustCompile(headerMessageConfigRegexpStr)
+)
+
+// Turn "service/method{h;m}" into "service", "method", "{h;m}".
+func parseMethodConfigAndSuffix(c string) (service, method, suffix string, _ error) {
+	// Regexp result:
+	//
+	// in:  "p.s/m{h:123,m:123}",
+	// out: []string{"p.s/m{h:123,m:123}", "p.s", "m", "{h:123,m:123}"},
+	match := longMethodConfigRegexp.FindStringSubmatch(c)
+	if match == nil {
+		return "", "", "", fmt.Errorf("%q contains invalid substring", c)
+	}
+	service = match[1]
+	method = match[2]
+	suffix = match[3]
+	return
+}
+
+// Turn "{h:123;m:345}" into 123, 345.
+//
+// Return maxUInt if length is unspecified.
+func parseHeaderMessageLengthConfig(c string) (hdrLenStr, msgLenStr uint64, err error) {
+	if c == "" {
+		return maxUInt, maxUInt, nil
+	}
+	// Header config only.
+	if match := headerConfigRegexp.FindStringSubmatch(c); match != nil {
+		if s := match[1]; s != "" {
+			hdrLenStr, err = strconv.ParseUint(s, 10, 64)
+			if err != nil {
+				return 0, 0, fmt.Errorf("failed to convert %q to uint", s)
+			}
+			return hdrLenStr, 0, nil
+		}
+		return maxUInt, 0, nil
+	}
+
+	// Message config only.
+	if match := messageConfigRegexp.FindStringSubmatch(c); match != nil {
+		if s := match[1]; s != "" {
+			msgLenStr, err = strconv.ParseUint(s, 10, 64)
+			if err != nil {
+				return 0, 0, fmt.Errorf("failed to convert %q to uint", s)
+			}
+			return 0, msgLenStr, nil
+		}
+		return 0, maxUInt, nil
+	}
+
+	// Header and message config both.
+	if match := headerMessageConfigRegexp.FindStringSubmatch(c); match != nil {
+		// Both hdr and msg are specified, but one or two of them might be empty.
+		hdrLenStr = maxUInt
+		msgLenStr = maxUInt
+		if s := match[1]; s != "" {
+			hdrLenStr, err = strconv.ParseUint(s, 10, 64)
+			if err != nil {
+				return 0, 0, fmt.Errorf("failed to convert %q to uint", s)
+			}
+		}
+		if s := match[2]; s != "" {
+			msgLenStr, err = strconv.ParseUint(s, 10, 64)
+			if err != nil {
+				return 0, 0, fmt.Errorf("failed to convert %q to uint", s)
+			}
+		}
+		return hdrLenStr, msgLenStr, nil
+	}
+	return 0, 0, fmt.Errorf("%q contains invalid substring", c)
+}
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go b/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
new file mode 100644
index 0000000000..56fcf008d3
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
@@ -0,0 +1,436 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package binarylog
+
+import (
+	"context"
+	"net"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/golang/protobuf/ptypes"
+	binlogpb "google.golang.org/grpc/binarylog/grpc_binarylog_v1"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+type callIDGenerator struct {
+	id uint64
+}
+
+func (g *callIDGenerator) next() uint64 {
+	id := atomic.AddUint64(&g.id, 1)
+	return id
+}
+
+// reset is for testing only, and doesn't need to be thread safe.
+func (g *callIDGenerator) reset() {
+	g.id = 0
+}
+
+var idGen callIDGenerator
+
+// MethodLogger is the sub-logger for each method.
+type MethodLogger interface {
+	Log(context.Context, LogEntryConfig)
+}
+
+// TruncatingMethodLogger is a method logger that truncates headers and messages
+// based on configured fields.
+type TruncatingMethodLogger struct {
+	headerMaxLen, messageMaxLen uint64
+
+	callID          uint64
+	idWithinCallGen *callIDGenerator
+
+	sink Sink // TODO(blog): make this plugable.
+}
+
+// NewTruncatingMethodLogger returns a new truncating method logger.
+func NewTruncatingMethodLogger(h, m uint64) *TruncatingMethodLogger {
+	return &TruncatingMethodLogger{
+		headerMaxLen:  h,
+		messageMaxLen: m,
+
+		callID:          idGen.next(),
+		idWithinCallGen: &callIDGenerator{},
+
+		sink: DefaultSink, // TODO(blog): make it plugable.
+	}
+}
+
+// Build is an internal only method for building the proto message out of the
+// input event. It's made public to enable other library to reuse as much logic
+// in TruncatingMethodLogger as possible.
+func (ml *TruncatingMethodLogger) Build(c LogEntryConfig) *binlogpb.GrpcLogEntry {
+	m := c.toProto()
+	timestamp, _ := ptypes.TimestampProto(time.Now())
+	m.Timestamp = timestamp
+	m.CallId = ml.callID
+	m.SequenceIdWithinCall = ml.idWithinCallGen.next()
+
+	switch pay := m.Payload.(type) {
+	case *binlogpb.GrpcLogEntry_ClientHeader:
+		m.PayloadTruncated = ml.truncateMetadata(pay.ClientHeader.GetMetadata())
+	case *binlogpb.GrpcLogEntry_ServerHeader:
+		m.PayloadTruncated = ml.truncateMetadata(pay.ServerHeader.GetMetadata())
+	case *binlogpb.GrpcLogEntry_Message:
+		m.PayloadTruncated = ml.truncateMessage(pay.Message)
+	}
+	return m
+}
+
+// Log creates a proto binary log entry, and logs it to the sink.
+func (ml *TruncatingMethodLogger) Log(ctx context.Context, c LogEntryConfig) {
+	ml.sink.Write(ml.Build(c))
+}
+
+func (ml *TruncatingMethodLogger) truncateMetadata(mdPb *binlogpb.Metadata) (truncated bool) {
+	if ml.headerMaxLen == maxUInt {
+		return false
+	}
+	var (
+		bytesLimit = ml.headerMaxLen
+		index      int
+	)
+	// At the end of the loop, index will be the first entry where the total
+	// size is greater than the limit:
+	//
+	// len(entry[:index]) <= ml.hdr && len(entry[:index+1]) > ml.hdr.
+	for ; index < len(mdPb.Entry); index++ {
+		entry := mdPb.Entry[index]
+		if entry.Key == "grpc-trace-bin" {
+			// "grpc-trace-bin" is a special key. It's kept in the log entry,
+			// but not counted towards the size limit.
+			continue
+		}
+		currentEntryLen := uint64(len(entry.GetKey())) + uint64(len(entry.GetValue()))
+		if currentEntryLen > bytesLimit {
+			break
+		}
+		bytesLimit -= currentEntryLen
+	}
+	truncated = index < len(mdPb.Entry)
+	mdPb.Entry = mdPb.Entry[:index]
+	return truncated
+}
+
+func (ml *TruncatingMethodLogger) truncateMessage(msgPb *binlogpb.Message) (truncated bool) {
+	if ml.messageMaxLen == maxUInt {
+		return false
+	}
+	if ml.messageMaxLen >= uint64(len(msgPb.Data)) {
+		return false
+	}
+	msgPb.Data = msgPb.Data[:ml.messageMaxLen]
+	return true
+}
+
+// LogEntryConfig represents the configuration for binary log entry.
+type LogEntryConfig interface {
+	toProto() *binlogpb.GrpcLogEntry
+}
+
+// ClientHeader configs the binary log entry to be a ClientHeader entry.
+type ClientHeader struct {
+	OnClientSide bool
+	Header       metadata.MD
+	MethodName   string
+	Authority    string
+	Timeout      time.Duration
+	// PeerAddr is required only when it's on server side.
+	PeerAddr net.Addr
+}
+
+func (c *ClientHeader) toProto() *binlogpb.GrpcLogEntry {
+	// This function doesn't need to set all the fields (e.g. seq ID). The Log
+	// function will set the fields when necessary.
+	clientHeader := &binlogpb.ClientHeader{
+		Metadata:   mdToMetadataProto(c.Header),
+		MethodName: c.MethodName,
+		Authority:  c.Authority,
+	}
+	if c.Timeout > 0 {
+		clientHeader.Timeout = ptypes.DurationProto(c.Timeout)
+	}
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_CLIENT_HEADER,
+		Payload: &binlogpb.GrpcLogEntry_ClientHeader{
+			ClientHeader: clientHeader,
+		},
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	if c.PeerAddr != nil {
+		ret.Peer = addrToProto(c.PeerAddr)
+	}
+	return ret
+}
+
+// ServerHeader configs the binary log entry to be a ServerHeader entry.
+type ServerHeader struct {
+	OnClientSide bool
+	Header       metadata.MD
+	// PeerAddr is required only when it's on client side.
+	PeerAddr net.Addr
+}
+
+func (c *ServerHeader) toProto() *binlogpb.GrpcLogEntry {
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_SERVER_HEADER,
+		Payload: &binlogpb.GrpcLogEntry_ServerHeader{
+			ServerHeader: &binlogpb.ServerHeader{
+				Metadata: mdToMetadataProto(c.Header),
+			},
+		},
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	if c.PeerAddr != nil {
+		ret.Peer = addrToProto(c.PeerAddr)
+	}
+	return ret
+}
+
+// ClientMessage configs the binary log entry to be a ClientMessage entry.
+type ClientMessage struct {
+	OnClientSide bool
+	// Message can be a proto.Message or []byte. Other messages formats are not
+	// supported.
+	Message interface{}
+}
+
+func (c *ClientMessage) toProto() *binlogpb.GrpcLogEntry {
+	var (
+		data []byte
+		err  error
+	)
+	if m, ok := c.Message.(proto.Message); ok {
+		data, err = proto.Marshal(m)
+		if err != nil {
+			grpclogLogger.Infof("binarylogging: failed to marshal proto message: %v", err)
+		}
+	} else if b, ok := c.Message.([]byte); ok {
+		data = b
+	} else {
+		grpclogLogger.Infof("binarylogging: message to log is neither proto.message nor []byte")
+	}
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_CLIENT_MESSAGE,
+		Payload: &binlogpb.GrpcLogEntry_Message{
+			Message: &binlogpb.Message{
+				Length: uint32(len(data)),
+				Data:   data,
+			},
+		},
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	return ret
+}
+
+// ServerMessage configs the binary log entry to be a ServerMessage entry.
+type ServerMessage struct {
+	OnClientSide bool
+	// Message can be a proto.Message or []byte. Other messages formats are not
+	// supported.
+	Message interface{}
+}
+
+func (c *ServerMessage) toProto() *binlogpb.GrpcLogEntry {
+	var (
+		data []byte
+		err  error
+	)
+	if m, ok := c.Message.(proto.Message); ok {
+		data, err = proto.Marshal(m)
+		if err != nil {
+			grpclogLogger.Infof("binarylogging: failed to marshal proto message: %v", err)
+		}
+	} else if b, ok := c.Message.([]byte); ok {
+		data = b
+	} else {
+		grpclogLogger.Infof("binarylogging: message to log is neither proto.message nor []byte")
+	}
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_SERVER_MESSAGE,
+		Payload: &binlogpb.GrpcLogEntry_Message{
+			Message: &binlogpb.Message{
+				Length: uint32(len(data)),
+				Data:   data,
+			},
+		},
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	return ret
+}
+
+// ClientHalfClose configs the binary log entry to be a ClientHalfClose entry.
+type ClientHalfClose struct {
+	OnClientSide bool
+}
+
+func (c *ClientHalfClose) toProto() *binlogpb.GrpcLogEntry {
+	ret := &binlogpb.GrpcLogEntry{
+		Type:    binlogpb.GrpcLogEntry_EVENT_TYPE_CLIENT_HALF_CLOSE,
+		Payload: nil, // No payload here.
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	return ret
+}
+
+// ServerTrailer configs the binary log entry to be a ServerTrailer entry.
+type ServerTrailer struct {
+	OnClientSide bool
+	Trailer      metadata.MD
+	// Err is the status error.
+	Err error
+	// PeerAddr is required only when it's on client side and the RPC is trailer
+	// only.
+	PeerAddr net.Addr
+}
+
+func (c *ServerTrailer) toProto() *binlogpb.GrpcLogEntry {
+	st, ok := status.FromError(c.Err)
+	if !ok {
+		grpclogLogger.Info("binarylogging: error in trailer is not a status error")
+	}
+	var (
+		detailsBytes []byte
+		err          error
+	)
+	stProto := st.Proto()
+	if stProto != nil && len(stProto.Details) != 0 {
+		detailsBytes, err = proto.Marshal(stProto)
+		if err != nil {
+			grpclogLogger.Infof("binarylogging: failed to marshal status proto: %v", err)
+		}
+	}
+	ret := &binlogpb.GrpcLogEntry{
+		Type: binlogpb.GrpcLogEntry_EVENT_TYPE_SERVER_TRAILER,
+		Payload: &binlogpb.GrpcLogEntry_Trailer{
+			Trailer: &binlogpb.Trailer{
+				Metadata:      mdToMetadataProto(c.Trailer),
+				StatusCode:    uint32(st.Code()),
+				StatusMessage: st.Message(),
+				StatusDetails: detailsBytes,
+			},
+		},
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	if c.PeerAddr != nil {
+		ret.Peer = addrToProto(c.PeerAddr)
+	}
+	return ret
+}
+
+// Cancel configs the binary log entry to be a Cancel entry.
+type Cancel struct {
+	OnClientSide bool
+}
+
+func (c *Cancel) toProto() *binlogpb.GrpcLogEntry {
+	ret := &binlogpb.GrpcLogEntry{
+		Type:    binlogpb.GrpcLogEntry_EVENT_TYPE_CANCEL,
+		Payload: nil,
+	}
+	if c.OnClientSide {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_CLIENT
+	} else {
+		ret.Logger = binlogpb.GrpcLogEntry_LOGGER_SERVER
+	}
+	return ret
+}
+
+// metadataKeyOmit returns whether the metadata entry with this key should be
+// omitted.
+func metadataKeyOmit(key string) bool {
+	switch key {
+	case "lb-token", ":path", ":authority", "content-encoding", "content-type", "user-agent", "te":
+		return true
+	case "grpc-trace-bin": // grpc-trace-bin is special because it's visiable to users.
+		return false
+	}
+	return strings.HasPrefix(key, "grpc-")
+}
+
+func mdToMetadataProto(md metadata.MD) *binlogpb.Metadata {
+	ret := &binlogpb.Metadata{}
+	for k, vv := range md {
+		if metadataKeyOmit(k) {
+			continue
+		}
+		for _, v := range vv {
+			ret.Entry = append(ret.Entry,
+				&binlogpb.MetadataEntry{
+					Key:   k,
+					Value: []byte(v),
+				},
+			)
+		}
+	}
+	return ret
+}
+
+func addrToProto(addr net.Addr) *binlogpb.Address {
+	ret := &binlogpb.Address{}
+	switch a := addr.(type) {
+	case *net.TCPAddr:
+		if a.IP.To4() != nil {
+			ret.Type = binlogpb.Address_TYPE_IPV4
+		} else if a.IP.To16() != nil {
+			ret.Type = binlogpb.Address_TYPE_IPV6
+		} else {
+			ret.Type = binlogpb.Address_TYPE_UNKNOWN
+			// Do not set address and port fields.
+			break
+		}
+		ret.Address = a.IP.String()
+		ret.IpPort = uint32(a.Port)
+	case *net.UnixAddr:
+		ret.Type = binlogpb.Address_TYPE_UNIX
+		ret.Address = a.String()
+	default:
+		ret.Type = binlogpb.Address_TYPE_UNKNOWN
+	}
+	return ret
+}
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/sink.go b/vendor/google.golang.org/grpc/internal/binarylog/sink.go
new file mode 100644
index 0000000000..264de387c2
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/binarylog/sink.go
@@ -0,0 +1,170 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package binarylog
+
+import (
+	"bufio"
+	"encoding/binary"
+	"io"
+	"sync"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	binlogpb "google.golang.org/grpc/binarylog/grpc_binarylog_v1"
+)
+
+var (
+	// DefaultSink is the sink where the logs will be written to. It's exported
+	// for the binarylog package to update.
+	DefaultSink Sink = &noopSink{} // TODO(blog): change this default (file in /tmp).
+)
+
+// Sink writes log entry into the binary log sink.
+//
+// sink is a copy of the exported binarylog.Sink, to avoid circular dependency.
+type Sink interface {
+	// Write will be called to write the log entry into the sink.
+	//
+	// It should be thread-safe so it can be called in parallel.
+	Write(*binlogpb.GrpcLogEntry) error
+	// Close will be called when the Sink is replaced by a new Sink.
+	Close() error
+}
+
+type noopSink struct{}
+
+func (ns *noopSink) Write(*binlogpb.GrpcLogEntry) error { return nil }
+func (ns *noopSink) Close() error                       { return nil }
+
+// newWriterSink creates a binary log sink with the given writer.
+//
+// Write() marshals the proto message and writes it to the given writer. Each
+// message is prefixed with a 4 byte big endian unsigned integer as the length.
+//
+// No buffer is done, Close() doesn't try to close the writer.
+func newWriterSink(w io.Writer) Sink {
+	return &writerSink{out: w}
+}
+
+type writerSink struct {
+	out io.Writer
+}
+
+func (ws *writerSink) Write(e *binlogpb.GrpcLogEntry) error {
+	b, err := proto.Marshal(e)
+	if err != nil {
+		grpclogLogger.Errorf("binary logging: failed to marshal proto message: %v", err)
+		return err
+	}
+	hdr := make([]byte, 4)
+	binary.BigEndian.PutUint32(hdr, uint32(len(b)))
+	if _, err := ws.out.Write(hdr); err != nil {
+		return err
+	}
+	if _, err := ws.out.Write(b); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (ws *writerSink) Close() error { return nil }
+
+type bufferedSink struct {
+	mu             sync.Mutex
+	closer         io.Closer
+	out            Sink          // out is built on buf.
+	buf            *bufio.Writer // buf is kept for flush.
+	flusherStarted bool
+
+	writeTicker *time.Ticker
+	done        chan struct{}
+}
+
+func (fs *bufferedSink) Write(e *binlogpb.GrpcLogEntry) error {
+	fs.mu.Lock()
+	defer fs.mu.Unlock()
+	if !fs.flusherStarted {
+		// Start the write loop when Write is called.
+		fs.startFlushGoroutine()
+		fs.flusherStarted = true
+	}
+	if err := fs.out.Write(e); err != nil {
+		return err
+	}
+	return nil
+}
+
+const (
+	bufFlushDuration = 60 * time.Second
+)
+
+func (fs *bufferedSink) startFlushGoroutine() {
+	fs.writeTicker = time.NewTicker(bufFlushDuration)
+	go func() {
+		for {
+			select {
+			case <-fs.done:
+				return
+			case <-fs.writeTicker.C:
+			}
+			fs.mu.Lock()
+			if err := fs.buf.Flush(); err != nil {
+				grpclogLogger.Warningf("failed to flush to Sink: %v", err)
+			}
+			fs.mu.Unlock()
+		}
+	}()
+}
+
+func (fs *bufferedSink) Close() error {
+	fs.mu.Lock()
+	defer fs.mu.Unlock()
+	if fs.writeTicker != nil {
+		fs.writeTicker.Stop()
+	}
+	close(fs.done)
+	if err := fs.buf.Flush(); err != nil {
+		grpclogLogger.Warningf("failed to flush to Sink: %v", err)
+	}
+	if err := fs.closer.Close(); err != nil {
+		grpclogLogger.Warningf("failed to close the underlying WriterCloser: %v", err)
+	}
+	if err := fs.out.Close(); err != nil {
+		grpclogLogger.Warningf("failed to close the Sink: %v", err)
+	}
+	return nil
+}
+
+// NewBufferedSink creates a binary log sink with the given WriteCloser.
+//
+// Write() marshals the proto message and writes it to the given writer. Each
+// message is prefixed with a 4 byte big endian unsigned integer as the length.
+//
+// Content is kept in a buffer, and is flushed every 60 seconds.
+//
+// Close closes the WriteCloser.
+func NewBufferedSink(o io.WriteCloser) Sink {
+	bufW := bufio.NewWriter(o)
+	return &bufferedSink{
+		closer: o,
+		out:    newWriterSink(bufW),
+		buf:    bufW,
+		done:   make(chan struct{}),
+	}
+}
diff --git a/vendor/google.golang.org/grpc/internal/buffer/unbounded.go b/vendor/google.golang.org/grpc/internal/buffer/unbounded.go
new file mode 100644
index 0000000000..9f6a0c1200
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/buffer/unbounded.go
@@ -0,0 +1,85 @@
+/*
+ * Copyright 2019 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package buffer provides an implementation of an unbounded buffer.
+package buffer
+
+import "sync"
+
+// Unbounded is an implementation of an unbounded buffer which does not use
+// extra goroutines. This is typically used for passing updates from one entity
+// to another within gRPC.
+//
+// All methods on this type are thread-safe and don't block on anything except
+// the underlying mutex used for synchronization.
+//
+// Unbounded supports values of any type to be stored in it by using a channel
+// of `interface{}`. This means that a call to Put() incurs an extra memory
+// allocation, and also that users need a type assertion while reading. For
+// performance critical code paths, using Unbounded is strongly discouraged and
+// defining a new type specific implementation of this buffer is preferred. See
+// internal/transport/transport.go for an example of this.
+type Unbounded struct {
+	c       chan interface{}
+	mu      sync.Mutex
+	backlog []interface{}
+}
+
+// NewUnbounded returns a new instance of Unbounded.
+func NewUnbounded() *Unbounded {
+	return &Unbounded{c: make(chan interface{}, 1)}
+}
+
+// Put adds t to the unbounded buffer.
+func (b *Unbounded) Put(t interface{}) {
+	b.mu.Lock()
+	if len(b.backlog) == 0 {
+		select {
+		case b.c <- t:
+			b.mu.Unlock()
+			return
+		default:
+		}
+	}
+	b.backlog = append(b.backlog, t)
+	b.mu.Unlock()
+}
+
+// Load sends the earliest buffered data, if any, onto the read channel
+// returned by Get(). Users are expected to call this every time they read a
+// value from the read channel.
+func (b *Unbounded) Load() {
+	b.mu.Lock()
+	if len(b.backlog) > 0 {
+		select {
+		case b.c <- b.backlog[0]:
+			b.backlog[0] = nil
+			b.backlog = b.backlog[1:]
+		default:
+		}
+	}
+	b.mu.Unlock()
+}
+
+// Get returns a read channel on which values added to the buffer, via Put(),
+// are sent on.
+//
+// Upon reading a value from this channel, users are expected to call Load() to
+// send the next buffered value onto the channel if there is any.
+func (b *Unbounded) Get() <-chan interface{} {
+	return b.c
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/funcs.go b/vendor/google.golang.org/grpc/internal/channelz/funcs.go
new file mode 100644
index 0000000000..777cbcd792
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/funcs.go
@@ -0,0 +1,789 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package channelz defines APIs for enabling channelz service, entry
+// registration/deletion, and accessing channelz data. It also defines channelz
+// metric struct formats.
+//
+// All APIs in this package are experimental.
+package channelz
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"google.golang.org/grpc/grpclog"
+)
+
+const (
+	defaultMaxTraceEntry int32 = 30
+)
+
+var (
+	db    dbWrapper
+	idGen idGenerator
+	// EntryPerPage defines the number of channelz entries to be shown on a web page.
+	EntryPerPage  = int64(50)
+	curState      int32
+	maxTraceEntry = defaultMaxTraceEntry
+)
+
+// TurnOn turns on channelz data collection.
+func TurnOn() {
+	if !IsOn() {
+		db.set(newChannelMap())
+		idGen.reset()
+		atomic.StoreInt32(&curState, 1)
+	}
+}
+
+// IsOn returns whether channelz data collection is on.
+func IsOn() bool {
+	return atomic.CompareAndSwapInt32(&curState, 1, 1)
+}
+
+// SetMaxTraceEntry sets maximum number of trace entry per entity (i.e. channel/subchannel).
+// Setting it to 0 will disable channel tracing.
+func SetMaxTraceEntry(i int32) {
+	atomic.StoreInt32(&maxTraceEntry, i)
+}
+
+// ResetMaxTraceEntryToDefault resets the maximum number of trace entry per entity to default.
+func ResetMaxTraceEntryToDefault() {
+	atomic.StoreInt32(&maxTraceEntry, defaultMaxTraceEntry)
+}
+
+func getMaxTraceEntry() int {
+	i := atomic.LoadInt32(&maxTraceEntry)
+	return int(i)
+}
+
+// dbWarpper wraps around a reference to internal channelz data storage, and
+// provide synchronized functionality to set and get the reference.
+type dbWrapper struct {
+	mu sync.RWMutex
+	DB *channelMap
+}
+
+func (d *dbWrapper) set(db *channelMap) {
+	d.mu.Lock()
+	d.DB = db
+	d.mu.Unlock()
+}
+
+func (d *dbWrapper) get() *channelMap {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	return d.DB
+}
+
+// NewChannelzStorageForTesting initializes channelz data storage and id
+// generator for testing purposes.
+//
+// Returns a cleanup function to be invoked by the test, which waits for up to
+// 10s for all channelz state to be reset by the grpc goroutines when those
+// entities get closed. This cleanup function helps with ensuring that tests
+// don't mess up each other.
+func NewChannelzStorageForTesting() (cleanup func() error) {
+	db.set(newChannelMap())
+	idGen.reset()
+
+	return func() error {
+		cm := db.get()
+		if cm == nil {
+			return nil
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		ticker := time.NewTicker(10 * time.Millisecond)
+		defer ticker.Stop()
+		for {
+			cm.mu.RLock()
+			topLevelChannels, servers, channels, subChannels, listenSockets, normalSockets := len(cm.topLevelChannels), len(cm.servers), len(cm.channels), len(cm.subChannels), len(cm.listenSockets), len(cm.normalSockets)
+			cm.mu.RUnlock()
+
+			if err := ctx.Err(); err != nil {
+				return fmt.Errorf("after 10s the channelz map has not been cleaned up yet, topchannels: %d, servers: %d, channels: %d, subchannels: %d, listen sockets: %d, normal sockets: %d", topLevelChannels, servers, channels, subChannels, listenSockets, normalSockets)
+			}
+			if topLevelChannels == 0 && servers == 0 && channels == 0 && subChannels == 0 && listenSockets == 0 && normalSockets == 0 {
+				return nil
+			}
+			<-ticker.C
+		}
+	}
+}
+
+// GetTopChannels returns a slice of top channel's ChannelMetric, along with a
+// boolean indicating whether there's more top channels to be queried for.
+//
+// The arg id specifies that only top channel with id at or above it will be included
+// in the result. The returned slice is up to a length of the arg maxResults or
+// EntryPerPage if maxResults is zero, and is sorted in ascending id order.
+func GetTopChannels(id int64, maxResults int64) ([]*ChannelMetric, bool) {
+	return db.get().GetTopChannels(id, maxResults)
+}
+
+// GetServers returns a slice of server's ServerMetric, along with a
+// boolean indicating whether there's more servers to be queried for.
+//
+// The arg id specifies that only server with id at or above it will be included
+// in the result. The returned slice is up to a length of the arg maxResults or
+// EntryPerPage if maxResults is zero, and is sorted in ascending id order.
+func GetServers(id int64, maxResults int64) ([]*ServerMetric, bool) {
+	return db.get().GetServers(id, maxResults)
+}
+
+// GetServerSockets returns a slice of server's (identified by id) normal socket's
+// SocketMetric, along with a boolean indicating whether there's more sockets to
+// be queried for.
+//
+// The arg startID specifies that only sockets with id at or above it will be
+// included in the result. The returned slice is up to a length of the arg maxResults
+// or EntryPerPage if maxResults is zero, and is sorted in ascending id order.
+func GetServerSockets(id int64, startID int64, maxResults int64) ([]*SocketMetric, bool) {
+	return db.get().GetServerSockets(id, startID, maxResults)
+}
+
+// GetChannel returns the ChannelMetric for the channel (identified by id).
+func GetChannel(id int64) *ChannelMetric {
+	return db.get().GetChannel(id)
+}
+
+// GetSubChannel returns the SubChannelMetric for the subchannel (identified by id).
+func GetSubChannel(id int64) *SubChannelMetric {
+	return db.get().GetSubChannel(id)
+}
+
+// GetSocket returns the SocketInternalMetric for the socket (identified by id).
+func GetSocket(id int64) *SocketMetric {
+	return db.get().GetSocket(id)
+}
+
+// GetServer returns the ServerMetric for the server (identified by id).
+func GetServer(id int64) *ServerMetric {
+	return db.get().GetServer(id)
+}
+
+// RegisterChannel registers the given channel c in the channelz database with
+// ref as its reference name, and adds it to the child list of its parent
+// (identified by pid). pid == nil means no parent.
+//
+// Returns a unique channelz identifier assigned to this channel.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterChannel(c Channel, pid *Identifier, ref string) *Identifier {
+	id := idGen.genID()
+	var parent int64
+	isTopChannel := true
+	if pid != nil {
+		isTopChannel = false
+		parent = pid.Int()
+	}
+
+	if !IsOn() {
+		return newIdentifer(RefChannel, id, pid)
+	}
+
+	cn := &channel{
+		refName:     ref,
+		c:           c,
+		subChans:    make(map[int64]string),
+		nestedChans: make(map[int64]string),
+		id:          id,
+		pid:         parent,
+		trace:       &channelTrace{createdTime: time.Now(), events: make([]*TraceEvent, 0, getMaxTraceEntry())},
+	}
+	db.get().addChannel(id, cn, isTopChannel, parent)
+	return newIdentifer(RefChannel, id, pid)
+}
+
+// RegisterSubChannel registers the given subChannel c in the channelz database
+// with ref as its reference name, and adds it to the child list of its parent
+// (identified by pid).
+//
+// Returns a unique channelz identifier assigned to this subChannel.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterSubChannel(c Channel, pid *Identifier, ref string) (*Identifier, error) {
+	if pid == nil {
+		return nil, errors.New("a SubChannel's parent id cannot be nil")
+	}
+	id := idGen.genID()
+	if !IsOn() {
+		return newIdentifer(RefSubChannel, id, pid), nil
+	}
+
+	sc := &subChannel{
+		refName: ref,
+		c:       c,
+		sockets: make(map[int64]string),
+		id:      id,
+		pid:     pid.Int(),
+		trace:   &channelTrace{createdTime: time.Now(), events: make([]*TraceEvent, 0, getMaxTraceEntry())},
+	}
+	db.get().addSubChannel(id, sc, pid.Int())
+	return newIdentifer(RefSubChannel, id, pid), nil
+}
+
+// RegisterServer registers the given server s in channelz database. It returns
+// the unique channelz tracking id assigned to this server.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterServer(s Server, ref string) *Identifier {
+	id := idGen.genID()
+	if !IsOn() {
+		return newIdentifer(RefServer, id, nil)
+	}
+
+	svr := &server{
+		refName:       ref,
+		s:             s,
+		sockets:       make(map[int64]string),
+		listenSockets: make(map[int64]string),
+		id:            id,
+	}
+	db.get().addServer(id, svr)
+	return newIdentifer(RefServer, id, nil)
+}
+
+// RegisterListenSocket registers the given listen socket s in channelz database
+// with ref as its reference name, and add it to the child list of its parent
+// (identified by pid). It returns the unique channelz tracking id assigned to
+// this listen socket.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterListenSocket(s Socket, pid *Identifier, ref string) (*Identifier, error) {
+	if pid == nil {
+		return nil, errors.New("a ListenSocket's parent id cannot be 0")
+	}
+	id := idGen.genID()
+	if !IsOn() {
+		return newIdentifer(RefListenSocket, id, pid), nil
+	}
+
+	ls := &listenSocket{refName: ref, s: s, id: id, pid: pid.Int()}
+	db.get().addListenSocket(id, ls, pid.Int())
+	return newIdentifer(RefListenSocket, id, pid), nil
+}
+
+// RegisterNormalSocket registers the given normal socket s in channelz database
+// with ref as its reference name, and adds it to the child list of its parent
+// (identified by pid). It returns the unique channelz tracking id assigned to
+// this normal socket.
+//
+// If channelz is not turned ON, the channelz database is not mutated.
+func RegisterNormalSocket(s Socket, pid *Identifier, ref string) (*Identifier, error) {
+	if pid == nil {
+		return nil, errors.New("a NormalSocket's parent id cannot be 0")
+	}
+	id := idGen.genID()
+	if !IsOn() {
+		return newIdentifer(RefNormalSocket, id, pid), nil
+	}
+
+	ns := &normalSocket{refName: ref, s: s, id: id, pid: pid.Int()}
+	db.get().addNormalSocket(id, ns, pid.Int())
+	return newIdentifer(RefNormalSocket, id, pid), nil
+}
+
+// RemoveEntry removes an entry with unique channelz tracking id to be id from
+// channelz database.
+//
+// If channelz is not turned ON, this function is a no-op.
+func RemoveEntry(id *Identifier) {
+	if !IsOn() {
+		return
+	}
+	db.get().removeEntry(id.Int())
+}
+
+// TraceEventDesc is what the caller of AddTraceEvent should provide to describe
+// the event to be added to the channel trace.
+//
+// The Parent field is optional. It is used for an event that will be recorded
+// in the entity's parent trace.
+type TraceEventDesc struct {
+	Desc     string
+	Severity Severity
+	Parent   *TraceEventDesc
+}
+
+// AddTraceEvent adds trace related to the entity with specified id, using the
+// provided TraceEventDesc.
+//
+// If channelz is not turned ON, this will simply log the event descriptions.
+func AddTraceEvent(l grpclog.DepthLoggerV2, id *Identifier, depth int, desc *TraceEventDesc) {
+	// Log only the trace description associated with the bottom most entity.
+	switch desc.Severity {
+	case CtUnknown, CtInfo:
+		l.InfoDepth(depth+1, withParens(id)+desc.Desc)
+	case CtWarning:
+		l.WarningDepth(depth+1, withParens(id)+desc.Desc)
+	case CtError:
+		l.ErrorDepth(depth+1, withParens(id)+desc.Desc)
+	}
+
+	if getMaxTraceEntry() == 0 {
+		return
+	}
+	if IsOn() {
+		db.get().traceEvent(id.Int(), desc)
+	}
+}
+
+// channelMap is the storage data structure for channelz.
+// Methods of channelMap can be divided in two two categories with respect to locking.
+// 1. Methods acquire the global lock.
+// 2. Methods that can only be called when global lock is held.
+// A second type of method need always to be called inside a first type of method.
+type channelMap struct {
+	mu               sync.RWMutex
+	topLevelChannels map[int64]struct{}
+	servers          map[int64]*server
+	channels         map[int64]*channel
+	subChannels      map[int64]*subChannel
+	listenSockets    map[int64]*listenSocket
+	normalSockets    map[int64]*normalSocket
+}
+
+func newChannelMap() *channelMap {
+	return &channelMap{
+		topLevelChannels: make(map[int64]struct{}),
+		channels:         make(map[int64]*channel),
+		listenSockets:    make(map[int64]*listenSocket),
+		normalSockets:    make(map[int64]*normalSocket),
+		servers:          make(map[int64]*server),
+		subChannels:      make(map[int64]*subChannel),
+	}
+}
+
+func (c *channelMap) addServer(id int64, s *server) {
+	c.mu.Lock()
+	s.cm = c
+	c.servers[id] = s
+	c.mu.Unlock()
+}
+
+func (c *channelMap) addChannel(id int64, cn *channel, isTopChannel bool, pid int64) {
+	c.mu.Lock()
+	cn.cm = c
+	cn.trace.cm = c
+	c.channels[id] = cn
+	if isTopChannel {
+		c.topLevelChannels[id] = struct{}{}
+	} else {
+		c.findEntry(pid).addChild(id, cn)
+	}
+	c.mu.Unlock()
+}
+
+func (c *channelMap) addSubChannel(id int64, sc *subChannel, pid int64) {
+	c.mu.Lock()
+	sc.cm = c
+	sc.trace.cm = c
+	c.subChannels[id] = sc
+	c.findEntry(pid).addChild(id, sc)
+	c.mu.Unlock()
+}
+
+func (c *channelMap) addListenSocket(id int64, ls *listenSocket, pid int64) {
+	c.mu.Lock()
+	ls.cm = c
+	c.listenSockets[id] = ls
+	c.findEntry(pid).addChild(id, ls)
+	c.mu.Unlock()
+}
+
+func (c *channelMap) addNormalSocket(id int64, ns *normalSocket, pid int64) {
+	c.mu.Lock()
+	ns.cm = c
+	c.normalSockets[id] = ns
+	c.findEntry(pid).addChild(id, ns)
+	c.mu.Unlock()
+}
+
+// removeEntry triggers the removal of an entry, which may not indeed delete the entry, if it has to
+// wait on the deletion of its children and until no other entity's channel trace references it.
+// It may lead to a chain of entry deletion. For example, deleting the last socket of a gracefully
+// shutting down server will lead to the server being also deleted.
+func (c *channelMap) removeEntry(id int64) {
+	c.mu.Lock()
+	c.findEntry(id).triggerDelete()
+	c.mu.Unlock()
+}
+
+// c.mu must be held by the caller
+func (c *channelMap) decrTraceRefCount(id int64) {
+	e := c.findEntry(id)
+	if v, ok := e.(tracedChannel); ok {
+		v.decrTraceRefCount()
+		e.deleteSelfIfReady()
+	}
+}
+
+// c.mu must be held by the caller.
+func (c *channelMap) findEntry(id int64) entry {
+	var v entry
+	var ok bool
+	if v, ok = c.channels[id]; ok {
+		return v
+	}
+	if v, ok = c.subChannels[id]; ok {
+		return v
+	}
+	if v, ok = c.servers[id]; ok {
+		return v
+	}
+	if v, ok = c.listenSockets[id]; ok {
+		return v
+	}
+	if v, ok = c.normalSockets[id]; ok {
+		return v
+	}
+	return &dummyEntry{idNotFound: id}
+}
+
+// c.mu must be held by the caller
+// deleteEntry simply deletes an entry from the channelMap. Before calling this
+// method, caller must check this entry is ready to be deleted, i.e removeEntry()
+// has been called on it, and no children still exist.
+// Conditionals are ordered by the expected frequency of deletion of each entity
+// type, in order to optimize performance.
+func (c *channelMap) deleteEntry(id int64) {
+	var ok bool
+	if _, ok = c.normalSockets[id]; ok {
+		delete(c.normalSockets, id)
+		return
+	}
+	if _, ok = c.subChannels[id]; ok {
+		delete(c.subChannels, id)
+		return
+	}
+	if _, ok = c.channels[id]; ok {
+		delete(c.channels, id)
+		delete(c.topLevelChannels, id)
+		return
+	}
+	if _, ok = c.listenSockets[id]; ok {
+		delete(c.listenSockets, id)
+		return
+	}
+	if _, ok = c.servers[id]; ok {
+		delete(c.servers, id)
+		return
+	}
+}
+
+func (c *channelMap) traceEvent(id int64, desc *TraceEventDesc) {
+	c.mu.Lock()
+	child := c.findEntry(id)
+	childTC, ok := child.(tracedChannel)
+	if !ok {
+		c.mu.Unlock()
+		return
+	}
+	childTC.getChannelTrace().append(&TraceEvent{Desc: desc.Desc, Severity: desc.Severity, Timestamp: time.Now()})
+	if desc.Parent != nil {
+		parent := c.findEntry(child.getParentID())
+		var chanType RefChannelType
+		switch child.(type) {
+		case *channel:
+			chanType = RefChannel
+		case *subChannel:
+			chanType = RefSubChannel
+		}
+		if parentTC, ok := parent.(tracedChannel); ok {
+			parentTC.getChannelTrace().append(&TraceEvent{
+				Desc:      desc.Parent.Desc,
+				Severity:  desc.Parent.Severity,
+				Timestamp: time.Now(),
+				RefID:     id,
+				RefName:   childTC.getRefName(),
+				RefType:   chanType,
+			})
+			childTC.incrTraceRefCount()
+		}
+	}
+	c.mu.Unlock()
+}
+
+type int64Slice []int64
+
+func (s int64Slice) Len() int           { return len(s) }
+func (s int64Slice) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
+func (s int64Slice) Less(i, j int) bool { return s[i] < s[j] }
+
+func copyMap(m map[int64]string) map[int64]string {
+	n := make(map[int64]string)
+	for k, v := range m {
+		n[k] = v
+	}
+	return n
+}
+
+func min(a, b int64) int64 {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+func (c *channelMap) GetTopChannels(id int64, maxResults int64) ([]*ChannelMetric, bool) {
+	if maxResults <= 0 {
+		maxResults = EntryPerPage
+	}
+	c.mu.RLock()
+	l := int64(len(c.topLevelChannels))
+	ids := make([]int64, 0, l)
+	cns := make([]*channel, 0, min(l, maxResults))
+
+	for k := range c.topLevelChannels {
+		ids = append(ids, k)
+	}
+	sort.Sort(int64Slice(ids))
+	idx := sort.Search(len(ids), func(i int) bool { return ids[i] >= id })
+	count := int64(0)
+	var end bool
+	var t []*ChannelMetric
+	for i, v := range ids[idx:] {
+		if count == maxResults {
+			break
+		}
+		if cn, ok := c.channels[v]; ok {
+			cns = append(cns, cn)
+			t = append(t, &ChannelMetric{
+				NestedChans: copyMap(cn.nestedChans),
+				SubChans:    copyMap(cn.subChans),
+			})
+			count++
+		}
+		if i == len(ids[idx:])-1 {
+			end = true
+			break
+		}
+	}
+	c.mu.RUnlock()
+	if count == 0 {
+		end = true
+	}
+
+	for i, cn := range cns {
+		t[i].ChannelData = cn.c.ChannelzMetric()
+		t[i].ID = cn.id
+		t[i].RefName = cn.refName
+		t[i].Trace = cn.trace.dumpData()
+	}
+	return t, end
+}
+
+func (c *channelMap) GetServers(id, maxResults int64) ([]*ServerMetric, bool) {
+	if maxResults <= 0 {
+		maxResults = EntryPerPage
+	}
+	c.mu.RLock()
+	l := int64(len(c.servers))
+	ids := make([]int64, 0, l)
+	ss := make([]*server, 0, min(l, maxResults))
+	for k := range c.servers {
+		ids = append(ids, k)
+	}
+	sort.Sort(int64Slice(ids))
+	idx := sort.Search(len(ids), func(i int) bool { return ids[i] >= id })
+	count := int64(0)
+	var end bool
+	var s []*ServerMetric
+	for i, v := range ids[idx:] {
+		if count == maxResults {
+			break
+		}
+		if svr, ok := c.servers[v]; ok {
+			ss = append(ss, svr)
+			s = append(s, &ServerMetric{
+				ListenSockets: copyMap(svr.listenSockets),
+			})
+			count++
+		}
+		if i == len(ids[idx:])-1 {
+			end = true
+			break
+		}
+	}
+	c.mu.RUnlock()
+	if count == 0 {
+		end = true
+	}
+
+	for i, svr := range ss {
+		s[i].ServerData = svr.s.ChannelzMetric()
+		s[i].ID = svr.id
+		s[i].RefName = svr.refName
+	}
+	return s, end
+}
+
+func (c *channelMap) GetServerSockets(id int64, startID int64, maxResults int64) ([]*SocketMetric, bool) {
+	if maxResults <= 0 {
+		maxResults = EntryPerPage
+	}
+	var svr *server
+	var ok bool
+	c.mu.RLock()
+	if svr, ok = c.servers[id]; !ok {
+		// server with id doesn't exist.
+		c.mu.RUnlock()
+		return nil, true
+	}
+	svrskts := svr.sockets
+	l := int64(len(svrskts))
+	ids := make([]int64, 0, l)
+	sks := make([]*normalSocket, 0, min(l, maxResults))
+	for k := range svrskts {
+		ids = append(ids, k)
+	}
+	sort.Sort(int64Slice(ids))
+	idx := sort.Search(len(ids), func(i int) bool { return ids[i] >= startID })
+	count := int64(0)
+	var end bool
+	for i, v := range ids[idx:] {
+		if count == maxResults {
+			break
+		}
+		if ns, ok := c.normalSockets[v]; ok {
+			sks = append(sks, ns)
+			count++
+		}
+		if i == len(ids[idx:])-1 {
+			end = true
+			break
+		}
+	}
+	c.mu.RUnlock()
+	if count == 0 {
+		end = true
+	}
+	s := make([]*SocketMetric, 0, len(sks))
+	for _, ns := range sks {
+		sm := &SocketMetric{}
+		sm.SocketData = ns.s.ChannelzMetric()
+		sm.ID = ns.id
+		sm.RefName = ns.refName
+		s = append(s, sm)
+	}
+	return s, end
+}
+
+func (c *channelMap) GetChannel(id int64) *ChannelMetric {
+	cm := &ChannelMetric{}
+	var cn *channel
+	var ok bool
+	c.mu.RLock()
+	if cn, ok = c.channels[id]; !ok {
+		// channel with id doesn't exist.
+		c.mu.RUnlock()
+		return nil
+	}
+	cm.NestedChans = copyMap(cn.nestedChans)
+	cm.SubChans = copyMap(cn.subChans)
+	// cn.c can be set to &dummyChannel{} when deleteSelfFromMap is called. Save a copy of cn.c when
+	// holding the lock to prevent potential data race.
+	chanCopy := cn.c
+	c.mu.RUnlock()
+	cm.ChannelData = chanCopy.ChannelzMetric()
+	cm.ID = cn.id
+	cm.RefName = cn.refName
+	cm.Trace = cn.trace.dumpData()
+	return cm
+}
+
+func (c *channelMap) GetSubChannel(id int64) *SubChannelMetric {
+	cm := &SubChannelMetric{}
+	var sc *subChannel
+	var ok bool
+	c.mu.RLock()
+	if sc, ok = c.subChannels[id]; !ok {
+		// subchannel with id doesn't exist.
+		c.mu.RUnlock()
+		return nil
+	}
+	cm.Sockets = copyMap(sc.sockets)
+	// sc.c can be set to &dummyChannel{} when deleteSelfFromMap is called. Save a copy of sc.c when
+	// holding the lock to prevent potential data race.
+	chanCopy := sc.c
+	c.mu.RUnlock()
+	cm.ChannelData = chanCopy.ChannelzMetric()
+	cm.ID = sc.id
+	cm.RefName = sc.refName
+	cm.Trace = sc.trace.dumpData()
+	return cm
+}
+
+func (c *channelMap) GetSocket(id int64) *SocketMetric {
+	sm := &SocketMetric{}
+	c.mu.RLock()
+	if ls, ok := c.listenSockets[id]; ok {
+		c.mu.RUnlock()
+		sm.SocketData = ls.s.ChannelzMetric()
+		sm.ID = ls.id
+		sm.RefName = ls.refName
+		return sm
+	}
+	if ns, ok := c.normalSockets[id]; ok {
+		c.mu.RUnlock()
+		sm.SocketData = ns.s.ChannelzMetric()
+		sm.ID = ns.id
+		sm.RefName = ns.refName
+		return sm
+	}
+	c.mu.RUnlock()
+	return nil
+}
+
+func (c *channelMap) GetServer(id int64) *ServerMetric {
+	sm := &ServerMetric{}
+	var svr *server
+	var ok bool
+	c.mu.RLock()
+	if svr, ok = c.servers[id]; !ok {
+		c.mu.RUnlock()
+		return nil
+	}
+	sm.ListenSockets = copyMap(svr.listenSockets)
+	c.mu.RUnlock()
+	sm.ID = svr.id
+	sm.RefName = svr.refName
+	sm.ServerData = svr.s.ChannelzMetric()
+	return sm
+}
+
+type idGenerator struct {
+	id int64
+}
+
+func (i *idGenerator) reset() {
+	atomic.StoreInt64(&i.id, 0)
+}
+
+func (i *idGenerator) genID() int64 {
+	return atomic.AddInt64(&i.id, 1)
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/id.go b/vendor/google.golang.org/grpc/internal/channelz/id.go
new file mode 100644
index 0000000000..c9a27acd37
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/id.go
@@ -0,0 +1,75 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import "fmt"
+
+// Identifier is an opaque identifier which uniquely identifies an entity in the
+// channelz database.
+type Identifier struct {
+	typ RefChannelType
+	id  int64
+	str string
+	pid *Identifier
+}
+
+// Type returns the entity type corresponding to id.
+func (id *Identifier) Type() RefChannelType {
+	return id.typ
+}
+
+// Int returns the integer identifier corresponding to id.
+func (id *Identifier) Int() int64 {
+	return id.id
+}
+
+// String returns a string representation of the entity corresponding to id.
+//
+// This includes some information about the parent as well. Examples:
+// Top-level channel: [Channel #channel-number]
+// Nested channel:    [Channel #parent-channel-number Channel #channel-number]
+// Sub channel:       [Channel #parent-channel SubChannel #subchannel-number]
+func (id *Identifier) String() string {
+	return id.str
+}
+
+// Equal returns true if other is the same as id.
+func (id *Identifier) Equal(other *Identifier) bool {
+	if (id != nil) != (other != nil) {
+		return false
+	}
+	if id == nil && other == nil {
+		return true
+	}
+	return id.typ == other.typ && id.id == other.id && id.pid == other.pid
+}
+
+// NewIdentifierForTesting returns a new opaque identifier to be used only for
+// testing purposes.
+func NewIdentifierForTesting(typ RefChannelType, id int64, pid *Identifier) *Identifier {
+	return newIdentifer(typ, id, pid)
+}
+
+func newIdentifer(typ RefChannelType, id int64, pid *Identifier) *Identifier {
+	str := fmt.Sprintf("%s #%d", typ, id)
+	if pid != nil {
+		str = fmt.Sprintf("%s %s", pid, str)
+	}
+	return &Identifier{typ: typ, id: id, str: str, pid: pid}
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/logging.go b/vendor/google.golang.org/grpc/internal/channelz/logging.go
new file mode 100644
index 0000000000..8e13a3d2ce
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/logging.go
@@ -0,0 +1,79 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/grpclog"
+)
+
+var logger = grpclog.Component("channelz")
+
+func withParens(id *Identifier) string {
+	return "[" + id.String() + "] "
+}
+
+// Info logs and adds a trace event if channelz is on.
+func Info(l grpclog.DepthLoggerV2, id *Identifier, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprint(args...),
+		Severity: CtInfo,
+	})
+}
+
+// Infof logs and adds a trace event if channelz is on.
+func Infof(l grpclog.DepthLoggerV2, id *Identifier, format string, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprintf(format, args...),
+		Severity: CtInfo,
+	})
+}
+
+// Warning logs and adds a trace event if channelz is on.
+func Warning(l grpclog.DepthLoggerV2, id *Identifier, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprint(args...),
+		Severity: CtWarning,
+	})
+}
+
+// Warningf logs and adds a trace event if channelz is on.
+func Warningf(l grpclog.DepthLoggerV2, id *Identifier, format string, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprintf(format, args...),
+		Severity: CtWarning,
+	})
+}
+
+// Error logs and adds a trace event if channelz is on.
+func Error(l grpclog.DepthLoggerV2, id *Identifier, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprint(args...),
+		Severity: CtError,
+	})
+}
+
+// Errorf logs and adds a trace event if channelz is on.
+func Errorf(l grpclog.DepthLoggerV2, id *Identifier, format string, args ...interface{}) {
+	AddTraceEvent(l, id, 1, &TraceEventDesc{
+		Desc:     fmt.Sprintf(format, args...),
+		Severity: CtError,
+	})
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/types.go b/vendor/google.golang.org/grpc/internal/channelz/types.go
new file mode 100644
index 0000000000..7b2f350e2e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/types.go
@@ -0,0 +1,722 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import (
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/credentials"
+)
+
+// entry represents a node in the channelz database.
+type entry interface {
+	// addChild adds a child e, whose channelz id is id to child list
+	addChild(id int64, e entry)
+	// deleteChild deletes a child with channelz id to be id from child list
+	deleteChild(id int64)
+	// triggerDelete tries to delete self from channelz database. However, if child
+	// list is not empty, then deletion from the database is on hold until the last
+	// child is deleted from database.
+	triggerDelete()
+	// deleteSelfIfReady check whether triggerDelete() has been called before, and whether child
+	// list is now empty. If both conditions are met, then delete self from database.
+	deleteSelfIfReady()
+	// getParentID returns parent ID of the entry. 0 value parent ID means no parent.
+	getParentID() int64
+}
+
+// dummyEntry is a fake entry to handle entry not found case.
+type dummyEntry struct {
+	idNotFound int64
+}
+
+func (d *dummyEntry) addChild(id int64, e entry) {
+	// Note: It is possible for a normal program to reach here under race condition.
+	// For example, there could be a race between ClientConn.Close() info being propagated
+	// to addrConn and http2Client. ClientConn.Close() cancel the context and result
+	// in http2Client to error. The error info is then caught by transport monitor
+	// and before addrConn.tearDown() is called in side ClientConn.Close(). Therefore,
+	// the addrConn will create a new transport. And when registering the new transport in
+	// channelz, its parent addrConn could have already been torn down and deleted
+	// from channelz tracking, and thus reach the code here.
+	logger.Infof("attempt to add child of type %T with id %d to a parent (id=%d) that doesn't currently exist", e, id, d.idNotFound)
+}
+
+func (d *dummyEntry) deleteChild(id int64) {
+	// It is possible for a normal program to reach here under race condition.
+	// Refer to the example described in addChild().
+	logger.Infof("attempt to delete child with id %d from a parent (id=%d) that doesn't currently exist", id, d.idNotFound)
+}
+
+func (d *dummyEntry) triggerDelete() {
+	logger.Warningf("attempt to delete an entry (id=%d) that doesn't currently exist", d.idNotFound)
+}
+
+func (*dummyEntry) deleteSelfIfReady() {
+	// code should not reach here. deleteSelfIfReady is always called on an existing entry.
+}
+
+func (*dummyEntry) getParentID() int64 {
+	return 0
+}
+
+// ChannelMetric defines the info channelz provides for a specific Channel, which
+// includes ChannelInternalMetric and channelz-specific data, such as channelz id,
+// child list, etc.
+type ChannelMetric struct {
+	// ID is the channelz id of this channel.
+	ID int64
+	// RefName is the human readable reference string of this channel.
+	RefName string
+	// ChannelData contains channel internal metric reported by the channel through
+	// ChannelzMetric().
+	ChannelData *ChannelInternalMetric
+	// NestedChans tracks the nested channel type children of this channel in the format of
+	// a map from nested channel channelz id to corresponding reference string.
+	NestedChans map[int64]string
+	// SubChans tracks the subchannel type children of this channel in the format of a
+	// map from subchannel channelz id to corresponding reference string.
+	SubChans map[int64]string
+	// Sockets tracks the socket type children of this channel in the format of a map
+	// from socket channelz id to corresponding reference string.
+	// Note current grpc implementation doesn't allow channel having sockets directly,
+	// therefore, this is field is unused.
+	Sockets map[int64]string
+	// Trace contains the most recent traced events.
+	Trace *ChannelTrace
+}
+
+// SubChannelMetric defines the info channelz provides for a specific SubChannel,
+// which includes ChannelInternalMetric and channelz-specific data, such as
+// channelz id, child list, etc.
+type SubChannelMetric struct {
+	// ID is the channelz id of this subchannel.
+	ID int64
+	// RefName is the human readable reference string of this subchannel.
+	RefName string
+	// ChannelData contains subchannel internal metric reported by the subchannel
+	// through ChannelzMetric().
+	ChannelData *ChannelInternalMetric
+	// NestedChans tracks the nested channel type children of this subchannel in the format of
+	// a map from nested channel channelz id to corresponding reference string.
+	// Note current grpc implementation doesn't allow subchannel to have nested channels
+	// as children, therefore, this field is unused.
+	NestedChans map[int64]string
+	// SubChans tracks the subchannel type children of this subchannel in the format of a
+	// map from subchannel channelz id to corresponding reference string.
+	// Note current grpc implementation doesn't allow subchannel to have subchannels
+	// as children, therefore, this field is unused.
+	SubChans map[int64]string
+	// Sockets tracks the socket type children of this subchannel in the format of a map
+	// from socket channelz id to corresponding reference string.
+	Sockets map[int64]string
+	// Trace contains the most recent traced events.
+	Trace *ChannelTrace
+}
+
+// ChannelInternalMetric defines the struct that the implementor of Channel interface
+// should return from ChannelzMetric().
+type ChannelInternalMetric struct {
+	// current connectivity state of the channel.
+	State connectivity.State
+	// The target this channel originally tried to connect to.  May be absent
+	Target string
+	// The number of calls started on the channel.
+	CallsStarted int64
+	// The number of calls that have completed with an OK status.
+	CallsSucceeded int64
+	// The number of calls that have a completed with a non-OK status.
+	CallsFailed int64
+	// The last time a call was started on the channel.
+	LastCallStartedTimestamp time.Time
+}
+
+// ChannelTrace stores traced events on a channel/subchannel and related info.
+type ChannelTrace struct {
+	// EventNum is the number of events that ever got traced (i.e. including those that have been deleted)
+	EventNum int64
+	// CreationTime is the creation time of the trace.
+	CreationTime time.Time
+	// Events stores the most recent trace events (up to $maxTraceEntry, newer event will overwrite the
+	// oldest one)
+	Events []*TraceEvent
+}
+
+// TraceEvent represent a single trace event
+type TraceEvent struct {
+	// Desc is a simple description of the trace event.
+	Desc string
+	// Severity states the severity of this trace event.
+	Severity Severity
+	// Timestamp is the event time.
+	Timestamp time.Time
+	// RefID is the id of the entity that gets referenced in the event. RefID is 0 if no other entity is
+	// involved in this event.
+	// e.g. SubChannel (id: 4[]) Created. --> RefID = 4, RefName = "" (inside [])
+	RefID int64
+	// RefName is the reference name for the entity that gets referenced in the event.
+	RefName string
+	// RefType indicates the referenced entity type, i.e Channel or SubChannel.
+	RefType RefChannelType
+}
+
+// Channel is the interface that should be satisfied in order to be tracked by
+// channelz as Channel or SubChannel.
+type Channel interface {
+	ChannelzMetric() *ChannelInternalMetric
+}
+
+type dummyChannel struct{}
+
+func (d *dummyChannel) ChannelzMetric() *ChannelInternalMetric {
+	return &ChannelInternalMetric{}
+}
+
+type channel struct {
+	refName     string
+	c           Channel
+	closeCalled bool
+	nestedChans map[int64]string
+	subChans    map[int64]string
+	id          int64
+	pid         int64
+	cm          *channelMap
+	trace       *channelTrace
+	// traceRefCount is the number of trace events that reference this channel.
+	// Non-zero traceRefCount means the trace of this channel cannot be deleted.
+	traceRefCount int32
+}
+
+func (c *channel) addChild(id int64, e entry) {
+	switch v := e.(type) {
+	case *subChannel:
+		c.subChans[id] = v.refName
+	case *channel:
+		c.nestedChans[id] = v.refName
+	default:
+		logger.Errorf("cannot add a child (id = %d) of type %T to a channel", id, e)
+	}
+}
+
+func (c *channel) deleteChild(id int64) {
+	delete(c.subChans, id)
+	delete(c.nestedChans, id)
+	c.deleteSelfIfReady()
+}
+
+func (c *channel) triggerDelete() {
+	c.closeCalled = true
+	c.deleteSelfIfReady()
+}
+
+func (c *channel) getParentID() int64 {
+	return c.pid
+}
+
+// deleteSelfFromTree tries to delete the channel from the channelz entry relation tree, which means
+// deleting the channel reference from its parent's child list.
+//
+// In order for a channel to be deleted from the tree, it must meet the criteria that, removal of the
+// corresponding grpc object has been invoked, and the channel does not have any children left.
+//
+// The returned boolean value indicates whether the channel has been successfully deleted from tree.
+func (c *channel) deleteSelfFromTree() (deleted bool) {
+	if !c.closeCalled || len(c.subChans)+len(c.nestedChans) != 0 {
+		return false
+	}
+	// not top channel
+	if c.pid != 0 {
+		c.cm.findEntry(c.pid).deleteChild(c.id)
+	}
+	return true
+}
+
+// deleteSelfFromMap checks whether it is valid to delete the channel from the map, which means
+// deleting the channel from channelz's tracking entirely. Users can no longer use id to query the
+// channel, and its memory will be garbage collected.
+//
+// The trace reference count of the channel must be 0 in order to be deleted from the map. This is
+// specified in the channel tracing gRFC that as long as some other trace has reference to an entity,
+// the trace of the referenced entity must not be deleted. In order to release the resource allocated
+// by grpc, the reference to the grpc object is reset to a dummy object.
+//
+// deleteSelfFromMap must be called after deleteSelfFromTree returns true.
+//
+// It returns a bool to indicate whether the channel can be safely deleted from map.
+func (c *channel) deleteSelfFromMap() (delete bool) {
+	if c.getTraceRefCount() != 0 {
+		c.c = &dummyChannel{}
+		return false
+	}
+	return true
+}
+
+// deleteSelfIfReady tries to delete the channel itself from the channelz database.
+// The delete process includes two steps:
+//  1. delete the channel from the entry relation tree, i.e. delete the channel reference from its
+//     parent's child list.
+//  2. delete the channel from the map, i.e. delete the channel entirely from channelz. Lookup by id
+//     will return entry not found error.
+func (c *channel) deleteSelfIfReady() {
+	if !c.deleteSelfFromTree() {
+		return
+	}
+	if !c.deleteSelfFromMap() {
+		return
+	}
+	c.cm.deleteEntry(c.id)
+	c.trace.clear()
+}
+
+func (c *channel) getChannelTrace() *channelTrace {
+	return c.trace
+}
+
+func (c *channel) incrTraceRefCount() {
+	atomic.AddInt32(&c.traceRefCount, 1)
+}
+
+func (c *channel) decrTraceRefCount() {
+	atomic.AddInt32(&c.traceRefCount, -1)
+}
+
+func (c *channel) getTraceRefCount() int {
+	i := atomic.LoadInt32(&c.traceRefCount)
+	return int(i)
+}
+
+func (c *channel) getRefName() string {
+	return c.refName
+}
+
+type subChannel struct {
+	refName       string
+	c             Channel
+	closeCalled   bool
+	sockets       map[int64]string
+	id            int64
+	pid           int64
+	cm            *channelMap
+	trace         *channelTrace
+	traceRefCount int32
+}
+
+func (sc *subChannel) addChild(id int64, e entry) {
+	if v, ok := e.(*normalSocket); ok {
+		sc.sockets[id] = v.refName
+	} else {
+		logger.Errorf("cannot add a child (id = %d) of type %T to a subChannel", id, e)
+	}
+}
+
+func (sc *subChannel) deleteChild(id int64) {
+	delete(sc.sockets, id)
+	sc.deleteSelfIfReady()
+}
+
+func (sc *subChannel) triggerDelete() {
+	sc.closeCalled = true
+	sc.deleteSelfIfReady()
+}
+
+func (sc *subChannel) getParentID() int64 {
+	return sc.pid
+}
+
+// deleteSelfFromTree tries to delete the subchannel from the channelz entry relation tree, which
+// means deleting the subchannel reference from its parent's child list.
+//
+// In order for a subchannel to be deleted from the tree, it must meet the criteria that, removal of
+// the corresponding grpc object has been invoked, and the subchannel does not have any children left.
+//
+// The returned boolean value indicates whether the channel has been successfully deleted from tree.
+func (sc *subChannel) deleteSelfFromTree() (deleted bool) {
+	if !sc.closeCalled || len(sc.sockets) != 0 {
+		return false
+	}
+	sc.cm.findEntry(sc.pid).deleteChild(sc.id)
+	return true
+}
+
+// deleteSelfFromMap checks whether it is valid to delete the subchannel from the map, which means
+// deleting the subchannel from channelz's tracking entirely. Users can no longer use id to query
+// the subchannel, and its memory will be garbage collected.
+//
+// The trace reference count of the subchannel must be 0 in order to be deleted from the map. This is
+// specified in the channel tracing gRFC that as long as some other trace has reference to an entity,
+// the trace of the referenced entity must not be deleted. In order to release the resource allocated
+// by grpc, the reference to the grpc object is reset to a dummy object.
+//
+// deleteSelfFromMap must be called after deleteSelfFromTree returns true.
+//
+// It returns a bool to indicate whether the channel can be safely deleted from map.
+func (sc *subChannel) deleteSelfFromMap() (delete bool) {
+	if sc.getTraceRefCount() != 0 {
+		// free the grpc struct (i.e. addrConn)
+		sc.c = &dummyChannel{}
+		return false
+	}
+	return true
+}
+
+// deleteSelfIfReady tries to delete the subchannel itself from the channelz database.
+// The delete process includes two steps:
+//  1. delete the subchannel from the entry relation tree, i.e. delete the subchannel reference from
+//     its parent's child list.
+//  2. delete the subchannel from the map, i.e. delete the subchannel entirely from channelz. Lookup
+//     by id will return entry not found error.
+func (sc *subChannel) deleteSelfIfReady() {
+	if !sc.deleteSelfFromTree() {
+		return
+	}
+	if !sc.deleteSelfFromMap() {
+		return
+	}
+	sc.cm.deleteEntry(sc.id)
+	sc.trace.clear()
+}
+
+func (sc *subChannel) getChannelTrace() *channelTrace {
+	return sc.trace
+}
+
+func (sc *subChannel) incrTraceRefCount() {
+	atomic.AddInt32(&sc.traceRefCount, 1)
+}
+
+func (sc *subChannel) decrTraceRefCount() {
+	atomic.AddInt32(&sc.traceRefCount, -1)
+}
+
+func (sc *subChannel) getTraceRefCount() int {
+	i := atomic.LoadInt32(&sc.traceRefCount)
+	return int(i)
+}
+
+func (sc *subChannel) getRefName() string {
+	return sc.refName
+}
+
+// SocketMetric defines the info channelz provides for a specific Socket, which
+// includes SocketInternalMetric and channelz-specific data, such as channelz id, etc.
+type SocketMetric struct {
+	// ID is the channelz id of this socket.
+	ID int64
+	// RefName is the human readable reference string of this socket.
+	RefName string
+	// SocketData contains socket internal metric reported by the socket through
+	// ChannelzMetric().
+	SocketData *SocketInternalMetric
+}
+
+// SocketInternalMetric defines the struct that the implementor of Socket interface
+// should return from ChannelzMetric().
+type SocketInternalMetric struct {
+	// The number of streams that have been started.
+	StreamsStarted int64
+	// The number of streams that have ended successfully:
+	// On client side, receiving frame with eos bit set.
+	// On server side, sending frame with eos bit set.
+	StreamsSucceeded int64
+	// The number of streams that have ended unsuccessfully:
+	// On client side, termination without receiving frame with eos bit set.
+	// On server side, termination without sending frame with eos bit set.
+	StreamsFailed int64
+	// The number of messages successfully sent on this socket.
+	MessagesSent     int64
+	MessagesReceived int64
+	// The number of keep alives sent.  This is typically implemented with HTTP/2
+	// ping messages.
+	KeepAlivesSent int64
+	// The last time a stream was created by this endpoint.  Usually unset for
+	// servers.
+	LastLocalStreamCreatedTimestamp time.Time
+	// The last time a stream was created by the remote endpoint.  Usually unset
+	// for clients.
+	LastRemoteStreamCreatedTimestamp time.Time
+	// The last time a message was sent by this endpoint.
+	LastMessageSentTimestamp time.Time
+	// The last time a message was received by this endpoint.
+	LastMessageReceivedTimestamp time.Time
+	// The amount of window, granted to the local endpoint by the remote endpoint.
+	// This may be slightly out of date due to network latency.  This does NOT
+	// include stream level or TCP level flow control info.
+	LocalFlowControlWindow int64
+	// The amount of window, granted to the remote endpoint by the local endpoint.
+	// This may be slightly out of date due to network latency.  This does NOT
+	// include stream level or TCP level flow control info.
+	RemoteFlowControlWindow int64
+	// The locally bound address.
+	LocalAddr net.Addr
+	// The remote bound address.  May be absent.
+	RemoteAddr net.Addr
+	// Optional, represents the name of the remote endpoint, if different than
+	// the original target name.
+	RemoteName    string
+	SocketOptions *SocketOptionData
+	Security      credentials.ChannelzSecurityValue
+}
+
+// Socket is the interface that should be satisfied in order to be tracked by
+// channelz as Socket.
+type Socket interface {
+	ChannelzMetric() *SocketInternalMetric
+}
+
+type listenSocket struct {
+	refName string
+	s       Socket
+	id      int64
+	pid     int64
+	cm      *channelMap
+}
+
+func (ls *listenSocket) addChild(id int64, e entry) {
+	logger.Errorf("cannot add a child (id = %d) of type %T to a listen socket", id, e)
+}
+
+func (ls *listenSocket) deleteChild(id int64) {
+	logger.Errorf("cannot delete a child (id = %d) from a listen socket", id)
+}
+
+func (ls *listenSocket) triggerDelete() {
+	ls.cm.deleteEntry(ls.id)
+	ls.cm.findEntry(ls.pid).deleteChild(ls.id)
+}
+
+func (ls *listenSocket) deleteSelfIfReady() {
+	logger.Errorf("cannot call deleteSelfIfReady on a listen socket")
+}
+
+func (ls *listenSocket) getParentID() int64 {
+	return ls.pid
+}
+
+type normalSocket struct {
+	refName string
+	s       Socket
+	id      int64
+	pid     int64
+	cm      *channelMap
+}
+
+func (ns *normalSocket) addChild(id int64, e entry) {
+	logger.Errorf("cannot add a child (id = %d) of type %T to a normal socket", id, e)
+}
+
+func (ns *normalSocket) deleteChild(id int64) {
+	logger.Errorf("cannot delete a child (id = %d) from a normal socket", id)
+}
+
+func (ns *normalSocket) triggerDelete() {
+	ns.cm.deleteEntry(ns.id)
+	ns.cm.findEntry(ns.pid).deleteChild(ns.id)
+}
+
+func (ns *normalSocket) deleteSelfIfReady() {
+	logger.Errorf("cannot call deleteSelfIfReady on a normal socket")
+}
+
+func (ns *normalSocket) getParentID() int64 {
+	return ns.pid
+}
+
+// ServerMetric defines the info channelz provides for a specific Server, which
+// includes ServerInternalMetric and channelz-specific data, such as channelz id,
+// child list, etc.
+type ServerMetric struct {
+	// ID is the channelz id of this server.
+	ID int64
+	// RefName is the human readable reference string of this server.
+	RefName string
+	// ServerData contains server internal metric reported by the server through
+	// ChannelzMetric().
+	ServerData *ServerInternalMetric
+	// ListenSockets tracks the listener socket type children of this server in the
+	// format of a map from socket channelz id to corresponding reference string.
+	ListenSockets map[int64]string
+}
+
+// ServerInternalMetric defines the struct that the implementor of Server interface
+// should return from ChannelzMetric().
+type ServerInternalMetric struct {
+	// The number of incoming calls started on the server.
+	CallsStarted int64
+	// The number of incoming calls that have completed with an OK status.
+	CallsSucceeded int64
+	// The number of incoming calls that have a completed with a non-OK status.
+	CallsFailed int64
+	// The last time a call was started on the server.
+	LastCallStartedTimestamp time.Time
+}
+
+// Server is the interface to be satisfied in order to be tracked by channelz as
+// Server.
+type Server interface {
+	ChannelzMetric() *ServerInternalMetric
+}
+
+type server struct {
+	refName       string
+	s             Server
+	closeCalled   bool
+	sockets       map[int64]string
+	listenSockets map[int64]string
+	id            int64
+	cm            *channelMap
+}
+
+func (s *server) addChild(id int64, e entry) {
+	switch v := e.(type) {
+	case *normalSocket:
+		s.sockets[id] = v.refName
+	case *listenSocket:
+		s.listenSockets[id] = v.refName
+	default:
+		logger.Errorf("cannot add a child (id = %d) of type %T to a server", id, e)
+	}
+}
+
+func (s *server) deleteChild(id int64) {
+	delete(s.sockets, id)
+	delete(s.listenSockets, id)
+	s.deleteSelfIfReady()
+}
+
+func (s *server) triggerDelete() {
+	s.closeCalled = true
+	s.deleteSelfIfReady()
+}
+
+func (s *server) deleteSelfIfReady() {
+	if !s.closeCalled || len(s.sockets)+len(s.listenSockets) != 0 {
+		return
+	}
+	s.cm.deleteEntry(s.id)
+}
+
+func (s *server) getParentID() int64 {
+	return 0
+}
+
+type tracedChannel interface {
+	getChannelTrace() *channelTrace
+	incrTraceRefCount()
+	decrTraceRefCount()
+	getRefName() string
+}
+
+type channelTrace struct {
+	cm          *channelMap
+	createdTime time.Time
+	eventCount  int64
+	mu          sync.Mutex
+	events      []*TraceEvent
+}
+
+func (c *channelTrace) append(e *TraceEvent) {
+	c.mu.Lock()
+	if len(c.events) == getMaxTraceEntry() {
+		del := c.events[0]
+		c.events = c.events[1:]
+		if del.RefID != 0 {
+			// start recursive cleanup in a goroutine to not block the call originated from grpc.
+			go func() {
+				// need to acquire c.cm.mu lock to call the unlocked attemptCleanup func.
+				c.cm.mu.Lock()
+				c.cm.decrTraceRefCount(del.RefID)
+				c.cm.mu.Unlock()
+			}()
+		}
+	}
+	e.Timestamp = time.Now()
+	c.events = append(c.events, e)
+	c.eventCount++
+	c.mu.Unlock()
+}
+
+func (c *channelTrace) clear() {
+	c.mu.Lock()
+	for _, e := range c.events {
+		if e.RefID != 0 {
+			// caller should have already held the c.cm.mu lock.
+			c.cm.decrTraceRefCount(e.RefID)
+		}
+	}
+	c.mu.Unlock()
+}
+
+// Severity is the severity level of a trace event.
+// The canonical enumeration of all valid values is here:
+// https://github.com/grpc/grpc-proto/blob/9b13d199cc0d4703c7ea26c9c330ba695866eb23/grpc/channelz/v1/channelz.proto#L126.
+type Severity int
+
+const (
+	// CtUnknown indicates unknown severity of a trace event.
+	CtUnknown Severity = iota
+	// CtInfo indicates info level severity of a trace event.
+	CtInfo
+	// CtWarning indicates warning level severity of a trace event.
+	CtWarning
+	// CtError indicates error level severity of a trace event.
+	CtError
+)
+
+// RefChannelType is the type of the entity being referenced in a trace event.
+type RefChannelType int
+
+const (
+	// RefUnknown indicates an unknown entity type, the zero value for this type.
+	RefUnknown RefChannelType = iota
+	// RefChannel indicates the referenced entity is a Channel.
+	RefChannel
+	// RefSubChannel indicates the referenced entity is a SubChannel.
+	RefSubChannel
+	// RefServer indicates the referenced entity is a Server.
+	RefServer
+	// RefListenSocket indicates the referenced entity is a ListenSocket.
+	RefListenSocket
+	// RefNormalSocket indicates the referenced entity is a NormalSocket.
+	RefNormalSocket
+)
+
+var refChannelTypeToString = map[RefChannelType]string{
+	RefUnknown:      "Unknown",
+	RefChannel:      "Channel",
+	RefSubChannel:   "SubChannel",
+	RefServer:       "Server",
+	RefListenSocket: "ListenSocket",
+	RefNormalSocket: "NormalSocket",
+}
+
+func (r RefChannelType) String() string {
+	return refChannelTypeToString[r]
+}
+
+func (c *channelTrace) dumpData() *ChannelTrace {
+	c.mu.Lock()
+	ct := &ChannelTrace{EventNum: c.eventCount, CreationTime: c.createdTime}
+	ct.Events = c.events[:len(c.events)]
+	c.mu.Unlock()
+	return ct
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/types_linux.go b/vendor/google.golang.org/grpc/internal/channelz/types_linux.go
new file mode 100644
index 0000000000..1b1c4cce34
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/types_linux.go
@@ -0,0 +1,51 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// SocketOptionData defines the struct to hold socket option data, and related
+// getter function to obtain info from fd.
+type SocketOptionData struct {
+	Linger      *unix.Linger
+	RecvTimeout *unix.Timeval
+	SendTimeout *unix.Timeval
+	TCPInfo     *unix.TCPInfo
+}
+
+// Getsockopt defines the function to get socket options requested by channelz.
+// It is to be passed to syscall.RawConn.Control().
+func (s *SocketOptionData) Getsockopt(fd uintptr) {
+	if v, err := unix.GetsockoptLinger(int(fd), syscall.SOL_SOCKET, syscall.SO_LINGER); err == nil {
+		s.Linger = v
+	}
+	if v, err := unix.GetsockoptTimeval(int(fd), syscall.SOL_SOCKET, syscall.SO_RCVTIMEO); err == nil {
+		s.RecvTimeout = v
+	}
+	if v, err := unix.GetsockoptTimeval(int(fd), syscall.SOL_SOCKET, syscall.SO_SNDTIMEO); err == nil {
+		s.SendTimeout = v
+	}
+	if v, err := unix.GetsockoptTCPInfo(int(fd), syscall.SOL_TCP, syscall.TCP_INFO); err == nil {
+		s.TCPInfo = v
+	}
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/types_nonlinux.go b/vendor/google.golang.org/grpc/internal/channelz/types_nonlinux.go
new file mode 100644
index 0000000000..8b06eed1ab
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/types_nonlinux.go
@@ -0,0 +1,43 @@
+//go:build !linux
+// +build !linux
+
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import (
+	"sync"
+)
+
+var once sync.Once
+
+// SocketOptionData defines the struct to hold socket option data, and related
+// getter function to obtain info from fd.
+// Windows OS doesn't support Socket Option
+type SocketOptionData struct {
+}
+
+// Getsockopt defines the function to get socket options requested by channelz.
+// It is to be passed to syscall.RawConn.Control().
+// Windows OS doesn't support Socket Option
+func (s *SocketOptionData) Getsockopt(fd uintptr) {
+	once.Do(func() {
+		logger.Warning("Channelz: socket options are not supported on non-linux environments")
+	})
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/util_linux.go b/vendor/google.golang.org/grpc/internal/channelz/util_linux.go
new file mode 100644
index 0000000000..8d194e44e1
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/util_linux.go
@@ -0,0 +1,37 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+import (
+	"syscall"
+)
+
+// GetSocketOption gets the socket option info of the conn.
+func GetSocketOption(socket interface{}) *SocketOptionData {
+	c, ok := socket.(syscall.Conn)
+	if !ok {
+		return nil
+	}
+	data := &SocketOptionData{}
+	if rawConn, err := c.SyscallConn(); err == nil {
+		rawConn.Control(data.Getsockopt)
+		return data
+	}
+	return nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/channelz/util_nonlinux.go b/vendor/google.golang.org/grpc/internal/channelz/util_nonlinux.go
new file mode 100644
index 0000000000..837ddc4024
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/channelz/util_nonlinux.go
@@ -0,0 +1,27 @@
+//go:build !linux
+// +build !linux
+
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package channelz
+
+// GetSocketOption gets the socket option info of the conn.
+func GetSocketOption(c interface{}) *SocketOptionData {
+	return nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/credentials/credentials.go b/vendor/google.golang.org/grpc/internal/credentials/credentials.go
new file mode 100644
index 0000000000..32c9b59033
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/credentials/credentials.go
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package credentials
+
+import (
+	"context"
+)
+
+// requestInfoKey is a struct to be used as the key to store RequestInfo in a
+// context.
+type requestInfoKey struct{}
+
+// NewRequestInfoContext creates a context with ri.
+func NewRequestInfoContext(ctx context.Context, ri interface{}) context.Context {
+	return context.WithValue(ctx, requestInfoKey{}, ri)
+}
+
+// RequestInfoFromContext extracts the RequestInfo from ctx.
+func RequestInfoFromContext(ctx context.Context) interface{} {
+	return ctx.Value(requestInfoKey{})
+}
+
+// clientHandshakeInfoKey is a struct used as the key to store
+// ClientHandshakeInfo in a context.
+type clientHandshakeInfoKey struct{}
+
+// ClientHandshakeInfoFromContext extracts the ClientHandshakeInfo from ctx.
+func ClientHandshakeInfoFromContext(ctx context.Context) interface{} {
+	return ctx.Value(clientHandshakeInfoKey{})
+}
+
+// NewClientHandshakeInfoContext creates a context with chi.
+func NewClientHandshakeInfoContext(ctx context.Context, chi interface{}) context.Context {
+	return context.WithValue(ctx, clientHandshakeInfoKey{}, chi)
+}
diff --git a/vendor/google.golang.org/grpc/internal/credentials/spiffe.go b/vendor/google.golang.org/grpc/internal/credentials/spiffe.go
new file mode 100644
index 0000000000..25ade62305
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/credentials/spiffe.go
@@ -0,0 +1,75 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package credentials defines APIs for parsing SPIFFE ID.
+//
+// All APIs in this package are experimental.
+package credentials
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"net/url"
+
+	"google.golang.org/grpc/grpclog"
+)
+
+var logger = grpclog.Component("credentials")
+
+// SPIFFEIDFromState parses the SPIFFE ID from State. If the SPIFFE ID format
+// is invalid, return nil with warning.
+func SPIFFEIDFromState(state tls.ConnectionState) *url.URL {
+	if len(state.PeerCertificates) == 0 || len(state.PeerCertificates[0].URIs) == 0 {
+		return nil
+	}
+	return SPIFFEIDFromCert(state.PeerCertificates[0])
+}
+
+// SPIFFEIDFromCert parses the SPIFFE ID from x509.Certificate. If the SPIFFE
+// ID format is invalid, return nil with warning.
+func SPIFFEIDFromCert(cert *x509.Certificate) *url.URL {
+	if cert == nil || cert.URIs == nil {
+		return nil
+	}
+	var spiffeID *url.URL
+	for _, uri := range cert.URIs {
+		if uri == nil || uri.Scheme != "spiffe" || uri.Opaque != "" || (uri.User != nil && uri.User.Username() != "") {
+			continue
+		}
+		// From this point, we assume the uri is intended for a SPIFFE ID.
+		if len(uri.String()) > 2048 {
+			logger.Warning("invalid SPIFFE ID: total ID length larger than 2048 bytes")
+			return nil
+		}
+		if len(uri.Host) == 0 || len(uri.Path) == 0 {
+			logger.Warning("invalid SPIFFE ID: domain or workload ID is empty")
+			return nil
+		}
+		if len(uri.Host) > 255 {
+			logger.Warning("invalid SPIFFE ID: domain length larger than 255 characters")
+			return nil
+		}
+		// A valid SPIFFE certificate can only have exactly one URI SAN field.
+		if len(cert.URIs) > 1 {
+			logger.Warning("invalid SPIFFE ID: multiple URI SANs")
+			return nil
+		}
+		spiffeID = uri
+	}
+	return spiffeID
+}
diff --git a/vendor/google.golang.org/grpc/internal/credentials/syscallconn.go b/vendor/google.golang.org/grpc/internal/credentials/syscallconn.go
new file mode 100644
index 0000000000..2919632d65
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/credentials/syscallconn.go
@@ -0,0 +1,58 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package credentials
+
+import (
+	"net"
+	"syscall"
+)
+
+type sysConn = syscall.Conn
+
+// syscallConn keeps reference of rawConn to support syscall.Conn for channelz.
+// SyscallConn() (the method in interface syscall.Conn) is explicitly
+// implemented on this type,
+//
+// Interface syscall.Conn is implemented by most net.Conn implementations (e.g.
+// TCPConn, UnixConn), but is not part of net.Conn interface. So wrapper conns
+// that embed net.Conn don't implement syscall.Conn. (Side note: tls.Conn
+// doesn't embed net.Conn, so even if syscall.Conn is part of net.Conn, it won't
+// help here).
+type syscallConn struct {
+	net.Conn
+	// sysConn is a type alias of syscall.Conn. It's necessary because the name
+	// `Conn` collides with `net.Conn`.
+	sysConn
+}
+
+// WrapSyscallConn tries to wrap rawConn and newConn into a net.Conn that
+// implements syscall.Conn. rawConn will be used to support syscall, and newConn
+// will be used for read/write.
+//
+// This function returns newConn if rawConn doesn't implement syscall.Conn.
+func WrapSyscallConn(rawConn, newConn net.Conn) net.Conn {
+	sysConn, ok := rawConn.(syscall.Conn)
+	if !ok {
+		return newConn
+	}
+	return &syscallConn{
+		Conn:    newConn,
+		sysConn: sysConn,
+	}
+}
diff --git a/vendor/google.golang.org/grpc/internal/credentials/util.go b/vendor/google.golang.org/grpc/internal/credentials/util.go
new file mode 100644
index 0000000000..f792fd22ca
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/credentials/util.go
@@ -0,0 +1,52 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package credentials
+
+import (
+	"crypto/tls"
+)
+
+const alpnProtoStrH2 = "h2"
+
+// AppendH2ToNextProtos appends h2 to next protos.
+func AppendH2ToNextProtos(ps []string) []string {
+	for _, p := range ps {
+		if p == alpnProtoStrH2 {
+			return ps
+		}
+	}
+	ret := make([]string, 0, len(ps)+1)
+	ret = append(ret, ps...)
+	return append(ret, alpnProtoStrH2)
+}
+
+// CloneTLSConfig returns a shallow clone of the exported
+// fields of cfg, ignoring the unexported sync.Once, which
+// contains a mutex and must not be copied.
+//
+// If cfg is nil, a new zero tls.Config is returned.
+//
+// TODO: inline this function if possible.
+func CloneTLSConfig(cfg *tls.Config) *tls.Config {
+	if cfg == nil {
+		return &tls.Config{}
+	}
+
+	return cfg.Clone()
+}
diff --git a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
new file mode 100644
index 0000000000..5ba9d94d49
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
@@ -0,0 +1,62 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package envconfig contains grpc settings configured by environment variables.
+package envconfig
+
+import (
+	"os"
+	"strconv"
+	"strings"
+)
+
+var (
+	// TXTErrIgnore is set if TXT errors should be ignored ("GRPC_GO_IGNORE_TXT_ERRORS" is not "false").
+	TXTErrIgnore = boolFromEnv("GRPC_GO_IGNORE_TXT_ERRORS", true)
+	// AdvertiseCompressors is set if registered compressor should be advertised
+	// ("GRPC_GO_ADVERTISE_COMPRESSORS" is not "false").
+	AdvertiseCompressors = boolFromEnv("GRPC_GO_ADVERTISE_COMPRESSORS", true)
+	// RingHashCap indicates the maximum ring size which defaults to 4096
+	// entries but may be overridden by setting the environment variable
+	// "GRPC_RING_HASH_CAP".  This does not override the default bounds
+	// checking which NACKs configs specifying ring sizes > 8*1024*1024 (~8M).
+	RingHashCap = uint64FromEnv("GRPC_RING_HASH_CAP", 4096, 1, 8*1024*1024)
+)
+
+func boolFromEnv(envVar string, def bool) bool {
+	if def {
+		// The default is true; return true unless the variable is "false".
+		return !strings.EqualFold(os.Getenv(envVar), "false")
+	}
+	// The default is false; return false unless the variable is "true".
+	return strings.EqualFold(os.Getenv(envVar), "true")
+}
+
+func uint64FromEnv(envVar string, def, min, max uint64) uint64 {
+	v, err := strconv.ParseUint(os.Getenv(envVar), 10, 64)
+	if err != nil {
+		return def
+	}
+	if v < min {
+		return min
+	}
+	if v > max {
+		return max
+	}
+	return v
+}
diff --git a/vendor/google.golang.org/grpc/internal/envconfig/observability.go b/vendor/google.golang.org/grpc/internal/envconfig/observability.go
new file mode 100644
index 0000000000..821dd0a7c1
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/envconfig/observability.go
@@ -0,0 +1,36 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package envconfig
+
+import "os"
+
+const (
+	envObservabilityConfig     = "GRPC_GCP_OBSERVABILITY_CONFIG"
+	envObservabilityConfigFile = "GRPC_GCP_OBSERVABILITY_CONFIG_FILE"
+)
+
+var (
+	// ObservabilityConfig is the json configuration for the gcp/observability
+	// package specified directly in the envObservabilityConfig env var.
+	ObservabilityConfig = os.Getenv(envObservabilityConfig)
+	// ObservabilityConfigFile is the json configuration for the
+	// gcp/observability specified in a file with the location specified in
+	// envObservabilityConfigFile env var.
+	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)
+)
diff --git a/vendor/google.golang.org/grpc/internal/envconfig/xds.go b/vendor/google.golang.org/grpc/internal/envconfig/xds.go
new file mode 100644
index 0000000000..3b17705ba0
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/envconfig/xds.go
@@ -0,0 +1,92 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package envconfig
+
+import (
+	"os"
+)
+
+const (
+	// XDSBootstrapFileNameEnv is the env variable to set bootstrap file name.
+	// Do not use this and read from env directly. Its value is read and kept in
+	// variable XDSBootstrapFileName.
+	//
+	// When both bootstrap FileName and FileContent are set, FileName is used.
+	XDSBootstrapFileNameEnv = "GRPC_XDS_BOOTSTRAP"
+	// XDSBootstrapFileContentEnv is the env variable to set bootstrap file
+	// content. Do not use this and read from env directly. Its value is read
+	// and kept in variable XDSBootstrapFileContent.
+	//
+	// When both bootstrap FileName and FileContent are set, FileName is used.
+	XDSBootstrapFileContentEnv = "GRPC_XDS_BOOTSTRAP_CONFIG"
+)
+
+var (
+	// XDSBootstrapFileName holds the name of the file which contains xDS
+	// bootstrap configuration. Users can specify the location of the bootstrap
+	// file by setting the environment variable "GRPC_XDS_BOOTSTRAP".
+	//
+	// When both bootstrap FileName and FileContent are set, FileName is used.
+	XDSBootstrapFileName = os.Getenv(XDSBootstrapFileNameEnv)
+	// XDSBootstrapFileContent holds the content of the xDS bootstrap
+	// configuration. Users can specify the bootstrap config by setting the
+	// environment variable "GRPC_XDS_BOOTSTRAP_CONFIG".
+	//
+	// When both bootstrap FileName and FileContent are set, FileName is used.
+	XDSBootstrapFileContent = os.Getenv(XDSBootstrapFileContentEnv)
+	// XDSRingHash indicates whether ring hash support is enabled, which can be
+	// disabled by setting the environment variable
+	// "GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH" to "false".
+	XDSRingHash = boolFromEnv("GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH", true)
+	// XDSClientSideSecurity is used to control processing of security
+	// configuration on the client-side.
+	//
+	// Note that there is no env var protection for the server-side because we
+	// have a brand new API on the server-side and users explicitly need to use
+	// the new API to get security integration on the server.
+	XDSClientSideSecurity = boolFromEnv("GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT", true)
+	// XDSAggregateAndDNS indicates whether processing of aggregated cluster
+	// and DNS cluster is enabled, which can be enabled by setting the
+	// environment variable
+	// "GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER" to
+	// "true".
+	XDSAggregateAndDNS = boolFromEnv("GRPC_XDS_EXPERIMENTAL_ENABLE_AGGREGATE_AND_LOGICAL_DNS_CLUSTER", true)
+
+	// XDSRBAC indicates whether xDS configured RBAC HTTP Filter is enabled,
+	// which can be disabled by setting the environment variable
+	// "GRPC_XDS_EXPERIMENTAL_RBAC" to "false".
+	XDSRBAC = boolFromEnv("GRPC_XDS_EXPERIMENTAL_RBAC", true)
+	// XDSOutlierDetection indicates whether outlier detection support is
+	// enabled, which can be disabled by setting the environment variable
+	// "GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION" to "false".
+	XDSOutlierDetection = boolFromEnv("GRPC_EXPERIMENTAL_ENABLE_OUTLIER_DETECTION", true)
+	// XDSFederation indicates whether federation support is enabled, which can
+	// be enabled by setting the environment variable
+	// "GRPC_EXPERIMENTAL_XDS_FEDERATION" to "true".
+	XDSFederation = boolFromEnv("GRPC_EXPERIMENTAL_XDS_FEDERATION", true)
+
+	// XDSRLS indicates whether processing of Cluster Specifier plugins and
+	// support for the RLS CLuster Specifier is enabled, which can be enabled by
+	// setting the environment variable "GRPC_EXPERIMENTAL_XDS_RLS_LB" to
+	// "true".
+	XDSRLS = boolFromEnv("GRPC_EXPERIMENTAL_XDS_RLS_LB", false)
+
+	// C2PResolverTestOnlyTrafficDirectorURI is the TD URI for testing.
+	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv("GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI")
+)
diff --git a/vendor/google.golang.org/grpc/internal/grpclog/grpclog.go b/vendor/google.golang.org/grpc/internal/grpclog/grpclog.go
new file mode 100644
index 0000000000..b68e26a364
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpclog/grpclog.go
@@ -0,0 +1,126 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package grpclog (internal) defines depth logging for grpc.
+package grpclog
+
+import (
+	"os"
+)
+
+// Logger is the logger used for the non-depth log functions.
+var Logger LoggerV2
+
+// DepthLogger is the logger used for the depth log functions.
+var DepthLogger DepthLoggerV2
+
+// InfoDepth logs to the INFO log at the specified depth.
+func InfoDepth(depth int, args ...interface{}) {
+	if DepthLogger != nil {
+		DepthLogger.InfoDepth(depth, args...)
+	} else {
+		Logger.Infoln(args...)
+	}
+}
+
+// WarningDepth logs to the WARNING log at the specified depth.
+func WarningDepth(depth int, args ...interface{}) {
+	if DepthLogger != nil {
+		DepthLogger.WarningDepth(depth, args...)
+	} else {
+		Logger.Warningln(args...)
+	}
+}
+
+// ErrorDepth logs to the ERROR log at the specified depth.
+func ErrorDepth(depth int, args ...interface{}) {
+	if DepthLogger != nil {
+		DepthLogger.ErrorDepth(depth, args...)
+	} else {
+		Logger.Errorln(args...)
+	}
+}
+
+// FatalDepth logs to the FATAL log at the specified depth.
+func FatalDepth(depth int, args ...interface{}) {
+	if DepthLogger != nil {
+		DepthLogger.FatalDepth(depth, args...)
+	} else {
+		Logger.Fatalln(args...)
+	}
+	os.Exit(1)
+}
+
+// LoggerV2 does underlying logging work for grpclog.
+// This is a copy of the LoggerV2 defined in the external grpclog package. It
+// is defined here to avoid a circular dependency.
+type LoggerV2 interface {
+	// Info logs to INFO log. Arguments are handled in the manner of fmt.Print.
+	Info(args ...interface{})
+	// Infoln logs to INFO log. Arguments are handled in the manner of fmt.Println.
+	Infoln(args ...interface{})
+	// Infof logs to INFO log. Arguments are handled in the manner of fmt.Printf.
+	Infof(format string, args ...interface{})
+	// Warning logs to WARNING log. Arguments are handled in the manner of fmt.Print.
+	Warning(args ...interface{})
+	// Warningln logs to WARNING log. Arguments are handled in the manner of fmt.Println.
+	Warningln(args ...interface{})
+	// Warningf logs to WARNING log. Arguments are handled in the manner of fmt.Printf.
+	Warningf(format string, args ...interface{})
+	// Error logs to ERROR log. Arguments are handled in the manner of fmt.Print.
+	Error(args ...interface{})
+	// Errorln logs to ERROR log. Arguments are handled in the manner of fmt.Println.
+	Errorln(args ...interface{})
+	// Errorf logs to ERROR log. Arguments are handled in the manner of fmt.Printf.
+	Errorf(format string, args ...interface{})
+	// Fatal logs to ERROR log. Arguments are handled in the manner of fmt.Print.
+	// gRPC ensures that all Fatal logs will exit with os.Exit(1).
+	// Implementations may also call os.Exit() with a non-zero exit code.
+	Fatal(args ...interface{})
+	// Fatalln logs to ERROR log. Arguments are handled in the manner of fmt.Println.
+	// gRPC ensures that all Fatal logs will exit with os.Exit(1).
+	// Implementations may also call os.Exit() with a non-zero exit code.
+	Fatalln(args ...interface{})
+	// Fatalf logs to ERROR log. Arguments are handled in the manner of fmt.Printf.
+	// gRPC ensures that all Fatal logs will exit with os.Exit(1).
+	// Implementations may also call os.Exit() with a non-zero exit code.
+	Fatalf(format string, args ...interface{})
+	// V reports whether verbosity level l is at least the requested verbose level.
+	V(l int) bool
+}
+
+// DepthLoggerV2 logs at a specified call frame. If a LoggerV2 also implements
+// DepthLoggerV2, the below functions will be called with the appropriate stack
+// depth set for trivial functions the logger may ignore.
+// This is a copy of the DepthLoggerV2 defined in the external grpclog package.
+// It is defined here to avoid a circular dependency.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type DepthLoggerV2 interface {
+	// InfoDepth logs to INFO log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	InfoDepth(depth int, args ...interface{})
+	// WarningDepth logs to WARNING log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	WarningDepth(depth int, args ...interface{})
+	// ErrorDepth logs to ERROR log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	ErrorDepth(depth int, args ...interface{})
+	// FatalDepth logs to FATAL log at the specified depth. Arguments are handled in the manner of fmt.Println.
+	FatalDepth(depth int, args ...interface{})
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go b/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go
new file mode 100644
index 0000000000..02224b42ca
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpclog/prefixLogger.go
@@ -0,0 +1,93 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpclog
+
+import (
+	"fmt"
+)
+
+// PrefixLogger does logging with a prefix.
+//
+// Logging method on a nil logs without any prefix.
+type PrefixLogger struct {
+	logger DepthLoggerV2
+	prefix string
+}
+
+// Infof does info logging.
+func (pl *PrefixLogger) Infof(format string, args ...interface{}) {
+	if pl != nil {
+		// Handle nil, so the tests can pass in a nil logger.
+		format = pl.prefix + format
+		pl.logger.InfoDepth(1, fmt.Sprintf(format, args...))
+		return
+	}
+	InfoDepth(1, fmt.Sprintf(format, args...))
+}
+
+// Warningf does warning logging.
+func (pl *PrefixLogger) Warningf(format string, args ...interface{}) {
+	if pl != nil {
+		format = pl.prefix + format
+		pl.logger.WarningDepth(1, fmt.Sprintf(format, args...))
+		return
+	}
+	WarningDepth(1, fmt.Sprintf(format, args...))
+}
+
+// Errorf does error logging.
+func (pl *PrefixLogger) Errorf(format string, args ...interface{}) {
+	if pl != nil {
+		format = pl.prefix + format
+		pl.logger.ErrorDepth(1, fmt.Sprintf(format, args...))
+		return
+	}
+	ErrorDepth(1, fmt.Sprintf(format, args...))
+}
+
+// Debugf does info logging at verbose level 2.
+func (pl *PrefixLogger) Debugf(format string, args ...interface{}) {
+	// TODO(6044): Refactor interfaces LoggerV2 and DepthLogger, and maybe
+	// rewrite PrefixLogger a little to ensure that we don't use the global
+	// `Logger` here, and instead use the `logger` field.
+	if !Logger.V(2) {
+		return
+	}
+	if pl != nil {
+		// Handle nil, so the tests can pass in a nil logger.
+		format = pl.prefix + format
+		pl.logger.InfoDepth(1, fmt.Sprintf(format, args...))
+		return
+	}
+	InfoDepth(1, fmt.Sprintf(format, args...))
+
+}
+
+// V reports whether verbosity level l is at least the requested verbose level.
+func (pl *PrefixLogger) V(l int) bool {
+	// TODO(6044): Refactor interfaces LoggerV2 and DepthLogger, and maybe
+	// rewrite PrefixLogger a little to ensure that we don't use the global
+	// `Logger` here, and instead use the `logger` field.
+	return Logger.V(l)
+}
+
+// NewPrefixLogger creates a prefix logger with the given prefix.
+func NewPrefixLogger(logger DepthLoggerV2, prefix string) *PrefixLogger {
+	return &PrefixLogger{logger: logger, prefix: prefix}
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go b/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
new file mode 100644
index 0000000000..517ea70642
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcrand/grpcrand.go
@@ -0,0 +1,74 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package grpcrand implements math/rand functions in a concurrent-safe way
+// with a global random source, independent of math/rand's global source.
+package grpcrand
+
+import (
+	"math/rand"
+	"sync"
+	"time"
+)
+
+var (
+	r  = rand.New(rand.NewSource(time.Now().UnixNano()))
+	mu sync.Mutex
+)
+
+// Int implements rand.Int on the grpcrand global source.
+func Int() int {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Int()
+}
+
+// Int63n implements rand.Int63n on the grpcrand global source.
+func Int63n(n int64) int64 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Int63n(n)
+}
+
+// Intn implements rand.Intn on the grpcrand global source.
+func Intn(n int) int {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Intn(n)
+}
+
+// Int31n implements rand.Int31n on the grpcrand global source.
+func Int31n(n int32) int32 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Int31n(n)
+}
+
+// Float64 implements rand.Float64 on the grpcrand global source.
+func Float64() float64 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Float64()
+}
+
+// Uint64 implements rand.Uint64 on the grpcrand global source.
+func Uint64() uint64 {
+	mu.Lock()
+	defer mu.Unlock()
+	return r.Uint64()
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go b/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
new file mode 100644
index 0000000000..79993d3437
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
@@ -0,0 +1,65 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcsync
+
+import (
+	"context"
+
+	"google.golang.org/grpc/internal/buffer"
+)
+
+// CallbackSerializer provides a mechanism to schedule callbacks in a
+// synchronized manner. It provides a FIFO guarantee on the order of execution
+// of scheduled callbacks. New callbacks can be scheduled by invoking the
+// Schedule() method.
+//
+// This type is safe for concurrent access.
+type CallbackSerializer struct {
+	callbacks *buffer.Unbounded
+}
+
+// NewCallbackSerializer returns a new CallbackSerializer instance. The provided
+// context will be passed to the scheduled callbacks. Users should cancel the
+// provided context to shutdown the CallbackSerializer. It is guaranteed that no
+// callbacks will be executed once this context is canceled.
+func NewCallbackSerializer(ctx context.Context) *CallbackSerializer {
+	t := &CallbackSerializer{callbacks: buffer.NewUnbounded()}
+	go t.run(ctx)
+	return t
+}
+
+// Schedule adds a callback to be scheduled after existing callbacks are run.
+//
+// Callbacks are expected to honor the context when performing any blocking
+// operations, and should return early when the context is canceled.
+func (t *CallbackSerializer) Schedule(f func(ctx context.Context)) {
+	t.callbacks.Put(f)
+}
+
+func (t *CallbackSerializer) run(ctx context.Context) {
+	for ctx.Err() == nil {
+		select {
+		case <-ctx.Done():
+			return
+		case callback := <-t.callbacks.Get():
+			t.callbacks.Load()
+			callback.(func(ctx context.Context))(ctx)
+		}
+	}
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcsync/event.go b/vendor/google.golang.org/grpc/internal/grpcsync/event.go
new file mode 100644
index 0000000000..fbe697c376
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcsync/event.go
@@ -0,0 +1,61 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package grpcsync implements additional synchronization primitives built upon
+// the sync package.
+package grpcsync
+
+import (
+	"sync"
+	"sync/atomic"
+)
+
+// Event represents a one-time event that may occur in the future.
+type Event struct {
+	fired int32
+	c     chan struct{}
+	o     sync.Once
+}
+
+// Fire causes e to complete.  It is safe to call multiple times, and
+// concurrently.  It returns true iff this call to Fire caused the signaling
+// channel returned by Done to close.
+func (e *Event) Fire() bool {
+	ret := false
+	e.o.Do(func() {
+		atomic.StoreInt32(&e.fired, 1)
+		close(e.c)
+		ret = true
+	})
+	return ret
+}
+
+// Done returns a channel that will be closed when Fire is called.
+func (e *Event) Done() <-chan struct{} {
+	return e.c
+}
+
+// HasFired returns true if Fire has been called.
+func (e *Event) HasFired() bool {
+	return atomic.LoadInt32(&e.fired) == 1
+}
+
+// NewEvent returns a new, ready-to-use Event.
+func NewEvent() *Event {
+	return &Event{c: make(chan struct{})}
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcsync/oncefunc.go b/vendor/google.golang.org/grpc/internal/grpcsync/oncefunc.go
new file mode 100644
index 0000000000..6635f7bca9
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcsync/oncefunc.go
@@ -0,0 +1,32 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcsync
+
+import (
+	"sync"
+)
+
+// OnceFunc returns a function wrapping f which ensures f is only executed
+// once even if the returned function is executed multiple times.
+func OnceFunc(f func()) func() {
+	var once sync.Once
+	return func() {
+		once.Do(f)
+	}
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go b/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go
new file mode 100644
index 0000000000..9f40909679
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go
@@ -0,0 +1,47 @@
+/*
+ *
+ * Copyright 2022 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcutil
+
+import (
+	"strings"
+
+	"google.golang.org/grpc/internal/envconfig"
+)
+
+// RegisteredCompressorNames holds names of the registered compressors.
+var RegisteredCompressorNames []string
+
+// IsCompressorNameRegistered returns true when name is available in registry.
+func IsCompressorNameRegistered(name string) bool {
+	for _, compressor := range RegisteredCompressorNames {
+		if compressor == name {
+			return true
+		}
+	}
+	return false
+}
+
+// RegisteredCompressors returns a string of registered compressor names
+// separated by comma.
+func RegisteredCompressors() string {
+	if !envconfig.AdvertiseCompressors {
+		return ""
+	}
+	return strings.Join(RegisteredCompressorNames, ",")
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go b/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go
new file mode 100644
index 0000000000..b25b0baec3
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go
@@ -0,0 +1,63 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcutil
+
+import (
+	"strconv"
+	"time"
+)
+
+const maxTimeoutValue int64 = 100000000 - 1
+
+// div does integer division and round-up the result. Note that this is
+// equivalent to (d+r-1)/r but has less chance to overflow.
+func div(d, r time.Duration) int64 {
+	if d%r > 0 {
+		return int64(d/r + 1)
+	}
+	return int64(d / r)
+}
+
+// EncodeDuration encodes the duration to the format grpc-timeout header
+// accepts.
+//
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests
+func EncodeDuration(t time.Duration) string {
+	// TODO: This is simplistic and not bandwidth efficient. Improve it.
+	if t <= 0 {
+		return "0n"
+	}
+	if d := div(t, time.Nanosecond); d <= maxTimeoutValue {
+		return strconv.FormatInt(d, 10) + "n"
+	}
+	if d := div(t, time.Microsecond); d <= maxTimeoutValue {
+		return strconv.FormatInt(d, 10) + "u"
+	}
+	if d := div(t, time.Millisecond); d <= maxTimeoutValue {
+		return strconv.FormatInt(d, 10) + "m"
+	}
+	if d := div(t, time.Second); d <= maxTimeoutValue {
+		return strconv.FormatInt(d, 10) + "S"
+	}
+	if d := div(t, time.Minute); d <= maxTimeoutValue {
+		return strconv.FormatInt(d, 10) + "M"
+	}
+	// Note that maxTimeoutValue * time.Hour > MaxInt64.
+	return strconv.FormatInt(div(t, time.Hour), 10) + "H"
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/grpcutil.go b/vendor/google.golang.org/grpc/internal/grpcutil/grpcutil.go
new file mode 100644
index 0000000000..e2f948e8f4
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/grpcutil.go
@@ -0,0 +1,20 @@
+/*
+ *
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package grpcutil provides utility functions used across the gRPC codebase.
+package grpcutil
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/metadata.go b/vendor/google.golang.org/grpc/internal/grpcutil/metadata.go
new file mode 100644
index 0000000000..6f22bd8911
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/metadata.go
@@ -0,0 +1,40 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcutil
+
+import (
+	"context"
+
+	"google.golang.org/grpc/metadata"
+)
+
+type mdExtraKey struct{}
+
+// WithExtraMetadata creates a new context with incoming md attached.
+func WithExtraMetadata(ctx context.Context, md metadata.MD) context.Context {
+	return context.WithValue(ctx, mdExtraKey{}, md)
+}
+
+// ExtraMetadata returns the incoming metadata in ctx if it exists.  The
+// returned MD should not be modified. Writing to it may cause races.
+// Modification should be made to copies of the returned MD.
+func ExtraMetadata(ctx context.Context) (md metadata.MD, ok bool) {
+	md, ok = ctx.Value(mdExtraKey{}).(metadata.MD)
+	return
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/method.go b/vendor/google.golang.org/grpc/internal/grpcutil/method.go
new file mode 100644
index 0000000000..ec62b4775e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/method.go
@@ -0,0 +1,88 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcutil
+
+import (
+	"errors"
+	"strings"
+)
+
+// ParseMethod splits service and method from the input. It expects format
+// "/service/method".
+func ParseMethod(methodName string) (service, method string, _ error) {
+	if !strings.HasPrefix(methodName, "/") {
+		return "", "", errors.New("invalid method name: should start with /")
+	}
+	methodName = methodName[1:]
+
+	pos := strings.LastIndex(methodName, "/")
+	if pos < 0 {
+		return "", "", errors.New("invalid method name: suffix /method is missing")
+	}
+	return methodName[:pos], methodName[pos+1:], nil
+}
+
+// baseContentType is the base content-type for gRPC.  This is a valid
+// content-type on it's own, but can also include a content-subtype such as
+// "proto" as a suffix after "+" or ";".  See
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests
+// for more details.
+const baseContentType = "application/grpc"
+
+// ContentSubtype returns the content-subtype for the given content-type.  The
+// given content-type must be a valid content-type that starts with
+// "application/grpc". A content-subtype will follow "application/grpc" after a
+// "+" or ";". See
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests for
+// more details.
+//
+// If contentType is not a valid content-type for gRPC, the boolean
+// will be false, otherwise true. If content-type == "application/grpc",
+// "application/grpc+", or "application/grpc;", the boolean will be true,
+// but no content-subtype will be returned.
+//
+// contentType is assumed to be lowercase already.
+func ContentSubtype(contentType string) (string, bool) {
+	if contentType == baseContentType {
+		return "", true
+	}
+	if !strings.HasPrefix(contentType, baseContentType) {
+		return "", false
+	}
+	// guaranteed since != baseContentType and has baseContentType prefix
+	switch contentType[len(baseContentType)] {
+	case '+', ';':
+		// this will return true for "application/grpc+" or "application/grpc;"
+		// which the previous validContentType function tested to be valid, so we
+		// just say that no content-subtype is specified in this case
+		return contentType[len(baseContentType)+1:], true
+	default:
+		return "", false
+	}
+}
+
+// ContentType builds full content type with the given sub-type.
+//
+// contentSubtype is assumed to be lowercase
+func ContentType(contentSubtype string) string {
+	if contentSubtype == "" {
+		return baseContentType
+	}
+	return baseContentType + "+" + contentSubtype
+}
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/regex.go b/vendor/google.golang.org/grpc/internal/grpcutil/regex.go
new file mode 100644
index 0000000000..7a092b2b80
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/regex.go
@@ -0,0 +1,31 @@
+/*
+ *
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpcutil
+
+import "regexp"
+
+// FullMatchWithRegex returns whether the full text matches the regex provided.
+func FullMatchWithRegex(re *regexp.Regexp, text string) bool {
+	if len(text) == 0 {
+		return re.MatchString(text)
+	}
+	re.Longest()
+	rem := re.FindString(text)
+	return len(rem) == len(text)
+}
diff --git a/vendor/google.golang.org/grpc/internal/internal.go b/vendor/google.golang.org/grpc/internal/internal.go
new file mode 100644
index 0000000000..836b6a3b3e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/internal.go
@@ -0,0 +1,170 @@
+/*
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package internal contains gRPC-internal code, to avoid polluting
+// the godoc of the top-level grpc package.  It must not import any grpc
+// symbols to avoid circular dependencies.
+package internal
+
+import (
+	"context"
+	"time"
+
+	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+var (
+	// WithHealthCheckFunc is set by dialoptions.go
+	WithHealthCheckFunc interface{} // func (HealthChecker) DialOption
+	// HealthCheckFunc is used to provide client-side LB channel health checking
+	HealthCheckFunc HealthChecker
+	// BalancerUnregister is exported by package balancer to unregister a balancer.
+	BalancerUnregister func(name string)
+	// KeepaliveMinPingTime is the minimum ping interval.  This must be 10s by
+	// default, but tests may wish to set it lower for convenience.
+	KeepaliveMinPingTime = 10 * time.Second
+	// ParseServiceConfig parses a JSON representation of the service config.
+	ParseServiceConfig interface{} // func(string) *serviceconfig.ParseResult
+	// EqualServiceConfigForTesting is for testing service config generation and
+	// parsing. Both a and b should be returned by ParseServiceConfig.
+	// This function compares the config without rawJSON stripped, in case the
+	// there's difference in white space.
+	EqualServiceConfigForTesting func(a, b serviceconfig.Config) bool
+	// GetCertificateProviderBuilder returns the registered builder for the
+	// given name. This is set by package certprovider for use from xDS
+	// bootstrap code while parsing certificate provider configs in the
+	// bootstrap file.
+	GetCertificateProviderBuilder interface{} // func(string) certprovider.Builder
+	// GetXDSHandshakeInfoForTesting returns a pointer to the xds.HandshakeInfo
+	// stored in the passed in attributes. This is set by
+	// credentials/xds/xds.go.
+	GetXDSHandshakeInfoForTesting interface{} // func (*attributes.Attributes) *xds.HandshakeInfo
+	// GetServerCredentials returns the transport credentials configured on a
+	// gRPC server. An xDS-enabled server needs to know what type of credentials
+	// is configured on the underlying gRPC server. This is set by server.go.
+	GetServerCredentials interface{} // func (*grpc.Server) credentials.TransportCredentials
+	// CanonicalString returns the canonical string of the code defined here:
+	// https://github.com/grpc/grpc/blob/master/doc/statuscodes.md.
+	CanonicalString interface{} // func (codes.Code) string
+	// DrainServerTransports initiates a graceful close of existing connections
+	// on a gRPC server accepted on the provided listener address. An
+	// xDS-enabled server invokes this method on a grpc.Server when a particular
+	// listener moves to "not-serving" mode.
+	DrainServerTransports interface{} // func(*grpc.Server, string)
+	// AddGlobalServerOptions adds an array of ServerOption that will be
+	// effective globally for newly created servers. The priority will be: 1.
+	// user-provided; 2. this method; 3. default values.
+	AddGlobalServerOptions interface{} // func(opt ...ServerOption)
+	// ClearGlobalServerOptions clears the array of extra ServerOption. This
+	// method is useful in testing and benchmarking.
+	ClearGlobalServerOptions func()
+	// AddGlobalDialOptions adds an array of DialOption that will be effective
+	// globally for newly created client channels. The priority will be: 1.
+	// user-provided; 2. this method; 3. default values.
+	AddGlobalDialOptions interface{} // func(opt ...DialOption)
+	// DisableGlobalDialOptions returns a DialOption that prevents the
+	// ClientConn from applying the global DialOptions (set via
+	// AddGlobalDialOptions).
+	DisableGlobalDialOptions interface{} // func() grpc.DialOption
+	// ClearGlobalDialOptions clears the array of extra DialOption. This
+	// method is useful in testing and benchmarking.
+	ClearGlobalDialOptions func()
+	// JoinDialOptions combines the dial options passed as arguments into a
+	// single dial option.
+	JoinDialOptions interface{} // func(...grpc.DialOption) grpc.DialOption
+	// JoinServerOptions combines the server options passed as arguments into a
+	// single server option.
+	JoinServerOptions interface{} // func(...grpc.ServerOption) grpc.ServerOption
+
+	// WithBinaryLogger returns a DialOption that specifies the binary logger
+	// for a ClientConn.
+	WithBinaryLogger interface{} // func(binarylog.Logger) grpc.DialOption
+	// BinaryLogger returns a ServerOption that can set the binary logger for a
+	// server.
+	BinaryLogger interface{} // func(binarylog.Logger) grpc.ServerOption
+
+	// NewXDSResolverWithConfigForTesting creates a new xds resolver builder using
+	// the provided xds bootstrap config instead of the global configuration from
+	// the supported environment variables.  The resolver.Builder is meant to be
+	// used in conjunction with the grpc.WithResolvers DialOption.
+	//
+	// Testing Only
+	//
+	// This function should ONLY be used for testing and may not work with some
+	// other features, including the CSDS service.
+	NewXDSResolverWithConfigForTesting interface{} // func([]byte) (resolver.Builder, error)
+
+	// RegisterRLSClusterSpecifierPluginForTesting registers the RLS Cluster
+	// Specifier Plugin for testing purposes, regardless of the XDSRLS environment
+	// variable.
+	//
+	// TODO: Remove this function once the RLS env var is removed.
+	RegisterRLSClusterSpecifierPluginForTesting func()
+
+	// UnregisterRLSClusterSpecifierPluginForTesting unregisters the RLS Cluster
+	// Specifier Plugin for testing purposes. This is needed because there is no way
+	// to unregister the RLS Cluster Specifier Plugin after registering it solely
+	// for testing purposes using RegisterRLSClusterSpecifierPluginForTesting().
+	//
+	// TODO: Remove this function once the RLS env var is removed.
+	UnregisterRLSClusterSpecifierPluginForTesting func()
+
+	// RegisterRBACHTTPFilterForTesting registers the RBAC HTTP Filter for testing
+	// purposes, regardless of the RBAC environment variable.
+	//
+	// TODO: Remove this function once the RBAC env var is removed.
+	RegisterRBACHTTPFilterForTesting func()
+
+	// UnregisterRBACHTTPFilterForTesting unregisters the RBAC HTTP Filter for
+	// testing purposes. This is needed because there is no way to unregister the
+	// HTTP Filter after registering it solely for testing purposes using
+	// RegisterRBACHTTPFilterForTesting().
+	//
+	// TODO: Remove this function once the RBAC env var is removed.
+	UnregisterRBACHTTPFilterForTesting func()
+
+	// ORCAAllowAnyMinReportingInterval is for examples/orca use ONLY.
+	ORCAAllowAnyMinReportingInterval interface{} // func(so *orca.ServiceOptions)
+)
+
+// HealthChecker defines the signature of the client-side LB channel health checking function.
+//
+// The implementation is expected to create a health checking RPC stream by
+// calling newStream(), watch for the health status of serviceName, and report
+// it's health back by calling setConnectivityState().
+//
+// The health checking protocol is defined at:
+// https://github.com/grpc/grpc/blob/master/doc/health-checking.md
+type HealthChecker func(ctx context.Context, newStream func(string) (interface{}, error), setConnectivityState func(connectivity.State, error), serviceName string) error
+
+const (
+	// CredsBundleModeFallback switches GoogleDefaultCreds to fallback mode.
+	CredsBundleModeFallback = "fallback"
+	// CredsBundleModeBalancer switches GoogleDefaultCreds to grpclb balancer
+	// mode.
+	CredsBundleModeBalancer = "balancer"
+	// CredsBundleModeBackendFromBalancer switches GoogleDefaultCreds to mode
+	// that supports backend returned by grpclb balancer.
+	CredsBundleModeBackendFromBalancer = "backend-from-balancer"
+)
+
+// RLSLoadBalancingPolicyName is the name of the RLS LB policy.
+//
+// It currently has an experimental suffix which would be removed once
+// end-to-end testing of the policy is completed.
+const RLSLoadBalancingPolicyName = "rls_experimental"
diff --git a/vendor/google.golang.org/grpc/internal/metadata/metadata.go b/vendor/google.golang.org/grpc/internal/metadata/metadata.go
new file mode 100644
index 0000000000..c82e608e07
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/metadata/metadata.go
@@ -0,0 +1,132 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package metadata contains functions to set and get metadata from addresses.
+//
+// This package is experimental.
+package metadata
+
+import (
+	"fmt"
+	"strings"
+
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/resolver"
+)
+
+type mdKeyType string
+
+const mdKey = mdKeyType("grpc.internal.address.metadata")
+
+type mdValue metadata.MD
+
+func (m mdValue) Equal(o interface{}) bool {
+	om, ok := o.(mdValue)
+	if !ok {
+		return false
+	}
+	if len(m) != len(om) {
+		return false
+	}
+	for k, v := range m {
+		ov := om[k]
+		if len(ov) != len(v) {
+			return false
+		}
+		for i, ve := range v {
+			if ov[i] != ve {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+// Get returns the metadata of addr.
+func Get(addr resolver.Address) metadata.MD {
+	attrs := addr.Attributes
+	if attrs == nil {
+		return nil
+	}
+	md, _ := attrs.Value(mdKey).(mdValue)
+	return metadata.MD(md)
+}
+
+// Set sets (overrides) the metadata in addr.
+//
+// When a SubConn is created with this address, the RPCs sent on it will all
+// have this metadata.
+func Set(addr resolver.Address, md metadata.MD) resolver.Address {
+	addr.Attributes = addr.Attributes.WithValue(mdKey, mdValue(md))
+	return addr
+}
+
+// Validate validates every pair in md with ValidatePair.
+func Validate(md metadata.MD) error {
+	for k, vals := range md {
+		if err := ValidatePair(k, vals...); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// hasNotPrintable return true if msg contains any characters which are not in %x20-%x7E
+func hasNotPrintable(msg string) bool {
+	// for i that saving a conversion if not using for range
+	for i := 0; i < len(msg); i++ {
+		if msg[i] < 0x20 || msg[i] > 0x7E {
+			return true
+		}
+	}
+	return false
+}
+
+// ValidatePair validate a key-value pair with the following rules (the pseudo-header will be skipped) :
+//
+// - key must contain one or more characters.
+// - the characters in the key must be contained in [0-9 a-z _ - .].
+// - if the key ends with a "-bin" suffix, no validation of the corresponding value is performed.
+// - the characters in the every value must be printable (in [%x20-%x7E]).
+func ValidatePair(key string, vals ...string) error {
+	// key should not be empty
+	if key == "" {
+		return fmt.Errorf("there is an empty key in the header")
+	}
+	// pseudo-header will be ignored
+	if key[0] == ':' {
+		return nil
+	}
+	// check key, for i that saving a conversion if not using for range
+	for i := 0; i < len(key); i++ {
+		r := key[i]
+		if !(r >= 'a' && r <= 'z') && !(r >= '0' && r <= '9') && r != '.' && r != '-' && r != '_' {
+			return fmt.Errorf("header key %q contains illegal characters not in [0-9a-z-_.]", key)
+		}
+	}
+	if strings.HasSuffix(key, "-bin") {
+		return nil
+	}
+	// check value
+	for _, val := range vals {
+		if hasNotPrintable(val) {
+			return fmt.Errorf("header key %q contains value with non-printable ASCII characters", key)
+		}
+	}
+	return nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/pretty/pretty.go b/vendor/google.golang.org/grpc/internal/pretty/pretty.go
new file mode 100644
index 0000000000..0177af4b51
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/pretty/pretty.go
@@ -0,0 +1,82 @@
+/*
+ *
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package pretty defines helper functions to pretty-print structs for logging.
+package pretty
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+
+	"github.com/golang/protobuf/jsonpb"
+	protov1 "github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/encoding/protojson"
+	protov2 "google.golang.org/protobuf/proto"
+)
+
+const jsonIndent = "  "
+
+// ToJSON marshals the input into a json string.
+//
+// If marshal fails, it falls back to fmt.Sprintf("%+v").
+func ToJSON(e interface{}) string {
+	switch ee := e.(type) {
+	case protov1.Message:
+		mm := jsonpb.Marshaler{Indent: jsonIndent}
+		ret, err := mm.MarshalToString(ee)
+		if err != nil {
+			// This may fail for proto.Anys, e.g. for xDS v2, LDS, the v2
+			// messages are not imported, and this will fail because the message
+			// is not found.
+			return fmt.Sprintf("%+v", ee)
+		}
+		return ret
+	case protov2.Message:
+		mm := protojson.MarshalOptions{
+			Multiline: true,
+			Indent:    jsonIndent,
+		}
+		ret, err := mm.Marshal(ee)
+		if err != nil {
+			// This may fail for proto.Anys, e.g. for xDS v2, LDS, the v2
+			// messages are not imported, and this will fail because the message
+			// is not found.
+			return fmt.Sprintf("%+v", ee)
+		}
+		return string(ret)
+	default:
+		ret, err := json.MarshalIndent(ee, "", jsonIndent)
+		if err != nil {
+			return fmt.Sprintf("%+v", ee)
+		}
+		return string(ret)
+	}
+}
+
+// FormatJSON formats the input json bytes with indentation.
+//
+// If Indent fails, it returns the unchanged input as string.
+func FormatJSON(b []byte) string {
+	var out bytes.Buffer
+	err := json.Indent(&out, b, "", jsonIndent)
+	if err != nil {
+		return string(b)
+	}
+	return out.String()
+}
diff --git a/vendor/google.golang.org/grpc/internal/resolver/config_selector.go b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go
new file mode 100644
index 0000000000..c7a18a948a
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go
@@ -0,0 +1,167 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package resolver provides internal resolver-related functionality.
+package resolver
+
+import (
+	"context"
+	"sync"
+
+	"google.golang.org/grpc/internal/serviceconfig"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/resolver"
+)
+
+// ConfigSelector controls what configuration to use for every RPC.
+type ConfigSelector interface {
+	// Selects the configuration for the RPC, or terminates it using the error.
+	// This error will be converted by the gRPC library to a status error with
+	// code UNKNOWN if it is not returned as a status error.
+	SelectConfig(RPCInfo) (*RPCConfig, error)
+}
+
+// RPCInfo contains RPC information needed by a ConfigSelector.
+type RPCInfo struct {
+	// Context is the user's context for the RPC and contains headers and
+	// application timeout.  It is passed for interception purposes and for
+	// efficiency reasons.  SelectConfig should not be blocking.
+	Context context.Context
+	Method  string // i.e. "/Service/Method"
+}
+
+// RPCConfig describes the configuration to use for each RPC.
+type RPCConfig struct {
+	// The context to use for the remainder of the RPC; can pass info to LB
+	// policy or affect timeout or metadata.
+	Context      context.Context
+	MethodConfig serviceconfig.MethodConfig // configuration to use for this RPC
+	OnCommitted  func()                     // Called when the RPC has been committed (retries no longer possible)
+	Interceptor  ClientInterceptor
+}
+
+// ClientStream is the same as grpc.ClientStream, but defined here for circular
+// dependency reasons.
+type ClientStream interface {
+	// Header returns the header metadata received from the server if there
+	// is any. It blocks if the metadata is not ready to read.
+	Header() (metadata.MD, error)
+	// Trailer returns the trailer metadata from the server, if there is any.
+	// It must only be called after stream.CloseAndRecv has returned, or
+	// stream.Recv has returned a non-nil error (including io.EOF).
+	Trailer() metadata.MD
+	// CloseSend closes the send direction of the stream. It closes the stream
+	// when non-nil error is met. It is also not safe to call CloseSend
+	// concurrently with SendMsg.
+	CloseSend() error
+	// Context returns the context for this stream.
+	//
+	// It should not be called until after Header or RecvMsg has returned. Once
+	// called, subsequent client-side retries are disabled.
+	Context() context.Context
+	// SendMsg is generally called by generated code. On error, SendMsg aborts
+	// the stream. If the error was generated by the client, the status is
+	// returned directly; otherwise, io.EOF is returned and the status of
+	// the stream may be discovered using RecvMsg.
+	//
+	// SendMsg blocks until:
+	//   - There is sufficient flow control to schedule m with the transport, or
+	//   - The stream is done, or
+	//   - The stream breaks.
+	//
+	// SendMsg does not wait until the message is received by the server. An
+	// untimely stream closure may result in lost messages. To ensure delivery,
+	// users should ensure the RPC completed successfully using RecvMsg.
+	//
+	// It is safe to have a goroutine calling SendMsg and another goroutine
+	// calling RecvMsg on the same stream at the same time, but it is not safe
+	// to call SendMsg on the same stream in different goroutines. It is also
+	// not safe to call CloseSend concurrently with SendMsg.
+	SendMsg(m interface{}) error
+	// RecvMsg blocks until it receives a message into m or the stream is
+	// done. It returns io.EOF when the stream completes successfully. On
+	// any other error, the stream is aborted and the error contains the RPC
+	// status.
+	//
+	// It is safe to have a goroutine calling SendMsg and another goroutine
+	// calling RecvMsg on the same stream at the same time, but it is not
+	// safe to call RecvMsg on the same stream in different goroutines.
+	RecvMsg(m interface{}) error
+}
+
+// ClientInterceptor is an interceptor for gRPC client streams.
+type ClientInterceptor interface {
+	// NewStream produces a ClientStream for an RPC which may optionally use
+	// the provided function to produce a stream for delegation.  Note:
+	// RPCInfo.Context should not be used (will be nil).
+	//
+	// done is invoked when the RPC is finished using its connection, or could
+	// not be assigned a connection.  RPC operations may still occur on
+	// ClientStream after done is called, since the interceptor is invoked by
+	// application-layer operations.  done must never be nil when called.
+	NewStream(ctx context.Context, ri RPCInfo, done func(), newStream func(ctx context.Context, done func()) (ClientStream, error)) (ClientStream, error)
+}
+
+// ServerInterceptor is an interceptor for incoming RPC's on gRPC server side.
+type ServerInterceptor interface {
+	// AllowRPC checks if an incoming RPC is allowed to proceed based on
+	// information about connection RPC was received on, and HTTP Headers. This
+	// information will be piped into context.
+	AllowRPC(ctx context.Context) error // TODO: Make this a real interceptor for filters such as rate limiting.
+}
+
+type csKeyType string
+
+const csKey = csKeyType("grpc.internal.resolver.configSelector")
+
+// SetConfigSelector sets the config selector in state and returns the new
+// state.
+func SetConfigSelector(state resolver.State, cs ConfigSelector) resolver.State {
+	state.Attributes = state.Attributes.WithValue(csKey, cs)
+	return state
+}
+
+// GetConfigSelector retrieves the config selector from state, if present, and
+// returns it or nil if absent.
+func GetConfigSelector(state resolver.State) ConfigSelector {
+	cs, _ := state.Attributes.Value(csKey).(ConfigSelector)
+	return cs
+}
+
+// SafeConfigSelector allows for safe switching of ConfigSelector
+// implementations such that previous values are guaranteed to not be in use
+// when UpdateConfigSelector returns.
+type SafeConfigSelector struct {
+	mu sync.RWMutex
+	cs ConfigSelector
+}
+
+// UpdateConfigSelector swaps to the provided ConfigSelector and blocks until
+// all uses of the previous ConfigSelector have completed.
+func (scs *SafeConfigSelector) UpdateConfigSelector(cs ConfigSelector) {
+	scs.mu.Lock()
+	defer scs.mu.Unlock()
+	scs.cs = cs
+}
+
+// SelectConfig defers to the current ConfigSelector in scs.
+func (scs *SafeConfigSelector) SelectConfig(r RPCInfo) (*RPCConfig, error) {
+	scs.mu.RLock()
+	defer scs.mu.RUnlock()
+	return scs.cs.SelectConfig(r)
+}
diff --git a/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go b/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
new file mode 100644
index 0000000000..09a667f33c
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
@@ -0,0 +1,458 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package dns implements a dns resolver to be installed as the default resolver
+// in grpc.
+package dns
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	grpclbstate "google.golang.org/grpc/balancer/grpclb/state"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/internal/backoff"
+	"google.golang.org/grpc/internal/envconfig"
+	"google.golang.org/grpc/internal/grpcrand"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+// EnableSRVLookups controls whether the DNS resolver attempts to fetch gRPCLB
+// addresses from SRV records.  Must not be changed after init time.
+var EnableSRVLookups = false
+
+var logger = grpclog.Component("dns")
+
+// Globals to stub out in tests. TODO: Perhaps these two can be combined into a
+// single variable for testing the resolver?
+var (
+	newTimer           = time.NewTimer
+	newTimerDNSResRate = time.NewTimer
+)
+
+func init() {
+	resolver.Register(NewBuilder())
+}
+
+const (
+	defaultPort       = "443"
+	defaultDNSSvrPort = "53"
+	golang            = "GO"
+	// txtPrefix is the prefix string to be prepended to the host name for txt record lookup.
+	txtPrefix = "_grpc_config."
+	// In DNS, service config is encoded in a TXT record via the mechanism
+	// described in RFC-1464 using the attribute name grpc_config.
+	txtAttribute = "grpc_config="
+)
+
+var (
+	errMissingAddr = errors.New("dns resolver: missing address")
+
+	// Addresses ending with a colon that is supposed to be the separator
+	// between host and port is not allowed.  E.g. "::" is a valid address as
+	// it is an IPv6 address (host only) and "[::]:" is invalid as it ends with
+	// a colon as the host and port separator
+	errEndsWithColon = errors.New("dns resolver: missing port after port-separator colon")
+)
+
+var (
+	defaultResolver netResolver = net.DefaultResolver
+	// To prevent excessive re-resolution, we enforce a rate limit on DNS
+	// resolution requests.
+	minDNSResRate = 30 * time.Second
+)
+
+var customAuthorityDialler = func(authority string) func(ctx context.Context, network, address string) (net.Conn, error) {
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		var dialer net.Dialer
+		return dialer.DialContext(ctx, network, authority)
+	}
+}
+
+var customAuthorityResolver = func(authority string) (netResolver, error) {
+	host, port, err := parseTarget(authority, defaultDNSSvrPort)
+	if err != nil {
+		return nil, err
+	}
+
+	authorityWithPort := net.JoinHostPort(host, port)
+
+	return &net.Resolver{
+		PreferGo: true,
+		Dial:     customAuthorityDialler(authorityWithPort),
+	}, nil
+}
+
+// NewBuilder creates a dnsBuilder which is used to factory DNS resolvers.
+func NewBuilder() resolver.Builder {
+	return &dnsBuilder{}
+}
+
+type dnsBuilder struct{}
+
+// Build creates and starts a DNS resolver that watches the name resolution of the target.
+func (b *dnsBuilder) Build(target resolver.Target, cc resolver.ClientConn, opts resolver.BuildOptions) (resolver.Resolver, error) {
+	host, port, err := parseTarget(target.Endpoint(), defaultPort)
+	if err != nil {
+		return nil, err
+	}
+
+	// IP address.
+	if ipAddr, ok := formatIP(host); ok {
+		addr := []resolver.Address{{Addr: ipAddr + ":" + port}}
+		cc.UpdateState(resolver.State{Addresses: addr})
+		return deadResolver{}, nil
+	}
+
+	// DNS address (non-IP).
+	ctx, cancel := context.WithCancel(context.Background())
+	d := &dnsResolver{
+		host:                 host,
+		port:                 port,
+		ctx:                  ctx,
+		cancel:               cancel,
+		cc:                   cc,
+		rn:                   make(chan struct{}, 1),
+		disableServiceConfig: opts.DisableServiceConfig,
+	}
+
+	if target.URL.Host == "" {
+		d.resolver = defaultResolver
+	} else {
+		d.resolver, err = customAuthorityResolver(target.URL.Host)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	d.wg.Add(1)
+	go d.watcher()
+	return d, nil
+}
+
+// Scheme returns the naming scheme of this resolver builder, which is "dns".
+func (b *dnsBuilder) Scheme() string {
+	return "dns"
+}
+
+type netResolver interface {
+	LookupHost(ctx context.Context, host string) (addrs []string, err error)
+	LookupSRV(ctx context.Context, service, proto, name string) (cname string, addrs []*net.SRV, err error)
+	LookupTXT(ctx context.Context, name string) (txts []string, err error)
+}
+
+// deadResolver is a resolver that does nothing.
+type deadResolver struct{}
+
+func (deadResolver) ResolveNow(resolver.ResolveNowOptions) {}
+
+func (deadResolver) Close() {}
+
+// dnsResolver watches for the name resolution update for a non-IP target.
+type dnsResolver struct {
+	host     string
+	port     string
+	resolver netResolver
+	ctx      context.Context
+	cancel   context.CancelFunc
+	cc       resolver.ClientConn
+	// rn channel is used by ResolveNow() to force an immediate resolution of the target.
+	rn chan struct{}
+	// wg is used to enforce Close() to return after the watcher() goroutine has finished.
+	// Otherwise, data race will be possible. [Race Example] in dns_resolver_test we
+	// replace the real lookup functions with mocked ones to facilitate testing.
+	// If Close() doesn't wait for watcher() goroutine finishes, race detector sometimes
+	// will warns lookup (READ the lookup function pointers) inside watcher() goroutine
+	// has data race with replaceNetFunc (WRITE the lookup function pointers).
+	wg                   sync.WaitGroup
+	disableServiceConfig bool
+}
+
+// ResolveNow invoke an immediate resolution of the target that this dnsResolver watches.
+func (d *dnsResolver) ResolveNow(resolver.ResolveNowOptions) {
+	select {
+	case d.rn <- struct{}{}:
+	default:
+	}
+}
+
+// Close closes the dnsResolver.
+func (d *dnsResolver) Close() {
+	d.cancel()
+	d.wg.Wait()
+}
+
+func (d *dnsResolver) watcher() {
+	defer d.wg.Done()
+	backoffIndex := 1
+	for {
+		state, err := d.lookup()
+		if err != nil {
+			// Report error to the underlying grpc.ClientConn.
+			d.cc.ReportError(err)
+		} else {
+			err = d.cc.UpdateState(*state)
+		}
+
+		var timer *time.Timer
+		if err == nil {
+			// Success resolving, wait for the next ResolveNow. However, also wait 30 seconds at the very least
+			// to prevent constantly re-resolving.
+			backoffIndex = 1
+			timer = newTimerDNSResRate(minDNSResRate)
+			select {
+			case <-d.ctx.Done():
+				timer.Stop()
+				return
+			case <-d.rn:
+			}
+		} else {
+			// Poll on an error found in DNS Resolver or an error received from ClientConn.
+			timer = newTimer(backoff.DefaultExponential.Backoff(backoffIndex))
+			backoffIndex++
+		}
+		select {
+		case <-d.ctx.Done():
+			timer.Stop()
+			return
+		case <-timer.C:
+		}
+	}
+}
+
+func (d *dnsResolver) lookupSRV() ([]resolver.Address, error) {
+	if !EnableSRVLookups {
+		return nil, nil
+	}
+	var newAddrs []resolver.Address
+	_, srvs, err := d.resolver.LookupSRV(d.ctx, "grpclb", "tcp", d.host)
+	if err != nil {
+		err = handleDNSError(err, "SRV") // may become nil
+		return nil, err
+	}
+	for _, s := range srvs {
+		lbAddrs, err := d.resolver.LookupHost(d.ctx, s.Target)
+		if err != nil {
+			err = handleDNSError(err, "A") // may become nil
+			if err == nil {
+				// If there are other SRV records, look them up and ignore this
+				// one that does not exist.
+				continue
+			}
+			return nil, err
+		}
+		for _, a := range lbAddrs {
+			ip, ok := formatIP(a)
+			if !ok {
+				return nil, fmt.Errorf("dns: error parsing A record IP address %v", a)
+			}
+			addr := ip + ":" + strconv.Itoa(int(s.Port))
+			newAddrs = append(newAddrs, resolver.Address{Addr: addr, ServerName: s.Target})
+		}
+	}
+	return newAddrs, nil
+}
+
+func handleDNSError(err error, lookupType string) error {
+	if dnsErr, ok := err.(*net.DNSError); ok && !dnsErr.IsTimeout && !dnsErr.IsTemporary {
+		// Timeouts and temporary errors should be communicated to gRPC to
+		// attempt another DNS query (with backoff).  Other errors should be
+		// suppressed (they may represent the absence of a TXT record).
+		return nil
+	}
+	if err != nil {
+		err = fmt.Errorf("dns: %v record lookup error: %v", lookupType, err)
+		logger.Info(err)
+	}
+	return err
+}
+
+func (d *dnsResolver) lookupTXT() *serviceconfig.ParseResult {
+	ss, err := d.resolver.LookupTXT(d.ctx, txtPrefix+d.host)
+	if err != nil {
+		if envconfig.TXTErrIgnore {
+			return nil
+		}
+		if err = handleDNSError(err, "TXT"); err != nil {
+			return &serviceconfig.ParseResult{Err: err}
+		}
+		return nil
+	}
+	var res string
+	for _, s := range ss {
+		res += s
+	}
+
+	// TXT record must have "grpc_config=" attribute in order to be used as service config.
+	if !strings.HasPrefix(res, txtAttribute) {
+		logger.Warningf("dns: TXT record %v missing %v attribute", res, txtAttribute)
+		// This is not an error; it is the equivalent of not having a service config.
+		return nil
+	}
+	sc := canaryingSC(strings.TrimPrefix(res, txtAttribute))
+	return d.cc.ParseServiceConfig(sc)
+}
+
+func (d *dnsResolver) lookupHost() ([]resolver.Address, error) {
+	addrs, err := d.resolver.LookupHost(d.ctx, d.host)
+	if err != nil {
+		err = handleDNSError(err, "A")
+		return nil, err
+	}
+	newAddrs := make([]resolver.Address, 0, len(addrs))
+	for _, a := range addrs {
+		ip, ok := formatIP(a)
+		if !ok {
+			return nil, fmt.Errorf("dns: error parsing A record IP address %v", a)
+		}
+		addr := ip + ":" + d.port
+		newAddrs = append(newAddrs, resolver.Address{Addr: addr})
+	}
+	return newAddrs, nil
+}
+
+func (d *dnsResolver) lookup() (*resolver.State, error) {
+	srv, srvErr := d.lookupSRV()
+	addrs, hostErr := d.lookupHost()
+	if hostErr != nil && (srvErr != nil || len(srv) == 0) {
+		return nil, hostErr
+	}
+
+	state := resolver.State{Addresses: addrs}
+	if len(srv) > 0 {
+		state = grpclbstate.Set(state, &grpclbstate.State{BalancerAddresses: srv})
+	}
+	if !d.disableServiceConfig {
+		state.ServiceConfig = d.lookupTXT()
+	}
+	return &state, nil
+}
+
+// formatIP returns ok = false if addr is not a valid textual representation of an IP address.
+// If addr is an IPv4 address, return the addr and ok = true.
+// If addr is an IPv6 address, return the addr enclosed in square brackets and ok = true.
+func formatIP(addr string) (addrIP string, ok bool) {
+	ip := net.ParseIP(addr)
+	if ip == nil {
+		return "", false
+	}
+	if ip.To4() != nil {
+		return addr, true
+	}
+	return "[" + addr + "]", true
+}
+
+// parseTarget takes the user input target string and default port, returns formatted host and port info.
+// If target doesn't specify a port, set the port to be the defaultPort.
+// If target is in IPv6 format and host-name is enclosed in square brackets, brackets
+// are stripped when setting the host.
+// examples:
+// target: "www.google.com" defaultPort: "443" returns host: "www.google.com", port: "443"
+// target: "ipv4-host:80" defaultPort: "443" returns host: "ipv4-host", port: "80"
+// target: "[ipv6-host]" defaultPort: "443" returns host: "ipv6-host", port: "443"
+// target: ":80" defaultPort: "443" returns host: "localhost", port: "80"
+func parseTarget(target, defaultPort string) (host, port string, err error) {
+	if target == "" {
+		return "", "", errMissingAddr
+	}
+	if ip := net.ParseIP(target); ip != nil {
+		// target is an IPv4 or IPv6(without brackets) address
+		return target, defaultPort, nil
+	}
+	if host, port, err = net.SplitHostPort(target); err == nil {
+		if port == "" {
+			// If the port field is empty (target ends with colon), e.g. "[::1]:", this is an error.
+			return "", "", errEndsWithColon
+		}
+		// target has port, i.e ipv4-host:port, [ipv6-host]:port, host-name:port
+		if host == "" {
+			// Keep consistent with net.Dial(): If the host is empty, as in ":80", the local system is assumed.
+			host = "localhost"
+		}
+		return host, port, nil
+	}
+	if host, port, err = net.SplitHostPort(target + ":" + defaultPort); err == nil {
+		// target doesn't have port
+		return host, port, nil
+	}
+	return "", "", fmt.Errorf("invalid target address %v, error info: %v", target, err)
+}
+
+type rawChoice struct {
+	ClientLanguage *[]string        `json:"clientLanguage,omitempty"`
+	Percentage     *int             `json:"percentage,omitempty"`
+	ClientHostName *[]string        `json:"clientHostName,omitempty"`
+	ServiceConfig  *json.RawMessage `json:"serviceConfig,omitempty"`
+}
+
+func containsString(a *[]string, b string) bool {
+	if a == nil {
+		return true
+	}
+	for _, c := range *a {
+		if c == b {
+			return true
+		}
+	}
+	return false
+}
+
+func chosenByPercentage(a *int) bool {
+	if a == nil {
+		return true
+	}
+	return grpcrand.Intn(100)+1 <= *a
+}
+
+func canaryingSC(js string) string {
+	if js == "" {
+		return ""
+	}
+	var rcs []rawChoice
+	err := json.Unmarshal([]byte(js), &rcs)
+	if err != nil {
+		logger.Warningf("dns: error parsing service config json: %v", err)
+		return ""
+	}
+	cliHostname, err := os.Hostname()
+	if err != nil {
+		logger.Warningf("dns: error getting client hostname: %v", err)
+		return ""
+	}
+	var sc string
+	for _, c := range rcs {
+		if !containsString(c.ClientLanguage, golang) ||
+			!chosenByPercentage(c.Percentage) ||
+			!containsString(c.ClientHostName, cliHostname) ||
+			c.ServiceConfig == nil {
+			continue
+		}
+		sc = string(*c.ServiceConfig)
+		break
+	}
+	return sc
+}
diff --git a/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go b/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go
new file mode 100644
index 0000000000..afac56572a
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/resolver/passthrough/passthrough.go
@@ -0,0 +1,64 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package passthrough implements a pass-through resolver. It sends the target
+// name without scheme back to gRPC as resolved address.
+package passthrough
+
+import (
+	"errors"
+
+	"google.golang.org/grpc/resolver"
+)
+
+const scheme = "passthrough"
+
+type passthroughBuilder struct{}
+
+func (*passthroughBuilder) Build(target resolver.Target, cc resolver.ClientConn, opts resolver.BuildOptions) (resolver.Resolver, error) {
+	if target.Endpoint() == "" && opts.Dialer == nil {
+		return nil, errors.New("passthrough: received empty target in Build()")
+	}
+	r := &passthroughResolver{
+		target: target,
+		cc:     cc,
+	}
+	r.start()
+	return r, nil
+}
+
+func (*passthroughBuilder) Scheme() string {
+	return scheme
+}
+
+type passthroughResolver struct {
+	target resolver.Target
+	cc     resolver.ClientConn
+}
+
+func (r *passthroughResolver) start() {
+	r.cc.UpdateState(resolver.State{Addresses: []resolver.Address{{Addr: r.target.Endpoint()}}})
+}
+
+func (*passthroughResolver) ResolveNow(o resolver.ResolveNowOptions) {}
+
+func (*passthroughResolver) Close() {}
+
+func init() {
+	resolver.Register(&passthroughBuilder{})
+}
diff --git a/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go b/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
new file mode 100644
index 0000000000..1609116877
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/resolver/unix/unix.go
@@ -0,0 +1,74 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package unix implements a resolver for unix targets.
+package unix
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/internal/transport/networktype"
+	"google.golang.org/grpc/resolver"
+)
+
+const unixScheme = "unix"
+const unixAbstractScheme = "unix-abstract"
+
+type builder struct {
+	scheme string
+}
+
+func (b *builder) Build(target resolver.Target, cc resolver.ClientConn, _ resolver.BuildOptions) (resolver.Resolver, error) {
+	if target.URL.Host != "" {
+		return nil, fmt.Errorf("invalid (non-empty) authority: %v", target.URL.Host)
+	}
+
+	// gRPC was parsing the dial target manually before PR #4817, and we
+	// switched to using url.Parse() in that PR. To avoid breaking existing
+	// resolver implementations we ended up stripping the leading "/" from the
+	// endpoint. This obviously does not work for the "unix" scheme. Hence we
+	// end up using the parsed URL instead.
+	endpoint := target.URL.Path
+	if endpoint == "" {
+		endpoint = target.URL.Opaque
+	}
+	addr := resolver.Address{Addr: endpoint}
+	if b.scheme == unixAbstractScheme {
+		// We can not prepend \0 as c++ gRPC does, as in Golang '@' is used to signify we do
+		// not want trailing \0 in address.
+		addr.Addr = "@" + addr.Addr
+	}
+	cc.UpdateState(resolver.State{Addresses: []resolver.Address{networktype.Set(addr, "unix")}})
+	return &nopResolver{}, nil
+}
+
+func (b *builder) Scheme() string {
+	return b.scheme
+}
+
+type nopResolver struct {
+}
+
+func (*nopResolver) ResolveNow(resolver.ResolveNowOptions) {}
+
+func (*nopResolver) Close() {}
+
+func init() {
+	resolver.Register(&builder{scheme: unixScheme})
+	resolver.Register(&builder{scheme: unixAbstractScheme})
+}
diff --git a/vendor/google.golang.org/grpc/internal/serviceconfig/serviceconfig.go b/vendor/google.golang.org/grpc/internal/serviceconfig/serviceconfig.go
new file mode 100644
index 0000000000..51e733e495
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/serviceconfig/serviceconfig.go
@@ -0,0 +1,180 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package serviceconfig contains utility functions to parse service config.
+package serviceconfig
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	externalserviceconfig "google.golang.org/grpc/serviceconfig"
+)
+
+var logger = grpclog.Component("core")
+
+// BalancerConfig wraps the name and config associated with one load balancing
+// policy. It corresponds to a single entry of the loadBalancingConfig field
+// from ServiceConfig.
+//
+// It implements the json.Unmarshaler interface.
+//
+// https://github.com/grpc/grpc-proto/blob/54713b1e8bc6ed2d4f25fb4dff527842150b91b2/grpc/service_config/service_config.proto#L247
+type BalancerConfig struct {
+	Name   string
+	Config externalserviceconfig.LoadBalancingConfig
+}
+
+type intermediateBalancerConfig []map[string]json.RawMessage
+
+// MarshalJSON implements the json.Marshaler interface.
+//
+// It marshals the balancer and config into a length-1 slice
+// ([]map[string]config).
+func (bc *BalancerConfig) MarshalJSON() ([]byte, error) {
+	if bc.Config == nil {
+		// If config is nil, return empty config `{}`.
+		return []byte(fmt.Sprintf(`[{%q: %v}]`, bc.Name, "{}")), nil
+	}
+	c, err := json.Marshal(bc.Config)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(fmt.Sprintf(`[{%q: %s}]`, bc.Name, c)), nil
+}
+
+// UnmarshalJSON implements the json.Unmarshaler interface.
+//
+// ServiceConfig contains a list of loadBalancingConfigs, each with a name and
+// config. This method iterates through that list in order, and stops at the
+// first policy that is supported.
+//   - If the config for the first supported policy is invalid, the whole service
+//     config is invalid.
+//   - If the list doesn't contain any supported policy, the whole service config
+//     is invalid.
+func (bc *BalancerConfig) UnmarshalJSON(b []byte) error {
+	var ir intermediateBalancerConfig
+	err := json.Unmarshal(b, &ir)
+	if err != nil {
+		return err
+	}
+
+	var names []string
+	for i, lbcfg := range ir {
+		if len(lbcfg) != 1 {
+			return fmt.Errorf("invalid loadBalancingConfig: entry %v does not contain exactly 1 policy/config pair: %q", i, lbcfg)
+		}
+
+		var (
+			name    string
+			jsonCfg json.RawMessage
+		)
+		// Get the key:value pair from the map. We have already made sure that
+		// the map contains a single entry.
+		for name, jsonCfg = range lbcfg {
+		}
+
+		names = append(names, name)
+		builder := balancer.Get(name)
+		if builder == nil {
+			// If the balancer is not registered, move on to the next config.
+			// This is not an error.
+			continue
+		}
+		bc.Name = name
+
+		parser, ok := builder.(balancer.ConfigParser)
+		if !ok {
+			if string(jsonCfg) != "{}" {
+				logger.Warningf("non-empty balancer configuration %q, but balancer does not implement ParseConfig", string(jsonCfg))
+			}
+			// Stop at this, though the builder doesn't support parsing config.
+			return nil
+		}
+
+		cfg, err := parser.ParseConfig(jsonCfg)
+		if err != nil {
+			return fmt.Errorf("error parsing loadBalancingConfig for policy %q: %v", name, err)
+		}
+		bc.Config = cfg
+		return nil
+	}
+	// This is reached when the for loop iterates over all entries, but didn't
+	// return. This means we had a loadBalancingConfig slice but did not
+	// encounter a registered policy. The config is considered invalid in this
+	// case.
+	return fmt.Errorf("invalid loadBalancingConfig: no supported policies found in %v", names)
+}
+
+// MethodConfig defines the configuration recommended by the service providers for a
+// particular method.
+type MethodConfig struct {
+	// WaitForReady indicates whether RPCs sent to this method should wait until
+	// the connection is ready by default (!failfast). The value specified via the
+	// gRPC client API will override the value set here.
+	WaitForReady *bool
+	// Timeout is the default timeout for RPCs sent to this method. The actual
+	// deadline used will be the minimum of the value specified here and the value
+	// set by the application via the gRPC client API.  If either one is not set,
+	// then the other will be used.  If neither is set, then the RPC has no deadline.
+	Timeout *time.Duration
+	// MaxReqSize is the maximum allowed payload size for an individual request in a
+	// stream (client->server) in bytes. The size which is measured is the serialized
+	// payload after per-message compression (but before stream compression) in bytes.
+	// The actual value used is the minimum of the value specified here and the value set
+	// by the application via the gRPC client API. If either one is not set, then the other
+	// will be used.  If neither is set, then the built-in default is used.
+	MaxReqSize *int
+	// MaxRespSize is the maximum allowed payload size for an individual response in a
+	// stream (server->client) in bytes.
+	MaxRespSize *int
+	// RetryPolicy configures retry options for the method.
+	RetryPolicy *RetryPolicy
+}
+
+// RetryPolicy defines the go-native version of the retry policy defined by the
+// service config here:
+// https://github.com/grpc/proposal/blob/master/A6-client-retries.md#integration-with-service-config
+type RetryPolicy struct {
+	// MaxAttempts is the maximum number of attempts, including the original RPC.
+	//
+	// This field is required and must be two or greater.
+	MaxAttempts int
+
+	// Exponential backoff parameters. The initial retry attempt will occur at
+	// random(0, initialBackoff). In general, the nth attempt will occur at
+	// random(0,
+	//   min(initialBackoff*backoffMultiplier**(n-1), maxBackoff)).
+	//
+	// These fields are required and must be greater than zero.
+	InitialBackoff    time.Duration
+	MaxBackoff        time.Duration
+	BackoffMultiplier float64
+
+	// The set of status codes which may be retried.
+	//
+	// Status codes are specified as strings, e.g., "UNAVAILABLE".
+	//
+	// This field is required and must be non-empty.
+	// Note: a set is used to store this for easy lookup.
+	RetryableStatusCodes map[codes.Code]bool
+}
diff --git a/vendor/google.golang.org/grpc/internal/status/status.go b/vendor/google.golang.org/grpc/internal/status/status.go
new file mode 100644
index 0000000000..b0ead4f54f
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/status/status.go
@@ -0,0 +1,176 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package status implements errors returned by gRPC.  These errors are
+// serialized and transmitted on the wire between server and client, and allow
+// for additional data to be transmitted via the Details field in the status
+// proto.  gRPC service handlers should return an error created by this
+// package, and gRPC clients should expect a corresponding error to be
+// returned from the RPC call.
+//
+// This package upholds the invariants that a non-nil error may not
+// contain an OK code, and an OK code must result in a nil error.
+package status
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/golang/protobuf/ptypes"
+	spb "google.golang.org/genproto/googleapis/rpc/status"
+	"google.golang.org/grpc/codes"
+)
+
+// Status represents an RPC status code, message, and details.  It is immutable
+// and should be created with New, Newf, or FromProto.
+type Status struct {
+	s *spb.Status
+}
+
+// New returns a Status representing c and msg.
+func New(c codes.Code, msg string) *Status {
+	return &Status{s: &spb.Status{Code: int32(c), Message: msg}}
+}
+
+// Newf returns New(c, fmt.Sprintf(format, a...)).
+func Newf(c codes.Code, format string, a ...interface{}) *Status {
+	return New(c, fmt.Sprintf(format, a...))
+}
+
+// FromProto returns a Status representing s.
+func FromProto(s *spb.Status) *Status {
+	return &Status{s: proto.Clone(s).(*spb.Status)}
+}
+
+// Err returns an error representing c and msg.  If c is OK, returns nil.
+func Err(c codes.Code, msg string) error {
+	return New(c, msg).Err()
+}
+
+// Errorf returns Error(c, fmt.Sprintf(format, a...)).
+func Errorf(c codes.Code, format string, a ...interface{}) error {
+	return Err(c, fmt.Sprintf(format, a...))
+}
+
+// Code returns the status code contained in s.
+func (s *Status) Code() codes.Code {
+	if s == nil || s.s == nil {
+		return codes.OK
+	}
+	return codes.Code(s.s.Code)
+}
+
+// Message returns the message contained in s.
+func (s *Status) Message() string {
+	if s == nil || s.s == nil {
+		return ""
+	}
+	return s.s.Message
+}
+
+// Proto returns s's status as an spb.Status proto message.
+func (s *Status) Proto() *spb.Status {
+	if s == nil {
+		return nil
+	}
+	return proto.Clone(s.s).(*spb.Status)
+}
+
+// Err returns an immutable error representing s; returns nil if s.Code() is OK.
+func (s *Status) Err() error {
+	if s.Code() == codes.OK {
+		return nil
+	}
+	return &Error{s: s}
+}
+
+// WithDetails returns a new status with the provided details messages appended to the status.
+// If any errors are encountered, it returns nil and the first error encountered.
+func (s *Status) WithDetails(details ...proto.Message) (*Status, error) {
+	if s.Code() == codes.OK {
+		return nil, errors.New("no error details for status with code OK")
+	}
+	// s.Code() != OK implies that s.Proto() != nil.
+	p := s.Proto()
+	for _, detail := range details {
+		any, err := ptypes.MarshalAny(detail)
+		if err != nil {
+			return nil, err
+		}
+		p.Details = append(p.Details, any)
+	}
+	return &Status{s: p}, nil
+}
+
+// Details returns a slice of details messages attached to the status.
+// If a detail cannot be decoded, the error is returned in place of the detail.
+func (s *Status) Details() []interface{} {
+	if s == nil || s.s == nil {
+		return nil
+	}
+	details := make([]interface{}, 0, len(s.s.Details))
+	for _, any := range s.s.Details {
+		detail := &ptypes.DynamicAny{}
+		if err := ptypes.UnmarshalAny(any, detail); err != nil {
+			details = append(details, err)
+			continue
+		}
+		details = append(details, detail.Message)
+	}
+	return details
+}
+
+func (s *Status) String() string {
+	return fmt.Sprintf("rpc error: code = %s desc = %s", s.Code(), s.Message())
+}
+
+// Error wraps a pointer of a status proto. It implements error and Status,
+// and a nil *Error should never be returned by this package.
+type Error struct {
+	s *Status
+}
+
+func (e *Error) Error() string {
+	return e.s.String()
+}
+
+// GRPCStatus returns the Status represented by se.
+func (e *Error) GRPCStatus() *Status {
+	return e.s
+}
+
+// Is implements future error.Is functionality.
+// A Error is equivalent if the code and message are identical.
+func (e *Error) Is(target error) bool {
+	tse, ok := target.(*Error)
+	if !ok {
+		return false
+	}
+	return proto.Equal(e.s.s, tse.s.s)
+}
+
+// IsRestrictedControlPlaneCode returns whether the status includes a code
+// restricted for control plane usage as defined by gRFC A54.
+func IsRestrictedControlPlaneCode(s *Status) bool {
+	switch s.Code() {
+	case codes.InvalidArgument, codes.NotFound, codes.AlreadyExists, codes.FailedPrecondition, codes.Aborted, codes.OutOfRange, codes.DataLoss:
+		return true
+	}
+	return false
+}
diff --git a/vendor/google.golang.org/grpc/internal/syscall/syscall_linux.go b/vendor/google.golang.org/grpc/internal/syscall/syscall_linux.go
new file mode 100644
index 0000000000..b3a72276de
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/syscall/syscall_linux.go
@@ -0,0 +1,112 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package syscall provides functionalities that grpc uses to get low-level operating system
+// stats/info.
+package syscall
+
+import (
+	"fmt"
+	"net"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/unix"
+	"google.golang.org/grpc/grpclog"
+)
+
+var logger = grpclog.Component("core")
+
+// GetCPUTime returns the how much CPU time has passed since the start of this process.
+func GetCPUTime() int64 {
+	var ts unix.Timespec
+	if err := unix.ClockGettime(unix.CLOCK_PROCESS_CPUTIME_ID, &ts); err != nil {
+		logger.Fatal(err)
+	}
+	return ts.Nano()
+}
+
+// Rusage is an alias for syscall.Rusage under linux environment.
+type Rusage = syscall.Rusage
+
+// GetRusage returns the resource usage of current process.
+func GetRusage() *Rusage {
+	rusage := new(Rusage)
+	syscall.Getrusage(syscall.RUSAGE_SELF, rusage)
+	return rusage
+}
+
+// CPUTimeDiff returns the differences of user CPU time and system CPU time used
+// between two Rusage structs.
+func CPUTimeDiff(first *Rusage, latest *Rusage) (float64, float64) {
+	var (
+		utimeDiffs  = latest.Utime.Sec - first.Utime.Sec
+		utimeDiffus = latest.Utime.Usec - first.Utime.Usec
+		stimeDiffs  = latest.Stime.Sec - first.Stime.Sec
+		stimeDiffus = latest.Stime.Usec - first.Stime.Usec
+	)
+
+	uTimeElapsed := float64(utimeDiffs) + float64(utimeDiffus)*1.0e-6
+	sTimeElapsed := float64(stimeDiffs) + float64(stimeDiffus)*1.0e-6
+
+	return uTimeElapsed, sTimeElapsed
+}
+
+// SetTCPUserTimeout sets the TCP user timeout on a connection's socket
+func SetTCPUserTimeout(conn net.Conn, timeout time.Duration) error {
+	tcpconn, ok := conn.(*net.TCPConn)
+	if !ok {
+		// not a TCP connection. exit early
+		return nil
+	}
+	rawConn, err := tcpconn.SyscallConn()
+	if err != nil {
+		return fmt.Errorf("error getting raw connection: %v", err)
+	}
+	err = rawConn.Control(func(fd uintptr) {
+		err = syscall.SetsockoptInt(int(fd), syscall.IPPROTO_TCP, unix.TCP_USER_TIMEOUT, int(timeout/time.Millisecond))
+	})
+	if err != nil {
+		return fmt.Errorf("error setting option on socket: %v", err)
+	}
+
+	return nil
+}
+
+// GetTCPUserTimeout gets the TCP user timeout on a connection's socket
+func GetTCPUserTimeout(conn net.Conn) (opt int, err error) {
+	tcpconn, ok := conn.(*net.TCPConn)
+	if !ok {
+		err = fmt.Errorf("conn is not *net.TCPConn. got %T", conn)
+		return
+	}
+	rawConn, err := tcpconn.SyscallConn()
+	if err != nil {
+		err = fmt.Errorf("error getting raw connection: %v", err)
+		return
+	}
+	err = rawConn.Control(func(fd uintptr) {
+		opt, err = syscall.GetsockoptInt(int(fd), syscall.IPPROTO_TCP, unix.TCP_USER_TIMEOUT)
+	})
+	if err != nil {
+		err = fmt.Errorf("error getting option on socket: %v", err)
+		return
+	}
+
+	return
+}
diff --git a/vendor/google.golang.org/grpc/internal/syscall/syscall_nonlinux.go b/vendor/google.golang.org/grpc/internal/syscall/syscall_nonlinux.go
new file mode 100644
index 0000000000..999f52cd75
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/syscall/syscall_nonlinux.go
@@ -0,0 +1,77 @@
+//go:build !linux
+// +build !linux
+
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package syscall provides functionalities that grpc uses to get low-level
+// operating system stats/info.
+package syscall
+
+import (
+	"net"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc/grpclog"
+)
+
+var once sync.Once
+var logger = grpclog.Component("core")
+
+func log() {
+	once.Do(func() {
+		logger.Info("CPU time info is unavailable on non-linux environments.")
+	})
+}
+
+// GetCPUTime returns the how much CPU time has passed since the start of this
+// process. It always returns 0 under non-linux environments.
+func GetCPUTime() int64 {
+	log()
+	return 0
+}
+
+// Rusage is an empty struct under non-linux environments.
+type Rusage struct{}
+
+// GetRusage is a no-op function under non-linux environments.
+func GetRusage() *Rusage {
+	log()
+	return nil
+}
+
+// CPUTimeDiff returns the differences of user CPU time and system CPU time used
+// between two Rusage structs. It a no-op function for non-linux environments.
+func CPUTimeDiff(first *Rusage, latest *Rusage) (float64, float64) {
+	log()
+	return 0, 0
+}
+
+// SetTCPUserTimeout is a no-op function under non-linux environments.
+func SetTCPUserTimeout(conn net.Conn, timeout time.Duration) error {
+	log()
+	return nil
+}
+
+// GetTCPUserTimeout is a no-op function under non-linux environments.
+// A negative return value indicates the operation is not supported
+func GetTCPUserTimeout(conn net.Conn) (int, error) {
+	log()
+	return -1, nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/bdp_estimator.go b/vendor/google.golang.org/grpc/internal/transport/bdp_estimator.go
new file mode 100644
index 0000000000..070680edba
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/bdp_estimator.go
@@ -0,0 +1,141 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"sync"
+	"time"
+)
+
+const (
+	// bdpLimit is the maximum value the flow control windows will be increased
+	// to.  TCP typically limits this to 4MB, but some systems go up to 16MB.
+	// Since this is only a limit, it is safe to make it optimistic.
+	bdpLimit = (1 << 20) * 16
+	// alpha is a constant factor used to keep a moving average
+	// of RTTs.
+	alpha = 0.9
+	// If the current bdp sample is greater than or equal to
+	// our beta * our estimated bdp and the current bandwidth
+	// sample is the maximum bandwidth observed so far, we
+	// increase our bbp estimate by a factor of gamma.
+	beta = 0.66
+	// To put our bdp to be smaller than or equal to twice the real BDP,
+	// we should multiply our current sample with 4/3, however to round things out
+	// we use 2 as the multiplication factor.
+	gamma = 2
+)
+
+// Adding arbitrary data to ping so that its ack can be identified.
+// Easter-egg: what does the ping message say?
+var bdpPing = &ping{data: [8]byte{2, 4, 16, 16, 9, 14, 7, 7}}
+
+type bdpEstimator struct {
+	// sentAt is the time when the ping was sent.
+	sentAt time.Time
+
+	mu sync.Mutex
+	// bdp is the current bdp estimate.
+	bdp uint32
+	// sample is the number of bytes received in one measurement cycle.
+	sample uint32
+	// bwMax is the maximum bandwidth noted so far (bytes/sec).
+	bwMax float64
+	// bool to keep track of the beginning of a new measurement cycle.
+	isSent bool
+	// Callback to update the window sizes.
+	updateFlowControl func(n uint32)
+	// sampleCount is the number of samples taken so far.
+	sampleCount uint64
+	// round trip time (seconds)
+	rtt float64
+}
+
+// timesnap registers the time bdp ping was sent out so that
+// network rtt can be calculated when its ack is received.
+// It is called (by controller) when the bdpPing is
+// being written on the wire.
+func (b *bdpEstimator) timesnap(d [8]byte) {
+	if bdpPing.data != d {
+		return
+	}
+	b.sentAt = time.Now()
+}
+
+// add adds bytes to the current sample for calculating bdp.
+// It returns true only if a ping must be sent. This can be used
+// by the caller (handleData) to make decision about batching
+// a window update with it.
+func (b *bdpEstimator) add(n uint32) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.bdp == bdpLimit {
+		return false
+	}
+	if !b.isSent {
+		b.isSent = true
+		b.sample = n
+		b.sentAt = time.Time{}
+		b.sampleCount++
+		return true
+	}
+	b.sample += n
+	return false
+}
+
+// calculate is called when an ack for a bdp ping is received.
+// Here we calculate the current bdp and bandwidth sample and
+// decide if the flow control windows should go up.
+func (b *bdpEstimator) calculate(d [8]byte) {
+	// Check if the ping acked for was the bdp ping.
+	if bdpPing.data != d {
+		return
+	}
+	b.mu.Lock()
+	rttSample := time.Since(b.sentAt).Seconds()
+	if b.sampleCount < 10 {
+		// Bootstrap rtt with an average of first 10 rtt samples.
+		b.rtt += (rttSample - b.rtt) / float64(b.sampleCount)
+	} else {
+		// Heed to the recent past more.
+		b.rtt += (rttSample - b.rtt) * float64(alpha)
+	}
+	b.isSent = false
+	// The number of bytes accumulated so far in the sample is smaller
+	// than or equal to 1.5 times the real BDP on a saturated connection.
+	bwCurrent := float64(b.sample) / (b.rtt * float64(1.5))
+	if bwCurrent > b.bwMax {
+		b.bwMax = bwCurrent
+	}
+	// If the current sample (which is smaller than or equal to the 1.5 times the real BDP) is
+	// greater than or equal to 2/3rd our perceived bdp AND this is the maximum bandwidth seen so far, we
+	// should update our perception of the network BDP.
+	if float64(b.sample) >= beta*float64(b.bdp) && bwCurrent == b.bwMax && b.bdp != bdpLimit {
+		sampleFloat := float64(b.sample)
+		b.bdp = uint32(gamma * sampleFloat)
+		if b.bdp > bdpLimit {
+			b.bdp = bdpLimit
+		}
+		bdp := b.bdp
+		b.mu.Unlock()
+		b.updateFlowControl(bdp)
+		return
+	}
+	b.mu.Unlock()
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
new file mode 100644
index 0000000000..be5a9c81eb
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
@@ -0,0 +1,1007 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
+	"runtime"
+	"strconv"
+	"sync"
+	"sync/atomic"
+
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcutil"
+	"google.golang.org/grpc/status"
+)
+
+var updateHeaderTblSize = func(e *hpack.Encoder, v uint32) {
+	e.SetMaxDynamicTableSizeLimit(v)
+}
+
+type itemNode struct {
+	it   interface{}
+	next *itemNode
+}
+
+type itemList struct {
+	head *itemNode
+	tail *itemNode
+}
+
+func (il *itemList) enqueue(i interface{}) {
+	n := &itemNode{it: i}
+	if il.tail == nil {
+		il.head, il.tail = n, n
+		return
+	}
+	il.tail.next = n
+	il.tail = n
+}
+
+// peek returns the first item in the list without removing it from the
+// list.
+func (il *itemList) peek() interface{} {
+	return il.head.it
+}
+
+func (il *itemList) dequeue() interface{} {
+	if il.head == nil {
+		return nil
+	}
+	i := il.head.it
+	il.head = il.head.next
+	if il.head == nil {
+		il.tail = nil
+	}
+	return i
+}
+
+func (il *itemList) dequeueAll() *itemNode {
+	h := il.head
+	il.head, il.tail = nil, nil
+	return h
+}
+
+func (il *itemList) isEmpty() bool {
+	return il.head == nil
+}
+
+// The following defines various control items which could flow through
+// the control buffer of transport. They represent different aspects of
+// control tasks, e.g., flow control, settings, streaming resetting, etc.
+
+// maxQueuedTransportResponseFrames is the most queued "transport response"
+// frames we will buffer before preventing new reads from occurring on the
+// transport.  These are control frames sent in response to client requests,
+// such as RST_STREAM due to bad headers or settings acks.
+const maxQueuedTransportResponseFrames = 50
+
+type cbItem interface {
+	isTransportResponseFrame() bool
+}
+
+// registerStream is used to register an incoming stream with loopy writer.
+type registerStream struct {
+	streamID uint32
+	wq       *writeQuota
+}
+
+func (*registerStream) isTransportResponseFrame() bool { return false }
+
+// headerFrame is also used to register stream on the client-side.
+type headerFrame struct {
+	streamID   uint32
+	hf         []hpack.HeaderField
+	endStream  bool               // Valid on server side.
+	initStream func(uint32) error // Used only on the client side.
+	onWrite    func()
+	wq         *writeQuota    // write quota for the stream created.
+	cleanup    *cleanupStream // Valid on the server side.
+	onOrphaned func(error)    // Valid on client-side
+}
+
+func (h *headerFrame) isTransportResponseFrame() bool {
+	return h.cleanup != nil && h.cleanup.rst // Results in a RST_STREAM
+}
+
+type cleanupStream struct {
+	streamID uint32
+	rst      bool
+	rstCode  http2.ErrCode
+	onWrite  func()
+}
+
+func (c *cleanupStream) isTransportResponseFrame() bool { return c.rst } // Results in a RST_STREAM
+
+type earlyAbortStream struct {
+	httpStatus     uint32
+	streamID       uint32
+	contentSubtype string
+	status         *status.Status
+	rst            bool
+}
+
+func (*earlyAbortStream) isTransportResponseFrame() bool { return false }
+
+type dataFrame struct {
+	streamID  uint32
+	endStream bool
+	h         []byte
+	d         []byte
+	// onEachWrite is called every time
+	// a part of d is written out.
+	onEachWrite func()
+}
+
+func (*dataFrame) isTransportResponseFrame() bool { return false }
+
+type incomingWindowUpdate struct {
+	streamID  uint32
+	increment uint32
+}
+
+func (*incomingWindowUpdate) isTransportResponseFrame() bool { return false }
+
+type outgoingWindowUpdate struct {
+	streamID  uint32
+	increment uint32
+}
+
+func (*outgoingWindowUpdate) isTransportResponseFrame() bool {
+	return false // window updates are throttled by thresholds
+}
+
+type incomingSettings struct {
+	ss []http2.Setting
+}
+
+func (*incomingSettings) isTransportResponseFrame() bool { return true } // Results in a settings ACK
+
+type outgoingSettings struct {
+	ss []http2.Setting
+}
+
+func (*outgoingSettings) isTransportResponseFrame() bool { return false }
+
+type incomingGoAway struct {
+}
+
+func (*incomingGoAway) isTransportResponseFrame() bool { return false }
+
+type goAway struct {
+	code      http2.ErrCode
+	debugData []byte
+	headsUp   bool
+	closeConn error // if set, loopyWriter will exit, resulting in conn closure
+}
+
+func (*goAway) isTransportResponseFrame() bool { return false }
+
+type ping struct {
+	ack  bool
+	data [8]byte
+}
+
+func (*ping) isTransportResponseFrame() bool { return true }
+
+type outFlowControlSizeRequest struct {
+	resp chan uint32
+}
+
+func (*outFlowControlSizeRequest) isTransportResponseFrame() bool { return false }
+
+// closeConnection is an instruction to tell the loopy writer to flush the
+// framer and exit, which will cause the transport's connection to be closed
+// (by the client or server).  The transport itself will close after the reader
+// encounters the EOF caused by the connection closure.
+type closeConnection struct{}
+
+func (closeConnection) isTransportResponseFrame() bool { return false }
+
+type outStreamState int
+
+const (
+	active outStreamState = iota
+	empty
+	waitingOnStreamQuota
+)
+
+type outStream struct {
+	id               uint32
+	state            outStreamState
+	itl              *itemList
+	bytesOutStanding int
+	wq               *writeQuota
+
+	next *outStream
+	prev *outStream
+}
+
+func (s *outStream) deleteSelf() {
+	if s.prev != nil {
+		s.prev.next = s.next
+	}
+	if s.next != nil {
+		s.next.prev = s.prev
+	}
+	s.next, s.prev = nil, nil
+}
+
+type outStreamList struct {
+	// Following are sentinel objects that mark the
+	// beginning and end of the list. They do not
+	// contain any item lists. All valid objects are
+	// inserted in between them.
+	// This is needed so that an outStream object can
+	// deleteSelf() in O(1) time without knowing which
+	// list it belongs to.
+	head *outStream
+	tail *outStream
+}
+
+func newOutStreamList() *outStreamList {
+	head, tail := new(outStream), new(outStream)
+	head.next = tail
+	tail.prev = head
+	return &outStreamList{
+		head: head,
+		tail: tail,
+	}
+}
+
+func (l *outStreamList) enqueue(s *outStream) {
+	e := l.tail.prev
+	e.next = s
+	s.prev = e
+	s.next = l.tail
+	l.tail.prev = s
+}
+
+// remove from the beginning of the list.
+func (l *outStreamList) dequeue() *outStream {
+	b := l.head.next
+	if b == l.tail {
+		return nil
+	}
+	b.deleteSelf()
+	return b
+}
+
+// controlBuffer is a way to pass information to loopy.
+// Information is passed as specific struct types called control frames.
+// A control frame not only represents data, messages or headers to be sent out
+// but can also be used to instruct loopy to update its internal state.
+// It shouldn't be confused with an HTTP2 frame, although some of the control frames
+// like dataFrame and headerFrame do go out on wire as HTTP2 frames.
+type controlBuffer struct {
+	ch              chan struct{}
+	done            <-chan struct{}
+	mu              sync.Mutex
+	consumerWaiting bool
+	list            *itemList
+	err             error
+
+	// transportResponseFrames counts the number of queued items that represent
+	// the response of an action initiated by the peer.  trfChan is created
+	// when transportResponseFrames >= maxQueuedTransportResponseFrames and is
+	// closed and nilled when transportResponseFrames drops below the
+	// threshold.  Both fields are protected by mu.
+	transportResponseFrames int
+	trfChan                 atomic.Value // chan struct{}
+}
+
+func newControlBuffer(done <-chan struct{}) *controlBuffer {
+	return &controlBuffer{
+		ch:   make(chan struct{}, 1),
+		list: &itemList{},
+		done: done,
+	}
+}
+
+// throttle blocks if there are too many incomingSettings/cleanupStreams in the
+// controlbuf.
+func (c *controlBuffer) throttle() {
+	ch, _ := c.trfChan.Load().(chan struct{})
+	if ch != nil {
+		select {
+		case <-ch:
+		case <-c.done:
+		}
+	}
+}
+
+func (c *controlBuffer) put(it cbItem) error {
+	_, err := c.executeAndPut(nil, it)
+	return err
+}
+
+func (c *controlBuffer) executeAndPut(f func(it interface{}) bool, it cbItem) (bool, error) {
+	var wakeUp bool
+	c.mu.Lock()
+	if c.err != nil {
+		c.mu.Unlock()
+		return false, c.err
+	}
+	if f != nil {
+		if !f(it) { // f wasn't successful
+			c.mu.Unlock()
+			return false, nil
+		}
+	}
+	if c.consumerWaiting {
+		wakeUp = true
+		c.consumerWaiting = false
+	}
+	c.list.enqueue(it)
+	if it.isTransportResponseFrame() {
+		c.transportResponseFrames++
+		if c.transportResponseFrames == maxQueuedTransportResponseFrames {
+			// We are adding the frame that puts us over the threshold; create
+			// a throttling channel.
+			c.trfChan.Store(make(chan struct{}))
+		}
+	}
+	c.mu.Unlock()
+	if wakeUp {
+		select {
+		case c.ch <- struct{}{}:
+		default:
+		}
+	}
+	return true, nil
+}
+
+// Note argument f should never be nil.
+func (c *controlBuffer) execute(f func(it interface{}) bool, it interface{}) (bool, error) {
+	c.mu.Lock()
+	if c.err != nil {
+		c.mu.Unlock()
+		return false, c.err
+	}
+	if !f(it) { // f wasn't successful
+		c.mu.Unlock()
+		return false, nil
+	}
+	c.mu.Unlock()
+	return true, nil
+}
+
+func (c *controlBuffer) get(block bool) (interface{}, error) {
+	for {
+		c.mu.Lock()
+		if c.err != nil {
+			c.mu.Unlock()
+			return nil, c.err
+		}
+		if !c.list.isEmpty() {
+			h := c.list.dequeue().(cbItem)
+			if h.isTransportResponseFrame() {
+				if c.transportResponseFrames == maxQueuedTransportResponseFrames {
+					// We are removing the frame that put us over the
+					// threshold; close and clear the throttling channel.
+					ch := c.trfChan.Load().(chan struct{})
+					close(ch)
+					c.trfChan.Store((chan struct{})(nil))
+				}
+				c.transportResponseFrames--
+			}
+			c.mu.Unlock()
+			return h, nil
+		}
+		if !block {
+			c.mu.Unlock()
+			return nil, nil
+		}
+		c.consumerWaiting = true
+		c.mu.Unlock()
+		select {
+		case <-c.ch:
+		case <-c.done:
+			return nil, errors.New("transport closed by client")
+		}
+	}
+}
+
+func (c *controlBuffer) finish() {
+	c.mu.Lock()
+	if c.err != nil {
+		c.mu.Unlock()
+		return
+	}
+	c.err = ErrConnClosing
+	// There may be headers for streams in the control buffer.
+	// These streams need to be cleaned out since the transport
+	// is still not aware of these yet.
+	for head := c.list.dequeueAll(); head != nil; head = head.next {
+		hdr, ok := head.it.(*headerFrame)
+		if !ok {
+			continue
+		}
+		if hdr.onOrphaned != nil { // It will be nil on the server-side.
+			hdr.onOrphaned(ErrConnClosing)
+		}
+	}
+	// In case throttle() is currently in flight, it needs to be unblocked.
+	// Otherwise, the transport may not close, since the transport is closed by
+	// the reader encountering the connection error.
+	ch, _ := c.trfChan.Load().(chan struct{})
+	if ch != nil {
+		close(ch)
+	}
+	c.trfChan.Store((chan struct{})(nil))
+	c.mu.Unlock()
+}
+
+type side int
+
+const (
+	clientSide side = iota
+	serverSide
+)
+
+// Loopy receives frames from the control buffer.
+// Each frame is handled individually; most of the work done by loopy goes
+// into handling data frames. Loopy maintains a queue of active streams, and each
+// stream maintains a queue of data frames; as loopy receives data frames
+// it gets added to the queue of the relevant stream.
+// Loopy goes over this list of active streams by processing one node every iteration,
+// thereby closely resemebling to a round-robin scheduling over all streams. While
+// processing a stream, loopy writes out data bytes from this stream capped by the min
+// of http2MaxFrameLen, connection-level flow control and stream-level flow control.
+type loopyWriter struct {
+	side      side
+	cbuf      *controlBuffer
+	sendQuota uint32
+	oiws      uint32 // outbound initial window size.
+	// estdStreams is map of all established streams that are not cleaned-up yet.
+	// On client-side, this is all streams whose headers were sent out.
+	// On server-side, this is all streams whose headers were received.
+	estdStreams map[uint32]*outStream // Established streams.
+	// activeStreams is a linked-list of all streams that have data to send and some
+	// stream-level flow control quota.
+	// Each of these streams internally have a list of data items(and perhaps trailers
+	// on the server-side) to be sent out.
+	activeStreams *outStreamList
+	framer        *framer
+	hBuf          *bytes.Buffer  // The buffer for HPACK encoding.
+	hEnc          *hpack.Encoder // HPACK encoder.
+	bdpEst        *bdpEstimator
+	draining      bool
+	conn          net.Conn
+	logger        *grpclog.PrefixLogger
+
+	// Side-specific handlers
+	ssGoAwayHandler func(*goAway) (bool, error)
+}
+
+func newLoopyWriter(s side, fr *framer, cbuf *controlBuffer, bdpEst *bdpEstimator, conn net.Conn, logger *grpclog.PrefixLogger) *loopyWriter {
+	var buf bytes.Buffer
+	l := &loopyWriter{
+		side:          s,
+		cbuf:          cbuf,
+		sendQuota:     defaultWindowSize,
+		oiws:          defaultWindowSize,
+		estdStreams:   make(map[uint32]*outStream),
+		activeStreams: newOutStreamList(),
+		framer:        fr,
+		hBuf:          &buf,
+		hEnc:          hpack.NewEncoder(&buf),
+		bdpEst:        bdpEst,
+		conn:          conn,
+		logger:        logger,
+	}
+	return l
+}
+
+const minBatchSize = 1000
+
+// run should be run in a separate goroutine.
+// It reads control frames from controlBuf and processes them by:
+// 1. Updating loopy's internal state, or/and
+// 2. Writing out HTTP2 frames on the wire.
+//
+// Loopy keeps all active streams with data to send in a linked-list.
+// All streams in the activeStreams linked-list must have both:
+// 1. Data to send, and
+// 2. Stream level flow control quota available.
+//
+// In each iteration of run loop, other than processing the incoming control
+// frame, loopy calls processData, which processes one node from the
+// activeStreams linked-list.  This results in writing of HTTP2 frames into an
+// underlying write buffer.  When there's no more control frames to read from
+// controlBuf, loopy flushes the write buffer.  As an optimization, to increase
+// the batch size for each flush, loopy yields the processor, once if the batch
+// size is too low to give stream goroutines a chance to fill it up.
+//
+// Upon exiting, if the error causing the exit is not an I/O error, run()
+// flushes and closes the underlying connection.  Otherwise, the connection is
+// left open to allow the I/O error to be encountered by the reader instead.
+func (l *loopyWriter) run() (err error) {
+	defer func() {
+		if l.logger.V(logLevel) {
+			l.logger.Infof("loopyWriter exiting with error: %v", err)
+		}
+		if !isIOError(err) {
+			l.framer.writer.Flush()
+			l.conn.Close()
+		}
+		l.cbuf.finish()
+	}()
+	for {
+		it, err := l.cbuf.get(true)
+		if err != nil {
+			return err
+		}
+		if err = l.handle(it); err != nil {
+			return err
+		}
+		if _, err = l.processData(); err != nil {
+			return err
+		}
+		gosched := true
+	hasdata:
+		for {
+			it, err := l.cbuf.get(false)
+			if err != nil {
+				return err
+			}
+			if it != nil {
+				if err = l.handle(it); err != nil {
+					return err
+				}
+				if _, err = l.processData(); err != nil {
+					return err
+				}
+				continue hasdata
+			}
+			isEmpty, err := l.processData()
+			if err != nil {
+				return err
+			}
+			if !isEmpty {
+				continue hasdata
+			}
+			if gosched {
+				gosched = false
+				if l.framer.writer.offset < minBatchSize {
+					runtime.Gosched()
+					continue hasdata
+				}
+			}
+			l.framer.writer.Flush()
+			break hasdata
+		}
+	}
+}
+
+func (l *loopyWriter) outgoingWindowUpdateHandler(w *outgoingWindowUpdate) error {
+	return l.framer.fr.WriteWindowUpdate(w.streamID, w.increment)
+}
+
+func (l *loopyWriter) incomingWindowUpdateHandler(w *incomingWindowUpdate) {
+	// Otherwise update the quota.
+	if w.streamID == 0 {
+		l.sendQuota += w.increment
+		return
+	}
+	// Find the stream and update it.
+	if str, ok := l.estdStreams[w.streamID]; ok {
+		str.bytesOutStanding -= int(w.increment)
+		if strQuota := int(l.oiws) - str.bytesOutStanding; strQuota > 0 && str.state == waitingOnStreamQuota {
+			str.state = active
+			l.activeStreams.enqueue(str)
+			return
+		}
+	}
+}
+
+func (l *loopyWriter) outgoingSettingsHandler(s *outgoingSettings) error {
+	return l.framer.fr.WriteSettings(s.ss...)
+}
+
+func (l *loopyWriter) incomingSettingsHandler(s *incomingSettings) error {
+	l.applySettings(s.ss)
+	return l.framer.fr.WriteSettingsAck()
+}
+
+func (l *loopyWriter) registerStreamHandler(h *registerStream) {
+	str := &outStream{
+		id:    h.streamID,
+		state: empty,
+		itl:   &itemList{},
+		wq:    h.wq,
+	}
+	l.estdStreams[h.streamID] = str
+}
+
+func (l *loopyWriter) headerHandler(h *headerFrame) error {
+	if l.side == serverSide {
+		str, ok := l.estdStreams[h.streamID]
+		if !ok {
+			if l.logger.V(logLevel) {
+				l.logger.Infof("Unrecognized streamID %d in loopyWriter", h.streamID)
+			}
+			return nil
+		}
+		// Case 1.A: Server is responding back with headers.
+		if !h.endStream {
+			return l.writeHeader(h.streamID, h.endStream, h.hf, h.onWrite)
+		}
+		// else:  Case 1.B: Server wants to close stream.
+
+		if str.state != empty { // either active or waiting on stream quota.
+			// add it str's list of items.
+			str.itl.enqueue(h)
+			return nil
+		}
+		if err := l.writeHeader(h.streamID, h.endStream, h.hf, h.onWrite); err != nil {
+			return err
+		}
+		return l.cleanupStreamHandler(h.cleanup)
+	}
+	// Case 2: Client wants to originate stream.
+	str := &outStream{
+		id:    h.streamID,
+		state: empty,
+		itl:   &itemList{},
+		wq:    h.wq,
+	}
+	return l.originateStream(str, h)
+}
+
+func (l *loopyWriter) originateStream(str *outStream, hdr *headerFrame) error {
+	// l.draining is set when handling GoAway. In which case, we want to avoid
+	// creating new streams.
+	if l.draining {
+		// TODO: provide a better error with the reason we are in draining.
+		hdr.onOrphaned(errStreamDrain)
+		return nil
+	}
+	if err := hdr.initStream(str.id); err != nil {
+		return err
+	}
+	if err := l.writeHeader(str.id, hdr.endStream, hdr.hf, hdr.onWrite); err != nil {
+		return err
+	}
+	l.estdStreams[str.id] = str
+	return nil
+}
+
+func (l *loopyWriter) writeHeader(streamID uint32, endStream bool, hf []hpack.HeaderField, onWrite func()) error {
+	if onWrite != nil {
+		onWrite()
+	}
+	l.hBuf.Reset()
+	for _, f := range hf {
+		if err := l.hEnc.WriteField(f); err != nil {
+			if l.logger.V(logLevel) {
+				l.logger.Warningf("Encountered error while encoding headers: %v", err)
+			}
+		}
+	}
+	var (
+		err               error
+		endHeaders, first bool
+	)
+	first = true
+	for !endHeaders {
+		size := l.hBuf.Len()
+		if size > http2MaxFrameLen {
+			size = http2MaxFrameLen
+		} else {
+			endHeaders = true
+		}
+		if first {
+			first = false
+			err = l.framer.fr.WriteHeaders(http2.HeadersFrameParam{
+				StreamID:      streamID,
+				BlockFragment: l.hBuf.Next(size),
+				EndStream:     endStream,
+				EndHeaders:    endHeaders,
+			})
+		} else {
+			err = l.framer.fr.WriteContinuation(
+				streamID,
+				endHeaders,
+				l.hBuf.Next(size),
+			)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (l *loopyWriter) preprocessData(df *dataFrame) {
+	str, ok := l.estdStreams[df.streamID]
+	if !ok {
+		return
+	}
+	// If we got data for a stream it means that
+	// stream was originated and the headers were sent out.
+	str.itl.enqueue(df)
+	if str.state == empty {
+		str.state = active
+		l.activeStreams.enqueue(str)
+	}
+}
+
+func (l *loopyWriter) pingHandler(p *ping) error {
+	if !p.ack {
+		l.bdpEst.timesnap(p.data)
+	}
+	return l.framer.fr.WritePing(p.ack, p.data)
+
+}
+
+func (l *loopyWriter) outFlowControlSizeRequestHandler(o *outFlowControlSizeRequest) {
+	o.resp <- l.sendQuota
+}
+
+func (l *loopyWriter) cleanupStreamHandler(c *cleanupStream) error {
+	c.onWrite()
+	if str, ok := l.estdStreams[c.streamID]; ok {
+		// On the server side it could be a trailers-only response or
+		// a RST_STREAM before stream initialization thus the stream might
+		// not be established yet.
+		delete(l.estdStreams, c.streamID)
+		str.deleteSelf()
+	}
+	if c.rst { // If RST_STREAM needs to be sent.
+		if err := l.framer.fr.WriteRSTStream(c.streamID, c.rstCode); err != nil {
+			return err
+		}
+	}
+	if l.draining && len(l.estdStreams) == 0 {
+		// Flush and close the connection; we are done with it.
+		return errors.New("finished processing active streams while in draining mode")
+	}
+	return nil
+}
+
+func (l *loopyWriter) earlyAbortStreamHandler(eas *earlyAbortStream) error {
+	if l.side == clientSide {
+		return errors.New("earlyAbortStream not handled on client")
+	}
+	// In case the caller forgets to set the http status, default to 200.
+	if eas.httpStatus == 0 {
+		eas.httpStatus = 200
+	}
+	headerFields := []hpack.HeaderField{
+		{Name: ":status", Value: strconv.Itoa(int(eas.httpStatus))},
+		{Name: "content-type", Value: grpcutil.ContentType(eas.contentSubtype)},
+		{Name: "grpc-status", Value: strconv.Itoa(int(eas.status.Code()))},
+		{Name: "grpc-message", Value: encodeGrpcMessage(eas.status.Message())},
+	}
+
+	if err := l.writeHeader(eas.streamID, true, headerFields, nil); err != nil {
+		return err
+	}
+	if eas.rst {
+		if err := l.framer.fr.WriteRSTStream(eas.streamID, http2.ErrCodeNo); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (l *loopyWriter) incomingGoAwayHandler(*incomingGoAway) error {
+	if l.side == clientSide {
+		l.draining = true
+		if len(l.estdStreams) == 0 {
+			// Flush and close the connection; we are done with it.
+			return errors.New("received GOAWAY with no active streams")
+		}
+	}
+	return nil
+}
+
+func (l *loopyWriter) goAwayHandler(g *goAway) error {
+	// Handling of outgoing GoAway is very specific to side.
+	if l.ssGoAwayHandler != nil {
+		draining, err := l.ssGoAwayHandler(g)
+		if err != nil {
+			return err
+		}
+		l.draining = draining
+	}
+	return nil
+}
+
+func (l *loopyWriter) handle(i interface{}) error {
+	switch i := i.(type) {
+	case *incomingWindowUpdate:
+		l.incomingWindowUpdateHandler(i)
+	case *outgoingWindowUpdate:
+		return l.outgoingWindowUpdateHandler(i)
+	case *incomingSettings:
+		return l.incomingSettingsHandler(i)
+	case *outgoingSettings:
+		return l.outgoingSettingsHandler(i)
+	case *headerFrame:
+		return l.headerHandler(i)
+	case *registerStream:
+		l.registerStreamHandler(i)
+	case *cleanupStream:
+		return l.cleanupStreamHandler(i)
+	case *earlyAbortStream:
+		return l.earlyAbortStreamHandler(i)
+	case *incomingGoAway:
+		return l.incomingGoAwayHandler(i)
+	case *dataFrame:
+		l.preprocessData(i)
+	case *ping:
+		return l.pingHandler(i)
+	case *goAway:
+		return l.goAwayHandler(i)
+	case *outFlowControlSizeRequest:
+		l.outFlowControlSizeRequestHandler(i)
+	case closeConnection:
+		// Just return a non-I/O error and run() will flush and close the
+		// connection.
+		return ErrConnClosing
+	default:
+		return fmt.Errorf("transport: unknown control message type %T", i)
+	}
+	return nil
+}
+
+func (l *loopyWriter) applySettings(ss []http2.Setting) {
+	for _, s := range ss {
+		switch s.ID {
+		case http2.SettingInitialWindowSize:
+			o := l.oiws
+			l.oiws = s.Val
+			if o < l.oiws {
+				// If the new limit is greater make all depleted streams active.
+				for _, stream := range l.estdStreams {
+					if stream.state == waitingOnStreamQuota {
+						stream.state = active
+						l.activeStreams.enqueue(stream)
+					}
+				}
+			}
+		case http2.SettingHeaderTableSize:
+			updateHeaderTblSize(l.hEnc, s.Val)
+		}
+	}
+}
+
+// processData removes the first stream from active streams, writes out at most 16KB
+// of its data and then puts it at the end of activeStreams if there's still more data
+// to be sent and stream has some stream-level flow control.
+func (l *loopyWriter) processData() (bool, error) {
+	if l.sendQuota == 0 {
+		return true, nil
+	}
+	str := l.activeStreams.dequeue() // Remove the first stream.
+	if str == nil {
+		return true, nil
+	}
+	dataItem := str.itl.peek().(*dataFrame) // Peek at the first data item this stream.
+	// A data item is represented by a dataFrame, since it later translates into
+	// multiple HTTP2 data frames.
+	// Every dataFrame has two buffers; h that keeps grpc-message header and d that is actual data.
+	// As an optimization to keep wire traffic low, data from d is copied to h to make as big as the
+	// maximum possible HTTP2 frame size.
+
+	if len(dataItem.h) == 0 && len(dataItem.d) == 0 { // Empty data frame
+		// Client sends out empty data frame with endStream = true
+		if err := l.framer.fr.WriteData(dataItem.streamID, dataItem.endStream, nil); err != nil {
+			return false, err
+		}
+		str.itl.dequeue() // remove the empty data item from stream
+		if str.itl.isEmpty() {
+			str.state = empty
+		} else if trailer, ok := str.itl.peek().(*headerFrame); ok { // the next item is trailers.
+			if err := l.writeHeader(trailer.streamID, trailer.endStream, trailer.hf, trailer.onWrite); err != nil {
+				return false, err
+			}
+			if err := l.cleanupStreamHandler(trailer.cleanup); err != nil {
+				return false, err
+			}
+		} else {
+			l.activeStreams.enqueue(str)
+		}
+		return false, nil
+	}
+	var (
+		buf []byte
+	)
+	// Figure out the maximum size we can send
+	maxSize := http2MaxFrameLen
+	if strQuota := int(l.oiws) - str.bytesOutStanding; strQuota <= 0 { // stream-level flow control.
+		str.state = waitingOnStreamQuota
+		return false, nil
+	} else if maxSize > strQuota {
+		maxSize = strQuota
+	}
+	if maxSize > int(l.sendQuota) { // connection-level flow control.
+		maxSize = int(l.sendQuota)
+	}
+	// Compute how much of the header and data we can send within quota and max frame length
+	hSize := min(maxSize, len(dataItem.h))
+	dSize := min(maxSize-hSize, len(dataItem.d))
+	if hSize != 0 {
+		if dSize == 0 {
+			buf = dataItem.h
+		} else {
+			// We can add some data to grpc message header to distribute bytes more equally across frames.
+			// Copy on the stack to avoid generating garbage
+			var localBuf [http2MaxFrameLen]byte
+			copy(localBuf[:hSize], dataItem.h)
+			copy(localBuf[hSize:], dataItem.d[:dSize])
+			buf = localBuf[:hSize+dSize]
+		}
+	} else {
+		buf = dataItem.d
+	}
+
+	size := hSize + dSize
+
+	// Now that outgoing flow controls are checked we can replenish str's write quota
+	str.wq.replenish(size)
+	var endStream bool
+	// If this is the last data message on this stream and all of it can be written in this iteration.
+	if dataItem.endStream && len(dataItem.h)+len(dataItem.d) <= size {
+		endStream = true
+	}
+	if dataItem.onEachWrite != nil {
+		dataItem.onEachWrite()
+	}
+	if err := l.framer.fr.WriteData(dataItem.streamID, endStream, buf[:size]); err != nil {
+		return false, err
+	}
+	str.bytesOutStanding += size
+	l.sendQuota -= uint32(size)
+	dataItem.h = dataItem.h[hSize:]
+	dataItem.d = dataItem.d[dSize:]
+
+	if len(dataItem.h) == 0 && len(dataItem.d) == 0 { // All the data from that message was written out.
+		str.itl.dequeue()
+	}
+	if str.itl.isEmpty() {
+		str.state = empty
+	} else if trailer, ok := str.itl.peek().(*headerFrame); ok { // The next item is trailers.
+		if err := l.writeHeader(trailer.streamID, trailer.endStream, trailer.hf, trailer.onWrite); err != nil {
+			return false, err
+		}
+		if err := l.cleanupStreamHandler(trailer.cleanup); err != nil {
+			return false, err
+		}
+	} else if int(l.oiws)-str.bytesOutStanding <= 0 { // Ran out of stream quota.
+		str.state = waitingOnStreamQuota
+	} else { // Otherwise add it back to the list of active streams.
+		l.activeStreams.enqueue(str)
+	}
+	return false, nil
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/defaults.go b/vendor/google.golang.org/grpc/internal/transport/defaults.go
new file mode 100644
index 0000000000..bc8ee07474
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/defaults.go
@@ -0,0 +1,55 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"math"
+	"time"
+)
+
+const (
+	// The default value of flow control window size in HTTP2 spec.
+	defaultWindowSize = 65535
+	// The initial window size for flow control.
+	initialWindowSize             = defaultWindowSize // for an RPC
+	infinity                      = time.Duration(math.MaxInt64)
+	defaultClientKeepaliveTime    = infinity
+	defaultClientKeepaliveTimeout = 20 * time.Second
+	defaultMaxStreamsClient       = 100
+	defaultMaxConnectionIdle      = infinity
+	defaultMaxConnectionAge       = infinity
+	defaultMaxConnectionAgeGrace  = infinity
+	defaultServerKeepaliveTime    = 2 * time.Hour
+	defaultServerKeepaliveTimeout = 20 * time.Second
+	defaultKeepalivePolicyMinTime = 5 * time.Minute
+	// max window limit set by HTTP2 Specs.
+	maxWindowSize = math.MaxInt32
+	// defaultWriteQuota is the default value for number of data
+	// bytes that each stream can schedule before some of it being
+	// flushed out.
+	defaultWriteQuota              = 64 * 1024
+	defaultClientMaxHeaderListSize = uint32(16 << 20)
+	defaultServerMaxHeaderListSize = uint32(16 << 20)
+)
+
+// MaxStreamID is the upper bound for the stream ID before the current
+// transport gracefully closes and new transport is created for subsequent RPCs.
+// This is set to 75% of 2^31-1. Streams are identified with an unsigned 31-bit
+// integer. It's exported so that tests can override it.
+var MaxStreamID = uint32(math.MaxInt32 * 3 / 4)
diff --git a/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go b/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go
new file mode 100644
index 0000000000..97198c5158
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go
@@ -0,0 +1,215 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"fmt"
+	"math"
+	"sync"
+	"sync/atomic"
+)
+
+// writeQuota is a soft limit on the amount of data a stream can
+// schedule before some of it is written out.
+type writeQuota struct {
+	quota int32
+	// get waits on read from when quota goes less than or equal to zero.
+	// replenish writes on it when quota goes positive again.
+	ch chan struct{}
+	// done is triggered in error case.
+	done <-chan struct{}
+	// replenish is called by loopyWriter to give quota back to.
+	// It is implemented as a field so that it can be updated
+	// by tests.
+	replenish func(n int)
+}
+
+func newWriteQuota(sz int32, done <-chan struct{}) *writeQuota {
+	w := &writeQuota{
+		quota: sz,
+		ch:    make(chan struct{}, 1),
+		done:  done,
+	}
+	w.replenish = w.realReplenish
+	return w
+}
+
+func (w *writeQuota) get(sz int32) error {
+	for {
+		if atomic.LoadInt32(&w.quota) > 0 {
+			atomic.AddInt32(&w.quota, -sz)
+			return nil
+		}
+		select {
+		case <-w.ch:
+			continue
+		case <-w.done:
+			return errStreamDone
+		}
+	}
+}
+
+func (w *writeQuota) realReplenish(n int) {
+	sz := int32(n)
+	a := atomic.AddInt32(&w.quota, sz)
+	b := a - sz
+	if b <= 0 && a > 0 {
+		select {
+		case w.ch <- struct{}{}:
+		default:
+		}
+	}
+}
+
+type trInFlow struct {
+	limit               uint32
+	unacked             uint32
+	effectiveWindowSize uint32
+}
+
+func (f *trInFlow) newLimit(n uint32) uint32 {
+	d := n - f.limit
+	f.limit = n
+	f.updateEffectiveWindowSize()
+	return d
+}
+
+func (f *trInFlow) onData(n uint32) uint32 {
+	f.unacked += n
+	if f.unacked >= f.limit/4 {
+		w := f.unacked
+		f.unacked = 0
+		f.updateEffectiveWindowSize()
+		return w
+	}
+	f.updateEffectiveWindowSize()
+	return 0
+}
+
+func (f *trInFlow) reset() uint32 {
+	w := f.unacked
+	f.unacked = 0
+	f.updateEffectiveWindowSize()
+	return w
+}
+
+func (f *trInFlow) updateEffectiveWindowSize() {
+	atomic.StoreUint32(&f.effectiveWindowSize, f.limit-f.unacked)
+}
+
+func (f *trInFlow) getSize() uint32 {
+	return atomic.LoadUint32(&f.effectiveWindowSize)
+}
+
+// TODO(mmukhi): Simplify this code.
+// inFlow deals with inbound flow control
+type inFlow struct {
+	mu sync.Mutex
+	// The inbound flow control limit for pending data.
+	limit uint32
+	// pendingData is the overall data which have been received but not been
+	// consumed by applications.
+	pendingData uint32
+	// The amount of data the application has consumed but grpc has not sent
+	// window update for them. Used to reduce window update frequency.
+	pendingUpdate uint32
+	// delta is the extra window update given by receiver when an application
+	// is reading data bigger in size than the inFlow limit.
+	delta uint32
+}
+
+// newLimit updates the inflow window to a new value n.
+// It assumes that n is always greater than the old limit.
+func (f *inFlow) newLimit(n uint32) {
+	f.mu.Lock()
+	f.limit = n
+	f.mu.Unlock()
+}
+
+func (f *inFlow) maybeAdjust(n uint32) uint32 {
+	if n > uint32(math.MaxInt32) {
+		n = uint32(math.MaxInt32)
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	// estSenderQuota is the receiver's view of the maximum number of bytes the sender
+	// can send without a window update.
+	estSenderQuota := int32(f.limit - (f.pendingData + f.pendingUpdate))
+	// estUntransmittedData is the maximum number of bytes the sends might not have put
+	// on the wire yet. A value of 0 or less means that we have already received all or
+	// more bytes than the application is requesting to read.
+	estUntransmittedData := int32(n - f.pendingData) // Casting into int32 since it could be negative.
+	// This implies that unless we send a window update, the sender won't be able to send all the bytes
+	// for this message. Therefore we must send an update over the limit since there's an active read
+	// request from the application.
+	if estUntransmittedData > estSenderQuota {
+		// Sender's window shouldn't go more than 2^31 - 1 as specified in the HTTP spec.
+		if f.limit+n > maxWindowSize {
+			f.delta = maxWindowSize - f.limit
+		} else {
+			// Send a window update for the whole message and not just the difference between
+			// estUntransmittedData and estSenderQuota. This will be helpful in case the message
+			// is padded; We will fallback on the current available window(at least a 1/4th of the limit).
+			f.delta = n
+		}
+		return f.delta
+	}
+	return 0
+}
+
+// onData is invoked when some data frame is received. It updates pendingData.
+func (f *inFlow) onData(n uint32) error {
+	f.mu.Lock()
+	f.pendingData += n
+	if f.pendingData+f.pendingUpdate > f.limit+f.delta {
+		limit := f.limit
+		rcvd := f.pendingData + f.pendingUpdate
+		f.mu.Unlock()
+		return fmt.Errorf("received %d-bytes data exceeding the limit %d bytes", rcvd, limit)
+	}
+	f.mu.Unlock()
+	return nil
+}
+
+// onRead is invoked when the application reads the data. It returns the window size
+// to be sent to the peer.
+func (f *inFlow) onRead(n uint32) uint32 {
+	f.mu.Lock()
+	if f.pendingData == 0 {
+		f.mu.Unlock()
+		return 0
+	}
+	f.pendingData -= n
+	if n > f.delta {
+		n -= f.delta
+		f.delta = 0
+	} else {
+		f.delta -= n
+		n = 0
+	}
+	f.pendingUpdate += n
+	if f.pendingUpdate >= f.limit/4 {
+		wu := f.pendingUpdate
+		f.pendingUpdate = 0
+		f.mu.Unlock()
+		return wu
+	}
+	f.mu.Unlock()
+	return 0
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/handler_server.go b/vendor/google.golang.org/grpc/internal/transport/handler_server.go
new file mode 100644
index 0000000000..fbee581b86
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/handler_server.go
@@ -0,0 +1,480 @@
+/*
+ *
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// This file is the implementation of a gRPC server using HTTP/2 which
+// uses the standard Go http2 Server implementation (via the
+// http.Handler interface), rather than speaking low-level HTTP/2
+// frames itself. It is the implementation of *grpc.Server.ServeHTTP.
+
+package transport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"golang.org/x/net/http2"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcutil"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+)
+
+// NewServerHandlerTransport returns a ServerTransport handling gRPC from
+// inside an http.Handler, or writes an HTTP error to w and returns an error.
+// It requires that the http Server supports HTTP/2.
+func NewServerHandlerTransport(w http.ResponseWriter, r *http.Request, stats []stats.Handler) (ServerTransport, error) {
+	if r.ProtoMajor != 2 {
+		msg := "gRPC requires HTTP/2"
+		http.Error(w, msg, http.StatusBadRequest)
+		return nil, errors.New(msg)
+	}
+	if r.Method != "POST" {
+		msg := fmt.Sprintf("invalid gRPC request method %q", r.Method)
+		http.Error(w, msg, http.StatusBadRequest)
+		return nil, errors.New(msg)
+	}
+	contentType := r.Header.Get("Content-Type")
+	// TODO: do we assume contentType is lowercase? we did before
+	contentSubtype, validContentType := grpcutil.ContentSubtype(contentType)
+	if !validContentType {
+		msg := fmt.Sprintf("invalid gRPC request content-type %q", contentType)
+		http.Error(w, msg, http.StatusUnsupportedMediaType)
+		return nil, errors.New(msg)
+	}
+	if _, ok := w.(http.Flusher); !ok {
+		msg := "gRPC requires a ResponseWriter supporting http.Flusher"
+		http.Error(w, msg, http.StatusInternalServerError)
+		return nil, errors.New(msg)
+	}
+
+	st := &serverHandlerTransport{
+		rw:             w,
+		req:            r,
+		closedCh:       make(chan struct{}),
+		writes:         make(chan func()),
+		contentType:    contentType,
+		contentSubtype: contentSubtype,
+		stats:          stats,
+	}
+	st.logger = prefixLoggerForServerHandlerTransport(st)
+
+	if v := r.Header.Get("grpc-timeout"); v != "" {
+		to, err := decodeTimeout(v)
+		if err != nil {
+			msg := fmt.Sprintf("malformed grpc-timeout: %v", err)
+			http.Error(w, msg, http.StatusBadRequest)
+			return nil, status.Error(codes.Internal, msg)
+		}
+		st.timeoutSet = true
+		st.timeout = to
+	}
+
+	metakv := []string{"content-type", contentType}
+	if r.Host != "" {
+		metakv = append(metakv, ":authority", r.Host)
+	}
+	for k, vv := range r.Header {
+		k = strings.ToLower(k)
+		if isReservedHeader(k) && !isWhitelistedHeader(k) {
+			continue
+		}
+		for _, v := range vv {
+			v, err := decodeMetadataHeader(k, v)
+			if err != nil {
+				msg := fmt.Sprintf("malformed binary metadata %q in header %q: %v", v, k, err)
+				http.Error(w, msg, http.StatusBadRequest)
+				return nil, status.Error(codes.Internal, msg)
+			}
+			metakv = append(metakv, k, v)
+		}
+	}
+	st.headerMD = metadata.Pairs(metakv...)
+
+	return st, nil
+}
+
+// serverHandlerTransport is an implementation of ServerTransport
+// which replies to exactly one gRPC request (exactly one HTTP request),
+// using the net/http.Handler interface. This http.Handler is guaranteed
+// at this point to be speaking over HTTP/2, so it's able to speak valid
+// gRPC.
+type serverHandlerTransport struct {
+	rw         http.ResponseWriter
+	req        *http.Request
+	timeoutSet bool
+	timeout    time.Duration
+
+	headerMD metadata.MD
+
+	closeOnce sync.Once
+	closedCh  chan struct{} // closed on Close
+
+	// writes is a channel of code to run serialized in the
+	// ServeHTTP (HandleStreams) goroutine. The channel is closed
+	// when WriteStatus is called.
+	writes chan func()
+
+	// block concurrent WriteStatus calls
+	// e.g. grpc/(*serverStream).SendMsg/RecvMsg
+	writeStatusMu sync.Mutex
+
+	// we just mirror the request content-type
+	contentType string
+	// we store both contentType and contentSubtype so we don't keep recreating them
+	// TODO make sure this is consistent across handler_server and http2_server
+	contentSubtype string
+
+	stats  []stats.Handler
+	logger *grpclog.PrefixLogger
+}
+
+func (ht *serverHandlerTransport) Close(err error) {
+	ht.closeOnce.Do(func() {
+		if ht.logger.V(logLevel) {
+			ht.logger.Infof("Closing: %v", err)
+		}
+		close(ht.closedCh)
+	})
+}
+
+func (ht *serverHandlerTransport) RemoteAddr() net.Addr { return strAddr(ht.req.RemoteAddr) }
+
+// strAddr is a net.Addr backed by either a TCP "ip:port" string, or
+// the empty string if unknown.
+type strAddr string
+
+func (a strAddr) Network() string {
+	if a != "" {
+		// Per the documentation on net/http.Request.RemoteAddr, if this is
+		// set, it's set to the IP:port of the peer (hence, TCP):
+		// https://golang.org/pkg/net/http/#Request
+		//
+		// If we want to support Unix sockets later, we can
+		// add our own grpc-specific convention within the
+		// grpc codebase to set RemoteAddr to a different
+		// format, or probably better: we can attach it to the
+		// context and use that from serverHandlerTransport.RemoteAddr.
+		return "tcp"
+	}
+	return ""
+}
+
+func (a strAddr) String() string { return string(a) }
+
+// do runs fn in the ServeHTTP goroutine.
+func (ht *serverHandlerTransport) do(fn func()) error {
+	select {
+	case <-ht.closedCh:
+		return ErrConnClosing
+	case ht.writes <- fn:
+		return nil
+	}
+}
+
+func (ht *serverHandlerTransport) WriteStatus(s *Stream, st *status.Status) error {
+	ht.writeStatusMu.Lock()
+	defer ht.writeStatusMu.Unlock()
+
+	headersWritten := s.updateHeaderSent()
+	err := ht.do(func() {
+		if !headersWritten {
+			ht.writePendingHeaders(s)
+		}
+
+		// And flush, in case no header or body has been sent yet.
+		// This forces a separation of headers and trailers if this is the
+		// first call (for example, in end2end tests's TestNoService).
+		ht.rw.(http.Flusher).Flush()
+
+		h := ht.rw.Header()
+		h.Set("Grpc-Status", fmt.Sprintf("%d", st.Code()))
+		if m := st.Message(); m != "" {
+			h.Set("Grpc-Message", encodeGrpcMessage(m))
+		}
+
+		if p := st.Proto(); p != nil && len(p.Details) > 0 {
+			stBytes, err := proto.Marshal(p)
+			if err != nil {
+				// TODO: return error instead, when callers are able to handle it.
+				panic(err)
+			}
+
+			h.Set("Grpc-Status-Details-Bin", encodeBinHeader(stBytes))
+		}
+
+		if md := s.Trailer(); len(md) > 0 {
+			for k, vv := range md {
+				// Clients don't tolerate reading restricted headers after some non restricted ones were sent.
+				if isReservedHeader(k) {
+					continue
+				}
+				for _, v := range vv {
+					// http2 ResponseWriter mechanism to send undeclared Trailers after
+					// the headers have possibly been written.
+					h.Add(http2.TrailerPrefix+k, encodeMetadataHeader(k, v))
+				}
+			}
+		}
+	})
+
+	if err == nil { // transport has not been closed
+		// Note: The trailer fields are compressed with hpack after this call returns.
+		// No WireLength field is set here.
+		for _, sh := range ht.stats {
+			sh.HandleRPC(s.Context(), &stats.OutTrailer{
+				Trailer: s.trailer.Copy(),
+			})
+		}
+	}
+	ht.Close(errors.New("finished writing status"))
+	return err
+}
+
+// writePendingHeaders sets common and custom headers on the first
+// write call (Write, WriteHeader, or WriteStatus)
+func (ht *serverHandlerTransport) writePendingHeaders(s *Stream) {
+	ht.writeCommonHeaders(s)
+	ht.writeCustomHeaders(s)
+}
+
+// writeCommonHeaders sets common headers on the first write
+// call (Write, WriteHeader, or WriteStatus).
+func (ht *serverHandlerTransport) writeCommonHeaders(s *Stream) {
+	h := ht.rw.Header()
+	h["Date"] = nil // suppress Date to make tests happy; TODO: restore
+	h.Set("Content-Type", ht.contentType)
+
+	// Predeclare trailers we'll set later in WriteStatus (after the body).
+	// This is a SHOULD in the HTTP RFC, and the way you add (known)
+	// Trailers per the net/http.ResponseWriter contract.
+	// See https://golang.org/pkg/net/http/#ResponseWriter
+	// and https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
+	h.Add("Trailer", "Grpc-Status")
+	h.Add("Trailer", "Grpc-Message")
+	h.Add("Trailer", "Grpc-Status-Details-Bin")
+
+	if s.sendCompress != "" {
+		h.Set("Grpc-Encoding", s.sendCompress)
+	}
+}
+
+// writeCustomHeaders sets custom headers set on the stream via SetHeader
+// on the first write call (Write, WriteHeader, or WriteStatus).
+func (ht *serverHandlerTransport) writeCustomHeaders(s *Stream) {
+	h := ht.rw.Header()
+
+	s.hdrMu.Lock()
+	for k, vv := range s.header {
+		if isReservedHeader(k) {
+			continue
+		}
+		for _, v := range vv {
+			h.Add(k, encodeMetadataHeader(k, v))
+		}
+	}
+
+	s.hdrMu.Unlock()
+}
+
+func (ht *serverHandlerTransport) Write(s *Stream, hdr []byte, data []byte, opts *Options) error {
+	headersWritten := s.updateHeaderSent()
+	return ht.do(func() {
+		if !headersWritten {
+			ht.writePendingHeaders(s)
+		}
+		ht.rw.Write(hdr)
+		ht.rw.Write(data)
+		ht.rw.(http.Flusher).Flush()
+	})
+}
+
+func (ht *serverHandlerTransport) WriteHeader(s *Stream, md metadata.MD) error {
+	if err := s.SetHeader(md); err != nil {
+		return err
+	}
+
+	headersWritten := s.updateHeaderSent()
+	err := ht.do(func() {
+		if !headersWritten {
+			ht.writePendingHeaders(s)
+		}
+
+		ht.rw.WriteHeader(200)
+		ht.rw.(http.Flusher).Flush()
+	})
+
+	if err == nil {
+		for _, sh := range ht.stats {
+			// Note: The header fields are compressed with hpack after this call returns.
+			// No WireLength field is set here.
+			sh.HandleRPC(s.Context(), &stats.OutHeader{
+				Header:      md.Copy(),
+				Compression: s.sendCompress,
+			})
+		}
+	}
+	return err
+}
+
+func (ht *serverHandlerTransport) HandleStreams(startStream func(*Stream), traceCtx func(context.Context, string) context.Context) {
+	// With this transport type there will be exactly 1 stream: this HTTP request.
+
+	ctx := ht.req.Context()
+	var cancel context.CancelFunc
+	if ht.timeoutSet {
+		ctx, cancel = context.WithTimeout(ctx, ht.timeout)
+	} else {
+		ctx, cancel = context.WithCancel(ctx)
+	}
+
+	// requestOver is closed when the status has been written via WriteStatus.
+	requestOver := make(chan struct{})
+	go func() {
+		select {
+		case <-requestOver:
+		case <-ht.closedCh:
+		case <-ht.req.Context().Done():
+		}
+		cancel()
+		ht.Close(errors.New("request is done processing"))
+	}()
+
+	req := ht.req
+
+	s := &Stream{
+		id:             0, // irrelevant
+		requestRead:    func(int) {},
+		cancel:         cancel,
+		buf:            newRecvBuffer(),
+		st:             ht,
+		method:         req.URL.Path,
+		recvCompress:   req.Header.Get("grpc-encoding"),
+		contentSubtype: ht.contentSubtype,
+	}
+	pr := &peer.Peer{
+		Addr: ht.RemoteAddr(),
+	}
+	if req.TLS != nil {
+		pr.AuthInfo = credentials.TLSInfo{State: *req.TLS, CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.PrivacyAndIntegrity}}
+	}
+	ctx = metadata.NewIncomingContext(ctx, ht.headerMD)
+	s.ctx = peer.NewContext(ctx, pr)
+	for _, sh := range ht.stats {
+		s.ctx = sh.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
+		inHeader := &stats.InHeader{
+			FullMethod:  s.method,
+			RemoteAddr:  ht.RemoteAddr(),
+			Compression: s.recvCompress,
+		}
+		sh.HandleRPC(s.ctx, inHeader)
+	}
+	s.trReader = &transportReader{
+		reader:        &recvBufferReader{ctx: s.ctx, ctxDone: s.ctx.Done(), recv: s.buf, freeBuffer: func(*bytes.Buffer) {}},
+		windowHandler: func(int) {},
+	}
+
+	// readerDone is closed when the Body.Read-ing goroutine exits.
+	readerDone := make(chan struct{})
+	go func() {
+		defer close(readerDone)
+
+		// TODO: minimize garbage, optimize recvBuffer code/ownership
+		const readSize = 8196
+		for buf := make([]byte, readSize); ; {
+			n, err := req.Body.Read(buf)
+			if n > 0 {
+				s.buf.put(recvMsg{buffer: bytes.NewBuffer(buf[:n:n])})
+				buf = buf[n:]
+			}
+			if err != nil {
+				s.buf.put(recvMsg{err: mapRecvMsgError(err)})
+				return
+			}
+			if len(buf) == 0 {
+				buf = make([]byte, readSize)
+			}
+		}
+	}()
+
+	// startStream is provided by the *grpc.Server's serveStreams.
+	// It starts a goroutine serving s and exits immediately.
+	// The goroutine that is started is the one that then calls
+	// into ht, calling WriteHeader, Write, WriteStatus, Close, etc.
+	startStream(s)
+
+	ht.runStream()
+	close(requestOver)
+
+	// Wait for reading goroutine to finish.
+	req.Body.Close()
+	<-readerDone
+}
+
+func (ht *serverHandlerTransport) runStream() {
+	for {
+		select {
+		case fn := <-ht.writes:
+			fn()
+		case <-ht.closedCh:
+			return
+		}
+	}
+}
+
+func (ht *serverHandlerTransport) IncrMsgSent() {}
+
+func (ht *serverHandlerTransport) IncrMsgRecv() {}
+
+func (ht *serverHandlerTransport) Drain() {
+	panic("Drain() is not implemented")
+}
+
+// mapRecvMsgError returns the non-nil err into the appropriate
+// error value as expected by callers of *grpc.parser.recvMsg.
+// In particular, in can only be:
+//   - io.EOF
+//   - io.ErrUnexpectedEOF
+//   - of type transport.ConnectionError
+//   - an error from the status package
+func mapRecvMsgError(err error) error {
+	if err == io.EOF || err == io.ErrUnexpectedEOF {
+		return err
+	}
+	if se, ok := err.(http2.StreamError); ok {
+		if code, ok := http2ErrConvTab[se.Code]; ok {
+			return status.Error(code, se.Error())
+		}
+	}
+	if strings.Contains(err.Error(), "body closed by handler") {
+		return status.Error(codes.Canceled, err.Error())
+	}
+	return connectionErrorf(true, err, err.Error())
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/vendor/google.golang.org/grpc/internal/transport/http2_client.go
new file mode 100644
index 0000000000..5216998a88
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_client.go
@@ -0,0 +1,1798 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"net/http"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/channelz"
+	icredentials "google.golang.org/grpc/internal/credentials"
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/internal/grpcutil"
+	imetadata "google.golang.org/grpc/internal/metadata"
+	istatus "google.golang.org/grpc/internal/status"
+	"google.golang.org/grpc/internal/syscall"
+	"google.golang.org/grpc/internal/transport/networktype"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+)
+
+// clientConnectionCounter counts the number of connections a client has
+// initiated (equal to the number of http2Clients created). Must be accessed
+// atomically.
+var clientConnectionCounter uint64
+
+// http2Client implements the ClientTransport interface with HTTP2.
+type http2Client struct {
+	lastRead  int64 // Keep this field 64-bit aligned. Accessed atomically.
+	ctx       context.Context
+	cancel    context.CancelFunc
+	ctxDone   <-chan struct{} // Cache the ctx.Done() chan.
+	userAgent string
+	// address contains the resolver returned address for this transport.
+	// If the `ServerName` field is set, it takes precedence over `CallHdr.Host`
+	// passed to `NewStream`, when determining the :authority header.
+	address    resolver.Address
+	md         metadata.MD
+	conn       net.Conn // underlying communication channel
+	loopy      *loopyWriter
+	remoteAddr net.Addr
+	localAddr  net.Addr
+	authInfo   credentials.AuthInfo // auth info about the connection
+
+	readerDone chan struct{} // sync point to enable testing.
+	writerDone chan struct{} // sync point to enable testing.
+	// goAway is closed to notify the upper layer (i.e., addrConn.transportMonitor)
+	// that the server sent GoAway on this transport.
+	goAway chan struct{}
+
+	framer *framer
+	// controlBuf delivers all the control related tasks (e.g., window
+	// updates, reset streams, and various settings) to the controller.
+	// Do not access controlBuf with mu held.
+	controlBuf *controlBuffer
+	fc         *trInFlow
+	// The scheme used: https if TLS is on, http otherwise.
+	scheme string
+
+	isSecure bool
+
+	perRPCCreds []credentials.PerRPCCredentials
+
+	kp               keepalive.ClientParameters
+	keepaliveEnabled bool
+
+	statsHandlers []stats.Handler
+
+	initialWindowSize int32
+
+	// configured by peer through SETTINGS_MAX_HEADER_LIST_SIZE
+	maxSendHeaderListSize *uint32
+
+	bdpEst *bdpEstimator
+
+	maxConcurrentStreams  uint32
+	streamQuota           int64
+	streamsQuotaAvailable chan struct{}
+	waitingStreams        uint32
+	nextID                uint32
+	registeredCompressors string
+
+	// Do not access controlBuf with mu held.
+	mu            sync.Mutex // guard the following variables
+	state         transportState
+	activeStreams map[uint32]*Stream
+	// prevGoAway ID records the Last-Stream-ID in the previous GOAway frame.
+	prevGoAwayID uint32
+	// goAwayReason records the http2.ErrCode and debug data received with the
+	// GoAway frame.
+	goAwayReason GoAwayReason
+	// goAwayDebugMessage contains a detailed human readable string about a
+	// GoAway frame, useful for error messages.
+	goAwayDebugMessage string
+	// A condition variable used to signal when the keepalive goroutine should
+	// go dormant. The condition for dormancy is based on the number of active
+	// streams and the `PermitWithoutStream` keepalive client parameter. And
+	// since the number of active streams is guarded by the above mutex, we use
+	// the same for this condition variable as well.
+	kpDormancyCond *sync.Cond
+	// A boolean to track whether the keepalive goroutine is dormant or not.
+	// This is checked before attempting to signal the above condition
+	// variable.
+	kpDormant bool
+
+	// Fields below are for channelz metric collection.
+	channelzID *channelz.Identifier
+	czData     *channelzData
+
+	onClose func(GoAwayReason)
+
+	bufferPool *bufferPool
+
+	connectionID uint64
+	logger       *grpclog.PrefixLogger
+}
+
+func dial(ctx context.Context, fn func(context.Context, string) (net.Conn, error), addr resolver.Address, useProxy bool, grpcUA string) (net.Conn, error) {
+	address := addr.Addr
+	networkType, ok := networktype.Get(addr)
+	if fn != nil {
+		// Special handling for unix scheme with custom dialer. Back in the day,
+		// we did not have a unix resolver and therefore targets with a unix
+		// scheme would end up using the passthrough resolver. So, user's used a
+		// custom dialer in this case and expected the original dial target to
+		// be passed to the custom dialer. Now, we have a unix resolver. But if
+		// a custom dialer is specified, we want to retain the old behavior in
+		// terms of the address being passed to the custom dialer.
+		if networkType == "unix" && !strings.HasPrefix(address, "\x00") {
+			// Supported unix targets are either "unix://absolute-path" or
+			// "unix:relative-path".
+			if filepath.IsAbs(address) {
+				return fn(ctx, "unix://"+address)
+			}
+			return fn(ctx, "unix:"+address)
+		}
+		return fn(ctx, address)
+	}
+	if !ok {
+		networkType, address = parseDialTarget(address)
+	}
+	if networkType == "tcp" && useProxy {
+		return proxyDial(ctx, address, grpcUA)
+	}
+	return (&net.Dialer{}).DialContext(ctx, networkType, address)
+}
+
+func isTemporary(err error) bool {
+	switch err := err.(type) {
+	case interface {
+		Temporary() bool
+	}:
+		return err.Temporary()
+	case interface {
+		Timeout() bool
+	}:
+		// Timeouts may be resolved upon retry, and are thus treated as
+		// temporary.
+		return err.Timeout()
+	}
+	return true
+}
+
+// newHTTP2Client constructs a connected ClientTransport to addr based on HTTP2
+// and starts to receive messages on it. Non-nil error returns if construction
+// fails.
+func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts ConnectOptions, onClose func(GoAwayReason)) (_ *http2Client, err error) {
+	scheme := "http"
+	ctx, cancel := context.WithCancel(ctx)
+	defer func() {
+		if err != nil {
+			cancel()
+		}
+	}()
+
+	// gRPC, resolver, balancer etc. can specify arbitrary data in the
+	// Attributes field of resolver.Address, which is shoved into connectCtx
+	// and passed to the dialer and credential handshaker. This makes it possible for
+	// address specific arbitrary data to reach custom dialers and credential handshakers.
+	connectCtx = icredentials.NewClientHandshakeInfoContext(connectCtx, credentials.ClientHandshakeInfo{Attributes: addr.Attributes})
+
+	conn, err := dial(connectCtx, opts.Dialer, addr, opts.UseProxy, opts.UserAgent)
+	if err != nil {
+		if opts.FailOnNonTempDialError {
+			return nil, connectionErrorf(isTemporary(err), err, "transport: error while dialing: %v", err)
+		}
+		return nil, connectionErrorf(true, err, "transport: Error while dialing: %v", err)
+	}
+
+	// Any further errors will close the underlying connection
+	defer func(conn net.Conn) {
+		if err != nil {
+			conn.Close()
+		}
+	}(conn)
+
+	// The following defer and goroutine monitor the connectCtx for cancelation
+	// and deadline.  On context expiration, the connection is hard closed and
+	// this function will naturally fail as a result.  Otherwise, the defer
+	// waits for the goroutine to exit to prevent the context from being
+	// monitored (and to prevent the connection from ever being closed) after
+	// returning from this function.
+	ctxMonitorDone := grpcsync.NewEvent()
+	newClientCtx, newClientDone := context.WithCancel(connectCtx)
+	defer func() {
+		newClientDone()         // Awaken the goroutine below if connectCtx hasn't expired.
+		<-ctxMonitorDone.Done() // Wait for the goroutine below to exit.
+	}()
+	go func(conn net.Conn) {
+		defer ctxMonitorDone.Fire() // Signal this goroutine has exited.
+		<-newClientCtx.Done()       // Block until connectCtx expires or the defer above executes.
+		if err := connectCtx.Err(); err != nil {
+			// connectCtx expired before exiting the function.  Hard close the connection.
+			if logger.V(logLevel) {
+				logger.Infof("Aborting due to connect deadline expiring: %v", err)
+			}
+			conn.Close()
+		}
+	}(conn)
+
+	kp := opts.KeepaliveParams
+	// Validate keepalive parameters.
+	if kp.Time == 0 {
+		kp.Time = defaultClientKeepaliveTime
+	}
+	if kp.Timeout == 0 {
+		kp.Timeout = defaultClientKeepaliveTimeout
+	}
+	keepaliveEnabled := false
+	if kp.Time != infinity {
+		if err = syscall.SetTCPUserTimeout(conn, kp.Timeout); err != nil {
+			return nil, connectionErrorf(false, err, "transport: failed to set TCP_USER_TIMEOUT: %v", err)
+		}
+		keepaliveEnabled = true
+	}
+	var (
+		isSecure bool
+		authInfo credentials.AuthInfo
+	)
+	transportCreds := opts.TransportCredentials
+	perRPCCreds := opts.PerRPCCredentials
+
+	if b := opts.CredsBundle; b != nil {
+		if t := b.TransportCredentials(); t != nil {
+			transportCreds = t
+		}
+		if t := b.PerRPCCredentials(); t != nil {
+			perRPCCreds = append(perRPCCreds, t)
+		}
+	}
+	if transportCreds != nil {
+		conn, authInfo, err = transportCreds.ClientHandshake(connectCtx, addr.ServerName, conn)
+		if err != nil {
+			return nil, connectionErrorf(isTemporary(err), err, "transport: authentication handshake failed: %v", err)
+		}
+		for _, cd := range perRPCCreds {
+			if cd.RequireTransportSecurity() {
+				if ci, ok := authInfo.(interface {
+					GetCommonAuthInfo() credentials.CommonAuthInfo
+				}); ok {
+					secLevel := ci.GetCommonAuthInfo().SecurityLevel
+					if secLevel != credentials.InvalidSecurityLevel && secLevel < credentials.PrivacyAndIntegrity {
+						return nil, connectionErrorf(true, nil, "transport: cannot send secure credentials on an insecure connection")
+					}
+				}
+			}
+		}
+		isSecure = true
+		if transportCreds.Info().SecurityProtocol == "tls" {
+			scheme = "https"
+		}
+	}
+	dynamicWindow := true
+	icwz := int32(initialWindowSize)
+	if opts.InitialConnWindowSize >= defaultWindowSize {
+		icwz = opts.InitialConnWindowSize
+		dynamicWindow = false
+	}
+	writeBufSize := opts.WriteBufferSize
+	readBufSize := opts.ReadBufferSize
+	maxHeaderListSize := defaultClientMaxHeaderListSize
+	if opts.MaxHeaderListSize != nil {
+		maxHeaderListSize = *opts.MaxHeaderListSize
+	}
+	t := &http2Client{
+		ctx:                   ctx,
+		ctxDone:               ctx.Done(), // Cache Done chan.
+		cancel:                cancel,
+		userAgent:             opts.UserAgent,
+		registeredCompressors: grpcutil.RegisteredCompressors(),
+		address:               addr,
+		conn:                  conn,
+		remoteAddr:            conn.RemoteAddr(),
+		localAddr:             conn.LocalAddr(),
+		authInfo:              authInfo,
+		readerDone:            make(chan struct{}),
+		writerDone:            make(chan struct{}),
+		goAway:                make(chan struct{}),
+		framer:                newFramer(conn, writeBufSize, readBufSize, maxHeaderListSize),
+		fc:                    &trInFlow{limit: uint32(icwz)},
+		scheme:                scheme,
+		activeStreams:         make(map[uint32]*Stream),
+		isSecure:              isSecure,
+		perRPCCreds:           perRPCCreds,
+		kp:                    kp,
+		statsHandlers:         opts.StatsHandlers,
+		initialWindowSize:     initialWindowSize,
+		nextID:                1,
+		maxConcurrentStreams:  defaultMaxStreamsClient,
+		streamQuota:           defaultMaxStreamsClient,
+		streamsQuotaAvailable: make(chan struct{}, 1),
+		czData:                new(channelzData),
+		keepaliveEnabled:      keepaliveEnabled,
+		bufferPool:            newBufferPool(),
+		onClose:               onClose,
+	}
+	t.logger = prefixLoggerForClientTransport(t)
+	// Add peer information to the http2client context.
+	t.ctx = peer.NewContext(t.ctx, t.getPeer())
+
+	if md, ok := addr.Metadata.(*metadata.MD); ok {
+		t.md = *md
+	} else if md := imetadata.Get(addr); md != nil {
+		t.md = md
+	}
+	t.controlBuf = newControlBuffer(t.ctxDone)
+	if opts.InitialWindowSize >= defaultWindowSize {
+		t.initialWindowSize = opts.InitialWindowSize
+		dynamicWindow = false
+	}
+	if dynamicWindow {
+		t.bdpEst = &bdpEstimator{
+			bdp:               initialWindowSize,
+			updateFlowControl: t.updateFlowControl,
+		}
+	}
+	for _, sh := range t.statsHandlers {
+		t.ctx = sh.TagConn(t.ctx, &stats.ConnTagInfo{
+			RemoteAddr: t.remoteAddr,
+			LocalAddr:  t.localAddr,
+		})
+		connBegin := &stats.ConnBegin{
+			Client: true,
+		}
+		sh.HandleConn(t.ctx, connBegin)
+	}
+	t.channelzID, err = channelz.RegisterNormalSocket(t, opts.ChannelzParentID, fmt.Sprintf("%s -> %s", t.localAddr, t.remoteAddr))
+	if err != nil {
+		return nil, err
+	}
+	if t.keepaliveEnabled {
+		t.kpDormancyCond = sync.NewCond(&t.mu)
+		go t.keepalive()
+	}
+
+	// Start the reader goroutine for incoming messages. Each transport has a
+	// dedicated goroutine which reads HTTP2 frames from the network. Then it
+	// dispatches the frame to the corresponding stream entity.  When the
+	// server preface is received, readerErrCh is closed.  If an error occurs
+	// first, an error is pushed to the channel.  This must be checked before
+	// returning from this function.
+	readerErrCh := make(chan error, 1)
+	go t.reader(readerErrCh)
+	defer func() {
+		if err == nil {
+			err = <-readerErrCh
+		}
+		if err != nil {
+			t.Close(err)
+		}
+	}()
+
+	// Send connection preface to server.
+	n, err := t.conn.Write(clientPreface)
+	if err != nil {
+		err = connectionErrorf(true, err, "transport: failed to write client preface: %v", err)
+		return nil, err
+	}
+	if n != len(clientPreface) {
+		err = connectionErrorf(true, nil, "transport: preface mismatch, wrote %d bytes; want %d", n, len(clientPreface))
+		return nil, err
+	}
+	var ss []http2.Setting
+
+	if t.initialWindowSize != defaultWindowSize {
+		ss = append(ss, http2.Setting{
+			ID:  http2.SettingInitialWindowSize,
+			Val: uint32(t.initialWindowSize),
+		})
+	}
+	if opts.MaxHeaderListSize != nil {
+		ss = append(ss, http2.Setting{
+			ID:  http2.SettingMaxHeaderListSize,
+			Val: *opts.MaxHeaderListSize,
+		})
+	}
+	err = t.framer.fr.WriteSettings(ss...)
+	if err != nil {
+		err = connectionErrorf(true, err, "transport: failed to write initial settings frame: %v", err)
+		return nil, err
+	}
+	// Adjust the connection flow control window if needed.
+	if delta := uint32(icwz - defaultWindowSize); delta > 0 {
+		if err := t.framer.fr.WriteWindowUpdate(0, delta); err != nil {
+			err = connectionErrorf(true, err, "transport: failed to write window update: %v", err)
+			return nil, err
+		}
+	}
+
+	t.connectionID = atomic.AddUint64(&clientConnectionCounter, 1)
+
+	if err := t.framer.writer.Flush(); err != nil {
+		return nil, err
+	}
+	go func() {
+		t.loopy = newLoopyWriter(clientSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger)
+		t.loopy.run()
+		close(t.writerDone)
+	}()
+	return t, nil
+}
+
+func (t *http2Client) newStream(ctx context.Context, callHdr *CallHdr) *Stream {
+	// TODO(zhaoq): Handle uint32 overflow of Stream.id.
+	s := &Stream{
+		ct:             t,
+		done:           make(chan struct{}),
+		method:         callHdr.Method,
+		sendCompress:   callHdr.SendCompress,
+		buf:            newRecvBuffer(),
+		headerChan:     make(chan struct{}),
+		contentSubtype: callHdr.ContentSubtype,
+		doneFunc:       callHdr.DoneFunc,
+	}
+	s.wq = newWriteQuota(defaultWriteQuota, s.done)
+	s.requestRead = func(n int) {
+		t.adjustWindow(s, uint32(n))
+	}
+	// The client side stream context should have exactly the same life cycle with the user provided context.
+	// That means, s.ctx should be read-only. And s.ctx is done iff ctx is done.
+	// So we use the original context here instead of creating a copy.
+	s.ctx = ctx
+	s.trReader = &transportReader{
+		reader: &recvBufferReader{
+			ctx:     s.ctx,
+			ctxDone: s.ctx.Done(),
+			recv:    s.buf,
+			closeStream: func(err error) {
+				t.CloseStream(s, err)
+			},
+			freeBuffer: t.bufferPool.put,
+		},
+		windowHandler: func(n int) {
+			t.updateWindow(s, uint32(n))
+		},
+	}
+	return s
+}
+
+func (t *http2Client) getPeer() *peer.Peer {
+	return &peer.Peer{
+		Addr:     t.remoteAddr,
+		AuthInfo: t.authInfo, // Can be nil
+	}
+}
+
+func (t *http2Client) createHeaderFields(ctx context.Context, callHdr *CallHdr) ([]hpack.HeaderField, error) {
+	aud := t.createAudience(callHdr)
+	ri := credentials.RequestInfo{
+		Method:   callHdr.Method,
+		AuthInfo: t.authInfo,
+	}
+	ctxWithRequestInfo := icredentials.NewRequestInfoContext(ctx, ri)
+	authData, err := t.getTrAuthData(ctxWithRequestInfo, aud)
+	if err != nil {
+		return nil, err
+	}
+	callAuthData, err := t.getCallAuthData(ctxWithRequestInfo, aud, callHdr)
+	if err != nil {
+		return nil, err
+	}
+	// TODO(mmukhi): Benchmark if the performance gets better if count the metadata and other header fields
+	// first and create a slice of that exact size.
+	// Make the slice of certain predictable size to reduce allocations made by append.
+	hfLen := 7 // :method, :scheme, :path, :authority, content-type, user-agent, te
+	hfLen += len(authData) + len(callAuthData)
+	headerFields := make([]hpack.HeaderField, 0, hfLen)
+	headerFields = append(headerFields, hpack.HeaderField{Name: ":method", Value: "POST"})
+	headerFields = append(headerFields, hpack.HeaderField{Name: ":scheme", Value: t.scheme})
+	headerFields = append(headerFields, hpack.HeaderField{Name: ":path", Value: callHdr.Method})
+	headerFields = append(headerFields, hpack.HeaderField{Name: ":authority", Value: callHdr.Host})
+	headerFields = append(headerFields, hpack.HeaderField{Name: "content-type", Value: grpcutil.ContentType(callHdr.ContentSubtype)})
+	headerFields = append(headerFields, hpack.HeaderField{Name: "user-agent", Value: t.userAgent})
+	headerFields = append(headerFields, hpack.HeaderField{Name: "te", Value: "trailers"})
+	if callHdr.PreviousAttempts > 0 {
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-previous-rpc-attempts", Value: strconv.Itoa(callHdr.PreviousAttempts)})
+	}
+
+	registeredCompressors := t.registeredCompressors
+	if callHdr.SendCompress != "" {
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-encoding", Value: callHdr.SendCompress})
+		// Include the outgoing compressor name when compressor is not registered
+		// via encoding.RegisterCompressor. This is possible when client uses
+		// WithCompressor dial option.
+		if !grpcutil.IsCompressorNameRegistered(callHdr.SendCompress) {
+			if registeredCompressors != "" {
+				registeredCompressors += ","
+			}
+			registeredCompressors += callHdr.SendCompress
+		}
+	}
+
+	if registeredCompressors != "" {
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-accept-encoding", Value: registeredCompressors})
+	}
+	if dl, ok := ctx.Deadline(); ok {
+		// Send out timeout regardless its value. The server can detect timeout context by itself.
+		// TODO(mmukhi): Perhaps this field should be updated when actually writing out to the wire.
+		timeout := time.Until(dl)
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-timeout", Value: grpcutil.EncodeDuration(timeout)})
+	}
+	for k, v := range authData {
+		headerFields = append(headerFields, hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
+	}
+	for k, v := range callAuthData {
+		headerFields = append(headerFields, hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
+	}
+	if b := stats.OutgoingTags(ctx); b != nil {
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-tags-bin", Value: encodeBinHeader(b)})
+	}
+	if b := stats.OutgoingTrace(ctx); b != nil {
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-trace-bin", Value: encodeBinHeader(b)})
+	}
+
+	if md, added, ok := metadata.FromOutgoingContextRaw(ctx); ok {
+		var k string
+		for k, vv := range md {
+			// HTTP doesn't allow you to set pseudoheaders after non pseudoheaders were set.
+			if isReservedHeader(k) {
+				continue
+			}
+			for _, v := range vv {
+				headerFields = append(headerFields, hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
+			}
+		}
+		for _, vv := range added {
+			for i, v := range vv {
+				if i%2 == 0 {
+					k = strings.ToLower(v)
+					continue
+				}
+				// HTTP doesn't allow you to set pseudoheaders after non pseudoheaders were set.
+				if isReservedHeader(k) {
+					continue
+				}
+				headerFields = append(headerFields, hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
+			}
+		}
+	}
+	for k, vv := range t.md {
+		if isReservedHeader(k) {
+			continue
+		}
+		for _, v := range vv {
+			headerFields = append(headerFields, hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
+		}
+	}
+	return headerFields, nil
+}
+
+func (t *http2Client) createAudience(callHdr *CallHdr) string {
+	// Create an audience string only if needed.
+	if len(t.perRPCCreds) == 0 && callHdr.Creds == nil {
+		return ""
+	}
+	// Construct URI required to get auth request metadata.
+	// Omit port if it is the default one.
+	host := strings.TrimSuffix(callHdr.Host, ":443")
+	pos := strings.LastIndex(callHdr.Method, "/")
+	if pos == -1 {
+		pos = len(callHdr.Method)
+	}
+	return "https://" + host + callHdr.Method[:pos]
+}
+
+func (t *http2Client) getTrAuthData(ctx context.Context, audience string) (map[string]string, error) {
+	if len(t.perRPCCreds) == 0 {
+		return nil, nil
+	}
+	authData := map[string]string{}
+	for _, c := range t.perRPCCreds {
+		data, err := c.GetRequestMetadata(ctx, audience)
+		if err != nil {
+			if st, ok := status.FromError(err); ok {
+				// Restrict the code to the list allowed by gRFC A54.
+				if istatus.IsRestrictedControlPlaneCode(st) {
+					err = status.Errorf(codes.Internal, "transport: received per-RPC creds error with illegal status: %v", err)
+				}
+				return nil, err
+			}
+
+			return nil, status.Errorf(codes.Unauthenticated, "transport: per-RPC creds failed due to error: %v", err)
+		}
+		for k, v := range data {
+			// Capital header names are illegal in HTTP/2.
+			k = strings.ToLower(k)
+			authData[k] = v
+		}
+	}
+	return authData, nil
+}
+
+func (t *http2Client) getCallAuthData(ctx context.Context, audience string, callHdr *CallHdr) (map[string]string, error) {
+	var callAuthData map[string]string
+	// Check if credentials.PerRPCCredentials were provided via call options.
+	// Note: if these credentials are provided both via dial options and call
+	// options, then both sets of credentials will be applied.
+	if callCreds := callHdr.Creds; callCreds != nil {
+		if callCreds.RequireTransportSecurity() {
+			ri, _ := credentials.RequestInfoFromContext(ctx)
+			if !t.isSecure || credentials.CheckSecurityLevel(ri.AuthInfo, credentials.PrivacyAndIntegrity) != nil {
+				return nil, status.Error(codes.Unauthenticated, "transport: cannot send secure credentials on an insecure connection")
+			}
+		}
+		data, err := callCreds.GetRequestMetadata(ctx, audience)
+		if err != nil {
+			if st, ok := status.FromError(err); ok {
+				// Restrict the code to the list allowed by gRFC A54.
+				if istatus.IsRestrictedControlPlaneCode(st) {
+					err = status.Errorf(codes.Internal, "transport: received per-RPC creds error with illegal status: %v", err)
+				}
+				return nil, err
+			}
+			return nil, status.Errorf(codes.Internal, "transport: per-RPC creds failed due to error: %v", err)
+		}
+		callAuthData = make(map[string]string, len(data))
+		for k, v := range data {
+			// Capital header names are illegal in HTTP/2
+			k = strings.ToLower(k)
+			callAuthData[k] = v
+		}
+	}
+	return callAuthData, nil
+}
+
+// NewStreamError wraps an error and reports additional information.  Typically
+// NewStream errors result in transparent retry, as they mean nothing went onto
+// the wire.  However, there are two notable exceptions:
+//
+//  1. If the stream headers violate the max header list size allowed by the
+//     server.  It's possible this could succeed on another transport, even if
+//     it's unlikely, but do not transparently retry.
+//  2. If the credentials errored when requesting their headers.  In this case,
+//     it's possible a retry can fix the problem, but indefinitely transparently
+//     retrying is not appropriate as it is likely the credentials, if they can
+//     eventually succeed, would need I/O to do so.
+type NewStreamError struct {
+	Err error
+
+	AllowTransparentRetry bool
+}
+
+func (e NewStreamError) Error() string {
+	return e.Err.Error()
+}
+
+// NewStream creates a stream and registers it into the transport as "active"
+// streams.  All non-nil errors returned will be *NewStreamError.
+func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream, error) {
+	ctx = peer.NewContext(ctx, t.getPeer())
+
+	// ServerName field of the resolver returned address takes precedence over
+	// Host field of CallHdr to determine the :authority header. This is because,
+	// the ServerName field takes precedence for server authentication during
+	// TLS handshake, and the :authority header should match the value used
+	// for server authentication.
+	if t.address.ServerName != "" {
+		newCallHdr := *callHdr
+		newCallHdr.Host = t.address.ServerName
+		callHdr = &newCallHdr
+	}
+
+	headerFields, err := t.createHeaderFields(ctx, callHdr)
+	if err != nil {
+		return nil, &NewStreamError{Err: err, AllowTransparentRetry: false}
+	}
+	s := t.newStream(ctx, callHdr)
+	cleanup := func(err error) {
+		if s.swapState(streamDone) == streamDone {
+			// If it was already done, return.
+			return
+		}
+		// The stream was unprocessed by the server.
+		atomic.StoreUint32(&s.unprocessed, 1)
+		s.write(recvMsg{err: err})
+		close(s.done)
+		// If headerChan isn't closed, then close it.
+		if atomic.CompareAndSwapUint32(&s.headerChanClosed, 0, 1) {
+			close(s.headerChan)
+		}
+	}
+	hdr := &headerFrame{
+		hf:        headerFields,
+		endStream: false,
+		initStream: func(id uint32) error {
+			t.mu.Lock()
+			// TODO: handle transport closure in loopy instead and remove this
+			// initStream is never called when transport is draining.
+			if t.state == closing {
+				t.mu.Unlock()
+				cleanup(ErrConnClosing)
+				return ErrConnClosing
+			}
+			if channelz.IsOn() {
+				atomic.AddInt64(&t.czData.streamsStarted, 1)
+				atomic.StoreInt64(&t.czData.lastStreamCreatedTime, time.Now().UnixNano())
+			}
+			// If the keepalive goroutine has gone dormant, wake it up.
+			if t.kpDormant {
+				t.kpDormancyCond.Signal()
+			}
+			t.mu.Unlock()
+			return nil
+		},
+		onOrphaned: cleanup,
+		wq:         s.wq,
+	}
+	firstTry := true
+	var ch chan struct{}
+	transportDrainRequired := false
+	checkForStreamQuota := func(it interface{}) bool {
+		if t.streamQuota <= 0 { // Can go negative if server decreases it.
+			if firstTry {
+				t.waitingStreams++
+			}
+			ch = t.streamsQuotaAvailable
+			return false
+		}
+		if !firstTry {
+			t.waitingStreams--
+		}
+		t.streamQuota--
+		h := it.(*headerFrame)
+		h.streamID = t.nextID
+		t.nextID += 2
+
+		// Drain client transport if nextID > MaxStreamID which signals gRPC that
+		// the connection is closed and a new one must be created for subsequent RPCs.
+		transportDrainRequired = t.nextID > MaxStreamID
+
+		s.id = h.streamID
+		s.fc = &inFlow{limit: uint32(t.initialWindowSize)}
+		t.mu.Lock()
+		if t.state == draining || t.activeStreams == nil { // Can be niled from Close().
+			t.mu.Unlock()
+			return false // Don't create a stream if the transport is already closed.
+		}
+		t.activeStreams[s.id] = s
+		t.mu.Unlock()
+		if t.streamQuota > 0 && t.waitingStreams > 0 {
+			select {
+			case t.streamsQuotaAvailable <- struct{}{}:
+			default:
+			}
+		}
+		return true
+	}
+	var hdrListSizeErr error
+	checkForHeaderListSize := func(it interface{}) bool {
+		if t.maxSendHeaderListSize == nil {
+			return true
+		}
+		hdrFrame := it.(*headerFrame)
+		var sz int64
+		for _, f := range hdrFrame.hf {
+			if sz += int64(f.Size()); sz > int64(*t.maxSendHeaderListSize) {
+				hdrListSizeErr = status.Errorf(codes.Internal, "header list size to send violates the maximum size (%d bytes) set by server", *t.maxSendHeaderListSize)
+				return false
+			}
+		}
+		return true
+	}
+	for {
+		success, err := t.controlBuf.executeAndPut(func(it interface{}) bool {
+			return checkForHeaderListSize(it) && checkForStreamQuota(it)
+		}, hdr)
+		if err != nil {
+			// Connection closed.
+			return nil, &NewStreamError{Err: err, AllowTransparentRetry: true}
+		}
+		if success {
+			break
+		}
+		if hdrListSizeErr != nil {
+			return nil, &NewStreamError{Err: hdrListSizeErr}
+		}
+		firstTry = false
+		select {
+		case <-ch:
+		case <-ctx.Done():
+			return nil, &NewStreamError{Err: ContextErr(ctx.Err())}
+		case <-t.goAway:
+			return nil, &NewStreamError{Err: errStreamDrain, AllowTransparentRetry: true}
+		case <-t.ctx.Done():
+			return nil, &NewStreamError{Err: ErrConnClosing, AllowTransparentRetry: true}
+		}
+	}
+	if len(t.statsHandlers) != 0 {
+		header, ok := metadata.FromOutgoingContext(ctx)
+		if ok {
+			header.Set("user-agent", t.userAgent)
+		} else {
+			header = metadata.Pairs("user-agent", t.userAgent)
+		}
+		for _, sh := range t.statsHandlers {
+			// Note: The header fields are compressed with hpack after this call returns.
+			// No WireLength field is set here.
+			// Note: Creating a new stats object to prevent pollution.
+			outHeader := &stats.OutHeader{
+				Client:      true,
+				FullMethod:  callHdr.Method,
+				RemoteAddr:  t.remoteAddr,
+				LocalAddr:   t.localAddr,
+				Compression: callHdr.SendCompress,
+				Header:      header,
+			}
+			sh.HandleRPC(s.ctx, outHeader)
+		}
+	}
+	if transportDrainRequired {
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Draining transport: t.nextID > MaxStreamID")
+		}
+		t.GracefulClose()
+	}
+	return s, nil
+}
+
+// CloseStream clears the footprint of a stream when the stream is not needed any more.
+// This must not be executed in reader's goroutine.
+func (t *http2Client) CloseStream(s *Stream, err error) {
+	var (
+		rst     bool
+		rstCode http2.ErrCode
+	)
+	if err != nil {
+		rst = true
+		rstCode = http2.ErrCodeCancel
+	}
+	t.closeStream(s, err, rst, rstCode, status.Convert(err), nil, false)
+}
+
+func (t *http2Client) closeStream(s *Stream, err error, rst bool, rstCode http2.ErrCode, st *status.Status, mdata map[string][]string, eosReceived bool) {
+	// Set stream status to done.
+	if s.swapState(streamDone) == streamDone {
+		// If it was already done, return.  If multiple closeStream calls
+		// happen simultaneously, wait for the first to finish.
+		<-s.done
+		return
+	}
+	// status and trailers can be updated here without any synchronization because the stream goroutine will
+	// only read it after it sees an io.EOF error from read or write and we'll write those errors
+	// only after updating this.
+	s.status = st
+	if len(mdata) > 0 {
+		s.trailer = mdata
+	}
+	if err != nil {
+		// This will unblock reads eventually.
+		s.write(recvMsg{err: err})
+	}
+	// If headerChan isn't closed, then close it.
+	if atomic.CompareAndSwapUint32(&s.headerChanClosed, 0, 1) {
+		s.noHeaders = true
+		close(s.headerChan)
+	}
+	cleanup := &cleanupStream{
+		streamID: s.id,
+		onWrite: func() {
+			t.mu.Lock()
+			if t.activeStreams != nil {
+				delete(t.activeStreams, s.id)
+			}
+			t.mu.Unlock()
+			if channelz.IsOn() {
+				if eosReceived {
+					atomic.AddInt64(&t.czData.streamsSucceeded, 1)
+				} else {
+					atomic.AddInt64(&t.czData.streamsFailed, 1)
+				}
+			}
+		},
+		rst:     rst,
+		rstCode: rstCode,
+	}
+	addBackStreamQuota := func(interface{}) bool {
+		t.streamQuota++
+		if t.streamQuota > 0 && t.waitingStreams > 0 {
+			select {
+			case t.streamsQuotaAvailable <- struct{}{}:
+			default:
+			}
+		}
+		return true
+	}
+	t.controlBuf.executeAndPut(addBackStreamQuota, cleanup)
+	// This will unblock write.
+	close(s.done)
+	if s.doneFunc != nil {
+		s.doneFunc()
+	}
+}
+
+// Close kicks off the shutdown process of the transport. This should be called
+// only once on a transport. Once it is called, the transport should not be
+// accessed any more.
+func (t *http2Client) Close(err error) {
+	t.mu.Lock()
+	// Make sure we only close once.
+	if t.state == closing {
+		t.mu.Unlock()
+		return
+	}
+	if t.logger.V(logLevel) {
+		t.logger.Infof("Closing: %v", err)
+	}
+	// Call t.onClose ASAP to prevent the client from attempting to create new
+	// streams.
+	if t.state != draining {
+		t.onClose(GoAwayInvalid)
+	}
+	t.state = closing
+	streams := t.activeStreams
+	t.activeStreams = nil
+	if t.kpDormant {
+		// If the keepalive goroutine is blocked on this condition variable, we
+		// should unblock it so that the goroutine eventually exits.
+		t.kpDormancyCond.Signal()
+	}
+	t.mu.Unlock()
+	t.controlBuf.finish()
+	t.cancel()
+	t.conn.Close()
+	channelz.RemoveEntry(t.channelzID)
+	// Append info about previous goaways if there were any, since this may be important
+	// for understanding the root cause for this connection to be closed.
+	_, goAwayDebugMessage := t.GetGoAwayReason()
+
+	var st *status.Status
+	if len(goAwayDebugMessage) > 0 {
+		st = status.Newf(codes.Unavailable, "closing transport due to: %v, received prior goaway: %v", err, goAwayDebugMessage)
+		err = st.Err()
+	} else {
+		st = status.New(codes.Unavailable, err.Error())
+	}
+
+	// Notify all active streams.
+	for _, s := range streams {
+		t.closeStream(s, err, false, http2.ErrCodeNo, st, nil, false)
+	}
+	for _, sh := range t.statsHandlers {
+		connEnd := &stats.ConnEnd{
+			Client: true,
+		}
+		sh.HandleConn(t.ctx, connEnd)
+	}
+}
+
+// GracefulClose sets the state to draining, which prevents new streams from
+// being created and causes the transport to be closed when the last active
+// stream is closed.  If there are no active streams, the transport is closed
+// immediately.  This does nothing if the transport is already draining or
+// closing.
+func (t *http2Client) GracefulClose() {
+	t.mu.Lock()
+	// Make sure we move to draining only from active.
+	if t.state == draining || t.state == closing {
+		t.mu.Unlock()
+		return
+	}
+	if t.logger.V(logLevel) {
+		t.logger.Infof("GracefulClose called")
+	}
+	t.onClose(GoAwayInvalid)
+	t.state = draining
+	active := len(t.activeStreams)
+	t.mu.Unlock()
+	if active == 0 {
+		t.Close(connectionErrorf(true, nil, "no active streams left to process while draining"))
+		return
+	}
+	t.controlBuf.put(&incomingGoAway{})
+}
+
+// Write formats the data into HTTP2 data frame(s) and sends it out. The caller
+// should proceed only if Write returns nil.
+func (t *http2Client) Write(s *Stream, hdr []byte, data []byte, opts *Options) error {
+	if opts.Last {
+		// If it's the last message, update stream state.
+		if !s.compareAndSwapState(streamActive, streamWriteDone) {
+			return errStreamDone
+		}
+	} else if s.getState() != streamActive {
+		return errStreamDone
+	}
+	df := &dataFrame{
+		streamID:  s.id,
+		endStream: opts.Last,
+		h:         hdr,
+		d:         data,
+	}
+	if hdr != nil || data != nil { // If it's not an empty data frame, check quota.
+		if err := s.wq.get(int32(len(hdr) + len(data))); err != nil {
+			return err
+		}
+	}
+	return t.controlBuf.put(df)
+}
+
+func (t *http2Client) getStream(f http2.Frame) *Stream {
+	t.mu.Lock()
+	s := t.activeStreams[f.Header().StreamID]
+	t.mu.Unlock()
+	return s
+}
+
+// adjustWindow sends out extra window update over the initial window size
+// of stream if the application is requesting data larger in size than
+// the window.
+func (t *http2Client) adjustWindow(s *Stream, n uint32) {
+	if w := s.fc.maybeAdjust(n); w > 0 {
+		t.controlBuf.put(&outgoingWindowUpdate{streamID: s.id, increment: w})
+	}
+}
+
+// updateWindow adjusts the inbound quota for the stream.
+// Window updates will be sent out when the cumulative quota
+// exceeds the corresponding threshold.
+func (t *http2Client) updateWindow(s *Stream, n uint32) {
+	if w := s.fc.onRead(n); w > 0 {
+		t.controlBuf.put(&outgoingWindowUpdate{streamID: s.id, increment: w})
+	}
+}
+
+// updateFlowControl updates the incoming flow control windows
+// for the transport and the stream based on the current bdp
+// estimation.
+func (t *http2Client) updateFlowControl(n uint32) {
+	updateIWS := func(interface{}) bool {
+		t.initialWindowSize = int32(n)
+		t.mu.Lock()
+		for _, s := range t.activeStreams {
+			s.fc.newLimit(n)
+		}
+		t.mu.Unlock()
+		return true
+	}
+	t.controlBuf.executeAndPut(updateIWS, &outgoingWindowUpdate{streamID: 0, increment: t.fc.newLimit(n)})
+	t.controlBuf.put(&outgoingSettings{
+		ss: []http2.Setting{
+			{
+				ID:  http2.SettingInitialWindowSize,
+				Val: n,
+			},
+		},
+	})
+}
+
+func (t *http2Client) handleData(f *http2.DataFrame) {
+	size := f.Header().Length
+	var sendBDPPing bool
+	if t.bdpEst != nil {
+		sendBDPPing = t.bdpEst.add(size)
+	}
+	// Decouple connection's flow control from application's read.
+	// An update on connection's flow control should not depend on
+	// whether user application has read the data or not. Such a
+	// restriction is already imposed on the stream's flow control,
+	// and therefore the sender will be blocked anyways.
+	// Decoupling the connection flow control will prevent other
+	// active(fast) streams from starving in presence of slow or
+	// inactive streams.
+	//
+	if w := t.fc.onData(size); w > 0 {
+		t.controlBuf.put(&outgoingWindowUpdate{
+			streamID:  0,
+			increment: w,
+		})
+	}
+	if sendBDPPing {
+		// Avoid excessive ping detection (e.g. in an L7 proxy)
+		// by sending a window update prior to the BDP ping.
+
+		if w := t.fc.reset(); w > 0 {
+			t.controlBuf.put(&outgoingWindowUpdate{
+				streamID:  0,
+				increment: w,
+			})
+		}
+
+		t.controlBuf.put(bdpPing)
+	}
+	// Select the right stream to dispatch.
+	s := t.getStream(f)
+	if s == nil {
+		return
+	}
+	if size > 0 {
+		if err := s.fc.onData(size); err != nil {
+			t.closeStream(s, io.EOF, true, http2.ErrCodeFlowControl, status.New(codes.Internal, err.Error()), nil, false)
+			return
+		}
+		if f.Header().Flags.Has(http2.FlagDataPadded) {
+			if w := s.fc.onRead(size - uint32(len(f.Data()))); w > 0 {
+				t.controlBuf.put(&outgoingWindowUpdate{s.id, w})
+			}
+		}
+		// TODO(bradfitz, zhaoq): A copy is required here because there is no
+		// guarantee f.Data() is consumed before the arrival of next frame.
+		// Can this copy be eliminated?
+		if len(f.Data()) > 0 {
+			buffer := t.bufferPool.get()
+			buffer.Reset()
+			buffer.Write(f.Data())
+			s.write(recvMsg{buffer: buffer})
+		}
+	}
+	// The server has closed the stream without sending trailers.  Record that
+	// the read direction is closed, and set the status appropriately.
+	if f.StreamEnded() {
+		t.closeStream(s, io.EOF, false, http2.ErrCodeNo, status.New(codes.Internal, "server closed the stream without sending trailers"), nil, true)
+	}
+}
+
+func (t *http2Client) handleRSTStream(f *http2.RSTStreamFrame) {
+	s := t.getStream(f)
+	if s == nil {
+		return
+	}
+	if f.ErrCode == http2.ErrCodeRefusedStream {
+		// The stream was unprocessed by the server.
+		atomic.StoreUint32(&s.unprocessed, 1)
+	}
+	statusCode, ok := http2ErrConvTab[f.ErrCode]
+	if !ok {
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Received a RST_STREAM frame with code %q, but found no mapped gRPC status", f.ErrCode)
+		}
+		statusCode = codes.Unknown
+	}
+	if statusCode == codes.Canceled {
+		if d, ok := s.ctx.Deadline(); ok && !d.After(time.Now()) {
+			// Our deadline was already exceeded, and that was likely the cause
+			// of this cancelation.  Alter the status code accordingly.
+			statusCode = codes.DeadlineExceeded
+		}
+	}
+	t.closeStream(s, io.EOF, false, http2.ErrCodeNo, status.Newf(statusCode, "stream terminated by RST_STREAM with error code: %v", f.ErrCode), nil, false)
+}
+
+func (t *http2Client) handleSettings(f *http2.SettingsFrame, isFirst bool) {
+	if f.IsAck() {
+		return
+	}
+	var maxStreams *uint32
+	var ss []http2.Setting
+	var updateFuncs []func()
+	f.ForeachSetting(func(s http2.Setting) error {
+		switch s.ID {
+		case http2.SettingMaxConcurrentStreams:
+			maxStreams = new(uint32)
+			*maxStreams = s.Val
+		case http2.SettingMaxHeaderListSize:
+			updateFuncs = append(updateFuncs, func() {
+				t.maxSendHeaderListSize = new(uint32)
+				*t.maxSendHeaderListSize = s.Val
+			})
+		default:
+			ss = append(ss, s)
+		}
+		return nil
+	})
+	if isFirst && maxStreams == nil {
+		maxStreams = new(uint32)
+		*maxStreams = math.MaxUint32
+	}
+	sf := &incomingSettings{
+		ss: ss,
+	}
+	if maxStreams != nil {
+		updateStreamQuota := func() {
+			delta := int64(*maxStreams) - int64(t.maxConcurrentStreams)
+			t.maxConcurrentStreams = *maxStreams
+			t.streamQuota += delta
+			if delta > 0 && t.waitingStreams > 0 {
+				close(t.streamsQuotaAvailable) // wake all of them up.
+				t.streamsQuotaAvailable = make(chan struct{}, 1)
+			}
+		}
+		updateFuncs = append(updateFuncs, updateStreamQuota)
+	}
+	t.controlBuf.executeAndPut(func(interface{}) bool {
+		for _, f := range updateFuncs {
+			f()
+		}
+		return true
+	}, sf)
+}
+
+func (t *http2Client) handlePing(f *http2.PingFrame) {
+	if f.IsAck() {
+		// Maybe it's a BDP ping.
+		if t.bdpEst != nil {
+			t.bdpEst.calculate(f.Data)
+		}
+		return
+	}
+	pingAck := &ping{ack: true}
+	copy(pingAck.data[:], f.Data[:])
+	t.controlBuf.put(pingAck)
+}
+
+func (t *http2Client) handleGoAway(f *http2.GoAwayFrame) {
+	t.mu.Lock()
+	if t.state == closing {
+		t.mu.Unlock()
+		return
+	}
+	if f.ErrCode == http2.ErrCodeEnhanceYourCalm && string(f.DebugData()) == "too_many_pings" {
+		// When a client receives a GOAWAY with error code ENHANCE_YOUR_CALM and debug
+		// data equal to ASCII "too_many_pings", it should log the occurrence at a log level that is
+		// enabled by default and double the configure KEEPALIVE_TIME used for new connections
+		// on that channel.
+		logger.Errorf("Client received GoAway with error code ENHANCE_YOUR_CALM and debug data equal to ASCII \"too_many_pings\".")
+	}
+	id := f.LastStreamID
+	if id > 0 && id%2 == 0 {
+		t.mu.Unlock()
+		t.Close(connectionErrorf(true, nil, "received goaway with non-zero even-numbered numbered stream id: %v", id))
+		return
+	}
+	// A client can receive multiple GoAways from the server (see
+	// https://github.com/grpc/grpc-go/issues/1387).  The idea is that the first
+	// GoAway will be sent with an ID of MaxInt32 and the second GoAway will be
+	// sent after an RTT delay with the ID of the last stream the server will
+	// process.
+	//
+	// Therefore, when we get the first GoAway we don't necessarily close any
+	// streams. While in case of second GoAway we close all streams created after
+	// the GoAwayId. This way streams that were in-flight while the GoAway from
+	// server was being sent don't get killed.
+	select {
+	case <-t.goAway: // t.goAway has been closed (i.e.,multiple GoAways).
+		// If there are multiple GoAways the first one should always have an ID greater than the following ones.
+		if id > t.prevGoAwayID {
+			t.mu.Unlock()
+			t.Close(connectionErrorf(true, nil, "received goaway with stream id: %v, which exceeds stream id of previous goaway: %v", id, t.prevGoAwayID))
+			return
+		}
+	default:
+		t.setGoAwayReason(f)
+		close(t.goAway)
+		defer t.controlBuf.put(&incomingGoAway{}) // Defer as t.mu is currently held.
+		// Notify the clientconn about the GOAWAY before we set the state to
+		// draining, to allow the client to stop attempting to create streams
+		// before disallowing new streams on this connection.
+		if t.state != draining {
+			t.onClose(t.goAwayReason)
+			t.state = draining
+		}
+	}
+	// All streams with IDs greater than the GoAwayId
+	// and smaller than the previous GoAway ID should be killed.
+	upperLimit := t.prevGoAwayID
+	if upperLimit == 0 { // This is the first GoAway Frame.
+		upperLimit = math.MaxUint32 // Kill all streams after the GoAway ID.
+	}
+
+	t.prevGoAwayID = id
+	if len(t.activeStreams) == 0 {
+		t.mu.Unlock()
+		t.Close(connectionErrorf(true, nil, "received goaway and there are no active streams"))
+		return
+	}
+
+	streamsToClose := make([]*Stream, 0)
+	for streamID, stream := range t.activeStreams {
+		if streamID > id && streamID <= upperLimit {
+			// The stream was unprocessed by the server.
+			if streamID > id && streamID <= upperLimit {
+				atomic.StoreUint32(&stream.unprocessed, 1)
+				streamsToClose = append(streamsToClose, stream)
+			}
+		}
+	}
+	t.mu.Unlock()
+	// Called outside t.mu because closeStream can take controlBuf's mu, which
+	// could induce deadlock and is not allowed.
+	for _, stream := range streamsToClose {
+		t.closeStream(stream, errStreamDrain, false, http2.ErrCodeNo, statusGoAway, nil, false)
+	}
+}
+
+// setGoAwayReason sets the value of t.goAwayReason based
+// on the GoAway frame received.
+// It expects a lock on transport's mutext to be held by
+// the caller.
+func (t *http2Client) setGoAwayReason(f *http2.GoAwayFrame) {
+	t.goAwayReason = GoAwayNoReason
+	switch f.ErrCode {
+	case http2.ErrCodeEnhanceYourCalm:
+		if string(f.DebugData()) == "too_many_pings" {
+			t.goAwayReason = GoAwayTooManyPings
+		}
+	}
+	if len(f.DebugData()) == 0 {
+		t.goAwayDebugMessage = fmt.Sprintf("code: %s", f.ErrCode)
+	} else {
+		t.goAwayDebugMessage = fmt.Sprintf("code: %s, debug data: %q", f.ErrCode, string(f.DebugData()))
+	}
+}
+
+func (t *http2Client) GetGoAwayReason() (GoAwayReason, string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.goAwayReason, t.goAwayDebugMessage
+}
+
+func (t *http2Client) handleWindowUpdate(f *http2.WindowUpdateFrame) {
+	t.controlBuf.put(&incomingWindowUpdate{
+		streamID:  f.Header().StreamID,
+		increment: f.Increment,
+	})
+}
+
+// operateHeaders takes action on the decoded headers.
+func (t *http2Client) operateHeaders(frame *http2.MetaHeadersFrame) {
+	s := t.getStream(frame)
+	if s == nil {
+		return
+	}
+	endStream := frame.StreamEnded()
+	atomic.StoreUint32(&s.bytesReceived, 1)
+	initialHeader := atomic.LoadUint32(&s.headerChanClosed) == 0
+
+	if !initialHeader && !endStream {
+		// As specified by gRPC over HTTP2, a HEADERS frame (and associated CONTINUATION frames) can only appear at the start or end of a stream. Therefore, second HEADERS frame must have EOS bit set.
+		st := status.New(codes.Internal, "a HEADERS frame cannot appear in the middle of a stream")
+		t.closeStream(s, st.Err(), true, http2.ErrCodeProtocol, st, nil, false)
+		return
+	}
+
+	// frame.Truncated is set to true when framer detects that the current header
+	// list size hits MaxHeaderListSize limit.
+	if frame.Truncated {
+		se := status.New(codes.Internal, "peer header list size exceeded limit")
+		t.closeStream(s, se.Err(), true, http2.ErrCodeFrameSize, se, nil, endStream)
+		return
+	}
+
+	var (
+		// If a gRPC Response-Headers has already been received, then it means
+		// that the peer is speaking gRPC and we are in gRPC mode.
+		isGRPC         = !initialHeader
+		mdata          = make(map[string][]string)
+		contentTypeErr = "malformed header: missing HTTP content-type"
+		grpcMessage    string
+		statusGen      *status.Status
+		recvCompress   string
+		httpStatusCode *int
+		httpStatusErr  string
+		rawStatusCode  = codes.Unknown
+		// headerError is set if an error is encountered while parsing the headers
+		headerError string
+	)
+
+	if initialHeader {
+		httpStatusErr = "malformed header: missing HTTP status"
+	}
+
+	for _, hf := range frame.Fields {
+		switch hf.Name {
+		case "content-type":
+			if _, validContentType := grpcutil.ContentSubtype(hf.Value); !validContentType {
+				contentTypeErr = fmt.Sprintf("transport: received unexpected content-type %q", hf.Value)
+				break
+			}
+			contentTypeErr = ""
+			mdata[hf.Name] = append(mdata[hf.Name], hf.Value)
+			isGRPC = true
+		case "grpc-encoding":
+			recvCompress = hf.Value
+		case "grpc-status":
+			code, err := strconv.ParseInt(hf.Value, 10, 32)
+			if err != nil {
+				se := status.New(codes.Internal, fmt.Sprintf("transport: malformed grpc-status: %v", err))
+				t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, endStream)
+				return
+			}
+			rawStatusCode = codes.Code(uint32(code))
+		case "grpc-message":
+			grpcMessage = decodeGrpcMessage(hf.Value)
+		case "grpc-status-details-bin":
+			var err error
+			statusGen, err = decodeGRPCStatusDetails(hf.Value)
+			if err != nil {
+				headerError = fmt.Sprintf("transport: malformed grpc-status-details-bin: %v", err)
+			}
+		case ":status":
+			if hf.Value == "200" {
+				httpStatusErr = ""
+				statusCode := 200
+				httpStatusCode = &statusCode
+				break
+			}
+
+			c, err := strconv.ParseInt(hf.Value, 10, 32)
+			if err != nil {
+				se := status.New(codes.Internal, fmt.Sprintf("transport: malformed http-status: %v", err))
+				t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, endStream)
+				return
+			}
+			statusCode := int(c)
+			httpStatusCode = &statusCode
+
+			httpStatusErr = fmt.Sprintf(
+				"unexpected HTTP status code received from server: %d (%s)",
+				statusCode,
+				http.StatusText(statusCode),
+			)
+		default:
+			if isReservedHeader(hf.Name) && !isWhitelistedHeader(hf.Name) {
+				break
+			}
+			v, err := decodeMetadataHeader(hf.Name, hf.Value)
+			if err != nil {
+				headerError = fmt.Sprintf("transport: malformed %s: %v", hf.Name, err)
+				logger.Warningf("Failed to decode metadata header (%q, %q): %v", hf.Name, hf.Value, err)
+				break
+			}
+			mdata[hf.Name] = append(mdata[hf.Name], v)
+		}
+	}
+
+	if !isGRPC || httpStatusErr != "" {
+		var code = codes.Internal // when header does not include HTTP status, return INTERNAL
+
+		if httpStatusCode != nil {
+			var ok bool
+			code, ok = HTTPStatusConvTab[*httpStatusCode]
+			if !ok {
+				code = codes.Unknown
+			}
+		}
+		var errs []string
+		if httpStatusErr != "" {
+			errs = append(errs, httpStatusErr)
+		}
+		if contentTypeErr != "" {
+			errs = append(errs, contentTypeErr)
+		}
+		// Verify the HTTP response is a 200.
+		se := status.New(code, strings.Join(errs, "; "))
+		t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, endStream)
+		return
+	}
+
+	if headerError != "" {
+		se := status.New(codes.Internal, headerError)
+		t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, endStream)
+		return
+	}
+
+	isHeader := false
+
+	// If headerChan hasn't been closed yet
+	if atomic.CompareAndSwapUint32(&s.headerChanClosed, 0, 1) {
+		s.headerValid = true
+		if !endStream {
+			// HEADERS frame block carries a Response-Headers.
+			isHeader = true
+			// These values can be set without any synchronization because
+			// stream goroutine will read it only after seeing a closed
+			// headerChan which we'll close after setting this.
+			s.recvCompress = recvCompress
+			if len(mdata) > 0 {
+				s.header = mdata
+			}
+		} else {
+			// HEADERS frame block carries a Trailers-Only.
+			s.noHeaders = true
+		}
+		close(s.headerChan)
+	}
+
+	for _, sh := range t.statsHandlers {
+		if isHeader {
+			inHeader := &stats.InHeader{
+				Client:      true,
+				WireLength:  int(frame.Header().Length),
+				Header:      metadata.MD(mdata).Copy(),
+				Compression: s.recvCompress,
+			}
+			sh.HandleRPC(s.ctx, inHeader)
+		} else {
+			inTrailer := &stats.InTrailer{
+				Client:     true,
+				WireLength: int(frame.Header().Length),
+				Trailer:    metadata.MD(mdata).Copy(),
+			}
+			sh.HandleRPC(s.ctx, inTrailer)
+		}
+	}
+
+	if !endStream {
+		return
+	}
+
+	if statusGen == nil {
+		statusGen = status.New(rawStatusCode, grpcMessage)
+	}
+
+	// if client received END_STREAM from server while stream was still active, send RST_STREAM
+	rst := s.getState() == streamActive
+	t.closeStream(s, io.EOF, rst, http2.ErrCodeNo, statusGen, mdata, true)
+}
+
+// readServerPreface reads and handles the initial settings frame from the
+// server.
+func (t *http2Client) readServerPreface() error {
+	frame, err := t.framer.fr.ReadFrame()
+	if err != nil {
+		return connectionErrorf(true, err, "error reading server preface: %v", err)
+	}
+	sf, ok := frame.(*http2.SettingsFrame)
+	if !ok {
+		return connectionErrorf(true, nil, "initial http2 frame from server is not a settings frame: %T", frame)
+	}
+	t.handleSettings(sf, true)
+	return nil
+}
+
+// reader verifies the server preface and reads all subsequent data from
+// network connection.  If the server preface is not read successfully, an
+// error is pushed to errCh; otherwise errCh is closed with no error.
+func (t *http2Client) reader(errCh chan<- error) {
+	defer close(t.readerDone)
+
+	if err := t.readServerPreface(); err != nil {
+		errCh <- err
+		return
+	}
+	close(errCh)
+	if t.keepaliveEnabled {
+		atomic.StoreInt64(&t.lastRead, time.Now().UnixNano())
+	}
+
+	// loop to keep reading incoming messages on this transport.
+	for {
+		t.controlBuf.throttle()
+		frame, err := t.framer.fr.ReadFrame()
+		if t.keepaliveEnabled {
+			atomic.StoreInt64(&t.lastRead, time.Now().UnixNano())
+		}
+		if err != nil {
+			// Abort an active stream if the http2.Framer returns a
+			// http2.StreamError. This can happen only if the server's response
+			// is malformed http2.
+			if se, ok := err.(http2.StreamError); ok {
+				t.mu.Lock()
+				s := t.activeStreams[se.StreamID]
+				t.mu.Unlock()
+				if s != nil {
+					// use error detail to provide better err message
+					code := http2ErrConvTab[se.Code]
+					errorDetail := t.framer.fr.ErrorDetail()
+					var msg string
+					if errorDetail != nil {
+						msg = errorDetail.Error()
+					} else {
+						msg = "received invalid frame"
+					}
+					t.closeStream(s, status.Error(code, msg), true, http2.ErrCodeProtocol, status.New(code, msg), nil, false)
+				}
+				continue
+			} else {
+				// Transport error.
+				t.Close(connectionErrorf(true, err, "error reading from server: %v", err))
+				return
+			}
+		}
+		switch frame := frame.(type) {
+		case *http2.MetaHeadersFrame:
+			t.operateHeaders(frame)
+		case *http2.DataFrame:
+			t.handleData(frame)
+		case *http2.RSTStreamFrame:
+			t.handleRSTStream(frame)
+		case *http2.SettingsFrame:
+			t.handleSettings(frame, false)
+		case *http2.PingFrame:
+			t.handlePing(frame)
+		case *http2.GoAwayFrame:
+			t.handleGoAway(frame)
+		case *http2.WindowUpdateFrame:
+			t.handleWindowUpdate(frame)
+		default:
+			if logger.V(logLevel) {
+				logger.Errorf("transport: http2Client.reader got unhandled frame type %v.", frame)
+			}
+		}
+	}
+}
+
+func minTime(a, b time.Duration) time.Duration {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// keepalive running in a separate goroutine makes sure the connection is alive by sending pings.
+func (t *http2Client) keepalive() {
+	p := &ping{data: [8]byte{}}
+	// True iff a ping has been sent, and no data has been received since then.
+	outstandingPing := false
+	// Amount of time remaining before which we should receive an ACK for the
+	// last sent ping.
+	timeoutLeft := time.Duration(0)
+	// Records the last value of t.lastRead before we go block on the timer.
+	// This is required to check for read activity since then.
+	prevNano := time.Now().UnixNano()
+	timer := time.NewTimer(t.kp.Time)
+	for {
+		select {
+		case <-timer.C:
+			lastRead := atomic.LoadInt64(&t.lastRead)
+			if lastRead > prevNano {
+				// There has been read activity since the last time we were here.
+				outstandingPing = false
+				// Next timer should fire at kp.Time seconds from lastRead time.
+				timer.Reset(time.Duration(lastRead) + t.kp.Time - time.Duration(time.Now().UnixNano()))
+				prevNano = lastRead
+				continue
+			}
+			if outstandingPing && timeoutLeft <= 0 {
+				t.Close(connectionErrorf(true, nil, "keepalive ping failed to receive ACK within timeout"))
+				return
+			}
+			t.mu.Lock()
+			if t.state == closing {
+				// If the transport is closing, we should exit from the
+				// keepalive goroutine here. If not, we could have a race
+				// between the call to Signal() from Close() and the call to
+				// Wait() here, whereby the keepalive goroutine ends up
+				// blocking on the condition variable which will never be
+				// signalled again.
+				t.mu.Unlock()
+				return
+			}
+			if len(t.activeStreams) < 1 && !t.kp.PermitWithoutStream {
+				// If a ping was sent out previously (because there were active
+				// streams at that point) which wasn't acked and its timeout
+				// hadn't fired, but we got here and are about to go dormant,
+				// we should make sure that we unconditionally send a ping once
+				// we awaken.
+				outstandingPing = false
+				t.kpDormant = true
+				t.kpDormancyCond.Wait()
+			}
+			t.kpDormant = false
+			t.mu.Unlock()
+
+			// We get here either because we were dormant and a new stream was
+			// created which unblocked the Wait() call, or because the
+			// keepalive timer expired. In both cases, we need to send a ping.
+			if !outstandingPing {
+				if channelz.IsOn() {
+					atomic.AddInt64(&t.czData.kpCount, 1)
+				}
+				t.controlBuf.put(p)
+				timeoutLeft = t.kp.Timeout
+				outstandingPing = true
+			}
+			// The amount of time to sleep here is the minimum of kp.Time and
+			// timeoutLeft. This will ensure that we wait only for kp.Time
+			// before sending out the next ping (for cases where the ping is
+			// acked).
+			sleepDuration := minTime(t.kp.Time, timeoutLeft)
+			timeoutLeft -= sleepDuration
+			timer.Reset(sleepDuration)
+		case <-t.ctx.Done():
+			if !timer.Stop() {
+				<-timer.C
+			}
+			return
+		}
+	}
+}
+
+func (t *http2Client) Error() <-chan struct{} {
+	return t.ctx.Done()
+}
+
+func (t *http2Client) GoAway() <-chan struct{} {
+	return t.goAway
+}
+
+func (t *http2Client) ChannelzMetric() *channelz.SocketInternalMetric {
+	s := channelz.SocketInternalMetric{
+		StreamsStarted:                  atomic.LoadInt64(&t.czData.streamsStarted),
+		StreamsSucceeded:                atomic.LoadInt64(&t.czData.streamsSucceeded),
+		StreamsFailed:                   atomic.LoadInt64(&t.czData.streamsFailed),
+		MessagesSent:                    atomic.LoadInt64(&t.czData.msgSent),
+		MessagesReceived:                atomic.LoadInt64(&t.czData.msgRecv),
+		KeepAlivesSent:                  atomic.LoadInt64(&t.czData.kpCount),
+		LastLocalStreamCreatedTimestamp: time.Unix(0, atomic.LoadInt64(&t.czData.lastStreamCreatedTime)),
+		LastMessageSentTimestamp:        time.Unix(0, atomic.LoadInt64(&t.czData.lastMsgSentTime)),
+		LastMessageReceivedTimestamp:    time.Unix(0, atomic.LoadInt64(&t.czData.lastMsgRecvTime)),
+		LocalFlowControlWindow:          int64(t.fc.getSize()),
+		SocketOptions:                   channelz.GetSocketOption(t.conn),
+		LocalAddr:                       t.localAddr,
+		RemoteAddr:                      t.remoteAddr,
+		// RemoteName :
+	}
+	if au, ok := t.authInfo.(credentials.ChannelzSecurityInfo); ok {
+		s.Security = au.GetSecurityValue()
+	}
+	s.RemoteFlowControlWindow = t.getOutFlowWindow()
+	return &s
+}
+
+func (t *http2Client) RemoteAddr() net.Addr { return t.remoteAddr }
+
+func (t *http2Client) IncrMsgSent() {
+	atomic.AddInt64(&t.czData.msgSent, 1)
+	atomic.StoreInt64(&t.czData.lastMsgSentTime, time.Now().UnixNano())
+}
+
+func (t *http2Client) IncrMsgRecv() {
+	atomic.AddInt64(&t.czData.msgRecv, 1)
+	atomic.StoreInt64(&t.czData.lastMsgRecvTime, time.Now().UnixNano())
+}
+
+func (t *http2Client) getOutFlowWindow() int64 {
+	resp := make(chan uint32, 1)
+	timer := time.NewTimer(time.Second)
+	defer timer.Stop()
+	t.controlBuf.put(&outFlowControlSizeRequest{resp})
+	select {
+	case sz := <-resp:
+		return int64(sz)
+	case <-t.ctxDone:
+		return -1
+	case <-timer.C:
+		return -2
+	}
+}
+
+func (t *http2Client) stateForTesting() transportState {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.state
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
new file mode 100644
index 0000000000..4b406b8cb0
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
@@ -0,0 +1,1469 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"net/http"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
+	"google.golang.org/grpc/internal/grpclog"
+	"google.golang.org/grpc/internal/grpcutil"
+	"google.golang.org/grpc/internal/pretty"
+	"google.golang.org/grpc/internal/syscall"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/grpcrand"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/tap"
+)
+
+var (
+	// ErrIllegalHeaderWrite indicates that setting header is illegal because of
+	// the stream's state.
+	ErrIllegalHeaderWrite = status.Error(codes.Internal, "transport: SendHeader called multiple times")
+	// ErrHeaderListSizeLimitViolation indicates that the header list size is larger
+	// than the limit set by peer.
+	ErrHeaderListSizeLimitViolation = status.Error(codes.Internal, "transport: trying to send header list size larger than the limit set by peer")
+)
+
+// serverConnectionCounter counts the number of connections a server has seen
+// (equal to the number of http2Servers created). Must be accessed atomically.
+var serverConnectionCounter uint64
+
+// http2Server implements the ServerTransport interface with HTTP2.
+type http2Server struct {
+	lastRead    int64 // Keep this field 64-bit aligned. Accessed atomically.
+	ctx         context.Context
+	done        chan struct{}
+	conn        net.Conn
+	loopy       *loopyWriter
+	readerDone  chan struct{} // sync point to enable testing.
+	writerDone  chan struct{} // sync point to enable testing.
+	remoteAddr  net.Addr
+	localAddr   net.Addr
+	authInfo    credentials.AuthInfo // auth info about the connection
+	inTapHandle tap.ServerInHandle
+	framer      *framer
+	// The max number of concurrent streams.
+	maxStreams uint32
+	// controlBuf delivers all the control related tasks (e.g., window
+	// updates, reset streams, and various settings) to the controller.
+	controlBuf *controlBuffer
+	fc         *trInFlow
+	stats      []stats.Handler
+	// Keepalive and max-age parameters for the server.
+	kp keepalive.ServerParameters
+	// Keepalive enforcement policy.
+	kep keepalive.EnforcementPolicy
+	// The time instance last ping was received.
+	lastPingAt time.Time
+	// Number of times the client has violated keepalive ping policy so far.
+	pingStrikes uint8
+	// Flag to signify that number of ping strikes should be reset to 0.
+	// This is set whenever data or header frames are sent.
+	// 1 means yes.
+	resetPingStrikes      uint32 // Accessed atomically.
+	initialWindowSize     int32
+	bdpEst                *bdpEstimator
+	maxSendHeaderListSize *uint32
+
+	mu sync.Mutex // guard the following
+
+	// drainEvent is initialized when Drain() is called the first time. After
+	// which the server writes out the first GoAway(with ID 2^31-1) frame. Then
+	// an independent goroutine will be launched to later send the second
+	// GoAway. During this time we don't want to write another first GoAway(with
+	// ID 2^31 -1) frame. Thus call to Drain() will be a no-op if drainEvent is
+	// already initialized since draining is already underway.
+	drainEvent    *grpcsync.Event
+	state         transportState
+	activeStreams map[uint32]*Stream
+	// idle is the time instant when the connection went idle.
+	// This is either the beginning of the connection or when the number of
+	// RPCs go down to 0.
+	// When the connection is busy, this value is set to 0.
+	idle time.Time
+
+	// Fields below are for channelz metric collection.
+	channelzID *channelz.Identifier
+	czData     *channelzData
+	bufferPool *bufferPool
+
+	connectionID uint64
+
+	// maxStreamMu guards the maximum stream ID
+	// This lock may not be taken if mu is already held.
+	maxStreamMu sync.Mutex
+	maxStreamID uint32 // max stream ID ever seen
+
+	logger *grpclog.PrefixLogger
+}
+
+// NewServerTransport creates a http2 transport with conn and configuration
+// options from config.
+//
+// It returns a non-nil transport and a nil error on success. On failure, it
+// returns a nil transport and a non-nil error. For a special case where the
+// underlying conn gets closed before the client preface could be read, it
+// returns a nil transport and a nil error.
+func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport, err error) {
+	var authInfo credentials.AuthInfo
+	rawConn := conn
+	if config.Credentials != nil {
+		var err error
+		conn, authInfo, err = config.Credentials.ServerHandshake(rawConn)
+		if err != nil {
+			// ErrConnDispatched means that the connection was dispatched away
+			// from gRPC; those connections should be left open. io.EOF means
+			// the connection was closed before handshaking completed, which can
+			// happen naturally from probers. Return these errors directly.
+			if err == credentials.ErrConnDispatched || err == io.EOF {
+				return nil, err
+			}
+			return nil, connectionErrorf(false, err, "ServerHandshake(%q) failed: %v", rawConn.RemoteAddr(), err)
+		}
+	}
+	writeBufSize := config.WriteBufferSize
+	readBufSize := config.ReadBufferSize
+	maxHeaderListSize := defaultServerMaxHeaderListSize
+	if config.MaxHeaderListSize != nil {
+		maxHeaderListSize = *config.MaxHeaderListSize
+	}
+	framer := newFramer(conn, writeBufSize, readBufSize, maxHeaderListSize)
+	// Send initial settings as connection preface to client.
+	isettings := []http2.Setting{{
+		ID:  http2.SettingMaxFrameSize,
+		Val: http2MaxFrameLen,
+	}}
+	// TODO(zhaoq): Have a better way to signal "no limit" because 0 is
+	// permitted in the HTTP2 spec.
+	maxStreams := config.MaxStreams
+	if maxStreams == 0 {
+		maxStreams = math.MaxUint32
+	} else {
+		isettings = append(isettings, http2.Setting{
+			ID:  http2.SettingMaxConcurrentStreams,
+			Val: maxStreams,
+		})
+	}
+	dynamicWindow := true
+	iwz := int32(initialWindowSize)
+	if config.InitialWindowSize >= defaultWindowSize {
+		iwz = config.InitialWindowSize
+		dynamicWindow = false
+	}
+	icwz := int32(initialWindowSize)
+	if config.InitialConnWindowSize >= defaultWindowSize {
+		icwz = config.InitialConnWindowSize
+		dynamicWindow = false
+	}
+	if iwz != defaultWindowSize {
+		isettings = append(isettings, http2.Setting{
+			ID:  http2.SettingInitialWindowSize,
+			Val: uint32(iwz)})
+	}
+	if config.MaxHeaderListSize != nil {
+		isettings = append(isettings, http2.Setting{
+			ID:  http2.SettingMaxHeaderListSize,
+			Val: *config.MaxHeaderListSize,
+		})
+	}
+	if config.HeaderTableSize != nil {
+		isettings = append(isettings, http2.Setting{
+			ID:  http2.SettingHeaderTableSize,
+			Val: *config.HeaderTableSize,
+		})
+	}
+	if err := framer.fr.WriteSettings(isettings...); err != nil {
+		return nil, connectionErrorf(false, err, "transport: %v", err)
+	}
+	// Adjust the connection flow control window if needed.
+	if delta := uint32(icwz - defaultWindowSize); delta > 0 {
+		if err := framer.fr.WriteWindowUpdate(0, delta); err != nil {
+			return nil, connectionErrorf(false, err, "transport: %v", err)
+		}
+	}
+	kp := config.KeepaliveParams
+	if kp.MaxConnectionIdle == 0 {
+		kp.MaxConnectionIdle = defaultMaxConnectionIdle
+	}
+	if kp.MaxConnectionAge == 0 {
+		kp.MaxConnectionAge = defaultMaxConnectionAge
+	}
+	// Add a jitter to MaxConnectionAge.
+	kp.MaxConnectionAge += getJitter(kp.MaxConnectionAge)
+	if kp.MaxConnectionAgeGrace == 0 {
+		kp.MaxConnectionAgeGrace = defaultMaxConnectionAgeGrace
+	}
+	if kp.Time == 0 {
+		kp.Time = defaultServerKeepaliveTime
+	}
+	if kp.Timeout == 0 {
+		kp.Timeout = defaultServerKeepaliveTimeout
+	}
+	if kp.Time != infinity {
+		if err = syscall.SetTCPUserTimeout(conn, kp.Timeout); err != nil {
+			return nil, connectionErrorf(false, err, "transport: failed to set TCP_USER_TIMEOUT: %v", err)
+		}
+	}
+	kep := config.KeepalivePolicy
+	if kep.MinTime == 0 {
+		kep.MinTime = defaultKeepalivePolicyMinTime
+	}
+
+	done := make(chan struct{})
+	t := &http2Server{
+		ctx:               setConnection(context.Background(), rawConn),
+		done:              done,
+		conn:              conn,
+		remoteAddr:        conn.RemoteAddr(),
+		localAddr:         conn.LocalAddr(),
+		authInfo:          authInfo,
+		framer:            framer,
+		readerDone:        make(chan struct{}),
+		writerDone:        make(chan struct{}),
+		maxStreams:        maxStreams,
+		inTapHandle:       config.InTapHandle,
+		fc:                &trInFlow{limit: uint32(icwz)},
+		state:             reachable,
+		activeStreams:     make(map[uint32]*Stream),
+		stats:             config.StatsHandlers,
+		kp:                kp,
+		idle:              time.Now(),
+		kep:               kep,
+		initialWindowSize: iwz,
+		czData:            new(channelzData),
+		bufferPool:        newBufferPool(),
+	}
+	t.logger = prefixLoggerForServerTransport(t)
+	// Add peer information to the http2server context.
+	t.ctx = peer.NewContext(t.ctx, t.getPeer())
+
+	t.controlBuf = newControlBuffer(t.done)
+	if dynamicWindow {
+		t.bdpEst = &bdpEstimator{
+			bdp:               initialWindowSize,
+			updateFlowControl: t.updateFlowControl,
+		}
+	}
+	for _, sh := range t.stats {
+		t.ctx = sh.TagConn(t.ctx, &stats.ConnTagInfo{
+			RemoteAddr: t.remoteAddr,
+			LocalAddr:  t.localAddr,
+		})
+		connBegin := &stats.ConnBegin{}
+		sh.HandleConn(t.ctx, connBegin)
+	}
+	t.channelzID, err = channelz.RegisterNormalSocket(t, config.ChannelzParentID, fmt.Sprintf("%s -> %s", t.remoteAddr, t.localAddr))
+	if err != nil {
+		return nil, err
+	}
+
+	t.connectionID = atomic.AddUint64(&serverConnectionCounter, 1)
+	t.framer.writer.Flush()
+
+	defer func() {
+		if err != nil {
+			t.Close(err)
+		}
+	}()
+
+	// Check the validity of client preface.
+	preface := make([]byte, len(clientPreface))
+	if _, err := io.ReadFull(t.conn, preface); err != nil {
+		// In deployments where a gRPC server runs behind a cloud load balancer
+		// which performs regular TCP level health checks, the connection is
+		// closed immediately by the latter.  Returning io.EOF here allows the
+		// grpc server implementation to recognize this scenario and suppress
+		// logging to reduce spam.
+		if err == io.EOF {
+			return nil, io.EOF
+		}
+		return nil, connectionErrorf(false, err, "transport: http2Server.HandleStreams failed to receive the preface from client: %v", err)
+	}
+	if !bytes.Equal(preface, clientPreface) {
+		return nil, connectionErrorf(false, nil, "transport: http2Server.HandleStreams received bogus greeting from client: %q", preface)
+	}
+
+	frame, err := t.framer.fr.ReadFrame()
+	if err == io.EOF || err == io.ErrUnexpectedEOF {
+		return nil, err
+	}
+	if err != nil {
+		return nil, connectionErrorf(false, err, "transport: http2Server.HandleStreams failed to read initial settings frame: %v", err)
+	}
+	atomic.StoreInt64(&t.lastRead, time.Now().UnixNano())
+	sf, ok := frame.(*http2.SettingsFrame)
+	if !ok {
+		return nil, connectionErrorf(false, nil, "transport: http2Server.HandleStreams saw invalid preface type %T from client", frame)
+	}
+	t.handleSettings(sf)
+
+	go func() {
+		t.loopy = newLoopyWriter(serverSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger)
+		t.loopy.ssGoAwayHandler = t.outgoingGoAwayHandler
+		t.loopy.run()
+		close(t.writerDone)
+	}()
+	go t.keepalive()
+	return t, nil
+}
+
+// operateHeaders takes action on the decoded headers. Returns an error if fatal
+// error encountered and transport needs to close, otherwise returns nil.
+func (t *http2Server) operateHeaders(frame *http2.MetaHeadersFrame, handle func(*Stream), traceCtx func(context.Context, string) context.Context) error {
+	// Acquire max stream ID lock for entire duration
+	t.maxStreamMu.Lock()
+	defer t.maxStreamMu.Unlock()
+
+	streamID := frame.Header().StreamID
+
+	// frame.Truncated is set to true when framer detects that the current header
+	// list size hits MaxHeaderListSize limit.
+	if frame.Truncated {
+		t.controlBuf.put(&cleanupStream{
+			streamID: streamID,
+			rst:      true,
+			rstCode:  http2.ErrCodeFrameSize,
+			onWrite:  func() {},
+		})
+		return nil
+	}
+
+	if streamID%2 != 1 || streamID <= t.maxStreamID {
+		// illegal gRPC stream id.
+		return fmt.Errorf("received an illegal stream id: %v. headers frame: %+v", streamID, frame)
+	}
+	t.maxStreamID = streamID
+
+	buf := newRecvBuffer()
+	s := &Stream{
+		id:  streamID,
+		st:  t,
+		buf: buf,
+		fc:  &inFlow{limit: uint32(t.initialWindowSize)},
+	}
+	var (
+		// if false, content-type was missing or invalid
+		isGRPC      = false
+		contentType = ""
+		mdata       = make(metadata.MD, len(frame.Fields))
+		httpMethod  string
+		// these are set if an error is encountered while parsing the headers
+		protocolError bool
+		headerError   *status.Status
+
+		timeoutSet bool
+		timeout    time.Duration
+	)
+
+	for _, hf := range frame.Fields {
+		switch hf.Name {
+		case "content-type":
+			contentSubtype, validContentType := grpcutil.ContentSubtype(hf.Value)
+			if !validContentType {
+				contentType = hf.Value
+				break
+			}
+			mdata[hf.Name] = append(mdata[hf.Name], hf.Value)
+			s.contentSubtype = contentSubtype
+			isGRPC = true
+
+		case "grpc-accept-encoding":
+			mdata[hf.Name] = append(mdata[hf.Name], hf.Value)
+			if hf.Value == "" {
+				continue
+			}
+			compressors := hf.Value
+			if s.clientAdvertisedCompressors != "" {
+				compressors = s.clientAdvertisedCompressors + "," + compressors
+			}
+			s.clientAdvertisedCompressors = compressors
+		case "grpc-encoding":
+			s.recvCompress = hf.Value
+		case ":method":
+			httpMethod = hf.Value
+		case ":path":
+			s.method = hf.Value
+		case "grpc-timeout":
+			timeoutSet = true
+			var err error
+			if timeout, err = decodeTimeout(hf.Value); err != nil {
+				headerError = status.Newf(codes.Internal, "malformed grpc-timeout: %v", err)
+			}
+		// "Transports must consider requests containing the Connection header
+		// as malformed." - A41
+		case "connection":
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Received a HEADERS frame with a :connection header which makes the request malformed, as per the HTTP/2 spec")
+			}
+			protocolError = true
+		default:
+			if isReservedHeader(hf.Name) && !isWhitelistedHeader(hf.Name) {
+				break
+			}
+			v, err := decodeMetadataHeader(hf.Name, hf.Value)
+			if err != nil {
+				headerError = status.Newf(codes.Internal, "malformed binary metadata %q in header %q: %v", hf.Value, hf.Name, err)
+				t.logger.Warningf("Failed to decode metadata header (%q, %q): %v", hf.Name, hf.Value, err)
+				break
+			}
+			mdata[hf.Name] = append(mdata[hf.Name], v)
+		}
+	}
+
+	// "If multiple Host headers or multiple :authority headers are present, the
+	// request must be rejected with an HTTP status code 400 as required by Host
+	// validation in RFC 7230 §5.4, gRPC status code INTERNAL, or RST_STREAM
+	// with HTTP/2 error code PROTOCOL_ERROR." - A41. Since this is a HTTP/2
+	// error, this takes precedence over a client not speaking gRPC.
+	if len(mdata[":authority"]) > 1 || len(mdata["host"]) > 1 {
+		errMsg := fmt.Sprintf("num values of :authority: %v, num values of host: %v, both must only have 1 value as per HTTP/2 spec", len(mdata[":authority"]), len(mdata["host"]))
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Aborting the stream early: %v", errMsg)
+		}
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     http.StatusBadRequest,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         status.New(codes.Internal, errMsg),
+			rst:            !frame.StreamEnded(),
+		})
+		return nil
+	}
+
+	if protocolError {
+		t.controlBuf.put(&cleanupStream{
+			streamID: streamID,
+			rst:      true,
+			rstCode:  http2.ErrCodeProtocol,
+			onWrite:  func() {},
+		})
+		return nil
+	}
+	if !isGRPC {
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     http.StatusUnsupportedMediaType,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         status.Newf(codes.InvalidArgument, "invalid gRPC request content-type %q", contentType),
+			rst:            !frame.StreamEnded(),
+		})
+		return nil
+	}
+	if headerError != nil {
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     http.StatusBadRequest,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         headerError,
+			rst:            !frame.StreamEnded(),
+		})
+		return nil
+	}
+
+	// "If :authority is missing, Host must be renamed to :authority." - A41
+	if len(mdata[":authority"]) == 0 {
+		// No-op if host isn't present, no eventual :authority header is a valid
+		// RPC.
+		if host, ok := mdata["host"]; ok {
+			mdata[":authority"] = host
+			delete(mdata, "host")
+		}
+	} else {
+		// "If :authority is present, Host must be discarded" - A41
+		delete(mdata, "host")
+	}
+
+	if frame.StreamEnded() {
+		// s is just created by the caller. No lock needed.
+		s.state = streamReadDone
+	}
+	if timeoutSet {
+		s.ctx, s.cancel = context.WithTimeout(t.ctx, timeout)
+	} else {
+		s.ctx, s.cancel = context.WithCancel(t.ctx)
+	}
+
+	// Attach the received metadata to the context.
+	if len(mdata) > 0 {
+		s.ctx = metadata.NewIncomingContext(s.ctx, mdata)
+		if statsTags := mdata["grpc-tags-bin"]; len(statsTags) > 0 {
+			s.ctx = stats.SetIncomingTags(s.ctx, []byte(statsTags[len(statsTags)-1]))
+		}
+		if statsTrace := mdata["grpc-trace-bin"]; len(statsTrace) > 0 {
+			s.ctx = stats.SetIncomingTrace(s.ctx, []byte(statsTrace[len(statsTrace)-1]))
+		}
+	}
+	t.mu.Lock()
+	if t.state != reachable {
+		t.mu.Unlock()
+		s.cancel()
+		return nil
+	}
+	if uint32(len(t.activeStreams)) >= t.maxStreams {
+		t.mu.Unlock()
+		t.controlBuf.put(&cleanupStream{
+			streamID: streamID,
+			rst:      true,
+			rstCode:  http2.ErrCodeRefusedStream,
+			onWrite:  func() {},
+		})
+		s.cancel()
+		return nil
+	}
+	if httpMethod != http.MethodPost {
+		t.mu.Unlock()
+		errMsg := fmt.Sprintf("Received a HEADERS frame with :method %q which should be POST", httpMethod)
+		if t.logger.V(logLevel) {
+			t.logger.Infof("Aborting the stream early: %v", errMsg)
+		}
+		t.controlBuf.put(&earlyAbortStream{
+			httpStatus:     405,
+			streamID:       streamID,
+			contentSubtype: s.contentSubtype,
+			status:         status.New(codes.Internal, errMsg),
+			rst:            !frame.StreamEnded(),
+		})
+		s.cancel()
+		return nil
+	}
+	if t.inTapHandle != nil {
+		var err error
+		if s.ctx, err = t.inTapHandle(s.ctx, &tap.Info{FullMethodName: s.method}); err != nil {
+			t.mu.Unlock()
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Aborting the stream early due to InTapHandle failure: %v", err)
+			}
+			stat, ok := status.FromError(err)
+			if !ok {
+				stat = status.New(codes.PermissionDenied, err.Error())
+			}
+			t.controlBuf.put(&earlyAbortStream{
+				httpStatus:     200,
+				streamID:       s.id,
+				contentSubtype: s.contentSubtype,
+				status:         stat,
+				rst:            !frame.StreamEnded(),
+			})
+			return nil
+		}
+	}
+	t.activeStreams[streamID] = s
+	if len(t.activeStreams) == 1 {
+		t.idle = time.Time{}
+	}
+	t.mu.Unlock()
+	if channelz.IsOn() {
+		atomic.AddInt64(&t.czData.streamsStarted, 1)
+		atomic.StoreInt64(&t.czData.lastStreamCreatedTime, time.Now().UnixNano())
+	}
+	s.requestRead = func(n int) {
+		t.adjustWindow(s, uint32(n))
+	}
+	s.ctx = traceCtx(s.ctx, s.method)
+	for _, sh := range t.stats {
+		s.ctx = sh.TagRPC(s.ctx, &stats.RPCTagInfo{FullMethodName: s.method})
+		inHeader := &stats.InHeader{
+			FullMethod:  s.method,
+			RemoteAddr:  t.remoteAddr,
+			LocalAddr:   t.localAddr,
+			Compression: s.recvCompress,
+			WireLength:  int(frame.Header().Length),
+			Header:      mdata.Copy(),
+		}
+		sh.HandleRPC(s.ctx, inHeader)
+	}
+	s.ctxDone = s.ctx.Done()
+	s.wq = newWriteQuota(defaultWriteQuota, s.ctxDone)
+	s.trReader = &transportReader{
+		reader: &recvBufferReader{
+			ctx:        s.ctx,
+			ctxDone:    s.ctxDone,
+			recv:       s.buf,
+			freeBuffer: t.bufferPool.put,
+		},
+		windowHandler: func(n int) {
+			t.updateWindow(s, uint32(n))
+		},
+	}
+	// Register the stream with loopy.
+	t.controlBuf.put(&registerStream{
+		streamID: s.id,
+		wq:       s.wq,
+	})
+	handle(s)
+	return nil
+}
+
+// HandleStreams receives incoming streams using the given handler. This is
+// typically run in a separate goroutine.
+// traceCtx attaches trace to ctx and returns the new context.
+func (t *http2Server) HandleStreams(handle func(*Stream), traceCtx func(context.Context, string) context.Context) {
+	defer close(t.readerDone)
+	for {
+		t.controlBuf.throttle()
+		frame, err := t.framer.fr.ReadFrame()
+		atomic.StoreInt64(&t.lastRead, time.Now().UnixNano())
+		if err != nil {
+			if se, ok := err.(http2.StreamError); ok {
+				if t.logger.V(logLevel) {
+					t.logger.Warningf("Encountered http2.StreamError: %v", se)
+				}
+				t.mu.Lock()
+				s := t.activeStreams[se.StreamID]
+				t.mu.Unlock()
+				if s != nil {
+					t.closeStream(s, true, se.Code, false)
+				} else {
+					t.controlBuf.put(&cleanupStream{
+						streamID: se.StreamID,
+						rst:      true,
+						rstCode:  se.Code,
+						onWrite:  func() {},
+					})
+				}
+				continue
+			}
+			if err == io.EOF || err == io.ErrUnexpectedEOF {
+				t.Close(err)
+				return
+			}
+			t.Close(err)
+			return
+		}
+		switch frame := frame.(type) {
+		case *http2.MetaHeadersFrame:
+			if err := t.operateHeaders(frame, handle, traceCtx); err != nil {
+				t.Close(err)
+				break
+			}
+		case *http2.DataFrame:
+			t.handleData(frame)
+		case *http2.RSTStreamFrame:
+			t.handleRSTStream(frame)
+		case *http2.SettingsFrame:
+			t.handleSettings(frame)
+		case *http2.PingFrame:
+			t.handlePing(frame)
+		case *http2.WindowUpdateFrame:
+			t.handleWindowUpdate(frame)
+		case *http2.GoAwayFrame:
+			// TODO: Handle GoAway from the client appropriately.
+		default:
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Received unsupported frame type %T", frame)
+			}
+		}
+	}
+}
+
+func (t *http2Server) getStream(f http2.Frame) (*Stream, bool) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if t.activeStreams == nil {
+		// The transport is closing.
+		return nil, false
+	}
+	s, ok := t.activeStreams[f.Header().StreamID]
+	if !ok {
+		// The stream is already done.
+		return nil, false
+	}
+	return s, true
+}
+
+// adjustWindow sends out extra window update over the initial window size
+// of stream if the application is requesting data larger in size than
+// the window.
+func (t *http2Server) adjustWindow(s *Stream, n uint32) {
+	if w := s.fc.maybeAdjust(n); w > 0 {
+		t.controlBuf.put(&outgoingWindowUpdate{streamID: s.id, increment: w})
+	}
+
+}
+
+// updateWindow adjusts the inbound quota for the stream and the transport.
+// Window updates will deliver to the controller for sending when
+// the cumulative quota exceeds the corresponding threshold.
+func (t *http2Server) updateWindow(s *Stream, n uint32) {
+	if w := s.fc.onRead(n); w > 0 {
+		t.controlBuf.put(&outgoingWindowUpdate{streamID: s.id,
+			increment: w,
+		})
+	}
+}
+
+// updateFlowControl updates the incoming flow control windows
+// for the transport and the stream based on the current bdp
+// estimation.
+func (t *http2Server) updateFlowControl(n uint32) {
+	t.mu.Lock()
+	for _, s := range t.activeStreams {
+		s.fc.newLimit(n)
+	}
+	t.initialWindowSize = int32(n)
+	t.mu.Unlock()
+	t.controlBuf.put(&outgoingWindowUpdate{
+		streamID:  0,
+		increment: t.fc.newLimit(n),
+	})
+	t.controlBuf.put(&outgoingSettings{
+		ss: []http2.Setting{
+			{
+				ID:  http2.SettingInitialWindowSize,
+				Val: n,
+			},
+		},
+	})
+
+}
+
+func (t *http2Server) handleData(f *http2.DataFrame) {
+	size := f.Header().Length
+	var sendBDPPing bool
+	if t.bdpEst != nil {
+		sendBDPPing = t.bdpEst.add(size)
+	}
+	// Decouple connection's flow control from application's read.
+	// An update on connection's flow control should not depend on
+	// whether user application has read the data or not. Such a
+	// restriction is already imposed on the stream's flow control,
+	// and therefore the sender will be blocked anyways.
+	// Decoupling the connection flow control will prevent other
+	// active(fast) streams from starving in presence of slow or
+	// inactive streams.
+	if w := t.fc.onData(size); w > 0 {
+		t.controlBuf.put(&outgoingWindowUpdate{
+			streamID:  0,
+			increment: w,
+		})
+	}
+	if sendBDPPing {
+		// Avoid excessive ping detection (e.g. in an L7 proxy)
+		// by sending a window update prior to the BDP ping.
+		if w := t.fc.reset(); w > 0 {
+			t.controlBuf.put(&outgoingWindowUpdate{
+				streamID:  0,
+				increment: w,
+			})
+		}
+		t.controlBuf.put(bdpPing)
+	}
+	// Select the right stream to dispatch.
+	s, ok := t.getStream(f)
+	if !ok {
+		return
+	}
+	if s.getState() == streamReadDone {
+		t.closeStream(s, true, http2.ErrCodeStreamClosed, false)
+		return
+	}
+	if size > 0 {
+		if err := s.fc.onData(size); err != nil {
+			t.closeStream(s, true, http2.ErrCodeFlowControl, false)
+			return
+		}
+		if f.Header().Flags.Has(http2.FlagDataPadded) {
+			if w := s.fc.onRead(size - uint32(len(f.Data()))); w > 0 {
+				t.controlBuf.put(&outgoingWindowUpdate{s.id, w})
+			}
+		}
+		// TODO(bradfitz, zhaoq): A copy is required here because there is no
+		// guarantee f.Data() is consumed before the arrival of next frame.
+		// Can this copy be eliminated?
+		if len(f.Data()) > 0 {
+			buffer := t.bufferPool.get()
+			buffer.Reset()
+			buffer.Write(f.Data())
+			s.write(recvMsg{buffer: buffer})
+		}
+	}
+	if f.StreamEnded() {
+		// Received the end of stream from the client.
+		s.compareAndSwapState(streamActive, streamReadDone)
+		s.write(recvMsg{err: io.EOF})
+	}
+}
+
+func (t *http2Server) handleRSTStream(f *http2.RSTStreamFrame) {
+	// If the stream is not deleted from the transport's active streams map, then do a regular close stream.
+	if s, ok := t.getStream(f); ok {
+		t.closeStream(s, false, 0, false)
+		return
+	}
+	// If the stream is already deleted from the active streams map, then put a cleanupStream item into controlbuf to delete the stream from loopy writer's established streams map.
+	t.controlBuf.put(&cleanupStream{
+		streamID: f.Header().StreamID,
+		rst:      false,
+		rstCode:  0,
+		onWrite:  func() {},
+	})
+}
+
+func (t *http2Server) handleSettings(f *http2.SettingsFrame) {
+	if f.IsAck() {
+		return
+	}
+	var ss []http2.Setting
+	var updateFuncs []func()
+	f.ForeachSetting(func(s http2.Setting) error {
+		switch s.ID {
+		case http2.SettingMaxHeaderListSize:
+			updateFuncs = append(updateFuncs, func() {
+				t.maxSendHeaderListSize = new(uint32)
+				*t.maxSendHeaderListSize = s.Val
+			})
+		default:
+			ss = append(ss, s)
+		}
+		return nil
+	})
+	t.controlBuf.executeAndPut(func(interface{}) bool {
+		for _, f := range updateFuncs {
+			f()
+		}
+		return true
+	}, &incomingSettings{
+		ss: ss,
+	})
+}
+
+const (
+	maxPingStrikes     = 2
+	defaultPingTimeout = 2 * time.Hour
+)
+
+func (t *http2Server) handlePing(f *http2.PingFrame) {
+	if f.IsAck() {
+		if f.Data == goAwayPing.data && t.drainEvent != nil {
+			t.drainEvent.Fire()
+			return
+		}
+		// Maybe it's a BDP ping.
+		if t.bdpEst != nil {
+			t.bdpEst.calculate(f.Data)
+		}
+		return
+	}
+	pingAck := &ping{ack: true}
+	copy(pingAck.data[:], f.Data[:])
+	t.controlBuf.put(pingAck)
+
+	now := time.Now()
+	defer func() {
+		t.lastPingAt = now
+	}()
+	// A reset ping strikes means that we don't need to check for policy
+	// violation for this ping and the pingStrikes counter should be set
+	// to 0.
+	if atomic.CompareAndSwapUint32(&t.resetPingStrikes, 1, 0) {
+		t.pingStrikes = 0
+		return
+	}
+	t.mu.Lock()
+	ns := len(t.activeStreams)
+	t.mu.Unlock()
+	if ns < 1 && !t.kep.PermitWithoutStream {
+		// Keepalive shouldn't be active thus, this new ping should
+		// have come after at least defaultPingTimeout.
+		if t.lastPingAt.Add(defaultPingTimeout).After(now) {
+			t.pingStrikes++
+		}
+	} else {
+		// Check if keepalive policy is respected.
+		if t.lastPingAt.Add(t.kep.MinTime).After(now) {
+			t.pingStrikes++
+		}
+	}
+
+	if t.pingStrikes > maxPingStrikes {
+		// Send goaway and close the connection.
+		t.controlBuf.put(&goAway{code: http2.ErrCodeEnhanceYourCalm, debugData: []byte("too_many_pings"), closeConn: errors.New("got too many pings from the client")})
+	}
+}
+
+func (t *http2Server) handleWindowUpdate(f *http2.WindowUpdateFrame) {
+	t.controlBuf.put(&incomingWindowUpdate{
+		streamID:  f.Header().StreamID,
+		increment: f.Increment,
+	})
+}
+
+func appendHeaderFieldsFromMD(headerFields []hpack.HeaderField, md metadata.MD) []hpack.HeaderField {
+	for k, vv := range md {
+		if isReservedHeader(k) {
+			// Clients don't tolerate reading restricted headers after some non restricted ones were sent.
+			continue
+		}
+		for _, v := range vv {
+			headerFields = append(headerFields, hpack.HeaderField{Name: k, Value: encodeMetadataHeader(k, v)})
+		}
+	}
+	return headerFields
+}
+
+func (t *http2Server) checkForHeaderListSize(it interface{}) bool {
+	if t.maxSendHeaderListSize == nil {
+		return true
+	}
+	hdrFrame := it.(*headerFrame)
+	var sz int64
+	for _, f := range hdrFrame.hf {
+		if sz += int64(f.Size()); sz > int64(*t.maxSendHeaderListSize) {
+			if t.logger.V(logLevel) {
+				t.logger.Infof("Header list size to send violates the maximum size (%d bytes) set by client", *t.maxSendHeaderListSize)
+			}
+			return false
+		}
+	}
+	return true
+}
+
+func (t *http2Server) streamContextErr(s *Stream) error {
+	select {
+	case <-t.done:
+		return ErrConnClosing
+	default:
+	}
+	return ContextErr(s.ctx.Err())
+}
+
+// WriteHeader sends the header metadata md back to the client.
+func (t *http2Server) WriteHeader(s *Stream, md metadata.MD) error {
+	s.hdrMu.Lock()
+	defer s.hdrMu.Unlock()
+	if s.getState() == streamDone {
+		return t.streamContextErr(s)
+	}
+
+	if s.updateHeaderSent() {
+		return ErrIllegalHeaderWrite
+	}
+
+	if md.Len() > 0 {
+		if s.header.Len() > 0 {
+			s.header = metadata.Join(s.header, md)
+		} else {
+			s.header = md
+		}
+	}
+	if err := t.writeHeaderLocked(s); err != nil {
+		return status.Convert(err).Err()
+	}
+	return nil
+}
+
+func (t *http2Server) setResetPingStrikes() {
+	atomic.StoreUint32(&t.resetPingStrikes, 1)
+}
+
+func (t *http2Server) writeHeaderLocked(s *Stream) error {
+	// TODO(mmukhi): Benchmark if the performance gets better if count the metadata and other header fields
+	// first and create a slice of that exact size.
+	headerFields := make([]hpack.HeaderField, 0, 2) // at least :status, content-type will be there if none else.
+	headerFields = append(headerFields, hpack.HeaderField{Name: ":status", Value: "200"})
+	headerFields = append(headerFields, hpack.HeaderField{Name: "content-type", Value: grpcutil.ContentType(s.contentSubtype)})
+	if s.sendCompress != "" {
+		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-encoding", Value: s.sendCompress})
+	}
+	headerFields = appendHeaderFieldsFromMD(headerFields, s.header)
+	success, err := t.controlBuf.executeAndPut(t.checkForHeaderListSize, &headerFrame{
+		streamID:  s.id,
+		hf:        headerFields,
+		endStream: false,
+		onWrite:   t.setResetPingStrikes,
+	})
+	if !success {
+		if err != nil {
+			return err
+		}
+		t.closeStream(s, true, http2.ErrCodeInternal, false)
+		return ErrHeaderListSizeLimitViolation
+	}
+	for _, sh := range t.stats {
+		// Note: Headers are compressed with hpack after this call returns.
+		// No WireLength field is set here.
+		outHeader := &stats.OutHeader{
+			Header:      s.header.Copy(),
+			Compression: s.sendCompress,
+		}
+		sh.HandleRPC(s.Context(), outHeader)
+	}
+	return nil
+}
+
+// WriteStatus sends stream status to the client and terminates the stream.
+// There is no further I/O operations being able to perform on this stream.
+// TODO(zhaoq): Now it indicates the end of entire stream. Revisit if early
+// OK is adopted.
+func (t *http2Server) WriteStatus(s *Stream, st *status.Status) error {
+	s.hdrMu.Lock()
+	defer s.hdrMu.Unlock()
+
+	if s.getState() == streamDone {
+		return nil
+	}
+
+	// TODO(mmukhi): Benchmark if the performance gets better if count the metadata and other header fields
+	// first and create a slice of that exact size.
+	headerFields := make([]hpack.HeaderField, 0, 2) // grpc-status and grpc-message will be there if none else.
+	if !s.updateHeaderSent() {                      // No headers have been sent.
+		if len(s.header) > 0 { // Send a separate header frame.
+			if err := t.writeHeaderLocked(s); err != nil {
+				return err
+			}
+		} else { // Send a trailer only response.
+			headerFields = append(headerFields, hpack.HeaderField{Name: ":status", Value: "200"})
+			headerFields = append(headerFields, hpack.HeaderField{Name: "content-type", Value: grpcutil.ContentType(s.contentSubtype)})
+		}
+	}
+	headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-status", Value: strconv.Itoa(int(st.Code()))})
+	headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-message", Value: encodeGrpcMessage(st.Message())})
+
+	if p := st.Proto(); p != nil && len(p.Details) > 0 {
+		stBytes, err := proto.Marshal(p)
+		if err != nil {
+			// TODO: return error instead, when callers are able to handle it.
+			t.logger.Errorf("Failed to marshal rpc status: %s, error: %v", pretty.ToJSON(p), err)
+		} else {
+			headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-status-details-bin", Value: encodeBinHeader(stBytes)})
+		}
+	}
+
+	// Attach the trailer metadata.
+	headerFields = appendHeaderFieldsFromMD(headerFields, s.trailer)
+	trailingHeader := &headerFrame{
+		streamID:  s.id,
+		hf:        headerFields,
+		endStream: true,
+		onWrite:   t.setResetPingStrikes,
+	}
+
+	success, err := t.controlBuf.execute(t.checkForHeaderListSize, trailingHeader)
+	if !success {
+		if err != nil {
+			return err
+		}
+		t.closeStream(s, true, http2.ErrCodeInternal, false)
+		return ErrHeaderListSizeLimitViolation
+	}
+	// Send a RST_STREAM after the trailers if the client has not already half-closed.
+	rst := s.getState() == streamActive
+	t.finishStream(s, rst, http2.ErrCodeNo, trailingHeader, true)
+	for _, sh := range t.stats {
+		// Note: The trailer fields are compressed with hpack after this call returns.
+		// No WireLength field is set here.
+		sh.HandleRPC(s.Context(), &stats.OutTrailer{
+			Trailer: s.trailer.Copy(),
+		})
+	}
+	return nil
+}
+
+// Write converts the data into HTTP2 data frame and sends it out. Non-nil error
+// is returns if it fails (e.g., framing error, transport error).
+func (t *http2Server) Write(s *Stream, hdr []byte, data []byte, opts *Options) error {
+	if !s.isHeaderSent() { // Headers haven't been written yet.
+		if err := t.WriteHeader(s, nil); err != nil {
+			return err
+		}
+	} else {
+		// Writing headers checks for this condition.
+		if s.getState() == streamDone {
+			return t.streamContextErr(s)
+		}
+	}
+	df := &dataFrame{
+		streamID:    s.id,
+		h:           hdr,
+		d:           data,
+		onEachWrite: t.setResetPingStrikes,
+	}
+	if err := s.wq.get(int32(len(hdr) + len(data))); err != nil {
+		return t.streamContextErr(s)
+	}
+	return t.controlBuf.put(df)
+}
+
+// keepalive running in a separate goroutine does the following:
+// 1. Gracefully closes an idle connection after a duration of keepalive.MaxConnectionIdle.
+// 2. Gracefully closes any connection after a duration of keepalive.MaxConnectionAge.
+// 3. Forcibly closes a connection after an additive period of keepalive.MaxConnectionAgeGrace over keepalive.MaxConnectionAge.
+// 4. Makes sure a connection is alive by sending pings with a frequency of keepalive.Time and closes a non-responsive connection
+// after an additional duration of keepalive.Timeout.
+func (t *http2Server) keepalive() {
+	p := &ping{}
+	// True iff a ping has been sent, and no data has been received since then.
+	outstandingPing := false
+	// Amount of time remaining before which we should receive an ACK for the
+	// last sent ping.
+	kpTimeoutLeft := time.Duration(0)
+	// Records the last value of t.lastRead before we go block on the timer.
+	// This is required to check for read activity since then.
+	prevNano := time.Now().UnixNano()
+	// Initialize the different timers to their default values.
+	idleTimer := time.NewTimer(t.kp.MaxConnectionIdle)
+	ageTimer := time.NewTimer(t.kp.MaxConnectionAge)
+	kpTimer := time.NewTimer(t.kp.Time)
+	defer func() {
+		// We need to drain the underlying channel in these timers after a call
+		// to Stop(), only if we are interested in resetting them. Clearly we
+		// are not interested in resetting them here.
+		idleTimer.Stop()
+		ageTimer.Stop()
+		kpTimer.Stop()
+	}()
+
+	for {
+		select {
+		case <-idleTimer.C:
+			t.mu.Lock()
+			idle := t.idle
+			if idle.IsZero() { // The connection is non-idle.
+				t.mu.Unlock()
+				idleTimer.Reset(t.kp.MaxConnectionIdle)
+				continue
+			}
+			val := t.kp.MaxConnectionIdle - time.Since(idle)
+			t.mu.Unlock()
+			if val <= 0 {
+				// The connection has been idle for a duration of keepalive.MaxConnectionIdle or more.
+				// Gracefully close the connection.
+				t.Drain()
+				return
+			}
+			idleTimer.Reset(val)
+		case <-ageTimer.C:
+			t.Drain()
+			ageTimer.Reset(t.kp.MaxConnectionAgeGrace)
+			select {
+			case <-ageTimer.C:
+				// Close the connection after grace period.
+				if t.logger.V(logLevel) {
+					t.logger.Infof("Closing server transport due to maximum connection age")
+				}
+				t.controlBuf.put(closeConnection{})
+			case <-t.done:
+			}
+			return
+		case <-kpTimer.C:
+			lastRead := atomic.LoadInt64(&t.lastRead)
+			if lastRead > prevNano {
+				// There has been read activity since the last time we were
+				// here. Setup the timer to fire at kp.Time seconds from
+				// lastRead time and continue.
+				outstandingPing = false
+				kpTimer.Reset(time.Duration(lastRead) + t.kp.Time - time.Duration(time.Now().UnixNano()))
+				prevNano = lastRead
+				continue
+			}
+			if outstandingPing && kpTimeoutLeft <= 0 {
+				t.Close(fmt.Errorf("keepalive ping not acked within timeout %s", t.kp.Time))
+				return
+			}
+			if !outstandingPing {
+				if channelz.IsOn() {
+					atomic.AddInt64(&t.czData.kpCount, 1)
+				}
+				t.controlBuf.put(p)
+				kpTimeoutLeft = t.kp.Timeout
+				outstandingPing = true
+			}
+			// The amount of time to sleep here is the minimum of kp.Time and
+			// timeoutLeft. This will ensure that we wait only for kp.Time
+			// before sending out the next ping (for cases where the ping is
+			// acked).
+			sleepDuration := minTime(t.kp.Time, kpTimeoutLeft)
+			kpTimeoutLeft -= sleepDuration
+			kpTimer.Reset(sleepDuration)
+		case <-t.done:
+			return
+		}
+	}
+}
+
+// Close starts shutting down the http2Server transport.
+// TODO(zhaoq): Now the destruction is not blocked on any pending streams. This
+// could cause some resource issue. Revisit this later.
+func (t *http2Server) Close(err error) {
+	t.mu.Lock()
+	if t.state == closing {
+		t.mu.Unlock()
+		return
+	}
+	if t.logger.V(logLevel) {
+		t.logger.Infof("Closing: %v", err)
+	}
+	t.state = closing
+	streams := t.activeStreams
+	t.activeStreams = nil
+	t.mu.Unlock()
+	t.controlBuf.finish()
+	close(t.done)
+	if err := t.conn.Close(); err != nil && t.logger.V(logLevel) {
+		t.logger.Infof("Error closing underlying net.Conn during Close: %v", err)
+	}
+	channelz.RemoveEntry(t.channelzID)
+	// Cancel all active streams.
+	for _, s := range streams {
+		s.cancel()
+	}
+	for _, sh := range t.stats {
+		connEnd := &stats.ConnEnd{}
+		sh.HandleConn(t.ctx, connEnd)
+	}
+}
+
+// deleteStream deletes the stream s from transport's active streams.
+func (t *http2Server) deleteStream(s *Stream, eosReceived bool) {
+
+	t.mu.Lock()
+	if _, ok := t.activeStreams[s.id]; ok {
+		delete(t.activeStreams, s.id)
+		if len(t.activeStreams) == 0 {
+			t.idle = time.Now()
+		}
+	}
+	t.mu.Unlock()
+
+	if channelz.IsOn() {
+		if eosReceived {
+			atomic.AddInt64(&t.czData.streamsSucceeded, 1)
+		} else {
+			atomic.AddInt64(&t.czData.streamsFailed, 1)
+		}
+	}
+}
+
+// finishStream closes the stream and puts the trailing headerFrame into controlbuf.
+func (t *http2Server) finishStream(s *Stream, rst bool, rstCode http2.ErrCode, hdr *headerFrame, eosReceived bool) {
+	// In case stream sending and receiving are invoked in separate
+	// goroutines (e.g., bi-directional streaming), cancel needs to be
+	// called to interrupt the potential blocking on other goroutines.
+	s.cancel()
+
+	oldState := s.swapState(streamDone)
+	if oldState == streamDone {
+		// If the stream was already done, return.
+		return
+	}
+
+	hdr.cleanup = &cleanupStream{
+		streamID: s.id,
+		rst:      rst,
+		rstCode:  rstCode,
+		onWrite: func() {
+			t.deleteStream(s, eosReceived)
+		},
+	}
+	t.controlBuf.put(hdr)
+}
+
+// closeStream clears the footprint of a stream when the stream is not needed any more.
+func (t *http2Server) closeStream(s *Stream, rst bool, rstCode http2.ErrCode, eosReceived bool) {
+	// In case stream sending and receiving are invoked in separate
+	// goroutines (e.g., bi-directional streaming), cancel needs to be
+	// called to interrupt the potential blocking on other goroutines.
+	s.cancel()
+
+	s.swapState(streamDone)
+	t.deleteStream(s, eosReceived)
+
+	t.controlBuf.put(&cleanupStream{
+		streamID: s.id,
+		rst:      rst,
+		rstCode:  rstCode,
+		onWrite:  func() {},
+	})
+}
+
+func (t *http2Server) RemoteAddr() net.Addr {
+	return t.remoteAddr
+}
+
+func (t *http2Server) Drain() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if t.drainEvent != nil {
+		return
+	}
+	t.drainEvent = grpcsync.NewEvent()
+	t.controlBuf.put(&goAway{code: http2.ErrCodeNo, debugData: []byte{}, headsUp: true})
+}
+
+var goAwayPing = &ping{data: [8]byte{1, 6, 1, 8, 0, 3, 3, 9}}
+
+// Handles outgoing GoAway and returns true if loopy needs to put itself
+// in draining mode.
+func (t *http2Server) outgoingGoAwayHandler(g *goAway) (bool, error) {
+	t.maxStreamMu.Lock()
+	t.mu.Lock()
+	if t.state == closing { // TODO(mmukhi): This seems unnecessary.
+		t.mu.Unlock()
+		t.maxStreamMu.Unlock()
+		// The transport is closing.
+		return false, ErrConnClosing
+	}
+	if !g.headsUp {
+		// Stop accepting more streams now.
+		t.state = draining
+		sid := t.maxStreamID
+		retErr := g.closeConn
+		if len(t.activeStreams) == 0 {
+			retErr = errors.New("second GOAWAY written and no active streams left to process")
+		}
+		t.mu.Unlock()
+		t.maxStreamMu.Unlock()
+		if err := t.framer.fr.WriteGoAway(sid, g.code, g.debugData); err != nil {
+			return false, err
+		}
+		if retErr != nil {
+			return false, retErr
+		}
+		return true, nil
+	}
+	t.mu.Unlock()
+	t.maxStreamMu.Unlock()
+	// For a graceful close, send out a GoAway with stream ID of MaxUInt32,
+	// Follow that with a ping and wait for the ack to come back or a timer
+	// to expire. During this time accept new streams since they might have
+	// originated before the GoAway reaches the client.
+	// After getting the ack or timer expiration send out another GoAway this
+	// time with an ID of the max stream server intends to process.
+	if err := t.framer.fr.WriteGoAway(math.MaxUint32, http2.ErrCodeNo, []byte{}); err != nil {
+		return false, err
+	}
+	if err := t.framer.fr.WritePing(false, goAwayPing.data); err != nil {
+		return false, err
+	}
+	go func() {
+		timer := time.NewTimer(time.Minute)
+		defer timer.Stop()
+		select {
+		case <-t.drainEvent.Done():
+		case <-timer.C:
+		case <-t.done:
+			return
+		}
+		t.controlBuf.put(&goAway{code: g.code, debugData: g.debugData})
+	}()
+	return false, nil
+}
+
+func (t *http2Server) ChannelzMetric() *channelz.SocketInternalMetric {
+	s := channelz.SocketInternalMetric{
+		StreamsStarted:                   atomic.LoadInt64(&t.czData.streamsStarted),
+		StreamsSucceeded:                 atomic.LoadInt64(&t.czData.streamsSucceeded),
+		StreamsFailed:                    atomic.LoadInt64(&t.czData.streamsFailed),
+		MessagesSent:                     atomic.LoadInt64(&t.czData.msgSent),
+		MessagesReceived:                 atomic.LoadInt64(&t.czData.msgRecv),
+		KeepAlivesSent:                   atomic.LoadInt64(&t.czData.kpCount),
+		LastRemoteStreamCreatedTimestamp: time.Unix(0, atomic.LoadInt64(&t.czData.lastStreamCreatedTime)),
+		LastMessageSentTimestamp:         time.Unix(0, atomic.LoadInt64(&t.czData.lastMsgSentTime)),
+		LastMessageReceivedTimestamp:     time.Unix(0, atomic.LoadInt64(&t.czData.lastMsgRecvTime)),
+		LocalFlowControlWindow:           int64(t.fc.getSize()),
+		SocketOptions:                    channelz.GetSocketOption(t.conn),
+		LocalAddr:                        t.localAddr,
+		RemoteAddr:                       t.remoteAddr,
+		// RemoteName :
+	}
+	if au, ok := t.authInfo.(credentials.ChannelzSecurityInfo); ok {
+		s.Security = au.GetSecurityValue()
+	}
+	s.RemoteFlowControlWindow = t.getOutFlowWindow()
+	return &s
+}
+
+func (t *http2Server) IncrMsgSent() {
+	atomic.AddInt64(&t.czData.msgSent, 1)
+	atomic.StoreInt64(&t.czData.lastMsgSentTime, time.Now().UnixNano())
+}
+
+func (t *http2Server) IncrMsgRecv() {
+	atomic.AddInt64(&t.czData.msgRecv, 1)
+	atomic.StoreInt64(&t.czData.lastMsgRecvTime, time.Now().UnixNano())
+}
+
+func (t *http2Server) getOutFlowWindow() int64 {
+	resp := make(chan uint32, 1)
+	timer := time.NewTimer(time.Second)
+	defer timer.Stop()
+	t.controlBuf.put(&outFlowControlSizeRequest{resp})
+	select {
+	case sz := <-resp:
+		return int64(sz)
+	case <-t.done:
+		return -1
+	case <-timer.C:
+		return -2
+	}
+}
+
+func (t *http2Server) getPeer() *peer.Peer {
+	return &peer.Peer{
+		Addr:     t.remoteAddr,
+		AuthInfo: t.authInfo, // Can be nil
+	}
+}
+
+func getJitter(v time.Duration) time.Duration {
+	if v == infinity {
+		return 0
+	}
+	// Generate a jitter between +/- 10% of the value.
+	r := int64(v / 10)
+	j := grpcrand.Int63n(2*r) - r
+	return time.Duration(j)
+}
+
+type connectionKey struct{}
+
+// GetConnection gets the connection from the context.
+func GetConnection(ctx context.Context) net.Conn {
+	conn, _ := ctx.Value(connectionKey{}).(net.Conn)
+	return conn
+}
+
+// SetConnection adds the connection to the context to be able to get
+// information about the destination ip and port for an incoming RPC. This also
+// allows any unary or streaming interceptors to see the connection.
+func setConnection(ctx context.Context, conn net.Conn) context.Context {
+	return context.WithValue(ctx, connectionKey{}, conn)
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/http_util.go b/vendor/google.golang.org/grpc/internal/transport/http_util.go
new file mode 100644
index 0000000000..19cbb18f5a
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/http_util.go
@@ -0,0 +1,432 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"bufio"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/golang/protobuf/proto"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/hpack"
+	spb "google.golang.org/genproto/googleapis/rpc/status"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const (
+	// http2MaxFrameLen specifies the max length of a HTTP2 frame.
+	http2MaxFrameLen = 16384 // 16KB frame
+	// https://httpwg.org/specs/rfc7540.html#SettingValues
+	http2InitHeaderTableSize = 4096
+)
+
+var (
+	clientPreface   = []byte(http2.ClientPreface)
+	http2ErrConvTab = map[http2.ErrCode]codes.Code{
+		http2.ErrCodeNo:                 codes.Internal,
+		http2.ErrCodeProtocol:           codes.Internal,
+		http2.ErrCodeInternal:           codes.Internal,
+		http2.ErrCodeFlowControl:        codes.ResourceExhausted,
+		http2.ErrCodeSettingsTimeout:    codes.Internal,
+		http2.ErrCodeStreamClosed:       codes.Internal,
+		http2.ErrCodeFrameSize:          codes.Internal,
+		http2.ErrCodeRefusedStream:      codes.Unavailable,
+		http2.ErrCodeCancel:             codes.Canceled,
+		http2.ErrCodeCompression:        codes.Internal,
+		http2.ErrCodeConnect:            codes.Internal,
+		http2.ErrCodeEnhanceYourCalm:    codes.ResourceExhausted,
+		http2.ErrCodeInadequateSecurity: codes.PermissionDenied,
+		http2.ErrCodeHTTP11Required:     codes.Internal,
+	}
+	// HTTPStatusConvTab is the HTTP status code to gRPC error code conversion table.
+	HTTPStatusConvTab = map[int]codes.Code{
+		// 400 Bad Request - INTERNAL.
+		http.StatusBadRequest: codes.Internal,
+		// 401 Unauthorized  - UNAUTHENTICATED.
+		http.StatusUnauthorized: codes.Unauthenticated,
+		// 403 Forbidden - PERMISSION_DENIED.
+		http.StatusForbidden: codes.PermissionDenied,
+		// 404 Not Found - UNIMPLEMENTED.
+		http.StatusNotFound: codes.Unimplemented,
+		// 429 Too Many Requests - UNAVAILABLE.
+		http.StatusTooManyRequests: codes.Unavailable,
+		// 502 Bad Gateway - UNAVAILABLE.
+		http.StatusBadGateway: codes.Unavailable,
+		// 503 Service Unavailable - UNAVAILABLE.
+		http.StatusServiceUnavailable: codes.Unavailable,
+		// 504 Gateway timeout - UNAVAILABLE.
+		http.StatusGatewayTimeout: codes.Unavailable,
+	}
+)
+
+// isReservedHeader checks whether hdr belongs to HTTP2 headers
+// reserved by gRPC protocol. Any other headers are classified as the
+// user-specified metadata.
+func isReservedHeader(hdr string) bool {
+	if hdr != "" && hdr[0] == ':' {
+		return true
+	}
+	switch hdr {
+	case "content-type",
+		"user-agent",
+		"grpc-message-type",
+		"grpc-encoding",
+		"grpc-message",
+		"grpc-status",
+		"grpc-timeout",
+		"grpc-status-details-bin",
+		// Intentionally exclude grpc-previous-rpc-attempts and
+		// grpc-retry-pushback-ms, which are "reserved", but their API
+		// intentionally works via metadata.
+		"te":
+		return true
+	default:
+		return false
+	}
+}
+
+// isWhitelistedHeader checks whether hdr should be propagated into metadata
+// visible to users, even though it is classified as "reserved", above.
+func isWhitelistedHeader(hdr string) bool {
+	switch hdr {
+	case ":authority", "user-agent":
+		return true
+	default:
+		return false
+	}
+}
+
+const binHdrSuffix = "-bin"
+
+func encodeBinHeader(v []byte) string {
+	return base64.RawStdEncoding.EncodeToString(v)
+}
+
+func decodeBinHeader(v string) ([]byte, error) {
+	if len(v)%4 == 0 {
+		// Input was padded, or padding was not necessary.
+		return base64.StdEncoding.DecodeString(v)
+	}
+	return base64.RawStdEncoding.DecodeString(v)
+}
+
+func encodeMetadataHeader(k, v string) string {
+	if strings.HasSuffix(k, binHdrSuffix) {
+		return encodeBinHeader(([]byte)(v))
+	}
+	return v
+}
+
+func decodeMetadataHeader(k, v string) (string, error) {
+	if strings.HasSuffix(k, binHdrSuffix) {
+		b, err := decodeBinHeader(v)
+		return string(b), err
+	}
+	return v, nil
+}
+
+func decodeGRPCStatusDetails(rawDetails string) (*status.Status, error) {
+	v, err := decodeBinHeader(rawDetails)
+	if err != nil {
+		return nil, err
+	}
+	st := &spb.Status{}
+	if err = proto.Unmarshal(v, st); err != nil {
+		return nil, err
+	}
+	return status.FromProto(st), nil
+}
+
+type timeoutUnit uint8
+
+const (
+	hour        timeoutUnit = 'H'
+	minute      timeoutUnit = 'M'
+	second      timeoutUnit = 'S'
+	millisecond timeoutUnit = 'm'
+	microsecond timeoutUnit = 'u'
+	nanosecond  timeoutUnit = 'n'
+)
+
+func timeoutUnitToDuration(u timeoutUnit) (d time.Duration, ok bool) {
+	switch u {
+	case hour:
+		return time.Hour, true
+	case minute:
+		return time.Minute, true
+	case second:
+		return time.Second, true
+	case millisecond:
+		return time.Millisecond, true
+	case microsecond:
+		return time.Microsecond, true
+	case nanosecond:
+		return time.Nanosecond, true
+	default:
+	}
+	return
+}
+
+func decodeTimeout(s string) (time.Duration, error) {
+	size := len(s)
+	if size < 2 {
+		return 0, fmt.Errorf("transport: timeout string is too short: %q", s)
+	}
+	if size > 9 {
+		// Spec allows for 8 digits plus the unit.
+		return 0, fmt.Errorf("transport: timeout string is too long: %q", s)
+	}
+	unit := timeoutUnit(s[size-1])
+	d, ok := timeoutUnitToDuration(unit)
+	if !ok {
+		return 0, fmt.Errorf("transport: timeout unit is not recognized: %q", s)
+	}
+	t, err := strconv.ParseInt(s[:size-1], 10, 64)
+	if err != nil {
+		return 0, err
+	}
+	const maxHours = math.MaxInt64 / int64(time.Hour)
+	if d == time.Hour && t > maxHours {
+		// This timeout would overflow math.MaxInt64; clamp it.
+		return time.Duration(math.MaxInt64), nil
+	}
+	return d * time.Duration(t), nil
+}
+
+const (
+	spaceByte   = ' '
+	tildeByte   = '~'
+	percentByte = '%'
+)
+
+// encodeGrpcMessage is used to encode status code in header field
+// "grpc-message". It does percent encoding and also replaces invalid utf-8
+// characters with Unicode replacement character.
+//
+// It checks to see if each individual byte in msg is an allowable byte, and
+// then either percent encoding or passing it through. When percent encoding,
+// the byte is converted into hexadecimal notation with a '%' prepended.
+func encodeGrpcMessage(msg string) string {
+	if msg == "" {
+		return ""
+	}
+	lenMsg := len(msg)
+	for i := 0; i < lenMsg; i++ {
+		c := msg[i]
+		if !(c >= spaceByte && c <= tildeByte && c != percentByte) {
+			return encodeGrpcMessageUnchecked(msg)
+		}
+	}
+	return msg
+}
+
+func encodeGrpcMessageUnchecked(msg string) string {
+	var sb strings.Builder
+	for len(msg) > 0 {
+		r, size := utf8.DecodeRuneInString(msg)
+		for _, b := range []byte(string(r)) {
+			if size > 1 {
+				// If size > 1, r is not ascii. Always do percent encoding.
+				fmt.Fprintf(&sb, "%%%02X", b)
+				continue
+			}
+
+			// The for loop is necessary even if size == 1. r could be
+			// utf8.RuneError.
+			//
+			// fmt.Sprintf("%%%02X", utf8.RuneError) gives "%FFFD".
+			if b >= spaceByte && b <= tildeByte && b != percentByte {
+				sb.WriteByte(b)
+			} else {
+				fmt.Fprintf(&sb, "%%%02X", b)
+			}
+		}
+		msg = msg[size:]
+	}
+	return sb.String()
+}
+
+// decodeGrpcMessage decodes the msg encoded by encodeGrpcMessage.
+func decodeGrpcMessage(msg string) string {
+	if msg == "" {
+		return ""
+	}
+	lenMsg := len(msg)
+	for i := 0; i < lenMsg; i++ {
+		if msg[i] == percentByte && i+2 < lenMsg {
+			return decodeGrpcMessageUnchecked(msg)
+		}
+	}
+	return msg
+}
+
+func decodeGrpcMessageUnchecked(msg string) string {
+	var sb strings.Builder
+	lenMsg := len(msg)
+	for i := 0; i < lenMsg; i++ {
+		c := msg[i]
+		if c == percentByte && i+2 < lenMsg {
+			parsed, err := strconv.ParseUint(msg[i+1:i+3], 16, 8)
+			if err != nil {
+				sb.WriteByte(c)
+			} else {
+				sb.WriteByte(byte(parsed))
+				i += 2
+			}
+		} else {
+			sb.WriteByte(c)
+		}
+	}
+	return sb.String()
+}
+
+type bufWriter struct {
+	buf       []byte
+	offset    int
+	batchSize int
+	conn      net.Conn
+	err       error
+}
+
+func newBufWriter(conn net.Conn, batchSize int) *bufWriter {
+	return &bufWriter{
+		buf:       make([]byte, batchSize*2),
+		batchSize: batchSize,
+		conn:      conn,
+	}
+}
+
+func (w *bufWriter) Write(b []byte) (n int, err error) {
+	if w.err != nil {
+		return 0, w.err
+	}
+	if w.batchSize == 0 { // Buffer has been disabled.
+		n, err = w.conn.Write(b)
+		return n, toIOError(err)
+	}
+	for len(b) > 0 {
+		nn := copy(w.buf[w.offset:], b)
+		b = b[nn:]
+		w.offset += nn
+		n += nn
+		if w.offset >= w.batchSize {
+			err = w.Flush()
+		}
+	}
+	return n, err
+}
+
+func (w *bufWriter) Flush() error {
+	if w.err != nil {
+		return w.err
+	}
+	if w.offset == 0 {
+		return nil
+	}
+	_, w.err = w.conn.Write(w.buf[:w.offset])
+	w.err = toIOError(w.err)
+	w.offset = 0
+	return w.err
+}
+
+type ioError struct {
+	error
+}
+
+func (i ioError) Unwrap() error {
+	return i.error
+}
+
+func isIOError(err error) bool {
+	return errors.As(err, &ioError{})
+}
+
+func toIOError(err error) error {
+	if err == nil {
+		return nil
+	}
+	return ioError{error: err}
+}
+
+type framer struct {
+	writer *bufWriter
+	fr     *http2.Framer
+}
+
+func newFramer(conn net.Conn, writeBufferSize, readBufferSize int, maxHeaderListSize uint32) *framer {
+	if writeBufferSize < 0 {
+		writeBufferSize = 0
+	}
+	var r io.Reader = conn
+	if readBufferSize > 0 {
+		r = bufio.NewReaderSize(r, readBufferSize)
+	}
+	w := newBufWriter(conn, writeBufferSize)
+	f := &framer{
+		writer: w,
+		fr:     http2.NewFramer(w, r),
+	}
+	f.fr.SetMaxReadFrameSize(http2MaxFrameLen)
+	// Opt-in to Frame reuse API on framer to reduce garbage.
+	// Frames aren't safe to read from after a subsequent call to ReadFrame.
+	f.fr.SetReuseFrames()
+	f.fr.MaxHeaderListSize = maxHeaderListSize
+	f.fr.ReadMetaHeaders = hpack.NewDecoder(http2InitHeaderTableSize, nil)
+	return f
+}
+
+// parseDialTarget returns the network and address to pass to dialer.
+func parseDialTarget(target string) (string, string) {
+	net := "tcp"
+	m1 := strings.Index(target, ":")
+	m2 := strings.Index(target, ":/")
+	// handle unix:addr which will fail with url.Parse
+	if m1 >= 0 && m2 < 0 {
+		if n := target[0:m1]; n == "unix" {
+			return n, target[m1+1:]
+		}
+	}
+	if m2 >= 0 {
+		t, err := url.Parse(target)
+		if err != nil {
+			return net, target
+		}
+		scheme := t.Scheme
+		addr := t.Path
+		if scheme == "unix" {
+			if addr == "" {
+				addr = t.Host
+			}
+			return scheme, addr
+		}
+	}
+	return net, target
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/logging.go b/vendor/google.golang.org/grpc/internal/transport/logging.go
new file mode 100644
index 0000000000..42ed2b07af
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/logging.go
@@ -0,0 +1,40 @@
+/*
+ *
+ * Copyright 2023 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"fmt"
+
+	"google.golang.org/grpc/grpclog"
+	internalgrpclog "google.golang.org/grpc/internal/grpclog"
+)
+
+var logger = grpclog.Component("transport")
+
+func prefixLoggerForServerTransport(p *http2Server) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[server-transport %p] ", p))
+}
+
+func prefixLoggerForServerHandlerTransport(p *serverHandlerTransport) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[server-handler-transport %p] ", p))
+}
+
+func prefixLoggerForClientTransport(p *http2Client) *internalgrpclog.PrefixLogger {
+	return internalgrpclog.NewPrefixLogger(logger, fmt.Sprintf("[client-transport %p] ", p))
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/networktype/networktype.go b/vendor/google.golang.org/grpc/internal/transport/networktype/networktype.go
new file mode 100644
index 0000000000..c11b527827
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/networktype/networktype.go
@@ -0,0 +1,46 @@
+/*
+ *
+ * Copyright 2020 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package networktype declares the network type to be used in the default
+// dialer. Attribute of a resolver.Address.
+package networktype
+
+import (
+	"google.golang.org/grpc/resolver"
+)
+
+// keyType is the key to use for storing State in Attributes.
+type keyType string
+
+const key = keyType("grpc.internal.transport.networktype")
+
+// Set returns a copy of the provided address with attributes containing networkType.
+func Set(address resolver.Address, networkType string) resolver.Address {
+	address.Attributes = address.Attributes.WithValue(key, networkType)
+	return address
+}
+
+// Get returns the network type in the resolver.Address and true, or "", false
+// if not present.
+func Get(address resolver.Address) (string, bool) {
+	v := address.Attributes.Value(key)
+	if v == nil {
+		return "", false
+	}
+	return v.(string), true
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/proxy.go b/vendor/google.golang.org/grpc/internal/transport/proxy.go
new file mode 100644
index 0000000000..4159619878
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/proxy.go
@@ -0,0 +1,142 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package transport
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+)
+
+const proxyAuthHeaderKey = "Proxy-Authorization"
+
+var (
+	// The following variable will be overwritten in the tests.
+	httpProxyFromEnvironment = http.ProxyFromEnvironment
+)
+
+func mapAddress(address string) (*url.URL, error) {
+	req := &http.Request{
+		URL: &url.URL{
+			Scheme: "https",
+			Host:   address,
+		},
+	}
+	url, err := httpProxyFromEnvironment(req)
+	if err != nil {
+		return nil, err
+	}
+	return url, nil
+}
+
+// To read a response from a net.Conn, http.ReadResponse() takes a bufio.Reader.
+// It's possible that this reader reads more than what's need for the response and stores
+// those bytes in the buffer.
+// bufConn wraps the original net.Conn and the bufio.Reader to make sure we don't lose the
+// bytes in the buffer.
+type bufConn struct {
+	net.Conn
+	r io.Reader
+}
+
+func (c *bufConn) Read(b []byte) (int, error) {
+	return c.r.Read(b)
+}
+
+func basicAuth(username, password string) string {
+	auth := username + ":" + password
+	return base64.StdEncoding.EncodeToString([]byte(auth))
+}
+
+func doHTTPConnectHandshake(ctx context.Context, conn net.Conn, backendAddr string, proxyURL *url.URL, grpcUA string) (_ net.Conn, err error) {
+	defer func() {
+		if err != nil {
+			conn.Close()
+		}
+	}()
+
+	req := &http.Request{
+		Method: http.MethodConnect,
+		URL:    &url.URL{Host: backendAddr},
+		Header: map[string][]string{"User-Agent": {grpcUA}},
+	}
+	if t := proxyURL.User; t != nil {
+		u := t.Username()
+		p, _ := t.Password()
+		req.Header.Add(proxyAuthHeaderKey, "Basic "+basicAuth(u, p))
+	}
+
+	if err := sendHTTPRequest(ctx, req, conn); err != nil {
+		return nil, fmt.Errorf("failed to write the HTTP request: %v", err)
+	}
+
+	r := bufio.NewReader(conn)
+	resp, err := http.ReadResponse(r, req)
+	if err != nil {
+		return nil, fmt.Errorf("reading server HTTP response: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		dump, err := httputil.DumpResponse(resp, true)
+		if err != nil {
+			return nil, fmt.Errorf("failed to do connect handshake, status code: %s", resp.Status)
+		}
+		return nil, fmt.Errorf("failed to do connect handshake, response: %q", dump)
+	}
+
+	return &bufConn{Conn: conn, r: r}, nil
+}
+
+// proxyDial dials, connecting to a proxy first if necessary. Checks if a proxy
+// is necessary, dials, does the HTTP CONNECT handshake, and returns the
+// connection.
+func proxyDial(ctx context.Context, addr string, grpcUA string) (conn net.Conn, err error) {
+	newAddr := addr
+	proxyURL, err := mapAddress(addr)
+	if err != nil {
+		return nil, err
+	}
+	if proxyURL != nil {
+		newAddr = proxyURL.Host
+	}
+
+	conn, err = (&net.Dialer{}).DialContext(ctx, "tcp", newAddr)
+	if err != nil {
+		return
+	}
+	if proxyURL != nil {
+		// proxy is disabled if proxyURL is nil.
+		conn, err = doHTTPConnectHandshake(ctx, conn, addr, proxyURL, grpcUA)
+	}
+	return
+}
+
+func sendHTTPRequest(ctx context.Context, req *http.Request, conn net.Conn) error {
+	req = req.WithContext(ctx)
+	if err := req.Write(conn); err != nil {
+		return fmt.Errorf("failed to write the HTTP request: %v", err)
+	}
+	return nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/transport.go b/vendor/google.golang.org/grpc/internal/transport/transport.go
new file mode 100644
index 0000000000..1b7d7fabc5
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/transport/transport.go
@@ -0,0 +1,842 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package transport defines and implements message oriented communication
+// channel to complete various transactions (e.g., an RPC).  It is meant for
+// grpc-internal usage and is not intended to be imported directly by users.
+package transport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/tap"
+)
+
+// ErrNoHeaders is used as a signal that a trailers only response was received,
+// and is not a real error.
+var ErrNoHeaders = errors.New("stream has no headers")
+
+const logLevel = 2
+
+type bufferPool struct {
+	pool sync.Pool
+}
+
+func newBufferPool() *bufferPool {
+	return &bufferPool{
+		pool: sync.Pool{
+			New: func() interface{} {
+				return new(bytes.Buffer)
+			},
+		},
+	}
+}
+
+func (p *bufferPool) get() *bytes.Buffer {
+	return p.pool.Get().(*bytes.Buffer)
+}
+
+func (p *bufferPool) put(b *bytes.Buffer) {
+	p.pool.Put(b)
+}
+
+// recvMsg represents the received msg from the transport. All transport
+// protocol specific info has been removed.
+type recvMsg struct {
+	buffer *bytes.Buffer
+	// nil: received some data
+	// io.EOF: stream is completed. data is nil.
+	// other non-nil error: transport failure. data is nil.
+	err error
+}
+
+// recvBuffer is an unbounded channel of recvMsg structs.
+//
+// Note: recvBuffer differs from buffer.Unbounded only in the fact that it
+// holds a channel of recvMsg structs instead of objects implementing "item"
+// interface. recvBuffer is written to much more often and using strict recvMsg
+// structs helps avoid allocation in "recvBuffer.put"
+type recvBuffer struct {
+	c       chan recvMsg
+	mu      sync.Mutex
+	backlog []recvMsg
+	err     error
+}
+
+func newRecvBuffer() *recvBuffer {
+	b := &recvBuffer{
+		c: make(chan recvMsg, 1),
+	}
+	return b
+}
+
+func (b *recvBuffer) put(r recvMsg) {
+	b.mu.Lock()
+	if b.err != nil {
+		b.mu.Unlock()
+		// An error had occurred earlier, don't accept more
+		// data or errors.
+		return
+	}
+	b.err = r.err
+	if len(b.backlog) == 0 {
+		select {
+		case b.c <- r:
+			b.mu.Unlock()
+			return
+		default:
+		}
+	}
+	b.backlog = append(b.backlog, r)
+	b.mu.Unlock()
+}
+
+func (b *recvBuffer) load() {
+	b.mu.Lock()
+	if len(b.backlog) > 0 {
+		select {
+		case b.c <- b.backlog[0]:
+			b.backlog[0] = recvMsg{}
+			b.backlog = b.backlog[1:]
+		default:
+		}
+	}
+	b.mu.Unlock()
+}
+
+// get returns the channel that receives a recvMsg in the buffer.
+//
+// Upon receipt of a recvMsg, the caller should call load to send another
+// recvMsg onto the channel if there is any.
+func (b *recvBuffer) get() <-chan recvMsg {
+	return b.c
+}
+
+// recvBufferReader implements io.Reader interface to read the data from
+// recvBuffer.
+type recvBufferReader struct {
+	closeStream func(error) // Closes the client transport stream with the given error and nil trailer metadata.
+	ctx         context.Context
+	ctxDone     <-chan struct{} // cache of ctx.Done() (for performance).
+	recv        *recvBuffer
+	last        *bytes.Buffer // Stores the remaining data in the previous calls.
+	err         error
+	freeBuffer  func(*bytes.Buffer)
+}
+
+// Read reads the next len(p) bytes from last. If last is drained, it tries to
+// read additional data from recv. It blocks if there no additional data available
+// in recv. If Read returns any non-nil error, it will continue to return that error.
+func (r *recvBufferReader) Read(p []byte) (n int, err error) {
+	if r.err != nil {
+		return 0, r.err
+	}
+	if r.last != nil {
+		// Read remaining data left in last call.
+		copied, _ := r.last.Read(p)
+		if r.last.Len() == 0 {
+			r.freeBuffer(r.last)
+			r.last = nil
+		}
+		return copied, nil
+	}
+	if r.closeStream != nil {
+		n, r.err = r.readClient(p)
+	} else {
+		n, r.err = r.read(p)
+	}
+	return n, r.err
+}
+
+func (r *recvBufferReader) read(p []byte) (n int, err error) {
+	select {
+	case <-r.ctxDone:
+		return 0, ContextErr(r.ctx.Err())
+	case m := <-r.recv.get():
+		return r.readAdditional(m, p)
+	}
+}
+
+func (r *recvBufferReader) readClient(p []byte) (n int, err error) {
+	// If the context is canceled, then closes the stream with nil metadata.
+	// closeStream writes its error parameter to r.recv as a recvMsg.
+	// r.readAdditional acts on that message and returns the necessary error.
+	select {
+	case <-r.ctxDone:
+		// Note that this adds the ctx error to the end of recv buffer, and
+		// reads from the head. This will delay the error until recv buffer is
+		// empty, thus will delay ctx cancellation in Recv().
+		//
+		// It's done this way to fix a race between ctx cancel and trailer. The
+		// race was, stream.Recv() may return ctx error if ctxDone wins the
+		// race, but stream.Trailer() may return a non-nil md because the stream
+		// was not marked as done when trailer is received. This closeStream
+		// call will mark stream as done, thus fix the race.
+		//
+		// TODO: delaying ctx error seems like a unnecessary side effect. What
+		// we really want is to mark the stream as done, and return ctx error
+		// faster.
+		r.closeStream(ContextErr(r.ctx.Err()))
+		m := <-r.recv.get()
+		return r.readAdditional(m, p)
+	case m := <-r.recv.get():
+		return r.readAdditional(m, p)
+	}
+}
+
+func (r *recvBufferReader) readAdditional(m recvMsg, p []byte) (n int, err error) {
+	r.recv.load()
+	if m.err != nil {
+		return 0, m.err
+	}
+	copied, _ := m.buffer.Read(p)
+	if m.buffer.Len() == 0 {
+		r.freeBuffer(m.buffer)
+		r.last = nil
+	} else {
+		r.last = m.buffer
+	}
+	return copied, nil
+}
+
+type streamState uint32
+
+const (
+	streamActive    streamState = iota
+	streamWriteDone             // EndStream sent
+	streamReadDone              // EndStream received
+	streamDone                  // the entire stream is finished.
+)
+
+// Stream represents an RPC in the transport layer.
+type Stream struct {
+	id           uint32
+	st           ServerTransport    // nil for client side Stream
+	ct           *http2Client       // nil for server side Stream
+	ctx          context.Context    // the associated context of the stream
+	cancel       context.CancelFunc // always nil for client side Stream
+	done         chan struct{}      // closed at the end of stream to unblock writers. On the client side.
+	doneFunc     func()             // invoked at the end of stream on client side.
+	ctxDone      <-chan struct{}    // same as done chan but for server side. Cache of ctx.Done() (for performance)
+	method       string             // the associated RPC method of the stream
+	recvCompress string
+	sendCompress string
+	buf          *recvBuffer
+	trReader     io.Reader
+	fc           *inFlow
+	wq           *writeQuota
+
+	// Holds compressor names passed in grpc-accept-encoding metadata from the
+	// client. This is empty for the client side stream.
+	clientAdvertisedCompressors string
+	// Callback to state application's intentions to read data. This
+	// is used to adjust flow control, if needed.
+	requestRead func(int)
+
+	headerChan       chan struct{} // closed to indicate the end of header metadata.
+	headerChanClosed uint32        // set when headerChan is closed. Used to avoid closing headerChan multiple times.
+	// headerValid indicates whether a valid header was received.  Only
+	// meaningful after headerChan is closed (always call waitOnHeader() before
+	// reading its value).  Not valid on server side.
+	headerValid bool
+
+	// hdrMu protects header and trailer metadata on the server-side.
+	hdrMu sync.Mutex
+	// On client side, header keeps the received header metadata.
+	//
+	// On server side, header keeps the header set by SetHeader(). The complete
+	// header will merged into this after t.WriteHeader() is called.
+	header  metadata.MD
+	trailer metadata.MD // the key-value map of trailer metadata.
+
+	noHeaders bool // set if the client never received headers (set only after the stream is done).
+
+	// On the server-side, headerSent is atomically set to 1 when the headers are sent out.
+	headerSent uint32
+
+	state streamState
+
+	// On client-side it is the status error received from the server.
+	// On server-side it is unused.
+	status *status.Status
+
+	bytesReceived uint32 // indicates whether any bytes have been received on this stream
+	unprocessed   uint32 // set if the server sends a refused stream or GOAWAY including this stream
+
+	// contentSubtype is the content-subtype for requests.
+	// this must be lowercase or the behavior is undefined.
+	contentSubtype string
+}
+
+// isHeaderSent is only valid on the server-side.
+func (s *Stream) isHeaderSent() bool {
+	return atomic.LoadUint32(&s.headerSent) == 1
+}
+
+// updateHeaderSent updates headerSent and returns true
+// if it was alreay set. It is valid only on server-side.
+func (s *Stream) updateHeaderSent() bool {
+	return atomic.SwapUint32(&s.headerSent, 1) == 1
+}
+
+func (s *Stream) swapState(st streamState) streamState {
+	return streamState(atomic.SwapUint32((*uint32)(&s.state), uint32(st)))
+}
+
+func (s *Stream) compareAndSwapState(oldState, newState streamState) bool {
+	return atomic.CompareAndSwapUint32((*uint32)(&s.state), uint32(oldState), uint32(newState))
+}
+
+func (s *Stream) getState() streamState {
+	return streamState(atomic.LoadUint32((*uint32)(&s.state)))
+}
+
+func (s *Stream) waitOnHeader() {
+	if s.headerChan == nil {
+		// On the server headerChan is always nil since a stream originates
+		// only after having received headers.
+		return
+	}
+	select {
+	case <-s.ctx.Done():
+		// Close the stream to prevent headers/trailers from changing after
+		// this function returns.
+		s.ct.CloseStream(s, ContextErr(s.ctx.Err()))
+		// headerChan could possibly not be closed yet if closeStream raced
+		// with operateHeaders; wait until it is closed explicitly here.
+		<-s.headerChan
+	case <-s.headerChan:
+	}
+}
+
+// RecvCompress returns the compression algorithm applied to the inbound
+// message. It is empty string if there is no compression applied.
+func (s *Stream) RecvCompress() string {
+	s.waitOnHeader()
+	return s.recvCompress
+}
+
+// SetSendCompress sets the compression algorithm to the stream.
+func (s *Stream) SetSendCompress(name string) error {
+	if s.isHeaderSent() || s.getState() == streamDone {
+		return errors.New("transport: set send compressor called after headers sent or stream done")
+	}
+
+	s.sendCompress = name
+	return nil
+}
+
+// SendCompress returns the send compressor name.
+func (s *Stream) SendCompress() string {
+	return s.sendCompress
+}
+
+// ClientAdvertisedCompressors returns the compressor names advertised by the
+// client via grpc-accept-encoding header.
+func (s *Stream) ClientAdvertisedCompressors() string {
+	return s.clientAdvertisedCompressors
+}
+
+// Done returns a channel which is closed when it receives the final status
+// from the server.
+func (s *Stream) Done() <-chan struct{} {
+	return s.done
+}
+
+// Header returns the header metadata of the stream.
+//
+// On client side, it acquires the key-value pairs of header metadata once it is
+// available. It blocks until i) the metadata is ready or ii) there is no header
+// metadata or iii) the stream is canceled/expired.
+//
+// On server side, it returns the out header after t.WriteHeader is called.  It
+// does not block and must not be called until after WriteHeader.
+func (s *Stream) Header() (metadata.MD, error) {
+	if s.headerChan == nil {
+		// On server side, return the header in stream. It will be the out
+		// header after t.WriteHeader is called.
+		return s.header.Copy(), nil
+	}
+	s.waitOnHeader()
+
+	if !s.headerValid {
+		return nil, s.status.Err()
+	}
+
+	if s.noHeaders {
+		return nil, ErrNoHeaders
+	}
+
+	return s.header.Copy(), nil
+}
+
+// TrailersOnly blocks until a header or trailers-only frame is received and
+// then returns true if the stream was trailers-only.  If the stream ends
+// before headers are received, returns true, nil.  Client-side only.
+func (s *Stream) TrailersOnly() bool {
+	s.waitOnHeader()
+	return s.noHeaders
+}
+
+// Trailer returns the cached trailer metedata. Note that if it is not called
+// after the entire stream is done, it could return an empty MD. Client
+// side only.
+// It can be safely read only after stream has ended that is either read
+// or write have returned io.EOF.
+func (s *Stream) Trailer() metadata.MD {
+	c := s.trailer.Copy()
+	return c
+}
+
+// ContentSubtype returns the content-subtype for a request. For example, a
+// content-subtype of "proto" will result in a content-type of
+// "application/grpc+proto". This will always be lowercase.  See
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests for
+// more details.
+func (s *Stream) ContentSubtype() string {
+	return s.contentSubtype
+}
+
+// Context returns the context of the stream.
+func (s *Stream) Context() context.Context {
+	return s.ctx
+}
+
+// Method returns the method for the stream.
+func (s *Stream) Method() string {
+	return s.method
+}
+
+// Status returns the status received from the server.
+// Status can be read safely only after the stream has ended,
+// that is, after Done() is closed.
+func (s *Stream) Status() *status.Status {
+	return s.status
+}
+
+// SetHeader sets the header metadata. This can be called multiple times.
+// Server side only.
+// This should not be called in parallel to other data writes.
+func (s *Stream) SetHeader(md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+	if s.isHeaderSent() || s.getState() == streamDone {
+		return ErrIllegalHeaderWrite
+	}
+	s.hdrMu.Lock()
+	s.header = metadata.Join(s.header, md)
+	s.hdrMu.Unlock()
+	return nil
+}
+
+// SendHeader sends the given header metadata. The given metadata is
+// combined with any metadata set by previous calls to SetHeader and
+// then written to the transport stream.
+func (s *Stream) SendHeader(md metadata.MD) error {
+	return s.st.WriteHeader(s, md)
+}
+
+// SetTrailer sets the trailer metadata which will be sent with the RPC status
+// by the server. This can be called multiple times. Server side only.
+// This should not be called parallel to other data writes.
+func (s *Stream) SetTrailer(md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+	if s.getState() == streamDone {
+		return ErrIllegalHeaderWrite
+	}
+	s.hdrMu.Lock()
+	s.trailer = metadata.Join(s.trailer, md)
+	s.hdrMu.Unlock()
+	return nil
+}
+
+func (s *Stream) write(m recvMsg) {
+	s.buf.put(m)
+}
+
+// Read reads all p bytes from the wire for this stream.
+func (s *Stream) Read(p []byte) (n int, err error) {
+	// Don't request a read if there was an error earlier
+	if er := s.trReader.(*transportReader).er; er != nil {
+		return 0, er
+	}
+	s.requestRead(len(p))
+	return io.ReadFull(s.trReader, p)
+}
+
+// tranportReader reads all the data available for this Stream from the transport and
+// passes them into the decoder, which converts them into a gRPC message stream.
+// The error is io.EOF when the stream is done or another non-nil error if
+// the stream broke.
+type transportReader struct {
+	reader io.Reader
+	// The handler to control the window update procedure for both this
+	// particular stream and the associated transport.
+	windowHandler func(int)
+	er            error
+}
+
+func (t *transportReader) Read(p []byte) (n int, err error) {
+	n, err = t.reader.Read(p)
+	if err != nil {
+		t.er = err
+		return
+	}
+	t.windowHandler(n)
+	return
+}
+
+// BytesReceived indicates whether any bytes have been received on this stream.
+func (s *Stream) BytesReceived() bool {
+	return atomic.LoadUint32(&s.bytesReceived) == 1
+}
+
+// Unprocessed indicates whether the server did not process this stream --
+// i.e. it sent a refused stream or GOAWAY including this stream ID.
+func (s *Stream) Unprocessed() bool {
+	return atomic.LoadUint32(&s.unprocessed) == 1
+}
+
+// GoString is implemented by Stream so context.String() won't
+// race when printing %#v.
+func (s *Stream) GoString() string {
+	return fmt.Sprintf("<stream: %p, %v>", s, s.method)
+}
+
+// state of transport
+type transportState int
+
+const (
+	reachable transportState = iota
+	closing
+	draining
+)
+
+// ServerConfig consists of all the configurations to establish a server transport.
+type ServerConfig struct {
+	MaxStreams            uint32
+	ConnectionTimeout     time.Duration
+	Credentials           credentials.TransportCredentials
+	InTapHandle           tap.ServerInHandle
+	StatsHandlers         []stats.Handler
+	KeepaliveParams       keepalive.ServerParameters
+	KeepalivePolicy       keepalive.EnforcementPolicy
+	InitialWindowSize     int32
+	InitialConnWindowSize int32
+	WriteBufferSize       int
+	ReadBufferSize        int
+	ChannelzParentID      *channelz.Identifier
+	MaxHeaderListSize     *uint32
+	HeaderTableSize       *uint32
+}
+
+// ConnectOptions covers all relevant options for communicating with the server.
+type ConnectOptions struct {
+	// UserAgent is the application user agent.
+	UserAgent string
+	// Dialer specifies how to dial a network address.
+	Dialer func(context.Context, string) (net.Conn, error)
+	// FailOnNonTempDialError specifies if gRPC fails on non-temporary dial errors.
+	FailOnNonTempDialError bool
+	// PerRPCCredentials stores the PerRPCCredentials required to issue RPCs.
+	PerRPCCredentials []credentials.PerRPCCredentials
+	// TransportCredentials stores the Authenticator required to setup a client
+	// connection. Only one of TransportCredentials and CredsBundle is non-nil.
+	TransportCredentials credentials.TransportCredentials
+	// CredsBundle is the credentials bundle to be used. Only one of
+	// TransportCredentials and CredsBundle is non-nil.
+	CredsBundle credentials.Bundle
+	// KeepaliveParams stores the keepalive parameters.
+	KeepaliveParams keepalive.ClientParameters
+	// StatsHandlers stores the handler for stats.
+	StatsHandlers []stats.Handler
+	// InitialWindowSize sets the initial window size for a stream.
+	InitialWindowSize int32
+	// InitialConnWindowSize sets the initial window size for a connection.
+	InitialConnWindowSize int32
+	// WriteBufferSize sets the size of write buffer which in turn determines how much data can be batched before it's written on the wire.
+	WriteBufferSize int
+	// ReadBufferSize sets the size of read buffer, which in turn determines how much data can be read at most for one read syscall.
+	ReadBufferSize int
+	// ChannelzParentID sets the addrConn id which initiate the creation of this client transport.
+	ChannelzParentID *channelz.Identifier
+	// MaxHeaderListSize sets the max (uncompressed) size of header list that is prepared to be received.
+	MaxHeaderListSize *uint32
+	// UseProxy specifies if a proxy should be used.
+	UseProxy bool
+}
+
+// NewClientTransport establishes the transport with the required ConnectOptions
+// and returns it to the caller.
+func NewClientTransport(connectCtx, ctx context.Context, addr resolver.Address, opts ConnectOptions, onClose func(GoAwayReason)) (ClientTransport, error) {
+	return newHTTP2Client(connectCtx, ctx, addr, opts, onClose)
+}
+
+// Options provides additional hints and information for message
+// transmission.
+type Options struct {
+	// Last indicates whether this write is the last piece for
+	// this stream.
+	Last bool
+}
+
+// CallHdr carries the information of a particular RPC.
+type CallHdr struct {
+	// Host specifies the peer's host.
+	Host string
+
+	// Method specifies the operation to perform.
+	Method string
+
+	// SendCompress specifies the compression algorithm applied on
+	// outbound message.
+	SendCompress string
+
+	// Creds specifies credentials.PerRPCCredentials for a call.
+	Creds credentials.PerRPCCredentials
+
+	// ContentSubtype specifies the content-subtype for a request. For example, a
+	// content-subtype of "proto" will result in a content-type of
+	// "application/grpc+proto". The value of ContentSubtype must be all
+	// lowercase, otherwise the behavior is undefined. See
+	// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests
+	// for more details.
+	ContentSubtype string
+
+	PreviousAttempts int // value of grpc-previous-rpc-attempts header to set
+
+	DoneFunc func() // called when the stream is finished
+}
+
+// ClientTransport is the common interface for all gRPC client-side transport
+// implementations.
+type ClientTransport interface {
+	// Close tears down this transport. Once it returns, the transport
+	// should not be accessed any more. The caller must make sure this
+	// is called only once.
+	Close(err error)
+
+	// GracefulClose starts to tear down the transport: the transport will stop
+	// accepting new RPCs and NewStream will return error. Once all streams are
+	// finished, the transport will close.
+	//
+	// It does not block.
+	GracefulClose()
+
+	// Write sends the data for the given stream. A nil stream indicates
+	// the write is to be performed on the transport as a whole.
+	Write(s *Stream, hdr []byte, data []byte, opts *Options) error
+
+	// NewStream creates a Stream for an RPC.
+	NewStream(ctx context.Context, callHdr *CallHdr) (*Stream, error)
+
+	// CloseStream clears the footprint of a stream when the stream is
+	// not needed any more. The err indicates the error incurred when
+	// CloseStream is called. Must be called when a stream is finished
+	// unless the associated transport is closing.
+	CloseStream(stream *Stream, err error)
+
+	// Error returns a channel that is closed when some I/O error
+	// happens. Typically the caller should have a goroutine to monitor
+	// this in order to take action (e.g., close the current transport
+	// and create a new one) in error case. It should not return nil
+	// once the transport is initiated.
+	Error() <-chan struct{}
+
+	// GoAway returns a channel that is closed when ClientTransport
+	// receives the draining signal from the server (e.g., GOAWAY frame in
+	// HTTP/2).
+	GoAway() <-chan struct{}
+
+	// GetGoAwayReason returns the reason why GoAway frame was received, along
+	// with a human readable string with debug info.
+	GetGoAwayReason() (GoAwayReason, string)
+
+	// RemoteAddr returns the remote network address.
+	RemoteAddr() net.Addr
+
+	// IncrMsgSent increments the number of message sent through this transport.
+	IncrMsgSent()
+
+	// IncrMsgRecv increments the number of message received through this transport.
+	IncrMsgRecv()
+}
+
+// ServerTransport is the common interface for all gRPC server-side transport
+// implementations.
+//
+// Methods may be called concurrently from multiple goroutines, but
+// Write methods for a given Stream will be called serially.
+type ServerTransport interface {
+	// HandleStreams receives incoming streams using the given handler.
+	HandleStreams(func(*Stream), func(context.Context, string) context.Context)
+
+	// WriteHeader sends the header metadata for the given stream.
+	// WriteHeader may not be called on all streams.
+	WriteHeader(s *Stream, md metadata.MD) error
+
+	// Write sends the data for the given stream.
+	// Write may not be called on all streams.
+	Write(s *Stream, hdr []byte, data []byte, opts *Options) error
+
+	// WriteStatus sends the status of a stream to the client.  WriteStatus is
+	// the final call made on a stream and always occurs.
+	WriteStatus(s *Stream, st *status.Status) error
+
+	// Close tears down the transport. Once it is called, the transport
+	// should not be accessed any more. All the pending streams and their
+	// handlers will be terminated asynchronously.
+	Close(err error)
+
+	// RemoteAddr returns the remote network address.
+	RemoteAddr() net.Addr
+
+	// Drain notifies the client this ServerTransport stops accepting new RPCs.
+	Drain()
+
+	// IncrMsgSent increments the number of message sent through this transport.
+	IncrMsgSent()
+
+	// IncrMsgRecv increments the number of message received through this transport.
+	IncrMsgRecv()
+}
+
+// connectionErrorf creates an ConnectionError with the specified error description.
+func connectionErrorf(temp bool, e error, format string, a ...interface{}) ConnectionError {
+	return ConnectionError{
+		Desc: fmt.Sprintf(format, a...),
+		temp: temp,
+		err:  e,
+	}
+}
+
+// ConnectionError is an error that results in the termination of the
+// entire connection and the retry of all the active streams.
+type ConnectionError struct {
+	Desc string
+	temp bool
+	err  error
+}
+
+func (e ConnectionError) Error() string {
+	return fmt.Sprintf("connection error: desc = %q", e.Desc)
+}
+
+// Temporary indicates if this connection error is temporary or fatal.
+func (e ConnectionError) Temporary() bool {
+	return e.temp
+}
+
+// Origin returns the original error of this connection error.
+func (e ConnectionError) Origin() error {
+	// Never return nil error here.
+	// If the original error is nil, return itself.
+	if e.err == nil {
+		return e
+	}
+	return e.err
+}
+
+// Unwrap returns the original error of this connection error or nil when the
+// origin is nil.
+func (e ConnectionError) Unwrap() error {
+	return e.err
+}
+
+var (
+	// ErrConnClosing indicates that the transport is closing.
+	ErrConnClosing = connectionErrorf(true, nil, "transport is closing")
+	// errStreamDrain indicates that the stream is rejected because the
+	// connection is draining. This could be caused by goaway or balancer
+	// removing the address.
+	errStreamDrain = status.Error(codes.Unavailable, "the connection is draining")
+	// errStreamDone is returned from write at the client side to indiacte application
+	// layer of an error.
+	errStreamDone = errors.New("the stream is done")
+	// StatusGoAway indicates that the server sent a GOAWAY that included this
+	// stream's ID in unprocessed RPCs.
+	statusGoAway = status.New(codes.Unavailable, "the stream is rejected because server is draining the connection")
+)
+
+// GoAwayReason contains the reason for the GoAway frame received.
+type GoAwayReason uint8
+
+const (
+	// GoAwayInvalid indicates that no GoAway frame is received.
+	GoAwayInvalid GoAwayReason = 0
+	// GoAwayNoReason is the default value when GoAway frame is received.
+	GoAwayNoReason GoAwayReason = 1
+	// GoAwayTooManyPings indicates that a GoAway frame with
+	// ErrCodeEnhanceYourCalm was received and that the debug data said
+	// "too_many_pings".
+	GoAwayTooManyPings GoAwayReason = 2
+)
+
+// channelzData is used to store channelz related data for http2Client and http2Server.
+// These fields cannot be embedded in the original structs (e.g. http2Client), since to do atomic
+// operation on int64 variable on 32-bit machine, user is responsible to enforce memory alignment.
+// Here, by grouping those int64 fields inside a struct, we are enforcing the alignment.
+type channelzData struct {
+	kpCount int64
+	// The number of streams that have started, including already finished ones.
+	streamsStarted int64
+	// Client side: The number of streams that have ended successfully by receiving
+	// EoS bit set frame from server.
+	// Server side: The number of streams that have ended successfully by sending
+	// frame with EoS bit set.
+	streamsSucceeded int64
+	streamsFailed    int64
+	// lastStreamCreatedTime stores the timestamp that the last stream gets created. It is of int64 type
+	// instead of time.Time since it's more costly to atomically update time.Time variable than int64
+	// variable. The same goes for lastMsgSentTime and lastMsgRecvTime.
+	lastStreamCreatedTime int64
+	msgSent               int64
+	msgRecv               int64
+	lastMsgSentTime       int64
+	lastMsgRecvTime       int64
+}
+
+// ContextErr converts the error from context package into a status error.
+func ContextErr(err error) error {
+	switch err {
+	case context.DeadlineExceeded:
+		return status.Error(codes.DeadlineExceeded, err.Error())
+	case context.Canceled:
+		return status.Error(codes.Canceled, err.Error())
+	}
+	return status.Errorf(codes.Internal, "Unexpected error from context packet: %v", err)
+}
diff --git a/vendor/google.golang.org/grpc/internal/xds_handshake_cluster.go b/vendor/google.golang.org/grpc/internal/xds_handshake_cluster.go
new file mode 100644
index 0000000000..e8b492774d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/internal/xds_handshake_cluster.go
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package internal
+
+import (
+	"google.golang.org/grpc/attributes"
+	"google.golang.org/grpc/resolver"
+)
+
+// handshakeClusterNameKey is the type used as the key to store cluster name in
+// the Attributes field of resolver.Address.
+type handshakeClusterNameKey struct{}
+
+// SetXDSHandshakeClusterName returns a copy of addr in which the Attributes field
+// is updated with the cluster name.
+func SetXDSHandshakeClusterName(addr resolver.Address, clusterName string) resolver.Address {
+	addr.Attributes = addr.Attributes.WithValue(handshakeClusterNameKey{}, clusterName)
+	return addr
+}
+
+// GetXDSHandshakeClusterName returns cluster name stored in attr.
+func GetXDSHandshakeClusterName(attr *attributes.Attributes) (string, bool) {
+	v := attr.Value(handshakeClusterNameKey{})
+	name, ok := v.(string)
+	return name, ok
+}
diff --git a/vendor/google.golang.org/grpc/keepalive/keepalive.go b/vendor/google.golang.org/grpc/keepalive/keepalive.go
new file mode 100644
index 0000000000..34d31b5e7d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/keepalive/keepalive.go
@@ -0,0 +1,85 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package keepalive defines configurable parameters for point-to-point
+// healthcheck.
+package keepalive
+
+import (
+	"time"
+)
+
+// ClientParameters is used to set keepalive parameters on the client-side.
+// These configure how the client will actively probe to notice when a
+// connection is broken and send pings so intermediaries will be aware of the
+// liveness of the connection. Make sure these parameters are set in
+// coordination with the keepalive policy on the server, as incompatible
+// settings can result in closing of connection.
+type ClientParameters struct {
+	// After a duration of this time if the client doesn't see any activity it
+	// pings the server to see if the transport is still alive.
+	// If set below 10s, a minimum value of 10s will be used instead.
+	Time time.Duration // The current default value is infinity.
+	// After having pinged for keepalive check, the client waits for a duration
+	// of Timeout and if no activity is seen even after that the connection is
+	// closed.
+	Timeout time.Duration // The current default value is 20 seconds.
+	// If true, client sends keepalive pings even with no active RPCs. If false,
+	// when there are no active RPCs, Time and Timeout will be ignored and no
+	// keepalive pings will be sent.
+	PermitWithoutStream bool // false by default.
+}
+
+// ServerParameters is used to set keepalive and max-age parameters on the
+// server-side.
+type ServerParameters struct {
+	// MaxConnectionIdle is a duration for the amount of time after which an
+	// idle connection would be closed by sending a GoAway. Idleness duration is
+	// defined since the most recent time the number of outstanding RPCs became
+	// zero or the connection establishment.
+	MaxConnectionIdle time.Duration // The current default value is infinity.
+	// MaxConnectionAge is a duration for the maximum amount of time a
+	// connection may exist before it will be closed by sending a GoAway. A
+	// random jitter of +/-10% will be added to MaxConnectionAge to spread out
+	// connection storms.
+	MaxConnectionAge time.Duration // The current default value is infinity.
+	// MaxConnectionAgeGrace is an additive period after MaxConnectionAge after
+	// which the connection will be forcibly closed.
+	MaxConnectionAgeGrace time.Duration // The current default value is infinity.
+	// After a duration of this time if the server doesn't see any activity it
+	// pings the client to see if the transport is still alive.
+	// If set below 1s, a minimum value of 1s will be used instead.
+	Time time.Duration // The current default value is 2 hours.
+	// After having pinged for keepalive check, the server waits for a duration
+	// of Timeout and if no activity is seen even after that the connection is
+	// closed.
+	Timeout time.Duration // The current default value is 20 seconds.
+}
+
+// EnforcementPolicy is used to set keepalive enforcement policy on the
+// server-side. Server will close connection with a client that violates this
+// policy.
+type EnforcementPolicy struct {
+	// MinTime is the minimum amount of time a client should wait before sending
+	// a keepalive ping.
+	MinTime time.Duration // The current default value is 5 minutes.
+	// If true, server allows keepalive pings even when there are no active
+	// streams(RPCs). If false, and client sends ping when there are no active
+	// streams, server will send GOAWAY and close the connection.
+	PermitWithoutStream bool // false by default.
+}
diff --git a/vendor/google.golang.org/grpc/metadata/metadata.go b/vendor/google.golang.org/grpc/metadata/metadata.go
new file mode 100644
index 0000000000..a2cdcaf12a
--- /dev/null
+++ b/vendor/google.golang.org/grpc/metadata/metadata.go
@@ -0,0 +1,295 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package metadata define the structure of the metadata supported by gRPC library.
+// Please refer to https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md
+// for more information about custom-metadata.
+package metadata // import "google.golang.org/grpc/metadata"
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// DecodeKeyValue returns k, v, nil.
+//
+// Deprecated: use k and v directly instead.
+func DecodeKeyValue(k, v string) (string, string, error) {
+	return k, v, nil
+}
+
+// MD is a mapping from metadata keys to values. Users should use the following
+// two convenience functions New and Pairs to generate MD.
+type MD map[string][]string
+
+// New creates an MD from a given key-value map.
+//
+// Only the following ASCII characters are allowed in keys:
+//   - digits: 0-9
+//   - uppercase letters: A-Z (normalized to lower)
+//   - lowercase letters: a-z
+//   - special characters: -_.
+//
+// Uppercase letters are automatically converted to lowercase.
+//
+// Keys beginning with "grpc-" are reserved for grpc-internal use only and may
+// result in errors if set in metadata.
+func New(m map[string]string) MD {
+	md := make(MD, len(m))
+	for k, val := range m {
+		key := strings.ToLower(k)
+		md[key] = append(md[key], val)
+	}
+	return md
+}
+
+// Pairs returns an MD formed by the mapping of key, value ...
+// Pairs panics if len(kv) is odd.
+//
+// Only the following ASCII characters are allowed in keys:
+//   - digits: 0-9
+//   - uppercase letters: A-Z (normalized to lower)
+//   - lowercase letters: a-z
+//   - special characters: -_.
+//
+// Uppercase letters are automatically converted to lowercase.
+//
+// Keys beginning with "grpc-" are reserved for grpc-internal use only and may
+// result in errors if set in metadata.
+func Pairs(kv ...string) MD {
+	if len(kv)%2 == 1 {
+		panic(fmt.Sprintf("metadata: Pairs got the odd number of input pairs for metadata: %d", len(kv)))
+	}
+	md := make(MD, len(kv)/2)
+	for i := 0; i < len(kv); i += 2 {
+		key := strings.ToLower(kv[i])
+		md[key] = append(md[key], kv[i+1])
+	}
+	return md
+}
+
+// Len returns the number of items in md.
+func (md MD) Len() int {
+	return len(md)
+}
+
+// Copy returns a copy of md.
+func (md MD) Copy() MD {
+	out := make(MD, len(md))
+	for k, v := range md {
+		out[k] = copyOf(v)
+	}
+	return out
+}
+
+// Get obtains the values for a given key.
+//
+// k is converted to lowercase before searching in md.
+func (md MD) Get(k string) []string {
+	k = strings.ToLower(k)
+	return md[k]
+}
+
+// Set sets the value of a given key with a slice of values.
+//
+// k is converted to lowercase before storing in md.
+func (md MD) Set(k string, vals ...string) {
+	if len(vals) == 0 {
+		return
+	}
+	k = strings.ToLower(k)
+	md[k] = vals
+}
+
+// Append adds the values to key k, not overwriting what was already stored at
+// that key.
+//
+// k is converted to lowercase before storing in md.
+func (md MD) Append(k string, vals ...string) {
+	if len(vals) == 0 {
+		return
+	}
+	k = strings.ToLower(k)
+	md[k] = append(md[k], vals...)
+}
+
+// Delete removes the values for a given key k which is converted to lowercase
+// before removing it from md.
+func (md MD) Delete(k string) {
+	k = strings.ToLower(k)
+	delete(md, k)
+}
+
+// Join joins any number of mds into a single MD.
+//
+// The order of values for each key is determined by the order in which the mds
+// containing those values are presented to Join.
+func Join(mds ...MD) MD {
+	out := MD{}
+	for _, md := range mds {
+		for k, v := range md {
+			out[k] = append(out[k], v...)
+		}
+	}
+	return out
+}
+
+type mdIncomingKey struct{}
+type mdOutgoingKey struct{}
+
+// NewIncomingContext creates a new context with incoming md attached.
+func NewIncomingContext(ctx context.Context, md MD) context.Context {
+	return context.WithValue(ctx, mdIncomingKey{}, md)
+}
+
+// NewOutgoingContext creates a new context with outgoing md attached. If used
+// in conjunction with AppendToOutgoingContext, NewOutgoingContext will
+// overwrite any previously-appended metadata.
+func NewOutgoingContext(ctx context.Context, md MD) context.Context {
+	return context.WithValue(ctx, mdOutgoingKey{}, rawMD{md: md})
+}
+
+// AppendToOutgoingContext returns a new context with the provided kv merged
+// with any existing metadata in the context. Please refer to the documentation
+// of Pairs for a description of kv.
+func AppendToOutgoingContext(ctx context.Context, kv ...string) context.Context {
+	if len(kv)%2 == 1 {
+		panic(fmt.Sprintf("metadata: AppendToOutgoingContext got an odd number of input pairs for metadata: %d", len(kv)))
+	}
+	md, _ := ctx.Value(mdOutgoingKey{}).(rawMD)
+	added := make([][]string, len(md.added)+1)
+	copy(added, md.added)
+	kvCopy := make([]string, 0, len(kv))
+	for i := 0; i < len(kv); i += 2 {
+		kvCopy = append(kvCopy, strings.ToLower(kv[i]), kv[i+1])
+	}
+	added[len(added)-1] = kvCopy
+	return context.WithValue(ctx, mdOutgoingKey{}, rawMD{md: md.md, added: added})
+}
+
+// FromIncomingContext returns the incoming metadata in ctx if it exists.
+//
+// All keys in the returned MD are lowercase.
+func FromIncomingContext(ctx context.Context) (MD, bool) {
+	md, ok := ctx.Value(mdIncomingKey{}).(MD)
+	if !ok {
+		return nil, false
+	}
+	out := make(MD, len(md))
+	for k, v := range md {
+		// We need to manually convert all keys to lower case, because MD is a
+		// map, and there's no guarantee that the MD attached to the context is
+		// created using our helper functions.
+		key := strings.ToLower(k)
+		out[key] = copyOf(v)
+	}
+	return out, true
+}
+
+// ValueFromIncomingContext returns the metadata value corresponding to the metadata
+// key from the incoming metadata if it exists. Key must be lower-case.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ValueFromIncomingContext(ctx context.Context, key string) []string {
+	md, ok := ctx.Value(mdIncomingKey{}).(MD)
+	if !ok {
+		return nil
+	}
+
+	if v, ok := md[key]; ok {
+		return copyOf(v)
+	}
+	for k, v := range md {
+		// We need to manually convert all keys to lower case, because MD is a
+		// map, and there's no guarantee that the MD attached to the context is
+		// created using our helper functions.
+		if strings.ToLower(k) == key {
+			return copyOf(v)
+		}
+	}
+	return nil
+}
+
+// the returned slice must not be modified in place
+func copyOf(v []string) []string {
+	vals := make([]string, len(v))
+	copy(vals, v)
+	return vals
+}
+
+// FromOutgoingContextRaw returns the un-merged, intermediary contents of rawMD.
+//
+// Remember to perform strings.ToLower on the keys, for both the returned MD (MD
+// is a map, there's no guarantee it's created using our helper functions) and
+// the extra kv pairs (AppendToOutgoingContext doesn't turn them into
+// lowercase).
+//
+// This is intended for gRPC-internal use ONLY. Users should use
+// FromOutgoingContext instead.
+func FromOutgoingContextRaw(ctx context.Context) (MD, [][]string, bool) {
+	raw, ok := ctx.Value(mdOutgoingKey{}).(rawMD)
+	if !ok {
+		return nil, nil, false
+	}
+
+	return raw.md, raw.added, true
+}
+
+// FromOutgoingContext returns the outgoing metadata in ctx if it exists.
+//
+// All keys in the returned MD are lowercase.
+func FromOutgoingContext(ctx context.Context) (MD, bool) {
+	raw, ok := ctx.Value(mdOutgoingKey{}).(rawMD)
+	if !ok {
+		return nil, false
+	}
+
+	mdSize := len(raw.md)
+	for i := range raw.added {
+		mdSize += len(raw.added[i]) / 2
+	}
+
+	out := make(MD, mdSize)
+	for k, v := range raw.md {
+		// We need to manually convert all keys to lower case, because MD is a
+		// map, and there's no guarantee that the MD attached to the context is
+		// created using our helper functions.
+		key := strings.ToLower(k)
+		out[key] = copyOf(v)
+	}
+	for _, added := range raw.added {
+		if len(added)%2 == 1 {
+			panic(fmt.Sprintf("metadata: FromOutgoingContext got an odd number of input pairs for metadata: %d", len(added)))
+		}
+
+		for i := 0; i < len(added); i += 2 {
+			key := strings.ToLower(added[i])
+			out[key] = append(out[key], added[i+1])
+		}
+	}
+	return out, ok
+}
+
+type rawMD struct {
+	md    MD
+	added [][]string
+}
diff --git a/vendor/google.golang.org/grpc/peer/peer.go b/vendor/google.golang.org/grpc/peer/peer.go
new file mode 100644
index 0000000000..e01d219ffb
--- /dev/null
+++ b/vendor/google.golang.org/grpc/peer/peer.go
@@ -0,0 +1,51 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package peer defines various peer information associated with RPCs and
+// corresponding utils.
+package peer
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// Peer contains the information of the peer for an RPC, such as the address
+// and authentication information.
+type Peer struct {
+	// Addr is the peer address.
+	Addr net.Addr
+	// AuthInfo is the authentication information of the transport.
+	// It is nil if there is no transport security being used.
+	AuthInfo credentials.AuthInfo
+}
+
+type peerKey struct{}
+
+// NewContext creates a new context with peer information attached.
+func NewContext(ctx context.Context, p *Peer) context.Context {
+	return context.WithValue(ctx, peerKey{}, p)
+}
+
+// FromContext returns the peer information in ctx if it exists.
+func FromContext(ctx context.Context) (p *Peer, ok bool) {
+	p, ok = ctx.Value(peerKey{}).(*Peer)
+	return
+}
diff --git a/vendor/google.golang.org/grpc/picker_wrapper.go b/vendor/google.golang.org/grpc/picker_wrapper.go
new file mode 100644
index 0000000000..c525dc070f
--- /dev/null
+++ b/vendor/google.golang.org/grpc/picker_wrapper.go
@@ -0,0 +1,194 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"io"
+	"sync"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/internal/channelz"
+	istatus "google.golang.org/grpc/internal/status"
+	"google.golang.org/grpc/internal/transport"
+	"google.golang.org/grpc/status"
+)
+
+// pickerWrapper is a wrapper of balancer.Picker. It blocks on certain pick
+// actions and unblock when there's a picker update.
+type pickerWrapper struct {
+	mu         sync.Mutex
+	done       bool
+	blockingCh chan struct{}
+	picker     balancer.Picker
+}
+
+func newPickerWrapper() *pickerWrapper {
+	return &pickerWrapper{blockingCh: make(chan struct{})}
+}
+
+// updatePicker is called by UpdateBalancerState. It unblocks all blocked pick.
+func (pw *pickerWrapper) updatePicker(p balancer.Picker) {
+	pw.mu.Lock()
+	if pw.done {
+		pw.mu.Unlock()
+		return
+	}
+	pw.picker = p
+	// pw.blockingCh should never be nil.
+	close(pw.blockingCh)
+	pw.blockingCh = make(chan struct{})
+	pw.mu.Unlock()
+}
+
+// doneChannelzWrapper performs the following:
+//   - increments the calls started channelz counter
+//   - wraps the done function in the passed in result to increment the calls
+//     failed or calls succeeded channelz counter before invoking the actual
+//     done function.
+func doneChannelzWrapper(acw *acBalancerWrapper, result *balancer.PickResult) {
+	acw.mu.Lock()
+	ac := acw.ac
+	acw.mu.Unlock()
+	ac.incrCallsStarted()
+	done := result.Done
+	result.Done = func(b balancer.DoneInfo) {
+		if b.Err != nil && b.Err != io.EOF {
+			ac.incrCallsFailed()
+		} else {
+			ac.incrCallsSucceeded()
+		}
+		if done != nil {
+			done(b)
+		}
+	}
+}
+
+// pick returns the transport that will be used for the RPC.
+// It may block in the following cases:
+// - there's no picker
+// - the current picker returns ErrNoSubConnAvailable
+// - the current picker returns other errors and failfast is false.
+// - the subConn returned by the current picker is not READY
+// When one of these situations happens, pick blocks until the picker gets updated.
+func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.PickInfo) (transport.ClientTransport, balancer.PickResult, error) {
+	var ch chan struct{}
+
+	var lastPickErr error
+	for {
+		pw.mu.Lock()
+		if pw.done {
+			pw.mu.Unlock()
+			return nil, balancer.PickResult{}, ErrClientConnClosing
+		}
+
+		if pw.picker == nil {
+			ch = pw.blockingCh
+		}
+		if ch == pw.blockingCh {
+			// This could happen when either:
+			// - pw.picker is nil (the previous if condition), or
+			// - has called pick on the current picker.
+			pw.mu.Unlock()
+			select {
+			case <-ctx.Done():
+				var errStr string
+				if lastPickErr != nil {
+					errStr = "latest balancer error: " + lastPickErr.Error()
+				} else {
+					errStr = ctx.Err().Error()
+				}
+				switch ctx.Err() {
+				case context.DeadlineExceeded:
+					return nil, balancer.PickResult{}, status.Error(codes.DeadlineExceeded, errStr)
+				case context.Canceled:
+					return nil, balancer.PickResult{}, status.Error(codes.Canceled, errStr)
+				}
+			case <-ch:
+			}
+			continue
+		}
+
+		ch = pw.blockingCh
+		p := pw.picker
+		pw.mu.Unlock()
+
+		pickResult, err := p.Pick(info)
+		if err != nil {
+			if err == balancer.ErrNoSubConnAvailable {
+				continue
+			}
+			if st, ok := status.FromError(err); ok {
+				// Status error: end the RPC unconditionally with this status.
+				// First restrict the code to the list allowed by gRFC A54.
+				if istatus.IsRestrictedControlPlaneCode(st) {
+					err = status.Errorf(codes.Internal, "received picker error with illegal status: %v", err)
+				}
+				return nil, balancer.PickResult{}, dropError{error: err}
+			}
+			// For all other errors, wait for ready RPCs should block and other
+			// RPCs should fail with unavailable.
+			if !failfast {
+				lastPickErr = err
+				continue
+			}
+			return nil, balancer.PickResult{}, status.Error(codes.Unavailable, err.Error())
+		}
+
+		acw, ok := pickResult.SubConn.(*acBalancerWrapper)
+		if !ok {
+			logger.Errorf("subconn returned from pick is type %T, not *acBalancerWrapper", pickResult.SubConn)
+			continue
+		}
+		if t := acw.getAddrConn().getReadyTransport(); t != nil {
+			if channelz.IsOn() {
+				doneChannelzWrapper(acw, &pickResult)
+				return t, pickResult, nil
+			}
+			return t, pickResult, nil
+		}
+		if pickResult.Done != nil {
+			// Calling done with nil error, no bytes sent and no bytes received.
+			// DoneInfo with default value works.
+			pickResult.Done(balancer.DoneInfo{})
+		}
+		logger.Infof("blockingPicker: the picked transport is not ready, loop back to repick")
+		// If ok == false, ac.state is not READY.
+		// A valid picker always returns READY subConn. This means the state of ac
+		// just changed, and picker will be updated shortly.
+		// continue back to the beginning of the for loop to repick.
+	}
+}
+
+func (pw *pickerWrapper) close() {
+	pw.mu.Lock()
+	defer pw.mu.Unlock()
+	if pw.done {
+		return
+	}
+	pw.done = true
+	close(pw.blockingCh)
+}
+
+// dropError is a wrapper error that indicates the LB policy wishes to drop the
+// RPC and not retry it.
+type dropError struct {
+	error
+}
diff --git a/vendor/google.golang.org/grpc/pickfirst.go b/vendor/google.golang.org/grpc/pickfirst.go
new file mode 100644
index 0000000000..fc91b4d266
--- /dev/null
+++ b/vendor/google.golang.org/grpc/pickfirst.go
@@ -0,0 +1,183 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"errors"
+	"fmt"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/connectivity"
+)
+
+// PickFirstBalancerName is the name of the pick_first balancer.
+const PickFirstBalancerName = "pick_first"
+
+func newPickfirstBuilder() balancer.Builder {
+	return &pickfirstBuilder{}
+}
+
+type pickfirstBuilder struct{}
+
+func (*pickfirstBuilder) Build(cc balancer.ClientConn, opt balancer.BuildOptions) balancer.Balancer {
+	return &pickfirstBalancer{cc: cc}
+}
+
+func (*pickfirstBuilder) Name() string {
+	return PickFirstBalancerName
+}
+
+type pickfirstBalancer struct {
+	state   connectivity.State
+	cc      balancer.ClientConn
+	subConn balancer.SubConn
+}
+
+func (b *pickfirstBalancer) ResolverError(err error) {
+	if logger.V(2) {
+		logger.Infof("pickfirstBalancer: ResolverError called with error: %v", err)
+	}
+	if b.subConn == nil {
+		b.state = connectivity.TransientFailure
+	}
+
+	if b.state != connectivity.TransientFailure {
+		// The picker will not change since the balancer does not currently
+		// report an error.
+		return
+	}
+	b.cc.UpdateState(balancer.State{
+		ConnectivityState: connectivity.TransientFailure,
+		Picker:            &picker{err: fmt.Errorf("name resolver error: %v", err)},
+	})
+}
+
+func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState) error {
+	if len(state.ResolverState.Addresses) == 0 {
+		// The resolver reported an empty address list. Treat it like an error by
+		// calling b.ResolverError.
+		if b.subConn != nil {
+			// Remove the old subConn. All addresses were removed, so it is no longer
+			// valid.
+			b.cc.RemoveSubConn(b.subConn)
+			b.subConn = nil
+		}
+		b.ResolverError(errors.New("produced zero addresses"))
+		return balancer.ErrBadResolverState
+	}
+
+	if b.subConn != nil {
+		b.cc.UpdateAddresses(b.subConn, state.ResolverState.Addresses)
+		return nil
+	}
+
+	subConn, err := b.cc.NewSubConn(state.ResolverState.Addresses, balancer.NewSubConnOptions{})
+	if err != nil {
+		if logger.V(2) {
+			logger.Errorf("pickfirstBalancer: failed to NewSubConn: %v", err)
+		}
+		b.state = connectivity.TransientFailure
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: connectivity.TransientFailure,
+			Picker:            &picker{err: fmt.Errorf("error creating connection: %v", err)},
+		})
+		return balancer.ErrBadResolverState
+	}
+	b.subConn = subConn
+	b.state = connectivity.Idle
+	b.cc.UpdateState(balancer.State{
+		ConnectivityState: connectivity.Connecting,
+		Picker:            &picker{err: balancer.ErrNoSubConnAvailable},
+	})
+	b.subConn.Connect()
+	return nil
+}
+
+func (b *pickfirstBalancer) UpdateSubConnState(subConn balancer.SubConn, state balancer.SubConnState) {
+	if logger.V(2) {
+		logger.Infof("pickfirstBalancer: UpdateSubConnState: %p, %v", subConn, state)
+	}
+	if b.subConn != subConn {
+		if logger.V(2) {
+			logger.Infof("pickfirstBalancer: ignored state change because subConn is not recognized")
+		}
+		return
+	}
+	b.state = state.ConnectivityState
+	if state.ConnectivityState == connectivity.Shutdown {
+		b.subConn = nil
+		return
+	}
+
+	switch state.ConnectivityState {
+	case connectivity.Ready:
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &picker{result: balancer.PickResult{SubConn: subConn}},
+		})
+	case connectivity.Connecting:
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &picker{err: balancer.ErrNoSubConnAvailable},
+		})
+	case connectivity.Idle:
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &idlePicker{subConn: subConn},
+		})
+	case connectivity.TransientFailure:
+		b.cc.UpdateState(balancer.State{
+			ConnectivityState: state.ConnectivityState,
+			Picker:            &picker{err: state.ConnectionError},
+		})
+	}
+}
+
+func (b *pickfirstBalancer) Close() {
+}
+
+func (b *pickfirstBalancer) ExitIdle() {
+	if b.subConn != nil && b.state == connectivity.Idle {
+		b.subConn.Connect()
+	}
+}
+
+type picker struct {
+	result balancer.PickResult
+	err    error
+}
+
+func (p *picker) Pick(balancer.PickInfo) (balancer.PickResult, error) {
+	return p.result, p.err
+}
+
+// idlePicker is used when the SubConn is IDLE and kicks the SubConn into
+// CONNECTING when Pick is called.
+type idlePicker struct {
+	subConn balancer.SubConn
+}
+
+func (i *idlePicker) Pick(balancer.PickInfo) (balancer.PickResult, error) {
+	i.subConn.Connect()
+	return balancer.PickResult{}, balancer.ErrNoSubConnAvailable
+}
+
+func init() {
+	balancer.Register(newPickfirstBuilder())
+}
diff --git a/vendor/google.golang.org/grpc/preloader.go b/vendor/google.golang.org/grpc/preloader.go
new file mode 100644
index 0000000000..cd45547854
--- /dev/null
+++ b/vendor/google.golang.org/grpc/preloader.go
@@ -0,0 +1,67 @@
+/*
+ *
+ * Copyright 2019 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// PreparedMsg is responsible for creating a Marshalled and Compressed object.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type PreparedMsg struct {
+	// Struct for preparing msg before sending them
+	encodedData []byte
+	hdr         []byte
+	payload     []byte
+}
+
+// Encode marshalls and compresses the message using the codec and compressor for the stream.
+func (p *PreparedMsg) Encode(s Stream, msg interface{}) error {
+	ctx := s.Context()
+	rpcInfo, ok := rpcInfoFromContext(ctx)
+	if !ok {
+		return status.Errorf(codes.Internal, "grpc: unable to get rpcInfo")
+	}
+
+	// check if the context has the relevant information to prepareMsg
+	if rpcInfo.preloaderInfo == nil {
+		return status.Errorf(codes.Internal, "grpc: rpcInfo.preloaderInfo is nil")
+	}
+	if rpcInfo.preloaderInfo.codec == nil {
+		return status.Errorf(codes.Internal, "grpc: rpcInfo.preloaderInfo.codec is nil")
+	}
+
+	// prepare the msg
+	data, err := encode(rpcInfo.preloaderInfo.codec, msg)
+	if err != nil {
+		return err
+	}
+	p.encodedData = data
+	compData, err := compress(data, rpcInfo.preloaderInfo.cp, rpcInfo.preloaderInfo.comp)
+	if err != nil {
+		return err
+	}
+	p.hdr, p.payload = msgHeader(data, compData)
+	return nil
+}
diff --git a/vendor/google.golang.org/grpc/regenerate.sh b/vendor/google.golang.org/grpc/regenerate.sh
new file mode 100644
index 0000000000..a6f26c8ab0
--- /dev/null
+++ b/vendor/google.golang.org/grpc/regenerate.sh
@@ -0,0 +1,123 @@
+#!/bin/bash
+# Copyright 2020 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eu -o pipefail
+
+WORKDIR=$(mktemp -d)
+
+function finish {
+  rm -rf "$WORKDIR"
+}
+trap finish EXIT
+
+export GOBIN=${WORKDIR}/bin
+export PATH=${GOBIN}:${PATH}
+mkdir -p ${GOBIN}
+
+echo "remove existing generated files"
+# grpc_testing_not_regenerate/*.pb.go is not re-generated,
+# see grpc_testing_not_regenerate/README.md for details.
+rm -f $(find . -name '*.pb.go' | grep -v 'grpc_testing_not_regenerate')
+
+echo "go install google.golang.org/protobuf/cmd/protoc-gen-go"
+(cd test/tools && go install google.golang.org/protobuf/cmd/protoc-gen-go)
+
+echo "go install cmd/protoc-gen-go-grpc"
+(cd cmd/protoc-gen-go-grpc && go install .)
+
+echo "git clone https://github.com/grpc/grpc-proto"
+git clone --quiet https://github.com/grpc/grpc-proto ${WORKDIR}/grpc-proto
+
+echo "git clone https://github.com/protocolbuffers/protobuf"
+git clone --quiet https://github.com/protocolbuffers/protobuf ${WORKDIR}/protobuf
+
+# Pull in code.proto as a proto dependency
+mkdir -p ${WORKDIR}/googleapis/google/rpc
+echo "curl https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/code.proto"
+curl --silent https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/code.proto > ${WORKDIR}/googleapis/google/rpc/code.proto
+
+mkdir -p ${WORKDIR}/out
+
+# Generates sources without the embed requirement
+LEGACY_SOURCES=(
+  ${WORKDIR}/grpc-proto/grpc/binlog/v1/binarylog.proto
+  ${WORKDIR}/grpc-proto/grpc/channelz/v1/channelz.proto
+  ${WORKDIR}/grpc-proto/grpc/health/v1/health.proto
+  ${WORKDIR}/grpc-proto/grpc/lb/v1/load_balancer.proto
+  profiling/proto/service.proto
+  ${WORKDIR}/grpc-proto/grpc/reflection/v1alpha/reflection.proto
+  ${WORKDIR}/grpc-proto/grpc/reflection/v1/reflection.proto
+)
+
+# Generates only the new gRPC Service symbols
+SOURCES=(
+  $(git ls-files --exclude-standard --cached --others "*.proto" | grep -v '^\(profiling/proto/service.proto\|reflection/grpc_reflection_v1alpha/reflection.proto\)$')
+  ${WORKDIR}/grpc-proto/grpc/gcp/altscontext.proto
+  ${WORKDIR}/grpc-proto/grpc/gcp/handshaker.proto
+  ${WORKDIR}/grpc-proto/grpc/gcp/transport_security_common.proto
+  ${WORKDIR}/grpc-proto/grpc/lookup/v1/rls.proto
+  ${WORKDIR}/grpc-proto/grpc/lookup/v1/rls_config.proto
+  ${WORKDIR}/grpc-proto/grpc/testing/*.proto
+  ${WORKDIR}/grpc-proto/grpc/core/*.proto
+)
+
+# These options of the form 'Mfoo.proto=bar' instruct the codegen to use an
+# import path of 'bar' in the generated code when 'foo.proto' is imported in
+# one of the sources.
+#
+# Note that the protos listed here are all for testing purposes. All protos to
+# be used externally should have a go_package option (and they don't need to be
+# listed here).
+OPTS=Mgrpc/core/stats.proto=google.golang.org/grpc/interop/grpc_testing/core,\
+Mgrpc/testing/benchmark_service.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/stats.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/report_qps_scenario_service.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/messages.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/worker_service.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/control.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/test.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/payloads.proto=google.golang.org/grpc/interop/grpc_testing,\
+Mgrpc/testing/empty.proto=google.golang.org/grpc/interop/grpc_testing
+
+for src in ${SOURCES[@]}; do
+  echo "protoc ${src}"
+  protoc --go_out=${OPTS}:${WORKDIR}/out --go-grpc_out=${OPTS}:${WORKDIR}/out \
+    -I"." \
+    -I${WORKDIR}/grpc-proto \
+    -I${WORKDIR}/googleapis \
+    -I${WORKDIR}/protobuf/src \
+    ${src}
+done
+
+for src in ${LEGACY_SOURCES[@]}; do
+  echo "protoc ${src}"
+  protoc --go_out=${OPTS}:${WORKDIR}/out --go-grpc_out=${OPTS},require_unimplemented_servers=false:${WORKDIR}/out \
+    -I"." \
+    -I${WORKDIR}/grpc-proto \
+    -I${WORKDIR}/googleapis \
+    -I${WORKDIR}/protobuf/src \
+    ${src}
+done
+
+# The go_package option in grpc/lookup/v1/rls.proto doesn't match the
+# current location. Move it into the right place.
+mkdir -p ${WORKDIR}/out/google.golang.org/grpc/internal/proto/grpc_lookup_v1
+mv ${WORKDIR}/out/google.golang.org/grpc/lookup/grpc_lookup_v1/* ${WORKDIR}/out/google.golang.org/grpc/internal/proto/grpc_lookup_v1
+
+# grpc_testing_not_regenerate/*.pb.go are not re-generated,
+# see grpc_testing_not_regenerate/README.md for details.
+rm ${WORKDIR}/out/google.golang.org/grpc/reflection/grpc_testing_not_regenerate/*.pb.go
+
+cp -R ${WORKDIR}/out/google.golang.org/grpc/* .
diff --git a/vendor/google.golang.org/grpc/resolver/map.go b/vendor/google.golang.org/grpc/resolver/map.go
new file mode 100644
index 0000000000..efcb7f3efd
--- /dev/null
+++ b/vendor/google.golang.org/grpc/resolver/map.go
@@ -0,0 +1,138 @@
+/*
+ *
+ * Copyright 2021 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package resolver
+
+type addressMapEntry struct {
+	addr  Address
+	value interface{}
+}
+
+// AddressMap is a map of addresses to arbitrary values taking into account
+// Attributes.  BalancerAttributes are ignored, as are Metadata and Type.
+// Multiple accesses may not be performed concurrently.  Must be created via
+// NewAddressMap; do not construct directly.
+type AddressMap struct {
+	// The underlying map is keyed by an Address with fields that we don't care
+	// about being set to their zero values. The only fields that we care about
+	// are `Addr`, `ServerName` and `Attributes`. Since we need to be able to
+	// distinguish between addresses with same `Addr` and `ServerName`, but
+	// different `Attributes`, we cannot store the `Attributes` in the map key.
+	//
+	// The comparison operation for structs work as follows:
+	//  Struct values are comparable if all their fields are comparable. Two
+	//  struct values are equal if their corresponding non-blank fields are equal.
+	//
+	// The value type of the map contains a slice of addresses which match the key
+	// in their `Addr` and `ServerName` fields and contain the corresponding value
+	// associated with them.
+	m map[Address]addressMapEntryList
+}
+
+func toMapKey(addr *Address) Address {
+	return Address{Addr: addr.Addr, ServerName: addr.ServerName}
+}
+
+type addressMapEntryList []*addressMapEntry
+
+// NewAddressMap creates a new AddressMap.
+func NewAddressMap() *AddressMap {
+	return &AddressMap{m: make(map[Address]addressMapEntryList)}
+}
+
+// find returns the index of addr in the addressMapEntry slice, or -1 if not
+// present.
+func (l addressMapEntryList) find(addr Address) int {
+	for i, entry := range l {
+		// Attributes are the only thing to match on here, since `Addr` and
+		// `ServerName` are already equal.
+		if entry.addr.Attributes.Equal(addr.Attributes) {
+			return i
+		}
+	}
+	return -1
+}
+
+// Get returns the value for the address in the map, if present.
+func (a *AddressMap) Get(addr Address) (value interface{}, ok bool) {
+	addrKey := toMapKey(&addr)
+	entryList := a.m[addrKey]
+	if entry := entryList.find(addr); entry != -1 {
+		return entryList[entry].value, true
+	}
+	return nil, false
+}
+
+// Set updates or adds the value to the address in the map.
+func (a *AddressMap) Set(addr Address, value interface{}) {
+	addrKey := toMapKey(&addr)
+	entryList := a.m[addrKey]
+	if entry := entryList.find(addr); entry != -1 {
+		entryList[entry].value = value
+		return
+	}
+	a.m[addrKey] = append(entryList, &addressMapEntry{addr: addr, value: value})
+}
+
+// Delete removes addr from the map.
+func (a *AddressMap) Delete(addr Address) {
+	addrKey := toMapKey(&addr)
+	entryList := a.m[addrKey]
+	entry := entryList.find(addr)
+	if entry == -1 {
+		return
+	}
+	if len(entryList) == 1 {
+		entryList = nil
+	} else {
+		copy(entryList[entry:], entryList[entry+1:])
+		entryList = entryList[:len(entryList)-1]
+	}
+	a.m[addrKey] = entryList
+}
+
+// Len returns the number of entries in the map.
+func (a *AddressMap) Len() int {
+	ret := 0
+	for _, entryList := range a.m {
+		ret += len(entryList)
+	}
+	return ret
+}
+
+// Keys returns a slice of all current map keys.
+func (a *AddressMap) Keys() []Address {
+	ret := make([]Address, 0, a.Len())
+	for _, entryList := range a.m {
+		for _, entry := range entryList {
+			ret = append(ret, entry.addr)
+		}
+	}
+	return ret
+}
+
+// Values returns a slice of all current map values.
+func (a *AddressMap) Values() []interface{} {
+	ret := make([]interface{}, 0, a.Len())
+	for _, entryList := range a.m {
+		for _, entry := range entryList {
+			ret = append(ret, entry.value)
+		}
+	}
+	return ret
+}
diff --git a/vendor/google.golang.org/grpc/resolver/resolver.go b/vendor/google.golang.org/grpc/resolver/resolver.go
new file mode 100644
index 0000000000..6215e5ef2b
--- /dev/null
+++ b/vendor/google.golang.org/grpc/resolver/resolver.go
@@ -0,0 +1,320 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package resolver defines APIs for name resolution in gRPC.
+// All APIs in this package are experimental.
+package resolver
+
+import (
+	"context"
+	"net"
+	"net/url"
+	"strings"
+
+	"google.golang.org/grpc/attributes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/pretty"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+var (
+	// m is a map from scheme to resolver builder.
+	m = make(map[string]Builder)
+	// defaultScheme is the default scheme to use.
+	defaultScheme = "passthrough"
+)
+
+// TODO(bar) install dns resolver in init(){}.
+
+// Register registers the resolver builder to the resolver map. b.Scheme will
+// be used as the scheme registered with this builder. The registry is case
+// sensitive, and schemes should not contain any uppercase characters.
+//
+// NOTE: this function must only be called during initialization time (i.e. in
+// an init() function), and is not thread-safe. If multiple Resolvers are
+// registered with the same name, the one registered last will take effect.
+func Register(b Builder) {
+	m[b.Scheme()] = b
+}
+
+// Get returns the resolver builder registered with the given scheme.
+//
+// If no builder is register with the scheme, nil will be returned.
+func Get(scheme string) Builder {
+	if b, ok := m[scheme]; ok {
+		return b
+	}
+	return nil
+}
+
+// SetDefaultScheme sets the default scheme that will be used. The default
+// default scheme is "passthrough".
+//
+// NOTE: this function must only be called during initialization time (i.e. in
+// an init() function), and is not thread-safe. The scheme set last overrides
+// previously set values.
+func SetDefaultScheme(scheme string) {
+	defaultScheme = scheme
+}
+
+// GetDefaultScheme gets the default scheme that will be used.
+func GetDefaultScheme() string {
+	return defaultScheme
+}
+
+// AddressType indicates the address type returned by name resolution.
+//
+// Deprecated: use Attributes in Address instead.
+type AddressType uint8
+
+const (
+	// Backend indicates the address is for a backend server.
+	//
+	// Deprecated: use Attributes in Address instead.
+	Backend AddressType = iota
+	// GRPCLB indicates the address is for a grpclb load balancer.
+	//
+	// Deprecated: to select the GRPCLB load balancing policy, use a service
+	// config with a corresponding loadBalancingConfig.  To supply balancer
+	// addresses to the GRPCLB load balancing policy, set State.Attributes
+	// using balancer/grpclb/state.Set.
+	GRPCLB
+)
+
+// Address represents a server the client connects to.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type Address struct {
+	// Addr is the server address on which a connection will be established.
+	Addr string
+
+	// ServerName is the name of this address.
+	// If non-empty, the ServerName is used as the transport certification authority for
+	// the address, instead of the hostname from the Dial target string. In most cases,
+	// this should not be set.
+	//
+	// If Type is GRPCLB, ServerName should be the name of the remote load
+	// balancer, not the name of the backend.
+	//
+	// WARNING: ServerName must only be populated with trusted values. It
+	// is insecure to populate it with data from untrusted inputs since untrusted
+	// values could be used to bypass the authority checks performed by TLS.
+	ServerName string
+
+	// Attributes contains arbitrary data about this address intended for
+	// consumption by the SubConn.
+	Attributes *attributes.Attributes
+
+	// BalancerAttributes contains arbitrary data about this address intended
+	// for consumption by the LB policy.  These attribes do not affect SubConn
+	// creation, connection establishment, handshaking, etc.
+	BalancerAttributes *attributes.Attributes
+
+	// Type is the type of this address.
+	//
+	// Deprecated: use Attributes instead.
+	Type AddressType
+
+	// Metadata is the information associated with Addr, which may be used
+	// to make load balancing decision.
+	//
+	// Deprecated: use Attributes instead.
+	Metadata interface{}
+}
+
+// Equal returns whether a and o are identical.  Metadata is compared directly,
+// not with any recursive introspection.
+func (a Address) Equal(o Address) bool {
+	return a.Addr == o.Addr && a.ServerName == o.ServerName &&
+		a.Attributes.Equal(o.Attributes) &&
+		a.BalancerAttributes.Equal(o.BalancerAttributes) &&
+		a.Type == o.Type && a.Metadata == o.Metadata
+}
+
+// String returns JSON formatted string representation of the address.
+func (a Address) String() string {
+	return pretty.ToJSON(a)
+}
+
+// BuildOptions includes additional information for the builder to create
+// the resolver.
+type BuildOptions struct {
+	// DisableServiceConfig indicates whether a resolver implementation should
+	// fetch service config data.
+	DisableServiceConfig bool
+	// DialCreds is the transport credentials used by the ClientConn for
+	// communicating with the target gRPC service (set via
+	// WithTransportCredentials). In cases where a name resolution service
+	// requires the same credentials, the resolver may use this field. In most
+	// cases though, it is not appropriate, and this field may be ignored.
+	DialCreds credentials.TransportCredentials
+	// CredsBundle is the credentials bundle used by the ClientConn for
+	// communicating with the target gRPC service (set via
+	// WithCredentialsBundle). In cases where a name resolution service
+	// requires the same credentials, the resolver may use this field. In most
+	// cases though, it is not appropriate, and this field may be ignored.
+	CredsBundle credentials.Bundle
+	// Dialer is the custom dialer used by the ClientConn for dialling the
+	// target gRPC service (set via WithDialer). In cases where a name
+	// resolution service requires the same dialer, the resolver may use this
+	// field. In most cases though, it is not appropriate, and this field may
+	// be ignored.
+	Dialer func(context.Context, string) (net.Conn, error)
+}
+
+// State contains the current Resolver state relevant to the ClientConn.
+type State struct {
+	// Addresses is the latest set of resolved addresses for the target.
+	Addresses []Address
+
+	// ServiceConfig contains the result from parsing the latest service
+	// config.  If it is nil, it indicates no service config is present or the
+	// resolver does not provide service configs.
+	ServiceConfig *serviceconfig.ParseResult
+
+	// Attributes contains arbitrary data about the resolver intended for
+	// consumption by the load balancing policy.
+	Attributes *attributes.Attributes
+}
+
+// ClientConn contains the callbacks for resolver to notify any updates
+// to the gRPC ClientConn.
+//
+// This interface is to be implemented by gRPC. Users should not need a
+// brand new implementation of this interface. For the situations like
+// testing, the new implementation should embed this interface. This allows
+// gRPC to add new methods to this interface.
+type ClientConn interface {
+	// UpdateState updates the state of the ClientConn appropriately.
+	//
+	// If an error is returned, the resolver should try to resolve the
+	// target again. The resolver should use a backoff timer to prevent
+	// overloading the server with requests. If a resolver is certain that
+	// reresolving will not change the result, e.g. because it is
+	// a watch-based resolver, returned errors can be ignored.
+	//
+	// If the resolved State is the same as the last reported one, calling
+	// UpdateState can be omitted.
+	UpdateState(State) error
+	// ReportError notifies the ClientConn that the Resolver encountered an
+	// error.  The ClientConn will notify the load balancer and begin calling
+	// ResolveNow on the Resolver with exponential backoff.
+	ReportError(error)
+	// NewAddress is called by resolver to notify ClientConn a new list
+	// of resolved addresses.
+	// The address list should be the complete list of resolved addresses.
+	//
+	// Deprecated: Use UpdateState instead.
+	NewAddress(addresses []Address)
+	// NewServiceConfig is called by resolver to notify ClientConn a new
+	// service config. The service config should be provided as a json string.
+	//
+	// Deprecated: Use UpdateState instead.
+	NewServiceConfig(serviceConfig string)
+	// ParseServiceConfig parses the provided service config and returns an
+	// object that provides the parsed config.
+	ParseServiceConfig(serviceConfigJSON string) *serviceconfig.ParseResult
+}
+
+// Target represents a target for gRPC, as specified in:
+// https://github.com/grpc/grpc/blob/master/doc/naming.md.
+// It is parsed from the target string that gets passed into Dial or DialContext
+// by the user. And gRPC passes it to the resolver and the balancer.
+//
+// If the target follows the naming spec, and the parsed scheme is registered
+// with gRPC, we will parse the target string according to the spec. If the
+// target does not contain a scheme or if the parsed scheme is not registered
+// (i.e. no corresponding resolver available to resolve the endpoint), we will
+// apply the default scheme, and will attempt to reparse it.
+//
+// Examples:
+//
+//   - "dns://some_authority/foo.bar"
+//     Target{Scheme: "dns", Authority: "some_authority", Endpoint: "foo.bar"}
+//   - "foo.bar"
+//     Target{Scheme: resolver.GetDefaultScheme(), Endpoint: "foo.bar"}
+//   - "unknown_scheme://authority/endpoint"
+//     Target{Scheme: resolver.GetDefaultScheme(), Endpoint: "unknown_scheme://authority/endpoint"}
+type Target struct {
+	// Deprecated: use URL.Scheme instead.
+	Scheme string
+	// Deprecated: use URL.Host instead.
+	Authority string
+	// URL contains the parsed dial target with an optional default scheme added
+	// to it if the original dial target contained no scheme or contained an
+	// unregistered scheme. Any query params specified in the original dial
+	// target can be accessed from here.
+	URL url.URL
+}
+
+// Endpoint retrieves endpoint without leading "/" from either `URL.Path`
+// or `URL.Opaque`. The latter is used when the former is empty.
+func (t Target) Endpoint() string {
+	endpoint := t.URL.Path
+	if endpoint == "" {
+		endpoint = t.URL.Opaque
+	}
+	// For targets of the form "[scheme]://[authority]/endpoint, the endpoint
+	// value returned from url.Parse() contains a leading "/". Although this is
+	// in accordance with RFC 3986, we do not want to break existing resolver
+	// implementations which expect the endpoint without the leading "/". So, we
+	// end up stripping the leading "/" here. But this will result in an
+	// incorrect parsing for something like "unix:///path/to/socket". Since we
+	// own the "unix" resolver, we can workaround in the unix resolver by using
+	// the `URL` field.
+	return strings.TrimPrefix(endpoint, "/")
+}
+
+// Builder creates a resolver that will be used to watch name resolution updates.
+type Builder interface {
+	// Build creates a new resolver for the given target.
+	//
+	// gRPC dial calls Build synchronously, and fails if the returned error is
+	// not nil.
+	Build(target Target, cc ClientConn, opts BuildOptions) (Resolver, error)
+	// Scheme returns the scheme supported by this resolver.  Scheme is defined
+	// at https://github.com/grpc/grpc/blob/master/doc/naming.md.  The returned
+	// string should not contain uppercase characters, as they will not match
+	// the parsed target's scheme as defined in RFC 3986.
+	Scheme() string
+}
+
+// ResolveNowOptions includes additional information for ResolveNow.
+type ResolveNowOptions struct{}
+
+// Resolver watches for the updates on the specified target.
+// Updates include address updates and service config updates.
+type Resolver interface {
+	// ResolveNow will be called by gRPC to try to resolve the target name
+	// again. It's just a hint, resolver can ignore this if it's not necessary.
+	//
+	// It could be called multiple times concurrently.
+	ResolveNow(ResolveNowOptions)
+	// Close closes the resolver.
+	Close()
+}
+
+// UnregisterForTesting removes the resolver builder with the given scheme from the
+// resolver map.
+// This function is for testing only.
+func UnregisterForTesting(scheme string) {
+	delete(m, scheme)
+}
diff --git a/vendor/google.golang.org/grpc/resolver_conn_wrapper.go b/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
new file mode 100644
index 0000000000..05a9d4e0ba
--- /dev/null
+++ b/vendor/google.golang.org/grpc/resolver_conn_wrapper.go
@@ -0,0 +1,176 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"strings"
+	"sync"
+
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/internal/pretty"
+	"google.golang.org/grpc/resolver"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+// ccResolverWrapper is a wrapper on top of cc for resolvers.
+// It implements resolver.ClientConn interface.
+type ccResolverWrapper struct {
+	cc         *ClientConn
+	resolverMu sync.Mutex
+	resolver   resolver.Resolver
+	done       *grpcsync.Event
+	curState   resolver.State
+
+	incomingMu sync.Mutex // Synchronizes all the incoming calls.
+}
+
+// newCCResolverWrapper uses the resolver.Builder to build a Resolver and
+// returns a ccResolverWrapper object which wraps the newly built resolver.
+func newCCResolverWrapper(cc *ClientConn, rb resolver.Builder) (*ccResolverWrapper, error) {
+	ccr := &ccResolverWrapper{
+		cc:   cc,
+		done: grpcsync.NewEvent(),
+	}
+
+	var credsClone credentials.TransportCredentials
+	if creds := cc.dopts.copts.TransportCredentials; creds != nil {
+		credsClone = creds.Clone()
+	}
+	rbo := resolver.BuildOptions{
+		DisableServiceConfig: cc.dopts.disableServiceConfig,
+		DialCreds:            credsClone,
+		CredsBundle:          cc.dopts.copts.CredsBundle,
+		Dialer:               cc.dopts.copts.Dialer,
+	}
+
+	var err error
+	// We need to hold the lock here while we assign to the ccr.resolver field
+	// to guard against a data race caused by the following code path,
+	// rb.Build-->ccr.ReportError-->ccr.poll-->ccr.resolveNow, would end up
+	// accessing ccr.resolver which is being assigned here.
+	ccr.resolverMu.Lock()
+	defer ccr.resolverMu.Unlock()
+	ccr.resolver, err = rb.Build(cc.parsedTarget, ccr, rbo)
+	if err != nil {
+		return nil, err
+	}
+	return ccr, nil
+}
+
+func (ccr *ccResolverWrapper) resolveNow(o resolver.ResolveNowOptions) {
+	ccr.resolverMu.Lock()
+	if !ccr.done.HasFired() {
+		ccr.resolver.ResolveNow(o)
+	}
+	ccr.resolverMu.Unlock()
+}
+
+func (ccr *ccResolverWrapper) close() {
+	ccr.resolverMu.Lock()
+	ccr.resolver.Close()
+	ccr.done.Fire()
+	ccr.resolverMu.Unlock()
+}
+
+func (ccr *ccResolverWrapper) UpdateState(s resolver.State) error {
+	ccr.incomingMu.Lock()
+	defer ccr.incomingMu.Unlock()
+	if ccr.done.HasFired() {
+		return nil
+	}
+	ccr.addChannelzTraceEvent(s)
+	ccr.curState = s
+	if err := ccr.cc.updateResolverState(ccr.curState, nil); err == balancer.ErrBadResolverState {
+		return balancer.ErrBadResolverState
+	}
+	return nil
+}
+
+func (ccr *ccResolverWrapper) ReportError(err error) {
+	ccr.incomingMu.Lock()
+	defer ccr.incomingMu.Unlock()
+	if ccr.done.HasFired() {
+		return
+	}
+	channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: reporting error to cc: %v", err)
+	ccr.cc.updateResolverState(resolver.State{}, err)
+}
+
+// NewAddress is called by the resolver implementation to send addresses to gRPC.
+func (ccr *ccResolverWrapper) NewAddress(addrs []resolver.Address) {
+	ccr.incomingMu.Lock()
+	defer ccr.incomingMu.Unlock()
+	if ccr.done.HasFired() {
+		return
+	}
+	ccr.addChannelzTraceEvent(resolver.State{Addresses: addrs, ServiceConfig: ccr.curState.ServiceConfig})
+	ccr.curState.Addresses = addrs
+	ccr.cc.updateResolverState(ccr.curState, nil)
+}
+
+// NewServiceConfig is called by the resolver implementation to send service
+// configs to gRPC.
+func (ccr *ccResolverWrapper) NewServiceConfig(sc string) {
+	ccr.incomingMu.Lock()
+	defer ccr.incomingMu.Unlock()
+	if ccr.done.HasFired() {
+		return
+	}
+	channelz.Infof(logger, ccr.cc.channelzID, "ccResolverWrapper: got new service config: %s", sc)
+	if ccr.cc.dopts.disableServiceConfig {
+		channelz.Info(logger, ccr.cc.channelzID, "Service config lookups disabled; ignoring config")
+		return
+	}
+	scpr := parseServiceConfig(sc)
+	if scpr.Err != nil {
+		channelz.Warningf(logger, ccr.cc.channelzID, "ccResolverWrapper: error parsing service config: %v", scpr.Err)
+		return
+	}
+	ccr.addChannelzTraceEvent(resolver.State{Addresses: ccr.curState.Addresses, ServiceConfig: scpr})
+	ccr.curState.ServiceConfig = scpr
+	ccr.cc.updateResolverState(ccr.curState, nil)
+}
+
+func (ccr *ccResolverWrapper) ParseServiceConfig(scJSON string) *serviceconfig.ParseResult {
+	return parseServiceConfig(scJSON)
+}
+
+func (ccr *ccResolverWrapper) addChannelzTraceEvent(s resolver.State) {
+	var updates []string
+	var oldSC, newSC *ServiceConfig
+	var oldOK, newOK bool
+	if ccr.curState.ServiceConfig != nil {
+		oldSC, oldOK = ccr.curState.ServiceConfig.Config.(*ServiceConfig)
+	}
+	if s.ServiceConfig != nil {
+		newSC, newOK = s.ServiceConfig.Config.(*ServiceConfig)
+	}
+	if oldOK != newOK || (oldOK && newOK && oldSC.rawJSONString != newSC.rawJSONString) {
+		updates = append(updates, "service config updated")
+	}
+	if len(ccr.curState.Addresses) > 0 && len(s.Addresses) == 0 {
+		updates = append(updates, "resolver returned an empty address list")
+	} else if len(ccr.curState.Addresses) == 0 && len(s.Addresses) > 0 {
+		updates = append(updates, "resolver returned new addresses")
+	}
+	channelz.Infof(logger, ccr.cc.channelzID, "Resolver state updated: %s (%v)", pretty.ToJSON(s), strings.Join(updates, "; "))
+}
diff --git a/vendor/google.golang.org/grpc/rpc_util.go b/vendor/google.golang.org/grpc/rpc_util.go
new file mode 100644
index 0000000000..2030736a30
--- /dev/null
+++ b/vendor/google.golang.org/grpc/rpc_util.go
@@ -0,0 +1,953 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"bytes"
+	"compress/gzip"
+	"context"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"math"
+	"strings"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/encoding/proto"
+	"google.golang.org/grpc/internal/transport"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+)
+
+// Compressor defines the interface gRPC uses to compress a message.
+//
+// Deprecated: use package encoding.
+type Compressor interface {
+	// Do compresses p into w.
+	Do(w io.Writer, p []byte) error
+	// Type returns the compression algorithm the Compressor uses.
+	Type() string
+}
+
+type gzipCompressor struct {
+	pool sync.Pool
+}
+
+// NewGZIPCompressor creates a Compressor based on GZIP.
+//
+// Deprecated: use package encoding/gzip.
+func NewGZIPCompressor() Compressor {
+	c, _ := NewGZIPCompressorWithLevel(gzip.DefaultCompression)
+	return c
+}
+
+// NewGZIPCompressorWithLevel is like NewGZIPCompressor but specifies the gzip compression level instead
+// of assuming DefaultCompression.
+//
+// The error returned will be nil if the level is valid.
+//
+// Deprecated: use package encoding/gzip.
+func NewGZIPCompressorWithLevel(level int) (Compressor, error) {
+	if level < gzip.DefaultCompression || level > gzip.BestCompression {
+		return nil, fmt.Errorf("grpc: invalid compression level: %d", level)
+	}
+	return &gzipCompressor{
+		pool: sync.Pool{
+			New: func() interface{} {
+				w, err := gzip.NewWriterLevel(io.Discard, level)
+				if err != nil {
+					panic(err)
+				}
+				return w
+			},
+		},
+	}, nil
+}
+
+func (c *gzipCompressor) Do(w io.Writer, p []byte) error {
+	z := c.pool.Get().(*gzip.Writer)
+	defer c.pool.Put(z)
+	z.Reset(w)
+	if _, err := z.Write(p); err != nil {
+		return err
+	}
+	return z.Close()
+}
+
+func (c *gzipCompressor) Type() string {
+	return "gzip"
+}
+
+// Decompressor defines the interface gRPC uses to decompress a message.
+//
+// Deprecated: use package encoding.
+type Decompressor interface {
+	// Do reads the data from r and uncompress them.
+	Do(r io.Reader) ([]byte, error)
+	// Type returns the compression algorithm the Decompressor uses.
+	Type() string
+}
+
+type gzipDecompressor struct {
+	pool sync.Pool
+}
+
+// NewGZIPDecompressor creates a Decompressor based on GZIP.
+//
+// Deprecated: use package encoding/gzip.
+func NewGZIPDecompressor() Decompressor {
+	return &gzipDecompressor{}
+}
+
+func (d *gzipDecompressor) Do(r io.Reader) ([]byte, error) {
+	var z *gzip.Reader
+	switch maybeZ := d.pool.Get().(type) {
+	case nil:
+		newZ, err := gzip.NewReader(r)
+		if err != nil {
+			return nil, err
+		}
+		z = newZ
+	case *gzip.Reader:
+		z = maybeZ
+		if err := z.Reset(r); err != nil {
+			d.pool.Put(z)
+			return nil, err
+		}
+	}
+
+	defer func() {
+		z.Close()
+		d.pool.Put(z)
+	}()
+	return io.ReadAll(z)
+}
+
+func (d *gzipDecompressor) Type() string {
+	return "gzip"
+}
+
+// callInfo contains all related configuration and information about an RPC.
+type callInfo struct {
+	compressorType        string
+	failFast              bool
+	maxReceiveMessageSize *int
+	maxSendMessageSize    *int
+	creds                 credentials.PerRPCCredentials
+	contentSubtype        string
+	codec                 baseCodec
+	maxRetryRPCBufferSize int
+	onFinish              []func(err error)
+}
+
+func defaultCallInfo() *callInfo {
+	return &callInfo{
+		failFast:              true,
+		maxRetryRPCBufferSize: 256 * 1024, // 256KB
+	}
+}
+
+// CallOption configures a Call before it starts or extracts information from
+// a Call after it completes.
+type CallOption interface {
+	// before is called before the call is sent to any server.  If before
+	// returns a non-nil error, the RPC fails with that error.
+	before(*callInfo) error
+
+	// after is called after the call has completed.  after cannot return an
+	// error, so any failures should be reported via output parameters.
+	after(*callInfo, *csAttempt)
+}
+
+// EmptyCallOption does not alter the Call configuration.
+// It can be embedded in another structure to carry satellite data for use
+// by interceptors.
+type EmptyCallOption struct{}
+
+func (EmptyCallOption) before(*callInfo) error      { return nil }
+func (EmptyCallOption) after(*callInfo, *csAttempt) {}
+
+// Header returns a CallOptions that retrieves the header metadata
+// for a unary RPC.
+func Header(md *metadata.MD) CallOption {
+	return HeaderCallOption{HeaderAddr: md}
+}
+
+// HeaderCallOption is a CallOption for collecting response header metadata.
+// The metadata field will be populated *after* the RPC completes.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type HeaderCallOption struct {
+	HeaderAddr *metadata.MD
+}
+
+func (o HeaderCallOption) before(c *callInfo) error { return nil }
+func (o HeaderCallOption) after(c *callInfo, attempt *csAttempt) {
+	*o.HeaderAddr, _ = attempt.s.Header()
+}
+
+// Trailer returns a CallOptions that retrieves the trailer metadata
+// for a unary RPC.
+func Trailer(md *metadata.MD) CallOption {
+	return TrailerCallOption{TrailerAddr: md}
+}
+
+// TrailerCallOption is a CallOption for collecting response trailer metadata.
+// The metadata field will be populated *after* the RPC completes.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type TrailerCallOption struct {
+	TrailerAddr *metadata.MD
+}
+
+func (o TrailerCallOption) before(c *callInfo) error { return nil }
+func (o TrailerCallOption) after(c *callInfo, attempt *csAttempt) {
+	*o.TrailerAddr = attempt.s.Trailer()
+}
+
+// Peer returns a CallOption that retrieves peer information for a unary RPC.
+// The peer field will be populated *after* the RPC completes.
+func Peer(p *peer.Peer) CallOption {
+	return PeerCallOption{PeerAddr: p}
+}
+
+// PeerCallOption is a CallOption for collecting the identity of the remote
+// peer. The peer field will be populated *after* the RPC completes.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type PeerCallOption struct {
+	PeerAddr *peer.Peer
+}
+
+func (o PeerCallOption) before(c *callInfo) error { return nil }
+func (o PeerCallOption) after(c *callInfo, attempt *csAttempt) {
+	if x, ok := peer.FromContext(attempt.s.Context()); ok {
+		*o.PeerAddr = *x
+	}
+}
+
+// WaitForReady configures the action to take when an RPC is attempted on broken
+// connections or unreachable servers. If waitForReady is false and the
+// connection is in the TRANSIENT_FAILURE state, the RPC will fail
+// immediately. Otherwise, the RPC client will block the call until a
+// connection is available (or the call is canceled or times out) and will
+// retry the call if it fails due to a transient error.  gRPC will not retry if
+// data was written to the wire unless the server indicates it did not process
+// the data.  Please refer to
+// https://github.com/grpc/grpc/blob/master/doc/wait-for-ready.md.
+//
+// By default, RPCs don't "wait for ready".
+func WaitForReady(waitForReady bool) CallOption {
+	return FailFastCallOption{FailFast: !waitForReady}
+}
+
+// FailFast is the opposite of WaitForReady.
+//
+// Deprecated: use WaitForReady.
+func FailFast(failFast bool) CallOption {
+	return FailFastCallOption{FailFast: failFast}
+}
+
+// FailFastCallOption is a CallOption for indicating whether an RPC should fail
+// fast or not.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type FailFastCallOption struct {
+	FailFast bool
+}
+
+func (o FailFastCallOption) before(c *callInfo) error {
+	c.failFast = o.FailFast
+	return nil
+}
+func (o FailFastCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// OnFinish returns a CallOption that configures a callback to be called when
+// the call completes. The error passed to the callback is the status of the
+// RPC, and may be nil. The onFinish callback provided will only be called once
+// by gRPC. This is mainly used to be used by streaming interceptors, to be
+// notified when the RPC completes along with information about the status of
+// the RPC.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func OnFinish(onFinish func(err error)) CallOption {
+	return OnFinishCallOption{
+		OnFinish: onFinish,
+	}
+}
+
+// OnFinishCallOption is CallOption that indicates a callback to be called when
+// the call completes.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type OnFinishCallOption struct {
+	OnFinish func(error)
+}
+
+func (o OnFinishCallOption) before(c *callInfo) error {
+	c.onFinish = append(c.onFinish, o.OnFinish)
+	return nil
+}
+
+func (o OnFinishCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// MaxCallRecvMsgSize returns a CallOption which sets the maximum message size
+// in bytes the client can receive. If this is not set, gRPC uses the default
+// 4MB.
+func MaxCallRecvMsgSize(bytes int) CallOption {
+	return MaxRecvMsgSizeCallOption{MaxRecvMsgSize: bytes}
+}
+
+// MaxRecvMsgSizeCallOption is a CallOption that indicates the maximum message
+// size in bytes the client can receive.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type MaxRecvMsgSizeCallOption struct {
+	MaxRecvMsgSize int
+}
+
+func (o MaxRecvMsgSizeCallOption) before(c *callInfo) error {
+	c.maxReceiveMessageSize = &o.MaxRecvMsgSize
+	return nil
+}
+func (o MaxRecvMsgSizeCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// MaxCallSendMsgSize returns a CallOption which sets the maximum message size
+// in bytes the client can send. If this is not set, gRPC uses the default
+// `math.MaxInt32`.
+func MaxCallSendMsgSize(bytes int) CallOption {
+	return MaxSendMsgSizeCallOption{MaxSendMsgSize: bytes}
+}
+
+// MaxSendMsgSizeCallOption is a CallOption that indicates the maximum message
+// size in bytes the client can send.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type MaxSendMsgSizeCallOption struct {
+	MaxSendMsgSize int
+}
+
+func (o MaxSendMsgSizeCallOption) before(c *callInfo) error {
+	c.maxSendMessageSize = &o.MaxSendMsgSize
+	return nil
+}
+func (o MaxSendMsgSizeCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// PerRPCCredentials returns a CallOption that sets credentials.PerRPCCredentials
+// for a call.
+func PerRPCCredentials(creds credentials.PerRPCCredentials) CallOption {
+	return PerRPCCredsCallOption{Creds: creds}
+}
+
+// PerRPCCredsCallOption is a CallOption that indicates the per-RPC
+// credentials to use for the call.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type PerRPCCredsCallOption struct {
+	Creds credentials.PerRPCCredentials
+}
+
+func (o PerRPCCredsCallOption) before(c *callInfo) error {
+	c.creds = o.Creds
+	return nil
+}
+func (o PerRPCCredsCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// UseCompressor returns a CallOption which sets the compressor used when
+// sending the request.  If WithCompressor is also set, UseCompressor has
+// higher priority.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func UseCompressor(name string) CallOption {
+	return CompressorCallOption{CompressorType: name}
+}
+
+// CompressorCallOption is a CallOption that indicates the compressor to use.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type CompressorCallOption struct {
+	CompressorType string
+}
+
+func (o CompressorCallOption) before(c *callInfo) error {
+	c.compressorType = o.CompressorType
+	return nil
+}
+func (o CompressorCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// CallContentSubtype returns a CallOption that will set the content-subtype
+// for a call. For example, if content-subtype is "json", the Content-Type over
+// the wire will be "application/grpc+json". The content-subtype is converted
+// to lowercase before being included in Content-Type. See Content-Type on
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests for
+// more details.
+//
+// If ForceCodec is not also used, the content-subtype will be used to look up
+// the Codec to use in the registry controlled by RegisterCodec. See the
+// documentation on RegisterCodec for details on registration. The lookup of
+// content-subtype is case-insensitive. If no such Codec is found, the call
+// will result in an error with code codes.Internal.
+//
+// If ForceCodec is also used, that Codec will be used for all request and
+// response messages, with the content-subtype set to the given contentSubtype
+// here for requests.
+func CallContentSubtype(contentSubtype string) CallOption {
+	return ContentSubtypeCallOption{ContentSubtype: strings.ToLower(contentSubtype)}
+}
+
+// ContentSubtypeCallOption is a CallOption that indicates the content-subtype
+// used for marshaling messages.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type ContentSubtypeCallOption struct {
+	ContentSubtype string
+}
+
+func (o ContentSubtypeCallOption) before(c *callInfo) error {
+	c.contentSubtype = o.ContentSubtype
+	return nil
+}
+func (o ContentSubtypeCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// ForceCodec returns a CallOption that will set codec to be used for all
+// request and response messages for a call. The result of calling Name() will
+// be used as the content-subtype after converting to lowercase, unless
+// CallContentSubtype is also used.
+//
+// See Content-Type on
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests for
+// more details. Also see the documentation on RegisterCodec and
+// CallContentSubtype for more details on the interaction between Codec and
+// content-subtype.
+//
+// This function is provided for advanced users; prefer to use only
+// CallContentSubtype to select a registered codec instead.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ForceCodec(codec encoding.Codec) CallOption {
+	return ForceCodecCallOption{Codec: codec}
+}
+
+// ForceCodecCallOption is a CallOption that indicates the codec used for
+// marshaling messages.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type ForceCodecCallOption struct {
+	Codec encoding.Codec
+}
+
+func (o ForceCodecCallOption) before(c *callInfo) error {
+	c.codec = o.Codec
+	return nil
+}
+func (o ForceCodecCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// CallCustomCodec behaves like ForceCodec, but accepts a grpc.Codec instead of
+// an encoding.Codec.
+//
+// Deprecated: use ForceCodec instead.
+func CallCustomCodec(codec Codec) CallOption {
+	return CustomCodecCallOption{Codec: codec}
+}
+
+// CustomCodecCallOption is a CallOption that indicates the codec used for
+// marshaling messages.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type CustomCodecCallOption struct {
+	Codec Codec
+}
+
+func (o CustomCodecCallOption) before(c *callInfo) error {
+	c.codec = o.Codec
+	return nil
+}
+func (o CustomCodecCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// MaxRetryRPCBufferSize returns a CallOption that limits the amount of memory
+// used for buffering this RPC's requests for retry purposes.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func MaxRetryRPCBufferSize(bytes int) CallOption {
+	return MaxRetryRPCBufferSizeCallOption{bytes}
+}
+
+// MaxRetryRPCBufferSizeCallOption is a CallOption indicating the amount of
+// memory to be used for caching this RPC for retry purposes.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type MaxRetryRPCBufferSizeCallOption struct {
+	MaxRetryRPCBufferSize int
+}
+
+func (o MaxRetryRPCBufferSizeCallOption) before(c *callInfo) error {
+	c.maxRetryRPCBufferSize = o.MaxRetryRPCBufferSize
+	return nil
+}
+func (o MaxRetryRPCBufferSizeCallOption) after(c *callInfo, attempt *csAttempt) {}
+
+// The format of the payload: compressed or not?
+type payloadFormat uint8
+
+const (
+	compressionNone payloadFormat = 0 // no compression
+	compressionMade payloadFormat = 1 // compressed
+)
+
+// parser reads complete gRPC messages from the underlying reader.
+type parser struct {
+	// r is the underlying reader.
+	// See the comment on recvMsg for the permissible
+	// error types.
+	r io.Reader
+
+	// The header of a gRPC message. Find more detail at
+	// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md
+	header [5]byte
+}
+
+// recvMsg reads a complete gRPC message from the stream.
+//
+// It returns the message and its payload (compression/encoding)
+// format. The caller owns the returned msg memory.
+//
+// If there is an error, possible values are:
+//   - io.EOF, when no messages remain
+//   - io.ErrUnexpectedEOF
+//   - of type transport.ConnectionError
+//   - an error from the status package
+//
+// No other error values or types must be returned, which also means
+// that the underlying io.Reader must not return an incompatible
+// error.
+func (p *parser) recvMsg(maxReceiveMessageSize int) (pf payloadFormat, msg []byte, err error) {
+	if _, err := p.r.Read(p.header[:]); err != nil {
+		return 0, nil, err
+	}
+
+	pf = payloadFormat(p.header[0])
+	length := binary.BigEndian.Uint32(p.header[1:])
+
+	if length == 0 {
+		return pf, nil, nil
+	}
+	if int64(length) > int64(maxInt) {
+		return 0, nil, status.Errorf(codes.ResourceExhausted, "grpc: received message larger than max length allowed on current machine (%d vs. %d)", length, maxInt)
+	}
+	if int(length) > maxReceiveMessageSize {
+		return 0, nil, status.Errorf(codes.ResourceExhausted, "grpc: received message larger than max (%d vs. %d)", length, maxReceiveMessageSize)
+	}
+	// TODO(bradfitz,zhaoq): garbage. reuse buffer after proto decoding instead
+	// of making it for each message:
+	msg = make([]byte, int(length))
+	if _, err := p.r.Read(msg); err != nil {
+		if err == io.EOF {
+			err = io.ErrUnexpectedEOF
+		}
+		return 0, nil, err
+	}
+	return pf, msg, nil
+}
+
+// encode serializes msg and returns a buffer containing the message, or an
+// error if it is too large to be transmitted by grpc.  If msg is nil, it
+// generates an empty message.
+func encode(c baseCodec, msg interface{}) ([]byte, error) {
+	if msg == nil { // NOTE: typed nils will not be caught by this check
+		return nil, nil
+	}
+	b, err := c.Marshal(msg)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "grpc: error while marshaling: %v", err.Error())
+	}
+	if uint(len(b)) > math.MaxUint32 {
+		return nil, status.Errorf(codes.ResourceExhausted, "grpc: message too large (%d bytes)", len(b))
+	}
+	return b, nil
+}
+
+// compress returns the input bytes compressed by compressor or cp.  If both
+// compressors are nil, returns nil.
+//
+// TODO(dfawley): eliminate cp parameter by wrapping Compressor in an encoding.Compressor.
+func compress(in []byte, cp Compressor, compressor encoding.Compressor) ([]byte, error) {
+	if compressor == nil && cp == nil {
+		return nil, nil
+	}
+	wrapErr := func(err error) error {
+		return status.Errorf(codes.Internal, "grpc: error while compressing: %v", err.Error())
+	}
+	cbuf := &bytes.Buffer{}
+	if compressor != nil {
+		z, err := compressor.Compress(cbuf)
+		if err != nil {
+			return nil, wrapErr(err)
+		}
+		if _, err := z.Write(in); err != nil {
+			return nil, wrapErr(err)
+		}
+		if err := z.Close(); err != nil {
+			return nil, wrapErr(err)
+		}
+	} else {
+		if err := cp.Do(cbuf, in); err != nil {
+			return nil, wrapErr(err)
+		}
+	}
+	return cbuf.Bytes(), nil
+}
+
+const (
+	payloadLen = 1
+	sizeLen    = 4
+	headerLen  = payloadLen + sizeLen
+)
+
+// msgHeader returns a 5-byte header for the message being transmitted and the
+// payload, which is compData if non-nil or data otherwise.
+func msgHeader(data, compData []byte) (hdr []byte, payload []byte) {
+	hdr = make([]byte, headerLen)
+	if compData != nil {
+		hdr[0] = byte(compressionMade)
+		data = compData
+	} else {
+		hdr[0] = byte(compressionNone)
+	}
+
+	// Write length of payload into buf
+	binary.BigEndian.PutUint32(hdr[payloadLen:], uint32(len(data)))
+	return hdr, data
+}
+
+func outPayload(client bool, msg interface{}, data, payload []byte, t time.Time) *stats.OutPayload {
+	return &stats.OutPayload{
+		Client:           client,
+		Payload:          msg,
+		Data:             data,
+		Length:           len(data),
+		WireLength:       len(payload) + headerLen,
+		CompressedLength: len(payload),
+		SentTime:         t,
+	}
+}
+
+func checkRecvPayload(pf payloadFormat, recvCompress string, haveCompressor bool) *status.Status {
+	switch pf {
+	case compressionNone:
+	case compressionMade:
+		if recvCompress == "" || recvCompress == encoding.Identity {
+			return status.New(codes.Internal, "grpc: compressed flag set with identity or empty encoding")
+		}
+		if !haveCompressor {
+			return status.Newf(codes.Unimplemented, "grpc: Decompressor is not installed for grpc-encoding %q", recvCompress)
+		}
+	default:
+		return status.Newf(codes.Internal, "grpc: received unexpected payload format %d", pf)
+	}
+	return nil
+}
+
+type payloadInfo struct {
+	compressedLength  int // The compressed length got from wire.
+	uncompressedBytes []byte
+}
+
+func recvAndDecompress(p *parser, s *transport.Stream, dc Decompressor, maxReceiveMessageSize int, payInfo *payloadInfo, compressor encoding.Compressor) ([]byte, error) {
+	pf, d, err := p.recvMsg(maxReceiveMessageSize)
+	if err != nil {
+		return nil, err
+	}
+	if payInfo != nil {
+		payInfo.compressedLength = len(d)
+	}
+
+	if st := checkRecvPayload(pf, s.RecvCompress(), compressor != nil || dc != nil); st != nil {
+		return nil, st.Err()
+	}
+
+	var size int
+	if pf == compressionMade {
+		// To match legacy behavior, if the decompressor is set by WithDecompressor or RPCDecompressor,
+		// use this decompressor as the default.
+		if dc != nil {
+			d, err = dc.Do(bytes.NewReader(d))
+			size = len(d)
+		} else {
+			d, size, err = decompress(compressor, d, maxReceiveMessageSize)
+		}
+		if err != nil {
+			return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the received message: %v", err)
+		}
+		if size > maxReceiveMessageSize {
+			// TODO: Revisit the error code. Currently keep it consistent with java
+			// implementation.
+			return nil, status.Errorf(codes.ResourceExhausted, "grpc: received message after decompression larger than max (%d vs. %d)", size, maxReceiveMessageSize)
+		}
+	}
+	return d, nil
+}
+
+// Using compressor, decompress d, returning data and size.
+// Optionally, if data will be over maxReceiveMessageSize, just return the size.
+func decompress(compressor encoding.Compressor, d []byte, maxReceiveMessageSize int) ([]byte, int, error) {
+	dcReader, err := compressor.Decompress(bytes.NewReader(d))
+	if err != nil {
+		return nil, 0, err
+	}
+	if sizer, ok := compressor.(interface {
+		DecompressedSize(compressedBytes []byte) int
+	}); ok {
+		if size := sizer.DecompressedSize(d); size >= 0 {
+			if size > maxReceiveMessageSize {
+				return nil, size, nil
+			}
+			// size is used as an estimate to size the buffer, but we
+			// will read more data if available.
+			// +MinRead so ReadFrom will not reallocate if size is correct.
+			buf := bytes.NewBuffer(make([]byte, 0, size+bytes.MinRead))
+			bytesRead, err := buf.ReadFrom(io.LimitReader(dcReader, int64(maxReceiveMessageSize)+1))
+			return buf.Bytes(), int(bytesRead), err
+		}
+	}
+	// Read from LimitReader with limit max+1. So if the underlying
+	// reader is over limit, the result will be bigger than max.
+	d, err = io.ReadAll(io.LimitReader(dcReader, int64(maxReceiveMessageSize)+1))
+	return d, len(d), err
+}
+
+// For the two compressor parameters, both should not be set, but if they are,
+// dc takes precedence over compressor.
+// TODO(dfawley): wrap the old compressor/decompressor using the new API?
+func recv(p *parser, c baseCodec, s *transport.Stream, dc Decompressor, m interface{}, maxReceiveMessageSize int, payInfo *payloadInfo, compressor encoding.Compressor) error {
+	d, err := recvAndDecompress(p, s, dc, maxReceiveMessageSize, payInfo, compressor)
+	if err != nil {
+		return err
+	}
+	if err := c.Unmarshal(d, m); err != nil {
+		return status.Errorf(codes.Internal, "grpc: failed to unmarshal the received message: %v", err)
+	}
+	if payInfo != nil {
+		payInfo.uncompressedBytes = d
+	}
+	return nil
+}
+
+// Information about RPC
+type rpcInfo struct {
+	failfast      bool
+	preloaderInfo *compressorInfo
+}
+
+// Information about Preloader
+// Responsible for storing codec, and compressors
+// If stream (s) has  context s.Context which stores rpcInfo that has non nil
+// pointers to codec, and compressors, then we can use preparedMsg for Async message prep
+// and reuse marshalled bytes
+type compressorInfo struct {
+	codec baseCodec
+	cp    Compressor
+	comp  encoding.Compressor
+}
+
+type rpcInfoContextKey struct{}
+
+func newContextWithRPCInfo(ctx context.Context, failfast bool, codec baseCodec, cp Compressor, comp encoding.Compressor) context.Context {
+	return context.WithValue(ctx, rpcInfoContextKey{}, &rpcInfo{
+		failfast: failfast,
+		preloaderInfo: &compressorInfo{
+			codec: codec,
+			cp:    cp,
+			comp:  comp,
+		},
+	})
+}
+
+func rpcInfoFromContext(ctx context.Context) (s *rpcInfo, ok bool) {
+	s, ok = ctx.Value(rpcInfoContextKey{}).(*rpcInfo)
+	return
+}
+
+// Code returns the error code for err if it was produced by the rpc system.
+// Otherwise, it returns codes.Unknown.
+//
+// Deprecated: use status.Code instead.
+func Code(err error) codes.Code {
+	return status.Code(err)
+}
+
+// ErrorDesc returns the error description of err if it was produced by the rpc system.
+// Otherwise, it returns err.Error() or empty string when err is nil.
+//
+// Deprecated: use status.Convert and Message method instead.
+func ErrorDesc(err error) string {
+	return status.Convert(err).Message()
+}
+
+// Errorf returns an error containing an error code and a description;
+// Errorf returns nil if c is OK.
+//
+// Deprecated: use status.Errorf instead.
+func Errorf(c codes.Code, format string, a ...interface{}) error {
+	return status.Errorf(c, format, a...)
+}
+
+// toRPCErr converts an error into an error from the status package.
+func toRPCErr(err error) error {
+	switch err {
+	case nil, io.EOF:
+		return err
+	case context.DeadlineExceeded:
+		return status.Error(codes.DeadlineExceeded, err.Error())
+	case context.Canceled:
+		return status.Error(codes.Canceled, err.Error())
+	case io.ErrUnexpectedEOF:
+		return status.Error(codes.Internal, err.Error())
+	}
+
+	switch e := err.(type) {
+	case transport.ConnectionError:
+		return status.Error(codes.Unavailable, e.Desc)
+	case *transport.NewStreamError:
+		return toRPCErr(e.Err)
+	}
+
+	if _, ok := status.FromError(err); ok {
+		return err
+	}
+
+	return status.Error(codes.Unknown, err.Error())
+}
+
+// setCallInfoCodec should only be called after CallOptions have been applied.
+func setCallInfoCodec(c *callInfo) error {
+	if c.codec != nil {
+		// codec was already set by a CallOption; use it, but set the content
+		// subtype if it is not set.
+		if c.contentSubtype == "" {
+			// c.codec is a baseCodec to hide the difference between grpc.Codec and
+			// encoding.Codec (Name vs. String method name).  We only support
+			// setting content subtype from encoding.Codec to avoid a behavior
+			// change with the deprecated version.
+			if ec, ok := c.codec.(encoding.Codec); ok {
+				c.contentSubtype = strings.ToLower(ec.Name())
+			}
+		}
+		return nil
+	}
+
+	if c.contentSubtype == "" {
+		// No codec specified in CallOptions; use proto by default.
+		c.codec = encoding.GetCodec(proto.Name)
+		return nil
+	}
+
+	// c.contentSubtype is already lowercased in CallContentSubtype
+	c.codec = encoding.GetCodec(c.contentSubtype)
+	if c.codec == nil {
+		return status.Errorf(codes.Internal, "no codec registered for content-subtype %s", c.contentSubtype)
+	}
+	return nil
+}
+
+// channelzData is used to store channelz related data for ClientConn, addrConn and Server.
+// These fields cannot be embedded in the original structs (e.g. ClientConn), since to do atomic
+// operation on int64 variable on 32-bit machine, user is responsible to enforce memory alignment.
+// Here, by grouping those int64 fields inside a struct, we are enforcing the alignment.
+type channelzData struct {
+	callsStarted   int64
+	callsFailed    int64
+	callsSucceeded int64
+	// lastCallStartedTime stores the timestamp that last call starts. It is of int64 type instead of
+	// time.Time since it's more costly to atomically update time.Time variable than int64 variable.
+	lastCallStartedTime int64
+}
+
+// The SupportPackageIsVersion variables are referenced from generated protocol
+// buffer files to ensure compatibility with the gRPC version used.  The latest
+// support package version is 7.
+//
+// Older versions are kept for compatibility.
+//
+// These constants should not be referenced from any other code.
+const (
+	SupportPackageIsVersion3 = true
+	SupportPackageIsVersion4 = true
+	SupportPackageIsVersion5 = true
+	SupportPackageIsVersion6 = true
+	SupportPackageIsVersion7 = true
+)
+
+const grpcUA = "grpc-go/" + Version
diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go
new file mode 100644
index 0000000000..76d152a69c
--- /dev/null
+++ b/vendor/google.golang.org/grpc/server.go
@@ -0,0 +1,2054 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"net/http"
+	"reflect"
+	"runtime"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"golang.org/x/net/trace"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/encoding/proto"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/internal"
+	"google.golang.org/grpc/internal/binarylog"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/grpcsync"
+	"google.golang.org/grpc/internal/grpcutil"
+	"google.golang.org/grpc/internal/transport"
+	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/tap"
+)
+
+const (
+	defaultServerMaxReceiveMessageSize = 1024 * 1024 * 4
+	defaultServerMaxSendMessageSize    = math.MaxInt32
+
+	// Server transports are tracked in a map which is keyed on listener
+	// address. For regular gRPC traffic, connections are accepted in Serve()
+	// through a call to Accept(), and we use the actual listener address as key
+	// when we add it to the map. But for connections received through
+	// ServeHTTP(), we do not have a listener and hence use this dummy value.
+	listenerAddressForServeHTTP = "listenerAddressForServeHTTP"
+)
+
+func init() {
+	internal.GetServerCredentials = func(srv *Server) credentials.TransportCredentials {
+		return srv.opts.creds
+	}
+	internal.DrainServerTransports = func(srv *Server, addr string) {
+		srv.drainServerTransports(addr)
+	}
+	internal.AddGlobalServerOptions = func(opt ...ServerOption) {
+		globalServerOptions = append(globalServerOptions, opt...)
+	}
+	internal.ClearGlobalServerOptions = func() {
+		globalServerOptions = nil
+	}
+	internal.BinaryLogger = binaryLogger
+	internal.JoinServerOptions = newJoinServerOption
+}
+
+var statusOK = status.New(codes.OK, "")
+var logger = grpclog.Component("core")
+
+type methodHandler func(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor UnaryServerInterceptor) (interface{}, error)
+
+// MethodDesc represents an RPC service's method specification.
+type MethodDesc struct {
+	MethodName string
+	Handler    methodHandler
+}
+
+// ServiceDesc represents an RPC service's specification.
+type ServiceDesc struct {
+	ServiceName string
+	// The pointer to the service interface. Used to check whether the user
+	// provided implementation satisfies the interface requirements.
+	HandlerType interface{}
+	Methods     []MethodDesc
+	Streams     []StreamDesc
+	Metadata    interface{}
+}
+
+// serviceInfo wraps information about a service. It is very similar to
+// ServiceDesc and is constructed from it for internal purposes.
+type serviceInfo struct {
+	// Contains the implementation for the methods in this service.
+	serviceImpl interface{}
+	methods     map[string]*MethodDesc
+	streams     map[string]*StreamDesc
+	mdata       interface{}
+}
+
+type serverWorkerData struct {
+	st     transport.ServerTransport
+	wg     *sync.WaitGroup
+	stream *transport.Stream
+}
+
+// Server is a gRPC server to serve RPC requests.
+type Server struct {
+	opts serverOptions
+
+	mu  sync.Mutex // guards following
+	lis map[net.Listener]bool
+	// conns contains all active server transports. It is a map keyed on a
+	// listener address with the value being the set of active transports
+	// belonging to that listener.
+	conns    map[string]map[transport.ServerTransport]bool
+	serve    bool
+	drain    bool
+	cv       *sync.Cond              // signaled when connections close for GracefulStop
+	services map[string]*serviceInfo // service name -> service info
+	events   trace.EventLog
+
+	quit               *grpcsync.Event
+	done               *grpcsync.Event
+	channelzRemoveOnce sync.Once
+	serveWG            sync.WaitGroup // counts active Serve goroutines for GracefulStop
+
+	channelzID *channelz.Identifier
+	czData     *channelzData
+
+	serverWorkerChannel chan *serverWorkerData
+}
+
+type serverOptions struct {
+	creds                 credentials.TransportCredentials
+	codec                 baseCodec
+	cp                    Compressor
+	dc                    Decompressor
+	unaryInt              UnaryServerInterceptor
+	streamInt             StreamServerInterceptor
+	chainUnaryInts        []UnaryServerInterceptor
+	chainStreamInts       []StreamServerInterceptor
+	binaryLogger          binarylog.Logger
+	inTapHandle           tap.ServerInHandle
+	statsHandlers         []stats.Handler
+	maxConcurrentStreams  uint32
+	maxReceiveMessageSize int
+	maxSendMessageSize    int
+	unknownStreamDesc     *StreamDesc
+	keepaliveParams       keepalive.ServerParameters
+	keepalivePolicy       keepalive.EnforcementPolicy
+	initialWindowSize     int32
+	initialConnWindowSize int32
+	writeBufferSize       int
+	readBufferSize        int
+	connectionTimeout     time.Duration
+	maxHeaderListSize     *uint32
+	headerTableSize       *uint32
+	numServerWorkers      uint32
+}
+
+var defaultServerOptions = serverOptions{
+	maxReceiveMessageSize: defaultServerMaxReceiveMessageSize,
+	maxSendMessageSize:    defaultServerMaxSendMessageSize,
+	connectionTimeout:     120 * time.Second,
+	writeBufferSize:       defaultWriteBufSize,
+	readBufferSize:        defaultReadBufSize,
+}
+var globalServerOptions []ServerOption
+
+// A ServerOption sets options such as credentials, codec and keepalive parameters, etc.
+type ServerOption interface {
+	apply(*serverOptions)
+}
+
+// EmptyServerOption does not alter the server configuration. It can be embedded
+// in another structure to build custom server options.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type EmptyServerOption struct{}
+
+func (EmptyServerOption) apply(*serverOptions) {}
+
+// funcServerOption wraps a function that modifies serverOptions into an
+// implementation of the ServerOption interface.
+type funcServerOption struct {
+	f func(*serverOptions)
+}
+
+func (fdo *funcServerOption) apply(do *serverOptions) {
+	fdo.f(do)
+}
+
+func newFuncServerOption(f func(*serverOptions)) *funcServerOption {
+	return &funcServerOption{
+		f: f,
+	}
+}
+
+// joinServerOption provides a way to combine arbitrary number of server
+// options into one.
+type joinServerOption struct {
+	opts []ServerOption
+}
+
+func (mdo *joinServerOption) apply(do *serverOptions) {
+	for _, opt := range mdo.opts {
+		opt.apply(do)
+	}
+}
+
+func newJoinServerOption(opts ...ServerOption) ServerOption {
+	return &joinServerOption{opts: opts}
+}
+
+// WriteBufferSize determines how much data can be batched before doing a write
+// on the wire. The corresponding memory allocation for this buffer will be
+// twice the size to keep syscalls low. The default value for this buffer is
+// 32KB. Zero or negative values will disable the write buffer such that each
+// write will be on underlying connection.
+// Note: A Send call may not directly translate to a write.
+func WriteBufferSize(s int) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.writeBufferSize = s
+	})
+}
+
+// ReadBufferSize lets you set the size of read buffer, this determines how much
+// data can be read at most for one read syscall. The default value for this
+// buffer is 32KB. Zero or negative values will disable read buffer for a
+// connection so data framer can access the underlying conn directly.
+func ReadBufferSize(s int) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.readBufferSize = s
+	})
+}
+
+// InitialWindowSize returns a ServerOption that sets window size for stream.
+// The lower bound for window size is 64K and any value smaller than that will be ignored.
+func InitialWindowSize(s int32) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.initialWindowSize = s
+	})
+}
+
+// InitialConnWindowSize returns a ServerOption that sets window size for a connection.
+// The lower bound for window size is 64K and any value smaller than that will be ignored.
+func InitialConnWindowSize(s int32) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.initialConnWindowSize = s
+	})
+}
+
+// KeepaliveParams returns a ServerOption that sets keepalive and max-age parameters for the server.
+func KeepaliveParams(kp keepalive.ServerParameters) ServerOption {
+	if kp.Time > 0 && kp.Time < time.Second {
+		logger.Warning("Adjusting keepalive ping interval to minimum period of 1s")
+		kp.Time = time.Second
+	}
+
+	return newFuncServerOption(func(o *serverOptions) {
+		o.keepaliveParams = kp
+	})
+}
+
+// KeepaliveEnforcementPolicy returns a ServerOption that sets keepalive enforcement policy for the server.
+func KeepaliveEnforcementPolicy(kep keepalive.EnforcementPolicy) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.keepalivePolicy = kep
+	})
+}
+
+// CustomCodec returns a ServerOption that sets a codec for message marshaling and unmarshaling.
+//
+// This will override any lookups by content-subtype for Codecs registered with RegisterCodec.
+//
+// Deprecated: register codecs using encoding.RegisterCodec. The server will
+// automatically use registered codecs based on the incoming requests' headers.
+// See also
+// https://github.com/grpc/grpc-go/blob/master/Documentation/encoding.md#using-a-codec.
+// Will be supported throughout 1.x.
+func CustomCodec(codec Codec) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.codec = codec
+	})
+}
+
+// ForceServerCodec returns a ServerOption that sets a codec for message
+// marshaling and unmarshaling.
+//
+// This will override any lookups by content-subtype for Codecs registered
+// with RegisterCodec.
+//
+// See Content-Type on
+// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests for
+// more details. Also see the documentation on RegisterCodec and
+// CallContentSubtype for more details on the interaction between encoding.Codec
+// and content-subtype.
+//
+// This function is provided for advanced users; prefer to register codecs
+// using encoding.RegisterCodec.
+// The server will automatically use registered codecs based on the incoming
+// requests' headers. See also
+// https://github.com/grpc/grpc-go/blob/master/Documentation/encoding.md#using-a-codec.
+// Will be supported throughout 1.x.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ForceServerCodec(codec encoding.Codec) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.codec = codec
+	})
+}
+
+// RPCCompressor returns a ServerOption that sets a compressor for outbound
+// messages.  For backward compatibility, all outbound messages will be sent
+// using this compressor, regardless of incoming message compression.  By
+// default, server messages will be sent using the same compressor with which
+// request messages were sent.
+//
+// Deprecated: use encoding.RegisterCompressor instead. Will be supported
+// throughout 1.x.
+func RPCCompressor(cp Compressor) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.cp = cp
+	})
+}
+
+// RPCDecompressor returns a ServerOption that sets a decompressor for inbound
+// messages.  It has higher priority than decompressors registered via
+// encoding.RegisterCompressor.
+//
+// Deprecated: use encoding.RegisterCompressor instead. Will be supported
+// throughout 1.x.
+func RPCDecompressor(dc Decompressor) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.dc = dc
+	})
+}
+
+// MaxMsgSize returns a ServerOption to set the max message size in bytes the server can receive.
+// If this is not set, gRPC uses the default limit.
+//
+// Deprecated: use MaxRecvMsgSize instead. Will be supported throughout 1.x.
+func MaxMsgSize(m int) ServerOption {
+	return MaxRecvMsgSize(m)
+}
+
+// MaxRecvMsgSize returns a ServerOption to set the max message size in bytes the server can receive.
+// If this is not set, gRPC uses the default 4MB.
+func MaxRecvMsgSize(m int) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.maxReceiveMessageSize = m
+	})
+}
+
+// MaxSendMsgSize returns a ServerOption to set the max message size in bytes the server can send.
+// If this is not set, gRPC uses the default `math.MaxInt32`.
+func MaxSendMsgSize(m int) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.maxSendMessageSize = m
+	})
+}
+
+// MaxConcurrentStreams returns a ServerOption that will apply a limit on the number
+// of concurrent streams to each ServerTransport.
+func MaxConcurrentStreams(n uint32) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.maxConcurrentStreams = n
+	})
+}
+
+// Creds returns a ServerOption that sets credentials for server connections.
+func Creds(c credentials.TransportCredentials) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.creds = c
+	})
+}
+
+// UnaryInterceptor returns a ServerOption that sets the UnaryServerInterceptor for the
+// server. Only one unary interceptor can be installed. The construction of multiple
+// interceptors (e.g., chaining) can be implemented at the caller.
+func UnaryInterceptor(i UnaryServerInterceptor) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		if o.unaryInt != nil {
+			panic("The unary server interceptor was already set and may not be reset.")
+		}
+		o.unaryInt = i
+	})
+}
+
+// ChainUnaryInterceptor returns a ServerOption that specifies the chained interceptor
+// for unary RPCs. The first interceptor will be the outer most,
+// while the last interceptor will be the inner most wrapper around the real call.
+// All unary interceptors added by this method will be chained.
+func ChainUnaryInterceptor(interceptors ...UnaryServerInterceptor) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.chainUnaryInts = append(o.chainUnaryInts, interceptors...)
+	})
+}
+
+// StreamInterceptor returns a ServerOption that sets the StreamServerInterceptor for the
+// server. Only one stream interceptor can be installed.
+func StreamInterceptor(i StreamServerInterceptor) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		if o.streamInt != nil {
+			panic("The stream server interceptor was already set and may not be reset.")
+		}
+		o.streamInt = i
+	})
+}
+
+// ChainStreamInterceptor returns a ServerOption that specifies the chained interceptor
+// for streaming RPCs. The first interceptor will be the outer most,
+// while the last interceptor will be the inner most wrapper around the real call.
+// All stream interceptors added by this method will be chained.
+func ChainStreamInterceptor(interceptors ...StreamServerInterceptor) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.chainStreamInts = append(o.chainStreamInts, interceptors...)
+	})
+}
+
+// InTapHandle returns a ServerOption that sets the tap handle for all the server
+// transport to be created. Only one can be installed.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func InTapHandle(h tap.ServerInHandle) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		if o.inTapHandle != nil {
+			panic("The tap handle was already set and may not be reset.")
+		}
+		o.inTapHandle = h
+	})
+}
+
+// StatsHandler returns a ServerOption that sets the stats handler for the server.
+func StatsHandler(h stats.Handler) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		if h == nil {
+			logger.Error("ignoring nil parameter in grpc.StatsHandler ServerOption")
+			// Do not allow a nil stats handler, which would otherwise cause
+			// panics.
+			return
+		}
+		o.statsHandlers = append(o.statsHandlers, h)
+	})
+}
+
+// binaryLogger returns a ServerOption that can set the binary logger for the
+// server.
+func binaryLogger(bl binarylog.Logger) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.binaryLogger = bl
+	})
+}
+
+// UnknownServiceHandler returns a ServerOption that allows for adding a custom
+// unknown service handler. The provided method is a bidi-streaming RPC service
+// handler that will be invoked instead of returning the "unimplemented" gRPC
+// error whenever a request is received for an unregistered service or method.
+// The handling function and stream interceptor (if set) have full access to
+// the ServerStream, including its Context.
+func UnknownServiceHandler(streamHandler StreamHandler) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.unknownStreamDesc = &StreamDesc{
+			StreamName: "unknown_service_handler",
+			Handler:    streamHandler,
+			// We need to assume that the users of the streamHandler will want to use both.
+			ClientStreams: true,
+			ServerStreams: true,
+		}
+	})
+}
+
+// ConnectionTimeout returns a ServerOption that sets the timeout for
+// connection establishment (up to and including HTTP/2 handshaking) for all
+// new connections.  If this is not set, the default is 120 seconds.  A zero or
+// negative value will result in an immediate timeout.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ConnectionTimeout(d time.Duration) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.connectionTimeout = d
+	})
+}
+
+// MaxHeaderListSize returns a ServerOption that sets the max (uncompressed) size
+// of header list that the server is prepared to accept.
+func MaxHeaderListSize(s uint32) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.maxHeaderListSize = &s
+	})
+}
+
+// HeaderTableSize returns a ServerOption that sets the size of dynamic
+// header table for stream.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func HeaderTableSize(s uint32) ServerOption {
+	return newFuncServerOption(func(o *serverOptions) {
+		o.headerTableSize = &s
+	})
+}
+
+// NumStreamWorkers returns a ServerOption that sets the number of worker
+// goroutines that should be used to process incoming streams. Setting this to
+// zero (default) will disable workers and spawn a new goroutine for each
+// stream.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func NumStreamWorkers(numServerWorkers uint32) ServerOption {
+	// TODO: If/when this API gets stabilized (i.e. stream workers become the
+	// only way streams are processed), change the behavior of the zero value to
+	// a sane default. Preliminary experiments suggest that a value equal to the
+	// number of CPUs available is most performant; requires thorough testing.
+	return newFuncServerOption(func(o *serverOptions) {
+		o.numServerWorkers = numServerWorkers
+	})
+}
+
+// serverWorkerResetThreshold defines how often the stack must be reset. Every
+// N requests, by spawning a new goroutine in its place, a worker can reset its
+// stack so that large stacks don't live in memory forever. 2^16 should allow
+// each goroutine stack to live for at least a few seconds in a typical
+// workload (assuming a QPS of a few thousand requests/sec).
+const serverWorkerResetThreshold = 1 << 16
+
+// serverWorkers blocks on a *transport.Stream channel forever and waits for
+// data to be fed by serveStreams. This allows multiple requests to be
+// processed by the same goroutine, removing the need for expensive stack
+// re-allocations (see the runtime.morestack problem [1]).
+//
+// [1] https://github.com/golang/go/issues/18138
+func (s *Server) serverWorker() {
+	for completed := 0; completed < serverWorkerResetThreshold; completed++ {
+		data, ok := <-s.serverWorkerChannel
+		if !ok {
+			return
+		}
+		s.handleSingleStream(data)
+	}
+	go s.serverWorker()
+}
+
+func (s *Server) handleSingleStream(data *serverWorkerData) {
+	defer data.wg.Done()
+	s.handleStream(data.st, data.stream, s.traceInfo(data.st, data.stream))
+}
+
+// initServerWorkers creates worker goroutines and a channel to process incoming
+// connections to reduce the time spent overall on runtime.morestack.
+func (s *Server) initServerWorkers() {
+	s.serverWorkerChannel = make(chan *serverWorkerData)
+	for i := uint32(0); i < s.opts.numServerWorkers; i++ {
+		go s.serverWorker()
+	}
+}
+
+func (s *Server) stopServerWorkers() {
+	close(s.serverWorkerChannel)
+}
+
+// NewServer creates a gRPC server which has no service registered and has not
+// started to accept requests yet.
+func NewServer(opt ...ServerOption) *Server {
+	opts := defaultServerOptions
+	for _, o := range globalServerOptions {
+		o.apply(&opts)
+	}
+	for _, o := range opt {
+		o.apply(&opts)
+	}
+	s := &Server{
+		lis:      make(map[net.Listener]bool),
+		opts:     opts,
+		conns:    make(map[string]map[transport.ServerTransport]bool),
+		services: make(map[string]*serviceInfo),
+		quit:     grpcsync.NewEvent(),
+		done:     grpcsync.NewEvent(),
+		czData:   new(channelzData),
+	}
+	chainUnaryServerInterceptors(s)
+	chainStreamServerInterceptors(s)
+	s.cv = sync.NewCond(&s.mu)
+	if EnableTracing {
+		_, file, line, _ := runtime.Caller(1)
+		s.events = trace.NewEventLog("grpc.Server", fmt.Sprintf("%s:%d", file, line))
+	}
+
+	if s.opts.numServerWorkers > 0 {
+		s.initServerWorkers()
+	}
+
+	s.channelzID = channelz.RegisterServer(&channelzServer{s}, "")
+	channelz.Info(logger, s.channelzID, "Server created")
+	return s
+}
+
+// printf records an event in s's event log, unless s has been stopped.
+// REQUIRES s.mu is held.
+func (s *Server) printf(format string, a ...interface{}) {
+	if s.events != nil {
+		s.events.Printf(format, a...)
+	}
+}
+
+// errorf records an error in s's event log, unless s has been stopped.
+// REQUIRES s.mu is held.
+func (s *Server) errorf(format string, a ...interface{}) {
+	if s.events != nil {
+		s.events.Errorf(format, a...)
+	}
+}
+
+// ServiceRegistrar wraps a single method that supports service registration. It
+// enables users to pass concrete types other than grpc.Server to the service
+// registration methods exported by the IDL generated code.
+type ServiceRegistrar interface {
+	// RegisterService registers a service and its implementation to the
+	// concrete type implementing this interface.  It may not be called
+	// once the server has started serving.
+	// desc describes the service and its methods and handlers. impl is the
+	// service implementation which is passed to the method handlers.
+	RegisterService(desc *ServiceDesc, impl interface{})
+}
+
+// RegisterService registers a service and its implementation to the gRPC
+// server. It is called from the IDL generated code. This must be called before
+// invoking Serve. If ss is non-nil (for legacy code), its type is checked to
+// ensure it implements sd.HandlerType.
+func (s *Server) RegisterService(sd *ServiceDesc, ss interface{}) {
+	if ss != nil {
+		ht := reflect.TypeOf(sd.HandlerType).Elem()
+		st := reflect.TypeOf(ss)
+		if !st.Implements(ht) {
+			logger.Fatalf("grpc: Server.RegisterService found the handler of type %v that does not satisfy %v", st, ht)
+		}
+	}
+	s.register(sd, ss)
+}
+
+func (s *Server) register(sd *ServiceDesc, ss interface{}) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.printf("RegisterService(%q)", sd.ServiceName)
+	if s.serve {
+		logger.Fatalf("grpc: Server.RegisterService after Server.Serve for %q", sd.ServiceName)
+	}
+	if _, ok := s.services[sd.ServiceName]; ok {
+		logger.Fatalf("grpc: Server.RegisterService found duplicate service registration for %q", sd.ServiceName)
+	}
+	info := &serviceInfo{
+		serviceImpl: ss,
+		methods:     make(map[string]*MethodDesc),
+		streams:     make(map[string]*StreamDesc),
+		mdata:       sd.Metadata,
+	}
+	for i := range sd.Methods {
+		d := &sd.Methods[i]
+		info.methods[d.MethodName] = d
+	}
+	for i := range sd.Streams {
+		d := &sd.Streams[i]
+		info.streams[d.StreamName] = d
+	}
+	s.services[sd.ServiceName] = info
+}
+
+// MethodInfo contains the information of an RPC including its method name and type.
+type MethodInfo struct {
+	// Name is the method name only, without the service name or package name.
+	Name string
+	// IsClientStream indicates whether the RPC is a client streaming RPC.
+	IsClientStream bool
+	// IsServerStream indicates whether the RPC is a server streaming RPC.
+	IsServerStream bool
+}
+
+// ServiceInfo contains unary RPC method info, streaming RPC method info and metadata for a service.
+type ServiceInfo struct {
+	Methods []MethodInfo
+	// Metadata is the metadata specified in ServiceDesc when registering service.
+	Metadata interface{}
+}
+
+// GetServiceInfo returns a map from service names to ServiceInfo.
+// Service names include the package names, in the form of <package>.<service>.
+func (s *Server) GetServiceInfo() map[string]ServiceInfo {
+	ret := make(map[string]ServiceInfo)
+	for n, srv := range s.services {
+		methods := make([]MethodInfo, 0, len(srv.methods)+len(srv.streams))
+		for m := range srv.methods {
+			methods = append(methods, MethodInfo{
+				Name:           m,
+				IsClientStream: false,
+				IsServerStream: false,
+			})
+		}
+		for m, d := range srv.streams {
+			methods = append(methods, MethodInfo{
+				Name:           m,
+				IsClientStream: d.ClientStreams,
+				IsServerStream: d.ServerStreams,
+			})
+		}
+
+		ret[n] = ServiceInfo{
+			Methods:  methods,
+			Metadata: srv.mdata,
+		}
+	}
+	return ret
+}
+
+// ErrServerStopped indicates that the operation is now illegal because of
+// the server being stopped.
+var ErrServerStopped = errors.New("grpc: the server has been stopped")
+
+type listenSocket struct {
+	net.Listener
+	channelzID *channelz.Identifier
+}
+
+func (l *listenSocket) ChannelzMetric() *channelz.SocketInternalMetric {
+	return &channelz.SocketInternalMetric{
+		SocketOptions: channelz.GetSocketOption(l.Listener),
+		LocalAddr:     l.Listener.Addr(),
+	}
+}
+
+func (l *listenSocket) Close() error {
+	err := l.Listener.Close()
+	channelz.RemoveEntry(l.channelzID)
+	channelz.Info(logger, l.channelzID, "ListenSocket deleted")
+	return err
+}
+
+// Serve accepts incoming connections on the listener lis, creating a new
+// ServerTransport and service goroutine for each. The service goroutines
+// read gRPC requests and then call the registered handlers to reply to them.
+// Serve returns when lis.Accept fails with fatal errors.  lis will be closed when
+// this method returns.
+// Serve will return a non-nil error unless Stop or GracefulStop is called.
+func (s *Server) Serve(lis net.Listener) error {
+	s.mu.Lock()
+	s.printf("serving")
+	s.serve = true
+	if s.lis == nil {
+		// Serve called after Stop or GracefulStop.
+		s.mu.Unlock()
+		lis.Close()
+		return ErrServerStopped
+	}
+
+	s.serveWG.Add(1)
+	defer func() {
+		s.serveWG.Done()
+		if s.quit.HasFired() {
+			// Stop or GracefulStop called; block until done and return nil.
+			<-s.done.Done()
+		}
+	}()
+
+	ls := &listenSocket{Listener: lis}
+	s.lis[ls] = true
+
+	defer func() {
+		s.mu.Lock()
+		if s.lis != nil && s.lis[ls] {
+			ls.Close()
+			delete(s.lis, ls)
+		}
+		s.mu.Unlock()
+	}()
+
+	var err error
+	ls.channelzID, err = channelz.RegisterListenSocket(ls, s.channelzID, lis.Addr().String())
+	if err != nil {
+		s.mu.Unlock()
+		return err
+	}
+	s.mu.Unlock()
+	channelz.Info(logger, ls.channelzID, "ListenSocket created")
+
+	var tempDelay time.Duration // how long to sleep on accept failure
+	for {
+		rawConn, err := lis.Accept()
+		if err != nil {
+			if ne, ok := err.(interface {
+				Temporary() bool
+			}); ok && ne.Temporary() {
+				if tempDelay == 0 {
+					tempDelay = 5 * time.Millisecond
+				} else {
+					tempDelay *= 2
+				}
+				if max := 1 * time.Second; tempDelay > max {
+					tempDelay = max
+				}
+				s.mu.Lock()
+				s.printf("Accept error: %v; retrying in %v", err, tempDelay)
+				s.mu.Unlock()
+				timer := time.NewTimer(tempDelay)
+				select {
+				case <-timer.C:
+				case <-s.quit.Done():
+					timer.Stop()
+					return nil
+				}
+				continue
+			}
+			s.mu.Lock()
+			s.printf("done serving; Accept = %v", err)
+			s.mu.Unlock()
+
+			if s.quit.HasFired() {
+				return nil
+			}
+			return err
+		}
+		tempDelay = 0
+		// Start a new goroutine to deal with rawConn so we don't stall this Accept
+		// loop goroutine.
+		//
+		// Make sure we account for the goroutine so GracefulStop doesn't nil out
+		// s.conns before this conn can be added.
+		s.serveWG.Add(1)
+		go func() {
+			s.handleRawConn(lis.Addr().String(), rawConn)
+			s.serveWG.Done()
+		}()
+	}
+}
+
+// handleRawConn forks a goroutine to handle a just-accepted connection that
+// has not had any I/O performed on it yet.
+func (s *Server) handleRawConn(lisAddr string, rawConn net.Conn) {
+	if s.quit.HasFired() {
+		rawConn.Close()
+		return
+	}
+	rawConn.SetDeadline(time.Now().Add(s.opts.connectionTimeout))
+
+	// Finish handshaking (HTTP2)
+	st := s.newHTTP2Transport(rawConn)
+	rawConn.SetDeadline(time.Time{})
+	if st == nil {
+		return
+	}
+
+	if !s.addConn(lisAddr, st) {
+		return
+	}
+	go func() {
+		s.serveStreams(st)
+		s.removeConn(lisAddr, st)
+	}()
+}
+
+func (s *Server) drainServerTransports(addr string) {
+	s.mu.Lock()
+	conns := s.conns[addr]
+	for st := range conns {
+		st.Drain()
+	}
+	s.mu.Unlock()
+}
+
+// newHTTP2Transport sets up a http/2 transport (using the
+// gRPC http2 server transport in transport/http2_server.go).
+func (s *Server) newHTTP2Transport(c net.Conn) transport.ServerTransport {
+	config := &transport.ServerConfig{
+		MaxStreams:            s.opts.maxConcurrentStreams,
+		ConnectionTimeout:     s.opts.connectionTimeout,
+		Credentials:           s.opts.creds,
+		InTapHandle:           s.opts.inTapHandle,
+		StatsHandlers:         s.opts.statsHandlers,
+		KeepaliveParams:       s.opts.keepaliveParams,
+		KeepalivePolicy:       s.opts.keepalivePolicy,
+		InitialWindowSize:     s.opts.initialWindowSize,
+		InitialConnWindowSize: s.opts.initialConnWindowSize,
+		WriteBufferSize:       s.opts.writeBufferSize,
+		ReadBufferSize:        s.opts.readBufferSize,
+		ChannelzParentID:      s.channelzID,
+		MaxHeaderListSize:     s.opts.maxHeaderListSize,
+		HeaderTableSize:       s.opts.headerTableSize,
+	}
+	st, err := transport.NewServerTransport(c, config)
+	if err != nil {
+		s.mu.Lock()
+		s.errorf("NewServerTransport(%q) failed: %v", c.RemoteAddr(), err)
+		s.mu.Unlock()
+		// ErrConnDispatched means that the connection was dispatched away from
+		// gRPC; those connections should be left open.
+		if err != credentials.ErrConnDispatched {
+			// Don't log on ErrConnDispatched and io.EOF to prevent log spam.
+			if err != io.EOF {
+				channelz.Info(logger, s.channelzID, "grpc: Server.Serve failed to create ServerTransport: ", err)
+			}
+			c.Close()
+		}
+		return nil
+	}
+
+	return st
+}
+
+func (s *Server) serveStreams(st transport.ServerTransport) {
+	defer st.Close(errors.New("finished serving streams for the server transport"))
+	var wg sync.WaitGroup
+
+	st.HandleStreams(func(stream *transport.Stream) {
+		wg.Add(1)
+		if s.opts.numServerWorkers > 0 {
+			data := &serverWorkerData{st: st, wg: &wg, stream: stream}
+			select {
+			case s.serverWorkerChannel <- data:
+				return
+			default:
+				// If all stream workers are busy, fallback to the default code path.
+			}
+		}
+		go func() {
+			defer wg.Done()
+			s.handleStream(st, stream, s.traceInfo(st, stream))
+		}()
+	}, func(ctx context.Context, method string) context.Context {
+		if !EnableTracing {
+			return ctx
+		}
+		tr := trace.New("grpc.Recv."+methodFamily(method), method)
+		return trace.NewContext(ctx, tr)
+	})
+	wg.Wait()
+}
+
+var _ http.Handler = (*Server)(nil)
+
+// ServeHTTP implements the Go standard library's http.Handler
+// interface by responding to the gRPC request r, by looking up
+// the requested gRPC method in the gRPC server s.
+//
+// The provided HTTP request must have arrived on an HTTP/2
+// connection. When using the Go standard library's server,
+// practically this means that the Request must also have arrived
+// over TLS.
+//
+// To share one port (such as 443 for https) between gRPC and an
+// existing http.Handler, use a root http.Handler such as:
+//
+//	if r.ProtoMajor == 2 && strings.HasPrefix(
+//		r.Header.Get("Content-Type"), "application/grpc") {
+//		grpcServer.ServeHTTP(w, r)
+//	} else {
+//		yourMux.ServeHTTP(w, r)
+//	}
+//
+// Note that ServeHTTP uses Go's HTTP/2 server implementation which is totally
+// separate from grpc-go's HTTP/2 server. Performance and features may vary
+// between the two paths. ServeHTTP does not support some gRPC features
+// available through grpc-go's HTTP/2 server.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	st, err := transport.NewServerHandlerTransport(w, r, s.opts.statsHandlers)
+	if err != nil {
+		// Errors returned from transport.NewServerHandlerTransport have
+		// already been written to w.
+		return
+	}
+	if !s.addConn(listenerAddressForServeHTTP, st) {
+		return
+	}
+	defer s.removeConn(listenerAddressForServeHTTP, st)
+	s.serveStreams(st)
+}
+
+// traceInfo returns a traceInfo and associates it with stream, if tracing is enabled.
+// If tracing is not enabled, it returns nil.
+func (s *Server) traceInfo(st transport.ServerTransport, stream *transport.Stream) (trInfo *traceInfo) {
+	if !EnableTracing {
+		return nil
+	}
+	tr, ok := trace.FromContext(stream.Context())
+	if !ok {
+		return nil
+	}
+
+	trInfo = &traceInfo{
+		tr: tr,
+		firstLine: firstLine{
+			client:     false,
+			remoteAddr: st.RemoteAddr(),
+		},
+	}
+	if dl, ok := stream.Context().Deadline(); ok {
+		trInfo.firstLine.deadline = time.Until(dl)
+	}
+	return trInfo
+}
+
+func (s *Server) addConn(addr string, st transport.ServerTransport) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.conns == nil {
+		st.Close(errors.New("Server.addConn called when server has already been stopped"))
+		return false
+	}
+	if s.drain {
+		// Transport added after we drained our existing conns: drain it
+		// immediately.
+		st.Drain()
+	}
+
+	if s.conns[addr] == nil {
+		// Create a map entry if this is the first connection on this listener.
+		s.conns[addr] = make(map[transport.ServerTransport]bool)
+	}
+	s.conns[addr][st] = true
+	return true
+}
+
+func (s *Server) removeConn(addr string, st transport.ServerTransport) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	conns := s.conns[addr]
+	if conns != nil {
+		delete(conns, st)
+		if len(conns) == 0 {
+			// If the last connection for this address is being removed, also
+			// remove the map entry corresponding to the address. This is used
+			// in GracefulStop() when waiting for all connections to be closed.
+			delete(s.conns, addr)
+		}
+		s.cv.Broadcast()
+	}
+}
+
+func (s *Server) channelzMetric() *channelz.ServerInternalMetric {
+	return &channelz.ServerInternalMetric{
+		CallsStarted:             atomic.LoadInt64(&s.czData.callsStarted),
+		CallsSucceeded:           atomic.LoadInt64(&s.czData.callsSucceeded),
+		CallsFailed:              atomic.LoadInt64(&s.czData.callsFailed),
+		LastCallStartedTimestamp: time.Unix(0, atomic.LoadInt64(&s.czData.lastCallStartedTime)),
+	}
+}
+
+func (s *Server) incrCallsStarted() {
+	atomic.AddInt64(&s.czData.callsStarted, 1)
+	atomic.StoreInt64(&s.czData.lastCallStartedTime, time.Now().UnixNano())
+}
+
+func (s *Server) incrCallsSucceeded() {
+	atomic.AddInt64(&s.czData.callsSucceeded, 1)
+}
+
+func (s *Server) incrCallsFailed() {
+	atomic.AddInt64(&s.czData.callsFailed, 1)
+}
+
+func (s *Server) sendResponse(t transport.ServerTransport, stream *transport.Stream, msg interface{}, cp Compressor, opts *transport.Options, comp encoding.Compressor) error {
+	data, err := encode(s.getCodec(stream.ContentSubtype()), msg)
+	if err != nil {
+		channelz.Error(logger, s.channelzID, "grpc: server failed to encode response: ", err)
+		return err
+	}
+	compData, err := compress(data, cp, comp)
+	if err != nil {
+		channelz.Error(logger, s.channelzID, "grpc: server failed to compress response: ", err)
+		return err
+	}
+	hdr, payload := msgHeader(data, compData)
+	// TODO(dfawley): should we be checking len(data) instead?
+	if len(payload) > s.opts.maxSendMessageSize {
+		return status.Errorf(codes.ResourceExhausted, "grpc: trying to send message larger than max (%d vs. %d)", len(payload), s.opts.maxSendMessageSize)
+	}
+	err = t.Write(stream, hdr, payload, opts)
+	if err == nil {
+		for _, sh := range s.opts.statsHandlers {
+			sh.HandleRPC(stream.Context(), outPayload(false, msg, data, payload, time.Now()))
+		}
+	}
+	return err
+}
+
+// chainUnaryServerInterceptors chains all unary server interceptors into one.
+func chainUnaryServerInterceptors(s *Server) {
+	// Prepend opts.unaryInt to the chaining interceptors if it exists, since unaryInt will
+	// be executed before any other chained interceptors.
+	interceptors := s.opts.chainUnaryInts
+	if s.opts.unaryInt != nil {
+		interceptors = append([]UnaryServerInterceptor{s.opts.unaryInt}, s.opts.chainUnaryInts...)
+	}
+
+	var chainedInt UnaryServerInterceptor
+	if len(interceptors) == 0 {
+		chainedInt = nil
+	} else if len(interceptors) == 1 {
+		chainedInt = interceptors[0]
+	} else {
+		chainedInt = chainUnaryInterceptors(interceptors)
+	}
+
+	s.opts.unaryInt = chainedInt
+}
+
+func chainUnaryInterceptors(interceptors []UnaryServerInterceptor) UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *UnaryServerInfo, handler UnaryHandler) (interface{}, error) {
+		return interceptors[0](ctx, req, info, getChainUnaryHandler(interceptors, 0, info, handler))
+	}
+}
+
+func getChainUnaryHandler(interceptors []UnaryServerInterceptor, curr int, info *UnaryServerInfo, finalHandler UnaryHandler) UnaryHandler {
+	if curr == len(interceptors)-1 {
+		return finalHandler
+	}
+	return func(ctx context.Context, req interface{}) (interface{}, error) {
+		return interceptors[curr+1](ctx, req, info, getChainUnaryHandler(interceptors, curr+1, info, finalHandler))
+	}
+}
+
+func (s *Server) processUnaryRPC(t transport.ServerTransport, stream *transport.Stream, info *serviceInfo, md *MethodDesc, trInfo *traceInfo) (err error) {
+	shs := s.opts.statsHandlers
+	if len(shs) != 0 || trInfo != nil || channelz.IsOn() {
+		if channelz.IsOn() {
+			s.incrCallsStarted()
+		}
+		var statsBegin *stats.Begin
+		for _, sh := range shs {
+			beginTime := time.Now()
+			statsBegin = &stats.Begin{
+				BeginTime:      beginTime,
+				IsClientStream: false,
+				IsServerStream: false,
+			}
+			sh.HandleRPC(stream.Context(), statsBegin)
+		}
+		if trInfo != nil {
+			trInfo.tr.LazyLog(&trInfo.firstLine, false)
+		}
+		// The deferred error handling for tracing, stats handler and channelz are
+		// combined into one function to reduce stack usage -- a defer takes ~56-64
+		// bytes on the stack, so overflowing the stack will require a stack
+		// re-allocation, which is expensive.
+		//
+		// To maintain behavior similar to separate deferred statements, statements
+		// should be executed in the reverse order. That is, tracing first, stats
+		// handler second, and channelz last. Note that panics *within* defers will
+		// lead to different behavior, but that's an acceptable compromise; that
+		// would be undefined behavior territory anyway.
+		defer func() {
+			if trInfo != nil {
+				if err != nil && err != io.EOF {
+					trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+					trInfo.tr.SetError()
+				}
+				trInfo.tr.Finish()
+			}
+
+			for _, sh := range shs {
+				end := &stats.End{
+					BeginTime: statsBegin.BeginTime,
+					EndTime:   time.Now(),
+				}
+				if err != nil && err != io.EOF {
+					end.Error = toRPCErr(err)
+				}
+				sh.HandleRPC(stream.Context(), end)
+			}
+
+			if channelz.IsOn() {
+				if err != nil && err != io.EOF {
+					s.incrCallsFailed()
+				} else {
+					s.incrCallsSucceeded()
+				}
+			}
+		}()
+	}
+	var binlogs []binarylog.MethodLogger
+	if ml := binarylog.GetMethodLogger(stream.Method()); ml != nil {
+		binlogs = append(binlogs, ml)
+	}
+	if s.opts.binaryLogger != nil {
+		if ml := s.opts.binaryLogger.GetMethodLogger(stream.Method()); ml != nil {
+			binlogs = append(binlogs, ml)
+		}
+	}
+	if len(binlogs) != 0 {
+		ctx := stream.Context()
+		md, _ := metadata.FromIncomingContext(ctx)
+		logEntry := &binarylog.ClientHeader{
+			Header:     md,
+			MethodName: stream.Method(),
+			PeerAddr:   nil,
+		}
+		if deadline, ok := ctx.Deadline(); ok {
+			logEntry.Timeout = time.Until(deadline)
+			if logEntry.Timeout < 0 {
+				logEntry.Timeout = 0
+			}
+		}
+		if a := md[":authority"]; len(a) > 0 {
+			logEntry.Authority = a[0]
+		}
+		if peer, ok := peer.FromContext(ctx); ok {
+			logEntry.PeerAddr = peer.Addr
+		}
+		for _, binlog := range binlogs {
+			binlog.Log(ctx, logEntry)
+		}
+	}
+
+	// comp and cp are used for compression.  decomp and dc are used for
+	// decompression.  If comp and decomp are both set, they are the same;
+	// however they are kept separate to ensure that at most one of the
+	// compressor/decompressor variable pairs are set for use later.
+	var comp, decomp encoding.Compressor
+	var cp Compressor
+	var dc Decompressor
+	var sendCompressorName string
+
+	// If dc is set and matches the stream's compression, use it.  Otherwise, try
+	// to find a matching registered compressor for decomp.
+	if rc := stream.RecvCompress(); s.opts.dc != nil && s.opts.dc.Type() == rc {
+		dc = s.opts.dc
+	} else if rc != "" && rc != encoding.Identity {
+		decomp = encoding.GetCompressor(rc)
+		if decomp == nil {
+			st := status.Newf(codes.Unimplemented, "grpc: Decompressor is not installed for grpc-encoding %q", rc)
+			t.WriteStatus(stream, st)
+			return st.Err()
+		}
+	}
+
+	// If cp is set, use it.  Otherwise, attempt to compress the response using
+	// the incoming message compression method.
+	//
+	// NOTE: this needs to be ahead of all handling, https://github.com/grpc/grpc-go/issues/686.
+	if s.opts.cp != nil {
+		cp = s.opts.cp
+		sendCompressorName = cp.Type()
+	} else if rc := stream.RecvCompress(); rc != "" && rc != encoding.Identity {
+		// Legacy compressor not specified; attempt to respond with same encoding.
+		comp = encoding.GetCompressor(rc)
+		if comp != nil {
+			sendCompressorName = comp.Name()
+		}
+	}
+
+	if sendCompressorName != "" {
+		if err := stream.SetSendCompress(sendCompressorName); err != nil {
+			return status.Errorf(codes.Internal, "grpc: failed to set send compressor: %v", err)
+		}
+	}
+
+	var payInfo *payloadInfo
+	if len(shs) != 0 || len(binlogs) != 0 {
+		payInfo = &payloadInfo{}
+	}
+	d, err := recvAndDecompress(&parser{r: stream}, stream, dc, s.opts.maxReceiveMessageSize, payInfo, decomp)
+	if err != nil {
+		if e := t.WriteStatus(stream, status.Convert(err)); e != nil {
+			channelz.Warningf(logger, s.channelzID, "grpc: Server.processUnaryRPC failed to write status: %v", e)
+		}
+		return err
+	}
+	if channelz.IsOn() {
+		t.IncrMsgRecv()
+	}
+	df := func(v interface{}) error {
+		if err := s.getCodec(stream.ContentSubtype()).Unmarshal(d, v); err != nil {
+			return status.Errorf(codes.Internal, "grpc: error unmarshalling request: %v", err)
+		}
+		for _, sh := range shs {
+			sh.HandleRPC(stream.Context(), &stats.InPayload{
+				RecvTime:         time.Now(),
+				Payload:          v,
+				Length:           len(d),
+				WireLength:       payInfo.compressedLength + headerLen,
+				CompressedLength: payInfo.compressedLength,
+				Data:             d,
+			})
+		}
+		if len(binlogs) != 0 {
+			cm := &binarylog.ClientMessage{
+				Message: d,
+			}
+			for _, binlog := range binlogs {
+				binlog.Log(stream.Context(), cm)
+			}
+		}
+		if trInfo != nil {
+			trInfo.tr.LazyLog(&payload{sent: false, msg: v}, true)
+		}
+		return nil
+	}
+	ctx := NewContextWithServerTransportStream(stream.Context(), stream)
+	reply, appErr := md.Handler(info.serviceImpl, ctx, df, s.opts.unaryInt)
+	if appErr != nil {
+		appStatus, ok := status.FromError(appErr)
+		if !ok {
+			// Convert non-status application error to a status error with code
+			// Unknown, but handle context errors specifically.
+			appStatus = status.FromContextError(appErr)
+			appErr = appStatus.Err()
+		}
+		if trInfo != nil {
+			trInfo.tr.LazyLog(stringer(appStatus.Message()), true)
+			trInfo.tr.SetError()
+		}
+		if e := t.WriteStatus(stream, appStatus); e != nil {
+			channelz.Warningf(logger, s.channelzID, "grpc: Server.processUnaryRPC failed to write status: %v", e)
+		}
+		if len(binlogs) != 0 {
+			if h, _ := stream.Header(); h.Len() > 0 {
+				// Only log serverHeader if there was header. Otherwise it can
+				// be trailer only.
+				sh := &binarylog.ServerHeader{
+					Header: h,
+				}
+				for _, binlog := range binlogs {
+					binlog.Log(stream.Context(), sh)
+				}
+			}
+			st := &binarylog.ServerTrailer{
+				Trailer: stream.Trailer(),
+				Err:     appErr,
+			}
+			for _, binlog := range binlogs {
+				binlog.Log(stream.Context(), st)
+			}
+		}
+		return appErr
+	}
+	if trInfo != nil {
+		trInfo.tr.LazyLog(stringer("OK"), false)
+	}
+	opts := &transport.Options{Last: true}
+
+	// Server handler could have set new compressor by calling SetSendCompressor.
+	// In case it is set, we need to use it for compressing outbound message.
+	if stream.SendCompress() != sendCompressorName {
+		comp = encoding.GetCompressor(stream.SendCompress())
+	}
+	if err := s.sendResponse(t, stream, reply, cp, opts, comp); err != nil {
+		if err == io.EOF {
+			// The entire stream is done (for unary RPC only).
+			return err
+		}
+		if sts, ok := status.FromError(err); ok {
+			if e := t.WriteStatus(stream, sts); e != nil {
+				channelz.Warningf(logger, s.channelzID, "grpc: Server.processUnaryRPC failed to write status: %v", e)
+			}
+		} else {
+			switch st := err.(type) {
+			case transport.ConnectionError:
+				// Nothing to do here.
+			default:
+				panic(fmt.Sprintf("grpc: Unexpected error (%T) from sendResponse: %v", st, st))
+			}
+		}
+		if len(binlogs) != 0 {
+			h, _ := stream.Header()
+			sh := &binarylog.ServerHeader{
+				Header: h,
+			}
+			st := &binarylog.ServerTrailer{
+				Trailer: stream.Trailer(),
+				Err:     appErr,
+			}
+			for _, binlog := range binlogs {
+				binlog.Log(stream.Context(), sh)
+				binlog.Log(stream.Context(), st)
+			}
+		}
+		return err
+	}
+	if len(binlogs) != 0 {
+		h, _ := stream.Header()
+		sh := &binarylog.ServerHeader{
+			Header: h,
+		}
+		sm := &binarylog.ServerMessage{
+			Message: reply,
+		}
+		for _, binlog := range binlogs {
+			binlog.Log(stream.Context(), sh)
+			binlog.Log(stream.Context(), sm)
+		}
+	}
+	if channelz.IsOn() {
+		t.IncrMsgSent()
+	}
+	if trInfo != nil {
+		trInfo.tr.LazyLog(&payload{sent: true, msg: reply}, true)
+	}
+	// TODO: Should we be logging if writing status failed here, like above?
+	// Should the logging be in WriteStatus?  Should we ignore the WriteStatus
+	// error or allow the stats handler to see it?
+	if len(binlogs) != 0 {
+		st := &binarylog.ServerTrailer{
+			Trailer: stream.Trailer(),
+			Err:     appErr,
+		}
+		for _, binlog := range binlogs {
+			binlog.Log(stream.Context(), st)
+		}
+	}
+	return t.WriteStatus(stream, statusOK)
+}
+
+// chainStreamServerInterceptors chains all stream server interceptors into one.
+func chainStreamServerInterceptors(s *Server) {
+	// Prepend opts.streamInt to the chaining interceptors if it exists, since streamInt will
+	// be executed before any other chained interceptors.
+	interceptors := s.opts.chainStreamInts
+	if s.opts.streamInt != nil {
+		interceptors = append([]StreamServerInterceptor{s.opts.streamInt}, s.opts.chainStreamInts...)
+	}
+
+	var chainedInt StreamServerInterceptor
+	if len(interceptors) == 0 {
+		chainedInt = nil
+	} else if len(interceptors) == 1 {
+		chainedInt = interceptors[0]
+	} else {
+		chainedInt = chainStreamInterceptors(interceptors)
+	}
+
+	s.opts.streamInt = chainedInt
+}
+
+func chainStreamInterceptors(interceptors []StreamServerInterceptor) StreamServerInterceptor {
+	return func(srv interface{}, ss ServerStream, info *StreamServerInfo, handler StreamHandler) error {
+		return interceptors[0](srv, ss, info, getChainStreamHandler(interceptors, 0, info, handler))
+	}
+}
+
+func getChainStreamHandler(interceptors []StreamServerInterceptor, curr int, info *StreamServerInfo, finalHandler StreamHandler) StreamHandler {
+	if curr == len(interceptors)-1 {
+		return finalHandler
+	}
+	return func(srv interface{}, stream ServerStream) error {
+		return interceptors[curr+1](srv, stream, info, getChainStreamHandler(interceptors, curr+1, info, finalHandler))
+	}
+}
+
+func (s *Server) processStreamingRPC(t transport.ServerTransport, stream *transport.Stream, info *serviceInfo, sd *StreamDesc, trInfo *traceInfo) (err error) {
+	if channelz.IsOn() {
+		s.incrCallsStarted()
+	}
+	shs := s.opts.statsHandlers
+	var statsBegin *stats.Begin
+	if len(shs) != 0 {
+		beginTime := time.Now()
+		statsBegin = &stats.Begin{
+			BeginTime:      beginTime,
+			IsClientStream: sd.ClientStreams,
+			IsServerStream: sd.ServerStreams,
+		}
+		for _, sh := range shs {
+			sh.HandleRPC(stream.Context(), statsBegin)
+		}
+	}
+	ctx := NewContextWithServerTransportStream(stream.Context(), stream)
+	ss := &serverStream{
+		ctx:                   ctx,
+		t:                     t,
+		s:                     stream,
+		p:                     &parser{r: stream},
+		codec:                 s.getCodec(stream.ContentSubtype()),
+		maxReceiveMessageSize: s.opts.maxReceiveMessageSize,
+		maxSendMessageSize:    s.opts.maxSendMessageSize,
+		trInfo:                trInfo,
+		statsHandler:          shs,
+	}
+
+	if len(shs) != 0 || trInfo != nil || channelz.IsOn() {
+		// See comment in processUnaryRPC on defers.
+		defer func() {
+			if trInfo != nil {
+				ss.mu.Lock()
+				if err != nil && err != io.EOF {
+					ss.trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+					ss.trInfo.tr.SetError()
+				}
+				ss.trInfo.tr.Finish()
+				ss.trInfo.tr = nil
+				ss.mu.Unlock()
+			}
+
+			if len(shs) != 0 {
+				end := &stats.End{
+					BeginTime: statsBegin.BeginTime,
+					EndTime:   time.Now(),
+				}
+				if err != nil && err != io.EOF {
+					end.Error = toRPCErr(err)
+				}
+				for _, sh := range shs {
+					sh.HandleRPC(stream.Context(), end)
+				}
+			}
+
+			if channelz.IsOn() {
+				if err != nil && err != io.EOF {
+					s.incrCallsFailed()
+				} else {
+					s.incrCallsSucceeded()
+				}
+			}
+		}()
+	}
+
+	if ml := binarylog.GetMethodLogger(stream.Method()); ml != nil {
+		ss.binlogs = append(ss.binlogs, ml)
+	}
+	if s.opts.binaryLogger != nil {
+		if ml := s.opts.binaryLogger.GetMethodLogger(stream.Method()); ml != nil {
+			ss.binlogs = append(ss.binlogs, ml)
+		}
+	}
+	if len(ss.binlogs) != 0 {
+		md, _ := metadata.FromIncomingContext(ctx)
+		logEntry := &binarylog.ClientHeader{
+			Header:     md,
+			MethodName: stream.Method(),
+			PeerAddr:   nil,
+		}
+		if deadline, ok := ctx.Deadline(); ok {
+			logEntry.Timeout = time.Until(deadline)
+			if logEntry.Timeout < 0 {
+				logEntry.Timeout = 0
+			}
+		}
+		if a := md[":authority"]; len(a) > 0 {
+			logEntry.Authority = a[0]
+		}
+		if peer, ok := peer.FromContext(ss.Context()); ok {
+			logEntry.PeerAddr = peer.Addr
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(stream.Context(), logEntry)
+		}
+	}
+
+	// If dc is set and matches the stream's compression, use it.  Otherwise, try
+	// to find a matching registered compressor for decomp.
+	if rc := stream.RecvCompress(); s.opts.dc != nil && s.opts.dc.Type() == rc {
+		ss.dc = s.opts.dc
+	} else if rc != "" && rc != encoding.Identity {
+		ss.decomp = encoding.GetCompressor(rc)
+		if ss.decomp == nil {
+			st := status.Newf(codes.Unimplemented, "grpc: Decompressor is not installed for grpc-encoding %q", rc)
+			t.WriteStatus(ss.s, st)
+			return st.Err()
+		}
+	}
+
+	// If cp is set, use it.  Otherwise, attempt to compress the response using
+	// the incoming message compression method.
+	//
+	// NOTE: this needs to be ahead of all handling, https://github.com/grpc/grpc-go/issues/686.
+	if s.opts.cp != nil {
+		ss.cp = s.opts.cp
+		ss.sendCompressorName = s.opts.cp.Type()
+	} else if rc := stream.RecvCompress(); rc != "" && rc != encoding.Identity {
+		// Legacy compressor not specified; attempt to respond with same encoding.
+		ss.comp = encoding.GetCompressor(rc)
+		if ss.comp != nil {
+			ss.sendCompressorName = rc
+		}
+	}
+
+	if ss.sendCompressorName != "" {
+		if err := stream.SetSendCompress(ss.sendCompressorName); err != nil {
+			return status.Errorf(codes.Internal, "grpc: failed to set send compressor: %v", err)
+		}
+	}
+
+	ss.ctx = newContextWithRPCInfo(ss.ctx, false, ss.codec, ss.cp, ss.comp)
+
+	if trInfo != nil {
+		trInfo.tr.LazyLog(&trInfo.firstLine, false)
+	}
+	var appErr error
+	var server interface{}
+	if info != nil {
+		server = info.serviceImpl
+	}
+	if s.opts.streamInt == nil {
+		appErr = sd.Handler(server, ss)
+	} else {
+		info := &StreamServerInfo{
+			FullMethod:     stream.Method(),
+			IsClientStream: sd.ClientStreams,
+			IsServerStream: sd.ServerStreams,
+		}
+		appErr = s.opts.streamInt(server, ss, info, sd.Handler)
+	}
+	if appErr != nil {
+		appStatus, ok := status.FromError(appErr)
+		if !ok {
+			// Convert non-status application error to a status error with code
+			// Unknown, but handle context errors specifically.
+			appStatus = status.FromContextError(appErr)
+			appErr = appStatus.Err()
+		}
+		if trInfo != nil {
+			ss.mu.Lock()
+			ss.trInfo.tr.LazyLog(stringer(appStatus.Message()), true)
+			ss.trInfo.tr.SetError()
+			ss.mu.Unlock()
+		}
+		if len(ss.binlogs) != 0 {
+			st := &binarylog.ServerTrailer{
+				Trailer: ss.s.Trailer(),
+				Err:     appErr,
+			}
+			for _, binlog := range ss.binlogs {
+				binlog.Log(stream.Context(), st)
+			}
+		}
+		t.WriteStatus(ss.s, appStatus)
+		// TODO: Should we log an error from WriteStatus here and below?
+		return appErr
+	}
+	if trInfo != nil {
+		ss.mu.Lock()
+		ss.trInfo.tr.LazyLog(stringer("OK"), false)
+		ss.mu.Unlock()
+	}
+	if len(ss.binlogs) != 0 {
+		st := &binarylog.ServerTrailer{
+			Trailer: ss.s.Trailer(),
+			Err:     appErr,
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(stream.Context(), st)
+		}
+	}
+	return t.WriteStatus(ss.s, statusOK)
+}
+
+func (s *Server) handleStream(t transport.ServerTransport, stream *transport.Stream, trInfo *traceInfo) {
+	sm := stream.Method()
+	if sm != "" && sm[0] == '/' {
+		sm = sm[1:]
+	}
+	pos := strings.LastIndex(sm, "/")
+	if pos == -1 {
+		if trInfo != nil {
+			trInfo.tr.LazyLog(&fmtStringer{"Malformed method name %q", []interface{}{sm}}, true)
+			trInfo.tr.SetError()
+		}
+		errDesc := fmt.Sprintf("malformed method name: %q", stream.Method())
+		if err := t.WriteStatus(stream, status.New(codes.Unimplemented, errDesc)); err != nil {
+			if trInfo != nil {
+				trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+				trInfo.tr.SetError()
+			}
+			channelz.Warningf(logger, s.channelzID, "grpc: Server.handleStream failed to write status: %v", err)
+		}
+		if trInfo != nil {
+			trInfo.tr.Finish()
+		}
+		return
+	}
+	service := sm[:pos]
+	method := sm[pos+1:]
+
+	srv, knownService := s.services[service]
+	if knownService {
+		if md, ok := srv.methods[method]; ok {
+			s.processUnaryRPC(t, stream, srv, md, trInfo)
+			return
+		}
+		if sd, ok := srv.streams[method]; ok {
+			s.processStreamingRPC(t, stream, srv, sd, trInfo)
+			return
+		}
+	}
+	// Unknown service, or known server unknown method.
+	if unknownDesc := s.opts.unknownStreamDesc; unknownDesc != nil {
+		s.processStreamingRPC(t, stream, nil, unknownDesc, trInfo)
+		return
+	}
+	var errDesc string
+	if !knownService {
+		errDesc = fmt.Sprintf("unknown service %v", service)
+	} else {
+		errDesc = fmt.Sprintf("unknown method %v for service %v", method, service)
+	}
+	if trInfo != nil {
+		trInfo.tr.LazyPrintf("%s", errDesc)
+		trInfo.tr.SetError()
+	}
+	if err := t.WriteStatus(stream, status.New(codes.Unimplemented, errDesc)); err != nil {
+		if trInfo != nil {
+			trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+			trInfo.tr.SetError()
+		}
+		channelz.Warningf(logger, s.channelzID, "grpc: Server.handleStream failed to write status: %v", err)
+	}
+	if trInfo != nil {
+		trInfo.tr.Finish()
+	}
+}
+
+// The key to save ServerTransportStream in the context.
+type streamKey struct{}
+
+// NewContextWithServerTransportStream creates a new context from ctx and
+// attaches stream to it.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func NewContextWithServerTransportStream(ctx context.Context, stream ServerTransportStream) context.Context {
+	return context.WithValue(ctx, streamKey{}, stream)
+}
+
+// ServerTransportStream is a minimal interface that a transport stream must
+// implement. This can be used to mock an actual transport stream for tests of
+// handler code that use, for example, grpc.SetHeader (which requires some
+// stream to be in context).
+//
+// See also NewContextWithServerTransportStream.
+//
+// # Experimental
+//
+// Notice: This type is EXPERIMENTAL and may be changed or removed in a
+// later release.
+type ServerTransportStream interface {
+	Method() string
+	SetHeader(md metadata.MD) error
+	SendHeader(md metadata.MD) error
+	SetTrailer(md metadata.MD) error
+}
+
+// ServerTransportStreamFromContext returns the ServerTransportStream saved in
+// ctx. Returns nil if the given context has no stream associated with it
+// (which implies it is not an RPC invocation context).
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ServerTransportStreamFromContext(ctx context.Context) ServerTransportStream {
+	s, _ := ctx.Value(streamKey{}).(ServerTransportStream)
+	return s
+}
+
+// Stop stops the gRPC server. It immediately closes all open
+// connections and listeners.
+// It cancels all active RPCs on the server side and the corresponding
+// pending RPCs on the client side will get notified by connection
+// errors.
+func (s *Server) Stop() {
+	s.quit.Fire()
+
+	defer func() {
+		s.serveWG.Wait()
+		s.done.Fire()
+	}()
+
+	s.channelzRemoveOnce.Do(func() { channelz.RemoveEntry(s.channelzID) })
+
+	s.mu.Lock()
+	listeners := s.lis
+	s.lis = nil
+	conns := s.conns
+	s.conns = nil
+	// interrupt GracefulStop if Stop and GracefulStop are called concurrently.
+	s.cv.Broadcast()
+	s.mu.Unlock()
+
+	for lis := range listeners {
+		lis.Close()
+	}
+	for _, cs := range conns {
+		for st := range cs {
+			st.Close(errors.New("Server.Stop called"))
+		}
+	}
+	if s.opts.numServerWorkers > 0 {
+		s.stopServerWorkers()
+	}
+
+	s.mu.Lock()
+	if s.events != nil {
+		s.events.Finish()
+		s.events = nil
+	}
+	s.mu.Unlock()
+}
+
+// GracefulStop stops the gRPC server gracefully. It stops the server from
+// accepting new connections and RPCs and blocks until all the pending RPCs are
+// finished.
+func (s *Server) GracefulStop() {
+	s.quit.Fire()
+	defer s.done.Fire()
+
+	s.channelzRemoveOnce.Do(func() { channelz.RemoveEntry(s.channelzID) })
+	s.mu.Lock()
+	if s.conns == nil {
+		s.mu.Unlock()
+		return
+	}
+
+	for lis := range s.lis {
+		lis.Close()
+	}
+	s.lis = nil
+	if !s.drain {
+		for _, conns := range s.conns {
+			for st := range conns {
+				st.Drain()
+			}
+		}
+		s.drain = true
+	}
+
+	// Wait for serving threads to be ready to exit.  Only then can we be sure no
+	// new conns will be created.
+	s.mu.Unlock()
+	s.serveWG.Wait()
+	s.mu.Lock()
+
+	for len(s.conns) != 0 {
+		s.cv.Wait()
+	}
+	s.conns = nil
+	if s.events != nil {
+		s.events.Finish()
+		s.events = nil
+	}
+	s.mu.Unlock()
+}
+
+// contentSubtype must be lowercase
+// cannot return nil
+func (s *Server) getCodec(contentSubtype string) baseCodec {
+	if s.opts.codec != nil {
+		return s.opts.codec
+	}
+	if contentSubtype == "" {
+		return encoding.GetCodec(proto.Name)
+	}
+	codec := encoding.GetCodec(contentSubtype)
+	if codec == nil {
+		return encoding.GetCodec(proto.Name)
+	}
+	return codec
+}
+
+// SetHeader sets the header metadata to be sent from the server to the client.
+// The context provided must be the context passed to the server's handler.
+//
+// Streaming RPCs should prefer the SetHeader method of the ServerStream.
+//
+// When called multiple times, all the provided metadata will be merged.  All
+// the metadata will be sent out when one of the following happens:
+//
+//   - grpc.SendHeader is called, or for streaming handlers, stream.SendHeader.
+//   - The first response message is sent.  For unary handlers, this occurs when
+//     the handler returns; for streaming handlers, this can happen when stream's
+//     SendMsg method is called.
+//   - An RPC status is sent out (error or success).  This occurs when the handler
+//     returns.
+//
+// SetHeader will fail if called after any of the events above.
+//
+// The error returned is compatible with the status package.  However, the
+// status code will often not match the RPC status as seen by the client
+// application, and therefore, should not be relied upon for this purpose.
+func SetHeader(ctx context.Context, md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+	stream := ServerTransportStreamFromContext(ctx)
+	if stream == nil {
+		return status.Errorf(codes.Internal, "grpc: failed to fetch the stream from the context %v", ctx)
+	}
+	return stream.SetHeader(md)
+}
+
+// SendHeader sends header metadata. It may be called at most once, and may not
+// be called after any event that causes headers to be sent (see SetHeader for
+// a complete list).  The provided md and headers set by SetHeader() will be
+// sent.
+//
+// The error returned is compatible with the status package.  However, the
+// status code will often not match the RPC status as seen by the client
+// application, and therefore, should not be relied upon for this purpose.
+func SendHeader(ctx context.Context, md metadata.MD) error {
+	stream := ServerTransportStreamFromContext(ctx)
+	if stream == nil {
+		return status.Errorf(codes.Internal, "grpc: failed to fetch the stream from the context %v", ctx)
+	}
+	if err := stream.SendHeader(md); err != nil {
+		return toRPCErr(err)
+	}
+	return nil
+}
+
+// SetSendCompressor sets a compressor for outbound messages from the server.
+// It must not be called after any event that causes headers to be sent
+// (see ServerStream.SetHeader for the complete list). Provided compressor is
+// used when below conditions are met:
+//
+//   - compressor is registered via encoding.RegisterCompressor
+//   - compressor name must exist in the client advertised compressor names
+//     sent in grpc-accept-encoding header. Use ClientSupportedCompressors to
+//     get client supported compressor names.
+//
+// The context provided must be the context passed to the server's handler.
+// It must be noted that compressor name encoding.Identity disables the
+// outbound compression.
+// By default, server messages will be sent using the same compressor with
+// which request messages were sent.
+//
+// It is not safe to call SetSendCompressor concurrently with SendHeader and
+// SendMsg.
+//
+// # Experimental
+//
+// Notice: This function is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func SetSendCompressor(ctx context.Context, name string) error {
+	stream, ok := ServerTransportStreamFromContext(ctx).(*transport.Stream)
+	if !ok || stream == nil {
+		return fmt.Errorf("failed to fetch the stream from the given context")
+	}
+
+	if err := validateSendCompressor(name, stream.ClientAdvertisedCompressors()); err != nil {
+		return fmt.Errorf("unable to set send compressor: %w", err)
+	}
+
+	return stream.SetSendCompress(name)
+}
+
+// ClientSupportedCompressors returns compressor names advertised by the client
+// via grpc-accept-encoding header.
+//
+// The context provided must be the context passed to the server's handler.
+//
+// # Experimental
+//
+// Notice: This function is EXPERIMENTAL and may be changed or removed in a
+// later release.
+func ClientSupportedCompressors(ctx context.Context) ([]string, error) {
+	stream, ok := ServerTransportStreamFromContext(ctx).(*transport.Stream)
+	if !ok || stream == nil {
+		return nil, fmt.Errorf("failed to fetch the stream from the given context %v", ctx)
+	}
+
+	return strings.Split(stream.ClientAdvertisedCompressors(), ","), nil
+}
+
+// SetTrailer sets the trailer metadata that will be sent when an RPC returns.
+// When called more than once, all the provided metadata will be merged.
+//
+// The error returned is compatible with the status package.  However, the
+// status code will often not match the RPC status as seen by the client
+// application, and therefore, should not be relied upon for this purpose.
+func SetTrailer(ctx context.Context, md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+	stream := ServerTransportStreamFromContext(ctx)
+	if stream == nil {
+		return status.Errorf(codes.Internal, "grpc: failed to fetch the stream from the context %v", ctx)
+	}
+	return stream.SetTrailer(md)
+}
+
+// Method returns the method string for the server context.  The returned
+// string is in the format of "/service/method".
+func Method(ctx context.Context) (string, bool) {
+	s := ServerTransportStreamFromContext(ctx)
+	if s == nil {
+		return "", false
+	}
+	return s.Method(), true
+}
+
+type channelzServer struct {
+	s *Server
+}
+
+func (c *channelzServer) ChannelzMetric() *channelz.ServerInternalMetric {
+	return c.s.channelzMetric()
+}
+
+// validateSendCompressor returns an error when given compressor name cannot be
+// handled by the server or the client based on the advertised compressors.
+func validateSendCompressor(name, clientCompressors string) error {
+	if name == encoding.Identity {
+		return nil
+	}
+
+	if !grpcutil.IsCompressorNameRegistered(name) {
+		return fmt.Errorf("compressor not registered %q", name)
+	}
+
+	for _, c := range strings.Split(clientCompressors, ",") {
+		if c == name {
+			return nil // found match
+		}
+	}
+	return fmt.Errorf("client does not support compressor %q", name)
+}
diff --git a/vendor/google.golang.org/grpc/service_config.go b/vendor/google.golang.org/grpc/service_config.go
new file mode 100644
index 0000000000..f22acace42
--- /dev/null
+++ b/vendor/google.golang.org/grpc/service_config.go
@@ -0,0 +1,406 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+	"time"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/internal"
+	internalserviceconfig "google.golang.org/grpc/internal/serviceconfig"
+	"google.golang.org/grpc/serviceconfig"
+)
+
+const maxInt = int(^uint(0) >> 1)
+
+// MethodConfig defines the configuration recommended by the service providers for a
+// particular method.
+//
+// Deprecated: Users should not use this struct. Service config should be received
+// through name resolver, as specified here
+// https://github.com/grpc/grpc/blob/master/doc/service_config.md
+type MethodConfig = internalserviceconfig.MethodConfig
+
+type lbConfig struct {
+	name string
+	cfg  serviceconfig.LoadBalancingConfig
+}
+
+// ServiceConfig is provided by the service provider and contains parameters for how
+// clients that connect to the service should behave.
+//
+// Deprecated: Users should not use this struct. Service config should be received
+// through name resolver, as specified here
+// https://github.com/grpc/grpc/blob/master/doc/service_config.md
+type ServiceConfig struct {
+	serviceconfig.Config
+
+	// LB is the load balancer the service providers recommends.  This is
+	// deprecated; lbConfigs is preferred.  If lbConfig and LB are both present,
+	// lbConfig will be used.
+	LB *string
+
+	// lbConfig is the service config's load balancing configuration.  If
+	// lbConfig and LB are both present, lbConfig will be used.
+	lbConfig *lbConfig
+
+	// Methods contains a map for the methods in this service.  If there is an
+	// exact match for a method (i.e. /service/method) in the map, use the
+	// corresponding MethodConfig.  If there's no exact match, look for the
+	// default config for the service (/service/) and use the corresponding
+	// MethodConfig if it exists.  Otherwise, the method has no MethodConfig to
+	// use.
+	Methods map[string]MethodConfig
+
+	// If a retryThrottlingPolicy is provided, gRPC will automatically throttle
+	// retry attempts and hedged RPCs when the client’s ratio of failures to
+	// successes exceeds a threshold.
+	//
+	// For each server name, the gRPC client will maintain a token_count which is
+	// initially set to maxTokens, and can take values between 0 and maxTokens.
+	//
+	// Every outgoing RPC (regardless of service or method invoked) will change
+	// token_count as follows:
+	//
+	//   - Every failed RPC will decrement the token_count by 1.
+	//   - Every successful RPC will increment the token_count by tokenRatio.
+	//
+	// If token_count is less than or equal to maxTokens / 2, then RPCs will not
+	// be retried and hedged RPCs will not be sent.
+	retryThrottling *retryThrottlingPolicy
+	// healthCheckConfig must be set as one of the requirement to enable LB channel
+	// health check.
+	healthCheckConfig *healthCheckConfig
+	// rawJSONString stores service config json string that get parsed into
+	// this service config struct.
+	rawJSONString string
+}
+
+// healthCheckConfig defines the go-native version of the LB channel health check config.
+type healthCheckConfig struct {
+	// serviceName is the service name to use in the health-checking request.
+	ServiceName string
+}
+
+type jsonRetryPolicy struct {
+	MaxAttempts          int
+	InitialBackoff       string
+	MaxBackoff           string
+	BackoffMultiplier    float64
+	RetryableStatusCodes []codes.Code
+}
+
+// retryThrottlingPolicy defines the go-native version of the retry throttling
+// policy defined by the service config here:
+// https://github.com/grpc/proposal/blob/master/A6-client-retries.md#integration-with-service-config
+type retryThrottlingPolicy struct {
+	// The number of tokens starts at maxTokens. The token_count will always be
+	// between 0 and maxTokens.
+	//
+	// This field is required and must be greater than zero.
+	MaxTokens float64
+	// The amount of tokens to add on each successful RPC. Typically this will
+	// be some number between 0 and 1, e.g., 0.1.
+	//
+	// This field is required and must be greater than zero. Up to 3 decimal
+	// places are supported.
+	TokenRatio float64
+}
+
+func parseDuration(s *string) (*time.Duration, error) {
+	if s == nil {
+		return nil, nil
+	}
+	if !strings.HasSuffix(*s, "s") {
+		return nil, fmt.Errorf("malformed duration %q", *s)
+	}
+	ss := strings.SplitN((*s)[:len(*s)-1], ".", 3)
+	if len(ss) > 2 {
+		return nil, fmt.Errorf("malformed duration %q", *s)
+	}
+	// hasDigits is set if either the whole or fractional part of the number is
+	// present, since both are optional but one is required.
+	hasDigits := false
+	var d time.Duration
+	if len(ss[0]) > 0 {
+		i, err := strconv.ParseInt(ss[0], 10, 32)
+		if err != nil {
+			return nil, fmt.Errorf("malformed duration %q: %v", *s, err)
+		}
+		d = time.Duration(i) * time.Second
+		hasDigits = true
+	}
+	if len(ss) == 2 && len(ss[1]) > 0 {
+		if len(ss[1]) > 9 {
+			return nil, fmt.Errorf("malformed duration %q", *s)
+		}
+		f, err := strconv.ParseInt(ss[1], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("malformed duration %q: %v", *s, err)
+		}
+		for i := 9; i > len(ss[1]); i-- {
+			f *= 10
+		}
+		d += time.Duration(f)
+		hasDigits = true
+	}
+	if !hasDigits {
+		return nil, fmt.Errorf("malformed duration %q", *s)
+	}
+
+	return &d, nil
+}
+
+type jsonName struct {
+	Service string
+	Method  string
+}
+
+var (
+	errDuplicatedName             = errors.New("duplicated name")
+	errEmptyServiceNonEmptyMethod = errors.New("cannot combine empty 'service' and non-empty 'method'")
+)
+
+func (j jsonName) generatePath() (string, error) {
+	if j.Service == "" {
+		if j.Method != "" {
+			return "", errEmptyServiceNonEmptyMethod
+		}
+		return "", nil
+	}
+	res := "/" + j.Service + "/"
+	if j.Method != "" {
+		res += j.Method
+	}
+	return res, nil
+}
+
+// TODO(lyuxuan): delete this struct after cleaning up old service config implementation.
+type jsonMC struct {
+	Name                    *[]jsonName
+	WaitForReady            *bool
+	Timeout                 *string
+	MaxRequestMessageBytes  *int64
+	MaxResponseMessageBytes *int64
+	RetryPolicy             *jsonRetryPolicy
+}
+
+// TODO(lyuxuan): delete this struct after cleaning up old service config implementation.
+type jsonSC struct {
+	LoadBalancingPolicy *string
+	LoadBalancingConfig *internalserviceconfig.BalancerConfig
+	MethodConfig        *[]jsonMC
+	RetryThrottling     *retryThrottlingPolicy
+	HealthCheckConfig   *healthCheckConfig
+}
+
+func init() {
+	internal.ParseServiceConfig = parseServiceConfig
+}
+func parseServiceConfig(js string) *serviceconfig.ParseResult {
+	if len(js) == 0 {
+		return &serviceconfig.ParseResult{Err: fmt.Errorf("no JSON service config provided")}
+	}
+	var rsc jsonSC
+	err := json.Unmarshal([]byte(js), &rsc)
+	if err != nil {
+		logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
+		return &serviceconfig.ParseResult{Err: err}
+	}
+	sc := ServiceConfig{
+		LB:                rsc.LoadBalancingPolicy,
+		Methods:           make(map[string]MethodConfig),
+		retryThrottling:   rsc.RetryThrottling,
+		healthCheckConfig: rsc.HealthCheckConfig,
+		rawJSONString:     js,
+	}
+	if c := rsc.LoadBalancingConfig; c != nil {
+		sc.lbConfig = &lbConfig{
+			name: c.Name,
+			cfg:  c.Config,
+		}
+	}
+
+	if rsc.MethodConfig == nil {
+		return &serviceconfig.ParseResult{Config: &sc}
+	}
+
+	paths := map[string]struct{}{}
+	for _, m := range *rsc.MethodConfig {
+		if m.Name == nil {
+			continue
+		}
+		d, err := parseDuration(m.Timeout)
+		if err != nil {
+			logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
+			return &serviceconfig.ParseResult{Err: err}
+		}
+
+		mc := MethodConfig{
+			WaitForReady: m.WaitForReady,
+			Timeout:      d,
+		}
+		if mc.RetryPolicy, err = convertRetryPolicy(m.RetryPolicy); err != nil {
+			logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
+			return &serviceconfig.ParseResult{Err: err}
+		}
+		if m.MaxRequestMessageBytes != nil {
+			if *m.MaxRequestMessageBytes > int64(maxInt) {
+				mc.MaxReqSize = newInt(maxInt)
+			} else {
+				mc.MaxReqSize = newInt(int(*m.MaxRequestMessageBytes))
+			}
+		}
+		if m.MaxResponseMessageBytes != nil {
+			if *m.MaxResponseMessageBytes > int64(maxInt) {
+				mc.MaxRespSize = newInt(maxInt)
+			} else {
+				mc.MaxRespSize = newInt(int(*m.MaxResponseMessageBytes))
+			}
+		}
+		for i, n := range *m.Name {
+			path, err := n.generatePath()
+			if err != nil {
+				logger.Warningf("grpc: error unmarshaling service config %s due to methodConfig[%d]: %v", js, i, err)
+				return &serviceconfig.ParseResult{Err: err}
+			}
+
+			if _, ok := paths[path]; ok {
+				err = errDuplicatedName
+				logger.Warningf("grpc: error unmarshaling service config %s due to methodConfig[%d]: %v", js, i, err)
+				return &serviceconfig.ParseResult{Err: err}
+			}
+			paths[path] = struct{}{}
+			sc.Methods[path] = mc
+		}
+	}
+
+	if sc.retryThrottling != nil {
+		if mt := sc.retryThrottling.MaxTokens; mt <= 0 || mt > 1000 {
+			return &serviceconfig.ParseResult{Err: fmt.Errorf("invalid retry throttling config: maxTokens (%v) out of range (0, 1000]", mt)}
+		}
+		if tr := sc.retryThrottling.TokenRatio; tr <= 0 {
+			return &serviceconfig.ParseResult{Err: fmt.Errorf("invalid retry throttling config: tokenRatio (%v) may not be negative", tr)}
+		}
+	}
+	return &serviceconfig.ParseResult{Config: &sc}
+}
+
+func convertRetryPolicy(jrp *jsonRetryPolicy) (p *internalserviceconfig.RetryPolicy, err error) {
+	if jrp == nil {
+		return nil, nil
+	}
+	ib, err := parseDuration(&jrp.InitialBackoff)
+	if err != nil {
+		return nil, err
+	}
+	mb, err := parseDuration(&jrp.MaxBackoff)
+	if err != nil {
+		return nil, err
+	}
+
+	if jrp.MaxAttempts <= 1 ||
+		*ib <= 0 ||
+		*mb <= 0 ||
+		jrp.BackoffMultiplier <= 0 ||
+		len(jrp.RetryableStatusCodes) == 0 {
+		logger.Warningf("grpc: ignoring retry policy %v due to illegal configuration", jrp)
+		return nil, nil
+	}
+
+	rp := &internalserviceconfig.RetryPolicy{
+		MaxAttempts:          jrp.MaxAttempts,
+		InitialBackoff:       *ib,
+		MaxBackoff:           *mb,
+		BackoffMultiplier:    jrp.BackoffMultiplier,
+		RetryableStatusCodes: make(map[codes.Code]bool),
+	}
+	if rp.MaxAttempts > 5 {
+		// TODO(retry): Make the max maxAttempts configurable.
+		rp.MaxAttempts = 5
+	}
+	for _, code := range jrp.RetryableStatusCodes {
+		rp.RetryableStatusCodes[code] = true
+	}
+	return rp, nil
+}
+
+func min(a, b *int) *int {
+	if *a < *b {
+		return a
+	}
+	return b
+}
+
+func getMaxSize(mcMax, doptMax *int, defaultVal int) *int {
+	if mcMax == nil && doptMax == nil {
+		return &defaultVal
+	}
+	if mcMax != nil && doptMax != nil {
+		return min(mcMax, doptMax)
+	}
+	if mcMax != nil {
+		return mcMax
+	}
+	return doptMax
+}
+
+func newInt(b int) *int {
+	return &b
+}
+
+func init() {
+	internal.EqualServiceConfigForTesting = equalServiceConfig
+}
+
+// equalServiceConfig compares two configs. The rawJSONString field is ignored,
+// because they may diff in white spaces.
+//
+// If any of them is NOT *ServiceConfig, return false.
+func equalServiceConfig(a, b serviceconfig.Config) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	aa, ok := a.(*ServiceConfig)
+	if !ok {
+		return false
+	}
+	bb, ok := b.(*ServiceConfig)
+	if !ok {
+		return false
+	}
+	aaRaw := aa.rawJSONString
+	aa.rawJSONString = ""
+	bbRaw := bb.rawJSONString
+	bb.rawJSONString = ""
+	defer func() {
+		aa.rawJSONString = aaRaw
+		bb.rawJSONString = bbRaw
+	}()
+	// Using reflect.DeepEqual instead of cmp.Equal because many balancer
+	// configs are unexported, and cmp.Equal cannot compare unexported fields
+	// from unexported structs.
+	return reflect.DeepEqual(aa, bb)
+}
diff --git a/vendor/google.golang.org/grpc/serviceconfig/serviceconfig.go b/vendor/google.golang.org/grpc/serviceconfig/serviceconfig.go
new file mode 100644
index 0000000000..35e7a20a04
--- /dev/null
+++ b/vendor/google.golang.org/grpc/serviceconfig/serviceconfig.go
@@ -0,0 +1,44 @@
+/*
+ *
+ * Copyright 2019 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package serviceconfig defines types and methods for operating on gRPC
+// service configs.
+//
+// # Experimental
+//
+// Notice: This package is EXPERIMENTAL and may be changed or removed in a
+// later release.
+package serviceconfig
+
+// Config represents an opaque data structure holding a service config.
+type Config interface {
+	isServiceConfig()
+}
+
+// LoadBalancingConfig represents an opaque data structure holding a load
+// balancing config.
+type LoadBalancingConfig interface {
+	isLoadBalancingConfig()
+}
+
+// ParseResult contains a service config or an error.  Exactly one must be
+// non-nil.
+type ParseResult struct {
+	Config Config
+	Err    error
+}
diff --git a/vendor/google.golang.org/grpc/stats/handlers.go b/vendor/google.golang.org/grpc/stats/handlers.go
new file mode 100644
index 0000000000..dc03731e45
--- /dev/null
+++ b/vendor/google.golang.org/grpc/stats/handlers.go
@@ -0,0 +1,63 @@
+/*
+ *
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package stats
+
+import (
+	"context"
+	"net"
+)
+
+// ConnTagInfo defines the relevant information needed by connection context tagger.
+type ConnTagInfo struct {
+	// RemoteAddr is the remote address of the corresponding connection.
+	RemoteAddr net.Addr
+	// LocalAddr is the local address of the corresponding connection.
+	LocalAddr net.Addr
+}
+
+// RPCTagInfo defines the relevant information needed by RPC context tagger.
+type RPCTagInfo struct {
+	// FullMethodName is the RPC method in the format of /package.service/method.
+	FullMethodName string
+	// FailFast indicates if this RPC is failfast.
+	// This field is only valid on client side, it's always false on server side.
+	FailFast bool
+}
+
+// Handler defines the interface for the related stats handling (e.g., RPCs, connections).
+type Handler interface {
+	// TagRPC can attach some information to the given context.
+	// The context used for the rest lifetime of the RPC will be derived from
+	// the returned context.
+	TagRPC(context.Context, *RPCTagInfo) context.Context
+	// HandleRPC processes the RPC stats.
+	HandleRPC(context.Context, RPCStats)
+
+	// TagConn can attach some information to the given context.
+	// The returned context will be used for stats handling.
+	// For conn stats handling, the context used in HandleConn for this
+	// connection will be derived from the context returned.
+	// For RPC stats handling,
+	//  - On server side, the context used in HandleRPC for all RPCs on this
+	// connection will be derived from the context returned.
+	//  - On client side, the context is not derived from the context returned.
+	TagConn(context.Context, *ConnTagInfo) context.Context
+	// HandleConn processes the Conn stats.
+	HandleConn(context.Context, ConnStats)
+}
diff --git a/vendor/google.golang.org/grpc/stats/stats.go b/vendor/google.golang.org/grpc/stats/stats.go
new file mode 100644
index 0000000000..7a552a9b78
--- /dev/null
+++ b/vendor/google.golang.org/grpc/stats/stats.go
@@ -0,0 +1,333 @@
+/*
+ *
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package stats is for collecting and reporting various network and RPC stats.
+// This package is for monitoring purpose only. All fields are read-only.
+// All APIs are experimental.
+package stats // import "google.golang.org/grpc/stats"
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"google.golang.org/grpc/metadata"
+)
+
+// RPCStats contains stats information about RPCs.
+type RPCStats interface {
+	isRPCStats()
+	// IsClient returns true if this RPCStats is from client side.
+	IsClient() bool
+}
+
+// Begin contains stats when an RPC attempt begins.
+// FailFast is only valid if this Begin is from client side.
+type Begin struct {
+	// Client is true if this Begin is from client side.
+	Client bool
+	// BeginTime is the time when the RPC attempt begins.
+	BeginTime time.Time
+	// FailFast indicates if this RPC is failfast.
+	FailFast bool
+	// IsClientStream indicates whether the RPC is a client streaming RPC.
+	IsClientStream bool
+	// IsServerStream indicates whether the RPC is a server streaming RPC.
+	IsServerStream bool
+	// IsTransparentRetryAttempt indicates whether this attempt was initiated
+	// due to transparently retrying a previous attempt.
+	IsTransparentRetryAttempt bool
+}
+
+// IsClient indicates if the stats information is from client side.
+func (s *Begin) IsClient() bool { return s.Client }
+
+func (s *Begin) isRPCStats() {}
+
+// InPayload contains the information for an incoming payload.
+type InPayload struct {
+	// Client is true if this InPayload is from client side.
+	Client bool
+	// Payload is the payload with original type.
+	Payload interface{}
+	// Data is the serialized message payload.
+	Data []byte
+
+	// Length is the size of the uncompressed payload data. Does not include any
+	// framing (gRPC or HTTP/2).
+	Length int
+	// CompressedLength is the size of the compressed payload data. Does not
+	// include any framing (gRPC or HTTP/2). Same as Length if compression not
+	// enabled.
+	CompressedLength int
+	// WireLength is the size of the compressed payload data plus gRPC framing.
+	// Does not include HTTP/2 framing.
+	WireLength int
+
+	// RecvTime is the time when the payload is received.
+	RecvTime time.Time
+}
+
+// IsClient indicates if the stats information is from client side.
+func (s *InPayload) IsClient() bool { return s.Client }
+
+func (s *InPayload) isRPCStats() {}
+
+// InHeader contains stats when a header is received.
+type InHeader struct {
+	// Client is true if this InHeader is from client side.
+	Client bool
+	// WireLength is the wire length of header.
+	WireLength int
+	// Compression is the compression algorithm used for the RPC.
+	Compression string
+	// Header contains the header metadata received.
+	Header metadata.MD
+
+	// The following fields are valid only if Client is false.
+	// FullMethod is the full RPC method string, i.e., /package.service/method.
+	FullMethod string
+	// RemoteAddr is the remote address of the corresponding connection.
+	RemoteAddr net.Addr
+	// LocalAddr is the local address of the corresponding connection.
+	LocalAddr net.Addr
+}
+
+// IsClient indicates if the stats information is from client side.
+func (s *InHeader) IsClient() bool { return s.Client }
+
+func (s *InHeader) isRPCStats() {}
+
+// InTrailer contains stats when a trailer is received.
+type InTrailer struct {
+	// Client is true if this InTrailer is from client side.
+	Client bool
+	// WireLength is the wire length of trailer.
+	WireLength int
+	// Trailer contains the trailer metadata received from the server. This
+	// field is only valid if this InTrailer is from the client side.
+	Trailer metadata.MD
+}
+
+// IsClient indicates if the stats information is from client side.
+func (s *InTrailer) IsClient() bool { return s.Client }
+
+func (s *InTrailer) isRPCStats() {}
+
+// OutPayload contains the information for an outgoing payload.
+type OutPayload struct {
+	// Client is true if this OutPayload is from client side.
+	Client bool
+	// Payload is the payload with original type.
+	Payload interface{}
+	// Data is the serialized message payload.
+	Data []byte
+	// Length is the size of the uncompressed payload data. Does not include any
+	// framing (gRPC or HTTP/2).
+	Length int
+	// CompressedLength is the size of the compressed payload data. Does not
+	// include any framing (gRPC or HTTP/2). Same as Length if compression not
+	// enabled.
+	CompressedLength int
+	// WireLength is the size of the compressed payload data plus gRPC framing.
+	// Does not include HTTP/2 framing.
+	WireLength int
+	// SentTime is the time when the payload is sent.
+	SentTime time.Time
+}
+
+// IsClient indicates if this stats information is from client side.
+func (s *OutPayload) IsClient() bool { return s.Client }
+
+func (s *OutPayload) isRPCStats() {}
+
+// OutHeader contains stats when a header is sent.
+type OutHeader struct {
+	// Client is true if this OutHeader is from client side.
+	Client bool
+	// Compression is the compression algorithm used for the RPC.
+	Compression string
+	// Header contains the header metadata sent.
+	Header metadata.MD
+
+	// The following fields are valid only if Client is true.
+	// FullMethod is the full RPC method string, i.e., /package.service/method.
+	FullMethod string
+	// RemoteAddr is the remote address of the corresponding connection.
+	RemoteAddr net.Addr
+	// LocalAddr is the local address of the corresponding connection.
+	LocalAddr net.Addr
+}
+
+// IsClient indicates if this stats information is from client side.
+func (s *OutHeader) IsClient() bool { return s.Client }
+
+func (s *OutHeader) isRPCStats() {}
+
+// OutTrailer contains stats when a trailer is sent.
+type OutTrailer struct {
+	// Client is true if this OutTrailer is from client side.
+	Client bool
+	// WireLength is the wire length of trailer.
+	//
+	// Deprecated: This field is never set. The length is not known when this message is
+	// emitted because the trailer fields are compressed with hpack after that.
+	WireLength int
+	// Trailer contains the trailer metadata sent to the client. This
+	// field is only valid if this OutTrailer is from the server side.
+	Trailer metadata.MD
+}
+
+// IsClient indicates if this stats information is from client side.
+func (s *OutTrailer) IsClient() bool { return s.Client }
+
+func (s *OutTrailer) isRPCStats() {}
+
+// End contains stats when an RPC ends.
+type End struct {
+	// Client is true if this End is from client side.
+	Client bool
+	// BeginTime is the time when the RPC began.
+	BeginTime time.Time
+	// EndTime is the time when the RPC ends.
+	EndTime time.Time
+	// Trailer contains the trailer metadata received from the server. This
+	// field is only valid if this End is from the client side.
+	// Deprecated: use Trailer in InTrailer instead.
+	Trailer metadata.MD
+	// Error is the error the RPC ended with. It is an error generated from
+	// status.Status and can be converted back to status.Status using
+	// status.FromError if non-nil.
+	Error error
+}
+
+// IsClient indicates if this is from client side.
+func (s *End) IsClient() bool { return s.Client }
+
+func (s *End) isRPCStats() {}
+
+// ConnStats contains stats information about connections.
+type ConnStats interface {
+	isConnStats()
+	// IsClient returns true if this ConnStats is from client side.
+	IsClient() bool
+}
+
+// ConnBegin contains the stats of a connection when it is established.
+type ConnBegin struct {
+	// Client is true if this ConnBegin is from client side.
+	Client bool
+}
+
+// IsClient indicates if this is from client side.
+func (s *ConnBegin) IsClient() bool { return s.Client }
+
+func (s *ConnBegin) isConnStats() {}
+
+// ConnEnd contains the stats of a connection when it ends.
+type ConnEnd struct {
+	// Client is true if this ConnEnd is from client side.
+	Client bool
+}
+
+// IsClient indicates if this is from client side.
+func (s *ConnEnd) IsClient() bool { return s.Client }
+
+func (s *ConnEnd) isConnStats() {}
+
+type incomingTagsKey struct{}
+type outgoingTagsKey struct{}
+
+// SetTags attaches stats tagging data to the context, which will be sent in
+// the outgoing RPC with the header grpc-tags-bin.  Subsequent calls to
+// SetTags will overwrite the values from earlier calls.
+//
+// NOTE: this is provided only for backward compatibility with existing clients
+// and will likely be removed in an upcoming release.  New uses should transmit
+// this type of data using metadata with a different, non-reserved (i.e. does
+// not begin with "grpc-") header name.
+func SetTags(ctx context.Context, b []byte) context.Context {
+	return context.WithValue(ctx, outgoingTagsKey{}, b)
+}
+
+// Tags returns the tags from the context for the inbound RPC.
+//
+// NOTE: this is provided only for backward compatibility with existing clients
+// and will likely be removed in an upcoming release.  New uses should transmit
+// this type of data using metadata with a different, non-reserved (i.e. does
+// not begin with "grpc-") header name.
+func Tags(ctx context.Context) []byte {
+	b, _ := ctx.Value(incomingTagsKey{}).([]byte)
+	return b
+}
+
+// SetIncomingTags attaches stats tagging data to the context, to be read by
+// the application (not sent in outgoing RPCs).
+//
+// This is intended for gRPC-internal use ONLY.
+func SetIncomingTags(ctx context.Context, b []byte) context.Context {
+	return context.WithValue(ctx, incomingTagsKey{}, b)
+}
+
+// OutgoingTags returns the tags from the context for the outbound RPC.
+//
+// This is intended for gRPC-internal use ONLY.
+func OutgoingTags(ctx context.Context) []byte {
+	b, _ := ctx.Value(outgoingTagsKey{}).([]byte)
+	return b
+}
+
+type incomingTraceKey struct{}
+type outgoingTraceKey struct{}
+
+// SetTrace attaches stats tagging data to the context, which will be sent in
+// the outgoing RPC with the header grpc-trace-bin.  Subsequent calls to
+// SetTrace will overwrite the values from earlier calls.
+//
+// NOTE: this is provided only for backward compatibility with existing clients
+// and will likely be removed in an upcoming release.  New uses should transmit
+// this type of data using metadata with a different, non-reserved (i.e. does
+// not begin with "grpc-") header name.
+func SetTrace(ctx context.Context, b []byte) context.Context {
+	return context.WithValue(ctx, outgoingTraceKey{}, b)
+}
+
+// Trace returns the trace from the context for the inbound RPC.
+//
+// NOTE: this is provided only for backward compatibility with existing clients
+// and will likely be removed in an upcoming release.  New uses should transmit
+// this type of data using metadata with a different, non-reserved (i.e. does
+// not begin with "grpc-") header name.
+func Trace(ctx context.Context) []byte {
+	b, _ := ctx.Value(incomingTraceKey{}).([]byte)
+	return b
+}
+
+// SetIncomingTrace attaches stats tagging data to the context, to be read by
+// the application (not sent in outgoing RPCs).  It is intended for
+// gRPC-internal use.
+func SetIncomingTrace(ctx context.Context, b []byte) context.Context {
+	return context.WithValue(ctx, incomingTraceKey{}, b)
+}
+
+// OutgoingTrace returns the trace from the context for the outbound RPC.  It is
+// intended for gRPC-internal use.
+func OutgoingTrace(ctx context.Context) []byte {
+	b, _ := ctx.Value(outgoingTraceKey{}).([]byte)
+	return b
+}
diff --git a/vendor/google.golang.org/grpc/status/status.go b/vendor/google.golang.org/grpc/status/status.go
new file mode 100644
index 0000000000..53910fb7c9
--- /dev/null
+++ b/vendor/google.golang.org/grpc/status/status.go
@@ -0,0 +1,139 @@
+/*
+ *
+ * Copyright 2017 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package status implements errors returned by gRPC.  These errors are
+// serialized and transmitted on the wire between server and client, and allow
+// for additional data to be transmitted via the Details field in the status
+// proto.  gRPC service handlers should return an error created by this
+// package, and gRPC clients should expect a corresponding error to be
+// returned from the RPC call.
+//
+// This package upholds the invariants that a non-nil error may not
+// contain an OK code, and an OK code must result in a nil error.
+package status
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	spb "google.golang.org/genproto/googleapis/rpc/status"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/internal/status"
+)
+
+// Status references google.golang.org/grpc/internal/status. It represents an
+// RPC status code, message, and details.  It is immutable and should be
+// created with New, Newf, or FromProto.
+// https://godoc.org/google.golang.org/grpc/internal/status
+type Status = status.Status
+
+// New returns a Status representing c and msg.
+func New(c codes.Code, msg string) *Status {
+	return status.New(c, msg)
+}
+
+// Newf returns New(c, fmt.Sprintf(format, a...)).
+func Newf(c codes.Code, format string, a ...interface{}) *Status {
+	return New(c, fmt.Sprintf(format, a...))
+}
+
+// Error returns an error representing c and msg.  If c is OK, returns nil.
+func Error(c codes.Code, msg string) error {
+	return New(c, msg).Err()
+}
+
+// Errorf returns Error(c, fmt.Sprintf(format, a...)).
+func Errorf(c codes.Code, format string, a ...interface{}) error {
+	return Error(c, fmt.Sprintf(format, a...))
+}
+
+// ErrorProto returns an error representing s.  If s.Code is OK, returns nil.
+func ErrorProto(s *spb.Status) error {
+	return FromProto(s).Err()
+}
+
+// FromProto returns a Status representing s.
+func FromProto(s *spb.Status) *Status {
+	return status.FromProto(s)
+}
+
+// FromError returns a Status representation of err.
+//
+//   - If err was produced by this package or implements the method `GRPCStatus()
+//     *Status`, or if err wraps a type satisfying this, the appropriate Status is
+//     returned.  For wrapped errors, the message returned contains the entire
+//     err.Error() text and not just the wrapped status.
+//
+//   - If err is nil, a Status is returned with codes.OK and no message.
+//
+//   - Otherwise, err is an error not compatible with this package.  In this
+//     case, a Status is returned with codes.Unknown and err's Error() message,
+//     and ok is false.
+func FromError(err error) (s *Status, ok bool) {
+	if err == nil {
+		return nil, true
+	}
+	type grpcstatus interface{ GRPCStatus() *Status }
+	if gs, ok := err.(grpcstatus); ok {
+		return gs.GRPCStatus(), true
+	}
+	var gs grpcstatus
+	if errors.As(err, &gs) {
+		p := gs.GRPCStatus().Proto()
+		p.Message = err.Error()
+		return status.FromProto(p), true
+	}
+	return New(codes.Unknown, err.Error()), false
+}
+
+// Convert is a convenience function which removes the need to handle the
+// boolean return value from FromError.
+func Convert(err error) *Status {
+	s, _ := FromError(err)
+	return s
+}
+
+// Code returns the Code of the error if it is a Status error or if it wraps a
+// Status error. If that is not the case, it returns codes.OK if err is nil, or
+// codes.Unknown otherwise.
+func Code(err error) codes.Code {
+	// Don't use FromError to avoid allocation of OK status.
+	if err == nil {
+		return codes.OK
+	}
+
+	return Convert(err).Code()
+}
+
+// FromContextError converts a context error or wrapped context error into a
+// Status.  It returns a Status with codes.OK if err is nil, or a Status with
+// codes.Unknown if err is non-nil and not a context error.
+func FromContextError(err error) *Status {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		return New(codes.DeadlineExceeded, err.Error())
+	}
+	if errors.Is(err, context.Canceled) {
+		return New(codes.Canceled, err.Error())
+	}
+	return New(codes.Unknown, err.Error())
+}
diff --git a/vendor/google.golang.org/grpc/stream.go b/vendor/google.golang.org/grpc/stream.go
new file mode 100644
index 0000000000..d1226a4120
--- /dev/null
+++ b/vendor/google.golang.org/grpc/stream.go
@@ -0,0 +1,1763 @@
+/*
+ *
+ * Copyright 2014 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"io"
+	"math"
+	"strconv"
+	"sync"
+	"time"
+
+	"golang.org/x/net/trace"
+	"google.golang.org/grpc/balancer"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/encoding"
+	"google.golang.org/grpc/internal/balancerload"
+	"google.golang.org/grpc/internal/binarylog"
+	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/grpcrand"
+	"google.golang.org/grpc/internal/grpcutil"
+	imetadata "google.golang.org/grpc/internal/metadata"
+	iresolver "google.golang.org/grpc/internal/resolver"
+	"google.golang.org/grpc/internal/serviceconfig"
+	istatus "google.golang.org/grpc/internal/status"
+	"google.golang.org/grpc/internal/transport"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/stats"
+	"google.golang.org/grpc/status"
+)
+
+// StreamHandler defines the handler called by gRPC server to complete the
+// execution of a streaming RPC.
+//
+// If a StreamHandler returns an error, it should either be produced by the
+// status package, or be one of the context errors. Otherwise, gRPC will use
+// codes.Unknown as the status code and err.Error() as the status message of the
+// RPC.
+type StreamHandler func(srv interface{}, stream ServerStream) error
+
+// StreamDesc represents a streaming RPC service's method specification.  Used
+// on the server when registering services and on the client when initiating
+// new streams.
+type StreamDesc struct {
+	// StreamName and Handler are only used when registering handlers on a
+	// server.
+	StreamName string        // the name of the method excluding the service
+	Handler    StreamHandler // the handler called for the method
+
+	// ServerStreams and ClientStreams are used for registering handlers on a
+	// server as well as defining RPC behavior when passed to NewClientStream
+	// and ClientConn.NewStream.  At least one must be true.
+	ServerStreams bool // indicates the server can perform streaming sends
+	ClientStreams bool // indicates the client can perform streaming sends
+}
+
+// Stream defines the common interface a client or server stream has to satisfy.
+//
+// Deprecated: See ClientStream and ServerStream documentation instead.
+type Stream interface {
+	// Deprecated: See ClientStream and ServerStream documentation instead.
+	Context() context.Context
+	// Deprecated: See ClientStream and ServerStream documentation instead.
+	SendMsg(m interface{}) error
+	// Deprecated: See ClientStream and ServerStream documentation instead.
+	RecvMsg(m interface{}) error
+}
+
+// ClientStream defines the client-side behavior of a streaming RPC.
+//
+// All errors returned from ClientStream methods are compatible with the
+// status package.
+type ClientStream interface {
+	// Header returns the header metadata received from the server if there
+	// is any. It blocks if the metadata is not ready to read.
+	Header() (metadata.MD, error)
+	// Trailer returns the trailer metadata from the server, if there is any.
+	// It must only be called after stream.CloseAndRecv has returned, or
+	// stream.Recv has returned a non-nil error (including io.EOF).
+	Trailer() metadata.MD
+	// CloseSend closes the send direction of the stream. It closes the stream
+	// when non-nil error is met. It is also not safe to call CloseSend
+	// concurrently with SendMsg.
+	CloseSend() error
+	// Context returns the context for this stream.
+	//
+	// It should not be called until after Header or RecvMsg has returned. Once
+	// called, subsequent client-side retries are disabled.
+	Context() context.Context
+	// SendMsg is generally called by generated code. On error, SendMsg aborts
+	// the stream. If the error was generated by the client, the status is
+	// returned directly; otherwise, io.EOF is returned and the status of
+	// the stream may be discovered using RecvMsg.
+	//
+	// SendMsg blocks until:
+	//   - There is sufficient flow control to schedule m with the transport, or
+	//   - The stream is done, or
+	//   - The stream breaks.
+	//
+	// SendMsg does not wait until the message is received by the server. An
+	// untimely stream closure may result in lost messages. To ensure delivery,
+	// users should ensure the RPC completed successfully using RecvMsg.
+	//
+	// It is safe to have a goroutine calling SendMsg and another goroutine
+	// calling RecvMsg on the same stream at the same time, but it is not safe
+	// to call SendMsg on the same stream in different goroutines. It is also
+	// not safe to call CloseSend concurrently with SendMsg.
+	SendMsg(m interface{}) error
+	// RecvMsg blocks until it receives a message into m or the stream is
+	// done. It returns io.EOF when the stream completes successfully. On
+	// any other error, the stream is aborted and the error contains the RPC
+	// status.
+	//
+	// It is safe to have a goroutine calling SendMsg and another goroutine
+	// calling RecvMsg on the same stream at the same time, but it is not
+	// safe to call RecvMsg on the same stream in different goroutines.
+	RecvMsg(m interface{}) error
+}
+
+// NewStream creates a new Stream for the client side. This is typically
+// called by generated code. ctx is used for the lifetime of the stream.
+//
+// To ensure resources are not leaked due to the stream returned, one of the following
+// actions must be performed:
+//
+//  1. Call Close on the ClientConn.
+//  2. Cancel the context provided.
+//  3. Call RecvMsg until a non-nil error is returned. A protobuf-generated
+//     client-streaming RPC, for instance, might use the helper function
+//     CloseAndRecv (note that CloseSend does not Recv, therefore is not
+//     guaranteed to release all resources).
+//  4. Receive a non-nil, non-io.EOF error from Header or SendMsg.
+//
+// If none of the above happen, a goroutine and a context will be leaked, and grpc
+// will not call the optionally-configured stats handler with a stats.End message.
+func (cc *ClientConn) NewStream(ctx context.Context, desc *StreamDesc, method string, opts ...CallOption) (ClientStream, error) {
+	// allow interceptor to see all applicable call options, which means those
+	// configured as defaults from dial option as well as per-call options
+	opts = combine(cc.dopts.callOptions, opts)
+
+	if cc.dopts.streamInt != nil {
+		return cc.dopts.streamInt(ctx, desc, cc, method, newClientStream, opts...)
+	}
+	return newClientStream(ctx, desc, cc, method, opts...)
+}
+
+// NewClientStream is a wrapper for ClientConn.NewStream.
+func NewClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (ClientStream, error) {
+	return cc.NewStream(ctx, desc, method, opts...)
+}
+
+func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
+	if md, added, ok := metadata.FromOutgoingContextRaw(ctx); ok {
+		// validate md
+		if err := imetadata.Validate(md); err != nil {
+			return nil, status.Error(codes.Internal, err.Error())
+		}
+		// validate added
+		for _, kvs := range added {
+			for i := 0; i < len(kvs); i += 2 {
+				if err := imetadata.ValidatePair(kvs[i], kvs[i+1]); err != nil {
+					return nil, status.Error(codes.Internal, err.Error())
+				}
+			}
+		}
+	}
+	if channelz.IsOn() {
+		cc.incrCallsStarted()
+		defer func() {
+			if err != nil {
+				cc.incrCallsFailed()
+			}
+		}()
+	}
+	// Provide an opportunity for the first RPC to see the first service config
+	// provided by the resolver.
+	if err := cc.waitForResolvedAddrs(ctx); err != nil {
+		return nil, err
+	}
+
+	var mc serviceconfig.MethodConfig
+	var onCommit func()
+	var newStream = func(ctx context.Context, done func()) (iresolver.ClientStream, error) {
+		return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, done, opts...)
+	}
+
+	rpcInfo := iresolver.RPCInfo{Context: ctx, Method: method}
+	rpcConfig, err := cc.safeConfigSelector.SelectConfig(rpcInfo)
+	if err != nil {
+		if st, ok := status.FromError(err); ok {
+			// Restrict the code to the list allowed by gRFC A54.
+			if istatus.IsRestrictedControlPlaneCode(st) {
+				err = status.Errorf(codes.Internal, "config selector returned illegal status: %v", err)
+			}
+			return nil, err
+		}
+		return nil, toRPCErr(err)
+	}
+
+	if rpcConfig != nil {
+		if rpcConfig.Context != nil {
+			ctx = rpcConfig.Context
+		}
+		mc = rpcConfig.MethodConfig
+		onCommit = rpcConfig.OnCommitted
+		if rpcConfig.Interceptor != nil {
+			rpcInfo.Context = nil
+			ns := newStream
+			newStream = func(ctx context.Context, done func()) (iresolver.ClientStream, error) {
+				cs, err := rpcConfig.Interceptor.NewStream(ctx, rpcInfo, done, ns)
+				if err != nil {
+					return nil, toRPCErr(err)
+				}
+				return cs, nil
+			}
+		}
+	}
+
+	return newStream(ctx, func() {})
+}
+
+func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc serviceconfig.MethodConfig, onCommit, doneFunc func(), opts ...CallOption) (_ iresolver.ClientStream, err error) {
+	c := defaultCallInfo()
+	if mc.WaitForReady != nil {
+		c.failFast = !*mc.WaitForReady
+	}
+
+	// Possible context leak:
+	// The cancel function for the child context we create will only be called
+	// when RecvMsg returns a non-nil error, if the ClientConn is closed, or if
+	// an error is generated by SendMsg.
+	// https://github.com/grpc/grpc-go/issues/1818.
+	var cancel context.CancelFunc
+	if mc.Timeout != nil && *mc.Timeout >= 0 {
+		ctx, cancel = context.WithTimeout(ctx, *mc.Timeout)
+	} else {
+		ctx, cancel = context.WithCancel(ctx)
+	}
+	defer func() {
+		if err != nil {
+			cancel()
+		}
+	}()
+
+	for _, o := range opts {
+		if err := o.before(c); err != nil {
+			return nil, toRPCErr(err)
+		}
+	}
+	c.maxSendMessageSize = getMaxSize(mc.MaxReqSize, c.maxSendMessageSize, defaultClientMaxSendMessageSize)
+	c.maxReceiveMessageSize = getMaxSize(mc.MaxRespSize, c.maxReceiveMessageSize, defaultClientMaxReceiveMessageSize)
+	if err := setCallInfoCodec(c); err != nil {
+		return nil, err
+	}
+
+	callHdr := &transport.CallHdr{
+		Host:           cc.authority,
+		Method:         method,
+		ContentSubtype: c.contentSubtype,
+		DoneFunc:       doneFunc,
+	}
+
+	// Set our outgoing compression according to the UseCompressor CallOption, if
+	// set.  In that case, also find the compressor from the encoding package.
+	// Otherwise, use the compressor configured by the WithCompressor DialOption,
+	// if set.
+	var cp Compressor
+	var comp encoding.Compressor
+	if ct := c.compressorType; ct != "" {
+		callHdr.SendCompress = ct
+		if ct != encoding.Identity {
+			comp = encoding.GetCompressor(ct)
+			if comp == nil {
+				return nil, status.Errorf(codes.Internal, "grpc: Compressor is not installed for requested grpc-encoding %q", ct)
+			}
+		}
+	} else if cc.dopts.cp != nil {
+		callHdr.SendCompress = cc.dopts.cp.Type()
+		cp = cc.dopts.cp
+	}
+	if c.creds != nil {
+		callHdr.Creds = c.creds
+	}
+
+	cs := &clientStream{
+		callHdr:      callHdr,
+		ctx:          ctx,
+		methodConfig: &mc,
+		opts:         opts,
+		callInfo:     c,
+		cc:           cc,
+		desc:         desc,
+		codec:        c.codec,
+		cp:           cp,
+		comp:         comp,
+		cancel:       cancel,
+		firstAttempt: true,
+		onCommit:     onCommit,
+	}
+	if !cc.dopts.disableRetry {
+		cs.retryThrottler = cc.retryThrottler.Load().(*retryThrottler)
+	}
+	if ml := binarylog.GetMethodLogger(method); ml != nil {
+		cs.binlogs = append(cs.binlogs, ml)
+	}
+	if cc.dopts.binaryLogger != nil {
+		if ml := cc.dopts.binaryLogger.GetMethodLogger(method); ml != nil {
+			cs.binlogs = append(cs.binlogs, ml)
+		}
+	}
+
+	// Pick the transport to use and create a new stream on the transport.
+	// Assign cs.attempt upon success.
+	op := func(a *csAttempt) error {
+		if err := a.getTransport(); err != nil {
+			return err
+		}
+		if err := a.newStream(); err != nil {
+			return err
+		}
+		// Because this operation is always called either here (while creating
+		// the clientStream) or by the retry code while locked when replaying
+		// the operation, it is safe to access cs.attempt directly.
+		cs.attempt = a
+		return nil
+	}
+	if err := cs.withRetry(op, func() { cs.bufferForRetryLocked(0, op) }); err != nil {
+		return nil, err
+	}
+
+	if len(cs.binlogs) != 0 {
+		md, _ := metadata.FromOutgoingContext(ctx)
+		logEntry := &binarylog.ClientHeader{
+			OnClientSide: true,
+			Header:       md,
+			MethodName:   method,
+			Authority:    cs.cc.authority,
+		}
+		if deadline, ok := ctx.Deadline(); ok {
+			logEntry.Timeout = time.Until(deadline)
+			if logEntry.Timeout < 0 {
+				logEntry.Timeout = 0
+			}
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cs.ctx, logEntry)
+		}
+	}
+
+	if desc != unaryStreamDesc {
+		// Listen on cc and stream contexts to cleanup when the user closes the
+		// ClientConn or cancels the stream context.  In all other cases, an error
+		// should already be injected into the recv buffer by the transport, which
+		// the client will eventually receive, and then we will cancel the stream's
+		// context in clientStream.finish.
+		go func() {
+			select {
+			case <-cc.ctx.Done():
+				cs.finish(ErrClientConnClosing)
+			case <-ctx.Done():
+				cs.finish(toRPCErr(ctx.Err()))
+			}
+		}()
+	}
+	return cs, nil
+}
+
+// newAttemptLocked creates a new csAttempt without a transport or stream.
+func (cs *clientStream) newAttemptLocked(isTransparent bool) (*csAttempt, error) {
+	if err := cs.ctx.Err(); err != nil {
+		return nil, toRPCErr(err)
+	}
+	if err := cs.cc.ctx.Err(); err != nil {
+		return nil, ErrClientConnClosing
+	}
+
+	ctx := newContextWithRPCInfo(cs.ctx, cs.callInfo.failFast, cs.callInfo.codec, cs.cp, cs.comp)
+	method := cs.callHdr.Method
+	var beginTime time.Time
+	shs := cs.cc.dopts.copts.StatsHandlers
+	for _, sh := range shs {
+		ctx = sh.TagRPC(ctx, &stats.RPCTagInfo{FullMethodName: method, FailFast: cs.callInfo.failFast})
+		beginTime = time.Now()
+		begin := &stats.Begin{
+			Client:                    true,
+			BeginTime:                 beginTime,
+			FailFast:                  cs.callInfo.failFast,
+			IsClientStream:            cs.desc.ClientStreams,
+			IsServerStream:            cs.desc.ServerStreams,
+			IsTransparentRetryAttempt: isTransparent,
+		}
+		sh.HandleRPC(ctx, begin)
+	}
+
+	var trInfo *traceInfo
+	if EnableTracing {
+		trInfo = &traceInfo{
+			tr: trace.New("grpc.Sent."+methodFamily(method), method),
+			firstLine: firstLine{
+				client: true,
+			},
+		}
+		if deadline, ok := ctx.Deadline(); ok {
+			trInfo.firstLine.deadline = time.Until(deadline)
+		}
+		trInfo.tr.LazyLog(&trInfo.firstLine, false)
+		ctx = trace.NewContext(ctx, trInfo.tr)
+	}
+
+	if cs.cc.parsedTarget.URL.Scheme == "xds" {
+		// Add extra metadata (metadata that will be added by transport) to context
+		// so the balancer can see them.
+		ctx = grpcutil.WithExtraMetadata(ctx, metadata.Pairs(
+			"content-type", grpcutil.ContentType(cs.callHdr.ContentSubtype),
+		))
+	}
+
+	return &csAttempt{
+		ctx:           ctx,
+		beginTime:     beginTime,
+		cs:            cs,
+		dc:            cs.cc.dopts.dc,
+		statsHandlers: shs,
+		trInfo:        trInfo,
+	}, nil
+}
+
+func (a *csAttempt) getTransport() error {
+	cs := a.cs
+
+	var err error
+	a.t, a.pickResult, err = cs.cc.getTransport(a.ctx, cs.callInfo.failFast, cs.callHdr.Method)
+	if err != nil {
+		if de, ok := err.(dropError); ok {
+			err = de.error
+			a.drop = true
+		}
+		return err
+	}
+	if a.trInfo != nil {
+		a.trInfo.firstLine.SetRemoteAddr(a.t.RemoteAddr())
+	}
+	return nil
+}
+
+func (a *csAttempt) newStream() error {
+	cs := a.cs
+	cs.callHdr.PreviousAttempts = cs.numRetries
+
+	// Merge metadata stored in PickResult, if any, with existing call metadata.
+	// It is safe to overwrite the csAttempt's context here, since all state
+	// maintained in it are local to the attempt. When the attempt has to be
+	// retried, a new instance of csAttempt will be created.
+	if a.pickResult.Metatada != nil {
+		// We currently do not have a function it the metadata package which
+		// merges given metadata with existing metadata in a context. Existing
+		// function `AppendToOutgoingContext()` takes a variadic argument of key
+		// value pairs.
+		//
+		// TODO: Make it possible to retrieve key value pairs from metadata.MD
+		// in a form passable to AppendToOutgoingContext(), or create a version
+		// of AppendToOutgoingContext() that accepts a metadata.MD.
+		md, _ := metadata.FromOutgoingContext(a.ctx)
+		md = metadata.Join(md, a.pickResult.Metatada)
+		a.ctx = metadata.NewOutgoingContext(a.ctx, md)
+	}
+
+	s, err := a.t.NewStream(a.ctx, cs.callHdr)
+	if err != nil {
+		nse, ok := err.(*transport.NewStreamError)
+		if !ok {
+			// Unexpected.
+			return err
+		}
+
+		if nse.AllowTransparentRetry {
+			a.allowTransparentRetry = true
+		}
+
+		// Unwrap and convert error.
+		return toRPCErr(nse.Err)
+	}
+	a.s = s
+	a.p = &parser{r: s}
+	return nil
+}
+
+// clientStream implements a client side Stream.
+type clientStream struct {
+	callHdr  *transport.CallHdr
+	opts     []CallOption
+	callInfo *callInfo
+	cc       *ClientConn
+	desc     *StreamDesc
+
+	codec baseCodec
+	cp    Compressor
+	comp  encoding.Compressor
+
+	cancel context.CancelFunc // cancels all attempts
+
+	sentLast bool // sent an end stream
+
+	methodConfig *MethodConfig
+
+	ctx context.Context // the application's context, wrapped by stats/tracing
+
+	retryThrottler *retryThrottler // The throttler active when the RPC began.
+
+	binlogs []binarylog.MethodLogger
+	// serverHeaderBinlogged is a boolean for whether server header has been
+	// logged. Server header will be logged when the first time one of those
+	// happens: stream.Header(), stream.Recv().
+	//
+	// It's only read and used by Recv() and Header(), so it doesn't need to be
+	// synchronized.
+	serverHeaderBinlogged bool
+
+	mu                      sync.Mutex
+	firstAttempt            bool // if true, transparent retry is valid
+	numRetries              int  // exclusive of transparent retry attempt(s)
+	numRetriesSincePushback int  // retries since pushback; to reset backoff
+	finished                bool // TODO: replace with atomic cmpxchg or sync.Once?
+	// attempt is the active client stream attempt.
+	// The only place where it is written is the newAttemptLocked method and this method never writes nil.
+	// So, attempt can be nil only inside newClientStream function when clientStream is first created.
+	// One of the first things done after clientStream's creation, is to call newAttemptLocked which either
+	// assigns a non nil value to the attempt or returns an error. If an error is returned from newAttemptLocked,
+	// then newClientStream calls finish on the clientStream and returns. So, finish method is the only
+	// place where we need to check if the attempt is nil.
+	attempt *csAttempt
+	// TODO(hedging): hedging will have multiple attempts simultaneously.
+	committed  bool // active attempt committed for retry?
+	onCommit   func()
+	buffer     []func(a *csAttempt) error // operations to replay on retry
+	bufferSize int                        // current size of buffer
+}
+
+// csAttempt implements a single transport stream attempt within a
+// clientStream.
+type csAttempt struct {
+	ctx        context.Context
+	cs         *clientStream
+	t          transport.ClientTransport
+	s          *transport.Stream
+	p          *parser
+	pickResult balancer.PickResult
+
+	finished  bool
+	dc        Decompressor
+	decomp    encoding.Compressor
+	decompSet bool
+
+	mu sync.Mutex // guards trInfo.tr
+	// trInfo may be nil (if EnableTracing is false).
+	// trInfo.tr is set when created (if EnableTracing is true),
+	// and cleared when the finish method is called.
+	trInfo *traceInfo
+
+	statsHandlers []stats.Handler
+	beginTime     time.Time
+
+	// set for newStream errors that may be transparently retried
+	allowTransparentRetry bool
+	// set for pick errors that are returned as a status
+	drop bool
+}
+
+func (cs *clientStream) commitAttemptLocked() {
+	if !cs.committed && cs.onCommit != nil {
+		cs.onCommit()
+	}
+	cs.committed = true
+	cs.buffer = nil
+}
+
+func (cs *clientStream) commitAttempt() {
+	cs.mu.Lock()
+	cs.commitAttemptLocked()
+	cs.mu.Unlock()
+}
+
+// shouldRetry returns nil if the RPC should be retried; otherwise it returns
+// the error that should be returned by the operation.  If the RPC should be
+// retried, the bool indicates whether it is being retried transparently.
+func (a *csAttempt) shouldRetry(err error) (bool, error) {
+	cs := a.cs
+
+	if cs.finished || cs.committed || a.drop {
+		// RPC is finished or committed or was dropped by the picker; cannot retry.
+		return false, err
+	}
+	if a.s == nil && a.allowTransparentRetry {
+		return true, nil
+	}
+	// Wait for the trailers.
+	unprocessed := false
+	if a.s != nil {
+		<-a.s.Done()
+		unprocessed = a.s.Unprocessed()
+	}
+	if cs.firstAttempt && unprocessed {
+		// First attempt, stream unprocessed: transparently retry.
+		return true, nil
+	}
+	if cs.cc.dopts.disableRetry {
+		return false, err
+	}
+
+	pushback := 0
+	hasPushback := false
+	if a.s != nil {
+		if !a.s.TrailersOnly() {
+			return false, err
+		}
+
+		// TODO(retry): Move down if the spec changes to not check server pushback
+		// before considering this a failure for throttling.
+		sps := a.s.Trailer()["grpc-retry-pushback-ms"]
+		if len(sps) == 1 {
+			var e error
+			if pushback, e = strconv.Atoi(sps[0]); e != nil || pushback < 0 {
+				channelz.Infof(logger, cs.cc.channelzID, "Server retry pushback specified to abort (%q).", sps[0])
+				cs.retryThrottler.throttle() // This counts as a failure for throttling.
+				return false, err
+			}
+			hasPushback = true
+		} else if len(sps) > 1 {
+			channelz.Warningf(logger, cs.cc.channelzID, "Server retry pushback specified multiple values (%q); not retrying.", sps)
+			cs.retryThrottler.throttle() // This counts as a failure for throttling.
+			return false, err
+		}
+	}
+
+	var code codes.Code
+	if a.s != nil {
+		code = a.s.Status().Code()
+	} else {
+		code = status.Code(err)
+	}
+
+	rp := cs.methodConfig.RetryPolicy
+	if rp == nil || !rp.RetryableStatusCodes[code] {
+		return false, err
+	}
+
+	// Note: the ordering here is important; we count this as a failure
+	// only if the code matched a retryable code.
+	if cs.retryThrottler.throttle() {
+		return false, err
+	}
+	if cs.numRetries+1 >= rp.MaxAttempts {
+		return false, err
+	}
+
+	var dur time.Duration
+	if hasPushback {
+		dur = time.Millisecond * time.Duration(pushback)
+		cs.numRetriesSincePushback = 0
+	} else {
+		fact := math.Pow(rp.BackoffMultiplier, float64(cs.numRetriesSincePushback))
+		cur := float64(rp.InitialBackoff) * fact
+		if max := float64(rp.MaxBackoff); cur > max {
+			cur = max
+		}
+		dur = time.Duration(grpcrand.Int63n(int64(cur)))
+		cs.numRetriesSincePushback++
+	}
+
+	// TODO(dfawley): we could eagerly fail here if dur puts us past the
+	// deadline, but unsure if it is worth doing.
+	t := time.NewTimer(dur)
+	select {
+	case <-t.C:
+		cs.numRetries++
+		return false, nil
+	case <-cs.ctx.Done():
+		t.Stop()
+		return false, status.FromContextError(cs.ctx.Err()).Err()
+	}
+}
+
+// Returns nil if a retry was performed and succeeded; error otherwise.
+func (cs *clientStream) retryLocked(attempt *csAttempt, lastErr error) error {
+	for {
+		attempt.finish(toRPCErr(lastErr))
+		isTransparent, err := attempt.shouldRetry(lastErr)
+		if err != nil {
+			cs.commitAttemptLocked()
+			return err
+		}
+		cs.firstAttempt = false
+		attempt, err = cs.newAttemptLocked(isTransparent)
+		if err != nil {
+			// Only returns error if the clientconn is closed or the context of
+			// the stream is canceled.
+			return err
+		}
+		// Note that the first op in the replay buffer always sets cs.attempt
+		// if it is able to pick a transport and create a stream.
+		if lastErr = cs.replayBufferLocked(attempt); lastErr == nil {
+			return nil
+		}
+	}
+}
+
+func (cs *clientStream) Context() context.Context {
+	cs.commitAttempt()
+	// No need to lock before using attempt, since we know it is committed and
+	// cannot change.
+	if cs.attempt.s != nil {
+		return cs.attempt.s.Context()
+	}
+	return cs.ctx
+}
+
+func (cs *clientStream) withRetry(op func(a *csAttempt) error, onSuccess func()) error {
+	cs.mu.Lock()
+	for {
+		if cs.committed {
+			cs.mu.Unlock()
+			// toRPCErr is used in case the error from the attempt comes from
+			// NewClientStream, which intentionally doesn't return a status
+			// error to allow for further inspection; all other errors should
+			// already be status errors.
+			return toRPCErr(op(cs.attempt))
+		}
+		if len(cs.buffer) == 0 {
+			// For the first op, which controls creation of the stream and
+			// assigns cs.attempt, we need to create a new attempt inline
+			// before executing the first op.  On subsequent ops, the attempt
+			// is created immediately before replaying the ops.
+			var err error
+			if cs.attempt, err = cs.newAttemptLocked(false /* isTransparent */); err != nil {
+				cs.mu.Unlock()
+				cs.finish(err)
+				return err
+			}
+		}
+		a := cs.attempt
+		cs.mu.Unlock()
+		err := op(a)
+		cs.mu.Lock()
+		if a != cs.attempt {
+			// We started another attempt already.
+			continue
+		}
+		if err == io.EOF {
+			<-a.s.Done()
+		}
+		if err == nil || (err == io.EOF && a.s.Status().Code() == codes.OK) {
+			onSuccess()
+			cs.mu.Unlock()
+			return err
+		}
+		if err := cs.retryLocked(a, err); err != nil {
+			cs.mu.Unlock()
+			return err
+		}
+	}
+}
+
+func (cs *clientStream) Header() (metadata.MD, error) {
+	var m metadata.MD
+	noHeader := false
+	err := cs.withRetry(func(a *csAttempt) error {
+		var err error
+		m, err = a.s.Header()
+		if err == transport.ErrNoHeaders {
+			noHeader = true
+			return nil
+		}
+		return toRPCErr(err)
+	}, cs.commitAttemptLocked)
+
+	if err != nil {
+		cs.finish(err)
+		return nil, err
+	}
+
+	if len(cs.binlogs) != 0 && !cs.serverHeaderBinlogged && !noHeader {
+		// Only log if binary log is on and header has not been logged, and
+		// there is actually headers to log.
+		logEntry := &binarylog.ServerHeader{
+			OnClientSide: true,
+			Header:       m,
+			PeerAddr:     nil,
+		}
+		if peer, ok := peer.FromContext(cs.Context()); ok {
+			logEntry.PeerAddr = peer.Addr
+		}
+		cs.serverHeaderBinlogged = true
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cs.ctx, logEntry)
+		}
+	}
+	return m, nil
+}
+
+func (cs *clientStream) Trailer() metadata.MD {
+	// On RPC failure, we never need to retry, because usage requires that
+	// RecvMsg() returned a non-nil error before calling this function is valid.
+	// We would have retried earlier if necessary.
+	//
+	// Commit the attempt anyway, just in case users are not following those
+	// directions -- it will prevent races and should not meaningfully impact
+	// performance.
+	cs.commitAttempt()
+	if cs.attempt.s == nil {
+		return nil
+	}
+	return cs.attempt.s.Trailer()
+}
+
+func (cs *clientStream) replayBufferLocked(attempt *csAttempt) error {
+	for _, f := range cs.buffer {
+		if err := f(attempt); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (cs *clientStream) bufferForRetryLocked(sz int, op func(a *csAttempt) error) {
+	// Note: we still will buffer if retry is disabled (for transparent retries).
+	if cs.committed {
+		return
+	}
+	cs.bufferSize += sz
+	if cs.bufferSize > cs.callInfo.maxRetryRPCBufferSize {
+		cs.commitAttemptLocked()
+		return
+	}
+	cs.buffer = append(cs.buffer, op)
+}
+
+func (cs *clientStream) SendMsg(m interface{}) (err error) {
+	defer func() {
+		if err != nil && err != io.EOF {
+			// Call finish on the client stream for errors generated by this SendMsg
+			// call, as these indicate problems created by this client.  (Transport
+			// errors are converted to an io.EOF error in csAttempt.sendMsg; the real
+			// error will be returned from RecvMsg eventually in that case, or be
+			// retried.)
+			cs.finish(err)
+		}
+	}()
+	if cs.sentLast {
+		return status.Errorf(codes.Internal, "SendMsg called after CloseSend")
+	}
+	if !cs.desc.ClientStreams {
+		cs.sentLast = true
+	}
+
+	// load hdr, payload, data
+	hdr, payload, data, err := prepareMsg(m, cs.codec, cs.cp, cs.comp)
+	if err != nil {
+		return err
+	}
+
+	// TODO(dfawley): should we be checking len(data) instead?
+	if len(payload) > *cs.callInfo.maxSendMessageSize {
+		return status.Errorf(codes.ResourceExhausted, "trying to send message larger than max (%d vs. %d)", len(payload), *cs.callInfo.maxSendMessageSize)
+	}
+	op := func(a *csAttempt) error {
+		return a.sendMsg(m, hdr, payload, data)
+	}
+	err = cs.withRetry(op, func() { cs.bufferForRetryLocked(len(hdr)+len(payload), op) })
+	if len(cs.binlogs) != 0 && err == nil {
+		cm := &binarylog.ClientMessage{
+			OnClientSide: true,
+			Message:      data,
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cs.ctx, cm)
+		}
+	}
+	return err
+}
+
+func (cs *clientStream) RecvMsg(m interface{}) error {
+	if len(cs.binlogs) != 0 && !cs.serverHeaderBinlogged {
+		// Call Header() to binary log header if it's not already logged.
+		cs.Header()
+	}
+	var recvInfo *payloadInfo
+	if len(cs.binlogs) != 0 {
+		recvInfo = &payloadInfo{}
+	}
+	err := cs.withRetry(func(a *csAttempt) error {
+		return a.recvMsg(m, recvInfo)
+	}, cs.commitAttemptLocked)
+	if len(cs.binlogs) != 0 && err == nil {
+		sm := &binarylog.ServerMessage{
+			OnClientSide: true,
+			Message:      recvInfo.uncompressedBytes,
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cs.ctx, sm)
+		}
+	}
+	if err != nil || !cs.desc.ServerStreams {
+		// err != nil or non-server-streaming indicates end of stream.
+		cs.finish(err)
+
+		if len(cs.binlogs) != 0 {
+			// finish will not log Trailer. Log Trailer here.
+			logEntry := &binarylog.ServerTrailer{
+				OnClientSide: true,
+				Trailer:      cs.Trailer(),
+				Err:          err,
+			}
+			if logEntry.Err == io.EOF {
+				logEntry.Err = nil
+			}
+			if peer, ok := peer.FromContext(cs.Context()); ok {
+				logEntry.PeerAddr = peer.Addr
+			}
+			for _, binlog := range cs.binlogs {
+				binlog.Log(cs.ctx, logEntry)
+			}
+		}
+	}
+	return err
+}
+
+func (cs *clientStream) CloseSend() error {
+	if cs.sentLast {
+		// TODO: return an error and finish the stream instead, due to API misuse?
+		return nil
+	}
+	cs.sentLast = true
+	op := func(a *csAttempt) error {
+		a.t.Write(a.s, nil, nil, &transport.Options{Last: true})
+		// Always return nil; io.EOF is the only error that might make sense
+		// instead, but there is no need to signal the client to call RecvMsg
+		// as the only use left for the stream after CloseSend is to call
+		// RecvMsg.  This also matches historical behavior.
+		return nil
+	}
+	cs.withRetry(op, func() { cs.bufferForRetryLocked(0, op) })
+	if len(cs.binlogs) != 0 {
+		chc := &binarylog.ClientHalfClose{
+			OnClientSide: true,
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cs.ctx, chc)
+		}
+	}
+	// We never returned an error here for reasons.
+	return nil
+}
+
+func (cs *clientStream) finish(err error) {
+	if err == io.EOF {
+		// Ending a stream with EOF indicates a success.
+		err = nil
+	}
+	cs.mu.Lock()
+	if cs.finished {
+		cs.mu.Unlock()
+		return
+	}
+	cs.finished = true
+	for _, onFinish := range cs.callInfo.onFinish {
+		onFinish(err)
+	}
+	cs.commitAttemptLocked()
+	if cs.attempt != nil {
+		cs.attempt.finish(err)
+		// after functions all rely upon having a stream.
+		if cs.attempt.s != nil {
+			for _, o := range cs.opts {
+				o.after(cs.callInfo, cs.attempt)
+			}
+		}
+	}
+	cs.mu.Unlock()
+	// For binary logging. only log cancel in finish (could be caused by RPC ctx
+	// canceled or ClientConn closed). Trailer will be logged in RecvMsg.
+	//
+	// Only one of cancel or trailer needs to be logged. In the cases where
+	// users don't call RecvMsg, users must have already canceled the RPC.
+	if len(cs.binlogs) != 0 && status.Code(err) == codes.Canceled {
+		c := &binarylog.Cancel{
+			OnClientSide: true,
+		}
+		for _, binlog := range cs.binlogs {
+			binlog.Log(cs.ctx, c)
+		}
+	}
+	if err == nil {
+		cs.retryThrottler.successfulRPC()
+	}
+	if channelz.IsOn() {
+		if err != nil {
+			cs.cc.incrCallsFailed()
+		} else {
+			cs.cc.incrCallsSucceeded()
+		}
+	}
+	cs.cancel()
+}
+
+func (a *csAttempt) sendMsg(m interface{}, hdr, payld, data []byte) error {
+	cs := a.cs
+	if a.trInfo != nil {
+		a.mu.Lock()
+		if a.trInfo.tr != nil {
+			a.trInfo.tr.LazyLog(&payload{sent: true, msg: m}, true)
+		}
+		a.mu.Unlock()
+	}
+	if err := a.t.Write(a.s, hdr, payld, &transport.Options{Last: !cs.desc.ClientStreams}); err != nil {
+		if !cs.desc.ClientStreams {
+			// For non-client-streaming RPCs, we return nil instead of EOF on error
+			// because the generated code requires it.  finish is not called; RecvMsg()
+			// will call it with the stream's status independently.
+			return nil
+		}
+		return io.EOF
+	}
+	for _, sh := range a.statsHandlers {
+		sh.HandleRPC(a.ctx, outPayload(true, m, data, payld, time.Now()))
+	}
+	if channelz.IsOn() {
+		a.t.IncrMsgSent()
+	}
+	return nil
+}
+
+func (a *csAttempt) recvMsg(m interface{}, payInfo *payloadInfo) (err error) {
+	cs := a.cs
+	if len(a.statsHandlers) != 0 && payInfo == nil {
+		payInfo = &payloadInfo{}
+	}
+
+	if !a.decompSet {
+		// Block until we receive headers containing received message encoding.
+		if ct := a.s.RecvCompress(); ct != "" && ct != encoding.Identity {
+			if a.dc == nil || a.dc.Type() != ct {
+				// No configured decompressor, or it does not match the incoming
+				// message encoding; attempt to find a registered compressor that does.
+				a.dc = nil
+				a.decomp = encoding.GetCompressor(ct)
+			}
+		} else {
+			// No compression is used; disable our decompressor.
+			a.dc = nil
+		}
+		// Only initialize this state once per stream.
+		a.decompSet = true
+	}
+	err = recv(a.p, cs.codec, a.s, a.dc, m, *cs.callInfo.maxReceiveMessageSize, payInfo, a.decomp)
+	if err != nil {
+		if err == io.EOF {
+			if statusErr := a.s.Status().Err(); statusErr != nil {
+				return statusErr
+			}
+			return io.EOF // indicates successful end of stream.
+		}
+
+		return toRPCErr(err)
+	}
+	if a.trInfo != nil {
+		a.mu.Lock()
+		if a.trInfo.tr != nil {
+			a.trInfo.tr.LazyLog(&payload{sent: false, msg: m}, true)
+		}
+		a.mu.Unlock()
+	}
+	for _, sh := range a.statsHandlers {
+		sh.HandleRPC(a.ctx, &stats.InPayload{
+			Client:   true,
+			RecvTime: time.Now(),
+			Payload:  m,
+			// TODO truncate large payload.
+			Data:             payInfo.uncompressedBytes,
+			WireLength:       payInfo.compressedLength + headerLen,
+			CompressedLength: payInfo.compressedLength,
+			Length:           len(payInfo.uncompressedBytes),
+		})
+	}
+	if channelz.IsOn() {
+		a.t.IncrMsgRecv()
+	}
+	if cs.desc.ServerStreams {
+		// Subsequent messages should be received by subsequent RecvMsg calls.
+		return nil
+	}
+	// Special handling for non-server-stream rpcs.
+	// This recv expects EOF or errors, so we don't collect inPayload.
+	err = recv(a.p, cs.codec, a.s, a.dc, m, *cs.callInfo.maxReceiveMessageSize, nil, a.decomp)
+	if err == nil {
+		return toRPCErr(errors.New("grpc: client streaming protocol violation: get <nil>, want <EOF>"))
+	}
+	if err == io.EOF {
+		return a.s.Status().Err() // non-server streaming Recv returns nil on success
+	}
+	return toRPCErr(err)
+}
+
+func (a *csAttempt) finish(err error) {
+	a.mu.Lock()
+	if a.finished {
+		a.mu.Unlock()
+		return
+	}
+	a.finished = true
+	if err == io.EOF {
+		// Ending a stream with EOF indicates a success.
+		err = nil
+	}
+	var tr metadata.MD
+	if a.s != nil {
+		a.t.CloseStream(a.s, err)
+		tr = a.s.Trailer()
+	}
+
+	if a.pickResult.Done != nil {
+		br := false
+		if a.s != nil {
+			br = a.s.BytesReceived()
+		}
+		a.pickResult.Done(balancer.DoneInfo{
+			Err:           err,
+			Trailer:       tr,
+			BytesSent:     a.s != nil,
+			BytesReceived: br,
+			ServerLoad:    balancerload.Parse(tr),
+		})
+	}
+	for _, sh := range a.statsHandlers {
+		end := &stats.End{
+			Client:    true,
+			BeginTime: a.beginTime,
+			EndTime:   time.Now(),
+			Trailer:   tr,
+			Error:     err,
+		}
+		sh.HandleRPC(a.ctx, end)
+	}
+	if a.trInfo != nil && a.trInfo.tr != nil {
+		if err == nil {
+			a.trInfo.tr.LazyPrintf("RPC: [OK]")
+		} else {
+			a.trInfo.tr.LazyPrintf("RPC: [%v]", err)
+			a.trInfo.tr.SetError()
+		}
+		a.trInfo.tr.Finish()
+		a.trInfo.tr = nil
+	}
+	a.mu.Unlock()
+}
+
+// newClientStream creates a ClientStream with the specified transport, on the
+// given addrConn.
+//
+// It's expected that the given transport is either the same one in addrConn, or
+// is already closed. To avoid race, transport is specified separately, instead
+// of using ac.transpot.
+//
+// Main difference between this and ClientConn.NewStream:
+// - no retry
+// - no service config (or wait for service config)
+// - no tracing or stats
+func newNonRetryClientStream(ctx context.Context, desc *StreamDesc, method string, t transport.ClientTransport, ac *addrConn, opts ...CallOption) (_ ClientStream, err error) {
+	if t == nil {
+		// TODO: return RPC error here?
+		return nil, errors.New("transport provided is nil")
+	}
+	// defaultCallInfo contains unnecessary info(i.e. failfast, maxRetryRPCBufferSize), so we just initialize an empty struct.
+	c := &callInfo{}
+
+	// Possible context leak:
+	// The cancel function for the child context we create will only be called
+	// when RecvMsg returns a non-nil error, if the ClientConn is closed, or if
+	// an error is generated by SendMsg.
+	// https://github.com/grpc/grpc-go/issues/1818.
+	ctx, cancel := context.WithCancel(ctx)
+	defer func() {
+		if err != nil {
+			cancel()
+		}
+	}()
+
+	for _, o := range opts {
+		if err := o.before(c); err != nil {
+			return nil, toRPCErr(err)
+		}
+	}
+	c.maxReceiveMessageSize = getMaxSize(nil, c.maxReceiveMessageSize, defaultClientMaxReceiveMessageSize)
+	c.maxSendMessageSize = getMaxSize(nil, c.maxSendMessageSize, defaultServerMaxSendMessageSize)
+	if err := setCallInfoCodec(c); err != nil {
+		return nil, err
+	}
+
+	callHdr := &transport.CallHdr{
+		Host:           ac.cc.authority,
+		Method:         method,
+		ContentSubtype: c.contentSubtype,
+	}
+
+	// Set our outgoing compression according to the UseCompressor CallOption, if
+	// set.  In that case, also find the compressor from the encoding package.
+	// Otherwise, use the compressor configured by the WithCompressor DialOption,
+	// if set.
+	var cp Compressor
+	var comp encoding.Compressor
+	if ct := c.compressorType; ct != "" {
+		callHdr.SendCompress = ct
+		if ct != encoding.Identity {
+			comp = encoding.GetCompressor(ct)
+			if comp == nil {
+				return nil, status.Errorf(codes.Internal, "grpc: Compressor is not installed for requested grpc-encoding %q", ct)
+			}
+		}
+	} else if ac.cc.dopts.cp != nil {
+		callHdr.SendCompress = ac.cc.dopts.cp.Type()
+		cp = ac.cc.dopts.cp
+	}
+	if c.creds != nil {
+		callHdr.Creds = c.creds
+	}
+
+	// Use a special addrConnStream to avoid retry.
+	as := &addrConnStream{
+		callHdr:  callHdr,
+		ac:       ac,
+		ctx:      ctx,
+		cancel:   cancel,
+		opts:     opts,
+		callInfo: c,
+		desc:     desc,
+		codec:    c.codec,
+		cp:       cp,
+		comp:     comp,
+		t:        t,
+	}
+
+	s, err := as.t.NewStream(as.ctx, as.callHdr)
+	if err != nil {
+		err = toRPCErr(err)
+		return nil, err
+	}
+	as.s = s
+	as.p = &parser{r: s}
+	ac.incrCallsStarted()
+	if desc != unaryStreamDesc {
+		// Listen on cc and stream contexts to cleanup when the user closes the
+		// ClientConn or cancels the stream context.  In all other cases, an error
+		// should already be injected into the recv buffer by the transport, which
+		// the client will eventually receive, and then we will cancel the stream's
+		// context in clientStream.finish.
+		go func() {
+			select {
+			case <-ac.ctx.Done():
+				as.finish(status.Error(codes.Canceled, "grpc: the SubConn is closing"))
+			case <-ctx.Done():
+				as.finish(toRPCErr(ctx.Err()))
+			}
+		}()
+	}
+	return as, nil
+}
+
+type addrConnStream struct {
+	s         *transport.Stream
+	ac        *addrConn
+	callHdr   *transport.CallHdr
+	cancel    context.CancelFunc
+	opts      []CallOption
+	callInfo  *callInfo
+	t         transport.ClientTransport
+	ctx       context.Context
+	sentLast  bool
+	desc      *StreamDesc
+	codec     baseCodec
+	cp        Compressor
+	comp      encoding.Compressor
+	decompSet bool
+	dc        Decompressor
+	decomp    encoding.Compressor
+	p         *parser
+	mu        sync.Mutex
+	finished  bool
+}
+
+func (as *addrConnStream) Header() (metadata.MD, error) {
+	m, err := as.s.Header()
+	if err != nil {
+		as.finish(toRPCErr(err))
+	}
+	return m, err
+}
+
+func (as *addrConnStream) Trailer() metadata.MD {
+	return as.s.Trailer()
+}
+
+func (as *addrConnStream) CloseSend() error {
+	if as.sentLast {
+		// TODO: return an error and finish the stream instead, due to API misuse?
+		return nil
+	}
+	as.sentLast = true
+
+	as.t.Write(as.s, nil, nil, &transport.Options{Last: true})
+	// Always return nil; io.EOF is the only error that might make sense
+	// instead, but there is no need to signal the client to call RecvMsg
+	// as the only use left for the stream after CloseSend is to call
+	// RecvMsg.  This also matches historical behavior.
+	return nil
+}
+
+func (as *addrConnStream) Context() context.Context {
+	return as.s.Context()
+}
+
+func (as *addrConnStream) SendMsg(m interface{}) (err error) {
+	defer func() {
+		if err != nil && err != io.EOF {
+			// Call finish on the client stream for errors generated by this SendMsg
+			// call, as these indicate problems created by this client.  (Transport
+			// errors are converted to an io.EOF error in csAttempt.sendMsg; the real
+			// error will be returned from RecvMsg eventually in that case, or be
+			// retried.)
+			as.finish(err)
+		}
+	}()
+	if as.sentLast {
+		return status.Errorf(codes.Internal, "SendMsg called after CloseSend")
+	}
+	if !as.desc.ClientStreams {
+		as.sentLast = true
+	}
+
+	// load hdr, payload, data
+	hdr, payld, _, err := prepareMsg(m, as.codec, as.cp, as.comp)
+	if err != nil {
+		return err
+	}
+
+	// TODO(dfawley): should we be checking len(data) instead?
+	if len(payld) > *as.callInfo.maxSendMessageSize {
+		return status.Errorf(codes.ResourceExhausted, "trying to send message larger than max (%d vs. %d)", len(payld), *as.callInfo.maxSendMessageSize)
+	}
+
+	if err := as.t.Write(as.s, hdr, payld, &transport.Options{Last: !as.desc.ClientStreams}); err != nil {
+		if !as.desc.ClientStreams {
+			// For non-client-streaming RPCs, we return nil instead of EOF on error
+			// because the generated code requires it.  finish is not called; RecvMsg()
+			// will call it with the stream's status independently.
+			return nil
+		}
+		return io.EOF
+	}
+
+	if channelz.IsOn() {
+		as.t.IncrMsgSent()
+	}
+	return nil
+}
+
+func (as *addrConnStream) RecvMsg(m interface{}) (err error) {
+	defer func() {
+		if err != nil || !as.desc.ServerStreams {
+			// err != nil or non-server-streaming indicates end of stream.
+			as.finish(err)
+		}
+	}()
+
+	if !as.decompSet {
+		// Block until we receive headers containing received message encoding.
+		if ct := as.s.RecvCompress(); ct != "" && ct != encoding.Identity {
+			if as.dc == nil || as.dc.Type() != ct {
+				// No configured decompressor, or it does not match the incoming
+				// message encoding; attempt to find a registered compressor that does.
+				as.dc = nil
+				as.decomp = encoding.GetCompressor(ct)
+			}
+		} else {
+			// No compression is used; disable our decompressor.
+			as.dc = nil
+		}
+		// Only initialize this state once per stream.
+		as.decompSet = true
+	}
+	err = recv(as.p, as.codec, as.s, as.dc, m, *as.callInfo.maxReceiveMessageSize, nil, as.decomp)
+	if err != nil {
+		if err == io.EOF {
+			if statusErr := as.s.Status().Err(); statusErr != nil {
+				return statusErr
+			}
+			return io.EOF // indicates successful end of stream.
+		}
+		return toRPCErr(err)
+	}
+
+	if channelz.IsOn() {
+		as.t.IncrMsgRecv()
+	}
+	if as.desc.ServerStreams {
+		// Subsequent messages should be received by subsequent RecvMsg calls.
+		return nil
+	}
+
+	// Special handling for non-server-stream rpcs.
+	// This recv expects EOF or errors, so we don't collect inPayload.
+	err = recv(as.p, as.codec, as.s, as.dc, m, *as.callInfo.maxReceiveMessageSize, nil, as.decomp)
+	if err == nil {
+		return toRPCErr(errors.New("grpc: client streaming protocol violation: get <nil>, want <EOF>"))
+	}
+	if err == io.EOF {
+		return as.s.Status().Err() // non-server streaming Recv returns nil on success
+	}
+	return toRPCErr(err)
+}
+
+func (as *addrConnStream) finish(err error) {
+	as.mu.Lock()
+	if as.finished {
+		as.mu.Unlock()
+		return
+	}
+	as.finished = true
+	if err == io.EOF {
+		// Ending a stream with EOF indicates a success.
+		err = nil
+	}
+	if as.s != nil {
+		as.t.CloseStream(as.s, err)
+	}
+
+	if err != nil {
+		as.ac.incrCallsFailed()
+	} else {
+		as.ac.incrCallsSucceeded()
+	}
+	as.cancel()
+	as.mu.Unlock()
+}
+
+// ServerStream defines the server-side behavior of a streaming RPC.
+//
+// Errors returned from ServerStream methods are compatible with the status
+// package.  However, the status code will often not match the RPC status as
+// seen by the client application, and therefore, should not be relied upon for
+// this purpose.
+type ServerStream interface {
+	// SetHeader sets the header metadata. It may be called multiple times.
+	// When call multiple times, all the provided metadata will be merged.
+	// All the metadata will be sent out when one of the following happens:
+	//  - ServerStream.SendHeader() is called;
+	//  - The first response is sent out;
+	//  - An RPC status is sent out (error or success).
+	SetHeader(metadata.MD) error
+	// SendHeader sends the header metadata.
+	// The provided md and headers set by SetHeader() will be sent.
+	// It fails if called multiple times.
+	SendHeader(metadata.MD) error
+	// SetTrailer sets the trailer metadata which will be sent with the RPC status.
+	// When called more than once, all the provided metadata will be merged.
+	SetTrailer(metadata.MD)
+	// Context returns the context for this stream.
+	Context() context.Context
+	// SendMsg sends a message. On error, SendMsg aborts the stream and the
+	// error is returned directly.
+	//
+	// SendMsg blocks until:
+	//   - There is sufficient flow control to schedule m with the transport, or
+	//   - The stream is done, or
+	//   - The stream breaks.
+	//
+	// SendMsg does not wait until the message is received by the client. An
+	// untimely stream closure may result in lost messages.
+	//
+	// It is safe to have a goroutine calling SendMsg and another goroutine
+	// calling RecvMsg on the same stream at the same time, but it is not safe
+	// to call SendMsg on the same stream in different goroutines.
+	//
+	// It is not safe to modify the message after calling SendMsg. Tracing
+	// libraries and stats handlers may use the message lazily.
+	SendMsg(m interface{}) error
+	// RecvMsg blocks until it receives a message into m or the stream is
+	// done. It returns io.EOF when the client has performed a CloseSend. On
+	// any non-EOF error, the stream is aborted and the error contains the
+	// RPC status.
+	//
+	// It is safe to have a goroutine calling SendMsg and another goroutine
+	// calling RecvMsg on the same stream at the same time, but it is not
+	// safe to call RecvMsg on the same stream in different goroutines.
+	RecvMsg(m interface{}) error
+}
+
+// serverStream implements a server side Stream.
+type serverStream struct {
+	ctx   context.Context
+	t     transport.ServerTransport
+	s     *transport.Stream
+	p     *parser
+	codec baseCodec
+
+	cp     Compressor
+	dc     Decompressor
+	comp   encoding.Compressor
+	decomp encoding.Compressor
+
+	sendCompressorName string
+
+	maxReceiveMessageSize int
+	maxSendMessageSize    int
+	trInfo                *traceInfo
+
+	statsHandler []stats.Handler
+
+	binlogs []binarylog.MethodLogger
+	// serverHeaderBinlogged indicates whether server header has been logged. It
+	// will happen when one of the following two happens: stream.SendHeader(),
+	// stream.Send().
+	//
+	// It's only checked in send and sendHeader, doesn't need to be
+	// synchronized.
+	serverHeaderBinlogged bool
+
+	mu sync.Mutex // protects trInfo.tr after the service handler runs.
+}
+
+func (ss *serverStream) Context() context.Context {
+	return ss.ctx
+}
+
+func (ss *serverStream) SetHeader(md metadata.MD) error {
+	if md.Len() == 0 {
+		return nil
+	}
+	err := imetadata.Validate(md)
+	if err != nil {
+		return status.Error(codes.Internal, err.Error())
+	}
+	return ss.s.SetHeader(md)
+}
+
+func (ss *serverStream) SendHeader(md metadata.MD) error {
+	err := imetadata.Validate(md)
+	if err != nil {
+		return status.Error(codes.Internal, err.Error())
+	}
+
+	err = ss.t.WriteHeader(ss.s, md)
+	if len(ss.binlogs) != 0 && !ss.serverHeaderBinlogged {
+		h, _ := ss.s.Header()
+		sh := &binarylog.ServerHeader{
+			Header: h,
+		}
+		ss.serverHeaderBinlogged = true
+		for _, binlog := range ss.binlogs {
+			binlog.Log(ss.ctx, sh)
+		}
+	}
+	return err
+}
+
+func (ss *serverStream) SetTrailer(md metadata.MD) {
+	if md.Len() == 0 {
+		return
+	}
+	if err := imetadata.Validate(md); err != nil {
+		logger.Errorf("stream: failed to validate md when setting trailer, err: %v", err)
+	}
+	ss.s.SetTrailer(md)
+}
+
+func (ss *serverStream) SendMsg(m interface{}) (err error) {
+	defer func() {
+		if ss.trInfo != nil {
+			ss.mu.Lock()
+			if ss.trInfo.tr != nil {
+				if err == nil {
+					ss.trInfo.tr.LazyLog(&payload{sent: true, msg: m}, true)
+				} else {
+					ss.trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+					ss.trInfo.tr.SetError()
+				}
+			}
+			ss.mu.Unlock()
+		}
+		if err != nil && err != io.EOF {
+			st, _ := status.FromError(toRPCErr(err))
+			ss.t.WriteStatus(ss.s, st)
+			// Non-user specified status was sent out. This should be an error
+			// case (as a server side Cancel maybe).
+			//
+			// This is not handled specifically now. User will return a final
+			// status from the service handler, we will log that error instead.
+			// This behavior is similar to an interceptor.
+		}
+		if channelz.IsOn() && err == nil {
+			ss.t.IncrMsgSent()
+		}
+	}()
+
+	// Server handler could have set new compressor by calling SetSendCompressor.
+	// In case it is set, we need to use it for compressing outbound message.
+	if sendCompressorsName := ss.s.SendCompress(); sendCompressorsName != ss.sendCompressorName {
+		ss.comp = encoding.GetCompressor(sendCompressorsName)
+		ss.sendCompressorName = sendCompressorsName
+	}
+
+	// load hdr, payload, data
+	hdr, payload, data, err := prepareMsg(m, ss.codec, ss.cp, ss.comp)
+	if err != nil {
+		return err
+	}
+
+	// TODO(dfawley): should we be checking len(data) instead?
+	if len(payload) > ss.maxSendMessageSize {
+		return status.Errorf(codes.ResourceExhausted, "trying to send message larger than max (%d vs. %d)", len(payload), ss.maxSendMessageSize)
+	}
+	if err := ss.t.Write(ss.s, hdr, payload, &transport.Options{Last: false}); err != nil {
+		return toRPCErr(err)
+	}
+	if len(ss.binlogs) != 0 {
+		if !ss.serverHeaderBinlogged {
+			h, _ := ss.s.Header()
+			sh := &binarylog.ServerHeader{
+				Header: h,
+			}
+			ss.serverHeaderBinlogged = true
+			for _, binlog := range ss.binlogs {
+				binlog.Log(ss.ctx, sh)
+			}
+		}
+		sm := &binarylog.ServerMessage{
+			Message: data,
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(ss.ctx, sm)
+		}
+	}
+	if len(ss.statsHandler) != 0 {
+		for _, sh := range ss.statsHandler {
+			sh.HandleRPC(ss.s.Context(), outPayload(false, m, data, payload, time.Now()))
+		}
+	}
+	return nil
+}
+
+func (ss *serverStream) RecvMsg(m interface{}) (err error) {
+	defer func() {
+		if ss.trInfo != nil {
+			ss.mu.Lock()
+			if ss.trInfo.tr != nil {
+				if err == nil {
+					ss.trInfo.tr.LazyLog(&payload{sent: false, msg: m}, true)
+				} else if err != io.EOF {
+					ss.trInfo.tr.LazyLog(&fmtStringer{"%v", []interface{}{err}}, true)
+					ss.trInfo.tr.SetError()
+				}
+			}
+			ss.mu.Unlock()
+		}
+		if err != nil && err != io.EOF {
+			st, _ := status.FromError(toRPCErr(err))
+			ss.t.WriteStatus(ss.s, st)
+			// Non-user specified status was sent out. This should be an error
+			// case (as a server side Cancel maybe).
+			//
+			// This is not handled specifically now. User will return a final
+			// status from the service handler, we will log that error instead.
+			// This behavior is similar to an interceptor.
+		}
+		if channelz.IsOn() && err == nil {
+			ss.t.IncrMsgRecv()
+		}
+	}()
+	var payInfo *payloadInfo
+	if len(ss.statsHandler) != 0 || len(ss.binlogs) != 0 {
+		payInfo = &payloadInfo{}
+	}
+	if err := recv(ss.p, ss.codec, ss.s, ss.dc, m, ss.maxReceiveMessageSize, payInfo, ss.decomp); err != nil {
+		if err == io.EOF {
+			if len(ss.binlogs) != 0 {
+				chc := &binarylog.ClientHalfClose{}
+				for _, binlog := range ss.binlogs {
+					binlog.Log(ss.ctx, chc)
+				}
+			}
+			return err
+		}
+		if err == io.ErrUnexpectedEOF {
+			err = status.Errorf(codes.Internal, io.ErrUnexpectedEOF.Error())
+		}
+		return toRPCErr(err)
+	}
+	if len(ss.statsHandler) != 0 {
+		for _, sh := range ss.statsHandler {
+			sh.HandleRPC(ss.s.Context(), &stats.InPayload{
+				RecvTime: time.Now(),
+				Payload:  m,
+				// TODO truncate large payload.
+				Data:             payInfo.uncompressedBytes,
+				Length:           len(payInfo.uncompressedBytes),
+				WireLength:       payInfo.compressedLength + headerLen,
+				CompressedLength: payInfo.compressedLength,
+			})
+		}
+	}
+	if len(ss.binlogs) != 0 {
+		cm := &binarylog.ClientMessage{
+			Message: payInfo.uncompressedBytes,
+		}
+		for _, binlog := range ss.binlogs {
+			binlog.Log(ss.ctx, cm)
+		}
+	}
+	return nil
+}
+
+// MethodFromServerStream returns the method string for the input stream.
+// The returned string is in the format of "/service/method".
+func MethodFromServerStream(stream ServerStream) (string, bool) {
+	return Method(stream.Context())
+}
+
+// prepareMsg returns the hdr, payload and data
+// using the compressors passed or using the
+// passed preparedmsg
+func prepareMsg(m interface{}, codec baseCodec, cp Compressor, comp encoding.Compressor) (hdr, payload, data []byte, err error) {
+	if preparedMsg, ok := m.(*PreparedMsg); ok {
+		return preparedMsg.hdr, preparedMsg.payload, preparedMsg.encodedData, nil
+	}
+	// The input interface is not a prepared msg.
+	// Marshal and Compress the data at this point
+	data, err = encode(codec, m)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	compData, err := compress(data, cp, comp)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	hdr, payload = msgHeader(data, compData)
+	return hdr, payload, data, nil
+}
diff --git a/vendor/google.golang.org/grpc/tap/tap.go b/vendor/google.golang.org/grpc/tap/tap.go
new file mode 100644
index 0000000000..bfa5dfa40e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/tap/tap.go
@@ -0,0 +1,56 @@
+/*
+ *
+ * Copyright 2016 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package tap defines the function handles which are executed on the transport
+// layer of gRPC-Go and related information.
+//
+// # Experimental
+//
+// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// later release.
+package tap
+
+import (
+	"context"
+)
+
+// Info defines the relevant information needed by the handles.
+type Info struct {
+	// FullMethodName is the string of grpc method (in the format of
+	// /package.service/method).
+	FullMethodName string
+	// TODO: More to be added.
+}
+
+// ServerInHandle defines the function which runs before a new stream is
+// created on the server side. If it returns a non-nil error, the stream will
+// not be created and an error will be returned to the client.  If the error
+// returned is a status error, that status code and message will be used,
+// otherwise PermissionDenied will be the code and err.Error() will be the
+// message.
+//
+// It's intended to be used in situations where you don't want to waste the
+// resources to accept the new stream (e.g. rate-limiting). For other general
+// usages, please use interceptors.
+//
+// Note that it is executed in the per-connection I/O goroutine(s) instead of
+// per-RPC goroutine. Therefore, users should NOT have any
+// blocking/time-consuming work in this handle. Otherwise all the RPCs would
+// slow down. Also, for the same reason, this handle won't be called
+// concurrently by gRPC.
+type ServerInHandle func(ctx context.Context, info *Info) (context.Context, error)
diff --git a/vendor/google.golang.org/grpc/trace.go b/vendor/google.golang.org/grpc/trace.go
new file mode 100644
index 0000000000..07a2d26b3e
--- /dev/null
+++ b/vendor/google.golang.org/grpc/trace.go
@@ -0,0 +1,123 @@
+/*
+ *
+ * Copyright 2015 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/net/trace"
+)
+
+// EnableTracing controls whether to trace RPCs using the golang.org/x/net/trace package.
+// This should only be set before any RPCs are sent or received by this program.
+var EnableTracing bool
+
+// methodFamily returns the trace family for the given method.
+// It turns "/pkg.Service/GetFoo" into "pkg.Service".
+func methodFamily(m string) string {
+	m = strings.TrimPrefix(m, "/") // remove leading slash
+	if i := strings.Index(m, "/"); i >= 0 {
+		m = m[:i] // remove everything from second slash
+	}
+	return m
+}
+
+// traceInfo contains tracing information for an RPC.
+type traceInfo struct {
+	tr        trace.Trace
+	firstLine firstLine
+}
+
+// firstLine is the first line of an RPC trace.
+// It may be mutated after construction; remoteAddr specifically may change
+// during client-side use.
+type firstLine struct {
+	mu         sync.Mutex
+	client     bool // whether this is a client (outgoing) RPC
+	remoteAddr net.Addr
+	deadline   time.Duration // may be zero
+}
+
+func (f *firstLine) SetRemoteAddr(addr net.Addr) {
+	f.mu.Lock()
+	f.remoteAddr = addr
+	f.mu.Unlock()
+}
+
+func (f *firstLine) String() string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	var line bytes.Buffer
+	io.WriteString(&line, "RPC: ")
+	if f.client {
+		io.WriteString(&line, "to")
+	} else {
+		io.WriteString(&line, "from")
+	}
+	fmt.Fprintf(&line, " %v deadline:", f.remoteAddr)
+	if f.deadline != 0 {
+		fmt.Fprint(&line, f.deadline)
+	} else {
+		io.WriteString(&line, "none")
+	}
+	return line.String()
+}
+
+const truncateSize = 100
+
+func truncate(x string, l int) string {
+	if l > len(x) {
+		return x
+	}
+	return x[:l]
+}
+
+// payload represents an RPC request or response payload.
+type payload struct {
+	sent bool        // whether this is an outgoing payload
+	msg  interface{} // e.g. a proto.Message
+	// TODO(dsymonds): add stringifying info to codec, and limit how much we hold here?
+}
+
+func (p payload) String() string {
+	if p.sent {
+		return truncate(fmt.Sprintf("sent: %v", p.msg), truncateSize)
+	}
+	return truncate(fmt.Sprintf("recv: %v", p.msg), truncateSize)
+}
+
+type fmtStringer struct {
+	format string
+	a      []interface{}
+}
+
+func (f *fmtStringer) String() string {
+	return fmt.Sprintf(f.format, f.a...)
+}
+
+type stringer string
+
+func (s stringer) String() string { return string(s) }
diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go
new file mode 100644
index 0000000000..853ce0e30f
--- /dev/null
+++ b/vendor/google.golang.org/grpc/version.go
@@ -0,0 +1,22 @@
+/*
+ *
+ * Copyright 2018 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+// Version is the current grpc version.
+const Version = "1.55.0"
diff --git a/vendor/google.golang.org/grpc/vet.sh b/vendor/google.golang.org/grpc/vet.sh
new file mode 100644
index 0000000000..a8e4732b3d
--- /dev/null
+++ b/vendor/google.golang.org/grpc/vet.sh
@@ -0,0 +1,208 @@
+#!/bin/bash
+
+set -ex  # Exit on error; debugging enabled.
+set -o pipefail  # Fail a pipe if any sub-command fails.
+
+# not makes sure the command passed to it does not exit with a return code of 0.
+not() {
+  # This is required instead of the earlier (! $COMMAND) because subshells and
+  # pipefail don't work the same on Darwin as in Linux.
+  ! "$@"
+}
+
+die() {
+  echo "$@" >&2
+  exit 1
+}
+
+fail_on_output() {
+  tee /dev/stderr | not read
+}
+
+# Check to make sure it's safe to modify the user's git repo.
+git status --porcelain | fail_on_output
+
+# Undo any edits made by this script.
+cleanup() {
+  git reset --hard HEAD
+}
+trap cleanup EXIT
+
+PATH="${HOME}/go/bin:${GOROOT}/bin:${PATH}"
+go version
+
+if [[ "$1" = "-install" ]]; then
+  # Install the pinned versions as defined in module tools.
+  pushd ./test/tools
+  go install \
+    golang.org/x/lint/golint \
+    golang.org/x/tools/cmd/goimports \
+    honnef.co/go/tools/cmd/staticcheck \
+    github.com/client9/misspell/cmd/misspell
+  popd
+  if [[ -z "${VET_SKIP_PROTO}" ]]; then
+    if [[ "${GITHUB_ACTIONS}" = "true" ]]; then
+      PROTOBUF_VERSION=22.0 # a.k.a v4.22.0 in pb.go files.
+      PROTOC_FILENAME=protoc-${PROTOBUF_VERSION}-linux-x86_64.zip
+      pushd /home/runner/go
+      wget https://github.com/google/protobuf/releases/download/v${PROTOBUF_VERSION}/${PROTOC_FILENAME}
+      unzip ${PROTOC_FILENAME}
+      bin/protoc --version
+      popd
+    elif not which protoc > /dev/null; then
+      die "Please install protoc into your path"
+    fi
+  fi
+  exit 0
+elif [[ "$#" -ne 0 ]]; then
+  die "Unknown argument(s): $*"
+fi
+
+# - Check that generated proto files are up to date.
+if [[ -z "${VET_SKIP_PROTO}" ]]; then
+  make proto && git status --porcelain 2>&1 | fail_on_output || \
+    (git status; git --no-pager diff; exit 1)
+fi
+
+if [[ -n "${VET_ONLY_PROTO}" ]]; then
+  exit 0
+fi
+
+# - Ensure all source files contain a copyright message.
+# (Done in two parts because Darwin "git grep" has broken support for compound
+# exclusion matches.)
+(grep -L "DO NOT EDIT" $(git grep -L "\(Copyright [0-9]\{4,\} gRPC authors\)" -- '*.go') || true) | fail_on_output
+
+# - Make sure all tests in grpc and grpc/test use leakcheck via Teardown.
+not grep 'func Test[^(]' *_test.go
+not grep 'func Test[^(]' test/*.go
+
+# - Do not import x/net/context.
+not git grep -l 'x/net/context' -- "*.go"
+
+# - Do not import math/rand for real library code.  Use internal/grpcrand for
+#   thread safety.
+git grep -l '"math/rand"' -- "*.go" 2>&1 | not grep -v '^examples\|^stress\|grpcrand\|^benchmark\|wrr_test'
+
+# - Do not call grpclog directly. Use grpclog.Component instead.
+git grep -l -e 'grpclog.I' --or -e 'grpclog.W' --or -e 'grpclog.E' --or -e 'grpclog.F' --or -e 'grpclog.V' -- "*.go" | not grep -v '^grpclog/component.go\|^internal/grpctest/tlogger_test.go'
+
+# - Ensure all ptypes proto packages are renamed when importing.
+not git grep "\(import \|^\s*\)\"github.com/golang/protobuf/ptypes/" -- "*.go"
+
+# - Ensure all xds proto imports are renamed to *pb or *grpc.
+git grep '"github.com/envoyproxy/go-control-plane/envoy' -- '*.go' ':(exclude)*.pb.go' | not grep -v 'pb "\|grpc "'
+
+misspell -error .
+
+# - gofmt, goimports, golint (with exceptions for generated code), go vet,
+# go mod tidy.
+# Perform these checks on each module inside gRPC.
+for MOD_FILE in $(find . -name 'go.mod'); do
+  MOD_DIR=$(dirname ${MOD_FILE})
+  pushd ${MOD_DIR}
+  go vet -all ./... | fail_on_output
+  gofmt -s -d -l . 2>&1 | fail_on_output
+  goimports -l . 2>&1 | not grep -vE "\.pb\.go"
+  golint ./... 2>&1 | not grep -vE "/grpc_testing_not_regenerate/.*\.pb\.go:"
+
+  go mod tidy -compat=1.17
+  git status --porcelain 2>&1 | fail_on_output || \
+    (git status; git --no-pager diff; exit 1)
+  popd
+done
+
+# - Collection of static analysis checks
+#
+# TODO(dfawley): don't use deprecated functions in examples or first-party
+# plugins.
+# TODO(dfawley): enable ST1019 (duplicate imports) but allow for protobufs.
+SC_OUT="$(mktemp)"
+staticcheck -go 1.19 -checks 'inherit,-ST1015,-ST1019,-SA1019' ./... > "${SC_OUT}" || true
+# Error if anything other than deprecation warnings are printed.
+not grep -v "is deprecated:.*SA1019" "${SC_OUT}"
+# Only ignore the following deprecated types/fields/functions.
+not grep -Fv '.CredsBundle
+.HeaderMap
+.Metadata is deprecated: use Attributes
+.NewAddress
+.NewServiceConfig
+.Type is deprecated: use Attributes
+BuildVersion is deprecated
+balancer.ErrTransientFailure
+balancer.Picker
+extDesc.Filename is deprecated
+github.com/golang/protobuf/jsonpb is deprecated
+grpc.CallCustomCodec
+grpc.Code
+grpc.Compressor
+grpc.CustomCodec
+grpc.Decompressor
+grpc.MaxMsgSize
+grpc.MethodConfig
+grpc.NewGZIPCompressor
+grpc.NewGZIPDecompressor
+grpc.RPCCompressor
+grpc.RPCDecompressor
+grpc.ServiceConfig
+grpc.WithCompressor
+grpc.WithDecompressor
+grpc.WithDialer
+grpc.WithMaxMsgSize
+grpc.WithServiceConfig
+grpc.WithTimeout
+http.CloseNotifier
+info.SecurityVersion
+proto is deprecated
+proto.InternalMessageInfo is deprecated
+proto.EnumName is deprecated
+proto.ErrInternalBadWireType is deprecated
+proto.FileDescriptor is deprecated
+proto.Marshaler is deprecated
+proto.MessageType is deprecated
+proto.RegisterEnum is deprecated
+proto.RegisterFile is deprecated
+proto.RegisterType is deprecated
+proto.RegisterExtension is deprecated
+proto.RegisteredExtension is deprecated
+proto.RegisteredExtensions is deprecated
+proto.RegisterMapType is deprecated
+proto.Unmarshaler is deprecated
+resolver.Backend
+resolver.GRPCLB
+Target is deprecated: Use the Target field in the BuildOptions instead.
+xxx_messageInfo_
+' "${SC_OUT}"
+
+# - special golint on package comments.
+lint_package_comment_per_package() {
+  # Number of files in this go package.
+  fileCount=$(go list -f '{{len .GoFiles}}' $1)
+  if [ ${fileCount} -eq 0 ]; then
+    return 0
+  fi
+  # Number of package errors generated by golint.
+  lintPackageCommentErrorsCount=$(golint --min_confidence 0 $1 | grep -c "should have a package comment")
+  # golint complains about every file that's missing the package comment. If the
+  # number of files for this package is greater than the number of errors, there's
+  # at least one file with package comment, good. Otherwise, fail.
+  if [ ${fileCount} -le ${lintPackageCommentErrorsCount} ]; then
+    echo "Package $1 (with ${fileCount} files) is missing package comment"
+    return 1
+  fi
+}
+lint_package_comment() {
+  set +ex
+
+  count=0
+  for i in $(go list ./...); do
+    lint_package_comment_per_package "$i"
+    ((count += $?))
+  done
+
+  set -ex
+  return $count
+}
+lint_package_comment
+
+echo SUCCESS
diff --git a/vendor/google.golang.org/protobuf/AUTHORS b/vendor/google.golang.org/protobuf/AUTHORS
deleted file mode 100644
index 2b00ddba0d..0000000000
--- a/vendor/google.golang.org/protobuf/AUTHORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code refers to The Go Authors for copyright purposes.
-# The master list of authors is in the main Go distribution,
-# visible at https://tip.golang.org/AUTHORS.
diff --git a/vendor/google.golang.org/protobuf/CONTRIBUTORS b/vendor/google.golang.org/protobuf/CONTRIBUTORS
deleted file mode 100644
index 1fbd3e976f..0000000000
--- a/vendor/google.golang.org/protobuf/CONTRIBUTORS
+++ /dev/null
@@ -1,3 +0,0 @@
-# This source code was written by the Go contributors.
-# The master list of contributors is in the main Go distribution,
-# visible at https://tip.golang.org/CONTRIBUTORS.
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
new file mode 100644
index 0000000000..5f28148d80
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
@@ -0,0 +1,665 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package protojson
+
+import (
+	"encoding/base64"
+	"fmt"
+	"math"
+	"strconv"
+	"strings"
+
+	"google.golang.org/protobuf/internal/encoding/json"
+	"google.golang.org/protobuf/internal/encoding/messageset"
+	"google.golang.org/protobuf/internal/errors"
+	"google.golang.org/protobuf/internal/flags"
+	"google.golang.org/protobuf/internal/genid"
+	"google.golang.org/protobuf/internal/pragma"
+	"google.golang.org/protobuf/internal/set"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+)
+
+// Unmarshal reads the given []byte into the given proto.Message.
+// The provided message must be mutable (e.g., a non-nil pointer to a message).
+func Unmarshal(b []byte, m proto.Message) error {
+	return UnmarshalOptions{}.Unmarshal(b, m)
+}
+
+// UnmarshalOptions is a configurable JSON format parser.
+type UnmarshalOptions struct {
+	pragma.NoUnkeyedLiterals
+
+	// If AllowPartial is set, input for messages that will result in missing
+	// required fields will not return an error.
+	AllowPartial bool
+
+	// If DiscardUnknown is set, unknown fields are ignored.
+	DiscardUnknown bool
+
+	// Resolver is used for looking up types when unmarshaling
+	// google.protobuf.Any messages or extension fields.
+	// If nil, this defaults to using protoregistry.GlobalTypes.
+	Resolver interface {
+		protoregistry.MessageTypeResolver
+		protoregistry.ExtensionTypeResolver
+	}
+}
+
+// Unmarshal reads the given []byte and populates the given proto.Message
+// using options in the UnmarshalOptions object.
+// It will clear the message first before setting the fields.
+// If it returns an error, the given message may be partially set.
+// The provided message must be mutable (e.g., a non-nil pointer to a message).
+func (o UnmarshalOptions) Unmarshal(b []byte, m proto.Message) error {
+	return o.unmarshal(b, m)
+}
+
+// unmarshal is a centralized function that all unmarshal operations go through.
+// For profiling purposes, avoid changing the name of this function or
+// introducing other code paths for unmarshal that do not go through this.
+func (o UnmarshalOptions) unmarshal(b []byte, m proto.Message) error {
+	proto.Reset(m)
+
+	if o.Resolver == nil {
+		o.Resolver = protoregistry.GlobalTypes
+	}
+
+	dec := decoder{json.NewDecoder(b), o}
+	if err := dec.unmarshalMessage(m.ProtoReflect(), false); err != nil {
+		return err
+	}
+
+	// Check for EOF.
+	tok, err := dec.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.EOF {
+		return dec.unexpectedTokenError(tok)
+	}
+
+	if o.AllowPartial {
+		return nil
+	}
+	return proto.CheckInitialized(m)
+}
+
+type decoder struct {
+	*json.Decoder
+	opts UnmarshalOptions
+}
+
+// newError returns an error object with position info.
+func (d decoder) newError(pos int, f string, x ...interface{}) error {
+	line, column := d.Position(pos)
+	head := fmt.Sprintf("(line %d:%d): ", line, column)
+	return errors.New(head+f, x...)
+}
+
+// unexpectedTokenError returns a syntax error for the given unexpected token.
+func (d decoder) unexpectedTokenError(tok json.Token) error {
+	return d.syntaxError(tok.Pos(), "unexpected token %s", tok.RawString())
+}
+
+// syntaxError returns a syntax error for given position.
+func (d decoder) syntaxError(pos int, f string, x ...interface{}) error {
+	line, column := d.Position(pos)
+	head := fmt.Sprintf("syntax error (line %d:%d): ", line, column)
+	return errors.New(head+f, x...)
+}
+
+// unmarshalMessage unmarshals a message into the given protoreflect.Message.
+func (d decoder) unmarshalMessage(m protoreflect.Message, skipTypeURL bool) error {
+	if unmarshal := wellKnownTypeUnmarshaler(m.Descriptor().FullName()); unmarshal != nil {
+		return unmarshal(d, m)
+	}
+
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.ObjectOpen {
+		return d.unexpectedTokenError(tok)
+	}
+
+	messageDesc := m.Descriptor()
+	if !flags.ProtoLegacy && messageset.IsMessageSet(messageDesc) {
+		return errors.New("no support for proto1 MessageSets")
+	}
+
+	var seenNums set.Ints
+	var seenOneofs set.Ints
+	fieldDescs := messageDesc.Fields()
+	for {
+		// Read field name.
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		switch tok.Kind() {
+		default:
+			return d.unexpectedTokenError(tok)
+		case json.ObjectClose:
+			return nil
+		case json.Name:
+			// Continue below.
+		}
+
+		name := tok.Name()
+		// Unmarshaling a non-custom embedded message in Any will contain the
+		// JSON field "@type" which should be skipped because it is not a field
+		// of the embedded message, but simply an artifact of the Any format.
+		if skipTypeURL && name == "@type" {
+			d.Read()
+			continue
+		}
+
+		// Get the FieldDescriptor.
+		var fd protoreflect.FieldDescriptor
+		if strings.HasPrefix(name, "[") && strings.HasSuffix(name, "]") {
+			// Only extension names are in [name] format.
+			extName := protoreflect.FullName(name[1 : len(name)-1])
+			extType, err := d.opts.Resolver.FindExtensionByName(extName)
+			if err != nil && err != protoregistry.NotFound {
+				return d.newError(tok.Pos(), "unable to resolve %s: %v", tok.RawString(), err)
+			}
+			if extType != nil {
+				fd = extType.TypeDescriptor()
+				if !messageDesc.ExtensionRanges().Has(fd.Number()) || fd.ContainingMessage().FullName() != messageDesc.FullName() {
+					return d.newError(tok.Pos(), "message %v cannot be extended by %v", messageDesc.FullName(), fd.FullName())
+				}
+			}
+		} else {
+			// The name can either be the JSON name or the proto field name.
+			fd = fieldDescs.ByJSONName(name)
+			if fd == nil {
+				fd = fieldDescs.ByTextName(name)
+			}
+		}
+		if flags.ProtoLegacy {
+			if fd != nil && fd.IsWeak() && fd.Message().IsPlaceholder() {
+				fd = nil // reset since the weak reference is not linked in
+			}
+		}
+
+		if fd == nil {
+			// Field is unknown.
+			if d.opts.DiscardUnknown {
+				if err := d.skipJSONValue(); err != nil {
+					return err
+				}
+				continue
+			}
+			return d.newError(tok.Pos(), "unknown field %v", tok.RawString())
+		}
+
+		// Do not allow duplicate fields.
+		num := uint64(fd.Number())
+		if seenNums.Has(num) {
+			return d.newError(tok.Pos(), "duplicate field %v", tok.RawString())
+		}
+		seenNums.Set(num)
+
+		// No need to set values for JSON null unless the field type is
+		// google.protobuf.Value or google.protobuf.NullValue.
+		if tok, _ := d.Peek(); tok.Kind() == json.Null && !isKnownValue(fd) && !isNullValue(fd) {
+			d.Read()
+			continue
+		}
+
+		switch {
+		case fd.IsList():
+			list := m.Mutable(fd).List()
+			if err := d.unmarshalList(list, fd); err != nil {
+				return err
+			}
+		case fd.IsMap():
+			mmap := m.Mutable(fd).Map()
+			if err := d.unmarshalMap(mmap, fd); err != nil {
+				return err
+			}
+		default:
+			// If field is a oneof, check if it has already been set.
+			if od := fd.ContainingOneof(); od != nil {
+				idx := uint64(od.Index())
+				if seenOneofs.Has(idx) {
+					return d.newError(tok.Pos(), "error parsing %s, oneof %v is already set", tok.RawString(), od.FullName())
+				}
+				seenOneofs.Set(idx)
+			}
+
+			// Required or optional fields.
+			if err := d.unmarshalSingular(m, fd); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func isKnownValue(fd protoreflect.FieldDescriptor) bool {
+	md := fd.Message()
+	return md != nil && md.FullName() == genid.Value_message_fullname
+}
+
+func isNullValue(fd protoreflect.FieldDescriptor) bool {
+	ed := fd.Enum()
+	return ed != nil && ed.FullName() == genid.NullValue_enum_fullname
+}
+
+// unmarshalSingular unmarshals to the non-repeated field specified
+// by the given FieldDescriptor.
+func (d decoder) unmarshalSingular(m protoreflect.Message, fd protoreflect.FieldDescriptor) error {
+	var val protoreflect.Value
+	var err error
+	switch fd.Kind() {
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		val = m.NewField(fd)
+		err = d.unmarshalMessage(val.Message(), false)
+	default:
+		val, err = d.unmarshalScalar(fd)
+	}
+
+	if err != nil {
+		return err
+	}
+	m.Set(fd, val)
+	return nil
+}
+
+// unmarshalScalar unmarshals to a scalar/enum protoreflect.Value specified by
+// the given FieldDescriptor.
+func (d decoder) unmarshalScalar(fd protoreflect.FieldDescriptor) (protoreflect.Value, error) {
+	const b32 int = 32
+	const b64 int = 64
+
+	tok, err := d.Read()
+	if err != nil {
+		return protoreflect.Value{}, err
+	}
+
+	kind := fd.Kind()
+	switch kind {
+	case protoreflect.BoolKind:
+		if tok.Kind() == json.Bool {
+			return protoreflect.ValueOfBool(tok.Bool()), nil
+		}
+
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		if v, ok := unmarshalInt(tok, b32); ok {
+			return v, nil
+		}
+
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+		if v, ok := unmarshalInt(tok, b64); ok {
+			return v, nil
+		}
+
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
+		if v, ok := unmarshalUint(tok, b32); ok {
+			return v, nil
+		}
+
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
+		if v, ok := unmarshalUint(tok, b64); ok {
+			return v, nil
+		}
+
+	case protoreflect.FloatKind:
+		if v, ok := unmarshalFloat(tok, b32); ok {
+			return v, nil
+		}
+
+	case protoreflect.DoubleKind:
+		if v, ok := unmarshalFloat(tok, b64); ok {
+			return v, nil
+		}
+
+	case protoreflect.StringKind:
+		if tok.Kind() == json.String {
+			return protoreflect.ValueOfString(tok.ParsedString()), nil
+		}
+
+	case protoreflect.BytesKind:
+		if v, ok := unmarshalBytes(tok); ok {
+			return v, nil
+		}
+
+	case protoreflect.EnumKind:
+		if v, ok := unmarshalEnum(tok, fd); ok {
+			return v, nil
+		}
+
+	default:
+		panic(fmt.Sprintf("unmarshalScalar: invalid scalar kind %v", kind))
+	}
+
+	return protoreflect.Value{}, d.newError(tok.Pos(), "invalid value for %v type: %v", kind, tok.RawString())
+}
+
+func unmarshalInt(tok json.Token, bitSize int) (protoreflect.Value, bool) {
+	switch tok.Kind() {
+	case json.Number:
+		return getInt(tok, bitSize)
+
+	case json.String:
+		// Decode number from string.
+		s := strings.TrimSpace(tok.ParsedString())
+		if len(s) != len(tok.ParsedString()) {
+			return protoreflect.Value{}, false
+		}
+		dec := json.NewDecoder([]byte(s))
+		tok, err := dec.Read()
+		if err != nil {
+			return protoreflect.Value{}, false
+		}
+		return getInt(tok, bitSize)
+	}
+	return protoreflect.Value{}, false
+}
+
+func getInt(tok json.Token, bitSize int) (protoreflect.Value, bool) {
+	n, ok := tok.Int(bitSize)
+	if !ok {
+		return protoreflect.Value{}, false
+	}
+	if bitSize == 32 {
+		return protoreflect.ValueOfInt32(int32(n)), true
+	}
+	return protoreflect.ValueOfInt64(n), true
+}
+
+func unmarshalUint(tok json.Token, bitSize int) (protoreflect.Value, bool) {
+	switch tok.Kind() {
+	case json.Number:
+		return getUint(tok, bitSize)
+
+	case json.String:
+		// Decode number from string.
+		s := strings.TrimSpace(tok.ParsedString())
+		if len(s) != len(tok.ParsedString()) {
+			return protoreflect.Value{}, false
+		}
+		dec := json.NewDecoder([]byte(s))
+		tok, err := dec.Read()
+		if err != nil {
+			return protoreflect.Value{}, false
+		}
+		return getUint(tok, bitSize)
+	}
+	return protoreflect.Value{}, false
+}
+
+func getUint(tok json.Token, bitSize int) (protoreflect.Value, bool) {
+	n, ok := tok.Uint(bitSize)
+	if !ok {
+		return protoreflect.Value{}, false
+	}
+	if bitSize == 32 {
+		return protoreflect.ValueOfUint32(uint32(n)), true
+	}
+	return protoreflect.ValueOfUint64(n), true
+}
+
+func unmarshalFloat(tok json.Token, bitSize int) (protoreflect.Value, bool) {
+	switch tok.Kind() {
+	case json.Number:
+		return getFloat(tok, bitSize)
+
+	case json.String:
+		s := tok.ParsedString()
+		switch s {
+		case "NaN":
+			if bitSize == 32 {
+				return protoreflect.ValueOfFloat32(float32(math.NaN())), true
+			}
+			return protoreflect.ValueOfFloat64(math.NaN()), true
+		case "Infinity":
+			if bitSize == 32 {
+				return protoreflect.ValueOfFloat32(float32(math.Inf(+1))), true
+			}
+			return protoreflect.ValueOfFloat64(math.Inf(+1)), true
+		case "-Infinity":
+			if bitSize == 32 {
+				return protoreflect.ValueOfFloat32(float32(math.Inf(-1))), true
+			}
+			return protoreflect.ValueOfFloat64(math.Inf(-1)), true
+		}
+
+		// Decode number from string.
+		if len(s) != len(strings.TrimSpace(s)) {
+			return protoreflect.Value{}, false
+		}
+		dec := json.NewDecoder([]byte(s))
+		tok, err := dec.Read()
+		if err != nil {
+			return protoreflect.Value{}, false
+		}
+		return getFloat(tok, bitSize)
+	}
+	return protoreflect.Value{}, false
+}
+
+func getFloat(tok json.Token, bitSize int) (protoreflect.Value, bool) {
+	n, ok := tok.Float(bitSize)
+	if !ok {
+		return protoreflect.Value{}, false
+	}
+	if bitSize == 32 {
+		return protoreflect.ValueOfFloat32(float32(n)), true
+	}
+	return protoreflect.ValueOfFloat64(n), true
+}
+
+func unmarshalBytes(tok json.Token) (protoreflect.Value, bool) {
+	if tok.Kind() != json.String {
+		return protoreflect.Value{}, false
+	}
+
+	s := tok.ParsedString()
+	enc := base64.StdEncoding
+	if strings.ContainsAny(s, "-_") {
+		enc = base64.URLEncoding
+	}
+	if len(s)%4 != 0 {
+		enc = enc.WithPadding(base64.NoPadding)
+	}
+	b, err := enc.DecodeString(s)
+	if err != nil {
+		return protoreflect.Value{}, false
+	}
+	return protoreflect.ValueOfBytes(b), true
+}
+
+func unmarshalEnum(tok json.Token, fd protoreflect.FieldDescriptor) (protoreflect.Value, bool) {
+	switch tok.Kind() {
+	case json.String:
+		// Lookup EnumNumber based on name.
+		s := tok.ParsedString()
+		if enumVal := fd.Enum().Values().ByName(protoreflect.Name(s)); enumVal != nil {
+			return protoreflect.ValueOfEnum(enumVal.Number()), true
+		}
+
+	case json.Number:
+		if n, ok := tok.Int(32); ok {
+			return protoreflect.ValueOfEnum(protoreflect.EnumNumber(n)), true
+		}
+
+	case json.Null:
+		// This is only valid for google.protobuf.NullValue.
+		if isNullValue(fd) {
+			return protoreflect.ValueOfEnum(0), true
+		}
+	}
+
+	return protoreflect.Value{}, false
+}
+
+func (d decoder) unmarshalList(list protoreflect.List, fd protoreflect.FieldDescriptor) error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.ArrayOpen {
+		return d.unexpectedTokenError(tok)
+	}
+
+	switch fd.Kind() {
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		for {
+			tok, err := d.Peek()
+			if err != nil {
+				return err
+			}
+
+			if tok.Kind() == json.ArrayClose {
+				d.Read()
+				return nil
+			}
+
+			val := list.NewElement()
+			if err := d.unmarshalMessage(val.Message(), false); err != nil {
+				return err
+			}
+			list.Append(val)
+		}
+	default:
+		for {
+			tok, err := d.Peek()
+			if err != nil {
+				return err
+			}
+
+			if tok.Kind() == json.ArrayClose {
+				d.Read()
+				return nil
+			}
+
+			val, err := d.unmarshalScalar(fd)
+			if err != nil {
+				return err
+			}
+			list.Append(val)
+		}
+	}
+
+	return nil
+}
+
+func (d decoder) unmarshalMap(mmap protoreflect.Map, fd protoreflect.FieldDescriptor) error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.ObjectOpen {
+		return d.unexpectedTokenError(tok)
+	}
+
+	// Determine ahead whether map entry is a scalar type or a message type in
+	// order to call the appropriate unmarshalMapValue func inside the for loop
+	// below.
+	var unmarshalMapValue func() (protoreflect.Value, error)
+	switch fd.MapValue().Kind() {
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		unmarshalMapValue = func() (protoreflect.Value, error) {
+			val := mmap.NewValue()
+			if err := d.unmarshalMessage(val.Message(), false); err != nil {
+				return protoreflect.Value{}, err
+			}
+			return val, nil
+		}
+	default:
+		unmarshalMapValue = func() (protoreflect.Value, error) {
+			return d.unmarshalScalar(fd.MapValue())
+		}
+	}
+
+Loop:
+	for {
+		// Read field name.
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		switch tok.Kind() {
+		default:
+			return d.unexpectedTokenError(tok)
+		case json.ObjectClose:
+			break Loop
+		case json.Name:
+			// Continue.
+		}
+
+		// Unmarshal field name.
+		pkey, err := d.unmarshalMapKey(tok, fd.MapKey())
+		if err != nil {
+			return err
+		}
+
+		// Check for duplicate field name.
+		if mmap.Has(pkey) {
+			return d.newError(tok.Pos(), "duplicate map key %v", tok.RawString())
+		}
+
+		// Read and unmarshal field value.
+		pval, err := unmarshalMapValue()
+		if err != nil {
+			return err
+		}
+
+		mmap.Set(pkey, pval)
+	}
+
+	return nil
+}
+
+// unmarshalMapKey converts given token of Name kind into a protoreflect.MapKey.
+// A map key type is any integral or string type.
+func (d decoder) unmarshalMapKey(tok json.Token, fd protoreflect.FieldDescriptor) (protoreflect.MapKey, error) {
+	const b32 = 32
+	const b64 = 64
+	const base10 = 10
+
+	name := tok.Name()
+	kind := fd.Kind()
+	switch kind {
+	case protoreflect.StringKind:
+		return protoreflect.ValueOfString(name).MapKey(), nil
+
+	case protoreflect.BoolKind:
+		switch name {
+		case "true":
+			return protoreflect.ValueOfBool(true).MapKey(), nil
+		case "false":
+			return protoreflect.ValueOfBool(false).MapKey(), nil
+		}
+
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		if n, err := strconv.ParseInt(name, base10, b32); err == nil {
+			return protoreflect.ValueOfInt32(int32(n)).MapKey(), nil
+		}
+
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+		if n, err := strconv.ParseInt(name, base10, b64); err == nil {
+			return protoreflect.ValueOfInt64(int64(n)).MapKey(), nil
+		}
+
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
+		if n, err := strconv.ParseUint(name, base10, b32); err == nil {
+			return protoreflect.ValueOfUint32(uint32(n)).MapKey(), nil
+		}
+
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
+		if n, err := strconv.ParseUint(name, base10, b64); err == nil {
+			return protoreflect.ValueOfUint64(uint64(n)).MapKey(), nil
+		}
+
+	default:
+		panic(fmt.Sprintf("invalid kind for map key: %v", kind))
+	}
+
+	return protoreflect.MapKey{}, d.newError(tok.Pos(), "invalid value for %v key: %s", kind, tok.RawString())
+}
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/doc.go b/vendor/google.golang.org/protobuf/encoding/protojson/doc.go
new file mode 100644
index 0000000000..21d5d2cb18
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/doc.go
@@ -0,0 +1,11 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package protojson marshals and unmarshals protocol buffer messages as JSON
+// format. It follows the guide at
+// https://protobuf.dev/programming-guides/proto3#json.
+//
+// This package produces a different output than the standard "encoding/json"
+// package, which does not operate correctly on protocol buffer messages.
+package protojson
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/encode.go b/vendor/google.golang.org/protobuf/encoding/protojson/encode.go
new file mode 100644
index 0000000000..d09d22e139
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/encode.go
@@ -0,0 +1,343 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package protojson
+
+import (
+	"encoding/base64"
+	"fmt"
+
+	"google.golang.org/protobuf/internal/encoding/json"
+	"google.golang.org/protobuf/internal/encoding/messageset"
+	"google.golang.org/protobuf/internal/errors"
+	"google.golang.org/protobuf/internal/filedesc"
+	"google.golang.org/protobuf/internal/flags"
+	"google.golang.org/protobuf/internal/genid"
+	"google.golang.org/protobuf/internal/order"
+	"google.golang.org/protobuf/internal/pragma"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+)
+
+const defaultIndent = "  "
+
+// Format formats the message as a multiline string.
+// This function is only intended for human consumption and ignores errors.
+// Do not depend on the output being stable. It may change over time across
+// different versions of the program.
+func Format(m proto.Message) string {
+	return MarshalOptions{Multiline: true}.Format(m)
+}
+
+// Marshal writes the given proto.Message in JSON format using default options.
+// Do not depend on the output being stable. It may change over time across
+// different versions of the program.
+func Marshal(m proto.Message) ([]byte, error) {
+	return MarshalOptions{}.Marshal(m)
+}
+
+// MarshalOptions is a configurable JSON format marshaler.
+type MarshalOptions struct {
+	pragma.NoUnkeyedLiterals
+
+	// Multiline specifies whether the marshaler should format the output in
+	// indented-form with every textual element on a new line.
+	// If Indent is an empty string, then an arbitrary indent is chosen.
+	Multiline bool
+
+	// Indent specifies the set of indentation characters to use in a multiline
+	// formatted output such that every entry is preceded by Indent and
+	// terminated by a newline. If non-empty, then Multiline is treated as true.
+	// Indent can only be composed of space or tab characters.
+	Indent string
+
+	// AllowPartial allows messages that have missing required fields to marshal
+	// without returning an error. If AllowPartial is false (the default),
+	// Marshal will return error if there are any missing required fields.
+	AllowPartial bool
+
+	// UseProtoNames uses proto field name instead of lowerCamelCase name in JSON
+	// field names.
+	UseProtoNames bool
+
+	// UseEnumNumbers emits enum values as numbers.
+	UseEnumNumbers bool
+
+	// EmitUnpopulated specifies whether to emit unpopulated fields. It does not
+	// emit unpopulated oneof fields or unpopulated extension fields.
+	// The JSON value emitted for unpopulated fields are as follows:
+	//  ╔═══════╤════════════════════════════╗
+	//  ║ JSON  │ Protobuf field             ║
+	//  ╠═══════╪════════════════════════════╣
+	//  ║ false │ proto3 boolean fields      ║
+	//  ║ 0     │ proto3 numeric fields      ║
+	//  ║ ""    │ proto3 string/bytes fields ║
+	//  ║ null  │ proto2 scalar fields       ║
+	//  ║ null  │ message fields             ║
+	//  ║ []    │ list fields                ║
+	//  ║ {}    │ map fields                 ║
+	//  ╚═══════╧════════════════════════════╝
+	EmitUnpopulated bool
+
+	// Resolver is used for looking up types when expanding google.protobuf.Any
+	// messages. If nil, this defaults to using protoregistry.GlobalTypes.
+	Resolver interface {
+		protoregistry.ExtensionTypeResolver
+		protoregistry.MessageTypeResolver
+	}
+}
+
+// Format formats the message as a string.
+// This method is only intended for human consumption and ignores errors.
+// Do not depend on the output being stable. It may change over time across
+// different versions of the program.
+func (o MarshalOptions) Format(m proto.Message) string {
+	if m == nil || !m.ProtoReflect().IsValid() {
+		return "<nil>" // invalid syntax, but okay since this is for debugging
+	}
+	o.AllowPartial = true
+	b, _ := o.Marshal(m)
+	return string(b)
+}
+
+// Marshal marshals the given proto.Message in the JSON format using options in
+// MarshalOptions. Do not depend on the output being stable. It may change over
+// time across different versions of the program.
+func (o MarshalOptions) Marshal(m proto.Message) ([]byte, error) {
+	return o.marshal(m)
+}
+
+// marshal is a centralized function that all marshal operations go through.
+// For profiling purposes, avoid changing the name of this function or
+// introducing other code paths for marshal that do not go through this.
+func (o MarshalOptions) marshal(m proto.Message) ([]byte, error) {
+	if o.Multiline && o.Indent == "" {
+		o.Indent = defaultIndent
+	}
+	if o.Resolver == nil {
+		o.Resolver = protoregistry.GlobalTypes
+	}
+
+	internalEnc, err := json.NewEncoder(o.Indent)
+	if err != nil {
+		return nil, err
+	}
+
+	// Treat nil message interface as an empty message,
+	// in which case the output in an empty JSON object.
+	if m == nil {
+		return []byte("{}"), nil
+	}
+
+	enc := encoder{internalEnc, o}
+	if err := enc.marshalMessage(m.ProtoReflect(), ""); err != nil {
+		return nil, err
+	}
+	if o.AllowPartial {
+		return enc.Bytes(), nil
+	}
+	return enc.Bytes(), proto.CheckInitialized(m)
+}
+
+type encoder struct {
+	*json.Encoder
+	opts MarshalOptions
+}
+
+// typeFieldDesc is a synthetic field descriptor used for the "@type" field.
+var typeFieldDesc = func() protoreflect.FieldDescriptor {
+	var fd filedesc.Field
+	fd.L0.FullName = "@type"
+	fd.L0.Index = -1
+	fd.L1.Cardinality = protoreflect.Optional
+	fd.L1.Kind = protoreflect.StringKind
+	return &fd
+}()
+
+// typeURLFieldRanger wraps a protoreflect.Message and modifies its Range method
+// to additionally iterate over a synthetic field for the type URL.
+type typeURLFieldRanger struct {
+	order.FieldRanger
+	typeURL string
+}
+
+func (m typeURLFieldRanger) Range(f func(protoreflect.FieldDescriptor, protoreflect.Value) bool) {
+	if !f(typeFieldDesc, protoreflect.ValueOfString(m.typeURL)) {
+		return
+	}
+	m.FieldRanger.Range(f)
+}
+
+// unpopulatedFieldRanger wraps a protoreflect.Message and modifies its Range
+// method to additionally iterate over unpopulated fields.
+type unpopulatedFieldRanger struct{ protoreflect.Message }
+
+func (m unpopulatedFieldRanger) Range(f func(protoreflect.FieldDescriptor, protoreflect.Value) bool) {
+	fds := m.Descriptor().Fields()
+	for i := 0; i < fds.Len(); i++ {
+		fd := fds.Get(i)
+		if m.Has(fd) || fd.ContainingOneof() != nil {
+			continue // ignore populated fields and fields within a oneofs
+		}
+
+		v := m.Get(fd)
+		isProto2Scalar := fd.Syntax() == protoreflect.Proto2 && fd.Default().IsValid()
+		isSingularMessage := fd.Cardinality() != protoreflect.Repeated && fd.Message() != nil
+		if isProto2Scalar || isSingularMessage {
+			v = protoreflect.Value{} // use invalid value to emit null
+		}
+		if !f(fd, v) {
+			return
+		}
+	}
+	m.Message.Range(f)
+}
+
+// marshalMessage marshals the fields in the given protoreflect.Message.
+// If the typeURL is non-empty, then a synthetic "@type" field is injected
+// containing the URL as the value.
+func (e encoder) marshalMessage(m protoreflect.Message, typeURL string) error {
+	if !flags.ProtoLegacy && messageset.IsMessageSet(m.Descriptor()) {
+		return errors.New("no support for proto1 MessageSets")
+	}
+
+	if marshal := wellKnownTypeMarshaler(m.Descriptor().FullName()); marshal != nil {
+		return marshal(e, m)
+	}
+
+	e.StartObject()
+	defer e.EndObject()
+
+	var fields order.FieldRanger = m
+	if e.opts.EmitUnpopulated {
+		fields = unpopulatedFieldRanger{m}
+	}
+	if typeURL != "" {
+		fields = typeURLFieldRanger{fields, typeURL}
+	}
+
+	var err error
+	order.RangeFields(fields, order.IndexNameFieldOrder, func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool {
+		name := fd.JSONName()
+		if e.opts.UseProtoNames {
+			name = fd.TextName()
+		}
+
+		if err = e.WriteName(name); err != nil {
+			return false
+		}
+		if err = e.marshalValue(v, fd); err != nil {
+			return false
+		}
+		return true
+	})
+	return err
+}
+
+// marshalValue marshals the given protoreflect.Value.
+func (e encoder) marshalValue(val protoreflect.Value, fd protoreflect.FieldDescriptor) error {
+	switch {
+	case fd.IsList():
+		return e.marshalList(val.List(), fd)
+	case fd.IsMap():
+		return e.marshalMap(val.Map(), fd)
+	default:
+		return e.marshalSingular(val, fd)
+	}
+}
+
+// marshalSingular marshals the given non-repeated field value. This includes
+// all scalar types, enums, messages, and groups.
+func (e encoder) marshalSingular(val protoreflect.Value, fd protoreflect.FieldDescriptor) error {
+	if !val.IsValid() {
+		e.WriteNull()
+		return nil
+	}
+
+	switch kind := fd.Kind(); kind {
+	case protoreflect.BoolKind:
+		e.WriteBool(val.Bool())
+
+	case protoreflect.StringKind:
+		if e.WriteString(val.String()) != nil {
+			return errors.InvalidUTF8(string(fd.FullName()))
+		}
+
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		e.WriteInt(val.Int())
+
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
+		e.WriteUint(val.Uint())
+
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Uint64Kind,
+		protoreflect.Sfixed64Kind, protoreflect.Fixed64Kind:
+		// 64-bit integers are written out as JSON string.
+		e.WriteString(val.String())
+
+	case protoreflect.FloatKind:
+		// Encoder.WriteFloat handles the special numbers NaN and infinites.
+		e.WriteFloat(val.Float(), 32)
+
+	case protoreflect.DoubleKind:
+		// Encoder.WriteFloat handles the special numbers NaN and infinites.
+		e.WriteFloat(val.Float(), 64)
+
+	case protoreflect.BytesKind:
+		e.WriteString(base64.StdEncoding.EncodeToString(val.Bytes()))
+
+	case protoreflect.EnumKind:
+		if fd.Enum().FullName() == genid.NullValue_enum_fullname {
+			e.WriteNull()
+		} else {
+			desc := fd.Enum().Values().ByNumber(val.Enum())
+			if e.opts.UseEnumNumbers || desc == nil {
+				e.WriteInt(int64(val.Enum()))
+			} else {
+				e.WriteString(string(desc.Name()))
+			}
+		}
+
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		if err := e.marshalMessage(val.Message(), ""); err != nil {
+			return err
+		}
+
+	default:
+		panic(fmt.Sprintf("%v has unknown kind: %v", fd.FullName(), kind))
+	}
+	return nil
+}
+
+// marshalList marshals the given protoreflect.List.
+func (e encoder) marshalList(list protoreflect.List, fd protoreflect.FieldDescriptor) error {
+	e.StartArray()
+	defer e.EndArray()
+
+	for i := 0; i < list.Len(); i++ {
+		item := list.Get(i)
+		if err := e.marshalSingular(item, fd); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// marshalMap marshals given protoreflect.Map.
+func (e encoder) marshalMap(mmap protoreflect.Map, fd protoreflect.FieldDescriptor) error {
+	e.StartObject()
+	defer e.EndObject()
+
+	var err error
+	order.RangeEntries(mmap, order.GenericKeyOrder, func(k protoreflect.MapKey, v protoreflect.Value) bool {
+		if err = e.WriteName(k.String()); err != nil {
+			return false
+		}
+		if err = e.marshalSingular(v, fd.MapValue()); err != nil {
+			return false
+		}
+		return true
+	})
+	return err
+}
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
new file mode 100644
index 0000000000..6c37d41744
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
@@ -0,0 +1,895 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package protojson
+
+import (
+	"bytes"
+	"fmt"
+	"math"
+	"strconv"
+	"strings"
+	"time"
+
+	"google.golang.org/protobuf/internal/encoding/json"
+	"google.golang.org/protobuf/internal/errors"
+	"google.golang.org/protobuf/internal/genid"
+	"google.golang.org/protobuf/internal/strs"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protoreflect"
+)
+
+type marshalFunc func(encoder, protoreflect.Message) error
+
+// wellKnownTypeMarshaler returns a marshal function if the message type
+// has specialized serialization behavior. It returns nil otherwise.
+func wellKnownTypeMarshaler(name protoreflect.FullName) marshalFunc {
+	if name.Parent() == genid.GoogleProtobuf_package {
+		switch name.Name() {
+		case genid.Any_message_name:
+			return encoder.marshalAny
+		case genid.Timestamp_message_name:
+			return encoder.marshalTimestamp
+		case genid.Duration_message_name:
+			return encoder.marshalDuration
+		case genid.BoolValue_message_name,
+			genid.Int32Value_message_name,
+			genid.Int64Value_message_name,
+			genid.UInt32Value_message_name,
+			genid.UInt64Value_message_name,
+			genid.FloatValue_message_name,
+			genid.DoubleValue_message_name,
+			genid.StringValue_message_name,
+			genid.BytesValue_message_name:
+			return encoder.marshalWrapperType
+		case genid.Struct_message_name:
+			return encoder.marshalStruct
+		case genid.ListValue_message_name:
+			return encoder.marshalListValue
+		case genid.Value_message_name:
+			return encoder.marshalKnownValue
+		case genid.FieldMask_message_name:
+			return encoder.marshalFieldMask
+		case genid.Empty_message_name:
+			return encoder.marshalEmpty
+		}
+	}
+	return nil
+}
+
+type unmarshalFunc func(decoder, protoreflect.Message) error
+
+// wellKnownTypeUnmarshaler returns a unmarshal function if the message type
+// has specialized serialization behavior. It returns nil otherwise.
+func wellKnownTypeUnmarshaler(name protoreflect.FullName) unmarshalFunc {
+	if name.Parent() == genid.GoogleProtobuf_package {
+		switch name.Name() {
+		case genid.Any_message_name:
+			return decoder.unmarshalAny
+		case genid.Timestamp_message_name:
+			return decoder.unmarshalTimestamp
+		case genid.Duration_message_name:
+			return decoder.unmarshalDuration
+		case genid.BoolValue_message_name,
+			genid.Int32Value_message_name,
+			genid.Int64Value_message_name,
+			genid.UInt32Value_message_name,
+			genid.UInt64Value_message_name,
+			genid.FloatValue_message_name,
+			genid.DoubleValue_message_name,
+			genid.StringValue_message_name,
+			genid.BytesValue_message_name:
+			return decoder.unmarshalWrapperType
+		case genid.Struct_message_name:
+			return decoder.unmarshalStruct
+		case genid.ListValue_message_name:
+			return decoder.unmarshalListValue
+		case genid.Value_message_name:
+			return decoder.unmarshalKnownValue
+		case genid.FieldMask_message_name:
+			return decoder.unmarshalFieldMask
+		case genid.Empty_message_name:
+			return decoder.unmarshalEmpty
+		}
+	}
+	return nil
+}
+
+// The JSON representation of an Any message uses the regular representation of
+// the deserialized, embedded message, with an additional field `@type` which
+// contains the type URL. If the embedded message type is well-known and has a
+// custom JSON representation, that representation will be embedded adding a
+// field `value` which holds the custom JSON in addition to the `@type` field.
+
+func (e encoder) marshalAny(m protoreflect.Message) error {
+	fds := m.Descriptor().Fields()
+	fdType := fds.ByNumber(genid.Any_TypeUrl_field_number)
+	fdValue := fds.ByNumber(genid.Any_Value_field_number)
+
+	if !m.Has(fdType) {
+		if !m.Has(fdValue) {
+			// If message is empty, marshal out empty JSON object.
+			e.StartObject()
+			e.EndObject()
+			return nil
+		} else {
+			// Return error if type_url field is not set, but value is set.
+			return errors.New("%s: %v is not set", genid.Any_message_fullname, genid.Any_TypeUrl_field_name)
+		}
+	}
+
+	typeVal := m.Get(fdType)
+	valueVal := m.Get(fdValue)
+
+	// Resolve the type in order to unmarshal value field.
+	typeURL := typeVal.String()
+	emt, err := e.opts.Resolver.FindMessageByURL(typeURL)
+	if err != nil {
+		return errors.New("%s: unable to resolve %q: %v", genid.Any_message_fullname, typeURL, err)
+	}
+
+	em := emt.New()
+	err = proto.UnmarshalOptions{
+		AllowPartial: true, // never check required fields inside an Any
+		Resolver:     e.opts.Resolver,
+	}.Unmarshal(valueVal.Bytes(), em.Interface())
+	if err != nil {
+		return errors.New("%s: unable to unmarshal %q: %v", genid.Any_message_fullname, typeURL, err)
+	}
+
+	// If type of value has custom JSON encoding, marshal out a field "value"
+	// with corresponding custom JSON encoding of the embedded message as a
+	// field.
+	if marshal := wellKnownTypeMarshaler(emt.Descriptor().FullName()); marshal != nil {
+		e.StartObject()
+		defer e.EndObject()
+
+		// Marshal out @type field.
+		e.WriteName("@type")
+		if err := e.WriteString(typeURL); err != nil {
+			return err
+		}
+
+		e.WriteName("value")
+		return marshal(e, em)
+	}
+
+	// Else, marshal out the embedded message's fields in this Any object.
+	if err := e.marshalMessage(em, typeURL); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d decoder) unmarshalAny(m protoreflect.Message) error {
+	// Peek to check for json.ObjectOpen to avoid advancing a read.
+	start, err := d.Peek()
+	if err != nil {
+		return err
+	}
+	if start.Kind() != json.ObjectOpen {
+		return d.unexpectedTokenError(start)
+	}
+
+	// Use another decoder to parse the unread bytes for @type field. This
+	// avoids advancing a read from current decoder because the current JSON
+	// object may contain the fields of the embedded type.
+	dec := decoder{d.Clone(), UnmarshalOptions{}}
+	tok, err := findTypeURL(dec)
+	switch err {
+	case errEmptyObject:
+		// An empty JSON object translates to an empty Any message.
+		d.Read() // Read json.ObjectOpen.
+		d.Read() // Read json.ObjectClose.
+		return nil
+
+	case errMissingType:
+		if d.opts.DiscardUnknown {
+			// Treat all fields as unknowns, similar to an empty object.
+			return d.skipJSONValue()
+		}
+		// Use start.Pos() for line position.
+		return d.newError(start.Pos(), err.Error())
+
+	default:
+		if err != nil {
+			return err
+		}
+	}
+
+	typeURL := tok.ParsedString()
+	emt, err := d.opts.Resolver.FindMessageByURL(typeURL)
+	if err != nil {
+		return d.newError(tok.Pos(), "unable to resolve %v: %q", tok.RawString(), err)
+	}
+
+	// Create new message for the embedded message type and unmarshal into it.
+	em := emt.New()
+	if unmarshal := wellKnownTypeUnmarshaler(emt.Descriptor().FullName()); unmarshal != nil {
+		// If embedded message is a custom type,
+		// unmarshal the JSON "value" field into it.
+		if err := d.unmarshalAnyValue(unmarshal, em); err != nil {
+			return err
+		}
+	} else {
+		// Else unmarshal the current JSON object into it.
+		if err := d.unmarshalMessage(em, true); err != nil {
+			return err
+		}
+	}
+	// Serialize the embedded message and assign the resulting bytes to the
+	// proto value field.
+	b, err := proto.MarshalOptions{
+		AllowPartial:  true, // No need to check required fields inside an Any.
+		Deterministic: true,
+	}.Marshal(em.Interface())
+	if err != nil {
+		return d.newError(start.Pos(), "error in marshaling Any.value field: %v", err)
+	}
+
+	fds := m.Descriptor().Fields()
+	fdType := fds.ByNumber(genid.Any_TypeUrl_field_number)
+	fdValue := fds.ByNumber(genid.Any_Value_field_number)
+
+	m.Set(fdType, protoreflect.ValueOfString(typeURL))
+	m.Set(fdValue, protoreflect.ValueOfBytes(b))
+	return nil
+}
+
+var errEmptyObject = fmt.Errorf(`empty object`)
+var errMissingType = fmt.Errorf(`missing "@type" field`)
+
+// findTypeURL returns the token for the "@type" field value from the given
+// JSON bytes. It is expected that the given bytes start with json.ObjectOpen.
+// It returns errEmptyObject if the JSON object is empty or errMissingType if
+// @type field does not exist. It returns other error if the @type field is not
+// valid or other decoding issues.
+func findTypeURL(d decoder) (json.Token, error) {
+	var typeURL string
+	var typeTok json.Token
+	numFields := 0
+	// Skip start object.
+	d.Read()
+
+Loop:
+	for {
+		tok, err := d.Read()
+		if err != nil {
+			return json.Token{}, err
+		}
+
+		switch tok.Kind() {
+		case json.ObjectClose:
+			if typeURL == "" {
+				// Did not find @type field.
+				if numFields > 0 {
+					return json.Token{}, errMissingType
+				}
+				return json.Token{}, errEmptyObject
+			}
+			break Loop
+
+		case json.Name:
+			numFields++
+			if tok.Name() != "@type" {
+				// Skip value.
+				if err := d.skipJSONValue(); err != nil {
+					return json.Token{}, err
+				}
+				continue
+			}
+
+			// Return error if this was previously set already.
+			if typeURL != "" {
+				return json.Token{}, d.newError(tok.Pos(), `duplicate "@type" field`)
+			}
+			// Read field value.
+			tok, err := d.Read()
+			if err != nil {
+				return json.Token{}, err
+			}
+			if tok.Kind() != json.String {
+				return json.Token{}, d.newError(tok.Pos(), `@type field value is not a string: %v`, tok.RawString())
+			}
+			typeURL = tok.ParsedString()
+			if typeURL == "" {
+				return json.Token{}, d.newError(tok.Pos(), `@type field contains empty value`)
+			}
+			typeTok = tok
+		}
+	}
+
+	return typeTok, nil
+}
+
+// skipJSONValue parses a JSON value (null, boolean, string, number, object and
+// array) in order to advance the read to the next JSON value. It relies on
+// the decoder returning an error if the types are not in valid sequence.
+func (d decoder) skipJSONValue() error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	// Only need to continue reading for objects and arrays.
+	switch tok.Kind() {
+	case json.ObjectOpen:
+		for {
+			tok, err := d.Read()
+			if err != nil {
+				return err
+			}
+			switch tok.Kind() {
+			case json.ObjectClose:
+				return nil
+			case json.Name:
+				// Skip object field value.
+				if err := d.skipJSONValue(); err != nil {
+					return err
+				}
+			}
+		}
+
+	case json.ArrayOpen:
+		for {
+			tok, err := d.Peek()
+			if err != nil {
+				return err
+			}
+			switch tok.Kind() {
+			case json.ArrayClose:
+				d.Read()
+				return nil
+			default:
+				// Skip array item.
+				if err := d.skipJSONValue(); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// unmarshalAnyValue unmarshals the given custom-type message from the JSON
+// object's "value" field.
+func (d decoder) unmarshalAnyValue(unmarshal unmarshalFunc, m protoreflect.Message) error {
+	// Skip ObjectOpen, and start reading the fields.
+	d.Read()
+
+	var found bool // Used for detecting duplicate "value".
+	for {
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		switch tok.Kind() {
+		case json.ObjectClose:
+			if !found {
+				return d.newError(tok.Pos(), `missing "value" field`)
+			}
+			return nil
+
+		case json.Name:
+			switch tok.Name() {
+			case "@type":
+				// Skip the value as this was previously parsed already.
+				d.Read()
+
+			case "value":
+				if found {
+					return d.newError(tok.Pos(), `duplicate "value" field`)
+				}
+				// Unmarshal the field value into the given message.
+				if err := unmarshal(d, m); err != nil {
+					return err
+				}
+				found = true
+
+			default:
+				if d.opts.DiscardUnknown {
+					if err := d.skipJSONValue(); err != nil {
+						return err
+					}
+					continue
+				}
+				return d.newError(tok.Pos(), "unknown field %v", tok.RawString())
+			}
+		}
+	}
+}
+
+// Wrapper types are encoded as JSON primitives like string, number or boolean.
+
+func (e encoder) marshalWrapperType(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.WrapperValue_Value_field_number)
+	val := m.Get(fd)
+	return e.marshalSingular(val, fd)
+}
+
+func (d decoder) unmarshalWrapperType(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.WrapperValue_Value_field_number)
+	val, err := d.unmarshalScalar(fd)
+	if err != nil {
+		return err
+	}
+	m.Set(fd, val)
+	return nil
+}
+
+// The JSON representation for Empty is an empty JSON object.
+
+func (e encoder) marshalEmpty(protoreflect.Message) error {
+	e.StartObject()
+	e.EndObject()
+	return nil
+}
+
+func (d decoder) unmarshalEmpty(protoreflect.Message) error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.ObjectOpen {
+		return d.unexpectedTokenError(tok)
+	}
+
+	for {
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		switch tok.Kind() {
+		case json.ObjectClose:
+			return nil
+
+		case json.Name:
+			if d.opts.DiscardUnknown {
+				if err := d.skipJSONValue(); err != nil {
+					return err
+				}
+				continue
+			}
+			return d.newError(tok.Pos(), "unknown field %v", tok.RawString())
+
+		default:
+			return d.unexpectedTokenError(tok)
+		}
+	}
+}
+
+// The JSON representation for Struct is a JSON object that contains the encoded
+// Struct.fields map and follows the serialization rules for a map.
+
+func (e encoder) marshalStruct(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.Struct_Fields_field_number)
+	return e.marshalMap(m.Get(fd).Map(), fd)
+}
+
+func (d decoder) unmarshalStruct(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.Struct_Fields_field_number)
+	return d.unmarshalMap(m.Mutable(fd).Map(), fd)
+}
+
+// The JSON representation for ListValue is JSON array that contains the encoded
+// ListValue.values repeated field and follows the serialization rules for a
+// repeated field.
+
+func (e encoder) marshalListValue(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.ListValue_Values_field_number)
+	return e.marshalList(m.Get(fd).List(), fd)
+}
+
+func (d decoder) unmarshalListValue(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.ListValue_Values_field_number)
+	return d.unmarshalList(m.Mutable(fd).List(), fd)
+}
+
+// The JSON representation for a Value is dependent on the oneof field that is
+// set. Each of the field in the oneof has its own custom serialization rule. A
+// Value message needs to be a oneof field set, else it is an error.
+
+func (e encoder) marshalKnownValue(m protoreflect.Message) error {
+	od := m.Descriptor().Oneofs().ByName(genid.Value_Kind_oneof_name)
+	fd := m.WhichOneof(od)
+	if fd == nil {
+		return errors.New("%s: none of the oneof fields is set", genid.Value_message_fullname)
+	}
+	if fd.Number() == genid.Value_NumberValue_field_number {
+		if v := m.Get(fd).Float(); math.IsNaN(v) || math.IsInf(v, 0) {
+			return errors.New("%s: invalid %v value", genid.Value_NumberValue_field_fullname, v)
+		}
+	}
+	return e.marshalSingular(m.Get(fd), fd)
+}
+
+func (d decoder) unmarshalKnownValue(m protoreflect.Message) error {
+	tok, err := d.Peek()
+	if err != nil {
+		return err
+	}
+
+	var fd protoreflect.FieldDescriptor
+	var val protoreflect.Value
+	switch tok.Kind() {
+	case json.Null:
+		d.Read()
+		fd = m.Descriptor().Fields().ByNumber(genid.Value_NullValue_field_number)
+		val = protoreflect.ValueOfEnum(0)
+
+	case json.Bool:
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		fd = m.Descriptor().Fields().ByNumber(genid.Value_BoolValue_field_number)
+		val = protoreflect.ValueOfBool(tok.Bool())
+
+	case json.Number:
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		fd = m.Descriptor().Fields().ByNumber(genid.Value_NumberValue_field_number)
+		var ok bool
+		val, ok = unmarshalFloat(tok, 64)
+		if !ok {
+			return d.newError(tok.Pos(), "invalid %v: %v", genid.Value_message_fullname, tok.RawString())
+		}
+
+	case json.String:
+		// A JSON string may have been encoded from the number_value field,
+		// e.g. "NaN", "Infinity", etc. Parsing a proto double type also allows
+		// for it to be in JSON string form. Given this custom encoding spec,
+		// however, there is no way to identify that and hence a JSON string is
+		// always assigned to the string_value field, which means that certain
+		// encoding cannot be parsed back to the same field.
+		tok, err := d.Read()
+		if err != nil {
+			return err
+		}
+		fd = m.Descriptor().Fields().ByNumber(genid.Value_StringValue_field_number)
+		val = protoreflect.ValueOfString(tok.ParsedString())
+
+	case json.ObjectOpen:
+		fd = m.Descriptor().Fields().ByNumber(genid.Value_StructValue_field_number)
+		val = m.NewField(fd)
+		if err := d.unmarshalStruct(val.Message()); err != nil {
+			return err
+		}
+
+	case json.ArrayOpen:
+		fd = m.Descriptor().Fields().ByNumber(genid.Value_ListValue_field_number)
+		val = m.NewField(fd)
+		if err := d.unmarshalListValue(val.Message()); err != nil {
+			return err
+		}
+
+	default:
+		return d.newError(tok.Pos(), "invalid %v: %v", genid.Value_message_fullname, tok.RawString())
+	}
+
+	m.Set(fd, val)
+	return nil
+}
+
+// The JSON representation for a Duration is a JSON string that ends in the
+// suffix "s" (indicating seconds) and is preceded by the number of seconds,
+// with nanoseconds expressed as fractional seconds.
+//
+// Durations less than one second are represented with a 0 seconds field and a
+// positive or negative nanos field. For durations of one second or more, a
+// non-zero value for the nanos field must be of the same sign as the seconds
+// field.
+//
+// Duration.seconds must be from -315,576,000,000 to +315,576,000,000 inclusive.
+// Duration.nanos must be from -999,999,999 to +999,999,999 inclusive.
+
+const (
+	secondsInNanos       = 999999999
+	maxSecondsInDuration = 315576000000
+)
+
+func (e encoder) marshalDuration(m protoreflect.Message) error {
+	fds := m.Descriptor().Fields()
+	fdSeconds := fds.ByNumber(genid.Duration_Seconds_field_number)
+	fdNanos := fds.ByNumber(genid.Duration_Nanos_field_number)
+
+	secsVal := m.Get(fdSeconds)
+	nanosVal := m.Get(fdNanos)
+	secs := secsVal.Int()
+	nanos := nanosVal.Int()
+	if secs < -maxSecondsInDuration || secs > maxSecondsInDuration {
+		return errors.New("%s: seconds out of range %v", genid.Duration_message_fullname, secs)
+	}
+	if nanos < -secondsInNanos || nanos > secondsInNanos {
+		return errors.New("%s: nanos out of range %v", genid.Duration_message_fullname, nanos)
+	}
+	if (secs > 0 && nanos < 0) || (secs < 0 && nanos > 0) {
+		return errors.New("%s: signs of seconds and nanos do not match", genid.Duration_message_fullname)
+	}
+	// Generated output always contains 0, 3, 6, or 9 fractional digits,
+	// depending on required precision, followed by the suffix "s".
+	var sign string
+	if secs < 0 || nanos < 0 {
+		sign, secs, nanos = "-", -1*secs, -1*nanos
+	}
+	x := fmt.Sprintf("%s%d.%09d", sign, secs, nanos)
+	x = strings.TrimSuffix(x, "000")
+	x = strings.TrimSuffix(x, "000")
+	x = strings.TrimSuffix(x, ".000")
+	e.WriteString(x + "s")
+	return nil
+}
+
+func (d decoder) unmarshalDuration(m protoreflect.Message) error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.String {
+		return d.unexpectedTokenError(tok)
+	}
+
+	secs, nanos, ok := parseDuration(tok.ParsedString())
+	if !ok {
+		return d.newError(tok.Pos(), "invalid %v value %v", genid.Duration_message_fullname, tok.RawString())
+	}
+	// Validate seconds. No need to validate nanos because parseDuration would
+	// have covered that already.
+	if secs < -maxSecondsInDuration || secs > maxSecondsInDuration {
+		return d.newError(tok.Pos(), "%v value out of range: %v", genid.Duration_message_fullname, tok.RawString())
+	}
+
+	fds := m.Descriptor().Fields()
+	fdSeconds := fds.ByNumber(genid.Duration_Seconds_field_number)
+	fdNanos := fds.ByNumber(genid.Duration_Nanos_field_number)
+
+	m.Set(fdSeconds, protoreflect.ValueOfInt64(secs))
+	m.Set(fdNanos, protoreflect.ValueOfInt32(nanos))
+	return nil
+}
+
+// parseDuration parses the given input string for seconds and nanoseconds value
+// for the Duration JSON format. The format is a decimal number with a suffix
+// 's'. It can have optional plus/minus sign. There needs to be at least an
+// integer or fractional part. Fractional part is limited to 9 digits only for
+// nanoseconds precision, regardless of whether there are trailing zero digits.
+// Example values are 1s, 0.1s, 1.s, .1s, +1s, -1s, -.1s.
+func parseDuration(input string) (int64, int32, bool) {
+	b := []byte(input)
+	size := len(b)
+	if size < 2 {
+		return 0, 0, false
+	}
+	if b[size-1] != 's' {
+		return 0, 0, false
+	}
+	b = b[:size-1]
+
+	// Read optional plus/minus symbol.
+	var neg bool
+	switch b[0] {
+	case '-':
+		neg = true
+		b = b[1:]
+	case '+':
+		b = b[1:]
+	}
+	if len(b) == 0 {
+		return 0, 0, false
+	}
+
+	// Read the integer part.
+	var intp []byte
+	switch {
+	case b[0] == '0':
+		b = b[1:]
+
+	case '1' <= b[0] && b[0] <= '9':
+		intp = b[0:]
+		b = b[1:]
+		n := 1
+		for len(b) > 0 && '0' <= b[0] && b[0] <= '9' {
+			n++
+			b = b[1:]
+		}
+		intp = intp[:n]
+
+	case b[0] == '.':
+		// Continue below.
+
+	default:
+		return 0, 0, false
+	}
+
+	hasFrac := false
+	var frac [9]byte
+	if len(b) > 0 {
+		if b[0] != '.' {
+			return 0, 0, false
+		}
+		// Read the fractional part.
+		b = b[1:]
+		n := 0
+		for len(b) > 0 && n < 9 && '0' <= b[0] && b[0] <= '9' {
+			frac[n] = b[0]
+			n++
+			b = b[1:]
+		}
+		// It is not valid if there are more bytes left.
+		if len(b) > 0 {
+			return 0, 0, false
+		}
+		// Pad fractional part with 0s.
+		for i := n; i < 9; i++ {
+			frac[i] = '0'
+		}
+		hasFrac = true
+	}
+
+	var secs int64
+	if len(intp) > 0 {
+		var err error
+		secs, err = strconv.ParseInt(string(intp), 10, 64)
+		if err != nil {
+			return 0, 0, false
+		}
+	}
+
+	var nanos int64
+	if hasFrac {
+		nanob := bytes.TrimLeft(frac[:], "0")
+		if len(nanob) > 0 {
+			var err error
+			nanos, err = strconv.ParseInt(string(nanob), 10, 32)
+			if err != nil {
+				return 0, 0, false
+			}
+		}
+	}
+
+	if neg {
+		if secs > 0 {
+			secs = -secs
+		}
+		if nanos > 0 {
+			nanos = -nanos
+		}
+	}
+	return secs, int32(nanos), true
+}
+
+// The JSON representation for a Timestamp is a JSON string in the RFC 3339
+// format, i.e. "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z" where
+// {year} is always expressed using four digits while {month}, {day}, {hour},
+// {min}, and {sec} are zero-padded to two digits each. The fractional seconds,
+// which can go up to 9 digits, up to 1 nanosecond resolution, is optional. The
+// "Z" suffix indicates the timezone ("UTC"); the timezone is required. Encoding
+// should always use UTC (as indicated by "Z") and a decoder should be able to
+// accept both UTC and other timezones (as indicated by an offset).
+//
+// Timestamp.seconds must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z
+// inclusive.
+// Timestamp.nanos must be from 0 to 999,999,999 inclusive.
+
+const (
+	maxTimestampSeconds = 253402300799
+	minTimestampSeconds = -62135596800
+)
+
+func (e encoder) marshalTimestamp(m protoreflect.Message) error {
+	fds := m.Descriptor().Fields()
+	fdSeconds := fds.ByNumber(genid.Timestamp_Seconds_field_number)
+	fdNanos := fds.ByNumber(genid.Timestamp_Nanos_field_number)
+
+	secsVal := m.Get(fdSeconds)
+	nanosVal := m.Get(fdNanos)
+	secs := secsVal.Int()
+	nanos := nanosVal.Int()
+	if secs < minTimestampSeconds || secs > maxTimestampSeconds {
+		return errors.New("%s: seconds out of range %v", genid.Timestamp_message_fullname, secs)
+	}
+	if nanos < 0 || nanos > secondsInNanos {
+		return errors.New("%s: nanos out of range %v", genid.Timestamp_message_fullname, nanos)
+	}
+	// Uses RFC 3339, where generated output will be Z-normalized and uses 0, 3,
+	// 6 or 9 fractional digits.
+	t := time.Unix(secs, nanos).UTC()
+	x := t.Format("2006-01-02T15:04:05.000000000")
+	x = strings.TrimSuffix(x, "000")
+	x = strings.TrimSuffix(x, "000")
+	x = strings.TrimSuffix(x, ".000")
+	e.WriteString(x + "Z")
+	return nil
+}
+
+func (d decoder) unmarshalTimestamp(m protoreflect.Message) error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.String {
+		return d.unexpectedTokenError(tok)
+	}
+
+	s := tok.ParsedString()
+	t, err := time.Parse(time.RFC3339Nano, s)
+	if err != nil {
+		return d.newError(tok.Pos(), "invalid %v value %v", genid.Timestamp_message_fullname, tok.RawString())
+	}
+	// Validate seconds.
+	secs := t.Unix()
+	if secs < minTimestampSeconds || secs > maxTimestampSeconds {
+		return d.newError(tok.Pos(), "%v value out of range: %v", genid.Timestamp_message_fullname, tok.RawString())
+	}
+	// Validate subseconds.
+	i := strings.LastIndexByte(s, '.')  // start of subsecond field
+	j := strings.LastIndexAny(s, "Z-+") // start of timezone field
+	if i >= 0 && j >= i && j-i > len(".999999999") {
+		return d.newError(tok.Pos(), "invalid %v value %v", genid.Timestamp_message_fullname, tok.RawString())
+	}
+
+	fds := m.Descriptor().Fields()
+	fdSeconds := fds.ByNumber(genid.Timestamp_Seconds_field_number)
+	fdNanos := fds.ByNumber(genid.Timestamp_Nanos_field_number)
+
+	m.Set(fdSeconds, protoreflect.ValueOfInt64(secs))
+	m.Set(fdNanos, protoreflect.ValueOfInt32(int32(t.Nanosecond())))
+	return nil
+}
+
+// The JSON representation for a FieldMask is a JSON string where paths are
+// separated by a comma. Fields name in each path are converted to/from
+// lower-camel naming conventions. Encoding should fail if the path name would
+// end up differently after a round-trip.
+
+func (e encoder) marshalFieldMask(m protoreflect.Message) error {
+	fd := m.Descriptor().Fields().ByNumber(genid.FieldMask_Paths_field_number)
+	list := m.Get(fd).List()
+	paths := make([]string, 0, list.Len())
+
+	for i := 0; i < list.Len(); i++ {
+		s := list.Get(i).String()
+		if !protoreflect.FullName(s).IsValid() {
+			return errors.New("%s contains invalid path: %q", genid.FieldMask_Paths_field_fullname, s)
+		}
+		// Return error if conversion to camelCase is not reversible.
+		cc := strs.JSONCamelCase(s)
+		if s != strs.JSONSnakeCase(cc) {
+			return errors.New("%s contains irreversible value %q", genid.FieldMask_Paths_field_fullname, s)
+		}
+		paths = append(paths, cc)
+	}
+
+	e.WriteString(strings.Join(paths, ","))
+	return nil
+}
+
+func (d decoder) unmarshalFieldMask(m protoreflect.Message) error {
+	tok, err := d.Read()
+	if err != nil {
+		return err
+	}
+	if tok.Kind() != json.String {
+		return d.unexpectedTokenError(tok)
+	}
+	str := strings.TrimSpace(tok.ParsedString())
+	if str == "" {
+		return nil
+	}
+	paths := strings.Split(str, ",")
+
+	fd := m.Descriptor().Fields().ByNumber(genid.FieldMask_Paths_field_number)
+	list := m.Mutable(fd).List()
+
+	for _, s0 := range paths {
+		s := strs.JSONSnakeCase(s0)
+		if strings.Contains(s0, "_") || !protoreflect.FullName(s).IsValid() {
+			return d.newError(tok.Pos(), "%v contains invalid path: %q", genid.FieldMask_Paths_field_fullname, s0)
+		}
+		list.Append(protoreflect.ValueOfString(s))
+	}
+	return nil
+}
diff --git a/vendor/google.golang.org/protobuf/encoding/prototext/decode.go b/vendor/google.golang.org/protobuf/encoding/prototext/decode.go
index 179d6e8fc1..4921b2d4a7 100644
--- a/vendor/google.golang.org/protobuf/encoding/prototext/decode.go
+++ b/vendor/google.golang.org/protobuf/encoding/prototext/decode.go
@@ -17,7 +17,7 @@ import (
 	"google.golang.org/protobuf/internal/set"
 	"google.golang.org/protobuf/internal/strs"
 	"google.golang.org/protobuf/proto"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
@@ -103,7 +103,7 @@ func (d decoder) syntaxError(pos int, f string, x ...interface{}) error {
 }
 
 // unmarshalMessage unmarshals into the given protoreflect.Message.
-func (d decoder) unmarshalMessage(m pref.Message, checkDelims bool) error {
+func (d decoder) unmarshalMessage(m protoreflect.Message, checkDelims bool) error {
 	messageDesc := m.Descriptor()
 	if !flags.ProtoLegacy && messageset.IsMessageSet(messageDesc) {
 		return errors.New("no support for proto1 MessageSets")
@@ -150,24 +150,24 @@ func (d decoder) unmarshalMessage(m pref.Message, checkDelims bool) error {
 		}
 
 		// Resolve the field descriptor.
-		var name pref.Name
-		var fd pref.FieldDescriptor
-		var xt pref.ExtensionType
+		var name protoreflect.Name
+		var fd protoreflect.FieldDescriptor
+		var xt protoreflect.ExtensionType
 		var xtErr error
 		var isFieldNumberName bool
 
 		switch tok.NameKind() {
 		case text.IdentName:
-			name = pref.Name(tok.IdentName())
+			name = protoreflect.Name(tok.IdentName())
 			fd = fieldDescs.ByTextName(string(name))
 
 		case text.TypeName:
 			// Handle extensions only. This code path is not for Any.
-			xt, xtErr = d.opts.Resolver.FindExtensionByName(pref.FullName(tok.TypeName()))
+			xt, xtErr = d.opts.Resolver.FindExtensionByName(protoreflect.FullName(tok.TypeName()))
 
 		case text.FieldNumber:
 			isFieldNumberName = true
-			num := pref.FieldNumber(tok.FieldNumber())
+			num := protoreflect.FieldNumber(tok.FieldNumber())
 			if !num.IsValid() {
 				return d.newError(tok.Pos(), "invalid field number: %d", num)
 			}
@@ -215,7 +215,7 @@ func (d decoder) unmarshalMessage(m pref.Message, checkDelims bool) error {
 		switch {
 		case fd.IsList():
 			kind := fd.Kind()
-			if kind != pref.MessageKind && kind != pref.GroupKind && !tok.HasSeparator() {
+			if kind != protoreflect.MessageKind && kind != protoreflect.GroupKind && !tok.HasSeparator() {
 				return d.syntaxError(tok.Pos(), "missing field separator :")
 			}
 
@@ -232,7 +232,7 @@ func (d decoder) unmarshalMessage(m pref.Message, checkDelims bool) error {
 
 		default:
 			kind := fd.Kind()
-			if kind != pref.MessageKind && kind != pref.GroupKind && !tok.HasSeparator() {
+			if kind != protoreflect.MessageKind && kind != protoreflect.GroupKind && !tok.HasSeparator() {
 				return d.syntaxError(tok.Pos(), "missing field separator :")
 			}
 
@@ -262,11 +262,11 @@ func (d decoder) unmarshalMessage(m pref.Message, checkDelims bool) error {
 
 // unmarshalSingular unmarshals a non-repeated field value specified by the
 // given FieldDescriptor.
-func (d decoder) unmarshalSingular(fd pref.FieldDescriptor, m pref.Message) error {
-	var val pref.Value
+func (d decoder) unmarshalSingular(fd protoreflect.FieldDescriptor, m protoreflect.Message) error {
+	var val protoreflect.Value
 	var err error
 	switch fd.Kind() {
-	case pref.MessageKind, pref.GroupKind:
+	case protoreflect.MessageKind, protoreflect.GroupKind:
 		val = m.NewField(fd)
 		err = d.unmarshalMessage(val.Message(), true)
 	default:
@@ -280,94 +280,94 @@ func (d decoder) unmarshalSingular(fd pref.FieldDescriptor, m pref.Message) erro
 
 // unmarshalScalar unmarshals a scalar/enum protoreflect.Value specified by the
 // given FieldDescriptor.
-func (d decoder) unmarshalScalar(fd pref.FieldDescriptor) (pref.Value, error) {
+func (d decoder) unmarshalScalar(fd protoreflect.FieldDescriptor) (protoreflect.Value, error) {
 	tok, err := d.Read()
 	if err != nil {
-		return pref.Value{}, err
+		return protoreflect.Value{}, err
 	}
 
 	if tok.Kind() != text.Scalar {
-		return pref.Value{}, d.unexpectedTokenError(tok)
+		return protoreflect.Value{}, d.unexpectedTokenError(tok)
 	}
 
 	kind := fd.Kind()
 	switch kind {
-	case pref.BoolKind:
+	case protoreflect.BoolKind:
 		if b, ok := tok.Bool(); ok {
-			return pref.ValueOfBool(b), nil
+			return protoreflect.ValueOfBool(b), nil
 		}
 
-	case pref.Int32Kind, pref.Sint32Kind, pref.Sfixed32Kind:
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
 		if n, ok := tok.Int32(); ok {
-			return pref.ValueOfInt32(n), nil
+			return protoreflect.ValueOfInt32(n), nil
 		}
 
-	case pref.Int64Kind, pref.Sint64Kind, pref.Sfixed64Kind:
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
 		if n, ok := tok.Int64(); ok {
-			return pref.ValueOfInt64(n), nil
+			return protoreflect.ValueOfInt64(n), nil
 		}
 
-	case pref.Uint32Kind, pref.Fixed32Kind:
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
 		if n, ok := tok.Uint32(); ok {
-			return pref.ValueOfUint32(n), nil
+			return protoreflect.ValueOfUint32(n), nil
 		}
 
-	case pref.Uint64Kind, pref.Fixed64Kind:
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
 		if n, ok := tok.Uint64(); ok {
-			return pref.ValueOfUint64(n), nil
+			return protoreflect.ValueOfUint64(n), nil
 		}
 
-	case pref.FloatKind:
+	case protoreflect.FloatKind:
 		if n, ok := tok.Float32(); ok {
-			return pref.ValueOfFloat32(n), nil
+			return protoreflect.ValueOfFloat32(n), nil
 		}
 
-	case pref.DoubleKind:
+	case protoreflect.DoubleKind:
 		if n, ok := tok.Float64(); ok {
-			return pref.ValueOfFloat64(n), nil
+			return protoreflect.ValueOfFloat64(n), nil
 		}
 
-	case pref.StringKind:
+	case protoreflect.StringKind:
 		if s, ok := tok.String(); ok {
 			if strs.EnforceUTF8(fd) && !utf8.ValidString(s) {
-				return pref.Value{}, d.newError(tok.Pos(), "contains invalid UTF-8")
+				return protoreflect.Value{}, d.newError(tok.Pos(), "contains invalid UTF-8")
 			}
-			return pref.ValueOfString(s), nil
+			return protoreflect.ValueOfString(s), nil
 		}
 
-	case pref.BytesKind:
+	case protoreflect.BytesKind:
 		if b, ok := tok.String(); ok {
-			return pref.ValueOfBytes([]byte(b)), nil
+			return protoreflect.ValueOfBytes([]byte(b)), nil
 		}
 
-	case pref.EnumKind:
+	case protoreflect.EnumKind:
 		if lit, ok := tok.Enum(); ok {
 			// Lookup EnumNumber based on name.
-			if enumVal := fd.Enum().Values().ByName(pref.Name(lit)); enumVal != nil {
-				return pref.ValueOfEnum(enumVal.Number()), nil
+			if enumVal := fd.Enum().Values().ByName(protoreflect.Name(lit)); enumVal != nil {
+				return protoreflect.ValueOfEnum(enumVal.Number()), nil
 			}
 		}
 		if num, ok := tok.Int32(); ok {
-			return pref.ValueOfEnum(pref.EnumNumber(num)), nil
+			return protoreflect.ValueOfEnum(protoreflect.EnumNumber(num)), nil
 		}
 
 	default:
 		panic(fmt.Sprintf("invalid scalar kind %v", kind))
 	}
 
-	return pref.Value{}, d.newError(tok.Pos(), "invalid value for %v type: %v", kind, tok.RawString())
+	return protoreflect.Value{}, d.newError(tok.Pos(), "invalid value for %v type: %v", kind, tok.RawString())
 }
 
 // unmarshalList unmarshals into given protoreflect.List. A list value can
 // either be in [] syntax or simply just a single scalar/message value.
-func (d decoder) unmarshalList(fd pref.FieldDescriptor, list pref.List) error {
+func (d decoder) unmarshalList(fd protoreflect.FieldDescriptor, list protoreflect.List) error {
 	tok, err := d.Peek()
 	if err != nil {
 		return err
 	}
 
 	switch fd.Kind() {
-	case pref.MessageKind, pref.GroupKind:
+	case protoreflect.MessageKind, protoreflect.GroupKind:
 		switch tok.Kind() {
 		case text.ListOpen:
 			d.Read()
@@ -441,22 +441,22 @@ func (d decoder) unmarshalList(fd pref.FieldDescriptor, list pref.List) error {
 
 // unmarshalMap unmarshals into given protoreflect.Map. A map value is a
 // textproto message containing {key: <kvalue>, value: <mvalue>}.
-func (d decoder) unmarshalMap(fd pref.FieldDescriptor, mmap pref.Map) error {
+func (d decoder) unmarshalMap(fd protoreflect.FieldDescriptor, mmap protoreflect.Map) error {
 	// Determine ahead whether map entry is a scalar type or a message type in
 	// order to call the appropriate unmarshalMapValue func inside
 	// unmarshalMapEntry.
-	var unmarshalMapValue func() (pref.Value, error)
+	var unmarshalMapValue func() (protoreflect.Value, error)
 	switch fd.MapValue().Kind() {
-	case pref.MessageKind, pref.GroupKind:
-		unmarshalMapValue = func() (pref.Value, error) {
+	case protoreflect.MessageKind, protoreflect.GroupKind:
+		unmarshalMapValue = func() (protoreflect.Value, error) {
 			pval := mmap.NewValue()
 			if err := d.unmarshalMessage(pval.Message(), true); err != nil {
-				return pref.Value{}, err
+				return protoreflect.Value{}, err
 			}
 			return pval, nil
 		}
 	default:
-		unmarshalMapValue = func() (pref.Value, error) {
+		unmarshalMapValue = func() (protoreflect.Value, error) {
 			return d.unmarshalScalar(fd.MapValue())
 		}
 	}
@@ -494,9 +494,9 @@ func (d decoder) unmarshalMap(fd pref.FieldDescriptor, mmap pref.Map) error {
 
 // unmarshalMap unmarshals into given protoreflect.Map. A map value is a
 // textproto message containing {key: <kvalue>, value: <mvalue>}.
-func (d decoder) unmarshalMapEntry(fd pref.FieldDescriptor, mmap pref.Map, unmarshalMapValue func() (pref.Value, error)) error {
-	var key pref.MapKey
-	var pval pref.Value
+func (d decoder) unmarshalMapEntry(fd protoreflect.FieldDescriptor, mmap protoreflect.Map, unmarshalMapValue func() (protoreflect.Value, error)) error {
+	var key protoreflect.MapKey
+	var pval protoreflect.Value
 Loop:
 	for {
 		// Read field name.
@@ -520,7 +520,7 @@ Loop:
 			return d.unexpectedTokenError(tok)
 		}
 
-		switch name := pref.Name(tok.IdentName()); name {
+		switch name := protoreflect.Name(tok.IdentName()); name {
 		case genid.MapEntry_Key_field_name:
 			if !tok.HasSeparator() {
 				return d.syntaxError(tok.Pos(), "missing field separator :")
@@ -535,7 +535,7 @@ Loop:
 			key = val.MapKey()
 
 		case genid.MapEntry_Value_field_name:
-			if kind := fd.MapValue().Kind(); (kind != pref.MessageKind) && (kind != pref.GroupKind) {
+			if kind := fd.MapValue().Kind(); (kind != protoreflect.MessageKind) && (kind != protoreflect.GroupKind) {
 				if !tok.HasSeparator() {
 					return d.syntaxError(tok.Pos(), "missing field separator :")
 				}
@@ -561,7 +561,7 @@ Loop:
 	}
 	if !pval.IsValid() {
 		switch fd.MapValue().Kind() {
-		case pref.MessageKind, pref.GroupKind:
+		case protoreflect.MessageKind, protoreflect.GroupKind:
 			// If value field is not set for message/group types, construct an
 			// empty one as default.
 			pval = mmap.NewValue()
@@ -575,7 +575,7 @@ Loop:
 
 // unmarshalAny unmarshals an Any textproto. It can either be in expanded form
 // or non-expanded form.
-func (d decoder) unmarshalAny(m pref.Message, checkDelims bool) error {
+func (d decoder) unmarshalAny(m protoreflect.Message, checkDelims bool) error {
 	var typeURL string
 	var bValue []byte
 	var seenTypeUrl bool
@@ -619,7 +619,7 @@ Loop:
 				return d.syntaxError(tok.Pos(), "missing field separator :")
 			}
 
-			switch name := pref.Name(tok.IdentName()); name {
+			switch name := protoreflect.Name(tok.IdentName()); name {
 			case genid.Any_TypeUrl_field_name:
 				if seenTypeUrl {
 					return d.newError(tok.Pos(), "duplicate %v field", genid.Any_TypeUrl_field_fullname)
@@ -686,10 +686,10 @@ Loop:
 
 	fds := m.Descriptor().Fields()
 	if len(typeURL) > 0 {
-		m.Set(fds.ByNumber(genid.Any_TypeUrl_field_number), pref.ValueOfString(typeURL))
+		m.Set(fds.ByNumber(genid.Any_TypeUrl_field_number), protoreflect.ValueOfString(typeURL))
 	}
 	if len(bValue) > 0 {
-		m.Set(fds.ByNumber(genid.Any_Value_field_number), pref.ValueOfBytes(bValue))
+		m.Set(fds.ByNumber(genid.Any_Value_field_number), protoreflect.ValueOfBytes(bValue))
 	}
 	return nil
 }
diff --git a/vendor/google.golang.org/protobuf/encoding/prototext/encode.go b/vendor/google.golang.org/protobuf/encoding/prototext/encode.go
index 8d5304dc5b..ebf6c65284 100644
--- a/vendor/google.golang.org/protobuf/encoding/prototext/encode.go
+++ b/vendor/google.golang.org/protobuf/encoding/prototext/encode.go
@@ -20,7 +20,6 @@ import (
 	"google.golang.org/protobuf/internal/strs"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
@@ -150,7 +149,7 @@ type encoder struct {
 }
 
 // marshalMessage marshals the given protoreflect.Message.
-func (e encoder) marshalMessage(m pref.Message, inclDelims bool) error {
+func (e encoder) marshalMessage(m protoreflect.Message, inclDelims bool) error {
 	messageDesc := m.Descriptor()
 	if !flags.ProtoLegacy && messageset.IsMessageSet(messageDesc) {
 		return errors.New("no support for proto1 MessageSets")
@@ -190,7 +189,7 @@ func (e encoder) marshalMessage(m pref.Message, inclDelims bool) error {
 }
 
 // marshalField marshals the given field with protoreflect.Value.
-func (e encoder) marshalField(name string, val pref.Value, fd pref.FieldDescriptor) error {
+func (e encoder) marshalField(name string, val protoreflect.Value, fd protoreflect.FieldDescriptor) error {
 	switch {
 	case fd.IsList():
 		return e.marshalList(name, val.List(), fd)
@@ -204,40 +203,40 @@ func (e encoder) marshalField(name string, val pref.Value, fd pref.FieldDescript
 
 // marshalSingular marshals the given non-repeated field value. This includes
 // all scalar types, enums, messages, and groups.
-func (e encoder) marshalSingular(val pref.Value, fd pref.FieldDescriptor) error {
+func (e encoder) marshalSingular(val protoreflect.Value, fd protoreflect.FieldDescriptor) error {
 	kind := fd.Kind()
 	switch kind {
-	case pref.BoolKind:
+	case protoreflect.BoolKind:
 		e.WriteBool(val.Bool())
 
-	case pref.StringKind:
+	case protoreflect.StringKind:
 		s := val.String()
 		if !e.opts.allowInvalidUTF8 && strs.EnforceUTF8(fd) && !utf8.ValidString(s) {
 			return errors.InvalidUTF8(string(fd.FullName()))
 		}
 		e.WriteString(s)
 
-	case pref.Int32Kind, pref.Int64Kind,
-		pref.Sint32Kind, pref.Sint64Kind,
-		pref.Sfixed32Kind, pref.Sfixed64Kind:
+	case protoreflect.Int32Kind, protoreflect.Int64Kind,
+		protoreflect.Sint32Kind, protoreflect.Sint64Kind,
+		protoreflect.Sfixed32Kind, protoreflect.Sfixed64Kind:
 		e.WriteInt(val.Int())
 
-	case pref.Uint32Kind, pref.Uint64Kind,
-		pref.Fixed32Kind, pref.Fixed64Kind:
+	case protoreflect.Uint32Kind, protoreflect.Uint64Kind,
+		protoreflect.Fixed32Kind, protoreflect.Fixed64Kind:
 		e.WriteUint(val.Uint())
 
-	case pref.FloatKind:
+	case protoreflect.FloatKind:
 		// Encoder.WriteFloat handles the special numbers NaN and infinites.
 		e.WriteFloat(val.Float(), 32)
 
-	case pref.DoubleKind:
+	case protoreflect.DoubleKind:
 		// Encoder.WriteFloat handles the special numbers NaN and infinites.
 		e.WriteFloat(val.Float(), 64)
 
-	case pref.BytesKind:
+	case protoreflect.BytesKind:
 		e.WriteString(string(val.Bytes()))
 
-	case pref.EnumKind:
+	case protoreflect.EnumKind:
 		num := val.Enum()
 		if desc := fd.Enum().Values().ByNumber(num); desc != nil {
 			e.WriteLiteral(string(desc.Name()))
@@ -246,7 +245,7 @@ func (e encoder) marshalSingular(val pref.Value, fd pref.FieldDescriptor) error
 			e.WriteInt(int64(num))
 		}
 
-	case pref.MessageKind, pref.GroupKind:
+	case protoreflect.MessageKind, protoreflect.GroupKind:
 		return e.marshalMessage(val.Message(), true)
 
 	default:
@@ -256,7 +255,7 @@ func (e encoder) marshalSingular(val pref.Value, fd pref.FieldDescriptor) error
 }
 
 // marshalList marshals the given protoreflect.List as multiple name-value fields.
-func (e encoder) marshalList(name string, list pref.List, fd pref.FieldDescriptor) error {
+func (e encoder) marshalList(name string, list protoreflect.List, fd protoreflect.FieldDescriptor) error {
 	size := list.Len()
 	for i := 0; i < size; i++ {
 		e.WriteName(name)
@@ -268,9 +267,9 @@ func (e encoder) marshalList(name string, list pref.List, fd pref.FieldDescripto
 }
 
 // marshalMap marshals the given protoreflect.Map as multiple name-value fields.
-func (e encoder) marshalMap(name string, mmap pref.Map, fd pref.FieldDescriptor) error {
+func (e encoder) marshalMap(name string, mmap protoreflect.Map, fd protoreflect.FieldDescriptor) error {
 	var err error
-	order.RangeEntries(mmap, order.GenericKeyOrder, func(key pref.MapKey, val pref.Value) bool {
+	order.RangeEntries(mmap, order.GenericKeyOrder, func(key protoreflect.MapKey, val protoreflect.Value) bool {
 		e.WriteName(name)
 		e.StartMessage()
 		defer e.EndMessage()
@@ -334,7 +333,7 @@ func (e encoder) marshalUnknown(b []byte) {
 
 // marshalAny marshals the given google.protobuf.Any message in expanded form.
 // It returns true if it was able to marshal, else false.
-func (e encoder) marshalAny(any pref.Message) bool {
+func (e encoder) marshalAny(any protoreflect.Message) bool {
 	// Construct the embedded message.
 	fds := any.Descriptor().Fields()
 	fdType := fds.ByNumber(genid.Any_TypeUrl_field_number)
diff --git a/vendor/google.golang.org/protobuf/encoding/protowire/wire.go b/vendor/google.golang.org/protobuf/encoding/protowire/wire.go
index a427f8b704..f4b4686cf9 100644
--- a/vendor/google.golang.org/protobuf/encoding/protowire/wire.go
+++ b/vendor/google.golang.org/protobuf/encoding/protowire/wire.go
@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // Package protowire parses and formats the raw wire encoding.
-// See https://developers.google.com/protocol-buffers/docs/encoding.
+// See https://protobuf.dev/programming-guides/encoding.
 //
 // For marshaling and unmarshaling entire protobuf messages,
 // use the "google.golang.org/protobuf/proto" package instead.
@@ -21,19 +21,16 @@ import (
 type Number int32
 
 const (
-	MinValidNumber      Number = 1
-	FirstReservedNumber Number = 19000
-	LastReservedNumber  Number = 19999
-	MaxValidNumber      Number = 1<<29 - 1
+	MinValidNumber        Number = 1
+	FirstReservedNumber   Number = 19000
+	LastReservedNumber    Number = 19999
+	MaxValidNumber        Number = 1<<29 - 1
+	DefaultRecursionLimit        = 10000
 )
 
 // IsValid reports whether the field number is semantically valid.
-//
-// Note that while numbers within the reserved range are semantically invalid,
-// they are syntactically valid in the wire format.
-// Implementations may treat records with reserved field numbers as unknown.
 func (n Number) IsValid() bool {
-	return MinValidNumber <= n && n < FirstReservedNumber || LastReservedNumber < n && n <= MaxValidNumber
+	return MinValidNumber <= n && n <= MaxValidNumber
 }
 
 // Type represents the wire type.
@@ -55,6 +52,7 @@ const (
 	errCodeOverflow
 	errCodeReserved
 	errCodeEndGroup
+	errCodeRecursionDepth
 )
 
 var (
@@ -112,6 +110,10 @@ func ConsumeField(b []byte) (Number, Type, int) {
 // When parsing a group, the length includes the end group marker and
 // the end group is verified to match the starting field number.
 func ConsumeFieldValue(num Number, typ Type, b []byte) (n int) {
+	return consumeFieldValueD(num, typ, b, DefaultRecursionLimit)
+}
+
+func consumeFieldValueD(num Number, typ Type, b []byte, depth int) (n int) {
 	switch typ {
 	case VarintType:
 		_, n = ConsumeVarint(b)
@@ -126,6 +128,9 @@ func ConsumeFieldValue(num Number, typ Type, b []byte) (n int) {
 		_, n = ConsumeBytes(b)
 		return n
 	case StartGroupType:
+		if depth < 0 {
+			return errCodeRecursionDepth
+		}
 		n0 := len(b)
 		for {
 			num2, typ2, n := ConsumeTag(b)
@@ -140,7 +145,7 @@ func ConsumeFieldValue(num Number, typ Type, b []byte) (n int) {
 				return n0 - len(b)
 			}
 
-			n = ConsumeFieldValue(num2, typ2, b)
+			n = consumeFieldValueD(num2, typ2, b, depth-1)
 			if n < 0 {
 				return n // forward error code
 			}
@@ -507,6 +512,7 @@ func EncodeTag(num Number, typ Type) uint64 {
 }
 
 // DecodeZigZag decodes a zig-zag-encoded uint64 as an int64.
+//
 //	Input:  {…,  5,  3,  1,  0,  2,  4,  6, …}
 //	Output: {…, -3, -2, -1,  0, +1, +2, +3, …}
 func DecodeZigZag(x uint64) int64 {
@@ -514,6 +520,7 @@ func DecodeZigZag(x uint64) int64 {
 }
 
 // EncodeZigZag encodes an int64 as a zig-zag-encoded uint64.
+//
 //	Input:  {…, -3, -2, -1,  0, +1, +2, +3, …}
 //	Output: {…,  5,  3,  1,  0,  2,  4,  6, …}
 func EncodeZigZag(x int64) uint64 {
@@ -521,6 +528,7 @@ func EncodeZigZag(x int64) uint64 {
 }
 
 // DecodeBool decodes a uint64 as a bool.
+//
 //	Input:  {    0,    1,    2, …}
 //	Output: {false, true, true, …}
 func DecodeBool(x uint64) bool {
@@ -528,6 +536,7 @@ func DecodeBool(x uint64) bool {
 }
 
 // EncodeBool encodes a bool as a uint64.
+//
 //	Input:  {false, true}
 //	Output: {    0,    1}
 func EncodeBool(x bool) uint64 {
diff --git a/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go b/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go
index 360c63329d..db5248e1b5 100644
--- a/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go
+++ b/vendor/google.golang.org/protobuf/internal/descfmt/stringer.go
@@ -14,7 +14,7 @@ import (
 
 	"google.golang.org/protobuf/internal/detrand"
 	"google.golang.org/protobuf/internal/pragma"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type list interface {
@@ -30,17 +30,17 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 	if isRoot {
 		var name string
 		switch vs.(type) {
-		case pref.Names:
+		case protoreflect.Names:
 			name = "Names"
-		case pref.FieldNumbers:
+		case protoreflect.FieldNumbers:
 			name = "FieldNumbers"
-		case pref.FieldRanges:
+		case protoreflect.FieldRanges:
 			name = "FieldRanges"
-		case pref.EnumRanges:
+		case protoreflect.EnumRanges:
 			name = "EnumRanges"
-		case pref.FileImports:
+		case protoreflect.FileImports:
 			name = "FileImports"
-		case pref.Descriptor:
+		case protoreflect.Descriptor:
 			name = reflect.ValueOf(vs).MethodByName("Get").Type().Out(0).Name() + "s"
 		default:
 			name = reflect.ValueOf(vs).Elem().Type().Name()
@@ -50,17 +50,17 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 
 	var ss []string
 	switch vs := vs.(type) {
-	case pref.Names:
+	case protoreflect.Names:
 		for i := 0; i < vs.Len(); i++ {
 			ss = append(ss, fmt.Sprint(vs.Get(i)))
 		}
 		return start + joinStrings(ss, false) + end
-	case pref.FieldNumbers:
+	case protoreflect.FieldNumbers:
 		for i := 0; i < vs.Len(); i++ {
 			ss = append(ss, fmt.Sprint(vs.Get(i)))
 		}
 		return start + joinStrings(ss, false) + end
-	case pref.FieldRanges:
+	case protoreflect.FieldRanges:
 		for i := 0; i < vs.Len(); i++ {
 			r := vs.Get(i)
 			if r[0]+1 == r[1] {
@@ -70,7 +70,7 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 			}
 		}
 		return start + joinStrings(ss, false) + end
-	case pref.EnumRanges:
+	case protoreflect.EnumRanges:
 		for i := 0; i < vs.Len(); i++ {
 			r := vs.Get(i)
 			if r[0] == r[1] {
@@ -80,7 +80,7 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 			}
 		}
 		return start + joinStrings(ss, false) + end
-	case pref.FileImports:
+	case protoreflect.FileImports:
 		for i := 0; i < vs.Len(); i++ {
 			var rs records
 			rs.Append(reflect.ValueOf(vs.Get(i)), "Path", "Package", "IsPublic", "IsWeak")
@@ -88,11 +88,11 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 		}
 		return start + joinStrings(ss, allowMulti) + end
 	default:
-		_, isEnumValue := vs.(pref.EnumValueDescriptors)
+		_, isEnumValue := vs.(protoreflect.EnumValueDescriptors)
 		for i := 0; i < vs.Len(); i++ {
 			m := reflect.ValueOf(vs).MethodByName("Get")
 			v := m.Call([]reflect.Value{reflect.ValueOf(i)})[0].Interface()
-			ss = append(ss, formatDescOpt(v.(pref.Descriptor), false, allowMulti && !isEnumValue))
+			ss = append(ss, formatDescOpt(v.(protoreflect.Descriptor), false, allowMulti && !isEnumValue))
 		}
 		return start + joinStrings(ss, allowMulti && isEnumValue) + end
 	}
@@ -106,20 +106,20 @@ func formatListOpt(vs list, isRoot, allowMulti bool) string {
 //
 // Using a list allows us to print the accessors in a sensible order.
 var descriptorAccessors = map[reflect.Type][]string{
-	reflect.TypeOf((*pref.FileDescriptor)(nil)).Elem():      {"Path", "Package", "Imports", "Messages", "Enums", "Extensions", "Services"},
-	reflect.TypeOf((*pref.MessageDescriptor)(nil)).Elem():   {"IsMapEntry", "Fields", "Oneofs", "ReservedNames", "ReservedRanges", "RequiredNumbers", "ExtensionRanges", "Messages", "Enums", "Extensions"},
-	reflect.TypeOf((*pref.FieldDescriptor)(nil)).Elem():     {"Number", "Cardinality", "Kind", "HasJSONName", "JSONName", "HasPresence", "IsExtension", "IsPacked", "IsWeak", "IsList", "IsMap", "MapKey", "MapValue", "HasDefault", "Default", "ContainingOneof", "ContainingMessage", "Message", "Enum"},
-	reflect.TypeOf((*pref.OneofDescriptor)(nil)).Elem():     {"Fields"}, // not directly used; must keep in sync with formatDescOpt
-	reflect.TypeOf((*pref.EnumDescriptor)(nil)).Elem():      {"Values", "ReservedNames", "ReservedRanges"},
-	reflect.TypeOf((*pref.EnumValueDescriptor)(nil)).Elem(): {"Number"},
-	reflect.TypeOf((*pref.ServiceDescriptor)(nil)).Elem():   {"Methods"},
-	reflect.TypeOf((*pref.MethodDescriptor)(nil)).Elem():    {"Input", "Output", "IsStreamingClient", "IsStreamingServer"},
+	reflect.TypeOf((*protoreflect.FileDescriptor)(nil)).Elem():      {"Path", "Package", "Imports", "Messages", "Enums", "Extensions", "Services"},
+	reflect.TypeOf((*protoreflect.MessageDescriptor)(nil)).Elem():   {"IsMapEntry", "Fields", "Oneofs", "ReservedNames", "ReservedRanges", "RequiredNumbers", "ExtensionRanges", "Messages", "Enums", "Extensions"},
+	reflect.TypeOf((*protoreflect.FieldDescriptor)(nil)).Elem():     {"Number", "Cardinality", "Kind", "HasJSONName", "JSONName", "HasPresence", "IsExtension", "IsPacked", "IsWeak", "IsList", "IsMap", "MapKey", "MapValue", "HasDefault", "Default", "ContainingOneof", "ContainingMessage", "Message", "Enum"},
+	reflect.TypeOf((*protoreflect.OneofDescriptor)(nil)).Elem():     {"Fields"}, // not directly used; must keep in sync with formatDescOpt
+	reflect.TypeOf((*protoreflect.EnumDescriptor)(nil)).Elem():      {"Values", "ReservedNames", "ReservedRanges"},
+	reflect.TypeOf((*protoreflect.EnumValueDescriptor)(nil)).Elem(): {"Number"},
+	reflect.TypeOf((*protoreflect.ServiceDescriptor)(nil)).Elem():   {"Methods"},
+	reflect.TypeOf((*protoreflect.MethodDescriptor)(nil)).Elem():    {"Input", "Output", "IsStreamingClient", "IsStreamingServer"},
 }
 
-func FormatDesc(s fmt.State, r rune, t pref.Descriptor) {
+func FormatDesc(s fmt.State, r rune, t protoreflect.Descriptor) {
 	io.WriteString(s, formatDescOpt(t, true, r == 'v' && (s.Flag('+') || s.Flag('#'))))
 }
-func formatDescOpt(t pref.Descriptor, isRoot, allowMulti bool) string {
+func formatDescOpt(t protoreflect.Descriptor, isRoot, allowMulti bool) string {
 	rv := reflect.ValueOf(t)
 	rt := rv.MethodByName("ProtoType").Type().In(0)
 
@@ -128,7 +128,7 @@ func formatDescOpt(t pref.Descriptor, isRoot, allowMulti bool) string {
 		start = rt.Name() + "{"
 	}
 
-	_, isFile := t.(pref.FileDescriptor)
+	_, isFile := t.(protoreflect.FileDescriptor)
 	rs := records{allowMulti: allowMulti}
 	if t.IsPlaceholder() {
 		if isFile {
@@ -146,7 +146,7 @@ func formatDescOpt(t pref.Descriptor, isRoot, allowMulti bool) string {
 			rs.Append(rv, "Name")
 		}
 		switch t := t.(type) {
-		case pref.FieldDescriptor:
+		case protoreflect.FieldDescriptor:
 			for _, s := range descriptorAccessors[rt] {
 				switch s {
 				case "MapKey":
@@ -156,9 +156,9 @@ func formatDescOpt(t pref.Descriptor, isRoot, allowMulti bool) string {
 				case "MapValue":
 					if v := t.MapValue(); v != nil {
 						switch v.Kind() {
-						case pref.EnumKind:
+						case protoreflect.EnumKind:
 							rs.recs = append(rs.recs, [2]string{"MapValue", string(v.Enum().FullName())})
-						case pref.MessageKind, pref.GroupKind:
+						case protoreflect.MessageKind, protoreflect.GroupKind:
 							rs.recs = append(rs.recs, [2]string{"MapValue", string(v.Message().FullName())})
 						default:
 							rs.recs = append(rs.recs, [2]string{"MapValue", v.Kind().String()})
@@ -180,7 +180,7 @@ func formatDescOpt(t pref.Descriptor, isRoot, allowMulti bool) string {
 					rs.Append(rv, s)
 				}
 			}
-		case pref.OneofDescriptor:
+		case protoreflect.OneofDescriptor:
 			var ss []string
 			fs := t.Fields()
 			for i := 0; i < fs.Len(); i++ {
@@ -216,7 +216,7 @@ func (rs *records) Append(v reflect.Value, accessors ...string) {
 		if !rv.IsValid() {
 			panic(fmt.Sprintf("unknown accessor: %v.%s", v.Type(), a))
 		}
-		if _, ok := rv.Interface().(pref.Value); ok {
+		if _, ok := rv.Interface().(protoreflect.Value); ok {
 			rv = rv.MethodByName("Interface").Call(nil)[0]
 			if !rv.IsNil() {
 				rv = rv.Elem()
@@ -250,9 +250,9 @@ func (rs *records) Append(v reflect.Value, accessors ...string) {
 		switch v := v.(type) {
 		case list:
 			s = formatListOpt(v, false, rs.allowMulti)
-		case pref.FieldDescriptor, pref.OneofDescriptor, pref.EnumValueDescriptor, pref.MethodDescriptor:
-			s = string(v.(pref.Descriptor).Name())
-		case pref.Descriptor:
+		case protoreflect.FieldDescriptor, protoreflect.OneofDescriptor, protoreflect.EnumValueDescriptor, protoreflect.MethodDescriptor:
+			s = string(v.(protoreflect.Descriptor).Name())
+		case protoreflect.Descriptor:
 			s = string(v.FullName())
 		case string:
 			s = strconv.Quote(v)
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/defval/default.go b/vendor/google.golang.org/protobuf/internal/encoding/defval/default.go
index fdd9b13f2f..328dc733b0 100644
--- a/vendor/google.golang.org/protobuf/internal/encoding/defval/default.go
+++ b/vendor/google.golang.org/protobuf/internal/encoding/defval/default.go
@@ -15,8 +15,8 @@ import (
 	"strconv"
 
 	ptext "google.golang.org/protobuf/internal/encoding/text"
-	errors "google.golang.org/protobuf/internal/errors"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/internal/errors"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // Format is the serialization format used to represent the default value.
@@ -35,56 +35,56 @@ const (
 
 // Unmarshal deserializes the default string s according to the given kind k.
 // When k is an enum, a list of enum value descriptors must be provided.
-func Unmarshal(s string, k pref.Kind, evs pref.EnumValueDescriptors, f Format) (pref.Value, pref.EnumValueDescriptor, error) {
+func Unmarshal(s string, k protoreflect.Kind, evs protoreflect.EnumValueDescriptors, f Format) (protoreflect.Value, protoreflect.EnumValueDescriptor, error) {
 	switch k {
-	case pref.BoolKind:
+	case protoreflect.BoolKind:
 		if f == GoTag {
 			switch s {
 			case "1":
-				return pref.ValueOfBool(true), nil, nil
+				return protoreflect.ValueOfBool(true), nil, nil
 			case "0":
-				return pref.ValueOfBool(false), nil, nil
+				return protoreflect.ValueOfBool(false), nil, nil
 			}
 		} else {
 			switch s {
 			case "true":
-				return pref.ValueOfBool(true), nil, nil
+				return protoreflect.ValueOfBool(true), nil, nil
 			case "false":
-				return pref.ValueOfBool(false), nil, nil
+				return protoreflect.ValueOfBool(false), nil, nil
 			}
 		}
-	case pref.EnumKind:
+	case protoreflect.EnumKind:
 		if f == GoTag {
 			// Go tags use the numeric form of the enum value.
 			if n, err := strconv.ParseInt(s, 10, 32); err == nil {
-				if ev := evs.ByNumber(pref.EnumNumber(n)); ev != nil {
-					return pref.ValueOfEnum(ev.Number()), ev, nil
+				if ev := evs.ByNumber(protoreflect.EnumNumber(n)); ev != nil {
+					return protoreflect.ValueOfEnum(ev.Number()), ev, nil
 				}
 			}
 		} else {
 			// Descriptor default_value use the enum identifier.
-			ev := evs.ByName(pref.Name(s))
+			ev := evs.ByName(protoreflect.Name(s))
 			if ev != nil {
-				return pref.ValueOfEnum(ev.Number()), ev, nil
+				return protoreflect.ValueOfEnum(ev.Number()), ev, nil
 			}
 		}
-	case pref.Int32Kind, pref.Sint32Kind, pref.Sfixed32Kind:
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
 		if v, err := strconv.ParseInt(s, 10, 32); err == nil {
-			return pref.ValueOfInt32(int32(v)), nil, nil
+			return protoreflect.ValueOfInt32(int32(v)), nil, nil
 		}
-	case pref.Int64Kind, pref.Sint64Kind, pref.Sfixed64Kind:
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
 		if v, err := strconv.ParseInt(s, 10, 64); err == nil {
-			return pref.ValueOfInt64(int64(v)), nil, nil
+			return protoreflect.ValueOfInt64(int64(v)), nil, nil
 		}
-	case pref.Uint32Kind, pref.Fixed32Kind:
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
 		if v, err := strconv.ParseUint(s, 10, 32); err == nil {
-			return pref.ValueOfUint32(uint32(v)), nil, nil
+			return protoreflect.ValueOfUint32(uint32(v)), nil, nil
 		}
-	case pref.Uint64Kind, pref.Fixed64Kind:
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
 		if v, err := strconv.ParseUint(s, 10, 64); err == nil {
-			return pref.ValueOfUint64(uint64(v)), nil, nil
+			return protoreflect.ValueOfUint64(uint64(v)), nil, nil
 		}
-	case pref.FloatKind, pref.DoubleKind:
+	case protoreflect.FloatKind, protoreflect.DoubleKind:
 		var v float64
 		var err error
 		switch s {
@@ -98,29 +98,29 @@ func Unmarshal(s string, k pref.Kind, evs pref.EnumValueDescriptors, f Format) (
 			v, err = strconv.ParseFloat(s, 64)
 		}
 		if err == nil {
-			if k == pref.FloatKind {
-				return pref.ValueOfFloat32(float32(v)), nil, nil
+			if k == protoreflect.FloatKind {
+				return protoreflect.ValueOfFloat32(float32(v)), nil, nil
 			} else {
-				return pref.ValueOfFloat64(float64(v)), nil, nil
+				return protoreflect.ValueOfFloat64(float64(v)), nil, nil
 			}
 		}
-	case pref.StringKind:
+	case protoreflect.StringKind:
 		// String values are already unescaped and can be used as is.
-		return pref.ValueOfString(s), nil, nil
-	case pref.BytesKind:
+		return protoreflect.ValueOfString(s), nil, nil
+	case protoreflect.BytesKind:
 		if b, ok := unmarshalBytes(s); ok {
-			return pref.ValueOfBytes(b), nil, nil
+			return protoreflect.ValueOfBytes(b), nil, nil
 		}
 	}
-	return pref.Value{}, nil, errors.New("could not parse value for %v: %q", k, s)
+	return protoreflect.Value{}, nil, errors.New("could not parse value for %v: %q", k, s)
 }
 
 // Marshal serializes v as the default string according to the given kind k.
 // When specifying the Descriptor format for an enum kind, the associated
 // enum value descriptor must be provided.
-func Marshal(v pref.Value, ev pref.EnumValueDescriptor, k pref.Kind, f Format) (string, error) {
+func Marshal(v protoreflect.Value, ev protoreflect.EnumValueDescriptor, k protoreflect.Kind, f Format) (string, error) {
 	switch k {
-	case pref.BoolKind:
+	case protoreflect.BoolKind:
 		if f == GoTag {
 			if v.Bool() {
 				return "1", nil
@@ -134,17 +134,17 @@ func Marshal(v pref.Value, ev pref.EnumValueDescriptor, k pref.Kind, f Format) (
 				return "false", nil
 			}
 		}
-	case pref.EnumKind:
+	case protoreflect.EnumKind:
 		if f == GoTag {
 			return strconv.FormatInt(int64(v.Enum()), 10), nil
 		} else {
 			return string(ev.Name()), nil
 		}
-	case pref.Int32Kind, pref.Sint32Kind, pref.Sfixed32Kind, pref.Int64Kind, pref.Sint64Kind, pref.Sfixed64Kind:
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind, protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
 		return strconv.FormatInt(v.Int(), 10), nil
-	case pref.Uint32Kind, pref.Fixed32Kind, pref.Uint64Kind, pref.Fixed64Kind:
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind, protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
 		return strconv.FormatUint(v.Uint(), 10), nil
-	case pref.FloatKind, pref.DoubleKind:
+	case protoreflect.FloatKind, protoreflect.DoubleKind:
 		f := v.Float()
 		switch {
 		case math.IsInf(f, -1):
@@ -154,16 +154,16 @@ func Marshal(v pref.Value, ev pref.EnumValueDescriptor, k pref.Kind, f Format) (
 		case math.IsNaN(f):
 			return "nan", nil
 		default:
-			if k == pref.FloatKind {
+			if k == protoreflect.FloatKind {
 				return strconv.FormatFloat(f, 'g', -1, 32), nil
 			} else {
 				return strconv.FormatFloat(f, 'g', -1, 64), nil
 			}
 		}
-	case pref.StringKind:
+	case protoreflect.StringKind:
 		// String values are serialized as is without any escaping.
 		return v.String(), nil
-	case pref.BytesKind:
+	case protoreflect.BytesKind:
 		if s, ok := marshalBytes(v.Bytes()); ok {
 			return s, nil
 		}
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
new file mode 100644
index 0000000000..d043a6ebe0
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
@@ -0,0 +1,340 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"regexp"
+	"unicode/utf8"
+
+	"google.golang.org/protobuf/internal/errors"
+)
+
+// call specifies which Decoder method was invoked.
+type call uint8
+
+const (
+	readCall call = iota
+	peekCall
+)
+
+const unexpectedFmt = "unexpected token %s"
+
+// ErrUnexpectedEOF means that EOF was encountered in the middle of the input.
+var ErrUnexpectedEOF = errors.New("%v", io.ErrUnexpectedEOF)
+
+// Decoder is a token-based JSON decoder.
+type Decoder struct {
+	// lastCall is last method called, either readCall or peekCall.
+	// Initial value is readCall.
+	lastCall call
+
+	// lastToken contains the last read token.
+	lastToken Token
+
+	// lastErr contains the last read error.
+	lastErr error
+
+	// openStack is a stack containing ObjectOpen and ArrayOpen values. The
+	// top of stack represents the object or the array the current value is
+	// directly located in.
+	openStack []Kind
+
+	// orig is used in reporting line and column.
+	orig []byte
+	// in contains the unconsumed input.
+	in []byte
+}
+
+// NewDecoder returns a Decoder to read the given []byte.
+func NewDecoder(b []byte) *Decoder {
+	return &Decoder{orig: b, in: b}
+}
+
+// Peek looks ahead and returns the next token kind without advancing a read.
+func (d *Decoder) Peek() (Token, error) {
+	defer func() { d.lastCall = peekCall }()
+	if d.lastCall == readCall {
+		d.lastToken, d.lastErr = d.Read()
+	}
+	return d.lastToken, d.lastErr
+}
+
+// Read returns the next JSON token.
+// It will return an error if there is no valid token.
+func (d *Decoder) Read() (Token, error) {
+	const scalar = Null | Bool | Number | String
+
+	defer func() { d.lastCall = readCall }()
+	if d.lastCall == peekCall {
+		return d.lastToken, d.lastErr
+	}
+
+	tok, err := d.parseNext()
+	if err != nil {
+		return Token{}, err
+	}
+
+	switch tok.kind {
+	case EOF:
+		if len(d.openStack) != 0 ||
+			d.lastToken.kind&scalar|ObjectClose|ArrayClose == 0 {
+			return Token{}, ErrUnexpectedEOF
+		}
+
+	case Null:
+		if !d.isValueNext() {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+
+	case Bool, Number:
+		if !d.isValueNext() {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+
+	case String:
+		if d.isValueNext() {
+			break
+		}
+		// This string token should only be for a field name.
+		if d.lastToken.kind&(ObjectOpen|comma) == 0 {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+		if len(d.in) == 0 {
+			return Token{}, ErrUnexpectedEOF
+		}
+		if c := d.in[0]; c != ':' {
+			return Token{}, d.newSyntaxError(d.currPos(), `unexpected character %s, missing ":" after field name`, string(c))
+		}
+		tok.kind = Name
+		d.consume(1)
+
+	case ObjectOpen, ArrayOpen:
+		if !d.isValueNext() {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+		d.openStack = append(d.openStack, tok.kind)
+
+	case ObjectClose:
+		if len(d.openStack) == 0 ||
+			d.lastToken.kind == comma ||
+			d.openStack[len(d.openStack)-1] != ObjectOpen {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+		d.openStack = d.openStack[:len(d.openStack)-1]
+
+	case ArrayClose:
+		if len(d.openStack) == 0 ||
+			d.lastToken.kind == comma ||
+			d.openStack[len(d.openStack)-1] != ArrayOpen {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+		d.openStack = d.openStack[:len(d.openStack)-1]
+
+	case comma:
+		if len(d.openStack) == 0 ||
+			d.lastToken.kind&(scalar|ObjectClose|ArrayClose) == 0 {
+			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
+		}
+	}
+
+	// Update d.lastToken only after validating token to be in the right sequence.
+	d.lastToken = tok
+
+	if d.lastToken.kind == comma {
+		return d.Read()
+	}
+	return tok, nil
+}
+
+// Any sequence that looks like a non-delimiter (for error reporting).
+var errRegexp = regexp.MustCompile(`^([-+._a-zA-Z0-9]{1,32}|.)`)
+
+// parseNext parses for the next JSON token. It returns a Token object for
+// different types, except for Name. It does not handle whether the next token
+// is in a valid sequence or not.
+func (d *Decoder) parseNext() (Token, error) {
+	// Trim leading spaces.
+	d.consume(0)
+
+	in := d.in
+	if len(in) == 0 {
+		return d.consumeToken(EOF, 0), nil
+	}
+
+	switch in[0] {
+	case 'n':
+		if n := matchWithDelim("null", in); n != 0 {
+			return d.consumeToken(Null, n), nil
+		}
+
+	case 't':
+		if n := matchWithDelim("true", in); n != 0 {
+			return d.consumeBoolToken(true, n), nil
+		}
+
+	case 'f':
+		if n := matchWithDelim("false", in); n != 0 {
+			return d.consumeBoolToken(false, n), nil
+		}
+
+	case '-', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		if n, ok := parseNumber(in); ok {
+			return d.consumeToken(Number, n), nil
+		}
+
+	case '"':
+		s, n, err := d.parseString(in)
+		if err != nil {
+			return Token{}, err
+		}
+		return d.consumeStringToken(s, n), nil
+
+	case '{':
+		return d.consumeToken(ObjectOpen, 1), nil
+
+	case '}':
+		return d.consumeToken(ObjectClose, 1), nil
+
+	case '[':
+		return d.consumeToken(ArrayOpen, 1), nil
+
+	case ']':
+		return d.consumeToken(ArrayClose, 1), nil
+
+	case ',':
+		return d.consumeToken(comma, 1), nil
+	}
+	return Token{}, d.newSyntaxError(d.currPos(), "invalid value %s", errRegexp.Find(in))
+}
+
+// newSyntaxError returns an error with line and column information useful for
+// syntax errors.
+func (d *Decoder) newSyntaxError(pos int, f string, x ...interface{}) error {
+	e := errors.New(f, x...)
+	line, column := d.Position(pos)
+	return errors.New("syntax error (line %d:%d): %v", line, column, e)
+}
+
+// Position returns line and column number of given index of the original input.
+// It will panic if index is out of range.
+func (d *Decoder) Position(idx int) (line int, column int) {
+	b := d.orig[:idx]
+	line = bytes.Count(b, []byte("\n")) + 1
+	if i := bytes.LastIndexByte(b, '\n'); i >= 0 {
+		b = b[i+1:]
+	}
+	column = utf8.RuneCount(b) + 1 // ignore multi-rune characters
+	return line, column
+}
+
+// currPos returns the current index position of d.in from d.orig.
+func (d *Decoder) currPos() int {
+	return len(d.orig) - len(d.in)
+}
+
+// matchWithDelim matches s with the input b and verifies that the match
+// terminates with a delimiter of some form (e.g., r"[^-+_.a-zA-Z0-9]").
+// As a special case, EOF is considered a delimiter. It returns the length of s
+// if there is a match, else 0.
+func matchWithDelim(s string, b []byte) int {
+	if !bytes.HasPrefix(b, []byte(s)) {
+		return 0
+	}
+
+	n := len(s)
+	if n < len(b) && isNotDelim(b[n]) {
+		return 0
+	}
+	return n
+}
+
+// isNotDelim returns true if given byte is a not delimiter character.
+func isNotDelim(c byte) bool {
+	return (c == '-' || c == '+' || c == '.' || c == '_' ||
+		('a' <= c && c <= 'z') ||
+		('A' <= c && c <= 'Z') ||
+		('0' <= c && c <= '9'))
+}
+
+// consume consumes n bytes of input and any subsequent whitespace.
+func (d *Decoder) consume(n int) {
+	d.in = d.in[n:]
+	for len(d.in) > 0 {
+		switch d.in[0] {
+		case ' ', '\n', '\r', '\t':
+			d.in = d.in[1:]
+		default:
+			return
+		}
+	}
+}
+
+// isValueNext returns true if next type should be a JSON value: Null,
+// Number, String or Bool.
+func (d *Decoder) isValueNext() bool {
+	if len(d.openStack) == 0 {
+		return d.lastToken.kind == 0
+	}
+
+	start := d.openStack[len(d.openStack)-1]
+	switch start {
+	case ObjectOpen:
+		return d.lastToken.kind&Name != 0
+	case ArrayOpen:
+		return d.lastToken.kind&(ArrayOpen|comma) != 0
+	}
+	panic(fmt.Sprintf(
+		"unreachable logic in Decoder.isValueNext, lastToken.kind: %v, openStack: %v",
+		d.lastToken.kind, start))
+}
+
+// consumeToken constructs a Token for given Kind with raw value derived from
+// current d.in and given size, and consumes the given size-length of it.
+func (d *Decoder) consumeToken(kind Kind, size int) Token {
+	tok := Token{
+		kind: kind,
+		raw:  d.in[:size],
+		pos:  len(d.orig) - len(d.in),
+	}
+	d.consume(size)
+	return tok
+}
+
+// consumeBoolToken constructs a Token for a Bool kind with raw value derived from
+// current d.in and given size.
+func (d *Decoder) consumeBoolToken(b bool, size int) Token {
+	tok := Token{
+		kind: Bool,
+		raw:  d.in[:size],
+		pos:  len(d.orig) - len(d.in),
+		boo:  b,
+	}
+	d.consume(size)
+	return tok
+}
+
+// consumeStringToken constructs a Token for a String kind with raw value derived
+// from current d.in and given size.
+func (d *Decoder) consumeStringToken(s string, size int) Token {
+	tok := Token{
+		kind: String,
+		raw:  d.in[:size],
+		pos:  len(d.orig) - len(d.in),
+		str:  s,
+	}
+	d.consume(size)
+	return tok
+}
+
+// Clone returns a copy of the Decoder for use in reading ahead the next JSON
+// object, array or other values without affecting current Decoder.
+func (d *Decoder) Clone() *Decoder {
+	ret := *d
+	ret.openStack = append([]Kind(nil), ret.openStack...)
+	return &ret
+}
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode_number.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode_number.go
new file mode 100644
index 0000000000..2999d71332
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode_number.go
@@ -0,0 +1,254 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"strconv"
+)
+
+// parseNumber reads the given []byte for a valid JSON number. If it is valid,
+// it returns the number of bytes.  Parsing logic follows the definition in
+// https://tools.ietf.org/html/rfc7159#section-6, and is based off
+// encoding/json.isValidNumber function.
+func parseNumber(input []byte) (int, bool) {
+	var n int
+
+	s := input
+	if len(s) == 0 {
+		return 0, false
+	}
+
+	// Optional -
+	if s[0] == '-' {
+		s = s[1:]
+		n++
+		if len(s) == 0 {
+			return 0, false
+		}
+	}
+
+	// Digits
+	switch {
+	case s[0] == '0':
+		s = s[1:]
+		n++
+
+	case '1' <= s[0] && s[0] <= '9':
+		s = s[1:]
+		n++
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+			n++
+		}
+
+	default:
+		return 0, false
+	}
+
+	// . followed by 1 or more digits.
+	if len(s) >= 2 && s[0] == '.' && '0' <= s[1] && s[1] <= '9' {
+		s = s[2:]
+		n += 2
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+			n++
+		}
+	}
+
+	// e or E followed by an optional - or + and
+	// 1 or more digits.
+	if len(s) >= 2 && (s[0] == 'e' || s[0] == 'E') {
+		s = s[1:]
+		n++
+		if s[0] == '+' || s[0] == '-' {
+			s = s[1:]
+			n++
+			if len(s) == 0 {
+				return 0, false
+			}
+		}
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+			n++
+		}
+	}
+
+	// Check that next byte is a delimiter or it is at the end.
+	if n < len(input) && isNotDelim(input[n]) {
+		return 0, false
+	}
+
+	return n, true
+}
+
+// numberParts is the result of parsing out a valid JSON number. It contains
+// the parts of a number. The parts are used for integer conversion.
+type numberParts struct {
+	neg  bool
+	intp []byte
+	frac []byte
+	exp  []byte
+}
+
+// parseNumber constructs numberParts from given []byte. The logic here is
+// similar to consumeNumber above with the difference of having to construct
+// numberParts. The slice fields in numberParts are subslices of the input.
+func parseNumberParts(input []byte) (numberParts, bool) {
+	var neg bool
+	var intp []byte
+	var frac []byte
+	var exp []byte
+
+	s := input
+	if len(s) == 0 {
+		return numberParts{}, false
+	}
+
+	// Optional -
+	if s[0] == '-' {
+		neg = true
+		s = s[1:]
+		if len(s) == 0 {
+			return numberParts{}, false
+		}
+	}
+
+	// Digits
+	switch {
+	case s[0] == '0':
+		// Skip first 0 and no need to store.
+		s = s[1:]
+
+	case '1' <= s[0] && s[0] <= '9':
+		intp = s
+		n := 1
+		s = s[1:]
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+			n++
+		}
+		intp = intp[:n]
+
+	default:
+		return numberParts{}, false
+	}
+
+	// . followed by 1 or more digits.
+	if len(s) >= 2 && s[0] == '.' && '0' <= s[1] && s[1] <= '9' {
+		frac = s[1:]
+		n := 1
+		s = s[2:]
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+			n++
+		}
+		frac = frac[:n]
+	}
+
+	// e or E followed by an optional - or + and
+	// 1 or more digits.
+	if len(s) >= 2 && (s[0] == 'e' || s[0] == 'E') {
+		s = s[1:]
+		exp = s
+		n := 0
+		if s[0] == '+' || s[0] == '-' {
+			s = s[1:]
+			n++
+			if len(s) == 0 {
+				return numberParts{}, false
+			}
+		}
+		for len(s) > 0 && '0' <= s[0] && s[0] <= '9' {
+			s = s[1:]
+			n++
+		}
+		exp = exp[:n]
+	}
+
+	return numberParts{
+		neg:  neg,
+		intp: intp,
+		frac: bytes.TrimRight(frac, "0"), // Remove unnecessary 0s to the right.
+		exp:  exp,
+	}, true
+}
+
+// normalizeToIntString returns an integer string in normal form without the
+// E-notation for given numberParts. It will return false if it is not an
+// integer or if the exponent exceeds than max/min int value.
+func normalizeToIntString(n numberParts) (string, bool) {
+	intpSize := len(n.intp)
+	fracSize := len(n.frac)
+
+	if intpSize == 0 && fracSize == 0 {
+		return "0", true
+	}
+
+	var exp int
+	if len(n.exp) > 0 {
+		i, err := strconv.ParseInt(string(n.exp), 10, 32)
+		if err != nil {
+			return "", false
+		}
+		exp = int(i)
+	}
+
+	var num []byte
+	if exp >= 0 {
+		// For positive E, shift fraction digits into integer part and also pad
+		// with zeroes as needed.
+
+		// If there are more digits in fraction than the E value, then the
+		// number is not an integer.
+		if fracSize > exp {
+			return "", false
+		}
+
+		// Make sure resulting digits are within max value limit to avoid
+		// unnecessarily constructing a large byte slice that may simply fail
+		// later on.
+		const maxDigits = 20 // Max uint64 value has 20 decimal digits.
+		if intpSize+exp > maxDigits {
+			return "", false
+		}
+
+		// Set cap to make a copy of integer part when appended.
+		num = n.intp[:len(n.intp):len(n.intp)]
+		num = append(num, n.frac...)
+		for i := 0; i < exp-fracSize; i++ {
+			num = append(num, '0')
+		}
+	} else {
+		// For negative E, shift digits in integer part out.
+
+		// If there are fractions, then the number is not an integer.
+		if fracSize > 0 {
+			return "", false
+		}
+
+		// index is where the decimal point will be after adjusting for negative
+		// exponent.
+		index := intpSize + exp
+		if index < 0 {
+			return "", false
+		}
+
+		num = n.intp
+		// If any of the digits being shifted to the right of the decimal point
+		// is non-zero, then the number is not an integer.
+		for i := index; i < intpSize; i++ {
+			if num[i] != '0' {
+				return "", false
+			}
+		}
+		num = num[:index]
+	}
+
+	if n.neg {
+		return "-" + string(num), true
+	}
+	return string(num), true
+}
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode_string.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode_string.go
new file mode 100644
index 0000000000..f7fea7d8dd
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode_string.go
@@ -0,0 +1,91 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"strconv"
+	"unicode"
+	"unicode/utf16"
+	"unicode/utf8"
+
+	"google.golang.org/protobuf/internal/strs"
+)
+
+func (d *Decoder) parseString(in []byte) (string, int, error) {
+	in0 := in
+	if len(in) == 0 {
+		return "", 0, ErrUnexpectedEOF
+	}
+	if in[0] != '"' {
+		return "", 0, d.newSyntaxError(d.currPos(), "invalid character %q at start of string", in[0])
+	}
+	in = in[1:]
+	i := indexNeedEscapeInBytes(in)
+	in, out := in[i:], in[:i:i] // set cap to prevent mutations
+	for len(in) > 0 {
+		switch r, n := utf8.DecodeRune(in); {
+		case r == utf8.RuneError && n == 1:
+			return "", 0, d.newSyntaxError(d.currPos(), "invalid UTF-8 in string")
+		case r < ' ':
+			return "", 0, d.newSyntaxError(d.currPos(), "invalid character %q in string", r)
+		case r == '"':
+			in = in[1:]
+			n := len(in0) - len(in)
+			return string(out), n, nil
+		case r == '\\':
+			if len(in) < 2 {
+				return "", 0, ErrUnexpectedEOF
+			}
+			switch r := in[1]; r {
+			case '"', '\\', '/':
+				in, out = in[2:], append(out, r)
+			case 'b':
+				in, out = in[2:], append(out, '\b')
+			case 'f':
+				in, out = in[2:], append(out, '\f')
+			case 'n':
+				in, out = in[2:], append(out, '\n')
+			case 'r':
+				in, out = in[2:], append(out, '\r')
+			case 't':
+				in, out = in[2:], append(out, '\t')
+			case 'u':
+				if len(in) < 6 {
+					return "", 0, ErrUnexpectedEOF
+				}
+				v, err := strconv.ParseUint(string(in[2:6]), 16, 16)
+				if err != nil {
+					return "", 0, d.newSyntaxError(d.currPos(), "invalid escape code %q in string", in[:6])
+				}
+				in = in[6:]
+
+				r := rune(v)
+				if utf16.IsSurrogate(r) {
+					if len(in) < 6 {
+						return "", 0, ErrUnexpectedEOF
+					}
+					v, err := strconv.ParseUint(string(in[2:6]), 16, 16)
+					r = utf16.DecodeRune(r, rune(v))
+					if in[0] != '\\' || in[1] != 'u' ||
+						r == unicode.ReplacementChar || err != nil {
+						return "", 0, d.newSyntaxError(d.currPos(), "invalid escape code %q in string", in[:6])
+					}
+					in = in[6:]
+				}
+				out = append(out, string(r)...)
+			default:
+				return "", 0, d.newSyntaxError(d.currPos(), "invalid escape code %q in string", in[:2])
+			}
+		default:
+			i := indexNeedEscapeInBytes(in[n:])
+			in, out = in[n+i:], append(out, in[:n+i]...)
+		}
+	}
+	return "", 0, ErrUnexpectedEOF
+}
+
+// indexNeedEscapeInBytes returns the index of the character that needs
+// escaping. If no characters need escaping, this returns the input length.
+func indexNeedEscapeInBytes(b []byte) int { return indexNeedEscapeInString(strs.UnsafeString(b)) }
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode_token.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode_token.go
new file mode 100644
index 0000000000..50578d6593
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode_token.go
@@ -0,0 +1,192 @@
+// Copyright 2019 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+)
+
+// Kind represents a token kind expressible in the JSON format.
+type Kind uint16
+
+const (
+	Invalid Kind = (1 << iota) / 2
+	EOF
+	Null
+	Bool
+	Number
+	String
+	Name
+	ObjectOpen
+	ObjectClose
+	ArrayOpen
+	ArrayClose
+
+	// comma is only for parsing in between tokens and
+	// does not need to be exported.
+	comma
+)
+
+func (k Kind) String() string {
+	switch k {
+	case EOF:
+		return "eof"
+	case Null:
+		return "null"
+	case Bool:
+		return "bool"
+	case Number:
+		return "number"
+	case String:
+		return "string"
+	case ObjectOpen:
+		return "{"
+	case ObjectClose:
+		return "}"
+	case Name:
+		return "name"
+	case ArrayOpen:
+		return "["
+	case ArrayClose:
+		return "]"
+	case comma:
+		return ","
+	}
+	return "<invalid>"
+}
+
+// Token provides a parsed token kind and value.
+//
+// Values are provided by the difference accessor methods. The accessor methods
+// Name, Bool, and ParsedString will panic if called on the wrong kind. There
+// are different accessor methods for the Number kind for converting to the
+// appropriate Go numeric type and those methods have the ok return value.
+type Token struct {
+	// Token kind.
+	kind Kind
+	// pos provides the position of the token in the original input.
+	pos int
+	// raw bytes of the serialized token.
+	// This is a subslice into the original input.
+	raw []byte
+	// boo is parsed boolean value.
+	boo bool
+	// str is parsed string value.
+	str string
+}
+
+// Kind returns the token kind.
+func (t Token) Kind() Kind {
+	return t.kind
+}
+
+// RawString returns the read value in string.
+func (t Token) RawString() string {
+	return string(t.raw)
+}
+
+// Pos returns the token position from the input.
+func (t Token) Pos() int {
+	return t.pos
+}
+
+// Name returns the object name if token is Name, else it panics.
+func (t Token) Name() string {
+	if t.kind == Name {
+		return t.str
+	}
+	panic(fmt.Sprintf("Token is not a Name: %v", t.RawString()))
+}
+
+// Bool returns the bool value if token kind is Bool, else it panics.
+func (t Token) Bool() bool {
+	if t.kind == Bool {
+		return t.boo
+	}
+	panic(fmt.Sprintf("Token is not a Bool: %v", t.RawString()))
+}
+
+// ParsedString returns the string value for a JSON string token or the read
+// value in string if token is not a string.
+func (t Token) ParsedString() string {
+	if t.kind == String {
+		return t.str
+	}
+	panic(fmt.Sprintf("Token is not a String: %v", t.RawString()))
+}
+
+// Float returns the floating-point number if token kind is Number.
+//
+// The floating-point precision is specified by the bitSize parameter: 32 for
+// float32 or 64 for float64. If bitSize=32, the result still has type float64,
+// but it will be convertible to float32 without changing its value. It will
+// return false if the number exceeds the floating point limits for given
+// bitSize.
+func (t Token) Float(bitSize int) (float64, bool) {
+	if t.kind != Number {
+		return 0, false
+	}
+	f, err := strconv.ParseFloat(t.RawString(), bitSize)
+	if err != nil {
+		return 0, false
+	}
+	return f, true
+}
+
+// Int returns the signed integer number if token is Number.
+//
+// The given bitSize specifies the integer type that the result must fit into.
+// It returns false if the number is not an integer value or if the result
+// exceeds the limits for given bitSize.
+func (t Token) Int(bitSize int) (int64, bool) {
+	s, ok := t.getIntStr()
+	if !ok {
+		return 0, false
+	}
+	n, err := strconv.ParseInt(s, 10, bitSize)
+	if err != nil {
+		return 0, false
+	}
+	return n, true
+}
+
+// Uint returns the signed integer number if token is Number.
+//
+// The given bitSize specifies the unsigned integer type that the result must
+// fit into. It returns false if the number is not an unsigned integer value
+// or if the result exceeds the limits for given bitSize.
+func (t Token) Uint(bitSize int) (uint64, bool) {
+	s, ok := t.getIntStr()
+	if !ok {
+		return 0, false
+	}
+	n, err := strconv.ParseUint(s, 10, bitSize)
+	if err != nil {
+		return 0, false
+	}
+	return n, true
+}
+
+func (t Token) getIntStr() (string, bool) {
+	if t.kind != Number {
+		return "", false
+	}
+	parts, ok := parseNumberParts(t.raw)
+	if !ok {
+		return "", false
+	}
+	return normalizeToIntString(parts)
+}
+
+// TokenEquals returns true if given Tokens are equal, else false.
+func TokenEquals(x, y Token) bool {
+	return x.kind == y.kind &&
+		x.pos == y.pos &&
+		bytes.Equal(x.raw, y.raw) &&
+		x.boo == y.boo &&
+		x.str == y.str
+}
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go
new file mode 100644
index 0000000000..fbdf348734
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/encode.go
@@ -0,0 +1,276 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package json
+
+import (
+	"math"
+	"math/bits"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"google.golang.org/protobuf/internal/detrand"
+	"google.golang.org/protobuf/internal/errors"
+)
+
+// kind represents an encoding type.
+type kind uint8
+
+const (
+	_ kind = (1 << iota) / 2
+	name
+	scalar
+	objectOpen
+	objectClose
+	arrayOpen
+	arrayClose
+)
+
+// Encoder provides methods to write out JSON constructs and values. The user is
+// responsible for producing valid sequences of JSON constructs and values.
+type Encoder struct {
+	indent   string
+	lastKind kind
+	indents  []byte
+	out      []byte
+}
+
+// NewEncoder returns an Encoder.
+//
+// If indent is a non-empty string, it causes every entry for an Array or Object
+// to be preceded by the indent and trailed by a newline.
+func NewEncoder(indent string) (*Encoder, error) {
+	e := &Encoder{}
+	if len(indent) > 0 {
+		if strings.Trim(indent, " \t") != "" {
+			return nil, errors.New("indent may only be composed of space or tab characters")
+		}
+		e.indent = indent
+	}
+	return e, nil
+}
+
+// Bytes returns the content of the written bytes.
+func (e *Encoder) Bytes() []byte {
+	return e.out
+}
+
+// WriteNull writes out the null value.
+func (e *Encoder) WriteNull() {
+	e.prepareNext(scalar)
+	e.out = append(e.out, "null"...)
+}
+
+// WriteBool writes out the given boolean value.
+func (e *Encoder) WriteBool(b bool) {
+	e.prepareNext(scalar)
+	if b {
+		e.out = append(e.out, "true"...)
+	} else {
+		e.out = append(e.out, "false"...)
+	}
+}
+
+// WriteString writes out the given string in JSON string value. Returns error
+// if input string contains invalid UTF-8.
+func (e *Encoder) WriteString(s string) error {
+	e.prepareNext(scalar)
+	var err error
+	if e.out, err = appendString(e.out, s); err != nil {
+		return err
+	}
+	return nil
+}
+
+// Sentinel error used for indicating invalid UTF-8.
+var errInvalidUTF8 = errors.New("invalid UTF-8")
+
+func appendString(out []byte, in string) ([]byte, error) {
+	out = append(out, '"')
+	i := indexNeedEscapeInString(in)
+	in, out = in[i:], append(out, in[:i]...)
+	for len(in) > 0 {
+		switch r, n := utf8.DecodeRuneInString(in); {
+		case r == utf8.RuneError && n == 1:
+			return out, errInvalidUTF8
+		case r < ' ' || r == '"' || r == '\\':
+			out = append(out, '\\')
+			switch r {
+			case '"', '\\':
+				out = append(out, byte(r))
+			case '\b':
+				out = append(out, 'b')
+			case '\f':
+				out = append(out, 'f')
+			case '\n':
+				out = append(out, 'n')
+			case '\r':
+				out = append(out, 'r')
+			case '\t':
+				out = append(out, 't')
+			default:
+				out = append(out, 'u')
+				out = append(out, "0000"[1+(bits.Len32(uint32(r))-1)/4:]...)
+				out = strconv.AppendUint(out, uint64(r), 16)
+			}
+			in = in[n:]
+		default:
+			i := indexNeedEscapeInString(in[n:])
+			in, out = in[n+i:], append(out, in[:n+i]...)
+		}
+	}
+	out = append(out, '"')
+	return out, nil
+}
+
+// indexNeedEscapeInString returns the index of the character that needs
+// escaping. If no characters need escaping, this returns the input length.
+func indexNeedEscapeInString(s string) int {
+	for i, r := range s {
+		if r < ' ' || r == '\\' || r == '"' || r == utf8.RuneError {
+			return i
+		}
+	}
+	return len(s)
+}
+
+// WriteFloat writes out the given float and bitSize in JSON number value.
+func (e *Encoder) WriteFloat(n float64, bitSize int) {
+	e.prepareNext(scalar)
+	e.out = appendFloat(e.out, n, bitSize)
+}
+
+// appendFloat formats given float in bitSize, and appends to the given []byte.
+func appendFloat(out []byte, n float64, bitSize int) []byte {
+	switch {
+	case math.IsNaN(n):
+		return append(out, `"NaN"`...)
+	case math.IsInf(n, +1):
+		return append(out, `"Infinity"`...)
+	case math.IsInf(n, -1):
+		return append(out, `"-Infinity"`...)
+	}
+
+	// JSON number formatting logic based on encoding/json.
+	// See floatEncoder.encode for reference.
+	fmt := byte('f')
+	if abs := math.Abs(n); abs != 0 {
+		if bitSize == 64 && (abs < 1e-6 || abs >= 1e21) ||
+			bitSize == 32 && (float32(abs) < 1e-6 || float32(abs) >= 1e21) {
+			fmt = 'e'
+		}
+	}
+	out = strconv.AppendFloat(out, n, fmt, -1, bitSize)
+	if fmt == 'e' {
+		n := len(out)
+		if n >= 4 && out[n-4] == 'e' && out[n-3] == '-' && out[n-2] == '0' {
+			out[n-2] = out[n-1]
+			out = out[:n-1]
+		}
+	}
+	return out
+}
+
+// WriteInt writes out the given signed integer in JSON number value.
+func (e *Encoder) WriteInt(n int64) {
+	e.prepareNext(scalar)
+	e.out = append(e.out, strconv.FormatInt(n, 10)...)
+}
+
+// WriteUint writes out the given unsigned integer in JSON number value.
+func (e *Encoder) WriteUint(n uint64) {
+	e.prepareNext(scalar)
+	e.out = append(e.out, strconv.FormatUint(n, 10)...)
+}
+
+// StartObject writes out the '{' symbol.
+func (e *Encoder) StartObject() {
+	e.prepareNext(objectOpen)
+	e.out = append(e.out, '{')
+}
+
+// EndObject writes out the '}' symbol.
+func (e *Encoder) EndObject() {
+	e.prepareNext(objectClose)
+	e.out = append(e.out, '}')
+}
+
+// WriteName writes out the given string in JSON string value and the name
+// separator ':'. Returns error if input string contains invalid UTF-8, which
+// should not be likely as protobuf field names should be valid.
+func (e *Encoder) WriteName(s string) error {
+	e.prepareNext(name)
+	var err error
+	// Append to output regardless of error.
+	e.out, err = appendString(e.out, s)
+	e.out = append(e.out, ':')
+	return err
+}
+
+// StartArray writes out the '[' symbol.
+func (e *Encoder) StartArray() {
+	e.prepareNext(arrayOpen)
+	e.out = append(e.out, '[')
+}
+
+// EndArray writes out the ']' symbol.
+func (e *Encoder) EndArray() {
+	e.prepareNext(arrayClose)
+	e.out = append(e.out, ']')
+}
+
+// prepareNext adds possible comma and indentation for the next value based
+// on last type and indent option. It also updates lastKind to next.
+func (e *Encoder) prepareNext(next kind) {
+	defer func() {
+		// Set lastKind to next.
+		e.lastKind = next
+	}()
+
+	if len(e.indent) == 0 {
+		// Need to add comma on the following condition.
+		if e.lastKind&(scalar|objectClose|arrayClose) != 0 &&
+			next&(name|scalar|objectOpen|arrayOpen) != 0 {
+			e.out = append(e.out, ',')
+			// For single-line output, add a random extra space after each
+			// comma to make output unstable.
+			if detrand.Bool() {
+				e.out = append(e.out, ' ')
+			}
+		}
+		return
+	}
+
+	switch {
+	case e.lastKind&(objectOpen|arrayOpen) != 0:
+		// If next type is NOT closing, add indent and newline.
+		if next&(objectClose|arrayClose) == 0 {
+			e.indents = append(e.indents, e.indent...)
+			e.out = append(e.out, '\n')
+			e.out = append(e.out, e.indents...)
+		}
+
+	case e.lastKind&(scalar|objectClose|arrayClose) != 0:
+		switch {
+		// If next type is either a value or name, add comma and newline.
+		case next&(name|scalar|objectOpen|arrayOpen) != 0:
+			e.out = append(e.out, ',', '\n')
+
+		// If next type is a closing object or array, adjust indentation.
+		case next&(objectClose|arrayClose) != 0:
+			e.indents = e.indents[:len(e.indents)-len(e.indent)]
+			e.out = append(e.out, '\n')
+		}
+		e.out = append(e.out, e.indents...)
+
+	case e.lastKind&name != 0:
+		e.out = append(e.out, ' ')
+		// For multi-line output, add a random extra space after key: to make
+		// output unstable.
+		if detrand.Bool() {
+			e.out = append(e.out, ' ')
+		}
+	}
+}
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/messageset/messageset.go b/vendor/google.golang.org/protobuf/internal/encoding/messageset/messageset.go
index c1866f3c1a..a6693f0a2f 100644
--- a/vendor/google.golang.org/protobuf/internal/encoding/messageset/messageset.go
+++ b/vendor/google.golang.org/protobuf/internal/encoding/messageset/messageset.go
@@ -10,7 +10,7 @@ import (
 
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/errors"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // The MessageSet wire format is equivalent to a message defined as follows,
@@ -33,6 +33,7 @@ const (
 // ExtensionName is the field name for extensions of MessageSet.
 //
 // A valid MessageSet extension must be of the form:
+//
 //	message MyMessage {
 //		extend proto2.bridge.MessageSet {
 //			optional MyMessage message_set_extension = 1234;
@@ -42,13 +43,13 @@ const (
 const ExtensionName = "message_set_extension"
 
 // IsMessageSet returns whether the message uses the MessageSet wire format.
-func IsMessageSet(md pref.MessageDescriptor) bool {
+func IsMessageSet(md protoreflect.MessageDescriptor) bool {
 	xmd, ok := md.(interface{ IsMessageSet() bool })
 	return ok && xmd.IsMessageSet()
 }
 
 // IsMessageSetExtension reports this field properly extends a MessageSet.
-func IsMessageSetExtension(fd pref.FieldDescriptor) bool {
+func IsMessageSetExtension(fd protoreflect.FieldDescriptor) bool {
 	switch {
 	case fd.Name() != ExtensionName:
 		return false
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/tag/tag.go b/vendor/google.golang.org/protobuf/internal/encoding/tag/tag.go
index 38f1931c6f..373d208374 100644
--- a/vendor/google.golang.org/protobuf/internal/encoding/tag/tag.go
+++ b/vendor/google.golang.org/protobuf/internal/encoding/tag/tag.go
@@ -11,10 +11,10 @@ import (
 	"strconv"
 	"strings"
 
-	defval "google.golang.org/protobuf/internal/encoding/defval"
-	fdesc "google.golang.org/protobuf/internal/filedesc"
+	"google.golang.org/protobuf/internal/encoding/defval"
+	"google.golang.org/protobuf/internal/filedesc"
 	"google.golang.org/protobuf/internal/strs"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 var byteType = reflect.TypeOf(byte(0))
@@ -29,9 +29,9 @@ var byteType = reflect.TypeOf(byte(0))
 // This does not populate the Enum or Message (except for weak message).
 //
 // This function is a best effort attempt; parsing errors are ignored.
-func Unmarshal(tag string, goType reflect.Type, evs pref.EnumValueDescriptors) pref.FieldDescriptor {
-	f := new(fdesc.Field)
-	f.L0.ParentFile = fdesc.SurrogateProto2
+func Unmarshal(tag string, goType reflect.Type, evs protoreflect.EnumValueDescriptors) protoreflect.FieldDescriptor {
+	f := new(filedesc.Field)
+	f.L0.ParentFile = filedesc.SurrogateProto2
 	for len(tag) > 0 {
 		i := strings.IndexByte(tag, ',')
 		if i < 0 {
@@ -39,68 +39,68 @@ func Unmarshal(tag string, goType reflect.Type, evs pref.EnumValueDescriptors) p
 		}
 		switch s := tag[:i]; {
 		case strings.HasPrefix(s, "name="):
-			f.L0.FullName = pref.FullName(s[len("name="):])
+			f.L0.FullName = protoreflect.FullName(s[len("name="):])
 		case strings.Trim(s, "0123456789") == "":
 			n, _ := strconv.ParseUint(s, 10, 32)
-			f.L1.Number = pref.FieldNumber(n)
+			f.L1.Number = protoreflect.FieldNumber(n)
 		case s == "opt":
-			f.L1.Cardinality = pref.Optional
+			f.L1.Cardinality = protoreflect.Optional
 		case s == "req":
-			f.L1.Cardinality = pref.Required
+			f.L1.Cardinality = protoreflect.Required
 		case s == "rep":
-			f.L1.Cardinality = pref.Repeated
+			f.L1.Cardinality = protoreflect.Repeated
 		case s == "varint":
 			switch goType.Kind() {
 			case reflect.Bool:
-				f.L1.Kind = pref.BoolKind
+				f.L1.Kind = protoreflect.BoolKind
 			case reflect.Int32:
-				f.L1.Kind = pref.Int32Kind
+				f.L1.Kind = protoreflect.Int32Kind
 			case reflect.Int64:
-				f.L1.Kind = pref.Int64Kind
+				f.L1.Kind = protoreflect.Int64Kind
 			case reflect.Uint32:
-				f.L1.Kind = pref.Uint32Kind
+				f.L1.Kind = protoreflect.Uint32Kind
 			case reflect.Uint64:
-				f.L1.Kind = pref.Uint64Kind
+				f.L1.Kind = protoreflect.Uint64Kind
 			}
 		case s == "zigzag32":
 			if goType.Kind() == reflect.Int32 {
-				f.L1.Kind = pref.Sint32Kind
+				f.L1.Kind = protoreflect.Sint32Kind
 			}
 		case s == "zigzag64":
 			if goType.Kind() == reflect.Int64 {
-				f.L1.Kind = pref.Sint64Kind
+				f.L1.Kind = protoreflect.Sint64Kind
 			}
 		case s == "fixed32":
 			switch goType.Kind() {
 			case reflect.Int32:
-				f.L1.Kind = pref.Sfixed32Kind
+				f.L1.Kind = protoreflect.Sfixed32Kind
 			case reflect.Uint32:
-				f.L1.Kind = pref.Fixed32Kind
+				f.L1.Kind = protoreflect.Fixed32Kind
 			case reflect.Float32:
-				f.L1.Kind = pref.FloatKind
+				f.L1.Kind = protoreflect.FloatKind
 			}
 		case s == "fixed64":
 			switch goType.Kind() {
 			case reflect.Int64:
-				f.L1.Kind = pref.Sfixed64Kind
+				f.L1.Kind = protoreflect.Sfixed64Kind
 			case reflect.Uint64:
-				f.L1.Kind = pref.Fixed64Kind
+				f.L1.Kind = protoreflect.Fixed64Kind
 			case reflect.Float64:
-				f.L1.Kind = pref.DoubleKind
+				f.L1.Kind = protoreflect.DoubleKind
 			}
 		case s == "bytes":
 			switch {
 			case goType.Kind() == reflect.String:
-				f.L1.Kind = pref.StringKind
+				f.L1.Kind = protoreflect.StringKind
 			case goType.Kind() == reflect.Slice && goType.Elem() == byteType:
-				f.L1.Kind = pref.BytesKind
+				f.L1.Kind = protoreflect.BytesKind
 			default:
-				f.L1.Kind = pref.MessageKind
+				f.L1.Kind = protoreflect.MessageKind
 			}
 		case s == "group":
-			f.L1.Kind = pref.GroupKind
+			f.L1.Kind = protoreflect.GroupKind
 		case strings.HasPrefix(s, "enum="):
-			f.L1.Kind = pref.EnumKind
+			f.L1.Kind = protoreflect.EnumKind
 		case strings.HasPrefix(s, "json="):
 			jsonName := s[len("json="):]
 			if jsonName != strs.JSONCamelCase(string(f.L0.FullName.Name())) {
@@ -111,23 +111,23 @@ func Unmarshal(tag string, goType reflect.Type, evs pref.EnumValueDescriptors) p
 			f.L1.IsPacked = true
 		case strings.HasPrefix(s, "weak="):
 			f.L1.IsWeak = true
-			f.L1.Message = fdesc.PlaceholderMessage(pref.FullName(s[len("weak="):]))
+			f.L1.Message = filedesc.PlaceholderMessage(protoreflect.FullName(s[len("weak="):]))
 		case strings.HasPrefix(s, "def="):
 			// The default tag is special in that everything afterwards is the
 			// default regardless of the presence of commas.
 			s, i = tag[len("def="):], len(tag)
 			v, ev, _ := defval.Unmarshal(s, f.L1.Kind, evs, defval.GoTag)
-			f.L1.Default = fdesc.DefaultValue(v, ev)
+			f.L1.Default = filedesc.DefaultValue(v, ev)
 		case s == "proto3":
-			f.L0.ParentFile = fdesc.SurrogateProto3
+			f.L0.ParentFile = filedesc.SurrogateProto3
 		}
 		tag = strings.TrimPrefix(tag[i:], ",")
 	}
 
 	// The generator uses the group message name instead of the field name.
 	// We obtain the real field name by lowercasing the group name.
-	if f.L1.Kind == pref.GroupKind {
-		f.L0.FullName = pref.FullName(strings.ToLower(string(f.L0.FullName)))
+	if f.L1.Kind == protoreflect.GroupKind {
+		f.L0.FullName = protoreflect.FullName(strings.ToLower(string(f.L0.FullName)))
 	}
 	return f
 }
@@ -140,38 +140,38 @@ func Unmarshal(tag string, goType reflect.Type, evs pref.EnumValueDescriptors) p
 // Depending on the context on how Marshal is called, there are different ways
 // through which that information is determined. As such it is the caller's
 // responsibility to provide a function to obtain that information.
-func Marshal(fd pref.FieldDescriptor, enumName string) string {
+func Marshal(fd protoreflect.FieldDescriptor, enumName string) string {
 	var tag []string
 	switch fd.Kind() {
-	case pref.BoolKind, pref.EnumKind, pref.Int32Kind, pref.Uint32Kind, pref.Int64Kind, pref.Uint64Kind:
+	case protoreflect.BoolKind, protoreflect.EnumKind, protoreflect.Int32Kind, protoreflect.Uint32Kind, protoreflect.Int64Kind, protoreflect.Uint64Kind:
 		tag = append(tag, "varint")
-	case pref.Sint32Kind:
+	case protoreflect.Sint32Kind:
 		tag = append(tag, "zigzag32")
-	case pref.Sint64Kind:
+	case protoreflect.Sint64Kind:
 		tag = append(tag, "zigzag64")
-	case pref.Sfixed32Kind, pref.Fixed32Kind, pref.FloatKind:
+	case protoreflect.Sfixed32Kind, protoreflect.Fixed32Kind, protoreflect.FloatKind:
 		tag = append(tag, "fixed32")
-	case pref.Sfixed64Kind, pref.Fixed64Kind, pref.DoubleKind:
+	case protoreflect.Sfixed64Kind, protoreflect.Fixed64Kind, protoreflect.DoubleKind:
 		tag = append(tag, "fixed64")
-	case pref.StringKind, pref.BytesKind, pref.MessageKind:
+	case protoreflect.StringKind, protoreflect.BytesKind, protoreflect.MessageKind:
 		tag = append(tag, "bytes")
-	case pref.GroupKind:
+	case protoreflect.GroupKind:
 		tag = append(tag, "group")
 	}
 	tag = append(tag, strconv.Itoa(int(fd.Number())))
 	switch fd.Cardinality() {
-	case pref.Optional:
+	case protoreflect.Optional:
 		tag = append(tag, "opt")
-	case pref.Required:
+	case protoreflect.Required:
 		tag = append(tag, "req")
-	case pref.Repeated:
+	case protoreflect.Repeated:
 		tag = append(tag, "rep")
 	}
 	if fd.IsPacked() {
 		tag = append(tag, "packed")
 	}
 	name := string(fd.Name())
-	if fd.Kind() == pref.GroupKind {
+	if fd.Kind() == protoreflect.GroupKind {
 		// The name of the FieldDescriptor for a group field is
 		// lowercased. To find the original capitalization, we
 		// look in the field's MessageType.
@@ -189,10 +189,10 @@ func Marshal(fd pref.FieldDescriptor, enumName string) string {
 	// The previous implementation does not tag extension fields as proto3,
 	// even when the field is defined in a proto3 file. Match that behavior
 	// for consistency.
-	if fd.Syntax() == pref.Proto3 && !fd.IsExtension() {
+	if fd.Syntax() == protoreflect.Proto3 && !fd.IsExtension() {
 		tag = append(tag, "proto3")
 	}
-	if fd.Kind() == pref.EnumKind && enumName != "" {
+	if fd.Kind() == protoreflect.EnumKind && enumName != "" {
 		tag = append(tag, "enum="+enumName)
 	}
 	if fd.ContainingOneof() != nil {
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go
index eb10ea1026..87853e786d 100644
--- a/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go
+++ b/vendor/google.golang.org/protobuf/internal/encoding/text/decode.go
@@ -8,7 +8,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"regexp"
 	"strconv"
 	"unicode/utf8"
 
@@ -381,7 +380,7 @@ func (d *Decoder) currentOpenKind() (Kind, byte) {
 	case '[':
 		return ListOpen, ']'
 	}
-	panic(fmt.Sprintf("Decoder: openStack contains invalid byte %s", string(openCh)))
+	panic(fmt.Sprintf("Decoder: openStack contains invalid byte %c", openCh))
 }
 
 func (d *Decoder) pushOpenStack(ch byte) {
@@ -413,15 +412,16 @@ func (d *Decoder) parseFieldName() (tok Token, err error) {
 	// Field number. Identify if input is a valid number that is not negative
 	// and is decimal integer within 32-bit range.
 	if num := parseNumber(d.in); num.size > 0 {
+		str := num.string(d.in)
 		if !num.neg && num.kind == numDec {
-			if _, err := strconv.ParseInt(string(d.in[:num.size]), 10, 32); err == nil {
+			if _, err := strconv.ParseInt(str, 10, 32); err == nil {
 				return d.consumeToken(Name, num.size, uint8(FieldNumber)), nil
 			}
 		}
-		return Token{}, d.newSyntaxError("invalid field number: %s", d.in[:num.size])
+		return Token{}, d.newSyntaxError("invalid field number: %s", str)
 	}
 
-	return Token{}, d.newSyntaxError("invalid field name: %s", errRegexp.Find(d.in))
+	return Token{}, d.newSyntaxError("invalid field name: %s", errId(d.in))
 }
 
 // parseTypeName parses Any type URL or extension field name. The name is
@@ -571,7 +571,7 @@ func (d *Decoder) parseScalar() (Token, error) {
 		return tok, nil
 	}
 
-	return Token{}, d.newSyntaxError("invalid scalar value: %s", errRegexp.Find(d.in))
+	return Token{}, d.newSyntaxError("invalid scalar value: %s", errId(d.in))
 }
 
 // parseLiteralValue parses a literal value. A literal value is used for
@@ -653,8 +653,29 @@ func consume(b []byte, n int) []byte {
 	return b
 }
 
-// Any sequence that looks like a non-delimiter (for error reporting).
-var errRegexp = regexp.MustCompile(`^([-+._a-zA-Z0-9\/]+|.)`)
+// errId extracts a byte sequence that looks like an invalid ID
+// (for the purposes of error reporting).
+func errId(seq []byte) []byte {
+	const maxLen = 32
+	for i := 0; i < len(seq); {
+		if i > maxLen {
+			return append(seq[:i:i], "…"...)
+		}
+		r, size := utf8.DecodeRune(seq[i:])
+		if r > utf8.RuneSelf || (r != '/' && isDelim(byte(r))) {
+			if i == 0 {
+				// Either the first byte is invalid UTF-8 or a
+				// delimiter, or the first rune is non-ASCII.
+				// Return it as-is.
+				i = size
+			}
+			return seq[:i:i]
+		}
+		i += size
+	}
+	// No delimiter found.
+	return seq
+}
 
 // isDelim returns true if given byte is a delimiter character.
 func isDelim(c byte) bool {
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go b/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go
index f2d90b7899..45c81f0298 100644
--- a/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go
+++ b/vendor/google.golang.org/protobuf/internal/encoding/text/decode_number.go
@@ -15,17 +15,12 @@ func (d *Decoder) parseNumberValue() (Token, bool) {
 	if num.neg {
 		numAttrs |= isNegative
 	}
-	strSize := num.size
-	last := num.size - 1
-	if num.kind == numFloat && (d.in[last] == 'f' || d.in[last] == 'F') {
-		strSize = last
-	}
 	tok := Token{
 		kind:     Scalar,
 		attrs:    numberValue,
 		pos:      len(d.orig) - len(d.in),
 		raw:      d.in[:num.size],
-		str:      string(d.in[:strSize]),
+		str:      num.string(d.in),
 		numAttrs: numAttrs,
 	}
 	d.consume(num.size)
@@ -46,12 +41,35 @@ type number struct {
 	kind uint8
 	neg  bool
 	size int
+	// if neg, this is the length of whitespace and comments between
+	// the minus sign and the rest fo the number literal
+	sep int
+}
+
+func (num number) string(data []byte) string {
+	strSize := num.size
+	last := num.size - 1
+	if num.kind == numFloat && (data[last] == 'f' || data[last] == 'F') {
+		strSize = last
+	}
+	if num.neg && num.sep > 0 {
+		// strip whitespace/comments between negative sign and the rest
+		strLen := strSize - num.sep
+		str := make([]byte, strLen)
+		str[0] = data[0]
+		copy(str[1:], data[num.sep+1:strSize])
+		return string(str)
+	}
+	return string(data[:strSize])
+
 }
 
 // parseNumber constructs a number object from given input. It allows for the
 // following patterns:
-//   integer: ^-?([1-9][0-9]*|0[xX][0-9a-fA-F]+|0[0-7]*)
-//   float: ^-?((0|[1-9][0-9]*)?([.][0-9]*)?([eE][+-]?[0-9]+)?[fF]?)
+//
+//	integer: ^-?([1-9][0-9]*|0[xX][0-9a-fA-F]+|0[0-7]*)
+//	float: ^-?((0|[1-9][0-9]*)?([.][0-9]*)?([eE][+-]?[0-9]+)?[fF]?)
+//
 // It also returns the number of parsed bytes for the given number, 0 if it is
 // not a number.
 func parseNumber(input []byte) number {
@@ -65,19 +83,22 @@ func parseNumber(input []byte) number {
 	}
 
 	// Optional -
+	var sep int
 	if s[0] == '-' {
 		neg = true
 		s = s[1:]
 		size++
+		// Consume any whitespace or comments between the
+		// negative sign and the rest of the number
+		lenBefore := len(s)
+		s = consume(s, 0)
+		sep = lenBefore - len(s)
+		size += sep
 		if len(s) == 0 {
 			return number{}
 		}
 	}
 
-	// C++ allows for whitespace and comments in between the negative sign and
-	// the rest of the number. This logic currently does not but is consistent
-	// with v1.
-
 	switch {
 	case s[0] == '0':
 		if len(s) > 1 {
@@ -114,7 +135,7 @@ func parseNumber(input []byte) number {
 				if len(s) > 0 && !isDelim(s[0]) {
 					return number{}
 				}
-				return number{kind: kind, neg: neg, size: size}
+				return number{kind: kind, neg: neg, size: size, sep: sep}
 			}
 		}
 		s = s[1:]
@@ -186,5 +207,5 @@ func parseNumber(input []byte) number {
 		return number{}
 	}
 
-	return number{kind: kind, neg: neg, size: size}
+	return number{kind: kind, neg: neg, size: size, sep: sep}
 }
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/text/doc.go b/vendor/google.golang.org/protobuf/internal/encoding/text/doc.go
index 0ce8d6fb83..7ae6c2a3c2 100644
--- a/vendor/google.golang.org/protobuf/internal/encoding/text/doc.go
+++ b/vendor/google.golang.org/protobuf/internal/encoding/text/doc.go
@@ -24,6 +24,6 @@
 // the Go implementation should as well.
 //
 // The text format is almost a superset of JSON except:
-//	* message keys are not quoted strings, but identifiers
-//	* the top-level value must be a message without the delimiters
+//   - message keys are not quoted strings, but identifiers
+//   - the top-level value must be a message without the delimiters
 package text
diff --git a/vendor/google.golang.org/protobuf/internal/errors/is_go112.go b/vendor/google.golang.org/protobuf/internal/errors/is_go112.go
index f90e909b37..fbcd349207 100644
--- a/vendor/google.golang.org/protobuf/internal/errors/is_go112.go
+++ b/vendor/google.golang.org/protobuf/internal/errors/is_go112.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !go1.13
 // +build !go1.13
 
 package errors
diff --git a/vendor/google.golang.org/protobuf/internal/errors/is_go113.go b/vendor/google.golang.org/protobuf/internal/errors/is_go113.go
index dc05f4191c..5e72f1cde9 100644
--- a/vendor/google.golang.org/protobuf/internal/errors/is_go113.go
+++ b/vendor/google.golang.org/protobuf/internal/errors/is_go113.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build go1.13
 // +build go1.13
 
 package errors
diff --git a/vendor/google.golang.org/protobuf/internal/filedesc/build.go b/vendor/google.golang.org/protobuf/internal/filedesc/build.go
index b293b69473..7cac1c1901 100644
--- a/vendor/google.golang.org/protobuf/internal/filedesc/build.go
+++ b/vendor/google.golang.org/protobuf/internal/filedesc/build.go
@@ -12,8 +12,7 @@ import (
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/genid"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
 // Builder construct a protoreflect.FileDescriptor from the raw descriptor.
@@ -38,7 +37,7 @@ type Builder struct {
 	// TypeResolver resolves extension field types for descriptor options.
 	// If nil, it uses protoregistry.GlobalTypes.
 	TypeResolver interface {
-		preg.ExtensionTypeResolver
+		protoregistry.ExtensionTypeResolver
 	}
 
 	// FileRegistry is use to lookup file, enum, and message dependencies.
@@ -46,8 +45,8 @@ type Builder struct {
 	// If nil, it uses protoregistry.GlobalFiles.
 	FileRegistry interface {
 		FindFileByPath(string) (protoreflect.FileDescriptor, error)
-		FindDescriptorByName(pref.FullName) (pref.Descriptor, error)
-		RegisterFile(pref.FileDescriptor) error
+		FindDescriptorByName(protoreflect.FullName) (protoreflect.Descriptor, error)
+		RegisterFile(protoreflect.FileDescriptor) error
 	}
 }
 
@@ -55,8 +54,8 @@ type Builder struct {
 // If so, it permits looking up an enum or message dependency based on the
 // sub-list and element index into filetype.Builder.DependencyIndexes.
 type resolverByIndex interface {
-	FindEnumByIndex(int32, int32, []Enum, []Message) pref.EnumDescriptor
-	FindMessageByIndex(int32, int32, []Enum, []Message) pref.MessageDescriptor
+	FindEnumByIndex(int32, int32, []Enum, []Message) protoreflect.EnumDescriptor
+	FindMessageByIndex(int32, int32, []Enum, []Message) protoreflect.MessageDescriptor
 }
 
 // Indexes of each sub-list in filetype.Builder.DependencyIndexes.
@@ -70,7 +69,7 @@ const (
 
 // Out is the output of the Builder.
 type Out struct {
-	File pref.FileDescriptor
+	File protoreflect.FileDescriptor
 
 	// Enums is all enum descriptors in "flattened ordering".
 	Enums []Enum
@@ -97,10 +96,10 @@ func (db Builder) Build() (out Out) {
 
 	// Initialize resolvers and registries if unpopulated.
 	if db.TypeResolver == nil {
-		db.TypeResolver = preg.GlobalTypes
+		db.TypeResolver = protoregistry.GlobalTypes
 	}
 	if db.FileRegistry == nil {
-		db.FileRegistry = preg.GlobalFiles
+		db.FileRegistry = protoregistry.GlobalFiles
 	}
 
 	fd := newRawFile(db)
diff --git a/vendor/google.golang.org/protobuf/internal/filedesc/desc.go b/vendor/google.golang.org/protobuf/internal/filedesc/desc.go
index 98ab142aee..7c3689baee 100644
--- a/vendor/google.golang.org/protobuf/internal/filedesc/desc.go
+++ b/vendor/google.golang.org/protobuf/internal/filedesc/desc.go
@@ -17,7 +17,7 @@ import (
 	"google.golang.org/protobuf/internal/genid"
 	"google.golang.org/protobuf/internal/pragma"
 	"google.golang.org/protobuf/internal/strs"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
@@ -43,9 +43,9 @@ type (
 		L2   *FileL2
 	}
 	FileL1 struct {
-		Syntax  pref.Syntax
+		Syntax  protoreflect.Syntax
 		Path    string
-		Package pref.FullName
+		Package protoreflect.FullName
 
 		Enums      Enums
 		Messages   Messages
@@ -53,36 +53,36 @@ type (
 		Services   Services
 	}
 	FileL2 struct {
-		Options   func() pref.ProtoMessage
+		Options   func() protoreflect.ProtoMessage
 		Imports   FileImports
 		Locations SourceLocations
 	}
 )
 
-func (fd *File) ParentFile() pref.FileDescriptor { return fd }
-func (fd *File) Parent() pref.Descriptor         { return nil }
-func (fd *File) Index() int                      { return 0 }
-func (fd *File) Syntax() pref.Syntax             { return fd.L1.Syntax }
-func (fd *File) Name() pref.Name                 { return fd.L1.Package.Name() }
-func (fd *File) FullName() pref.FullName         { return fd.L1.Package }
-func (fd *File) IsPlaceholder() bool             { return false }
-func (fd *File) Options() pref.ProtoMessage {
+func (fd *File) ParentFile() protoreflect.FileDescriptor { return fd }
+func (fd *File) Parent() protoreflect.Descriptor         { return nil }
+func (fd *File) Index() int                              { return 0 }
+func (fd *File) Syntax() protoreflect.Syntax             { return fd.L1.Syntax }
+func (fd *File) Name() protoreflect.Name                 { return fd.L1.Package.Name() }
+func (fd *File) FullName() protoreflect.FullName         { return fd.L1.Package }
+func (fd *File) IsPlaceholder() bool                     { return false }
+func (fd *File) Options() protoreflect.ProtoMessage {
 	if f := fd.lazyInit().Options; f != nil {
 		return f()
 	}
 	return descopts.File
 }
-func (fd *File) Path() string                          { return fd.L1.Path }
-func (fd *File) Package() pref.FullName                { return fd.L1.Package }
-func (fd *File) Imports() pref.FileImports             { return &fd.lazyInit().Imports }
-func (fd *File) Enums() pref.EnumDescriptors           { return &fd.L1.Enums }
-func (fd *File) Messages() pref.MessageDescriptors     { return &fd.L1.Messages }
-func (fd *File) Extensions() pref.ExtensionDescriptors { return &fd.L1.Extensions }
-func (fd *File) Services() pref.ServiceDescriptors     { return &fd.L1.Services }
-func (fd *File) SourceLocations() pref.SourceLocations { return &fd.lazyInit().Locations }
-func (fd *File) Format(s fmt.State, r rune)            { descfmt.FormatDesc(s, r, fd) }
-func (fd *File) ProtoType(pref.FileDescriptor)         {}
-func (fd *File) ProtoInternal(pragma.DoNotImplement)   {}
+func (fd *File) Path() string                                  { return fd.L1.Path }
+func (fd *File) Package() protoreflect.FullName                { return fd.L1.Package }
+func (fd *File) Imports() protoreflect.FileImports             { return &fd.lazyInit().Imports }
+func (fd *File) Enums() protoreflect.EnumDescriptors           { return &fd.L1.Enums }
+func (fd *File) Messages() protoreflect.MessageDescriptors     { return &fd.L1.Messages }
+func (fd *File) Extensions() protoreflect.ExtensionDescriptors { return &fd.L1.Extensions }
+func (fd *File) Services() protoreflect.ServiceDescriptors     { return &fd.L1.Services }
+func (fd *File) SourceLocations() protoreflect.SourceLocations { return &fd.lazyInit().Locations }
+func (fd *File) Format(s fmt.State, r rune)                    { descfmt.FormatDesc(s, r, fd) }
+func (fd *File) ProtoType(protoreflect.FileDescriptor)         {}
+func (fd *File) ProtoInternal(pragma.DoNotImplement)           {}
 
 func (fd *File) lazyInit() *FileL2 {
 	if atomic.LoadUint32(&fd.once) == 0 {
@@ -119,7 +119,7 @@ type (
 		eagerValues bool // controls whether EnumL2.Values is already populated
 	}
 	EnumL2 struct {
-		Options        func() pref.ProtoMessage
+		Options        func() protoreflect.ProtoMessage
 		Values         EnumValues
 		ReservedNames  Names
 		ReservedRanges EnumRanges
@@ -130,41 +130,41 @@ type (
 		L1 EnumValueL1
 	}
 	EnumValueL1 struct {
-		Options func() pref.ProtoMessage
-		Number  pref.EnumNumber
+		Options func() protoreflect.ProtoMessage
+		Number  protoreflect.EnumNumber
 	}
 )
 
-func (ed *Enum) Options() pref.ProtoMessage {
+func (ed *Enum) Options() protoreflect.ProtoMessage {
 	if f := ed.lazyInit().Options; f != nil {
 		return f()
 	}
 	return descopts.Enum
 }
-func (ed *Enum) Values() pref.EnumValueDescriptors {
+func (ed *Enum) Values() protoreflect.EnumValueDescriptors {
 	if ed.L1.eagerValues {
 		return &ed.L2.Values
 	}
 	return &ed.lazyInit().Values
 }
-func (ed *Enum) ReservedNames() pref.Names       { return &ed.lazyInit().ReservedNames }
-func (ed *Enum) ReservedRanges() pref.EnumRanges { return &ed.lazyInit().ReservedRanges }
-func (ed *Enum) Format(s fmt.State, r rune)      { descfmt.FormatDesc(s, r, ed) }
-func (ed *Enum) ProtoType(pref.EnumDescriptor)   {}
+func (ed *Enum) ReservedNames() protoreflect.Names       { return &ed.lazyInit().ReservedNames }
+func (ed *Enum) ReservedRanges() protoreflect.EnumRanges { return &ed.lazyInit().ReservedRanges }
+func (ed *Enum) Format(s fmt.State, r rune)              { descfmt.FormatDesc(s, r, ed) }
+func (ed *Enum) ProtoType(protoreflect.EnumDescriptor)   {}
 func (ed *Enum) lazyInit() *EnumL2 {
 	ed.L0.ParentFile.lazyInit() // implicitly initializes L2
 	return ed.L2
 }
 
-func (ed *EnumValue) Options() pref.ProtoMessage {
+func (ed *EnumValue) Options() protoreflect.ProtoMessage {
 	if f := ed.L1.Options; f != nil {
 		return f()
 	}
 	return descopts.EnumValue
 }
-func (ed *EnumValue) Number() pref.EnumNumber            { return ed.L1.Number }
-func (ed *EnumValue) Format(s fmt.State, r rune)         { descfmt.FormatDesc(s, r, ed) }
-func (ed *EnumValue) ProtoType(pref.EnumValueDescriptor) {}
+func (ed *EnumValue) Number() protoreflect.EnumNumber            { return ed.L1.Number }
+func (ed *EnumValue) Format(s fmt.State, r rune)                 { descfmt.FormatDesc(s, r, ed) }
+func (ed *EnumValue) ProtoType(protoreflect.EnumValueDescriptor) {}
 
 type (
 	Message struct {
@@ -180,14 +180,14 @@ type (
 		IsMessageSet bool // promoted from google.protobuf.MessageOptions
 	}
 	MessageL2 struct {
-		Options               func() pref.ProtoMessage
+		Options               func() protoreflect.ProtoMessage
 		Fields                Fields
 		Oneofs                Oneofs
 		ReservedNames         Names
 		ReservedRanges        FieldRanges
 		RequiredNumbers       FieldNumbers // must be consistent with Fields.Cardinality
 		ExtensionRanges       FieldRanges
-		ExtensionRangeOptions []func() pref.ProtoMessage // must be same length as ExtensionRanges
+		ExtensionRangeOptions []func() protoreflect.ProtoMessage // must be same length as ExtensionRanges
 	}
 
 	Field struct {
@@ -195,10 +195,10 @@ type (
 		L1 FieldL1
 	}
 	FieldL1 struct {
-		Options          func() pref.ProtoMessage
-		Number           pref.FieldNumber
-		Cardinality      pref.Cardinality // must be consistent with Message.RequiredNumbers
-		Kind             pref.Kind
+		Options          func() protoreflect.ProtoMessage
+		Number           protoreflect.FieldNumber
+		Cardinality      protoreflect.Cardinality // must be consistent with Message.RequiredNumbers
+		Kind             protoreflect.Kind
 		StringName       stringName
 		IsProto3Optional bool // promoted from google.protobuf.FieldDescriptorProto
 		IsWeak           bool // promoted from google.protobuf.FieldOptions
@@ -207,9 +207,9 @@ type (
 		HasEnforceUTF8   bool // promoted from google.protobuf.FieldOptions
 		EnforceUTF8      bool // promoted from google.protobuf.FieldOptions
 		Default          defaultValue
-		ContainingOneof  pref.OneofDescriptor // must be consistent with Message.Oneofs.Fields
-		Enum             pref.EnumDescriptor
-		Message          pref.MessageDescriptor
+		ContainingOneof  protoreflect.OneofDescriptor // must be consistent with Message.Oneofs.Fields
+		Enum             protoreflect.EnumDescriptor
+		Message          protoreflect.MessageDescriptor
 	}
 
 	Oneof struct {
@@ -217,35 +217,35 @@ type (
 		L1 OneofL1
 	}
 	OneofL1 struct {
-		Options func() pref.ProtoMessage
+		Options func() protoreflect.ProtoMessage
 		Fields  OneofFields // must be consistent with Message.Fields.ContainingOneof
 	}
 )
 
-func (md *Message) Options() pref.ProtoMessage {
+func (md *Message) Options() protoreflect.ProtoMessage {
 	if f := md.lazyInit().Options; f != nil {
 		return f()
 	}
 	return descopts.Message
 }
-func (md *Message) IsMapEntry() bool                   { return md.L1.IsMapEntry }
-func (md *Message) Fields() pref.FieldDescriptors      { return &md.lazyInit().Fields }
-func (md *Message) Oneofs() pref.OneofDescriptors      { return &md.lazyInit().Oneofs }
-func (md *Message) ReservedNames() pref.Names          { return &md.lazyInit().ReservedNames }
-func (md *Message) ReservedRanges() pref.FieldRanges   { return &md.lazyInit().ReservedRanges }
-func (md *Message) RequiredNumbers() pref.FieldNumbers { return &md.lazyInit().RequiredNumbers }
-func (md *Message) ExtensionRanges() pref.FieldRanges  { return &md.lazyInit().ExtensionRanges }
-func (md *Message) ExtensionRangeOptions(i int) pref.ProtoMessage {
+func (md *Message) IsMapEntry() bool                           { return md.L1.IsMapEntry }
+func (md *Message) Fields() protoreflect.FieldDescriptors      { return &md.lazyInit().Fields }
+func (md *Message) Oneofs() protoreflect.OneofDescriptors      { return &md.lazyInit().Oneofs }
+func (md *Message) ReservedNames() protoreflect.Names          { return &md.lazyInit().ReservedNames }
+func (md *Message) ReservedRanges() protoreflect.FieldRanges   { return &md.lazyInit().ReservedRanges }
+func (md *Message) RequiredNumbers() protoreflect.FieldNumbers { return &md.lazyInit().RequiredNumbers }
+func (md *Message) ExtensionRanges() protoreflect.FieldRanges  { return &md.lazyInit().ExtensionRanges }
+func (md *Message) ExtensionRangeOptions(i int) protoreflect.ProtoMessage {
 	if f := md.lazyInit().ExtensionRangeOptions[i]; f != nil {
 		return f()
 	}
 	return descopts.ExtensionRange
 }
-func (md *Message) Enums() pref.EnumDescriptors           { return &md.L1.Enums }
-func (md *Message) Messages() pref.MessageDescriptors     { return &md.L1.Messages }
-func (md *Message) Extensions() pref.ExtensionDescriptors { return &md.L1.Extensions }
-func (md *Message) ProtoType(pref.MessageDescriptor)      {}
-func (md *Message) Format(s fmt.State, r rune)            { descfmt.FormatDesc(s, r, md) }
+func (md *Message) Enums() protoreflect.EnumDescriptors           { return &md.L1.Enums }
+func (md *Message) Messages() protoreflect.MessageDescriptors     { return &md.L1.Messages }
+func (md *Message) Extensions() protoreflect.ExtensionDescriptors { return &md.L1.Extensions }
+func (md *Message) ProtoType(protoreflect.MessageDescriptor)      {}
+func (md *Message) Format(s fmt.State, r rune)                    { descfmt.FormatDesc(s, r, md) }
 func (md *Message) lazyInit() *MessageL2 {
 	md.L0.ParentFile.lazyInit() // implicitly initializes L2
 	return md.L2
@@ -260,28 +260,28 @@ func (md *Message) IsMessageSet() bool {
 	return md.L1.IsMessageSet
 }
 
-func (fd *Field) Options() pref.ProtoMessage {
+func (fd *Field) Options() protoreflect.ProtoMessage {
 	if f := fd.L1.Options; f != nil {
 		return f()
 	}
 	return descopts.Field
 }
-func (fd *Field) Number() pref.FieldNumber      { return fd.L1.Number }
-func (fd *Field) Cardinality() pref.Cardinality { return fd.L1.Cardinality }
-func (fd *Field) Kind() pref.Kind               { return fd.L1.Kind }
-func (fd *Field) HasJSONName() bool             { return fd.L1.StringName.hasJSON }
-func (fd *Field) JSONName() string              { return fd.L1.StringName.getJSON(fd) }
-func (fd *Field) TextName() string              { return fd.L1.StringName.getText(fd) }
+func (fd *Field) Number() protoreflect.FieldNumber      { return fd.L1.Number }
+func (fd *Field) Cardinality() protoreflect.Cardinality { return fd.L1.Cardinality }
+func (fd *Field) Kind() protoreflect.Kind               { return fd.L1.Kind }
+func (fd *Field) HasJSONName() bool                     { return fd.L1.StringName.hasJSON }
+func (fd *Field) JSONName() string                      { return fd.L1.StringName.getJSON(fd) }
+func (fd *Field) TextName() string                      { return fd.L1.StringName.getText(fd) }
 func (fd *Field) HasPresence() bool {
-	return fd.L1.Cardinality != pref.Repeated && (fd.L0.ParentFile.L1.Syntax == pref.Proto2 || fd.L1.Message != nil || fd.L1.ContainingOneof != nil)
+	return fd.L1.Cardinality != protoreflect.Repeated && (fd.L0.ParentFile.L1.Syntax == protoreflect.Proto2 || fd.L1.Message != nil || fd.L1.ContainingOneof != nil)
 }
 func (fd *Field) HasOptionalKeyword() bool {
-	return (fd.L0.ParentFile.L1.Syntax == pref.Proto2 && fd.L1.Cardinality == pref.Optional && fd.L1.ContainingOneof == nil) || fd.L1.IsProto3Optional
+	return (fd.L0.ParentFile.L1.Syntax == protoreflect.Proto2 && fd.L1.Cardinality == protoreflect.Optional && fd.L1.ContainingOneof == nil) || fd.L1.IsProto3Optional
 }
 func (fd *Field) IsPacked() bool {
-	if !fd.L1.HasPacked && fd.L0.ParentFile.L1.Syntax != pref.Proto2 && fd.L1.Cardinality == pref.Repeated {
+	if !fd.L1.HasPacked && fd.L0.ParentFile.L1.Syntax != protoreflect.Proto2 && fd.L1.Cardinality == protoreflect.Repeated {
 		switch fd.L1.Kind {
-		case pref.StringKind, pref.BytesKind, pref.MessageKind, pref.GroupKind:
+		case protoreflect.StringKind, protoreflect.BytesKind, protoreflect.MessageKind, protoreflect.GroupKind:
 		default:
 			return true
 		}
@@ -290,40 +290,40 @@ func (fd *Field) IsPacked() bool {
 }
 func (fd *Field) IsExtension() bool { return false }
 func (fd *Field) IsWeak() bool      { return fd.L1.IsWeak }
-func (fd *Field) IsList() bool      { return fd.Cardinality() == pref.Repeated && !fd.IsMap() }
+func (fd *Field) IsList() bool      { return fd.Cardinality() == protoreflect.Repeated && !fd.IsMap() }
 func (fd *Field) IsMap() bool       { return fd.Message() != nil && fd.Message().IsMapEntry() }
-func (fd *Field) MapKey() pref.FieldDescriptor {
+func (fd *Field) MapKey() protoreflect.FieldDescriptor {
 	if !fd.IsMap() {
 		return nil
 	}
 	return fd.Message().Fields().ByNumber(genid.MapEntry_Key_field_number)
 }
-func (fd *Field) MapValue() pref.FieldDescriptor {
+func (fd *Field) MapValue() protoreflect.FieldDescriptor {
 	if !fd.IsMap() {
 		return nil
 	}
 	return fd.Message().Fields().ByNumber(genid.MapEntry_Value_field_number)
 }
-func (fd *Field) HasDefault() bool                           { return fd.L1.Default.has }
-func (fd *Field) Default() pref.Value                        { return fd.L1.Default.get(fd) }
-func (fd *Field) DefaultEnumValue() pref.EnumValueDescriptor { return fd.L1.Default.enum }
-func (fd *Field) ContainingOneof() pref.OneofDescriptor      { return fd.L1.ContainingOneof }
-func (fd *Field) ContainingMessage() pref.MessageDescriptor {
-	return fd.L0.Parent.(pref.MessageDescriptor)
+func (fd *Field) HasDefault() bool                                   { return fd.L1.Default.has }
+func (fd *Field) Default() protoreflect.Value                        { return fd.L1.Default.get(fd) }
+func (fd *Field) DefaultEnumValue() protoreflect.EnumValueDescriptor { return fd.L1.Default.enum }
+func (fd *Field) ContainingOneof() protoreflect.OneofDescriptor      { return fd.L1.ContainingOneof }
+func (fd *Field) ContainingMessage() protoreflect.MessageDescriptor {
+	return fd.L0.Parent.(protoreflect.MessageDescriptor)
 }
-func (fd *Field) Enum() pref.EnumDescriptor {
+func (fd *Field) Enum() protoreflect.EnumDescriptor {
 	return fd.L1.Enum
 }
-func (fd *Field) Message() pref.MessageDescriptor {
+func (fd *Field) Message() protoreflect.MessageDescriptor {
 	if fd.L1.IsWeak {
 		if d, _ := protoregistry.GlobalFiles.FindDescriptorByName(fd.L1.Message.FullName()); d != nil {
-			return d.(pref.MessageDescriptor)
+			return d.(protoreflect.MessageDescriptor)
 		}
 	}
 	return fd.L1.Message
 }
-func (fd *Field) Format(s fmt.State, r rune)     { descfmt.FormatDesc(s, r, fd) }
-func (fd *Field) ProtoType(pref.FieldDescriptor) {}
+func (fd *Field) Format(s fmt.State, r rune)             { descfmt.FormatDesc(s, r, fd) }
+func (fd *Field) ProtoType(protoreflect.FieldDescriptor) {}
 
 // EnforceUTF8 is a pseudo-internal API to determine whether to enforce UTF-8
 // validation for the string field. This exists for Google-internal use only
@@ -336,21 +336,21 @@ func (fd *Field) EnforceUTF8() bool {
 	if fd.L1.HasEnforceUTF8 {
 		return fd.L1.EnforceUTF8
 	}
-	return fd.L0.ParentFile.L1.Syntax == pref.Proto3
+	return fd.L0.ParentFile.L1.Syntax == protoreflect.Proto3
 }
 
 func (od *Oneof) IsSynthetic() bool {
-	return od.L0.ParentFile.L1.Syntax == pref.Proto3 && len(od.L1.Fields.List) == 1 && od.L1.Fields.List[0].HasOptionalKeyword()
+	return od.L0.ParentFile.L1.Syntax == protoreflect.Proto3 && len(od.L1.Fields.List) == 1 && od.L1.Fields.List[0].HasOptionalKeyword()
 }
-func (od *Oneof) Options() pref.ProtoMessage {
+func (od *Oneof) Options() protoreflect.ProtoMessage {
 	if f := od.L1.Options; f != nil {
 		return f()
 	}
 	return descopts.Oneof
 }
-func (od *Oneof) Fields() pref.FieldDescriptors  { return &od.L1.Fields }
-func (od *Oneof) Format(s fmt.State, r rune)     { descfmt.FormatDesc(s, r, od) }
-func (od *Oneof) ProtoType(pref.OneofDescriptor) {}
+func (od *Oneof) Fields() protoreflect.FieldDescriptors  { return &od.L1.Fields }
+func (od *Oneof) Format(s fmt.State, r rune)             { descfmt.FormatDesc(s, r, od) }
+func (od *Oneof) ProtoType(protoreflect.OneofDescriptor) {}
 
 type (
 	Extension struct {
@@ -359,55 +359,57 @@ type (
 		L2 *ExtensionL2 // protected by fileDesc.once
 	}
 	ExtensionL1 struct {
-		Number      pref.FieldNumber
-		Extendee    pref.MessageDescriptor
-		Cardinality pref.Cardinality
-		Kind        pref.Kind
+		Number      protoreflect.FieldNumber
+		Extendee    protoreflect.MessageDescriptor
+		Cardinality protoreflect.Cardinality
+		Kind        protoreflect.Kind
 	}
 	ExtensionL2 struct {
-		Options          func() pref.ProtoMessage
+		Options          func() protoreflect.ProtoMessage
 		StringName       stringName
 		IsProto3Optional bool // promoted from google.protobuf.FieldDescriptorProto
 		IsPacked         bool // promoted from google.protobuf.FieldOptions
 		Default          defaultValue
-		Enum             pref.EnumDescriptor
-		Message          pref.MessageDescriptor
+		Enum             protoreflect.EnumDescriptor
+		Message          protoreflect.MessageDescriptor
 	}
 )
 
-func (xd *Extension) Options() pref.ProtoMessage {
+func (xd *Extension) Options() protoreflect.ProtoMessage {
 	if f := xd.lazyInit().Options; f != nil {
 		return f()
 	}
 	return descopts.Field
 }
-func (xd *Extension) Number() pref.FieldNumber      { return xd.L1.Number }
-func (xd *Extension) Cardinality() pref.Cardinality { return xd.L1.Cardinality }
-func (xd *Extension) Kind() pref.Kind               { return xd.L1.Kind }
-func (xd *Extension) HasJSONName() bool             { return xd.lazyInit().StringName.hasJSON }
-func (xd *Extension) JSONName() string              { return xd.lazyInit().StringName.getJSON(xd) }
-func (xd *Extension) TextName() string              { return xd.lazyInit().StringName.getText(xd) }
-func (xd *Extension) HasPresence() bool             { return xd.L1.Cardinality != pref.Repeated }
+func (xd *Extension) Number() protoreflect.FieldNumber      { return xd.L1.Number }
+func (xd *Extension) Cardinality() protoreflect.Cardinality { return xd.L1.Cardinality }
+func (xd *Extension) Kind() protoreflect.Kind               { return xd.L1.Kind }
+func (xd *Extension) HasJSONName() bool                     { return xd.lazyInit().StringName.hasJSON }
+func (xd *Extension) JSONName() string                      { return xd.lazyInit().StringName.getJSON(xd) }
+func (xd *Extension) TextName() string                      { return xd.lazyInit().StringName.getText(xd) }
+func (xd *Extension) HasPresence() bool                     { return xd.L1.Cardinality != protoreflect.Repeated }
 func (xd *Extension) HasOptionalKeyword() bool {
-	return (xd.L0.ParentFile.L1.Syntax == pref.Proto2 && xd.L1.Cardinality == pref.Optional) || xd.lazyInit().IsProto3Optional
-}
-func (xd *Extension) IsPacked() bool                             { return xd.lazyInit().IsPacked }
-func (xd *Extension) IsExtension() bool                          { return true }
-func (xd *Extension) IsWeak() bool                               { return false }
-func (xd *Extension) IsList() bool                               { return xd.Cardinality() == pref.Repeated }
-func (xd *Extension) IsMap() bool                                { return false }
-func (xd *Extension) MapKey() pref.FieldDescriptor               { return nil }
-func (xd *Extension) MapValue() pref.FieldDescriptor             { return nil }
-func (xd *Extension) HasDefault() bool                           { return xd.lazyInit().Default.has }
-func (xd *Extension) Default() pref.Value                        { return xd.lazyInit().Default.get(xd) }
-func (xd *Extension) DefaultEnumValue() pref.EnumValueDescriptor { return xd.lazyInit().Default.enum }
-func (xd *Extension) ContainingOneof() pref.OneofDescriptor      { return nil }
-func (xd *Extension) ContainingMessage() pref.MessageDescriptor  { return xd.L1.Extendee }
-func (xd *Extension) Enum() pref.EnumDescriptor                  { return xd.lazyInit().Enum }
-func (xd *Extension) Message() pref.MessageDescriptor            { return xd.lazyInit().Message }
-func (xd *Extension) Format(s fmt.State, r rune)                 { descfmt.FormatDesc(s, r, xd) }
-func (xd *Extension) ProtoType(pref.FieldDescriptor)             {}
-func (xd *Extension) ProtoInternal(pragma.DoNotImplement)        {}
+	return (xd.L0.ParentFile.L1.Syntax == protoreflect.Proto2 && xd.L1.Cardinality == protoreflect.Optional) || xd.lazyInit().IsProto3Optional
+}
+func (xd *Extension) IsPacked() bool                         { return xd.lazyInit().IsPacked }
+func (xd *Extension) IsExtension() bool                      { return true }
+func (xd *Extension) IsWeak() bool                           { return false }
+func (xd *Extension) IsList() bool                           { return xd.Cardinality() == protoreflect.Repeated }
+func (xd *Extension) IsMap() bool                            { return false }
+func (xd *Extension) MapKey() protoreflect.FieldDescriptor   { return nil }
+func (xd *Extension) MapValue() protoreflect.FieldDescriptor { return nil }
+func (xd *Extension) HasDefault() bool                       { return xd.lazyInit().Default.has }
+func (xd *Extension) Default() protoreflect.Value            { return xd.lazyInit().Default.get(xd) }
+func (xd *Extension) DefaultEnumValue() protoreflect.EnumValueDescriptor {
+	return xd.lazyInit().Default.enum
+}
+func (xd *Extension) ContainingOneof() protoreflect.OneofDescriptor     { return nil }
+func (xd *Extension) ContainingMessage() protoreflect.MessageDescriptor { return xd.L1.Extendee }
+func (xd *Extension) Enum() protoreflect.EnumDescriptor                 { return xd.lazyInit().Enum }
+func (xd *Extension) Message() protoreflect.MessageDescriptor           { return xd.lazyInit().Message }
+func (xd *Extension) Format(s fmt.State, r rune)                        { descfmt.FormatDesc(s, r, xd) }
+func (xd *Extension) ProtoType(protoreflect.FieldDescriptor)            {}
+func (xd *Extension) ProtoInternal(pragma.DoNotImplement)               {}
 func (xd *Extension) lazyInit() *ExtensionL2 {
 	xd.L0.ParentFile.lazyInit() // implicitly initializes L2
 	return xd.L2
@@ -421,7 +423,7 @@ type (
 	}
 	ServiceL1 struct{}
 	ServiceL2 struct {
-		Options func() pref.ProtoMessage
+		Options func() protoreflect.ProtoMessage
 		Methods Methods
 	}
 
@@ -430,48 +432,48 @@ type (
 		L1 MethodL1
 	}
 	MethodL1 struct {
-		Options           func() pref.ProtoMessage
-		Input             pref.MessageDescriptor
-		Output            pref.MessageDescriptor
+		Options           func() protoreflect.ProtoMessage
+		Input             protoreflect.MessageDescriptor
+		Output            protoreflect.MessageDescriptor
 		IsStreamingClient bool
 		IsStreamingServer bool
 	}
 )
 
-func (sd *Service) Options() pref.ProtoMessage {
+func (sd *Service) Options() protoreflect.ProtoMessage {
 	if f := sd.lazyInit().Options; f != nil {
 		return f()
 	}
 	return descopts.Service
 }
-func (sd *Service) Methods() pref.MethodDescriptors     { return &sd.lazyInit().Methods }
-func (sd *Service) Format(s fmt.State, r rune)          { descfmt.FormatDesc(s, r, sd) }
-func (sd *Service) ProtoType(pref.ServiceDescriptor)    {}
-func (sd *Service) ProtoInternal(pragma.DoNotImplement) {}
+func (sd *Service) Methods() protoreflect.MethodDescriptors  { return &sd.lazyInit().Methods }
+func (sd *Service) Format(s fmt.State, r rune)               { descfmt.FormatDesc(s, r, sd) }
+func (sd *Service) ProtoType(protoreflect.ServiceDescriptor) {}
+func (sd *Service) ProtoInternal(pragma.DoNotImplement)      {}
 func (sd *Service) lazyInit() *ServiceL2 {
 	sd.L0.ParentFile.lazyInit() // implicitly initializes L2
 	return sd.L2
 }
 
-func (md *Method) Options() pref.ProtoMessage {
+func (md *Method) Options() protoreflect.ProtoMessage {
 	if f := md.L1.Options; f != nil {
 		return f()
 	}
 	return descopts.Method
 }
-func (md *Method) Input() pref.MessageDescriptor       { return md.L1.Input }
-func (md *Method) Output() pref.MessageDescriptor      { return md.L1.Output }
-func (md *Method) IsStreamingClient() bool             { return md.L1.IsStreamingClient }
-func (md *Method) IsStreamingServer() bool             { return md.L1.IsStreamingServer }
-func (md *Method) Format(s fmt.State, r rune)          { descfmt.FormatDesc(s, r, md) }
-func (md *Method) ProtoType(pref.MethodDescriptor)     {}
-func (md *Method) ProtoInternal(pragma.DoNotImplement) {}
+func (md *Method) Input() protoreflect.MessageDescriptor   { return md.L1.Input }
+func (md *Method) Output() protoreflect.MessageDescriptor  { return md.L1.Output }
+func (md *Method) IsStreamingClient() bool                 { return md.L1.IsStreamingClient }
+func (md *Method) IsStreamingServer() bool                 { return md.L1.IsStreamingServer }
+func (md *Method) Format(s fmt.State, r rune)              { descfmt.FormatDesc(s, r, md) }
+func (md *Method) ProtoType(protoreflect.MethodDescriptor) {}
+func (md *Method) ProtoInternal(pragma.DoNotImplement)     {}
 
 // Surrogate files are can be used to create standalone descriptors
 // where the syntax is only information derived from the parent file.
 var (
-	SurrogateProto2 = &File{L1: FileL1{Syntax: pref.Proto2}, L2: &FileL2{}}
-	SurrogateProto3 = &File{L1: FileL1{Syntax: pref.Proto3}, L2: &FileL2{}}
+	SurrogateProto2 = &File{L1: FileL1{Syntax: protoreflect.Proto2}, L2: &FileL2{}}
+	SurrogateProto3 = &File{L1: FileL1{Syntax: protoreflect.Proto3}, L2: &FileL2{}}
 )
 
 type (
@@ -479,24 +481,24 @@ type (
 		L0 BaseL0
 	}
 	BaseL0 struct {
-		FullName   pref.FullName // must be populated
-		ParentFile *File         // must be populated
-		Parent     pref.Descriptor
+		FullName   protoreflect.FullName // must be populated
+		ParentFile *File                 // must be populated
+		Parent     protoreflect.Descriptor
 		Index      int
 	}
 )
 
-func (d *Base) Name() pref.Name         { return d.L0.FullName.Name() }
-func (d *Base) FullName() pref.FullName { return d.L0.FullName }
-func (d *Base) ParentFile() pref.FileDescriptor {
+func (d *Base) Name() protoreflect.Name         { return d.L0.FullName.Name() }
+func (d *Base) FullName() protoreflect.FullName { return d.L0.FullName }
+func (d *Base) ParentFile() protoreflect.FileDescriptor {
 	if d.L0.ParentFile == SurrogateProto2 || d.L0.ParentFile == SurrogateProto3 {
 		return nil // surrogate files are not real parents
 	}
 	return d.L0.ParentFile
 }
-func (d *Base) Parent() pref.Descriptor             { return d.L0.Parent }
+func (d *Base) Parent() protoreflect.Descriptor     { return d.L0.Parent }
 func (d *Base) Index() int                          { return d.L0.Index }
-func (d *Base) Syntax() pref.Syntax                 { return d.L0.ParentFile.Syntax() }
+func (d *Base) Syntax() protoreflect.Syntax         { return d.L0.ParentFile.Syntax() }
 func (d *Base) IsPlaceholder() bool                 { return false }
 func (d *Base) ProtoInternal(pragma.DoNotImplement) {}
 
@@ -513,7 +515,7 @@ func (s *stringName) InitJSON(name string) {
 	s.nameJSON = name
 }
 
-func (s *stringName) lazyInit(fd pref.FieldDescriptor) *stringName {
+func (s *stringName) lazyInit(fd protoreflect.FieldDescriptor) *stringName {
 	s.once.Do(func() {
 		if fd.IsExtension() {
 			// For extensions, JSON and text are formatted the same way.
@@ -533,7 +535,7 @@ func (s *stringName) lazyInit(fd pref.FieldDescriptor) *stringName {
 
 			// Format the text name.
 			s.nameText = string(fd.Name())
-			if fd.Kind() == pref.GroupKind {
+			if fd.Kind() == protoreflect.GroupKind {
 				s.nameText = string(fd.Message().Name())
 			}
 		}
@@ -541,10 +543,10 @@ func (s *stringName) lazyInit(fd pref.FieldDescriptor) *stringName {
 	return s
 }
 
-func (s *stringName) getJSON(fd pref.FieldDescriptor) string { return s.lazyInit(fd).nameJSON }
-func (s *stringName) getText(fd pref.FieldDescriptor) string { return s.lazyInit(fd).nameText }
+func (s *stringName) getJSON(fd protoreflect.FieldDescriptor) string { return s.lazyInit(fd).nameJSON }
+func (s *stringName) getText(fd protoreflect.FieldDescriptor) string { return s.lazyInit(fd).nameText }
 
-func DefaultValue(v pref.Value, ev pref.EnumValueDescriptor) defaultValue {
+func DefaultValue(v protoreflect.Value, ev protoreflect.EnumValueDescriptor) defaultValue {
 	dv := defaultValue{has: v.IsValid(), val: v, enum: ev}
 	if b, ok := v.Interface().([]byte); ok {
 		// Store a copy of the default bytes, so that we can detect
@@ -554,9 +556,9 @@ func DefaultValue(v pref.Value, ev pref.EnumValueDescriptor) defaultValue {
 	return dv
 }
 
-func unmarshalDefault(b []byte, k pref.Kind, pf *File, ed pref.EnumDescriptor) defaultValue {
-	var evs pref.EnumValueDescriptors
-	if k == pref.EnumKind {
+func unmarshalDefault(b []byte, k protoreflect.Kind, pf *File, ed protoreflect.EnumDescriptor) defaultValue {
+	var evs protoreflect.EnumValueDescriptors
+	if k == protoreflect.EnumKind {
 		// If the enum is declared within the same file, be careful not to
 		// blindly call the Values method, lest we bind ourselves in a deadlock.
 		if e, ok := ed.(*Enum); ok && e.L0.ParentFile == pf {
@@ -567,9 +569,9 @@ func unmarshalDefault(b []byte, k pref.Kind, pf *File, ed pref.EnumDescriptor) d
 
 		// If we are unable to resolve the enum dependency, use a placeholder
 		// enum value since we will not be able to parse the default value.
-		if ed.IsPlaceholder() && pref.Name(b).IsValid() {
-			v := pref.ValueOfEnum(0)
-			ev := PlaceholderEnumValue(ed.FullName().Parent().Append(pref.Name(b)))
+		if ed.IsPlaceholder() && protoreflect.Name(b).IsValid() {
+			v := protoreflect.ValueOfEnum(0)
+			ev := PlaceholderEnumValue(ed.FullName().Parent().Append(protoreflect.Name(b)))
 			return DefaultValue(v, ev)
 		}
 	}
@@ -583,41 +585,41 @@ func unmarshalDefault(b []byte, k pref.Kind, pf *File, ed pref.EnumDescriptor) d
 
 type defaultValue struct {
 	has   bool
-	val   pref.Value
-	enum  pref.EnumValueDescriptor
+	val   protoreflect.Value
+	enum  protoreflect.EnumValueDescriptor
 	bytes []byte
 }
 
-func (dv *defaultValue) get(fd pref.FieldDescriptor) pref.Value {
+func (dv *defaultValue) get(fd protoreflect.FieldDescriptor) protoreflect.Value {
 	// Return the zero value as the default if unpopulated.
 	if !dv.has {
-		if fd.Cardinality() == pref.Repeated {
-			return pref.Value{}
+		if fd.Cardinality() == protoreflect.Repeated {
+			return protoreflect.Value{}
 		}
 		switch fd.Kind() {
-		case pref.BoolKind:
-			return pref.ValueOfBool(false)
-		case pref.Int32Kind, pref.Sint32Kind, pref.Sfixed32Kind:
-			return pref.ValueOfInt32(0)
-		case pref.Int64Kind, pref.Sint64Kind, pref.Sfixed64Kind:
-			return pref.ValueOfInt64(0)
-		case pref.Uint32Kind, pref.Fixed32Kind:
-			return pref.ValueOfUint32(0)
-		case pref.Uint64Kind, pref.Fixed64Kind:
-			return pref.ValueOfUint64(0)
-		case pref.FloatKind:
-			return pref.ValueOfFloat32(0)
-		case pref.DoubleKind:
-			return pref.ValueOfFloat64(0)
-		case pref.StringKind:
-			return pref.ValueOfString("")
-		case pref.BytesKind:
-			return pref.ValueOfBytes(nil)
-		case pref.EnumKind:
+		case protoreflect.BoolKind:
+			return protoreflect.ValueOfBool(false)
+		case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+			return protoreflect.ValueOfInt32(0)
+		case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+			return protoreflect.ValueOfInt64(0)
+		case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
+			return protoreflect.ValueOfUint32(0)
+		case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
+			return protoreflect.ValueOfUint64(0)
+		case protoreflect.FloatKind:
+			return protoreflect.ValueOfFloat32(0)
+		case protoreflect.DoubleKind:
+			return protoreflect.ValueOfFloat64(0)
+		case protoreflect.StringKind:
+			return protoreflect.ValueOfString("")
+		case protoreflect.BytesKind:
+			return protoreflect.ValueOfBytes(nil)
+		case protoreflect.EnumKind:
 			if evs := fd.Enum().Values(); evs.Len() > 0 {
-				return pref.ValueOfEnum(evs.Get(0).Number())
+				return protoreflect.ValueOfEnum(evs.Get(0).Number())
 			}
-			return pref.ValueOfEnum(0)
+			return protoreflect.ValueOfEnum(0)
 		}
 	}
 
diff --git a/vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go b/vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go
index 66e1fee522..4a1584c9d2 100644
--- a/vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go
+++ b/vendor/google.golang.org/protobuf/internal/filedesc/desc_init.go
@@ -10,7 +10,7 @@ import (
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/genid"
 	"google.golang.org/protobuf/internal/strs"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // fileRaw is a data struct used when initializing a file descriptor from
@@ -95,7 +95,7 @@ func (fd *File) unmarshalSeed(b []byte) {
 	sb := getBuilder()
 	defer putBuilder(sb)
 
-	var prevField pref.FieldNumber
+	var prevField protoreflect.FieldNumber
 	var numEnums, numMessages, numExtensions, numServices int
 	var posEnums, posMessages, posExtensions, posServices int
 	b0 := b
@@ -110,16 +110,16 @@ func (fd *File) unmarshalSeed(b []byte) {
 			case genid.FileDescriptorProto_Syntax_field_number:
 				switch string(v) {
 				case "proto2":
-					fd.L1.Syntax = pref.Proto2
+					fd.L1.Syntax = protoreflect.Proto2
 				case "proto3":
-					fd.L1.Syntax = pref.Proto3
+					fd.L1.Syntax = protoreflect.Proto3
 				default:
 					panic("invalid syntax")
 				}
 			case genid.FileDescriptorProto_Name_field_number:
 				fd.L1.Path = sb.MakeString(v)
 			case genid.FileDescriptorProto_Package_field_number:
-				fd.L1.Package = pref.FullName(sb.MakeString(v))
+				fd.L1.Package = protoreflect.FullName(sb.MakeString(v))
 			case genid.FileDescriptorProto_EnumType_field_number:
 				if prevField != genid.FileDescriptorProto_EnumType_field_number {
 					if numEnums > 0 {
@@ -163,7 +163,7 @@ func (fd *File) unmarshalSeed(b []byte) {
 
 	// If syntax is missing, it is assumed to be proto2.
 	if fd.L1.Syntax == 0 {
-		fd.L1.Syntax = pref.Proto2
+		fd.L1.Syntax = protoreflect.Proto2
 	}
 
 	// Must allocate all declarations before parsing each descriptor type
@@ -219,7 +219,7 @@ func (fd *File) unmarshalSeed(b []byte) {
 	}
 }
 
-func (ed *Enum) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (ed *Enum) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	ed.L0.ParentFile = pf
 	ed.L0.Parent = pd
 	ed.L0.Index = i
@@ -271,12 +271,12 @@ func (ed *Enum) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref.Desc
 	}
 }
 
-func (md *Message) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (md *Message) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	md.L0.ParentFile = pf
 	md.L0.Parent = pd
 	md.L0.Index = i
 
-	var prevField pref.FieldNumber
+	var prevField protoreflect.FieldNumber
 	var numEnums, numMessages, numExtensions int
 	var posEnums, posMessages, posExtensions int
 	b0 := b
@@ -387,7 +387,7 @@ func (md *Message) unmarshalSeedOptions(b []byte) {
 	}
 }
 
-func (xd *Extension) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (xd *Extension) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	xd.L0.ParentFile = pf
 	xd.L0.Parent = pd
 	xd.L0.Index = i
@@ -401,11 +401,11 @@ func (xd *Extension) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref
 			b = b[m:]
 			switch num {
 			case genid.FieldDescriptorProto_Number_field_number:
-				xd.L1.Number = pref.FieldNumber(v)
+				xd.L1.Number = protoreflect.FieldNumber(v)
 			case genid.FieldDescriptorProto_Label_field_number:
-				xd.L1.Cardinality = pref.Cardinality(v)
+				xd.L1.Cardinality = protoreflect.Cardinality(v)
 			case genid.FieldDescriptorProto_Type_field_number:
-				xd.L1.Kind = pref.Kind(v)
+				xd.L1.Kind = protoreflect.Kind(v)
 			}
 		case protowire.BytesType:
 			v, m := protowire.ConsumeBytes(b)
@@ -423,7 +423,7 @@ func (xd *Extension) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref
 	}
 }
 
-func (sd *Service) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (sd *Service) unmarshalSeed(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	sd.L0.ParentFile = pf
 	sd.L0.Parent = pd
 	sd.L0.Index = i
@@ -459,13 +459,13 @@ func putBuilder(b *strs.Builder) {
 
 // makeFullName converts b to a protoreflect.FullName,
 // where b must start with a leading dot.
-func makeFullName(sb *strs.Builder, b []byte) pref.FullName {
+func makeFullName(sb *strs.Builder, b []byte) protoreflect.FullName {
 	if len(b) == 0 || b[0] != '.' {
 		panic("name reference must be fully qualified")
 	}
-	return pref.FullName(sb.MakeString(b[1:]))
+	return protoreflect.FullName(sb.MakeString(b[1:]))
 }
 
-func appendFullName(sb *strs.Builder, prefix pref.FullName, suffix []byte) pref.FullName {
-	return sb.AppendFullName(prefix, pref.Name(strs.UnsafeString(suffix)))
+func appendFullName(sb *strs.Builder, prefix protoreflect.FullName, suffix []byte) protoreflect.FullName {
+	return sb.AppendFullName(prefix, protoreflect.Name(strs.UnsafeString(suffix)))
 }
diff --git a/vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go b/vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go
index 198451e3ec..736a19a75b 100644
--- a/vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go
+++ b/vendor/google.golang.org/protobuf/internal/filedesc/desc_lazy.go
@@ -13,7 +13,7 @@ import (
 	"google.golang.org/protobuf/internal/genid"
 	"google.golang.org/protobuf/internal/strs"
 	"google.golang.org/protobuf/proto"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 func (fd *File) lazyRawInit() {
@@ -39,10 +39,10 @@ func (file *File) resolveMessages() {
 
 			// Resolve message field dependency.
 			switch fd.L1.Kind {
-			case pref.EnumKind:
+			case protoreflect.EnumKind:
 				fd.L1.Enum = file.resolveEnumDependency(fd.L1.Enum, listFieldDeps, depIdx)
 				depIdx++
-			case pref.MessageKind, pref.GroupKind:
+			case protoreflect.MessageKind, protoreflect.GroupKind:
 				fd.L1.Message = file.resolveMessageDependency(fd.L1.Message, listFieldDeps, depIdx)
 				depIdx++
 			}
@@ -62,10 +62,10 @@ func (file *File) resolveExtensions() {
 
 		// Resolve extension field dependency.
 		switch xd.L1.Kind {
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			xd.L2.Enum = file.resolveEnumDependency(xd.L2.Enum, listExtDeps, depIdx)
 			depIdx++
-		case pref.MessageKind, pref.GroupKind:
+		case protoreflect.MessageKind, protoreflect.GroupKind:
 			xd.L2.Message = file.resolveMessageDependency(xd.L2.Message, listExtDeps, depIdx)
 			depIdx++
 		}
@@ -92,7 +92,7 @@ func (file *File) resolveServices() {
 	}
 }
 
-func (file *File) resolveEnumDependency(ed pref.EnumDescriptor, i, j int32) pref.EnumDescriptor {
+func (file *File) resolveEnumDependency(ed protoreflect.EnumDescriptor, i, j int32) protoreflect.EnumDescriptor {
 	r := file.builder.FileRegistry
 	if r, ok := r.(resolverByIndex); ok {
 		if ed2 := r.FindEnumByIndex(i, j, file.allEnums, file.allMessages); ed2 != nil {
@@ -105,12 +105,12 @@ func (file *File) resolveEnumDependency(ed pref.EnumDescriptor, i, j int32) pref
 		}
 	}
 	if d, _ := r.FindDescriptorByName(ed.FullName()); d != nil {
-		return d.(pref.EnumDescriptor)
+		return d.(protoreflect.EnumDescriptor)
 	}
 	return ed
 }
 
-func (file *File) resolveMessageDependency(md pref.MessageDescriptor, i, j int32) pref.MessageDescriptor {
+func (file *File) resolveMessageDependency(md protoreflect.MessageDescriptor, i, j int32) protoreflect.MessageDescriptor {
 	r := file.builder.FileRegistry
 	if r, ok := r.(resolverByIndex); ok {
 		if md2 := r.FindMessageByIndex(i, j, file.allEnums, file.allMessages); md2 != nil {
@@ -123,7 +123,7 @@ func (file *File) resolveMessageDependency(md pref.MessageDescriptor, i, j int32
 		}
 	}
 	if d, _ := r.FindDescriptorByName(md.FullName()); d != nil {
-		return d.(pref.MessageDescriptor)
+		return d.(protoreflect.MessageDescriptor)
 	}
 	return md
 }
@@ -158,7 +158,7 @@ func (fd *File) unmarshalFull(b []byte) {
 				if imp == nil {
 					imp = PlaceholderFile(path)
 				}
-				fd.L2.Imports = append(fd.L2.Imports, pref.FileImport{FileDescriptor: imp})
+				fd.L2.Imports = append(fd.L2.Imports, protoreflect.FileImport{FileDescriptor: imp})
 			case genid.FileDescriptorProto_EnumType_field_number:
 				fd.L1.Enums.List[enumIdx].unmarshalFull(v, sb)
 				enumIdx++
@@ -199,7 +199,7 @@ func (ed *Enum) unmarshalFull(b []byte, sb *strs.Builder) {
 			case genid.EnumDescriptorProto_Value_field_number:
 				rawValues = append(rawValues, v)
 			case genid.EnumDescriptorProto_ReservedName_field_number:
-				ed.L2.ReservedNames.List = append(ed.L2.ReservedNames.List, pref.Name(sb.MakeString(v)))
+				ed.L2.ReservedNames.List = append(ed.L2.ReservedNames.List, protoreflect.Name(sb.MakeString(v)))
 			case genid.EnumDescriptorProto_ReservedRange_field_number:
 				ed.L2.ReservedRanges.List = append(ed.L2.ReservedRanges.List, unmarshalEnumReservedRange(v))
 			case genid.EnumDescriptorProto_Options_field_number:
@@ -219,7 +219,7 @@ func (ed *Enum) unmarshalFull(b []byte, sb *strs.Builder) {
 	ed.L2.Options = ed.L0.ParentFile.builder.optionsUnmarshaler(&descopts.Enum, rawOptions)
 }
 
-func unmarshalEnumReservedRange(b []byte) (r [2]pref.EnumNumber) {
+func unmarshalEnumReservedRange(b []byte) (r [2]protoreflect.EnumNumber) {
 	for len(b) > 0 {
 		num, typ, n := protowire.ConsumeTag(b)
 		b = b[n:]
@@ -229,9 +229,9 @@ func unmarshalEnumReservedRange(b []byte) (r [2]pref.EnumNumber) {
 			b = b[m:]
 			switch num {
 			case genid.EnumDescriptorProto_EnumReservedRange_Start_field_number:
-				r[0] = pref.EnumNumber(v)
+				r[0] = protoreflect.EnumNumber(v)
 			case genid.EnumDescriptorProto_EnumReservedRange_End_field_number:
-				r[1] = pref.EnumNumber(v)
+				r[1] = protoreflect.EnumNumber(v)
 			}
 		default:
 			m := protowire.ConsumeFieldValue(num, typ, b)
@@ -241,7 +241,7 @@ func unmarshalEnumReservedRange(b []byte) (r [2]pref.EnumNumber) {
 	return r
 }
 
-func (vd *EnumValue) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (vd *EnumValue) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	vd.L0.ParentFile = pf
 	vd.L0.Parent = pd
 	vd.L0.Index = i
@@ -256,7 +256,7 @@ func (vd *EnumValue) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref
 			b = b[m:]
 			switch num {
 			case genid.EnumValueDescriptorProto_Number_field_number:
-				vd.L1.Number = pref.EnumNumber(v)
+				vd.L1.Number = protoreflect.EnumNumber(v)
 			}
 		case protowire.BytesType:
 			v, m := protowire.ConsumeBytes(b)
@@ -294,7 +294,7 @@ func (md *Message) unmarshalFull(b []byte, sb *strs.Builder) {
 			case genid.DescriptorProto_OneofDecl_field_number:
 				rawOneofs = append(rawOneofs, v)
 			case genid.DescriptorProto_ReservedName_field_number:
-				md.L2.ReservedNames.List = append(md.L2.ReservedNames.List, pref.Name(sb.MakeString(v)))
+				md.L2.ReservedNames.List = append(md.L2.ReservedNames.List, protoreflect.Name(sb.MakeString(v)))
 			case genid.DescriptorProto_ReservedRange_field_number:
 				md.L2.ReservedRanges.List = append(md.L2.ReservedRanges.List, unmarshalMessageReservedRange(v))
 			case genid.DescriptorProto_ExtensionRange_field_number:
@@ -326,7 +326,7 @@ func (md *Message) unmarshalFull(b []byte, sb *strs.Builder) {
 		for i, b := range rawFields {
 			fd := &md.L2.Fields.List[i]
 			fd.unmarshalFull(b, sb, md.L0.ParentFile, md, i)
-			if fd.L1.Cardinality == pref.Required {
+			if fd.L1.Cardinality == protoreflect.Required {
 				md.L2.RequiredNumbers.List = append(md.L2.RequiredNumbers.List, fd.L1.Number)
 			}
 		}
@@ -359,7 +359,7 @@ func (md *Message) unmarshalOptions(b []byte) {
 	}
 }
 
-func unmarshalMessageReservedRange(b []byte) (r [2]pref.FieldNumber) {
+func unmarshalMessageReservedRange(b []byte) (r [2]protoreflect.FieldNumber) {
 	for len(b) > 0 {
 		num, typ, n := protowire.ConsumeTag(b)
 		b = b[n:]
@@ -369,9 +369,9 @@ func unmarshalMessageReservedRange(b []byte) (r [2]pref.FieldNumber) {
 			b = b[m:]
 			switch num {
 			case genid.DescriptorProto_ReservedRange_Start_field_number:
-				r[0] = pref.FieldNumber(v)
+				r[0] = protoreflect.FieldNumber(v)
 			case genid.DescriptorProto_ReservedRange_End_field_number:
-				r[1] = pref.FieldNumber(v)
+				r[1] = protoreflect.FieldNumber(v)
 			}
 		default:
 			m := protowire.ConsumeFieldValue(num, typ, b)
@@ -381,7 +381,7 @@ func unmarshalMessageReservedRange(b []byte) (r [2]pref.FieldNumber) {
 	return r
 }
 
-func unmarshalMessageExtensionRange(b []byte) (r [2]pref.FieldNumber, rawOptions []byte) {
+func unmarshalMessageExtensionRange(b []byte) (r [2]protoreflect.FieldNumber, rawOptions []byte) {
 	for len(b) > 0 {
 		num, typ, n := protowire.ConsumeTag(b)
 		b = b[n:]
@@ -391,9 +391,9 @@ func unmarshalMessageExtensionRange(b []byte) (r [2]pref.FieldNumber, rawOptions
 			b = b[m:]
 			switch num {
 			case genid.DescriptorProto_ExtensionRange_Start_field_number:
-				r[0] = pref.FieldNumber(v)
+				r[0] = protoreflect.FieldNumber(v)
 			case genid.DescriptorProto_ExtensionRange_End_field_number:
-				r[1] = pref.FieldNumber(v)
+				r[1] = protoreflect.FieldNumber(v)
 			}
 		case protowire.BytesType:
 			v, m := protowire.ConsumeBytes(b)
@@ -410,7 +410,7 @@ func unmarshalMessageExtensionRange(b []byte) (r [2]pref.FieldNumber, rawOptions
 	return r, rawOptions
 }
 
-func (fd *Field) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (fd *Field) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	fd.L0.ParentFile = pf
 	fd.L0.Parent = pd
 	fd.L0.Index = i
@@ -426,11 +426,11 @@ func (fd *Field) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Des
 			b = b[m:]
 			switch num {
 			case genid.FieldDescriptorProto_Number_field_number:
-				fd.L1.Number = pref.FieldNumber(v)
+				fd.L1.Number = protoreflect.FieldNumber(v)
 			case genid.FieldDescriptorProto_Label_field_number:
-				fd.L1.Cardinality = pref.Cardinality(v)
+				fd.L1.Cardinality = protoreflect.Cardinality(v)
 			case genid.FieldDescriptorProto_Type_field_number:
-				fd.L1.Kind = pref.Kind(v)
+				fd.L1.Kind = protoreflect.Kind(v)
 			case genid.FieldDescriptorProto_OneofIndex_field_number:
 				// In Message.unmarshalFull, we allocate slices for both
 				// the field and oneof descriptors before unmarshaling either
@@ -453,7 +453,7 @@ func (fd *Field) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Des
 			case genid.FieldDescriptorProto_JsonName_field_number:
 				fd.L1.StringName.InitJSON(sb.MakeString(v))
 			case genid.FieldDescriptorProto_DefaultValue_field_number:
-				fd.L1.Default.val = pref.ValueOfBytes(v) // temporarily store as bytes; later resolved in resolveMessages
+				fd.L1.Default.val = protoreflect.ValueOfBytes(v) // temporarily store as bytes; later resolved in resolveMessages
 			case genid.FieldDescriptorProto_TypeName_field_number:
 				rawTypeName = v
 			case genid.FieldDescriptorProto_Options_field_number:
@@ -468,9 +468,9 @@ func (fd *Field) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Des
 	if rawTypeName != nil {
 		name := makeFullName(sb, rawTypeName)
 		switch fd.L1.Kind {
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			fd.L1.Enum = PlaceholderEnum(name)
-		case pref.MessageKind, pref.GroupKind:
+		case protoreflect.MessageKind, protoreflect.GroupKind:
 			fd.L1.Message = PlaceholderMessage(name)
 		}
 	}
@@ -504,7 +504,7 @@ func (fd *Field) unmarshalOptions(b []byte) {
 	}
 }
 
-func (od *Oneof) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (od *Oneof) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	od.L0.ParentFile = pf
 	od.L0.Parent = pd
 	od.L0.Index = i
@@ -553,7 +553,7 @@ func (xd *Extension) unmarshalFull(b []byte, sb *strs.Builder) {
 			case genid.FieldDescriptorProto_JsonName_field_number:
 				xd.L2.StringName.InitJSON(sb.MakeString(v))
 			case genid.FieldDescriptorProto_DefaultValue_field_number:
-				xd.L2.Default.val = pref.ValueOfBytes(v) // temporarily store as bytes; later resolved in resolveExtensions
+				xd.L2.Default.val = protoreflect.ValueOfBytes(v) // temporarily store as bytes; later resolved in resolveExtensions
 			case genid.FieldDescriptorProto_TypeName_field_number:
 				rawTypeName = v
 			case genid.FieldDescriptorProto_Options_field_number:
@@ -568,9 +568,9 @@ func (xd *Extension) unmarshalFull(b []byte, sb *strs.Builder) {
 	if rawTypeName != nil {
 		name := makeFullName(sb, rawTypeName)
 		switch xd.L1.Kind {
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			xd.L2.Enum = PlaceholderEnum(name)
-		case pref.MessageKind, pref.GroupKind:
+		case protoreflect.MessageKind, protoreflect.GroupKind:
 			xd.L2.Message = PlaceholderMessage(name)
 		}
 	}
@@ -627,7 +627,7 @@ func (sd *Service) unmarshalFull(b []byte, sb *strs.Builder) {
 	sd.L2.Options = sd.L0.ParentFile.builder.optionsUnmarshaler(&descopts.Service, rawOptions)
 }
 
-func (md *Method) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd pref.Descriptor, i int) {
+func (md *Method) unmarshalFull(b []byte, sb *strs.Builder, pf *File, pd protoreflect.Descriptor, i int) {
 	md.L0.ParentFile = pf
 	md.L0.Parent = pd
 	md.L0.Index = i
@@ -680,18 +680,18 @@ func appendOptions(dst, src []byte) []byte {
 //
 // The type of message to unmarshal to is passed as a pointer since the
 // vars in descopts may not yet be populated at the time this function is called.
-func (db *Builder) optionsUnmarshaler(p *pref.ProtoMessage, b []byte) func() pref.ProtoMessage {
+func (db *Builder) optionsUnmarshaler(p *protoreflect.ProtoMessage, b []byte) func() protoreflect.ProtoMessage {
 	if b == nil {
 		return nil
 	}
-	var opts pref.ProtoMessage
+	var opts protoreflect.ProtoMessage
 	var once sync.Once
-	return func() pref.ProtoMessage {
+	return func() protoreflect.ProtoMessage {
 		once.Do(func() {
 			if *p == nil {
 				panic("Descriptor.Options called without importing the descriptor package")
 			}
-			opts = reflect.New(reflect.TypeOf(*p).Elem()).Interface().(pref.ProtoMessage)
+			opts = reflect.New(reflect.TypeOf(*p).Elem()).Interface().(protoreflect.ProtoMessage)
 			if err := (proto.UnmarshalOptions{
 				AllowPartial: true,
 				Resolver:     db.TypeResolver,
diff --git a/vendor/google.golang.org/protobuf/internal/filedesc/desc_list.go b/vendor/google.golang.org/protobuf/internal/filedesc/desc_list.go
index aa294fff99..e3b6587da6 100644
--- a/vendor/google.golang.org/protobuf/internal/filedesc/desc_list.go
+++ b/vendor/google.golang.org/protobuf/internal/filedesc/desc_list.go
@@ -17,31 +17,30 @@ import (
 	"google.golang.org/protobuf/internal/errors"
 	"google.golang.org/protobuf/internal/pragma"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
 )
 
-type FileImports []pref.FileImport
+type FileImports []protoreflect.FileImport
 
 func (p *FileImports) Len() int                            { return len(*p) }
-func (p *FileImports) Get(i int) pref.FileImport           { return (*p)[i] }
+func (p *FileImports) Get(i int) protoreflect.FileImport   { return (*p)[i] }
 func (p *FileImports) Format(s fmt.State, r rune)          { descfmt.FormatList(s, r, p) }
 func (p *FileImports) ProtoInternal(pragma.DoNotImplement) {}
 
 type Names struct {
-	List []pref.Name
+	List []protoreflect.Name
 	once sync.Once
-	has  map[pref.Name]int // protected by once
+	has  map[protoreflect.Name]int // protected by once
 }
 
 func (p *Names) Len() int                            { return len(p.List) }
-func (p *Names) Get(i int) pref.Name                 { return p.List[i] }
-func (p *Names) Has(s pref.Name) bool                { return p.lazyInit().has[s] > 0 }
+func (p *Names) Get(i int) protoreflect.Name         { return p.List[i] }
+func (p *Names) Has(s protoreflect.Name) bool        { return p.lazyInit().has[s] > 0 }
 func (p *Names) Format(s fmt.State, r rune)          { descfmt.FormatList(s, r, p) }
 func (p *Names) ProtoInternal(pragma.DoNotImplement) {}
 func (p *Names) lazyInit() *Names {
 	p.once.Do(func() {
 		if len(p.List) > 0 {
-			p.has = make(map[pref.Name]int, len(p.List))
+			p.has = make(map[protoreflect.Name]int, len(p.List))
 			for _, s := range p.List {
 				p.has[s] = p.has[s] + 1
 			}
@@ -67,14 +66,14 @@ func (p *Names) CheckValid() error {
 }
 
 type EnumRanges struct {
-	List   [][2]pref.EnumNumber // start inclusive; end inclusive
+	List   [][2]protoreflect.EnumNumber // start inclusive; end inclusive
 	once   sync.Once
-	sorted [][2]pref.EnumNumber // protected by once
+	sorted [][2]protoreflect.EnumNumber // protected by once
 }
 
-func (p *EnumRanges) Len() int                     { return len(p.List) }
-func (p *EnumRanges) Get(i int) [2]pref.EnumNumber { return p.List[i] }
-func (p *EnumRanges) Has(n pref.EnumNumber) bool {
+func (p *EnumRanges) Len() int                             { return len(p.List) }
+func (p *EnumRanges) Get(i int) [2]protoreflect.EnumNumber { return p.List[i] }
+func (p *EnumRanges) Has(n protoreflect.EnumNumber) bool {
 	for ls := p.lazyInit().sorted; len(ls) > 0; {
 		i := len(ls) / 2
 		switch r := enumRange(ls[i]); {
@@ -129,14 +128,14 @@ func (r enumRange) String() string {
 }
 
 type FieldRanges struct {
-	List   [][2]pref.FieldNumber // start inclusive; end exclusive
+	List   [][2]protoreflect.FieldNumber // start inclusive; end exclusive
 	once   sync.Once
-	sorted [][2]pref.FieldNumber // protected by once
+	sorted [][2]protoreflect.FieldNumber // protected by once
 }
 
-func (p *FieldRanges) Len() int                      { return len(p.List) }
-func (p *FieldRanges) Get(i int) [2]pref.FieldNumber { return p.List[i] }
-func (p *FieldRanges) Has(n pref.FieldNumber) bool {
+func (p *FieldRanges) Len() int                              { return len(p.List) }
+func (p *FieldRanges) Get(i int) [2]protoreflect.FieldNumber { return p.List[i] }
+func (p *FieldRanges) Has(n protoreflect.FieldNumber) bool {
 	for ls := p.lazyInit().sorted; len(ls) > 0; {
 		i := len(ls) / 2
 		switch r := fieldRange(ls[i]); {
@@ -221,17 +220,17 @@ func (r fieldRange) String() string {
 }
 
 type FieldNumbers struct {
-	List []pref.FieldNumber
+	List []protoreflect.FieldNumber
 	once sync.Once
-	has  map[pref.FieldNumber]struct{} // protected by once
+	has  map[protoreflect.FieldNumber]struct{} // protected by once
 }
 
-func (p *FieldNumbers) Len() int                   { return len(p.List) }
-func (p *FieldNumbers) Get(i int) pref.FieldNumber { return p.List[i] }
-func (p *FieldNumbers) Has(n pref.FieldNumber) bool {
+func (p *FieldNumbers) Len() int                           { return len(p.List) }
+func (p *FieldNumbers) Get(i int) protoreflect.FieldNumber { return p.List[i] }
+func (p *FieldNumbers) Has(n protoreflect.FieldNumber) bool {
 	p.once.Do(func() {
 		if len(p.List) > 0 {
-			p.has = make(map[pref.FieldNumber]struct{}, len(p.List))
+			p.has = make(map[protoreflect.FieldNumber]struct{}, len(p.List))
 			for _, n := range p.List {
 				p.has[n] = struct{}{}
 			}
@@ -244,30 +243,38 @@ func (p *FieldNumbers) Format(s fmt.State, r rune)          { descfmt.FormatList
 func (p *FieldNumbers) ProtoInternal(pragma.DoNotImplement) {}
 
 type OneofFields struct {
-	List   []pref.FieldDescriptor
+	List   []protoreflect.FieldDescriptor
 	once   sync.Once
-	byName map[pref.Name]pref.FieldDescriptor        // protected by once
-	byJSON map[string]pref.FieldDescriptor           // protected by once
-	byText map[string]pref.FieldDescriptor           // protected by once
-	byNum  map[pref.FieldNumber]pref.FieldDescriptor // protected by once
+	byName map[protoreflect.Name]protoreflect.FieldDescriptor        // protected by once
+	byJSON map[string]protoreflect.FieldDescriptor                   // protected by once
+	byText map[string]protoreflect.FieldDescriptor                   // protected by once
+	byNum  map[protoreflect.FieldNumber]protoreflect.FieldDescriptor // protected by once
 }
 
-func (p *OneofFields) Len() int                                         { return len(p.List) }
-func (p *OneofFields) Get(i int) pref.FieldDescriptor                   { return p.List[i] }
-func (p *OneofFields) ByName(s pref.Name) pref.FieldDescriptor          { return p.lazyInit().byName[s] }
-func (p *OneofFields) ByJSONName(s string) pref.FieldDescriptor         { return p.lazyInit().byJSON[s] }
-func (p *OneofFields) ByTextName(s string) pref.FieldDescriptor         { return p.lazyInit().byText[s] }
-func (p *OneofFields) ByNumber(n pref.FieldNumber) pref.FieldDescriptor { return p.lazyInit().byNum[n] }
-func (p *OneofFields) Format(s fmt.State, r rune)                       { descfmt.FormatList(s, r, p) }
-func (p *OneofFields) ProtoInternal(pragma.DoNotImplement)              {}
+func (p *OneofFields) Len() int                               { return len(p.List) }
+func (p *OneofFields) Get(i int) protoreflect.FieldDescriptor { return p.List[i] }
+func (p *OneofFields) ByName(s protoreflect.Name) protoreflect.FieldDescriptor {
+	return p.lazyInit().byName[s]
+}
+func (p *OneofFields) ByJSONName(s string) protoreflect.FieldDescriptor {
+	return p.lazyInit().byJSON[s]
+}
+func (p *OneofFields) ByTextName(s string) protoreflect.FieldDescriptor {
+	return p.lazyInit().byText[s]
+}
+func (p *OneofFields) ByNumber(n protoreflect.FieldNumber) protoreflect.FieldDescriptor {
+	return p.lazyInit().byNum[n]
+}
+func (p *OneofFields) Format(s fmt.State, r rune)          { descfmt.FormatList(s, r, p) }
+func (p *OneofFields) ProtoInternal(pragma.DoNotImplement) {}
 
 func (p *OneofFields) lazyInit() *OneofFields {
 	p.once.Do(func() {
 		if len(p.List) > 0 {
-			p.byName = make(map[pref.Name]pref.FieldDescriptor, len(p.List))
-			p.byJSON = make(map[string]pref.FieldDescriptor, len(p.List))
-			p.byText = make(map[string]pref.FieldDescriptor, len(p.List))
-			p.byNum = make(map[pref.FieldNumber]pref.FieldDescriptor, len(p.List))
+			p.byName = make(map[protoreflect.Name]protoreflect.FieldDescriptor, len(p.List))
+			p.byJSON = make(map[string]protoreflect.FieldDescriptor, len(p.List))
+			p.byText = make(map[string]protoreflect.FieldDescriptor, len(p.List))
+			p.byNum = make(map[protoreflect.FieldNumber]protoreflect.FieldDescriptor, len(p.List))
 			for _, f := range p.List {
 				// Field names and numbers are guaranteed to be unique.
 				p.byName[f.Name()] = f
@@ -284,123 +291,123 @@ type SourceLocations struct {
 	// List is a list of SourceLocations.
 	// The SourceLocation.Next field does not need to be populated
 	// as it will be lazily populated upon first need.
-	List []pref.SourceLocation
+	List []protoreflect.SourceLocation
 
 	// File is the parent file descriptor that these locations are relative to.
 	// If non-nil, ByDescriptor verifies that the provided descriptor
 	// is a child of this file descriptor.
-	File pref.FileDescriptor
+	File protoreflect.FileDescriptor
 
 	once   sync.Once
 	byPath map[pathKey]int
 }
 
-func (p *SourceLocations) Len() int                      { return len(p.List) }
-func (p *SourceLocations) Get(i int) pref.SourceLocation { return p.lazyInit().List[i] }
-func (p *SourceLocations) byKey(k pathKey) pref.SourceLocation {
+func (p *SourceLocations) Len() int                              { return len(p.List) }
+func (p *SourceLocations) Get(i int) protoreflect.SourceLocation { return p.lazyInit().List[i] }
+func (p *SourceLocations) byKey(k pathKey) protoreflect.SourceLocation {
 	if i, ok := p.lazyInit().byPath[k]; ok {
 		return p.List[i]
 	}
-	return pref.SourceLocation{}
+	return protoreflect.SourceLocation{}
 }
-func (p *SourceLocations) ByPath(path pref.SourcePath) pref.SourceLocation {
+func (p *SourceLocations) ByPath(path protoreflect.SourcePath) protoreflect.SourceLocation {
 	return p.byKey(newPathKey(path))
 }
-func (p *SourceLocations) ByDescriptor(desc pref.Descriptor) pref.SourceLocation {
+func (p *SourceLocations) ByDescriptor(desc protoreflect.Descriptor) protoreflect.SourceLocation {
 	if p.File != nil && desc != nil && p.File != desc.ParentFile() {
-		return pref.SourceLocation{} // mismatching parent files
+		return protoreflect.SourceLocation{} // mismatching parent files
 	}
 	var pathArr [16]int32
 	path := pathArr[:0]
 	for {
 		switch desc.(type) {
-		case pref.FileDescriptor:
+		case protoreflect.FileDescriptor:
 			// Reverse the path since it was constructed in reverse.
 			for i, j := 0, len(path)-1; i < j; i, j = i+1, j-1 {
 				path[i], path[j] = path[j], path[i]
 			}
 			return p.byKey(newPathKey(path))
-		case pref.MessageDescriptor:
+		case protoreflect.MessageDescriptor:
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			switch desc.(type) {
-			case pref.FileDescriptor:
+			case protoreflect.FileDescriptor:
 				path = append(path, int32(genid.FileDescriptorProto_MessageType_field_number))
-			case pref.MessageDescriptor:
+			case protoreflect.MessageDescriptor:
 				path = append(path, int32(genid.DescriptorProto_NestedType_field_number))
 			default:
-				return pref.SourceLocation{}
+				return protoreflect.SourceLocation{}
 			}
-		case pref.FieldDescriptor:
-			isExtension := desc.(pref.FieldDescriptor).IsExtension()
+		case protoreflect.FieldDescriptor:
+			isExtension := desc.(protoreflect.FieldDescriptor).IsExtension()
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			if isExtension {
 				switch desc.(type) {
-				case pref.FileDescriptor:
+				case protoreflect.FileDescriptor:
 					path = append(path, int32(genid.FileDescriptorProto_Extension_field_number))
-				case pref.MessageDescriptor:
+				case protoreflect.MessageDescriptor:
 					path = append(path, int32(genid.DescriptorProto_Extension_field_number))
 				default:
-					return pref.SourceLocation{}
+					return protoreflect.SourceLocation{}
 				}
 			} else {
 				switch desc.(type) {
-				case pref.MessageDescriptor:
+				case protoreflect.MessageDescriptor:
 					path = append(path, int32(genid.DescriptorProto_Field_field_number))
 				default:
-					return pref.SourceLocation{}
+					return protoreflect.SourceLocation{}
 				}
 			}
-		case pref.OneofDescriptor:
+		case protoreflect.OneofDescriptor:
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			switch desc.(type) {
-			case pref.MessageDescriptor:
+			case protoreflect.MessageDescriptor:
 				path = append(path, int32(genid.DescriptorProto_OneofDecl_field_number))
 			default:
-				return pref.SourceLocation{}
+				return protoreflect.SourceLocation{}
 			}
-		case pref.EnumDescriptor:
+		case protoreflect.EnumDescriptor:
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			switch desc.(type) {
-			case pref.FileDescriptor:
+			case protoreflect.FileDescriptor:
 				path = append(path, int32(genid.FileDescriptorProto_EnumType_field_number))
-			case pref.MessageDescriptor:
+			case protoreflect.MessageDescriptor:
 				path = append(path, int32(genid.DescriptorProto_EnumType_field_number))
 			default:
-				return pref.SourceLocation{}
+				return protoreflect.SourceLocation{}
 			}
-		case pref.EnumValueDescriptor:
+		case protoreflect.EnumValueDescriptor:
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			switch desc.(type) {
-			case pref.EnumDescriptor:
+			case protoreflect.EnumDescriptor:
 				path = append(path, int32(genid.EnumDescriptorProto_Value_field_number))
 			default:
-				return pref.SourceLocation{}
+				return protoreflect.SourceLocation{}
 			}
-		case pref.ServiceDescriptor:
+		case protoreflect.ServiceDescriptor:
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			switch desc.(type) {
-			case pref.FileDescriptor:
+			case protoreflect.FileDescriptor:
 				path = append(path, int32(genid.FileDescriptorProto_Service_field_number))
 			default:
-				return pref.SourceLocation{}
+				return protoreflect.SourceLocation{}
 			}
-		case pref.MethodDescriptor:
+		case protoreflect.MethodDescriptor:
 			path = append(path, int32(desc.Index()))
 			desc = desc.Parent()
 			switch desc.(type) {
-			case pref.ServiceDescriptor:
+			case protoreflect.ServiceDescriptor:
 				path = append(path, int32(genid.ServiceDescriptorProto_Method_field_number))
 			default:
-				return pref.SourceLocation{}
+				return protoreflect.SourceLocation{}
 			}
 		default:
-			return pref.SourceLocation{}
+			return protoreflect.SourceLocation{}
 		}
 	}
 }
@@ -435,7 +442,7 @@ type pathKey struct {
 	str string    // used if the path does not fit in arr
 }
 
-func newPathKey(p pref.SourcePath) (k pathKey) {
+func newPathKey(p protoreflect.SourcePath) (k pathKey) {
 	if len(p) < len(k.arr) {
 		for i, ps := range p {
 			if ps < 0 || math.MaxUint8 <= ps {
diff --git a/vendor/google.golang.org/protobuf/internal/filedesc/placeholder.go b/vendor/google.golang.org/protobuf/internal/filedesc/placeholder.go
index dbf2c605bf..28240ebc5c 100644
--- a/vendor/google.golang.org/protobuf/internal/filedesc/placeholder.go
+++ b/vendor/google.golang.org/protobuf/internal/filedesc/placeholder.go
@@ -7,7 +7,7 @@ package filedesc
 import (
 	"google.golang.org/protobuf/internal/descopts"
 	"google.golang.org/protobuf/internal/pragma"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 var (
@@ -30,78 +30,80 @@ var (
 // PlaceholderFile is a placeholder, representing only the file path.
 type PlaceholderFile string
 
-func (f PlaceholderFile) ParentFile() pref.FileDescriptor       { return f }
-func (f PlaceholderFile) Parent() pref.Descriptor               { return nil }
-func (f PlaceholderFile) Index() int                            { return 0 }
-func (f PlaceholderFile) Syntax() pref.Syntax                   { return 0 }
-func (f PlaceholderFile) Name() pref.Name                       { return "" }
-func (f PlaceholderFile) FullName() pref.FullName               { return "" }
-func (f PlaceholderFile) IsPlaceholder() bool                   { return true }
-func (f PlaceholderFile) Options() pref.ProtoMessage            { return descopts.File }
-func (f PlaceholderFile) Path() string                          { return string(f) }
-func (f PlaceholderFile) Package() pref.FullName                { return "" }
-func (f PlaceholderFile) Imports() pref.FileImports             { return emptyFiles }
-func (f PlaceholderFile) Messages() pref.MessageDescriptors     { return emptyMessages }
-func (f PlaceholderFile) Enums() pref.EnumDescriptors           { return emptyEnums }
-func (f PlaceholderFile) Extensions() pref.ExtensionDescriptors { return emptyExtensions }
-func (f PlaceholderFile) Services() pref.ServiceDescriptors     { return emptyServices }
-func (f PlaceholderFile) SourceLocations() pref.SourceLocations { return emptySourceLocations }
-func (f PlaceholderFile) ProtoType(pref.FileDescriptor)         { return }
-func (f PlaceholderFile) ProtoInternal(pragma.DoNotImplement)   { return }
+func (f PlaceholderFile) ParentFile() protoreflect.FileDescriptor       { return f }
+func (f PlaceholderFile) Parent() protoreflect.Descriptor               { return nil }
+func (f PlaceholderFile) Index() int                                    { return 0 }
+func (f PlaceholderFile) Syntax() protoreflect.Syntax                   { return 0 }
+func (f PlaceholderFile) Name() protoreflect.Name                       { return "" }
+func (f PlaceholderFile) FullName() protoreflect.FullName               { return "" }
+func (f PlaceholderFile) IsPlaceholder() bool                           { return true }
+func (f PlaceholderFile) Options() protoreflect.ProtoMessage            { return descopts.File }
+func (f PlaceholderFile) Path() string                                  { return string(f) }
+func (f PlaceholderFile) Package() protoreflect.FullName                { return "" }
+func (f PlaceholderFile) Imports() protoreflect.FileImports             { return emptyFiles }
+func (f PlaceholderFile) Messages() protoreflect.MessageDescriptors     { return emptyMessages }
+func (f PlaceholderFile) Enums() protoreflect.EnumDescriptors           { return emptyEnums }
+func (f PlaceholderFile) Extensions() protoreflect.ExtensionDescriptors { return emptyExtensions }
+func (f PlaceholderFile) Services() protoreflect.ServiceDescriptors     { return emptyServices }
+func (f PlaceholderFile) SourceLocations() protoreflect.SourceLocations { return emptySourceLocations }
+func (f PlaceholderFile) ProtoType(protoreflect.FileDescriptor)         { return }
+func (f PlaceholderFile) ProtoInternal(pragma.DoNotImplement)           { return }
 
 // PlaceholderEnum is a placeholder, representing only the full name.
-type PlaceholderEnum pref.FullName
+type PlaceholderEnum protoreflect.FullName
 
-func (e PlaceholderEnum) ParentFile() pref.FileDescriptor     { return nil }
-func (e PlaceholderEnum) Parent() pref.Descriptor             { return nil }
-func (e PlaceholderEnum) Index() int                          { return 0 }
-func (e PlaceholderEnum) Syntax() pref.Syntax                 { return 0 }
-func (e PlaceholderEnum) Name() pref.Name                     { return pref.FullName(e).Name() }
-func (e PlaceholderEnum) FullName() pref.FullName             { return pref.FullName(e) }
-func (e PlaceholderEnum) IsPlaceholder() bool                 { return true }
-func (e PlaceholderEnum) Options() pref.ProtoMessage          { return descopts.Enum }
-func (e PlaceholderEnum) Values() pref.EnumValueDescriptors   { return emptyEnumValues }
-func (e PlaceholderEnum) ReservedNames() pref.Names           { return emptyNames }
-func (e PlaceholderEnum) ReservedRanges() pref.EnumRanges     { return emptyEnumRanges }
-func (e PlaceholderEnum) ProtoType(pref.EnumDescriptor)       { return }
-func (e PlaceholderEnum) ProtoInternal(pragma.DoNotImplement) { return }
+func (e PlaceholderEnum) ParentFile() protoreflect.FileDescriptor   { return nil }
+func (e PlaceholderEnum) Parent() protoreflect.Descriptor           { return nil }
+func (e PlaceholderEnum) Index() int                                { return 0 }
+func (e PlaceholderEnum) Syntax() protoreflect.Syntax               { return 0 }
+func (e PlaceholderEnum) Name() protoreflect.Name                   { return protoreflect.FullName(e).Name() }
+func (e PlaceholderEnum) FullName() protoreflect.FullName           { return protoreflect.FullName(e) }
+func (e PlaceholderEnum) IsPlaceholder() bool                       { return true }
+func (e PlaceholderEnum) Options() protoreflect.ProtoMessage        { return descopts.Enum }
+func (e PlaceholderEnum) Values() protoreflect.EnumValueDescriptors { return emptyEnumValues }
+func (e PlaceholderEnum) ReservedNames() protoreflect.Names         { return emptyNames }
+func (e PlaceholderEnum) ReservedRanges() protoreflect.EnumRanges   { return emptyEnumRanges }
+func (e PlaceholderEnum) ProtoType(protoreflect.EnumDescriptor)     { return }
+func (e PlaceholderEnum) ProtoInternal(pragma.DoNotImplement)       { return }
 
 // PlaceholderEnumValue is a placeholder, representing only the full name.
-type PlaceholderEnumValue pref.FullName
+type PlaceholderEnumValue protoreflect.FullName
 
-func (e PlaceholderEnumValue) ParentFile() pref.FileDescriptor     { return nil }
-func (e PlaceholderEnumValue) Parent() pref.Descriptor             { return nil }
-func (e PlaceholderEnumValue) Index() int                          { return 0 }
-func (e PlaceholderEnumValue) Syntax() pref.Syntax                 { return 0 }
-func (e PlaceholderEnumValue) Name() pref.Name                     { return pref.FullName(e).Name() }
-func (e PlaceholderEnumValue) FullName() pref.FullName             { return pref.FullName(e) }
-func (e PlaceholderEnumValue) IsPlaceholder() bool                 { return true }
-func (e PlaceholderEnumValue) Options() pref.ProtoMessage          { return descopts.EnumValue }
-func (e PlaceholderEnumValue) Number() pref.EnumNumber             { return 0 }
-func (e PlaceholderEnumValue) ProtoType(pref.EnumValueDescriptor)  { return }
-func (e PlaceholderEnumValue) ProtoInternal(pragma.DoNotImplement) { return }
+func (e PlaceholderEnumValue) ParentFile() protoreflect.FileDescriptor    { return nil }
+func (e PlaceholderEnumValue) Parent() protoreflect.Descriptor            { return nil }
+func (e PlaceholderEnumValue) Index() int                                 { return 0 }
+func (e PlaceholderEnumValue) Syntax() protoreflect.Syntax                { return 0 }
+func (e PlaceholderEnumValue) Name() protoreflect.Name                    { return protoreflect.FullName(e).Name() }
+func (e PlaceholderEnumValue) FullName() protoreflect.FullName            { return protoreflect.FullName(e) }
+func (e PlaceholderEnumValue) IsPlaceholder() bool                        { return true }
+func (e PlaceholderEnumValue) Options() protoreflect.ProtoMessage         { return descopts.EnumValue }
+func (e PlaceholderEnumValue) Number() protoreflect.EnumNumber            { return 0 }
+func (e PlaceholderEnumValue) ProtoType(protoreflect.EnumValueDescriptor) { return }
+func (e PlaceholderEnumValue) ProtoInternal(pragma.DoNotImplement)        { return }
 
 // PlaceholderMessage is a placeholder, representing only the full name.
-type PlaceholderMessage pref.FullName
+type PlaceholderMessage protoreflect.FullName
 
-func (m PlaceholderMessage) ParentFile() pref.FileDescriptor             { return nil }
-func (m PlaceholderMessage) Parent() pref.Descriptor                     { return nil }
-func (m PlaceholderMessage) Index() int                                  { return 0 }
-func (m PlaceholderMessage) Syntax() pref.Syntax                         { return 0 }
-func (m PlaceholderMessage) Name() pref.Name                             { return pref.FullName(m).Name() }
-func (m PlaceholderMessage) FullName() pref.FullName                     { return pref.FullName(m) }
-func (m PlaceholderMessage) IsPlaceholder() bool                         { return true }
-func (m PlaceholderMessage) Options() pref.ProtoMessage                  { return descopts.Message }
-func (m PlaceholderMessage) IsMapEntry() bool                            { return false }
-func (m PlaceholderMessage) Fields() pref.FieldDescriptors               { return emptyFields }
-func (m PlaceholderMessage) Oneofs() pref.OneofDescriptors               { return emptyOneofs }
-func (m PlaceholderMessage) ReservedNames() pref.Names                   { return emptyNames }
-func (m PlaceholderMessage) ReservedRanges() pref.FieldRanges            { return emptyFieldRanges }
-func (m PlaceholderMessage) RequiredNumbers() pref.FieldNumbers          { return emptyFieldNumbers }
-func (m PlaceholderMessage) ExtensionRanges() pref.FieldRanges           { return emptyFieldRanges }
-func (m PlaceholderMessage) ExtensionRangeOptions(int) pref.ProtoMessage { panic("index out of range") }
-func (m PlaceholderMessage) Messages() pref.MessageDescriptors           { return emptyMessages }
-func (m PlaceholderMessage) Enums() pref.EnumDescriptors                 { return emptyEnums }
-func (m PlaceholderMessage) Extensions() pref.ExtensionDescriptors       { return emptyExtensions }
-func (m PlaceholderMessage) ProtoType(pref.MessageDescriptor)            { return }
-func (m PlaceholderMessage) ProtoInternal(pragma.DoNotImplement)         { return }
+func (m PlaceholderMessage) ParentFile() protoreflect.FileDescriptor    { return nil }
+func (m PlaceholderMessage) Parent() protoreflect.Descriptor            { return nil }
+func (m PlaceholderMessage) Index() int                                 { return 0 }
+func (m PlaceholderMessage) Syntax() protoreflect.Syntax                { return 0 }
+func (m PlaceholderMessage) Name() protoreflect.Name                    { return protoreflect.FullName(m).Name() }
+func (m PlaceholderMessage) FullName() protoreflect.FullName            { return protoreflect.FullName(m) }
+func (m PlaceholderMessage) IsPlaceholder() bool                        { return true }
+func (m PlaceholderMessage) Options() protoreflect.ProtoMessage         { return descopts.Message }
+func (m PlaceholderMessage) IsMapEntry() bool                           { return false }
+func (m PlaceholderMessage) Fields() protoreflect.FieldDescriptors      { return emptyFields }
+func (m PlaceholderMessage) Oneofs() protoreflect.OneofDescriptors      { return emptyOneofs }
+func (m PlaceholderMessage) ReservedNames() protoreflect.Names          { return emptyNames }
+func (m PlaceholderMessage) ReservedRanges() protoreflect.FieldRanges   { return emptyFieldRanges }
+func (m PlaceholderMessage) RequiredNumbers() protoreflect.FieldNumbers { return emptyFieldNumbers }
+func (m PlaceholderMessage) ExtensionRanges() protoreflect.FieldRanges  { return emptyFieldRanges }
+func (m PlaceholderMessage) ExtensionRangeOptions(int) protoreflect.ProtoMessage {
+	panic("index out of range")
+}
+func (m PlaceholderMessage) Messages() protoreflect.MessageDescriptors     { return emptyMessages }
+func (m PlaceholderMessage) Enums() protoreflect.EnumDescriptors           { return emptyEnums }
+func (m PlaceholderMessage) Extensions() protoreflect.ExtensionDescriptors { return emptyExtensions }
+func (m PlaceholderMessage) ProtoType(protoreflect.MessageDescriptor)      { return }
+func (m PlaceholderMessage) ProtoInternal(pragma.DoNotImplement)           { return }
diff --git a/vendor/google.golang.org/protobuf/internal/filetype/build.go b/vendor/google.golang.org/protobuf/internal/filetype/build.go
index 0a0dd35de5..f0e38c4ef4 100644
--- a/vendor/google.golang.org/protobuf/internal/filetype/build.go
+++ b/vendor/google.golang.org/protobuf/internal/filetype/build.go
@@ -10,17 +10,16 @@ import (
 	"reflect"
 
 	"google.golang.org/protobuf/internal/descopts"
-	fdesc "google.golang.org/protobuf/internal/filedesc"
+	"google.golang.org/protobuf/internal/filedesc"
 	pimpl "google.golang.org/protobuf/internal/impl"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
 // Builder constructs type descriptors from a raw file descriptor
 // and associated Go types for each enum and message declaration.
 //
-//
-// Flattened Ordering
+// # Flattened Ordering
 //
 // The protobuf type system represents declarations as a tree. Certain nodes in
 // the tree require us to either associate it with a concrete Go type or to
@@ -52,7 +51,7 @@ import (
 // that children themselves may have.
 type Builder struct {
 	// File is the underlying file descriptor builder.
-	File fdesc.Builder
+	File filedesc.Builder
 
 	// GoTypes is a unique set of the Go types for all declarations and
 	// dependencies. Each type is represented as a zero value of the Go type.
@@ -108,22 +107,22 @@ type Builder struct {
 	// TypeRegistry is the registry to register each type descriptor.
 	// If nil, it uses protoregistry.GlobalTypes.
 	TypeRegistry interface {
-		RegisterMessage(pref.MessageType) error
-		RegisterEnum(pref.EnumType) error
-		RegisterExtension(pref.ExtensionType) error
+		RegisterMessage(protoreflect.MessageType) error
+		RegisterEnum(protoreflect.EnumType) error
+		RegisterExtension(protoreflect.ExtensionType) error
 	}
 }
 
 // Out is the output of the builder.
 type Out struct {
-	File pref.FileDescriptor
+	File protoreflect.FileDescriptor
 }
 
 func (tb Builder) Build() (out Out) {
 	// Replace the resolver with one that resolves dependencies by index,
 	// which is faster and more reliable than relying on the global registry.
 	if tb.File.FileRegistry == nil {
-		tb.File.FileRegistry = preg.GlobalFiles
+		tb.File.FileRegistry = protoregistry.GlobalFiles
 	}
 	tb.File.FileRegistry = &resolverByIndex{
 		goTypes:      tb.GoTypes,
@@ -133,7 +132,7 @@ func (tb Builder) Build() (out Out) {
 
 	// Initialize registry if unpopulated.
 	if tb.TypeRegistry == nil {
-		tb.TypeRegistry = preg.GlobalTypes
+		tb.TypeRegistry = protoregistry.GlobalTypes
 	}
 
 	fbOut := tb.File.Build()
@@ -183,23 +182,23 @@ func (tb Builder) Build() (out Out) {
 			for i := range fbOut.Messages {
 				switch fbOut.Messages[i].Name() {
 				case "FileOptions":
-					descopts.File = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.File = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "EnumOptions":
-					descopts.Enum = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.Enum = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "EnumValueOptions":
-					descopts.EnumValue = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.EnumValue = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "MessageOptions":
-					descopts.Message = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.Message = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "FieldOptions":
-					descopts.Field = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.Field = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "OneofOptions":
-					descopts.Oneof = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.Oneof = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "ExtensionRangeOptions":
-					descopts.ExtensionRange = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.ExtensionRange = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "ServiceOptions":
-					descopts.Service = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.Service = messageGoTypes[i].(protoreflect.ProtoMessage)
 				case "MethodOptions":
-					descopts.Method = messageGoTypes[i].(pref.ProtoMessage)
+					descopts.Method = messageGoTypes[i].(protoreflect.ProtoMessage)
 				}
 			}
 		}
@@ -216,11 +215,11 @@ func (tb Builder) Build() (out Out) {
 		const listExtDeps = 2
 		var goType reflect.Type
 		switch fbOut.Extensions[i].L1.Kind {
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			j := depIdxs.Get(tb.DependencyIndexes, listExtDeps, depIdx)
 			goType = reflect.TypeOf(tb.GoTypes[j])
 			depIdx++
-		case pref.MessageKind, pref.GroupKind:
+		case protoreflect.MessageKind, protoreflect.GroupKind:
 			j := depIdxs.Get(tb.DependencyIndexes, listExtDeps, depIdx)
 			goType = reflect.TypeOf(tb.GoTypes[j])
 			depIdx++
@@ -242,22 +241,22 @@ func (tb Builder) Build() (out Out) {
 	return out
 }
 
-var goTypeForPBKind = map[pref.Kind]reflect.Type{
-	pref.BoolKind:     reflect.TypeOf(bool(false)),
-	pref.Int32Kind:    reflect.TypeOf(int32(0)),
-	pref.Sint32Kind:   reflect.TypeOf(int32(0)),
-	pref.Sfixed32Kind: reflect.TypeOf(int32(0)),
-	pref.Int64Kind:    reflect.TypeOf(int64(0)),
-	pref.Sint64Kind:   reflect.TypeOf(int64(0)),
-	pref.Sfixed64Kind: reflect.TypeOf(int64(0)),
-	pref.Uint32Kind:   reflect.TypeOf(uint32(0)),
-	pref.Fixed32Kind:  reflect.TypeOf(uint32(0)),
-	pref.Uint64Kind:   reflect.TypeOf(uint64(0)),
-	pref.Fixed64Kind:  reflect.TypeOf(uint64(0)),
-	pref.FloatKind:    reflect.TypeOf(float32(0)),
-	pref.DoubleKind:   reflect.TypeOf(float64(0)),
-	pref.StringKind:   reflect.TypeOf(string("")),
-	pref.BytesKind:    reflect.TypeOf([]byte(nil)),
+var goTypeForPBKind = map[protoreflect.Kind]reflect.Type{
+	protoreflect.BoolKind:     reflect.TypeOf(bool(false)),
+	protoreflect.Int32Kind:    reflect.TypeOf(int32(0)),
+	protoreflect.Sint32Kind:   reflect.TypeOf(int32(0)),
+	protoreflect.Sfixed32Kind: reflect.TypeOf(int32(0)),
+	protoreflect.Int64Kind:    reflect.TypeOf(int64(0)),
+	protoreflect.Sint64Kind:   reflect.TypeOf(int64(0)),
+	protoreflect.Sfixed64Kind: reflect.TypeOf(int64(0)),
+	protoreflect.Uint32Kind:   reflect.TypeOf(uint32(0)),
+	protoreflect.Fixed32Kind:  reflect.TypeOf(uint32(0)),
+	protoreflect.Uint64Kind:   reflect.TypeOf(uint64(0)),
+	protoreflect.Fixed64Kind:  reflect.TypeOf(uint64(0)),
+	protoreflect.FloatKind:    reflect.TypeOf(float32(0)),
+	protoreflect.DoubleKind:   reflect.TypeOf(float64(0)),
+	protoreflect.StringKind:   reflect.TypeOf(string("")),
+	protoreflect.BytesKind:    reflect.TypeOf([]byte(nil)),
 }
 
 type depIdxs []int32
@@ -274,13 +273,13 @@ type (
 		fileRegistry
 	}
 	fileRegistry interface {
-		FindFileByPath(string) (pref.FileDescriptor, error)
-		FindDescriptorByName(pref.FullName) (pref.Descriptor, error)
-		RegisterFile(pref.FileDescriptor) error
+		FindFileByPath(string) (protoreflect.FileDescriptor, error)
+		FindDescriptorByName(protoreflect.FullName) (protoreflect.Descriptor, error)
+		RegisterFile(protoreflect.FileDescriptor) error
 	}
 )
 
-func (r *resolverByIndex) FindEnumByIndex(i, j int32, es []fdesc.Enum, ms []fdesc.Message) pref.EnumDescriptor {
+func (r *resolverByIndex) FindEnumByIndex(i, j int32, es []filedesc.Enum, ms []filedesc.Message) protoreflect.EnumDescriptor {
 	if depIdx := int(r.depIdxs.Get(i, j)); int(depIdx) < len(es)+len(ms) {
 		return &es[depIdx]
 	} else {
@@ -288,7 +287,7 @@ func (r *resolverByIndex) FindEnumByIndex(i, j int32, es []fdesc.Enum, ms []fdes
 	}
 }
 
-func (r *resolverByIndex) FindMessageByIndex(i, j int32, es []fdesc.Enum, ms []fdesc.Message) pref.MessageDescriptor {
+func (r *resolverByIndex) FindMessageByIndex(i, j int32, es []filedesc.Enum, ms []filedesc.Message) protoreflect.MessageDescriptor {
 	if depIdx := int(r.depIdxs.Get(i, j)); depIdx < len(es)+len(ms) {
 		return &ms[depIdx-len(es)]
 	} else {
diff --git a/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_disable.go b/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_disable.go
index a72995f02d..bda8e8cf3f 100644
--- a/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_disable.go
+++ b/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_disable.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !protolegacy
 // +build !protolegacy
 
 package flags
diff --git a/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_enable.go b/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_enable.go
index 772e2f0e4d..6d8d9bd6b0 100644
--- a/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_enable.go
+++ b/vendor/google.golang.org/protobuf/internal/flags/proto_legacy_enable.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build protolegacy
 // +build protolegacy
 
 package flags
diff --git a/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go b/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go
index e3cdf1c205..5c0e8f73f4 100644
--- a/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go
+++ b/vendor/google.golang.org/protobuf/internal/genid/descriptor_gen.go
@@ -50,6 +50,7 @@ const (
 	FileDescriptorProto_Options_field_name          protoreflect.Name = "options"
 	FileDescriptorProto_SourceCodeInfo_field_name   protoreflect.Name = "source_code_info"
 	FileDescriptorProto_Syntax_field_name           protoreflect.Name = "syntax"
+	FileDescriptorProto_Edition_field_name          protoreflect.Name = "edition"
 
 	FileDescriptorProto_Name_field_fullname             protoreflect.FullName = "google.protobuf.FileDescriptorProto.name"
 	FileDescriptorProto_Package_field_fullname          protoreflect.FullName = "google.protobuf.FileDescriptorProto.package"
@@ -63,6 +64,7 @@ const (
 	FileDescriptorProto_Options_field_fullname          protoreflect.FullName = "google.protobuf.FileDescriptorProto.options"
 	FileDescriptorProto_SourceCodeInfo_field_fullname   protoreflect.FullName = "google.protobuf.FileDescriptorProto.source_code_info"
 	FileDescriptorProto_Syntax_field_fullname           protoreflect.FullName = "google.protobuf.FileDescriptorProto.syntax"
+	FileDescriptorProto_Edition_field_fullname          protoreflect.FullName = "google.protobuf.FileDescriptorProto.edition"
 )
 
 // Field numbers for google.protobuf.FileDescriptorProto.
@@ -79,6 +81,7 @@ const (
 	FileDescriptorProto_Options_field_number          protoreflect.FieldNumber = 8
 	FileDescriptorProto_SourceCodeInfo_field_number   protoreflect.FieldNumber = 9
 	FileDescriptorProto_Syntax_field_number           protoreflect.FieldNumber = 12
+	FileDescriptorProto_Edition_field_number          protoreflect.FieldNumber = 13
 )
 
 // Names for google.protobuf.DescriptorProto.
@@ -494,26 +497,29 @@ const (
 
 // Field names for google.protobuf.MessageOptions.
 const (
-	MessageOptions_MessageSetWireFormat_field_name         protoreflect.Name = "message_set_wire_format"
-	MessageOptions_NoStandardDescriptorAccessor_field_name protoreflect.Name = "no_standard_descriptor_accessor"
-	MessageOptions_Deprecated_field_name                   protoreflect.Name = "deprecated"
-	MessageOptions_MapEntry_field_name                     protoreflect.Name = "map_entry"
-	MessageOptions_UninterpretedOption_field_name          protoreflect.Name = "uninterpreted_option"
+	MessageOptions_MessageSetWireFormat_field_name               protoreflect.Name = "message_set_wire_format"
+	MessageOptions_NoStandardDescriptorAccessor_field_name       protoreflect.Name = "no_standard_descriptor_accessor"
+	MessageOptions_Deprecated_field_name                         protoreflect.Name = "deprecated"
+	MessageOptions_MapEntry_field_name                           protoreflect.Name = "map_entry"
+	MessageOptions_DeprecatedLegacyJsonFieldConflicts_field_name protoreflect.Name = "deprecated_legacy_json_field_conflicts"
+	MessageOptions_UninterpretedOption_field_name                protoreflect.Name = "uninterpreted_option"
 
-	MessageOptions_MessageSetWireFormat_field_fullname         protoreflect.FullName = "google.protobuf.MessageOptions.message_set_wire_format"
-	MessageOptions_NoStandardDescriptorAccessor_field_fullname protoreflect.FullName = "google.protobuf.MessageOptions.no_standard_descriptor_accessor"
-	MessageOptions_Deprecated_field_fullname                   protoreflect.FullName = "google.protobuf.MessageOptions.deprecated"
-	MessageOptions_MapEntry_field_fullname                     protoreflect.FullName = "google.protobuf.MessageOptions.map_entry"
-	MessageOptions_UninterpretedOption_field_fullname          protoreflect.FullName = "google.protobuf.MessageOptions.uninterpreted_option"
+	MessageOptions_MessageSetWireFormat_field_fullname               protoreflect.FullName = "google.protobuf.MessageOptions.message_set_wire_format"
+	MessageOptions_NoStandardDescriptorAccessor_field_fullname       protoreflect.FullName = "google.protobuf.MessageOptions.no_standard_descriptor_accessor"
+	MessageOptions_Deprecated_field_fullname                         protoreflect.FullName = "google.protobuf.MessageOptions.deprecated"
+	MessageOptions_MapEntry_field_fullname                           protoreflect.FullName = "google.protobuf.MessageOptions.map_entry"
+	MessageOptions_DeprecatedLegacyJsonFieldConflicts_field_fullname protoreflect.FullName = "google.protobuf.MessageOptions.deprecated_legacy_json_field_conflicts"
+	MessageOptions_UninterpretedOption_field_fullname                protoreflect.FullName = "google.protobuf.MessageOptions.uninterpreted_option"
 )
 
 // Field numbers for google.protobuf.MessageOptions.
 const (
-	MessageOptions_MessageSetWireFormat_field_number         protoreflect.FieldNumber = 1
-	MessageOptions_NoStandardDescriptorAccessor_field_number protoreflect.FieldNumber = 2
-	MessageOptions_Deprecated_field_number                   protoreflect.FieldNumber = 3
-	MessageOptions_MapEntry_field_number                     protoreflect.FieldNumber = 7
-	MessageOptions_UninterpretedOption_field_number          protoreflect.FieldNumber = 999
+	MessageOptions_MessageSetWireFormat_field_number               protoreflect.FieldNumber = 1
+	MessageOptions_NoStandardDescriptorAccessor_field_number       protoreflect.FieldNumber = 2
+	MessageOptions_Deprecated_field_number                         protoreflect.FieldNumber = 3
+	MessageOptions_MapEntry_field_number                           protoreflect.FieldNumber = 7
+	MessageOptions_DeprecatedLegacyJsonFieldConflicts_field_number protoreflect.FieldNumber = 11
+	MessageOptions_UninterpretedOption_field_number                protoreflect.FieldNumber = 999
 )
 
 // Names for google.protobuf.FieldOptions.
@@ -528,16 +534,24 @@ const (
 	FieldOptions_Packed_field_name              protoreflect.Name = "packed"
 	FieldOptions_Jstype_field_name              protoreflect.Name = "jstype"
 	FieldOptions_Lazy_field_name                protoreflect.Name = "lazy"
+	FieldOptions_UnverifiedLazy_field_name      protoreflect.Name = "unverified_lazy"
 	FieldOptions_Deprecated_field_name          protoreflect.Name = "deprecated"
 	FieldOptions_Weak_field_name                protoreflect.Name = "weak"
+	FieldOptions_DebugRedact_field_name         protoreflect.Name = "debug_redact"
+	FieldOptions_Retention_field_name           protoreflect.Name = "retention"
+	FieldOptions_Target_field_name              protoreflect.Name = "target"
 	FieldOptions_UninterpretedOption_field_name protoreflect.Name = "uninterpreted_option"
 
 	FieldOptions_Ctype_field_fullname               protoreflect.FullName = "google.protobuf.FieldOptions.ctype"
 	FieldOptions_Packed_field_fullname              protoreflect.FullName = "google.protobuf.FieldOptions.packed"
 	FieldOptions_Jstype_field_fullname              protoreflect.FullName = "google.protobuf.FieldOptions.jstype"
 	FieldOptions_Lazy_field_fullname                protoreflect.FullName = "google.protobuf.FieldOptions.lazy"
+	FieldOptions_UnverifiedLazy_field_fullname      protoreflect.FullName = "google.protobuf.FieldOptions.unverified_lazy"
 	FieldOptions_Deprecated_field_fullname          protoreflect.FullName = "google.protobuf.FieldOptions.deprecated"
 	FieldOptions_Weak_field_fullname                protoreflect.FullName = "google.protobuf.FieldOptions.weak"
+	FieldOptions_DebugRedact_field_fullname         protoreflect.FullName = "google.protobuf.FieldOptions.debug_redact"
+	FieldOptions_Retention_field_fullname           protoreflect.FullName = "google.protobuf.FieldOptions.retention"
+	FieldOptions_Target_field_fullname              protoreflect.FullName = "google.protobuf.FieldOptions.target"
 	FieldOptions_UninterpretedOption_field_fullname protoreflect.FullName = "google.protobuf.FieldOptions.uninterpreted_option"
 )
 
@@ -547,8 +561,12 @@ const (
 	FieldOptions_Packed_field_number              protoreflect.FieldNumber = 2
 	FieldOptions_Jstype_field_number              protoreflect.FieldNumber = 6
 	FieldOptions_Lazy_field_number                protoreflect.FieldNumber = 5
+	FieldOptions_UnverifiedLazy_field_number      protoreflect.FieldNumber = 15
 	FieldOptions_Deprecated_field_number          protoreflect.FieldNumber = 3
 	FieldOptions_Weak_field_number                protoreflect.FieldNumber = 10
+	FieldOptions_DebugRedact_field_number         protoreflect.FieldNumber = 16
+	FieldOptions_Retention_field_number           protoreflect.FieldNumber = 17
+	FieldOptions_Target_field_number              protoreflect.FieldNumber = 18
 	FieldOptions_UninterpretedOption_field_number protoreflect.FieldNumber = 999
 )
 
@@ -564,6 +582,18 @@ const (
 	FieldOptions_JSType_enum_name     = "JSType"
 )
 
+// Full and short names for google.protobuf.FieldOptions.OptionRetention.
+const (
+	FieldOptions_OptionRetention_enum_fullname = "google.protobuf.FieldOptions.OptionRetention"
+	FieldOptions_OptionRetention_enum_name     = "OptionRetention"
+)
+
+// Full and short names for google.protobuf.FieldOptions.OptionTargetType.
+const (
+	FieldOptions_OptionTargetType_enum_fullname = "google.protobuf.FieldOptions.OptionTargetType"
+	FieldOptions_OptionTargetType_enum_name     = "OptionTargetType"
+)
+
 // Names for google.protobuf.OneofOptions.
 const (
 	OneofOptions_message_name     protoreflect.Name     = "OneofOptions"
@@ -590,20 +620,23 @@ const (
 
 // Field names for google.protobuf.EnumOptions.
 const (
-	EnumOptions_AllowAlias_field_name          protoreflect.Name = "allow_alias"
-	EnumOptions_Deprecated_field_name          protoreflect.Name = "deprecated"
-	EnumOptions_UninterpretedOption_field_name protoreflect.Name = "uninterpreted_option"
+	EnumOptions_AllowAlias_field_name                         protoreflect.Name = "allow_alias"
+	EnumOptions_Deprecated_field_name                         protoreflect.Name = "deprecated"
+	EnumOptions_DeprecatedLegacyJsonFieldConflicts_field_name protoreflect.Name = "deprecated_legacy_json_field_conflicts"
+	EnumOptions_UninterpretedOption_field_name                protoreflect.Name = "uninterpreted_option"
 
-	EnumOptions_AllowAlias_field_fullname          protoreflect.FullName = "google.protobuf.EnumOptions.allow_alias"
-	EnumOptions_Deprecated_field_fullname          protoreflect.FullName = "google.protobuf.EnumOptions.deprecated"
-	EnumOptions_UninterpretedOption_field_fullname protoreflect.FullName = "google.protobuf.EnumOptions.uninterpreted_option"
+	EnumOptions_AllowAlias_field_fullname                         protoreflect.FullName = "google.protobuf.EnumOptions.allow_alias"
+	EnumOptions_Deprecated_field_fullname                         protoreflect.FullName = "google.protobuf.EnumOptions.deprecated"
+	EnumOptions_DeprecatedLegacyJsonFieldConflicts_field_fullname protoreflect.FullName = "google.protobuf.EnumOptions.deprecated_legacy_json_field_conflicts"
+	EnumOptions_UninterpretedOption_field_fullname                protoreflect.FullName = "google.protobuf.EnumOptions.uninterpreted_option"
 )
 
 // Field numbers for google.protobuf.EnumOptions.
 const (
-	EnumOptions_AllowAlias_field_number          protoreflect.FieldNumber = 2
-	EnumOptions_Deprecated_field_number          protoreflect.FieldNumber = 3
-	EnumOptions_UninterpretedOption_field_number protoreflect.FieldNumber = 999
+	EnumOptions_AllowAlias_field_number                         protoreflect.FieldNumber = 2
+	EnumOptions_Deprecated_field_number                         protoreflect.FieldNumber = 3
+	EnumOptions_DeprecatedLegacyJsonFieldConflicts_field_number protoreflect.FieldNumber = 6
+	EnumOptions_UninterpretedOption_field_number                protoreflect.FieldNumber = 999
 )
 
 // Names for google.protobuf.EnumValueOptions.
@@ -813,11 +846,13 @@ const (
 	GeneratedCodeInfo_Annotation_SourceFile_field_name protoreflect.Name = "source_file"
 	GeneratedCodeInfo_Annotation_Begin_field_name      protoreflect.Name = "begin"
 	GeneratedCodeInfo_Annotation_End_field_name        protoreflect.Name = "end"
+	GeneratedCodeInfo_Annotation_Semantic_field_name   protoreflect.Name = "semantic"
 
 	GeneratedCodeInfo_Annotation_Path_field_fullname       protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.path"
 	GeneratedCodeInfo_Annotation_SourceFile_field_fullname protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.source_file"
 	GeneratedCodeInfo_Annotation_Begin_field_fullname      protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.begin"
 	GeneratedCodeInfo_Annotation_End_field_fullname        protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.end"
+	GeneratedCodeInfo_Annotation_Semantic_field_fullname   protoreflect.FullName = "google.protobuf.GeneratedCodeInfo.Annotation.semantic"
 )
 
 // Field numbers for google.protobuf.GeneratedCodeInfo.Annotation.
@@ -826,4 +861,11 @@ const (
 	GeneratedCodeInfo_Annotation_SourceFile_field_number protoreflect.FieldNumber = 2
 	GeneratedCodeInfo_Annotation_Begin_field_number      protoreflect.FieldNumber = 3
 	GeneratedCodeInfo_Annotation_End_field_number        protoreflect.FieldNumber = 4
+	GeneratedCodeInfo_Annotation_Semantic_field_number   protoreflect.FieldNumber = 5
+)
+
+// Full and short names for google.protobuf.GeneratedCodeInfo.Annotation.Semantic.
+const (
+	GeneratedCodeInfo_Annotation_Semantic_enum_fullname = "google.protobuf.GeneratedCodeInfo.Annotation.Semantic"
+	GeneratedCodeInfo_Annotation_Semantic_enum_name     = "Semantic"
 )
diff --git a/vendor/google.golang.org/protobuf/internal/impl/api_export.go b/vendor/google.golang.org/protobuf/internal/impl/api_export.go
index abee5f30e9..a371f98de1 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/api_export.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/api_export.go
@@ -12,8 +12,8 @@ import (
 	"google.golang.org/protobuf/encoding/prototext"
 	"google.golang.org/protobuf/internal/errors"
 	"google.golang.org/protobuf/proto"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 // Export is a zero-length named type that exists only to export a set of
@@ -32,11 +32,11 @@ type enum = interface{}
 
 // EnumOf returns the protoreflect.Enum interface over e.
 // It returns nil if e is nil.
-func (Export) EnumOf(e enum) pref.Enum {
+func (Export) EnumOf(e enum) protoreflect.Enum {
 	switch e := e.(type) {
 	case nil:
 		return nil
-	case pref.Enum:
+	case protoreflect.Enum:
 		return e
 	default:
 		return legacyWrapEnum(reflect.ValueOf(e))
@@ -45,11 +45,11 @@ func (Export) EnumOf(e enum) pref.Enum {
 
 // EnumDescriptorOf returns the protoreflect.EnumDescriptor for e.
 // It returns nil if e is nil.
-func (Export) EnumDescriptorOf(e enum) pref.EnumDescriptor {
+func (Export) EnumDescriptorOf(e enum) protoreflect.EnumDescriptor {
 	switch e := e.(type) {
 	case nil:
 		return nil
-	case pref.Enum:
+	case protoreflect.Enum:
 		return e.Descriptor()
 	default:
 		return LegacyLoadEnumDesc(reflect.TypeOf(e))
@@ -58,11 +58,11 @@ func (Export) EnumDescriptorOf(e enum) pref.EnumDescriptor {
 
 // EnumTypeOf returns the protoreflect.EnumType for e.
 // It returns nil if e is nil.
-func (Export) EnumTypeOf(e enum) pref.EnumType {
+func (Export) EnumTypeOf(e enum) protoreflect.EnumType {
 	switch e := e.(type) {
 	case nil:
 		return nil
-	case pref.Enum:
+	case protoreflect.Enum:
 		return e.Type()
 	default:
 		return legacyLoadEnumType(reflect.TypeOf(e))
@@ -71,7 +71,7 @@ func (Export) EnumTypeOf(e enum) pref.EnumType {
 
 // EnumStringOf returns the enum value as a string, either as the name if
 // the number is resolvable, or the number formatted as a string.
-func (Export) EnumStringOf(ed pref.EnumDescriptor, n pref.EnumNumber) string {
+func (Export) EnumStringOf(ed protoreflect.EnumDescriptor, n protoreflect.EnumNumber) string {
 	ev := ed.Values().ByNumber(n)
 	if ev != nil {
 		return string(ev.Name())
@@ -84,7 +84,7 @@ func (Export) EnumStringOf(ed pref.EnumDescriptor, n pref.EnumNumber) string {
 type message = interface{}
 
 // legacyMessageWrapper wraps a v2 message as a v1 message.
-type legacyMessageWrapper struct{ m pref.ProtoMessage }
+type legacyMessageWrapper struct{ m protoreflect.ProtoMessage }
 
 func (m legacyMessageWrapper) Reset()         { proto.Reset(m.m) }
 func (m legacyMessageWrapper) String() string { return Export{}.MessageStringOf(m.m) }
@@ -92,30 +92,30 @@ func (m legacyMessageWrapper) ProtoMessage()  {}
 
 // ProtoMessageV1Of converts either a v1 or v2 message to a v1 message.
 // It returns nil if m is nil.
-func (Export) ProtoMessageV1Of(m message) piface.MessageV1 {
+func (Export) ProtoMessageV1Of(m message) protoiface.MessageV1 {
 	switch mv := m.(type) {
 	case nil:
 		return nil
-	case piface.MessageV1:
+	case protoiface.MessageV1:
 		return mv
 	case unwrapper:
 		return Export{}.ProtoMessageV1Of(mv.protoUnwrap())
-	case pref.ProtoMessage:
+	case protoreflect.ProtoMessage:
 		return legacyMessageWrapper{mv}
 	default:
 		panic(fmt.Sprintf("message %T is neither a v1 or v2 Message", m))
 	}
 }
 
-func (Export) protoMessageV2Of(m message) pref.ProtoMessage {
+func (Export) protoMessageV2Of(m message) protoreflect.ProtoMessage {
 	switch mv := m.(type) {
 	case nil:
 		return nil
-	case pref.ProtoMessage:
+	case protoreflect.ProtoMessage:
 		return mv
 	case legacyMessageWrapper:
 		return mv.m
-	case piface.MessageV1:
+	case protoiface.MessageV1:
 		return nil
 	default:
 		panic(fmt.Sprintf("message %T is neither a v1 or v2 Message", m))
@@ -124,7 +124,7 @@ func (Export) protoMessageV2Of(m message) pref.ProtoMessage {
 
 // ProtoMessageV2Of converts either a v1 or v2 message to a v2 message.
 // It returns nil if m is nil.
-func (Export) ProtoMessageV2Of(m message) pref.ProtoMessage {
+func (Export) ProtoMessageV2Of(m message) protoreflect.ProtoMessage {
 	if m == nil {
 		return nil
 	}
@@ -136,7 +136,7 @@ func (Export) ProtoMessageV2Of(m message) pref.ProtoMessage {
 
 // MessageOf returns the protoreflect.Message interface over m.
 // It returns nil if m is nil.
-func (Export) MessageOf(m message) pref.Message {
+func (Export) MessageOf(m message) protoreflect.Message {
 	if m == nil {
 		return nil
 	}
@@ -148,7 +148,7 @@ func (Export) MessageOf(m message) pref.Message {
 
 // MessageDescriptorOf returns the protoreflect.MessageDescriptor for m.
 // It returns nil if m is nil.
-func (Export) MessageDescriptorOf(m message) pref.MessageDescriptor {
+func (Export) MessageDescriptorOf(m message) protoreflect.MessageDescriptor {
 	if m == nil {
 		return nil
 	}
@@ -160,7 +160,7 @@ func (Export) MessageDescriptorOf(m message) pref.MessageDescriptor {
 
 // MessageTypeOf returns the protoreflect.MessageType for m.
 // It returns nil if m is nil.
-func (Export) MessageTypeOf(m message) pref.MessageType {
+func (Export) MessageTypeOf(m message) protoreflect.MessageType {
 	if m == nil {
 		return nil
 	}
@@ -172,6 +172,6 @@ func (Export) MessageTypeOf(m message) pref.MessageType {
 
 // MessageStringOf returns the message value as a string,
 // which is the message serialized in the protobuf text format.
-func (Export) MessageStringOf(m pref.ProtoMessage) string {
+func (Export) MessageStringOf(m protoreflect.ProtoMessage) string {
 	return prototext.MarshalOptions{Multiline: false}.Format(m)
 }
diff --git a/vendor/google.golang.org/protobuf/internal/impl/checkinit.go b/vendor/google.golang.org/protobuf/internal/impl/checkinit.go
index b82341e575..bff041edc9 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/checkinit.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/checkinit.go
@@ -8,18 +8,18 @@ import (
 	"sync"
 
 	"google.golang.org/protobuf/internal/errors"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
-func (mi *MessageInfo) checkInitialized(in piface.CheckInitializedInput) (piface.CheckInitializedOutput, error) {
+func (mi *MessageInfo) checkInitialized(in protoiface.CheckInitializedInput) (protoiface.CheckInitializedOutput, error) {
 	var p pointer
 	if ms, ok := in.Message.(*messageState); ok {
 		p = ms.pointer()
 	} else {
 		p = in.Message.(*messageReflectWrapper).pointer()
 	}
-	return piface.CheckInitializedOutput{}, mi.checkInitializedPointer(p)
+	return protoiface.CheckInitializedOutput{}, mi.checkInitializedPointer(p)
 }
 
 func (mi *MessageInfo) checkInitializedPointer(p pointer) error {
@@ -90,7 +90,7 @@ var (
 // needsInitCheck reports whether a message needs to be checked for partial initialization.
 //
 // It returns true if the message transitively includes any required or extension fields.
-func needsInitCheck(md pref.MessageDescriptor) bool {
+func needsInitCheck(md protoreflect.MessageDescriptor) bool {
 	if v, ok := needsInitCheckMap.Load(md); ok {
 		if has, ok := v.(bool); ok {
 			return has
@@ -101,7 +101,7 @@ func needsInitCheck(md pref.MessageDescriptor) bool {
 	return needsInitCheckLocked(md)
 }
 
-func needsInitCheckLocked(md pref.MessageDescriptor) (has bool) {
+func needsInitCheckLocked(md protoreflect.MessageDescriptor) (has bool) {
 	if v, ok := needsInitCheckMap.Load(md); ok {
 		// If has is true, we've previously determined that this message
 		// needs init checks.
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_extension.go b/vendor/google.golang.org/protobuf/internal/impl/codec_extension.go
index 08d35170b6..e74cefdc50 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_extension.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_extension.go
@@ -10,7 +10,7 @@ import (
 
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/errors"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type extensionFieldInfo struct {
@@ -23,7 +23,7 @@ type extensionFieldInfo struct {
 
 var legacyExtensionFieldInfoCache sync.Map // map[protoreflect.ExtensionType]*extensionFieldInfo
 
-func getExtensionFieldInfo(xt pref.ExtensionType) *extensionFieldInfo {
+func getExtensionFieldInfo(xt protoreflect.ExtensionType) *extensionFieldInfo {
 	if xi, ok := xt.(*ExtensionInfo); ok {
 		xi.lazyInit()
 		return xi.info
@@ -32,7 +32,7 @@ func getExtensionFieldInfo(xt pref.ExtensionType) *extensionFieldInfo {
 }
 
 // legacyLoadExtensionFieldInfo dynamically loads a *ExtensionInfo for xt.
-func legacyLoadExtensionFieldInfo(xt pref.ExtensionType) *extensionFieldInfo {
+func legacyLoadExtensionFieldInfo(xt protoreflect.ExtensionType) *extensionFieldInfo {
 	if xi, ok := legacyExtensionFieldInfoCache.Load(xt); ok {
 		return xi.(*extensionFieldInfo)
 	}
@@ -43,7 +43,7 @@ func legacyLoadExtensionFieldInfo(xt pref.ExtensionType) *extensionFieldInfo {
 	return e
 }
 
-func makeExtensionFieldInfo(xd pref.ExtensionDescriptor) *extensionFieldInfo {
+func makeExtensionFieldInfo(xd protoreflect.ExtensionDescriptor) *extensionFieldInfo {
 	var wiretag uint64
 	if !xd.IsPacked() {
 		wiretag = protowire.EncodeTag(xd.Number(), wireTypes[xd.Kind()])
@@ -59,10 +59,10 @@ func makeExtensionFieldInfo(xd pref.ExtensionDescriptor) *extensionFieldInfo {
 	// This is true for composite types, where we pass in a message, list, or map to fill in,
 	// and for enums, where we pass in a prototype value to specify the concrete enum type.
 	switch xd.Kind() {
-	case pref.MessageKind, pref.GroupKind, pref.EnumKind:
+	case protoreflect.MessageKind, protoreflect.GroupKind, protoreflect.EnumKind:
 		e.unmarshalNeedsValue = true
 	default:
-		if xd.Cardinality() == pref.Repeated {
+		if xd.Cardinality() == protoreflect.Repeated {
 			e.unmarshalNeedsValue = true
 		}
 	}
@@ -73,21 +73,21 @@ type lazyExtensionValue struct {
 	atomicOnce uint32 // atomically set if value is valid
 	mu         sync.Mutex
 	xi         *extensionFieldInfo
-	value      pref.Value
+	value      protoreflect.Value
 	b          []byte
-	fn         func() pref.Value
+	fn         func() protoreflect.Value
 }
 
 type ExtensionField struct {
-	typ pref.ExtensionType
+	typ protoreflect.ExtensionType
 
 	// value is either the value of GetValue,
 	// or a *lazyExtensionValue that then returns the value of GetValue.
-	value pref.Value
+	value protoreflect.Value
 	lazy  *lazyExtensionValue
 }
 
-func (f *ExtensionField) appendLazyBytes(xt pref.ExtensionType, xi *extensionFieldInfo, num protowire.Number, wtyp protowire.Type, b []byte) {
+func (f *ExtensionField) appendLazyBytes(xt protoreflect.ExtensionType, xi *extensionFieldInfo, num protowire.Number, wtyp protowire.Type, b []byte) {
 	if f.lazy == nil {
 		f.lazy = &lazyExtensionValue{xi: xi}
 	}
@@ -97,7 +97,7 @@ func (f *ExtensionField) appendLazyBytes(xt pref.ExtensionType, xi *extensionFie
 	f.lazy.b = append(f.lazy.b, b...)
 }
 
-func (f *ExtensionField) canLazy(xt pref.ExtensionType) bool {
+func (f *ExtensionField) canLazy(xt protoreflect.ExtensionType) bool {
 	if f.typ == nil {
 		return true
 	}
@@ -154,7 +154,7 @@ func (f *ExtensionField) lazyInit() {
 
 // Set sets the type and value of the extension field.
 // This must not be called concurrently.
-func (f *ExtensionField) Set(t pref.ExtensionType, v pref.Value) {
+func (f *ExtensionField) Set(t protoreflect.ExtensionType, v protoreflect.Value) {
 	f.typ = t
 	f.value = v
 	f.lazy = nil
@@ -162,14 +162,14 @@ func (f *ExtensionField) Set(t pref.ExtensionType, v pref.Value) {
 
 // SetLazy sets the type and a value that is to be lazily evaluated upon first use.
 // This must not be called concurrently.
-func (f *ExtensionField) SetLazy(t pref.ExtensionType, fn func() pref.Value) {
+func (f *ExtensionField) SetLazy(t protoreflect.ExtensionType, fn func() protoreflect.Value) {
 	f.typ = t
 	f.lazy = &lazyExtensionValue{fn: fn}
 }
 
 // Value returns the value of the extension field.
 // This may be called concurrently.
-func (f *ExtensionField) Value() pref.Value {
+func (f *ExtensionField) Value() protoreflect.Value {
 	if f.lazy != nil {
 		if atomic.LoadUint32(&f.lazy.atomicOnce) == 0 {
 			f.lazyInit()
@@ -181,7 +181,7 @@ func (f *ExtensionField) Value() pref.Value {
 
 // Type returns the type of the extension field.
 // This may be called concurrently.
-func (f ExtensionField) Type() pref.ExtensionType {
+func (f ExtensionField) Type() protoreflect.ExtensionType {
 	return f.typ
 }
 
@@ -193,7 +193,7 @@ func (f ExtensionField) IsSet() bool {
 
 // IsLazy reports whether a field is lazily encoded.
 // It is exported for testing.
-func IsLazy(m pref.Message, fd pref.FieldDescriptor) bool {
+func IsLazy(m protoreflect.Message, fd protoreflect.FieldDescriptor) bool {
 	var mi *MessageInfo
 	var p pointer
 	switch m := m.(type) {
@@ -206,7 +206,7 @@ func IsLazy(m pref.Message, fd pref.FieldDescriptor) bool {
 	default:
 		return false
 	}
-	xd, ok := fd.(pref.ExtensionTypeDescriptor)
+	xd, ok := fd.(protoreflect.ExtensionTypeDescriptor)
 	if !ok {
 		return false
 	}
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_field.go b/vendor/google.golang.org/protobuf/internal/impl/codec_field.go
index cb4b482d16..3fadd241e1 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_field.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_field.go
@@ -12,9 +12,9 @@ import (
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/errors"
 	"google.golang.org/protobuf/proto"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 type errInvalidUTF8 struct{}
@@ -30,7 +30,7 @@ func (errInvalidUTF8) Unwrap() error     { return errors.Error }
 // to the appropriate field-specific function as necessary.
 //
 // The unmarshal function is set on each field individually as usual.
-func (mi *MessageInfo) initOneofFieldCoders(od pref.OneofDescriptor, si structInfo) {
+func (mi *MessageInfo) initOneofFieldCoders(od protoreflect.OneofDescriptor, si structInfo) {
 	fs := si.oneofsByName[od.Name()]
 	ft := fs.Type
 	oneofFields := make(map[reflect.Type]*coderFieldInfo)
@@ -118,13 +118,13 @@ func (mi *MessageInfo) initOneofFieldCoders(od pref.OneofDescriptor, si structIn
 	}
 }
 
-func makeWeakMessageFieldCoder(fd pref.FieldDescriptor) pointerCoderFuncs {
+func makeWeakMessageFieldCoder(fd protoreflect.FieldDescriptor) pointerCoderFuncs {
 	var once sync.Once
-	var messageType pref.MessageType
+	var messageType protoreflect.MessageType
 	lazyInit := func() {
 		once.Do(func() {
 			messageName := fd.Message().FullName()
-			messageType, _ = preg.GlobalTypes.FindMessageByName(messageName)
+			messageType, _ = protoregistry.GlobalTypes.FindMessageByName(messageName)
 		})
 	}
 
@@ -190,7 +190,7 @@ func makeWeakMessageFieldCoder(fd pref.FieldDescriptor) pointerCoderFuncs {
 	}
 }
 
-func makeMessageFieldCoder(fd pref.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
+func makeMessageFieldCoder(fd protoreflect.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
 	if mi := getMessageInfo(ft); mi != nil {
 		funcs := pointerCoderFuncs{
 			size:      sizeMessageInfo,
@@ -280,7 +280,7 @@ func consumeMessage(b []byte, m proto.Message, wtyp protowire.Type, opts unmarsh
 	if n < 0 {
 		return out, errDecode
 	}
-	o, err := opts.Options().UnmarshalState(piface.UnmarshalInput{
+	o, err := opts.Options().UnmarshalState(protoiface.UnmarshalInput{
 		Buf:     v,
 		Message: m.ProtoReflect(),
 	})
@@ -288,27 +288,27 @@ func consumeMessage(b []byte, m proto.Message, wtyp protowire.Type, opts unmarsh
 		return out, err
 	}
 	out.n = n
-	out.initialized = o.Flags&piface.UnmarshalInitialized != 0
+	out.initialized = o.Flags&protoiface.UnmarshalInitialized != 0
 	return out, nil
 }
 
-func sizeMessageValue(v pref.Value, tagsize int, opts marshalOptions) int {
+func sizeMessageValue(v protoreflect.Value, tagsize int, opts marshalOptions) int {
 	m := v.Message().Interface()
 	return sizeMessage(m, tagsize, opts)
 }
 
-func appendMessageValue(b []byte, v pref.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
+func appendMessageValue(b []byte, v protoreflect.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
 	m := v.Message().Interface()
 	return appendMessage(b, m, wiretag, opts)
 }
 
-func consumeMessageValue(b []byte, v pref.Value, _ protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (pref.Value, unmarshalOutput, error) {
+func consumeMessageValue(b []byte, v protoreflect.Value, _ protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (protoreflect.Value, unmarshalOutput, error) {
 	m := v.Message().Interface()
 	out, err := consumeMessage(b, m, wtyp, opts)
 	return v, out, err
 }
 
-func isInitMessageValue(v pref.Value) error {
+func isInitMessageValue(v protoreflect.Value) error {
 	m := v.Message().Interface()
 	return proto.CheckInitialized(m)
 }
@@ -321,17 +321,17 @@ var coderMessageValue = valueCoderFuncs{
 	merge:     mergeMessageValue,
 }
 
-func sizeGroupValue(v pref.Value, tagsize int, opts marshalOptions) int {
+func sizeGroupValue(v protoreflect.Value, tagsize int, opts marshalOptions) int {
 	m := v.Message().Interface()
 	return sizeGroup(m, tagsize, opts)
 }
 
-func appendGroupValue(b []byte, v pref.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
+func appendGroupValue(b []byte, v protoreflect.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
 	m := v.Message().Interface()
 	return appendGroup(b, m, wiretag, opts)
 }
 
-func consumeGroupValue(b []byte, v pref.Value, num protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (pref.Value, unmarshalOutput, error) {
+func consumeGroupValue(b []byte, v protoreflect.Value, num protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (protoreflect.Value, unmarshalOutput, error) {
 	m := v.Message().Interface()
 	out, err := consumeGroup(b, m, num, wtyp, opts)
 	return v, out, err
@@ -345,7 +345,7 @@ var coderGroupValue = valueCoderFuncs{
 	merge:     mergeMessageValue,
 }
 
-func makeGroupFieldCoder(fd pref.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
+func makeGroupFieldCoder(fd protoreflect.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
 	num := fd.Number()
 	if mi := getMessageInfo(ft); mi != nil {
 		funcs := pointerCoderFuncs{
@@ -424,7 +424,7 @@ func consumeGroup(b []byte, m proto.Message, num protowire.Number, wtyp protowir
 	if n < 0 {
 		return out, errDecode
 	}
-	o, err := opts.Options().UnmarshalState(piface.UnmarshalInput{
+	o, err := opts.Options().UnmarshalState(protoiface.UnmarshalInput{
 		Buf:     b,
 		Message: m.ProtoReflect(),
 	})
@@ -432,11 +432,11 @@ func consumeGroup(b []byte, m proto.Message, num protowire.Number, wtyp protowir
 		return out, err
 	}
 	out.n = n
-	out.initialized = o.Flags&piface.UnmarshalInitialized != 0
+	out.initialized = o.Flags&protoiface.UnmarshalInitialized != 0
 	return out, nil
 }
 
-func makeMessageSliceFieldCoder(fd pref.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
+func makeMessageSliceFieldCoder(fd protoreflect.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
 	if mi := getMessageInfo(ft); mi != nil {
 		funcs := pointerCoderFuncs{
 			size:      sizeMessageSliceInfo,
@@ -555,7 +555,7 @@ func consumeMessageSlice(b []byte, p pointer, goType reflect.Type, wtyp protowir
 		return out, errDecode
 	}
 	mp := reflect.New(goType.Elem())
-	o, err := opts.Options().UnmarshalState(piface.UnmarshalInput{
+	o, err := opts.Options().UnmarshalState(protoiface.UnmarshalInput{
 		Buf:     v,
 		Message: asMessage(mp).ProtoReflect(),
 	})
@@ -564,7 +564,7 @@ func consumeMessageSlice(b []byte, p pointer, goType reflect.Type, wtyp protowir
 	}
 	p.AppendPointerSlice(pointerOfValue(mp))
 	out.n = n
-	out.initialized = o.Flags&piface.UnmarshalInitialized != 0
+	out.initialized = o.Flags&protoiface.UnmarshalInitialized != 0
 	return out, nil
 }
 
@@ -581,7 +581,7 @@ func isInitMessageSlice(p pointer, goType reflect.Type) error {
 
 // Slices of messages
 
-func sizeMessageSliceValue(listv pref.Value, tagsize int, opts marshalOptions) int {
+func sizeMessageSliceValue(listv protoreflect.Value, tagsize int, opts marshalOptions) int {
 	list := listv.List()
 	n := 0
 	for i, llen := 0, list.Len(); i < llen; i++ {
@@ -591,7 +591,7 @@ func sizeMessageSliceValue(listv pref.Value, tagsize int, opts marshalOptions) i
 	return n
 }
 
-func appendMessageSliceValue(b []byte, listv pref.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
+func appendMessageSliceValue(b []byte, listv protoreflect.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
 	list := listv.List()
 	mopts := opts.Options()
 	for i, llen := 0, list.Len(); i < llen; i++ {
@@ -608,30 +608,30 @@ func appendMessageSliceValue(b []byte, listv pref.Value, wiretag uint64, opts ma
 	return b, nil
 }
 
-func consumeMessageSliceValue(b []byte, listv pref.Value, _ protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (_ pref.Value, out unmarshalOutput, err error) {
+func consumeMessageSliceValue(b []byte, listv protoreflect.Value, _ protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (_ protoreflect.Value, out unmarshalOutput, err error) {
 	list := listv.List()
 	if wtyp != protowire.BytesType {
-		return pref.Value{}, out, errUnknown
+		return protoreflect.Value{}, out, errUnknown
 	}
 	v, n := protowire.ConsumeBytes(b)
 	if n < 0 {
-		return pref.Value{}, out, errDecode
+		return protoreflect.Value{}, out, errDecode
 	}
 	m := list.NewElement()
-	o, err := opts.Options().UnmarshalState(piface.UnmarshalInput{
+	o, err := opts.Options().UnmarshalState(protoiface.UnmarshalInput{
 		Buf:     v,
 		Message: m.Message(),
 	})
 	if err != nil {
-		return pref.Value{}, out, err
+		return protoreflect.Value{}, out, err
 	}
 	list.Append(m)
 	out.n = n
-	out.initialized = o.Flags&piface.UnmarshalInitialized != 0
+	out.initialized = o.Flags&protoiface.UnmarshalInitialized != 0
 	return listv, out, nil
 }
 
-func isInitMessageSliceValue(listv pref.Value) error {
+func isInitMessageSliceValue(listv protoreflect.Value) error {
 	list := listv.List()
 	for i, llen := 0, list.Len(); i < llen; i++ {
 		m := list.Get(i).Message().Interface()
@@ -650,7 +650,7 @@ var coderMessageSliceValue = valueCoderFuncs{
 	merge:     mergeMessageListValue,
 }
 
-func sizeGroupSliceValue(listv pref.Value, tagsize int, opts marshalOptions) int {
+func sizeGroupSliceValue(listv protoreflect.Value, tagsize int, opts marshalOptions) int {
 	list := listv.List()
 	n := 0
 	for i, llen := 0, list.Len(); i < llen; i++ {
@@ -660,7 +660,7 @@ func sizeGroupSliceValue(listv pref.Value, tagsize int, opts marshalOptions) int
 	return n
 }
 
-func appendGroupSliceValue(b []byte, listv pref.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
+func appendGroupSliceValue(b []byte, listv protoreflect.Value, wiretag uint64, opts marshalOptions) ([]byte, error) {
 	list := listv.List()
 	mopts := opts.Options()
 	for i, llen := 0, list.Len(); i < llen; i++ {
@@ -676,26 +676,26 @@ func appendGroupSliceValue(b []byte, listv pref.Value, wiretag uint64, opts mars
 	return b, nil
 }
 
-func consumeGroupSliceValue(b []byte, listv pref.Value, num protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (_ pref.Value, out unmarshalOutput, err error) {
+func consumeGroupSliceValue(b []byte, listv protoreflect.Value, num protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (_ protoreflect.Value, out unmarshalOutput, err error) {
 	list := listv.List()
 	if wtyp != protowire.StartGroupType {
-		return pref.Value{}, out, errUnknown
+		return protoreflect.Value{}, out, errUnknown
 	}
 	b, n := protowire.ConsumeGroup(num, b)
 	if n < 0 {
-		return pref.Value{}, out, errDecode
+		return protoreflect.Value{}, out, errDecode
 	}
 	m := list.NewElement()
-	o, err := opts.Options().UnmarshalState(piface.UnmarshalInput{
+	o, err := opts.Options().UnmarshalState(protoiface.UnmarshalInput{
 		Buf:     b,
 		Message: m.Message(),
 	})
 	if err != nil {
-		return pref.Value{}, out, err
+		return protoreflect.Value{}, out, err
 	}
 	list.Append(m)
 	out.n = n
-	out.initialized = o.Flags&piface.UnmarshalInitialized != 0
+	out.initialized = o.Flags&protoiface.UnmarshalInitialized != 0
 	return listv, out, nil
 }
 
@@ -707,7 +707,7 @@ var coderGroupSliceValue = valueCoderFuncs{
 	merge:     mergeMessageListValue,
 }
 
-func makeGroupSliceFieldCoder(fd pref.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
+func makeGroupSliceFieldCoder(fd protoreflect.FieldDescriptor, ft reflect.Type) pointerCoderFuncs {
 	num := fd.Number()
 	if mi := getMessageInfo(ft); mi != nil {
 		funcs := pointerCoderFuncs{
@@ -772,7 +772,7 @@ func consumeGroupSlice(b []byte, p pointer, num protowire.Number, wtyp protowire
 		return out, errDecode
 	}
 	mp := reflect.New(goType.Elem())
-	o, err := opts.Options().UnmarshalState(piface.UnmarshalInput{
+	o, err := opts.Options().UnmarshalState(protoiface.UnmarshalInput{
 		Buf:     b,
 		Message: asMessage(mp).ProtoReflect(),
 	})
@@ -781,7 +781,7 @@ func consumeGroupSlice(b []byte, p pointer, num protowire.Number, wtyp protowire
 	}
 	p.AppendPointerSlice(pointerOfValue(mp))
 	out.n = n
-	out.initialized = o.Flags&piface.UnmarshalInitialized != 0
+	out.initialized = o.Flags&protoiface.UnmarshalInitialized != 0
 	return out, nil
 }
 
@@ -822,8 +822,8 @@ func consumeGroupSliceInfo(b []byte, p pointer, wtyp protowire.Type, f *coderFie
 	return out, nil
 }
 
-func asMessage(v reflect.Value) pref.ProtoMessage {
-	if m, ok := v.Interface().(pref.ProtoMessage); ok {
+func asMessage(v reflect.Value) protoreflect.ProtoMessage {
+	if m, ok := v.Interface().(protoreflect.ProtoMessage); ok {
 		return m
 	}
 	return legacyWrapMessage(v).Interface()
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_map.go b/vendor/google.golang.org/protobuf/internal/impl/codec_map.go
index c1245fef48..111b9d16f9 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_map.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_map.go
@@ -10,7 +10,7 @@ import (
 
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/genid"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type mapInfo struct {
@@ -19,12 +19,12 @@ type mapInfo struct {
 	valWiretag uint64
 	keyFuncs   valueCoderFuncs
 	valFuncs   valueCoderFuncs
-	keyZero    pref.Value
-	keyKind    pref.Kind
+	keyZero    protoreflect.Value
+	keyKind    protoreflect.Kind
 	conv       *mapConverter
 }
 
-func encoderFuncsForMap(fd pref.FieldDescriptor, ft reflect.Type) (valueMessage *MessageInfo, funcs pointerCoderFuncs) {
+func encoderFuncsForMap(fd protoreflect.FieldDescriptor, ft reflect.Type) (valueMessage *MessageInfo, funcs pointerCoderFuncs) {
 	// TODO: Consider generating specialized map coders.
 	keyField := fd.MapKey()
 	valField := fd.MapValue()
@@ -44,7 +44,7 @@ func encoderFuncsForMap(fd pref.FieldDescriptor, ft reflect.Type) (valueMessage
 		keyKind:    keyField.Kind(),
 		conv:       conv,
 	}
-	if valField.Kind() == pref.MessageKind {
+	if valField.Kind() == protoreflect.MessageKind {
 		valueMessage = getMessageInfo(ft.Elem())
 	}
 
@@ -68,9 +68,9 @@ func encoderFuncsForMap(fd pref.FieldDescriptor, ft reflect.Type) (valueMessage
 		},
 	}
 	switch valField.Kind() {
-	case pref.MessageKind:
+	case protoreflect.MessageKind:
 		funcs.merge = mergeMapOfMessage
-	case pref.BytesKind:
+	case protoreflect.BytesKind:
 		funcs.merge = mergeMapOfBytes
 	default:
 		funcs.merge = mergeMap
@@ -135,7 +135,7 @@ func consumeMap(b []byte, mapv reflect.Value, wtyp protowire.Type, mapi *mapInfo
 		err := errUnknown
 		switch num {
 		case genid.MapEntry_Key_field_number:
-			var v pref.Value
+			var v protoreflect.Value
 			var o unmarshalOutput
 			v, o, err = mapi.keyFuncs.unmarshal(b, key, num, wtyp, opts)
 			if err != nil {
@@ -144,7 +144,7 @@ func consumeMap(b []byte, mapv reflect.Value, wtyp protowire.Type, mapi *mapInfo
 			key = v
 			n = o.n
 		case genid.MapEntry_Value_field_number:
-			var v pref.Value
+			var v protoreflect.Value
 			var o unmarshalOutput
 			v, o, err = mapi.valFuncs.unmarshal(b, val, num, wtyp, opts)
 			if err != nil {
@@ -192,7 +192,7 @@ func consumeMapOfMessage(b []byte, mapv reflect.Value, wtyp protowire.Type, mapi
 		err := errUnknown
 		switch num {
 		case 1:
-			var v pref.Value
+			var v protoreflect.Value
 			var o unmarshalOutput
 			v, o, err = mapi.keyFuncs.unmarshal(b, key, num, wtyp, opts)
 			if err != nil {
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_map_go111.go b/vendor/google.golang.org/protobuf/internal/impl/codec_map_go111.go
index 2706bb67f5..4b15493f2f 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_map_go111.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_map_go111.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !go1.12
 // +build !go1.12
 
 package impl
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_map_go112.go b/vendor/google.golang.org/protobuf/internal/impl/codec_map_go112.go
index 1533ef600c..0b31b66eaf 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_map_go112.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_map_go112.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build go1.12
 // +build go1.12
 
 package impl
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_message.go b/vendor/google.golang.org/protobuf/internal/impl/codec_message.go
index cd40527ff6..6b2fdbb739 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_message.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_message.go
@@ -12,15 +12,15 @@ import (
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/encoding/messageset"
 	"google.golang.org/protobuf/internal/order"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 // coderMessageInfo contains per-message information used by the fast-path functions.
 // This is a different type from MessageInfo to keep MessageInfo as general-purpose as
 // possible.
 type coderMessageInfo struct {
-	methods piface.Methods
+	methods protoiface.Methods
 
 	orderedCoderFields []*coderFieldInfo
 	denseCoderFields   []*coderFieldInfo
@@ -38,13 +38,13 @@ type coderFieldInfo struct {
 	funcs      pointerCoderFuncs // fast-path per-field functions
 	mi         *MessageInfo      // field's message
 	ft         reflect.Type
-	validation validationInfo   // information used by message validation
-	num        pref.FieldNumber // field number
-	offset     offset           // struct field offset
-	wiretag    uint64           // field tag (number + wire type)
-	tagsize    int              // size of the varint-encoded tag
-	isPointer  bool             // true if IsNil may be called on the struct field
-	isRequired bool             // true if field is required
+	validation validationInfo           // information used by message validation
+	num        protoreflect.FieldNumber // field number
+	offset     offset                   // struct field offset
+	wiretag    uint64                   // field tag (number + wire type)
+	tagsize    int                      // size of the varint-encoded tag
+	isPointer  bool                     // true if IsNil may be called on the struct field
+	isRequired bool                     // true if field is required
 }
 
 func (mi *MessageInfo) makeCoderMethods(t reflect.Type, si structInfo) {
@@ -125,8 +125,8 @@ func (mi *MessageInfo) makeCoderMethods(t reflect.Type, si structInfo) {
 			funcs:      funcs,
 			mi:         childMessage,
 			validation: newFieldValidationInfo(mi, si, fd, ft),
-			isPointer:  fd.Cardinality() == pref.Repeated || fd.HasPresence(),
-			isRequired: fd.Cardinality() == pref.Required,
+			isPointer:  fd.Cardinality() == protoreflect.Repeated || fd.HasPresence(),
+			isRequired: fd.Cardinality() == protoreflect.Required,
 		}
 		mi.orderedCoderFields = append(mi.orderedCoderFields, cf)
 		mi.coderFields[cf.num] = cf
@@ -149,7 +149,7 @@ func (mi *MessageInfo) makeCoderMethods(t reflect.Type, si structInfo) {
 		return mi.orderedCoderFields[i].num < mi.orderedCoderFields[j].num
 	})
 
-	var maxDense pref.FieldNumber
+	var maxDense protoreflect.FieldNumber
 	for _, cf := range mi.orderedCoderFields {
 		if cf.num >= 16 && cf.num >= 2*maxDense {
 			break
@@ -175,12 +175,12 @@ func (mi *MessageInfo) makeCoderMethods(t reflect.Type, si structInfo) {
 
 	mi.needsInitCheck = needsInitCheck(mi.Desc)
 	if mi.methods.Marshal == nil && mi.methods.Size == nil {
-		mi.methods.Flags |= piface.SupportMarshalDeterministic
+		mi.methods.Flags |= protoiface.SupportMarshalDeterministic
 		mi.methods.Marshal = mi.marshal
 		mi.methods.Size = mi.size
 	}
 	if mi.methods.Unmarshal == nil {
-		mi.methods.Flags |= piface.SupportUnmarshalDiscardUnknown
+		mi.methods.Flags |= protoiface.SupportUnmarshalDiscardUnknown
 		mi.methods.Unmarshal = mi.unmarshal
 	}
 	if mi.methods.CheckInitialized == nil {
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_reflect.go b/vendor/google.golang.org/protobuf/internal/impl/codec_reflect.go
index 90705e3aea..145c577bd6 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_reflect.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_reflect.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build purego || appengine
 // +build purego appengine
 
 package impl
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_tables.go b/vendor/google.golang.org/protobuf/internal/impl/codec_tables.go
index e899712388..576dcf3aac 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_tables.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_tables.go
@@ -10,7 +10,7 @@ import (
 
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/internal/strs"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // pointerCoderFuncs is a set of pointer encoding functions.
@@ -25,83 +25,83 @@ type pointerCoderFuncs struct {
 
 // valueCoderFuncs is a set of protoreflect.Value encoding functions.
 type valueCoderFuncs struct {
-	size      func(v pref.Value, tagsize int, opts marshalOptions) int
-	marshal   func(b []byte, v pref.Value, wiretag uint64, opts marshalOptions) ([]byte, error)
-	unmarshal func(b []byte, v pref.Value, num protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (pref.Value, unmarshalOutput, error)
-	isInit    func(v pref.Value) error
-	merge     func(dst, src pref.Value, opts mergeOptions) pref.Value
+	size      func(v protoreflect.Value, tagsize int, opts marshalOptions) int
+	marshal   func(b []byte, v protoreflect.Value, wiretag uint64, opts marshalOptions) ([]byte, error)
+	unmarshal func(b []byte, v protoreflect.Value, num protowire.Number, wtyp protowire.Type, opts unmarshalOptions) (protoreflect.Value, unmarshalOutput, error)
+	isInit    func(v protoreflect.Value) error
+	merge     func(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value
 }
 
 // fieldCoder returns pointer functions for a field, used for operating on
 // struct fields.
-func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointerCoderFuncs) {
+func fieldCoder(fd protoreflect.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointerCoderFuncs) {
 	switch {
 	case fd.IsMap():
 		return encoderFuncsForMap(fd, ft)
-	case fd.Cardinality() == pref.Repeated && !fd.IsPacked():
+	case fd.Cardinality() == protoreflect.Repeated && !fd.IsPacked():
 		// Repeated fields (not packed).
 		if ft.Kind() != reflect.Slice {
 			break
 		}
 		ft := ft.Elem()
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			if ft.Kind() == reflect.Bool {
 				return nil, coderBoolSlice
 			}
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderEnumSlice
 			}
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderInt32Slice
 			}
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSint32Slice
 			}
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderUint32Slice
 			}
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderInt64Slice
 			}
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSint64Slice
 			}
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderUint64Slice
 			}
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSfixed32Slice
 			}
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderFixed32Slice
 			}
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			if ft.Kind() == reflect.Float32 {
 				return nil, coderFloatSlice
 			}
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSfixed64Slice
 			}
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderFixed64Slice
 			}
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			if ft.Kind() == reflect.Float64 {
 				return nil, coderDoubleSlice
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if ft.Kind() == reflect.String && strs.EnforceUTF8(fd) {
 				return nil, coderStringSliceValidateUTF8
 			}
@@ -114,19 +114,19 @@ func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointer
 			if ft.Kind() == reflect.Slice && ft.Elem().Kind() == reflect.Uint8 {
 				return nil, coderBytesSlice
 			}
-		case pref.BytesKind:
+		case protoreflect.BytesKind:
 			if ft.Kind() == reflect.String {
 				return nil, coderStringSlice
 			}
 			if ft.Kind() == reflect.Slice && ft.Elem().Kind() == reflect.Uint8 {
 				return nil, coderBytesSlice
 			}
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			return getMessageInfo(ft), makeMessageSliceFieldCoder(fd, ft)
-		case pref.GroupKind:
+		case protoreflect.GroupKind:
 			return getMessageInfo(ft), makeGroupSliceFieldCoder(fd, ft)
 		}
-	case fd.Cardinality() == pref.Repeated && fd.IsPacked():
+	case fd.Cardinality() == protoreflect.Repeated && fd.IsPacked():
 		// Packed repeated fields.
 		//
 		// Only repeated fields of primitive numeric types
@@ -136,128 +136,128 @@ func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointer
 		}
 		ft := ft.Elem()
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			if ft.Kind() == reflect.Bool {
 				return nil, coderBoolPackedSlice
 			}
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderEnumPackedSlice
 			}
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderInt32PackedSlice
 			}
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSint32PackedSlice
 			}
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderUint32PackedSlice
 			}
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderInt64PackedSlice
 			}
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSint64PackedSlice
 			}
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderUint64PackedSlice
 			}
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSfixed32PackedSlice
 			}
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderFixed32PackedSlice
 			}
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			if ft.Kind() == reflect.Float32 {
 				return nil, coderFloatPackedSlice
 			}
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSfixed64PackedSlice
 			}
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderFixed64PackedSlice
 			}
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			if ft.Kind() == reflect.Float64 {
 				return nil, coderDoublePackedSlice
 			}
 		}
-	case fd.Kind() == pref.MessageKind:
+	case fd.Kind() == protoreflect.MessageKind:
 		return getMessageInfo(ft), makeMessageFieldCoder(fd, ft)
-	case fd.Kind() == pref.GroupKind:
+	case fd.Kind() == protoreflect.GroupKind:
 		return getMessageInfo(ft), makeGroupFieldCoder(fd, ft)
-	case fd.Syntax() == pref.Proto3 && fd.ContainingOneof() == nil:
+	case fd.Syntax() == protoreflect.Proto3 && fd.ContainingOneof() == nil:
 		// Populated oneof fields always encode even if set to the zero value,
 		// which normally are not encoded in proto3.
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			if ft.Kind() == reflect.Bool {
 				return nil, coderBoolNoZero
 			}
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderEnumNoZero
 			}
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderInt32NoZero
 			}
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSint32NoZero
 			}
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderUint32NoZero
 			}
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderInt64NoZero
 			}
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSint64NoZero
 			}
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderUint64NoZero
 			}
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSfixed32NoZero
 			}
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderFixed32NoZero
 			}
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			if ft.Kind() == reflect.Float32 {
 				return nil, coderFloatNoZero
 			}
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSfixed64NoZero
 			}
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderFixed64NoZero
 			}
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			if ft.Kind() == reflect.Float64 {
 				return nil, coderDoubleNoZero
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if ft.Kind() == reflect.String && strs.EnforceUTF8(fd) {
 				return nil, coderStringNoZeroValidateUTF8
 			}
@@ -270,7 +270,7 @@ func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointer
 			if ft.Kind() == reflect.Slice && ft.Elem().Kind() == reflect.Uint8 {
 				return nil, coderBytesNoZero
 			}
-		case pref.BytesKind:
+		case protoreflect.BytesKind:
 			if ft.Kind() == reflect.String {
 				return nil, coderStringNoZero
 			}
@@ -281,133 +281,133 @@ func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointer
 	case ft.Kind() == reflect.Ptr:
 		ft := ft.Elem()
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			if ft.Kind() == reflect.Bool {
 				return nil, coderBoolPtr
 			}
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderEnumPtr
 			}
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderInt32Ptr
 			}
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSint32Ptr
 			}
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderUint32Ptr
 			}
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderInt64Ptr
 			}
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSint64Ptr
 			}
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderUint64Ptr
 			}
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSfixed32Ptr
 			}
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderFixed32Ptr
 			}
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			if ft.Kind() == reflect.Float32 {
 				return nil, coderFloatPtr
 			}
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSfixed64Ptr
 			}
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderFixed64Ptr
 			}
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			if ft.Kind() == reflect.Float64 {
 				return nil, coderDoublePtr
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if ft.Kind() == reflect.String && strs.EnforceUTF8(fd) {
 				return nil, coderStringPtrValidateUTF8
 			}
 			if ft.Kind() == reflect.String {
 				return nil, coderStringPtr
 			}
-		case pref.BytesKind:
+		case protoreflect.BytesKind:
 			if ft.Kind() == reflect.String {
 				return nil, coderStringPtr
 			}
 		}
 	default:
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			if ft.Kind() == reflect.Bool {
 				return nil, coderBool
 			}
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderEnum
 			}
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderInt32
 			}
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSint32
 			}
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderUint32
 			}
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderInt64
 			}
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSint64
 			}
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderUint64
 			}
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			if ft.Kind() == reflect.Int32 {
 				return nil, coderSfixed32
 			}
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			if ft.Kind() == reflect.Uint32 {
 				return nil, coderFixed32
 			}
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			if ft.Kind() == reflect.Float32 {
 				return nil, coderFloat
 			}
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			if ft.Kind() == reflect.Int64 {
 				return nil, coderSfixed64
 			}
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			if ft.Kind() == reflect.Uint64 {
 				return nil, coderFixed64
 			}
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			if ft.Kind() == reflect.Float64 {
 				return nil, coderDouble
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if ft.Kind() == reflect.String && strs.EnforceUTF8(fd) {
 				return nil, coderStringValidateUTF8
 			}
@@ -420,7 +420,7 @@ func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointer
 			if ft.Kind() == reflect.Slice && ft.Elem().Kind() == reflect.Uint8 {
 				return nil, coderBytes
 			}
-		case pref.BytesKind:
+		case protoreflect.BytesKind:
 			if ft.Kind() == reflect.String {
 				return nil, coderString
 			}
@@ -434,122 +434,122 @@ func fieldCoder(fd pref.FieldDescriptor, ft reflect.Type) (*MessageInfo, pointer
 
 // encoderFuncsForValue returns value functions for a field, used for
 // extension values and map encoding.
-func encoderFuncsForValue(fd pref.FieldDescriptor) valueCoderFuncs {
+func encoderFuncsForValue(fd protoreflect.FieldDescriptor) valueCoderFuncs {
 	switch {
-	case fd.Cardinality() == pref.Repeated && !fd.IsPacked():
+	case fd.Cardinality() == protoreflect.Repeated && !fd.IsPacked():
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			return coderBoolSliceValue
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			return coderEnumSliceValue
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			return coderInt32SliceValue
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			return coderSint32SliceValue
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			return coderUint32SliceValue
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			return coderInt64SliceValue
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			return coderSint64SliceValue
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			return coderUint64SliceValue
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			return coderSfixed32SliceValue
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			return coderFixed32SliceValue
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			return coderFloatSliceValue
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			return coderSfixed64SliceValue
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			return coderFixed64SliceValue
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			return coderDoubleSliceValue
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			// We don't have a UTF-8 validating coder for repeated string fields.
 			// Value coders are used for extensions and maps.
 			// Extensions are never proto3, and maps never contain lists.
 			return coderStringSliceValue
-		case pref.BytesKind:
+		case protoreflect.BytesKind:
 			return coderBytesSliceValue
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			return coderMessageSliceValue
-		case pref.GroupKind:
+		case protoreflect.GroupKind:
 			return coderGroupSliceValue
 		}
-	case fd.Cardinality() == pref.Repeated && fd.IsPacked():
+	case fd.Cardinality() == protoreflect.Repeated && fd.IsPacked():
 		switch fd.Kind() {
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			return coderBoolPackedSliceValue
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			return coderEnumPackedSliceValue
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			return coderInt32PackedSliceValue
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			return coderSint32PackedSliceValue
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			return coderUint32PackedSliceValue
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			return coderInt64PackedSliceValue
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			return coderSint64PackedSliceValue
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			return coderUint64PackedSliceValue
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			return coderSfixed32PackedSliceValue
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			return coderFixed32PackedSliceValue
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			return coderFloatPackedSliceValue
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			return coderSfixed64PackedSliceValue
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			return coderFixed64PackedSliceValue
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			return coderDoublePackedSliceValue
 		}
 	default:
 		switch fd.Kind() {
 		default:
-		case pref.BoolKind:
+		case protoreflect.BoolKind:
 			return coderBoolValue
-		case pref.EnumKind:
+		case protoreflect.EnumKind:
 			return coderEnumValue
-		case pref.Int32Kind:
+		case protoreflect.Int32Kind:
 			return coderInt32Value
-		case pref.Sint32Kind:
+		case protoreflect.Sint32Kind:
 			return coderSint32Value
-		case pref.Uint32Kind:
+		case protoreflect.Uint32Kind:
 			return coderUint32Value
-		case pref.Int64Kind:
+		case protoreflect.Int64Kind:
 			return coderInt64Value
-		case pref.Sint64Kind:
+		case protoreflect.Sint64Kind:
 			return coderSint64Value
-		case pref.Uint64Kind:
+		case protoreflect.Uint64Kind:
 			return coderUint64Value
-		case pref.Sfixed32Kind:
+		case protoreflect.Sfixed32Kind:
 			return coderSfixed32Value
-		case pref.Fixed32Kind:
+		case protoreflect.Fixed32Kind:
 			return coderFixed32Value
-		case pref.FloatKind:
+		case protoreflect.FloatKind:
 			return coderFloatValue
-		case pref.Sfixed64Kind:
+		case protoreflect.Sfixed64Kind:
 			return coderSfixed64Value
-		case pref.Fixed64Kind:
+		case protoreflect.Fixed64Kind:
 			return coderFixed64Value
-		case pref.DoubleKind:
+		case protoreflect.DoubleKind:
 			return coderDoubleValue
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if strs.EnforceUTF8(fd) {
 				return coderStringValueValidateUTF8
 			}
 			return coderStringValue
-		case pref.BytesKind:
+		case protoreflect.BytesKind:
 			return coderBytesValue
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			return coderMessageValue
-		case pref.GroupKind:
+		case protoreflect.GroupKind:
 			return coderGroupValue
 		}
 	}
diff --git a/vendor/google.golang.org/protobuf/internal/impl/codec_unsafe.go b/vendor/google.golang.org/protobuf/internal/impl/codec_unsafe.go
index e118af1e20..757642e23c 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/codec_unsafe.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/codec_unsafe.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego && !appengine
 // +build !purego,!appengine
 
 package impl
diff --git a/vendor/google.golang.org/protobuf/internal/impl/convert.go b/vendor/google.golang.org/protobuf/internal/impl/convert.go
index acd61bb50b..185ef2efa5 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/convert.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/convert.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"reflect"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // unwrapper unwraps the value to the underlying value.
@@ -20,13 +20,13 @@ type unwrapper interface {
 // A Converter coverts to/from Go reflect.Value types and protobuf protoreflect.Value types.
 type Converter interface {
 	// PBValueOf converts a reflect.Value to a protoreflect.Value.
-	PBValueOf(reflect.Value) pref.Value
+	PBValueOf(reflect.Value) protoreflect.Value
 
 	// GoValueOf converts a protoreflect.Value to a reflect.Value.
-	GoValueOf(pref.Value) reflect.Value
+	GoValueOf(protoreflect.Value) reflect.Value
 
 	// IsValidPB returns whether a protoreflect.Value is compatible with this type.
-	IsValidPB(pref.Value) bool
+	IsValidPB(protoreflect.Value) bool
 
 	// IsValidGo returns whether a reflect.Value is compatible with this type.
 	IsValidGo(reflect.Value) bool
@@ -34,12 +34,12 @@ type Converter interface {
 	// New returns a new field value.
 	// For scalars, it returns the default value of the field.
 	// For composite types, it returns a new mutable value.
-	New() pref.Value
+	New() protoreflect.Value
 
 	// Zero returns a new field value.
 	// For scalars, it returns the default value of the field.
 	// For composite types, it returns an immutable, empty value.
-	Zero() pref.Value
+	Zero() protoreflect.Value
 }
 
 // NewConverter matches a Go type with a protobuf field and returns a Converter
@@ -50,7 +50,7 @@ type Converter interface {
 // This matcher deliberately supports a wider range of Go types than what
 // protoc-gen-go historically generated to be able to automatically wrap some
 // v1 messages generated by other forks of protoc-gen-go.
-func NewConverter(t reflect.Type, fd pref.FieldDescriptor) Converter {
+func NewConverter(t reflect.Type, fd protoreflect.FieldDescriptor) Converter {
 	switch {
 	case fd.IsList():
 		return newListConverter(t, fd)
@@ -59,7 +59,6 @@ func NewConverter(t reflect.Type, fd pref.FieldDescriptor) Converter {
 	default:
 		return newSingularConverter(t, fd)
 	}
-	panic(fmt.Sprintf("invalid Go type %v for field %v", t, fd.FullName()))
 }
 
 var (
@@ -76,68 +75,68 @@ var (
 )
 
 var (
-	boolZero    = pref.ValueOfBool(false)
-	int32Zero   = pref.ValueOfInt32(0)
-	int64Zero   = pref.ValueOfInt64(0)
-	uint32Zero  = pref.ValueOfUint32(0)
-	uint64Zero  = pref.ValueOfUint64(0)
-	float32Zero = pref.ValueOfFloat32(0)
-	float64Zero = pref.ValueOfFloat64(0)
-	stringZero  = pref.ValueOfString("")
-	bytesZero   = pref.ValueOfBytes(nil)
+	boolZero    = protoreflect.ValueOfBool(false)
+	int32Zero   = protoreflect.ValueOfInt32(0)
+	int64Zero   = protoreflect.ValueOfInt64(0)
+	uint32Zero  = protoreflect.ValueOfUint32(0)
+	uint64Zero  = protoreflect.ValueOfUint64(0)
+	float32Zero = protoreflect.ValueOfFloat32(0)
+	float64Zero = protoreflect.ValueOfFloat64(0)
+	stringZero  = protoreflect.ValueOfString("")
+	bytesZero   = protoreflect.ValueOfBytes(nil)
 )
 
-func newSingularConverter(t reflect.Type, fd pref.FieldDescriptor) Converter {
-	defVal := func(fd pref.FieldDescriptor, zero pref.Value) pref.Value {
-		if fd.Cardinality() == pref.Repeated {
+func newSingularConverter(t reflect.Type, fd protoreflect.FieldDescriptor) Converter {
+	defVal := func(fd protoreflect.FieldDescriptor, zero protoreflect.Value) protoreflect.Value {
+		if fd.Cardinality() == protoreflect.Repeated {
 			// Default isn't defined for repeated fields.
 			return zero
 		}
 		return fd.Default()
 	}
 	switch fd.Kind() {
-	case pref.BoolKind:
+	case protoreflect.BoolKind:
 		if t.Kind() == reflect.Bool {
 			return &boolConverter{t, defVal(fd, boolZero)}
 		}
-	case pref.Int32Kind, pref.Sint32Kind, pref.Sfixed32Kind:
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
 		if t.Kind() == reflect.Int32 {
 			return &int32Converter{t, defVal(fd, int32Zero)}
 		}
-	case pref.Int64Kind, pref.Sint64Kind, pref.Sfixed64Kind:
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
 		if t.Kind() == reflect.Int64 {
 			return &int64Converter{t, defVal(fd, int64Zero)}
 		}
-	case pref.Uint32Kind, pref.Fixed32Kind:
+	case protoreflect.Uint32Kind, protoreflect.Fixed32Kind:
 		if t.Kind() == reflect.Uint32 {
 			return &uint32Converter{t, defVal(fd, uint32Zero)}
 		}
-	case pref.Uint64Kind, pref.Fixed64Kind:
+	case protoreflect.Uint64Kind, protoreflect.Fixed64Kind:
 		if t.Kind() == reflect.Uint64 {
 			return &uint64Converter{t, defVal(fd, uint64Zero)}
 		}
-	case pref.FloatKind:
+	case protoreflect.FloatKind:
 		if t.Kind() == reflect.Float32 {
 			return &float32Converter{t, defVal(fd, float32Zero)}
 		}
-	case pref.DoubleKind:
+	case protoreflect.DoubleKind:
 		if t.Kind() == reflect.Float64 {
 			return &float64Converter{t, defVal(fd, float64Zero)}
 		}
-	case pref.StringKind:
+	case protoreflect.StringKind:
 		if t.Kind() == reflect.String || (t.Kind() == reflect.Slice && t.Elem() == byteType) {
 			return &stringConverter{t, defVal(fd, stringZero)}
 		}
-	case pref.BytesKind:
+	case protoreflect.BytesKind:
 		if t.Kind() == reflect.String || (t.Kind() == reflect.Slice && t.Elem() == byteType) {
 			return &bytesConverter{t, defVal(fd, bytesZero)}
 		}
-	case pref.EnumKind:
+	case protoreflect.EnumKind:
 		// Handle enums, which must be a named int32 type.
 		if t.Kind() == reflect.Int32 {
 			return newEnumConverter(t, fd)
 		}
-	case pref.MessageKind, pref.GroupKind:
+	case protoreflect.MessageKind, protoreflect.GroupKind:
 		return newMessageConverter(t)
 	}
 	panic(fmt.Sprintf("invalid Go type %v for field %v", t, fd.FullName()))
@@ -145,184 +144,184 @@ func newSingularConverter(t reflect.Type, fd pref.FieldDescriptor) Converter {
 
 type boolConverter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *boolConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *boolConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfBool(v.Bool())
+	return protoreflect.ValueOfBool(v.Bool())
 }
-func (c *boolConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *boolConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(v.Bool()).Convert(c.goType)
 }
-func (c *boolConverter) IsValidPB(v pref.Value) bool {
+func (c *boolConverter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(bool)
 	return ok
 }
 func (c *boolConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *boolConverter) New() pref.Value  { return c.def }
-func (c *boolConverter) Zero() pref.Value { return c.def }
+func (c *boolConverter) New() protoreflect.Value  { return c.def }
+func (c *boolConverter) Zero() protoreflect.Value { return c.def }
 
 type int32Converter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *int32Converter) PBValueOf(v reflect.Value) pref.Value {
+func (c *int32Converter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfInt32(int32(v.Int()))
+	return protoreflect.ValueOfInt32(int32(v.Int()))
 }
-func (c *int32Converter) GoValueOf(v pref.Value) reflect.Value {
+func (c *int32Converter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(int32(v.Int())).Convert(c.goType)
 }
-func (c *int32Converter) IsValidPB(v pref.Value) bool {
+func (c *int32Converter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(int32)
 	return ok
 }
 func (c *int32Converter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *int32Converter) New() pref.Value  { return c.def }
-func (c *int32Converter) Zero() pref.Value { return c.def }
+func (c *int32Converter) New() protoreflect.Value  { return c.def }
+func (c *int32Converter) Zero() protoreflect.Value { return c.def }
 
 type int64Converter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *int64Converter) PBValueOf(v reflect.Value) pref.Value {
+func (c *int64Converter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfInt64(int64(v.Int()))
+	return protoreflect.ValueOfInt64(int64(v.Int()))
 }
-func (c *int64Converter) GoValueOf(v pref.Value) reflect.Value {
+func (c *int64Converter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(int64(v.Int())).Convert(c.goType)
 }
-func (c *int64Converter) IsValidPB(v pref.Value) bool {
+func (c *int64Converter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(int64)
 	return ok
 }
 func (c *int64Converter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *int64Converter) New() pref.Value  { return c.def }
-func (c *int64Converter) Zero() pref.Value { return c.def }
+func (c *int64Converter) New() protoreflect.Value  { return c.def }
+func (c *int64Converter) Zero() protoreflect.Value { return c.def }
 
 type uint32Converter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *uint32Converter) PBValueOf(v reflect.Value) pref.Value {
+func (c *uint32Converter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfUint32(uint32(v.Uint()))
+	return protoreflect.ValueOfUint32(uint32(v.Uint()))
 }
-func (c *uint32Converter) GoValueOf(v pref.Value) reflect.Value {
+func (c *uint32Converter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(uint32(v.Uint())).Convert(c.goType)
 }
-func (c *uint32Converter) IsValidPB(v pref.Value) bool {
+func (c *uint32Converter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(uint32)
 	return ok
 }
 func (c *uint32Converter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *uint32Converter) New() pref.Value  { return c.def }
-func (c *uint32Converter) Zero() pref.Value { return c.def }
+func (c *uint32Converter) New() protoreflect.Value  { return c.def }
+func (c *uint32Converter) Zero() protoreflect.Value { return c.def }
 
 type uint64Converter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *uint64Converter) PBValueOf(v reflect.Value) pref.Value {
+func (c *uint64Converter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfUint64(uint64(v.Uint()))
+	return protoreflect.ValueOfUint64(uint64(v.Uint()))
 }
-func (c *uint64Converter) GoValueOf(v pref.Value) reflect.Value {
+func (c *uint64Converter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(uint64(v.Uint())).Convert(c.goType)
 }
-func (c *uint64Converter) IsValidPB(v pref.Value) bool {
+func (c *uint64Converter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(uint64)
 	return ok
 }
 func (c *uint64Converter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *uint64Converter) New() pref.Value  { return c.def }
-func (c *uint64Converter) Zero() pref.Value { return c.def }
+func (c *uint64Converter) New() protoreflect.Value  { return c.def }
+func (c *uint64Converter) Zero() protoreflect.Value { return c.def }
 
 type float32Converter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *float32Converter) PBValueOf(v reflect.Value) pref.Value {
+func (c *float32Converter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfFloat32(float32(v.Float()))
+	return protoreflect.ValueOfFloat32(float32(v.Float()))
 }
-func (c *float32Converter) GoValueOf(v pref.Value) reflect.Value {
+func (c *float32Converter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(float32(v.Float())).Convert(c.goType)
 }
-func (c *float32Converter) IsValidPB(v pref.Value) bool {
+func (c *float32Converter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(float32)
 	return ok
 }
 func (c *float32Converter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *float32Converter) New() pref.Value  { return c.def }
-func (c *float32Converter) Zero() pref.Value { return c.def }
+func (c *float32Converter) New() protoreflect.Value  { return c.def }
+func (c *float32Converter) Zero() protoreflect.Value { return c.def }
 
 type float64Converter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *float64Converter) PBValueOf(v reflect.Value) pref.Value {
+func (c *float64Converter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfFloat64(float64(v.Float()))
+	return protoreflect.ValueOfFloat64(float64(v.Float()))
 }
-func (c *float64Converter) GoValueOf(v pref.Value) reflect.Value {
+func (c *float64Converter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(float64(v.Float())).Convert(c.goType)
 }
-func (c *float64Converter) IsValidPB(v pref.Value) bool {
+func (c *float64Converter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(float64)
 	return ok
 }
 func (c *float64Converter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *float64Converter) New() pref.Value  { return c.def }
-func (c *float64Converter) Zero() pref.Value { return c.def }
+func (c *float64Converter) New() protoreflect.Value  { return c.def }
+func (c *float64Converter) Zero() protoreflect.Value { return c.def }
 
 type stringConverter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *stringConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *stringConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfString(v.Convert(stringType).String())
+	return protoreflect.ValueOfString(v.Convert(stringType).String())
 }
-func (c *stringConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *stringConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	// pref.Value.String never panics, so we go through an interface
 	// conversion here to check the type.
 	s := v.Interface().(string)
@@ -331,71 +330,71 @@ func (c *stringConverter) GoValueOf(v pref.Value) reflect.Value {
 	}
 	return reflect.ValueOf(s).Convert(c.goType)
 }
-func (c *stringConverter) IsValidPB(v pref.Value) bool {
+func (c *stringConverter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().(string)
 	return ok
 }
 func (c *stringConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *stringConverter) New() pref.Value  { return c.def }
-func (c *stringConverter) Zero() pref.Value { return c.def }
+func (c *stringConverter) New() protoreflect.Value  { return c.def }
+func (c *stringConverter) Zero() protoreflect.Value { return c.def }
 
 type bytesConverter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func (c *bytesConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *bytesConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
 	if c.goType.Kind() == reflect.String && v.Len() == 0 {
-		return pref.ValueOfBytes(nil) // ensure empty string is []byte(nil)
+		return protoreflect.ValueOfBytes(nil) // ensure empty string is []byte(nil)
 	}
-	return pref.ValueOfBytes(v.Convert(bytesType).Bytes())
+	return protoreflect.ValueOfBytes(v.Convert(bytesType).Bytes())
 }
-func (c *bytesConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *bytesConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(v.Bytes()).Convert(c.goType)
 }
-func (c *bytesConverter) IsValidPB(v pref.Value) bool {
+func (c *bytesConverter) IsValidPB(v protoreflect.Value) bool {
 	_, ok := v.Interface().([]byte)
 	return ok
 }
 func (c *bytesConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
-func (c *bytesConverter) New() pref.Value  { return c.def }
-func (c *bytesConverter) Zero() pref.Value { return c.def }
+func (c *bytesConverter) New() protoreflect.Value  { return c.def }
+func (c *bytesConverter) Zero() protoreflect.Value { return c.def }
 
 type enumConverter struct {
 	goType reflect.Type
-	def    pref.Value
+	def    protoreflect.Value
 }
 
-func newEnumConverter(goType reflect.Type, fd pref.FieldDescriptor) Converter {
-	var def pref.Value
-	if fd.Cardinality() == pref.Repeated {
-		def = pref.ValueOfEnum(fd.Enum().Values().Get(0).Number())
+func newEnumConverter(goType reflect.Type, fd protoreflect.FieldDescriptor) Converter {
+	var def protoreflect.Value
+	if fd.Cardinality() == protoreflect.Repeated {
+		def = protoreflect.ValueOfEnum(fd.Enum().Values().Get(0).Number())
 	} else {
 		def = fd.Default()
 	}
 	return &enumConverter{goType, def}
 }
 
-func (c *enumConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *enumConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfEnum(pref.EnumNumber(v.Int()))
+	return protoreflect.ValueOfEnum(protoreflect.EnumNumber(v.Int()))
 }
 
-func (c *enumConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *enumConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return reflect.ValueOf(v.Enum()).Convert(c.goType)
 }
 
-func (c *enumConverter) IsValidPB(v pref.Value) bool {
-	_, ok := v.Interface().(pref.EnumNumber)
+func (c *enumConverter) IsValidPB(v protoreflect.Value) bool {
+	_, ok := v.Interface().(protoreflect.EnumNumber)
 	return ok
 }
 
@@ -403,11 +402,11 @@ func (c *enumConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
 
-func (c *enumConverter) New() pref.Value {
+func (c *enumConverter) New() protoreflect.Value {
 	return c.def
 }
 
-func (c *enumConverter) Zero() pref.Value {
+func (c *enumConverter) Zero() protoreflect.Value {
 	return c.def
 }
 
@@ -419,7 +418,7 @@ func newMessageConverter(goType reflect.Type) Converter {
 	return &messageConverter{goType}
 }
 
-func (c *messageConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *messageConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
@@ -430,13 +429,13 @@ func (c *messageConverter) PBValueOf(v reflect.Value) pref.Value {
 			v = reflect.Zero(reflect.PtrTo(v.Type()))
 		}
 	}
-	if m, ok := v.Interface().(pref.ProtoMessage); ok {
-		return pref.ValueOfMessage(m.ProtoReflect())
+	if m, ok := v.Interface().(protoreflect.ProtoMessage); ok {
+		return protoreflect.ValueOfMessage(m.ProtoReflect())
 	}
-	return pref.ValueOfMessage(legacyWrapMessage(v))
+	return protoreflect.ValueOfMessage(legacyWrapMessage(v))
 }
 
-func (c *messageConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *messageConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	m := v.Message()
 	var rv reflect.Value
 	if u, ok := m.(unwrapper); ok {
@@ -460,7 +459,7 @@ func (c *messageConverter) GoValueOf(v pref.Value) reflect.Value {
 	return rv
 }
 
-func (c *messageConverter) IsValidPB(v pref.Value) bool {
+func (c *messageConverter) IsValidPB(v protoreflect.Value) bool {
 	m := v.Message()
 	var rv reflect.Value
 	if u, ok := m.(unwrapper); ok {
@@ -478,14 +477,14 @@ func (c *messageConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
 
-func (c *messageConverter) New() pref.Value {
+func (c *messageConverter) New() protoreflect.Value {
 	if c.isNonPointer() {
 		return c.PBValueOf(reflect.New(c.goType).Elem())
 	}
 	return c.PBValueOf(reflect.New(c.goType.Elem()))
 }
 
-func (c *messageConverter) Zero() pref.Value {
+func (c *messageConverter) Zero() protoreflect.Value {
 	return c.PBValueOf(reflect.Zero(c.goType))
 }
 
diff --git a/vendor/google.golang.org/protobuf/internal/impl/convert_list.go b/vendor/google.golang.org/protobuf/internal/impl/convert_list.go
index 6fccab520e..f89136516f 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/convert_list.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/convert_list.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"reflect"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
-func newListConverter(t reflect.Type, fd pref.FieldDescriptor) Converter {
+func newListConverter(t reflect.Type, fd protoreflect.FieldDescriptor) Converter {
 	switch {
 	case t.Kind() == reflect.Ptr && t.Elem().Kind() == reflect.Slice:
 		return &listPtrConverter{t, newSingularConverter(t.Elem().Elem(), fd)}
@@ -26,16 +26,16 @@ type listConverter struct {
 	c      Converter
 }
 
-func (c *listConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *listConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
 	pv := reflect.New(c.goType)
 	pv.Elem().Set(v)
-	return pref.ValueOfList(&listReflect{pv, c.c})
+	return protoreflect.ValueOfList(&listReflect{pv, c.c})
 }
 
-func (c *listConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *listConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	rv := v.List().(*listReflect).v
 	if rv.IsNil() {
 		return reflect.Zero(c.goType)
@@ -43,7 +43,7 @@ func (c *listConverter) GoValueOf(v pref.Value) reflect.Value {
 	return rv.Elem()
 }
 
-func (c *listConverter) IsValidPB(v pref.Value) bool {
+func (c *listConverter) IsValidPB(v protoreflect.Value) bool {
 	list, ok := v.Interface().(*listReflect)
 	if !ok {
 		return false
@@ -55,12 +55,12 @@ func (c *listConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
 
-func (c *listConverter) New() pref.Value {
-	return pref.ValueOfList(&listReflect{reflect.New(c.goType), c.c})
+func (c *listConverter) New() protoreflect.Value {
+	return protoreflect.ValueOfList(&listReflect{reflect.New(c.goType), c.c})
 }
 
-func (c *listConverter) Zero() pref.Value {
-	return pref.ValueOfList(&listReflect{reflect.Zero(reflect.PtrTo(c.goType)), c.c})
+func (c *listConverter) Zero() protoreflect.Value {
+	return protoreflect.ValueOfList(&listReflect{reflect.Zero(reflect.PtrTo(c.goType)), c.c})
 }
 
 type listPtrConverter struct {
@@ -68,18 +68,18 @@ type listPtrConverter struct {
 	c      Converter
 }
 
-func (c *listPtrConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *listPtrConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfList(&listReflect{v, c.c})
+	return protoreflect.ValueOfList(&listReflect{v, c.c})
 }
 
-func (c *listPtrConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *listPtrConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return v.List().(*listReflect).v
 }
 
-func (c *listPtrConverter) IsValidPB(v pref.Value) bool {
+func (c *listPtrConverter) IsValidPB(v protoreflect.Value) bool {
 	list, ok := v.Interface().(*listReflect)
 	if !ok {
 		return false
@@ -91,11 +91,11 @@ func (c *listPtrConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
 
-func (c *listPtrConverter) New() pref.Value {
+func (c *listPtrConverter) New() protoreflect.Value {
 	return c.PBValueOf(reflect.New(c.goType.Elem()))
 }
 
-func (c *listPtrConverter) Zero() pref.Value {
+func (c *listPtrConverter) Zero() protoreflect.Value {
 	return c.PBValueOf(reflect.Zero(c.goType))
 }
 
@@ -110,16 +110,16 @@ func (ls *listReflect) Len() int {
 	}
 	return ls.v.Elem().Len()
 }
-func (ls *listReflect) Get(i int) pref.Value {
+func (ls *listReflect) Get(i int) protoreflect.Value {
 	return ls.conv.PBValueOf(ls.v.Elem().Index(i))
 }
-func (ls *listReflect) Set(i int, v pref.Value) {
+func (ls *listReflect) Set(i int, v protoreflect.Value) {
 	ls.v.Elem().Index(i).Set(ls.conv.GoValueOf(v))
 }
-func (ls *listReflect) Append(v pref.Value) {
+func (ls *listReflect) Append(v protoreflect.Value) {
 	ls.v.Elem().Set(reflect.Append(ls.v.Elem(), ls.conv.GoValueOf(v)))
 }
-func (ls *listReflect) AppendMutable() pref.Value {
+func (ls *listReflect) AppendMutable() protoreflect.Value {
 	if _, ok := ls.conv.(*messageConverter); !ok {
 		panic("invalid AppendMutable on list with non-message type")
 	}
@@ -130,7 +130,7 @@ func (ls *listReflect) AppendMutable() pref.Value {
 func (ls *listReflect) Truncate(i int) {
 	ls.v.Elem().Set(ls.v.Elem().Slice(0, i))
 }
-func (ls *listReflect) NewElement() pref.Value {
+func (ls *listReflect) NewElement() protoreflect.Value {
 	return ls.conv.New()
 }
 func (ls *listReflect) IsValid() bool {
diff --git a/vendor/google.golang.org/protobuf/internal/impl/convert_map.go b/vendor/google.golang.org/protobuf/internal/impl/convert_map.go
index de06b2593f..f30b0a0576 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/convert_map.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/convert_map.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"reflect"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type mapConverter struct {
@@ -16,7 +16,7 @@ type mapConverter struct {
 	keyConv, valConv Converter
 }
 
-func newMapConverter(t reflect.Type, fd pref.FieldDescriptor) *mapConverter {
+func newMapConverter(t reflect.Type, fd protoreflect.FieldDescriptor) *mapConverter {
 	if t.Kind() != reflect.Map {
 		panic(fmt.Sprintf("invalid Go type %v for field %v", t, fd.FullName()))
 	}
@@ -27,18 +27,18 @@ func newMapConverter(t reflect.Type, fd pref.FieldDescriptor) *mapConverter {
 	}
 }
 
-func (c *mapConverter) PBValueOf(v reflect.Value) pref.Value {
+func (c *mapConverter) PBValueOf(v reflect.Value) protoreflect.Value {
 	if v.Type() != c.goType {
 		panic(fmt.Sprintf("invalid type: got %v, want %v", v.Type(), c.goType))
 	}
-	return pref.ValueOfMap(&mapReflect{v, c.keyConv, c.valConv})
+	return protoreflect.ValueOfMap(&mapReflect{v, c.keyConv, c.valConv})
 }
 
-func (c *mapConverter) GoValueOf(v pref.Value) reflect.Value {
+func (c *mapConverter) GoValueOf(v protoreflect.Value) reflect.Value {
 	return v.Map().(*mapReflect).v
 }
 
-func (c *mapConverter) IsValidPB(v pref.Value) bool {
+func (c *mapConverter) IsValidPB(v protoreflect.Value) bool {
 	mapv, ok := v.Interface().(*mapReflect)
 	if !ok {
 		return false
@@ -50,11 +50,11 @@ func (c *mapConverter) IsValidGo(v reflect.Value) bool {
 	return v.IsValid() && v.Type() == c.goType
 }
 
-func (c *mapConverter) New() pref.Value {
+func (c *mapConverter) New() protoreflect.Value {
 	return c.PBValueOf(reflect.MakeMap(c.goType))
 }
 
-func (c *mapConverter) Zero() pref.Value {
+func (c *mapConverter) Zero() protoreflect.Value {
 	return c.PBValueOf(reflect.Zero(c.goType))
 }
 
@@ -67,29 +67,29 @@ type mapReflect struct {
 func (ms *mapReflect) Len() int {
 	return ms.v.Len()
 }
-func (ms *mapReflect) Has(k pref.MapKey) bool {
+func (ms *mapReflect) Has(k protoreflect.MapKey) bool {
 	rk := ms.keyConv.GoValueOf(k.Value())
 	rv := ms.v.MapIndex(rk)
 	return rv.IsValid()
 }
-func (ms *mapReflect) Get(k pref.MapKey) pref.Value {
+func (ms *mapReflect) Get(k protoreflect.MapKey) protoreflect.Value {
 	rk := ms.keyConv.GoValueOf(k.Value())
 	rv := ms.v.MapIndex(rk)
 	if !rv.IsValid() {
-		return pref.Value{}
+		return protoreflect.Value{}
 	}
 	return ms.valConv.PBValueOf(rv)
 }
-func (ms *mapReflect) Set(k pref.MapKey, v pref.Value) {
+func (ms *mapReflect) Set(k protoreflect.MapKey, v protoreflect.Value) {
 	rk := ms.keyConv.GoValueOf(k.Value())
 	rv := ms.valConv.GoValueOf(v)
 	ms.v.SetMapIndex(rk, rv)
 }
-func (ms *mapReflect) Clear(k pref.MapKey) {
+func (ms *mapReflect) Clear(k protoreflect.MapKey) {
 	rk := ms.keyConv.GoValueOf(k.Value())
 	ms.v.SetMapIndex(rk, reflect.Value{})
 }
-func (ms *mapReflect) Mutable(k pref.MapKey) pref.Value {
+func (ms *mapReflect) Mutable(k protoreflect.MapKey) protoreflect.Value {
 	if _, ok := ms.valConv.(*messageConverter); !ok {
 		panic("invalid Mutable on map with non-message value type")
 	}
@@ -100,7 +100,7 @@ func (ms *mapReflect) Mutable(k pref.MapKey) pref.Value {
 	}
 	return v
 }
-func (ms *mapReflect) Range(f func(pref.MapKey, pref.Value) bool) {
+func (ms *mapReflect) Range(f func(protoreflect.MapKey, protoreflect.Value) bool) {
 	iter := mapRange(ms.v)
 	for iter.Next() {
 		k := ms.keyConv.PBValueOf(iter.Key()).MapKey()
@@ -110,7 +110,7 @@ func (ms *mapReflect) Range(f func(pref.MapKey, pref.Value) bool) {
 		}
 	}
 }
-func (ms *mapReflect) NewValue() pref.Value {
+func (ms *mapReflect) NewValue() protoreflect.Value {
 	return ms.valConv.New()
 }
 func (ms *mapReflect) IsValid() bool {
diff --git a/vendor/google.golang.org/protobuf/internal/impl/decode.go b/vendor/google.golang.org/protobuf/internal/impl/decode.go
index 949dc49a65..cda0520c27 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/decode.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/decode.go
@@ -12,12 +12,12 @@ import (
 	"google.golang.org/protobuf/internal/flags"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/reflect/protoregistry"
 	"google.golang.org/protobuf/runtime/protoiface"
-	piface "google.golang.org/protobuf/runtime/protoiface"
 )
 
 var errDecode = errors.New("cannot parse invalid wire-format data")
+var errRecursionDepth = errors.New("exceeded maximum recursion depth")
 
 type unmarshalOptions struct {
 	flags    protoiface.UnmarshalInputFlags
@@ -25,6 +25,7 @@ type unmarshalOptions struct {
 		FindExtensionByName(field protoreflect.FullName) (protoreflect.ExtensionType, error)
 		FindExtensionByNumber(message protoreflect.FullName, field protoreflect.FieldNumber) (protoreflect.ExtensionType, error)
 	}
+	depth int
 }
 
 func (o unmarshalOptions) Options() proto.UnmarshalOptions {
@@ -36,14 +37,17 @@ func (o unmarshalOptions) Options() proto.UnmarshalOptions {
 	}
 }
 
-func (o unmarshalOptions) DiscardUnknown() bool { return o.flags&piface.UnmarshalDiscardUnknown != 0 }
+func (o unmarshalOptions) DiscardUnknown() bool {
+	return o.flags&protoiface.UnmarshalDiscardUnknown != 0
+}
 
 func (o unmarshalOptions) IsDefault() bool {
-	return o.flags == 0 && o.resolver == preg.GlobalTypes
+	return o.flags == 0 && o.resolver == protoregistry.GlobalTypes
 }
 
 var lazyUnmarshalOptions = unmarshalOptions{
-	resolver: preg.GlobalTypes,
+	resolver: protoregistry.GlobalTypes,
+	depth:    protowire.DefaultRecursionLimit,
 }
 
 type unmarshalOutput struct {
@@ -52,7 +56,7 @@ type unmarshalOutput struct {
 }
 
 // unmarshal is protoreflect.Methods.Unmarshal.
-func (mi *MessageInfo) unmarshal(in piface.UnmarshalInput) (piface.UnmarshalOutput, error) {
+func (mi *MessageInfo) unmarshal(in protoiface.UnmarshalInput) (protoiface.UnmarshalOutput, error) {
 	var p pointer
 	if ms, ok := in.Message.(*messageState); ok {
 		p = ms.pointer()
@@ -62,12 +66,13 @@ func (mi *MessageInfo) unmarshal(in piface.UnmarshalInput) (piface.UnmarshalOutp
 	out, err := mi.unmarshalPointer(in.Buf, p, 0, unmarshalOptions{
 		flags:    in.Flags,
 		resolver: in.Resolver,
+		depth:    in.Depth,
 	})
-	var flags piface.UnmarshalOutputFlags
+	var flags protoiface.UnmarshalOutputFlags
 	if out.initialized {
-		flags |= piface.UnmarshalInitialized
+		flags |= protoiface.UnmarshalInitialized
 	}
-	return piface.UnmarshalOutput{
+	return protoiface.UnmarshalOutput{
 		Flags: flags,
 	}, err
 }
@@ -82,6 +87,10 @@ var errUnknown = errors.New("unknown")
 
 func (mi *MessageInfo) unmarshalPointer(b []byte, p pointer, groupTag protowire.Number, opts unmarshalOptions) (out unmarshalOutput, err error) {
 	mi.init()
+	opts.depth--
+	if opts.depth < 0 {
+		return out, errRecursionDepth
+	}
 	if flags.ProtoLegacy && mi.isMessageSet {
 		return unmarshalMessageSet(mi, b, p, opts)
 	}
@@ -202,7 +211,7 @@ func (mi *MessageInfo) unmarshalExtension(b []byte, num protowire.Number, wtyp p
 		var err error
 		xt, err = opts.resolver.FindExtensionByNumber(mi.Desc.FullName(), num)
 		if err != nil {
-			if err == preg.NotFound {
+			if err == protoregistry.NotFound {
 				return out, errUnknown
 			}
 			return out, errors.New("%v: unable to resolve extension %v: %v", mi.Desc.FullName(), num, err)
diff --git a/vendor/google.golang.org/protobuf/internal/impl/enum.go b/vendor/google.golang.org/protobuf/internal/impl/enum.go
index 8c1eab4bfd..5f3ef5ad73 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/enum.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/enum.go
@@ -7,15 +7,15 @@ package impl
 import (
 	"reflect"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type EnumInfo struct {
 	GoReflectType reflect.Type // int32 kind
-	Desc          pref.EnumDescriptor
+	Desc          protoreflect.EnumDescriptor
 }
 
-func (t *EnumInfo) New(n pref.EnumNumber) pref.Enum {
-	return reflect.ValueOf(n).Convert(t.GoReflectType).Interface().(pref.Enum)
+func (t *EnumInfo) New(n protoreflect.EnumNumber) protoreflect.Enum {
+	return reflect.ValueOf(n).Convert(t.GoReflectType).Interface().(protoreflect.Enum)
 }
-func (t *EnumInfo) Descriptor() pref.EnumDescriptor { return t.Desc }
+func (t *EnumInfo) Descriptor() protoreflect.EnumDescriptor { return t.Desc }
diff --git a/vendor/google.golang.org/protobuf/internal/impl/extension.go b/vendor/google.golang.org/protobuf/internal/impl/extension.go
index e904fd9936..cb25b0bae1 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/extension.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/extension.go
@@ -9,8 +9,8 @@ import (
 	"sync"
 	"sync/atomic"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 // ExtensionInfo implements ExtensionType.
@@ -45,7 +45,7 @@ type ExtensionInfo struct {
 	// since the message may no longer implement the MessageV1 interface.
 	//
 	// Deprecated: Use the ExtendedType method instead.
-	ExtendedType piface.MessageV1
+	ExtendedType protoiface.MessageV1
 
 	// ExtensionType is the zero value of the extension type.
 	//
@@ -83,31 +83,31 @@ const (
 	extensionInfoFullInit      = 2
 )
 
-func InitExtensionInfo(xi *ExtensionInfo, xd pref.ExtensionDescriptor, goType reflect.Type) {
+func InitExtensionInfo(xi *ExtensionInfo, xd protoreflect.ExtensionDescriptor, goType reflect.Type) {
 	xi.goType = goType
 	xi.desc = extensionTypeDescriptor{xd, xi}
 	xi.init = extensionInfoDescInit
 }
 
-func (xi *ExtensionInfo) New() pref.Value {
+func (xi *ExtensionInfo) New() protoreflect.Value {
 	return xi.lazyInit().New()
 }
-func (xi *ExtensionInfo) Zero() pref.Value {
+func (xi *ExtensionInfo) Zero() protoreflect.Value {
 	return xi.lazyInit().Zero()
 }
-func (xi *ExtensionInfo) ValueOf(v interface{}) pref.Value {
+func (xi *ExtensionInfo) ValueOf(v interface{}) protoreflect.Value {
 	return xi.lazyInit().PBValueOf(reflect.ValueOf(v))
 }
-func (xi *ExtensionInfo) InterfaceOf(v pref.Value) interface{} {
+func (xi *ExtensionInfo) InterfaceOf(v protoreflect.Value) interface{} {
 	return xi.lazyInit().GoValueOf(v).Interface()
 }
-func (xi *ExtensionInfo) IsValidValue(v pref.Value) bool {
+func (xi *ExtensionInfo) IsValidValue(v protoreflect.Value) bool {
 	return xi.lazyInit().IsValidPB(v)
 }
 func (xi *ExtensionInfo) IsValidInterface(v interface{}) bool {
 	return xi.lazyInit().IsValidGo(reflect.ValueOf(v))
 }
-func (xi *ExtensionInfo) TypeDescriptor() pref.ExtensionTypeDescriptor {
+func (xi *ExtensionInfo) TypeDescriptor() protoreflect.ExtensionTypeDescriptor {
 	if atomic.LoadUint32(&xi.init) < extensionInfoDescInit {
 		xi.lazyInitSlow()
 	}
@@ -144,13 +144,13 @@ func (xi *ExtensionInfo) lazyInitSlow() {
 }
 
 type extensionTypeDescriptor struct {
-	pref.ExtensionDescriptor
+	protoreflect.ExtensionDescriptor
 	xi *ExtensionInfo
 }
 
-func (xtd *extensionTypeDescriptor) Type() pref.ExtensionType {
+func (xtd *extensionTypeDescriptor) Type() protoreflect.ExtensionType {
 	return xtd.xi
 }
-func (xtd *extensionTypeDescriptor) Descriptor() pref.ExtensionDescriptor {
+func (xtd *extensionTypeDescriptor) Descriptor() protoreflect.ExtensionDescriptor {
 	return xtd.ExtensionDescriptor
 }
diff --git a/vendor/google.golang.org/protobuf/internal/impl/legacy_enum.go b/vendor/google.golang.org/protobuf/internal/impl/legacy_enum.go
index f7d7ffb510..c2a803bb2f 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/legacy_enum.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/legacy_enum.go
@@ -13,13 +13,12 @@ import (
 	"google.golang.org/protobuf/internal/filedesc"
 	"google.golang.org/protobuf/internal/strs"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // legacyEnumName returns the name of enums used in legacy code.
 // It is neither the protobuf full name nor the qualified Go name,
 // but rather an odd hybrid of both.
-func legacyEnumName(ed pref.EnumDescriptor) string {
+func legacyEnumName(ed protoreflect.EnumDescriptor) string {
 	var protoPkg string
 	enumName := string(ed.FullName())
 	if fd := ed.ParentFile(); fd != nil {
@@ -34,68 +33,68 @@ func legacyEnumName(ed pref.EnumDescriptor) string {
 
 // legacyWrapEnum wraps v as a protoreflect.Enum,
 // where v must be a int32 kind and not implement the v2 API already.
-func legacyWrapEnum(v reflect.Value) pref.Enum {
+func legacyWrapEnum(v reflect.Value) protoreflect.Enum {
 	et := legacyLoadEnumType(v.Type())
-	return et.New(pref.EnumNumber(v.Int()))
+	return et.New(protoreflect.EnumNumber(v.Int()))
 }
 
 var legacyEnumTypeCache sync.Map // map[reflect.Type]protoreflect.EnumType
 
 // legacyLoadEnumType dynamically loads a protoreflect.EnumType for t,
 // where t must be an int32 kind and not implement the v2 API already.
-func legacyLoadEnumType(t reflect.Type) pref.EnumType {
+func legacyLoadEnumType(t reflect.Type) protoreflect.EnumType {
 	// Fast-path: check if a EnumType is cached for this concrete type.
 	if et, ok := legacyEnumTypeCache.Load(t); ok {
-		return et.(pref.EnumType)
+		return et.(protoreflect.EnumType)
 	}
 
 	// Slow-path: derive enum descriptor and initialize EnumType.
-	var et pref.EnumType
+	var et protoreflect.EnumType
 	ed := LegacyLoadEnumDesc(t)
 	et = &legacyEnumType{
 		desc:   ed,
 		goType: t,
 	}
 	if et, ok := legacyEnumTypeCache.LoadOrStore(t, et); ok {
-		return et.(pref.EnumType)
+		return et.(protoreflect.EnumType)
 	}
 	return et
 }
 
 type legacyEnumType struct {
-	desc   pref.EnumDescriptor
+	desc   protoreflect.EnumDescriptor
 	goType reflect.Type
 	m      sync.Map // map[protoreflect.EnumNumber]proto.Enum
 }
 
-func (t *legacyEnumType) New(n pref.EnumNumber) pref.Enum {
+func (t *legacyEnumType) New(n protoreflect.EnumNumber) protoreflect.Enum {
 	if e, ok := t.m.Load(n); ok {
-		return e.(pref.Enum)
+		return e.(protoreflect.Enum)
 	}
 	e := &legacyEnumWrapper{num: n, pbTyp: t, goTyp: t.goType}
 	t.m.Store(n, e)
 	return e
 }
-func (t *legacyEnumType) Descriptor() pref.EnumDescriptor {
+func (t *legacyEnumType) Descriptor() protoreflect.EnumDescriptor {
 	return t.desc
 }
 
 type legacyEnumWrapper struct {
-	num   pref.EnumNumber
-	pbTyp pref.EnumType
+	num   protoreflect.EnumNumber
+	pbTyp protoreflect.EnumType
 	goTyp reflect.Type
 }
 
-func (e *legacyEnumWrapper) Descriptor() pref.EnumDescriptor {
+func (e *legacyEnumWrapper) Descriptor() protoreflect.EnumDescriptor {
 	return e.pbTyp.Descriptor()
 }
-func (e *legacyEnumWrapper) Type() pref.EnumType {
+func (e *legacyEnumWrapper) Type() protoreflect.EnumType {
 	return e.pbTyp
 }
-func (e *legacyEnumWrapper) Number() pref.EnumNumber {
+func (e *legacyEnumWrapper) Number() protoreflect.EnumNumber {
 	return e.num
 }
-func (e *legacyEnumWrapper) ProtoReflect() pref.Enum {
+func (e *legacyEnumWrapper) ProtoReflect() protoreflect.Enum {
 	return e
 }
 func (e *legacyEnumWrapper) protoUnwrap() interface{} {
@@ -105,8 +104,8 @@ func (e *legacyEnumWrapper) protoUnwrap() interface{} {
 }
 
 var (
-	_ pref.Enum = (*legacyEnumWrapper)(nil)
-	_ unwrapper = (*legacyEnumWrapper)(nil)
+	_ protoreflect.Enum = (*legacyEnumWrapper)(nil)
+	_ unwrapper         = (*legacyEnumWrapper)(nil)
 )
 
 var legacyEnumDescCache sync.Map // map[reflect.Type]protoreflect.EnumDescriptor
@@ -115,15 +114,15 @@ var legacyEnumDescCache sync.Map // map[reflect.Type]protoreflect.EnumDescriptor
 // which must be an int32 kind and not implement the v2 API already.
 //
 // This is exported for testing purposes.
-func LegacyLoadEnumDesc(t reflect.Type) pref.EnumDescriptor {
+func LegacyLoadEnumDesc(t reflect.Type) protoreflect.EnumDescriptor {
 	// Fast-path: check if an EnumDescriptor is cached for this concrete type.
 	if ed, ok := legacyEnumDescCache.Load(t); ok {
-		return ed.(pref.EnumDescriptor)
+		return ed.(protoreflect.EnumDescriptor)
 	}
 
 	// Slow-path: initialize EnumDescriptor from the raw descriptor.
 	ev := reflect.Zero(t).Interface()
-	if _, ok := ev.(pref.Enum); ok {
+	if _, ok := ev.(protoreflect.Enum); ok {
 		panic(fmt.Sprintf("%v already implements proto.Enum", t))
 	}
 	edV1, ok := ev.(enumV1)
@@ -132,7 +131,7 @@ func LegacyLoadEnumDesc(t reflect.Type) pref.EnumDescriptor {
 	}
 	b, idxs := edV1.EnumDescriptor()
 
-	var ed pref.EnumDescriptor
+	var ed protoreflect.EnumDescriptor
 	if len(idxs) == 1 {
 		ed = legacyLoadFileDesc(b).Enums().Get(idxs[0])
 	} else {
@@ -158,10 +157,10 @@ var aberrantEnumDescCache sync.Map // map[reflect.Type]protoreflect.EnumDescript
 // We are unable to use the global enum registry since it is
 // unfortunately keyed by the protobuf full name, which we also do not know.
 // Thus, this produces some bogus enum descriptor based on the Go type name.
-func aberrantLoadEnumDesc(t reflect.Type) pref.EnumDescriptor {
+func aberrantLoadEnumDesc(t reflect.Type) protoreflect.EnumDescriptor {
 	// Fast-path: check if an EnumDescriptor is cached for this concrete type.
 	if ed, ok := aberrantEnumDescCache.Load(t); ok {
-		return ed.(pref.EnumDescriptor)
+		return ed.(protoreflect.EnumDescriptor)
 	}
 
 	// Slow-path: construct a bogus, but unique EnumDescriptor.
@@ -182,7 +181,7 @@ func aberrantLoadEnumDesc(t reflect.Type) pref.EnumDescriptor {
 	// An exhaustive query is clearly impractical, but can be best-effort.
 
 	if ed, ok := aberrantEnumDescCache.LoadOrStore(t, ed); ok {
-		return ed.(pref.EnumDescriptor)
+		return ed.(protoreflect.EnumDescriptor)
 	}
 	return ed
 }
@@ -192,7 +191,7 @@ func aberrantLoadEnumDesc(t reflect.Type) pref.EnumDescriptor {
 // It should be sufficiently unique within a program.
 //
 // This is exported for testing purposes.
-func AberrantDeriveFullName(t reflect.Type) pref.FullName {
+func AberrantDeriveFullName(t reflect.Type) protoreflect.FullName {
 	sanitize := func(r rune) rune {
 		switch {
 		case r == '/':
@@ -215,5 +214,5 @@ func AberrantDeriveFullName(t reflect.Type) pref.FullName {
 			ss[i] = "x" + s
 		}
 	}
-	return pref.FullName(strings.Join(ss, "."))
+	return protoreflect.FullName(strings.Join(ss, "."))
 }
diff --git a/vendor/google.golang.org/protobuf/internal/impl/legacy_export.go b/vendor/google.golang.org/protobuf/internal/impl/legacy_export.go
index e3fb0b5785..9b64ad5bba 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/legacy_export.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/legacy_export.go
@@ -12,21 +12,21 @@ import (
 	"reflect"
 
 	"google.golang.org/protobuf/internal/errors"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 // These functions exist to support exported APIs in generated protobufs.
 // While these are deprecated, they cannot be removed for compatibility reasons.
 
 // LegacyEnumName returns the name of enums used in legacy code.
-func (Export) LegacyEnumName(ed pref.EnumDescriptor) string {
+func (Export) LegacyEnumName(ed protoreflect.EnumDescriptor) string {
 	return legacyEnumName(ed)
 }
 
 // LegacyMessageTypeOf returns the protoreflect.MessageType for m,
 // with name used as the message name if necessary.
-func (Export) LegacyMessageTypeOf(m piface.MessageV1, name pref.FullName) pref.MessageType {
+func (Export) LegacyMessageTypeOf(m protoiface.MessageV1, name protoreflect.FullName) protoreflect.MessageType {
 	if mv := (Export{}).protoMessageV2Of(m); mv != nil {
 		return mv.ProtoReflect().Type()
 	}
@@ -36,9 +36,9 @@ func (Export) LegacyMessageTypeOf(m piface.MessageV1, name pref.FullName) pref.M
 // UnmarshalJSONEnum unmarshals an enum from a JSON-encoded input.
 // The input can either be a string representing the enum value by name,
 // or a number representing the enum number itself.
-func (Export) UnmarshalJSONEnum(ed pref.EnumDescriptor, b []byte) (pref.EnumNumber, error) {
+func (Export) UnmarshalJSONEnum(ed protoreflect.EnumDescriptor, b []byte) (protoreflect.EnumNumber, error) {
 	if b[0] == '"' {
-		var name pref.Name
+		var name protoreflect.Name
 		if err := json.Unmarshal(b, &name); err != nil {
 			return 0, errors.New("invalid input for enum %v: %s", ed.FullName(), b)
 		}
@@ -48,7 +48,7 @@ func (Export) UnmarshalJSONEnum(ed pref.EnumDescriptor, b []byte) (pref.EnumNumb
 		}
 		return ev.Number(), nil
 	} else {
-		var num pref.EnumNumber
+		var num protoreflect.EnumNumber
 		if err := json.Unmarshal(b, &num); err != nil {
 			return 0, errors.New("invalid input for enum %v: %s", ed.FullName(), b)
 		}
@@ -81,8 +81,8 @@ func (Export) CompressGZIP(in []byte) (out []byte) {
 			blockHeader[0] = 0x01 // final bit per RFC 1951, section 3.2.3.
 			blockSize = len(in)
 		}
-		binary.LittleEndian.PutUint16(blockHeader[1:3], uint16(blockSize)^0x0000)
-		binary.LittleEndian.PutUint16(blockHeader[3:5], uint16(blockSize)^0xffff)
+		binary.LittleEndian.PutUint16(blockHeader[1:3], uint16(blockSize))
+		binary.LittleEndian.PutUint16(blockHeader[3:5], ^uint16(blockSize))
 		out = append(out, blockHeader[:]...)
 		out = append(out, in[:blockSize]...)
 		in = in[blockSize:]
diff --git a/vendor/google.golang.org/protobuf/internal/impl/legacy_extension.go b/vendor/google.golang.org/protobuf/internal/impl/legacy_extension.go
index 49e723161c..87b30d0504 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/legacy_extension.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/legacy_extension.go
@@ -12,16 +12,16 @@ import (
 	ptag "google.golang.org/protobuf/internal/encoding/tag"
 	"google.golang.org/protobuf/internal/filedesc"
 	"google.golang.org/protobuf/internal/pragma"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 func (xi *ExtensionInfo) initToLegacy() {
 	xd := xi.desc
-	var parent piface.MessageV1
+	var parent protoiface.MessageV1
 	messageName := xd.ContainingMessage().FullName()
-	if mt, _ := preg.GlobalTypes.FindMessageByName(messageName); mt != nil {
+	if mt, _ := protoregistry.GlobalTypes.FindMessageByName(messageName); mt != nil {
 		// Create a new parent message and unwrap it if possible.
 		mv := mt.New().Interface()
 		t := reflect.TypeOf(mv)
@@ -31,7 +31,7 @@ func (xi *ExtensionInfo) initToLegacy() {
 
 		// Check whether the message implements the legacy v1 Message interface.
 		mz := reflect.Zero(t).Interface()
-		if mz, ok := mz.(piface.MessageV1); ok {
+		if mz, ok := mz.(protoiface.MessageV1); ok {
 			parent = mz
 		}
 	}
@@ -46,7 +46,7 @@ func (xi *ExtensionInfo) initToLegacy() {
 
 	// Reconstruct the legacy enum full name.
 	var enumName string
-	if xd.Kind() == pref.EnumKind {
+	if xd.Kind() == protoreflect.EnumKind {
 		enumName = legacyEnumName(xd.Enum())
 	}
 
@@ -77,16 +77,16 @@ func (xi *ExtensionInfo) initFromLegacy() {
 	// field number is specified. In such a case, use a placeholder.
 	if xi.ExtendedType == nil || xi.ExtensionType == nil {
 		xd := placeholderExtension{
-			name:   pref.FullName(xi.Name),
-			number: pref.FieldNumber(xi.Field),
+			name:   protoreflect.FullName(xi.Name),
+			number: protoreflect.FieldNumber(xi.Field),
 		}
 		xi.desc = extensionTypeDescriptor{xd, xi}
 		return
 	}
 
 	// Resolve enum or message dependencies.
-	var ed pref.EnumDescriptor
-	var md pref.MessageDescriptor
+	var ed protoreflect.EnumDescriptor
+	var md protoreflect.MessageDescriptor
 	t := reflect.TypeOf(xi.ExtensionType)
 	isOptional := t.Kind() == reflect.Ptr && t.Elem().Kind() != reflect.Struct
 	isRepeated := t.Kind() == reflect.Slice && t.Elem().Kind() != reflect.Uint8
@@ -94,18 +94,18 @@ func (xi *ExtensionInfo) initFromLegacy() {
 		t = t.Elem()
 	}
 	switch v := reflect.Zero(t).Interface().(type) {
-	case pref.Enum:
+	case protoreflect.Enum:
 		ed = v.Descriptor()
 	case enumV1:
 		ed = LegacyLoadEnumDesc(t)
-	case pref.ProtoMessage:
+	case protoreflect.ProtoMessage:
 		md = v.ProtoReflect().Descriptor()
 	case messageV1:
 		md = LegacyLoadMessageDesc(t)
 	}
 
 	// Derive basic field information from the struct tag.
-	var evs pref.EnumValueDescriptors
+	var evs protoreflect.EnumValueDescriptors
 	if ed != nil {
 		evs = ed.Values()
 	}
@@ -114,8 +114,8 @@ func (xi *ExtensionInfo) initFromLegacy() {
 	// Construct a v2 ExtensionType.
 	xd := &filedesc.Extension{L2: new(filedesc.ExtensionL2)}
 	xd.L0.ParentFile = filedesc.SurrogateProto2
-	xd.L0.FullName = pref.FullName(xi.Name)
-	xd.L1.Number = pref.FieldNumber(xi.Field)
+	xd.L0.FullName = protoreflect.FullName(xi.Name)
+	xd.L1.Number = protoreflect.FieldNumber(xi.Field)
 	xd.L1.Cardinality = fd.L1.Cardinality
 	xd.L1.Kind = fd.L1.Kind
 	xd.L2.IsPacked = fd.L1.IsPacked
@@ -138,39 +138,39 @@ func (xi *ExtensionInfo) initFromLegacy() {
 }
 
 type placeholderExtension struct {
-	name   pref.FullName
-	number pref.FieldNumber
+	name   protoreflect.FullName
+	number protoreflect.FieldNumber
 }
 
-func (x placeholderExtension) ParentFile() pref.FileDescriptor            { return nil }
-func (x placeholderExtension) Parent() pref.Descriptor                    { return nil }
-func (x placeholderExtension) Index() int                                 { return 0 }
-func (x placeholderExtension) Syntax() pref.Syntax                        { return 0 }
-func (x placeholderExtension) Name() pref.Name                            { return x.name.Name() }
-func (x placeholderExtension) FullName() pref.FullName                    { return x.name }
-func (x placeholderExtension) IsPlaceholder() bool                        { return true }
-func (x placeholderExtension) Options() pref.ProtoMessage                 { return descopts.Field }
-func (x placeholderExtension) Number() pref.FieldNumber                   { return x.number }
-func (x placeholderExtension) Cardinality() pref.Cardinality              { return 0 }
-func (x placeholderExtension) Kind() pref.Kind                            { return 0 }
-func (x placeholderExtension) HasJSONName() bool                          { return false }
-func (x placeholderExtension) JSONName() string                           { return "[" + string(x.name) + "]" }
-func (x placeholderExtension) TextName() string                           { return "[" + string(x.name) + "]" }
-func (x placeholderExtension) HasPresence() bool                          { return false }
-func (x placeholderExtension) HasOptionalKeyword() bool                   { return false }
-func (x placeholderExtension) IsExtension() bool                          { return true }
-func (x placeholderExtension) IsWeak() bool                               { return false }
-func (x placeholderExtension) IsPacked() bool                             { return false }
-func (x placeholderExtension) IsList() bool                               { return false }
-func (x placeholderExtension) IsMap() bool                                { return false }
-func (x placeholderExtension) MapKey() pref.FieldDescriptor               { return nil }
-func (x placeholderExtension) MapValue() pref.FieldDescriptor             { return nil }
-func (x placeholderExtension) HasDefault() bool                           { return false }
-func (x placeholderExtension) Default() pref.Value                        { return pref.Value{} }
-func (x placeholderExtension) DefaultEnumValue() pref.EnumValueDescriptor { return nil }
-func (x placeholderExtension) ContainingOneof() pref.OneofDescriptor      { return nil }
-func (x placeholderExtension) ContainingMessage() pref.MessageDescriptor  { return nil }
-func (x placeholderExtension) Enum() pref.EnumDescriptor                  { return nil }
-func (x placeholderExtension) Message() pref.MessageDescriptor            { return nil }
-func (x placeholderExtension) ProtoType(pref.FieldDescriptor)             { return }
-func (x placeholderExtension) ProtoInternal(pragma.DoNotImplement)        { return }
+func (x placeholderExtension) ParentFile() protoreflect.FileDescriptor            { return nil }
+func (x placeholderExtension) Parent() protoreflect.Descriptor                    { return nil }
+func (x placeholderExtension) Index() int                                         { return 0 }
+func (x placeholderExtension) Syntax() protoreflect.Syntax                        { return 0 }
+func (x placeholderExtension) Name() protoreflect.Name                            { return x.name.Name() }
+func (x placeholderExtension) FullName() protoreflect.FullName                    { return x.name }
+func (x placeholderExtension) IsPlaceholder() bool                                { return true }
+func (x placeholderExtension) Options() protoreflect.ProtoMessage                 { return descopts.Field }
+func (x placeholderExtension) Number() protoreflect.FieldNumber                   { return x.number }
+func (x placeholderExtension) Cardinality() protoreflect.Cardinality              { return 0 }
+func (x placeholderExtension) Kind() protoreflect.Kind                            { return 0 }
+func (x placeholderExtension) HasJSONName() bool                                  { return false }
+func (x placeholderExtension) JSONName() string                                   { return "[" + string(x.name) + "]" }
+func (x placeholderExtension) TextName() string                                   { return "[" + string(x.name) + "]" }
+func (x placeholderExtension) HasPresence() bool                                  { return false }
+func (x placeholderExtension) HasOptionalKeyword() bool                           { return false }
+func (x placeholderExtension) IsExtension() bool                                  { return true }
+func (x placeholderExtension) IsWeak() bool                                       { return false }
+func (x placeholderExtension) IsPacked() bool                                     { return false }
+func (x placeholderExtension) IsList() bool                                       { return false }
+func (x placeholderExtension) IsMap() bool                                        { return false }
+func (x placeholderExtension) MapKey() protoreflect.FieldDescriptor               { return nil }
+func (x placeholderExtension) MapValue() protoreflect.FieldDescriptor             { return nil }
+func (x placeholderExtension) HasDefault() bool                                   { return false }
+func (x placeholderExtension) Default() protoreflect.Value                        { return protoreflect.Value{} }
+func (x placeholderExtension) DefaultEnumValue() protoreflect.EnumValueDescriptor { return nil }
+func (x placeholderExtension) ContainingOneof() protoreflect.OneofDescriptor      { return nil }
+func (x placeholderExtension) ContainingMessage() protoreflect.MessageDescriptor  { return nil }
+func (x placeholderExtension) Enum() protoreflect.EnumDescriptor                  { return nil }
+func (x placeholderExtension) Message() protoreflect.MessageDescriptor            { return nil }
+func (x placeholderExtension) ProtoType(protoreflect.FieldDescriptor)             { return }
+func (x placeholderExtension) ProtoInternal(pragma.DoNotImplement)                { return }
diff --git a/vendor/google.golang.org/protobuf/internal/impl/legacy_message.go b/vendor/google.golang.org/protobuf/internal/impl/legacy_message.go
index 029feeefd7..61c483fac0 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/legacy_message.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/legacy_message.go
@@ -16,14 +16,12 @@ import (
 	"google.golang.org/protobuf/internal/filedesc"
 	"google.golang.org/protobuf/internal/strs"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/runtime/protoiface"
-	piface "google.golang.org/protobuf/runtime/protoiface"
 )
 
 // legacyWrapMessage wraps v as a protoreflect.Message,
 // where v must be a *struct kind and not implement the v2 API already.
-func legacyWrapMessage(v reflect.Value) pref.Message {
+func legacyWrapMessage(v reflect.Value) protoreflect.Message {
 	t := v.Type()
 	if t.Kind() != reflect.Ptr || t.Elem().Kind() != reflect.Struct {
 		return aberrantMessage{v: v}
@@ -35,7 +33,7 @@ func legacyWrapMessage(v reflect.Value) pref.Message {
 // legacyLoadMessageType dynamically loads a protoreflect.Type for t,
 // where t must be not implement the v2 API already.
 // The provided name is used if it cannot be determined from the message.
-func legacyLoadMessageType(t reflect.Type, name pref.FullName) protoreflect.MessageType {
+func legacyLoadMessageType(t reflect.Type, name protoreflect.FullName) protoreflect.MessageType {
 	if t.Kind() != reflect.Ptr || t.Elem().Kind() != reflect.Struct {
 		return aberrantMessageType{t}
 	}
@@ -47,7 +45,7 @@ var legacyMessageTypeCache sync.Map // map[reflect.Type]*MessageInfo
 // legacyLoadMessageInfo dynamically loads a *MessageInfo for t,
 // where t must be a *struct kind and not implement the v2 API already.
 // The provided name is used if it cannot be determined from the message.
-func legacyLoadMessageInfo(t reflect.Type, name pref.FullName) *MessageInfo {
+func legacyLoadMessageInfo(t reflect.Type, name protoreflect.FullName) *MessageInfo {
 	// Fast-path: check if a MessageInfo is cached for this concrete type.
 	if mt, ok := legacyMessageTypeCache.Load(t); ok {
 		return mt.(*MessageInfo)
@@ -68,7 +66,7 @@ func legacyLoadMessageInfo(t reflect.Type, name pref.FullName) *MessageInfo {
 		// supports deterministic serialization or not, but this
 		// preserves the v1 implementation's behavior of always
 		// calling Marshal methods when present.
-		mi.methods.Flags |= piface.SupportMarshalDeterministic
+		mi.methods.Flags |= protoiface.SupportMarshalDeterministic
 	}
 	if _, hasUnmarshal = v.(legacyUnmarshaler); hasUnmarshal {
 		mi.methods.Unmarshal = legacyUnmarshal
@@ -89,18 +87,18 @@ var legacyMessageDescCache sync.Map // map[reflect.Type]protoreflect.MessageDesc
 // which should be a *struct kind and must not implement the v2 API already.
 //
 // This is exported for testing purposes.
-func LegacyLoadMessageDesc(t reflect.Type) pref.MessageDescriptor {
+func LegacyLoadMessageDesc(t reflect.Type) protoreflect.MessageDescriptor {
 	return legacyLoadMessageDesc(t, "")
 }
-func legacyLoadMessageDesc(t reflect.Type, name pref.FullName) pref.MessageDescriptor {
+func legacyLoadMessageDesc(t reflect.Type, name protoreflect.FullName) protoreflect.MessageDescriptor {
 	// Fast-path: check if a MessageDescriptor is cached for this concrete type.
 	if mi, ok := legacyMessageDescCache.Load(t); ok {
-		return mi.(pref.MessageDescriptor)
+		return mi.(protoreflect.MessageDescriptor)
 	}
 
 	// Slow-path: initialize MessageDescriptor from the raw descriptor.
 	mv := reflect.Zero(t).Interface()
-	if _, ok := mv.(pref.ProtoMessage); ok {
+	if _, ok := mv.(protoreflect.ProtoMessage); ok {
 		panic(fmt.Sprintf("%v already implements proto.Message", t))
 	}
 	mdV1, ok := mv.(messageV1)
@@ -164,7 +162,7 @@ var (
 //
 // This is a best-effort derivation of the message descriptor using the protobuf
 // tags on the struct fields.
-func aberrantLoadMessageDesc(t reflect.Type, name pref.FullName) pref.MessageDescriptor {
+func aberrantLoadMessageDesc(t reflect.Type, name protoreflect.FullName) protoreflect.MessageDescriptor {
 	aberrantMessageDescLock.Lock()
 	defer aberrantMessageDescLock.Unlock()
 	if aberrantMessageDescCache == nil {
@@ -172,7 +170,7 @@ func aberrantLoadMessageDesc(t reflect.Type, name pref.FullName) pref.MessageDes
 	}
 	return aberrantLoadMessageDescReentrant(t, name)
 }
-func aberrantLoadMessageDescReentrant(t reflect.Type, name pref.FullName) pref.MessageDescriptor {
+func aberrantLoadMessageDescReentrant(t reflect.Type, name protoreflect.FullName) protoreflect.MessageDescriptor {
 	// Fast-path: check if an MessageDescriptor is cached for this concrete type.
 	if md, ok := aberrantMessageDescCache[t]; ok {
 		return md
@@ -225,9 +223,9 @@ func aberrantLoadMessageDescReentrant(t reflect.Type, name pref.FullName) pref.M
 		vs := fn.Func.Call([]reflect.Value{reflect.Zero(fn.Type.In(0))})[0]
 		for i := 0; i < vs.Len(); i++ {
 			v := vs.Index(i)
-			md.L2.ExtensionRanges.List = append(md.L2.ExtensionRanges.List, [2]pref.FieldNumber{
-				pref.FieldNumber(v.FieldByName("Start").Int()),
-				pref.FieldNumber(v.FieldByName("End").Int() + 1),
+			md.L2.ExtensionRanges.List = append(md.L2.ExtensionRanges.List, [2]protoreflect.FieldNumber{
+				protoreflect.FieldNumber(v.FieldByName("Start").Int()),
+				protoreflect.FieldNumber(v.FieldByName("End").Int() + 1),
 			})
 			md.L2.ExtensionRangeOptions = append(md.L2.ExtensionRangeOptions, nil)
 		}
@@ -245,7 +243,7 @@ func aberrantLoadMessageDescReentrant(t reflect.Type, name pref.FullName) pref.M
 			n := len(md.L2.Oneofs.List)
 			md.L2.Oneofs.List = append(md.L2.Oneofs.List, filedesc.Oneof{})
 			od := &md.L2.Oneofs.List[n]
-			od.L0.FullName = md.FullName().Append(pref.Name(tag))
+			od.L0.FullName = md.FullName().Append(protoreflect.Name(tag))
 			od.L0.ParentFile = md.L0.ParentFile
 			od.L0.Parent = md
 			od.L0.Index = n
@@ -267,14 +265,14 @@ func aberrantLoadMessageDescReentrant(t reflect.Type, name pref.FullName) pref.M
 	return md
 }
 
-func aberrantDeriveMessageName(t reflect.Type, name pref.FullName) pref.FullName {
+func aberrantDeriveMessageName(t reflect.Type, name protoreflect.FullName) protoreflect.FullName {
 	if name.IsValid() {
 		return name
 	}
 	func() {
 		defer func() { recover() }() // swallow possible nil panics
 		if m, ok := reflect.Zero(t).Interface().(interface{ XXX_MessageName() string }); ok {
-			name = pref.FullName(m.XXX_MessageName())
+			name = protoreflect.FullName(m.XXX_MessageName())
 		}
 	}()
 	if name.IsValid() {
@@ -305,7 +303,7 @@ func aberrantAppendField(md *filedesc.Message, goType reflect.Type, tag, tagKey,
 	fd.L0.Index = n
 
 	if fd.L1.IsWeak || fd.L1.HasPacked {
-		fd.L1.Options = func() pref.ProtoMessage {
+		fd.L1.Options = func() protoreflect.ProtoMessage {
 			opts := descopts.Field.ProtoReflect().New()
 			if fd.L1.IsWeak {
 				opts.Set(opts.Descriptor().Fields().ByName("weak"), protoreflect.ValueOfBool(true))
@@ -318,17 +316,17 @@ func aberrantAppendField(md *filedesc.Message, goType reflect.Type, tag, tagKey,
 	}
 
 	// Populate Enum and Message.
-	if fd.Enum() == nil && fd.Kind() == pref.EnumKind {
+	if fd.Enum() == nil && fd.Kind() == protoreflect.EnumKind {
 		switch v := reflect.Zero(t).Interface().(type) {
-		case pref.Enum:
+		case protoreflect.Enum:
 			fd.L1.Enum = v.Descriptor()
 		default:
 			fd.L1.Enum = LegacyLoadEnumDesc(t)
 		}
 	}
-	if fd.Message() == nil && (fd.Kind() == pref.MessageKind || fd.Kind() == pref.GroupKind) {
+	if fd.Message() == nil && (fd.Kind() == protoreflect.MessageKind || fd.Kind() == protoreflect.GroupKind) {
 		switch v := reflect.Zero(t).Interface().(type) {
-		case pref.ProtoMessage:
+		case protoreflect.ProtoMessage:
 			fd.L1.Message = v.ProtoReflect().Descriptor()
 		case messageV1:
 			fd.L1.Message = LegacyLoadMessageDesc(t)
@@ -337,13 +335,13 @@ func aberrantAppendField(md *filedesc.Message, goType reflect.Type, tag, tagKey,
 				n := len(md.L1.Messages.List)
 				md.L1.Messages.List = append(md.L1.Messages.List, filedesc.Message{L2: new(filedesc.MessageL2)})
 				md2 := &md.L1.Messages.List[n]
-				md2.L0.FullName = md.FullName().Append(pref.Name(strs.MapEntryName(string(fd.Name()))))
+				md2.L0.FullName = md.FullName().Append(protoreflect.Name(strs.MapEntryName(string(fd.Name()))))
 				md2.L0.ParentFile = md.L0.ParentFile
 				md2.L0.Parent = md
 				md2.L0.Index = n
 
 				md2.L1.IsMapEntry = true
-				md2.L2.Options = func() pref.ProtoMessage {
+				md2.L2.Options = func() protoreflect.ProtoMessage {
 					opts := descopts.Message.ProtoReflect().New()
 					opts.Set(opts.Descriptor().Fields().ByName("map_entry"), protoreflect.ValueOfBool(true))
 					return opts.Interface()
@@ -364,8 +362,8 @@ type placeholderEnumValues struct {
 	protoreflect.EnumValueDescriptors
 }
 
-func (placeholderEnumValues) ByNumber(n pref.EnumNumber) pref.EnumValueDescriptor {
-	return filedesc.PlaceholderEnumValue(pref.FullName(fmt.Sprintf("UNKNOWN_%d", n)))
+func (placeholderEnumValues) ByNumber(n protoreflect.EnumNumber) protoreflect.EnumValueDescriptor {
+	return filedesc.PlaceholderEnumValue(protoreflect.FullName(fmt.Sprintf("UNKNOWN_%d", n)))
 }
 
 // legacyMarshaler is the proto.Marshaler interface superseded by protoiface.Methoder.
@@ -383,7 +381,7 @@ type legacyMerger interface {
 	Merge(protoiface.MessageV1)
 }
 
-var aberrantProtoMethods = &piface.Methods{
+var aberrantProtoMethods = &protoiface.Methods{
 	Marshal:   legacyMarshal,
 	Unmarshal: legacyUnmarshal,
 	Merge:     legacyMerge,
@@ -392,40 +390,40 @@ var aberrantProtoMethods = &piface.Methods{
 	// supports deterministic serialization or not, but this
 	// preserves the v1 implementation's behavior of always
 	// calling Marshal methods when present.
-	Flags: piface.SupportMarshalDeterministic,
+	Flags: protoiface.SupportMarshalDeterministic,
 }
 
-func legacyMarshal(in piface.MarshalInput) (piface.MarshalOutput, error) {
+func legacyMarshal(in protoiface.MarshalInput) (protoiface.MarshalOutput, error) {
 	v := in.Message.(unwrapper).protoUnwrap()
 	marshaler, ok := v.(legacyMarshaler)
 	if !ok {
-		return piface.MarshalOutput{}, errors.New("%T does not implement Marshal", v)
+		return protoiface.MarshalOutput{}, errors.New("%T does not implement Marshal", v)
 	}
 	out, err := marshaler.Marshal()
 	if in.Buf != nil {
 		out = append(in.Buf, out...)
 	}
-	return piface.MarshalOutput{
+	return protoiface.MarshalOutput{
 		Buf: out,
 	}, err
 }
 
-func legacyUnmarshal(in piface.UnmarshalInput) (piface.UnmarshalOutput, error) {
+func legacyUnmarshal(in protoiface.UnmarshalInput) (protoiface.UnmarshalOutput, error) {
 	v := in.Message.(unwrapper).protoUnwrap()
 	unmarshaler, ok := v.(legacyUnmarshaler)
 	if !ok {
-		return piface.UnmarshalOutput{}, errors.New("%T does not implement Unmarshal", v)
+		return protoiface.UnmarshalOutput{}, errors.New("%T does not implement Unmarshal", v)
 	}
-	return piface.UnmarshalOutput{}, unmarshaler.Unmarshal(in.Buf)
+	return protoiface.UnmarshalOutput{}, unmarshaler.Unmarshal(in.Buf)
 }
 
-func legacyMerge(in piface.MergeInput) piface.MergeOutput {
+func legacyMerge(in protoiface.MergeInput) protoiface.MergeOutput {
 	// Check whether this supports the legacy merger.
 	dstv := in.Destination.(unwrapper).protoUnwrap()
 	merger, ok := dstv.(legacyMerger)
 	if ok {
 		merger.Merge(Export{}.ProtoMessageV1Of(in.Source))
-		return piface.MergeOutput{Flags: piface.MergeComplete}
+		return protoiface.MergeOutput{Flags: protoiface.MergeComplete}
 	}
 
 	// If legacy merger is unavailable, implement merge in terms of
@@ -433,29 +431,29 @@ func legacyMerge(in piface.MergeInput) piface.MergeOutput {
 	srcv := in.Source.(unwrapper).protoUnwrap()
 	marshaler, ok := srcv.(legacyMarshaler)
 	if !ok {
-		return piface.MergeOutput{}
+		return protoiface.MergeOutput{}
 	}
 	dstv = in.Destination.(unwrapper).protoUnwrap()
 	unmarshaler, ok := dstv.(legacyUnmarshaler)
 	if !ok {
-		return piface.MergeOutput{}
+		return protoiface.MergeOutput{}
 	}
 	if !in.Source.IsValid() {
 		// Legacy Marshal methods may not function on nil messages.
 		// Check for a typed nil source only after we confirm that
 		// legacy Marshal/Unmarshal methods are present, for
 		// consistency.
-		return piface.MergeOutput{Flags: piface.MergeComplete}
+		return protoiface.MergeOutput{Flags: protoiface.MergeComplete}
 	}
 	b, err := marshaler.Marshal()
 	if err != nil {
-		return piface.MergeOutput{}
+		return protoiface.MergeOutput{}
 	}
 	err = unmarshaler.Unmarshal(b)
 	if err != nil {
-		return piface.MergeOutput{}
+		return protoiface.MergeOutput{}
 	}
-	return piface.MergeOutput{Flags: piface.MergeComplete}
+	return protoiface.MergeOutput{Flags: protoiface.MergeComplete}
 }
 
 // aberrantMessageType implements MessageType for all types other than pointer-to-struct.
@@ -463,19 +461,19 @@ type aberrantMessageType struct {
 	t reflect.Type
 }
 
-func (mt aberrantMessageType) New() pref.Message {
+func (mt aberrantMessageType) New() protoreflect.Message {
 	if mt.t.Kind() == reflect.Ptr {
 		return aberrantMessage{reflect.New(mt.t.Elem())}
 	}
 	return aberrantMessage{reflect.Zero(mt.t)}
 }
-func (mt aberrantMessageType) Zero() pref.Message {
+func (mt aberrantMessageType) Zero() protoreflect.Message {
 	return aberrantMessage{reflect.Zero(mt.t)}
 }
 func (mt aberrantMessageType) GoType() reflect.Type {
 	return mt.t
 }
-func (mt aberrantMessageType) Descriptor() pref.MessageDescriptor {
+func (mt aberrantMessageType) Descriptor() protoreflect.MessageDescriptor {
 	return LegacyLoadMessageDesc(mt.t)
 }
 
@@ -499,56 +497,56 @@ func (m aberrantMessage) Reset() {
 	}
 }
 
-func (m aberrantMessage) ProtoReflect() pref.Message {
+func (m aberrantMessage) ProtoReflect() protoreflect.Message {
 	return m
 }
 
-func (m aberrantMessage) Descriptor() pref.MessageDescriptor {
+func (m aberrantMessage) Descriptor() protoreflect.MessageDescriptor {
 	return LegacyLoadMessageDesc(m.v.Type())
 }
-func (m aberrantMessage) Type() pref.MessageType {
+func (m aberrantMessage) Type() protoreflect.MessageType {
 	return aberrantMessageType{m.v.Type()}
 }
-func (m aberrantMessage) New() pref.Message {
+func (m aberrantMessage) New() protoreflect.Message {
 	if m.v.Type().Kind() == reflect.Ptr {
 		return aberrantMessage{reflect.New(m.v.Type().Elem())}
 	}
 	return aberrantMessage{reflect.Zero(m.v.Type())}
 }
-func (m aberrantMessage) Interface() pref.ProtoMessage {
+func (m aberrantMessage) Interface() protoreflect.ProtoMessage {
 	return m
 }
-func (m aberrantMessage) Range(f func(pref.FieldDescriptor, pref.Value) bool) {
+func (m aberrantMessage) Range(f func(protoreflect.FieldDescriptor, protoreflect.Value) bool) {
 	return
 }
-func (m aberrantMessage) Has(pref.FieldDescriptor) bool {
+func (m aberrantMessage) Has(protoreflect.FieldDescriptor) bool {
 	return false
 }
-func (m aberrantMessage) Clear(pref.FieldDescriptor) {
+func (m aberrantMessage) Clear(protoreflect.FieldDescriptor) {
 	panic("invalid Message.Clear on " + string(m.Descriptor().FullName()))
 }
-func (m aberrantMessage) Get(fd pref.FieldDescriptor) pref.Value {
+func (m aberrantMessage) Get(fd protoreflect.FieldDescriptor) protoreflect.Value {
 	if fd.Default().IsValid() {
 		return fd.Default()
 	}
 	panic("invalid Message.Get on " + string(m.Descriptor().FullName()))
 }
-func (m aberrantMessage) Set(pref.FieldDescriptor, pref.Value) {
+func (m aberrantMessage) Set(protoreflect.FieldDescriptor, protoreflect.Value) {
 	panic("invalid Message.Set on " + string(m.Descriptor().FullName()))
 }
-func (m aberrantMessage) Mutable(pref.FieldDescriptor) pref.Value {
+func (m aberrantMessage) Mutable(protoreflect.FieldDescriptor) protoreflect.Value {
 	panic("invalid Message.Mutable on " + string(m.Descriptor().FullName()))
 }
-func (m aberrantMessage) NewField(pref.FieldDescriptor) pref.Value {
+func (m aberrantMessage) NewField(protoreflect.FieldDescriptor) protoreflect.Value {
 	panic("invalid Message.NewField on " + string(m.Descriptor().FullName()))
 }
-func (m aberrantMessage) WhichOneof(pref.OneofDescriptor) pref.FieldDescriptor {
+func (m aberrantMessage) WhichOneof(protoreflect.OneofDescriptor) protoreflect.FieldDescriptor {
 	panic("invalid Message.WhichOneof descriptor on " + string(m.Descriptor().FullName()))
 }
-func (m aberrantMessage) GetUnknown() pref.RawFields {
+func (m aberrantMessage) GetUnknown() protoreflect.RawFields {
 	return nil
 }
-func (m aberrantMessage) SetUnknown(pref.RawFields) {
+func (m aberrantMessage) SetUnknown(protoreflect.RawFields) {
 	// SetUnknown discards its input on messages which don't support unknown field storage.
 }
 func (m aberrantMessage) IsValid() bool {
@@ -557,7 +555,7 @@ func (m aberrantMessage) IsValid() bool {
 	}
 	return false
 }
-func (m aberrantMessage) ProtoMethods() *piface.Methods {
+func (m aberrantMessage) ProtoMethods() *protoiface.Methods {
 	return aberrantProtoMethods
 }
 func (m aberrantMessage) protoUnwrap() interface{} {
diff --git a/vendor/google.golang.org/protobuf/internal/impl/merge.go b/vendor/google.golang.org/protobuf/internal/impl/merge.go
index c65bbc0446..7e65f64f28 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/merge.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/merge.go
@@ -9,8 +9,8 @@ import (
 	"reflect"
 
 	"google.golang.org/protobuf/proto"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 type mergeOptions struct{}
@@ -20,17 +20,17 @@ func (o mergeOptions) Merge(dst, src proto.Message) {
 }
 
 // merge is protoreflect.Methods.Merge.
-func (mi *MessageInfo) merge(in piface.MergeInput) piface.MergeOutput {
+func (mi *MessageInfo) merge(in protoiface.MergeInput) protoiface.MergeOutput {
 	dp, ok := mi.getPointer(in.Destination)
 	if !ok {
-		return piface.MergeOutput{}
+		return protoiface.MergeOutput{}
 	}
 	sp, ok := mi.getPointer(in.Source)
 	if !ok {
-		return piface.MergeOutput{}
+		return protoiface.MergeOutput{}
 	}
 	mi.mergePointer(dp, sp, mergeOptions{})
-	return piface.MergeOutput{Flags: piface.MergeComplete}
+	return protoiface.MergeOutput{Flags: protoiface.MergeComplete}
 }
 
 func (mi *MessageInfo) mergePointer(dst, src pointer, opts mergeOptions) {
@@ -64,7 +64,7 @@ func (mi *MessageInfo) mergePointer(dst, src pointer, opts mergeOptions) {
 				continue
 			}
 			dx := (*dext)[num]
-			var dv pref.Value
+			var dv protoreflect.Value
 			if dx.Type() == sx.Type() {
 				dv = dx.Value()
 			}
@@ -85,15 +85,15 @@ func (mi *MessageInfo) mergePointer(dst, src pointer, opts mergeOptions) {
 	}
 }
 
-func mergeScalarValue(dst, src pref.Value, opts mergeOptions) pref.Value {
+func mergeScalarValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
 	return src
 }
 
-func mergeBytesValue(dst, src pref.Value, opts mergeOptions) pref.Value {
-	return pref.ValueOfBytes(append(emptyBuf[:], src.Bytes()...))
+func mergeBytesValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
+	return protoreflect.ValueOfBytes(append(emptyBuf[:], src.Bytes()...))
 }
 
-func mergeListValue(dst, src pref.Value, opts mergeOptions) pref.Value {
+func mergeListValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
 	dstl := dst.List()
 	srcl := src.List()
 	for i, llen := 0, srcl.Len(); i < llen; i++ {
@@ -102,29 +102,29 @@ func mergeListValue(dst, src pref.Value, opts mergeOptions) pref.Value {
 	return dst
 }
 
-func mergeBytesListValue(dst, src pref.Value, opts mergeOptions) pref.Value {
+func mergeBytesListValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
 	dstl := dst.List()
 	srcl := src.List()
 	for i, llen := 0, srcl.Len(); i < llen; i++ {
 		sb := srcl.Get(i).Bytes()
 		db := append(emptyBuf[:], sb...)
-		dstl.Append(pref.ValueOfBytes(db))
+		dstl.Append(protoreflect.ValueOfBytes(db))
 	}
 	return dst
 }
 
-func mergeMessageListValue(dst, src pref.Value, opts mergeOptions) pref.Value {
+func mergeMessageListValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
 	dstl := dst.List()
 	srcl := src.List()
 	for i, llen := 0, srcl.Len(); i < llen; i++ {
 		sm := srcl.Get(i).Message()
 		dm := proto.Clone(sm.Interface()).ProtoReflect()
-		dstl.Append(pref.ValueOfMessage(dm))
+		dstl.Append(protoreflect.ValueOfMessage(dm))
 	}
 	return dst
 }
 
-func mergeMessageValue(dst, src pref.Value, opts mergeOptions) pref.Value {
+func mergeMessageValue(dst, src protoreflect.Value, opts mergeOptions) protoreflect.Value {
 	opts.Merge(dst.Message().Interface(), src.Message().Interface())
 	return dst
 }
diff --git a/vendor/google.golang.org/protobuf/internal/impl/message.go b/vendor/google.golang.org/protobuf/internal/impl/message.go
index a104e28e85..4f5fb67a0d 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/message.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/message.go
@@ -14,8 +14,7 @@ import (
 
 	"google.golang.org/protobuf/internal/genid"
 	"google.golang.org/protobuf/reflect/protoreflect"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
 // MessageInfo provides protobuf related functionality for a given Go type
@@ -29,7 +28,7 @@ type MessageInfo struct {
 	GoReflectType reflect.Type // pointer to struct
 
 	// Desc is the underlying message descriptor type and must be populated.
-	Desc pref.MessageDescriptor
+	Desc protoreflect.MessageDescriptor
 
 	// Exporter must be provided in a purego environment in order to provide
 	// access to unexported fields.
@@ -54,7 +53,7 @@ type exporter func(v interface{}, i int) interface{}
 // is generated by our implementation of protoc-gen-go (for v2 and on).
 // If it is unable to obtain a MessageInfo, it returns nil.
 func getMessageInfo(mt reflect.Type) *MessageInfo {
-	m, ok := reflect.Zero(mt).Interface().(pref.ProtoMessage)
+	m, ok := reflect.Zero(mt).Interface().(protoreflect.ProtoMessage)
 	if !ok {
 		return nil
 	}
@@ -97,7 +96,7 @@ func (mi *MessageInfo) initOnce() {
 // getPointer returns the pointer for a message, which should be of
 // the type of the MessageInfo. If the message is of a different type,
 // it returns ok==false.
-func (mi *MessageInfo) getPointer(m pref.Message) (p pointer, ok bool) {
+func (mi *MessageInfo) getPointer(m protoreflect.Message) (p pointer, ok bool) {
 	switch m := m.(type) {
 	case *messageState:
 		return m.pointer(), m.messageInfo() == mi
@@ -134,10 +133,10 @@ type structInfo struct {
 	extensionOffset offset
 	extensionType   reflect.Type
 
-	fieldsByNumber        map[pref.FieldNumber]reflect.StructField
-	oneofsByName          map[pref.Name]reflect.StructField
-	oneofWrappersByType   map[reflect.Type]pref.FieldNumber
-	oneofWrappersByNumber map[pref.FieldNumber]reflect.Type
+	fieldsByNumber        map[protoreflect.FieldNumber]reflect.StructField
+	oneofsByName          map[protoreflect.Name]reflect.StructField
+	oneofWrappersByType   map[reflect.Type]protoreflect.FieldNumber
+	oneofWrappersByNumber map[protoreflect.FieldNumber]reflect.Type
 }
 
 func (mi *MessageInfo) makeStructInfo(t reflect.Type) structInfo {
@@ -147,10 +146,10 @@ func (mi *MessageInfo) makeStructInfo(t reflect.Type) structInfo {
 		unknownOffset:   invalidOffset,
 		extensionOffset: invalidOffset,
 
-		fieldsByNumber:        map[pref.FieldNumber]reflect.StructField{},
-		oneofsByName:          map[pref.Name]reflect.StructField{},
-		oneofWrappersByType:   map[reflect.Type]pref.FieldNumber{},
-		oneofWrappersByNumber: map[pref.FieldNumber]reflect.Type{},
+		fieldsByNumber:        map[protoreflect.FieldNumber]reflect.StructField{},
+		oneofsByName:          map[protoreflect.Name]reflect.StructField{},
+		oneofWrappersByType:   map[reflect.Type]protoreflect.FieldNumber{},
+		oneofWrappersByNumber: map[protoreflect.FieldNumber]reflect.Type{},
 	}
 
 fieldLoop:
@@ -180,12 +179,12 @@ fieldLoop:
 			for _, s := range strings.Split(f.Tag.Get("protobuf"), ",") {
 				if len(s) > 0 && strings.Trim(s, "0123456789") == "" {
 					n, _ := strconv.ParseUint(s, 10, 64)
-					si.fieldsByNumber[pref.FieldNumber(n)] = f
+					si.fieldsByNumber[protoreflect.FieldNumber(n)] = f
 					continue fieldLoop
 				}
 			}
 			if s := f.Tag.Get("protobuf_oneof"); len(s) > 0 {
-				si.oneofsByName[pref.Name(s)] = f
+				si.oneofsByName[protoreflect.Name(s)] = f
 				continue fieldLoop
 			}
 		}
@@ -208,8 +207,8 @@ fieldLoop:
 		for _, s := range strings.Split(f.Tag.Get("protobuf"), ",") {
 			if len(s) > 0 && strings.Trim(s, "0123456789") == "" {
 				n, _ := strconv.ParseUint(s, 10, 64)
-				si.oneofWrappersByType[tf] = pref.FieldNumber(n)
-				si.oneofWrappersByNumber[pref.FieldNumber(n)] = tf
+				si.oneofWrappersByType[tf] = protoreflect.FieldNumber(n)
+				si.oneofWrappersByNumber[protoreflect.FieldNumber(n)] = tf
 				break
 			}
 		}
@@ -219,7 +218,11 @@ fieldLoop:
 }
 
 func (mi *MessageInfo) New() protoreflect.Message {
-	return mi.MessageOf(reflect.New(mi.GoReflectType.Elem()).Interface())
+	m := reflect.New(mi.GoReflectType.Elem()).Interface()
+	if r, ok := m.(protoreflect.ProtoMessage); ok {
+		return r.ProtoReflect()
+	}
+	return mi.MessageOf(m)
 }
 func (mi *MessageInfo) Zero() protoreflect.Message {
 	return mi.MessageOf(reflect.Zero(mi.GoReflectType).Interface())
@@ -237,7 +240,7 @@ func (mi *MessageInfo) Message(i int) protoreflect.MessageType {
 	fd := mi.Desc.Fields().Get(i)
 	switch {
 	case fd.IsWeak():
-		mt, _ := preg.GlobalTypes.FindMessageByName(fd.Message().FullName())
+		mt, _ := protoregistry.GlobalTypes.FindMessageByName(fd.Message().FullName())
 		return mt
 	case fd.IsMap():
 		return mapEntryType{fd.Message(), mi.fieldTypes[fd.Number()]}
diff --git a/vendor/google.golang.org/protobuf/internal/impl/message_reflect.go b/vendor/google.golang.org/protobuf/internal/impl/message_reflect.go
index 9488b72613..d9ea010bef 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/message_reflect.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/message_reflect.go
@@ -10,17 +10,17 @@ import (
 
 	"google.golang.org/protobuf/internal/detrand"
 	"google.golang.org/protobuf/internal/pragma"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type reflectMessageInfo struct {
-	fields map[pref.FieldNumber]*fieldInfo
-	oneofs map[pref.Name]*oneofInfo
+	fields map[protoreflect.FieldNumber]*fieldInfo
+	oneofs map[protoreflect.Name]*oneofInfo
 
 	// fieldTypes contains the zero value of an enum or message field.
 	// For lists, it contains the element type.
 	// For maps, it contains the entry value type.
-	fieldTypes map[pref.FieldNumber]interface{}
+	fieldTypes map[protoreflect.FieldNumber]interface{}
 
 	// denseFields is a subset of fields where:
 	//	0 < fieldDesc.Number() < len(denseFields)
@@ -30,8 +30,8 @@ type reflectMessageInfo struct {
 	// rangeInfos is a list of all fields (not belonging to a oneof) and oneofs.
 	rangeInfos []interface{} // either *fieldInfo or *oneofInfo
 
-	getUnknown   func(pointer) pref.RawFields
-	setUnknown   func(pointer, pref.RawFields)
+	getUnknown   func(pointer) protoreflect.RawFields
+	setUnknown   func(pointer, protoreflect.RawFields)
 	extensionMap func(pointer) *extensionMap
 
 	nilMessage atomicNilMessage
@@ -52,7 +52,7 @@ func (mi *MessageInfo) makeReflectFuncs(t reflect.Type, si structInfo) {
 // This code assumes that the struct is well-formed and panics if there are
 // any discrepancies.
 func (mi *MessageInfo) makeKnownFieldsFunc(si structInfo) {
-	mi.fields = map[pref.FieldNumber]*fieldInfo{}
+	mi.fields = map[protoreflect.FieldNumber]*fieldInfo{}
 	md := mi.Desc
 	fds := md.Fields()
 	for i := 0; i < fds.Len(); i++ {
@@ -82,7 +82,7 @@ func (mi *MessageInfo) makeKnownFieldsFunc(si structInfo) {
 		mi.fields[fd.Number()] = &fi
 	}
 
-	mi.oneofs = map[pref.Name]*oneofInfo{}
+	mi.oneofs = map[protoreflect.Name]*oneofInfo{}
 	for i := 0; i < md.Oneofs().Len(); i++ {
 		od := md.Oneofs().Get(i)
 		mi.oneofs[od.Name()] = makeOneofInfo(od, si, mi.Exporter)
@@ -117,13 +117,13 @@ func (mi *MessageInfo) makeUnknownFieldsFunc(t reflect.Type, si structInfo) {
 	switch {
 	case si.unknownOffset.IsValid() && si.unknownType == unknownFieldsAType:
 		// Handle as []byte.
-		mi.getUnknown = func(p pointer) pref.RawFields {
+		mi.getUnknown = func(p pointer) protoreflect.RawFields {
 			if p.IsNil() {
 				return nil
 			}
 			return *p.Apply(mi.unknownOffset).Bytes()
 		}
-		mi.setUnknown = func(p pointer, b pref.RawFields) {
+		mi.setUnknown = func(p pointer, b protoreflect.RawFields) {
 			if p.IsNil() {
 				panic("invalid SetUnknown on nil Message")
 			}
@@ -131,7 +131,7 @@ func (mi *MessageInfo) makeUnknownFieldsFunc(t reflect.Type, si structInfo) {
 		}
 	case si.unknownOffset.IsValid() && si.unknownType == unknownFieldsBType:
 		// Handle as *[]byte.
-		mi.getUnknown = func(p pointer) pref.RawFields {
+		mi.getUnknown = func(p pointer) protoreflect.RawFields {
 			if p.IsNil() {
 				return nil
 			}
@@ -141,7 +141,7 @@ func (mi *MessageInfo) makeUnknownFieldsFunc(t reflect.Type, si structInfo) {
 			}
 			return **bp
 		}
-		mi.setUnknown = func(p pointer, b pref.RawFields) {
+		mi.setUnknown = func(p pointer, b protoreflect.RawFields) {
 			if p.IsNil() {
 				panic("invalid SetUnknown on nil Message")
 			}
@@ -152,10 +152,10 @@ func (mi *MessageInfo) makeUnknownFieldsFunc(t reflect.Type, si structInfo) {
 			**bp = b
 		}
 	default:
-		mi.getUnknown = func(pointer) pref.RawFields {
+		mi.getUnknown = func(pointer) protoreflect.RawFields {
 			return nil
 		}
-		mi.setUnknown = func(p pointer, _ pref.RawFields) {
+		mi.setUnknown = func(p pointer, _ protoreflect.RawFields) {
 			if p.IsNil() {
 				panic("invalid SetUnknown on nil Message")
 			}
@@ -224,7 +224,7 @@ func (mi *MessageInfo) makeFieldTypes(si structInfo) {
 		}
 		if ft != nil {
 			if mi.fieldTypes == nil {
-				mi.fieldTypes = make(map[pref.FieldNumber]interface{})
+				mi.fieldTypes = make(map[protoreflect.FieldNumber]interface{})
 			}
 			mi.fieldTypes[fd.Number()] = reflect.Zero(ft).Interface()
 		}
@@ -233,7 +233,7 @@ func (mi *MessageInfo) makeFieldTypes(si structInfo) {
 
 type extensionMap map[int32]ExtensionField
 
-func (m *extensionMap) Range(f func(pref.FieldDescriptor, pref.Value) bool) {
+func (m *extensionMap) Range(f func(protoreflect.FieldDescriptor, protoreflect.Value) bool) {
 	if m != nil {
 		for _, x := range *m {
 			xd := x.Type().TypeDescriptor()
@@ -247,7 +247,7 @@ func (m *extensionMap) Range(f func(pref.FieldDescriptor, pref.Value) bool) {
 		}
 	}
 }
-func (m *extensionMap) Has(xt pref.ExtensionType) (ok bool) {
+func (m *extensionMap) Has(xt protoreflect.ExtensionType) (ok bool) {
 	if m == nil {
 		return false
 	}
@@ -266,10 +266,10 @@ func (m *extensionMap) Has(xt pref.ExtensionType) (ok bool) {
 	}
 	return true
 }
-func (m *extensionMap) Clear(xt pref.ExtensionType) {
+func (m *extensionMap) Clear(xt protoreflect.ExtensionType) {
 	delete(*m, int32(xt.TypeDescriptor().Number()))
 }
-func (m *extensionMap) Get(xt pref.ExtensionType) pref.Value {
+func (m *extensionMap) Get(xt protoreflect.ExtensionType) protoreflect.Value {
 	xd := xt.TypeDescriptor()
 	if m != nil {
 		if x, ok := (*m)[int32(xd.Number())]; ok {
@@ -278,7 +278,7 @@ func (m *extensionMap) Get(xt pref.ExtensionType) pref.Value {
 	}
 	return xt.Zero()
 }
-func (m *extensionMap) Set(xt pref.ExtensionType, v pref.Value) {
+func (m *extensionMap) Set(xt protoreflect.ExtensionType, v protoreflect.Value) {
 	xd := xt.TypeDescriptor()
 	isValid := true
 	switch {
@@ -302,9 +302,9 @@ func (m *extensionMap) Set(xt pref.ExtensionType, v pref.Value) {
 	x.Set(xt, v)
 	(*m)[int32(xd.Number())] = x
 }
-func (m *extensionMap) Mutable(xt pref.ExtensionType) pref.Value {
+func (m *extensionMap) Mutable(xt protoreflect.ExtensionType) protoreflect.Value {
 	xd := xt.TypeDescriptor()
-	if xd.Kind() != pref.MessageKind && xd.Kind() != pref.GroupKind && !xd.IsList() && !xd.IsMap() {
+	if xd.Kind() != protoreflect.MessageKind && xd.Kind() != protoreflect.GroupKind && !xd.IsList() && !xd.IsMap() {
 		panic("invalid Mutable on field with non-composite type")
 	}
 	if x, ok := (*m)[int32(xd.Number())]; ok {
@@ -320,7 +320,6 @@ func (m *extensionMap) Mutable(xt pref.ExtensionType) pref.Value {
 // in an allocation-free way without needing to have a shadow Go type generated
 // for every message type. This technique only works using unsafe.
 //
-//
 // Example generated code:
 //
 //	type M struct {
@@ -351,12 +350,11 @@ func (m *extensionMap) Mutable(xt pref.ExtensionType) pref.Value {
 // It has access to the message info as its first field, and a pointer to the
 // MessageState is identical to a pointer to the concrete message value.
 //
-//
 // Requirements:
-//	• The type M must implement protoreflect.ProtoMessage.
-//	• The address of m must not be nil.
-//	• The address of m and the address of m.state must be equal,
-//	even though they are different Go types.
+//   - The type M must implement protoreflect.ProtoMessage.
+//   - The address of m must not be nil.
+//   - The address of m and the address of m.state must be equal,
+//     even though they are different Go types.
 type MessageState struct {
 	pragma.NoUnkeyedLiterals
 	pragma.DoNotCompare
@@ -368,8 +366,8 @@ type MessageState struct {
 type messageState MessageState
 
 var (
-	_ pref.Message = (*messageState)(nil)
-	_ unwrapper    = (*messageState)(nil)
+	_ protoreflect.Message = (*messageState)(nil)
+	_ unwrapper            = (*messageState)(nil)
 )
 
 // messageDataType is a tuple of a pointer to the message data and
@@ -387,16 +385,16 @@ type (
 )
 
 var (
-	_ pref.Message      = (*messageReflectWrapper)(nil)
-	_ unwrapper         = (*messageReflectWrapper)(nil)
-	_ pref.ProtoMessage = (*messageIfaceWrapper)(nil)
-	_ unwrapper         = (*messageIfaceWrapper)(nil)
+	_ protoreflect.Message      = (*messageReflectWrapper)(nil)
+	_ unwrapper                 = (*messageReflectWrapper)(nil)
+	_ protoreflect.ProtoMessage = (*messageIfaceWrapper)(nil)
+	_ unwrapper                 = (*messageIfaceWrapper)(nil)
 )
 
 // MessageOf returns a reflective view over a message. The input must be a
 // pointer to a named Go struct. If the provided type has a ProtoReflect method,
 // it must be implemented by calling this method.
-func (mi *MessageInfo) MessageOf(m interface{}) pref.Message {
+func (mi *MessageInfo) MessageOf(m interface{}) protoreflect.Message {
 	if reflect.TypeOf(m) != mi.GoReflectType {
 		panic(fmt.Sprintf("type mismatch: got %T, want %v", m, mi.GoReflectType))
 	}
@@ -421,7 +419,7 @@ func (m *messageIfaceWrapper) Reset() {
 		rv.Elem().Set(reflect.Zero(rv.Type().Elem()))
 	}
 }
-func (m *messageIfaceWrapper) ProtoReflect() pref.Message {
+func (m *messageIfaceWrapper) ProtoReflect() protoreflect.Message {
 	return (*messageReflectWrapper)(m)
 }
 func (m *messageIfaceWrapper) protoUnwrap() interface{} {
@@ -430,7 +428,7 @@ func (m *messageIfaceWrapper) protoUnwrap() interface{} {
 
 // checkField verifies that the provided field descriptor is valid.
 // Exactly one of the returned values is populated.
-func (mi *MessageInfo) checkField(fd pref.FieldDescriptor) (*fieldInfo, pref.ExtensionType) {
+func (mi *MessageInfo) checkField(fd protoreflect.FieldDescriptor) (*fieldInfo, protoreflect.ExtensionType) {
 	var fi *fieldInfo
 	if n := fd.Number(); 0 < n && int(n) < len(mi.denseFields) {
 		fi = mi.denseFields[n]
@@ -455,7 +453,7 @@ func (mi *MessageInfo) checkField(fd pref.FieldDescriptor) (*fieldInfo, pref.Ext
 		if !mi.Desc.ExtensionRanges().Has(fd.Number()) {
 			panic(fmt.Sprintf("extension %v extends %v outside the extension range", fd.FullName(), mi.Desc.FullName()))
 		}
-		xtd, ok := fd.(pref.ExtensionTypeDescriptor)
+		xtd, ok := fd.(protoreflect.ExtensionTypeDescriptor)
 		if !ok {
 			panic(fmt.Sprintf("extension %v does not implement protoreflect.ExtensionTypeDescriptor", fd.FullName()))
 		}
diff --git a/vendor/google.golang.org/protobuf/internal/impl/message_reflect_field.go b/vendor/google.golang.org/protobuf/internal/impl/message_reflect_field.go
index 343cf87219..5e736c60ef 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/message_reflect_field.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/message_reflect_field.go
@@ -11,24 +11,24 @@ import (
 	"sync"
 
 	"google.golang.org/protobuf/internal/flags"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
 type fieldInfo struct {
-	fieldDesc pref.FieldDescriptor
+	fieldDesc protoreflect.FieldDescriptor
 
 	// These fields are used for protobuf reflection support.
 	has        func(pointer) bool
 	clear      func(pointer)
-	get        func(pointer) pref.Value
-	set        func(pointer, pref.Value)
-	mutable    func(pointer) pref.Value
-	newMessage func() pref.Message
-	newField   func() pref.Value
+	get        func(pointer) protoreflect.Value
+	set        func(pointer, protoreflect.Value)
+	mutable    func(pointer) protoreflect.Value
+	newMessage func() protoreflect.Message
+	newField   func() protoreflect.Value
 }
 
-func fieldInfoForMissing(fd pref.FieldDescriptor) fieldInfo {
+func fieldInfoForMissing(fd protoreflect.FieldDescriptor) fieldInfo {
 	// This never occurs for generated message types.
 	// It implies that a hand-crafted type has missing Go fields
 	// for specific protobuf message fields.
@@ -40,19 +40,19 @@ func fieldInfoForMissing(fd pref.FieldDescriptor) fieldInfo {
 		clear: func(p pointer) {
 			panic("missing Go struct field for " + string(fd.FullName()))
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			return fd.Default()
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			panic("missing Go struct field for " + string(fd.FullName()))
 		},
-		mutable: func(p pointer) pref.Value {
+		mutable: func(p pointer) protoreflect.Value {
 			panic("missing Go struct field for " + string(fd.FullName()))
 		},
-		newMessage: func() pref.Message {
+		newMessage: func() protoreflect.Message {
 			panic("missing Go struct field for " + string(fd.FullName()))
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			if v := fd.Default(); v.IsValid() {
 				return v
 			}
@@ -61,7 +61,7 @@ func fieldInfoForMissing(fd pref.FieldDescriptor) fieldInfo {
 	}
 }
 
-func fieldInfoForOneof(fd pref.FieldDescriptor, fs reflect.StructField, x exporter, ot reflect.Type) fieldInfo {
+func fieldInfoForOneof(fd protoreflect.FieldDescriptor, fs reflect.StructField, x exporter, ot reflect.Type) fieldInfo {
 	ft := fs.Type
 	if ft.Kind() != reflect.Interface {
 		panic(fmt.Sprintf("field %v has invalid type: got %v, want interface kind", fd.FullName(), ft))
@@ -102,7 +102,7 @@ func fieldInfoForOneof(fd pref.FieldDescriptor, fs reflect.StructField, x export
 			}
 			rv.Set(reflect.Zero(rv.Type()))
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			if p.IsNil() {
 				return conv.Zero()
 			}
@@ -113,7 +113,7 @@ func fieldInfoForOneof(fd pref.FieldDescriptor, fs reflect.StructField, x export
 			rv = rv.Elem().Elem().Field(0)
 			return conv.PBValueOf(rv)
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			if rv.IsNil() || rv.Elem().Type().Elem() != ot || rv.Elem().IsNil() {
 				rv.Set(reflect.New(ot))
@@ -121,7 +121,7 @@ func fieldInfoForOneof(fd pref.FieldDescriptor, fs reflect.StructField, x export
 			rv = rv.Elem().Elem().Field(0)
 			rv.Set(conv.GoValueOf(v))
 		},
-		mutable: func(p pointer) pref.Value {
+		mutable: func(p pointer) protoreflect.Value {
 			if !isMessage {
 				panic(fmt.Sprintf("field %v with invalid Mutable call on field with non-composite type", fd.FullName()))
 			}
@@ -131,20 +131,20 @@ func fieldInfoForOneof(fd pref.FieldDescriptor, fs reflect.StructField, x export
 			}
 			rv = rv.Elem().Elem().Field(0)
 			if rv.Kind() == reflect.Ptr && rv.IsNil() {
-				rv.Set(conv.GoValueOf(pref.ValueOfMessage(conv.New().Message())))
+				rv.Set(conv.GoValueOf(protoreflect.ValueOfMessage(conv.New().Message())))
 			}
 			return conv.PBValueOf(rv)
 		},
-		newMessage: func() pref.Message {
+		newMessage: func() protoreflect.Message {
 			return conv.New().Message()
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			return conv.New()
 		},
 	}
 }
 
-func fieldInfoForMap(fd pref.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
+func fieldInfoForMap(fd protoreflect.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
 	ft := fs.Type
 	if ft.Kind() != reflect.Map {
 		panic(fmt.Sprintf("field %v has invalid type: got %v, want map kind", fd.FullName(), ft))
@@ -166,7 +166,7 @@ func fieldInfoForMap(fd pref.FieldDescriptor, fs reflect.StructField, x exporter
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			rv.Set(reflect.Zero(rv.Type()))
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			if p.IsNil() {
 				return conv.Zero()
 			}
@@ -176,7 +176,7 @@ func fieldInfoForMap(fd pref.FieldDescriptor, fs reflect.StructField, x exporter
 			}
 			return conv.PBValueOf(rv)
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			pv := conv.GoValueOf(v)
 			if pv.IsNil() {
@@ -184,20 +184,20 @@ func fieldInfoForMap(fd pref.FieldDescriptor, fs reflect.StructField, x exporter
 			}
 			rv.Set(pv)
 		},
-		mutable: func(p pointer) pref.Value {
+		mutable: func(p pointer) protoreflect.Value {
 			v := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			if v.IsNil() {
 				v.Set(reflect.MakeMap(fs.Type))
 			}
 			return conv.PBValueOf(v)
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			return conv.New()
 		},
 	}
 }
 
-func fieldInfoForList(fd pref.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
+func fieldInfoForList(fd protoreflect.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
 	ft := fs.Type
 	if ft.Kind() != reflect.Slice {
 		panic(fmt.Sprintf("field %v has invalid type: got %v, want slice kind", fd.FullName(), ft))
@@ -219,7 +219,7 @@ func fieldInfoForList(fd pref.FieldDescriptor, fs reflect.StructField, x exporte
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			rv.Set(reflect.Zero(rv.Type()))
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			if p.IsNil() {
 				return conv.Zero()
 			}
@@ -229,7 +229,7 @@ func fieldInfoForList(fd pref.FieldDescriptor, fs reflect.StructField, x exporte
 			}
 			return conv.PBValueOf(rv)
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			pv := conv.GoValueOf(v)
 			if pv.IsNil() {
@@ -237,11 +237,11 @@ func fieldInfoForList(fd pref.FieldDescriptor, fs reflect.StructField, x exporte
 			}
 			rv.Set(pv.Elem())
 		},
-		mutable: func(p pointer) pref.Value {
+		mutable: func(p pointer) protoreflect.Value {
 			v := p.Apply(fieldOffset).AsValueOf(fs.Type)
 			return conv.PBValueOf(v)
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			return conv.New()
 		},
 	}
@@ -252,7 +252,7 @@ var (
 	emptyBytes = reflect.ValueOf([]byte{})
 )
 
-func fieldInfoForScalar(fd pref.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
+func fieldInfoForScalar(fd protoreflect.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
 	ft := fs.Type
 	nullable := fd.HasPresence()
 	isBytes := ft.Kind() == reflect.Slice && ft.Elem().Kind() == reflect.Uint8
@@ -300,7 +300,7 @@ func fieldInfoForScalar(fd pref.FieldDescriptor, fs reflect.StructField, x expor
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			rv.Set(reflect.Zero(rv.Type()))
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			if p.IsNil() {
 				return conv.Zero()
 			}
@@ -315,7 +315,7 @@ func fieldInfoForScalar(fd pref.FieldDescriptor, fs reflect.StructField, x expor
 			}
 			return conv.PBValueOf(rv)
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			if nullable && rv.Kind() == reflect.Ptr {
 				if rv.IsNil() {
@@ -332,23 +332,23 @@ func fieldInfoForScalar(fd pref.FieldDescriptor, fs reflect.StructField, x expor
 				}
 			}
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			return conv.New()
 		},
 	}
 }
 
-func fieldInfoForWeakMessage(fd pref.FieldDescriptor, weakOffset offset) fieldInfo {
+func fieldInfoForWeakMessage(fd protoreflect.FieldDescriptor, weakOffset offset) fieldInfo {
 	if !flags.ProtoLegacy {
 		panic("no support for proto1 weak fields")
 	}
 
 	var once sync.Once
-	var messageType pref.MessageType
+	var messageType protoreflect.MessageType
 	lazyInit := func() {
 		once.Do(func() {
 			messageName := fd.Message().FullName()
-			messageType, _ = preg.GlobalTypes.FindMessageByName(messageName)
+			messageType, _ = protoregistry.GlobalTypes.FindMessageByName(messageName)
 			if messageType == nil {
 				panic(fmt.Sprintf("weak message %v for field %v is not linked in", messageName, fd.FullName()))
 			}
@@ -368,18 +368,18 @@ func fieldInfoForWeakMessage(fd pref.FieldDescriptor, weakOffset offset) fieldIn
 		clear: func(p pointer) {
 			p.Apply(weakOffset).WeakFields().clear(num)
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			lazyInit()
 			if p.IsNil() {
-				return pref.ValueOfMessage(messageType.Zero())
+				return protoreflect.ValueOfMessage(messageType.Zero())
 			}
 			m, ok := p.Apply(weakOffset).WeakFields().get(num)
 			if !ok {
-				return pref.ValueOfMessage(messageType.Zero())
+				return protoreflect.ValueOfMessage(messageType.Zero())
 			}
-			return pref.ValueOfMessage(m.ProtoReflect())
+			return protoreflect.ValueOfMessage(m.ProtoReflect())
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			lazyInit()
 			m := v.Message()
 			if m.Descriptor() != messageType.Descriptor() {
@@ -390,7 +390,7 @@ func fieldInfoForWeakMessage(fd pref.FieldDescriptor, weakOffset offset) fieldIn
 			}
 			p.Apply(weakOffset).WeakFields().set(num, m.Interface())
 		},
-		mutable: func(p pointer) pref.Value {
+		mutable: func(p pointer) protoreflect.Value {
 			lazyInit()
 			fs := p.Apply(weakOffset).WeakFields()
 			m, ok := fs.get(num)
@@ -398,20 +398,20 @@ func fieldInfoForWeakMessage(fd pref.FieldDescriptor, weakOffset offset) fieldIn
 				m = messageType.New().Interface()
 				fs.set(num, m)
 			}
-			return pref.ValueOfMessage(m.ProtoReflect())
+			return protoreflect.ValueOfMessage(m.ProtoReflect())
 		},
-		newMessage: func() pref.Message {
+		newMessage: func() protoreflect.Message {
 			lazyInit()
 			return messageType.New()
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			lazyInit()
-			return pref.ValueOfMessage(messageType.New())
+			return protoreflect.ValueOfMessage(messageType.New())
 		},
 	}
 }
 
-func fieldInfoForMessage(fd pref.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
+func fieldInfoForMessage(fd protoreflect.FieldDescriptor, fs reflect.StructField, x exporter) fieldInfo {
 	ft := fs.Type
 	conv := NewConverter(ft, fd)
 
@@ -433,47 +433,47 @@ func fieldInfoForMessage(fd pref.FieldDescriptor, fs reflect.StructField, x expo
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			rv.Set(reflect.Zero(rv.Type()))
 		},
-		get: func(p pointer) pref.Value {
+		get: func(p pointer) protoreflect.Value {
 			if p.IsNil() {
 				return conv.Zero()
 			}
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			return conv.PBValueOf(rv)
 		},
-		set: func(p pointer, v pref.Value) {
+		set: func(p pointer, v protoreflect.Value) {
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			rv.Set(conv.GoValueOf(v))
 			if fs.Type.Kind() == reflect.Ptr && rv.IsNil() {
 				panic(fmt.Sprintf("field %v has invalid nil pointer", fd.FullName()))
 			}
 		},
-		mutable: func(p pointer) pref.Value {
+		mutable: func(p pointer) protoreflect.Value {
 			rv := p.Apply(fieldOffset).AsValueOf(fs.Type).Elem()
 			if fs.Type.Kind() == reflect.Ptr && rv.IsNil() {
 				rv.Set(conv.GoValueOf(conv.New()))
 			}
 			return conv.PBValueOf(rv)
 		},
-		newMessage: func() pref.Message {
+		newMessage: func() protoreflect.Message {
 			return conv.New().Message()
 		},
-		newField: func() pref.Value {
+		newField: func() protoreflect.Value {
 			return conv.New()
 		},
 	}
 }
 
 type oneofInfo struct {
-	oneofDesc pref.OneofDescriptor
-	which     func(pointer) pref.FieldNumber
+	oneofDesc protoreflect.OneofDescriptor
+	which     func(pointer) protoreflect.FieldNumber
 }
 
-func makeOneofInfo(od pref.OneofDescriptor, si structInfo, x exporter) *oneofInfo {
+func makeOneofInfo(od protoreflect.OneofDescriptor, si structInfo, x exporter) *oneofInfo {
 	oi := &oneofInfo{oneofDesc: od}
 	if od.IsSynthetic() {
 		fs := si.fieldsByNumber[od.Fields().Get(0).Number()]
 		fieldOffset := offsetOf(fs, x)
-		oi.which = func(p pointer) pref.FieldNumber {
+		oi.which = func(p pointer) protoreflect.FieldNumber {
 			if p.IsNil() {
 				return 0
 			}
@@ -486,7 +486,7 @@ func makeOneofInfo(od pref.OneofDescriptor, si structInfo, x exporter) *oneofInf
 	} else {
 		fs := si.oneofsByName[od.Name()]
 		fieldOffset := offsetOf(fs, x)
-		oi.which = func(p pointer) pref.FieldNumber {
+		oi.which = func(p pointer) protoreflect.FieldNumber {
 			if p.IsNil() {
 				return 0
 			}
diff --git a/vendor/google.golang.org/protobuf/internal/impl/pointer_reflect.go b/vendor/google.golang.org/protobuf/internal/impl/pointer_reflect.go
index 9e3ed821ef..4c491bdf48 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/pointer_reflect.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/pointer_reflect.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build purego || appengine
 // +build purego appengine
 
 package impl
diff --git a/vendor/google.golang.org/protobuf/internal/impl/pointer_unsafe.go b/vendor/google.golang.org/protobuf/internal/impl/pointer_unsafe.go
index 9ecf23a85b..ee0e0573e3 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/pointer_unsafe.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/pointer_unsafe.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego && !appengine
 // +build !purego,!appengine
 
 package impl
diff --git a/vendor/google.golang.org/protobuf/internal/impl/validate.go b/vendor/google.golang.org/protobuf/internal/impl/validate.go
index 08cfb6054b..a24e6bbd7a 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/validate.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/validate.go
@@ -16,9 +16,9 @@ import (
 	"google.golang.org/protobuf/internal/flags"
 	"google.golang.org/protobuf/internal/genid"
 	"google.golang.org/protobuf/internal/strs"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
-	preg "google.golang.org/protobuf/reflect/protoregistry"
-	piface "google.golang.org/protobuf/runtime/protoiface"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/runtime/protoiface"
 )
 
 // ValidationStatus is the result of validating the wire-format encoding of a message.
@@ -56,20 +56,20 @@ func (v ValidationStatus) String() string {
 // of the message type.
 //
 // This function is exposed for testing.
-func Validate(mt pref.MessageType, in piface.UnmarshalInput) (out piface.UnmarshalOutput, _ ValidationStatus) {
+func Validate(mt protoreflect.MessageType, in protoiface.UnmarshalInput) (out protoiface.UnmarshalOutput, _ ValidationStatus) {
 	mi, ok := mt.(*MessageInfo)
 	if !ok {
 		return out, ValidationUnknown
 	}
 	if in.Resolver == nil {
-		in.Resolver = preg.GlobalTypes
+		in.Resolver = protoregistry.GlobalTypes
 	}
 	o, st := mi.validate(in.Buf, 0, unmarshalOptions{
 		flags:    in.Flags,
 		resolver: in.Resolver,
 	})
 	if o.initialized {
-		out.Flags |= piface.UnmarshalInitialized
+		out.Flags |= protoiface.UnmarshalInitialized
 	}
 	return out, st
 }
@@ -106,22 +106,22 @@ const (
 	validationTypeMessageSetItem
 )
 
-func newFieldValidationInfo(mi *MessageInfo, si structInfo, fd pref.FieldDescriptor, ft reflect.Type) validationInfo {
+func newFieldValidationInfo(mi *MessageInfo, si structInfo, fd protoreflect.FieldDescriptor, ft reflect.Type) validationInfo {
 	var vi validationInfo
 	switch {
 	case fd.ContainingOneof() != nil && !fd.ContainingOneof().IsSynthetic():
 		switch fd.Kind() {
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			vi.typ = validationTypeMessage
 			if ot, ok := si.oneofWrappersByNumber[fd.Number()]; ok {
 				vi.mi = getMessageInfo(ot.Field(0).Type)
 			}
-		case pref.GroupKind:
+		case protoreflect.GroupKind:
 			vi.typ = validationTypeGroup
 			if ot, ok := si.oneofWrappersByNumber[fd.Number()]; ok {
 				vi.mi = getMessageInfo(ot.Field(0).Type)
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if strs.EnforceUTF8(fd) {
 				vi.typ = validationTypeUTF8String
 			}
@@ -129,7 +129,7 @@ func newFieldValidationInfo(mi *MessageInfo, si structInfo, fd pref.FieldDescrip
 	default:
 		vi = newValidationInfo(fd, ft)
 	}
-	if fd.Cardinality() == pref.Required {
+	if fd.Cardinality() == protoreflect.Required {
 		// Avoid overflow. The required field check is done with a 64-bit mask, with
 		// any message containing more than 64 required fields always reported as
 		// potentially uninitialized, so it is not important to get a precise count
@@ -142,22 +142,22 @@ func newFieldValidationInfo(mi *MessageInfo, si structInfo, fd pref.FieldDescrip
 	return vi
 }
 
-func newValidationInfo(fd pref.FieldDescriptor, ft reflect.Type) validationInfo {
+func newValidationInfo(fd protoreflect.FieldDescriptor, ft reflect.Type) validationInfo {
 	var vi validationInfo
 	switch {
 	case fd.IsList():
 		switch fd.Kind() {
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			vi.typ = validationTypeMessage
 			if ft.Kind() == reflect.Slice {
 				vi.mi = getMessageInfo(ft.Elem())
 			}
-		case pref.GroupKind:
+		case protoreflect.GroupKind:
 			vi.typ = validationTypeGroup
 			if ft.Kind() == reflect.Slice {
 				vi.mi = getMessageInfo(ft.Elem())
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			vi.typ = validationTypeBytes
 			if strs.EnforceUTF8(fd) {
 				vi.typ = validationTypeUTF8String
@@ -175,33 +175,33 @@ func newValidationInfo(fd pref.FieldDescriptor, ft reflect.Type) validationInfo
 	case fd.IsMap():
 		vi.typ = validationTypeMap
 		switch fd.MapKey().Kind() {
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if strs.EnforceUTF8(fd) {
 				vi.keyType = validationTypeUTF8String
 			}
 		}
 		switch fd.MapValue().Kind() {
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			vi.valType = validationTypeMessage
 			if ft.Kind() == reflect.Map {
 				vi.mi = getMessageInfo(ft.Elem())
 			}
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			if strs.EnforceUTF8(fd) {
 				vi.valType = validationTypeUTF8String
 			}
 		}
 	default:
 		switch fd.Kind() {
-		case pref.MessageKind:
+		case protoreflect.MessageKind:
 			vi.typ = validationTypeMessage
 			if !fd.IsWeak() {
 				vi.mi = getMessageInfo(ft)
 			}
-		case pref.GroupKind:
+		case protoreflect.GroupKind:
 			vi.typ = validationTypeGroup
 			vi.mi = getMessageInfo(ft)
-		case pref.StringKind:
+		case protoreflect.StringKind:
 			vi.typ = validationTypeBytes
 			if strs.EnforceUTF8(fd) {
 				vi.typ = validationTypeUTF8String
@@ -314,11 +314,11 @@ State:
 							break
 						}
 						messageName := fd.Message().FullName()
-						messageType, err := preg.GlobalTypes.FindMessageByName(messageName)
+						messageType, err := protoregistry.GlobalTypes.FindMessageByName(messageName)
 						switch err {
 						case nil:
 							vi.mi, _ = messageType.(*MessageInfo)
-						case preg.NotFound:
+						case protoregistry.NotFound:
 							vi.typ = validationTypeBytes
 						default:
 							return out, ValidationUnknown
@@ -335,7 +335,7 @@ State:
 				// unmarshaling to begin failing. Supporting this requires some way to
 				// determine if the resolver is frozen.
 				xt, err := opts.resolver.FindExtensionByNumber(st.mi.Desc.FullName(), num)
-				if err != nil && err != preg.NotFound {
+				if err != nil && err != protoregistry.NotFound {
 					return out, ValidationUnknown
 				}
 				if err == nil {
@@ -513,7 +513,7 @@ State:
 					}
 					xt, err := opts.resolver.FindExtensionByNumber(st.mi.Desc.FullName(), typeid)
 					switch {
-					case err == preg.NotFound:
+					case err == protoregistry.NotFound:
 						b = b[n:]
 					case err != nil:
 						return out, ValidationUnknown
diff --git a/vendor/google.golang.org/protobuf/internal/impl/weak.go b/vendor/google.golang.org/protobuf/internal/impl/weak.go
index 009cbefd1e..eb79a7ba94 100644
--- a/vendor/google.golang.org/protobuf/internal/impl/weak.go
+++ b/vendor/google.golang.org/protobuf/internal/impl/weak.go
@@ -7,7 +7,7 @@ package impl
 import (
 	"fmt"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/reflect/protoregistry"
 )
 
@@ -17,32 +17,32 @@ import (
 // defined directly on it.
 type weakFields WeakFields
 
-func (w weakFields) get(num pref.FieldNumber) (pref.ProtoMessage, bool) {
+func (w weakFields) get(num protoreflect.FieldNumber) (protoreflect.ProtoMessage, bool) {
 	m, ok := w[int32(num)]
 	return m, ok
 }
 
-func (w *weakFields) set(num pref.FieldNumber, m pref.ProtoMessage) {
+func (w *weakFields) set(num protoreflect.FieldNumber, m protoreflect.ProtoMessage) {
 	if *w == nil {
 		*w = make(weakFields)
 	}
 	(*w)[int32(num)] = m
 }
 
-func (w *weakFields) clear(num pref.FieldNumber) {
+func (w *weakFields) clear(num protoreflect.FieldNumber) {
 	delete(*w, int32(num))
 }
 
-func (Export) HasWeak(w WeakFields, num pref.FieldNumber) bool {
+func (Export) HasWeak(w WeakFields, num protoreflect.FieldNumber) bool {
 	_, ok := w[int32(num)]
 	return ok
 }
 
-func (Export) ClearWeak(w *WeakFields, num pref.FieldNumber) {
+func (Export) ClearWeak(w *WeakFields, num protoreflect.FieldNumber) {
 	delete(*w, int32(num))
 }
 
-func (Export) GetWeak(w WeakFields, num pref.FieldNumber, name pref.FullName) pref.ProtoMessage {
+func (Export) GetWeak(w WeakFields, num protoreflect.FieldNumber, name protoreflect.FullName) protoreflect.ProtoMessage {
 	if m, ok := w[int32(num)]; ok {
 		return m
 	}
@@ -53,7 +53,7 @@ func (Export) GetWeak(w WeakFields, num pref.FieldNumber, name pref.FullName) pr
 	return mt.Zero().Interface()
 }
 
-func (Export) SetWeak(w *WeakFields, num pref.FieldNumber, name pref.FullName, m pref.ProtoMessage) {
+func (Export) SetWeak(w *WeakFields, num protoreflect.FieldNumber, name protoreflect.FullName, m protoreflect.ProtoMessage) {
 	if m != nil {
 		mt, _ := protoregistry.GlobalTypes.FindMessageByName(name)
 		if mt == nil {
diff --git a/vendor/google.golang.org/protobuf/internal/order/order.go b/vendor/google.golang.org/protobuf/internal/order/order.go
index 2a24953f6a..33745ed062 100644
--- a/vendor/google.golang.org/protobuf/internal/order/order.go
+++ b/vendor/google.golang.org/protobuf/internal/order/order.go
@@ -5,12 +5,12 @@
 package order
 
 import (
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 // FieldOrder specifies the ordering to visit message fields.
 // It is a function that reports whether x is ordered before y.
-type FieldOrder func(x, y pref.FieldDescriptor) bool
+type FieldOrder func(x, y protoreflect.FieldDescriptor) bool
 
 var (
 	// AnyFieldOrder specifies no specific field ordering.
@@ -18,9 +18,9 @@ var (
 
 	// LegacyFieldOrder sorts fields in the same ordering as emitted by
 	// wire serialization in the github.com/golang/protobuf implementation.
-	LegacyFieldOrder FieldOrder = func(x, y pref.FieldDescriptor) bool {
+	LegacyFieldOrder FieldOrder = func(x, y protoreflect.FieldDescriptor) bool {
 		ox, oy := x.ContainingOneof(), y.ContainingOneof()
-		inOneof := func(od pref.OneofDescriptor) bool {
+		inOneof := func(od protoreflect.OneofDescriptor) bool {
 			return od != nil && !od.IsSynthetic()
 		}
 
@@ -41,14 +41,14 @@ var (
 	}
 
 	// NumberFieldOrder sorts fields by their field number.
-	NumberFieldOrder FieldOrder = func(x, y pref.FieldDescriptor) bool {
+	NumberFieldOrder FieldOrder = func(x, y protoreflect.FieldDescriptor) bool {
 		return x.Number() < y.Number()
 	}
 
 	// IndexNameFieldOrder sorts non-extension fields before extension fields.
 	// Non-extensions are sorted according to their declaration index.
 	// Extensions are sorted according to their full name.
-	IndexNameFieldOrder FieldOrder = func(x, y pref.FieldDescriptor) bool {
+	IndexNameFieldOrder FieldOrder = func(x, y protoreflect.FieldDescriptor) bool {
 		// Non-extension fields sort before extension fields.
 		if x.IsExtension() != y.IsExtension() {
 			return !x.IsExtension() && y.IsExtension()
@@ -64,7 +64,7 @@ var (
 
 // KeyOrder specifies the ordering to visit map entries.
 // It is a function that reports whether x is ordered before y.
-type KeyOrder func(x, y pref.MapKey) bool
+type KeyOrder func(x, y protoreflect.MapKey) bool
 
 var (
 	// AnyKeyOrder specifies no specific key ordering.
@@ -72,7 +72,7 @@ var (
 
 	// GenericKeyOrder sorts false before true, numeric keys in ascending order,
 	// and strings in lexicographical ordering according to UTF-8 codepoints.
-	GenericKeyOrder KeyOrder = func(x, y pref.MapKey) bool {
+	GenericKeyOrder KeyOrder = func(x, y protoreflect.MapKey) bool {
 		switch x.Interface().(type) {
 		case bool:
 			return !x.Bool() && y.Bool()
diff --git a/vendor/google.golang.org/protobuf/internal/order/range.go b/vendor/google.golang.org/protobuf/internal/order/range.go
index c8090e0c54..1665a68e5b 100644
--- a/vendor/google.golang.org/protobuf/internal/order/range.go
+++ b/vendor/google.golang.org/protobuf/internal/order/range.go
@@ -9,12 +9,12 @@ import (
 	"sort"
 	"sync"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type messageField struct {
-	fd pref.FieldDescriptor
-	v  pref.Value
+	fd protoreflect.FieldDescriptor
+	v  protoreflect.Value
 }
 
 var messageFieldPool = sync.Pool{
@@ -25,8 +25,8 @@ type (
 	// FieldRnger is an interface for visiting all fields in a message.
 	// The protoreflect.Message type implements this interface.
 	FieldRanger interface{ Range(VisitField) }
-	// VisitField is called everytime a message field is visited.
-	VisitField = func(pref.FieldDescriptor, pref.Value) bool
+	// VisitField is called every time a message field is visited.
+	VisitField = func(protoreflect.FieldDescriptor, protoreflect.Value) bool
 )
 
 // RangeFields iterates over the fields of fs according to the specified order.
@@ -47,7 +47,7 @@ func RangeFields(fs FieldRanger, less FieldOrder, fn VisitField) {
 	}()
 
 	// Collect all fields in the message and sort them.
-	fs.Range(func(fd pref.FieldDescriptor, v pref.Value) bool {
+	fs.Range(func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool {
 		fields = append(fields, messageField{fd, v})
 		return true
 	})
@@ -64,8 +64,8 @@ func RangeFields(fs FieldRanger, less FieldOrder, fn VisitField) {
 }
 
 type mapEntry struct {
-	k pref.MapKey
-	v pref.Value
+	k protoreflect.MapKey
+	v protoreflect.Value
 }
 
 var mapEntryPool = sync.Pool{
@@ -76,8 +76,8 @@ type (
 	// EntryRanger is an interface for visiting all fields in a message.
 	// The protoreflect.Map type implements this interface.
 	EntryRanger interface{ Range(VisitEntry) }
-	// VisitEntry is called everytime a map entry is visited.
-	VisitEntry = func(pref.MapKey, pref.Value) bool
+	// VisitEntry is called every time a map entry is visited.
+	VisitEntry = func(protoreflect.MapKey, protoreflect.Value) bool
 )
 
 // RangeEntries iterates over the entries of es according to the specified order.
@@ -98,7 +98,7 @@ func RangeEntries(es EntryRanger, less KeyOrder, fn VisitEntry) {
 	}()
 
 	// Collect all entries in the map and sort them.
-	es.Range(func(k pref.MapKey, v pref.Value) bool {
+	es.Range(func(k protoreflect.MapKey, v protoreflect.Value) bool {
 		entries = append(entries, mapEntry{k, v})
 		return true
 	})
diff --git a/vendor/google.golang.org/protobuf/internal/strs/strings_pure.go b/vendor/google.golang.org/protobuf/internal/strs/strings_pure.go
index 85e074c977..a1f6f33386 100644
--- a/vendor/google.golang.org/protobuf/internal/strs/strings_pure.go
+++ b/vendor/google.golang.org/protobuf/internal/strs/strings_pure.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build purego || appengine
 // +build purego appengine
 
 package strs
diff --git a/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go b/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go
index 2160c70191..61a84d3418 100644
--- a/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go
+++ b/vendor/google.golang.org/protobuf/internal/strs/strings_unsafe.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego && !appengine
 // +build !purego,!appengine
 
 package strs
@@ -9,7 +10,7 @@ package strs
 import (
 	"unsafe"
 
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
 type (
@@ -58,7 +59,7 @@ type Builder struct {
 
 // AppendFullName is equivalent to protoreflect.FullName.Append,
 // but optimized for large batches where each name has a shared lifetime.
-func (sb *Builder) AppendFullName(prefix pref.FullName, name pref.Name) pref.FullName {
+func (sb *Builder) AppendFullName(prefix protoreflect.FullName, name protoreflect.Name) protoreflect.FullName {
 	n := len(prefix) + len(".") + len(name)
 	if len(prefix) == 0 {
 		n -= len(".")
@@ -67,7 +68,7 @@ func (sb *Builder) AppendFullName(prefix pref.FullName, name pref.Name) pref.Ful
 	sb.buf = append(sb.buf, prefix...)
 	sb.buf = append(sb.buf, '.')
 	sb.buf = append(sb.buf, name...)
-	return pref.FullName(sb.last(n))
+	return protoreflect.FullName(sb.last(n))
 }
 
 // MakeString is equivalent to string(b), but optimized for large batches
@@ -86,7 +87,7 @@ func (sb *Builder) grow(n int) {
 	// Unlike strings.Builder, we do not need to copy over the contents
 	// of the old buffer since our builder provides no API for
 	// retrieving previously created strings.
-	sb.buf = make([]byte, 2*(cap(sb.buf)+n))
+	sb.buf = make([]byte, 0, 2*(cap(sb.buf)+n))
 }
 
 func (sb *Builder) last(n int) string {
diff --git a/vendor/google.golang.org/protobuf/internal/version/version.go b/vendor/google.golang.org/protobuf/internal/version/version.go
index 14e774fb2e..f7014cd51c 100644
--- a/vendor/google.golang.org/protobuf/internal/version/version.go
+++ b/vendor/google.golang.org/protobuf/internal/version/version.go
@@ -12,54 +12,54 @@ import (
 
 // These constants determine the current version of this module.
 //
-//
 // For our release process, we enforce the following rules:
-//	* Tagged releases use a tag that is identical to String.
-//	* Tagged releases never reference a commit where the String
-//	contains "devel".
-//	* The set of all commits in this repository where String
-//	does not contain "devel" must have a unique String.
-//
+//   - Tagged releases use a tag that is identical to String.
+//   - Tagged releases never reference a commit where the String
+//     contains "devel".
+//   - The set of all commits in this repository where String
+//     does not contain "devel" must have a unique String.
 //
 // Steps for tagging a new release:
-//	1. Create a new CL.
 //
-//	2. Update Minor, Patch, and/or PreRelease as necessary.
-//	PreRelease must not contain the string "devel".
+//  1. Create a new CL.
 //
-//	3. Since the last released minor version, have there been any changes to
-//	generator that relies on new functionality in the runtime?
-//	If yes, then increment RequiredGenerated.
+//  2. Update Minor, Patch, and/or PreRelease as necessary.
+//     PreRelease must not contain the string "devel".
 //
-//	4. Since the last released minor version, have there been any changes to
-//	the runtime that removes support for old .pb.go source code?
-//	If yes, then increment SupportMinimum.
+//  3. Since the last released minor version, have there been any changes to
+//     generator that relies on new functionality in the runtime?
+//     If yes, then increment RequiredGenerated.
 //
-//	5. Send out the CL for review and submit it.
-//	Note that the next CL in step 8 must be submitted after this CL
-//	without any other CLs in-between.
+//  4. Since the last released minor version, have there been any changes to
+//     the runtime that removes support for old .pb.go source code?
+//     If yes, then increment SupportMinimum.
 //
-//	6. Tag a new version, where the tag is is the current String.
+//  5. Send out the CL for review and submit it.
+//     Note that the next CL in step 8 must be submitted after this CL
+//     without any other CLs in-between.
 //
-//	7. Write release notes for all notable changes
-//	between this release and the last release.
+//  6. Tag a new version, where the tag is is the current String.
 //
-//	8. Create a new CL.
+//  7. Write release notes for all notable changes
+//     between this release and the last release.
 //
-//	9. Update PreRelease to include the string "devel".
-//	For example: "" -> "devel" or "rc.1" -> "rc.1.devel"
+//  8. Create a new CL.
 //
-//	10. Send out the CL for review and submit it.
+//  9. Update PreRelease to include the string "devel".
+//     For example: "" -> "devel" or "rc.1" -> "rc.1.devel"
+//
+//  10. Send out the CL for review and submit it.
 const (
 	Major      = 1
-	Minor      = 27
-	Patch      = 1
+	Minor      = 30
+	Patch      = 0
 	PreRelease = ""
 )
 
 // String formats the version string for this module in semver format.
 //
 // Examples:
+//
 //	v1.20.1
 //	v1.21.0-rc.1
 func String() string {
diff --git a/vendor/google.golang.org/protobuf/proto/decode.go b/vendor/google.golang.org/protobuf/proto/decode.go
index 49f9b8c88c..48d47946bb 100644
--- a/vendor/google.golang.org/protobuf/proto/decode.go
+++ b/vendor/google.golang.org/protobuf/proto/decode.go
@@ -19,7 +19,8 @@ import (
 // UnmarshalOptions configures the unmarshaler.
 //
 // Example usage:
-//   err := UnmarshalOptions{DiscardUnknown: true}.Unmarshal(b, m)
+//
+//	err := UnmarshalOptions{DiscardUnknown: true}.Unmarshal(b, m)
 type UnmarshalOptions struct {
 	pragma.NoUnkeyedLiterals
 
@@ -42,18 +43,25 @@ type UnmarshalOptions struct {
 		FindExtensionByName(field protoreflect.FullName) (protoreflect.ExtensionType, error)
 		FindExtensionByNumber(message protoreflect.FullName, field protoreflect.FieldNumber) (protoreflect.ExtensionType, error)
 	}
+
+	// RecursionLimit limits how deeply messages may be nested.
+	// If zero, a default limit is applied.
+	RecursionLimit int
 }
 
 // Unmarshal parses the wire-format message in b and places the result in m.
 // The provided message must be mutable (e.g., a non-nil pointer to a message).
 func Unmarshal(b []byte, m Message) error {
-	_, err := UnmarshalOptions{}.unmarshal(b, m.ProtoReflect())
+	_, err := UnmarshalOptions{RecursionLimit: protowire.DefaultRecursionLimit}.unmarshal(b, m.ProtoReflect())
 	return err
 }
 
 // Unmarshal parses the wire-format message in b and places the result in m.
 // The provided message must be mutable (e.g., a non-nil pointer to a message).
 func (o UnmarshalOptions) Unmarshal(b []byte, m Message) error {
+	if o.RecursionLimit == 0 {
+		o.RecursionLimit = protowire.DefaultRecursionLimit
+	}
 	_, err := o.unmarshal(b, m.ProtoReflect())
 	return err
 }
@@ -63,6 +71,9 @@ func (o UnmarshalOptions) Unmarshal(b []byte, m Message) error {
 // This method permits fine-grained control over the unmarshaler.
 // Most users should use Unmarshal instead.
 func (o UnmarshalOptions) UnmarshalState(in protoiface.UnmarshalInput) (protoiface.UnmarshalOutput, error) {
+	if o.RecursionLimit == 0 {
+		o.RecursionLimit = protowire.DefaultRecursionLimit
+	}
 	return o.unmarshal(in.Buf, in.Message)
 }
 
@@ -86,12 +97,17 @@ func (o UnmarshalOptions) unmarshal(b []byte, m protoreflect.Message) (out proto
 			Message:  m,
 			Buf:      b,
 			Resolver: o.Resolver,
+			Depth:    o.RecursionLimit,
 		}
 		if o.DiscardUnknown {
 			in.Flags |= protoiface.UnmarshalDiscardUnknown
 		}
 		out, err = methods.Unmarshal(in)
 	} else {
+		o.RecursionLimit--
+		if o.RecursionLimit < 0 {
+			return out, errors.New("exceeded max recursion depth")
+		}
 		err = o.unmarshalMessageSlow(b, m)
 	}
 	if err != nil {
diff --git a/vendor/google.golang.org/protobuf/proto/doc.go b/vendor/google.golang.org/protobuf/proto/doc.go
index c52d8c4ab7..ec71e717fe 100644
--- a/vendor/google.golang.org/protobuf/proto/doc.go
+++ b/vendor/google.golang.org/protobuf/proto/doc.go
@@ -5,19 +5,15 @@
 // Package proto provides functions operating on protocol buffer messages.
 //
 // For documentation on protocol buffers in general, see:
-//
-//   https://developers.google.com/protocol-buffers
+// https://protobuf.dev.
 //
 // For a tutorial on using protocol buffers with Go, see:
-//
-//   https://developers.google.com/protocol-buffers/docs/gotutorial
+// https://protobuf.dev/getting-started/gotutorial.
 //
 // For a guide to generated Go protocol buffer code, see:
+// https://protobuf.dev/reference/go/go-generated.
 //
-//   https://developers.google.com/protocol-buffers/docs/reference/go-generated
-//
-//
-// Binary serialization
+// # Binary serialization
 //
 // This package contains functions to convert to and from the wire format,
 // an efficient binary serialization of protocol buffers.
@@ -30,8 +26,7 @@
 // • Unmarshal converts a message from the wire format.
 // The UnmarshalOptions type provides more control over wire unmarshaling.
 //
-//
-// Basic message operations
+// # Basic message operations
 //
 // • Clone makes a deep copy of a message.
 //
@@ -45,8 +40,7 @@
 //
 // • CheckInitialized reports whether all required fields in a message are set.
 //
-//
-// Optional scalar constructors
+// # Optional scalar constructors
 //
 // The API for some generated messages represents optional scalar fields
 // as pointers to a value. For example, an optional string field has the
@@ -61,16 +55,14 @@
 //
 // Optional scalar fields are only supported in proto2.
 //
-//
-// Extension accessors
+// # Extension accessors
 //
 // • HasExtension, GetExtension, SetExtension, and ClearExtension
 // access extension field values in a protocol buffer message.
 //
 // Extension fields are only supported in proto2.
 //
-//
-// Related packages
+// # Related packages
 //
 // • Package "google.golang.org/protobuf/encoding/protojson" converts messages to
 // and from JSON.
diff --git a/vendor/google.golang.org/protobuf/proto/encode.go b/vendor/google.golang.org/protobuf/proto/encode.go
index d18239c237..bf7f816d0e 100644
--- a/vendor/google.golang.org/protobuf/proto/encode.go
+++ b/vendor/google.golang.org/protobuf/proto/encode.go
@@ -16,7 +16,8 @@ import (
 // MarshalOptions configures the marshaler.
 //
 // Example usage:
-//   b, err := MarshalOptions{Deterministic: true}.Marshal(m)
+//
+//	b, err := MarshalOptions{Deterministic: true}.Marshal(m)
 type MarshalOptions struct {
 	pragma.NoUnkeyedLiterals
 
@@ -101,7 +102,9 @@ func (o MarshalOptions) Marshal(m Message) ([]byte, error) {
 // otherwise it returns a non-nil empty buffer.
 //
 // This is to assist the edge-case where user-code does the following:
+//
 //	m1.OptionalBytes, _ = proto.Marshal(m2)
+//
 // where they expect the proto2 "optional_bytes" field to be populated
 // if any only if m2 is a valid message.
 func emptyBytesForMessage(m Message) []byte {
diff --git a/vendor/google.golang.org/protobuf/proto/equal.go b/vendor/google.golang.org/protobuf/proto/equal.go
index 4dba2b9699..1a0be1b03c 100644
--- a/vendor/google.golang.org/protobuf/proto/equal.go
+++ b/vendor/google.golang.org/protobuf/proto/equal.go
@@ -5,163 +5,53 @@
 package proto
 
 import (
-	"bytes"
-	"math"
 	"reflect"
 
-	"google.golang.org/protobuf/encoding/protowire"
-	pref "google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoreflect"
 )
 
-// Equal reports whether two messages are equal.
-// If two messages marshal to the same bytes under deterministic serialization,
-// then Equal is guaranteed to report true.
+// Equal reports whether two messages are equal,
+// by recursively comparing the fields of the message.
 //
-// Two messages are equal if they belong to the same message descriptor,
-// have the same set of populated known and extension field values,
-// and the same set of unknown fields values. If either of the top-level
-// messages are invalid, then Equal reports true only if both are invalid.
+//   - Bytes fields are equal if they contain identical bytes.
+//     Empty bytes (regardless of nil-ness) are considered equal.
 //
-// Scalar values are compared with the equivalent of the == operator in Go,
-// except bytes values which are compared using bytes.Equal and
-// floating point values which specially treat NaNs as equal.
-// Message values are compared by recursively calling Equal.
-// Lists are equal if each element value is also equal.
-// Maps are equal if they have the same set of keys, where the pair of values
-// for each key is also equal.
+//   - Floating-point fields are equal if they contain the same value.
+//     Unlike the == operator, a NaN is equal to another NaN.
+//
+//   - Other scalar fields are equal if they contain the same value.
+//
+//   - Message fields are equal if they have
+//     the same set of populated known and extension field values, and
+//     the same set of unknown fields values.
+//
+//   - Lists are equal if they are the same length and
+//     each corresponding element is equal.
+//
+//   - Maps are equal if they have the same set of keys and
+//     the corresponding value for each key is equal.
+//
+// An invalid message is not equal to a valid message.
+// An invalid message is only equal to another invalid message of the
+// same type. An invalid message often corresponds to a nil pointer
+// of the concrete message type. For example, (*pb.M)(nil) is not equal
+// to &pb.M{}.
+// If two valid messages marshal to the same bytes under deterministic
+// serialization, then Equal is guaranteed to report true.
 func Equal(x, y Message) bool {
 	if x == nil || y == nil {
 		return x == nil && y == nil
 	}
+	if reflect.TypeOf(x).Kind() == reflect.Ptr && x == y {
+		// Avoid an expensive comparison if both inputs are identical pointers.
+		return true
+	}
 	mx := x.ProtoReflect()
 	my := y.ProtoReflect()
 	if mx.IsValid() != my.IsValid() {
 		return false
 	}
-	return equalMessage(mx, my)
-}
-
-// equalMessage compares two messages.
-func equalMessage(mx, my pref.Message) bool {
-	if mx.Descriptor() != my.Descriptor() {
-		return false
-	}
-
-	nx := 0
-	equal := true
-	mx.Range(func(fd pref.FieldDescriptor, vx pref.Value) bool {
-		nx++
-		vy := my.Get(fd)
-		equal = my.Has(fd) && equalField(fd, vx, vy)
-		return equal
-	})
-	if !equal {
-		return false
-	}
-	ny := 0
-	my.Range(func(fd pref.FieldDescriptor, vx pref.Value) bool {
-		ny++
-		return true
-	})
-	if nx != ny {
-		return false
-	}
-
-	return equalUnknown(mx.GetUnknown(), my.GetUnknown())
-}
-
-// equalField compares two fields.
-func equalField(fd pref.FieldDescriptor, x, y pref.Value) bool {
-	switch {
-	case fd.IsList():
-		return equalList(fd, x.List(), y.List())
-	case fd.IsMap():
-		return equalMap(fd, x.Map(), y.Map())
-	default:
-		return equalValue(fd, x, y)
-	}
-}
-
-// equalMap compares two maps.
-func equalMap(fd pref.FieldDescriptor, x, y pref.Map) bool {
-	if x.Len() != y.Len() {
-		return false
-	}
-	equal := true
-	x.Range(func(k pref.MapKey, vx pref.Value) bool {
-		vy := y.Get(k)
-		equal = y.Has(k) && equalValue(fd.MapValue(), vx, vy)
-		return equal
-	})
-	return equal
-}
-
-// equalList compares two lists.
-func equalList(fd pref.FieldDescriptor, x, y pref.List) bool {
-	if x.Len() != y.Len() {
-		return false
-	}
-	for i := x.Len() - 1; i >= 0; i-- {
-		if !equalValue(fd, x.Get(i), y.Get(i)) {
-			return false
-		}
-	}
-	return true
-}
-
-// equalValue compares two singular values.
-func equalValue(fd pref.FieldDescriptor, x, y pref.Value) bool {
-	switch fd.Kind() {
-	case pref.BoolKind:
-		return x.Bool() == y.Bool()
-	case pref.EnumKind:
-		return x.Enum() == y.Enum()
-	case pref.Int32Kind, pref.Sint32Kind,
-		pref.Int64Kind, pref.Sint64Kind,
-		pref.Sfixed32Kind, pref.Sfixed64Kind:
-		return x.Int() == y.Int()
-	case pref.Uint32Kind, pref.Uint64Kind,
-		pref.Fixed32Kind, pref.Fixed64Kind:
-		return x.Uint() == y.Uint()
-	case pref.FloatKind, pref.DoubleKind:
-		fx := x.Float()
-		fy := y.Float()
-		if math.IsNaN(fx) || math.IsNaN(fy) {
-			return math.IsNaN(fx) && math.IsNaN(fy)
-		}
-		return fx == fy
-	case pref.StringKind:
-		return x.String() == y.String()
-	case pref.BytesKind:
-		return bytes.Equal(x.Bytes(), y.Bytes())
-	case pref.MessageKind, pref.GroupKind:
-		return equalMessage(x.Message(), y.Message())
-	default:
-		return x.Interface() == y.Interface()
-	}
-}
-
-// equalUnknown compares unknown fields by direct comparison on the raw bytes
-// of each individual field number.
-func equalUnknown(x, y pref.RawFields) bool {
-	if len(x) != len(y) {
-		return false
-	}
-	if bytes.Equal([]byte(x), []byte(y)) {
-		return true
-	}
-
-	mx := make(map[pref.FieldNumber]pref.RawFields)
-	my := make(map[pref.FieldNumber]pref.RawFields)
-	for len(x) > 0 {
-		fnum, _, n := protowire.ConsumeField(x)
-		mx[fnum] = append(mx[fnum], x[:n]...)
-		x = x[n:]
-	}
-	for len(y) > 0 {
-		fnum, _, n := protowire.ConsumeField(y)
-		my[fnum] = append(my[fnum], y[:n]...)
-		y = y[n:]
-	}
-	return reflect.DeepEqual(mx, my)
+	vx := protoreflect.ValueOfMessage(mx)
+	vy := protoreflect.ValueOfMessage(my)
+	return vx.Equal(vy)
 }
diff --git a/vendor/google.golang.org/protobuf/proto/proto_methods.go b/vendor/google.golang.org/protobuf/proto/proto_methods.go
index d8dd604f6b..465e057b32 100644
--- a/vendor/google.golang.org/protobuf/proto/proto_methods.go
+++ b/vendor/google.golang.org/protobuf/proto/proto_methods.go
@@ -3,6 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // The protoreflect build tag disables use of fast-path methods.
+//go:build !protoreflect
 // +build !protoreflect
 
 package proto
diff --git a/vendor/google.golang.org/protobuf/proto/proto_reflect.go b/vendor/google.golang.org/protobuf/proto/proto_reflect.go
index b103d43205..494d6ceef9 100644
--- a/vendor/google.golang.org/protobuf/proto/proto_reflect.go
+++ b/vendor/google.golang.org/protobuf/proto/proto_reflect.go
@@ -3,6 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // The protoreflect build tag disables use of fast-path methods.
+//go:build protoreflect
 // +build protoreflect
 
 package proto
diff --git a/vendor/google.golang.org/protobuf/reflect/protodesc/desc_resolve.go b/vendor/google.golang.org/protobuf/reflect/protodesc/desc_resolve.go
index cebb36cdad..27d7e35012 100644
--- a/vendor/google.golang.org/protobuf/reflect/protodesc/desc_resolve.go
+++ b/vendor/google.golang.org/protobuf/reflect/protodesc/desc_resolve.go
@@ -155,9 +155,9 @@ func (r *resolver) findTarget(k protoreflect.Kind, scope protoreflect.FullName,
 //
 // Suppose the scope was "fizz.buzz" and the reference was "Foo.Bar",
 // then the following full names are searched:
-//	* fizz.buzz.Foo.Bar
-//	* fizz.Foo.Bar
-//	* Foo.Bar
+//   - fizz.buzz.Foo.Bar
+//   - fizz.Foo.Bar
+//   - Foo.Bar
 func (r *resolver) findDescriptor(scope protoreflect.FullName, ref partialName) (protoreflect.Descriptor, error) {
 	if !ref.IsValid() {
 		return nil, errors.New("invalid name reference: %q", ref)
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/methods.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/methods.go
index 6be5d16e9f..d5d5af6ebe 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/methods.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/methods.go
@@ -53,6 +53,7 @@ type (
 			FindExtensionByName(field FullName) (ExtensionType, error)
 			FindExtensionByNumber(message FullName, field FieldNumber) (ExtensionType, error)
 		}
+		Depth int
 	}
 	unmarshalOutput = struct {
 		pragma.NoUnkeyedLiterals
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/proto.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/proto.go
index dd85915bd4..55aa14922b 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/proto.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/proto.go
@@ -8,8 +8,7 @@
 // defined in proto source files and value interfaces which provide the
 // ability to examine and manipulate the contents of messages.
 //
-//
-// Protocol Buffer Descriptors
+// # Protocol Buffer Descriptors
 //
 // Protobuf descriptors (e.g., EnumDescriptor or MessageDescriptor)
 // are immutable objects that represent protobuf type information.
@@ -26,8 +25,7 @@
 // The "google.golang.org/protobuf/reflect/protodesc" package converts between
 // google.protobuf.DescriptorProto messages and protobuf descriptors.
 //
-//
-// Go Type Descriptors
+// # Go Type Descriptors
 //
 // A type descriptor (e.g., EnumType or MessageType) is a constructor for
 // a concrete Go type that represents the associated protobuf descriptor.
@@ -41,8 +39,7 @@
 // The "google.golang.org/protobuf/types/dynamicpb" package can be used to
 // create Go type descriptors from protobuf descriptors.
 //
-//
-// Value Interfaces
+// # Value Interfaces
 //
 // The Enum and Message interfaces provide a reflective view over an
 // enum or message instance. For enums, it provides the ability to retrieve
@@ -55,13 +52,11 @@
 // The "github.com/golang/protobuf/proto".MessageReflect function can be used
 // to obtain a reflective view on older messages.
 //
-//
-// Relationships
+// # Relationships
 //
 // The following diagrams demonstrate the relationships between
 // various types declared in this package.
 //
-//
 //	                       ┌───────────────────────────────────┐
 //	                       V                                   │
 //	   ┌────────────── New(n) ─────────────┐                   │
@@ -83,7 +78,6 @@
 //
 // • An Enum is a concrete enum instance. Generated enums implement Enum.
 //
-//
 //	  ┌──────────────── New() ─────────────────┐
 //	  │                                        │
 //	  │         ┌─── Descriptor() ─────┐       │   ┌── Interface() ───┐
@@ -98,12 +92,22 @@
 //
 // • A MessageType describes a concrete Go message type.
 // It has a MessageDescriptor and can construct a Message instance.
+// Just as how Go's reflect.Type is a reflective description of a Go type,
+// a MessageType is a reflective description of a Go type for a protobuf message.
 //
 // • A MessageDescriptor describes an abstract protobuf message type.
-//
-// • A Message is a concrete message instance. Generated messages implement
-// ProtoMessage, which can convert to/from a Message.
-//
+// It has no understanding of Go types. In order to construct a MessageType
+// from just a MessageDescriptor, you can consider looking up the message type
+// in the global registry using protoregistry.GlobalTypes.FindMessageByName
+// or constructing a dynamic MessageType using dynamicpb.NewMessageType.
+//
+// • A Message is a reflective view over a concrete message instance.
+// Generated messages implement ProtoMessage, which can convert to a Message.
+// Just as how Go's reflect.Value is a reflective view over a Go value,
+// a Message is a reflective view over a concrete protobuf message instance.
+// Using Go reflection as an analogy, the ProtoReflect method is similar to
+// calling reflect.ValueOf, and the Message.Interface method is similar to
+// calling reflect.Value.Interface.
 //
 //	      ┌── TypeDescriptor() ──┐    ┌───── Descriptor() ─────┐
 //	      │                      V    │                        V
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/source.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/source.go
index 121ba3a07b..0b99428855 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/source.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/source.go
@@ -87,6 +87,7 @@ func (p1 SourcePath) Equal(p2 SourcePath) bool {
 // in a future version of this module.
 //
 // Example output:
+//
 //	.message_type[6].nested_type[15].field[3]
 func (p SourcePath) String() string {
 	b := p.appendFileDescriptorProto(nil)
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go
index b03c1223c4..54ce326df9 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/source_gen.go
@@ -35,6 +35,8 @@ func (p *SourcePath) appendFileDescriptorProto(b []byte) []byte {
 		b = p.appendSingularField(b, "source_code_info", (*SourcePath).appendSourceCodeInfo)
 	case 12:
 		b = p.appendSingularField(b, "syntax", nil)
+	case 13:
+		b = p.appendSingularField(b, "edition", nil)
 	}
 	return b
 }
@@ -236,6 +238,8 @@ func (p *SourcePath) appendMessageOptions(b []byte) []byte {
 		b = p.appendSingularField(b, "deprecated", nil)
 	case 7:
 		b = p.appendSingularField(b, "map_entry", nil)
+	case 11:
+		b = p.appendSingularField(b, "deprecated_legacy_json_field_conflicts", nil)
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
 	}
@@ -279,6 +283,8 @@ func (p *SourcePath) appendEnumOptions(b []byte) []byte {
 		b = p.appendSingularField(b, "allow_alias", nil)
 	case 3:
 		b = p.appendSingularField(b, "deprecated", nil)
+	case 6:
+		b = p.appendSingularField(b, "deprecated_legacy_json_field_conflicts", nil)
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
 	}
@@ -345,10 +351,18 @@ func (p *SourcePath) appendFieldOptions(b []byte) []byte {
 		b = p.appendSingularField(b, "jstype", nil)
 	case 5:
 		b = p.appendSingularField(b, "lazy", nil)
+	case 15:
+		b = p.appendSingularField(b, "unverified_lazy", nil)
 	case 3:
 		b = p.appendSingularField(b, "deprecated", nil)
 	case 10:
 		b = p.appendSingularField(b, "weak", nil)
+	case 16:
+		b = p.appendSingularField(b, "debug_redact", nil)
+	case 17:
+		b = p.appendSingularField(b, "retention", nil)
+	case 18:
+		b = p.appendSingularField(b, "target", nil)
 	case 999:
 		b = p.appendRepeatedField(b, "uninterpreted_option", (*SourcePath).appendUninterpretedOption)
 	}
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/type.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/type.go
index 8e53c44a91..3867470d30 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/type.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/type.go
@@ -480,6 +480,7 @@ type ExtensionDescriptors interface {
 // relative to the parent that it is declared within.
 //
 // For example:
+//
 //	syntax = "proto2";
 //	package example;
 //	message FooMessage {
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go
index f319810778..37601b7819 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/value.go
@@ -148,7 +148,7 @@ type Message interface {
 	// be preserved in marshaling or other operations.
 	IsValid() bool
 
-	// ProtoMethods returns optional fast-path implementions of various operations.
+	// ProtoMethods returns optional fast-path implementations of various operations.
 	// This method may return nil.
 	//
 	// The returned methods type is identical to
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_equal.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_equal.go
new file mode 100644
index 0000000000..591652541f
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_equal.go
@@ -0,0 +1,168 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package protoreflect
+
+import (
+	"bytes"
+	"fmt"
+	"math"
+	"reflect"
+
+	"google.golang.org/protobuf/encoding/protowire"
+)
+
+// Equal reports whether v1 and v2 are recursively equal.
+//
+//   - Values of different types are always unequal.
+//
+//   - Bytes values are equal if they contain identical bytes.
+//     Empty bytes (regardless of nil-ness) are considered equal.
+//
+//   - Floating point values are equal if they contain the same value.
+//     Unlike the == operator, a NaN is equal to another NaN.
+//
+//   - Enums are equal if they contain the same number.
+//     Since Value does not contain an enum descriptor,
+//     enum values do not consider the type of the enum.
+//
+//   - Other scalar values are equal if they contain the same value.
+//
+//   - Message values are equal if they belong to the same message descriptor,
+//     have the same set of populated known and extension field values,
+//     and the same set of unknown fields values.
+//
+//   - Lists are equal if they are the same length and
+//     each corresponding element is equal.
+//
+//   - Maps are equal if they have the same set of keys and
+//     the corresponding value for each key is equal.
+func (v1 Value) Equal(v2 Value) bool {
+	return equalValue(v1, v2)
+}
+
+func equalValue(x, y Value) bool {
+	eqType := x.typ == y.typ
+	switch x.typ {
+	case nilType:
+		return eqType
+	case boolType:
+		return eqType && x.Bool() == y.Bool()
+	case int32Type, int64Type:
+		return eqType && x.Int() == y.Int()
+	case uint32Type, uint64Type:
+		return eqType && x.Uint() == y.Uint()
+	case float32Type, float64Type:
+		return eqType && equalFloat(x.Float(), y.Float())
+	case stringType:
+		return eqType && x.String() == y.String()
+	case bytesType:
+		return eqType && bytes.Equal(x.Bytes(), y.Bytes())
+	case enumType:
+		return eqType && x.Enum() == y.Enum()
+	default:
+		switch x := x.Interface().(type) {
+		case Message:
+			y, ok := y.Interface().(Message)
+			return ok && equalMessage(x, y)
+		case List:
+			y, ok := y.Interface().(List)
+			return ok && equalList(x, y)
+		case Map:
+			y, ok := y.Interface().(Map)
+			return ok && equalMap(x, y)
+		default:
+			panic(fmt.Sprintf("unknown type: %T", x))
+		}
+	}
+}
+
+// equalFloat compares two floats, where NaNs are treated as equal.
+func equalFloat(x, y float64) bool {
+	if math.IsNaN(x) || math.IsNaN(y) {
+		return math.IsNaN(x) && math.IsNaN(y)
+	}
+	return x == y
+}
+
+// equalMessage compares two messages.
+func equalMessage(mx, my Message) bool {
+	if mx.Descriptor() != my.Descriptor() {
+		return false
+	}
+
+	nx := 0
+	equal := true
+	mx.Range(func(fd FieldDescriptor, vx Value) bool {
+		nx++
+		vy := my.Get(fd)
+		equal = my.Has(fd) && equalValue(vx, vy)
+		return equal
+	})
+	if !equal {
+		return false
+	}
+	ny := 0
+	my.Range(func(fd FieldDescriptor, vx Value) bool {
+		ny++
+		return true
+	})
+	if nx != ny {
+		return false
+	}
+
+	return equalUnknown(mx.GetUnknown(), my.GetUnknown())
+}
+
+// equalList compares two lists.
+func equalList(x, y List) bool {
+	if x.Len() != y.Len() {
+		return false
+	}
+	for i := x.Len() - 1; i >= 0; i-- {
+		if !equalValue(x.Get(i), y.Get(i)) {
+			return false
+		}
+	}
+	return true
+}
+
+// equalMap compares two maps.
+func equalMap(x, y Map) bool {
+	if x.Len() != y.Len() {
+		return false
+	}
+	equal := true
+	x.Range(func(k MapKey, vx Value) bool {
+		vy := y.Get(k)
+		equal = y.Has(k) && equalValue(vx, vy)
+		return equal
+	})
+	return equal
+}
+
+// equalUnknown compares unknown fields by direct comparison on the raw bytes
+// of each individual field number.
+func equalUnknown(x, y RawFields) bool {
+	if len(x) != len(y) {
+		return false
+	}
+	if bytes.Equal([]byte(x), []byte(y)) {
+		return true
+	}
+
+	mx := make(map[FieldNumber]RawFields)
+	my := make(map[FieldNumber]RawFields)
+	for len(x) > 0 {
+		fnum, _, n := protowire.ConsumeField(x)
+		mx[fnum] = append(mx[fnum], x[:n]...)
+		x = x[n:]
+	}
+	for len(y) > 0 {
+		fnum, _, n := protowire.ConsumeField(y)
+		my[fnum] = append(my[fnum], y[:n]...)
+		y = y[n:]
+	}
+	return reflect.DeepEqual(mx, my)
+}
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_pure.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_pure.go
index 918e685e1d..7ced876f4e 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_pure.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_pure.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build purego || appengine
 // +build purego appengine
 
 package protoreflect
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go
index 5a34147241..08e5ef73fc 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_union.go
@@ -41,6 +41,32 @@ import (
 // Converting to/from a Value and a concrete Go value panics on type mismatch.
 // For example, ValueOf("hello").Int() panics because this attempts to
 // retrieve an int64 from a string.
+//
+// List, Map, and Message Values are called "composite" values.
+//
+// A composite Value may alias (reference) memory at some location,
+// such that changes to the Value updates the that location.
+// A composite value acquired with a Mutable method, such as Message.Mutable,
+// always references the source object.
+//
+// For example:
+//
+//	// Append a 0 to a "repeated int32" field.
+//	// Since the Value returned by Mutable is guaranteed to alias
+//	// the source message, modifying the Value modifies the message.
+//	message.Mutable(fieldDesc).List().Append(protoreflect.ValueOfInt32(0))
+//
+//	// Assign [0] to a "repeated int32" field by creating a new Value,
+//	// modifying it, and assigning it.
+//	list := message.NewField(fieldDesc).List()
+//	list.Append(protoreflect.ValueOfInt32(0))
+//	message.Set(fieldDesc, list)
+//	// ERROR: Since it is not defined whether Set aliases the source,
+//	// appending to the List here may or may not modify the message.
+//	list.Append(protoreflect.ValueOfInt32(0))
+//
+// Some operations, such as Message.Get, may return an "empty, read-only"
+// composite Value. Modifying an empty, read-only value panics.
 type Value value
 
 // The protoreflect API uses a custom Value union type instead of interface{}
@@ -367,6 +393,7 @@ func (v Value) MapKey() MapKey {
 //	╚═════════╧═════════════════════════════════════╝
 //
 // A MapKey is constructed and accessed through a Value:
+//
 //	k := ValueOf("hash").MapKey() // convert string to MapKey
 //	s := k.String()               // convert MapKey to string
 //
diff --git a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_unsafe.go b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_unsafe.go
index c45debdcac..702ddf22a2 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoreflect/value_unsafe.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoreflect/value_unsafe.go
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego && !appengine
 // +build !purego,!appengine
 
 package protoreflect
diff --git a/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go b/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go
index 59f024c444..aeb5597744 100644
--- a/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go
+++ b/vendor/google.golang.org/protobuf/reflect/protoregistry/registry.go
@@ -30,9 +30,11 @@ import (
 // conflictPolicy configures the policy for handling registration conflicts.
 //
 // It can be over-written at compile time with a linker-initialized variable:
+//
 //	go build -ldflags "-X google.golang.org/protobuf/reflect/protoregistry.conflictPolicy=warn"
 //
 // It can be over-written at program execution with an environment variable:
+//
 //	GOLANG_PROTOBUF_REGISTRATION_CONFLICT=warn ./main
 //
 // Neither of the above are covered by the compatibility promise and
@@ -44,7 +46,7 @@ var conflictPolicy = "panic" // "panic" | "warn" | "ignore"
 // It is a variable so that the behavior is easily overridden in another file.
 var ignoreConflict = func(d protoreflect.Descriptor, err error) bool {
 	const env = "GOLANG_PROTOBUF_REGISTRATION_CONFLICT"
-	const faq = "https://developers.google.com/protocol-buffers/docs/reference/go/faq#namespace-conflict"
+	const faq = "https://protobuf.dev/reference/go/faq#namespace-conflict"
 	policy := conflictPolicy
 	if v := os.Getenv(env); v != "" {
 		policy = v
diff --git a/vendor/google.golang.org/protobuf/runtime/protoiface/methods.go b/vendor/google.golang.org/protobuf/runtime/protoiface/methods.go
index 32c04f67eb..44cf467d88 100644
--- a/vendor/google.golang.org/protobuf/runtime/protoiface/methods.go
+++ b/vendor/google.golang.org/protobuf/runtime/protoiface/methods.go
@@ -103,6 +103,7 @@ type UnmarshalInput = struct {
 		FindExtensionByName(field protoreflect.FullName) (protoreflect.ExtensionType, error)
 		FindExtensionByNumber(message protoreflect.FullName, field protoreflect.FieldNumber) (protoreflect.ExtensionType, error)
 	}
+	Depth int
 }
 
 // UnmarshalOutput is output from the Unmarshal method.
diff --git a/vendor/google.golang.org/protobuf/runtime/protoimpl/version.go b/vendor/google.golang.org/protobuf/runtime/protoimpl/version.go
index ff094e1ba4..a105cb23e0 100644
--- a/vendor/google.golang.org/protobuf/runtime/protoimpl/version.go
+++ b/vendor/google.golang.org/protobuf/runtime/protoimpl/version.go
@@ -26,16 +26,19 @@ const (
 // EnforceVersion is used by code generated by protoc-gen-go
 // to statically enforce minimum and maximum versions of this package.
 // A compilation failure implies either that:
-//	* the runtime package is too old and needs to be updated OR
-//	* the generated code is too old and needs to be regenerated.
+//   - the runtime package is too old and needs to be updated OR
+//   - the generated code is too old and needs to be regenerated.
 //
 // The runtime package can be upgraded by running:
+//
 //	go get google.golang.org/protobuf
 //
 // The generated code can be regenerated by running:
+//
 //	protoc --go_out=${PROTOC_GEN_GO_ARGS} ${PROTO_FILES}
 //
 // Example usage by generated code:
+//
 //	const (
 //		// Verify that this generated code is sufficiently up-to-date.
 //		_ = protoimpl.EnforceVersion(genVersion - protoimpl.MinVersion)
@@ -49,6 +52,7 @@ const (
 type EnforceVersion uint
 
 // This enforces the following invariant:
+//
 //	MinVersion ≤ GenVersion ≤ MaxVersion
 const (
 	_ = EnforceVersion(GenVersion - MinVersion)
diff --git a/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go b/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go
index abe4ab5115..dac5671db0 100644
--- a/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go
+++ b/vendor/google.golang.org/protobuf/types/descriptorpb/descriptor.pb.go
@@ -406,6 +406,152 @@ func (FieldOptions_JSType) EnumDescriptor() ([]byte, []int) {
 	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{12, 1}
 }
 
+// If set to RETENTION_SOURCE, the option will be omitted from the binary.
+// Note: as of January 2023, support for this is in progress and does not yet
+// have an effect (b/264593489).
+type FieldOptions_OptionRetention int32
+
+const (
+	FieldOptions_RETENTION_UNKNOWN FieldOptions_OptionRetention = 0
+	FieldOptions_RETENTION_RUNTIME FieldOptions_OptionRetention = 1
+	FieldOptions_RETENTION_SOURCE  FieldOptions_OptionRetention = 2
+)
+
+// Enum value maps for FieldOptions_OptionRetention.
+var (
+	FieldOptions_OptionRetention_name = map[int32]string{
+		0: "RETENTION_UNKNOWN",
+		1: "RETENTION_RUNTIME",
+		2: "RETENTION_SOURCE",
+	}
+	FieldOptions_OptionRetention_value = map[string]int32{
+		"RETENTION_UNKNOWN": 0,
+		"RETENTION_RUNTIME": 1,
+		"RETENTION_SOURCE":  2,
+	}
+)
+
+func (x FieldOptions_OptionRetention) Enum() *FieldOptions_OptionRetention {
+	p := new(FieldOptions_OptionRetention)
+	*p = x
+	return p
+}
+
+func (x FieldOptions_OptionRetention) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FieldOptions_OptionRetention) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[5].Descriptor()
+}
+
+func (FieldOptions_OptionRetention) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[5]
+}
+
+func (x FieldOptions_OptionRetention) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *FieldOptions_OptionRetention) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = FieldOptions_OptionRetention(num)
+	return nil
+}
+
+// Deprecated: Use FieldOptions_OptionRetention.Descriptor instead.
+func (FieldOptions_OptionRetention) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{12, 2}
+}
+
+// This indicates the types of entities that the field may apply to when used
+// as an option. If it is unset, then the field may be freely used as an
+// option on any kind of entity. Note: as of January 2023, support for this is
+// in progress and does not yet have an effect (b/264593489).
+type FieldOptions_OptionTargetType int32
+
+const (
+	FieldOptions_TARGET_TYPE_UNKNOWN         FieldOptions_OptionTargetType = 0
+	FieldOptions_TARGET_TYPE_FILE            FieldOptions_OptionTargetType = 1
+	FieldOptions_TARGET_TYPE_EXTENSION_RANGE FieldOptions_OptionTargetType = 2
+	FieldOptions_TARGET_TYPE_MESSAGE         FieldOptions_OptionTargetType = 3
+	FieldOptions_TARGET_TYPE_FIELD           FieldOptions_OptionTargetType = 4
+	FieldOptions_TARGET_TYPE_ONEOF           FieldOptions_OptionTargetType = 5
+	FieldOptions_TARGET_TYPE_ENUM            FieldOptions_OptionTargetType = 6
+	FieldOptions_TARGET_TYPE_ENUM_ENTRY      FieldOptions_OptionTargetType = 7
+	FieldOptions_TARGET_TYPE_SERVICE         FieldOptions_OptionTargetType = 8
+	FieldOptions_TARGET_TYPE_METHOD          FieldOptions_OptionTargetType = 9
+)
+
+// Enum value maps for FieldOptions_OptionTargetType.
+var (
+	FieldOptions_OptionTargetType_name = map[int32]string{
+		0: "TARGET_TYPE_UNKNOWN",
+		1: "TARGET_TYPE_FILE",
+		2: "TARGET_TYPE_EXTENSION_RANGE",
+		3: "TARGET_TYPE_MESSAGE",
+		4: "TARGET_TYPE_FIELD",
+		5: "TARGET_TYPE_ONEOF",
+		6: "TARGET_TYPE_ENUM",
+		7: "TARGET_TYPE_ENUM_ENTRY",
+		8: "TARGET_TYPE_SERVICE",
+		9: "TARGET_TYPE_METHOD",
+	}
+	FieldOptions_OptionTargetType_value = map[string]int32{
+		"TARGET_TYPE_UNKNOWN":         0,
+		"TARGET_TYPE_FILE":            1,
+		"TARGET_TYPE_EXTENSION_RANGE": 2,
+		"TARGET_TYPE_MESSAGE":         3,
+		"TARGET_TYPE_FIELD":           4,
+		"TARGET_TYPE_ONEOF":           5,
+		"TARGET_TYPE_ENUM":            6,
+		"TARGET_TYPE_ENUM_ENTRY":      7,
+		"TARGET_TYPE_SERVICE":         8,
+		"TARGET_TYPE_METHOD":          9,
+	}
+)
+
+func (x FieldOptions_OptionTargetType) Enum() *FieldOptions_OptionTargetType {
+	p := new(FieldOptions_OptionTargetType)
+	*p = x
+	return p
+}
+
+func (x FieldOptions_OptionTargetType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FieldOptions_OptionTargetType) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[6].Descriptor()
+}
+
+func (FieldOptions_OptionTargetType) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[6]
+}
+
+func (x FieldOptions_OptionTargetType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *FieldOptions_OptionTargetType) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = FieldOptions_OptionTargetType(num)
+	return nil
+}
+
+// Deprecated: Use FieldOptions_OptionTargetType.Descriptor instead.
+func (FieldOptions_OptionTargetType) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{12, 3}
+}
+
 // Is this method side-effect-free (or safe in HTTP parlance), or idempotent,
 // or neither? HTTP based RPC implementation may choose GET verb for safe
 // methods, and PUT verb for idempotent methods instead of the default POST.
@@ -442,11 +588,11 @@ func (x MethodOptions_IdempotencyLevel) String() string {
 }
 
 func (MethodOptions_IdempotencyLevel) Descriptor() protoreflect.EnumDescriptor {
-	return file_google_protobuf_descriptor_proto_enumTypes[5].Descriptor()
+	return file_google_protobuf_descriptor_proto_enumTypes[7].Descriptor()
 }
 
 func (MethodOptions_IdempotencyLevel) Type() protoreflect.EnumType {
-	return &file_google_protobuf_descriptor_proto_enumTypes[5]
+	return &file_google_protobuf_descriptor_proto_enumTypes[7]
 }
 
 func (x MethodOptions_IdempotencyLevel) Number() protoreflect.EnumNumber {
@@ -468,6 +614,70 @@ func (MethodOptions_IdempotencyLevel) EnumDescriptor() ([]byte, []int) {
 	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{17, 0}
 }
 
+// Represents the identified object's effect on the element in the original
+// .proto file.
+type GeneratedCodeInfo_Annotation_Semantic int32
+
+const (
+	// There is no effect or the effect is indescribable.
+	GeneratedCodeInfo_Annotation_NONE GeneratedCodeInfo_Annotation_Semantic = 0
+	// The element is set or otherwise mutated.
+	GeneratedCodeInfo_Annotation_SET GeneratedCodeInfo_Annotation_Semantic = 1
+	// An alias to the element is returned.
+	GeneratedCodeInfo_Annotation_ALIAS GeneratedCodeInfo_Annotation_Semantic = 2
+)
+
+// Enum value maps for GeneratedCodeInfo_Annotation_Semantic.
+var (
+	GeneratedCodeInfo_Annotation_Semantic_name = map[int32]string{
+		0: "NONE",
+		1: "SET",
+		2: "ALIAS",
+	}
+	GeneratedCodeInfo_Annotation_Semantic_value = map[string]int32{
+		"NONE":  0,
+		"SET":   1,
+		"ALIAS": 2,
+	}
+)
+
+func (x GeneratedCodeInfo_Annotation_Semantic) Enum() *GeneratedCodeInfo_Annotation_Semantic {
+	p := new(GeneratedCodeInfo_Annotation_Semantic)
+	*p = x
+	return p
+}
+
+func (x GeneratedCodeInfo_Annotation_Semantic) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (GeneratedCodeInfo_Annotation_Semantic) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_protobuf_descriptor_proto_enumTypes[8].Descriptor()
+}
+
+func (GeneratedCodeInfo_Annotation_Semantic) Type() protoreflect.EnumType {
+	return &file_google_protobuf_descriptor_proto_enumTypes[8]
+}
+
+func (x GeneratedCodeInfo_Annotation_Semantic) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Do not use.
+func (x *GeneratedCodeInfo_Annotation_Semantic) UnmarshalJSON(b []byte) error {
+	num, err := protoimpl.X.UnmarshalJSONEnum(x.Descriptor(), b)
+	if err != nil {
+		return err
+	}
+	*x = GeneratedCodeInfo_Annotation_Semantic(num)
+	return nil
+}
+
+// Deprecated: Use GeneratedCodeInfo_Annotation_Semantic.Descriptor instead.
+func (GeneratedCodeInfo_Annotation_Semantic) EnumDescriptor() ([]byte, []int) {
+	return file_google_protobuf_descriptor_proto_rawDescGZIP(), []int{20, 0, 0}
+}
+
 // The protocol compiler can output a FileDescriptorSet containing the .proto
 // files it parses.
 type FileDescriptorSet struct {
@@ -544,8 +754,12 @@ type FileDescriptorProto struct {
 	// development tools.
 	SourceCodeInfo *SourceCodeInfo `protobuf:"bytes,9,opt,name=source_code_info,json=sourceCodeInfo" json:"source_code_info,omitempty"`
 	// The syntax of the proto file.
-	// The supported values are "proto2" and "proto3".
+	// The supported values are "proto2", "proto3", and "editions".
+	//
+	// If `edition` is present, this value must be "editions".
 	Syntax *string `protobuf:"bytes,12,opt,name=syntax" json:"syntax,omitempty"`
+	// The edition of the proto file, which is an opaque string.
+	Edition *string `protobuf:"bytes,13,opt,name=edition" json:"edition,omitempty"`
 }
 
 func (x *FileDescriptorProto) Reset() {
@@ -664,6 +878,13 @@ func (x *FileDescriptorProto) GetSyntax() string {
 	return ""
 }
 
+func (x *FileDescriptorProto) GetEdition() string {
+	if x != nil && x.Edition != nil {
+		return *x.Edition
+	}
+	return ""
+}
+
 // Describes a message type.
 type DescriptorProto struct {
 	state         protoimpl.MessageState
@@ -860,7 +1081,6 @@ type FieldDescriptorProto struct {
 	// For booleans, "true" or "false".
 	// For strings, contains the default text contents (not escaped in any way).
 	// For bytes, contains the C escaped value.  All bytes >= 128 are escaped.
-	// TODO(kenton):  Base-64 encode?
 	DefaultValue *string `protobuf:"bytes,7,opt,name=default_value,json=defaultValue" json:"default_value,omitempty"`
 	// If set, gives the index of a oneof in the containing type's oneof_decl
 	// list.  This field is a member of that oneof.
@@ -1382,22 +1602,22 @@ type FileOptions struct {
 	// inappropriate because proto packages do not normally start with backwards
 	// domain names.
 	JavaPackage *string `protobuf:"bytes,1,opt,name=java_package,json=javaPackage" json:"java_package,omitempty"`
-	// If set, all the classes from the .proto file are wrapped in a single
-	// outer class with the given name.  This applies to both Proto1
-	// (equivalent to the old "--one_java_file" option) and Proto2 (where
-	// a .proto always translates to a single class, but you may want to
-	// explicitly choose the class name).
+	// Controls the name of the wrapper Java class generated for the .proto file.
+	// That class will always contain the .proto file's getDescriptor() method as
+	// well as any top-level extensions defined in the .proto file.
+	// If java_multiple_files is disabled, then all the other classes from the
+	// .proto file will be nested inside the single wrapper outer class.
 	JavaOuterClassname *string `protobuf:"bytes,8,opt,name=java_outer_classname,json=javaOuterClassname" json:"java_outer_classname,omitempty"`
-	// If set true, then the Java code generator will generate a separate .java
+	// If enabled, then the Java code generator will generate a separate .java
 	// file for each top-level message, enum, and service defined in the .proto
-	// file.  Thus, these types will *not* be nested inside the outer class
-	// named by java_outer_classname.  However, the outer class will still be
+	// file.  Thus, these types will *not* be nested inside the wrapper class
+	// named by java_outer_classname.  However, the wrapper class will still be
 	// generated to contain the file's getDescriptor() method as well as any
 	// top-level extensions defined in the file.
 	JavaMultipleFiles *bool `protobuf:"varint,10,opt,name=java_multiple_files,json=javaMultipleFiles,def=0" json:"java_multiple_files,omitempty"`
 	// This option does nothing.
 	//
-	// Deprecated: Do not use.
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
 	JavaGenerateEqualsAndHash *bool `protobuf:"varint,20,opt,name=java_generate_equals_and_hash,json=javaGenerateEqualsAndHash" json:"java_generate_equals_and_hash,omitempty"`
 	// If set true, then the Java2 code generator will generate code that
 	// throws an exception whenever an attempt is made to assign a non-UTF-8
@@ -1531,7 +1751,7 @@ func (x *FileOptions) GetJavaMultipleFiles() bool {
 	return Default_FileOptions_JavaMultipleFiles
 }
 
-// Deprecated: Do not use.
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
 func (x *FileOptions) GetJavaGenerateEqualsAndHash() bool {
 	if x != nil && x.JavaGenerateEqualsAndHash != nil {
 		return *x.JavaGenerateEqualsAndHash
@@ -1670,10 +1890,12 @@ type MessageOptions struct {
 	// efficient, has fewer features, and is more complicated.
 	//
 	// The message must be defined exactly as follows:
-	//   message Foo {
-	//     option message_set_wire_format = true;
-	//     extensions 4 to max;
-	//   }
+	//
+	//	message Foo {
+	//	  option message_set_wire_format = true;
+	//	  extensions 4 to max;
+	//	}
+	//
 	// Note that the message cannot have any defined fields; MessageSets only
 	// have extensions.
 	//
@@ -1692,28 +1914,44 @@ type MessageOptions struct {
 	// for the message, or it will be completely ignored; in the very least,
 	// this is a formalization for deprecating messages.
 	Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+	// NOTE: Do not set the option in .proto files. Always use the maps syntax
+	// instead. The option should only be implicitly set by the proto compiler
+	// parser.
+	//
 	// Whether the message is an automatically generated map entry type for the
 	// maps field.
 	//
 	// For maps fields:
-	//     map<KeyType, ValueType> map_field = 1;
+	//
+	//	map<KeyType, ValueType> map_field = 1;
+	//
 	// The parsed descriptor looks like:
-	//     message MapFieldEntry {
-	//         option map_entry = true;
-	//         optional KeyType key = 1;
-	//         optional ValueType value = 2;
-	//     }
-	//     repeated MapFieldEntry map_field = 1;
+	//
+	//	message MapFieldEntry {
+	//	    option map_entry = true;
+	//	    optional KeyType key = 1;
+	//	    optional ValueType value = 2;
+	//	}
+	//	repeated MapFieldEntry map_field = 1;
 	//
 	// Implementations may choose not to generate the map_entry=true message, but
 	// use a native map in the target language to hold the keys and values.
 	// The reflection APIs in such implementations still need to work as
 	// if the field is a repeated message field.
-	//
-	// NOTE: Do not set the option in .proto files. Always use the maps syntax
-	// instead. The option should only be implicitly set by the proto compiler
-	// parser.
 	MapEntry *bool `protobuf:"varint,7,opt,name=map_entry,json=mapEntry" json:"map_entry,omitempty"`
+	// Enable the legacy handling of JSON field name conflicts.  This lowercases
+	// and strips underscored from the fields before comparison in proto3 only.
+	// The new behavior takes `json_name` into account and applies to proto2 as
+	// well.
+	//
+	// This should only be used as a temporary measure against broken builds due
+	// to the change in behavior for JSON field name conflicts.
+	//
+	// TODO(b/261750190) This is legacy behavior we plan to remove once downstream
+	// teams have had time to migrate.
+	//
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+	DeprecatedLegacyJsonFieldConflicts *bool `protobuf:"varint,11,opt,name=deprecated_legacy_json_field_conflicts,json=deprecatedLegacyJsonFieldConflicts" json:"deprecated_legacy_json_field_conflicts,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 }
@@ -1785,6 +2023,14 @@ func (x *MessageOptions) GetMapEntry() bool {
 	return false
 }
 
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+func (x *MessageOptions) GetDeprecatedLegacyJsonFieldConflicts() bool {
+	if x != nil && x.DeprecatedLegacyJsonFieldConflicts != nil {
+		return *x.DeprecatedLegacyJsonFieldConflicts
+	}
+	return false
+}
+
 func (x *MessageOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if x != nil {
 		return x.UninterpretedOption
@@ -1838,7 +2084,6 @@ type FieldOptions struct {
 	// call from multiple threads concurrently, while non-const methods continue
 	// to require exclusive access.
 	//
-	//
 	// Note that implementations may choose not to check required fields within
 	// a lazy sub-message.  That is, calling IsInitialized() on the outer message
 	// may return true even if the inner message has missing required fields.
@@ -1849,7 +2094,14 @@ type FieldOptions struct {
 	// implementation must either *always* check its required fields, or *never*
 	// check its required fields, regardless of whether or not the message has
 	// been parsed.
+	//
+	// As of May 2022, lazy verifies the contents of the byte stream during
+	// parsing.  An invalid byte stream will cause the overall parsing to fail.
 	Lazy *bool `protobuf:"varint,5,opt,name=lazy,def=0" json:"lazy,omitempty"`
+	// unverified_lazy does no correctness checks on the byte stream. This should
+	// only be used where lazy with verification is prohibitive for performance
+	// reasons.
+	UnverifiedLazy *bool `protobuf:"varint,15,opt,name=unverified_lazy,json=unverifiedLazy,def=0" json:"unverified_lazy,omitempty"`
 	// Is this field deprecated?
 	// Depending on the target platform, this can emit Deprecated annotations
 	// for accessors, or it will be completely ignored; in the very least, this
@@ -1857,17 +2109,24 @@ type FieldOptions struct {
 	Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
 	// For Google-internal migration only. Do not use.
 	Weak *bool `protobuf:"varint,10,opt,name=weak,def=0" json:"weak,omitempty"`
+	// Indicate that the field value should not be printed out when using debug
+	// formats, e.g. when the field contains sensitive credentials.
+	DebugRedact *bool                          `protobuf:"varint,16,opt,name=debug_redact,json=debugRedact,def=0" json:"debug_redact,omitempty"`
+	Retention   *FieldOptions_OptionRetention  `protobuf:"varint,17,opt,name=retention,enum=google.protobuf.FieldOptions_OptionRetention" json:"retention,omitempty"`
+	Target      *FieldOptions_OptionTargetType `protobuf:"varint,18,opt,name=target,enum=google.protobuf.FieldOptions_OptionTargetType" json:"target,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 }
 
 // Default values for FieldOptions fields.
 const (
-	Default_FieldOptions_Ctype      = FieldOptions_STRING
-	Default_FieldOptions_Jstype     = FieldOptions_JS_NORMAL
-	Default_FieldOptions_Lazy       = bool(false)
-	Default_FieldOptions_Deprecated = bool(false)
-	Default_FieldOptions_Weak       = bool(false)
+	Default_FieldOptions_Ctype          = FieldOptions_STRING
+	Default_FieldOptions_Jstype         = FieldOptions_JS_NORMAL
+	Default_FieldOptions_Lazy           = bool(false)
+	Default_FieldOptions_UnverifiedLazy = bool(false)
+	Default_FieldOptions_Deprecated     = bool(false)
+	Default_FieldOptions_Weak           = bool(false)
+	Default_FieldOptions_DebugRedact    = bool(false)
 )
 
 func (x *FieldOptions) Reset() {
@@ -1930,6 +2189,13 @@ func (x *FieldOptions) GetLazy() bool {
 	return Default_FieldOptions_Lazy
 }
 
+func (x *FieldOptions) GetUnverifiedLazy() bool {
+	if x != nil && x.UnverifiedLazy != nil {
+		return *x.UnverifiedLazy
+	}
+	return Default_FieldOptions_UnverifiedLazy
+}
+
 func (x *FieldOptions) GetDeprecated() bool {
 	if x != nil && x.Deprecated != nil {
 		return *x.Deprecated
@@ -1944,6 +2210,27 @@ func (x *FieldOptions) GetWeak() bool {
 	return Default_FieldOptions_Weak
 }
 
+func (x *FieldOptions) GetDebugRedact() bool {
+	if x != nil && x.DebugRedact != nil {
+		return *x.DebugRedact
+	}
+	return Default_FieldOptions_DebugRedact
+}
+
+func (x *FieldOptions) GetRetention() FieldOptions_OptionRetention {
+	if x != nil && x.Retention != nil {
+		return *x.Retention
+	}
+	return FieldOptions_RETENTION_UNKNOWN
+}
+
+func (x *FieldOptions) GetTarget() FieldOptions_OptionTargetType {
+	if x != nil && x.Target != nil {
+		return *x.Target
+	}
+	return FieldOptions_TARGET_TYPE_UNKNOWN
+}
+
 func (x *FieldOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if x != nil {
 		return x.UninterpretedOption
@@ -2014,6 +2301,15 @@ type EnumOptions struct {
 	// for the enum, or it will be completely ignored; in the very least, this
 	// is a formalization for deprecating enums.
 	Deprecated *bool `protobuf:"varint,3,opt,name=deprecated,def=0" json:"deprecated,omitempty"`
+	// Enable the legacy handling of JSON field name conflicts.  This lowercases
+	// and strips underscored from the fields before comparison in proto3 only.
+	// The new behavior takes `json_name` into account and applies to proto2 as
+	// well.
+	// TODO(b/261750190) Remove this legacy behavior once downstream teams have
+	// had time to migrate.
+	//
+	// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+	DeprecatedLegacyJsonFieldConflicts *bool `protobuf:"varint,6,opt,name=deprecated_legacy_json_field_conflicts,json=deprecatedLegacyJsonFieldConflicts" json:"deprecated_legacy_json_field_conflicts,omitempty"`
 	// The parser stores options it doesn't recognize here. See above.
 	UninterpretedOption []*UninterpretedOption `protobuf:"bytes,999,rep,name=uninterpreted_option,json=uninterpretedOption" json:"uninterpreted_option,omitempty"`
 }
@@ -2069,6 +2365,14 @@ func (x *EnumOptions) GetDeprecated() bool {
 	return Default_EnumOptions_Deprecated
 }
 
+// Deprecated: Marked as deprecated in google/protobuf/descriptor.proto.
+func (x *EnumOptions) GetDeprecatedLegacyJsonFieldConflicts() bool {
+	if x != nil && x.DeprecatedLegacyJsonFieldConflicts != nil {
+		return *x.DeprecatedLegacyJsonFieldConflicts
+	}
+	return false
+}
+
 func (x *EnumOptions) GetUninterpretedOption() []*UninterpretedOption {
 	if x != nil {
 		return x.UninterpretedOption
@@ -2399,43 +2703,48 @@ type SourceCodeInfo struct {
 	// tools.
 	//
 	// For example, say we have a file like:
-	//   message Foo {
-	//     optional string foo = 1;
-	//   }
+	//
+	//	message Foo {
+	//	  optional string foo = 1;
+	//	}
+	//
 	// Let's look at just the field definition:
-	//   optional string foo = 1;
-	//   ^       ^^     ^^  ^  ^^^
-	//   a       bc     de  f  ghi
+	//
+	//	optional string foo = 1;
+	//	^       ^^     ^^  ^  ^^^
+	//	a       bc     de  f  ghi
+	//
 	// We have the following locations:
-	//   span   path               represents
-	//   [a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
-	//   [a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
-	//   [c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
-	//   [e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
-	//   [g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
+	//
+	//	span   path               represents
+	//	[a,i)  [ 4, 0, 2, 0 ]     The whole field definition.
+	//	[a,b)  [ 4, 0, 2, 0, 4 ]  The label (optional).
+	//	[c,d)  [ 4, 0, 2, 0, 5 ]  The type (string).
+	//	[e,f)  [ 4, 0, 2, 0, 1 ]  The name (foo).
+	//	[g,h)  [ 4, 0, 2, 0, 3 ]  The number (1).
 	//
 	// Notes:
-	// - A location may refer to a repeated field itself (i.e. not to any
-	//   particular index within it).  This is used whenever a set of elements are
-	//   logically enclosed in a single code segment.  For example, an entire
-	//   extend block (possibly containing multiple extension definitions) will
-	//   have an outer location whose path refers to the "extensions" repeated
-	//   field without an index.
-	// - Multiple locations may have the same path.  This happens when a single
-	//   logical declaration is spread out across multiple places.  The most
-	//   obvious example is the "extend" block again -- there may be multiple
-	//   extend blocks in the same scope, each of which will have the same path.
-	// - A location's span is not always a subset of its parent's span.  For
-	//   example, the "extendee" of an extension declaration appears at the
-	//   beginning of the "extend" block and is shared by all extensions within
-	//   the block.
-	// - Just because a location's span is a subset of some other location's span
-	//   does not mean that it is a descendant.  For example, a "group" defines
-	//   both a type and a field in a single declaration.  Thus, the locations
-	//   corresponding to the type and field and their components will overlap.
-	// - Code which tries to interpret locations should probably be designed to
-	//   ignore those that it doesn't understand, as more types of locations could
-	//   be recorded in the future.
+	//   - A location may refer to a repeated field itself (i.e. not to any
+	//     particular index within it).  This is used whenever a set of elements are
+	//     logically enclosed in a single code segment.  For example, an entire
+	//     extend block (possibly containing multiple extension definitions) will
+	//     have an outer location whose path refers to the "extensions" repeated
+	//     field without an index.
+	//   - Multiple locations may have the same path.  This happens when a single
+	//     logical declaration is spread out across multiple places.  The most
+	//     obvious example is the "extend" block again -- there may be multiple
+	//     extend blocks in the same scope, each of which will have the same path.
+	//   - A location's span is not always a subset of its parent's span.  For
+	//     example, the "extendee" of an extension declaration appears at the
+	//     beginning of the "extend" block and is shared by all extensions within
+	//     the block.
+	//   - Just because a location's span is a subset of some other location's span
+	//     does not mean that it is a descendant.  For example, a "group" defines
+	//     both a type and a field in a single declaration.  Thus, the locations
+	//     corresponding to the type and field and their components will overlap.
+	//   - Code which tries to interpret locations should probably be designed to
+	//     ignore those that it doesn't understand, as more types of locations could
+	//     be recorded in the future.
 	Location []*SourceCodeInfo_Location `protobuf:"bytes,1,rep,name=location" json:"location,omitempty"`
 }
 
@@ -2715,8 +3024,8 @@ func (x *EnumDescriptorProto_EnumReservedRange) GetEnd() int32 {
 // The name of the uninterpreted option.  Each string represents a segment in
 // a dot-separated name.  is_extension is true iff a segment represents an
 // extension (denoted with parentheses in options specs in .proto files).
-// E.g.,{ ["foo", false], ["bar.baz", true], ["qux", false] } represents
-// "foo.(bar.baz).qux".
+// E.g.,{ ["foo", false], ["bar.baz", true], ["moo", false] } represents
+// "foo.(bar.baz).moo".
 type UninterpretedOption_NamePart struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2781,23 +3090,34 @@ type SourceCodeInfo_Location struct {
 	// location.
 	//
 	// Each element is a field number or an index.  They form a path from
-	// the root FileDescriptorProto to the place where the definition.  For
-	// example, this path:
-	//   [ 4, 3, 2, 7, 1 ]
+	// the root FileDescriptorProto to the place where the definition occurs.
+	// For example, this path:
+	//
+	//	[ 4, 3, 2, 7, 1 ]
+	//
 	// refers to:
-	//   file.message_type(3)  // 4, 3
-	//       .field(7)         // 2, 7
-	//       .name()           // 1
+	//
+	//	file.message_type(3)  // 4, 3
+	//	    .field(7)         // 2, 7
+	//	    .name()           // 1
+	//
 	// This is because FileDescriptorProto.message_type has field number 4:
-	//   repeated DescriptorProto message_type = 4;
+	//
+	//	repeated DescriptorProto message_type = 4;
+	//
 	// and DescriptorProto.field has field number 2:
-	//   repeated FieldDescriptorProto field = 2;
+	//
+	//	repeated FieldDescriptorProto field = 2;
+	//
 	// and FieldDescriptorProto.name has field number 1:
-	//   optional string name = 1;
+	//
+	//	optional string name = 1;
 	//
 	// Thus, the above path gives the location of a field name.  If we removed
 	// the last element:
-	//   [ 4, 3, 2, 7 ]
+	//
+	//	[ 4, 3, 2, 7 ]
+	//
 	// this path refers to the whole field declaration (from the beginning
 	// of the label to the terminating semicolon).
 	Path []int32 `protobuf:"varint,1,rep,packed,name=path" json:"path,omitempty"`
@@ -2826,34 +3146,34 @@ type SourceCodeInfo_Location struct {
 	//
 	// Examples:
 	//
-	//   optional int32 foo = 1;  // Comment attached to foo.
-	//   // Comment attached to bar.
-	//   optional int32 bar = 2;
+	//	optional int32 foo = 1;  // Comment attached to foo.
+	//	// Comment attached to bar.
+	//	optional int32 bar = 2;
 	//
-	//   optional string baz = 3;
-	//   // Comment attached to baz.
-	//   // Another line attached to baz.
+	//	optional string baz = 3;
+	//	// Comment attached to baz.
+	//	// Another line attached to baz.
 	//
-	//   // Comment attached to qux.
-	//   //
-	//   // Another line attached to qux.
-	//   optional double qux = 4;
+	//	// Comment attached to moo.
+	//	//
+	//	// Another line attached to moo.
+	//	optional double moo = 4;
 	//
-	//   // Detached comment for corge. This is not leading or trailing comments
-	//   // to qux or corge because there are blank lines separating it from
-	//   // both.
+	//	// Detached comment for corge. This is not leading or trailing comments
+	//	// to moo or corge because there are blank lines separating it from
+	//	// both.
 	//
-	//   // Detached comment for corge paragraph 2.
+	//	// Detached comment for corge paragraph 2.
 	//
-	//   optional string corge = 5;
-	//   /* Block comment attached
-	//    * to corge.  Leading asterisks
-	//    * will be removed. */
-	//   /* Block comment attached to
-	//    * grault. */
-	//   optional int32 grault = 6;
+	//	optional string corge = 5;
+	//	/* Block comment attached
+	//	 * to corge.  Leading asterisks
+	//	 * will be removed. */
+	//	/* Block comment attached to
+	//	 * grault. */
+	//	optional int32 grault = 6;
 	//
-	//   // ignored detached comments.
+	//	// ignored detached comments.
 	LeadingComments         *string  `protobuf:"bytes,3,opt,name=leading_comments,json=leadingComments" json:"leading_comments,omitempty"`
 	TrailingComments        *string  `protobuf:"bytes,4,opt,name=trailing_comments,json=trailingComments" json:"trailing_comments,omitempty"`
 	LeadingDetachedComments []string `protobuf:"bytes,6,rep,name=leading_detached_comments,json=leadingDetachedComments" json:"leading_detached_comments,omitempty"`
@@ -2940,9 +3260,10 @@ type GeneratedCodeInfo_Annotation struct {
 	// that relates to the identified object.
 	Begin *int32 `protobuf:"varint,3,opt,name=begin" json:"begin,omitempty"`
 	// Identifies the ending offset in bytes in the generated code that
-	// relates to the identified offset. The end offset should be one past
+	// relates to the identified object. The end offset should be one past
 	// the last relevant byte (so the length of the text = end - begin).
-	End *int32 `protobuf:"varint,4,opt,name=end" json:"end,omitempty"`
+	End      *int32                                 `protobuf:"varint,4,opt,name=end" json:"end,omitempty"`
+	Semantic *GeneratedCodeInfo_Annotation_Semantic `protobuf:"varint,5,opt,name=semantic,enum=google.protobuf.GeneratedCodeInfo_Annotation_Semantic" json:"semantic,omitempty"`
 }
 
 func (x *GeneratedCodeInfo_Annotation) Reset() {
@@ -3005,6 +3326,13 @@ func (x *GeneratedCodeInfo_Annotation) GetEnd() int32 {
 	return 0
 }
 
+func (x *GeneratedCodeInfo_Annotation) GetSemantic() GeneratedCodeInfo_Annotation_Semantic {
+	if x != nil && x.Semantic != nil {
+		return *x.Semantic
+	}
+	return GeneratedCodeInfo_Annotation_NONE
+}
+
 var File_google_protobuf_descriptor_proto protoreflect.FileDescriptor
 
 var file_google_protobuf_descriptor_proto_rawDesc = []byte{
@@ -3016,7 +3344,7 @@ var file_google_protobuf_descriptor_proto_rawDesc = []byte{
 	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73,
 	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x04, 0x66, 0x69,
-	0x6c, 0x65, 0x22, 0xe4, 0x04, 0x0a, 0x13, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72,
+	0x6c, 0x65, 0x22, 0xfe, 0x04, 0x0a, 0x13, 0x46, 0x69, 0x6c, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72,
 	0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
 	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18,
 	0x0a, 0x07, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
@@ -3054,330 +3382,391 @@ var file_google_protobuf_descriptor_proto_rawDesc = []byte{
 	0x75, 0x66, 0x2e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66,
 	0x6f, 0x52, 0x0e, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66,
 	0x6f, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x79, 0x6e, 0x74, 0x61, 0x78, 0x18, 0x0c, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x73, 0x79, 0x6e, 0x74, 0x61, 0x78, 0x22, 0xb9, 0x06, 0x0a, 0x0f, 0x44, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x3b, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x43,
-	0x0a, 0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
-	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x0b, 0x6e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x65, 0x73, 0x63, 0x72,
-	0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x0a, 0x6e, 0x65, 0x73, 0x74,
-	0x65, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x41, 0x0a, 0x09, 0x65, 0x6e, 0x75, 0x6d, 0x5f, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52,
-	0x08, 0x65, 0x6e, 0x75, 0x6d, 0x54, 0x79, 0x70, 0x65, 0x12, 0x58, 0x0a, 0x0f, 0x65, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x05, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x09, 0x52, 0x06, 0x73, 0x79, 0x6e, 0x74, 0x61, 0x78, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x64, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x22, 0xb9, 0x06, 0x0a, 0x0f, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3b, 0x0a, 0x05, 0x66,
+	0x69, 0x65, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65,
+	0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x43, 0x0a, 0x09, 0x65, 0x78, 0x74, 0x65,
+	0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f,
+	0x74, 0x6f, 0x52, 0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a,
+	0x0b, 0x6e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61,
-	0x6e, 0x67, 0x65, 0x52, 0x0e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61,
-	0x6e, 0x67, 0x65, 0x12, 0x44, 0x0a, 0x0a, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x5f, 0x64, 0x65, 0x63,
-	0x6c, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x09,
-	0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x44, 0x65, 0x63, 0x6c, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73,
-	0x73, 0x61, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x55, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64,
-	0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x67,
+	0x72, 0x6f, 0x74, 0x6f, 0x52, 0x0a, 0x6e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x41, 0x0a, 0x09, 0x65, 0x6e, 0x75, 0x6d, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x08, 0x65, 0x6e, 0x75, 0x6d, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x58, 0x0a, 0x0f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x67,
 	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52,
-	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0d, 0x72, 0x65,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x72,
-	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65,
-	0x1a, 0x7a, 0x0a, 0x0e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e,
-	0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x12, 0x40, 0x0a, 0x07, 0x6f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x78,
-	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x37, 0x0a, 0x0d,
-	0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a,
-	0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x03, 0x65, 0x6e, 0x64, 0x22, 0x7c, 0x0a, 0x15, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
-	0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58,
-	0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74,
-	0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80,
-	0x80, 0x80, 0x02, 0x22, 0xc1, 0x06, 0x0a, 0x14, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x41, 0x0a, 0x05, 0x6c, 0x61, 0x62, 0x65,
-	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4c,
-	0x61, 0x62, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x3e, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c,
-	0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74,
-	0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x74, 0x79, 0x70, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65,
-	0x6e, 0x64, 0x65, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65,
-	0x6e, 0x64, 0x65, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x66,
-	0x61, 0x75, 0x6c, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x6e, 0x65,
-	0x6f, 0x66, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a,
-	0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x1b, 0x0a, 0x09, 0x6a, 0x73,
-	0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a,
-	0x73, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x12, 0x27, 0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x61, 0x6c, 0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0xb6, 0x02, 0x0a, 0x04, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x44, 0x4f, 0x55, 0x42, 0x4c,
-	0x45, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x4c, 0x4f, 0x41,
-	0x54, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x36,
-	0x34, 0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e, 0x54,
-	0x36, 0x34, 0x10, 0x04, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54,
-	0x33, 0x32, 0x10, 0x05, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x58,
-	0x45, 0x44, 0x36, 0x34, 0x10, 0x06, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46,
-	0x49, 0x58, 0x45, 0x44, 0x33, 0x32, 0x10, 0x07, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x10, 0x08, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f,
-	0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x09, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x47, 0x52, 0x4f, 0x55, 0x50, 0x10, 0x0a, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45, 0x10, 0x0b, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x42, 0x59, 0x54, 0x45, 0x53, 0x10, 0x0c, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x0d, 0x12, 0x0d, 0x0a, 0x09, 0x54,
-	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x10, 0x0e, 0x12, 0x11, 0x0a, 0x0d, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x53, 0x46, 0x49, 0x58, 0x45, 0x44, 0x33, 0x32, 0x10, 0x0f, 0x12, 0x11, 0x0a,
-	0x0d, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x46, 0x49, 0x58, 0x45, 0x44, 0x36, 0x34, 0x10, 0x10,
-	0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10,
-	0x11, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x36, 0x34,
-	0x10, 0x12, 0x22, 0x43, 0x0a, 0x05, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x12, 0x0a, 0x0e, 0x4c,
-	0x41, 0x42, 0x45, 0x4c, 0x5f, 0x4f, 0x50, 0x54, 0x49, 0x4f, 0x4e, 0x41, 0x4c, 0x10, 0x01, 0x12,
-	0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x49, 0x52, 0x45,
-	0x44, 0x10, 0x02, 0x12, 0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x50,
-	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x03, 0x22, 0x63, 0x0a, 0x14, 0x4f, 0x6e, 0x65, 0x6f, 0x66,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xe3, 0x02, 0x0a,
-	0x13, 0x45, 0x6e, 0x75, 0x6d, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50,
-	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75,
-	0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x12, 0x5d, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x72, 0x61,
-	0x6e, 0x67, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67,
-	0x65, 0x52, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65,
-	0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x64, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x3b, 0x0a, 0x11, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65,
-	0x6e, 0x64, 0x22, 0x83, 0x01, 0x0a, 0x18, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x3b, 0x0a, 0x07, 0x6f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45,
-	0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52,
-	0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x16, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72,
-	0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
-	0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64,
-	0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52,
-	0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x22, 0x89, 0x02, 0x0a, 0x15, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x73,
-	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12,
-	0x1f, 0x0a, 0x0b, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x38, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30, 0x0a, 0x10, 0x63, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x12, 0x30, 0x0a, 0x10,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x22, 0x91,
-	0x09, 0x0a, 0x0b, 0x46, 0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x21,
-	0x0a, 0x0c, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6a, 0x61, 0x76, 0x61, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67,
-	0x65, 0x12, 0x30, 0x0a, 0x14, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f,
-	0x63, 0x6c, 0x61, 0x73, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x12, 0x6a, 0x61, 0x76, 0x61, 0x4f, 0x75, 0x74, 0x65, 0x72, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x35, 0x0a, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6d, 0x75, 0x6c, 0x74,
-	0x69, 0x70, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08,
-	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x11, 0x6a, 0x61, 0x76, 0x61, 0x4d, 0x75, 0x6c,
-	0x74, 0x69, 0x70, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x44, 0x0a, 0x1d, 0x6a, 0x61,
-	0x76, 0x61, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x71, 0x75, 0x61,
-	0x6c, 0x73, 0x5f, 0x61, 0x6e, 0x64, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x14, 0x20, 0x01, 0x28,
-	0x08, 0x42, 0x02, 0x18, 0x01, 0x52, 0x19, 0x6a, 0x61, 0x76, 0x61, 0x47, 0x65, 0x6e, 0x65, 0x72,
-	0x61, 0x74, 0x65, 0x45, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x41, 0x6e, 0x64, 0x48, 0x61, 0x73, 0x68,
-	0x12, 0x3a, 0x0a, 0x16, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f,
-	0x63, 0x68, 0x65, 0x63, 0x6b, 0x5f, 0x75, 0x74, 0x66, 0x38, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x08,
-	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x53, 0x74, 0x72,
-	0x69, 0x6e, 0x67, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x55, 0x74, 0x66, 0x38, 0x12, 0x53, 0x0a, 0x0c,
-	0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x09, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x3a, 0x05, 0x53,
-	0x50, 0x45, 0x45, 0x44, 0x52, 0x0b, 0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x46, 0x6f,
-	0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x67, 0x6f, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18,
-	0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x67, 0x6f, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65,
-	0x12, 0x35, 0x0a, 0x13, 0x63, 0x63, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66,
-	0x61, 0x6c, 0x73, 0x65, 0x52, 0x11, 0x63, 0x63, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x15, 0x6a, 0x61, 0x76, 0x61, 0x5f,
-	0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a,
-	0x61, 0x76, 0x61, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x35, 0x0a, 0x13, 0x70, 0x79, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63,
-	0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x3a,
-	0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x11, 0x70, 0x79, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69,
-	0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x14, 0x70, 0x68, 0x70,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0e, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x44, 0x0a,
+	0x0a, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x5f, 0x64, 0x65, 0x63, 0x6c, 0x18, 0x08, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x25, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x09, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x44,
+	0x65, 0x63, 0x6c, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x55,
+	0x0a, 0x0e, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65,
+	0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64,
+	0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x7a, 0x0a, 0x0e, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x03, 0x65, 0x6e, 0x64, 0x12, 0x40, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x37, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a,
+	0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x22,
+	0x7c, 0x0a, 0x15, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x61, 0x6e, 0x67,
+	0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65,
+	0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75,
+	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0xc1, 0x06,
+	0x0a, 0x14, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f,
+	0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75,
+	0x6d, 0x62, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62,
+	0x65, 0x72, 0x12, 0x41, 0x0a, 0x05, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x2b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x05,
+	0x6c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x3e, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x79, 0x70, 0x65, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x65, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x65, 0x65, 0x12, 0x23,
+	0x0a, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x5f, 0x69, 0x6e, 0x64,
+	0x65, 0x78, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x6f, 0x6e, 0x65, 0x6f, 0x66, 0x49,
+	0x6e, 0x64, 0x65, 0x78, 0x12, 0x1b, 0x0a, 0x09, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a, 0x73, 0x6f, 0x6e, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x11, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, 0x4f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x61, 0x6c, 0x22, 0xb6, 0x02, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x44, 0x4f, 0x55, 0x42, 0x4c, 0x45, 0x10, 0x01, 0x12, 0x0e, 0x0a,
+	0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x4c, 0x4f, 0x41, 0x54, 0x10, 0x02, 0x12, 0x0e, 0x0a,
+	0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x03, 0x12, 0x0f, 0x0a,
+	0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x04, 0x12, 0x0e,
+	0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x05, 0x12, 0x10,
+	0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x58, 0x45, 0x44, 0x36, 0x34, 0x10, 0x06,
+	0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x58, 0x45, 0x44, 0x33, 0x32,
+	0x10, 0x07, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x10,
+	0x08, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47,
+	0x10, 0x09, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x47, 0x52, 0x4f, 0x55, 0x50,
+	0x10, 0x0a, 0x12, 0x10, 0x0a, 0x0c, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41,
+	0x47, 0x45, 0x10, 0x0b, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x42, 0x59, 0x54,
+	0x45, 0x53, 0x10, 0x0c, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x49, 0x4e,
+	0x54, 0x33, 0x32, 0x10, 0x0d, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e,
+	0x55, 0x4d, 0x10, 0x0e, 0x12, 0x11, 0x0a, 0x0d, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x46, 0x49,
+	0x58, 0x45, 0x44, 0x33, 0x32, 0x10, 0x0f, 0x12, 0x11, 0x0a, 0x0d, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x53, 0x46, 0x49, 0x58, 0x45, 0x44, 0x36, 0x34, 0x10, 0x10, 0x12, 0x0f, 0x0a, 0x0b, 0x54, 0x59,
+	0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x11, 0x12, 0x0f, 0x0a, 0x0b, 0x54,
+	0x59, 0x50, 0x45, 0x5f, 0x53, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x12, 0x22, 0x43, 0x0a, 0x05,
+	0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x4f,
+	0x50, 0x54, 0x49, 0x4f, 0x4e, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x4c, 0x41, 0x42,
+	0x45, 0x4c, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x49, 0x52, 0x45, 0x44, 0x10, 0x02, 0x12, 0x12, 0x0a,
+	0x0e, 0x4c, 0x41, 0x42, 0x45, 0x4c, 0x5f, 0x52, 0x45, 0x50, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10,
+	0x03, 0x22, 0x63, 0x0a, 0x14, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a,
+	0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xe3, 0x02, 0x0a, 0x13, 0x45, 0x6e, 0x75, 0x6d, 0x44,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x29, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x44, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x5d, 0x0a, 0x0e, 0x72,
+	0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x04, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x0d, 0x72, 0x65, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x64, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x1a,
+	0x3b, 0x0a, 0x11, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x52,
+	0x61, 0x6e, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x22, 0x83, 0x01, 0x0a,
+	0x18, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a,
+	0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6e,
+	0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x3b, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x16, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x3e, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x26, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x12, 0x39, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x89, 0x02, 0x0a,
+	0x15, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f,
+	0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x6e,
+	0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x69, 0x6e, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x75, 0x74,
+	0x70, 0x75, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x38, 0x0a, 0x07, 0x6f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30, 0x0a, 0x10, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73,
+	0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05,
+	0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x72,
+	0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x12, 0x30, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08,
+	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53,
+	0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x22, 0x91, 0x09, 0x0a, 0x0b, 0x46, 0x69, 0x6c,
+	0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6a, 0x61, 0x76, 0x61,
+	0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x6a, 0x61, 0x76, 0x61, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x30, 0x0a, 0x14, 0x6a,
+	0x61, 0x76, 0x61, 0x5f, 0x6f, 0x75, 0x74, 0x65, 0x72, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6a, 0x61, 0x76, 0x61, 0x4f,
+	0x75, 0x74, 0x65, 0x72, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x35, 0x0a,
+	0x13, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x5f, 0x66,
+	0x69, 0x6c, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73,
+	0x65, 0x52, 0x11, 0x6a, 0x61, 0x76, 0x61, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65, 0x46,
+	0x69, 0x6c, 0x65, 0x73, 0x12, 0x44, 0x0a, 0x1d, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x67, 0x65, 0x6e,
+	0x65, 0x72, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x71, 0x75, 0x61, 0x6c, 0x73, 0x5f, 0x61, 0x6e, 0x64,
+	0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x42, 0x02, 0x18, 0x01, 0x52,
+	0x19, 0x6a, 0x61, 0x76, 0x61, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x45, 0x71, 0x75,
+	0x61, 0x6c, 0x73, 0x41, 0x6e, 0x64, 0x48, 0x61, 0x73, 0x68, 0x12, 0x3a, 0x0a, 0x16, 0x6a, 0x61,
+	0x76, 0x61, 0x5f, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x5f,
+	0x75, 0x74, 0x66, 0x38, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73,
+	0x65, 0x52, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x55, 0x74, 0x66, 0x38, 0x12, 0x53, 0x0a, 0x0c, 0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69,
+	0x7a, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46,
+	0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6d,
+	0x69, 0x7a, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x3a, 0x05, 0x53, 0x50, 0x45, 0x45, 0x44, 0x52, 0x0b,
+	0x6f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x46, 0x6f, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x67,
+	0x6f, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x67, 0x6f, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x35, 0x0a, 0x13, 0x63, 0x63,
 	0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x73, 0x18, 0x2a, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x12,
-	0x70, 0x68, 0x70, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64,
-	0x18, 0x17, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64,
-	0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x10, 0x63, 0x63, 0x5f,
-	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x61, 0x72, 0x65, 0x6e, 0x61, 0x73, 0x18, 0x1f, 0x20,
-	0x01, 0x28, 0x08, 0x3a, 0x04, 0x74, 0x72, 0x75, 0x65, 0x52, 0x0e, 0x63, 0x63, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x41, 0x72, 0x65, 0x6e, 0x61, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x62, 0x6a,
-	0x63, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x24,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x62, 0x6a, 0x63, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x50,
-	0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x73, 0x68, 0x61, 0x72, 0x70, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x25, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0f, 0x63, 0x73, 0x68, 0x61, 0x72, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x12, 0x21, 0x0a, 0x0c, 0x73, 0x77, 0x69, 0x66, 0x74, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78,
-	0x18, 0x27, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x77, 0x69, 0x66, 0x74, 0x50, 0x72, 0x65,
-	0x66, 0x69, 0x78, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x68, 0x70, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73,
-	0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x70,
-	0x68, 0x70, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x23, 0x0a,
-	0x0d, 0x70, 0x68, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x29,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x68, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x70, 0x68, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x2c, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x14, 0x70, 0x68, 0x70, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x75, 0x62, 0x79,
-	0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x2d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
-	0x72, 0x75, 0x62, 0x79, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x58, 0x0a, 0x14, 0x75,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x3a, 0x0a, 0x0c, 0x4f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a,
-	0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x50, 0x45, 0x45, 0x44, 0x10, 0x01,
-	0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4f, 0x44, 0x45, 0x5f, 0x53, 0x49, 0x5a, 0x45, 0x10, 0x02, 0x12,
-	0x10, 0x0a, 0x0c, 0x4c, 0x49, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4e, 0x54, 0x49, 0x4d, 0x45, 0x10,
-	0x03, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x26,
-	0x10, 0x27, 0x22, 0xd1, 0x02, 0x0a, 0x0e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x3c, 0x0a, 0x17, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
-	0x5f, 0x73, 0x65, 0x74, 0x5f, 0x77, 0x69, 0x72, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x14, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x65, 0x74, 0x57, 0x69, 0x72, 0x65, 0x46, 0x6f, 0x72,
-	0x6d, 0x61, 0x74, 0x12, 0x4c, 0x0a, 0x1f, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61,
-	0x72, 0x64, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
-	0x6c, 0x73, 0x65, 0x52, 0x1c, 0x6e, 0x6f, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x44,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f,
-	0x72, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65,
-	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x70, 0x5f,
-	0x65, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6d, 0x61, 0x70,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x73, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x11,
+	0x63, 0x63, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x73, 0x12, 0x39, 0x0a, 0x15, 0x6a, 0x61, 0x76, 0x61, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69,
+	0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x11, 0x20, 0x01, 0x28, 0x08,
+	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x13, 0x6a, 0x61, 0x76, 0x61, 0x47, 0x65, 0x6e,
+	0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x13,
+	0x70, 0x79, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65,
+	0x52, 0x11, 0x70, 0x79, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x12, 0x37, 0x0a, 0x14, 0x70, 0x68, 0x70, 0x5f, 0x67, 0x65, 0x6e, 0x65, 0x72,
+	0x69, 0x63, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x2a, 0x20, 0x01, 0x28,
+	0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x12, 0x70, 0x68, 0x70, 0x47, 0x65, 0x6e,
+	0x65, 0x72, 0x69, 0x63, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x25, 0x0a, 0x0a,
+	0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x17, 0x20, 0x01, 0x28, 0x08,
+	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61,
+	0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x10, 0x63, 0x63, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x5f, 0x61, 0x72, 0x65, 0x6e, 0x61, 0x73, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x04, 0x74,
+	0x72, 0x75, 0x65, 0x52, 0x0e, 0x63, 0x63, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x41, 0x72, 0x65,
+	0x6e, 0x61, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x62, 0x6a, 0x63, 0x5f, 0x63, 0x6c, 0x61, 0x73,
+	0x73, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x24, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f,
+	0x6f, 0x62, 0x6a, 0x63, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12,
+	0x29, 0x0a, 0x10, 0x63, 0x73, 0x68, 0x61, 0x72, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x18, 0x25, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x63, 0x73, 0x68, 0x61, 0x72,
+	0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x77,
+	0x69, 0x66, 0x74, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x27, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x73, 0x77, 0x69, 0x66, 0x74, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x28, 0x0a,
+	0x10, 0x70, 0x68, 0x70, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x68, 0x70, 0x43, 0x6c, 0x61, 0x73,
+	0x73, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x68, 0x70, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x29, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x70, 0x68, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x34, 0x0a, 0x16,
+	0x70, 0x68, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x2c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x70, 0x68,
+	0x70, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x75, 0x62, 0x79, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x61,
+	0x67, 0x65, 0x18, 0x2d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x75, 0x62, 0x79, 0x50, 0x61,
+	0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72,
 	0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07,
 	0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72,
 	0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a,
-	0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x08, 0x10, 0x09,
-	0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0xe2, 0x03, 0x0a, 0x0c, 0x46, 0x69, 0x65, 0x6c, 0x64,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x41, 0x0a, 0x05, 0x63, 0x74, 0x79, 0x70, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22,
+	0x3a, 0x0a, 0x0c, 0x4f, 0x70, 0x74, 0x69, 0x6d, 0x69, 0x7a, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12,
+	0x09, 0x0a, 0x05, 0x53, 0x50, 0x45, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4f,
+	0x44, 0x45, 0x5f, 0x53, 0x49, 0x5a, 0x45, 0x10, 0x02, 0x12, 0x10, 0x0a, 0x0c, 0x4c, 0x49, 0x54,
+	0x45, 0x5f, 0x52, 0x55, 0x4e, 0x54, 0x49, 0x4d, 0x45, 0x10, 0x03, 0x2a, 0x09, 0x08, 0xe8, 0x07,
+	0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x26, 0x10, 0x27, 0x22, 0xbb, 0x03, 0x0a,
+	0x0e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
+	0x3c, 0x0a, 0x17, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x77,
+	0x69, 0x72, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x14, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x53, 0x65, 0x74, 0x57, 0x69, 0x72, 0x65, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0x4c, 0x0a,
+	0x1f, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x5f, 0x64, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x1c, 0x6e,
+	0x6f, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x6f, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x25, 0x0a, 0x0a, 0x64,
+	0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x3a,
+	0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74,
+	0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x70, 0x5f, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x6d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x56, 0x0a, 0x26, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x6c, 0x65,
+	0x67, 0x61, 0x63, 0x79, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x42,
+	0x02, 0x18, 0x01, 0x52, 0x22, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x4c,
+	0x65, 0x67, 0x61, 0x63, 0x79, 0x4a, 0x73, 0x6f, 0x6e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x43, 0x6f,
+	0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x04,
+	0x10, 0x05, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06, 0x4a, 0x04, 0x08, 0x06, 0x10, 0x07, 0x4a, 0x04,
+	0x08, 0x08, 0x10, 0x09, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0xb7, 0x08, 0x0a, 0x0c, 0x46,
+	0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x41, 0x0a, 0x05, 0x63,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65,
+	0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x54, 0x79, 0x70, 0x65, 0x3a,
+	0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x52, 0x05, 0x63, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16,
+	0x0a, 0x06, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06,
+	0x70, 0x61, 0x63, 0x6b, 0x65, 0x64, 0x12, 0x47, 0x0a, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70, 0x65,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x06, 0x53, 0x54, 0x52,
-	0x49, 0x4e, 0x47, 0x52, 0x05, 0x63, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x61,
-	0x63, 0x6b, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x70, 0x61, 0x63, 0x6b,
-	0x65, 0x64, 0x12, 0x47, 0x0a, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52,
-	0x4d, 0x41, 0x4c, 0x52, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70, 0x65, 0x12, 0x19, 0x0a, 0x04, 0x6c,
-	0x61, 0x7a, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65,
-	0x52, 0x04, 0x6c, 0x61, 0x7a, 0x79, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63,
-	0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73,
-	0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x19, 0x0a,
-	0x04, 0x77, 0x65, 0x61, 0x6b, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c,
-	0x73, 0x65, 0x52, 0x04, 0x77, 0x65, 0x61, 0x6b, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x05, 0x43, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x53,
-	0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x43, 0x4f, 0x52, 0x44, 0x10,
-	0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x5f, 0x50, 0x49, 0x45, 0x43,
-	0x45, 0x10, 0x02, 0x22, 0x35, 0x0a, 0x06, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0d, 0x0a,
-	0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52, 0x4d, 0x41, 0x4c, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09,
-	0x4a, 0x53, 0x5f, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x4a,
-	0x53, 0x5f, 0x4e, 0x55, 0x4d, 0x42, 0x45, 0x52, 0x10, 0x02, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10,
-	0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x22, 0x73, 0x0a, 0x0c, 0x4f,
-	0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65, 0x3a, 0x09, 0x4a, 0x53,
+	0x5f, 0x4e, 0x4f, 0x52, 0x4d, 0x41, 0x4c, 0x52, 0x06, 0x6a, 0x73, 0x74, 0x79, 0x70, 0x65, 0x12,
+	0x19, 0x0a, 0x04, 0x6c, 0x61, 0x7a, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66,
+	0x61, 0x6c, 0x73, 0x65, 0x52, 0x04, 0x6c, 0x61, 0x7a, 0x79, 0x12, 0x2e, 0x0a, 0x0f, 0x75, 0x6e,
+	0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x6c, 0x61, 0x7a, 0x79, 0x18, 0x0f, 0x20,
+	0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0e, 0x75, 0x6e, 0x76, 0x65,
+	0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x4c, 0x61, 0x7a, 0x79, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65,
+	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05,
+	0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x12, 0x19, 0x0a, 0x04, 0x77, 0x65, 0x61, 0x6b, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x3a,
+	0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x04, 0x77, 0x65, 0x61, 0x6b, 0x12, 0x28, 0x0a, 0x0c,
+	0x64, 0x65, 0x62, 0x75, 0x67, 0x5f, 0x72, 0x65, 0x64, 0x61, 0x63, 0x74, 0x18, 0x10, 0x20, 0x01,
+	0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0b, 0x64, 0x65, 0x62, 0x75, 0x67,
+	0x52, 0x65, 0x64, 0x61, 0x63, 0x74, 0x12, 0x4b, 0x0a, 0x09, 0x72, 0x65, 0x74, 0x65, 0x6e, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c,
+	0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x72, 0x65, 0x74, 0x65, 0x6e, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x46, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x12, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x2e, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x54,
+	0x79, 0x70, 0x65, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x58, 0x0a, 0x14, 0x75,
 	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74,
 	0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f,
 	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69,
 	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
 	0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02,
-	0x22, 0xc0, 0x01, 0x0a, 0x0b, 0x45, 0x6e, 0x75, 0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x41, 0x6c, 0x69, 0x61,
-	0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65,
-	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04, 0x08,
-	0x05, 0x10, 0x06, 0x22, 0x9e, 0x01, 0x0a, 0x10, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c, 0x75,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x05, 0x43, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0a,
+	0x0a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x43, 0x4f,
+	0x52, 0x44, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x5f, 0x50,
+	0x49, 0x45, 0x43, 0x45, 0x10, 0x02, 0x22, 0x35, 0x0a, 0x06, 0x4a, 0x53, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x0d, 0x0a, 0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x4f, 0x52, 0x4d, 0x41, 0x4c, 0x10, 0x00, 0x12,
+	0x0d, 0x0a, 0x09, 0x4a, 0x53, 0x5f, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0d,
+	0x0a, 0x09, 0x4a, 0x53, 0x5f, 0x4e, 0x55, 0x4d, 0x42, 0x45, 0x52, 0x10, 0x02, 0x22, 0x55, 0x0a,
+	0x0f, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x15, 0x0a, 0x11, 0x52, 0x45, 0x54, 0x45, 0x4e, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x52, 0x45, 0x54, 0x45, 0x4e,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x52, 0x55, 0x4e, 0x54, 0x49, 0x4d, 0x45, 0x10, 0x01, 0x12, 0x14,
+	0x0a, 0x10, 0x52, 0x45, 0x54, 0x45, 0x4e, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x4f, 0x55, 0x52,
+	0x43, 0x45, 0x10, 0x02, 0x22, 0x8c, 0x02, 0x0a, 0x10, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x54,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e,
+	0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x01, 0x12, 0x1f, 0x0a, 0x1b, 0x54, 0x41, 0x52, 0x47,
+	0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x58, 0x54, 0x45, 0x4e, 0x53, 0x49, 0x4f,
+	0x4e, 0x5f, 0x52, 0x41, 0x4e, 0x47, 0x45, 0x10, 0x02, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45,
+	0x10, 0x03, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x46, 0x49, 0x45, 0x4c, 0x44, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x41, 0x52,
+	0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4f, 0x4e, 0x45, 0x4f, 0x46, 0x10, 0x05,
+	0x12, 0x14, 0x0a, 0x10, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x10, 0x06, 0x12, 0x1a, 0x0a, 0x16, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x4e, 0x54, 0x52, 0x59,
+	0x10, 0x07, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x53, 0x45, 0x52, 0x56, 0x49, 0x43, 0x45, 0x10, 0x08, 0x12, 0x16, 0x0a, 0x12, 0x54,
+	0x41, 0x52, 0x47, 0x45, 0x54, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x45, 0x54, 0x48, 0x4f,
+	0x44, 0x10, 0x09, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04,
+	0x08, 0x04, 0x10, 0x05, 0x22, 0x73, 0x0a, 0x0c, 0x4f, 0x6e, 0x65, 0x6f, 0x66, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70,
+	0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65,
+	0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09,
+	0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x98, 0x02, 0x0a, 0x0b, 0x45, 0x6e,
+	0x75, 0x6d, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x6c, 0x6c,
+	0x6f, 0x77, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65,
+	0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05,
+	0x66, 0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x12, 0x56, 0x0a, 0x26, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x66, 0x69, 0x65, 0x6c,
+	0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x08, 0x42, 0x02, 0x18, 0x01, 0x52, 0x22, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65,
+	0x64, 0x4c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x4a, 0x73, 0x6f, 0x6e, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x43, 0x6f, 0x6e, 0x66, 0x6c, 0x69, 0x63, 0x74, 0x73, 0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13,
+	0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x4a, 0x04,
+	0x08, 0x05, 0x10, 0x06, 0x22, 0x9e, 0x01, 0x0a, 0x10, 0x45, 0x6e, 0x75, 0x6d, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70,
+	0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66,
+	0x61, 0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64,
+	0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65,
+	0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72,
+	0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10,
+	0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x9c, 0x01, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72,
-	0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
+	0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61,
 	0x6c, 0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12,
 	0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64,
 	0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24,
@@ -3385,97 +3774,95 @@ var file_google_protobuf_descriptor_proto_rawDesc = []byte{
 	0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70,
 	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65,
 	0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80,
-	0x80, 0x80, 0x80, 0x02, 0x22, 0x9c, 0x01, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65,
-	0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c,
-	0x73, 0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x58,
-	0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x5f,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x80, 0x80, 0x80, 0x02, 0x22, 0xe0, 0x02, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63,
+	0x61, 0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73,
+	0x65, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x71, 0x0a,
+	0x11, 0x69, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x5f, 0x6c, 0x65, 0x76,
+	0x65, 0x6c, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x49, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74,
+	0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x3a, 0x13, 0x49, 0x44, 0x45, 0x4d, 0x50,
+	0x4f, 0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x52, 0x10,
+	0x69, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c,
+	0x12, 0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65,
+	0x64, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72,
+	0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x50, 0x0a, 0x10, 0x49, 0x64,
+	0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x17,
+	0x0a, 0x13, 0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x4e, 0x4f, 0x5f, 0x53, 0x49,
+	0x44, 0x45, 0x5f, 0x45, 0x46, 0x46, 0x45, 0x43, 0x54, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a,
+	0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x54, 0x10, 0x02, 0x2a, 0x09, 0x08, 0xe8,
+	0x07, 0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x9a, 0x03, 0x0a, 0x13, 0x55, 0x6e, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x41, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e,
 	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
 	0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74,
-	0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2a, 0x09, 0x08, 0xe8, 0x07, 0x10, 0x80, 0x80,
-	0x80, 0x80, 0x02, 0x22, 0xe0, 0x02, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x25, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61,
-	0x74, 0x65, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x08, 0x3a, 0x05, 0x66, 0x61, 0x6c, 0x73, 0x65,
-	0x52, 0x0a, 0x64, 0x65, 0x70, 0x72, 0x65, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x71, 0x0a, 0x11,
-	0x69, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x5f, 0x6c, 0x65, 0x76, 0x65,
-	0x6c, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x49, 0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65,
-	0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x3a, 0x13, 0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f,
-	0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x52, 0x10, 0x69,
-	0x64, 0x65, 0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12,
-	0x58, 0x0a, 0x14, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64,
-	0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0xe7, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65,
-	0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x50, 0x0a, 0x10, 0x49, 0x64, 0x65,
-	0x6d, 0x70, 0x6f, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x17, 0x0a,
-	0x13, 0x49, 0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x43, 0x59, 0x5f, 0x55, 0x4e, 0x4b,
-	0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x4e, 0x4f, 0x5f, 0x53, 0x49, 0x44,
-	0x45, 0x5f, 0x45, 0x46, 0x46, 0x45, 0x43, 0x54, 0x53, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x49,
-	0x44, 0x45, 0x4d, 0x50, 0x4f, 0x54, 0x45, 0x4e, 0x54, 0x10, 0x02, 0x2a, 0x09, 0x08, 0xe8, 0x07,
-	0x10, 0x80, 0x80, 0x80, 0x80, 0x02, 0x22, 0x9a, 0x03, 0x0a, 0x13, 0x55, 0x6e, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55,
-	0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x65, 0x74, 0x65, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x74, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x29, 0x0a, 0x10, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x69, 0x64, 0x65,
-	0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x12,
-	0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69,
-	0x76, 0x65, 0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x12, 0x6e, 0x65,
-	0x67, 0x61, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65,
-	0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x75, 0x62,
-	0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52, 0x0b,
-	0x64, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73,
-	0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x0b, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x27,
-	0x0a, 0x0f, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67, 0x61,
-	0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x1a, 0x4a, 0x0a, 0x08, 0x4e, 0x61, 0x6d, 0x65, 0x50,
-	0x61, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x61, 0x72, 0x74,
-	0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x74,
-	0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x02, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
-	0x69, 0x6f, 0x6e, 0x22, 0xa7, 0x02, 0x0a, 0x0e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43, 0x6f,
-	0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x44, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xce, 0x01, 0x0a,
-	0x08, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x12, 0x16, 0x0a, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x05, 0x42,
-	0x02, 0x10, 0x01, 0x52, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x6c, 0x65, 0x61,
-	0x64, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d,
-	0x65, 0x6e, 0x74, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67,
-	0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x10, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74,
-	0x73, 0x12, 0x3a, 0x0a, 0x19, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x65, 0x74,
-	0x61, 0x63, 0x68, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x17, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x44, 0x65, 0x74,
-	0x61, 0x63, 0x68, 0x65, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0xd1, 0x01,
-	0x0a, 0x11, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x49,
-	0x6e, 0x66, 0x6f, 0x12, 0x4d, 0x0a, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61,
-	0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e, 0x6f,
-	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x1a, 0x6d, 0x0a, 0x0a, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x16, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x02,
-	0x10, 0x01, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x62, 0x65, 0x67,
-	0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x62, 0x65, 0x67, 0x69, 0x6e, 0x12,
-	0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x65, 0x6e,
-	0x64, 0x42, 0x7e, 0x0a, 0x13, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x69, 0x6f, 0x6e, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x74, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x69, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a,
+	0x12, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x70, 0x6f, 0x73, 0x69, 0x74,
+	0x69, 0x76, 0x65, 0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x12, 0x6e,
+	0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x69, 0x6e, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76,
+	0x65, 0x49, 0x6e, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x6f, 0x75,
+	0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52,
+	0x0b, 0x64, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x0b, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12,
+	0x27, 0x0a, 0x0f, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x67, 0x67, 0x72, 0x65, 0x67,
+	0x61, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x1a, 0x4a, 0x0a, 0x08, 0x4e, 0x61, 0x6d, 0x65,
+	0x50, 0x61, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x61, 0x72,
+	0x74, 0x18, 0x01, 0x20, 0x02, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x72,
+	0x74, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x02, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x45, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x22, 0xa7, 0x02, 0x0a, 0x0e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x43,
+	0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x44, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xce, 0x01,
+	0x0a, 0x08, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x04, 0x70, 0x61,
+	0x74, 0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05, 0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x70, 0x61,
+	0x74, 0x68, 0x12, 0x16, 0x0a, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x05,
+	0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x73, 0x70, 0x61, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x6c, 0x65,
+	0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d,
+	0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e,
+	0x67, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x10, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e,
+	0x74, 0x73, 0x12, 0x3a, 0x0a, 0x19, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x65,
+	0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18,
+	0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x17, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x44, 0x65,
+	0x74, 0x61, 0x63, 0x68, 0x65, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0xd0,
+	0x02, 0x0a, 0x11, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x4d, 0x0a, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72,
+	0x61, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e,
+	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x1a, 0xeb, 0x01, 0x0a, 0x0a, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x03, 0x28, 0x05,
+	0x42, 0x02, 0x10, 0x01, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x62,
+	0x65, 0x67, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x62, 0x65, 0x67, 0x69,
+	0x6e, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03,
+	0x65, 0x6e, 0x64, 0x12, 0x52, 0x0a, 0x08, 0x73, 0x65, 0x6d, 0x61, 0x6e, 0x74, 0x69, 0x63, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x36, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
+	0x64, 0x43, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x6d, 0x61, 0x6e, 0x74, 0x69, 0x63, 0x52, 0x08, 0x73,
+	0x65, 0x6d, 0x61, 0x6e, 0x74, 0x69, 0x63, 0x22, 0x28, 0x0a, 0x08, 0x53, 0x65, 0x6d, 0x61, 0x6e,
+	0x74, 0x69, 0x63, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x07, 0x0a,
+	0x03, 0x53, 0x45, 0x54, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x4c, 0x49, 0x41, 0x53, 0x10,
+	0x02, 0x42, 0x7e, 0x0a, 0x13, 0x63, 0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x42, 0x10, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
 	0x70, 0x74, 0x6f, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x73, 0x48, 0x01, 0x5a, 0x2d, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f, 0x72, 0x67, 0x2f,
@@ -3498,7 +3885,7 @@ func file_google_protobuf_descriptor_proto_rawDescGZIP() []byte {
 	return file_google_protobuf_descriptor_proto_rawDescData
 }
 
-var file_google_protobuf_descriptor_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
+var file_google_protobuf_descriptor_proto_enumTypes = make([]protoimpl.EnumInfo, 9)
 var file_google_protobuf_descriptor_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
 var file_google_protobuf_descriptor_proto_goTypes = []interface{}{
 	(FieldDescriptorProto_Type)(0),                // 0: google.protobuf.FieldDescriptorProto.Type
@@ -3506,84 +3893,90 @@ var file_google_protobuf_descriptor_proto_goTypes = []interface{}{
 	(FileOptions_OptimizeMode)(0),                 // 2: google.protobuf.FileOptions.OptimizeMode
 	(FieldOptions_CType)(0),                       // 3: google.protobuf.FieldOptions.CType
 	(FieldOptions_JSType)(0),                      // 4: google.protobuf.FieldOptions.JSType
-	(MethodOptions_IdempotencyLevel)(0),           // 5: google.protobuf.MethodOptions.IdempotencyLevel
-	(*FileDescriptorSet)(nil),                     // 6: google.protobuf.FileDescriptorSet
-	(*FileDescriptorProto)(nil),                   // 7: google.protobuf.FileDescriptorProto
-	(*DescriptorProto)(nil),                       // 8: google.protobuf.DescriptorProto
-	(*ExtensionRangeOptions)(nil),                 // 9: google.protobuf.ExtensionRangeOptions
-	(*FieldDescriptorProto)(nil),                  // 10: google.protobuf.FieldDescriptorProto
-	(*OneofDescriptorProto)(nil),                  // 11: google.protobuf.OneofDescriptorProto
-	(*EnumDescriptorProto)(nil),                   // 12: google.protobuf.EnumDescriptorProto
-	(*EnumValueDescriptorProto)(nil),              // 13: google.protobuf.EnumValueDescriptorProto
-	(*ServiceDescriptorProto)(nil),                // 14: google.protobuf.ServiceDescriptorProto
-	(*MethodDescriptorProto)(nil),                 // 15: google.protobuf.MethodDescriptorProto
-	(*FileOptions)(nil),                           // 16: google.protobuf.FileOptions
-	(*MessageOptions)(nil),                        // 17: google.protobuf.MessageOptions
-	(*FieldOptions)(nil),                          // 18: google.protobuf.FieldOptions
-	(*OneofOptions)(nil),                          // 19: google.protobuf.OneofOptions
-	(*EnumOptions)(nil),                           // 20: google.protobuf.EnumOptions
-	(*EnumValueOptions)(nil),                      // 21: google.protobuf.EnumValueOptions
-	(*ServiceOptions)(nil),                        // 22: google.protobuf.ServiceOptions
-	(*MethodOptions)(nil),                         // 23: google.protobuf.MethodOptions
-	(*UninterpretedOption)(nil),                   // 24: google.protobuf.UninterpretedOption
-	(*SourceCodeInfo)(nil),                        // 25: google.protobuf.SourceCodeInfo
-	(*GeneratedCodeInfo)(nil),                     // 26: google.protobuf.GeneratedCodeInfo
-	(*DescriptorProto_ExtensionRange)(nil),        // 27: google.protobuf.DescriptorProto.ExtensionRange
-	(*DescriptorProto_ReservedRange)(nil),         // 28: google.protobuf.DescriptorProto.ReservedRange
-	(*EnumDescriptorProto_EnumReservedRange)(nil), // 29: google.protobuf.EnumDescriptorProto.EnumReservedRange
-	(*UninterpretedOption_NamePart)(nil),          // 30: google.protobuf.UninterpretedOption.NamePart
-	(*SourceCodeInfo_Location)(nil),               // 31: google.protobuf.SourceCodeInfo.Location
-	(*GeneratedCodeInfo_Annotation)(nil),          // 32: google.protobuf.GeneratedCodeInfo.Annotation
+	(FieldOptions_OptionRetention)(0),             // 5: google.protobuf.FieldOptions.OptionRetention
+	(FieldOptions_OptionTargetType)(0),            // 6: google.protobuf.FieldOptions.OptionTargetType
+	(MethodOptions_IdempotencyLevel)(0),           // 7: google.protobuf.MethodOptions.IdempotencyLevel
+	(GeneratedCodeInfo_Annotation_Semantic)(0),    // 8: google.protobuf.GeneratedCodeInfo.Annotation.Semantic
+	(*FileDescriptorSet)(nil),                     // 9: google.protobuf.FileDescriptorSet
+	(*FileDescriptorProto)(nil),                   // 10: google.protobuf.FileDescriptorProto
+	(*DescriptorProto)(nil),                       // 11: google.protobuf.DescriptorProto
+	(*ExtensionRangeOptions)(nil),                 // 12: google.protobuf.ExtensionRangeOptions
+	(*FieldDescriptorProto)(nil),                  // 13: google.protobuf.FieldDescriptorProto
+	(*OneofDescriptorProto)(nil),                  // 14: google.protobuf.OneofDescriptorProto
+	(*EnumDescriptorProto)(nil),                   // 15: google.protobuf.EnumDescriptorProto
+	(*EnumValueDescriptorProto)(nil),              // 16: google.protobuf.EnumValueDescriptorProto
+	(*ServiceDescriptorProto)(nil),                // 17: google.protobuf.ServiceDescriptorProto
+	(*MethodDescriptorProto)(nil),                 // 18: google.protobuf.MethodDescriptorProto
+	(*FileOptions)(nil),                           // 19: google.protobuf.FileOptions
+	(*MessageOptions)(nil),                        // 20: google.protobuf.MessageOptions
+	(*FieldOptions)(nil),                          // 21: google.protobuf.FieldOptions
+	(*OneofOptions)(nil),                          // 22: google.protobuf.OneofOptions
+	(*EnumOptions)(nil),                           // 23: google.protobuf.EnumOptions
+	(*EnumValueOptions)(nil),                      // 24: google.protobuf.EnumValueOptions
+	(*ServiceOptions)(nil),                        // 25: google.protobuf.ServiceOptions
+	(*MethodOptions)(nil),                         // 26: google.protobuf.MethodOptions
+	(*UninterpretedOption)(nil),                   // 27: google.protobuf.UninterpretedOption
+	(*SourceCodeInfo)(nil),                        // 28: google.protobuf.SourceCodeInfo
+	(*GeneratedCodeInfo)(nil),                     // 29: google.protobuf.GeneratedCodeInfo
+	(*DescriptorProto_ExtensionRange)(nil),        // 30: google.protobuf.DescriptorProto.ExtensionRange
+	(*DescriptorProto_ReservedRange)(nil),         // 31: google.protobuf.DescriptorProto.ReservedRange
+	(*EnumDescriptorProto_EnumReservedRange)(nil), // 32: google.protobuf.EnumDescriptorProto.EnumReservedRange
+	(*UninterpretedOption_NamePart)(nil),          // 33: google.protobuf.UninterpretedOption.NamePart
+	(*SourceCodeInfo_Location)(nil),               // 34: google.protobuf.SourceCodeInfo.Location
+	(*GeneratedCodeInfo_Annotation)(nil),          // 35: google.protobuf.GeneratedCodeInfo.Annotation
 }
 var file_google_protobuf_descriptor_proto_depIdxs = []int32{
-	7,  // 0: google.protobuf.FileDescriptorSet.file:type_name -> google.protobuf.FileDescriptorProto
-	8,  // 1: google.protobuf.FileDescriptorProto.message_type:type_name -> google.protobuf.DescriptorProto
-	12, // 2: google.protobuf.FileDescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
-	14, // 3: google.protobuf.FileDescriptorProto.service:type_name -> google.protobuf.ServiceDescriptorProto
-	10, // 4: google.protobuf.FileDescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
-	16, // 5: google.protobuf.FileDescriptorProto.options:type_name -> google.protobuf.FileOptions
-	25, // 6: google.protobuf.FileDescriptorProto.source_code_info:type_name -> google.protobuf.SourceCodeInfo
-	10, // 7: google.protobuf.DescriptorProto.field:type_name -> google.protobuf.FieldDescriptorProto
-	10, // 8: google.protobuf.DescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
-	8,  // 9: google.protobuf.DescriptorProto.nested_type:type_name -> google.protobuf.DescriptorProto
-	12, // 10: google.protobuf.DescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
-	27, // 11: google.protobuf.DescriptorProto.extension_range:type_name -> google.protobuf.DescriptorProto.ExtensionRange
-	11, // 12: google.protobuf.DescriptorProto.oneof_decl:type_name -> google.protobuf.OneofDescriptorProto
-	17, // 13: google.protobuf.DescriptorProto.options:type_name -> google.protobuf.MessageOptions
-	28, // 14: google.protobuf.DescriptorProto.reserved_range:type_name -> google.protobuf.DescriptorProto.ReservedRange
-	24, // 15: google.protobuf.ExtensionRangeOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	10, // 0: google.protobuf.FileDescriptorSet.file:type_name -> google.protobuf.FileDescriptorProto
+	11, // 1: google.protobuf.FileDescriptorProto.message_type:type_name -> google.protobuf.DescriptorProto
+	15, // 2: google.protobuf.FileDescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
+	17, // 3: google.protobuf.FileDescriptorProto.service:type_name -> google.protobuf.ServiceDescriptorProto
+	13, // 4: google.protobuf.FileDescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
+	19, // 5: google.protobuf.FileDescriptorProto.options:type_name -> google.protobuf.FileOptions
+	28, // 6: google.protobuf.FileDescriptorProto.source_code_info:type_name -> google.protobuf.SourceCodeInfo
+	13, // 7: google.protobuf.DescriptorProto.field:type_name -> google.protobuf.FieldDescriptorProto
+	13, // 8: google.protobuf.DescriptorProto.extension:type_name -> google.protobuf.FieldDescriptorProto
+	11, // 9: google.protobuf.DescriptorProto.nested_type:type_name -> google.protobuf.DescriptorProto
+	15, // 10: google.protobuf.DescriptorProto.enum_type:type_name -> google.protobuf.EnumDescriptorProto
+	30, // 11: google.protobuf.DescriptorProto.extension_range:type_name -> google.protobuf.DescriptorProto.ExtensionRange
+	14, // 12: google.protobuf.DescriptorProto.oneof_decl:type_name -> google.protobuf.OneofDescriptorProto
+	20, // 13: google.protobuf.DescriptorProto.options:type_name -> google.protobuf.MessageOptions
+	31, // 14: google.protobuf.DescriptorProto.reserved_range:type_name -> google.protobuf.DescriptorProto.ReservedRange
+	27, // 15: google.protobuf.ExtensionRangeOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
 	1,  // 16: google.protobuf.FieldDescriptorProto.label:type_name -> google.protobuf.FieldDescriptorProto.Label
 	0,  // 17: google.protobuf.FieldDescriptorProto.type:type_name -> google.protobuf.FieldDescriptorProto.Type
-	18, // 18: google.protobuf.FieldDescriptorProto.options:type_name -> google.protobuf.FieldOptions
-	19, // 19: google.protobuf.OneofDescriptorProto.options:type_name -> google.protobuf.OneofOptions
-	13, // 20: google.protobuf.EnumDescriptorProto.value:type_name -> google.protobuf.EnumValueDescriptorProto
-	20, // 21: google.protobuf.EnumDescriptorProto.options:type_name -> google.protobuf.EnumOptions
-	29, // 22: google.protobuf.EnumDescriptorProto.reserved_range:type_name -> google.protobuf.EnumDescriptorProto.EnumReservedRange
-	21, // 23: google.protobuf.EnumValueDescriptorProto.options:type_name -> google.protobuf.EnumValueOptions
-	15, // 24: google.protobuf.ServiceDescriptorProto.method:type_name -> google.protobuf.MethodDescriptorProto
-	22, // 25: google.protobuf.ServiceDescriptorProto.options:type_name -> google.protobuf.ServiceOptions
-	23, // 26: google.protobuf.MethodDescriptorProto.options:type_name -> google.protobuf.MethodOptions
+	21, // 18: google.protobuf.FieldDescriptorProto.options:type_name -> google.protobuf.FieldOptions
+	22, // 19: google.protobuf.OneofDescriptorProto.options:type_name -> google.protobuf.OneofOptions
+	16, // 20: google.protobuf.EnumDescriptorProto.value:type_name -> google.protobuf.EnumValueDescriptorProto
+	23, // 21: google.protobuf.EnumDescriptorProto.options:type_name -> google.protobuf.EnumOptions
+	32, // 22: google.protobuf.EnumDescriptorProto.reserved_range:type_name -> google.protobuf.EnumDescriptorProto.EnumReservedRange
+	24, // 23: google.protobuf.EnumValueDescriptorProto.options:type_name -> google.protobuf.EnumValueOptions
+	18, // 24: google.protobuf.ServiceDescriptorProto.method:type_name -> google.protobuf.MethodDescriptorProto
+	25, // 25: google.protobuf.ServiceDescriptorProto.options:type_name -> google.protobuf.ServiceOptions
+	26, // 26: google.protobuf.MethodDescriptorProto.options:type_name -> google.protobuf.MethodOptions
 	2,  // 27: google.protobuf.FileOptions.optimize_for:type_name -> google.protobuf.FileOptions.OptimizeMode
-	24, // 28: google.protobuf.FileOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 29: google.protobuf.MessageOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	27, // 28: google.protobuf.FileOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	27, // 29: google.protobuf.MessageOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
 	3,  // 30: google.protobuf.FieldOptions.ctype:type_name -> google.protobuf.FieldOptions.CType
 	4,  // 31: google.protobuf.FieldOptions.jstype:type_name -> google.protobuf.FieldOptions.JSType
-	24, // 32: google.protobuf.FieldOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 33: google.protobuf.OneofOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 34: google.protobuf.EnumOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 35: google.protobuf.EnumValueOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	24, // 36: google.protobuf.ServiceOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	5,  // 37: google.protobuf.MethodOptions.idempotency_level:type_name -> google.protobuf.MethodOptions.IdempotencyLevel
-	24, // 38: google.protobuf.MethodOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
-	30, // 39: google.protobuf.UninterpretedOption.name:type_name -> google.protobuf.UninterpretedOption.NamePart
-	31, // 40: google.protobuf.SourceCodeInfo.location:type_name -> google.protobuf.SourceCodeInfo.Location
-	32, // 41: google.protobuf.GeneratedCodeInfo.annotation:type_name -> google.protobuf.GeneratedCodeInfo.Annotation
-	9,  // 42: google.protobuf.DescriptorProto.ExtensionRange.options:type_name -> google.protobuf.ExtensionRangeOptions
-	43, // [43:43] is the sub-list for method output_type
-	43, // [43:43] is the sub-list for method input_type
-	43, // [43:43] is the sub-list for extension type_name
-	43, // [43:43] is the sub-list for extension extendee
-	0,  // [0:43] is the sub-list for field type_name
+	5,  // 32: google.protobuf.FieldOptions.retention:type_name -> google.protobuf.FieldOptions.OptionRetention
+	6,  // 33: google.protobuf.FieldOptions.target:type_name -> google.protobuf.FieldOptions.OptionTargetType
+	27, // 34: google.protobuf.FieldOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	27, // 35: google.protobuf.OneofOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	27, // 36: google.protobuf.EnumOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	27, // 37: google.protobuf.EnumValueOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	27, // 38: google.protobuf.ServiceOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	7,  // 39: google.protobuf.MethodOptions.idempotency_level:type_name -> google.protobuf.MethodOptions.IdempotencyLevel
+	27, // 40: google.protobuf.MethodOptions.uninterpreted_option:type_name -> google.protobuf.UninterpretedOption
+	33, // 41: google.protobuf.UninterpretedOption.name:type_name -> google.protobuf.UninterpretedOption.NamePart
+	34, // 42: google.protobuf.SourceCodeInfo.location:type_name -> google.protobuf.SourceCodeInfo.Location
+	35, // 43: google.protobuf.GeneratedCodeInfo.annotation:type_name -> google.protobuf.GeneratedCodeInfo.Annotation
+	12, // 44: google.protobuf.DescriptorProto.ExtensionRange.options:type_name -> google.protobuf.ExtensionRangeOptions
+	8,  // 45: google.protobuf.GeneratedCodeInfo.Annotation.semantic:type_name -> google.protobuf.GeneratedCodeInfo.Annotation.Semantic
+	46, // [46:46] is the sub-list for method output_type
+	46, // [46:46] is the sub-list for method input_type
+	46, // [46:46] is the sub-list for extension type_name
+	46, // [46:46] is the sub-list for extension extendee
+	0,  // [0:46] is the sub-list for field type_name
 }
 
 func init() { file_google_protobuf_descriptor_proto_init() }
@@ -3940,7 +4333,7 @@ func file_google_protobuf_descriptor_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_google_protobuf_descriptor_proto_rawDesc,
-			NumEnums:      6,
+			NumEnums:      9,
 			NumMessages:   27,
 			NumExtensions: 0,
 			NumServices:   0,
diff --git a/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go b/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go
index 8c10797b90..a6c7a33f33 100644
--- a/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go
+++ b/vendor/google.golang.org/protobuf/types/known/anypb/any.pb.go
@@ -37,8 +37,7 @@
 // It is functionally a tuple of the full name of the remote message type and
 // the serialized bytes of the remote message value.
 //
-//
-// Constructing an Any
+// # Constructing an Any
 //
 // An Any message containing another message value is constructed using New:
 //
@@ -48,8 +47,7 @@
 //	}
 //	... // make use of any
 //
-//
-// Unmarshaling an Any
+// # Unmarshaling an Any
 //
 // With a populated Any message, the underlying message can be serialized into
 // a remote concrete message value in a few ways.
@@ -95,8 +93,7 @@
 // listed in the case clauses are linked into the Go binary and therefore also
 // registered in the global registry.
 //
-//
-// Type checking an Any
+// # Type checking an Any
 //
 // In order to type check whether an Any message represents some other message,
 // then use the MessageIs method:
@@ -115,7 +112,6 @@
 //		}
 //		... // make use of m
 //	}
-//
 package anypb
 
 import (
@@ -136,45 +132,49 @@ import (
 //
 // Example 1: Pack and unpack a message in C++.
 //
-//     Foo foo = ...;
-//     Any any;
-//     any.PackFrom(foo);
-//     ...
-//     if (any.UnpackTo(&foo)) {
-//       ...
-//     }
+//	Foo foo = ...;
+//	Any any;
+//	any.PackFrom(foo);
+//	...
+//	if (any.UnpackTo(&foo)) {
+//	  ...
+//	}
 //
 // Example 2: Pack and unpack a message in Java.
 //
-//     Foo foo = ...;
-//     Any any = Any.pack(foo);
-//     ...
-//     if (any.is(Foo.class)) {
-//       foo = any.unpack(Foo.class);
-//     }
-//
-//  Example 3: Pack and unpack a message in Python.
-//
-//     foo = Foo(...)
-//     any = Any()
-//     any.Pack(foo)
-//     ...
-//     if any.Is(Foo.DESCRIPTOR):
-//       any.Unpack(foo)
-//       ...
-//
-//  Example 4: Pack and unpack a message in Go
-//
-//      foo := &pb.Foo{...}
-//      any, err := anypb.New(foo)
-//      if err != nil {
-//        ...
-//      }
-//      ...
-//      foo := &pb.Foo{}
-//      if err := any.UnmarshalTo(foo); err != nil {
-//        ...
-//      }
+//	Foo foo = ...;
+//	Any any = Any.pack(foo);
+//	...
+//	if (any.is(Foo.class)) {
+//	  foo = any.unpack(Foo.class);
+//	}
+//	// or ...
+//	if (any.isSameTypeAs(Foo.getDefaultInstance())) {
+//	  foo = any.unpack(Foo.getDefaultInstance());
+//	}
+//
+// Example 3: Pack and unpack a message in Python.
+//
+//	foo = Foo(...)
+//	any = Any()
+//	any.Pack(foo)
+//	...
+//	if any.Is(Foo.DESCRIPTOR):
+//	  any.Unpack(foo)
+//	  ...
+//
+// Example 4: Pack and unpack a message in Go
+//
+//	foo := &pb.Foo{...}
+//	any, err := anypb.New(foo)
+//	if err != nil {
+//	  ...
+//	}
+//	...
+//	foo := &pb.Foo{}
+//	if err := any.UnmarshalTo(foo); err != nil {
+//	  ...
+//	}
 //
 // The pack methods provided by protobuf library will by default use
 // 'type.googleapis.com/full.type.name' as the type URL and the unpack
@@ -182,35 +182,33 @@ import (
 // in the type URL, for example "foo.bar.com/x/y.z" will yield type
 // name "y.z".
 //
+// # JSON
 //
-// JSON
-// ====
 // The JSON representation of an `Any` value uses the regular
 // representation of the deserialized, embedded message, with an
 // additional field `@type` which contains the type URL. Example:
 //
-//     package google.profile;
-//     message Person {
-//       string first_name = 1;
-//       string last_name = 2;
-//     }
+//	package google.profile;
+//	message Person {
+//	  string first_name = 1;
+//	  string last_name = 2;
+//	}
 //
-//     {
-//       "@type": "type.googleapis.com/google.profile.Person",
-//       "firstName": <string>,
-//       "lastName": <string>
-//     }
+//	{
+//	  "@type": "type.googleapis.com/google.profile.Person",
+//	  "firstName": <string>,
+//	  "lastName": <string>
+//	}
 //
 // If the embedded message type is well-known and has a custom JSON
 // representation, that representation will be embedded adding a field
 // `value` which holds the custom JSON in addition to the `@type`
 // field. Example (for message [google.protobuf.Duration][]):
 //
-//     {
-//       "@type": "type.googleapis.com/google.protobuf.Duration",
-//       "value": "1.212s"
-//     }
-//
+//	{
+//	  "@type": "type.googleapis.com/google.protobuf.Duration",
+//	  "value": "1.212s"
+//	}
 type Any struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -228,14 +226,14 @@ type Any struct {
 	// scheme `http`, `https`, or no scheme, one can optionally set up a type
 	// server that maps type URLs to message definitions as follows:
 	//
-	// * If no scheme is provided, `https` is assumed.
-	// * An HTTP GET on the URL must yield a [google.protobuf.Type][]
-	//   value in binary format, or produce an error.
-	// * Applications are allowed to cache lookup results based on the
-	//   URL, or have them precompiled into a binary to avoid any
-	//   lookup. Therefore, binary compatibility needs to be preserved
-	//   on changes to types. (Use versioned type names to manage
-	//   breaking changes.)
+	//   - If no scheme is provided, `https` is assumed.
+	//   - An HTTP GET on the URL must yield a [google.protobuf.Type][]
+	//     value in binary format, or produce an error.
+	//   - Applications are allowed to cache lookup results based on the
+	//     URL, or have them precompiled into a binary to avoid any
+	//     lookup. Therefore, binary compatibility needs to be preserved
+	//     on changes to types. (Use versioned type names to manage
+	//     breaking changes.)
 	//
 	// Note: this functionality is not currently available in the official
 	// protobuf release, and it is not used for type URLs beginning with
@@ -243,7 +241,6 @@ type Any struct {
 	//
 	// Schemes other than `http`, `https` (or the empty scheme) might be
 	// used with implementation specific semantics.
-	//
 	TypeUrl string `protobuf:"bytes,1,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
 	// Must be a valid serialized protocol buffer of the above specified type.
 	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
diff --git a/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go b/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go
index a583ca2f6c..df709a8dd4 100644
--- a/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go
+++ b/vendor/google.golang.org/protobuf/types/known/durationpb/duration.pb.go
@@ -35,8 +35,7 @@
 //
 // The Duration message represents a signed span of time.
 //
-//
-// Conversion to a Go Duration
+// # Conversion to a Go Duration
 //
 // The AsDuration method can be used to convert a Duration message to a
 // standard Go time.Duration value:
@@ -65,15 +64,13 @@
 // the resulting value to the closest representable value (e.g., math.MaxInt64
 // for positive overflow and math.MinInt64 for negative overflow).
 //
-//
-// Conversion from a Go Duration
+// # Conversion from a Go Duration
 //
 // The durationpb.New function can be used to construct a Duration message
 // from a standard Go time.Duration value:
 //
 //	dur := durationpb.New(d)
 //	... // make use of d as a *durationpb.Duration
-//
 package durationpb
 
 import (
@@ -96,43 +93,43 @@ import (
 //
 // Example 1: Compute Duration from two Timestamps in pseudo code.
 //
-//     Timestamp start = ...;
-//     Timestamp end = ...;
-//     Duration duration = ...;
+//	Timestamp start = ...;
+//	Timestamp end = ...;
+//	Duration duration = ...;
 //
-//     duration.seconds = end.seconds - start.seconds;
-//     duration.nanos = end.nanos - start.nanos;
+//	duration.seconds = end.seconds - start.seconds;
+//	duration.nanos = end.nanos - start.nanos;
 //
-//     if (duration.seconds < 0 && duration.nanos > 0) {
-//       duration.seconds += 1;
-//       duration.nanos -= 1000000000;
-//     } else if (duration.seconds > 0 && duration.nanos < 0) {
-//       duration.seconds -= 1;
-//       duration.nanos += 1000000000;
-//     }
+//	if (duration.seconds < 0 && duration.nanos > 0) {
+//	  duration.seconds += 1;
+//	  duration.nanos -= 1000000000;
+//	} else if (duration.seconds > 0 && duration.nanos < 0) {
+//	  duration.seconds -= 1;
+//	  duration.nanos += 1000000000;
+//	}
 //
 // Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
 //
-//     Timestamp start = ...;
-//     Duration duration = ...;
-//     Timestamp end = ...;
+//	Timestamp start = ...;
+//	Duration duration = ...;
+//	Timestamp end = ...;
 //
-//     end.seconds = start.seconds + duration.seconds;
-//     end.nanos = start.nanos + duration.nanos;
+//	end.seconds = start.seconds + duration.seconds;
+//	end.nanos = start.nanos + duration.nanos;
 //
-//     if (end.nanos < 0) {
-//       end.seconds -= 1;
-//       end.nanos += 1000000000;
-//     } else if (end.nanos >= 1000000000) {
-//       end.seconds += 1;
-//       end.nanos -= 1000000000;
-//     }
+//	if (end.nanos < 0) {
+//	  end.seconds -= 1;
+//	  end.nanos += 1000000000;
+//	} else if (end.nanos >= 1000000000) {
+//	  end.seconds += 1;
+//	  end.nanos -= 1000000000;
+//	}
 //
 // Example 3: Compute Duration from datetime.timedelta in Python.
 //
-//     td = datetime.timedelta(days=3, minutes=10)
-//     duration = Duration()
-//     duration.FromTimedelta(td)
+//	td = datetime.timedelta(days=3, minutes=10)
+//	duration = Duration()
+//	duration.FromTimedelta(td)
 //
 // # JSON Mapping
 //
@@ -143,8 +140,6 @@ import (
 // encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
 // be expressed in JSON format as "3.000000001s", and 3 seconds and 1
 // microsecond should be expressed in JSON format as "3.000001s".
-//
-//
 type Duration struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
diff --git a/vendor/google.golang.org/protobuf/types/known/fieldmaskpb/field_mask.pb.go b/vendor/google.golang.org/protobuf/types/known/fieldmaskpb/field_mask.pb.go
new file mode 100644
index 0000000000..e8789cb331
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/types/known/fieldmaskpb/field_mask.pb.go
@@ -0,0 +1,588 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: google/protobuf/field_mask.proto
+
+// Package fieldmaskpb contains generated types for google/protobuf/field_mask.proto.
+//
+// The FieldMask message represents a set of symbolic field paths.
+// The paths are specific to some target message type,
+// which is not stored within the FieldMask message itself.
+//
+// # Constructing a FieldMask
+//
+// The New function is used construct a FieldMask:
+//
+//	var messageType *descriptorpb.DescriptorProto
+//	fm, err := fieldmaskpb.New(messageType, "field.name", "field.number")
+//	if err != nil {
+//		... // handle error
+//	}
+//	... // make use of fm
+//
+// The "field.name" and "field.number" paths are valid paths according to the
+// google.protobuf.DescriptorProto message. Use of a path that does not correlate
+// to valid fields reachable from DescriptorProto would result in an error.
+//
+// Once a FieldMask message has been constructed,
+// the Append method can be used to insert additional paths to the path set:
+//
+//	var messageType *descriptorpb.DescriptorProto
+//	if err := fm.Append(messageType, "options"); err != nil {
+//		... // handle error
+//	}
+//
+// # Type checking a FieldMask
+//
+// In order to verify that a FieldMask represents a set of fields that are
+// reachable from some target message type, use the IsValid method:
+//
+//	var messageType *descriptorpb.DescriptorProto
+//	if fm.IsValid(messageType) {
+//		... // make use of fm
+//	}
+//
+// IsValid needs to be passed the target message type as an input since the
+// FieldMask message itself does not store the message type that the set of paths
+// are for.
+package fieldmaskpb
+
+import (
+	proto "google.golang.org/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sort "sort"
+	strings "strings"
+	sync "sync"
+)
+
+// `FieldMask` represents a set of symbolic field paths, for example:
+//
+//	paths: "f.a"
+//	paths: "f.b.d"
+//
+// Here `f` represents a field in some root message, `a` and `b`
+// fields in the message found in `f`, and `d` a field found in the
+// message in `f.b`.
+//
+// Field masks are used to specify a subset of fields that should be
+// returned by a get operation or modified by an update operation.
+// Field masks also have a custom JSON encoding (see below).
+//
+// # Field Masks in Projections
+//
+// When used in the context of a projection, a response message or
+// sub-message is filtered by the API to only contain those fields as
+// specified in the mask. For example, if the mask in the previous
+// example is applied to a response message as follows:
+//
+//	f {
+//	  a : 22
+//	  b {
+//	    d : 1
+//	    x : 2
+//	  }
+//	  y : 13
+//	}
+//	z: 8
+//
+// The result will not contain specific values for fields x,y and z
+// (their value will be set to the default, and omitted in proto text
+// output):
+//
+//	f {
+//	  a : 22
+//	  b {
+//	    d : 1
+//	  }
+//	}
+//
+// A repeated field is not allowed except at the last position of a
+// paths string.
+//
+// If a FieldMask object is not present in a get operation, the
+// operation applies to all fields (as if a FieldMask of all fields
+// had been specified).
+//
+// Note that a field mask does not necessarily apply to the
+// top-level response message. In case of a REST get operation, the
+// field mask applies directly to the response, but in case of a REST
+// list operation, the mask instead applies to each individual message
+// in the returned resource list. In case of a REST custom method,
+// other definitions may be used. Where the mask applies will be
+// clearly documented together with its declaration in the API.  In
+// any case, the effect on the returned resource/resources is required
+// behavior for APIs.
+//
+// # Field Masks in Update Operations
+//
+// A field mask in update operations specifies which fields of the
+// targeted resource are going to be updated. The API is required
+// to only change the values of the fields as specified in the mask
+// and leave the others untouched. If a resource is passed in to
+// describe the updated values, the API ignores the values of all
+// fields not covered by the mask.
+//
+// If a repeated field is specified for an update operation, new values will
+// be appended to the existing repeated field in the target resource. Note that
+// a repeated field is only allowed in the last position of a `paths` string.
+//
+// If a sub-message is specified in the last position of the field mask for an
+// update operation, then new value will be merged into the existing sub-message
+// in the target resource.
+//
+// For example, given the target message:
+//
+//	f {
+//	  b {
+//	    d: 1
+//	    x: 2
+//	  }
+//	  c: [1]
+//	}
+//
+// And an update message:
+//
+//	f {
+//	  b {
+//	    d: 10
+//	  }
+//	  c: [2]
+//	}
+//
+// then if the field mask is:
+//
+//	paths: ["f.b", "f.c"]
+//
+// then the result will be:
+//
+//	f {
+//	  b {
+//	    d: 10
+//	    x: 2
+//	  }
+//	  c: [1, 2]
+//	}
+//
+// An implementation may provide options to override this default behavior for
+// repeated and message fields.
+//
+// In order to reset a field's value to the default, the field must
+// be in the mask and set to the default value in the provided resource.
+// Hence, in order to reset all fields of a resource, provide a default
+// instance of the resource and set all fields in the mask, or do
+// not provide a mask as described below.
+//
+// If a field mask is not present on update, the operation applies to
+// all fields (as if a field mask of all fields has been specified).
+// Note that in the presence of schema evolution, this may mean that
+// fields the client does not know and has therefore not filled into
+// the request will be reset to their default. If this is unwanted
+// behavior, a specific service may require a client to always specify
+// a field mask, producing an error if not.
+//
+// As with get operations, the location of the resource which
+// describes the updated values in the request message depends on the
+// operation kind. In any case, the effect of the field mask is
+// required to be honored by the API.
+//
+// ## Considerations for HTTP REST
+//
+// The HTTP kind of an update operation which uses a field mask must
+// be set to PATCH instead of PUT in order to satisfy HTTP semantics
+// (PUT must only be used for full updates).
+//
+// # JSON Encoding of Field Masks
+//
+// In JSON, a field mask is encoded as a single string where paths are
+// separated by a comma. Fields name in each path are converted
+// to/from lower-camel naming conventions.
+//
+// As an example, consider the following message declarations:
+//
+//	message Profile {
+//	  User user = 1;
+//	  Photo photo = 2;
+//	}
+//	message User {
+//	  string display_name = 1;
+//	  string address = 2;
+//	}
+//
+// In proto a field mask for `Profile` may look as such:
+//
+//	mask {
+//	  paths: "user.display_name"
+//	  paths: "photo"
+//	}
+//
+// In JSON, the same mask is represented as below:
+//
+//	{
+//	  mask: "user.displayName,photo"
+//	}
+//
+// # Field Masks and Oneof Fields
+//
+// Field masks treat fields in oneofs just as regular fields. Consider the
+// following message:
+//
+//	message SampleMessage {
+//	  oneof test_oneof {
+//	    string name = 4;
+//	    SubMessage sub_message = 9;
+//	  }
+//	}
+//
+// The field mask can be:
+//
+//	mask {
+//	  paths: "name"
+//	}
+//
+// Or:
+//
+//	mask {
+//	  paths: "sub_message"
+//	}
+//
+// Note that oneof type names ("test_oneof" in this case) cannot be used in
+// paths.
+//
+// ## Field Mask Verification
+//
+// The implementation of any API method which has a FieldMask type field in the
+// request should verify the included field paths, and return an
+// `INVALID_ARGUMENT` error if any path is unmappable.
+type FieldMask struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The set of field mask paths.
+	Paths []string `protobuf:"bytes,1,rep,name=paths,proto3" json:"paths,omitempty"`
+}
+
+// New constructs a field mask from a list of paths and verifies that
+// each one is valid according to the specified message type.
+func New(m proto.Message, paths ...string) (*FieldMask, error) {
+	x := new(FieldMask)
+	return x, x.Append(m, paths...)
+}
+
+// Union returns the union of all the paths in the input field masks.
+func Union(mx *FieldMask, my *FieldMask, ms ...*FieldMask) *FieldMask {
+	var out []string
+	out = append(out, mx.GetPaths()...)
+	out = append(out, my.GetPaths()...)
+	for _, m := range ms {
+		out = append(out, m.GetPaths()...)
+	}
+	return &FieldMask{Paths: normalizePaths(out)}
+}
+
+// Intersect returns the intersection of all the paths in the input field masks.
+func Intersect(mx *FieldMask, my *FieldMask, ms ...*FieldMask) *FieldMask {
+	var ss1, ss2 []string // reused buffers for performance
+	intersect := func(out, in []string) []string {
+		ss1 = normalizePaths(append(ss1[:0], in...))
+		ss2 = normalizePaths(append(ss2[:0], out...))
+		out = out[:0]
+		for i1, i2 := 0, 0; i1 < len(ss1) && i2 < len(ss2); {
+			switch s1, s2 := ss1[i1], ss2[i2]; {
+			case hasPathPrefix(s1, s2):
+				out = append(out, s1)
+				i1++
+			case hasPathPrefix(s2, s1):
+				out = append(out, s2)
+				i2++
+			case lessPath(s1, s2):
+				i1++
+			case lessPath(s2, s1):
+				i2++
+			}
+		}
+		return out
+	}
+
+	out := Union(mx, my, ms...).GetPaths()
+	out = intersect(out, mx.GetPaths())
+	out = intersect(out, my.GetPaths())
+	for _, m := range ms {
+		out = intersect(out, m.GetPaths())
+	}
+	return &FieldMask{Paths: normalizePaths(out)}
+}
+
+// IsValid reports whether all the paths are syntactically valid and
+// refer to known fields in the specified message type.
+// It reports false for a nil FieldMask.
+func (x *FieldMask) IsValid(m proto.Message) bool {
+	paths := x.GetPaths()
+	return x != nil && numValidPaths(m, paths) == len(paths)
+}
+
+// Append appends a list of paths to the mask and verifies that each one
+// is valid according to the specified message type.
+// An invalid path is not appended and breaks insertion of subsequent paths.
+func (x *FieldMask) Append(m proto.Message, paths ...string) error {
+	numValid := numValidPaths(m, paths)
+	x.Paths = append(x.Paths, paths[:numValid]...)
+	paths = paths[numValid:]
+	if len(paths) > 0 {
+		name := m.ProtoReflect().Descriptor().FullName()
+		return protoimpl.X.NewError("invalid path %q for message %q", paths[0], name)
+	}
+	return nil
+}
+
+func numValidPaths(m proto.Message, paths []string) int {
+	md0 := m.ProtoReflect().Descriptor()
+	for i, path := range paths {
+		md := md0
+		if !rangeFields(path, func(field string) bool {
+			// Search the field within the message.
+			if md == nil {
+				return false // not within a message
+			}
+			fd := md.Fields().ByName(protoreflect.Name(field))
+			// The real field name of a group is the message name.
+			if fd == nil {
+				gd := md.Fields().ByName(protoreflect.Name(strings.ToLower(field)))
+				if gd != nil && gd.Kind() == protoreflect.GroupKind && string(gd.Message().Name()) == field {
+					fd = gd
+				}
+			} else if fd.Kind() == protoreflect.GroupKind && string(fd.Message().Name()) != field {
+				fd = nil
+			}
+			if fd == nil {
+				return false // message has does not have this field
+			}
+
+			// Identify the next message to search within.
+			md = fd.Message() // may be nil
+
+			// Repeated fields are only allowed at the last position.
+			if fd.IsList() || fd.IsMap() {
+				md = nil
+			}
+
+			return true
+		}) {
+			return i
+		}
+	}
+	return len(paths)
+}
+
+// Normalize converts the mask to its canonical form where all paths are sorted
+// and redundant paths are removed.
+func (x *FieldMask) Normalize() {
+	x.Paths = normalizePaths(x.Paths)
+}
+
+func normalizePaths(paths []string) []string {
+	sort.Slice(paths, func(i, j int) bool {
+		return lessPath(paths[i], paths[j])
+	})
+
+	// Elide any path that is a prefix match on the previous.
+	out := paths[:0]
+	for _, path := range paths {
+		if len(out) > 0 && hasPathPrefix(path, out[len(out)-1]) {
+			continue
+		}
+		out = append(out, path)
+	}
+	return out
+}
+
+// hasPathPrefix is like strings.HasPrefix, but further checks for either
+// an exact matche or that the prefix is delimited by a dot.
+func hasPathPrefix(path, prefix string) bool {
+	return strings.HasPrefix(path, prefix) && (len(path) == len(prefix) || path[len(prefix)] == '.')
+}
+
+// lessPath is a lexicographical comparison where dot is specially treated
+// as the smallest symbol.
+func lessPath(x, y string) bool {
+	for i := 0; i < len(x) && i < len(y); i++ {
+		if x[i] != y[i] {
+			return (x[i] - '.') < (y[i] - '.')
+		}
+	}
+	return len(x) < len(y)
+}
+
+// rangeFields is like strings.Split(path, "."), but avoids allocations by
+// iterating over each field in place and calling a iterator function.
+func rangeFields(path string, f func(field string) bool) bool {
+	for {
+		var field string
+		if i := strings.IndexByte(path, '.'); i >= 0 {
+			field, path = path[:i], path[i:]
+		} else {
+			field, path = path, ""
+		}
+
+		if !f(field) {
+			return false
+		}
+
+		if len(path) == 0 {
+			return true
+		}
+		path = strings.TrimPrefix(path, ".")
+	}
+}
+
+func (x *FieldMask) Reset() {
+	*x = FieldMask{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_field_mask_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FieldMask) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FieldMask) ProtoMessage() {}
+
+func (x *FieldMask) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_field_mask_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FieldMask.ProtoReflect.Descriptor instead.
+func (*FieldMask) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_field_mask_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *FieldMask) GetPaths() []string {
+	if x != nil {
+		return x.Paths
+	}
+	return nil
+}
+
+var File_google_protobuf_field_mask_proto protoreflect.FileDescriptor
+
+var file_google_protobuf_field_mask_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x0f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x22, 0x21, 0x0a, 0x09, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b,
+	0x12, 0x14, 0x0a, 0x05, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x05, 0x70, 0x61, 0x74, 0x68, 0x73, 0x42, 0x85, 0x01, 0x0a, 0x13, 0x63, 0x6f, 0x6d, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x42, 0x0e,
+	0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x32, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e,
+	0x6f, 0x72, 0x67, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x79, 0x70,
+	0x65, 0x73, 0x2f, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x6d, 0x61,
+	0x73, 0x6b, 0x70, 0x62, 0xf8, 0x01, 0x01, 0xa2, 0x02, 0x03, 0x47, 0x50, 0x42, 0xaa, 0x02, 0x1e,
+	0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x57, 0x65, 0x6c, 0x6c, 0x4b, 0x6e, 0x6f, 0x77, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_google_protobuf_field_mask_proto_rawDescOnce sync.Once
+	file_google_protobuf_field_mask_proto_rawDescData = file_google_protobuf_field_mask_proto_rawDesc
+)
+
+func file_google_protobuf_field_mask_proto_rawDescGZIP() []byte {
+	file_google_protobuf_field_mask_proto_rawDescOnce.Do(func() {
+		file_google_protobuf_field_mask_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_protobuf_field_mask_proto_rawDescData)
+	})
+	return file_google_protobuf_field_mask_proto_rawDescData
+}
+
+var file_google_protobuf_field_mask_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_google_protobuf_field_mask_proto_goTypes = []interface{}{
+	(*FieldMask)(nil), // 0: google.protobuf.FieldMask
+}
+var file_google_protobuf_field_mask_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_google_protobuf_field_mask_proto_init() }
+func file_google_protobuf_field_mask_proto_init() {
+	if File_google_protobuf_field_mask_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_google_protobuf_field_mask_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FieldMask); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_google_protobuf_field_mask_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_google_protobuf_field_mask_proto_goTypes,
+		DependencyIndexes: file_google_protobuf_field_mask_proto_depIdxs,
+		MessageInfos:      file_google_protobuf_field_mask_proto_msgTypes,
+	}.Build()
+	File_google_protobuf_field_mask_proto = out.File
+	file_google_protobuf_field_mask_proto_rawDesc = nil
+	file_google_protobuf_field_mask_proto_goTypes = nil
+	file_google_protobuf_field_mask_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go b/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go
index c9ae92132a..61f69fc11b 100644
--- a/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go
+++ b/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go
@@ -36,8 +36,7 @@
 // The Timestamp message represents a timestamp,
 // an instant in time since the Unix epoch (January 1st, 1970).
 //
-//
-// Conversion to a Go Time
+// # Conversion to a Go Time
 //
 // The AsTime method can be used to convert a Timestamp message to a
 // standard Go time.Time value in UTC:
@@ -59,8 +58,7 @@
 //		... // handle error
 //	}
 //
-//
-// Conversion from a Go Time
+// # Conversion from a Go Time
 //
 // The timestamppb.New function can be used to construct a Timestamp message
 // from a standard Go time.Time value:
@@ -72,7 +70,6 @@
 //
 //	ts := timestamppb.Now()
 //	... // make use of ts as a *timestamppb.Timestamp
-//
 package timestamppb
 
 import (
@@ -101,52 +98,50 @@ import (
 //
 // Example 1: Compute Timestamp from POSIX `time()`.
 //
-//     Timestamp timestamp;
-//     timestamp.set_seconds(time(NULL));
-//     timestamp.set_nanos(0);
+//	Timestamp timestamp;
+//	timestamp.set_seconds(time(NULL));
+//	timestamp.set_nanos(0);
 //
 // Example 2: Compute Timestamp from POSIX `gettimeofday()`.
 //
-//     struct timeval tv;
-//     gettimeofday(&tv, NULL);
+//	struct timeval tv;
+//	gettimeofday(&tv, NULL);
 //
-//     Timestamp timestamp;
-//     timestamp.set_seconds(tv.tv_sec);
-//     timestamp.set_nanos(tv.tv_usec * 1000);
+//	Timestamp timestamp;
+//	timestamp.set_seconds(tv.tv_sec);
+//	timestamp.set_nanos(tv.tv_usec * 1000);
 //
 // Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
 //
-//     FILETIME ft;
-//     GetSystemTimeAsFileTime(&ft);
-//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
+//	FILETIME ft;
+//	GetSystemTimeAsFileTime(&ft);
+//	UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
 //
-//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
-//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
-//     Timestamp timestamp;
-//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
-//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
+//	// A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
+//	// is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
+//	Timestamp timestamp;
+//	timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
+//	timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
 //
 // Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
 //
-//     long millis = System.currentTimeMillis();
-//
-//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
-//         .setNanos((int) ((millis % 1000) * 1000000)).build();
+//	long millis = System.currentTimeMillis();
 //
+//	Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
+//	    .setNanos((int) ((millis % 1000) * 1000000)).build();
 //
 // Example 5: Compute Timestamp from Java `Instant.now()`.
 //
-//     Instant now = Instant.now();
-//
-//     Timestamp timestamp =
-//         Timestamp.newBuilder().setSeconds(now.getEpochSecond())
-//             .setNanos(now.getNano()).build();
+//	Instant now = Instant.now();
 //
+//	Timestamp timestamp =
+//	    Timestamp.newBuilder().setSeconds(now.getEpochSecond())
+//	        .setNanos(now.getNano()).build();
 //
 // Example 6: Compute Timestamp from current time in Python.
 //
-//     timestamp = Timestamp()
-//     timestamp.GetCurrentTime()
+//	timestamp = Timestamp()
+//	timestamp.GetCurrentTime()
 //
 // # JSON Mapping
 //
@@ -174,8 +169,6 @@ import (
 // the Joda Time's [`ISODateTimeFormat.dateTime()`](
 // http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D
 // ) to obtain a formatter capable of generating timestamps in this format.
-//
-//
 type Timestamp struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
diff --git a/vendor/google.golang.org/protobuf/types/known/wrapperspb/wrappers.pb.go b/vendor/google.golang.org/protobuf/types/known/wrapperspb/wrappers.pb.go
new file mode 100644
index 0000000000..762a87130f
--- /dev/null
+++ b/vendor/google.golang.org/protobuf/types/known/wrapperspb/wrappers.pb.go
@@ -0,0 +1,760 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Wrappers for primitive (non-message) types. These types are useful
+// for embedding primitives in the `google.protobuf.Any` type and for places
+// where we need to distinguish between the absence of a primitive
+// typed field and its default value.
+//
+// These wrappers have no meaningful use within repeated fields as they lack
+// the ability to detect presence on individual elements.
+// These wrappers have no meaningful use within a map or a oneof since
+// individual entries of a map or fields of a oneof can already detect presence.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: google/protobuf/wrappers.proto
+
+package wrapperspb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+// Wrapper message for `double`.
+//
+// The JSON representation for `DoubleValue` is JSON number.
+type DoubleValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The double value.
+	Value float64 `protobuf:"fixed64,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// Double stores v in a new DoubleValue and returns a pointer to it.
+func Double(v float64) *DoubleValue {
+	return &DoubleValue{Value: v}
+}
+
+func (x *DoubleValue) Reset() {
+	*x = DoubleValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DoubleValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DoubleValue) ProtoMessage() {}
+
+func (x *DoubleValue) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DoubleValue.ProtoReflect.Descriptor instead.
+func (*DoubleValue) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DoubleValue) GetValue() float64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// Wrapper message for `float`.
+//
+// The JSON representation for `FloatValue` is JSON number.
+type FloatValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The float value.
+	Value float32 `protobuf:"fixed32,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// Float stores v in a new FloatValue and returns a pointer to it.
+func Float(v float32) *FloatValue {
+	return &FloatValue{Value: v}
+}
+
+func (x *FloatValue) Reset() {
+	*x = FloatValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FloatValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FloatValue) ProtoMessage() {}
+
+func (x *FloatValue) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FloatValue.ProtoReflect.Descriptor instead.
+func (*FloatValue) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *FloatValue) GetValue() float32 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// Wrapper message for `int64`.
+//
+// The JSON representation for `Int64Value` is JSON string.
+type Int64Value struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The int64 value.
+	Value int64 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// Int64 stores v in a new Int64Value and returns a pointer to it.
+func Int64(v int64) *Int64Value {
+	return &Int64Value{Value: v}
+}
+
+func (x *Int64Value) Reset() {
+	*x = Int64Value{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Int64Value) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Int64Value) ProtoMessage() {}
+
+func (x *Int64Value) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Int64Value.ProtoReflect.Descriptor instead.
+func (*Int64Value) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Int64Value) GetValue() int64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// Wrapper message for `uint64`.
+//
+// The JSON representation for `UInt64Value` is JSON string.
+type UInt64Value struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The uint64 value.
+	Value uint64 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// UInt64 stores v in a new UInt64Value and returns a pointer to it.
+func UInt64(v uint64) *UInt64Value {
+	return &UInt64Value{Value: v}
+}
+
+func (x *UInt64Value) Reset() {
+	*x = UInt64Value{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UInt64Value) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UInt64Value) ProtoMessage() {}
+
+func (x *UInt64Value) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UInt64Value.ProtoReflect.Descriptor instead.
+func (*UInt64Value) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *UInt64Value) GetValue() uint64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// Wrapper message for `int32`.
+//
+// The JSON representation for `Int32Value` is JSON number.
+type Int32Value struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The int32 value.
+	Value int32 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// Int32 stores v in a new Int32Value and returns a pointer to it.
+func Int32(v int32) *Int32Value {
+	return &Int32Value{Value: v}
+}
+
+func (x *Int32Value) Reset() {
+	*x = Int32Value{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Int32Value) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Int32Value) ProtoMessage() {}
+
+func (x *Int32Value) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Int32Value.ProtoReflect.Descriptor instead.
+func (*Int32Value) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Int32Value) GetValue() int32 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// Wrapper message for `uint32`.
+//
+// The JSON representation for `UInt32Value` is JSON number.
+type UInt32Value struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The uint32 value.
+	Value uint32 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// UInt32 stores v in a new UInt32Value and returns a pointer to it.
+func UInt32(v uint32) *UInt32Value {
+	return &UInt32Value{Value: v}
+}
+
+func (x *UInt32Value) Reset() {
+	*x = UInt32Value{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UInt32Value) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UInt32Value) ProtoMessage() {}
+
+func (x *UInt32Value) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UInt32Value.ProtoReflect.Descriptor instead.
+func (*UInt32Value) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UInt32Value) GetValue() uint32 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// Wrapper message for `bool`.
+//
+// The JSON representation for `BoolValue` is JSON `true` and `false`.
+type BoolValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The bool value.
+	Value bool `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// Bool stores v in a new BoolValue and returns a pointer to it.
+func Bool(v bool) *BoolValue {
+	return &BoolValue{Value: v}
+}
+
+func (x *BoolValue) Reset() {
+	*x = BoolValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BoolValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BoolValue) ProtoMessage() {}
+
+func (x *BoolValue) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BoolValue.ProtoReflect.Descriptor instead.
+func (*BoolValue) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *BoolValue) GetValue() bool {
+	if x != nil {
+		return x.Value
+	}
+	return false
+}
+
+// Wrapper message for `string`.
+//
+// The JSON representation for `StringValue` is JSON string.
+type StringValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The string value.
+	Value string `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// String stores v in a new StringValue and returns a pointer to it.
+func String(v string) *StringValue {
+	return &StringValue{Value: v}
+}
+
+func (x *StringValue) Reset() {
+	*x = StringValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StringValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StringValue) ProtoMessage() {}
+
+func (x *StringValue) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StringValue.ProtoReflect.Descriptor instead.
+func (*StringValue) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *StringValue) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+// Wrapper message for `bytes`.
+//
+// The JSON representation for `BytesValue` is JSON string.
+type BytesValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The bytes value.
+	Value []byte `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+// Bytes stores v in a new BytesValue and returns a pointer to it.
+func Bytes(v []byte) *BytesValue {
+	return &BytesValue{Value: v}
+}
+
+func (x *BytesValue) Reset() {
+	*x = BytesValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_protobuf_wrappers_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BytesValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BytesValue) ProtoMessage() {}
+
+func (x *BytesValue) ProtoReflect() protoreflect.Message {
+	mi := &file_google_protobuf_wrappers_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BytesValue.ProtoReflect.Descriptor instead.
+func (*BytesValue) Descriptor() ([]byte, []int) {
+	return file_google_protobuf_wrappers_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *BytesValue) GetValue() []byte {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+var File_google_protobuf_wrappers_proto protoreflect.FileDescriptor
+
+var file_google_protobuf_wrappers_proto_rawDesc = []byte{
+	0x0a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x0f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x22, 0x23, 0x0a, 0x0b, 0x44, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x01, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x22, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x61, 0x74, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x02, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x22, 0x0a, 0x0a, 0x49, 0x6e,
+	0x74, 0x36, 0x34, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x23,
+	0x0a, 0x0b, 0x55, 0x49, 0x6e, 0x74, 0x36, 0x34, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x22, 0x22, 0x0a, 0x0a, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x23, 0x0a, 0x0b, 0x55, 0x49, 0x6e, 0x74, 0x33,
+	0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x21, 0x0a, 0x09,
+	0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22,
+	0x23, 0x0a, 0x0b, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x22, 0x22, 0x0a, 0x0a, 0x42, 0x79, 0x74, 0x65, 0x73, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x83, 0x01, 0x0a, 0x13, 0x63, 0x6f, 0x6d,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x42, 0x0d, 0x57, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x31, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67,
+	0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x79,
+	0x70, 0x65, 0x73, 0x2f, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65,
+	0x72, 0x73, 0x70, 0x62, 0xf8, 0x01, 0x01, 0xa2, 0x02, 0x03, 0x47, 0x50, 0x42, 0xaa, 0x02, 0x1e,
+	0x47, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x57, 0x65, 0x6c, 0x6c, 0x4b, 0x6e, 0x6f, 0x77, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_google_protobuf_wrappers_proto_rawDescOnce sync.Once
+	file_google_protobuf_wrappers_proto_rawDescData = file_google_protobuf_wrappers_proto_rawDesc
+)
+
+func file_google_protobuf_wrappers_proto_rawDescGZIP() []byte {
+	file_google_protobuf_wrappers_proto_rawDescOnce.Do(func() {
+		file_google_protobuf_wrappers_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_protobuf_wrappers_proto_rawDescData)
+	})
+	return file_google_protobuf_wrappers_proto_rawDescData
+}
+
+var file_google_protobuf_wrappers_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_google_protobuf_wrappers_proto_goTypes = []interface{}{
+	(*DoubleValue)(nil), // 0: google.protobuf.DoubleValue
+	(*FloatValue)(nil),  // 1: google.protobuf.FloatValue
+	(*Int64Value)(nil),  // 2: google.protobuf.Int64Value
+	(*UInt64Value)(nil), // 3: google.protobuf.UInt64Value
+	(*Int32Value)(nil),  // 4: google.protobuf.Int32Value
+	(*UInt32Value)(nil), // 5: google.protobuf.UInt32Value
+	(*BoolValue)(nil),   // 6: google.protobuf.BoolValue
+	(*StringValue)(nil), // 7: google.protobuf.StringValue
+	(*BytesValue)(nil),  // 8: google.protobuf.BytesValue
+}
+var file_google_protobuf_wrappers_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_google_protobuf_wrappers_proto_init() }
+func file_google_protobuf_wrappers_proto_init() {
+	if File_google_protobuf_wrappers_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_google_protobuf_wrappers_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DoubleValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FloatValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Int64Value); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UInt64Value); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Int32Value); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UInt32Value); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BoolValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StringValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_google_protobuf_wrappers_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BytesValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_google_protobuf_wrappers_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_google_protobuf_wrappers_proto_goTypes,
+		DependencyIndexes: file_google_protobuf_wrappers_proto_depIdxs,
+		MessageInfos:      file_google_protobuf_wrappers_proto_msgTypes,
+	}.Build()
+	File_google_protobuf_wrappers_proto = out.File
+	file_google_protobuf_wrappers_proto_rawDesc = nil
+	file_google_protobuf_wrappers_proto_goTypes = nil
+	file_google_protobuf_wrappers_proto_depIdxs = nil
+}
diff --git a/vendor/gopkg.in/check.v1/.gitignore b/vendor/gopkg.in/check.v1/.gitignore
new file mode 100644
index 0000000000..191a5360b7
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/.gitignore
@@ -0,0 +1,4 @@
+_*
+*.swp
+*.[568]
+[568].out
diff --git a/vendor/gopkg.in/check.v1/.travis.yml b/vendor/gopkg.in/check.v1/.travis.yml
new file mode 100644
index 0000000000..ead6735fca
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/.travis.yml
@@ -0,0 +1,3 @@
+language: go
+
+go_import_path: gopkg.in/check.v1
diff --git a/vendor/gopkg.in/check.v1/LICENSE b/vendor/gopkg.in/check.v1/LICENSE
new file mode 100644
index 0000000000..545cf2d331
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/LICENSE
@@ -0,0 +1,25 @@
+Gocheck - A rich testing framework for Go
+ 
+Copyright (c) 2010-2013 Gustavo Niemeyer <gustavo@niemeyer.net>
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met: 
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer. 
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/gopkg.in/check.v1/README.md b/vendor/gopkg.in/check.v1/README.md
new file mode 100644
index 0000000000..0ca9e57260
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/README.md
@@ -0,0 +1,20 @@
+Instructions
+============
+
+Install the package with:
+
+    go get gopkg.in/check.v1
+    
+Import it with:
+
+    import "gopkg.in/check.v1"
+
+and use _check_ as the package name inside the code.
+
+For more details, visit the project page:
+
+* http://labix.org/gocheck
+
+and the API documentation:
+
+* https://gopkg.in/check.v1
diff --git a/vendor/gopkg.in/check.v1/TODO b/vendor/gopkg.in/check.v1/TODO
new file mode 100644
index 0000000000..33498270ea
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/TODO
@@ -0,0 +1,2 @@
+- Assert(slice, Contains, item)
+- Parallel test support
diff --git a/vendor/gopkg.in/check.v1/benchmark.go b/vendor/gopkg.in/check.v1/benchmark.go
new file mode 100644
index 0000000000..46ea9dc6da
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/benchmark.go
@@ -0,0 +1,187 @@
+// Copyright (c) 2012 The Go Authors. All rights reserved.
+// 
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+// 
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+// 
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package check
+
+import (
+	"fmt"
+	"runtime"
+	"time"
+)
+
+var memStats runtime.MemStats
+
+// testingB is a type passed to Benchmark functions to manage benchmark
+// timing and to specify the number of iterations to run.
+type timer struct {
+	start     time.Time // Time test or benchmark started
+	duration  time.Duration
+	N         int
+	bytes     int64
+	timerOn   bool
+	benchTime time.Duration
+	// The initial states of memStats.Mallocs and memStats.TotalAlloc.
+	startAllocs uint64
+	startBytes  uint64
+	// The net total of this test after being run.
+	netAllocs uint64
+	netBytes  uint64
+}
+
+// StartTimer starts timing a test. This function is called automatically
+// before a benchmark starts, but it can also used to resume timing after
+// a call to StopTimer.
+func (c *C) StartTimer() {
+	if !c.timerOn {
+		c.start = time.Now()
+		c.timerOn = true
+
+		runtime.ReadMemStats(&memStats)
+		c.startAllocs = memStats.Mallocs
+		c.startBytes = memStats.TotalAlloc
+	}
+}
+
+// StopTimer stops timing a test. This can be used to pause the timer
+// while performing complex initialization that you don't
+// want to measure.
+func (c *C) StopTimer() {
+	if c.timerOn {
+		c.duration += time.Now().Sub(c.start)
+		c.timerOn = false
+		runtime.ReadMemStats(&memStats)
+		c.netAllocs += memStats.Mallocs - c.startAllocs
+		c.netBytes += memStats.TotalAlloc - c.startBytes
+	}
+}
+
+// ResetTimer sets the elapsed benchmark time to zero.
+// It does not affect whether the timer is running.
+func (c *C) ResetTimer() {
+	if c.timerOn {
+		c.start = time.Now()
+		runtime.ReadMemStats(&memStats)
+		c.startAllocs = memStats.Mallocs
+		c.startBytes = memStats.TotalAlloc
+	}
+	c.duration = 0
+	c.netAllocs = 0
+	c.netBytes = 0
+}
+
+// SetBytes informs the number of bytes that the benchmark processes
+// on each iteration. If this is called in a benchmark it will also
+// report MB/s.
+func (c *C) SetBytes(n int64) {
+	c.bytes = n
+}
+
+func (c *C) nsPerOp() int64 {
+	if c.N <= 0 {
+		return 0
+	}
+	return c.duration.Nanoseconds() / int64(c.N)
+}
+
+func (c *C) mbPerSec() float64 {
+	if c.bytes <= 0 || c.duration <= 0 || c.N <= 0 {
+		return 0
+	}
+	return (float64(c.bytes) * float64(c.N) / 1e6) / c.duration.Seconds()
+}
+
+func (c *C) timerString() string {
+	if c.N <= 0 {
+		return fmt.Sprintf("%3.3fs", float64(c.duration.Nanoseconds())/1e9)
+	}
+	mbs := c.mbPerSec()
+	mb := ""
+	if mbs != 0 {
+		mb = fmt.Sprintf("\t%7.2f MB/s", mbs)
+	}
+	nsop := c.nsPerOp()
+	ns := fmt.Sprintf("%10d ns/op", nsop)
+	if c.N > 0 && nsop < 100 {
+		// The format specifiers here make sure that
+		// the ones digits line up for all three possible formats.
+		if nsop < 10 {
+			ns = fmt.Sprintf("%13.2f ns/op", float64(c.duration.Nanoseconds())/float64(c.N))
+		} else {
+			ns = fmt.Sprintf("%12.1f ns/op", float64(c.duration.Nanoseconds())/float64(c.N))
+		}
+	}
+	memStats := ""
+	if c.benchMem {
+		allocedBytes := fmt.Sprintf("%8d B/op", int64(c.netBytes)/int64(c.N))
+		allocs := fmt.Sprintf("%8d allocs/op", int64(c.netAllocs)/int64(c.N))
+		memStats = fmt.Sprintf("\t%s\t%s", allocedBytes, allocs)
+	}
+	return fmt.Sprintf("%8d\t%s%s%s", c.N, ns, mb, memStats)
+}
+
+func min(x, y int) int {
+	if x > y {
+		return y
+	}
+	return x
+}
+
+func max(x, y int) int {
+	if x < y {
+		return y
+	}
+	return x
+}
+
+// roundDown10 rounds a number down to the nearest power of 10.
+func roundDown10(n int) int {
+	var tens = 0
+	// tens = floor(log_10(n))
+	for n > 10 {
+		n = n / 10
+		tens++
+	}
+	// result = 10^tens
+	result := 1
+	for i := 0; i < tens; i++ {
+		result *= 10
+	}
+	return result
+}
+
+// roundUp rounds x up to a number of the form [1eX, 2eX, 5eX].
+func roundUp(n int) int {
+	base := roundDown10(n)
+	if n < (2 * base) {
+		return 2 * base
+	}
+	if n < (5 * base) {
+		return 5 * base
+	}
+	return 10 * base
+}
diff --git a/vendor/gopkg.in/check.v1/check.go b/vendor/gopkg.in/check.v1/check.go
new file mode 100644
index 0000000000..bba8d8bf6e
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/check.go
@@ -0,0 +1,876 @@
+// Package check is a rich testing extension for Go's testing package.
+//
+// For details about the project, see:
+//
+//     http://labix.org/gocheck
+//
+package check
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// -----------------------------------------------------------------------
+// Internal type which deals with suite method calling.
+
+const (
+	fixtureKd = iota
+	testKd
+)
+
+type funcKind int
+
+const (
+	succeededSt = iota
+	failedSt
+	skippedSt
+	panickedSt
+	fixturePanickedSt
+	missedSt
+)
+
+type funcStatus uint32
+
+// A method value can't reach its own Method structure.
+type methodType struct {
+	reflect.Value
+	Info reflect.Method
+}
+
+func newMethod(receiver reflect.Value, i int) *methodType {
+	return &methodType{receiver.Method(i), receiver.Type().Method(i)}
+}
+
+func (method *methodType) PC() uintptr {
+	return method.Info.Func.Pointer()
+}
+
+func (method *methodType) suiteName() string {
+	t := method.Info.Type.In(0)
+	if t.Kind() == reflect.Ptr {
+		t = t.Elem()
+	}
+	return t.Name()
+}
+
+func (method *methodType) String() string {
+	return method.suiteName() + "." + method.Info.Name
+}
+
+func (method *methodType) matches(re *regexp.Regexp) bool {
+	return (re.MatchString(method.Info.Name) ||
+		re.MatchString(method.suiteName()) ||
+		re.MatchString(method.String()))
+}
+
+type C struct {
+	method    *methodType
+	kind      funcKind
+	testName  string
+	_status   funcStatus
+	logb      *logger
+	logw      io.Writer
+	done      chan *C
+	reason    string
+	mustFail  bool
+	tempDir   *tempDir
+	benchMem  bool
+	startTime time.Time
+	timer
+}
+
+func (c *C) status() funcStatus {
+	return funcStatus(atomic.LoadUint32((*uint32)(&c._status)))
+}
+
+func (c *C) setStatus(s funcStatus) {
+	atomic.StoreUint32((*uint32)(&c._status), uint32(s))
+}
+
+func (c *C) stopNow() {
+	runtime.Goexit()
+}
+
+// logger is a concurrency safe byte.Buffer
+type logger struct {
+	sync.Mutex
+	writer bytes.Buffer
+}
+
+func (l *logger) Write(buf []byte) (int, error) {
+	l.Lock()
+	defer l.Unlock()
+	return l.writer.Write(buf)
+}
+
+func (l *logger) WriteTo(w io.Writer) (int64, error) {
+	l.Lock()
+	defer l.Unlock()
+	return l.writer.WriteTo(w)
+}
+
+func (l *logger) String() string {
+	l.Lock()
+	defer l.Unlock()
+	return l.writer.String()
+}
+
+// -----------------------------------------------------------------------
+// Handling of temporary files and directories.
+
+type tempDir struct {
+	sync.Mutex
+	path    string
+	counter int
+}
+
+func (td *tempDir) newPath() string {
+	td.Lock()
+	defer td.Unlock()
+	if td.path == "" {
+		path, err := ioutil.TempDir("", "check-")
+		if err != nil {
+			panic("Couldn't create temporary directory: " + err.Error())
+		}
+		td.path = path
+	}
+	result := filepath.Join(td.path, strconv.Itoa(td.counter))
+	td.counter++
+	return result
+}
+
+func (td *tempDir) removeAll() {
+	td.Lock()
+	defer td.Unlock()
+	if td.path != "" {
+		err := os.RemoveAll(td.path)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "WARNING: Error cleaning up temporaries: "+err.Error())
+		}
+	}
+}
+
+// Create a new temporary directory which is automatically removed after
+// the suite finishes running.
+func (c *C) MkDir() string {
+	path := c.tempDir.newPath()
+	if err := os.Mkdir(path, 0700); err != nil {
+		panic(fmt.Sprintf("Couldn't create temporary directory %s: %s", path, err.Error()))
+	}
+	return path
+}
+
+// -----------------------------------------------------------------------
+// Low-level logging functions.
+
+func (c *C) log(args ...interface{}) {
+	c.writeLog([]byte(fmt.Sprint(args...) + "\n"))
+}
+
+func (c *C) logf(format string, args ...interface{}) {
+	c.writeLog([]byte(fmt.Sprintf(format+"\n", args...)))
+}
+
+func (c *C) logNewLine() {
+	c.writeLog([]byte{'\n'})
+}
+
+func (c *C) writeLog(buf []byte) {
+	c.logb.Write(buf)
+	if c.logw != nil {
+		c.logw.Write(buf)
+	}
+}
+
+func hasStringOrError(x interface{}) (ok bool) {
+	_, ok = x.(fmt.Stringer)
+	if ok {
+		return
+	}
+	_, ok = x.(error)
+	return
+}
+
+func (c *C) logValue(label string, value interface{}) {
+	if label == "" {
+		if hasStringOrError(value) {
+			c.logf("... %#v (%q)", value, value)
+		} else {
+			c.logf("... %#v", value)
+		}
+	} else if value == nil {
+		c.logf("... %s = nil", label)
+	} else {
+		if hasStringOrError(value) {
+			fv := fmt.Sprintf("%#v", value)
+			qv := fmt.Sprintf("%q", value)
+			if fv != qv {
+				c.logf("... %s %s = %s (%s)", label, reflect.TypeOf(value), fv, qv)
+				return
+			}
+		}
+		if s, ok := value.(string); ok && isMultiLine(s) {
+			c.logf(`... %s %s = "" +`, label, reflect.TypeOf(value))
+			c.logMultiLine(s)
+		} else {
+			c.logf("... %s %s = %#v", label, reflect.TypeOf(value), value)
+		}
+	}
+}
+
+func formatMultiLine(s string, quote bool) []byte {
+	b := make([]byte, 0, len(s)*2)
+	i := 0
+	n := len(s)
+	for i < n {
+		j := i + 1
+		for j < n && s[j-1] != '\n' {
+			j++
+		}
+		b = append(b, "...     "...)
+		if quote {
+			b = strconv.AppendQuote(b, s[i:j])
+		} else {
+			b = append(b, s[i:j]...)
+			b = bytes.TrimSpace(b)
+		}
+		if quote && j < n {
+			b = append(b, " +"...)
+		}
+		b = append(b, '\n')
+		i = j
+	}
+	return b
+}
+
+func (c *C) logMultiLine(s string) {
+	c.writeLog(formatMultiLine(s, true))
+}
+
+func isMultiLine(s string) bool {
+	for i := 0; i+1 < len(s); i++ {
+		if s[i] == '\n' {
+			return true
+		}
+	}
+	return false
+}
+
+func (c *C) logString(issue string) {
+	c.log("... ", issue)
+}
+
+func (c *C) logCaller(skip int) {
+	// This is a bit heavier than it ought to be.
+	skip++ // Our own frame.
+	pc, callerFile, callerLine, ok := runtime.Caller(skip)
+	if !ok {
+		return
+	}
+	var testFile string
+	var testLine int
+	testFunc := runtime.FuncForPC(c.method.PC())
+	if runtime.FuncForPC(pc) != testFunc {
+		for {
+			skip++
+			if pc, file, line, ok := runtime.Caller(skip); ok {
+				// Note that the test line may be different on
+				// distinct calls for the same test.  Showing
+				// the "internal" line is helpful when debugging.
+				if runtime.FuncForPC(pc) == testFunc {
+					testFile, testLine = file, line
+					break
+				}
+			} else {
+				break
+			}
+		}
+	}
+	if testFile != "" && (testFile != callerFile || testLine != callerLine) {
+		c.logCode(testFile, testLine)
+	}
+	c.logCode(callerFile, callerLine)
+}
+
+func (c *C) logCode(path string, line int) {
+	c.logf("%s:%d:", nicePath(path), line)
+	code, err := printLine(path, line)
+	if code == "" {
+		code = "..." // XXX Open the file and take the raw line.
+		if err != nil {
+			code += err.Error()
+		}
+	}
+	c.log(indent(code, "    "))
+}
+
+var valueGo = filepath.Join("reflect", "value.go")
+var asmGo = filepath.Join("runtime", "asm_")
+
+func (c *C) logPanic(skip int, value interface{}) {
+	skip++ // Our own frame.
+	initialSkip := skip
+	for ; ; skip++ {
+		if pc, file, line, ok := runtime.Caller(skip); ok {
+			if skip == initialSkip {
+				c.logf("... Panic: %s (PC=0x%X)\n", value, pc)
+			}
+			name := niceFuncName(pc)
+			path := nicePath(file)
+			if strings.Contains(path, "/gopkg.in/check.v") {
+				continue
+			}
+			if name == "Value.call" && strings.HasSuffix(path, valueGo) {
+				continue
+			}
+			if (name == "call16" || name == "call32") && strings.Contains(path, asmGo) {
+				continue
+			}
+			c.logf("%s:%d\n  in %s", nicePath(file), line, name)
+		} else {
+			break
+		}
+	}
+}
+
+func (c *C) logSoftPanic(issue string) {
+	c.log("... Panic: ", issue)
+}
+
+func (c *C) logArgPanic(method *methodType, expectedType string) {
+	c.logf("... Panic: %s argument should be %s",
+		niceFuncName(method.PC()), expectedType)
+}
+
+// -----------------------------------------------------------------------
+// Some simple formatting helpers.
+
+var initWD, initWDErr = os.Getwd()
+
+func init() {
+	if initWDErr == nil {
+		initWD = strings.Replace(initWD, "\\", "/", -1) + "/"
+	}
+}
+
+func nicePath(path string) string {
+	if initWDErr == nil {
+		if strings.HasPrefix(path, initWD) {
+			return path[len(initWD):]
+		}
+	}
+	return path
+}
+
+func niceFuncPath(pc uintptr) string {
+	function := runtime.FuncForPC(pc)
+	if function != nil {
+		filename, line := function.FileLine(pc)
+		return fmt.Sprintf("%s:%d", nicePath(filename), line)
+	}
+	return "<unknown path>"
+}
+
+func niceFuncName(pc uintptr) string {
+	function := runtime.FuncForPC(pc)
+	if function != nil {
+		name := path.Base(function.Name())
+		if i := strings.Index(name, "."); i > 0 {
+			name = name[i+1:]
+		}
+		if strings.HasPrefix(name, "(*") {
+			if i := strings.Index(name, ")"); i > 0 {
+				name = name[2:i] + name[i+1:]
+			}
+		}
+		if i := strings.LastIndex(name, ".*"); i != -1 {
+			name = name[:i] + "." + name[i+2:]
+		}
+		if i := strings.LastIndex(name, "·"); i != -1 {
+			name = name[:i] + "." + name[i+2:]
+		}
+		return name
+	}
+	return "<unknown function>"
+}
+
+// -----------------------------------------------------------------------
+// Result tracker to aggregate call results.
+
+type Result struct {
+	Succeeded        int
+	Failed           int
+	Skipped          int
+	Panicked         int
+	FixturePanicked  int
+	ExpectedFailures int
+	Missed           int    // Not even tried to run, related to a panic in the fixture.
+	RunError         error  // Houston, we've got a problem.
+	WorkDir          string // If KeepWorkDir is true
+}
+
+type resultTracker struct {
+	result          Result
+	_lastWasProblem bool
+	_waiting        int
+	_missed         int
+	_expectChan     chan *C
+	_doneChan       chan *C
+	_stopChan       chan bool
+}
+
+func newResultTracker() *resultTracker {
+	return &resultTracker{_expectChan: make(chan *C), // Synchronous
+		_doneChan: make(chan *C, 32), // Asynchronous
+		_stopChan: make(chan bool)}   // Synchronous
+}
+
+func (tracker *resultTracker) start() {
+	go tracker._loopRoutine()
+}
+
+func (tracker *resultTracker) waitAndStop() {
+	<-tracker._stopChan
+}
+
+func (tracker *resultTracker) expectCall(c *C) {
+	tracker._expectChan <- c
+}
+
+func (tracker *resultTracker) callDone(c *C) {
+	tracker._doneChan <- c
+}
+
+func (tracker *resultTracker) _loopRoutine() {
+	for {
+		var c *C
+		if tracker._waiting > 0 {
+			// Calls still running. Can't stop.
+			select {
+			// XXX Reindent this (not now to make diff clear)
+			case <-tracker._expectChan:
+				tracker._waiting++
+			case c = <-tracker._doneChan:
+				tracker._waiting--
+				switch c.status() {
+				case succeededSt:
+					if c.kind == testKd {
+						if c.mustFail {
+							tracker.result.ExpectedFailures++
+						} else {
+							tracker.result.Succeeded++
+						}
+					}
+				case failedSt:
+					tracker.result.Failed++
+				case panickedSt:
+					if c.kind == fixtureKd {
+						tracker.result.FixturePanicked++
+					} else {
+						tracker.result.Panicked++
+					}
+				case fixturePanickedSt:
+					// Track it as missed, since the panic
+					// was on the fixture, not on the test.
+					tracker.result.Missed++
+				case missedSt:
+					tracker.result.Missed++
+				case skippedSt:
+					if c.kind == testKd {
+						tracker.result.Skipped++
+					}
+				}
+			}
+		} else {
+			// No calls.  Can stop, but no done calls here.
+			select {
+			case tracker._stopChan <- true:
+				return
+			case <-tracker._expectChan:
+				tracker._waiting++
+			case <-tracker._doneChan:
+				panic("Tracker got an unexpected done call.")
+			}
+		}
+	}
+}
+
+// -----------------------------------------------------------------------
+// The underlying suite runner.
+
+type suiteRunner struct {
+	suite                     interface{}
+	setUpSuite, tearDownSuite *methodType
+	setUpTest, tearDownTest   *methodType
+	tests                     []*methodType
+	tracker                   *resultTracker
+	tempDir                   *tempDir
+	keepDir                   bool
+	output                    *outputWriter
+	reportedProblemLast       bool
+	benchTime                 time.Duration
+	benchMem                  bool
+}
+
+type RunConf struct {
+	Output        io.Writer
+	Stream        bool
+	Verbose       bool
+	Filter        string
+	Benchmark     bool
+	BenchmarkTime time.Duration // Defaults to 1 second
+	BenchmarkMem  bool
+	KeepWorkDir   bool
+}
+
+// Create a new suiteRunner able to run all methods in the given suite.
+func newSuiteRunner(suite interface{}, runConf *RunConf) *suiteRunner {
+	var conf RunConf
+	if runConf != nil {
+		conf = *runConf
+	}
+	if conf.Output == nil {
+		conf.Output = os.Stdout
+	}
+	if conf.Benchmark {
+		conf.Verbose = true
+	}
+
+	suiteType := reflect.TypeOf(suite)
+	suiteNumMethods := suiteType.NumMethod()
+	suiteValue := reflect.ValueOf(suite)
+
+	runner := &suiteRunner{
+		suite:     suite,
+		output:    newOutputWriter(conf.Output, conf.Stream, conf.Verbose),
+		tracker:   newResultTracker(),
+		benchTime: conf.BenchmarkTime,
+		benchMem:  conf.BenchmarkMem,
+		tempDir:   &tempDir{},
+		keepDir:   conf.KeepWorkDir,
+		tests:     make([]*methodType, 0, suiteNumMethods),
+	}
+	if runner.benchTime == 0 {
+		runner.benchTime = 1 * time.Second
+	}
+
+	var filterRegexp *regexp.Regexp
+	if conf.Filter != "" {
+		regexp, err := regexp.Compile(conf.Filter)
+		if err != nil {
+			msg := "Bad filter expression: " + err.Error()
+			runner.tracker.result.RunError = errors.New(msg)
+			return runner
+		}
+		filterRegexp = regexp
+	}
+
+	for i := 0; i != suiteNumMethods; i++ {
+		method := newMethod(suiteValue, i)
+		switch method.Info.Name {
+		case "SetUpSuite":
+			runner.setUpSuite = method
+		case "TearDownSuite":
+			runner.tearDownSuite = method
+		case "SetUpTest":
+			runner.setUpTest = method
+		case "TearDownTest":
+			runner.tearDownTest = method
+		default:
+			prefix := "Test"
+			if conf.Benchmark {
+				prefix = "Benchmark"
+			}
+			if !strings.HasPrefix(method.Info.Name, prefix) {
+				continue
+			}
+			if filterRegexp == nil || method.matches(filterRegexp) {
+				runner.tests = append(runner.tests, method)
+			}
+		}
+	}
+	return runner
+}
+
+// Run all methods in the given suite.
+func (runner *suiteRunner) run() *Result {
+	if runner.tracker.result.RunError == nil && len(runner.tests) > 0 {
+		runner.tracker.start()
+		if runner.checkFixtureArgs() {
+			c := runner.runFixture(runner.setUpSuite, "", nil)
+			if c == nil || c.status() == succeededSt {
+				for i := 0; i != len(runner.tests); i++ {
+					c := runner.runTest(runner.tests[i])
+					if c.status() == fixturePanickedSt {
+						runner.skipTests(missedSt, runner.tests[i+1:])
+						break
+					}
+				}
+			} else if c != nil && c.status() == skippedSt {
+				runner.skipTests(skippedSt, runner.tests)
+			} else {
+				runner.skipTests(missedSt, runner.tests)
+			}
+			runner.runFixture(runner.tearDownSuite, "", nil)
+		} else {
+			runner.skipTests(missedSt, runner.tests)
+		}
+		runner.tracker.waitAndStop()
+		if runner.keepDir {
+			runner.tracker.result.WorkDir = runner.tempDir.path
+		} else {
+			runner.tempDir.removeAll()
+		}
+	}
+	return &runner.tracker.result
+}
+
+// Create a call object with the given suite method, and fork a
+// goroutine with the provided dispatcher for running it.
+func (runner *suiteRunner) forkCall(method *methodType, kind funcKind, testName string, logb *logger, dispatcher func(c *C)) *C {
+	var logw io.Writer
+	if runner.output.Stream {
+		logw = runner.output
+	}
+	if logb == nil {
+		logb = new(logger)
+	}
+	c := &C{
+		method:    method,
+		kind:      kind,
+		testName:  testName,
+		logb:      logb,
+		logw:      logw,
+		tempDir:   runner.tempDir,
+		done:      make(chan *C, 1),
+		timer:     timer{benchTime: runner.benchTime},
+		startTime: time.Now(),
+		benchMem:  runner.benchMem,
+	}
+	runner.tracker.expectCall(c)
+	go (func() {
+		runner.reportCallStarted(c)
+		defer runner.callDone(c)
+		dispatcher(c)
+	})()
+	return c
+}
+
+// Same as forkCall(), but wait for call to finish before returning.
+func (runner *suiteRunner) runFunc(method *methodType, kind funcKind, testName string, logb *logger, dispatcher func(c *C)) *C {
+	c := runner.forkCall(method, kind, testName, logb, dispatcher)
+	<-c.done
+	return c
+}
+
+// Handle a finished call.  If there were any panics, update the call status
+// accordingly.  Then, mark the call as done and report to the tracker.
+func (runner *suiteRunner) callDone(c *C) {
+	value := recover()
+	if value != nil {
+		switch v := value.(type) {
+		case *fixturePanic:
+			if v.status == skippedSt {
+				c.setStatus(skippedSt)
+			} else {
+				c.logSoftPanic("Fixture has panicked (see related PANIC)")
+				c.setStatus(fixturePanickedSt)
+			}
+		default:
+			c.logPanic(1, value)
+			c.setStatus(panickedSt)
+		}
+	}
+	if c.mustFail {
+		switch c.status() {
+		case failedSt:
+			c.setStatus(succeededSt)
+		case succeededSt:
+			c.setStatus(failedSt)
+			c.logString("Error: Test succeeded, but was expected to fail")
+			c.logString("Reason: " + c.reason)
+		}
+	}
+
+	runner.reportCallDone(c)
+	c.done <- c
+}
+
+// Runs a fixture call synchronously.  The fixture will still be run in a
+// goroutine like all suite methods, but this method will not return
+// while the fixture goroutine is not done, because the fixture must be
+// run in a desired order.
+func (runner *suiteRunner) runFixture(method *methodType, testName string, logb *logger) *C {
+	if method != nil {
+		c := runner.runFunc(method, fixtureKd, testName, logb, func(c *C) {
+			c.ResetTimer()
+			c.StartTimer()
+			defer c.StopTimer()
+			c.method.Call([]reflect.Value{reflect.ValueOf(c)})
+		})
+		return c
+	}
+	return nil
+}
+
+// Run the fixture method with runFixture(), but panic with a fixturePanic{}
+// in case the fixture method panics.  This makes it easier to track the
+// fixture panic together with other call panics within forkTest().
+func (runner *suiteRunner) runFixtureWithPanic(method *methodType, testName string, logb *logger, skipped *bool) *C {
+	if skipped != nil && *skipped {
+		return nil
+	}
+	c := runner.runFixture(method, testName, logb)
+	if c != nil && c.status() != succeededSt {
+		if skipped != nil {
+			*skipped = c.status() == skippedSt
+		}
+		panic(&fixturePanic{c.status(), method})
+	}
+	return c
+}
+
+type fixturePanic struct {
+	status funcStatus
+	method *methodType
+}
+
+// Run the suite test method, together with the test-specific fixture,
+// asynchronously.
+func (runner *suiteRunner) forkTest(method *methodType) *C {
+	testName := method.String()
+	return runner.forkCall(method, testKd, testName, nil, func(c *C) {
+		var skipped bool
+		defer runner.runFixtureWithPanic(runner.tearDownTest, testName, nil, &skipped)
+		defer c.StopTimer()
+		benchN := 1
+		for {
+			runner.runFixtureWithPanic(runner.setUpTest, testName, c.logb, &skipped)
+			mt := c.method.Type()
+			if mt.NumIn() != 1 || mt.In(0) != reflect.TypeOf(c) {
+				// Rather than a plain panic, provide a more helpful message when
+				// the argument type is incorrect.
+				c.setStatus(panickedSt)
+				c.logArgPanic(c.method, "*check.C")
+				return
+			}
+			if strings.HasPrefix(c.method.Info.Name, "Test") {
+				c.ResetTimer()
+				c.StartTimer()
+				c.method.Call([]reflect.Value{reflect.ValueOf(c)})
+				return
+			}
+			if !strings.HasPrefix(c.method.Info.Name, "Benchmark") {
+				panic("unexpected method prefix: " + c.method.Info.Name)
+			}
+
+			runtime.GC()
+			c.N = benchN
+			c.ResetTimer()
+			c.StartTimer()
+			c.method.Call([]reflect.Value{reflect.ValueOf(c)})
+			c.StopTimer()
+			if c.status() != succeededSt || c.duration >= c.benchTime || benchN >= 1e9 {
+				return
+			}
+			perOpN := int(1e9)
+			if c.nsPerOp() != 0 {
+				perOpN = int(c.benchTime.Nanoseconds() / c.nsPerOp())
+			}
+
+			// Logic taken from the stock testing package:
+			// - Run more iterations than we think we'll need for a second (1.5x).
+			// - Don't grow too fast in case we had timing errors previously.
+			// - Be sure to run at least one more than last time.
+			benchN = max(min(perOpN+perOpN/2, 100*benchN), benchN+1)
+			benchN = roundUp(benchN)
+
+			skipped = true // Don't run the deferred one if this panics.
+			runner.runFixtureWithPanic(runner.tearDownTest, testName, nil, nil)
+			skipped = false
+		}
+	})
+}
+
+// Same as forkTest(), but wait for the test to finish before returning.
+func (runner *suiteRunner) runTest(method *methodType) *C {
+	c := runner.forkTest(method)
+	<-c.done
+	return c
+}
+
+// Helper to mark tests as skipped or missed.  A bit heavy for what
+// it does, but it enables homogeneous handling of tracking, including
+// nice verbose output.
+func (runner *suiteRunner) skipTests(status funcStatus, methods []*methodType) {
+	for _, method := range methods {
+		runner.runFunc(method, testKd, "", nil, func(c *C) {
+			c.setStatus(status)
+		})
+	}
+}
+
+// Verify if the fixture arguments are *check.C.  In case of errors,
+// log the error as a panic in the fixture method call, and return false.
+func (runner *suiteRunner) checkFixtureArgs() bool {
+	succeeded := true
+	argType := reflect.TypeOf(&C{})
+	for _, method := range []*methodType{runner.setUpSuite, runner.tearDownSuite, runner.setUpTest, runner.tearDownTest} {
+		if method != nil {
+			mt := method.Type()
+			if mt.NumIn() != 1 || mt.In(0) != argType {
+				succeeded = false
+				runner.runFunc(method, fixtureKd, "", nil, func(c *C) {
+					c.logArgPanic(method, "*check.C")
+					c.setStatus(panickedSt)
+				})
+			}
+		}
+	}
+	return succeeded
+}
+
+func (runner *suiteRunner) reportCallStarted(c *C) {
+	runner.output.WriteCallStarted("START", c)
+}
+
+func (runner *suiteRunner) reportCallDone(c *C) {
+	runner.tracker.callDone(c)
+	switch c.status() {
+	case succeededSt:
+		if c.mustFail {
+			runner.output.WriteCallSuccess("FAIL EXPECTED", c)
+		} else {
+			runner.output.WriteCallSuccess("PASS", c)
+		}
+	case skippedSt:
+		runner.output.WriteCallSuccess("SKIP", c)
+	case failedSt:
+		runner.output.WriteCallProblem("FAIL", c)
+	case panickedSt:
+		runner.output.WriteCallProblem("PANIC", c)
+	case fixturePanickedSt:
+		// That's a testKd call reporting that its fixture
+		// has panicked. The fixture call which caused the
+		// panic itself was tracked above. We'll report to
+		// aid debugging.
+		runner.output.WriteCallProblem("PANIC", c)
+	case missedSt:
+		runner.output.WriteCallSuccess("MISS", c)
+	}
+}
diff --git a/vendor/gopkg.in/check.v1/checkers.go b/vendor/gopkg.in/check.v1/checkers.go
new file mode 100644
index 0000000000..032619792e
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/checkers.go
@@ -0,0 +1,528 @@
+package check
+
+import (
+	"fmt"
+	"reflect"
+	"regexp"
+	"strings"
+
+	"github.com/kr/pretty"
+)
+
+// -----------------------------------------------------------------------
+// CommentInterface and Commentf helper, to attach extra information to checks.
+
+type comment struct {
+	format string
+	args   []interface{}
+}
+
+// Commentf returns an infomational value to use with Assert or Check calls.
+// If the checker test fails, the provided arguments will be passed to
+// fmt.Sprintf, and will be presented next to the logged failure.
+//
+// For example:
+//
+//     c.Assert(v, Equals, 42, Commentf("Iteration #%d failed.", i))
+//
+// Note that if the comment is constant, a better option is to
+// simply use a normal comment right above or next to the line, as
+// it will also get printed with any errors:
+//
+//     c.Assert(l, Equals, 8192) // Ensure buffer size is correct (bug #123)
+//
+func Commentf(format string, args ...interface{}) CommentInterface {
+	return &comment{format, args}
+}
+
+// CommentInterface must be implemented by types that attach extra
+// information to failed checks. See the Commentf function for details.
+type CommentInterface interface {
+	CheckCommentString() string
+}
+
+func (c *comment) CheckCommentString() string {
+	return fmt.Sprintf(c.format, c.args...)
+}
+
+// -----------------------------------------------------------------------
+// The Checker interface.
+
+// The Checker interface must be provided by checkers used with
+// the Assert and Check verification methods.
+type Checker interface {
+	Info() *CheckerInfo
+	Check(params []interface{}, names []string) (result bool, error string)
+}
+
+// See the Checker interface.
+type CheckerInfo struct {
+	Name   string
+	Params []string
+}
+
+func (info *CheckerInfo) Info() *CheckerInfo {
+	return info
+}
+
+// -----------------------------------------------------------------------
+// Not checker logic inverter.
+
+// The Not checker inverts the logic of the provided checker.  The
+// resulting checker will succeed where the original one failed, and
+// vice-versa.
+//
+// For example:
+//
+//     c.Assert(a, Not(Equals), b)
+//
+func Not(checker Checker) Checker {
+	return &notChecker{checker}
+}
+
+type notChecker struct {
+	sub Checker
+}
+
+func (checker *notChecker) Info() *CheckerInfo {
+	info := *checker.sub.Info()
+	info.Name = "Not(" + info.Name + ")"
+	return &info
+}
+
+func (checker *notChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	result, error = checker.sub.Check(params, names)
+	result = !result
+	if result {
+		// clear error message if the new result is true
+		error = ""
+	}
+	return
+}
+
+// -----------------------------------------------------------------------
+// IsNil checker.
+
+type isNilChecker struct {
+	*CheckerInfo
+}
+
+// The IsNil checker tests whether the obtained value is nil.
+//
+// For example:
+//
+//    c.Assert(err, IsNil)
+//
+var IsNil Checker = &isNilChecker{
+	&CheckerInfo{Name: "IsNil", Params: []string{"value"}},
+}
+
+func (checker *isNilChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	return isNil(params[0]), ""
+}
+
+func isNil(obtained interface{}) (result bool) {
+	if obtained == nil {
+		result = true
+	} else {
+		switch v := reflect.ValueOf(obtained); v.Kind() {
+		case reflect.Chan, reflect.Func, reflect.Interface, reflect.Map, reflect.Ptr, reflect.Slice:
+			return v.IsNil()
+		}
+	}
+	return
+}
+
+// -----------------------------------------------------------------------
+// NotNil checker. Alias for Not(IsNil), since it's so common.
+
+type notNilChecker struct {
+	*CheckerInfo
+}
+
+// The NotNil checker verifies that the obtained value is not nil.
+//
+// For example:
+//
+//     c.Assert(iface, NotNil)
+//
+// This is an alias for Not(IsNil), made available since it's a
+// fairly common check.
+//
+var NotNil Checker = &notNilChecker{
+	&CheckerInfo{Name: "NotNil", Params: []string{"value"}},
+}
+
+func (checker *notNilChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	return !isNil(params[0]), ""
+}
+
+// -----------------------------------------------------------------------
+// Equals checker.
+
+func diffworthy(a interface{}) bool {
+	if a == nil {
+		return false
+	}
+
+	t := reflect.TypeOf(a)
+	switch t.Kind() {
+	case reflect.Array, reflect.Map, reflect.Slice, reflect.Struct, reflect.String, reflect.Ptr:
+		return true
+	}
+	return false
+}
+
+// formatUnequal will dump the actual and expected values into a textual
+// representation and return an error message containing a diff.
+func formatUnequal(obtained interface{}, expected interface{}) string {
+	// We do not do diffs for basic types because go-check already
+	// shows them very cleanly.
+	if !diffworthy(obtained) || !diffworthy(expected) {
+		return ""
+	}
+
+	// Handle strings, short strings are ignored (go-check formats
+	// them very nicely already). We do multi-line strings by
+	// generating two string slices and using kr.Diff to compare
+	// those (kr.Diff does not do string diffs by itself).
+	aStr, aOK := obtained.(string)
+	bStr, bOK := expected.(string)
+	if aOK && bOK {
+		l1 := strings.Split(aStr, "\n")
+		l2 := strings.Split(bStr, "\n")
+		// the "2" here is a bit arbitrary
+		if len(l1) > 2 && len(l2) > 2 {
+			diff := pretty.Diff(l1, l2)
+			return fmt.Sprintf(`String difference:
+%s`, formatMultiLine(strings.Join(diff, "\n"), false))
+		}
+		// string too short
+		return ""
+	}
+
+	// generic diff
+	diff := pretty.Diff(obtained, expected)
+	if len(diff) == 0 {
+		// No diff, this happens when e.g. just struct
+		// pointers are different but the structs have
+		// identical values.
+		return ""
+	}
+
+	return fmt.Sprintf(`Difference:
+%s`, formatMultiLine(strings.Join(diff, "\n"), false))
+}
+
+type equalsChecker struct {
+	*CheckerInfo
+}
+
+// The Equals checker verifies that the obtained value is equal to
+// the expected value, according to usual Go semantics for ==.
+//
+// For example:
+//
+//     c.Assert(value, Equals, 42)
+//
+var Equals Checker = &equalsChecker{
+	&CheckerInfo{Name: "Equals", Params: []string{"obtained", "expected"}},
+}
+
+func (checker *equalsChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	defer func() {
+		if v := recover(); v != nil {
+			result = false
+			error = fmt.Sprint(v)
+		}
+	}()
+
+	result = params[0] == params[1]
+	if !result {
+		error = formatUnequal(params[0], params[1])
+	}
+	return
+}
+
+// -----------------------------------------------------------------------
+// DeepEquals checker.
+
+type deepEqualsChecker struct {
+	*CheckerInfo
+}
+
+// The DeepEquals checker verifies that the obtained value is deep-equal to
+// the expected value.  The check will work correctly even when facing
+// slices, interfaces, and values of different types (which always fail
+// the test).
+//
+// For example:
+//
+//     c.Assert(value, DeepEquals, 42)
+//     c.Assert(array, DeepEquals, []string{"hi", "there"})
+//
+var DeepEquals Checker = &deepEqualsChecker{
+	&CheckerInfo{Name: "DeepEquals", Params: []string{"obtained", "expected"}},
+}
+
+func (checker *deepEqualsChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	result = reflect.DeepEqual(params[0], params[1])
+	if !result {
+		error = formatUnequal(params[0], params[1])
+	}
+	return
+}
+
+// -----------------------------------------------------------------------
+// HasLen checker.
+
+type hasLenChecker struct {
+	*CheckerInfo
+}
+
+// The HasLen checker verifies that the obtained value has the
+// provided length. In many cases this is superior to using Equals
+// in conjunction with the len function because in case the check
+// fails the value itself will be printed, instead of its length,
+// providing more details for figuring the problem.
+//
+// For example:
+//
+//     c.Assert(list, HasLen, 5)
+//
+var HasLen Checker = &hasLenChecker{
+	&CheckerInfo{Name: "HasLen", Params: []string{"obtained", "n"}},
+}
+
+func (checker *hasLenChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	n, ok := params[1].(int)
+	if !ok {
+		return false, "n must be an int"
+	}
+	value := reflect.ValueOf(params[0])
+	switch value.Kind() {
+	case reflect.Map, reflect.Array, reflect.Slice, reflect.Chan, reflect.String:
+	default:
+		return false, "obtained value type has no length"
+	}
+	return value.Len() == n, ""
+}
+
+// -----------------------------------------------------------------------
+// ErrorMatches checker.
+
+type errorMatchesChecker struct {
+	*CheckerInfo
+}
+
+// The ErrorMatches checker verifies that the error value
+// is non nil and matches the regular expression provided.
+//
+// For example:
+//
+//     c.Assert(err, ErrorMatches, "perm.*denied")
+//
+var ErrorMatches Checker = errorMatchesChecker{
+	&CheckerInfo{Name: "ErrorMatches", Params: []string{"value", "regex"}},
+}
+
+func (checker errorMatchesChecker) Check(params []interface{}, names []string) (result bool, errStr string) {
+	if params[0] == nil {
+		return false, "Error value is nil"
+	}
+	err, ok := params[0].(error)
+	if !ok {
+		return false, "Value is not an error"
+	}
+	params[0] = err.Error()
+	names[0] = "error"
+	return matches(params[0], params[1])
+}
+
+// -----------------------------------------------------------------------
+// Matches checker.
+
+type matchesChecker struct {
+	*CheckerInfo
+}
+
+// The Matches checker verifies that the string provided as the obtained
+// value (or the string resulting from obtained.String()) matches the
+// regular expression provided.
+//
+// For example:
+//
+//     c.Assert(err, Matches, "perm.*denied")
+//
+var Matches Checker = &matchesChecker{
+	&CheckerInfo{Name: "Matches", Params: []string{"value", "regex"}},
+}
+
+func (checker *matchesChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	return matches(params[0], params[1])
+}
+
+func matches(value, regex interface{}) (result bool, error string) {
+	reStr, ok := regex.(string)
+	if !ok {
+		return false, "Regex must be a string"
+	}
+	valueStr, valueIsStr := value.(string)
+	if !valueIsStr {
+		if valueWithStr, valueHasStr := value.(fmt.Stringer); valueHasStr {
+			valueStr, valueIsStr = valueWithStr.String(), true
+		}
+	}
+	if valueIsStr {
+		matches, err := regexp.MatchString("^"+reStr+"$", valueStr)
+		if err != nil {
+			return false, "Can't compile regex: " + err.Error()
+		}
+		return matches, ""
+	}
+	return false, "Obtained value is not a string and has no .String()"
+}
+
+// -----------------------------------------------------------------------
+// Panics checker.
+
+type panicsChecker struct {
+	*CheckerInfo
+}
+
+// The Panics checker verifies that calling the provided zero-argument
+// function will cause a panic which is deep-equal to the provided value.
+//
+// For example:
+//
+//     c.Assert(func() { f(1, 2) }, Panics, &SomeErrorType{"BOOM"}).
+//
+//
+var Panics Checker = &panicsChecker{
+	&CheckerInfo{Name: "Panics", Params: []string{"function", "expected"}},
+}
+
+func (checker *panicsChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	f := reflect.ValueOf(params[0])
+	if f.Kind() != reflect.Func || f.Type().NumIn() != 0 {
+		return false, "Function must take zero arguments"
+	}
+	defer func() {
+		// If the function has not panicked, then don't do the check.
+		if error != "" {
+			return
+		}
+		params[0] = recover()
+		names[0] = "panic"
+		result = reflect.DeepEqual(params[0], params[1])
+	}()
+	f.Call(nil)
+	return false, "Function has not panicked"
+}
+
+type panicMatchesChecker struct {
+	*CheckerInfo
+}
+
+// The PanicMatches checker verifies that calling the provided zero-argument
+// function will cause a panic with an error value matching
+// the regular expression provided.
+//
+// For example:
+//
+//     c.Assert(func() { f(1, 2) }, PanicMatches, `open.*: no such file or directory`).
+//
+//
+var PanicMatches Checker = &panicMatchesChecker{
+	&CheckerInfo{Name: "PanicMatches", Params: []string{"function", "expected"}},
+}
+
+func (checker *panicMatchesChecker) Check(params []interface{}, names []string) (result bool, errmsg string) {
+	f := reflect.ValueOf(params[0])
+	if f.Kind() != reflect.Func || f.Type().NumIn() != 0 {
+		return false, "Function must take zero arguments"
+	}
+	defer func() {
+		// If the function has not panicked, then don't do the check.
+		if errmsg != "" {
+			return
+		}
+		obtained := recover()
+		names[0] = "panic"
+		if e, ok := obtained.(error); ok {
+			params[0] = e.Error()
+		} else if _, ok := obtained.(string); ok {
+			params[0] = obtained
+		} else {
+			errmsg = "Panic value is not a string or an error"
+			return
+		}
+		result, errmsg = matches(params[0], params[1])
+	}()
+	f.Call(nil)
+	return false, "Function has not panicked"
+}
+
+// -----------------------------------------------------------------------
+// FitsTypeOf checker.
+
+type fitsTypeChecker struct {
+	*CheckerInfo
+}
+
+// The FitsTypeOf checker verifies that the obtained value is
+// assignable to a variable with the same type as the provided
+// sample value.
+//
+// For example:
+//
+//     c.Assert(value, FitsTypeOf, int64(0))
+//     c.Assert(value, FitsTypeOf, os.Error(nil))
+//
+var FitsTypeOf Checker = &fitsTypeChecker{
+	&CheckerInfo{Name: "FitsTypeOf", Params: []string{"obtained", "sample"}},
+}
+
+func (checker *fitsTypeChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	obtained := reflect.ValueOf(params[0])
+	sample := reflect.ValueOf(params[1])
+	if !obtained.IsValid() {
+		return false, ""
+	}
+	if !sample.IsValid() {
+		return false, "Invalid sample value"
+	}
+	return obtained.Type().AssignableTo(sample.Type()), ""
+}
+
+// -----------------------------------------------------------------------
+// Implements checker.
+
+type implementsChecker struct {
+	*CheckerInfo
+}
+
+// The Implements checker verifies that the obtained value
+// implements the interface specified via a pointer to an interface
+// variable.
+//
+// For example:
+//
+//     var e os.Error
+//     c.Assert(err, Implements, &e)
+//
+var Implements Checker = &implementsChecker{
+	&CheckerInfo{Name: "Implements", Params: []string{"obtained", "ifaceptr"}},
+}
+
+func (checker *implementsChecker) Check(params []interface{}, names []string) (result bool, error string) {
+	obtained := reflect.ValueOf(params[0])
+	ifaceptr := reflect.ValueOf(params[1])
+	if !obtained.IsValid() {
+		return false, ""
+	}
+	if !ifaceptr.IsValid() || ifaceptr.Kind() != reflect.Ptr || ifaceptr.Elem().Kind() != reflect.Interface {
+		return false, "ifaceptr should be a pointer to an interface variable"
+	}
+	return obtained.Type().Implements(ifaceptr.Elem().Type()), ""
+}
diff --git a/vendor/gopkg.in/check.v1/helpers.go b/vendor/gopkg.in/check.v1/helpers.go
new file mode 100644
index 0000000000..9e0d0bac4c
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/helpers.go
@@ -0,0 +1,233 @@
+package check
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// TestName returns the current test name in the form "SuiteName.TestName"
+func (c *C) TestName() string {
+	return c.testName
+}
+
+// -----------------------------------------------------------------------
+// Basic succeeding/failing logic.
+
+// Failed returns whether the currently running test has already failed.
+func (c *C) Failed() bool {
+	return c.status() == failedSt
+}
+
+// Fail marks the currently running test as failed.
+//
+// Something ought to have been previously logged so the developer can tell
+// what went wrong. The higher level helper functions will fail the test
+// and do the logging properly.
+func (c *C) Fail() {
+	c.setStatus(failedSt)
+}
+
+// FailNow marks the currently running test as failed and stops running it.
+// Something ought to have been previously logged so the developer can tell
+// what went wrong. The higher level helper functions will fail the test
+// and do the logging properly.
+func (c *C) FailNow() {
+	c.Fail()
+	c.stopNow()
+}
+
+// Succeed marks the currently running test as succeeded, undoing any
+// previous failures.
+func (c *C) Succeed() {
+	c.setStatus(succeededSt)
+}
+
+// SucceedNow marks the currently running test as succeeded, undoing any
+// previous failures, and stops running the test.
+func (c *C) SucceedNow() {
+	c.Succeed()
+	c.stopNow()
+}
+
+// ExpectFailure informs that the running test is knowingly broken for
+// the provided reason. If the test does not fail, an error will be reported
+// to raise attention to this fact. This method is useful to temporarily
+// disable tests which cover well known problems until a better time to
+// fix the problem is found, without forgetting about the fact that a
+// failure still exists.
+func (c *C) ExpectFailure(reason string) {
+	if reason == "" {
+		panic("Missing reason why the test is expected to fail")
+	}
+	c.mustFail = true
+	c.reason = reason
+}
+
+// Skip skips the running test for the provided reason. If run from within
+// SetUpTest, the individual test being set up will be skipped, and if run
+// from within SetUpSuite, the whole suite is skipped.
+func (c *C) Skip(reason string) {
+	if reason == "" {
+		panic("Missing reason why the test is being skipped")
+	}
+	c.reason = reason
+	c.setStatus(skippedSt)
+	c.stopNow()
+}
+
+// -----------------------------------------------------------------------
+// Basic logging.
+
+// GetTestLog returns the current test error output.
+func (c *C) GetTestLog() string {
+	return c.logb.String()
+}
+
+// Log logs some information into the test error output.
+// The provided arguments are assembled together into a string with fmt.Sprint.
+func (c *C) Log(args ...interface{}) {
+	c.log(args...)
+}
+
+// Log logs some information into the test error output.
+// The provided arguments are assembled together into a string with fmt.Sprintf.
+func (c *C) Logf(format string, args ...interface{}) {
+	c.logf(format, args...)
+}
+
+// Output enables *C to be used as a logger in functions that require only
+// the minimum interface of *log.Logger.
+func (c *C) Output(calldepth int, s string) error {
+	d := time.Now().Sub(c.startTime)
+	msec := d / time.Millisecond
+	sec := d / time.Second
+	min := d / time.Minute
+
+	c.Logf("[LOG] %d:%02d.%03d %s", min, sec%60, msec%1000, s)
+	return nil
+}
+
+// Error logs an error into the test error output and marks the test as failed.
+// The provided arguments are assembled together into a string with fmt.Sprint.
+func (c *C) Error(args ...interface{}) {
+	c.logCaller(1)
+	c.logString(fmt.Sprint("Error: ", fmt.Sprint(args...)))
+	c.logNewLine()
+	c.Fail()
+}
+
+// Errorf logs an error into the test error output and marks the test as failed.
+// The provided arguments are assembled together into a string with fmt.Sprintf.
+func (c *C) Errorf(format string, args ...interface{}) {
+	c.logCaller(1)
+	c.logString(fmt.Sprintf("Error: "+format, args...))
+	c.logNewLine()
+	c.Fail()
+}
+
+// Fatal logs an error into the test error output, marks the test as failed, and
+// stops the test execution. The provided arguments are assembled together into
+// a string with fmt.Sprint.
+func (c *C) Fatal(args ...interface{}) {
+	c.logCaller(1)
+	c.logString(fmt.Sprint("Error: ", fmt.Sprint(args...)))
+	c.logNewLine()
+	c.FailNow()
+}
+
+// Fatlaf logs an error into the test error output, marks the test as failed, and
+// stops the test execution. The provided arguments are assembled together into
+// a string with fmt.Sprintf.
+func (c *C) Fatalf(format string, args ...interface{}) {
+	c.logCaller(1)
+	c.logString(fmt.Sprint("Error: ", fmt.Sprintf(format, args...)))
+	c.logNewLine()
+	c.FailNow()
+}
+
+// -----------------------------------------------------------------------
+// Generic checks and assertions based on checkers.
+
+// Check verifies if the first value matches the expected value according
+// to the provided checker. If they do not match, an error is logged, the
+// test is marked as failed, and the test execution continues.
+//
+// Some checkers may not need the expected argument (e.g. IsNil).
+//
+// If the last value in args implements CommentInterface, it is used to log
+// additional information instead of being passed to the checker (see Commentf
+// for an example).
+func (c *C) Check(obtained interface{}, checker Checker, args ...interface{}) bool {
+	return c.internalCheck("Check", obtained, checker, args...)
+}
+
+// Assert ensures that the first value matches the expected value according
+// to the provided checker. If they do not match, an error is logged, the
+// test is marked as failed, and the test execution stops.
+//
+// Some checkers may not need the expected argument (e.g. IsNil).
+//
+// If the last value in args implements CommentInterface, it is used to log
+// additional information instead of being passed to the checker (see Commentf
+// for an example).
+func (c *C) Assert(obtained interface{}, checker Checker, args ...interface{}) {
+	if !c.internalCheck("Assert", obtained, checker, args...) {
+		c.stopNow()
+	}
+}
+
+func (c *C) internalCheck(funcName string, obtained interface{}, checker Checker, args ...interface{}) bool {
+	if checker == nil {
+		c.logCaller(2)
+		c.logString(fmt.Sprintf("%s(obtained, nil!?, ...):", funcName))
+		c.logString("Oops.. you've provided a nil checker!")
+		c.logNewLine()
+		c.Fail()
+		return false
+	}
+
+	// If the last argument is a bug info, extract it out.
+	var comment CommentInterface
+	if len(args) > 0 {
+		if c, ok := args[len(args)-1].(CommentInterface); ok {
+			comment = c
+			args = args[:len(args)-1]
+		}
+	}
+
+	params := append([]interface{}{obtained}, args...)
+	info := checker.Info()
+
+	if len(params) != len(info.Params) {
+		names := append([]string{info.Params[0], info.Name}, info.Params[1:]...)
+		c.logCaller(2)
+		c.logString(fmt.Sprintf("%s(%s):", funcName, strings.Join(names, ", ")))
+		c.logString(fmt.Sprintf("Wrong number of parameters for %s: want %d, got %d", info.Name, len(names), len(params)+1))
+		c.logNewLine()
+		c.Fail()
+		return false
+	}
+
+	// Copy since it may be mutated by Check.
+	names := append([]string{}, info.Params...)
+
+	// Do the actual check.
+	result, error := checker.Check(params, names)
+	if !result || error != "" {
+		c.logCaller(2)
+		for i := 0; i != len(params); i++ {
+			c.logValue(names[i], params[i])
+		}
+		if comment != nil {
+			c.logString(comment.CheckCommentString())
+		}
+		if error != "" {
+			c.logString(error)
+		}
+		c.logNewLine()
+		c.Fail()
+		return false
+	}
+	return true
+}
diff --git a/vendor/gopkg.in/check.v1/printer.go b/vendor/gopkg.in/check.v1/printer.go
new file mode 100644
index 0000000000..e0f7557b5c
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/printer.go
@@ -0,0 +1,168 @@
+package check
+
+import (
+	"bytes"
+	"go/ast"
+	"go/parser"
+	"go/printer"
+	"go/token"
+	"os"
+)
+
+func indent(s, with string) (r string) {
+	eol := true
+	for i := 0; i != len(s); i++ {
+		c := s[i]
+		switch {
+		case eol && c == '\n' || c == '\r':
+		case c == '\n' || c == '\r':
+			eol = true
+		case eol:
+			eol = false
+			s = s[:i] + with + s[i:]
+			i += len(with)
+		}
+	}
+	return s
+}
+
+func printLine(filename string, line int) (string, error) {
+	fset := token.NewFileSet()
+	file, err := os.Open(filename)
+	if err != nil {
+		return "", err
+	}
+	fnode, err := parser.ParseFile(fset, filename, file, parser.ParseComments)
+	if err != nil {
+		return "", err
+	}
+	config := &printer.Config{Mode: printer.UseSpaces, Tabwidth: 4}
+	lp := &linePrinter{fset: fset, fnode: fnode, line: line, config: config}
+	ast.Walk(lp, fnode)
+	result := lp.output.Bytes()
+	// Comments leave \n at the end.
+	n := len(result)
+	for n > 0 && result[n-1] == '\n' {
+		n--
+	}
+	return string(result[:n]), nil
+}
+
+type linePrinter struct {
+	config *printer.Config
+	fset   *token.FileSet
+	fnode  *ast.File
+	line   int
+	output bytes.Buffer
+	stmt   ast.Stmt
+}
+
+func (lp *linePrinter) emit() bool {
+	if lp.stmt != nil {
+		lp.trim(lp.stmt)
+		lp.printWithComments(lp.stmt)
+		lp.stmt = nil
+		return true
+	}
+	return false
+}
+
+func (lp *linePrinter) printWithComments(n ast.Node) {
+	nfirst := lp.fset.Position(n.Pos()).Line
+	nlast := lp.fset.Position(n.End()).Line
+	for _, g := range lp.fnode.Comments {
+		cfirst := lp.fset.Position(g.Pos()).Line
+		clast := lp.fset.Position(g.End()).Line
+		if clast == nfirst-1 && lp.fset.Position(n.Pos()).Column == lp.fset.Position(g.Pos()).Column {
+			for _, c := range g.List {
+				lp.output.WriteString(c.Text)
+				lp.output.WriteByte('\n')
+			}
+		}
+		if cfirst >= nfirst && cfirst <= nlast && n.End() <= g.List[0].Slash {
+			// The printer will not include the comment if it starts past
+			// the node itself. Trick it into printing by overlapping the
+			// slash with the end of the statement.
+			g.List[0].Slash = n.End() - 1
+		}
+	}
+	node := &printer.CommentedNode{n, lp.fnode.Comments}
+	lp.config.Fprint(&lp.output, lp.fset, node)
+}
+
+func (lp *linePrinter) Visit(n ast.Node) (w ast.Visitor) {
+	if n == nil {
+		if lp.output.Len() == 0 {
+			lp.emit()
+		}
+		return nil
+	}
+	first := lp.fset.Position(n.Pos()).Line
+	last := lp.fset.Position(n.End()).Line
+	if first <= lp.line && last >= lp.line {
+		// Print the innermost statement containing the line.
+		if stmt, ok := n.(ast.Stmt); ok {
+			if _, ok := n.(*ast.BlockStmt); !ok {
+				lp.stmt = stmt
+			}
+		}
+		if first == lp.line && lp.emit() {
+			return nil
+		}
+		return lp
+	}
+	return nil
+}
+
+func (lp *linePrinter) trim(n ast.Node) bool {
+	stmt, ok := n.(ast.Stmt)
+	if !ok {
+		return true
+	}
+	line := lp.fset.Position(n.Pos()).Line
+	if line != lp.line {
+		return false
+	}
+	switch stmt := stmt.(type) {
+	case *ast.IfStmt:
+		stmt.Body = lp.trimBlock(stmt.Body)
+	case *ast.SwitchStmt:
+		stmt.Body = lp.trimBlock(stmt.Body)
+	case *ast.TypeSwitchStmt:
+		stmt.Body = lp.trimBlock(stmt.Body)
+	case *ast.CaseClause:
+		stmt.Body = lp.trimList(stmt.Body)
+	case *ast.CommClause:
+		stmt.Body = lp.trimList(stmt.Body)
+	case *ast.BlockStmt:
+		stmt.List = lp.trimList(stmt.List)
+	}
+	return true
+}
+
+func (lp *linePrinter) trimBlock(stmt *ast.BlockStmt) *ast.BlockStmt {
+	if !lp.trim(stmt) {
+		return lp.emptyBlock(stmt)
+	}
+	stmt.Rbrace = stmt.Lbrace
+	return stmt
+}
+
+func (lp *linePrinter) trimList(stmts []ast.Stmt) []ast.Stmt {
+	for i := 0; i != len(stmts); i++ {
+		if !lp.trim(stmts[i]) {
+			stmts[i] = lp.emptyStmt(stmts[i])
+			break
+		}
+	}
+	return stmts
+}
+
+func (lp *linePrinter) emptyStmt(n ast.Node) *ast.ExprStmt {
+	return &ast.ExprStmt{&ast.Ellipsis{n.Pos(), nil}}
+}
+
+func (lp *linePrinter) emptyBlock(n ast.Node) *ast.BlockStmt {
+	p := n.Pos()
+	return &ast.BlockStmt{p, []ast.Stmt{lp.emptyStmt(n)}, p}
+}
diff --git a/vendor/gopkg.in/check.v1/reporter.go b/vendor/gopkg.in/check.v1/reporter.go
new file mode 100644
index 0000000000..fb04f76f64
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/reporter.go
@@ -0,0 +1,88 @@
+package check
+
+import (
+	"fmt"
+	"io"
+	"sync"
+)
+
+// -----------------------------------------------------------------------
+// Output writer manages atomic output writing according to settings.
+
+type outputWriter struct {
+	m                    sync.Mutex
+	writer               io.Writer
+	wroteCallProblemLast bool
+	Stream               bool
+	Verbose              bool
+}
+
+func newOutputWriter(writer io.Writer, stream, verbose bool) *outputWriter {
+	return &outputWriter{writer: writer, Stream: stream, Verbose: verbose}
+}
+
+func (ow *outputWriter) Write(content []byte) (n int, err error) {
+	ow.m.Lock()
+	n, err = ow.writer.Write(content)
+	ow.m.Unlock()
+	return
+}
+
+func (ow *outputWriter) WriteCallStarted(label string, c *C) {
+	if ow.Stream {
+		header := renderCallHeader(label, c, "", "\n")
+		ow.m.Lock()
+		ow.writer.Write([]byte(header))
+		ow.m.Unlock()
+	}
+}
+
+func (ow *outputWriter) WriteCallProblem(label string, c *C) {
+	var prefix string
+	if !ow.Stream {
+		prefix = "\n-----------------------------------" +
+			"-----------------------------------\n"
+	}
+	header := renderCallHeader(label, c, prefix, "\n\n")
+	ow.m.Lock()
+	ow.wroteCallProblemLast = true
+	ow.writer.Write([]byte(header))
+	if !ow.Stream {
+		c.logb.WriteTo(ow.writer)
+	}
+	ow.m.Unlock()
+}
+
+func (ow *outputWriter) WriteCallSuccess(label string, c *C) {
+	if ow.Stream || (ow.Verbose && c.kind == testKd) {
+		// TODO Use a buffer here.
+		var suffix string
+		if c.reason != "" {
+			suffix = " (" + c.reason + ")"
+		}
+		if c.status() == succeededSt {
+			suffix += "\t" + c.timerString()
+		}
+		suffix += "\n"
+		if ow.Stream {
+			suffix += "\n"
+		}
+		header := renderCallHeader(label, c, "", suffix)
+		ow.m.Lock()
+		// Resist temptation of using line as prefix above due to race.
+		if !ow.Stream && ow.wroteCallProblemLast {
+			header = "\n-----------------------------------" +
+				"-----------------------------------\n" +
+				header
+		}
+		ow.wroteCallProblemLast = false
+		ow.writer.Write([]byte(header))
+		ow.m.Unlock()
+	}
+}
+
+func renderCallHeader(label string, c *C, prefix, suffix string) string {
+	pc := c.method.PC()
+	return fmt.Sprintf("%s%s: %s: %s%s", prefix, label, niceFuncPath(pc),
+		niceFuncName(pc), suffix)
+}
diff --git a/vendor/gopkg.in/check.v1/run.go b/vendor/gopkg.in/check.v1/run.go
new file mode 100644
index 0000000000..da8fd79872
--- /dev/null
+++ b/vendor/gopkg.in/check.v1/run.go
@@ -0,0 +1,175 @@
+package check
+
+import (
+	"bufio"
+	"flag"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+)
+
+// -----------------------------------------------------------------------
+// Test suite registry.
+
+var allSuites []interface{}
+
+// Suite registers the given value as a test suite to be run. Any methods
+// starting with the Test prefix in the given value will be considered as
+// a test method.
+func Suite(suite interface{}) interface{} {
+	allSuites = append(allSuites, suite)
+	return suite
+}
+
+// -----------------------------------------------------------------------
+// Public running interface.
+
+var (
+	oldFilterFlag  = flag.String("gocheck.f", "", "Regular expression selecting which tests and/or suites to run")
+	oldVerboseFlag = flag.Bool("gocheck.v", false, "Verbose mode")
+	oldStreamFlag  = flag.Bool("gocheck.vv", false, "Super verbose mode (disables output caching)")
+	oldBenchFlag   = flag.Bool("gocheck.b", false, "Run benchmarks")
+	oldBenchTime   = flag.Duration("gocheck.btime", 1*time.Second, "approximate run time for each benchmark")
+	oldListFlag    = flag.Bool("gocheck.list", false, "List the names of all tests that will be run")
+	oldWorkFlag    = flag.Bool("gocheck.work", false, "Display and do not remove the test working directory")
+
+	newFilterFlag  = flag.String("check.f", "", "Regular expression selecting which tests and/or suites to run")
+	newVerboseFlag = flag.Bool("check.v", false, "Verbose mode")
+	newStreamFlag  = flag.Bool("check.vv", false, "Super verbose mode (disables output caching)")
+	newBenchFlag   = flag.Bool("check.b", false, "Run benchmarks")
+	newBenchTime   = flag.Duration("check.btime", 1*time.Second, "approximate run time for each benchmark")
+	newBenchMem    = flag.Bool("check.bmem", false, "Report memory benchmarks")
+	newListFlag    = flag.Bool("check.list", false, "List the names of all tests that will be run")
+	newWorkFlag    = flag.Bool("check.work", false, "Display and do not remove the test working directory")
+)
+
+// TestingT runs all test suites registered with the Suite function,
+// printing results to stdout, and reporting any failures back to
+// the "testing" package.
+func TestingT(testingT *testing.T) {
+	benchTime := *newBenchTime
+	if benchTime == 1*time.Second {
+		benchTime = *oldBenchTime
+	}
+	conf := &RunConf{
+		Filter:        *oldFilterFlag + *newFilterFlag,
+		Verbose:       *oldVerboseFlag || *newVerboseFlag,
+		Stream:        *oldStreamFlag || *newStreamFlag,
+		Benchmark:     *oldBenchFlag || *newBenchFlag,
+		BenchmarkTime: benchTime,
+		BenchmarkMem:  *newBenchMem,
+		KeepWorkDir:   *oldWorkFlag || *newWorkFlag,
+	}
+	if *oldListFlag || *newListFlag {
+		w := bufio.NewWriter(os.Stdout)
+		for _, name := range ListAll(conf) {
+			fmt.Fprintln(w, name)
+		}
+		w.Flush()
+		return
+	}
+	result := RunAll(conf)
+	println(result.String())
+	if !result.Passed() {
+		testingT.Fail()
+	}
+}
+
+// RunAll runs all test suites registered with the Suite function, using the
+// provided run configuration.
+func RunAll(runConf *RunConf) *Result {
+	result := Result{}
+	for _, suite := range allSuites {
+		result.Add(Run(suite, runConf))
+	}
+	return &result
+}
+
+// Run runs the provided test suite using the provided run configuration.
+func Run(suite interface{}, runConf *RunConf) *Result {
+	runner := newSuiteRunner(suite, runConf)
+	return runner.run()
+}
+
+// ListAll returns the names of all the test functions registered with the
+// Suite function that will be run with the provided run configuration.
+func ListAll(runConf *RunConf) []string {
+	var names []string
+	for _, suite := range allSuites {
+		names = append(names, List(suite, runConf)...)
+	}
+	return names
+}
+
+// List returns the names of the test functions in the given
+// suite that will be run with the provided run configuration.
+func List(suite interface{}, runConf *RunConf) []string {
+	var names []string
+	runner := newSuiteRunner(suite, runConf)
+	for _, t := range runner.tests {
+		names = append(names, t.String())
+	}
+	return names
+}
+
+// -----------------------------------------------------------------------
+// Result methods.
+
+func (r *Result) Add(other *Result) {
+	r.Succeeded += other.Succeeded
+	r.Skipped += other.Skipped
+	r.Failed += other.Failed
+	r.Panicked += other.Panicked
+	r.FixturePanicked += other.FixturePanicked
+	r.ExpectedFailures += other.ExpectedFailures
+	r.Missed += other.Missed
+	if r.WorkDir != "" && other.WorkDir != "" {
+		r.WorkDir += ":" + other.WorkDir
+	} else if other.WorkDir != "" {
+		r.WorkDir = other.WorkDir
+	}
+}
+
+func (r *Result) Passed() bool {
+	return (r.Failed == 0 && r.Panicked == 0 &&
+		r.FixturePanicked == 0 && r.Missed == 0 &&
+		r.RunError == nil)
+}
+
+func (r *Result) String() string {
+	if r.RunError != nil {
+		return "ERROR: " + r.RunError.Error()
+	}
+
+	var value string
+	if r.Failed == 0 && r.Panicked == 0 && r.FixturePanicked == 0 &&
+		r.Missed == 0 {
+		value = "OK: "
+	} else {
+		value = "OOPS: "
+	}
+	value += fmt.Sprintf("%d passed", r.Succeeded)
+	if r.Skipped != 0 {
+		value += fmt.Sprintf(", %d skipped", r.Skipped)
+	}
+	if r.ExpectedFailures != 0 {
+		value += fmt.Sprintf(", %d expected failures", r.ExpectedFailures)
+	}
+	if r.Failed != 0 {
+		value += fmt.Sprintf(", %d FAILED", r.Failed)
+	}
+	if r.Panicked != 0 {
+		value += fmt.Sprintf(", %d PANICKED", r.Panicked)
+	}
+	if r.FixturePanicked != 0 {
+		value += fmt.Sprintf(", %d FIXTURE-PANICKED", r.FixturePanicked)
+	}
+	if r.Missed != 0 {
+		value += fmt.Sprintf(", %d MISSED", r.Missed)
+	}
+	if r.WorkDir != "" {
+		value += "\nWORK=" + r.WorkDir
+	}
+	return value
+}
diff --git a/vendor/gopkg.in/yaml.v2/go.mod b/vendor/gopkg.in/yaml.v2/go.mod
deleted file mode 100644
index 2cbb85aeac..0000000000
--- a/vendor/gopkg.in/yaml.v2/go.mod
+++ /dev/null
@@ -1,5 +0,0 @@
-module gopkg.in/yaml.v2
-
-go 1.15
-
-require gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
diff --git a/vendor/gopkg.in/yaml.v3/decode.go b/vendor/gopkg.in/yaml.v3/decode.go
index df36e3a30f..0173b6982e 100644
--- a/vendor/gopkg.in/yaml.v3/decode.go
+++ b/vendor/gopkg.in/yaml.v3/decode.go
@@ -100,7 +100,10 @@ func (p *parser) peek() yaml_event_type_t {
 	if p.event.typ != yaml_NO_EVENT {
 		return p.event.typ
 	}
-	if !yaml_parser_parse(&p.parser, &p.event) {
+	// It's curious choice from the underlying API to generally return a
+	// positive result on success, but on this case return true in an error
+	// scenario. This was the source of bugs in the past (issue #666).
+	if !yaml_parser_parse(&p.parser, &p.event) || p.parser.error != yaml_NO_ERROR {
 		p.fail()
 	}
 	return p.event.typ
@@ -320,6 +323,8 @@ type decoder struct {
 	decodeCount int
 	aliasCount  int
 	aliasDepth  int
+
+	mergedFields map[interface{}]bool
 }
 
 var (
@@ -808,6 +813,11 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 		}
 	}
 
+	mergedFields := d.mergedFields
+	d.mergedFields = nil
+
+	var mergeNode *Node
+
 	mapIsNew := false
 	if out.IsNil() {
 		out.Set(reflect.MakeMap(outt))
@@ -815,11 +825,18 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 	}
 	for i := 0; i < l; i += 2 {
 		if isMerge(n.Content[i]) {
-			d.merge(n.Content[i+1], out)
+			mergeNode = n.Content[i+1]
 			continue
 		}
 		k := reflect.New(kt).Elem()
 		if d.unmarshal(n.Content[i], k) {
+			if mergedFields != nil {
+				ki := k.Interface()
+				if mergedFields[ki] {
+					continue
+				}
+				mergedFields[ki] = true
+			}
 			kkind := k.Kind()
 			if kkind == reflect.Interface {
 				kkind = k.Elem().Kind()
@@ -833,6 +850,12 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 			}
 		}
 	}
+
+	d.mergedFields = mergedFields
+	if mergeNode != nil {
+		d.merge(n, mergeNode, out)
+	}
+
 	d.stringMapType = stringMapType
 	d.generalMapType = generalMapType
 	return true
@@ -844,7 +867,8 @@ func isStringMap(n *Node) bool {
 	}
 	l := len(n.Content)
 	for i := 0; i < l; i += 2 {
-		if n.Content[i].ShortTag() != strTag {
+		shortTag := n.Content[i].ShortTag()
+		if shortTag != strTag && shortTag != mergeTag {
 			return false
 		}
 	}
@@ -861,7 +885,6 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 	var elemType reflect.Type
 	if sinfo.InlineMap != -1 {
 		inlineMap = out.Field(sinfo.InlineMap)
-		inlineMap.Set(reflect.New(inlineMap.Type()).Elem())
 		elemType = inlineMap.Type().Elem()
 	}
 
@@ -870,6 +893,9 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 		d.prepare(n, field)
 	}
 
+	mergedFields := d.mergedFields
+	d.mergedFields = nil
+	var mergeNode *Node
 	var doneFields []bool
 	if d.uniqueKeys {
 		doneFields = make([]bool, len(sinfo.FieldsList))
@@ -879,13 +905,20 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 	for i := 0; i < l; i += 2 {
 		ni := n.Content[i]
 		if isMerge(ni) {
-			d.merge(n.Content[i+1], out)
+			mergeNode = n.Content[i+1]
 			continue
 		}
 		if !d.unmarshal(ni, name) {
 			continue
 		}
-		if info, ok := sinfo.FieldsMap[name.String()]; ok {
+		sname := name.String()
+		if mergedFields != nil {
+			if mergedFields[sname] {
+				continue
+			}
+			mergedFields[sname] = true
+		}
+		if info, ok := sinfo.FieldsMap[sname]; ok {
 			if d.uniqueKeys {
 				if doneFields[info.Id] {
 					d.terrors = append(d.terrors, fmt.Sprintf("line %d: field %s already set in type %s", ni.Line, name.String(), out.Type()))
@@ -911,6 +944,11 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 			d.terrors = append(d.terrors, fmt.Sprintf("line %d: field %s not found in type %s", ni.Line, name.String(), out.Type()))
 		}
 	}
+
+	d.mergedFields = mergedFields
+	if mergeNode != nil {
+		d.merge(n, mergeNode, out)
+	}
 	return true
 }
 
@@ -918,19 +956,29 @@ func failWantMap() {
 	failf("map merge requires map or sequence of maps as the value")
 }
 
-func (d *decoder) merge(n *Node, out reflect.Value) {
-	switch n.Kind {
+func (d *decoder) merge(parent *Node, merge *Node, out reflect.Value) {
+	mergedFields := d.mergedFields
+	if mergedFields == nil {
+		d.mergedFields = make(map[interface{}]bool)
+		for i := 0; i < len(parent.Content); i += 2 {
+			k := reflect.New(ifaceType).Elem()
+			if d.unmarshal(parent.Content[i], k) {
+				d.mergedFields[k.Interface()] = true
+			}
+		}
+	}
+
+	switch merge.Kind {
 	case MappingNode:
-		d.unmarshal(n, out)
+		d.unmarshal(merge, out)
 	case AliasNode:
-		if n.Alias != nil && n.Alias.Kind != MappingNode {
+		if merge.Alias != nil && merge.Alias.Kind != MappingNode {
 			failWantMap()
 		}
-		d.unmarshal(n, out)
+		d.unmarshal(merge, out)
 	case SequenceNode:
-		// Step backwards as earlier nodes take precedence.
-		for i := len(n.Content) - 1; i >= 0; i-- {
-			ni := n.Content[i]
+		for i := 0; i < len(merge.Content); i++ {
+			ni := merge.Content[i]
 			if ni.Kind == AliasNode {
 				if ni.Alias != nil && ni.Alias.Kind != MappingNode {
 					failWantMap()
@@ -943,6 +991,8 @@ func (d *decoder) merge(n *Node, out reflect.Value) {
 	default:
 		failWantMap()
 	}
+
+	d.mergedFields = mergedFields
 }
 
 func isMerge(n *Node) bool {
diff --git a/vendor/gopkg.in/yaml.v3/go.mod b/vendor/gopkg.in/yaml.v3/go.mod
deleted file mode 100644
index f407ea3213..0000000000
--- a/vendor/gopkg.in/yaml.v3/go.mod
+++ /dev/null
@@ -1,5 +0,0 @@
-module "gopkg.in/yaml.v3"
-
-require (
-	"gopkg.in/check.v1" v0.0.0-20161208181325-20d25e280405
-)
diff --git a/vendor/gopkg.in/yaml.v3/parserc.go b/vendor/gopkg.in/yaml.v3/parserc.go
index ac66fccc05..268558a0d6 100644
--- a/vendor/gopkg.in/yaml.v3/parserc.go
+++ b/vendor/gopkg.in/yaml.v3/parserc.go
@@ -687,6 +687,9 @@ func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, i
 func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
+		if token == nil {
+			return false
+		}
 		parser.marks = append(parser.marks, token.start_mark)
 		skip_token(parser)
 	}
@@ -786,7 +789,7 @@ func yaml_parser_split_stem_comment(parser *yaml_parser_t, stem_len int) {
 	}
 
 	token := peek_token(parser)
-	if token.typ != yaml_BLOCK_SEQUENCE_START_TOKEN && token.typ != yaml_BLOCK_MAPPING_START_TOKEN {
+	if token == nil || token.typ != yaml_BLOCK_SEQUENCE_START_TOKEN && token.typ != yaml_BLOCK_MAPPING_START_TOKEN {
 		return
 	}
 
@@ -813,6 +816,9 @@ func yaml_parser_split_stem_comment(parser *yaml_parser_t, stem_len int) {
 func yaml_parser_parse_block_mapping_key(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
+		if token == nil {
+			return false
+		}
 		parser.marks = append(parser.marks, token.start_mark)
 		skip_token(parser)
 	}
@@ -922,6 +928,9 @@ func yaml_parser_parse_block_mapping_value(parser *yaml_parser_t, event *yaml_ev
 func yaml_parser_parse_flow_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
+		if token == nil {
+			return false
+		}
 		parser.marks = append(parser.marks, token.start_mark)
 		skip_token(parser)
 	}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index a2ca5d8749..c5bee26d87 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,29 +1,59 @@
 # github.com/OneOfOne/xxhash v1.2.8
-## explicit
+## explicit; go 1.11
 github.com/OneOfOne/xxhash
+# github.com/agnivade/levenshtein v1.1.1
+## explicit; go 1.13
+github.com/agnivade/levenshtein
+# github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883
+## explicit
+github.com/andreyvit/diff
 # github.com/beorn7/perks v1.0.1
+## explicit; go 1.11
 github.com/beorn7/perks/quantile
-# github.com/bytecodealliance/wasmtime-go v0.31.0
-## explicit
-github.com/bytecodealliance/wasmtime-go
-github.com/bytecodealliance/wasmtime-go/build/include
-github.com/bytecodealliance/wasmtime-go/build/include/wasmtime
-github.com/bytecodealliance/wasmtime-go/build/linux-aarch64
-github.com/bytecodealliance/wasmtime-go/build/linux-x86_64
-github.com/bytecodealliance/wasmtime-go/build/macos-aarch64
-github.com/bytecodealliance/wasmtime-go/build/macos-x86_64
-github.com/bytecodealliance/wasmtime-go/build/windows-x86_64
+# github.com/bytecodealliance/wasmtime-go/v3 v3.0.2
+## explicit; go 1.18
+github.com/bytecodealliance/wasmtime-go/v3
+github.com/bytecodealliance/wasmtime-go/v3/build/include
+github.com/bytecodealliance/wasmtime-go/v3/build/include/wasmtime
+github.com/bytecodealliance/wasmtime-go/v3/build/linux-aarch64
+github.com/bytecodealliance/wasmtime-go/v3/build/linux-x86_64
+github.com/bytecodealliance/wasmtime-go/v3/build/macos-aarch64
+github.com/bytecodealliance/wasmtime-go/v3/build/macos-x86_64
+github.com/bytecodealliance/wasmtime-go/v3/build/windows-x86_64
+# github.com/cenkalti/backoff/v4 v4.2.0
+## explicit; go 1.18
+github.com/cenkalti/backoff/v4
 # github.com/cespare/xxhash v1.1.0
-github.com/cespare/xxhash
-# github.com/cespare/xxhash/v2 v2.1.2
 ## explicit
+github.com/cespare/xxhash
+# github.com/cespare/xxhash/v2 v2.2.0
+## explicit; go 1.11
 github.com/cespare/xxhash/v2
-# github.com/cpuguy83/go-md2man/v2 v2.0.0
+# github.com/containerd/containerd v1.6.19
+## explicit; go 1.17
+github.com/containerd/containerd/archive/compression
+github.com/containerd/containerd/content
+github.com/containerd/containerd/errdefs
+github.com/containerd/containerd/filters
+github.com/containerd/containerd/images
+github.com/containerd/containerd/labels
+github.com/containerd/containerd/log
+github.com/containerd/containerd/platforms
+github.com/containerd/containerd/reference
+github.com/containerd/containerd/remotes
+github.com/containerd/containerd/remotes/docker
+github.com/containerd/containerd/remotes/docker/auth
+github.com/containerd/containerd/remotes/docker/schema1
+github.com/containerd/containerd/remotes/errors
+github.com/containerd/containerd/version
+# github.com/cpuguy83/go-md2man/v2 v2.0.2
+## explicit; go 1.11
 github.com/cpuguy83/go-md2man/v2/md2man
 # github.com/davecgh/go-spew v1.1.1
-github.com/davecgh/go-spew/spew
-# github.com/dgraph-io/badger/v3 v3.2103.2
 ## explicit
+github.com/davecgh/go-spew/spew
+# github.com/dgraph-io/badger/v3 v3.2103.5
+## explicit; go 1.12
 github.com/dgraph-io/badger/v3
 github.com/dgraph-io/badger/v3/fb
 github.com/dgraph-io/badger/v3/options
@@ -32,29 +62,41 @@ github.com/dgraph-io/badger/v3/skl
 github.com/dgraph-io/badger/v3/table
 github.com/dgraph-io/badger/v3/trie
 github.com/dgraph-io/badger/v3/y
-# github.com/dgraph-io/ristretto v0.1.0
+# github.com/dgraph-io/ristretto v0.1.1
+## explicit; go 1.12
 github.com/dgraph-io/ristretto
 github.com/dgraph-io/ristretto/z
 github.com/dgraph-io/ristretto/z/simd
 # github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13
 ## explicit
 # github.com/dustin/go-humanize v1.0.0
+## explicit
 github.com/dustin/go-humanize
+# github.com/felixge/httpsnoop v1.0.3
+## explicit; go 1.13
+github.com/felixge/httpsnoop
 # github.com/fortytw2/leaktest v1.3.0
 ## explicit
 github.com/fortytw2/leaktest
-# github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897
-## explicit
+# github.com/foxcpp/go-mockdns v1.0.0
+## explicit; go 1.13
 github.com/foxcpp/go-mockdns
-# github.com/fsnotify/fsnotify v1.5.1
-## explicit
+# github.com/fsnotify/fsnotify v1.6.0
+## explicit; go 1.16
 github.com/fsnotify/fsnotify
 # github.com/ghodss/yaml v1.0.0
 ## explicit
 github.com/ghodss/yaml
-# github.com/go-ini/ini v1.66.2
+# github.com/go-ini/ini v1.67.0
 ## explicit
 github.com/go-ini/ini
+# github.com/go-logr/logr v1.2.4
+## explicit; go 1.16
+github.com/go-logr/logr
+github.com/go-logr/logr/funcr
+# github.com/go-logr/stdr v1.2.2
+## explicit; go 1.16
+github.com/go-logr/stdr
 # github.com/gobwas/glob v0.2.3
 ## explicit
 github.com/gobwas/glob
@@ -66,13 +108,17 @@ github.com/gobwas/glob/syntax/lexer
 github.com/gobwas/glob/util/runes
 github.com/gobwas/glob/util/strings
 # github.com/gogo/protobuf v1.3.2
+## explicit; go 1.15
 github.com/gogo/protobuf/proto
-# github.com/golang/glog v1.0.0
-## explicit
+# github.com/golang/glog v1.1.0 => ./build/replacements/github.com/golang/glog
+## explicit; go 1.18
 github.com/golang/glog
-# github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e
+# github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
+## explicit
 github.com/golang/groupcache/lru
-# github.com/golang/protobuf v1.5.2
+# github.com/golang/protobuf v1.5.3
+## explicit; go 1.9
+github.com/golang/protobuf/jsonpb
 github.com/golang/protobuf/proto
 github.com/golang/protobuf/ptypes
 github.com/golang/protobuf/ptypes/any
@@ -82,103 +128,191 @@ github.com/golang/protobuf/ptypes/timestamp
 ## explicit
 github.com/golang/snappy
 # github.com/google/flatbuffers v1.12.1
+## explicit
 github.com/google/flatbuffers/go
 # github.com/gorilla/mux v1.8.0
-## explicit
+## explicit; go 1.12
 github.com/gorilla/mux
-# github.com/inconshreveable/mousetrap v1.0.0
+# github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0
+## explicit; go 1.14
+github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule
+github.com/grpc-ecosystem/grpc-gateway/v2/runtime
+github.com/grpc-ecosystem/grpc-gateway/v2/utilities
+# github.com/inconshreveable/mousetrap v1.1.0
+## explicit; go 1.18
 github.com/inconshreveable/mousetrap
-# github.com/klauspost/compress v1.13.5
-## explicit
+# github.com/klauspost/compress v1.13.6
+## explicit; go 1.15
 github.com/klauspost/compress
 github.com/klauspost/compress/fse
 github.com/klauspost/compress/huff0
 github.com/klauspost/compress/internal/snapref
 github.com/klauspost/compress/zstd
 github.com/klauspost/compress/zstd/internal/xxhash
+# github.com/kr/pretty v0.3.1
+## explicit; go 1.12
+github.com/kr/pretty
 # github.com/kr/text v0.2.0
 ## explicit
+github.com/kr/text
 # github.com/mattn/go-runewidth v0.0.9
+## explicit; go 1.9
 github.com/mattn/go-runewidth
-# github.com/matttproud/golang_protobuf_extensions v1.0.1
+# github.com/matttproud/golang_protobuf_extensions v1.0.4
+## explicit; go 1.9
 github.com/matttproud/golang_protobuf_extensions/pbutil
 # github.com/miekg/dns v1.1.43
-## explicit
+## explicit; go 1.14
 github.com/miekg/dns
-# github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e
-## explicit
+# github.com/moby/locker v1.0.1
+## explicit; go 1.13
+github.com/moby/locker
 # github.com/olekukonko/tablewriter v0.0.5
-## explicit
+## explicit; go 1.12
 github.com/olekukonko/tablewriter
-# github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d
+# github.com/opencontainers/go-digest v1.0.0
+## explicit; go 1.13
+github.com/opencontainers/go-digest
+# github.com/opencontainers/image-spec v1.1.0-rc2
+## explicit; go 1.17
+github.com/opencontainers/image-spec/specs-go
+github.com/opencontainers/image-spec/specs-go/v1
+# github.com/peterh/liner v1.2.2
 ## explicit
 github.com/peterh/liner
 # github.com/pkg/errors v0.9.1
 ## explicit
 github.com/pkg/errors
-# github.com/pmezard/go-difflib v1.0.0
-github.com/pmezard/go-difflib/difflib
-# github.com/prometheus/client_golang v1.11.0
-## explicit
+# github.com/prometheus/client_golang v1.15.1
+## explicit; go 1.17
 github.com/prometheus/client_golang/prometheus
 github.com/prometheus/client_golang/prometheus/collectors
 github.com/prometheus/client_golang/prometheus/internal
 github.com/prometheus/client_golang/prometheus/promhttp
-# github.com/prometheus/client_model v0.2.0
+github.com/prometheus/client_golang/prometheus/testutil
+github.com/prometheus/client_golang/prometheus/testutil/promlint
+# github.com/prometheus/client_model v0.3.0
+## explicit; go 1.9
 github.com/prometheus/client_model/go
-# github.com/prometheus/common v0.29.0
-## explicit
+# github.com/prometheus/common v0.42.0
+## explicit; go 1.18
 github.com/prometheus/common/expfmt
 github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg
 github.com/prometheus/common/model
-# github.com/prometheus/procfs v0.6.0
+# github.com/prometheus/procfs v0.9.0
+## explicit; go 1.18
 github.com/prometheus/procfs
 github.com/prometheus/procfs/internal/fs
 github.com/prometheus/procfs/internal/util
 # github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
 ## explicit
 github.com/rcrowley/go-metrics
-# github.com/russross/blackfriday/v2 v2.0.1
-github.com/russross/blackfriday/v2
-# github.com/shurcooL/sanitized_anchor_name v1.0.0
-github.com/shurcooL/sanitized_anchor_name
-# github.com/sirupsen/logrus v1.8.1
+# github.com/rogpeppe/go-internal v1.9.0
+## explicit; go 1.17
+github.com/rogpeppe/go-internal/fmtsort
+# github.com/russross/blackfriday/v2 v2.1.0
 ## explicit
+github.com/russross/blackfriday/v2
+# github.com/sergi/go-diff v1.1.0
+## explicit; go 1.12
+github.com/sergi/go-diff/diffmatchpatch
+# github.com/sirupsen/logrus v1.9.0
+## explicit; go 1.13
 github.com/sirupsen/logrus
-# github.com/spf13/cobra v1.2.1
-## explicit
+# github.com/spf13/cobra v1.7.0
+## explicit; go 1.15
 github.com/spf13/cobra
 github.com/spf13/cobra/doc
 # github.com/spf13/pflag v1.0.5
-## explicit
+## explicit; go 1.12
 github.com/spf13/pflag
-# github.com/stretchr/testify v1.7.0
-## explicit
-github.com/stretchr/testify/assert
-github.com/stretchr/testify/require
+# github.com/tchap/go-patricia/v2 v2.3.1
+## explicit; go 1.16
+github.com/tchap/go-patricia/v2/patricia
 # github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb
 ## explicit
 github.com/xeipuuv/gojsonpointer
 # github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
 ## explicit
 github.com/xeipuuv/gojsonreference
-# github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b
-## explicit
+# github.com/yashtewari/glob-intersection v0.1.0
+## explicit; go 1.17
 github.com/yashtewari/glob-intersection
 # go.opencensus.io v0.23.0
+## explicit; go 1.13
 go.opencensus.io
 go.opencensus.io/internal
 go.opencensus.io/trace
 go.opencensus.io/trace/internal
 go.opencensus.io/trace/tracestate
-# go.uber.org/automaxprocs v1.4.0
-## explicit
+# go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.37.0
+## explicit; go 1.18
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
+# go.opentelemetry.io/otel v1.14.0
+## explicit; go 1.18
+go.opentelemetry.io/otel
+go.opentelemetry.io/otel/attribute
+go.opentelemetry.io/otel/baggage
+go.opentelemetry.io/otel/codes
+go.opentelemetry.io/otel/exporters/otlp/internal
+go.opentelemetry.io/otel/exporters/otlp/internal/envconfig
+go.opentelemetry.io/otel/internal
+go.opentelemetry.io/otel/internal/attribute
+go.opentelemetry.io/otel/internal/baggage
+go.opentelemetry.io/otel/internal/global
+go.opentelemetry.io/otel/propagation
+go.opentelemetry.io/otel/semconv/internal
+go.opentelemetry.io/otel/semconv/v1.12.0
+go.opentelemetry.io/otel/semconv/v1.17.0
+go.opentelemetry.io/otel/semconv/v1.7.0
+# go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.14.0
+## explicit; go 1.18
+go.opentelemetry.io/otel/exporters/otlp/internal/retry
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.14.0
+## explicit; go 1.18
+go.opentelemetry.io/otel/exporters/otlp/otlptrace
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/otlpconfig
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform
+# go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0
+## explicit; go 1.18
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
+# go.opentelemetry.io/otel/metric v0.34.0
+## explicit; go 1.18
+go.opentelemetry.io/otel/metric
+go.opentelemetry.io/otel/metric/global
+go.opentelemetry.io/otel/metric/instrument
+go.opentelemetry.io/otel/metric/instrument/asyncfloat64
+go.opentelemetry.io/otel/metric/instrument/asyncint64
+go.opentelemetry.io/otel/metric/instrument/syncfloat64
+go.opentelemetry.io/otel/metric/instrument/syncint64
+go.opentelemetry.io/otel/metric/internal/global
+go.opentelemetry.io/otel/metric/unit
+# go.opentelemetry.io/otel/sdk v1.14.0
+## explicit; go 1.18
+go.opentelemetry.io/otel/sdk/instrumentation
+go.opentelemetry.io/otel/sdk/internal
+go.opentelemetry.io/otel/sdk/internal/env
+go.opentelemetry.io/otel/sdk/resource
+go.opentelemetry.io/otel/sdk/trace
+go.opentelemetry.io/otel/sdk/trace/tracetest
+# go.opentelemetry.io/otel/trace v1.14.0
+## explicit; go 1.18
+go.opentelemetry.io/otel/trace
+# go.opentelemetry.io/proto/otlp v0.19.0
+## explicit; go 1.14
+go.opentelemetry.io/proto/otlp/collector/trace/v1
+go.opentelemetry.io/proto/otlp/common/v1
+go.opentelemetry.io/proto/otlp/resource/v1
+go.opentelemetry.io/proto/otlp/trace/v1
+# go.uber.org/automaxprocs v1.5.2
+## explicit; go 1.18
 go.uber.org/automaxprocs/internal/cgroups
 go.uber.org/automaxprocs/internal/runtime
 go.uber.org/automaxprocs/maxprocs
-# golang.org/x/net v0.0.0-20211111083644-e5c967477495
-## explicit
+# golang.org/x/net v0.10.0
+## explicit; go 1.17
 golang.org/x/net/bpf
+golang.org/x/net/context/ctxhttp
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
 golang.org/x/net/http2/h2c
@@ -190,27 +324,93 @@ golang.org/x/net/internal/timeseries
 golang.org/x/net/ipv4
 golang.org/x/net/ipv6
 golang.org/x/net/trace
-# golang.org/x/sys v0.0.0-20211110154304-99a53858aa08
+# golang.org/x/sync v0.1.0
 ## explicit
+golang.org/x/sync/errgroup
+golang.org/x/sync/semaphore
+# golang.org/x/sys v0.8.0
+## explicit; go 1.17
+golang.org/x/sys/execabs
 golang.org/x/sys/internal/unsafeheader
 golang.org/x/sys/unix
 golang.org/x/sys/windows
-# golang.org/x/text v0.3.6
+golang.org/x/sys/windows/registry
+# golang.org/x/text v0.9.0
+## explicit; go 1.17
 golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
 golang.org/x/text/unicode/bidi
 golang.org/x/text/unicode/norm
-# golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba
+# golang.org/x/time v0.3.0
 ## explicit
 golang.org/x/time/rate
-# google.golang.org/protobuf v1.27.1
-## explicit
+# google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4
+## explicit; go 1.19
+google.golang.org/genproto/googleapis/api/httpbody
+google.golang.org/genproto/googleapis/rpc/errdetails
+google.golang.org/genproto/googleapis/rpc/status
+google.golang.org/genproto/protobuf/field_mask
+# google.golang.org/grpc v1.55.0
+## explicit; go 1.17
+google.golang.org/grpc
+google.golang.org/grpc/attributes
+google.golang.org/grpc/backoff
+google.golang.org/grpc/balancer
+google.golang.org/grpc/balancer/base
+google.golang.org/grpc/balancer/grpclb/state
+google.golang.org/grpc/balancer/roundrobin
+google.golang.org/grpc/binarylog/grpc_binarylog_v1
+google.golang.org/grpc/channelz
+google.golang.org/grpc/codes
+google.golang.org/grpc/connectivity
+google.golang.org/grpc/credentials
+google.golang.org/grpc/credentials/insecure
+google.golang.org/grpc/encoding
+google.golang.org/grpc/encoding/gzip
+google.golang.org/grpc/encoding/proto
+google.golang.org/grpc/grpclog
+google.golang.org/grpc/internal
+google.golang.org/grpc/internal/backoff
+google.golang.org/grpc/internal/balancer/gracefulswitch
+google.golang.org/grpc/internal/balancerload
+google.golang.org/grpc/internal/binarylog
+google.golang.org/grpc/internal/buffer
+google.golang.org/grpc/internal/channelz
+google.golang.org/grpc/internal/credentials
+google.golang.org/grpc/internal/envconfig
+google.golang.org/grpc/internal/grpclog
+google.golang.org/grpc/internal/grpcrand
+google.golang.org/grpc/internal/grpcsync
+google.golang.org/grpc/internal/grpcutil
+google.golang.org/grpc/internal/metadata
+google.golang.org/grpc/internal/pretty
+google.golang.org/grpc/internal/resolver
+google.golang.org/grpc/internal/resolver/dns
+google.golang.org/grpc/internal/resolver/passthrough
+google.golang.org/grpc/internal/resolver/unix
+google.golang.org/grpc/internal/serviceconfig
+google.golang.org/grpc/internal/status
+google.golang.org/grpc/internal/syscall
+google.golang.org/grpc/internal/transport
+google.golang.org/grpc/internal/transport/networktype
+google.golang.org/grpc/keepalive
+google.golang.org/grpc/metadata
+google.golang.org/grpc/peer
+google.golang.org/grpc/resolver
+google.golang.org/grpc/serviceconfig
+google.golang.org/grpc/stats
+google.golang.org/grpc/status
+google.golang.org/grpc/tap
+# google.golang.org/protobuf v1.30.0
+## explicit; go 1.11
+google.golang.org/protobuf/encoding/protojson
 google.golang.org/protobuf/encoding/prototext
 google.golang.org/protobuf/encoding/protowire
 google.golang.org/protobuf/internal/descfmt
 google.golang.org/protobuf/internal/descopts
 google.golang.org/protobuf/internal/detrand
 google.golang.org/protobuf/internal/encoding/defval
+google.golang.org/protobuf/internal/encoding/json
 google.golang.org/protobuf/internal/encoding/messageset
 google.golang.org/protobuf/internal/encoding/tag
 google.golang.org/protobuf/internal/encoding/text
@@ -234,11 +434,42 @@ google.golang.org/protobuf/runtime/protoimpl
 google.golang.org/protobuf/types/descriptorpb
 google.golang.org/protobuf/types/known/anypb
 google.golang.org/protobuf/types/known/durationpb
+google.golang.org/protobuf/types/known/fieldmaskpb
 google.golang.org/protobuf/types/known/timestamppb
-# gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f
-## explicit
+google.golang.org/protobuf/types/known/wrapperspb
+# gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
+## explicit; go 1.11
+gopkg.in/check.v1
 # gopkg.in/yaml.v2 v2.4.0
-## explicit
+## explicit; go 1.15
 gopkg.in/yaml.v2
-# gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
+# gopkg.in/yaml.v3 v3.0.1
+## explicit
 gopkg.in/yaml.v3
+# oras.land/oras-go/v2 v2.1.0
+## explicit; go 1.19
+oras.land/oras-go/v2
+oras.land/oras-go/v2/content
+oras.land/oras-go/v2/content/oci
+oras.land/oras-go/v2/errdef
+oras.land/oras-go/v2/internal/cas
+oras.land/oras-go/v2/internal/container/set
+oras.land/oras-go/v2/internal/copyutil
+oras.land/oras-go/v2/internal/descriptor
+oras.land/oras-go/v2/internal/docker
+oras.land/oras-go/v2/internal/fs/tarfs
+oras.land/oras-go/v2/internal/graph
+oras.land/oras-go/v2/internal/interfaces
+oras.land/oras-go/v2/internal/ioutil
+oras.land/oras-go/v2/internal/platform
+oras.land/oras-go/v2/internal/registryutil
+oras.land/oras-go/v2/internal/resolver
+oras.land/oras-go/v2/internal/spec
+oras.land/oras-go/v2/internal/status
+oras.land/oras-go/v2/internal/syncutil
+oras.land/oras-go/v2/registry
+oras.land/oras-go/v2/registry/remote/auth
+oras.land/oras-go/v2/registry/remote/errcode
+oras.land/oras-go/v2/registry/remote/internal/errutil
+oras.land/oras-go/v2/registry/remote/retry
+# github.com/golang/glog => ./build/replacements/github.com/golang/glog
diff --git a/vendor/oras.land/oras-go/v2/.gitignore b/vendor/oras.land/oras-go/v2/.gitignore
new file mode 100644
index 0000000000..400a0ea0cb
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/.gitignore
@@ -0,0 +1,41 @@
+# Copyright The ORAS Authors.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, build with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# VS Code
+.vscode
+debug
+
+# Jetbrains
+.idea
+
+# Custom
+coverage.txt
+bin/
+dist/
+*.tar.gz
+vendor/
+_dist/
+.cover
diff --git a/vendor/oras.land/oras-go/v2/CODEOWNERS b/vendor/oras.land/oras-go/v2/CODEOWNERS
new file mode 100644
index 0000000000..45a68a31c2
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/CODEOWNERS
@@ -0,0 +1,2 @@
+# Derived from OWNERS.md
+* @sajayantony @shizhMSFT @stevelasker @Wwwsylvia
diff --git a/vendor/oras.land/oras-go/v2/CODE_OF_CONDUCT.md b/vendor/oras.land/oras-go/v2/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000000..49579ab800
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/CODE_OF_CONDUCT.md
@@ -0,0 +1,3 @@
+# Code of Conduct
+
+OCI Registry As Storage (ORAS) follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
diff --git a/vendor/oras.land/oras-go/v2/LICENSE b/vendor/oras.land/oras-go/v2/LICENSE
new file mode 100644
index 0000000000..a67d169389
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2021 ORAS Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/oras.land/oras-go/v2/MIGRATION_GUIDE.md b/vendor/oras.land/oras-go/v2/MIGRATION_GUIDE.md
new file mode 100644
index 0000000000..b9292f1436
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/MIGRATION_GUIDE.md
@@ -0,0 +1,45 @@
+# Migration Guide
+
+In version `v2`, ORAS Go library has been completely refreshed with:
+
+- More unified interfaces
+- Notably fewer dependencies
+- Higher test coverage
+- Better documentation
+
+**Besides, ORAS Go `v2` is now a registry client.**
+
+## Major Changes in `v2`
+
+- Moves `content.FileStore` to [file.Store](https://pkg.go.dev/oras.land/oras-go/v2/content/file#Store)
+- Moves `content.OCIStore` to [oci.Store](https://pkg.go.dev/oras.land/oras-go/v2/content/oci#Store)
+- Moves `content.MemoryStore` to [memory.Store](https://pkg.go.dev/oras.land/oras-go/v2/content/memory#Store)
+- Provides [SDK](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote) to interact with OCI-compliant and Docker-compliant registries
+- Supports [Copy](https://pkg.go.dev/oras.land/oras-go/v2#Copy) with more flexible options
+- Supports [Extended Copy](https://pkg.go.dev/oras.land/oras-go/v2#ExtendedCopy) with options *(experimental)*
+- No longer supports `docker.Login` and `docker.Logout` (removes the dependency on `docker`); instead, provides authentication through [auth.Client](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote/auth#Client)
+
+Documentation and examples are available at [pkg.go.dev](https://pkg.go.dev/oras.land/oras-go/v2).
+
+## Migrating from `v1` to `v2`
+
+1. Get the `v2` package
+
+    ```sh
+    go get oras.land/oras-go/v2
+    ```
+
+2. Import and use the `v2` package
+
+    ```go
+    import "oras.land/oras-go/v2"
+    ```
+
+3. Run
+
+   ```sh
+   go mod tidy
+    ```
+
+Since breaking changes are introduced in `v2`, code refactoring is required for migrating from `v1` to `v2`.  
+The migration can be done in an iterative fashion, as `v1` and `v2` can be imported and used at the same time.
diff --git a/vendor/oras.land/oras-go/v2/Makefile b/vendor/oras.land/oras-go/v2/Makefile
new file mode 100644
index 0000000000..bc671e4405
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/Makefile
@@ -0,0 +1,38 @@
+# Copyright The ORAS Authors.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+.PHONY: test
+test: vendor check-encoding
+	go test -race -v -coverprofile=coverage.txt -covermode=atomic ./...
+
+.PHONY: covhtml
+covhtml:
+	open .cover/coverage.html
+
+.PHONY: clean
+clean:
+	git status --ignored --short | grep '^!! ' | sed 's/!! //' | xargs rm -rf
+
+.PHONY: check-encoding
+check-encoding:
+	! find . -not -path "./vendor/*" -name "*.go" -type f -exec file "{}" ";" | grep CRLF
+	! find scripts -name "*.sh" -type f -exec file "{}" ";" | grep CRLF
+
+.PHONY: fix-encoding
+fix-encoding:
+	find . -not -path "./vendor/*" -name "*.go" -type f -exec sed -i -e "s/\r//g" {} +
+	find scripts -name "*.sh" -type f -exec sed -i -e "s/\r//g" {} +
+
+.PHONY: vendor
+vendor:
+	go mod vendor
diff --git a/vendor/oras.land/oras-go/v2/OWNERS.md b/vendor/oras.land/oras-go/v2/OWNERS.md
new file mode 100644
index 0000000000..402c4a97df
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/OWNERS.md
@@ -0,0 +1,11 @@
+# Owners
+
+Owners:
+  - Sajay Antony (@sajayantony)
+  - Shiwei Zhang (@shizhMSFT)
+  - Steve Lasker (@stevelasker)
+  - Sylvia Lei (@Wwwsylvia)
+
+Emeritus:
+  - Avi Deitcher (@deitch)
+  - Josh Dolitsky (@jdolitsky)
diff --git a/vendor/oras.land/oras-go/v2/README.md b/vendor/oras.land/oras-go/v2/README.md
new file mode 100644
index 0000000000..50bb30642f
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/README.md
@@ -0,0 +1,55 @@
+# ORAS Go library
+
+<p align="left">
+<a href="https://oras.land/"><img src="https://oras.land/img/oras.svg" alt="banner" width="100px"></a>
+</p>
+
+## Project status
+
+### Versioning
+
+The ORAS Go library follows [Semantic Versioning](https://semver.org/), where breaking changes are reserved for MAJOR releases, and MINOR and PATCH releases must be 100% backwards compatible.
+
+### v2: stable
+
+[![Build Status](https://github.com/oras-project/oras-go/actions/workflows/build.yml/badge.svg?event=push&branch=main)](https://github.com/oras-project/oras-go/actions/workflows/build.yml?query=workflow%3Abuild+event%3Apush+branch%3Amain)
+[![codecov](https://codecov.io/gh/oras-project/oras-go/branch/main/graph/badge.svg)](https://codecov.io/gh/oras-project/oras-go)
+[![Go Report Card](https://goreportcard.com/badge/oras.land/oras-go/v2)](https://goreportcard.com/report/oras.land/oras-go/v2)
+[![Go Reference](https://pkg.go.dev/badge/oras.land/oras-go/v2.svg)](https://pkg.go.dev/oras.land/oras-go/v2)
+
+The version `2` is actively developed in the [`main`](https://github.com/oras-project/oras-go/tree/main) branch with all new features.
+
+Examples for common use cases can be found below:
+
+- [Copy examples](https://pkg.go.dev/oras.land/oras-go/v2#pkg-examples)
+- [Registry interaction examples](https://pkg.go.dev/oras.land/oras-go/v2/registry#pkg-examples)
+- [Repository interaction examples](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote#pkg-examples)
+- [Authentication examples](https://pkg.go.dev/oras.land/oras-go/v2/registry/remote/auth#pkg-examples)
+
+If you are seeking latest changes, you should use the [`main`](https://github.com/oras-project/oras-go/tree/main) branch (or a specific commit hash) over a tagged version when including the ORAS Go library in your project's `go.mod`.
+The Go Reference for the `main` branch is available [here](https://pkg.go.dev/oras.land/oras-go/v2@main).
+
+To migrate from `v1` to `v2`, see [MIGRATION_GUIDE.md](./MIGRATION_GUIDE.md).
+
+### v1: stable
+
+[![Build Status](https://github.com/oras-project/oras-go/actions/workflows/build.yml/badge.svg?event=push&branch=v1)](https://github.com/oras-project/oras-go/actions/workflows/build.yml?query=workflow%3Abuild+event%3Apush+branch%3Av1)
+[![Go Report Card](https://goreportcard.com/badge/oras.land/oras-go)](https://goreportcard.com/report/oras.land/oras-go)
+[![Go Reference](https://pkg.go.dev/badge/oras.land/oras-go.svg)](https://pkg.go.dev/oras.land/oras-go)
+
+As there are various stable projects depending on the ORAS Go library `v1`, the
+[`v1`](https://github.com/oras-project/oras-go/tree/v1) branch
+is maintained for API stability, dependency updates, and security patches.
+All `v1.*` releases are based upon this branch.
+
+Since `v1` is in a maintenance state, you are highly encouraged
+to use releases with major version `2` for new features.
+
+## Docs
+
+- [oras.land/client_libraries/go](https://oras.land/docs/Client_Libraries/go): Documentation for the ORAS Go library
+- [Reviewing guide](https://github.com/oras-project/community/blob/main/REVIEWING.md): All reviewers must read the reviewing guide and agree to follow the project review guidelines.
+
+## Code of Conduct
+
+This project has adopted the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). See [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for further details.
diff --git a/vendor/oras.land/oras-go/v2/content.go b/vendor/oras.land/oras-go/v2/content.go
new file mode 100644
index 0000000000..53eb6c75ac
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content.go
@@ -0,0 +1,412 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oras
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/cas"
+	"oras.land/oras-go/v2/internal/docker"
+	"oras.land/oras-go/v2/internal/interfaces"
+	"oras.land/oras-go/v2/internal/platform"
+	"oras.land/oras-go/v2/internal/registryutil"
+	"oras.land/oras-go/v2/internal/syncutil"
+	"oras.land/oras-go/v2/registry"
+	"oras.land/oras-go/v2/registry/remote/auth"
+)
+
+const (
+	// defaultTagConcurrency is the default concurrency of tagging.
+	defaultTagConcurrency int = 5 // This value is consistent with dockerd
+
+	// defaultTagNMaxMetadataBytes is the default value of
+	// TagNOptions.MaxMetadataBytes.
+	defaultTagNMaxMetadataBytes int64 = 4 * 1024 * 1024 // 4 MiB
+
+	// defaultResolveMaxMetadataBytes is the default value of
+	// ResolveOptions.MaxMetadataBytes.
+	defaultResolveMaxMetadataBytes int64 = 4 * 1024 * 1024 // 4 MiB
+
+	// defaultMaxBytes is the default value of FetchBytesOptions.MaxBytes.
+	defaultMaxBytes int64 = 4 * 1024 * 1024 // 4 MiB
+)
+
+// DefaultTagNOptions provides the default TagNOptions.
+var DefaultTagNOptions TagNOptions
+
+// TagNOptions contains parameters for [oras.TagN].
+type TagNOptions struct {
+	// Concurrency limits the maximum number of concurrent tag tasks.
+	// If less than or equal to 0, a default (currently 5) is used.
+	Concurrency int
+
+	// MaxMetadataBytes limits the maximum size of metadata that can be cached
+	// in the memory.
+	// If less than or equal to 0, a default (currently 4 MiB) is used.
+	MaxMetadataBytes int64
+}
+
+// TagN tags the descriptor identified by srcReference with dstReferences.
+func TagN(ctx context.Context, target Target, srcReference string, dstReferences []string, opts TagNOptions) (ocispec.Descriptor, error) {
+	switch len(dstReferences) {
+	case 0:
+		return ocispec.Descriptor{}, fmt.Errorf("dstReferences cannot be empty: %w", errdef.ErrMissingReference)
+	case 1:
+		return Tag(ctx, target, srcReference, dstReferences[0])
+	}
+
+	if opts.Concurrency <= 0 {
+		opts.Concurrency = defaultTagConcurrency
+	}
+	if opts.MaxMetadataBytes <= 0 {
+		opts.MaxMetadataBytes = defaultTagNMaxMetadataBytes
+	}
+
+	_, isRefFetcher := target.(registry.ReferenceFetcher)
+	_, isRefPusher := target.(registry.ReferencePusher)
+	if isRefFetcher && isRefPusher {
+		if repo, ok := target.(interfaces.ReferenceParser); ok {
+			// add scope hints to minimize the number of auth requests
+			ref, err := repo.ParseReference(srcReference)
+			if err != nil {
+				return ocispec.Descriptor{}, err
+			}
+			ctx = registryutil.WithScopeHint(ctx, ref, auth.ActionPull, auth.ActionPush)
+		}
+
+		desc, contentBytes, err := FetchBytes(ctx, target, srcReference, FetchBytesOptions{
+			MaxBytes: opts.MaxMetadataBytes,
+		})
+		if err != nil {
+			if errors.Is(err, errdef.ErrSizeExceedsLimit) {
+				err = fmt.Errorf(
+					"content size %v exceeds MaxMetadataBytes %v: %w",
+					desc.Size,
+					opts.MaxMetadataBytes,
+					errdef.ErrSizeExceedsLimit)
+			}
+			return ocispec.Descriptor{}, err
+		}
+
+		if err := tagBytesN(ctx, target, desc, contentBytes, dstReferences, TagBytesNOptions{
+			Concurrency: opts.Concurrency,
+		}); err != nil {
+			return ocispec.Descriptor{}, err
+		}
+		return desc, nil
+	}
+
+	desc, err := target.Resolve(ctx, srcReference)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	eg, egCtx := syncutil.LimitGroup(ctx, opts.Concurrency)
+	for _, dstRef := range dstReferences {
+		eg.Go(func(dst string) func() error {
+			return func() error {
+				if err := target.Tag(egCtx, desc, dst); err != nil {
+					return fmt.Errorf("failed to tag %s as %s: %w", srcReference, dst, err)
+				}
+				return nil
+			}
+		}(dstRef))
+	}
+
+	if err := eg.Wait(); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	return desc, nil
+}
+
+// Tag tags the descriptor identified by src with dst.
+func Tag(ctx context.Context, target Target, src, dst string) (ocispec.Descriptor, error) {
+	refFetcher, okFetch := target.(registry.ReferenceFetcher)
+	refPusher, okPush := target.(registry.ReferencePusher)
+	if okFetch && okPush {
+		if repo, ok := target.(interfaces.ReferenceParser); ok {
+			// add scope hints to minimize the number of auth requests
+			ref, err := repo.ParseReference(src)
+			if err != nil {
+				return ocispec.Descriptor{}, err
+			}
+			ctx = registryutil.WithScopeHint(ctx, ref, auth.ActionPull, auth.ActionPush)
+		}
+		desc, rc, err := refFetcher.FetchReference(ctx, src)
+		if err != nil {
+			return ocispec.Descriptor{}, err
+		}
+		defer rc.Close()
+		if err := refPusher.PushReference(ctx, desc, rc, dst); err != nil {
+			return ocispec.Descriptor{}, err
+		}
+		return desc, nil
+	}
+
+	desc, err := target.Resolve(ctx, src)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	if err := target.Tag(ctx, desc, dst); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	return desc, nil
+}
+
+// DefaultResolveOptions provides the default ResolveOptions.
+var DefaultResolveOptions ResolveOptions
+
+// ResolveOptions contains parameters for [oras.Resolve].
+type ResolveOptions struct {
+	// TargetPlatform ensures the resolved content matches the target platform
+	// if the node is a manifest, or selects the first resolved content that
+	// matches the target platform if the node is a manifest list.
+	TargetPlatform *ocispec.Platform
+
+	// MaxMetadataBytes limits the maximum size of metadata that can be cached
+	// in the memory.
+	// If less than or equal to 0, a default (currently 4 MiB) is used.
+	MaxMetadataBytes int64
+}
+
+// Resolve resolves a descriptor with provided reference from the target.
+func Resolve(ctx context.Context, target ReadOnlyTarget, reference string, opts ResolveOptions) (ocispec.Descriptor, error) {
+	if opts.TargetPlatform == nil {
+		return target.Resolve(ctx, reference)
+	}
+	return resolve(ctx, target, nil, reference, opts)
+}
+
+// resolve resolves a descriptor with provided reference from the target, with
+// specified caching.
+func resolve(ctx context.Context, target ReadOnlyTarget, proxy *cas.Proxy, reference string, opts ResolveOptions) (ocispec.Descriptor, error) {
+	if opts.MaxMetadataBytes <= 0 {
+		opts.MaxMetadataBytes = defaultResolveMaxMetadataBytes
+	}
+
+	if refFetcher, ok := target.(registry.ReferenceFetcher); ok {
+		// optimize performance for ReferenceFetcher targets
+		desc, rc, err := refFetcher.FetchReference(ctx, reference)
+		if err != nil {
+			return ocispec.Descriptor{}, err
+		}
+		defer rc.Close()
+
+		switch desc.MediaType {
+		case docker.MediaTypeManifestList, ocispec.MediaTypeImageIndex,
+			docker.MediaTypeManifest, ocispec.MediaTypeImageManifest:
+			// cache the fetched content
+			if desc.Size > opts.MaxMetadataBytes {
+				return ocispec.Descriptor{}, fmt.Errorf(
+					"content size %v exceeds MaxMetadataBytes %v: %w",
+					desc.Size,
+					opts.MaxMetadataBytes,
+					errdef.ErrSizeExceedsLimit)
+			}
+			if proxy == nil {
+				proxy = cas.NewProxyWithLimit(target, cas.NewMemory(), opts.MaxMetadataBytes)
+			}
+			if err := proxy.Cache.Push(ctx, desc, rc); err != nil {
+				return ocispec.Descriptor{}, err
+			}
+			// stop caching as SelectManifest may fetch a config blob
+			proxy.StopCaching = true
+			return platform.SelectManifest(ctx, proxy, desc, opts.TargetPlatform)
+		default:
+			return ocispec.Descriptor{}, fmt.Errorf("%s: %s: %w", desc.Digest, desc.MediaType, errdef.ErrUnsupported)
+		}
+	}
+
+	desc, err := target.Resolve(ctx, reference)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	return platform.SelectManifest(ctx, target, desc, opts.TargetPlatform)
+}
+
+// DefaultFetchOptions provides the default FetchOptions.
+var DefaultFetchOptions FetchOptions
+
+// FetchOptions contains parameters for [oras.Fetch].
+type FetchOptions struct {
+	// ResolveOptions contains parameters for resolving reference.
+	ResolveOptions
+}
+
+// Fetch fetches the content identified by the reference.
+func Fetch(ctx context.Context, target ReadOnlyTarget, reference string, opts FetchOptions) (ocispec.Descriptor, io.ReadCloser, error) {
+	if opts.TargetPlatform == nil {
+		if refFetcher, ok := target.(registry.ReferenceFetcher); ok {
+			return refFetcher.FetchReference(ctx, reference)
+		}
+
+		desc, err := target.Resolve(ctx, reference)
+		if err != nil {
+			return ocispec.Descriptor{}, nil, err
+		}
+		rc, err := target.Fetch(ctx, desc)
+		if err != nil {
+			return ocispec.Descriptor{}, nil, err
+		}
+		return desc, rc, nil
+	}
+
+	if opts.MaxMetadataBytes <= 0 {
+		opts.MaxMetadataBytes = defaultResolveMaxMetadataBytes
+	}
+	proxy := cas.NewProxyWithLimit(target, cas.NewMemory(), opts.MaxMetadataBytes)
+	desc, err := resolve(ctx, target, proxy, reference, opts.ResolveOptions)
+	if err != nil {
+		return ocispec.Descriptor{}, nil, err
+	}
+	// if the content exists in cache, fetch it from cache
+	// otherwise fetch without caching
+	proxy.StopCaching = true
+	rc, err := proxy.Fetch(ctx, desc)
+	if err != nil {
+		return ocispec.Descriptor{}, nil, err
+	}
+	return desc, rc, nil
+}
+
+// DefaultFetchBytesOptions provides the default FetchBytesOptions.
+var DefaultFetchBytesOptions FetchBytesOptions
+
+// FetchBytesOptions contains parameters for [oras.FetchBytes].
+type FetchBytesOptions struct {
+	// FetchOptions contains parameters for fetching content.
+	FetchOptions
+	// MaxBytes limits the maximum size of the fetched content bytes.
+	// If less than or equal to 0, a default (currently 4 MiB) is used.
+	MaxBytes int64
+}
+
+// FetchBytes fetches the content bytes identified by the reference.
+func FetchBytes(ctx context.Context, target ReadOnlyTarget, reference string, opts FetchBytesOptions) (ocispec.Descriptor, []byte, error) {
+	if opts.MaxBytes <= 0 {
+		opts.MaxBytes = defaultMaxBytes
+	}
+
+	desc, rc, err := Fetch(ctx, target, reference, opts.FetchOptions)
+	if err != nil {
+		return ocispec.Descriptor{}, nil, err
+	}
+	defer rc.Close()
+
+	if desc.Size > opts.MaxBytes {
+		return ocispec.Descriptor{}, nil, fmt.Errorf(
+			"content size %v exceeds MaxBytes %v: %w",
+			desc.Size,
+			opts.MaxBytes,
+			errdef.ErrSizeExceedsLimit)
+	}
+	bytes, err := content.ReadAll(rc, desc)
+	if err != nil {
+		return ocispec.Descriptor{}, nil, err
+	}
+
+	return desc, bytes, nil
+}
+
+// PushBytes describes the contentBytes using the given mediaType and pushes it.
+// If mediaType is not specified, "application/octet-stream" is used.
+func PushBytes(ctx context.Context, pusher content.Pusher, mediaType string, contentBytes []byte) (ocispec.Descriptor, error) {
+	desc := content.NewDescriptorFromBytes(mediaType, contentBytes)
+	r := bytes.NewReader(contentBytes)
+	if err := pusher.Push(ctx, desc, r); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	return desc, nil
+}
+
+// DefaultTagBytesNOptions provides the default TagBytesNOptions.
+var DefaultTagBytesNOptions TagBytesNOptions
+
+// TagBytesNOptions contains parameters for [oras.TagBytesN].
+type TagBytesNOptions struct {
+	// Concurrency limits the maximum number of concurrent tag tasks.
+	// If less than or equal to 0, a default (currently 5) is used.
+	Concurrency int
+}
+
+// TagBytesN describes the contentBytes using the given mediaType, pushes it,
+// and tag it with the given references.
+// If mediaType is not specified, "application/octet-stream" is used.
+func TagBytesN(ctx context.Context, target Target, mediaType string, contentBytes []byte, references []string, opts TagBytesNOptions) (ocispec.Descriptor, error) {
+	if len(references) == 0 {
+		return PushBytes(ctx, target, mediaType, contentBytes)
+	}
+
+	desc := content.NewDescriptorFromBytes(mediaType, contentBytes)
+	if opts.Concurrency <= 0 {
+		opts.Concurrency = defaultTagConcurrency
+	}
+
+	if err := tagBytesN(ctx, target, desc, contentBytes, references, opts); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	return desc, nil
+}
+
+// tagBytesN pushes the contentBytes using the given desc, and tag it with the
+// given references.
+func tagBytesN(ctx context.Context, target Target, desc ocispec.Descriptor, contentBytes []byte, references []string, opts TagBytesNOptions) error {
+	eg, egCtx := syncutil.LimitGroup(ctx, opts.Concurrency)
+	if refPusher, ok := target.(registry.ReferencePusher); ok {
+		for _, reference := range references {
+			eg.Go(func(ref string) func() error {
+				return func() error {
+					r := bytes.NewReader(contentBytes)
+					if err := refPusher.PushReference(egCtx, desc, r, ref); err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+						return fmt.Errorf("failed to tag %s: %w", ref, err)
+					}
+					return nil
+				}
+			}(reference))
+		}
+	} else {
+		r := bytes.NewReader(contentBytes)
+		if err := target.Push(ctx, desc, r); err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+			return fmt.Errorf("failed to push content: %w", err)
+		}
+		for _, reference := range references {
+			eg.Go(func(ref string) func() error {
+				return func() error {
+					if err := target.Tag(egCtx, desc, ref); err != nil {
+						return fmt.Errorf("failed to tag %s: %w", ref, err)
+					}
+					return nil
+				}
+			}(reference))
+		}
+	}
+
+	return eg.Wait()
+}
+
+// TagBytes describes the contentBytes using the given mediaType, pushes it,
+// and tag it with the given reference.
+// If mediaType is not specified, "application/octet-stream" is used.
+func TagBytes(ctx context.Context, target Target, mediaType string, contentBytes []byte, reference string) (ocispec.Descriptor, error) {
+	return TagBytesN(ctx, target, mediaType, contentBytes, []string{reference}, DefaultTagBytesNOptions)
+}
diff --git a/vendor/oras.land/oras-go/v2/content/descriptor.go b/vendor/oras.land/oras-go/v2/content/descriptor.go
new file mode 100644
index 0000000000..8e6c25dec2
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/descriptor.go
@@ -0,0 +1,40 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/internal/descriptor"
+)
+
+// NewDescriptorFromBytes returns a descriptor, given the content and media type.
+// If no media type is specified, "application/octet-stream" will be used.
+func NewDescriptorFromBytes(mediaType string, content []byte) ocispec.Descriptor {
+	if mediaType == "" {
+		mediaType = descriptor.DefaultMediaType
+	}
+	return ocispec.Descriptor{
+		MediaType: mediaType,
+		Digest:    digest.FromBytes(content),
+		Size:      int64(len(content)),
+	}
+}
+
+// Equal returns true if two descriptors point to the same content.
+func Equal(a, b ocispec.Descriptor) bool {
+	return a.Size == b.Size && a.Digest == b.Digest && a.MediaType == b.MediaType
+}
diff --git a/vendor/oras.land/oras-go/v2/content/graph.go b/vendor/oras.land/oras-go/v2/content/graph.go
new file mode 100644
index 0000000000..fa2f9efe78
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/graph.go
@@ -0,0 +1,107 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"context"
+	"encoding/json"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/internal/docker"
+	"oras.land/oras-go/v2/internal/spec"
+)
+
+// PredecessorFinder finds out the nodes directly pointing to a given node of a
+// directed acyclic graph.
+// In other words, returns the "parents" of the current descriptor.
+// PredecessorFinder is an extension of Storage.
+type PredecessorFinder interface {
+	// Predecessors returns the nodes directly pointing to the current node.
+	Predecessors(ctx context.Context, node ocispec.Descriptor) ([]ocispec.Descriptor, error)
+}
+
+// GraphStorage represents a CAS that supports direct predecessor node finding.
+type GraphStorage interface {
+	Storage
+	PredecessorFinder
+}
+
+// ReadOnlyGraphStorage represents a read-only GraphStorage.
+type ReadOnlyGraphStorage interface {
+	ReadOnlyStorage
+	PredecessorFinder
+}
+
+// Successors returns the nodes directly pointed by the current node.
+// In other words, returns the "children" of the current descriptor.
+func Successors(ctx context.Context, fetcher Fetcher, node ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+	switch node.MediaType {
+	case docker.MediaTypeManifest:
+		content, err := FetchAll(ctx, fetcher, node)
+		if err != nil {
+			return nil, err
+		}
+		// OCI manifest schema can be used to marshal docker manifest
+		var manifest ocispec.Manifest
+		if err := json.Unmarshal(content, &manifest); err != nil {
+			return nil, err
+		}
+		return append([]ocispec.Descriptor{manifest.Config}, manifest.Layers...), nil
+	case ocispec.MediaTypeImageManifest:
+		content, err := FetchAll(ctx, fetcher, node)
+		if err != nil {
+			return nil, err
+		}
+		var manifest ocispec.Manifest
+		if err := json.Unmarshal(content, &manifest); err != nil {
+			return nil, err
+		}
+		var nodes []ocispec.Descriptor
+		if manifest.Subject != nil {
+			nodes = append(nodes, *manifest.Subject)
+		}
+		nodes = append(nodes, manifest.Config)
+		return append(nodes, manifest.Layers...), nil
+	case docker.MediaTypeManifestList, ocispec.MediaTypeImageIndex:
+		content, err := FetchAll(ctx, fetcher, node)
+		if err != nil {
+			return nil, err
+		}
+
+		// docker manifest list and oci index are equivalent for successors.
+		var index ocispec.Index
+		if err := json.Unmarshal(content, &index); err != nil {
+			return nil, err
+		}
+		return index.Manifests, nil
+	case spec.MediaTypeArtifactManifest:
+		content, err := FetchAll(ctx, fetcher, node)
+		if err != nil {
+			return nil, err
+		}
+
+		var manifest spec.Artifact
+		if err := json.Unmarshal(content, &manifest); err != nil {
+			return nil, err
+		}
+		var nodes []ocispec.Descriptor
+		if manifest.Subject != nil {
+			nodes = append(nodes, *manifest.Subject)
+		}
+		return append(nodes, manifest.Blobs...), nil
+	}
+	return nil, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/content/limitedstorage.go b/vendor/oras.land/oras-go/v2/content/limitedstorage.go
new file mode 100644
index 0000000000..9a6df2f82f
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/limitedstorage.go
@@ -0,0 +1,50 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/errdef"
+)
+
+// LimitedStorage represents a CAS with a push size limit.
+type LimitedStorage struct {
+	Storage         // underlying storage
+	PushLimit int64 // max size for push
+}
+
+// Push pushes the content, matching the expected descriptor.
+// The size of the content cannot exceed the push size limit.
+func (ls *LimitedStorage) Push(ctx context.Context, expected ocispec.Descriptor, content io.Reader) error {
+	if expected.Size > ls.PushLimit {
+		return fmt.Errorf(
+			"content size %v exceeds push size limit %v: %w",
+			expected.Size,
+			ls.PushLimit,
+			errdef.ErrSizeExceedsLimit)
+	}
+
+	return ls.Storage.Push(ctx, expected, io.LimitReader(content, expected.Size))
+}
+
+// LimitStorage returns a storage with a push size limit.
+func LimitStorage(s Storage, n int64) *LimitedStorage {
+	return &LimitedStorage{s, n}
+}
diff --git a/vendor/oras.land/oras-go/v2/content/oci/oci.go b/vendor/oras.land/oras-go/v2/content/oci/oci.go
new file mode 100644
index 0000000000..a473e5c1e4
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/oci/oci.go
@@ -0,0 +1,326 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package oci provides access to an OCI content store.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md
+package oci
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/opencontainers/go-digest"
+	specs "github.com/opencontainers/image-spec/specs-go"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/container/set"
+	"oras.land/oras-go/v2/internal/descriptor"
+	"oras.land/oras-go/v2/internal/graph"
+	"oras.land/oras-go/v2/internal/resolver"
+)
+
+// ociImageIndexFile is the file name of the index
+// from the OCI Image Layout Specification.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md#indexjson-file
+const ociImageIndexFile = "index.json"
+
+// Store implements `oras.Target`, and represents a content store
+// based on file system with the OCI-Image layout.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md
+type Store struct {
+	// AutoSaveIndex controls if the OCI store will automatically save the index
+	// file on each Tag() call.
+	//   - If AutoSaveIndex is set to true, the OCI store will automatically call
+	//     this method on each Tag() call.
+	//   - If AutoSaveIndex is set to false, it's the caller's responsibility
+	//     to manually call SaveIndex() when needed.
+	//   - Default value: true.
+	AutoSaveIndex bool
+	root          string
+	indexPath     string
+	index         *ocispec.Index
+	indexLock     sync.Mutex
+
+	storage     content.Storage
+	tagResolver *resolver.Memory
+	graph       *graph.Memory
+}
+
+// New creates a new OCI store with context.Background().
+func New(root string) (*Store, error) {
+	return NewWithContext(context.Background(), root)
+}
+
+// NewWithContext creates a new OCI store.
+func NewWithContext(ctx context.Context, root string) (*Store, error) {
+	rootAbs, err := filepath.Abs(root)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve absolute path for %s: %w", root, err)
+	}
+	storage, err := NewStorage(rootAbs)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create storage: %w", err)
+	}
+
+	store := &Store{
+		AutoSaveIndex: true,
+		root:          rootAbs,
+		indexPath:     filepath.Join(rootAbs, ociImageIndexFile),
+		storage:       storage,
+		tagResolver:   resolver.NewMemory(),
+		graph:         graph.NewMemory(),
+	}
+
+	if err := ensureDir(rootAbs); err != nil {
+		return nil, err
+	}
+	if err := store.ensureOCILayoutFile(); err != nil {
+		return nil, fmt.Errorf("invalid OCI Image Layout: %w", err)
+	}
+	if err := store.loadIndexFile(ctx); err != nil {
+		return nil, fmt.Errorf("invalid OCI Image Layout: %w", err)
+	}
+
+	return store, nil
+}
+
+// Fetch fetches the content identified by the descriptor.
+func (s *Store) Fetch(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	return s.storage.Fetch(ctx, target)
+}
+
+// Push pushes the content, matching the expected descriptor.
+func (s *Store) Push(ctx context.Context, expected ocispec.Descriptor, reader io.Reader) error {
+	if err := s.storage.Push(ctx, expected, reader); err != nil {
+		return err
+	}
+	if err := s.graph.Index(ctx, s.storage, expected); err != nil {
+		return err
+	}
+	if descriptor.IsManifest(expected) {
+		// tag by digest
+		return s.tag(ctx, expected, expected.Digest.String())
+	}
+	return nil
+}
+
+// Exists returns true if the described content exists.
+func (s *Store) Exists(ctx context.Context, target ocispec.Descriptor) (bool, error) {
+	return s.storage.Exists(ctx, target)
+}
+
+// Tag tags a descriptor with a reference string.
+// reference should be a valid tag (e.g. "latest").
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md#indexjson-file
+func (s *Store) Tag(ctx context.Context, desc ocispec.Descriptor, reference string) error {
+	if err := validateReference(reference); err != nil {
+		return err
+	}
+
+	exists, err := s.storage.Exists(ctx, desc)
+	if err != nil {
+		return err
+	}
+	if !exists {
+		return fmt.Errorf("%s: %s: %w", desc.Digest, desc.MediaType, errdef.ErrNotFound)
+	}
+
+	return s.tag(ctx, desc, reference)
+}
+
+// tag tags a descriptor with a reference string.
+func (s *Store) tag(ctx context.Context, desc ocispec.Descriptor, reference string) error {
+	dgst := desc.Digest.String()
+	if reference != dgst {
+		// also tag desc by its digest
+		if err := s.tagResolver.Tag(ctx, desc, dgst); err != nil {
+			return err
+		}
+	}
+	if err := s.tagResolver.Tag(ctx, desc, reference); err != nil {
+		return err
+	}
+	if s.AutoSaveIndex {
+		return s.SaveIndex()
+	}
+	return nil
+}
+
+// Resolve resolves a reference to a descriptor. If the reference to be resolved
+// is a tag, the returned descriptor will be a full descriptor declared by
+// github.com/opencontainers/image-spec/specs-go/v1. If the reference is a
+// digest the returned descriptor will be a plain descriptor (containing only
+// the digest, media type and size).
+func (s *Store) Resolve(ctx context.Context, reference string) (ocispec.Descriptor, error) {
+	if reference == "" {
+		return ocispec.Descriptor{}, errdef.ErrMissingReference
+	}
+
+	// attempt resolving manifest
+	desc, err := s.tagResolver.Resolve(ctx, reference)
+	if err != nil {
+		if errors.Is(err, errdef.ErrNotFound) {
+			// attempt resolving blob
+			return resolveBlob(os.DirFS(s.root), reference)
+		}
+		return ocispec.Descriptor{}, err
+	}
+
+	if reference == desc.Digest.String() {
+		return descriptor.Plain(desc), nil
+	}
+
+	return desc, nil
+}
+
+// Predecessors returns the nodes directly pointing to the current node.
+// Predecessors returns nil without error if the node does not exists in the
+// store.
+func (s *Store) Predecessors(ctx context.Context, node ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+	return s.graph.Predecessors(ctx, node)
+}
+
+// Tags lists the tags presented in the `index.json` file of the OCI layout,
+// returned in ascending order.
+// If `last` is NOT empty, the entries in the response start after the tag
+// specified by `last`. Otherwise, the response starts from the top of the tags
+// list.
+//
+// See also `Tags()` in the package `registry`.
+func (s *Store) Tags(ctx context.Context, last string, fn func(tags []string) error) error {
+	return listTags(ctx, s.tagResolver, last, fn)
+}
+
+// ensureOCILayoutFile ensures the `oci-layout` file.
+func (s *Store) ensureOCILayoutFile() error {
+	layoutFilePath := filepath.Join(s.root, ocispec.ImageLayoutFile)
+	layoutFile, err := os.Open(layoutFilePath)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return fmt.Errorf("failed to open OCI layout file: %w", err)
+		}
+
+		layout := ocispec.ImageLayout{
+			Version: ocispec.ImageLayoutVersion,
+		}
+		layoutJSON, err := json.Marshal(layout)
+		if err != nil {
+			return fmt.Errorf("failed to marshal OCI layout file: %w", err)
+		}
+		return os.WriteFile(layoutFilePath, layoutJSON, 0666)
+	}
+	defer layoutFile.Close()
+
+	var layout ocispec.ImageLayout
+	err = json.NewDecoder(layoutFile).Decode(&layout)
+	if err != nil {
+		return fmt.Errorf("failed to decode OCI layout file: %w", err)
+	}
+	return validateOCILayout(&layout)
+}
+
+// loadIndexFile reads index.json from the file system.
+// Create index.json if it does not exist.
+func (s *Store) loadIndexFile(ctx context.Context) error {
+	indexFile, err := os.Open(s.indexPath)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return fmt.Errorf("failed to open index file: %w", err)
+		}
+
+		// write index.json if it does not exist
+		s.index = &ocispec.Index{
+			Versioned: specs.Versioned{
+				SchemaVersion: 2, // historical value
+			},
+			Manifests: []ocispec.Descriptor{},
+		}
+		return s.writeIndexFile()
+	}
+	defer indexFile.Close()
+
+	var index ocispec.Index
+	if err := json.NewDecoder(indexFile).Decode(&index); err != nil {
+		return fmt.Errorf("failed to decode index file: %w", err)
+	}
+	s.index = &index
+	return loadIndex(ctx, s.index, s.storage, s.tagResolver, s.graph)
+}
+
+// SaveIndex writes the `index.json` file to the file system.
+//   - If AutoSaveIndex is set to true (default value),
+//     the OCI store will automatically call this method on each Tag() call.
+//   - If AutoSaveIndex is set to false, it's the caller's responsibility
+//     to manually call this method when needed.
+func (s *Store) SaveIndex() error {
+	s.indexLock.Lock()
+	defer s.indexLock.Unlock()
+
+	var manifests []ocispec.Descriptor
+	tagged := set.New[digest.Digest]()
+	refMap := s.tagResolver.Map()
+
+	// 1. Add descriptors that are associated with tags
+	// Note: One descriptor can be associated with multiple tags.
+	for ref, desc := range refMap {
+		if ref != desc.Digest.String() {
+			annotations := make(map[string]string, len(desc.Annotations)+1)
+			for k, v := range desc.Annotations {
+				annotations[k] = v
+			}
+			annotations[ocispec.AnnotationRefName] = ref
+			desc.Annotations = annotations
+			manifests = append(manifests, desc)
+			// mark the digest as tagged for deduplication in step 2
+			tagged.Add(desc.Digest)
+		}
+	}
+	// 2. Add descriptors that are not associated with any tag
+	for ref, desc := range refMap {
+		if ref == desc.Digest.String() && !tagged.Contains(desc.Digest) {
+			// skip tagged ones since they have been added in step 1
+			manifests = append(manifests, deleteAnnotationRefName(desc))
+		}
+	}
+
+	s.index.Manifests = manifests
+	return s.writeIndexFile()
+}
+
+// writeIndexFile writes the `index.json` file.
+func (s *Store) writeIndexFile() error {
+	indexJSON, err := json.Marshal(s.index)
+	if err != nil {
+		return fmt.Errorf("failed to marshal index file: %w", err)
+	}
+	return os.WriteFile(s.indexPath, indexJSON, 0666)
+}
+
+// validateReference validates ref.
+func validateReference(ref string) error {
+	if ref == "" {
+		return errdef.ErrMissingReference
+	}
+
+	// TODO: may enforce more strict validation if needed.
+	return nil
+}
diff --git a/vendor/oras.land/oras-go/v2/content/oci/readonlyoci.go b/vendor/oras.land/oras-go/v2/content/oci/readonlyoci.go
new file mode 100644
index 0000000000..b70b767527
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/oci/readonlyoci.go
@@ -0,0 +1,259 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oci
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"sort"
+
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/descriptor"
+	"oras.land/oras-go/v2/internal/fs/tarfs"
+	"oras.land/oras-go/v2/internal/graph"
+	"oras.land/oras-go/v2/internal/resolver"
+)
+
+// ReadOnlyStore implements `oras.ReadonlyTarget`, and represents a read-only
+// content store based on file system with the OCI-Image layout.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md
+type ReadOnlyStore struct {
+	fsys        fs.FS
+	storage     content.ReadOnlyStorage
+	tagResolver *resolver.Memory
+	graph       *graph.Memory
+}
+
+// NewFromFS creates a new read-only OCI store from fsys.
+func NewFromFS(ctx context.Context, fsys fs.FS) (*ReadOnlyStore, error) {
+	store := &ReadOnlyStore{
+		fsys:        fsys,
+		storage:     NewStorageFromFS(fsys),
+		tagResolver: resolver.NewMemory(),
+		graph:       graph.NewMemory(),
+	}
+
+	if err := store.validateOCILayoutFile(); err != nil {
+		return nil, fmt.Errorf("invalid OCI Image Layout: %w", err)
+	}
+	if err := store.loadIndexFile(ctx); err != nil {
+		return nil, fmt.Errorf("invalid OCI Image Layout: %w", err)
+	}
+
+	return store, nil
+}
+
+// NewFromTar creates a new read-only OCI store from a tar archive located at
+// path.
+func NewFromTar(ctx context.Context, path string) (*ReadOnlyStore, error) {
+	tfs, err := tarfs.New(path)
+	if err != nil {
+		return nil, err
+	}
+	return NewFromFS(ctx, tfs)
+}
+
+// Fetch fetches the content identified by the descriptor.
+func (s *ReadOnlyStore) Fetch(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	return s.storage.Fetch(ctx, target)
+}
+
+// Exists returns true if the described content exists.
+func (s *ReadOnlyStore) Exists(ctx context.Context, target ocispec.Descriptor) (bool, error) {
+	return s.storage.Exists(ctx, target)
+}
+
+// Resolve resolves a reference to a descriptor. If the reference to be resolved
+// is a tag, the returned descriptor will be a full descriptor declared by
+// github.com/opencontainers/image-spec/specs-go/v1. If the reference is a
+// digest the returned descriptor will be a plain descriptor (containing only
+// the digest, media type and size).
+func (s *ReadOnlyStore) Resolve(ctx context.Context, reference string) (ocispec.Descriptor, error) {
+	if reference == "" {
+		return ocispec.Descriptor{}, errdef.ErrMissingReference
+	}
+
+	// attempt resolving manifest
+	desc, err := s.tagResolver.Resolve(ctx, reference)
+	if err != nil {
+		if errors.Is(err, errdef.ErrNotFound) {
+			// attempt resolving blob
+			return resolveBlob(s.fsys, reference)
+		}
+		return ocispec.Descriptor{}, err
+	}
+
+	if reference == desc.Digest.String() {
+		return descriptor.Plain(desc), nil
+	}
+
+	return desc, nil
+}
+
+// Predecessors returns the nodes directly pointing to the current node.
+// Predecessors returns nil without error if the node does not exists in the
+// store.
+func (s *ReadOnlyStore) Predecessors(ctx context.Context, node ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+	return s.graph.Predecessors(ctx, node)
+}
+
+// Tags lists the tags presented in the `index.json` file of the OCI layout,
+// returned in ascending order.
+// If `last` is NOT empty, the entries in the response start after the tag
+// specified by `last`. Otherwise, the response starts from the top of the tags
+// list.
+//
+// See also `Tags()` in the package `registry`.
+func (s *ReadOnlyStore) Tags(ctx context.Context, last string, fn func(tags []string) error) error {
+	return listTags(ctx, s.tagResolver, last, fn)
+}
+
+// validateOCILayoutFile validates the `oci-layout` file.
+func (s *ReadOnlyStore) validateOCILayoutFile() error {
+	layoutFile, err := s.fsys.Open(ocispec.ImageLayoutFile)
+	if err != nil {
+		return fmt.Errorf("failed to open OCI layout file: %w", err)
+	}
+	defer layoutFile.Close()
+
+	var layout ocispec.ImageLayout
+	err = json.NewDecoder(layoutFile).Decode(&layout)
+	if err != nil {
+		return fmt.Errorf("failed to decode OCI layout file: %w", err)
+	}
+	return validateOCILayout(&layout)
+}
+
+// validateOCILayout validates layout.
+func validateOCILayout(layout *ocispec.ImageLayout) error {
+	if layout.Version != ocispec.ImageLayoutVersion {
+		return errdef.ErrUnsupportedVersion
+	}
+	return nil
+}
+
+// loadIndexFile reads index.json from s.fsys.
+func (s *ReadOnlyStore) loadIndexFile(ctx context.Context) error {
+	indexFile, err := s.fsys.Open(ociImageIndexFile)
+	if err != nil {
+		return fmt.Errorf("failed to open index file: %w", err)
+	}
+	defer indexFile.Close()
+
+	var index ocispec.Index
+	if err := json.NewDecoder(indexFile).Decode(&index); err != nil {
+		return fmt.Errorf("failed to decode index file: %w", err)
+	}
+	return loadIndex(ctx, &index, s.storage, s.tagResolver, s.graph)
+}
+
+// loadIndex loads index into memory.
+func loadIndex(ctx context.Context, index *ocispec.Index, fetcher content.Fetcher, tagger content.Tagger, graph *graph.Memory) error {
+	for _, desc := range index.Manifests {
+		if err := tagger.Tag(ctx, deleteAnnotationRefName(desc), desc.Digest.String()); err != nil {
+			return err
+		}
+		if ref := desc.Annotations[ocispec.AnnotationRefName]; ref != "" {
+			if err := tagger.Tag(ctx, desc, ref); err != nil {
+				return err
+			}
+		}
+		plain := descriptor.Plain(desc)
+		if err := graph.IndexAll(ctx, fetcher, plain); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// resolveBlob returns a descriptor describing the blob identified by dgst.
+func resolveBlob(fsys fs.FS, dgst string) (ocispec.Descriptor, error) {
+	path, err := blobPath(digest.Digest(dgst))
+	if err != nil {
+		if errors.Is(err, errdef.ErrInvalidDigest) {
+			return ocispec.Descriptor{}, errdef.ErrNotFound
+		}
+		return ocispec.Descriptor{}, err
+	}
+	fi, err := fs.Stat(fsys, path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return ocispec.Descriptor{}, errdef.ErrNotFound
+		}
+		return ocispec.Descriptor{}, err
+	}
+
+	return ocispec.Descriptor{
+		MediaType: descriptor.DefaultMediaType,
+		Size:      fi.Size(),
+		Digest:    digest.Digest(dgst),
+	}, nil
+}
+
+// listTags returns the tags in ascending order.
+// If `last` is NOT empty, the entries in the response start after the tag
+// specified by `last`. Otherwise, the response starts from the top of the tags
+// list.
+//
+// See also `Tags()` in the package `registry`.
+func listTags(ctx context.Context, tagResolver *resolver.Memory, last string, fn func(tags []string) error) error {
+	var tags []string
+
+	tagMap := tagResolver.Map()
+	for tag, desc := range tagMap {
+		if tag == desc.Digest.String() {
+			continue
+		}
+		if last != "" && tag <= last {
+			continue
+		}
+		tags = append(tags, tag)
+	}
+	sort.Strings(tags)
+
+	return fn(tags)
+}
+
+// deleteAnnotationRefName deletes the AnnotationRefName from the annotation map
+// of desc.
+func deleteAnnotationRefName(desc ocispec.Descriptor) ocispec.Descriptor {
+	if _, ok := desc.Annotations[ocispec.AnnotationRefName]; !ok {
+		// no ops
+		return desc
+	}
+
+	size := len(desc.Annotations) - 1
+	if size == 0 {
+		desc.Annotations = nil
+		return desc
+	}
+
+	annotations := make(map[string]string, size)
+	for k, v := range desc.Annotations {
+		if k != ocispec.AnnotationRefName {
+			annotations[k] = v
+		}
+	}
+	desc.Annotations = annotations
+	return desc
+}
diff --git a/vendor/oras.land/oras-go/v2/content/oci/readonlystorage.go b/vendor/oras.land/oras-go/v2/content/oci/readonlystorage.go
new file mode 100644
index 0000000000..8a5b39c514
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/oci/readonlystorage.go
@@ -0,0 +1,99 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oci
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"path"
+
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/fs/tarfs"
+)
+
+// ReadOnlyStorage is a read-only CAS based on file system with the OCI-Image
+// layout.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md
+type ReadOnlyStorage struct {
+	fsys fs.FS
+}
+
+// NewStorageFromFS creates a new read-only CAS from fsys.
+func NewStorageFromFS(fsys fs.FS) *ReadOnlyStorage {
+	return &ReadOnlyStorage{
+		fsys: fsys,
+	}
+}
+
+// NewStorageFromTar creates a new read-only CAS from a tar archive located at
+// path.
+func NewStorageFromTar(path string) (*ReadOnlyStorage, error) {
+	tfs, err := tarfs.New(path)
+	if err != nil {
+		return nil, err
+	}
+	return NewStorageFromFS(tfs), nil
+}
+
+// Fetch fetches the content identified by the descriptor.
+func (s *ReadOnlyStorage) Fetch(_ context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	path, err := blobPath(target.Digest)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %s: %w", target.Digest, target.MediaType, errdef.ErrInvalidDigest)
+	}
+
+	fp, err := s.fsys.Open(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, fmt.Errorf("%s: %s: %w", target.Digest, target.MediaType, errdef.ErrNotFound)
+		}
+		return nil, err
+	}
+
+	return fp, nil
+}
+
+// Exists returns true if the described content Exists.
+func (s *ReadOnlyStorage) Exists(_ context.Context, target ocispec.Descriptor) (bool, error) {
+	path, err := blobPath(target.Digest)
+	if err != nil {
+		return false, fmt.Errorf("%s: %s: %w", target.Digest, target.MediaType, errdef.ErrInvalidDigest)
+	}
+
+	_, err = fs.Stat(s.fsys, path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return false, nil
+		}
+		return false, err
+	}
+
+	return true, nil
+}
+
+// blobPath calculates blob path from the given digest.
+func blobPath(dgst digest.Digest) (string, error) {
+	if err := dgst.Validate(); err != nil {
+		return "", fmt.Errorf("cannot calculate blob path from invalid digest %s: %w: %v",
+			dgst.String(), errdef.ErrInvalidDigest, err)
+	}
+	return path.Join("blobs", dgst.Algorithm().String(), dgst.Encoded()), nil
+}
diff --git a/vendor/oras.land/oras-go/v2/content/oci/storage.go b/vendor/oras.land/oras-go/v2/content/oci/storage.go
new file mode 100644
index 0000000000..6b0e90a8c3
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/oci/storage.go
@@ -0,0 +1,151 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oci
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/ioutil"
+)
+
+// bufPool is a pool of byte buffers that can be reused for copying content
+// between files.
+var bufPool = sync.Pool{
+	New: func() interface{} {
+		// the buffer size should be larger than or equal to 128 KiB
+		// for performance considerations.
+		// we choose 1 MiB here so there will be less disk I/O.
+		buffer := make([]byte, 1<<20) // buffer size = 1 MiB
+		return &buffer
+	},
+}
+
+// Storage is a CAS based on file system with the OCI-Image layout.
+// Reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/image-layout.md
+type Storage struct {
+	*ReadOnlyStorage
+	// root is the root directory of the OCI layout.
+	root string
+	// ingestRoot is the root directory of the temporary ingest files.
+	ingestRoot string
+}
+
+// NewStorage creates a new CAS based on file system with the OCI-Image layout.
+func NewStorage(root string) (*Storage, error) {
+	rootAbs, err := filepath.Abs(root)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve absolute path for %s: %w", root, err)
+	}
+
+	return &Storage{
+		ReadOnlyStorage: NewStorageFromFS(os.DirFS(rootAbs)),
+		root:            rootAbs,
+		ingestRoot:      filepath.Join(rootAbs, "ingest"),
+	}, nil
+}
+
+// Push pushes the content, matching the expected descriptor.
+func (s *Storage) Push(_ context.Context, expected ocispec.Descriptor, content io.Reader) error {
+	path, err := blobPath(expected.Digest)
+	if err != nil {
+		return fmt.Errorf("%s: %s: %w", expected.Digest, expected.MediaType, errdef.ErrInvalidDigest)
+	}
+	target := filepath.Join(s.root, path)
+
+	// check if the target content already exists in the blob directory.
+	if _, err := os.Stat(target); err == nil {
+		return fmt.Errorf("%s: %s: %w", expected.Digest, expected.MediaType, errdef.ErrAlreadyExists)
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+
+	if err := ensureDir(filepath.Dir(target)); err != nil {
+		return err
+	}
+
+	// write the content to a temporary ingest file.
+	ingest, err := s.ingest(expected, content)
+	if err != nil {
+		return err
+	}
+
+	// move the content from the temporary ingest file to the target path.
+	// since blobs are read-only once stored, if the target blob already exists,
+	// Rename() will fail for permission denied when trying to overwrite it.
+	if err := os.Rename(ingest, target); err != nil {
+		// remove the ingest file in case of error
+		os.Remove(ingest)
+		if errors.Is(err, os.ErrPermission) {
+			return fmt.Errorf("%s: %s: %w", expected.Digest, expected.MediaType, errdef.ErrAlreadyExists)
+		}
+
+		return err
+	}
+
+	return nil
+}
+
+// ingest write the content into a temporary ingest file.
+func (s *Storage) ingest(expected ocispec.Descriptor, content io.Reader) (path string, ingestErr error) {
+	if err := ensureDir(s.ingestRoot); err != nil {
+		return "", fmt.Errorf("failed to ensure ingest dir: %w", err)
+	}
+
+	// create a temp file with the file name format "blobDigest_randomString"
+	// in the ingest directory.
+	// Go ensures that multiple programs or goroutines calling CreateTemp
+	// simultaneously will not choose the same file.
+	fp, err := os.CreateTemp(s.ingestRoot, expected.Digest.Encoded()+"_*")
+	if err != nil {
+		return "", fmt.Errorf("failed to create ingest file: %w", err)
+	}
+
+	path = fp.Name()
+	defer func() {
+		// remove the temp file in case of error.
+		// this executes after the file is closed.
+		if ingestErr != nil {
+			os.Remove(path)
+		}
+	}()
+	defer fp.Close()
+
+	buf := bufPool.Get().(*[]byte)
+	defer bufPool.Put(buf)
+	if err := ioutil.CopyBuffer(fp, content, *buf, expected); err != nil {
+		return "", fmt.Errorf("failed to ingest: %w", err)
+	}
+
+	// change to readonly
+	if err := os.Chmod(path, 0444); err != nil {
+		return "", fmt.Errorf("failed to make readonly: %w", err)
+	}
+
+	return
+}
+
+// ensureDir ensures the directories of the path exists.
+func ensureDir(path string) error {
+	return os.MkdirAll(path, 0777)
+}
diff --git a/vendor/oras.land/oras-go/v2/content/reader.go b/vendor/oras.land/oras-go/v2/content/reader.go
new file mode 100644
index 0000000000..11d27b236e
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/reader.go
@@ -0,0 +1,141 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+var (
+	// ErrInvalidDescriptorSize is returned by ReadAll() when
+	// the descriptor has an invalid size.
+	ErrInvalidDescriptorSize = errors.New("invalid descriptor size")
+
+	// ErrMismatchedDigest is returned by ReadAll() when
+	// the descriptor has an invalid digest.
+	ErrMismatchedDigest = errors.New("mismatched digest")
+
+	// ErrTrailingData is returned by ReadAll() when
+	// there exists trailing data unread when the read terminates.
+	ErrTrailingData = errors.New("trailing data")
+)
+
+var (
+	// errEarlyVerify is returned by VerifyReader.Verify() when
+	// Verify() is called before completing reading the entire content blob.
+	errEarlyVerify = errors.New("early verify")
+)
+
+// VerifyReader reads the content described by its descriptor and verifies
+// against its size and digest.
+type VerifyReader struct {
+	base     *io.LimitedReader
+	verifier digest.Verifier
+	verified bool
+	err      error
+}
+
+// Read reads up to len(p) bytes into p. It returns the number of bytes
+// read (0 <= n <= len(p)) and any error encountered.
+func (vr *VerifyReader) Read(p []byte) (n int, err error) {
+	if vr.err != nil {
+		return 0, vr.err
+	}
+
+	n, err = vr.base.Read(p)
+	if err != nil {
+		if err == io.EOF && vr.base.N > 0 {
+			err = io.ErrUnexpectedEOF
+		}
+		vr.err = err
+	}
+	return
+}
+
+// Verify verifies the read content against the size and the digest.
+func (vr *VerifyReader) Verify() error {
+	if vr.verified {
+		return nil
+	}
+	if vr.err == nil {
+		if vr.base.N > 0 {
+			return errEarlyVerify
+		}
+	} else if vr.err != io.EOF {
+		return vr.err
+	}
+
+	if err := ensureEOF(vr.base.R); err != nil {
+		vr.err = err
+		return vr.err
+	}
+	if !vr.verifier.Verified() {
+		vr.err = ErrMismatchedDigest
+		return vr.err
+	}
+
+	vr.verified = true
+	vr.err = io.EOF
+	return nil
+}
+
+// NewVerifyReader wraps r for reading content with verification against desc.
+func NewVerifyReader(r io.Reader, desc ocispec.Descriptor) *VerifyReader {
+	verifier := desc.Digest.Verifier()
+	lr := &io.LimitedReader{
+		R: io.TeeReader(r, verifier),
+		N: desc.Size,
+	}
+	return &VerifyReader{
+		base:     lr,
+		verifier: verifier,
+	}
+}
+
+// ReadAll safely reads the content described by the descriptor.
+// The read content is verified against the size and the digest
+// using a VerifyReader.
+func ReadAll(r io.Reader, desc ocispec.Descriptor) ([]byte, error) {
+	if desc.Size < 0 {
+		return nil, ErrInvalidDescriptorSize
+	}
+	buf := make([]byte, desc.Size)
+
+	vr := NewVerifyReader(r, desc)
+	if _, err := io.ReadFull(vr, buf); err != nil {
+		return nil, fmt.Errorf("read failed: %w", err)
+	}
+	if err := vr.Verify(); err != nil {
+		return nil, err
+	}
+	return buf, nil
+}
+
+// ensureEOF ensures the read operation ends with an EOF and no
+// trailing data is present.
+func ensureEOF(r io.Reader) error {
+	var peek [1]byte
+	_, err := io.ReadFull(r, peek[:])
+	if err != io.EOF {
+		return ErrTrailingData
+	}
+	return nil
+}
diff --git a/vendor/oras.land/oras-go/v2/content/resolver.go b/vendor/oras.land/oras-go/v2/content/resolver.go
new file mode 100644
index 0000000000..b536b5ddca
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/resolver.go
@@ -0,0 +1,41 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package content provides implementations to access content stores.
+package content
+
+import (
+	"context"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// Resolver resolves reference tags.
+type Resolver interface {
+	// Resolve resolves a reference to a descriptor.
+	Resolve(ctx context.Context, reference string) (ocispec.Descriptor, error)
+}
+
+// Tagger tags reference tags.
+type Tagger interface {
+	// Tag tags a descriptor with a reference string.
+	Tag(ctx context.Context, desc ocispec.Descriptor, reference string) error
+}
+
+// TagResolver provides reference tag indexing services.
+type TagResolver interface {
+	Tagger
+	Resolver
+}
diff --git a/vendor/oras.land/oras-go/v2/content/storage.go b/vendor/oras.land/oras-go/v2/content/storage.go
new file mode 100644
index 0000000000..971142cbf9
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/content/storage.go
@@ -0,0 +1,80 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"context"
+	"io"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// Fetcher fetches content.
+type Fetcher interface {
+	// Fetch fetches the content identified by the descriptor.
+	Fetch(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error)
+}
+
+// Pusher pushes content.
+type Pusher interface {
+	// Push pushes the content, matching the expected descriptor.
+	// Reader is perferred to Writer so that the suitable buffer size can be
+	// chosen by the underlying implementation. Furthermore, the implementation
+	// can also do reflection on the Reader for more advanced I/O optimization.
+	Push(ctx context.Context, expected ocispec.Descriptor, content io.Reader) error
+}
+
+// Storage represents a content-addressable storage (CAS) where contents are
+// accessed via Descriptors.
+// The storage is designed to handle blobs of large sizes.
+type Storage interface {
+	ReadOnlyStorage
+	Pusher
+}
+
+// ReadOnlyStorage represents a read-only Storage.
+type ReadOnlyStorage interface {
+	Fetcher
+
+	// Exists returns true if the described content exists.
+	Exists(ctx context.Context, target ocispec.Descriptor) (bool, error)
+}
+
+// Deleter removes content.
+// Deleter is an extension of Storage.
+type Deleter interface {
+	// Delete removes the content identified by the descriptor.
+	Delete(ctx context.Context, target ocispec.Descriptor) error
+}
+
+// FetchAll safely fetches the content described by the descriptor.
+// The fetched content is verified against the size and the digest.
+func FetchAll(ctx context.Context, fetcher Fetcher, desc ocispec.Descriptor) ([]byte, error) {
+	rc, err := fetcher.Fetch(ctx, desc)
+	if err != nil {
+		return nil, err
+	}
+	defer rc.Close()
+	return ReadAll(rc, desc)
+}
+
+// FetcherFunc is the basic Fetch method defined in Fetcher.
+type FetcherFunc func(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error)
+
+// Fetch performs Fetch operation by the FetcherFunc.
+func (fn FetcherFunc) Fetch(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	return fn(ctx, target)
+}
diff --git a/vendor/oras.land/oras-go/v2/copy.go b/vendor/oras.land/oras-go/v2/copy.go
new file mode 100644
index 0000000000..e55312dd48
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/copy.go
@@ -0,0 +1,426 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oras
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"golang.org/x/sync/semaphore"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/cas"
+	"oras.land/oras-go/v2/internal/descriptor"
+	"oras.land/oras-go/v2/internal/platform"
+	"oras.land/oras-go/v2/internal/registryutil"
+	"oras.land/oras-go/v2/internal/status"
+	"oras.land/oras-go/v2/internal/syncutil"
+	"oras.land/oras-go/v2/registry"
+)
+
+// defaultConcurrency is the default value of CopyGraphOptions.Concurrency.
+const defaultConcurrency int = 3 // This value is consistent with dockerd and containerd.
+
+// errSkipDesc signals copyNode() to stop processing a descriptor.
+var errSkipDesc = errors.New("skip descriptor")
+
+// DefaultCopyOptions provides the default CopyOptions.
+var DefaultCopyOptions CopyOptions = CopyOptions{
+	CopyGraphOptions: DefaultCopyGraphOptions,
+}
+
+// CopyOptions contains parameters for [oras.Copy].
+type CopyOptions struct {
+	CopyGraphOptions
+	// MapRoot maps the resolved root node to a desired root node for copy.
+	// When MapRoot is provided, the descriptor resolved from the source
+	// reference will be passed to MapRoot, and the mapped descriptor will be
+	// used as the root node for copy.
+	MapRoot func(ctx context.Context, src content.ReadOnlyStorage, root ocispec.Descriptor) (ocispec.Descriptor, error)
+}
+
+// WithTargetPlatform configures opts.MapRoot to select the manifest whose
+// platform matches the given platform. When MapRoot is provided, the platform
+// selection will be applied on the mapped root node.
+//   - If the given platform is nil, no platform selection will be applied.
+//   - If the root node is a manifest, it will remain the same if platform
+//     matches, otherwise ErrNotFound will be returned.
+//   - If the root node is a manifest list, it will be mapped to the first
+//     matching manifest if exists, otherwise ErrNotFound will be returned.
+//   - Otherwise ErrUnsupported will be returned.
+func (opts *CopyOptions) WithTargetPlatform(p *ocispec.Platform) {
+	if p == nil {
+		return
+	}
+	mapRoot := opts.MapRoot
+	opts.MapRoot = func(ctx context.Context, src content.ReadOnlyStorage, root ocispec.Descriptor) (desc ocispec.Descriptor, err error) {
+		if mapRoot != nil {
+			if root, err = mapRoot(ctx, src, root); err != nil {
+				return ocispec.Descriptor{}, err
+			}
+		}
+		return platform.SelectManifest(ctx, src, root, p)
+	}
+}
+
+// defaultCopyMaxMetadataBytes is the default value of
+// CopyGraphOptions.MaxMetadataBytes.
+const defaultCopyMaxMetadataBytes int64 = 4 * 1024 * 1024 // 4 MiB
+
+// DefaultCopyGraphOptions provides the default CopyGraphOptions.
+var DefaultCopyGraphOptions CopyGraphOptions
+
+// CopyGraphOptions contains parameters for [oras.CopyGraph].
+type CopyGraphOptions struct {
+	// Concurrency limits the maximum number of concurrent copy tasks.
+	// If less than or equal to 0, a default (currently 3) is used.
+	Concurrency int
+	// MaxMetadataBytes limits the maximum size of the metadata that can be
+	// cached in the memory.
+	// If less than or equal to 0, a default (currently 4 MiB) is used.
+	MaxMetadataBytes int64
+	// PreCopy handles the current descriptor before copying it.
+	PreCopy func(ctx context.Context, desc ocispec.Descriptor) error
+	// PostCopy handles the current descriptor after copying it.
+	PostCopy func(ctx context.Context, desc ocispec.Descriptor) error
+	// OnCopySkipped will be called when the sub-DAG rooted by the current node
+	// is skipped.
+	OnCopySkipped func(ctx context.Context, desc ocispec.Descriptor) error
+	// FindSuccessors finds the successors of the current node.
+	// fetcher provides cached access to the source storage, and is suitable
+	// for fetching non-leaf nodes like manifests. Since anything fetched from
+	// fetcher will be cached in the memory, it is recommended to use original
+	// source storage to fetch large blobs.
+	// If FindSuccessors is nil, content.Successors will be used.
+	FindSuccessors func(ctx context.Context, fetcher content.Fetcher, desc ocispec.Descriptor) ([]ocispec.Descriptor, error)
+}
+
+// Copy copies a rooted directed acyclic graph (DAG) with the tagged root node
+// in the source Target to the destination Target.
+// The destination reference will be the same as the source reference if the
+// destination reference is left blank.
+//
+// Returns the descriptor of the root node on successful copy.
+func Copy(ctx context.Context, src ReadOnlyTarget, srcRef string, dst Target, dstRef string, opts CopyOptions) (ocispec.Descriptor, error) {
+	if src == nil {
+		return ocispec.Descriptor{}, errors.New("nil source target")
+	}
+	if dst == nil {
+		return ocispec.Descriptor{}, errors.New("nil destination target")
+	}
+	if dstRef == "" {
+		dstRef = srcRef
+	}
+
+	// use caching proxy on non-leaf nodes
+	if opts.MaxMetadataBytes <= 0 {
+		opts.MaxMetadataBytes = defaultCopyMaxMetadataBytes
+	}
+	proxy := cas.NewProxyWithLimit(src, cas.NewMemory(), opts.MaxMetadataBytes)
+	root, err := resolveRoot(ctx, src, srcRef, proxy)
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to resolve %s: %w", srcRef, err)
+	}
+
+	if opts.MapRoot != nil {
+		proxy.StopCaching = true
+		root, err = opts.MapRoot(ctx, proxy, root)
+		if err != nil {
+			return ocispec.Descriptor{}, err
+		}
+		proxy.StopCaching = false
+	}
+
+	if err := prepareCopy(ctx, dst, dstRef, proxy, root, &opts); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	if err := copyGraph(ctx, src, dst, root, proxy, nil, nil, opts.CopyGraphOptions); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	return root, nil
+}
+
+// CopyGraph copies a rooted directed acyclic graph (DAG) from the source CAS to
+// the destination CAS.
+func CopyGraph(ctx context.Context, src content.ReadOnlyStorage, dst content.Storage, root ocispec.Descriptor, opts CopyGraphOptions) error {
+	return copyGraph(ctx, src, dst, root, nil, nil, nil, opts)
+}
+
+// copyGraph copies a rooted directed acyclic graph (DAG) from the source CAS to
+// the destination CAS with specified caching, concurrency limiter and tracker.
+func copyGraph(ctx context.Context, src content.ReadOnlyStorage, dst content.Storage, root ocispec.Descriptor,
+	proxy *cas.Proxy, limiter *semaphore.Weighted, tracker *status.Tracker, opts CopyGraphOptions) error {
+	if proxy == nil {
+		// use caching proxy on non-leaf nodes
+		if opts.MaxMetadataBytes <= 0 {
+			opts.MaxMetadataBytes = defaultCopyMaxMetadataBytes
+		}
+		proxy = cas.NewProxyWithLimit(src, cas.NewMemory(), opts.MaxMetadataBytes)
+	}
+	if limiter == nil {
+		// if Concurrency is not set or invalid, use the default concurrency
+		if opts.Concurrency <= 0 {
+			opts.Concurrency = defaultConcurrency
+		}
+		limiter = semaphore.NewWeighted(int64(opts.Concurrency))
+	}
+	if tracker == nil {
+		// track content status
+		tracker = status.NewTracker()
+	}
+	// if FindSuccessors is not provided, use the default one
+	if opts.FindSuccessors == nil {
+		opts.FindSuccessors = content.Successors
+	}
+
+	// traverse the graph
+	var fn syncutil.GoFunc[ocispec.Descriptor]
+	fn = func(ctx context.Context, region *syncutil.LimitedRegion, desc ocispec.Descriptor) (err error) {
+		// skip the descriptor if other go routine is working on it
+		done, committed := tracker.TryCommit(desc)
+		if !committed {
+			return nil
+		}
+		defer func() {
+			if err == nil {
+				// mark the content as done on success
+				close(done)
+			}
+		}()
+
+		// skip if a rooted sub-DAG exists
+		exists, err := dst.Exists(ctx, desc)
+		if err != nil {
+			return err
+		}
+		if exists {
+			if opts.OnCopySkipped != nil {
+				if err := opts.OnCopySkipped(ctx, desc); err != nil {
+					return err
+				}
+			}
+			return nil
+		}
+
+		// find successors while non-leaf nodes will be fetched and cached
+		successors, err := opts.FindSuccessors(ctx, proxy, desc)
+		if err != nil {
+			return err
+		}
+		successors = removeForeignLayers(successors)
+
+		if len(successors) != 0 {
+			// for non-leaf nodes, process successors and wait for them to complete
+			region.End()
+			if err := syncutil.Go(ctx, limiter, fn, successors...); err != nil {
+				return err
+			}
+			for _, node := range successors {
+				done, committed := tracker.TryCommit(node)
+				if committed {
+					return fmt.Errorf("%s: %s: successor not committed", desc.Digest, node.Digest)
+				}
+				select {
+				case <-done:
+				case <-ctx.Done():
+					return ctx.Err()
+				}
+			}
+			if err := region.Start(); err != nil {
+				return err
+			}
+		}
+
+		exists, err = proxy.Cache.Exists(ctx, desc)
+		if err != nil {
+			return err
+		}
+		if exists {
+			return copyNode(ctx, proxy.Cache, dst, desc, opts)
+		}
+		return copyNode(ctx, src, dst, desc, opts)
+	}
+
+	return syncutil.Go(ctx, limiter, fn, root)
+}
+
+// doCopyNode copies a single content from the source CAS to the destination CAS.
+func doCopyNode(ctx context.Context, src content.ReadOnlyStorage, dst content.Storage, desc ocispec.Descriptor) error {
+	rc, err := src.Fetch(ctx, desc)
+	if err != nil {
+		return err
+	}
+	defer rc.Close()
+	err = dst.Push(ctx, desc, rc)
+	if err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+		return err
+	}
+	return nil
+}
+
+// copyNode copies a single content from the source CAS to the destination CAS,
+// and apply the given options.
+func copyNode(ctx context.Context, src content.ReadOnlyStorage, dst content.Storage, desc ocispec.Descriptor, opts CopyGraphOptions) error {
+	if opts.PreCopy != nil {
+		if err := opts.PreCopy(ctx, desc); err != nil {
+			if err == errSkipDesc {
+				return nil
+			}
+			return err
+		}
+	}
+
+	if err := doCopyNode(ctx, src, dst, desc); err != nil {
+		return err
+	}
+
+	if opts.PostCopy != nil {
+		return opts.PostCopy(ctx, desc)
+	}
+	return nil
+}
+
+// copyCachedNodeWithReference copies a single content with a reference from the
+// source cache to the destination ReferencePusher.
+func copyCachedNodeWithReference(ctx context.Context, src *cas.Proxy, dst registry.ReferencePusher, desc ocispec.Descriptor, dstRef string) error {
+	rc, err := src.FetchCached(ctx, desc)
+	if err != nil {
+		return err
+	}
+	defer rc.Close()
+
+	err = dst.PushReference(ctx, desc, rc, dstRef)
+	if err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+		return err
+	}
+	return nil
+}
+
+// resolveRoot resolves the source reference to the root node.
+func resolveRoot(ctx context.Context, src ReadOnlyTarget, srcRef string, proxy *cas.Proxy) (ocispec.Descriptor, error) {
+	refFetcher, ok := src.(registry.ReferenceFetcher)
+	if !ok {
+		return src.Resolve(ctx, srcRef)
+	}
+
+	// optimize performance for ReferenceFetcher targets
+	refProxy := &registryutil.Proxy{
+		ReferenceFetcher: refFetcher,
+		Proxy:            proxy,
+	}
+	root, rc, err := refProxy.FetchReference(ctx, srcRef)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	defer rc.Close()
+	// cache root if it is a non-leaf node
+	fetcher := content.FetcherFunc(func(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+		if content.Equal(target, root) {
+			return rc, nil
+		}
+		return nil, errors.New("fetching only root node expected")
+	})
+	if _, err = content.Successors(ctx, fetcher, root); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	// TODO: optimize special case where root is a leaf node (i.e. a blob)
+	//       and dst is a ReferencePusher.
+	return root, nil
+}
+
+// prepareCopy prepares the hooks for copy.
+func prepareCopy(ctx context.Context, dst Target, dstRef string, proxy *cas.Proxy, root ocispec.Descriptor, opts *CopyOptions) error {
+	if refPusher, ok := dst.(registry.ReferencePusher); ok {
+		// optimize performance for ReferencePusher targets
+		preCopy := opts.PreCopy
+		opts.PreCopy = func(ctx context.Context, desc ocispec.Descriptor) error {
+			if preCopy != nil {
+				if err := preCopy(ctx, desc); err != nil {
+					return err
+				}
+			}
+			if !content.Equal(desc, root) {
+				// for non-root node, do nothing
+				return nil
+			}
+
+			// for root node, prepare optimized copy
+			if err := copyCachedNodeWithReference(ctx, proxy, refPusher, desc, dstRef); err != nil {
+				return err
+			}
+			if opts.PostCopy != nil {
+				if err := opts.PostCopy(ctx, desc); err != nil {
+					return err
+				}
+			}
+			// skip the regular copy workflow
+			return errSkipDesc
+		}
+	} else {
+		postCopy := opts.PostCopy
+		opts.PostCopy = func(ctx context.Context, desc ocispec.Descriptor) error {
+			if content.Equal(desc, root) {
+				// for root node, tag it after copying it
+				if err := dst.Tag(ctx, root, dstRef); err != nil {
+					return err
+				}
+			}
+			if postCopy != nil {
+				return postCopy(ctx, desc)
+			}
+			return nil
+		}
+	}
+
+	onCopySkipped := opts.OnCopySkipped
+	opts.OnCopySkipped = func(ctx context.Context, desc ocispec.Descriptor) error {
+		if onCopySkipped != nil {
+			if err := onCopySkipped(ctx, desc); err != nil {
+				return err
+			}
+		}
+		if !content.Equal(desc, root) {
+			return nil
+		}
+		// enforce tagging when root is skipped
+		if refPusher, ok := dst.(registry.ReferencePusher); ok {
+			return copyCachedNodeWithReference(ctx, proxy, refPusher, desc, dstRef)
+		}
+		return dst.Tag(ctx, root, dstRef)
+	}
+
+	return nil
+}
+
+// removeForeignLayers in-place removes all foreign layers in the given slice.
+func removeForeignLayers(descs []ocispec.Descriptor) []ocispec.Descriptor {
+	var j int
+	for i, desc := range descs {
+		if !descriptor.IsForeignLayer(desc) {
+			if i != j {
+				descs[j] = desc
+			}
+			j++
+		}
+	}
+	return descs[:j]
+}
diff --git a/vendor/oras.land/oras-go/v2/errdef/errors.go b/vendor/oras.land/oras-go/v2/errdef/errors.go
new file mode 100644
index 0000000000..030360edb7
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/errdef/errors.go
@@ -0,0 +1,30 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errdef
+
+import "errors"
+
+// Common errors used in ORAS
+var (
+	ErrAlreadyExists      = errors.New("already exists")
+	ErrInvalidDigest      = errors.New("invalid digest")
+	ErrInvalidReference   = errors.New("invalid reference")
+	ErrMissingReference   = errors.New("missing reference")
+	ErrNotFound           = errors.New("not found")
+	ErrSizeExceedsLimit   = errors.New("size exceeds limit")
+	ErrUnsupported        = errors.New("unsupported")
+	ErrUnsupportedVersion = errors.New("unsupported version")
+)
diff --git a/vendor/oras.land/oras-go/v2/extendedcopy.go b/vendor/oras.land/oras-go/v2/extendedcopy.go
new file mode 100644
index 0000000000..49b6264ec6
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/extendedcopy.go
@@ -0,0 +1,389 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oras
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"regexp"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"golang.org/x/sync/semaphore"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/internal/cas"
+	"oras.land/oras-go/v2/internal/container/set"
+	"oras.land/oras-go/v2/internal/copyutil"
+	"oras.land/oras-go/v2/internal/descriptor"
+	"oras.land/oras-go/v2/internal/docker"
+	"oras.land/oras-go/v2/internal/spec"
+	"oras.land/oras-go/v2/internal/status"
+	"oras.land/oras-go/v2/internal/syncutil"
+	"oras.land/oras-go/v2/registry"
+)
+
+// DefaultExtendedCopyOptions provides the default ExtendedCopyOptions.
+var DefaultExtendedCopyOptions ExtendedCopyOptions = ExtendedCopyOptions{
+	ExtendedCopyGraphOptions: DefaultExtendedCopyGraphOptions,
+}
+
+// ExtendedCopyOptions contains parameters for [oras.ExtendedCopy].
+type ExtendedCopyOptions struct {
+	ExtendedCopyGraphOptions
+}
+
+// DefaultExtendedCopyGraphOptions provides the default ExtendedCopyGraphOptions.
+var DefaultExtendedCopyGraphOptions ExtendedCopyGraphOptions = ExtendedCopyGraphOptions{
+	CopyGraphOptions: DefaultCopyGraphOptions,
+}
+
+// ExtendedCopyGraphOptions contains parameters for [oras.ExtendedCopyGraph].
+type ExtendedCopyGraphOptions struct {
+	CopyGraphOptions
+	// Depth limits the maximum depth of the directed acyclic graph (DAG) that
+	// will be extended-copied.
+	// If Depth is no specified, or the specified value is less than or
+	// equal to 0, the depth limit will be considered as infinity.
+	Depth int
+	// FindPredecessors finds the predecessors of the current node.
+	// If FindPredecessors is nil, src.Predecessors will be adapted and used.
+	FindPredecessors func(ctx context.Context, src content.ReadOnlyGraphStorage, desc ocispec.Descriptor) ([]ocispec.Descriptor, error)
+}
+
+// ExtendedCopy copies the directed acyclic graph (DAG) that are reachable from
+// the given tagged node from the source GraphTarget to the destination Target.
+// The destination reference will be the same as the source reference if the
+// destination reference is left blank.
+//
+// Returns the descriptor of the tagged node on successful copy.
+func ExtendedCopy(ctx context.Context, src ReadOnlyGraphTarget, srcRef string, dst Target, dstRef string, opts ExtendedCopyOptions) (ocispec.Descriptor, error) {
+	if src == nil {
+		return ocispec.Descriptor{}, errors.New("nil source graph target")
+	}
+	if dst == nil {
+		return ocispec.Descriptor{}, errors.New("nil destination target")
+	}
+	if dstRef == "" {
+		dstRef = srcRef
+	}
+
+	node, err := src.Resolve(ctx, srcRef)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	if err := ExtendedCopyGraph(ctx, src, dst, node, opts.ExtendedCopyGraphOptions); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	if err := dst.Tag(ctx, node, dstRef); err != nil {
+		return ocispec.Descriptor{}, err
+	}
+
+	return node, nil
+}
+
+// ExtendedCopyGraph copies the directed acyclic graph (DAG) that are reachable
+// from the given node from the source GraphStorage to the destination Storage.
+func ExtendedCopyGraph(ctx context.Context, src content.ReadOnlyGraphStorage, dst content.Storage, node ocispec.Descriptor, opts ExtendedCopyGraphOptions) error {
+	roots, err := findRoots(ctx, src, node, opts)
+	if err != nil {
+		return err
+	}
+
+	// if Concurrency is not set or invalid, use the default concurrency
+	if opts.Concurrency <= 0 {
+		opts.Concurrency = defaultConcurrency
+	}
+	limiter := semaphore.NewWeighted(int64(opts.Concurrency))
+	// use caching proxy on non-leaf nodes
+	if opts.MaxMetadataBytes <= 0 {
+		opts.MaxMetadataBytes = defaultCopyMaxMetadataBytes
+	}
+	proxy := cas.NewProxyWithLimit(src, cas.NewMemory(), opts.MaxMetadataBytes)
+	// track content status
+	tracker := status.NewTracker()
+
+	// copy the sub-DAGs rooted by the root nodes
+	return syncutil.Go(ctx, limiter, func(ctx context.Context, region *syncutil.LimitedRegion, root ocispec.Descriptor) error {
+		// As a root can be a predecessor of other roots, release the limit here
+		// for dispatching, to avoid dead locks where predecessor roots are
+		// handled first and are waiting for its successors to complete.
+		region.End()
+		if err := copyGraph(ctx, src, dst, root, proxy, limiter, tracker, opts.CopyGraphOptions); err != nil {
+			return err
+		}
+		return region.Start()
+	}, roots...)
+}
+
+// findRoots finds the root nodes reachable from the given node through a
+// depth-first search.
+func findRoots(ctx context.Context, storage content.ReadOnlyGraphStorage, node ocispec.Descriptor, opts ExtendedCopyGraphOptions) ([]ocispec.Descriptor, error) {
+	visited := set.New[descriptor.Descriptor]()
+	rootMap := make(map[descriptor.Descriptor]ocispec.Descriptor)
+	addRoot := func(key descriptor.Descriptor, val ocispec.Descriptor) {
+		if _, exists := rootMap[key]; !exists {
+			rootMap[key] = val
+		}
+	}
+
+	// if FindPredecessors is not provided, use the default one
+	if opts.FindPredecessors == nil {
+		opts.FindPredecessors = func(ctx context.Context, src content.ReadOnlyGraphStorage, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+			return src.Predecessors(ctx, desc)
+		}
+	}
+
+	var stack copyutil.Stack
+	// push the initial node to the stack, set the depth to 0
+	stack.Push(copyutil.NodeInfo{Node: node, Depth: 0})
+	for {
+		current, ok := stack.Pop()
+		if !ok {
+			// empty stack
+			break
+		}
+		currentNode := current.Node
+		currentKey := descriptor.FromOCI(currentNode)
+
+		if visited.Contains(currentKey) {
+			// skip the current node if it has been visited
+			continue
+		}
+		visited.Add(currentKey)
+
+		// stop finding predecessors if the target depth is reached
+		if opts.Depth > 0 && current.Depth == opts.Depth {
+			addRoot(currentKey, currentNode)
+			continue
+		}
+
+		predecessors, err := opts.FindPredecessors(ctx, storage, currentNode)
+		if err != nil {
+			return nil, err
+		}
+
+		// The current node has no predecessor node,
+		// which means it is a root node of a sub-DAG.
+		if len(predecessors) == 0 {
+			addRoot(currentKey, currentNode)
+			continue
+		}
+
+		// The current node has predecessor nodes, which means it is NOT a root node.
+		// Push the predecessor nodes to the stack and keep finding from there.
+		for _, predecessor := range predecessors {
+			predecessorKey := descriptor.FromOCI(predecessor)
+			if !visited.Contains(predecessorKey) {
+				// push the predecessor node with increased depth
+				stack.Push(copyutil.NodeInfo{Node: predecessor, Depth: current.Depth + 1})
+			}
+		}
+	}
+
+	roots := make([]ocispec.Descriptor, 0, len(rootMap))
+	for _, root := range rootMap {
+		roots = append(roots, root)
+	}
+	return roots, nil
+}
+
+// FilterAnnotation configures opts.FindPredecessors to filter the predecessors
+// whose annotation matches a given regex pattern.
+//
+// A predecessor is kept if key is in its annotations and the annotation value
+// matches regex.
+// If regex is nil, predecessors whose annotations contain key will be kept,
+// no matter of the annotation value.
+//
+// For performance consideration, when using both FilterArtifactType and
+// FilterAnnotation, it's recommended to call FilterArtifactType first.
+func (opts *ExtendedCopyGraphOptions) FilterAnnotation(key string, regex *regexp.Regexp) {
+	keep := func(desc ocispec.Descriptor) bool {
+		value, ok := desc.Annotations[key]
+		return ok && (regex == nil || regex.MatchString(value))
+	}
+
+	fp := opts.FindPredecessors
+	opts.FindPredecessors = func(ctx context.Context, src content.ReadOnlyGraphStorage, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		var predecessors []ocispec.Descriptor
+		var err error
+		if fp == nil {
+			if rf, ok := src.(registry.ReferrerLister); ok {
+				// if src is a ReferrerLister, use Referrers() for possible memory saving
+				if err := rf.Referrers(ctx, desc, "", func(referrers []ocispec.Descriptor) error {
+					// for each page of the results, filter the referrers
+					for _, r := range referrers {
+						if keep(r) {
+							predecessors = append(predecessors, r)
+						}
+					}
+					return nil
+				}); err != nil {
+					return nil, err
+				}
+				return predecessors, nil
+			}
+			predecessors, err = src.Predecessors(ctx, desc)
+		} else {
+			predecessors, err = fp(ctx, src, desc)
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// Predecessor descriptors that are not from Referrers API are not
+		// guaranteed to include the annotations of the corresponding manifests.
+		var kept []ocispec.Descriptor
+		for _, p := range predecessors {
+			if p.Annotations == nil {
+				// If the annotations are not present in the descriptors,
+				// fetch it from the manifest content.
+				switch p.MediaType {
+				case docker.MediaTypeManifest, ocispec.MediaTypeImageManifest,
+					docker.MediaTypeManifestList, ocispec.MediaTypeImageIndex,
+					spec.MediaTypeArtifactManifest:
+					annotations, err := fetchAnnotations(ctx, src, p)
+					if err != nil {
+						return nil, err
+					}
+					p.Annotations = annotations
+				}
+			}
+			if keep(p) {
+				kept = append(kept, p)
+			}
+		}
+		return kept, nil
+	}
+}
+
+// fetchAnnotations fetches the annotations of the manifest described by desc.
+func fetchAnnotations(ctx context.Context, src content.ReadOnlyGraphStorage, desc ocispec.Descriptor) (map[string]string, error) {
+	rc, err := src.Fetch(ctx, desc)
+	if err != nil {
+		return nil, err
+	}
+	defer rc.Close()
+
+	var manifest struct {
+		Annotations map[string]string `json:"annotations"`
+	}
+	if err := json.NewDecoder(rc).Decode(&manifest); err != nil {
+		return nil, err
+	}
+	if manifest.Annotations == nil {
+		// to differentiate with nil
+		return make(map[string]string), nil
+	}
+	return manifest.Annotations, nil
+}
+
+// FilterArtifactType configures opts.FindPredecessors to filter the
+// predecessors whose artifact type matches a given regex pattern.
+//
+// A predecessor is kept if its artifact type matches regex.
+// If regex is nil, all predecessors will be kept.
+//
+// For performance consideration, when using both FilterArtifactType and
+// FilterAnnotation, it's recommended to call FilterArtifactType first.
+func (opts *ExtendedCopyGraphOptions) FilterArtifactType(regex *regexp.Regexp) {
+	if regex == nil {
+		return
+	}
+	keep := func(desc ocispec.Descriptor) bool {
+		return regex.MatchString(desc.ArtifactType)
+	}
+
+	fp := opts.FindPredecessors
+	opts.FindPredecessors = func(ctx context.Context, src content.ReadOnlyGraphStorage, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		var predecessors []ocispec.Descriptor
+		var err error
+		if fp == nil {
+			if rf, ok := src.(registry.ReferrerLister); ok {
+				// if src is a ReferrerLister, use Referrers() for possible memory saving
+				if err := rf.Referrers(ctx, desc, "", func(referrers []ocispec.Descriptor) error {
+					// for each page of the results, filter the referrers
+					for _, r := range referrers {
+						if keep(r) {
+							predecessors = append(predecessors, r)
+						}
+					}
+					return nil
+				}); err != nil {
+					return nil, err
+				}
+				return predecessors, nil
+			}
+			predecessors, err = src.Predecessors(ctx, desc)
+		} else {
+			predecessors, err = fp(ctx, src, desc)
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// predecessor descriptors that are not from Referrers API are not
+		// guaranteed to include the artifact type of the corresponding
+		// manifests.
+		var kept []ocispec.Descriptor
+		for _, p := range predecessors {
+			if p.ArtifactType == "" {
+				// if the artifact type is not present in the descriptors,
+				// fetch it from the manifest content.
+				switch p.MediaType {
+				case spec.MediaTypeArtifactManifest, ocispec.MediaTypeImageManifest:
+					artifactType, err := fetchArtifactType(ctx, src, p)
+					if err != nil {
+						return nil, err
+					}
+					p.ArtifactType = artifactType
+				}
+			}
+			if keep(p) {
+				kept = append(kept, p)
+			}
+		}
+		return kept, nil
+	}
+}
+
+// fetchArtifactType fetches the artifact type of the manifest described by desc.
+func fetchArtifactType(ctx context.Context, src content.ReadOnlyGraphStorage, desc ocispec.Descriptor) (string, error) {
+	rc, err := src.Fetch(ctx, desc)
+	if err != nil {
+		return "", err
+	}
+	defer rc.Close()
+
+	switch desc.MediaType {
+	case spec.MediaTypeArtifactManifest:
+		var manifest spec.Artifact
+		if err := json.NewDecoder(rc).Decode(&manifest); err != nil {
+			return "", err
+		}
+		return manifest.ArtifactType, nil
+	case ocispec.MediaTypeImageManifest:
+		var manifest ocispec.Manifest
+		if err := json.NewDecoder(rc).Decode(&manifest); err != nil {
+			return "", err
+		}
+		return manifest.Config.MediaType, nil
+	default:
+		return "", nil
+	}
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/cas/memory.go b/vendor/oras.land/oras-go/v2/internal/cas/memory.go
new file mode 100644
index 0000000000..7e358e136c
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/cas/memory.go
@@ -0,0 +1,88 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cas
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	contentpkg "oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/descriptor"
+)
+
+// Memory is a memory based CAS.
+type Memory struct {
+	content sync.Map // map[descriptor.Descriptor][]byte
+}
+
+// NewMemory creates a new Memory CAS.
+func NewMemory() *Memory {
+	return &Memory{}
+}
+
+// Fetch fetches the content identified by the descriptor.
+func (m *Memory) Fetch(_ context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	key := descriptor.FromOCI(target)
+	content, exists := m.content.Load(key)
+	if !exists {
+		return nil, fmt.Errorf("%s: %s: %w", key.Digest, key.MediaType, errdef.ErrNotFound)
+	}
+	return io.NopCloser(bytes.NewReader(content.([]byte))), nil
+}
+
+// Push pushes the content, matching the expected descriptor.
+func (m *Memory) Push(_ context.Context, expected ocispec.Descriptor, content io.Reader) error {
+	key := descriptor.FromOCI(expected)
+
+	// check if the content exists in advance to avoid reading from the content.
+	if _, exists := m.content.Load(key); exists {
+		return fmt.Errorf("%s: %s: %w", key.Digest, key.MediaType, errdef.ErrAlreadyExists)
+	}
+
+	// read and try to store the content.
+	value, err := contentpkg.ReadAll(content, expected)
+	if err != nil {
+		return err
+	}
+	if _, exists := m.content.LoadOrStore(key, value); exists {
+		return fmt.Errorf("%s: %s: %w", key.Digest, key.MediaType, errdef.ErrAlreadyExists)
+	}
+	return nil
+}
+
+// Exists returns true if the described content exists.
+func (m *Memory) Exists(_ context.Context, target ocispec.Descriptor) (bool, error) {
+	key := descriptor.FromOCI(target)
+	_, exists := m.content.Load(key)
+	return exists, nil
+}
+
+// Map dumps the memory into a built-in map structure.
+// Like other operations, calling Map() is go-routine safe. However, it does not
+// necessarily correspond to any consistent snapshot of the storage contents.
+func (m *Memory) Map() map[descriptor.Descriptor][]byte {
+	res := make(map[descriptor.Descriptor][]byte)
+	m.content.Range(func(key, value interface{}) bool {
+		res[key.(descriptor.Descriptor)] = value.([]byte)
+		return true
+	})
+	return res
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/cas/proxy.go b/vendor/oras.land/oras-go/v2/internal/cas/proxy.go
new file mode 100644
index 0000000000..ada5f94e00
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/cas/proxy.go
@@ -0,0 +1,125 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package cas
+
+import (
+	"context"
+	"io"
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/internal/ioutil"
+)
+
+// Proxy is a caching proxy for the storage.
+// The first fetch call of a described content will read from the remote and
+// cache the fetched content.
+// The subsequent fetch call will read from the local cache.
+type Proxy struct {
+	content.ReadOnlyStorage
+	Cache       content.Storage
+	StopCaching bool
+}
+
+// NewProxy creates a proxy for the `base` storage, using the `cache` storage as
+// the cache.
+func NewProxy(base content.ReadOnlyStorage, cache content.Storage) *Proxy {
+	return &Proxy{
+		ReadOnlyStorage: base,
+		Cache:           cache,
+	}
+}
+
+// NewProxyWithLimit creates a proxy for the `base` storage, using the `cache`
+// storage with a push size limit as the cache.
+func NewProxyWithLimit(base content.ReadOnlyStorage, cache content.Storage, pushLimit int64) *Proxy {
+	limitedCache := content.LimitStorage(cache, pushLimit)
+	return &Proxy{
+		ReadOnlyStorage: base,
+		Cache:           limitedCache,
+	}
+}
+
+// Fetch fetches the content identified by the descriptor.
+func (p *Proxy) Fetch(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	if p.StopCaching {
+		return p.FetchCached(ctx, target)
+	}
+
+	rc, err := p.Cache.Fetch(ctx, target)
+	if err == nil {
+		return rc, nil
+	}
+
+	rc, err = p.ReadOnlyStorage.Fetch(ctx, target)
+	if err != nil {
+		return nil, err
+	}
+	pr, pw := io.Pipe()
+	var wg sync.WaitGroup
+	wg.Add(1)
+	var pushErr error
+	go func() {
+		defer wg.Done()
+		pushErr = p.Cache.Push(ctx, target, pr)
+		if pushErr != nil {
+			pr.CloseWithError(pushErr)
+		}
+	}()
+	closer := ioutil.CloserFunc(func() error {
+		rcErr := rc.Close()
+		if err := pw.Close(); err != nil {
+			return err
+		}
+		wg.Wait()
+		if pushErr != nil {
+			return pushErr
+		}
+		return rcErr
+	})
+
+	return struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.TeeReader(rc, pw),
+		Closer: closer,
+	}, nil
+}
+
+// FetchCached fetches the content identified by the descriptor.
+// If the content is not cached, it will be fetched from the remote without
+// caching.
+func (p *Proxy) FetchCached(ctx context.Context, target ocispec.Descriptor) (io.ReadCloser, error) {
+	exists, err := p.Cache.Exists(ctx, target)
+	if err != nil {
+		return nil, err
+	}
+	if exists {
+		return p.Cache.Fetch(ctx, target)
+	}
+	return p.ReadOnlyStorage.Fetch(ctx, target)
+}
+
+// Exists returns true if the described content exists.
+func (p *Proxy) Exists(ctx context.Context, target ocispec.Descriptor) (bool, error) {
+	exists, err := p.Cache.Exists(ctx, target)
+	if err == nil && exists {
+		return true, nil
+	}
+	return p.ReadOnlyStorage.Exists(ctx, target)
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/container/set/set.go b/vendor/oras.land/oras-go/v2/internal/container/set/set.go
new file mode 100644
index 0000000000..a084e28899
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/container/set/set.go
@@ -0,0 +1,35 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package set
+
+// Set represents a set data structure.
+type Set[T comparable] map[T]struct{}
+
+// New returns an initialized set.
+func New[T comparable]() Set[T] {
+	return make(Set[T])
+}
+
+// Add adds item into the set s.
+func (s Set[T]) Add(item T) {
+	s[item] = struct{}{}
+}
+
+// Contains returns true if the set s contains item.
+func (s Set[T]) Contains(item T) bool {
+	_, ok := s[item]
+	return ok
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/copyutil/stack.go b/vendor/oras.land/oras-go/v2/internal/copyutil/stack.go
new file mode 100644
index 0000000000..69412b0099
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/copyutil/stack.go
@@ -0,0 +1,55 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package copyutil
+
+import (
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+// NodeInfo represents information of a node that is being visited in
+// ExtendedCopy.
+type NodeInfo struct {
+	// Node represents a node in the graph.
+	Node ocispec.Descriptor
+	// Depth represents the depth of the node in the graph.
+	Depth int
+}
+
+// Stack represents a stack data structure that is used in ExtendedCopy for
+// storing node information.
+type Stack []NodeInfo
+
+// IsEmpty returns true if the stack is empty, otherwise returns false.
+func (s *Stack) IsEmpty() bool {
+	return len(*s) == 0
+}
+
+// Push pushes an item to the stack.
+func (s *Stack) Push(i NodeInfo) {
+	*s = append(*s, i)
+}
+
+// Pop pops the top item out of the stack.
+func (s *Stack) Pop() (NodeInfo, bool) {
+	if s.IsEmpty() {
+		return NodeInfo{}, false
+	}
+
+	last := len(*s) - 1
+	top := (*s)[last]
+	*s = (*s)[:last]
+	return top, true
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/descriptor/descriptor.go b/vendor/oras.land/oras-go/v2/internal/descriptor/descriptor.go
new file mode 100644
index 0000000000..b9b339c048
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/descriptor/descriptor.go
@@ -0,0 +1,89 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package descriptor
+
+import (
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/internal/docker"
+	"oras.land/oras-go/v2/internal/spec"
+)
+
+// DefaultMediaType is the media type used when no media type is specified.
+const DefaultMediaType string = "application/octet-stream"
+
+// Descriptor contains the minimun information to describe the disposition of
+// targeted content.
+// Since it only has strings and integers, Descriptor is a comparable struct.
+type Descriptor struct {
+	// MediaType is the media type of the object this schema refers to.
+	MediaType string `json:"mediaType,omitempty"`
+
+	// Digest is the digest of the targeted content.
+	Digest digest.Digest `json:"digest"`
+
+	// Size specifies the size in bytes of the blob.
+	Size int64 `json:"size"`
+}
+
+// Empty is an empty descriptor
+var Empty Descriptor
+
+// FromOCI shrinks the OCI descriptor to the minimum.
+func FromOCI(desc ocispec.Descriptor) Descriptor {
+	return Descriptor{
+		MediaType: desc.MediaType,
+		Digest:    desc.Digest,
+		Size:      desc.Size,
+	}
+}
+
+// IsForeignLayer checks if a descriptor describes a foreign layer.
+func IsForeignLayer(desc ocispec.Descriptor) bool {
+	switch desc.MediaType {
+	case ocispec.MediaTypeImageLayerNonDistributable,
+		ocispec.MediaTypeImageLayerNonDistributableGzip,
+		ocispec.MediaTypeImageLayerNonDistributableZstd,
+		docker.MediaTypeForeignLayer:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsManifest checks if a descriptor describes a manifest.
+func IsManifest(desc ocispec.Descriptor) bool {
+	switch desc.MediaType {
+	case docker.MediaTypeManifest,
+		docker.MediaTypeManifestList,
+		ocispec.MediaTypeImageManifest,
+		ocispec.MediaTypeImageIndex,
+		spec.MediaTypeArtifactManifest:
+		return true
+	default:
+		return false
+	}
+}
+
+// Plain returns a plain descriptor that contains only MediaType, Digest and
+// Size.
+func Plain(desc ocispec.Descriptor) ocispec.Descriptor {
+	return ocispec.Descriptor{
+		MediaType: desc.MediaType,
+		Digest:    desc.Digest,
+		Size:      desc.Size,
+	}
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/docker/mediatype.go b/vendor/oras.land/oras-go/v2/internal/docker/mediatype.go
new file mode 100644
index 0000000000..76a4ba9ed9
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/docker/mediatype.go
@@ -0,0 +1,24 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package docker
+
+// docker media types
+const (
+	MediaTypeConfig       = "application/vnd.docker.container.image.v1+json"
+	MediaTypeManifestList = "application/vnd.docker.distribution.manifest.list.v2+json"
+	MediaTypeManifest     = "application/vnd.docker.distribution.manifest.v2+json"
+	MediaTypeForeignLayer = "application/vnd.docker.image.rootfs.foreign.diff.tar.gzip"
+)
diff --git a/vendor/oras.land/oras-go/v2/internal/fs/tarfs/tarfs.go b/vendor/oras.land/oras-go/v2/internal/fs/tarfs/tarfs.go
new file mode 100644
index 0000000000..a7a0a6c14e
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/fs/tarfs/tarfs.go
@@ -0,0 +1,165 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tarfs
+
+import (
+	"archive/tar"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+
+	"oras.land/oras-go/v2/errdef"
+)
+
+// blockSize is the size of each block in a tar archive.
+const blockSize int64 = 512
+
+// TarFS represents a file system (an fs.FS) based on a tar archive.
+type TarFS struct {
+	path    string
+	entries map[string]*entry
+}
+
+// entry represents an entry in a tar archive.
+type entry struct {
+	header *tar.Header
+	pos    int64
+}
+
+// New returns a file system (an fs.FS) for a tar archive located at path.
+func New(path string) (*TarFS, error) {
+	pathAbs, err := filepath.Abs(path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve absolute path for %s: %w", path, err)
+	}
+	tarfs := &TarFS{
+		path:    pathAbs,
+		entries: make(map[string]*entry),
+	}
+	if err := tarfs.indexEntries(); err != nil {
+		return nil, err
+	}
+	return tarfs, nil
+}
+
+// Open opens the named file.
+// When Open returns an error, it should be of type *PathError
+// with the Op field set to "open", the Path field set to name,
+// and the Err field describing the problem.
+//
+// Open should reject attempts to open names that do not satisfy
+// ValidPath(name), returning a *PathError with Err set to
+// ErrInvalid or ErrNotExist.
+func (tfs *TarFS) Open(name string) (file fs.File, openErr error) {
+	entry, err := tfs.getEntry(name)
+	if err != nil {
+		return nil, err
+	}
+	tarFile, err := os.Open(tfs.path)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if openErr != nil {
+			tarFile.Close()
+		}
+	}()
+
+	if _, err := tarFile.Seek(entry.pos, io.SeekStart); err != nil {
+		return nil, err
+	}
+	tr := tar.NewReader(tarFile)
+	if _, err := tr.Next(); err != nil {
+		return nil, err
+	}
+	return &entryFile{
+		Reader: tr,
+		Closer: tarFile,
+		header: entry.header,
+	}, nil
+}
+
+// Stat returns a FileInfo describing the file.
+// If there is an error, it should be of type *PathError.
+func (tfs *TarFS) Stat(name string) (fs.FileInfo, error) {
+	entry, err := tfs.getEntry(name)
+	if err != nil {
+		return nil, err
+	}
+	return entry.header.FileInfo(), nil
+}
+
+// getEntry returns the named entry.
+func (tfs *TarFS) getEntry(name string) (*entry, error) {
+	if !fs.ValidPath(name) {
+		return nil, &fs.PathError{Path: name, Err: fs.ErrInvalid}
+	}
+	entry, ok := tfs.entries[name]
+	if !ok {
+		return nil, &fs.PathError{Path: name, Err: fs.ErrNotExist}
+	}
+	if entry.header.Typeflag != tar.TypeReg {
+		// support regular files only
+		return nil, fmt.Errorf("%s: type flag %c is not supported: %w",
+			name, entry.header.Typeflag, errdef.ErrUnsupported)
+	}
+	return entry, nil
+}
+
+// indexEntries index entries in the tar archive.
+func (tfs *TarFS) indexEntries() error {
+	tarFile, err := os.Open(tfs.path)
+	if err != nil {
+		return err
+	}
+	defer tarFile.Close()
+
+	tr := tar.NewReader(tarFile)
+	for {
+		header, err := tr.Next()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			return err
+		}
+		pos, err := tarFile.Seek(0, io.SeekCurrent)
+		if err != nil {
+			return err
+		}
+		tfs.entries[header.Name] = &entry{
+			header: header,
+			pos:    pos - blockSize,
+		}
+	}
+
+	return nil
+}
+
+// entryFile represents an entryFile in a tar archive and implements `fs.File`.
+type entryFile struct {
+	io.Reader
+	io.Closer
+	header *tar.Header
+}
+
+// Stat returns a fs.FileInfo describing e.
+func (e *entryFile) Stat() (fs.FileInfo, error) {
+	return e.header.FileInfo(), nil
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/graph/memory.go b/vendor/oras.land/oras-go/v2/internal/graph/memory.go
new file mode 100644
index 0000000000..0aa25aee84
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/graph/memory.go
@@ -0,0 +1,134 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package graph
+
+import (
+	"context"
+	"errors"
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/descriptor"
+	"oras.land/oras-go/v2/internal/status"
+	"oras.land/oras-go/v2/internal/syncutil"
+)
+
+// Memory is a memory based PredecessorFinder.
+type Memory struct {
+	predecessors sync.Map // map[descriptor.Descriptor]map[descriptor.Descriptor]ocispec.Descriptor
+	indexed      sync.Map // map[descriptor.Descriptor]any
+}
+
+// NewMemory creates a new memory PredecessorFinder.
+func NewMemory() *Memory {
+	return &Memory{}
+}
+
+// Index indexes predecessors for each direct successor of the given node.
+// There is no data consistency issue as long as deletion is not implemented
+// for the underlying storage.
+func (m *Memory) Index(ctx context.Context, fetcher content.Fetcher, node ocispec.Descriptor) error {
+	successors, err := content.Successors(ctx, fetcher, node)
+	if err != nil {
+		return err
+	}
+
+	m.index(ctx, node, successors)
+	return nil
+}
+
+// Index indexes predecessors for all the successors of the given node.
+// There is no data consistency issue as long as deletion is not implemented
+// for the underlying storage.
+func (m *Memory) IndexAll(ctx context.Context, fetcher content.Fetcher, node ocispec.Descriptor) error {
+	// track content status
+	tracker := status.NewTracker()
+
+	var fn syncutil.GoFunc[ocispec.Descriptor]
+	fn = func(ctx context.Context, region *syncutil.LimitedRegion, desc ocispec.Descriptor) error {
+		// skip the node if other go routine is working on it
+		_, committed := tracker.TryCommit(desc)
+		if !committed {
+			return nil
+		}
+
+		// skip the node if it has been indexed
+		key := descriptor.FromOCI(desc)
+		_, exists := m.indexed.Load(key)
+		if exists {
+			return nil
+		}
+
+		successors, err := content.Successors(ctx, fetcher, desc)
+		if err != nil {
+			if errors.Is(err, errdef.ErrNotFound) {
+				// skip the node if it does not exist
+				return nil
+			}
+			return err
+		}
+		m.index(ctx, desc, successors)
+		m.indexed.Store(key, nil)
+
+		if len(successors) > 0 {
+			// traverse and index successors
+			return syncutil.Go(ctx, nil, fn, successors...)
+		}
+		return nil
+	}
+	return syncutil.Go(ctx, nil, fn, node)
+}
+
+// Predecessors returns the nodes directly pointing to the current node.
+// Predecessors returns nil without error if the node does not exists in the
+// store.
+// Like other operations, calling Predecessors() is go-routine safe. However,
+// it does not necessarily correspond to any consistent snapshot of the stored
+// contents.
+func (m *Memory) Predecessors(_ context.Context, node ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+	key := descriptor.FromOCI(node)
+	value, exists := m.predecessors.Load(key)
+	if !exists {
+		return nil, nil
+	}
+	predecessors := value.(*sync.Map)
+
+	var res []ocispec.Descriptor
+	predecessors.Range(func(key, value interface{}) bool {
+		res = append(res, value.(ocispec.Descriptor))
+		return true
+	})
+	return res, nil
+}
+
+// index indexes predecessors for each direct successor of the given node.
+// There is no data consistency issue as long as deletion is not implemented
+// for the underlying storage.
+func (m *Memory) index(ctx context.Context, node ocispec.Descriptor, successors []ocispec.Descriptor) {
+	if len(successors) == 0 {
+		return
+	}
+
+	predecessorKey := descriptor.FromOCI(node)
+	for _, successor := range successors {
+		successorKey := descriptor.FromOCI(successor)
+		value, _ := m.predecessors.LoadOrStore(successorKey, &sync.Map{})
+		predecessors := value.(*sync.Map)
+		predecessors.Store(predecessorKey, node)
+	}
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/interfaces/registry.go b/vendor/oras.land/oras-go/v2/internal/interfaces/registry.go
new file mode 100644
index 0000000000..05600148e6
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/interfaces/registry.go
@@ -0,0 +1,24 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package interfaces
+
+import "oras.land/oras-go/v2/registry"
+
+// ReferenceParser provides reference parsing.
+type ReferenceParser interface {
+	// ParseReference parses a reference to a fully qualified reference.
+	ParseReference(reference string) (registry.Reference, error)
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/ioutil/io.go b/vendor/oras.land/oras-go/v2/internal/ioutil/io.go
new file mode 100644
index 0000000000..888d26f895
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/ioutil/io.go
@@ -0,0 +1,58 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package ioutil
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+)
+
+// CloserFunc is the basic Close method defined in io.Closer.
+type CloserFunc func() error
+
+// Close performs close operation by the CloserFunc.
+func (fn CloserFunc) Close() error {
+	return fn()
+}
+
+// CopyBuffer copies from src to dst through the provided buffer
+// until either EOF is reached on src, or an error occurs.
+// The copied content is verified against the size and the digest.
+func CopyBuffer(dst io.Writer, src io.Reader, buf []byte, desc ocispec.Descriptor) error {
+	// verify while copying
+	vr := content.NewVerifyReader(src, desc)
+	if _, err := io.CopyBuffer(dst, vr, buf); err != nil {
+		return fmt.Errorf("copy failed: %w", err)
+	}
+	return vr.Verify()
+}
+
+// nopCloserType is the type of `io.NopCloser()`.
+var nopCloserType = reflect.TypeOf(io.NopCloser(nil))
+
+// UnwrapNopCloser unwraps the reader wrapped by `io.NopCloser()`.
+// Similar implementation can be found in the built-in package `net/http`.
+// Reference: https://github.com/golang/go/blob/go1.17.6/src/net/http/transfer.go#L423-L425
+func UnwrapNopCloser(rc io.Reader) io.Reader {
+	if reflect.TypeOf(rc) == nopCloserType {
+		return reflect.ValueOf(rc).Field(0).Interface().(io.Reader)
+	}
+	return rc
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/platform/platform.go b/vendor/oras.land/oras-go/v2/internal/platform/platform.go
new file mode 100644
index 0000000000..38d8d47fd9
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/platform/platform.go
@@ -0,0 +1,136 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package platform
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/docker"
+)
+
+// Match checks whether the current platform matches the target platform.
+// Match will return true if all of the following conditions are met.
+//   - Architecture and OS exactly match.
+//   - Variant and OSVersion exactly match if target platform provided.
+//   - OSFeatures of the target platform are the subsets of the OSFeatures
+//     array of the current platform.
+//
+// Note: Variant, OSVersion and OSFeatures are optional fields, will skip
+// the comparison if the target platform does not provide specfic value.
+func Match(got *ocispec.Platform, want *ocispec.Platform) bool {
+	if got.Architecture != want.Architecture || got.OS != want.OS {
+		return false
+	}
+
+	if want.OSVersion != "" && got.OSVersion != want.OSVersion {
+		return false
+	}
+
+	if want.Variant != "" && got.Variant != want.Variant {
+		return false
+	}
+
+	if len(want.OSFeatures) != 0 && !isSubset(want.OSFeatures, got.OSFeatures) {
+		return false
+	}
+
+	return true
+}
+
+// isSubset returns true if all items in slice A are present in slice B.
+func isSubset(a, b []string) bool {
+	set := make(map[string]bool, len(b))
+	for _, v := range b {
+		set[v] = true
+	}
+	for _, v := range a {
+		if _, ok := set[v]; !ok {
+			return false
+		}
+	}
+
+	return true
+}
+
+// SelectManifest implements platform filter and returns the descriptor of the
+// first matched manifest if the root is a manifest list. If the root is a
+// manifest, then return the root descriptor if platform matches.
+func SelectManifest(ctx context.Context, src content.ReadOnlyStorage, root ocispec.Descriptor, p *ocispec.Platform) (ocispec.Descriptor, error) {
+	switch root.MediaType {
+	case docker.MediaTypeManifestList, ocispec.MediaTypeImageIndex:
+		manifests, err := content.Successors(ctx, src, root)
+		if err != nil {
+			return ocispec.Descriptor{}, err
+		}
+
+		// platform filter
+		for _, m := range manifests {
+			if Match(m.Platform, p) {
+				return m, nil
+			}
+		}
+		return ocispec.Descriptor{}, fmt.Errorf("%s: %w: no matching manifest was found in the manifest list", root.Digest, errdef.ErrNotFound)
+	case docker.MediaTypeManifest, ocispec.MediaTypeImageManifest:
+		descs, err := content.Successors(ctx, src, root)
+		if err != nil {
+			return ocispec.Descriptor{}, err
+		}
+
+		configMediaType := docker.MediaTypeConfig
+		if root.MediaType == ocispec.MediaTypeImageManifest {
+			configMediaType = ocispec.MediaTypeImageConfig
+		}
+
+		cfgPlatform, err := getPlatformFromConfig(ctx, src, descs[0], configMediaType)
+		if err != nil {
+			return ocispec.Descriptor{}, err
+		}
+
+		if Match(cfgPlatform, p) {
+			return root, nil
+		}
+		return ocispec.Descriptor{}, fmt.Errorf("%s: %w: platform in manifest does not match target platform", root.Digest, errdef.ErrNotFound)
+	default:
+		return ocispec.Descriptor{}, fmt.Errorf("%s: %s: %w", root.Digest, root.MediaType, errdef.ErrUnsupported)
+	}
+}
+
+// getPlatformFromConfig returns a platform object which is made up from the
+// fields in config blob.
+func getPlatformFromConfig(ctx context.Context, src content.ReadOnlyStorage, desc ocispec.Descriptor, targetConfigMediaType string) (*ocispec.Platform, error) {
+	if desc.MediaType != targetConfigMediaType {
+		return nil, fmt.Errorf("fail to recognize platform from unknown config %s: expect %s", desc.MediaType, targetConfigMediaType)
+	}
+
+	rc, err := src.Fetch(ctx, desc)
+	if err != nil {
+		return nil, err
+	}
+	defer rc.Close()
+
+	var platform ocispec.Platform
+	if err = json.NewDecoder(rc).Decode(&platform); err != nil && err != io.EOF {
+		return nil, err
+	}
+
+	return &platform, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/registryutil/auth.go b/vendor/oras.land/oras-go/v2/internal/registryutil/auth.go
new file mode 100644
index 0000000000..4a601f0c6b
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/registryutil/auth.go
@@ -0,0 +1,29 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registryutil
+
+import (
+	"context"
+
+	"oras.land/oras-go/v2/registry"
+	"oras.land/oras-go/v2/registry/remote/auth"
+)
+
+// WithScopeHint adds a hinted scope to the context.
+func WithScopeHint(ctx context.Context, ref registry.Reference, actions ...string) context.Context {
+	scope := auth.ScopeRepository(ref.Repository, actions...)
+	return auth.AppendScopes(ctx, scope)
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/registryutil/proxy.go b/vendor/oras.land/oras-go/v2/internal/registryutil/proxy.go
new file mode 100644
index 0000000000..c238713e5f
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/registryutil/proxy.go
@@ -0,0 +1,102 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registryutil
+
+import (
+	"context"
+	"io"
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/internal/cas"
+	"oras.land/oras-go/v2/internal/ioutil"
+	"oras.land/oras-go/v2/registry"
+)
+
+// ReferenceStorage represents a CAS that supports registry.ReferenceFetcher.
+type ReferenceStorage interface {
+	content.ReadOnlyStorage
+	registry.ReferenceFetcher
+}
+
+// Proxy is a caching proxy dedicated for registry.ReferenceFetcher.
+// The first fetch call of a described content will read from the remote and
+// cache the fetched content.
+// The subsequent fetch call will read from the local cache.
+type Proxy struct {
+	registry.ReferenceFetcher
+	*cas.Proxy
+}
+
+// NewProxy creates a proxy for the `base` ReferenceStorage, using the `cache`
+// storage as the cache.
+func NewProxy(base ReferenceStorage, cache content.Storage) *Proxy {
+	return &Proxy{
+		ReferenceFetcher: base,
+		Proxy:            cas.NewProxy(base, cache),
+	}
+}
+
+// FetchReference fetches the content identified by the reference from the
+// remote and cache the fetched content.
+func (p *Proxy) FetchReference(ctx context.Context, reference string) (ocispec.Descriptor, io.ReadCloser, error) {
+	target, rc, err := p.ReferenceFetcher.FetchReference(ctx, reference)
+	if err != nil {
+		return ocispec.Descriptor{}, nil, err
+	}
+
+	// skip caching if the content already exists in cache
+	exists, err := p.Cache.Exists(ctx, target)
+	if err != nil {
+		return ocispec.Descriptor{}, nil, err
+	}
+	if exists {
+		return target, rc, nil
+	}
+
+	// cache content while reading
+	pr, pw := io.Pipe()
+	var wg sync.WaitGroup
+	wg.Add(1)
+	var pushErr error
+	go func() {
+		defer wg.Done()
+		pushErr = p.Cache.Push(ctx, target, pr)
+		if pushErr != nil {
+			pr.CloseWithError(pushErr)
+		}
+	}()
+	closer := ioutil.CloserFunc(func() error {
+		rcErr := rc.Close()
+		if err := pw.Close(); err != nil {
+			return err
+		}
+		wg.Wait()
+		if pushErr != nil {
+			return pushErr
+		}
+		return rcErr
+	})
+
+	return target, struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.TeeReader(rc, pw),
+		Closer: closer,
+	}, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/resolver/memory.go b/vendor/oras.land/oras-go/v2/internal/resolver/memory.go
new file mode 100644
index 0000000000..6fac5e2d08
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/resolver/memory.go
@@ -0,0 +1,61 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package resolver
+
+import (
+	"context"
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/errdef"
+)
+
+// Memory is a memory based resolver.
+type Memory struct {
+	index sync.Map // map[string]ocispec.Descriptor
+}
+
+// NewMemory creates a new Memory resolver.
+func NewMemory() *Memory {
+	return &Memory{}
+}
+
+// Resolve resolves a reference to a descriptor.
+func (m *Memory) Resolve(_ context.Context, reference string) (ocispec.Descriptor, error) {
+	desc, ok := m.index.Load(reference)
+	if !ok {
+		return ocispec.Descriptor{}, errdef.ErrNotFound
+	}
+	return desc.(ocispec.Descriptor), nil
+}
+
+// Tag tags a descriptor with a reference string.
+func (m *Memory) Tag(_ context.Context, desc ocispec.Descriptor, reference string) error {
+	m.index.Store(reference, desc)
+	return nil
+}
+
+// Map dumps the memory into a built-in map structure.
+// Like other operations, calling Map() is go-routine safe. However, it does not
+// necessarily correspond to any consistent snapshot of the storage contents.
+func (m *Memory) Map() map[string]ocispec.Descriptor {
+	res := make(map[string]ocispec.Descriptor)
+	m.index.Range(func(key, value interface{}) bool {
+		res[key.(string)] = value.(ocispec.Descriptor)
+		return true
+	})
+	return res
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/spec/artifact.go b/vendor/oras.land/oras-go/v2/internal/spec/artifact.go
new file mode 100644
index 0000000000..8aa8e79ecc
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/spec/artifact.go
@@ -0,0 +1,49 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package spec
+
+import ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+
+// AnnotationReferrersFiltersApplied is the annotation key for the comma separated list of filters applied by the registry in the referrers listing.
+const AnnotationReferrersFiltersApplied = "org.opencontainers.referrers.filtersApplied"
+
+// MediaTypeArtifactManifest specifies the media type for a content descriptor.
+const MediaTypeArtifactManifest = "application/vnd.oci.artifact.manifest.v1+json"
+
+// Artifact describes an artifact manifest.
+// This structure provides `application/vnd.oci.artifact.manifest.v1+json` mediatype when marshalled to JSON.
+//
+// This manifest type was introduced in image-spec v1.1.0-rc1 and was removed in
+// image-spec v1.1.0-rc3. It is not part of the current image-spec and is kept
+// here for Go compatibility.
+//
+// Reference: https://github.com/opencontainers/image-spec/pull/999
+type Artifact struct {
+	// MediaType is the media type of the object this schema refers to.
+	MediaType string `json:"mediaType"`
+
+	// ArtifactType is the IANA media type of the artifact this schema refers to.
+	ArtifactType string `json:"artifactType"`
+
+	// Blobs is a collection of blobs referenced by this manifest.
+	Blobs []ocispec.Descriptor `json:"blobs,omitempty"`
+
+	// Subject (reference) is an optional link from the artifact to another manifest forming an association between the artifact and the other manifest.
+	Subject *ocispec.Descriptor `json:"subject,omitempty"`
+
+	// Annotations contains arbitrary metadata for the artifact manifest.
+	Annotations map[string]string `json:"annotations,omitempty"`
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/status/tracker.go b/vendor/oras.land/oras-go/v2/internal/status/tracker.go
new file mode 100644
index 0000000000..1a48bb5aff
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/status/tracker.go
@@ -0,0 +1,43 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package status
+
+import (
+	"sync"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/internal/descriptor"
+)
+
+// Tracker tracks content status described by a descriptor.
+type Tracker struct {
+	status sync.Map // map[descriptor.Descriptor]chan struct{}
+}
+
+// NewTracker creates a new content status tracker.
+func NewTracker() *Tracker {
+	return &Tracker{}
+}
+
+// TryCommit tries to commit the work for the target descriptor.
+// Returns true if committed. A channel is also returned for sending
+// notifications. Once the work is done, the channel should be closed.
+// Returns false if the work is done or still in progress.
+func (t *Tracker) TryCommit(target ocispec.Descriptor) (chan struct{}, bool) {
+	key := descriptor.FromOCI(target)
+	status, exists := t.status.LoadOrStore(key, make(chan struct{}))
+	return status.(chan struct{}), !exists
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/limit.go b/vendor/oras.land/oras-go/v2/internal/syncutil/limit.go
new file mode 100644
index 0000000000..2a05d4ea28
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/syncutil/limit.go
@@ -0,0 +1,84 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syncutil
+
+import (
+	"context"
+
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/sync/semaphore"
+)
+
+// LimitedRegion provides a way to bound concurrent access to a code block.
+type LimitedRegion struct {
+	ctx     context.Context
+	limiter *semaphore.Weighted
+	ended   bool
+}
+
+// LimitRegion creates a new LimitedRegion.
+func LimitRegion(ctx context.Context, limiter *semaphore.Weighted) *LimitedRegion {
+	if limiter == nil {
+		return nil
+	}
+	return &LimitedRegion{
+		ctx:     ctx,
+		limiter: limiter,
+		ended:   true,
+	}
+}
+
+// Start starts the region with concurrency limit.
+func (lr *LimitedRegion) Start() error {
+	if lr == nil || !lr.ended {
+		return nil
+	}
+	if err := lr.limiter.Acquire(lr.ctx, 1); err != nil {
+		return err
+	}
+	lr.ended = false
+	return nil
+}
+
+// End ends the region with concurrency limit.
+func (lr *LimitedRegion) End() {
+	if lr == nil || lr.ended {
+		return
+	}
+	lr.limiter.Release(1)
+	lr.ended = true
+}
+
+// GoFunc represents a function that can be invoked by Go.
+type GoFunc[T any] func(ctx context.Context, region *LimitedRegion, t T) error
+
+// Go concurrently invokes fn on items.
+func Go[T any](ctx context.Context, limiter *semaphore.Weighted, fn GoFunc[T], items ...T) error {
+	eg, egCtx := errgroup.WithContext(ctx)
+	for _, item := range items {
+		region := LimitRegion(ctx, limiter)
+		if err := region.Start(); err != nil {
+			return err
+		}
+		eg.Go(func(t T) func() error {
+			return func() error {
+				defer region.End()
+				return fn(egCtx, region, t)
+			}
+		}(item))
+	}
+	return eg.Wait()
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/limitgroup.go b/vendor/oras.land/oras-go/v2/internal/syncutil/limitgroup.go
new file mode 100644
index 0000000000..1071bedc90
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/syncutil/limitgroup.go
@@ -0,0 +1,67 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syncutil
+
+import (
+	"context"
+
+	"golang.org/x/sync/errgroup"
+)
+
+// A LimitedGroup is a collection of goroutines working on subtasks that are part of
+// the same overall task.
+type LimitedGroup struct {
+	grp *errgroup.Group
+	ctx context.Context
+}
+
+// LimitGroup returns a new LimitedGroup and an associated Context derived from ctx.
+//
+// The number of active goroutines in this group is limited to the given limit.
+// A negative value indicates no limit.
+//
+// The derived Context is canceled the first time a function passed to Go
+// returns a non-nil error or the first time Wait returns, whichever occurs
+// first.
+func LimitGroup(ctx context.Context, limit int) (*LimitedGroup, context.Context) {
+	grp, ctx := errgroup.WithContext(ctx)
+	grp.SetLimit(limit)
+	return &LimitedGroup{grp: grp, ctx: ctx}, ctx
+}
+
+// Go calls the given function in a new goroutine.
+// It blocks until the new goroutine can be added without the number of
+// active goroutines in the group exceeding the configured limit.
+//
+// The first call to return a non-nil error cancels the group's context.
+// After which, any subsequent calls to Go will not execute their given function.
+// The error will be returned by Wait.
+func (g *LimitedGroup) Go(f func() error) {
+	g.grp.Go(func() error {
+		select {
+		case <-g.ctx.Done():
+			return g.ctx.Err()
+		default:
+			return f()
+		}
+	})
+}
+
+// Wait blocks until all function calls from the Go method have returned, then
+// returns the first non-nil error (if any) from them.
+func (g *LimitedGroup) Wait() error {
+	return g.grp.Wait()
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/merge.go b/vendor/oras.land/oras-go/v2/internal/syncutil/merge.go
new file mode 100644
index 0000000000..44788990c2
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/syncutil/merge.go
@@ -0,0 +1,140 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syncutil
+
+import "sync"
+
+// mergeStatus represents the merge status of an item.
+type mergeStatus struct {
+	// main indicates if items are being merged by the current go-routine.
+	main bool
+	// err represents the error of the merge operation.
+	err error
+}
+
+// Merge represents merge operations on items.
+// The state transfer is shown as below:
+//
+//	           +----------+
+//	           |  Start   +--------+-------------+
+//	           +----+-----+        |             |
+//	                |              |             |
+//	                v              v             v
+//	           +----+-----+   +----+----+   +----+----+
+//	   +-------+ Prepare  +<--+ Pending +-->+ Waiting |
+//	   |       +----+-----+   +---------+   +----+----+
+//	   |            |                            |
+//	   |            v                            |
+//	   |       + ---+---- +                      |
+//	On Error   | Resolve  |                      |
+//	   |       + ---+---- +                      |
+//	   |            |                            |
+//	   |            v                            |
+//	   |       +----+-----+                      |
+//	   +------>+ Complete +<---------------------+
+//	           +----+-----+
+//	                |
+//	                v
+//	           +----+-----+
+//	           |   End    |
+//	           +----------+
+type Merge[T any] struct {
+	lock          sync.Mutex
+	committed     bool
+	items         []T
+	status        chan mergeStatus
+	pending       []T
+	pendingStatus chan mergeStatus
+}
+
+// Do merges concurrent operations of items into a single call of prepare and
+// resolve.
+// If Do is called multiple times concurrently, only one of the calls will be
+// selected to invoke prepare and resolve.
+func (m *Merge[T]) Do(item T, prepare func() error, resolve func(items []T) error) error {
+	status := <-m.assign(item)
+	if status.main {
+		err := prepare()
+		items := m.commit()
+		if err == nil {
+			err = resolve(items)
+		}
+		m.complete(err)
+		return err
+	}
+	return status.err
+}
+
+// assign adds a new item into the item list.
+func (m *Merge[T]) assign(item T) <-chan mergeStatus {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	if m.committed {
+		if m.pendingStatus == nil {
+			m.pendingStatus = make(chan mergeStatus, 1)
+		}
+		m.pending = append(m.pending, item)
+		return m.pendingStatus
+	}
+
+	if m.status == nil {
+		m.status = make(chan mergeStatus, 1)
+		m.status <- mergeStatus{main: true}
+	}
+	m.items = append(m.items, item)
+	return m.status
+}
+
+// commit closes the assignment window, and the assigned items will be ready
+// for resolve.
+func (m *Merge[T]) commit() []T {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	m.committed = true
+	return m.items
+}
+
+// complete completes the previous merge, and moves the pending items to the
+// stage for the next merge.
+func (m *Merge[T]) complete(err error) {
+	// notify results
+	if err == nil {
+		close(m.status)
+	} else {
+		remaining := len(m.items) - 1
+		status := m.status
+		for remaining > 0 {
+			status <- mergeStatus{err: err}
+			remaining--
+		}
+	}
+
+	// move pending items to the stage
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	m.committed = false
+	m.items = m.pending
+	m.status = m.pendingStatus
+	m.pending = nil
+	m.pendingStatus = nil
+
+	if m.status != nil {
+		m.status <- mergeStatus{main: true}
+	}
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/once.go b/vendor/oras.land/oras-go/v2/internal/syncutil/once.go
new file mode 100644
index 0000000000..1d55719800
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/syncutil/once.go
@@ -0,0 +1,70 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syncutil
+
+import "context"
+
+// Once is an object that will perform exactly one action.
+// Unlike sync.Once, this Once allowes the action to have return values.
+type Once struct {
+	result interface{}
+	err    error
+	status chan bool
+}
+
+// NewOnce creates a new Once instance.
+func NewOnce() *Once {
+	status := make(chan bool, 1)
+	status <- true
+	return &Once{
+		status: status,
+	}
+}
+
+// Do calls the function f if and only if Do is being called first time or all
+// previous function calls are cancelled, deadline exceeded, or panicking.
+// When `once.Do(ctx, f)` is called multiple times, the return value of the
+// first call of the function f is stored, and is directly returned for other
+// calls.
+// Besides the return value of the function f, including the error, Do returns
+// true if the function f passed is called first and is not cancelled, deadline
+// exceeded, or panicking. Otherwise, returns false.
+func (o *Once) Do(ctx context.Context, f func() (interface{}, error)) (bool, interface{}, error) {
+	defer func() {
+		if r := recover(); r != nil {
+			o.status <- true
+			panic(r)
+		}
+	}()
+	for {
+		select {
+		case inProgress := <-o.status:
+			if !inProgress {
+				return false, o.result, o.err
+			}
+			result, err := f()
+			if err == context.Canceled || err == context.DeadlineExceeded {
+				o.status <- true
+				return false, nil, err
+			}
+			o.result, o.err = result, err
+			close(o.status)
+			return true, result, err
+		case <-ctx.Done():
+			return false, nil, ctx.Err()
+		}
+	}
+}
diff --git a/vendor/oras.land/oras-go/v2/internal/syncutil/pool.go b/vendor/oras.land/oras-go/v2/internal/syncutil/pool.go
new file mode 100644
index 0000000000..6fb4a69c51
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/internal/syncutil/pool.go
@@ -0,0 +1,64 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syncutil
+
+import "sync"
+
+// poolItem represents an item in Pool.
+type poolItem[T any] struct {
+	value    T
+	refCount int
+}
+
+// Pool is a scalable pool with items identified by keys.
+type Pool[T any] struct {
+	// New optionally specifies a function to generate a value when Get would
+	// otherwise return nil.
+	// It may not be changed concurrently with calls to Get.
+	New func() T
+
+	lock  sync.Mutex
+	items map[any]*poolItem[T]
+}
+
+// Get gets the value identified by key.
+// The caller should invoke the returned function after using the returned item.
+func (p *Pool[T]) Get(key any) (*T, func()) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	item, ok := p.items[key]
+	if !ok {
+		if p.items == nil {
+			p.items = make(map[any]*poolItem[T])
+		}
+		item = &poolItem[T]{}
+		if p.New != nil {
+			item.value = p.New()
+		}
+		p.items[key] = item
+	}
+	item.refCount++
+
+	return &item.value, func() {
+		p.lock.Lock()
+		defer p.lock.Unlock()
+		item.refCount--
+		if item.refCount <= 0 {
+			delete(p.items, key)
+		}
+	}
+}
diff --git a/vendor/oras.land/oras-go/v2/pack.go b/vendor/oras.land/oras-go/v2/pack.go
new file mode 100644
index 0000000000..81fc12ca65
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/pack.go
@@ -0,0 +1,203 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oras
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	specs "github.com/opencontainers/image-spec/specs-go"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/spec"
+)
+
+const (
+	// MediaTypeUnknownConfig is the default mediaType used when no
+	// config media type is specified.
+	MediaTypeUnknownConfig = "application/vnd.unknown.config.v1+json"
+	// MediaTypeUnknownArtifact is the default artifactType used when no
+	// artifact type is specified.
+	MediaTypeUnknownArtifact = "application/vnd.unknown.artifact.v1"
+)
+
+// ErrInvalidDateTimeFormat is returned by Pack() when
+// AnnotationArtifactCreated or AnnotationCreated is provided, but its value
+// is not in RFC 3339 format.
+// Reference: https://www.rfc-editor.org/rfc/rfc3339#section-5.6
+var ErrInvalidDateTimeFormat = errors.New("invalid date and time format")
+
+// PackOptions contains parameters for [oras.Pack].
+type PackOptions struct {
+	// Subject is the subject of the manifest.
+	Subject *ocispec.Descriptor
+	// ManifestAnnotations is the annotation map of the manifest.
+	ManifestAnnotations map[string]string
+
+	// PackImageManifest controls whether to pack an image manifest or not.
+	//   - If true, pack an image manifest; artifactType will be used as the
+	// the config descriptor mediaType of the image manifest.
+	//   - If false, pack an artifact manifest.
+	// Default: false.
+	PackImageManifest bool
+	// ConfigDescriptor is a pointer to the descriptor of the config blob.
+	// If not nil, artifactType will be implied by the mediaType of the
+	// specified ConfigDescriptor, and ConfigAnnotations will be ignored.
+	// This option is valid only when PackImageManifest is true.
+	ConfigDescriptor *ocispec.Descriptor
+	// ConfigAnnotations is the annotation map of the config descriptor.
+	// This option is valid only when PackImageManifest is true
+	// and ConfigDescriptor is nil.
+	ConfigAnnotations map[string]string
+}
+
+// Pack packs the given blobs, generates a manifest for the pack,
+// and pushes it to a content storage.
+//
+// When opts.PackImageManifest is true, artifactType will be used as the
+// the config descriptor mediaType of the image manifest.
+// If succeeded, returns a descriptor of the manifest.
+func Pack(ctx context.Context, pusher content.Pusher, artifactType string, blobs []ocispec.Descriptor, opts PackOptions) (ocispec.Descriptor, error) {
+	if opts.PackImageManifest {
+		return packImage(ctx, pusher, artifactType, blobs, opts)
+	}
+	return packArtifact(ctx, pusher, artifactType, blobs, opts)
+}
+
+// packArtifact packs the given blobs, generates an artifact manifest for the
+// pack, and pushes it to a content storage.
+// If succeeded, returns a descriptor of the manifest.
+func packArtifact(ctx context.Context, pusher content.Pusher, artifactType string, blobs []ocispec.Descriptor, opts PackOptions) (ocispec.Descriptor, error) {
+	if artifactType == "" {
+		artifactType = MediaTypeUnknownArtifact
+	}
+
+	annotations, err := ensureAnnotationCreated(opts.ManifestAnnotations, ocispec.AnnotationArtifactCreated)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	manifest := spec.Artifact{
+		MediaType:    spec.MediaTypeArtifactManifest,
+		ArtifactType: artifactType,
+		Blobs:        blobs,
+		Subject:      opts.Subject,
+		Annotations:  annotations,
+	}
+	manifestJSON, err := json.Marshal(manifest)
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to marshal manifest: %w", err)
+	}
+	manifestDesc := content.NewDescriptorFromBytes(spec.MediaTypeArtifactManifest, manifestJSON)
+	// populate ArtifactType and Annotations of the manifest into manifestDesc
+	manifestDesc.ArtifactType = manifest.ArtifactType
+	manifestDesc.Annotations = manifest.Annotations
+
+	// push manifest
+	if err := pusher.Push(ctx, manifestDesc, bytes.NewReader(manifestJSON)); err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to push manifest: %w", err)
+	}
+
+	return manifestDesc, nil
+}
+
+// packImage packs the given blobs, generates an image manifest for the pack,
+// and pushes it to a content storage. artifactType will be used as the config
+// descriptor mediaType of the image manifest.
+// If succeeded, returns a descriptor of the manifest.
+func packImage(ctx context.Context, pusher content.Pusher, configMediaType string, layers []ocispec.Descriptor, opts PackOptions) (ocispec.Descriptor, error) {
+	if configMediaType == "" {
+		configMediaType = MediaTypeUnknownConfig
+	}
+
+	var configDesc ocispec.Descriptor
+	if opts.ConfigDescriptor != nil {
+		configDesc = *opts.ConfigDescriptor
+	} else {
+		// Use an empty JSON object here, because some registries may not accept
+		// empty config blob.
+		// As of September 2022, GAR is known to return 400 on empty blob upload.
+		// See https://github.com/oras-project/oras-go/issues/294 for details.
+		configBytes := []byte("{}")
+		configDesc = content.NewDescriptorFromBytes(configMediaType, configBytes)
+		configDesc.Annotations = opts.ConfigAnnotations
+		// push config
+		if err := pusher.Push(ctx, configDesc, bytes.NewReader(configBytes)); err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+			return ocispec.Descriptor{}, fmt.Errorf("failed to push config: %w", err)
+		}
+	}
+
+	annotations, err := ensureAnnotationCreated(opts.ManifestAnnotations, ocispec.AnnotationCreated)
+	if err != nil {
+		return ocispec.Descriptor{}, err
+	}
+	if layers == nil {
+		layers = []ocispec.Descriptor{} // make it an empty array to prevent potential server-side bugs
+	}
+	manifest := ocispec.Manifest{
+		Versioned: specs.Versioned{
+			SchemaVersion: 2, // historical value. does not pertain to OCI or docker version
+		},
+		Config:      configDesc,
+		MediaType:   ocispec.MediaTypeImageManifest,
+		Layers:      layers,
+		Subject:     opts.Subject,
+		Annotations: annotations,
+	}
+	manifestJSON, err := json.Marshal(manifest)
+	if err != nil {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to marshal manifest: %w", err)
+	}
+	manifestDesc := content.NewDescriptorFromBytes(ocispec.MediaTypeImageManifest, manifestJSON)
+	// populate ArtifactType and Annotations of the manifest into manifestDesc
+	manifestDesc.ArtifactType = manifest.Config.MediaType
+	manifestDesc.Annotations = manifest.Annotations
+
+	// push manifest
+	if err := pusher.Push(ctx, manifestDesc, bytes.NewReader(manifestJSON)); err != nil && !errors.Is(err, errdef.ErrAlreadyExists) {
+		return ocispec.Descriptor{}, fmt.Errorf("failed to push manifest: %w", err)
+	}
+
+	return manifestDesc, nil
+}
+
+// ensureAnnotationCreated ensures that annotationCreatedKey is in annotations,
+// and that its value conforms to RFC 3339. Otherwise returns a new annotation
+// map with annotationCreatedKey created.
+func ensureAnnotationCreated(annotations map[string]string, annotationCreatedKey string) (map[string]string, error) {
+	if createdTime, ok := annotations[annotationCreatedKey]; ok {
+		// if annotationCreatedKey is provided, validate its format
+		if _, err := time.Parse(time.RFC3339, createdTime); err != nil {
+			return nil, fmt.Errorf("%w: %v", ErrInvalidDateTimeFormat, err)
+		}
+		return annotations, nil
+	}
+
+	// copy the original annotation map
+	copied := make(map[string]string, len(annotations)+1)
+	for k, v := range annotations {
+		copied[k] = v
+	}
+	// set creation time in RFC 3339 format
+	// reference: https://github.com/opencontainers/image-spec/blob/v1.1.0-rc2/annotations.md#pre-defined-annotation-keys
+	now := time.Now().UTC()
+	copied[annotationCreatedKey] = now.Format(time.RFC3339)
+	return copied, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/reference.go b/vendor/oras.land/oras-go/v2/registry/reference.go
new file mode 100644
index 0000000000..cea579a141
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/reference.go
@@ -0,0 +1,269 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registry
+
+import (
+	"fmt"
+	"net/url"
+	"regexp"
+	"strings"
+
+	"github.com/opencontainers/go-digest"
+	"oras.land/oras-go/v2/errdef"
+)
+
+// regular expressions for components.
+var (
+	// repositoryRegexp is adapted from the distribution implementation. The
+	// repository name set under OCI distribution spec is a subset of the docker
+	// spec. For maximum compatability, the docker spec is verified client-side.
+	// Further checks are left to the server-side.
+	// References:
+	// - https://github.com/distribution/distribution/blob/v2.7.1/reference/regexp.go#L53
+	// - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#pulling-manifests
+	repositoryRegexp = regexp.MustCompile(`^[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]*)[a-z0-9]+)*)*$`)
+
+	// tagRegexp checks the tag name.
+	// The docker and OCI spec have the same regular expression.
+	// Reference: https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#pulling-manifests
+	tagRegexp = regexp.MustCompile(`^[\w][\w.-]{0,127}$`)
+)
+
+// Reference references either a resource descriptor (where Reference.Reference
+// is a tag or a digest), or a resource repository (where Reference.Reference
+// is the empty string).
+type Reference struct {
+	// Registry is the name of the registry. It is usually the domain name of
+	// the registry optionally with a port.
+	Registry string
+
+	// Repository is the name of the repository.
+	Repository string
+
+	// Reference is the reference of the object in the repository. This field
+	// can take any one of the four valid forms (see ParseReference). In the
+	// case where it's the empty string, it necessarily implies valid form D,
+	// and where it is non-empty, then it is either a tag, or a digest
+	// (implying one of valid forms A, B, or C).
+	Reference string
+}
+
+// ParseReference parses a string (artifact) into an `artifact reference`.
+//
+// Note: An "image" is an "artifact", however, an "artifact" is not necessarily
+// an "image".
+//
+// The token `artifact` is composed of other tokens, and those in turn are
+// composed of others.  This definition recursivity requires a notation capable
+// of recursion, thus the following two forms have been adopted:
+//
+//  1. Backus–Naur Form (BNF) has been adopted to address the recursive nature
+//     of the definition.
+//  2. Token opacity is revealed via its label letter-casing.  That is, "opaque"
+//     tokens (i.e., tokens that are not final, and must therefore be further
+//     broken down into their constituents) are denoted in *lowercase*, while
+//     final tokens (i.e., leaf-node tokens that are final) are denoted in
+//     *uppercase*.
+//
+// Finally, note that a number of the opaque tokens are polymorphic in nature;
+// that is, they can take on one of numerous forms, not restricted to a single
+// defining form.
+//
+// The top-level token, `artifact`, is composed of two (opaque) tokens; namely
+// `socketaddr` and `path`:
+//
+//	<artifact> ::= <socketaddr> "/" <path>
+//
+// The former is described as follows:
+//
+//	   <socketaddr> ::= <host> | <host> ":" <PORT>
+//		     <host> ::= <ip> | <FQDN>
+//		       <ip> ::= <IPV4-ADDR> | <IPV6-ADDR>
+//
+// The latter, which is of greater interest here, is described as follows:
+//
+//	     <path> ::= <REPOSITORY> | <REPOSITORY> <reference>
+//	<reference> ::= "@" <digest> | ":" <TAG> "@" <DIGEST> | ":" <TAG>
+//	   <digest> ::= <ALGO> ":" <HASH>
+//
+// This second token--`path`--can take on exactly four forms, each of which will
+// now be illustrated:
+//
+//	<--- path --------------------------------------------> |  - Decode `path`
+//	<=== REPOSITORY ===> <--- reference ------------------> |    - Decode `reference`
+//	<=== REPOSITORY ===> @ <=================== digest ===> |      - Valid Form A
+//	<=== REPOSITORY ===> : <!!! TAG !!!> @ <=== digest ===> |      - Valid Form B (tag is dropped)
+//	<=== REPOSITORY ===> : <=== TAG ======================> |      - Valid Form C
+//	<=== REPOSITORY ======================================> |    - Valid Form D
+//
+// Note: In the case of Valid Form B, TAG is dropped without any validation or
+// further consideration.
+func ParseReference(artifact string) (Reference, error) {
+	parts := strings.SplitN(artifact, "/", 2)
+	if len(parts) == 1 {
+		// Invalid Form
+		return Reference{}, fmt.Errorf("%w: missing repository", errdef.ErrInvalidReference)
+	}
+	registry, path := parts[0], parts[1]
+
+	var isTag bool
+	var repository string
+	var reference string
+	if index := strings.Index(path, "@"); index != -1 {
+		// `digest` found; Valid Form A (if not B)
+		isTag = false
+		repository = path[:index]
+		reference = path[index+1:]
+
+		if index = strings.Index(repository, ":"); index != -1 {
+			// `tag` found (and now dropped without validation) since `the
+			// `digest` already present; Valid Form B
+			repository = repository[:index]
+		}
+	} else if index = strings.Index(path, ":"); index != -1 {
+		// `tag` found; Valid Form C
+		isTag = true
+		repository = path[:index]
+		reference = path[index+1:]
+	} else {
+		// empty `reference`; Valid Form D
+		repository = path
+	}
+	ref := Reference{
+		Registry:   registry,
+		Repository: repository,
+		Reference:  reference,
+	}
+
+	if err := ref.ValidateRegistry(); err != nil {
+		return Reference{}, err
+	}
+
+	if err := ref.ValidateRepository(); err != nil {
+		return Reference{}, err
+	}
+
+	if len(ref.Reference) == 0 {
+		return ref, nil
+	}
+
+	validator := ref.ValidateReferenceAsDigest
+	if isTag {
+		validator = ref.ValidateReferenceAsTag
+	}
+	if err := validator(); err != nil {
+		return Reference{}, err
+	}
+
+	return ref, nil
+}
+
+// Validate the entire reference object; the registry, the repository, and the
+// reference.
+func (r Reference) Validate() error {
+	if err := r.ValidateRegistry(); err != nil {
+		return err
+	}
+
+	if err := r.ValidateRepository(); err != nil {
+		return err
+	}
+
+	return r.ValidateReference()
+}
+
+// ValidateRegistry validates the registry.
+func (r Reference) ValidateRegistry() error {
+	if uri, err := url.ParseRequestURI("dummy://" + r.Registry); err != nil || uri.Host != r.Registry {
+		return fmt.Errorf("%w: invalid registry", errdef.ErrInvalidReference)
+	}
+	return nil
+}
+
+// ValidateRepository validates the repository.
+func (r Reference) ValidateRepository() error {
+	if !repositoryRegexp.MatchString(r.Repository) {
+		return fmt.Errorf("%w: invalid repository", errdef.ErrInvalidReference)
+	}
+	return nil
+}
+
+// ValidateReferenceAsTag validates the reference as a tag.
+func (r Reference) ValidateReferenceAsTag() error {
+	if !tagRegexp.MatchString(r.Reference) {
+		return fmt.Errorf("%w: invalid tag", errdef.ErrInvalidReference)
+	}
+	return nil
+}
+
+// ValidateReferenceAsDigest validates the reference as a digest.
+func (r Reference) ValidateReferenceAsDigest() error {
+	if _, err := r.Digest(); err != nil {
+		return fmt.Errorf("%w: invalid digest; %v", errdef.ErrInvalidReference, err)
+	}
+	return nil
+}
+
+// ValidateReference where the reference is first tried as an ampty string, then
+// as a digest, and if that fails, as a tag.
+func (r Reference) ValidateReference() error {
+	if len(r.Reference) == 0 {
+		return nil
+	}
+
+	if index := strings.IndexByte(r.Reference, ':'); index != -1 {
+		return r.ValidateReferenceAsDigest()
+	}
+
+	return r.ValidateReferenceAsTag()
+}
+
+// Host returns the host name of the registry.
+func (r Reference) Host() string {
+	if r.Registry == "docker.io" {
+		return "registry-1.docker.io"
+	}
+	return r.Registry
+}
+
+// ReferenceOrDefault returns the reference or the default reference if empty.
+func (r Reference) ReferenceOrDefault() string {
+	if r.Reference == "" {
+		return "latest"
+	}
+	return r.Reference
+}
+
+// Digest returns the reference as a digest.
+func (r Reference) Digest() (digest.Digest, error) {
+	return digest.Parse(r.Reference)
+}
+
+// String implements `fmt.Stringer` and returns the reference string.
+// The resulted string is meaningful only if the reference is valid.
+func (r Reference) String() string {
+	if r.Repository == "" {
+		return r.Registry
+	}
+	ref := r.Registry + "/" + r.Repository
+	if r.Reference == "" {
+		return ref
+	}
+	if d, err := r.Digest(); err == nil {
+		return ref + "@" + d.String()
+	}
+	return ref + ":" + r.Reference
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/registry.go b/vendor/oras.land/oras-go/v2/registry/registry.go
new file mode 100644
index 0000000000..e1da0ab9c7
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/registry.go
@@ -0,0 +1,52 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package registry provides high-level operations to manage registries.
+package registry
+
+import "context"
+
+// Registry represents a collection of repositories.
+type Registry interface {
+	// Repositories lists the name of repositories available in the registry.
+	// Since the returned repositories may be paginated by the underlying
+	// implementation, a function should be passed in to process the paginated
+	// repository list.
+	// `last` argument is the `last` parameter when invoking the catalog API.
+	// If `last` is NOT empty, the entries in the response start after the
+	// repo specified by `last`. Otherwise, the response starts from the top
+	// of the Repositories list.
+	// Note: When implemented by a remote registry, the catalog API is called.
+	// However, not all registries supports pagination or conforms the
+	// specification.
+	// Reference: https://docs.docker.com/registry/spec/api/#catalog
+	// See also `Repositories()` in this package.
+	Repositories(ctx context.Context, last string, fn func(repos []string) error) error
+
+	// Repository returns a repository reference by the given name.
+	Repository(ctx context.Context, name string) (Repository, error)
+}
+
+// Repositories lists the name of repositories available in the registry.
+func Repositories(ctx context.Context, reg Registry) ([]string, error) {
+	var res []string
+	if err := reg.Repositories(ctx, "", func(repos []string) error {
+		res = append(res, repos...)
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return res, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/auth/cache.go b/vendor/oras.land/oras-go/v2/registry/remote/auth/cache.go
new file mode 100644
index 0000000000..91a52e1c16
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/auth/cache.go
@@ -0,0 +1,159 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"context"
+	"strings"
+	"sync"
+
+	"oras.land/oras-go/v2/errdef"
+	"oras.land/oras-go/v2/internal/syncutil"
+)
+
+// DefaultCache is the sharable cache used by DefaultClient.
+var DefaultCache Cache = NewCache()
+
+// Cache caches the auth-scheme and auth-token for the "Authorization" header in
+// accessing the remote registry.
+// Precisely, the header is `Authorization: auth-scheme auth-token`.
+// The `auth-token` is a generic term as `token68` in RFC 7235 section 2.1.
+type Cache interface {
+	// GetScheme returns the auth-scheme part cached for the given registry.
+	// A single registry is assumed to have a consistent scheme.
+	// If a registry has different schemes per path, the auth client is still
+	// workable. However, the cache may not be effective as the cache cannot
+	// correctly guess the scheme.
+	GetScheme(ctx context.Context, registry string) (Scheme, error)
+
+	// GetToken returns the auth-token part cached for the given registry of a
+	// given scheme.
+	// The underlying implementation MAY cache the token for all schemes for the
+	// given registry.
+	GetToken(ctx context.Context, registry string, scheme Scheme, key string) (string, error)
+
+	// Set fetches the token using the given fetch function and caches the token
+	// for the given scheme with the given key for the given registry.
+	// The return values of the fetch function is returned by this function.
+	// The underlying implementation MAY combine the fetch operation if the Set
+	// function is invoked multiple times at the same time.
+	Set(ctx context.Context, registry string, scheme Scheme, key string, fetch func(context.Context) (string, error)) (string, error)
+}
+
+// cacheEntry is a cache entry for a single registry.
+type cacheEntry struct {
+	scheme Scheme
+	tokens sync.Map // map[string]string
+}
+
+// concurrentCache is a cache suitable for concurrent invocation.
+type concurrentCache struct {
+	status sync.Map // map[string]*syncutil.Once
+	cache  sync.Map // map[string]*cacheEntry
+}
+
+// NewCache creates a new go-routine safe cache instance.
+func NewCache() Cache {
+	return &concurrentCache{}
+}
+
+// GetScheme returns the auth-scheme part cached for the given registry.
+func (cc *concurrentCache) GetScheme(ctx context.Context, registry string) (Scheme, error) {
+	entry, ok := cc.cache.Load(registry)
+	if !ok {
+		return SchemeUnknown, errdef.ErrNotFound
+	}
+	return entry.(*cacheEntry).scheme, nil
+}
+
+// GetToken returns the auth-token part cached for the given registry of a given
+// scheme.
+func (cc *concurrentCache) GetToken(ctx context.Context, registry string, scheme Scheme, key string) (string, error) {
+	entryValue, ok := cc.cache.Load(registry)
+	if !ok {
+		return "", errdef.ErrNotFound
+	}
+	entry := entryValue.(*cacheEntry)
+	if entry.scheme != scheme {
+		return "", errdef.ErrNotFound
+	}
+	if token, ok := entry.tokens.Load(key); ok {
+		return token.(string), nil
+	}
+	return "", errdef.ErrNotFound
+}
+
+// Set fetches the token using the given fetch function and caches the token
+// for the given scheme with the given key for the given registry.
+// Set combines the fetch operation if the Set is invoked multiple times at the
+// same time.
+func (cc *concurrentCache) Set(ctx context.Context, registry string, scheme Scheme, key string, fetch func(context.Context) (string, error)) (string, error) {
+	// fetch token
+	statusKey := strings.Join([]string{
+		registry,
+		scheme.String(),
+		key,
+	}, " ")
+	statusValue, _ := cc.status.LoadOrStore(statusKey, syncutil.NewOnce())
+	fetchOnce := statusValue.(*syncutil.Once)
+	fetchedFirst, result, err := fetchOnce.Do(ctx, func() (interface{}, error) {
+		return fetch(ctx)
+	})
+	if fetchedFirst {
+		cc.status.Delete(statusKey)
+	}
+	if err != nil {
+		return "", err
+	}
+	token := result.(string)
+	if !fetchedFirst {
+		return token, nil
+	}
+
+	// cache token
+	newEntry := &cacheEntry{
+		scheme: scheme,
+	}
+	entryValue, exists := cc.cache.LoadOrStore(registry, newEntry)
+	entry := entryValue.(*cacheEntry)
+	if exists && entry.scheme != scheme {
+		// there is a scheme change, which is not expected in most scenarios.
+		// force invalidating all previous cache.
+		entry = newEntry
+		cc.cache.Store(registry, entry)
+	}
+	entry.tokens.Store(key, token)
+
+	return token, nil
+}
+
+// noCache is a cache implementation that does not do cache at all.
+type noCache struct{}
+
+// GetScheme always returns not found error as it has no cache.
+func (noCache) GetScheme(ctx context.Context, registry string) (Scheme, error) {
+	return SchemeUnknown, errdef.ErrNotFound
+}
+
+// GetToken always returns not found error as it has no cache.
+func (noCache) GetToken(ctx context.Context, registry string, scheme Scheme, key string) (string, error) {
+	return "", errdef.ErrNotFound
+}
+
+// Set calls fetch directly without caching.
+func (noCache) Set(ctx context.Context, registry string, scheme Scheme, key string, fetch func(context.Context) (string, error)) (string, error) {
+	return fetch(ctx)
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/auth/challenge.go b/vendor/oras.land/oras-go/v2/registry/remote/auth/challenge.go
new file mode 100644
index 0000000000..58bdefda9c
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/auth/challenge.go
@@ -0,0 +1,167 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"strconv"
+	"strings"
+)
+
+// Scheme define the authentication method.
+type Scheme byte
+
+const (
+	// SchemeUnknown represents unknown or unsupported schemes
+	SchemeUnknown Scheme = iota
+
+	// SchemeBasic represents the "Basic" HTTP authentication scheme.
+	// Reference: https://tools.ietf.org/html/rfc7617
+	SchemeBasic
+
+	// SchemeBearer represents the Bearer token in OAuth 2.0.
+	// Reference: https://tools.ietf.org/html/rfc6750
+	SchemeBearer
+)
+
+// parseScheme parse the authentication scheme from the given string
+// case-insensitively.
+func parseScheme(scheme string) Scheme {
+	switch {
+	case strings.EqualFold(scheme, "basic"):
+		return SchemeBasic
+	case strings.EqualFold(scheme, "bearer"):
+		return SchemeBearer
+	}
+	return SchemeUnknown
+}
+
+// String return the string for the scheme.
+func (s Scheme) String() string {
+	switch s {
+	case SchemeBasic:
+		return "Basic"
+	case SchemeBearer:
+		return "Bearer"
+	}
+	return "Unknown"
+}
+
+// parseChallenge parses the "WWW-Authenticate" header returned by the remote
+// registry, and extracts parameters if scheme is Bearer.
+// References:
+// - https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate
+// - https://tools.ietf.org/html/rfc7235#section-2.1
+func parseChallenge(header string) (scheme Scheme, params map[string]string) {
+	// as defined in RFC 7235 section 2.1, we have
+	//     challenge   = auth-scheme [ 1*SP ( token68 / #auth-param ) ]
+	//     auth-scheme = token
+	//     auth-param  = token BWS "=" BWS ( token / quoted-string )
+	//
+	// since we focus parameters only on Bearer, we have
+	//     challenge   = auth-scheme [ 1*SP #auth-param ]
+	schemeString, rest := parseToken(header)
+	scheme = parseScheme(schemeString)
+
+	// fast path for non bearer challenge
+	if scheme != SchemeBearer {
+		return
+	}
+
+	// parse params for bearer auth.
+	// combining RFC 7235 section 2.1 with RFC 7230 section 7, we have
+	//     #auth-param => auth-param *( OWS "," OWS auth-param )
+	var key, value string
+	for {
+		key, rest = parseToken(skipSpace(rest))
+		if key == "" {
+			return
+		}
+
+		rest = skipSpace(rest)
+		if rest == "" || rest[0] != '=' {
+			return
+		}
+		rest = skipSpace(rest[1:])
+		if rest == "" {
+			return
+		}
+
+		if rest[0] == '"' {
+			prefix, err := strconv.QuotedPrefix(rest)
+			if err != nil {
+				return
+			}
+			value, err = strconv.Unquote(prefix)
+			if err != nil {
+				return
+			}
+			rest = rest[len(prefix):]
+		} else {
+			value, rest = parseToken(rest)
+			if value == "" {
+				return
+			}
+		}
+		if params == nil {
+			params = map[string]string{
+				key: value,
+			}
+		} else {
+			params[key] = value
+		}
+
+		rest = skipSpace(rest)
+		if rest == "" || rest[0] != ',' {
+			return
+		}
+		rest = rest[1:]
+	}
+}
+
+// isNotTokenChar reports whether rune is not a `tchar` defined in RFC 7230
+// section 3.2.6.
+func isNotTokenChar(r rune) bool {
+	// tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*"
+	//       / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
+	//       / DIGIT / ALPHA
+	//       ; any VCHAR, except delimiters
+	return (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') &&
+		(r < '0' || r > '9') && !strings.ContainsRune("!#$%&'*+-.^_`|~", r)
+}
+
+// parseToken finds the next token from the given string. If no token found,
+// an empty token is returned and the whole of the input is returned in rest.
+// Note: Since token = 1*tchar, empty string is not a valid token.
+func parseToken(s string) (token, rest string) {
+	if i := strings.IndexFunc(s, isNotTokenChar); i != -1 {
+		return s[:i], s[i:]
+	}
+	return s, ""
+}
+
+// skipSpace skips "bad" whitespace (BWS) defined in RFC 7230 section 3.2.3.
+func skipSpace(s string) string {
+	// OWS = *( SP / HTAB )
+	//     ; optional whitespace
+	// BWS = OWS
+	//     ; "bad" whitespace
+	if i := strings.IndexFunc(s, func(r rune) bool {
+		return r != ' ' && r != '\t'
+	}); i != -1 {
+		return s[i:]
+	}
+	return s
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/auth/client.go b/vendor/oras.land/oras-go/v2/registry/remote/auth/client.go
new file mode 100644
index 0000000000..879b5c04d5
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/auth/client.go
@@ -0,0 +1,413 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package auth provides authentication for a client to a remote registry.
+package auth
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"oras.land/oras-go/v2/registry/remote/internal/errutil"
+	"oras.land/oras-go/v2/registry/remote/retry"
+)
+
+// DefaultClient is the default auth-decorated client.
+var DefaultClient = &Client{
+	Client: retry.DefaultClient,
+	Header: http.Header{
+		"User-Agent": {"oras-go"},
+	},
+	Cache: DefaultCache,
+}
+
+// maxResponseBytes specifies the default limit on how many response bytes are
+// allowed in the server's response from authorization service servers.
+// A typical response message from authorization service servers is around 1 to
+// 4 KiB. Since the size of a token must be smaller than the HTTP header size
+// limit, which is usually 16 KiB. As specified by the distribution, the
+// response may contain 2 identical tokens, that is, 16 x 2 = 32 KiB.
+// Hence, 128 KiB should be sufficient.
+// References: https://docs.docker.com/registry/spec/auth/token/
+var maxResponseBytes int64 = 128 * 1024 // 128 KiB
+
+// defaultClientID specifies the default client ID used in OAuth2.
+// See also ClientID.
+var defaultClientID = "oras-go"
+
+// StaticCredential specifies static credentials for the given host.
+func StaticCredential(registry string, cred Credential) func(context.Context, string) (Credential, error) {
+	return func(_ context.Context, target string) (Credential, error) {
+		if target == registry {
+			return cred, nil
+		}
+		return EmptyCredential, nil
+	}
+}
+
+// Client is an auth-decorated HTTP client.
+// Its zero value is a usable client that uses http.DefaultClient with no cache.
+type Client struct {
+	// Client is the underlying HTTP client used to access the remote
+	// server.
+	// If nil, http.DefaultClient is used.
+	// It is possible to use the default retry client from the package
+	// `oras.land/oras-go/v2/registry/remote/retry`. That client is already available
+	// in the DefaultClient.
+	// It is also possible to use a custom client. For example, github.com/hashicorp/go-retryablehttp
+	// is a popular HTTP client that supports retries.
+	Client *http.Client
+
+	// Header contains the custom headers to be added to each request.
+	Header http.Header
+
+	// Credential specifies the function for resolving the credential for the
+	// given registry (i.e. host:port).
+	// `EmptyCredential` is a valid return value and should not be considered as
+	// an error.
+	// If nil, the credential is always resolved to `EmptyCredential`.
+	Credential func(context.Context, string) (Credential, error)
+
+	// Cache caches credentials for direct accessing the remote registry.
+	// If nil, no cache is used.
+	Cache Cache
+
+	// ClientID used in fetching OAuth2 token as a required field.
+	// If empty, a default client ID is used.
+	// Reference: https://docs.docker.com/registry/spec/auth/oauth/#getting-a-token
+	ClientID string
+
+	// ForceAttemptOAuth2 controls whether to follow OAuth2 with password grant
+	// instead the distribution spec when authenticating using username and
+	// password.
+	// References:
+	// - https://docs.docker.com/registry/spec/auth/jwt/
+	// - https://docs.docker.com/registry/spec/auth/oauth/
+	ForceAttemptOAuth2 bool
+}
+
+// client returns an HTTP client used to access the remote registry.
+// http.DefaultClient is return if the client is not configured.
+func (c *Client) client() *http.Client {
+	if c.Client == nil {
+		return http.DefaultClient
+	}
+	return c.Client
+}
+
+// send adds headers to the request and sends the request to the remote server.
+func (c *Client) send(req *http.Request) (*http.Response, error) {
+	for key, values := range c.Header {
+		req.Header[key] = append(req.Header[key], values...)
+	}
+	return c.client().Do(req)
+}
+
+// credential resolves the credential for the given registry.
+func (c *Client) credential(ctx context.Context, reg string) (Credential, error) {
+	if c.Credential == nil {
+		return EmptyCredential, nil
+	}
+	return c.Credential(ctx, reg)
+}
+
+// cache resolves the cache.
+// noCache is return if the cache is not configured.
+func (c *Client) cache() Cache {
+	if c.Cache == nil {
+		return noCache{}
+	}
+	return c.Cache
+}
+
+// SetUserAgent sets the user agent for all out-going requests.
+func (c *Client) SetUserAgent(userAgent string) {
+	if c.Header == nil {
+		c.Header = http.Header{}
+	}
+	c.Header.Set("User-Agent", userAgent)
+}
+
+// Do sends the request to the remote server, attempting to resolve
+// authentication if 'Authorization' header is not set.
+//
+// On authentication failure due to bad credential,
+//   - Do returns error if it fails to fetch token for bearer auth.
+//   - Do returns the registry response without error for basic auth.
+func (c *Client) Do(originalReq *http.Request) (*http.Response, error) {
+	if auth := originalReq.Header.Get("Authorization"); auth != "" {
+		return c.send(originalReq)
+	}
+
+	ctx := originalReq.Context()
+	req := originalReq.Clone(ctx)
+
+	// attempt cached auth token
+	var attemptedKey string
+	cache := c.cache()
+	registry := originalReq.Host
+	scheme, err := cache.GetScheme(ctx, registry)
+	if err == nil {
+		switch scheme {
+		case SchemeBasic:
+			token, err := cache.GetToken(ctx, registry, SchemeBasic, "")
+			if err == nil {
+				req.Header.Set("Authorization", "Basic "+token)
+			}
+		case SchemeBearer:
+			scopes := GetScopes(ctx)
+			attemptedKey = strings.Join(scopes, " ")
+			token, err := cache.GetToken(ctx, registry, SchemeBearer, attemptedKey)
+			if err == nil {
+				req.Header.Set("Authorization", "Bearer "+token)
+			}
+		}
+	}
+
+	resp, err := c.send(req)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusUnauthorized {
+		return resp, nil
+	}
+
+	// attempt again with credentials for recognized schemes
+	challenge := resp.Header.Get("Www-Authenticate")
+	scheme, params := parseChallenge(challenge)
+	switch scheme {
+	case SchemeBasic:
+		resp.Body.Close()
+
+		token, err := cache.Set(ctx, registry, SchemeBasic, "", func(ctx context.Context) (string, error) {
+			return c.fetchBasicAuth(ctx, registry)
+		})
+		if err != nil {
+			return nil, fmt.Errorf("%s %q: %w", resp.Request.Method, resp.Request.URL, err)
+		}
+
+		req = originalReq.Clone(ctx)
+		req.Header.Set("Authorization", "Basic "+token)
+	case SchemeBearer:
+		resp.Body.Close()
+
+		// merge hinted scopes with challenged scopes
+		scopes := GetScopes(ctx)
+		if scope := params["scope"]; scope != "" {
+			scopes = append(scopes, strings.Split(scope, " ")...)
+			scopes = CleanScopes(scopes)
+		}
+		key := strings.Join(scopes, " ")
+
+		// attempt the cache again if there is a scope change
+		if key != attemptedKey {
+			if token, err := cache.GetToken(ctx, registry, SchemeBearer, key); err == nil {
+				req = originalReq.Clone(ctx)
+				req.Header.Set("Authorization", "Bearer "+token)
+				if err := rewindRequestBody(req); err != nil {
+					return nil, err
+				}
+
+				resp, err := c.send(req)
+				if err != nil {
+					return nil, err
+				}
+				if resp.StatusCode != http.StatusUnauthorized {
+					return resp, nil
+				}
+				resp.Body.Close()
+			}
+		}
+
+		// attempt with credentials
+		realm := params["realm"]
+		service := params["service"]
+		token, err := cache.Set(ctx, registry, SchemeBearer, key, func(ctx context.Context) (string, error) {
+			return c.fetchBearerToken(ctx, registry, realm, service, scopes)
+		})
+		if err != nil {
+			return nil, fmt.Errorf("%s %q: %w", resp.Request.Method, resp.Request.URL, err)
+		}
+
+		req = originalReq.Clone(ctx)
+		req.Header.Set("Authorization", "Bearer "+token)
+	default:
+		return resp, nil
+	}
+	if err := rewindRequestBody(req); err != nil {
+		return nil, err
+	}
+
+	return c.send(req)
+}
+
+// fetchBasicAuth fetches a basic auth token for the basic challenge.
+func (c *Client) fetchBasicAuth(ctx context.Context, registry string) (string, error) {
+	cred, err := c.credential(ctx, registry)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve credential: %w", err)
+	}
+	if cred == EmptyCredential {
+		return "", errors.New("credential required for basic auth")
+	}
+	if cred.Username == "" || cred.Password == "" {
+		return "", errors.New("missing username or password for basic auth")
+	}
+	auth := cred.Username + ":" + cred.Password
+	return base64.StdEncoding.EncodeToString([]byte(auth)), nil
+}
+
+// fetchBearerToken fetches an access token for the bearer challenge.
+func (c *Client) fetchBearerToken(ctx context.Context, registry, realm, service string, scopes []string) (string, error) {
+	cred, err := c.credential(ctx, registry)
+	if err != nil {
+		return "", err
+	}
+	if cred.AccessToken != "" {
+		return cred.AccessToken, nil
+	}
+	if cred == EmptyCredential || (cred.RefreshToken == "" && !c.ForceAttemptOAuth2) {
+		return c.fetchDistributionToken(ctx, realm, service, scopes, cred.Username, cred.Password)
+	}
+	return c.fetchOAuth2Token(ctx, realm, service, scopes, cred)
+}
+
+// fetchDistributionToken fetches an access token as defined by the distribution
+// specification.
+// It fetches anonymous tokens if no credential is provided.
+// References:
+// - https://docs.docker.com/registry/spec/auth/jwt/
+// - https://docs.docker.com/registry/spec/auth/token/
+func (c *Client) fetchDistributionToken(ctx context.Context, realm, service string, scopes []string, username, password string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, realm, nil)
+	if err != nil {
+		return "", err
+	}
+	if username != "" || password != "" {
+		req.SetBasicAuth(username, password)
+	}
+	q := req.URL.Query()
+	if service != "" {
+		q.Set("service", service)
+	}
+	for _, scope := range scopes {
+		q.Add("scope", scope)
+	}
+	req.URL.RawQuery = q.Encode()
+
+	resp, err := c.send(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", errutil.ParseErrorResponse(resp)
+	}
+
+	// As specified in https://docs.docker.com/registry/spec/auth/token/ section
+	// "Token Response Fields", the token is either in `token` or
+	// `access_token`. If both present, they are identical.
+	var result struct {
+		Token       string `json:"token"`
+		AccessToken string `json:"access_token"`
+	}
+	lr := io.LimitReader(resp.Body, maxResponseBytes)
+	if err := json.NewDecoder(lr).Decode(&result); err != nil {
+		return "", fmt.Errorf("%s %q: failed to decode response: %w", resp.Request.Method, resp.Request.URL, err)
+	}
+	if result.AccessToken != "" {
+		return result.AccessToken, nil
+	}
+	if result.Token != "" {
+		return result.Token, nil
+	}
+	return "", fmt.Errorf("%s %q: empty token returned", resp.Request.Method, resp.Request.URL)
+}
+
+// fetchOAuth2Token fetches an OAuth2 access token.
+// Reference: https://docs.docker.com/registry/spec/auth/oauth/
+func (c *Client) fetchOAuth2Token(ctx context.Context, realm, service string, scopes []string, cred Credential) (string, error) {
+	form := url.Values{}
+	if cred.RefreshToken != "" {
+		form.Set("grant_type", "refresh_token")
+		form.Set("refresh_token", cred.RefreshToken)
+	} else if cred.Username != "" && cred.Password != "" {
+		form.Set("grant_type", "password")
+		form.Set("username", cred.Username)
+		form.Set("password", cred.Password)
+	} else {
+		return "", errors.New("missing username or password for bearer auth")
+	}
+	form.Set("service", service)
+	clientID := c.ClientID
+	if clientID == "" {
+		clientID = defaultClientID
+	}
+	form.Set("client_id", clientID)
+	if len(scopes) != 0 {
+		form.Set("scope", strings.Join(scopes, " "))
+	}
+	body := strings.NewReader(form.Encode())
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, realm, body)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := c.send(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", errutil.ParseErrorResponse(resp)
+	}
+
+	var result struct {
+		AccessToken string `json:"access_token"`
+	}
+	lr := io.LimitReader(resp.Body, maxResponseBytes)
+	if err := json.NewDecoder(lr).Decode(&result); err != nil {
+		return "", fmt.Errorf("%s %q: failed to decode response: %w", resp.Request.Method, resp.Request.URL, err)
+	}
+	if result.AccessToken != "" {
+		return result.AccessToken, nil
+	}
+	return "", fmt.Errorf("%s %q: empty token returned", resp.Request.Method, resp.Request.URL)
+}
+
+// rewindRequestBody tries to rewind the request body if exists.
+func rewindRequestBody(req *http.Request) error {
+	if req.Body == nil || req.Body == http.NoBody {
+		return nil
+	}
+	if req.GetBody == nil {
+		return fmt.Errorf("%s %q: request body is not rewindable", req.Method, req.URL)
+	}
+	body, err := req.GetBody()
+	if err != nil {
+		return fmt.Errorf("%s %q: failed to get request body: %w", req.Method, req.URL, err)
+	}
+	req.Body = body
+	return nil
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/auth/credential.go b/vendor/oras.land/oras-go/v2/registry/remote/auth/credential.go
new file mode 100644
index 0000000000..013305f711
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/auth/credential.go
@@ -0,0 +1,40 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+// EmptyCredential represents an empty credential.
+var EmptyCredential Credential
+
+// Credential contains authentication credentials used to access remote
+// registries.
+type Credential struct {
+	// Username is the name of the user for the remote registry.
+	Username string
+
+	// Password is the secret associated with the username.
+	Password string
+
+	// RefreshToken is a bearer token to be sent to the authorization service
+	// for fetching access tokens.
+	// A refresh token is often referred as an identity token.
+	// Reference: https://docs.docker.com/registry/spec/auth/oauth/
+	RefreshToken string
+
+	// AccessToken is a bearer token to be sent to the registry.
+	// An access token is often referred as a registry token.
+	// Reference: https://docs.docker.com/registry/spec/auth/token/
+	AccessToken string
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/auth/scope.go b/vendor/oras.land/oras-go/v2/registry/remote/auth/scope.go
new file mode 100644
index 0000000000..24a0f89837
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/auth/scope.go
@@ -0,0 +1,236 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"context"
+	"sort"
+	"strings"
+)
+
+// Actions used in scopes.
+// Reference: https://docs.docker.com/registry/spec/auth/scope/
+const (
+	// ActionPull represents generic read access for resources of the repository
+	// type.
+	ActionPull = "pull"
+
+	// ActionPush represents generic write access for resources of the
+	// repository type.
+	ActionPush = "push"
+
+	// ActionDelete represents the delete permission for resources of the
+	// repository type.
+	ActionDelete = "delete"
+)
+
+// ScopeRegistryCatalog is the scope for registry catalog access.
+const ScopeRegistryCatalog = "registry:catalog:*"
+
+// ScopeRepository returns a repository scope with given actions.
+// Reference: https://docs.docker.com/registry/spec/auth/scope/
+func ScopeRepository(repository string, actions ...string) string {
+	actions = cleanActions(actions)
+	if repository == "" || len(actions) == 0 {
+		return ""
+	}
+	return strings.Join([]string{
+		"repository",
+		repository,
+		strings.Join(actions, ","),
+	}, ":")
+}
+
+// scopesContextKey is the context key for scopes.
+type scopesContextKey struct{}
+
+// WithScopes returns a context with scopes added. Scopes are de-duplicated.
+// Scopes are used as hints for the auth client to fetch bearer tokens with
+// larger scopes.
+//
+// For example, uploading blob to the repository "hello-world" does HEAD request
+// first then POST and PUT. The HEAD request will return a challenge for scope
+// `repository:hello-world:pull`, and the auth client will fetch a token for
+// that challenge. Later, the POST request will return a challenge for scope
+// `repository:hello-world:push`, and the auth client will fetch a token for
+// that challenge again. By invoking `WithScopes()` with the scope
+// `repository:hello-world:pull,push`, the auth client with cache is hinted to
+// fetch a token via a single token fetch request for all the HEAD, POST, PUT
+// requests.
+//
+// Passing an empty list of scopes will virtually remove the scope hints in the
+// context.
+//
+// Reference: https://docs.docker.com/registry/spec/auth/scope/
+func WithScopes(ctx context.Context, scopes ...string) context.Context {
+	scopes = CleanScopes(scopes)
+	return context.WithValue(ctx, scopesContextKey{}, scopes)
+}
+
+// AppendScopes appends additional scopes to the existing scopes in the context
+// and returns a new context. The resulted scopes are de-duplicated.
+// The append operation does modify the existing scope in the context passed in.
+func AppendScopes(ctx context.Context, scopes ...string) context.Context {
+	if len(scopes) == 0 {
+		return ctx
+	}
+	return WithScopes(ctx, append(GetScopes(ctx), scopes...)...)
+}
+
+// GetScopes returns the scopes in the context.
+func GetScopes(ctx context.Context) []string {
+	if scopes, ok := ctx.Value(scopesContextKey{}).([]string); ok {
+		return append([]string(nil), scopes...)
+	}
+	return nil
+}
+
+// CleanScopes merges and sort the actions in ascending order if the scopes have
+// the same resource type and name. The final scopes are sorted in ascending
+// order. In other words, the scopes passed in are de-duplicated and sorted.
+// Therefore, the output of this function is deterministic.
+//
+// If there is a wildcard `*` in the action, other actions in the same resource
+// type and name are ignored.
+func CleanScopes(scopes []string) []string {
+	// fast paths
+	switch len(scopes) {
+	case 0:
+		return nil
+	case 1:
+		scope := scopes[0]
+		i := strings.LastIndex(scope, ":")
+		if i == -1 {
+			return []string{scope}
+		}
+		actionList := strings.Split(scope[i+1:], ",")
+		actionList = cleanActions(actionList)
+		if len(actionList) == 0 {
+			return nil
+		}
+		actions := strings.Join(actionList, ",")
+		scope = scope[:i+1] + actions
+		return []string{scope}
+	}
+
+	// slow path
+	var result []string
+
+	// merge recognizable scopes
+	resourceTypes := make(map[string]map[string]map[string]struct{})
+	for _, scope := range scopes {
+		// extract resource type
+		i := strings.Index(scope, ":")
+		if i == -1 {
+			result = append(result, scope)
+			continue
+		}
+		resourceType := scope[:i]
+
+		// extract resource name and actions
+		rest := scope[i+1:]
+		i = strings.LastIndex(rest, ":")
+		if i == -1 {
+			result = append(result, scope)
+			continue
+		}
+		resourceName := rest[:i]
+		actions := rest[i+1:]
+		if actions == "" {
+			// drop scope since no action found
+			continue
+		}
+
+		// add to the intermediate map for de-duplication
+		namedActions := resourceTypes[resourceType]
+		if namedActions == nil {
+			namedActions = make(map[string]map[string]struct{})
+			resourceTypes[resourceType] = namedActions
+		}
+		actionSet := namedActions[resourceName]
+		if actionSet == nil {
+			actionSet = make(map[string]struct{})
+			namedActions[resourceName] = actionSet
+		}
+		for _, action := range strings.Split(actions, ",") {
+			if action != "" {
+				actionSet[action] = struct{}{}
+			}
+		}
+	}
+
+	// reconstruct scopes
+	for resourceType, namedActions := range resourceTypes {
+		for resourceName, actionSet := range namedActions {
+			if len(actionSet) == 0 {
+				continue
+			}
+			var actions []string
+			for action := range actionSet {
+				if action == "*" {
+					actions = []string{"*"}
+					break
+				}
+				actions = append(actions, action)
+			}
+			sort.Strings(actions)
+			scope := resourceType + ":" + resourceName + ":" + strings.Join(actions, ",")
+			result = append(result, scope)
+		}
+	}
+
+	// sort and return
+	sort.Strings(result)
+	return result
+}
+
+// cleanActions removes the duplicated actions and sort in ascending order.
+// If there is a wildcard `*` in the action, other actions are ignored.
+func cleanActions(actions []string) []string {
+	// fast paths
+	switch len(actions) {
+	case 0:
+		return nil
+	case 1:
+		if actions[0] == "" {
+			return nil
+		}
+		return actions
+	}
+
+	// slow path
+	sort.Strings(actions)
+	n := 0
+	for i := 0; i < len(actions); i++ {
+		if actions[i] == "*" {
+			return []string{"*"}
+		}
+		if actions[i] != actions[n] {
+			n++
+			if n != i {
+				actions[n] = actions[i]
+			}
+		}
+	}
+	n++
+	if actions[0] == "" {
+		if n == 1 {
+			return nil
+		}
+		return actions[1:n]
+	}
+	return actions[:n]
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/errcode/errors.go b/vendor/oras.land/oras-go/v2/registry/remote/errcode/errors.go
new file mode 100644
index 0000000000..cf0018a018
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/errcode/errors.go
@@ -0,0 +1,128 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errcode
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"unicode"
+)
+
+// References:
+//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#error-codes
+//   - https://docs.docker.com/registry/spec/api/#errors-2
+const (
+	ErrorCodeBlobUnknown         = "BLOB_UNKNOWN"
+	ErrorCodeBlobUploadInvalid   = "BLOB_UPLOAD_INVALID"
+	ErrorCodeBlobUploadUnknown   = "BLOB_UPLOAD_UNKNOWN"
+	ErrorCodeDigestInvalid       = "DIGEST_INVALID"
+	ErrorCodeManifestBlobUnknown = "MANIFEST_BLOB_UNKNOWN"
+	ErrorCodeManifestInvalid     = "MANIFEST_INVALID"
+	ErrorCodeManifestUnknown     = "MANIFEST_UNKNOWN"
+	ErrorCodeNameInvalid         = "NAME_INVALID"
+	ErrorCodeNameUnknown         = "NAME_UNKNOWN"
+	ErrorCodeSizeInvalid         = "SIZE_INVALID"
+	ErrorCodeUnauthorized        = "UNAUTHORIZED"
+	ErrorCodeDenied              = "DENIED"
+	ErrorCodeUnsupported         = "UNSUPPORTED"
+)
+
+// Error represents a response inner error returned by the remote
+// registry.
+// References:
+//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#error-codes
+//   - https://docs.docker.com/registry/spec/api/#errors-2
+type Error struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+	Detail  any    `json:"detail,omitempty"`
+}
+
+// Error returns a error string describing the error.
+func (e Error) Error() string {
+	code := strings.Map(func(r rune) rune {
+		if r == '_' {
+			return ' '
+		}
+		return unicode.ToLower(r)
+	}, e.Code)
+	if e.Message == "" {
+		return code
+	}
+	if e.Detail == nil {
+		return fmt.Sprintf("%s: %s", code, e.Message)
+	}
+	return fmt.Sprintf("%s: %s: %v", code, e.Message, e.Detail)
+}
+
+// Errors represents a list of response inner errors returned by the remote
+// server.
+// References:
+//   - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#error-codes
+//   - https://docs.docker.com/registry/spec/api/#errors-2
+type Errors []Error
+
+// Error returns a error string describing the error.
+func (errs Errors) Error() string {
+	switch len(errs) {
+	case 0:
+		return "<nil>"
+	case 1:
+		return errs[0].Error()
+	}
+	var errmsgs []string
+	for _, err := range errs {
+		errmsgs = append(errmsgs, err.Error())
+	}
+	return strings.Join(errmsgs, "; ")
+}
+
+// Unwrap returns the inner error only when there is exactly one error.
+func (errs Errors) Unwrap() error {
+	if len(errs) == 1 {
+		return errs[0]
+	}
+	return nil
+}
+
+// ErrorResponse represents an error response.
+type ErrorResponse struct {
+	Method     string
+	URL        *url.URL
+	StatusCode int
+	Errors     Errors
+}
+
+// Error returns a error string describing the error.
+func (err *ErrorResponse) Error() string {
+	var errmsg string
+	if len(err.Errors) > 0 {
+		errmsg = err.Errors.Error()
+	} else {
+		errmsg = http.StatusText(err.StatusCode)
+	}
+	return fmt.Sprintf("%s %q: response status code %d: %s", err.Method, err.URL, err.StatusCode, errmsg)
+}
+
+// Unwrap returns the internal errors of err if any.
+func (err *ErrorResponse) Unwrap() error {
+	if len(err.Errors) == 0 {
+		return nil
+	}
+	return err.Errors
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/internal/errutil/errutil.go b/vendor/oras.land/oras-go/v2/registry/remote/internal/errutil/errutil.go
new file mode 100644
index 0000000000..52dc3612aa
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/internal/errutil/errutil.go
@@ -0,0 +1,54 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package errutil
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+
+	"oras.land/oras-go/v2/registry/remote/errcode"
+)
+
+// maxErrorBytes specifies the default limit on how many response bytes are
+// allowed in the server's error response.
+// A typical error message is around 200 bytes. Hence, 8 KiB should be
+// sufficient.
+const maxErrorBytes int64 = 8 * 1024 // 8 KiB
+
+// ParseErrorResponse parses the error returned by the remote registry.
+func ParseErrorResponse(resp *http.Response) error {
+	resultErr := &errcode.ErrorResponse{
+		Method:     resp.Request.Method,
+		URL:        resp.Request.URL,
+		StatusCode: resp.StatusCode,
+	}
+	var body struct {
+		Errors errcode.Errors `json:"errors"`
+	}
+	lr := io.LimitReader(resp.Body, maxErrorBytes)
+	if err := json.NewDecoder(lr).Decode(&body); err == nil {
+		resultErr.Errors = body.Errors
+	}
+	return resultErr
+}
+
+// IsErrorCode returns true if err is an Error and its Code equals to code.
+func IsErrorCode(err error, code string) bool {
+	var ec errcode.Error
+	return errors.As(err, &ec) && ec.Code == code
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/retry/client.go b/vendor/oras.land/oras-go/v2/registry/remote/retry/client.go
new file mode 100644
index 0000000000..5e986ea02a
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/retry/client.go
@@ -0,0 +1,114 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package retry
+
+import (
+	"net/http"
+	"time"
+)
+
+// DefaultClient is a client with the default retry policy.
+var DefaultClient = NewClient()
+
+// NewClient creates an HTTP client with the default retry policy.
+func NewClient() *http.Client {
+	return &http.Client{
+		Transport: NewTransport(nil),
+	}
+}
+
+// Transport is an HTTP transport with retry policy.
+type Transport struct {
+	// Base is the underlying HTTP transport to use.
+	// If nil, http.DefaultTransport is used for round trips.
+	Base http.RoundTripper
+
+	// Policy returns a retry Policy to use for the request.
+	// If nil, DefaultPolicy is used to determine if the request should be retried.
+	Policy func() Policy
+}
+
+// NewTransport creates an HTTP Transport with the default retry policy.
+func NewTransport(base http.RoundTripper) *Transport {
+	return &Transport{
+		Base: base,
+	}
+}
+
+// RoundTrip executes a single HTTP transaction, returning a Response for the
+// provided Request.
+// It relies on the configured Policy to determine if the request should be
+// retried and to backoff.
+func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	ctx := req.Context()
+	policy := t.policy()
+	attempt := 0
+	for {
+		resp, respErr := t.roundTrip(req)
+		duration, err := policy.Retry(attempt, resp, respErr)
+		if err != nil {
+			if respErr == nil {
+				resp.Body.Close()
+			}
+			return nil, err
+		}
+		if duration < 0 {
+			return resp, respErr
+		}
+
+		// rewind the body if possible
+		if req.Body != nil {
+			if req.GetBody == nil {
+				// body can't be rewound, so we can't retry
+				return resp, respErr
+			}
+			body, err := req.GetBody()
+			if err != nil {
+				// failed to rewind the body, so we can't retry
+				return resp, respErr
+			}
+			req.Body = body
+		}
+
+		// close the response body if needed
+		if respErr == nil {
+			resp.Body.Close()
+		}
+
+		timer := time.NewTimer(duration)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return nil, ctx.Err()
+		case <-timer.C:
+		}
+		attempt++
+	}
+}
+
+func (t *Transport) roundTrip(req *http.Request) (*http.Response, error) {
+	if t.Base == nil {
+		return http.DefaultTransport.RoundTrip(req)
+	}
+	return t.Base.RoundTrip(req)
+}
+
+func (t *Transport) policy() Policy {
+	if t.Policy == nil {
+		return DefaultPolicy
+	}
+	return t.Policy()
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/remote/retry/policy.go b/vendor/oras.land/oras-go/v2/registry/remote/retry/policy.go
new file mode 100644
index 0000000000..fe7fadee74
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/remote/retry/policy.go
@@ -0,0 +1,154 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package retry
+
+import (
+	"hash/maphash"
+	"math"
+	"math/rand"
+	"net"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+// headerRetryAfter is the header key for Retry-After.
+const headerRetryAfter = "Retry-After"
+
+// DefaultPolicy is a policy with fine-tuned retry parameters.
+// It uses an exponential backoff with jitter.
+var DefaultPolicy Policy = &GenericPolicy{
+	Retryable: DefaultPredicate,
+	Backoff:   DefaultBackoff,
+	MinWait:   200 * time.Millisecond,
+	MaxWait:   3 * time.Second,
+	MaxRetry:  5,
+}
+
+// DefaultPredicate is a predicate that retries on 5xx errors, 429 Too Many
+// Requests, 408 Request Timeout and on network dial timeout.
+var DefaultPredicate Predicate = func(resp *http.Response, err error) (bool, error) {
+	if err != nil {
+		// retry on Dial timeout
+		if err, ok := err.(net.Error); ok && err.Timeout() {
+			return true, nil
+		}
+		return false, err
+	}
+
+	if resp.StatusCode == http.StatusRequestTimeout || resp.StatusCode == http.StatusTooManyRequests {
+		return true, nil
+	}
+
+	if resp.StatusCode == 0 || resp.StatusCode >= 500 {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+// DefaultBackoff is a backoff that uses an exponential backoff with jitter.
+// It uses a base of 250ms, a factor of 2 and a jitter of 10%.
+var DefaultBackoff Backoff = ExponentialBackoff(250*time.Millisecond, 2, 0.1)
+
+// Policy is a retry policy.
+type Policy interface {
+	// Retry returns the duration to wait before retrying the request.
+	// It returns a negative value if the request should not be retried.
+	// The attempt is used to:
+	//  - calculate the backoff duration, the default backoff is an exponential backoff.
+	//  - determine if the request should be retried.
+	// The attempt starts at 0 and should be less than MaxRetry for the request to
+	// be retried.
+	Retry(attempt int, resp *http.Response, err error) (time.Duration, error)
+}
+
+// Predicate is a function that returns true if the request should be retried.
+type Predicate func(resp *http.Response, err error) (bool, error)
+
+// Backoff is a function that returns the duration to wait before retrying the
+// request. The attempt, is the next attempt number. The response is the
+// response from the previous request.
+type Backoff func(attempt int, resp *http.Response) time.Duration
+
+// ExponentialBackoff returns a Backoff that uses an exponential backoff with
+// jitter. The backoff is calculated as:
+//
+//	temp = backoff * factor ^ attempt
+//	interval = temp * (1 - jitter) + rand.Int63n(2 * jitter * temp)
+//
+// The HTTP response is checked for a Retry-After header. If it is present, the
+// value is used as the backoff duration.
+func ExponentialBackoff(backoff time.Duration, factor, jitter float64) Backoff {
+	return func(attempt int, resp *http.Response) time.Duration {
+		var h maphash.Hash
+		h.SetSeed(maphash.MakeSeed())
+		rand := rand.New(rand.NewSource(int64(h.Sum64())))
+
+		// check Retry-After
+		if resp != nil && resp.StatusCode == http.StatusTooManyRequests {
+			if v := resp.Header.Get(headerRetryAfter); v != "" {
+				if retryAfter, _ := strconv.ParseInt(v, 10, 64); retryAfter > 0 {
+					return time.Duration(retryAfter) * time.Second
+				}
+			}
+		}
+
+		// do exponential backoff with jitter
+		temp := float64(backoff) * math.Pow(factor, float64(attempt))
+		return time.Duration(temp*(1-jitter)) + time.Duration(rand.Int63n(int64(2*jitter*temp)))
+	}
+}
+
+// GenericPolicy is a generic retry policy.
+type GenericPolicy struct {
+	// Retryable is a predicate that returns true if the request should be
+	// retried.
+	Retryable Predicate
+
+	// Backoff is a function that returns the duration to wait before retrying.
+	Backoff Backoff
+
+	// MinWait is the minimum duration to wait before retrying.
+	MinWait time.Duration
+
+	// MaxWait is the maximum duration to wait before retrying.
+	MaxWait time.Duration
+
+	// MaxRetry is the maximum number of retries.
+	MaxRetry int
+}
+
+// Retry returns the duration to wait before retrying the request.
+// It returns -1 if the request should not be retried.
+func (p *GenericPolicy) Retry(attempt int, resp *http.Response, err error) (time.Duration, error) {
+	if attempt >= p.MaxRetry {
+		return -1, nil
+	}
+	if ok, err := p.Retryable(resp, err); err != nil {
+		return -1, err
+	} else if !ok {
+		return -1, nil
+	}
+	backoff := p.Backoff(attempt, resp)
+	if backoff < p.MinWait {
+		backoff = p.MinWait
+	}
+	if backoff > p.MaxWait {
+		backoff = p.MaxWait
+	}
+	return backoff, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/registry/repository.go b/vendor/oras.land/oras-go/v2/registry/repository.go
new file mode 100644
index 0000000000..c2cb0d055b
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/registry/repository.go
@@ -0,0 +1,120 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package registry
+
+import (
+	"context"
+	"io"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"oras.land/oras-go/v2/content"
+)
+
+// Repository is an ORAS target and an union of the blob and the manifest CASs.
+//
+// As specified by https://docs.docker.com/registry/spec/api/, it is natural to
+// assume that content.Resolver interface only works for manifests. Tagging a
+// blob may be resulted in an `ErrUnsupported` error. However, this interface
+// does not restrict tagging blobs.
+//
+// Since a repository is an union of the blob and the manifest CASs, all
+// operations defined in the `BlobStore` are executed depending on the media
+// type of the given descriptor accordingly.
+//
+// Furthermore, this interface also provides the ability to enforce the
+// separation of the blob and the manifests CASs.
+type Repository interface {
+	content.Storage
+	content.Deleter
+	content.TagResolver
+	ReferenceFetcher
+	ReferencePusher
+	ReferrerLister
+	TagLister
+
+	// Blobs provides access to the blob CAS only, which contains config blobs,
+	// layers, and other generic blobs.
+	Blobs() BlobStore
+
+	// Manifests provides access to the manifest CAS only.
+	Manifests() ManifestStore
+}
+
+// BlobStore is a CAS with the ability to stat and delete its content.
+type BlobStore interface {
+	content.Storage
+	content.Deleter
+	content.Resolver
+	ReferenceFetcher
+}
+
+// ManifestStore is a CAS with the ability to stat and delete its content.
+// Besides, ManifestStore provides reference tagging.
+type ManifestStore interface {
+	BlobStore
+	content.Tagger
+	ReferencePusher
+}
+
+// ReferencePusher provides advanced push with the tag service.
+type ReferencePusher interface {
+	// PushReference pushes the manifest with a reference tag.
+	PushReference(ctx context.Context, expected ocispec.Descriptor, content io.Reader, reference string) error
+}
+
+// ReferenceFetcher provides advanced fetch with the tag service.
+type ReferenceFetcher interface {
+	// FetchReference fetches the content identified by the reference.
+	FetchReference(ctx context.Context, reference string) (ocispec.Descriptor, io.ReadCloser, error)
+}
+
+// ReferrerLister provides the Referrers API.
+// Reference: https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#listing-referrers
+type ReferrerLister interface {
+	Referrers(ctx context.Context, desc ocispec.Descriptor, artifactType string, fn func(referrers []ocispec.Descriptor) error) error
+}
+
+// TagLister lists tags by the tag service.
+type TagLister interface {
+	// Tags lists the tags available in the repository.
+	// Since the returned tag list may be paginated by the underlying
+	// implementation, a function should be passed in to process the paginated
+	// tag list.
+	// `last` argument is the `last` parameter when invoking the tags API.
+	// If `last` is NOT empty, the entries in the response start after the
+	// tag specified by `last`. Otherwise, the response starts from the top
+	// of the Tags list.
+	// Note: When implemented by a remote registry, the tags API is called.
+	// However, not all registries supports pagination or conforms the
+	// specification.
+	// References:
+	// - https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md#content-discovery
+	// - https://docs.docker.com/registry/spec/api/#tags
+	// See also `Tags()` in this package.
+	Tags(ctx context.Context, last string, fn func(tags []string) error) error
+}
+
+// Tags lists the tags available in the repository.
+func Tags(ctx context.Context, repo TagLister) ([]string, error) {
+	var res []string
+	if err := repo.Tags(ctx, "", func(tags []string) error {
+		res = append(res, tags...)
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return res, nil
+}
diff --git a/vendor/oras.land/oras-go/v2/target.go b/vendor/oras.land/oras-go/v2/target.go
new file mode 100644
index 0000000000..c6dcaef9ba
--- /dev/null
+++ b/vendor/oras.land/oras-go/v2/target.go
@@ -0,0 +1,43 @@
+/*
+Copyright The ORAS Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package oras
+
+import "oras.land/oras-go/v2/content"
+
+// Target is a CAS with generic tags.
+type Target interface {
+	content.Storage
+	content.TagResolver
+}
+
+// GraphTarget is a CAS with generic tags that supports direct predecessor node
+// finding.
+type GraphTarget interface {
+	content.GraphStorage
+	content.TagResolver
+}
+
+// ReadOnlyTarget represents a read-only Target.
+type ReadOnlyTarget interface {
+	content.ReadOnlyStorage
+	content.Resolver
+}
+
+// ReadOnlyGraphTarget represents a read-only GraphTarget.
+type ReadOnlyGraphTarget interface {
+	content.ReadOnlyGraphStorage
+	content.Resolver
+}
diff --git a/version/version.go b/version/version.go
index ec49d1b5b4..0dfba38a73 100644
--- a/version/version.go
+++ b/version/version.go
@@ -10,11 +10,14 @@ import (
 )
 
 // Version is the canonical version of OPA.
-var Version = "0.36.0-dev"
+var Version = "0.53.0-dev"
 
 // GoVersion is the version of Go this was built with
 var GoVersion = runtime.Version()
 
+// Platform is the runtime OS and architecture of this OPA binary
+var Platform = runtime.GOOS + "/" + runtime.GOARCH
+
 // Additional version information that is displayed by the "version" command and used to
 // identify the version of running instances of OPA.
 var (
diff --git a/version/version_go1.18.go b/version/version_go1.18.go
new file mode 100644
index 0000000000..8c02ca49d2
--- /dev/null
+++ b/version/version_go1.18.go
@@ -0,0 +1,33 @@
+// Copyright 2022 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+//go:build go1.18
+// +build go1.18
+
+package version
+
+import (
+	"runtime/debug"
+)
+
+func init() {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		return
+	}
+	dirty := false
+	for _, s := range bi.Settings {
+		switch s.Key {
+		case "vcs.time":
+			Timestamp = s.Value
+		case "vcs.revision":
+			Vcs = s.Value
+		case "vcs.modified":
+			dirty = s.Value == "true"
+		}
+	}
+	if dirty {
+		Vcs = Vcs + "-dirty"
+	}
+}
diff --git a/wasm/Makefile b/wasm/Makefile
index ef04b8bcff..60f2300187 100644
--- a/wasm/Makefile
+++ b/wasm/Makefile
@@ -1,8 +1,6 @@
 DOCKER := docker
-
-DEBUG ?= 0
-
 DOCKER_FLAGS := --rm -e DEBUG
+DEBUG ?= 0
 
 ifeq ($(shell tty > /dev/null && echo 1 || echo 0), 1)
 DOCKER_FLAGS += -it
diff --git a/wasm/README.md b/wasm/README.md
index 967524c953..bc56709653 100644
--- a/wasm/README.md
+++ b/wasm/README.md
@@ -1,26 +1,30 @@
 # OPA-WASM
 
 This directory contains a library that implements various low-level
-operations for policies compiled into WebAssembly (WASM). Specifically, the
-library implements:
-
-* JSON parsing
-* JSON AST (e.g., comparison, iteration, lookup, etc.)
-* String operations
-* Memory allocation
+operations for policies compiled into WebAssembly (Wasm). Specifically, the
+library implements most of the built-in functions provided by OPA. See the "Wasm"
+tag next to each function listed in the
+[built-in function reference](https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions)
+for the complete list, or the 
+[builtin_metadata.json](https://github.com/open-policy-agent/opa/blob/main/builtin_metadata.json) file for programmatic purposes.
 
 This library does not make any backwards compatibility guarantees.
 
+## Documentation
+
+See the [OPA docs](https://www.openpolicyagent.org/docs/latest/wasm/) on Wasm for an overview of the integration,
+compilation options, and more.
+
 ## Development
 
 You should have Docker installed to build and test changes to the library. We
-commit the output of the build (`opa.wasm`) into the repository so it's
+commit the output of the build (`opa.wasm`) into the repository, so it's
 important for the build output to be reproducible.
 
 You can build the library by running `make build`. This will produce WASM
 executables under the `_obj` directory.
 
-You can test the library by running `make test`. By default the test runner
+You can test the library by running `make test`. By default, the test runner
 does not print messages when tests pass. If you run `make test VERBOSE=1` it
 will log all of the tests that were run.
 
@@ -44,4 +48,4 @@ target will:
 
 1. Build the OPA-WASM library
 2. Copy the library into the [internal/compiler/wasm/opa](../internal/compiler/wasm/opa) directory.
-3. Run the tool to generate the [internal/compiler/wasm/opa/opa.go](../internal/compiler/wasm/opa/opa.go) file.
\ No newline at end of file
+3. Run the tool to generate the [internal/compiler/wasm/opa/opa.go](../internal/compiler/wasm/opa/opa.go) file.
diff --git a/wasm/src/array.c b/wasm/src/array.c
index e95d0af5e5..595fb988db 100644
--- a/wasm/src/array.c
+++ b/wasm/src/array.c
@@ -66,3 +66,24 @@ opa_value *opa_array_slice(opa_value *a, opa_value *i, opa_value *j)
 
     return &r->hdr;
 }
+
+OPA_BUILTIN
+opa_value *opa_array_reverse(opa_value *a)
+{
+    if (opa_value_type(a) != OPA_ARRAY)
+    {
+        return NULL;
+    }
+
+    opa_array_t *arr = opa_cast_array(a);
+
+    opa_array_t *reversed = opa_cast_array(opa_array_with_cap(arr->len));
+
+    int n = arr->len;
+
+    for (int i = 0; i < n; i++) {
+        opa_array_append(reversed, arr->elems[n - 1 - i].v);
+    }
+
+    return &reversed->hdr;
+}
diff --git a/wasm/src/array.h b/wasm/src/array.h
index 298a8f5b23..e1bcdce904 100644
--- a/wasm/src/array.h
+++ b/wasm/src/array.h
@@ -3,5 +3,6 @@
 
 opa_value *opa_array_concat(opa_value *a, opa_value *b);
 opa_value *opa_array_slice(opa_value *a, opa_value *i, opa_value *j);
+opa_value *opa_array_reverse(opa_value *a);
 
 #endif
diff --git a/wasm/src/encoding.c b/wasm/src/encoding.c
index b136f381a5..9b22d7f641 100644
--- a/wasm/src/encoding.c
+++ b/wasm/src/encoding.c
@@ -39,6 +39,7 @@
 #include <limits.h>
 
 #include "json.h"
+#include "malloc.h"
 #include "value.h"
 
 static const unsigned char base64_table[65] =
@@ -222,7 +223,7 @@ opa_value *opa_base64_is_valid(opa_value *a)
 {
     if (opa_value_type(a) != OPA_STRING)
     {
-        return NULL;
+        return opa_boolean(false);
     }
 
     opa_string_t *s = opa_cast_string(a);
@@ -316,3 +317,24 @@ opa_value *opa_json_marshal(opa_value *a)
 
     return opa_string_allocated(v, strlen(v));
 }
+
+OPA_BUILTIN
+opa_value *opa_json_is_valid(opa_value *a)
+{
+    if (opa_value_type(a) != OPA_STRING)
+    {
+        return opa_boolean(false);
+    }
+
+
+    opa_string_t *s = opa_cast_string(a);
+    opa_value *r = opa_json_parse(s->v, s->len);
+
+	if (r == NULL)
+	{
+		return opa_boolean(false);
+	}
+
+	opa_free(r);
+	return opa_boolean(true);
+}
\ No newline at end of file
diff --git a/wasm/src/encoding.h b/wasm/src/encoding.h
index c492f2c3e1..95d1fc427b 100644
--- a/wasm/src/encoding.h
+++ b/wasm/src/encoding.h
@@ -10,5 +10,6 @@ opa_value *opa_base64_url_decode(opa_value *a);
 opa_value *opa_base64_url_encode(opa_value *a);
 opa_value *opa_json_unmarshal(opa_value *a);
 opa_value *opa_json_marshal(opa_value *a);
+opa_value *opa_json_is_valid(opa_value *a);
 
 #endif
diff --git a/wasm/src/glob-compiler.cc b/wasm/src/glob-compiler.cc
index 40fbc54a51..5b6aaad785 100644
--- a/wasm/src/glob-compiler.cc
+++ b/wasm/src/glob-compiler.cc
@@ -128,7 +128,7 @@ std::string glob_translate(const char *glob, size_t n, const std::vector<std::st
 
     if (delimiters.empty())
     {
-        single_mark = "[^\\.]";
+        single_mark = ".";
     } else {
         single_mark = "[^";
 
diff --git a/wasm/src/glob.cc b/wasm/src/glob.cc
index 12bad6a695..4471f92903 100644
--- a/wasm/src/glob.cc
+++ b/wasm/src/glob.cc
@@ -53,7 +53,9 @@ static glob_cache* cache()
 OPA_BUILTIN
 opa_value *opa_glob_match(opa_value *pattern, opa_value *delimiters, opa_value *match)
 {
-    if (opa_value_type(pattern) != OPA_STRING || opa_value_type(delimiters) != OPA_ARRAY || opa_value_type(match) != OPA_STRING)
+    if (opa_value_type(pattern) != OPA_STRING ||
+        (opa_value_type(delimiters) != OPA_ARRAY && opa_value_type(delimiters) != OPA_NULL) ||
+        opa_value_type(match) != OPA_STRING)
     {
         return NULL;
     }
@@ -75,6 +77,15 @@ opa_value *opa_glob_match(opa_value *pattern, opa_value *delimiters, opa_value *
         v.push_back(std::string(s->v, s->len));
         prev = curr;
     }
+    
+    // NOTE(sr): If we're passed an empty array, use "." as default delimiter.
+    //           If we're passed OPA_NULL, use no delimiter; but separate glob parts by '.*'
+    if (opa_value_type(delimiters) == OPA_ARRAY) {
+        if (v.empty())
+        {
+            v.push_back(std::string("."));
+        }
+    }
 
     glob_cache *c = cache();
     cache_key key = cache_key(std::string(p->v, p->len), v);
diff --git a/wasm/src/graphs.c b/wasm/src/graphs.c
index 4e41feb0c1..6f29280403 100644
--- a/wasm/src/graphs.c
+++ b/wasm/src/graphs.c
@@ -47,7 +47,11 @@ opa_value *builtin_graph_reachable(opa_value *graph, opa_value *initial)
 {
     if (opa_value_type(graph) != OPA_OBJECT)
     {
-        return opa_set();
+        return NULL;
+    }
+    if (opa_value_type(initial) != OPA_SET && opa_value_type(initial) != OPA_ARRAY)
+    {
+        return NULL;
     }
 
     // This is a queue that holds all nodes we still need to visit. It is
diff --git a/wasm/src/malloc.c b/wasm/src/malloc.c
index 41d22da729..f8c03ac91d 100644
--- a/wasm/src/malloc.c
+++ b/wasm/src/malloc.c
@@ -37,6 +37,14 @@ static struct heap_blocks heap_free[5] = {
     {false, 128},
 };
 
+static struct heap_blocks heap_stash[5] = {
+    {true, 4},
+    {true, 8},
+    {true, 16},
+    {true, 64},
+    {false, 128},
+};
+
 #ifdef DEBUG
 #define HEAP_CHECK(blocks) heap_check(__FUNCTION__, blocks)
 #else
@@ -56,6 +64,16 @@ static void init_free()
     }
 }
 
+static void init_stash()
+{
+    for (int i = 0; i < ARRAY_SIZE(heap_stash); i++) {
+        heap_stash[i].start =
+            (struct heap_block) { 0, NULL, &heap_stash[i].end };
+        heap_stash[i].end =
+            (struct heap_block) { 0, &heap_stash[i].start, NULL };
+    }
+}
+
 static void heap_check(const char *name, struct heap_blocks *blocks)
 {
     struct heap_block *start = &blocks->start;
@@ -116,6 +134,7 @@ void opa_malloc_init(unsigned int heap_base)
     heap_ptr = heap_base;
     heap_top = __builtin_wasm_memory_grow(0, 0) * WASM_PAGE_SIZE;
     init_free();
+    init_stash();
 }
 
 void opa_malloc_init_test(void)
@@ -144,6 +163,75 @@ void opa_heap_ptr_set(unsigned int ptr)
     init_free();
 }
 
+OPA_INTERNAL
+void move_freelists(struct heap_blocks *dst_block_list,
+                    struct heap_blocks *src_block_list,
+                    const char *caller_fail_msg)
+{
+    /*
+     * First verify that dst freelists are empty and
+     * all blocks in the src are below the current heap pointer.
+     */
+    for (int i = 0; i < ARRAY_SIZE(heap_free); i++)
+    {
+        struct heap_blocks *dst = &dst_block_list[i];
+        struct heap_blocks *src = &src_block_list[i];
+
+        if (dst->start.next != &dst->end || dst->end.prev != &dst->start)
+            opa_abort(caller_fail_msg);
+
+        if (src->end.prev != &src->start) {
+            struct heap_block *b = src->end.prev;
+            if ((unsigned int)b + b->size + sizeof(struct heap_block) > heap_ptr)
+                opa_abort(caller_fail_msg);
+        }
+    }
+
+    /* Now move the blocks en masse from one freelist to the other. */
+    for (int i = 0; i < ARRAY_SIZE(heap_free); i++)
+    {
+        struct heap_blocks *dst = &dst_block_list[i];
+        struct heap_blocks *src = &src_block_list[i];
+
+        dst->start.prev = NULL; /* unnecessary, but safe */
+        dst->start.next = src->start.next;
+        dst->start.next->prev = &dst->start;
+
+        dst->end.prev = src->end.prev;
+        dst->end.next = NULL; /* unnecessary, but safe */
+        dst->end.prev->next = &dst->end;
+    }
+
+    /*
+     * Note that this leaves src w/ dangling pointers.  Caller
+     * must be sure to re-initialize those blocks.
+     */
+}
+
+WASM_EXPORT(opa_heap_blocks_stash)
+void opa_heap_blocks_stash(void)
+{
+    move_freelists(heap_stash, heap_free,
+                   "opa_heap_blocks_stash() consistency check failed");
+    /* clean up dangling references */
+    init_free();
+}
+
+WASM_EXPORT(opa_heap_stash_clear)
+void opa_heap_stash_clear(void)
+{
+    init_stash();
+}
+
+WASM_EXPORT(opa_heap_blocks_restore)
+void opa_heap_blocks_restore(void)
+{
+    move_freelists(heap_free, heap_stash,
+                   "opa_heap_blocks_restore() consistency check failed");
+    /* clean up dangling references */
+    init_stash();
+}
+
 void opa_heap_top_set(unsigned int top)
 {
     heap_top = top;
@@ -313,6 +401,13 @@ void opa_free(void *ptr)
         if (prev_end == block)
         {
             prev->size += sizeof(struct heap_block) + block->size;
+            prev_end = (void *)(&prev->data[0]) + prev->size;
+            if (prev_end == prev->next) {
+                struct heap_block *next = prev->next;
+                prev->size += sizeof(struct heap_block) + next->size;
+                prev->next = next->next;
+                prev->next->prev = prev;
+            }
             compact_free(blocks);
             return;
         }
diff --git a/wasm/src/malloc.h b/wasm/src/malloc.h
index 356117dcf1..daae6850af 100644
--- a/wasm/src/malloc.h
+++ b/wasm/src/malloc.h
@@ -26,6 +26,10 @@ void opa_builtin_cache_set(size_t i, void *p);
 void opa_heap_compact(void);
 size_t opa_heap_free_blocks(void);
 
+void opa_heap_blocks_stash(void);
+void opa_heap_blocks_restore(void);
+void opa_heap_stash_clear(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/wasm/src/object.c b/wasm/src/object.c
index fcc2cc4ffd..02ac66ab69 100644
--- a/wasm/src/object.c
+++ b/wasm/src/object.c
@@ -435,15 +435,72 @@ opa_value *builtin_object_get(opa_value *obj, opa_value *key, opa_value *value)
         return NULL;
     }
 
-    opa_object_elem_t *elem = opa_object_get(opa_cast_object(obj), key);
-    if (elem != NULL)
+    opa_value *elem;
+
+    // if the key is not an array, then we get that top level key from the object/array or return the default value
+    if (opa_value_type(key) != OPA_ARRAY) {
+        elem = opa_value_get(obj, key);
+        if (elem != NULL)
+        {
+            return elem;
+        }
+
+        return value;
+    }
+
+    size_t path_len = opa_cast_array(key)->len;
+    // if the path is empty, then we skip selecting nested keys and return the default
+    if (path_len == 0) {
+        return obj;
+    }
+
+    for (int i = 0; i < path_len; i++)
     {
-       return elem->v;
+        opa_value *path_component = opa_cast_array(key)->elems[i].v;
+
+        elem = opa_value_get(obj, path_component);
+
+        if (elem == NULL)
+        {
+            return value;
+        }
+
+        if (i == path_len-1)
+        {
+            return elem;
+        }
+
+        obj = elem;
     }
 
     return value;
 }
 
+OPA_BUILTIN
+opa_value *builtin_object_keys(opa_value *a)
+{
+    if (opa_value_type(a) != OPA_OBJECT)
+    {
+        return NULL;
+    }
+
+    opa_object_t *obj = opa_cast_object(a);
+    opa_set_t *keys = opa_cast_set(opa_set_with_cap(obj->len));
+
+    for (int i = 0; i < obj->n; i++)
+    {
+        opa_object_elem_t *elem = obj->buckets[i];
+
+        while (elem != NULL)
+        {
+            opa_set_add(keys, elem->k);
+            elem = elem->next;
+        }
+    }
+
+    return &keys->hdr;
+}
+
 OPA_BUILTIN
 opa_value *builtin_object_remove(opa_value *obj, opa_value *keys)
 {
@@ -509,6 +566,34 @@ opa_value *builtin_object_union(opa_value *a, opa_value *b)
     return r;
 }
 
+OPA_BUILTIN
+opa_value *builtin_object_union_n(opa_value *a)
+{
+    opa_value *r = NULL;
+
+    for (opa_value *key = opa_value_iter(a, NULL); key != NULL;
+         key = opa_value_iter(a, key)){
+        opa_value *next_obj = opa_value_get(a, key);
+        if (opa_value_type(next_obj) != OPA_OBJECT) {
+            return NULL;
+        }
+
+        if (r == NULL) {
+            r = next_obj;
+        } else {
+            opa_value *merged = builtin_object_union(r, next_obj);
+
+            if (merged == NULL) {
+                return NULL;
+            }
+
+            r = merged;
+        }
+    }
+
+    return r;
+}
+
 OPA_BUILTIN
 opa_value *builtin_json_remove(opa_value *obj, opa_value *paths)
 {
diff --git a/wasm/src/object.h b/wasm/src/object.h
index e35859e5c1..4cca8e7ad6 100644
--- a/wasm/src/object.h
+++ b/wasm/src/object.h
@@ -6,8 +6,10 @@
 
 opa_value *builtin_object_filter(opa_value *obj, opa_value *keys);
 opa_value *builtin_object_get(opa_value *obj, opa_value *key, opa_value *value);
+opa_value *builtin_object_keys(opa_value *obj);
 opa_value *builtin_object_remove(opa_value *obj, opa_value *keys);
 opa_value *builtin_object_union(opa_value *a, opa_value *b);
+opa_value *builtin_object_union_n(opa_value *a);
 opa_value *builtin_json_remove(opa_value *obj, opa_value *paths);
 opa_value *builtin_json_filter(opa_value *obj, opa_value *paths);
 
diff --git a/wasm/src/set.c b/wasm/src/set.c
index 4854b60688..d2d426cbfd 100644
--- a/wasm/src/set.c
+++ b/wasm/src/set.c
@@ -98,7 +98,7 @@ opa_value *opa_sets_intersection(opa_value *v)
                 r = opa_set_union(opa_set(), elem->v);
             } else {
                 opa_value *x = opa_set_intersection(r, elem->v);
-                opa_value_free(r);
+                opa_value_free_shallow(r);
                 if (x == NULL)
                 {
                     return NULL;
@@ -174,7 +174,7 @@ opa_value *opa_sets_union(opa_value *v)
             }
 
             opa_value *x = opa_set_union(r, elem->v);
-            opa_value_free(r);
+            opa_value_free_shallow(r);
             if (x == NULL)
             {
                 return NULL;
diff --git a/wasm/src/strings.c b/wasm/src/strings.c
index 06efba9517..1c621c92b0 100644
--- a/wasm/src/strings.c
+++ b/wasm/src/strings.c
@@ -6,6 +6,207 @@
 #include "strings.h"
 #include "unicode.h"
 
+OPA_BUILTIN
+opa_value *opa_strings_any_prefix_match(opa_value *a, opa_value *b)
+{
+    // If the first argument is a string, continue to matching.
+    // Otherwise, if it's an array or set, recur for each element.
+    // In other words if opa_strings_any_prefix_match(["test", "test2"], x) is called,
+    // then this will result in two recurrent calls:
+    // - opa_strings_any_prefix_match("test", x)
+    // - opa_strings_any_prefix_match("test2", x)
+    switch (opa_value_type(a))
+    {
+    case OPA_STRING: {
+        break;
+    }
+    case OPA_ARRAY:
+    case OPA_SET: {
+        opa_value *prev = NULL;
+        opa_value *curr = NULL;
+        while ((curr = opa_value_iter(a, prev)) != NULL)
+        {
+            opa_value *elem = opa_value_get(a, curr);
+            if (opa_value_type(elem) != OPA_STRING)
+            {
+                return NULL;
+            }
+
+            opa_value *res = opa_strings_any_prefix_match(elem, b);
+            if (res == NULL) {
+                return NULL;
+            }
+            opa_boolean_t *res_b = opa_cast_boolean(res);
+            if (res_b->v) {
+                return res;
+            }
+            opa_value_free(res);
+
+            prev = curr;
+        }
+        return opa_boolean(false);
+    }
+    default:
+        return NULL;
+    }
+
+    // If the second argument is a string, continue to matching.
+    // Otherwise, if it's an array or set, recur for each element.
+    // In other words if opa_strings_any_prefix_match(x, ["test", "test2"]) is called,
+    // then this will result in two recurrent calls:
+    // - opa_strings_any_prefix_match(x, "test")
+    // - opa_strings_any_prefix_match(x, "test2")
+    switch (opa_value_type(b))
+    {
+    case OPA_STRING: {
+        break;
+    }
+    case OPA_ARRAY:
+    case OPA_SET: {
+        opa_value *prev = NULL;
+        opa_value *curr = NULL;
+        while ((curr = opa_value_iter(b, prev)) != NULL)
+        {
+            opa_value *elem = opa_value_get(b, curr);
+            if (opa_value_type(elem) != OPA_STRING)
+            {
+                return NULL;
+            }
+
+            opa_value *res = opa_strings_any_prefix_match(a, elem);
+            if (res == NULL) {
+                return NULL;
+            }
+            opa_boolean_t *res_b = opa_cast_boolean(res);
+            if (res_b->v) {
+                return res;
+            }
+            opa_value_free(res);
+
+            prev = curr;
+        }
+        return opa_boolean(false);
+    }
+    default:
+        return NULL;
+    }
+
+    opa_string_t *s = opa_cast_string(a);
+    opa_string_t *prefix = opa_cast_string(b);
+
+    if (s->len < prefix->len)
+    {
+        return opa_boolean(false);
+    }
+
+    return opa_boolean(opa_strncmp(s->v, prefix->v, prefix->len) == 0);
+}
+
+OPA_BUILTIN
+opa_value *opa_strings_any_suffix_match(opa_value *a, opa_value *b)
+{
+
+    // If the first argument is a string, continue to matching.
+    // Otherwise, if it's an array or set, recur for each element.
+    // In other words if opa_strings_any_suffix_match(["test", "test2"], x) is called,
+    // then this will result in two recurrent calls:
+    // - opa_strings_any_suffix_match("test", x)
+    // - opa_strings_any_suffix_match("test2", x)
+    switch (opa_value_type(a))
+    {
+    case OPA_STRING: {
+        break;
+    }
+    case OPA_ARRAY:
+    case OPA_SET: {
+        opa_value *prev = NULL;
+        opa_value *curr = NULL;
+        while ((curr = opa_value_iter(a, prev)) != NULL)
+        {
+            opa_value *elem = opa_value_get(a, curr);
+            if (opa_value_type(elem) != OPA_STRING)
+            {
+                return NULL;
+            }
+
+            opa_value *res = opa_strings_any_suffix_match(elem, b);
+            if (res == NULL) {
+                return NULL;
+            }
+            opa_boolean_t *res_b = opa_cast_boolean(res);
+            if (res_b->v) {
+                return res;
+            }
+            opa_value_free(res);
+
+            prev = curr;
+        }
+        return opa_boolean(false);
+    }
+    default:
+        return NULL;
+    }
+
+    // If the second argument is a string, continue to matching.
+    // Otherwise, if it's an array or set, recur for each element.
+    // In other words if opa_strings_any_suffix_match(x, ["test", "test2"]) is called,
+    // then this will result in two recurrent calls:
+    // - opa_strings_any_suffix_match(x, "test")
+    // - opa_strings_any_suffix_match(x, "test2")
+    switch (opa_value_type(b))
+    {
+    case OPA_STRING: {
+        break;
+    }
+    case OPA_ARRAY:
+    case OPA_SET: {
+        opa_value *prev = NULL;
+        opa_value *curr = NULL;
+        while ((curr = opa_value_iter(b, prev)) != NULL)
+        {
+            opa_value *elem = opa_value_get(b, curr);
+            if (opa_value_type(elem) != OPA_STRING)
+            {
+                return NULL;
+            }
+
+            opa_value *res = opa_strings_any_suffix_match(a, elem);
+            if (res == NULL) {
+                return NULL;
+            }
+            opa_boolean_t *res_b = opa_cast_boolean(res);
+            if (res_b->v) {
+                return res;
+            }
+            opa_value_free(res);
+
+            prev = curr;
+        }
+        return opa_boolean(false);
+    }
+    default:
+        return NULL;
+    }
+
+    opa_string_t *s = opa_cast_string(a);
+    opa_string_t *suffix = opa_cast_string(b);
+
+    if (s->len < suffix->len)
+    {
+        return opa_boolean(false);
+    }
+
+    for (int i = 0; i < suffix->len; i++)
+    {
+        if (s->v[s->len - suffix->len + i] != suffix->v[i])
+        {
+            return opa_boolean(false);
+        }
+    }
+
+    return opa_boolean(true);
+}
+
 OPA_BUILTIN
 opa_value *opa_strings_concat(opa_value *a, opa_value *b)
 {
@@ -351,6 +552,33 @@ opa_value *opa_strings_replace_n(opa_value *a, opa_value *b)
     return result;
 }
 
+OPA_BUILTIN
+opa_value *opa_strings_reverse(opa_value *a)
+{
+    if (opa_value_type(a) != OPA_STRING)
+    {
+        return NULL;
+    }
+
+    opa_string_t *s = opa_cast_string(a);
+
+    char *reversed = opa_malloc(s->len + 1);
+
+    for (int i = 0; i < s->len; )
+    {
+        int len = 0;
+        if (opa_unicode_decode_utf8(s->v, i, s->len, &len) == -1)
+        {
+            opa_abort("string: invalid unicode");
+        }
+        memcpy(&reversed[s->len - i - len], &s->v[i], len);
+        i += len;
+    }
+    reversed[s->len] = '\0';
+
+    return opa_string_allocated(reversed, s->len);
+}
+
 OPA_BUILTIN
 opa_value *opa_strings_split(opa_value *a, opa_value *b)
 {
diff --git a/wasm/src/strings.h b/wasm/src/strings.h
index 74474aa0b7..19c08a1a24 100644
--- a/wasm/src/strings.h
+++ b/wasm/src/strings.h
@@ -3,6 +3,8 @@
 
 #include "value.h"
 
+opa_value *opa_strings_any_prefix_match(opa_value *a, opa_value *b);
+opa_value *opa_strings_any_suffix_match(opa_value *a, opa_value *b);
 opa_value *opa_strings_concat(opa_value *a, opa_value *b);
 opa_value *opa_strings_contains(opa_value *a, opa_value *b);
 opa_value *opa_strings_endswith(opa_value *a, opa_value *b);
@@ -11,6 +13,7 @@ opa_value *opa_strings_indexof(opa_value *a, opa_value *b);
 opa_value *opa_strings_lower(opa_value *a);
 opa_value *opa_strings_replace(opa_value *a, opa_value *b, opa_value *c);
 opa_value *opa_strings_replace_n(opa_value *a, opa_value *b);
+opa_value *opa_strings_reverse(opa_value *a);
 opa_value *opa_strings_split(opa_value *a, opa_value *b);
 opa_value *opa_strings_startswith(opa_value *a, opa_value *b);
 opa_value *opa_strings_substring(opa_value *a, opa_value *b, opa_value *c);
diff --git a/wasm/src/types.c b/wasm/src/types.c
index bb1bc8c34e..6614d77d59 100644
--- a/wasm/src/types.c
+++ b/wasm/src/types.c
@@ -4,43 +4,43 @@
 OPA_BUILTIN
 opa_value *opa_types_is_number(opa_value *v)
 {
-    return opa_value_type(v) == OPA_NUMBER ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_NUMBER);
 }
 
 OPA_BUILTIN
 opa_value *opa_types_is_string(opa_value *v)
 {
-    return opa_value_type(v) == OPA_STRING ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_STRING);
 }
 
 OPA_BUILTIN
 opa_value *opa_types_is_boolean(opa_value *v)
 {
-    return opa_value_type(v) == OPA_BOOLEAN ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_BOOLEAN);
 }
 
 OPA_BUILTIN
 opa_value *opa_types_is_array(opa_value *v)
 {
-    return opa_value_type(v) == OPA_ARRAY ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_ARRAY);
 }
 
 OPA_BUILTIN
 opa_value *opa_types_is_set(opa_value *v)
 {
-    return opa_value_type(v) == OPA_SET ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_SET);
 }
 
 OPA_BUILTIN
 opa_value *opa_types_is_object(opa_value *v)
 {
-    return opa_value_type(v) == OPA_OBJECT ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_OBJECT);
 }
 
 OPA_BUILTIN
 opa_value *opa_types_is_null(opa_value *v)
 {
-    return opa_value_type(v) == OPA_NULL ? opa_boolean(true) : NULL;
+    return opa_boolean(opa_value_type(v) == OPA_NULL);
 }
 
 OPA_BUILTIN
diff --git a/wasm/src/value.c b/wasm/src/value.c
index 07f3c30e9d..a43ced4a4f 100644
--- a/wasm/src/value.c
+++ b/wasm/src/value.c
@@ -442,8 +442,8 @@ int opa_value_compare_object(opa_object_t *a, opa_object_t *b)
     }
 
 finish:
-    opa_array_free(a_keys);
-    opa_array_free(b_keys);
+    opa_array_free(a_keys, 0);
+    opa_array_free(b_keys, 0);
     return cmp;
 }
 
@@ -641,7 +641,7 @@ size_t opa_value_hash(opa_value *node) {
 }
 
 OPA_INTERNAL
-void opa_value_free(opa_value *node)
+void __opa_value_free(opa_value *node, int deep)
 {
     switch (node->type) // bypass opa_value_type: don't free OPA_STRING_INTERNED
     {
@@ -658,17 +658,30 @@ void opa_value_free(opa_value *node)
         opa_string_free(opa_cast_string(node));
         return;
     case OPA_ARRAY:
-        opa_array_free(opa_cast_array(node));
+        opa_array_free(opa_cast_array(node), deep);
         return;
     case OPA_OBJECT:
-        opa_object_free(opa_cast_object(node));
+        opa_object_free(opa_cast_object(node), deep);
         return;
     case OPA_SET:
-        opa_set_free(opa_cast_set(node));
+        opa_set_free(opa_cast_set(node), deep);
         return;
     }
 }
 
+OPA_INTERNAL
+WASM_EXPORT(opa_value_free)
+void opa_value_free(opa_value *node)
+{
+    __opa_value_free(node, 1);
+}
+
+OPA_INTERNAL
+void opa_value_free_shallow(opa_value *node)
+{
+    __opa_value_free(node, 0);
+}
+
 OPA_INTERNAL
 opa_value *opa_value_merge(opa_value *a, opa_value *b)
 {
@@ -1145,13 +1158,18 @@ void opa_value_number_set_int(opa_value *v, long long i)
 	ret->v.i = i;
 }
 
-void opa_array_free(opa_array_t *arr)
+void opa_array_free(opa_array_t *arr, int deep)
 {
     if (arr->elems != NULL)
     {
         for (size_t i = 0; i < arr->len; i++)
         {
-            opa_free(arr->elems[i].i);
+            if (deep) {
+                opa_value_free(arr->elems[i].i);
+                opa_value_free(arr->elems[i].v);
+            } else {
+                opa_free(arr->elems[i].i);
+            }
         }
 
         opa_free(arr->elems);
@@ -1190,7 +1208,7 @@ void opa_array_sort(opa_array_t *arr, opa_compare_fn cmp_fn)
     }
 }
 
-void __opa_object_buckets_free(opa_object_t *obj)
+void __opa_object_buckets_free(opa_object_t *obj, int deep)
 {
     for (int i = 0; i < obj->n; i++)
     {
@@ -1200,6 +1218,10 @@ void __opa_object_buckets_free(opa_object_t *obj)
         {
             if (prev != NULL)
             {
+                if (deep) {
+                    opa_value_free(prev->k);
+                    opa_value_free(prev->v);
+                }
                 opa_free(prev);
             }
 
@@ -1208,6 +1230,10 @@ void __opa_object_buckets_free(opa_object_t *obj)
 
         if (prev != NULL)
         {
+            if (deep) {
+                opa_value_free(prev->k);
+                opa_value_free(prev->v);
+            }
             opa_free(prev);
         }
     }
@@ -1215,9 +1241,9 @@ void __opa_object_buckets_free(opa_object_t *obj)
     opa_free(obj->buckets);
 }
 
-void opa_object_free(opa_object_t *obj)
+void opa_object_free(opa_object_t *obj, int deep)
 {
-    __opa_object_buckets_free(obj);
+    __opa_object_buckets_free(obj, deep);
     opa_free(obj);
 }
 
@@ -1276,7 +1302,8 @@ void __opa_object_grow(opa_object_t *obj, size_t n) {
 }
 
 OPA_INTERNAL
-void opa_object_insert(opa_object_t *obj, opa_value *k, opa_value *v)
+void __opa_object_insert(opa_object_t *obj, opa_value *k, opa_value *v,
+                         int free_dup_key)
 {
     size_t hash = opa_value_hash(k);
 
@@ -1284,6 +1311,8 @@ void opa_object_insert(opa_object_t *obj, opa_value *k, opa_value *v)
     {
         if (opa_value_compare(curr->k, k) == 0)
         {
+            if (free_dup_key)
+                opa_value_free(k);
             curr->v = v;
             return;
         }
@@ -1293,6 +1322,12 @@ void opa_object_insert(opa_object_t *obj, opa_value *k, opa_value *v)
     __opa_object_insert_elem(obj, __opa_object_elem_alloc(k, v), hash);
 }
 
+OPA_INTERNAL
+void opa_object_insert(opa_object_t *obj, opa_value *k, opa_value *v)
+{
+    __opa_object_insert(obj, k, v, 0);
+}
+
 static void __opa_object_insert_elem(opa_object_t *obj, opa_object_elem_t *new, size_t hash)
 {
     size_t i = hash % obj->n;
@@ -1357,7 +1392,7 @@ opa_object_elem_t *opa_object_get(opa_object_t *obj, opa_value *key)
     return NULL;
 }
 
-void __opa_set_buckets_free(opa_set_t *set)
+void __opa_set_buckets_free(opa_set_t *set, int deep)
 {
     for (int i = 0; i < set->n; i++)
     {
@@ -1367,6 +1402,8 @@ void __opa_set_buckets_free(opa_set_t *set)
         {
             if (prev != NULL)
             {
+                if (deep)
+                    opa_value_free(prev->v);
                 opa_free(prev);
             }
 
@@ -1375,6 +1412,8 @@ void __opa_set_buckets_free(opa_set_t *set)
 
         if (prev != NULL)
         {
+            if (deep)
+                opa_value_free(prev->v);
             opa_free(prev);
         }
     }
@@ -1382,9 +1421,9 @@ void __opa_set_buckets_free(opa_set_t *set)
     opa_free(set->buckets);
 }
 
-void opa_set_free(opa_set_t *set)
+void opa_set_free(opa_set_t *set, int deep)
 {
-    __opa_set_buckets_free(set);
+    __opa_set_buckets_free(set, deep);
     opa_free(set);
 }
 
@@ -1521,6 +1560,19 @@ int _validate_json_path(opa_value *path)
     return path_len;
 }
 
+OPA_INTERNAL
+opa_value *opa_string_copy(opa_string_t *src)
+{
+    char *s = (char *)opa_malloc(src->len);
+
+    for (int i = 0; i < src->len; i++)
+    {
+        s[i] = src->v[i];
+    }
+
+    return opa_string_allocated(s, src->len);
+}
+
 // For the given `data` value set the provided value `v` at
 // the specified `path`. Requires objects for containers,
 // any portion of the path that is missing will be created.
@@ -1554,7 +1606,12 @@ opa_errc opa_value_add_path(opa_value *data, opa_value *path, opa_value *v)
             {
                 case OPA_OBJECT:
                     next = opa_object();
+                    /* REMOVE (left in for readability)
                     opa_object_insert(opa_cast_object(curr), k, next);
+                    */
+                    __opa_object_insert(opa_cast_object(curr),
+                                        opa_string_copy(opa_cast_string(k)),
+                                        next, 1);
                     break;
                 default:
                     return OPA_ERR_INVALID_TYPE;
@@ -1571,7 +1628,11 @@ opa_errc opa_value_add_path(opa_value *data, opa_value *path, opa_value *v)
     switch (curr->type)
     {
         case OPA_OBJECT:
+            /* REMOVE (left in for readability)
             opa_object_insert(opa_cast_object(curr), k, v);
+            */
+            __opa_object_insert(opa_cast_object(curr),
+                                opa_string_copy(opa_cast_string(k)), v, 1);
             break;
         default:
             return OPA_ERR_INVALID_TYPE;
@@ -1629,8 +1690,13 @@ opa_errc opa_value_remove_path(opa_value *data, opa_value *path)
 // be found, or of there's no function index leaf when we've run out
 // of path pieces.
 int opa_lookup(opa_value *mapping, opa_value *path) {
-    int path_len = _validate_json_path(path);
-    if (path_len < 1)
+    if (path == NULL || opa_value_type(path) != OPA_ARRAY)
+    {
+        return 0;
+    }
+
+    int path_len = opa_value_length(path);
+    if (path_len == 0)
     {
         return 0;
     }
diff --git a/wasm/src/value.h b/wasm/src/value.h
index 1bb5b2f913..b5bb7cd3ec 100644
--- a/wasm/src/value.h
+++ b/wasm/src/value.h
@@ -123,6 +123,7 @@ opa_value *opa_value_get(opa_value *node, opa_value *key);
 opa_value *opa_value_iter(opa_value *node, opa_value *prev);
 size_t opa_value_length(opa_value *node);
 void opa_value_free(opa_value *node);
+void opa_value_free_shallow(opa_value *node);
 opa_value *opa_value_merge(opa_value *a, opa_value *b);
 opa_value *opa_value_shallow_copy(opa_value *node);
 opa_value *opa_value_transitive_closure(opa_value *node);
@@ -155,17 +156,17 @@ void opa_number_free(opa_number_t *n);
 
 void opa_string_free(opa_string_t *s);
 
-void opa_array_free(opa_array_t *arr);
+void opa_array_free(opa_array_t *arr, int deep);
 void opa_array_append(opa_array_t *arr, opa_value *v);
 void opa_array_sort(opa_array_t *arr, opa_compare_fn cmp_fn);
 
-void opa_object_free(opa_object_t *obj);
+void opa_object_free(opa_object_t *obj, int deep);
 opa_array_t *opa_object_keys(opa_object_t *obj);
 void opa_object_insert(opa_object_t *obj, opa_value *k, opa_value *v);
 void opa_object_remove(opa_object_t *obj, opa_value *k);
 opa_object_elem_t *opa_object_get(opa_object_t *obj, opa_value *key);
 
-void opa_set_free(opa_set_t *set);
+void opa_set_free(opa_set_t *set, int deep);
 void opa_set_add(opa_set_t *set, opa_value *v);
 opa_set_elem_t *opa_set_get(opa_set_t *set, opa_value *v);
 
diff --git a/wasm/tests/test-glob.cc b/wasm/tests/test-glob.cc
index e349bdc80a..504aeaabf5 100644
--- a/wasm/tests/test-glob.cc
+++ b/wasm/tests/test-glob.cc
@@ -234,6 +234,7 @@ void test_glob_translate()
         for (int i = 0; i < sizeof(delimiters)/sizeof(const char*); i++) { \
             v.push_back(delimiters[i]);                                 \
         }                                                               \
+        if (v.empty()) { v.push_back(std::string(".")); }               \
         glob_translate(pattern, strlen(pattern), v, &re2);              \
         test_str_eq(test_case, expected, re2.c_str());                  \
         re2::RE2::Options options;                                      \
diff --git a/wasm/tests/test.c b/wasm/tests/test.c
index 60033bbb41..9bea657e4a 100644
--- a/wasm/tests/test.c
+++ b/wasm/tests/test.c
@@ -223,6 +223,37 @@ void test_opa_free(void)
     test("heap ptr", base == opa_heap_ptr_get());
 }
 
+WASM_EXPORT(test_opa_heap_blocks_stash)
+void test_opa_heap_blocks_stash(void)
+{
+    reset_heap();
+
+    unsigned int base = opa_heap_ptr_get();
+    void *p1;
+    void *p2;
+
+    // check basic save / restore
+    p1 = opa_malloc(128);
+    p2 = opa_malloc(128);
+    opa_free(p1);
+    opa_heap_blocks_stash();
+    test("free blocks", opa_heap_free_blocks() == 0);
+    opa_heap_blocks_restore();
+    test("free blocks", opa_heap_free_blocks() == 1);
+    opa_free(p2);
+    test("heap ptr", base == opa_heap_ptr_get());
+
+    // check opa_heap_stash_clear()
+    p1 = opa_malloc(128);
+    p2 = opa_malloc(128);
+    opa_free(p1);
+    opa_heap_blocks_stash();
+    opa_heap_stash_clear();
+    opa_heap_blocks_restore();
+    test("free blocks", opa_heap_free_blocks() == 0);
+    opa_heap_ptr_set(base); // p2 is dangling, but we'll discard it
+}
+
 WASM_EXPORT(test_opa_memoize)
 void test_opa_memoize(void)
 {
@@ -896,6 +927,149 @@ void test_opa_value_parse(void)
     test("empty whitespace", value_parse_crunch("set(   )", empty_set));
 }
 
+WASM_EXPORT(test_opa_value_free)
+void test_opa_value_free(void)
+{
+	char *s;
+	opa_value *ret;
+	int i;
+
+	reset_heap();
+	unsigned int base;
+
+	// This is tricky because some of these dynamic allocations
+	// leave memory in the heap because the blocks they allocate
+	// come from different lists.  If they don't get freed in
+	// reverse order of allocation, the heap pointer won't go
+	// down.  Some of these objects don't free the sub-objects
+	// in reverse order of allocation.
+	//
+	// However, what we can do is
+	//  * do a small number of parse/free combinations to prime the heap
+	//  * grab the new heap pointer
+	//  * do a few more parse/free cycles checking each time that the
+	//    pointer doesn't increase.
+	//
+	// This isn't perfect because for larger, variable-sized blocks
+	// order of allocation matters and can lead to the heap bumping
+	// up a bit although this would stabalize in the long run.  But
+	// to a void this, keep the value elements (strings, numbers, ...)
+	// small to keep the allocations in the fixed-sized block regions.
+
+	// Null test
+	s = "null";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// Boolean test
+	s = "true";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// Integer test
+	s = "0";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// String test
+	s = "\"hello\"";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// Array test
+	s = "[\"a\", \"b\", \"c\"]";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// Object test
+	s = "{\"a\": 1, \"b\": 2}";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// Set test
+	//
+	// The bucket sizes seem to be just enough to mix elements,
+	// buckets and set objects.  This makes one parse/free
+	// cycle insufficient to stabalize the heap.  So do two
+	// instead before validating that the heap will no longer
+	// increase.
+	s = "{\"a\", \"b\", \"c\"}";
+	for (i = 0; i < 2; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+	}
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+
+	// Compound object / array test
+	s = "{[1,2],[3,4]}";
+	ret = opa_value_parse(s, opa_strlen(s));
+	test("parse", ret != NULL);
+	opa_value_free(ret);
+	base = opa_heap_ptr_get();
+	for (i = 0; i < 5; i++) {
+		ret = opa_value_parse(s, opa_strlen(s));
+		test("parse", ret != NULL);
+		opa_value_free(ret);
+		test("heap ptr", base == opa_heap_ptr_get());
+	}
+}
+
+
 WASM_EXPORT(test_opa_json_parse_memory_ownership)
 void test_opa_json_parse_memory_ownership(void)
 {
@@ -1454,25 +1628,36 @@ void test_array(void)
     test("array_slice", r->len == 2 &&
          opa_value_compare(r->elems[0].v, opa_number_int(1)) == 0 &&
          opa_value_compare(r->elems[1].v, opa_number_int(2)) == 0);
+    
+    opa_array_t *arr3 = opa_cast_array(opa_array());
+    opa_array_append(arr3, opa_number_int(0));
+    opa_array_append(arr3, opa_number_int(1));
+    opa_array_append(arr3, opa_number_int(2));
+
+    r = opa_cast_array(opa_array_reverse(&arr3->hdr));
+    test("array_reverse", r->len == 3 &&
+         opa_value_compare(r->elems[0].v, opa_number_int(2)) == 0 &&
+         opa_value_compare(r->elems[1].v, opa_number_int(1)) == 0 &&
+         opa_value_compare(r->elems[2].v, opa_number_int(0)) == 0);
 }
 
 WASM_EXPORT(test_types)
 void test_types(void)
 {
     test("is_number", opa_value_compare(opa_types_is_number(opa_number_int(0)), opa_boolean(true)) == 0);
-    test("is_number", opa_types_is_number(opa_null()) == NULL);
+    test("is_number", opa_value_compare(opa_types_is_number(opa_null()), opa_boolean(false)) == 0);
     test("is_string", opa_value_compare(opa_types_is_string(opa_string("a", 1)), opa_boolean(true)) == 0);
-    test("is_string", opa_types_is_string(opa_null()) == NULL);
+    test("is_string", opa_value_compare(opa_types_is_string(opa_null()), opa_boolean(false)) == 0);
     test("is_boolean", opa_value_compare(opa_types_is_boolean(opa_boolean(true)), opa_boolean(true)) == 0);
-    test("is_boolean", opa_types_is_boolean(opa_null()) == NULL);
+    test("is_boolean", opa_value_compare(opa_types_is_boolean(opa_null()), opa_boolean(false)) == 0);
     test("is_array", opa_value_compare(opa_types_is_array(opa_array()), opa_boolean(true)) == 0);
-    test("is_array", opa_types_is_array(opa_null()) == NULL);
+    test("is_array", opa_value_compare(opa_types_is_array(opa_null()), opa_boolean(false)) == 0);
     test("is_set", opa_value_compare(opa_types_is_set(opa_set()), opa_boolean(true)) == 0);
-    test("is_set", opa_types_is_set(opa_null()) == NULL);
+    test("is_set", opa_value_compare(opa_types_is_set(opa_null()), opa_boolean(false)) == 0);
     test("is_object", opa_value_compare(opa_types_is_object(opa_object()), opa_boolean(true)) == 0);
-    test("is_object", opa_types_is_object(opa_null()) == NULL);
+    test("is_object", opa_value_compare(opa_types_is_object(opa_null()), opa_boolean(false)) == 0);
     test("is_null", opa_value_compare(opa_types_is_null(opa_null()), opa_boolean(true)) == 0);
-    test("is_null", opa_types_is_null(opa_number_int(0)) == NULL);
+    test("is_null", opa_value_compare(opa_types_is_null(opa_number_int(0)), opa_boolean(false)) == 0);
 
     test("name/null", opa_value_compare(opa_types_name(opa_null()), opa_string("null", 4)) == 0);
     test("name/boolean", opa_value_compare(opa_types_name(opa_boolean(true)), opa_string("boolean", 7)) == 0);
@@ -1779,6 +1964,8 @@ void test_json(void)
 {
     test("json/marshal", opa_value_compare(opa_json_marshal(opa_string_terminated("string")), opa_string_terminated("\"string\"")) == 0);
     test("json/unmarshal", opa_value_compare(opa_json_unmarshal(opa_string_terminated("\"string\"")), opa_string_terminated("string")) == 0);
+    test("json/is_valid_true", opa_cast_boolean(opa_json_is_valid(opa_string_terminated("\"string\"")))->v);
+    test("json/is_valid_false", !opa_cast_boolean(opa_json_is_valid(opa_string_terminated("\"string")))->v);
 }
 
 WASM_EXPORT(test_object)
@@ -1815,6 +2002,73 @@ void test_object(void)
     test("object/filter (array keys)", opa_value_compare(builtin_object_filter(&obj->hdr, &arr_keys->hdr), &expected->hdr) == 0);
 }
 
+WASM_EXPORT(test_object_keys)
+void test_object_keys(void)
+{
+    opa_object_t *obj1 = opa_cast_object(opa_object());
+    opa_object_insert(obj1, opa_string_terminated("a"), opa_number_int(1));
+    opa_object_insert(obj1, opa_string_terminated("b"), opa_number_int(2));
+    opa_object_insert(obj1, opa_string_terminated("c"), opa_number_int(3));
+
+    opa_set_t *expected_keys1 = opa_cast_set(opa_set());
+    opa_set_add(expected_keys1, opa_string_terminated("a"));
+    opa_set_add(expected_keys1, opa_string_terminated("b"));
+    opa_set_add(expected_keys1, opa_string_terminated("c"));
+
+    test("object/keys (string keys)", opa_value_compare(builtin_object_keys(&obj1->hdr), &expected_keys1->hdr) == 0);
+
+    opa_object_t *obj2 = opa_cast_object(opa_object());
+    opa_object_insert(obj2, opa_number_int(1), opa_number_int(2));
+    opa_object_insert(obj2, opa_number_int(3), opa_number_int(4));
+
+    opa_set_t *expected_keys2 = opa_cast_set(opa_set());
+    opa_set_add(expected_keys2, opa_number_int(1));
+    opa_set_add(expected_keys2, opa_number_int(3));
+
+    test("object/keys (number keys)", opa_value_compare(builtin_object_keys(&obj2->hdr), &expected_keys2->hdr) == 0);
+
+    opa_set_t *set_key = opa_cast_set(opa_set());
+    opa_set_add(set_key, opa_number_int(1));
+    opa_set_add(set_key, opa_number_int(2));
+
+    opa_object_t *obj3 = opa_cast_object(opa_object());
+    opa_object_insert(obj3, &set_key->hdr, opa_number_int(1));
+
+    opa_set_t *expected_keys3 = opa_cast_set(opa_set());
+    opa_set_add(expected_keys3, &set_key->hdr);
+
+    test("object/keys (set keys)", opa_value_compare(builtin_object_keys(&obj3->hdr), &expected_keys3->hdr) == 0);
+
+    opa_object_t *object_key = opa_cast_object(opa_object());
+    opa_object_insert(object_key, opa_string_terminated("a"), opa_number_int(1));
+
+    opa_object_t *obj4 = opa_cast_object(opa_object());
+    opa_object_insert(obj4, &object_key->hdr, opa_number_int(1));
+
+    opa_set_t *expected_keys4 = opa_cast_set(opa_set());
+    opa_set_add(expected_keys4, &object_key->hdr);
+
+    test("object/keys (object keys)", opa_value_compare(builtin_object_keys(&obj4->hdr), &expected_keys4->hdr) == 0);
+
+    opa_array_t *array_key = opa_cast_array(opa_array());
+    opa_array_append(array_key, opa_number_int(1));
+    opa_array_append(array_key, opa_number_int(2));
+
+    opa_object_t *obj5 = opa_cast_object(opa_object());
+    opa_object_insert(obj5, &array_key->hdr, opa_number_int(1));
+
+    opa_set_t *expected_keys5 = opa_cast_set(opa_set());
+    opa_set_add(expected_keys5, &array_key->hdr);
+
+    test("object/keys (array keys)", opa_value_compare(builtin_object_keys(&obj5->hdr), &expected_keys5->hdr) == 0);
+
+    opa_object_t *obj6 = opa_cast_object(opa_object());
+    opa_set_t *expected_keys6 = opa_cast_set(opa_set());
+    test("object/keys (empty)", opa_value_compare(builtin_object_keys(&obj6->hdr), &expected_keys6->hdr) == 0);
+
+    test("object/keys (null on non-object)", opa_value_compare(builtin_object_keys(opa_number_int(3)), NULL) == 0);
+}
+
 WASM_EXPORT(test_object_remove)
 void test_object_remove(void)
 {
@@ -2474,7 +2728,7 @@ WASM_EXPORT(test_builtin_graph_reachable)
 void test_builtin_graph_reachable(void)
 {
 
-    test("reachable/malformed graph", opa_value_compare(builtin_graph_reachable(opa_set(), opa_set()), opa_set()) == 0);
+    test("reachable/malformed graph", opa_value_compare(builtin_graph_reachable(opa_set(), opa_set()), NULL) == 0);
 
     opa_object_t *graph1 = opa_cast_object(opa_object());
     opa_set_t *initial1 = opa_cast_set(opa_set());
@@ -2564,7 +2818,7 @@ void test_builtin_graph_reachable(void)
 
     test("reachable/arrays", opa_value_compare(builtin_graph_reachable(&graph3->hdr, &initial3->hdr), &expected3->hdr) == 0);
 
-    test("reachable/malformed initial nodes", opa_value_compare(builtin_graph_reachable(&graph3->hdr, opa_string_terminated("foo")), opa_set()) == 0);
+    test("reachable/malformed initial nodes", opa_value_compare(builtin_graph_reachable(&graph3->hdr, opa_string_terminated("foo")), NULL) == 0);
 
     // graph -> {"a": null}
     opa_object_t *graph4 = opa_cast_object(opa_object());
@@ -2579,6 +2833,104 @@ void test_builtin_graph_reachable(void)
 WASM_EXPORT(test_strings)
 void test_strings(void)
 {
+    opa_array_t *any_prefix_match_string_arr_1 = opa_cast_array(opa_array());
+    opa_array_append(any_prefix_match_string_arr_1, opa_string_terminated("a/b/c"));
+    opa_array_append(any_prefix_match_string_arr_1, opa_string_terminated("e/f/g"));
+
+    opa_array_t *any_prefix_match_prefixes_arr_11 = opa_cast_array(opa_array());
+    opa_array_append(any_prefix_match_prefixes_arr_11, opa_string_terminated("g/b"));
+    opa_array_append(any_prefix_match_prefixes_arr_11, opa_string_terminated("a/"));
+
+    opa_array_t *any_prefix_match_prefixes_arr_12 = opa_cast_array(opa_array());
+    opa_array_append(any_prefix_match_prefixes_arr_12, opa_string_terminated("g/b"));
+    opa_array_append(any_prefix_match_prefixes_arr_12, opa_string_terminated("b/"));
+
+    opa_array_t *any_prefix_match_string_arr_2 = opa_cast_array(opa_array());
+    opa_array_t *any_prefix_match_prefixes_arr_2 = opa_cast_array(opa_array());
+
+    opa_set_t *any_prefix_match_string_set_1 = opa_cast_set(opa_set());
+    opa_set_add(any_prefix_match_string_set_1, opa_string_terminated("a/b/c"));
+    opa_set_add(any_prefix_match_string_set_1, opa_string_terminated("e/f/g"));
+
+    opa_set_t *any_prefix_match_prefixes_set_11 = opa_cast_set(opa_set());
+    opa_set_add(any_prefix_match_prefixes_set_11, opa_string_terminated("g/b"));
+    opa_set_add(any_prefix_match_prefixes_set_11, opa_string_terminated("a/"));
+
+    opa_set_t *any_prefix_match_prefixes_set_12 = opa_cast_set(opa_set());
+    opa_set_add(any_prefix_match_prefixes_set_12, opa_string_terminated("g/b"));
+    opa_set_add(any_prefix_match_prefixes_set_12, opa_string_terminated("b/"));
+
+    opa_set_t *any_prefix_match_string_set_2 = opa_cast_set(opa_set());
+    opa_set_t *any_prefix_match_prefixes_set_2 = opa_cast_set(opa_set());
+
+    test("any_prefix_match/__", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated(""), opa_string_terminated("")), opa_boolean(true)) == 0);
+    test("any_prefix_match/_a", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated(""), opa_string_terminated("a")), opa_boolean(false)) == 0);
+    test("any_prefix_match/a_", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("a"), opa_string_terminated("")), opa_boolean(true)) == 0);
+    test("any_prefix_match/aa", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("a"), opa_string_terminated("a")), opa_boolean(true)) == 0);
+    test("any_prefix_match/ab", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("a"), opa_string_terminated("b")), opa_boolean(false)) == 0);
+    test("any_prefix_match/aab", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("a"), opa_string_terminated("ab")), opa_boolean(false)) == 0);
+    test("any_prefix_match/aba", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("ab"), opa_string_terminated("a")), opa_boolean(true)) == 0);
+    test("any_prefix_match/aab", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("aa"), opa_string_terminated("b")), opa_boolean(false)) == 0);
+    test("any_prefix_match/abab", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("ab"), opa_string_terminated("ab")), opa_boolean(true)) == 0);
+    test("any_prefix_match/abaa", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("ab"), opa_string_terminated("aa")), opa_boolean(false)) == 0);
+    test("any_prefix_match/abcab", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("abc"), opa_string_terminated("ab")), opa_boolean(true)) == 0);
+    test("any_prefix_match/abcac", opa_value_compare(opa_strings_any_prefix_match(opa_string_terminated("abc"), opa_string_terminated("ac")), opa_boolean(false)) == 0);
+    test("any_prefix_match/arr11", opa_value_compare(opa_strings_any_prefix_match(&any_prefix_match_string_arr_1->hdr, &any_prefix_match_prefixes_arr_11->hdr), opa_boolean(true)) == 0);
+    test("any_prefix_match/arr12", opa_value_compare(opa_strings_any_prefix_match(&any_prefix_match_string_arr_1->hdr, &any_prefix_match_prefixes_arr_12->hdr), opa_boolean(false)) == 0);
+    test("any_prefix_match/arr2", opa_value_compare(opa_strings_any_prefix_match(&any_prefix_match_string_arr_2->hdr, &any_prefix_match_prefixes_arr_2->hdr), opa_boolean(false)) == 0);
+    test("any_prefix_match/set11", opa_value_compare(opa_strings_any_prefix_match(&any_prefix_match_string_set_1->hdr, &any_prefix_match_prefixes_set_11->hdr), opa_boolean(true)) == 0);
+    test("any_prefix_match/set12", opa_value_compare(opa_strings_any_prefix_match(&any_prefix_match_string_set_1->hdr, &any_prefix_match_prefixes_set_12->hdr), opa_boolean(false)) == 0);
+    test("any_prefix_match/set2", opa_value_compare(opa_strings_any_prefix_match(&any_prefix_match_string_set_2->hdr, &any_prefix_match_prefixes_set_2->hdr), opa_boolean(false)) == 0);
+
+    opa_array_t *any_suffix_match_string_arr_1 = opa_cast_array(opa_array());
+    opa_array_append(any_suffix_match_string_arr_1, opa_string_terminated("a/b/c"));
+    opa_array_append(any_suffix_match_string_arr_1, opa_string_terminated("e/f/g"));
+
+    opa_array_t *any_suffix_match_suffixes_arr_11 = opa_cast_array(opa_array());
+    opa_array_append(any_suffix_match_suffixes_arr_11, opa_string_terminated("g/b"));
+    opa_array_append(any_suffix_match_suffixes_arr_11, opa_string_terminated("/c"));
+
+    opa_array_t *any_suffix_match_suffixes_arr_12 = opa_cast_array(opa_array());
+    opa_array_append(any_suffix_match_suffixes_arr_12, opa_string_terminated("g/b"));
+    opa_array_append(any_suffix_match_suffixes_arr_12, opa_string_terminated("/b"));
+
+    opa_array_t *any_suffix_match_string_arr_2 = opa_cast_array(opa_array());
+    opa_array_t *any_suffix_match_suffixes_arr_2 = opa_cast_array(opa_array());
+
+    opa_set_t *any_suffix_match_string_set_1 = opa_cast_set(opa_set());
+    opa_set_add(any_suffix_match_string_set_1, opa_string_terminated("a/b/c"));
+    opa_set_add(any_suffix_match_string_set_1, opa_string_terminated("e/f/g"));
+
+    opa_set_t *any_suffix_match_suffixes_set_11 = opa_cast_set(opa_set());
+    opa_set_add(any_suffix_match_suffixes_set_11, opa_string_terminated("g/b"));
+    opa_set_add(any_suffix_match_suffixes_set_11, opa_string_terminated("/c"));
+
+    opa_set_t *any_suffix_match_suffixes_set_12 = opa_cast_set(opa_set());
+    opa_set_add(any_suffix_match_suffixes_set_12, opa_string_terminated("g/b"));
+    opa_set_add(any_suffix_match_suffixes_set_12, opa_string_terminated("/b"));
+
+    opa_set_t *any_suffix_match_string_set_2 = opa_cast_set(opa_set());
+    opa_set_t *any_suffix_match_suffixes_set_2 = opa_cast_set(opa_set());
+
+    test("any_suffix_match/__", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated(""), opa_string_terminated("")), opa_boolean(true)) == 0);
+    test("any_suffix_match/_a", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated(""), opa_string_terminated("a")), opa_boolean(false)) == 0);
+    test("any_suffix_match/a_", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("a"), opa_string_terminated("")), opa_boolean(true)) == 0);
+    test("any_suffix_match/aa", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("a"), opa_string_terminated("a")), opa_boolean(true)) == 0);
+    test("any_suffix_match/ab", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("a"), opa_string_terminated("b")), opa_boolean(false)) == 0);
+    test("any_suffix_match/aab", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("a"), opa_string_terminated("ab")), opa_boolean(false)) == 0);
+    test("any_suffix_match/abb", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("ab"), opa_string_terminated("b")), opa_boolean(true)) == 0);
+    test("any_suffix_match/aab", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("aa"), opa_string_terminated("b")), opa_boolean(false)) == 0);
+    test("any_suffix_match/abab", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("ab"), opa_string_terminated("ab")), opa_boolean(true)) == 0);
+    test("any_suffix_match/abaa", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("ab"), opa_string_terminated("aa")), opa_boolean(false)) == 0);
+    test("any_suffix_match/abcbc", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("abc"), opa_string_terminated("bc")), opa_boolean(true)) == 0);
+    test("any_suffix_match/abcbd", opa_value_compare(opa_strings_any_suffix_match(opa_string_terminated("abc"), opa_string_terminated("bd")), opa_boolean(false)) == 0);
+    test("any_suffix_match/arr11", opa_value_compare(opa_strings_any_suffix_match(&any_suffix_match_string_arr_1->hdr, &any_suffix_match_suffixes_arr_11->hdr), opa_boolean(true)) == 0);
+    test("any_suffix_match/arr12", opa_value_compare(opa_strings_any_suffix_match(&any_suffix_match_string_arr_1->hdr, &any_suffix_match_suffixes_arr_12->hdr), opa_boolean(false)) == 0);
+    test("any_suffix_match/arr2", opa_value_compare(opa_strings_any_suffix_match(&any_suffix_match_string_arr_2->hdr, &any_suffix_match_suffixes_arr_2->hdr), opa_boolean(false)) == 0);
+    test("any_suffix_match/set11", opa_value_compare(opa_strings_any_suffix_match(&any_suffix_match_string_set_1->hdr, &any_suffix_match_suffixes_set_11->hdr), opa_boolean(true)) == 0);
+    test("any_suffix_match/set12", opa_value_compare(opa_strings_any_suffix_match(&any_suffix_match_string_set_1->hdr, &any_suffix_match_suffixes_set_12->hdr), opa_boolean(false)) == 0);
+    test("any_suffix_match/set2", opa_value_compare(opa_strings_any_suffix_match(&any_suffix_match_string_set_2->hdr, &any_suffix_match_suffixes_set_2->hdr), opa_boolean(false)) == 0);
+
     opa_value *join = opa_string_terminated("--");
 
     opa_array_t *arr0 = opa_cast_array(opa_array());
@@ -2679,6 +3031,10 @@ void test_strings(void)
     test("replace/cacab", opa_value_compare(opa_strings_replace(opa_string_terminated("cac"), opa_string_terminated("a"), opa_string_terminated("b")), opa_string_terminated("cbc")) == 0);
     test("replace/cacabd", opa_value_compare(opa_strings_replace(opa_string_terminated("cac"), opa_string_terminated("a"), opa_string_terminated("bd")), opa_string_terminated("cbdc")) == 0);
 
+    test("reverse/abc", opa_value_compare(opa_strings_reverse(opa_string_terminated("abc")), opa_string_terminated("cba")) == 0);
+    test("reverse/unicode", opa_value_compare(opa_strings_reverse(opa_string_terminated("1😀𝛾")), opa_string_terminated("𝛾😀1"))== 0);
+    test("reverse/___", opa_value_compare(opa_strings_reverse(opa_string_terminated("")), opa_string_terminated("")) == 0);
+
     opa_object_t *obj2 = opa_cast_object(opa_object());
     opa_object_insert(obj2, opa_string_terminated("a"), opa_string_terminated("b"));
     opa_object_insert(obj2, opa_string_terminated("c"), opa_string_terminated("d"));